wifi: update bcm driver to 101.10.240 to support android r [1/2]
authorLiang Ji <liang.ji@amlogic.com>
Wed, 15 Jul 2020 12:34:27 +0000 (20:34 +0800)
committerLiang Ji <liang.ji@amlogic.com>
Wed, 15 Jul 2020 12:34:58 +0000 (20:34 +0800)
PD#SWPL-28939

Problem:
1.sta setMac let connect key fail
2.wlan1 setMac error let softap open fail

Solution:
1. update to new driver to support MAC Randomization feature

Verify:
deadpool

Signed-off-by: Liang Ji <liang.ji@amlogic.com>
Change-Id: I42b5b31f84b35cbe5261bec03a24740d7113769e

232 files changed:
bcmdhd.101.10.240.x/Kconfig [new file with mode: 0644]
bcmdhd.101.10.240.x/Makefile [new file with mode: 0644]
bcmdhd.101.10.240.x/aiutils.c [new file with mode: 0644]
bcmdhd.101.10.240.x/bcm_app_utils.c [new file with mode: 0644]
bcmdhd.101.10.240.x/bcm_l2_filter.c [new file with mode: 0644]
bcmdhd.101.10.240.x/bcmbloom.c [new file with mode: 0644]
bcmdhd.101.10.240.x/bcmevent.c [new file with mode: 0644]
bcmdhd.101.10.240.x/bcmsdh.c [new file with mode: 0644]
bcmdhd.101.10.240.x/bcmsdh_linux.c [new file with mode: 0644]
bcmdhd.101.10.240.x/bcmsdh_sdmmc.c [new file with mode: 0644]
bcmdhd.101.10.240.x/bcmsdh_sdmmc_linux.c [new file with mode: 0644]
bcmdhd.101.10.240.x/bcmsdstd.h [new file with mode: 0644]
bcmdhd.101.10.240.x/bcmstdlib_s.c [new file with mode: 0644]
bcmdhd.101.10.240.x/bcmutils.c [new file with mode: 0644]
bcmdhd.101.10.240.x/bcmwifi_channels.c [new file with mode: 0644]
bcmdhd.101.10.240.x/bcmxtlv.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dbus.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dbus_usb.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dbus_usb_linux.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_bitpack.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_bitpack.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_bus.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_ccode.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_cdc.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_cfg80211.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_cfg80211.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_common.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_config.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_config.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_csi.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_csi.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_custom_cis.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_custom_exynos.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_custom_gpio.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_custom_hikey.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_custom_memprealloc.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_custom_msm.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_custom_sec.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_dbg.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_dbg_ring.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_dbg_ring.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_debug.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_debug.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_debug_linux.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_event_log_filter.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_event_log_filter.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_flowring.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_flowring.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_gpio.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_ip.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_ip.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_linux.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_linux.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_linux_exportfs.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_linux_lb.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_linux_pktdump.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_linux_pktdump.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_linux_platdev.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_linux_priv.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_linux_sched.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_linux_sock_qos.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_linux_wq.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_linux_wq.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_mschdbg.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_mschdbg.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_msgbuf.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_pcie.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_pcie.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_pcie_linux.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_pktlog.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_pktlog.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_pno.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_pno.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_proto.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_qos_algo.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_rtt.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_rtt.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_sdio.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_sec_feature.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_static_buf.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_statlog.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_statlog.h [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_wlfc.c [new file with mode: 0644]
bcmdhd.101.10.240.x/dhd_wlfc.h [new file with mode: 0644]
bcmdhd.101.10.240.x/frag.c [new file with mode: 0644]
bcmdhd.101.10.240.x/frag.h [new file with mode: 0644]
bcmdhd.101.10.240.x/hnd_pktpool.c [new file with mode: 0644]
bcmdhd.101.10.240.x/hnd_pktq.c [new file with mode: 0644]
bcmdhd.101.10.240.x/hndpmu.c [new file with mode: 0644]
bcmdhd.101.10.240.x/include/802.11.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/802.11ax.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/802.11s.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/802.1d.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/802.3.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/aidmp.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcm_l2_filter.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcm_mpool_pub.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcm_ring.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmarp.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmbloom.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmcdc.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmdefs.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmdevs.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmdevs_legacy.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmdhcp.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmendian.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmerror.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmeth.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmevent.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmicmp.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmiov.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmip.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmipv6.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmmsgbuf.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmpcie.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmproto.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmrand.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmsdbus.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmsdh.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmsdh_sdmmc.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmsdpcm.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmstdlib_s.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmtcp.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmtlv.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmudp.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmutils.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmwifi_channels.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmwifi_rates.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/bcmwifi_rspec.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/brcm_nl80211.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/dbus.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/dhd_daemon.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/dhdioctl.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/dngl_stats.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/dnglevent.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/dnglioctl.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/eap.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/eapol.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/epivers.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/etd.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/ethernet.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/event_log.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/event_log_payload.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/event_log_set.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/event_log_tag.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/event_trace.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/fils.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/hnd_armtrap.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/hnd_cons.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/hnd_debug.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/hnd_pktpool.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/hnd_pktq.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/hnd_trap.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/hndchipc.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/hndlhl.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/hndoobr.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/hndpmu.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/hndsoc.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/linux_osl.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/linux_pkt.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/linuxver.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/lpflags.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/mbo.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/msgtrace.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/nan.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/osl.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/osl_decl.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/osl_ext.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/p2p.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/packed_section_end.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/packed_section_start.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/pcicfg.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/pcie_core.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/sbchipc.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/sbconfig.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/sbgci.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/sbhndarm.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/sbhnddma.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/sbpcmcia.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/sbsdio.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/sbsdpcmdev.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/sbsocram.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/sbsysmem.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/sdio.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/sdioh.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/sdiovar.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/siutils.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/typedefs.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/usbrdl.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/vlan.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/wl_bam.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/wl_bigdata.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/wldev_common.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/wlfc_proto.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/wlioctl.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/wlioctl_defs.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/wlioctl_utils.h [new file with mode: 0644]
bcmdhd.101.10.240.x/include/wpa.h [new file with mode: 0644]
bcmdhd.101.10.240.x/linux_osl.c [new file with mode: 0644]
bcmdhd.101.10.240.x/linux_osl_priv.h [new file with mode: 0644]
bcmdhd.101.10.240.x/linux_pkt.c [new file with mode: 0644]
bcmdhd.101.10.240.x/pcie_core.c [new file with mode: 0644]
bcmdhd.101.10.240.x/sbutils.c [new file with mode: 0644]
bcmdhd.101.10.240.x/siutils.c [new file with mode: 0644]
bcmdhd.101.10.240.x/siutils_priv.h [new file with mode: 0644]
bcmdhd.101.10.240.x/wifi_stats.h [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_android.c [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_android.h [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_android_ext.c [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_bam.c [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_bigdata.c [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_cfg80211.c [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_cfg80211.h [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_cfg_btcoex.c [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_cfgnan.c [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_cfgnan.h [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_cfgp2p.c [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_cfgp2p.h [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_cfgscan.c [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_cfgscan.h [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_cfgvendor.c [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_cfgvendor.h [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_escan.c [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_escan.h [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_event.c [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_iw.c [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_iw.h [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_linux_mon.c [new file with mode: 0644]
bcmdhd.101.10.240.x/wl_roam.c [new file with mode: 0644]
bcmdhd.101.10.240.x/wlc_types.h [new file with mode: 0644]
bcmdhd.101.10.240.x/wldev_common.c [new file with mode: 0644]

diff --git a/bcmdhd.101.10.240.x/Kconfig b/bcmdhd.101.10.240.x/Kconfig
new file mode 100644 (file)
index 0000000..f49ae76
--- /dev/null
@@ -0,0 +1,61 @@
+config BCMDHD
+       tristate "Broadcom FullMAC wireless cards support"
+       ---help---
+         This module adds support for wireless adapters based on
+         Broadcom FullMAC chipset.
+
+config BCMDHD_FW_PATH
+       depends on BCMDHD
+       string "Firmware path"
+       default "/system/etc/firmware/fw_bcmdhd.bin"
+       ---help---
+         Path to the firmware file.
+
+config BCMDHD_NVRAM_PATH
+       depends on BCMDHD
+       string "NVRAM path"
+       default "/system/etc/firmware/nvram.txt"
+       ---help---
+         Path to the calibration file.
+
+config BCMDHD_WEXT
+       bool "Enable WEXT support"
+       depends on BCMDHD && CFG80211 = n
+       select WIRELESS_EXT
+       select WEXT_PRIV
+       help
+         Enables WEXT support
+
+choice
+       prompt "Enable Chip Interface"
+       depends on BCMDHD
+       ---help---
+               Enable Chip Interface.
+config BCMDHD_SDIO
+               bool "SDIO bus interface support"
+               depends on BCMDHD && MMC
+config BCMDHD_PCIE
+               bool "PCIe bus interface support"
+               depends on BCMDHD && PCI
+config BCMDHD_USB
+               bool "USB bus interface support"
+               depends on BCMDHD && USB
+endchoice
+
+choice
+       depends on BCMDHD && BCMDHD_SDIO
+       prompt "Interrupt type"
+       ---help---
+               Interrupt type
+config BCMDHD_OOB
+       depends on BCMDHD && BCMDHD_SDIO
+       bool "Out-of-Band Interrupt"
+       default y
+       ---help---
+               Interrupt from WL_HOST_WAKE.
+config BCMDHD_SDIO_IRQ
+       depends on BCMDHD && BCMDHD_SDIO
+       bool "In-Band Interrupt"
+       ---help---
+         Interrupt from SDIO DAT[1]
+endchoice
diff --git a/bcmdhd.101.10.240.x/Makefile b/bcmdhd.101.10.240.x/Makefile
new file mode 100644 (file)
index 0000000..8177ba7
--- /dev/null
@@ -0,0 +1,264 @@
+# bcmdhd
+
+# if not confiure pci mode, we use sdio mode as default
+ifeq ($(CONFIG_BCMDHD_PCIE),)
+$(info bcm SDIO driver configured)
+CONFIG_DHD_USE_STATIC_BUF := y
+endif
+
+ifeq ($(CONFIG_BCMDHD_SDIO),y)
+MODULE_NAME := dhd
+else
+ifeq ($(CONFIG_BCMDHD_USB),y)
+MODULE_NAME := bcmdhd
+else
+MODULE_NAME := dhdpci
+endif
+endif
+#CONFIG_BCMDHD := m
+#CONFIG_BCMDHD_SDIO := y
+#CONFIG_BCMDHD_PCIE := y
+#CONFIG_BCMDHD_USB := y
+
+#CONFIG_BCMDHD_CUSB := y
+CONFIG_BCMDHD_PROPTXSTATUS := y
+#CONFIG_BCMDHD_DEBUG := y
+
+CONFIG_MACH_PLATFORM := y
+#CONFIG_BCMDHD_DTS := y
+
+export CONFIG_BCMDHD = m
+export CONFIG_BCMDHD_OOB = y
+export CONFIG_VTS_SUPPORT = y
+
+ifndef CONFIG_KASAN
+       KBUILD_CFLAGS_MODULE += -Wframe-larger-than=3000
+endif
+
+DHDCFLAGS = -Wall -Wstrict-prototypes -Dlinux -DBCMDRIVER                 \
+       -Wno-maybe-uninitialized -Werror                                      \
+       -DBCMDONGLEHOST -DBCMDMA32 -DBCMFILEIMAGE                             \
+       -DDHDTHREAD -DDHD_DEBUG -DSHOW_EVENTS -DBCMDBG -DGET_OTP_MAC_ENABLE   \
+       -DWIFI_ACT_FRAME -DARP_OFFLOAD_SUPPORT -DSUPPORT_PM2_ONLY             \
+       -DKEEP_ALIVE -DPKT_FILTER_SUPPORT -DDHDTCPACK_SUPPRESS                \
+       -DDHD_DONOT_FORWARD_BCMEVENT_AS_NETWORK_PKT                           \
+       -DMULTIPLE_SUPPLICANT -DTSQ_MULTIPLIER -DMFP -DDHD_8021X_DUMP         \
+       -DPOWERUP_MAX_RETRY=0 -DIFACE_HANG_FORCE_DEV_CLOSE -DWAIT_DEQUEUE     \
+       -DWL_EXT_IAPSTA -DWL_ESCAN -DCCODE_LIST                               \
+       -DENABLE_INSMOD_NO_FW_LOAD                                            \
+       -I$(src) -I$(src)/include
+
+DHDOFILES = aiutils.o siutils.o sbutils.o bcmutils.o bcmwifi_channels.o   \
+       dhd_linux.o dhd_linux_platdev.o dhd_linux_sched.o dhd_pno.o           \
+       dhd_common.o dhd_ip.o dhd_linux_wq.o dhd_custom_gpio.o                \
+       bcmevent.o hndpmu.o linux_osl.o wldev_common.o wl_android.o           \
+       dhd_debug_linux.o dhd_debug.o dhd_mschdbg.o dhd_dbg_ring.o            \
+       hnd_pktq.o hnd_pktpool.o bcmxtlv.o linux_pkt.o bcmstdlib_s.o frag.o   \
+       dhd_linux_exportfs.o dhd_linux_pktdump.o                              \
+       dhd_config.o dhd_ccode.o wl_event.o wl_android_ext.o wl_escan.o
+
+ifneq ($(CONFIG_WIRELESS_EXT),)
+       DHDOFILES += wl_iw.o
+       DHDCFLAGS += -DSOFTAP -DWL_WIRELESS_EXT -DUSE_IW
+endif
+ifneq ($(CONFIG_CFG80211),)
+       DHDOFILES += wl_cfg80211.o wl_cfgscan.o wl_cfgp2p.o
+       DHDOFILES += wl_linux_mon.o wl_cfg_btcoex.o wl_cfgvendor.o
+       DHDOFILES += dhd_cfg80211.o
+       DHDCFLAGS += -DWL_CFG80211 -DWLP2P -DWL_CFG80211_STA_EVENT
+       DHDCFLAGS += -DWL_IFACE_COMB_NUM_CHANNELS
+       DHDCFLAGS += -DCUSTOM_PNO_EVENT_LOCK_xTIME=10
+       DHDCFLAGS += -DWL_SUPPORT_AUTO_CHANNEL
+       DHDCFLAGS += -DWL_SUPPORT_BACKPORTED_KPATCHES
+       DHDCFLAGS += -DESCAN_RESULT_PATCH -DESCAN_BUF_OVERFLOW_MGMT
+       DHDCFLAGS += -DVSDB -DWL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+       DHDCFLAGS += -DWLTDLS -DMIRACAST_AMPDU_SIZE=8
+       DHDCFLAGS += -DWL_VIRTUAL_APSTA
+       DHDCFLAGS += -DPNO_SUPPORT -DEXPLICIT_DISCIF_CLEANUP
+       DHDCFLAGS += -DDHD_USE_SCAN_WAKELOCK
+       DHDCFLAGS += -DWL_STATIC_IF
+#      DHDCFLAGS += -DWL_CLIENT_SAE
+#      DHDCFLAGS += -DWL_SAE
+endif
+
+#BCMDHD_SDIO
+ifneq ($(CONFIG_BCMDHD_SDIO),)
+DHDCFLAGS += -DBCMSDIO -DMMC_SDIO_ABORT -DBCMLXSDMMC -DUSE_SDIOFIFO_IOVAR \
+       -DSDTEST -DBDC -DDHD_USE_IDLECOUNT -DCUSTOM_SDIO_F2_BLKSIZE=256       \
+       -DBCMSDIOH_TXGLOM -DBCMSDIOH_TXGLOM_EXT -DRXFRAME_THREAD              \
+       -DDHDENABLE_TAILPAD -DSUPPORT_P2P_GO_PS                               \
+       -DBCMSDIO_RXLIM_POST -DCONSOLE_DPC
+ifeq ($(CONFIG_BCMDHD_OOB),y)
+       DHDCFLAGS += -DOOB_INTR_ONLY -DCUSTOMER_OOB -DHW_OOB
+ifeq ($(CONFIG_BCMDHD_DISABLE_WOWLAN),y)
+       DHDCFLAGS += -DDISABLE_WOWLAN
+endif
+else
+       DHDCFLAGS += -DSDIO_ISR_THREAD
+endif
+DHDOFILES += bcmsdh.o bcmsdh_linux.o bcmsdh_sdmmc.o bcmsdh_sdmmc_linux.o  \
+       dhd_sdio.o dhd_cdc.o dhd_wlfc.o
+endif
+
+#BCMDHD_PCIE
+ifneq ($(CONFIG_BCMDHD_PCIE),)
+DHDCFLAGS += -DPCIE_FULL_DONGLE -DBCMPCIE -DCUSTOM_DPC_PRIO_SETTING=-1    \
+       -DDONGLE_ENABLE_ISOLATION
+DHDCFLAGS += -DDHD_LB -DDHD_LB_RXP -DDHD_LB_STATS -DDHD_LB_TXP
+DHDCFLAGS += -DDHD_PKTID_AUDIT_ENABLED
+ifeq ($(CONFIG_BCMDHD_OOB),y)
+       DHDCFLAGS += -DCUSTOMER_OOB -DBCMPCIE_OOB_HOST_WAKE
+endif
+ifneq ($(CONFIG_PCI_MSI),)
+       DHDCFLAGS += -DDHD_MSI_SUPPORT
+endif
+DHDOFILES += dhd_pcie.o dhd_pcie_linux.o pcie_core.o dhd_flowring.o       \
+       dhd_msgbuf.o dhd_linux_lb.o
+endif
+
+#BCMDHD_USB
+ifneq ($(CONFIG_BCMDHD_USB),)
+DHDCFLAGS += -DUSBOS_TX_THREAD -DBCMDBUS -DBCMTRXV2 -DDBUS_USB_LOOPBACK   \
+       -DBDC
+DHDCFLAGS += -DBCM_REQUEST_FW -DEXTERNAL_FW_PATH
+DHDCFLAGS :=$(filter-out -DENABLE_INSMOD_NO_FW_LOAD,$(DHDCFLAGS))
+ifneq ($(CONFIG_BCMDHD_CUSB),)
+       DHDCFLAGS += -DBCMUSBDEV_COMPOSITE
+       DHDCFLAGS :=$(filter-out -DENABLE_INSMOD_NO_FW_LOAD,$(DHDCFLAGS))
+endif
+DHDOFILES += dbus.o dbus_usb.o dbus_usb_linux.o dhd_cdc.o dhd_wlfc.o
+endif
+
+#PROPTXSTATUS
+ifeq ($(CONFIG_BCMDHD_PROPTXSTATUS),y)
+ifneq ($(CONFIG_BCMDHD_USB),)
+       DHDCFLAGS += -DPROP_TXSTATUS
+endif
+ifneq ($(CONFIG_BCMDHD_SDIO),)
+       DHDCFLAGS += -DPROP_TXSTATUS -DPROPTX_MAXCOUNT
+endif
+ifneq ($(CONFIG_CFG80211),)
+       DHDCFLAGS += -DPROP_TXSTATUS_VSDB
+endif
+endif
+
+ifeq ($(CONFIG_64BIT),y)
+    DHDCFLAGS := $(filter-out -DBCMDMA32,$(DHDCFLAGS))
+    DHDCFLAGS += -DBCMDMA64OSL
+endif
+
+#VTS_SUPPORT
+ifeq ($(CONFIG_VTS_SUPPORT),y)
+DHDCFLAGS += -DDHD_NOTIFY_MAC_CHANGED
+ifneq ($(CONFIG_CFG80211),)
+DHDCFLAGS += -DGSCAN_SUPPORT -DRTT_SUPPORT -DLINKSTAT_SUPPORT             \
+       -DCUSTOM_COUNTRY_CODE -DDHD_GET_VALID_CHANNELS                        \
+       -DDEBUGABILITY -DDBG_PKT_MON -DDHD_LOG_DUMP -DDHD_FW_COREDUMP         \
+       -DAPF -DNDO_CONFIG_SUPPORT -DRSSI_MONITOR_SUPPORT -DDHD_WAKE_STATUS
+DHDOFILES += dhd_rtt.o bcm_app_utils.o
+endif
+endif
+
+# For Debug
+ifneq ($(CONFIG_BCMDHD_DEBUG),)
+DHDCFLAGS += -DDEBUGFS_CFG80211
+DHDCFLAGS += -DSHOW_LOGTRACE -DDHD_LOG_DUMP -DDHD_FW_COREDUMP             \
+       -DBCMASSERT_LOG -DSI_ERROR_ENFORCE
+ifneq ($(CONFIG_BCMDHD_PCIE),)
+       DHDCFLAGS += -DEWP_EDL
+       DHDCFLAGS += -DDNGL_EVENT_SUPPORT
+       DHDCFLAGS += -DDHD_SSSR_DUMP
+endif
+endif
+
+# MESH support for kernel 3.10 later
+ifeq ($(CONFIG_WL_MESH),y)
+       DHDCFLAGS += -DWLMESH
+ifneq ($(CONFIG_CFG80211),)
+       DHDCFLAGS += -DWLMESH_CFG80211
+endif
+ifneq ($(CONFIG_BCMDHD_PCIE),)
+       DHDCFLAGS += -DBCM_HOST_BUF -DDMA_HOST_BUFFER_LEN=0x80000
+endif
+       DHDCFLAGS += -DDHD_UPDATE_INTF_MAC
+       DHDCFLAGS :=$(filter-out -DDHD_FW_COREDUMP,$(DHDCFLAGS))
+       DHDCFLAGS :=$(filter-out -DWL_STATIC_IF,$(DHDCFLAGS))
+endif
+
+ifeq ($(CONFIG_WL_EASYMESH),y)
+       DHDCFLAGS :=$(filter-out -DDHD_FW_COREDUMP,$(DHDCFLAGS))
+       DHDCFLAGS :=$(filter-out -DDHD_LOG_DUMP,$(DHDCFLAGS))
+       DHDCFLAGS += -DWLEASYMESH -DWL_STATIC_IF -DWLDWDS -DFOURADDR_AUTO_BRG
+endif
+
+#CSI_SUPPORT
+ifneq ($(CONFIG_CSI_SUPPORT),)
+       DHDCFLAGS += -DCSI_SUPPORT
+       DHDOFILES += dhd_csi.o
+endif
+
+obj-$(CONFIG_BCMDHD) += $(MODULE_NAME).o
+$(MODULE_NAME)-objs += $(DHDOFILES)
+
+ifeq ($(CONFIG_MACH_PLATFORM),y)
+       DHDOFILES += dhd_gpio.o
+ifeq ($(CONFIG_BCMDHD_DTS),y)
+       DHDCFLAGS += -DCONFIG_DTS
+else
+       DHDCFLAGS += -DCUSTOMER_HW -DDHD_OF_SUPPORT
+endif
+       DHDCFLAGS += -DCUSTOMER_HW_AMLOGIC
+
+# for config custom MAC
+#      DHDCFLAGS += -DGET_CUSTOM_MAC_ENABLE -DCUSTOM_MULTI_MAC
+# if also need config AP MAC
+#      DHDCFLAGS += -DCUSTOM_AP_MAC
+#
+
+#      DHDCFLAGS += -DBCMWAPI_WPI -DBCMWAPI_WAI
+endif
+
+ifeq ($(CONFIG_BCMDHD_AG),y)
+       DHDCFLAGS += -DBAND_AG
+endif
+
+ifeq ($(CONFIG_DHD_USE_STATIC_BUF),y)
+#      obj-m += dhd_static_buf.o
+       DHDCFLAGS += -DSTATIC_WL_PRIV_STRUCT -DENHANCED_STATIC_BUF
+       DHDCFLAGS += -DCONFIG_DHD_USE_STATIC_BUF
+       DHDCFLAGS += -DDHD_USE_STATIC_MEMDUMP
+endif
+
+EXTRA_CFLAGS = $(DHDCFLAGS)
+ifeq ($(CONFIG_BCMDHD),m)
+EXTRA_LDFLAGS += --strip-debug
+endif
+
+ARCH ?= arm64
+CROSS_COMPILE ?=aarch64-linux-gnu-
+KDIR ?=../../../../../../common
+
+#all: bcmdhd_sdio bcmdhd_usb
+all: bcmdhd_sdio
+
+EXTRA_CFLAGS += -I$(KERNEL_SRC)/$(M)/include -I$(KERNEL_SRC)/$(M)/
+modules_install:
+       @$(MAKE) INSTALL_MOD_STRIP=1 M=$(M) -C $(KERNEL_SRC) modules_install
+       mkdir -p ${OUT_DIR}/../vendor_lib/modules
+       cd ${OUT_DIR}/$(M)/; find -name "*.ko" -exec cp {} ${OUT_DIR}/../vendor_lib/modules/ \;
+
+clean:
+       $(MAKE) -C $(KERNEL_SRC) M=$(M) clean $(KBUILD_OPTIONS)
+
+bcmdhd_sdio:
+       $(MAKE) -C $(KERNEL_SRC) M=$(M) CONFIG_DHD_USE_STATIC_BUF=y CONFIG_BCMDHD_SDIO=y modules
+       #mv dhd.ko dhd_sdio.ko
+
+bcmdhd_usb:
+       $(MAKE) -C $(KDIR) M=$(PWD) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules CONFIG_BCMDHD_USB=y
+       mv dhd.ko dhd_usb.ko
+
+clean:
+       $(MAKE) -C $(KDIR) M=$(PWD) ARCH=$(ARCH) clean
+       $(RM) Module.markers
+       $(RM) modules.order
diff --git a/bcmdhd.101.10.240.x/aiutils.c b/bcmdhd.101.10.240.x/aiutils.c
new file mode 100644 (file)
index 0000000..f86a6d7
--- /dev/null
@@ -0,0 +1,2233 @@
+/*
+ * Misc utility routines for accessing chip-specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <pcicfg.h>
+#include <pcie_core.h>
+
+#include "siutils_priv.h"
+#include <bcmdevs.h>
+
+#if defined(ETD)
+#include <etd.h>
+#endif
+
+#define PMU_DMP() (0)
+#define GCI_DMP() (0)
+
+#if defined(AXI_TIMEOUTS_NIC)
+static bool ai_get_apb_bridge(const si_t *sih, uint32 coreidx, uint32 *apb_id,
+       uint32 *apb_coreunit);
+#endif /* AXI_TIMEOUTS_NIC */
+
+#if defined(AXI_TIMEOUTS) || defined(AXI_TIMEOUTS_NIC)
+static void ai_reset_axi_to(const si_info_t *sii, aidmp_t *ai);
+#endif /* defined (AXI_TIMEOUTS) || defined (AXI_TIMEOUTS_NIC) */
+
+/* AXI ID to CoreID + unit mappings */
+typedef struct axi_to_coreidx {
+       uint coreid;
+       uint coreunit;
+} axi_to_coreidx_t;
+
+static const axi_to_coreidx_t axi2coreidx_4369[] = {
+       {CC_CORE_ID, 0},        /* 00 Chipcommon */
+       {PCIE2_CORE_ID, 0},     /* 01 PCIe */
+       {D11_CORE_ID, 0},       /* 02 D11 Main */
+       {ARMCR4_CORE_ID, 0},    /* 03 ARM */
+       {BT_CORE_ID, 0},        /* 04 BT AHB */
+       {D11_CORE_ID, 1},       /* 05 D11 Aux */
+       {D11_CORE_ID, 0},       /* 06 D11 Main l1 */
+       {D11_CORE_ID, 1},       /* 07 D11 Aux  l1 */
+       {D11_CORE_ID, 0},       /* 08 D11 Main l2 */
+       {D11_CORE_ID, 1},       /* 09 D11 Aux  l2 */
+       {NODEV_CORE_ID, 0},     /* 10 M2M DMA */
+       {NODEV_CORE_ID, 0},     /* 11 unused */
+       {NODEV_CORE_ID, 0},     /* 12 unused */
+       {NODEV_CORE_ID, 0},     /* 13 unused */
+       {NODEV_CORE_ID, 0},     /* 14 unused */
+       {NODEV_CORE_ID, 0}      /* 15 unused */
+};
+
+/* EROM parsing */
+
+static uint32
+get_erom_ent(const si_t *sih, uint32 **eromptr, uint32 mask, uint32 match)
+{
+       uint32 ent;
+       uint inv = 0, nom = 0;
+       uint32 size = 0;
+
+       while (TRUE) {
+               ent = R_REG(SI_INFO(sih)->osh, *eromptr);
+               (*eromptr)++;
+
+               if (mask == 0)
+                       break;
+
+               if ((ent & ER_VALID) == 0) {
+                       inv++;
+                       continue;
+               }
+
+               if (ent == (ER_END | ER_VALID))
+                       break;
+
+               if ((ent & mask) == match)
+                       break;
+
+               /* escape condition related EROM size if it has invalid values */
+               size += sizeof(*eromptr);
+               if (size >= ER_SZ_MAX) {
+                       SI_ERROR(("Failed to find end of EROM marker\n"));
+                       break;
+               }
+
+               nom++;
+       }
+
+       SI_VMSG(("get_erom_ent: Returning ent 0x%08x\n", ent));
+       if (inv + nom) {
+               SI_VMSG(("  after %d invalid and %d non-matching entries\n", inv, nom));
+       }
+       return ent;
+}
+
+static uint32
+get_asd(const si_t *sih, uint32 **eromptr, uint sp, uint ad, uint st, uint32 *addrl, uint32 *addrh,
+       uint32 *sizel, uint32 *sizeh)
+{
+       uint32 asd, sz, szd;
+
+       BCM_REFERENCE(ad);
+
+       asd = get_erom_ent(sih, eromptr, ER_VALID, ER_VALID);
+       if (((asd & ER_TAG1) != ER_ADD) ||
+           (((asd & AD_SP_MASK) >> AD_SP_SHIFT) != sp) ||
+           ((asd & AD_ST_MASK) != st)) {
+               /* This is not what we want, "push" it back */
+               (*eromptr)--;
+               return 0;
+       }
+       *addrl = asd & AD_ADDR_MASK;
+       if (asd & AD_AG32)
+               *addrh = get_erom_ent(sih, eromptr, 0, 0);
+       else
+               *addrh = 0;
+       *sizeh = 0;
+       sz = asd & AD_SZ_MASK;
+       if (sz == AD_SZ_SZD) {
+               szd = get_erom_ent(sih, eromptr, 0, 0);
+               *sizel = szd & SD_SZ_MASK;
+               if (szd & SD_SG32)
+                       *sizeh = get_erom_ent(sih, eromptr, 0, 0);
+       } else
+               *sizel = AD_SZ_BASE << (sz >> AD_SZ_SHIFT);
+
+       SI_VMSG(("  SP %d, ad %d: st = %d, 0x%08x_0x%08x @ 0x%08x_0x%08x\n",
+               sp, ad, st, *sizeh, *sizel, *addrh, *addrl));
+
+       return asd;
+}
+
+/* Parse the enumeration rom to identify all cores */
+void
+ai_scan(si_t *sih, void *regs, uint devid)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       chipcregs_t *cc = (chipcregs_t *)regs;
+       uint32 erombase, *eromptr, *eromlim;
+       axi_wrapper_t * axi_wrapper = sii->axi_wrapper;
+
+       BCM_REFERENCE(devid);
+
+       erombase = R_REG(sii->osh, &cc->eromptr);
+
+       switch (BUSTYPE(sih->bustype)) {
+       case SI_BUS:
+               eromptr = (uint32 *)REG_MAP(erombase, SI_CORE_SIZE);
+               break;
+
+       case PCI_BUS:
+               /* Set wrappers address */
+               sii->curwrap = (void *)((uintptr)regs + SI_CORE_SIZE);
+
+               /* Now point the window at the erom */
+               OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, 4, erombase);
+               eromptr = regs;
+               break;
+
+#ifdef BCMSDIO
+       case SPI_BUS:
+       case SDIO_BUS:
+               eromptr = (uint32 *)(uintptr)erombase;
+               break;
+#endif /* BCMSDIO */
+
+       default:
+               SI_ERROR(("Don't know how to do AXI enumeration on bus %d\n", sih->bustype));
+               ASSERT(0);
+               return;
+       }
+       eromlim = eromptr + (ER_REMAPCONTROL / sizeof(uint32));
+       sii->axi_num_wrappers = 0;
+
+       SI_VMSG(("ai_scan: regs = 0x%p, erombase = 0x%08x, eromptr = 0x%p, eromlim = 0x%p\n",
+                OSL_OBFUSCATE_BUF(regs), erombase,
+               OSL_OBFUSCATE_BUF(eromptr), OSL_OBFUSCATE_BUF(eromlim)));
+       while (eromptr < eromlim) {
+               uint32 cia, cib, cid, mfg, crev, nmw, nsw, nmp, nsp;
+               uint32 mpd, asd, addrl, addrh, sizel, sizeh;
+               uint i, j, idx;
+               bool br;
+
+               br = FALSE;
+
+               /* Grok a component */
+               cia = get_erom_ent(sih, &eromptr, ER_TAG, ER_CI);
+               if (cia == (ER_END | ER_VALID)) {
+                       SI_VMSG(("Found END of erom after %d cores\n", sii->numcores));
+                       return;
+               }
+
+               cib = get_erom_ent(sih, &eromptr, 0, 0);
+
+               if ((cib & ER_TAG) != ER_CI) {
+                       SI_ERROR(("CIA not followed by CIB\n"));
+                       goto error;
+               }
+
+               cid = (cia & CIA_CID_MASK) >> CIA_CID_SHIFT;
+               mfg = (cia & CIA_MFG_MASK) >> CIA_MFG_SHIFT;
+               crev = (cib & CIB_REV_MASK) >> CIB_REV_SHIFT;
+               nmw = (cib & CIB_NMW_MASK) >> CIB_NMW_SHIFT;
+               nsw = (cib & CIB_NSW_MASK) >> CIB_NSW_SHIFT;
+               nmp = (cib & CIB_NMP_MASK) >> CIB_NMP_SHIFT;
+               nsp = (cib & CIB_NSP_MASK) >> CIB_NSP_SHIFT;
+
+#ifdef BCMDBG_SI
+               SI_VMSG(("Found component 0x%04x/0x%04x rev %d at erom addr 0x%p, with nmw = %d, "
+                        "nsw = %d, nmp = %d & nsp = %d\n",
+                        mfg, cid, crev, OSL_OBFUSCATE_BUF(eromptr - 1), nmw, nsw, nmp, nsp));
+#else
+               BCM_REFERENCE(crev);
+#endif
+
+               /* Include Default slave wrapper for timeout monitoring */
+               if ((nsp == 0 && nsw == 0) ||
+#if !defined(AXI_TIMEOUTS) && !defined(AXI_TIMEOUTS_NIC)
+                       ((mfg == MFGID_ARM) && (cid == DEF_AI_COMP)) ||
+#else
+                       ((CHIPTYPE(sii->pub.socitype) == SOCI_NAI) &&
+                       (mfg == MFGID_ARM) && (cid == DEF_AI_COMP)) ||
+#endif /* !defined(AXI_TIMEOUTS) && !defined(AXI_TIMEOUTS_NIC) */
+                       FALSE) {
+                       continue;
+               }
+
+               if ((nmw + nsw == 0)) {
+                       /* A component which is not a core */
+                       /* Should record some info */
+                       if (cid == OOB_ROUTER_CORE_ID) {
+                               asd = get_asd(sih, &eromptr, 0, 0, AD_ST_SLAVE,
+                                       &addrl, &addrh, &sizel, &sizeh);
+                               if (asd != 0) {
+                                       if ((sii->oob_router != 0) && (sii->oob_router != addrl)) {
+                                               sii->oob_router1 = addrl;
+                                       } else {
+                                               sii->oob_router = addrl;
+                                       }
+                               }
+                       }
+                       if ((cid != NS_CCB_CORE_ID) && (cid != PMU_CORE_ID) &&
+                               (cid != GCI_CORE_ID) && (cid != SR_CORE_ID) &&
+                               (cid != HUB_CORE_ID) && (cid != HND_OOBR_CORE_ID) &&
+                               (cid != CCI400_CORE_ID) && (cid != SPMI_SLAVE_CORE_ID)) {
+                               continue;
+                       }
+               }
+
+               idx = sii->numcores;
+
+               cores_info->cia[idx] = cia;
+               cores_info->cib[idx] = cib;
+               cores_info->coreid[idx] = cid;
+
+               /* workaround the fact the variable buscoretype is used in _ai_set_coreidx()
+                * when checking PCIE_GEN2() for PCI_BUS case before it is setup later...,
+                * both use and setup happen in si_buscore_setup().
+                */
+               if (BUSTYPE(sih->bustype) == PCI_BUS &&
+                   (cid == PCI_CORE_ID || cid == PCIE_CORE_ID || cid == PCIE2_CORE_ID)) {
+                       sii->pub.buscoretype = (uint16)cid;
+               }
+
+               for (i = 0; i < nmp; i++) {
+                       mpd = get_erom_ent(sih, &eromptr, ER_VALID, ER_VALID);
+                       if ((mpd & ER_TAG) != ER_MP) {
+                               SI_ERROR(("Not enough MP entries for component 0x%x\n", cid));
+                               goto error;
+                       }
+                       /* Record something? */
+                       SI_VMSG(("  Master port %d, mp: %d id: %d\n", i,
+                                (mpd & MPD_MP_MASK) >> MPD_MP_SHIFT,
+                                (mpd & MPD_MUI_MASK) >> MPD_MUI_SHIFT));
+               }
+
+               /* First Slave Address Descriptor should be port 0:
+                * the main register space for the core
+                */
+               asd = get_asd(sih, &eromptr, 0, 0, AD_ST_SLAVE, &addrl, &addrh, &sizel, &sizeh);
+               if (asd == 0) {
+                       do {
+                       /* Try again to see if it is a bridge */
+                       asd = get_asd(sih, &eromptr, 0, 0, AD_ST_BRIDGE, &addrl, &addrh,
+                                     &sizel, &sizeh);
+                       if (asd != 0)
+                               br = TRUE;
+                       else {
+                                       break;
+                               }
+                       } while (1);
+               } else {
+                       if (addrl == 0 || sizel == 0) {
+                               SI_ERROR((" Invalid ASD %x for slave port \n", asd));
+                               goto error;
+                       }
+                       cores_info->coresba[idx] = addrl;
+                       cores_info->coresba_size[idx] = sizel;
+               }
+
+               /* Get any more ASDs in first port */
+               j = 1;
+               do {
+                       asd = get_asd(sih, &eromptr, 0, j, AD_ST_SLAVE, &addrl, &addrh,
+                                     &sizel, &sizeh);
+                       if ((asd != 0) && (j == 1) && (sizel == SI_CORE_SIZE)) {
+                               cores_info->coresba2[idx] = addrl;
+                               cores_info->coresba2_size[idx] = sizel;
+                       }
+                       j++;
+               } while (asd != 0);
+
+               /* Go through the ASDs for other slave ports */
+               for (i = 1; i < nsp; i++) {
+                       j = 0;
+                       do {
+                               asd = get_asd(sih, &eromptr, i, j, AD_ST_SLAVE, &addrl, &addrh,
+                                             &sizel, &sizeh);
+                               /* To get the first base address of second slave port */
+                               if ((asd != 0) && (i == 1) && (j == 0)) {
+                                       cores_info->csp2ba[idx] = addrl;
+                                       cores_info->csp2ba_size[idx] = sizel;
+                               }
+                               if (asd == 0)
+                                       break;
+                               j++;
+                       } while (1);
+                       if (j == 0) {
+                               SI_ERROR((" SP %d has no address descriptors\n", i));
+                               goto error;
+                       }
+               }
+
+               /* Now get master wrappers */
+               for (i = 0; i < nmw; i++) {
+                       asd = get_asd(sih, &eromptr, i, 0, AD_ST_MWRAP, &addrl, &addrh,
+                                     &sizel, &sizeh);
+                       if (asd == 0) {
+                               SI_ERROR(("Missing descriptor for MW %d\n", i));
+                               goto error;
+                       }
+                       if ((sizeh != 0) || (sizel != SI_CORE_SIZE)) {
+                               SI_ERROR(("Master wrapper %d is not 4KB\n", i));
+                               goto error;
+                       }
+                       if (i == 0) {
+                               cores_info->wrapba[idx] = addrl;
+                       } else if (i == 1) {
+                               cores_info->wrapba2[idx] = addrl;
+                       } else if (i == 2) {
+                               cores_info->wrapba3[idx] = addrl;
+                       }
+
+                       if (axi_wrapper && (sii->axi_num_wrappers < SI_MAX_AXI_WRAPPERS)) {
+                               axi_wrapper[sii->axi_num_wrappers].mfg = mfg;
+                               axi_wrapper[sii->axi_num_wrappers].cid = cid;
+                               axi_wrapper[sii->axi_num_wrappers].rev = crev;
+                               axi_wrapper[sii->axi_num_wrappers].wrapper_type = AI_MASTER_WRAPPER;
+                               axi_wrapper[sii->axi_num_wrappers].wrapper_addr = addrl;
+                               sii->axi_num_wrappers++;
+                               SI_VMSG(("MASTER WRAPPER: %d, mfg:%x, cid:%x,"
+                                       "rev:%x, addr:%x, size:%x\n",
+                                       sii->axi_num_wrappers, mfg, cid, crev, addrl, sizel));
+                       }
+               }
+
+               /* And finally slave wrappers */
+               for (i = 0; i < nsw; i++) {
+                       uint fwp = (nsp <= 1) ? 0 : 1;
+                       asd = get_asd(sih, &eromptr, fwp + i, 0, AD_ST_SWRAP, &addrl, &addrh,
+                                     &sizel, &sizeh);
+                       if (asd == 0) {
+                               SI_ERROR(("Missing descriptor for SW %d cid %x eromp %p fwp %d \n",
+                                       i, cid, eromptr, fwp));
+                               goto error;
+                       }
+
+                       if ((sizeh != 0) || (sizel != SI_CORE_SIZE)) {
+                               SI_ERROR(("Slave wrapper %d is not 4KB\n", i));
+                               goto error;
+                       }
+
+                       /* HW4368-574, Slave wrapper address of 0x1810b000 should be 0x18133000 */
+                       if (BCM4368_CHIP(sih->chip) && addrl == 0x1810b000) {
+                               addrl = 0x18133000;
+                       }
+
+                       /* cache APB bridge wrapper address for set/clear timeout */
+                       if ((mfg == MFGID_ARM) && (cid == APB_BRIDGE_ID)) {
+                               ASSERT(sii->num_br < SI_MAXBR);
+                               sii->br_wrapba[sii->num_br++] = addrl;
+                       }
+
+                       if ((mfg == MFGID_ARM) && (cid == ADB_BRIDGE_ID)) {
+                               br = TRUE;
+                       }
+
+                       BCM_REFERENCE(br);
+
+                       if ((nmw == 0) && (i == 0)) {
+                               cores_info->wrapba[idx] = addrl;
+                       } else if ((nmw == 0) && (i == 1)) {
+                               cores_info->wrapba2[idx] = addrl;
+                       } else if ((nmw == 0) && (i == 2)) {
+                               cores_info->wrapba3[idx] = addrl;
+                       }
+
+                       /* Include all slave wrappers to the list to
+                        * enable and monitor watchdog timeouts
+                        */
+
+                       if (axi_wrapper && (sii->axi_num_wrappers < SI_MAX_AXI_WRAPPERS)) {
+                               axi_wrapper[sii->axi_num_wrappers].mfg = mfg;
+                               axi_wrapper[sii->axi_num_wrappers].cid = cid;
+                               axi_wrapper[sii->axi_num_wrappers].rev = crev;
+                               axi_wrapper[sii->axi_num_wrappers].wrapper_type = AI_SLAVE_WRAPPER;
+                               axi_wrapper[sii->axi_num_wrappers].wrapper_addr = addrl;
+
+                               sii->axi_num_wrappers++;
+
+                               SI_VMSG(("SLAVE WRAPPER: %d,  mfg:%x, cid:%x,"
+                                       "rev:%x, addr:%x, size:%x\n",
+                                       sii->axi_num_wrappers,  mfg, cid, crev, addrl, sizel));
+                       }
+               }
+
+#ifndef AXI_TIMEOUTS_NIC
+               /* Don't record bridges and core with 0 slave ports */
+               if (br || (nsp == 0)) {
+                       continue;
+               }
+#endif
+
+               /* Done with core */
+               sii->numcores++;
+       }
+
+       SI_ERROR(("Reached end of erom without finding END\n"));
+
+error:
+       sii->numcores = 0;
+       return;
+}
+
+#define AI_SETCOREIDX_MAPSIZE(coreid) \
+       (((coreid) == NS_CCB_CORE_ID) ? 15 * SI_CORE_SIZE : SI_CORE_SIZE)
+
+/* This function changes the logical "focus" to the indicated core.
+ * Return the current core's virtual address.
+ */
+static volatile void *
+_ai_setcoreidx(si_t *sih, uint coreidx, uint use_wrapn)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint32 addr, wrap, wrap2, wrap3;
+       volatile void *regs;
+
+       if (coreidx >= MIN(sii->numcores, SI_MAXCORES))
+               return (NULL);
+
+       addr = cores_info->coresba[coreidx];
+       wrap = cores_info->wrapba[coreidx];
+       wrap2 = cores_info->wrapba2[coreidx];
+       wrap3 = cores_info->wrapba3[coreidx];
+
+#ifdef AXI_TIMEOUTS_NIC
+       /* No need to disable interrupts while entering/exiting APB bridge core */
+       if ((cores_info->coreid[coreidx] != APB_BRIDGE_CORE_ID) &&
+               (cores_info->coreid[sii->curidx] != APB_BRIDGE_CORE_ID))
+#endif /* AXI_TIMEOUTS_NIC */
+       {
+               /*
+                * If the user has provided an interrupt mask enabled function,
+                * then assert interrupts are disabled before switching the core.
+                */
+               ASSERT((sii->intrsenabled_fn == NULL) ||
+                       !(*(sii)->intrsenabled_fn)((sii)->intr_arg));
+       }
+
+       switch (BUSTYPE(sih->bustype)) {
+       case SI_BUS:
+               /* map new one */
+               if (!cores_info->regs[coreidx]) {
+                       cores_info->regs[coreidx] = REG_MAP(addr,
+                               AI_SETCOREIDX_MAPSIZE(cores_info->coreid[coreidx]));
+                       ASSERT(GOODREGS(cores_info->regs[coreidx]));
+               }
+               sii->curmap = regs = cores_info->regs[coreidx];
+               if (!cores_info->wrappers[coreidx] && (wrap != 0)) {
+                       cores_info->wrappers[coreidx] = REG_MAP(wrap, SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->wrappers[coreidx]));
+               }
+               if (!cores_info->wrappers2[coreidx] && (wrap2 != 0)) {
+                       cores_info->wrappers2[coreidx] = REG_MAP(wrap2, SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->wrappers2[coreidx]));
+               }
+               if (!cores_info->wrappers3[coreidx] && (wrap3 != 0)) {
+                       cores_info->wrappers3[coreidx] = REG_MAP(wrap3, SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->wrappers3[coreidx]));
+               }
+
+               if (use_wrapn == 2) {
+                       sii->curwrap = cores_info->wrappers3[coreidx];
+               } else if (use_wrapn == 1) {
+                       sii->curwrap = cores_info->wrappers2[coreidx];
+               } else {
+                       sii->curwrap = cores_info->wrappers[coreidx];
+               }
+               break;
+
+       case PCI_BUS:
+               regs = sii->curmap;
+
+               /* point bar0 2nd 4KB window to the primary wrapper */
+               if (use_wrapn == 2) {
+                       wrap = wrap3;
+               } else if (use_wrapn == 1) {
+                       wrap = wrap2;
+               }
+
+               /* Use BAR0 Window to support dual mac chips... */
+
+               /* TODO: the other mac unit can't be supportd by the current BAR0 window.
+                * need to find other ways to access these cores.
+                */
+
+               switch (sii->slice) {
+               case 0: /* main/first slice */
+#ifdef AXI_TIMEOUTS_NIC
+                       /* No need to set the BAR0 if core is APB Bridge.
+                        * This is to reduce 2 PCI writes while checkng for errlog
+                        */
+                       if (cores_info->coreid[coreidx] != APB_BRIDGE_CORE_ID)
+#endif /* AXI_TIMEOUTS_NIC */
+                       {
+                               /* point bar0 window */
+                               OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, 4, addr);
+                       }
+
+                       if (PCIE_GEN2(sii))
+                               OSL_PCI_WRITE_CONFIG(sii->osh, PCIE2_BAR0_WIN2, 4, wrap);
+                       else
+                               OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN2, 4, wrap);
+
+                       break;
+
+               case 1: /* aux/second slice */
+                       /* PCIE GEN2 only for other slices */
+                       if (!PCIE_GEN2(sii)) {
+                               /* other slices not supported */
+                               SI_ERROR(("PCI GEN not supported for slice %d\n", sii->slice));
+                               ASSERT(0);
+                               break;
+                       }
+
+                       /* 0x4000 - 0x4fff: enum space 0x5000 - 0x5fff: wrapper space */
+                       regs = (volatile uint8 *)regs + PCI_SEC_BAR0_WIN_OFFSET;
+                       sii->curwrap = (void *)((uintptr)regs + SI_CORE_SIZE);
+
+                       /* point bar0 window */
+                       OSL_PCI_WRITE_CONFIG(sii->osh, PCIE2_BAR0_CORE2_WIN, 4, addr);
+                       OSL_PCI_WRITE_CONFIG(sii->osh, PCIE2_BAR0_CORE2_WIN2, 4, wrap);
+                       break;
+
+               case 2: /* scan/third slice */
+                       /* PCIE GEN2 only for other slices */
+                       if (!PCIE_GEN2(sii)) {
+                               /* other slices not supported */
+                               SI_ERROR(("PCI GEN not supported for slice %d\n", sii->slice));
+                               ASSERT(0);
+                               break;
+                       }
+
+                       /* 0x9000 - 0x9fff: enum space 0xa000 - 0xafff: wrapper space */
+                       regs = (volatile uint8 *)regs + PCI_TER_BAR0_WIN_OFFSET;
+                       sii->curwrap = (void *)((uintptr)regs + SI_CORE_SIZE);
+
+                       /* point bar0 window */
+                       ai_corereg(sih, sih->buscoreidx, PCIE_TER_BAR0_WIN, ~0, addr);
+                       ai_corereg(sih, sih->buscoreidx, PCIE_TER_BAR0_WRAPPER, ~0, wrap);
+                       break;
+
+               default: /* other slices */
+                       SI_ERROR(("BAR0 Window not supported for slice %d\n", sii->slice));
+                       ASSERT(0);
+                       break;
+               }
+
+               break;
+
+#ifdef BCMSDIO
+       case SPI_BUS:
+       case SDIO_BUS:
+               sii->curmap = regs = (void *)((uintptr)addr);
+               if (use_wrapn)
+                       sii->curwrap = (void *)((uintptr)wrap2);
+               else
+                       sii->curwrap = (void *)((uintptr)wrap);
+               break;
+#endif /* BCMSDIO */
+
+       default:
+               ASSERT(0);
+               sii->curmap = regs = NULL;
+               break;
+       }
+
+       sii->curidx = coreidx;
+
+       return regs;
+}
+
+volatile void *
+ai_setcoreidx(si_t *sih, uint coreidx)
+{
+       return _ai_setcoreidx(sih, coreidx, 0);
+}
+
+volatile void *
+ai_setcoreidx_2ndwrap(si_t *sih, uint coreidx)
+{
+       return _ai_setcoreidx(sih, coreidx, 1);
+}
+
+volatile void *
+ai_setcoreidx_3rdwrap(si_t *sih, uint coreidx)
+{
+       return _ai_setcoreidx(sih, coreidx, 2);
+}
+
+void
+ai_coreaddrspaceX(const si_t *sih, uint asidx, uint32 *addr, uint32 *size)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       const si_cores_info_t *cores_info = (const si_cores_info_t *)sii->cores_info;
+       chipcregs_t *cc = NULL;
+       uint32 erombase, *eromptr, *eromlim;
+       uint i, j, cidx;
+       uint32 cia, cib, nmp, nsp;
+       uint32 asd, addrl, addrh, sizel, sizeh;
+
+       for (i = 0; i < sii->numcores; i++) {
+               if (cores_info->coreid[i] == CC_CORE_ID) {
+                       cc = (chipcregs_t *)cores_info->regs[i];
+                       break;
+               }
+       }
+       if (cc == NULL)
+               goto error;
+
+       BCM_REFERENCE(erombase);
+       erombase = R_REG(sii->osh, &cc->eromptr);
+       eromptr = (uint32 *)REG_MAP(erombase, SI_CORE_SIZE);
+       eromlim = eromptr + (ER_REMAPCONTROL / sizeof(uint32));
+
+       cidx = sii->curidx;
+       cia = cores_info->cia[cidx];
+       cib = cores_info->cib[cidx];
+
+       nmp = (cib & CIB_NMP_MASK) >> CIB_NMP_SHIFT;
+       nsp = (cib & CIB_NSP_MASK) >> CIB_NSP_SHIFT;
+
+       /* scan for cores */
+       while (eromptr < eromlim) {
+               if ((get_erom_ent(sih, &eromptr, ER_TAG, ER_CI) == cia) &&
+                       (get_erom_ent(sih, &eromptr, 0, 0) == cib)) {
+                       break;
+               }
+       }
+
+       /* skip master ports */
+       for (i = 0; i < nmp; i++)
+               get_erom_ent(sih, &eromptr, ER_VALID, ER_VALID);
+
+       /* Skip ASDs in port 0 */
+       asd = get_asd(sih, &eromptr, 0, 0, AD_ST_SLAVE, &addrl, &addrh, &sizel, &sizeh);
+       if (asd == 0) {
+               /* Try again to see if it is a bridge */
+               asd = get_asd(sih, &eromptr, 0, 0, AD_ST_BRIDGE, &addrl, &addrh,
+                             &sizel, &sizeh);
+       }
+
+       j = 1;
+       do {
+               asd = get_asd(sih, &eromptr, 0, j, AD_ST_SLAVE, &addrl, &addrh,
+                             &sizel, &sizeh);
+               j++;
+       } while (asd != 0);
+
+       /* Go through the ASDs for other slave ports */
+       for (i = 1; i < nsp; i++) {
+               j = 0;
+               do {
+                       asd = get_asd(sih, &eromptr, i, j, AD_ST_SLAVE, &addrl, &addrh,
+                               &sizel, &sizeh);
+                       if (asd == 0)
+                               break;
+
+                       if (!asidx--) {
+                               *addr = addrl;
+                               *size = sizel;
+                               return;
+                       }
+                       j++;
+               } while (1);
+
+               if (j == 0) {
+                       SI_ERROR((" SP %d has no address descriptors\n", i));
+                       break;
+               }
+       }
+
+error:
+       *size = 0;
+       return;
+}
+
+/* Return the number of address spaces in current core */
+int
+ai_numaddrspaces(const si_t *sih)
+{
+       /* TODO: Either save it or parse the EROM on demand, currently hardcode 2 */
+       BCM_REFERENCE(sih);
+
+       return 2;
+}
+
+/* Return the address of the nth address space in the current core
+ * Arguments:
+ * sih : Pointer to struct si_t
+ * spidx : slave port index
+ * baidx : base address index
+ */
+uint32
+ai_addrspace(const si_t *sih, uint spidx, uint baidx)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       const si_cores_info_t *cores_info = (const si_cores_info_t *)sii->cores_info;
+       uint cidx;
+
+       cidx = sii->curidx;
+
+       if (spidx == CORE_SLAVE_PORT_0) {
+               if (baidx == CORE_BASE_ADDR_0)
+                       return cores_info->coresba[cidx];
+               else if (baidx == CORE_BASE_ADDR_1)
+                       return cores_info->coresba2[cidx];
+       }
+       else if (spidx == CORE_SLAVE_PORT_1) {
+               if (baidx == CORE_BASE_ADDR_0)
+                       return cores_info->csp2ba[cidx];
+       }
+
+       SI_ERROR(("ai_addrspace: Need to parse the erom again to find %d base addr"
+               " in %d slave port\n",
+               baidx, spidx));
+
+       return 0;
+
+}
+
+/* Return the size of the nth address space in the current core
+* Arguments:
+* sih : Pointer to struct si_t
+* spidx : slave port index
+* baidx : base address index
+*/
+uint32
+ai_addrspacesize(const si_t *sih, uint spidx, uint baidx)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       const si_cores_info_t *cores_info = (const si_cores_info_t *)sii->cores_info;
+       uint cidx;
+
+       cidx = sii->curidx;
+       if (spidx == CORE_SLAVE_PORT_0) {
+               if (baidx == CORE_BASE_ADDR_0)
+                       return cores_info->coresba_size[cidx];
+               else if (baidx == CORE_BASE_ADDR_1)
+                       return cores_info->coresba2_size[cidx];
+       }
+       else if (spidx == CORE_SLAVE_PORT_1) {
+               if (baidx == CORE_BASE_ADDR_0)
+                       return cores_info->csp2ba_size[cidx];
+       }
+
+       SI_ERROR(("ai_addrspacesize: Need to parse the erom again to find %d"
+               " base addr in %d slave port\n",
+               baidx, spidx));
+
+       return 0;
+}
+
+uint
+ai_flag(si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+
+       if (PMU_DMP()) {
+               uint idx, flag;
+               idx = sii->curidx;
+               ai_setcoreidx(sih, SI_CC_IDX);
+               flag = ai_flag_alt(sih);
+               ai_setcoreidx(sih, idx);
+               return flag;
+       }
+
+       ai = sii->curwrap;
+       ASSERT(ai != NULL);
+
+       return (R_REG(sii->osh, &ai->oobselouta30) & 0x1f);
+}
+
+uint
+ai_flag_alt(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai = sii->curwrap;
+
+       return ((R_REG(sii->osh, &ai->oobselouta30) >> AI_OOBSEL_1_SHIFT) & AI_OOBSEL_MASK);
+}
+
+void
+ai_setint(const si_t *sih, int siflag)
+{
+       BCM_REFERENCE(sih);
+       BCM_REFERENCE(siflag);
+
+       /* TODO: Figure out how to set interrupt mask in ai */
+}
+
+uint
+ai_wrap_reg(const si_t *sih, uint32 offset, uint32 mask, uint32 val)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       uint32 *addr = (uint32 *) ((uchar *)(sii->curwrap) + offset);
+
+       if (mask || val) {
+               uint32 w = R_REG(sii->osh, addr);
+               w &= ~mask;
+               w |= val;
+               W_REG(sii->osh, addr, w);
+       }
+       return (R_REG(sii->osh, addr));
+}
+
+uint
+ai_corevendor(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       const si_cores_info_t *cores_info = (const si_cores_info_t *)sii->cores_info;
+       uint32 cia;
+
+       cia = cores_info->cia[sii->curidx];
+       return ((cia & CIA_MFG_MASK) >> CIA_MFG_SHIFT);
+}
+
+uint
+ai_corerev(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       const si_cores_info_t *cores_info = (const si_cores_info_t *)sii->cores_info;
+       uint32 cib;
+
+       cib = cores_info->cib[sii->curidx];
+       return ((cib & CIB_REV_MASK) >> CIB_REV_SHIFT);
+}
+
+uint
+ai_corerev_minor(const si_t *sih)
+{
+       return (ai_core_sflags(sih, 0, 0) >> SISF_MINORREV_D11_SHIFT) &
+                       SISF_MINORREV_D11_MASK;
+}
+
+bool
+ai_iscoreup(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai = sii->curwrap;
+
+       return (((R_REG(sii->osh, &ai->ioctrl) & (SICF_FGC | SICF_CLOCK_EN)) == SICF_CLOCK_EN) &&
+               ((R_REG(sii->osh, &ai->resetctrl) & AIRC_RESET) == 0));
+}
+
+/*
+ * Switch to 'coreidx', issue a single arbitrary 32bit register mask&set operation,
+ * switch back to the original core, and return the new value.
+ *
+ * When using the silicon backplane, no fiddling with interrupts or core switches is needed.
+ *
+ * Also, when using pci/pcie, we can optimize away the core switching for pci registers
+ * and (on newer pci cores) chipcommon registers.
+ */
+uint
+ai_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val)
+{
+       uint origidx = 0;
+       volatile uint32 *r = NULL;
+       uint w;
+       bcm_int_bitmask_t intr_val;
+       bool fast = FALSE;
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       ASSERT(GOODIDX(coreidx, sii->numcores));
+       ASSERT(regoff < SI_CORE_SIZE);
+       ASSERT((val & ~mask) == 0);
+
+       if (coreidx >= SI_MAXCORES)
+               return 0;
+
+       if (BUSTYPE(sih->bustype) == SI_BUS) {
+               /* If internal bus, we can always get at everything */
+               fast = TRUE;
+               /* map if does not exist */
+               if (!cores_info->regs[coreidx]) {
+                       cores_info->regs[coreidx] = REG_MAP(cores_info->coresba[coreidx],
+                                                   SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->regs[coreidx]));
+               }
+               r = (volatile uint32 *)((volatile uchar *)cores_info->regs[coreidx] + regoff);
+       } else if (BUSTYPE(sih->bustype) == PCI_BUS) {
+               /* If pci/pcie, we can get at pci/pcie regs and on newer cores to chipc */
+
+               if ((cores_info->coreid[coreidx] == CC_CORE_ID) && SI_FAST(sii)) {
+                       /* Chipc registers are mapped at 12KB */
+
+                       fast = TRUE;
+                       r = (volatile uint32 *)((volatile char *)sii->curmap +
+                                      PCI_16KB0_CCREGS_OFFSET + regoff);
+               } else if (sii->pub.buscoreidx == coreidx) {
+                       /* pci registers are at either in the last 2KB of an 8KB window
+                        * or, in pcie and pci rev 13 at 8KB
+                        */
+                       fast = TRUE;
+                       if (SI_FAST(sii))
+                               r = (volatile uint32 *)((volatile char *)sii->curmap +
+                                              PCI_16KB0_PCIREGS_OFFSET + regoff);
+                       else
+                               r = (volatile uint32 *)((volatile char *)sii->curmap +
+                                              ((regoff >= SBCONFIGOFF) ?
+                                               PCI_BAR0_PCISBR_OFFSET : PCI_BAR0_PCIREGS_OFFSET) +
+                                              regoff);
+               }
+       }
+
+       if (!fast) {
+               INTR_OFF(sii, &intr_val);
+
+               /* save current core index */
+               origidx = si_coreidx(&sii->pub);
+
+               /* switch core */
+               r = (volatile uint32*) ((volatile uchar*) ai_setcoreidx(&sii->pub, coreidx) +
+                              regoff);
+       }
+       ASSERT(r != NULL);
+
+       /* mask and set */
+       if (mask || val) {
+               w = (R_REG(sii->osh, r) & ~mask) | val;
+               W_REG(sii->osh, r, w);
+       }
+
+       /* readback */
+       w = R_REG(sii->osh, r);
+
+       if (!fast) {
+               /* restore core index */
+               if (origidx != coreidx)
+                       ai_setcoreidx(&sii->pub, origidx);
+
+               INTR_RESTORE(sii, &intr_val);
+       }
+
+       return (w);
+}
+
+/*
+ * Switch to 'coreidx', issue a single arbitrary 32bit register mask&set operation,
+ * switch back to the original core, and return the new value.
+ *
+ * When using the silicon backplane, no fiddling with interrupts or core switches is needed.
+ *
+ * Also, when using pci/pcie, we can optimize away the core switching for pci registers
+ * and (on newer pci cores) chipcommon registers.
+ */
+uint
+ai_corereg_writeonly(si_t *sih, uint coreidx, uint regoff, uint mask, uint val)
+{
+       uint origidx = 0;
+       volatile uint32 *r = NULL;
+       uint w = 0;
+       bcm_int_bitmask_t intr_val;
+       bool fast = FALSE;
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       ASSERT(GOODIDX(coreidx, sii->numcores));
+       ASSERT(regoff < SI_CORE_SIZE);
+       ASSERT((val & ~mask) == 0);
+
+       if (coreidx >= SI_MAXCORES)
+               return 0;
+
+       if (BUSTYPE(sih->bustype) == SI_BUS) {
+               /* If internal bus, we can always get at everything */
+               fast = TRUE;
+               /* map if does not exist */
+               if (!cores_info->regs[coreidx]) {
+                       cores_info->regs[coreidx] = REG_MAP(cores_info->coresba[coreidx],
+                                                   SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->regs[coreidx]));
+               }
+               r = (volatile uint32 *)((volatile uchar *)cores_info->regs[coreidx] + regoff);
+       } else if (BUSTYPE(sih->bustype) == PCI_BUS) {
+               /* If pci/pcie, we can get at pci/pcie regs and on newer cores to chipc */
+
+               if ((cores_info->coreid[coreidx] == CC_CORE_ID) && SI_FAST(sii)) {
+                       /* Chipc registers are mapped at 12KB */
+
+                       fast = TRUE;
+                       r = (volatile uint32 *)((volatile char *)sii->curmap +
+                                      PCI_16KB0_CCREGS_OFFSET + regoff);
+               } else if (sii->pub.buscoreidx == coreidx) {
+                       /* pci registers are at either in the last 2KB of an 8KB window
+                        * or, in pcie and pci rev 13 at 8KB
+                        */
+                       fast = TRUE;
+                       if (SI_FAST(sii))
+                               r = (volatile uint32 *)((volatile char *)sii->curmap +
+                                              PCI_16KB0_PCIREGS_OFFSET + regoff);
+                       else
+                               r = (volatile uint32 *)((volatile char *)sii->curmap +
+                                              ((regoff >= SBCONFIGOFF) ?
+                                               PCI_BAR0_PCISBR_OFFSET : PCI_BAR0_PCIREGS_OFFSET) +
+                                              regoff);
+               }
+       }
+
+       if (!fast) {
+               INTR_OFF(sii, &intr_val);
+
+               /* save current core index */
+               origidx = si_coreidx(&sii->pub);
+
+               /* switch core */
+               r = (volatile uint32*) ((volatile uchar*) ai_setcoreidx(&sii->pub, coreidx) +
+                              regoff);
+       }
+       ASSERT(r != NULL);
+
+       /* mask and set */
+       if (mask || val) {
+               w = (R_REG(sii->osh, r) & ~mask) | val;
+               W_REG(sii->osh, r, w);
+       }
+
+       if (!fast) {
+               /* restore core index */
+               if (origidx != coreidx)
+                       ai_setcoreidx(&sii->pub, origidx);
+
+               INTR_RESTORE(sii, &intr_val);
+       }
+
+       return (w);
+}
+
+/*
+ * If there is no need for fiddling with interrupts or core switches (typically silicon
+ * back plane registers, pci registers and chipcommon registers), this function
+ * returns the register offset on this core to a mapped address. This address can
+ * be used for W_REG/R_REG directly.
+ *
+ * For accessing registers that would need a core switch, this function will return
+ * NULL.
+ */
+volatile uint32 *
+ai_corereg_addr(si_t *sih, uint coreidx, uint regoff)
+{
+       volatile uint32 *r = NULL;
+       bool fast = FALSE;
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       ASSERT(GOODIDX(coreidx, sii->numcores));
+       ASSERT(regoff < SI_CORE_SIZE);
+
+       if (coreidx >= SI_MAXCORES)
+               return 0;
+
+       if (BUSTYPE(sih->bustype) == SI_BUS) {
+               /* If internal bus, we can always get at everything */
+               fast = TRUE;
+               /* map if does not exist */
+               if (!cores_info->regs[coreidx]) {
+                       cores_info->regs[coreidx] = REG_MAP(cores_info->coresba[coreidx],
+                                                   SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->regs[coreidx]));
+               }
+               r = (volatile uint32 *)((volatile uchar *)cores_info->regs[coreidx] + regoff);
+       } else if (BUSTYPE(sih->bustype) == PCI_BUS) {
+               /* If pci/pcie, we can get at pci/pcie regs and on newer cores to chipc */
+
+               if ((cores_info->coreid[coreidx] == CC_CORE_ID) && SI_FAST(sii)) {
+                       /* Chipc registers are mapped at 12KB */
+
+                       fast = TRUE;
+                       r = (volatile uint32 *)((volatile char *)sii->curmap +
+                                      PCI_16KB0_CCREGS_OFFSET + regoff);
+               } else if (sii->pub.buscoreidx == coreidx) {
+                       /* pci registers are at either in the last 2KB of an 8KB window
+                        * or, in pcie and pci rev 13 at 8KB
+                        */
+                       fast = TRUE;
+                       if (SI_FAST(sii))
+                               r = (volatile uint32 *)((volatile char *)sii->curmap +
+                                              PCI_16KB0_PCIREGS_OFFSET + regoff);
+                       else
+                               r = (volatile uint32 *)((volatile char *)sii->curmap +
+                                              ((regoff >= SBCONFIGOFF) ?
+                                               PCI_BAR0_PCISBR_OFFSET : PCI_BAR0_PCIREGS_OFFSET) +
+                                              regoff);
+               }
+       }
+
+       if (!fast) {
+               ASSERT(sii->curidx == coreidx);
+               r = (volatile uint32*) ((volatile uchar*)sii->curmap + regoff);
+       }
+
+       return (r);
+}
+
+void
+ai_core_disable(const si_t *sih, uint32 bits)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       volatile uint32 dummy;
+       uint32 status;
+       aidmp_t *ai;
+
+       ASSERT(GOODREGS(sii->curwrap));
+       ai = sii->curwrap;
+
+       /* if core is already in reset, just return */
+       if (R_REG(sii->osh, &ai->resetctrl) & AIRC_RESET) {
+               return;
+       }
+
+       /* ensure there are no pending backplane operations */
+       SPINWAIT(((status = R_REG(sii->osh, &ai->resetstatus)) != 0), 300);
+
+       /* if pending backplane ops still, try waiting longer */
+       if (status != 0) {
+               /* 300usecs was sufficient to allow backplane ops to clear for big hammer */
+               /* during driver load we may need more time */
+               SPINWAIT(((status = R_REG(sii->osh, &ai->resetstatus)) != 0), 10000);
+               /* if still pending ops, continue on and try disable anyway */
+               /* this is in big hammer path, so don't call wl_reinit in this case... */
+       }
+
+       W_REG(sii->osh, &ai->resetctrl, AIRC_RESET);
+       dummy = R_REG(sii->osh, &ai->resetctrl);
+       BCM_REFERENCE(dummy);
+       OSL_DELAY(1);
+
+       W_REG(sii->osh, &ai->ioctrl, bits);
+       dummy = R_REG(sii->osh, &ai->ioctrl);
+       BCM_REFERENCE(dummy);
+       OSL_DELAY(10);
+}
+
+/* reset and re-enable a core
+ * inputs:
+ * bits - core specific bits that are set during and after reset sequence
+ * resetbits - core specific bits that are set only during reset sequence
+ */
+static void
+_ai_core_reset(const si_t *sih, uint32 bits, uint32 resetbits)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+       volatile uint32 dummy;
+       uint loop_counter = 10;
+
+       ASSERT(GOODREGS(sii->curwrap));
+       ai = sii->curwrap;
+
+       /* ensure there are no pending backplane operations */
+       SPINWAIT(((dummy = R_REG(sii->osh, &ai->resetstatus)) != 0), 300);
+
+       /* put core into reset state */
+       W_REG(sii->osh, &ai->resetctrl, AIRC_RESET);
+       OSL_DELAY(10);
+
+       /* ensure there are no pending backplane operations */
+       SPINWAIT((R_REG(sii->osh, &ai->resetstatus) != 0), 300);
+
+       W_REG(sii->osh, &ai->ioctrl, (bits | resetbits | SICF_FGC | SICF_CLOCK_EN));
+       dummy = R_REG(sii->osh, &ai->ioctrl);
+       BCM_REFERENCE(dummy);
+#ifdef UCM_CORRUPTION_WAR
+       if (si_coreid(sih) == D11_CORE_ID) {
+               /* Reset FGC */
+               OSL_DELAY(1);
+               W_REG(sii->osh, &ai->ioctrl, (dummy & (~SICF_FGC)));
+       }
+#endif /* UCM_CORRUPTION_WAR */
+       /* ensure there are no pending backplane operations */
+       SPINWAIT(((dummy = R_REG(sii->osh, &ai->resetstatus)) != 0), 300);
+
+       while (R_REG(sii->osh, &ai->resetctrl) != 0 && --loop_counter != 0) {
+               /* ensure there are no pending backplane operations */
+               SPINWAIT(((dummy = R_REG(sii->osh, &ai->resetstatus)) != 0), 300);
+
+               /* take core out of reset */
+               W_REG(sii->osh, &ai->resetctrl, 0);
+
+               /* ensure there are no pending backplane operations */
+               SPINWAIT((R_REG(sii->osh, &ai->resetstatus) != 0), 300);
+       }
+
+#ifdef UCM_CORRUPTION_WAR
+       /* Pulse FGC after lifting Reset */
+       W_REG(sii->osh, &ai->ioctrl, (bits | SICF_FGC | SICF_CLOCK_EN));
+#else
+       W_REG(sii->osh, &ai->ioctrl, (bits | SICF_CLOCK_EN));
+#endif /* UCM_CORRUPTION_WAR */
+       dummy = R_REG(sii->osh, &ai->ioctrl);
+       BCM_REFERENCE(dummy);
+#ifdef UCM_CORRUPTION_WAR
+       if (si_coreid(sih) == D11_CORE_ID) {
+               /* Reset FGC */
+               OSL_DELAY(1);
+               W_REG(sii->osh, &ai->ioctrl, (dummy & (~SICF_FGC)));
+       }
+#endif /* UCM_CORRUPTION_WAR */
+       OSL_DELAY(1);
+}
+
+void
+ai_core_reset(si_t *sih, uint32 bits, uint32 resetbits)
+{
+       si_info_t *sii = SI_INFO(sih);
+       const si_cores_info_t *cores_info = (const si_cores_info_t *)sii->cores_info;
+       uint idx = sii->curidx;
+
+       if (cores_info->wrapba3[idx] != 0) {
+               ai_setcoreidx_3rdwrap(sih, idx);
+               _ai_core_reset(sih, bits, resetbits);
+               ai_setcoreidx(sih, idx);
+       }
+
+       if (cores_info->wrapba2[idx] != 0) {
+               ai_setcoreidx_2ndwrap(sih, idx);
+               _ai_core_reset(sih, bits, resetbits);
+               ai_setcoreidx(sih, idx);
+       }
+
+       _ai_core_reset(sih, bits, resetbits);
+}
+
+#ifdef BOOKER_NIC400_INF
+void
+ai_core_reset_ext(const si_t *sih, uint32 bits, uint32 resetbits)
+{
+       _ai_core_reset(sih, bits, resetbits);
+}
+#endif /* BOOKER_NIC400_INF */
+
+void
+ai_core_cflags_wo(const si_t *sih, uint32 mask, uint32 val)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+       uint32 w;
+
+       if (PMU_DMP()) {
+               SI_ERROR(("ai_core_cflags_wo: Accessing PMU DMP register (ioctrl)\n"));
+               return;
+       }
+
+       ASSERT(GOODREGS(sii->curwrap));
+       ai = sii->curwrap;
+
+       ASSERT((val & ~mask) == 0);
+
+       if (mask || val) {
+               w = ((R_REG(sii->osh, &ai->ioctrl) & ~mask) | val);
+               W_REG(sii->osh, &ai->ioctrl, w);
+       }
+}
+
+uint32
+ai_core_cflags(const si_t *sih, uint32 mask, uint32 val)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+       uint32 w;
+
+       if (PMU_DMP()) {
+               SI_ERROR(("ai_core_cflags: Accessing PMU DMP register (ioctrl)\n"));
+               return 0;
+       }
+       ASSERT(GOODREGS(sii->curwrap));
+       ai = sii->curwrap;
+
+       ASSERT((val & ~mask) == 0);
+
+       if (mask || val) {
+               w = ((R_REG(sii->osh, &ai->ioctrl) & ~mask) | val);
+               W_REG(sii->osh, &ai->ioctrl, w);
+       }
+
+       return R_REG(sii->osh, &ai->ioctrl);
+}
+
+uint32
+ai_core_sflags(const si_t *sih, uint32 mask, uint32 val)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+       uint32 w;
+
+       if (PMU_DMP()) {
+               SI_ERROR(("ai_core_sflags: Accessing PMU DMP register (ioctrl)\n"));
+               return 0;
+       }
+
+       ASSERT(GOODREGS(sii->curwrap));
+       ai = sii->curwrap;
+
+       ASSERT((val & ~mask) == 0);
+       ASSERT((mask & ~SISF_CORE_BITS) == 0);
+
+       if (mask || val) {
+               w = ((R_REG(sii->osh, &ai->iostatus) & ~mask) | val);
+               W_REG(sii->osh, &ai->iostatus, w);
+       }
+
+       return R_REG(sii->osh, &ai->iostatus);
+}
+
+#if defined(BCMDBG_PHYDUMP)
+/* print interesting aidmp registers */
+void
+ai_dumpregs(const si_t *sih, struct bcmstrbuf *b)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       osl_t *osh;
+       aidmp_t *ai;
+       uint i;
+       uint32 prev_value = 0;
+       const axi_wrapper_t * axi_wrapper = sii->axi_wrapper;
+       uint32 cfg_reg = 0;
+       uint bar0_win_offset = 0;
+
+       osh = sii->osh;
+
+       /* Save and restore wrapper access window */
+       if (BUSTYPE(sii->pub.bustype) == PCI_BUS) {
+               if (PCIE_GEN2(sii)) {
+                       cfg_reg = PCIE2_BAR0_CORE2_WIN2;
+                       bar0_win_offset = PCIE2_BAR0_CORE2_WIN2_OFFSET;
+               } else {
+                       cfg_reg = PCI_BAR0_WIN2;
+                       bar0_win_offset = PCI_BAR0_WIN2_OFFSET;
+               }
+
+               prev_value = OSL_PCI_READ_CONFIG(osh, cfg_reg, 4);
+
+               if (prev_value == ID32_INVALID) {
+                       SI_PRINT(("ai_dumpregs, PCI_BAR0_WIN2 - %x\n", prev_value));
+                       return;
+               }
+       }
+
+       bcm_bprintf(b, "ChipNum:%x, ChipRev;%x, BusType:%x, BoardType:%x, BoardVendor:%x\n\n",
+               sih->chip, sih->chiprev, sih->bustype, sih->boardtype, sih->boardvendor);
+
+       for (i = 0; i < sii->axi_num_wrappers; i++) {
+
+               if (BUSTYPE(sii->pub.bustype) == PCI_BUS) {
+                       /* Set BAR0 window to bridge wapper base address */
+                       OSL_PCI_WRITE_CONFIG(osh,
+                               cfg_reg, 4, axi_wrapper[i].wrapper_addr);
+
+                       ai = (aidmp_t *) ((volatile uint8*)sii->curmap + bar0_win_offset);
+               } else {
+                       ai = (aidmp_t *)(uintptr) axi_wrapper[i].wrapper_addr;
+               }
+
+               bcm_bprintf(b, "core 0x%x: core_rev:%d, %s_WR ADDR:%x \n", axi_wrapper[i].cid,
+                       axi_wrapper[i].rev,
+                       axi_wrapper[i].wrapper_type == AI_SLAVE_WRAPPER ? "SLAVE" : "MASTER",
+                       axi_wrapper[i].wrapper_addr);
+
+               bcm_bprintf(b, "ioctrlset 0x%x ioctrlclear 0x%x ioctrl 0x%x iostatus 0x%x "
+                           "ioctrlwidth 0x%x iostatuswidth 0x%x\n"
+                           "resetctrl 0x%x resetstatus 0x%x resetreadid 0x%x resetwriteid 0x%x\n"
+                           "errlogctrl 0x%x errlogdone 0x%x errlogstatus 0x%x "
+                           "errlogaddrlo 0x%x errlogaddrhi 0x%x\n"
+                           "errlogid 0x%x errloguser 0x%x errlogflags 0x%x\n"
+                           "intstatus 0x%x config 0x%x itcr 0x%x\n\n",
+                           R_REG(osh, &ai->ioctrlset),
+                           R_REG(osh, &ai->ioctrlclear),
+                           R_REG(osh, &ai->ioctrl),
+                           R_REG(osh, &ai->iostatus),
+                           R_REG(osh, &ai->ioctrlwidth),
+                           R_REG(osh, &ai->iostatuswidth),
+                           R_REG(osh, &ai->resetctrl),
+                           R_REG(osh, &ai->resetstatus),
+                           R_REG(osh, &ai->resetreadid),
+                           R_REG(osh, &ai->resetwriteid),
+                           R_REG(osh, &ai->errlogctrl),
+                           R_REG(osh, &ai->errlogdone),
+                           R_REG(osh, &ai->errlogstatus),
+                           R_REG(osh, &ai->errlogaddrlo),
+                           R_REG(osh, &ai->errlogaddrhi),
+                           R_REG(osh, &ai->errlogid),
+                           R_REG(osh, &ai->errloguser),
+                           R_REG(osh, &ai->errlogflags),
+                           R_REG(osh, &ai->intstatus),
+                           R_REG(osh, &ai->config),
+                           R_REG(osh, &ai->itcr));
+       }
+
+       /* Restore the initial wrapper space */
+       if (BUSTYPE(sii->pub.bustype) == PCI_BUS) {
+               if (prev_value && cfg_reg) {
+                       OSL_PCI_WRITE_CONFIG(osh, cfg_reg, 4, prev_value);
+               }
+       }
+}
+#endif
+
+void
+ai_update_backplane_timeouts(const si_t *sih, bool enable, uint32 timeout_exp, uint32 cid)
+{
+#if defined(AXI_TIMEOUTS) || defined(AXI_TIMEOUTS_NIC)
+       const si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+       uint32 i;
+       axi_wrapper_t * axi_wrapper = sii->axi_wrapper;
+       uint32 errlogctrl = (enable << AIELC_TO_ENAB_SHIFT) |
+               ((timeout_exp << AIELC_TO_EXP_SHIFT) & AIELC_TO_EXP_MASK);
+
+#ifdef AXI_TIMEOUTS_NIC
+       uint32 prev_value = 0;
+       osl_t *osh = sii->osh;
+       uint32 cfg_reg = 0;
+       uint32 offset = 0;
+#endif /* AXI_TIMEOUTS_NIC */
+
+       if ((sii->axi_num_wrappers == 0) ||
+#ifdef AXI_TIMEOUTS_NIC
+               (!PCIE(sii)) ||
+#endif /* AXI_TIMEOUTS_NIC */
+               FALSE) {
+               SI_VMSG((" iai_update_backplane_timeouts, axi_num_wrappers:%d, Is_PCIE:%d,"
+                       " BUS_TYPE:%d, ID:%x\n",
+                       sii->axi_num_wrappers, PCIE(sii),
+                       BUSTYPE(sii->pub.bustype), sii->pub.buscoretype));
+               return;
+       }
+
+#ifdef AXI_TIMEOUTS_NIC
+       /* Save and restore the wrapper access window */
+       if (BUSTYPE(sii->pub.bustype) == PCI_BUS) {
+               if (PCIE_GEN1(sii)) {
+                       cfg_reg = PCI_BAR0_WIN2;
+                       offset = PCI_BAR0_WIN2_OFFSET;
+               } else if (PCIE_GEN2(sii)) {
+                       cfg_reg = PCIE2_BAR0_CORE2_WIN2;
+                       offset = PCIE2_BAR0_CORE2_WIN2_OFFSET;
+               }
+               else {
+                       ASSERT(!"!PCIE_GEN1 && !PCIE_GEN2");
+               }
+
+               prev_value = OSL_PCI_READ_CONFIG(osh, cfg_reg, 4);
+               if (prev_value == ID32_INVALID) {
+                       SI_PRINT(("ai_update_backplane_timeouts, PCI_BAR0_WIN2 - %x\n",
+                               prev_value));
+                       return;
+               }
+       }
+#endif /* AXI_TIMEOUTS_NIC */
+
+       for (i = 0; i < sii->axi_num_wrappers; ++i) {
+               /* WAR for wrong EROM entries w.r.t slave and master wrapper
+                * for ADB bridge core...so checking actual wrapper config to determine type
+                * http://jira.broadcom.com/browse/HW4388-905
+               */
+               if ((cid == 0 || cid == ADB_BRIDGE_ID) &&
+                               (axi_wrapper[i].cid == ADB_BRIDGE_ID)) {
+                       /* WAR is applicable only to 89B0 and 89C0 */
+                       if (CCREV(sih->ccrev) == 70) {
+                               ai = (aidmp_t *)(uintptr)axi_wrapper[i].wrapper_addr;
+                               if (R_REG(sii->osh, &ai->config) & WRAPPER_TIMEOUT_CONFIG) {
+                                       axi_wrapper[i].wrapper_type  = AI_SLAVE_WRAPPER;
+                               } else {
+                                       axi_wrapper[i].wrapper_type  = AI_MASTER_WRAPPER;
+                               }
+                       }
+               }
+               if (axi_wrapper[i].wrapper_type != AI_SLAVE_WRAPPER || (BCM4389_CHIP(sih->chip) &&
+                               (axi_wrapper[i].wrapper_addr == WL_BRIDGE1_S ||
+                               axi_wrapper[i].wrapper_addr == WL_BRIDGE2_S))) {
+                       SI_VMSG(("SKIP ENABLE BPT: MFG:%x, CID:%x, ADDR:%x\n",
+                               axi_wrapper[i].mfg,
+                               axi_wrapper[i].cid,
+                               axi_wrapper[i].wrapper_addr));
+                       continue;
+               }
+
+               /* Update only given core if requested */
+               if ((cid != 0) && (axi_wrapper[i].cid != cid)) {
+                       continue;
+               }
+
+#ifdef AXI_TIMEOUTS_NIC
+               if (BUSTYPE(sii->pub.bustype) == PCI_BUS) {
+                       /* Set BAR0_CORE2_WIN2 to bridge wapper base address */
+                       OSL_PCI_WRITE_CONFIG(osh,
+                               cfg_reg, 4, axi_wrapper[i].wrapper_addr);
+
+                       /* set AI to BAR0 + Offset corresponding to Gen1 or gen2 */
+                       ai = (aidmp_t *) (DISCARD_QUAL(sii->curmap, uint8) + offset);
+               }
+               else
+#endif /* AXI_TIMEOUTS_NIC */
+               {
+                       ai = (aidmp_t *)(uintptr) axi_wrapper[i].wrapper_addr;
+               }
+
+               W_REG(sii->osh, &ai->errlogctrl, errlogctrl);
+
+               SI_VMSG(("ENABLED BPT: MFG:%x, CID:%x, ADDR:%x, ERR_CTRL:%x\n",
+                       axi_wrapper[i].mfg,
+                       axi_wrapper[i].cid,
+                       axi_wrapper[i].wrapper_addr,
+                       R_REG(sii->osh, &ai->errlogctrl)));
+       }
+
+#ifdef AXI_TIMEOUTS_NIC
+       /* Restore the initial wrapper space */
+       if (prev_value) {
+               OSL_PCI_WRITE_CONFIG(osh, cfg_reg, 4, prev_value);
+       }
+#endif /* AXI_TIMEOUTS_NIC */
+
+#endif /* AXI_TIMEOUTS || AXI_TIMEOUTS_NIC */
+}
+
+#if defined(AXI_TIMEOUTS) || defined(AXI_TIMEOUTS_NIC)
+
+/* slave error is ignored, so account for those cases */
+static uint32 si_ignore_errlog_cnt = 0;
+
+static bool
+ai_ignore_errlog(const si_info_t *sii, const aidmp_t *ai,
+       uint32 lo_addr, uint32 hi_addr, uint32 err_axi_id, uint32 errsts)
+{
+       uint32 ignore_errsts = AIELS_SLAVE_ERR;
+       uint32 ignore_errsts_2 = 0;
+       uint32 ignore_hi = BT_CC_SPROM_BADREG_HI;
+       uint32 ignore_lo = BT_CC_SPROM_BADREG_LO;
+       uint32 ignore_size = BT_CC_SPROM_BADREG_SIZE;
+       bool address_check = TRUE;
+       uint32 axi_id = 0;
+       uint32 axi_id2 = 0;
+       bool extd_axi_id_mask = FALSE;
+       uint32 axi_id_mask;
+
+       SI_PRINT(("err check: core %p, error %d, axi id 0x%04x, addr(0x%08x:%08x)\n",
+               ai, errsts, err_axi_id, hi_addr, lo_addr));
+
+       /* ignore the BT slave errors if the errlog is to chipcommon addr 0x190 */
+       switch (CHIPID(sii->pub.chip)) {
+#if defined(BT_WLAN_REG_ON_WAR)
+               /*
+                * 4389B0/C0 - WL and BT turn on WAR, ignore AXI error originating from
+                * AHB-AXI bridge i.e, any slave error or timeout from BT access
+                */
+               case BCM4389_CHIP_GRPID:
+                       axi_id = BCM4389_BT_AXI_ID;
+                       ignore_errsts = AIELS_SLAVE_ERR;
+                       axi_id2 = BCM4389_BT_AXI_ID;
+                       ignore_errsts_2 = AIELS_TIMEOUT;
+                       address_check = FALSE;
+                       extd_axi_id_mask = TRUE;
+                       break;
+#endif /* BT_WLAN_REG_ON_WAR */
+#ifdef BTOVERPCIE
+               case BCM4369_CHIP_GRPID:
+                       axi_id = BCM4369_BT_AXI_ID;
+               /* For BT over PCIE, ignore any slave error from BT. */
+               /* No need to check any address range */
+                       address_check = FALSE;
+                       ignore_errsts_2 = AIELS_DECODE;
+                       break;
+#endif /* BTOVERPCIE */
+               case BCM4376_CHIP_GRPID:
+               case BCM4378_CHIP_GRPID:
+               case BCM4385_CHIP_GRPID:
+               case BCM4387_CHIP_GRPID:
+#ifdef BTOVERPCIE
+                       axi_id = BCM4378_BT_AXI_ID;
+                       /* For BT over PCIE, ignore any slave error from BT. */
+                       /* No need to check any address range */
+                       address_check = FALSE;
+#endif /* BTOVERPCIE */
+                       axi_id2 = BCM4378_ARM_PREFETCH_AXI_ID;
+                       extd_axi_id_mask = TRUE;
+                       ignore_errsts_2 = AIELS_DECODE;
+                       break;
+               case BCM4368_CHIP_GRPID:
+                       axi_id = BCM4368_BT_AXI_ID;
+                       /* For BT over PCIE, ignore any slave error from BT. */
+                       /* No need to check any address range */
+                       address_check = FALSE;
+                       ignore_errsts_2 = AIELS_DECODE;
+                       break;
+               default:
+                       return FALSE;
+       }
+
+       axi_id_mask = extd_axi_id_mask ? AI_ERRLOGID_AXI_ID_MASK_EXTD : AI_ERRLOGID_AXI_ID_MASK;
+
+       /* AXI ID check */
+       err_axi_id &= axi_id_mask;
+       errsts &=  AIELS_ERROR_MASK;
+
+       /* check the ignore error cases. 2 checks */
+       if (!(((err_axi_id == axi_id) && (errsts == ignore_errsts)) ||
+               ((err_axi_id == axi_id2) && (errsts == ignore_errsts_2)))) {
+               /* not the error ignore cases */
+               return FALSE;
+
+       }
+
+       /* check the specific address checks now, if specified */
+       if (address_check) {
+               /* address range check */
+               if ((hi_addr != ignore_hi) ||
+                   (lo_addr < ignore_lo) || (lo_addr >= (ignore_lo + ignore_size))) {
+                       return FALSE;
+               }
+       }
+
+       SI_PRINT(("err check: ignored\n"));
+       return TRUE;
+}
+#endif /* defined (AXI_TIMEOUTS) || defined (AXI_TIMEOUTS_NIC) */
+
+#ifdef AXI_TIMEOUTS_NIC
+
+/* Function to return the APB bridge details corresponding to the core */
+static bool
+ai_get_apb_bridge(const si_t * sih, uint32 coreidx, uint32 *apb_id, uint32 * apb_coreunit)
+{
+       uint i;
+       uint32 core_base, core_end;
+       const si_info_t *sii = SI_INFO(sih);
+       static uint32 coreidx_cached = 0, apb_id_cached = 0, apb_coreunit_cached = 0;
+       uint32 tmp_coreunit = 0;
+       const si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       if (coreidx >= MIN(sii->numcores, SI_MAXCORES))
+               return FALSE;
+
+       /* Most of the time apb bridge query will be for d11 core.
+        * Maintain the last cache and return if found rather than iterating the table
+        */
+       if (coreidx_cached == coreidx) {
+               *apb_id = apb_id_cached;
+               *apb_coreunit = apb_coreunit_cached;
+               return TRUE;
+       }
+
+       core_base = cores_info->coresba[coreidx];
+       core_end = core_base + cores_info->coresba_size[coreidx];
+
+       for (i = 0; i < sii->numcores; i++) {
+               if (cores_info->coreid[i] == APB_BRIDGE_ID) {
+                       uint32 apb_base;
+                       uint32 apb_end;
+
+                       apb_base = cores_info->coresba[i];
+                       apb_end = apb_base + cores_info->coresba_size[i];
+
+                       if ((core_base >= apb_base) &&
+                               (core_end <= apb_end)) {
+                               /* Current core is attached to this APB bridge */
+                               *apb_id = apb_id_cached = APB_BRIDGE_ID;
+                               *apb_coreunit = apb_coreunit_cached = tmp_coreunit;
+                               coreidx_cached = coreidx;
+                               return TRUE;
+                       }
+                       /* Increment the coreunit */
+                       tmp_coreunit++;
+               }
+       }
+
+       return FALSE;
+}
+
+uint32
+ai_clear_backplane_to_fast(si_t *sih, void *addr)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       volatile const void *curmap = sii->curmap;
+       bool core_reg = FALSE;
+
+       /* Use fast path only for core register access */
+       if (((uintptr)addr >= (uintptr)curmap) &&
+               ((uintptr)addr < ((uintptr)curmap + SI_CORE_SIZE))) {
+               /* address being accessed is within current core reg map */
+               core_reg = TRUE;
+       }
+
+       if (core_reg) {
+               uint32 apb_id, apb_coreunit;
+
+               if (ai_get_apb_bridge(sih, si_coreidx(&sii->pub),
+                       &apb_id, &apb_coreunit) == TRUE) {
+                       /* Found the APB bridge corresponding to current core,
+                        * Check for bus errors in APB wrapper
+                        */
+                       return ai_clear_backplane_to_per_core(sih,
+                               apb_id, apb_coreunit, NULL);
+               }
+       }
+
+       /* Default is to poll for errors on all slave wrappers */
+       return si_clear_backplane_to(sih);
+}
+#endif /* AXI_TIMEOUTS_NIC */
+
+#if defined(AXI_TIMEOUTS) || defined(AXI_TIMEOUTS_NIC)
+static bool g_disable_backplane_logs = FALSE;
+
+static uint32 last_axi_error = AXI_WRAP_STS_NONE;
+static uint32 last_axi_error_log_status = 0;
+static uint32 last_axi_error_core = 0;
+static uint32 last_axi_error_wrap = 0;
+static uint32 last_axi_errlog_lo = 0;
+static uint32 last_axi_errlog_hi = 0;
+static uint32 last_axi_errlog_id = 0;
+
+/*
+ * API to clear the back plane timeout per core.
+ * Caller may passs optional wrapper address. If present this will be used as
+ * the wrapper base address. If wrapper base address is provided then caller
+ * must provide the coreid also.
+ * If both coreid and wrapper is zero, then err status of current bridge
+ * will be verified.
+ */
+uint32
+ai_clear_backplane_to_per_core(si_t *sih, uint coreid, uint coreunit, void *wrap)
+{
+       int ret = AXI_WRAP_STS_NONE;
+       aidmp_t *ai = NULL;
+       uint32 errlog_status = 0;
+       const si_info_t *sii = SI_INFO(sih);
+       uint32 errlog_lo = 0, errlog_hi = 0, errlog_id = 0, errlog_flags = 0;
+       uint32 current_coreidx = si_coreidx(sih);
+       uint32 target_coreidx = si_findcoreidx(sih, coreid, coreunit);
+
+#if defined(AXI_TIMEOUTS_NIC)
+       si_axi_error_t * axi_error = sih->err_info ?
+               &sih->err_info->axi_error[sih->err_info->count] : NULL;
+#endif /* AXI_TIMEOUTS_NIC */
+       bool restore_core = FALSE;
+
+       if ((sii->axi_num_wrappers == 0) ||
+#ifdef AXI_TIMEOUTS_NIC
+               (!PCIE(sii)) ||
+#endif /* AXI_TIMEOUTS_NIC */
+               FALSE) {
+               SI_VMSG(("ai_clear_backplane_to_per_core, axi_num_wrappers:%d, Is_PCIE:%d,"
+                       " BUS_TYPE:%d, ID:%x\n",
+                       sii->axi_num_wrappers, PCIE(sii),
+                       BUSTYPE(sii->pub.bustype), sii->pub.buscoretype));
+               return AXI_WRAP_STS_NONE;
+       }
+
+       if (wrap != NULL) {
+               ai = (aidmp_t *)wrap;
+       } else if (coreid && (target_coreidx != current_coreidx)) {
+
+               if (ai_setcoreidx(sih, target_coreidx) == NULL) {
+                       /* Unable to set the core */
+                       SI_PRINT(("Set Code Failed: coreid:%x, unit:%d, target_coreidx:%d\n",
+                               coreid, coreunit, target_coreidx));
+                       errlog_lo = target_coreidx;
+                       ret = AXI_WRAP_STS_SET_CORE_FAIL;
+                       goto end;
+               }
+
+               restore_core = TRUE;
+               ai = (aidmp_t *)si_wrapperregs(sih);
+       } else {
+               /* Read error status of current wrapper */
+               ai = (aidmp_t *)si_wrapperregs(sih);
+
+               /* Update CoreID to current Code ID */
+               coreid = si_coreid(sih);
+       }
+
+       /* read error log status */
+       errlog_status = R_REG(sii->osh, &ai->errlogstatus);
+
+       if (errlog_status == ID32_INVALID) {
+               /* Do not try to peek further */
+               SI_PRINT(("ai_clear_backplane_to_per_core, errlogstatus:%x - Slave Wrapper:%x\n",
+                       errlog_status, coreid));
+               ret = AXI_WRAP_STS_WRAP_RD_ERR;
+               errlog_lo = (uint32)(uintptr)&ai->errlogstatus;
+               goto end;
+       }
+
+       if ((errlog_status & AIELS_ERROR_MASK) != 0) {
+               uint32 tmp;
+               uint32 count = 0;
+               /* set ErrDone to clear the condition */
+               W_REG(sii->osh, &ai->errlogdone, AIELD_ERRDONE_MASK);
+
+               /* SPINWAIT on errlogstatus timeout status bits */
+               while ((tmp = R_REG(sii->osh, &ai->errlogstatus)) & AIELS_ERROR_MASK) {
+
+                       if (tmp == ID32_INVALID) {
+                               SI_PRINT(("ai_clear_backplane_to_per_core: prev errlogstatus:%x,"
+                                       " errlogstatus:%x\n",
+                                       errlog_status, tmp));
+                               ret = AXI_WRAP_STS_WRAP_RD_ERR;
+                               errlog_lo = (uint32)(uintptr)&ai->errlogstatus;
+                               goto end;
+                       }
+                       /*
+                        * Clear again, to avoid getting stuck in the loop, if a new error
+                        * is logged after we cleared the first timeout
+                        */
+                       W_REG(sii->osh, &ai->errlogdone, AIELD_ERRDONE_MASK);
+
+                       count++;
+                       OSL_DELAY(10);
+                       if ((10 * count) > AI_REG_READ_TIMEOUT) {
+                               errlog_status = tmp;
+                               break;
+                       }
+               }
+
+               errlog_lo = R_REG(sii->osh, &ai->errlogaddrlo);
+               errlog_hi = R_REG(sii->osh, &ai->errlogaddrhi);
+               errlog_id = R_REG(sii->osh, &ai->errlogid);
+               errlog_flags = R_REG(sii->osh, &ai->errlogflags);
+
+               /* we are already in the error path, so OK to check for the  slave error */
+               if (ai_ignore_errlog(sii, ai, errlog_lo, errlog_hi, errlog_id,
+                       errlog_status)) {
+                       si_ignore_errlog_cnt++;
+                       goto end;
+               }
+
+               /* only reset APB Bridge on timeout (not slave error, or dec error) */
+               switch (errlog_status & AIELS_ERROR_MASK) {
+                       case AIELS_SLAVE_ERR:
+                               SI_PRINT(("AXI slave error\n"));
+                               ret |= AXI_WRAP_STS_SLAVE_ERR;
+                               break;
+
+                       case AIELS_TIMEOUT:
+                               ai_reset_axi_to(sii, ai);
+                               ret |= AXI_WRAP_STS_TIMEOUT;
+                               break;
+
+                       case AIELS_DECODE:
+                               SI_PRINT(("AXI decode error\n"));
+                               {
+                                       ret |= AXI_WRAP_STS_DECODE_ERR;
+                               }
+                               break;
+                       default:
+                               ASSERT(0);      /* should be impossible */
+               }
+
+               if (errlog_status & AIELS_MULTIPLE_ERRORS) {
+                       SI_PRINT(("Multiple AXI Errors\n"));
+                       /* Set multiple errors bit only if actual error is not ignored */
+                       if (ret) {
+                               ret |= AXI_WRAP_STS_MULTIPLE_ERRORS;
+                       }
+               }
+
+               SI_PRINT(("\tCoreID: %x\n", coreid));
+               SI_PRINT(("\t errlog: lo 0x%08x, hi 0x%08x, id 0x%08x, flags 0x%08x"
+                       ", status 0x%08x\n",
+                       errlog_lo, errlog_hi, errlog_id, errlog_flags,
+                       errlog_status));
+       }
+
+end:
+       if (ret != AXI_WRAP_STS_NONE) {
+               last_axi_error = ret;
+               last_axi_error_log_status = errlog_status;
+               last_axi_error_core = coreid;
+               last_axi_error_wrap = (uint32)ai;
+               last_axi_errlog_lo = errlog_lo;
+               last_axi_errlog_hi = errlog_hi;
+               last_axi_errlog_id = errlog_id;
+       }
+
+#if defined(AXI_TIMEOUTS_NIC)
+       if (axi_error && (ret != AXI_WRAP_STS_NONE)) {
+               axi_error->error = ret;
+               axi_error->coreid = coreid;
+               axi_error->errlog_lo = errlog_lo;
+               axi_error->errlog_hi = errlog_hi;
+               axi_error->errlog_id = errlog_id;
+               axi_error->errlog_flags = errlog_flags;
+               axi_error->errlog_status = errlog_status;
+               sih->err_info->count++;
+
+               if (sih->err_info->count == SI_MAX_ERRLOG_SIZE) {
+                       sih->err_info->count = SI_MAX_ERRLOG_SIZE - 1;
+                       SI_PRINT(("AXI Error log overflow\n"));
+               }
+       }
+#endif /* AXI_TIMEOUTS_NIC */
+
+       if (restore_core) {
+               if (ai_setcoreidx(sih, current_coreidx) == NULL) {
+                       /* Unable to set the core */
+                       return ID32_INVALID;
+               }
+       }
+
+       return ret;
+}
+
+/* reset AXI timeout */
+static void
+ai_reset_axi_to(const si_info_t *sii, aidmp_t *ai)
+{
+       /* reset APB Bridge */
+       OR_REG(sii->osh, &ai->resetctrl, AIRC_RESET);
+       /* sync write */
+       (void)R_REG(sii->osh, &ai->resetctrl);
+       /* clear Reset bit */
+       AND_REG(sii->osh, &ai->resetctrl, ~(AIRC_RESET));
+       /* sync write */
+       (void)R_REG(sii->osh, &ai->resetctrl);
+       SI_PRINT(("AXI timeout\n"));
+       if (R_REG(sii->osh, &ai->resetctrl) & AIRC_RESET) {
+               SI_PRINT(("reset failed on wrapper %p\n", ai));
+               g_disable_backplane_logs = TRUE;
+       }
+}
+
+void
+ai_wrapper_get_last_error(const si_t *sih, uint32 *error_status, uint32 *core, uint32 *lo,
+       uint32 *hi, uint32 *id)
+{
+       *error_status = last_axi_error_log_status;
+       *core = last_axi_error_core;
+       *lo = last_axi_errlog_lo;
+       *hi = last_axi_errlog_hi;
+       *id = last_axi_errlog_id;
+}
+
+/* Function to check whether AXI timeout has been registered on a core */
+uint32
+ai_get_axi_timeout_reg(void)
+{
+       return (GOODREGS(last_axi_errlog_lo) ? last_axi_errlog_lo : 0);
+}
+#endif /* AXI_TIMEOUTS || AXI_TIMEOUTS_NIC */
+
+uint32
+ai_findcoreidx_by_axiid(const si_t *sih, uint32 axiid)
+{
+       uint coreid = 0;
+       uint coreunit = 0;
+       const axi_to_coreidx_t *axi2coreidx = NULL;
+       switch (CHIPID(sih->chip)) {
+               case BCM4369_CHIP_GRPID:
+                       axi2coreidx = axi2coreidx_4369;
+                       break;
+               default:
+                       SI_PRINT(("Chipid mapping not found\n"));
+                       break;
+       }
+
+       if (!axi2coreidx)
+               return (BADIDX);
+
+       coreid = axi2coreidx[axiid].coreid;
+       coreunit = axi2coreidx[axiid].coreunit;
+
+       return si_findcoreidx(sih, coreid, coreunit);
+
+}
+
+/*
+ * This API polls all slave wrappers for errors and returns bit map of
+ * all reported errors.
+ * return - bit map of
+ *     AXI_WRAP_STS_NONE
+ *     AXI_WRAP_STS_TIMEOUT
+ *     AXI_WRAP_STS_SLAVE_ERR
+ *     AXI_WRAP_STS_DECODE_ERR
+ *     AXI_WRAP_STS_PCI_RD_ERR
+ *     AXI_WRAP_STS_WRAP_RD_ERR
+ *     AXI_WRAP_STS_SET_CORE_FAIL
+ * On timeout detection, correspondign bridge will be reset to
+ * unblock the bus.
+ * Error reported in each wrapper can be retrieved using the API
+ * si_get_axi_errlog_info()
+ */
+uint32
+ai_clear_backplane_to(si_t *sih)
+{
+       uint32 ret = 0;
+#if defined(AXI_TIMEOUTS) || defined(AXI_TIMEOUTS_NIC)
+       const si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+       uint32 i;
+       axi_wrapper_t * axi_wrapper = sii->axi_wrapper;
+
+#ifdef AXI_TIMEOUTS_NIC
+       uint32 prev_value = 0;
+       osl_t *osh = sii->osh;
+       uint32 cfg_reg = 0;
+       uint32 offset = 0;
+
+       if ((sii->axi_num_wrappers == 0) || (!PCIE(sii)))
+#else
+       if (sii->axi_num_wrappers == 0)
+#endif
+       {
+               SI_VMSG(("ai_clear_backplane_to, axi_num_wrappers:%d, Is_PCIE:%d, BUS_TYPE:%d,"
+                       " ID:%x\n",
+                       sii->axi_num_wrappers, PCIE(sii),
+                       BUSTYPE(sii->pub.bustype), sii->pub.buscoretype));
+               return AXI_WRAP_STS_NONE;
+       }
+
+#ifdef AXI_TIMEOUTS_NIC
+       /* Save and restore wrapper access window */
+       if (BUSTYPE(sii->pub.bustype) == PCI_BUS) {
+               if (PCIE_GEN1(sii)) {
+                       cfg_reg = PCI_BAR0_WIN2;
+                       offset = PCI_BAR0_WIN2_OFFSET;
+               } else if (PCIE_GEN2(sii)) {
+                       cfg_reg = PCIE2_BAR0_CORE2_WIN2;
+                       offset = PCIE2_BAR0_CORE2_WIN2_OFFSET;
+               }
+               else {
+                       ASSERT(!"!PCIE_GEN1 && !PCIE_GEN2");
+               }
+
+               prev_value = OSL_PCI_READ_CONFIG(osh, cfg_reg, 4);
+
+               if (prev_value == ID32_INVALID) {
+                       si_axi_error_t * axi_error =
+                               sih->err_info ?
+                                       &sih->err_info->axi_error[sih->err_info->count] :
+                                       NULL;
+
+                       SI_PRINT(("ai_clear_backplane_to, PCI_BAR0_WIN2 - %x\n", prev_value));
+                       if (axi_error) {
+                               axi_error->error = ret = AXI_WRAP_STS_PCI_RD_ERR;
+                               axi_error->errlog_lo = cfg_reg;
+                               sih->err_info->count++;
+
+                               if (sih->err_info->count == SI_MAX_ERRLOG_SIZE) {
+                                       sih->err_info->count = SI_MAX_ERRLOG_SIZE - 1;
+                                       SI_PRINT(("AXI Error log overflow\n"));
+                               }
+                       }
+
+                       return ret;
+               }
+       }
+#endif /* AXI_TIMEOUTS_NIC */
+
+       for (i = 0; i < sii->axi_num_wrappers; ++i) {
+               uint32 tmp;
+
+               if (axi_wrapper[i].wrapper_type != AI_SLAVE_WRAPPER) {
+                       continue;
+               }
+
+#ifdef AXI_TIMEOUTS_NIC
+               if (BUSTYPE(sii->pub.bustype) == PCI_BUS) {
+                       /* Set BAR0_CORE2_WIN2 to bridge wapper base address */
+                       OSL_PCI_WRITE_CONFIG(osh,
+                               cfg_reg, 4, axi_wrapper[i].wrapper_addr);
+
+                       /* set AI to BAR0 + Offset corresponding to Gen1 or gen2 */
+                       ai = (aidmp_t *) (DISCARD_QUAL(sii->curmap, uint8) + offset);
+               }
+               else
+#endif /* AXI_TIMEOUTS_NIC */
+               {
+                       ai = (aidmp_t *)(uintptr) axi_wrapper[i].wrapper_addr;
+               }
+
+               tmp = ai_clear_backplane_to_per_core(sih, axi_wrapper[i].cid, 0,
+                       DISCARD_QUAL(ai, void));
+
+               ret |= tmp;
+       }
+
+#ifdef AXI_TIMEOUTS_NIC
+       /* Restore the initial wrapper space */
+       if (prev_value) {
+               OSL_PCI_WRITE_CONFIG(osh, cfg_reg, 4, prev_value);
+       }
+#endif /* AXI_TIMEOUTS_NIC */
+
+#endif /* AXI_TIMEOUTS || AXI_TIMEOUTS_NIC */
+
+       return ret;
+}
+
+uint
+ai_num_slaveports(const si_t *sih, uint coreidx)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       const si_cores_info_t *cores_info = (const si_cores_info_t *)sii->cores_info;
+       uint32 cib;
+
+       cib = cores_info->cib[coreidx];
+       return ((cib & CIB_NSP_MASK) >> CIB_NSP_SHIFT);
+}
+
+#ifdef UART_TRAP_DBG
+void
+ai_dump_APB_Bridge_registers(const si_t *sih)
+{
+       aidmp_t *ai;
+       const si_info_t *sii = SI_INFO(sih);
+
+       ai = (aidmp_t *)sii->br_wrapba[0];
+       printf("APB Bridge 0\n");
+       printf("lo 0x%08x, hi 0x%08x, id 0x%08x, flags 0x%08x",
+               R_REG(sii->osh, &ai->errlogaddrlo),
+               R_REG(sii->osh, &ai->errlogaddrhi),
+               R_REG(sii->osh, &ai->errlogid),
+               R_REG(sii->osh, &ai->errlogflags));
+       printf("\n status 0x%08x\n", R_REG(sii->osh, &ai->errlogstatus));
+}
+#endif /* UART_TRAP_DBG */
+
+void
+ai_force_clocks(const si_t *sih, uint clock_state)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai, *ai_sec = NULL;
+       volatile uint32 dummy;
+       uint32 ioctrl;
+       const si_cores_info_t *cores_info = (const si_cores_info_t *)sii->cores_info;
+
+       ASSERT(GOODREGS(sii->curwrap));
+       ai = sii->curwrap;
+       if (cores_info->wrapba2[sii->curidx])
+               ai_sec = REG_MAP(cores_info->wrapba2[sii->curidx], SI_CORE_SIZE);
+
+       /* ensure there are no pending backplane operations */
+       SPINWAIT((R_REG(sii->osh, &ai->resetstatus) != 0), 300);
+
+       if (clock_state == FORCE_CLK_ON) {
+               ioctrl = R_REG(sii->osh, &ai->ioctrl);
+               W_REG(sii->osh, &ai->ioctrl, (ioctrl | SICF_FGC));
+               dummy = R_REG(sii->osh, &ai->ioctrl);
+               BCM_REFERENCE(dummy);
+               if (ai_sec) {
+                       ioctrl = R_REG(sii->osh, &ai_sec->ioctrl);
+                       W_REG(sii->osh, &ai_sec->ioctrl, (ioctrl | SICF_FGC));
+                       dummy = R_REG(sii->osh, &ai_sec->ioctrl);
+                       BCM_REFERENCE(dummy);
+               }
+       } else {
+               ioctrl = R_REG(sii->osh, &ai->ioctrl);
+               W_REG(sii->osh, &ai->ioctrl, (ioctrl & (~SICF_FGC)));
+               dummy = R_REG(sii->osh, &ai->ioctrl);
+               BCM_REFERENCE(dummy);
+               if (ai_sec) {
+                       ioctrl = R_REG(sii->osh, &ai_sec->ioctrl);
+                       W_REG(sii->osh, &ai_sec->ioctrl, (ioctrl & (~SICF_FGC)));
+                       dummy = R_REG(sii->osh, &ai_sec->ioctrl);
+                       BCM_REFERENCE(dummy);
+               }
+       }
+       /* ensure there are no pending backplane operations */
+       SPINWAIT((R_REG(sii->osh, &ai->resetstatus) != 0), 300);
+}
diff --git a/bcmdhd.101.10.240.x/bcm_app_utils.c b/bcmdhd.101.10.240.x/bcm_app_utils.c
new file mode 100644 (file)
index 0000000..62d0507
--- /dev/null
@@ -0,0 +1,1276 @@
+/*
+ * Misc utility routines used by kernel or app-level.
+ * Contents are wifi-specific, used by any kernel or app-level
+ * software that might want wifi things as it grows.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <typedefs.h>
+
+#ifdef BCMDRIVER
+#include <osl.h>
+#define strtoul(nptr, endptr, base) bcm_strtoul((nptr), (endptr), (base))
+#define tolower(c) (bcm_isupper((c)) ? ((c) + 'a' - 'A') : (c))
+#else /* BCMDRIVER */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <ctype.h>
+#ifndef ASSERT
+#define ASSERT(exp)
+#endif
+#endif /* BCMDRIVER */
+#include <bcmwifi_channels.h>
+
+#if defined(WIN32) && (defined(BCMDLL) || defined(WLMDLL))
+#include <bcmstdlib.h> /* For wlexe/Makefile.wlm_dll */
+#endif
+
+#include <bcmutils.h>
+#include <wlioctl.h>
+#include <wlioctl_utils.h>
+
+#ifndef BCMDRIVER
+/*     Take an array of measurments representing a single channel over time and return
+       a summary. Currently implemented as a simple average but could easily evolve
+       into more cpomplex alogrithms.
+*/
+cca_congest_channel_req_t *
+cca_per_chan_summary(cca_congest_channel_req_t *input, cca_congest_channel_req_t *avg, bool percent)
+{
+       int sec;
+       cca_congest_t totals;
+
+       totals.duration  = 0;
+       totals.congest_ibss  = 0;
+       totals.congest_obss  = 0;
+       totals.interference  = 0;
+       avg->num_secs = 0;
+
+       for (sec = 0; sec < input->num_secs; sec++) {
+               if (input->secs[sec].duration) {
+                       totals.duration += input->secs[sec].duration;
+                       totals.congest_ibss += input->secs[sec].congest_ibss;
+                       totals.congest_obss += input->secs[sec].congest_obss;
+                       totals.interference += input->secs[sec].interference;
+                       avg->num_secs++;
+               }
+       }
+       avg->chanspec = input->chanspec;
+
+       if (!avg->num_secs || !totals.duration)
+               return (avg);
+
+       if (percent) {
+               avg->secs[0].duration = totals.duration / avg->num_secs;
+               avg->secs[0].congest_ibss = totals.congest_ibss * 100/totals.duration;
+               avg->secs[0].congest_obss = totals.congest_obss * 100/totals.duration;
+               avg->secs[0].interference = totals.interference * 100/totals.duration;
+       } else {
+               avg->secs[0].duration = totals.duration / avg->num_secs;
+               avg->secs[0].congest_ibss = totals.congest_ibss / avg->num_secs;
+               avg->secs[0].congest_obss = totals.congest_obss / avg->num_secs;
+               avg->secs[0].interference = totals.interference / avg->num_secs;
+       }
+
+       return (avg);
+}
+
+static void
+cca_info(uint8 *bitmap, int num_bits, int *left, int *bit_pos)
+{
+       int i;
+       for (*left = 0, i = 0; i < num_bits; i++) {
+               if (isset(bitmap, i)) {
+                       (*left)++;
+                       *bit_pos = i;
+               }
+       }
+}
+
+static uint8
+spec_to_chan(chanspec_t chspec)
+{
+       uint8 center_ch, edge, primary, sb;
+
+       center_ch = CHSPEC_CHANNEL(chspec);
+
+       if (CHSPEC_IS20(chspec)) {
+               return center_ch;
+       } else {
+               /* the lower edge of the wide channel is half the bw from
+                * the center channel.
+                */
+               if (CHSPEC_IS40(chspec)) {
+                       edge = center_ch - CH_20MHZ_APART;
+               } else {
+                       /* must be 80MHz (until we support more) */
+                       ASSERT(CHSPEC_IS80(chspec));
+                       edge = center_ch - CH_40MHZ_APART;
+               }
+
+               /* find the channel number of the lowest 20MHz primary channel */
+               primary = edge + CH_10MHZ_APART;
+
+               /* select the actual subband */
+               sb = (chspec & WL_CHANSPEC_CTL_SB_MASK) >> WL_CHANSPEC_CTL_SB_SHIFT;
+               primary = primary + sb * CH_20MHZ_APART;
+
+               return primary;
+       }
+}
+
+/*
+       Take an array of measumrements representing summaries of different channels.
+       Return a recomended channel.
+       Interference is evil, get rid of that first.
+       Then hunt for lowest Other bss traffic.
+       Don't forget that channels with low duration times may not have accurate readings.
+       For the moment, do not overwrite input array.
+*/
+int
+cca_analyze(cca_congest_channel_req_t *input[], int num_chans, uint flags, chanspec_t *answer)
+{
+       uint8 *bitmap = NULL;   /* 38 Max channels needs 5 bytes  = 40 */
+       int i, left, winner, ret_val = 0;
+       uint32 min_obss = 1 << 30;
+       uint bitmap_sz;
+
+       bitmap_sz = CEIL(num_chans, NBBY);
+       bitmap = (uint8 *)malloc(bitmap_sz);
+       if (bitmap == NULL) {
+               printf("unable to allocate memory\n");
+               return BCME_NOMEM;
+       }
+
+       memset(bitmap, 0, bitmap_sz);
+       /* Initially, all channels are up for consideration */
+       for (i = 0; i < num_chans; i++) {
+               if (input[i]->chanspec)
+                       setbit(bitmap, i);
+       }
+       cca_info(bitmap, num_chans, &left, &i);
+       if (!left) {
+               ret_val = CCA_ERRNO_TOO_FEW;
+               goto f_exit;
+       }
+
+       /* Filter for 2.4 GHz Band */
+       if (flags & CCA_FLAG_2G_ONLY) {
+               for (i = 0; i < num_chans; i++) {
+                       if (!CHSPEC_IS2G(input[i]->chanspec))
+                               clrbit(bitmap, i);
+               }
+       }
+       cca_info(bitmap, num_chans, &left, &i);
+       if (!left) {
+               ret_val = CCA_ERRNO_BAND;
+               goto f_exit;
+       }
+
+       /* Filter for 5 GHz Band */
+       if (flags & CCA_FLAG_5G_ONLY) {
+               for (i = 0; i < num_chans; i++) {
+                       if (!CHSPEC_IS5G(input[i]->chanspec))
+                               clrbit(bitmap, i);
+               }
+       }
+       cca_info(bitmap, num_chans, &left, &i);
+       if (!left) {
+               ret_val = CCA_ERRNO_BAND;
+               goto f_exit;
+       }
+
+       /* Filter for Duration */
+       if (!(flags & CCA_FLAG_IGNORE_DURATION)) {
+               for (i = 0; i < num_chans; i++) {
+                       if (input[i]->secs[0].duration < CCA_THRESH_MILLI)
+                               clrbit(bitmap, i);
+               }
+       }
+       cca_info(bitmap, num_chans, &left, &i);
+       if (!left) {
+               ret_val = CCA_ERRNO_DURATION;
+               goto f_exit;
+       }
+
+       /* Filter for 1 6 11 on 2.4 Band */
+       if (flags &  CCA_FLAGS_PREFER_1_6_11) {
+               int tmp_channel = spec_to_chan(input[i]->chanspec);
+               int is2g = CHSPEC_IS2G(input[i]->chanspec);
+               for (i = 0; i < num_chans; i++) {
+                       if (is2g && tmp_channel != 1 && tmp_channel != 6 && tmp_channel != 11)
+                               clrbit(bitmap, i);
+               }
+       }
+       cca_info(bitmap, num_chans, &left, &i);
+       if (!left) {
+               ret_val = CCA_ERRNO_PREF_CHAN;
+               goto f_exit;
+       }
+
+       /* Toss high interference interference */
+       if (!(flags & CCA_FLAG_IGNORE_INTERFER)) {
+               for (i = 0; i < num_chans; i++) {
+                       if (input[i]->secs[0].interference > CCA_THRESH_INTERFERE)
+                               clrbit(bitmap, i);
+               }
+               cca_info(bitmap, num_chans, &left, &i);
+               if (!left) {
+                       ret_val = CCA_ERRNO_INTERFER;
+                       goto f_exit;
+               }
+       }
+
+       /* Now find lowest obss */
+       winner = 0;
+       for (i = 0; i < num_chans; i++) {
+               if (isset(bitmap, i) && input[i]->secs[0].congest_obss < min_obss) {
+                       winner = i;
+                       min_obss = input[i]->secs[0].congest_obss;
+               }
+       }
+       *answer = input[winner]->chanspec;
+       f_exit:
+       free(bitmap);   /* free the allocated memory for bitmap */
+       return ret_val;
+}
+#endif /* !BCMDRIVER */
+
+/* offset of cntmember by sizeof(uint32) from the first cnt variable, txframe. */
+#define IDX_IN_WL_CNT_VER_6_T(cntmember)               \
+       ((OFFSETOF(wl_cnt_ver_6_t, cntmember) - OFFSETOF(wl_cnt_ver_6_t, txframe)) / sizeof(uint32))
+
+#define IDX_IN_WL_CNT_VER_7_T(cntmember)               \
+       ((OFFSETOF(wl_cnt_ver_7_t, cntmember) - OFFSETOF(wl_cnt_ver_7_t, txframe)) / sizeof(uint32))
+
+#define IDX_IN_WL_CNT_VER_11_T(cntmember)              \
+       ((OFFSETOF(wl_cnt_ver_11_t, cntmember) - OFFSETOF(wl_cnt_ver_11_t, txframe))    \
+       / sizeof(uint32))
+
+/* Exclude version and length fields */
+#define NUM_OF_CNT_IN_WL_CNT_VER_6_T   \
+       ((sizeof(wl_cnt_ver_6_t) - 2 * sizeof(uint16)) / sizeof(uint32))
+/* Exclude macstat cnt variables. wl_cnt_ver_6_t only has 62 macstat cnt variables. */
+#define NUM_OF_WLCCNT_IN_WL_CNT_VER_6_T                        \
+       (NUM_OF_CNT_IN_WL_CNT_VER_6_T - (WL_CNT_MCST_VAR_NUM - 2))
+
+/* Exclude version and length fields */
+#define NUM_OF_CNT_IN_WL_CNT_VER_7_T   \
+       ((sizeof(wl_cnt_ver_7_t) - 2 * sizeof(uint16)) / sizeof(uint32))
+
+/* Exclude version and length fields */
+#define NUM_OF_CNT_IN_WL_CNT_VER_11_T  \
+       ((sizeof(wl_cnt_ver_11_t) - 2 * sizeof(uint16)) / sizeof(uint32))
+/* Exclude 64 macstat cnt variables. */
+#define NUM_OF_WLCCNT_IN_WL_CNT_VER_11_T       \
+       ((sizeof(wl_cnt_wlc_t)) / sizeof(uint32))
+
+/* Index conversion table from wl_cnt_ver_6_t to wl_cnt_wlc_t */
+static const uint8 wlcntver6t_to_wlcntwlct[NUM_OF_WLCCNT_IN_WL_CNT_VER_6_T] = {
+       IDX_IN_WL_CNT_VER_6_T(txframe),
+       IDX_IN_WL_CNT_VER_6_T(txbyte),
+       IDX_IN_WL_CNT_VER_6_T(txretrans),
+       IDX_IN_WL_CNT_VER_6_T(txerror),
+       IDX_IN_WL_CNT_VER_6_T(txctl),
+       IDX_IN_WL_CNT_VER_6_T(txprshort),
+       IDX_IN_WL_CNT_VER_6_T(txserr),
+       IDX_IN_WL_CNT_VER_6_T(txnobuf),
+       IDX_IN_WL_CNT_VER_6_T(txnoassoc),
+       IDX_IN_WL_CNT_VER_6_T(txrunt),
+       IDX_IN_WL_CNT_VER_6_T(txchit),
+       IDX_IN_WL_CNT_VER_6_T(txcmiss),
+       IDX_IN_WL_CNT_VER_6_T(txuflo),
+       IDX_IN_WL_CNT_VER_6_T(txphyerr),
+       IDX_IN_WL_CNT_VER_6_T(txphycrs),
+       IDX_IN_WL_CNT_VER_6_T(rxframe),
+       IDX_IN_WL_CNT_VER_6_T(rxbyte),
+       IDX_IN_WL_CNT_VER_6_T(rxerror),
+       IDX_IN_WL_CNT_VER_6_T(rxctl),
+       IDX_IN_WL_CNT_VER_6_T(rxnobuf),
+       IDX_IN_WL_CNT_VER_6_T(rxnondata),
+       IDX_IN_WL_CNT_VER_6_T(rxbadds),
+       IDX_IN_WL_CNT_VER_6_T(rxbadcm),
+       IDX_IN_WL_CNT_VER_6_T(rxfragerr),
+       IDX_IN_WL_CNT_VER_6_T(rxrunt),
+       IDX_IN_WL_CNT_VER_6_T(rxgiant),
+       IDX_IN_WL_CNT_VER_6_T(rxnoscb),
+       IDX_IN_WL_CNT_VER_6_T(rxbadproto),
+       IDX_IN_WL_CNT_VER_6_T(rxbadsrcmac),
+       IDX_IN_WL_CNT_VER_6_T(rxbadda),
+       IDX_IN_WL_CNT_VER_6_T(rxfilter),
+       IDX_IN_WL_CNT_VER_6_T(rxoflo),
+       IDX_IN_WL_CNT_VER_6_T(rxuflo),
+       IDX_IN_WL_CNT_VER_6_T(rxuflo) + 1,
+       IDX_IN_WL_CNT_VER_6_T(rxuflo) + 2,
+       IDX_IN_WL_CNT_VER_6_T(rxuflo) + 3,
+       IDX_IN_WL_CNT_VER_6_T(rxuflo) + 4,
+       IDX_IN_WL_CNT_VER_6_T(rxuflo) + 5,
+       IDX_IN_WL_CNT_VER_6_T(d11cnt_txrts_off),
+       IDX_IN_WL_CNT_VER_6_T(d11cnt_rxcrc_off),
+       IDX_IN_WL_CNT_VER_6_T(d11cnt_txnocts_off),
+       IDX_IN_WL_CNT_VER_6_T(dmade),
+       IDX_IN_WL_CNT_VER_6_T(dmada),
+       IDX_IN_WL_CNT_VER_6_T(dmape),
+       IDX_IN_WL_CNT_VER_6_T(reset),
+       IDX_IN_WL_CNT_VER_6_T(tbtt),
+       IDX_IN_WL_CNT_VER_6_T(txdmawar),
+       IDX_IN_WL_CNT_VER_6_T(pkt_callback_reg_fail),
+       IDX_IN_WL_CNT_VER_6_T(txfrag),
+       IDX_IN_WL_CNT_VER_6_T(txmulti),
+       IDX_IN_WL_CNT_VER_6_T(txfail),
+       IDX_IN_WL_CNT_VER_6_T(txretry),
+       IDX_IN_WL_CNT_VER_6_T(txretrie),
+       IDX_IN_WL_CNT_VER_6_T(rxdup),
+       IDX_IN_WL_CNT_VER_6_T(txrts),
+       IDX_IN_WL_CNT_VER_6_T(txnocts),
+       IDX_IN_WL_CNT_VER_6_T(txnoack),
+       IDX_IN_WL_CNT_VER_6_T(rxfrag),
+       IDX_IN_WL_CNT_VER_6_T(rxmulti),
+       IDX_IN_WL_CNT_VER_6_T(rxcrc),
+       IDX_IN_WL_CNT_VER_6_T(txfrmsnt),
+       IDX_IN_WL_CNT_VER_6_T(rxundec),
+       IDX_IN_WL_CNT_VER_6_T(tkipmicfaill),
+       IDX_IN_WL_CNT_VER_6_T(tkipcntrmsr),
+       IDX_IN_WL_CNT_VER_6_T(tkipreplay),
+       IDX_IN_WL_CNT_VER_6_T(ccmpfmterr),
+       IDX_IN_WL_CNT_VER_6_T(ccmpreplay),
+       IDX_IN_WL_CNT_VER_6_T(ccmpundec),
+       IDX_IN_WL_CNT_VER_6_T(fourwayfail),
+       IDX_IN_WL_CNT_VER_6_T(wepundec),
+       IDX_IN_WL_CNT_VER_6_T(wepicverr),
+       IDX_IN_WL_CNT_VER_6_T(decsuccess),
+       IDX_IN_WL_CNT_VER_6_T(tkipicverr),
+       IDX_IN_WL_CNT_VER_6_T(wepexcluded),
+       IDX_IN_WL_CNT_VER_6_T(txchanrej),
+       IDX_IN_WL_CNT_VER_6_T(psmwds),
+       IDX_IN_WL_CNT_VER_6_T(phywatchdog),
+       IDX_IN_WL_CNT_VER_6_T(prq_entries_handled),
+       IDX_IN_WL_CNT_VER_6_T(prq_undirected_entries),
+       IDX_IN_WL_CNT_VER_6_T(prq_bad_entries),
+       IDX_IN_WL_CNT_VER_6_T(atim_suppress_count),
+       IDX_IN_WL_CNT_VER_6_T(bcn_template_not_ready),
+       IDX_IN_WL_CNT_VER_6_T(bcn_template_not_ready_done),
+       IDX_IN_WL_CNT_VER_6_T(late_tbtt_dpc),
+       IDX_IN_WL_CNT_VER_6_T(rx1mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx2mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx5mbps5),
+       IDX_IN_WL_CNT_VER_6_T(rx6mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx9mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx11mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx12mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx18mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx24mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx36mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx48mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx54mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx108mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx162mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx216mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx270mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx324mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx378mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx432mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx486mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx540mbps),
+       IDX_IN_WL_CNT_VER_6_T(rfdisable),
+       IDX_IN_WL_CNT_VER_6_T(txexptime),
+       IDX_IN_WL_CNT_VER_6_T(txmpdu_sgi),
+       IDX_IN_WL_CNT_VER_6_T(rxmpdu_sgi),
+       IDX_IN_WL_CNT_VER_6_T(txmpdu_stbc),
+       IDX_IN_WL_CNT_VER_6_T(rxmpdu_stbc),
+       IDX_IN_WL_CNT_VER_6_T(rxundec_mcst),
+       IDX_IN_WL_CNT_VER_6_T(tkipmicfaill_mcst),
+       IDX_IN_WL_CNT_VER_6_T(tkipcntrmsr_mcst),
+       IDX_IN_WL_CNT_VER_6_T(tkipreplay_mcst),
+       IDX_IN_WL_CNT_VER_6_T(ccmpfmterr_mcst),
+       IDX_IN_WL_CNT_VER_6_T(ccmpreplay_mcst),
+       IDX_IN_WL_CNT_VER_6_T(ccmpundec_mcst),
+       IDX_IN_WL_CNT_VER_6_T(fourwayfail_mcst),
+       IDX_IN_WL_CNT_VER_6_T(wepundec_mcst),
+       IDX_IN_WL_CNT_VER_6_T(wepicverr_mcst),
+       IDX_IN_WL_CNT_VER_6_T(decsuccess_mcst),
+       IDX_IN_WL_CNT_VER_6_T(tkipicverr_mcst),
+       IDX_IN_WL_CNT_VER_6_T(wepexcluded_mcst)
+};
+
+#define INVALID_IDX ((uint8)(-1))
+
+/* Index conversion table from wl_cnt_ver_7_t to wl_cnt_wlc_t */
+static const uint8 wlcntver7t_to_wlcntwlct[] = {
+       IDX_IN_WL_CNT_VER_7_T(txframe),
+       IDX_IN_WL_CNT_VER_7_T(txbyte),
+       IDX_IN_WL_CNT_VER_7_T(txretrans),
+       IDX_IN_WL_CNT_VER_7_T(txerror),
+       IDX_IN_WL_CNT_VER_7_T(txctl),
+       IDX_IN_WL_CNT_VER_7_T(txprshort),
+       IDX_IN_WL_CNT_VER_7_T(txserr),
+       IDX_IN_WL_CNT_VER_7_T(txnobuf),
+       IDX_IN_WL_CNT_VER_7_T(txnoassoc),
+       IDX_IN_WL_CNT_VER_7_T(txrunt),
+       IDX_IN_WL_CNT_VER_7_T(txchit),
+       IDX_IN_WL_CNT_VER_7_T(txcmiss),
+       IDX_IN_WL_CNT_VER_7_T(txuflo),
+       IDX_IN_WL_CNT_VER_7_T(txphyerr),
+       IDX_IN_WL_CNT_VER_7_T(txphycrs),
+       IDX_IN_WL_CNT_VER_7_T(rxframe),
+       IDX_IN_WL_CNT_VER_7_T(rxbyte),
+       IDX_IN_WL_CNT_VER_7_T(rxerror),
+       IDX_IN_WL_CNT_VER_7_T(rxctl),
+       IDX_IN_WL_CNT_VER_7_T(rxnobuf),
+       IDX_IN_WL_CNT_VER_7_T(rxnondata),
+       IDX_IN_WL_CNT_VER_7_T(rxbadds),
+       IDX_IN_WL_CNT_VER_7_T(rxbadcm),
+       IDX_IN_WL_CNT_VER_7_T(rxfragerr),
+       IDX_IN_WL_CNT_VER_7_T(rxrunt),
+       IDX_IN_WL_CNT_VER_7_T(rxgiant),
+       IDX_IN_WL_CNT_VER_7_T(rxnoscb),
+       IDX_IN_WL_CNT_VER_7_T(rxbadproto),
+       IDX_IN_WL_CNT_VER_7_T(rxbadsrcmac),
+       IDX_IN_WL_CNT_VER_7_T(rxbadda),
+       IDX_IN_WL_CNT_VER_7_T(rxfilter),
+       IDX_IN_WL_CNT_VER_7_T(rxoflo),
+       IDX_IN_WL_CNT_VER_7_T(rxuflo),
+       IDX_IN_WL_CNT_VER_7_T(rxuflo) + 1,
+       IDX_IN_WL_CNT_VER_7_T(rxuflo) + 2,
+       IDX_IN_WL_CNT_VER_7_T(rxuflo) + 3,
+       IDX_IN_WL_CNT_VER_7_T(rxuflo) + 4,
+       IDX_IN_WL_CNT_VER_7_T(rxuflo) + 5,
+       IDX_IN_WL_CNT_VER_7_T(d11cnt_txrts_off),
+       IDX_IN_WL_CNT_VER_7_T(d11cnt_rxcrc_off),
+       IDX_IN_WL_CNT_VER_7_T(d11cnt_txnocts_off),
+       IDX_IN_WL_CNT_VER_7_T(dmade),
+       IDX_IN_WL_CNT_VER_7_T(dmada),
+       IDX_IN_WL_CNT_VER_7_T(dmape),
+       IDX_IN_WL_CNT_VER_7_T(reset),
+       IDX_IN_WL_CNT_VER_7_T(tbtt),
+       IDX_IN_WL_CNT_VER_7_T(txdmawar),
+       IDX_IN_WL_CNT_VER_7_T(pkt_callback_reg_fail),
+       IDX_IN_WL_CNT_VER_7_T(txfrag),
+       IDX_IN_WL_CNT_VER_7_T(txmulti),
+       IDX_IN_WL_CNT_VER_7_T(txfail),
+       IDX_IN_WL_CNT_VER_7_T(txretry),
+       IDX_IN_WL_CNT_VER_7_T(txretrie),
+       IDX_IN_WL_CNT_VER_7_T(rxdup),
+       IDX_IN_WL_CNT_VER_7_T(txrts),
+       IDX_IN_WL_CNT_VER_7_T(txnocts),
+       IDX_IN_WL_CNT_VER_7_T(txnoack),
+       IDX_IN_WL_CNT_VER_7_T(rxfrag),
+       IDX_IN_WL_CNT_VER_7_T(rxmulti),
+       IDX_IN_WL_CNT_VER_7_T(rxcrc),
+       IDX_IN_WL_CNT_VER_7_T(txfrmsnt),
+       IDX_IN_WL_CNT_VER_7_T(rxundec),
+       IDX_IN_WL_CNT_VER_7_T(tkipmicfaill),
+       IDX_IN_WL_CNT_VER_7_T(tkipcntrmsr),
+       IDX_IN_WL_CNT_VER_7_T(tkipreplay),
+       IDX_IN_WL_CNT_VER_7_T(ccmpfmterr),
+       IDX_IN_WL_CNT_VER_7_T(ccmpreplay),
+       IDX_IN_WL_CNT_VER_7_T(ccmpundec),
+       IDX_IN_WL_CNT_VER_7_T(fourwayfail),
+       IDX_IN_WL_CNT_VER_7_T(wepundec),
+       IDX_IN_WL_CNT_VER_7_T(wepicverr),
+       IDX_IN_WL_CNT_VER_7_T(decsuccess),
+       IDX_IN_WL_CNT_VER_7_T(tkipicverr),
+       IDX_IN_WL_CNT_VER_7_T(wepexcluded),
+       IDX_IN_WL_CNT_VER_7_T(txchanrej),
+       IDX_IN_WL_CNT_VER_7_T(psmwds),
+       IDX_IN_WL_CNT_VER_7_T(phywatchdog),
+       IDX_IN_WL_CNT_VER_7_T(prq_entries_handled),
+       IDX_IN_WL_CNT_VER_7_T(prq_undirected_entries),
+       IDX_IN_WL_CNT_VER_7_T(prq_bad_entries),
+       IDX_IN_WL_CNT_VER_7_T(atim_suppress_count),
+       IDX_IN_WL_CNT_VER_7_T(bcn_template_not_ready),
+       IDX_IN_WL_CNT_VER_7_T(bcn_template_not_ready_done),
+       IDX_IN_WL_CNT_VER_7_T(late_tbtt_dpc),
+       IDX_IN_WL_CNT_VER_7_T(rx1mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx2mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx5mbps5),
+       IDX_IN_WL_CNT_VER_7_T(rx6mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx9mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx11mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx12mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx18mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx24mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx36mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx48mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx54mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx108mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx162mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx216mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx270mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx324mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx378mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx432mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx486mbps),
+       IDX_IN_WL_CNT_VER_7_T(rx540mbps),
+       IDX_IN_WL_CNT_VER_7_T(rfdisable),
+       IDX_IN_WL_CNT_VER_7_T(txexptime),
+       IDX_IN_WL_CNT_VER_7_T(txmpdu_sgi),
+       IDX_IN_WL_CNT_VER_7_T(rxmpdu_sgi),
+       IDX_IN_WL_CNT_VER_7_T(txmpdu_stbc),
+       IDX_IN_WL_CNT_VER_7_T(rxmpdu_stbc),
+       IDX_IN_WL_CNT_VER_7_T(rxundec_mcst),
+       IDX_IN_WL_CNT_VER_7_T(tkipmicfaill_mcst),
+       IDX_IN_WL_CNT_VER_7_T(tkipcntrmsr_mcst),
+       IDX_IN_WL_CNT_VER_7_T(tkipreplay_mcst),
+       IDX_IN_WL_CNT_VER_7_T(ccmpfmterr_mcst),
+       IDX_IN_WL_CNT_VER_7_T(ccmpreplay_mcst),
+       IDX_IN_WL_CNT_VER_7_T(ccmpundec_mcst),
+       IDX_IN_WL_CNT_VER_7_T(fourwayfail_mcst),
+       IDX_IN_WL_CNT_VER_7_T(wepundec_mcst),
+       IDX_IN_WL_CNT_VER_7_T(wepicverr_mcst),
+       IDX_IN_WL_CNT_VER_7_T(decsuccess_mcst),
+       IDX_IN_WL_CNT_VER_7_T(tkipicverr_mcst),
+       IDX_IN_WL_CNT_VER_7_T(wepexcluded_mcst),
+       IDX_IN_WL_CNT_VER_7_T(dma_hang),
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       IDX_IN_WL_CNT_VER_7_T(rxrtry)
+};
+
+/* Max wl_cnt_wlc_t fields including rxrtry */
+#define NUM_OF_WLCCNT_IN_WL_CNT_VER_7_T                                \
+       (sizeof(wlcntver7t_to_wlcntwlct) / sizeof(uint8))
+
+/* Index conversion table from wl_cnt_ver_11_t to wl_cnt_wlc_t */
+static const uint8 wlcntver11t_to_wlcntwlct[NUM_OF_WLCCNT_IN_WL_CNT_VER_11_T] = {
+       IDX_IN_WL_CNT_VER_11_T(txframe),
+       IDX_IN_WL_CNT_VER_11_T(txbyte),
+       IDX_IN_WL_CNT_VER_11_T(txretrans),
+       IDX_IN_WL_CNT_VER_11_T(txerror),
+       IDX_IN_WL_CNT_VER_11_T(txctl),
+       IDX_IN_WL_CNT_VER_11_T(txprshort),
+       IDX_IN_WL_CNT_VER_11_T(txserr),
+       IDX_IN_WL_CNT_VER_11_T(txnobuf),
+       IDX_IN_WL_CNT_VER_11_T(txnoassoc),
+       IDX_IN_WL_CNT_VER_11_T(txrunt),
+       IDX_IN_WL_CNT_VER_11_T(txchit),
+       IDX_IN_WL_CNT_VER_11_T(txcmiss),
+       IDX_IN_WL_CNT_VER_11_T(txuflo),
+       IDX_IN_WL_CNT_VER_11_T(txphyerr),
+       IDX_IN_WL_CNT_VER_11_T(txphycrs),
+       IDX_IN_WL_CNT_VER_11_T(rxframe),
+       IDX_IN_WL_CNT_VER_11_T(rxbyte),
+       IDX_IN_WL_CNT_VER_11_T(rxerror),
+       IDX_IN_WL_CNT_VER_11_T(rxctl),
+       IDX_IN_WL_CNT_VER_11_T(rxnobuf),
+       IDX_IN_WL_CNT_VER_11_T(rxnondata),
+       IDX_IN_WL_CNT_VER_11_T(rxbadds),
+       IDX_IN_WL_CNT_VER_11_T(rxbadcm),
+       IDX_IN_WL_CNT_VER_11_T(rxfragerr),
+       IDX_IN_WL_CNT_VER_11_T(rxrunt),
+       IDX_IN_WL_CNT_VER_11_T(rxgiant),
+       IDX_IN_WL_CNT_VER_11_T(rxnoscb),
+       IDX_IN_WL_CNT_VER_11_T(rxbadproto),
+       IDX_IN_WL_CNT_VER_11_T(rxbadsrcmac),
+       IDX_IN_WL_CNT_VER_11_T(rxbadda),
+       IDX_IN_WL_CNT_VER_11_T(rxfilter),
+       IDX_IN_WL_CNT_VER_11_T(rxoflo),
+       IDX_IN_WL_CNT_VER_11_T(rxuflo),
+       IDX_IN_WL_CNT_VER_11_T(rxuflo) + 1,
+       IDX_IN_WL_CNT_VER_11_T(rxuflo) + 2,
+       IDX_IN_WL_CNT_VER_11_T(rxuflo) + 3,
+       IDX_IN_WL_CNT_VER_11_T(rxuflo) + 4,
+       IDX_IN_WL_CNT_VER_11_T(rxuflo) + 5,
+       IDX_IN_WL_CNT_VER_11_T(d11cnt_txrts_off),
+       IDX_IN_WL_CNT_VER_11_T(d11cnt_rxcrc_off),
+       IDX_IN_WL_CNT_VER_11_T(d11cnt_txnocts_off),
+       IDX_IN_WL_CNT_VER_11_T(dmade),
+       IDX_IN_WL_CNT_VER_11_T(dmada),
+       IDX_IN_WL_CNT_VER_11_T(dmape),
+       IDX_IN_WL_CNT_VER_11_T(reset),
+       IDX_IN_WL_CNT_VER_11_T(tbtt),
+       IDX_IN_WL_CNT_VER_11_T(txdmawar),
+       IDX_IN_WL_CNT_VER_11_T(pkt_callback_reg_fail),
+       IDX_IN_WL_CNT_VER_11_T(txfrag),
+       IDX_IN_WL_CNT_VER_11_T(txmulti),
+       IDX_IN_WL_CNT_VER_11_T(txfail),
+       IDX_IN_WL_CNT_VER_11_T(txretry),
+       IDX_IN_WL_CNT_VER_11_T(txretrie),
+       IDX_IN_WL_CNT_VER_11_T(rxdup),
+       IDX_IN_WL_CNT_VER_11_T(txrts),
+       IDX_IN_WL_CNT_VER_11_T(txnocts),
+       IDX_IN_WL_CNT_VER_11_T(txnoack),
+       IDX_IN_WL_CNT_VER_11_T(rxfrag),
+       IDX_IN_WL_CNT_VER_11_T(rxmulti),
+       IDX_IN_WL_CNT_VER_11_T(rxcrc),
+       IDX_IN_WL_CNT_VER_11_T(txfrmsnt),
+       IDX_IN_WL_CNT_VER_11_T(rxundec),
+       IDX_IN_WL_CNT_VER_11_T(tkipmicfaill),
+       IDX_IN_WL_CNT_VER_11_T(tkipcntrmsr),
+       IDX_IN_WL_CNT_VER_11_T(tkipreplay),
+       IDX_IN_WL_CNT_VER_11_T(ccmpfmterr),
+       IDX_IN_WL_CNT_VER_11_T(ccmpreplay),
+       IDX_IN_WL_CNT_VER_11_T(ccmpundec),
+       IDX_IN_WL_CNT_VER_11_T(fourwayfail),
+       IDX_IN_WL_CNT_VER_11_T(wepundec),
+       IDX_IN_WL_CNT_VER_11_T(wepicverr),
+       IDX_IN_WL_CNT_VER_11_T(decsuccess),
+       IDX_IN_WL_CNT_VER_11_T(tkipicverr),
+       IDX_IN_WL_CNT_VER_11_T(wepexcluded),
+       IDX_IN_WL_CNT_VER_11_T(txchanrej),
+       IDX_IN_WL_CNT_VER_11_T(psmwds),
+       IDX_IN_WL_CNT_VER_11_T(phywatchdog),
+       IDX_IN_WL_CNT_VER_11_T(prq_entries_handled),
+       IDX_IN_WL_CNT_VER_11_T(prq_undirected_entries),
+       IDX_IN_WL_CNT_VER_11_T(prq_bad_entries),
+       IDX_IN_WL_CNT_VER_11_T(atim_suppress_count),
+       IDX_IN_WL_CNT_VER_11_T(bcn_template_not_ready),
+       IDX_IN_WL_CNT_VER_11_T(bcn_template_not_ready_done),
+       IDX_IN_WL_CNT_VER_11_T(late_tbtt_dpc),
+       IDX_IN_WL_CNT_VER_11_T(rx1mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx2mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx5mbps5),
+       IDX_IN_WL_CNT_VER_11_T(rx6mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx9mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx11mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx12mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx18mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx24mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx36mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx48mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx54mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx108mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx162mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx216mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx270mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx324mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx378mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx432mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx486mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx540mbps),
+       IDX_IN_WL_CNT_VER_11_T(rfdisable),
+       IDX_IN_WL_CNT_VER_11_T(txexptime),
+       IDX_IN_WL_CNT_VER_11_T(txmpdu_sgi),
+       IDX_IN_WL_CNT_VER_11_T(rxmpdu_sgi),
+       IDX_IN_WL_CNT_VER_11_T(txmpdu_stbc),
+       IDX_IN_WL_CNT_VER_11_T(rxmpdu_stbc),
+       IDX_IN_WL_CNT_VER_11_T(rxundec_mcst),
+       IDX_IN_WL_CNT_VER_11_T(tkipmicfaill_mcst),
+       IDX_IN_WL_CNT_VER_11_T(tkipcntrmsr_mcst),
+       IDX_IN_WL_CNT_VER_11_T(tkipreplay_mcst),
+       IDX_IN_WL_CNT_VER_11_T(ccmpfmterr_mcst),
+       IDX_IN_WL_CNT_VER_11_T(ccmpreplay_mcst),
+       IDX_IN_WL_CNT_VER_11_T(ccmpundec_mcst),
+       IDX_IN_WL_CNT_VER_11_T(fourwayfail_mcst),
+       IDX_IN_WL_CNT_VER_11_T(wepundec_mcst),
+       IDX_IN_WL_CNT_VER_11_T(wepicverr_mcst),
+       IDX_IN_WL_CNT_VER_11_T(decsuccess_mcst),
+       IDX_IN_WL_CNT_VER_11_T(tkipicverr_mcst),
+       IDX_IN_WL_CNT_VER_11_T(wepexcluded_mcst),
+       IDX_IN_WL_CNT_VER_11_T(dma_hang),
+       IDX_IN_WL_CNT_VER_11_T(reinit),
+       IDX_IN_WL_CNT_VER_11_T(pstatxucast),
+       IDX_IN_WL_CNT_VER_11_T(pstatxnoassoc),
+       IDX_IN_WL_CNT_VER_11_T(pstarxucast),
+       IDX_IN_WL_CNT_VER_11_T(pstarxbcmc),
+       IDX_IN_WL_CNT_VER_11_T(pstatxbcmc),
+       IDX_IN_WL_CNT_VER_11_T(cso_passthrough),
+       IDX_IN_WL_CNT_VER_11_T(cso_normal),
+       IDX_IN_WL_CNT_VER_11_T(chained),
+       IDX_IN_WL_CNT_VER_11_T(chainedsz1),
+       IDX_IN_WL_CNT_VER_11_T(unchained),
+       IDX_IN_WL_CNT_VER_11_T(maxchainsz),
+       IDX_IN_WL_CNT_VER_11_T(currchainsz),
+       IDX_IN_WL_CNT_VER_11_T(pciereset),
+       IDX_IN_WL_CNT_VER_11_T(cfgrestore),
+       IDX_IN_WL_CNT_VER_11_T(reinitreason),
+       IDX_IN_WL_CNT_VER_11_T(reinitreason) + 1,
+       IDX_IN_WL_CNT_VER_11_T(reinitreason) + 2,
+       IDX_IN_WL_CNT_VER_11_T(reinitreason) + 3,
+       IDX_IN_WL_CNT_VER_11_T(reinitreason) + 4,
+       IDX_IN_WL_CNT_VER_11_T(reinitreason) + 5,
+       IDX_IN_WL_CNT_VER_11_T(reinitreason) + 6,
+       IDX_IN_WL_CNT_VER_11_T(reinitreason) + 7,
+       IDX_IN_WL_CNT_VER_11_T(rxrtry),
+       IDX_IN_WL_CNT_VER_11_T(rxmpdu_mu),
+       IDX_IN_WL_CNT_VER_11_T(txbar),
+       IDX_IN_WL_CNT_VER_11_T(rxbar),
+       IDX_IN_WL_CNT_VER_11_T(txpspoll),
+       IDX_IN_WL_CNT_VER_11_T(rxpspoll),
+       IDX_IN_WL_CNT_VER_11_T(txnull),
+       IDX_IN_WL_CNT_VER_11_T(rxnull),
+       IDX_IN_WL_CNT_VER_11_T(txqosnull),
+       IDX_IN_WL_CNT_VER_11_T(rxqosnull),
+       IDX_IN_WL_CNT_VER_11_T(txassocreq),
+       IDX_IN_WL_CNT_VER_11_T(rxassocreq),
+       IDX_IN_WL_CNT_VER_11_T(txreassocreq),
+       IDX_IN_WL_CNT_VER_11_T(rxreassocreq),
+       IDX_IN_WL_CNT_VER_11_T(txdisassoc),
+       IDX_IN_WL_CNT_VER_11_T(rxdisassoc),
+       IDX_IN_WL_CNT_VER_11_T(txassocrsp),
+       IDX_IN_WL_CNT_VER_11_T(rxassocrsp),
+       IDX_IN_WL_CNT_VER_11_T(txreassocrsp),
+       IDX_IN_WL_CNT_VER_11_T(rxreassocrsp),
+       IDX_IN_WL_CNT_VER_11_T(txauth),
+       IDX_IN_WL_CNT_VER_11_T(rxauth),
+       IDX_IN_WL_CNT_VER_11_T(txdeauth),
+       IDX_IN_WL_CNT_VER_11_T(rxdeauth),
+       IDX_IN_WL_CNT_VER_11_T(txprobereq),
+       IDX_IN_WL_CNT_VER_11_T(rxprobereq),
+       IDX_IN_WL_CNT_VER_11_T(txprobersp),
+       IDX_IN_WL_CNT_VER_11_T(rxprobersp),
+       IDX_IN_WL_CNT_VER_11_T(txaction),
+       IDX_IN_WL_CNT_VER_11_T(rxaction),
+       IDX_IN_WL_CNT_VER_11_T(ampdu_wds),
+       IDX_IN_WL_CNT_VER_11_T(txlost),
+       IDX_IN_WL_CNT_VER_11_T(txdatamcast),
+       IDX_IN_WL_CNT_VER_11_T(txdatabcast),
+       INVALID_IDX,
+       IDX_IN_WL_CNT_VER_11_T(rxback),
+       IDX_IN_WL_CNT_VER_11_T(txback),
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       INVALID_IDX,
+       IDX_IN_WL_CNT_VER_11_T(txbcast),
+       IDX_IN_WL_CNT_VER_11_T(txdropped),
+       IDX_IN_WL_CNT_VER_11_T(rxbcast),
+       IDX_IN_WL_CNT_VER_11_T(rxdropped)
+};
+
+/* Index conversion table from wl_cnt_ver_11_t to
+ * either wl_cnt_ge40mcst_v1_t or wl_cnt_lt40mcst_v1_t
+ */
+static const uint8 wlcntver11t_to_wlcntXX40mcstv1t[WL_CNT_MCST_VAR_NUM] = {
+       IDX_IN_WL_CNT_VER_11_T(txallfrm),
+       IDX_IN_WL_CNT_VER_11_T(txrtsfrm),
+       IDX_IN_WL_CNT_VER_11_T(txctsfrm),
+       IDX_IN_WL_CNT_VER_11_T(txackfrm),
+       IDX_IN_WL_CNT_VER_11_T(txdnlfrm),
+       IDX_IN_WL_CNT_VER_11_T(txbcnfrm),
+       IDX_IN_WL_CNT_VER_11_T(txfunfl),
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 1,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 2,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 3,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 4,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 5,
+       IDX_IN_WL_CNT_VER_11_T(txfbw),
+       IDX_IN_WL_CNT_VER_11_T(txmpdu),
+       IDX_IN_WL_CNT_VER_11_T(txtplunfl),
+       IDX_IN_WL_CNT_VER_11_T(txphyerror),
+       IDX_IN_WL_CNT_VER_11_T(pktengrxducast),
+       IDX_IN_WL_CNT_VER_11_T(pktengrxdmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxfrmtoolong),
+       IDX_IN_WL_CNT_VER_11_T(rxfrmtooshrt),
+       IDX_IN_WL_CNT_VER_11_T(rxinvmachdr),
+       IDX_IN_WL_CNT_VER_11_T(rxbadfcs),
+       IDX_IN_WL_CNT_VER_11_T(rxbadplcp),
+       IDX_IN_WL_CNT_VER_11_T(rxcrsglitch),
+       IDX_IN_WL_CNT_VER_11_T(rxstrt),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmucastmbss),
+       IDX_IN_WL_CNT_VER_11_T(rxmfrmucastmbss),
+       IDX_IN_WL_CNT_VER_11_T(rxcfrmucast),
+       IDX_IN_WL_CNT_VER_11_T(rxrtsucast),
+       IDX_IN_WL_CNT_VER_11_T(rxctsucast),
+       IDX_IN_WL_CNT_VER_11_T(rxackucast),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmocast),
+       IDX_IN_WL_CNT_VER_11_T(rxmfrmocast),
+       IDX_IN_WL_CNT_VER_11_T(rxcfrmocast),
+       IDX_IN_WL_CNT_VER_11_T(rxrtsocast),
+       IDX_IN_WL_CNT_VER_11_T(rxctsocast),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxmfrmmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxcfrmmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxbeaconmbss),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmucastobss),
+       IDX_IN_WL_CNT_VER_11_T(rxbeaconobss),
+       IDX_IN_WL_CNT_VER_11_T(rxrsptmout),
+       IDX_IN_WL_CNT_VER_11_T(bcntxcancl),
+       IDX_IN_WL_CNT_VER_11_T(rxnodelim),
+       IDX_IN_WL_CNT_VER_11_T(rxf0ovfl),
+       IDX_IN_WL_CNT_VER_11_T(rxf1ovfl),
+       IDX_IN_WL_CNT_VER_11_T(rxf2ovfl),
+       IDX_IN_WL_CNT_VER_11_T(txsfovfl),
+       IDX_IN_WL_CNT_VER_11_T(pmqovfl),
+       IDX_IN_WL_CNT_VER_11_T(rxcgprqfrm),
+       IDX_IN_WL_CNT_VER_11_T(rxcgprsqovfl),
+       IDX_IN_WL_CNT_VER_11_T(txcgprsfail),
+       IDX_IN_WL_CNT_VER_11_T(txcgprssuc),
+       IDX_IN_WL_CNT_VER_11_T(prs_timeout),
+       IDX_IN_WL_CNT_VER_11_T(rxnack),
+       IDX_IN_WL_CNT_VER_11_T(frmscons),
+       IDX_IN_WL_CNT_VER_11_T(txnack),
+       IDX_IN_WL_CNT_VER_11_T(rxback),
+       IDX_IN_WL_CNT_VER_11_T(txback),
+       IDX_IN_WL_CNT_VER_11_T(bphy_rxcrsglitch),
+       IDX_IN_WL_CNT_VER_11_T(rxdrop20s),
+       IDX_IN_WL_CNT_VER_11_T(rxtoolate),
+       IDX_IN_WL_CNT_VER_11_T(bphy_badplcp)
+};
+
+/* For mcst offsets that were not used. (2 Pads) */
+#define INVALID_MCST_IDX ((uint8)(-1))
+/* Index conversion table from wl_cnt_ver_11_t to wl_cnt_v_le10_mcst_t */
+static const uint8 wlcntver11t_to_wlcntvle10mcstt[WL_CNT_MCST_VAR_NUM] = {
+       IDX_IN_WL_CNT_VER_11_T(txallfrm),
+       IDX_IN_WL_CNT_VER_11_T(txrtsfrm),
+       IDX_IN_WL_CNT_VER_11_T(txctsfrm),
+       IDX_IN_WL_CNT_VER_11_T(txackfrm),
+       IDX_IN_WL_CNT_VER_11_T(txdnlfrm),
+       IDX_IN_WL_CNT_VER_11_T(txbcnfrm),
+       IDX_IN_WL_CNT_VER_11_T(txfunfl),
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 1,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 2,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 3,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 4,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 5,
+       IDX_IN_WL_CNT_VER_11_T(txfbw),
+       INVALID_MCST_IDX,
+       IDX_IN_WL_CNT_VER_11_T(txtplunfl),
+       IDX_IN_WL_CNT_VER_11_T(txphyerror),
+       IDX_IN_WL_CNT_VER_11_T(pktengrxducast),
+       IDX_IN_WL_CNT_VER_11_T(pktengrxdmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxfrmtoolong),
+       IDX_IN_WL_CNT_VER_11_T(rxfrmtooshrt),
+       IDX_IN_WL_CNT_VER_11_T(rxinvmachdr),
+       IDX_IN_WL_CNT_VER_11_T(rxbadfcs),
+       IDX_IN_WL_CNT_VER_11_T(rxbadplcp),
+       IDX_IN_WL_CNT_VER_11_T(rxcrsglitch),
+       IDX_IN_WL_CNT_VER_11_T(rxstrt),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmucastmbss),
+       IDX_IN_WL_CNT_VER_11_T(rxmfrmucastmbss),
+       IDX_IN_WL_CNT_VER_11_T(rxcfrmucast),
+       IDX_IN_WL_CNT_VER_11_T(rxrtsucast),
+       IDX_IN_WL_CNT_VER_11_T(rxctsucast),
+       IDX_IN_WL_CNT_VER_11_T(rxackucast),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmocast),
+       IDX_IN_WL_CNT_VER_11_T(rxmfrmocast),
+       IDX_IN_WL_CNT_VER_11_T(rxcfrmocast),
+       IDX_IN_WL_CNT_VER_11_T(rxrtsocast),
+       IDX_IN_WL_CNT_VER_11_T(rxctsocast),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxmfrmmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxcfrmmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxbeaconmbss),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmucastobss),
+       IDX_IN_WL_CNT_VER_11_T(rxbeaconobss),
+       IDX_IN_WL_CNT_VER_11_T(rxrsptmout),
+       IDX_IN_WL_CNT_VER_11_T(bcntxcancl),
+       INVALID_MCST_IDX,
+       IDX_IN_WL_CNT_VER_11_T(rxf0ovfl),
+       IDX_IN_WL_CNT_VER_11_T(rxf1ovfl),
+       IDX_IN_WL_CNT_VER_11_T(rxf2ovfl),
+       IDX_IN_WL_CNT_VER_11_T(txsfovfl),
+       IDX_IN_WL_CNT_VER_11_T(pmqovfl),
+       IDX_IN_WL_CNT_VER_11_T(rxcgprqfrm),
+       IDX_IN_WL_CNT_VER_11_T(rxcgprsqovfl),
+       IDX_IN_WL_CNT_VER_11_T(txcgprsfail),
+       IDX_IN_WL_CNT_VER_11_T(txcgprssuc),
+       IDX_IN_WL_CNT_VER_11_T(prs_timeout),
+       IDX_IN_WL_CNT_VER_11_T(rxnack),
+       IDX_IN_WL_CNT_VER_11_T(frmscons),
+       IDX_IN_WL_CNT_VER_11_T(txnack),
+       IDX_IN_WL_CNT_VER_11_T(rxback),
+       IDX_IN_WL_CNT_VER_11_T(txback),
+       IDX_IN_WL_CNT_VER_11_T(bphy_rxcrsglitch),
+       IDX_IN_WL_CNT_VER_11_T(rxdrop20s),
+       IDX_IN_WL_CNT_VER_11_T(rxtoolate),
+       IDX_IN_WL_CNT_VER_11_T(bphy_badplcp)
+};
+
+/* Index conversion table from wl_cnt_ver_6_t to wl_cnt_v_le10_mcst_t */
+static const uint8 wlcntver6t_to_wlcntvle10mcstt[WL_CNT_MCST_VAR_NUM] = {
+       IDX_IN_WL_CNT_VER_6_T(txallfrm),
+       IDX_IN_WL_CNT_VER_6_T(txrtsfrm),
+       IDX_IN_WL_CNT_VER_6_T(txctsfrm),
+       IDX_IN_WL_CNT_VER_6_T(txackfrm),
+       IDX_IN_WL_CNT_VER_6_T(txdnlfrm),
+       IDX_IN_WL_CNT_VER_6_T(txbcnfrm),
+       IDX_IN_WL_CNT_VER_6_T(txfunfl),
+       IDX_IN_WL_CNT_VER_6_T(txfunfl) + 1,
+       IDX_IN_WL_CNT_VER_6_T(txfunfl) + 2,
+       IDX_IN_WL_CNT_VER_6_T(txfunfl) + 3,
+       IDX_IN_WL_CNT_VER_6_T(txfunfl) + 4,
+       IDX_IN_WL_CNT_VER_6_T(txfunfl) + 5,
+       IDX_IN_WL_CNT_VER_6_T(txfbw),
+       INVALID_MCST_IDX,
+       IDX_IN_WL_CNT_VER_6_T(txtplunfl),
+       IDX_IN_WL_CNT_VER_6_T(txphyerror),
+       IDX_IN_WL_CNT_VER_6_T(pktengrxducast),
+       IDX_IN_WL_CNT_VER_6_T(pktengrxdmcast),
+       IDX_IN_WL_CNT_VER_6_T(rxfrmtoolong),
+       IDX_IN_WL_CNT_VER_6_T(rxfrmtooshrt),
+       IDX_IN_WL_CNT_VER_6_T(rxinvmachdr),
+       IDX_IN_WL_CNT_VER_6_T(rxbadfcs),
+       IDX_IN_WL_CNT_VER_6_T(rxbadplcp),
+       IDX_IN_WL_CNT_VER_6_T(rxcrsglitch),
+       IDX_IN_WL_CNT_VER_6_T(rxstrt),
+       IDX_IN_WL_CNT_VER_6_T(rxdfrmucastmbss),
+       IDX_IN_WL_CNT_VER_6_T(rxmfrmucastmbss),
+       IDX_IN_WL_CNT_VER_6_T(rxcfrmucast),
+       IDX_IN_WL_CNT_VER_6_T(rxrtsucast),
+       IDX_IN_WL_CNT_VER_6_T(rxctsucast),
+       IDX_IN_WL_CNT_VER_6_T(rxackucast),
+       IDX_IN_WL_CNT_VER_6_T(rxdfrmocast),
+       IDX_IN_WL_CNT_VER_6_T(rxmfrmocast),
+       IDX_IN_WL_CNT_VER_6_T(rxcfrmocast),
+       IDX_IN_WL_CNT_VER_6_T(rxrtsocast),
+       IDX_IN_WL_CNT_VER_6_T(rxctsocast),
+       IDX_IN_WL_CNT_VER_6_T(rxdfrmmcast),
+       IDX_IN_WL_CNT_VER_6_T(rxmfrmmcast),
+       IDX_IN_WL_CNT_VER_6_T(rxcfrmmcast),
+       IDX_IN_WL_CNT_VER_6_T(rxbeaconmbss),
+       IDX_IN_WL_CNT_VER_6_T(rxdfrmucastobss),
+       IDX_IN_WL_CNT_VER_6_T(rxbeaconobss),
+       IDX_IN_WL_CNT_VER_6_T(rxrsptmout),
+       IDX_IN_WL_CNT_VER_6_T(bcntxcancl),
+       INVALID_MCST_IDX,
+       IDX_IN_WL_CNT_VER_6_T(rxf0ovfl),
+       IDX_IN_WL_CNT_VER_6_T(rxf1ovfl),
+       IDX_IN_WL_CNT_VER_6_T(rxf2ovfl),
+       IDX_IN_WL_CNT_VER_6_T(txsfovfl),
+       IDX_IN_WL_CNT_VER_6_T(pmqovfl),
+       IDX_IN_WL_CNT_VER_6_T(rxcgprqfrm),
+       IDX_IN_WL_CNT_VER_6_T(rxcgprsqovfl),
+       IDX_IN_WL_CNT_VER_6_T(txcgprsfail),
+       IDX_IN_WL_CNT_VER_6_T(txcgprssuc),
+       IDX_IN_WL_CNT_VER_6_T(prs_timeout),
+       IDX_IN_WL_CNT_VER_6_T(rxnack),
+       IDX_IN_WL_CNT_VER_6_T(frmscons),
+       IDX_IN_WL_CNT_VER_6_T(txnack),
+       IDX_IN_WL_CNT_VER_6_T(rxback),
+       IDX_IN_WL_CNT_VER_6_T(txback),
+       IDX_IN_WL_CNT_VER_6_T(bphy_rxcrsglitch),
+       IDX_IN_WL_CNT_VER_6_T(rxdrop20s),
+       IDX_IN_WL_CNT_VER_6_T(rxtoolate),
+       IDX_IN_WL_CNT_VER_6_T(bphy_badplcp)
+};
+
+/* Index conversion table from wl_cnt_ver_7_t to wl_cnt_v_le10_mcst_t */
+static const uint8 wlcntver7t_to_wlcntvle10mcstt[WL_CNT_MCST_VAR_NUM] = {
+       IDX_IN_WL_CNT_VER_7_T(txallfrm),
+       IDX_IN_WL_CNT_VER_7_T(txrtsfrm),
+       IDX_IN_WL_CNT_VER_7_T(txctsfrm),
+       IDX_IN_WL_CNT_VER_7_T(txackfrm),
+       IDX_IN_WL_CNT_VER_7_T(txdnlfrm),
+       IDX_IN_WL_CNT_VER_7_T(txbcnfrm),
+       IDX_IN_WL_CNT_VER_7_T(txfunfl),
+       IDX_IN_WL_CNT_VER_7_T(txfunfl) + 1,
+       IDX_IN_WL_CNT_VER_7_T(txfunfl) + 2,
+       IDX_IN_WL_CNT_VER_7_T(txfunfl) + 3,
+       IDX_IN_WL_CNT_VER_7_T(txfunfl) + 4,
+       IDX_IN_WL_CNT_VER_7_T(txfunfl) + 5,
+       INVALID_MCST_IDX,
+       INVALID_MCST_IDX,
+       IDX_IN_WL_CNT_VER_7_T(txtplunfl),
+       IDX_IN_WL_CNT_VER_7_T(txphyerror),
+       IDX_IN_WL_CNT_VER_7_T(pktengrxducast),
+       IDX_IN_WL_CNT_VER_7_T(pktengrxdmcast),
+       IDX_IN_WL_CNT_VER_7_T(rxfrmtoolong),
+       IDX_IN_WL_CNT_VER_7_T(rxfrmtooshrt),
+       IDX_IN_WL_CNT_VER_7_T(rxinvmachdr),
+       IDX_IN_WL_CNT_VER_7_T(rxbadfcs),
+       IDX_IN_WL_CNT_VER_7_T(rxbadplcp),
+       IDX_IN_WL_CNT_VER_7_T(rxcrsglitch),
+       IDX_IN_WL_CNT_VER_7_T(rxstrt),
+       IDX_IN_WL_CNT_VER_7_T(rxdfrmucastmbss),
+       IDX_IN_WL_CNT_VER_7_T(rxmfrmucastmbss),
+       IDX_IN_WL_CNT_VER_7_T(rxcfrmucast),
+       IDX_IN_WL_CNT_VER_7_T(rxrtsucast),
+       IDX_IN_WL_CNT_VER_7_T(rxctsucast),
+       IDX_IN_WL_CNT_VER_7_T(rxackucast),
+       IDX_IN_WL_CNT_VER_7_T(rxdfrmocast),
+       IDX_IN_WL_CNT_VER_7_T(rxmfrmocast),
+       IDX_IN_WL_CNT_VER_7_T(rxcfrmocast),
+       IDX_IN_WL_CNT_VER_7_T(rxrtsocast),
+       IDX_IN_WL_CNT_VER_7_T(rxctsocast),
+       IDX_IN_WL_CNT_VER_7_T(rxdfrmmcast),
+       IDX_IN_WL_CNT_VER_7_T(rxmfrmmcast),
+       IDX_IN_WL_CNT_VER_7_T(rxcfrmmcast),
+       IDX_IN_WL_CNT_VER_7_T(rxbeaconmbss),
+       IDX_IN_WL_CNT_VER_7_T(rxdfrmucastobss),
+       IDX_IN_WL_CNT_VER_7_T(rxbeaconobss),
+       IDX_IN_WL_CNT_VER_7_T(rxrsptmout),
+       IDX_IN_WL_CNT_VER_7_T(bcntxcancl),
+       INVALID_MCST_IDX,
+       IDX_IN_WL_CNT_VER_7_T(rxf0ovfl),
+       IDX_IN_WL_CNT_VER_7_T(rxf1ovfl),
+       IDX_IN_WL_CNT_VER_7_T(rxf2ovfl),
+       IDX_IN_WL_CNT_VER_7_T(txsfovfl),
+       IDX_IN_WL_CNT_VER_7_T(pmqovfl),
+       IDX_IN_WL_CNT_VER_7_T(rxcgprqfrm),
+       IDX_IN_WL_CNT_VER_7_T(rxcgprsqovfl),
+       IDX_IN_WL_CNT_VER_7_T(txcgprsfail),
+       IDX_IN_WL_CNT_VER_7_T(txcgprssuc),
+       IDX_IN_WL_CNT_VER_7_T(prs_timeout),
+       IDX_IN_WL_CNT_VER_7_T(rxnack),
+       IDX_IN_WL_CNT_VER_7_T(frmscons),
+       IDX_IN_WL_CNT_VER_7_T(txnack),
+       INVALID_MCST_IDX,
+       INVALID_MCST_IDX,
+       IDX_IN_WL_CNT_VER_7_T(bphy_rxcrsglitch),
+       INVALID_MCST_IDX,
+       INVALID_MCST_IDX,
+       INVALID_MCST_IDX
+};
+
+/* copy wlc layer counters from old type cntbuf to wl_cnt_wlc_t type. */
+static int
+wl_copy_wlccnt(uint16 cntver, uint32 *dst, uint32 *src, uint8 src_max_idx)
+{
+       uint i;
+       if (dst == NULL || src == NULL) {
+               return BCME_ERROR;
+       }
+
+       /* Init wlccnt with invalid value. Unchanged value will not be printed out */
+       for (i = 0; i < (sizeof(wl_cnt_wlc_t) / sizeof(uint32)); i++) {
+               dst[i] = INVALID_CNT_VAL;
+       }
+
+       if (cntver == WL_CNT_VERSION_6) {
+               for (i = 0; i < NUM_OF_WLCCNT_IN_WL_CNT_VER_6_T; i++) {
+                       if (wlcntver6t_to_wlcntwlct[i] >= src_max_idx) {
+                               /* src buffer does not have counters from here */
+                               break;
+                       }
+                       dst[i] = src[wlcntver6t_to_wlcntwlct[i]];
+               }
+       } else if (cntver == WL_CNT_VERSION_7) {
+               for (i = 0; i < NUM_OF_WLCCNT_IN_WL_CNT_VER_7_T; i++) {
+                       if (wlcntver7t_to_wlcntwlct[i] >= src_max_idx ||
+                               wlcntver7t_to_wlcntwlct[i] == INVALID_IDX) {
+                               continue;
+                       }
+                       dst[i] = src[wlcntver7t_to_wlcntwlct[i]];
+               }
+       } else {
+               for (i = 0; i < NUM_OF_WLCCNT_IN_WL_CNT_VER_11_T; i++) {
+                       if (wlcntver11t_to_wlcntwlct[i] >= src_max_idx) {
+                               if (wlcntver11t_to_wlcntwlct[i] == INVALID_IDX) {
+                                       continue;
+                               }
+                               else {
+                                       /* src buffer does not have counters from here */
+                                       break;
+                               }
+                       }
+                       dst[i] = src[wlcntver11t_to_wlcntwlct[i]];
+               }
+       }
+       return BCME_OK;
+}
+
+/* copy macstat counters from old type cntbuf to wl_cnt_v_le10_mcst_t type. */
+static int
+wl_copy_macstat_upto_ver10(uint16 cntver, uint32 *dst, uint32 *src)
+{
+       uint i;
+
+       if (dst == NULL || src == NULL) {
+               return BCME_ERROR;
+       }
+
+       if (cntver == WL_CNT_VERSION_6) {
+               for (i = 0; i < WL_CNT_MCST_VAR_NUM; i++) {
+                       if (wlcntver6t_to_wlcntvle10mcstt[i] == INVALID_MCST_IDX) {
+                               /* This mcst counter does not exist in wl_cnt_ver_6_t */
+                               dst[i] = INVALID_CNT_VAL;
+                       } else {
+                               dst[i] = src[wlcntver6t_to_wlcntvle10mcstt[i]];
+                       }
+               }
+       } else if (cntver == WL_CNT_VERSION_7) {
+               for (i = 0; i < WL_CNT_MCST_VAR_NUM; i++) {
+                       if (wlcntver7t_to_wlcntvle10mcstt[i] == INVALID_MCST_IDX) {
+                               /* This mcst counter does not exist in wl_cnt_ver_7_t */
+                               dst[i] = INVALID_CNT_VAL;
+                       } else {
+                               dst[i] = src[wlcntver7t_to_wlcntvle10mcstt[i]];
+                       }
+               }
+       } else {
+               for (i = 0; i < WL_CNT_MCST_VAR_NUM; i++) {
+                       if (wlcntver11t_to_wlcntvle10mcstt[i] == INVALID_MCST_IDX) {
+                               /* This mcst counter does not exist in wl_cnt_ver_11_t */
+                               dst[i] = INVALID_CNT_VAL;
+                       } else {
+                               dst[i] = src[wlcntver11t_to_wlcntvle10mcstt[i]];
+                       }
+               }
+       }
+       return BCME_OK;
+}
+
+static int
+wl_copy_macstat_ver11(uint32 *dst, uint32 *src)
+{
+       uint i;
+
+       if (dst == NULL || src == NULL) {
+               return BCME_ERROR;
+       }
+
+       for (i = 0; i < WL_CNT_MCST_VAR_NUM; i++) {
+               dst[i] = src[wlcntver11t_to_wlcntXX40mcstv1t[i]];
+       }
+       return BCME_OK;
+}
+
+/**
+ * Translate non-xtlv 'wl counters' IOVar buffer received by old driver/FW to xtlv format.
+ * Parameters:
+ *     cntbuf: pointer to non-xtlv 'wl counters' IOVar buffer received by old driver/FW.
+ *             Newly translated xtlv format is written to this pointer.
+ *     buflen: length of the "cntbuf" without any padding.
+ *     corerev: chip core revision of the driver/FW.
+ */
+int
+wl_cntbuf_to_xtlv_format(void *ctx, void *cntbuf, int buflen, uint32 corerev)
+{
+       wl_cnt_wlc_t *wlccnt = NULL;
+       uint32 *macstat = NULL;
+       xtlv_desc_t xtlv_desc[3];
+       uint16 mcst_xtlv_id;
+       int res = BCME_OK;
+       wl_cnt_info_t *cntinfo = cntbuf;
+       uint8 *xtlvbuf_p = cntinfo->data;
+       uint16 ver = cntinfo->version;
+       uint16 xtlvbuflen = (uint16)buflen;
+       uint16 src_max_idx;
+#ifdef BCMDRIVER
+       osl_t *osh = ctx;
+#else
+       BCM_REFERENCE(ctx);
+#endif
+
+       if (ver >= WL_CNT_VERSION_XTLV) {
+               /* Already in xtlv format. */
+               goto exit;
+       }
+
+#ifdef BCMDRIVER
+       wlccnt = MALLOC(osh, sizeof(*wlccnt));
+       macstat = MALLOC(osh, WL_CNT_MCST_STRUCT_SZ);
+#else
+       wlccnt = (wl_cnt_wlc_t *)malloc(sizeof(*wlccnt));
+       macstat = (uint32 *)malloc(WL_CNT_MCST_STRUCT_SZ);
+#endif
+       if (!wlccnt || !macstat) {
+               printf("wl_cntbuf_to_xtlv_format: malloc fail!\n");
+               res = BCME_NOMEM;
+               goto exit;
+       }
+
+       /* Check if the max idx in the struct exceeds the boundary of uint8 */
+       if (NUM_OF_CNT_IN_WL_CNT_VER_6_T > ((uint8)(-1) + 1) ||
+               NUM_OF_CNT_IN_WL_CNT_VER_7_T > ((uint8)(-1) + 1) ||
+               NUM_OF_CNT_IN_WL_CNT_VER_11_T > ((uint8)(-1) + 1)) {
+               printf("wlcntverXXt_to_wlcntwlct and src_max_idx need"
+                       " to be of uint16 instead of uint8\n");
+               res = BCME_ERROR;
+               goto exit;
+       }
+
+       /* Exclude version and length fields in either wlc_cnt_ver_6_t or wlc_cnt_ver_11_t */
+       src_max_idx = (cntinfo->datalen - OFFSETOF(wl_cnt_info_t, data)) / sizeof(uint32);
+       if (src_max_idx > (uint8)(-1)) {
+               printf("wlcntverXXt_to_wlcntwlct and src_max_idx need"
+                       " to be of uint16 instead of uint8\n"
+                       "Try updating wl utility to the latest.\n");
+               src_max_idx = (uint8)(-1);
+       }
+
+       /* Copy wlc layer counters to wl_cnt_wlc_t */
+       res = wl_copy_wlccnt(ver, (uint32 *)wlccnt, (uint32 *)cntinfo->data, (uint8)src_max_idx);
+       if (res != BCME_OK) {
+               printf("wl_copy_wlccnt fail!\n");
+               goto exit;
+       }
+
+       /* Copy macstat counters to wl_cnt_wlc_t */
+       if (ver == WL_CNT_VERSION_11) {
+               res = wl_copy_macstat_ver11(macstat, (uint32 *)cntinfo->data);
+               if (res != BCME_OK) {
+                       printf("wl_copy_macstat_ver11 fail!\n");
+                       goto exit;
+               }
+               if (corerev >= 40) {
+                       mcst_xtlv_id = WL_CNT_XTLV_GE40_UCODE_V1;
+               } else {
+                       mcst_xtlv_id = WL_CNT_XTLV_LT40_UCODE_V1;
+               }
+       } else {
+               res = wl_copy_macstat_upto_ver10(ver, macstat, (uint32 *)cntinfo->data);
+               if (res != BCME_OK) {
+                       printf("wl_copy_macstat_upto_ver10 fail!\n");
+                       goto exit;
+               }
+               mcst_xtlv_id = WL_CNT_XTLV_CNTV_LE10_UCODE;
+       }
+
+       xtlv_desc[0].type = WL_CNT_XTLV_WLC;
+       xtlv_desc[0].len = sizeof(*wlccnt);
+       xtlv_desc[0].ptr = wlccnt;
+
+       xtlv_desc[1].type = mcst_xtlv_id;
+       xtlv_desc[1].len = WL_CNT_MCST_STRUCT_SZ;
+       xtlv_desc[1].ptr = macstat;
+
+       xtlv_desc[2].type = 0;
+       xtlv_desc[2].len = 0;
+       xtlv_desc[2].ptr = NULL;
+
+       memset(cntbuf, 0, buflen);
+
+       res = bcm_pack_xtlv_buf_from_mem(&xtlvbuf_p, &xtlvbuflen,
+               xtlv_desc, BCM_XTLV_OPTION_ALIGN32);
+       cntinfo->datalen = (buflen - xtlvbuflen);
+exit:
+#ifdef BCMDRIVER
+       if (wlccnt) {
+               MFREE(osh, wlccnt, sizeof(*wlccnt));
+       }
+       if (macstat) {
+               MFREE(osh, macstat, WL_CNT_MCST_STRUCT_SZ);
+       }
+#else
+       if (wlccnt) {
+               free(wlccnt);
+       }
+       if (macstat) {
+               free(macstat);
+       }
+#endif
+       return res;
+}
diff --git a/bcmdhd.101.10.240.x/bcm_l2_filter.c b/bcmdhd.101.10.240.x/bcm_l2_filter.c
new file mode 100644 (file)
index 0000000..749e813
--- /dev/null
@@ -0,0 +1,762 @@
+/*
+ * L2 Filter handling functions
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ *
+ */
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmdefs.h>
+#include <bcmdevs.h>
+#include <ethernet.h>
+#include <bcmip.h>
+#include <bcmipv6.h>
+#include <bcmudp.h>
+#include <bcmarp.h>
+#include <bcmicmp.h>
+#include <bcmproto.h>
+#include <bcmdhcp.h>
+#include <802.11.h>
+#include <bcm_l2_filter.h>
+
+#define        L2_FILTER_ERROR(args)
+
+#ifdef BCMDBG_MSG
+#define        L2_FILTER_MSG(args)     printf args
+#else
+#define        L2_FILTER_MSG(args)
+#endif /* BCMDBG_msg */
+
+struct arp_table {
+       parp_entry_t    *parp_table[BCM_PARP_TABLE_SIZE];   /* proxyarp entries in cache table */
+       parp_entry_t    *parp_candidate_list;               /* proxyarp entries in candidate list */
+       uint8 parp_smac[ETHER_ADDR_LEN];                    /* L2 SMAC from DHCP Req */
+       uint8 parp_cmac[ETHER_ADDR_LEN];                    /* Bootp Client MAC from DHCP Req */
+};
+#ifdef DHD_DUMP_ARPTABLE
+void bcm_l2_parp_dump_table(arp_table_t* arp_tbl);
+
+void
+bcm_l2_parp_dump_table(arp_table_t* arp_tbl)
+{
+       parp_entry_t *entry;
+       uint16 idx, ip_len;
+       arp_table_t *ptable;
+       ip_len = IPV4_ADDR_LEN;
+       ptable = arp_tbl;
+       for (idx = 0; idx < BCM_PARP_TABLE_SIZE; idx++) {
+               entry = ptable->parp_table[idx];
+               while (entry) {
+                       printf("Cached entries..\n");
+                       printf("%d: %d.%d.%d.%d", idx, entry->ip.data[0], entry->ip.data[1],
+                               entry->ip.data[2], entry->ip.data[3]);
+                       printf("%02x:%02x:%02x:%02x:%02x:%02x", entry->ea.octet[0],
+                               entry->ea.octet[1], entry->ea.octet[2], entry->ea.octet[3],
+                               entry->ea.octet[4], entry->ea.octet[5]);
+                       printf("\n");
+                       entry = entry->next;
+               }
+       }
+       entry = ptable->parp_candidate_list;
+       while (entry) {
+               printf("Candidate entries..\n");
+               printf("%d.%d.%d.%d", entry->ip.data[0], entry->ip.data[1],
+                       entry->ip.data[2], entry->ip.data[3]);
+               printf("%02x:%02x:%02x:%02x:%02x:%02x", entry->ea.octet[0],
+                       entry->ea.octet[1], entry->ea.octet[2], entry->ea.octet[3],
+                       entry->ea.octet[4], entry->ea.octet[5]);
+
+               printf("\n");
+               entry = entry->next;
+       }
+}
+#endif /* DHD_DUMP_ARPTABLE */
+
+arp_table_t* init_l2_filter_arp_table(osl_t* osh)
+{
+       return ((arp_table_t*)MALLOCZ(osh, sizeof(arp_table_t)));
+}
+
+void deinit_l2_filter_arp_table(osl_t* osh, arp_table_t* ptable)
+{
+       MFREE(osh, ptable, sizeof(arp_table_t));
+}
+/* returns 0 if gratuitous ARP or unsolicited neighbour advertisement */
+int
+bcm_l2_filter_gratuitous_arp(osl_t *osh, void *pktbuf)
+{
+       uint8 *frame = PKTDATA(osh, pktbuf);
+       uint16 ethertype;
+       int send_ip_offset, target_ip_offset;
+       int iplen;
+       int minlen;
+       uint8 *data;
+       int datalen;
+       bool snap;
+
+       if (get_pkt_ether_type(osh, pktbuf, &data, &datalen, &ethertype, &snap) != BCME_OK)
+           return BCME_ERROR;
+
+       if (!ETHER_ISBCAST(frame + ETHER_DEST_OFFSET) &&
+           bcmp(&ether_ipv6_mcast, frame + ETHER_DEST_OFFSET, sizeof(ether_ipv6_mcast))) {
+           return BCME_ERROR;
+       }
+
+       if (ethertype == ETHER_TYPE_ARP) {
+               L2_FILTER_MSG(("bcm_l2_filter_gratuitous_arp: ARP RX data : %p: datalen : %d\n",
+                       data, datalen));
+               send_ip_offset = ARP_SRC_IP_OFFSET;
+               target_ip_offset = ARP_TGT_IP_OFFSET;
+               iplen = IPV4_ADDR_LEN;
+               minlen = ARP_DATA_LEN;
+       } else if (ethertype == ETHER_TYPE_IPV6) {
+               send_ip_offset = NEIGHBOR_ADVERTISE_SRC_IPV6_OFFSET;
+               target_ip_offset = NEIGHBOR_ADVERTISE_TGT_IPV6_OFFSET;
+               iplen = IPV6_ADDR_LEN;
+               minlen = target_ip_offset + iplen;
+
+               /* check for neighbour advertisement */
+               if (datalen >= minlen && (data[IPV6_NEXT_HDR_OFFSET] != IP_PROT_ICMP6 ||
+                   data[NEIGHBOR_ADVERTISE_TYPE_OFFSET] != NEIGHBOR_ADVERTISE_TYPE))
+                       return BCME_ERROR;
+
+               /* Dont drop Unsolicitated NA fm AP with allnode mcast dest addr (HS2-4.5.E) */
+               if (datalen >= minlen &&
+                       (data[IPV6_NEXT_HDR_OFFSET] == IP_PROT_ICMP6) &&
+                       (data[NEIGHBOR_ADVERTISE_TYPE_OFFSET] == NEIGHBOR_ADVERTISE_TYPE) &&
+                       (data[NEIGHBOR_ADVERTISE_OPTION_OFFSET] == OPT_TYPE_TGT_LINK_ADDR)) {
+                               L2_FILTER_MSG(("Unsolicitated Neighbour Advertisement from AP "
+                                       "with allnode mcast dest addr tx'ed (%d)\n", datalen));
+                               return -1;
+                       }
+
+       } else {
+               return BCME_ERROR;
+       }
+
+       if (datalen < minlen) {
+               L2_FILTER_MSG(("BCM: dhd_gratuitous_arp: truncated packet (%d)\n", datalen));
+               return BCME_ERROR;
+       }
+
+       if (bcmp(data + send_ip_offset, data + target_ip_offset, iplen) == 0) {
+               L2_FILTER_MSG((" returning BCME_OK in bcm_l2_filter_gratuitous_arp\n"));
+               return BCME_OK;
+       }
+
+       return BCME_ERROR;
+}
+int
+get_pkt_ether_type(osl_t *osh, void *pktbuf,
+       uint8 **data_ptr, int *len_ptr, uint16 *et_ptr, bool *snap_ptr)
+{
+       uint8 *frame = PKTDATA(osh, pktbuf);
+       int length = PKTLEN(osh, pktbuf);
+       uint8 *pt;                      /* Pointer to type field */
+       uint16 ethertype;
+       bool snap = FALSE;
+       /* Process Ethernet II or SNAP-encapsulated 802.3 frames */
+       if (length < ETHER_HDR_LEN) {
+               L2_FILTER_MSG(("BCM: get_pkt_ether_type: short eth frame (%d)\n",
+                          length));
+               return BCME_ERROR;
+       } else if (ntoh16_ua(frame + ETHER_TYPE_OFFSET) >= ETHER_TYPE_MIN) {
+               /* Frame is Ethernet II */
+               pt = frame + ETHER_TYPE_OFFSET;
+       } else if (length >= ETHER_HDR_LEN + SNAP_HDR_LEN + ETHER_TYPE_LEN &&
+                  !bcmp(llc_snap_hdr, frame + ETHER_HDR_LEN, SNAP_HDR_LEN)) {
+               pt = frame + ETHER_HDR_LEN + SNAP_HDR_LEN;
+               snap = TRUE;
+       } else {
+               L2_FILTER_MSG((" get_pkt_ether_type: non-SNAP 802.3 frame\n"));
+               return BCME_ERROR;
+       }
+
+       ethertype = ntoh16_ua(pt);
+
+       /* Skip VLAN tag, if any */
+       if (ethertype == ETHER_TYPE_8021Q) {
+               pt += VLAN_TAG_LEN;
+
+               if ((pt + ETHER_TYPE_LEN) > (frame + length)) {
+                       L2_FILTER_MSG(("BCM: get_pkt_ether_type: short VLAN frame (%d)\n",
+                                 length));
+                       return BCME_ERROR;
+               }
+               ethertype = ntoh16_ua(pt);
+       }
+       *data_ptr = pt + ETHER_TYPE_LEN;
+       *len_ptr = length - (int32)(pt + ETHER_TYPE_LEN - frame);
+       *et_ptr = ethertype;
+       *snap_ptr = snap;
+       return BCME_OK;
+}
+
+int
+get_pkt_ip_type(osl_t *osh, void *pktbuf,
+       uint8 **data_ptr, int *len_ptr, uint8 *prot_ptr)
+{
+       struct ipv4_hdr *iph;           /* IP frame pointer */
+       int iplen;                      /* IP frame length */
+       uint16 ethertype, iphdrlen, ippktlen;
+       uint16 iph_frag;
+       uint8 prot;
+       bool snap;
+
+       if (get_pkt_ether_type(osh, pktbuf, (uint8 **)&iph,
+           &iplen, &ethertype, &snap) != 0)
+               return BCME_ERROR;
+
+       if (ethertype != ETHER_TYPE_IP) {
+               return BCME_ERROR;
+       }
+
+       /* We support IPv4 only */
+       if (iplen < IPV4_OPTIONS_OFFSET || (IP_VER(iph) != IP_VER_4)) {
+               return BCME_ERROR;
+       }
+
+       /* Header length sanity */
+       iphdrlen = IPV4_HLEN(iph);
+
+       /*
+        * Packet length sanity; sometimes we receive eth-frame size bigger
+        * than the IP content, which results in a bad tcp chksum
+        */
+       ippktlen = ntoh16(iph->tot_len);
+       if (ippktlen < iplen) {
+               L2_FILTER_MSG(("get_pkt_ip_type: extra frame length ignored\n"));
+               iplen = ippktlen;
+       } else if (ippktlen > iplen) {
+               L2_FILTER_MSG(("get_pkt_ip_type: truncated IP packet (%d)\n",
+                          ippktlen - iplen));
+               return BCME_ERROR;
+       }
+
+       if (iphdrlen < IPV4_OPTIONS_OFFSET || iphdrlen > iplen) {
+               L2_FILTER_ERROR((" get_pkt_ip_type: IP-header-len (%d) out of range (%d-%d)\n",
+                          iphdrlen, IPV4_OPTIONS_OFFSET, iplen));
+               return BCME_ERROR;
+       }
+
+       /*
+        * We don't handle fragmented IP packets.  A first frag is indicated by the MF
+        * (more frag) bit and a subsequent frag is indicated by a non-zero frag offset.
+        */
+       iph_frag = ntoh16(iph->frag);
+
+       if ((iph_frag & IPV4_FRAG_MORE) || (iph_frag & IPV4_FRAG_OFFSET_MASK) != 0) {
+               L2_FILTER_ERROR(("get_pkt_ip_type: IP fragment not handled\n"));
+               return BCME_ERROR;
+       }
+       prot = IPV4_PROT(iph);
+       *data_ptr = (((uint8 *)iph) + iphdrlen);
+       *len_ptr = iplen - iphdrlen;
+       *prot_ptr = prot;
+       return BCME_OK;
+}
+
+/* Check if packet type is ICMP ECHO */
+int bcm_l2_filter_block_ping(osl_t *osh, void *pktbuf)
+{
+       struct bcmicmp_hdr *icmph;
+       int udpl;
+       uint8 prot;
+
+       if (get_pkt_ip_type(osh, pktbuf, (uint8 **)&icmph, &udpl, &prot) != 0)
+               return BCME_ERROR;
+       if (prot == IP_PROT_ICMP) {
+               if (icmph->type == ICMP_TYPE_ECHO_REQUEST)
+                       return BCME_OK;
+       }
+       return BCME_ERROR;
+}
+
+int bcm_l2_filter_get_mac_addr_dhcp_pkt(osl_t *osh, void *pktbuf,
+       int ifidx, uint8** mac_addr)
+{
+       uint8 *eh = PKTDATA(osh, pktbuf);
+       uint8 *udph;
+       uint8 *dhcp;
+       int udpl;
+       int dhcpl;
+       uint16 port;
+       uint8 prot;
+
+       if (!ETHER_ISMULTI(eh + ETHER_DEST_OFFSET))
+           return BCME_ERROR;
+       if (get_pkt_ip_type(osh, pktbuf, &udph, &udpl, &prot) != 0)
+               return BCME_ERROR;
+       if (prot != IP_PROT_UDP)
+               return BCME_ERROR;
+       /* check frame length, at least UDP_HDR_LEN */
+       if (udpl < UDP_HDR_LEN) {
+               L2_FILTER_MSG(("BCM: bcm_l2_filter_get_mac_addr_dhcp_pkt: short UDP frame,"
+                       " ignored\n"));
+               return BCME_ERROR;
+       }
+       port = ntoh16_ua(udph + UDP_DEST_PORT_OFFSET);
+       /* only process DHCP packets from server to client */
+       if (port != DHCP_PORT_CLIENT)
+               return BCME_ERROR;
+
+       dhcp = udph + UDP_HDR_LEN;
+       dhcpl = udpl - UDP_HDR_LEN;
+
+       if (dhcpl < DHCP_CHADDR_OFFSET + ETHER_ADDR_LEN) {
+               L2_FILTER_MSG(("BCM: bcm_l2_filter_get_mac_addr_dhcp_pkt: short DHCP frame,"
+                       " ignored\n"));
+               return BCME_ERROR;
+       }
+       /* only process DHCP reply(offer/ack) packets */
+       if (*(dhcp + DHCP_TYPE_OFFSET) != DHCP_TYPE_REPLY)
+               return BCME_ERROR;
+       /* chaddr = dhcp + DHCP_CHADDR_OFFSET; */
+       *mac_addr = dhcp + DHCP_CHADDR_OFFSET;
+       return BCME_OK;
+}
+/* modify the mac address for IP, in arp table */
+int
+bcm_l2_filter_parp_modifyentry(arp_table_t* arp_tbl, struct ether_addr *ea,
+       uint8 *ip, uint8 ip_ver, bool cached, unsigned int entry_tickcnt)
+{
+       parp_entry_t *entry;
+       uint8 idx, ip_len;
+       arp_table_t *ptable;
+
+       if (ip_ver == IP_VER_4 && !IPV4_ADDR_NULL(ip) && !IPV4_ADDR_BCAST(ip)) {
+               idx = BCM_PARP_TABLE_INDEX(ip[IPV4_ADDR_LEN - 1]);
+               ip_len = IPV4_ADDR_LEN;
+       }
+       else if (ip_ver == IP_VER_6 && !IPV6_ADDR_NULL(ip)) {
+               idx = BCM_PARP_TABLE_INDEX(ip[IPV6_ADDR_LEN - 1]);
+               ip_len = IPV6_ADDR_LEN;
+       }
+       else {
+           return BCME_ERROR;
+       }
+
+       ptable = arp_tbl;
+       if (cached) {
+           entry = ptable->parp_table[idx];
+       } else {
+           entry = ptable->parp_candidate_list;
+       }
+       while (entry) {
+               if (bcmp(entry->ip.data, ip, ip_len) == 0) {
+                       /* entry matches, overwrite mac content and return */
+                       bcopy((void *)ea, (void *)&entry->ea, ETHER_ADDR_LEN);
+                       entry->used = entry_tickcnt;
+#ifdef DHD_DUMP_ARPTABLE
+                       bcm_l2_parp_dump_table(arp_tbl);
+#endif
+                       return BCME_OK;
+               }
+               entry = entry->next;
+       }
+#ifdef DHD_DUMP_ARPTABLE
+       bcm_l2_parp_dump_table(arp_tbl);
+#endif
+       return BCME_ERROR;
+}
+
+/* Add the IP entry in ARP table based on Cached argument, if cached argument is
+ * non zero positive value: it adds to parp_table, else adds to
+ * parp_candidate_list
+ */
+int
+bcm_l2_filter_parp_addentry(osl_t *osh, arp_table_t* arp_tbl, struct ether_addr *ea,
+       uint8 *ip, uint8 ip_ver, bool cached, unsigned int entry_tickcnt)
+{
+       parp_entry_t *entry;
+       uint8 idx, ip_len;
+       arp_table_t *ptable;
+
+       if (ip_ver == IP_VER_4 && !IPV4_ADDR_NULL(ip) && !IPV4_ADDR_BCAST(ip)) {
+               idx = BCM_PARP_TABLE_INDEX(ip[IPV4_ADDR_LEN - 1]);
+               ip_len = IPV4_ADDR_LEN;
+       }
+       else if (ip_ver == IP_VER_6 && !IPV6_ADDR_NULL(ip)) {
+               idx = BCM_PARP_TABLE_INDEX(ip[IPV6_ADDR_LEN - 1]);
+               ip_len = IPV6_ADDR_LEN;
+       }
+       else {
+           return BCME_ERROR;
+       }
+
+       if ((entry = MALLOCZ(osh, sizeof(parp_entry_t) + ip_len)) == NULL) {
+           L2_FILTER_MSG(("Allocating new parp_entry for IPv%d failed!!\n", ip_ver));
+           return BCME_NOMEM;
+       }
+
+       bcopy((void *)ea, (void *)&entry->ea, ETHER_ADDR_LEN);
+       entry->used = entry_tickcnt;
+       entry->ip.id = ip_ver;
+       entry->ip.len = ip_len;
+       bcopy(ip, entry->ip.data, ip_len);
+       ptable = arp_tbl;
+       if (cached) {
+           entry->next = ptable->parp_table[idx];
+           ptable->parp_table[idx] = entry;
+       } else {
+           entry->next = ptable->parp_candidate_list;
+           ptable->parp_candidate_list = entry;
+       }
+#ifdef DHD_DUMP_ARPTABLE
+       bcm_l2_parp_dump_table(arp_tbl);
+#endif
+       return BCME_OK;
+}
+
+/* Delete the IP entry in ARP table based on Cached argument, if cached argument is
+ * non zero positive value: it delete from parp_table, else delete from
+ * parp_candidate_list
+ */
+int
+bcm_l2_filter_parp_delentry(osl_t* osh, arp_table_t *arp_tbl, struct ether_addr *ea,
+       uint8 *ip, uint8 ip_ver, bool cached)
+{
+       parp_entry_t *entry, *prev = NULL;
+       uint8 idx, ip_len;
+       arp_table_t *ptable;
+
+       if (ip_ver == IP_VER_4) {
+               idx = BCM_PARP_TABLE_INDEX(ip[IPV4_ADDR_LEN - 1]);
+               ip_len = IPV4_ADDR_LEN;
+       }
+       else if (ip_ver == IP_VER_6) {
+               idx = BCM_PARP_TABLE_INDEX(ip[IPV6_ADDR_LEN - 1]);
+               ip_len = IPV6_ADDR_LEN;
+       }
+       else {
+           return BCME_ERROR;
+       }
+       ptable = arp_tbl;
+       if (cached) {
+           entry = ptable->parp_table[idx];
+       } else {
+               entry = ptable->parp_candidate_list;
+       }
+       while (entry) {
+               if (entry->ip.id == ip_ver &&
+                   bcmp(entry->ip.data, ip, ip_len) == 0 &&
+                   bcmp(&entry->ea, ea, ETHER_ADDR_LEN) == 0) {
+                       if (prev == NULL) {
+                           if (cached) {
+                               ptable->parp_table[idx] = entry->next;
+                           } else {
+                               ptable->parp_candidate_list = entry->next;
+                           }
+                       } else {
+                           prev->next = entry->next;
+                       }
+                       break;
+               }
+               prev = entry;
+               entry = entry->next;
+       }
+       if (entry != NULL)
+               MFREE(osh, entry, sizeof(parp_entry_t) + ip_len);
+#ifdef DHD_DUMP_ARPTABLE
+       bcm_l2_parp_dump_table(arp_tbl);
+#endif
+       return BCME_OK;
+}
+
+/* search the IP entry in ARP table based on Cached argument, if cached argument is
+ * non zero positive value: it searches from parp_table, else search from
+ * parp_candidate_list
+ */
+parp_entry_t *
+bcm_l2_filter_parp_findentry(arp_table_t* arp_tbl, uint8 *ip, uint8 ip_ver, bool cached,
+       unsigned int entry_tickcnt)
+{
+       parp_entry_t *entry;
+       uint8 idx, ip_len;
+       arp_table_t *ptable;
+
+       if (ip_ver == IP_VER_4) {
+               idx = BCM_PARP_TABLE_INDEX(ip[IPV4_ADDR_LEN - 1]);
+               ip_len = IPV4_ADDR_LEN;
+       } else if (ip_ver == IP_VER_6) {
+               idx = BCM_PARP_TABLE_INDEX(ip[IPV6_ADDR_LEN - 1]);
+               ip_len = IPV6_ADDR_LEN;
+       } else {
+               return NULL;
+       }
+       ptable = arp_tbl;
+       if (cached) {
+           entry = ptable->parp_table[idx];
+       } else {
+           entry = ptable->parp_candidate_list;
+       }
+       while (entry) {
+           if (entry->ip.id == ip_ver && bcmp(entry->ip.data, ip, ip_len) == 0) {
+                       /* time stamp of adding the station entry to arp table for ifp */
+                       entry->used = entry_tickcnt;
+                       break;
+           }
+           entry = entry->next;
+       }
+       return entry;
+}
+
+/* update arp table entries for every proxy arp enable interface */
+void
+bcm_l2_filter_arp_table_update(osl_t *osh, arp_table_t* arp_tbl, bool all, uint8 *del_ea,
+       bool periodic, unsigned int tickcnt)
+{
+       parp_entry_t *prev, *entry, *delentry;
+       uint8 idx, ip_ver;
+       struct ether_addr ea;
+       uint8 ip[IPV6_ADDR_LEN];
+       arp_table_t *ptable;
+
+       ptable = arp_tbl;
+       for (idx = 0; idx < BCM_PARP_TABLE_SIZE; idx++) {
+               entry = ptable->parp_table[idx];
+               while (entry) {
+                       /* check if the entry need to be removed */
+                       if (all || (periodic && BCM_PARP_IS_TIMEOUT(tickcnt, entry)) ||
+                           (del_ea != NULL && !bcmp(del_ea, &entry->ea, ETHER_ADDR_LEN))) {
+                               /* copy frame here */
+                               ip_ver = entry->ip.id;
+                               bcopy(entry->ip.data, ip, entry->ip.len);
+                               bcopy(&entry->ea, &ea, ETHER_ADDR_LEN);
+                               entry = entry->next;
+                               bcm_l2_filter_parp_delentry(osh, ptable, &ea, ip, ip_ver, TRUE);
+                       }
+                       else {
+                               entry = entry->next;
+                       }
+               }
+       }
+
+       /* remove candidate or promote to real entry */
+       prev = delentry = NULL;
+       entry = ptable->parp_candidate_list;
+       while (entry) {
+               /* remove candidate */
+               if (all || (periodic && BCM_PARP_ANNOUNCE_WAIT_REACH(tickcnt, entry)) ||
+                   (del_ea != NULL && !bcmp(del_ea, (uint8 *)&entry->ea, ETHER_ADDR_LEN))) {
+                       bool promote = (periodic && BCM_PARP_ANNOUNCE_WAIT_REACH(tickcnt, entry)) ?
+                               TRUE: FALSE;
+                       parp_entry_t *node = NULL;
+
+                       ip_ver = entry->ip.id;
+
+                       if (prev == NULL)
+                               ptable->parp_candidate_list = entry->next;
+                       else
+                               prev->next = entry->next;
+
+                       node = bcm_l2_filter_parp_findentry(ptable,
+                               entry->ip.data, IP_VER_6, TRUE, tickcnt);
+                       if (promote && node == NULL) {
+                               bcm_l2_filter_parp_addentry(osh, ptable, &entry->ea,
+                                       entry->ip.data, entry->ip.id, TRUE, tickcnt);
+                       }
+                       MFREE(osh, entry, sizeof(parp_entry_t) + entry->ip.len);
+                       if (prev == NULL) {
+                               entry = ptable->parp_candidate_list;
+                       } else {
+                               entry = prev->next;
+                       }
+               }
+               else {
+                       prev = entry;
+                       entry = entry->next;
+               }
+       }
+}
+/* create 42 byte ARP packet for ARP response, aligned the Buffer */
+void *
+bcm_l2_filter_proxyarp_alloc_reply(osl_t* osh, uint16 pktlen, struct ether_addr *src_ea,
+       struct ether_addr *dst_ea, uint16 ea_type, bool snap, void **p)
+{
+       void *pkt;
+       uint8 *frame;
+
+       /* adjust pktlen since skb->data is aligned to 2 */
+       pktlen += ALIGN_ADJ_BUFLEN;
+
+       if ((pkt = PKTGET(osh, pktlen, FALSE)) == NULL) {
+               L2_FILTER_ERROR(("bcm_l2_filter_proxyarp_alloc_reply: PKTGET failed\n"));
+               return NULL;
+       }
+       /* adjust for pkt->data aligned */
+       PKTPULL(osh, pkt, ALIGN_ADJ_BUFLEN);
+       frame = PKTDATA(osh, pkt);
+
+       /* Create 14-byte eth header, plus snap header if applicable */
+       bcopy(src_ea, frame + ETHER_SRC_OFFSET, ETHER_ADDR_LEN);
+       bcopy(dst_ea, frame + ETHER_DEST_OFFSET, ETHER_ADDR_LEN);
+       if (snap) {
+               hton16_ua_store(pktlen, frame + ETHER_TYPE_OFFSET);
+               bcopy(llc_snap_hdr, frame + ETHER_HDR_LEN, SNAP_HDR_LEN);
+               hton16_ua_store(ea_type, frame + ETHER_HDR_LEN + SNAP_HDR_LEN);
+       } else
+               hton16_ua_store(ea_type, frame + ETHER_TYPE_OFFSET);
+
+       *p = (void *)(frame + ETHER_HDR_LEN + (snap ? SNAP_HDR_LEN + ETHER_TYPE_LEN : 0));
+       return pkt;
+}
+/* copy the smac entry from parp_table */
+void bcm_l2_filter_parp_get_smac(arp_table_t* ptable, void* smac)
+{
+       bcopy(ptable->parp_smac, smac, ETHER_ADDR_LEN);
+}
+/* copy the cmac entry from parp_table */
+void bcm_l2_filter_parp_get_cmac(arp_table_t* ptable, void* cmac)
+{
+       bcopy(ptable->parp_cmac, cmac, ETHER_ADDR_LEN);
+}
+/* copy the smac entry to smac entry in parp_table */
+void bcm_l2_filter_parp_set_smac(arp_table_t* ptable, void* smac)
+{
+       bcopy(smac, ptable->parp_smac, ETHER_ADDR_LEN);
+}
+/* copy the cmac entry to cmac entry in parp_table */
+void bcm_l2_filter_parp_set_cmac(arp_table_t* ptable, void* cmac)
+{
+       bcopy(cmac, ptable->parp_cmac, ETHER_ADDR_LEN);
+}
+
+uint16
+calc_checksum(uint8 *src_ipa, uint8 *dst_ipa, uint32 ul_len, uint8 prot, uint8 *ul_data)
+{
+       uint16 *startpos;
+       uint32 sum = 0;
+       int i;
+       uint16 answer = 0;
+
+       if (src_ipa) {
+               uint8 ph[8] = {0, };
+               for (i = 0; i < (IPV6_ADDR_LEN / 2); i++) {
+                       sum += *((uint16 *)src_ipa);
+                       src_ipa += 2;
+               }
+
+               for (i = 0; i < (IPV6_ADDR_LEN / 2); i++) {
+                       sum += *((uint16 *)dst_ipa);
+                       dst_ipa += 2;
+               }
+
+               *((uint32 *)ph) = hton32(ul_len);
+               *((uint32 *)(ph+4)) = 0;
+               ph[7] = prot;
+               startpos = (uint16 *)ph;
+               for (i = 0; i < 4; i++) {
+                       sum += *startpos++;
+               }
+       }
+
+       startpos = (uint16 *)ul_data;
+       while (ul_len > 1) {
+               sum += *startpos++;
+               ul_len -= 2;
+       }
+
+       if (ul_len == 1) {
+               *((uint8 *)(&answer)) = *((uint8 *)startpos);
+               sum += answer;
+       }
+
+       sum = (sum >> 16) + (sum & 0xffff);
+       sum += (sum >> 16);
+       answer = ~sum;
+
+       return answer;
+}
+/*
+ * The length of the option including
+ * the type and length fields in units of 8 octets
+ */
+bcm_tlv_t *
+parse_nd_options(void *buf, int buflen, uint key)
+{
+       bcm_tlv_t *elt;
+       int totlen;
+
+       elt = (bcm_tlv_t*)buf;
+       totlen = buflen;
+
+       /* find tagged parameter */
+       while (totlen >= TLV_HDR_LEN) {
+               int len = elt->len * 8;
+
+               /* validate remaining totlen */
+               if ((elt->id == key) &&
+                   (totlen >= len))
+                       return (elt);
+
+               elt = (bcm_tlv_t*)((uint8*)elt + len);
+               totlen -= len;
+       }
+
+       return NULL;
+}
+
+/* returns 0 if tdls set up request or tdls discovery request */
+int
+bcm_l2_filter_block_tdls(osl_t *osh, void *pktbuf)
+{
+       uint16 ethertype;
+       uint8 *data;
+       int datalen;
+       bool snap;
+       uint8 action_field;
+
+       if (get_pkt_ether_type(osh, pktbuf, &data, &datalen, &ethertype, &snap) != BCME_OK)
+               return BCME_ERROR;
+
+       if (ethertype != ETHER_TYPE_89_0D)
+               return BCME_ERROR;
+
+       /* validate payload type */
+       if (datalen < TDLS_PAYLOAD_TYPE_LEN + 2) {
+               L2_FILTER_ERROR(("bcm_l2_filter_block_tdls: wrong length for 89-0d eth frame %d\n",
+                       datalen));
+               return BCME_ERROR;
+       }
+
+       /* validate payload type */
+       if (*data != TDLS_PAYLOAD_TYPE) {
+               L2_FILTER_ERROR(("bcm_l2_filter_block_tdls: wrong payload type for 89-0d"
+                       " eth frame %d\n",
+                       *data));
+               return BCME_ERROR;
+       }
+       data += TDLS_PAYLOAD_TYPE_LEN;
+
+       /* validate TDLS action category */
+       if (*data != TDLS_ACTION_CATEGORY_CODE) {
+               L2_FILTER_ERROR(("bcm_l2_filter_block_tdls: wrong TDLS Category %d\n", *data));
+               return BCME_ERROR;
+       }
+       data++;
+
+       action_field = *data;
+
+       if ((action_field == TDLS_SETUP_REQ) || (action_field == TDLS_DISCOVERY_REQ))
+               return BCME_OK;
+
+       return BCME_ERROR;
+}
diff --git a/bcmdhd.101.10.240.x/bcmbloom.c b/bcmdhd.101.10.240.x/bcmbloom.c
new file mode 100644 (file)
index 0000000..5d7440f
--- /dev/null
@@ -0,0 +1,234 @@
+/*
+ * Bloom filter support
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <typedefs.h>
+#include <bcmdefs.h>
+
+#include <stdarg.h>
+
+#ifdef BCMDRIVER
+#include <osl.h>
+#include <bcmutils.h>
+#else /* !BCMDRIVER */
+#include <stdio.h>
+#include <string.h>
+#ifndef ASSERT
+#define ASSERT(exp)
+#endif
+#endif /* !BCMDRIVER */
+#include <bcmutils.h>
+
+#include <bcmbloom.h>
+
+#define BLOOM_BIT_LEN(_x) ((_x) << 3)
+
+struct bcm_bloom_filter {
+       void *cb_ctx;
+       uint max_hash;
+       bcm_bloom_hash_t *hash; /* array of hash functions */
+       uint filter_size;               /* in bytes */
+       uint8 *filter;                  /* can be NULL for validate only */
+};
+
+/* public interface */
+int
+bcm_bloom_create(bcm_bloom_alloc_t alloc_cb,
+       bcm_bloom_free_t free_cb, void *cb_ctx, uint max_hash,
+       uint filter_size, bcm_bloom_filter_t **bloom)
+{
+       int err = BCME_OK;
+       bcm_bloom_filter_t *bp = NULL;
+
+       if (!bloom || !alloc_cb || (max_hash == 0)) {
+               err = BCME_BADARG;
+               goto done;
+       }
+
+       bp = (*alloc_cb)(cb_ctx, sizeof(*bp));
+       if (!bp) {
+               err = BCME_NOMEM;
+               goto done;
+       }
+
+       memset(bp, 0, sizeof(*bp));
+       bp->cb_ctx = cb_ctx;
+       bp->max_hash = max_hash;
+       bp->hash = (*alloc_cb)(cb_ctx, sizeof(*bp->hash) * max_hash);
+       memset(bp->hash, 0, sizeof(*bp->hash) * max_hash);
+
+       if (!bp->hash) {
+               err = BCME_NOMEM;
+               goto done;
+       }
+
+       if (filter_size > 0) {
+               bp->filter = (*alloc_cb)(cb_ctx, filter_size);
+               if (!bp->filter) {
+                       err = BCME_NOMEM;
+                       goto done;
+               }
+               bp->filter_size = filter_size;
+               memset(bp->filter, 0, filter_size);
+       }
+
+       *bloom = bp;
+
+done:
+       if (err != BCME_OK)
+               bcm_bloom_destroy(&bp, free_cb);
+
+       return err;
+}
+
+int
+bcm_bloom_destroy(bcm_bloom_filter_t **bloom, bcm_bloom_free_t free_cb)
+{
+       int err = BCME_OK;
+       bcm_bloom_filter_t *bp;
+
+       if (!bloom || !*bloom || !free_cb)
+               goto done;
+
+       bp = *bloom;
+       *bloom = NULL;
+
+       if (bp->filter)
+               (*free_cb)(bp->cb_ctx, bp->filter, bp->filter_size);
+       if (bp->hash)
+               (*free_cb)(bp->cb_ctx, bp->hash,
+                       sizeof(*bp->hash) * bp->max_hash);
+       (*free_cb)(bp->cb_ctx, bp, sizeof(*bp));
+
+done:
+       return err;
+}
+
+int
+bcm_bloom_add_hash(bcm_bloom_filter_t *bp, bcm_bloom_hash_t hash, uint *idx)
+{
+       uint i;
+
+       if (!bp || !hash || !idx)
+               return BCME_BADARG;
+
+       for (i = 0; i < bp->max_hash; ++i) {
+               if (bp->hash[i] == NULL)
+                       break;
+       }
+
+       if (i >= bp->max_hash)
+               return BCME_NORESOURCE;
+
+       bp->hash[i] = hash;
+       *idx = i;
+       return BCME_OK;
+}
+
+int
+bcm_bloom_remove_hash(bcm_bloom_filter_t *bp, uint idx)
+{
+       if (!bp)
+               return BCME_BADARG;
+
+       if (idx >= bp->max_hash)
+               return BCME_NOTFOUND;
+
+       bp->hash[idx] = NULL;
+       return BCME_OK;
+}
+
+bool
+bcm_bloom_is_member(bcm_bloom_filter_t *bp,
+       const uint8 *tag, uint tag_len, const uint8 *buf, uint buf_len)
+{
+       uint i;
+       int err = BCME_OK;
+
+       if (!tag || (tag_len == 0)) /* empty tag is always a member */
+               goto done;
+
+       /* use internal buffer if none was specified */
+       if (!buf || (buf_len == 0)) {
+               if (!bp->filter)        /* every one is a member of empty filter */
+                       goto done;
+
+               buf = bp->filter;
+               buf_len = bp->filter_size;
+       }
+
+       for (i = 0; i < bp->max_hash; ++i) {
+               uint pos;
+               if (!bp->hash[i])
+                       continue;
+               pos = (*bp->hash[i])(bp->cb_ctx, i, tag, tag_len);
+
+               /* all bits must be set for a match */
+               if (isclr(buf, pos % BLOOM_BIT_LEN(buf_len))) {
+                       err = BCME_NOTFOUND;
+                       break;
+               }
+       }
+
+done:
+       return err;
+}
+
+int
+bcm_bloom_add_member(bcm_bloom_filter_t *bp, const uint8 *tag, uint tag_len)
+{
+       uint i;
+
+       if (!bp || !tag || (tag_len == 0))
+               return BCME_BADARG;
+
+       if (!bp->filter)                /* validate only */
+               return BCME_UNSUPPORTED;
+
+       for (i = 0; i < bp->max_hash; ++i) {
+               uint pos;
+               if (!bp->hash[i])
+                       continue;
+               pos = (*bp->hash[i])(bp->cb_ctx, i, tag, tag_len);
+               setbit(bp->filter, pos % BLOOM_BIT_LEN(bp->filter_size));
+       }
+
+       return BCME_OK;
+}
+
+int bcm_bloom_get_filter_data(bcm_bloom_filter_t *bp,
+       uint buf_size, uint8 *buf, uint *buf_len)
+{
+       if (!bp)
+               return BCME_BADARG;
+
+       if (buf_len)
+               *buf_len = bp->filter_size;
+
+       if (buf_size < bp->filter_size)
+               return BCME_BUFTOOSHORT;
+
+       if (bp->filter && bp->filter_size)
+               memcpy(buf, bp->filter, bp->filter_size);
+
+       return BCME_OK;
+}
diff --git a/bcmdhd.101.10.240.x/bcmevent.c b/bcmdhd.101.10.240.x/bcmevent.c
new file mode 100644 (file)
index 0000000..6435175
--- /dev/null
@@ -0,0 +1,404 @@
+/*
+ * bcmevent read-only data shared by kernel or app layers
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <ethernet.h>
+#include <bcmeth.h>
+#include <bcmevent.h>
+#include <802.11.h>
+
+/* Table of event name strings for UIs and debugging dumps */
+typedef struct {
+       uint event;
+       const char *name;
+} bcmevent_name_str_t;
+
+/* Use the actual name for event tracing */
+#define BCMEVENT_NAME(_event) {(_event), #_event}
+
+/* this becomes static data when all code is changed to use
+ * the bcmevent_get_name() API
+ */
+static const bcmevent_name_str_t bcmevent_names[] = {
+       BCMEVENT_NAME(WLC_E_SET_SSID),
+       BCMEVENT_NAME(WLC_E_JOIN),
+       BCMEVENT_NAME(WLC_E_START),
+       BCMEVENT_NAME(WLC_E_AUTH),
+       BCMEVENT_NAME(WLC_E_AUTH_IND),
+       BCMEVENT_NAME(WLC_E_DEAUTH),
+       BCMEVENT_NAME(WLC_E_DEAUTH_IND),
+       BCMEVENT_NAME(WLC_E_ASSOC),
+       BCMEVENT_NAME(WLC_E_ASSOC_IND),
+       BCMEVENT_NAME(WLC_E_REASSOC),
+       BCMEVENT_NAME(WLC_E_REASSOC_IND),
+       BCMEVENT_NAME(WLC_E_DISASSOC),
+       BCMEVENT_NAME(WLC_E_DISASSOC_IND),
+       BCMEVENT_NAME(WLC_E_QUIET_START),
+       BCMEVENT_NAME(WLC_E_QUIET_END),
+       BCMEVENT_NAME(WLC_E_BEACON_RX),
+       BCMEVENT_NAME(WLC_E_LINK),
+       BCMEVENT_NAME(WLC_E_MIC_ERROR),
+       BCMEVENT_NAME(WLC_E_NDIS_LINK),
+       BCMEVENT_NAME(WLC_E_ROAM),
+       BCMEVENT_NAME(WLC_E_TXFAIL),
+       BCMEVENT_NAME(WLC_E_PMKID_CACHE),
+       BCMEVENT_NAME(WLC_E_RETROGRADE_TSF),
+       BCMEVENT_NAME(WLC_E_PRUNE),
+       BCMEVENT_NAME(WLC_E_AUTOAUTH),
+       BCMEVENT_NAME(WLC_E_EAPOL_MSG),
+       BCMEVENT_NAME(WLC_E_SCAN_COMPLETE),
+       BCMEVENT_NAME(WLC_E_ADDTS_IND),
+       BCMEVENT_NAME(WLC_E_DELTS_IND),
+       BCMEVENT_NAME(WLC_E_BCNSENT_IND),
+       BCMEVENT_NAME(WLC_E_BCNRX_MSG),
+       BCMEVENT_NAME(WLC_E_BCNLOST_MSG),
+       BCMEVENT_NAME(WLC_E_ROAM_PREP),
+       BCMEVENT_NAME(WLC_E_PFN_NET_FOUND),
+       BCMEVENT_NAME(WLC_E_PFN_SCAN_ALLGONE),
+       BCMEVENT_NAME(WLC_E_PFN_NET_LOST),
+       BCMEVENT_NAME(WLC_E_JOIN_START),
+       BCMEVENT_NAME(WLC_E_ROAM_START),
+       BCMEVENT_NAME(WLC_E_ASSOC_START),
+#if defined(IBSS_PEER_DISCOVERY_EVENT)
+       BCMEVENT_NAME(WLC_E_IBSS_ASSOC),
+#endif /* defined(IBSS_PEER_DISCOVERY_EVENT) */
+       BCMEVENT_NAME(WLC_E_RADIO),
+       BCMEVENT_NAME(WLC_E_PSM_WATCHDOG),
+       BCMEVENT_NAME(WLC_E_PROBREQ_MSG),
+       BCMEVENT_NAME(WLC_E_SCAN_CONFIRM_IND),
+       BCMEVENT_NAME(WLC_E_PSK_SUP),
+       BCMEVENT_NAME(WLC_E_COUNTRY_CODE_CHANGED),
+       BCMEVENT_NAME(WLC_E_EXCEEDED_MEDIUM_TIME),
+       BCMEVENT_NAME(WLC_E_ICV_ERROR),
+       BCMEVENT_NAME(WLC_E_UNICAST_DECODE_ERROR),
+       BCMEVENT_NAME(WLC_E_MULTICAST_DECODE_ERROR),
+       BCMEVENT_NAME(WLC_E_TRACE),
+       BCMEVENT_NAME(WLC_E_IF),
+#ifdef WLP2P
+       BCMEVENT_NAME(WLC_E_P2P_DISC_LISTEN_COMPLETE),
+#endif
+       BCMEVENT_NAME(WLC_E_RSSI),
+       BCMEVENT_NAME(WLC_E_PFN_SCAN_COMPLETE),
+       BCMEVENT_NAME(WLC_E_ACTION_FRAME),
+       BCMEVENT_NAME(WLC_E_ACTION_FRAME_RX),
+       BCMEVENT_NAME(WLC_E_ACTION_FRAME_COMPLETE),
+
+#ifdef BCMWAPI_WAI
+       BCMEVENT_NAME(WLC_E_WAI_STA_EVENT),
+       BCMEVENT_NAME(WLC_E_WAI_MSG),
+#endif /* BCMWAPI_WAI */
+
+       BCMEVENT_NAME(WLC_E_ESCAN_RESULT),
+       BCMEVENT_NAME(WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE),
+#ifdef WLP2P
+       BCMEVENT_NAME(WLC_E_PROBRESP_MSG),
+       BCMEVENT_NAME(WLC_E_P2P_PROBREQ_MSG),
+#endif
+#ifdef PROP_TXSTATUS
+       BCMEVENT_NAME(WLC_E_FIFO_CREDIT_MAP),
+#endif
+       BCMEVENT_NAME(WLC_E_WAKE_EVENT),
+       BCMEVENT_NAME(WLC_E_DCS_REQUEST),
+       BCMEVENT_NAME(WLC_E_RM_COMPLETE),
+       BCMEVENT_NAME(WLC_E_OVERLAY_REQ),
+       BCMEVENT_NAME(WLC_E_CSA_COMPLETE_IND),
+       BCMEVENT_NAME(WLC_E_EXCESS_PM_WAKE_EVENT),
+       BCMEVENT_NAME(WLC_E_PFN_SCAN_NONE),
+       BCMEVENT_NAME(WLC_E_PFN_SCAN_ALLGONE),
+#ifdef SOFTAP
+       BCMEVENT_NAME(WLC_E_GTK_PLUMBED),
+#endif
+       BCMEVENT_NAME(WLC_E_ASSOC_REQ_IE),
+       BCMEVENT_NAME(WLC_E_ASSOC_RESP_IE),
+       BCMEVENT_NAME(WLC_E_BEACON_FRAME_RX),
+#ifdef WLTDLS
+       BCMEVENT_NAME(WLC_E_TDLS_PEER_EVENT),
+#endif /* WLTDLS */
+       BCMEVENT_NAME(WLC_E_NATIVE),
+#ifdef WLPKTDLYSTAT
+       BCMEVENT_NAME(WLC_E_PKTDELAY_IND),
+#endif /* WLPKTDLYSTAT */
+       BCMEVENT_NAME(WLC_E_SERVICE_FOUND),
+       BCMEVENT_NAME(WLC_E_GAS_FRAGMENT_RX),
+       BCMEVENT_NAME(WLC_E_GAS_COMPLETE),
+       BCMEVENT_NAME(WLC_E_P2PO_ADD_DEVICE),
+       BCMEVENT_NAME(WLC_E_P2PO_DEL_DEVICE),
+#ifdef WLWNM
+       BCMEVENT_NAME(WLC_E_WNM_STA_SLEEP),
+#endif /* WLWNM */
+#if defined(WL_PROXDETECT) || defined(RTT_SUPPORT)
+       BCMEVENT_NAME(WLC_E_PROXD),
+#endif
+       BCMEVENT_NAME(WLC_E_CCA_CHAN_QUAL),
+       BCMEVENT_NAME(WLC_E_BSSID),
+#ifdef PROP_TXSTATUS
+       BCMEVENT_NAME(WLC_E_BCMC_CREDIT_SUPPORT),
+#endif
+       BCMEVENT_NAME(WLC_E_PSTA_PRIMARY_INTF_IND),
+       BCMEVENT_NAME(WLC_E_TXFAIL_THRESH),
+#ifdef WLAIBSS
+       BCMEVENT_NAME(WLC_E_AIBSS_TXFAIL),
+#endif /* WLAIBSS */
+#ifdef GSCAN_SUPPORT
+       BCMEVENT_NAME(WLC_E_PFN_GSCAN_FULL_RESULT),
+       BCMEVENT_NAME(WLC_E_PFN_SSID_EXT),
+#endif /* GSCAN_SUPPORT */
+#ifdef WLBSSLOAD_REPORT
+       BCMEVENT_NAME(WLC_E_BSS_LOAD),
+#endif
+#if defined(BT_WIFI_HANDOVER) || defined(WL_TBOW)
+       BCMEVENT_NAME(WLC_E_BT_WIFI_HANDOVER_REQ),
+#endif
+#ifdef WLFBT
+       BCMEVENT_NAME(WLC_E_FBT),
+#endif /* WLFBT */
+       BCMEVENT_NAME(WLC_E_AUTHORIZED),
+       BCMEVENT_NAME(WLC_E_PROBREQ_MSG_RX),
+
+       BCMEVENT_NAME(WLC_E_CSA_START_IND),
+       BCMEVENT_NAME(WLC_E_CSA_DONE_IND),
+       BCMEVENT_NAME(WLC_E_CSA_FAILURE_IND),
+       BCMEVENT_NAME(WLC_E_RMC_EVENT),
+       BCMEVENT_NAME(WLC_E_DPSTA_INTF_IND),
+       BCMEVENT_NAME(WLC_E_ALLOW_CREDIT_BORROW),
+       BCMEVENT_NAME(WLC_E_MSCH),
+       BCMEVENT_NAME(WLC_E_ULP),
+       BCMEVENT_NAME(WLC_E_NAN),
+       BCMEVENT_NAME(WLC_E_PKT_FILTER),
+       BCMEVENT_NAME(WLC_E_DMA_TXFLUSH_COMPLETE),
+       BCMEVENT_NAME(WLC_E_PSK_AUTH),
+       BCMEVENT_NAME(WLC_E_SDB_TRANSITION),
+       BCMEVENT_NAME(WLC_E_PFN_SCAN_BACKOFF),
+       BCMEVENT_NAME(WLC_E_PFN_BSSID_SCAN_BACKOFF),
+       BCMEVENT_NAME(WLC_E_AGGR_EVENT),
+       BCMEVENT_NAME(WLC_E_TVPM_MITIGATION),
+       BCMEVENT_NAME(WLC_E_SCAN),
+       BCMEVENT_NAME(WLC_E_SLOTTED_BSS_PEER_OP),
+       BCMEVENT_NAME(WLC_E_PHY_CAL),
+#ifdef WL_NAN
+       BCMEVENT_NAME(WLC_E_NAN_CRITICAL),
+       BCMEVENT_NAME(WLC_E_NAN_NON_CRITICAL),
+       BCMEVENT_NAME(WLC_E_NAN),
+#endif /* WL_NAN */
+       BCMEVENT_NAME(WLC_E_RPSNOA),
+       BCMEVENT_NAME(WLC_E_WA_LQM),
+       BCMEVENT_NAME(WLC_E_OBSS_DETECTION),
+       BCMEVENT_NAME(WLC_E_SC_CHAN_QUAL),
+       BCMEVENT_NAME(WLC_E_DYNSAR),
+       BCMEVENT_NAME(WLC_E_ROAM_CACHE_UPDATE),
+};
+
+const char *bcmevent_get_name(uint event_type)
+{
+       /* note:  first coded this as a static const but some
+        * ROMs already have something called event_name so
+        * changed it so we don't have a variable for the
+        * 'unknown string
+        */
+       const char *event_name = NULL;
+
+       uint idx;
+       for (idx = 0; idx < (uint)ARRAYSIZE(bcmevent_names); idx++) {
+
+               if (bcmevent_names[idx].event == event_type) {
+                       event_name = bcmevent_names[idx].name;
+                       break;
+               }
+       }
+
+       /* if we find an event name in the array, return it.
+        * otherwise return unknown string.
+        */
+       return ((event_name) ? event_name : "Unknown Event");
+}
+
+void
+wl_event_to_host_order(wl_event_msg_t * evt)
+{
+       /* Event struct members passed from dongle to host are stored in network
+       * byte order. Convert all members to host-order.
+       */
+       evt->event_type = ntoh32(evt->event_type);
+       evt->flags = ntoh16(evt->flags);
+       evt->status = ntoh32(evt->status);
+       evt->reason = ntoh32(evt->reason);
+       evt->auth_type = ntoh32(evt->auth_type);
+       evt->datalen = ntoh32(evt->datalen);
+       evt->version = ntoh16(evt->version);
+}
+
+void
+wl_event_to_network_order(wl_event_msg_t * evt)
+{
+       /* Event struct members passed from dongle to host are stored in network
+       * byte order. Convert all members to host-order.
+       */
+       evt->event_type = hton32(evt->event_type);
+       evt->flags = hton16(evt->flags);
+       evt->status = hton32(evt->status);
+       evt->reason = hton32(evt->reason);
+       evt->auth_type = hton32(evt->auth_type);
+       evt->datalen = hton32(evt->datalen);
+       evt->version = hton16(evt->version);
+}
+
+/*
+ * Validate if the event is proper and if valid copy event header to event.
+ * If proper event pointer is passed, to just validate, pass NULL to event.
+ *
+ * Return values are
+ *     BCME_OK - It is a BRCM event or BRCM dongle event
+ *     BCME_NOTFOUND - Not BRCM, not an event, may be okay
+ *     BCME_BADLEN - Bad length, should not process, just drop
+ */
+int
+is_wlc_event_frame(void *pktdata, uint pktlen, uint16 exp_usr_subtype,
+       bcm_event_msg_u_t *out_event)
+{
+       uint16 evlen = 0;       /* length in bcmeth_hdr */
+       uint16 subtype;
+       uint16 usr_subtype;
+       bcm_event_t *bcm_event;
+       uint8 *pktend;
+       uint8 *evend;
+       int err = BCME_OK;
+       uint32 data_len = 0; /* data length in bcm_event */
+
+       pktend = (uint8 *)pktdata + pktlen;
+       bcm_event = (bcm_event_t *)pktdata;
+
+       /* only care about 16-bit subtype / length versions */
+       if ((uint8 *)&bcm_event->bcm_hdr < pktend) {
+               uint8 short_subtype = *(uint8 *)&bcm_event->bcm_hdr;
+               if (!(short_subtype & 0x80)) {
+                       err = BCME_NOTFOUND;
+                       goto done;
+               }
+       }
+
+       /* must have both ether_header and bcmeth_hdr */
+       if (pktlen < OFFSETOF(bcm_event_t, event)) {
+               err = BCME_BADLEN;
+               goto done;
+       }
+
+       /* check length in bcmeth_hdr */
+
+       /* temporary - header length not always set properly. When the below
+        * !BCMDONGLEHOST is in all branches that use trunk DHD, the code
+        * under BCMDONGLEHOST can be removed.
+        */
+       evlen = (uint16)(pktend - (uint8 *)&bcm_event->bcm_hdr.version);
+       evend = (uint8 *)&bcm_event->bcm_hdr.version + evlen;
+       if (evend != pktend) {
+               err = BCME_BADLEN;
+               goto done;
+       }
+
+       /* match on subtype, oui and usr subtype for BRCM events */
+       subtype = ntoh16_ua((void *)&bcm_event->bcm_hdr.subtype);
+       if (subtype != BCMILCP_SUBTYPE_VENDOR_LONG) {
+               err = BCME_NOTFOUND;
+               goto done;
+       }
+
+       if (bcmp(BRCM_OUI, &bcm_event->bcm_hdr.oui[0], DOT11_OUI_LEN)) {
+               err = BCME_NOTFOUND;
+               goto done;
+       }
+
+       /* if it is a bcm_event or bcm_dngl_event_t, validate it */
+       usr_subtype = ntoh16_ua((void *)&bcm_event->bcm_hdr.usr_subtype);
+       switch (usr_subtype) {
+       case BCMILCP_BCM_SUBTYPE_EVENT:
+               /* check that header length and pkt length are sufficient */
+               if ((pktlen < sizeof(bcm_event_t)) ||
+                       (evend < ((uint8 *)bcm_event + sizeof(bcm_event_t)))) {
+                       err = BCME_BADLEN;
+                       goto done;
+               }
+
+               /* ensure data length in event is not beyond the packet. */
+               data_len = ntoh32_ua((void *)&bcm_event->event.datalen);
+               if ((sizeof(bcm_event_t) + data_len +
+                       BCMILCP_BCM_SUBTYPE_EVENT_DATA_PAD) != pktlen) {
+                       err = BCME_BADLEN;
+                       goto done;
+               }
+
+               if (exp_usr_subtype && (exp_usr_subtype != usr_subtype)) {
+                       err = BCME_NOTFOUND;
+                       goto done;
+               }
+
+               if (out_event) {
+                       /* ensure BRCM event pkt aligned */
+                       memcpy(&out_event->event, &bcm_event->event, sizeof(wl_event_msg_t));
+               }
+
+               break;
+
+       case BCMILCP_BCM_SUBTYPE_DNGLEVENT:
+#if defined(DNGL_EVENT_SUPPORT)
+               if ((pktlen < sizeof(bcm_dngl_event_t)) ||
+                       (evend < ((uint8 *)bcm_event + sizeof(bcm_dngl_event_t)))) {
+                       err = BCME_BADLEN;
+                       goto done;
+               }
+
+               /* ensure data length in event is not beyond the packet. */
+               data_len = ntoh16_ua((void *)&((bcm_dngl_event_t *)pktdata)->dngl_event.datalen);
+               if ((sizeof(bcm_dngl_event_t) + data_len +
+                       BCMILCP_BCM_SUBTYPE_EVENT_DATA_PAD) != pktlen) {
+                       err = BCME_BADLEN;
+                       goto done;
+               }
+
+               if (exp_usr_subtype && (exp_usr_subtype != usr_subtype)) {
+                       err = BCME_NOTFOUND;
+                       goto done;
+               }
+
+               if (out_event) {
+                       /* ensure BRCM dngl event pkt aligned */
+                       memcpy(&out_event->dngl_event, &((bcm_dngl_event_t *)pktdata)->dngl_event,
+                               sizeof(bcm_dngl_event_msg_t));
+               }
+
+               break;
+#else
+               err = BCME_UNSUPPORTED;
+               break;
+#endif
+
+       default:
+               err = BCME_NOTFOUND;
+               goto done;
+       }
+
+       BCM_REFERENCE(data_len);
+done:
+       return err;
+}
diff --git a/bcmdhd.101.10.240.x/bcmsdh.c b/bcmdhd.101.10.240.x/bcmsdh.c
new file mode 100644 (file)
index 0000000..4aa8882
--- /dev/null
@@ -0,0 +1,890 @@
+/*
+ *  BCMSDH interface glue
+ *  implement bcmsdh API for SDIOH driver
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+/**
+ * @file bcmsdh.c
+ */
+
+/* ****************** BCMSDH Interface Functions *************************** */
+
+#include <typedefs.h>
+#include <bcmdevs.h>
+#include <bcmendian.h>
+#include <bcmutils.h>
+#include <hndsoc.h>
+#include <siutils.h>
+#include <osl.h>
+
+#include <bcmsdh.h>    /* BRCM API for SDIO clients (such as wl, dhd) */
+#include <bcmsdbus.h>  /* common SDIO/controller interface */
+#include <sbsdio.h>    /* SDIO device core hardware definitions. */
+#include <sdio.h>      /* SDIO Device and Protocol Specs */
+
+#if defined(BT_OVER_SDIO)
+#include <dhd_bt_interface.h>
+#endif /* defined (BT_OVER_SDIO) */
+
+#define SDIOH_API_ACCESS_RETRY_LIMIT   2
+const uint bcmsdh_msglevel = BCMSDH_ERROR_VAL;
+
+/* local copy of bcm sd handler */
+bcmsdh_info_t * l_bcmsdh = NULL;
+
+#if defined(BT_OVER_SDIO)
+struct sdio_func *func_f3 = NULL;
+static f3intr_handler processf3intr = NULL;
+static dhd_hang_notification process_dhd_hang_notification = NULL;
+static dhd_hang_state_t g_dhd_hang_state = NO_HANG_STATE;
+#endif /* defined (BT_OVER_SDIO) */
+
+#if defined(OOB_INTR_ONLY) && defined(HW_OOB) || defined(FORCE_WOWLAN)
+extern int
+sdioh_enable_hw_oob_intr(void *sdioh, bool enable);
+
+void
+bcmsdh_enable_hw_oob_intr(bcmsdh_info_t *sdh, bool enable)
+{
+       sdioh_enable_hw_oob_intr(sdh->sdioh, enable);
+}
+#endif
+
+#if defined(BT_OVER_SDIO)
+void bcmsdh_btsdio_process_hang_state(dhd_hang_state_t new_state)
+{
+       bool state_change = false;
+
+       BCMSDH_ERROR(("%s: DHD hang state changed - [%d] -> [%d]\n",
+               __FUNCTION__, g_dhd_hang_state, new_state));
+
+       if (g_dhd_hang_state == new_state)
+               return;
+
+       switch (g_dhd_hang_state) {
+               case NO_HANG_STATE:
+                       if (HANG_START_STATE == new_state)
+                               state_change = true;
+               break;
+
+               case HANG_START_STATE:
+                       if (HANG_RECOVERY_STATE == new_state ||
+                               NO_HANG_STATE == new_state)
+                               state_change = true;
+
+               break;
+
+               case HANG_RECOVERY_STATE:
+                       if (NO_HANG_STATE == new_state)
+                               state_change = true;
+               break;
+
+               default:
+                       BCMSDH_ERROR(("%s: Unhandled Hang state\n", __FUNCTION__));
+               break;
+       }
+
+       if (!state_change) {
+               BCMSDH_ERROR(("%s: Hang state cannot be changed\n", __FUNCTION__));
+               return;
+       }
+
+       g_dhd_hang_state = new_state;
+}
+
+void bcmsdh_btsdio_process_f3_intr(void)
+{
+       if (processf3intr && (g_dhd_hang_state == NO_HANG_STATE))
+               processf3intr(func_f3);
+}
+
+void bcmsdh_btsdio_process_dhd_hang_notification(bool wifi_recovery_completed)
+{
+       bcmsdh_btsdio_process_hang_state(HANG_START_STATE);
+
+       if (process_dhd_hang_notification)
+               process_dhd_hang_notification(func_f3, wifi_recovery_completed);
+
+       /* WiFi was off, so HANG_RECOVERY_STATE is not needed */
+       if (wifi_recovery_completed)
+               bcmsdh_btsdio_process_hang_state(NO_HANG_STATE);
+       else {
+               bcmsdh_btsdio_process_hang_state(HANG_RECOVERY_STATE);
+       }
+}
+
+void bcmsdh_btsdio_interface_init(struct sdio_func *func,
+       f3intr_handler f3intr_fun, dhd_hang_notification hang_notification)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)l_bcmsdh;
+       BCMSDH_INFO(("%s: func %p \n", __FUNCTION__, func));
+       func_f3 = func;
+       processf3intr = f3intr_fun;
+       sdioh_sdmmc_card_enable_func_f3(bcmsdh->sdioh, func);
+       process_dhd_hang_notification = hang_notification;
+
+} EXPORT_SYMBOL(bcmsdh_btsdio_interface_init);
+#endif /* defined (BT_OVER_SDIO) */
+
+/* Attach BCMSDH layer to SDIO Host Controller Driver
+ *
+ * @param osh OSL Handle.
+ * @param cfghdl Configuration Handle.
+ * @param regsva Virtual address of controller registers.
+ * @param irq Interrupt number of SDIO controller.
+ *
+ * @return bcmsdh_info_t Handle to BCMSDH context.
+ */
+bcmsdh_info_t *
+bcmsdh_attach(osl_t *osh, void *sdioh, ulong *regsva)
+{
+       bcmsdh_info_t *bcmsdh;
+
+       if ((bcmsdh = (bcmsdh_info_t *)MALLOC(osh, sizeof(bcmsdh_info_t))) == NULL) {
+               BCMSDH_ERROR(("bcmsdh_attach: out of memory, malloced %d bytes\n", MALLOCED(osh)));
+               return NULL;
+       }
+       bzero((char *)bcmsdh, sizeof(bcmsdh_info_t));
+       bcmsdh->sdioh = sdioh;
+       bcmsdh->osh = osh;
+       bcmsdh->init_success = TRUE;
+       *regsva = si_enum_base(0);
+
+       bcmsdh_force_sbwad_calc(bcmsdh, FALSE);
+
+       /* Report the BAR, to fix if needed */
+       bcmsdh->sbwad = si_enum_base(0);
+
+       /* save the handler locally */
+       l_bcmsdh = bcmsdh;
+
+       return bcmsdh;
+}
+
+int
+bcmsdh_detach(osl_t *osh, void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       if (bcmsdh != NULL) {
+               MFREE(osh, bcmsdh, sizeof(bcmsdh_info_t));
+       }
+
+       l_bcmsdh = NULL;
+
+       return 0;
+}
+
+int
+bcmsdh_iovar_op(void *sdh, const char *name,
+                void *params, uint plen, void *arg, uint len, bool set)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       return sdioh_iovar_op(bcmsdh->sdioh, name, params, plen, arg, len, set);
+}
+
+bool
+bcmsdh_intr_query(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       bool on;
+
+       ASSERT(bcmsdh);
+       status = sdioh_interrupt_query(bcmsdh->sdioh, &on);
+       if (SDIOH_API_SUCCESS(status))
+               return FALSE;
+       else
+               return on;
+}
+
+int
+bcmsdh_intr_enable(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+#ifdef BCMSPI_ANDROID
+       uint32 data;
+#endif /* BCMSPI_ANDROID */
+       ASSERT(bcmsdh);
+
+       status = sdioh_interrupt_set(bcmsdh->sdioh, TRUE);
+#ifdef BCMSPI_ANDROID
+       data = bcmsdh_cfg_read_word(sdh, 0, 4, NULL);
+       data |= 0xE0E70000;
+       bcmsdh_cfg_write_word(sdh, 0, 4, data, NULL);
+#endif /* BCMSPI_ANDROID */
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_intr_disable(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+#ifdef BCMSPI_ANDROID
+       uint32 data;
+#endif /* BCMSPI_ANDROID */
+       ASSERT(bcmsdh);
+
+       status = sdioh_interrupt_set(bcmsdh->sdioh, FALSE);
+#ifdef BCMSPI_ANDROID
+       data = bcmsdh_cfg_read_word(sdh, 0, 4, NULL);
+       data &= ~0xE0E70000;
+       bcmsdh_cfg_write_word(sdh, 0, 4, data, NULL);
+#endif /* BCMSPI_ANDROID */
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_intr_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh);
+
+       status = sdioh_interrupt_register(bcmsdh->sdioh, fn, argh);
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_intr_dereg(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh);
+
+       status = sdioh_interrupt_deregister(bcmsdh->sdioh);
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+#if defined(DHD_DEBUG)
+bool
+bcmsdh_intr_pending(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       ASSERT(sdh);
+       return sdioh_interrupt_pending(bcmsdh->sdioh);
+}
+#endif
+
+int
+bcmsdh_devremove_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh)
+{
+       ASSERT(sdh);
+
+       /* don't support yet */
+       return BCME_UNSUPPORTED;
+}
+
+/**
+ * Read from SDIO Configuration Space
+ * @param sdh SDIO Host context.
+ * @param func_num Function number to read from.
+ * @param addr Address to read from.
+ * @param err Error return.
+ * @return value read from SDIO configuration space.
+ */
+uint8
+bcmsdh_cfg_read(void *sdh, uint fnc_num, uint32 addr, int *err)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+       int32 retry = 0;
+#endif
+       uint8 data = 0;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh->init_success);
+
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+       do {
+               if (retry)      /* wait for 1 ms till bus get settled down */
+                       OSL_DELAY(1000);
+#endif
+       status = sdioh_cfg_read(bcmsdh->sdioh, fnc_num, addr, (uint8 *)&data);
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+       } while (!SDIOH_API_SUCCESS(status) && (retry++ < SDIOH_API_ACCESS_RETRY_LIMIT));
+#endif
+       if (err)
+               *err = (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+
+       BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint8data = 0x%x\n", __FUNCTION__,
+                   fnc_num, addr, data));
+
+       return data;
+} EXPORT_SYMBOL(bcmsdh_cfg_read);
+
+void
+bcmsdh_cfg_write(void *sdh, uint fnc_num, uint32 addr, uint8 data, int *err)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+       int32 retry = 0;
+#endif
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh->init_success);
+
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+       do {
+               if (retry)      /* wait for 1 ms till bus get settled down */
+                       OSL_DELAY(1000);
+#endif
+       status = sdioh_cfg_write(bcmsdh->sdioh, fnc_num, addr, (uint8 *)&data);
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+       } while (!SDIOH_API_SUCCESS(status) && (retry++ < SDIOH_API_ACCESS_RETRY_LIMIT));
+#endif
+       if (err)
+               *err = SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR;
+
+       BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint8data = 0x%x\n", __FUNCTION__,
+                   fnc_num, addr, data));
+} EXPORT_SYMBOL(bcmsdh_cfg_write);
+
+uint32
+bcmsdh_cfg_read_word(void *sdh, uint fnc_num, uint32 addr, int *err)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       uint32 data = 0;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh->init_success);
+
+       status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL, SDIOH_READ, fnc_num,
+                                   addr, &data, 4);
+
+       if (err)
+               *err = (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+
+       BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint32data = 0x%x\n", __FUNCTION__,
+                   fnc_num, addr, data));
+
+       return data;
+}
+
+void
+bcmsdh_cfg_write_word(void *sdh, uint fnc_num, uint32 addr, uint32 data, int *err)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh->init_success);
+
+       status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL, SDIOH_WRITE, fnc_num,
+                                   addr, &data, 4);
+
+       if (err)
+               *err = (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+
+       BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint32data = 0x%x\n", __FUNCTION__, fnc_num,
+                    addr, data));
+}
+
+int
+bcmsdh_cis_read(void *sdh, uint func, uint8 *cis, uint length)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+
+       uint8 *tmp_buf, *tmp_ptr;
+       uint8 *ptr;
+       bool ascii = func & ~0xf;
+       func &= 0x7;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh->init_success);
+       ASSERT(cis);
+       ASSERT(length <= SBSDIO_CIS_SIZE_LIMIT);
+
+       status = sdioh_cis_read(bcmsdh->sdioh, func, cis, length);
+
+       if (ascii) {
+               /* Move binary bits to tmp and format them into the provided buffer. */
+               if ((tmp_buf = (uint8 *)MALLOC(bcmsdh->osh, length)) == NULL) {
+                       BCMSDH_ERROR(("%s: out of memory\n", __FUNCTION__));
+                       return BCME_NOMEM;
+               }
+               bcopy(cis, tmp_buf, length);
+               for (tmp_ptr = tmp_buf, ptr = cis; ptr < (cis + length - 4); tmp_ptr++) {
+                       ptr += snprintf((char*)ptr, (cis + length - ptr - 4),
+                               "%.2x ", *tmp_ptr & 0xff);
+                       if ((((tmp_ptr - tmp_buf) + 1) & 0xf) == 0)
+                               ptr += snprintf((char *)ptr, (cis + length - ptr -4), "\n");
+               }
+               MFREE(bcmsdh->osh, tmp_buf, length);
+       }
+
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_cisaddr_read(void *sdh, uint func, uint8 *cisd, uint32 offset)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+
+       func &= 0x7;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh->init_success);
+       ASSERT(cisd);
+
+       status = sdioh_cisaddr_read(bcmsdh->sdioh, func, cisd, offset);
+
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+
+int
+bcmsdhsdio_set_sbaddr_window(void *sdh, uint32 address, bool force_set)
+{
+       int err = 0;
+       uint bar0 = address & ~SBSDIO_SB_OFT_ADDR_MASK;
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       if (bar0 != bcmsdh->sbwad || force_set) {
+               bcmsdh_cfg_write(bcmsdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW,
+                       (address >> 8) & SBSDIO_SBADDRLOW_MASK, &err);
+               if (!err)
+                       bcmsdh_cfg_write(bcmsdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRMID,
+                               (address >> 16) & SBSDIO_SBADDRMID_MASK, &err);
+               if (!err)
+                       bcmsdh_cfg_write(bcmsdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRHIGH,
+                               (address >> 24) & SBSDIO_SBADDRHIGH_MASK, &err);
+
+               if (!err)
+                       bcmsdh->sbwad = bar0;
+               else
+                       /* invalidate cached window var */
+                       bcmsdh->sbwad = 0;
+
+       }
+
+       return err;
+}
+
+uint32
+bcmsdh_reg_read(void *sdh, uintptr addr, uint size)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       uint32 word = 0;
+
+       BCMSDH_INFO(("%s:fun = 1, addr = 0x%x\n", __FUNCTION__, (unsigned int)addr));
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh->init_success);
+
+       if (bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, bcmsdh->force_sbwad_calc)) {
+               bcmsdh->regfail = TRUE; // terence 20130621: prevent dhd_dpc in dead lock
+               return 0xFFFFFFFF;
+       }
+
+       addr &= SBSDIO_SB_OFT_ADDR_MASK;
+       if (size == 4)
+               addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+       status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL,
+               SDIOH_READ, SDIO_FUNC_1, addr, &word, size);
+
+       bcmsdh->regfail = !(SDIOH_API_SUCCESS(status));
+
+       BCMSDH_INFO(("uint32data = 0x%x\n", word));
+
+       /* if ok, return appropriately masked word */
+       /* XXX Masking was put in for NDIS port, remove if not needed */
+       if (SDIOH_API_SUCCESS(status)) {
+               switch (size) {
+                       case sizeof(uint8):
+                               return (word & 0xff);
+                       case sizeof(uint16):
+                               return (word & 0xffff);
+                       case sizeof(uint32):
+                               return word;
+                       default:
+                               bcmsdh->regfail = TRUE;
+
+               }
+       }
+
+       /* otherwise, bad sdio access or invalid size */
+       BCMSDH_ERROR(("%s: error reading addr 0x%x size %d\n",
+               __FUNCTION__, (unsigned int)addr, size));
+       return 0xFFFFFFFF;
+}
+
+uint32
+bcmsdh_reg_write(void *sdh, uintptr addr, uint size, uint32 data)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       int err = 0;
+
+       BCMSDH_INFO(("%s:fun = 1, addr = 0x%x, uint%ddata = 0x%x\n",
+                    __FUNCTION__, (unsigned int)addr, size*8, data));
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh->init_success);
+
+       if ((err = bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, bcmsdh->force_sbwad_calc))) {
+               bcmsdh->regfail = TRUE; // terence 20130621:
+               return err;
+       }
+
+       addr &= SBSDIO_SB_OFT_ADDR_MASK;
+       if (size == 4)
+               addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+       status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL, SDIOH_WRITE, SDIO_FUNC_1,
+                                   addr, &data, size);
+       bcmsdh->regfail = !(SDIOH_API_SUCCESS(status));
+
+       if (SDIOH_API_SUCCESS(status))
+               return 0;
+
+       BCMSDH_ERROR(("%s: error writing 0x%08x to addr 0x%04x size %d\n",
+                     __FUNCTION__, data, (unsigned int)addr, size));
+       return 0xFFFFFFFF;
+}
+
+bool
+bcmsdh_regfail(void *sdh)
+{
+       return ((bcmsdh_info_t *)sdh)->regfail;
+}
+
+int
+bcmsdh_recv_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                uint8 *buf, uint nbytes, void *pkt,
+                bcmsdh_cmplt_fn_t complete_fn, void *handle)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       uint incr_fix;
+       uint width;
+       int err = 0;
+
+       ASSERT(bcmsdh);
+       ASSERT(bcmsdh->init_success);
+
+       BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, size = %d\n",
+                    __FUNCTION__, fn, addr, nbytes));
+
+       /* Async not implemented yet */
+       ASSERT(!(flags & SDIO_REQ_ASYNC));
+       if (flags & SDIO_REQ_ASYNC)
+               return BCME_UNSUPPORTED;
+
+       if ((err = bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, FALSE)))
+               return err;
+
+       addr &= SBSDIO_SB_OFT_ADDR_MASK;
+
+       incr_fix = (flags & SDIO_REQ_FIXED) ? SDIOH_DATA_FIX : SDIOH_DATA_INC;
+       width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
+       if (width == 4)
+               addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+       status = sdioh_request_buffer(bcmsdh->sdioh, SDIOH_DATA_PIO, incr_fix,
+                                     SDIOH_READ, fn, addr, width, nbytes, buf, pkt);
+
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+}
+
+int
+bcmsdh_send_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                uint8 *buf, uint nbytes, void *pkt,
+                bcmsdh_cmplt_fn_t complete_fn, void *handle)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       uint incr_fix;
+       uint width;
+       int err = 0;
+
+       ASSERT(bcmsdh);
+       ASSERT(bcmsdh->init_success);
+
+       BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, size = %d\n",
+                   __FUNCTION__, fn, addr, nbytes));
+
+       /* Async not implemented yet */
+       ASSERT(!(flags & SDIO_REQ_ASYNC));
+       if (flags & SDIO_REQ_ASYNC)
+               return BCME_UNSUPPORTED;
+
+       if ((err = bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, FALSE)))
+               return err;
+
+       addr &= SBSDIO_SB_OFT_ADDR_MASK;
+
+       incr_fix = (flags & SDIO_REQ_FIXED) ? SDIOH_DATA_FIX : SDIOH_DATA_INC;
+       width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
+       if (width == 4)
+               addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+       status = sdioh_request_buffer(bcmsdh->sdioh, SDIOH_DATA_PIO, incr_fix,
+                                     SDIOH_WRITE, fn, addr, width, nbytes, buf, pkt);
+
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_rwdata(void *sdh, uint rw, uint32 addr, uint8 *buf, uint nbytes)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+
+       ASSERT(bcmsdh);
+       ASSERT(bcmsdh->init_success);
+       ASSERT((addr & SBSDIO_SBWINDOW_MASK) == 0);
+
+       addr &= SBSDIO_SB_OFT_ADDR_MASK;
+       addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+       status = sdioh_request_buffer(bcmsdh->sdioh, SDIOH_DATA_PIO, SDIOH_DATA_INC,
+                                     (rw ? SDIOH_WRITE : SDIOH_READ), SDIO_FUNC_1,
+                                     addr, 4, nbytes, buf, NULL);
+
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_abort(void *sdh, uint fn)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       return sdioh_abort(bcmsdh->sdioh, fn);
+}
+
+int
+bcmsdh_start(void *sdh, int stage)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       return sdioh_start(bcmsdh->sdioh, stage);
+}
+
+int
+bcmsdh_stop(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       return sdioh_stop(bcmsdh->sdioh);
+}
+
+int
+bcmsdh_waitlockfree(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       return sdioh_waitlockfree(bcmsdh->sdioh);
+}
+
+int
+bcmsdh_query_device(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       bcmsdh->vendevid = (VENDOR_BROADCOM << 16) | 0;
+       return (bcmsdh->vendevid);
+}
+
+uint
+bcmsdh_query_iofnum(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       return (sdioh_query_iofnum(bcmsdh->sdioh));
+}
+
+int
+bcmsdh_reset(bcmsdh_info_t *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       return sdioh_sdio_reset(bcmsdh->sdioh);
+}
+
+/* XXX For use by NDIS port, remove if not needed. */
+void *bcmsdh_get_sdioh(bcmsdh_info_t *sdh)
+{
+       ASSERT(sdh);
+       return sdh->sdioh;
+}
+
+/* Function to pass device-status bits to DHD. */
+uint32
+bcmsdh_get_dstatus(void *sdh)
+{
+#ifdef BCMSPI
+       bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+       sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+       return sdioh_get_dstatus(sd);
+#else
+       return 0;
+#endif /* BCMSPI */
+}
+uint32
+bcmsdh_cur_sbwad(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       return (bcmsdh->sbwad);
+}
+
+/* example usage: if force is TRUE, forces the bcmsdhsdio_set_sbaddr_window to
+ * calculate sbwad always instead of caching.
+ */
+void
+bcmsdh_force_sbwad_calc(void *sdh, bool force)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+       bcmsdh->force_sbwad_calc = force;
+}
+
+void
+bcmsdh_chipinfo(void *sdh, uint32 chip, uint32 chiprev)
+{
+#ifdef BCMSPI
+       bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+       sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+       sdioh_chipinfo(sd, chip, chiprev);
+#else
+       return;
+#endif /* BCMSPI */
+}
+
+#ifdef BCMSPI
+void
+bcmsdh_dwordmode(void *sdh, bool set)
+{
+       bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+       sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+       sdioh_dwordmode(sd, set);
+       return;
+}
+#endif /* BCMSPI */
+
+int
+bcmsdh_sleep(void *sdh, bool enab)
+{
+#ifdef SDIOH_SLEEP_ENABLED
+       bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+       sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+       return sdioh_sleep(sd, enab);
+#else
+       return BCME_UNSUPPORTED;
+#endif
+}
+
+int
+bcmsdh_gpio_init(void *sdh)
+{
+       bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+       sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+       return sdioh_gpio_init(sd);
+}
+
+bool
+bcmsdh_gpioin(void *sdh, uint32 gpio)
+{
+       bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+       sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+       return sdioh_gpioin(sd, gpio);
+}
+
+int
+bcmsdh_gpioouten(void *sdh, uint32 gpio)
+{
+       bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+       sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+       return sdioh_gpioouten(sd, gpio);
+}
+
+int
+bcmsdh_gpioout(void *sdh, uint32 gpio, bool enab)
+{
+       bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+       sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+       return sdioh_gpioout(sd, gpio, enab);
+}
+
+uint
+bcmsdh_set_mode(void *sdh, uint mode) 
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       return (sdioh_set_mode(bcmsdh->sdioh, mode));
+}
+
+#ifdef PKT_STATICS
+uint32
+bcmsdh_get_spend_time(void *sdh) 
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       return (sdioh_get_spend_time(bcmsdh->sdioh));
+}
+#endif
diff --git a/bcmdhd.101.10.240.x/bcmsdh_linux.c b/bcmdhd.101.10.240.x/bcmsdh_linux.c
new file mode 100644 (file)
index 0000000..0a3b0de
--- /dev/null
@@ -0,0 +1,538 @@
+/*
+ * SDIO access interface for drivers - linux specific (pci only)
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+/**
+ * @file bcmsdh_linux.c
+ */
+
+#define __UNDEF_NO_VERSION__
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <linux/pci.h>
+#include <linux/completion.h>
+
+#include <osl.h>
+#include <pcicfg.h>
+#include <bcmdefs.h>
+#include <bcmdevs.h>
+#include <linux/irq.h>
+extern void dhdsdio_isr(void * args);
+#include <bcmutils.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_linux.h>
+
+/* driver info, initialized when bcmsdh_register is called */
+static bcmsdh_driver_t drvinfo = {NULL, NULL, NULL, NULL};
+
+typedef enum {
+       DHD_INTR_INVALID = 0,
+       DHD_INTR_INBAND,
+       DHD_INTR_HWOOB,
+       DHD_INTR_SWOOB
+} DHD_HOST_INTR_TYPE;
+
+/* the BCMSDH module comprises the generic part (bcmsdh.c) and OS specific layer (e.g.
+ * bcmsdh_linux.c). Put all OS specific variables (e.g. irq number and flags) here rather
+ * than in the common structure bcmsdh_info. bcmsdh_info only keeps a handle (os_ctx) to this
+ * structure.
+ */
+typedef struct bcmsdh_os_info {
+       DHD_HOST_INTR_TYPE      intr_type;
+       int                     oob_irq_num;    /* valid when hardware or software oob in use */
+       unsigned long           oob_irq_flags;  /* valid when hardware or software oob in use */
+       bool                    oob_irq_registered;
+       bool                    oob_irq_enabled;
+       bool                    oob_irq_wake_enabled;
+       spinlock_t              oob_irq_spinlock;
+       bcmsdh_cb_fn_t          oob_irq_handler;
+       void                    *oob_irq_handler_context;
+       void                    *context;       /* context returned from upper layer */
+       void                    *sdioh;         /* handle to lower layer (sdioh) */
+       void                    *dev;           /* handle to the underlying device */
+       bool                    dev_wake_enabled;
+} bcmsdh_os_info_t;
+
+/* debugging macros */
+#define SDLX_ERR(x) printf x
+#define SDLX_MSG(x) printf x
+
+/**
+ * Checks to see if vendor and device IDs match a supported SDIO Host Controller.
+ */
+bool
+bcmsdh_chipmatch(uint16 vendor, uint16 device)
+{
+       /* Add other vendors and devices as required */
+
+#ifdef BCMSDIOH_STD
+       /* Check for Arasan host controller */
+       if (vendor == VENDOR_SI_IMAGE) {
+               return (TRUE);
+       }
+       /* Check for BRCM 27XX Standard host controller */
+       if (device == BCM27XX_SDIOH_ID && vendor == VENDOR_BROADCOM) {
+               return (TRUE);
+       }
+       /* Check for BRCM Standard host controller */
+       if (device == SDIOH_FPGA_ID && vendor == VENDOR_BROADCOM) {
+               return (TRUE);
+       }
+       /* Check for TI PCIxx21 Standard host controller */
+       if (device == PCIXX21_SDIOH_ID && vendor == VENDOR_TI) {
+               return (TRUE);
+       }
+       if (device == PCIXX21_SDIOH0_ID && vendor == VENDOR_TI) {
+               return (TRUE);
+       }
+       /* Ricoh R5C822 Standard SDIO Host */
+       if (device == R5C822_SDIOH_ID && vendor == VENDOR_RICOH) {
+               return (TRUE);
+       }
+       /* JMicron Standard SDIO Host */
+       if (device == JMICRON_SDIOH_ID && vendor == VENDOR_JMICRON) {
+               return (TRUE);
+       }
+
+#endif /* BCMSDIOH_STD */
+#ifdef BCMSDIOH_SPI
+       /* This is the PciSpiHost. */
+       if (device == SPIH_FPGA_ID && vendor == VENDOR_BROADCOM) {
+               printf("Found PCI SPI Host Controller\n");
+               return (TRUE);
+       }
+
+#endif /* BCMSDIOH_SPI */
+
+       return (FALSE);
+}
+
+void* bcmsdh_probe(osl_t *osh, void *dev, void *sdioh, void *adapter_info, uint bus_type,
+       uint bus_num, uint slot_num)
+{
+       ulong regs;
+       bcmsdh_info_t *bcmsdh;
+       uint32 vendevid;
+       bcmsdh_os_info_t *bcmsdh_osinfo = NULL;
+
+       bcmsdh = bcmsdh_attach(osh, sdioh, &regs);
+       if (bcmsdh == NULL) {
+               SDLX_ERR(("%s: bcmsdh_attach failed\n", __FUNCTION__));
+               goto err;
+       }
+       bcmsdh_osinfo = MALLOC(osh, sizeof(bcmsdh_os_info_t));
+       if (bcmsdh_osinfo == NULL) {
+               SDLX_ERR(("%s: failed to allocate bcmsdh_os_info_t\n", __FUNCTION__));
+               goto err;
+       }
+       bzero((char *)bcmsdh_osinfo, sizeof(bcmsdh_os_info_t));
+       bcmsdh->os_cxt = bcmsdh_osinfo;
+       bcmsdh_osinfo->sdioh = sdioh;
+       bcmsdh_osinfo->dev = dev;
+       osl_set_bus_handle(osh, bcmsdh);
+
+#if !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+       if (dev && device_init_wakeup(dev, true) == 0)
+               bcmsdh_osinfo->dev_wake_enabled = TRUE;
+#endif /* !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36)) */
+
+#if defined(OOB_INTR_ONLY)
+       spin_lock_init(&bcmsdh_osinfo->oob_irq_spinlock);
+       /* Get customer specific OOB IRQ parametres: IRQ number as IRQ type */
+       bcmsdh_osinfo->oob_irq_num = wifi_platform_get_irq_number(adapter_info,
+               &bcmsdh_osinfo->oob_irq_flags);
+       if  (bcmsdh_osinfo->oob_irq_num < 0) {
+               SDLX_ERR(("%s: Host OOB irq is not defined\n", __FUNCTION__));
+               goto err;
+       }
+#endif /* defined(BCMLXSDMMC) */
+
+       /* Read the vendor/device ID from the CIS */
+       vendevid = bcmsdh_query_device(bcmsdh);
+       /* try to attach to the target device */
+       bcmsdh_osinfo->context = drvinfo.probe((vendevid >> 16), (vendevid & 0xFFFF), bus_num,
+               slot_num, 0, bus_type, (void *)regs, osh, bcmsdh);
+       if (bcmsdh_osinfo->context == NULL) {
+               SDLX_ERR(("%s: device attach failed\n", __FUNCTION__));
+               goto err;
+       }
+
+       return bcmsdh;
+
+       /* error handling */
+err:
+       if (bcmsdh != NULL)
+               bcmsdh_detach(osh, bcmsdh);
+       if (bcmsdh_osinfo != NULL)
+               MFREE(osh, bcmsdh_osinfo, sizeof(bcmsdh_os_info_t));
+       return NULL;
+}
+
+int bcmsdh_remove(bcmsdh_info_t *bcmsdh)
+{
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+#if !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+       if (bcmsdh_osinfo->dev)
+               device_init_wakeup(bcmsdh_osinfo->dev, false);
+       bcmsdh_osinfo->dev_wake_enabled = FALSE;
+#endif /* !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36)) */
+
+       drvinfo.remove(bcmsdh_osinfo->context);
+       MFREE(bcmsdh->osh, bcmsdh->os_cxt, sizeof(bcmsdh_os_info_t));
+       bcmsdh_detach(bcmsdh->osh, bcmsdh);
+
+       return 0;
+}
+
+#ifdef DHD_WAKE_STATUS
+int bcmsdh_get_total_wake(bcmsdh_info_t *bcmsdh)
+{
+       return bcmsdh->total_wake_count;
+}
+
+int bcmsdh_set_get_wake(bcmsdh_info_t *bcmsdh, int flag)
+{
+#if defined(OOB_INTR_ONLY)
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+       unsigned long flags;
+#endif
+       int ret = 0;
+
+#if defined(OOB_INTR_ONLY)
+       spin_lock_irqsave(&bcmsdh_osinfo->oob_irq_spinlock, flags);
+
+       ret = bcmsdh->pkt_wake;
+       bcmsdh->total_wake_count += flag;
+       bcmsdh->pkt_wake = flag;
+
+       spin_unlock_irqrestore(&bcmsdh_osinfo->oob_irq_spinlock, flags);
+#endif
+       return ret;
+}
+#endif /* DHD_WAKE_STATUS */
+
+int bcmsdh_suspend(bcmsdh_info_t *bcmsdh)
+{
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+       if (drvinfo.suspend && drvinfo.suspend(bcmsdh_osinfo->context))
+               return -EBUSY;
+       return 0;
+}
+
+int bcmsdh_resume(bcmsdh_info_t *bcmsdh)
+{
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+       if (drvinfo.resume)
+               return drvinfo.resume(bcmsdh_osinfo->context);
+       return 0;
+}
+
+extern int bcmsdh_register_client_driver(void);
+extern void bcmsdh_unregister_client_driver(void);
+extern int sdio_func_reg_notify(void* semaphore);
+extern void sdio_func_unreg_notify(void);
+
+#if defined(BCMLXSDMMC)
+int bcmsdh_reg_sdio_notify(void* semaphore)
+{
+       return sdio_func_reg_notify(semaphore);
+}
+
+void bcmsdh_unreg_sdio_notify(void)
+{
+       sdio_func_unreg_notify();
+}
+#endif /* defined(BCMLXSDMMC) */
+
+int
+bcmsdh_register(bcmsdh_driver_t *driver)
+{
+       int error = 0;
+
+       drvinfo = *driver;
+       SDLX_MSG(("%s: register client driver\n", __FUNCTION__));
+       error = bcmsdh_register_client_driver();
+       if (error)
+               SDLX_ERR(("%s: failed %d\n", __FUNCTION__, error));
+
+       return error;
+}
+
+void
+bcmsdh_unregister(void)
+{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+               if (bcmsdh_pci_driver.node.next == NULL)
+                       return;
+#endif
+
+       bcmsdh_unregister_client_driver();
+}
+
+void bcmsdh_dev_pm_stay_awake(bcmsdh_info_t *bcmsdh)
+{
+#if !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+       pm_stay_awake(bcmsdh_osinfo->dev);
+#endif /* !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36)) */
+}
+
+void bcmsdh_dev_relax(bcmsdh_info_t *bcmsdh)
+{
+#if !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+       pm_relax(bcmsdh_osinfo->dev);
+#endif /* !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36)) */
+}
+
+bool bcmsdh_dev_pm_enabled(bcmsdh_info_t *bcmsdh)
+{
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+       return bcmsdh_osinfo->dev_wake_enabled;
+}
+
+#if defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID)
+int bcmsdh_get_oob_intr_num(bcmsdh_info_t *bcmsdh)
+{
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+       return bcmsdh_osinfo->oob_irq_num;
+}
+
+void bcmsdh_oob_intr_set(bcmsdh_info_t *bcmsdh, bool enable)
+{
+       unsigned long flags;
+       bcmsdh_os_info_t *bcmsdh_osinfo;
+
+       if (!bcmsdh)
+               return;
+
+       bcmsdh_osinfo = bcmsdh->os_cxt;
+       spin_lock_irqsave(&bcmsdh_osinfo->oob_irq_spinlock, flags);
+       if (bcmsdh_osinfo->oob_irq_enabled != enable) {
+               if (enable)
+                       enable_irq(bcmsdh_osinfo->oob_irq_num);
+               else
+                       disable_irq_nosync(bcmsdh_osinfo->oob_irq_num);
+               bcmsdh_osinfo->oob_irq_enabled = enable;
+       }
+       spin_unlock_irqrestore(&bcmsdh_osinfo->oob_irq_spinlock, flags);
+}
+
+#ifdef ENABLE_WAKEUP_PKT_DUMP
+extern volatile bool dhd_mmc_suspend;
+extern volatile bool dhd_mmc_wake;
+#endif /* ENABLE_WAKEUP_PKT_DUMP */
+
+static irqreturn_t wlan_oob_irq(int irq, void *dev_id)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)dev_id;
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+#ifndef BCMSPI_ANDROID
+       bcmsdh_oob_intr_set(bcmsdh, FALSE);
+#endif /* !BCMSPI_ANDROID */
+       bcmsdh_osinfo->oob_irq_handler(bcmsdh_osinfo->oob_irq_handler_context);
+
+#ifdef ENABLE_WAKEUP_PKT_DUMP
+       if (dhd_mmc_suspend) {
+               dhd_mmc_wake = TRUE;
+       }
+#endif /* ENABLE_WAKEUP_PKT_DUMP */
+
+       return IRQ_HANDLED;
+}
+
+int bcmsdh_oob_intr_register(bcmsdh_info_t *bcmsdh, bcmsdh_cb_fn_t oob_irq_handler,
+       void* oob_irq_handler_context)
+{
+       int err = 0;
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+       if (bcmsdh_osinfo->oob_irq_registered) {
+               SDLX_ERR(("%s: irq is already registered\n", __FUNCTION__));
+               return -EBUSY;
+       }
+#ifdef HW_OOB
+       SDLX_MSG(("%s: HW_OOB irq=%d flags=0x%X\n", __FUNCTION__,
+               (int)bcmsdh_osinfo->oob_irq_num, (int)bcmsdh_osinfo->oob_irq_flags));
+#else
+       SDLX_MSG(("%s: SW_OOB irq=%d flags=0x%X\n", __FUNCTION__,
+               (int)bcmsdh_osinfo->oob_irq_num, (int)bcmsdh_osinfo->oob_irq_flags));
+#endif
+       bcmsdh_osinfo->oob_irq_handler = oob_irq_handler;
+       bcmsdh_osinfo->oob_irq_handler_context = oob_irq_handler_context;
+       bcmsdh_osinfo->oob_irq_enabled = TRUE;
+       bcmsdh_osinfo->oob_irq_registered = TRUE;
+       err = request_irq(bcmsdh_osinfo->oob_irq_num, wlan_oob_irq,
+               bcmsdh_osinfo->oob_irq_flags, "bcmsdh_sdmmc", bcmsdh);
+       if (err) {
+               SDLX_ERR(("%s: request_irq failed with %d\n", __FUNCTION__, err));
+               bcmsdh_osinfo->oob_irq_enabled = FALSE;
+               bcmsdh_osinfo->oob_irq_registered = FALSE;
+               return err;
+       }
+
+#if defined(DISABLE_WOWLAN)
+       SDLX_MSG(("%s: disable_irq_wake\n", __FUNCTION__));
+       bcmsdh_osinfo->oob_irq_wake_enabled = FALSE;
+#else
+#if defined(CONFIG_ARCH_RHEA) || defined(CONFIG_ARCH_CAPRI)
+       if (device_may_wakeup(bcmsdh_osinfo->dev)) {
+#endif /* CONFIG_ARCH_RHEA || CONFIG_ARCH_CAPRI */
+               err = enable_irq_wake(bcmsdh_osinfo->oob_irq_num);
+               if (err)
+                       SDLX_ERR(("%s: enable_irq_wake failed with %d\n", __FUNCTION__, err));
+               else
+                       bcmsdh_osinfo->oob_irq_wake_enabled = TRUE;
+#if defined(CONFIG_ARCH_RHEA) || defined(CONFIG_ARCH_CAPRI)
+       }
+#endif /* CONFIG_ARCH_RHEA || CONFIG_ARCH_CAPRI */
+#endif
+
+       return 0;
+}
+
+void bcmsdh_oob_intr_unregister(bcmsdh_info_t *bcmsdh)
+{
+       int err = 0;
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+       SDLX_MSG(("%s: Enter\n", __FUNCTION__));
+       if (!bcmsdh_osinfo->oob_irq_registered) {
+               SDLX_MSG(("%s: irq is not registered\n", __FUNCTION__));
+               return;
+       }
+       if (bcmsdh_osinfo->oob_irq_wake_enabled) {
+#if defined(CONFIG_ARCH_RHEA) || defined(CONFIG_ARCH_CAPRI)
+               if (device_may_wakeup(bcmsdh_osinfo->dev)) {
+#endif /* CONFIG_ARCH_RHEA || CONFIG_ARCH_CAPRI */
+                       err = disable_irq_wake(bcmsdh_osinfo->oob_irq_num);
+                       if (!err)
+                               bcmsdh_osinfo->oob_irq_wake_enabled = FALSE;
+#if defined(CONFIG_ARCH_RHEA) || defined(CONFIG_ARCH_CAPRI)
+               }
+#endif /* CONFIG_ARCH_RHEA || CONFIG_ARCH_CAPRI */
+       }
+       if (bcmsdh_osinfo->oob_irq_enabled) {
+               disable_irq(bcmsdh_osinfo->oob_irq_num);
+               bcmsdh_osinfo->oob_irq_enabled = FALSE;
+       }
+       free_irq(bcmsdh_osinfo->oob_irq_num, bcmsdh);
+       bcmsdh_osinfo->oob_irq_registered = FALSE;
+}
+#endif /* defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID) */
+
+/* Module parameters specific to each host-controller driver */
+/* XXX Need to move these to where they really belong! */
+
+extern uint sd_msglevel;       /* Debug message level */
+module_param(sd_msglevel, uint, 0);
+
+extern uint sd_power;  /* 0 = SD Power OFF, 1 = SD Power ON. */
+module_param(sd_power, uint, 0);
+
+extern uint sd_clock;  /* SD Clock Control, 0 = SD Clock OFF, 1 = SD Clock ON */
+module_param(sd_clock, uint, 0);
+
+extern uint sd_divisor;        /* Divisor (-1 means external clock) */
+module_param(sd_divisor, uint, 0);
+
+extern uint sd_sdmode; /* Default is SD4, 0=SPI, 1=SD1, 2=SD4 */
+module_param(sd_sdmode, uint, 0);
+
+extern uint sd_hiok;   /* Ok to use hi-speed mode */
+module_param(sd_hiok, uint, 0);
+
+extern uint sd_f2_blocksize;
+module_param(sd_f2_blocksize, int, 0);
+
+extern uint sd_f1_blocksize;
+module_param(sd_f1_blocksize, int, 0);
+
+#ifdef BCMSDIOH_STD
+extern int sd_uhsimode;
+module_param(sd_uhsimode, int, 0);
+extern uint sd_tuning_period;
+module_param(sd_tuning_period, uint, 0);
+extern int sd_delay_value;
+module_param(sd_delay_value, uint, 0);
+
+/* SDIO Drive Strength for UHSI mode specific to SDIO3.0 */
+extern char dhd_sdiod_uhsi_ds_override[2];
+module_param_string(dhd_sdiod_uhsi_ds_override, dhd_sdiod_uhsi_ds_override, 2, 0);
+
+#endif
+
+#ifdef BCMSDH_MODULE
+EXPORT_SYMBOL(bcmsdh_attach);
+EXPORT_SYMBOL(bcmsdh_detach);
+EXPORT_SYMBOL(bcmsdh_intr_query);
+EXPORT_SYMBOL(bcmsdh_intr_enable);
+EXPORT_SYMBOL(bcmsdh_intr_disable);
+EXPORT_SYMBOL(bcmsdh_intr_reg);
+EXPORT_SYMBOL(bcmsdh_intr_dereg);
+
+#if defined(DHD_DEBUG)
+EXPORT_SYMBOL(bcmsdh_intr_pending);
+#endif
+
+#if defined(BT_OVER_SDIO)
+EXPORT_SYMBOL(bcmsdh_btsdio_interface_init);
+#endif /* defined (BT_OVER_SDIO) */
+
+EXPORT_SYMBOL(bcmsdh_devremove_reg);
+EXPORT_SYMBOL(bcmsdh_cfg_read);
+EXPORT_SYMBOL(bcmsdh_cfg_write);
+EXPORT_SYMBOL(bcmsdh_cis_read);
+EXPORT_SYMBOL(bcmsdh_reg_read);
+EXPORT_SYMBOL(bcmsdh_reg_write);
+EXPORT_SYMBOL(bcmsdh_regfail);
+EXPORT_SYMBOL(bcmsdh_send_buf);
+EXPORT_SYMBOL(bcmsdh_recv_buf);
+
+EXPORT_SYMBOL(bcmsdh_rwdata);
+EXPORT_SYMBOL(bcmsdh_abort);
+EXPORT_SYMBOL(bcmsdh_query_device);
+EXPORT_SYMBOL(bcmsdh_query_iofnum);
+EXPORT_SYMBOL(bcmsdh_iovar_op);
+EXPORT_SYMBOL(bcmsdh_register);
+EXPORT_SYMBOL(bcmsdh_unregister);
+EXPORT_SYMBOL(bcmsdh_chipmatch);
+EXPORT_SYMBOL(bcmsdh_reset);
+EXPORT_SYMBOL(bcmsdh_waitlockfree);
+
+EXPORT_SYMBOL(bcmsdh_get_dstatus);
+EXPORT_SYMBOL(bcmsdh_cfg_read_word);
+EXPORT_SYMBOL(bcmsdh_cfg_write_word);
+EXPORT_SYMBOL(bcmsdh_cur_sbwad);
+EXPORT_SYMBOL(bcmsdh_chipinfo);
+
+#endif /* BCMSDH_MODULE */
diff --git a/bcmdhd.101.10.240.x/bcmsdh_sdmmc.c b/bcmdhd.101.10.240.x/bcmsdh_sdmmc.c
new file mode 100644 (file)
index 0000000..82bcb84
--- /dev/null
@@ -0,0 +1,1827 @@
+/*
+ * BCMSDH Function Driver for the native SDIO/MMC driver in the Linux Kernel
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+#include <typedefs.h>
+
+#include <bcmdevs.h>
+#include <bcmendian.h>
+#include <bcmutils.h>
+#include <osl.h>
+#include <sdio.h>      /* SDIO Device and Protocol Specs */
+#include <sdioh.h>     /* Standard SDIO Host Controller Specification */
+#include <bcmsdbus.h>  /* bcmsdh to/from specific controller APIs */
+#include <sdiovar.h>   /* ioctl/iovars */
+
+#include <linux/mmc/core.h>
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3, 0, 8))
+#include <drivers/mmc/core/host.h>
+#else
+#include <linux/mmc/host.h>
+#endif /* (LINUX_VERSION_CODE <= KERNEL_VERSION(3, 0, 0)) */
+#include <linux/mmc/card.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP)
+#include <linux/suspend.h>
+extern volatile bool dhd_mmc_suspend;
+#endif
+#include "bcmsdh_sdmmc.h"
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3, 0, 0)) || (LINUX_VERSION_CODE >= \
+       KERNEL_VERSION(4, 4, 0))
+static inline void
+mmc_host_clk_hold(struct mmc_host *host)
+{
+       BCM_REFERENCE(host);
+       return;
+}
+
+static inline void
+mmc_host_clk_release(struct mmc_host *host)
+{
+       BCM_REFERENCE(host);
+       return;
+}
+
+static inline unsigned int
+mmc_host_clk_rate(struct mmc_host *host)
+{
+       return host->ios.clock;
+}
+#endif /* LINUX_VERSION_CODE <= KERNEL_VERSION(3, 0, 0) */
+
+#ifndef BCMSDH_MODULE
+extern int sdio_function_init(void);
+extern void sdio_function_cleanup(void);
+#endif /* BCMSDH_MODULE */
+
+#if !defined(OOB_INTR_ONLY)
+static void IRQHandler(struct sdio_func *func);
+static void IRQHandlerF2(struct sdio_func *func);
+#endif /* !defined(OOB_INTR_ONLY) */
+static int sdioh_sdmmc_get_cisaddr(sdioh_info_t *sd, uint32 regaddr);
+#if defined(ENABLE_INSMOD_NO_FW_LOAD) && !defined(BUS_POWER_RESTORE)
+extern int sdio_reset_comm(struct mmc_card *card);
+#endif
+#ifdef GLOBAL_SDMMC_INSTANCE
+extern PBCMSDH_SDMMC_INSTANCE gInstance;
+#endif
+
+#define DEFAULT_SDIO_F2_BLKSIZE                512
+#ifndef CUSTOM_SDIO_F2_BLKSIZE
+#define CUSTOM_SDIO_F2_BLKSIZE         DEFAULT_SDIO_F2_BLKSIZE
+#endif
+
+#define DEFAULT_SDIO_F1_BLKSIZE                64
+#ifndef CUSTOM_SDIO_F1_BLKSIZE
+#define CUSTOM_SDIO_F1_BLKSIZE         DEFAULT_SDIO_F1_BLKSIZE
+#endif
+
+#define MAX_IO_RW_EXTENDED_BLK         511
+
+uint sd_sdmode = SDIOH_MODE_SD4;       /* Use SD4 mode by default */
+uint sd_f2_blocksize = CUSTOM_SDIO_F2_BLKSIZE;
+uint sd_f1_blocksize = CUSTOM_SDIO_F1_BLKSIZE;
+
+#if defined(BT_OVER_SDIO)
+uint sd_f3_blocksize = 64;
+#endif /* defined (BT_OVER_SDIO) */
+
+uint sd_divisor = 2;                   /* Default 48MHz/2 = 24MHz */
+
+uint sd_power = 1;             /* Default to SD Slot powered ON */
+uint sd_clock = 1;             /* Default to SD Clock turned ON */
+uint sd_hiok = FALSE;  /* Don't use hi-speed mode by default */
+uint sd_msglevel = SDH_ERROR_VAL;
+uint sd_use_dma = TRUE;
+
+#ifndef CUSTOM_RXCHAIN
+#define CUSTOM_RXCHAIN 0
+#endif
+
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_byte_wait);
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_word_wait);
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_packet_wait);
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_buffer_wait);
+
+#define DMA_ALIGN_MASK 0x03
+#define MMC_SDIO_ABORT_RETRY_LIMIT 5
+
+int sdioh_sdmmc_card_regread(sdioh_info_t *sd, int func, uint32 regaddr, int regsize, uint32 *data);
+
+#if defined(BT_OVER_SDIO)
+extern
+void sdioh_sdmmc_card_enable_func_f3(sdioh_info_t *sd, struct sdio_func *func)
+{
+       sd->func[3] = func;
+       sd_info(("%s sd->func[3] %p\n", __FUNCTION__, sd->func[3]));
+}
+#endif /* defined (BT_OVER_SDIO) */
+
+void  sdmmc_set_clock_rate(sdioh_info_t *sd, uint hz);
+uint  sdmmc_get_clock_rate(sdioh_info_t *sd);
+void  sdmmc_set_clock_divisor(sdioh_info_t *sd, uint sd_div);
+
+static int
+sdioh_sdmmc_card_enablefuncs(sdioh_info_t *sd)
+{
+       int err_ret;
+       uint32 fbraddr;
+       uint8 func;
+
+       sd_trace(("%s\n", __FUNCTION__));
+
+       /* Get the Card's common CIS address */
+       sd->com_cis_ptr = sdioh_sdmmc_get_cisaddr(sd, SDIOD_CCCR_CISPTR_0);
+       sd->func_cis_ptr[0] = sd->com_cis_ptr;
+       sd_info(("%s: Card's Common CIS Ptr = 0x%x\n", __FUNCTION__, sd->com_cis_ptr));
+
+       /* Get the Card's function CIS (for each function) */
+       for (fbraddr = SDIOD_FBR_STARTADDR, func = 1;
+            func <= sd->num_funcs; func++, fbraddr += SDIOD_FBR_SIZE) {
+               sd->func_cis_ptr[func] = sdioh_sdmmc_get_cisaddr(sd, SDIOD_FBR_CISPTR_0 + fbraddr);
+               sd_info(("%s: Function %d CIS Ptr = 0x%x\n",
+                        __FUNCTION__, func, sd->func_cis_ptr[func]));
+       }
+
+       sd->func_cis_ptr[0] = sd->com_cis_ptr;
+       sd_info(("%s: Card's Common CIS Ptr = 0x%x\n", __FUNCTION__, sd->com_cis_ptr));
+
+       /* Enable Function 1 */
+       sdio_claim_host(sd->func[1]);
+       err_ret = sdio_enable_func(sd->func[1]);
+       sdio_release_host(sd->func[1]);
+       if (err_ret) {
+               sd_err(("bcmsdh_sdmmc: Failed to enable F1 Err: 0x%08x\n", err_ret));
+       }
+
+       return FALSE;
+}
+
+/*
+ *     Public entry points & extern's
+ */
+extern sdioh_info_t *
+sdioh_attach(osl_t *osh, struct sdio_func *func)
+{
+       sdioh_info_t *sd = NULL;
+       int err_ret;
+
+       sd_trace(("%s\n", __FUNCTION__));
+
+       if (func == NULL) {
+               sd_err(("%s: sdio function device is NULL\n", __FUNCTION__));
+               return NULL;
+       }
+
+       if ((sd = (sdioh_info_t *)MALLOC(osh, sizeof(sdioh_info_t))) == NULL) {
+               sd_err(("sdioh_attach: out of memory, malloced %d bytes\n", MALLOCED(osh)));
+               return NULL;
+       }
+       bzero((char *)sd, sizeof(sdioh_info_t));
+       sd->osh = osh;
+       sd->fake_func0.num = 0;
+       sd->fake_func0.card = func->card;
+       sd->func[0] = &sd->fake_func0;
+#ifdef GLOBAL_SDMMC_INSTANCE
+       if (func->num == 2)
+               sd->func[1] = gInstance->func[1];
+#else
+       sd->func[1] = func->card->sdio_func[0];
+#endif
+       sd->func[2] = func->card->sdio_func[1];
+#ifdef GLOBAL_SDMMC_INSTANCE
+       sd->func[func->num] = func;
+#endif
+
+#if defined(BT_OVER_SDIO)
+       sd->func[3] = NULL;
+#endif /* defined (BT_OVER_SDIO) */
+
+       sd->num_funcs = 2;
+       sd->sd_blockmode = TRUE;
+       sd->use_client_ints = TRUE;
+       sd->client_block_size[0] = 64;
+       sd->use_rxchain = CUSTOM_RXCHAIN;
+       if (sd->func[1] == NULL || sd->func[2] == NULL) {
+               sd_err(("%s: func 1 or 2 is null \n", __FUNCTION__));
+               goto fail;
+       }
+       sdio_set_drvdata(sd->func[1], sd);
+
+       sdio_claim_host(sd->func[1]);
+       sd->client_block_size[1] = sd_f1_blocksize;
+       err_ret = sdio_set_block_size(sd->func[1], sd_f1_blocksize);
+       sdio_release_host(sd->func[1]);
+       if (err_ret) {
+               sd_err(("bcmsdh_sdmmc: Failed to set F1 blocksize(%d)\n", err_ret));
+               goto fail;
+       }
+
+       sdio_claim_host(sd->func[2]);
+       sd->client_block_size[2] = sd_f2_blocksize;
+       printf("%s: set sd_f2_blocksize %d\n", __FUNCTION__, sd_f2_blocksize);
+       err_ret = sdio_set_block_size(sd->func[2], sd_f2_blocksize);
+       sdio_release_host(sd->func[2]);
+       if (err_ret) {
+               sd_err(("bcmsdh_sdmmc: Failed to set F2 blocksize to %d(%d)\n",
+                       sd_f2_blocksize, err_ret));
+               goto fail;
+       }
+
+       sd->sd_clk_rate = sdmmc_get_clock_rate(sd);
+       printf("%s: sd clock rate = %u\n", __FUNCTION__, sd->sd_clk_rate);
+       sdioh_sdmmc_card_enablefuncs(sd);
+
+       sd_trace(("%s: Done\n", __FUNCTION__));
+       return sd;
+
+fail:
+       MFREE(sd->osh, sd, sizeof(sdioh_info_t));
+       return NULL;
+}
+
+extern SDIOH_API_RC
+sdioh_detach(osl_t *osh, sdioh_info_t *sd)
+{
+       sd_trace(("%s\n", __FUNCTION__));
+
+       if (sd) {
+
+               /* Disable Function 2 */
+               if (sd->func[2]) {
+                       sdio_claim_host(sd->func[2]);
+                       sdio_disable_func(sd->func[2]);
+                       sdio_release_host(sd->func[2]);
+               }
+
+               /* Disable Function 1 */
+               if (sd->func[1]) {
+                       sdio_claim_host(sd->func[1]);
+                       sdio_disable_func(sd->func[1]);
+                       sdio_release_host(sd->func[1]);
+               }
+
+               sd->func[1] = NULL;
+               sd->func[2] = NULL;
+
+               MFREE(sd->osh, sd, sizeof(sdioh_info_t));
+       }
+       return SDIOH_API_RC_SUCCESS;
+}
+
+#if defined(OOB_INTR_ONLY) && defined(HW_OOB)
+
+extern SDIOH_API_RC
+sdioh_enable_func_intr(sdioh_info_t *sd)
+{
+       uint8 reg;
+       int err;
+
+       if (sd->func[0] == NULL) {
+               sd_err(("%s: function 0 pointer is NULL\n", __FUNCTION__));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       sdio_claim_host(sd->func[0]);
+       reg = sdio_readb(sd->func[0], SDIOD_CCCR_INTEN, &err);
+       if (err) {
+               sd_err(("%s: error for read SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+               sdio_release_host(sd->func[0]);
+               return SDIOH_API_RC_FAIL;
+       }
+       /* Enable F1 and F2 interrupts, clear master enable */
+       reg &= ~INTR_CTL_MASTER_EN;
+       reg |= (INTR_CTL_FUNC1_EN | INTR_CTL_FUNC2_EN);
+#if defined(BT_OVER_SDIO)
+       reg |= (INTR_CTL_FUNC3_EN);
+#endif /* defined (BT_OVER_SDIO) */
+       sdio_writeb(sd->func[0], reg, SDIOD_CCCR_INTEN, &err);
+       sdio_release_host(sd->func[0]);
+
+       if (err) {
+               sd_err(("%s: error for write SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_disable_func_intr(sdioh_info_t *sd)
+{
+       uint8 reg;
+       int err;
+
+       if (sd->func[0] == NULL) {
+               sd_err(("%s: function 0 pointer is NULL\n", __FUNCTION__));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       sdio_claim_host(sd->func[0]);
+       reg = sdio_readb(sd->func[0], SDIOD_CCCR_INTEN, &err);
+       if (err) {
+               sd_err(("%s: error for read SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+               sdio_release_host(sd->func[0]);
+               return SDIOH_API_RC_FAIL;
+       }
+       reg &= ~(INTR_CTL_FUNC1_EN | INTR_CTL_FUNC2_EN);
+#if defined(BT_OVER_SDIO)
+       reg &= ~INTR_CTL_FUNC3_EN;
+#endif
+       /* Disable master interrupt with the last function interrupt */
+       if (!(reg & 0xFE))
+               reg = 0;
+       sdio_writeb(sd->func[0], reg, SDIOD_CCCR_INTEN, &err);
+       sdio_release_host(sd->func[0]);
+
+       if (err) {
+               sd_err(("%s: error for write SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       return SDIOH_API_RC_SUCCESS;
+}
+#endif /* defined(OOB_INTR_ONLY) && defined(HW_OOB) */
+
+/* Configure callback to client when we recieve client interrupt */
+extern SDIOH_API_RC
+sdioh_interrupt_register(sdioh_info_t *sd, sdioh_cb_fn_t fn, void *argh)
+{
+       sd_trace(("%s: Entering\n", __FUNCTION__));
+       if (fn == NULL) {
+               sd_err(("%s: interrupt handler is NULL, not registering\n", __FUNCTION__));
+               return SDIOH_API_RC_FAIL;
+       }
+#if !defined(OOB_INTR_ONLY)
+       sd->intr_handler = fn;
+       sd->intr_handler_arg = argh;
+       sd->intr_handler_valid = TRUE;
+
+       /* register and unmask irq */
+       if (sd->func[2]) {
+               sdio_claim_host(sd->func[2]);
+               sdio_claim_irq(sd->func[2], IRQHandlerF2);
+               sdio_release_host(sd->func[2]);
+       }
+
+       if (sd->func[1]) {
+               sdio_claim_host(sd->func[1]);
+               sdio_claim_irq(sd->func[1], IRQHandler);
+               sdio_release_host(sd->func[1]);
+       }
+#elif defined(HW_OOB)
+       sdioh_enable_func_intr(sd);
+#endif /* !defined(OOB_INTR_ONLY) */
+
+       return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_interrupt_deregister(sdioh_info_t *sd)
+{
+       sd_trace(("%s: Entering\n", __FUNCTION__));
+
+#if !defined(OOB_INTR_ONLY)
+       if (sd->func[1]) {
+               /* register and unmask irq */
+               sdio_claim_host(sd->func[1]);
+               sdio_release_irq(sd->func[1]);
+               sdio_release_host(sd->func[1]);
+       }
+
+       if (sd->func[2]) {
+               /* Claim host controller F2 */
+               sdio_claim_host(sd->func[2]);
+               sdio_release_irq(sd->func[2]);
+               /* Release host controller F2 */
+               sdio_release_host(sd->func[2]);
+       }
+
+       sd->intr_handler_valid = FALSE;
+       sd->intr_handler = NULL;
+       sd->intr_handler_arg = NULL;
+#elif defined(HW_OOB)
+       if (dhd_download_fw_on_driverload)
+               sdioh_disable_func_intr(sd);
+#endif /* !defined(OOB_INTR_ONLY) */
+       return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_interrupt_query(sdioh_info_t *sd, bool *onoff)
+{
+       sd_trace(("%s: Entering\n", __FUNCTION__));
+       *onoff = sd->client_intr_enabled;
+       return SDIOH_API_RC_SUCCESS;
+}
+
+#if defined(DHD_DEBUG)
+extern bool
+sdioh_interrupt_pending(sdioh_info_t *sd)
+{
+       return (0);
+}
+#endif
+
+uint
+sdioh_query_iofnum(sdioh_info_t *sd)
+{
+       return sd->num_funcs;
+}
+
+/* IOVar table */
+enum {
+       IOV_MSGLEVEL = 1,
+       IOV_BLOCKMODE,
+       IOV_BLOCKSIZE,
+       IOV_DMA,
+       IOV_USEINTS,
+       IOV_NUMINTS,
+       IOV_NUMLOCALINTS,
+       IOV_HOSTREG,
+       IOV_DEVREG,
+       IOV_DIVISOR,
+       IOV_SDMODE,
+       IOV_HISPEED,
+       IOV_HCIREGS,
+       IOV_POWER,
+       IOV_CLOCK,
+       IOV_RXCHAIN
+};
+
+const bcm_iovar_t sdioh_iovars[] = {
+       {"sd_msglevel", IOV_MSGLEVEL,   0, 0,   IOVT_UINT32,    0 },
+       {"sd_blockmode", IOV_BLOCKMODE, 0, 0,   IOVT_BOOL,      0 },
+       {"sd_blocksize", IOV_BLOCKSIZE, 0, 0,   IOVT_UINT32,    0 }, /* ((fn << 16) | size) */
+       {"sd_dma",      IOV_DMA,        0, 0,   IOVT_BOOL,      0 },
+       {"sd_ints",     IOV_USEINTS,    0, 0,   IOVT_BOOL,      0 },
+       {"sd_numints",  IOV_NUMINTS,    0, 0,   IOVT_UINT32,    0 },
+       {"sd_numlocalints", IOV_NUMLOCALINTS, 0, 0, IOVT_UINT32,        0 },
+       {"sd_divisor",  IOV_DIVISOR,    0, 0,   IOVT_UINT32,    0 },
+       {"sd_power",    IOV_POWER,      0, 0,   IOVT_UINT32,    0 },
+       {"sd_clock",    IOV_CLOCK,      0, 0,   IOVT_UINT32,    0 },
+       {"sd_mode",     IOV_SDMODE,     0, 0,   IOVT_UINT32,    100},
+       {"sd_highspeed", IOV_HISPEED,   0, 0,   IOVT_UINT32,    0 },
+       {"sd_rxchain",  IOV_RXCHAIN,    0, 0,   IOVT_BOOL,      0 },
+       {NULL, 0, 0, 0, 0, 0 }
+};
+
+int
+sdioh_iovar_op(sdioh_info_t *si, const char *name,
+                           void *params, int plen, void *arg, uint len, bool set)
+{
+       const bcm_iovar_t *vi = NULL;
+       int bcmerror = 0;
+       uint val_size;
+       int32 int_val = 0;
+       bool bool_val;
+       uint32 actionid;
+
+       ASSERT(name);
+
+       /* Get must have return space; Set does not take qualifiers */
+       ASSERT(set || (arg && len));
+       ASSERT(!set || (!params && !plen));
+
+       sd_trace(("%s: Enter (%s %s)\n", __FUNCTION__, (set ? "set" : "get"), name));
+
+       if ((vi = bcm_iovar_lookup(sdioh_iovars, name)) == NULL) {
+               bcmerror = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, set)) != 0)
+               goto exit;
+
+       /* XXX Copied from dhd, copied from wl; certainly overkill here? */
+       /* Set up params so get and set can share the convenience variables */
+       if (params == NULL) {
+               params = arg;
+               plen = len;
+       }
+
+       if (vi->type == IOVT_VOID)
+               val_size = 0;
+       else if (vi->type == IOVT_BUFFER)
+               val_size = len;
+       else
+               val_size = sizeof(int);
+
+       if (plen >= (int)sizeof(int_val))
+               bcopy(params, &int_val, sizeof(int_val));
+
+       bool_val = (int_val != 0) ? TRUE : FALSE;
+       BCM_REFERENCE(bool_val);
+
+       actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+       switch (actionid) {
+       case IOV_GVAL(IOV_MSGLEVEL):
+               int_val = (int32)sd_msglevel;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_MSGLEVEL):
+               sd_msglevel = int_val;
+               break;
+
+       case IOV_GVAL(IOV_BLOCKMODE):
+               int_val = (int32)si->sd_blockmode;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_BLOCKMODE):
+               si->sd_blockmode = (bool)int_val;
+               /* Haven't figured out how to make non-block mode with DMA */
+               break;
+
+       case IOV_GVAL(IOV_BLOCKSIZE):
+               if ((uint32)int_val > si->num_funcs) {
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               int_val = (int32)si->client_block_size[int_val];
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_BLOCKSIZE):
+       {
+               uint func = ((uint32)int_val >> 16);
+               uint blksize = (uint16)int_val;
+               uint maxsize;
+
+               if (func > si->num_funcs) {
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               /* XXX These hardcoded sizes are a hack, remove after proper CIS parsing. */
+               switch (func) {
+               case 0: maxsize = 32; break;
+               case 1: maxsize = BLOCK_SIZE_4318; break;
+               case 2: maxsize = BLOCK_SIZE_4328; break;
+               default: maxsize = 0;
+               }
+               if (blksize > maxsize) {
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               if (!blksize) {
+                       blksize = maxsize;
+               }
+
+               /* Now set it */
+               si->client_block_size[func] = blksize;
+
+#ifdef USE_DYNAMIC_F2_BLKSIZE
+               if (si->func[func] == NULL) {
+                       sd_err(("%s: SDIO Device not present\n", __FUNCTION__));
+                       bcmerror = BCME_NORESOURCE;
+                       break;
+               }
+               sdio_claim_host(si->func[func]);
+               bcmerror = sdio_set_block_size(si->func[func], blksize);
+               if (bcmerror)
+                       sd_err(("%s: Failed to set F%d blocksize to %d(%d)\n",
+                               __FUNCTION__, func, blksize, bcmerror));
+               sdio_release_host(si->func[func]);
+#endif /* USE_DYNAMIC_F2_BLKSIZE */
+               break;
+       }
+
+       case IOV_GVAL(IOV_RXCHAIN):
+               int_val = (int32)si->use_rxchain;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_DMA):
+               int_val = (int32)si->sd_use_dma;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DMA):
+               si->sd_use_dma = (bool)int_val;
+               break;
+
+       case IOV_GVAL(IOV_USEINTS):
+               int_val = (int32)si->use_client_ints;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_USEINTS):
+               si->use_client_ints = (bool)int_val;
+               if (si->use_client_ints)
+                       si->intmask |= CLIENT_INTR;
+               else
+                       si->intmask &= ~CLIENT_INTR;
+
+               break;
+
+       case IOV_GVAL(IOV_DIVISOR):
+               int_val = (uint32)sd_divisor;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DIVISOR):
+               /* set the clock to divisor, if value is non-zero & power of 2 */
+               if (int_val && !(int_val & (int_val - 1))) {
+                       sd_divisor = int_val;
+                       sdmmc_set_clock_divisor(si, sd_divisor);
+               } else {
+                       DHD_ERROR(("%s: Invalid sd_divisor value, should be power of 2!\n",
+                               __FUNCTION__));
+               }
+               break;
+
+       case IOV_GVAL(IOV_POWER):
+               int_val = (uint32)sd_power;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_POWER):
+               sd_power = int_val;
+               break;
+
+       case IOV_GVAL(IOV_CLOCK):
+               int_val = (uint32)sd_clock;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_CLOCK):
+               sd_clock = int_val;
+               break;
+
+       case IOV_GVAL(IOV_SDMODE):
+               int_val = (uint32)sd_sdmode;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_SDMODE):
+               sd_sdmode = int_val;
+               break;
+
+       case IOV_GVAL(IOV_HISPEED):
+               int_val = (uint32)sd_hiok;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_HISPEED):
+               sd_hiok = int_val;
+               break;
+
+       case IOV_GVAL(IOV_NUMINTS):
+               int_val = (int32)si->intrcount;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_NUMLOCALINTS):
+               int_val = (int32)0;
+               bcopy(&int_val, arg, val_size);
+               break;
+       default:
+               bcmerror = BCME_UNSUPPORTED;
+               break;
+       }
+exit:
+
+       /* XXX Remove protective lock after clients all clean... */
+       return bcmerror;
+}
+
+#if (defined(OOB_INTR_ONLY) && defined(HW_OOB)) || defined(FORCE_WOWLAN)
+/*
+ * XXX dhd -i eth0 sd_devreg 0 0xf2 0x3
+ */
+
+#ifdef CUSTOMER_HW_AMLOGIC
+#include <linux/amlogic/aml_gpio_consumer.h>
+extern int wifi_irq_trigger_level(void);
+#endif
+SDIOH_API_RC
+sdioh_enable_hw_oob_intr(sdioh_info_t *sd, bool enable)
+{
+       SDIOH_API_RC status;
+       uint8 data;
+
+       if (enable) {
+               if (wifi_irq_trigger_level() == GPIO_IRQ_LOW)
+                       data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
+               else
+                       data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE | SDIO_SEPINT_ACT_HI;
+       }
+       else
+               data = SDIO_SEPINT_ACT_HI;      /* disable hw oob interrupt */
+
+       status = sdioh_request_byte(sd, SDIOH_WRITE, 0, SDIOD_CCCR_BRCM_SEPINT, &data);
+       return status;
+}
+#endif /* defined(OOB_INTR_ONLY) && defined(HW_OOB) */
+
+extern SDIOH_API_RC
+sdioh_cfg_read(sdioh_info_t *sd, uint fnc_num, uint32 addr, uint8 *data)
+{
+       SDIOH_API_RC status;
+       /* No lock needed since sdioh_request_byte does locking */
+       status = sdioh_request_byte(sd, SDIOH_READ, fnc_num, addr, data);
+       return status;
+}
+
+extern SDIOH_API_RC
+sdioh_cfg_write(sdioh_info_t *sd, uint fnc_num, uint32 addr, uint8 *data)
+{
+       /* No lock needed since sdioh_request_byte does locking */
+       SDIOH_API_RC status;
+       status = sdioh_request_byte(sd, SDIOH_WRITE, fnc_num, addr, data);
+       return status;
+}
+
+static int
+sdioh_sdmmc_get_cisaddr(sdioh_info_t *sd, uint32 regaddr)
+{
+       /* read 24 bits and return valid 17 bit addr */
+       int i;
+       uint32 scratch, regdata;
+       uint8 *ptr = (uint8 *)&scratch;
+       for (i = 0; i < 3; i++) {
+               if ((sdioh_sdmmc_card_regread (sd, 0, regaddr, 1, &regdata)) != SUCCESS)
+                       sd_err(("%s: Can't read!\n", __FUNCTION__));
+
+               *ptr++ = (uint8) regdata;
+               regaddr++;
+       }
+
+       /* Only the lower 17-bits are valid */
+       scratch = ltoh32(scratch);
+       scratch &= 0x0001FFFF;
+       return (scratch);
+}
+
+extern SDIOH_API_RC
+sdioh_cis_read(sdioh_info_t *sd, uint func, uint8 *cisd, uint32 length)
+{
+       uint32 count;
+       int offset;
+       uint32 foo;
+       uint8 *cis = cisd;
+
+       sd_trace(("%s: Func = %d\n", __FUNCTION__, func));
+
+       if (!sd->func_cis_ptr[func]) {
+               bzero(cis, length);
+               sd_err(("%s: no func_cis_ptr[%d]\n", __FUNCTION__, func));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       sd_err(("%s: func_cis_ptr[%d]=0x%04x\n", __FUNCTION__, func, sd->func_cis_ptr[func]));
+
+       for (count = 0; count < length; count++) {
+               offset =  sd->func_cis_ptr[func] + count;
+               if (sdioh_sdmmc_card_regread (sd, 0, offset, 1, &foo) < 0) {
+                       sd_err(("%s: regread failed: Can't read CIS\n", __FUNCTION__));
+                       return SDIOH_API_RC_FAIL;
+               }
+
+               *cis = (uint8)(foo & 0xff);
+               cis++;
+       }
+
+       return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_cisaddr_read(sdioh_info_t *sd, uint func, uint8 *cisd, uint32 offset)
+{
+       uint32 foo;
+
+       sd_trace(("%s: Func = %d\n", __FUNCTION__, func));
+
+       if (!sd->func_cis_ptr[func]) {
+               sd_err(("%s: no func_cis_ptr[%d]\n", __FUNCTION__, func));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       if (sdioh_sdmmc_card_regread (sd, 0, sd->func_cis_ptr[func]+offset, 1, &foo) < 0) {
+               sd_err(("%s: regread failed: Can't read CIS\n", __FUNCTION__));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       *cisd = (uint8)(foo & 0xff);
+
+       return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_request_byte(sdioh_info_t *sd, uint rw, uint func, uint regaddr, uint8 *byte)
+{
+       int err_ret = 0;
+#if defined(MMC_SDIO_ABORT)
+       int sdio_abort_retry = MMC_SDIO_ABORT_RETRY_LIMIT;
+#endif
+       struct osl_timespec now, before;
+
+       if (sd_msglevel & SDH_COST_VAL)
+               osl_do_gettimeofday(&before);
+
+       sd_info(("%s: rw=%d, func=%d, addr=0x%05x\n", __FUNCTION__, rw, func, regaddr));
+
+       DHD_PM_RESUME_WAIT(sdioh_request_byte_wait);
+       DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+       if(rw) { /* CMD52 Write */
+               if (func == 0) {
+                       /* Can only directly write to some F0 registers.  Handle F2 enable
+                        * as a special case.
+                        */
+                       if (regaddr == SDIOD_CCCR_IOEN) {
+#if defined(BT_OVER_SDIO)
+                               do {
+                               if (sd->func[3]) {
+                                       sd_info(("bcmsdh_sdmmc F3: *byte 0x%x\n", *byte));
+
+                                       if (*byte & SDIO_FUNC_ENABLE_3) {
+                                               sdio_claim_host(sd->func[3]);
+
+                                               /* Set Function 3 Block Size */
+                                               err_ret = sdio_set_block_size(sd->func[3],
+                                               sd_f3_blocksize);
+                                               if (err_ret) {
+                                                       sd_err(("F3 blocksize set err%d\n",
+                                                               err_ret));
+                                               }
+
+                                               /* Enable Function 3 */
+                                               sd_info(("bcmsdh_sdmmc F3: enable F3 fn %p\n",
+                                               sd->func[3]));
+                                               err_ret = sdio_enable_func(sd->func[3]);
+                                               if (err_ret) {
+                                                       sd_err(("bcmsdh_sdmmc: enable F3 err:%d\n",
+                                                               err_ret));
+                                               }
+
+                                               sdio_release_host(sd->func[3]);
+
+                                               break;
+                                       } else if (*byte & SDIO_FUNC_DISABLE_3) {
+                                               sdio_claim_host(sd->func[3]);
+
+                                               /* Disable Function 3 */
+                                               sd_info(("bcmsdh_sdmmc F3: disable F3 fn %p\n",
+                                               sd->func[3]));
+                                               err_ret = sdio_disable_func(sd->func[3]);
+                                               if (err_ret) {
+                                                       sd_err(("bcmsdh_sdmmc: Disable F3 err:%d\n",
+                                                               err_ret));
+                                               }
+                                               sdio_release_host(sd->func[3]);
+                                               sd->func[3] = NULL;
+
+                                               break;
+                                       }
+                               }
+#endif /* defined (BT_OVER_SDIO) */
+                               if (sd->func[2]) {
+                                       sdio_claim_host(sd->func[2]);
+                                       if (*byte & SDIO_FUNC_ENABLE_2) {
+                                               /* Enable Function 2 */
+                                               err_ret = sdio_enable_func(sd->func[2]);
+                                               if (err_ret) {
+                                                       sd_err(("bcmsdh_sdmmc: enable F2 failed:%d\n",
+                                                               err_ret));
+                                               }
+                                       } else {
+                                               /* Disable Function 2 */
+                                               err_ret = sdio_disable_func(sd->func[2]);
+                                               if (err_ret) {
+                                                       sd_err(("bcmsdh_sdmmc: Disab F2 failed:%d\n",
+                                                               err_ret));
+                                               }
+                                       }
+                                       sdio_release_host(sd->func[2]);
+                               }
+#if defined(BT_OVER_SDIO)
+                       } while (0);
+#endif /* defined (BT_OVER_SDIO) */
+               }
+#if defined(MMC_SDIO_ABORT)
+                       /* to allow abort command through F1 */
+                       else if (regaddr == SDIOD_CCCR_IOABORT) {
+                               /* XXX Because of SDIO3.0 host issue on Manta,
+                                * sometimes the abort fails.
+                                * Retrying again will fix this issue.
+                                */
+                               while (sdio_abort_retry--) {
+                                       if (sd->func[func]) {
+                                               sdio_claim_host(sd->func[func]);
+                                               /*
+                                                * this sdio_f0_writeb() can be replaced with
+                                                * another api depending upon MMC driver change.
+                                                * As of this time, this is temporaray one
+                                                */
+                                               sdio_writeb(sd->func[func],
+                                                       *byte, regaddr, &err_ret);
+                                               sdio_release_host(sd->func[func]);
+                                       }
+                                       if (!err_ret)
+                                               break;
+                               }
+                       }
+#endif /* MMC_SDIO_ABORT */
+#if defined(SDIO_ISR_THREAD)
+                       else if (regaddr == SDIOD_CCCR_INTR_EXTN) {
+                               while (sdio_abort_retry--) {
+                                       if (sd->func[func]) {
+                                               sdio_claim_host(sd->func[func]);
+                                               /*
+                                                * this sdio_f0_writeb() can be replaced with
+                                                * another api depending upon MMC driver change.
+                                                * As of this time, this is temporaray one
+                                                */
+                                               sdio_writeb(sd->func[func],
+                                                       *byte, regaddr, &err_ret);
+                                               sdio_release_host(sd->func[func]);
+                                       }
+                                       if (!err_ret)
+                                               break;
+                               }
+                       }
+#endif
+                       else if (regaddr < 0xF0) {
+                               sd_err(("bcmsdh_sdmmc: F0 Wr:0x%02x: write disallowed\n", regaddr));
+                       } else {
+                               /* Claim host controller, perform F0 write, and release */
+                               if (sd->func[func]) {
+                                       sdio_claim_host(sd->func[func]);
+                                       sdio_f0_writeb(sd->func[func],
+                                               *byte, regaddr, &err_ret);
+                                       sdio_release_host(sd->func[func]);
+                               }
+                       }
+               } else {
+                       /* Claim host controller, perform Fn write, and release */
+                       if (sd->func[func]) {
+                               sdio_claim_host(sd->func[func]);
+                               sdio_writeb(sd->func[func], *byte, regaddr, &err_ret);
+                               sdio_release_host(sd->func[func]);
+                       }
+               }
+       } else { /* CMD52 Read */
+               /* Claim host controller, perform Fn read, and release */
+               if (sd->func[func]) {
+                       sdio_claim_host(sd->func[func]);
+                       if (func == 0) {
+                               *byte = sdio_f0_readb(sd->func[func], regaddr, &err_ret);
+                       } else {
+                               *byte = sdio_readb(sd->func[func], regaddr, &err_ret);
+                       }
+                       sdio_release_host(sd->func[func]);
+               }
+       }
+
+       if (err_ret) {
+               if ((regaddr == 0x1001F) && ((err_ret == -ETIMEDOUT) || (err_ret == -EILSEQ)
+                       || (err_ret == -EIO))) {
+                       /* XXX: Read/Write to SBSDIO_FUNC1_SLEEPCSR could return -110(timeout)
+                        *      or -84(CRC) error in case the host tries to wake the device up.
+                        *      Skip error log message if err code is -110 or -84 when accessing
+                        *      to SBSDIO_FUNC1_SLEEPCSR to avoid QA misunderstand and DHD shoul
+                        *      print error log message if retry count over the MAX_KSO_ATTEMPTS.
+                        */
+               } else {
+                       sd_err(("bcmsdh_sdmmc: Failed to %s byte F%d:@0x%05x=%02x, Err: %d\n",
+                               rw ? "Write" : "Read", func, regaddr, *byte, err_ret));
+               }
+       }
+
+       if (sd_msglevel & SDH_COST_VAL) {
+               osl_do_gettimeofday(&now);
+               sd_cost(("%s: rw=%d len=1 cost=%lds %luus\n", __FUNCTION__,
+                       rw, now.tv_sec-before.tv_sec, now.tv_nsec/1000-before.tv_nsec/1000));
+       }
+
+       return ((err_ret == 0) ? SDIOH_API_RC_SUCCESS : SDIOH_API_RC_FAIL);
+}
+
+uint
+sdioh_set_mode(sdioh_info_t *sd, uint mode)
+{
+       if (mode == SDPCM_TXGLOM_CPY)
+               sd->txglom_mode = mode;
+       else if (mode == SDPCM_TXGLOM_MDESC)
+               sd->txglom_mode = mode;
+
+       return (sd->txglom_mode);
+}
+
+#ifdef PKT_STATICS
+uint32
+sdioh_get_spend_time(sdioh_info_t *sd)
+{
+       return (sd->sdio_spent_time_us);
+}
+#endif
+
+extern SDIOH_API_RC
+sdioh_request_word(sdioh_info_t *sd, uint cmd_type, uint rw, uint func, uint addr,
+                                   uint32 *word, uint nbytes)
+{
+       int err_ret = SDIOH_API_RC_FAIL;
+       int err_ret2 = SDIOH_API_RC_SUCCESS; // terence 20130621: prevent dhd_dpc in dead lock
+#if defined(MMC_SDIO_ABORT)
+       int sdio_abort_retry = MMC_SDIO_ABORT_RETRY_LIMIT;
+#endif
+       struct osl_timespec now, before;
+
+       if (sd_msglevel & SDH_COST_VAL)
+               osl_do_gettimeofday(&before);
+
+       if (func == 0) {
+               sd_err(("%s: Only CMD52 allowed to F0.\n", __FUNCTION__));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       sd_info(("%s: cmd_type=%d, rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
+                __FUNCTION__, cmd_type, rw, func, addr, nbytes));
+
+       DHD_PM_RESUME_WAIT(sdioh_request_word_wait);
+       DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+       /* Claim host controller */
+       sdio_claim_host(sd->func[func]);
+
+       if(rw) { /* CMD52 Write */
+               if (nbytes == 4) {
+                       sdio_writel(sd->func[func], *word, addr, &err_ret);
+               } else if (nbytes == 2) {
+                       sdio_writew(sd->func[func], (*word & 0xFFFF), addr, &err_ret);
+               } else {
+                       sd_err(("%s: Invalid nbytes: %d\n", __FUNCTION__, nbytes));
+               }
+       } else { /* CMD52 Read */
+               if (nbytes == 4) {
+                       *word = sdio_readl(sd->func[func], addr, &err_ret);
+               } else if (nbytes == 2) {
+                       *word = sdio_readw(sd->func[func], addr, &err_ret) & 0xFFFF;
+               } else {
+                       sd_err(("%s: Invalid nbytes: %d\n", __FUNCTION__, nbytes));
+               }
+       }
+
+       /* Release host controller */
+       sdio_release_host(sd->func[func]);
+
+       if (err_ret) {
+#if defined(MMC_SDIO_ABORT)
+               /* Any error on CMD53 transaction should abort that function using function 0. */
+               while (sdio_abort_retry--) {
+                       if (sd->func[0]) {
+                               sdio_claim_host(sd->func[0]);
+                               /*
+                                * this sdio_f0_writeb() can be replaced with another api
+                                * depending upon MMC driver change.
+                                * As of this time, this is temporaray one
+                                */
+                               sdio_writeb(sd->func[0],
+                                       func, SDIOD_CCCR_IOABORT, &err_ret2);
+                               sdio_release_host(sd->func[0]);
+                       }
+                       if (!err_ret2)
+                               break;
+               }
+               if (err_ret)
+#endif /* MMC_SDIO_ABORT */
+               {
+                       sd_err(("bcmsdh_sdmmc: Failed to %s word F%d:@0x%05x=%02x, Err: 0x%08x\n",
+                               rw ? "Write" : "Read", func, addr, *word, err_ret));
+               }
+       }
+
+       if (sd_msglevel & SDH_COST_VAL) {
+               osl_do_gettimeofday(&now);
+               sd_cost(("%s: rw=%d, len=%d cost=%lds %luus\n", __FUNCTION__,
+                       rw, nbytes, now.tv_sec-before.tv_sec, now.tv_nsec/1000 - before.tv_nsec/1000));
+       }
+
+       return (((err_ret == 0)&&(err_ret2 == 0)) ? SDIOH_API_RC_SUCCESS : SDIOH_API_RC_FAIL);
+}
+
+#ifdef BCMSDIOH_TXGLOM
+static SDIOH_API_RC
+sdioh_request_packet_chain(sdioh_info_t *sd, uint fix_inc, uint write, uint func,
+                     uint addr, void *pkt)
+{
+       bool fifo = (fix_inc == SDIOH_DATA_FIX);
+       int err_ret = 0;
+       void *pnext;
+       uint ttl_len, pkt_offset;
+       uint blk_num;
+       uint blk_size;
+       uint max_blk_count;
+       uint max_req_size;
+       struct mmc_request mmc_req;
+       struct mmc_command mmc_cmd;
+       struct mmc_data mmc_dat;
+       uint32 sg_count;
+       struct sdio_func *sdio_func = sd->func[func];
+       struct mmc_host *host = sdio_func->card->host;
+       uint8 *localbuf = NULL;
+       uint local_plen = 0;
+       uint pkt_len = 0;
+       struct osl_timespec now, before;
+
+       sd_trace(("%s: Enter\n", __FUNCTION__));
+       ASSERT(pkt);
+       DHD_PM_RESUME_WAIT(sdioh_request_packet_wait);
+       DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+
+#ifndef PKT_STATICS
+       if (sd_msglevel & SDH_COST_VAL)
+#endif
+               osl_do_gettimeofday(&before);
+
+       blk_size = sd->client_block_size[func];
+       max_blk_count = min(host->max_blk_count, (uint)MAX_IO_RW_EXTENDED_BLK);
+       max_req_size = min(max_blk_count * blk_size, host->max_req_size);
+
+       pkt_offset = 0;
+       pnext = pkt;
+
+       ttl_len = 0;
+       sg_count = 0;
+       if(sd->txglom_mode == SDPCM_TXGLOM_MDESC) {
+       while (pnext != NULL) {
+               ttl_len = 0;
+               sg_count = 0;
+               memset(&mmc_req, 0, sizeof(struct mmc_request));
+               memset(&mmc_cmd, 0, sizeof(struct mmc_command));
+               memset(&mmc_dat, 0, sizeof(struct mmc_data));
+               sg_init_table(sd->sg_list, ARRAYSIZE(sd->sg_list));
+
+               /* Set up scatter-gather DMA descriptors. this loop is to find out the max
+                * data we can transfer with one command 53. blocks per command is limited by
+                * host max_req_size and 9-bit max block number. when the total length of this
+                * packet chain is bigger than max_req_size, use multiple SD_IO_RW_EXTENDED
+                * commands (each transfer is still block aligned)
+                */
+               while (pnext != NULL && ttl_len < max_req_size) {
+                       int pkt_len;
+                       int sg_data_size;
+                       uint8 *pdata = (uint8*)PKTDATA(sd->osh, pnext);
+
+                       ASSERT(pdata != NULL);
+                       pkt_len = PKTLEN(sd->osh, pnext);
+                       sd_trace(("%s[%d] data=%p, len=%d\n", __FUNCTION__, write, pdata, pkt_len));
+                       /* sg_count is unlikely larger than the array size, and this is
+                        * NOT something we can handle here, but in case it happens, PLEASE put
+                        * a restriction on max tx/glom count (based on host->max_segs).
+                        */
+                       if (sg_count >= ARRAYSIZE(sd->sg_list)) {
+                               sd_err(("%s: sg list entries(%u) exceed limit(%zu),"
+                                       " sd blk_size=%u\n",
+                                       __FUNCTION__, sg_count, (size_t)ARRAYSIZE(sd->sg_list), blk_size));
+                               return (SDIOH_API_RC_FAIL);
+                       }
+                       pdata += pkt_offset;
+
+                       sg_data_size = pkt_len - pkt_offset;
+                       if (sg_data_size > max_req_size - ttl_len)
+                               sg_data_size = max_req_size - ttl_len;
+                       /* some platforms put a restriction on the data size of each scatter-gather
+                        * DMA descriptor, use multiple sg buffers when xfer_size is bigger than
+                        * max_seg_size
+                        */
+                       if (sg_data_size > host->max_seg_size) {
+                               sg_data_size = host->max_seg_size;
+                       }
+                       sg_set_buf(&sd->sg_list[sg_count++], pdata, sg_data_size);
+
+                       ttl_len += sg_data_size;
+                       pkt_offset += sg_data_size;
+                       if (pkt_offset == pkt_len) {
+                               pnext = PKTNEXT(sd->osh, pnext);
+                               pkt_offset = 0;
+                       }
+               }
+
+               if (ttl_len % blk_size != 0) {
+                       sd_err(("%s, data length %d not aligned to block size %d\n",
+                               __FUNCTION__,  ttl_len, blk_size));
+                       return SDIOH_API_RC_FAIL;
+               }
+               blk_num = ttl_len / blk_size;
+               mmc_dat.sg = sd->sg_list;
+               mmc_dat.sg_len = sg_count;
+               mmc_dat.blksz = blk_size;
+               mmc_dat.blocks = blk_num;
+               mmc_dat.flags = write ? MMC_DATA_WRITE : MMC_DATA_READ;
+               mmc_cmd.opcode = 53; /* SD_IO_RW_EXTENDED */
+               mmc_cmd.arg = write ? 1<<31 : 0;
+               mmc_cmd.arg |= (func & 0x7) << 28;
+               mmc_cmd.arg |= 1<<27;
+               mmc_cmd.arg |= fifo ? 0 : 1<<26;
+               mmc_cmd.arg |= (addr & 0x1FFFF) << 9;
+               mmc_cmd.arg |= blk_num & 0x1FF;
+               mmc_cmd.flags = MMC_RSP_SPI_R5 | MMC_RSP_R5 | MMC_CMD_ADTC;
+               mmc_req.cmd = &mmc_cmd;
+               mmc_req.data = &mmc_dat;
+               if (!fifo)
+                       addr += ttl_len;
+
+               sdio_claim_host(sdio_func);
+               mmc_set_data_timeout(&mmc_dat, sdio_func->card);
+               mmc_wait_for_req(host, &mmc_req);
+               sdio_release_host(sdio_func);
+
+               err_ret = mmc_cmd.error? mmc_cmd.error : mmc_dat.error;
+               if (0 != err_ret) {
+                       sd_err(("%s:CMD53 %s failed with code %d\n",
+                               __FUNCTION__, write ? "write" : "read", err_ret));
+                       return SDIOH_API_RC_FAIL;
+               }
+       }
+       } else if(sd->txglom_mode == SDPCM_TXGLOM_CPY) {
+               for (pnext = pkt; pnext; pnext = PKTNEXT(sd->osh, pnext)) {
+                       ttl_len += PKTLEN(sd->osh, pnext);
+               }
+               /* Claim host controller */
+               sdio_claim_host(sd->func[func]);
+               for (pnext = pkt; pnext; pnext = PKTNEXT(sd->osh, pnext)) {
+                       uint8 *buf = (uint8*)PKTDATA(sd->osh, pnext);
+                       pkt_len = PKTLEN(sd->osh, pnext);
+
+                       if (!localbuf) {
+                               localbuf = (uint8 *)MALLOC(sd->osh, ttl_len);
+                               if (localbuf == NULL) {
+                                       sd_err(("%s: %s TXGLOM: localbuf malloc FAILED\n",
+                                               __FUNCTION__, (write) ? "TX" : "RX"));
+                                       goto txglomfail;
+                               }
+                       }
+
+                       bcopy(buf, (localbuf + local_plen), pkt_len);
+                       local_plen += pkt_len;
+                       if (PKTNEXT(sd->osh, pnext))
+                               continue;
+
+                       buf = localbuf;
+                       pkt_len = local_plen;
+txglomfail:
+                       /* Align Patch */
+                       if (!write || pkt_len < 32)
+                               pkt_len = (pkt_len + 3) & 0xFFFFFFFC;
+                       else if (pkt_len % blk_size)
+                               pkt_len += blk_size - (pkt_len % blk_size);
+
+                       if ((write) && (!fifo))
+                               err_ret = sdio_memcpy_toio(sd->func[func], addr, buf, pkt_len);
+                       else if (write)
+                               err_ret = sdio_memcpy_toio(sd->func[func], addr, buf, pkt_len);
+                       else if (fifo)
+                               err_ret = sdio_readsb(sd->func[func], buf, addr, pkt_len);
+                       else
+                               err_ret = sdio_memcpy_fromio(sd->func[func], buf, addr, pkt_len);
+
+                       if (err_ret)
+                               sd_err(("%s: %s FAILED %p[%d], addr=0x%05x, pkt_len=%d, ERR=%d\n",
+                                      __FUNCTION__,
+                                      (write) ? "TX" : "RX",
+                                      pnext, sg_count, addr, pkt_len, err_ret));
+                       else
+                               sd_trace(("%s: %s xfr'd %p[%d], addr=0x%05x, len=%d\n",
+                                       __FUNCTION__,
+                                       (write) ? "TX" : "RX",
+                                       pnext, sg_count, addr, pkt_len));
+
+                       if (!fifo)
+                               addr += pkt_len;
+                       sg_count ++;
+               }
+               sdio_release_host(sd->func[func]);
+       } else {
+               sd_err(("%s: set to wrong glom mode %d\n", __FUNCTION__, sd->txglom_mode));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       if (localbuf)
+               MFREE(sd->osh, localbuf, ttl_len);
+
+#ifndef PKT_STATICS
+       if (sd_msglevel & SDH_COST_VAL)
+#endif
+       {
+               osl_do_gettimeofday(&now);
+               sd_cost(("%s: rw=%d, ttl_len=%d, cost=%lds %luus\n", __FUNCTION__,
+                       write, ttl_len, now.tv_sec-before.tv_sec, now.tv_nsec/1000-before.tv_nsec/1000));
+       }
+
+#ifdef PKT_STATICS
+       if (write && (func == 2))
+               sd->sdio_spent_time_us = osl_do_gettimediff(&now, &before);
+#endif
+
+       sd_trace(("%s: Exit\n", __FUNCTION__));
+       return SDIOH_API_RC_SUCCESS;
+}
+#endif /* BCMSDIOH_TXGLOM */
+
+static SDIOH_API_RC
+sdioh_buffer_tofrom_bus(sdioh_info_t *sd, uint fix_inc, uint write, uint func,
+                     uint addr, uint8 *buf, uint len)
+{
+       bool fifo = (fix_inc == SDIOH_DATA_FIX);
+       int err_ret = 0;
+       struct osl_timespec now, before;
+
+       sd_trace(("%s: Enter\n", __FUNCTION__));
+       ASSERT(buf);
+
+       if (sd_msglevel & SDH_COST_VAL)
+               osl_do_gettimeofday(&before);
+
+       /* NOTE:
+        * For all writes, each packet length is aligned to 32 (or 4)
+        * bytes in dhdsdio_txpkt_preprocess, and for glom the last packet length
+        * is aligned to block boundary. If you want to align each packet to
+        * a custom size, please do it in dhdsdio_txpkt_preprocess, NOT here
+        *
+        * For reads, the alignment is doen in sdioh_request_buffer.
+        *
+        */
+       sdio_claim_host(sd->func[func]);
+
+       if ((write) && (!fifo))
+               err_ret = sdio_memcpy_toio(sd->func[func], addr, buf, len);
+       else if (write)
+               err_ret = sdio_memcpy_toio(sd->func[func], addr, buf, len);
+       else if (fifo)
+               err_ret = sdio_readsb(sd->func[func], buf, addr, len);
+       else
+               err_ret = sdio_memcpy_fromio(sd->func[func], buf, addr, len);
+
+       sdio_release_host(sd->func[func]);
+
+       if (err_ret)
+               sd_err(("%s: %s FAILED %p, addr=0x%05x, pkt_len=%d, ERR=%d\n", __FUNCTION__,
+                      (write) ? "TX" : "RX", buf, addr, len, err_ret));
+       else
+               sd_trace(("%s: %s xfr'd %p, addr=0x%05x, len=%d\n", __FUNCTION__,
+                       (write) ? "TX" : "RX", buf, addr, len));
+
+       sd_trace(("%s: Exit\n", __FUNCTION__));
+
+       if (sd_msglevel & SDH_COST_VAL) {
+               osl_do_gettimeofday(&now);
+               sd_cost(("%s: rw=%d, len=%d cost=%lds %luus\n", __FUNCTION__,
+                       write, len, now.tv_sec-before.tv_sec, now.tv_nsec/1000 - before.tv_nsec/1000));
+       }
+
+       return ((err_ret == 0) ? SDIOH_API_RC_SUCCESS : SDIOH_API_RC_FAIL);
+}
+
+/*
+ * This function takes a buffer or packet, and fixes everything up so that in the
+ * end, a DMA-able packet is created.
+ *
+ * A buffer does not have an associated packet pointer, and may or may not be aligned.
+ * A packet may consist of a single packet, or a packet chain.  If it is a packet chain,
+ * then all the packets in the chain must be properly aligned.  If the packet data is not
+ * aligned, then there may only be one packet, and in this case, it is copied to a new
+ * aligned packet.
+ *
+ */
+extern SDIOH_API_RC
+sdioh_request_buffer(sdioh_info_t *sd, uint pio_dma, uint fix_inc, uint write, uint func,
+       uint addr, uint reg_width, uint buf_len, uint8 *buffer, void *pkt)
+{
+       SDIOH_API_RC status;
+       void *tmppkt;
+       int is_vmalloc = FALSE;
+       struct osl_timespec now, before;
+
+       sd_trace(("%s: Enter\n", __FUNCTION__));
+       DHD_PM_RESUME_WAIT(sdioh_request_buffer_wait);
+       DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+
+       if (sd_msglevel & SDH_COST_VAL)
+               osl_do_gettimeofday(&before);
+
+       if (pkt) {
+#ifdef BCMSDIOH_TXGLOM
+               /* packet chain, only used for tx/rx glom, all packets length
+                * are aligned, total length is a block multiple
+                */
+               if (PKTNEXT(sd->osh, pkt))
+                       return sdioh_request_packet_chain(sd, fix_inc, write, func, addr, pkt);
+#endif /* BCMSDIOH_TXGLOM */
+               /* non-glom mode, ignore the buffer parameter and use the packet pointer
+                * (this shouldn't happen)
+                */
+               buffer = PKTDATA(sd->osh, pkt);
+               buf_len = PKTLEN(sd->osh, pkt);
+       }
+
+       ASSERT(buffer);
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 24)
+       is_vmalloc = is_vmalloc_addr(buffer);
+#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 24) */
+
+       /* buffer and length are aligned, use it directly so we can avoid memory copy */
+       if ((((ulong)buffer & DMA_ALIGN_MASK) == 0) && ((buf_len & DMA_ALIGN_MASK) == 0) &&
+                       (!is_vmalloc)) {
+               return sdioh_buffer_tofrom_bus(sd, fix_inc, write, func, addr, buffer, buf_len);
+       }
+
+       if (is_vmalloc) {
+               sd_trace(("%s: Need to memory copy due to virtual memory address.\n",
+                       __FUNCTION__));
+       }
+
+       sd_trace(("%s: [%d] doing memory copy buf=%p, len=%d\n",
+               __FUNCTION__, write, buffer, buf_len));
+
+       /* otherwise, a memory copy is needed as the input buffer is not aligned */
+       tmppkt = PKTGET_STATIC(sd->osh, buf_len + DEFAULT_SDIO_F2_BLKSIZE, write ? TRUE : FALSE);
+       if (tmppkt == NULL) {
+               sd_err(("%s: PKTGET failed: len %d\n", __FUNCTION__, buf_len));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       if (write)
+               bcopy(buffer, PKTDATA(sd->osh, tmppkt), buf_len);
+
+       status = sdioh_buffer_tofrom_bus(sd, fix_inc, write, func, addr,
+               PKTDATA(sd->osh, tmppkt), ROUNDUP(buf_len, (DMA_ALIGN_MASK+1)));
+
+       if (!write)
+               bcopy(PKTDATA(sd->osh, tmppkt), buffer, buf_len);
+
+       PKTFREE_STATIC(sd->osh, tmppkt, write ? TRUE : FALSE);
+
+       if (sd_msglevel & SDH_COST_VAL) {
+               osl_do_gettimeofday(&now);
+               sd_cost(("%s: len=%d cost=%lds %luus\n", __FUNCTION__,
+                       buf_len, now.tv_sec-before.tv_sec, now.tv_nsec/1000 - before.tv_nsec/1000));
+       }
+
+       return status;
+}
+
+/* this function performs "abort" for both of host & device */
+extern int
+sdioh_abort(sdioh_info_t *sd, uint func)
+{
+#if defined(MMC_SDIO_ABORT)
+       char t_func = (char) func;
+#endif /* defined(MMC_SDIO_ABORT) */
+       sd_trace(("%s: Enter\n", __FUNCTION__));
+
+       /* XXX Standard Linux SDIO Stack cannot perform an abort. */
+#if defined(MMC_SDIO_ABORT)
+       /* issue abort cmd52 command through F1 */
+       sdioh_request_byte(sd, SD_IO_OP_WRITE, SDIO_FUNC_0, SDIOD_CCCR_IOABORT, &t_func);
+#endif /* defined(MMC_SDIO_ABORT) */
+
+       sd_trace(("%s: Exit\n", __FUNCTION__));
+       return SDIOH_API_RC_SUCCESS;
+}
+
+/* Reset and re-initialize the device */
+int sdioh_sdio_reset(sdioh_info_t *si)
+{
+       sd_trace(("%s: Enter\n", __FUNCTION__));
+       sd_trace(("%s: Exit\n", __FUNCTION__));
+       return SDIOH_API_RC_SUCCESS;
+}
+
+/* Disable device interrupt */
+void
+sdioh_sdmmc_devintr_off(sdioh_info_t *sd)
+{
+       sd_trace(("%s: %d\n", __FUNCTION__, sd->use_client_ints));
+       sd->intmask &= ~CLIENT_INTR;
+}
+
+/* Enable device interrupt */
+void
+sdioh_sdmmc_devintr_on(sdioh_info_t *sd)
+{
+       sd_trace(("%s: %d\n", __FUNCTION__, sd->use_client_ints));
+       sd->intmask |= CLIENT_INTR;
+}
+
+/* Read client card reg */
+int
+sdioh_sdmmc_card_regread(sdioh_info_t *sd, int func, uint32 regaddr, int regsize, uint32 *data)
+{
+
+       if ((func == 0) || (regsize == 1)) {
+               uint8 temp = 0;
+
+               sdioh_request_byte(sd, SDIOH_READ, func, regaddr, &temp);
+               *data = temp;
+               *data &= 0xff;
+               sd_data(("%s: byte read data=0x%02x\n",
+                        __FUNCTION__, *data));
+       } else {
+               if (sdioh_request_word(sd, 0, SDIOH_READ, func, regaddr, data, regsize)) {
+                       return BCME_SDIO_ERROR;
+               }
+               if (regsize == 2)
+                       *data &= 0xffff;
+
+               sd_data(("%s: word read data=0x%08x\n",
+                        __FUNCTION__, *data));
+       }
+
+       return SUCCESS;
+}
+
+#if !defined(OOB_INTR_ONLY)
+/* bcmsdh_sdmmc interrupt handler */
+static void IRQHandler(struct sdio_func *func)
+{
+       sdioh_info_t *sd;
+
+       sd = sdio_get_drvdata(func);
+
+       ASSERT(sd != NULL);
+       sdio_release_host(sd->func[0]);
+
+       if (sd->use_client_ints) {
+               sd->intrcount++;
+               ASSERT(sd->intr_handler);
+               ASSERT(sd->intr_handler_arg);
+               (sd->intr_handler)(sd->intr_handler_arg);
+       } else { /* XXX - Do not remove these sd_err messages.  Need to figure
+                                 out how to keep interrupts disabled until DHD registers
+                                 a handler.
+                         */
+               sd_err(("bcmsdh_sdmmc: ***IRQHandler\n"));
+
+               sd_err(("%s: Not ready for intr: enabled %d, handler %p\n",
+                       __FUNCTION__, sd->client_intr_enabled, sd->intr_handler));
+       }
+
+       sdio_claim_host(sd->func[0]);
+}
+
+/* bcmsdh_sdmmc interrupt handler for F2 (dummy handler) */
+static void IRQHandlerF2(struct sdio_func *func)
+{
+       sd_trace(("bcmsdh_sdmmc: ***IRQHandlerF2\n"));
+}
+#endif /* !defined(OOB_INTR_ONLY) */
+
+#ifdef NOTUSED
+/* Write client card reg */
+static int
+sdioh_sdmmc_card_regwrite(sdioh_info_t *sd, int func, uint32 regaddr, int regsize, uint32 data)
+{
+
+       if ((func == 0) || (regsize == 1)) {
+               uint8 temp;
+
+               temp = data & 0xff;
+               sdioh_request_byte(sd, SDIOH_READ, func, regaddr, &temp);
+               sd_data(("%s: byte write data=0x%02x\n",
+                        __FUNCTION__, data));
+       } else {
+               if (regsize == 2)
+                       data &= 0xffff;
+
+               sdioh_request_word(sd, 0, SDIOH_READ, func, regaddr, &data, regsize);
+
+               sd_data(("%s: word write data=0x%08x\n",
+                        __FUNCTION__, data));
+       }
+
+       return SUCCESS;
+}
+#endif /* NOTUSED */
+
+int
+sdioh_start(sdioh_info_t *sd, int stage)
+{
+       int ret;
+
+       if (!sd) {
+               sd_err(("%s Failed, sd is NULL\n", __FUNCTION__));
+               return (0);
+       }
+
+       /* Need to do this stages as we can't enable the interrupt till
+               downloading of the firmware is complete, other wise polling
+               sdio access will come in way
+       */
+       if (sd->func[0]) {
+                       if (stage == 0) {
+               /* Since the power to the chip is killed, we will have
+                       re enumerate the device again. Set the block size
+                       and enable the fucntion 1 for in preparation for
+                       downloading the code
+               */
+               /* sdio_reset_comm() - has been fixed in latest kernel/msm.git for Linux
+                  2.6.27. The implementation prior to that is buggy, and needs broadcom's
+                  patch for it
+               */
+#if defined(ENABLE_INSMOD_NO_FW_LOAD) && !defined(BUS_POWER_RESTORE)
+               if ((ret = sdio_reset_comm(sd->func[0]->card))) {
+                       sd_err(("%s Failed, error = %d\n", __FUNCTION__, ret));
+                       return ret;
+               } else
+#endif
+               {
+                       sd->num_funcs = 2;
+                       sd->sd_blockmode = TRUE;
+                       sd->use_client_ints = TRUE;
+                       sd->client_block_size[0] = 64;
+
+                       if (sd->func[1]) {
+                               /* Claim host controller */
+                               sdio_claim_host(sd->func[1]);
+
+                               sd->client_block_size[1] = 64;
+                               ret = sdio_set_block_size(sd->func[1], 64);
+                               if (ret) {
+                                       sd_err(("bcmsdh_sdmmc: Failed to set F1 "
+                                               "blocksize(%d)\n", ret));
+                               }
+
+                               /* Release host controller F1 */
+                               sdio_release_host(sd->func[1]);
+                       }
+
+                       if (sd->func[2]) {
+                               /* Claim host controller F2 */
+                               sdio_claim_host(sd->func[2]);
+
+                               sd->client_block_size[2] = sd_f2_blocksize;
+                               printf("%s: set sd_f2_blocksize %d\n", __FUNCTION__, sd_f2_blocksize);
+                               ret = sdio_set_block_size(sd->func[2], sd_f2_blocksize);
+                               if (ret) {
+                                       sd_err(("bcmsdh_sdmmc: Failed to set F2 "
+                                               "blocksize to %d(%d)\n", sd_f2_blocksize, ret));
+                               }
+
+                               /* Release host controller F2 */
+                               sdio_release_host(sd->func[2]);
+                       }
+
+                       sdioh_sdmmc_card_enablefuncs(sd);
+                       }
+               } else {
+#if !defined(OOB_INTR_ONLY)
+                       sdio_claim_host(sd->func[0]);
+                       if (sd->func[2])
+                               sdio_claim_irq(sd->func[2], IRQHandlerF2);
+                       if (sd->func[1])
+                               sdio_claim_irq(sd->func[1], IRQHandler);
+                       sdio_release_host(sd->func[0]);
+#else /* defined(OOB_INTR_ONLY) */
+#if defined(HW_OOB)
+                       sdioh_enable_func_intr(sd);
+#endif
+                       bcmsdh_oob_intr_set(sd->bcmsdh, TRUE);
+#endif /* !defined(OOB_INTR_ONLY) */
+               }
+       }
+       else
+               sd_err(("%s Failed\n", __FUNCTION__));
+
+       return (0);
+}
+
+int
+sdioh_stop(sdioh_info_t *sd)
+{
+       /* MSM7201A Android sdio stack has bug with interrupt
+               So internaly within SDIO stack they are polling
+               which cause issue when device is turned off. So
+               unregister interrupt with SDIO stack to stop the
+               polling
+       */
+       if (sd->func[0]) {
+#if !defined(OOB_INTR_ONLY)
+               sdio_claim_host(sd->func[0]);
+               if (sd->func[1])
+                       sdio_release_irq(sd->func[1]);
+               if (sd->func[2])
+                       sdio_release_irq(sd->func[2]);
+               sdio_release_host(sd->func[0]);
+#else /* defined(OOB_INTR_ONLY) */
+#if defined(HW_OOB)
+               sdioh_disable_func_intr(sd);
+#endif
+               bcmsdh_oob_intr_set(sd->bcmsdh, FALSE);
+#endif /* !defined(OOB_INTR_ONLY) */
+       }
+       else
+               sd_err(("%s Failed\n", __FUNCTION__));
+       return (0);
+}
+
+int
+sdioh_waitlockfree(sdioh_info_t *sd)
+{
+       return (1);
+}
+
+SDIOH_API_RC
+sdioh_gpioouten(sdioh_info_t *sd, uint32 gpio)
+{
+       return SDIOH_API_RC_FAIL;
+}
+
+SDIOH_API_RC
+sdioh_gpioout(sdioh_info_t *sd, uint32 gpio, bool enab)
+{
+       return SDIOH_API_RC_FAIL;
+}
+
+bool
+sdioh_gpioin(sdioh_info_t *sd, uint32 gpio)
+{
+       return FALSE;
+}
+
+SDIOH_API_RC
+sdioh_gpio_init(sdioh_info_t *sd)
+{
+       return SDIOH_API_RC_FAIL;
+}
+
+uint
+sdmmc_get_clock_rate(sdioh_info_t *sd)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)) || (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0))
+       return 0;
+#else
+       struct sdio_func *sdio_func = sd->func[0];
+       struct mmc_host *host = sdio_func->card->host;
+       return mmc_host_clk_rate(host);
+#endif
+}
+
+void
+sdmmc_set_clock_rate(sdioh_info_t *sd, uint hz)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)) || (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0))
+       return;
+#else
+       struct sdio_func *sdio_func = sd->func[0];
+       struct mmc_host *host = sdio_func->card->host;
+       struct mmc_ios *ios = &host->ios;
+
+       mmc_host_clk_hold(host);
+       DHD_INFO(("%s: Before change: sd clock rate is %u\n", __FUNCTION__, ios->clock));
+       if (hz < host->f_min) {
+               DHD_ERROR(("%s: Intended rate is below min rate, setting to min\n", __FUNCTION__));
+               hz = host->f_min;
+       }
+
+       if (hz > host->f_max) {
+               DHD_ERROR(("%s: Intended rate exceeds max rate, setting to max\n", __FUNCTION__));
+               hz = host->f_max;
+       }
+       ios->clock = hz;
+       host->ops->set_ios(host, ios);
+       DHD_ERROR(("%s: After change: sd clock rate is %u\n", __FUNCTION__, ios->clock));
+       mmc_host_clk_release(host);
+#endif
+}
+
+void
+sdmmc_set_clock_divisor(sdioh_info_t *sd, uint sd_div)
+{
+       uint hz;
+       uint old_div = sdmmc_get_clock_rate(sd);
+       if (old_div == sd_div) {
+               return;
+       }
+
+       hz = sd->sd_clk_rate / sd_div;
+       sdmmc_set_clock_rate(sd, hz);
+}
diff --git a/bcmdhd.101.10.240.x/bcmsdh_sdmmc_linux.c b/bcmdhd.101.10.240.x/bcmsdh_sdmmc_linux.c
new file mode 100644 (file)
index 0000000..c8388f8
--- /dev/null
@@ -0,0 +1,386 @@
+/*
+ * BCMSDH Function Driver for the native SDIO/MMC driver in the Linux Kernel
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <sdio.h>      /* SDIO Device and Protocol Specs */
+#include <bcmsdbus.h>  /* bcmsdh to/from specific controller APIs */
+#include <sdiovar.h>   /* to get msglevel bit values */
+
+#include <linux/sched.h>       /* request_irq() */
+
+#include <linux/mmc/core.h>
+#include <linux/mmc/card.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
+#include <dhd_linux.h>
+#include <bcmsdh_sdmmc.h>
+#include <dhd_dbg.h>
+#include <bcmdevs.h>
+
+#if !defined(SDIO_VENDOR_ID_BROADCOM)
+#define SDIO_VENDOR_ID_BROADCOM                0x02d0
+#endif /* !defined(SDIO_VENDOR_ID_BROADCOM) */
+
+#define SDIO_DEVICE_ID_BROADCOM_DEFAULT        0x0000
+
+extern void wl_cfg80211_set_parent_dev(void *dev);
+extern void sdioh_sdmmc_devintr_off(sdioh_info_t *sd);
+extern void sdioh_sdmmc_devintr_on(sdioh_info_t *sd);
+extern void* bcmsdh_probe(osl_t *osh, void *dev, void *sdioh, void *adapter_info, uint bus_type,
+       uint bus_num, uint slot_num);
+extern int bcmsdh_remove(bcmsdh_info_t *bcmsdh);
+
+int sdio_function_init(void);
+void sdio_function_cleanup(void);
+
+#define DESCRIPTION "bcmsdh_sdmmc Driver"
+#define AUTHOR "Broadcom Corporation"
+
+/* module param defaults */
+static int clockoverride = 0;
+
+module_param(clockoverride, int, 0644);
+MODULE_PARM_DESC(clockoverride, "SDIO card clock override");
+
+#ifdef GLOBAL_SDMMC_INSTANCE
+PBCMSDH_SDMMC_INSTANCE gInstance;
+#endif
+
+/* Maximum number of bcmsdh_sdmmc devices supported by driver */
+#define BCMSDH_SDMMC_MAX_DEVICES 1
+
+extern volatile bool dhd_mmc_suspend;
+
+static int sdioh_probe(struct sdio_func *func)
+{
+       int host_idx = func->card->host->index;
+       uint32 rca = func->card->rca;
+       wifi_adapter_info_t *adapter;
+       osl_t *osh = NULL;
+       sdioh_info_t *sdioh = NULL;
+
+       sd_err(("bus num (host idx)=%d, slot num (rca)=%d\n", host_idx, rca));
+       adapter = dhd_wifi_platform_get_adapter(SDIO_BUS, host_idx, rca);
+       if (adapter != NULL) {
+               sd_err(("found adapter info '%s'\n", adapter->name));
+#ifdef BUS_POWER_RESTORE
+               adapter->sdio_func = func;
+#endif
+       } else
+               sd_err(("can't find adapter info for this chip\n"));
+
+#ifdef WL_CFG80211
+       wl_cfg80211_set_parent_dev(&func->dev);
+#endif
+
+        /* allocate SDIO Host Controller state info */
+        osh = osl_attach(&func->dev, SDIO_BUS, TRUE);
+        if (osh == NULL) {
+                sd_err(("%s: osl_attach failed\n", __FUNCTION__));
+                goto fail;
+        }
+        osl_static_mem_init(osh, adapter);
+        sdioh = sdioh_attach(osh, func);
+        if (sdioh == NULL) {
+                sd_err(("%s: sdioh_attach failed\n", __FUNCTION__));
+                goto fail;
+        }
+        sdioh->bcmsdh = bcmsdh_probe(osh, &func->dev, sdioh, adapter, SDIO_BUS, host_idx, rca);
+        if (sdioh->bcmsdh == NULL) {
+                sd_err(("%s: bcmsdh_probe failed\n", __FUNCTION__));
+                goto fail;
+        }
+
+       sdio_set_drvdata(func, sdioh);
+       return 0;
+
+fail:
+       if (sdioh != NULL)
+               sdioh_detach(osh, sdioh);
+       if (osh != NULL)
+               osl_detach(osh);
+       return -ENOMEM;
+}
+
+static void sdioh_remove(struct sdio_func *func)
+{
+       sdioh_info_t *sdioh;
+       osl_t *osh;
+
+       sdioh = sdio_get_drvdata(func);
+       if (sdioh == NULL) {
+               sd_err(("%s: error, no sdioh handler found\n", __FUNCTION__));
+               return;
+       }
+       sd_err(("%s: Enter\n", __FUNCTION__));
+
+       osh = sdioh->osh;
+       bcmsdh_remove(sdioh->bcmsdh);
+       sdioh_detach(osh, sdioh);
+       osl_detach(osh);
+}
+
+static int bcmsdh_sdmmc_probe(struct sdio_func *func,
+                              const struct sdio_device_id *id)
+{
+       int ret = 0;
+
+       if (func == NULL)
+               return -EINVAL;
+
+       sd_err(("%s: Enter num=%d\n", __FUNCTION__, func->num));
+       sd_info(("sdio_bcmsdh: func->class=%x\n", func->class));
+       sd_info(("sdio_vendor: 0x%04x\n", func->vendor));
+       sd_info(("sdio_device: 0x%04x\n", func->device));
+       sd_info(("Function#: 0x%04x\n", func->num));
+
+#ifdef GLOBAL_SDMMC_INSTANCE
+       gInstance->func[func->num] = func;
+#endif
+
+       /* 4318 doesn't have function 2 */
+       if ((func->num == 2) || (func->num == 1 && func->device == 0x4))
+               ret = sdioh_probe(func);
+
+       return ret;
+}
+
+static void bcmsdh_sdmmc_remove(struct sdio_func *func)
+{
+       if (func == NULL) {
+               sd_err(("%s is called with NULL SDIO function pointer\n", __FUNCTION__));
+               return;
+       }
+
+       sd_trace(("bcmsdh_sdmmc: %s Enter\n", __FUNCTION__));
+       sd_info(("sdio_bcmsdh: func->class=%x\n", func->class));
+       sd_info(("sdio_vendor: 0x%04x\n", func->vendor));
+       sd_info(("sdio_device: 0x%04x\n", func->device));
+       sd_info(("Function#: 0x%04x\n", func->num));
+
+       if ((func->num == 2) || (func->num == 1 && func->device == 0x4))
+               sdioh_remove(func);
+}
+
+/* devices we support, null terminated */
+static const struct sdio_device_id bcmsdh_sdmmc_ids[] = {
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_DEFAULT) },
+       /* XXX This should not be in the external release, as it will attach to any SDIO
+        * device, even non-WLAN devices.
+        * Need to add IDs for the FALCON-based chips and put this under BCMINTERNAL
+        { SDIO_DEVICE_CLASS(SDIO_CLASS_NONE) },
+        */
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, BCM4362_CHIP_ID) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, BCM43751_CHIP_ID) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, BCM43752_CHIP_ID) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, BCM43012_CHIP_ID) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, BCM43014_CHIP_ID) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, BCM43014_D11N_ID) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, BCM43014_D11N2G_ID) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, BCM43014_D11N5G_ID) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, BCM43013_CHIP_ID) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, BCM43013_D11N_ID) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, BCM43013_D11N2G_ID) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, BCM43013_D11N5G_ID) },
+       { SDIO_DEVICE_CLASS(SDIO_CLASS_NONE)            },
+       { 0, 0, 0, 0 /* end: all zeroes */
+       },
+};
+
+MODULE_DEVICE_TABLE(sdio, bcmsdh_sdmmc_ids);
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) && defined(CONFIG_PM)
+static int bcmsdh_sdmmc_suspend(struct device *pdev)
+{
+       int err;
+       sdioh_info_t *sdioh;
+       struct sdio_func *func = dev_to_sdio_func(pdev);
+       mmc_pm_flag_t sdio_flags;
+
+       printf("%s Enter func->num=%d\n", __FUNCTION__, func->num);
+       if (func->num != 2)
+               return 0;
+
+       dhd_mmc_suspend = TRUE;
+       sdioh = sdio_get_drvdata(func);
+       err = bcmsdh_suspend(sdioh->bcmsdh);
+       if (err) {
+               printf("%s bcmsdh_suspend err=%d\n", __FUNCTION__, err);
+               dhd_mmc_suspend = FALSE;
+               return err;
+       }
+
+       sdio_flags = sdio_get_host_pm_caps(func);
+       if (!(sdio_flags & MMC_PM_KEEP_POWER)) {
+               sd_err(("%s: can't keep power while host is suspended\n", __FUNCTION__));
+               dhd_mmc_suspend = FALSE;
+               return  -EINVAL;
+       }
+
+       /* keep power while host suspended */
+       err = sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER);
+       if (err) {
+               sd_err(("%s: error while trying to keep power\n", __FUNCTION__));
+               dhd_mmc_suspend = FALSE;
+               return err;
+       }
+       smp_mb();
+
+       printf("%s Exit\n", __FUNCTION__);
+       return 0;
+}
+
+static int bcmsdh_sdmmc_resume(struct device *pdev)
+{
+       sdioh_info_t *sdioh;
+       struct sdio_func *func = dev_to_sdio_func(pdev);
+
+       printf("%s Enter func->num=%d\n", __FUNCTION__, func->num);
+       if (func->num != 2)
+               return 0;
+
+       dhd_mmc_suspend = FALSE;
+       sdioh = sdio_get_drvdata(func);
+       bcmsdh_resume(sdioh->bcmsdh);
+
+       smp_mb();
+       printf("%s Exit\n", __FUNCTION__);
+       return 0;
+}
+
+static const struct dev_pm_ops bcmsdh_sdmmc_pm_ops = {
+       .suspend        = bcmsdh_sdmmc_suspend,
+       .resume         = bcmsdh_sdmmc_resume,
+};
+#endif  /* (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) && defined(CONFIG_PM) */
+
+#if defined(BCMLXSDMMC)
+static struct semaphore *notify_semaphore = NULL;
+
+static int dummy_probe(struct sdio_func *func,
+                              const struct sdio_device_id *id)
+{
+       if (func && (func->num != 2)) {
+               return 0;
+       }
+
+       if (notify_semaphore)
+               up(notify_semaphore);
+       return 0;
+}
+
+static void dummy_remove(struct sdio_func *func)
+{
+}
+
+static struct sdio_driver dummy_sdmmc_driver = {
+       .probe          = dummy_probe,
+       .remove         = dummy_remove,
+       .name           = "dummy_sdmmc",
+       .id_table       = bcmsdh_sdmmc_ids,
+       };
+
+int sdio_func_reg_notify(void* semaphore)
+{
+       notify_semaphore = semaphore;
+       return sdio_register_driver(&dummy_sdmmc_driver);
+}
+
+void sdio_func_unreg_notify(void)
+{
+       OSL_SLEEP(15);
+       sdio_unregister_driver(&dummy_sdmmc_driver);
+}
+
+#endif /* defined(BCMLXSDMMC) */
+
+static struct sdio_driver bcmsdh_sdmmc_driver = {
+       .probe          = bcmsdh_sdmmc_probe,
+       .remove         = bcmsdh_sdmmc_remove,
+       .name           = "bcmsdh_sdmmc",
+       .id_table       = bcmsdh_sdmmc_ids,
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) && defined(CONFIG_PM)
+       .drv = {
+       .pm     = &bcmsdh_sdmmc_pm_ops,
+       },
+#endif /* (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) && defined(CONFIG_PM) */
+       };
+
+struct sdos_info {
+       sdioh_info_t *sd;
+       spinlock_t lock;
+};
+
+/* Interrupt enable/disable */
+SDIOH_API_RC
+sdioh_interrupt_set(sdioh_info_t *sd, bool enable)
+{
+       if (!sd)
+               return BCME_BADARG;
+
+       sd_trace(("%s: %s\n", __FUNCTION__, enable ? "Enabling" : "Disabling"));
+       return SDIOH_API_RC_SUCCESS;
+}
+
+#ifdef BCMSDH_MODULE
+static int __init
+bcmsdh_module_init(void)
+{
+       int error = 0;
+       error = sdio_function_init();
+       return error;
+}
+
+static void __exit
+bcmsdh_module_cleanup(void)
+{
+       sdio_function_cleanup();
+}
+
+module_init(bcmsdh_module_init);
+module_exit(bcmsdh_module_cleanup);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION(DESCRIPTION);
+MODULE_AUTHOR(AUTHOR);
+
+#endif /* BCMSDH_MODULE */
+/*
+ * module init
+*/
+int bcmsdh_register_client_driver(void)
+{
+       return sdio_register_driver(&bcmsdh_sdmmc_driver);
+}
+
+/*
+ * module cleanup
+*/
+void bcmsdh_unregister_client_driver(void)
+{
+       sdio_unregister_driver(&bcmsdh_sdmmc_driver);
+}
diff --git a/bcmdhd.101.10.240.x/bcmsdstd.h b/bcmdhd.101.10.240.x/bcmsdstd.h
new file mode 100644 (file)
index 0000000..aa6a67c
--- /dev/null
@@ -0,0 +1,277 @@
+/*
+ *  'Standard' SDIO HOST CONTROLLER driver
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmsdstd.h 833030 2019-08-02 17:22:42Z $
+ */
+#ifndef        _BCM_SD_STD_H
+#define        _BCM_SD_STD_H
+
+/* global msglevel for debug messages - bitvals come from sdiovar.h */
+#define sd_err(x)      do { if (sd_msglevel & SDH_ERROR_VAL) printf x; } while (0)
+#define sd_trace(x)
+#define sd_info(x)
+#define sd_debug(x)
+#define sd_data(x)
+#define sd_ctrl(x)
+#define sd_dma(x)
+
+#define sd_sync_dma(sd, read, nbytes)
+#define sd_init_dma(sd)
+#define sd_ack_intr(sd)
+#define sd_wakeup(sd);
+/* Allocate/init/free per-OS private data */
+extern int sdstd_osinit(sdioh_info_t *sd);
+extern void sdstd_osfree(sdioh_info_t *sd);
+
+#define sd_log(x)
+
+#define SDIOH_ASSERT(exp) \
+       do { if (!(exp)) \
+               printf("!!!ASSERT fail: file %s lines %d", __FILE__, __LINE__); \
+       } while (0)
+
+#define BLOCK_SIZE_4318 64
+#define BLOCK_SIZE_4328 512
+
+/* internal return code */
+#define SUCCESS        0
+#define ERROR  1
+
+/* private bus modes */
+#define SDIOH_MODE_SPI         0
+#define SDIOH_MODE_SD1         1
+#define SDIOH_MODE_SD4         2
+
+#define MAX_SLOTS 6    /* For PCI: Only 6 BAR entries => 6 slots */
+#define SDIOH_REG_WINSZ        0x100 /* Number of registers in Standard Host Controller */
+
+#define SDIOH_TYPE_ARASAN_HDK  1
+#define SDIOH_TYPE_BCM27XX     2
+#define SDIOH_TYPE_TI_PCIXX21  4       /* TI PCIxx21 Standard Host Controller */
+#define SDIOH_TYPE_RICOH_R5C822        5       /* Ricoh Co Ltd R5C822 SD/SDIO/MMC/MS/MSPro Host Adapter */
+#define SDIOH_TYPE_JMICRON     6       /* JMicron Standard SDIO Host Controller */
+
+/* For linux, allow yielding for dongle */
+#define BCMSDYIELD
+
+/* Expected card status value for CMD7 */
+#define SDIOH_CMD7_EXP_STATUS   0x00001E00
+
+#define RETRIES_LARGE 100000
+#define sdstd_os_yield(sd)     do {} while (0)
+#define RETRIES_SMALL 100
+
+#define USE_BLOCKMODE          0x2     /* Block mode can be single block or multi */
+#define USE_MULTIBLOCK         0x4
+
+#define USE_FIFO               0x8     /* Fifo vs non-fifo */
+
+#define CLIENT_INTR            0x100   /* Get rid of this! */
+
+#define HC_INTR_RETUNING       0x1000
+
+#ifdef BCMSDIOH_TXGLOM
+/* Total glom pkt can not exceed 64K
+ * need one more slot for glom padding packet
+ */
+#define SDIOH_MAXGLOM_SIZE     (40+1)
+
+typedef struct glom_buf {
+       uint32 count;                           /* Total number of pkts queued */
+       void *dma_buf_arr[SDIOH_MAXGLOM_SIZE];  /* Frame address */
+       dmaaddr_t dma_phys_arr[SDIOH_MAXGLOM_SIZE]; /* DMA_MAPed address of frames */
+       uint16 nbytes[SDIOH_MAXGLOM_SIZE];      /* Size of each frame */
+} glom_buf_t;
+#endif
+
+struct sdioh_info {
+       uint cfg_bar;                           /* pci cfg address for bar */
+       uint32 caps;                            /* cached value of capabilities reg */
+       uint32 curr_caps;                       /* max current capabilities reg */
+
+       osl_t           *osh;                   /* osh handler */
+       volatile char   *mem_space;             /* pci device memory va */
+       uint            lockcount;              /* nest count of sdstd_lock() calls */
+       bool            client_intr_enabled;    /* interrupt connnected flag */
+       bool            intr_handler_valid;     /* client driver interrupt handler valid */
+       sdioh_cb_fn_t   intr_handler;           /* registered interrupt handler */
+       void            *intr_handler_arg;      /* argument to call interrupt handler */
+       bool            initialized;            /* card initialized */
+       uint            target_dev;             /* Target device ID */
+       uint16          intmask;                /* Current active interrupts */
+       void            *sdos_info;             /* Pointer to per-OS private data */
+       void            *bcmsdh;                /* handler to upper layer stack (bcmsdh) */
+
+       uint32          controller_type;        /* Host controller type */
+       uint8           version;                /* Host Controller Spec Compliance Version */
+       uint            irq;                    /* Client irq */
+       int             intrcount;              /* Client interrupts */
+       int             local_intrcount;        /* Controller interrupts */
+       bool            host_init_done;         /* Controller initted */
+       bool            card_init_done;         /* Client SDIO interface initted */
+       bool            polled_mode;            /* polling for command completion */
+
+       bool            sd_blockmode;           /* sd_blockmode == FALSE => 64 Byte Cmd 53s. */
+                                               /*  Must be on for sd_multiblock to be effective */
+       bool            use_client_ints;        /* If this is false, make sure to restore */
+                                               /*  polling hack in wl_linux.c:wl_timer() */
+       int             adapter_slot;           /* Maybe dealing with multiple slots/controllers */
+       int             sd_mode;                /* SD1/SD4/SPI */
+       int             client_block_size[SDIOD_MAX_IOFUNCS];           /* Blocksize */
+       uint32          data_xfer_count;        /* Current transfer */
+       uint16          card_rca;               /* Current Address */
+       int8            sd_dma_mode;            /* DMA Mode (PIO, SDMA, ... ADMA2) on CMD53 */
+       uint8           num_funcs;              /* Supported funcs on client */
+       uint32          com_cis_ptr;
+       uint32          func_cis_ptr[SDIOD_MAX_IOFUNCS];
+       void            *dma_buf;               /* DMA Buffer virtual address */
+       dmaaddr_t       dma_phys;               /* DMA Buffer physical address */
+       void            *adma2_dscr_buf;        /* ADMA2 Descriptor Buffer virtual address */
+       dmaaddr_t       adma2_dscr_phys;        /* ADMA2 Descriptor Buffer physical address */
+
+       /* adjustments needed to make the dma align properly */
+       void            *dma_start_buf;
+       dmaaddr_t       dma_start_phys;
+       uint            alloced_dma_size;
+       void            *adma2_dscr_start_buf;
+       dmaaddr_t       adma2_dscr_start_phys;
+       uint            alloced_adma2_dscr_size;
+
+       int             r_cnt;                  /* rx count */
+       int             t_cnt;                  /* tx_count */
+       bool            got_hcint;              /* local interrupt flag */
+       uint16          last_intrstatus;        /* to cache intrstatus */
+       int     host_UHSISupported;             /* whether UHSI is supported for HC. */
+       int     card_UHSI_voltage_Supported;    /* whether UHSI is supported for
+                                                * Card in terms of Voltage [1.8 or 3.3].
+                                                */
+       int     global_UHSI_Supp;       /* type of UHSI support in both host and card.
+                                        * HOST_SDR_UNSUPP: capabilities not supported/matched
+                                        * HOST_SDR_12_25: SDR12 and SDR25 supported
+                                        * HOST_SDR_50_104_DDR: one of SDR50/SDR104 or DDR50 supptd
+                                        */
+       volatile int    sd3_dat_state;          /* data transfer state used for retuning check */
+       volatile int    sd3_tun_state;          /* tuning state used for retuning check */
+       bool    sd3_tuning_reqd;        /* tuning requirement parameter */
+       bool    sd3_tuning_disable;     /* tuning disable due to bus sleeping */
+       uint32  caps3;                  /* cached value of 32 MSbits capabilities reg (SDIO 3.0) */
+#ifdef BCMSDIOH_TXGLOM
+       glom_buf_t glom_info;           /* pkt information used for glomming */
+       uint    txglom_mode;            /* Txglom mode: 0 - copy, 1 - multi-descriptor */
+#endif
+};
+
+#define DMA_MODE_NONE  0
+#define DMA_MODE_SDMA  1
+#define DMA_MODE_ADMA1 2
+#define DMA_MODE_ADMA2 3
+#define DMA_MODE_ADMA2_64 4
+#define DMA_MODE_AUTO  -1
+
+#define USE_DMA(sd)            ((bool)((sd->sd_dma_mode > 0) ? TRUE : FALSE))
+
+/* States for Tuning and corr data */
+#define TUNING_IDLE                    0
+#define TUNING_START                   1
+#define TUNING_START_AFTER_DAT         2
+#define TUNING_ONGOING                         3
+
+#define DATA_TRANSFER_IDLE             0
+#define DATA_TRANSFER_ONGOING  1
+
+#define CHECK_TUNING_PRE_DATA  1
+#define CHECK_TUNING_POST_DATA 2
+
+#ifdef DHD_DEBUG
+#define SD_DHD_DISABLE_PERIODIC_TUNING 0x01
+#define SD_DHD_ENABLE_PERIODIC_TUNING  0x00
+#endif
+
+/************************************************************
+ * Internal interfaces: per-port references into bcmsdstd.c
+ */
+
+/* Global message bits */
+extern uint sd_msglevel;
+
+/* OS-independent interrupt handler */
+extern bool check_client_intr(sdioh_info_t *sd);
+
+/* Core interrupt enable/disable of device interrupts */
+extern void sdstd_devintr_on(sdioh_info_t *sd);
+extern void sdstd_devintr_off(sdioh_info_t *sd);
+
+/* Enable/disable interrupts for local controller events */
+extern void sdstd_intrs_on(sdioh_info_t *sd, uint16 norm, uint16 err);
+extern void sdstd_intrs_off(sdioh_info_t *sd, uint16 norm, uint16 err);
+
+/* Wait for specified interrupt and error bits to be set */
+extern void sdstd_spinbits(sdioh_info_t *sd, uint16 norm, uint16 err);
+
+/**************************************************************
+ * Internal interfaces: bcmsdstd.c references to per-port code
+ */
+
+/* Register mapping routines */
+extern uint32 *sdstd_reg_map(osl_t *osh, dmaaddr_t addr, int size);
+extern void sdstd_reg_unmap(osl_t *osh, dmaaddr_t addr, int size);
+
+/* Interrupt (de)registration routines */
+extern int sdstd_register_irq(sdioh_info_t *sd, uint irq);
+extern void sdstd_free_irq(uint irq, sdioh_info_t *sd);
+
+/* OS-specific interrupt wrappers (atomic interrupt enable/disable) */
+extern void sdstd_lock(sdioh_info_t *sd);
+extern void sdstd_unlock(sdioh_info_t *sd);
+extern void sdstd_waitlockfree(sdioh_info_t *sd);
+
+/* OS-specific wrappers for safe concurrent register access */
+extern void sdstd_os_lock_irqsave(sdioh_info_t *sd, ulong* flags);
+extern void sdstd_os_unlock_irqrestore(sdioh_info_t *sd, ulong* flags);
+
+/* OS-specific wait-for-interrupt-or-status */
+extern int sdstd_waitbits(sdioh_info_t *sd, uint16 norm, uint16 err, bool yield, uint16 *bits);
+
+/* used by bcmsdstd_linux [implemented in sdstd] */
+extern void sdstd_3_enable_retuning_int(sdioh_info_t *sd);
+extern void sdstd_3_disable_retuning_int(sdioh_info_t *sd);
+extern bool sdstd_3_is_retuning_int_set(sdioh_info_t *sd);
+extern void sdstd_3_check_and_do_tuning(sdioh_info_t *sd, int tuning_param);
+extern bool sdstd_3_check_and_set_retuning(sdioh_info_t *sd);
+extern int sdstd_3_get_tune_state(sdioh_info_t *sd);
+extern int sdstd_3_get_data_state(sdioh_info_t *sd);
+extern void sdstd_3_set_tune_state(sdioh_info_t *sd, int state);
+extern void sdstd_3_set_data_state(sdioh_info_t *sd, int state);
+extern uint8 sdstd_3_get_tuning_exp(sdioh_info_t *sd);
+extern uint32 sdstd_3_get_uhsi_clkmode(sdioh_info_t *sd);
+extern int sdstd_3_clk_tuning(sdioh_info_t *sd, uint32 sd3ClkMode);
+
+/* used by sdstd [implemented in bcmsdstd_linux/ndis] */
+extern void sdstd_3_start_tuning(sdioh_info_t *sd);
+extern void sdstd_3_osinit_tuning(sdioh_info_t *sd);
+extern void sdstd_3_osclean_tuning(sdioh_info_t *sd);
+
+extern void sdstd_enable_disable_periodic_timer(sdioh_info_t * sd, uint val);
+
+extern sdioh_info_t *sdioh_attach(osl_t *osh, void *bar0, uint irq);
+extern SDIOH_API_RC sdioh_detach(osl_t *osh, sdioh_info_t *sd);
+#endif /* _BCM_SD_STD_H */
diff --git a/bcmdhd.101.10.240.x/bcmstdlib_s.c b/bcmdhd.101.10.240.x/bcmstdlib_s.c
new file mode 100644 (file)
index 0000000..11b92c7
--- /dev/null
@@ -0,0 +1,285 @@
+/*
+ * Broadcom Secure Standard Library.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <typedefs.h>
+#include <bcmdefs.h>
+#ifdef BCMDRIVER
+#include <osl.h>
+#else /* BCMDRIVER */
+#include <stddef.h>
+#include <string.h>
+#endif /* else BCMDRIVER */
+
+#include <bcmstdlib_s.h>
+#include <bcmutils.h>
+
+/*
+ * __SIZE_MAX__ value is depending on platform:
+ * Firmware Dongle: RAMSIZE (Dongle Specific Limit).
+ * LINUX NIC/Windows/MACOSX/Application: OS Native or
+ * 0xFFFFFFFFu if not defined.
+ */
+#ifndef SIZE_MAX
+#ifndef __SIZE_MAX__
+#define __SIZE_MAX__ 0xFFFFFFFFu
+#endif /* __SIZE_MAX__ */
+#define SIZE_MAX __SIZE_MAX__
+#endif /* SIZE_MAX */
+#define RSIZE_MAX (SIZE_MAX >> 1u)
+
+#if !defined(__STDC_WANT_SECURE_LIB__) && !(defined(__STDC_LIB_EXT1__) && \
+       defined(__STDC_WANT_LIB_EXT1__))
+/*
+ * memmove_s - secure memmove
+ * dest : pointer to the object to copy to
+ * destsz : size of the destination buffer
+ * src : pointer to the object to copy from
+ * n : number of bytes to copy
+ * Return Value : zero on success and non-zero on error
+ * Also on error, if dest is not a null pointer and destsz not greater
+ * than RSIZE_MAX, writes destsz zero bytes into the dest object.
+ */
+int
+memmove_s(void *dest, size_t destsz, const void *src, size_t n)
+{
+       int err = BCME_OK;
+
+       if ((!dest) || (((char *)dest + destsz) < (char *)dest)) {
+               err = BCME_BADARG;
+               goto exit;
+       }
+
+       if (destsz > RSIZE_MAX) {
+               err = BCME_BADLEN;
+               goto exit;
+       }
+
+       if (destsz < n) {
+               memset(dest, 0, destsz);
+               err = BCME_BADLEN;
+               goto exit;
+       }
+
+       if ((!src) || (((const char *)src + n) < (const char *)src)) {
+               memset(dest, 0, destsz);
+               err = BCME_BADARG;
+               goto exit;
+       }
+
+       memmove(dest, src, n);
+exit:
+       return err;
+}
+
+/*
+ * memcpy_s - secure memcpy
+ * dest : pointer to the object to copy to
+ * destsz : size of the destination buffer
+ * src : pointer to the object to copy from
+ * n : number of bytes to copy
+ * Return Value : zero on success and non-zero on error
+ * Also on error, if dest is not a null pointer and destsz not greater
+ * than RSIZE_MAX, writes destsz zero bytes into the dest object.
+ */
+int
+memcpy_s(void *dest, size_t destsz, const void *src, size_t n)
+{
+       int err = BCME_OK;
+       char *d = dest;
+       const char *s = src;
+
+       if ((!d) || ((d + destsz) < d)) {
+               err = BCME_BADARG;
+               goto exit;
+       }
+
+       if (destsz > RSIZE_MAX) {
+               err = BCME_BADLEN;
+               goto exit;
+       }
+
+       if (destsz < n) {
+               memset(dest, 0, destsz);
+               err = BCME_BADLEN;
+               goto exit;
+       }
+
+       if ((!s) || ((s + n) < s)) {
+               memset(dest, 0, destsz);
+               err = BCME_BADARG;
+               goto exit;
+       }
+
+       /* overlap checking between dest and src */
+       if (!(((d + destsz) <= s) || (d >= (s + n)))) {
+               memset(dest, 0, destsz);
+               err = BCME_BADARG;
+               goto exit;
+       }
+
+       (void)memcpy(dest, src, n);
+exit:
+       return err;
+}
+
+/*
+ * memset_s - secure memset
+ * dest : pointer to the object to be set
+ * destsz : size of the destination buffer
+ * c : byte value
+ * n : number of bytes to be set
+ * Return Value : zero on success and non-zero on error
+ * Also on error, if dest is not a null pointer and destsz not greater
+ * than RSIZE_MAX, writes destsz bytes with value c into the dest object.
+ */
+int
+memset_s(void *dest, size_t destsz, int c, size_t n)
+{
+       int err = BCME_OK;
+       if ((!dest) || (((char *)dest + destsz) < (char *)dest)) {
+               err = BCME_BADARG;
+               goto exit;
+       }
+
+       if (destsz > RSIZE_MAX) {
+               err = BCME_BADLEN;
+               goto exit;
+       }
+
+       if (destsz < n) {
+               (void)memset(dest, c, destsz);
+               err = BCME_BADLEN;
+               goto exit;
+       }
+
+       (void)memset(dest, c, n);
+exit:
+       return err;
+}
+#endif /* !__STDC_WANT_SECURE_LIB__ && !(__STDC_LIB_EXT1__ && __STDC_WANT_LIB_EXT1__) */
+
+#if !defined(FREEBSD) && !defined(MACOSX) && !defined(BCM_USE_PLATFORM_STRLCPY)
+/**
+ * strlcpy - Copy a %NUL terminated string into a sized buffer
+ * @dest: Where to copy the string to
+ * @src: Where to copy the string from
+ * @size: size of destination buffer 0 if input parameters are NOK
+ * return: string leng of src (which is always < size) on success or size on failure
+ *
+ * Compatible with *BSD: the result is always a valid
+ * NUL-terminated string that fits in the buffer (unless,
+ * of course, the buffer size is zero). It does not pad
+ * out the result like strncpy() does.
+ */
+size_t strlcpy(char *dest, const char *src, size_t size)
+{
+       size_t i;
+
+       if (dest == NULL || size == 0) {
+               return 0;
+       }
+
+       if (src == NULL) {
+               *dest = '\0';
+               return 0;
+       }
+
+       for (i = 0; i < size; i++) {
+               dest[i] = src[i];
+               if (dest[i] == '\0') {
+                       /* success - src string copied */
+                       return i;
+               }
+       }
+
+       /* NULL terminate since not found in src */
+       dest[size - 1u] = '\0';
+
+       /* fail - src string truncated */
+       return size;
+}
+#endif /* !defined(FREEBSD) && !defined(MACOSX) && !defined(BCM_USE_PLATFORM_STRLCPY) */
+
+/**
+ * strlcat_s - Concatenate a %NUL terminated string with a sized buffer
+ * @dest: Where to concatenate the string to
+ * @src: Where to copy the string from
+ * @size: size of destination buffer
+ * return: string length of created string (i.e. the initial length of dest plus the length of src)
+ *         not including the NUL char, up until size
+ *
+ * Unlike strncat(), strlcat() take the full size of the buffer (not just the number of bytes to
+ * copy) and guarantee to NUL-terminate the result (even when there's nothing to concat).
+ * If the length of dest string concatinated with the src string >= size, truncation occurs.
+ *
+ * Compatible with *BSD: the result is always a valid NUL-terminated string that fits in the buffer
+ * (unless, of course, the buffer size is zero).
+ *
+ * If either src or dest is not NUL-terminated, dest[size-1] will be set to NUL.
+ * If size < strlen(dest) + strlen(src), dest[size-1] will be set to NUL.
+ * If size == 0, dest[0] will be set to NUL.
+ */
+size_t
+strlcat_s(char *dest, const char *src, size_t size)
+{
+       char *d = dest;
+       const char *s = src;    /* point to the start of the src string */
+       size_t n = size;
+       size_t dlen;
+       size_t bytes_to_copy = 0;
+
+       if (dest == NULL) {
+               return 0;
+       }
+
+       /* set d to point to the end of dest string (up to size) */
+       while (n != 0 && *d != '\0') {
+               d++;
+               n--;
+       }
+       dlen = (size_t)(d - dest);
+
+       if (s != NULL) {
+               size_t slen = 0;
+
+               /* calculate src len in case it's not null-terminated */
+               n = size;
+               while (n-- != 0 && *(s + slen) != '\0') {
+                       ++slen;
+               }
+
+               n = size - dlen;        /* maximum num of chars to copy */
+               if (n != 0) {
+                       /* copy relevant chars (until end of src buf or given size is reached) */
+                       bytes_to_copy = MIN(slen - (size_t)(s - src), n - 1);
+                       (void)memcpy(d, s, bytes_to_copy);
+                       d += bytes_to_copy;
+               }
+       }
+       if (n == 0 && dlen != 0) {
+               --d;    /* nothing to copy, but NUL-terminate dest anyway */
+       }
+       *d = '\0';      /* NUL-terminate dest */
+
+       return (dlen + bytes_to_copy);
+}
diff --git a/bcmdhd.101.10.240.x/bcmutils.c b/bcmdhd.101.10.240.x/bcmutils.c
new file mode 100644 (file)
index 0000000..169e721
--- /dev/null
@@ -0,0 +1,4880 @@
+/*
+ * Driver O/S-independent utility routines
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <stdarg.h>
+#ifdef BCMDRIVER
+#include <osl.h>
+#include <bcmutils.h>
+
+#else /* !BCMDRIVER */
+
+#include <stdio.h>
+#include <string.h>
+#include <bcmutils.h>
+
+#if defined(BCMEXTSUP)
+#include <bcm_osl.h>
+#endif
+
+#ifndef ASSERT
+#define ASSERT(exp)
+#endif
+
+#endif /* !BCMDRIVER */
+
+#ifdef WL_UNITTEST
+/*
+ * Definitions and includes needed during software unit test compilation and execution.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#ifdef ASSERT
+#undef ASSERT
+#endif /* ASSERT */
+#define ASSERT(exp)
+#endif /* WL_UNITTEST */
+
+#include <bcmstdlib_s.h>
+#include <bcmendian.h>
+#include <bcmdevs.h>
+#include <ethernet.h>
+#include <vlan.h>
+#include <bcmip.h>
+#include <802.1d.h>
+#include <802.11.h>
+#include <bcmip.h>
+#include <bcmipv6.h>
+#include <bcmtcp.h>
+
+#define NUMBER_OF_BITS_BYTE    8u
+
+#ifdef PRIVACY_MASK
+struct ether_addr privacy_addrmask;
+
+/* RAM accessor function to avoid 'privacy_addrmask' in ROM/RAM shared data section. */
+static struct ether_addr *
+BCMRAMFN(privacy_addrmask_get)(void)
+{
+       return &privacy_addrmask;
+}
+#endif /* PRIVACY_MASK */
+
+#ifdef BCMDRIVER
+
+#ifndef BCM_ARM_BACKTRACE
+/* function pointers for firmware stack backtrace utility */
+void (*const print_btrace_int_fn)(int depth, uint32 pc, uint32 lr, uint32 sp) = NULL;
+void (*const print_btrace_fn)(int depth) = NULL;
+#else
+void print_backtrace(int depth);
+void (*const print_btrace_fn)(int depth) = print_backtrace;
+void print_backtrace_int(int depth, uint32 pc, uint32 lr, uint32 sp);
+void (*const print_btrace_int_fn)(int depth, uint32 pc, uint32 lr, uint32 sp) = print_backtrace_int;
+#endif
+
+/* return total length of buffer chain */
+uint
+BCMFASTPATH(pkttotlen)(osl_t *osh, void *p)
+{
+       uint total;
+       uint len;
+
+       total = 0;
+       for (; p; p = PKTNEXT(osh, p)) {
+               len = PKTLEN(osh, p);
+               total += len;
+#ifdef BCMLFRAG
+               if (BCMLFRAG_ENAB()) {
+                       if (PKTISFRAG(osh, p)) {
+                               total += PKTFRAGTOTLEN(osh, p);
+                       }
+               }
+#endif
+       }
+
+       return (total);
+}
+
+/* return total length of buffer chain */
+uint
+BCMFASTPATH(pkttotcnt)(osl_t *osh, void *p)
+{
+       uint cnt = 0;
+
+       for (; p; p = PKTNEXT(osh, p)) {
+               cnt++;
+       }
+
+       return (cnt);
+}
+
+/* return the last buffer of chained pkt */
+void *
+BCMFASTPATH(pktlast)(osl_t *osh, void *p)
+{
+       for (; PKTNEXT(osh, p); p = PKTNEXT(osh, p))
+               ;
+
+       return (p);
+}
+
+/* count segments of a chained packet */
+uint
+BCMFASTPATH(pktsegcnt)(osl_t *osh, void *p)
+{
+       uint cnt;
+
+       for (cnt = 0; p; p = PKTNEXT(osh, p)) {
+               cnt++;
+#ifdef BCMLFRAG
+               if (BCMLFRAG_ENAB() && PKTISFRAG(osh, p)) {
+                               cnt += PKTFRAGTOTNUM(osh, p);
+               }
+#ifdef HWA
+               else {
+                       cnt ++;
+               }
+#endif /* HWA */
+#endif /* BCMLFRAG */
+       }
+
+       return cnt;
+}
+
+/* copy a pkt buffer chain into a buffer */
+uint
+pktcopy(osl_t *osh, void *p, uint offset, uint len, uchar *buf)
+{
+       uint n, ret = 0;
+
+       /* skip 'offset' bytes */
+       for (; p && offset; p = PKTNEXT(osh, p)) {
+               if (offset < PKTLEN(osh, p))
+                       break;
+               offset -= PKTLEN(osh, p);
+       }
+
+       if (!p)
+               return 0;
+
+       /* copy the data */
+       for (; p && len; p = PKTNEXT(osh, p)) {
+               n = MIN(PKTLEN(osh, p) - offset, len);
+               bcopy(PKTDATA(osh, p) + offset, buf, n);
+               buf += n;
+               len -= n;
+               ret += n;
+               offset = 0;
+       }
+
+       return ret;
+}
+
+/* copy a buffer into a pkt buffer chain */
+uint
+pktfrombuf(osl_t *osh, void *p, uint offset, uint len, uchar *buf)
+{
+       uint n, ret = 0;
+
+       /* skip 'offset' bytes */
+       for (; p && offset; p = PKTNEXT(osh, p)) {
+               if (offset < PKTLEN(osh, p))
+                       break;
+               offset -= PKTLEN(osh, p);
+       }
+
+       if (!p)
+               return 0;
+
+       /* copy the data */
+       for (; p && len; p = PKTNEXT(osh, p)) {
+               n = MIN(PKTLEN(osh, p) - offset, len);
+               bcopy(buf, PKTDATA(osh, p) + offset, n);
+               buf += n;
+               len -= n;
+               ret += n;
+               offset = 0;
+       }
+
+       return ret;
+}
+
+#ifdef NOT_YET
+/* copy data from one pkt buffer (chain) to another */
+uint
+pkt2pktcopy(osl_t *osh, void *p1, uint offs1, void *p2, uint offs2, uint maxlen)
+{
+       uint8 *dp1, *dp2;
+       uint len1, len2, copylen, totallen;
+
+       for (; p1 && offs; p1 = PKTNEXT(osh, p1)) {
+               if (offs1 < (uint)PKTLEN(osh, p1))
+                       break;
+               offs1 -= PKTLEN(osh, p1);
+       }
+       for (; p2 && offs; p2 = PKTNEXT(osh, p2)) {
+               if (offs2 < (uint)PKTLEN(osh, p2))
+                       break;
+               offs2 -= PKTLEN(osh, p2);
+       }
+
+       /* Heck w/it, only need the above for now */
+}
+#endif /* NOT_YET */
+
+uint8 *
+BCMFASTPATH(pktdataoffset)(osl_t *osh, void *p,  uint offset)
+{
+       uint total = pkttotlen(osh, p);
+       uint pkt_off = 0, len = 0;
+       uint8 *pdata = (uint8 *) PKTDATA(osh, p);
+
+       if (offset > total)
+               return NULL;
+
+       for (; p; p = PKTNEXT(osh, p)) {
+               pdata = (uint8 *) PKTDATA(osh, p);
+               pkt_off = offset - len;
+               len += PKTLEN(osh, p);
+               if (len > offset)
+                       break;
+       }
+       return (uint8*) (pdata+pkt_off);
+}
+
+/* given a offset in pdata, find the pkt seg hdr */
+void *
+pktoffset(osl_t *osh, void *p,  uint offset)
+{
+       uint total = pkttotlen(osh, p);
+       uint len = 0;
+
+       if (offset > total)
+               return NULL;
+
+       for (; p; p = PKTNEXT(osh, p)) {
+               len += PKTLEN(osh, p);
+               if (len > offset)
+                       break;
+       }
+       return p;
+}
+
+void
+bcm_mdelay(uint ms)
+{
+       uint i;
+
+       for (i = 0; i < ms; i++) {
+               OSL_DELAY(1000);
+       }
+}
+
+#if defined(DHD_DEBUG)
+/* pretty hex print a pkt buffer chain */
+void
+prpkt(const char *msg, osl_t *osh, void *p0)
+{
+       void *p;
+
+       if (msg && (msg[0] != '\0'))
+               printf("%s:\n", msg);
+
+       for (p = p0; p; p = PKTNEXT(osh, p))
+               prhex(NULL, PKTDATA(osh, p), PKTLEN(osh, p));
+}
+#endif
+
+/* Takes an Ethernet frame and sets out-of-bound PKTPRIO.
+ * Also updates the inplace vlan tag if requested.
+ * For debugging, it returns an indication of what it did.
+ */
+uint
+BCMFASTPATH(pktsetprio)(void *pkt, bool update_vtag)
+{
+       struct ether_header *eh;
+       struct ethervlan_header *evh;
+       uint8 *pktdata;
+       int priority = 0;
+       int rc = 0;
+
+       pktdata = (uint8 *)PKTDATA(OSH_NULL, pkt);
+       ASSERT_FP(ISALIGNED((uintptr)pktdata, sizeof(uint16)));
+
+       eh = (struct ether_header *) pktdata;
+
+       if (eh->ether_type == hton16(ETHER_TYPE_8021Q)) {
+               uint16 vlan_tag;
+               int vlan_prio, dscp_prio = 0;
+
+               evh = (struct ethervlan_header *)eh;
+
+               vlan_tag = ntoh16(evh->vlan_tag);
+               vlan_prio = (int) (vlan_tag >> VLAN_PRI_SHIFT) & VLAN_PRI_MASK;
+
+               if ((evh->ether_type == hton16(ETHER_TYPE_IP)) ||
+                       (evh->ether_type == hton16(ETHER_TYPE_IPV6))) {
+                       uint8 *ip_body = pktdata + sizeof(struct ethervlan_header);
+                       uint8 tos_tc = IP_TOS46(ip_body);
+                       dscp_prio = (int)(tos_tc >> IPV4_TOS_PREC_SHIFT);
+               }
+
+               /* DSCP priority gets precedence over 802.1P (vlan tag) */
+               if (dscp_prio != 0) {
+                       priority = dscp_prio;
+                       rc |= PKTPRIO_VDSCP;
+               } else {
+                       priority = vlan_prio;
+                       rc |= PKTPRIO_VLAN;
+               }
+               /*
+                * If the DSCP priority is not the same as the VLAN priority,
+                * then overwrite the priority field in the vlan tag, with the
+                * DSCP priority value. This is required for Linux APs because
+                * the VLAN driver on Linux, overwrites the skb->priority field
+                * with the priority value in the vlan tag
+                */
+               if (update_vtag && (priority != vlan_prio)) {
+                       vlan_tag &= ~(VLAN_PRI_MASK << VLAN_PRI_SHIFT);
+                       vlan_tag |= (uint16)priority << VLAN_PRI_SHIFT;
+                       evh->vlan_tag = hton16(vlan_tag);
+                       rc |= PKTPRIO_UPD;
+               }
+#if defined(EAPOL_PKT_PRIO) || defined(DHD_LOSSLESS_ROAMING)
+       } else if (eh->ether_type == hton16(ETHER_TYPE_802_1X)) {
+               priority = PRIO_8021D_NC;
+               rc = PKTPRIO_DSCP;
+#endif /* EAPOL_PKT_PRIO || DHD_LOSSLESS_ROAMING */
+       } else if ((eh->ether_type == hton16(ETHER_TYPE_IP)) ||
+               (eh->ether_type == hton16(ETHER_TYPE_IPV6))) {
+               uint8 *ip_body = pktdata + sizeof(struct ether_header);
+               uint8 tos_tc = IP_TOS46(ip_body);
+               uint8 dscp = tos_tc >> IPV4_TOS_DSCP_SHIFT;
+               switch (dscp) {
+               case DSCP_EF:
+               case DSCP_VA:
+                       priority = PRIO_8021D_VO;
+                       break;
+               case DSCP_AF31:
+               case DSCP_AF32:
+               case DSCP_AF33:
+               case DSCP_CS3:
+                       priority = PRIO_8021D_CL;
+                       break;
+               case DSCP_AF21:
+               case DSCP_AF22:
+               case DSCP_AF23:
+                       priority = PRIO_8021D_EE;
+                       break;
+               case DSCP_AF11:
+               case DSCP_AF12:
+               case DSCP_AF13:
+               case DSCP_CS2:
+                       priority = PRIO_8021D_BE;
+                       break;
+               case DSCP_CS6:
+               case DSCP_CS7:
+                       priority = PRIO_8021D_NC;
+                       break;
+               default:
+                       priority = (int)(tos_tc >> IPV4_TOS_PREC_SHIFT);
+                       break;
+               }
+
+               rc |= PKTPRIO_DSCP;
+       }
+
+       ASSERT_FP(priority >= 0 && priority <= MAXPRIO);
+       PKTSETPRIO(pkt, priority);
+       return (rc | priority);
+}
+
+/* lookup user priority for specified DSCP */
+static uint8
+dscp2up(uint8 *up_table, uint8 dscp)
+{
+       uint8 user_priority = 255;
+
+       /* lookup up from table if parameters valid */
+       if (up_table != NULL && dscp < UP_TABLE_MAX) {
+               user_priority = up_table[dscp];
+       }
+
+       /* 255 is unused value so return up from dscp */
+       if (user_priority == 255) {
+               user_priority = dscp >> (IPV4_TOS_PREC_SHIFT - IPV4_TOS_DSCP_SHIFT);
+       }
+
+       return user_priority;
+}
+
+/* set user priority by QoS Map Set table (UP table), table size is UP_TABLE_MAX */
+uint
+BCMFASTPATH(pktsetprio_qms)(void *pkt, uint8* up_table, bool update_vtag)
+{
+       if (up_table) {
+               uint8 *pktdata;
+               uint pktlen;
+               uint8 dscp;
+               uint user_priority = 0;
+               uint rc = 0;
+
+               pktdata = (uint8 *)PKTDATA(OSH_NULL, pkt);
+               pktlen = PKTLEN(OSH_NULL, pkt);
+               if (pktgetdscp(pktdata, pktlen, &dscp)) {
+                       rc = PKTPRIO_DSCP;
+                       user_priority = dscp2up(up_table, dscp);
+                       PKTSETPRIO(pkt, user_priority);
+               }
+
+               return (rc | user_priority);
+       } else {
+               return pktsetprio(pkt, update_vtag);
+       }
+}
+
+/* Returns TRUE and DSCP if IP header found, FALSE otherwise.
+ */
+bool
+BCMFASTPATH(pktgetdscp)(uint8 *pktdata, uint pktlen, uint8 *dscp)
+{
+       struct ether_header *eh;
+       struct ethervlan_header *evh;
+       uint8 *ip_body;
+       bool rc = FALSE;
+
+       /* minimum length is ether header and IP header */
+       if (pktlen < sizeof(struct ether_header) + IPV4_MIN_HEADER_LEN)
+               return FALSE;
+
+       eh = (struct ether_header *) pktdata;
+
+       if (eh->ether_type == HTON16(ETHER_TYPE_IP)) {
+               ip_body = pktdata + sizeof(struct ether_header);
+               *dscp = IP_DSCP46(ip_body);
+               rc = TRUE;
+       }
+       else if (eh->ether_type == HTON16(ETHER_TYPE_8021Q)) {
+               evh = (struct ethervlan_header *)eh;
+
+               /* minimum length is ethervlan header and IP header */
+               if (pktlen >= sizeof(struct ethervlan_header) + IPV4_MIN_HEADER_LEN &&
+                       evh->ether_type == HTON16(ETHER_TYPE_IP)) {
+                       ip_body = pktdata + sizeof(struct ethervlan_header);
+                       *dscp = IP_DSCP46(ip_body);
+                       rc = TRUE;
+               }
+       }
+
+       return rc;
+}
+
+/* usr_prio range from low to high with usr_prio value */
+static bool
+up_table_set(uint8 *up_table, uint8 usr_prio, uint8 low, uint8 high)
+{
+       int i;
+
+       if (usr_prio > 7 || low > high || low >= UP_TABLE_MAX || high >= UP_TABLE_MAX) {
+               return FALSE;
+       }
+
+       for (i = low; i <= high; i++) {
+               up_table[i] = usr_prio;
+       }
+
+       return TRUE;
+}
+
+/* set user priority table */
+int
+BCMFASTPATH(wl_set_up_table)(uint8 *up_table, bcm_tlv_t *qos_map_ie)
+{
+       uint8 len;
+
+       if (up_table == NULL || qos_map_ie == NULL) {
+               return BCME_ERROR;
+       }
+
+       /* clear table to check table was set or not */
+       memset(up_table, 0xff, UP_TABLE_MAX);
+
+       /* length of QoS Map IE must be 16+n*2, n is number of exceptions */
+       if (qos_map_ie != NULL && qos_map_ie->id == DOT11_MNG_QOS_MAP_ID &&
+                       (len = qos_map_ie->len) >= QOS_MAP_FIXED_LENGTH &&
+                       (len % 2) == 0) {
+               uint8 *except_ptr = (uint8 *)qos_map_ie->data;
+               uint8 except_len = len - QOS_MAP_FIXED_LENGTH;
+               uint8 *range_ptr = except_ptr + except_len;
+               int i;
+
+               /* fill in ranges */
+               for (i = 0; i < QOS_MAP_FIXED_LENGTH; i += 2) {
+                       uint8 low = range_ptr[i];
+                       uint8 high = range_ptr[i + 1];
+                       if (low == 255 && high == 255) {
+                               continue;
+                       }
+
+                       if (!up_table_set(up_table, i / 2, low, high)) {
+                               /* clear the table on failure */
+                               memset(up_table, 0xff, UP_TABLE_MAX);
+                               return BCME_ERROR;
+                       }
+               }
+
+               /* update exceptions */
+               for (i = 0; i < except_len; i += 2) {
+                       uint8 dscp = except_ptr[i];
+                       uint8 usr_prio = except_ptr[i+1];
+
+                       /* exceptions with invalid dscp/usr_prio are ignored */
+                       up_table_set(up_table, usr_prio, dscp, dscp);
+               }
+       }
+
+       return BCME_OK;
+}
+
+/* The 0.5KB string table is not removed by compiler even though it's unused */
+
+static char bcm_undeferrstr[32];
+static const char *bcmerrorstrtable[] = BCMERRSTRINGTABLE;
+
+/* Convert the error codes into related error strings  */
+/* BCMRAMFN for BCME_LAST usage */
+const char *
+BCMRAMFN(bcmerrorstr)(int bcmerror)
+{
+       /* check if someone added a bcmerror code but forgot to add errorstring */
+       ASSERT(ABS(BCME_LAST) == (ARRAYSIZE(bcmerrorstrtable) - 1));
+
+       if (bcmerror > 0 || bcmerror < BCME_LAST) {
+               snprintf(bcm_undeferrstr, sizeof(bcm_undeferrstr), "Undefined error %d", bcmerror);
+               return bcm_undeferrstr;
+       }
+
+       ASSERT(strlen(bcmerrorstrtable[-bcmerror]) < BCME_STRLEN);
+
+       return bcmerrorstrtable[-bcmerror];
+}
+
+/* iovar table lookup */
+/* could mandate sorted tables and do a binary search */
+const bcm_iovar_t*
+bcm_iovar_lookup(const bcm_iovar_t *table, const char *name)
+{
+       const bcm_iovar_t *vi;
+       const char *lookup_name;
+
+       /* skip any ':' delimited option prefixes */
+       lookup_name = strrchr(name, ':');
+       if (lookup_name != NULL)
+               lookup_name++;
+       else
+               lookup_name = name;
+
+       ASSERT(table != NULL);
+
+       for (vi = table; vi->name; vi++) {
+               if (!strcmp(vi->name, lookup_name))
+                       return vi;
+       }
+       /* ran to end of table */
+
+       return NULL; /* var name not found */
+}
+
+int
+bcm_iovar_lencheck(const bcm_iovar_t *vi, void *arg, uint len, bool set)
+{
+       int bcmerror = 0;
+       BCM_REFERENCE(arg);
+
+       /* length check on io buf */
+       switch (vi->type) {
+       case IOVT_BOOL:
+       case IOVT_INT8:
+       case IOVT_INT16:
+       case IOVT_INT32:
+       case IOVT_UINT8:
+       case IOVT_UINT16:
+       case IOVT_UINT32:
+               /* all integers are int32 sized args at the ioctl interface */
+               if (len < sizeof(int)) {
+                       bcmerror = BCME_BUFTOOSHORT;
+               }
+               break;
+
+       case IOVT_BUFFER:
+               /* buffer must meet minimum length requirement */
+               if (len < vi->minlen) {
+                       bcmerror = BCME_BUFTOOSHORT;
+               }
+               break;
+
+       case IOVT_VOID:
+               if (!set) {
+                       /* Cannot return nil... */
+                       bcmerror = BCME_UNSUPPORTED;
+               }
+               break;
+
+       default:
+               /* unknown type for length check in iovar info */
+               ASSERT(0);
+               bcmerror = BCME_UNSUPPORTED;
+       }
+
+       return bcmerror;
+}
+
+/*
+ * Hierarchical Multiword bitmap based small id allocator.
+ *
+ * Multilevel hierarchy bitmap. (maximum 2 levels)
+ * First hierarchy uses a multiword bitmap to identify 32bit words in the
+ * second hierarchy that have at least a single bit set. Each bit in a word of
+ * the second hierarchy represents a unique ID that may be allocated.
+ *
+ * BCM_MWBMAP_ITEMS_MAX: Maximum number of IDs managed.
+ * BCM_MWBMAP_BITS_WORD: Number of bits in a bitmap word word
+ * BCM_MWBMAP_WORDS_MAX: Maximum number of bitmap words needed for free IDs.
+ * BCM_MWBMAP_WDMAP_MAX: Maximum number of bitmap wordss identifying first non
+ *                       non-zero bitmap word carrying at least one free ID.
+ * BCM_MWBMAP_SHIFT_OP:  Used in MOD, DIV and MUL operations.
+ * BCM_MWBMAP_INVALID_IDX: Value ~0U is treated as an invalid ID
+ *
+ * Design Notes:
+ * BCM_MWBMAP_USE_CNTSETBITS trades CPU for memory. A runtime count of how many
+ * bits are computed each time on allocation and deallocation, requiring 4
+ * array indexed access and 3 arithmetic operations. When not defined, a runtime
+ * count of set bits state is maintained. Upto 32 Bytes per 1024 IDs is needed.
+ * In a 4K max ID allocator, up to 128Bytes are hence used per instantiation.
+ * In a memory limited system e.g. dongle builds, a CPU for memory tradeoff may
+ * be used by defining BCM_MWBMAP_USE_CNTSETBITS.
+ *
+ * Note: wd_bitmap[] is statically declared and is not ROM friendly ... array
+ * size is fixed. No intention to support larger than 4K indice allocation. ID
+ * allocators for ranges smaller than 4K will have a wastage of only 12Bytes
+ * with savings in not having to use an indirect access, had it been dynamically
+ * allocated.
+ */
+#define BCM_MWBMAP_ITEMS_MAX    (64 * 1024)  /* May increase to 64K */
+
+#define BCM_MWBMAP_BITS_WORD    (NBITS(uint32))
+#define BCM_MWBMAP_WORDS_MAX    (BCM_MWBMAP_ITEMS_MAX / BCM_MWBMAP_BITS_WORD)
+#define BCM_MWBMAP_WDMAP_MAX    (BCM_MWBMAP_WORDS_MAX / BCM_MWBMAP_BITS_WORD)
+#define BCM_MWBMAP_SHIFT_OP     (5)
+#define BCM_MWBMAP_MODOP(ix)    ((ix) & (BCM_MWBMAP_BITS_WORD - 1))
+#define BCM_MWBMAP_DIVOP(ix)    ((ix) >> BCM_MWBMAP_SHIFT_OP)
+#define BCM_MWBMAP_MULOP(ix)    ((ix) << BCM_MWBMAP_SHIFT_OP)
+
+/* Redefine PTR() and/or HDL() conversion to invoke audit for debugging */
+#define BCM_MWBMAP_PTR(hdl)            ((struct bcm_mwbmap *)(hdl))
+#define BCM_MWBMAP_HDL(ptr)            ((void *)(ptr))
+
+#if defined(BCM_MWBMAP_DEBUG)
+#define BCM_MWBMAP_AUDIT(mwb) \
+       do { \
+               ASSERT((mwb != NULL) && \
+                      (((struct bcm_mwbmap *)(mwb))->magic == (void *)(mwb))); \
+               bcm_mwbmap_audit(mwb); \
+       } while (0)
+#define MWBMAP_ASSERT(exp)             ASSERT(exp)
+#define MWBMAP_DBG(x)           printf x
+#else   /* !BCM_MWBMAP_DEBUG */
+#define BCM_MWBMAP_AUDIT(mwb)   do {} while (0)
+#define MWBMAP_ASSERT(exp)             do {} while (0)
+#define MWBMAP_DBG(x)
+#endif  /* !BCM_MWBMAP_DEBUG */
+
+typedef struct bcm_mwbmap {     /* Hierarchical multiword bitmap allocator    */
+       uint16 wmaps;               /* Total number of words in free wd bitmap    */
+       uint16 imaps;               /* Total number of words in free id bitmap    */
+       int32  ifree;               /* Count of free indices. Used only in audits */
+       uint16 total;               /* Total indices managed by multiword bitmap  */
+
+       void * magic;               /* Audit handle parameter from user           */
+
+       uint32 wd_bitmap[BCM_MWBMAP_WDMAP_MAX]; /* 1st level bitmap of            */
+#if !defined(BCM_MWBMAP_USE_CNTSETBITS)
+       int8   wd_count[BCM_MWBMAP_WORDS_MAX];  /* free id running count, 1st lvl */
+#endif /*  ! BCM_MWBMAP_USE_CNTSETBITS */
+
+       uint32 id_bitmap[0];        /* Second level bitmap                        */
+} bcm_mwbmap_t;
+
+/* Incarnate a hierarchical multiword bitmap based small index allocator. */
+struct bcm_mwbmap *
+bcm_mwbmap_init(osl_t *osh, uint32 items_max)
+{
+       struct bcm_mwbmap * mwbmap_p;
+       uint32 wordix, size, words, extra;
+
+       /* Implementation Constraint: Uses 32bit word bitmap */
+       MWBMAP_ASSERT(BCM_MWBMAP_BITS_WORD == 32U);
+       MWBMAP_ASSERT(BCM_MWBMAP_SHIFT_OP == 5U);
+       MWBMAP_ASSERT(ISPOWEROF2(BCM_MWBMAP_ITEMS_MAX));
+       MWBMAP_ASSERT((BCM_MWBMAP_ITEMS_MAX % BCM_MWBMAP_BITS_WORD) == 0U);
+
+       ASSERT(items_max <= BCM_MWBMAP_ITEMS_MAX);
+
+       /* Determine the number of words needed in the multiword bitmap */
+       extra = BCM_MWBMAP_MODOP(items_max);
+       words = BCM_MWBMAP_DIVOP(items_max) + ((extra != 0U) ? 1U : 0U);
+
+       /* Allocate runtime state of multiword bitmap */
+       /* Note: wd_count[] or wd_bitmap[] are not dynamically allocated */
+       size = sizeof(bcm_mwbmap_t) + (sizeof(uint32) * words);
+       mwbmap_p = (bcm_mwbmap_t *)MALLOC(osh, size);
+       if (mwbmap_p == (bcm_mwbmap_t *)NULL) {
+               ASSERT(0);
+               goto error1;
+       }
+       memset(mwbmap_p, 0, size);
+
+       /* Initialize runtime multiword bitmap state */
+       mwbmap_p->imaps = (uint16)words;
+       mwbmap_p->ifree = (int32)items_max;
+       mwbmap_p->total = (uint16)items_max;
+
+       /* Setup magic, for use in audit of handle */
+       mwbmap_p->magic = BCM_MWBMAP_HDL(mwbmap_p);
+
+       /* Setup the second level bitmap of free indices */
+       /* Mark all indices as available */
+       for (wordix = 0U; wordix < mwbmap_p->imaps; wordix++) {
+               mwbmap_p->id_bitmap[wordix] = (uint32)(~0U);
+#if !defined(BCM_MWBMAP_USE_CNTSETBITS)
+               mwbmap_p->wd_count[wordix] = BCM_MWBMAP_BITS_WORD;
+#endif /*  ! BCM_MWBMAP_USE_CNTSETBITS */
+       }
+
+       /* Ensure that extra indices are tagged as un-available */
+       if (extra) { /* fixup the free ids in last bitmap and wd_count */
+               uint32 * bmap_p = &mwbmap_p->id_bitmap[mwbmap_p->imaps - 1];
+               *bmap_p ^= (uint32)(~0U << extra); /* fixup bitmap */
+#if !defined(BCM_MWBMAP_USE_CNTSETBITS)
+               mwbmap_p->wd_count[mwbmap_p->imaps - 1] = (int8)extra; /* fixup count */
+#endif /*  ! BCM_MWBMAP_USE_CNTSETBITS */
+       }
+
+       /* Setup the first level bitmap hierarchy */
+       extra = BCM_MWBMAP_MODOP(mwbmap_p->imaps);
+       words = BCM_MWBMAP_DIVOP(mwbmap_p->imaps) + ((extra != 0U) ? 1U : 0U);
+
+       mwbmap_p->wmaps = (uint16)words;
+
+       for (wordix = 0U; wordix < mwbmap_p->wmaps; wordix++)
+               mwbmap_p->wd_bitmap[wordix] = (uint32)(~0U);
+       if (extra) {
+               uint32 * bmap_p = &mwbmap_p->wd_bitmap[mwbmap_p->wmaps - 1];
+               *bmap_p ^= (uint32)(~0U << extra); /* fixup bitmap */
+       }
+
+       return mwbmap_p;
+
+error1:
+       return BCM_MWBMAP_INVALID_HDL;
+}
+
+/* Release resources used by multiword bitmap based small index allocator. */
+void
+bcm_mwbmap_fini(osl_t * osh, struct bcm_mwbmap * mwbmap_hdl)
+{
+       bcm_mwbmap_t * mwbmap_p;
+
+       BCM_MWBMAP_AUDIT(mwbmap_hdl);
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       MFREE(osh, mwbmap_p, sizeof(struct bcm_mwbmap)
+                            + (sizeof(uint32) * mwbmap_p->imaps));
+       return;
+}
+
+/* Allocate a unique small index using a multiword bitmap index allocator.    */
+uint32
+BCMFASTPATH(bcm_mwbmap_alloc)(struct bcm_mwbmap * mwbmap_hdl)
+{
+       bcm_mwbmap_t * mwbmap_p;
+       uint32 wordix, bitmap;
+
+       BCM_MWBMAP_AUDIT(mwbmap_hdl);
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       /* Start with the first hierarchy */
+       for (wordix = 0; wordix < mwbmap_p->wmaps; ++wordix) {
+
+               bitmap = mwbmap_p->wd_bitmap[wordix]; /* get the word bitmap */
+
+               if (bitmap != 0U) {
+
+                       uint32 count, bitix, *bitmap_p;
+
+                       bitmap_p = &mwbmap_p->wd_bitmap[wordix];
+
+                       /* clear all except trailing 1 */
+                       if (bitmap != (1u << 31u)) {
+                               bitmap = (uint32)(((int)(bitmap)) & (-((int)(bitmap))));
+                       }
+                       MWBMAP_ASSERT(C_bcm_count_leading_zeros(bitmap) ==
+                                     bcm_count_leading_zeros(bitmap));
+                       bitix    = (BCM_MWBMAP_BITS_WORD - 1)
+                                - bcm_count_leading_zeros(bitmap); /* use asm clz */
+                       wordix   = BCM_MWBMAP_MULOP(wordix) + bitix;
+
+                       /* Clear bit if wd count is 0, without conditional branch */
+#if defined(BCM_MWBMAP_USE_CNTSETBITS)
+                       count = bcm_cntsetbits(mwbmap_p->id_bitmap[wordix]) - 1;
+#else  /* ! BCM_MWBMAP_USE_CNTSETBITS */
+                       mwbmap_p->wd_count[wordix]--;
+                       count = mwbmap_p->wd_count[wordix];
+                       MWBMAP_ASSERT(count ==
+                                     (bcm_cntsetbits(mwbmap_p->id_bitmap[wordix]) - 1));
+#endif /* ! BCM_MWBMAP_USE_CNTSETBITS */
+                       MWBMAP_ASSERT(count >= 0);
+
+                       /* clear wd_bitmap bit if id_map count is 0 */
+                       bitmap = (count == 0) << bitix;
+
+                       MWBMAP_DBG((
+                           "Lvl1: bitix<%02u> wordix<%02u>: %08x ^ %08x = %08x wfree %d",
+                           bitix, wordix, *bitmap_p, bitmap, (*bitmap_p) ^ bitmap, count));
+
+                       *bitmap_p ^= bitmap;
+
+                       /* Use bitix in the second hierarchy */
+                       bitmap_p = &mwbmap_p->id_bitmap[wordix];
+
+                       bitmap = mwbmap_p->id_bitmap[wordix]; /* get the id bitmap */
+                       MWBMAP_ASSERT(bitmap != 0U);
+
+                       /* clear all except trailing 1 */
+                       if (bitmap != (1u << 31u)) {
+                               bitmap = (uint32)(((int)(bitmap)) & (-((int)(bitmap))));
+                       }
+                       MWBMAP_ASSERT(C_bcm_count_leading_zeros(bitmap) ==
+                                     bcm_count_leading_zeros(bitmap));
+                       bitix    = BCM_MWBMAP_MULOP(wordix)
+                                + (BCM_MWBMAP_BITS_WORD - 1)
+                                - bcm_count_leading_zeros(bitmap); /* use asm clz */
+
+                       mwbmap_p->ifree--; /* decrement system wide free count */
+                       MWBMAP_ASSERT(mwbmap_p->ifree >= 0);
+
+                       MWBMAP_DBG((
+                           "Lvl2: bitix<%02u> wordix<%02u>: %08x ^ %08x = %08x ifree %d",
+                           bitix, wordix, *bitmap_p, bitmap, (*bitmap_p) ^ bitmap,
+                           mwbmap_p->ifree));
+
+                       *bitmap_p ^= bitmap; /* mark as allocated = 1b0 */
+
+                       return bitix;
+               }
+       }
+
+       ASSERT(mwbmap_p->ifree == 0);
+
+       return BCM_MWBMAP_INVALID_IDX;
+}
+
+/* Force an index at a specified position to be in use */
+void
+bcm_mwbmap_force(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix)
+{
+       bcm_mwbmap_t * mwbmap_p;
+       uint32 count, wordix, bitmap, *bitmap_p;
+
+       BCM_MWBMAP_AUDIT(mwbmap_hdl);
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       ASSERT(bitix < mwbmap_p->total);
+
+       /* Start with second hierarchy */
+       wordix   = BCM_MWBMAP_DIVOP(bitix);
+       bitmap   = (uint32)(1U << BCM_MWBMAP_MODOP(bitix));
+       bitmap_p = &mwbmap_p->id_bitmap[wordix];
+
+       ASSERT((*bitmap_p & bitmap) == bitmap);
+
+       mwbmap_p->ifree--; /* update free count */
+       ASSERT(mwbmap_p->ifree >= 0);
+
+       MWBMAP_DBG(("Lvl2: bitix<%u> wordix<%u>: %08x ^ %08x = %08x ifree %d",
+                   bitix, wordix, *bitmap_p, bitmap, (*bitmap_p) ^ bitmap,
+                   mwbmap_p->ifree));
+
+       *bitmap_p ^= bitmap; /* mark as in use */
+
+       /* Update first hierarchy */
+       bitix    = wordix;
+
+       wordix   = BCM_MWBMAP_DIVOP(bitix);
+       bitmap_p = &mwbmap_p->wd_bitmap[wordix];
+
+#if defined(BCM_MWBMAP_USE_CNTSETBITS)
+       count = bcm_cntsetbits(mwbmap_p->id_bitmap[bitix]);
+#else  /* ! BCM_MWBMAP_USE_CNTSETBITS */
+       mwbmap_p->wd_count[bitix]--;
+       count = mwbmap_p->wd_count[bitix];
+       MWBMAP_ASSERT(count == bcm_cntsetbits(mwbmap_p->id_bitmap[bitix]));
+#endif /* ! BCM_MWBMAP_USE_CNTSETBITS */
+       MWBMAP_ASSERT(count >= 0);
+
+       bitmap   = (count == 0) << BCM_MWBMAP_MODOP(bitix);
+
+       MWBMAP_DBG(("Lvl1: bitix<%02lu> wordix<%02u>: %08x ^ %08x = %08x wfree %d",
+                   BCM_MWBMAP_MODOP(bitix), wordix, *bitmap_p, bitmap,
+                   (*bitmap_p) ^ bitmap, count));
+
+       *bitmap_p ^= bitmap; /* mark as in use */
+
+       return;
+}
+
+/* Free a previously allocated index back into the multiword bitmap allocator */
+void
+BCMFASTPATH(bcm_mwbmap_free)(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix)
+{
+       bcm_mwbmap_t * mwbmap_p;
+       uint32 wordix, bitmap, *bitmap_p;
+
+       BCM_MWBMAP_AUDIT(mwbmap_hdl);
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       ASSERT_FP(bitix < mwbmap_p->total);
+
+       /* Start with second level hierarchy */
+       wordix   = BCM_MWBMAP_DIVOP(bitix);
+       bitmap   = (1U << BCM_MWBMAP_MODOP(bitix));
+       bitmap_p = &mwbmap_p->id_bitmap[wordix];
+
+       ASSERT_FP((*bitmap_p & bitmap) == 0U);  /* ASSERT not a double free */
+
+       mwbmap_p->ifree++; /* update free count */
+       ASSERT_FP(mwbmap_p->ifree <= mwbmap_p->total);
+
+       MWBMAP_DBG(("Lvl2: bitix<%02u> wordix<%02u>: %08x | %08x = %08x ifree %d",
+                   bitix, wordix, *bitmap_p, bitmap, (*bitmap_p) | bitmap,
+                   mwbmap_p->ifree));
+
+       *bitmap_p |= bitmap; /* mark as available */
+
+       /* Now update first level hierarchy */
+
+       bitix    = wordix;
+
+       wordix   = BCM_MWBMAP_DIVOP(bitix); /* first level's word index */
+       bitmap   = (1U << BCM_MWBMAP_MODOP(bitix));
+       bitmap_p = &mwbmap_p->wd_bitmap[wordix];
+
+#if !defined(BCM_MWBMAP_USE_CNTSETBITS)
+       mwbmap_p->wd_count[bitix]++;
+#endif
+
+#if defined(BCM_MWBMAP_DEBUG)
+       {
+               uint32 count;
+#if defined(BCM_MWBMAP_USE_CNTSETBITS)
+               count = bcm_cntsetbits(mwbmap_p->id_bitmap[bitix]);
+#else  /*  ! BCM_MWBMAP_USE_CNTSETBITS */
+               count = mwbmap_p->wd_count[bitix];
+               MWBMAP_ASSERT(count == bcm_cntsetbits(mwbmap_p->id_bitmap[bitix]));
+#endif /*  ! BCM_MWBMAP_USE_CNTSETBITS */
+
+               MWBMAP_ASSERT(count <= BCM_MWBMAP_BITS_WORD);
+
+               MWBMAP_DBG(("Lvl1: bitix<%02u> wordix<%02u>: %08x | %08x = %08x wfree %d",
+                           bitix, wordix, *bitmap_p, bitmap, (*bitmap_p) | bitmap, count));
+       }
+#endif /* BCM_MWBMAP_DEBUG */
+
+       *bitmap_p |= bitmap;
+
+       return;
+}
+
+/* Fetch the toal number of free indices in the multiword bitmap allocator */
+uint32
+bcm_mwbmap_free_cnt(struct bcm_mwbmap * mwbmap_hdl)
+{
+       bcm_mwbmap_t * mwbmap_p;
+
+       BCM_MWBMAP_AUDIT(mwbmap_hdl);
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       ASSERT(mwbmap_p->ifree >= 0);
+
+       return mwbmap_p->ifree;
+}
+
+/* Determine whether an index is inuse or free */
+bool
+bcm_mwbmap_isfree(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix)
+{
+       bcm_mwbmap_t * mwbmap_p;
+       uint32 wordix, bitmap;
+
+       BCM_MWBMAP_AUDIT(mwbmap_hdl);
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       ASSERT(bitix < mwbmap_p->total);
+
+       wordix   = BCM_MWBMAP_DIVOP(bitix);
+       bitmap   = (1U << BCM_MWBMAP_MODOP(bitix));
+
+       return ((mwbmap_p->id_bitmap[wordix] & bitmap) != 0U);
+}
+
+/* Debug dump a multiword bitmap allocator */
+void
+bcm_mwbmap_show(struct bcm_mwbmap * mwbmap_hdl)
+{
+       uint32 ix, count;
+       bcm_mwbmap_t * mwbmap_p;
+
+       BCM_MWBMAP_AUDIT(mwbmap_hdl);
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       printf("mwbmap_p %p wmaps %u imaps %u ifree %d total %u\n",
+               OSL_OBFUSCATE_BUF((void *)mwbmap_p),
+              mwbmap_p->wmaps, mwbmap_p->imaps, mwbmap_p->ifree, mwbmap_p->total);
+       for (ix = 0U; ix < mwbmap_p->wmaps; ix++) {
+               printf("\tWDMAP:%2u. 0x%08x\t", ix, mwbmap_p->wd_bitmap[ix]);
+               bcm_bitprint32(mwbmap_p->wd_bitmap[ix]);
+               printf("\n");
+       }
+       for (ix = 0U; ix < mwbmap_p->imaps; ix++) {
+#if defined(BCM_MWBMAP_USE_CNTSETBITS)
+               count = bcm_cntsetbits(mwbmap_p->id_bitmap[ix]);
+#else  /* ! BCM_MWBMAP_USE_CNTSETBITS */
+               count = mwbmap_p->wd_count[ix];
+               MWBMAP_ASSERT(count == bcm_cntsetbits(mwbmap_p->id_bitmap[ix]));
+#endif /* ! BCM_MWBMAP_USE_CNTSETBITS */
+               printf("\tIDMAP:%2u. 0x%08x %02u\t", ix, mwbmap_p->id_bitmap[ix], count);
+               bcm_bitprint32(mwbmap_p->id_bitmap[ix]);
+               printf("\n");
+       }
+
+       return;
+}
+
+/* Audit a hierarchical multiword bitmap */
+void
+bcm_mwbmap_audit(struct bcm_mwbmap * mwbmap_hdl)
+{
+       bcm_mwbmap_t * mwbmap_p;
+       uint32 count, free_cnt = 0U, wordix, idmap_ix, bitix, *bitmap_p;
+
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       for (wordix = 0U; wordix < mwbmap_p->wmaps; ++wordix) {
+
+               bitmap_p = &mwbmap_p->wd_bitmap[wordix];
+
+               for (bitix = 0U; bitix < BCM_MWBMAP_BITS_WORD; bitix++) {
+                       if ((*bitmap_p) & (1 << bitix)) {
+                               idmap_ix = BCM_MWBMAP_MULOP(wordix) + bitix;
+#if defined(BCM_MWBMAP_USE_CNTSETBITS)
+                               count = bcm_cntsetbits(mwbmap_p->id_bitmap[idmap_ix]);
+#else  /* ! BCM_MWBMAP_USE_CNTSETBITS */
+                               count = mwbmap_p->wd_count[idmap_ix];
+                               ASSERT(count == bcm_cntsetbits(mwbmap_p->id_bitmap[idmap_ix]));
+#endif /* ! BCM_MWBMAP_USE_CNTSETBITS */
+                               ASSERT(count != 0U);
+                               free_cnt += count;
+                       }
+               }
+       }
+
+       ASSERT((int)free_cnt == mwbmap_p->ifree);
+}
+/* END : Multiword bitmap based 64bit to Unique 32bit Id allocator. */
+
+/* Simple 16bit Id allocator using a stack implementation. */
+typedef struct id16_map {
+       uint32  failures;  /* count of failures */
+       void    *dbg;      /* debug placeholder */
+       uint16  total;     /* total number of ids managed by allocator */
+       uint16  start;     /* start value of 16bit ids to be managed */
+       int     stack_idx; /* index into stack of available ids */
+       uint16  stack[0];  /* stack of 16 bit ids */
+} id16_map_t;
+
+#define ID16_MAP_SZ(items)      (sizeof(id16_map_t) + \
+                                    (sizeof(uint16) * (items)))
+
+#if defined(BCM_DBG)
+
+/* Uncomment BCM_DBG_ID16 to debug double free */
+/* #define BCM_DBG_ID16 */
+
+typedef struct id16_map_dbg {
+       uint16  total;
+       bool    avail[0];
+} id16_map_dbg_t;
+#define ID16_MAP_DBG_SZ(items)  (sizeof(id16_map_dbg_t) + \
+                                    (sizeof(bool) * (items)))
+#define ID16_MAP_MSG(x)         print x
+#else
+#define ID16_MAP_MSG(x)
+#endif /* BCM_DBG */
+
+void * /* Construct an id16 allocator: [start_val16 .. start_val16+total_ids) */
+id16_map_init(osl_t *osh, uint16 total_ids, uint16 start_val16)
+{
+       uint16 idx, val16;
+       id16_map_t * id16_map;
+
+       ASSERT(total_ids > 0);
+
+       /* A start_val16 of ID16_UNDEFINED, allows the caller to fill the id16 map
+        * with random values.
+        */
+       ASSERT((start_val16 == ID16_UNDEFINED) ||
+              (start_val16 + total_ids) < ID16_INVALID);
+
+       id16_map = (id16_map_t *) MALLOC(osh, ID16_MAP_SZ(total_ids));
+       if (id16_map == NULL) {
+               return NULL;
+       }
+
+       id16_map->total = total_ids;
+       id16_map->start = start_val16;
+       id16_map->failures = 0;
+       id16_map->dbg = NULL;
+
+       /*
+        * Populate stack with 16bit id values, commencing with start_val16.
+        * if start_val16 is ID16_UNDEFINED, then do not populate the id16 map.
+        */
+       id16_map->stack_idx = -1;
+
+       if (id16_map->start != ID16_UNDEFINED) {
+               val16 = start_val16;
+
+               for (idx = 0; idx < total_ids; idx++, val16++) {
+                       id16_map->stack_idx = idx;
+                       id16_map->stack[id16_map->stack_idx] = val16;
+               }
+       }
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+       if (id16_map->start != ID16_UNDEFINED) {
+               id16_map->dbg = MALLOC(osh, ID16_MAP_DBG_SZ(total_ids));
+
+               if (id16_map->dbg) {
+                       id16_map_dbg_t *id16_map_dbg = (id16_map_dbg_t *)id16_map->dbg;
+
+                       id16_map_dbg->total = total_ids;
+                       for (idx = 0; idx < total_ids; idx++) {
+                               id16_map_dbg->avail[idx] = TRUE;
+                       }
+               }
+       }
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+
+       return (void *)id16_map;
+}
+
+void * /* Destruct an id16 allocator instance */
+id16_map_fini(osl_t *osh, void * id16_map_hndl)
+{
+       uint16 total_ids;
+       id16_map_t * id16_map;
+
+       if (id16_map_hndl == NULL)
+               return NULL;
+
+       id16_map = (id16_map_t *)id16_map_hndl;
+
+       total_ids = id16_map->total;
+       ASSERT(total_ids > 0);
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+       if (id16_map->dbg) {
+               MFREE(osh, id16_map->dbg, ID16_MAP_DBG_SZ(total_ids));
+       }
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+
+       id16_map->total = 0;
+       MFREE(osh, id16_map, ID16_MAP_SZ(total_ids));
+
+       return NULL;
+}
+
+void
+id16_map_clear(void * id16_map_hndl, uint16 total_ids, uint16 start_val16)
+{
+       uint16 idx, val16;
+       id16_map_t * id16_map;
+
+       ASSERT(total_ids > 0);
+       /* A start_val16 of ID16_UNDEFINED, allows the caller to fill the id16 map
+        * with random values.
+        */
+       ASSERT((start_val16 == ID16_UNDEFINED) ||
+              (start_val16 + total_ids) < ID16_INVALID);
+
+       id16_map = (id16_map_t *)id16_map_hndl;
+       if (id16_map == NULL) {
+               return;
+       }
+
+       id16_map->total = total_ids;
+       id16_map->start = start_val16;
+       id16_map->failures = 0;
+
+       /* Populate stack with 16bit id values, commencing with start_val16 */
+       id16_map->stack_idx = -1;
+
+       if (id16_map->start != ID16_UNDEFINED) {
+               val16 = start_val16;
+
+               for (idx = 0; idx < total_ids; idx++, val16++) {
+                       id16_map->stack_idx = idx;
+                       id16_map->stack[id16_map->stack_idx] = val16;
+               }
+       }
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+       if (id16_map->start != ID16_UNDEFINED) {
+               if (id16_map->dbg) {
+                       id16_map_dbg_t *id16_map_dbg = (id16_map_dbg_t *)id16_map->dbg;
+
+                       id16_map_dbg->total = total_ids;
+                       for (idx = 0; idx < total_ids; idx++) {
+                               id16_map_dbg->avail[idx] = TRUE;
+                       }
+               }
+       }
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+}
+
+uint16 /* Allocate a unique 16bit id */
+BCMFASTPATH(id16_map_alloc)(void * id16_map_hndl)
+{
+       uint16 val16;
+       id16_map_t * id16_map;
+
+       ASSERT_FP(id16_map_hndl != NULL);
+
+       id16_map = (id16_map_t *)id16_map_hndl;
+
+       ASSERT_FP(id16_map->total > 0);
+
+       if (id16_map->stack_idx < 0) {
+               id16_map->failures++;
+               return ID16_INVALID;
+       }
+
+       val16 = id16_map->stack[id16_map->stack_idx];
+       id16_map->stack_idx--;
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+       ASSERT_FP((id16_map->start == ID16_UNDEFINED) ||
+              (val16 < (id16_map->start + id16_map->total)));
+
+       if (id16_map->dbg) { /* Validate val16 */
+               id16_map_dbg_t *id16_map_dbg = (id16_map_dbg_t *)id16_map->dbg;
+
+               ASSERT_FP(id16_map_dbg->avail[val16 - id16_map->start] == TRUE);
+               id16_map_dbg->avail[val16 - id16_map->start] = FALSE;
+       }
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+
+       return val16;
+}
+
+void /* Free a 16bit id value into the id16 allocator */
+BCMFASTPATH(id16_map_free)(void * id16_map_hndl, uint16 val16)
+{
+       id16_map_t * id16_map;
+
+       ASSERT_FP(id16_map_hndl != NULL);
+
+       id16_map = (id16_map_t *)id16_map_hndl;
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+       ASSERT_FP((id16_map->start == ID16_UNDEFINED) ||
+              (val16 < (id16_map->start + id16_map->total)));
+
+       if (id16_map->dbg) { /* Validate val16 */
+               id16_map_dbg_t *id16_map_dbg = (id16_map_dbg_t *)id16_map->dbg;
+
+               ASSERT_FP(id16_map_dbg->avail[val16 - id16_map->start] == FALSE);
+               id16_map_dbg->avail[val16 - id16_map->start] = TRUE;
+       }
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+
+       id16_map->stack_idx++;
+       id16_map->stack[id16_map->stack_idx] = val16;
+}
+
+uint32 /* Returns number of failures to allocate an unique id16 */
+id16_map_failures(void * id16_map_hndl)
+{
+       ASSERT(id16_map_hndl != NULL);
+       return ((id16_map_t *)id16_map_hndl)->failures;
+}
+
+bool
+id16_map_audit(void * id16_map_hndl)
+{
+       int idx;
+       int insane = 0;
+       id16_map_t * id16_map;
+
+       ASSERT(id16_map_hndl != NULL);
+
+       id16_map = (id16_map_t *)id16_map_hndl;
+
+       ASSERT(id16_map->stack_idx >= -1);
+       ASSERT(id16_map->stack_idx < (int)id16_map->total);
+
+       if (id16_map->start == ID16_UNDEFINED)
+               goto done;
+
+       for (idx = 0; idx <= id16_map->stack_idx; idx++) {
+               ASSERT(id16_map->stack[idx] >= id16_map->start);
+               ASSERT(id16_map->stack[idx] < (id16_map->start + id16_map->total));
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+               if (id16_map->dbg) {
+                       uint16 val16 = id16_map->stack[idx];
+                       if (((id16_map_dbg_t *)(id16_map->dbg))->avail[val16] != TRUE) {
+                               insane |= 1;
+                               ID16_MAP_MSG(("id16_map<%p>: stack_idx %u invalid val16 %u\n",
+                                             OSL_OBFUSATE_BUF(id16_map_hndl), idx, val16));
+                       }
+               }
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+       }
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+       if (id16_map->dbg) {
+               uint16 avail = 0; /* Audit available ids counts */
+               for (idx = 0; idx < id16_map_dbg->total; idx++) {
+                       if (((id16_map_dbg_t *)(id16_map->dbg))->avail[idx16] == TRUE)
+                               avail++;
+               }
+               if (avail && (avail != (id16_map->stack_idx + 1))) {
+                       insane |= 1;
+                       ID16_MAP_MSG(("id16_map<%p>: avail %u stack_idx %u\n",
+                                     OSL_OBFUSCATE_BUF(id16_map_hndl),
+                                     avail, id16_map->stack_idx));
+               }
+       }
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+
+done:
+       /* invoke any other system audits */
+       return (!!insane);
+}
+/* END: Simple id16 allocator */
+
+void
+dll_pool_detach(void * osh, dll_pool_t * pool, uint16 elems_max, uint16 elem_size)
+{
+       uint32 mem_size;
+       mem_size = sizeof(dll_pool_t) + (elems_max * elem_size);
+       if (pool)
+               MFREE(osh, pool, mem_size);
+}
+dll_pool_t *
+dll_pool_init(void * osh, uint16 elems_max, uint16 elem_size)
+{
+       uint32 mem_size, i;
+       dll_pool_t * dll_pool_p;
+       dll_t * elem_p;
+
+       ASSERT(elem_size > sizeof(dll_t));
+
+       mem_size = sizeof(dll_pool_t) + (elems_max * elem_size);
+
+       if ((dll_pool_p = (dll_pool_t *)MALLOCZ(osh, mem_size)) == NULL) {
+               ASSERT(0);
+               return dll_pool_p;
+       }
+
+       dll_init(&dll_pool_p->free_list);
+       dll_pool_p->elems_max = elems_max;
+       dll_pool_p->elem_size = elem_size;
+
+       elem_p = dll_pool_p->elements;
+       for (i = 0; i < elems_max; i++) {
+               dll_append(&dll_pool_p->free_list, elem_p);
+               elem_p = (dll_t *)((uintptr)elem_p + elem_size);
+       }
+
+       dll_pool_p->free_count = elems_max;
+
+       return dll_pool_p;
+}
+
+void *
+dll_pool_alloc(dll_pool_t * dll_pool_p)
+{
+       dll_t * elem_p;
+
+       if (dll_pool_p->free_count == 0) {
+               ASSERT(dll_empty(&dll_pool_p->free_list));
+               return NULL;
+       }
+
+       elem_p = dll_head_p(&dll_pool_p->free_list);
+       dll_delete(elem_p);
+       dll_pool_p->free_count -= 1;
+
+       return (void *)elem_p;
+}
+
+void
+dll_pool_free(dll_pool_t * dll_pool_p, void * elem_p)
+{
+       dll_t * node_p = (dll_t *)elem_p;
+       dll_prepend(&dll_pool_p->free_list, node_p);
+       dll_pool_p->free_count += 1;
+}
+
+void
+dll_pool_free_tail(dll_pool_t * dll_pool_p, void * elem_p)
+{
+       dll_t * node_p = (dll_t *)elem_p;
+       dll_append(&dll_pool_p->free_list, node_p);
+       dll_pool_p->free_count += 1;
+}
+
+#endif /* BCMDRIVER */
+
+#if defined(BCMDRIVER) || defined(WL_UNITTEST)
+
+/* triggers bcm_bprintf to print to kernel log */
+bool bcm_bprintf_bypass = FALSE;
+
+/* Initialization of bcmstrbuf structure */
+void
+bcm_binit(struct bcmstrbuf *b, char *buf, uint size)
+{
+       b->origsize = b->size = size;
+       b->origbuf = b->buf = buf;
+       if (size > 0) {
+               buf[0] = '\0';
+       }
+}
+
+/* Buffer sprintf wrapper to guard against buffer overflow */
+int
+bcm_bprintf(struct bcmstrbuf *b, const char *fmt, ...)
+{
+       va_list ap;
+       int r;
+
+       va_start(ap, fmt);
+
+       r = vsnprintf(b->buf, b->size, fmt, ap);
+       if (bcm_bprintf_bypass == TRUE) {
+               printf("%s", b->buf);
+               goto exit;
+       }
+
+       /* Non Ansi C99 compliant returns -1,
+        * Ansi compliant return r >= b->size,
+        * bcmstdlib returns 0, handle all
+        */
+       /* r == 0 is also the case when strlen(fmt) is zero.
+        * typically the case when "" is passed as argument.
+        */
+       if ((r == -1) || (r >= (int)b->size)) {
+               b->size = 0;
+       } else {
+               b->size -= r;
+               b->buf += r;
+       }
+
+exit:
+       va_end(ap);
+
+       return r;
+}
+
+void
+bcm_bprhex(struct bcmstrbuf *b, const char *msg, bool newline, const uint8 *buf, uint len)
+{
+       uint i;
+
+       if (msg != NULL && msg[0] != '\0')
+               bcm_bprintf(b, "%s", msg);
+       for (i = 0u; i < len; i ++)
+               bcm_bprintf(b, "%02X", buf[i]);
+       if (newline)
+               bcm_bprintf(b, "\n");
+}
+
+void
+bcm_inc_bytes(uchar *num, int num_bytes, uint8 amount)
+{
+       int i;
+
+       for (i = 0; i < num_bytes; i++) {
+               num[i] += amount;
+               if (num[i] >= amount)
+                       break;
+               amount = 1;
+       }
+}
+
+int
+bcm_cmp_bytes(const uchar *arg1, const uchar *arg2, uint8 nbytes)
+{
+       int i;
+
+       for (i = nbytes - 1; i >= 0; i--) {
+               if (arg1[i] != arg2[i])
+                       return (arg1[i] - arg2[i]);
+       }
+       return 0;
+}
+
+void
+bcm_print_bytes(const char *name, const uchar *data, uint len)
+{
+       uint i;
+       int per_line = 0;
+
+       printf("%s: %d \n", name ? name : "", len);
+       for (i = 0u; i < len; i++) {
+               printf("%02x ", *data++);
+               per_line++;
+               if (per_line == 16) {
+                       per_line = 0;
+                       printf("\n");
+               }
+       }
+       printf("\n");
+}
+
+/* Search for an IE having a specific tag and an OUI type from a buffer.
+ * tlvs: buffer to search for IE
+ * tlvs_len: buffer length
+ * tag: IE tag
+ * oui: Specific OUI to match
+ * oui_len: length of the OUI
+ * type: OUI type
+ * Return the matched IE, else return null.
+*/
+bcm_tlv_t *
+bcm_find_ie(const uint8* tlvs, uint tlvs_len, uint8 tag, uint8 oui_len,
+       const char *oui, uint8 type)
+{
+       const bcm_tlv_t *ie;
+
+       COV_TAINTED_DATA_SINK(tlvs_len);
+       COV_NEG_SINK(tlvs_len);
+
+       /* Walk through the IEs looking for an OUI match */
+       while ((ie = bcm_parse_tlvs_advance(&tlvs, &tlvs_len, tag,
+               BCM_TLV_ADVANCE_TO))) {
+               if ((ie->len > oui_len) &&
+                   !bcmp(ie->data, oui, oui_len) &&
+                       ie->data[oui_len] == type) {
+
+                       COV_TAINTED_DATA_ARG(ie);
+
+                       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                       return (bcm_tlv_t *)(ie);               /* a match */
+                       GCC_DIAGNOSTIC_POP();
+               }
+               /* Point to the next IE */
+               bcm_tlv_buffer_advance_past(ie, &tlvs, &tlvs_len);
+       }
+
+       return NULL;
+}
+
+/* Look for vendor-specific IE with specified OUI and optional type */
+bcm_tlv_t *
+bcm_find_vendor_ie(const  void *tlvs, uint tlvs_len, const char *voui, uint8 *type, uint type_len)
+{
+       const  bcm_tlv_t *ie;
+       uint8 ie_len;
+
+       COV_TAINTED_DATA_SINK(tlvs_len);
+       COV_NEG_SINK(tlvs_len);
+
+       ie = (const  bcm_tlv_t*)tlvs;
+
+       /* make sure we are looking at a valid IE */
+       if (ie == NULL || !bcm_valid_tlv(ie, tlvs_len)) {
+               return NULL;
+       }
+
+       /* Walk through the IEs looking for an OUI match */
+       do {
+               ie_len = ie->len;
+               if ((ie->id == DOT11_MNG_VS_ID) &&
+                   (ie_len >= (DOT11_OUI_LEN + type_len)) &&
+                   !bcmp(ie->data, voui, DOT11_OUI_LEN))
+               {
+                       /* compare optional type */
+                       if (type_len == 0 ||
+                           !bcmp(&ie->data[DOT11_OUI_LEN], type, type_len)) {
+
+                               COV_TAINTED_DATA_ARG(ie);
+
+                               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                               return (bcm_tlv_t *)(ie);               /* a match */
+                               GCC_DIAGNOSTIC_POP();
+                       }
+               }
+       } while ((ie = bcm_next_tlv(ie, &tlvs_len)) != NULL);
+
+       return NULL;
+}
+
+#if defined(WLTINYDUMP) || defined(WLMSG_INFORM) || defined(WLMSG_ASSOC) || \
+       defined(WLMSG_PRPKT) || defined(WLMSG_WSEC)
+#define SSID_FMT_BUF_LEN       ((4 * DOT11_MAX_SSID_LEN) + 1)
+
+int
+bcm_format_ssid(char* buf, const uchar ssid[], uint ssid_len)
+{
+       uint i, c;
+       char *p = buf;
+       char *endp = buf + SSID_FMT_BUF_LEN;
+
+       if (ssid_len > DOT11_MAX_SSID_LEN) ssid_len = DOT11_MAX_SSID_LEN;
+
+       for (i = 0; i < ssid_len; i++) {
+               c = (uint)ssid[i];
+               if (c == '\\') {
+                       *p++ = '\\';
+                       *p++ = '\\';
+               } else if (bcm_isprint((uchar)c)) {
+                       *p++ = (char)c;
+               } else {
+                       p += snprintf(p, (endp - p), "\\x%02X", c);
+               }
+       }
+       *p = '\0';
+       ASSERT(p < endp);
+
+       return (int)(p - buf);
+}
+#endif
+
+#endif /* BCMDRIVER || WL_UNITTEST */
+
+/* Masking few bytes of MAC address per customer in all prints/eventlogs. */
+int
+BCMRAMFN(bcm_addrmask_set)(int enable)
+{
+#ifdef PRIVACY_MASK
+       struct ether_addr *privacy = privacy_addrmask_get();
+       if (enable) {
+               /* apply mask as (For SS)
+                * orig         : 12:34:56:78:90:ab
+                * masked       : 12:xx:xx:xx:x0:ab
+                */
+               privacy->octet[1] = privacy->octet[2] =
+                       privacy->octet[3] = 0;
+               privacy->octet[0] = privacy->octet[5] = 0xff;
+               privacy->octet[4] = 0x0f;
+       } else
+       {
+               /* No masking. All are 0xff. */
+               memcpy(privacy, &ether_bcast, sizeof(struct ether_addr));
+       }
+
+       return BCME_OK;
+#else
+       BCM_REFERENCE(enable);
+       return BCME_UNSUPPORTED;
+#endif /* PRIVACY_MASK */
+
+}
+
+int
+bcm_addrmask_get(int *val)
+{
+#ifdef PRIVACY_MASK
+       struct ether_addr *privacy = privacy_addrmask_get();
+       if (!eacmp(&ether_bcast, privacy)) {
+               *val = FALSE;
+       } else {
+               *val = TRUE;
+       }
+
+       return BCME_OK;
+#else
+       BCM_REFERENCE(val);
+       return BCME_UNSUPPORTED;
+#endif
+}
+
+char *
+bcm_ether_ntoa(const struct ether_addr *ea, char *buf)
+{
+       static const char hex[] =
+         {
+                 '0', '1', '2', '3', '4', '5', '6', '7',
+                 '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'
+         };
+       const uint8 *octet = ea->octet;
+       char *p = buf;
+       int i;
+
+       for (i = 0; i < 6; i++, octet++) {
+               *p++ = hex[(*octet >> 4) & 0xf];
+               *p++ = hex[*octet & 0xf];
+               *p++ = ':';
+       }
+
+       *(p-1) = '\0';
+
+       return (buf);
+}
+
+/* Find the position of first bit set
+ * in the given number.
+ */
+int
+bcm_find_fsb(uint32 num)
+{
+       uint8 pos = 0;
+       if (!num)
+               return pos;
+       while (!(num & 1)) {
+               num >>= 1;
+               pos++;
+       }
+       return (pos+1);
+}
+
+/* TODO: need to pass in the buffer length for validation check */
+char *
+bcm_ip_ntoa(struct ipv4_addr *ia, char *buf)
+{
+       snprintf(buf, 16, "%d.%d.%d.%d",
+                ia->addr[0], ia->addr[1], ia->addr[2], ia->addr[3]);
+       return (buf);
+}
+
+/* TODO: need to pass in the buffer length for validation check */
+char *
+bcm_ipv6_ntoa(void *ipv6, char *buf)
+{
+       /* Implementing RFC 5952 Sections 4 + 5 */
+       /* Not thoroughly tested */
+       uint16 tmp[8];
+       uint16 *a = &tmp[0];
+       char *p = buf;
+       int i, i_max = -1, cnt = 0, cnt_max = 1;
+       uint8 *a4 = NULL;
+       memcpy((uint8 *)&tmp[0], (uint8 *)ipv6, IPV6_ADDR_LEN);
+
+       for (i = 0; i < IPV6_ADDR_LEN/2; i++) {
+               if (a[i]) {
+                       if (cnt > cnt_max) {
+                               cnt_max = cnt;
+                               i_max = i - cnt;
+                       }
+                       cnt = 0;
+               } else
+                       cnt++;
+       }
+       if (cnt > cnt_max) {
+               cnt_max = cnt;
+               i_max = i - cnt;
+       }
+       if (i_max == 0 &&
+               /* IPv4-translated: ::ffff:0:a.b.c.d */
+               ((cnt_max == 4 && a[4] == 0xffff && a[5] == 0) ||
+               /* IPv4-mapped: ::ffff:a.b.c.d */
+               (cnt_max == 5 && a[5] == 0xffff)))
+               a4 = (uint8*) (a + 6);
+
+       for (i = 0; i < IPV6_ADDR_LEN/2; i++) {
+               if ((uint8*) (a + i) == a4) {
+                       snprintf(p, 17, ":%u.%u.%u.%u", a4[0], a4[1], a4[2], a4[3]);
+                       break;
+               } else if (i == i_max) {
+                       *p++ = ':';
+                       i += cnt_max - 1;
+                       p[0] = ':';
+                       p[1] = '\0';
+               } else {
+                       if (i)
+                               *p++ = ':';
+                       p += snprintf(p, 8, "%x", ntoh16(a[i]));
+               }
+       }
+
+       return buf;
+}
+
+#if !defined(BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS)
+const unsigned char bcm_ctype[256] = {
+
+       _BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,                        /* 0-7 */
+       _BCM_C, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C,
+       _BCM_C, /* 8-15 */
+       _BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,                        /* 16-23 */
+       _BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,                        /* 24-31 */
+       _BCM_S|_BCM_SP,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,                /* 32-39 */
+       _BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,                        /* 40-47 */
+       _BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,                        /* 48-55 */
+       _BCM_D,_BCM_D,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,                        /* 56-63 */
+       _BCM_P, _BCM_U|_BCM_X, _BCM_U|_BCM_X, _BCM_U|_BCM_X, _BCM_U|_BCM_X, _BCM_U|_BCM_X,
+       _BCM_U|_BCM_X, _BCM_U, /* 64-71 */
+       _BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,                        /* 72-79 */
+       _BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,                        /* 80-87 */
+       _BCM_U,_BCM_U,_BCM_U,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,                        /* 88-95 */
+       _BCM_P, _BCM_L|_BCM_X, _BCM_L|_BCM_X, _BCM_L|_BCM_X, _BCM_L|_BCM_X, _BCM_L|_BCM_X,
+       _BCM_L|_BCM_X, _BCM_L, /* 96-103 */
+       _BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L, /* 104-111 */
+       _BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L, /* 112-119 */
+       _BCM_L,_BCM_L,_BCM_L,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_C, /* 120-127 */
+       0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,         /* 128-143 */
+       0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,         /* 144-159 */
+       _BCM_S|_BCM_SP, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P,
+       _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, /* 160-175 */
+       _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P,
+       _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, /* 176-191 */
+       _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U,
+       _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, /* 192-207 */
+       _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_P, _BCM_U, _BCM_U, _BCM_U,
+       _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_L, /* 208-223 */
+       _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L,
+       _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, /* 224-239 */
+       _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_P, _BCM_L, _BCM_L, _BCM_L,
+       _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L /* 240-255 */
+};
+
+uint64
+bcm_strtoull(const char *cp, char **endp, uint base)
+{
+       uint64 result, last_result = 0, value;
+       bool minus;
+
+       minus = FALSE;
+
+       while (bcm_isspace(*cp))
+               cp++;
+
+       if (cp[0] == '+')
+               cp++;
+       else if (cp[0] == '-') {
+               minus = TRUE;
+               cp++;
+       }
+
+       if (base == 0) {
+               if (cp[0] == '0') {
+                       if ((cp[1] == 'x') || (cp[1] == 'X')) {
+                               base = 16;
+                               cp = &cp[2];
+                       } else {
+                               base = 8;
+                               cp = &cp[1];
+                       }
+               } else
+                       base = 10;
+       } else if (base == 16 && (cp[0] == '0') && ((cp[1] == 'x') || (cp[1] == 'X'))) {
+               cp = &cp[2];
+       }
+
+       result = 0;
+
+       while (bcm_isxdigit(*cp) &&
+              (value = bcm_isdigit(*cp) ? *cp-'0' : bcm_toupper(*cp)-'A'+10) < base) {
+               result = result*base + value;
+               /* Detected overflow */
+               if (result < last_result && !minus) {
+                       if (endp) {
+                               /* Go to the end of current number */
+                               while (bcm_isxdigit(*cp)) {
+                                       cp++;
+                               }
+                               *endp = DISCARD_QUAL(cp, char);
+                       }
+                       return (ulong)-1;
+               }
+               last_result = result;
+               cp++;
+       }
+
+       if (minus)
+               result = (ulong)(-(long)result);
+
+       if (endp)
+               *endp = DISCARD_QUAL(cp, char);
+
+       return (result);
+}
+
+ulong
+bcm_strtoul(const char *cp, char **endp, uint base)
+{
+       return (ulong) bcm_strtoull(cp, endp, base);
+}
+
+int
+bcm_atoi(const char *s)
+{
+       return (int)bcm_strtoul(s, NULL, 10);
+}
+
+/* return pointer to location of substring 'needle' in 'haystack' */
+char *
+bcmstrstr(const char *haystack, const char *needle)
+{
+       uint len, nlen;
+       uint i;
+
+       if ((haystack == NULL) || (needle == NULL))
+               return DISCARD_QUAL(haystack, char);
+
+       nlen = (uint)strlen(needle);
+       if (strlen(haystack) < nlen) {
+               return NULL;
+       }
+       len = (uint)strlen(haystack) - nlen + 1u;
+
+       for (i = 0u; i < len; i++)
+               if (memcmp(needle, &haystack[i], nlen) == 0)
+                       return DISCARD_QUAL(&haystack[i], char);
+       return (NULL);
+}
+
+char *
+bcmstrnstr(const char *s, uint s_len, const char *substr, uint substr_len)
+{
+       for (; s_len >= substr_len; s++, s_len--)
+               if (strncmp(s, substr, substr_len) == 0)
+                       return DISCARD_QUAL(s, char);
+
+       return NULL;
+}
+
+char *
+bcmstrcat(char *dest, const char *src)
+{
+       char *p;
+
+       p = dest + strlen(dest);
+
+       while ((*p++ = *src++) != '\0')
+               ;
+
+       return (dest);
+}
+
+char *
+bcmstrncat(char *dest, const char *src, uint size)
+{
+       char *endp;
+       char *p;
+
+       p = dest + strlen(dest);
+       endp = p + size;
+
+       while (p != endp && (*p++ = *src++) != '\0')
+               ;
+
+       return (dest);
+}
+
+/****************************************************************************
+* Function:   bcmstrtok
+*
+* Purpose:
+*  Tokenizes a string. This function is conceptually similiar to ANSI C strtok(),
+*  but allows strToken() to be used by different strings or callers at the same
+*  time. Each call modifies '*string' by substituting a NULL character for the
+*  first delimiter that is encountered, and updates 'string' to point to the char
+*  after the delimiter. Leading delimiters are skipped.
+*
+* Parameters:
+*  string      (mod) Ptr to string ptr, updated by token.
+*  delimiters  (in)  Set of delimiter characters.
+*  tokdelim    (out) Character that delimits the returned token. (May
+*                    be set to NULL if token delimiter is not required).
+*
+* Returns:  Pointer to the next token found. NULL when no more tokens are found.
+*****************************************************************************
+*/
+char *
+bcmstrtok(char **string, const char *delimiters, char *tokdelim)
+{
+       unsigned char *str;
+       unsigned long map[8];
+       int count;
+       char *nextoken;
+
+       if (tokdelim != NULL) {
+               /* Prime the token delimiter */
+               *tokdelim = '\0';
+       }
+
+       /* Clear control map */
+       for (count = 0; count < 8; count++) {
+               map[count] = 0;
+       }
+
+       /* Set bits in delimiter table */
+       do {
+               map[*delimiters >> 5] |= (1 << (*delimiters & 31));
+       }
+       while (*delimiters++);
+
+       str = (unsigned char*)*string;
+
+       /* Find beginning of token (skip over leading delimiters). Note that
+        * there is no token iff this loop sets str to point to the terminal
+        * null (*str == '\0')
+        */
+       while (((map[*str >> 5] & (1 << (*str & 31))) && *str) || (*str == ' ')) {
+               str++;
+       }
+
+       nextoken = (char*)str;
+
+       /* Find the end of the token. If it is not the end of the string,
+        * put a null there.
+        */
+       for (; *str; str++) {
+               if (map[*str >> 5] & (1 << (*str & 31))) {
+                       if (tokdelim != NULL) {
+                               *tokdelim = *str;
+                       }
+
+                       *str++ = '\0';
+                       break;
+               }
+       }
+
+       *string = (char*)str;
+
+       /* Determine if a token has been found. */
+       if (nextoken == (char *) str) {
+               return NULL;
+       }
+       else {
+               return nextoken;
+       }
+}
+
+#define xToLower(C) \
+       ((C >= 'A' && C <= 'Z') ? (char)((int)C - (int)'A' + (int)'a') : C)
+
+/****************************************************************************
+* Function:   bcmstricmp
+*
+* Purpose:    Compare to strings case insensitively.
+*
+* Parameters: s1 (in) First string to compare.
+*             s2 (in) Second string to compare.
+*
+* Returns:    Return 0 if the two strings are equal, -1 if t1 < t2 and 1 if
+*             t1 > t2, when ignoring case sensitivity.
+*****************************************************************************
+*/
+int
+bcmstricmp(const char *s1, const char *s2)
+{
+       char dc, sc;
+
+       while (*s2 && *s1) {
+               dc = xToLower(*s1);
+               sc = xToLower(*s2);
+               if (dc < sc) return -1;
+               if (dc > sc) return 1;
+               s1++;
+               s2++;
+       }
+
+       if (*s1 && !*s2) return 1;
+       if (!*s1 && *s2) return -1;
+       return 0;
+}
+
+/****************************************************************************
+* Function:   bcmstrnicmp
+*
+* Purpose:    Compare to strings case insensitively, upto a max of 'cnt'
+*             characters.
+*
+* Parameters: s1  (in) First string to compare.
+*             s2  (in) Second string to compare.
+*             cnt (in) Max characters to compare.
+*
+* Returns:    Return 0 if the two strings are equal, -1 if t1 < t2 and 1 if
+*             t1 > t2, when ignoring case sensitivity.
+*****************************************************************************
+*/
+int
+bcmstrnicmp(const char* s1, const char* s2, int cnt)
+{
+       char dc, sc;
+
+       while (*s2 && *s1 && cnt) {
+               dc = xToLower(*s1);
+               sc = xToLower(*s2);
+               if (dc < sc) return -1;
+               if (dc > sc) return 1;
+               s1++;
+               s2++;
+               cnt--;
+       }
+
+       if (!cnt) return 0;
+       if (*s1 && !*s2) return 1;
+       if (!*s1 && *s2) return -1;
+       return 0;
+}
+
+/* parse a xx:xx:xx:xx:xx:xx format ethernet address */
+int
+bcm_ether_atoe(const char *p, struct ether_addr *ea)
+{
+       int i = 0;
+       char *ep;
+
+       for (;;) {
+               ea->octet[i++] = (char) bcm_strtoul(p, &ep, 16);
+               p = ep;
+               if (!*p++ || i == 6)
+                       break;
+       }
+
+       return (i == 6);
+}
+
+/* parse a nnn.nnn.nnn.nnn format IPV4 address */
+int
+bcm_atoipv4(const char *p, struct ipv4_addr *ip)
+{
+
+       int i = 0;
+       char *c;
+       for (;;) {
+               ip->addr[i++] = (uint8)bcm_strtoul(p, &c, 0);
+               if (*c++ != '.' || i == IPV4_ADDR_LEN)
+                       break;
+               p = c;
+       }
+       return (i == IPV4_ADDR_LEN);
+}
+#endif /* !BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS */
+
+#if defined(CONFIG_USBRNDIS_RETAIL) || defined(NDIS_MINIPORT_DRIVER)
+/* registry routine buffer preparation utility functions:
+ * parameter order is like strlcpy, but returns count
+ * of bytes copied. Minimum bytes copied is null char(1)/wchar(2)
+ */
+ulong
+wchar2ascii(char *abuf, ushort *wbuf, ushort wbuflen, ulong abuflen)
+{
+       ulong copyct = 1;
+       ushort i;
+
+       if (abuflen == 0)
+               return 0;
+
+       /* wbuflen is in bytes */
+       wbuflen /= sizeof(ushort);
+
+       for (i = 0; i < wbuflen; ++i) {
+               if (--abuflen == 0)
+                       break;
+               *abuf++ = (char) *wbuf++;
+               ++copyct;
+       }
+       *abuf = '\0';
+
+       return copyct;
+}
+#endif /* CONFIG_USBRNDIS_RETAIL || NDIS_MINIPORT_DRIVER */
+
+#ifdef BCM_OBJECT_TRACE
+
+#define BCM_OBJECT_MERGE_SAME_OBJ      0
+
+/* some place may add / remove the object to trace list for Linux: */
+/* add:    osl_alloc_skb dev_alloc_skb skb_realloc_headroom dhd_start_xmit */
+/* remove: osl_pktfree dev_kfree_skb netif_rx */
+
+#if defined(__linux__)
+#define BCM_OBJDBG_COUNT          (1024 * 100)
+static spinlock_t dbgobj_lock;
+#define        BCM_OBJDBG_LOCK_INIT()    spin_lock_init(&dbgobj_lock)
+#define        BCM_OBJDBG_LOCK_DESTROY()
+#define        BCM_OBJDBG_LOCK           spin_lock_irqsave
+#define        BCM_OBJDBG_UNLOCK         spin_unlock_irqrestore
+#else
+#define BCM_OBJDBG_COUNT          (256)
+#define BCM_OBJDBG_LOCK_INIT()
+#define        BCM_OBJDBG_LOCK_DESTROY()
+#define BCM_OBJDBG_LOCK(x, y)
+#define BCM_OBJDBG_UNLOCK(x, y)
+#endif /* else OS */
+
+#define BCM_OBJDBG_ADDTOHEAD      0
+#define BCM_OBJDBG_ADDTOTAIL      1
+
+#define BCM_OBJDBG_CALLER_LEN     32
+struct bcm_dbgobj {
+       struct bcm_dbgobj *prior;
+       struct bcm_dbgobj *next;
+       uint32 flag;
+       void   *obj;
+       uint32 obj_sn;
+       uint32 obj_state;
+       uint32 line;
+       char   caller[BCM_OBJDBG_CALLER_LEN];
+};
+
+static struct bcm_dbgobj *dbgobj_freehead = NULL;
+static struct bcm_dbgobj *dbgobj_freetail = NULL;
+static struct bcm_dbgobj *dbgobj_objhead = NULL;
+static struct bcm_dbgobj *dbgobj_objtail = NULL;
+
+static uint32 dbgobj_sn = 0;
+static int dbgobj_count = 0;
+static struct bcm_dbgobj bcm_dbg_objs[BCM_OBJDBG_COUNT];
+
+void
+bcm_object_trace_init(void)
+{
+       int i = 0;
+       BCM_OBJDBG_LOCK_INIT();
+       memset(&bcm_dbg_objs, 0x00, sizeof(struct bcm_dbgobj) * BCM_OBJDBG_COUNT);
+       dbgobj_freehead = &bcm_dbg_objs[0];
+       dbgobj_freetail = &bcm_dbg_objs[BCM_OBJDBG_COUNT - 1];
+
+       for (i = 0; i < BCM_OBJDBG_COUNT; ++i) {
+               bcm_dbg_objs[i].next = (i == (BCM_OBJDBG_COUNT - 1)) ?
+                       dbgobj_freehead : &bcm_dbg_objs[i + 1];
+               bcm_dbg_objs[i].prior = (i == 0) ?
+                       dbgobj_freetail : &bcm_dbg_objs[i - 1];
+       }
+}
+
+void
+bcm_object_trace_deinit(void)
+{
+       if (dbgobj_objhead || dbgobj_objtail) {
+               printf("bcm_object_trace_deinit: not all objects are released\n");
+               ASSERT(0);
+       }
+       BCM_OBJDBG_LOCK_DESTROY();
+}
+
+static void
+bcm_object_rm_list(struct bcm_dbgobj **head, struct bcm_dbgobj **tail,
+       struct bcm_dbgobj *dbgobj)
+{
+       if ((dbgobj == *head) && (dbgobj == *tail)) {
+               *head = NULL;
+               *tail = NULL;
+       } else if (dbgobj == *head) {
+               *head = (*head)->next;
+       } else if (dbgobj == *tail) {
+               *tail = (*tail)->prior;
+       }
+       dbgobj->next->prior = dbgobj->prior;
+       dbgobj->prior->next = dbgobj->next;
+}
+
+static void
+bcm_object_add_list(struct bcm_dbgobj **head, struct bcm_dbgobj **tail,
+       struct bcm_dbgobj *dbgobj, int addtotail)
+{
+       if (!(*head) && !(*tail)) {
+               *head = dbgobj;
+               *tail = dbgobj;
+               dbgobj->next = dbgobj;
+               dbgobj->prior = dbgobj;
+       } else if ((*head) && (*tail)) {
+               (*tail)->next = dbgobj;
+               (*head)->prior = dbgobj;
+               dbgobj->next = *head;
+               dbgobj->prior = *tail;
+               if (addtotail == BCM_OBJDBG_ADDTOTAIL)
+                       *tail = dbgobj;
+               else
+                       *head = dbgobj;
+       } else {
+               ASSERT(0); /* can't be this case */
+       }
+}
+
+static INLINE void
+bcm_object_movetoend(struct bcm_dbgobj **head, struct bcm_dbgobj **tail,
+       struct bcm_dbgobj *dbgobj, int movetotail)
+{
+       if ((*head) && (*tail)) {
+               if (movetotail == BCM_OBJDBG_ADDTOTAIL) {
+                       if (dbgobj != (*tail)) {
+                               bcm_object_rm_list(head, tail, dbgobj);
+                               bcm_object_add_list(head, tail, dbgobj, movetotail);
+                       }
+               } else {
+                       if (dbgobj != (*head)) {
+                               bcm_object_rm_list(head, tail, dbgobj);
+                               bcm_object_add_list(head, tail, dbgobj, movetotail);
+                       }
+               }
+       } else {
+               ASSERT(0); /* can't be this case */
+       }
+}
+
+void
+bcm_object_trace_opr(void *obj, uint32 opt, const char *caller, int line)
+{
+       struct bcm_dbgobj *dbgobj;
+       unsigned long flags;
+
+       BCM_REFERENCE(flags);
+       BCM_OBJDBG_LOCK(&dbgobj_lock, flags);
+
+       if (opt == BCM_OBJDBG_ADD_PKT ||
+               opt == BCM_OBJDBG_ADD) {
+               dbgobj = dbgobj_objtail;
+               while (dbgobj) {
+                       if (dbgobj->obj == obj) {
+                               printf("bcm_object_trace_opr: obj %p allocated from %s(%d),"
+                                       " allocate again from %s(%d)\n",
+                                       dbgobj->obj,
+                                       dbgobj->caller, dbgobj->line,
+                                       caller, line);
+                               ASSERT(0);
+                               goto EXIT;
+                       }
+                       dbgobj = dbgobj->prior;
+                       if (dbgobj == dbgobj_objtail)
+                               break;
+               }
+
+#if BCM_OBJECT_MERGE_SAME_OBJ
+               dbgobj = dbgobj_freetail;
+               while (dbgobj) {
+                       if (dbgobj->obj == obj) {
+                               goto FREED_ENTRY_FOUND;
+                       }
+                       dbgobj = dbgobj->prior;
+                       if (dbgobj == dbgobj_freetail)
+                               break;
+               }
+#endif /* BCM_OBJECT_MERGE_SAME_OBJ */
+
+               dbgobj = dbgobj_freehead;
+#if BCM_OBJECT_MERGE_SAME_OBJ
+FREED_ENTRY_FOUND:
+#endif /* BCM_OBJECT_MERGE_SAME_OBJ */
+               if (!dbgobj) {
+                       printf("bcm_object_trace_opr: already got %d objects ?????????????????\n",
+                               BCM_OBJDBG_COUNT);
+                       ASSERT(0);
+                       goto EXIT;
+               }
+
+               bcm_object_rm_list(&dbgobj_freehead, &dbgobj_freetail, dbgobj);
+               dbgobj->obj = obj;
+               strlcpy(dbgobj->caller, caller, sizeof(dbgobj->caller));
+               dbgobj->line = line;
+               dbgobj->flag = 0;
+               if (opt == BCM_OBJDBG_ADD_PKT) {
+                       dbgobj->obj_sn = dbgobj_sn++;
+                       dbgobj->obj_state = 0;
+                       /* first 4 bytes is pkt sn */
+                       if (((unsigned long)PKTTAG(obj)) & 0x3)
+                               printf("pkt tag address not aligned by 4: %p\n", PKTTAG(obj));
+                       *(uint32*)PKTTAG(obj) = dbgobj->obj_sn;
+               }
+               bcm_object_add_list(&dbgobj_objhead, &dbgobj_objtail, dbgobj,
+                       BCM_OBJDBG_ADDTOTAIL);
+
+               dbgobj_count++;
+
+       } else if (opt == BCM_OBJDBG_REMOVE) {
+               dbgobj = dbgobj_objtail;
+               while (dbgobj) {
+                       if (dbgobj->obj == obj) {
+                               if (dbgobj->flag) {
+                                       printf("bcm_object_trace_opr: rm flagged obj %p"
+                                               " flag 0x%08x from %s(%d)\n",
+                                               obj, dbgobj->flag, caller, line);
+                               }
+                               bcm_object_rm_list(&dbgobj_objhead, &dbgobj_objtail, dbgobj);
+                               bzero(dbgobj->caller, sizeof(dbgobj->caller));
+                               strlcpy(dbgobj->caller, caller, sizeof(dbgobj->caller));
+                               dbgobj->line = line;
+                               bcm_object_add_list(&dbgobj_freehead, &dbgobj_freetail, dbgobj,
+                                       BCM_OBJDBG_ADDTOTAIL);
+                               dbgobj_count--;
+                               goto EXIT;
+                       }
+                       dbgobj = dbgobj->prior;
+                       if (dbgobj == dbgobj_objtail)
+                               break;
+               }
+
+               dbgobj = dbgobj_freetail;
+               while (dbgobj && dbgobj->obj) {
+                       if (dbgobj->obj == obj) {
+                               printf("bcm_object_trace_opr: obj %p already freed"
+                                       " from from %s(%d),"
+                                       " try free again from %s(%d)\n",
+                                       obj,
+                                       dbgobj->caller, dbgobj->line,
+                                       caller, line);
+                               //ASSERT(0); /* release same obj more than one time? */
+                               goto EXIT;
+                       }
+                       dbgobj = dbgobj->prior;
+                       if (dbgobj == dbgobj_freetail)
+                               break;
+               }
+
+               printf("bcm_object_trace_opr: ################### release none-existing"
+                       " obj %p from %s(%d)\n",
+                       obj, caller, line);
+               //ASSERT(0); /* release same obj more than one time? */
+
+       }
+
+EXIT:
+       BCM_OBJDBG_UNLOCK(&dbgobj_lock, flags);
+       return;
+}
+
+void
+bcm_object_trace_upd(void *obj, void *obj_new)
+{
+       struct bcm_dbgobj *dbgobj;
+       unsigned long flags;
+
+       BCM_REFERENCE(flags);
+       BCM_OBJDBG_LOCK(&dbgobj_lock, flags);
+
+       dbgobj = dbgobj_objtail;
+       while (dbgobj) {
+               if (dbgobj->obj == obj) {
+                       dbgobj->obj = obj_new;
+                       if (dbgobj != dbgobj_objtail) {
+                               bcm_object_movetoend(&dbgobj_objhead, &dbgobj_objtail,
+                                       dbgobj, BCM_OBJDBG_ADDTOTAIL);
+                       }
+                       goto EXIT;
+               }
+               dbgobj = dbgobj->prior;
+               if (dbgobj == dbgobj_objtail)
+                       break;
+       }
+
+EXIT:
+       BCM_OBJDBG_UNLOCK(&dbgobj_lock, flags);
+       return;
+}
+
+void
+bcm_object_trace_chk(void *obj, uint32 chksn, uint32 sn,
+       const char *caller, int line)
+{
+       struct bcm_dbgobj *dbgobj;
+       unsigned long flags;
+
+       BCM_REFERENCE(flags);
+       BCM_OBJDBG_LOCK(&dbgobj_lock, flags);
+
+       dbgobj = dbgobj_objtail;
+       while (dbgobj) {
+               if ((dbgobj->obj == obj) &&
+                       ((!chksn) || (dbgobj->obj_sn == sn))) {
+                       if (dbgobj != dbgobj_objtail) {
+                               bcm_object_movetoend(&dbgobj_objhead, &dbgobj_objtail,
+                                       dbgobj, BCM_OBJDBG_ADDTOTAIL);
+                       }
+                       goto EXIT;
+               }
+               dbgobj = dbgobj->prior;
+               if (dbgobj == dbgobj_objtail)
+                       break;
+       }
+
+       dbgobj = dbgobj_freetail;
+       while (dbgobj) {
+               if ((dbgobj->obj == obj) &&
+                       ((!chksn) || (dbgobj->obj_sn == sn))) {
+                       printf("bcm_object_trace_chk: (%s:%d) obj %p (sn %d state %d)"
+                               " was freed from %s(%d)\n",
+                               caller, line,
+                               dbgobj->obj, dbgobj->obj_sn, dbgobj->obj_state,
+                               dbgobj->caller, dbgobj->line);
+                       goto EXIT;
+               }
+               else if (dbgobj->obj == NULL) {
+                       break;
+               }
+               dbgobj = dbgobj->prior;
+               if (dbgobj == dbgobj_freetail)
+                       break;
+       }
+
+       printf("bcm_object_trace_chk: obj %p not found, check from %s(%d), chksn %s, sn %d\n",
+               obj, caller, line, chksn ? "yes" : "no", sn);
+       dbgobj = dbgobj_objtail;
+       while (dbgobj) {
+               printf("bcm_object_trace_chk: (%s:%d) obj %p sn %d was allocated from %s(%d)\n",
+                               caller, line,
+                               dbgobj->obj, dbgobj->obj_sn, dbgobj->caller, dbgobj->line);
+               dbgobj = dbgobj->prior;
+               if (dbgobj == dbgobj_objtail)
+                       break;
+       }
+
+EXIT:
+       BCM_OBJDBG_UNLOCK(&dbgobj_lock, flags);
+       return;
+}
+
+void
+bcm_object_feature_set(void *obj, uint32 type, uint32 value)
+{
+       struct bcm_dbgobj *dbgobj;
+       unsigned long flags;
+
+       BCM_REFERENCE(flags);
+       BCM_OBJDBG_LOCK(&dbgobj_lock, flags);
+
+       dbgobj = dbgobj_objtail;
+       while (dbgobj) {
+               if (dbgobj->obj == obj) {
+                       if (type == BCM_OBJECT_FEATURE_FLAG) {
+                               if (value & BCM_OBJECT_FEATURE_CLEAR)
+                                       dbgobj->flag &= ~(value);
+                               else
+                                       dbgobj->flag |= (value);
+                       } else if (type == BCM_OBJECT_FEATURE_PKT_STATE) {
+                               dbgobj->obj_state = value;
+                       }
+                       if (dbgobj != dbgobj_objtail) {
+                               bcm_object_movetoend(&dbgobj_objhead, &dbgobj_objtail,
+                                       dbgobj, BCM_OBJDBG_ADDTOTAIL);
+                       }
+                       goto EXIT;
+               }
+               dbgobj = dbgobj->prior;
+               if (dbgobj == dbgobj_objtail)
+                       break;
+       }
+
+       printf("bcm_object_feature_set: obj %p not found in active list\n", obj);
+       ASSERT(0);
+
+EXIT:
+       BCM_OBJDBG_UNLOCK(&dbgobj_lock, flags);
+       return;
+}
+
+int
+bcm_object_feature_get(void *obj, uint32 type, uint32 value)
+{
+       int rtn = 0;
+       struct bcm_dbgobj *dbgobj;
+       unsigned long flags;
+
+       BCM_REFERENCE(flags);
+       BCM_OBJDBG_LOCK(&dbgobj_lock, flags);
+
+       dbgobj = dbgobj_objtail;
+       while (dbgobj) {
+               if (dbgobj->obj == obj) {
+                       if (type == BCM_OBJECT_FEATURE_FLAG) {
+                               rtn = (dbgobj->flag & value) & (~BCM_OBJECT_FEATURE_CLEAR);
+                       }
+                       if (dbgobj != dbgobj_objtail) {
+                               bcm_object_movetoend(&dbgobj_objhead, &dbgobj_objtail,
+                                       dbgobj, BCM_OBJDBG_ADDTOTAIL);
+                       }
+                       goto EXIT;
+               }
+               dbgobj = dbgobj->prior;
+               if (dbgobj == dbgobj_objtail)
+                       break;
+       }
+
+       printf("bcm_object_feature_get: obj %p not found in active list\n", obj);
+       ASSERT(0);
+
+EXIT:
+       BCM_OBJDBG_UNLOCK(&dbgobj_lock, flags);
+       return rtn;
+}
+
+#endif /* BCM_OBJECT_TRACE */
+
+uint8 *
+bcm_write_tlv(int type, const void *data, uint datalen, uint8 *dst)
+{
+       uint8 *new_dst = dst;
+       bcm_tlv_t *dst_tlv = (bcm_tlv_t *)dst;
+
+       /* dst buffer should always be valid */
+       ASSERT(dst);
+
+       /* data len must be within valid range */
+       ASSERT((datalen <= BCM_TLV_MAX_DATA_SIZE));
+
+       /* source data buffer pointer should be valid, unless datalen is 0
+        * meaning no data with this TLV
+        */
+       ASSERT((data != NULL) || (datalen == 0));
+
+       /* only do work if the inputs are valid
+        * - must have a dst to write to AND
+        * - datalen must be within range AND
+        * - the source data pointer must be non-NULL if datalen is non-zero
+        * (this last condition detects datalen > 0 with a NULL data pointer)
+        */
+       if ((dst != NULL) &&
+           ((datalen <= BCM_TLV_MAX_DATA_SIZE)) &&
+           ((data != NULL) || (datalen == 0u))) {
+
+               /* write type, len fields */
+               dst_tlv->id = (uint8)type;
+               dst_tlv->len = (uint8)datalen;
+
+               /* if data is present, copy to the output buffer and update
+                * pointer to output buffer
+                */
+               if (datalen > 0u) {
+
+                       memcpy(dst_tlv->data, data, datalen);
+               }
+
+               /* update the output destination poitner to point past
+                * the TLV written
+                */
+               new_dst = dst + BCM_TLV_HDR_SIZE + datalen;
+       }
+
+       return (new_dst);
+}
+
+uint8 *
+bcm_write_tlv_ext(uint8 type, uint8 ext, const void *data, uint8 datalen, uint8 *dst)
+{
+       uint8 *new_dst = dst;
+       bcm_tlv_ext_t *dst_tlv = (bcm_tlv_ext_t *)dst;
+
+       /* dst buffer should always be valid */
+       ASSERT(dst);
+
+       /* data len must be within valid range */
+       ASSERT(datalen <= BCM_TLV_EXT_MAX_DATA_SIZE);
+
+       /* source data buffer pointer should be valid, unless datalen is 0
+        * meaning no data with this TLV
+        */
+       ASSERT((data != NULL) || (datalen == 0));
+
+       /* only do work if the inputs are valid
+        * - must have a dst to write to AND
+        * - datalen must be within range AND
+        * - the source data pointer must be non-NULL if datalen is non-zero
+        * (this last condition detects datalen > 0 with a NULL data pointer)
+        */
+       if ((dst != NULL) &&
+           (datalen <= BCM_TLV_EXT_MAX_DATA_SIZE) &&
+           ((data != NULL) || (datalen == 0))) {
+
+               /* write type, len fields */
+               dst_tlv->id = (uint8)type;
+               dst_tlv->ext = ext;
+               dst_tlv->len = 1 + (uint8)datalen;
+
+               /* if data is present, copy to the output buffer and update
+                * pointer to output buffer
+                */
+               if (datalen > 0) {
+                       memcpy(dst_tlv->data, data, datalen);
+               }
+
+               /* update the output destination poitner to point past
+                * the TLV written
+                */
+               new_dst = dst + BCM_TLV_EXT_HDR_SIZE + datalen;
+       }
+
+       return (new_dst);
+}
+
+uint8 *
+bcm_write_tlv_safe(int type, const void *data, uint datalen, uint8 *dst, uint dst_maxlen)
+{
+       uint8 *new_dst = dst;
+
+       if ((datalen <= BCM_TLV_MAX_DATA_SIZE)) {
+
+               /* if len + tlv hdr len is more than destlen, don't do anything
+                * just return the buffer untouched
+                */
+               if ((datalen + BCM_TLV_HDR_SIZE) <= dst_maxlen) {
+
+                       new_dst = bcm_write_tlv(type, data, datalen, dst);
+               }
+       }
+
+       return (new_dst);
+}
+
+uint8 *
+bcm_copy_tlv(const void *src, uint8 *dst)
+{
+       uint8 *new_dst = dst;
+       const bcm_tlv_t *src_tlv = (const bcm_tlv_t *)src;
+       uint totlen;
+
+       ASSERT(dst && src);
+       if (dst && src) {
+
+               totlen = BCM_TLV_HDR_SIZE + src_tlv->len;
+               memcpy(dst, src_tlv, totlen);
+               new_dst = dst + totlen;
+       }
+
+       return (new_dst);
+}
+
+uint8 *
+bcm_copy_tlv_safe(const void *src, uint8 *dst, uint dst_maxlen)
+{
+       uint8 *new_dst = dst;
+       const bcm_tlv_t *src_tlv = (const bcm_tlv_t *)src;
+
+       ASSERT(src);
+       if (bcm_valid_tlv(src_tlv, dst_maxlen)) {
+               new_dst = bcm_copy_tlv(src, dst);
+       }
+
+       return (new_dst);
+}
+
+#if !defined(BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS)
+/*******************************************************************************
+ * crc8
+ *
+ * Computes a crc8 over the input data using the polynomial:
+ *
+ *       x^8 + x^7 +x^6 + x^4 + x^2 + 1
+ *
+ * The caller provides the initial value (either CRC8_INIT_VALUE
+ * or the previous returned value) to allow for processing of
+ * discontiguous blocks of data.  When generating the CRC the
+ * caller is responsible for complementing the final return value
+ * and inserting it into the byte stream.  When checking, a final
+ * return value of CRC8_GOOD_VALUE indicates a valid CRC.
+ *
+ * Reference: Dallas Semiconductor Application Note 27
+ *   Williams, Ross N., "A Painless Guide to CRC Error Detection Algorithms",
+ *     ver 3, Aug 1993, ross@guest.adelaide.edu.au, Rocksoft Pty Ltd.,
+ *     ftp://ftp.rocksoft.com/clients/rocksoft/papers/crc_v3.txt
+ *
+ * ****************************************************************************
+ */
+
+static const uint8 crc8_table[256] = {
+    0x00, 0xF7, 0xB9, 0x4E, 0x25, 0xD2, 0x9C, 0x6B,
+    0x4A, 0xBD, 0xF3, 0x04, 0x6F, 0x98, 0xD6, 0x21,
+    0x94, 0x63, 0x2D, 0xDA, 0xB1, 0x46, 0x08, 0xFF,
+    0xDE, 0x29, 0x67, 0x90, 0xFB, 0x0C, 0x42, 0xB5,
+    0x7F, 0x88, 0xC6, 0x31, 0x5A, 0xAD, 0xE3, 0x14,
+    0x35, 0xC2, 0x8C, 0x7B, 0x10, 0xE7, 0xA9, 0x5E,
+    0xEB, 0x1C, 0x52, 0xA5, 0xCE, 0x39, 0x77, 0x80,
+    0xA1, 0x56, 0x18, 0xEF, 0x84, 0x73, 0x3D, 0xCA,
+    0xFE, 0x09, 0x47, 0xB0, 0xDB, 0x2C, 0x62, 0x95,
+    0xB4, 0x43, 0x0D, 0xFA, 0x91, 0x66, 0x28, 0xDF,
+    0x6A, 0x9D, 0xD3, 0x24, 0x4F, 0xB8, 0xF6, 0x01,
+    0x20, 0xD7, 0x99, 0x6E, 0x05, 0xF2, 0xBC, 0x4B,
+    0x81, 0x76, 0x38, 0xCF, 0xA4, 0x53, 0x1D, 0xEA,
+    0xCB, 0x3C, 0x72, 0x85, 0xEE, 0x19, 0x57, 0xA0,
+    0x15, 0xE2, 0xAC, 0x5B, 0x30, 0xC7, 0x89, 0x7E,
+    0x5F, 0xA8, 0xE6, 0x11, 0x7A, 0x8D, 0xC3, 0x34,
+    0xAB, 0x5C, 0x12, 0xE5, 0x8E, 0x79, 0x37, 0xC0,
+    0xE1, 0x16, 0x58, 0xAF, 0xC4, 0x33, 0x7D, 0x8A,
+    0x3F, 0xC8, 0x86, 0x71, 0x1A, 0xED, 0xA3, 0x54,
+    0x75, 0x82, 0xCC, 0x3B, 0x50, 0xA7, 0xE9, 0x1E,
+    0xD4, 0x23, 0x6D, 0x9A, 0xF1, 0x06, 0x48, 0xBF,
+    0x9E, 0x69, 0x27, 0xD0, 0xBB, 0x4C, 0x02, 0xF5,
+    0x40, 0xB7, 0xF9, 0x0E, 0x65, 0x92, 0xDC, 0x2B,
+    0x0A, 0xFD, 0xB3, 0x44, 0x2F, 0xD8, 0x96, 0x61,
+    0x55, 0xA2, 0xEC, 0x1B, 0x70, 0x87, 0xC9, 0x3E,
+    0x1F, 0xE8, 0xA6, 0x51, 0x3A, 0xCD, 0x83, 0x74,
+    0xC1, 0x36, 0x78, 0x8F, 0xE4, 0x13, 0x5D, 0xAA,
+    0x8B, 0x7C, 0x32, 0xC5, 0xAE, 0x59, 0x17, 0xE0,
+    0x2A, 0xDD, 0x93, 0x64, 0x0F, 0xF8, 0xB6, 0x41,
+    0x60, 0x97, 0xD9, 0x2E, 0x45, 0xB2, 0xFC, 0x0B,
+    0xBE, 0x49, 0x07, 0xF0, 0x9B, 0x6C, 0x22, 0xD5,
+    0xF4, 0x03, 0x4D, 0xBA, 0xD1, 0x26, 0x68, 0x9F
+};
+
+#define CRC_INNER_LOOP(n, c, x) \
+       (c) = ((c) >> 8) ^ crc##n##_table[((c) ^ (x)) & 0xff]
+
+uint8
+hndcrc8(
+       const uint8 *pdata,     /* pointer to array of data to process */
+       uint  nbytes,   /* number of input data bytes to process */
+       uint8 crc       /* either CRC8_INIT_VALUE or previous return value */
+)
+{
+       /* hard code the crc loop instead of using CRC_INNER_LOOP macro
+        * to avoid the undefined and unnecessary (uint8 >> 8) operation.
+        */
+       while (nbytes-- > 0)
+               crc = crc8_table[(crc ^ *pdata++) & 0xff];
+
+       return crc;
+}
+
+/*******************************************************************************
+ * crc16
+ *
+ * Computes a crc16 over the input data using the polynomial:
+ *
+ *       x^16 + x^12 +x^5 + 1
+ *
+ * The caller provides the initial value (either CRC16_INIT_VALUE
+ * or the previous returned value) to allow for processing of
+ * discontiguous blocks of data.  When generating the CRC the
+ * caller is responsible for complementing the final return value
+ * and inserting it into the byte stream.  When checking, a final
+ * return value of CRC16_GOOD_VALUE indicates a valid CRC.
+ *
+ * Reference: Dallas Semiconductor Application Note 27
+ *   Williams, Ross N., "A Painless Guide to CRC Error Detection Algorithms",
+ *     ver 3, Aug 1993, ross@guest.adelaide.edu.au, Rocksoft Pty Ltd.,
+ *     ftp://ftp.rocksoft.com/clients/rocksoft/papers/crc_v3.txt
+ *
+ * ****************************************************************************
+ */
+
+static const uint16 crc16_table[256] = {
+    0x0000, 0x1189, 0x2312, 0x329B, 0x4624, 0x57AD, 0x6536, 0x74BF,
+    0x8C48, 0x9DC1, 0xAF5A, 0xBED3, 0xCA6C, 0xDBE5, 0xE97E, 0xF8F7,
+    0x1081, 0x0108, 0x3393, 0x221A, 0x56A5, 0x472C, 0x75B7, 0x643E,
+    0x9CC9, 0x8D40, 0xBFDB, 0xAE52, 0xDAED, 0xCB64, 0xF9FF, 0xE876,
+    0x2102, 0x308B, 0x0210, 0x1399, 0x6726, 0x76AF, 0x4434, 0x55BD,
+    0xAD4A, 0xBCC3, 0x8E58, 0x9FD1, 0xEB6E, 0xFAE7, 0xC87C, 0xD9F5,
+    0x3183, 0x200A, 0x1291, 0x0318, 0x77A7, 0x662E, 0x54B5, 0x453C,
+    0xBDCB, 0xAC42, 0x9ED9, 0x8F50, 0xFBEF, 0xEA66, 0xD8FD, 0xC974,
+    0x4204, 0x538D, 0x6116, 0x709F, 0x0420, 0x15A9, 0x2732, 0x36BB,
+    0xCE4C, 0xDFC5, 0xED5E, 0xFCD7, 0x8868, 0x99E1, 0xAB7A, 0xBAF3,
+    0x5285, 0x430C, 0x7197, 0x601E, 0x14A1, 0x0528, 0x37B3, 0x263A,
+    0xDECD, 0xCF44, 0xFDDF, 0xEC56, 0x98E9, 0x8960, 0xBBFB, 0xAA72,
+    0x6306, 0x728F, 0x4014, 0x519D, 0x2522, 0x34AB, 0x0630, 0x17B9,
+    0xEF4E, 0xFEC7, 0xCC5C, 0xDDD5, 0xA96A, 0xB8E3, 0x8A78, 0x9BF1,
+    0x7387, 0x620E, 0x5095, 0x411C, 0x35A3, 0x242A, 0x16B1, 0x0738,
+    0xFFCF, 0xEE46, 0xDCDD, 0xCD54, 0xB9EB, 0xA862, 0x9AF9, 0x8B70,
+    0x8408, 0x9581, 0xA71A, 0xB693, 0xC22C, 0xD3A5, 0xE13E, 0xF0B7,
+    0x0840, 0x19C9, 0x2B52, 0x3ADB, 0x4E64, 0x5FED, 0x6D76, 0x7CFF,
+    0x9489, 0x8500, 0xB79B, 0xA612, 0xD2AD, 0xC324, 0xF1BF, 0xE036,
+    0x18C1, 0x0948, 0x3BD3, 0x2A5A, 0x5EE5, 0x4F6C, 0x7DF7, 0x6C7E,
+    0xA50A, 0xB483, 0x8618, 0x9791, 0xE32E, 0xF2A7, 0xC03C, 0xD1B5,
+    0x2942, 0x38CB, 0x0A50, 0x1BD9, 0x6F66, 0x7EEF, 0x4C74, 0x5DFD,
+    0xB58B, 0xA402, 0x9699, 0x8710, 0xF3AF, 0xE226, 0xD0BD, 0xC134,
+    0x39C3, 0x284A, 0x1AD1, 0x0B58, 0x7FE7, 0x6E6E, 0x5CF5, 0x4D7C,
+    0xC60C, 0xD785, 0xE51E, 0xF497, 0x8028, 0x91A1, 0xA33A, 0xB2B3,
+    0x4A44, 0x5BCD, 0x6956, 0x78DF, 0x0C60, 0x1DE9, 0x2F72, 0x3EFB,
+    0xD68D, 0xC704, 0xF59F, 0xE416, 0x90A9, 0x8120, 0xB3BB, 0xA232,
+    0x5AC5, 0x4B4C, 0x79D7, 0x685E, 0x1CE1, 0x0D68, 0x3FF3, 0x2E7A,
+    0xE70E, 0xF687, 0xC41C, 0xD595, 0xA12A, 0xB0A3, 0x8238, 0x93B1,
+    0x6B46, 0x7ACF, 0x4854, 0x59DD, 0x2D62, 0x3CEB, 0x0E70, 0x1FF9,
+    0xF78F, 0xE606, 0xD49D, 0xC514, 0xB1AB, 0xA022, 0x92B9, 0x8330,
+    0x7BC7, 0x6A4E, 0x58D5, 0x495C, 0x3DE3, 0x2C6A, 0x1EF1, 0x0F78
+};
+
+uint16
+hndcrc16(
+    const uint8 *pdata,  /* pointer to array of data to process */
+    uint nbytes, /* number of input data bytes to process */
+    uint16 crc     /* either CRC16_INIT_VALUE or previous return value */
+)
+{
+       while (nbytes-- > 0)
+               CRC_INNER_LOOP(16, crc, *pdata++);
+       return crc;
+}
+
+static const uint32 crc32_table[256] = {
+    0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA,
+    0x076DC419, 0x706AF48F, 0xE963A535, 0x9E6495A3,
+    0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988,
+    0x09B64C2B, 0x7EB17CBD, 0xE7B82D07, 0x90BF1D91,
+    0x1DB71064, 0x6AB020F2, 0xF3B97148, 0x84BE41DE,
+    0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7,
+    0x136C9856, 0x646BA8C0, 0xFD62F97A, 0x8A65C9EC,
+    0x14015C4F, 0x63066CD9, 0xFA0F3D63, 0x8D080DF5,
+    0x3B6E20C8, 0x4C69105E, 0xD56041E4, 0xA2677172,
+    0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B,
+    0x35B5A8FA, 0x42B2986C, 0xDBBBC9D6, 0xACBCF940,
+    0x32D86CE3, 0x45DF5C75, 0xDCD60DCF, 0xABD13D59,
+    0x26D930AC, 0x51DE003A, 0xC8D75180, 0xBFD06116,
+    0x21B4F4B5, 0x56B3C423, 0xCFBA9599, 0xB8BDA50F,
+    0x2802B89E, 0x5F058808, 0xC60CD9B2, 0xB10BE924,
+    0x2F6F7C87, 0x58684C11, 0xC1611DAB, 0xB6662D3D,
+    0x76DC4190, 0x01DB7106, 0x98D220BC, 0xEFD5102A,
+    0x71B18589, 0x06B6B51F, 0x9FBFE4A5, 0xE8B8D433,
+    0x7807C9A2, 0x0F00F934, 0x9609A88E, 0xE10E9818,
+    0x7F6A0DBB, 0x086D3D2D, 0x91646C97, 0xE6635C01,
+    0x6B6B51F4, 0x1C6C6162, 0x856530D8, 0xF262004E,
+    0x6C0695ED, 0x1B01A57B, 0x8208F4C1, 0xF50FC457,
+    0x65B0D9C6, 0x12B7E950, 0x8BBEB8EA, 0xFCB9887C,
+    0x62DD1DDF, 0x15DA2D49, 0x8CD37CF3, 0xFBD44C65,
+    0x4DB26158, 0x3AB551CE, 0xA3BC0074, 0xD4BB30E2,
+    0x4ADFA541, 0x3DD895D7, 0xA4D1C46D, 0xD3D6F4FB,
+    0x4369E96A, 0x346ED9FC, 0xAD678846, 0xDA60B8D0,
+    0x44042D73, 0x33031DE5, 0xAA0A4C5F, 0xDD0D7CC9,
+    0x5005713C, 0x270241AA, 0xBE0B1010, 0xC90C2086,
+    0x5768B525, 0x206F85B3, 0xB966D409, 0xCE61E49F,
+    0x5EDEF90E, 0x29D9C998, 0xB0D09822, 0xC7D7A8B4,
+    0x59B33D17, 0x2EB40D81, 0xB7BD5C3B, 0xC0BA6CAD,
+    0xEDB88320, 0x9ABFB3B6, 0x03B6E20C, 0x74B1D29A,
+    0xEAD54739, 0x9DD277AF, 0x04DB2615, 0x73DC1683,
+    0xE3630B12, 0x94643B84, 0x0D6D6A3E, 0x7A6A5AA8,
+    0xE40ECF0B, 0x9309FF9D, 0x0A00AE27, 0x7D079EB1,
+    0xF00F9344, 0x8708A3D2, 0x1E01F268, 0x6906C2FE,
+    0xF762575D, 0x806567CB, 0x196C3671, 0x6E6B06E7,
+    0xFED41B76, 0x89D32BE0, 0x10DA7A5A, 0x67DD4ACC,
+    0xF9B9DF6F, 0x8EBEEFF9, 0x17B7BE43, 0x60B08ED5,
+    0xD6D6A3E8, 0xA1D1937E, 0x38D8C2C4, 0x4FDFF252,
+    0xD1BB67F1, 0xA6BC5767, 0x3FB506DD, 0x48B2364B,
+    0xD80D2BDA, 0xAF0A1B4C, 0x36034AF6, 0x41047A60,
+    0xDF60EFC3, 0xA867DF55, 0x316E8EEF, 0x4669BE79,
+    0xCB61B38C, 0xBC66831A, 0x256FD2A0, 0x5268E236,
+    0xCC0C7795, 0xBB0B4703, 0x220216B9, 0x5505262F,
+    0xC5BA3BBE, 0xB2BD0B28, 0x2BB45A92, 0x5CB36A04,
+    0xC2D7FFA7, 0xB5D0CF31, 0x2CD99E8B, 0x5BDEAE1D,
+    0x9B64C2B0, 0xEC63F226, 0x756AA39C, 0x026D930A,
+    0x9C0906A9, 0xEB0E363F, 0x72076785, 0x05005713,
+    0x95BF4A82, 0xE2B87A14, 0x7BB12BAE, 0x0CB61B38,
+    0x92D28E9B, 0xE5D5BE0D, 0x7CDCEFB7, 0x0BDBDF21,
+    0x86D3D2D4, 0xF1D4E242, 0x68DDB3F8, 0x1FDA836E,
+    0x81BE16CD, 0xF6B9265B, 0x6FB077E1, 0x18B74777,
+    0x88085AE6, 0xFF0F6A70, 0x66063BCA, 0x11010B5C,
+    0x8F659EFF, 0xF862AE69, 0x616BFFD3, 0x166CCF45,
+    0xA00AE278, 0xD70DD2EE, 0x4E048354, 0x3903B3C2,
+    0xA7672661, 0xD06016F7, 0x4969474D, 0x3E6E77DB,
+    0xAED16A4A, 0xD9D65ADC, 0x40DF0B66, 0x37D83BF0,
+    0xA9BCAE53, 0xDEBB9EC5, 0x47B2CF7F, 0x30B5FFE9,
+    0xBDBDF21C, 0xCABAC28A, 0x53B39330, 0x24B4A3A6,
+    0xBAD03605, 0xCDD70693, 0x54DE5729, 0x23D967BF,
+    0xB3667A2E, 0xC4614AB8, 0x5D681B02, 0x2A6F2B94,
+    0xB40BBE37, 0xC30C8EA1, 0x5A05DF1B, 0x2D02EF8D
+};
+
+/*
+ * crc input is CRC32_INIT_VALUE for a fresh start, or previous return value if
+ * accumulating over multiple pieces.
+ */
+uint32
+hndcrc32(const uint8 *pdata, uint nbytes, uint32 crc)
+{
+       const uint8 *pend;
+       pend = pdata + nbytes;
+       while (pdata < pend)
+               CRC_INNER_LOOP(32, crc, *pdata++);
+
+       return crc;
+}
+
+#ifdef NOT_YET
+#define CLEN   1499    /*  CRC Length */
+#define CBUFSIZ                (CLEN+4)
+#define CNBUFS         5 /* # of bufs */
+
+void
+testcrc32(void)
+{
+       uint j, k, l;
+       uint8 *buf;
+       uint len[CNBUFS];
+       uint32 crcr;
+       uint32 crc32tv[CNBUFS] =
+               {0xd2cb1faa, 0xd385c8fa, 0xf5b4f3f3, 0x55789e20, 0x00343110};
+
+       ASSERT((buf = MALLOC(CBUFSIZ*CNBUFS)) != NULL);
+
+       /* step through all possible alignments */
+       for (l = 0; l <= 4; l++) {
+               for (j = 0; j < CNBUFS; j++) {
+                       len[j] = CLEN;
+                       for (k = 0; k < len[j]; k++)
+                               *(buf + j*CBUFSIZ + (k+l)) = (j+k) & 0xff;
+               }
+
+               for (j = 0; j < CNBUFS; j++) {
+                       crcr = crc32(buf + j*CBUFSIZ + l, len[j], CRC32_INIT_VALUE);
+                       ASSERT(crcr == crc32tv[j]);
+               }
+       }
+
+       MFREE(buf, CBUFSIZ*CNBUFS);
+       return;
+}
+#endif /* NOT_YET */
+
+/*
+ * Advance from the current 1-byte tag/1-byte length/variable-length value
+ * triple, to the next, returning a pointer to the next.
+ * If the current or next TLV is invalid (does not fit in given buffer length),
+ * NULL is returned.
+ * *buflen is not modified if the TLV elt parameter is invalid, or is decremented
+ * by the TLV parameter's length if it is valid.
+ */
+bcm_tlv_t *
+bcm_next_tlv(const bcm_tlv_t *elt, uint *buflen)
+{
+       uint len;
+
+       COV_TAINTED_DATA_SINK(buflen);
+       COV_NEG_SINK(buflen);
+
+       /* validate current elt */
+       if (!bcm_valid_tlv(elt, *buflen)) {
+               return NULL;
+       }
+
+       /* advance to next elt */
+       len = TLV_HDR_LEN + elt->len;
+       elt = (const  bcm_tlv_t*)((const uint8 *)elt + len);
+
+#if defined(__COVERITY__)
+       /* The 'len' value is tainted in Coverity because it is read from the tainted data pointed
+        * to by 'elt'.  However, bcm_valid_tlv() verifies that the elt pointer is a valid element,
+        * so its length, len = (TLV_HDR_LEN + elt->len), is in the bounds of the buffer.
+        * Clearing the tainted attribute of 'len' for Coverity.
+        */
+       __coverity_tainted_data_sanitize__(len);
+       if (len > *buflen) {
+               return NULL;
+       }
+#endif /* __COVERITY__ */
+
+       *buflen -= len;
+
+       /* validate next elt */
+       if (!bcm_valid_tlv(elt, *buflen)) {
+               return NULL;
+       }
+
+       COV_TAINTED_DATA_ARG(elt);
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       return (bcm_tlv_t *)(elt);
+       GCC_DIAGNOSTIC_POP();
+}
+
+/**
+ * Advance a const tlv buffer pointer and length up to the given tlv element pointer
+ * 'elt'.  The function checks that elt is a valid tlv; the elt pointer and data
+ * are all in the range of the buffer/length.
+ *
+ * @param elt      pointer to a valid bcm_tlv_t in the buffer
+ * @param buffer   pointer to a tlv buffer
+ * @param buflen   length of the buffer in bytes
+ *
+ * On return, if elt is not a tlv in the buffer bounds, the *buffer parameter
+ * will be set to NULL and *buflen parameter will be set to zero.  Otherwise,
+ * *buffer will point to elt, and *buflen will have been adjusted by the the
+ * difference between *buffer and elt.
+ */
+void
+bcm_tlv_buffer_advance_to(const bcm_tlv_t *elt, const uint8 **buffer, uint *buflen)
+{
+       uint new_buflen;
+       const uint8 *new_buffer;
+
+       /* model the input length value as a tainted and negative sink so
+        * Coverity will complain about unvalidated or possibly length values
+        */
+       COV_TAINTED_DATA_SINK(*buflen);
+       COV_NEG_SINK(*buflen);
+
+       new_buffer = (const uint8*)elt;
+
+       /* make sure the input buffer pointer is non-null, that (buffer + buflen) does not wrap,
+        * and that the elt pointer is in the range of [buffer, buffer + buflen]
+        */
+       if ((*buffer != NULL) &&
+           ((uintptr)*buffer < ((uintptr)*buffer + *buflen)) &&
+           (new_buffer >= *buffer) &&
+           (new_buffer < (*buffer + *buflen))) {
+               /* delta between buffer and new_buffer is <= *buflen, so truncating cast to uint
+                * from ptrdiff is ok
+                */
+               uint delta = (uint)(new_buffer - *buffer);
+
+               /* New buffer length is old len minus the delta from the buffer start to elt.
+                * The check just above guarantees that the subtractions does not underflow.
+                */
+               new_buflen = *buflen - delta;
+
+               /* validate current elt */
+               if (bcm_valid_tlv(elt, new_buflen)) {
+                       /* All good, so update the input/output parameters */
+                       *buffer = new_buffer;
+                       *buflen = new_buflen;
+                       return;
+               }
+       }
+
+       /* something did not check out, clear out the buffer info */
+       *buffer = NULL;
+       *buflen = 0;
+
+       return;
+}
+
+/**
+ * Advance a const tlv buffer pointer and length past the given tlv element pointer
+ * 'elt'.  The function checks that elt is a valid tlv; the elt pointer and data
+ * are all in the range of the buffer/length.  The function also checks that the
+ * remaining buffer starts with a valid tlv.
+ *
+ * @param elt      pointer to a valid bcm_tlv_t in the buffer
+ * @param buffer   pointer to a tlv buffer
+ * @param buflen   length of the buffer in bytes
+ *
+ * On return, if elt is not a tlv in the buffer bounds, or the remaining buffer
+ * following the elt does not begin with a tlv in the buffer bounds, the *buffer
+ * parameter will be set to NULL and *buflen parameter will be set to zero.
+ * Otherwise, *buffer will point to the first byte past elt, and *buflen will
+ * have the remaining buffer length.
+ */
+void
+bcm_tlv_buffer_advance_past(const bcm_tlv_t *elt, const uint8 **buffer, uint *buflen)
+{
+       /* Start by advancing the buffer up to the given elt */
+       bcm_tlv_buffer_advance_to(elt, buffer, buflen);
+
+       /* if that did not work, bail out */
+       if (*buflen == 0) {
+               return;
+       }
+
+#if defined(__COVERITY__)
+       /* The elt has been verified by bcm_tlv_buffer_advance_to() to be a valid element,
+        * so its elt->len is in the bounds of the buffer. The following check prevents
+        * Coverity from flagging the (elt->data + elt->len) statement below as using a
+        * tainted elt->len to index into array 'elt->data'.
+        */
+       if (elt->len > *buflen) {
+               return;
+       }
+#endif /* __COVERITY__ */
+
+       /* We know we are advanced up to a good tlv.
+        * Now just advance to the following tlv.
+        */
+       elt = (const bcm_tlv_t*)(elt->data + elt->len);
+
+       bcm_tlv_buffer_advance_to(elt, buffer, buflen);
+
+       return;
+}
+
+/*
+ * Traverse a string of 1-byte tag/1-byte length/variable-length value
+ * triples, returning a pointer to the substring whose first element
+ * matches tag
+ */
+bcm_tlv_t *
+bcm_parse_tlvs(const void *buf, uint buflen, uint key)
+{
+       const bcm_tlv_t *elt;
+       uint totlen;
+
+       COV_TAINTED_DATA_SINK(buflen);
+       COV_NEG_SINK(buflen);
+
+       if ((elt = (const bcm_tlv_t*)buf) == NULL) {
+               return NULL;
+       }
+       totlen = buflen;
+
+       /* find tagged parameter */
+       while (totlen >= TLV_HDR_LEN) {
+               uint len = elt->len;
+
+               /* check if elt overruns buffer */
+               if (totlen < (len + TLV_HDR_LEN)) {
+                       break;
+               }
+               /* did we find the ID? */
+               if ((elt->id == key)) {
+                       COV_TAINTED_DATA_ARG(elt);
+
+                       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                       return (bcm_tlv_t *)(elt);
+                       GCC_DIAGNOSTIC_POP();
+               }
+               elt = (const bcm_tlv_t*)((const uint8*)elt + (len + TLV_HDR_LEN));
+               totlen -= (len + TLV_HDR_LEN);
+       }
+
+       return NULL;
+}
+
+/*
+ * Traverse a string of 1-byte tag/1-byte length/variable-length value
+ * triples, returning a pointer to the substring whose first element
+ * matches tag.
+ * The 'advance' parmeter specifies what to do to the parse buf/buflen values if a
+ * matching tlv is found:
+ *     BCM_TLV_ADVANCE_NONE - do nothing
+ *     BCM_TLV_ADVANCE_TO - move the buf up to the discovered tlv, and adjust buflen.
+ *     BCM_TLV_ADVANCE_PAST - move the buf past the discovered tlb, and adjust buflen.
+ * If a tlv is not found, no changes are made to buf/buflen
+ *
+ */
+const bcm_tlv_t *
+bcm_parse_tlvs_advance(const uint8 **buf, uint *buflen, uint key, bcm_tlv_advance_mode_t advance)
+{
+       const bcm_tlv_t *elt;
+
+       elt = bcm_parse_tlvs(*buf, *buflen, key);
+
+       if (elt == NULL) {
+               return elt;
+       }
+
+       if (advance == BCM_TLV_ADVANCE_TO) {
+               bcm_tlv_buffer_advance_to(elt, buf, buflen);
+       } else if (advance == BCM_TLV_ADVANCE_PAST) {
+               bcm_tlv_buffer_advance_past(elt, buf, buflen);
+       } else if (advance == BCM_TLV_ADVANCE_NONE) {
+               /* nothing to do */
+       } else {
+               /* there are only 3 modes, but just in case, zero the parse buffer pointer and
+                * length to prevent infinite loops in callers that expect progress.
+                */
+               ASSERT(0);
+               *buf = NULL;
+               *buflen = 0;
+       }
+
+       return elt;
+}
+
+bcm_tlv_t *
+bcm_parse_tlvs_dot11(const void *buf, uint buflen, uint key, bool id_ext)
+{
+       bcm_tlv_t *elt;
+       uint totlen;
+
+       COV_TAINTED_DATA_SINK(buflen);
+       COV_NEG_SINK(buflen);
+
+       /*
+          ideally, we don't want to do that, but returning a const pointer
+          from these parse function spreads casting everywhere in the code
+       */
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       elt = (bcm_tlv_t*)buf;
+       GCC_DIAGNOSTIC_POP();
+
+       totlen = buflen;
+
+       /* find tagged parameter */
+       while (totlen >= TLV_HDR_LEN) {
+               uint len = elt->len;
+
+               /* validate remaining totlen */
+               if (totlen < (len + TLV_HDR_LEN)) {
+                       break;
+               }
+
+               do {
+                       if (id_ext) {
+                               if (!DOT11_MNG_IE_ID_EXT_MATCH(elt, key))
+                                       break;
+                       } else if (elt->id != key) {
+                               break;
+                       }
+
+                       COV_TAINTED_DATA_ARG(elt);
+
+                       return (bcm_tlv_t *)(elt);              /* a match */
+               } while (0);
+
+               elt = (bcm_tlv_t*)((uint8*)elt + (len + TLV_HDR_LEN));
+               totlen -= (len + TLV_HDR_LEN);
+       }
+
+       return NULL;
+}
+
+/*
+ * Traverse a string of 1-byte tag/1-byte length/variable-length value
+ * triples, returning a pointer to the substring whose first element
+ * matches tag
+ * return NULL if not found or length field < min_varlen
+ */
+bcm_tlv_t *
+bcm_parse_tlvs_min_bodylen(const  void *buf, uint buflen, uint key, uint min_bodylen)
+{
+       bcm_tlv_t * ret;
+       ret = bcm_parse_tlvs(buf, buflen, key);
+       if (ret == NULL || ret->len < min_bodylen) {
+               return NULL;
+       }
+       return ret;
+}
+
+/*
+ * Traverse a string of 1-byte tag/1-byte length/variable-length value
+ * triples, returning a pointer to the substring whose first element
+ * matches tag
+ * return NULL if not found or tlv size > max_len or < min_len
+ */
+bcm_tlv_t *
+bcm_parse_tlvs_minmax_len(const  void *buf, uint buflen, uint key,
+       uint min_len, uint max_len)
+{
+       bcm_tlv_t * ret;
+       ret = bcm_parse_tlvs(buf, buflen, key);
+       if (ret == NULL ||
+               (BCM_TLV_SIZE(ret) > max_len) ||
+               (BCM_TLV_SIZE(ret) < min_len)) {
+               return NULL;
+       }
+       return ret;
+}
+
+/*
+ * Traverse a string of 1-byte tag/1-byte length/variable-length value
+ * triples, returning a pointer to the substring whose first element
+ * matches tag.  Stop parsing when we see an element whose ID is greater
+ * than the target key.
+ */
+const  bcm_tlv_t *
+bcm_parse_ordered_tlvs(const  void *buf, uint buflen, uint key)
+{
+       const  bcm_tlv_t *elt;
+       uint totlen;
+
+       COV_TAINTED_DATA_SINK(buflen);
+       COV_NEG_SINK(buflen);
+
+       elt = (const  bcm_tlv_t*)buf;
+       totlen = buflen;
+
+       /* find tagged parameter */
+       while (totlen >= TLV_HDR_LEN) {
+               uint id = elt->id;
+               uint len = elt->len;
+
+               /* Punt if we start seeing IDs > than target key */
+               if (id > key) {
+                       return (NULL);
+               }
+
+               /* validate remaining totlen */
+               if (totlen < (len + TLV_HDR_LEN)) {
+                       break;
+               }
+               if (id == key) {
+                       COV_TAINTED_DATA_ARG(elt);
+                       return (elt);
+               }
+
+               elt = (const  bcm_tlv_t*)((const  uint8*)elt + (len + TLV_HDR_LEN));
+               totlen -= (len + TLV_HDR_LEN);
+       }
+       return NULL;
+}
+#endif /* !BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS */
+
+uint
+bcm_format_field(const bcm_bit_desc_ex_t *bd, uint32 flags, char* buf, uint len)
+{
+       uint i, slen = 0;
+       uint32 bit, mask;
+       const char *name;
+       mask = bd->mask;
+       if (len < 2 || !buf)
+               return 0;
+
+       buf[0] = '\0';
+
+       for (i = 0;  (name = bd->bitfield[i].name) != NULL; i++) {
+               bit = bd->bitfield[i].bit;
+               if ((flags & mask) == bit) {
+                       slen = (int)strlen(name);
+                       if (memcpy_s(buf, len, name, slen + 1) != BCME_OK) {
+                               slen = 0;
+                       }
+                       break;
+               }
+       }
+       return slen;
+}
+
+int
+bcm_format_flags(const bcm_bit_desc_t *bd, uint32 flags, char* buf, uint len)
+{
+       int i;
+       char* p = buf;
+       char hexstr[16];
+       uint slen = 0, nlen = 0;
+       uint32 bit;
+       const char* name;
+
+       if (len < 2 || !buf)
+               return 0;
+
+       buf[0] = '\0';
+
+       for (i = 0; flags != 0; i++) {
+               bit = bd[i].bit;
+               name = bd[i].name;
+               if (bit == 0 && flags != 0) {
+                       /* print any unnamed bits */
+                       snprintf(hexstr, 16, "0x%X", flags);
+                       name = hexstr;
+                       flags = 0;      /* exit loop */
+               } else if ((flags & bit) == 0)
+                       continue;
+               flags &= ~bit;
+               nlen = (int)strlen(name);
+               slen += nlen;
+               /* count btwn flag space */
+               if (flags != 0)
+                       slen += 1;
+               if (memcpy_s(p, len, name, nlen + 1) != BCME_OK) {
+                       break;
+               }
+               p += nlen;
+               /* copy btwn flag space and NULL char */
+               if (flags != 0)
+                       p += snprintf(p, 2, " ");
+       }
+
+       /* indicate the str was too short */
+       if (flags != 0) {
+               p += snprintf(p, 2, ">");
+       }
+
+       return (int)(p - buf);
+}
+
+/* print out whcih bits in octet array 'addr' are set. bcm_bit_desc_t:bit is a bit offset. */
+int
+bcm_format_octets(const bcm_bit_desc_t *bd, uint bdsz,
+       const uint8 *addr, uint size, char *buf, uint len)
+{
+       uint i;
+       char *p = buf;
+       uint slen = 0, nlen = 0;
+       uint32 bit;
+       const char* name;
+       bool more = FALSE;
+
+       BCM_REFERENCE(size);
+
+       if (len < 2 || !buf)
+               return 0;
+
+       buf[0] = '\0';
+
+       for (i = 0; i < bdsz; i++) {
+               bit = bd[i].bit;
+               name = bd[i].name;
+               if (isset(addr, bit)) {
+                       nlen = (int)strlen(name);
+                       slen += nlen;
+                       /* need SPACE - for simplicity */
+                       slen += 1;
+                       /* need NULL as well */
+                       if (len < slen + 1) {
+                               more = TRUE;
+                               break;
+                       }
+                       memcpy(p, name, nlen);
+                       p += nlen;
+                       p[0] = ' ';
+                       p += 1;
+                       p[0] = '\0';
+               }
+       }
+
+       if (more) {
+               p[0] = '>';
+               p += 1;
+               p[0] = '\0';
+       }
+
+       return (int)(p - buf);
+}
+
+/* Transform an hexadecimal string into binary.
+ * Output is limited to 64K.
+ * hex : string
+ * hex_len : string length
+ * buf : allocated output buffer
+ * buf_len : allocated size
+ * return : copied length, if successfull, 0 if error.
+ */
+uint16
+bcmhex2bin(const uint8* hex, uint hex_len, uint8 *buf, uint buf_len)
+{
+               uint i = 0;
+               uint16 out_len;
+               char tmp[] = "XX";
+               if (hex_len % 2) {
+                       /* hex_len not even */
+                       return 0;
+               }
+               /* check for hex radix */
+               if ((hex[0] == '0') && ((hex[1] == 'x') || (hex[1] == 'X'))) {
+                       hex += 2;
+                       hex_len -= 2;
+               }
+               if (hex_len/2 > 0xFFFF) {
+                       /* exceed 64K buffer capacity */
+                       return 0;
+               }
+               if ((out_len = hex_len/2) > buf_len) {
+                       /* buf too short */
+                       return 0;
+               }
+               do {
+                       tmp[0] = *hex++;
+                       tmp[1] = *hex++;
+                       if (!bcm_isxdigit(tmp[0]) || !bcm_isxdigit(tmp[1])) {
+                               /* char is not a 256-bit hex number     */
+                               return 0;
+                       }
+                       /* okay so far; make this piece a number */
+                       buf[i] = (uint8) bcm_strtoul(tmp, NULL, 16);
+               } while (++i < out_len);
+               return out_len;
+}
+
+/* print bytes formatted as hex to a string. return the resulting string length */
+int
+bcm_format_hex(char *str, const void *bytes, uint len)
+{
+       uint i;
+       char *p = str;
+       const uint8 *src = (const uint8*)bytes;
+
+       for (i = 0; i < len; i++) {
+               p += snprintf(p, 3, "%02X", *src);
+               src++;
+       }
+       return (int)(p - str);
+}
+
+/* pretty hex print a contiguous buffer */
+void
+prhex(const char *msg, const uchar *buf, uint nbytes)
+{
+       char line[128], *p;
+       uint len = sizeof(line);
+       int nchar;
+       uint i;
+
+       if (msg && (msg[0] != '\0'))
+               printf("%s:\n", msg);
+
+       p = line;
+       for (i = 0; i < nbytes; i++) {
+               if (i % 16 == 0) {
+                       nchar = snprintf(p, len, "  %04x: ", i);        /* line prefix */
+                       p += nchar;
+                       len -= nchar;
+               }
+               if (len > 0) {
+                       nchar = snprintf(p, len, "%02x ", buf[i]);
+                       p += nchar;
+                       len -= nchar;
+               }
+
+               if (i % 16 == 15) {
+                       printf("%s\n", line);           /* flush line */
+                       p = line;
+                       len = sizeof(line);
+               }
+       }
+
+       /* flush last partial line */
+       if (p != line)
+               printf("%s\n", line);
+}
+
+static const char *crypto_algo_names[] = {
+       "NONE",
+       "WEP1",
+       "TKIP",
+       "WEP128",
+       "AES_CCM",
+       "AES_OCB_MSDU",
+       "AES_OCB_MPDU",
+       "NALG",
+       "UNDEF",
+       "UNDEF",
+       "UNDEF",
+
+#ifdef BCMWAPI_WAI
+       "WAPI",
+#endif /* BCMWAPI_WAI */
+
+#ifndef BCMWAPI_WAI
+       "UNDEF",
+#endif
+       "PMK",
+       "BIP",
+       "AES_GCM",
+       "AES_CCM256",
+       "AES_GCM256",
+       "BIP_CMAC256",
+       "BIP_GMAC",
+       "BIP_GMAC256",
+       "UNDEF"
+};
+
+const char *
+bcm_crypto_algo_name(uint algo)
+{
+       return (algo < ARRAYSIZE(crypto_algo_names)) ? crypto_algo_names[algo] : "ERR";
+}
+
+char *
+bcm_chipname(uint chipid, char *buf, uint len)
+{
+       const char *fmt;
+
+       fmt = ((chipid > 0xa000) || (chipid < 0x4000)) ? "%d" : "%x";
+       snprintf(buf, len, fmt, chipid);
+       return buf;
+}
+
+/* Produce a human-readable string for boardrev */
+char *
+bcm_brev_str(uint32 brev, char *buf)
+{
+       if (brev < 0x100)
+               snprintf(buf, 8, "%d.%d", (brev & 0xf0) >> 4, brev & 0xf);
+       else
+               snprintf(buf, 8, "%c%03x", ((brev & 0xf000) == 0x1000) ? 'P' : 'A', brev & 0xfff);
+
+       return (buf);
+}
+
+#define BUFSIZE_TODUMP_ATONCE 128 /* Buffer size */
+
+/* dump large strings to console */
+void
+printbig(char *buf)
+{
+       uint len, max_len;
+       char c;
+
+       len = (uint)strlen(buf);
+
+       max_len = BUFSIZE_TODUMP_ATONCE;
+
+       while (len > max_len) {
+               c = buf[max_len];
+               buf[max_len] = '\0';
+               printf("%s", buf);
+               buf[max_len] = c;
+
+               buf += max_len;
+               len -= max_len;
+       }
+       /* print the remaining string */
+       printf("%s\n", buf);
+       return;
+}
+
+/* routine to dump fields in a fileddesc structure */
+uint
+bcmdumpfields(bcmutl_rdreg_rtn read_rtn, void *arg0, uint arg1, struct fielddesc *fielddesc_array,
+       char *buf, uint32 bufsize)
+{
+       uint  filled_len;
+       int len;
+       struct fielddesc *cur_ptr;
+
+       filled_len = 0;
+       cur_ptr = fielddesc_array;
+
+       while (bufsize > 1) {
+               if (cur_ptr->nameandfmt == NULL)
+                       break;
+               len = snprintf(buf, bufsize, cur_ptr->nameandfmt,
+                              read_rtn(arg0, arg1, cur_ptr->offset));
+               /* check for snprintf overflow or error */
+               if (len < 0 || (uint32)len >= bufsize)
+                       len = bufsize - 1;
+               buf += len;
+               bufsize -= len;
+               filled_len += len;
+               cur_ptr++;
+       }
+       return filled_len;
+}
+
+uint
+bcm_mkiovar(const char *name, const char *data, uint datalen, char *buf, uint buflen)
+{
+       uint len;
+
+       len = (uint)strlen(name) + 1;
+
+       if ((len + datalen) > buflen)
+               return 0;
+
+       strlcpy(buf, name, buflen);
+
+       /* append data onto the end of the name string */
+       if (data && datalen != 0) {
+               memcpy(&buf[len], data, datalen);
+               len += datalen;
+       }
+
+       return len;
+}
+
+/* Quarter dBm units to mW
+ * Table starts at QDBM_OFFSET, so the first entry is mW for qdBm=153
+ * Table is offset so the last entry is largest mW value that fits in
+ * a uint16.
+ */
+
+#define QDBM_OFFSET 153                /* Offset for first entry */
+#define QDBM_TABLE_LEN 40      /* Table size */
+
+/* Smallest mW value that will round up to the first table entry, QDBM_OFFSET.
+ * Value is ( mW(QDBM_OFFSET - 1) + mW(QDBM_OFFSET) ) / 2
+ */
+#define QDBM_TABLE_LOW_BOUND 6493 /* Low bound */
+
+/* Largest mW value that will round down to the last table entry,
+ * QDBM_OFFSET + QDBM_TABLE_LEN-1.
+ * Value is ( mW(QDBM_OFFSET + QDBM_TABLE_LEN - 1) + mW(QDBM_OFFSET + QDBM_TABLE_LEN) ) / 2.
+ */
+#define QDBM_TABLE_HIGH_BOUND 64938 /* High bound */
+
+static const uint16 nqdBm_to_mW_map[QDBM_TABLE_LEN] = {
+/* qdBm:       +0      +1      +2      +3      +4      +5      +6      +7 */
+/* 153: */      6683,  7079,   7499,   7943,   8414,   8913,   9441,   10000,
+/* 161: */      10593, 11220,  11885,  12589,  13335,  14125,  14962,  15849,
+/* 169: */      16788, 17783,  18836,  19953,  21135,  22387,  23714,  25119,
+/* 177: */      26607, 28184,  29854,  31623,  33497,  35481,  37584,  39811,
+/* 185: */      42170, 44668,  47315,  50119,  53088,  56234,  59566,  63096
+};
+
+uint16
+bcm_qdbm_to_mw(uint8 qdbm)
+{
+       uint factor = 1;
+       int idx = qdbm - QDBM_OFFSET;
+
+       if (idx >= QDBM_TABLE_LEN) {
+               /* clamp to max uint16 mW value */
+               return 0xFFFF;
+       }
+
+       /* scale the qdBm index up to the range of the table 0-40
+        * where an offset of 40 qdBm equals a factor of 10 mW.
+        */
+       while (idx < 0) {
+               idx += 40;
+               factor *= 10;
+       }
+
+       /* return the mW value scaled down to the correct factor of 10,
+        * adding in factor/2 to get proper rounding.
+        */
+       return ((nqdBm_to_mW_map[idx] + factor/2) / factor);
+}
+
+uint8
+bcm_mw_to_qdbm(uint16 mw)
+{
+       uint8 qdbm;
+       int offset;
+       uint mw_uint = mw;
+       uint boundary;
+
+       /* handle boundary case */
+       if (mw_uint <= 1)
+               return 0;
+
+       offset = QDBM_OFFSET;
+
+       /* move mw into the range of the table */
+       while (mw_uint < QDBM_TABLE_LOW_BOUND) {
+               mw_uint *= 10;
+               offset -= 40;
+       }
+
+       for (qdbm = 0; qdbm < QDBM_TABLE_LEN-1; qdbm++) {
+               boundary = nqdBm_to_mW_map[qdbm] + (nqdBm_to_mW_map[qdbm+1] -
+                                                   nqdBm_to_mW_map[qdbm])/2;
+               if (mw_uint < boundary) break;
+       }
+
+       qdbm += (uint8)offset;
+
+       return (qdbm);
+}
+
+uint
+bcm_bitcount(const uint8 *bitmap, uint length)
+{
+       uint bitcount = 0, i;
+       uint8 tmp;
+       for (i = 0; i < length; i++) {
+               tmp = bitmap[i];
+               while (tmp) {
+                       bitcount++;
+                       tmp &= (tmp - 1);
+               }
+       }
+       return bitcount;
+}
+
+/*
+ * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file and ending in a NUL.
+ * also accepts nvram files which are already in the format of <var1>=<value>\0\<var2>=<value2>\0
+ * Removes carriage returns, empty lines, comment lines, and converts newlines to NULs.
+ * Shortens buffer as needed and pads with NULs.  End of buffer is marked by two NULs.
+*/
+
+unsigned int
+process_nvram_vars(char *varbuf, unsigned int len)
+{
+       char *dp;
+       bool findNewline;
+       int column;
+       unsigned int buf_len, n;
+       unsigned int pad = 0;
+       char nv_ver[128];
+
+       dp = varbuf;
+
+       findNewline = FALSE;
+       column = 0;
+
+       // terence 20130914: print out NVRAM version
+       if (varbuf[0] == '#') {
+               memset(nv_ver, 0x00, sizeof(nv_ver));
+               for (n=1; n<len && n<(sizeof(nv_ver)-1); n++) {
+                       if (varbuf[n] == '\n')
+                               break;
+                       nv_ver[n-1] = varbuf[n];
+               }
+               printf("NVRAM version: %s\n", nv_ver);
+       }
+
+       for (n = 0; n < len; n++) {
+               if (varbuf[n] == '\r')
+                       continue;
+               if (findNewline && varbuf[n] != '\n')
+                       continue;
+               findNewline = FALSE;
+               if (varbuf[n] == '#') {
+                       findNewline = TRUE;
+                       continue;
+               }
+               if (varbuf[n] == '\n') {
+                       if (column == 0)
+                               continue;
+                       *dp++ = 0;
+                       column = 0;
+                       continue;
+               }
+               *dp++ = varbuf[n];
+               column++;
+       }
+       buf_len = (unsigned int)(dp - varbuf);
+       if (buf_len % 4) {
+               pad = 4 - buf_len % 4;
+               if (pad && (buf_len + pad <= len)) {
+                       buf_len += pad;
+               }
+       }
+
+       while (dp < varbuf + n)
+               *dp++ = 0;
+
+       return buf_len;
+}
+
+#ifndef setbit /* As in the header file */
+#ifdef BCMUTILS_BIT_MACROS_USE_FUNCS
+/* Set bit in byte array. */
+void
+setbit(void *array, uint bit)
+{
+       ((uint8 *)array)[bit / NBBY] |= 1 << (bit % NBBY);
+}
+
+/* Clear bit in byte array. */
+void
+clrbit(void *array, uint bit)
+{
+       ((uint8 *)array)[bit / NBBY] &= ~(1 << (bit % NBBY));
+}
+
+/* Test if bit is set in byte array. */
+bool
+isset(const void *array, uint bit)
+{
+       return (((const uint8 *)array)[bit / NBBY] & (1 << (bit % NBBY)));
+}
+
+/* Test if bit is clear in byte array. */
+bool
+isclr(const void *array, uint bit)
+{
+       return ((((const uint8 *)array)[bit / NBBY] & (1 << (bit % NBBY))) == 0);
+}
+#endif /* BCMUTILS_BIT_MACROS_USE_FUNCS */
+#endif /* setbit */
+
+void
+set_bitrange(void *array, uint start, uint end, uint maxbit)
+{
+       uint startbyte = start/NBBY;
+       uint endbyte = end/NBBY;
+       uint i, startbytelastbit, endbytestartbit;
+
+       if (end >= start) {
+               if (endbyte - startbyte > 1) {
+                       startbytelastbit = ((startbyte + 1) * NBBY) - 1;
+                       endbytestartbit = endbyte * NBBY;
+                       for (i = startbyte + 1; i < endbyte; i++)
+                               ((uint8 *)array)[i] = 0xFF;
+                       for (i = start; i <= startbytelastbit; i++)
+                               setbit(array, i);
+                       for (i = endbytestartbit; i <= end; i++)
+                               setbit(array, i);
+               } else {
+                       for (i = start; i <= end; i++)
+                               setbit(array, i);
+               }
+       } else {
+               set_bitrange(array, start, maxbit, maxbit);
+               set_bitrange(array, 0, end, maxbit);
+       }
+}
+
+void
+clr_bitrange(void *array, uint start, uint end, uint maxbit)
+{
+       uint startbyte = start/NBBY;
+       uint endbyte = end/NBBY;
+       uint i, startbytelastbit, endbytestartbit;
+
+       if (end >= start) {
+               if (endbyte - startbyte > 1) {
+                       startbytelastbit = ((startbyte + 1) * NBBY) - 1;
+                       endbytestartbit = endbyte * NBBY;
+                       for (i = startbyte + 1; i < endbyte; i++)
+                               ((uint8 *)array)[i] = 0x0;
+                       for (i = start; i <= startbytelastbit; i++)
+                               clrbit(array, i);
+                       for (i = endbytestartbit; i <= end; i++)
+                               clrbit(array, i);
+               } else {
+                       for (i = start; i <= end; i++)
+                               clrbit(array, i);
+               }
+       } else {
+               clr_bitrange(array, start, maxbit, maxbit);
+               clr_bitrange(array, 0, end, maxbit);
+       }
+}
+
+/*
+ * This api (set_bitrange_int_access) as same as set_bitrange but uses int32 operation
+ * This api can be used in the place of set_bitrange but array should be word (32bit) alligned.
+ * This api has to be used when the memory being accessed has restrictions of
+ * not using them in 8bit (byte) mode and needing 32bit (word) mode.
+ */
+void
+set_bitrange_u32(void *array, uint start, uint end, uint maxbit)
+{
+       uint startword = start/(NBBY * sizeof(uint32));
+       uint endword = end/(NBBY * sizeof(uint32));
+       uint startwordstartbit = start % (NBBY * sizeof(uint32));
+       uint endwordlastbit = end % (NBBY * sizeof(uint32));
+       uint u32msbnum = NBBY * sizeof(uint32) - 1U; /* Used to caluculate bit number from MSB */
+       uint i;
+       uint32 setbitsword;
+       uint32 u32max = ~0U;
+
+       ASSERT(ISALIGNED(array, sizeof(uint32))); /* array should be alligned for this API */
+
+       if (start > end) {
+               set_bitrange_u32(array, start, maxbit, maxbit);
+               set_bitrange_u32(array, 0U, end, maxbit);
+               return;
+       }
+
+       if (endword - startword) {
+               /* Setting MSB bits including startwordstartbit */
+               setbitsword = u32max << startwordstartbit;
+               ((uint32 *)array)[startword] |= setbitsword;
+
+               /* Setting all bits in 'startword + 1' to 'endword - 1' */
+               for (i = startword + 1U; i <= endword - 1U; i++) {
+                       ((uint32 *)array)[i] = u32max;
+               }
+
+               /* Setting LSB bits including endwordlastbit */
+               setbitsword = u32max >> (u32msbnum - endwordlastbit);
+               ((uint32 *)array)[endword] |= setbitsword;
+       } else { /* start and end are in same word */
+               /* Setting start bit to end bit including start and end bits */
+               setbitsword =
+                       (u32max << startwordstartbit) & (u32max >> (u32msbnum - endwordlastbit));
+               ((uint32 *)array)[startword] |= setbitsword;
+       }
+}
+
+/*
+ * This api (clr_bitrange_u32) as same as clr_bitrange but uses int32 operation
+ * This api can be used in the place of clr_bitrange but array should be word (32bit) alligned.
+ * This api has to be used when the memory being accessed has restrictions of
+ * not using them in 8bit (byte) mode and needing 32bit (word) mode.
+ */
+void
+clr_bitrange_u32(void *array, uint start, uint end, uint maxbit)
+{
+       uint startword = start/(NBBY * sizeof(uint32));
+       uint endword = end/(NBBY * sizeof(uint32));
+       uint startwordstartbit = start % (NBBY * sizeof(uint32));
+       uint endwordlastbit = end % (NBBY * sizeof(uint32));
+       uint u32msbnum = NBBY * sizeof(uint32) - 1U; /* Used to caluculate bit number from MSB */
+       uint i;
+       uint32 clrbitsword;
+       uint32 u32max = ~0U;
+
+       ASSERT(ISALIGNED(array, sizeof(uint32))); /* array should be alligned for this API */
+
+       if (start > end) {
+               clr_bitrange_u32(array, start, maxbit, maxbit);
+               clr_bitrange_u32(array, 0U, end, maxbit);
+               return;
+       }
+
+       if (endword - startword) {
+               /* Clearing MSB bits including startwordstartbit */
+               clrbitsword = ~(u32max << startwordstartbit);
+               ((uint32 *)array)[startword] &= clrbitsword;
+
+               /* Clearing all bits in 'startword + 1' to 'endword - 1' */
+               for (i = startword + 1U; i <= endword - 1U; i++) {
+                       ((uint32 *)array)[i] = 0U;
+               }
+
+               /* Clearing LSB bits including endwordlastbit */
+               clrbitsword = ~(u32max >> (u32msbnum - endwordlastbit));
+               ((uint32 *)array)[endword] &= clrbitsword;
+       } else { /* start and end are in same word */
+               /* Clearing start bit to end bit including start and end bits */
+               clrbitsword =
+                       ~(u32max << startwordstartbit) | ~(u32max >> (u32msbnum - endwordlastbit));
+               ((uint32 *)array)[startword] &= clrbitsword;
+       }
+}
+
+void
+bcm_bitprint32(const uint32 u32arg)
+{
+       int i;
+       for (i = NBITS(uint32) - 1; i >= 0; i--) {
+               if (isbitset(u32arg, i)) {
+                       printf("1");
+               } else {
+                       printf("0");
+               }
+
+               if ((i % NBBY) == 0) printf(" ");
+       }
+       printf("\n");
+}
+
+/* calculate checksum for ip header, tcp / udp header / data */
+uint16
+bcm_ip_cksum(uint8 *buf, uint32 len, uint32 sum)
+{
+       while (len > 1) {
+               sum += (buf[0] << 8) | buf[1];
+               buf += 2;
+               len -= 2;
+       }
+
+       if (len > 0) {
+               sum += (*buf) << 8;
+       }
+
+       while (sum >> 16) {
+               sum = (sum & 0xffff) + (sum >> 16);
+       }
+
+       return ((uint16)~sum);
+}
+
+/* calculate a + b where a is a 64 bit number and b is a 32 bit number */
+void
+bcm_add_64(uint32* r_hi, uint32* r_lo, uint32 offset)
+{
+       uint32 r1_lo = *r_lo;
+       (*r_lo) += offset;
+       if (*r_lo < r1_lo)
+               (*r_hi) ++;
+}
+
+/* calculate a - b where a is a 64 bit number and b is a 32 bit number */
+void
+bcm_sub_64(uint32* r_hi, uint32* r_lo, uint32 offset)
+{
+       uint32 r1_lo = *r_lo;
+       (*r_lo) -= offset;
+       if (*r_lo > r1_lo)
+               (*r_hi) --;
+}
+
+int
+BCMRAMFN(valid_bcmerror)(int e)
+{
+       return ((e <= 0) && (e >= BCME_LAST));
+}
+
+#ifdef DEBUG_COUNTER
+#if (OSL_SYSUPTIME_SUPPORT == TRUE)
+void counter_printlog(counter_tbl_t *ctr_tbl)
+{
+       uint32 now;
+
+       if (!ctr_tbl->enabled)
+               return;
+
+       now = OSL_SYSUPTIME();
+
+       if (now - ctr_tbl->prev_log_print > ctr_tbl->log_print_interval) {
+               uint8 i = 0;
+               printf("counter_print(%s %d):", ctr_tbl->name, now - ctr_tbl->prev_log_print);
+
+               for (i = 0; i < ctr_tbl->needed_cnt; i++) {
+                       printf(" %u", ctr_tbl->cnt[i]);
+               }
+               printf("\n");
+
+               ctr_tbl->prev_log_print = now;
+               bzero(ctr_tbl->cnt, CNTR_TBL_MAX * sizeof(uint));
+       }
+}
+#else
+/* OSL_SYSUPTIME is not supported so no way to get time */
+#define counter_printlog(a) do {} while (0)
+#endif /* OSL_SYSUPTIME_SUPPORT == TRUE */
+#endif /* DEBUG_COUNTER */
+
+/* calculate partial checksum */
+static uint32
+ip_cksum_partial(uint32 sum, uint8 *val8, uint32 count)
+{
+       uint32 i;
+       uint16 *val16 = (uint16 *)val8;
+
+       ASSERT(val8 != NULL);
+       /* partial chksum calculated on 16-bit values */
+       ASSERT((count % 2) == 0);
+
+       count /= 2;
+
+       for (i = 0; i < count; i++) {
+               sum += *val16++;
+       }
+       return sum;
+}
+
+/* calculate IP checksum */
+static uint16
+ip_cksum(uint32 sum, uint8 *val8, uint32 count)
+{
+       uint16 *val16 = (uint16 *)val8;
+
+       ASSERT(val8 != NULL);
+
+       while (count > 1) {
+               sum += *val16++;
+               count -= 2;
+       }
+       /*  add left-over byte, if any */
+       if (count > 0) {
+               sum += (*(uint8 *)val16);
+       }
+
+       /*  fold 32-bit sum to 16 bits */
+       sum = (sum >> 16) + (sum & 0xffff);
+       sum += (sum >> 16);
+       return ((uint16)~sum);
+}
+
+/* calculate IPv4 header checksum
+ * - input ip points to IP header in network order
+ * - output cksum is in network order
+ */
+uint16
+ipv4_hdr_cksum(uint8 *ip, uint ip_len)
+{
+       uint32 sum = 0;
+       uint8 *ptr = ip;
+
+       ASSERT(ip != NULL);
+       ASSERT(ip_len >= IPV4_MIN_HEADER_LEN);
+
+       if (ip_len < IPV4_MIN_HEADER_LEN) {
+               return 0;
+       }
+
+       /* partial cksum skipping the hdr_chksum field */
+       sum = ip_cksum_partial(sum, ptr, OFFSETOF(struct ipv4_hdr, hdr_chksum));
+       ptr += OFFSETOF(struct ipv4_hdr, hdr_chksum) + 2;
+
+       /* return calculated chksum */
+       return ip_cksum(sum, ptr, ip_len - OFFSETOF(struct ipv4_hdr, src_ip));
+}
+
+/* calculate TCP header checksum using partial sum */
+static uint16
+tcp_hdr_chksum(uint32 sum, uint8 *tcp_hdr, uint16 tcp_len)
+{
+       uint8 *ptr = tcp_hdr;
+
+       ASSERT(tcp_hdr != NULL);
+       ASSERT(tcp_len >= TCP_MIN_HEADER_LEN);
+
+       /* partial TCP cksum skipping the chksum field */
+       sum = ip_cksum_partial(sum, ptr, OFFSETOF(struct bcmtcp_hdr, chksum));
+       ptr += OFFSETOF(struct bcmtcp_hdr, chksum) + 2;
+
+       /* return calculated chksum */
+       return ip_cksum(sum, ptr, tcp_len - OFFSETOF(struct bcmtcp_hdr, urg_ptr));
+}
+
+struct tcp_pseudo_hdr {
+       uint8   src_ip[IPV4_ADDR_LEN];  /* Source IP Address */
+       uint8   dst_ip[IPV4_ADDR_LEN];  /* Destination IP Address */
+       uint8   zero;
+       uint8   prot;
+       uint16  tcp_size;
+};
+
+/* calculate IPv4 TCP header checksum
+ * - input ip and tcp points to IP and TCP header in network order
+ * - output cksum is in network order
+ */
+uint16
+ipv4_tcp_hdr_cksum(uint8 *ip, uint8 *tcp, uint16 tcp_len)
+{
+       struct ipv4_hdr *ip_hdr = (struct ipv4_hdr *)ip;
+       struct tcp_pseudo_hdr tcp_ps;
+       uint32 sum = 0;
+
+       ASSERT(ip != NULL);
+       ASSERT(tcp != NULL);
+       ASSERT(tcp_len >= TCP_MIN_HEADER_LEN);
+
+       /* pseudo header cksum */
+       memset(&tcp_ps, 0, sizeof(tcp_ps));
+       memcpy(&tcp_ps.dst_ip, ip_hdr->dst_ip, IPV4_ADDR_LEN);
+       memcpy(&tcp_ps.src_ip, ip_hdr->src_ip, IPV4_ADDR_LEN);
+       tcp_ps.zero = 0;
+       tcp_ps.prot = ip_hdr->prot;
+       tcp_ps.tcp_size = hton16(tcp_len);
+       sum = ip_cksum_partial(sum, (uint8 *)&tcp_ps, sizeof(tcp_ps));
+
+       /* return calculated TCP header chksum */
+       return tcp_hdr_chksum(sum, tcp, tcp_len);
+}
+
+struct ipv6_pseudo_hdr {
+       uint8  saddr[IPV6_ADDR_LEN];
+       uint8  daddr[IPV6_ADDR_LEN];
+       uint16 payload_len;
+       uint8  zero;
+       uint8  next_hdr;
+};
+
+/* calculate IPv6 TCP header checksum
+ * - input ipv6 and tcp points to IPv6 and TCP header in network order
+ * - output cksum is in network order
+ */
+uint16
+ipv6_tcp_hdr_cksum(uint8 *ipv6, uint8 *tcp, uint16 tcp_len)
+{
+       struct ipv6_hdr *ipv6_hdr = (struct ipv6_hdr *)ipv6;
+       struct ipv6_pseudo_hdr ipv6_pseudo;
+       uint32 sum = 0;
+
+       ASSERT(ipv6 != NULL);
+       ASSERT(tcp != NULL);
+       ASSERT(tcp_len >= TCP_MIN_HEADER_LEN);
+
+       /* pseudo header cksum */
+       memset((char *)&ipv6_pseudo, 0, sizeof(ipv6_pseudo));
+       memcpy((char *)ipv6_pseudo.saddr, (char *)ipv6_hdr->saddr.addr,
+               sizeof(ipv6_pseudo.saddr));
+       memcpy((char *)ipv6_pseudo.daddr, (char *)ipv6_hdr->daddr.addr,
+               sizeof(ipv6_pseudo.daddr));
+       ipv6_pseudo.payload_len = ipv6_hdr->payload_len;
+       ipv6_pseudo.next_hdr = ipv6_hdr->nexthdr;
+       sum = ip_cksum_partial(sum, (uint8 *)&ipv6_pseudo, sizeof(ipv6_pseudo));
+
+       /* return calculated TCP header chksum */
+       return tcp_hdr_chksum(sum, tcp, tcp_len);
+}
+
+void *_bcmutils_dummy_fn = NULL;
+
+/* GROUP 1 --- start
+ * These function under GROUP 1 are general purpose functions to do complex number
+ * calculations and square root calculation.
+ */
+
+uint32 sqrt_int(uint32 value)
+{
+       uint32 root = 0, shift = 0;
+
+       /* Compute integer nearest to square root of input integer value */
+       for (shift = 0; shift < 32; shift += 2) {
+               if (((0x40000000 >> shift) + root) <= value) {
+                       value -= ((0x40000000 >> shift) + root);
+                       root = (root >> 1) | (0x40000000 >> shift);
+               }
+               else {
+                       root = root >> 1;
+               }
+       }
+
+       /* round to the nearest integer */
+       if (root < value) ++root;
+
+       return root;
+}
+/* GROUP 1 --- end */
+
+/* read/write field in a consecutive bits in an octet array.
+ * 'addr' is the octet array's start byte address
+ * 'size' is the octet array's byte size
+ * 'stbit' is the value's start bit offset
+ * 'nbits' is the value's bit size
+ * This set of utilities are for convenience. Don't use them
+ * in time critical/data path as there's a great overhead in them.
+ */
+void
+setbits(uint8 *addr, uint size, uint stbit, uint nbits, uint32 val)
+{
+       uint fbyte = stbit >> 3;                /* first byte */
+       uint lbyte = (stbit + nbits - 1) >> 3;  /* last byte */
+       uint fbit = stbit & 7;                  /* first bit in the first byte */
+       uint rbits = (nbits > 8 - fbit ?
+                     nbits - (8 - fbit) :
+                     0) & 7;                   /* remaining bits of the last byte when not 0 */
+       uint8 mask;
+       uint byte;
+
+       BCM_REFERENCE(size);
+
+       ASSERT(fbyte < size);
+       ASSERT(lbyte < size);
+       ASSERT(nbits <= (sizeof(val) << 3));
+
+       /* all bits are in the same byte */
+       if (fbyte == lbyte) {
+               mask = ((1 << nbits) - 1) << fbit;
+               addr[fbyte] &= ~mask;
+               addr[fbyte] |= (uint8)(val << fbit);
+               return;
+       }
+
+       /* first partial byte */
+       if (fbit > 0) {
+               mask = (0xff << fbit);
+               addr[fbyte] &= ~mask;
+               addr[fbyte] |= (uint8)(val << fbit);
+               val >>= (8 - fbit);
+               nbits -= (8 - fbit);
+               fbyte ++;       /* first full byte */
+       }
+
+       /* last partial byte */
+       if (rbits > 0) {
+               mask = (1 << rbits) - 1;
+               addr[lbyte] &= ~mask;
+               addr[lbyte] |= (uint8)(val >> (nbits - rbits));
+               lbyte --;       /* last full byte */
+       }
+
+       /* remaining full byte(s) */
+       for (byte = fbyte; byte <= lbyte; byte ++) {
+               addr[byte] = (uint8)val;
+               val >>= 8;
+       }
+}
+
+uint32
+getbits(const uint8 *addr, uint size, uint stbit, uint nbits)
+{
+       uint fbyte = stbit >> 3;                /* first byte */
+       uint lbyte = (stbit + nbits - 1) >> 3;  /* last byte */
+       uint fbit = stbit & 7;                  /* first bit in the first byte */
+       uint rbits = (nbits > 8 - fbit ?
+                     nbits - (8 - fbit) :
+                     0) & 7;                   /* remaining bits of the last byte when not 0 */
+       uint32 val = 0;
+       uint bits = 0;                          /* bits in first partial byte */
+       uint8 mask;
+       uint byte;
+
+       BCM_REFERENCE(size);
+
+       ASSERT(fbyte < size);
+       ASSERT(lbyte < size);
+       ASSERT(nbits <= (sizeof(val) << 3));
+
+       /* all bits are in the same byte */
+       if (fbyte == lbyte) {
+               mask = ((1 << nbits) - 1) << fbit;
+               val = (addr[fbyte] & mask) >> fbit;
+               return val;
+       }
+
+       /* first partial byte */
+       if (fbit > 0) {
+               bits = 8 - fbit;
+               mask = (0xff << fbit);
+               val |= (addr[fbyte] & mask) >> fbit;
+               fbyte ++;       /* first full byte */
+       }
+
+       /* last partial byte */
+       if (rbits > 0) {
+               mask = (1 << rbits) - 1;
+               val |= (addr[lbyte] & mask) << (nbits - rbits);
+               lbyte --;       /* last full byte */
+       }
+
+       /* remaining full byte(s) */
+       for (byte = fbyte; byte <= lbyte; byte ++) {
+               val |= (addr[byte] << (((byte - fbyte) << 3) + bits));
+       }
+
+       return val;
+}
+
+#if defined(WLMSG_ASSOC)
+/* support for getting 802.11 frame type/name based on frame kind */
+#define FK_NAME_DECL(x) {FC_##x, #x}
+static const struct {
+    uint fk;
+    const char *name;
+} bcm_80211_fk_names[] =  {
+       FK_NAME_DECL(ASSOC_REQ),
+       FK_NAME_DECL(ASSOC_RESP),
+       FK_NAME_DECL(REASSOC_REQ),
+       FK_NAME_DECL(REASSOC_RESP),
+       FK_NAME_DECL(PROBE_REQ),
+       FK_NAME_DECL(PROBE_RESP),
+       FK_NAME_DECL(BEACON),
+       FK_NAME_DECL(ATIM),
+       FK_NAME_DECL(DISASSOC),
+       FK_NAME_DECL(AUTH),
+       FK_NAME_DECL(DEAUTH),
+       FK_NAME_DECL(ACTION),
+       FK_NAME_DECL(ACTION_NOACK),
+       FK_NAME_DECL(CTL_TRIGGER),
+       FK_NAME_DECL(CTL_WRAPPER),
+       FK_NAME_DECL(BLOCKACK_REQ),
+       FK_NAME_DECL(BLOCKACK),
+       FK_NAME_DECL(PS_POLL),
+       FK_NAME_DECL(RTS),
+       FK_NAME_DECL(CTS),
+       FK_NAME_DECL(ACK),
+       FK_NAME_DECL(CF_END),
+       FK_NAME_DECL(CF_END_ACK),
+       FK_NAME_DECL(DATA),
+       FK_NAME_DECL(NULL_DATA),
+       FK_NAME_DECL(DATA_CF_ACK),
+       FK_NAME_DECL(QOS_DATA),
+       FK_NAME_DECL(QOS_NULL)
+};
+static const uint n_bcm_80211_fk_names = ARRAYSIZE(bcm_80211_fk_names);
+
+const char *bcm_80211_fk_name(uint fk)
+{
+       uint i;
+       for (i = 0; i < n_bcm_80211_fk_names; ++i) {
+               if (bcm_80211_fk_names[i].fk == fk) {
+                       return bcm_80211_fk_names[i].name;
+               }
+       }
+       return "unknown";
+}
+#endif
+
+#ifdef BCMDRIVER
+
+/** allocate variable sized data with 'size' bytes. note: vld should NOT be null.
+ */
+int
+bcm_vdata_alloc(osl_t *osh, var_len_data_t *vld, uint32 size)
+{
+       int ret = BCME_ERROR;
+       uint8 *dat = NULL;
+
+       if (vld == NULL) {
+               ASSERT(0);
+               goto done;
+       }
+
+       /* trying to allocate twice? */
+       if (vld->vdata != NULL) {
+               ASSERT(0);
+               goto done;
+       }
+
+       /* trying to allocate 0 size? */
+       if (size == 0) {
+               ASSERT(0);
+               ret = BCME_BADARG;
+               goto done;
+       }
+
+       dat = MALLOCZ(osh, size);
+       if (dat == NULL) {
+               ret = BCME_NOMEM;
+               goto done;
+       }
+       vld->vlen = size;
+       vld->vdata = dat;
+       ret = BCME_OK;
+done:
+       return ret;
+}
+
+/** free memory associated with variable sized data. note: vld should NOT be null.
+ */
+int
+bcm_vdata_free(osl_t *osh, var_len_data_t *vld)
+{
+       int ret = BCME_ERROR;
+
+       if (vld == NULL) {
+               ASSERT(0);
+               goto done;
+       }
+
+       if (vld->vdata) {
+               MFREE(osh, vld->vdata, vld->vlen);
+               vld->vlen = 0;
+               ret = BCME_OK;
+       }
+done:
+       return ret;
+}
+
+/* return TRUE if :
+ * - both buffers are of length 0
+ * OR
+ * - both buffers are NULL
+ * OR
+ * lengths and contents are the same.
+ */
+bool
+bcm_match_buffers(const uint8 *b1, uint b1_len, const uint8 *b2, uint b2_len)
+
+{
+       if (b1_len == 0 && b2_len == 0) {
+               return TRUE;
+       }
+
+       if (b1 == NULL && b2 == NULL) {
+               return TRUE;
+       }
+
+       /* If they are not both NULL, neither can be */
+       if (b1 == NULL || b2 == NULL) {
+               return FALSE;
+       }
+
+       if ((b1_len == b2_len) && !memcmp(b1, b2, b1_len)) {
+               return TRUE;
+       }
+       return FALSE;
+}
+
+#ifdef PRIVACY_MASK
+/* applies privacy mask on the input address itself */
+void
+BCMRAMFN(bcm_ether_privacy_mask)(struct ether_addr *addr)
+{
+       struct ether_addr *privacy = privacy_addrmask_get();
+       if (addr && !ETHER_ISMULTI(addr)) {
+               *(uint32*)(&(addr->octet[0])) &= *((uint32*)&privacy->octet[0]);
+               *(uint16*)(&(addr->octet[4])) &= *((uint16*)&privacy->octet[4]);
+       }
+}
+#endif /* PRIVACY_MASK */
+#endif /* BCMDRIVER */
+
+/* Count the number of elements not matching a given value in a null terminated array */
+int
+array_value_mismatch_count(uint8 value, uint8 *array, int array_size)
+{
+       int i;
+       int count = 0;
+
+       for (i = 0; i < array_size; i++) {
+               /* exit if a null terminator is found */
+               if (array[i] == 0) {
+                       break;
+               }
+               if (array[i] != value) {
+                       count++;
+               }
+       }
+       return count;
+}
+
+/* Count the number of non-zero elements in an uint8 array */
+int
+array_nonzero_count(uint8 *array, int array_size)
+{
+       return array_value_mismatch_count(0, array, array_size);
+}
+
+/* Count the number of non-zero elements in an int16 array */
+int
+array_nonzero_count_int16(int16 *array, int array_size)
+{
+       int i;
+       int count = 0;
+
+       for (i = 0; i < array_size; i++) {
+               if (array[i] != 0) {
+                       count++;
+               }
+       }
+       return count;
+}
+
+/* Count the number of zero elements in an uint8 array */
+int
+array_zero_count(uint8 *array, int array_size)
+{
+       int i;
+       int count = 0;
+
+       for (i = 0; i < array_size; i++) {
+               if (array[i] == 0) {
+                       count++;
+               }
+       }
+       return count;
+}
+
+/* Validate an array that can be 1 of 2 data types.
+ * One of array1 or array2 should be non-NULL.  The other should be NULL.
+ */
+static int
+verify_ordered_array(uint8 *array1, int16 *array2, int array_size,
+       int range_lo, int range_hi, bool err_if_no_zero_term, bool is_ordered)
+{
+       int ret;
+       int i;
+       int val = 0;
+       int prev_val = 0;
+
+       ret = err_if_no_zero_term ? BCME_NOTFOUND : BCME_OK;
+
+       /* Check that:
+        * - values are in descending order.
+        * - values are within the valid range.
+        */
+       for (i = 0; i < array_size; i++) {
+               if (array1) {
+                       val = (int)array1[i];
+               } else if (array2) {
+                       val = (int)array2[i];
+               } else {
+                       /* both array parameters are NULL */
+                       return BCME_NOTFOUND;
+               }
+               if (val == 0) {
+                       /* array is zero-terminated */
+                       ret = BCME_OK;
+                       break;
+               }
+
+               if (is_ordered && i > 0 && val > prev_val) {
+                       /* array is not in descending order */
+                       ret = BCME_BADOPTION;
+                       break;
+               }
+               prev_val = val;
+
+               if (val < range_lo || val > range_hi) {
+                       /* array value out of range */
+                       ret = BCME_RANGE;
+                       break;
+               }
+       }
+
+       return ret;
+}
+
+/* Validate an ordered uint8 configuration array */
+int
+verify_ordered_array_uint8(uint8 *array, int array_size,
+       uint8 range_lo, uint8 range_hi)
+{
+       return verify_ordered_array(array, NULL, array_size, (int)range_lo, (int)range_hi,
+               TRUE, TRUE);
+}
+
+/* Validate an ordered int16 non-zero-terminated configuration array */
+int
+verify_ordered_array_int16(int16 *array, int array_size,
+       int16 range_lo, int16 range_hi)
+{
+       return verify_ordered_array(NULL, array, array_size, (int)range_lo, (int)range_hi,
+               FALSE, TRUE);
+}
+
+/* Validate all values in an array are in range */
+int
+verify_array_values(uint8 *array, int array_size,
+       int range_lo, int range_hi, bool zero_terminated)
+{
+       int ret = BCME_OK;
+       int i;
+       int val = 0;
+
+       /* Check that:
+        * - values are in strict descending order.
+        * - values are within the valid range.
+        */
+       for (i = 0; i < array_size; i++) {
+               val = (int)array[i];
+               if (val == 0 && zero_terminated) {
+                       ret = BCME_OK;
+                       break;
+               }
+               if (val < range_lo || val > range_hi) {
+                       /* array value out of range */
+                       ret = BCME_RANGE;
+                       break;
+               }
+       }
+       return ret;
+}
+
+/* Adds/replaces NVRAM variable with given value
+ * varbuf[in,out]   - Buffer with NVRAM variables (sequence of zero-terminated 'name=value' records,
+ *                    terminated with additional zero)
+ * buflen[in]       - Length of buffer (may, even should, have some unused space)
+ * variable[in]     - Variable to add/replace in 'name=value' form
+ * datalen[out,opt] - Optional output parameter - resulting length of data in buffer
+ * Returns TRUE on success, FALSE if buffer too short or variable specified incorrectly
+ */
+bool
+replace_nvram_variable(char *varbuf, unsigned int buflen, const char *variable,
+       unsigned int *datalen)
+{
+       char *p;
+       int variable_heading_len, record_len, variable_record_len = (int)strlen(variable) + 1;
+       char *buf_end = varbuf + buflen;
+       p = strchr(variable, '=');
+       if (!p) {
+               return FALSE;
+       }
+       /* Length of given variable name, followed by '=' */
+       variable_heading_len = (int)((const char *)(p + 1) - variable);
+       /* Scanning NVRAM, record by record up to trailing 0 */
+       for (p = varbuf; *p; p += strlen(p) + 1) {
+               /* If given variable found - remove it */
+               if (!strncmp(p, variable, variable_heading_len)) {
+                       record_len = (int)strlen(p) + 1;
+                       memmove_s(p, buf_end - p, p + record_len, buf_end - (p + record_len));
+               }
+       }
+       /* If buffer does not have space for given variable - return FALSE */
+       if ((p + variable_record_len + 1) > buf_end) {
+               return FALSE;
+       }
+       /* Copy given variable to end of buffer */
+       memmove_s(p, buf_end - p, variable, variable_record_len);
+       /* Adding trailing 0 */
+       p[variable_record_len] = 0;
+       /* Setting optional output parameter - length of data in buffer */
+       if (datalen) {
+               *datalen = (unsigned int)(p + variable_record_len + 1  - varbuf);
+       }
+       return TRUE;
+}
+
+/* Add to adjust the 802.1x priority */
+void
+pktset8021xprio(void *pkt, int prio)
+{
+       struct ether_header *eh;
+       uint8 *pktdata;
+       if(prio == PKTPRIO(pkt))
+               return;
+       pktdata = (uint8 *)PKTDATA(OSH_NULL, pkt);
+       ASSERT(ISALIGNED((uintptr)pktdata, sizeof(uint16)));
+       eh = (struct ether_header *) pktdata;
+       if (eh->ether_type == hton16(ETHER_TYPE_802_1X)) {
+               ASSERT(prio >= 0 && prio <= MAXPRIO);
+               PKTSETPRIO(pkt, prio);
+       }
+}      
diff --git a/bcmdhd.101.10.240.x/bcmwifi_channels.c b/bcmdhd.101.10.240.x/bcmwifi_channels.c
new file mode 100644 (file)
index 0000000..4a3ee9e
--- /dev/null
@@ -0,0 +1,3014 @@
+/*
+ * Misc utility routines used by kernel or app-level.
+ * Contents are wifi-specific, used by any kernel or app-level
+ * software that might want wifi things as it grows.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <typedefs.h>
+#include <bcmutils.h>
+
+#ifdef BCMDRIVER
+#include <osl.h>
+#define strtoul(nptr, endptr, base) bcm_strtoul((nptr), (endptr), (base))
+#define tolower(c) (bcm_isupper((c)) ? ((c) + 'a' - 'A') : (c))
+#else
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+#ifndef ASSERT
+#define ASSERT(exp)
+#endif
+#endif /* BCMDRIVER */
+
+#include <bcmwifi_channels.h>
+
+#if defined(WIN32) && (defined(BCMDLL) || defined(WLMDLL))
+#include <bcmstdlib.h> /* For wlexe/Makefile.wlm_dll */
+#endif
+
+#include <802.11.h>
+
+/* Definitions for D11AC capable (80MHz+) Chanspec type */
+
+/* Chanspec ASCII representation:
+ *
+ * [<band>'g']<channel>['/'<bandwidth>[<primary-sideband>]
+ *    ['/'<1st-channel-segment>'-'<2nd-channel-segment>]]
+ *
+ * <band>:
+ *      (optional) 2, 4, 5, 6 for 2.4GHz, 4GHz, 5GHz, and 6GHz respectively.
+ *      Default value is 2g if channel <= 14, otherwise 5g.
+ * <channel>:
+ *      channel number of the 20MHz channel,
+ *      or primary 20 MHz channel of 40MHz, 80MHz, 160MHz, 80+80MHz,
+ *      320MHz, or 160+160MHz channels.
+ * <bandwidth>:
+ *      (optional) 20, 40, 80, 160, 80+80, 320, or 160+160. Default value is 20.
+ * <primary-sideband>:
+ *      'u' or 'l' (only for 2.4GHz band 40MHz)
+ *
+ *       For 2.4GHz band 40MHz channels, the same primary channel may be the
+ *       upper sideband for one 40MHz channel, and the lower sideband for an
+ *       overlapping 40MHz channel. The {u: upper, l: lower} primary sideband
+ *       indication disambiguates which 40MHz channel is being specified.
+ *
+ *       For 40MHz in the 5GHz or 6GHz band and all channel bandwidths greater than
+ *       40MHz, the U/L specification is not necessary or allowed since the channels are
+ *       non-overlapping and the primary 20MHz channel position is derived from its
+ *       position in the wide bandwidth channel.
+ * <1st-channel-segment>
+ * <2nd-channel-segment>:
+ *       Required for 80+80 or 160+160, otherwise not allowed.
+ *       These fields specify the center channel of the first and the second 80MHz
+ *       or 160MHz channels.
+ *
+ * In its simplest form, it is a 20MHz channel number, with the implied band
+ * of 2.4GHz if channel number <= 14, and 5GHz otherwise.
+ *
+ * To allow for backward compatibility with scripts, the old form for
+ * 40MHz channels is also allowed: <channel><primary-sideband>
+ *
+ * <channel>:
+ *     primary channel of 40MHz, channel <= 14 is 2GHz, otherwise 5GHz
+ * <primary-sideband>:
+ *     "U" for upper, "L" for lower (or lower case "u" "l")
+ *
+ * 5 GHz Examples:
+ *      Chanspec        BW        Center Ch  Channel Range  Primary Ch
+ *      5g8             20MHz     8          -              -
+ *      52              20MHz     52         -              -
+ *      52/40           40MHz     54         52-56          52
+ *      56/40           40MHz     54         52-56          56
+ *      52/80           80MHz     58         52-64          52
+ *      56/80           80MHz     58         52-64          56
+ *      60/80           80MHz     58         52-64          60
+ *      64/80           80MHz     58         52-64          64
+ *      52/160          160MHz    50         36-64          52
+ *      36/160          160MGz    50         36-64          36
+ *      36/80+80/42-106 80+80MHz  42,106     36-48,100-112  36
+ *
+ * 2 GHz Examples:
+ *      Chanspec        BW        Center Ch  Channel Range  Primary Ch
+ *      2g8             20MHz     8          -              -
+ *      8               20MHz     8          -              -
+ *      6               20MHz     6          -              -
+ *      6/40l           40MHz     8          6-10           6
+ *      6l              40MHz     8          6-10           6
+ *      6/40u           40MHz     4          2-6            6
+ *      6u              40MHz     4          2-6            6
+ */
+
+/* bandwidth ASCII string */
+static const char *wf_chspec_bw_str[] =
+{
+       "320",
+       "160+160",
+       "20",
+       "40",
+       "80",
+       "160",
+       "80+80",
+       "na"
+};
+
+static const uint16 wf_chspec_bw_mhz[] = {
+       320, 320, 20, 40, 80, 160, 160
+};
+#define WF_NUM_BW ARRAYSIZE(wf_chspec_bw_mhz)
+
+/* 40MHz channels in 5GHz band */
+static const uint8 wf_5g_40m_chans[] = {
+       38, 46, 54, 62, 102, 110, 118, 126, 134, 142, 151, 159, 167, 175
+};
+#define WF_NUM_5G_40M_CHANS ARRAYSIZE(wf_5g_40m_chans)
+
+/* 80MHz channels in 5GHz band */
+static const uint8 wf_5g_80m_chans[] = {
+       42, 58, 106, 122, 138, 155, 171
+};
+#define WF_NUM_5G_80M_CHANS ARRAYSIZE(wf_5g_80m_chans)
+
+/* 160MHz channels in 5GHz band */
+static const uint8 wf_5g_160m_chans[] = {
+       50, 114, 163
+};
+#define WF_NUM_5G_160M_CHANS ARRAYSIZE(wf_5g_160m_chans)
+
+/** 80MHz channels in 6GHz band */
+#define WF_NUM_6G_80M_CHANS 14
+
+/** 160MHz channels in 6GHz band */
+#define WF_NUM_6G_160M_CHANS 7 /* TBD */
+
+/** 320MHz channels in 6GHz band */
+#define WF_NUM_6G_320M_CHANS 3 /* TBD */
+
+/* Define the conditional macro to help with reducing the code size bloat
+ * in other branches and in trunk targets that don't need 11BE features...
+ */
+#define WFC_2VALS_EQ(var, val) ((var) == (val))
+
+/* compare bandwidth unconditionally for 11be related stuff */
+#ifdef WL11BE
+#define WFC_BW_EQ(bw, val)     WFC_2VALS_EQ(bw, val)
+#else
+#define WFC_BW_EQ(bw, val)     (FALSE)
+#endif
+
+/* compare bandwidth based on WFC_NON_CONT_CHAN */
+#ifdef WFC_NON_CONT_CHAN
+#define WFC_NCBW_EQ(bw, val)   WFC_2VALS_EQ(bw, val)
+#else
+#define WFC_NCBW_EQ(bw, val)   (FALSE)
+#endif
+
+static void wf_chanspec_iter_firstchan(wf_chanspec_iter_t *iter);
+static chanspec_bw_t wf_iter_next_bw(chanspec_bw_t bw);
+static bool wf_chanspec_iter_next_2g(wf_chanspec_iter_t *iter);
+static bool wf_chanspec_iter_next_5g(wf_chanspec_iter_t *iter);
+static int wf_chanspec_iter_next_5g_range(wf_chanspec_iter_t *iter, chanspec_bw_t bw);
+static void wf_chanspec_iter_6g_range_init(wf_chanspec_iter_t *iter, chanspec_bw_t bw);
+static bool wf_chanspec_iter_next_6g(wf_chanspec_iter_t *iter);
+
+/**
+ * Return the chanspec bandwidth in MHz
+ * Bandwidth of 160 MHz will be returned for 80+80MHz chanspecs.
+ *
+ * @param      chspec          chanspec_t
+ *
+ * @return     bandwidth of chspec in MHz units
+ */
+uint
+wf_bw_chspec_to_mhz(chanspec_t chspec)
+{
+       uint bw;
+
+       bw = (chspec & WL_CHANSPEC_BW_MASK) >> WL_CHANSPEC_BW_SHIFT;
+       return (bw >= WF_NUM_BW ? 0 : wf_chspec_bw_mhz[bw]);
+}
+
+/* bw in MHz, return the channel count from the center channel to the
+ * the channel at the edge of the band
+ */
+static uint
+center_chan_to_edge(chanspec_bw_t bw)
+{
+       uint delta = 0;
+
+       /* edge channels separated by BW - 10MHz on each side
+        * delta from cf to edge is half of that,
+        */
+       if (bw == WL_CHANSPEC_BW_40) {
+               /* 10 MHz */
+               delta = 2;
+       } else if (bw == WL_CHANSPEC_BW_80) {
+               /* 30 MHz */
+               delta = 6;
+       } else if (bw == WL_CHANSPEC_BW_160) {
+               /* 70 MHz */
+               delta = 14;
+       } else if (WFC_BW_EQ(bw, WL_CHANSPEC_BW_320)) {
+               /* 150 MHz */
+               delta = 30;
+       }
+
+       return delta;
+}
+
+/* return channel number of the low edge of the band
+ * given the center channel and BW
+ */
+static uint
+channel_low_edge(uint center_ch, chanspec_bw_t bw)
+{
+       return (center_ch - center_chan_to_edge(bw));
+}
+
+/* return side band number given center channel and primary20 channel
+ * return -1 on error
+ */
+static int
+channel_to_sb(uint center_ch, uint primary_ch, chanspec_bw_t bw)
+{
+       uint lowest = channel_low_edge(center_ch, bw);
+       uint sb;
+
+       if (primary_ch < lowest ||
+           (primary_ch - lowest) % 4) {
+               /* bad primary channel lower than the low edge of the channel,
+                * or not mult 4.
+                */
+               return -1;
+       }
+
+       sb = ((primary_ch - lowest) / 4);
+
+       /* sb must be a index to a 20MHz channel in range */
+       if ((bw == WL_CHANSPEC_BW_20 && sb >= 1) ||
+           (bw == WL_CHANSPEC_BW_40 && sb >= 2) ||
+           (bw == WL_CHANSPEC_BW_80 && sb >= 4) ||
+           (bw == WL_CHANSPEC_BW_160 && sb >= 8) ||
+           (WFC_BW_EQ(bw, WL_CHANSPEC_BW_320) && sb >= 16)) {
+               /* primary_ch must have been too high for the center_ch */
+               return -1;
+       }
+
+       return sb;
+}
+
+/* return primary20 channel given center channel and side band */
+static uint
+channel_to_primary20_chan(uint center_ch, chanspec_bw_t bw, uint sb)
+{
+       return (channel_low_edge(center_ch, bw) + sb * 4);
+}
+
+/* return index of 80MHz channel from channel number
+ * return -1 on error
+ */
+static int
+channel_80mhz_to_id(uint ch)
+{
+       uint i;
+       for (i = 0; i < WF_NUM_5G_80M_CHANS; i ++) {
+               if (ch == wf_5g_80m_chans[i])
+                       return i;
+       }
+
+       return -1;
+}
+
+/* return index of the 6G 80MHz channel from channel number
+ * return -1 on error
+ */
+static int
+channel_6g_80mhz_to_id(uint ch)
+{
+       /* The 6GHz center channels start at 7, and have a spacing of 16 */
+       if (ch >= CH_MIN_6G_80M_CHANNEL &&
+           ch <= CH_MAX_6G_80M_CHANNEL &&
+           ((ch - CH_MIN_6G_80M_CHANNEL) % 16) == 0) {  // even multiple of 16
+               return (ch - CH_MIN_6G_80M_CHANNEL) / 16;
+       }
+
+       return -1;
+}
+
+/* return index of the 5G 160MHz channel from channel number
+ * return -1 on error
+ */
+static int
+channel_5g_160mhz_to_id(uint ch)
+{
+       uint i;
+       for (i = 0; i < WF_NUM_5G_160M_CHANS; i ++) {
+               if (ch == wf_5g_160m_chans[i]) {
+                       return i;
+               }
+       }
+
+       return -1;
+}
+
+/* return index of the 6G 160MHz channel from channel number
+ * return -1 on error
+ */
+static int
+channel_6g_160mhz_to_id(uint ch)
+{
+       /* The 6GHz center channels start at 15, and have a spacing of 32 */
+       if (ch >= CH_MIN_6G_160M_CHANNEL &&
+           ch <= CH_MAX_6G_160M_CHANNEL &&
+           ((ch - CH_MIN_6G_160M_CHANNEL) % 32) == 0) {
+               return (ch - CH_MIN_6G_160M_CHANNEL) / 32;
+       }
+
+       return -1;
+}
+
+/* return index of the 6G 320MHz channel from channel number
+ * return -1 on error
+ */
+static int
+channel_6g_320mhz_to_id(uint ch)
+{
+       /* The 6GHz center channels start at 31, and have a spacing of 64 */
+       if (ch >= CH_MIN_6G_320M_CHANNEL &&
+           ch <= CH_MAX_6G_320M_CHANNEL &&
+           ((ch - CH_MIN_6G_320M_CHANNEL) % 64) == 0) {
+               return (ch - CH_MIN_6G_320M_CHANNEL) / 64;
+       }
+
+       return -1;
+}
+
+/**
+ * This function returns the the 5GHz 80MHz center channel for the given chanspec 80MHz ID
+ *
+ * @param    chan_80MHz_id    80MHz chanspec ID
+ *
+ * @return   Return the center channel number, or 0 on error.
+ *
+ */
+static uint8
+wf_chspec_5G_id80_to_ch(uint8 chan_80MHz_id)
+{
+       if (chan_80MHz_id < WF_NUM_5G_80M_CHANS) {
+               return wf_5g_80m_chans[chan_80MHz_id];
+       }
+
+       return 0;
+}
+
+/**
+ * This function returns the the 6GHz 80MHz center channel for the given chanspec 80MHz ID
+ *
+ * @param    chan_80MHz_id    80MHz chanspec ID
+ *
+ * @return   Return the center channel number, or 0 on error.
+ *
+ */
+static uint8
+wf_chspec_6G_id80_to_ch(uint8 chan_80MHz_id)
+{
+       uint8 ch = 0;
+
+       if (chan_80MHz_id < WF_NUM_6G_80M_CHANS) {
+               /* The 6GHz center channels have a spacing of 16
+                * starting from the first 80MHz center
+                */
+               ch = CH_MIN_6G_80M_CHANNEL + (chan_80MHz_id * 16);
+       }
+
+       return ch;
+}
+
+/**
+ * This function returns the the 5GHz 160MHz center channel for the given chanspec 160MHz ID
+ *
+ * @param    chan_160MHz_id    160MHz chanspec ID
+ *
+ * @return   Return the center channel number, or 0 on error.
+ *
+ */
+static uint8
+wf_chspec_5G_id160_to_ch(uint8 chan_160MHz_id)
+{
+       if (chan_160MHz_id < WF_NUM_5G_160M_CHANS) {
+               return wf_5g_160m_chans[chan_160MHz_id];
+       }
+
+       return 0;
+}
+
+/**
+ * This function returns the the 6GHz 160MHz center channel for the given chanspec 160MHz ID
+ *
+ * @param    chan_160MHz_id    160MHz chanspec ID
+ *
+ * @return   Return the center channel number, or 0 on error.
+ *
+ */
+static uint8
+wf_chspec_6G_id160_to_ch(uint8 chan_160MHz_id)
+{
+       uint8 ch = 0;
+
+       if (chan_160MHz_id < WF_NUM_6G_160M_CHANS) {
+               /* The 6GHz center channels have a spacing of 32
+                * starting from the first 160MHz center
+                */
+               ch = CH_MIN_6G_160M_CHANNEL + (chan_160MHz_id * 32);
+       }
+
+       return ch;
+}
+
+/**
+ * This function returns the the 6GHz 320MHz center channel for the given chanspec 320MHz ID
+ *
+ * @param    chan_320MHz_id    320MHz chanspec ID
+ *
+ * @return   Return the center channel number, or 0 on error.
+ *
+ */
+static uint8
+wf_chspec_6G_id320_to_ch(uint8 chan_320MHz_id)
+{
+       uint8 ch = 0;
+
+       if (chan_320MHz_id < WF_NUM_6G_320M_CHANS) {
+               /* The 6GHz center channels have a spacing of 64
+                * starting from the first 320MHz center
+                */
+               ch = CH_MIN_6G_320M_CHANNEL + (chan_320MHz_id * 64);
+       }
+
+       return ch;
+}
+
+/* Retrive the chan_id and convert it to center channel */
+uint8
+wf_chspec_320_id2cch(chanspec_t chanspec)
+{
+       if (CHSPEC_BAND(chanspec) == WL_CHANSPEC_BAND_6G &&
+           CHSPEC_BW(chanspec) == WL_CHANSPEC_BW_320) {
+               uint8 ch_id = CHSPEC_320_CHAN(chanspec);
+
+               return wf_chspec_6G_id320_to_ch(ch_id);
+       }
+       return 0;
+}
+
+/**
+ * Convert chanspec to ascii string, or formats hex of an invalid chanspec.
+ *
+ * @param      chspec   chanspec to format
+ * @param      buf      pointer to buf with room for at least CHANSPEC_STR_LEN bytes
+ *
+ * @return      Returns pointer to passed in buf. The buffer will have the ascii
+ *              representation of the given chspec, or "invalid 0xHHHH" where
+ *              0xHHHH is the hex representation of the invalid chanspec.
+ *
+ * @see                CHANSPEC_STR_LEN
+ *
+ * Wrapper function for wf_chspec_ntoa. In case of an error it puts
+ * the original chanspec in the output buffer, prepended with "invalid".
+ * Can be directly used in print routines as it takes care of null
+ */
+char *
+wf_chspec_ntoa_ex(chanspec_t chspec, char *buf)
+{
+       if (wf_chspec_ntoa(chspec, buf) == NULL)
+               snprintf(buf, CHANSPEC_STR_LEN, "invalid 0x%04x", chspec);
+       return buf;
+}
+
+/**
+ * Convert chanspec to ascii string, or return NULL on error.
+ *
+ * @param      chspec   chanspec to format
+ * @param      buf      pointer to buf with room for at least CHANSPEC_STR_LEN bytes
+ *
+ * @return      Returns pointer to passed in buf or NULL on error. On sucess, the buffer
+ *              will have the ascii representation of the given chspec.
+ *
+ * @see                CHANSPEC_STR_LEN
+ *
+ * Given a chanspec and a string buffer, format the chanspec as a
+ * string, and return the original pointer buf.
+ * Min buffer length must be CHANSPEC_STR_LEN.
+ * On error return NULL.
+ */
+char *
+wf_chspec_ntoa(chanspec_t chspec, char *buf)
+{
+       const char *band;
+       uint pri_chan;
+
+       if (wf_chspec_malformed(chspec))
+               return NULL;
+
+       band = "";
+
+       /* check for non-default band spec */
+       if (CHSPEC_IS2G(chspec) && CHSPEC_CHANNEL(chspec) > CH_MAX_2G_CHANNEL) {
+               band = "2g";
+       } else if (CHSPEC_IS5G(chspec) && CHSPEC_CHANNEL(chspec) <= CH_MAX_2G_CHANNEL) {
+               band = "5g";
+       } else if (CHSPEC_IS6G(chspec)) {
+               band = "6g";
+       }
+
+       /* primary20 channel */
+       pri_chan = wf_chspec_primary20_chan(chspec);
+
+       /* bandwidth and primary20 sideband */
+       if (CHSPEC_IS20(chspec)) {
+               snprintf(buf, CHANSPEC_STR_LEN, "%s%d", band, pri_chan);
+       } else if (CHSPEC_IS8080(chspec)) {
+               /* 80+80 */
+               uint ch0;
+               uint ch1;
+
+               /* get the center channels for each frequency segment */
+               if (CHSPEC_IS5G(chspec)) {
+                       ch0 = wf_chspec_5G_id80_to_ch(CHSPEC_CHAN0(chspec));
+                       ch1 = wf_chspec_5G_id80_to_ch(CHSPEC_CHAN1(chspec));
+               } else if (CHSPEC_IS6G(chspec)) {
+                       ch0 = wf_chspec_6G_id80_to_ch(CHSPEC_CHAN0(chspec));
+                       ch1 = wf_chspec_6G_id80_to_ch(CHSPEC_CHAN1(chspec));
+               } else {
+                       return NULL;
+               }
+
+               /* Outputs a max of CHANSPEC_STR_LEN chars including '\0'  */
+               snprintf(buf, CHANSPEC_STR_LEN, "%s%d/80+80/%d-%d", band, pri_chan, ch0, ch1);
+       } else if (CHSPEC_IS320(chspec)) {
+               /* 320 */
+               uint ch;
+               const char *bw;
+
+               /* get the center channels for each frequency segment */
+               if (CHSPEC_IS6G(chspec)) {
+                       ch = wf_chspec_6G_id320_to_ch(CHSPEC_320_CHAN(chspec));
+               } else {
+                       return NULL;
+               }
+
+               bw = wf_chspec_to_bw_str(chspec);
+
+               snprintf(buf, CHANSPEC_STR_LEN, "%s%d/%s", band, ch, bw);
+       } else if (CHSPEC_IS160160(chspec)) {
+               /* 160+160 */
+               uint ch0;
+               uint ch1;
+
+               /* get the center channels for each frequency segment */
+               if (CHSPEC_IS5G(chspec)) {
+                       ch0 = wf_chspec_5G_id160_to_ch(CHSPEC_CHAN0(chspec));
+                       ch1 = wf_chspec_5G_id160_to_ch(CHSPEC_CHAN1(chspec));
+               } else if (CHSPEC_IS6G(chspec)) {
+                       ch0 = wf_chspec_6G_id160_to_ch(CHSPEC_CHAN0(chspec));
+                       ch1 = wf_chspec_6G_id160_to_ch(CHSPEC_CHAN1(chspec));
+               } else {
+                       return NULL;
+               }
+
+               /* Outputs a max of CHANSPEC_STR_LEN chars including '\0'  */
+               snprintf(buf, CHANSPEC_STR_LEN, "%s%d/160+160/%d-%d", band, pri_chan, ch0, ch1);
+       } else {
+               const char *bw;
+               const char *sb = "";
+
+               bw = wf_chspec_to_bw_str(chspec);
+
+#ifdef CHANSPEC_NEW_40MHZ_FORMAT
+               /* primary20 sideband string if needed for 2g 40MHz */
+               if (CHSPEC_IS40(chspec) && CHSPEC_IS2G(chspec)) {
+                       sb = CHSPEC_SB_UPPER(chspec) ? "u" : "l";
+               }
+
+               snprintf(buf, CHANSPEC_STR_LEN, "%s%d/%s%s", band, pri_chan, bw, sb);
+#else
+               /* primary20 sideband string instead of BW for 40MHz */
+               if (CHSPEC_IS40(chspec) && !CHSPEC_IS6G(chspec)) {
+                       sb = CHSPEC_SB_UPPER(chspec) ? "u" : "l";
+                       snprintf(buf, CHANSPEC_STR_LEN, "%s%d%s", band, pri_chan, sb);
+               } else {
+                       snprintf(buf, CHANSPEC_STR_LEN, "%s%d/%s", band, pri_chan, bw);
+               }
+#endif /* CHANSPEC_NEW_40MHZ_FORMAT */
+       }
+
+       return (buf);
+}
+
+static int
+read_uint(const char **p, unsigned int *num)
+{
+       unsigned long val;
+       char *endp = NULL;
+
+       val = strtoul(*p, &endp, 10);
+       /* if endp is the initial pointer value, then a number was not read */
+       if (endp == *p)
+               return 0;
+
+       /* advance the buffer pointer to the end of the integer string */
+       *p = endp;
+       /* return the parsed integer */
+       *num = (unsigned int)val;
+
+       return 1;
+}
+
+/**
+ * Convert ascii string to chanspec
+ *
+ * @param      a     pointer to input string
+ *
+ * @return     Return > 0 if successful or 0 otherwise
+ */
+chanspec_t
+wf_chspec_aton(const char *a)
+{
+       chanspec_t chspec;
+       chanspec_band_t chspec_band;
+       chanspec_subband_t chspec_sb;
+       chanspec_bw_t chspec_bw;
+       uint bw;
+       uint num, pri_ch;
+       char c, sb_ul = '\0';
+
+       bw = 20;
+       chspec_sb = 0;
+
+       /* parse channel num or band */
+       if (!read_uint(&a, &num))
+               return 0;
+       /* if we are looking at a 'g', then the first number was a band */
+       c = tolower((int)a[0]);
+       if (c == 'g') {
+               a++; /* consume the char */
+
+               /* band must be "2", "5", or "6" */
+               if (num == 2)
+                       chspec_band = WL_CHANSPEC_BAND_2G;
+               else if (num == 5)
+                       chspec_band = WL_CHANSPEC_BAND_5G;
+               else if (num == 6)
+                       chspec_band = WL_CHANSPEC_BAND_6G;
+               else
+                       return 0;
+
+               /* read the channel number */
+               if (!read_uint(&a, &pri_ch))
+                       return 0;
+
+               c = tolower((int)a[0]);
+       } else {
+               /* first number is channel, use default for band */
+               pri_ch = num;
+               chspec_band = ((pri_ch <= CH_MAX_2G_CHANNEL) ?
+                              WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G);
+       }
+
+       if (c == '\0') {
+               /* default BW of 20MHz */
+               chspec_bw = WL_CHANSPEC_BW_20;
+               goto done_read;
+       }
+
+       a ++; /* consume the 'u','l', or '/' */
+
+       /* check 'u'/'l' */
+       if (c == 'u' || c == 'l') {
+               sb_ul = c;
+               chspec_bw = WL_CHANSPEC_BW_40;
+               goto done_read;
+       }
+
+       /* next letter must be '/' */
+       if (c != '/')
+               return 0;
+
+       /* read bandwidth */
+       if (!read_uint(&a, &bw))
+               return 0;
+
+       /* convert to chspec value */
+       if (bw == 20) {
+               chspec_bw = WL_CHANSPEC_BW_20;
+       } else if (bw == 40) {
+               chspec_bw = WL_CHANSPEC_BW_40;
+       } else if (bw == 80) {
+               chspec_bw = WL_CHANSPEC_BW_80;
+       } else if (bw == 160) {
+               chspec_bw = WL_CHANSPEC_BW_160;
+       } else if (WFC_BW_EQ(bw, 320)) {
+               chspec_bw = WL_CHANSPEC_BW_320;
+       } else {
+               return 0;
+       }
+
+       /* So far we have <band>g<chan>/<bw>
+        * Can now be followed by u/l if bw = 40,
+        */
+
+       c = tolower((int)a[0]);
+
+       /* if we have a 2g/40 channel, we should have a l/u spec now */
+       if (chspec_band == WL_CHANSPEC_BAND_2G && bw == 40) {
+               if (c == 'u' || c == 'l') {
+                       a ++; /* consume the u/l char */
+                       sb_ul = c;
+                       goto done_read;
+               }
+       }
+
+       /* check for 80+80 or 160+160 */
+       if (c == '+') {
+               return 0;
+       }
+
+done_read:
+       /* skip trailing white space */
+       while (a[0] == ' ') {
+               a ++;
+       }
+
+       /* must be end of string */
+       if (a[0] != '\0')
+               return 0;
+
+       /* Now have all the chanspec string parts read;
+        * chspec_band, pri_ch, chspec_bw, sb_ul.
+        * chspec_band and chspec_bw are chanspec values.
+        * Need to convert pri_ch, and sb_ul into
+        * a center channel (or two) and sideband.
+        */
+
+       /* if a sb u/l string was given, just use that,
+        * guaranteed to be bw = 40 by string parse.
+        */
+       if (sb_ul != '\0') {
+               if (sb_ul == 'l') {
+                       chspec_sb = WL_CHANSPEC_CTL_SB_LLL;
+               } else if (sb_ul == 'u') {
+                       chspec_sb = WL_CHANSPEC_CTL_SB_LLU;
+               }
+               chspec = wf_create_40MHz_chspec_primary_sb(pri_ch, chspec_sb, chspec_band);
+       } else if (chspec_bw == WL_CHANSPEC_BW_20) {
+               /* if the bw is 20, only need the primary channel and band */
+               chspec = wf_create_20MHz_chspec(pri_ch, chspec_band);
+       } else {
+               /* If the bw is 40/80/160/320 (and not 40MHz 2G), the channels are
+                * non-overlapping in 5G or 6G bands. Each primary channel is contained
+                * in only one higher bandwidth channel. The wf_create_chspec_from_primary()
+                * will create the chanspec. 2G 40MHz is handled just above, assuming a {u,l}
+                * sub-band spec was given.
+                */
+               chspec = wf_create_chspec_from_primary(pri_ch, chspec_bw, chspec_band);
+       }
+
+       if (wf_chspec_malformed(chspec))
+               return 0;
+
+       return chspec;
+}
+
+/**
+ * Verify the chanspec is using a legal set of parameters, i.e. that the
+ * chanspec specified a band, bw, pri_sb and channel and that the
+ * combination could be legal given any set of circumstances.
+ *
+ * @param  chanspec   the chanspec to check
+ *
+ * @return Returns TRUE if the chanspec is malformed, FALSE if it looks good.
+ */
+bool
+wf_chspec_malformed(chanspec_t chanspec)
+{
+       uint chspec_bw = CHSPEC_BW(chanspec);
+       uint chspec_sb;
+
+       if (CHSPEC_IS2G(chanspec)) {
+               /* must be valid bandwidth for 2G */
+               if (!BW_LE40(chspec_bw)) {
+                       return TRUE;
+               }
+
+               /* check for invalid channel number */
+               if (CHSPEC_CHANNEL(chanspec) == INVCHANNEL) {
+                       return TRUE;
+               }
+       } else if (CHSPEC_IS5G(chanspec) || CHSPEC_IS6G(chanspec)) {
+               if (WFC_BW_EQ(chspec_bw, WL_CHANSPEC_BW_320)) {
+                       uint ch_id;
+
+                       ch_id = CHSPEC_320_CHAN(chanspec);
+
+                       /* channel IDs in 320 must be in range */
+                       if (CHSPEC_IS6G(chanspec)) {
+                               if (ch_id >= WF_NUM_6G_320M_CHANS) {
+                                       /* bad 320MHz channel ID for the band */
+                                       return TRUE;
+                               }
+                       } else {
+                               return TRUE;
+                       }
+               } else if (WFC_NCBW_EQ(chspec_bw, WL_CHANSPEC_BW_160160)) {
+                       uint ch0_id, ch1_id;
+
+                       ch0_id = CHSPEC_CHAN0(chanspec);
+                       ch1_id = CHSPEC_CHAN1(chanspec);
+
+                       /* channel IDs in 160+160 must be in range */
+                       if (CHSPEC_IS5G(chanspec) &&
+                           (ch0_id >= WF_NUM_5G_160M_CHANS || ch1_id >= WF_NUM_5G_160M_CHANS)) {
+                               /* bad 160MHz channel ID for the band */
+                               return TRUE;
+                       }
+                       if (CHSPEC_IS6G(chanspec) &&
+                           (ch0_id >= WF_NUM_6G_160M_CHANS || ch1_id >= WF_NUM_6G_160M_CHANS)) {
+                               /* bad 160MHz channel ID for the band */
+                               return TRUE;
+                       }
+               } else if (WFC_NCBW_EQ(chspec_bw, WL_CHANSPEC_BW_8080)) {
+                       uint ch0_id, ch1_id;
+
+                       ch0_id = CHSPEC_CHAN0(chanspec);
+                       ch1_id = CHSPEC_CHAN1(chanspec);
+
+                       /* channel IDs in 80+80 must be in range */
+                       if (CHSPEC_IS5G(chanspec) &&
+                           (ch0_id >= WF_NUM_5G_80M_CHANS || ch1_id >= WF_NUM_5G_80M_CHANS)) {
+                               /* bad 80MHz channel ID for the band */
+                               return TRUE;
+                       }
+                       if (CHSPEC_IS6G(chanspec) &&
+                           (ch0_id >= WF_NUM_6G_80M_CHANS || ch1_id >= WF_NUM_6G_80M_CHANS)) {
+                               /* bad 80MHz channel ID for the band */
+                               return TRUE;
+                       }
+               } else if (chspec_bw == WL_CHANSPEC_BW_20 || chspec_bw == WL_CHANSPEC_BW_40 ||
+                          chspec_bw == WL_CHANSPEC_BW_80 || chspec_bw == WL_CHANSPEC_BW_160) {
+
+                       /* check for invalid channel number */
+                       if (CHSPEC_CHANNEL(chanspec) == INVCHANNEL) {
+                               return TRUE;
+                       }
+               } else {
+                       /* invalid bandwidth */
+                       return TRUE;
+               }
+       } else {
+               /* must be a valid band */
+               return TRUE;
+       }
+
+       /* retrive sideband */
+       if (WFC_BW_EQ(chspec_bw, WL_CHANSPEC_BW_320)) {
+               chspec_sb = CHSPEC_320_SB(chanspec);
+       } else {
+               chspec_sb = CHSPEC_CTL_SB(chanspec);
+       }
+
+       /* side band needs to be consistent with bandwidth */
+       if (chspec_bw == WL_CHANSPEC_BW_20) {
+               if (chspec_sb != WL_CHANSPEC_CTL_SB_LLL)
+                       return TRUE;
+       } else if (chspec_bw == WL_CHANSPEC_BW_40) {
+               if (chspec_sb > WL_CHANSPEC_CTL_SB_LLU)
+                       return TRUE;
+       } else if (chspec_bw == WL_CHANSPEC_BW_80 ||
+                  WFC_NCBW_EQ(chspec_bw, WL_CHANSPEC_BW_8080)) {
+               /* both 80MHz and 80+80MHz use 80MHz side bands.
+                * 80+80 SB info is relative to the primary 80MHz sub-band.
+                */
+               if (chspec_sb > WL_CHANSPEC_CTL_SB_LUU)
+                       return TRUE;
+       } else if (chspec_bw == WL_CHANSPEC_BW_160 ||
+                  WFC_NCBW_EQ(chspec_bw, WL_CHANSPEC_BW_160160)) {
+               ASSERT(chspec_sb <= WL_CHANSPEC_CTL_SB_UUU);
+       } else if (WFC_BW_EQ(chspec_bw, WL_CHANSPEC_BW_320)) {
+               /* FIXME: define the max the sideband index */
+               ASSERT(chspec_sb <= 15);
+       }
+
+       return FALSE;
+}
+
+/**
+ * Verify the chanspec specifies a valid channel according to 802.11.
+ *
+ * @param   chanspec     the chanspec to check
+ *
+ * @return  Returns TRUE if the chanspec is a valid 802.11 channel
+ */
+bool
+wf_chspec_valid(chanspec_t chanspec)
+{
+       chanspec_band_t chspec_band = CHSPEC_BAND(chanspec);
+       chanspec_bw_t chspec_bw = CHSPEC_BW(chanspec);
+       uint chspec_ch = -1;
+
+       if (wf_chspec_malformed(chanspec)) {
+               return FALSE;
+       }
+
+       if (WFC_BW_EQ(chspec_bw, WL_CHANSPEC_BW_320)) {
+               if (CHSPEC_IS6G(chanspec)) {
+                       chspec_ch = wf_chspec_6G_id320_to_ch(CHSPEC_320_CHAN(chanspec));
+               } else {
+                       return FALSE;
+               }
+       } else {
+               chspec_ch = CHSPEC_CHANNEL(chanspec);
+       }
+
+       /* After the malformed check, we know that we have
+        * a valid band field,
+        * a valid bandwidth for the band,
+        * and a valid sub-band value for the bandwidth.
+        *
+        * Since all sub-band specs are valid for any channel, the only thing remaining to
+        * check is that
+        *   the 20MHz channel,
+        *   or the center channel for higher BW,
+        *   or both center channels for an 80+80MHz channel,
+        * are valid for the specified band.
+        * Also, 80+80MHz channels need to be non-contiguous.
+        */
+
+       if (chspec_bw == WL_CHANSPEC_BW_20) {
+
+               return wf_valid_20MHz_chan(chspec_ch, chspec_band);
+
+       } else if (chspec_bw == WL_CHANSPEC_BW_40) {
+
+               return wf_valid_40MHz_center_chan(chspec_ch, chspec_band);
+
+       } else if (chspec_bw == WL_CHANSPEC_BW_80) {
+
+               return wf_valid_80MHz_center_chan(chspec_ch, chspec_band);
+
+       } else if (chspec_bw == WL_CHANSPEC_BW_160) {
+
+               return wf_valid_160MHz_center_chan(chspec_ch, chspec_band);
+
+       } else if (WFC_BW_EQ(chspec_bw, WL_CHANSPEC_BW_320)) {
+
+               return wf_valid_320MHz_center_chan(chspec_ch, chspec_band);
+
+       } else if (WFC_NCBW_EQ(chspec_bw, WL_CHANSPEC_BW_8080)) {
+               uint16 ch0 = 0;
+               uint16 ch1 = 0;
+
+               /* get the center channels for each frequency segment */
+               if (CHSPEC_IS5G(chanspec)) {
+                       ch0 = wf_chspec_5G_id80_to_ch(CHSPEC_CHAN0(chanspec));
+                       ch1 = wf_chspec_5G_id80_to_ch(CHSPEC_CHAN1(chanspec));
+               } else if (CHSPEC_IS6G(chanspec)) {
+                       ch0 = wf_chspec_6G_id80_to_ch(CHSPEC_CHAN0(chanspec));
+                       ch1 = wf_chspec_6G_id80_to_ch(CHSPEC_CHAN1(chanspec));
+               } else {
+                       return FALSE;
+               }
+
+               /* the two channels must be separated by more than 80MHz by VHT req */
+               if ((ch1 > ch0 + CH_80MHZ_APART) ||
+                   (ch0 > ch1 + CH_80MHZ_APART))
+                       return TRUE;
+       } else if (WFC_NCBW_EQ(chspec_bw, WL_CHANSPEC_BW_160160)) {
+               uint16 ch0 = 0;
+               uint16 ch1 = 0;
+
+               /* get the center channels for each frequency segment */
+               if (CHSPEC_IS5G(chanspec)) {
+                       ch0 = wf_chspec_5G_id160_to_ch(CHSPEC_CHAN0(chanspec));
+                       ch1 = wf_chspec_5G_id160_to_ch(CHSPEC_CHAN1(chanspec));
+               } else if (CHSPEC_IS6G(chanspec)) {
+                       ch0 = wf_chspec_6G_id160_to_ch(CHSPEC_CHAN0(chanspec));
+                       ch1 = wf_chspec_6G_id160_to_ch(CHSPEC_CHAN1(chanspec));
+               } else {
+                       return FALSE;
+               }
+
+               /* the two channels must be separated by more than 160MHz by EHT req */
+               if ((ch1 > ch0 + CH_160MHZ_APART) ||
+                   (ch0 > ch1 + CH_160MHZ_APART)) {
+                       return TRUE;
+               }
+       }
+
+       return FALSE;
+}
+
+/* 5G band 20MHz channel ranges with even (+4) channel spacing */
+static const struct wf_iter_range wf_5g_iter_ranges[] = {
+       {36, 64},
+       {100, 144},
+       {149, 165}
+};
+
+#define RANGE_ID_INVAL 0xFFu
+enum wf_iter_state {
+       WF_ITER_INIT = 0,
+       WF_ITER_RUN  = 1,
+       WF_ITER_DONE = 2
+};
+
+/**
+ * @brief  Initialize a chanspec iteration structure.
+ */
+bool
+wf_chanspec_iter_init(wf_chanspec_iter_t *iter, chanspec_band_t band, chanspec_bw_t bw)
+{
+       if (iter == NULL) {
+               return FALSE;
+       }
+
+       /* Initialize the iter structure to the "DONE" state
+        * in case the parameter validation fails.
+        * If the validation fails then the iterator will return INVCHANSPEC as the current
+        * chanspec, and wf_chanspec_iter_next() will return FALSE.
+        */
+       memset(iter, 0, sizeof(*iter));
+       iter->state = WF_ITER_DONE;
+       iter->chanspec = INVCHANSPEC;
+
+       if (band != WL_CHANSPEC_BAND_2G &&
+           band != WL_CHANSPEC_BAND_5G &&
+           band != WL_CHANSPEC_BAND_6G) {
+               ASSERT(0);
+               return FALSE;
+       }
+
+       /* make sure the BW is unspecified (INVCHANSPEC), 20/40,
+        * or (not 2g and 80/160)
+        */
+       if (!(bw == INVCHANSPEC ||
+             bw == WL_CHANSPEC_BW_20 ||
+             bw == WL_CHANSPEC_BW_40 ||
+             (band != WL_CHANSPEC_BAND_2G &&
+              (bw == WL_CHANSPEC_BW_80 ||
+               bw == WL_CHANSPEC_BW_160 ||
+               WFC_BW_EQ(bw, WL_CHANSPEC_BW_320))))) {
+
+               ASSERT(0);
+               return FALSE;
+       }
+
+       /* Validation of the params is successful so move to the "INIT" state to
+        * allow the first wf_chanspec_iter_next() move the iteration to the first
+        * chanspec in the set.
+        */
+       iter->state = WF_ITER_INIT;
+       iter->band = band;
+       iter->bw = bw;
+       iter->range_id = RANGE_ID_INVAL;
+
+       return TRUE;
+}
+
+/**
+ * Start the iterator off from the 'init' state.
+ * The internal state is set up and advanced to the first chanspec.
+ */
+static void
+wf_chanspec_iter_firstchan(wf_chanspec_iter_t *iter)
+{
+       chanspec_band_t band = iter->band;
+       chanspec_bw_t bw = iter->bw;
+       chanspec_t chspec;
+
+       /* if BW unspecified (INVCHANSPEC), start with 20 MHz */
+       if (bw == INVCHANSPEC) {
+               bw = WL_CHANSPEC_BW_20;
+       }
+
+       /* calc the initial channel based on band */
+       if (band == WL_CHANSPEC_BAND_2G) {
+               /* 2g has overlapping 40MHz channels, so cannot just use the
+                * wf_create_chspec_from_primary() fn.
+                */
+               if (bw == WL_CHANSPEC_BW_20) {
+                       chspec = wf_create_20MHz_chspec(CH_MIN_2G_CHANNEL, band);
+               } else {
+                       chspec = (WL_CHANSPEC_BAND_2G | bw | WL_CHANSPEC_CTL_SB_L |
+                                 CH_MIN_2G_40M_CHANNEL);
+               }
+       } else {
+               if (band == WL_CHANSPEC_BAND_5G) {
+                       wf_chanspec_iter_next_5g_range(iter, bw);
+               } else {
+                       wf_chanspec_iter_6g_range_init(iter, bw);
+               }
+               chspec = wf_create_chspec_from_primary(iter->range.start, bw, band);
+       }
+
+       iter->chanspec = chspec;
+}
+
+/**
+ * @brief Return the current chanspec of the iteration.
+ */
+chanspec_t
+wf_chanspec_iter_current(wf_chanspec_iter_t *iter)
+{
+       return iter->chanspec;
+}
+
+/**
+ * @brief Advance the iteration to the next chanspec in the set.
+ */
+bool
+wf_chanspec_iter_next(wf_chanspec_iter_t *iter, chanspec_t *chspec)
+{
+       bool ok = FALSE;
+       chanspec_band_t band = iter->band;
+
+       /* Handle the INIT and DONE states. Otherwise, we are in the RUN state
+        * and will dispatch to the 'next' function for the appropriate band.
+        */
+       if (iter->state == WF_ITER_INIT) {
+               iter->state = WF_ITER_RUN;
+               wf_chanspec_iter_firstchan(iter);
+               ok = TRUE;
+       } else if (iter->state == WF_ITER_DONE) {
+               ok = FALSE;
+       } else if (band == WL_CHANSPEC_BAND_2G) {
+               ok = wf_chanspec_iter_next_2g(iter);
+       } else if (band == WL_CHANSPEC_BAND_5G) {
+               ok = wf_chanspec_iter_next_5g(iter);
+       } else if (band == WL_CHANSPEC_BAND_6G) {
+               ok = wf_chanspec_iter_next_6g(iter);
+       }
+
+       /* Return the new chanspec if a pointer was provided.
+        * In case the iteration is done, the return will be INVCHANSPEC.
+        */
+       if (chspec != NULL) {
+               *chspec = iter->chanspec;
+       }
+
+       return ok;
+}
+
+/**
+ * When the iterator completes a particular bandwidth, this function
+ * returns the next BW, or INVCHANSPEC when done.
+ *
+ * Internal iterator helper.
+ */
+static chanspec_bw_t
+wf_iter_next_bw(chanspec_bw_t bw)
+{
+       switch (bw) {
+       case WL_CHANSPEC_BW_20:
+               bw = WL_CHANSPEC_BW_40;
+               break;
+       case WL_CHANSPEC_BW_40:
+               bw = WL_CHANSPEC_BW_80;
+               break;
+       case WL_CHANSPEC_BW_80:
+               bw = WL_CHANSPEC_BW_160;
+               break;
+#ifdef WL11BE
+       case WL_CHANSPEC_BW_160:
+               bw = WL_CHANSPEC_BW_320;
+               break;
+#endif
+       default:
+               bw = INVCHANSPEC;
+               break;
+       }
+       return bw;
+}
+
+/**
+ * This is the _iter_next() helper for 2g band chanspec iteration.
+ */
+static bool
+wf_chanspec_iter_next_2g(wf_chanspec_iter_t *iter)
+{
+       chanspec_t chspec = iter->chanspec;
+       uint8 ch = CHSPEC_CHANNEL(chspec);
+
+       if (CHSPEC_IS20(chspec)) {
+               if (ch < CH_MAX_2G_CHANNEL) {
+                       ch++;
+                       chspec = wf_create_20MHz_chspec(ch, WL_CHANSPEC_BAND_2G);
+               } else if (iter->bw == INVCHANSPEC) {
+                       /* hit the end of 20M channels, go to 40M if bw was unspecified */
+                       ch = CH_MIN_2G_40M_CHANNEL;
+                       chspec = wf_create_40MHz_chspec(LOWER_20_SB(ch), ch, WL_CHANSPEC_BAND_2G);
+               } else {
+                       /* done */
+                       iter->state = WF_ITER_DONE;
+                       chspec = INVCHANSPEC;
+               }
+       } else {
+               /* step through low then high primary sideband, then next 40 center channel */
+               if (CHSPEC_SB_LOWER(iter->chanspec)) {
+                       /* move from lower primary 20 to upper */
+                       chspec = wf_create_40MHz_chspec(UPPER_20_SB(ch),
+                                                       ch, WL_CHANSPEC_BAND_2G);
+               } else if (ch < CH_MAX_2G_40M_CHANNEL) {
+                       /* move to next 40M center and lower primary 20 */
+                       ch++;
+                       chspec = wf_create_40MHz_chspec(LOWER_20_SB(ch),
+                                                       ch, WL_CHANSPEC_BAND_2G);
+               } else {
+                       /* done */
+                       iter->state = WF_ITER_DONE;
+                       chspec = INVCHANSPEC;
+               }
+       }
+
+       iter->chanspec = chspec;
+
+       return (chspec != INVCHANSPEC);
+}
+
+/**
+ * This is the _iter_next() helper for 5g band chanspec iteration.
+ * The 5g iterator uses ranges of primary 20MHz channels, and the current BW, to create
+ * each chanspec in the set.
+ * When a 5g range is exhausted, wf_chanspec_iter_next_5g_range() is called to get the next
+ * range appropriate to the current BW.
+ */
+static bool
+wf_chanspec_iter_next_5g(wf_chanspec_iter_t *iter)
+{
+       chanspec_t chspec = iter->chanspec;
+       chanspec_bw_t bw = CHSPEC_BW(chspec);
+       uint8 ch = wf_chspec_primary20_chan(chspec);
+       uint8 end = iter->range.end;
+
+       if (ch < end) {
+               /* not at the end of the current range, so
+                * step to the next 20MHz channel and create the current BW
+                * channel with that new primary 20MHz.
+                */
+               ch += CH_20MHZ_APART;
+       } else if (wf_chanspec_iter_next_5g_range(iter, bw)) {
+               /* there was a new range in the current BW, so start at the beginning */
+               ch = iter->range.start;
+       } else if (iter->bw == INVCHANSPEC) {
+               /* hit the end of current bw, so move to the next bw */
+               bw = wf_iter_next_bw(bw);
+               if (bw != INVCHANSPEC) {
+                       /* initialize the first range */
+                       iter->range_id = RANGE_ID_INVAL;
+                       wf_chanspec_iter_next_5g_range(iter, bw);
+                       ch = iter->range.start;
+               } else {
+                       /* no more BWs */
+                       chspec = INVCHANSPEC;
+               }
+       } else {
+               /* no more channels, ranges, or BWs */
+               chspec = INVCHANSPEC;
+       }
+
+       /* if we are not at the end of the iteration, calc the next chanspec from components */
+       if (chspec != INVCHANSPEC) {
+               chspec = wf_create_chspec_from_primary(ch, bw, WL_CHANSPEC_BAND_5G);
+       }
+
+       iter->chanspec = chspec;
+       if (chspec != INVCHANSPEC) {
+               return TRUE;
+       } else {
+               iter->state = WF_ITER_DONE;
+               return FALSE;
+       }
+}
+
+/**
+ * Helper function to set up the next range of primary 20MHz channels to
+ * iterate over for the current BW. This will advance
+ *    iter->range_id
+ * and set up
+ *    iter->range.start
+ *    iter->range.end
+ * for the new range.
+ * Returns FALSE if there are no more ranges in the current BW.
+ */
+static int
+wf_chanspec_iter_next_5g_range(wf_chanspec_iter_t *iter, chanspec_bw_t bw)
+{
+       uint8 range_id = iter->range_id;
+       const uint8 *channels;
+       uint count;
+
+       if (bw == WL_CHANSPEC_BW_20) {
+               if (range_id == RANGE_ID_INVAL) {
+                       range_id = 0;
+               } else {
+                       range_id++;
+               }
+
+               if (range_id < ARRAYSIZE(wf_5g_iter_ranges)) {
+                       iter->range_id = range_id;
+                       iter->range = wf_5g_iter_ranges[range_id];
+                       return TRUE;
+               }
+
+               return FALSE;
+       }
+
+       if (bw == WL_CHANSPEC_BW_40) {
+               channels = wf_5g_40m_chans;
+               count = WF_NUM_5G_40M_CHANS;
+       } else if (bw == WL_CHANSPEC_BW_80) {
+               channels = wf_5g_80m_chans;
+               count = WF_NUM_5G_80M_CHANS;
+       } else if (bw == WL_CHANSPEC_BW_160) {
+               channels = wf_5g_160m_chans;
+               count = WF_NUM_5G_160M_CHANS;
+       } else {
+               return FALSE;
+       }
+
+       if (range_id == RANGE_ID_INVAL) {
+               range_id = 0;
+       } else {
+               range_id++;
+       }
+       if (range_id < count) {
+               uint8 ch = channels[range_id];
+               uint offset = center_chan_to_edge(bw);
+
+               iter->range_id = range_id;
+               iter->range.start = ch - offset;
+               iter->range.end = ch + offset;
+               return TRUE;
+       }
+
+       return FALSE;
+}
+
+/**
+ * This is the _iter_next() helper for 6g band chanspec iteration.
+ * The 6g iterator uses ranges of primary 20MHz channels, and the current BW, to create
+ * each chanspec in the set.
+ * Each BW in 6g has one contiguous range of primary 20MHz channels. When a range is
+ * exhausted, the iterator moves to the next BW.
+ */
+static bool
+wf_chanspec_iter_next_6g(wf_chanspec_iter_t *iter)
+{
+       chanspec_t chspec = iter->chanspec;
+       chanspec_bw_t bw = CHSPEC_BW(chspec);
+       uint8 ch = wf_chspec_primary20_chan(chspec);
+       uint8 end = iter->range.end;
+
+       if (ch < end) {
+               /* not at the end of the current range, so
+                * step to the next 20MHz channel and create the current BW
+                * channel with that new primary 20MHz.
+                */
+               ch += CH_20MHZ_APART;
+
+               /* try to create a valid channel of the current BW
+                * with a primary20 'ch'
+                */
+               chspec = wf_create_chspec_from_primary(ch, bw, WL_CHANSPEC_BAND_6G);
+
+               /* if chspec is INVCHANSPEC, then we hit the end
+                * of the valid channels in the range.
+                */
+       } else {
+               /* hit the end of the current range */
+               chspec = INVCHANSPEC;
+       }
+
+       /* if we are at the end of the current channel range
+        * check if there is another BW to iterate
+        * Note: (iter->bw == INVCHANSPEC) indicates an unspecified BW for the interation,
+        * so it will iterate over all BWs.
+        */
+       if (chspec == INVCHANSPEC &&
+           iter->bw == INVCHANSPEC &&
+           (bw = wf_iter_next_bw(bw)) != INVCHANSPEC) {
+               /* start the new bw with the first primary20 */
+               ch = iter->range.start;
+               chspec = wf_create_chspec_from_primary(ch, bw, WL_CHANSPEC_BAND_6G);
+       }
+
+       iter->chanspec = chspec;
+       if (chspec != INVCHANSPEC) {
+               return TRUE;
+       } else {
+               iter->state = WF_ITER_DONE;
+               return FALSE;
+       }
+}
+
+/**
+ * Helper used by wf_chanspec_iter_firstchan() to set up the first range of
+ * primary channels for the 6g band and for the BW being iterated.
+ */
+static void
+wf_chanspec_iter_6g_range_init(wf_chanspec_iter_t *iter, chanspec_bw_t bw)
+{
+       switch (bw) {
+       case WL_CHANSPEC_BW_20:
+       case WL_CHANSPEC_BW_40:
+       case WL_CHANSPEC_BW_80:
+       case WL_CHANSPEC_BW_160:
+#ifdef WL11BE
+       case WL_CHANSPEC_BW_320:
+#endif
+               iter->range.start = CH_MIN_6G_CHANNEL;
+               iter->range.end   = CH_MAX_6G_CHANNEL;
+               break;
+       default:
+               ASSERT(0);
+               break;
+       }
+}
+
+/**
+ * Verify that the channel is a valid 20MHz channel according to 802.11.
+ *
+ * @param  channel   20MHz channel number to validate
+ * @param  band      chanspec band
+ *
+ * @return Return TRUE if valid
+ */
+bool
+wf_valid_20MHz_chan(uint channel, chanspec_band_t band)
+{
+       if (band == WL_CHANSPEC_BAND_2G) {
+               /* simple range check for 2GHz */
+               return (channel >= CH_MIN_2G_CHANNEL &&
+                       channel <= CH_MAX_2G_CHANNEL);
+       } else if (band == WL_CHANSPEC_BAND_5G) {
+               const uint8 *center_ch = wf_5g_40m_chans;
+               uint num_ch = WF_NUM_5G_40M_CHANS;
+               uint i;
+
+               /* We don't have an array of legal 20MHz 5G channels, but they are
+                * each side of the legal 40MHz channels.  Check the chanspec
+                * channel against either side of the 40MHz channels.
+                */
+               for (i = 0; i < num_ch; i ++) {
+                       if (channel == (uint)LOWER_20_SB(center_ch[i]) ||
+                           channel == (uint)UPPER_20_SB(center_ch[i])) {
+                               break; /* match found */
+                       }
+               }
+
+               if (i == num_ch) {
+                       /* check for channel 165 which is not the side band
+                        * of 40MHz 5G channel
+                        */
+                       if (channel == 165) {
+                               i = 0;
+                       }
+
+                       /* check for legacy JP channels on failure */
+                       if (channel == 34 || channel == 38 ||
+                           channel == 42 || channel == 46) {
+                               i = 0;
+                       }
+               }
+
+               if (i < num_ch) {
+                       /* match found */
+                       return TRUE;
+               }
+       }
+
+       else if (band == WL_CHANSPEC_BAND_6G) {
+               /* Use the simple pattern of 6GHz 20MHz channels */
+               if ((channel >= CH_MIN_6G_CHANNEL &&
+                    channel <= CH_MAX_6G_CHANNEL) &&
+                   ((channel - CH_MIN_6G_CHANNEL) % 4) == 0) {  // even multiple of 4
+                       return TRUE;
+               }
+       }
+
+       return FALSE;
+}
+
+/**
+ * Verify that the center channel is a valid 40MHz center channel according to 802.11.
+ *
+ * @param  center_channel   40MHz center channel to validate
+ * @param  band             chanspec band
+ *
+ * @return Return TRUE if valid
+ */
+bool
+wf_valid_40MHz_center_chan(uint center_channel, chanspec_band_t band)
+{
+       if (band == WL_CHANSPEC_BAND_2G) {
+               /* simple range check for 2GHz */
+               return (center_channel >= CH_MIN_2G_40M_CHANNEL &&
+                       center_channel <= CH_MAX_2G_40M_CHANNEL);
+       } else if (band == WL_CHANSPEC_BAND_5G) {
+               uint i;
+
+               /* use the 5GHz lookup of 40MHz channels */
+               for (i = 0; i < WF_NUM_5G_40M_CHANS; i++) {
+                       if (center_channel == wf_5g_40m_chans[i]) {
+                               return TRUE;
+                       }
+               }
+       }
+       else if (band == WL_CHANSPEC_BAND_6G) {
+               /* Use the simple pattern of 6GHz center channels */
+               if ((center_channel >= CH_MIN_6G_40M_CHANNEL &&
+                    center_channel <= CH_MAX_6G_40M_CHANNEL) &&
+                   ((center_channel - CH_MIN_6G_40M_CHANNEL) % 8) == 0) {  // even multiple of 8
+                       return TRUE;
+               }
+       }
+
+       return FALSE;
+}
+
+/**
+ * Verify that the center channel is a valid 80MHz center channel according to 802.11.
+ *
+ * @param  center_channel   80MHz center channel to validate
+ * @param  band             chanspec band
+ *
+ * @return Return TRUE if valid
+ */
+bool
+wf_valid_80MHz_center_chan(uint center_channel, chanspec_band_t band)
+{
+       if (band == WL_CHANSPEC_BAND_5G) {
+               /* use the 80MHz ID lookup to validate the center channel */
+               if (channel_80mhz_to_id(center_channel) >= 0) {
+                       return TRUE;
+               }
+       } else if (band == WL_CHANSPEC_BAND_6G) {
+               /* use the 80MHz ID lookup to validate the center channel */
+               if (channel_6g_80mhz_to_id(center_channel) >= 0) {
+                       return TRUE;
+               }
+       }
+
+       return FALSE;
+}
+
+/**
+ * Verify that the center channel is a valid 160MHz center channel according to 802.11.
+ *
+ * @param  center_channel   160MHz center channel to validate
+ * @param  band             chanspec band
+ *
+ * @return Return TRUE if valid
+ */
+bool
+wf_valid_160MHz_center_chan(uint center_channel, chanspec_band_t band)
+{
+       if (band == WL_CHANSPEC_BAND_5G) {
+               uint i;
+
+               /* use the 5GHz lookup of 40MHz channels */
+               for (i = 0; i < WF_NUM_5G_160M_CHANS; i++) {
+                       if (center_channel == wf_5g_160m_chans[i]) {
+                               return TRUE;
+                       }
+               }
+       } else if (band == WL_CHANSPEC_BAND_6G) {
+               /* Use the simple pattern of 6GHz center channels */
+               if ((center_channel >= CH_MIN_6G_160M_CHANNEL &&
+                    center_channel <= CH_MAX_6G_160M_CHANNEL) &&
+                   ((center_channel - CH_MIN_6G_160M_CHANNEL) % 32) == 0) { // even multiple of 32
+                       return TRUE;
+               }
+       }
+
+       return FALSE;
+}
+
+/**
+ * Verify that the center channel is a valid 320MHz center channel according to 802.11.
+ *
+ * @param  center_channel   320MHz center channel to validate
+ * @param  band             chanspec band
+ *
+ * @return Return TRUE if valid
+ */
+bool
+wf_valid_320MHz_center_chan(uint center_channel, chanspec_band_t band)
+{
+       if (band == WL_CHANSPEC_BAND_6G) {
+               /* Use the simple pattern of 6GHz center channels */
+               if ((center_channel >= CH_MIN_6G_320M_CHANNEL &&
+                    center_channel <= CH_MAX_6G_320M_CHANNEL) &&
+                   ((center_channel - CH_MIN_6G_320M_CHANNEL) % 64) == 0) { // even multiple of 64
+                       return TRUE;
+               }
+       }
+
+       return FALSE;
+}
+
+/*
+ * This function returns TRUE if both the chanspec can co-exist in PHY.
+ * Addition to primary20 channel, the function checks for side band for 2g 40 channels
+ */
+bool
+wf_chspec_coexist(chanspec_t chspec1, chanspec_t chspec2)
+{
+       bool same_primary;
+
+       same_primary = (wf_chspec_primary20_chan(chspec1) == wf_chspec_primary20_chan(chspec2));
+
+       if (same_primary && CHSPEC_IS2G(chspec1)) {
+           if (CHSPEC_IS40(chspec1) && CHSPEC_IS40(chspec2)) {
+               return (CHSPEC_CTL_SB(chspec1) == CHSPEC_CTL_SB(chspec2));
+           }
+       }
+       return same_primary;
+}
+
+/**
+ * Create a 20MHz chanspec for the given band.
+ *
+ * This function returns a 20MHz chanspec in the given band.
+ *
+ * @param      channel   20MHz channel number
+ * @param      band      a chanspec band (e.g. WL_CHANSPEC_BAND_2G)
+ *
+ * @return Returns a 20MHz chanspec, or IVNCHANSPEC in case of error.
+ */
+chanspec_t
+wf_create_20MHz_chspec(uint channel, chanspec_band_t band)
+{
+       chanspec_t chspec;
+
+       if (channel <= WL_CHANSPEC_CHAN_MASK &&
+           (band == WL_CHANSPEC_BAND_2G ||
+            band == WL_CHANSPEC_BAND_5G ||
+            band == WL_CHANSPEC_BAND_6G)) {
+               chspec = band | WL_CHANSPEC_BW_20 | WL_CHANSPEC_CTL_SB_NONE | channel;
+               if (!wf_chspec_valid(chspec)) {
+                       chspec = INVCHANSPEC;
+               }
+       } else {
+               chspec = INVCHANSPEC;
+       }
+
+       return chspec;
+}
+
+/**
+ * Returns the chanspec for a 40MHz channel given the primary 20MHz channel number,
+ * the center channel number, and the band.
+ *
+ * @param  primary_channel  primary 20Mhz channel
+ * @param  center_channel   center channel of the 40MHz channel
+ * @param  band             band of the 40MHz channel (chanspec_band_t value)
+ *
+ * The center_channel can be one of the 802.11 spec valid 40MHz chenter channels
+ * in the given band.
+ *
+ * @return returns a 40MHz chanspec, or INVCHANSPEC in case of error
+ */
+chanspec_t
+wf_create_40MHz_chspec(uint primary_channel, uint center_channel,
+                       chanspec_band_t band)
+{
+       int sb;
+
+       /* Calculate the sideband value for the center and primary channel.
+        * Will return -1 if not a valid pair for 40MHz
+        */
+       sb = channel_to_sb(center_channel, primary_channel, WL_CHANSPEC_BW_40);
+
+       /* return err if the sideband was bad or the center channel is not
+        * valid for the given band.
+        */
+       if (sb < 0 || !wf_valid_40MHz_center_chan(center_channel, band)) {
+               return INVCHANSPEC;
+       }
+
+       /* othewise construct and return the valid 40MHz chanspec */
+       return (chanspec_t)(center_channel | WL_CHANSPEC_BW_40 | band |
+                           ((uint)sb << WL_CHANSPEC_CTL_SB_SHIFT));
+}
+
+/**
+ * Returns the chanspec for a 40MHz channel given the primary 20MHz channel number,
+ * the sub-band for the primary 20MHz channel, and the band.
+ *
+ * @param  primary_channel  primary 20Mhz channel
+ * @param  primary_subband  sub-band of the 20MHz primary channel (chanspec_subband_t value)
+ * @param  band             band of the 40MHz channel (chanspec_band_t value)
+ *
+ * The primary channel and sub-band should describe one of the 802.11 spec valid
+ * 40MHz channels in the given band.
+ *
+ * @return returns a 40MHz chanspec, or INVCHANSPEC in case of error
+ */
+chanspec_t
+wf_create_40MHz_chspec_primary_sb(uint primary_channel, chanspec_subband_t primary_subband,
+                                  chanspec_band_t band)
+{
+       uint center_channel;
+
+       /* find the center channel */
+       if (primary_subband == WL_CHANSPEC_CTL_SB_L) {
+               center_channel = primary_channel + CH_10MHZ_APART;
+       } else if (primary_subband == WL_CHANSPEC_CTL_SB_U) {
+               center_channel = primary_channel - CH_10MHZ_APART;
+       } else {
+               return INVCHANSPEC;
+       }
+
+       return wf_create_40MHz_chspec(primary_channel, center_channel, band);
+}
+
+/**
+ * Returns the chanspec for an 80MHz channel given the primary 20MHz channel number,
+ * the center channel number, and the band.
+ *
+ * @param  primary_channel  primary 20Mhz channel
+ * @param  center_channel   center channel of the 80MHz channel
+ * @param  band             band of the 80MHz channel (chanspec_band_t value)
+ *
+ * The center_channel can be one of {42, 58, 106, 122, 138, 155} for 5G,
+ * or {7 + 16*X for 0 <= X <= 13} for 6G.
+ *
+ * @return returns an 80MHz chanspec, or INVCHANSPEC in case of error
+ */
+chanspec_t
+wf_create_80MHz_chspec(uint primary_channel, uint center_channel,
+                       chanspec_band_t band)
+{
+       int sb;
+
+       /* Calculate the sideband value for the center and primary channel.
+        * Will return -1 if not a valid pair for 80MHz
+        */
+       sb = channel_to_sb(center_channel, primary_channel, WL_CHANSPEC_BW_80);
+
+       /* return err if the sideband was bad or the center channel is not
+        * valid for the given band.
+        */
+       if (sb < 0 || !wf_valid_80MHz_center_chan(center_channel, band)) {
+               return INVCHANSPEC;
+       }
+
+       /* othewise construct and return the valid 80MHz chanspec */
+       return (chanspec_t)(center_channel | WL_CHANSPEC_BW_80 | band |
+                           ((uint)sb << WL_CHANSPEC_CTL_SB_SHIFT));
+}
+
+/**
+ * Returns the chanspec for an 160MHz channel given the primary 20MHz channel number,
+ * the center channel number, and the band.
+ *
+ * @param  primary_channel  primary 20Mhz channel
+ * @param  center_channel   center channel of the 160MHz channel
+ * @param  band             band of the 160MHz channel (chanspec_band_t value)
+ *
+ * The center_channel can be one of {50, 114} for 5G,
+ * or {15 + 32*X for 0 <= X <= 7} for 6G.
+ *
+ * @return returns an 160MHz chanspec, or INVCHANSPEC in case of error
+ */
+chanspec_t
+wf_create_160MHz_chspec(uint primary_channel, uint center_channel, chanspec_band_t band)
+{
+       int sb;
+
+       /* Calculate the sideband value for the center and primary channel.
+        * Will return -1 if not a valid pair for 160MHz
+        */
+       sb = channel_to_sb(center_channel, primary_channel, WL_CHANSPEC_BW_160);
+
+       /* return err if the sideband was bad or the center channel is not
+        * valid for the given band.
+        */
+       if (sb < 0 || !wf_valid_160MHz_center_chan(center_channel, band)) {
+               return INVCHANSPEC;
+       }
+
+       /* othewise construct and return the valid 160MHz chanspec */
+       return (chanspec_t)(center_channel | WL_CHANSPEC_BW_160 | band |
+                           ((uint)sb << WL_CHANSPEC_CTL_SB_SHIFT));
+}
+
+/**
+ * Returns the chanspec for an 80+80MHz channel given the primary 20MHz channel number,
+ * the center channel numbers for each frequency segment, and the band.
+ *
+ * @param  primary_channel  primary 20 Mhz channel
+ * @param  chan0            center channel number of one frequency segment
+ * @param  chan1            center channel number of the other frequency segment
+ * @param  band             band of the 80+80 MHz channel (chanspec_band_t value)
+ *
+ * Parameters chan0 and chan1 are valid 80 MHz center channel numbers for the given band.
+ * The primary channel must be contained in one of the 80 MHz channels. This routine
+ * will determine which frequency segment is the primary 80 MHz segment.
+ *
+ * @return returns an 80+80 MHz chanspec, or INVCHANSPEC in case of error
+ *
+ * Refer to 802.11-2016 section 21.3.14 "Channelization".
+ */
+chanspec_t
+wf_create_8080MHz_chspec(uint primary_channel, uint chan0, uint chan1,
+                       chanspec_band_t band)
+{
+       int sb = 0;
+       chanspec_t chanspec = 0;
+       int chan0_id = -1, chan1_id = -1;
+       int seg0, seg1;
+
+       /* frequency segments need to be non-contiguous, so the channel separation needs
+        * to be greater than 80MHz
+        */
+       if ((uint)ABS((int)(chan0 - chan1)) <= CH_80MHZ_APART) {
+               return INVCHANSPEC;
+       }
+
+       if (band == WL_CHANSPEC_BAND_5G) {
+               chan0_id = channel_80mhz_to_id(chan0);
+               chan1_id = channel_80mhz_to_id(chan1);
+       } else if (band == WL_CHANSPEC_BAND_6G) {
+               chan0_id = channel_6g_80mhz_to_id(chan0);
+               chan1_id = channel_6g_80mhz_to_id(chan1);
+       }
+
+       /* make sure the channel numbers were valid */
+       if (chan0_id == -1 || chan1_id == -1) {
+               return INVCHANSPEC;
+       }
+
+       /* does the primary channel fit with the 1st 80MHz channel ? */
+       sb = channel_to_sb(chan0, primary_channel, WL_CHANSPEC_BW_80);
+       if (sb >= 0) {
+               /* yes, so chan0 is frequency segment 0, and chan1 is seg 1 */
+               seg0 = chan0_id;
+               seg1 = chan1_id;
+       } else {
+               /* no, so does the primary channel fit with the 2nd 80MHz channel ? */
+               sb = channel_to_sb(chan1, primary_channel, WL_CHANSPEC_BW_80);
+               if (sb < 0) {
+                       /* no match for pri_ch to either 80MHz center channel */
+                       return INVCHANSPEC;
+               }
+               /* swapped, so chan1 is frequency segment 0, and chan0 is seg 1 */
+               seg0 = chan1_id;
+               seg1 = chan0_id;
+       }
+
+       chanspec = ((seg0 << WL_CHANSPEC_CHAN0_SHIFT) |
+                   (seg1 << WL_CHANSPEC_CHAN1_SHIFT) |
+                   (sb << WL_CHANSPEC_CTL_SB_SHIFT) |
+                   WL_CHANSPEC_BW_8080 |
+                   band);
+
+       return chanspec;
+}
+
+/**
+ * Returns the chanspec for an 160+160MHz channel given the primary 20MHz channel number,
+ * the center channel numbers for each frequency segment, and the band.
+ *
+ * @param  primary_channel  primary 20 Mhz channel
+ * @param  chan0            center channel number of one frequency segment
+ * @param  chan1            center channel number of the other frequency segment
+ * @param  band             band of the 160+160 MHz channel (chanspec_band_t value)
+ *
+ * Parameters chan0 and chan1 are valid 160 MHz center channel numbers for the given band.
+ * The primary channel must be contained in one of the 160 MHz channels. This routine
+ * will determine which frequency segment is the primary 160 MHz segment.
+ *
+ * @return returns an 160+160 MHz chanspec, or INVCHANSPEC in case of error
+ *
+ * Refer to <TBD> "Channelization".
+ */
+chanspec_t
+wf_create_160160MHz_chspec(uint primary_channel, uint chan0, uint chan1,
+                           chanspec_band_t band)
+{
+       int sb = 0;
+       chanspec_t chanspec = 0;
+       int chan0_id = -1, chan1_id = -1;
+       int seg0, seg1;
+
+       /* frequency segments need to be non-contiguous, so the channel separation needs
+        * to be greater than 160MHz
+        */
+       if ((uint)ABS((int)(chan0 - chan1)) <= CH_160MHZ_APART) {
+               return INVCHANSPEC;
+       }
+
+       if (band == WL_CHANSPEC_BAND_5G) {
+               chan0_id = channel_5g_160mhz_to_id(chan0);
+               chan1_id = channel_5g_160mhz_to_id(chan1);
+       } else if (band == WL_CHANSPEC_BAND_6G) {
+               chan0_id = channel_6g_160mhz_to_id(chan0);
+               chan1_id = channel_6g_160mhz_to_id(chan1);
+       }
+
+       /* make sure the channel numbers were valid */
+       if (chan0_id == -1 || chan1_id == -1) {
+               return INVCHANSPEC;
+       }
+
+       /* does the primary channel fit with the 1st 160MHz channel ? */
+       sb = channel_to_sb(chan0, primary_channel, WL_CHANSPEC_BW_160);
+       if (sb >= 0) {
+               /* yes, so chan0 is frequency segment 0, and chan1 is seg 1 */
+               seg0 = chan0_id;
+               seg1 = chan1_id;
+       } else {
+               /* no, so does the primary channel fit with the 2nd 160MHz channel ? */
+               sb = channel_to_sb(chan1, primary_channel, WL_CHANSPEC_BW_160);
+               if (sb < 0) {
+                       /* no match for pri_ch to either 160MHz center channel */
+                       return INVCHANSPEC;
+               }
+               /* swapped, so chan1 is frequency segment 0, and chan0 is seg 1 */
+               seg0 = chan1_id;
+               seg1 = chan0_id;
+       }
+
+       chanspec = ((seg0 << WL_CHANSPEC_CHAN0_SHIFT) |
+                   (seg1 << WL_CHANSPEC_CHAN1_SHIFT) |
+                   (sb << WL_CHANSPEC_CTL_SB_SHIFT) |
+                   WL_CHANSPEC_BW_160160 |
+                   band);
+
+       return chanspec;
+}
+
+/**
+ * Returns the chanspec for an 320MHz channel given the primary 20MHz channel number,
+ * the center channel number, and the band.
+ *
+ * @param  primary_channel  primary 20 Mhz channel
+ * @param  chan             center channel number
+ * @param  band             band of the 320 MHz channel (chanspec_band_t value)
+ *
+ * Parameters chan is valid 320 MHz center channel numbers for the given band.
+ * The primary channel must be contained in one of the 320 MHz channels.
+ *
+ * @return returns an 320 MHz chanspec, or INVCHANSPEC in case of error
+ *
+ * Refer to <TBD> "Channelization".
+ */
+chanspec_t
+wf_create_320MHz_chspec(uint primary_channel, uint center_channel, chanspec_band_t band)
+{
+       int sb = 0;
+       chanspec_t chanspec = 0;
+       int chan_id = -1;
+
+       if (band == WL_CHANSPEC_BAND_6G) {
+               chan_id = channel_6g_320mhz_to_id(center_channel);
+       }
+
+       /* make sure the channel number were valid */
+       if (chan_id == -1) {
+               return INVCHANSPEC;
+       }
+
+       /* Calculate the sideband value for the center and primary channel.
+        * Will return -1 if not a valid pair for 320MHz
+        */
+       sb = channel_to_sb(center_channel, primary_channel, WL_CHANSPEC_BW_320);
+
+       /* return err if the sideband was bad or the center channel is not
+        * valid for the given band.
+        */
+       if (sb < 0 || !wf_valid_320MHz_center_chan(center_channel, band)) {
+               return INVCHANSPEC;
+       }
+
+       chanspec = ((chan_id << WL_CHANSPEC_320_CHAN_SHIFT) |
+                   (sb << WL_CHANSPEC_320_SB_SHIFT) |
+                   WL_CHANSPEC_BW_320 |
+                   band);
+
+       return chanspec;
+}
+
+/**
+ * Returns the chanspec given the primary 20MHz channel number,
+ * the center channel number, channel width, and the band. The channel width
+ * must be 20, 40, 80, 160, or 320 MHz.
+ * 80+80 or 160+160 MHz chanspec creation is not handled by this function,
+ * use wf_create_8080MHz_chspec() or wf_create_160160MHz_chspec()instead.
+ *
+ * @param  primary_channel  primary 20Mhz channel
+ * @param  center_channel   center channel of the channel
+ * @param  bw               width of the channel (chanspec_bw_t)
+ * @param  band             chanspec band of channel  (chanspec_band_t)
+ *
+ * The center_channel can be one of the 802.11 spec valid center channels
+ * for the given bandwidth in the given band.
+ *
+ * @return returns a chanspec, or INVCHANSPEC in case of error
+ */
+chanspec_t
+wf_create_chspec(uint primary_channel, uint center_channel,
+                 chanspec_bw_t bw, chanspec_band_t band)
+{
+       chanspec_t chspec = INVCHANSPEC;
+       int sb = -1;
+       uint sb_shift;
+
+       /* 20MHz channels have matching center and primary channels */
+       if (bw == WL_CHANSPEC_BW_20 && primary_channel == center_channel) {
+
+               sb = 0;
+
+       } else if (bw == WL_CHANSPEC_BW_40 ||
+                  bw == WL_CHANSPEC_BW_80 ||
+                  bw == WL_CHANSPEC_BW_160 ||
+                  WFC_BW_EQ(bw, WL_CHANSPEC_BW_320)) {
+
+               /* calculate the sub-band index */
+               sb = channel_to_sb(center_channel, primary_channel, bw);
+       }
+
+       /* if we have a good sub-band, assemble the chanspec, and use wf_chspec_valid()
+        * to check it for correctness
+        */
+       if (sb >= 0) {
+               if (WFC_BW_EQ(bw, WL_CHANSPEC_BW_320)) {
+                       if (band == WL_CHANSPEC_BAND_6G) {
+                               center_channel = channel_6g_320mhz_to_id(center_channel);
+                               sb_shift = WL_CHANSPEC_320_SB_SHIFT;
+                       } else {
+                               return INVCHANSPEC;
+                       }
+               } else {
+                       sb_shift = WL_CHANSPEC_CTL_SB_SHIFT;
+               }
+               chspec = center_channel | band | bw |
+                       ((uint)sb << sb_shift);
+               if (!wf_chspec_valid(chspec)) {
+                       chspec = INVCHANSPEC;
+               }
+       }
+
+       return chspec;
+}
+
+/**
+ * Returns the chanspec given the primary 20MHz channel number,
+ * channel width, and the band.
+ *
+ * @param  primary_channel  primary 20Mhz channel
+ * @param  bw               width of the channel (chanspec_bw_t)
+ * @param  band             chanspec band of channel  (chanspec_band_t)
+ *
+ * @return returns a chanspec, or INVCHANSPEC in case of error
+ *
+ * This function is a similar to wf_create_chspec() but does not require the
+ * center_channel parameter. As a result, it can not create 40MHz channels on
+ * the 2G band.
+ *
+ * This function supports creating 20MHz bandwidth chanspecs on any band.
+ *
+ * For the 2GHz band, 40MHz channels overlap, so two 40MHz channels may
+ * have the same primary 20MHz channel. This function will return INVCHANSPEC
+ * whenever called with a bandwidth of 40MHz or wider for the 2GHz band.
+ *
+ * 5GHz and 6GHz bands have non-overlapping 40/80/160 MHz channels, so a
+ * 20MHz primary channel uniquely specifies a wider channel in a given band.
+ *
+ * 80+80MHz channels also cannot be uniquely defined. This function will return
+ * INVCHANSPEC whenever bandwidth of WL_CHANSPEC_BW_8080.
+ */
+chanspec_t
+wf_create_chspec_from_primary(uint primary_channel, chanspec_bw_t bw, chanspec_band_t band)
+{
+       chanspec_t chspec = INVCHANSPEC;
+
+       if (bw == WL_CHANSPEC_BW_20) {
+               chspec = wf_create_20MHz_chspec(primary_channel, band);
+       } else if (band == WL_CHANSPEC_BAND_2G) {
+               /* 2G 40MHz cannot be uniquely identified by the primary channel.
+                * Return INVAL for any channel given. Or if bw != 20
+                */
+       } else if (band == WL_CHANSPEC_BAND_5G) {
+               /* For 5GHz, use the lookup tables for valid 40/80/160 center channels
+                * and search for a center channel compatible with the given primary channel.
+                */
+               const uint8 *center_ch = NULL;
+               uint num_ch, i;
+
+               if (bw == WL_CHANSPEC_BW_40) {
+                       center_ch = wf_5g_40m_chans;
+                       num_ch = WF_NUM_5G_40M_CHANS;
+               } else if (bw == WL_CHANSPEC_BW_80) {
+                       center_ch = wf_5g_80m_chans;
+                       num_ch = WF_NUM_5G_80M_CHANS;
+               } else if (bw == WL_CHANSPEC_BW_160) {
+                       center_ch = wf_5g_160m_chans;
+                       num_ch = WF_NUM_5G_160M_CHANS;
+               } else {
+                       num_ch = 0;
+               }
+
+               for (i = 0; i < num_ch; i ++) {
+                       chspec = wf_create_chspec(primary_channel, center_ch[i], bw, band);
+                       if (chspec != INVCHANSPEC) {
+                               break;
+                       }
+               }
+       }
+       else if (band == WL_CHANSPEC_BAND_6G) {
+               /* For 6GHz, use a formula to calculate the valid 40/80/160 center channel from
+                * the primary channel.
+                */
+               uint ch_per_block;
+               uint mask;
+               uint base, center;
+
+               if (bw == WL_CHANSPEC_BW_40) {
+                       ch_per_block = 8;
+               } else if (bw == WL_CHANSPEC_BW_80) {
+                       ch_per_block = 16;
+               } else if (bw == WL_CHANSPEC_BW_160) {
+                       ch_per_block = 32;
+               } else if (WFC_BW_EQ(bw, WL_CHANSPEC_BW_320)) {
+                       ch_per_block = 64;
+               } else {
+                       ch_per_block = 0;
+               }
+
+               if (ch_per_block) {
+                       /* calculate the base of the block of channel numbers
+                        * covered by the given bw
+                        */
+                       mask = ~(ch_per_block - 1);
+                       base = 1 + ((primary_channel - 1) & mask);
+
+                       /* calculate the center channel from the base channel */
+                       center = base + center_chan_to_edge(bw);
+
+                       chspec = wf_create_chspec(primary_channel, center, bw, band);
+               }
+       }
+
+       return chspec;
+}
+
+/**
+ * Return the primary 20MHz channel.
+ *
+ * This function returns the channel number of the primary 20MHz channel. For
+ * 20MHz channels this is just the channel number. For 40MHz or wider channels
+ * it is the primary 20MHz channel specified by the chanspec.
+ *
+ * @param      chspec    input chanspec
+ *
+ * @return Returns the channel number of the primary 20MHz channel
+ */
+uint8
+wf_chspec_primary20_chan(chanspec_t chspec)
+{
+       uint center_chan = INVCHANNEL;
+       chanspec_bw_t bw;
+       uint sb;
+
+       ASSERT(!wf_chspec_malformed(chspec));
+
+       /* Is there a sideband ? */
+       if (CHSPEC_IS20(chspec)) {
+               return CHSPEC_CHANNEL(chspec);
+       } else {
+               if (CHSPEC_IS320(chspec)) {
+                       sb = CHSPEC_320_SB(chspec) >> WL_CHANSPEC_320_SB_SHIFT;
+               } else {
+                       sb = CHSPEC_CTL_SB(chspec) >> WL_CHANSPEC_CTL_SB_SHIFT;
+               }
+
+               if (CHSPEC_IS8080(chspec)) {
+                       /* For an 80+80 MHz channel, the sideband 'sb' field is an 80 MHz sideband
+                        * (LL, LU, UL, LU) for the 80 MHz frequency segment 0.
+                        */
+
+                       /* use bw 80MHz for the primary channel lookup */
+                       bw = WL_CHANSPEC_BW_80;
+
+                       /* convert from channel index to channel number */
+                       if (CHSPEC_IS5G(chspec)) {
+                               center_chan = wf_chspec_5G_id80_to_ch(CHSPEC_CHAN0(chspec));
+                       } else if (CHSPEC_IS6G(chspec)) {
+                               center_chan = wf_chspec_6G_id80_to_ch(CHSPEC_CHAN0(chspec));
+                       }
+               } else if (CHSPEC_IS160160(chspec)) {
+                       /* For an 160+160 MHz channel, the sideband 'sb' field is an 160MHz sideband
+                        * for the 160 MHz frequency segment 0.
+                        */
+
+                       /* use bw 160MHz for the primary channel lookup */
+                       bw = WL_CHANSPEC_BW_160;
+
+                       /* convert from channel index to channel number */
+                       if (CHSPEC_IS5G(chspec)) {
+                               center_chan = wf_chspec_5G_id160_to_ch(CHSPEC_CHAN0(chspec));
+                       } else if (CHSPEC_IS6G(chspec)) {
+                               center_chan = wf_chspec_6G_id160_to_ch(CHSPEC_CHAN0(chspec));
+                       }
+               } else if (CHSPEC_IS320(chspec)) {
+                       /* use bw 320MHz for the primary channel lookup */
+                       bw = WL_CHANSPEC_BW_320;
+
+                       /* convert from channel index to channel number */
+                       if (CHSPEC_IS6G(chspec)) {
+                               center_chan = wf_chspec_6G_id320_to_ch(CHSPEC_320_CHAN(chspec));
+                       }
+                       /* What to return otherwise? */
+               }
+               else {
+                       bw = CHSPEC_BW(chspec);
+                       center_chan = CHSPEC_CHANNEL(chspec) >> WL_CHANSPEC_CHAN_SHIFT;
+               }
+
+               return (uint8)(channel_to_primary20_chan((uint8)center_chan, bw, sb));
+       }
+}
+
+/**
+ * Return the bandwidth string for a given chanspec
+ *
+ * This function returns the bandwidth string for the passed chanspec.
+ *
+ * @param      chspec    input chanspec
+ *
+ * @return Returns the bandwidth string:
+ *         "5", "10", "20", "40", "80", "160", "80+80"
+ */
+const char *
+BCMRAMFN(wf_chspec_to_bw_str)(chanspec_t chspec)
+{
+       return wf_chspec_bw_str[(CHSPEC_BW(chspec) >> WL_CHANSPEC_BW_SHIFT)];
+}
+
+/**
+ * Return the primary 20MHz chanspec of a given chanspec
+ *
+ * This function returns the chanspec of the primary 20MHz channel. For 20MHz
+ * channels this is just the chanspec. For 40MHz or wider channels it is the
+ * chanspec of the primary 20MHz channel specified by the chanspec.
+ *
+ * @param      chspec    input chanspec
+ *
+ * @return Returns the chanspec of the primary 20MHz channel
+ */
+chanspec_t
+wf_chspec_primary20_chspec(chanspec_t chspec)
+{
+       chanspec_t pri_chspec = chspec;
+       uint8 pri_chan;
+
+       ASSERT(!wf_chspec_malformed(chspec));
+
+       /* Is there a sideband ? */
+       if (!CHSPEC_IS20(chspec)) {
+               pri_chan = wf_chspec_primary20_chan(chspec);
+               pri_chspec = pri_chan | WL_CHANSPEC_BW_20;
+               pri_chspec |= CHSPEC_BAND(chspec);
+       }
+       return pri_chspec;
+}
+
+/* return chanspec given primary 20MHz channel and bandwidth
+ * return 0 on error
+ * does not support 6G
+ */
+uint16
+wf_channel2chspec(uint pri_ch, uint bw)
+{
+       uint16 chspec;
+       const uint8 *center_ch = NULL;
+       int num_ch = 0;
+       int sb = -1;
+       int i = 0;
+
+       chspec = ((pri_ch <= CH_MAX_2G_CHANNEL) ? WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G);
+
+       chspec |= bw;
+
+       if (bw == WL_CHANSPEC_BW_40) {
+               center_ch = wf_5g_40m_chans;
+               num_ch = WF_NUM_5G_40M_CHANS;
+       } else if (bw == WL_CHANSPEC_BW_80) {
+               center_ch = wf_5g_80m_chans;
+               num_ch = WF_NUM_5G_80M_CHANS;
+       } else if (bw == WL_CHANSPEC_BW_160) {
+               center_ch = wf_5g_160m_chans;
+               num_ch = WF_NUM_5G_160M_CHANS;
+       } else if (bw == WL_CHANSPEC_BW_20) {
+               chspec |= pri_ch;
+               return chspec;
+       } else {
+               return 0;
+       }
+
+       for (i = 0; i < num_ch; i ++) {
+               sb = channel_to_sb(center_ch[i], pri_ch, (chanspec_bw_t)bw);
+               if (sb >= 0) {
+                       chspec |= center_ch[i];
+                       chspec |= (sb << WL_CHANSPEC_CTL_SB_SHIFT);
+                       break;
+               }
+       }
+
+       /* check for no matching sb/center */
+       if (sb < 0) {
+               return 0;
+       }
+
+       return chspec;
+}
+
+/**
+ * Return the primary 40MHz chanspec or a 40MHz or wider channel
+ *
+ * This function returns the chanspec for the primary 40MHz of an 80MHz or wider channel.
+ * The primary 40MHz channel is the 40MHz sub-band that contains the primary 20MHz channel.
+ * The primary 20MHz channel of the returned 40MHz chanspec is the same as the primary 20MHz
+ * channel of the input chanspec.
+ *
+ * @param      chspec    input chanspec
+ *
+ * @return Returns the chanspec of the primary 20MHz channel
+ */
+chanspec_t
+wf_chspec_primary40_chspec(chanspec_t chspec)
+{
+       chanspec_t chspec40 = chspec;
+       uint center_chan;
+       uint sb;
+
+       ASSERT(!wf_chspec_malformed(chspec));
+
+       /* if the chanspec is > 80MHz, use the helper routine to find the primary 80 MHz channel */
+       if (CHSPEC_IS8080(chspec) || CHSPEC_IS160(chspec)) {
+               chspec = wf_chspec_primary80_chspec(chspec);
+       }
+
+       /* determine primary 40 MHz sub-channel of an 80 MHz chanspec */
+       if (CHSPEC_IS80(chspec)) {
+               center_chan = CHSPEC_CHANNEL(chspec);
+               sb = CHSPEC_CTL_SB(chspec);
+
+               if (sb < WL_CHANSPEC_CTL_SB_UL) {
+                       /* Primary 40MHz is on lower side */
+                       center_chan -= CH_20MHZ_APART;
+                       /* sideband bits are the same for LL/LU and L/U */
+               } else {
+                       /* Primary 40MHz is on upper side */
+                       center_chan += CH_20MHZ_APART;
+                       /* sideband bits need to be adjusted by UL offset */
+                       sb -= WL_CHANSPEC_CTL_SB_UL;
+               }
+
+               /* Create primary 40MHz chanspec */
+               chspec40 = (CHSPEC_BAND(chspec) | WL_CHANSPEC_BW_40 |
+                           sb | center_chan);
+       }
+
+       return chspec40;
+}
+
+/**
+ * Return the channel number for a given frequency and base frequency.
+ *
+ * @param   freq            frequency in MHz of the channel center
+ * @param   start_factor    starting base frequency in 500 KHz units
+ *
+ * @return  Returns a channel number > 0, or -1 on error
+ *
+ * The returned channel number is relative to the given base frequency.
+ *
+ * The base frequency is specified as (start_factor * 500 kHz).
+ * Constants WF_CHAN_FACTOR_2_4_G, WF_CHAN_FACTOR_5_G, and WF_CHAN_FACTOR_6_G are
+ * defined for 2.4 GHz, 5 GHz, and 6 GHz bands.
+ *
+ * If the given base frequency is zero these base frequencies are assumed:
+ *
+ *              freq (GHz)  -> assumed base freq (GHz)
+ *  2G band   2.4   - 2.5      2.407
+ *  5G band   5.0   - 5.940    5.000
+ *  6G band   5.940 - 7.205    5.940
+ *
+ * It is an error if the start_factor is zero and the freq is not in one of
+ * these ranges.
+ *
+ * The returned channel will be in the range [1, 14] in the 2.4 GHz band,
+ * [1, 253] for 6 GHz band, or [1, 200] otherwise.
+ *
+ * It is an error if the start_factor is WF_CHAN_FACTOR_2_4_G and the
+ * frequency is not a 2.4 GHz channel. For any other start factor the frequency
+ * must be an even 5 MHz multiple greater than the base frequency.
+ *
+ * For a start_factor WF_CHAN_FACTOR_6_G, the frequency may be up to 7.205 MHz
+ * (channel 253). For any other start_factor, the frequence can be up to
+ * 1 GHz from the base freqency (channel 200).
+ *
+ * Reference 802.11-2016, section 17.3.8.3 and section 16.3.6.3
+ */
+int
+wf_mhz2channel(uint freq, uint start_factor)
+{
+       int ch = -1;
+       uint base;
+       int offset;
+
+       /* take the default channel start frequency */
+       if (start_factor == 0) {
+               if (freq >= 2400 && freq <= 2500) {
+                       start_factor = WF_CHAN_FACTOR_2_4_G;
+               } else if (freq >= 5000 && freq < 5940) {
+                       start_factor = WF_CHAN_FACTOR_5_G;
+               } else if (freq >= 5940 && freq <= 7205) {
+                       start_factor = WF_CHAN_FACTOR_6_G;
+               }
+       }
+
+       if (freq == 2484 && start_factor == WF_CHAN_FACTOR_2_4_G)
+               return 14;
+
+       base = start_factor / 2;
+
+       if (freq < base) {
+               return -1;
+       }
+
+       offset = freq - base;
+       ch = offset / 5;
+
+       /* check that frequency is a 5MHz multiple from the base */
+       if (offset != (ch * 5))
+               return -1;
+
+       /* channel range checks */
+       if (start_factor == WF_CHAN_FACTOR_2_4_G) {
+               /* 2G should only be up to 13 here as 14 is
+                * handled above as it is a non-5MHz offset
+                */
+               if (ch > 13) {
+                       ch = -1;
+               }
+       }
+       else if (start_factor == WF_CHAN_FACTOR_6_G) {
+               /* 6G has a higher channel range than 5G channelization specifies [1,200] */
+               if ((uint)ch > CH_MAX_6G_CHANNEL) {
+                       ch = -1;
+               }
+       } else if (ch > 200) {
+                       ch = -1;
+       }
+
+       return ch;
+}
+
+/**
+ * Return the center frequency in MHz of the given channel and base frequency.
+ *
+ * The channel number is interpreted relative to the given base frequency.
+ *
+ * The valid channel range is [1, 14] in the 2.4 GHz band, [1,253] in the 6 GHz
+ * band, and [1, 200] otherwise.
+ * The base frequency is specified as (start_factor * 500 kHz).
+ * Constants WF_CHAN_FACTOR_2_4_G, WF_CHAN_FACTOR_5_G, and WF_CHAN_FACTOR_6_G are
+ * defined for 2.4 GHz, 5 GHz, and 6 GHz bands.
+ * The channel range of [1, 14] is only checked for a start_factor of
+ * WF_CHAN_FACTOR_2_4_G (4814).
+ * Odd start_factors produce channels on .5 MHz boundaries, in which case
+ * the answer is rounded down to an integral MHz.
+ * -1 is returned for an out of range channel.
+ *
+ * Reference 802.11-2016, section 17.3.8.3 and section 16.3.6.3
+ *
+ * @param      channel       input channel number
+ * @param      start_factor  base frequency in 500 kHz units, e.g. 10000 for 5 GHz
+ *
+ * @return Returns a frequency in MHz
+ *
+ * @see  WF_CHAN_FACTOR_2_4_G
+ * @see  WF_CHAN_FACTOR_5_G
+ * @see  WF_CHAN_FACTOR_6_G
+ */
+int
+wf_channel2mhz(uint ch, uint start_factor)
+{
+       int freq;
+
+       if ((start_factor == WF_CHAN_FACTOR_2_4_G && (ch < 1 || ch > 14)) ||
+           (start_factor == WF_CHAN_FACTOR_6_G && (ch < 1 || ch > 253)) ||
+           (start_factor != WF_CHAN_FACTOR_6_G && (ch < 1 || ch > 200))) {
+               freq = -1;
+       } else if ((start_factor == WF_CHAN_FACTOR_2_4_G) && (ch == 14)) {
+               freq = 2484;
+       } else {
+               freq = ch * 5 + start_factor / 2;
+       }
+
+       return freq;
+}
+
+static const uint16 sidebands[] = {
+       WL_CHANSPEC_CTL_SB_LLL, WL_CHANSPEC_CTL_SB_LLU,
+       WL_CHANSPEC_CTL_SB_LUL, WL_CHANSPEC_CTL_SB_LUU,
+       WL_CHANSPEC_CTL_SB_ULL, WL_CHANSPEC_CTL_SB_ULU,
+       WL_CHANSPEC_CTL_SB_UUL, WL_CHANSPEC_CTL_SB_UUU
+};
+
+/*
+ * Returns the chanspec 80Mhz channel corresponding to the following input
+ * parameters
+ *
+ *     primary_channel - primary 20Mhz channel
+ *     center_channel   - center frequecny of the 80Mhz channel
+ *
+ * The center_channel can be one of {42, 58, 106, 122, 138, 155}
+ *
+ * returns INVCHANSPEC in case of error
+ *
+ * does not support 6G
+ */
+chanspec_t
+wf_chspec_80(uint8 center_channel, uint8 primary_channel)
+{
+
+       chanspec_t chanspec = INVCHANSPEC;
+       chanspec_t chanspec_cur;
+       uint i;
+
+       for (i = 0; i < WF_NUM_SIDEBANDS_80MHZ; i++) {
+               chanspec_cur = CH80MHZ_CHSPEC(center_channel, sidebands[i]);
+               if (primary_channel == wf_chspec_primary20_chan(chanspec_cur)) {
+                       chanspec = chanspec_cur;
+                       break;
+               }
+       }
+       /* If the loop ended early, we are good, otherwise we did not
+       * find a 80MHz chanspec with the given center_channel that had a primary channel
+       *matching the given primary_channel.
+       */
+       return chanspec;
+}
+
+/*
+ * Returns the 80+80 chanspec corresponding to the following input parameters
+ *
+ *    primary_20mhz - Primary 20 MHz channel
+ *    chan0 - center channel number of one frequency segment
+ *    chan1 - center channel number of the other frequency segment
+ *
+ * Parameters chan0 and chan1 are channel numbers in {42, 58, 106, 122, 138, 155}.
+ * The primary channel must be contained in one of the 80MHz channels. This routine
+ * will determine which frequency segment is the primary 80 MHz segment.
+ *
+ * Returns INVCHANSPEC in case of error.
+ *
+ * Refer to 802.11-2016 section 22.3.14 "Channelization".
+ *
+ * does not support 6G
+ */
+chanspec_t
+wf_chspec_get8080_chspec(uint8 primary_20mhz, uint8 chan0, uint8 chan1)
+{
+       int sb = 0;
+       uint16 chanspec = 0;
+       int chan0_id = 0, chan1_id = 0;
+       int seg0, seg1;
+
+       chan0_id = channel_80mhz_to_id(chan0);
+       chan1_id = channel_80mhz_to_id(chan1);
+
+       /* make sure the channel numbers were valid */
+       if (chan0_id == -1 || chan1_id == -1)
+               return INVCHANSPEC;
+
+       /* does the primary channel fit with the 1st 80MHz channel ? */
+       sb = channel_to_sb(chan0, primary_20mhz, WL_CHANSPEC_BW_80);
+       if (sb >= 0) {
+               /* yes, so chan0 is frequency segment 0, and chan1 is seg 1 */
+               seg0 = chan0_id;
+               seg1 = chan1_id;
+       } else {
+               /* no, so does the primary channel fit with the 2nd 80MHz channel ? */
+               sb = channel_to_sb(chan1, primary_20mhz, WL_CHANSPEC_BW_80);
+               if (sb < 0) {
+                       /* no match for pri_ch to either 80MHz center channel */
+                       return INVCHANSPEC;
+               }
+               /* swapped, so chan1 is frequency segment 0, and chan0 is seg 1 */
+               seg0 = chan1_id;
+               seg1 = chan0_id;
+       }
+
+       chanspec = ((seg0 << WL_CHANSPEC_CHAN0_SHIFT) |
+                   (seg1 << WL_CHANSPEC_CHAN1_SHIFT) |
+                   (sb << WL_CHANSPEC_CTL_SB_SHIFT) |
+                   WL_CHANSPEC_BW_8080 |
+                   WL_CHANSPEC_BAND_5G);
+
+       return chanspec;
+}
+
+/*
+ * Returns the center channel of the primary 80 MHz sub-band of the provided chanspec
+ */
+uint8
+wf_chspec_primary80_channel(chanspec_t chanspec)
+{
+       chanspec_t primary80_chspec;
+       uint8 primary80_chan;
+
+       primary80_chspec = wf_chspec_primary80_chspec(chanspec);
+
+       if (primary80_chspec == INVCHANSPEC) {
+               primary80_chan = INVCHANNEL;
+       } else {
+               primary80_chan = CHSPEC_CHANNEL(primary80_chspec);
+       }
+
+       return primary80_chan;
+}
+
+/*
+ * Returns the center channel of the secondary 80 MHz sub-band of the provided chanspec
+ */
+uint8
+wf_chspec_secondary80_channel(chanspec_t chanspec)
+{
+       chanspec_t secondary80_chspec;
+       uint8 secondary80_chan;
+
+       secondary80_chspec = wf_chspec_secondary80_chspec(chanspec);
+
+       if (secondary80_chspec == INVCHANSPEC) {
+               secondary80_chan = INVCHANNEL;
+       } else {
+               secondary80_chan = CHSPEC_CHANNEL(secondary80_chspec);
+       }
+
+       return secondary80_chan;
+}
+
+/*
+ * Returns the chanspec for the primary 80MHz sub-band of an 160MHz or 80+80 channel
+ */
+chanspec_t
+wf_chspec_primary80_chspec(chanspec_t chspec)
+{
+       chanspec_t chspec80;
+       uint center_chan;
+       uint sb;
+
+       ASSERT(!wf_chspec_malformed(chspec));
+
+       if (CHSPEC_IS80(chspec)) {
+               chspec80 = chspec;
+       }
+       else if (CHSPEC_IS8080(chspec)) {
+               sb = CHSPEC_CTL_SB(chspec);
+
+               /* primary sub-band is stored in seg0 */
+               if (CHSPEC_IS5G(chspec)) {
+                       center_chan = wf_chspec_5G_id80_to_ch(CHSPEC_CHAN0(chspec));
+               } else if (CHSPEC_IS6G(chspec)) {
+                       center_chan = wf_chspec_6G_id80_to_ch(CHSPEC_CHAN0(chspec));
+               } else {
+                       center_chan = INVCHANNEL;
+               }
+
+               /* Create primary 80MHz chanspec */
+               chspec80 = (CHSPEC_BAND(chspec) | WL_CHANSPEC_BW_80 | sb | center_chan);
+       }
+       else if (CHSPEC_IS160(chspec)) {
+               center_chan = CHSPEC_CHANNEL(chspec);
+               sb = CHSPEC_CTL_SB(chspec);
+
+               if (sb < WL_CHANSPEC_CTL_SB_ULL) {
+                       /* Primary 80MHz is on lower side */
+                       center_chan -= CH_40MHZ_APART;
+               }
+               else {
+                       /* Primary 80MHz is on upper side */
+                       center_chan += CH_40MHZ_APART;
+                       sb -= WL_CHANSPEC_CTL_SB_ULL;
+               }
+
+               /* Create primary 80MHz chanspec */
+               chspec80 = (CHSPEC_BAND(chspec) | WL_CHANSPEC_BW_80 | sb | center_chan);
+       }
+       else {
+               chspec80 = INVCHANSPEC;
+       }
+
+       return chspec80;
+}
+
+/*
+ * Returns the chanspec for the secondary 80MHz sub-band of an 160MHz or 80+80 channel
+ */
+chanspec_t
+wf_chspec_secondary80_chspec(chanspec_t chspec)
+{
+       chanspec_t chspec80;
+       uint center_chan;
+
+       ASSERT(!wf_chspec_malformed(chspec));
+
+       if (CHSPEC_IS8080(chspec)) {
+               /* secondary sub-band is stored in seg1 */
+               if (CHSPEC_IS5G(chspec)) {
+                       center_chan = wf_chspec_5G_id80_to_ch(CHSPEC_CHAN1(chspec));
+               } else if (CHSPEC_IS6G(chspec)) {
+                       center_chan = wf_chspec_6G_id80_to_ch(CHSPEC_CHAN1(chspec));
+               } else {
+                       center_chan = INVCHANNEL;
+               }
+
+               /* Create secondary 80MHz chanspec */
+               chspec80 = (CHSPEC_BAND(chspec) |
+                           WL_CHANSPEC_BW_80 |
+                           WL_CHANSPEC_CTL_SB_LL |
+                           center_chan);
+       }
+       else if (CHSPEC_IS160(chspec)) {
+               center_chan = CHSPEC_CHANNEL(chspec);
+
+               if (CHSPEC_CTL_SB(chspec) < WL_CHANSPEC_CTL_SB_ULL) {
+                       /* Primary 80MHz is on lower side, so the secondary is on
+                        * the upper side
+                        */
+                       center_chan += CH_40MHZ_APART;
+               } else {
+                       /* Primary 80MHz is on upper side, so the secondary is on
+                        * the lower side
+                        */
+                       center_chan -= CH_40MHZ_APART;
+               }
+
+               /* Create secondary 80MHz chanspec */
+               chspec80 = (CHSPEC_BAND(chspec) |
+                           WL_CHANSPEC_BW_80 |
+                           WL_CHANSPEC_CTL_SB_LL |
+                           center_chan);
+       }
+       else {
+               chspec80 = INVCHANSPEC;
+       }
+
+       return chspec80;
+}
+
+/*
+ * For 160MHz or 80P80 chanspec, set ch[0]/ch[1] to be the low/high 80 Mhz channels
+ *
+ * For 20/40/80MHz chanspec, set ch[0] to be the center freq, and chan[1]=-1
+ */
+void
+wf_chspec_get_80p80_channels(chanspec_t chspec, uint8 *ch)
+{
+
+       if (CHSPEC_IS160(chspec)) {
+               uint8 center_chan = CHSPEC_CHANNEL(chspec);
+               ch[0] = center_chan - CH_40MHZ_APART;
+               ch[1] = center_chan + CH_40MHZ_APART;
+       }
+       else {
+               /* for 20, 40, and 80 Mhz */
+               ch[0] = CHSPEC_CHANNEL(chspec);
+               ch[1] = -1;
+       }
+       return;
+
+}
+
+/* Populates array with all 20MHz side bands of a given chanspec_t in the following order:
+ *             primary20, secondary20, two secondary40s, four secondary80s.
+ *    'chspec' is the chanspec of interest
+ *    'pext' must point to an uint8 array of long enough to hold all side bands of the given chspec
+ *
+ * Works with 20, 40, 80, and 160MHz chspec
+ */
+void
+wf_get_all_ext(chanspec_t chspec, uint8 *pext)
+{
+#ifdef WL11N_20MHZONLY
+       GET_ALL_SB(chspec, pext);
+#else /* !WL11N_20MHZONLY */
+       chanspec_t t = (CHSPEC_IS160(chspec)) ? /* if bw > 80MHz */
+       wf_chspec_primary80_chspec(chspec) : (chspec); /* extract primary 80 */
+       /* primary20 channel as first element */
+       uint8 pri_ch = (pext)[0] = wf_chspec_primary20_chan(t);
+       if (CHSPEC_IS20(chspec)) return; /* nothing more to do since 20MHz chspec */
+       /* 20MHz EXT */
+       (pext)[1] = (IS_CTL_IN_L20(t) ? pri_ch + CH_20MHZ_APART : pri_ch - CH_20MHZ_APART);
+       if (CHSPEC_IS40(chspec)) return; /* nothing more to do since 40MHz chspec */
+       /* center 40MHz EXT */
+       t = wf_channel2chspec((IS_CTL_IN_L40(chspec) ?
+               pri_ch + CH_40MHZ_APART : pri_ch - CH_40MHZ_APART), WL_CHANSPEC_BW_40);
+       GET_ALL_SB(t, &((pext)[2])); /* get the 20MHz side bands in 40MHz EXT */
+       if (CHSPEC_IS80(chspec)) return; /* nothing more to do since 80MHz chspec */
+       t = CH80MHZ_CHSPEC(wf_chspec_secondary80_channel(chspec), WL_CHANSPEC_CTL_SB_LLL);
+       /* get the 20MHz side bands in 80MHz EXT (secondary) */
+       GET_ALL_SB(t, &((pext)[4]));
+#endif /* !WL11N_20MHZONLY */
+}
+
+/*
+ * Given two chanspecs, returns true if they overlap.
+ * (Overlap: At least one 20MHz subband is common between the two chanspecs provided)
+ */
+bool wf_chspec_overlap(chanspec_t chspec0, chanspec_t chspec1)
+{
+       uint8 ch0, ch1;
+
+       if (CHSPEC_BAND(chspec0) != CHSPEC_BAND(chspec1)) {
+               return FALSE;
+       }
+
+       FOREACH_20_SB(chspec0, ch0) {
+               FOREACH_20_SB(chspec1, ch1) {
+                       if ((uint)ABS(ch0 - ch1) < CH_20MHZ_APART) {
+                               return TRUE;
+                       }
+               }
+       }
+
+       return FALSE;
+}
+
+uint8
+channel_bw_to_width(chanspec_t chspec)
+{
+       uint8 channel_width;
+
+       if (CHSPEC_IS80(chspec))
+               channel_width = VHT_OP_CHAN_WIDTH_80;
+       else if (CHSPEC_IS160(chspec))
+               channel_width = VHT_OP_CHAN_WIDTH_160;
+       else if (CHSPEC_IS8080(chspec))
+               channel_width = VHT_OP_CHAN_WIDTH_80_80;
+       else
+               channel_width = VHT_OP_CHAN_WIDTH_20_40;
+
+       return channel_width;
+}
+
+uint wf_chspec_first_20_sb(chanspec_t chspec)
+{
+#if defined(WL_BW160MHZ)
+       if (CHSPEC_IS160(chspec)) {
+               return LLL_20_SB_160(CHSPEC_CHANNEL(chspec));
+       } else
+#endif
+       if (CHSPEC_IS80(chspec)) {
+               return LL_20_SB(CHSPEC_CHANNEL(chspec));
+       } else if (CHSPEC_IS40(chspec)) {
+               return LOWER_20_SB(CHSPEC_CHANNEL(chspec));
+       } else {
+               return CHSPEC_CHANNEL(chspec);
+       }
+}
+
+chanspec_t
+wf_create_chspec_sb(uint sb, uint center_channel, chanspec_bw_t bw, chanspec_band_t band)
+{
+       chanspec_t chspec;
+       if (sb > (WL_CHANSPEC_CTL_SB_MASK >> WL_CHANSPEC_CTL_SB_SHIFT)) {
+               return INVCHANSPEC;
+       }
+       chspec = center_channel | band | bw | ((uint)sb << WL_CHANSPEC_CTL_SB_SHIFT);
+       return wf_chspec_valid(chspec) ? chspec : INVCHANSPEC;
+}
+
+chanspec_t
+wf_create_8080MHz_chspec_sb(uint sb, uint chan0, uint chan1, chanspec_band_t band)
+{
+       int chan0_id, chan1_id, seg0, seg1;
+       chanspec_t chspec;
+
+       if (sb > (WL_CHANSPEC_CTL_SB_UUU >> WL_CHANSPEC_CTL_SB_SHIFT)) {
+               return INVCHANSPEC;
+       }
+       /* From here on sb is not an index, but value for SB field */
+       sb <<= WL_CHANSPEC_CTL_SB_SHIFT;
+
+       /* frequency segments need to be non-contiguous, so the channel
+        * separation needs to be greater than 80MHz
+        */
+       if ((uint)ABS((int)(chan0 - chan1)) <= CH_80MHZ_APART) {
+               return INVCHANSPEC;
+       }
+
+       if (band == WL_CHANSPEC_BAND_5G) {
+               chan0_id = channel_80mhz_to_id(chan0);
+               chan1_id = channel_80mhz_to_id(chan1);
+       } else if (band == WL_CHANSPEC_BAND_6G) {
+               chan0_id = channel_6g_80mhz_to_id(chan0);
+               chan1_id = channel_6g_80mhz_to_id(chan1);
+       } else {
+               return INVCHANSPEC;
+       }
+
+       /* make sure the channel numbers were valid */
+       if ((chan0_id == -1) || (chan1_id == -1)) {
+               return INVCHANSPEC;
+       }
+       /* Optionally swapping channel IDs to make sure that control subchannel
+        * is in chan0
+        */
+       if (sb < WL_CHANSPEC_CTL_SB_ULL) {
+               seg0 = chan0_id;
+               seg1 = chan1_id;
+       } else {
+               seg0 = chan1_id;
+               seg1 = chan0_id;
+               sb -= WL_CHANSPEC_CTL_SB_ULL;
+       }
+       chspec = ((seg0 << WL_CHANSPEC_CHAN0_SHIFT) |
+                (seg1 << WL_CHANSPEC_CHAN1_SHIFT) |
+                sb | WL_CHANSPEC_BW_8080 | band);
+       return wf_chspec_valid(chspec) ? chspec : INVCHANSPEC;
+}
+
+chanspec_t
+wf_create_160160MHz_chspec_sb(uint sb, uint chan0, uint chan1, chanspec_band_t band)
+{
+       int chan0_id, chan1_id, seg0, seg1;
+       chanspec_t chspec;
+
+       if (sb > (WL_CHANSPEC_CTL_SB_UUU >> WL_CHANSPEC_CTL_SB_SHIFT)) {
+               return INVCHANSPEC;
+       }
+       /* From here on sb is not an index, but value for SB field */
+       sb <<= WL_CHANSPEC_CTL_SB_SHIFT;
+
+       /* frequency segments need to be non-contiguous, so the channel
+        * separation needs to be greater than 160MHz
+        */
+       if ((uint)ABS((int)(chan0 - chan1)) <= CH_160MHZ_APART) {
+               return INVCHANSPEC;
+       }
+
+       if (band == WL_CHANSPEC_BAND_5G) {
+               chan0_id = channel_5g_160mhz_to_id(chan0);
+               chan1_id = channel_5g_160mhz_to_id(chan1);
+       } else if (band == WL_CHANSPEC_BAND_6G) {
+               chan0_id = channel_6g_160mhz_to_id(chan0);
+               chan1_id = channel_6g_160mhz_to_id(chan1);
+       } else {
+               return INVCHANSPEC;
+       }
+
+       /* make sure the channel numbers were valid */
+       if ((chan0_id == -1) || (chan1_id == -1)) {
+               return INVCHANSPEC;
+       }
+       /* Optionally swapping channel IDs to make sure that control subchannel
+        * is in chan0
+        */
+       if (sb < WL_CHANSPEC_CTL_SB_ULL) {
+               seg0 = chan0_id;
+               seg1 = chan1_id;
+       } else {
+               seg0 = chan1_id;
+               seg1 = chan0_id;
+               sb -= WL_CHANSPEC_CTL_SB_ULL;
+       }
+       chspec = ((seg0 << WL_CHANSPEC_CHAN0_SHIFT) |
+                (seg1 << WL_CHANSPEC_CHAN1_SHIFT) |
+                sb | WL_CHANSPEC_BW_160160 | band);
+       return wf_chspec_valid(chspec) ? chspec : INVCHANSPEC;
+}
diff --git a/bcmdhd.101.10.240.x/bcmxtlv.c b/bcmdhd.101.10.240.x/bcmxtlv.c
new file mode 100644 (file)
index 0000000..831be2c
--- /dev/null
@@ -0,0 +1,647 @@
+/*
+ * Driver O/S-independent utility routines
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <typedefs.h>
+#include <bcmdefs.h>
+
+#include <stdarg.h>
+
+#ifdef BCMDRIVER
+#include <osl.h>
+#else /* !BCMDRIVER */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#ifndef ASSERT
+#define ASSERT(exp)
+#endif
+#endif /* !BCMDRIVER */
+
+#include <bcmtlv.h>
+#include <bcmendian.h>
+#include <bcmutils.h>
+
+int
+bcm_xtlv_hdr_size(bcm_xtlv_opts_t opts)
+{
+       int len = (int)OFFSETOF(bcm_xtlv_t, data); /* nominal */
+       if (opts & BCM_XTLV_OPTION_LENU8) --len;
+       if (opts & BCM_XTLV_OPTION_IDU8) --len;
+
+       return len;
+}
+
+bool
+bcm_valid_xtlv(const bcm_xtlv_t *elt, int buf_len, bcm_xtlv_opts_t opts)
+{
+       return elt != NULL &&
+               buf_len >= bcm_xtlv_hdr_size(opts) &&
+               buf_len  >= bcm_xtlv_size(elt, opts);
+}
+
+int
+bcm_xtlv_size_for_data(int dlen, bcm_xtlv_opts_t opts)
+{
+       int hsz;
+
+       hsz = bcm_xtlv_hdr_size(opts);
+       return ((opts & BCM_XTLV_OPTION_ALIGN32) ? ALIGN_SIZE(dlen + hsz, 4)
+               : (dlen + hsz));
+}
+
+int
+bcm_xtlv_size(const bcm_xtlv_t *elt, bcm_xtlv_opts_t opts)
+{
+       int size;       /* size including header, data, and any pad */
+       int len;        /* length wthout padding */
+
+       len = BCM_XTLV_LEN_EX(elt, opts);
+       size = bcm_xtlv_size_for_data(len, opts);
+       return size;
+}
+
+int
+bcm_xtlv_len(const bcm_xtlv_t *elt, bcm_xtlv_opts_t opts)
+{
+       const uint8 *lenp;
+       int len;
+
+       lenp = (const uint8 *)elt + OFFSETOF(bcm_xtlv_t, len); /* nominal */
+       if (opts & BCM_XTLV_OPTION_IDU8) {
+               --lenp;
+       }
+
+       if (opts & BCM_XTLV_OPTION_LENU8) {
+               len = *lenp;
+       } else if (opts & BCM_XTLV_OPTION_LENBE) {
+               len = (uint32)hton16(elt->len);
+       } else {
+               len = ltoh16_ua(lenp);
+       }
+
+       return len;
+}
+
+int
+bcm_xtlv_id(const bcm_xtlv_t *elt, bcm_xtlv_opts_t opts)
+{
+       int id = 0;
+       if (opts & BCM_XTLV_OPTION_IDU8) {
+               id =  *(const uint8 *)elt;
+       } else if (opts & BCM_XTLV_OPTION_IDBE) {
+               id = (uint32)hton16(elt->id);
+       } else {
+               id = ltoh16_ua((const uint8 *)elt);
+       }
+
+       return id;
+}
+
+bcm_xtlv_t *
+bcm_next_xtlv(const bcm_xtlv_t *elt, int *buflen, bcm_xtlv_opts_t opts)
+{
+       uint sz;
+
+       COV_TAINTED_DATA_SINK(buflen);
+       COV_NEG_SINK(buflen);
+
+       /* validate current elt */
+       if (!bcm_valid_xtlv(elt, *buflen, opts))
+               return NULL;
+
+       /* advance to next elt */
+       sz = BCM_XTLV_SIZE_EX(elt, opts);
+       elt = (const bcm_xtlv_t*)((const uint8 *)elt + sz);
+
+#if defined(__COVERITY__)
+       /* The 'sz' value is tainted in Coverity because it is read from the tainted data pointed
+        * to by 'elt'.  However, bcm_valid_xtlv() verifies that the elt pointer is a valid element,
+        * so its size, sz = BCM_XTLV_SIZE_EX(elt, opts), is in the bounds of the buffer.
+        * Clearing the tainted attribute of 'sz' for Coverity.
+        */
+       __coverity_tainted_data_sanitize__(sz);
+       if (sz > *buflen) {
+               return NULL;
+       }
+#endif /* __COVERITY__ */
+
+       *buflen -= sz;
+
+       /* validate next elt */
+       if (!bcm_valid_xtlv(elt, *buflen, opts))
+               return NULL;
+
+       COV_TAINTED_DATA_ARG(elt);
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST()
+       return (bcm_xtlv_t *)(elt);
+       GCC_DIAGNOSTIC_POP()
+}
+
+int
+bcm_xtlv_buf_init(bcm_xtlvbuf_t *tlv_buf, uint8 *buf, uint16 len, bcm_xtlv_opts_t opts)
+{
+       if (!tlv_buf || !buf || !len)
+               return BCME_BADARG;
+
+       tlv_buf->opts = opts;
+       tlv_buf->size = len;
+       tlv_buf->head = buf;
+       tlv_buf->buf  = buf;
+       return BCME_OK;
+}
+
+uint16
+bcm_xtlv_buf_len(bcm_xtlvbuf_t *tbuf)
+{
+       uint16 len;
+
+       if (tbuf)
+               len = (uint16)(tbuf->buf - tbuf->head);
+       else
+               len = 0;
+
+       return len;
+}
+
+uint16
+bcm_xtlv_buf_rlen(bcm_xtlvbuf_t *tbuf)
+{
+       uint16 rlen;
+       if (tbuf)
+               rlen = tbuf->size - bcm_xtlv_buf_len(tbuf);
+       else
+               rlen = 0;
+
+       return rlen;
+}
+
+uint8 *
+bcm_xtlv_buf(bcm_xtlvbuf_t *tbuf)
+{
+       return tbuf ? tbuf->buf : NULL;
+}
+
+uint8 *
+bcm_xtlv_head(bcm_xtlvbuf_t *tbuf)
+{
+       return tbuf ? tbuf->head : NULL;
+}
+
+void
+bcm_xtlv_pack_xtlv(bcm_xtlv_t *xtlv, uint16 type, uint16 len, const uint8 *data,
+       bcm_xtlv_opts_t opts)
+{
+       uint8 *data_buf;
+       bcm_xtlv_opts_t mask = BCM_XTLV_OPTION_IDU8 | BCM_XTLV_OPTION_LENU8;
+
+       if (!(opts & mask)) {           /* default */
+               uint8 *idp = (uint8 *)xtlv;
+               uint8 *lenp = idp + sizeof(xtlv->id);
+               htol16_ua_store(type, idp);
+               htol16_ua_store(len, lenp);
+               data_buf = lenp + sizeof(uint16);
+       } else if ((opts & mask) == mask) { /* u8 id and u8 len */
+               uint8 *idp = (uint8 *)xtlv;
+               uint8 *lenp = idp + 1;
+               *idp = (uint8)type;
+               *lenp = (uint8)len;
+               data_buf = lenp + sizeof(uint8);
+       } else if (opts & BCM_XTLV_OPTION_IDU8) { /* u8 id, u16 len */
+               uint8 *idp = (uint8 *)xtlv;
+               uint8 *lenp = idp + 1;
+               *idp = (uint8)type;
+               htol16_ua_store(len, lenp);
+               data_buf = lenp + sizeof(uint16);
+       } else if (opts & BCM_XTLV_OPTION_LENU8) { /* u16 id, u8 len */
+               uint8 *idp = (uint8 *)xtlv;
+               uint8 *lenp = idp + sizeof(uint16);
+               htol16_ua_store(type, idp);
+               *lenp = (uint8)len;
+               data_buf = lenp + sizeof(uint8);
+       } else {
+               ASSERT(!"Unexpected xtlv option");
+               return;
+       }
+
+       if (opts & BCM_XTLV_OPTION_LENU8) {
+               ASSERT(len <= 0x00ff);
+               len &= 0xff;
+       }
+
+       if (data != NULL) {
+               memcpy(data_buf, data, len);
+       }
+}
+
+/* xtlv header is always packed in LE order */
+void
+bcm_xtlv_unpack_xtlv(const bcm_xtlv_t *xtlv, uint16 *type, uint16 *len,
+       const uint8 **data, bcm_xtlv_opts_t opts)
+{
+       if (type)
+               *type = (uint16)bcm_xtlv_id(xtlv, opts);
+       if (len)
+               *len = (uint16)bcm_xtlv_len(xtlv, opts);
+       if (data)
+               *data = (const uint8 *)xtlv + BCM_XTLV_HDR_SIZE_EX(opts);
+}
+
+int
+bcm_xtlv_put_data(bcm_xtlvbuf_t *tbuf, uint16 type, const uint8 *data, int n)
+{
+       bcm_xtlv_t *xtlv;
+       int size;
+
+       if (tbuf == NULL)
+               return BCME_BADARG;
+
+       size = bcm_xtlv_size_for_data(n, tbuf->opts);
+       if (bcm_xtlv_buf_rlen(tbuf) < size)
+               return BCME_NOMEM;
+
+       xtlv = (bcm_xtlv_t *)bcm_xtlv_buf(tbuf);
+       bcm_xtlv_pack_xtlv(xtlv, type, (uint16)n, data, tbuf->opts);
+       tbuf->buf += size; /* note: data may be NULL, reserves space */
+       return BCME_OK;
+}
+
+static int
+bcm_xtlv_put_int(bcm_xtlvbuf_t *tbuf, uint16 type, const uint8 *data, int n, int int_sz)
+{
+       bcm_xtlv_t *xtlv;
+       int xtlv_len;
+       uint8 *xtlv_data;
+       int err = BCME_OK;
+
+       if (tbuf == NULL) {
+               err = BCME_BADARG;
+               goto done;
+       }
+
+       xtlv = (bcm_xtlv_t *)bcm_xtlv_buf(tbuf);
+
+       /* put type and length in xtlv and reserve data space */
+       xtlv_len = n * int_sz;
+       err = bcm_xtlv_put_data(tbuf, type, NULL, xtlv_len);
+       if (err != BCME_OK)
+               goto done;
+
+       xtlv_data = (uint8 *)xtlv + bcm_xtlv_hdr_size(tbuf->opts);
+
+       /* write data w/ little-endianness into buffer - single loop, aligned access */
+       for (; n != 0; --n, xtlv_data += int_sz, data += int_sz) {
+               switch (int_sz) {
+               case sizeof(uint8):
+                       break;
+               case sizeof(uint16):
+                       {
+                               uint16 v =  load16_ua(data);
+                               htol16_ua_store(v, xtlv_data);
+                               break;
+                       }
+               case sizeof(uint32):
+                       {
+                               uint32 v = load32_ua(data);
+                               htol32_ua_store(v, xtlv_data);
+                               break;
+                       }
+               case sizeof(uint64):
+                       {
+                               uint64 v = load64_ua(data);
+                               htol64_ua_store(v, xtlv_data);
+                               break;
+                       }
+               default:
+                       err = BCME_UNSUPPORTED;
+                       goto done;
+               }
+       }
+
+done:
+       return err;
+}
+
+int
+bcm_xtlv_put16(bcm_xtlvbuf_t *tbuf, uint16 type, const uint16 *data, int n)
+{
+       return bcm_xtlv_put_int(tbuf, type, (const uint8 *)data, n, sizeof(uint16));
+}
+
+int
+bcm_xtlv_put32(bcm_xtlvbuf_t *tbuf, uint16 type, const uint32 *data, int n)
+{
+       return bcm_xtlv_put_int(tbuf, type, (const uint8 *)data, n, sizeof(uint32));
+}
+
+int
+bcm_xtlv_put64(bcm_xtlvbuf_t *tbuf, uint16 type, const uint64 *data, int n)
+{
+       return bcm_xtlv_put_int(tbuf, type, (const uint8 *)data, n, sizeof(uint64));
+}
+
+/*
+ *  upacks xtlv record from buf checks the type
+ *  copies data to callers buffer
+ *  advances tlv pointer to next record
+ *  caller's resposible for dst space check
+ */
+int
+bcm_unpack_xtlv_entry(const uint8 **tlv_buf, uint16 xpct_type, uint16 xpct_len,
+       uint8 *dst_data, bcm_xtlv_opts_t opts)
+{
+       const bcm_xtlv_t *ptlv = (const bcm_xtlv_t *)*tlv_buf;
+       uint16 len;
+       uint16 type;
+       const uint8 *data;
+
+       ASSERT(ptlv);
+
+       bcm_xtlv_unpack_xtlv(ptlv, &type, &len, &data, opts);
+       if (len) {
+               if ((type != xpct_type) || (len > xpct_len))
+                       return BCME_BADARG;
+               if (dst_data && data)
+                       memcpy(dst_data, data, len); /* copy data to dst */
+       }
+
+       *tlv_buf += BCM_XTLV_SIZE_EX(ptlv, opts);
+       return BCME_OK;
+}
+
+/*
+ *  packs user data into tlv record and advances tlv pointer to next xtlv slot
+ *  buflen is used for tlv_buf space check
+ */
+int
+bcm_pack_xtlv_entry(uint8 **tlv_buf, uint16 *buflen, uint16 type, uint16 len,
+       const uint8 *src_data, bcm_xtlv_opts_t opts)
+{
+       bcm_xtlv_t *ptlv = (bcm_xtlv_t *)*tlv_buf;
+       int size;
+
+       ASSERT(ptlv);
+
+       size = bcm_xtlv_size_for_data(len, opts);
+
+       /* copy data from tlv buffer to dst provided by user */
+       if (size > *buflen) {
+               return BCME_BADLEN;
+       }
+
+       bcm_xtlv_pack_xtlv(ptlv, type, len, src_data, opts);
+
+       /* advance callers pointer to tlv buff */
+       *tlv_buf = (uint8*)(*tlv_buf) + size;
+       /* decrement the len */
+       *buflen -= (uint16)size;
+       return BCME_OK;
+}
+
+/*
+ *  unpack all xtlv records from the issue a callback
+ *  to set function one call per found tlv record
+ */
+int
+bcm_unpack_xtlv_buf(void *ctx, const uint8 *tlv_buf, uint16 buflen, bcm_xtlv_opts_t opts,
+       bcm_xtlv_unpack_cbfn_t *cbfn)
+{
+       uint16 len;
+       uint16 type;
+       int res = BCME_OK;
+       int size;
+       const bcm_xtlv_t *ptlv;
+       int sbuflen = buflen;
+       const uint8 *data;
+       int hdr_size;
+
+       ASSERT(!buflen || tlv_buf);
+       ASSERT(!buflen || cbfn);
+
+       hdr_size = BCM_XTLV_HDR_SIZE_EX(opts);
+       while (sbuflen >= hdr_size) {
+               ptlv = (const bcm_xtlv_t *)tlv_buf;
+
+               bcm_xtlv_unpack_xtlv(ptlv, &type, &len, &data, opts);
+               size = bcm_xtlv_size_for_data(len, opts);
+
+               sbuflen -= size;
+
+               /* check for buffer overrun */
+               if (sbuflen < 0) {
+                       break;
+               }
+
+               if ((res = cbfn(ctx, data, type, len)) != BCME_OK) {
+                       break;
+               }
+               tlv_buf += size;
+       }
+       return res;
+}
+
+int
+bcm_pack_xtlv_buf(void *ctx, uint8 *tlv_buf, uint16 buflen, bcm_xtlv_opts_t opts,
+       bcm_pack_xtlv_next_info_cbfn_t get_next, bcm_pack_xtlv_pack_next_cbfn_t pack_next,
+       int *outlen)
+{
+       int res = BCME_OK;
+       uint16 tlv_id;
+       uint16 tlv_len;
+       uint8 *startp;
+       uint8 *endp;
+       uint8 *buf;
+       bool more;
+       int size;
+       int hdr_size;
+
+       ASSERT(get_next && pack_next);
+
+       buf = tlv_buf;
+       startp = buf;
+       endp = (uint8 *)buf + buflen;
+       more = TRUE;
+       hdr_size = BCM_XTLV_HDR_SIZE_EX(opts);
+
+       while (more && (buf < endp)) {
+               more = get_next(ctx, &tlv_id, &tlv_len);
+               size = bcm_xtlv_size_for_data(tlv_len, opts);
+               if ((buf + size) > endp) {
+                       res = BCME_BUFTOOSHORT;
+                       goto done;
+               }
+
+               bcm_xtlv_pack_xtlv((bcm_xtlv_t *)buf, tlv_id, tlv_len, NULL, opts);
+               pack_next(ctx, tlv_id, tlv_len, buf + hdr_size);
+               buf += size;
+       }
+
+       if (more)
+               res = BCME_BUFTOOSHORT;
+
+done:
+       if (outlen) {
+               *outlen = (int)(buf - startp);
+       }
+       return res;
+}
+
+/*
+ *  pack xtlv buffer from memory according to xtlv_desc_t
+ */
+int
+bcm_pack_xtlv_buf_from_mem(uint8 **tlv_buf, uint16 *buflen, const xtlv_desc_t *items,
+       bcm_xtlv_opts_t opts)
+{
+       int res = BCME_OK;
+       uint8 *ptlv = *tlv_buf;
+
+       while (items->type != 0) {
+               if (items->len && items->ptr) {
+                       res = bcm_pack_xtlv_entry(&ptlv, buflen, items->type,
+                               items->len, items->ptr, opts);
+                       if (res != BCME_OK)
+                               break;
+               }
+               items++;
+       }
+
+       *tlv_buf = ptlv; /* update the external pointer */
+       return res;
+}
+
+/*
+ *  unpack xtlv buffer to memory according to xtlv_desc_t
+ *
+ */
+int
+bcm_unpack_xtlv_buf_to_mem(const uint8 *tlv_buf, int *buflen, xtlv_desc_t *items,
+       bcm_xtlv_opts_t opts)
+{
+       int res = BCME_OK;
+       const bcm_xtlv_t *elt;
+
+       elt =  bcm_valid_xtlv((const bcm_xtlv_t *)tlv_buf, *buflen, opts) ?
+               (const bcm_xtlv_t *)tlv_buf : NULL;
+       if (!elt || !items) {
+               res = BCME_BADARG;
+               return res;
+       }
+
+       for (; elt != NULL && res == BCME_OK; elt = bcm_next_xtlv(elt, buflen, opts)) {
+               /*  find matches in desc_t items  */
+               xtlv_desc_t *dst_desc = items;
+               uint16 len, type;
+               const uint8 *data;
+
+               bcm_xtlv_unpack_xtlv(elt, &type, &len, &data, opts);
+               while (dst_desc->type != 0) {
+                       if (type == dst_desc->type) {
+                               if (len != dst_desc->len) {
+                                       res = BCME_BADLEN;
+                               } else {
+                                       memcpy(dst_desc->ptr, data, len);
+                               }
+                               break;
+                       }
+                       dst_desc++;
+               }
+       }
+
+       if (res == BCME_OK && *buflen != 0)             /* this does not look right */
+               res =  BCME_BUFTOOSHORT;
+
+       return res;
+}
+
+/*
+ * return data pointer of a given ID from xtlv buffer.
+ * If the specified xTLV ID is found, on return *datalen will contain
+ * the the data length of the xTLV ID.
+ */
+const uint8*
+bcm_get_data_from_xtlv_buf(const uint8 *tlv_buf, uint16 buflen, uint16 id,
+       uint16 *datalen, bcm_xtlv_opts_t opts)
+{
+       const uint8 *retptr = NULL;
+       uint16 type, len;
+       int size;
+       const bcm_xtlv_t *ptlv;
+       int sbuflen = buflen;
+       const uint8 *data;
+       int hdr_size;
+
+       COV_TAINTED_DATA_SINK(buflen);
+       COV_NEG_SINK(buflen);
+
+       hdr_size = BCM_XTLV_HDR_SIZE_EX(opts);
+
+       /* Init the datalength */
+       if (datalen) {
+               *datalen = 0;
+       }
+       while (sbuflen >= hdr_size) {
+               ptlv = (const bcm_xtlv_t *)tlv_buf;
+               bcm_xtlv_unpack_xtlv(ptlv, &type, &len, &data, opts);
+
+               size = bcm_xtlv_size_for_data(len, opts);
+               sbuflen -= size;
+               if (sbuflen < 0) /* buffer overrun? */
+                       break;
+
+               if (id == type) {
+                       retptr = data;
+                       if (datalen)
+                               *datalen = len;
+                       break;
+               }
+
+               tlv_buf += size;
+       }
+
+       COV_TAINTED_DATA_ARG(retptr);
+
+       return retptr;
+}
+
+bcm_xtlv_t*
+bcm_xtlv_bcopy(const bcm_xtlv_t *src, bcm_xtlv_t *dst,
+       int src_buf_len, int dst_buf_len, bcm_xtlv_opts_t opts)
+{
+       bcm_xtlv_t *dst_next = NULL;
+       src =  (src && bcm_valid_xtlv(src, src_buf_len, opts)) ? src : NULL;
+       if (src && dst) {
+               uint16 type;
+               uint16 len;
+               const uint8 *data;
+               int size;
+               bcm_xtlv_unpack_xtlv(src, &type, &len, &data, opts);
+               size = bcm_xtlv_size_for_data(len, opts);
+               if (size <= dst_buf_len) {
+                       bcm_xtlv_pack_xtlv(dst, type, len, data, opts);
+                       dst_next = (bcm_xtlv_t *)((uint8 *)dst + size);
+               }
+       }
+
+       return dst_next;
+}
diff --git a/bcmdhd.101.10.240.x/dbus.c b/bcmdhd.101.10.240.x/dbus.c
new file mode 100644 (file)
index 0000000..66fc7f8
--- /dev/null
@@ -0,0 +1,2905 @@
+/** @file dbus.c
+ *
+ * Hides details of USB / SDIO / SPI interfaces and OS details. It is intended to shield details and
+ * provide the caller with one common bus interface for all dongle devices. In practice, it is only
+ * used for USB interfaces. DBUS is not a protocol, but an abstraction layer.
+ *
+ * Copyright (C) 1999-2016, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dbus.c 553311 2015-04-29 10:23:08Z $
+ */
+
+
+#include "osl.h"
+#include "dbus.h"
+#include <bcmutils.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_proto.h>
+#ifdef PROP_TXSTATUS /* a form of flow control between host and dongle */
+#include <dhd_wlfc.h>
+#endif
+#include <dhd_config.h>
+
+#if defined(BCM_REQUEST_FW)
+#include <bcmsrom_fmt.h>
+#include <trxhdr.h>
+#include <usbrdl.h>
+#include <bcmendian.h>
+#include <sbpcmcia.h>
+#include <bcmnvram.h>
+#include <bcmdevs.h>
+#endif 
+
+
+
+#if defined(BCM_REQUEST_FW)
+#ifndef VARS_MAX
+#define VARS_MAX            8192
+#endif
+#endif 
+
+#ifdef DBUS_USB_LOOPBACK
+extern bool is_loopback_pkt(void *buf);
+extern int matches_loopback_pkt(void *buf);
+#endif
+
+/** General info for all BUS types */
+typedef struct dbus_irbq {
+       dbus_irb_t *head;
+       dbus_irb_t *tail;
+       int cnt;
+} dbus_irbq_t;
+
+/**
+ * This private structure dhd_bus_t is also declared in dbus_usb_linux.c.
+ * All the fields must be consistent in both declarations.
+ */
+typedef struct dhd_bus {
+       dbus_pub_t   pub; /* MUST BE FIRST */
+       dhd_pub_t *dhd;
+
+       void        *cbarg;
+       dbus_callbacks_t *cbs; /* callbacks to higher level, e.g. dhd_linux.c */
+       void        *bus_info;
+       dbus_intf_t *drvintf;  /* callbacks to lower level, e.g. dbus_usb.c or dbus_usb_linux.c */
+       uint8       *fw;
+       int         fwlen;
+       uint32      errmask;
+       int         rx_low_watermark;  /* avoid rx overflow by filling rx with free IRBs */
+       int         tx_low_watermark;
+       bool        txoff;
+       bool        txoverride;   /* flow control related */
+       bool        rxoff;
+       bool        tx_timer_ticking;
+
+
+       dbus_irbq_t *rx_q;
+       dbus_irbq_t *tx_q;
+
+       uint8        *nvram;
+       int          nvram_len;
+       uint8        *image;  /* buffer for combine fw and nvram */
+       int          image_len;
+       uint8        *orig_fw;
+       int          origfw_len;
+       int          decomp_memsize;
+       dbus_extdl_t extdl;
+       int          nvram_nontxt;
+#if defined(BCM_REQUEST_FW)
+       void         *firmware;
+       void         *nvfile;
+#endif
+       char            *fw_path;               /* module_param: path to firmware image */
+       char            *nv_path;               /* module_param: path to nvram vars file */
+} dhd_bus_t;
+
+struct exec_parms {
+       union {
+               /* Can consolidate same params, if need be, but this shows
+                * group of parameters per function
+                */
+               struct {
+                       dbus_irbq_t  *q;
+                       dbus_irb_t   *b;
+               } qenq;
+
+               struct {
+                       dbus_irbq_t  *q;
+               } qdeq;
+       };
+};
+
+#define EXEC_RXLOCK(info, fn, a) \
+       info->drvintf->exec_rxlock(dhd_bus->bus_info, ((exec_cb_t)fn), ((struct exec_parms *) a))
+
+#define EXEC_TXLOCK(info, fn, a) \
+       info->drvintf->exec_txlock(dhd_bus->bus_info, ((exec_cb_t)fn), ((struct exec_parms *) a))
+
+/*
+ * Callbacks common for all BUS
+ */
+static void dbus_if_send_irb_timeout(void *handle, dbus_irb_tx_t *txirb);
+static void dbus_if_send_irb_complete(void *handle, dbus_irb_tx_t *txirb, int status);
+static void dbus_if_recv_irb_complete(void *handle, dbus_irb_rx_t *rxirb, int status);
+static void dbus_if_errhandler(void *handle, int err);
+static void dbus_if_ctl_complete(void *handle, int type, int status);
+static void dbus_if_state_change(void *handle, int state);
+static void *dbus_if_pktget(void *handle, uint len, bool send);
+static void dbus_if_pktfree(void *handle, void *p, bool send);
+static struct dbus_irb *dbus_if_getirb(void *cbarg, bool send);
+static void dbus_if_rxerr_indicate(void *handle, bool on);
+
+void * dhd_dbus_probe_cb(void *arg, const char *desc, uint32 bustype,
+       uint16 bus_no, uint16 slot, uint32 hdrlen);
+void dhd_dbus_disconnect_cb(void *arg);
+void dbus_detach(dhd_bus_t *pub);
+
+/** functions in this file that are called by lower DBUS levels, e.g. dbus_usb.c */
+static dbus_intf_callbacks_t dbus_intf_cbs = {
+       dbus_if_send_irb_timeout,
+       dbus_if_send_irb_complete,
+       dbus_if_recv_irb_complete,
+       dbus_if_errhandler,
+       dbus_if_ctl_complete,
+       dbus_if_state_change,
+       NULL,                   /* isr */
+       NULL,                   /* dpc */
+       NULL,                   /* watchdog */
+       dbus_if_pktget,
+       dbus_if_pktfree,
+       dbus_if_getirb,
+       dbus_if_rxerr_indicate
+};
+
+/*
+ * Need global for probe() and disconnect() since
+ * attach() is not called at probe and detach()
+ * can be called inside disconnect()
+ */
+static dbus_intf_t     *g_busintf = NULL;
+static probe_cb_t      probe_cb = NULL;
+static disconnect_cb_t disconnect_cb = NULL;
+static void            *probe_arg = NULL;
+static void            *disc_arg = NULL;
+
+#if defined(BCM_REQUEST_FW)
+int8 *nonfwnvram = NULL; /* stand-alone multi-nvram given with driver load */
+int nonfwnvramlen = 0;
+#endif /* #if defined(BCM_REQUEST_FW) */
+
+static void* q_enq(dbus_irbq_t *q, dbus_irb_t *b);
+static void* q_enq_exec(struct exec_parms *args);
+static dbus_irb_t*q_deq(dbus_irbq_t *q);
+static void* q_deq_exec(struct exec_parms *args);
+static int   dbus_tx_timer_init(dhd_bus_t *dhd_bus);
+static int   dbus_tx_timer_start(dhd_bus_t *dhd_bus, uint timeout);
+static int   dbus_tx_timer_stop(dhd_bus_t *dhd_bus);
+static int   dbus_irbq_init(dhd_bus_t *dhd_bus, dbus_irbq_t *q, int nq, int size_irb);
+static int   dbus_irbq_deinit(dhd_bus_t *dhd_bus, dbus_irbq_t *q, int size_irb);
+static int   dbus_rxirbs_fill(dhd_bus_t *dhd_bus);
+static int   dbus_send_irb(dbus_pub_t *pub, uint8 *buf, int len, void *pkt, void *info);
+static void  dbus_disconnect(void *handle);
+static void *dbus_probe(void *arg, const char *desc, uint32 bustype,
+       uint16 bus_no, uint16 slot, uint32 hdrlen);
+
+#if defined(BCM_REQUEST_FW)
+extern char * dngl_firmware;
+extern unsigned int dngl_fwlen;
+#ifndef EXTERNAL_FW_PATH
+static int dbus_get_nvram(dhd_bus_t *dhd_bus);
+static int dbus_jumbo_nvram(dhd_bus_t *dhd_bus);
+static int dbus_otp(dhd_bus_t *dhd_bus, uint16 *boardtype, uint16 *boardrev);
+static int dbus_select_nvram(dhd_bus_t *dhd_bus, int8 *jumbonvram, int jumbolen,
+uint16 boardtype, uint16 boardrev, int8 **nvram, int *nvram_len);
+#endif /* !EXTERNAL_FW_PATH */
+extern int dbus_zlib_decomp(dhd_bus_t *dhd_bus);
+extern void *dbus_zlib_calloc(int num, int size);
+extern void dbus_zlib_free(void *ptr);
+#endif
+
+/* function */
+void
+dbus_flowctrl_tx(void *dbi, bool on)
+{
+       dhd_bus_t *dhd_bus = dbi;
+
+       if (dhd_bus == NULL)
+               return;
+
+       DBUSTRACE(("%s on %d\n", __FUNCTION__, on));
+
+       if (dhd_bus->txoff == on)
+               return;
+
+       dhd_bus->txoff = on;
+
+       if (dhd_bus->cbs && dhd_bus->cbs->txflowcontrol)
+               dhd_bus->cbs->txflowcontrol(dhd_bus->cbarg, on);
+}
+
+/**
+ * if lower level DBUS signaled a rx error, more free rx IRBs should be allocated or flow control
+ * should kick in to make more free rx IRBs available.
+ */
+static void
+dbus_if_rxerr_indicate(void *handle, bool on)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) handle;
+
+       DBUSTRACE(("%s, on %d\n", __FUNCTION__, on));
+
+       if (dhd_bus == NULL)
+               return;
+
+       if (dhd_bus->txoverride == on)
+               return;
+
+       dhd_bus->txoverride = on;       /* flow control */
+
+       if (!on)
+               dbus_rxirbs_fill(dhd_bus);
+
+}
+
+/** q_enq()/q_deq() are executed with protection via exec_rxlock()/exec_txlock() */
+static void*
+q_enq(dbus_irbq_t *q, dbus_irb_t *b)
+{
+       ASSERT(q->tail != b);
+       ASSERT(b->next == NULL);
+       b->next = NULL;
+       if (q->tail) {
+               q->tail->next = b;
+               q->tail = b;
+       } else
+               q->head = q->tail = b;
+
+       q->cnt++;
+
+       return b;
+}
+
+static void*
+q_enq_exec(struct exec_parms *args)
+{
+       return q_enq(args->qenq.q, args->qenq.b);
+}
+
+static dbus_irb_t*
+q_deq(dbus_irbq_t *q)
+{
+       dbus_irb_t *b;
+
+       b = q->head;
+       if (b) {
+               q->head = q->head->next;
+               b->next = NULL;
+
+               if (q->head == NULL)
+                       q->tail = q->head;
+
+               q->cnt--;
+       }
+       return b;
+}
+
+static void*
+q_deq_exec(struct exec_parms *args)
+{
+       return q_deq(args->qdeq.q);
+}
+
+/**
+ * called during attach phase. Status @ Dec 2012: this function does nothing since for all of the
+ * lower DBUS levels dhd_bus->drvintf->tx_timer_init is NULL.
+ */
+static int
+dbus_tx_timer_init(dhd_bus_t *dhd_bus)
+{
+       if (dhd_bus && dhd_bus->drvintf && dhd_bus->drvintf->tx_timer_init)
+               return dhd_bus->drvintf->tx_timer_init(dhd_bus->bus_info);
+       else
+               return DBUS_ERR;
+}
+
+static int
+dbus_tx_timer_start(dhd_bus_t *dhd_bus, uint timeout)
+{
+       if (dhd_bus == NULL)
+               return DBUS_ERR;
+
+       if (dhd_bus->tx_timer_ticking)
+               return DBUS_OK;
+
+       if (dhd_bus->drvintf && dhd_bus->drvintf->tx_timer_start) {
+               if (dhd_bus->drvintf->tx_timer_start(dhd_bus->bus_info, timeout) == DBUS_OK) {
+                       dhd_bus->tx_timer_ticking = TRUE;
+                       return DBUS_OK;
+               }
+       }
+
+       return DBUS_ERR;
+}
+
+static int
+dbus_tx_timer_stop(dhd_bus_t *dhd_bus)
+{
+       if (dhd_bus == NULL)
+               return DBUS_ERR;
+
+       if (!dhd_bus->tx_timer_ticking)
+               return DBUS_OK;
+
+       if (dhd_bus->drvintf && dhd_bus->drvintf->tx_timer_stop) {
+               if (dhd_bus->drvintf->tx_timer_stop(dhd_bus->bus_info) == DBUS_OK) {
+                       dhd_bus->tx_timer_ticking = FALSE;
+                       return DBUS_OK;
+               }
+       }
+
+       return DBUS_ERR;
+}
+
+/** called during attach phase. */
+static int
+dbus_irbq_init(dhd_bus_t *dhd_bus, dbus_irbq_t *q, int nq, int size_irb)
+{
+       int i;
+       dbus_irb_t *irb;
+
+       ASSERT(q);
+       ASSERT(dhd_bus);
+
+       for (i = 0; i < nq; i++) {
+               /* MALLOC dbus_irb_tx or dbus_irb_rx, but cast to simple dbus_irb_t linkedlist */
+               irb = (dbus_irb_t *) MALLOC(dhd_bus->pub.osh, size_irb);
+               if (irb == NULL) {
+                       ASSERT(irb);
+                       return DBUS_ERR;
+               }
+               bzero(irb, size_irb);
+
+               /* q_enq() does not need to go through EXEC_xxLOCK() during init() */
+               q_enq(q, irb);
+       }
+
+       return DBUS_OK;
+}
+
+/** called during detach phase or when attach failed */
+static int
+dbus_irbq_deinit(dhd_bus_t *dhd_bus, dbus_irbq_t *q, int size_irb)
+{
+       dbus_irb_t *irb;
+
+       ASSERT(q);
+       ASSERT(dhd_bus);
+
+       /* q_deq() does not need to go through EXEC_xxLOCK()
+        * during deinit(); all callbacks are stopped by this time
+        */
+       while ((irb = q_deq(q)) != NULL) {
+               MFREE(dhd_bus->pub.osh, irb, size_irb);
+       }
+
+       if (q->cnt)
+               DBUSERR(("deinit: q->cnt=%d > 0\n", q->cnt));
+       return DBUS_OK;
+}
+
+/** multiple code paths require the rx queue to be filled with more free IRBs */
+static int
+dbus_rxirbs_fill(dhd_bus_t *dhd_bus)
+{
+       int err = DBUS_OK;
+
+
+       dbus_irb_rx_t *rxirb;
+       struct exec_parms args;
+
+       ASSERT(dhd_bus);
+       if (dhd_bus->pub.busstate != DBUS_STATE_UP) {
+               DBUSERR(("dbus_rxirbs_fill: DBUS not up \n"));
+               return DBUS_ERR;
+       } else if (!dhd_bus->drvintf || (dhd_bus->drvintf->recv_irb == NULL)) {
+               /* Lower edge bus interface does not support recv_irb().
+                * No need to pre-submit IRBs in this case.
+                */
+               return DBUS_ERR;
+       }
+
+       /* The dongle recv callback is freerunning without lock. So multiple callbacks(and this
+        *  refill) can run in parallel. While the rxoff condition is triggered outside,
+        *  below while loop has to check and abort posting more to avoid RPC rxq overflow.
+        */
+       args.qdeq.q = dhd_bus->rx_q;
+       while ((!dhd_bus->rxoff) &&
+              (rxirb = (EXEC_RXLOCK(dhd_bus, q_deq_exec, &args))) != NULL) {
+               err = dhd_bus->drvintf->recv_irb(dhd_bus->bus_info, rxirb);
+               if (err == DBUS_ERR_RXDROP || err == DBUS_ERR_RXFAIL) {
+                       /* Add the the free rxirb back to the queue
+                        * and wait till later
+                        */
+                       bzero(rxirb, sizeof(dbus_irb_rx_t));
+                       args.qenq.q = dhd_bus->rx_q;
+                       args.qenq.b = (dbus_irb_t *) rxirb;
+                       EXEC_RXLOCK(dhd_bus, q_enq_exec, &args);
+                       break;
+               } else if (err != DBUS_OK) {
+                       int i = 0;
+                       while (i++ < 100) {
+                               DBUSERR(("%s :: memory leak for rxirb note?\n", __FUNCTION__));
+                       }
+               }
+       }
+       return err;
+} /* dbus_rxirbs_fill */
+
+/** called when the DBUS interface state changed. */
+void
+dbus_flowctrl_rx(dbus_pub_t *pub, bool on)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+
+       if (dhd_bus == NULL)
+               return;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (dhd_bus->rxoff == on)
+               return;
+
+       dhd_bus->rxoff = on;
+
+       if (dhd_bus->pub.busstate == DBUS_STATE_UP) {
+               if (!on) {
+                       /* post more irbs, resume rx if necessary */
+                       dbus_rxirbs_fill(dhd_bus);
+                       if (dhd_bus && dhd_bus->drvintf->recv_resume) {
+                               dhd_bus->drvintf->recv_resume(dhd_bus->bus_info);
+                       }
+               } else {
+                       /* ??? cancell posted irbs first */
+
+                       if (dhd_bus && dhd_bus->drvintf->recv_stop) {
+                               dhd_bus->drvintf->recv_stop(dhd_bus->bus_info);
+                       }
+               }
+       }
+}
+
+/**
+ * Several code paths in this file want to send a buffer to the dongle. This function handles both
+ * sending of a buffer or a pkt.
+ */
+static int
+dbus_send_irb(dbus_pub_t *pub, uint8 *buf, int len, void *pkt, void *info)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+       int err = DBUS_OK;
+       dbus_irb_tx_t *txirb = NULL;
+       int txirb_pending;
+       struct exec_parms args;
+
+       if (dhd_bus == NULL)
+               return DBUS_ERR;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (dhd_bus->pub.busstate == DBUS_STATE_UP ||
+               dhd_bus->pub.busstate == DBUS_STATE_SLEEP) {
+               args.qdeq.q = dhd_bus->tx_q;
+               if (dhd_bus->drvintf)
+                       txirb = EXEC_TXLOCK(dhd_bus, q_deq_exec, &args);
+
+               if (txirb == NULL) {
+                       DBUSERR(("Out of tx dbus_bufs\n"));
+                       return DBUS_ERR;
+               }
+
+               if (pkt != NULL) {
+                       txirb->pkt = pkt;
+                       txirb->buf = NULL;
+                       txirb->len = 0;
+               } else if (buf != NULL) {
+                       txirb->pkt = NULL;
+                       txirb->buf = buf;
+                       txirb->len = len;
+               } else {
+                       ASSERT(0); /* Should not happen */
+               }
+               txirb->info = info;
+               txirb->arg = NULL;
+               txirb->retry_count = 0;
+
+               if (dhd_bus->drvintf && dhd_bus->drvintf->send_irb) {
+                       /* call lower DBUS level send_irb function */
+                       err = dhd_bus->drvintf->send_irb(dhd_bus->bus_info, txirb);
+                       if (err == DBUS_ERR_TXDROP) {
+                               /* tx fail and no completion routine to clean up, reclaim irb NOW */
+                               DBUSERR(("%s: send_irb failed, status = %d\n", __FUNCTION__, err));
+                               bzero(txirb, sizeof(dbus_irb_tx_t));
+                               args.qenq.q = dhd_bus->tx_q;
+                               args.qenq.b = (dbus_irb_t *) txirb;
+                               EXEC_TXLOCK(dhd_bus, q_enq_exec, &args);
+                       } else {
+                               dbus_tx_timer_start(dhd_bus, DBUS_TX_TIMEOUT_INTERVAL);
+                               txirb_pending = dhd_bus->pub.ntxq - dhd_bus->tx_q->cnt;
+                               if (txirb_pending > (dhd_bus->tx_low_watermark * 3)) {
+                                       dbus_flowctrl_tx(dhd_bus, TRUE);
+                               }
+                       }
+               }
+       } else {
+               err = DBUS_ERR_TXFAIL;
+               DBUSTRACE(("%s: bus down, send_irb failed\n", __FUNCTION__));
+       }
+
+       return err;
+} /* dbus_send_irb */
+
+#if defined(BCM_REQUEST_FW)
+
+/**
+ * Before downloading a firmware image into the dongle, the validity of the image must be checked.
+ */
+static int
+check_file(osl_t *osh, unsigned char *headers)
+{
+       struct trx_header *trx;
+       int actual_len = -1;
+
+       /* Extract trx header */
+       trx = (struct trx_header *)headers;
+       if (ltoh32(trx->magic) != TRX_MAGIC) {
+               printf("Error: trx bad hdr %x\n", ltoh32(trx->magic));
+               return -1;
+       }
+
+       headers += SIZEOF_TRX(trx);
+
+       /* TRX V1: get firmware len */
+       /* TRX V2: get firmware len and DSG/CFG lengths */
+       if (ltoh32(trx->flag_version) & TRX_UNCOMP_IMAGE) {
+               actual_len = ltoh32(trx->offsets[TRX_OFFSETS_DLFWLEN_IDX]) +
+                                    SIZEOF_TRX(trx);
+#ifdef BCMTRXV2
+               if (ISTRX_V2(trx)) {
+                       actual_len += ltoh32(trx->offsets[TRX_OFFSETS_DSG_LEN_IDX]) +
+                               ltoh32(trx->offsets[TRX_OFFSETS_CFG_LEN_IDX]);
+               }
+#endif
+               return actual_len;
+       }  else {
+               printf("compressed image\n");
+       }
+
+       return -1;
+}
+
+#ifdef EXTERNAL_FW_PATH
+static int
+dbus_get_fw_nvram(dhd_bus_t *dhd_bus, char *pfw_path, char *pnv_path)
+{
+       int bcmerror = -1, i;
+       uint len, total_len;
+       void *nv_image = NULL, *fw_image = NULL;
+       char *nv_memblock = NULL, *fw_memblock = NULL;
+       char *bufp;
+       bool file_exists;
+       uint8 nvram_words_pad = 0;
+       uint memblock_size = 2048;
+       uint8 *memptr;
+       int     actual_fwlen;
+       struct trx_header *hdr;
+       uint32 img_offset = 0;
+       int offset = 0;
+
+       /* For Get nvram */
+       file_exists = ((pnv_path != NULL) && (pnv_path[0] != '\0'));
+       if (file_exists) {
+               nv_image = dhd_os_open_image1(dhd_bus->dhd, pnv_path);
+               if (nv_image == NULL) {
+                       printf("%s: Open nvram file failed %s\n", __FUNCTION__, pnv_path);
+                       goto err;
+               }
+       }
+       nv_memblock = MALLOC(dhd_bus->pub.osh, MAX_NVRAMBUF_SIZE);
+       if (nv_memblock == NULL) {
+               DBUSERR(("%s: Failed to allocate memory %d bytes\n",
+                          __FUNCTION__, MAX_NVRAMBUF_SIZE));
+               goto err;
+       }
+       len = dhd_os_get_image_block(nv_memblock, MAX_NVRAMBUF_SIZE, nv_image);
+       if (len > 0 && len < MAX_NVRAMBUF_SIZE) {
+               bufp = (char *)nv_memblock;
+               bufp[len] = 0;
+               dhd_bus->nvram_len = process_nvram_vars(bufp, len);
+               if (dhd_bus->nvram_len % 4)
+                       nvram_words_pad = 4 - dhd_bus->nvram_len % 4;
+       } else {
+               DBUSERR(("%s: error reading nvram file: %d\n", __FUNCTION__, len));
+               bcmerror = DBUS_ERR_NVRAM;
+               goto err;
+       }
+       if (nv_image) {
+               dhd_os_close_image1(dhd_bus->dhd, nv_image);
+               nv_image = NULL;
+       }
+
+       /* For Get first block of fw to calculate total_len */
+       file_exists = ((pfw_path != NULL) && (pfw_path[0] != '\0'));
+       if (file_exists) {
+               fw_image = dhd_os_open_image1(dhd_bus->dhd, pfw_path);
+               if (fw_image == NULL) {
+                       printf("%s: Open fw file failed %s\n", __FUNCTION__, pfw_path);
+                       goto err;
+               }
+       }
+       memptr = fw_memblock = MALLOC(dhd_bus->pub.osh, memblock_size);
+       if (fw_memblock == NULL) {
+               DBUSERR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__,
+                       memblock_size));
+               goto err;
+       }
+       len = dhd_os_get_image_block((char*)memptr, memblock_size, fw_image);
+       if ((actual_fwlen = check_file(dhd_bus->pub.osh, memptr)) <= 0) {
+               DBUSERR(("%s: bad firmware format!\n", __FUNCTION__));
+               goto err;
+       }
+
+       total_len = actual_fwlen + dhd_bus->nvram_len + nvram_words_pad;
+       dhd_bus->image = MALLOC(dhd_bus->pub.osh, total_len);
+       dhd_bus->image_len = total_len;
+       if (dhd_bus->image == NULL) {
+               DBUSERR(("%s: malloc failed!\n", __FUNCTION__));
+               goto err;
+       }
+
+       /* Step1: Copy trx header + firmwre */
+       memptr = fw_memblock;
+       do {
+               if (len < 0) {
+                       DBUSERR(("%s: dhd_os_get_image_block failed (%d)\n", __FUNCTION__, len));
+                       bcmerror = BCME_ERROR;
+                       goto err;
+               }
+               bcopy(memptr, dhd_bus->image+offset, len);
+               offset += len;
+       } while ((len = dhd_os_get_image_block((char*)memptr, memblock_size, fw_image)));
+       /* Step2: Copy NVRAM + pad */
+       hdr = (struct trx_header *)dhd_bus->image;
+       img_offset = SIZEOF_TRX(hdr) + hdr->offsets[TRX_OFFSETS_DLFWLEN_IDX];
+       bcopy(nv_memblock, (uint8 *)(dhd_bus->image + img_offset),
+               dhd_bus->nvram_len);
+       img_offset += dhd_bus->nvram_len;
+       if (nvram_words_pad) {
+               bzero(&dhd_bus->image[img_offset], nvram_words_pad);
+               img_offset += nvram_words_pad;
+       }
+#ifdef BCMTRXV2
+       /* Step3: Copy DSG/CFG for V2 */
+       if (ISTRX_V2(hdr) &&
+               (hdr->offsets[TRX_OFFSETS_DSG_LEN_IDX] ||
+               hdr->offsets[TRX_OFFSETS_CFG_LEN_IDX])) {
+               DBUSERR(("%s: fix me\n", __FUNCTION__));
+       }
+#endif /* BCMTRXV2 */
+       /* Step4: update TRX header for nvram size */
+       hdr = (struct trx_header *)dhd_bus->image;
+       hdr->len = htol32(total_len);
+       /* Pass the actual fw len */
+       hdr->offsets[TRX_OFFSETS_NVM_LEN_IDX] =
+               htol32(dhd_bus->nvram_len + nvram_words_pad);
+       /* Calculate CRC over header */
+       hdr->crc32 = hndcrc32((uint8 *)&hdr->flag_version,
+               SIZEOF_TRX(hdr) - OFFSETOF(struct trx_header, flag_version),
+               CRC32_INIT_VALUE);
+
+       /* Calculate CRC over data */
+       for (i = SIZEOF_TRX(hdr); i < total_len; ++i)
+                       hdr->crc32 = hndcrc32((uint8 *)&dhd_bus->image[i], 1, hdr->crc32);
+       hdr->crc32 = htol32(hdr->crc32);
+
+       bcmerror = DBUS_OK;
+
+err:
+       if (fw_memblock)
+               MFREE(dhd_bus->pub.osh, fw_memblock, MAX_NVRAMBUF_SIZE);
+       if (fw_image)
+               dhd_os_close_image1(dhd_bus->dhd, fw_image);
+       if (nv_memblock)
+               MFREE(dhd_bus->pub.osh, nv_memblock, MAX_NVRAMBUF_SIZE);
+       if (nv_image)
+               dhd_os_close_image1(dhd_bus->dhd, nv_image);
+
+       return bcmerror;
+}
+
+/**
+ * during driver initialization ('attach') or after PnP 'resume', firmware needs to be loaded into
+ * the dongle
+ */
+static int
+dbus_do_download(dhd_bus_t *dhd_bus, char *pfw_path, char *pnv_path)
+{
+       int err = DBUS_OK;
+
+       err = dbus_get_fw_nvram(dhd_bus, pfw_path, pnv_path);
+       if (err) {
+               DBUSERR(("dbus_do_download: fail to get nvram %d\n", err));
+               return err;
+       }
+
+       if (dhd_bus->drvintf->dlstart && dhd_bus->drvintf->dlrun) {
+               err = dhd_bus->drvintf->dlstart(dhd_bus->bus_info,
+                       dhd_bus->image, dhd_bus->image_len);
+               if (err == DBUS_OK) {
+                       err = dhd_bus->drvintf->dlrun(dhd_bus->bus_info);
+               }
+       } else
+               err = DBUS_ERR;
+
+       if (dhd_bus->image) {
+               MFREE(dhd_bus->pub.osh, dhd_bus->image, dhd_bus->image_len);
+               dhd_bus->image = NULL;
+               dhd_bus->image_len = 0;
+       }
+
+       return err;
+} /* dbus_do_download */
+#else
+
+/**
+ * It is easy for the user to pass one jumbo nvram file to the driver than a set of smaller files.
+ * The 'jumbo nvram' file format is essentially a set of nvram files. Before commencing firmware
+ * download, the dongle needs to be probed so that the correct nvram contents within the jumbo nvram
+ * file is selected.
+ */
+static int
+dbus_jumbo_nvram(dhd_bus_t *dhd_bus)
+{
+       int8 *nvram = NULL;
+       int nvram_len = 0;
+       int ret = DBUS_OK;
+       uint16 boardrev = 0xFFFF;
+       uint16 boardtype = 0xFFFF;
+
+       /* read the otp for boardrev & boardtype
+       * if boardtype/rev are present in otp
+       * select nvram data for that boardtype/rev
+       */
+       dbus_otp(dhd_bus, &boardtype, &boardrev);
+
+       ret = dbus_select_nvram(dhd_bus, dhd_bus->extdl.vars, dhd_bus->extdl.varslen,
+               boardtype, boardrev, &nvram, &nvram_len);
+
+       if (ret == DBUS_JUMBO_BAD_FORMAT)
+                       return DBUS_ERR_NVRAM;
+       else if (ret == DBUS_JUMBO_NOMATCH &&
+               (boardtype != 0xFFFF || boardrev  != 0xFFFF)) {
+                       DBUSERR(("No matching NVRAM for boardtype 0x%02x boardrev 0x%02x\n",
+                               boardtype, boardrev));
+                       return DBUS_ERR_NVRAM;
+       }
+       dhd_bus->nvram = nvram;
+       dhd_bus->nvram_len =  nvram_len;
+
+       return DBUS_OK;
+}
+
+/** before commencing fw download, the correct NVRAM image to download has to be picked */
+static int
+dbus_get_nvram(dhd_bus_t *dhd_bus)
+{
+       int len, i;
+       struct trx_header *hdr;
+       int     actual_fwlen;
+       uint32 img_offset = 0;
+
+       dhd_bus->nvram_len = 0;
+       if (dhd_bus->extdl.varslen) {
+               if (DBUS_OK != dbus_jumbo_nvram(dhd_bus))
+                       return DBUS_ERR_NVRAM;
+               DBUSERR(("NVRAM %d bytes downloaded\n", dhd_bus->nvram_len));
+       }
+#if defined(BCM_REQUEST_FW)
+       else if (nonfwnvram) {
+               dhd_bus->nvram = nonfwnvram;
+               dhd_bus->nvram_len = nonfwnvramlen;
+               DBUSERR(("NVRAM %d bytes downloaded\n", dhd_bus->nvram_len));
+       }
+#endif
+       if (dhd_bus->nvram) {
+               uint8 nvram_words_pad = 0;
+               /* Validate the format/length etc of the file */
+               if ((actual_fwlen = check_file(dhd_bus->pub.osh, dhd_bus->fw)) <= 0) {
+                       DBUSERR(("%s: bad firmware format!\n", __FUNCTION__));
+                       return DBUS_ERR_NVRAM;
+               }
+
+               if (!dhd_bus->nvram_nontxt) {
+                       /* host supplied nvram could be in .txt format
+                       * with all the comments etc...
+                       */
+                       dhd_bus->nvram_len = process_nvram_vars(dhd_bus->nvram,
+                               dhd_bus->nvram_len);
+               }
+               if (dhd_bus->nvram_len % 4)
+                       nvram_words_pad = 4 - dhd_bus->nvram_len % 4;
+
+               len = actual_fwlen + dhd_bus->nvram_len + nvram_words_pad;
+               dhd_bus->image = MALLOC(dhd_bus->pub.osh, len);
+               dhd_bus->image_len = len;
+               if (dhd_bus->image == NULL) {
+                       DBUSERR(("%s: malloc failed!\n", __FUNCTION__));
+                       return DBUS_ERR_NVRAM;
+               }
+               hdr = (struct trx_header *)dhd_bus->fw;
+               /* Step1: Copy trx header + firmwre */
+               img_offset = SIZEOF_TRX(hdr) + hdr->offsets[TRX_OFFSETS_DLFWLEN_IDX];
+               bcopy(dhd_bus->fw, dhd_bus->image, img_offset);
+               /* Step2: Copy NVRAM + pad */
+               bcopy(dhd_bus->nvram, (uint8 *)(dhd_bus->image + img_offset),
+                       dhd_bus->nvram_len);
+               img_offset += dhd_bus->nvram_len;
+               if (nvram_words_pad) {
+                       bzero(&dhd_bus->image[img_offset],
+                               nvram_words_pad);
+                       img_offset += nvram_words_pad;
+               }
+#ifdef BCMTRXV2
+               /* Step3: Copy DSG/CFG for V2 */
+               if (ISTRX_V2(hdr) &&
+                       (hdr->offsets[TRX_OFFSETS_DSG_LEN_IDX] ||
+                       hdr->offsets[TRX_OFFSETS_CFG_LEN_IDX])) {
+
+                       bcopy(dhd_bus->fw + SIZEOF_TRX(hdr) +
+                               hdr->offsets[TRX_OFFSETS_DLFWLEN_IDX] +
+                               hdr->offsets[TRX_OFFSETS_NVM_LEN_IDX],
+                               dhd_bus->image + img_offset,
+                               hdr->offsets[TRX_OFFSETS_DSG_LEN_IDX] +
+                               hdr->offsets[TRX_OFFSETS_CFG_LEN_IDX]);
+
+                       img_offset += hdr->offsets[TRX_OFFSETS_DSG_LEN_IDX] +
+                               hdr->offsets[TRX_OFFSETS_CFG_LEN_IDX];
+               }
+#endif /* BCMTRXV2 */
+               /* Step4: update TRX header for nvram size */
+               hdr = (struct trx_header *)dhd_bus->image;
+               hdr->len = htol32(len);
+               /* Pass the actual fw len */
+               hdr->offsets[TRX_OFFSETS_NVM_LEN_IDX] =
+                       htol32(dhd_bus->nvram_len + nvram_words_pad);
+               /* Calculate CRC over header */
+               hdr->crc32 = hndcrc32((uint8 *)&hdr->flag_version,
+                       SIZEOF_TRX(hdr) - OFFSETOF(struct trx_header, flag_version),
+                       CRC32_INIT_VALUE);
+
+               /* Calculate CRC over data */
+               for (i = SIZEOF_TRX(hdr); i < len; ++i)
+                               hdr->crc32 = hndcrc32((uint8 *)&dhd_bus->image[i], 1, hdr->crc32);
+               hdr->crc32 = htol32(hdr->crc32);
+       } else {
+               dhd_bus->image = dhd_bus->fw;
+               dhd_bus->image_len = (uint32)dhd_bus->fwlen;
+       }
+
+       return DBUS_OK;
+} /* dbus_get_nvram */
+
+/**
+ * during driver initialization ('attach') or after PnP 'resume', firmware needs to be loaded into
+ * the dongle
+ */
+static int
+dbus_do_download(dhd_bus_t *dhd_bus)
+{
+       int err = DBUS_OK;
+#ifndef BCM_REQUEST_FW
+       int decomp_override = 0;
+#endif
+#ifdef BCM_REQUEST_FW
+       uint16 boardrev = 0xFFFF, boardtype = 0xFFFF;
+       int8 *temp_nvram;
+       int temp_len;
+#endif
+
+#if defined(BCM_REQUEST_FW)
+       dhd_bus->firmware = dbus_get_fw_nvfile(dhd_bus->pub.attrib.devid,
+               dhd_bus->pub.attrib.chiprev, &dhd_bus->fw, &dhd_bus->fwlen,
+               DBUS_FIRMWARE, 0, 0);
+       if (!dhd_bus->firmware)
+               return DBUS_ERR;
+#endif 
+
+       dhd_bus->image = dhd_bus->fw;
+       dhd_bus->image_len = (uint32)dhd_bus->fwlen;
+
+#ifndef BCM_REQUEST_FW
+       if (UNZIP_ENAB(dhd_bus) && !decomp_override) {
+               err = dbus_zlib_decomp(dhd_bus);
+               if (err) {
+                       DBUSERR(("dbus_attach: fw decompress fail %d\n", err));
+                       return err;
+               }
+       }
+#endif
+
+#if defined(BCM_REQUEST_FW)
+       /* check if firmware is appended with nvram file */
+       err = dbus_otp(dhd_bus, &boardtype, &boardrev);
+       /* check if nvram is provided as separte file */
+       nonfwnvram = NULL;
+       nonfwnvramlen = 0;
+       dhd_bus->nvfile = dbus_get_fw_nvfile(dhd_bus->pub.attrib.devid,
+               dhd_bus->pub.attrib.chiprev, (void *)&temp_nvram, &temp_len,
+               DBUS_NVFILE, boardtype, boardrev);
+       if (dhd_bus->nvfile) {
+               int8 *tmp = MALLOC(dhd_bus->pub.osh, temp_len);
+               if (tmp) {
+                       bcopy(temp_nvram, tmp, temp_len);
+                       nonfwnvram = tmp;
+                       nonfwnvramlen = temp_len;
+               } else {
+                       err = DBUS_ERR;
+                       goto fail;
+               }
+       }
+#endif /* defined(BCM_REQUEST_FW) */
+
+       err = dbus_get_nvram(dhd_bus);
+       if (err) {
+               DBUSERR(("dbus_do_download: fail to get nvram %d\n", err));
+               return err;
+       }
+
+
+       if (dhd_bus->drvintf->dlstart && dhd_bus->drvintf->dlrun) {
+               err = dhd_bus->drvintf->dlstart(dhd_bus->bus_info,
+                       dhd_bus->image, dhd_bus->image_len);
+
+               if (err == DBUS_OK)
+                       err = dhd_bus->drvintf->dlrun(dhd_bus->bus_info);
+       } else
+               err = DBUS_ERR;
+
+       if (dhd_bus->nvram) {
+               MFREE(dhd_bus->pub.osh, dhd_bus->image, dhd_bus->image_len);
+               dhd_bus->image = dhd_bus->fw;
+               dhd_bus->image_len = (uint32)dhd_bus->fwlen;
+       }
+
+#ifndef BCM_REQUEST_FW
+       if (UNZIP_ENAB(dhd_bus) && (!decomp_override) && dhd_bus->orig_fw) {
+               MFREE(dhd_bus->pub.osh, dhd_bus->fw, dhd_bus->decomp_memsize);
+               dhd_bus->image = dhd_bus->fw = dhd_bus->orig_fw;
+               dhd_bus->image_len = dhd_bus->fwlen = dhd_bus->origfw_len;
+       }
+#endif
+
+#if defined(BCM_REQUEST_FW)
+fail:
+       if (dhd_bus->firmware) {
+               dbus_release_fw_nvfile(dhd_bus->firmware);
+               dhd_bus->firmware = NULL;
+       }
+       if (dhd_bus->nvfile) {
+               dbus_release_fw_nvfile(dhd_bus->nvfile);
+               dhd_bus->nvfile = NULL;
+       }
+       if (nonfwnvram) {
+               MFREE(dhd_bus->pub.osh, nonfwnvram, nonfwnvramlen);
+               nonfwnvram = NULL;
+               nonfwnvramlen = 0;
+       }
+#endif
+       return err;
+} /* dbus_do_download */
+#endif /* EXTERNAL_FW_PATH */
+#endif
+
+/** required for DBUS deregistration */
+static void
+dbus_disconnect(void *handle)
+{
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (disconnect_cb)
+               disconnect_cb(disc_arg);
+}
+
+/**
+ * This function is called when the sent irb times out without a tx response status.
+ * DBUS adds reliability by resending timed out IRBs DBUS_TX_RETRY_LIMIT times.
+ */
+static void
+dbus_if_send_irb_timeout(void *handle, dbus_irb_tx_t *txirb)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) handle;
+
+       if ((dhd_bus == NULL) || (dhd_bus->drvintf == NULL) || (txirb == NULL)) {
+               return;
+       }
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       return;
+
+} /* dbus_if_send_irb_timeout */
+
+/**
+ * When lower DBUS level signals that a send IRB completed, either successful or not, the higher
+ * level (e.g. dhd_linux.c) has to be notified, and transmit flow control has to be evaluated.
+ */
+static void BCMFASTPATH
+dbus_if_send_irb_complete(void *handle, dbus_irb_tx_t *txirb, int status)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) handle;
+       int txirb_pending;
+       struct exec_parms args;
+       void *pktinfo;
+
+       if ((dhd_bus == NULL) || (txirb == NULL)) {
+               return;
+       }
+
+       DBUSTRACE(("%s: status = %d\n", __FUNCTION__, status));
+
+       dbus_tx_timer_stop(dhd_bus);
+
+       /* re-queue BEFORE calling send_complete which will assume that this irb
+          is now available.
+        */
+       pktinfo = txirb->info;
+       bzero(txirb, sizeof(dbus_irb_tx_t));
+       args.qenq.q = dhd_bus->tx_q;
+       args.qenq.b = (dbus_irb_t *) txirb;
+       EXEC_TXLOCK(dhd_bus, q_enq_exec, &args);
+
+       if (dhd_bus->pub.busstate != DBUS_STATE_DOWN) {
+               if ((status == DBUS_OK) || (status == DBUS_ERR_NODEVICE)) {
+                       if (dhd_bus->cbs && dhd_bus->cbs->send_complete)
+                               dhd_bus->cbs->send_complete(dhd_bus->cbarg, pktinfo,
+                                       status);
+
+                       if (status == DBUS_OK) {
+                               txirb_pending = dhd_bus->pub.ntxq - dhd_bus->tx_q->cnt;
+                               if (txirb_pending)
+                                       dbus_tx_timer_start(dhd_bus, DBUS_TX_TIMEOUT_INTERVAL);
+                               if ((txirb_pending < dhd_bus->tx_low_watermark) &&
+                                       dhd_bus->txoff && !dhd_bus->txoverride) {
+                                       dbus_flowctrl_tx(dhd_bus, OFF);
+                               }
+                       }
+               } else {
+                       DBUSERR(("%s: %d WARNING freeing orphan pkt %p\n", __FUNCTION__, __LINE__,
+                               pktinfo));
+#if defined(BCM_RPC_NOCOPY) || defined(BCM_RPC_TXNOCOPY) || defined(BCM_RPC_TOC)
+                       if (pktinfo)
+                               if (dhd_bus->cbs && dhd_bus->cbs->send_complete)
+                                       dhd_bus->cbs->send_complete(dhd_bus->cbarg, pktinfo,
+                                               status);
+#else
+                       dbus_if_pktfree(dhd_bus, (void*)pktinfo, TRUE);
+#endif /* defined(BCM_RPC_NOCOPY) || defined(BCM_RPC_TXNOCOPY) || defined(BCM_RPC_TOC) */
+               }
+       } else {
+               DBUSERR(("%s: %d WARNING freeing orphan pkt %p\n", __FUNCTION__, __LINE__,
+                       pktinfo));
+#if defined(BCM_RPC_NOCOPY) || defined(BCM_RPC_TXNOCOPY) || defined(BCM_RPC_TOC)
+               if (pktinfo)
+                       if (dhd_bus->cbs && dhd_bus->cbs->send_complete)
+                               dhd_bus->cbs->send_complete(dhd_bus->cbarg, pktinfo,
+                                       status);
+#else
+               dbus_if_pktfree(dhd_bus, (void*)pktinfo, TRUE);
+#endif /* defined(BCM_RPC_NOCOPY) || defined(BCM_RPC_TXNOCOPY) defined(BCM_RPC_TOC) */
+       }
+} /* dbus_if_send_irb_complete */
+
+/**
+ * When lower DBUS level signals that a receive IRB completed, either successful or not, the higher
+ * level (e.g. dhd_linux.c) has to be notified, and fresh free receive IRBs may have to be given
+ * to lower levels.
+ */
+static void BCMFASTPATH
+dbus_if_recv_irb_complete(void *handle, dbus_irb_rx_t *rxirb, int status)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) handle;
+       int rxirb_pending;
+       struct exec_parms args;
+
+       if ((dhd_bus == NULL) || (rxirb == NULL)) {
+               return;
+       }
+       DBUSTRACE(("%s\n", __FUNCTION__));
+       if (dhd_bus->pub.busstate != DBUS_STATE_DOWN &&
+               dhd_bus->pub.busstate != DBUS_STATE_SLEEP) {
+               if (status == DBUS_OK) {
+                       if ((rxirb->buf != NULL) && (rxirb->actual_len > 0)) {
+#ifdef DBUS_USB_LOOPBACK
+                               if (is_loopback_pkt(rxirb->buf)) {
+                                       matches_loopback_pkt(rxirb->buf);
+                               } else
+#endif
+                               if (dhd_bus->cbs && dhd_bus->cbs->recv_buf) {
+                                       dhd_bus->cbs->recv_buf(dhd_bus->cbarg, rxirb->buf,
+                                       rxirb->actual_len);
+                               }
+                       } else if (rxirb->pkt != NULL) {
+                               if (dhd_bus->cbs && dhd_bus->cbs->recv_pkt)
+                                       dhd_bus->cbs->recv_pkt(dhd_bus->cbarg, rxirb->pkt);
+                       } else {
+                               ASSERT(0); /* Should not happen */
+                       }
+
+                       rxirb_pending = dhd_bus->pub.nrxq - dhd_bus->rx_q->cnt - 1;
+                       if ((rxirb_pending <= dhd_bus->rx_low_watermark) &&
+                               !dhd_bus->rxoff) {
+                               DBUSTRACE(("Low watermark so submit more %d <= %d \n",
+                                       dhd_bus->rx_low_watermark, rxirb_pending));
+                               dbus_rxirbs_fill(dhd_bus);
+                       } else if (dhd_bus->rxoff)
+                               DBUSTRACE(("rx flow controlled. not filling more. cut_rxq=%d\n",
+                                       dhd_bus->rx_q->cnt));
+               } else if (status == DBUS_ERR_NODEVICE) {
+                       DBUSERR(("%s: %d status = %d, buf %p\n", __FUNCTION__, __LINE__, status,
+                               rxirb->buf));
+#if defined(BCM_RPC_NOCOPY) || defined(BCM_RPC_RXNOCOPY)
+                       if (rxirb->buf) {
+                               PKTFRMNATIVE(dhd_bus->pub.osh, rxirb->buf);
+                               PKTFREE(dhd_bus->pub.osh, rxirb->buf, FALSE);
+                       }
+#endif /* BCM_RPC_NOCOPY || BCM_RPC_TXNOCOPY || BCM_RPC_TOC */
+               } else {
+                       if (status != DBUS_ERR_RXZLP)
+                               DBUSERR(("%s: %d status = %d, buf %p\n", __FUNCTION__, __LINE__,
+                                       status, rxirb->buf));
+#if defined(BCM_RPC_NOCOPY) || defined(BCM_RPC_RXNOCOPY)
+                       if (rxirb->buf) {
+                               PKTFRMNATIVE(dhd_bus->pub.osh, rxirb->buf);
+                               PKTFREE(dhd_bus->pub.osh, rxirb->buf, FALSE);
+                       }
+#endif /* BCM_RPC_NOCOPY || BCM_RPC_TXNOCOPY || BCM_RPC_TOC */
+               }
+       } else {
+               DBUSTRACE(("%s: DBUS down, ignoring recv callback. buf %p\n", __FUNCTION__,
+                       rxirb->buf));
+#if defined(BCM_RPC_NOCOPY) || defined(BCM_RPC_RXNOCOPY)
+               if (rxirb->buf) {
+                       PKTFRMNATIVE(dhd_bus->pub.osh, rxirb->buf);
+                       PKTFREE(dhd_bus->pub.osh, rxirb->buf, FALSE);
+               }
+#endif /* BCM_RPC_NOCOPY || BCM_RPC_TXNOCOPY || BCM_RPC_TOC */
+       }
+       if (dhd_bus->rx_q != NULL) {
+               bzero(rxirb, sizeof(dbus_irb_rx_t));
+               args.qenq.q = dhd_bus->rx_q;
+               args.qenq.b = (dbus_irb_t *) rxirb;
+               EXEC_RXLOCK(dhd_bus, q_enq_exec, &args);
+       } else
+               MFREE(dhd_bus->pub.osh, rxirb, sizeof(dbus_irb_tx_t));
+} /* dbus_if_recv_irb_complete */
+
+/**
+ *  Accumulate errors signaled by lower DBUS levels and signal them to higher (e.g. dhd_linux.c)
+ *  level.
+ */
+static void
+dbus_if_errhandler(void *handle, int err)
+{
+       dhd_bus_t *dhd_bus = handle;
+       uint32 mask = 0;
+
+       if (dhd_bus == NULL)
+               return;
+
+       switch (err) {
+               case DBUS_ERR_TXFAIL:
+                       dhd_bus->pub.stats.tx_errors++;
+                       mask |= ERR_CBMASK_TXFAIL;
+                       break;
+               case DBUS_ERR_TXDROP:
+                       dhd_bus->pub.stats.tx_dropped++;
+                       mask |= ERR_CBMASK_TXFAIL;
+                       break;
+               case DBUS_ERR_RXFAIL:
+                       dhd_bus->pub.stats.rx_errors++;
+                       mask |= ERR_CBMASK_RXFAIL;
+                       break;
+               case DBUS_ERR_RXDROP:
+                       dhd_bus->pub.stats.rx_dropped++;
+                       mask |= ERR_CBMASK_RXFAIL;
+                       break;
+               default:
+                       break;
+       }
+
+       if (dhd_bus->cbs && dhd_bus->cbs->errhandler && (dhd_bus->errmask & mask))
+               dhd_bus->cbs->errhandler(dhd_bus->cbarg, err);
+}
+
+/**
+ * When lower DBUS level signals control IRB completed, higher level (e.g. dhd_linux.c) has to be
+ * notified.
+ */
+static void
+dbus_if_ctl_complete(void *handle, int type, int status)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) handle;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (dhd_bus == NULL) {
+               DBUSERR(("%s: dhd_bus is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (dhd_bus->pub.busstate != DBUS_STATE_DOWN) {
+               if (dhd_bus->cbs && dhd_bus->cbs->ctl_complete)
+                       dhd_bus->cbs->ctl_complete(dhd_bus->cbarg, type, status);
+       }
+}
+
+/**
+ * Rx related functionality (flow control, posting of free IRBs to rx queue) is dependent upon the
+ * bus state. When lower DBUS level signals a change in the interface state, take appropriate action
+ * and forward the signaling to the higher (e.g. dhd_linux.c) level.
+ */
+static void
+dbus_if_state_change(void *handle, int state)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) handle;
+       int old_state;
+
+       if (dhd_bus == NULL)
+               return;
+
+       if (dhd_bus->pub.busstate == state)
+               return;
+       old_state = dhd_bus->pub.busstate;
+       if (state == DBUS_STATE_DISCONNECT) {
+               DBUSERR(("DBUS disconnected\n"));
+       }
+
+       /* Ignore USB SUSPEND while not up yet */
+       if (state == DBUS_STATE_SLEEP && old_state != DBUS_STATE_UP)
+               return;
+
+       DBUSTRACE(("dbus state change from %d to to %d\n", old_state, state));
+
+       /* Don't update state if it's PnP firmware re-download */
+       if (state != DBUS_STATE_PNP_FWDL)
+               dhd_bus->pub.busstate = state;
+       else
+               dbus_flowctrl_rx(handle, FALSE);
+       if (state == DBUS_STATE_SLEEP)
+               dbus_flowctrl_rx(handle, TRUE);
+       if (state == DBUS_STATE_UP) {
+               dbus_rxirbs_fill(dhd_bus);
+               dbus_flowctrl_rx(handle, FALSE);
+       }
+
+       if (dhd_bus->cbs && dhd_bus->cbs->state_change)
+               dhd_bus->cbs->state_change(dhd_bus->cbarg, state);
+}
+
+/** Forward request for packet from lower DBUS layer to higher layer (e.g. dhd_linux.c) */
+static void *
+dbus_if_pktget(void *handle, uint len, bool send)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) handle;
+       void *p = NULL;
+
+       if (dhd_bus == NULL)
+               return NULL;
+
+       if (dhd_bus->cbs && dhd_bus->cbs->pktget)
+               p = dhd_bus->cbs->pktget(dhd_bus->cbarg, len, send);
+       else
+               ASSERT(0);
+
+       return p;
+}
+
+/** Forward request to free packet from lower DBUS layer to higher layer (e.g. dhd_linux.c) */
+static void
+dbus_if_pktfree(void *handle, void *p, bool send)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) handle;
+
+       if (dhd_bus == NULL)
+               return;
+
+       if (dhd_bus->cbs && dhd_bus->cbs->pktfree)
+               dhd_bus->cbs->pktfree(dhd_bus->cbarg, p, send);
+       else
+               ASSERT(0);
+}
+
+/** Lower DBUS level requests either a send or receive IRB */
+static struct dbus_irb*
+dbus_if_getirb(void *cbarg, bool send)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) cbarg;
+       struct exec_parms args;
+       struct dbus_irb *irb;
+
+       if ((dhd_bus == NULL) || (dhd_bus->pub.busstate != DBUS_STATE_UP))
+               return NULL;
+
+       if (send == TRUE) {
+               args.qdeq.q = dhd_bus->tx_q;
+               irb = EXEC_TXLOCK(dhd_bus, q_deq_exec, &args);
+       } else {
+               args.qdeq.q = dhd_bus->rx_q;
+               irb = EXEC_RXLOCK(dhd_bus, q_deq_exec, &args);
+       }
+
+       return irb;
+}
+
+/**
+ * Called as part of DBUS bus registration. Calls back into higher level (e.g. dhd_linux.c) probe
+ * function.
+ */
+static void *
+dbus_probe(void *arg, const char *desc, uint32 bustype, uint16 bus_no,
+       uint16 slot, uint32 hdrlen)
+{
+       DBUSTRACE(("%s\n", __FUNCTION__));
+       if (probe_cb) {
+               disc_arg = probe_cb(probe_arg, desc, bustype, bus_no, slot, hdrlen);
+               return disc_arg;
+       }
+
+       return (void *)DBUS_ERR;
+}
+
+/**
+ * As part of initialization, higher level (e.g. dhd_linux.c) requests DBUS to prepare for
+ * action.
+ */
+int
+dhd_bus_register(void)
+{
+       int err;
+
+       DBUSTRACE(("%s: Enter\n", __FUNCTION__));
+
+       probe_cb = dhd_dbus_probe_cb;
+       disconnect_cb = dhd_dbus_disconnect_cb;
+       probe_arg = NULL;
+
+       err = dbus_bus_register(0xa5c, 0x48f, dbus_probe, /* call lower DBUS level register function */
+               dbus_disconnect, NULL, &g_busintf, NULL, NULL);
+
+       /* Device not detected */
+       if (err == DBUS_ERR_NODEVICE)
+               err = DBUS_OK;
+
+       return err;
+}
+
+dhd_pub_t *g_pub = NULL;
+void
+dhd_bus_unregister(void)
+{
+       int ret;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       DHD_MUTEX_LOCK();
+       if (g_pub) {
+               g_pub->dhd_remove = TRUE;
+               if (!g_pub->bus) {
+                       dhd_dbus_disconnect_cb(g_pub->bus);
+               }
+       }
+       probe_cb = NULL;
+       DHD_MUTEX_UNLOCK();
+       ret = dbus_bus_deregister();
+       disconnect_cb = NULL;
+       probe_arg = NULL;
+}
+
+/** As part of initialization, data structures have to be allocated and initialized */
+dhd_bus_t *
+dbus_attach(osl_t *osh, int rxsize, int nrxq, int ntxq, dhd_pub_t *pub,
+       dbus_callbacks_t *cbs, dbus_extdl_t *extdl, struct shared_info *sh)
+{
+       dhd_bus_t *dhd_bus;
+       int err;
+
+       if ((g_busintf == NULL) || (g_busintf->attach == NULL) || (cbs == NULL))
+               return NULL;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if ((nrxq <= 0) || (ntxq <= 0))
+               return NULL;
+
+       dhd_bus = MALLOC(osh, sizeof(dhd_bus_t));
+       if (dhd_bus == NULL) {
+               DBUSERR(("%s: malloc failed %zu\n", __FUNCTION__, sizeof(dhd_bus_t)));
+               return NULL;
+       }
+
+       bzero(dhd_bus, sizeof(dhd_bus_t));
+
+       /* BUS-specific driver interface (at a lower DBUS level) */
+       dhd_bus->drvintf = g_busintf;
+       dhd_bus->cbarg = pub;
+       dhd_bus->cbs = cbs;
+
+       dhd_bus->pub.sh = sh;
+       dhd_bus->pub.osh = osh;
+       dhd_bus->pub.rxsize = rxsize;
+
+       dhd_bus->pub.nrxq = nrxq;
+       dhd_bus->rx_low_watermark = nrxq / 2;   /* keep enough posted rx urbs */
+       dhd_bus->pub.ntxq = ntxq;
+       dhd_bus->tx_low_watermark = ntxq / 4;   /* flow control when too many tx urbs posted */
+
+       dhd_bus->tx_q = MALLOC(osh, sizeof(dbus_irbq_t));
+       if (dhd_bus->tx_q == NULL)
+               goto error;
+       else {
+               bzero(dhd_bus->tx_q, sizeof(dbus_irbq_t));
+               err = dbus_irbq_init(dhd_bus, dhd_bus->tx_q, ntxq, sizeof(dbus_irb_tx_t));
+               if (err != DBUS_OK)
+                       goto error;
+       }
+
+       dhd_bus->rx_q = MALLOC(osh, sizeof(dbus_irbq_t));
+       if (dhd_bus->rx_q == NULL)
+               goto error;
+       else {
+               bzero(dhd_bus->rx_q, sizeof(dbus_irbq_t));
+               err = dbus_irbq_init(dhd_bus, dhd_bus->rx_q, nrxq, sizeof(dbus_irb_rx_t));
+               if (err != DBUS_OK)
+                       goto error;
+       }
+
+
+       dhd_bus->bus_info = (void *)g_busintf->attach(&dhd_bus->pub,
+               dhd_bus, &dbus_intf_cbs);
+       if (dhd_bus->bus_info == NULL)
+               goto error;
+
+       dbus_tx_timer_init(dhd_bus);
+
+#if defined(BCM_REQUEST_FW)
+       /* Need to copy external image for re-download */
+       if (extdl && extdl->fw && (extdl->fwlen > 0)) {
+               dhd_bus->extdl.fw = MALLOC(osh, extdl->fwlen);
+               if (dhd_bus->extdl.fw) {
+                       bcopy(extdl->fw, dhd_bus->extdl.fw, extdl->fwlen);
+                       dhd_bus->extdl.fwlen = extdl->fwlen;
+               }
+       }
+
+       if (extdl && extdl->vars && (extdl->varslen > 0)) {
+               dhd_bus->extdl.vars = MALLOC(osh, extdl->varslen);
+               if (dhd_bus->extdl.vars) {
+                       bcopy(extdl->vars, dhd_bus->extdl.vars, extdl->varslen);
+                       dhd_bus->extdl.varslen = extdl->varslen;
+               }
+       }
+#endif 
+
+       return (dhd_bus_t *)dhd_bus;
+
+error:
+       DBUSERR(("%s: Failed\n", __FUNCTION__));
+       dbus_detach(dhd_bus);
+       return NULL;
+} /* dbus_attach */
+
+void
+dbus_detach(dhd_bus_t *pub)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+       osl_t *osh;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (dhd_bus == NULL)
+               return;
+
+       dbus_tx_timer_stop(dhd_bus);
+
+       osh = pub->pub.osh;
+
+       if (dhd_bus->drvintf && dhd_bus->drvintf->detach)
+                dhd_bus->drvintf->detach((dbus_pub_t *)dhd_bus, dhd_bus->bus_info);
+
+       if (dhd_bus->tx_q) {
+               dbus_irbq_deinit(dhd_bus, dhd_bus->tx_q, sizeof(dbus_irb_tx_t));
+               MFREE(osh, dhd_bus->tx_q, sizeof(dbus_irbq_t));
+               dhd_bus->tx_q = NULL;
+       }
+
+       if (dhd_bus->rx_q) {
+               dbus_irbq_deinit(dhd_bus, dhd_bus->rx_q, sizeof(dbus_irb_rx_t));
+               MFREE(osh, dhd_bus->rx_q, sizeof(dbus_irbq_t));
+               dhd_bus->rx_q = NULL;
+       }
+
+
+       if (dhd_bus->extdl.fw && (dhd_bus->extdl.fwlen > 0)) {
+               MFREE(osh, dhd_bus->extdl.fw, dhd_bus->extdl.fwlen);
+               dhd_bus->extdl.fw = NULL;
+               dhd_bus->extdl.fwlen = 0;
+       }
+
+       if (dhd_bus->extdl.vars && (dhd_bus->extdl.varslen > 0)) {
+               MFREE(osh, dhd_bus->extdl.vars, dhd_bus->extdl.varslen);
+               dhd_bus->extdl.vars = NULL;
+               dhd_bus->extdl.varslen = 0;
+       }
+
+       MFREE(osh, dhd_bus, sizeof(dhd_bus_t));
+} /* dbus_detach */
+
+int dbus_dlneeded(dhd_bus_t *pub)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+       int dlneeded = DBUS_ERR;
+
+       if (!dhd_bus) {
+               DBUSERR(("%s: dhd_bus is NULL\n", __FUNCTION__));
+               return DBUS_ERR;
+       }
+
+       DBUSTRACE(("%s: state %d\n", __FUNCTION__, dhd_bus->pub.busstate));
+
+       if (dhd_bus->drvintf->dlneeded) {
+               dlneeded = dhd_bus->drvintf->dlneeded(dhd_bus->bus_info);
+       }
+       printf("%s: dlneeded=%d\n", __FUNCTION__, dlneeded);
+
+       /* dlneeded > 0: need to download
+         * dlneeded = 0: downloaded
+         * dlneeded < 0: bus error*/
+       return dlneeded;
+}
+
+#if defined(BCM_REQUEST_FW)
+int dbus_download_firmware(dhd_bus_t *pub, char *pfw_path, char *pnv_path)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+       int err = DBUS_OK;
+
+       if (!dhd_bus) {
+               DBUSERR(("%s: dhd_bus is NULL\n", __FUNCTION__));
+               return DBUS_ERR;
+       }
+
+       DBUSTRACE(("%s: state %d\n", __FUNCTION__, dhd_bus->pub.busstate));
+
+       dhd_bus->pub.busstate = DBUS_STATE_DL_PENDING;
+#ifdef EXTERNAL_FW_PATH
+       err = dbus_do_download(dhd_bus, pfw_path, pnv_path);
+#else
+       err = dbus_do_download(dhd_bus);
+#endif /* EXTERNAL_FW_PATH */
+       if (err == DBUS_OK) {
+               dhd_bus->pub.busstate = DBUS_STATE_DL_DONE;
+       } else {
+               DBUSERR(("%s: download failed (%d)\n", __FUNCTION__, err));
+       }
+
+       return err;
+}
+#endif 
+
+/**
+ * higher layer requests us to 'up' the interface to the dongle. Prerequisite is that firmware (not
+ * bootloader) must be active in the dongle.
+ */
+int
+dbus_up(struct dhd_bus *pub)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+       int err = DBUS_OK;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (dhd_bus == NULL) {
+               DBUSERR(("%s: dhd_bus is NULL\n", __FUNCTION__));
+               return DBUS_ERR;
+       }
+
+       if ((dhd_bus->pub.busstate == DBUS_STATE_DL_DONE) ||
+               (dhd_bus->pub.busstate == DBUS_STATE_DOWN) ||
+               (dhd_bus->pub.busstate == DBUS_STATE_SLEEP)) {
+               if (dhd_bus->drvintf && dhd_bus->drvintf->up) {
+                       err = dhd_bus->drvintf->up(dhd_bus->bus_info);
+
+                       if (err == DBUS_OK) {
+                               dbus_rxirbs_fill(dhd_bus);
+                       }
+               }
+       } else
+               err = DBUS_ERR;
+
+       return err;
+}
+
+/** higher layer requests us to 'down' the interface to the dongle. */
+int
+dbus_down(dbus_pub_t *pub)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (dhd_bus == NULL)
+               return DBUS_ERR;
+
+       dbus_tx_timer_stop(dhd_bus);
+
+       if (dhd_bus->pub.busstate == DBUS_STATE_UP ||
+               dhd_bus->pub.busstate == DBUS_STATE_SLEEP) {
+               if (dhd_bus->drvintf && dhd_bus->drvintf->down)
+                       return dhd_bus->drvintf->down(dhd_bus->bus_info);
+       }
+
+       return DBUS_ERR;
+}
+
+int
+dbus_shutdown(dbus_pub_t *pub)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (dhd_bus == NULL)
+               return DBUS_ERR;
+
+       if (dhd_bus->drvintf && dhd_bus->drvintf->shutdown)
+               return dhd_bus->drvintf->shutdown(dhd_bus->bus_info);
+
+       return DBUS_OK;
+}
+
+int
+dbus_stop(struct dhd_bus *pub)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (dhd_bus == NULL)
+               return DBUS_ERR;
+
+       if (dhd_bus->pub.busstate == DBUS_STATE_UP ||
+               dhd_bus->pub.busstate == DBUS_STATE_SLEEP) {
+               if (dhd_bus->drvintf && dhd_bus->drvintf->stop)
+                       return dhd_bus->drvintf->stop(dhd_bus->bus_info);
+       }
+
+       return DBUS_ERR;
+}
+
+int dbus_send_txdata(dbus_pub_t *dbus, void *pktbuf)
+{
+       return dbus_send_pkt(dbus, pktbuf, pktbuf /* pktinfo */);
+}
+
+int
+dbus_send_buf(dbus_pub_t *pub, uint8 *buf, int len, void *info)
+{
+       return dbus_send_irb(pub, buf, len, NULL, info);
+}
+
+int
+dbus_send_pkt(dbus_pub_t *pub, void *pkt, void *info)
+{
+       return dbus_send_irb(pub, NULL, 0, pkt, info);
+}
+
+int
+dbus_send_ctl(struct dhd_bus *pub, uint8 *buf, int len)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+
+       if (dhd_bus == NULL) {
+               DBUSERR(("%s: dhd_bus is NULL\n", __FUNCTION__));
+               return DBUS_ERR;
+       }
+
+       if (dhd_bus->pub.busstate == DBUS_STATE_UP ||
+               dhd_bus->pub.busstate == DBUS_STATE_SLEEP) {
+               if (dhd_bus->drvintf && dhd_bus->drvintf->send_ctl)
+                       return dhd_bus->drvintf->send_ctl(dhd_bus->bus_info, buf, len);
+       } else {
+               DBUSERR(("%s: bustate=%d\n", __FUNCTION__, dhd_bus->pub.busstate));
+       }
+
+       return DBUS_ERR;
+}
+
+int
+dbus_recv_ctl(struct dhd_bus *pub, uint8 *buf, int len)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+
+       if ((dhd_bus == NULL) || (buf == NULL))
+               return DBUS_ERR;
+
+       if (dhd_bus->pub.busstate == DBUS_STATE_UP ||
+               dhd_bus->pub.busstate == DBUS_STATE_SLEEP) {
+               if (dhd_bus->drvintf && dhd_bus->drvintf->recv_ctl)
+                       return dhd_bus->drvintf->recv_ctl(dhd_bus->bus_info, buf, len);
+       }
+
+       return DBUS_ERR;
+}
+
+/** Only called via RPC (Dec 2012) */
+int
+dbus_recv_bulk(dbus_pub_t *pub, uint32 ep_idx)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+
+       dbus_irb_rx_t *rxirb;
+       struct exec_parms args;
+       int status;
+
+
+       if (dhd_bus == NULL)
+               return DBUS_ERR;
+
+       args.qdeq.q = dhd_bus->rx_q;
+       if (dhd_bus->pub.busstate == DBUS_STATE_UP) {
+               if (dhd_bus->drvintf && dhd_bus->drvintf->recv_irb_from_ep) {
+                       if ((rxirb = (EXEC_RXLOCK(dhd_bus, q_deq_exec, &args))) != NULL) {
+                               status = dhd_bus->drvintf->recv_irb_from_ep(dhd_bus->bus_info,
+                                       rxirb, ep_idx);
+                               if (status == DBUS_ERR_RXDROP) {
+                                       bzero(rxirb, sizeof(dbus_irb_rx_t));
+                                       args.qenq.q = dhd_bus->rx_q;
+                                       args.qenq.b = (dbus_irb_t *) rxirb;
+                                       EXEC_RXLOCK(dhd_bus, q_enq_exec, &args);
+                               }
+                       }
+               }
+       }
+
+       return DBUS_ERR;
+}
+
+/** only called by dhd_cdc.c (Dec 2012) */
+int
+dbus_poll_intr(dbus_pub_t *pub)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+
+       int status = DBUS_ERR;
+
+       if (dhd_bus == NULL)
+               return DBUS_ERR;
+
+       if (dhd_bus->pub.busstate == DBUS_STATE_UP) {
+               if (dhd_bus->drvintf && dhd_bus->drvintf->recv_irb_from_ep) {
+                       status = dhd_bus->drvintf->recv_irb_from_ep(dhd_bus->bus_info,
+                               NULL, 0xff);
+               }
+       }
+       return status;
+}
+
+/** called by nobody (Dec 2012) */
+void *
+dbus_pktget(dbus_pub_t *pub, int len)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+
+       if ((dhd_bus == NULL) || (len < 0))
+               return NULL;
+
+       return PKTGET(dhd_bus->pub.osh, len, TRUE);
+}
+
+/** called by nobody (Dec 2012) */
+void
+dbus_pktfree(dbus_pub_t *pub, void* pkt)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+
+       if ((dhd_bus == NULL) || (pkt == NULL))
+               return;
+
+       PKTFREE(dhd_bus->pub.osh, pkt, TRUE);
+}
+
+/** called by nobody (Dec 2012) */
+int
+dbus_get_stats(dbus_pub_t *pub, dbus_stats_t *stats)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+
+       if ((dhd_bus == NULL) || (stats == NULL))
+               return DBUS_ERR;
+
+       bcopy(&dhd_bus->pub.stats, stats, sizeof(dbus_stats_t));
+
+       return DBUS_OK;
+}
+
+int
+dbus_get_attrib(dhd_bus_t *pub, dbus_attrib_t *attrib)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+       int err = DBUS_ERR;
+
+       if ((dhd_bus == NULL) || (attrib == NULL))
+               return DBUS_ERR;
+
+       if (dhd_bus->drvintf && dhd_bus->drvintf->get_attrib) {
+               err = dhd_bus->drvintf->get_attrib(dhd_bus->bus_info,
+               &dhd_bus->pub.attrib);
+       }
+
+       bcopy(&dhd_bus->pub.attrib, attrib, sizeof(dbus_attrib_t));
+       return err;
+}
+
+int
+dbus_get_device_speed(dbus_pub_t *pub)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+
+       if (dhd_bus == NULL)
+               return INVALID_SPEED;
+
+       return (dhd_bus->pub.device_speed);
+}
+
+int
+dbus_set_config(dbus_pub_t *pub, dbus_config_t *config)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+       int err = DBUS_ERR;
+
+       if ((dhd_bus == NULL) || (config == NULL))
+               return DBUS_ERR;
+
+       if (dhd_bus->drvintf && dhd_bus->drvintf->set_config) {
+               err = dhd_bus->drvintf->set_config(dhd_bus->bus_info,
+                       config);
+
+               if ((config->config_id == DBUS_CONFIG_ID_AGGR_LIMIT) &&
+                       (!err) &&
+                       (dhd_bus->pub.busstate == DBUS_STATE_UP)) {
+                       dbus_rxirbs_fill(dhd_bus);
+               }
+       }
+
+       return err;
+}
+
+int
+dbus_get_config(dbus_pub_t *pub, dbus_config_t *config)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+       int err = DBUS_ERR;
+
+       if ((dhd_bus == NULL) || (config == NULL))
+               return DBUS_ERR;
+
+       if (dhd_bus->drvintf && dhd_bus->drvintf->get_config) {
+               err = dhd_bus->drvintf->get_config(dhd_bus->bus_info,
+               config);
+       }
+
+       return err;
+}
+
+int
+dbus_set_errmask(dbus_pub_t *pub, uint32 mask)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+       int err = DBUS_OK;
+
+       if (dhd_bus == NULL)
+               return DBUS_ERR;
+
+       dhd_bus->errmask = mask;
+       return err;
+}
+
+int
+dbus_pnp_resume(dbus_pub_t *pub, int *fw_reload)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+       int err = DBUS_ERR;
+       bool fwdl = FALSE;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (dhd_bus == NULL)
+               return DBUS_ERR;
+
+       if (dhd_bus->pub.busstate == DBUS_STATE_UP) {
+               return DBUS_OK;
+       }
+
+
+
+       if (dhd_bus->drvintf->pnp) {
+               err = dhd_bus->drvintf->pnp(dhd_bus->bus_info,
+                       DBUS_PNP_RESUME);
+       }
+
+       if (dhd_bus->drvintf->recv_needed) {
+               if (dhd_bus->drvintf->recv_needed(dhd_bus->bus_info)) {
+                       /* Refill after sleep/hibernate */
+                       dbus_rxirbs_fill(dhd_bus);
+               }
+       }
+
+
+       if (fw_reload)
+               *fw_reload = fwdl;
+
+       return err;
+} /* dbus_pnp_resume */
+
+int
+dbus_pnp_sleep(dbus_pub_t *pub)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+       int err = DBUS_ERR;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (dhd_bus == NULL)
+               return DBUS_ERR;
+
+       dbus_tx_timer_stop(dhd_bus);
+
+       if (dhd_bus->drvintf && dhd_bus->drvintf->pnp) {
+               err = dhd_bus->drvintf->pnp(dhd_bus->bus_info,
+                       DBUS_PNP_SLEEP);
+       }
+
+       return err;
+}
+
+int
+dbus_pnp_disconnect(dbus_pub_t *pub)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) pub;
+       int err = DBUS_ERR;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (dhd_bus == NULL)
+               return DBUS_ERR;
+
+       dbus_tx_timer_stop(dhd_bus);
+
+       if (dhd_bus->drvintf && dhd_bus->drvintf->pnp) {
+               err = dhd_bus->drvintf->pnp(dhd_bus->bus_info,
+                       DBUS_PNP_DISCONNECT);
+       }
+
+       return err;
+}
+
+int
+dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
+       void *params, int plen, void *arg, int len, bool set)
+{
+       dhd_bus_t *dhd_bus = (dhd_bus_t *) dhdp->bus;
+       int err = DBUS_ERR;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (dhd_bus == NULL)
+               return DBUS_ERR;
+
+       if (dhd_bus->drvintf && dhd_bus->drvintf->iovar_op) {
+               err = dhd_bus->drvintf->iovar_op(dhd_bus->bus_info,
+                       name, params, plen, arg, len, set);
+       }
+
+       return err;
+}
+
+
+void *
+dhd_dbus_txq(const dbus_pub_t *pub)
+{
+       return NULL;
+}
+
+uint
+dhd_dbus_hdrlen(const dbus_pub_t *pub)
+{
+       return 0;
+}
+
+void *
+dbus_get_devinfo(dbus_pub_t *pub)
+{
+       return pub->dev_info;
+}
+
+#if defined(BCM_REQUEST_FW) && !defined(EXTERNAL_FW_PATH)
+static int
+dbus_otp(dhd_bus_t *dhd_bus, uint16 *boardtype, uint16 *boardrev)
+{
+       uint32 value = 0;
+       uint8 *cis;
+       uint16 *otpinfo;
+       uint32 i;
+       bool standard_cis = TRUE;
+       uint8 tup, tlen;
+       bool btype_present = FALSE;
+       bool brev_present = FALSE;
+       int ret;
+       int devid;
+       uint16 btype = 0;
+       uint16 brev = 0;
+       uint32 otp_size = 0, otp_addr = 0, otp_sw_rgn = 0;
+
+       if (dhd_bus == NULL || dhd_bus->drvintf == NULL ||
+               dhd_bus->drvintf->readreg == NULL)
+               return DBUS_ERR;
+
+       devid = dhd_bus->pub.attrib.devid;
+
+       if ((devid == BCM43234_CHIP_ID) || (devid == BCM43235_CHIP_ID) ||
+               (devid == BCM43236_CHIP_ID)) {
+
+               otp_size = BCM_OTP_SIZE_43236;
+               otp_sw_rgn = BCM_OTP_SW_RGN_43236;
+               otp_addr = BCM_OTP_ADDR_43236;
+
+       } else {
+               return DBUS_ERR_NVRAM;
+       }
+
+       cis = MALLOC(dhd_bus->pub.osh, otp_size * 2);
+       if (cis == NULL)
+               return DBUS_ERR;
+
+       otpinfo = (uint16 *) cis;
+
+       for (i = 0; i < otp_size; i++) {
+
+               ret = dhd_bus->drvintf->readreg(dhd_bus->bus_info,
+                       otp_addr + ((otp_sw_rgn + i) << 1), 2, &value);
+
+               if (ret != DBUS_OK) {
+                       MFREE(dhd_bus->pub.osh, cis, otp_size * 2);
+                       return ret;
+               }
+               otpinfo[i] = (uint16) value;
+       }
+
+       for (i = 0; i < (otp_size << 1); ) {
+
+               if (standard_cis) {
+                       tup = cis[i++];
+                       if (tup == CISTPL_NULL || tup == CISTPL_END)
+                               tlen = 0;
+                       else
+                               tlen = cis[i++];
+               } else {
+                       if (cis[i] == CISTPL_NULL || cis[i] == CISTPL_END) {
+                               tlen = 0;
+                               tup = cis[i];
+                       } else {
+                               tlen = cis[i];
+                               tup = CISTPL_BRCM_HNBU;
+                       }
+                       ++i;
+               }
+
+               if (tup == CISTPL_END || (i + tlen) >= (otp_size << 1)) {
+                       break;
+               }
+
+               switch (tup) {
+
+               case CISTPL_BRCM_HNBU:
+
+                       switch (cis[i]) {
+
+                       case HNBU_BOARDTYPE:
+
+                               btype = (uint16) ((cis[i + 2] << 8) + cis[i + 1]);
+                               btype_present = TRUE;
+                               DBUSTRACE(("%s: HNBU_BOARDTYPE = 0x%2x\n", __FUNCTION__,
+                                       (uint32)btype));
+                               break;
+
+                       case HNBU_BOARDREV:
+
+                               if (tlen == 2)
+                                       brev = (uint16) cis[i + 1];
+                               else
+                                       brev = (uint16) ((cis[i + 2] << 8) + cis[i + 1]);
+                               brev_present = TRUE;
+                               DBUSTRACE(("%s: HNBU_BOARDREV =  0x%2x\n", __FUNCTION__,
+                                       (uint32)*boardrev));
+                               break;
+
+                       case HNBU_HNBUCIS:
+                               DBUSTRACE(("%s: HNBU_HNBUCIS\n", __FUNCTION__));
+                               tlen++;
+                               standard_cis = FALSE;
+                               break;
+                       }
+                       break;
+               }
+
+               i += tlen;
+       }
+
+       MFREE(dhd_bus->pub.osh, cis, otp_size * 2);
+
+       if (btype_present == TRUE && brev_present == TRUE) {
+               *boardtype = btype;
+               *boardrev = brev;
+               DBUSERR(("otp boardtype = 0x%2x boardrev = 0x%2x\n",
+                       *boardtype, *boardrev));
+
+               return DBUS_OK;
+       }
+       else
+               return DBUS_ERR;
+} /* dbus_otp */
+
+static int
+dbus_select_nvram(dhd_bus_t *dhd_bus, int8 *jumbonvram, int jumbolen,
+uint16 boardtype, uint16 boardrev, int8 **nvram, int *nvram_len)
+{
+       /* Multi board nvram file format is contenation of nvram info with \r
+       *  The file format for two contatenated set is
+       *  \nBroadcom Jumbo Nvram file\nfirst_set\nsecond_set\nthird_set\n
+       */
+       uint8 *nvram_start = NULL, *nvram_end = NULL;
+       uint8 *nvram_start_prev = NULL, *nvram_end_prev = NULL;
+       uint16 btype = 0, brev = 0;
+       int len  = 0;
+       char *field;
+
+       *nvram = NULL;
+       *nvram_len = 0;
+
+       if (strncmp(BCM_JUMBO_START, jumbonvram, strlen(BCM_JUMBO_START))) {
+               /* single nvram file in the native format */
+               DBUSTRACE(("%s: Non-Jumbo NVRAM File \n", __FUNCTION__));
+               *nvram = jumbonvram;
+               *nvram_len = jumbolen;
+               return DBUS_OK;
+       } else {
+               DBUSTRACE(("%s: Jumbo NVRAM File \n", __FUNCTION__));
+       }
+
+       /* sanity test the end of the config sets for proper ending */
+       if (jumbonvram[jumbolen - 1] != BCM_JUMBO_NVRAM_DELIMIT ||
+               jumbonvram[jumbolen - 2] != '\0') {
+               DBUSERR(("%s: Bad Jumbo NVRAM file format\n", __FUNCTION__));
+               return DBUS_JUMBO_BAD_FORMAT;
+       }
+
+       dhd_bus->nvram_nontxt = DBUS_NVRAM_NONTXT;
+
+       nvram_start = jumbonvram;
+
+       while (*nvram_start != BCM_JUMBO_NVRAM_DELIMIT && len < jumbolen) {
+
+               /* consume the  first file info line
+               * \nBroadcom Jumbo Nvram file\nfile1\n ...
+               */
+               len ++;
+               nvram_start ++;
+       }
+
+       nvram_end = nvram_start;
+
+       /* search for "boardrev=0xabcd" and "boardtype=0x1234" information in
+       * the concatenated nvram config files /sets
+       */
+
+       while (len < jumbolen) {
+
+               if (*nvram_end == '\0') {
+                       /* end of a config set is marked by multiple null characters */
+                       len ++;
+                       nvram_end ++;
+                       DBUSTRACE(("%s: NULL chr len = %d char = 0x%x\n", __FUNCTION__,
+                               len, *nvram_end));
+                       continue;
+
+               } else if (*nvram_end == BCM_JUMBO_NVRAM_DELIMIT) {
+
+                       /* config set delimiter is reached */
+                       /* check if next config set is present or not
+                       *  return  if next config is not present
+                       */
+
+                       /* start search the next config set */
+                       nvram_start_prev = nvram_start;
+                       nvram_end_prev = nvram_end;
+
+                       nvram_end ++;
+                       nvram_start = nvram_end;
+                       btype = brev = 0;
+                       DBUSTRACE(("%s: going to next record len = %d "
+                                       "char = 0x%x \n", __FUNCTION__, len, *nvram_end));
+                       len ++;
+                       if (len >= jumbolen) {
+
+                               *nvram = nvram_start_prev;
+                               *nvram_len = (int)(nvram_end_prev - nvram_start_prev);
+
+                               DBUSTRACE(("%s: no more len = %d nvram_end = 0x%p",
+                                       __FUNCTION__, len, nvram_end));
+
+                               return DBUS_JUMBO_NOMATCH;
+
+                       } else {
+                               continue;
+                       }
+
+               } else {
+
+                       DBUSTRACE(("%s: config str = %s\n", __FUNCTION__, nvram_end));
+
+                       if (bcmp(nvram_end, "boardtype", strlen("boardtype")) == 0) {
+
+                               field = strchr(nvram_end, '=');
+                               field++;
+                               btype = (uint16)bcm_strtoul(field, NULL, 0);
+
+                               DBUSTRACE(("%s: btype = 0x%x boardtype = 0x%x \n", __FUNCTION__,
+                                       btype, boardtype));
+                       }
+
+                       if (bcmp(nvram_end, "boardrev", strlen("boardrev")) == 0) {
+
+                               field = strchr(nvram_end, '=');
+                               field++;
+                               brev = (uint16)bcm_strtoul(field, NULL, 0);
+
+                               DBUSTRACE(("%s: brev = 0x%x boardrev = 0x%x \n", __FUNCTION__,
+                                       brev, boardrev));
+                       }
+                       if (btype == boardtype && brev == boardrev) {
+                               /* locate nvram config set end - ie.find '\r' char */
+                               while (*nvram_end != BCM_JUMBO_NVRAM_DELIMIT)
+                                       nvram_end ++;
+                               *nvram = nvram_start;
+                               *nvram_len = (int) (nvram_end - nvram_start);
+                               DBUSTRACE(("found len = %d nvram_start = 0x%p "
+                                       "nvram_end = 0x%p\n", *nvram_len, nvram_start, nvram_end));
+                               return DBUS_OK;
+                       }
+
+                       len += (strlen(nvram_end) + 1);
+                       nvram_end += (strlen(nvram_end) + 1);
+               }
+       }
+       return DBUS_JUMBO_NOMATCH;
+} /* dbus_select_nvram */
+
+#endif 
+
+#define DBUS_NRXQ      50
+#define DBUS_NTXQ      100
+
+static void
+dhd_dbus_send_complete(void *handle, void *info, int status)
+{
+       dhd_pub_t *dhd = (dhd_pub_t *)handle;
+       void *pkt = info;
+
+       if ((dhd == NULL) || (pkt == NULL)) {
+               DBUSERR(("dhd or pkt is NULL\n"));
+               return;
+       }
+
+       if (status == DBUS_OK) {
+               dhd->dstats.tx_packets++;
+       } else {
+               DBUSERR(("TX error=%d\n", status));
+               dhd->dstats.tx_errors++;
+       }
+#ifdef PROP_TXSTATUS
+       if (DHD_PKTTAG_WLFCPKT(PKTTAG(pkt)) &&
+               (dhd_wlfc_txcomplete(dhd, pkt, status == 0) != WLFC_UNSUPPORTED)) {
+               return;
+       }
+#endif /* PROP_TXSTATUS */
+       PKTFREE(dhd->osh, pkt, TRUE);
+}
+
+static void
+dhd_dbus_recv_pkt(void *handle, void *pkt)
+{
+       uchar reorder_info_buf[WLHOST_REORDERDATA_TOTLEN];
+       uint reorder_info_len;
+       uint pkt_count;
+       dhd_pub_t *dhd = (dhd_pub_t *)handle;
+       int ifidx = 0;
+
+       if (dhd == NULL) {
+               DBUSERR(("%s: dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       /* If the protocol uses a data header, check and remove it */
+       if (dhd_prot_hdrpull(dhd, &ifidx, pkt, reorder_info_buf,
+               &reorder_info_len) != 0) {
+               DBUSERR(("rx protocol error\n"));
+               PKTFREE(dhd->osh, pkt, FALSE);
+               dhd->rx_errors++;
+               return;
+       }
+
+       if (reorder_info_len) {
+               /* Reordering info from the firmware */
+               dhd_process_pkt_reorder_info(dhd, reorder_info_buf, reorder_info_len,
+                       &pkt, &pkt_count);
+               if (pkt_count == 0)
+                       return;
+       }
+       else {
+               pkt_count = 1;
+       }
+       dhd_rx_frame(dhd, ifidx, pkt, pkt_count, 0);
+}
+
+static void
+dhd_dbus_recv_buf(void *handle, uint8 *buf, int len)
+{
+       dhd_pub_t *dhd = (dhd_pub_t *)handle;
+       void *pkt;
+
+       if (dhd == NULL) {
+               DBUSERR(("%s: dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if ((pkt = PKTGET(dhd->osh, len, FALSE)) == NULL) {
+               DBUSERR(("PKTGET (rx) failed=%d\n", len));
+               return;
+       }
+
+       bcopy(buf, PKTDATA(dhd->osh, pkt), len);
+       dhd_dbus_recv_pkt(dhd, pkt);
+}
+
+static void
+dhd_dbus_txflowcontrol(void *handle, bool onoff)
+{
+       dhd_pub_t *dhd = (dhd_pub_t *)handle;
+       bool wlfc_enabled = FALSE;
+
+       if (dhd == NULL) {
+               DBUSERR(("%s: dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+#ifdef PROP_TXSTATUS
+       wlfc_enabled = (dhd_wlfc_flowcontrol(dhd, onoff, !onoff) != WLFC_UNSUPPORTED);
+#endif
+
+       if (!wlfc_enabled) {
+               dhd_txflowcontrol(dhd, ALL_INTERFACES, onoff);
+       }
+}
+
+static void
+dhd_dbus_errhandler(void *handle, int err)
+{
+}
+
+static void
+dhd_dbus_ctl_complete(void *handle, int type, int status)
+{
+       dhd_pub_t *dhd = (dhd_pub_t *)handle;
+
+       if (dhd == NULL) {
+               DBUSERR(("%s: dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (type == DBUS_CBCTL_READ) {
+               if (status == DBUS_OK)
+                       dhd->rx_ctlpkts++;
+               else
+                       dhd->rx_ctlerrs++;
+       } else if (type == DBUS_CBCTL_WRITE) {
+               if (status == DBUS_OK)
+                       dhd->tx_ctlpkts++;
+               else
+                       dhd->tx_ctlerrs++;
+       }
+
+       dhd_prot_ctl_complete(dhd);
+}
+
+static void
+dhd_dbus_state_change(void *handle, int state)
+{
+       dhd_pub_t *dhd = (dhd_pub_t *)handle;
+
+       if (dhd == NULL) {
+               DBUSERR(("%s: dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       switch (state) {
+
+               case DBUS_STATE_DL_NEEDED:
+                       DBUSERR(("%s: firmware request cannot be handled\n", __FUNCTION__));
+                       break;
+               case DBUS_STATE_DOWN:
+                       DBUSTRACE(("%s: DBUS is down\n", __FUNCTION__));
+                       dhd->busstate = DHD_BUS_DOWN;
+                       break;
+               case DBUS_STATE_UP:
+                       DBUSTRACE(("%s: DBUS is up\n", __FUNCTION__));
+                       dhd->busstate = DHD_BUS_DATA;
+                       break;
+               default:
+                       break;
+       }
+
+       DBUSERR(("%s: DBUS current state=%d\n", __FUNCTION__, state));
+}
+
+static void *
+dhd_dbus_pktget(void *handle, uint len, bool send)
+{
+       dhd_pub_t *dhd = (dhd_pub_t *)handle;
+       void *p = NULL;
+
+       if (dhd == NULL) {
+               DBUSERR(("%s: dhd is NULL\n", __FUNCTION__));
+               return NULL;
+       }
+
+       if (send == TRUE) {
+               dhd_os_sdlock_txq(dhd);
+               p = PKTGET(dhd->osh, len, TRUE);
+               dhd_os_sdunlock_txq(dhd);
+       } else {
+               dhd_os_sdlock_rxq(dhd);
+               p = PKTGET(dhd->osh, len, FALSE);
+               dhd_os_sdunlock_rxq(dhd);
+       }
+
+       return p;
+}
+
+static void
+dhd_dbus_pktfree(void *handle, void *p, bool send)
+{
+       dhd_pub_t *dhd = (dhd_pub_t *)handle;
+
+       if (dhd == NULL) {
+               DBUSERR(("%s: dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (send == TRUE) {
+#ifdef PROP_TXSTATUS
+               if (DHD_PKTTAG_WLFCPKT(PKTTAG(p)) &&
+                       (dhd_wlfc_txcomplete(dhd, p, FALSE) != WLFC_UNSUPPORTED)) {
+                       return;
+               }
+#endif /* PROP_TXSTATUS */
+
+               dhd_os_sdlock_txq(dhd);
+               PKTFREE(dhd->osh, p, TRUE);
+               dhd_os_sdunlock_txq(dhd);
+       } else {
+               dhd_os_sdlock_rxq(dhd);
+               PKTFREE(dhd->osh, p, FALSE);
+               dhd_os_sdunlock_rxq(dhd);
+       }
+}
+
+
+static dbus_callbacks_t dhd_dbus_cbs = {
+       dhd_dbus_send_complete,
+       dhd_dbus_recv_buf,
+       dhd_dbus_recv_pkt,
+       dhd_dbus_txflowcontrol,
+       dhd_dbus_errhandler,
+       dhd_dbus_ctl_complete,
+       dhd_dbus_state_change,
+       dhd_dbus_pktget,
+       dhd_dbus_pktfree
+};
+
+uint
+dhd_bus_chip(struct dhd_bus *bus)
+{
+       ASSERT(bus != NULL);
+       return bus->pub.attrib.devid;
+}
+
+uint
+dhd_bus_chiprev(struct dhd_bus *bus)
+{
+       ASSERT(bus);
+       ASSERT(bus != NULL);
+       return bus->pub.attrib.chiprev;
+}
+
+void
+dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+       bcm_bprintf(strbuf, "Bus USB\n");
+}
+
+void
+dhd_bus_clearcounts(dhd_pub_t *dhdp)
+{
+}
+
+int
+dhd_bus_txdata(struct dhd_bus *bus, void *pktbuf)
+{
+       DBUSTRACE(("%s\n", __FUNCTION__));
+       if (bus->txoff) {
+               DBUSTRACE(("txoff\n"));
+               return BCME_EPERM;
+       }
+       return dbus_send_txdata(&bus->pub, pktbuf);
+}
+
+static void
+dhd_dbus_advertise_bus_cleanup(dhd_pub_t *dhdp)
+{
+       unsigned long flags;
+       int timeleft;
+
+       DHD_LINUX_GENERAL_LOCK(dhdp, flags);
+       dhdp->busstate = DHD_BUS_DOWN_IN_PROGRESS;
+       DHD_LINUX_GENERAL_UNLOCK(dhdp, flags);
+
+       timeleft = dhd_os_busbusy_wait_negation(dhdp, &dhdp->dhd_bus_busy_state);
+       if ((timeleft == 0) || (timeleft == 1)) {
+               DBUSERR(("%s : Timeout due to dhd_bus_busy_state=0x%x\n",
+                               __FUNCTION__, dhdp->dhd_bus_busy_state));
+               ASSERT(0);
+       }
+
+       return;
+}
+
+static void
+dhd_dbus_advertise_bus_remove(dhd_pub_t *dhdp)
+{
+       unsigned long flags;
+       int timeleft;
+
+       DHD_LINUX_GENERAL_LOCK(dhdp, flags);
+       dhdp->busstate = DHD_BUS_REMOVE;
+       DHD_LINUX_GENERAL_UNLOCK(dhdp, flags);
+
+       timeleft = dhd_os_busbusy_wait_negation(dhdp, &dhdp->dhd_bus_busy_state);
+       if ((timeleft == 0) || (timeleft == 1)) {
+               DBUSERR(("%s : Timeout due to dhd_bus_busy_state=0x%x\n",
+                               __FUNCTION__, dhdp->dhd_bus_busy_state));
+               ASSERT(0);
+       }
+
+       return;
+}
+
+int
+dhd_bus_devreset(dhd_pub_t *dhdp, uint8 flag)
+{
+       int bcmerror = 0;
+       unsigned long flags;
+       wifi_adapter_info_t *adapter = (wifi_adapter_info_t *)dhdp->adapter;
+
+       if (flag == TRUE) {
+               if (!dhdp->dongle_reset) {
+                       DBUSERR(("%s: == Power OFF ==\n", __FUNCTION__));
+                       dhd_dbus_advertise_bus_cleanup(dhdp);
+                       dhd_os_wd_timer(dhdp, 0);
+#if !defined(IGNORE_ETH0_DOWN)
+                       /* Force flow control as protection when stop come before ifconfig_down */
+                       dhd_txflowcontrol(dhdp, ALL_INTERFACES, ON);
+#endif /* !defined(IGNORE_ETH0_DOWN) */
+                       dbus_stop(dhdp->bus);
+
+                       dhdp->dongle_reset = TRUE;
+                       dhdp->up = FALSE;
+
+                       DHD_LINUX_GENERAL_LOCK(dhdp, flags);
+                       dhdp->busstate = DHD_BUS_DOWN;
+                       DHD_LINUX_GENERAL_UNLOCK(dhdp, flags);
+                       wifi_clr_adapter_status(adapter, WIFI_STATUS_FW_READY);
+
+                       printf("%s:  WLAN OFF DONE\n", __FUNCTION__);
+                       /* App can now remove power from device */
+               } else
+                       bcmerror = BCME_ERROR;
+       } else {
+               /* App must have restored power to device before calling */
+               printf("\n\n%s: == WLAN ON ==\n", __FUNCTION__);
+               if (dhdp->dongle_reset) {
+                       /* Turn on WLAN */
+                       DHD_MUTEX_UNLOCK();
+                       wait_event_interruptible_timeout(adapter->status_event,
+                               wifi_get_adapter_status(adapter, WIFI_STATUS_FW_READY),
+                               msecs_to_jiffies(DHD_FW_READY_TIMEOUT));
+                       DHD_MUTEX_LOCK();
+                       bcmerror = dbus_up(dhdp->bus);
+                       if (bcmerror == BCME_OK) {
+                               dhdp->dongle_reset = FALSE;
+                               dhdp->up = TRUE;
+#if !defined(IGNORE_ETH0_DOWN)
+                               /* Restore flow control  */
+                               dhd_txflowcontrol(dhdp, ALL_INTERFACES, OFF);
+#endif 
+                               dhd_os_wd_timer(dhdp, dhd_watchdog_ms);
+
+                               DBUSTRACE(("%s: WLAN ON DONE\n", __FUNCTION__));
+                       } else {
+                               DBUSERR(("%s: failed to dbus_up with code %d\n", __FUNCTION__, bcmerror));
+                       }
+               }
+       }
+
+#ifdef PKT_STATICS
+       memset((uint8*) &tx_statics, 0, sizeof(pkt_statics_t));
+#endif
+       return bcmerror;
+}
+
+void
+dhd_bus_update_fw_nv_path(struct dhd_bus *bus, char *pfw_path,
+       char *pnv_path, char *pclm_path, char *pconf_path)
+{
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (bus == NULL) {
+               DBUSERR(("%s: bus is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       bus->fw_path = pfw_path;
+       bus->nv_path = pnv_path;
+       bus->dhd->clm_path = pclm_path;
+       bus->dhd->conf_path = pconf_path;
+
+       dhd_conf_set_path_params(bus->dhd, bus->fw_path, bus->nv_path);
+
+}
+
+/*
+ * hdrlen is space to reserve in pkt headroom for DBUS
+ */
+void *
+dhd_dbus_probe_cb(void *arg, const char *desc, uint32 bustype,
+       uint16 bus_no, uint16 slot, uint32 hdrlen)
+{
+       osl_t *osh = NULL;
+       dhd_bus_t *bus = NULL;
+       dhd_pub_t *pub = NULL;
+       uint rxsz;
+       int dlneeded = 0;
+       wifi_adapter_info_t *adapter = NULL;
+
+       DBUSTRACE(("%s: Enter\n", __FUNCTION__));
+
+       adapter = dhd_wifi_platform_get_adapter(bustype, bus_no, slot);
+
+       if (!g_pub) {
+               /* Ask the OS interface part for an OSL handle */
+               if (!(osh = osl_attach(NULL, bustype, TRUE))) {
+                       DBUSERR(("%s: OSL attach failed\n", __FUNCTION__));
+                       goto fail;
+               }
+
+               /* Attach to the dhd/OS interface */
+               if (!(pub = dhd_attach(osh, bus, hdrlen, adapter))) {
+                       DBUSERR(("%s: dhd_attach failed\n", __FUNCTION__));
+                       goto fail;
+               }
+       } else {
+               pub = g_pub;
+               osh = pub->osh;
+       }
+
+       if (pub->bus) {
+               DBUSERR(("%s: wrong probe\n", __FUNCTION__));
+               goto fail;
+       }
+
+       rxsz = dhd_get_rxsz(pub);
+       bus = dbus_attach(osh, rxsz, DBUS_NRXQ, DBUS_NTXQ, pub, &dhd_dbus_cbs, NULL, NULL);
+       if (bus) {
+               pub->bus = bus;
+               bus->dhd = pub;
+
+               dlneeded = dbus_dlneeded(bus);
+               if (dlneeded >= 0) {
+                       if (!g_pub) {
+                               dhd_conf_reset(pub);
+                               dhd_conf_set_chiprev(pub, bus->pub.attrib.devid, bus->pub.attrib.chiprev);
+                               dhd_conf_preinit(pub);
+                       }
+               }
+
+               if (g_pub || dhd_download_fw_on_driverload) {
+                       if (dlneeded == 0) {
+                               wifi_set_adapter_status(adapter, WIFI_STATUS_FW_READY);
+#ifdef BCM_REQUEST_FW
+                       } else if (dlneeded > 0) {
+                               dhd_set_path(bus->dhd);
+                               if (dbus_download_firmware(bus, bus->fw_path, bus->nv_path) != DBUS_OK)
+                                       goto fail;
+#endif
+                       } else {
+                               goto fail;
+                       }
+               }
+       } else {
+               DBUSERR(("%s: dbus_attach failed\n", __FUNCTION__));
+       }
+
+       if (!g_pub) {
+               /* Ok, have the per-port tell the stack we're open for business */
+               if (dhd_attach_net(bus->dhd, TRUE) != 0)
+               {
+                       DBUSERR(("%s: Net attach failed!!\n", __FUNCTION__));
+                       goto fail;
+               }
+               pub->hang_report  = TRUE;
+#if defined(MULTIPLE_SUPPLICANT)
+               wl_android_post_init(); // terence 20120530: fix critical section in dhd_open and dhdsdio_probe
+#endif
+               g_pub = pub;
+       }
+
+       DBUSTRACE(("%s: Exit\n", __FUNCTION__));
+       wifi_clr_adapter_status(adapter, WIFI_STATUS_DETTACH);
+       wifi_set_adapter_status(adapter, WIFI_STATUS_ATTACH);
+       wake_up_interruptible(&adapter->status_event);
+       /* This is passed to dhd_dbus_disconnect_cb */
+       return bus;
+
+fail:
+       if (pub && pub->bus) {
+               dbus_detach(pub->bus);
+               pub->bus = NULL;
+       }
+       /* Release resources in reverse order */
+       if (!g_pub) {
+               if (pub) {
+                       dhd_detach(pub);
+                       dhd_free(pub);
+               }
+               if (osh) {
+                       osl_detach(osh);
+               }
+       }
+
+       printf("%s: Failed\n", __FUNCTION__);
+       return NULL;
+}
+
+void
+dhd_dbus_disconnect_cb(void *arg)
+{
+       dhd_bus_t *bus = (dhd_bus_t *)arg;
+       dhd_pub_t *pub = g_pub;
+       osl_t *osh;
+       wifi_adapter_info_t *adapter = NULL;
+
+       adapter = (wifi_adapter_info_t *)pub->adapter;
+
+       if (pub && !pub->dhd_remove && bus == NULL) {
+               DBUSERR(("%s: bus is NULL\n", __FUNCTION__));
+               return;
+       }
+       if (!adapter) {
+               DBUSERR(("%s: adapter is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       printf("%s: Enter dhd_remove=%d on %s\n", __FUNCTION__,
+               pub->dhd_remove, adapter->name);
+       if (!pub->dhd_remove) {
+               /* Advertise bus remove during rmmod */
+               dhd_dbus_advertise_bus_remove(bus->dhd);
+               dbus_detach(pub->bus);
+               pub->bus = NULL;
+               wifi_clr_adapter_status(adapter, WIFI_STATUS_ATTACH);
+               wifi_set_adapter_status(adapter, WIFI_STATUS_DETTACH);
+               wake_up_interruptible(&adapter->status_event);
+       } else {
+               osh = pub->osh;
+               dhd_detach(pub);
+               if (pub->bus) {
+                       dbus_detach(pub->bus);
+                       pub->bus = NULL;
+               }
+               dhd_free(pub);
+               g_pub = NULL;
+               if (MALLOCED(osh)) {
+                       DBUSERR(("%s: MEMORY LEAK %d bytes\n", __FUNCTION__, MALLOCED(osh)));
+               }
+               osl_detach(osh);
+       }
+
+       DBUSTRACE(("%s: Exit\n", __FUNCTION__));
+}
+
+#ifdef LINUX_EXTERNAL_MODULE_DBUS
+
+static int __init
+bcm_dbus_module_init(void)
+{
+       printf("Inserting bcm_dbus module \n");
+       return 0;
+}
+
+static void __exit
+bcm_dbus_module_exit(void)
+{
+       printf("Removing bcm_dbus module \n");
+       return;
+}
+
+EXPORT_SYMBOL(dbus_pnp_sleep);
+EXPORT_SYMBOL(dbus_get_devinfo);
+EXPORT_SYMBOL(dbus_detach);
+EXPORT_SYMBOL(dbus_get_attrib);
+EXPORT_SYMBOL(dbus_down);
+EXPORT_SYMBOL(dbus_pnp_resume);
+EXPORT_SYMBOL(dbus_set_config);
+EXPORT_SYMBOL(dbus_flowctrl_rx);
+EXPORT_SYMBOL(dbus_up);
+EXPORT_SYMBOL(dbus_get_device_speed);
+EXPORT_SYMBOL(dbus_send_pkt);
+EXPORT_SYMBOL(dbus_recv_ctl);
+EXPORT_SYMBOL(dbus_attach);
+
+MODULE_LICENSE("GPL");
+
+module_init(bcm_dbus_module_init);
+module_exit(bcm_dbus_module_exit);
+
+#endif  /* #ifdef LINUX_EXTERNAL_MODULE_DBUS */
diff --git a/bcmdhd.101.10.240.x/dbus_usb.c b/bcmdhd.101.10.240.x/dbus_usb.c
new file mode 100644 (file)
index 0000000..8a496dd
--- /dev/null
@@ -0,0 +1,1172 @@
+/*
+ * Dongle BUS interface for USB, OS independent
+ *
+ * Copyright (C) 1999-2016, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dbus_usb.c 565557 2015-06-22 19:29:44Z $
+ */
+
+/**
+ * @file @brief
+ * This file contains DBUS code that is USB, but not OS specific. DBUS is a Broadcom proprietary
+ * host specific abstraction layer.
+ */
+
+#include <osl.h>
+#include <bcmdefs.h>
+#include <bcmutils.h>
+#include <dbus.h>
+#include <usbrdl.h>
+#include <bcmdevs.h>
+#include <bcmendian.h>
+
+uint dbus_msglevel = DBUS_ERROR_VAL;
+module_param(dbus_msglevel, int, 0);
+
+
+#define USB_DLIMAGE_RETRY_TIMEOUT    3000    /* retry Timeout */
+#define USB_SFLASH_DLIMAGE_SPINWAIT  150     /* in unit of ms */
+#define USB_SFLASH_DLIMAGE_LIMIT     2000    /* spinwait limit (ms) */
+#define POSTBOOT_ID                  0xA123  /* ID to detect if dongle has boot up */
+#define USB_RESETCFG_SPINWAIT        1       /* wait after resetcfg (ms) */
+#define USB_DEV_ISBAD(u)             (u->pub->attrib.devid == 0xDEAD)
+#define USB_DLGO_SPINWAIT            100     /* wait after DL_GO (ms) */
+#define TEST_CHIP                    0x4328
+
+typedef struct {
+       dbus_pub_t  *pub;
+
+       void        *cbarg;
+       dbus_intf_callbacks_t *cbs;  /** callbacks into higher DBUS level (dbus.c) */
+       dbus_intf_t *drvintf;
+       void        *usbosl_info;
+       uint32      rdlram_base_addr;
+       uint32      rdlram_size;
+} usb_info_t;
+
+/*
+ * Callbacks common to all USB
+ */
+static void dbus_usb_disconnect(void *handle);
+static void dbus_usb_send_irb_timeout(void *handle, dbus_irb_tx_t *txirb);
+static void dbus_usb_send_irb_complete(void *handle, dbus_irb_tx_t *txirb, int status);
+static void dbus_usb_recv_irb_complete(void *handle, dbus_irb_rx_t *rxirb, int status);
+static void dbus_usb_errhandler(void *handle, int err);
+static void dbus_usb_ctl_complete(void *handle, int type, int status);
+static void dbus_usb_state_change(void *handle, int state);
+static struct dbus_irb* dbus_usb_getirb(void *handle, bool send);
+static void dbus_usb_rxerr_indicate(void *handle, bool on);
+#if !defined(BCM_REQUEST_FW)
+static int dbus_usb_resetcfg(usb_info_t *usbinfo);
+#endif
+static int dbus_usb_iovar_op(void *bus, const char *name,
+       void *params, int plen, void *arg, int len, bool set);
+static int dbus_iovar_process(usb_info_t* usbinfo, const char *name,
+                 void *params, int plen, void *arg, int len, bool set);
+static int dbus_usb_doiovar(usb_info_t *bus, const bcm_iovar_t *vi, uint32 actionid,
+       const char *name, void *params, int plen, void *arg, int len, int val_size);
+static int dhdusb_downloadvars(usb_info_t *bus, void *arg, int len);
+
+static int dbus_usb_dl_writeimage(usb_info_t *usbinfo, uint8 *fw, int fwlen);
+static int dbus_usb_dlstart(void *bus, uint8 *fw, int len);
+static int dbus_usb_dlneeded(void *bus);
+static int dbus_usb_dlrun(void *bus);
+static int dbus_usb_rdl_dwnld_state(usb_info_t *usbinfo);
+
+
+/* OS specific */
+extern bool dbus_usbos_dl_cmd(void *info, uint8 cmd, void *buffer, int buflen);
+extern int dbus_usbos_wait(void *info, uint16 ms);
+extern int dbus_write_membytes(usb_info_t *usbinfo, bool set, uint32 address,
+       uint8 *data, uint size);
+extern bool dbus_usbos_dl_send_bulk(void *info, void *buffer, int len);
+extern int dbus_usbos_loopback_tx(void *usbos_info_ptr, int cnt, int size);
+
+/**
+ * These functions are called by the lower DBUS level (dbus_usb_os.c) to notify this DBUS level
+ * (dbus_usb.c) of an event.
+ */
+static dbus_intf_callbacks_t dbus_usb_intf_cbs = {
+       dbus_usb_send_irb_timeout,
+       dbus_usb_send_irb_complete,
+       dbus_usb_recv_irb_complete,
+       dbus_usb_errhandler,
+       dbus_usb_ctl_complete,
+       dbus_usb_state_change,
+       NULL,                   /* isr */
+       NULL,                   /* dpc */
+       NULL,                   /* watchdog */
+       NULL,                   /* dbus_if_pktget */
+       NULL,                   /* dbus_if_pktfree */
+       dbus_usb_getirb,
+       dbus_usb_rxerr_indicate
+};
+
+/* IOVar table */
+enum {
+       IOV_SET_DOWNLOAD_STATE = 1,
+       IOV_DBUS_MSGLEVEL,
+       IOV_MEMBYTES,
+       IOV_VARS,
+       IOV_LOOPBACK_TX
+};
+
+const bcm_iovar_t dhdusb_iovars[] = {
+       {"vars",        IOV_VARS,       0,      IOVT_BUFFER,    0 },
+       {"dbus_msglevel",       IOV_DBUS_MSGLEVEL,      0,      IOVT_UINT32,    0 },
+       {"dwnldstate",  IOV_SET_DOWNLOAD_STATE, 0,      IOVT_BOOL,      0 },
+       {"membytes",    IOV_MEMBYTES,   0,      IOVT_BUFFER,    2 * sizeof(int) },
+       {"usb_lb_txfer", IOV_LOOPBACK_TX, 0,    IOVT_BUFFER,    2 * sizeof(int) },
+       {NULL, 0, 0, 0, 0 }
+};
+
+/*
+ * Need global for probe() and disconnect() since
+ * attach() is not called at probe and detach()
+ * can be called inside disconnect()
+ */
+static probe_cb_t      probe_cb = NULL;
+static disconnect_cb_t disconnect_cb = NULL;
+static void            *probe_arg = NULL;
+static void            *disc_arg = NULL;
+static dbus_intf_t     *g_dbusintf = NULL;
+static dbus_intf_t     dbus_usb_intf; /** functions called by higher layer DBUS into lower layer */
+
+/*
+ * dbus_intf_t common to all USB
+ * These functions override dbus_usb_<os>.c.
+ */
+static void *dbus_usb_attach(dbus_pub_t *pub, void *cbarg, dbus_intf_callbacks_t *cbs);
+static void dbus_usb_detach(dbus_pub_t *pub, void *info);
+static void * dbus_usb_probe(void *arg, const char *desc, uint32 bustype,
+       uint16 bus_no, uint16 slot, uint32 hdrlen);
+
+/* functions */
+
+/**
+ * As part of DBUS initialization/registration, the higher level DBUS (dbus.c) needs to know what
+ * lower level DBUS functions to call (in both dbus_usb.c and dbus_usb_os.c).
+ */
+static void *
+dbus_usb_probe(void *arg, const char *desc, uint32 bustype, uint16 bus_no,
+       uint16 slot, uint32 hdrlen)
+{
+       DBUSTRACE(("%s(): \n", __FUNCTION__));
+       if (probe_cb) {
+
+               if (g_dbusintf != NULL) {
+                       /* First, initialize all lower-level functions as default
+                        * so that dbus.c simply calls directly to dbus_usb_os.c.
+                        */
+                       bcopy(g_dbusintf, &dbus_usb_intf, sizeof(dbus_intf_t));
+
+                       /* Second, selectively override functions we need, if any. */
+                       dbus_usb_intf.attach = dbus_usb_attach;
+                       dbus_usb_intf.detach = dbus_usb_detach;
+                       dbus_usb_intf.iovar_op = dbus_usb_iovar_op;
+                       dbus_usb_intf.dlstart = dbus_usb_dlstart;
+                       dbus_usb_intf.dlneeded = dbus_usb_dlneeded;
+                       dbus_usb_intf.dlrun = dbus_usb_dlrun;
+               }
+
+               disc_arg = probe_cb(probe_arg, "DBUS USB", USB_BUS, bus_no, slot, hdrlen);
+               return disc_arg;
+       }
+
+       return NULL;
+}
+
+/**
+ * On return, *intf contains this or lower-level DBUS functions to be called by higher
+ * level (dbus.c)
+ */
+int
+dbus_bus_register(int vid, int pid, probe_cb_t prcb,
+       disconnect_cb_t discb, void *prarg, dbus_intf_t **intf, void *param1, void *param2)
+{
+       int err;
+
+       DBUSTRACE(("%s(): \n", __FUNCTION__));
+       probe_cb = prcb;
+       disconnect_cb = discb;
+       probe_arg = prarg;
+
+       *intf = &dbus_usb_intf;
+
+       err = dbus_bus_osl_register(vid, pid, dbus_usb_probe,
+               dbus_usb_disconnect, NULL, &g_dbusintf, param1, param2);
+
+       ASSERT(g_dbusintf);
+       return err;
+}
+
+int
+dbus_bus_deregister()
+{
+       DBUSTRACE(("%s(): \n", __FUNCTION__));
+       return dbus_bus_osl_deregister();
+}
+
+/** initialization consists of registration followed by 'attach'. */
+void *
+dbus_usb_attach(dbus_pub_t *pub, void *cbarg, dbus_intf_callbacks_t *cbs)
+{
+       usb_info_t *usb_info;
+
+       DBUSTRACE(("%s(): \n", __FUNCTION__));
+
+       if ((g_dbusintf == NULL) || (g_dbusintf->attach == NULL))
+               return NULL;
+
+       /* Sanity check for BUS_INFO() */
+       ASSERT(OFFSETOF(usb_info_t, pub) == 0);
+
+       usb_info = MALLOC(pub->osh, sizeof(usb_info_t));
+       if (usb_info == NULL)
+               return NULL;
+
+       bzero(usb_info, sizeof(usb_info_t));
+
+       usb_info->pub = pub;
+       usb_info->cbarg = cbarg;
+       usb_info->cbs = cbs;
+
+       usb_info->usbosl_info = (dbus_pub_t *)g_dbusintf->attach(pub,
+               usb_info, &dbus_usb_intf_cbs);
+       if (usb_info->usbosl_info == NULL) {
+               MFREE(pub->osh, usb_info, sizeof(usb_info_t));
+               return NULL;
+       }
+
+       /* Save USB OS-specific driver entry points */
+       usb_info->drvintf = g_dbusintf;
+
+       pub->bus = usb_info;
+#if !defined(BCM_REQUEST_FW)
+       if (!dbus_usb_resetcfg(usb_info)) {
+               usb_info->pub->busstate = DBUS_STATE_DL_DONE;
+       }
+#endif
+       /* Return Lower layer info */
+       return (void *) usb_info->usbosl_info;
+}
+
+void
+dbus_usb_detach(dbus_pub_t *pub, void *info)
+{
+       usb_info_t *usb_info = (usb_info_t *) pub->bus;
+       osl_t *osh = pub->osh;
+
+       if (usb_info == NULL)
+               return;
+
+       if (usb_info->drvintf && usb_info->drvintf->detach)
+               usb_info->drvintf->detach(pub, usb_info->usbosl_info);
+
+       MFREE(osh, usb_info, sizeof(usb_info_t));
+}
+
+void
+dbus_usb_disconnect(void *handle)
+{
+       DBUSTRACE(("%s(): \n", __FUNCTION__));
+       if (disconnect_cb)
+               disconnect_cb(disc_arg);
+}
+
+/**
+ * When the lower DBUS level (dbus_usb_os.c) signals this event, the higher DBUS level has to be
+ * notified.
+ */
+static void
+dbus_usb_send_irb_timeout(void *handle, dbus_irb_tx_t *txirb)
+{
+       usb_info_t *usb_info = (usb_info_t *) handle;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (usb_info == NULL)
+               return;
+
+       if (usb_info->cbs && usb_info->cbs->send_irb_timeout)
+               usb_info->cbs->send_irb_timeout(usb_info->cbarg, txirb);
+}
+
+/**
+ * When the lower DBUS level (dbus_usb_os.c) signals this event, the higher DBUS level has to be
+ * notified.
+ */
+static void
+dbus_usb_send_irb_complete(void *handle, dbus_irb_tx_t *txirb, int status)
+{
+       usb_info_t *usb_info = (usb_info_t *) handle;
+
+       if (usb_info == NULL)
+               return;
+
+       if (usb_info->cbs && usb_info->cbs->send_irb_complete)
+               usb_info->cbs->send_irb_complete(usb_info->cbarg, txirb, status);
+}
+
+/**
+ * When the lower DBUS level (dbus_usb_os.c) signals this event, the higher DBUS level has to be
+ * notified.
+ */
+static void
+dbus_usb_recv_irb_complete(void *handle, dbus_irb_rx_t *rxirb, int status)
+{
+       usb_info_t *usb_info = (usb_info_t *) handle;
+
+       if (usb_info == NULL)
+               return;
+
+       if (usb_info->cbs && usb_info->cbs->recv_irb_complete)
+               usb_info->cbs->recv_irb_complete(usb_info->cbarg, rxirb, status);
+}
+
+/** Lower DBUS level (dbus_usb_os.c) requests a free IRB. Pass this on to the higher DBUS level. */
+static struct dbus_irb*
+dbus_usb_getirb(void *handle, bool send)
+{
+       usb_info_t *usb_info = (usb_info_t *) handle;
+
+       if (usb_info == NULL)
+               return NULL;
+
+       if (usb_info->cbs && usb_info->cbs->getirb)
+               return usb_info->cbs->getirb(usb_info->cbarg, send);
+
+       return NULL;
+}
+
+/**
+ * When the lower DBUS level (dbus_usb_os.c) signals this event, the higher DBUS level has to be
+ * notified.
+ */
+static void
+dbus_usb_rxerr_indicate(void *handle, bool on)
+{
+       usb_info_t *usb_info = (usb_info_t *) handle;
+
+       if (usb_info == NULL)
+               return;
+
+       if (usb_info->cbs && usb_info->cbs->rxerr_indicate)
+               usb_info->cbs->rxerr_indicate(usb_info->cbarg, on);
+}
+
+/**
+ * When the lower DBUS level (dbus_usb_os.c) signals this event, the higher DBUS level has to be
+ * notified.
+ */
+static void
+dbus_usb_errhandler(void *handle, int err)
+{
+       usb_info_t *usb_info = (usb_info_t *) handle;
+
+       if (usb_info == NULL)
+               return;
+
+       if (usb_info->cbs && usb_info->cbs->errhandler)
+               usb_info->cbs->errhandler(usb_info->cbarg, err);
+}
+
+/**
+ * When the lower DBUS level (dbus_usb_os.c) signals this event, the higher DBUS level has to be
+ * notified.
+ */
+static void
+dbus_usb_ctl_complete(void *handle, int type, int status)
+{
+       usb_info_t *usb_info = (usb_info_t *) handle;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (usb_info == NULL) {
+               DBUSERR(("%s: usb_info is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (usb_info->cbs && usb_info->cbs->ctl_complete)
+               usb_info->cbs->ctl_complete(usb_info->cbarg, type, status);
+}
+
+/**
+ * When the lower DBUS level (dbus_usb_os.c) signals this event, the higher DBUS level has to be
+ * notified.
+ */
+static void
+dbus_usb_state_change(void *handle, int state)
+{
+       usb_info_t *usb_info = (usb_info_t *) handle;
+
+       if (usb_info == NULL)
+               return;
+
+       if (usb_info->cbs && usb_info->cbs->state_change)
+               usb_info->cbs->state_change(usb_info->cbarg, state);
+}
+
+/** called by higher DBUS level (dbus.c) */
+static int
+dbus_usb_iovar_op(void *bus, const char *name,
+       void *params, int plen, void *arg, int len, bool set)
+{
+       int err = DBUS_OK;
+
+       err = dbus_iovar_process((usb_info_t*)bus, name, params, plen, arg, len, set);
+       return err;
+}
+
+/** process iovar request from higher DBUS level */
+static int
+dbus_iovar_process(usb_info_t* usbinfo, const char *name,
+                 void *params, int plen, void *arg, int len, bool set)
+{
+       const bcm_iovar_t *vi = NULL;
+       int bcmerror = 0;
+       int val_size;
+       uint32 actionid;
+
+       DBUSTRACE(("%s: Enter\n", __FUNCTION__));
+
+       ASSERT(name);
+       ASSERT(len >= 0);
+
+       /* Get MUST have return space */
+       ASSERT(set || (arg && len));
+
+       /* Set does NOT take qualifiers */
+       ASSERT(!set || (!params && !plen));
+
+       /* Look up var locally; if not found pass to host driver */
+       if ((vi = bcm_iovar_lookup(dhdusb_iovars, name)) == NULL) {
+               /* Not Supported */
+               bcmerror = BCME_UNSUPPORTED;
+               DBUSTRACE(("%s: IOVAR %s is not supported\n", name, __FUNCTION__));
+               goto exit;
+
+       }
+
+       DBUSTRACE(("%s: %s %s, len %d plen %d\n", __FUNCTION__,
+                name, (set ? "set" : "get"), len, plen));
+
+       /* set up 'params' pointer in case this is a set command so that
+        * the convenience int and bool code can be common to set and get
+        */
+       if (params == NULL) {
+               params = arg;
+               plen = len;
+       }
+
+       if (vi->type == IOVT_VOID)
+               val_size = 0;
+       else if (vi->type == IOVT_BUFFER)
+               val_size = len;
+       else
+               /* all other types are integer sized */
+               val_size = sizeof(int);
+
+       actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+       bcmerror = dbus_usb_doiovar(usbinfo, vi, actionid,
+               name, params, plen, arg, len, val_size);
+
+exit:
+       return bcmerror;
+} /* dbus_iovar_process */
+
+static int
+dbus_usb_doiovar(usb_info_t *bus, const bcm_iovar_t *vi, uint32 actionid, const char *name,
+                void *params, int plen, void *arg, int len, int val_size)
+{
+       int bcmerror = 0;
+       int32 int_val = 0;
+       int32 int_val2 = 0;
+       bool bool_val = 0;
+
+       DBUSTRACE(("%s: Enter, action %d name %s params %p plen %d arg %p len %d val_size %d\n",
+                  __FUNCTION__, actionid, name, params, plen, arg, len, val_size));
+
+       if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid))) != 0)
+               goto exit;
+
+       if (plen >= (int)sizeof(int_val))
+               bcopy(params, &int_val, sizeof(int_val));
+
+       if (plen >= (int)sizeof(int_val) * 2)
+               bcopy((void*)((uintptr)params + sizeof(int_val)), &int_val2, sizeof(int_val2));
+
+       bool_val = (int_val != 0) ? TRUE : FALSE;
+
+       switch (actionid) {
+
+       case IOV_SVAL(IOV_MEMBYTES):
+       case IOV_GVAL(IOV_MEMBYTES):
+       {
+               uint32 address;
+               uint size, dsize;
+               uint8 *data;
+
+               bool set = (actionid == IOV_SVAL(IOV_MEMBYTES));
+
+               ASSERT(plen >= 2*sizeof(int));
+
+               address = (uint32)int_val;
+               BCM_REFERENCE(address);
+               bcopy((char *)params + sizeof(int_val), &int_val, sizeof(int_val));
+               size = (uint)int_val;
+
+               /* Do some validation */
+               dsize = set ? plen - (2 * sizeof(int)) : len;
+               if (dsize < size) {
+                       DBUSTRACE(("%s: error on %s membytes, addr 0x%08x size %d dsize %d\n",
+                                  __FUNCTION__, (set ? "set" : "get"), address, size, dsize));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               DBUSTRACE(("%s: Request to %s %d bytes at address 0x%08x\n", __FUNCTION__,
+                         (set ? "write" : "read"), size, address));
+
+               /* Generate the actual data pointer */
+               data = set ? (uint8*)params + 2 * sizeof(int): (uint8*)arg;
+
+               /* Call to do the transfer */
+               bcmerror = dbus_usb_dl_writeimage(BUS_INFO(bus, usb_info_t), data, size);
+       }
+               break;
+
+
+       case IOV_SVAL(IOV_SET_DOWNLOAD_STATE):
+
+               if (bool_val == TRUE) {
+                       bcmerror = dbus_usb_dlneeded(bus);
+                       dbus_usb_rdl_dwnld_state(BUS_INFO(bus, usb_info_t));
+               } else {
+                       usb_info_t *usbinfo = BUS_INFO(bus, usb_info_t);
+                       bcmerror = dbus_usb_dlrun(bus);
+                       usbinfo->pub->busstate = DBUS_STATE_DL_DONE;
+               }
+               break;
+
+       case IOV_SVAL(IOV_VARS):
+               bcmerror = dhdusb_downloadvars(BUS_INFO(bus, usb_info_t), arg, len);
+               break;
+
+       case IOV_GVAL(IOV_DBUS_MSGLEVEL):
+               int_val = (int32)dbus_msglevel;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DBUS_MSGLEVEL):
+               dbus_msglevel = int_val;
+               break;
+
+#ifdef DBUS_USB_LOOPBACK
+       case IOV_SVAL(IOV_LOOPBACK_TX):
+                       bcmerror = dbus_usbos_loopback_tx(BUS_INFO(bus, usb_info_t), int_val,
+                         int_val2);
+                       break;
+#endif
+       default:
+               bcmerror = BCME_UNSUPPORTED;
+               break;
+       }
+
+exit:
+       return bcmerror;
+} /* dbus_usb_doiovar */
+
+/** higher DBUS level (dbus.c) wants to set NVRAM variables in dongle */
+static int
+dhdusb_downloadvars(usb_info_t *bus, void *arg, int len)
+{
+       int bcmerror = 0;
+       uint32 varsize;
+       uint32 varaddr;
+       uint32 varsizew;
+
+       if (!len) {
+               bcmerror = BCME_BUFTOOSHORT;
+               goto err;
+       }
+
+       /* RAM size is not set. Set it at dbus_usb_dlneeded */
+       if (!bus->rdlram_size)
+               bcmerror = BCME_ERROR;
+
+       /* Even if there are no vars are to be written, we still need to set the ramsize. */
+       varsize = len ? ROUNDUP(len, 4) : 0;
+       varaddr = (bus->rdlram_size - 4) - varsize;
+
+       /* Write the vars list */
+       DBUSTRACE(("WriteVars: @%x varsize=%d\n", varaddr, varsize));
+       bcmerror = dbus_write_membytes(bus->usbosl_info, TRUE, (varaddr + bus->rdlram_base_addr),
+               arg, varsize);
+
+       /* adjust to the user specified RAM */
+       DBUSTRACE(("Usable memory size: %d\n", bus->rdlram_size));
+       DBUSTRACE(("Vars are at %d, orig varsize is %d\n", varaddr, varsize));
+
+       varsize = ((bus->rdlram_size - 4) - varaddr);
+
+       /*
+        * Determine the length token:
+        * Varsize, converted to words, in lower 16-bits, checksum in upper 16-bits.
+        */
+       if (bcmerror) {
+               varsizew = 0;
+       } else {
+               varsizew = varsize / 4;
+               varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
+               varsizew = htol32(varsizew);
+       }
+
+       DBUSTRACE(("New varsize is %d, length token=0x%08x\n", varsize, varsizew));
+
+       /* Write the length token to the last word */
+       bcmerror = dbus_write_membytes(bus->usbosl_info, TRUE, ((bus->rdlram_size - 4) +
+               bus->rdlram_base_addr), (uint8*)&varsizew, 4);
+err:
+       return bcmerror;
+} /* dbus_usb_doiovar */
+
+#if !defined(BCM_REQUEST_FW)
+/**
+ * After downloading firmware into dongle and starting it, we need to know if the firmware is
+ * indeed up and running.
+ */
+static int
+dbus_usb_resetcfg(usb_info_t *usbinfo)
+{
+       void *osinfo;
+       bootrom_id_t id;
+       uint16 waittime = 0;
+
+       uint32 starttime = 0;
+       uint32 endtime = 0;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (usbinfo == NULL)
+               return DBUS_ERR;
+
+       osinfo = usbinfo->usbosl_info;
+       ASSERT(osinfo);
+
+       /* Give dongle chance to boot */
+       dbus_usbos_wait(osinfo, USB_SFLASH_DLIMAGE_SPINWAIT);
+       waittime = USB_SFLASH_DLIMAGE_SPINWAIT;
+       while (waittime < USB_DLIMAGE_RETRY_TIMEOUT) {
+
+               starttime = OSL_SYSUPTIME();
+
+               id.chip = 0xDEAD;       /* Get the ID */
+               dbus_usbos_dl_cmd(osinfo, DL_GETVER, &id, sizeof(bootrom_id_t));
+               id.chip = ltoh32(id.chip);
+
+               endtime = OSL_SYSUPTIME();
+               waittime += (endtime - starttime);
+
+               if (id.chip == POSTBOOT_ID)
+                       break;
+       }
+
+       if (id.chip == POSTBOOT_ID) {
+               DBUSERR(("%s: download done. Bootup time = %d ms postboot chip 0x%x/rev 0x%x\n",
+                       __FUNCTION__, waittime, id.chip, id.chiprev));
+
+               dbus_usbos_dl_cmd(osinfo, DL_RESETCFG, &id, sizeof(bootrom_id_t));
+
+               dbus_usbos_wait(osinfo, USB_RESETCFG_SPINWAIT);
+               return DBUS_OK;
+       } else {
+               DBUSERR(("%s: Cannot talk to Dongle. Wait time = %d ms. Firmware is not UP \n",
+                       __FUNCTION__, waittime));
+               return DBUS_ERR;
+       }
+
+       return DBUS_OK;
+}
+#endif
+
+/** before firmware download, the dongle has to be prepared to receive the fw image */
+static int
+dbus_usb_rdl_dwnld_state(usb_info_t *usbinfo)
+{
+       void *osinfo = usbinfo->usbosl_info;
+       rdl_state_t state;
+       int err = DBUS_OK;
+
+       /* 1) Prepare USB boot loader for runtime image */
+       dbus_usbos_dl_cmd(osinfo, DL_START, &state, sizeof(rdl_state_t));
+
+       state.state = ltoh32(state.state);
+       state.bytes = ltoh32(state.bytes);
+
+       /* 2) Check we are in the Waiting state */
+       if (state.state != DL_WAITING) {
+               DBUSERR(("%s: Failed to DL_START\n", __FUNCTION__));
+               err = DBUS_ERR;
+               goto fail;
+       }
+
+fail:
+       return err;
+}
+
+/**
+ * Dongle contains bootcode in ROM but firmware is (partially) contained in dongle RAM. Therefore,
+ * firmware has to be downloaded into dongle RAM.
+ */
+static int
+dbus_usb_dl_writeimage(usb_info_t *usbinfo, uint8 *fw, int fwlen)
+{
+       osl_t *osh = usbinfo->pub->osh;
+       void *osinfo = usbinfo->usbosl_info;
+       unsigned int sendlen, sent, dllen;
+       char *bulkchunk = NULL, *dlpos;
+       rdl_state_t state;
+       int err = DBUS_OK;
+       bootrom_id_t id;
+       uint16 wait, wait_time;
+       uint32 dl_trunk_size = RDL_CHUNK;
+
+       if (BCM4350_CHIP(usbinfo->pub->attrib.devid))
+               dl_trunk_size = RDL_CHUNK_MAX;
+
+       while (!bulkchunk) {
+               bulkchunk = MALLOC(osh, dl_trunk_size);
+               if (dl_trunk_size == RDL_CHUNK)
+                       break;
+               if (!bulkchunk) {
+                       dl_trunk_size /= 2;
+                       if (dl_trunk_size < RDL_CHUNK)
+                               dl_trunk_size = RDL_CHUNK;
+               }
+       }
+
+       if (bulkchunk == NULL) {
+               err = DBUS_ERR;
+               goto fail;
+       }
+
+       sent = 0;
+       dlpos = fw;
+       dllen = fwlen;
+
+       /* Get chip id and rev */
+       id.chip = usbinfo->pub->attrib.devid;
+       id.chiprev = usbinfo->pub->attrib.chiprev;
+
+       DBUSTRACE(("enter %s: fwlen=%d\n", __FUNCTION__, fwlen));
+
+       dbus_usbos_dl_cmd(osinfo, DL_GETSTATE, &state, sizeof(rdl_state_t));
+
+       /* 3) Load the image */
+       while ((sent < dllen)) {
+               /* Wait until the usb device reports it received all the bytes we sent */
+
+               if (sent < dllen) {
+                       if ((dllen-sent) < dl_trunk_size)
+                               sendlen = dllen-sent;
+                       else
+                               sendlen = dl_trunk_size;
+
+                       /* simply avoid having to send a ZLP by ensuring we never have an even
+                        * multiple of 64
+                        */
+                       if (!(sendlen % 64))
+                               sendlen -= 4;
+
+                       /* send data */
+                       memcpy(bulkchunk, dlpos, sendlen);
+                       if (!dbus_usbos_dl_send_bulk(osinfo, bulkchunk, sendlen)) {
+                               err = DBUS_ERR;
+                               goto fail;
+                       }
+
+                       dlpos += sendlen;
+                       sent += sendlen;
+                       DBUSTRACE(("%s: sendlen %d\n", __FUNCTION__, sendlen));
+               }
+
+               wait = 0;
+               wait_time = USB_SFLASH_DLIMAGE_SPINWAIT;
+               while (!dbus_usbos_dl_cmd(osinfo, DL_GETSTATE, &state,
+                       sizeof(rdl_state_t))) {
+                       if ((id.chip == 43236) && (id.chiprev == 0)) {
+                               DBUSERR(("%s: 43236a0 SFlash delay, waiting for dongle crc check "
+                                        "completion!!!\n", __FUNCTION__));
+                               dbus_usbos_wait(osinfo, wait_time);
+                               wait += wait_time;
+                               if (wait >= USB_SFLASH_DLIMAGE_LIMIT) {
+                                       DBUSERR(("%s: DL_GETSTATE Failed xxxx\n", __FUNCTION__));
+                                       err = DBUS_ERR;
+                                       goto fail;
+                                       break;
+                               }
+                       } else {
+                               DBUSERR(("%s: DL_GETSTATE Failed xxxx\n", __FUNCTION__));
+                               err = DBUS_ERR;
+                               goto fail;
+                       }
+               }
+
+               state.state = ltoh32(state.state);
+               state.bytes = ltoh32(state.bytes);
+
+               /* restart if an error is reported */
+               if ((state.state == DL_BAD_HDR) || (state.state == DL_BAD_CRC)) {
+                       DBUSERR(("%s: Bad Hdr or Bad CRC\n", __FUNCTION__));
+                       err = DBUS_ERR;
+                       goto fail;
+               }
+
+       }
+fail:
+       if (bulkchunk)
+               MFREE(osh, bulkchunk, dl_trunk_size);
+
+       return err;
+} /* dbus_usb_dl_writeimage */
+
+/** Higher level DBUS layer (dbus.c) requests this layer to download image into dongle */
+static int
+dbus_usb_dlstart(void *bus, uint8 *fw, int len)
+{
+       usb_info_t *usbinfo = BUS_INFO(bus, usb_info_t);
+       int err;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (usbinfo == NULL)
+               return DBUS_ERR;
+
+       if (USB_DEV_ISBAD(usbinfo))
+               return DBUS_ERR;
+
+       err = dbus_usb_rdl_dwnld_state(usbinfo);
+
+       if (DBUS_OK == err) {
+               err = dbus_usb_dl_writeimage(usbinfo, fw, len);
+               if (err == DBUS_OK)
+                       usbinfo->pub->busstate = DBUS_STATE_DL_DONE;
+               else
+                       usbinfo->pub->busstate = DBUS_STATE_DL_PENDING;
+       } else
+               usbinfo->pub->busstate = DBUS_STATE_DL_PENDING;
+
+       return err;
+}
+
+static bool
+dbus_usb_update_chipinfo(usb_info_t *usbinfo, uint32 chip)
+{
+       bool retval = TRUE;
+       /* based on the CHIP Id, store the ram size which is needed for NVRAM download. */
+       switch (chip) {
+
+               case 0x4319:
+                       usbinfo->rdlram_size = RDL_RAM_SIZE_4319;
+                       usbinfo->rdlram_base_addr = RDL_RAM_BASE_4319;
+                       break;
+
+               case 0x4329:
+                       usbinfo->rdlram_size = RDL_RAM_SIZE_4329;
+                       usbinfo->rdlram_base_addr = RDL_RAM_BASE_4329;
+                       break;
+
+               case 43234:
+               case 43235:
+               case 43236:
+                       usbinfo->rdlram_size = RDL_RAM_SIZE_43236;
+                       usbinfo->rdlram_base_addr = RDL_RAM_BASE_43236;
+                       break;
+
+               case 0x4328:
+                       usbinfo->rdlram_size = RDL_RAM_SIZE_4328;
+                       usbinfo->rdlram_base_addr = RDL_RAM_BASE_4328;
+                       break;
+
+               case 0x4322:
+                       usbinfo->rdlram_size = RDL_RAM_SIZE_4322;
+                       usbinfo->rdlram_base_addr = RDL_RAM_BASE_4322;
+                       break;
+
+               case 0x4360:
+               case 0xAA06:
+                       usbinfo->rdlram_size = RDL_RAM_SIZE_4360;
+                       usbinfo->rdlram_base_addr = RDL_RAM_BASE_4360;
+                       break;
+
+               case 43242:
+               case 43243:
+                       usbinfo->rdlram_size = RDL_RAM_SIZE_43242;
+                       usbinfo->rdlram_base_addr = RDL_RAM_BASE_43242;
+                       break;
+
+               case 43143:
+                       usbinfo->rdlram_size = RDL_RAM_SIZE_43143;
+                       usbinfo->rdlram_base_addr = RDL_RAM_BASE_43143;
+                       break;
+
+               case 0x4350:
+               case 43556:
+               case 43558:
+               case 43569:
+                       usbinfo->rdlram_size = RDL_RAM_SIZE_4350;
+                       usbinfo->rdlram_base_addr = RDL_RAM_BASE_4350;
+                       break;
+
+               case POSTBOOT_ID:
+                       break;
+
+               default:
+                       DBUSERR(("%s: Chip 0x%x Ram size is not known\n", __FUNCTION__, chip));
+                       retval = FALSE;
+                       break;
+
+       }
+
+       return retval;
+} /* dbus_usb_update_chipinfo */
+
+/** higher DBUS level (dbus.c) wants to know if firmware download is required. */
+static int
+dbus_usb_dlneeded(void *bus)
+{
+       usb_info_t *usbinfo = BUS_INFO(bus, usb_info_t);
+       void *osinfo;
+       bootrom_id_t id;
+       int dl_needed = 1;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (usbinfo == NULL)
+               return DBUS_ERR;
+
+       osinfo = usbinfo->usbosl_info;
+       ASSERT(osinfo);
+
+       /* Check if firmware downloaded already by querying runtime ID */
+       id.chip = 0xDEAD;
+       dbus_usbos_dl_cmd(osinfo, DL_GETVER, &id, sizeof(bootrom_id_t));
+
+       id.chip = ltoh32(id.chip);
+       id.chiprev = ltoh32(id.chiprev);
+
+       if (FALSE == dbus_usb_update_chipinfo(usbinfo, id.chip)) {
+               dl_needed = DBUS_ERR;
+               goto exit;
+       }
+
+       DBUSERR(("%s: chip 0x%x rev 0x%x\n", __FUNCTION__, id.chip, id.chiprev));
+       if (id.chip == POSTBOOT_ID) {
+               /* This code is  needed to support two enumerations on USB1.1 scenario */
+               DBUSERR(("%s: Firmware already downloaded\n", __FUNCTION__));
+
+               dbus_usbos_dl_cmd(osinfo, DL_RESETCFG, &id, sizeof(bootrom_id_t));
+               dl_needed = DBUS_OK;
+               if (usbinfo->pub->busstate == DBUS_STATE_DL_PENDING)
+                       usbinfo->pub->busstate = DBUS_STATE_DL_DONE;
+       } else {
+               usbinfo->pub->attrib.devid = id.chip;
+               usbinfo->pub->attrib.chiprev = id.chiprev;
+       }
+
+exit:
+       return dl_needed;
+}
+
+/** After issuing firmware download, higher DBUS level (dbus.c) wants to start the firmware. */
+static int
+dbus_usb_dlrun(void *bus)
+{
+       usb_info_t *usbinfo = BUS_INFO(bus, usb_info_t);
+       void *osinfo;
+       rdl_state_t state;
+       int err = DBUS_OK;
+
+       DBUSTRACE(("%s\n", __FUNCTION__));
+
+       if (usbinfo == NULL)
+               return DBUS_ERR;
+
+       if (USB_DEV_ISBAD(usbinfo))
+               return DBUS_ERR;
+
+       osinfo = usbinfo->usbosl_info;
+       ASSERT(osinfo);
+
+       /* Check we are runnable */
+       dbus_usbos_dl_cmd(osinfo, DL_GETSTATE, &state, sizeof(rdl_state_t));
+
+       state.state = ltoh32(state.state);
+       state.bytes = ltoh32(state.bytes);
+
+       /* Start the image */
+       if (state.state == DL_RUNNABLE) {
+               DBUSTRACE(("%s: Issue DL_GO\n", __FUNCTION__));
+               dbus_usbos_dl_cmd(osinfo, DL_GO, &state, sizeof(rdl_state_t));
+
+               if (usbinfo->pub->attrib.devid == TEST_CHIP)
+                       dbus_usbos_wait(osinfo, USB_DLGO_SPINWAIT);
+
+//             dbus_usb_resetcfg(usbinfo);
+               /* The Donlge may go for re-enumeration. */
+       } else {
+               DBUSERR(("%s: Dongle not runnable\n", __FUNCTION__));
+               err = DBUS_ERR;
+       }
+
+       return err;
+}
+
+/**
+ * As preparation for firmware download, higher DBUS level (dbus.c) requests the firmware image
+ * to be used for the type of dongle detected. Directly called by dbus.c (so not via a callback
+ * construction)
+ */
+void
+dbus_bus_fw_get(void *bus, uint8 **fw, int *fwlen, int *decomp)
+{
+       usb_info_t *usbinfo = BUS_INFO(bus, usb_info_t);
+       unsigned int devid;
+       unsigned int crev;
+
+       devid = usbinfo->pub->attrib.devid;
+       crev = usbinfo->pub->attrib.chiprev;
+
+       *fw = NULL;
+       *fwlen = 0;
+
+       switch (devid) {
+       case BCM43236_CHIP_ID:
+       case BCM43235_CHIP_ID:
+       case BCM43234_CHIP_ID:
+       case BCM43238_CHIP_ID: {
+               if (crev == 3 || crev == 2 || crev == 1) {
+#ifdef EMBED_IMAGE_43236b
+                       *fw = (uint8 *)dlarray_43236b;
+                       *fwlen = sizeof(dlarray_43236b);
+
+#endif
+               }
+               } break;
+       case BCM4360_CHIP_ID:
+       case BCM4352_CHIP_ID:
+       case BCM43526_CHIP_ID:
+#ifdef EMBED_IMAGE_43526a
+               if (crev <= 2) {
+                       *fw = (uint8 *)dlarray_43526a;
+                       *fwlen = sizeof(dlarray_43526a);
+               }
+#endif
+#ifdef EMBED_IMAGE_43526b
+               if (crev > 2) {
+                       *fw = (uint8 *)dlarray_43526b;
+                       *fwlen = sizeof(dlarray_43526b);
+               }
+#endif
+               break;
+
+       case BCM43242_CHIP_ID:
+#ifdef EMBED_IMAGE_43242a0
+               *fw = (uint8 *)dlarray_43242a0;
+               *fwlen = sizeof(dlarray_43242a0);
+#endif
+               break;
+
+       case BCM43143_CHIP_ID:
+#ifdef EMBED_IMAGE_43143a0
+               *fw = (uint8 *)dlarray_43143a0;
+               *fwlen = sizeof(dlarray_43143a0);
+#endif
+#ifdef EMBED_IMAGE_43143b0
+               *fw = (uint8 *)dlarray_43143b0;
+               *fwlen = sizeof(dlarray_43143b0);
+#endif
+               break;
+
+       case BCM4350_CHIP_ID:
+       case BCM4354_CHIP_ID:
+       case BCM43556_CHIP_ID:
+       case BCM43558_CHIP_ID:
+       case BCM43566_CHIP_ID:
+       case BCM43568_CHIP_ID:
+       case BCM43570_CHIP_ID:
+       case BCM4358_CHIP_ID:
+#ifdef EMBED_IMAGE_4350a0
+               if (crev == 0) {
+                       *fw = (uint8 *)dlarray_4350a0;
+                       *fwlen = sizeof(dlarray_4350a0);
+               }
+#endif
+#ifdef EMBED_IMAGE_4350b0
+               if (crev == 1) {
+                       *fw = (uint8 *)dlarray_4350b0;
+                       *fwlen = sizeof(dlarray_4350b0);
+               }
+#endif
+#ifdef EMBED_IMAGE_4350b1
+               if (crev == 2) {
+                       *fw = (uint8 *)dlarray_4350b1;
+                       *fwlen = sizeof(dlarray_4350b1);
+               }
+#endif
+#ifdef EMBED_IMAGE_43556b1
+               if (crev == 2) {
+                       *fw = (uint8 *)dlarray_43556b1;
+                       *fwlen = sizeof(dlarray_43556b1);
+               }
+#endif
+#ifdef EMBED_IMAGE_4350c0
+               if (crev == 3) {
+                       *fw = (uint8 *)dlarray_4350c0;
+                       *fwlen = sizeof(dlarray_4350c0);
+               }
+#endif /* EMBED_IMAGE_4350c0 */
+#ifdef EMBED_IMAGE_4350c1
+               if (crev == 4) {
+                       *fw = (uint8 *)dlarray_4350c1;
+                       *fwlen = sizeof(dlarray_4350c1);
+               }
+#endif /* EMBED_IMAGE_4350c1 */
+               break;
+       case BCM43569_CHIP_ID:
+#ifdef EMBED_IMAGE_43569a0
+               if (crev == 0) {
+                       *fw = (uint8 *)dlarray_43569a0;
+                       *fwlen = sizeof(dlarray_43569a0);
+               }
+#endif /* EMBED_IMAGE_43569a0 */
+               break;
+       default:
+#ifdef EMBED_IMAGE_GENERIC
+               *fw = (uint8 *)dlarray;
+               *fwlen = sizeof(dlarray);
+#endif
+               break;
+       }
+} /* dbus_bus_fw_get */
diff --git a/bcmdhd.101.10.240.x/dbus_usb_linux.c b/bcmdhd.101.10.240.x/dbus_usb_linux.c
new file mode 100644 (file)
index 0000000..10927d8
--- /dev/null
@@ -0,0 +1,3403 @@
+/*
+ * Dongle BUS interface
+ * USB Linux Implementation
+ *
+ * Copyright (C) 1999-2016, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dbus_usb_linux.c 564663 2015-06-18 02:34:42Z $
+ */
+
+/**
+ * @file @brief
+ * This file contains DBUS code that is USB *and* OS (Linux) specific. DBUS is a Broadcom
+ * proprietary host specific abstraction layer.
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+
+/**
+ * DBUS_LINUX_RXDPC is created for router platform performance tuning. A separate thread is created
+ * to handle USB RX and avoid the call chain getting too long and enhance cache hit rate.
+ *
+ * DBUS_LINUX_RXDPC setting is in wlconfig file.
+ */
+
+/*
+ * If DBUS_LINUX_RXDPC is off, spin_lock_bh() for CTFPOOL in
+ * linux_osl.c has to be changed to spin_lock_irqsave() because
+ * PKTGET/PKTFREE are no longer in bottom half.
+ *
+ * Right now we have another queue rpcq in wl_linux.c. Maybe we
+ * can eliminate that one to reduce the overhead.
+ *
+ * Enabling 2nd EP and DBUS_LINUX_RXDPC causing traffic from
+ * both EP's to be queued in the same rx queue. If we want
+ * RXDPC to work with 2nd EP. The EP for RPC call return
+ * should bypass the dpc and go directly up.
+ */
+
+/* #define DBUS_LINUX_RXDPC */
+
+/* Dbus histogram for ntxq, nrxq, dpc parameter tuning */
+/* #define DBUS_LINUX_HIST */
+
+#include <usbrdl.h>
+#include <bcmendian.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/usb.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/random.h>
+#include <linux/spinlock.h>
+#include <linux/list.h>
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+#include <dbus.h>
+#include <bcmutils.h>
+#include <bcmdevs.h>
+#include <linux/usb.h>
+#include <usbrdl.h>
+#include <linux/firmware.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+
+#if defined(USBOS_THREAD) || defined(USBOS_TX_THREAD)
+
+/**
+ * The usb-thread is designed to provide currency on multiprocessors and SMP linux kernels. On the
+ * dual cores platform, the WLAN driver, without threads, executed only on CPU0. The driver consumed
+ * almost of 100% on CPU0, while CPU1 remained idle. The behavior was observed on Broadcom's STB.
+ *
+ * The WLAN driver consumed most of CPU0 and not CPU1 because tasklets/queues, software irq, and
+ * hardware irq are executing from CPU0, only. CPU0 became the system's bottle-neck. TPUT is lower
+ * and system's responsiveness is slower.
+ *
+ * To improve system responsiveness and TPUT usb-thread was implemented. The system's threads could
+ * be scheduled to run on any core. One core could be processing data in the usb-layer and the other
+ * core could be processing data in the wl-layer.
+ *
+ * For further info see [WlThreadAndUsbThread] Twiki.
+ */
+
+#include <linux/kthread.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <asm/hardirq.h>
+#include <linux/list.h>
+#include <linux_osl.h>
+#endif /* USBOS_THREAD || USBOS_TX_THREAD */
+
+
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#define KERNEL26
+#endif
+
+/**
+ * Starting with the 3.10 kernel release, dynamic PM support for USB is present whenever
+ * the kernel was built with CONFIG_PM_RUNTIME enabled. The CONFIG_USB_SUSPEND option has
+ * been eliminated.
+ */
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 21)) && defined(CONFIG_USB_SUSPEND)) \
+       || ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)) && defined(CONFIG_PM_RUNTIME))
+/* For USB power management support, see Linux kernel: Documentation/usb/power-management.txt */
+#define USB_SUSPEND_AVAILABLE
+#endif
+
+/* Define alternate fw/nvram paths used in Android */
+#ifdef OEM_ANDROID
+#define CONFIG_ANDROID_BCMDHD_FW_PATH "broadcom/dhd/firmware/fw.bin.trx"
+#define CONFIG_ANDROID_BCMDHD_NVRAM_PATH "broadcom/dhd/nvrams/nvm.txt"
+#endif /* OEM_ANDROID */
+
+static inline int usb_submit_urb_linux(struct urb *urb)
+{
+
+#ifdef BCM_MAX_URB_LEN
+       if (urb && (urb->transfer_buffer_length > BCM_MAX_URB_LEN)) {
+               DBUSERR(("URB transfer length=%d exceeded %d ra=%p\n", urb->transfer_buffer_length,
+               BCM_MAX_URB_LEN, __builtin_return_address(0)));
+               return DBUS_ERR;
+       }
+#endif
+
+#ifdef KERNEL26
+       return usb_submit_urb(urb, GFP_ATOMIC);
+#else
+       return usb_submit_urb(urb);
+#endif
+
+}
+
+#define USB_SUBMIT_URB(urb) usb_submit_urb_linux(urb)
+
+#ifdef KERNEL26
+
+#define USB_ALLOC_URB()                                usb_alloc_urb(0, GFP_ATOMIC)
+#define USB_UNLINK_URB(urb)                    (usb_kill_urb(urb))
+#define USB_FREE_URB(urb)                      (usb_free_urb(urb))
+#define USB_REGISTER()                         usb_register(&dbus_usbdev)
+#define USB_DEREGISTER()                       usb_deregister(&dbus_usbdev)
+
+#ifdef USB_SUSPEND_AVAILABLE
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 33))
+#define USB_AUTOPM_SET_INTERFACE(intf)         usb_autopm_set_interface(intf)
+#else
+#define USB_ENABLE_AUTOSUSPEND(udev)           usb_enable_autosuspend(udev)
+#define USB_DISABLE_AUTOSUSPEND(udev)       usb_disable_autosuspend(udev)
+#endif  /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 33))  */
+
+#define USB_AUTOPM_GET_INTERFACE(intf)         usb_autopm_get_interface(intf)
+#define USB_AUTOPM_PUT_INTERFACE(intf)         usb_autopm_put_interface(intf)
+#define USB_AUTOPM_GET_INTERFACE_ASYNC(intf)   usb_autopm_get_interface_async(intf)
+#define USB_AUTOPM_PUT_INTERFACE_ASYNC(intf)   usb_autopm_put_interface_async(intf)
+#define USB_MARK_LAST_BUSY(dev)                        usb_mark_last_busy(dev)
+
+#else /* USB_SUSPEND_AVAILABLE */
+
+#define USB_AUTOPM_GET_INTERFACE(intf)         do {} while (0)
+#define USB_AUTOPM_PUT_INTERFACE(intf)         do {} while (0)
+#define USB_AUTOPM_GET_INTERFACE_ASYNC(intf)   do {} while (0)
+#define USB_AUTOPM_PUT_INTERFACE_ASYNC(intf)   do {} while (0)
+#define USB_MARK_LAST_BUSY(dev)                        do {} while (0)
+#endif /* USB_SUSPEND_AVAILABLE */
+
+#define USB_CONTROL_MSG(dev, pipe, request, requesttype, value, index, data, size, timeout) \
+       usb_control_msg((dev), (pipe), (request), (requesttype), (value), (index), \
+       (data), (size), (timeout))
+#define USB_BULK_MSG(dev, pipe, data, len, actual_length, timeout) \
+       usb_bulk_msg((dev), (pipe), (data), (len), (actual_length), (timeout))
+#define USB_BUFFER_ALLOC(dev, size, mem, dma)  usb_buffer_alloc(dev, size, mem, dma)
+#define USB_BUFFER_FREE(dev, size, data, dma)  usb_buffer_free(dev, size, data, dma)
+
+#ifdef WL_URB_ZPKT
+#define URB_QUEUE_BULK   URB_ZERO_PACKET
+#else
+#define URB_QUEUE_BULK   0
+#endif /* WL_URB_ZPKT */
+
+#define CALLBACK_ARGS          struct urb *urb, struct pt_regs *regs
+#define CALLBACK_ARGS_DATA     urb, regs
+#define CONFIGDESC(usb)                (&((usb)->actconfig)->desc)
+#define IFPTR(usb, idx)                ((usb)->actconfig->interface[idx])
+#define IFALTS(usb, idx)       (IFPTR((usb), (idx))->altsetting[0])
+#define IFDESC(usb, idx)       IFALTS((usb), (idx)).desc
+#define IFEPDESC(usb, idx, ep) (IFALTS((usb), (idx)).endpoint[ep]).desc
+
+#else /* KERNEL26 */
+
+#define USB_ALLOC_URB()                                usb_alloc_urb(0)
+#define USB_UNLINK_URB(urb)                    usb_unlink_urb(urb)
+#define USB_FREE_URB(urb)                      (usb_free_urb(urb))
+#define USB_REGISTER()                         usb_register(&dbus_usbdev)
+#define USB_DEREGISTER()                       usb_deregister(&dbus_usbdev)
+#define USB_AUTOPM_GET_INTERFACE(intf)         do {} while (0)
+#define USB_AUTOPM_GET_INTERFACE_ASYNC(intf)   do {} while (0)
+#define USB_AUTOPM_PUT_INTERFACE_ASYNC(intf)   do {} while (0)
+#define USB_MARK_LAST_BUSY(dev)                        do {} while (0)
+
+#define USB_CONTROL_MSG(dev, pipe, request, requesttype, value, index, data, size, timeout) \
+       usb_control_msg((dev), (pipe), (request), (requesttype), (value), (index), \
+       (data), (size), (timeout))
+#define USB_BUFFER_ALLOC(dev, size, mem, dma)  kmalloc(size, mem)
+#define USB_BUFFER_FREE(dev, size, data, dma)  kfree(data)
+
+#ifdef WL_URB_ZPKT
+#define URB_QUEUE_BULK   USB_QUEUE_BULK|URB_ZERO_PACKET
+#else
+#define URB_QUEUE_BULK   0
+#endif /*  WL_URB_ZPKT */
+
+#define CALLBACK_ARGS          struct urb *urb
+#define CALLBACK_ARGS_DATA     urb
+#define CONFIGDESC(usb)                ((usb)->actconfig)
+#define IFPTR(usb, idx)                (&(usb)->actconfig->interface[idx])
+#define IFALTS(usb, idx)       ((usb)->actconfig->interface[idx].altsetting[0])
+#define IFDESC(usb, idx)       IFALTS((usb), (idx))
+#define IFEPDESC(usb, idx, ep) (IFALTS((usb), (idx)).endpoint[ep])
+
+
+#endif /* KERNEL26 */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31))
+#define USB_SPEED_SUPER                5
+#endif  /* #if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)) */
+
+#define CONTROL_IF   0
+#define BULK_IF      0
+
+#ifdef BCMUSBDEV_COMPOSITE
+#define USB_COMPIF_MAX       4
+
+#define USB_CLASS_WIRELESS     0xe0
+#define USB_CLASS_MISC         0xef
+#define USB_SUBCLASS_COMMON    0x02
+#define USB_PROTO_IAD          0x01
+#define USB_PROTO_VENDOR       0xff
+
+#define USB_QUIRK_NO_SET_INTF   0x04 /* device does not support set_interface */
+#endif /* BCMUSBDEV_COMPOSITE */
+
+#define USB_SYNC_WAIT_TIMEOUT  300  /* ms */
+
+/* Private data kept in skb */
+#define SKB_PRIV(skb, idx)  (&((void **)skb->cb)[idx])
+#define SKB_PRIV_URB(skb)   (*(struct urb **)SKB_PRIV(skb, 0))
+
+#ifndef DBUS_USB_RXQUEUE_BATCH_ADD
+/* items to add each time within limit */
+#define DBUS_USB_RXQUEUE_BATCH_ADD            8
+#endif
+
+#ifndef DBUS_USB_RXQUEUE_LOWER_WATERMARK
+/* add a new batch req to rx queue when waiting item count reduce to this number */
+#define DBUS_USB_RXQUEUE_LOWER_WATERMARK      4
+#endif
+
+enum usbos_suspend_state {
+       USBOS_SUSPEND_STATE_DEVICE_ACTIVE = 0, /* Device is busy, won't allow suspend */
+       USBOS_SUSPEND_STATE_SUSPEND_PENDING,   /* Device is idle, can be suspended */
+                                              /* Wating PM to suspend */
+       USBOS_SUSPEND_STATE_SUSPENDED          /* Device suspended */
+};
+
+enum usbos_request_state {
+       USBOS_REQUEST_STATE_UNSCHEDULED = 0,    /* USB TX request not scheduled */
+       USBOS_REQUEST_STATE_SCHEDULED,          /* USB TX request given to TX thread */
+       USBOS_REQUEST_STATE_SUBMITTED           /* USB TX request submitted */
+};
+
+typedef struct {
+       uint32 notification;
+       uint32 reserved;
+} intr_t;
+
+typedef struct {
+       dbus_pub_t *pub;
+
+       void *cbarg;
+       dbus_intf_callbacks_t *cbs;
+
+       /* Imported */
+       struct usb_device *usb; /* USB device pointer from OS */
+       struct urb *intr_urb; /* URB for interrupt endpoint */
+       struct list_head req_rxfreeq;
+       struct list_head req_txfreeq;
+       struct list_head req_rxpostedq; /* Posted down to USB driver for RX */
+       struct list_head req_txpostedq; /* Posted down to USB driver for TX */
+       spinlock_t rxfree_lock; /* Lock for rx free list */
+       spinlock_t txfree_lock; /* Lock for tx free list */
+       spinlock_t rxposted_lock; /* Lock for rx posted list */
+       spinlock_t txposted_lock; /* Lock for tx posted list */
+       uint rx_pipe, tx_pipe, intr_pipe, rx_pipe2; /* Pipe numbers for USB I/O */
+       uint rxbuf_len;
+
+       struct list_head req_rxpendingq; /* RXDPC: Pending for dpc to send up */
+       spinlock_t rxpending_lock;      /* RXDPC: Lock for rx pending list */
+       long dpc_pid;
+       struct semaphore dpc_sem;
+       struct completion dpc_exited;
+       int rxpending;
+
+       struct urb               *ctl_urb;
+       int                      ctl_in_pipe, ctl_out_pipe;
+       struct usb_ctrlrequest   ctl_write;
+       struct usb_ctrlrequest   ctl_read;
+       struct semaphore         ctl_lock;     /* Lock for CTRL transfers via tx_thread */
+#ifdef USBOS_TX_THREAD
+       enum usbos_request_state ctl_state;
+#endif /* USBOS_TX_THREAD */
+
+       spinlock_t rxlock;      /* Lock for rxq management */
+       spinlock_t txlock;      /* Lock for txq management */
+
+       int intr_size;          /* Size of interrupt message */
+       int interval;           /* Interrupt polling interval */
+       intr_t intr;            /* Data buffer for interrupt endpoint */
+
+       int maxps;
+       atomic_t txposted;
+       atomic_t rxposted;
+       atomic_t txallocated;
+       atomic_t rxallocated;
+       bool rxctl_deferrespok; /* Get a response for setup from dongle */
+
+       wait_queue_head_t wait;
+       bool waitdone;
+       int sync_urb_status;
+
+       struct urb *blk_urb; /* Used for downloading embedded image */
+
+#ifdef USBOS_THREAD
+       spinlock_t              ctrl_lock;
+       spinlock_t              usbos_list_lock;
+       struct list_head        usbos_list;
+       struct list_head        usbos_free_list;
+       atomic_t                usbos_list_cnt;
+       wait_queue_head_t       usbos_queue_head;
+       struct task_struct      *usbos_kt;
+#endif /* USBOS_THREAD */
+
+#ifdef USBOS_TX_THREAD
+       spinlock_t              usbos_tx_list_lock;
+       struct list_head        usbos_tx_list;
+       wait_queue_head_t       usbos_tx_queue_head;
+       struct task_struct      *usbos_tx_kt;
+#endif /* USBOS_TX_THREAD */
+
+       struct dma_pool *qtd_pool; /* QTD pool for USB optimization only */
+       int tx_ep, rx_ep, rx2_ep;  /* EPs for USB optimization */
+       struct usb_device *usb_device; /* USB device for optimization */
+} usbos_info_t;
+
+typedef struct urb_req {
+       void         *pkt;
+       int          buf_len;
+       struct urb   *urb;
+       void         *arg;
+       usbos_info_t *usbinfo;
+       struct list_head urb_list;
+} urb_req_t;
+
+#ifdef USBOS_THREAD
+typedef struct usbos_list_entry {
+       struct list_head    list;   /* must be first */
+       void               *urb_context;
+       int                 urb_length;
+       int                 urb_status;
+} usbos_list_entry_t;
+
+static void* dbus_usbos_thread_init(usbos_info_t *usbos_info);
+static void  dbus_usbos_thread_deinit(usbos_info_t *usbos_info);
+static void  dbus_usbos_dispatch_schedule(CALLBACK_ARGS);
+static int   dbus_usbos_thread_func(void *data);
+#endif /* USBOS_THREAD */
+
+#ifdef USBOS_TX_THREAD
+void* dbus_usbos_tx_thread_init(usbos_info_t *usbos_info);
+void  dbus_usbos_tx_thread_deinit(usbos_info_t *usbos_info);
+int   dbus_usbos_tx_thread_func(void *data);
+#endif /* USBOS_TX_THREAD */
+
+/* Shared Function prototypes */
+bool dbus_usbos_dl_cmd(usbos_info_t *usbinfo, uint8 cmd, void *buffer, int buflen);
+int dbus_usbos_wait(usbos_info_t *usbinfo, uint16 ms);
+bool dbus_usbos_dl_send_bulk(usbos_info_t *usbinfo, void *buffer, int len);
+int dbus_write_membytes(usbos_info_t *usbinfo, bool set, uint32 address, uint8 *data, uint size);
+
+/* Local function prototypes */
+static void dbus_usbos_send_complete(CALLBACK_ARGS);
+static void dbus_usbos_recv_complete(CALLBACK_ARGS);
+static int  dbus_usbos_errhandler(void *bus, int err);
+static int  dbus_usbos_state_change(void *bus, int state);
+static void dbusos_stop(usbos_info_t *usbos_info);
+
+#ifdef KERNEL26
+static int dbus_usbos_probe(struct usb_interface *intf, const struct usb_device_id *id);
+static void dbus_usbos_disconnect(struct usb_interface *intf);
+#if defined(USB_SUSPEND_AVAILABLE)
+static int dbus_usbos_resume(struct usb_interface *intf);
+static int dbus_usbos_suspend(struct usb_interface *intf, pm_message_t message);
+/* at the moment, used for full dongle host driver only */
+static int dbus_usbos_reset_resume(struct usb_interface *intf);
+#endif /* USB_SUSPEND_AVAILABLE */
+#else /* KERNEL26 */
+static void *dbus_usbos_probe(struct usb_device *usb, unsigned int ifnum,
+       const struct usb_device_id *id);
+static void dbus_usbos_disconnect(struct usb_device *usb, void *ptr);
+#endif /* KERNEL26 */
+
+
+/**
+ * have to disable missing-field-initializers warning as last element {} triggers it
+ * and different versions of kernel have different number of members so it is impossible
+ * to specify the initializer. BTW issuing the warning here is bug og GCC as  universal
+ * zero {0} specified in C99 standard as correct way of initialization of struct to all zeros
+ */
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wmissing-field-initializers"
+#endif
+
+static struct usb_device_id devid_table[] = {
+       { USB_DEVICE(BCM_DNGL_VID, 0x0000) }, /* Configurable via register() */
+#if defined(BCM_REQUEST_FW)
+       { USB_DEVICE(BCM_DNGL_VID, BCM_DNGL_BL_PID_4328) },
+       { USB_DEVICE(BCM_DNGL_VID, BCM_DNGL_BL_PID_4322) },
+       { USB_DEVICE(BCM_DNGL_VID, BCM_DNGL_BL_PID_4319) },
+       { USB_DEVICE(BCM_DNGL_VID, BCM_DNGL_BL_PID_43236) },
+       { USB_DEVICE(BCM_DNGL_VID, BCM_DNGL_BL_PID_43143) },
+       { USB_DEVICE(BCM_DNGL_VID, BCM_DNGL_BL_PID_43242) },
+       { USB_DEVICE(BCM_DNGL_VID, BCM_DNGL_BL_PID_4360) },
+       { USB_DEVICE(BCM_DNGL_VID, BCM_DNGL_BL_PID_4350) },
+       { USB_DEVICE(BCM_DNGL_VID, BCM_DNGL_BL_PID_43569) },
+#endif
+#ifdef EXTENDED_VID_PID
+       EXTENDED_VID_PID,
+#endif /* EXTENDED_VID_PID */
+       { USB_DEVICE(BCM_DNGL_VID, BCM_DNGL_BDC_PID) }, /* Default BDC */
+       { }
+};
+
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+#pragma GCC diagnostic pop
+#endif
+
+MODULE_DEVICE_TABLE(usb, devid_table);
+
+/** functions called by the Linux kernel USB subsystem */
+static struct usb_driver dbus_usbdev = {
+       name:           "dbus_usbdev",
+       probe:          dbus_usbos_probe,
+       disconnect:     dbus_usbos_disconnect,
+       id_table:       devid_table,
+#if defined(USB_SUSPEND_AVAILABLE)
+       suspend:        dbus_usbos_suspend,
+       resume:         dbus_usbos_resume,
+       reset_resume:   dbus_usbos_reset_resume,
+       /* Linux USB core will allow autosuspend for devices bound to this driver */
+       supports_autosuspend: 1
+#endif /* USB_SUSPEND_AVAILABLE */
+};
+
+/**
+ * This stores USB info during Linux probe callback since attach() is not called yet at this point
+ */
+typedef struct {
+       void    *usbos_info;
+       struct usb_device *usb; /* USB device pointer from OS */
+       uint    rx_pipe;   /* Pipe numbers for USB I/O */
+       uint    tx_pipe;   /* Pipe numbers for USB I/O */
+       uint    intr_pipe; /* Pipe numbers for USB I/O */
+       uint    rx_pipe2;  /* Pipe numbers for USB I/O */
+       int     intr_size; /* Size of interrupt message */
+       int     interval;  /* Interrupt polling interval */
+       bool    dldone;
+       int     vid;
+       int     pid;
+       bool    dereged;
+       bool    disc_cb_done;
+       DEVICE_SPEED    device_speed;
+       enum usbos_suspend_state suspend_state;
+       struct usb_interface     *intf;
+} probe_info_t;
+
+/*
+ * USB Linux dbus_intf_t
+ */
+static void *dbus_usbos_intf_attach(dbus_pub_t *pub, void *cbarg, dbus_intf_callbacks_t *cbs);
+static void dbus_usbos_intf_detach(dbus_pub_t *pub, void *info);
+static int  dbus_usbos_intf_send_irb(void *bus, dbus_irb_tx_t *txirb);
+static int  dbus_usbos_intf_recv_irb(void *bus, dbus_irb_rx_t *rxirb);
+static int  dbus_usbos_intf_recv_irb_from_ep(void *bus, dbus_irb_rx_t *rxirb, uint32 ep_idx);
+static int  dbus_usbos_intf_cancel_irb(void *bus, dbus_irb_tx_t *txirb);
+static int  dbus_usbos_intf_send_ctl(void *bus, uint8 *buf, int len);
+static int  dbus_usbos_intf_recv_ctl(void *bus, uint8 *buf, int len);
+static int  dbus_usbos_intf_get_attrib(void *bus, dbus_attrib_t *attrib);
+static int  dbus_usbos_intf_up(void *bus);
+static int  dbus_usbos_intf_down(void *bus);
+static int  dbus_usbos_intf_stop(void *bus);
+static int  dbus_usbos_readreg(void *bus, uint32 regaddr, int datalen, uint32 *value);
+extern int dbus_usbos_loopback_tx(void *usbos_info_ptr, int cnt, int size);
+int dbus_usbos_writereg(void *bus, uint32 regaddr, int datalen, uint32 data);
+static int  dbus_usbos_intf_set_config(void *bus, dbus_config_t *config);
+static bool dbus_usbos_intf_recv_needed(void *bus);
+static void *dbus_usbos_intf_exec_rxlock(void *bus, exec_cb_t cb, struct exec_parms *args);
+static void *dbus_usbos_intf_exec_txlock(void *bus, exec_cb_t cb, struct exec_parms *args);
+#ifdef BCMUSBDEV_COMPOSITE
+static int dbus_usbos_intf_wlan(struct usb_device *usb);
+#endif /* BCMUSBDEV_COMPOSITE */
+
+/** functions called by dbus_usb.c */
+static dbus_intf_t dbus_usbos_intf = {
+       .attach = dbus_usbos_intf_attach,
+       .detach = dbus_usbos_intf_detach,
+       .up = dbus_usbos_intf_up,
+       .down = dbus_usbos_intf_down,
+       .send_irb = dbus_usbos_intf_send_irb,
+       .recv_irb = dbus_usbos_intf_recv_irb,
+       .cancel_irb = dbus_usbos_intf_cancel_irb,
+       .send_ctl = dbus_usbos_intf_send_ctl,
+       .recv_ctl = dbus_usbos_intf_recv_ctl,
+       .get_stats = NULL,
+       .get_attrib = dbus_usbos_intf_get_attrib,
+       .remove = NULL,
+       .resume = NULL,
+       .suspend = NULL,
+       .stop = dbus_usbos_intf_stop,
+       .reset = NULL,
+       .pktget = NULL,
+       .pktfree = NULL,
+       .iovar_op = NULL,
+       .dump = NULL,
+       .set_config = dbus_usbos_intf_set_config,
+       .get_config = NULL,
+       .device_exists = NULL,
+       .dlneeded = NULL,
+       .dlstart = NULL,
+       .dlrun = NULL,
+       .recv_needed = dbus_usbos_intf_recv_needed,
+       .exec_rxlock = dbus_usbos_intf_exec_rxlock,
+       .exec_txlock = dbus_usbos_intf_exec_txlock,
+
+       .tx_timer_init = NULL,
+       .tx_timer_start = NULL,
+       .tx_timer_stop = NULL,
+
+       .sched_dpc = NULL,
+       .lock = NULL,
+       .unlock = NULL,
+       .sched_probe_cb = NULL,
+
+       .shutdown = NULL,
+
+       .recv_stop = NULL,
+       .recv_resume = NULL,
+
+       .recv_irb_from_ep = dbus_usbos_intf_recv_irb_from_ep,
+       .readreg = dbus_usbos_readreg
+};
+
+static probe_info_t    g_probe_info;
+static probe_cb_t      probe_cb = NULL;
+static disconnect_cb_t disconnect_cb = NULL;
+static void            *probe_arg = NULL;
+static void            *disc_arg = NULL;
+
+
+
+static volatile int loopback_rx_cnt, loopback_tx_cnt;
+int loopback_size;
+bool is_loopback_pkt(void *buf);
+int matches_loopback_pkt(void *buf);
+
+/**
+ * multiple code paths in this file dequeue a URB request, this function makes sure that it happens
+ * in a concurrency save manner. Don't call this from a sleepable process context.
+ */
+static urb_req_t * BCMFASTPATH
+dbus_usbos_qdeq(struct list_head *urbreq_q, spinlock_t *lock)
+{
+       unsigned long flags;
+       urb_req_t *req;
+
+       ASSERT(urbreq_q != NULL);
+
+       spin_lock_irqsave(lock, flags);
+
+       if (list_empty(urbreq_q)) {
+               req = NULL;
+       } else {
+               ASSERT(urbreq_q->next != NULL);
+               ASSERT(urbreq_q->next != urbreq_q);
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wcast-qual"
+#endif
+               req = list_entry(urbreq_q->next, urb_req_t, urb_list);
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+               list_del_init(&req->urb_list);
+       }
+
+       spin_unlock_irqrestore(lock, flags);
+
+       return req;
+}
+
+static void BCMFASTPATH
+dbus_usbos_qenq(struct list_head *urbreq_q, urb_req_t *req, spinlock_t *lock)
+{
+       unsigned long flags;
+
+       spin_lock_irqsave(lock, flags);
+
+       list_add_tail(&req->urb_list, urbreq_q);
+
+       spin_unlock_irqrestore(lock, flags);
+}
+
+/**
+ * multiple code paths in this file remove a URB request from a list, this function makes sure that
+ * it happens in a concurrency save manner. Don't call this from a sleepable process context.
+ * Is quite similar to dbus_usbos_qdeq(), I wonder why this function is needed.
+ */
+static void
+dbus_usbos_req_del(urb_req_t *req, spinlock_t *lock)
+{
+       unsigned long flags;
+
+       spin_lock_irqsave(lock, flags);
+
+       list_del_init(&req->urb_list);
+
+       spin_unlock_irqrestore(lock, flags);
+}
+
+
+/**
+ * Driver requires a pool of URBs to operate. This function is called during
+ * initialization (attach phase), allocates a number of URBs, and puts them
+ * on the free (req_rxfreeq and req_txfreeq) queue
+ */
+static int
+dbus_usbos_urbreqs_alloc(usbos_info_t *usbos_info, uint32 count, bool is_rx)
+{
+       int i;
+       int allocated = 0;
+       int err = DBUS_OK;
+
+       for (i = 0; i < count; i++) {
+               urb_req_t *req;
+
+               req = MALLOC(usbos_info->pub->osh, sizeof(urb_req_t));
+               if (req == NULL) {
+                       DBUSERR(("%s: MALLOC req failed\n", __FUNCTION__));
+                       err = DBUS_ERR_NOMEM;
+                       goto fail;
+               }
+               bzero(req, sizeof(urb_req_t));
+
+               req->urb = USB_ALLOC_URB();
+               if (req->urb == NULL) {
+                       DBUSERR(("%s: USB_ALLOC_URB req->urb failed\n", __FUNCTION__));
+                       err = DBUS_ERR_NOMEM;
+                       goto fail;
+               }
+
+               INIT_LIST_HEAD(&req->urb_list);
+
+               if (is_rx) {
+#if defined(BCM_RPC_NOCOPY) || defined(BCM_RPC_RXNOCOPY)
+                       /* don't allocate now. Do it on demand */
+                       req->pkt = NULL;
+#else
+                       /* pre-allocate  buffers never to be released */
+                       req->pkt = MALLOC(usbos_info->pub->osh, usbos_info->rxbuf_len);
+                       if (req->pkt == NULL) {
+                               DBUSERR(("%s: MALLOC req->pkt failed\n", __FUNCTION__));
+                               err = DBUS_ERR_NOMEM;
+                               goto fail;
+                       }
+#endif
+                       req->buf_len = usbos_info->rxbuf_len;
+                       dbus_usbos_qenq(&usbos_info->req_rxfreeq, req, &usbos_info->rxfree_lock);
+               } else {
+                       req->buf_len = 0;
+                       dbus_usbos_qenq(&usbos_info->req_txfreeq, req, &usbos_info->txfree_lock);
+               }
+               allocated++;
+               continue;
+
+fail:
+               if (req) {
+                       if (is_rx && req->pkt) {
+#if defined(BCM_RPC_NOCOPY) || defined(BCM_RPC_RXNOCOPY)
+                               /* req->pkt is NULL in "NOCOPY" mode */
+#else
+                               MFREE(usbos_info->pub->osh, req->pkt, req->buf_len);
+#endif
+                       }
+                       if (req->urb) {
+                               USB_FREE_URB(req->urb);
+                       }
+                       MFREE(usbos_info->pub->osh, req, sizeof(urb_req_t));
+               }
+               break;
+       }
+
+       atomic_add(allocated, is_rx ? &usbos_info->rxallocated : &usbos_info->txallocated);
+
+       if (is_rx) {
+               DBUSTRACE(("%s: add %d (total %d) rx buf, each has %d bytes\n", __FUNCTION__,
+                       allocated, atomic_read(&usbos_info->rxallocated), usbos_info->rxbuf_len));
+       } else {
+               DBUSTRACE(("%s: add %d (total %d) tx req\n", __FUNCTION__,
+                       allocated, atomic_read(&usbos_info->txallocated)));
+       }
+
+       return err;
+} /* dbus_usbos_urbreqs_alloc */
+
+/** Typically called during detach or when attach failed. Don't call until all URBs unlinked */
+static int
+dbus_usbos_urbreqs_free(usbos_info_t *usbos_info, bool is_rx)
+{
+       int rtn = 0;
+       urb_req_t *req;
+       struct list_head *req_q;
+       spinlock_t *lock;
+
+       if (is_rx) {
+               req_q = &usbos_info->req_rxfreeq;
+               lock = &usbos_info->rxfree_lock;
+       } else {
+               req_q = &usbos_info->req_txfreeq;
+               lock = &usbos_info->txfree_lock;
+       }
+       while ((req = dbus_usbos_qdeq(req_q, lock)) != NULL) {
+
+               if (is_rx) {
+                       if (req->pkt) {
+                               /* We do MFREE instead of PKTFREE because the pkt has been
+                                * converted to native already
+                                */
+                               MFREE(usbos_info->pub->osh, req->pkt, req->buf_len);
+                               req->pkt = NULL;
+                               req->buf_len = 0;
+                       }
+               } else {
+                       /* sending req should not be assigned pkt buffer */
+                       ASSERT(req->pkt == NULL);
+               }
+
+               if (req->urb) {
+                       USB_FREE_URB(req->urb);
+                       req->urb = NULL;
+               }
+               MFREE(usbos_info->pub->osh, req, sizeof(urb_req_t));
+
+               rtn++;
+       }
+       return rtn;
+} /* dbus_usbos_urbreqs_free */
+
+/**
+ * called by Linux kernel on URB completion. Upper DBUS layer (dbus_usb.c) has to be notified of
+ * send completion.
+ */
+void
+dbus_usbos_send_complete(CALLBACK_ARGS)
+{
+       urb_req_t *req = urb->context;
+       dbus_irb_tx_t *txirb = req->arg;
+       usbos_info_t *usbos_info = req->usbinfo;
+       unsigned long flags;
+       int status = DBUS_OK;
+       int txposted;
+
+       USB_AUTOPM_PUT_INTERFACE_ASYNC(g_probe_info.intf);
+
+       spin_lock_irqsave(&usbos_info->txlock, flags);
+
+       dbus_usbos_req_del(req, &usbos_info->txposted_lock);
+       txposted = atomic_dec_return(&usbos_info->txposted);
+       if (unlikely (txposted < 0)) {
+               DBUSERR(("%s ERROR: txposted is negative (%d)!!\n", __FUNCTION__, txposted));
+       }
+       spin_unlock_irqrestore(&usbos_info->txlock, flags);
+
+       if (unlikely (urb->status)) {
+               status = DBUS_ERR_TXFAIL;
+               DBUSTRACE(("txfail status %d\n", urb->status));
+       }
+
+#if defined(BCM_RPC_NOCOPY) || defined(BCM_RPC_RXNOCOPY)
+       /* sending req should not be assigned pkt buffer */
+       ASSERT(req->pkt == NULL);
+#endif
+       /*  txirb should always be set, except for ZLP. ZLP is reusing this callback function. */
+       if (txirb != NULL) {
+               if (txirb->send_buf != NULL) {
+                       MFREE(usbos_info->pub->osh, txirb->send_buf, req->buf_len);
+                       txirb->send_buf = NULL;
+                       req->buf_len = 0;
+               }
+               if (likely (usbos_info->cbarg && usbos_info->cbs)) {
+                       if (likely (usbos_info->cbs->send_irb_complete != NULL))
+                           usbos_info->cbs->send_irb_complete(usbos_info->cbarg, txirb, status);
+               }
+       }
+
+       dbus_usbos_qenq(&usbos_info->req_txfreeq, req, &usbos_info->txfree_lock);
+} /* dbus_usbos_send_complete */
+
+/**
+ * In order to receive USB traffic from the dongle, we need to supply the Linux kernel with a free
+ * URB that is going to contain received data.
+ */
+static int BCMFASTPATH
+dbus_usbos_recv_urb_submit(usbos_info_t *usbos_info, dbus_irb_rx_t *rxirb, uint32 ep_idx)
+{
+       urb_req_t *req;
+       int ret = DBUS_OK;
+       unsigned long flags;
+       void *p;
+       uint rx_pipe;
+       int rxposted;
+
+       BCM_REFERENCE(rxposted);
+
+       if (!(req = dbus_usbos_qdeq(&usbos_info->req_rxfreeq, &usbos_info->rxfree_lock))) {
+               DBUSTRACE(("%s No free URB!\n", __FUNCTION__));
+               return DBUS_ERR_RXDROP;
+       }
+
+       spin_lock_irqsave(&usbos_info->rxlock, flags);
+
+#if defined(BCM_RPC_NOCOPY) || defined(BCM_RPC_RXNOCOPY)
+       req->pkt = rxirb->pkt = PKTGET(usbos_info->pub->osh, req->buf_len, FALSE);
+       if (!rxirb->pkt) {
+               DBUSERR(("%s: PKTGET failed\n", __FUNCTION__));
+               dbus_usbos_qenq(&usbos_info->req_rxfreeq, req, &usbos_info->rxfree_lock);
+               ret = DBUS_ERR_RXDROP;
+               goto fail;
+       }
+       /* consider the packet "native" so we don't count it as MALLOCED in the osl */
+       PKTTONATIVE(usbos_info->pub->osh, req->pkt);
+       rxirb->buf = NULL;
+       p = PKTDATA(usbos_info->pub->osh, req->pkt);
+#else
+       if (req->buf_len != usbos_info->rxbuf_len) {
+               ASSERT(req->pkt);
+               MFREE(usbos_info->pub->osh, req->pkt, req->buf_len);
+               DBUSTRACE(("%s: replace rx buff: old len %d, new len %d\n", __FUNCTION__,
+                       req->buf_len, usbos_info->rxbuf_len));
+               req->buf_len = 0;
+               req->pkt = MALLOC(usbos_info->pub->osh, usbos_info->rxbuf_len);
+               if (req->pkt == NULL) {
+                       DBUSERR(("%s: MALLOC req->pkt failed\n", __FUNCTION__));
+                       ret = DBUS_ERR_NOMEM;
+                       goto fail;
+               }
+               req->buf_len = usbos_info->rxbuf_len;
+       }
+       rxirb->buf = req->pkt;
+       p = rxirb->buf;
+#endif /* defined(BCM_RPC_NOCOPY) */
+       rxirb->buf_len = req->buf_len;
+       req->usbinfo = usbos_info;
+       req->arg = rxirb;
+       if (ep_idx == 0) {
+               rx_pipe = usbos_info->rx_pipe;
+       } else {
+               rx_pipe = usbos_info->rx_pipe2;
+               ASSERT(usbos_info->rx_pipe2);
+       }
+       /* Prepare the URB */
+       usb_fill_bulk_urb(req->urb, usbos_info->usb, rx_pipe,
+               p,
+               rxirb->buf_len,
+               (usb_complete_t)dbus_usbos_recv_complete, req);
+               req->urb->transfer_flags |= URB_QUEUE_BULK;
+
+       if ((ret = USB_SUBMIT_URB(req->urb))) {
+               DBUSERR(("%s USB_SUBMIT_URB failed. status %d\n", __FUNCTION__, ret));
+               dbus_usbos_qenq(&usbos_info->req_rxfreeq, req, &usbos_info->rxfree_lock);
+               ret = DBUS_ERR_RXFAIL;
+               goto fail;
+       }
+       rxposted = atomic_inc_return(&usbos_info->rxposted);
+
+       dbus_usbos_qenq(&usbos_info->req_rxpostedq, req, &usbos_info->rxposted_lock);
+fail:
+       spin_unlock_irqrestore(&usbos_info->rxlock, flags);
+       return ret;
+} /* dbus_usbos_recv_urb_submit */
+
+
+/**
+ * Called by worked thread when a 'receive URB' completed or Linux kernel when it returns a URB to
+ * this driver.
+ */
+static void BCMFASTPATH
+dbus_usbos_recv_complete_handle(urb_req_t *req, int len, int status)
+{
+       dbus_irb_rx_t *rxirb = req->arg;
+       usbos_info_t *usbos_info = req->usbinfo;
+       unsigned long flags;
+       int rxallocated, rxposted;
+       int dbus_status = DBUS_OK;
+       bool killed = (g_probe_info.suspend_state == USBOS_SUSPEND_STATE_SUSPEND_PENDING) ? 1 : 0;
+
+       spin_lock_irqsave(&usbos_info->rxlock, flags);
+       dbus_usbos_req_del(req, &usbos_info->rxposted_lock);
+       rxposted = atomic_dec_return(&usbos_info->rxposted);
+       rxallocated = atomic_read(&usbos_info->rxallocated);
+       spin_unlock_irqrestore(&usbos_info->rxlock, flags);
+
+       if ((rxallocated < usbos_info->pub->nrxq) && (!status) &&
+               (rxposted == DBUS_USB_RXQUEUE_LOWER_WATERMARK)) {
+                       DBUSTRACE(("%s: need more rx buf: rxallocated %d rxposted %d!\n",
+                               __FUNCTION__, rxallocated, rxposted));
+                       dbus_usbos_urbreqs_alloc(usbos_info,
+                               MIN(DBUS_USB_RXQUEUE_BATCH_ADD,
+                               usbos_info->pub->nrxq - rxallocated), TRUE);
+       }
+
+       /* Handle errors */
+       if (status) {
+               /*
+                * Linux 2.4 disconnect: -ENOENT or -EILSEQ for CRC error; rmmod: -ENOENT
+                * Linux 2.6 disconnect: -EPROTO, rmmod: -ESHUTDOWN
+                */
+               if ((status == -ENOENT && (!killed))|| status == -ESHUTDOWN) {
+                       /* NOTE: unlink() can not be called from URB callback().
+                        * Do not call dbusos_stop() here.
+                        */
+                       DBUSTRACE(("%s rx error %d\n", __FUNCTION__, status));
+                       dbus_usbos_state_change(usbos_info, DBUS_STATE_DOWN);
+               } else if (status == -EPROTO) {
+                       DBUSTRACE(("%s rx error %d\n", __FUNCTION__, status));
+               } else if (killed && (status == -EHOSTUNREACH || status == -ENOENT)) {
+                       /* Device is suspended */
+               } else {
+                       DBUSTRACE(("%s rx error %d\n", __FUNCTION__, status));
+                       dbus_usbos_errhandler(usbos_info, DBUS_ERR_RXFAIL);
+               }
+
+               /* On error, don't submit more URBs yet */
+               rxirb->buf = NULL;
+               rxirb->actual_len = 0;
+               dbus_status = DBUS_ERR_RXFAIL;
+               goto fail;
+       }
+
+       /* Make the skb represent the received urb */
+       rxirb->actual_len = len;
+
+       if (rxirb->actual_len < sizeof(uint32)) {
+               DBUSTRACE(("small pkt len %d, process as ZLP\n", rxirb->actual_len));
+               dbus_status = DBUS_ERR_RXZLP;
+       }
+
+fail:
+#if defined(BCM_RPC_NOCOPY) || defined(BCM_RPC_RXNOCOPY)
+       /* detach the packet from the queue */
+       req->pkt = NULL;
+#endif /* BCM_RPC_NOCOPY || BCM_RPC_RXNOCOPY */
+
+       if (usbos_info->cbarg && usbos_info->cbs) {
+               if (usbos_info->cbs->recv_irb_complete) {
+                       usbos_info->cbs->recv_irb_complete(usbos_info->cbarg, rxirb, dbus_status);
+               }
+       }
+
+       dbus_usbos_qenq(&usbos_info->req_rxfreeq, req, &usbos_info->rxfree_lock);
+
+       /* Mark the interface as busy to reset USB autosuspend timer */
+       USB_MARK_LAST_BUSY(usbos_info->usb);
+} /* dbus_usbos_recv_complete_handle */
+
+/** called by Linux kernel when it returns a URB to this driver */
+static void
+dbus_usbos_recv_complete(CALLBACK_ARGS)
+{
+#ifdef USBOS_THREAD
+       dbus_usbos_dispatch_schedule(CALLBACK_ARGS_DATA);
+#else /*  !USBOS_THREAD */
+       dbus_usbos_recv_complete_handle(urb->context, urb->actual_length, urb->status);
+#endif /*  USBOS_THREAD */
+}
+
+
+/**
+ * If Linux notifies our driver that a control read or write URB has completed, we should notify
+ * the DBUS layer above us (dbus_usb.c in this case).
+ */
+static void
+dbus_usbos_ctl_complete(usbos_info_t *usbos_info, int type, int urbstatus)
+{
+       int status = DBUS_ERR;
+
+       if (usbos_info == NULL)
+               return;
+
+       switch (urbstatus) {
+               case 0:
+                       status = DBUS_OK;
+               break;
+               case -EINPROGRESS:
+               case -ENOENT:
+               default:
+#ifdef INTR_EP_ENABLE
+                       DBUSERR(("%s:%d fail status %d bus:%d susp:%d intr:%d ctli:%d ctlo:%d\n",
+                               __FUNCTION__, type, urbstatus,
+                               usbos_info->pub->busstate, g_probe_info.suspend_state,
+                               usbos_info->intr_urb_submitted, usbos_info->ctlin_urb_submitted,
+                               usbos_info->ctlout_urb_submitted));
+#else
+                       DBUSERR(("%s: failed with status %d\n", __FUNCTION__, urbstatus));
+                       status = DBUS_ERR;
+               break;
+#endif /* INTR_EP_ENABLE */
+       }
+
+       if (usbos_info->cbarg && usbos_info->cbs) {
+               if (usbos_info->cbs->ctl_complete)
+                       usbos_info->cbs->ctl_complete(usbos_info->cbarg, type, status);
+       }
+}
+
+/** called by Linux */
+static void
+dbus_usbos_ctlread_complete(CALLBACK_ARGS)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *)urb->context;
+
+       ASSERT(urb);
+       usbos_info = (usbos_info_t *)urb->context;
+
+       dbus_usbos_ctl_complete(usbos_info, DBUS_CBCTL_READ, urb->status);
+
+#ifdef USBOS_THREAD
+       if (usbos_info->rxctl_deferrespok) {
+               usbos_info->ctl_read.bRequestType = USB_DIR_IN | USB_TYPE_CLASS |
+               USB_RECIP_INTERFACE;
+               usbos_info->ctl_read.bRequest = 1;
+       }
+#endif
+
+       up(&usbos_info->ctl_lock);
+
+       USB_AUTOPM_PUT_INTERFACE_ASYNC(g_probe_info.intf);
+}
+
+/** called by Linux */
+static void
+dbus_usbos_ctlwrite_complete(CALLBACK_ARGS)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *)urb->context;
+
+       ASSERT(urb);
+       usbos_info = (usbos_info_t *)urb->context;
+
+       dbus_usbos_ctl_complete(usbos_info, DBUS_CBCTL_WRITE, urb->status);
+
+#ifdef USBOS_TX_THREAD
+       usbos_info->ctl_state = USBOS_REQUEST_STATE_UNSCHEDULED;
+#endif /* USBOS_TX_THREAD */
+
+       up(&usbos_info->ctl_lock);
+
+       USB_AUTOPM_PUT_INTERFACE_ASYNC(g_probe_info.intf);
+}
+
+#ifdef INTR_EP_ENABLE
+/** called by Linux */
+static void
+dbus_usbos_intr_complete(CALLBACK_ARGS)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *)urb->context;
+       bool killed = (g_probe_info.suspend_state == USBOS_SUSPEND_STATE_SUSPEND_PENDING) ? 1 : 0;
+
+       if (usbos_info == NULL || usbos_info->pub == NULL)
+               return;
+       if ((urb->status == -ENOENT && (!killed)) || urb->status == -ESHUTDOWN ||
+               urb->status == -ENODEV) {
+               dbus_usbos_state_change(usbos_info, DBUS_STATE_DOWN);
+       }
+
+       if (usbos_info->pub->busstate == DBUS_STATE_DOWN) {
+               DBUSERR(("%s: intr cb when DBUS down, ignoring\n", __FUNCTION__));
+               return;
+       }
+       dbus_usbos_ctl_complete(usbos_info, DBUS_CBINTR_POLL, urb->status);
+}
+#endif /* INTR_EP_ENABLE */
+
+/**
+ * when the bus is going to sleep or halt, the Linux kernel requires us to take ownership of our
+ * URBs again. Multiple code paths in this file require a list of URBs to be cancelled in a
+ * concurrency save manner.
+ */
+static void
+dbus_usbos_unlink(struct list_head *urbreq_q, spinlock_t *lock)
+{
+       urb_req_t *req;
+
+       /* dbus_usbos_recv_complete() adds req back to req_freeq */
+       while ((req = dbus_usbos_qdeq(urbreq_q, lock)) != NULL) {
+               ASSERT(req->urb != NULL);
+               USB_UNLINK_URB(req->urb);
+       }
+}
+
+/** multiple code paths in this file require the bus to stop */
+static void
+dbus_usbos_cancel_all_urbs(usbos_info_t *usbos_info)
+{
+       int rxposted, txposted;
+
+       DBUSTRACE(("%s: unlink all URBs\n", __FUNCTION__));
+
+#ifdef USBOS_TX_THREAD
+       usbos_info->ctl_state = USBOS_REQUEST_STATE_UNSCHEDULED;
+
+       /* Yield the CPU to TX thread so all pending requests are submitted */
+       while (!list_empty(&usbos_info->usbos_tx_list)) {
+               wake_up_interruptible(&usbos_info->usbos_tx_queue_head);
+               OSL_SLEEP(10);
+       }
+#endif /* USBOS_TX_THREAD */
+
+       /* tell Linux kernel to cancel a single intr, ctl and blk URB */
+       if (usbos_info->intr_urb)
+               USB_UNLINK_URB(usbos_info->intr_urb);
+       if (usbos_info->ctl_urb)
+               USB_UNLINK_URB(usbos_info->ctl_urb);
+       if (usbos_info->blk_urb)
+               USB_UNLINK_URB(usbos_info->blk_urb);
+
+       dbus_usbos_unlink(&usbos_info->req_txpostedq, &usbos_info->txposted_lock);
+       dbus_usbos_unlink(&usbos_info->req_rxpostedq, &usbos_info->rxposted_lock);
+
+       /* Wait until the callbacks for all submitted URBs have been called, because the
+        * handler needs to know is an USB suspend is in progress.
+        */
+       SPINWAIT((atomic_read(&usbos_info->txposted) != 0 ||
+               atomic_read(&usbos_info->rxposted) != 0), 10000);
+
+       txposted = atomic_read(&usbos_info->txposted);
+       rxposted = atomic_read(&usbos_info->rxposted);
+       if (txposted != 0 || rxposted != 0) {
+               DBUSERR(("%s ERROR: REQs posted, rx=%d tx=%d!\n",
+                       __FUNCTION__, rxposted, txposted));
+       }
+} /* dbus_usbos_cancel_all_urbs */
+
+/** multiple code paths require the bus to stop */
+static void
+dbusos_stop(usbos_info_t *usbos_info)
+{
+       urb_req_t *req;
+       int rxposted;
+       req = NULL;
+       BCM_REFERENCE(req);
+
+       ASSERT(usbos_info);
+
+       dbus_usbos_state_change(usbos_info, DBUS_STATE_DOWN);
+
+       dbus_usbos_cancel_all_urbs(usbos_info);
+
+#ifdef USBOS_THREAD
+       /* yield the CPU to rx packet thread */
+       while (1) {
+               if (atomic_read(&usbos_info->usbos_list_cnt) <= 0)      break;
+               wake_up_interruptible(&usbos_info->usbos_queue_head);
+               OSL_SLEEP(3);
+       }
+#endif /* USBOS_THREAD */
+
+       rxposted = atomic_read(&usbos_info->rxposted);
+       if (rxposted > 0) {
+               DBUSERR(("%s ERROR: rx REQs posted=%d in stop!\n", __FUNCTION__,
+                       rxposted));
+       }
+
+       ASSERT(atomic_read(&usbos_info->txposted) == 0 && rxposted == 0);
+
+} /* dbusos_stop */
+
+#if defined(USB_SUSPEND_AVAILABLE)
+
+/**
+ * Linux kernel sports a 'USB auto suspend' feature. See: http://lwn.net/Articles/373550/
+ * The suspend method is called by the Linux kernel to warn the driver that the device is going to
+ * be suspended.  If the driver returns a negative error code, the suspend will be aborted. If the
+ * driver returns 0, it must cancel all outstanding URBs (usb_kill_urb()) and not submit any more.
+ */
+static int
+dbus_usbos_suspend(struct usb_interface *intf,
+            pm_message_t message)
+{
+       DBUSERR(("%s suspend state: %d\n", __FUNCTION__, g_probe_info.suspend_state));
+       /* DHD for full dongle model */
+       g_probe_info.suspend_state = USBOS_SUSPEND_STATE_SUSPEND_PENDING;
+       dbus_usbos_state_change((usbos_info_t*)g_probe_info.usbos_info, DBUS_STATE_SLEEP);
+       dbus_usbos_cancel_all_urbs((usbos_info_t*)g_probe_info.usbos_info);
+       g_probe_info.suspend_state = USBOS_SUSPEND_STATE_SUSPENDED;
+
+       return 0;
+}
+
+/**
+ * The resume method is called to tell the driver that the device has been resumed and the driver
+ * can return to normal operation.  URBs may once more be submitted.
+ */
+static int dbus_usbos_resume(struct usb_interface *intf)
+{
+       DBUSERR(("%s Device resumed\n", __FUNCTION__));
+
+       dbus_usbos_state_change((usbos_info_t*)g_probe_info.usbos_info, DBUS_STATE_UP);
+       g_probe_info.suspend_state = USBOS_SUSPEND_STATE_DEVICE_ACTIVE;
+       return 0;
+}
+
+/**
+* This function is directly called by the Linux kernel, when the suspended device has been reset
+* instead of being resumed
+*/
+static int dbus_usbos_reset_resume(struct usb_interface *intf)
+{
+       DBUSERR(("%s Device reset resumed\n", __FUNCTION__));
+
+       /* The device may have lost power, so a firmware download may be required */
+       dbus_usbos_state_change((usbos_info_t*)g_probe_info.usbos_info, DBUS_STATE_DL_NEEDED);
+       g_probe_info.suspend_state = USBOS_SUSPEND_STATE_DEVICE_ACTIVE;
+       return 0;
+}
+
+#endif /* USB_SUSPEND_AVAILABLE */
+
+/**
+ * Called by Linux kernel at initialization time, kernel wants to know if our driver will accept the
+ * caller supplied USB interface. Note that USB drivers are bound to interfaces, and not to USB
+ * devices.
+ */
+#ifdef KERNEL26
+#define DBUS_USBOS_PROBE() static int dbus_usbos_probe(struct usb_interface *intf, const struct usb_device_id *id)
+#define DBUS_USBOS_DISCONNECT() static void dbus_usbos_disconnect(struct usb_interface *intf)
+#else
+#define DBUS_USBOS_PROBE() static void * dbus_usbos_probe(struct usb_device *usb, unsigned int ifnum, const struct usb_device_id *id)
+#define DBUS_USBOS_DISCONNECT() static void dbus_usbos_disconnect(struct usb_device *usb, void *ptr)
+#endif /* KERNEL26 */
+
+DBUS_USBOS_PROBE()
+{
+       int ep;
+       struct usb_endpoint_descriptor *endpoint;
+       int ret = 0;
+#ifdef KERNEL26
+       struct usb_device *usb = interface_to_usbdev(intf);
+#else
+       int claimed = 0;
+#endif
+       int num_of_eps;
+#ifdef BCMUSBDEV_COMPOSITE
+       int wlan_if = -1;
+       bool intr_ep = FALSE;
+#endif /* BCMUSBDEV_COMPOSITE */
+       wifi_adapter_info_t *adapter;
+
+       DHD_MUTEX_LOCK();
+
+       DBUSERR(("%s: bus num(busnum)=%d, slot num (portnum)=%d\n", __FUNCTION__,
+               usb->bus->busnum, usb->portnum));
+       adapter = dhd_wifi_platform_attach_adapter(USB_BUS, usb->bus->busnum,
+               usb->portnum, WIFI_STATUS_POWER_ON);
+       if (adapter == NULL) {
+               DBUSERR(("%s: can't find adapter info for this chip\n", __FUNCTION__));
+               goto fail;
+       }
+
+#ifdef BCMUSBDEV_COMPOSITE
+       wlan_if = dbus_usbos_intf_wlan(usb);
+#ifdef KERNEL26
+       if ((wlan_if >= 0) && (IFPTR(usb, wlan_if) == intf))
+#else
+       if (wlan_if == ifnum)
+#endif /* KERNEL26 */
+       {
+#endif /* BCMUSBDEV_COMPOSITE */
+               g_probe_info.usb = usb;
+               g_probe_info.dldone = TRUE;
+#ifdef BCMUSBDEV_COMPOSITE
+       } else {
+               DBUSTRACE(("dbus_usbos_probe: skip probe for non WLAN interface\n"));
+               ret = BCME_UNSUPPORTED;
+               goto fail;
+       }
+#endif /* BCMUSBDEV_COMPOSITE */
+
+#ifdef KERNEL26
+       g_probe_info.intf = intf;
+#endif /* KERNEL26 */
+
+#ifdef BCMUSBDEV_COMPOSITE
+       if (IFDESC(usb, wlan_if).bInterfaceNumber > USB_COMPIF_MAX)
+#else
+       if (IFDESC(usb, CONTROL_IF).bInterfaceNumber)
+#endif /* BCMUSBDEV_COMPOSITE */
+       {
+               ret = -1;
+               goto fail;
+       }
+       if (id != NULL) {
+               g_probe_info.vid = id->idVendor;
+               g_probe_info.pid = id->idProduct;
+       }
+
+#ifdef KERNEL26
+       usb_set_intfdata(intf, &g_probe_info);
+#endif
+
+       /* Check that the device supports only one configuration */
+       if (usb->descriptor.bNumConfigurations != 1) {
+               ret = -1;
+               goto fail;
+       }
+
+       if (usb->descriptor.bDeviceClass != USB_CLASS_VENDOR_SPEC) {
+#ifdef BCMUSBDEV_COMPOSITE
+               if ((usb->descriptor.bDeviceClass != USB_CLASS_MISC) &&
+                       (usb->descriptor.bDeviceClass != USB_CLASS_WIRELESS)) {
+#endif /* BCMUSBDEV_COMPOSITE */
+                       ret = -1;
+                       goto fail;
+#ifdef BCMUSBDEV_COMPOSITE
+               }
+#endif /* BCMUSBDEV_COMPOSITE */
+       }
+
+       /*
+        * Only the BDC interface configuration is supported:
+        *      Device class: USB_CLASS_VENDOR_SPEC
+        *      if0 class: USB_CLASS_VENDOR_SPEC
+        *      if0/ep0: control
+        *      if0/ep1: bulk in
+        *      if0/ep2: bulk out (ok if swapped with bulk in)
+        */
+       if (CONFIGDESC(usb)->bNumInterfaces != 1) {
+#ifdef BCMUSBDEV_COMPOSITE
+               if (CONFIGDESC(usb)->bNumInterfaces > USB_COMPIF_MAX) {
+#endif /* BCMUSBDEV_COMPOSITE */
+                       ret = -1;
+                       goto fail;
+#ifdef BCMUSBDEV_COMPOSITE
+               }
+#endif /* BCMUSBDEV_COMPOSITE */
+       }
+
+       /* Check interface */
+#ifndef KERNEL26
+#ifdef BCMUSBDEV_COMPOSITE
+       if (usb_interface_claimed(IFPTR(usb, wlan_if)))
+#else
+       if (usb_interface_claimed(IFPTR(usb, CONTROL_IF)))
+#endif /* BCMUSBDEV_COMPOSITE */
+       {
+               ret = -1;
+               goto fail;
+       }
+#endif /* !KERNEL26 */
+
+#ifdef BCMUSBDEV_COMPOSITE
+       if ((IFDESC(usb, wlan_if).bInterfaceClass != USB_CLASS_VENDOR_SPEC ||
+               IFDESC(usb, wlan_if).bInterfaceSubClass != 2 ||
+               IFDESC(usb, wlan_if).bInterfaceProtocol != 0xff) &&
+               (IFDESC(usb, wlan_if).bInterfaceClass != USB_CLASS_MISC ||
+               IFDESC(usb, wlan_if).bInterfaceSubClass != USB_SUBCLASS_COMMON ||
+               IFDESC(usb, wlan_if).bInterfaceProtocol != USB_PROTO_IAD))
+#else
+       if (IFDESC(usb, CONTROL_IF).bInterfaceClass != USB_CLASS_VENDOR_SPEC ||
+               IFDESC(usb, CONTROL_IF).bInterfaceSubClass != 2 ||
+               IFDESC(usb, CONTROL_IF).bInterfaceProtocol != 0xff)
+#endif /* BCMUSBDEV_COMPOSITE */
+       {
+#ifdef BCMUSBDEV_COMPOSITE
+                       DBUSERR(("%s: invalid control interface: class %d, subclass %d, proto %d\n",
+                               __FUNCTION__,
+                               IFDESC(usb, wlan_if).bInterfaceClass,
+                               IFDESC(usb, wlan_if).bInterfaceSubClass,
+                               IFDESC(usb, wlan_if).bInterfaceProtocol));
+#else
+                       DBUSERR(("%s: invalid control interface: class %d, subclass %d, proto %d\n",
+                               __FUNCTION__,
+                               IFDESC(usb, CONTROL_IF).bInterfaceClass,
+                               IFDESC(usb, CONTROL_IF).bInterfaceSubClass,
+                               IFDESC(usb, CONTROL_IF).bInterfaceProtocol));
+#endif /* BCMUSBDEV_COMPOSITE */
+                       ret = -1;
+                       goto fail;
+       }
+
+       /* Check control endpoint */
+#ifdef BCMUSBDEV_COMPOSITE
+       endpoint = &IFEPDESC(usb, wlan_if, 0);
+#else
+       endpoint = &IFEPDESC(usb, CONTROL_IF, 0);
+#endif /* BCMUSBDEV_COMPOSITE */
+       if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) != USB_ENDPOINT_XFER_INT) {
+#ifdef BCMUSBDEV_COMPOSITE
+               if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) !=
+                       USB_ENDPOINT_XFER_BULK) {
+#endif /* BCMUSBDEV_COMPOSITE */
+                       DBUSERR(("%s: invalid control endpoint %d\n",
+                               __FUNCTION__, endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK));
+                       ret = -1;
+                       goto fail;
+#ifdef BCMUSBDEV_COMPOSITE
+               }
+#endif /* BCMUSBDEV_COMPOSITE */
+       }
+
+#ifdef BCMUSBDEV_COMPOSITE
+       if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) == USB_ENDPOINT_XFER_INT) {
+#endif /* BCMUSBDEV_COMPOSITE */
+               g_probe_info.intr_pipe =
+                       usb_rcvintpipe(usb, endpoint->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+#ifdef BCMUSBDEV_COMPOSITE
+               intr_ep = TRUE;
+       }
+#endif /* BCMUSBDEV_COMPOSITE */
+
+#ifndef KERNEL26
+       /* Claim interface */
+#ifdef BCMUSBDEV_COMPOSITE
+       usb_driver_claim_interface(&dbus_usbdev, IFPTR(usb, wlan_if), &g_probe_info);
+#else
+       usb_driver_claim_interface(&dbus_usbdev, IFPTR(usb, CONTROL_IF), &g_probe_info);
+#endif /* BCMUSBDEV_COMPOSITE */
+       claimed = 1;
+#endif /* !KERNEL26 */
+       g_probe_info.rx_pipe = 0;
+       g_probe_info.rx_pipe2 = 0;
+       g_probe_info.tx_pipe = 0;
+#ifdef BCMUSBDEV_COMPOSITE
+       if (intr_ep)
+               ep = 1;
+       else
+               ep = 0;
+       num_of_eps = IFDESC(usb, wlan_if).bNumEndpoints - 1;
+#else
+       num_of_eps = IFDESC(usb, BULK_IF).bNumEndpoints - 1;
+#endif /* BCMUSBDEV_COMPOSITE */
+
+       if ((num_of_eps != 2) && (num_of_eps != 3)) {
+#ifdef BCMUSBDEV_COMPOSITE
+               if (num_of_eps > 7)
+#endif /* BCMUSBDEV_COMPOSITE */
+                       ASSERT(0);
+       }
+       /* Check data endpoints and get pipes */
+#ifdef BCMUSBDEV_COMPOSITE
+       for (; ep <= num_of_eps; ep++)
+#else
+       for (ep = 1; ep <= num_of_eps; ep++)
+#endif /* BCMUSBDEV_COMPOSITE */
+       {
+#ifdef BCMUSBDEV_COMPOSITE
+               endpoint = &IFEPDESC(usb, wlan_if, ep);
+#else
+               endpoint = &IFEPDESC(usb, BULK_IF, ep);
+#endif /* BCMUSBDEV_COMPOSITE */
+               if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) !=
+                   USB_ENDPOINT_XFER_BULK) {
+                       DBUSERR(("%s: invalid data endpoint %d\n",
+                                  __FUNCTION__, ep));
+                       ret = -1;
+                       goto fail;
+               }
+
+               if ((endpoint->bEndpointAddress & USB_ENDPOINT_DIR_MASK) == USB_DIR_IN) {
+                       /* direction: dongle->host */
+                       if (!g_probe_info.rx_pipe) {
+                               g_probe_info.rx_pipe = usb_rcvbulkpipe(usb,
+                                       (endpoint->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK));
+                       } else {
+                               g_probe_info.rx_pipe2 = usb_rcvbulkpipe(usb,
+                                       (endpoint->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK));
+                       }
+
+               } else
+                       g_probe_info.tx_pipe = usb_sndbulkpipe(usb, (endpoint->bEndpointAddress &
+                            USB_ENDPOINT_NUMBER_MASK));
+       }
+
+       /* Allocate interrupt URB and data buffer */
+       /* RNDIS says 8-byte intr, our old drivers used 4-byte */
+#ifdef BCMUSBDEV_COMPOSITE
+       g_probe_info.intr_size = (IFEPDESC(usb, wlan_if, 0).wMaxPacketSize == 16) ? 8 : 4;
+       g_probe_info.interval = IFEPDESC(usb, wlan_if, 0).bInterval;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 21))
+       usb->quirks |= USB_QUIRK_NO_SET_INTF;
+#endif
+#else
+       g_probe_info.intr_size = (IFEPDESC(usb, CONTROL_IF, 0).wMaxPacketSize == 16) ? 8 : 4;
+       g_probe_info.interval = IFEPDESC(usb, CONTROL_IF, 0).bInterval;
+#endif /* BCMUSBDEV_COMPOSITE */
+
+#ifndef KERNEL26
+       /* usb_fill_int_urb does the interval decoding in 2.6 */
+       if (usb->speed == USB_SPEED_HIGH)
+               g_probe_info.interval = 1 << (g_probe_info.interval - 1);
+#endif
+       if (usb->speed == USB_SPEED_SUPER) {
+               g_probe_info.device_speed = SUPER_SPEED;
+               DBUSERR(("super speed device detected\n"));
+       } else if (usb->speed == USB_SPEED_HIGH) {
+               g_probe_info.device_speed = HIGH_SPEED;
+               DBUSERR(("high speed device detected\n"));
+       } else {
+               g_probe_info.device_speed = FULL_SPEED;
+               DBUSERR(("full speed device detected\n"));
+       }
+       if (g_probe_info.dereged == FALSE && probe_cb) {
+               disc_arg = probe_cb(probe_arg, "", USB_BUS, usb->bus->busnum, usb->portnum, 0);
+       }
+
+       g_probe_info.disc_cb_done = FALSE;
+
+#ifdef KERNEL26
+       intf->needs_remote_wakeup = 1;
+#endif /* KERNEL26 */
+       DHD_MUTEX_UNLOCK();
+
+       /* Success */
+#ifdef KERNEL26
+       return DBUS_OK;
+#else
+       usb_inc_dev_use(usb);
+       return &g_probe_info;
+#endif
+
+fail:
+       printf("%s: Exit ret=%d\n", __FUNCTION__, ret);
+#ifdef BCMUSBDEV_COMPOSITE
+       if (ret != BCME_UNSUPPORTED)
+#endif /* BCMUSBDEV_COMPOSITE */
+               DBUSERR(("%s: failed with errno %d\n", __FUNCTION__, ret));
+#ifndef KERNEL26
+       if (claimed)
+#ifdef BCMUSBDEV_COMPOSITE
+               usb_driver_release_interface(&dbus_usbdev, IFPTR(usb, wlan_if));
+#else
+               usb_driver_release_interface(&dbus_usbdev, IFPTR(usb, CONTROL_IF));
+#endif /* BCMUSBDEV_COMPOSITE */
+#endif /* !KERNEL26 */
+
+       DHD_MUTEX_UNLOCK();
+#ifdef KERNEL26
+       usb_set_intfdata(intf, NULL);
+       return ret;
+#else
+       return NULL;
+#endif
+} /* dbus_usbos_probe */
+
+/** Called by Linux kernel, is the counter part of dbus_usbos_probe() */
+DBUS_USBOS_DISCONNECT()
+{
+#ifdef KERNEL26
+       struct usb_device *usb = interface_to_usbdev(intf);
+       probe_info_t *probe_usb_init_data = usb_get_intfdata(intf);
+#else
+       probe_info_t *probe_usb_init_data = (probe_info_t *) ptr;
+#endif
+       usbos_info_t *usbos_info;
+
+       DHD_MUTEX_LOCK();
+
+       DBUSERR(("%s: bus num(busnum)=%d, slot num (portnum)=%d\n", __FUNCTION__,
+               usb->bus->busnum, usb->portnum));
+
+       if (probe_usb_init_data) {
+               usbos_info = (usbos_info_t *) probe_usb_init_data->usbos_info;
+               if (usbos_info) {
+                       if ((probe_usb_init_data->dereged == FALSE) && disconnect_cb && disc_arg) {
+                               disconnect_cb(disc_arg);
+                               disc_arg = NULL;
+                               probe_usb_init_data->disc_cb_done = TRUE;
+                       }
+               }
+       }
+
+       if (usb) {
+#ifndef KERNEL26
+#ifdef BCMUSBDEV_COMPOSITE
+               usb_driver_release_interface(&dbus_usbdev, IFPTR(usb, wlan_if));
+#else
+               usb_driver_release_interface(&dbus_usbdev, IFPTR(usb, CONTROL_IF));
+#endif /* BCMUSBDEV_COMPOSITE */
+               usb_dec_dev_use(usb);
+#endif /* !KERNEL26 */
+       }
+       DHD_MUTEX_UNLOCK();
+} /* dbus_usbos_disconnect */
+
+#define LOOPBACK_PKT_START 0xBABE1234
+
+bool is_loopback_pkt(void *buf)
+{
+
+       uint32 *buf_ptr = (uint32 *) buf;
+
+       if (*buf_ptr == LOOPBACK_PKT_START)
+               return TRUE;
+       return FALSE;
+
+}
+
+int matches_loopback_pkt(void *buf)
+{
+       int i, j;
+       unsigned char *cbuf = (unsigned char *) buf;
+
+       for (i = 4; i < loopback_size; i++) {
+               if (cbuf[i] != (i % 256)) {
+                       printf("%s: mismatch at i=%d %d : ", __FUNCTION__, i, cbuf[i]);
+                       for (j = i; ((j < i+ 16) && (j < loopback_size)); j++) {
+                               printf("%d ", cbuf[j]);
+                       }
+                       printf("\n");
+                       return 0;
+               }
+       }
+       loopback_rx_cnt++;
+       return 1;
+}
+
+int dbus_usbos_loopback_tx(void *usbos_info_ptr, int cnt, int size)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) usbos_info_ptr;
+       unsigned char *buf;
+       int j;
+       void* p = NULL;
+       int rc, last_rx_cnt;
+       int tx_failed_cnt;
+       int max_size = 1650;
+       int usb_packet_size = 512;
+       int min_packet_size = 10;
+
+       if (size % usb_packet_size == 0) {
+               size = size - 1;
+               DBUSERR(("%s: overriding size=%d \n", __FUNCTION__, size));
+       }
+
+       if (size < min_packet_size) {
+               size = min_packet_size;
+               DBUSERR(("%s: overriding size=%d\n", __FUNCTION__, min_packet_size));
+       }
+       if (size > max_size) {
+               size = max_size;
+               DBUSERR(("%s: overriding size=%d\n", __FUNCTION__, max_size));
+       }
+
+       loopback_tx_cnt = 0;
+       loopback_rx_cnt = 0;
+       tx_failed_cnt = 0;
+       loopback_size   = size;
+
+       while (loopback_tx_cnt < cnt) {
+               uint32 *x;
+               int pkt_size = loopback_size;
+
+               p = PKTGET(usbos_info->pub->osh, pkt_size, TRUE);
+               if (p == NULL) {
+                       DBUSERR(("%s:%d Failed to allocate packet sz=%d\n",
+                              __FUNCTION__, __LINE__, pkt_size));
+                       return BCME_ERROR;
+               }
+               x = (uint32*) PKTDATA(usbos_info->pub->osh, p);
+               *x = LOOPBACK_PKT_START;
+               buf = (unsigned char*) x;
+               for (j = 4; j < pkt_size; j++) {
+                       buf[j] = j % 256;
+               }
+               rc = dbus_send_buf(usbos_info->pub, buf, pkt_size, p);
+               if (rc != BCME_OK) {
+                       DBUSERR(("%s:%d Freeing packet \n", __FUNCTION__, __LINE__));
+                       PKTFREE(usbos_info->pub->osh, p, TRUE);
+                       dbus_usbos_wait(usbos_info, 1);
+                       tx_failed_cnt++;
+               } else {
+                       loopback_tx_cnt++;
+                       tx_failed_cnt = 0;
+               }
+               if (tx_failed_cnt == 5) {
+                       DBUSERR(("%s : Failed to send loopback packets cnt=%d loopback_tx_cnt=%d\n",
+                        __FUNCTION__, cnt, loopback_tx_cnt));
+                       break;
+               }
+       }
+       printf("Transmitted %d loopback packets of size %d\n", loopback_tx_cnt, loopback_size);
+
+       last_rx_cnt = loopback_rx_cnt;
+       while (loopback_rx_cnt < loopback_tx_cnt) {
+               dbus_usbos_wait(usbos_info, 1);
+               if (loopback_rx_cnt <= last_rx_cnt) {
+                       DBUSERR(("%s: Matched rx cnt stuck at %d \n", __FUNCTION__, last_rx_cnt));
+                       return BCME_ERROR;
+               }
+               last_rx_cnt = loopback_rx_cnt;
+       }
+       printf("Received %d loopback packets of size %d\n", loopback_tx_cnt, loopback_size);
+
+       return BCME_OK;
+} /* dbus_usbos_loopback_tx */
+
+/**
+ * Higher layer (dbus_usb.c) wants to transmit an I/O Request Block
+ *     @param[in] txirb txirb->pkt, if non-zero, contains a single or a chain of packets
+ */
+static int
+dbus_usbos_intf_send_irb(void *bus, dbus_irb_tx_t *txirb)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) bus;
+       urb_req_t *req, *req_zlp = NULL;
+       int ret = DBUS_OK;
+       unsigned long flags;
+       void *pkt;
+       uint32 buffer_length;
+       uint8 *buf;
+
+       if ((usbos_info == NULL) || !usbos_info->tx_pipe) {
+               return DBUS_ERR;
+       }
+
+       if (txirb->pkt != NULL) {
+               buffer_length = pkttotlen(usbos_info->pub->osh, txirb->pkt);
+               /* In case of multiple packets the values below may be overwritten */
+               txirb->send_buf = NULL;
+               buf = PKTDATA(usbos_info->pub->osh, txirb->pkt);
+       } else { /* txirb->buf != NULL */
+               ASSERT(txirb->buf != NULL);
+               ASSERT(txirb->send_buf == NULL);
+               buffer_length = txirb->len;
+               buf = txirb->buf;
+       }
+
+       if (!(req = dbus_usbos_qdeq(&usbos_info->req_txfreeq, &usbos_info->txfree_lock))) {
+               DBUSERR(("%s No free URB!\n", __FUNCTION__));
+               return DBUS_ERR_TXDROP;
+       }
+
+       /* If not using standard Linux kernel functionality for handling Zero Length Packet(ZLP),
+        * the dbus needs to generate ZLP when length is multiple of MaxPacketSize.
+        */
+#ifndef WL_URB_ZPKT
+       if (!(buffer_length % usbos_info->maxps)) {
+               if (!(req_zlp =
+                       dbus_usbos_qdeq(&usbos_info->req_txfreeq, &usbos_info->txfree_lock))) {
+                       DBUSERR(("%s No free URB for ZLP!\n", __FUNCTION__));
+                       dbus_usbos_qenq(&usbos_info->req_txfreeq, req, &usbos_info->txfree_lock);
+                       return DBUS_ERR_TXDROP;
+               }
+
+               /* No txirb, so that dbus_usbos_send_complete can differentiate between
+                * DATA and ZLP.
+                */
+               req_zlp->arg = NULL;
+               req_zlp->usbinfo = usbos_info;
+               req_zlp->buf_len = 0;
+
+               usb_fill_bulk_urb(req_zlp->urb, usbos_info->usb, usbos_info->tx_pipe, NULL,
+                       0, (usb_complete_t)dbus_usbos_send_complete, req_zlp);
+
+               req_zlp->urb->transfer_flags |= URB_QUEUE_BULK;
+       }
+#endif /* !WL_URB_ZPKT */
+
+#ifndef USBOS_TX_THREAD
+       /* Disable USB autosuspend until this request completes, request USB resume if needed.
+        * Because this call runs asynchronously, there is no guarantee the bus is resumed before
+        * the URB is submitted, and the URB might be dropped. Use USBOS_TX_THREAD to avoid
+        * this.
+        */
+       USB_AUTOPM_GET_INTERFACE_ASYNC(g_probe_info.intf);
+#endif /* !USBOS_TX_THREAD */
+
+       spin_lock_irqsave(&usbos_info->txlock, flags);
+
+       req->arg = txirb;
+       req->usbinfo = usbos_info;
+       req->buf_len = 0;
+
+       /* Prepare the URB */
+       if (txirb->pkt != NULL) {
+               uint32 pktlen;
+               uint8 *transfer_buf;
+
+               /* For multiple packets, allocate contiguous buffer and copy packet data to it */
+               if (PKTNEXT(usbos_info->pub->osh, txirb->pkt)) {
+                       transfer_buf = MALLOC(usbos_info->pub->osh, buffer_length);
+                       if (!transfer_buf) {
+                               ret = DBUS_ERR_TXDROP;
+                               DBUSERR(("fail to alloc to usb buffer\n"));
+                               goto fail;
+                       }
+
+                       pkt = txirb->pkt;
+                       txirb->send_buf = transfer_buf;
+                       req->buf_len = buffer_length;
+
+                       while (pkt) {
+                               pktlen = PKTLEN(usbos_info->pub->osh, pkt);
+                               bcopy(PKTDATA(usbos_info->pub->osh, pkt), transfer_buf, pktlen);
+                               transfer_buf += pktlen;
+                               pkt = PKTNEXT(usbos_info->pub->osh, pkt);
+                       }
+
+                       ASSERT(((uint8 *) txirb->send_buf + buffer_length) == transfer_buf);
+
+                       /* Overwrite buf pointer with pointer to allocated contiguous transfer_buf
+                        */
+                       buf = txirb->send_buf;
+               }
+       }
+
+       usb_fill_bulk_urb(req->urb, usbos_info->usb, usbos_info->tx_pipe, buf,
+               buffer_length, (usb_complete_t)dbus_usbos_send_complete, req);
+
+       req->urb->transfer_flags |= URB_QUEUE_BULK;
+
+#ifdef USBOS_TX_THREAD
+       /* Enqueue TX request, the TX thread will resume the bus if needed and submit
+        * it asynchronously
+        */
+       dbus_usbos_qenq(&usbos_info->usbos_tx_list, req, &usbos_info->usbos_tx_list_lock);
+       if (req_zlp != NULL) {
+               dbus_usbos_qenq(&usbos_info->usbos_tx_list, req_zlp,
+                       &usbos_info->usbos_tx_list_lock);
+       }
+       spin_unlock_irqrestore(&usbos_info->txlock, flags);
+
+       wake_up_interruptible(&usbos_info->usbos_tx_queue_head);
+       return DBUS_OK;
+#else
+       if ((ret = USB_SUBMIT_URB(req->urb))) {
+               ret = DBUS_ERR_TXDROP;
+               goto fail;
+       }
+
+       dbus_usbos_qenq(&usbos_info->req_txpostedq, req, &usbos_info->txposted_lock);
+       atomic_inc(&usbos_info->txposted);
+
+       if (req_zlp != NULL) {
+               if ((ret = USB_SUBMIT_URB(req_zlp->urb))) {
+                       DBUSERR(("failed to submit ZLP URB!\n"));
+                       ASSERT(0);
+                       ret = DBUS_ERR_TXDROP;
+                       goto fail2;
+               }
+
+               dbus_usbos_qenq(&usbos_info->req_txpostedq, req_zlp, &usbos_info->txposted_lock);
+               /* Also increment txposted for zlp packet, as it will be decremented in
+                * dbus_usbos_send_complete()
+                */
+               atomic_inc(&usbos_info->txposted);
+       }
+
+       spin_unlock_irqrestore(&usbos_info->txlock, flags);
+       return DBUS_OK;
+#endif /* USBOS_TX_THREAD */
+
+fail:
+       if (txirb->send_buf != NULL) {
+               MFREE(usbos_info->pub->osh, txirb->send_buf, req->buf_len);
+               txirb->send_buf = NULL;
+               req->buf_len = 0;
+       }
+       dbus_usbos_qenq(&usbos_info->req_txfreeq, req, &usbos_info->txfree_lock);
+#ifndef USBOS_TX_THREAD
+fail2:
+#endif
+       if (req_zlp != NULL) {
+               dbus_usbos_qenq(&usbos_info->req_txfreeq, req_zlp, &usbos_info->txfree_lock);
+       }
+
+       spin_unlock_irqrestore(&usbos_info->txlock, flags);
+
+#ifndef USBOS_TX_THREAD
+       USB_AUTOPM_PUT_INTERFACE_ASYNC(g_probe_info.intf);
+#endif /* !USBOS_TX_THREAD */
+
+       return ret;
+} /* dbus_usbos_intf_send_irb */
+
+/** Higher layer (dbus_usb.c) recycles a received (and used) packet. */
+static int
+dbus_usbos_intf_recv_irb(void *bus, dbus_irb_rx_t *rxirb)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) bus;
+       int ret = DBUS_OK;
+
+       if (usbos_info == NULL)
+               return DBUS_ERR;
+
+       ret = dbus_usbos_recv_urb_submit(usbos_info, rxirb, 0);
+       return ret;
+}
+
+static int
+dbus_usbos_intf_recv_irb_from_ep(void *bus, dbus_irb_rx_t *rxirb, uint32 ep_idx)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) bus;
+       int ret = DBUS_OK;
+
+       if (usbos_info == NULL)
+               return DBUS_ERR;
+
+#ifdef INTR_EP_ENABLE
+               /* By specifying the ep_idx value of 0xff, the cdc layer is asking to
+               * submit an interrupt URB
+               */
+               if (rxirb == NULL && ep_idx == 0xff) {
+                       /* submit intr URB */
+                       if ((ret = USB_SUBMIT_URB(usbos_info->intr_urb)) < 0) {
+                               DBUSERR(("%s intr USB_SUBMIT_URB failed, status %d\n",
+                                       __FUNCTION__, ret));
+                       }
+                       return ret;
+               }
+#else
+               if (rxirb == NULL) {
+                       return DBUS_ERR;
+               }
+#endif /* INTR_EP_ENABLE */
+
+       ret = dbus_usbos_recv_urb_submit(usbos_info, rxirb, ep_idx);
+       return ret;
+}
+
+/** Higher layer (dbus_usb.c) want to cancel an IRB */
+static int
+dbus_usbos_intf_cancel_irb(void *bus, dbus_irb_tx_t *txirb)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) bus;
+
+       if (usbos_info == NULL)
+               return DBUS_ERR;
+
+       return DBUS_ERR;
+}
+
+/** Only one CTL transfer can be pending at any time. This function may block. */
+static int
+dbus_usbos_intf_send_ctl(void *bus, uint8 *buf, int len)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) bus;
+       uint16 size;
+#ifndef USBOS_TX_THREAD
+       int status;
+#endif /* USBOS_TX_THREAD */
+
+       if ((usbos_info == NULL) || (buf == NULL) || (len == 0))
+               return DBUS_ERR;
+
+       if (usbos_info->ctl_urb == NULL)
+               return DBUS_ERR;
+
+       /* Block until a pending CTL transfer has completed */
+       if (down_interruptible(&usbos_info->ctl_lock) != 0) {
+               return DBUS_ERR_TXCTLFAIL;
+       }
+
+#ifdef USBOS_TX_THREAD
+       ASSERT(usbos_info->ctl_state == USBOS_REQUEST_STATE_UNSCHEDULED);
+#else
+       /* Disable USB autosuspend until this request completes, request USB resume if needed.
+        * Because this call runs asynchronously, there is no guarantee the bus is resumed before
+        * the URB is submitted, and the URB might be dropped. Use USBOS_TX_THREAD to avoid
+        * this.
+        */
+       USB_AUTOPM_GET_INTERFACE_ASYNC(g_probe_info.intf);
+#endif /* USBOS_TX_THREAD */
+
+       size = len;
+       usbos_info->ctl_write.wLength = cpu_to_le16p(&size);
+       usbos_info->ctl_urb->transfer_buffer_length = size;
+
+       usb_fill_control_urb(usbos_info->ctl_urb,
+               usbos_info->usb,
+               usb_sndctrlpipe(usbos_info->usb, 0),
+               (unsigned char *) &usbos_info->ctl_write,
+               buf, size, (usb_complete_t)dbus_usbos_ctlwrite_complete, usbos_info);
+
+#ifdef USBOS_TX_THREAD
+       /* Enqueue CTRL request for transmission by the TX thread. The
+        * USB bus will first be resumed if needed.
+        */
+       usbos_info->ctl_state = USBOS_REQUEST_STATE_SCHEDULED;
+       wake_up_interruptible(&usbos_info->usbos_tx_queue_head);
+#else
+       status = USB_SUBMIT_URB(usbos_info->ctl_urb);
+       if (status < 0) {
+               DBUSERR(("%s: usb_submit_urb failed %d\n", __FUNCTION__, status));
+               up(&usbos_info->ctl_lock);
+
+               USB_AUTOPM_PUT_INTERFACE_ASYNC(g_probe_info.intf);
+
+               return DBUS_ERR_TXCTLFAIL;
+       }
+#endif /* USBOS_TX_THREAD */
+
+       return DBUS_OK;
+} /* dbus_usbos_intf_send_ctl */
+
+/** This function does not seem to be called by anyone, including dbus_usb.c */
+static int
+dbus_usbos_intf_recv_ctl(void *bus, uint8 *buf, int len)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) bus;
+       int status;
+       uint16 size;
+
+       if ((usbos_info == NULL) || (buf == NULL) || (len == 0))
+               return DBUS_ERR;
+
+       if (usbos_info->ctl_urb == NULL)
+               return DBUS_ERR;
+
+       /* Block until a pending CTRL transfer has completed */
+       if (down_interruptible(&usbos_info->ctl_lock) != 0) {
+               return DBUS_ERR_TXCTLFAIL;
+       }
+
+       /* Disable USB autosuspend until this request completes, request USB resume if needed. */
+       USB_AUTOPM_GET_INTERFACE_ASYNC(g_probe_info.intf);
+
+       size = len;
+       usbos_info->ctl_read.wLength = cpu_to_le16p(&size);
+       usbos_info->ctl_urb->transfer_buffer_length = size;
+
+       if (usbos_info->rxctl_deferrespok) {
+               /* BMAC model */
+               usbos_info->ctl_read.bRequestType = USB_DIR_IN | USB_TYPE_VENDOR |
+                       USB_RECIP_INTERFACE;
+               usbos_info->ctl_read.bRequest = DL_DEFER_RESP_OK;
+       } else {
+               /* full dongle model */
+               usbos_info->ctl_read.bRequestType = USB_DIR_IN | USB_TYPE_CLASS |
+                       USB_RECIP_INTERFACE;
+               usbos_info->ctl_read.bRequest = 1;
+       }
+
+       usb_fill_control_urb(usbos_info->ctl_urb,
+               usbos_info->usb,
+               usb_rcvctrlpipe(usbos_info->usb, 0),
+               (unsigned char *) &usbos_info->ctl_read,
+               buf, size, (usb_complete_t)dbus_usbos_ctlread_complete, usbos_info);
+
+       status = USB_SUBMIT_URB(usbos_info->ctl_urb);
+       if (status < 0) {
+               DBUSERR(("%s: usb_submit_urb failed %d\n", __FUNCTION__, status));
+               up(&usbos_info->ctl_lock);
+
+               USB_AUTOPM_PUT_INTERFACE_ASYNC(g_probe_info.intf);
+
+               return DBUS_ERR_RXCTLFAIL;
+       }
+
+       return DBUS_OK;
+}
+
+static int
+dbus_usbos_intf_get_attrib(void *bus, dbus_attrib_t *attrib)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) bus;
+
+       if ((usbos_info == NULL) || (attrib == NULL))
+               return DBUS_ERR;
+
+       attrib->bustype = DBUS_USB;
+       attrib->vid = g_probe_info.vid;
+       attrib->pid = g_probe_info.pid;
+       attrib->devid = 0x4322;
+
+       attrib->nchan = 1;
+
+       /* MaxPacketSize for USB hi-speed bulk out is 512 bytes
+        * and 64-bytes for full-speed.
+        * When sending pkt > MaxPacketSize, Host SW breaks it
+        * up into multiple packets.
+        */
+       attrib->mtu = usbos_info->maxps;
+
+       return DBUS_OK;
+}
+
+/** Called by higher layer (dbus_usb.c) when it wants to 'up' the USB interface to the dongle */
+static int
+dbus_usbos_intf_up(void *bus)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) bus;
+       uint16 ifnum;
+#ifdef BCMUSBDEV_COMPOSITE
+       int wlan_if = 0;
+#endif
+       if (usbos_info == NULL)
+               return DBUS_ERR;
+
+       if (usbos_info->usb == NULL)
+               return DBUS_ERR;
+
+#if defined(INTR_EP_ENABLE)
+       /* full dongle use intr EP, bmac doesn't use it */
+       if (usbos_info->intr_urb) {
+               int ret;
+
+               usb_fill_int_urb(usbos_info->intr_urb, usbos_info->usb,
+                       usbos_info->intr_pipe, &usbos_info->intr,
+                       usbos_info->intr_size, (usb_complete_t)dbus_usbos_intr_complete,
+                       usbos_info, usbos_info->interval);
+
+               if ((ret = USB_SUBMIT_URB(usbos_info->intr_urb))) {
+                       DBUSERR(("%s USB_SUBMIT_URB failed with status %d\n", __FUNCTION__, ret));
+                       return DBUS_ERR;
+               }
+       }
+#endif 
+
+       if (usbos_info->ctl_urb) {
+               usbos_info->ctl_in_pipe = usb_rcvctrlpipe(usbos_info->usb, 0);
+               usbos_info->ctl_out_pipe = usb_sndctrlpipe(usbos_info->usb, 0);
+
+#ifdef BCMUSBDEV_COMPOSITE
+               wlan_if = dbus_usbos_intf_wlan(usbos_info->usb);
+               ifnum = cpu_to_le16(IFDESC(usbos_info->usb, wlan_if).bInterfaceNumber);
+#else
+               ifnum = cpu_to_le16(IFDESC(usbos_info->usb, CONTROL_IF).bInterfaceNumber);
+#endif /* BCMUSBDEV_COMPOSITE */
+               /* CTL Write */
+               usbos_info->ctl_write.bRequestType =
+                       USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
+               usbos_info->ctl_write.bRequest = 0;
+               usbos_info->ctl_write.wValue = cpu_to_le16(0);
+               usbos_info->ctl_write.wIndex = cpu_to_le16p(&ifnum);
+
+               /* CTL Read */
+               usbos_info->ctl_read.bRequestType =
+                       USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
+               usbos_info->ctl_read.bRequest = 1;
+               usbos_info->ctl_read.wValue = cpu_to_le16(0);
+               usbos_info->ctl_read.wIndex = cpu_to_le16p(&ifnum);
+       }
+
+       /* Success, indicate usbos_info is fully up */
+       dbus_usbos_state_change(usbos_info, DBUS_STATE_UP);
+
+       return DBUS_OK;
+} /* dbus_usbos_intf_up */
+
+static int
+dbus_usbos_intf_down(void *bus)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) bus;
+
+       if (usbos_info == NULL)
+               return DBUS_ERR;
+
+       dbusos_stop(usbos_info);
+       return DBUS_OK;
+}
+
+static int
+dbus_usbos_intf_stop(void *bus)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) bus;
+
+       if (usbos_info == NULL)
+               return DBUS_ERR;
+
+       dbusos_stop(usbos_info);
+       return DBUS_OK;
+}
+
+
+/** Called by higher layer (dbus_usb.c) */
+static int
+dbus_usbos_intf_set_config(void *bus, dbus_config_t *config)
+{
+       int err = DBUS_ERR;
+       usbos_info_t* usbos_info = bus;
+
+       if (config->config_id == DBUS_CONFIG_ID_RXCTL_DEFERRES) {
+               usbos_info->rxctl_deferrespok = config->rxctl_deferrespok;
+               err = DBUS_OK;
+       } else if (config->config_id == DBUS_CONFIG_ID_AGGR_LIMIT) {
+               /* DBUS_CONFIG_ID_AGGR_LIMIT shouldn't be called after probe stage */
+               ASSERT(disc_arg == NULL);
+               ASSERT(config->aggr_param.maxrxsf > 0);
+               ASSERT(config->aggr_param.maxrxsize > 0);
+               if (config->aggr_param.maxrxsize > usbos_info->rxbuf_len) {
+                       int state = usbos_info->pub->busstate;
+                       dbus_usbos_unlink(&usbos_info->req_rxpostedq, &usbos_info->rxposted_lock);
+                       while (atomic_read(&usbos_info->rxposted)) {
+                               DBUSTRACE(("%s rxposted is %d, delay 1 ms\n", __FUNCTION__,
+                                       atomic_read(&usbos_info->rxposted)));
+                               dbus_usbos_wait(usbos_info, 1);
+                       }
+                       usbos_info->rxbuf_len = config->aggr_param.maxrxsize;
+                       dbus_usbos_state_change(usbos_info, state);
+               }
+               err = DBUS_OK;
+       }
+
+       return err;
+}
+
+
+/** Called by dbus_usb.c when it wants to download firmware into the dongle */
+bool
+dbus_usbos_dl_cmd(usbos_info_t *usbinfo, uint8 cmd, void *buffer, int buflen)
+{
+       int transferred;
+       int index = 0;
+       char *tmpbuf;
+
+       if ((usbinfo == NULL) || (buffer == NULL) || (buflen == 0))
+               return FALSE;
+
+       tmpbuf = (char *) MALLOC(usbinfo->pub->osh, buflen);
+       if (!tmpbuf) {
+               DBUSERR(("%s: Unable to allocate memory \n", __FUNCTION__));
+               return FALSE;
+       }
+
+#ifdef BCM_REQUEST_FW
+       if (cmd == DL_GO) {
+               index = 1;
+       }
+#endif
+
+       /* Disable USB autosuspend until this request completes, request USB resume if needed. */
+       USB_AUTOPM_GET_INTERFACE(g_probe_info.intf);
+
+       transferred = USB_CONTROL_MSG(usbinfo->usb, usb_rcvctrlpipe(usbinfo->usb, 0),
+               cmd, (USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE),
+               0, index,
+               (void*) tmpbuf, buflen, USB_CTRL_EP_TIMEOUT);
+       if (transferred == buflen) {
+               memcpy(buffer, tmpbuf, buflen);
+       } else {
+               DBUSERR(("%s: usb_control_msg failed %d\n", __FUNCTION__, transferred));
+       }
+
+       USB_AUTOPM_PUT_INTERFACE(g_probe_info.intf);
+
+       MFREE(usbinfo->pub->osh, tmpbuf, buflen);
+       return (transferred == buflen);
+}
+
+/**
+ * Called by dbus_usb.c when it wants to download a buffer into the dongle (e.g. as part of the
+ * download process, when writing nvram variables).
+ */
+int
+dbus_write_membytes(usbos_info_t* usbinfo, bool set, uint32 address, uint8 *data, uint size)
+{
+       hwacc_t hwacc;
+       int write_bytes = 4;
+       int status;
+       int retval = 0;
+
+       DBUSTRACE(("Enter:%s\n", __FUNCTION__));
+
+       /* Read is not supported */
+       if (set == 0) {
+               DBUSERR(("Currently read is not supported!!\n"));
+               return -1;
+       }
+
+       USB_AUTOPM_GET_INTERFACE(g_probe_info.intf);
+
+       hwacc.cmd = DL_CMD_WRHW;
+       hwacc.addr = address;
+
+       DBUSTRACE(("Address:%x size:%d", hwacc.addr, size));
+       do {
+               if (size >= 4) {
+                       write_bytes = 4;
+               } else if (size >= 2) {
+                       write_bytes = 2;
+               } else {
+                       write_bytes = 1;
+               }
+
+               hwacc.len = write_bytes;
+
+               while (size >= write_bytes) {
+                       hwacc.data = *((unsigned int*)data);
+
+                       status = USB_CONTROL_MSG(usbinfo->usb, usb_sndctrlpipe(usbinfo->usb, 0),
+                               DL_WRHW, (USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE),
+                               1, 0, (char *)&hwacc, sizeof(hwacc_t), USB_CTRL_EP_TIMEOUT);
+
+                       if (status < 0) {
+                               retval = -1;
+                               DBUSERR((" Ctrl write hwacc failed w/status %d @ address:%x \n",
+                                       status, hwacc.addr));
+                               goto err;
+                       }
+
+                       hwacc.addr += write_bytes;
+                       data += write_bytes;
+                       size -= write_bytes;
+               }
+       } while (size > 0);
+
+err:
+       USB_AUTOPM_PUT_INTERFACE(g_probe_info.intf);
+
+       return retval;
+}
+
+int
+dbus_usbos_readreg(void *bus, uint32 regaddr, int datalen, uint32 *value)
+{
+       usbos_info_t *usbinfo = (usbos_info_t *) bus;
+       int ret = DBUS_OK;
+       int transferred;
+       uint32 cmd;
+       hwacc_t hwacc;
+
+       if (usbinfo == NULL)
+               return DBUS_ERR;
+
+       if (datalen == 1)
+               cmd = DL_RDHW8;
+       else if (datalen == 2)
+               cmd = DL_RDHW16;
+       else
+               cmd = DL_RDHW32;
+
+       USB_AUTOPM_GET_INTERFACE(g_probe_info.intf);
+
+       transferred = USB_CONTROL_MSG(usbinfo->usb, usb_rcvctrlpipe(usbinfo->usb, 0),
+               cmd, (USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE),
+               (uint16)(regaddr), (uint16)(regaddr >> 16),
+               (void *) &hwacc, sizeof(hwacc_t), USB_CTRL_EP_TIMEOUT);
+
+       if (transferred >= sizeof(hwacc_t)) {
+               *value = hwacc.data;
+       } else {
+               DBUSERR(("%s: usb_control_msg failed %d\n", __FUNCTION__, transferred));
+               ret = DBUS_ERR;
+       }
+
+       USB_AUTOPM_PUT_INTERFACE(g_probe_info.intf);
+
+       return ret;
+}
+
+int
+dbus_usbos_writereg(void *bus, uint32 regaddr, int datalen, uint32 data)
+{
+       usbos_info_t *usbinfo = (usbos_info_t *) bus;
+       int ret = DBUS_OK;
+       int transferred;
+       uint32 cmd = DL_WRHW;
+       hwacc_t hwacc;
+
+       if (usbinfo == NULL)
+               return DBUS_ERR;
+
+       USB_AUTOPM_GET_INTERFACE(g_probe_info.intf);
+
+       hwacc.cmd = DL_WRHW;
+       hwacc.addr = regaddr;
+       hwacc.data = data;
+       hwacc.len = datalen;
+
+       transferred = USB_CONTROL_MSG(usbinfo->usb, usb_sndctrlpipe(usbinfo->usb, 0),
+               cmd, (USB_DIR_OUT| USB_TYPE_VENDOR | USB_RECIP_INTERFACE),
+               1, 0,
+               (void *) &hwacc, sizeof(hwacc_t), USB_CTRL_EP_TIMEOUT);
+
+       if (transferred != sizeof(hwacc_t)) {
+               DBUSERR(("%s: usb_control_msg failed %d\n", __FUNCTION__, transferred));
+               ret = DBUS_ERR;
+       }
+
+       USB_AUTOPM_PUT_INTERFACE(g_probe_info.intf);
+
+       return ret;
+}
+
+int
+dbus_usbos_wait(usbos_info_t *usbinfo, uint16 ms)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+       if (in_interrupt())
+               mdelay(ms);
+       else
+               msleep_interruptible(ms);
+#else
+       wait_ms(ms);
+#endif
+       return DBUS_OK;
+}
+
+/** Called by dbus_usb.c as part of the firmware download process */
+bool
+dbus_usbos_dl_send_bulk(usbos_info_t *usbinfo, void *buffer, int len)
+{
+       bool ret = TRUE;
+       int status;
+       int transferred = 0;
+
+       if (usbinfo == NULL)
+               return DBUS_ERR;
+
+       USB_AUTOPM_GET_INTERFACE(g_probe_info.intf);
+
+       status = USB_BULK_MSG(usbinfo->usb, usbinfo->tx_pipe,
+               buffer, len,
+               &transferred, USB_BULK_EP_TIMEOUT);
+
+       if (status < 0) {
+               DBUSERR(("%s: usb_bulk_msg failed %d\n", __FUNCTION__, status));
+               ret = FALSE;
+       }
+
+       USB_AUTOPM_PUT_INTERFACE(g_probe_info.intf);
+
+       return ret;
+}
+
+static bool
+dbus_usbos_intf_recv_needed(void *bus)
+{
+       return FALSE;
+}
+
+/**
+ * Higher layer (dbus_usb.c) wants to execute a function on the condition that the rx spin lock has
+ * been acquired.
+ */
+static void*
+dbus_usbos_intf_exec_rxlock(void *bus, exec_cb_t cb, struct exec_parms *args)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) bus;
+       void *ret;
+       unsigned long flags;
+
+       if (usbos_info == NULL)
+               return NULL;
+
+       spin_lock_irqsave(&usbos_info->rxlock, flags);
+       ret = cb(args);
+       spin_unlock_irqrestore(&usbos_info->rxlock, flags);
+
+       return ret;
+}
+
+static void*
+dbus_usbos_intf_exec_txlock(void *bus, exec_cb_t cb, struct exec_parms *args)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) bus;
+       void *ret;
+       unsigned long flags;
+
+       if (usbos_info == NULL)
+               return NULL;
+
+       spin_lock_irqsave(&usbos_info->txlock, flags);
+       ret = cb(args);
+       spin_unlock_irqrestore(&usbos_info->txlock, flags);
+
+       return ret;
+}
+
+/**
+ * if an error condition was detected in this module, the higher DBUS layer (dbus_usb.c) has to
+ * be notified.
+ */
+int
+dbus_usbos_errhandler(void *bus, int err)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) bus;
+
+       if (usbos_info == NULL)
+               return DBUS_ERR;
+
+       if (usbos_info->cbarg && usbos_info->cbs) {
+               if (usbos_info->cbs->errhandler)
+                       usbos_info->cbs->errhandler(usbos_info->cbarg, err);
+       }
+
+       return DBUS_OK;
+}
+
+/**
+ * if a change in bus state was detected in this module, the higher DBUS layer (dbus_usb.c) has to
+ * be notified.
+ */
+int
+dbus_usbos_state_change(void *bus, int state)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) bus;
+
+       if (usbos_info == NULL)
+               return DBUS_ERR;
+
+       if (usbos_info->cbarg && usbos_info->cbs) {
+               if (usbos_info->cbs->state_change)
+                       usbos_info->cbs->state_change(usbos_info->cbarg, state);
+       }
+
+       usbos_info->pub->busstate = state;
+       return DBUS_OK;
+}
+
+int
+dbus_bus_osl_register(int vid, int pid, probe_cb_t prcb,
+       disconnect_cb_t discb, void *prarg, dbus_intf_t **intf, void *param1, void *param2)
+{
+       bzero(&g_probe_info, sizeof(probe_info_t));
+
+       probe_cb = prcb;
+       disconnect_cb = discb;
+       probe_arg = prarg;
+
+       devid_table[0].idVendor = vid;
+       devid_table[0].idProduct = pid;
+
+       *intf = &dbus_usbos_intf;
+
+       USB_REGISTER();
+
+       return DBUS_ERR_NODEVICE;
+}
+
+int
+dbus_bus_osl_deregister()
+{
+       g_probe_info.dereged = TRUE;
+
+       DHD_MUTEX_LOCK();
+       if (disconnect_cb && disc_arg && (g_probe_info.disc_cb_done == FALSE)) {
+               disconnect_cb(disc_arg);
+               disc_arg = NULL;
+       }
+       DHD_MUTEX_UNLOCK();
+
+       USB_DEREGISTER();
+
+       return DBUS_OK;
+}
+
+void *
+dbus_usbos_intf_attach(dbus_pub_t *pub, void *cbarg, dbus_intf_callbacks_t *cbs)
+{
+       usbos_info_t *usbos_info;
+
+       if (g_probe_info.dldone == FALSE) {
+               DBUSERR(("%s: err device not downloaded!\n", __FUNCTION__));
+               return NULL;
+       }
+
+       /* Sanity check for BUS_INFO() */
+       ASSERT(OFFSETOF(usbos_info_t, pub) == 0);
+
+       usbos_info = MALLOC(pub->osh, sizeof(usbos_info_t));
+       if (usbos_info == NULL)
+               return NULL;
+
+       bzero(usbos_info, sizeof(usbos_info_t));
+
+       usbos_info->pub = pub;
+       usbos_info->cbarg = cbarg;
+       usbos_info->cbs = cbs;
+
+       /* Needed for disconnect() */
+       g_probe_info.usbos_info = usbos_info;
+
+       /* Update USB Info */
+       usbos_info->usb = g_probe_info.usb;
+       usbos_info->rx_pipe = g_probe_info.rx_pipe;
+       usbos_info->rx_pipe2 = g_probe_info.rx_pipe2;
+       usbos_info->tx_pipe = g_probe_info.tx_pipe;
+       usbos_info->intr_pipe = g_probe_info.intr_pipe;
+       usbos_info->intr_size = g_probe_info.intr_size;
+       usbos_info->interval = g_probe_info.interval;
+       usbos_info->pub->device_speed = g_probe_info.device_speed;
+       if (usbos_info->rx_pipe2) {
+               usbos_info->pub->attrib.has_2nd_bulk_in_ep = 1;
+       } else {
+               usbos_info->pub->attrib.has_2nd_bulk_in_ep = 0;
+       }
+
+       if (usbos_info->tx_pipe)
+               usbos_info->maxps = usb_maxpacket(usbos_info->usb,
+                       usbos_info->tx_pipe, usb_pipeout(usbos_info->tx_pipe));
+
+       INIT_LIST_HEAD(&usbos_info->req_rxfreeq);
+       INIT_LIST_HEAD(&usbos_info->req_txfreeq);
+       INIT_LIST_HEAD(&usbos_info->req_rxpostedq);
+       INIT_LIST_HEAD(&usbos_info->req_txpostedq);
+       spin_lock_init(&usbos_info->rxfree_lock);
+       spin_lock_init(&usbos_info->txfree_lock);
+       spin_lock_init(&usbos_info->rxposted_lock);
+       spin_lock_init(&usbos_info->txposted_lock);
+       spin_lock_init(&usbos_info->rxlock);
+       spin_lock_init(&usbos_info->txlock);
+
+       atomic_set(&usbos_info->rxposted, 0);
+       atomic_set(&usbos_info->txposted, 0);
+
+
+#ifdef USB_DISABLE_INT_EP
+       usbos_info->intr_urb = NULL;
+#else
+       if (!(usbos_info->intr_urb = USB_ALLOC_URB())) {
+               DBUSERR(("%s: usb_alloc_urb (tx) failed\n", __FUNCTION__));
+               goto fail;
+       }
+#endif
+
+       if (!(usbos_info->ctl_urb = USB_ALLOC_URB())) {
+               DBUSERR(("%s: usb_alloc_urb (tx) failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+       init_waitqueue_head(&usbos_info->wait);
+
+       if (!(usbos_info->blk_urb = USB_ALLOC_URB())) { /* for embedded image downloading */
+               DBUSERR(("%s: usb_alloc_urb (tx) failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+       usbos_info->rxbuf_len = (uint)usbos_info->pub->rxsize;
+
+
+
+       atomic_set(&usbos_info->txallocated, 0);
+       if (DBUS_OK != dbus_usbos_urbreqs_alloc(usbos_info,
+               usbos_info->pub->ntxq, FALSE)) {
+               goto fail;
+       }
+
+       atomic_set(&usbos_info->rxallocated, 0);
+       if (DBUS_OK != dbus_usbos_urbreqs_alloc(usbos_info,
+               MIN(DBUS_USB_RXQUEUE_BATCH_ADD, usbos_info->pub->nrxq),
+               TRUE)) {
+               goto fail;
+       }
+
+       sema_init(&usbos_info->ctl_lock, 1);
+
+#ifdef USBOS_THREAD
+       if (dbus_usbos_thread_init(usbos_info) == NULL)
+               goto fail;
+#endif /* USBOS_THREAD */
+
+#ifdef USBOS_TX_THREAD
+       if (dbus_usbos_tx_thread_init(usbos_info) == NULL)
+               goto fail;
+#endif /* USBOS_TX_THREAD */
+
+       pub->dev_info = g_probe_info.usb;
+
+
+       return (void *) usbos_info;
+fail:
+       if (usbos_info->intr_urb) {
+               USB_FREE_URB(usbos_info->intr_urb);
+               usbos_info->intr_urb = NULL;
+       }
+
+       if (usbos_info->ctl_urb) {
+               USB_FREE_URB(usbos_info->ctl_urb);
+               usbos_info->ctl_urb = NULL;
+       }
+
+#if defined(BCM_REQUEST_FW)
+       if (usbos_info->blk_urb) {
+               USB_FREE_URB(usbos_info->blk_urb);
+               usbos_info->blk_urb = NULL;
+       }
+#endif
+
+       dbus_usbos_urbreqs_free(usbos_info, TRUE);
+       atomic_set(&usbos_info->rxallocated, 0);
+       dbus_usbos_urbreqs_free(usbos_info, FALSE);
+       atomic_set(&usbos_info->txallocated, 0);
+
+       g_probe_info.usbos_info = NULL;
+
+       MFREE(pub->osh, usbos_info, sizeof(usbos_info_t));
+       return NULL;
+} /* dbus_usbos_intf_attach */
+
+void
+dbus_usbos_intf_detach(dbus_pub_t *pub, void *info)
+{
+       usbos_info_t *usbos_info = (usbos_info_t *) info;
+       osl_t *osh = pub->osh;
+
+       if (usbos_info == NULL) {
+               return;
+       }
+
+#ifdef USBOS_TX_THREAD
+       dbus_usbos_tx_thread_deinit(usbos_info);
+#endif /* USBOS_TX_THREAD */
+
+       /* Must unlink all URBs prior to driver unload;
+        * otherwise an URB callback can occur after driver
+        * has been de-allocated and rmmod'd
+        */
+       dbusos_stop(usbos_info);
+
+       if (usbos_info->intr_urb) {
+               USB_FREE_URB(usbos_info->intr_urb);
+               usbos_info->intr_urb = NULL;
+       }
+
+       if (usbos_info->ctl_urb) {
+               USB_FREE_URB(usbos_info->ctl_urb);
+               usbos_info->ctl_urb = NULL;
+       }
+
+       if (usbos_info->blk_urb) {
+               USB_FREE_URB(usbos_info->blk_urb);
+               usbos_info->blk_urb = NULL;
+       }
+
+       dbus_usbos_urbreqs_free(usbos_info, TRUE);
+       atomic_set(&usbos_info->rxallocated, 0);
+       dbus_usbos_urbreqs_free(usbos_info, FALSE);
+       atomic_set(&usbos_info->txallocated, 0);
+
+#ifdef USBOS_THREAD
+       dbus_usbos_thread_deinit(usbos_info);
+#endif /* USBOS_THREAD */
+
+       g_probe_info.usbos_info = NULL;
+       MFREE(osh, usbos_info, sizeof(usbos_info_t));
+} /* dbus_usbos_intf_detach */
+
+
+#ifdef USBOS_TX_THREAD
+
+void*
+dbus_usbos_tx_thread_init(usbos_info_t *usbos_info)
+{
+       spin_lock_init(&usbos_info->usbos_tx_list_lock);
+       INIT_LIST_HEAD(&usbos_info->usbos_tx_list);
+       init_waitqueue_head(&usbos_info->usbos_tx_queue_head);
+
+       usbos_info->usbos_tx_kt = kthread_create(dbus_usbos_tx_thread_func,
+               usbos_info, "usb-tx-thread");
+
+       if (IS_ERR(usbos_info->usbos_tx_kt)) {
+               DBUSERR(("Thread Creation failed\n"));
+               return (NULL);
+       }
+
+       usbos_info->ctl_state = USBOS_REQUEST_STATE_UNSCHEDULED;
+       wake_up_process(usbos_info->usbos_tx_kt);
+
+       return (usbos_info->usbos_tx_kt);
+}
+
+void
+dbus_usbos_tx_thread_deinit(usbos_info_t *usbos_info)
+{
+       urb_req_t *req;
+
+       if (usbos_info->usbos_tx_kt) {
+               wake_up_interruptible(&usbos_info->usbos_tx_queue_head);
+               kthread_stop(usbos_info->usbos_tx_kt);
+       }
+
+       /* Move pending requests to free queue so they can be freed */
+       while ((req = dbus_usbos_qdeq(
+               &usbos_info->usbos_tx_list, &usbos_info->usbos_tx_list_lock)) != NULL) {
+               dbus_usbos_qenq(&usbos_info->req_txfreeq, req, &usbos_info->txfree_lock);
+       }
+}
+
+/**
+ * Allow USB in-band resume to block by submitting CTRL and DATA URBs on a separate thread.
+ */
+int
+dbus_usbos_tx_thread_func(void *data)
+{
+       usbos_info_t  *usbos_info = (usbos_info_t *)data;
+       urb_req_t     *req;
+       dbus_irb_tx_t *txirb;
+       int           ret;
+       unsigned long flags;
+
+#ifdef WL_THREADNICE
+       set_user_nice(current, WL_THREADNICE);
+#endif
+
+       while (1) {
+               /* Wait until there are URBs to submit */
+               wait_event_interruptible_timeout(
+                       usbos_info->usbos_tx_queue_head,
+                       !list_empty(&usbos_info->usbos_tx_list) ||
+                       usbos_info->ctl_state == USBOS_REQUEST_STATE_SCHEDULED,
+                       100);
+
+               if (kthread_should_stop())
+                       break;
+
+               /* Submit CTRL URB if needed */
+               if (usbos_info->ctl_state == USBOS_REQUEST_STATE_SCHEDULED) {
+
+                       /* Disable USB autosuspend until this request completes. If the
+                        * interface was suspended, this call blocks until it has been resumed.
+                        */
+                       USB_AUTOPM_GET_INTERFACE(g_probe_info.intf);
+
+                       usbos_info->ctl_state = USBOS_REQUEST_STATE_SUBMITTED;
+
+                       ret = USB_SUBMIT_URB(usbos_info->ctl_urb);
+                       if (ret != 0) {
+                               DBUSERR(("%s CTRL USB_SUBMIT_URB failed, status %d\n",
+                                       __FUNCTION__, ret));
+
+                               usbos_info->ctl_state = USBOS_REQUEST_STATE_UNSCHEDULED;
+                               up(&usbos_info->ctl_lock);
+
+                               USB_AUTOPM_PUT_INTERFACE_ASYNC(g_probe_info.intf);
+                       }
+               }
+
+               /* Submit all available TX URBs */
+               while ((req = dbus_usbos_qdeq(&usbos_info->usbos_tx_list,
+                       &usbos_info->usbos_tx_list_lock)) != NULL) {
+
+                       /* Disable USB autosuspend until this request completes. If the
+                        * interface was suspended, this call blocks until it has been resumed.
+                        */
+                       USB_AUTOPM_GET_INTERFACE(g_probe_info.intf);
+
+                       spin_lock_irqsave(&usbos_info->txlock, flags);
+
+                       ret = USB_SUBMIT_URB(req->urb);
+                       if (ret == 0) {
+                               /* URB submitted successfully */
+                               dbus_usbos_qenq(&usbos_info->req_txpostedq, req,
+                                       &usbos_info->txposted_lock);
+                               atomic_inc(&usbos_info->txposted);
+                       } else {
+                               /* Submitting the URB failed. */
+                               DBUSERR(("%s TX USB_SUBMIT_URB failed, status %d\n",
+                                       __FUNCTION__, ret));
+
+                               USB_AUTOPM_PUT_INTERFACE_ASYNC(g_probe_info.intf);
+                       }
+
+                       spin_unlock_irqrestore(&usbos_info->txlock, flags);
+
+                       if (ret != 0) {
+                               /* Cleanup and notify higher layers */
+                               dbus_usbos_qenq(&usbos_info->req_txfreeq, req,
+                                       &usbos_info->txfree_lock);
+
+                               txirb = req->arg;
+                               if (txirb->send_buf) {
+                                       MFREE(usbos_info->pub->osh, txirb->send_buf, req->buf_len);
+                                       txirb->send_buf = NULL;
+                                       req->buf_len = 0;
+                               }
+
+                               if (likely (usbos_info->cbarg && usbos_info->cbs)) {
+                                       if (likely (usbos_info->cbs->send_irb_complete != NULL))
+                                               usbos_info->cbs->send_irb_complete(
+                                                       usbos_info->cbarg, txirb, DBUS_ERR_TXDROP);
+                               }
+                       }
+               }
+       }
+
+       return 0;
+} /* dbus_usbos_tx_thread_func */
+
+#endif /* USBOS_TX_THREAD */
+
+#ifdef USBOS_THREAD
+
+/**
+ * Increase system performance by creating a USB thread that runs parallel to other system
+ * activity.
+ */
+static void*
+dbus_usbos_thread_init(usbos_info_t *usbos_info)
+{
+       usbos_list_entry_t  *entry;
+       unsigned long       flags, ii;
+
+       spin_lock_init(&usbos_info->usbos_list_lock);
+       spin_lock_init(&usbos_info->ctrl_lock);
+       INIT_LIST_HEAD(&usbos_info->usbos_list);
+       INIT_LIST_HEAD(&usbos_info->usbos_free_list);
+       init_waitqueue_head(&usbos_info->usbos_queue_head);
+       atomic_set(&usbos_info->usbos_list_cnt, 0);
+
+
+       for (ii = 0; ii < (usbos_info->pub->nrxq + usbos_info->pub->ntxq); ii++) {
+               entry = MALLOC(usbos_info->pub->osh, sizeof(usbos_list_entry_t));
+               if (entry) {
+                       spin_lock_irqsave(&usbos_info->usbos_list_lock, flags);
+                       list_add_tail((struct list_head*) entry, &usbos_info->usbos_free_list);
+                       spin_unlock_irqrestore(&usbos_info->usbos_list_lock, flags);
+               } else {
+                       DBUSERR(("Failed to create list\n"));
+               }
+       }
+
+       usbos_info->usbos_kt = kthread_create(dbus_usbos_thread_func,
+               usbos_info, "usb-thread");
+
+       if (IS_ERR(usbos_info->usbos_kt)) {
+               DBUSERR(("Thread Creation failed\n"));
+               return (NULL);
+       }
+
+       wake_up_process(usbos_info->usbos_kt);
+
+       return (usbos_info->usbos_kt);
+}
+
+static void
+dbus_usbos_thread_deinit(usbos_info_t *usbos_info)
+{
+       struct list_head    *cur, *next;
+       usbos_list_entry_t  *entry;
+       unsigned long       flags;
+
+       if (usbos_info->usbos_kt) {
+               wake_up_interruptible(&usbos_info->usbos_queue_head);
+               kthread_stop(usbos_info->usbos_kt);
+       }
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wcast-qual"
+#endif
+       list_for_each_safe(cur, next, &usbos_info->usbos_list)
+       {
+               entry = list_entry(cur, struct usbos_list_entry, list);
+               /* detach this entry from the list and then free the entry */
+               spin_lock_irqsave(&usbos_info->usbos_list_lock, flags);
+               list_del(cur);
+               MFREE(usbos_info->pub->osh, entry, sizeof(usbos_list_entry_t));
+               spin_unlock_irqrestore(&usbos_info->usbos_list_lock, flags);
+       }
+
+       list_for_each_safe(cur, next, &usbos_info->usbos_free_list)
+       {
+               entry = list_entry(cur, struct usbos_list_entry, list);
+               /* detach this entry from the list and then free the entry */
+               spin_lock_irqsave(&usbos_info->usbos_list_lock, flags);
+               list_del(cur);
+               MFREE(usbos_info->pub->osh, entry, sizeof(usbos_list_entry_t));
+               spin_unlock_irqrestore(&usbos_info->usbos_list_lock, flags);
+       }
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+}
+
+/** Process completed URBs in a worker thread */
+static int
+dbus_usbos_thread_func(void *data)
+{
+       usbos_info_t        *usbos_info = (usbos_info_t *)data;
+       usbos_list_entry_t  *entry;
+       struct list_head    *cur, *next;
+       unsigned long       flags;
+
+#ifdef WL_THREADNICE
+       set_user_nice(current, WL_THREADNICE);
+#endif
+
+       while (1) {
+               /* If the list is empty, then go to sleep */
+               wait_event_interruptible_timeout
+               (usbos_info->usbos_queue_head,
+                       atomic_read(&usbos_info->usbos_list_cnt) > 0,
+                       100);
+
+               if (kthread_should_stop())
+                       break;
+
+               spin_lock_irqsave(&usbos_info->usbos_list_lock, flags);
+
+               /* For each entry on the list, process it.  Remove the entry from
+               * the list when done.
+               */
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wcast-qual"
+#endif
+               list_for_each_safe(cur, next, &usbos_info->usbos_list)
+               {
+                       urb_req_t           *req;
+                       int                 len;
+                       int                 stat;
+                       usbos_info_t        *usbos_info_local;
+
+                       entry = list_entry(cur, struct usbos_list_entry, list);
+                       if (entry == NULL)
+                               break;
+
+                       req = entry->urb_context;
+                       len = entry->urb_length;
+                       stat = entry->urb_status;
+                       usbos_info_local = req->usbinfo;
+
+                       /* detach this entry from the list and attach it to the free list */
+                       list_del_init(cur);
+                       spin_unlock_irqrestore(&usbos_info_local->usbos_list_lock, flags);
+
+                       dbus_usbos_recv_complete_handle(req, len, stat);
+
+                       spin_lock_irqsave(&usbos_info_local->usbos_list_lock, flags);
+
+                       list_add_tail(cur, &usbos_info_local->usbos_free_list);
+
+                       atomic_dec(&usbos_info_local->usbos_list_cnt);
+               }
+
+               spin_unlock_irqrestore(&usbos_info->usbos_list_lock, flags);
+
+       }
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+
+       return 0;
+} /* dbus_usbos_thread_func */
+
+/** Called on Linux calling URB callback, see dbus_usbos_recv_complete() */
+static void
+dbus_usbos_dispatch_schedule(CALLBACK_ARGS)
+{
+       urb_req_t           *req = urb->context;
+       usbos_info_t        *usbos_info = req->usbinfo;
+       usbos_list_entry_t  *entry;
+       unsigned long       flags;
+       struct list_head    *cur;
+
+       spin_lock_irqsave(&usbos_info->usbos_list_lock, flags);
+
+       cur   = usbos_info->usbos_free_list.next;
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wcast-qual"
+#endif
+       entry = list_entry(cur, struct usbos_list_entry, list);
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+
+       /* detach this entry from the free list and prepare it insert it to use list */
+       list_del_init(cur);
+
+       if (entry) {
+               entry->urb_context = urb->context;
+               entry->urb_length  = urb->actual_length;
+               entry->urb_status  = urb->status;
+
+               atomic_inc(&usbos_info->usbos_list_cnt);
+               list_add_tail(cur, &usbos_info->usbos_list);
+       } else {
+               DBUSERR(("!!!!!!OUT OF MEMORY!!!!!!!\n"));
+       }
+
+       spin_unlock_irqrestore(&usbos_info->usbos_list_lock, flags);
+
+       /* thread */
+       wake_up_interruptible(&usbos_info->usbos_queue_head);
+} /* dbus_usbos_dispatch_schedule */
+
+#endif /* USBOS_THREAD */
+
+
+
+
+#ifdef BCM_REQUEST_FW
+
+struct request_fw_context {
+       const struct firmware *firmware;
+       struct semaphore lock;
+};
+
+/*
+ * Callback for dbus_request_firmware().
+ */
+static void
+dbus_request_firmware_done(const struct firmware *firmware, void *ctx)
+{
+       struct request_fw_context *context = (struct request_fw_context*)ctx;
+
+       /* Store the received firmware handle in the context and wake requester */
+       context->firmware = firmware;
+       up(&context->lock);
+}
+
+/*
+ * Send a firmware request and wait for completion.
+ *
+ * The use of the asynchronous version of request_firmware() is needed to avoid
+ * kernel oopses when we just come out of system hibernate.
+ */
+static int
+dbus_request_firmware(const char *name, const struct firmware **firmware)
+{
+       struct request_fw_context *context;
+       int ret;
+
+       context = kzalloc(sizeof(*context), GFP_KERNEL);
+       if (!context)
+               return -ENOMEM;
+
+       sema_init(&context->lock, 0);
+
+       ret = request_firmware_nowait(THIS_MODULE, true, name, &g_probe_info.usb->dev,
+                                     GFP_KERNEL, context, dbus_request_firmware_done);
+       if (ret) {
+               kfree(context);
+               return ret;
+       }
+
+       /* Wait for completion */
+       if (down_interruptible(&context->lock) != 0) {
+               kfree(context);
+               return -ERESTARTSYS;
+       }
+
+       *firmware = context->firmware;
+       kfree(context);
+
+       return *firmware != NULL ? 0 : -ENOENT;
+}
+
+static void *
+dbus_get_fwfile(int devid, int chiprev, uint8 **fw, int *fwlen, uint16 boardtype, uint16 boardrev)
+{
+       const struct firmware *firmware = NULL;
+#ifndef OEM_ANDROID
+       s8 *device_id = NULL;
+       s8 *chip_rev = "";
+#endif /* OEM_ANDROID */
+       s8 file_name[64];
+       int ret;
+
+#ifndef OEM_ANDROID
+       switch (devid) {
+               case BCM4350_CHIP_ID:
+               case BCM4354_CHIP_ID:
+               case BCM43556_CHIP_ID:
+               case BCM43558_CHIP_ID:
+               case BCM43566_CHIP_ID:
+               case BCM43568_CHIP_ID:
+               case BCM43570_CHIP_ID:
+               case BCM4358_CHIP_ID:
+                       device_id = "4350";
+                       break;
+               case BCM43143_CHIP_ID:
+                       device_id = "43143";
+                       break;
+               case BCM43234_CHIP_ID:
+               case BCM43235_CHIP_ID:
+               case BCM43236_CHIP_ID:
+                       device_id = "43236";
+                       break;
+               case BCM43242_CHIP_ID:
+                       device_id = "43242";
+                       break;
+               case BCM43238_CHIP_ID:
+                       device_id = "43238";
+                       break;
+               case BCM43526_CHIP_ID:
+                       device_id = "43526";
+                       break;
+               case BCM43569_CHIP_ID:
+                       device_id = "43569";
+                       switch (chiprev) {
+                               case 0:
+                                       chip_rev = "a0";
+                                       break;
+                               case 2:
+                                       chip_rev = "a2";
+                                       break;
+                               default:
+                                       break;
+                       }
+                       break;
+               default:
+                       DBUSERR(("unsupported device %x\n", devid));
+                       return NULL;
+       }
+
+       /* Load firmware */
+       snprintf(file_name, sizeof(file_name), "brcm/bcm%s%s-firmware.bin", device_id, chip_rev);
+#else
+       snprintf(file_name, sizeof(file_name), "%s", CONFIG_ANDROID_BCMDHD_FW_PATH);
+#endif /* OEM_ANDROID */
+
+       ret = dbus_request_firmware(file_name, &firmware);
+       if (ret) {
+               DBUSERR(("fail to request firmware %s\n", file_name));
+               return NULL;
+       }
+
+       *fwlen = firmware->size;
+       *fw = (uint8 *)firmware->data;
+       return (void *)firmware;
+
+}
+
+static void *
+dbus_get_nvfile(int devid, int chiprev, uint8 **fw, int *fwlen, uint16 boardtype, uint16 boardrev)
+{
+       const struct firmware *firmware = NULL;
+#ifndef OEM_ANDROID
+       s8 *device_id = NULL;
+       s8 *chip_rev = "";
+#endif /* OEM_ANDROID */
+       s8 file_name[64];
+       int ret;
+
+#ifndef OEM_ANDROID
+       switch (devid) {
+               case BCM4350_CHIP_ID:
+               case BCM4354_CHIP_ID:
+               case BCM43556_CHIP_ID:
+               case BCM43558_CHIP_ID:
+               case BCM43566_CHIP_ID:
+               case BCM43568_CHIP_ID:
+               case BCM43570_CHIP_ID:
+               case BCM4358_CHIP_ID:
+                       device_id = "4350";
+                       break;
+               case BCM43143_CHIP_ID:
+                       device_id = "43143";
+                       break;
+               case BCM43234_CHIP_ID:
+                       device_id = "43234";
+                       break;
+               case BCM43235_CHIP_ID:
+                       device_id = "43235";
+                       break;
+               case BCM43236_CHIP_ID:
+                       device_id = "43236";
+                       break;
+               case BCM43238_CHIP_ID:
+                       device_id = "43238";
+                       break;
+               case BCM43242_CHIP_ID:
+                       device_id = "43242";
+                       break;
+               case BCM43526_CHIP_ID:
+                       device_id = "43526";
+                       break;
+               case BCM43569_CHIP_ID:
+                       device_id = "43569";
+                       switch (chiprev) {
+                               case 0:
+                                       chip_rev = "a0";
+                                       break;
+                               case 2:
+                                       chip_rev = "a2";
+                                       break;
+                               default:
+                                       break;
+                       }
+                       break;
+               default:
+                       DBUSERR(("unsupported device %x\n", devid));
+                       return NULL;
+       }
+
+       /* Load board specific nvram file */
+       snprintf(file_name, sizeof(file_name), "brcm/bcm%s%s-%2x-%2x.nvm",
+                device_id, chip_rev, boardtype, boardrev);
+#else
+       snprintf(file_name, sizeof(file_name), "%s", CONFIG_ANDROID_BCMDHD_NVRAM_PATH);
+#endif /* OEM_ANDROID */
+
+       ret = dbus_request_firmware(file_name, &firmware);
+       if (ret) {
+               DBUSERR(("fail to request nvram %s\n", file_name));
+
+#ifndef OEM_ANDROID
+               /* Load generic nvram file */
+               snprintf(file_name, sizeof(file_name), "brcm/bcm%s%s.nvm",
+                        device_id, chip_rev);
+
+               ret = dbus_request_firmware(file_name, &firmware);
+#endif /* OEM_ANDROID */
+
+               if (ret) {
+                       DBUSERR(("fail to request nvram %s\n", file_name));
+                       return NULL;
+               }
+       }
+
+       *fwlen = firmware->size;
+       *fw = (uint8 *)firmware->data;
+       return (void *)firmware;
+}
+
+void *
+dbus_get_fw_nvfile(int devid, int chiprev, uint8 **fw, int *fwlen, int type, uint16 boardtype,
+       uint16 boardrev)
+{
+       switch (type) {
+               case DBUS_FIRMWARE:
+                       return dbus_get_fwfile(devid, chiprev, fw, fwlen, boardtype, boardrev);
+               case DBUS_NVFILE:
+                       return dbus_get_nvfile(devid, chiprev, fw, fwlen, boardtype, boardrev);
+               default:
+                       return NULL;
+       }
+}
+
+void
+dbus_release_fw_nvfile(void *firmware)
+{
+       release_firmware((struct firmware *)firmware);
+}
+#endif /* BCM_REQUEST_FW */
+
+#ifdef BCMUSBDEV_COMPOSITE
+/**
+ * For a composite device the interface order is not guaranteed, scan the device struct for the WLAN
+ * interface.
+ */
+static int
+dbus_usbos_intf_wlan(struct usb_device *usb)
+{
+       int i, num_of_eps, ep, intf_wlan = -1;
+       int num_intf = CONFIGDESC(usb)->bNumInterfaces;
+       struct usb_endpoint_descriptor *endpoint;
+
+       for (i = 0; i < num_intf; i++) {
+               if (IFDESC(usb, i).bInterfaceClass != USB_CLASS_VENDOR_SPEC)
+                       continue;
+               num_of_eps = IFDESC(usb, i).bNumEndpoints;
+
+               for (ep = 0; ep < num_of_eps; ep++) {
+                       endpoint = &IFEPDESC(usb, i, ep);
+                       if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
+                               USB_ENDPOINT_XFER_BULK) {
+                               intf_wlan = i;
+                               break;
+                       }
+               }
+               if (ep < num_of_eps)
+                       break;
+       }
+
+       return intf_wlan;
+}
+#endif /* BCMUSBDEV_COMPOSITE */
diff --git a/bcmdhd.101.10.240.x/dhd.h b/bcmdhd.101.10.240.x/dhd.h
new file mode 100644 (file)
index 0000000..b8a1d53
--- /dev/null
@@ -0,0 +1,3762 @@
+/*
+ * Header file describing the internal (inter-module) DHD interfaces.
+ *
+ * Provides type definitions and function prototypes used to link the
+ * DHD OS, bus, and protocol modules.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+/****************
+ * Common types *
+ */
+
+#ifndef _dhd_h_
+#define _dhd_h_
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/random.h>
+#include <linux/spinlock.h>
+#include <linux/ethtool.h>
+#include <linux/proc_fs.h>
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+#if defined(CONFIG_HAS_WAKELOCK)
+#include <linux/wakelock.h>
+#endif /* defined CONFIG_HAS_WAKELOCK */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0)
+#include <uapi/linux/sched/types.h>
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
+#include <linux/sched/types.h>
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0) */
+/* The kernel threading is sdio-specific */
+struct task_struct;
+struct sched_param;
+#if defined(BT_OVER_SDIO)
+#include <dhd_bt_interface.h>
+#endif /* defined (BT_OVER_SDIO) */
+int setScheduler(struct task_struct *p, int policy, struct sched_param *param);
+int get_scheduler_policy(struct task_struct *p);
+#define MAX_EVENT      16
+
+#define ALL_INTERFACES 0xff
+
+/* H2D and D2H ring dump is enabled by default */
+#ifdef PCIE_FULL_DONGLE
+#define DHD_DUMP_PCIE_RINGS
+#endif /* PCIE_FULL_DONGLE */
+
+#include <osl.h>
+
+#include <wlioctl.h>
+#include <dhdioctl.h>
+#include <wlfc_proto.h>
+#include <hnd_armtrap.h>
+#if defined(DUMP_IOCTL_IOV_LIST) || defined(DHD_DEBUG)
+#include <bcmutils.h>
+#endif /* DUMP_IOCTL_IOV_LIST || DHD_DEBUG */
+
+#if defined(BCMWDF)
+#include <wdf.h>
+#include <WdfMiniport.h>
+#endif /* (BCMWDF)  */
+
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+#include <dnglioctl.h>
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+
+#ifdef DHD_ERPOM
+#include <pom.h>
+#endif /* DHD_ERPOM */
+
+#include <dngl_stats.h>
+#include <hnd_pktq.h>
+
+#ifdef DEBUG_DPC_THREAD_WATCHDOG
+#define MAX_RESCHED_CNT 600
+#endif /* DEBUG_DPC_THREAD_WATCHDOG */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) && LINUX_VERSION_CODE < \
+       KERNEL_VERSION(3, 18, 0) || defined(CONFIG_BCMDHD_VENDOR_EXT))
+#define WL_VENDOR_EXT_SUPPORT
+#endif /* 3.18 > KERNEL_VER >= 3.14 || defined(CONFIG_BCMDHD_VENDOR_EXT) */
+
+#if defined(KEEP_ALIVE)
+/* Default KEEP_ALIVE Period is 55 sec to prevent AP from sending Keep Alive probe frame */
+#define KEEP_ALIVE_PERIOD 55000
+#define NULL_PKT_STR   "null_pkt"
+#endif /* KEEP_ALIVE */
+
+/* By default enabled from here, later the WQ code will be removed */
+#define DHD_USE_KTHREAD_FOR_LOGTRACE
+
+/* Forward decls */
+struct dhd_bus;
+struct dhd_prot;
+struct dhd_info;
+struct dhd_ioctl;
+struct dhd_dbg;
+struct dhd_ts;
+#ifdef DNGL_AXI_ERROR_LOGGING
+struct dhd_axi_error_dump;
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+/* The level of bus communication with the dongle */
+enum dhd_bus_state {
+       DHD_BUS_DOWN,           /* Not ready for frame transfers */
+       DHD_BUS_LOAD,           /* Download access only (CPU reset) */
+       DHD_BUS_DATA,           /* Ready for frame transfers */
+       DHD_BUS_SUSPEND,        /* Bus has been suspended */
+       DHD_BUS_DOWN_IN_PROGRESS,       /* Bus going Down */
+       DHD_BUS_REMOVE, /* Bus has been removed */
+};
+
+/* The level of bus communication with the dongle */
+enum dhd_bus_devreset_type {
+       DHD_BUS_DEVRESET_ON = 0,        /* ON */
+       DHD_BUS_DEVRESET_OFF = 1,               /* OFF */
+       DHD_BUS_DEVRESET_FLR = 2,               /* FLR */
+       DHD_BUS_DEVRESET_FLR_FORCE_FAIL = 3,    /* FLR FORCE FAIL */
+       DHD_BUS_DEVRESET_QUIESCE = 4,           /* FLR */
+};
+
+/*
+ * Bit fields to Indicate clean up process that wait till they are finished.
+ * Future synchronizable processes can add their bit filed below and update
+ * their functionalities accordingly
+ */
+#define DHD_BUS_BUSY_IN_TX                   0x01
+#define DHD_BUS_BUSY_IN_SEND_PKT             0x02
+#define DHD_BUS_BUSY_IN_DPC                  0x04
+#define DHD_BUS_BUSY_IN_WD                   0x08
+#define DHD_BUS_BUSY_IN_IOVAR                0x10
+#define DHD_BUS_BUSY_IN_DHD_IOVAR            0x20
+#define DHD_BUS_BUSY_SUSPEND_IN_PROGRESS     0x40
+#define DHD_BUS_BUSY_RESUME_IN_PROGRESS      0x80
+#define DHD_BUS_BUSY_RPM_SUSPEND_IN_PROGRESS 0x100
+#define DHD_BUS_BUSY_RPM_SUSPEND_DONE        0x200
+#define DHD_BUS_BUSY_RPM_RESUME_IN_PROGRESS  0x400
+#define DHD_BUS_BUSY_RPM_ALL                 (DHD_BUS_BUSY_RPM_SUSPEND_DONE | \
+               DHD_BUS_BUSY_RPM_SUSPEND_IN_PROGRESS | \
+               DHD_BUS_BUSY_RPM_RESUME_IN_PROGRESS)
+#define DHD_BUS_BUSY_IN_CHECKDIED              0x800
+#define DHD_BUS_BUSY_IN_MEMDUMP                        0x1000
+#define DHD_BUS_BUSY_IN_SSSRDUMP               0x2000
+#define DHD_BUS_BUSY_IN_LOGDUMP                        0x4000
+#define DHD_BUS_BUSY_IN_HALDUMP                        0x8000
+#define DHD_BUS_BUSY_IN_NAPI                   0x10000
+#define DHD_BUS_BUSY_IN_DS_DEASSERT            0x20000
+
+#define DHD_BUS_BUSY_SET_IN_TX(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_TX
+#define DHD_BUS_BUSY_SET_IN_SEND_PKT(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_SEND_PKT
+#define DHD_BUS_BUSY_SET_IN_DPC(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_DPC
+#define DHD_BUS_BUSY_SET_IN_WD(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_WD
+#define DHD_BUS_BUSY_SET_IN_IOVAR(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_IOVAR
+#define DHD_BUS_BUSY_SET_IN_DHD_IOVAR(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_DHD_IOVAR
+#define DHD_BUS_BUSY_SET_SUSPEND_IN_PROGRESS(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_SUSPEND_IN_PROGRESS
+#define DHD_BUS_BUSY_SET_RESUME_IN_PROGRESS(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_RESUME_IN_PROGRESS
+#define DHD_BUS_BUSY_SET_RPM_SUSPEND_IN_PROGRESS(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_RPM_SUSPEND_IN_PROGRESS
+#define DHD_BUS_BUSY_SET_RPM_SUSPEND_DONE(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_RPM_SUSPEND_DONE
+#define DHD_BUS_BUSY_SET_RPM_RESUME_IN_PROGRESS(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_RPM_RESUME_IN_PROGRESS
+#define DHD_BUS_BUSY_SET_IN_CHECKDIED(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_CHECKDIED
+#define DHD_BUS_BUSY_SET_IN_MEMDUMP(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_MEMDUMP
+#define DHD_BUS_BUSY_SET_IN_SSSRDUMP(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_SSSRDUMP
+#define DHD_BUS_BUSY_SET_IN_LOGDUMP(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_LOGDUMP
+#define DHD_BUS_BUSY_SET_IN_HALDUMP(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_HALDUMP
+#define DHD_BUS_BUSY_SET_IN_NAPI(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_NAPI
+#define DHD_BUS_BUSY_SET_IN_DS_DEASSERT(dhdp) \
+       (dhdp)->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_DS_DEASSERT
+
+#define DHD_BUS_BUSY_CLEAR_IN_TX(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_TX
+#define DHD_BUS_BUSY_CLEAR_IN_SEND_PKT(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_SEND_PKT
+#define DHD_BUS_BUSY_CLEAR_IN_DPC(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_DPC
+#define DHD_BUS_BUSY_CLEAR_IN_WD(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_WD
+#define DHD_BUS_BUSY_CLEAR_IN_IOVAR(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_IOVAR
+#define DHD_BUS_BUSY_CLEAR_IN_DHD_IOVAR(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_DHD_IOVAR
+#define DHD_BUS_BUSY_CLEAR_SUSPEND_IN_PROGRESS(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_SUSPEND_IN_PROGRESS
+#define DHD_BUS_BUSY_CLEAR_RESUME_IN_PROGRESS(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_RESUME_IN_PROGRESS
+#define DHD_BUS_BUSY_CLEAR_RPM_SUSPEND_IN_PROGRESS(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_RPM_SUSPEND_IN_PROGRESS
+#define DHD_BUS_BUSY_CLEAR_RPM_SUSPEND_DONE(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_RPM_SUSPEND_DONE
+#define DHD_BUS_BUSY_CLEAR_RPM_RESUME_IN_PROGRESS(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_RPM_RESUME_IN_PROGRESS
+#define DHD_BUS_BUSY_CLEAR_IN_CHECKDIED(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_CHECKDIED
+#define DHD_BUS_BUSY_CLEAR_IN_MEMDUMP(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_MEMDUMP
+#define DHD_BUS_BUSY_CLEAR_IN_SSSRDUMP(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_SSSRDUMP
+#define DHD_BUS_BUSY_CLEAR_IN_LOGDUMP(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_LOGDUMP
+#define DHD_BUS_BUSY_CLEAR_IN_HALDUMP(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_HALDUMP
+#define DHD_BUS_BUSY_CLEAR_IN_NAPI(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_NAPI
+#define DHD_BUS_BUSY_CLEAR_IN_DS_DEASSERT(dhdp) \
+       (dhdp)->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_DS_DEASSERT
+
+#define DHD_BUS_BUSY_CHECK_IN_TX(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_IN_TX)
+#define DHD_BUS_BUSY_CHECK_IN_SEND_PKT(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_IN_SEND_PKT)
+#define DHD_BUS_BUSY_CHECK_IN_DPC(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_IN_DPC)
+#define DHD_BUS_BUSY_CHECK_IN_WD(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_IN_WD)
+#define DHD_BUS_BUSY_CHECK_IN_IOVAR(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_IN_IOVAR)
+#define DHD_BUS_BUSY_CHECK_IN_DHD_IOVAR(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_IN_DHD_IOVAR)
+#define DHD_BUS_BUSY_CHECK_SUSPEND_IN_PROGRESS(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_SUSPEND_IN_PROGRESS)
+#define DHD_BUS_BUSY_CHECK_RESUME_IN_PROGRESS(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_RESUME_IN_PROGRESS)
+#define DHD_BUS_BUSY_CHECK_RPM_SUSPEND_IN_PROGRESS(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_RPM_SUSPEND_IN_PROGRESS)
+#define DHD_BUS_BUSY_CHECK_RPM_SUSPEND_DONE(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_RPM_SUSPEND_DONE)
+#define DHD_BUS_BUSY_CHECK_RPM_RESUME_IN_PROGRESS(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_RPM_RESUME_IN_PROGRESS)
+#define DHD_BUS_BUSY_CHECK_RPM_ALL(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_RPM_ALL)
+#define DHD_BUS_BUSY_CHECK_IN_CHECKDIED(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_IN_CHECKDIED)
+#define DHD_BUS_BUSY_CHECK_IN_MEMDUMP(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_IN_MEMDUMP)
+#define DHD_BUS_BUSY_CHECK_IN_SSSRDUMP(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_IN_SSSRDUMP)
+#define DHD_BUS_BUSY_CHECK_IN_LOGDUMP(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_IN_LOGDUMP)
+#define DHD_BUS_BUSY_CHECK_IN_HALDUMP(dhdp) \
+       ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_IN_HALDUMP)
+#define DHD_BUS_BUSY_CHECK_IN_DS_DEASSERT(dhdp) \
+               ((dhdp)->dhd_bus_busy_state & DHD_BUS_BUSY_IN_DS_DEASSERT)
+#define DHD_BUS_BUSY_CHECK_IDLE(dhdp) \
+       ((dhdp)->dhd_bus_busy_state == 0)
+
+#define DHD_BUS_CHECK_SUSPEND_OR_SUSPEND_IN_PROGRESS(dhdp) \
+       ((dhdp)->busstate == DHD_BUS_SUSPEND || DHD_BUS_BUSY_CHECK_SUSPEND_IN_PROGRESS(dhdp))
+
+#define DHD_BUS_CHECK_ANY_SUSPEND_IN_PROGRESS(dhdp) \
+               (DHD_BUS_BUSY_CHECK_SUSPEND_IN_PROGRESS(dhdp) || \
+                DHD_BUS_BUSY_CHECK_RPM_SUSPEND_IN_PROGRESS(dhdp))
+
+#define DHD_BUS_CHECK_SUSPEND_OR_ANY_SUSPEND_IN_PROGRESS(dhdp) \
+       ((dhdp)->busstate == DHD_BUS_SUSPEND || DHD_BUS_CHECK_ANY_SUSPEND_IN_PROGRESS(dhdp))
+
+#define DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(dhdp) \
+               ((dhdp)->busstate == DHD_BUS_DOWN || (dhdp)->busstate == DHD_BUS_DOWN_IN_PROGRESS || \
+               (dhdp)->busstate == DHD_BUS_REMOVE)
+
+#define DHD_BUS_CHECK_REMOVE(dhdp) \
+               ((dhdp)->busstate == DHD_BUS_REMOVE)
+
+/* IOVar flags for common error checks */
+#define DHD_IOVF_PWRREQ_BYPASS (1<<0) /* flags to prevent bp access during host sleep state */
+
+#define MAX_MTU_SZ (1600u)
+
+#ifdef PCIE_INB_DW
+#define DHD_CHECK_CFG_IN_PROGRESS(dhdp) \
+       ((INBAND_DW_ENAB((dhdp)->bus)) ? dhd_check_cfg_in_progress(dhdp) : FALSE)
+#else
+#define DHD_CHECK_CFG_IN_PROGRESS(dhdp) FALSE
+#endif /* PCIE_INB_DW */
+
+#ifndef USEC_PER_SEC
+#define USEC_PER_SEC (1000 * 1000)
+#endif
+/* (u64)result = (u64)dividend / (u64)divisor */
+#define DIV_U64_BY_U64(dividend, divisor)      div64_u64(dividend, divisor)
+
+/* (u64)result = (u64)dividend / (u32)divisor */
+#define DIV_U64_BY_U32(dividend, divisor)      div_u64(dividend, divisor)
+
+/* Be careful while using this, as it divides dividend also
+ * (u32)remainder = (u64)dividend % (u32)divisor
+ * (u64)dividend = (u64)dividend / (u32)divisor
+ */
+#define DIV_AND_MOD_U64_BY_U32(dividend, divisor)      do_div(dividend, divisor)
+
+/* (u32)remainder = (u64)dividend % (u32)divisor */
+#define MOD_U64_BY_U32(dividend, divisor) ({                           \
+       uint64 temp_dividend = (dividend);                              \
+       uint32 rem = DIV_AND_MOD_U64_BY_U32(temp_dividend, (divisor));  \
+       rem;                                                            \
+})
+
+#define SEC_USEC_FMT \
+       "%5llu.%06u"
+
+/* t: time in nano second */
+#define GET_SEC_USEC(t) \
+       DIV_U64_BY_U32(t, NSEC_PER_SEC), \
+       ((uint32)(MOD_U64_BY_U32(t, NSEC_PER_SEC) / (uint32)NSEC_PER_USEC))
+
+/* Download Types */
+typedef enum download_type {
+       FW,
+       NVRAM,
+       CLM_BLOB,
+       TXCAP_BLOB
+} download_type_t;
+
+/* For supporting multiple interfaces */
+#define DHD_MAX_IFS                    16
+#define DHD_MAX_STATIC_IFS     1
+#define DHD_DEL_IF                     -0xE
+#define DHD_BAD_IF                     -0xF
+#define DHD_DUMMY_INFO_IF      0xDEAF  /* Hack i/f to handle events from INFO Ring */
+/* XXX to avoid build error for NDIS for timebeing */
+#define DHD_EVENT_IF DHD_DUMMY_INFO_IF
+
+enum dhd_op_flags {
+/* Firmware requested operation mode */
+       DHD_FLAG_STA_MODE                               = (1 << (0)), /* STA only */
+       DHD_FLAG_HOSTAP_MODE                            = (1 << (1)), /* SOFTAP only */
+       DHD_FLAG_P2P_MODE                               = (1 << (2)), /* P2P Only */
+       /* STA + P2P */
+       DHD_FLAG_CONCURR_SINGLE_CHAN_MODE = (DHD_FLAG_STA_MODE | DHD_FLAG_P2P_MODE),
+       /* STA + SoftAP */
+       DHD_FLAG_CONCURR_STA_HOSTAP_MODE = (DHD_FLAG_STA_MODE | DHD_FLAG_HOSTAP_MODE),
+       /* XXX MULTI_CHAN mode is meaningful only if it is conccurncy mode */
+       DHD_FLAG_CONCURR_MULTI_CHAN_MODE                = (1 << (4)), /* STA + P2P */
+       /* Current P2P mode for P2P connection */
+       DHD_FLAG_P2P_GC_MODE                            = (1 << (5)),
+       DHD_FLAG_P2P_GO_MODE                            = (1 << (6)),
+       DHD_FLAG_MBSS_MODE                              = (1 << (7)), /* MBSS in future */
+       DHD_FLAG_IBSS_MODE                              = (1 << (8)),
+       DHD_FLAG_MFG_MODE                               = (1 << (9)),
+       DHD_FLAG_RSDB_MODE                              = (1 << (10)),
+       DHD_FLAG_MP2P_MODE                              = (1 << (11))
+};
+
+#define DHD_OPMODE_SUPPORTED(dhd, opmode_flag) \
+       (dhd ? ((((dhd_pub_t *)dhd)->op_mode)  &  opmode_flag) : -1)
+#define DHD_OPMODE_STA_SOFTAP_CONCURR(dhd) \
+       (dhd ? (((((dhd_pub_t *)dhd)->op_mode) & DHD_FLAG_CONCURR_STA_HOSTAP_MODE) == \
+       DHD_FLAG_CONCURR_STA_HOSTAP_MODE) : 0)
+
+/* Max sequential TX/RX Control timeouts to set HANG event */
+#ifndef MAX_CNTL_TX_TIMEOUT
+#define MAX_CNTL_TX_TIMEOUT 2
+#endif /* MAX_CNTL_TX_TIMEOUT */
+#ifndef MAX_CNTL_RX_TIMEOUT
+#define MAX_CNTL_RX_TIMEOUT 1
+#endif /* MAX_CNTL_RX_TIMEOUT */
+
+#define DHD_SCAN_ASSOC_ACTIVE_TIME     40 /* ms: Embedded default Active setting from DHD */
+#define DHD_SCAN_UNASSOC_ACTIVE_TIME   80 /* ms: Embedded def. Unassoc Active setting from DHD */
+#define DHD_SCAN_HOME_TIME             45 /* ms: Embedded default Home time setting from DHD */
+#define DHD_SCAN_HOME_AWAY_TIME        100 /* ms: Embedded default Home Away time setting from DHD */
+#ifndef CUSTOM_SCAN_PASSIVE_TIME
+#define DHD_SCAN_PASSIVE_TIME          130 /* ms: Embedded default Passive setting from DHD */
+#else
+#define DHD_SCAN_PASSIVE_TIME  CUSTOM_SCAN_PASSIVE_TIME /* ms: Custom Passive setting from DHD */
+#endif /* CUSTOM_SCAN_PASSIVE_TIME */
+
+#ifndef POWERUP_MAX_RETRY
+#define POWERUP_MAX_RETRY      3 /* how many times we retry to power up the chip */
+#endif
+#ifndef POWERUP_WAIT_MS
+#define POWERUP_WAIT_MS                2000 /* ms: time out in waiting wifi to come up */
+#endif
+/*
+ * MAX_NVRAMBUF_SIZE determines the size of the Buffer in the DHD that holds
+ * the NVRAM data. That is the size of the buffer pointed by bus->vars
+ * This also needs to be increased to 24K to support NVRAM size higher than 16K
+ */
+#define MAX_NVRAMBUF_SIZE      (24 * 1024) /* max nvram buf size */
+#define MAX_CLM_BUF_SIZE       (48 * 1024) /* max clm blob size */
+#define MAX_TXCAP_BUF_SIZE     (16 * 1024) /* max txcap blob size */
+#ifdef DHD_DEBUG
+#define DHD_JOIN_MAX_TIME_DEFAULT 10000 /* ms: Max time out for joining AP */
+#define DHD_SCAN_DEF_TIMEOUT 10000 /* ms: Max time out for scan in progress */
+#endif /* DHD_DEBUG */
+
+#ifndef CONFIG_BCMDHD_CLM_PATH
+#if defined(CUSTOMER_HW4) && defined(PLATFORM_SLP)
+#define CONFIG_BCMDHD_CLM_PATH "/lib/firmware/bcmdhd_clm.blob"
+#else
+#define CONFIG_BCMDHD_CLM_PATH "/etc/wifi/bcmdhd_clm.blob"
+#endif /* CUSTOMER_HW4 && PLATFORM_SLP */
+#endif /* CONFIG_BCMDHD_CLM_PATH */
+#define WL_CCODE_NULL_COUNTRY  "#n"
+
+#define FW_VER_STR_LEN 128
+#define FWID_STR_LEN 256
+#define CLM_VER_STR_LEN 128
+#define BUS_API_REV_STR_LEN    128
+#define FW_VER_STR "Version"
+#define FWID_STR_1 "FWID: 01-"
+#define FWID_STR_2 "FWID=01-"
+extern char bus_api_revision[];
+
+enum dhd_bus_wake_state {
+       WAKE_LOCK_OFF                   = 0,
+       WAKE_LOCK_PRIV                  = 1,
+       WAKE_LOCK_DPC                   = 2,
+       WAKE_LOCK_IOCTL                 = 3,
+       WAKE_LOCK_DOWNLOAD              = 4,
+       WAKE_LOCK_TMOUT                 = 5,
+       WAKE_LOCK_WATCHDOG              = 6,
+       WAKE_LOCK_LINK_DOWN_TMOUT       = 7,
+       WAKE_LOCK_PNO_FIND_TMOUT        = 8,
+       WAKE_LOCK_SOFTAP_SET            = 9,
+       WAKE_LOCK_SOFTAP_STOP           = 10,
+       WAKE_LOCK_SOFTAP_START          = 11,
+       WAKE_LOCK_SOFTAP_THREAD         = 12
+};
+
+#ifdef PCIE_INB_DW
+enum dhd_bus_ds_state {
+       DW_DEVICE_DS_INVALID            = -1,
+       DW_DEVICE_DS_DEV_SLEEP          = 0,
+       DW_DEVICE_DS_DEV_SLEEP_PEND     = 1,
+       DW_DEVICE_DS_DISABLED_WAIT      = 2,
+       DW_DEVICE_DS_DEV_WAKE           = 3,
+       DW_DEVICE_DS_ACTIVE             = 4,
+       DW_DEVICE_HOST_SLEEP_WAIT       = 5,
+       DW_DEVICE_HOST_SLEEP            = 6,
+       DW_DEVICE_HOST_WAKE_WAIT        = 7,
+       DW_DEVICE_DS_D3_INFORM_WAIT     = 8
+};
+#endif /* PCIE_INB_DW */
+
+enum dhd_prealloc_index {
+       DHD_PREALLOC_PROT                       = 0,
+       DHD_PREALLOC_RXBUF                      = 1,
+       DHD_PREALLOC_DATABUF                    = 2,
+       DHD_PREALLOC_OSL_BUF                    = 3,
+       DHD_PREALLOC_SKB_BUF = 4,
+       DHD_PREALLOC_WIPHY_ESCAN0               = 5,
+       DHD_PREALLOC_WIPHY_ESCAN1               = 6,
+       DHD_PREALLOC_DHD_INFO                   = 7,
+       DHD_PREALLOC_DHD_WLFC_INFO              = 8,
+       DHD_PREALLOC_IF_FLOW_LKUP               = 9,
+       /* 10 */
+       DHD_PREALLOC_MEMDUMP_RAM                = 11,
+       DHD_PREALLOC_DHD_WLFC_HANGER            = 12,
+       DHD_PREALLOC_PKTID_MAP                  = 13,
+       DHD_PREALLOC_PKTID_MAP_IOCTL            = 14,
+       DHD_PREALLOC_DHD_LOG_DUMP_BUF           = 15,
+       DHD_PREALLOC_DHD_LOG_DUMP_BUF_EX        = 16,
+       DHD_PREALLOC_DHD_PKTLOG_DUMP_BUF        = 17,
+       DHD_PREALLOC_STAT_REPORT_BUF = 18,
+       DHD_PREALLOC_WL_ESCAN = 19,
+       DHD_PREALLOC_FW_VERBOSE_RING = 20,
+       DHD_PREALLOC_FW_EVENT_RING = 21,
+       DHD_PREALLOC_DHD_EVENT_RING = 22,
+       DHD_PREALLOC_NAN_EVENT_RING = 23
+};
+
+enum dhd_dongledump_mode {
+       DUMP_DISABLED           = 0,
+       DUMP_MEMONLY            = 1,
+       DUMP_MEMFILE            = 2,
+       DUMP_MEMFILE_BUGON      = 3,
+       DUMP_MEMFILE_MAX        = 4
+};
+
+enum dhd_dongledump_type {
+       DUMP_TYPE_RESUMED_ON_TIMEOUT            = 1,
+       DUMP_TYPE_D3_ACK_TIMEOUT                = 2,
+       DUMP_TYPE_DONGLE_TRAP                   = 3,
+       DUMP_TYPE_MEMORY_CORRUPTION             = 4,
+       DUMP_TYPE_PKTID_AUDIT_FAILURE           = 5,
+       DUMP_TYPE_PKTID_INVALID                 = 6,
+       DUMP_TYPE_SCAN_TIMEOUT                  = 7,
+       DUMP_TYPE_SCAN_BUSY                     = 8,
+       DUMP_TYPE_BY_SYSDUMP                    = 9,
+       DUMP_TYPE_BY_LIVELOCK                   = 10,
+       DUMP_TYPE_AP_LINKUP_FAILURE             = 11,
+       DUMP_TYPE_AP_ABNORMAL_ACCESS            = 12,
+       DUMP_TYPE_CFG_VENDOR_TRIGGERED          = 13,
+       DUMP_TYPE_RESUMED_ON_TIMEOUT_TX         = 14,
+       DUMP_TYPE_RESUMED_ON_TIMEOUT_RX         = 15,
+       DUMP_TYPE_RESUMED_ON_INVALID_RING_RDWR  = 16,
+       DUMP_TYPE_TRANS_ID_MISMATCH             = 17,
+       DUMP_TYPE_IFACE_OP_FAILURE              = 18,
+       DUMP_TYPE_DONGLE_INIT_FAILURE           = 19,
+       DUMP_TYPE_READ_SHM_FAIL                 = 20,
+       DUMP_TYPE_DONGLE_HOST_EVENT             = 21,
+       DUMP_TYPE_SMMU_FAULT                    = 22,
+       DUMP_TYPE_RESUMED_UNKNOWN               = 23,
+       DUMP_TYPE_DUE_TO_BT                     = 24,
+       DUMP_TYPE_LOGSET_BEYOND_RANGE           = 25,
+       DUMP_TYPE_BY_USER                       = 26,
+       DUMP_TYPE_CTO_RECOVERY                  = 27,
+       DUMP_TYPE_SEQUENTIAL_PRIVCMD_ERROR      = 28,
+       DUMP_TYPE_PROXD_TIMEOUT                 = 29,
+       DUMP_TYPE_INBAND_DEVICE_WAKE_FAILURE    = 30,
+       DUMP_TYPE_PKTID_POOL_DEPLETED           = 31,
+       DUMP_TYPE_ESCAN_SYNCID_MISMATCH         = 32
+};
+
+enum dhd_hang_reason {
+       HANG_REASON_MASK                                = 0x8000,
+       HANG_REASON_IOCTL_RESP_TIMEOUT                  = 0x8001,
+       HANG_REASON_DONGLE_TRAP                         = 0x8002,
+       HANG_REASON_D3_ACK_TIMEOUT                      = 0x8003,
+       HANG_REASON_BUS_DOWN                            = 0x8004,
+       HANG_REASON_MSGBUF_LIVELOCK                     = 0x8006,
+       HANG_REASON_IFACE_DEL_FAILURE                   = 0x8007,
+       HANG_REASON_HT_AVAIL_ERROR                      = 0x8008,
+       HANG_REASON_PCIE_RC_LINK_UP_FAIL                = 0x8009,
+       HANG_REASON_PCIE_PKTID_ERROR                    = 0x800A,
+       HANG_REASON_IFACE_ADD_FAILURE                   = 0x800B,
+       HANG_REASON_IOCTL_RESP_TIMEOUT_SCHED_ERROR      = 0x800C,
+       HANG_REASON_D3_ACK_TIMEOUT_SCHED_ERROR          = 0x800D,
+       HANG_REASON_SEQUENTIAL_PRIVCMD_ERROR            = 0x800E,
+       HANG_REASON_SCAN_BUSY                           = 0x800F,
+       HANG_REASON_BSS_UP_FAILURE                      = 0x8010,
+       HANG_REASON_BSS_DOWN_FAILURE                    = 0x8011,
+       HANG_REASON_IOCTL_SUSPEND_ERROR                 = 0x8012,
+       HANG_REASON_ESCAN_SYNCID_MISMATCH               = 0x8013,
+       HANG_REASON_PCIE_LINK_DOWN_RC_DETECT            = 0x8805,
+       HANG_REASON_INVALID_EVENT_OR_DATA               = 0x8806,
+       HANG_REASON_UNKNOWN                             = 0x8807,
+       HANG_REASON_PCIE_LINK_DOWN_EP_DETECT            = 0x8808,
+       HANG_REASON_PCIE_CTO_DETECT                     = 0x8809,
+       HANG_REASON_MAX                                 = 0x880A
+};
+
+#define WLC_E_DEAUTH_MAX_REASON 0x0FFF
+
+enum dhd_rsdb_scan_features {
+       /* Downgraded scan feature for AP active */
+       RSDB_SCAN_DOWNGRADED_AP_SCAN = 0x01,
+       /* Downgraded scan feature for P2P Discovery */
+       RSDB_SCAN_DOWNGRADED_P2P_DISC_SCAN = 0x02,
+       /* Enable channel pruning for ROAM SCAN */
+       RSDB_SCAN_DOWNGRADED_CH_PRUNE_ROAM = 0x10,
+       /* Enable channel pruning for any SCAN */
+       RSDB_SCAN_DOWNGRADED_CH_PRUNE_ALL  = 0x20
+};
+
+#define VENDOR_SEND_HANG_EXT_INFO_LEN (800 + 1)
+#ifdef DHD_EWPR_VER2
+#define VENDOR_SEND_HANG_EXT_INFO_VER 20181111
+#else
+#define VENDOR_SEND_HANG_EXT_INFO_VER 20170905
+#endif /* DHD_EWPR_VER2 */
+
+#define HANG_INFO_TRAP_T_NAME_MAX 6
+#define HANG_INFO_TRAP_T_REASON_IDX 0
+#define HANG_INFO_TRAP_T_SUBTYPE_IDX 2
+#define HANG_INFO_TRAP_T_OFFSET_IDX 3
+#define HANG_INFO_TRAP_T_EPC_IDX 4
+#define HANG_FIELD_STR_MAX_LEN 9
+#define HANG_FIELD_CNT_MAX 69
+#define HANG_FIELD_IF_FAILURE_CNT 10
+#define HANG_FIELD_IOCTL_RESP_TIMEOUT_CNT 8
+#define HANG_FIELD_TRAP_T_STACK_CNT_MAX 16
+#define HANG_FIELD_MISMATCH_CNT 10
+#define HANG_INFO_BIGDATA_KEY_STACK_CNT 4
+
+#define DEBUG_DUMP_TIME_BUF_LEN (16 + 1)
+/* delimiter between values */
+#define HANG_KEY_DEL    ' '
+#define HANG_RAW_DEL    '_'
+
+#ifdef DHD_EWPR_VER2
+#define HANG_INFO_BIGDATA_EXTRA_KEY 4
+#define HANG_INFO_TRAP_T_EXTRA_KEY_IDX 5
+#endif
+
+/* Packet alignment for most efficient SDIO (can change based on platform) */
+#ifndef DHD_SDALIGN
+#define DHD_SDALIGN    32
+#endif
+
+#define DHD_TX_CONTEXT_MASK 0xff
+#define DHD_TX_START_XMIT   0x01
+#define DHD_TX_SEND_PKT     0x02
+#define DHD_IF_SET_TX_ACTIVE(ifp, context)     \
+    ifp->tx_paths_active |= context;
+#define DHD_IF_CLR_TX_ACTIVE(ifp, context)     \
+    ifp->tx_paths_active &= ~context;
+#define DHD_IF_IS_TX_ACTIVE(ifp)       \
+       (ifp->tx_paths_active)
+/**
+ * DMA-able buffer parameters
+ * - dmaaddr_t is 32bits on a 32bit host.
+ *   dhd_dma_buf::pa may not be used as a sh_addr_t, bcm_addr64_t or uintptr
+ * - dhd_dma_buf::_alloced is ONLY for freeing a DMA-able buffer.
+ */
+typedef struct dhd_dma_buf {
+       void      *va;      /* virtual address of buffer */
+       uint32    len;      /* user requested buffer length */
+       dmaaddr_t pa;       /* physical address of buffer */
+       void      *dmah;    /* dma mapper handle */
+       void      *secdma;  /* secure dma sec_cma_info handle */
+       uint32    _alloced; /* actual size of buffer allocated with align and pad */
+} dhd_dma_buf_t;
+
+/* host reordering packts logic */
+/* followed the structure to hold the reorder buffers (void **p) */
+typedef struct reorder_info {
+       void **p;
+       uint8 flow_id;
+       uint8 cur_idx;
+       uint8 exp_idx;
+       uint8 max_idx;
+       uint8 pend_pkts;
+} reorder_info_t;
+
+/* throughput test packet format */
+typedef struct tput_pkt {
+       /* header */
+       uint8 mac_sta[ETHER_ADDR_LEN];
+       uint8 mac_ap[ETHER_ADDR_LEN];
+       uint16 pkt_type;
+       uint8 PAD[2];
+       /* data */
+       uint32 crc32;
+       uint32 pkt_id;
+       uint32 num_pkts;
+} tput_pkt_t;
+
+typedef enum {
+       TPUT_PKT_TYPE_NORMAL,
+       TPUT_PKT_TYPE_STOP
+} tput_pkt_type_t;
+
+#define TPUT_TEST_MAX_PAYLOAD 1500
+#define TPUT_TEST_WAIT_TIMEOUT_DEFAULT 5000
+
+#ifdef DHDTCPACK_SUPPRESS
+
+enum {
+       /* TCPACK suppress off */
+       TCPACK_SUP_OFF,
+       /* Replace TCPACK in txq when new coming one has higher ACK number. */
+       TCPACK_SUP_REPLACE,
+       /* TCPACK_SUP_REPLACE + delayed TCPACK TX unless ACK to PSH DATA.
+        * This will give benefits to Half-Duplex bus interface(e.g. SDIO) that
+        * 1. we are able to read TCP DATA packets first from the bus
+        * 2. TCPACKs that don't need to hurry delivered remains longer in TXQ so can be suppressed.
+        */
+       TCPACK_SUP_DELAYTX,
+       TCPACK_SUP_HOLD,
+       TCPACK_SUP_LAST_MODE
+};
+#endif /* DHDTCPACK_SUPPRESS */
+
+#define DHD_NULL_CHK_AND_RET(cond) \
+       if (!cond) { \
+               DHD_ERROR(("%s " #cond " is NULL\n", __FUNCTION__)); \
+               return; \
+       }
+
+#define DHD_NULL_CHK_AND_RET_VAL(cond, value) \
+       if (!cond) { \
+               DHD_ERROR(("%s " #cond " is NULL\n", __FUNCTION__)); \
+               return value; \
+       }
+
+#define DHD_NULL_CHK_AND_GOTO(cond, label) \
+       if (!cond) { \
+               DHD_ERROR(("%s " #cond " is NULL\n", __FUNCTION__)); \
+               goto label; \
+       }
+
+/*
+ * Accumulating the queue lengths of all flowring queues in a parent object,
+ * to assert flow control, when the cummulative queue length crosses an upper
+ * threshold defined on a parent object. Upper threshold may be maintained
+ * at a station level, at an interface level, or at a dhd instance.
+ *
+ * cumm_ctr_t abstraction:
+ * cumm_ctr_t abstraction may be enhanced to use an object with a hysterisis
+ * pause on/off threshold callback.
+ * All macros use the address of the cummulative length in the parent objects.
+ *
+ * Cummulative counters in parent objects may be updated without spinlocks.
+ *
+ * If a cummulative queue length is desired across all flows
+ * belonging to either of (a station, or an interface or a dhd instance), then
+ * an atomic operation is required using an atomic_t cummulative counters or
+ * using a spinlock. BCM_ROUTER_DHD uses the Linux atomic_t construct.
+ */
+
+/* Cummulative length not supported. */
+typedef uint32 cumm_ctr_t;
+#define DHD_CUMM_CTR_PTR(clen)     ((cumm_ctr_t*)(clen))
+#define DHD_CUMM_CTR(clen)         *(DHD_CUMM_CTR_PTR(clen)) /* accessor */
+#define DHD_CUMM_CTR_READ(clen)    DHD_CUMM_CTR(clen) /* read access */
+#define DHD_CUMM_CTR_INIT(clen)                                                \
+       ASSERT(DHD_CUMM_CTR_PTR(clen) != DHD_CUMM_CTR_PTR(NULL));
+#define DHD_CUMM_CTR_INCR(clen)                                                \
+       ASSERT(DHD_CUMM_CTR_PTR(clen) != DHD_CUMM_CTR_PTR(NULL));
+#define DHD_CUMM_CTR_DECR(clen)                                                \
+       ASSERT(DHD_CUMM_CTR_PTR(clen) != DHD_CUMM_CTR_PTR(NULL));
+
+#if defined(WLTDLS) && defined(PCIE_FULL_DONGLE)
+struct tdls_peer_node {
+       uint8 addr[ETHER_ADDR_LEN];
+       struct tdls_peer_node *next;
+};
+typedef struct tdls_peer_node tdls_peer_node_t;
+typedef struct {
+       tdls_peer_node_t *node;
+       uint8 tdls_peer_count;
+} tdls_peer_tbl_t;
+#endif /* defined(WLTDLS) && defined(PCIE_FULL_DONGLE) */
+
+#ifdef DHD_LOG_DUMP
+#define DUMP_SSSR_ATTR_START   2
+#define DUMP_SSSR_ATTR_COUNT   10
+
+typedef enum {
+       SSSR_C0_D11_BEFORE = 0,
+       SSSR_C0_D11_AFTER = 1,
+       SSSR_C1_D11_BEFORE = 2,
+       SSSR_C1_D11_AFTER = 3,
+       SSSR_C2_D11_BEFORE = 4,
+       SSSR_C2_D11_AFTER = 5,
+       SSSR_DIG_BEFORE = 6,
+       SSSR_DIG_AFTER = 7
+} EWP_SSSR_DUMP;
+
+typedef enum {
+       DLD_BUF_TYPE_GENERAL = 0,
+       DLD_BUF_TYPE_PRESERVE = 1,
+       DLD_BUF_TYPE_SPECIAL = 2,
+       DLD_BUF_TYPE_ECNTRS = 3,
+       DLD_BUF_TYPE_FILTER = 4,
+       DLD_BUF_TYPE_ALL = 5
+} log_dump_type_t;
+
+#define LOG_DUMP_MAGIC 0xDEB3DEB3
+#define HEALTH_CHK_BUF_SIZE 256
+#ifdef EWP_ECNTRS_LOGGING
+#define ECNTR_RING_ID 0xECDB
+#define        ECNTR_RING_NAME "ewp_ecntr_ring"
+#endif /* EWP_ECNTRS_LOGGING */
+
+#ifdef EWP_RTT_LOGGING
+#define        RTT_RING_ID 0xADCD
+#define        RTT_RING_NAME   "ewp_rtt_ring"
+#endif /* EWP_ECNTRS_LOGGING */
+
+/*
+ * XXX: Always add new enums at the end to compatible with parser,
+ * also add new section in split_ret of EWP_config.py
+ */
+typedef enum {
+       LOG_DUMP_SECTION_GENERAL = 0,
+       LOG_DUMP_SECTION_ECNTRS,
+       LOG_DUMP_SECTION_SPECIAL,
+       LOG_DUMP_SECTION_DHD_DUMP,
+       LOG_DUMP_SECTION_EXT_TRAP,
+       LOG_DUMP_SECTION_HEALTH_CHK,
+       LOG_DUMP_SECTION_PRESERVE,
+       LOG_DUMP_SECTION_COOKIE,
+       LOG_DUMP_SECTION_FLOWRING,
+       LOG_DUMP_SECTION_STATUS,
+       LOG_DUMP_SECTION_RTT
+} log_dump_section_type_t;
+
+/* Each section in the debug_dump log file shall begin with a header */
+typedef struct {
+       uint32 magic;  /* 0xDEB3DEB3 */
+       uint32 type;   /* of type log_dump_section_type_t */
+       uint64 timestamp;
+       uint32 length;  /* length of the section that follows */
+} log_dump_section_hdr_t;
+
+/* below structure describe ring buffer. */
+struct dhd_log_dump_buf
+{
+       spinlock_t lock;
+       void *dhd_pub;
+       unsigned int enable;
+       unsigned int wraparound;
+       unsigned long max;
+       unsigned int remain;
+       char* present;
+       char* front;
+       char* buffer;
+};
+
+#define DHD_LOG_DUMP_MAX_TEMP_BUFFER_SIZE      256
+#define DHD_LOG_DUMP_MAX_TAIL_FLUSH_SIZE (80 * 1024)
+
+extern void dhd_log_dump_write(int type, char *binary_data,
+               int binary_len, const char *fmt, ...);
+#endif /* DHD_LOG_DUMP */
+
+/* DEBUG_DUMP SUB COMMAND */
+enum {
+       CMD_DEFAULT,
+       CMD_UNWANTED,
+       CMD_DISCONNECTED,
+       CMD_MAX
+};
+
+#define DHD_LOG_DUMP_TS_MULTIPLIER_VALUE    60
+#define DHD_LOG_DUMP_TS_FMT_YYMMDDHHMMSSMSMS    "%02d%02d%02d%02d%02d%02d%04d"
+#define DHD_DEBUG_DUMP_TYPE            "debug_dump_FORUSER"
+#define DHD_DUMP_SUBSTR_UNWANTED       "_unwanted"
+#define DHD_DUMP_SUBSTR_DISCONNECTED   "_disconnected"
+
+#ifdef DNGL_AXI_ERROR_LOGGING
+#define DHD_DUMP_AXI_ERROR_FILENAME    "axi_error"
+#define DHD_DUMP_HAL_FILENAME_SUFFIX   "_hal"
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+extern void get_debug_dump_time(char *str);
+extern void clear_debug_dump_time(char *str);
+#if defined(WL_CFGVENDOR_SEND_HANG_EVENT) || defined(DHD_PKT_LOGGING)
+extern void copy_debug_dump_time(char *dest, char *src);
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT || DHD_PKT_LOGGING */
+
+#define FW_LOGSET_MASK_ALL 0xFFFFu
+
+#if defined(CUSTOMER_HW4)
+#ifndef DHD_COMMON_DUMP_PATH
+#define DHD_COMMON_DUMP_PATH   "/data/log/wifi/"
+#endif /* !DHD_COMMON_DUMP_PATH */
+#elif defined(BOARD_HIKEY)
+#define DHD_COMMON_DUMP_PATH   "/data/misc/wifi/"
+#elif defined(CUSTOMER_HW_AMLOGIC)
+#define DHD_COMMON_DUMP_PATH   "/data/vendor/misc/wifi/"
+#elif defined(__ARM_ARCH_7A__)
+#define DHD_COMMON_DUMP_PATH   "/data/vendor/wifi/"
+#else
+#define DHD_COMMON_DUMP_PATH   "/installmedia/"
+#endif /* CUSTOMER_HW4 */
+
+struct cntry_locales_custom {
+       char iso_abbrev[WLC_CNTRY_BUF_SZ];      /* ISO 3166-1 country abbreviation */
+       char custom_locale[WLC_CNTRY_BUF_SZ];   /* Custom firmware locale */
+       int32 custom_locale_rev;                /* Custom local revisin default -1 */
+};
+
+int dhd_send_msg_to_daemon(struct sk_buff *skb, void *data, int size);
+
+#ifdef DMAMAP_STATS
+typedef struct dmamap_stats {
+       uint64 txdata;
+       uint64 txdata_sz;
+       uint64 rxdata;
+       uint64 rxdata_sz;
+       uint64 ioctl_rx;
+       uint64 ioctl_rx_sz;
+       uint64 event_rx;
+       uint64 event_rx_sz;
+       uint64 info_rx;
+       uint64 info_rx_sz;
+       uint64 tsbuf_rx;
+       uint64 tsbuf_rx_sz;
+} dma_stats_t;
+#endif /* DMAMAP_STATS */
+
+/*  see wlfc_proto.h for tx status details */
+#define DHD_MAX_TX_STATUS_MSGS     9u
+
+#ifdef TX_STATUS_LATENCY_STATS
+typedef struct dhd_if_tx_status_latency {
+       /* total number of tx_status received on this interface */
+       uint64 num_tx_status;
+       /* cumulative tx_status latency for this interface */
+       uint64 cum_tx_status_latency;
+} dhd_if_tx_status_latency_t;
+#endif /* TX_STATUS_LATENCY_STATS */
+
+/* Bit in dhd_pub_t::gdb_proxy_stop_count set when firmware is stopped by GDB */
+#define GDB_PROXY_STOP_MASK 1
+
+/* Enable Reserve STA flowrings only for Android */
+#define DHD_LIMIT_MULTI_CLIENT_FLOWRINGS
+
+typedef enum {
+       FW_UNLOADED = 0,
+       FW_DOWNLOAD_IN_PROGRESS = 1,
+       FW_DOWNLOAD_DONE = 2
+} fw_download_status_t;
+
+#define PCIE_DB7_MAGIC_NUMBER_ISR_TRAP 0xdead0001
+#define PCIE_DB7_MAGIC_NUMBER_DPC_TRAP 0xdead0002
+
+typedef struct dhd_db7_info {
+       bool    fw_db7w_trap;
+       bool    fw_db7w_trap_inprogress;
+       uint32  db7_magic_number;
+
+       uint32  debug_db7_send_cnt;
+       uint32  debug_db7_trap_cnt;
+       uint32  debug_db7_timing_error_cnt;
+       uint64  debug_db7_send_time;
+       uint64  debug_db7_trap_time;
+       uint64  debug_max_db7_dur;
+       uint64  debug_max_db7_send_time;
+       uint64  debug_max_db7_trap_time;
+} dhd_db7_info_t;
+
+typedef enum dhd_induce_error_states
+{
+       DHD_INDUCE_ERROR_CLEAR          = 0x0,
+       DHD_INDUCE_IOCTL_TIMEOUT        = 0x1,
+       DHD_INDUCE_D3_ACK_TIMEOUT       = 0x2,
+       DHD_INDUCE_LIVELOCK             = 0x3,
+       DHD_INDUCE_DROP_OOB_IRQ         = 0x4,
+       DHD_INDUCE_DROP_AXI_SIG         = 0x5,
+       DHD_INDUCE_TX_BIG_PKT           = 0x6,
+       DHD_INDUCE_IOCTL_SUSPEND_ERROR  = 0x7,
+       DHD_INDUCE_ERROR_MAX
+} dhd_induce_error_states_t;
+
+#if defined(SHOW_LOGTRACE) && defined(DHD_USE_KTHREAD_FOR_LOGTRACE)
+/* Timestamps to trace dhd_logtrace_thread() */
+struct dhd_logtrace_thr_ts {
+       uint64 entry_time;
+       uint64 sem_down_time;
+       uint64 flush_time;
+       uint64 unexpected_break_time;
+       uint64 complete_time;
+};
+#endif /* SHOW_LOGTRACE && DHD_USE_KTHREAD_FOR_LOGTRACE */
+
+/**
+ * Common structure for module and instance linkage.
+ * Instantiated once per hardware (dongle) instance that this DHD manages.
+ */
+typedef struct dhd_pub {
+       /* Linkage ponters */
+       osl_t *osh;             /* OSL handle */
+       struct dhd_bus *bus;    /* Bus module handle */
+       struct dhd_prot *prot;  /* Protocol module handle */
+       struct dhd_info  *info; /* Info module handle */
+       struct dhd_dbg *dbg;    /* Debugability module handle */
+#if defined(SHOW_LOGTRACE) && defined(DHD_USE_KTHREAD_FOR_LOGTRACE)
+       struct dhd_logtrace_thr_ts logtrace_thr_ts;
+#endif /* SHOW_LOGTRACE && DHD_USE_KTHREAD_FOR_LOGTRACE */
+
+       /* to NDIS developer, the structure dhd_common is redundant,
+        * please do NOT merge it back from other branches !!!
+        */
+
+#ifdef BCMDBUS
+       struct dbus_pub *dbus;
+#endif /* BCMDBUS */
+
+       /* Internal dhd items */
+       bool up;                /* Driver up/down (to OS) */
+#ifdef WL_CFG80211
+       spinlock_t up_lock;     /* Synchronization with CFG80211 down */
+#endif /* WL_CFG80211 */
+       bool txoff;             /* Transmit flow-controlled */
+       bool dongle_reset;  /* TRUE = DEVRESET put dongle into reset */
+       enum dhd_bus_state busstate;
+       uint dhd_bus_busy_state;        /* Bus busy state */
+       uint hdrlen;            /* Total DHD header length (proto + bus) */
+       uint maxctl;            /* Max size rxctl request from proto to bus */
+       uint rxsz;              /* Rx buffer size bus module should use */
+       uint8 wme_dp;   /* wme discard priority */
+#ifdef DNGL_AXI_ERROR_LOGGING
+       uint32 axierror_logbuf_addr;
+       bool axi_error;
+       struct dhd_axi_error_dump *axi_err_dump;
+#endif /* DNGL_AXI_ERROR_LOGGING */
+       /* Dongle media info */
+       bool iswl;              /* Dongle-resident driver is wl */
+       ulong drv_version;      /* Version of dongle-resident driver */
+       struct ether_addr mac;  /* MAC address obtained from dongle */
+       dngl_stats_t dstats;    /* Stats for dongle-based data */
+
+       /* Additional stats for the bus level */
+       ulong tx_packets;       /* Data packets sent to dongle */
+       ulong actual_tx_pkts;   /* Actual data packets sent to dongle */
+       ulong tot_txcpl;        /* Total Tx completion received */
+       ulong tx_dropped;       /* Data packets dropped in dhd */
+       ulong tx_multicast;     /* Multicast data packets sent to dongle */
+       ulong tx_errors;        /* Errors in sending data to dongle */
+       ulong tx_ctlpkts;       /* Control packets sent to dongle */
+       ulong tx_ctlerrs;       /* Errors sending control frames to dongle */
+       ulong rx_packets;       /* Packets sent up the network interface */
+       ulong rx_multicast;     /* Multicast packets sent up the network interface */
+       ulong rx_errors;        /* Errors processing rx data packets */
+       ulong rx_ctlpkts;       /* Control frames processed from dongle */
+       ulong rx_ctlerrs;       /* Errors in processing rx control frames */
+       ulong rx_dropped;       /* Packets dropped locally (no memory) */
+       ulong rx_flushed;  /* Packets flushed due to unscheduled sendup thread */
+       ulong wd_dpc_sched;   /* Number of times dhd dpc scheduled by watchdog timer */
+       ulong rx_pktgetfail; /* Number of PKTGET failures in DHD on RX */
+       ulong tx_pktgetfail; /* Number of PKTGET failures in DHD on TX */
+       ulong rx_readahead_cnt; /* Number of packets where header read-ahead was used. */
+       ulong tx_realloc;       /* Number of tx packets we had to realloc for headroom */
+       ulong fc_packets;       /* Number of flow control pkts recvd */
+       ulong tx_big_packets;   /* Dropped data packets that are larger than MAX_MTU_SZ */
+#ifdef DMAMAP_STATS
+       /* DMA Mapping statistics */
+       dma_stats_t dma_stats;
+#endif /* DMAMAP_STATS */
+#ifdef WL_MONITOR
+       bool monitor_enable;
+#endif /* WL_MONITOR */
+       /* Last error return */
+       int bcmerror;
+       uint tickcnt;
+
+       /* Last error from dongle */
+       int dongle_error;
+
+       uint8 country_code[WLC_CNTRY_BUF_SZ];
+
+       /* Suspend disable flag and "in suspend" flag */
+       int suspend_disable_flag; /* "1" to disable all extra powersaving during suspend */
+       int in_suspend;                 /* flag set to 1 when early suspend called */
+#ifdef PNO_SUPPORT
+       int pno_enable;                 /* pno status : "1" is pno enable */
+       int pno_suspend;                /* pno suspend status : "1" is pno suspended */
+#endif /* PNO_SUPPORT */
+       /* DTIM skip value, default 0(or 1) means wake each DTIM
+        * 3 means skip 2 DTIMs and wake up 3rd DTIM(9th beacon when AP DTIM is 3)
+        */
+       int suspend_bcn_li_dtim;         /* bcn_li_dtim value in suspend mode */
+#ifdef PKT_FILTER_SUPPORT
+       int early_suspended;    /* Early suspend status */
+       int dhcp_in_progress;   /* DHCP period */
+#endif
+
+       /* Pkt filter defination */
+       char * pktfilter[100];
+       int pktfilter_count;
+
+       wl_country_t dhd_cspec;         /* Current Locale info */
+#ifdef CUSTOM_COUNTRY_CODE
+       uint dhd_cflags;
+#endif /* CUSTOM_COUNTRY_CODE */
+#if defined(DHD_BLOB_EXISTENCE_CHECK)
+       bool is_blob;                   /* Checking for existance of Blob file */
+#endif /* DHD_BLOB_EXISTENCE_CHECK */
+       bool force_country_change;
+       int     op_mode;                                /* STA, HostAPD, WFD, SoftAP */
+
+       struct mutex wl_start_stop_lock; /* lock/unlock for Android start/stop */
+       struct mutex wl_softap_lock;             /* lock/unlock for any SoftAP/STA settings */
+
+#ifdef PROP_TXSTATUS
+       bool    wlfc_enabled;
+       int     wlfc_mode;
+       void*   wlfc_state;
+       /*
+       Mode in which the dhd flow control shall operate. Must be set before
+       traffic starts to the device.
+       0 - Do not do any proptxtstatus flow control
+       1 - Use implied credit from a packet status
+       2 - Use explicit credit
+       3 - Only AMPDU hostreorder used. no wlfc.
+       */
+       uint8   proptxstatus_mode;
+       bool    proptxstatus_txoff;
+       bool    proptxstatus_module_ignore;
+       bool    proptxstatus_credit_ignore;
+       bool    proptxstatus_txstatus_ignore;
+
+       bool    wlfc_rxpkt_chk;
+#ifdef LIMIT_BORROW
+       bool wlfc_borrow_allowed;
+#endif /* LIMIT_BORROW */
+       /*
+        * implement below functions in each platform if needed.
+        */
+       /* platform specific function whether to skip flow control */
+       bool (*skip_fc)(void * dhdp, uint8 ifx);
+       /* platform specific function for wlfc_enable and wlfc_deinit */
+       void (*plat_init)(void *dhd);
+       void (*plat_deinit)(void *dhd);
+#ifdef DHD_WLFC_THREAD
+       bool                wlfc_thread_go;
+       struct task_struct* wlfc_thread;
+       wait_queue_head_t   wlfc_wqhead;
+#endif /* DHD_WLFC_THREAD */
+#endif /* PROP_TXSTATUS */
+#ifdef PNO_SUPPORT
+       void *pno_state;
+#endif
+#ifdef RTT_SUPPORT
+       void *rtt_state;
+       bool rtt_supported;
+#endif
+#ifdef ROAM_AP_ENV_DETECTION
+       bool    roam_env_detection;
+#endif
+       bool    dongle_isolation;
+       bool    is_pcie_watchdog_reset;
+
+/* Begin - Variables to track Bus Errors */
+       bool    dongle_trap_occured;    /* flag for sending HANG event to upper layer */
+       bool    iovar_timeout_occured;  /* flag to indicate iovar resumed on timeout */
+       bool    is_sched_error;         /* flag to indicate timeout due to scheduling issue */
+#ifdef PCIE_FULL_DONGLE
+       bool    d3ack_timeout_occured;  /* flag to indicate d3ack resumed on timeout */
+       bool    livelock_occured;       /* flag to indicate livelock occured */
+       bool    pktid_audit_failed;     /* flag to indicate pktid audit failure */
+#endif /* PCIE_FULL_DONGLE */
+       bool    iface_op_failed;        /* flag to indicate interface operation failed */
+       bool    scan_timeout_occurred;  /* flag to indicate scan has timedout */
+       bool    scan_busy_occurred;     /* flag to indicate scan busy occurred */
+#ifdef BT_OVER_SDIO
+       bool    is_bt_recovery_required;
+#endif
+       bool    smmu_fault_occurred;    /* flag to indicate SMMU Fault */
+/*
+ * Add any new variables to track Bus errors above
+ * this line. Also ensure that the variable is
+ * cleared from dhd_clear_bus_errors
+ */
+/* End - Variables to track Bus Errors */
+
+       int   hang_was_sent;
+       int   hang_was_pending;
+       int   rxcnt_timeout;            /* counter rxcnt timeout to send HANG */
+       int   txcnt_timeout;            /* counter txcnt timeout to send HANG */
+#ifdef BCMPCIE
+       int   d3ackcnt_timeout;         /* counter d3ack timeout to send HANG */
+#endif /* BCMPCIE */
+       bool hang_report;               /* enable hang report by default */
+       uint16 hang_reason;             /* reason codes for HANG event */
+#if defined(DHD_HANG_SEND_UP_TEST)
+       uint req_hang_type;
+#endif /* DHD_HANG_SEND_UP_TEST */
+#ifdef DHD_DETECT_CONSECUTIVE_MFG_HANG
+       uint hang_count;
+#endif /* DHD_DETECT_CONSECUTIVE_MFG_HANG */
+#ifdef WLTDLS
+       bool tdls_enable;
+#endif
+       struct reorder_info *reorder_bufs[WLHOST_REORDERDATA_MAXFLOWS];
+       #define WLC_IOCTL_MAXBUF_FWCAP  1024
+       char  fw_capabilities[WLC_IOCTL_MAXBUF_FWCAP];
+       #define MAXSKBPEND 1024
+       void *skbbuf[MAXSKBPEND];
+       uint32 store_idx;
+       uint32 sent_idx;
+#ifdef DHDTCPACK_SUPPRESS
+       uint8 tcpack_sup_mode;          /* TCPACK suppress mode */
+       void *tcpack_sup_module;        /* TCPACK suppress module */
+       uint32 tcpack_sup_ratio;
+       uint32 tcpack_sup_delay;
+#endif /* DHDTCPACK_SUPPRESS */
+#if defined(ARP_OFFLOAD_SUPPORT)
+       uint32 arp_version;
+       bool hmac_updated;
+#endif
+#if defined(BCMSUP_4WAY_HANDSHAKE)
+       bool fw_4way_handshake;         /* Whether firmware will to do the 4way handshake. */
+#endif
+#ifdef DEBUG_DPC_THREAD_WATCHDOG
+       bool dhd_bug_on;
+#endif /* DEBUG_DPC_THREAD_WATCHDOG */
+#ifdef CUSTOM_SET_CPUCORE
+       struct task_struct * current_dpc;
+       struct task_struct * current_rxf;
+       int chan_isvht80;
+#endif /* CUSTOM_SET_CPUCORE */
+       void    *sta_pool;          /* pre-allocated pool of sta objects */
+       void    *staid_allocator;   /* allocator of sta indexes */
+#ifdef PCIE_FULL_DONGLE
+       bool    flow_rings_inited;      /* set this flag after initializing flow rings */
+#endif /* PCIE_FULL_DONGLE */
+       void    *flowid_allocator;  /* unique flowid allocator */
+#if defined(DHD_HTPUT_TUNABLES)
+       void    *htput_flowid_allocator;  /* unique htput flowid allocator */
+       uint8   htput_client_flow_rings;  /* current number of htput client flowrings */
+       uint8   htput_flow_ring_start;    /* start index of htput flow rings */
+#endif /* DHD_HTPUT_TUNABLES */
+       void    *flow_ring_table;   /* flow ring table, include prot and bus info */
+       void    *if_flow_lkup;      /* per interface flowid lkup hash table */
+       void    *flowid_lock;       /* per os lock for flowid info protection */
+       void    *flowring_list_lock;       /* per os lock for flowring list protection */
+       uint8   max_multi_client_flow_rings;
+       uint8   multi_client_flow_rings;
+       uint32  num_h2d_rings;          /* Max h2d rings including static and dynamic rings */
+       uint32  max_tx_flowid;          /* used to validate flowid */
+       cumm_ctr_t cumm_ctr;        /* cumm queue length placeholder  */
+       cumm_ctr_t l2cumm_ctr;      /* level 2 cumm queue length placeholder */
+       uint32 d2h_sync_mode;       /* D2H DMA completion sync mode */
+       uint8  flow_prio_map[NUMPRIO];
+       uint8   flow_prio_map_type;
+       char enable_log[MAX_EVENT];
+       bool dma_d2h_ring_upd_support;
+       bool dma_h2d_ring_upd_support;
+       bool dma_ring_upd_overwrite;    /* host overwrites support setting */
+
+       bool hwa_capable;
+       uint hwa_inited;
+
+       bool idma_enable;
+       uint idma_inited;
+
+       bool ifrm_enable;                       /* implicit frm enable */
+       uint ifrm_inited;                       /* implicit frm init */
+
+       bool dar_enable;                /* use DAR registers */
+       uint dar_inited;
+
+       bool fast_delete_ring_support;          /* fast delete ring supported */
+
+#ifdef DHD_L2_FILTER
+       unsigned long l2_filter_cnt;    /* for L2_FILTER ARP table timeout */
+#endif /* DHD_L2_FILTER */
+#ifdef DHD_SSSR_DUMP
+       bool sssr_inited;
+       bool sssr_dump_collected;       /* Flag to indicate sssr dump is collected */
+       sssr_reg_info_cmn_t *sssr_reg_info;
+       uint8 *sssr_mempool;
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+       uint *sssr_d11_before[MAX_NUM_D11_CORES_WITH_SCAN];
+       uint *sssr_dig_buf_before;
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+       uint *sssr_d11_after[MAX_NUM_D11_CORES_WITH_SCAN];
+       bool sssr_d11_outofreset[MAX_NUM_D11_CORES_WITH_SCAN];
+       uint *sssr_dig_buf_after;
+       uint32 sssr_dump_mode;
+       bool collect_sssr;              /* Flag to indicate SSSR dump is required */
+       bool fis_triggered;
+#endif /* DHD_SSSR_DUMP */
+#ifdef DHD_SDTC_ETB_DUMP
+       etb_addr_info_t etb_addr_info;
+       uint8 *sdtc_etb_mempool;
+       bool sdtc_etb_inited;
+       bool collect_sdtc;              /* Flag to indicate SDTC dump is required */
+#endif /* DHD_SDTC_ETB_DUMP */
+       uint8 *soc_ram;
+       uint32 soc_ram_length;
+       uint32 memdump_type;
+#ifdef DHD_FW_COREDUMP
+       uint32 memdump_enabled;
+#ifdef DHD_DEBUG_UART
+       bool memdump_success;
+#endif /* DHD_DEBUG_UART */
+#endif /* DHD_FW_COREDUMP */
+#ifdef PCIE_FULL_DONGLE
+#ifdef WLTDLS
+       tdls_peer_tbl_t peer_tbl;
+#endif /* WLTDLS */
+       uint8 tx_in_progress;
+#endif /* PCIE_FULL_DONGLE */
+#ifdef KEEP_JP_REGREV
+/* XXX Needed by customer's request */
+       char vars_ccode[WLC_CNTRY_BUF_SZ];
+       uint vars_regrev;
+#endif /* KEEP_JP_REGREV */
+#ifdef WLTDLS
+       uint32 tdls_mode;
+#endif
+#ifdef GSCAN_SUPPORT
+       bool lazy_roam_enable;
+#endif
+#if defined(PKT_FILTER_SUPPORT) && defined(APF)
+       bool apf_set;
+#endif /* PKT_FILTER_SUPPORT && APF */
+       void *macdbg_info;
+#ifdef DHD_WET
+       void *wet_info;
+#endif
+       bool    h2d_phase_supported;
+       bool    force_dongletrap_on_bad_h2d_phase;
+       uint32  dongle_trap_data;
+       fw_download_status_t    fw_download_status;
+       trap_t  last_trap_info; /* trap info from the last trap */
+       uint8 rand_mac_oui[DOT11_OUI_LEN];
+#ifdef DHD_LOSSLESS_ROAMING
+       uint8 dequeue_prec_map;
+       uint8 prio_8021x;
+#endif
+#ifdef WL_NATOE
+       struct dhd_nfct_info *nfct;
+       spinlock_t nfct_lock;
+#endif /* WL_NATOE */
+       /* timesync link */
+       struct dhd_ts *ts;
+       bool    d2h_hostrdy_supported;
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       atomic_t block_bus;
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+#if defined(DBG_PKT_MON) || defined(DHD_PKT_LOGGING)
+       bool d11_tx_status;
+#endif /* DBG_PKT_MON || DHD_PKT_LOGGING */
+       uint16 ndo_version;     /* ND offload version supported */
+#ifdef NDO_CONFIG_SUPPORT
+       bool ndo_enable;                /* ND offload feature enable */
+       bool ndo_host_ip_overflow;      /* # of host ip addr exceed FW capacity */
+       uint32 ndo_max_host_ip;         /* # of host ip addr supported by FW */
+#endif /* NDO_CONFIG_SUPPORT */
+#if defined(DHD_LOG_DUMP)
+       /* buffer to hold 'dhd dump' data before dumping to file */
+       uint8 *concise_dbg_buf;
+       uint64 last_file_posn;
+       int logdump_periodic_flush;
+#ifdef EWP_ECNTRS_LOGGING
+       void *ecntr_dbg_ring;
+#endif
+#ifdef EWP_RTT_LOGGING
+       void *rtt_dbg_ring;
+#endif
+#ifdef DNGL_EVENT_SUPPORT
+       uint8 health_chk_event_data[HEALTH_CHK_BUF_SIZE];
+#endif
+       void *logdump_cookie;
+#endif /* DHD_LOG_DUMP */
+       uint32 dhd_console_ms; /** interval for polling the dongle for console (log) messages */
+       bool ext_trap_data_supported;
+       uint32 *extended_trap_data;
+#ifdef DUMP_IOCTL_IOV_LIST
+       /* dump iovar list */
+       dll_t dump_iovlist_head;
+       uint8 dump_iovlist_len;
+#endif /* DUMP_IOCTL_IOV_LIST */
+#ifdef CUSTOM_SET_ANTNPM
+       uint32 mimo_ant_set;
+#endif /* CUSTOM_SET_ANTNPM */
+#ifdef CUSTOM_SET_OCLOFF
+       bool ocl_off;
+#endif /* CUSTOM_SET_OCLOFF */
+#ifdef DHD_DEBUG
+       /* memwaste feature */
+       dll_t mw_list_head; /* memwaste list head */
+       uint32 mw_id; /* memwaste list unique id */
+#endif /* DHD_DEBUG */
+#ifdef WLTDLS
+       spinlock_t tdls_lock;
+#endif /* WLTDLS */
+       uint pcie_txs_metadata_enable;
+       uint wbtext_policy;     /* wbtext policy of dongle */
+       bool wbtext_support;    /* for product policy only */
+#ifdef PCIE_INB_DW
+       bool    d2h_inband_dw;
+       enum dhd_bus_ds_state   ds_state;
+#endif /* PCIE_INB_DW */
+       bool max_dtim_enable;   /* use MAX bcn_li_dtim value in suspend mode */
+       tput_test_t tput_data;
+       uint64 tput_start_ts;
+       uint64 tput_stop_ts;
+       uint dhd_watchdog_ms_backup;
+       bool wl_event_enabled;
+       bool logtrace_pkt_sendup;
+#ifdef GDB_PROXY
+       /* True if firmware runs under gdb control (this may cause timeouts at any point) */
+       bool gdb_proxy_active;
+       /* True if deadman_to shall be forced to 0 */
+       bool gdb_proxy_nodeadman;
+       /* Counter incremented at each firmware stop/go transition. LSB (GDB_PROXY_STOP_MASK)
+        * is set when firmwar eis stopped, clear when running
+        */
+       uint32 gdb_proxy_stop_count;
+#endif /* GDB_PROXY */
+       int debug_dump_subcmd;
+       uint64 debug_dump_time_sec;
+       bool hscb_enable;
+       uint32 logset_prsrv_mask;
+#ifdef DHD_PKT_LOGGING
+       struct dhd_pktlog *pktlog;
+       char debug_dump_time_pktlog_str[DEBUG_DUMP_TIME_BUF_LEN];
+       bool pktlog_debug;
+#endif /* DHD_PKT_LOGGING */
+#ifdef EWP_EDL
+       bool dongle_edl_support;
+       dhd_dma_buf_t edl_ring_mem;
+#endif /* EWP_EDL */
+       struct mutex ndev_op_sync;
+       bool debug_buf_dest_support;
+       uint32 debug_buf_dest_stat[DEBUG_BUF_DEST_MAX];
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+       char *hang_info;
+       int hang_info_cnt;
+       char debug_dump_time_hang_str[DEBUG_DUMP_TIME_BUF_LEN];
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+       char debug_dump_time_str[DEBUG_DUMP_TIME_BUF_LEN];
+       void *event_log_filter;
+       uint tput_test_done;
+       wait_queue_head_t tx_tput_test_wait;
+       wait_queue_head_t tx_completion_wait;
+#ifdef DHD_ERPOM
+       bool enable_erpom;
+       pom_func_handler_t pom_wlan_handler;
+       int (*pom_func_register)(pom_func_handler_t *func);
+       int (*pom_func_deregister)(pom_func_handler_t *func);
+       int (*pom_toggle_reg_on)(uchar func_id, uchar reason);
+#endif /* DHD_ERPOM */
+#if defined(DHD_H2D_LOG_TIME_SYNC)
+#define DHD_H2D_LOG_TIME_STAMP_MATCH   (10000) /* 10 Seconds */
+       /*
+        * Interval for updating the dongle console message time stamp with the Host (DHD)
+        * time stamp
+        */
+       uint32 dhd_rte_time_sync_ms;
+#endif /* DHD_H2D_LOG_TIME_SYNC */
+       uint32 batch_tx_pkts_cmpl;
+       uint32 batch_tx_num_pkts;
+#ifdef DHD_DUMP_MNGR
+       struct _dhd_dump_file_manage *dump_file_manage;
+#endif /* DHD_DUMP_MNGR */
+       bool event_log_max_sets_queried;
+       uint32 event_log_max_sets;
+#ifdef DHD_STATUS_LOGGING
+       void *statlog;
+#endif /* DHD_STATUS_LOGGING */
+#ifdef DHD_DB0TS
+       bool db0ts_capable;
+#endif /* DHD_DB0TS */
+       bool extdtxs_in_txcpl;
+       bool hostrdy_after_init;
+       uint16 dhd_induce_error;
+       int wlc_ver_major;
+       int wlc_ver_minor;
+#ifdef SUPPORT_SET_TID
+       uint8 tid_mode;
+       uint32 target_uid;
+       uint8 target_tid;
+#endif /* SUPPORT_SET_TID */
+#ifdef CONFIG_SILENT_ROAM
+       bool sroam_turn_on;     /* Silent roam monitor enable flags */
+       bool sroamed;           /* Silent roam monitor check flags */
+#endif /* CONFIG_SILENT_ROAM */
+#ifdef DHD_PKTDUMP_ROAM
+       void *pktcnts;
+#endif /* DHD_PKTDUMP_ROAM */
+       dhd_db7_info_t db7_trap;
+       bool fw_preinit;
+       bool ring_attached;
+#ifdef DHD_PCIE_RUNTIMEPM
+       bool rx_pending_due_to_rpm;
+#endif /* DHD_PCIE_RUNTIMEPM */
+       bool disable_dtim_in_suspend;   /* Disable set bcn_li_dtim in suspend */
+       union {
+               wl_roam_stats_v1_t v1;
+       } roam_evt;
+       bool arpoe_enable;
+       bool arpol_configured;
+#ifdef DHD_TX_PROFILE
+       bool tx_profile_enab;
+       uint8 num_profiles;
+       dhd_tx_profile_protocol_t *protocol_filters;
+#endif /* defined(DHD_TX_PROFILE) */
+#ifdef DHD_MEM_STATS
+       void *mem_stats_lock;
+       uint64 txpath_mem;
+       uint64 rxpath_mem;
+#endif /* DHD_MEM_STATS */
+#ifdef CSI_SUPPORT
+       struct list_head csi_list;
+       int csi_count;
+#endif /* CSI_SUPPORT */
+       char *clm_path;         /* module_param: path to clm vars file */
+       char *conf_path;                /* module_param: path to config vars file */
+       struct dhd_conf *conf;  /* Bus module handle */
+       void *adapter;                  /* adapter information, interrupt, fw path etc. */
+       void *event_params;
+#ifdef BCMDBUS
+       bool dhd_remove;
+#endif /* BCMDBUS */
+#ifdef WL_ESCAN
+       struct wl_escan_info *escan;
+#endif
+#if defined(WL_WIRELESS_EXT)
+       void *wext_info;
+#endif
+#ifdef WL_EXT_IAPSTA
+       void *iapsta_params;
+#endif
+       int hostsleep;
+#ifdef SENDPROB
+       bool recv_probereq;
+#endif
+#ifdef HOST_TPUT_TEST
+       struct osl_timespec bus_ts;
+       struct osl_timespec net_ts;
+       uint32 net_len;
+#endif
+       bool skip_dhd_stop;
+} dhd_pub_t;
+
+#if defined(__linux__)
+int dhd_wifi_platform_set_power(dhd_pub_t *pub, bool on);
+#else
+static INLINE int dhd_wifi_platform_set_power(dhd_pub_t *pub, bool on)  { return 0; }
+#endif /* __linux__ */
+
+typedef struct {
+       uint rxwake;
+       uint rcwake;
+#ifdef DHD_WAKE_RX_STATUS
+       uint rx_bcast;
+       uint rx_arp;
+       uint rx_mcast;
+       uint rx_multi_ipv6;
+       uint rx_icmpv6;
+       uint rx_icmpv6_ra;
+       uint rx_icmpv6_na;
+       uint rx_icmpv6_ns;
+       uint rx_multi_ipv4;
+       uint rx_multi_other;
+       uint rx_ucast;
+#endif /* DHD_WAKE_RX_STATUS */
+#ifdef DHD_WAKE_EVENT_STATUS
+       uint rc_event[WLC_E_LAST];
+#endif /* DHD_WAKE_EVENT_STATUS */
+} wake_counts_t;
+
+#if defined(PCIE_FULL_DONGLE)
+/*
+ * XXX: WARNING: dhd_wlfc.h also defines a dhd_pkttag_t
+ * making wlfc incompatible with PCIE_FULL DONGLE
+ */
+
+/* Packet Tag for PCIE Full Dongle DHD */
+typedef struct dhd_pkttag_fd {
+       uint16    flowid;   /* Flowring Id */
+       uint16    ifid;
+#ifdef DHD_SBN
+       uint8     pkt_udr;
+       uint8     pad;
+#endif /* DHD_SBN */
+#ifndef DHD_PCIE_PKTID
+       uint16    dma_len;  /* pkt len for DMA_MAP/UNMAP */
+       dmaaddr_t pa;       /* physical address */
+       void      *dmah;    /* dma mapper handle */
+       void      *secdma; /* secure dma sec_cma_info handle */
+#endif /* !DHD_PCIE_PKTID */
+#if defined(TX_STATUS_LATENCY_STATS)
+       uint64     q_time_us; /* time when tx pkt queued to flowring */
+#endif
+} dhd_pkttag_fd_t;
+
+/* Packet Tag for DHD PCIE Full Dongle */
+#define DHD_PKTTAG_FD(pkt)          ((dhd_pkttag_fd_t *)(PKTTAG(pkt)))
+
+#define DHD_PKT_GET_FLOWID(pkt)     ((DHD_PKTTAG_FD(pkt))->flowid)
+#define DHD_PKT_SET_FLOWID(pkt, pkt_flowid) \
+       DHD_PKTTAG_FD(pkt)->flowid = (uint16)(pkt_flowid)
+
+#define DHD_PKT_GET_DATAOFF(pkt)    ((DHD_PKTTAG_FD(pkt))->dataoff)
+#define DHD_PKT_SET_DATAOFF(pkt, pkt_dataoff) \
+       DHD_PKTTAG_FD(pkt)->dataoff = (uint16)(pkt_dataoff)
+
+#define DHD_PKT_GET_DMA_LEN(pkt)    ((DHD_PKTTAG_FD(pkt))->dma_len)
+#define DHD_PKT_SET_DMA_LEN(pkt, pkt_dma_len) \
+       DHD_PKTTAG_FD(pkt)->dma_len = (uint16)(pkt_dma_len)
+
+#define DHD_PKT_GET_PA(pkt)         ((DHD_PKTTAG_FD(pkt))->pa)
+#define DHD_PKT_SET_PA(pkt, pkt_pa) \
+       DHD_PKTTAG_FD(pkt)->pa = (dmaaddr_t)(pkt_pa)
+
+#define DHD_PKT_GET_DMAH(pkt)       ((DHD_PKTTAG_FD(pkt))->dmah)
+#define DHD_PKT_SET_DMAH(pkt, pkt_dmah) \
+       DHD_PKTTAG_FD(pkt)->dmah = (void *)(pkt_dmah)
+
+#define DHD_PKT_GET_SECDMA(pkt)    ((DHD_PKTTAG_FD(pkt))->secdma)
+#define DHD_PKT_SET_SECDMA(pkt, pkt_secdma) \
+       DHD_PKTTAG_FD(pkt)->secdma = (void *)(pkt_secdma)
+
+#if defined(TX_STATUS_LATENCY_STATS)
+#define DHD_PKT_GET_QTIME(pkt)    ((DHD_PKTTAG_FD(pkt))->q_time_us)
+#define DHD_PKT_SET_QTIME(pkt, pkt_q_time_us) \
+       DHD_PKTTAG_FD(pkt)->q_time_us = (uint64)(pkt_q_time_us)
+#endif
+#endif /* PCIE_FULL_DONGLE */
+
+#if defined(BCMWDF)
+typedef struct {
+       dhd_pub_t *dhd_pub;
+} dhd_workitem_context_t;
+
+WDF_DECLARE_CONTEXT_TYPE_WITH_NAME(dhd_workitem_context_t, dhd_get_dhd_workitem_context)
+#endif /* (BCMWDF)  */
+
+       #if defined(CONFIG_PM_SLEEP)
+
+       #define DHD_PM_RESUME_WAIT_INIT(a) DECLARE_WAIT_QUEUE_HEAD(a);
+       #define _DHD_PM_RESUME_WAIT(a, b) do {\
+                       int retry = 0; \
+                       SMP_RD_BARRIER_DEPENDS(); \
+                       while (dhd_mmc_suspend && retry++ != b) { \
+                               SMP_RD_BARRIER_DEPENDS(); \
+                               wait_event_interruptible_timeout(a, !dhd_mmc_suspend, 1); \
+                       } \
+               }       while (0)
+       #define DHD_PM_RESUME_WAIT(a)           _DHD_PM_RESUME_WAIT(a, 200)
+       #define DHD_PM_RESUME_WAIT_FOREVER(a)   _DHD_PM_RESUME_WAIT(a, ~0)
+       #define DHD_PM_RESUME_RETURN_ERROR(a)   do { \
+                       if (dhd_mmc_suspend) { \
+                               printf("%s[%d]: mmc is still in suspend state!!!\n", \
+                                       __FUNCTION__, __LINE__); \
+                               return a; \
+                       } \
+               } while (0)
+       #define DHD_PM_RESUME_RETURN            do { if (dhd_mmc_suspend) return; } while (0)
+
+       #define DHD_SPINWAIT_SLEEP_INIT(a) DECLARE_WAIT_QUEUE_HEAD(a);
+       #define SPINWAIT_SLEEP(a, exp, us) do { \
+               uint countdown = (us) + 9999; \
+               while ((exp) && (countdown >= 10000)) { \
+                       wait_event_interruptible_timeout(a, FALSE, 1); \
+                       countdown -= 10000; \
+               } \
+       } while (0)
+
+       #else
+
+       #define DHD_PM_RESUME_WAIT_INIT(a)
+       #define DHD_PM_RESUME_WAIT(a)
+       #define DHD_PM_RESUME_WAIT_FOREVER(a)
+       #define DHD_PM_RESUME_RETURN_ERROR(a)
+       #define DHD_PM_RESUME_RETURN
+
+       #define DHD_SPINWAIT_SLEEP_INIT(a)
+       #define SPINWAIT_SLEEP(a, exp, us)  do { \
+               uint countdown = (us) + 9; \
+               while ((exp) && (countdown >= 10)) { \
+                       OSL_DELAY(10);  \
+                       countdown -= 10;  \
+               } \
+       } while (0)
+
+       #endif /* CONFIG_PM_SLEEP */
+
+#define DHD_IF_VIF     0x01    /* Virtual IF (Hidden from user) */
+
+#ifdef PNO_SUPPORT
+int dhd_pno_clean(dhd_pub_t *dhd);
+#endif /* PNO_SUPPORT */
+
+/*
+ *  Wake locks are an Android power management concept. They are used by applications and services
+ *  to request CPU resources.
+ */
+extern int dhd_os_wake_lock(dhd_pub_t *pub);
+extern int dhd_os_wake_unlock(dhd_pub_t *pub);
+extern int dhd_os_wake_lock_waive(dhd_pub_t *pub);
+extern int dhd_os_wake_lock_restore(dhd_pub_t *pub);
+extern void dhd_event_wake_lock(dhd_pub_t *pub);
+extern void dhd_event_wake_unlock(dhd_pub_t *pub);
+extern void dhd_pm_wake_lock_timeout(dhd_pub_t *pub, int val);
+extern void dhd_pm_wake_unlock(dhd_pub_t *pub);
+extern void dhd_txfl_wake_lock_timeout(dhd_pub_t *pub, int val);
+extern void dhd_txfl_wake_unlock(dhd_pub_t *pub);
+extern void dhd_nan_wake_lock_timeout(dhd_pub_t *pub, int val);
+extern void dhd_nan_wake_unlock(dhd_pub_t *pub);
+extern int dhd_os_wake_lock_timeout(dhd_pub_t *pub);
+extern int dhd_os_wake_lock_rx_timeout_enable(dhd_pub_t *pub, int val);
+extern int dhd_os_wake_lock_ctrl_timeout_enable(dhd_pub_t *pub, int val);
+extern int dhd_os_wake_lock_ctrl_timeout_cancel(dhd_pub_t *pub);
+extern int dhd_os_wd_wake_lock(dhd_pub_t *pub);
+extern int dhd_os_wd_wake_unlock(dhd_pub_t *pub);
+extern void dhd_os_wake_lock_init(struct dhd_info *dhd);
+extern void dhd_os_wake_lock_destroy(struct dhd_info *dhd);
+#ifdef DHD_USE_SCAN_WAKELOCK
+extern void dhd_os_scan_wake_lock_timeout(dhd_pub_t *pub, int val);
+extern void dhd_os_scan_wake_unlock(dhd_pub_t *pub);
+#endif /* BCMPCIE_SCAN_WAKELOCK */
+
+inline static void MUTEX_LOCK_SOFTAP_SET_INIT(dhd_pub_t * dhdp)
+{
+       mutex_init(&dhdp->wl_softap_lock);
+}
+
+inline static void MUTEX_LOCK_SOFTAP_SET(dhd_pub_t * dhdp)
+{
+       mutex_lock(&dhdp->wl_softap_lock);
+}
+
+inline static void MUTEX_UNLOCK_SOFTAP_SET(dhd_pub_t * dhdp)
+{
+       mutex_unlock(&dhdp->wl_softap_lock);
+}
+
+#ifdef DHD_DEBUG_WAKE_LOCK
+#define DHD_OS_WAKE_LOCK(pub) \
+       do { \
+               printf("call wake_lock: %s %d\n", \
+                       __FUNCTION__, __LINE__); \
+               dhd_os_wake_lock(pub); \
+       } while (0)
+#define DHD_OS_WAKE_UNLOCK(pub) \
+       do { \
+               printf("call wake_unlock: %s %d\n", \
+                       __FUNCTION__, __LINE__); \
+               dhd_os_wake_unlock(pub); \
+       } while (0)
+#define DHD_EVENT_WAKE_LOCK(pub) \
+       do { \
+               printf("call event wake_lock: %s %d\n", \
+                       __FUNCTION__, __LINE__); \
+               dhd_event_wake_lock(pub); \
+       } while (0)
+#define DHD_EVENT_WAKE_UNLOCK(pub) \
+       do { \
+               printf("call event wake_unlock: %s %d\n", \
+                       __FUNCTION__, __LINE__); \
+               dhd_event_wake_unlock(pub); \
+       } while (0)
+#define DHD_PM_WAKE_LOCK_TIMEOUT(pub, val) \
+       do { \
+               printf("call pm_wake_timeout enable\n"); \
+       dhd_pm_wake_lock_timeout(pub, val); \
+       } while (0)
+#define DHD_PM_WAKE_UNLOCK(pub) \
+       do { \
+               printf("call pm_wake unlock\n"); \
+       dhd_pm_wake_unlock(pub); \
+       } while (0)
+#define DHD_TXFL_WAKE_LOCK_TIMEOUT(pub, val) \
+       do { \
+               printf("call pm_wake_timeout enable\n"); \
+               dhd_txfl_wake_lock_timeout(pub, val); \
+       } while (0)
+#define DHD_TXFL_WAKE_UNLOCK(pub) \
+       do { \
+               printf("call pm_wake unlock\n"); \
+               dhd_txfl_wake_unlock(pub); \
+       } while (0)
+#define DHD_NAN_WAKE_LOCK_TIMEOUT(pub, val) \
+       do { \
+               printf("call pm_wake_timeout enable\n"); \
+               dhd_nan_wake_lock_timeout(pub, val); \
+       } while (0)
+#define DHD_NAN_WAKE_UNLOCK(pub) \
+       do { \
+               printf("call pm_wake unlock\n"); \
+               dhd_nan_wake_unlock(pub); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_TIMEOUT(pub) \
+       do { \
+               printf("call wake_lock_timeout: %s %d\n", \
+                       __FUNCTION__, __LINE__); \
+               dhd_os_wake_lock_timeout(pub); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_RX_TIMEOUT_ENABLE(pub, val) \
+       do { \
+               printf("call wake_lock_rx_timeout_enable[%d]: %s %d\n", \
+                       val, __FUNCTION__, __LINE__); \
+               dhd_os_wake_lock_rx_timeout_enable(pub, val); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE(pub, val) \
+       do { \
+               printf("call wake_lock_ctrl_timeout_enable[%d]: %s %d\n", \
+                       val, __FUNCTION__, __LINE__); \
+               dhd_os_wake_lock_ctrl_timeout_enable(pub, val); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_CANCEL(pub) \
+       do { \
+               printf("call wake_lock_ctrl_timeout_cancel: %s %d\n", \
+                       __FUNCTION__, __LINE__); \
+               dhd_os_wake_lock_ctrl_timeout_cancel(pub); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_WAIVE(pub) \
+       do { \
+               printf("call wake_lock_waive: %s %d\n", \
+                       __FUNCTION__, __LINE__); \
+               dhd_os_wake_lock_waive(pub); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_RESTORE(pub) \
+       do { \
+               printf("call wake_lock_restore: %s %d\n", \
+                       __FUNCTION__, __LINE__); \
+               dhd_os_wake_lock_restore(pub); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_INIT(dhd) \
+       do { \
+               printf("call wake_lock_init: %s %d\n", \
+                       __FUNCTION__, __LINE__); \
+               dhd_os_wake_lock_init(dhd); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_DESTROY(dhd) \
+       do { \
+               printf("call wake_lock_destroy: %s %d\n", \
+                       __FUNCTION__, __LINE__); \
+               dhd_os_wake_lock_destroy(dhd); \
+       } while (0)
+#else
+#define DHD_OS_WAKE_LOCK(pub)                  dhd_os_wake_lock(pub)
+#define DHD_OS_WAKE_UNLOCK(pub)                dhd_os_wake_unlock(pub)
+#define DHD_EVENT_WAKE_LOCK(pub)                       dhd_event_wake_lock(pub)
+#define DHD_EVENT_WAKE_UNLOCK(pub)             dhd_event_wake_unlock(pub)
+#define DHD_PM_WAKE_LOCK_TIMEOUT(pub, val)  dhd_pm_wake_lock_timeout(pub, val)
+#define DHD_PM_WAKE_UNLOCK(pub)                        dhd_pm_wake_unlock(pub)
+#define DHD_TXFL_WAKE_LOCK_TIMEOUT(pub, val)   dhd_txfl_wake_lock_timeout(pub, val)
+#define DHD_TXFL_WAKE_UNLOCK(pub)                      dhd_txfl_wake_unlock(pub)
+#define DHD_NAN_WAKE_LOCK_TIMEOUT(pub, val)    dhd_nan_wake_lock_timeout(pub, val)
+#define DHD_NAN_WAKE_UNLOCK(pub)               dhd_nan_wake_unlock(pub)
+#define DHD_OS_WAKE_LOCK_TIMEOUT(pub)          dhd_os_wake_lock_timeout(pub)
+#define DHD_OS_WAKE_LOCK_RX_TIMEOUT_ENABLE(pub, val) \
+       dhd_os_wake_lock_rx_timeout_enable(pub, val)
+#define DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE(pub, val) \
+       dhd_os_wake_lock_ctrl_timeout_enable(pub, val)
+#define DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_CANCEL(pub) \
+       dhd_os_wake_lock_ctrl_timeout_cancel(pub)
+#define DHD_OS_WAKE_LOCK_WAIVE(pub)                    dhd_os_wake_lock_waive(pub)
+#define DHD_OS_WAKE_LOCK_RESTORE(pub)          dhd_os_wake_lock_restore(pub)
+#define DHD_OS_WAKE_LOCK_INIT(dhd)             dhd_os_wake_lock_init(dhd);
+#define DHD_OS_WAKE_LOCK_DESTROY(dhd)          dhd_os_wake_lock_destroy(dhd);
+#endif /* DHD_DEBUG_WAKE_LOCK */
+
+#define DHD_OS_WD_WAKE_LOCK(pub)               dhd_os_wd_wake_lock(pub)
+#define DHD_OS_WD_WAKE_UNLOCK(pub)             dhd_os_wd_wake_unlock(pub)
+
+#ifdef DHD_USE_SCAN_WAKELOCK
+#ifdef DHD_DEBUG_SCAN_WAKELOCK
+#define DHD_OS_SCAN_WAKE_LOCK_TIMEOUT(pub, val) \
+       do { \
+               printf("call wake_lock_scan: %s %d\n", \
+                       __FUNCTION__, __LINE__); \
+               dhd_os_scan_wake_lock_timeout(pub, val); \
+       } while (0)
+#define DHD_OS_SCAN_WAKE_UNLOCK(pub) \
+       do { \
+               printf("call wake_unlock_scan: %s %d\n", \
+                       __FUNCTION__, __LINE__); \
+               dhd_os_scan_wake_unlock(pub); \
+       } while (0)
+#else
+#define DHD_OS_SCAN_WAKE_LOCK_TIMEOUT(pub, val)                dhd_os_scan_wake_lock_timeout(pub, val)
+#define DHD_OS_SCAN_WAKE_UNLOCK(pub)                   dhd_os_scan_wake_unlock(pub)
+#endif /* DHD_DEBUG_SCAN_WAKELOCK */
+#else
+#define DHD_OS_SCAN_WAKE_LOCK_TIMEOUT(pub, val)
+#define DHD_OS_SCAN_WAKE_UNLOCK(pub)
+#endif /* DHD_USE_SCAN_WAKELOCK */
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+#define OOB_WAKE_LOCK_TIMEOUT 500
+extern void dhd_os_oob_irq_wake_lock_timeout(dhd_pub_t *pub, int val);
+extern void dhd_os_oob_irq_wake_unlock(dhd_pub_t *pub);
+
+#define DHD_OS_OOB_IRQ_WAKE_LOCK_TIMEOUT(pub, val)     dhd_os_oob_irq_wake_lock_timeout(pub, val)
+#define DHD_OS_OOB_IRQ_WAKE_UNLOCK(pub)                        dhd_os_oob_irq_wake_unlock(pub)
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+#define DHD_PACKET_TIMEOUT_MS  500
+#define DHD_EVENT_TIMEOUT_MS   1500
+#define SCAN_WAKE_LOCK_TIMEOUT 10000
+#define MAX_TX_TIMEOUT                 500
+
+/* Enum for IOCTL recieved status */
+typedef enum dhd_ioctl_recieved_status
+{
+       IOCTL_WAIT = 0,
+       IOCTL_RETURN_ON_SUCCESS,
+       IOCTL_RETURN_ON_TRAP,
+       IOCTL_RETURN_ON_BUS_STOP,
+       IOCTL_RETURN_ON_ERROR
+} dhd_ioctl_recieved_status_t;
+
+/* interface operations (register, remove) should be atomic, use this lock to prevent race
+ * condition among wifi on/off and interface operation functions
+ */
+void dhd_net_if_lock(struct net_device *dev);
+void dhd_net_if_unlock(struct net_device *dev);
+
+#if defined(MULTIPLE_SUPPLICANT)
+extern void wl_android_post_init(void); // terence 20120530: fix critical section in dhd_open and dhdsdio_probe
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && defined(MULTIPLE_SUPPLICANT)
+extern struct mutex _dhd_mutex_lock_;
+#define DHD_MUTEX_IS_LOCK_RETURN() \
+       if (mutex_is_locked(&_dhd_mutex_lock_) != 0) { \
+               printf("%s : probe is already running! return.\n", __FUNCTION__); \
+               return 0; \
+       }
+#define DHD_MUTEX_LOCK() \
+       do { \
+               if (mutex_is_locked(&_dhd_mutex_lock_) == 0) { \
+                       printf("%s : no mutex held. set lock\n", __FUNCTION__); \
+               } else { \
+                       printf("%s : mutex is locked!. wait for unlocking\n", __FUNCTION__); \
+               } \
+               mutex_lock(&_dhd_mutex_lock_); \
+       } while (0)
+#define DHD_MUTEX_UNLOCK() \
+       do { \
+               mutex_unlock(&_dhd_mutex_lock_); \
+               printf("%s : the lock is released.\n", __FUNCTION__); \
+       } while (0)
+#else
+#define DHD_MUTEX_IS_LOCK_RETURN(a)    do {} while (0)
+#define DHD_MUTEX_LOCK(a)      do {} while (0)
+#define DHD_MUTEX_UNLOCK(a)    do {} while (0)
+#endif
+
+typedef enum dhd_attach_states
+{
+       DHD_ATTACH_STATE_INIT = 0x0,
+       DHD_ATTACH_STATE_NET_ALLOC = 0x1,
+       DHD_ATTACH_STATE_DHD_ALLOC = 0x2,
+       DHD_ATTACH_STATE_ADD_IF = 0x4,
+       DHD_ATTACH_STATE_PROT_ATTACH = 0x8,
+       DHD_ATTACH_STATE_WL_ATTACH = 0x10,
+       DHD_ATTACH_STATE_THREADS_CREATED = 0x20,
+       DHD_ATTACH_STATE_WAKELOCKS_INIT = 0x40,
+       DHD_ATTACH_STATE_CFG80211 = 0x80,
+       DHD_ATTACH_STATE_EARLYSUSPEND_DONE = 0x100,
+       DHD_ATTACH_TIMESYNC_ATTACH_DONE = 0x200,
+       DHD_ATTACH_LOGTRACE_INIT = 0x400,
+       DHD_ATTACH_STATE_LB_ATTACH_DONE = 0x800,
+       DHD_ATTACH_STATE_DONE = 0x1000
+} dhd_attach_states_t;
+
+/* Value -1 means we are unsuccessful in creating the kthread. */
+#define DHD_PID_KT_INVALID             -1
+/* Value -2 means we are unsuccessful in both creating the kthread and tasklet */
+#define DHD_PID_KT_TL_INVALID          -2
+
+/* default reporting period */
+#define ECOUNTERS_DEFAULT_PERIOD       0
+
+/* default number of reports. '0' indicates forever */
+#define ECOUNTERS_NUM_REPORTS          0
+
+typedef struct ecounters_cfg {
+       uint16 type;
+       uint16 if_slice_idx;
+       uint16 stats_rep;
+} ecounters_cfg_t;
+
+typedef struct event_ecounters_cfg {
+       uint16 event_id;
+       uint16 type;
+       uint16 if_slice_idx;
+       uint16 stats_rep;
+} event_ecounters_cfg_t;
+
+typedef struct ecountersv2_xtlv_list_elt {
+       /* Not quite the exact bcm_xtlv_t type as data could be pointing to other pieces in
+        * memory at the time of parsing arguments.
+        */
+       uint16 id;
+       uint16 len;
+       uint8 *data;
+       struct ecountersv2_xtlv_list_elt *next;
+} ecountersv2_xtlv_list_elt_t;
+
+typedef struct ecountersv2_processed_xtlv_list_elt {
+       uint8 *data;
+       struct ecountersv2_processed_xtlv_list_elt *next;
+} ecountersv2_processed_xtlv_list_elt;
+
+/*
+ * Exported from dhd OS modules (dhd_linux/dhd_ndis)
+ */
+
+/* Indication from bus module regarding presence/insertion of dongle.
+ * Return dhd_pub_t pointer, used as handle to OS module in later calls.
+ * Returned structure should have bus and prot pointers filled in.
+ * bus_hdrlen specifies required headroom for bus module header.
+ */
+extern dhd_pub_t *dhd_attach(osl_t *osh, struct dhd_bus *bus, uint bus_hdrlen
+#ifdef BCMDBUS
+       , void *adapter
+#endif
+);
+extern int dhd_attach_net(dhd_pub_t *dhdp, bool need_rtnl_lock);
+#if defined(WLP2P) && defined(WL_CFG80211)
+/* To allow attach/detach calls corresponding to p2p0 interface  */
+extern int dhd_attach_p2p(dhd_pub_t *);
+extern int dhd_detach_p2p(dhd_pub_t *);
+#endif /* WLP2P && WL_CFG80211 */
+extern int dhd_register_if(dhd_pub_t *dhdp, int idx, bool need_rtnl_lock);
+
+/* Indication from bus module regarding removal/absence of dongle */
+extern void dhd_detach(dhd_pub_t *dhdp);
+extern void dhd_free(dhd_pub_t *dhdp);
+extern void dhd_clear(dhd_pub_t *dhdp);
+
+/* Indication from bus module to change flow-control state */
+extern void dhd_txflowcontrol(dhd_pub_t *dhdp, int ifidx, bool on);
+
+/* Store the status of a connection attempt for later retrieval by an iovar */
+extern void dhd_store_conn_status(uint32 event, uint32 status, uint32 reason);
+
+extern bool dhd_prec_enq(dhd_pub_t *dhdp, struct pktq *q, void *pkt, int prec);
+
+extern void dhd_rx_frame(dhd_pub_t *dhdp, int ifidx, void *rxp, int numpkt, uint8 chan);
+
+/* Return pointer to interface name */
+extern char *dhd_ifname(dhd_pub_t *dhdp, int idx);
+
+#ifdef DHD_UCODE_DOWNLOAD
+/* Returns the ucode path */
+extern char *dhd_get_ucode_path(dhd_pub_t *dhdp);
+#endif /* DHD_UCODE_DOWNLOAD */
+
+/* Request scheduling of the bus dpc */
+extern void dhd_sched_dpc(dhd_pub_t *dhdp);
+
+/* Notify tx completion */
+extern void dhd_txcomplete(dhd_pub_t *dhdp, void *txp, bool success);
+#ifdef DHD_4WAYM4_FAIL_DISCONNECT
+extern void dhd_eap_txcomplete(dhd_pub_t *dhdp, void *txp, bool success, int ifidx);
+extern void dhd_cleanup_m4_state_work(dhd_pub_t *dhdp, int ifidx);
+#endif /* DHD_4WAYM4_FAIL_DISCONNECT */
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+extern void dhd_bus_wakeup_work(dhd_pub_t *dhdp);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#define WIFI_FEATURE_INFRA              0x0001      /* Basic infrastructure mode        */
+#define WIFI_FEATURE_INFRA_5G           0x0002      /* Support for 5 GHz Band           */
+#define WIFI_FEATURE_HOTSPOT            0x0004      /* Support for GAS/ANQP             */
+#define WIFI_FEATURE_P2P                0x0008      /* Wifi-Direct                      */
+#define WIFI_FEATURE_SOFT_AP            0x0010      /* Soft AP                          */
+#define WIFI_FEATURE_GSCAN              0x0020      /* Google-Scan APIs                 */
+#define WIFI_FEATURE_NAN                0x0040      /* Neighbor Awareness Networking    */
+#define WIFI_FEATURE_D2D_RTT            0x0080      /* Device-to-device RTT             */
+#define WIFI_FEATURE_D2AP_RTT           0x0100      /* Device-to-AP RTT                 */
+#define WIFI_FEATURE_BATCH_SCAN         0x0200      /* Batched Scan (legacy)            */
+#define WIFI_FEATURE_PNO                0x0400      /* Preferred network offload        */
+#define WIFI_FEATURE_ADDITIONAL_STA     0x0800      /* Support for two STAs             */
+#define WIFI_FEATURE_TDLS               0x1000      /* Tunnel directed link setup       */
+#define WIFI_FEATURE_TDLS_OFFCHANNEL    0x2000      /* Support for TDLS off channel     */
+#define WIFI_FEATURE_EPR                0x4000      /* Enhanced power reporting         */
+#define WIFI_FEATURE_AP_STA             0x8000      /* Support for AP STA Concurrency   */
+#define WIFI_FEATURE_LINKSTAT           0x10000     /* Support for Linkstats            */
+#define WIFI_FEATURE_HAL_EPNO           0x40000            /* WiFi PNO enhanced                */
+#define WIFI_FEATURE_RSSI_MONITOR       0x80000     /* RSSI Monitor                     */
+#define WIFI_FEATURE_CONFIG_NDO         0x200000    /* ND offload configure             */
+#define WIFI_FEATURE_TX_TRANSMIT_POWER  0x400000    /* Capture Tx transmit power levels */
+#define WIFI_FEATURE_CONTROL_ROAMING    0x800000    /* Enable/Disable firmware roaming  */
+#define WIFI_FEATURE_FILTER_IE          0x1000000   /* Probe req ie filter              */
+#define WIFI_FEATURE_SCAN_RAND          0x2000000   /* MAC & Prb SN randomization       */
+#define WIFI_FEATURE_SET_TX_POWER_LIMIT 0x4000000   /* Support Tx Power Limit setting   */
+#define WIFI_FEATURE_USE_BODY_HEAD_SAR  0x8000000   /* Support Body/Head Proximity SAR  */
+#define WIFI_FEATURE_SET_LATENCY_MODE   0x40000000  /* Support Latency mode setting     */
+#define WIFI_FEATURE_P2P_RAND_MAC       0x80000000  /* Support P2P MAC randomization    */
+#define WIFI_FEATURE_INVALID            0xFFFFFFFF  /* Invalid Feature                  */
+
+#define MAX_FEATURE_SET_CONCURRRENT_GROUPS  3
+
+extern int dhd_dev_get_feature_set(struct net_device *dev);
+extern int dhd_dev_get_feature_set_matrix(struct net_device *dev, int num);
+extern int dhd_dev_cfg_rand_mac_oui(struct net_device *dev, uint8 *oui);
+extern int dhd_update_rand_mac_addr(dhd_pub_t *dhd);
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+extern int dhd_dev_set_nodfs(struct net_device *dev, uint nodfs);
+#endif /* CUSTOM_FORCE_NODFS_FLAG */
+#ifdef NDO_CONFIG_SUPPORT
+#ifndef NDO_MAX_HOST_IP_ENTRIES
+#define NDO_MAX_HOST_IP_ENTRIES        10
+#endif /* NDO_MAX_HOST_IP_ENTRIES */
+
+extern int dhd_dev_ndo_cfg(struct net_device *dev, u8 enable);
+extern int dhd_dev_ndo_update_inet6addr(struct net_device * dev);
+#endif /* NDO_CONFIG_SUPPORT */
+extern int dhd_set_rand_mac_oui(dhd_pub_t *dhd);
+#ifdef GSCAN_SUPPORT
+extern int dhd_dev_set_lazy_roam_cfg(struct net_device *dev,
+             wlc_roam_exp_params_t *roam_param);
+extern int dhd_dev_lazy_roam_enable(struct net_device *dev, uint32 enable);
+extern int dhd_dev_set_lazy_roam_bssid_pref(struct net_device *dev,
+       wl_bssid_pref_cfg_t *bssid_pref, uint32 flush);
+#endif /* GSCAN_SUPPORT */
+#if defined(GSCAN_SUPPORT) || defined(ROAMEXP_SUPPORT)
+extern int dhd_dev_set_blacklist_bssid(struct net_device *dev, maclist_t *blacklist,
+    uint32 len, uint32 flush);
+extern int dhd_dev_set_whitelist_ssid(struct net_device *dev, wl_ssid_whitelist_t *whitelist,
+    uint32 len, uint32 flush);
+#endif /* GSCAN_SUPPORT || ROAMEXP_SUPPORT */
+
+/* OS independent layer functions */
+extern void dhd_os_dhdiovar_lock(dhd_pub_t *pub);
+extern void dhd_os_dhdiovar_unlock(dhd_pub_t *pub);
+void dhd_os_logdump_lock(dhd_pub_t *pub);
+void dhd_os_logdump_unlock(dhd_pub_t *pub);
+extern int dhd_os_proto_block(dhd_pub_t * pub);
+extern int dhd_os_proto_unblock(dhd_pub_t * pub);
+extern int dhd_os_ioctl_resp_wait(dhd_pub_t * pub, uint * condition);
+extern int dhd_os_ioctl_resp_wake(dhd_pub_t * pub);
+extern unsigned int dhd_os_get_ioctl_resp_timeout(void);
+extern void dhd_os_set_ioctl_resp_timeout(unsigned int timeout_msec);
+extern void dhd_os_ioctl_resp_lock(dhd_pub_t * pub);
+extern void dhd_os_ioctl_resp_unlock(dhd_pub_t * pub);
+#ifdef PCIE_FULL_DONGLE
+extern void dhd_wakeup_ioctl_event(dhd_pub_t *pub, dhd_ioctl_recieved_status_t reason);
+#else
+static INLINE void dhd_wakeup_ioctl_event(dhd_pub_t *pub, dhd_ioctl_recieved_status_t reason)
+{ printf("%s is NOT implemented for SDIO", __FUNCTION__); return; }
+#endif
+#ifdef SHOW_LOGTRACE
+/* Bound and delay are fine tuned after several experiments and these
+ * are the best case values to handle bombarding of console logs.
+ */
+#define DHD_EVENT_LOGTRACE_BOUND 10u
+#define DHD_EVENT_LOGTRACE_RESCHEDULE_DELAY_MS 10u
+extern int dhd_os_read_file(void *file, char *buf, uint32 size);
+extern int dhd_os_seek_file(void *file, int64 offset);
+#endif /* SHOW_LOGTRACE */
+int dhd_os_write_file_posn(void *fp, unsigned long *posn,
+               void *buf, unsigned long buflen);
+int dhd_msix_message_set(dhd_pub_t *dhdp, uint table_entry,
+    uint message_number, bool unmask);
+
+extern void
+dhd_pcie_dump_core_regs(dhd_pub_t * pub, uint32 index, uint32 first_addr, uint32 last_addr);
+extern void wl_dhdpcie_dump_regs(void * context);
+
+#define DHD_OS_IOCTL_RESP_LOCK(x)
+#define DHD_OS_IOCTL_RESP_UNLOCK(x)
+
+extern int dhd_os_get_image_block(char * buf, int len, void * image);
+extern int dhd_os_get_image_size(void * image);
+#if defined(BT_OVER_SDIO)
+extern int dhd_os_gets_image(dhd_pub_t *pub, char *str, int len, void *image);
+extern void dhdsdio_bus_usr_cnt_inc(dhd_pub_t *pub);
+extern void dhdsdio_bus_usr_cnt_dec(dhd_pub_t *pub);
+#endif /* (BT_OVER_SDIO) */
+extern void *dhd_os_open_image1(dhd_pub_t *pub, char *filename); /* rev1 function signature */
+extern void dhd_os_close_image1(dhd_pub_t *pub, void *image);
+extern void dhd_os_wd_timer(void *bus, uint wdtick);
+#ifdef DHD_PCIE_RUNTIMEPM
+extern void dhd_os_runtimepm_timer(void *bus, uint tick);
+#endif /* DHD_PCIE_RUNTIMEPM */
+extern void dhd_os_sdlock(dhd_pub_t * pub);
+extern void dhd_os_sdunlock(dhd_pub_t * pub);
+extern void dhd_os_sdlock_txq(dhd_pub_t * pub);
+extern void dhd_os_sdunlock_txq(dhd_pub_t * pub);
+extern void dhd_os_sdlock_rxq(dhd_pub_t * pub);
+extern void dhd_os_sdunlock_rxq(dhd_pub_t * pub);
+extern void dhd_os_sdlock_sndup_rxq(dhd_pub_t * pub);
+extern void dhd_os_tracelog(const char *format, ...);
+#ifdef DHDTCPACK_SUPPRESS
+extern unsigned long dhd_os_tcpacklock(dhd_pub_t *pub);
+extern void dhd_os_tcpackunlock(dhd_pub_t *pub, unsigned long flags);
+#endif /* DHDTCPACK_SUPPRESS */
+
+extern int dhd_customer_oob_irq_map(void *adapter, unsigned long *irq_flags_ptr);
+extern int dhd_customer_gpio_wlan_ctrl(void *adapter, int onoff);
+extern int dhd_custom_get_mac_address(void *adapter, unsigned char *buf);
+#if defined(CUSTOM_COUNTRY_CODE)
+extern void get_customized_country_code(void *adapter, char *country_iso_code,
+       wl_country_t *cspec, u32 flags);
+#else
+extern void get_customized_country_code(void *adapter, char *country_iso_code, wl_country_t *cspec);
+#endif /* CUSTOM_COUNTRY_CODE */
+extern void dhd_os_sdunlock_sndup_rxq(dhd_pub_t * pub);
+extern void dhd_os_sdlock_eventq(dhd_pub_t * pub);
+extern void dhd_os_sdunlock_eventq(dhd_pub_t * pub);
+extern bool dhd_os_check_hang(dhd_pub_t *dhdp, int ifidx, int ret);
+extern int dhd_os_send_hang_message(dhd_pub_t *dhdp);
+extern void dhd_set_version_info(dhd_pub_t *pub, char *fw);
+extern bool dhd_os_check_if_up(dhd_pub_t *pub);
+extern int dhd_os_check_wakelock(dhd_pub_t *pub);
+extern int dhd_os_check_wakelock_all(dhd_pub_t *pub);
+extern int dhd_get_instance(dhd_pub_t *pub);
+#ifdef CUSTOM_SET_CPUCORE
+extern void dhd_set_cpucore(dhd_pub_t *dhd, int set);
+#endif /* CUSTOM_SET_CPUCORE */
+
+#if defined(KEEP_ALIVE)
+extern int dhd_keep_alive_onoff(dhd_pub_t *dhd);
+#endif /* KEEP_ALIVE */
+
+#if defined(DHD_FW_COREDUMP)
+void dhd_schedule_memdump(dhd_pub_t *dhdp, uint8 *buf, uint32 size);
+#endif /* DHD_FW_COREDUMP */
+
+#if defined(DHD_SSSR_DUMP)
+void dhd_write_sssr_dump(dhd_pub_t *dhdp, uint32 dump_mode);
+#endif /* DHD_SSSR_DUMP */
+#ifdef DNGL_AXI_ERROR_LOGGING
+void dhd_schedule_axi_error_dump(dhd_pub_t *dhdp, void *type);
+#endif /* DNGL_AXI_ERROR_LOGGING */
+#ifdef BCMPCIE
+void dhd_schedule_cto_recovery(dhd_pub_t *dhdp);
+#endif /* BCMPCIE */
+
+#ifdef EWP_EDL
+#define EDL_SCHEDULE_DELAY 500 /* 500ms */
+void dhd_schedule_edl_work(dhd_pub_t *dhdp, uint delay_ms);
+#endif /* EWP_EDL */
+
+#ifdef PKT_FILTER_SUPPORT
+#define DHD_UNICAST_FILTER_NUM         0
+#define DHD_BROADCAST_FILTER_NUM       1
+#define DHD_MULTICAST4_FILTER_NUM      2
+#define DHD_MULTICAST6_FILTER_NUM      3
+#define DHD_MDNS_FILTER_NUM            4
+#define DHD_ARP_FILTER_NUM             5
+#define DHD_BROADCAST_ARP_FILTER_NUM   6
+#define DHD_IP4BCAST_DROP_FILTER_NUM   7
+#define DHD_LLC_STP_DROP_FILTER_NUM    8
+#define DHD_LLC_XID_DROP_FILTER_NUM    9
+#define DHD_UDPNETBIOS_DROP_FILTER_NUM 10
+#define DISCARD_IPV4_MCAST     "102 1 6 IP4_H:16 0xf0 0xe0"
+#define DISCARD_IPV6_MCAST     "103 1 6 IP6_H:24 0xff 0xff"
+#define DISCARD_IPV4_BCAST     "107 1 6 IP4_H:16 0xffffffff 0xffffffff"
+#define DISCARD_LLC_STP                "108 1 6 ETH_H:14 0xFFFFFFFFFFFF 0xAAAA0300000C"
+#define DISCARD_LLC_XID                "109 1 6 ETH_H:14 0xFFFFFF 0x0001AF"
+#define DISCARD_UDPNETBIOS     "110 1 6 UDP_H:2 0xffff 0x0089"
+extern int dhd_os_enable_packet_filter(dhd_pub_t *dhdp, int val);
+extern void dhd_enable_packet_filter(int value, dhd_pub_t *dhd);
+extern int dhd_packet_filter_add_remove(dhd_pub_t *dhdp, int add_remove, int num);
+extern int net_os_enable_packet_filter(struct net_device *dev, int val);
+extern int net_os_rxfilter_add_remove(struct net_device *dev, int val, int num);
+extern int net_os_set_suspend_bcn_li_dtim(struct net_device *dev, int val);
+
+#define MAX_PKTFLT_BUF_SIZE            2048
+#define MAX_PKTFLT_FIXED_PATTERN_SIZE  32
+#define MAX_PKTFLT_FIXED_BUF_SIZE      \
+       (WL_PKT_FILTER_FIXED_LEN + MAX_PKTFLT_FIXED_PATTERN_SIZE * 2)
+#define MAXPKT_ARG     16
+#endif /* PKT_FILTER_SUPPORT */
+
+#if defined(BCMPCIE)
+extern int dhd_get_suspend_bcn_li_dtim(dhd_pub_t *dhd, int *dtim_period, int *bcn_interval);
+#else
+extern int dhd_get_suspend_bcn_li_dtim(dhd_pub_t *dhd);
+#endif /* OEM_ANDROID && BCMPCIE */
+
+extern bool dhd_support_sta_mode(dhd_pub_t *dhd);
+extern int write_to_file(dhd_pub_t *dhd, uint8 *buf, int size);
+
+#ifdef RSSI_MONITOR_SUPPORT
+extern int dhd_dev_set_rssi_monitor_cfg(struct net_device *dev, int start,
+             int8 max_rssi, int8 min_rssi);
+#endif /* RSSI_MONITOR_SUPPORT */
+
+#ifdef DHDTCPACK_SUPPRESS
+int dhd_dev_set_tcpack_sup_mode_cfg(struct net_device *dev, uint8 enable);
+#endif /* DHDTCPACK_SUPPRESS */
+
+#define DHD_RSSI_MONITOR_EVT_VERSION   1
+typedef struct {
+       uint8 version;
+       int8 cur_rssi;
+       struct ether_addr BSSID;
+} dhd_rssi_monitor_evt_t;
+
+typedef struct {
+       uint32 limit;           /* Expiration time (usec) */
+       uint32 increment;       /* Current expiration increment (usec) */
+       uint32 elapsed;         /* Current elapsed time (usec) */
+       uint32 tick;            /* O/S tick time (usec) */
+} dhd_timeout_t;
+
+#ifdef SHOW_LOGTRACE
+typedef struct {
+       uint  num_fmts;
+       char **fmts;
+       char *raw_fmts;
+       char *raw_sstr;
+       uint32 fmts_size;
+       uint32 raw_fmts_size;
+       uint32 raw_sstr_size;
+       uint32 ramstart;
+       uint32 rodata_start;
+       uint32 rodata_end;
+       char *rom_raw_sstr;
+       uint32 rom_raw_sstr_size;
+       uint32 rom_ramstart;
+       uint32 rom_rodata_start;
+       uint32 rom_rodata_end;
+} dhd_event_log_t;
+#endif /* SHOW_LOGTRACE */
+
+#if defined(PKT_FILTER_SUPPORT) && defined(APF)
+/*
+ * As per Google's current implementation, there will be only one APF filter.
+ * Therefore, userspace doesn't bother about filter id and because of that
+ * DHD has to manage the filter id.
+ */
+#define PKT_FILTER_APF_ID              200
+#define DHD_APF_LOCK(ndev)             dhd_apf_lock(ndev)
+#define DHD_APF_UNLOCK(ndev)           dhd_apf_unlock(ndev)
+
+extern void dhd_apf_lock(struct net_device *dev);
+extern void dhd_apf_unlock(struct net_device *dev);
+extern int dhd_dev_apf_get_version(struct net_device *ndev, uint32 *version);
+extern int dhd_dev_apf_get_max_len(struct net_device *ndev, uint32 *max_len);
+extern int dhd_dev_apf_add_filter(struct net_device *ndev, u8* program,
+       uint32 program_len);
+extern int dhd_dev_apf_enable_filter(struct net_device *ndev);
+extern int dhd_dev_apf_disable_filter(struct net_device *ndev);
+extern int dhd_dev_apf_delete_filter(struct net_device *ndev);
+#endif /* PKT_FILTER_SUPPORT && APF */
+
+extern void dhd_timeout_start(dhd_timeout_t *tmo, uint usec);
+extern int dhd_timeout_expired(dhd_timeout_t *tmo);
+
+extern int dhd_ifname2idx(struct dhd_info *dhd, char *name);
+extern int dhd_net2idx(struct dhd_info *dhd, struct net_device *net);
+extern struct net_device * dhd_idx2net(void *pub, int ifidx);
+extern int net_os_send_hang_message(struct net_device *dev);
+extern int net_os_send_hang_message_reason(struct net_device *dev, const char *string_num);
+extern bool dhd_wowl_cap(void *bus);
+extern int wl_host_event(dhd_pub_t *dhd_pub, int *idx, void *pktdata, uint pktlen,
+       wl_event_msg_t *, void **data_ptr,  void *);
+extern int wl_process_host_event(dhd_pub_t *dhd_pub, int *idx, void *pktdata, uint pktlen,
+       wl_event_msg_t *, void **data_ptr,  void *);
+extern void wl_event_to_host_order(wl_event_msg_t * evt);
+extern int wl_host_event_get_data(void *pktdata, uint pktlen, bcm_event_msg_u_t *evu);
+extern int dhd_wl_ioctl(dhd_pub_t *dhd_pub, int ifindex, wl_ioctl_t *ioc, void *buf, int len);
+extern int dhd_wl_ioctl_cmd(dhd_pub_t *dhd_pub, int cmd, void *arg, int len, uint8 set,
+                            int ifindex);
+extern int dhd_wl_ioctl_get_intiovar(dhd_pub_t *dhd_pub, char *name, uint *pval,
+       int cmd, uint8 set, int ifidx);
+extern int dhd_wl_ioctl_set_intiovar(dhd_pub_t *dhd_pub, char *name, uint val,
+       int cmd, uint8 set, int ifidx);
+extern void dhd_common_init(osl_t *osh);
+
+extern int dhd_do_driver_init(struct net_device *net);
+extern int dhd_event_ifadd(struct dhd_info *dhd, struct wl_event_data_if *ifevent,
+       char *name, uint8 *mac);
+extern int dhd_event_ifdel(struct dhd_info *dhd, struct wl_event_data_if *ifevent,
+       char *name, uint8 *mac);
+extern int dhd_event_ifchange(struct dhd_info *dhd, struct wl_event_data_if *ifevent,
+       char *name, uint8 *mac);
+#ifdef DHD_UPDATE_INTF_MAC
+extern int dhd_op_if_update(dhd_pub_t *dhdpub, int ifidx);
+#endif /* DHD_UPDATE_INTF_MAC */
+extern struct net_device* dhd_allocate_if(dhd_pub_t *dhdpub, int ifidx, const char *name,
+       uint8 *mac, uint8 bssidx, bool need_rtnl_lock, const char *dngl_name);
+extern int dhd_remove_if(dhd_pub_t *dhdpub, int ifidx, bool need_rtnl_lock);
+#ifdef WL_STATIC_IF
+extern s32 dhd_update_iflist_info(dhd_pub_t *dhdp, struct net_device *ndev, int ifidx,
+       uint8 *mac, uint8 bssidx, const char *dngl_name, int if_state);
+#endif /* WL_STATIC_IF */
+extern void dhd_vif_add(struct dhd_info *dhd, int ifidx, char * name);
+extern void dhd_vif_del(struct dhd_info *dhd, int ifidx);
+extern void dhd_event(struct dhd_info *dhd, char *evpkt, int evlen, int ifidx);
+extern void dhd_vif_sendup(struct dhd_info *dhd, int ifidx, uchar *cp, int len);
+
+#ifdef WL_NATOE
+extern int dhd_natoe_ct_event(dhd_pub_t *dhd, char *data);
+#endif /* WL_NATOE */
+
+/* Send packet to dongle via data channel */
+extern int dhd_sendpkt(dhd_pub_t *dhdp, int ifidx, void *pkt);
+
+/* send up locally generated event */
+extern void dhd_sendup_event_common(dhd_pub_t *dhdp, wl_event_msg_t *event, void *data);
+/* Send event to host */
+extern void dhd_sendup_event(dhd_pub_t *dhdp, wl_event_msg_t *event, void *data);
+#ifdef LOG_INTO_TCPDUMP
+extern void dhd_sendup_log(dhd_pub_t *dhdp, void *data, int len);
+#endif /* LOG_INTO_TCPDUMP */
+#if defined(SHOW_LOGTRACE) && defined(EWP_EDL)
+void dhd_sendup_info_buf(dhd_pub_t *dhdp, uint8 *msg);
+#endif
+#if defined(WIFI_TURNON_USE_HALINIT)
+extern int dhd_open(struct net_device *net);
+#endif /* WIFI_TURNON_USE_HALINIT */
+extern int dhd_bus_devreset(dhd_pub_t *dhdp, uint8 flag);
+extern uint dhd_bus_status(dhd_pub_t *dhdp);
+extern int  dhd_bus_start(dhd_pub_t *dhdp);
+extern int dhd_bus_suspend(dhd_pub_t *dhdpub);
+extern int dhd_bus_resume(dhd_pub_t *dhdpub, int stage);
+extern int dhd_bus_membytes(dhd_pub_t *dhdp, bool set, uint32 address, uint8 *data, uint size);
+extern void dhd_print_buf(void *pbuf, int len, int bytes_per_line);
+extern bool dhd_is_associated(dhd_pub_t *dhd, uint8 ifidx, int *retval);
+#if defined(BCMSDIO) || defined(BCMPCIE)
+extern uint dhd_bus_chip_id(dhd_pub_t *dhdp);
+extern uint dhd_bus_chiprev_id(dhd_pub_t *dhdp);
+extern uint dhd_bus_chippkg_id(dhd_pub_t *dhdp);
+#endif /* defined(BCMSDIO) || defined(BCMPCIE) */
+int dhd_bus_get_fw_mode(dhd_pub_t *dhdp);
+
+#if defined(KEEP_ALIVE)
+extern int dhd_keep_alive_onoff(dhd_pub_t *dhd);
+#endif /* KEEP_ALIVE */
+
+/* linux is defined for DHD EFI builds also,
+* since its cross-compiled for EFI from linux.
+* dbgring_lock apis are meant only for linux
+* to use mutexes, other OSes will continue to
+* use osl_spin_lock
+*/
+void *dhd_os_dbgring_lock_init(osl_t *osh);
+void dhd_os_dbgring_lock_deinit(osl_t *osh, void *mtx);
+unsigned long dhd_os_dbgring_lock(void *lock);
+void dhd_os_dbgring_unlock(void *lock, unsigned long flags);
+
+#ifdef PCIE_INB_DW
+static INLINE int dhd_os_ds_enter_wait(dhd_pub_t * pub, uint * condition)
+{ return 0; }
+static INLINE int dhd_os_ds_enter_wake(dhd_pub_t * pub)
+{ return 0; }
+#endif /* PCIE_INB_DW */
+
+extern int dhd_os_busbusy_wait_negation(dhd_pub_t * pub, uint * condition);
+extern int dhd_os_busbusy_wake(dhd_pub_t * pub);
+extern void dhd_os_tx_completion_wake(dhd_pub_t *dhd);
+extern int dhd_os_busbusy_wait_condition(dhd_pub_t *pub, uint *var, uint condition);
+extern int dhd_os_d3ack_wait(dhd_pub_t * pub, uint * condition);
+extern int dhd_os_d3ack_wake(dhd_pub_t * pub);
+extern int dhd_os_dmaxfer_wait(dhd_pub_t *pub, uint *condition);
+extern int dhd_os_dmaxfer_wake(dhd_pub_t *pub);
+int dhd_os_busbusy_wait_bitmask(dhd_pub_t *pub, uint *var,
+               uint bitmask, uint condition);
+#ifdef PCIE_INB_DW
+extern int dhd_os_ds_exit_wait(dhd_pub_t * pub, uint * condition);
+extern int dhd_os_ds_exit_wake(dhd_pub_t * pub);
+#endif /* PCIE_INB_DW */
+int dhd_os_tput_test_wait(dhd_pub_t *pub, uint *condition, uint timeout_ms);
+int dhd_os_tput_test_wake(dhd_pub_t * pub);
+
+/*
+ * Manage sta objects in an interface. Interface is identified by an ifindex and
+ * sta(s) within an interfaces are managed using a MacAddress of the sta.
+ */
+struct dhd_sta;
+extern bool dhd_sta_associated(dhd_pub_t *dhdp, uint32 bssidx, uint8 *mac);
+extern struct dhd_sta *dhd_find_sta(void *pub, int ifidx, void *ea);
+extern struct dhd_sta *dhd_findadd_sta(void *pub, int ifidx, void *ea);
+extern void dhd_del_all_sta(void *pub, int ifidx);
+extern void dhd_del_sta(void *pub, int ifidx, void *ea);
+extern int dhd_get_ap_isolate(dhd_pub_t *dhdp, uint32 idx);
+extern int dhd_set_ap_isolate(dhd_pub_t *dhdp, uint32 idx, int val);
+extern int dhd_bssidx2idx(dhd_pub_t *dhdp, uint32 bssidx);
+extern struct net_device *dhd_linux_get_primary_netdev(dhd_pub_t *dhdp);
+
+extern bool dhd_is_concurrent_mode(dhd_pub_t *dhd);
+int dhd_iovar(dhd_pub_t *pub, int ifidx, char *name, char *param_buf, uint param_len,
+               char *res_buf, uint res_len, bool set);
+extern int dhd_getiovar(dhd_pub_t *pub, int ifidx, char *name, char *cmd_buf,
+               uint cmd_len, char **resptr, uint resp_len);
+
+#ifdef DHD_MCAST_REGEN
+extern int dhd_get_mcast_regen_bss_enable(dhd_pub_t *dhdp, uint32 idx);
+extern int dhd_set_mcast_regen_bss_enable(dhd_pub_t *dhdp, uint32 idx, int val);
+#endif
+typedef enum cust_gpio_modes {
+       WLAN_RESET_ON,
+       WLAN_RESET_OFF,
+       WLAN_POWER_ON,
+       WLAN_POWER_OFF
+} cust_gpio_modes_t;
+
+typedef struct dmaxref_mem_map {
+       dhd_dma_buf_t *srcmem;
+       dhd_dma_buf_t *dstmem;
+} dmaxref_mem_map_t;
+
+extern int wl_iw_iscan_set_scan_broadcast_prep(struct net_device *dev, uint flag);
+extern int wl_iw_send_priv_event(struct net_device *dev, char *flag);
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+extern void dhd_flush_rx_tx_wq(dhd_pub_t *dhdp);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+/*
+ * Insmod parameters for debug/test
+ */
+
+/* Watchdog timer interval */
+extern uint dhd_watchdog_ms;
+extern bool dhd_os_wd_timer_enabled(void *bus);
+#ifdef DHD_PCIE_RUNTIMEPM
+extern uint dhd_runtimepm_ms;
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+/** Default console output poll interval */
+extern uint dhd_console_ms;
+
+extern uint android_msg_level;
+extern uint config_msg_level;
+extern uint sd_msglevel;
+extern uint dump_msg_level;
+#ifdef BCMDBUS
+extern uint dbus_msglevel;
+#endif /* BCMDBUS */
+#ifdef WL_WIRELESS_EXT
+extern uint iw_msg_level;
+#endif
+#ifdef WL_CFG80211
+extern uint wl_dbg_level;
+#endif
+
+extern uint dhd_slpauto;
+
+/* Use interrupts */
+extern uint dhd_intr;
+
+/* Use polling */
+extern uint dhd_poll;
+
+/* ARP offload agent mode */
+extern uint dhd_arp_mode;
+
+/* Pkt filte enable control */
+extern uint dhd_pkt_filter_enable;
+
+/*  Pkt filter init setup */
+extern uint dhd_pkt_filter_init;
+
+/* Pkt filter mode control */
+extern uint dhd_master_mode;
+
+/* Roaming mode control */
+extern uint dhd_roam_disable;
+
+/* Roaming mode control */
+extern uint dhd_radio_up;
+
+/* TCM verification control */
+extern uint dhd_tcm_test_enable;
+
+/* Initial idletime ticks (may be -1 for immediate idle, 0 for no idle) */
+extern int dhd_idletime;
+#ifdef DHD_USE_IDLECOUNT
+#define DHD_IDLETIME_TICKS 5
+#else
+#define DHD_IDLETIME_TICKS 1
+#endif /* DHD_USE_IDLECOUNT */
+
+/* SDIO Drive Strength */
+extern uint dhd_sdiod_drive_strength;
+
+/* triggers bcm_bprintf to print to kernel log */
+extern bool bcm_bprintf_bypass;
+
+/* Override to force tx queueing all the time */
+extern uint dhd_force_tx_queueing;
+
+/* Default bcn_timeout value is 4 */
+#define DEFAULT_BCN_TIMEOUT_VALUE      4
+#ifndef CUSTOM_BCN_TIMEOUT_SETTING
+#define CUSTOM_BCN_TIMEOUT_SETTING     DEFAULT_BCN_TIMEOUT_VALUE
+#endif
+
+/* Default KEEP_ALIVE Period is 55 sec to prevent AP from sending Keep Alive probe frame */
+#define DEFAULT_KEEP_ALIVE_VALUE       55000 /* msec */
+#ifndef CUSTOM_KEEP_ALIVE_SETTING
+#define CUSTOM_KEEP_ALIVE_SETTING      DEFAULT_KEEP_ALIVE_VALUE
+#endif /* DEFAULT_KEEP_ALIVE_VALUE */
+
+#define NULL_PKT_STR   "null_pkt"
+
+/* hooks for custom glom setting option via Makefile */
+#define DEFAULT_GLOM_VALUE     -1
+#ifndef CUSTOM_GLOM_SETTING
+#define CUSTOM_GLOM_SETTING    DEFAULT_GLOM_VALUE
+#endif
+#define WL_AUTO_ROAM_TRIGGER -75
+/* hooks for custom Roaming Trigger  setting via Makefile */
+#define DEFAULT_ROAM_TRIGGER_VALUE -75 /* dBm default roam trigger all band */
+#define DEFAULT_ROAM_TRIGGER_SETTING   -1
+#ifndef CUSTOM_ROAM_TRIGGER_SETTING
+#define CUSTOM_ROAM_TRIGGER_SETTING    DEFAULT_ROAM_TRIGGER_VALUE
+#endif
+
+/* hooks for custom Roaming Romaing  setting via Makefile */
+#define DEFAULT_ROAM_DELTA_VALUE  10 /* dBm default roam delta all band */
+#define DEFAULT_ROAM_DELTA_SETTING     -1
+#ifndef CUSTOM_ROAM_DELTA_SETTING
+#define CUSTOM_ROAM_DELTA_SETTING      DEFAULT_ROAM_DELTA_VALUE
+#endif
+
+/* hooks for custom PNO Event wake lock to guarantee enough time
+       for the Platform to detect Event before system suspended
+*/
+#define DEFAULT_PNO_EVENT_LOCK_xTIME   2       /* multiplay of DHD_PACKET_TIMEOUT_MS */
+#ifndef CUSTOM_PNO_EVENT_LOCK_xTIME
+#define CUSTOM_PNO_EVENT_LOCK_xTIME     DEFAULT_PNO_EVENT_LOCK_xTIME
+#endif
+/* hooks for custom dhd_dpc_prio setting option via Makefile */
+#define DEFAULT_DHP_DPC_PRIO  1
+#ifndef CUSTOM_DPC_PRIO_SETTING
+#define CUSTOM_DPC_PRIO_SETTING        DEFAULT_DHP_DPC_PRIO
+#endif
+
+#ifndef CUSTOM_LISTEN_INTERVAL
+#define CUSTOM_LISTEN_INTERVAL                 LISTEN_INTERVAL
+#endif /* CUSTOM_LISTEN_INTERVAL */
+
+#define DEFAULT_SUSPEND_BCN_LI_DTIM            3
+#ifndef CUSTOM_SUSPEND_BCN_LI_DTIM
+#define CUSTOM_SUSPEND_BCN_LI_DTIM             DEFAULT_SUSPEND_BCN_LI_DTIM
+#endif
+
+#ifndef BCN_TIMEOUT_IN_SUSPEND
+#define BCN_TIMEOUT_IN_SUSPEND                 6 /* bcn timeout value in suspend mode */
+#endif
+
+#ifndef CUSTOM_RXF_PRIO_SETTING
+#define CUSTOM_RXF_PRIO_SETTING                MAX((CUSTOM_DPC_PRIO_SETTING - 1), 1)
+#endif
+
+#define DEFAULT_WIFI_TURNOFF_DELAY             0
+#ifndef WIFI_TURNOFF_DELAY
+#define WIFI_TURNOFF_DELAY             DEFAULT_WIFI_TURNOFF_DELAY
+#endif /* WIFI_TURNOFF_DELAY */
+
+#define DEFAULT_WIFI_TURNON_DELAY              200
+#ifndef WIFI_TURNON_DELAY
+#define WIFI_TURNON_DELAY              DEFAULT_WIFI_TURNON_DELAY
+#endif /* WIFI_TURNON_DELAY */
+
+#ifdef BCMSDIO
+#define DEFAULT_DHD_WATCHDOG_INTERVAL_MS       10 /* msec */
+#else
+#define DEFAULT_DHD_WATCHDOG_INTERVAL_MS       0 /* msec */
+#endif
+#ifndef CUSTOM_DHD_WATCHDOG_MS
+#define CUSTOM_DHD_WATCHDOG_MS                 DEFAULT_DHD_WATCHDOG_INTERVAL_MS
+#endif /* DEFAULT_DHD_WATCHDOG_INTERVAL_MS */
+
+#define        DHD_INB_DW_DEASSERT_MS                  250
+
+#define DEFAULT_ASSOC_RETRY_MAX                        3
+#ifndef CUSTOM_ASSOC_RETRY_MAX
+#define CUSTOM_ASSOC_RETRY_MAX                 DEFAULT_ASSOC_RETRY_MAX
+#endif /* DEFAULT_ASSOC_RETRY_MAX */
+
+#if defined(BCMSDIO) || defined(DISABLE_FRAMEBURST)
+#define DEFAULT_FRAMEBURST_SET                 0
+#else
+#define DEFAULT_FRAMEBURST_SET                 1
+#endif /* BCMSDIO */
+
+#ifndef CUSTOM_FRAMEBURST_SET
+#define CUSTOM_FRAMEBURST_SET                  DEFAULT_FRAMEBURST_SET
+#endif /* CUSTOM_FRAMEBURST_SET */
+
+#ifdef WLTDLS
+#ifndef CUSTOM_TDLS_IDLE_MODE_SETTING
+#define CUSTOM_TDLS_IDLE_MODE_SETTING  60000 /* 60sec to tear down TDLS of not active */
+#endif
+#ifndef CUSTOM_TDLS_RSSI_THRESHOLD_HIGH
+#define CUSTOM_TDLS_RSSI_THRESHOLD_HIGH -70 /* rssi threshold for establishing TDLS link */
+#endif
+#ifndef CUSTOM_TDLS_RSSI_THRESHOLD_LOW
+#define CUSTOM_TDLS_RSSI_THRESHOLD_LOW -80 /* rssi threshold for tearing down TDLS link */
+#endif
+#ifndef CUSTOM_TDLS_PCKTCNT_THRESHOLD_HIGH
+#define CUSTOM_TDLS_PCKTCNT_THRESHOLD_HIGH 100 /* pkt/sec threshold for establishing TDLS link */
+#endif
+#ifndef CUSTOM_TDLS_PCKTCNT_THRESHOLD_LOW
+#define CUSTOM_TDLS_PCKTCNT_THRESHOLD_LOW 10 /* pkt/sec threshold for tearing down TDLS link */
+#endif
+#endif /* WLTDLS */
+
+#if defined(VSDB) || defined(ROAM_ENABLE)
+#define DEFAULT_BCN_TIMEOUT            8
+#else
+#define DEFAULT_BCN_TIMEOUT            4
+#endif /* CUSTOMER_HW4 && (VSDB || ROAM_ENABLE) */
+
+#ifndef CUSTOM_BCN_TIMEOUT
+#define CUSTOM_BCN_TIMEOUT             DEFAULT_BCN_TIMEOUT
+#endif
+
+#define MAX_DTIM_SKIP_BEACON_INTERVAL  100 /* max allowed associated AP beacon for DTIM skip */
+#ifndef MAX_DTIM_ALLOWED_INTERVAL
+#define MAX_DTIM_ALLOWED_INTERVAL 600 /* max allowed total beacon interval for DTIM skip */
+#endif
+
+#ifndef MIN_DTIM_FOR_ROAM_THRES_EXTEND
+#define MIN_DTIM_FOR_ROAM_THRES_EXTEND 600 /* minimum dtim interval to extend roam threshold */
+#endif
+
+#ifdef CONFIG_ROAM_RSSI_LIMIT
+extern int dhd_roam_rssi_limit_get(dhd_pub_t *dhd, int *lmt2g, int *lmt5g);
+extern int dhd_roam_rssi_limit_set(dhd_pub_t *dhd, int lmt2g, int lmt5g);
+#ifndef CUSTOM_ROAMRSSI_2G
+#define CUSTOM_ROAMRSSI_2G             ROAMRSSI_2G_DEFAULT
+#endif /* CUSTOM_ROAMRSSI_2G */
+#ifndef CUSTOM_ROAMRSSI_5G
+#define CUSTOM_ROAMRSSI_5G             ROAMRSSI_5G_DEFAULT
+#endif /* CUSTOM_ROAMRSSI_5G */
+#endif /* CONFIG_ROAM_RSSI_LIMIT */
+
+#define NO_DTIM_SKIP 1
+#ifdef SDTEST
+/* Echo packet generator (SDIO), pkts/s */
+extern uint dhd_pktgen;
+
+/* Echo packet len (0 => sawtooth, max 1800) */
+extern uint dhd_pktgen_len;
+#define MAX_PKTGEN_LEN 1800
+#endif
+
+/* optionally set by a module_param_string() */
+#define MOD_PARAM_PATHLEN      2048
+#define MOD_PARAM_INFOLEN      512
+#define MOD_PARAM_SRLEN                64
+
+#ifdef SOFTAP
+extern char fw_path2[MOD_PARAM_PATHLEN];
+#endif
+
+#if defined(ANDROID_PLATFORM_VERSION)
+#if (ANDROID_PLATFORM_VERSION < 7)
+#define DHD_LEGACY_FILE_PATH
+#define VENDOR_PATH "/system"
+#elif (ANDROID_PLATFORM_VERSION == 7)
+#define VENDOR_PATH "/system"
+#elif (ANDROID_PLATFORM_VERSION >= 8)
+#define VENDOR_PATH "/vendor"
+#endif /* ANDROID_PLATFORM_VERSION < 7 */
+#else
+#define VENDOR_PATH ""
+#endif /* ANDROID_PLATFORM_VERSION */
+
+#if defined(ANDROID_PLATFORM_VERSION)
+#if (ANDROID_PLATFORM_VERSION < 9)
+#ifdef WL_STATIC_IF
+#undef WL_STATIC_IF
+#endif /* WL_STATIC_IF */
+#ifdef WL_STATIC_IFNAME_PREFIX
+#undef WL_STATIC_IFNAME_PREFIX
+#endif /* WL_STATIC_IFNAME_PREFIX */
+#endif /* ANDROID_PLATFORM_VERSION < 9 */
+#endif /* ANDROID_PLATFORM_VERSION */
+
+/* Platform path Name -
+ * Used to find out where to find the FW debug support files.
+ * 1) If the Platform Makefile mentions from where it should be
+ *    picked from use it.
+ * 2) If Platform Makefile does not mention anything,use the
+ *    scheme as mapped below
+ */
+#if !defined(PLATFORM_PATH)
+/* First Overrides */
+#if defined(DHD_LEGACY_FILE_PATH)
+/* If Legacy file path is to be used */
+#define PLATFORM_PATH  "/data/"
+#elif defined(PLATFORM_SLP)
+/* Path Name for SLP */
+#define PLATFORM_PATH  "/opt/etc/"
+#else
+/* End of Overrides, rely on what is dictated by Android */
+#if defined(ANDROID_PLATFORM_VERSION)
+#if (ANDROID_PLATFORM_VERSION >= 9)
+#define PLATFORM_PATH  "/data/vendor/conn/"
+#define DHD_MAC_ADDR_EXPORT
+#define DHD_ADPS_BAM_EXPORT
+#define DHD_EXPORT_CNTL_FILE
+#define DHD_SOFTAP_DUAL_IF_INFO
+#define DHD_SEND_HANG_PRIVCMD_ERRORS
+#else
+#define PLATFORM_PATH   "/data/misc/conn/"
+#endif /* ANDROID_PLATFORM_VERSION >= 9 */
+#else
+#define PLATFORM_PATH   "/data/misc/conn/"
+#endif /* ANDROID_PLATFORM_VERSION */
+#endif /* DHD_LEGACY_FILE_PATH */
+#endif /* !PLATFORM_PATH */
+
+#ifdef DHD_MAC_ADDR_EXPORT
+extern struct ether_addr sysfs_mac_addr;
+#endif /* DHD_MAC_ADDR_EXPORT */
+
+/* Flag to indicate if we should download firmware on driver load */
+extern uint dhd_download_fw_on_driverload;
+#ifndef BCMDBUS
+extern int allow_delay_fwdl;
+#endif /* !BCMDBUS */
+
+extern int dhd_process_cid_mac(dhd_pub_t *dhdp, bool prepost);
+extern int dhd_write_file(const char *filepath, char *buf, int buf_len);
+extern int dhd_read_file(const char *filepath, char *buf, int buf_len);
+extern int dhd_write_file_and_check(const char *filepath, char *buf, int buf_len);
+extern int dhd_file_delete(char *path);
+
+#ifdef READ_MACADDR
+extern int dhd_set_macaddr_from_file(dhd_pub_t *dhdp);
+#else
+static INLINE int dhd_set_macaddr_from_file(dhd_pub_t *dhdp) { return 0; }
+#endif /* READ_MACADDR */
+#ifdef WRITE_MACADDR
+extern int dhd_write_macaddr(struct ether_addr *mac);
+#else
+static INLINE int dhd_write_macaddr(struct ether_addr *mac) { return 0; }
+#endif /* WRITE_MACADDR */
+#ifdef USE_CID_CHECK
+#define MAX_VNAME_LEN          64
+#ifdef DHD_EXPORT_CNTL_FILE
+extern char cidinfostr[MAX_VNAME_LEN];
+#endif /* DHD_EXPORT_CNTL_FILE */
+extern int dhd_check_module_cid(dhd_pub_t *dhdp);
+extern char *dhd_get_cid_info(unsigned char *vid, int vid_length);
+#else
+static INLINE int dhd_check_module_cid(dhd_pub_t *dhdp) { return 0; }
+#endif /* USE_CID_CHECK */
+#ifdef GET_MAC_FROM_OTP
+extern int dhd_check_module_mac(dhd_pub_t *dhdp);
+#else
+static INLINE int dhd_check_module_mac(dhd_pub_t *dhdp) { return 0; }
+#endif /* GET_MAC_FROM_OTP */
+
+#if defined(READ_MACADDR) || defined(WRITE_MACADDR) || defined(USE_CID_CHECK) || \
+       defined(GET_MAC_FROM_OTP)
+#define DHD_USE_CISINFO
+#endif /* READ_MACADDR || WRITE_MACADDR || USE_CID_CHECK || GET_MAC_FROM_OTP */
+
+#ifdef DHD_USE_CISINFO
+int dhd_read_cis(dhd_pub_t *dhdp);
+int dhd_read_otp_sw_rgn(dhd_pub_t *dhdp);
+void dhd_clear_cis(dhd_pub_t *dhdp);
+int dhd_alloc_cis(dhd_pub_t *dhdp);
+#if defined(SUPPORT_MULTIPLE_MODULE_CIS) && defined(USE_CID_CHECK)
+extern int dhd_check_module_b85a(void);
+extern int dhd_check_module_b90(void);
+#define BCM4359_MODULE_TYPE_B90B 1
+#define BCM4359_MODULE_TYPE_B90S 2
+#endif /* defined(SUPPORT_MULTIPLE_MODULE_CIS) && defined(USE_CID_CHECK) */
+#if defined(USE_CID_CHECK)
+extern int dhd_check_module_bcm(char *module_type, int index, bool *is_murata_fem);
+#endif /* defined(USE_CID_CHECK) */
+#else
+static INLINE int dhd_read_cis(dhd_pub_t *dhdp) { return 0; }
+static INLINE int dhd_read_otp_sw_rgn(dhd_pub_t *dhdp) { return 0; }
+static INLINE void dhd_clear_cis(dhd_pub_t *dhdp) { }
+static INLINE int dhd_alloc_cis(dhd_pub_t *dhdp) { return 0; }
+#endif /* DHD_USE_CISINFO */
+
+#if defined(WL_CFG80211) && defined(SUPPORT_DEEP_SLEEP)
+/* Flags to indicate if we distingish power off policy when
+ * user set the memu "Keep Wi-Fi on during sleep" to "Never"
+ */
+extern int trigger_deep_sleep;
+int dhd_deepsleep(struct net_device *dev, int flag);
+#endif /* WL_CFG80211 && SUPPORT_DEEP_SLEEP */
+
+extern void dhd_wait_for_event(dhd_pub_t *dhd, bool *lockvar);
+extern void dhd_wait_event_wakeup(dhd_pub_t*dhd);
+
+#define IFLOCK_INIT(lock)       *lock = 0
+#define IFLOCK(lock)    while (InterlockedCompareExchange((lock), 1, 0))       \
+       NdisStallExecution(1);
+#define IFUNLOCK(lock)  InterlockedExchange((lock), 0)
+#define IFLOCK_FREE(lock)
+#define FW_SUPPORTED(dhd, capa) ((strstr(dhd->fw_capabilities, " " #capa " ") != NULL))
+#ifdef ARP_OFFLOAD_SUPPORT
+#define MAX_IPV4_ENTRIES       8
+void dhd_arp_offload_set(dhd_pub_t * dhd, int arp_mode);
+void dhd_arp_offload_enable(dhd_pub_t * dhd, int arp_enable);
+
+/* dhd_commn arp offload wrapers */
+void dhd_aoe_hostip_clr(dhd_pub_t *dhd, int idx);
+void dhd_aoe_arp_clr(dhd_pub_t *dhd, int idx);
+int dhd_arp_get_arp_hostip_table(dhd_pub_t *dhd, void *buf, int buflen, int idx);
+void dhd_arp_offload_add_ip(dhd_pub_t *dhd, uint32 ipaddr, int idx);
+#endif /* ARP_OFFLOAD_SUPPORT */
+#ifdef WLTDLS
+int dhd_tdls_enable(struct net_device *dev, bool tdls_on, bool auto_on, struct ether_addr *mac);
+int dhd_tdls_set_mode(dhd_pub_t *dhd, bool wfd_mode);
+#ifdef PCIE_FULL_DONGLE
+int dhd_tdls_update_peer_info(dhd_pub_t *dhdp, wl_event_msg_t *event);
+int dhd_tdls_event_handler(dhd_pub_t *dhd_pub, wl_event_msg_t *event);
+int dhd_free_tdls_peer_list(dhd_pub_t *dhd_pub);
+#endif /* PCIE_FULL_DONGLE */
+#endif /* WLTDLS */
+
+/* Neighbor Discovery Offload Support */
+extern int dhd_ndo_enable(dhd_pub_t * dhd, int ndo_enable);
+int dhd_ndo_add_ip(dhd_pub_t *dhd, char* ipaddr, int idx);
+int dhd_ndo_remove_ip(dhd_pub_t *dhd, int idx);
+
+/* Enhanced ND offload support */
+uint16 dhd_ndo_get_version(dhd_pub_t *dhdp);
+int dhd_ndo_add_ip_with_type(dhd_pub_t *dhdp, char *ipv6addr, uint8 type, int idx);
+int dhd_ndo_remove_ip_by_addr(dhd_pub_t *dhdp, char *ipv6addr, int idx);
+int dhd_ndo_remove_ip_by_type(dhd_pub_t *dhdp, uint8 type, int idx);
+int dhd_ndo_unsolicited_na_filter_enable(dhd_pub_t *dhdp, int enable);
+
+/* ioctl processing for nl80211 */
+int dhd_ioctl_process(dhd_pub_t *pub, int ifidx, struct dhd_ioctl *ioc, void *data_buf);
+
+#if defined(SUPPORT_MULTIPLE_REVISION)
+extern int
+concate_revision(struct dhd_bus *bus, char *fwpath, char *nvpath);
+#endif /* SUPPORT_MULTIPLE_REVISION */
+void dhd_bus_update_fw_nv_path(struct dhd_bus *bus, char *pfw_path, char *pnv_path,
+                                                                                       char *pclm_path, char *pconf_path);
+void dhd_set_bus_state(void *bus, uint32 state);
+
+/* Remove proper pkts(either one no-frag pkt or whole fragmented pkts) */
+typedef int (*f_droppkt_t)(dhd_pub_t *dhdp, int prec, void* p, bool bPktInQ);
+extern bool dhd_prec_drop_pkts(dhd_pub_t *dhdp, struct pktq *pq, int prec, f_droppkt_t fn);
+
+#ifdef PROP_TXSTATUS
+int dhd_os_wlfc_block(dhd_pub_t *pub);
+int dhd_os_wlfc_unblock(dhd_pub_t *pub);
+extern const uint8 prio2fifo[];
+#endif /* PROP_TXSTATUS */
+
+int dhd_os_socram_dump(struct net_device *dev, uint32 *dump_size);
+int dhd_os_get_socram_dump(struct net_device *dev, char **buf, uint32 *size);
+int dhd_common_socram_dump(dhd_pub_t *dhdp);
+
+int dhd_dump(dhd_pub_t *dhdp, char *buf, int buflen);
+
+int dhd_os_get_version(struct net_device *dev, bool dhd_ver, char **buf, uint32 size);
+void dhd_get_memdump_filename(struct net_device *ndev, char *memdump_path, int len, char *fname);
+uint8* dhd_os_prealloc(dhd_pub_t *dhdpub, int section, uint size, bool kmalloc_if_fail);
+void dhd_os_prefree(dhd_pub_t *dhdpub, void *addr, uint size);
+
+#if defined(CONFIG_DHD_USE_STATIC_BUF)
+#define DHD_OS_PREALLOC(dhdpub, section, size) dhd_os_prealloc(dhdpub, section, size, FALSE)
+#define DHD_OS_PREFREE(dhdpub, addr, size) dhd_os_prefree(dhdpub, addr, size)
+#else
+#define DHD_OS_PREALLOC(dhdpub, section, size) MALLOC(dhdpub->osh, size)
+#define DHD_OS_PREFREE(dhdpub, addr, size) MFREE(dhdpub->osh, addr, size)
+#endif /* defined(CONFIG_DHD_USE_STATIC_BUF) */
+
+#ifdef USE_WFA_CERT_CONF
+enum {
+       SET_PARAM_BUS_TXGLOM_MODE,
+       SET_PARAM_ROAMOFF,
+#ifdef USE_WL_FRAMEBURST
+       SET_PARAM_FRAMEBURST,
+#endif /* USE_WL_FRAMEBURST */
+#ifdef USE_WL_TXBF
+       SET_PARAM_TXBF,
+#endif /* USE_WL_TXBF */
+#ifdef PROP_TXSTATUS
+       SET_PARAM_PROPTX,
+       SET_PARAM_PROPTXMODE,
+#endif /* PROP_TXSTATUS */
+       PARAM_LAST_VALUE
+};
+extern int sec_get_param_wfa_cert(dhd_pub_t *dhd, int mode, uint* read_val);
+#ifdef DHD_EXPORT_CNTL_FILE
+#define VALUENOTSET 0xFFFFFFFFu
+extern uint32 bus_txglom;
+extern uint32 roam_off;
+#ifdef USE_WL_FRAMEBURST
+extern uint32 frameburst;
+#endif /* USE_WL_FRAMEBURST */
+#ifdef USE_WL_TXBF
+extern uint32 txbf;
+#endif /* USE_WL_TXBF */
+#ifdef PROP_TXSTATUS
+extern uint32 proptx;
+#endif /* PROP_TXSTATUS */
+#endif /* DHD_EXPORT_CNTL_FILE */
+#endif /* USE_WFA_CERT_CONF */
+
+#define dhd_add_flowid(pub, ifidx, ac_prio, ea, flowid)  do {} while (0)
+#define dhd_del_flowid(pub, ifidx, flowid)               do {} while (0)
+bool dhd_wet_chainable(dhd_pub_t *dhdp);
+
+extern unsigned long dhd_os_general_spin_lock(dhd_pub_t *pub);
+extern void dhd_os_general_spin_unlock(dhd_pub_t *pub, unsigned long flags);
+
+/** Miscellaenous DHD Spin Locks */
+
+/* Enable DHD general spin lock/unlock */
+#define DHD_GENERAL_LOCK(dhdp, flags) \
+       (flags) = dhd_os_general_spin_lock(dhdp)
+#define DHD_GENERAL_UNLOCK(dhdp, flags) \
+       dhd_os_general_spin_unlock((dhdp), (flags))
+
+/* Enable DHD timer spin lock/unlock */
+#define DHD_TIMER_LOCK(lock, flags)     (flags) = osl_spin_lock(lock)
+#define DHD_TIMER_UNLOCK(lock, flags)   osl_spin_unlock(lock, (flags))
+
+/* Enable DHD flowring spin lock/unlock */
+#define DHD_FLOWRING_LOCK(lock, flags)     (flags) = osl_spin_lock(lock)
+#define DHD_FLOWRING_UNLOCK(lock, flags)   osl_spin_unlock((lock), (flags))
+
+/* Enable DHD common flowring info spin lock/unlock */
+#define DHD_FLOWID_LOCK(lock, flags)       (flags) = osl_spin_lock(lock)
+#define DHD_FLOWID_UNLOCK(lock, flags)     osl_spin_unlock((lock), (flags))
+
+/* Enable DHD common flowring list spin lock/unlock */
+#define DHD_FLOWRING_LIST_LOCK(lock, flags)       (flags) = osl_spin_lock(lock)
+#define DHD_FLOWRING_LIST_UNLOCK(lock, flags)     osl_spin_unlock((lock), (flags))
+
+#define DHD_RING_LOCK(lock, flags)     (flags) = osl_spin_lock(lock)
+#define DHD_RING_UNLOCK(lock, flags)   osl_spin_unlock((lock), (flags))
+
+#define DHD_BUS_LP_STATE_LOCK(lock, flags)     (flags) = osl_spin_lock(lock)
+#define DHD_BUS_LP_STATE_UNLOCK(lock, flags)   osl_spin_unlock((lock), (flags))
+
+#define DHD_BAR1_SWITCH_LOCK(lock, flags)      (flags) = osl_spin_lock(lock)
+#define DHD_BAR1_SWITCH_UNLOCK(lock, flags)    osl_spin_unlock((lock), (flags))
+
+#define DHD_BUS_PWR_REQ_LOCK(lock, flags)      (flags) = osl_spin_lock(lock)
+#define DHD_BUS_PWR_REQ_UNLOCK(lock, flags)    osl_spin_unlock((lock), (flags))
+
+/* Enable DHD backplane spin lock/unlock */
+#define DHD_BACKPLANE_ACCESS_LOCK(lock, flags)     (flags) = osl_spin_lock(lock)
+#define DHD_BACKPLANE_ACCESS_UNLOCK(lock, flags)   osl_spin_unlock((lock), (flags))
+
+#define DHD_BUS_INB_DW_LOCK(lock, flags)       (flags) = osl_spin_lock(lock)
+#define DHD_BUS_INB_DW_UNLOCK(lock, flags)     osl_spin_unlock((lock), (flags))
+
+/* Enable DHD TDLS peer list spin lock/unlock */
+#ifdef WLTDLS
+#define DHD_TDLS_LOCK(lock, flags)       (flags) = osl_spin_lock(lock)
+#define DHD_TDLS_UNLOCK(lock, flags)     osl_spin_unlock((lock), (flags))
+#endif /* WLTDLS */
+
+#define DHD_BUS_INB_DW_LOCK(lock, flags)       (flags) = osl_spin_lock(lock)
+#define DHD_BUS_INB_DW_UNLOCK(lock, flags)     osl_spin_unlock((lock), (flags))
+
+#ifdef DBG_PKT_MON
+/* Enable DHD PKT MON spin lock/unlock */
+#define DHD_PKT_MON_LOCK(lock, flags)     (flags) = osl_spin_lock(lock)
+#define DHD_PKT_MON_UNLOCK(lock, flags)   osl_spin_unlock(lock, (flags))
+#endif /* DBG_PKT_MON */
+
+#ifdef DHD_PKT_LOGGING
+/* Enable DHD PKT LOG spin lock/unlock */
+#define DHD_PKT_LOG_LOCK(lock, flags)     (flags) = osl_spin_lock(lock)
+#define DHD_PKT_LOG_UNLOCK(lock, flags)   osl_spin_unlock(lock, (flags))
+#endif /* DHD_PKT_LOGGING */
+
+#define DHD_LINUX_GENERAL_LOCK(dhdp, flags)    DHD_GENERAL_LOCK(dhdp, flags)
+#define DHD_LINUX_GENERAL_UNLOCK(dhdp, flags)  DHD_GENERAL_UNLOCK(dhdp, flags)
+
+#define DHD_BUS_INB_DW_LOCK(lock, flags)       (flags) = osl_spin_lock(lock)
+#define DHD_BUS_INB_DW_UNLOCK(lock, flags)     osl_spin_unlock((lock), (flags))
+
+#define DHD_RX_NAPI_QUEUE_LOCK(lock, flags)    (flags) = osl_spin_lock(lock)
+#define DHD_RX_NAPI_QUEUE_UNLOCK(lock, flags)  osl_spin_unlock((lock), (flags))
+
+#define DHD_UP_LOCK(lock, flags)       (flags) = osl_spin_lock(lock)
+#define DHD_UP_UNLOCK(lock, flags)     osl_spin_unlock((lock), (flags))
+
+#define DHD_WAKE_SPIN_LOCK(lock, flags)        (flags) = osl_spin_lock(lock)
+#define DHD_WAKE_SPIN_UNLOCK(lock, flags)      osl_spin_unlock((lock), (flags))
+
+/*
+ * Temporarily change log dump lock to spin_lock_irqsave as DHD_ERROR/DHD_LOG_MEM
+ * are being called from dhdpcie_bus_isr.
+ * This will be reverted after proper solution is implemented to handle isr prints
+ */
+#define DHD_LOG_DUMP_BUF_LOCK(lock, flags)     (flags) = osl_spin_lock_irq(lock)
+#define DHD_LOG_DUMP_BUF_UNLOCK(lock, flags)   osl_spin_unlock_irq((lock), (flags))
+
+#define DHD_PKT_WAKE_LOCK(lock, flags) (flags) = osl_spin_lock(lock)
+#define DHD_PKT_WAKE_UNLOCK(lock, flags)       osl_spin_unlock((lock), (flags))
+
+#define DHD_OOB_IRQ_LOCK(lock, flags)  (flags) = osl_spin_lock(lock)
+#define DHD_OOB_IRQ_UNLOCK(lock, flags)        osl_spin_unlock((lock), (flags))
+
+#define DHD_IF_STA_LIST_LOCK(lock, flags)      (flags) = osl_spin_lock(lock)
+#define DHD_IF_STA_LIST_UNLOCK(lock, flags)    osl_spin_unlock((lock), (flags))
+
+/* linux is defined for DHD EFI builds also,
+* since its cross-compiled for EFI from linux
+*/
+#define DHD_DBG_RING_LOCK_INIT(osh)                            dhd_os_dbgring_lock_init(osh)
+#define DHD_DBG_RING_LOCK_DEINIT(osh, lock)            dhd_os_dbgring_lock_deinit(osh, (lock))
+#define DHD_DBG_RING_LOCK(lock, flags)                 (flags) = dhd_os_dbgring_lock(lock)
+#define DHD_DBG_RING_UNLOCK(lock, flags)               dhd_os_dbgring_unlock((lock), flags)
+
+#ifdef DHD_MEM_STATS
+/* memory stats lock/unlock */
+#define DHD_MEM_STATS_LOCK(lock, flags)     (flags) = osl_spin_lock(lock)
+#define DHD_MEM_STATS_UNLOCK(lock, flags)   osl_spin_unlock((lock), (flags))
+#endif /* DHD_MEM_STATS */
+
+extern void dhd_dump_to_kernelog(dhd_pub_t *dhdp);
+
+extern void dhd_print_tasklet_status(dhd_pub_t *dhd);
+#ifdef PCIE_INB_DW
+extern bool dhd_check_cfg_in_progress(dhd_pub_t *dhdp);
+#endif
+
+#ifdef BCMDBUS
+extern uint dhd_get_rxsz(dhd_pub_t *pub);
+extern void dhd_set_path(dhd_pub_t *pub);
+extern void dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf);
+extern void dhd_bus_clearcounts(dhd_pub_t *dhdp);
+#endif /* BCMDBUS */
+
+#ifdef DHD_L2_FILTER
+extern int dhd_get_parp_status(dhd_pub_t *dhdp, uint32 idx);
+extern int dhd_set_parp_status(dhd_pub_t *dhdp, uint32 idx, int val);
+extern int dhd_get_dhcp_unicast_status(dhd_pub_t *dhdp, uint32 idx);
+extern int dhd_set_dhcp_unicast_status(dhd_pub_t *dhdp, uint32 idx, int val);
+extern int dhd_get_block_ping_status(dhd_pub_t *dhdp, uint32 idx);
+extern int dhd_set_block_ping_status(dhd_pub_t *dhdp, uint32 idx, int val);
+extern int dhd_get_grat_arp_status(dhd_pub_t *dhdp, uint32 idx);
+extern int dhd_set_grat_arp_status(dhd_pub_t *dhdp, uint32 idx, int val);
+extern int dhd_get_block_tdls_status(dhd_pub_t *dhdp, uint32 idx);
+extern int dhd_set_block_tdls_status(dhd_pub_t *dhdp, uint32 idx, int val);
+#endif /* DHD_L2_FILTER */
+
+typedef struct wl_io_pport {
+       dhd_pub_t *dhd_pub;
+       uint ifidx;
+} wl_io_pport_t;
+
+typedef struct wl_evt_pport {
+       dhd_pub_t *dhd_pub;
+       int *ifidx;
+       void *pktdata;
+       uint data_len;
+       void **data_ptr;
+       void *raw_event;
+} wl_evt_pport_t;
+
+extern void *dhd_pub_shim(dhd_pub_t *dhd_pub);
+#ifdef DHD_FW_COREDUMP
+void* dhd_get_fwdump_buf(dhd_pub_t *dhd_pub, uint32 length);
+#endif /* DHD_FW_COREDUMP */
+
+int dhd_get_download_buffer(dhd_pub_t  *dhd, char *file_path, download_type_t component,
+       char ** buffer, int *length);
+
+void dhd_free_download_buffer(dhd_pub_t        *dhd, void *buffer, int length);
+
+int dhd_download_blob(dhd_pub_t *dhd, unsigned char *buf,
+               uint32 len, char *iovar);
+
+int dhd_download_blob_cached(dhd_pub_t *dhd, char *file_path,
+       uint32 len, char *iovar);
+
+int dhd_apply_default_txcap(dhd_pub_t *dhd, char *txcap_path);
+int dhd_apply_default_clm(dhd_pub_t *dhd, char *clm_path);
+
+#ifdef SHOW_LOGTRACE
+int dhd_parse_logstrs_file(osl_t *osh, char *raw_fmts, int logstrs_size,
+               dhd_event_log_t *event_log);
+int dhd_parse_map_file(osl_t *osh, void *file, uint32 *ramstart,
+               uint32 *rodata_start, uint32 *rodata_end);
+#ifdef PCIE_FULL_DONGLE
+int dhd_event_logtrace_infobuf_pkt_process(dhd_pub_t *dhdp, void *pktbuf,
+               dhd_event_log_t *event_data);
+#endif /* PCIE_FULL_DONGLE */
+#endif /* SHOW_LOGTRACE */
+
+/*
+ * control_logtrace:
+ * "0" -> do not print event log messages in any form
+ * "1" -> print event log messages as EL
+ * "2" -> print event log messages as formatted CONSOLE_E if logstrs.bin etc. files are available
+ */
+typedef enum logtrace_ctrl {
+       LOGTRACE_DISABLE = 0,
+       LOGTRACE_RAW_FMT = 1,
+       LOGTRACE_PARSED_FMT = 2
+} logtrace_ctrl_t;
+
+#define DEFAULT_CONTROL_LOGTRACE       LOGTRACE_PARSED_FMT
+#ifndef CUSTOM_CONTROL_LOGTRACE
+#define CUSTOM_CONTROL_LOGTRACE                DEFAULT_CONTROL_LOGTRACE
+#endif
+
+extern uint8 control_logtrace;
+
+#define dhd_is_device_removed(x) FALSE
+#define dhd_os_ind_firmware_stall(x)
+
+#if defined(DHD_FW_COREDUMP)
+extern void dhd_get_memdump_info(dhd_pub_t *dhd);
+#endif /* defined(DHD_FW_COREDUMP) */
+#ifdef BCMASSERT_LOG
+extern void dhd_get_assert_info(dhd_pub_t *dhd);
+#else
+static INLINE void dhd_get_assert_info(dhd_pub_t *dhd) { }
+#endif /* BCMASSERT_LOG */
+
+#define DMAXFER_FREE(dhdp, dmap) dhd_schedule_dmaxfer_free(dhdp, dmap);
+
+#if defined(PCIE_FULL_DONGLE)
+extern void dmaxfer_free_prev_dmaaddr(dhd_pub_t *dhdp, dmaxref_mem_map_t *dmmap);
+void dhd_schedule_dmaxfer_free(dhd_pub_t *dhdp, dmaxref_mem_map_t *dmmap);
+#endif  /* PCIE_FULL_DONGLE */
+
+#define DHD_LB_STATS_NOOP      do { /* noop */ } while (0)
+#if defined(DHD_LB_STATS)
+#include <bcmutils.h>
+extern void dhd_lb_stats_init(dhd_pub_t *dhd);
+extern void dhd_lb_stats_deinit(dhd_pub_t *dhd);
+#ifdef DHD_MEM_STATS
+extern uint64 dhd_lb_mem_usage(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf);
+#endif /* DHD_MEM_STATS */
+extern void dhd_lb_stats_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf);
+extern void dhd_lb_stats_update_napi_histo(dhd_pub_t *dhdp, uint32 count);
+extern void dhd_lb_stats_update_txc_histo(dhd_pub_t *dhdp, uint32 count);
+extern void dhd_lb_stats_update_rxc_histo(dhd_pub_t *dhdp, uint32 count);
+extern void dhd_lb_stats_txc_percpu_cnt_incr(dhd_pub_t *dhdp);
+extern void dhd_lb_stats_rxc_percpu_cnt_incr(dhd_pub_t *dhdp);
+#define DHD_LB_STATS_INIT(dhdp)        dhd_lb_stats_init(dhdp)
+#define DHD_LB_STATS_DEINIT(dhdp) dhd_lb_stats_deinit(dhdp)
+/* Reset is called from common layer so it takes dhd_pub_t as argument */
+#define DHD_LB_STATS_RESET(dhdp) dhd_lb_stats_init(dhdp)
+#define DHD_LB_STATS_CLR(x)    (x) = 0U
+#define DHD_LB_STATS_INCR(x)   (x) = (x) + 1
+#define DHD_LB_STATS_ADD(x, c) (x) = (x) + (c)
+#define DHD_LB_STATS_PERCPU_ARR_INCR(x) \
+       { \
+               int cpu = get_cpu(); put_cpu(); \
+               DHD_LB_STATS_INCR(x[cpu]); \
+       }
+#define DHD_LB_STATS_UPDATE_NAPI_HISTO(dhdp, x)        dhd_lb_stats_update_napi_histo(dhdp, x)
+#define DHD_LB_STATS_UPDATE_TXC_HISTO(dhdp, x) dhd_lb_stats_update_txc_histo(dhdp, x)
+#define DHD_LB_STATS_UPDATE_RXC_HISTO(dhdp, x) dhd_lb_stats_update_rxc_histo(dhdp, x)
+#define DHD_LB_STATS_TXC_PERCPU_CNT_INCR(dhdp) dhd_lb_stats_txc_percpu_cnt_incr(dhdp)
+#define DHD_LB_STATS_RXC_PERCPU_CNT_INCR(dhdp) dhd_lb_stats_rxc_percpu_cnt_incr(dhdp)
+#else /* !DHD_LB_STATS */
+#define DHD_LB_STATS_INIT(dhdp)         DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_DEINIT(dhdp) DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_RESET(dhdp) DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_CLR(x)     DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_INCR(x)    DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_ADD(x, c)  DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_PERCPU_ARR_INCR(x)         DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_UPDATE_NAPI_HISTO(dhd, x) DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_UPDATE_TXC_HISTO(dhd, x) DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_UPDATE_RXC_HISTO(dhd, x) DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_TXC_PERCPU_CNT_INCR(dhdp) DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_RXC_PERCPU_CNT_INCR(dhdp) DHD_LB_STATS_NOOP
+#endif /* !DHD_LB_STATS */
+
+#ifdef DHD_SSSR_DUMP
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+#define DHD_SSSR_MEMPOOL_SIZE  (2 * 1024 * 1024) /* 2MB size */
+#else
+#define DHD_SSSR_MEMPOOL_SIZE  (1 * 1024 * 1024) /* 1MB size */
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+/* used in sssr_dump_mode */
+#define SSSR_DUMP_MODE_SSSR    0       /* dump both *before* and *after* files */
+#define SSSR_DUMP_MODE_FIS     1       /* dump *after* files only */
+
+extern int dhd_sssr_mempool_init(dhd_pub_t *dhd);
+extern void dhd_sssr_mempool_deinit(dhd_pub_t *dhd);
+extern int dhd_sssr_dump_init(dhd_pub_t *dhd);
+extern void dhd_sssr_dump_deinit(dhd_pub_t *dhd);
+extern int dhdpcie_sssr_dump(dhd_pub_t *dhd);
+extern void dhd_sssr_print_filepath(dhd_pub_t *dhd, char *path);
+extern int dhd_sssr_reg_info_init(dhd_pub_t *dhd);
+extern void dhd_sssr_reg_info_deinit(dhd_pub_t *dhd);
+extern uint dhd_sssr_dig_buf_size(dhd_pub_t *dhdp);
+extern uint dhd_sssr_dig_buf_addr(dhd_pub_t *dhdp);
+extern uint dhd_sssr_mac_buf_size(dhd_pub_t *dhdp, uint8 core_idx);
+extern uint dhd_sssr_mac_xmtaddress(dhd_pub_t *dhdp, uint8 core_idx);
+extern uint dhd_sssr_mac_xmtdata(dhd_pub_t *dhdp, uint8 core_idx);
+
+#define DHD_SSSR_MEMPOOL_INIT(dhdp)    dhd_sssr_mempool_init(dhdp)
+#define DHD_SSSR_MEMPOOL_DEINIT(dhdp) dhd_sssr_mempool_deinit(dhdp)
+#define DHD_SSSR_DUMP_INIT(dhdp)       dhd_sssr_dump_init(dhdp)
+#define DHD_SSSR_DUMP_DEINIT(dhdp) dhd_sssr_dump_deinit(dhdp)
+#define DHD_SSSR_PRINT_FILEPATH(dhdp, path) dhd_sssr_print_filepath(dhdp, path)
+#define DHD_SSSR_REG_INFO_INIT(dhdp)   dhd_sssr_reg_info_init(dhdp)
+#define DHD_SSSR_REG_INFO_DEINIT(dhdp) dhd_sssr_reg_info_deinit(dhdp)
+#else
+#define DHD_SSSR_MEMPOOL_INIT(dhdp)            do { /* noop */ } while (0)
+#define DHD_SSSR_MEMPOOL_DEINIT(dhdp)          do { /* noop */ } while (0)
+#define DHD_SSSR_DUMP_INIT(dhdp)               do { /* noop */ } while (0)
+#define DHD_SSSR_DUMP_DEINIT(dhdp)             do { /* noop */ } while (0)
+#define DHD_SSSR_PRINT_FILEPATH(dhdp, path)    do { /* noop */ } while (0)
+#define DHD_SSSR_REG_INFO_INIT(dhdp)           do { /* noop */ } while (0)
+#define DHD_SSSR_REG_INFO_DEINIT(dhdp)         do { /* noop */ } while (0)
+#endif /* DHD_SSSR_DUMP */
+
+#ifdef BCMPCIE
+extern int dhd_prot_debug_info_print(dhd_pub_t *dhd);
+extern bool dhd_bus_skip_clm(dhd_pub_t *dhdp);
+extern void dhd_pcie_dump_rc_conf_space_cap(dhd_pub_t *dhd);
+extern bool dhd_pcie_dump_int_regs(dhd_pub_t *dhd);
+#else
+#define dhd_prot_debug_info_print(x)
+static INLINE bool dhd_bus_skip_clm(dhd_pub_t *dhd_pub)
+{ return 0; }
+#endif /* BCMPCIE */
+
+fw_download_status_t dhd_fw_download_status(dhd_pub_t * dhd_pub);
+void dhd_show_kirqstats(dhd_pub_t *dhd);
+
+/* Bitmask used for Join Timeout */
+#define WLC_SSID_MASK          0x01
+#define WLC_WPA_MASK           0x02
+
+extern int dhd_start_join_timer(dhd_pub_t *pub);
+extern int dhd_stop_join_timer(dhd_pub_t *pub);
+extern int dhd_start_scan_timer(dhd_pub_t *pub, bool is_escan);
+extern int dhd_stop_scan_timer(dhd_pub_t *pub, bool is_escan, uint16 sync_id);
+extern int dhd_start_cmd_timer(dhd_pub_t *pub);
+extern int dhd_stop_cmd_timer(dhd_pub_t *pub);
+extern int dhd_start_bus_timer(dhd_pub_t *pub);
+extern int dhd_stop_bus_timer(dhd_pub_t *pub);
+extern uint16 dhd_get_request_id(dhd_pub_t *pub);
+extern int dhd_set_request_id(dhd_pub_t *pub, uint16 id, uint32 cmd);
+extern void dhd_set_join_error(dhd_pub_t *pub, uint32 mask);
+extern void dhd_clear_join_error(dhd_pub_t *pub, uint32 mask);
+extern void dhd_get_scan_to_val(dhd_pub_t *pub, uint32 *to_val);
+extern void dhd_set_scan_to_val(dhd_pub_t *pub, uint32 to_val);
+extern void dhd_get_join_to_val(dhd_pub_t *pub, uint32 *to_val);
+extern void dhd_set_join_to_val(dhd_pub_t *pub, uint32 to_val);
+extern void dhd_get_cmd_to_val(dhd_pub_t *pub, uint32 *to_val);
+extern void dhd_set_cmd_to_val(dhd_pub_t *pub, uint32 to_val);
+extern void dhd_get_bus_to_val(dhd_pub_t *pub, uint32 *to_val);
+extern void dhd_set_bus_to_val(dhd_pub_t *pub, uint32 to_val);
+extern int dhd_start_timesync_timer(dhd_pub_t *pub);
+extern int dhd_stop_timesync_timer(dhd_pub_t *pub);
+
+#ifdef DHD_PKTID_AUDIT_ENABLED
+void dhd_pktid_error_handler(dhd_pub_t *dhdp);
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+#ifdef DHD_MAP_PKTID_LOGGING
+extern void dhd_pktid_logging_dump(dhd_pub_t *dhdp);
+#endif /* DHD_MAP_PKTID_LOGGING */
+
+#ifdef DHD_PCIE_RUNTIMEPM
+#define DEFAULT_DHD_RUNTIME_MS 100
+#ifndef CUSTOM_DHD_RUNTIME_MS
+#define CUSTOM_DHD_RUNTIME_MS DEFAULT_DHD_RUNTIME_MS
+#endif /* CUSTOM_DHD_RUNTIME_MS */
+
+#ifndef MAX_IDLE_COUNT
+#define MAX_IDLE_COUNT 11
+#endif /* MAX_IDLE_COUNT */
+
+extern bool dhd_runtimepm_state(dhd_pub_t *dhd);
+extern bool dhd_runtime_bus_wake(struct dhd_bus *bus, bool wait, void *func_addr);
+extern bool dhdpcie_runtime_bus_wake(dhd_pub_t *dhdp, bool wait, void *func_addr);
+extern void dhdpcie_block_runtime_pm(dhd_pub_t *dhdp);
+extern bool dhdpcie_is_resume_done(dhd_pub_t *dhdp);
+extern void dhd_runtime_pm_disable(dhd_pub_t *dhdp);
+extern void dhd_runtime_pm_enable(dhd_pub_t *dhdp);
+/* Disable the Runtime PM thread and wake up if the bus is already in suspend */
+#define DHD_DISABLE_RUNTIME_PM(dhdp) \
+do { \
+       dhd_runtime_pm_disable(dhdp); \
+} while (0);
+
+/* Enable the Runtime PM thread */
+#define DHD_ENABLE_RUNTIME_PM(dhdp) \
+do { \
+       dhd_runtime_pm_enable(dhdp); \
+} while (0);
+
+/* Stop the timer and disable RPM thread */
+#define DHD_STOP_RPM_TIMER(dhdp) \
+do { \
+       dhd_os_runtimepm_timer(dhdp, 0); \
+       DHD_DISABLE_RUNTIME_PM(dhdp) \
+} while (0);
+
+/* Start the timer and enable RPM thread */
+#define DHD_START_RPM_TIMER(dhdp) \
+do { \
+       dhd_os_runtimepm_timer(dhdp, dhd_runtimepm_ms); \
+       DHD_ENABLE_RUNTIME_PM(dhdp) \
+} while (0);
+#else
+#define DHD_DISABLE_RUNTIME_PM(dhdp)
+#define DHD_ENABLE_RUNTIME_PM(dhdp)
+#define DHD_STOP_RPM_TIMER(dhdp)
+#define DHD_START_RPM_TIMER(dhdp)
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+extern bool dhd_prot_is_cmpl_ring_empty(dhd_pub_t *dhd, void *prot_info);
+extern void dhd_prot_dump_ring_ptrs(void *prot_info);
+
+#if defined(DHD_TRACE_WAKE_LOCK)
+void dhd_wk_lock_stats_dump(dhd_pub_t *dhdp);
+#endif
+
+extern bool dhd_query_bus_erros(dhd_pub_t *dhdp);
+void dhd_clear_bus_errors(dhd_pub_t *dhdp);
+
+#if defined(CONFIG_64BIT)
+#define DHD_SUPPORT_64BIT
+#endif /* (linux || LINUX) && CONFIG_64BIT */
+
+#if defined(DHD_ERPOM)
+extern void dhd_schedule_reset(dhd_pub_t *dhdp);
+#else
+static INLINE void dhd_schedule_reset(dhd_pub_t *dhdp) {;}
+#endif
+
+extern void init_dhd_timeouts(dhd_pub_t *pub);
+extern void deinit_dhd_timeouts(dhd_pub_t *pub);
+
+typedef enum timeout_resons {
+       DHD_REASON_COMMAND_TO,
+       DHD_REASON_JOIN_TO,
+       DHD_REASON_SCAN_TO,
+       DHD_REASON_OQS_TO
+} timeout_reasons_t;
+
+#if defined(PCIE_INB_DW)
+extern int dhd_bus_set_device_wake(struct dhd_bus *bus, bool val);
+extern void dhd_bus_dw_deassert(dhd_pub_t *dhd);
+#endif
+extern void dhd_prhex(const char *msg, volatile uchar *buf, uint nbytes, uint8 dbg_level);
+int dhd_tput_test(dhd_pub_t *dhd, tput_test_t *tput_data);
+void dhd_tput_test_rx(dhd_pub_t *dhd, void *pkt);
+static INLINE int dhd_get_max_txbufs(dhd_pub_t *dhdp)
+{ return -1; }
+
+#ifdef FILTER_IE
+int dhd_read_from_file(dhd_pub_t *dhd);
+int dhd_parse_filter_ie(dhd_pub_t *dhd, uint8 *buf);
+int dhd_get_filter_ie_count(dhd_pub_t *dhd, uint8 *buf);
+int dhd_parse_oui(dhd_pub_t *dhd, uint8 *inbuf, uint8 *oui, int len);
+int dhd_check_valid_ie(dhd_pub_t *dhdp, uint8 *buf, int len);
+#endif /* FILTER_IE */
+
+uint16 dhd_prot_get_ioctl_trans_id(dhd_pub_t *dhdp);
+
+#ifdef SET_PCIE_IRQ_CPU_CORE
+enum {
+       PCIE_IRQ_AFFINITY_OFF = 0,
+       PCIE_IRQ_AFFINITY_BIG_CORE_ANY,
+       PCIE_IRQ_AFFINITY_BIG_CORE_EXYNOS,
+       PCIE_IRQ_AFFINITY_LAST
+};
+
+extern void dhd_set_irq_cpucore(dhd_pub_t *dhdp, int affinity_cmd);
+#endif /* SET_PCIE_IRQ_CPU_CORE */
+#if defined(DHD_HANG_SEND_UP_TEST)
+extern void dhd_make_hang_with_reason(struct net_device *dev, const char *string_num);
+#endif /* DHD_HANG_SEND_UP_TEST */
+
+#ifdef DHD_WAKE_STATUS
+wake_counts_t* dhd_get_wakecount(dhd_pub_t *dhdp);
+#endif /* DHD_WAKE_STATUS */
+extern int dhd_get_random_bytes(uint8 *buf, uint len);
+
+#if defined(DHD_BLOB_EXISTENCE_CHECK)
+extern void dhd_set_blob_support(dhd_pub_t *dhdp, char *fw_path);
+#endif /* DHD_BLOB_EXISTENCE_CHECK */
+
+int dhd_get_preserve_log_numbers(dhd_pub_t *dhd, uint32 *logset_mask);
+#ifdef DHD_LOG_DUMP
+void dhd_schedule_log_dump(dhd_pub_t *dhdp, void *type);
+void dhd_log_dump_trigger(dhd_pub_t *dhdp, int subcmd);
+#endif
+
+#ifdef DHD_LOG_DUMP
+int dhd_log_dump_ring_to_file(dhd_pub_t *dhdp, void *ring_ptr, void *file,
+               unsigned long *file_posn, log_dump_section_hdr_t *sec_hdr, char *text_hdr,
+               uint32 sec_type);
+int dhd_dump_debug_ring(dhd_pub_t *dhdp, void *ring_ptr, const void *user_buf,
+               log_dump_section_hdr_t *sec_hdr, char *text_hdr, int buflen, uint32 sec_type);
+int dhd_log_dump_cookie_to_file(dhd_pub_t *dhdp, void *fp,
+       const void *user_buf, unsigned long *f_pos);
+int dhd_log_dump_cookie(dhd_pub_t *dhdp, const void *user_buf);
+uint32 dhd_log_dump_cookie_len(dhd_pub_t *dhdp);
+int dhd_logdump_cookie_init(dhd_pub_t *dhdp, uint8 *buf, uint32 buf_size);
+void dhd_logdump_cookie_deinit(dhd_pub_t *dhdp);
+void dhd_logdump_cookie_save(dhd_pub_t *dhdp, char *cookie, char *type);
+int dhd_logdump_cookie_get(dhd_pub_t *dhdp, char *ret_cookie, uint32 buf_size);
+int dhd_logdump_cookie_count(dhd_pub_t *dhdp);
+int dhd_get_dld_log_dump(void *dev, dhd_pub_t *dhdp, const void *user_buf, void *fp,
+       uint32 len, int type, void *pos);
+#if defined(BCMPCIE)
+int dhd_print_ext_trap_data(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+       void *fp, uint32 len, void *pos);
+uint32 dhd_get_ext_trap_len(void *ndev, dhd_pub_t *dhdp);
+#endif /* BCMPCIE */
+int dhd_print_dump_data(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+       void *fp, uint32 len, void *pos);
+int dhd_print_cookie_data(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+       void *fp, uint32 len, void *pos);
+int dhd_print_health_chk_data(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+       void *fp, uint32 len, void *pos);
+int dhd_print_time_str(const void *user_buf, void *fp, uint32 len, void *pos);
+#ifdef DHD_DUMP_PCIE_RINGS
+int dhd_print_flowring_data(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+       void *fp, uint32 len, void *pos);
+uint32 dhd_get_flowring_len(void *ndev, dhd_pub_t *dhdp);
+#endif /* DHD_DUMP_PCIE_RINGS */
+#ifdef DHD_STATUS_LOGGING
+extern int dhd_print_status_log_data(void *dev, dhd_pub_t *dhdp,
+       const void *user_buf, void *fp, uint32 len, void *pos);
+extern uint32 dhd_get_status_log_len(void *ndev, dhd_pub_t *dhdp);
+#endif /* DHD_STATUS_LOGGING */
+int dhd_print_ecntrs_data(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+       void *fp, uint32 len, void *pos);
+int dhd_print_rtt_data(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+       void *fp, uint32 len, void *pos);
+int dhd_get_debug_dump_file_name(void *dev, dhd_pub_t *dhdp,
+       char *dump_path, int size);
+uint32 dhd_get_time_str_len(void);
+uint32 dhd_get_health_chk_len(void *ndev, dhd_pub_t *dhdp);
+uint32 dhd_get_dhd_dump_len(void *ndev, dhd_pub_t *dhdp);
+uint32 dhd_get_cookie_log_len(void *ndev, dhd_pub_t *dhdp);
+uint32 dhd_get_ecntrs_len(void *ndev, dhd_pub_t *dhdp);
+uint32 dhd_get_rtt_len(void *ndev, dhd_pub_t *dhdp);
+uint32 dhd_get_dld_len(int log_type);
+void dhd_init_sec_hdr(log_dump_section_hdr_t *sec_hdr);
+extern char *dhd_log_dump_get_timestamp(void);
+bool dhd_log_dump_ecntr_enabled(void);
+bool dhd_log_dump_rtt_enabled(void);
+void dhd_nla_put_sssr_dump_len(void *ndev, uint32 *arr_len);
+int dhd_get_debug_dump(void *dev, const void *user_buf, uint32 len, int type);
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+int
+dhd_sssr_dump_d11_buf_before(void *dev, const void *user_buf, uint32 len, int core);
+int
+dhd_sssr_dump_dig_buf_before(void *dev, const void *user_buf, uint32 len);
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+int
+dhd_sssr_dump_d11_buf_after(void *dev, const void *user_buf, uint32 len, int core);
+int
+dhd_sssr_dump_dig_buf_after(void *dev, const void *user_buf, uint32 len);
+#ifdef DHD_PKT_LOGGING
+extern int dhd_os_get_pktlog_dump(void *dev, const void *user_buf, uint32 len);
+extern uint32 dhd_os_get_pktlog_dump_size(struct net_device *dev);
+extern void dhd_os_get_pktlogdump_filename(struct net_device *dev, char *dump_path, int len);
+#endif /* DHD_PKT_LOGGING */
+
+#ifdef DNGL_AXI_ERROR_LOGGING
+extern int dhd_os_get_axi_error_dump(void *dev, const void *user_buf, uint32 len);
+extern int dhd_os_get_axi_error_dump_size(struct net_device *dev);
+extern void dhd_os_get_axi_error_filename(struct net_device *dev, char *dump_path, int len);
+#endif /*  DNGL_AXI_ERROR_LOGGING */
+
+#endif /* DHD_LOG_DUMP */
+int dhd_export_debug_data(void *mem_buf, void *fp, const void *user_buf, uint32 buf_len, void *pos);
+#define DHD_PCIE_CONFIG_SAVE(bus)      pci_save_state(bus->dev)
+#define DHD_PCIE_CONFIG_RESTORE(bus)   pci_restore_state(bus->dev)
+
+typedef struct dhd_pkt_parse {
+       uint32 proto;   /* Network layer protocol */
+       uint32 t1;      /* n-tuple */
+       uint32 t2;
+} dhd_pkt_parse_t;
+
+/* ========= RING API functions : exposed to others ============= */
+#define DHD_RING_TYPE_FIXED            1
+#define DHD_RING_TYPE_SINGLE_IDX       2
+uint32 dhd_ring_get_hdr_size(void);
+void *dhd_ring_init(dhd_pub_t *dhdp, uint8 *buf, uint32 buf_size, uint32 elem_size,
+       uint32 elem_cnt, uint32 type);
+void dhd_ring_deinit(dhd_pub_t *dhdp, void *_ring);
+void *dhd_ring_get_first(void *_ring);
+void dhd_ring_free_first(void *_ring);
+void dhd_ring_set_read_idx(void *_ring, uint32 read_idx);
+void dhd_ring_set_write_idx(void *_ring, uint32 write_idx);
+uint32 dhd_ring_get_read_idx(void *_ring);
+uint32 dhd_ring_get_write_idx(void *_ring);
+void *dhd_ring_get_last(void *_ring);
+void *dhd_ring_get_next(void *_ring, void *cur);
+void *dhd_ring_get_prev(void *_ring, void *cur);
+void *dhd_ring_get_empty(void *_ring);
+int dhd_ring_get_cur_size(void *_ring);
+void dhd_ring_lock(void *ring, void *fist_ptr, void *last_ptr);
+void dhd_ring_lock_free(void *ring);
+void *dhd_ring_lock_get_first(void *_ring);
+void *dhd_ring_lock_get_last(void *_ring);
+int dhd_ring_lock_get_count(void *_ring);
+void dhd_ring_lock_free_first(void *ring);
+void dhd_ring_whole_lock(void *ring);
+void dhd_ring_whole_unlock(void *ring);
+
+#ifdef GDB_PROXY
+/** Firmware loaded and GDB proxy may access memory and registers */
+#define DHD_GDB_PROXY_PROBE_ACCESS_ENABLED             0x00000001
+/** Firmware loaded, access to it is enabled but it is not running yet */
+#define DHD_GDB_PROXY_PROBE_FIRMWARE_NOT_RUNNING       0x00000002
+/** Firmware is running */
+#define DHD_GDB_PROXY_PROBE_FIRMWARE_RUNNING           0x00000004
+/** Firmware was started in bootloader mode */
+#define DHD_GDB_PROXY_PROBE_BOOTLOADER_MODE            0x00000008
+
+/* Data structure, returned by "gdb_proxy_probe" iovar */
+typedef struct dhd_gdb_proxy_probe_data {
+       uint32 data_len;        /* Length of data in structure */
+       uint32 magic;           /* Must contain DHD_IOCTL_MAGIC */
+       uint32 flags;           /* Set of DHD_GDB_PROXY_PROBE_... bits */
+       uint32 last_id;         /* 0 or proxy ID last set */
+} dhd_gdb_proxy_probe_data_t;
+#endif /* GDB_PROXY */
+
+#ifdef PKT_FILTER_SUPPORT
+extern void dhd_pktfilter_offload_set(dhd_pub_t * dhd, char *arg);
+extern void dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode);
+extern void dhd_pktfilter_offload_delete(dhd_pub_t *dhd, int id);
+#endif
+
+#ifdef DHD_DUMP_PCIE_RINGS
+extern int dhd_d2h_h2d_ring_dump(dhd_pub_t *dhd, void *file, const void *user_buf,
+       unsigned long *file_posn, bool file_write);
+#endif /* DHD_DUMP_PCIE_RINGS */
+
+#ifdef EWP_EDL
+#define DHD_EDL_RING_SIZE (D2HRING_EDL_MAX_ITEM * D2HRING_EDL_ITEMSIZE)
+int dhd_event_logtrace_process_edl(dhd_pub_t *dhdp, uint8 *data,
+               void *evt_decode_data);
+int dhd_edl_mem_init(dhd_pub_t *dhd);
+void dhd_edl_mem_deinit(dhd_pub_t *dhd);
+void dhd_prot_edl_ring_tcm_rd_update(dhd_pub_t *dhd);
+#define DHD_EDL_MEM_INIT(dhdp) dhd_edl_mem_init(dhdp)
+#define DHD_EDL_MEM_DEINIT(dhdp) dhd_edl_mem_deinit(dhdp)
+#define DHD_EDL_RING_TCM_RD_UPDATE(dhdp) \
+       dhd_prot_edl_ring_tcm_rd_update(dhdp)
+#else
+#define DHD_EDL_MEM_INIT(dhdp) do { /* noop */ } while (0)
+#define DHD_EDL_MEM_DEINIT(dhdp) do { /* noop */ } while (0)
+#define DHD_EDL_RING_TCM_RD_UPDATE(dhdp) do { /* noop */ } while (0)
+#endif /* EWP_EDL */
+
+#ifdef BIGDATA_SOFTAP
+void dhd_schedule_gather_ap_stadata(void *bcm_cfg, void *ndev, const wl_event_msg_t *e);
+#endif /* BIGDATA_SOFTAP */
+
+#if defined(DHD_H2D_LOG_TIME_SYNC)
+void dhd_h2d_log_time_sync_deferred_wq_schedule(dhd_pub_t *dhdp);
+void dhd_h2d_log_time_sync(dhd_pub_t *dhdp);
+#endif /* DHD_H2D_LOG_TIME_SYNC */
+extern void dhd_cleanup_if(struct net_device *net);
+
+void dhd_schedule_logtrace(void *dhd_info);
+int dhd_print_fw_ver_from_file(dhd_pub_t *dhdp, char *fwpath);
+
+/* configuration of ecounters. API's tp start/stop. currently supported only for linux */
+extern int dhd_ecounter_configure(dhd_pub_t *dhd, bool enable);
+extern int dhd_start_ecounters(dhd_pub_t *dhd);
+extern int dhd_stop_ecounters(dhd_pub_t *dhd);
+extern int dhd_start_event_ecounters(dhd_pub_t *dhd);
+extern int dhd_stop_event_ecounters(dhd_pub_t *dhd);
+
+#define DHD_DUMP_TYPE_NAME_SIZE                32
+#define DHD_DUMP_FILE_PATH_SIZE                256
+#define DHD_DUMP_FILE_COUNT_MAX                5
+#define DHD_DUMP_TYPE_COUNT_MAX                10
+
+#ifdef DHD_DUMP_MNGR
+typedef struct _DFM_elem {
+       char type_name[DHD_DUMP_TYPE_NAME_SIZE];
+       char file_path[DHD_DUMP_FILE_COUNT_MAX][DHD_DUMP_FILE_PATH_SIZE];
+       int file_idx;
+} DFM_elem_t;
+
+typedef struct _dhd_dump_file_manage {
+       DFM_elem_t elems[DHD_DUMP_TYPE_COUNT_MAX];
+} dhd_dump_file_manage_t;
+
+extern void dhd_dump_file_manage_enqueue(dhd_pub_t *dhd, char *dump_path, char *fname);
+#endif /* DHD_DUMP_MNGR */
+
+#define HD_PREFIX_SIZE  2   /* hexadecimal prefix size */
+#define HD_BYTE_SIZE    2   /* hexadecimal byte size */
+
+#ifdef DNGL_AXI_ERROR_LOGGING
+extern void dhd_axi_error(dhd_pub_t *dhd);
+#ifdef DHD_USE_WQ_FOR_DNGL_AXI_ERROR
+extern void dhd_axi_error_dispatch(dhd_pub_t *dhdp);
+#endif /* DHD_USE_WQ_FOR_DNGL_AXI_ERROR */
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+#ifdef DHD_STATUS_LOGGING
+#include <dhd_statlog.h>
+#else
+#define ST(x)          0
+#define STDIR(x)       0
+#define DHD_STATLOG_CTRL(dhdp, stat, ifidx, reason) \
+       do { /* noop */ } while (0)
+#define DHD_STATLOG_DATA(dhdp, stat, ifidx, dir, cond) \
+       do { BCM_REFERENCE(cond); } while (0)
+#define DHD_STATLOG_DATA_RSN(dhdp, stat, ifidx, dir, reason) \
+       do { /* noop */ } while (0)
+#endif /* DHD_STATUS_LOGGING */
+
+#ifdef SUPPORT_SET_TID
+enum dhd_set_tid_mode {
+       /* Disalbe changing TID */
+       SET_TID_OFF = 0,
+       /* Change TID for all UDP frames */
+       SET_TID_ALL_UDP,
+       /* Change TID for UDP frames based on UID */
+       SET_TID_BASED_ON_UID
+};
+extern void dhd_set_tid_based_on_uid(dhd_pub_t *dhdp, void *pkt);
+#endif /* SUPPORT_SET_TID */
+
+#ifdef CONFIG_SILENT_ROAM
+extern int dhd_sroam_set_mon(dhd_pub_t *dhd, bool set);
+typedef wlc_sroam_info_v1_t wlc_sroam_info_t;
+#endif /* CONFIG_SILENT_ROAM */
+
+#ifdef DHD_DUMP_FILE_WRITE_FROM_KERNEL
+#define FILE_NAME_HAL_TAG      ""
+#else
+#define FILE_NAME_HAL_TAG      "_hal" /* The tag name concatenated by HAL */
+#endif /* DHD_DUMP_FILE_WRITE_FROM_KERNEL */
+
+extern struct dhd_if * dhd_get_ifp(dhd_pub_t *dhdp, uint32 ifidx);
+uint8 dhd_d11_slices_num_get(dhd_pub_t *dhdp);
+#ifdef WL_AUTO_QOS
+extern void dhd_wl_sock_qos_set_status(dhd_pub_t *dhdp, unsigned long on_off);
+#endif /* WL_AUTO_QOS */
+
+void *dhd_get_roam_evt(dhd_pub_t *dhdp);
+#if defined(DISABLE_HE_ENAB) || defined(CUSTOM_CONTROL_HE_ENAB)
+extern int dhd_control_he_enab(dhd_pub_t * dhd, uint8 he_enab);
+extern uint8 control_he_enab;
+#endif /* DISABLE_HE_ENAB  || CUSTOM_CONTROL_HE_ENAB */
+
+#ifdef DHD_SDTC_ETB_DUMP
+
+#define DHD_SDTC_ETB_MEMPOOL_SIZE (33 * 1024)
+
+extern void dhd_sdtc_etb_init(dhd_pub_t *dhd);
+extern void dhd_sdtc_etb_deinit(dhd_pub_t *dhd);
+extern void dhd_sdtc_etb_dump(dhd_pub_t *dhd);
+#endif /* DHD_SDTC_ETB_DUMP */
+
+#ifdef DHD_TX_PROFILE
+int dhd_tx_profile_attach(dhd_pub_t *dhdp);
+int dhd_tx_profile_detach(dhd_pub_t *dhdp);
+#endif /* defined (DHD_TX_PROFILE) */
+
+#ifdef DHD_SUPPORT_HDM
+extern bool hdm_trigger_init;
+extern int dhd_module_init_hdm(void);
+extern void dhd_hdm_wlan_sysfs_init(void);
+extern void dhd_hdm_wlan_sysfs_deinit(struct work_struct *);
+#define SYSFS_DEINIT_MS 10
+#endif /* DHD_SUPPORT_HDM */
+#ifdef WL_MONITOR
+void dhd_set_monitor(dhd_pub_t *pub, int ifidx, int val);
+#endif /* WL_MONITOR */
+
+#endif /* _dhd_h_ */
diff --git a/bcmdhd.101.10.240.x/dhd_bitpack.c b/bcmdhd.101.10.240.x/dhd_bitpack.c
new file mode 100644 (file)
index 0000000..c3aecaf
--- /dev/null
@@ -0,0 +1,228 @@
+/*
+ * Bit packing and Base64 utils for EWP
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#include <dhd_bitpack.h>
+
+#define BIT_PACK_OVERFLOW 0xFFFFFFFFu
+
+const char* base64_table = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+#define BASE64_MAX_VALUE 63u
+
+#define BASE64_UNIT_LEN 6u
+
+#define BASE64_OFFSET0 0u
+#define BASE64_OFFSET1 6u
+#define BASE64_OFFSET2 12u
+
+#define MASK_UPPER_6BIT 0xfc
+#define MASK_LOWER_6BIT 0x3f
+
+#define MASK_UPPER_4BIT 0xf0
+#define MASK_LOWER_4BIT 0x0f
+
+#define MASK_UPPER_2BIT 0xc0
+#define MASK_LOWER_2BIT 0x03
+
+#define SHIFT_2BIT 2u
+#define SHIFT_4BIT 4u
+#define SHIFT_6BIT 6u
+
+#define BASE64_PADDING_MARGIN 4u
+
+/*
+ * Function:   dhd_bit_pack
+ *
+ * Purpose:    bit data packing to given buffer
+ *
+ * Input Parameters:
+ *      buf            buffer to pack bit data
+ *      buf_len                total buffer length
+ *     bit_offset      offset in buffer (bitwise)
+ *     data            data to pack (max 32 bit)
+ *     bit_length      bit length to pack
+ *
+ * Output:
+ *     Updated bit offset in buf
+ */
+int32
+dhd_bit_pack(char *buf, int buf_len, int bit_offset, uint32 data, int32 bit_length)
+{
+
+       int32 byte_shift = (bit_offset / 8);
+       int32 local_bit_offset = bit_offset % 8;
+       int32 available_bit = 8 - local_bit_offset;
+       int32 remain_bit = bit_length;
+       uint32 cropped_data;
+       int32 idx;
+       int32 total_byte = BYTE_SIZE(local_bit_offset + bit_length);
+
+       if (bit_length > 32) {
+               /* exceeded max bit length, do nothing */
+               return bit_offset;
+       }
+       if (BYTE_SIZE(bit_offset + bit_length) > buf_len) {
+               /* can't pack more bits if expected offset is
+                * exceeded then buffer size
+                */
+               return bit_offset;
+       }
+       if (bit_length < 32 && data >= 1<<bit_length) {
+               cropped_data = BIT_PACK_OVERFLOW << (32 - bit_length);
+               cropped_data = cropped_data >> (32 - bit_length);
+       } else {
+               cropped_data = data << (32 - bit_length);
+               cropped_data = cropped_data >> (32 - bit_length);
+       }
+
+       buf += byte_shift;
+
+       remain_bit = bit_length;
+       if (total_byte > 10) {
+               return bit_offset;
+       }
+       for (idx = 0; idx < total_byte; idx++) {
+               char temp_byte = 0x00;
+               if (idx == 0) {
+                       local_bit_offset = bit_offset % 8;
+               } else {
+                       local_bit_offset = 0;
+               }
+
+               available_bit = 8 - local_bit_offset;
+               remain_bit -= available_bit;
+               if (remain_bit >= 0) {
+                       temp_byte = cropped_data >> remain_bit;
+               } else {
+                       temp_byte = cropped_data << (-1*remain_bit);
+               }
+               *buf = *buf | temp_byte;
+               buf ++;
+       }
+       bit_offset += bit_length;
+
+       return bit_offset;
+}
+
+static char
+dhd_base64_get_code(char input)
+{
+       if (input > BASE64_MAX_VALUE) {
+               return '=';
+       }
+       return base64_table[(int)input];
+}
+
+/*
+ * Function:   dhd_base64_encode
+ *
+ * Purpose:    base64 encoding module which converts from 8 bits to
+ *             6 bit based, base64 format using base64_table
+ *             eg:     input:  hex-123456
+ *                             bin-0001|0010|0011|0100|0101|0110
+ *                     encode every 6 bit :
+ *                             bin-000100|100011|010001|010110
+ *                     base64 code :
+ *                             base64-EjRW
+ *
+ * Input Parameters:
+ *      in_buf         input buffer
+ *      in_buf_len     length of input buffer
+ *     out_buf         output buffer
+ *     out_buf_len     length_ of output buffer
+ *
+ * Output:
+ *     length of encoded base64 string
+ */
+int32
+dhd_base64_encode(char* in_buf, int32 in_buf_len, char* out_buf, int32 out_buf_len)
+{
+       char* input_pos;
+       char* input_end;
+       char* base64_out;
+       char* base64_out_pos;
+       char* base64_output_end;
+       char current_byte = 0;
+       char masked_byte = 0;
+       int32 estimated_out_len = 0;
+       int32 offset = 0;
+
+       if (!in_buf || !out_buf || in_buf_len == 0 || out_buf_len == 0) {
+               /* wrong input parameters */
+               return 0;
+       }
+
+       input_pos = in_buf;
+       input_end = in_buf + in_buf_len;
+       base64_out = out_buf;
+       base64_out_pos = base64_out;
+       base64_output_end = out_buf + out_buf_len - BASE64_PADDING_MARGIN;
+       estimated_out_len = in_buf_len / 3 * 4;
+
+       if (estimated_out_len > out_buf_len) {
+               /* estimated output length is
+                * larger than output buffer size
+                */
+               return 0;
+       }
+
+       while (input_pos != input_end) {
+               if (base64_out_pos > base64_output_end) {
+                       /* outbuf buffer size exceeded, finish encoding */
+                       break;
+               }
+               if (offset == BASE64_OFFSET0) {
+                       current_byte = *input_pos++;
+                       masked_byte = (current_byte & MASK_UPPER_6BIT) >> SHIFT_2BIT;
+                       *base64_out_pos++ = dhd_base64_get_code(masked_byte);
+                       masked_byte = (current_byte & MASK_LOWER_2BIT) << SHIFT_4BIT;
+                       offset += BASE64_UNIT_LEN;
+               } else if (offset == BASE64_OFFSET1) {
+                       current_byte = *input_pos++;
+                       masked_byte |= (current_byte & MASK_UPPER_4BIT) >> SHIFT_4BIT;
+                       *base64_out_pos++ = dhd_base64_get_code(masked_byte);
+                       masked_byte = (current_byte & MASK_LOWER_4BIT) << SHIFT_2BIT;
+                       offset += BASE64_UNIT_LEN;
+               } else if (offset == BASE64_OFFSET2) {
+                       current_byte = *input_pos++;
+                       masked_byte |= (current_byte & MASK_UPPER_2BIT) >> SHIFT_6BIT;
+                       *base64_out_pos++ = dhd_base64_get_code(masked_byte);
+                       offset += BASE64_UNIT_LEN;
+                       masked_byte = (current_byte & MASK_LOWER_6BIT);
+                       *base64_out_pos++ = dhd_base64_get_code(masked_byte);
+                       offset = BASE64_OFFSET0;
+               }
+       }
+       if (offset == BASE64_OFFSET1) {
+               *base64_out_pos++ = dhd_base64_get_code(masked_byte);
+               *base64_out_pos++ = '=';
+               *base64_out_pos++ = '=';
+       } else if (offset == BASE64_OFFSET2) {
+               *base64_out_pos++ = dhd_base64_get_code(masked_byte);
+               *base64_out_pos++ = '=';
+       }
+
+       return base64_out_pos - base64_out;
+}
diff --git a/bcmdhd.101.10.240.x/dhd_bitpack.h b/bcmdhd.101.10.240.x/dhd_bitpack.h
new file mode 100644 (file)
index 0000000..74bebf3
--- /dev/null
@@ -0,0 +1,33 @@
+/*
+ * Bit packing and Base64 utils for EWP
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef __BITPACK_H_
+#define __BITPACK_H_
+
+#define BYTE_SIZE(a) ((a + 7)/8)
+
+extern int32 dhd_bit_pack(char *buf, int32 buf_len, int bit_offset, uint32 data, int32 bit_length);
+extern int32 dhd_base64_encode(char* in_buf, int32 in_buf_len, char* out_buf, int32 out_buf_len);
+#endif /* __BITPACK_H */
diff --git a/bcmdhd.101.10.240.x/dhd_bus.h b/bcmdhd.101.10.240.x/dhd_bus.h
new file mode 100644 (file)
index 0000000..860ff88
--- /dev/null
@@ -0,0 +1,367 @@
+/*
+ * Header file describing the internal (inter-module) DHD interfaces.
+ *
+ * Provides type definitions and function prototypes used to link the
+ * DHD OS, bus, and protocol modules.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef _dhd_bus_h_
+#define _dhd_bus_h_
+
+extern int dbus_up(struct dhd_bus *pub);
+extern int dbus_stop(struct dhd_bus *pub);
+extern int dbus_send_ctl(struct dhd_bus *pub, uint8 *buf, int len);
+extern int dbus_recv_ctl(struct dhd_bus *pub, uint8 *buf, int len);
+/*
+ * Exported from dhd bus module (dhd_usb, dhd_sdio)
+ */
+
+/* global variable for the bus */
+extern struct dhd_bus *g_dhd_bus;
+
+/* Indicate (dis)interest in finding dongles. */
+extern int dhd_bus_register(void);
+extern void dhd_bus_unregister(void);
+
+/* Download firmware image and nvram image */
+extern int dhd_bus_download_firmware(struct dhd_bus *bus, osl_t *osh,
+       char *fw_path, char *nv_path, char *clm_path, char *conf_path);
+#if defined(BT_OVER_SDIO)
+extern int dhd_bus_download_btfw(struct dhd_bus *bus, osl_t *osh, char *btfw_path);
+#endif /* defined (BT_OVER_SDIO) */
+
+/* Stop bus module: clear pending frames, disable data flow */
+extern void dhd_bus_stop(struct dhd_bus *bus, bool enforce_mutex);
+
+/* Initialize bus module: prepare for communication w/dongle */
+extern int dhd_bus_init(dhd_pub_t *dhdp, bool enforce_mutex);
+
+/* Get the Bus Idle Time */
+extern void dhd_bus_getidletime(dhd_pub_t *dhdp, int *idletime);
+
+/* Set the Bus Idle Time */
+extern void dhd_bus_setidletime(dhd_pub_t *dhdp, int idle_time);
+
+/* Send a data frame to the dongle.  Callee disposes of txp. */
+#ifdef BCMPCIE
+extern int dhd_bus_txdata(struct dhd_bus *bus, void *txp, uint8 ifidx);
+#else
+extern int dhd_bus_txdata(struct dhd_bus *bus, void *txp);
+#endif
+
+#ifdef BCMPCIE
+extern uint16 dhd_prot_get_rxbufpost_sz(dhd_pub_t *dhd);
+extern uint16 dhd_prot_get_h2d_rx_post_active(dhd_pub_t *dhd);
+extern uint16 dhd_prot_get_d2h_rx_cpln_active(dhd_pub_t *dhd);
+extern void dhdpcie_cto_recovery_handler(dhd_pub_t *dhd);
+#endif /* BCMPCIE */
+
+/* Send/receive a control message to/from the dongle.
+ * Expects caller to enforce a single outstanding transaction.
+ */
+extern int dhd_bus_txctl(struct dhd_bus *bus, uchar *msg, uint msglen);
+extern int dhd_bus_rxctl(struct dhd_bus *bus, uchar *msg, uint msglen);
+
+/* Watchdog timer function */
+extern bool dhd_bus_watchdog(dhd_pub_t *dhd);
+
+extern int dhd_bus_oob_intr_register(dhd_pub_t *dhdp);
+extern void dhd_bus_oob_intr_unregister(dhd_pub_t *dhdp);
+extern void dhd_bus_oob_intr_set(dhd_pub_t *dhdp, bool enable);
+extern int dhd_bus_get_oob_irq_num(dhd_pub_t *dhdp);
+extern void dhd_bus_dev_pm_stay_awake(dhd_pub_t *dhdpub);
+extern void dhd_bus_dev_pm_relax(dhd_pub_t *dhdpub);
+extern bool dhd_bus_dev_pm_enabled(dhd_pub_t *dhdpub);
+
+/* Device console input function */
+extern int dhd_bus_console_in(dhd_pub_t *dhd, uchar *msg, uint msglen);
+#ifdef CONSOLE_DPC
+extern int dhd_bus_txcons(dhd_pub_t *dhd, uchar *msg, uint msglen);
+#endif
+
+/* Deferred processing for the bus, return TRUE requests reschedule */
+extern bool dhd_bus_dpc(struct dhd_bus *bus);
+extern void dhd_bus_isr(bool * InterruptRecognized, bool * QueueMiniportHandleInterrupt, void *arg);
+
+/* Check for and handle local prot-specific iovar commands */
+extern int dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
+                            void *params, uint plen, void *arg, uint len, bool set);
+
+/* Add bus dump output to a buffer */
+extern void dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf);
+
+/* Clear any bus counters */
+extern void dhd_bus_clearcounts(dhd_pub_t *dhdp);
+
+#if defined(BCMSDIO) && defined(PKT_STATICS)
+extern void dhd_bus_dump_txpktstatics(struct dhd_bus *bus);
+extern void dhd_bus_clear_txpktstatics(struct dhd_bus *bus);
+#endif
+
+/* return the dongle chipid */
+extern uint dhd_bus_chip(struct dhd_bus *bus);
+
+/* return the dongle chiprev */
+extern uint dhd_bus_chiprev(struct dhd_bus *bus);
+
+/* Set user-specified nvram parameters. */
+extern void dhd_bus_set_nvram_params(struct dhd_bus * bus, const char *nvram_params);
+
+extern void *dhd_bus_pub(struct dhd_bus *bus);
+extern void *dhd_bus_txq(struct dhd_bus *bus);
+extern void *dhd_bus_sih(struct dhd_bus *bus);
+extern uint dhd_bus_hdrlen(struct dhd_bus *bus);
+#ifdef BCMSDIO
+extern void dhd_bus_set_dotxinrx(struct dhd_bus *bus, bool val);
+/* return sdio io status */
+extern uint8 dhd_bus_is_ioready(struct dhd_bus *bus);
+#else
+#define dhd_bus_set_dotxinrx(a, b) do {} while (0)
+#endif
+
+#define DHD_SET_BUS_STATE_DOWN(_bus)  do { \
+       (_bus)->dhd->busstate = DHD_BUS_DOWN; \
+} while (0)
+
+/* Register a dummy SDIO client driver in order to be notified of new SDIO device */
+extern int dhd_bus_reg_sdio_notify(void* semaphore);
+extern void dhd_bus_unreg_sdio_notify(void);
+extern void dhd_txglom_enable(dhd_pub_t *dhdp, bool enable);
+extern int dhd_bus_get_ids(struct dhd_bus *bus, uint32 *bus_type, uint32 *bus_num,
+       uint32 *slot_num);
+
+#if defined(DHD_FW_COREDUMP) && (defined(BCMPCIE) || defined(BCMSDIO))
+extern int dhd_bus_mem_dump(dhd_pub_t *dhd);
+extern int dhd_bus_get_mem_dump(dhd_pub_t *dhdp);
+#else
+#define dhd_bus_mem_dump(x)
+#define dhd_bus_get_mem_dump(x)
+#endif /* DHD_FW_COREDUMP && (BCMPCIE || BCMSDIO) */
+
+#ifdef BCMPCIE
+enum {
+       /* Scratch buffer confiuguration update */
+       D2H_DMA_SCRATCH_BUF,
+       D2H_DMA_SCRATCH_BUF_LEN,
+
+       /* DMA Indices array buffers for: H2D WR and RD, and D2H WR and RD */
+       H2D_DMA_INDX_WR_BUF, /* update H2D WR dma indices buf base addr to dongle */
+       H2D_DMA_INDX_RD_BUF, /* update H2D RD dma indices buf base addr to dongle */
+       D2H_DMA_INDX_WR_BUF, /* update D2H WR dma indices buf base addr to dongle */
+       D2H_DMA_INDX_RD_BUF, /* update D2H RD dma indices buf base addr to dongle */
+
+       /* DHD sets/gets WR or RD index, in host's H2D and D2H DMA indices buffer */
+       H2D_DMA_INDX_WR_UPD, /* update H2D WR index in H2D WR dma indices buf */
+       H2D_DMA_INDX_RD_UPD, /* update H2D RD index in H2D RD dma indices buf */
+       D2H_DMA_INDX_WR_UPD, /* update D2H WR index in D2H WR dma indices buf */
+       D2H_DMA_INDX_RD_UPD, /* update D2H RD index in D2H RD dma indices buf */
+
+       /* DHD Indices array buffers and update for: H2D flow ring WR */
+       H2D_IFRM_INDX_WR_BUF, /* update H2D WR dma indices buf base addr to dongle */
+       H2D_IFRM_INDX_WR_UPD, /* update H2D WR dma indices buf base addr to dongle */
+
+       /* H2D and D2H Mailbox data update */
+       H2D_MB_DATA,
+       D2H_MB_DATA,
+
+       /* (Common) MsgBuf Ring configuration update */
+       RING_BUF_ADDR,       /* update ring base address to dongle */
+       RING_ITEM_LEN,       /* update ring item size to dongle */
+       RING_MAX_ITEMS,      /* update ring max items to dongle */
+
+       /* Update of WR or RD index, for a MsgBuf Ring */
+       RING_RD_UPD,         /* update ring read index from/to dongle */
+       RING_WR_UPD,         /* update ring write index from/to dongle */
+
+       TOTAL_LFRAG_PACKET_CNT,
+       MAX_HOST_RXBUFS,
+       HOST_API_VERSION,
+       DNGL_TO_HOST_TRAP_ADDR,
+       HOST_SCB_ADDR,          /* update host scb base address to dongle */
+};
+
+typedef void (*dhd_mb_ring_t) (struct dhd_bus *, uint32);
+typedef void (*dhd_mb_ring_2_t) (struct dhd_bus *, uint32, bool);
+extern void dhd_bus_cmn_writeshared(struct dhd_bus *bus, void * data, uint32 len, uint8 type,
+       uint16 ringid);
+extern void dhd_bus_ringbell(struct dhd_bus *bus, uint32 value);
+extern void dhd_bus_ringbell_2(struct dhd_bus *bus, uint32 value, bool devwake);
+extern void dhd_bus_cmn_readshared(struct dhd_bus *bus, void* data, uint8 type, uint16 ringid);
+extern uint32 dhd_bus_get_sharedflags(struct dhd_bus *bus);
+extern void dhd_bus_rx_frame(struct dhd_bus *bus, void* pkt, int ifidx, uint pkt_count);
+extern void dhd_bus_start_queue(struct dhd_bus *bus);
+extern void dhd_bus_stop_queue(struct dhd_bus *bus);
+extern dhd_mb_ring_t dhd_bus_get_mbintr_fn(struct dhd_bus *bus);
+extern dhd_mb_ring_2_t dhd_bus_get_mbintr_2_fn(struct dhd_bus *bus);
+extern void dhd_bus_write_flow_ring_states(struct dhd_bus *bus,
+       void * data, uint16 flowid);
+extern void dhd_bus_read_flow_ring_states(struct dhd_bus *bus,
+       void * data, uint8 flowid);
+extern int dhd_bus_flow_ring_create_request(struct dhd_bus *bus, void *flow_ring_node);
+extern void dhd_bus_clean_flow_ring(struct dhd_bus *bus, void *flow_ring_node);
+extern void dhd_bus_flow_ring_create_response(struct dhd_bus *bus, uint16 flow_id, int32 status);
+extern int dhd_bus_flow_ring_delete_request(struct dhd_bus *bus, void *flow_ring_node);
+extern void dhd_bus_flow_ring_delete_response(struct dhd_bus *bus, uint16 flowid, uint32 status);
+extern int dhd_bus_flow_ring_flush_request(struct dhd_bus *bus, void *flow_ring_node);
+extern void dhd_bus_flow_ring_flush_response(struct dhd_bus *bus, uint16 flowid, uint32 status);
+extern uint32 dhd_bus_max_h2d_queues(struct dhd_bus *bus);
+extern int dhd_bus_schedule_queue(struct dhd_bus *bus, uint16 flow_id, bool txs);
+
+#ifdef IDLE_TX_FLOW_MGMT
+extern void dhd_bus_flow_ring_resume_response(struct dhd_bus *bus, uint16 flowid, int32 status);
+#endif /* IDLE_TX_FLOW_MGMT */
+
+extern int dhdpcie_bus_start_host_dev(struct dhd_bus *bus);
+extern int dhdpcie_bus_stop_host_dev(struct dhd_bus *bus);
+extern int dhdpcie_bus_enable_device(struct dhd_bus *bus);
+extern int dhdpcie_bus_disable_device(struct dhd_bus *bus);
+extern int dhdpcie_bus_alloc_resource(struct dhd_bus *bus);
+extern void dhdpcie_bus_free_resource(struct dhd_bus *bus);
+extern bool dhdpcie_bus_dongle_attach(struct dhd_bus *bus);
+extern int dhd_bus_release_dongle(struct dhd_bus *bus);
+extern int dhd_bus_request_irq(struct dhd_bus *bus);
+extern int dhdpcie_get_pcieirq(struct dhd_bus *bus, unsigned int *irq);
+extern void dhd_bus_aer_config(struct dhd_bus *bus);
+
+extern struct device * dhd_bus_to_dev(struct dhd_bus *bus);
+
+extern int dhdpcie_cto_init(struct dhd_bus *bus, bool enable);
+extern int dhdpcie_cto_cfg_init(struct dhd_bus *bus, bool enable);
+
+extern void dhdpcie_ssreset_dis_enum_rst(struct dhd_bus *bus);
+
+#ifdef DHD_FW_COREDUMP
+extern int dhd_dongle_mem_dump(void);
+#endif /* DHD_FW_COREDUMP */
+
+#ifdef IDLE_TX_FLOW_MGMT
+extern void dhd_bus_idle_tx_ring_suspend(dhd_pub_t *dhd, uint16 flow_ring_id);
+#endif /* IDLE_TX_FLOW_MGMT */
+extern void dhd_bus_handle_mb_data(struct dhd_bus *bus, uint32 d2h_mb_data);
+#endif /* BCMPCIE */
+
+/* dump the device trap informtation  */
+extern void dhd_bus_dump_trap_info(struct dhd_bus *bus, struct bcmstrbuf *b);
+extern void dhd_bus_copy_trap_sig(struct dhd_bus *bus,  trap_t *tr);
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+extern void dhd_dump_pcie_rc_regs_for_linkdown(dhd_pub_t *dhd, int *bytes_written);
+void copy_hang_info_linkdown(dhd_pub_t *dhd);
+void copy_ext_trap_sig(dhd_pub_t *dhd, trap_t *tr);
+void copy_hang_info_trap(dhd_pub_t *dhd);
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+
+/* Function to set default min res mask */
+extern bool dhd_bus_set_default_min_res_mask(struct dhd_bus *bus);
+
+/* Function to reset PMU registers */
+extern void dhd_bus_pmu_reg_reset(dhd_pub_t *dhdp);
+
+extern void dhd_bus_ucode_download(struct dhd_bus *bus);
+
+extern int dhd_bus_readwrite_bp_addr(dhd_pub_t *dhdp, uint addr, uint size, uint* data, bool read);
+extern int dhd_get_idletime(dhd_pub_t *dhd);
+extern bool dhd_get_rpm_state(dhd_pub_t *dhd);
+extern void dhd_set_rpm_state(dhd_pub_t *dhd, bool state);
+#ifdef BCMPCIE
+extern void dhd_bus_dump_console_buffer(struct dhd_bus *bus);
+extern void dhd_bus_intr_count_dump(dhd_pub_t *dhdp);
+extern bool dhd_bus_query_dpc_sched_errors(dhd_pub_t *dhdp);
+extern int dhd_bus_dmaxfer_lpbk(dhd_pub_t *dhdp, uint32 type);
+extern bool dhd_bus_check_driver_up(void);
+extern int dhd_bus_get_cto(dhd_pub_t *dhdp);
+extern void dhd_bus_set_linkdown(dhd_pub_t *dhdp, bool val);
+extern int dhd_bus_get_linkdown(dhd_pub_t *dhdp);
+#else
+#define dhd_bus_dump_console_buffer(x)
+static INLINE void dhd_bus_intr_count_dump(dhd_pub_t *dhdp) { UNUSED_PARAMETER(dhdp); }
+static INLINE bool dhd_bus_query_dpc_sched_errors(dhd_pub_t *dhdp) { return 0; }
+static INLINE int dhd_bus_dmaxfer_lpbk(dhd_pub_t *dhdp, uint32 type) { return 0; }
+static INLINE bool dhd_bus_check_driver_up(void) { return FALSE; }
+extern INLINE void dhd_bus_set_linkdown(dhd_pub_t *dhdp, bool val) { }
+extern INLINE int dhd_bus_get_linkdown(dhd_pub_t *dhdp) { return 0; }
+static INLINE int dhd_bus_get_cto(dhd_pub_t *dhdp) { return 0; }
+#endif /* BCMPCIE */
+
+#if defined(BCMPCIE) && defined(EWP_ETD_PRSRV_LOGS)
+void dhdpcie_get_etd_preserve_logs(dhd_pub_t *dhd, uint8 *ext_trap_data,
+               void *event_decode_data);
+#endif
+
+extern uint16 dhd_get_chipid(struct dhd_bus *bus);
+
+#ifdef DHD_WAKE_STATUS
+extern wake_counts_t* dhd_bus_get_wakecount(dhd_pub_t *dhd);
+extern int dhd_bus_get_bus_wake(dhd_pub_t * dhd);
+#endif /* DHD_WAKE_STATUS */
+
+#ifdef BT_OVER_SDIO
+/*
+ * SDIO layer clock control functions exposed to be called from other layers.
+ * This is required especially in the case where the BUS is shared between
+ * BT and SDIO and we have to control the clock. The callers of this function
+ * are expected to hold the sdlock
+ */
+int __dhdsdio_clk_enable(struct dhd_bus *bus, bus_owner_t owner, int can_wait);
+int __dhdsdio_clk_disable(struct dhd_bus *bus, bus_owner_t owner, int can_wait);
+void dhdsdio_reset_bt_use_count(struct dhd_bus *bus);
+#endif /* BT_OVER_SDIO */
+
+int dhd_bus_perform_flr(struct dhd_bus *bus, bool force_fail);
+extern bool dhd_bus_get_flr_force_fail(struct dhd_bus *bus);
+
+extern bool dhd_bus_aspm_enable_rc_ep(struct dhd_bus *bus, bool enable);
+extern void dhd_bus_l1ss_enable_rc_ep(struct dhd_bus *bus, bool enable);
+
+bool dhd_bus_is_multibp_capable(struct dhd_bus *bus);
+
+#ifdef BCMPCIE
+extern void dhdpcie_advertise_bus_cleanup(dhd_pub_t  *dhdp);
+extern void dhd_msgbuf_iovar_timeout_dump(dhd_pub_t *dhd);
+#endif /* BCMPCIE */
+
+extern bool dhd_bus_force_bt_quiesce_enabled(struct dhd_bus *bus);
+extern void dhd_bwm_bt_quiesce(struct dhd_bus *bus);
+extern void dhd_bwm_bt_resume(struct dhd_bus *bus);
+
+#ifdef DHD_SSSR_DUMP
+extern int dhd_bus_fis_trigger(dhd_pub_t *dhd);
+extern int dhd_bus_fis_dump(dhd_pub_t *dhd);
+#endif /* DHD_SSSR_DUMP */
+
+#ifdef PCIE_FULL_DONGLE
+extern int dhdpcie_set_dma_ring_indices(dhd_pub_t *dhd, int32 int_val);
+#endif /* PCIE_FULL_DONGLE */
+
+#ifdef DHD_CFG80211_SUSPEND_RESUME
+extern void dhd_cfg80211_suspend(dhd_pub_t *dhdp);
+extern void dhd_cfg80211_resume(dhd_pub_t *dhdp);
+#endif /* DHD_CFG80211_SUSPEND_RESUME */
+
+#ifdef DHD_SDTC_ETB_DUMP
+extern int dhd_bus_get_etb_info(dhd_pub_t *dhd, uint32 etb_info_addr, etb_info_t *etb_info);
+extern int dhd_bus_get_sdtc_etb(dhd_pub_t *dhd, uint8 *sdtc_etb_mempool,
+       uint addr, uint read_bytes);
+#endif /* DHD_SDTC_ETB_DUMP */
+
+#endif /* _dhd_bus_h_ */
diff --git a/bcmdhd.101.10.240.x/dhd_ccode.c b/bcmdhd.101.10.240.x/dhd_ccode.c
new file mode 100644 (file)
index 0000000..78296d7
--- /dev/null
@@ -0,0 +1,262 @@
+\r
+#ifdef CCODE_LIST\r
+#ifdef CONFIG_COMPAT\r
+#include <linux/compat.h>\r
+#endif /* COMFIG_COMPAT */\r
+#include <typedefs.h>\r
+#include <dhd_config.h>\r
+\r
+#ifdef BCMSDIO\r
+#define CCODE_43438\r
+#define CCODE_43436\r
+#define CCODE_43455C0\r
+#define CCODE_43456C5\r
+#endif\r
+#if defined(BCMSDIO) || defined(BCMPCIE)\r
+#define CCODE_4356A2\r
+#define CCODE_4359C0\r
+#endif\r
+#ifdef BCMDBUS\r
+#define CCODE_4358U\r
+#endif\r
+\r
+#ifdef BCMSDIO\r
+#ifdef CCODE_43438\r
+const char ccode_43438[] = "RU/13";\r
+#else\r
+const char ccode_43438[] = "";\r
+#endif\r
+\r
+#ifdef CCODE_43436\r
+const char ccode_43436[] = \\r
+"AE/1 AR/1 AT/1 AU/2 "\\r
+"BE/1 BG/1 BN/1 "\\r
+"CA/2 CH/1 CN/38 CY/1 CZ/1 "\\r
+"DE/3 DK/1 "\\r
+"EE/1 ES/1 "\\r
+"FI/1 FR/1 "\\r
+"GB/1 GR/1 "\\r
+"HR/1 HU/1 "\\r
+"ID/5 IE/1 IS/1 IT/1 "\\r
+"JP/3 "\\r
+"KR/4 KW/1 "\\r
+"LI/1 LT/1 LU/1 LV/1 "\\r
+"MA/1 MT/1 MX/1 "\\r
+"NL/1 NO/1 "\\r
+"PL/1 PT/1 PY/1 "\\r
+"RO/1 RU/5 "\\r
+"SE/1 SI/1 SK/1 "\\r
+"TR/7 TW/2 "\\r
+"US/26 "\\r
+"XZ/11";\r
+#else\r
+const char ccode_43436[] = "";\r
+#endif\r
+\r
+#ifdef CCODE_43455C0\r
+const char ccode_43455c0[] = \\r
+"AE/6 AG/2 AI/1 AL/2 AS/12 AT/4 AU/6 AW/2 AZ/2 "\\r
+"BA/2 BD/1 BE/4 BG/4 BH/4 BM/12 BN/4 BR/2 BS/2 BY/3 "\\r
+"CA/2 CH/4 CN/38 CO/17 CR/17 CY/4 CZ/4 "\\r
+"DE/7 DK/4 "\\r
+"EC/21 EE/4 EG/13 ES/4 ET/2 "\\r
+"FI/4 FR/5 "\\r
+"GB/6 GD/2 GF/2 GP/2 GR/4 GT/1 GU/30 "\\r
+"HK/2 HR/4 HU/4 "\\r
+"ID/1 IE/5 IL/14 IN/3 IS/4 IT/4 "\\r
+"JO/3 JP/58 "\\r
+"KH/2 KR/96 KW/5 KY/3 "\\r
+"LA/2 LB/5 LI/4 LK/1 LS/2 LT/4 LU/3 LV/4 "\\r
+"MA/2 MC/1 MD/2 ME/2 MK/2 MN/1 MQ/2 MR/2 MT/4 MU/2 MV/3 MW/1 MX/44 MY/3 "\\r
+"NI/2 NL/4 NO/4 NZ/4 "\\r
+"OM/4 "\\r
+"PA/17 PE/20 PH/5 PL/4 PR/38 PT/4 PY/2 "\\r
+"Q2/993 "\\r
+"RE/2 RO/4 RS/2 RU/13 "\\r
+"SE/4 SI/4 SK/4 SV/25 "\\r
+"TH/5 TN/1 TR/7 TT/3 TW/65 "\\r
+"UA/8 US/988 "\\r
+"VA/2 VE/3 VG/2 VN/4 "\\r
+"XZ/11 "\\r
+"YT/2 "\\r
+"ZA/6";\r
+#else\r
+const char ccode_43455c0[] = "";\r
+#endif\r
+\r
+#ifdef CCODE_43456C5\r
+const char ccode_43456c5[] = \\r
+"AE/6 AG/2 AI/1 AL/2 AS/12 AT/4 AU/6 AW/2 AZ/2 "\\r
+"BA/2 BD/1 BE/4 BG/4 BH/4 BM/12 BN/4 BR/4 BS/2 BY/3 "\\r
+"CA/2 CH/4 CN/38 CO/17 CR/17 CY/4 CZ/4 "\\r
+"DE/7 DK/4 "\\r
+"EC/21 EE/4 EG/13 ES/4 ET/2 "\\r
+"FI/4 FR/5 "\\r
+"GB/6 GD/2 GF/2 GP/2 GR/4 GT/1 GU/30 "\\r
+"HK/2 HR/4 HU/4 "\\r
+"ID/1 IE/5 IL/14 IN/3 IS/4 IT/4 "\\r
+"JO/3 JP/58 "\\r
+"KH/2 KR/96 KW/5 KY/3 "\\r
+"LA/2 LB/5 LI/4 LK/1 LS/2 LT/4 LU/3 LV/4 "\\r
+"MA/2 MC/1 MD/2 ME/2 MK/2 MN/1 MQ/2 MR/2 MT/4 MU/2 MV/3 MW/1 MX/44 MY/3 "\\r
+"NI/2 NL/4 NO/4 NZ/4 "\\r
+"OM/4 "\\r
+"PA/17 PE/20 PH/5 PL/4 PR/38 PT/4 PY/2 "\\r
+"Q2/993 "\\r
+"RE/2 RO/4 RS/2 RU/13 "\\r
+"SE/4 SI/4 SK/4 SV/25 "\\r
+"TH/5 TN/1 TR/7 TT/3 TW/65 "\\r
+"UA/8 US/988 "\\r
+"VA/2 VE/3 VG/2 VN/4 "\\r
+"XZ/11 "\\r
+"YT/2 "\\r
+"ZA/6";\r
+#else\r
+const char ccode_43456c5[] = "";\r
+#endif\r
+#endif\r
+\r
+#ifdef CCODE_4356A2\r
+const char ccode_4356a2[] = \\r
+"AE/6 AG/2 AI/1 AL/2 AN/2 AR/21 AS/12 AT/4 AU/6 AW/2 AZ/2 "\\r
+"BA/2 BD/2 BE/4 BG/4 BH/4 BM/12 BN/4 BR/4 BS/2 BY/3 "\\r
+"CA/31 CH/4 CN/38 CO/17 CR/17 CY/4 CZ/4 "\\r
+"DE/7 DK/4 DZ/1 "\\r
+"EC/21 EE/4 ES/4 ET/2 "\\r
+"FI/4 FR/5 "\\r
+"GB/6 GD/2 GF/2 GP/2 GR/4 GT/1 GU/12 "\\r
+"HK/2 HR/4 HU/4 "\\r
+"ID/13 IE/5 IL/7 IN/28 IS/4 IT/4 "\\r
+"JO/3 JP/58 "\\r
+"KH/2 KR/57 KW/5 KY/3 "\\r
+"LA/2 LB/5 LI/4 LK/1 LS/2 LT/4 LU/3 LV/4 "\\r
+"MA/2 MC/1 MD/2 ME/2 MK/2 MN/1 MO/2 MR/2 MT/4 MQ/2 MU/2 MV/3 MW/1 MX/20 MY/16 "\\r
+"NI/2 NL/4 NO/4 NP/3 NZ/4 "\\r
+"OM/4 "\\r
+"PA/17 PE/20 PG/2 PH/5 PL/4 PR/20 PT/4 PY/2 "\\r
+"RE/2 RO/4 RS/2 RU/986 "\\r
+"SE/4 SG/19 SI/4 SK/4 SN/2 SV/19 "\\r
+"TH/9 TN/1 TR/7 TT/3 TW/1 "\\r
+"UA/8 UG/2 US/1 UY/1 "\\r
+"VA/2 VE/3 VG/2 VI/13 VN/4 "\\r
+"XZ/11 "\\r
+"YT/2 "\\r
+"ZM/2 "\\r
+"E0/32";\r
+#else\r
+const char ccode_4356a2[] = "";\r
+#endif\r
+\r
+#ifdef CCODE_4359C0\r
+const char ccode_4359c0[] = \\r
+"AD/1 AE/6 AG/2 AI/1 AL/3 AS/12 AT/21 AU/6 AW/2 AZ/8 "\\r
+"BA/4 BD/1 BE/19 BG/18 BH/4 BM/12 BN/4 BR/2 BS/2 BY/3 "\\r
+"CN/38 CO/17 CR/17 CY/18 CZ/18 "\\r
+"DE/30 DK/19 "\\r
+"E0/32 EC/21 EE/18 EG/13 ES/21 ET/2 "\\r
+"FI/19 FR/21 "\\r
+"GB/996 GD/2 GE/1 GF/2 GP/2 GR/18 GT/1 GU/30 "\\r
+"HK/2 HR/18 HU/18 "\\r
+"ID/1 IE/21 IL/14 IN/3 IS/17 IT/20 "\\r
+"JO/3 JP/967 "\\r
+"KH/2 KR/70 KW/5 KY/3 "\\r
+"LA/2 LB/5 LI/17 LK/1 LS/2 LT/18 LU/18 LV/18 "\\r
+"MA/2 MC/2 MD/3 ME/5 MK/4 MN/1 MQ/2 MR/2 MT/18 MU/2 MV/3 MW/1 MX/44 MY/3 "\\r
+"NI/2 NL/19 NO/18 NZ/4 "\\r
+"OM/4 "\\r
+"PA/17 PE/20 PH/5 PL/18 PR/38 PT/20 PY/2 "\\r
+"Q1/947 Q2/993 "\\r
+"RE/2 RO/18 RS/4 RU/986 "\\r
+"SE/19 SI/18 SK/18 SM/1 SV/25 "\\r
+"TH/5 TN/1 TR/18 TT/3 TW/980 "\\r
+"UA/16 US/988 "\\r
+"VA/3 VE/3 VG/2 VN/4 "\\r
+"XZ/11 "\\r
+"YT/2 "\\r
+"ZA/6";\r
+#else\r
+const char ccode_4359c0[] = "";\r
+#endif\r
+\r
+#ifdef CCODE_4358U\r
+const char ccode_4358u[] = \\r
+"BE/4 BR/4 CA/2 CH/4 CN/38 CY/4 DE/7 DK/4 ES/4 "\\r
+"FI/4 FR/5 GB/6 GR/4 HK/2 HU/4 IE/5 IL/7 IS/4 "\\r
+"IT/4 JP/72 KE/0 MY/3 NL/4 PT/4 SA/5 SE/4 SG/0 "\\r
+"SZ/0 TH/5 TR/7 TW/230 US/0 VN/4";\r
+#else\r
+const char ccode_4358u[] = "";\r
+#endif\r
+\r
+typedef struct ccode_list_map_t {\r
+       uint chip;\r
+       uint chiprev;\r
+       const char *ccode_list;\r
+       const char *ccode_ww;\r
+} ccode_list_map_t;\r
+\r
+extern const char ccode_43438[];\r
+extern const char ccode_43455c0[];\r
+extern const char ccode_43456c5[];\r
+extern const char ccode_4356a2[];\r
+extern const char ccode_4359c0[];\r
+extern const char ccode_4358u[];\r
+\r
+const ccode_list_map_t ccode_list_map[] = {\r
+       /* ChipID               Chiprev         ccode  */\r
+#ifdef BCMSDIO\r
+       {BCM43430_CHIP_ID,      0,      ccode_43438, ""},\r
+       {BCM43430_CHIP_ID,      1,      ccode_43438, ""},\r
+       {BCM43430_CHIP_ID,      2,      ccode_43436, ""},\r
+       {BCM4345_CHIP_ID,       6,      ccode_43455c0, "XZ/11"},\r
+       {BCM43454_CHIP_ID,      6,      ccode_43455c0, "XZ/11"},\r
+       {BCM4345_CHIP_ID,       9,      ccode_43456c5, "XZ/11"},\r
+       {BCM43454_CHIP_ID,      9,      ccode_43456c5, "XZ/11"},\r
+       {BCM4354_CHIP_ID,       2,      ccode_4356a2, "XZ/11"},\r
+       {BCM4356_CHIP_ID,       2,      ccode_4356a2, "XZ/11"},\r
+       {BCM4371_CHIP_ID,       2,      ccode_4356a2, "XZ/11"},\r
+       {BCM4359_CHIP_ID,       9,      ccode_4359c0, "XZ/11"},\r
+#endif\r
+#ifdef BCMPCIE\r
+       {BCM4354_CHIP_ID,       2,      ccode_4356a2, "XZ/11"},\r
+       {BCM4356_CHIP_ID,       2,      ccode_4356a2, "XZ/11"},\r
+       {BCM4359_CHIP_ID,       9,      ccode_4359c0, "XZ/11"},\r
+#endif\r
+#ifdef BCMDBUS\r
+       {BCM43569_CHIP_ID,      2,      ccode_4358u, "XW/0"},\r
+#endif\r
+};\r
+\r
+int\r
+dhd_ccode_map_country_list(dhd_pub_t *dhd, wl_country_t *cspec)\r
+{\r
+       int bcmerror = -1, i;\r
+       uint chip = dhd->conf->chip, chiprev = dhd->conf->chiprev; \r
+       const char *ccode_list = NULL, *ccode_ww = NULL;\r
+       char *pch;\r
+\r
+       for (i=0;  i<sizeof(ccode_list_map)/sizeof(ccode_list_map[0]);  i++) {\r
+               const ccode_list_map_t* row = &ccode_list_map[i];\r
+               if (row->chip == chip && row->chiprev == chiprev) {\r
+                       ccode_list = row->ccode_list;\r
+                       ccode_ww = row->ccode_ww;\r
+                       break;\r
+               }\r
+       }\r
+\r
+       if (ccode_list) {\r
+               pch = strstr(ccode_list, cspec->ccode);\r
+               if (pch) {\r
+                       cspec->rev = (int)simple_strtol(pch+strlen(cspec->ccode)+1, NULL, 0);\r
+                       bcmerror = 0;\r
+               }\r
+       }\r
+\r
+       if (bcmerror && ccode_ww && strlen(ccode_ww)>=4) {\r
+               memcpy(cspec->ccode, ccode_ww, 2);\r
+               cspec->rev = (int)simple_strtol(ccode_ww+3, NULL, 0);\r
+       }\r
+\r
+       return bcmerror;\r
+}\r
+#endif\r
diff --git a/bcmdhd.101.10.240.x/dhd_cdc.c b/bcmdhd.101.10.240.x/dhd_cdc.c
new file mode 100644 (file)
index 0000000..fd00368
--- /dev/null
@@ -0,0 +1,1019 @@
+/*
+ * DHD Protocol Module for CDC and BDC.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ *
+ * BDC is like CDC, except it includes a header for data packets to convey
+ * packet priority over the bus, and flags (e.g. to indicate checksum status
+ * for dongle offload.)
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+
+#include <bcmutils.h>
+#include <bcmcdc.h>
+#include <bcmendian.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_proto.h>
+#include <dhd_bus.h>
+#include <dhd_dbg.h>
+
+#ifdef PROP_TXSTATUS
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+#ifdef BCMDBUS
+#include <dhd_config.h>
+#endif /* BCMDBUS */
+
+#define RETRIES 2              /* # of retries to retrieve matching ioctl response */
+#define BUS_HEADER_LEN (24+DHD_SDALIGN)        /* Must be at least SDPCM_RESERVE
+                                * defined in dhd_sdio.c (amount of header tha might be added)
+                                * plus any space that might be needed for alignment padding.
+                                */
+#define ROUND_UP_MARGIN        2048    /* Biggest SDIO block size possible for
+                                * round off at the end of buffer
+                                */
+
+/* This value is from Legacy chipsets */
+#define DEFAULT_WLC_API_VERSION_MAJOR  3
+#define DEFAULT_WLC_API_VERSION_MINOR  0
+
+typedef struct dhd_prot {
+       uint16 reqid;
+       uint8 pending;
+       uint32 lastcmd;
+#ifdef BCMDBUS
+       uint ctl_completed;
+#endif /* BCMDBUS */
+       uint8 bus_header[BUS_HEADER_LEN];
+       cdc_ioctl_t msg;
+       unsigned char buf[WLC_IOCTL_MAXLEN + ROUND_UP_MARGIN];
+} dhd_prot_t;
+
+uint16
+dhd_prot_get_ioctl_trans_id(dhd_pub_t *dhdp)
+{
+       /* SDIO does not have ioctl_trans_id yet, so return -1 */
+       return -1;
+}
+
+static int
+dhdcdc_msg(dhd_pub_t *dhd)
+{
+#ifdef BCMDBUS
+       int timeout = 0;
+#endif /* BCMDBUS */
+       int err = 0;
+       dhd_prot_t *prot = dhd->prot;
+       int len = ltoh32(prot->msg.len) + sizeof(cdc_ioctl_t);
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       DHD_OS_WAKE_LOCK(dhd);
+
+       /* NOTE : cdc->msg.len holds the desired length of the buffer to be
+        *        returned. Only up to CDC_MAX_MSG_SIZE of this buffer area
+        *        is actually sent to the dongle
+        */
+       if (len > CDC_MAX_MSG_SIZE)
+               len = CDC_MAX_MSG_SIZE;
+
+       /* Send request */
+#ifdef BCMDBUS
+       DHD_OS_IOCTL_RESP_LOCK(dhd);
+       prot->ctl_completed = FALSE;
+       err = dbus_send_ctl(dhd->bus, (void *)&prot->msg, len);
+       if (err) {
+               DHD_ERROR(("dbus_send_ctl error=%d\n", err));
+               DHD_OS_IOCTL_RESP_UNLOCK(dhd);
+               DHD_OS_WAKE_UNLOCK(dhd);
+               return err;
+       }
+#else
+       err = dhd_bus_txctl(dhd->bus, (uchar*)&prot->msg, len);
+#endif /* BCMDBUS */
+
+#ifdef BCMDBUS
+       timeout = dhd_os_ioctl_resp_wait(dhd, &prot->ctl_completed);
+       if ((!timeout) || (!prot->ctl_completed)) {
+               DHD_ERROR(("Txctl timeout %d ctl_completed %d\n",
+                       timeout, prot->ctl_completed));
+               DHD_ERROR(("Txctl wait timed out\n"));
+               err = -1;
+       }
+       DHD_OS_IOCTL_RESP_UNLOCK(dhd);
+#endif /* BCMDBUS */
+#if defined(BCMDBUS) && defined(INTR_EP_ENABLE)
+       /* If the ctl write is successfully completed, wait for an acknowledgement
+       * that indicates that it is now ok to do ctl read from the dongle
+       */
+       if (err != -1) {
+               DHD_OS_IOCTL_RESP_LOCK(dhd);
+               prot->ctl_completed = FALSE;
+               if (dbus_poll_intr(dhd->dbus)) {
+                       DHD_ERROR(("dbus_poll_intr not submitted\n"));
+               } else {
+                       /* interrupt polling is sucessfully submitted. Wait for dongle to send
+                       * interrupt
+                       */
+                       timeout = dhd_os_ioctl_resp_wait(dhd, &prot->ctl_completed);
+                       if (!timeout) {
+                               DHD_ERROR(("intr poll wait timed out\n"));
+                       }
+               }
+               DHD_OS_IOCTL_RESP_UNLOCK(dhd);
+       }
+#endif /* defined(BCMDBUS) && defined(INTR_EP_ENABLE) */
+       DHD_OS_WAKE_UNLOCK(dhd);
+       return err;
+}
+
+static int
+dhdcdc_cmplt(dhd_pub_t *dhd, uint32 id, uint32 len)
+{
+#ifdef BCMDBUS
+       int timeout = 0;
+#endif /* BCMDBUS */
+       int ret;
+       int cdc_len = len + sizeof(cdc_ioctl_t);
+       dhd_prot_t *prot = dhd->prot;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       do {
+#ifdef BCMDBUS
+               DHD_OS_IOCTL_RESP_LOCK(dhd);
+               prot->ctl_completed = FALSE;
+               ret = dbus_recv_ctl(dhd->bus, (uchar*)&prot->msg, cdc_len);
+               if (ret) {
+                       DHD_ERROR(("dbus_recv_ctl error=0x%x(%d)\n", ret, ret));
+                       DHD_OS_IOCTL_RESP_UNLOCK(dhd);
+                       goto done;
+               }
+               timeout = dhd_os_ioctl_resp_wait(dhd, &prot->ctl_completed);
+               if ((!timeout) || (!prot->ctl_completed)) {
+                       DHD_ERROR(("Rxctl timeout %d ctl_completed %d\n",
+                               timeout, prot->ctl_completed));
+                       ret = -1;
+                       DHD_OS_IOCTL_RESP_UNLOCK(dhd);
+
+                       goto done;
+               }
+               DHD_OS_IOCTL_RESP_UNLOCK(dhd);
+
+               ret = cdc_len;
+#else
+               ret = dhd_bus_rxctl(dhd->bus, (uchar*)&prot->msg, cdc_len);
+#endif /* BCMDBUS */
+               if (ret < 0)
+                       break;
+       } while (CDC_IOC_ID(ltoh32(prot->msg.flags)) != id);
+
+       /* update ret to len on success */
+       if (ret == cdc_len) {
+               ret = len;
+       }
+
+#ifdef BCMDBUS
+done:
+#endif /* BCMDBUS */
+       return ret;
+}
+
+/* XXX: due to overlays this should not be called directly; call dhd_wl_ioctl_cmd() instead */
+static int
+dhdcdc_query_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len, uint8 action)
+{
+       dhd_prot_t *prot = dhd->prot;
+       cdc_ioctl_t *msg = &prot->msg;
+       int ret = 0, retries = 0;
+       uint32 id, flags = 0;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+       DHD_CTL(("%s: cmd %d len %d\n", __FUNCTION__, cmd, len));
+
+       /* Respond "bcmerror" and "bcmerrorstr" with local cache */
+       if (cmd == WLC_GET_VAR && buf)
+       {
+               if (!strcmp((char *)buf, "bcmerrorstr"))
+               {
+                       strlcpy((char *)buf, bcmerrorstr(dhd->dongle_error), len);
+                       goto done;
+               }
+               else if (!strcmp((char *)buf, "bcmerror"))
+               {
+                       *(int *)buf = dhd->dongle_error;
+                       goto done;
+               }
+       }
+
+       memset(msg, 0, sizeof(cdc_ioctl_t));
+
+#ifdef BCMSPI
+       /* 11bit gSPI bus allows 2048bytes of max-data.  We restrict 'len'
+        * value which is 8Kbytes for various 'get' commands to 2000.  48 bytes are
+        * left for sw headers and misc.
+        */
+       if (len > 2000) {
+               DHD_ERROR(("dhdcdc_query_ioctl: len is truncated to 2000 bytes\n"));
+               len = 2000;
+       }
+#endif /* BCMSPI */
+       msg->cmd = htol32(cmd);
+       msg->len = htol32(len);
+       msg->flags = (++prot->reqid << CDCF_IOC_ID_SHIFT);
+       CDC_SET_IF_IDX(msg, ifidx);
+       /* add additional action bits */
+       action &= WL_IOCTL_ACTION_MASK;
+       msg->flags |= (action << CDCF_IOC_ACTION_SHIFT);
+       msg->flags = htol32(msg->flags);
+
+       if (buf)
+               memcpy(prot->buf, buf, len);
+
+       if ((ret = dhdcdc_msg(dhd)) < 0) {
+               if (!dhd->hang_was_sent)
+               DHD_ERROR(("dhdcdc_query_ioctl: dhdcdc_msg failed w/status %d\n", ret));
+               goto done;
+       }
+
+retry:
+       /* wait for interrupt and get first fragment */
+       if ((ret = dhdcdc_cmplt(dhd, prot->reqid, len)) < 0)
+               goto done;
+
+       flags = ltoh32(msg->flags);
+       id = (flags & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT;
+
+       if ((id < prot->reqid) && (++retries < RETRIES))
+               goto retry;
+       if (id != prot->reqid) {
+               DHD_ERROR(("%s: %s: unexpected request id %d (expected %d)\n",
+                          dhd_ifname(dhd, ifidx), __FUNCTION__, id, prot->reqid));
+               ret = -EINVAL;
+               goto done;
+       }
+
+       /* Copy info buffer */
+       if (buf)
+       {
+               if (ret < (int)len)
+                       len = ret;
+               memcpy(buf, (void*) prot->buf, len);
+       }
+
+       /* Check the ERROR flag */
+       if (flags & CDCF_IOC_ERROR)
+       {
+               ret = ltoh32(msg->status);
+               /* Cache error from dongle */
+               dhd->dongle_error = ret;
+       }
+
+done:
+       return ret;
+}
+
+#ifdef DHD_PM_CONTROL_FROM_FILE
+extern bool g_pm_control;
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+
+/* XXX: due to overlays this should not be called directly; call dhd_wl_ioctl_cmd() instead */
+static int
+dhdcdc_set_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len, uint8 action)
+{
+       dhd_prot_t *prot = dhd->prot;
+       cdc_ioctl_t *msg = &prot->msg;
+       int ret = 0;
+       uint32 flags, id;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+       DHD_CTL(("%s: cmd %d len %d\n", __FUNCTION__, cmd, len));
+
+       if (dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+               return -EIO;
+       }
+
+       /* don't talk to the dongle if fw is about to be reloaded */
+       if (dhd->hang_was_sent) {
+               DHD_ERROR(("%s: HANG was sent up earlier. Not talking to the chip\n",
+                       __FUNCTION__));
+               return -EIO;
+       }
+
+       if (cmd == WLC_SET_PM) {
+#ifdef DHD_PM_CONTROL_FROM_FILE
+               if (g_pm_control == TRUE) {
+                       DHD_ERROR(("%s: SET PM ignored!(Requested:%d)\n",
+                               __FUNCTION__, buf ? *(char *)buf : 0));
+                       goto done;
+               }
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+#ifdef DHD_PM_OVERRIDE
+               {
+                       extern bool g_pm_override;
+                       if (g_pm_override == TRUE) {
+                               DHD_ERROR(("%s: PM override SET PM ignored!(Requested:%d)\n",
+                                       __FUNCTION__, buf ? *(char *)buf : 0));
+                               goto done;
+                       }
+               }
+#endif /* DHD_PM_OVERRIDE */
+#if defined(WLAIBSS)
+               if (dhd->op_mode == DHD_FLAG_IBSS_MODE) {
+                       DHD_ERROR(("%s: SET PM ignored for IBSS!(Requested:%d)\n",
+                               __FUNCTION__, buf ? *(char *)buf : 0));
+                       goto done;
+               }
+#endif /* WLAIBSS */
+               DHD_TRACE_HW4(("%s: SET PM to %d\n", __FUNCTION__, buf ? *(char *)buf : 0));
+       }
+
+       memset(msg, 0, sizeof(cdc_ioctl_t));
+
+       msg->cmd = htol32(cmd);
+       msg->len = htol32(len);
+       msg->flags = (++prot->reqid << CDCF_IOC_ID_SHIFT);
+       CDC_SET_IF_IDX(msg, ifidx);
+       /* add additional action bits */
+       action &= WL_IOCTL_ACTION_MASK;
+       msg->flags |= (action << CDCF_IOC_ACTION_SHIFT) | CDCF_IOC_SET;
+       msg->flags = htol32(msg->flags);
+
+       if (buf)
+               memcpy(prot->buf, buf, len);
+
+       if ((ret = dhdcdc_msg(dhd)) < 0) {
+               DHD_ERROR(("%s: dhdcdc_msg failed w/status %d\n", __FUNCTION__, ret));
+               goto done;
+       }
+
+       if ((ret = dhdcdc_cmplt(dhd, prot->reqid, len)) < 0)
+               goto done;
+
+       flags = ltoh32(msg->flags);
+       id = (flags & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT;
+
+       if (id != prot->reqid) {
+               DHD_ERROR(("%s: %s: unexpected request id %d (expected %d)\n",
+                          dhd_ifname(dhd, ifidx), __FUNCTION__, id, prot->reqid));
+               ret = -EINVAL;
+               goto done;
+       }
+
+       /* Copy fw response to buf */
+       if (buf) {
+               ASSERT(ret == len);
+               memcpy(buf, (void*) prot->buf, len);
+       }
+
+       /* Check the ERROR flag */
+       if (flags & CDCF_IOC_ERROR)
+       {
+               ret = ltoh32(msg->status);
+               /* Cache error from dongle */
+               dhd->dongle_error = ret;
+       }
+
+done:
+       return ret;
+}
+
+#ifdef BCMDBUS
+int
+dhd_prot_ctl_complete(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot;
+
+       if (dhd == NULL)
+               return BCME_ERROR;
+
+       prot = dhd->prot;
+
+       ASSERT(prot);
+       DHD_OS_IOCTL_RESP_LOCK(dhd);
+       prot->ctl_completed = TRUE;
+       dhd_os_ioctl_resp_wake(dhd);
+       DHD_OS_IOCTL_RESP_UNLOCK(dhd);
+       return 0;
+}
+#endif /* BCMDBUS */
+
+/* XXX: due to overlays this should not be called directly; call dhd_wl_ioctl() instead */
+int
+dhd_prot_ioctl(dhd_pub_t *dhd, int ifidx, wl_ioctl_t * ioc, void * buf, int len)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int ret = -1;
+       uint8 action;
+       static int error_cnt = 0;
+
+       if ((dhd->busstate == DHD_BUS_DOWN) || dhd->hang_was_sent) {
+               DHD_ERROR(("%s : bus is down. we have nothing to do - bs: %d, has: %d\n",
+                               __FUNCTION__, dhd->busstate, dhd->hang_was_sent));
+               goto done;
+       }
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       ASSERT(len <= WLC_IOCTL_MAXLEN);
+
+       if (len > WLC_IOCTL_MAXLEN)
+               goto done;
+
+       if (prot->pending == TRUE) {
+               DHD_ERROR(("CDC packet is pending!!!! cmd=0x%x (%lu) lastcmd=0x%x (%lu)\n",
+                       ioc->cmd, (unsigned long)ioc->cmd, prot->lastcmd,
+                       (unsigned long)prot->lastcmd));
+               if ((ioc->cmd == WLC_SET_VAR) || (ioc->cmd == WLC_GET_VAR)) {
+                       DHD_TRACE(("iovar cmd=%s\n", buf ? (char*)buf : "\0"));
+               }
+               goto done;
+       }
+
+       prot->pending = TRUE;
+       prot->lastcmd = ioc->cmd;
+       action = ioc->set;
+       if (action & WL_IOCTL_ACTION_SET)
+               ret = dhdcdc_set_ioctl(dhd, ifidx, ioc->cmd, buf, len, action);
+       else {
+               ret = dhdcdc_query_ioctl(dhd, ifidx, ioc->cmd, buf, len, action);
+               if (ret > 0)
+                       ioc->used = ret - sizeof(cdc_ioctl_t);
+       }
+       // terence 20130805: send hang event to wpa_supplicant
+       if (ret == -EIO) {
+               error_cnt++;
+               if (error_cnt > 2)
+                       ret = -ETIMEDOUT;
+       } else
+               error_cnt = 0;
+
+       /* Too many programs assume ioctl() returns 0 on success */
+       if (ret >= 0)
+               ret = 0;
+       else {
+               cdc_ioctl_t *msg = &prot->msg;
+               ioc->needed = ltoh32(msg->len); /* len == needed when set/query fails from dongle */
+       }
+
+       /* Intercept the wme_dp ioctl here */
+       if ((!ret) && (ioc->cmd == WLC_SET_VAR) && (!strcmp(buf, "wme_dp"))) {
+               int slen, val = 0;
+
+               slen = strlen("wme_dp") + 1;
+               if (len >= (int)(slen + sizeof(int)))
+                       bcopy(((char *)buf + slen), &val, sizeof(int));
+               dhd->wme_dp = (uint8) ltoh32(val);
+       }
+
+       prot->pending = FALSE;
+
+done:
+
+       return ret;
+}
+
+int
+dhd_prot_iovar_op(dhd_pub_t *dhdp, const char *name,
+                  void *params, int plen, void *arg, int len, bool set)
+{
+       return BCME_UNSUPPORTED;
+}
+
+void
+dhd_prot_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+       if (!dhdp || !dhdp->prot) {
+               return;
+       }
+
+       bcm_bprintf(strbuf, "Protocol CDC: reqid %d\n", dhdp->prot->reqid);
+#ifdef PROP_TXSTATUS
+       dhd_wlfc_dump(dhdp, strbuf);
+#endif
+}
+
+/*     The FreeBSD PKTPUSH could change the packet buf pinter
+       so we need to make it changable
+*/
+#define PKTBUF pktbuf
+void
+dhd_prot_hdrpush(dhd_pub_t *dhd, int ifidx, void *PKTBUF)
+{
+#ifdef BDC
+       struct bdc_header *h;
+#endif /* BDC */
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef BDC
+       /* Push BDC header used to convey priority for buses that don't */
+
+       PKTPUSH(dhd->osh, PKTBUF, BDC_HEADER_LEN);
+
+       h = (struct bdc_header *)PKTDATA(dhd->osh, PKTBUF);
+
+       h->flags = (BDC_PROTO_VER << BDC_FLAG_VER_SHIFT);
+       if (PKTSUMNEEDED(PKTBUF))
+               h->flags |= BDC_FLAG_SUM_NEEDED;
+
+       h->priority = (PKTPRIO(PKTBUF) & BDC_PRIORITY_MASK);
+       h->flags2 = 0;
+       h->dataOffset = 0;
+#endif /* BDC */
+       BDC_SET_IF_IDX(h, ifidx);
+}
+#undef PKTBUF  /* Only defined in the above routine */
+
+uint
+dhd_prot_hdrlen(dhd_pub_t *dhd, void *PKTBUF)
+{
+       uint hdrlen = 0;
+#ifdef BDC
+       /* Length of BDC(+WLFC) headers pushed */
+       hdrlen = BDC_HEADER_LEN + (((struct bdc_header *)PKTBUF)->dataOffset * 4);
+#endif
+       return hdrlen;
+}
+
+int
+dhd_prot_hdrpull(dhd_pub_t *dhd, int *ifidx, void *pktbuf, uchar *reorder_buf_info,
+       uint *reorder_info_len)
+{
+#ifdef BDC
+       struct bdc_header *h;
+#endif
+       uint8 data_offset = 0;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef BDC
+       if (reorder_info_len)
+               *reorder_info_len = 0;
+       /* Pop BDC header used to convey priority for buses that don't */
+
+       if (PKTLEN(dhd->osh, pktbuf) < BDC_HEADER_LEN) {
+               DHD_ERROR(("%s: rx data too short (%d < %d)\n", __FUNCTION__,
+                          PKTLEN(dhd->osh, pktbuf), BDC_HEADER_LEN));
+               return BCME_ERROR;
+       }
+
+       h = (struct bdc_header *)PKTDATA(dhd->osh, pktbuf);
+
+       if (!ifidx) {
+               /* for tx packet, skip the analysis */
+               data_offset = h->dataOffset;
+               PKTPULL(dhd->osh, pktbuf, BDC_HEADER_LEN);
+               goto exit;
+       }
+
+       *ifidx = BDC_GET_IF_IDX(h);
+
+       if (((h->flags & BDC_FLAG_VER_MASK) >> BDC_FLAG_VER_SHIFT) != BDC_PROTO_VER) {
+               DHD_ERROR(("%s: non-BDC packet received, flags = 0x%x\n",
+                          dhd_ifname(dhd, *ifidx), h->flags));
+               if (((h->flags & BDC_FLAG_VER_MASK) >> BDC_FLAG_VER_SHIFT) == BDC_PROTO_VER_1)
+                       h->dataOffset = 0;
+               else
+               return BCME_ERROR;
+       }
+
+       if (h->flags & BDC_FLAG_SUM_GOOD) {
+               DHD_INFO(("%s: BDC packet received with good rx-csum, flags 0x%x\n",
+                         dhd_ifname(dhd, *ifidx), h->flags));
+               PKTSETSUMGOOD(pktbuf, TRUE);
+       }
+
+       PKTSETPRIO(pktbuf, (h->priority & BDC_PRIORITY_MASK));
+       data_offset = h->dataOffset;
+       PKTPULL(dhd->osh, pktbuf, BDC_HEADER_LEN);
+#endif /* BDC */
+
+#ifdef PROP_TXSTATUS
+       if (!DHD_PKTTAG_PKTDIR(PKTTAG(pktbuf))) {
+               /*
+               - parse txstatus only for packets that came from the firmware
+               */
+               dhd_wlfc_parse_header_info(dhd, pktbuf, (data_offset << 2),
+                       reorder_buf_info, reorder_info_len);
+
+#ifdef BCMDBUS
+#ifndef DHD_WLFC_THREAD
+               dhd_wlfc_commit_packets(dhd,
+                       (f_commitpkt_t)dhd_bus_txdata, dhd->bus, NULL, FALSE);
+#endif /* DHD_WLFC_THREAD */
+#endif /* BCMDBUS */
+       }
+#endif /* PROP_TXSTATUS */
+
+exit:
+       PKTPULL(dhd->osh, pktbuf, (data_offset << 2));
+       return 0;
+}
+
+int
+dhd_prot_attach(dhd_pub_t *dhd)
+{
+       dhd_prot_t *cdc;
+
+       if (!(cdc = (dhd_prot_t *)DHD_OS_PREALLOC(dhd, DHD_PREALLOC_PROT, sizeof(dhd_prot_t)))) {
+               DHD_ERROR(("%s: kmalloc failed\n", __FUNCTION__));
+               goto fail;
+       }
+       memset(cdc, 0, sizeof(dhd_prot_t));
+
+       /* ensure that the msg buf directly follows the cdc msg struct */
+       if ((uintptr)(&cdc->msg + 1) != (uintptr)cdc->buf) {
+               DHD_ERROR(("dhd_prot_t is not correctly defined\n"));
+               goto fail;
+       }
+
+       dhd->prot = cdc;
+#ifdef BDC
+       dhd->hdrlen += BDC_HEADER_LEN;
+#endif
+       dhd->maxctl = WLC_IOCTL_MAXLEN + sizeof(cdc_ioctl_t) + ROUND_UP_MARGIN;
+       return 0;
+
+fail:
+       if (cdc != NULL)
+               DHD_OS_PREFREE(dhd, cdc, sizeof(dhd_prot_t));
+       return BCME_NOMEM;
+}
+
+/* ~NOTE~ What if another thread is waiting on the semaphore?  Holding it? */
+void
+dhd_prot_detach(dhd_pub_t *dhd)
+{
+#ifdef PROP_TXSTATUS
+       dhd_wlfc_deinit(dhd);
+#endif
+       DHD_OS_PREFREE(dhd, dhd->prot, sizeof(dhd_prot_t));
+       dhd->prot = NULL;
+}
+
+void
+dhd_prot_dstats(dhd_pub_t *dhd)
+{
+       /*  copy bus stats */
+
+       dhd->dstats.tx_packets = dhd->tx_packets;
+       dhd->dstats.tx_errors = dhd->tx_errors;
+       dhd->dstats.rx_packets = dhd->rx_packets;
+       dhd->dstats.rx_errors = dhd->rx_errors;
+       dhd->dstats.rx_dropped = dhd->rx_dropped;
+       dhd->dstats.multicast = dhd->rx_multicast;
+       return;
+}
+
+int
+dhd_sync_with_dongle(dhd_pub_t *dhd)
+{
+       int ret = 0;
+       wlc_rev_info_t revinfo;
+       char buf[128];
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef DHD_FW_COREDUMP
+       /* Check the memdump capability */
+       dhd_get_memdump_info(dhd);
+#endif /* DHD_FW_COREDUMP */
+
+#ifdef BCMASSERT_LOG
+       dhd_get_assert_info(dhd);
+#endif /* BCMASSERT_LOG */
+
+       /* Get the device rev info */
+       memset(&revinfo, 0, sizeof(revinfo));
+       ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_REVINFO, &revinfo, sizeof(revinfo), FALSE, 0);
+       if (ret < 0)
+               goto done;
+#if defined(BCMDBUS)
+       if (dhd_download_fw_on_driverload) {
+               dhd_conf_reset(dhd);
+               dhd_conf_set_chiprev(dhd, revinfo.chipnum, revinfo.chiprev);
+               dhd_conf_preinit(dhd);
+               dhd_conf_read_config(dhd, dhd->conf_path);
+       }
+#endif /* BCMDBUS */
+
+       /* query for 'wlc_ver' to get version info from firmware */
+       /* memsetting to zero */
+       bzero(buf, sizeof(buf));
+       ret = bcm_mkiovar("wlc_ver", NULL, 0, buf, sizeof(buf));
+       if (ret == 0) {
+               ret = BCME_BUFTOOSHORT;
+               goto done;
+       }
+       ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, sizeof(buf), FALSE, 0);
+       if (ret == BCME_UNSUPPORTED) {
+               dhd->wlc_ver_major = DEFAULT_WLC_API_VERSION_MAJOR;
+               dhd->wlc_ver_minor = DEFAULT_WLC_API_VERSION_MINOR;
+       } else if (ret < 0) {
+               DHD_ERROR(("%s failed %d\n", __FUNCTION__, ret));
+               goto done;
+       } else {
+               dhd->wlc_ver_major = ((wl_wlc_version_t*)buf)->wlc_ver_major;
+               dhd->wlc_ver_minor = ((wl_wlc_version_t*)buf)->wlc_ver_minor;
+       }
+       DHD_ERROR(("wlc_ver_major %d, wlc_ver_minor %d\n", dhd->wlc_ver_major, dhd->wlc_ver_minor));
+
+       DHD_SSSR_DUMP_INIT(dhd);
+
+       dhd_process_cid_mac(dhd, TRUE);
+       ret = dhd_preinit_ioctls(dhd);
+       dhd_process_cid_mac(dhd, FALSE);
+
+       /* Always assumes wl for now */
+       dhd->iswl = TRUE;
+
+       /* XXX Could use WLC_GET_REVINFO to get driver version? */
+done:
+       return ret;
+}
+
+int dhd_prot_init(dhd_pub_t *dhd)
+{
+       return BCME_OK;
+}
+
+void
+dhd_prot_stop(dhd_pub_t *dhd)
+{
+/* Nothing to do for CDC */
+}
+
+static void
+dhd_get_hostreorder_pkts(void *osh, struct reorder_info *ptr, void **pkt,
+       uint32 *pkt_count, void **pplast, uint8 start, uint8 end)
+{
+       void *plast = NULL, *p;
+       uint32 pkt_cnt = 0;
+
+       if (ptr->pend_pkts == 0) {
+               DHD_REORDER(("%s: no packets in reorder queue \n", __FUNCTION__));
+               *pplast = NULL;
+               *pkt_count = 0;
+               *pkt = NULL;
+               return;
+       }
+       do {
+               p = (void *)(ptr->p[start]);
+               ptr->p[start] = NULL;
+
+               if (p != NULL) {
+                       if (plast == NULL)
+                               *pkt = p;
+                       else
+                               PKTSETNEXT(osh, plast, p);
+
+                       plast = p;
+                       pkt_cnt++;
+               }
+               start++;
+               if (start > ptr->max_idx)
+                       start = 0;
+       } while (start != end);
+       *pplast = plast;
+       *pkt_count = pkt_cnt;
+       ptr->pend_pkts -= (uint8)pkt_cnt;
+}
+
+int
+dhd_process_pkt_reorder_info(dhd_pub_t *dhd, uchar *reorder_info_buf, uint reorder_info_len,
+       void **pkt, uint32 *pkt_count)
+{
+       uint8 flow_id, max_idx, cur_idx, exp_idx;
+       struct reorder_info *ptr;
+       uint8 flags;
+       void *cur_pkt, *plast = NULL;
+       uint32 cnt = 0;
+
+       if (pkt == NULL) {
+               if (pkt_count != NULL)
+                       *pkt_count = 0;
+               return 0;
+       }
+
+       flow_id = reorder_info_buf[WLHOST_REORDERDATA_FLOWID_OFFSET];
+       flags = reorder_info_buf[WLHOST_REORDERDATA_FLAGS_OFFSET];
+
+       DHD_REORDER(("flow_id %d, flags 0x%02x, idx(%d, %d, %d)\n", flow_id, flags,
+               reorder_info_buf[WLHOST_REORDERDATA_CURIDX_OFFSET],
+               reorder_info_buf[WLHOST_REORDERDATA_EXPIDX_OFFSET],
+               reorder_info_buf[WLHOST_REORDERDATA_MAXIDX_OFFSET]));
+
+       /* validate flags and flow id */
+       if (flags == 0xFF) {
+               DHD_ERROR(("%s: invalid flags...so ignore this packet\n", __FUNCTION__));
+               *pkt_count = 1;
+               return 0;
+       }
+
+       cur_pkt = *pkt;
+       *pkt = NULL;
+
+       ptr = dhd->reorder_bufs[flow_id];
+       if (flags & WLHOST_REORDERDATA_DEL_FLOW) {
+               uint32 buf_size = sizeof(struct reorder_info);
+
+               DHD_REORDER(("%s: Flags indicating to delete a flow id %d\n",
+                       __FUNCTION__, flow_id));
+
+               if (ptr == NULL) {
+                       DHD_REORDER(("%s: received flags to cleanup, but no flow (%d) yet\n",
+                               __FUNCTION__, flow_id));
+                       *pkt_count = 1;
+                       *pkt = cur_pkt;
+                       return 0;
+               }
+
+               dhd_get_hostreorder_pkts(dhd->osh, ptr, pkt, &cnt, &plast,
+                       ptr->exp_idx, ptr->exp_idx);
+               /* set it to the last packet */
+               if (plast) {
+                       PKTSETNEXT(dhd->osh, plast, cur_pkt);
+                       cnt++;
+               }
+               else {
+                       if (cnt != 0) {
+                               DHD_ERROR(("%s: del flow: something fishy, pending packets %d\n",
+                                       __FUNCTION__, cnt));
+                       }
+                       *pkt = cur_pkt;
+                       cnt = 1;
+               }
+               buf_size += ((ptr->max_idx + 1) * sizeof(void *));
+               MFREE(dhd->osh, ptr, buf_size);
+               dhd->reorder_bufs[flow_id] = NULL;
+               *pkt_count = cnt;
+               return 0;
+       }
+       /* all the other cases depend on the existance of the reorder struct for that flow id */
+       if (ptr == NULL) {
+               uint32 buf_size_alloc = sizeof(reorder_info_t);
+               max_idx = reorder_info_buf[WLHOST_REORDERDATA_MAXIDX_OFFSET];
+
+               buf_size_alloc += ((max_idx + 1) * sizeof(void*));
+               /* allocate space to hold the buffers, index etc */
+
+               DHD_REORDER(("%s: alloc buffer of size %d size, reorder info id %d, maxidx %d\n",
+                       __FUNCTION__, buf_size_alloc, flow_id, max_idx));
+               ptr = (struct reorder_info *)MALLOC(dhd->osh, buf_size_alloc);
+               if (ptr == NULL) {
+                       DHD_ERROR(("%s: Malloc failed to alloc buffer\n", __FUNCTION__));
+                       *pkt_count = 1;
+                       return 0;
+               }
+               bzero(ptr, buf_size_alloc);
+               dhd->reorder_bufs[flow_id] = ptr;
+               ptr->p = (void *)(ptr+1);
+               ptr->max_idx = max_idx;
+       }
+       /* XXX: validate cur, exp indices */
+       if (flags & WLHOST_REORDERDATA_NEW_HOLE)  {
+               DHD_REORDER(("%s: new hole, so cleanup pending buffers\n", __FUNCTION__));
+               if (ptr->pend_pkts) {
+                       dhd_get_hostreorder_pkts(dhd->osh, ptr, pkt, &cnt, &plast,
+                               ptr->exp_idx, ptr->exp_idx);
+                       ptr->pend_pkts = 0;
+               }
+               ptr->cur_idx = reorder_info_buf[WLHOST_REORDERDATA_CURIDX_OFFSET];
+               ptr->exp_idx = reorder_info_buf[WLHOST_REORDERDATA_EXPIDX_OFFSET];
+               ptr->max_idx = reorder_info_buf[WLHOST_REORDERDATA_MAXIDX_OFFSET];
+               ptr->p[ptr->cur_idx] = cur_pkt;
+               ptr->pend_pkts++;
+               *pkt_count = cnt;
+       }
+       else if (flags & WLHOST_REORDERDATA_CURIDX_VALID) {
+               cur_idx = reorder_info_buf[WLHOST_REORDERDATA_CURIDX_OFFSET];
+               exp_idx = reorder_info_buf[WLHOST_REORDERDATA_EXPIDX_OFFSET];
+
+               if ((exp_idx == ptr->exp_idx) && (cur_idx != ptr->exp_idx)) {
+                       /* still in the current hole */
+                       /* enqueue the current on the buffer chain */
+                       if (ptr->p[cur_idx] != NULL) {
+                               DHD_REORDER(("%s: HOLE: ERROR buffer pending..free it\n",
+                                       __FUNCTION__));
+                               PKTFREE(dhd->osh, ptr->p[cur_idx], TRUE);
+                               ptr->p[cur_idx] = NULL;
+                       }
+                       ptr->p[cur_idx] = cur_pkt;
+                       ptr->pend_pkts++;
+                       ptr->cur_idx = cur_idx;
+                       DHD_REORDER(("%s: fill up a hole..pending packets is %d\n",
+                               __FUNCTION__, ptr->pend_pkts));
+                       *pkt_count = 0;
+                       *pkt = NULL;
+               }
+               else if (ptr->exp_idx == cur_idx) {
+                       /* got the right one ..flush from cur to exp and update exp */
+                       DHD_REORDER(("%s: got the right one now, cur_idx is %d\n",
+                               __FUNCTION__, cur_idx));
+                       if (ptr->p[cur_idx] != NULL) {
+                               DHD_REORDER(("%s: Error buffer pending..free it\n",
+                                       __FUNCTION__));
+                               PKTFREE(dhd->osh, ptr->p[cur_idx], TRUE);
+                               ptr->p[cur_idx] = NULL;
+                       }
+                       ptr->p[cur_idx] = cur_pkt;
+                       ptr->pend_pkts++;
+
+                       ptr->cur_idx = cur_idx;
+                       ptr->exp_idx = exp_idx;
+
+                       dhd_get_hostreorder_pkts(dhd->osh, ptr, pkt, &cnt, &plast,
+                               cur_idx, exp_idx);
+                       *pkt_count = cnt;
+                       DHD_REORDER(("%s: freeing up buffers %d, still pending %d\n",
+                               __FUNCTION__, cnt, ptr->pend_pkts));
+               }
+               else {
+                       uint8 end_idx;
+                       bool flush_current = FALSE;
+                       /* both cur and exp are moved now .. */
+                       DHD_REORDER(("%s:, flow %d, both moved, cur %d(%d), exp %d(%d)\n",
+                               __FUNCTION__, flow_id, ptr->cur_idx, cur_idx,
+                               ptr->exp_idx, exp_idx));
+                       if (flags & WLHOST_REORDERDATA_FLUSH_ALL)
+                               end_idx = ptr->exp_idx;
+                       else
+                               end_idx = exp_idx;
+
+                       /* flush pkts first */
+                       dhd_get_hostreorder_pkts(dhd->osh, ptr, pkt, &cnt, &plast,
+                               ptr->exp_idx, end_idx);
+
+                       if (cur_idx == ptr->max_idx) {
+                               if (exp_idx == 0)
+                                       flush_current = TRUE;
+                       } else {
+                               if (exp_idx == cur_idx + 1)
+                                       flush_current = TRUE;
+                       }
+                       if (flush_current) {
+                               if (plast)
+                                       PKTSETNEXT(dhd->osh, plast, cur_pkt);
+                               else
+                                       *pkt = cur_pkt;
+                               cnt++;
+                       }
+                       else {
+                               ptr->p[cur_idx] = cur_pkt;
+                               ptr->pend_pkts++;
+                       }
+                       ptr->exp_idx = exp_idx;
+                       ptr->cur_idx = cur_idx;
+                       *pkt_count = cnt;
+               }
+       }
+       else {
+               uint8 end_idx;
+               /* no real packet but update to exp_seq...that means explicit window move */
+               exp_idx = reorder_info_buf[WLHOST_REORDERDATA_EXPIDX_OFFSET];
+
+               DHD_REORDER(("%s: move the window, cur_idx is %d, exp is %d, new exp is %d\n",
+                       __FUNCTION__, ptr->cur_idx, ptr->exp_idx, exp_idx));
+               if (flags & WLHOST_REORDERDATA_FLUSH_ALL)
+                       end_idx =  ptr->exp_idx;
+               else
+                       end_idx =  exp_idx;
+
+               dhd_get_hostreorder_pkts(dhd->osh, ptr, pkt, &cnt, &plast, ptr->exp_idx, end_idx);
+               if (plast)
+                       PKTSETNEXT(dhd->osh, plast, cur_pkt);
+               else
+                       *pkt = cur_pkt;
+               cnt++;
+               *pkt_count = cnt;
+               /* set the new expected idx */
+               ptr->exp_idx = exp_idx;
+       }
+       return 0;
+}
diff --git a/bcmdhd.101.10.240.x/dhd_cfg80211.c b/bcmdhd.101.10.240.x/dhd_cfg80211.c
new file mode 100644 (file)
index 0000000..72a66f1
--- /dev/null
@@ -0,0 +1,297 @@
+/*
+ * Linux cfg80211 driver - Dongle Host Driver (DHD) related
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#include <linux/vmalloc.h>
+#include <net/rtnetlink.h>
+
+#include <bcmutils.h>
+#include <wldev_common.h>
+#include <wl_cfg80211.h>
+#include <dhd_cfg80211.h>
+
+#ifdef PKT_FILTER_SUPPORT
+#include <dngl_stats.h>
+#include <dhd.h>
+#endif
+
+#ifdef PKT_FILTER_SUPPORT
+extern uint dhd_pkt_filter_enable;
+extern uint dhd_master_mode;
+extern void dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode);
+#endif
+
+static int dhd_dongle_up = FALSE;
+#define PKT_FILTER_BUF_SIZE 64
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+#include <brcm_nl80211.h>
+#include <dhd_cfg80211.h>
+
+static s32 wl_dongle_up(struct net_device *ndev);
+static s32 wl_dongle_down(struct net_device *ndev);
+
+/**
+ * Function implementations
+ */
+
+s32 dhd_cfg80211_init(struct bcm_cfg80211 *cfg)
+{
+       dhd_dongle_up = FALSE;
+       return 0;
+}
+
+s32 dhd_cfg80211_deinit(struct bcm_cfg80211 *cfg)
+{
+       dhd_dongle_up = FALSE;
+       return 0;
+}
+
+s32 dhd_cfg80211_down(struct bcm_cfg80211 *cfg)
+{
+       struct net_device *ndev;
+       s32 err = 0;
+
+       WL_TRACE(("In\n"));
+       if (!dhd_dongle_up) {
+               WL_INFORM_MEM(("Dongle is already down\n"));
+               err = 0;
+               goto done;
+       }
+       ndev = bcmcfg_to_prmry_ndev(cfg);
+       wl_dongle_down(ndev);
+done:
+       return err;
+}
+
+s32 dhd_cfg80211_set_p2p_info(struct bcm_cfg80211 *cfg, int val)
+{
+       dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+       dhd->op_mode |= val;
+       WL_ERR(("Set : op_mode=0x%04x\n", dhd->op_mode));
+
+       return 0;
+}
+
+s32 dhd_cfg80211_clean_p2p_info(struct bcm_cfg80211 *cfg)
+{
+       dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+       dhd->op_mode &= ~(DHD_FLAG_P2P_GC_MODE | DHD_FLAG_P2P_GO_MODE);
+       WL_ERR(("Clean : op_mode=0x%04x\n", dhd->op_mode));
+
+       return 0;
+}
+#ifdef WL_STATIC_IF
+int32
+wl_cfg80211_update_iflist_info(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       int ifidx, uint8 *addr, int bssidx, char *name, int if_state)
+{
+               return dhd_update_iflist_info(cfg->pub, ndev, ifidx, addr, bssidx, name, if_state);
+}
+#endif /* WL_STATIC_IF */
+struct net_device* wl_cfg80211_allocate_if(struct bcm_cfg80211 *cfg, int ifidx, const char *name,
+       uint8 *mac, uint8 bssidx, const char *dngl_name)
+{
+       return dhd_allocate_if(cfg->pub, ifidx, name, mac, bssidx, FALSE, dngl_name);
+}
+
+int wl_cfg80211_register_if(struct bcm_cfg80211 *cfg,
+       int ifidx, struct net_device* ndev, bool rtnl_lock_reqd)
+{
+       return dhd_register_if(cfg->pub, ifidx, rtnl_lock_reqd);
+}
+
+int wl_cfg80211_remove_if(struct bcm_cfg80211 *cfg,
+       int ifidx, struct net_device* ndev, bool rtnl_lock_reqd)
+{
+#ifdef DHD_PCIE_RUNTIMEPM
+       dhdpcie_runtime_bus_wake(cfg->pub, CAN_SLEEP(), __builtin_return_address(0));
+#endif /* DHD_PCIE_RUNTIMEPM */
+       return dhd_remove_if(cfg->pub, ifidx, rtnl_lock_reqd);
+}
+
+void wl_cfg80211_cleanup_if(struct net_device *net)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+#ifdef DHD_PCIE_RUNTIMEPM
+       dhdpcie_runtime_bus_wake(cfg->pub, CAN_SLEEP(), __builtin_return_address(0));
+#else
+       BCM_REFERENCE(cfg);
+#endif /* DHD_PCIE_RUNTIMEPM */
+       dhd_cleanup_if(net);
+}
+
+struct net_device * dhd_cfg80211_netdev_free(struct net_device *ndev)
+{
+       struct bcm_cfg80211 *cfg;
+
+       if (ndev) {
+               cfg = wl_get_cfg(ndev);
+               if (ndev->ieee80211_ptr) {
+                       MFREE(cfg->osh, ndev->ieee80211_ptr, sizeof(struct wireless_dev));
+                       ndev->ieee80211_ptr = NULL;
+               }
+               free_netdev(ndev);
+               return NULL;
+       }
+
+       return ndev;
+}
+
+void dhd_netdev_free(struct net_device *ndev)
+{
+#ifdef WL_CFG80211
+       ndev = dhd_cfg80211_netdev_free(ndev);
+#endif
+       if (ndev)
+               free_netdev(ndev);
+}
+
+static s32
+wl_dongle_up(struct net_device *ndev)
+{
+       s32 err = 0;
+       u32 local_up = 0;
+
+       err = wldev_ioctl_set(ndev, WLC_UP, &local_up, sizeof(local_up));
+       if (unlikely(err)) {
+               WL_ERR(("WLC_UP error (%d)\n", err));
+       } else {
+               WL_INFORM_MEM(("wl up\n"));
+               dhd_dongle_up = TRUE;
+       }
+       return err;
+}
+
+static s32
+wl_dongle_down(struct net_device *ndev)
+{
+       s32 err = 0;
+       u32 local_down = 0;
+
+       err = wldev_ioctl_set(ndev, WLC_DOWN, &local_down, sizeof(local_down));
+       if (unlikely(err)) {
+               WL_ERR(("WLC_DOWN error (%d)\n", err));
+       }
+       WL_INFORM_MEM(("wl down\n"));
+       dhd_dongle_up = FALSE;
+
+       return err;
+}
+
+s32
+wl_dongle_roam(struct net_device *ndev, u32 roamvar, u32 bcn_timeout)
+{
+       s32 err = 0;
+
+       /* Setup timeout if Beacons are lost and roam is off to report link down */
+       if (roamvar) {
+               err = wldev_iovar_setint(ndev, "bcn_timeout", bcn_timeout);
+               if (unlikely(err)) {
+                       WL_ERR(("bcn_timeout error (%d)\n", err));
+                       goto dongle_rom_out;
+               }
+       }
+       /* Enable/Disable built-in roaming to allow supplicant to take care of roaming */
+       err = wldev_iovar_setint(ndev, "roam_off", roamvar);
+       if (unlikely(err)) {
+               WL_ERR(("roam_off error (%d)\n", err));
+               goto dongle_rom_out;
+       }
+dongle_rom_out:
+       return err;
+}
+
+s32 dhd_config_dongle(struct bcm_cfg80211 *cfg)
+{
+#ifndef DHD_SDALIGN
+#define DHD_SDALIGN    32
+#endif
+       struct net_device *ndev;
+       s32 err = 0;
+       dhd_pub_t *dhd = NULL;
+
+       WL_TRACE(("In\n"));
+
+       ndev = bcmcfg_to_prmry_ndev(cfg);
+       dhd = (dhd_pub_t *)(cfg->pub);
+
+       err = wl_dongle_up(ndev);
+       if (unlikely(err)) {
+               WL_ERR(("wl_dongle_up failed\n"));
+               goto default_conf_out;
+       }
+
+       if (dhd && dhd->fw_preinit) {
+               /* Init config will be done by fw preinit context */
+               return BCME_OK;
+       }
+
+default_conf_out:
+
+       return err;
+
+}
+
+int dhd_cfgvendor_priv_string_handler(struct bcm_cfg80211 *cfg, struct wireless_dev *wdev,
+       const struct bcm_nlmsg_hdr *nlioc, void *buf)
+{
+       struct net_device *ndev = NULL;
+       dhd_pub_t *dhd;
+       dhd_ioctl_t ioc = { 0, NULL, 0, 0, 0, 0, 0};
+       int ret = 0;
+       int8 index;
+
+       WL_TRACE(("entry: cmd = %d\n", nlioc->cmd));
+
+       dhd = cfg->pub;
+       DHD_OS_WAKE_LOCK(dhd);
+
+       ndev = wdev_to_wlc_ndev(wdev, cfg);
+       index = dhd_net2idx(dhd->info, ndev);
+       if (index == DHD_BAD_IF) {
+               WL_ERR(("Bad ifidx from wdev:%p\n", wdev));
+               ret = BCME_ERROR;
+               goto done;
+       }
+
+       ioc.cmd = nlioc->cmd;
+       ioc.len = nlioc->len;
+       ioc.set = nlioc->set;
+       ioc.driver = nlioc->magic;
+       ioc.buf = buf;
+       ret = dhd_ioctl_process(dhd, index, &ioc, buf);
+       if (ret) {
+               WL_TRACE(("dhd_ioctl_process return err %d\n", ret));
+               ret = OSL_ERROR(ret);
+               goto done;
+       }
+
+done:
+       DHD_OS_WAKE_UNLOCK(dhd);
+       return ret;
+}
diff --git a/bcmdhd.101.10.240.x/dhd_cfg80211.h b/bcmdhd.101.10.240.x/dhd_cfg80211.h
new file mode 100644 (file)
index 0000000..1abf42b
--- /dev/null
@@ -0,0 +1,49 @@
+/*
+ * Linux cfg80211 driver - Dongle Host Driver (DHD) related
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef __DHD_CFG80211__
+#define __DHD_CFG80211__
+
+#include <wl_cfg80211.h>
+#include <wl_cfgp2p.h>
+#include <brcm_nl80211.h>
+
+#ifndef WL_ERR
+#define WL_ERR CFG80211_ERR
+#endif
+#ifndef WL_TRACE
+#define WL_TRACE CFG80211_TRACE
+#endif
+
+s32 dhd_cfg80211_init(struct bcm_cfg80211 *cfg);
+s32 dhd_cfg80211_deinit(struct bcm_cfg80211 *cfg);
+s32 dhd_cfg80211_down(struct bcm_cfg80211 *cfg);
+s32 dhd_cfg80211_set_p2p_info(struct bcm_cfg80211 *cfg, int val);
+s32 dhd_cfg80211_clean_p2p_info(struct bcm_cfg80211 *cfg);
+s32 dhd_config_dongle(struct bcm_cfg80211 *cfg);
+int dhd_cfgvendor_priv_string_handler(struct bcm_cfg80211 *cfg,
+       struct wireless_dev *wdev, const struct bcm_nlmsg_hdr *nlioc, void  *data);
+s32 wl_dongle_roam(struct net_device *ndev, u32 roamvar, u32 bcn_timeout);
+#endif /* __DHD_CFG80211__ */
diff --git a/bcmdhd.101.10.240.x/dhd_common.c b/bcmdhd.101.10.240.x/dhd_common.c
new file mode 100644 (file)
index 0000000..b8b0663
--- /dev/null
@@ -0,0 +1,8874 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), common DHD core.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+#include <typedefs.h>
+#include <osl.h>
+
+#include <epivers.h>
+#include <bcmutils.h>
+#include <bcmstdlib_s.h>
+
+#include <bcmendian.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_ip.h>
+#include <bcmevent.h>
+#include <dhdioctl.h>
+#ifdef DHD_SDTC_ETB_DUMP
+#include <bcmiov.h>
+#endif /* DHD_SDTC_ETB_DUMP */
+
+#ifdef PCIE_FULL_DONGLE
+#include <bcmmsgbuf.h>
+#endif /* PCIE_FULL_DONGLE */
+
+#ifdef SHOW_LOGTRACE
+#include <event_log.h>
+#endif /* SHOW_LOGTRACE */
+
+#ifdef BCMPCIE
+#include <dhd_flowring.h>
+#endif
+
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <bcmsdbus.h>
+#include <dhd_dbg.h>
+#include <802.1d.h>
+#include <dhd_debug.h>
+#include <dhd_dbg_ring.h>
+#include <dhd_mschdbg.h>
+#include <msgtrace.h>
+#include <dhd_config.h>
+#include <wl_android.h>
+
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#endif
+#if defined(PNO_SUPPORT)
+#include <dhd_pno.h>
+#endif /* (OEM_ANDROID) && (PNO_SUPPORT) */
+#ifdef RTT_SUPPORT
+#include <dhd_rtt.h>
+#endif
+
+#ifdef DNGL_EVENT_SUPPORT
+#include <dnglevent.h>
+#endif
+
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+
+#ifdef PROP_TXSTATUS
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+
+#if defined(__linux__)
+#include <dhd_linux.h>
+#endif /* __linux__ */
+
+#ifdef DHD_L2_FILTER
+#include <dhd_l2_filter.h>
+#endif /* DHD_L2_FILTER */
+
+#ifdef DHD_PSTA
+#include <dhd_psta.h>
+#endif /* DHD_PSTA */
+
+#ifdef DHD_WET
+#include <dhd_wet.h>
+#endif /* DHD_WET */
+
+#ifdef DHD_LOG_DUMP
+#include <dhd_dbg.h>
+#ifdef DHD_PKT_LOGGING
+#include <dhd_pktlog.h>
+#endif
+#endif /* DHD_LOG_DUMP */
+
+#ifdef DHD_LOG_PRINT_RATE_LIMIT
+int log_print_threshold = 0;
+#endif /* DHD_LOG_PRINT_RATE_LIMIT */
+
+/* For CUSTOMER_HW4/Hikey do not enable DHD_ERROR_MEM_VAL by default */
+int dhd_msg_level = DHD_ERROR_VAL | DHD_FWLOG_VAL;
+       /* For CUSTOMER_HW4 do not enable DHD_IOVAR_MEM_VAL by default */
+
+#ifdef DHD_DEBUG
+#include <sdiovar.h>
+#endif /* DHD_DEBUG */
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+#include <linux/pm_runtime.h>
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#ifdef CSI_SUPPORT
+#include <dhd_csi.h>
+#endif /* CSI_SUPPORT */
+
+#ifdef SOFTAP
+char fw_path2[MOD_PARAM_PATHLEN];
+extern bool softap_enabled;
+#endif
+
+#ifdef SHOW_LOGTRACE
+#define BYTES_AHEAD_NUM                10      /* address in map file is before these many bytes */
+#define READ_NUM_BYTES         1000 /* read map file each time this No. of bytes */
+#define GO_BACK_FILE_POS_NUM_BYTES     100 /* set file pos back to cur pos */
+static char *ramstart_str = " text_start"; /* string in mapfile has addr ramstart */
+static char *rodata_start_str = " rodata_start"; /* string in mapfile has addr rodata start */
+static char *rodata_end_str = " rodata_end"; /* string in mapfile has addr rodata end */
+#define RAMSTART_BIT   0x01
+#define RDSTART_BIT            0x02
+#define RDEND_BIT              0x04
+#define ALL_MAP_VAL            (RAMSTART_BIT | RDSTART_BIT | RDEND_BIT)
+#endif /* SHOW_LOGTRACE */
+
+#ifdef SHOW_LOGTRACE
+/* the fw file path is taken from either the module parameter at
+ * insmod time or is defined as a constant of different values
+ * for different platforms
+ */
+extern char *st_str_file_path;
+#endif /* SHOW_LOGTRACE */
+
+#ifdef EWP_EDL
+typedef struct msg_hdr_edl {
+       uint32 infobuf_ver;
+       info_buf_payload_hdr_t pyld_hdr;
+       msgtrace_hdr_t trace_hdr;
+} msg_hdr_edl_t;
+#endif /* EWP_EDL */
+
+#define DHD_TPUT_MAX_TX_PKTS_BATCH     1000
+
+/* Last connection success/failure status */
+uint32 dhd_conn_event;
+uint32 dhd_conn_status;
+uint32 dhd_conn_reason;
+
+extern int dhd_iscan_request(void * dhdp, uint16 action);
+extern void dhd_ind_scan_confirm(void *h, bool status);
+extern int dhd_iscan_in_progress(void *h);
+void dhd_iscan_lock(void);
+void dhd_iscan_unlock(void);
+extern int dhd_change_mtu(dhd_pub_t *dhd, int new_mtu, int ifidx);
+#if !defined(AP) && defined(WLP2P)
+extern int dhd_get_concurrent_capabilites(dhd_pub_t *dhd);
+#endif
+
+extern int dhd_socram_dump(struct dhd_bus *bus);
+extern void dhd_set_packet_filter(dhd_pub_t *dhd);
+
+#ifdef DNGL_EVENT_SUPPORT
+static void dngl_host_event_process(dhd_pub_t *dhdp, bcm_dngl_event_t *event,
+       bcm_dngl_event_msg_t *dngl_event, size_t pktlen);
+static int dngl_host_event(dhd_pub_t *dhdp, void *pktdata, bcm_dngl_event_msg_t *dngl_event,
+       size_t pktlen);
+#endif /* DNGL_EVENT_SUPPORT */
+
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+static void copy_hang_info_ioctl_timeout(dhd_pub_t *dhd, int ifidx, wl_ioctl_t *ioc);
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+
+#ifdef DHD_SEND_HANG_IOCTL_SUSPEND_ERROR
+#define MAX_IOCTL_SUSPEND_ERROR        10
+static int ioctl_suspend_error = 0;
+#endif /* DHD_SEND_HANG_IOCTL_SUSPEND_ERROR */
+
+/* Should ideally read this from target(taken from wlu) */
+#define MAX_CHUNK_LEN 1408 /* 8 * 8 * 22 */
+
+/* note these variables will be used with wext */
+bool ap_cfg_running = FALSE;
+bool ap_fw_loaded = FALSE;
+
+#define CHIPID_MISMATCH        8
+
+#define DHD_VERSION "\nDongle Host Driver, version " EPI_VERSION_STR "\n"
+
+#if defined(DHD_DEBUG) && defined(DHD_COMPILED)
+const char dhd_version[] = DHD_VERSION DHD_COMPILED " compiled on "
+                       __DATE__ " at " __TIME__ "\n\0<TIMESTAMP>";
+#else
+const char dhd_version[] = DHD_VERSION;
+#endif /* DHD_DEBUG && DHD_COMPILED */
+
+char fw_version[FW_VER_STR_LEN] = "\0";
+char clm_version[CLM_VER_STR_LEN] = "\0";
+
+char bus_api_revision[BUS_API_REV_STR_LEN] = "\0";
+
+void dhd_set_timer(void *bus, uint wdtick);
+
+static char* ioctl2str(uint32 ioctl);
+
+/* IOVar table */
+enum {
+       IOV_VERSION = 1,
+       IOV_WLMSGLEVEL,
+       IOV_MSGLEVEL,
+       IOV_BCMERRORSTR,
+       IOV_BCMERROR,
+       IOV_WDTICK,
+       IOV_DUMP,
+       IOV_CLEARCOUNTS,
+       IOV_LOGDUMP,
+       IOV_LOGCAL,
+       IOV_LOGSTAMP,
+       IOV_GPIOOB,
+       IOV_IOCTLTIMEOUT,
+       IOV_CONS,
+       IOV_DCONSOLE_POLL,
+#if defined(DHD_DEBUG)
+       IOV_DHD_JOIN_TIMEOUT_DBG,
+       IOV_SCAN_TIMEOUT,
+       IOV_MEM_DEBUG,
+#ifdef BCMPCIE
+       IOV_FLOW_RING_DEBUG,
+#endif /* BCMPCIE */
+#endif /* defined(DHD_DEBUG) */
+#ifdef PROP_TXSTATUS
+       IOV_PROPTXSTATUS_ENABLE,
+       IOV_PROPTXSTATUS_MODE,
+       IOV_PROPTXSTATUS_OPT,
+       IOV_PROPTXSTATUS_MODULE_IGNORE,
+       IOV_PROPTXSTATUS_CREDIT_IGNORE,
+       IOV_PROPTXSTATUS_TXSTATUS_IGNORE,
+       IOV_PROPTXSTATUS_RXPKT_CHK,
+#endif /* PROP_TXSTATUS */
+       IOV_BUS_TYPE,
+       IOV_CHANGEMTU,
+       IOV_HOSTREORDER_FLOWS,
+#ifdef DHDTCPACK_SUPPRESS
+       IOV_TCPACK_SUPPRESS,
+#endif /* DHDTCPACK_SUPPRESS */
+       IOV_AP_ISOLATE,
+#ifdef DHD_L2_FILTER
+       IOV_DHCP_UNICAST,
+       IOV_BLOCK_PING,
+       IOV_PROXY_ARP,
+       IOV_GRAT_ARP,
+       IOV_BLOCK_TDLS,
+#endif /* DHD_L2_FILTER */
+       IOV_DHD_IE,
+#ifdef DHD_PSTA
+       IOV_PSTA,
+#endif /* DHD_PSTA */
+#ifdef DHD_WET
+       IOV_WET,
+       IOV_WET_HOST_IPV4,
+       IOV_WET_HOST_MAC,
+#endif /* DHD_WET */
+       IOV_CFG80211_OPMODE,
+       IOV_ASSERT_TYPE,
+       IOV_LMTEST,
+#ifdef DHD_MCAST_REGEN
+       IOV_MCAST_REGEN_BSS_ENABLE,
+#endif
+#ifdef SHOW_LOGTRACE
+       IOV_DUMP_TRACE_LOG,
+#endif /* SHOW_LOGTRACE */
+       IOV_DONGLE_TRAP_TYPE,
+       IOV_DONGLE_TRAP_INFO,
+       IOV_BPADDR,
+       IOV_DUMP_DONGLE, /**< dumps core registers and d11 memories */
+#if defined(DHD_LOG_DUMP)
+       IOV_LOG_DUMP,
+#endif /* DHD_LOG_DUMP */
+       IOV_TPUT_TEST,
+       IOV_DEBUG_BUF_DEST_STAT,
+#ifdef DHD_DEBUG
+       IOV_INDUCE_ERROR,
+#endif /* DHD_DEBUG */
+       IOV_FIS_TRIGGER,
+#ifdef RTT_GEOFENCE_CONT
+#if defined(RTT_SUPPORT) && defined(WL_NAN)
+       IOV_RTT_GEOFENCE_TYPE_OVRD,
+#endif /* RTT_SUPPORT && WL_NAN */
+#endif /* RTT_GEOFENCE_CONT */
+       IOV_FW_VBS,
+#ifdef DHD_TX_PROFILE
+       IOV_TX_PROFILE_TAG,
+       IOV_TX_PROFILE_ENABLE,
+       IOV_TX_PROFILE_DUMP,
+#endif /* defined(DHD_TX_PROFILE) */
+       IOV_LAST
+};
+
+const bcm_iovar_t dhd_iovars[] = {
+       /* name         varid                   flags   flags2 type     minlen */
+       {"version",     IOV_VERSION,            0,      0, IOVT_BUFFER, 0},
+       {"wlmsglevel",  IOV_WLMSGLEVEL, 0,      0,      IOVT_UINT32,    0 },
+#ifdef DHD_DEBUG
+       {"msglevel",    IOV_MSGLEVEL,           0,      0, IOVT_UINT32, 0},
+       {"mem_debug",   IOV_MEM_DEBUG,  0,      0,      IOVT_BUFFER,    0 },
+#ifdef BCMPCIE
+       {"flow_ring_debug", IOV_FLOW_RING_DEBUG, 0, 0, IOVT_BUFFER, 0 },
+#endif /* BCMPCIE */
+#endif /* DHD_DEBUG */
+       {"bcmerrorstr", IOV_BCMERRORSTR,        0,      0, IOVT_BUFFER, BCME_STRLEN},
+       {"bcmerror",    IOV_BCMERROR,           0,      0, IOVT_INT8,   0},
+       {"wdtick",      IOV_WDTICK,             0,      0, IOVT_UINT32, 0},
+       {"dump",        IOV_DUMP,               0,      0, IOVT_BUFFER, DHD_IOCTL_MAXLEN},
+       {"cons",        IOV_CONS,               0,      0, IOVT_BUFFER, 0},
+       {"dconpoll",    IOV_DCONSOLE_POLL,      0,      0, IOVT_UINT32, 0},
+       {"clearcounts", IOV_CLEARCOUNTS,        0,      0, IOVT_VOID,   0},
+       {"gpioob",      IOV_GPIOOB,             0,      0, IOVT_UINT32, 0},
+       {"ioctl_timeout", IOV_IOCTLTIMEOUT,     0,      0, IOVT_UINT32, 0},
+#ifdef PROP_TXSTATUS
+       {"proptx",      IOV_PROPTXSTATUS_ENABLE,        0,      0, IOVT_BOOL,   0 },
+       /*
+       set the proptxtstatus operation mode:
+       0 - Do not do any proptxtstatus flow control
+       1 - Use implied credit from a packet status
+       2 - Use explicit credit
+       */
+       {"ptxmode",     IOV_PROPTXSTATUS_MODE,  0,      0, IOVT_UINT32, 0 },
+       {"proptx_opt", IOV_PROPTXSTATUS_OPT,    0,      0, IOVT_UINT32, 0 },
+       {"pmodule_ignore", IOV_PROPTXSTATUS_MODULE_IGNORE, 0, 0, IOVT_BOOL, 0 },
+       {"pcredit_ignore", IOV_PROPTXSTATUS_CREDIT_IGNORE, 0, 0, IOVT_BOOL, 0 },
+       {"ptxstatus_ignore", IOV_PROPTXSTATUS_TXSTATUS_IGNORE, 0, 0,  IOVT_BOOL, 0 },
+       {"rxpkt_chk", IOV_PROPTXSTATUS_RXPKT_CHK, 0, 0, IOVT_BOOL, 0 },
+#endif /* PROP_TXSTATUS */
+       {"bustype", IOV_BUS_TYPE, 0, 0, IOVT_UINT32, 0},
+       {"changemtu", IOV_CHANGEMTU, 0, 0, IOVT_UINT32, 0 },
+       {"host_reorder_flows", IOV_HOSTREORDER_FLOWS, 0, 0, IOVT_BUFFER,
+       (WLHOST_REORDERDATA_MAXFLOWS + 1) },
+#ifdef DHDTCPACK_SUPPRESS
+       {"tcpack_suppress",     IOV_TCPACK_SUPPRESS,    0,      0, IOVT_UINT8,  0 },
+#endif /* DHDTCPACK_SUPPRESS */
+#ifdef DHD_L2_FILTER
+       {"dhcp_unicast", IOV_DHCP_UNICAST, (0), 0, IOVT_BOOL, 0 },
+#endif /* DHD_L2_FILTER */
+       {"ap_isolate", IOV_AP_ISOLATE, (0), 0, IOVT_BOOL, 0},
+#ifdef DHD_L2_FILTER
+       {"block_ping", IOV_BLOCK_PING, (0), 0, IOVT_BOOL, 0},
+       {"proxy_arp", IOV_PROXY_ARP, (0), 0, IOVT_BOOL, 0},
+       {"grat_arp", IOV_GRAT_ARP, (0), 0, IOVT_BOOL, 0},
+       {"block_tdls", IOV_BLOCK_TDLS, (0), IOVT_BOOL, 0},
+#endif /* DHD_L2_FILTER */
+       {"dhd_ie", IOV_DHD_IE, (0), 0, IOVT_BUFFER, 0},
+#ifdef DHD_PSTA
+       /* PSTA/PSR Mode configuration. 0: DIABLED 1: PSTA 2: PSR */
+       {"psta", IOV_PSTA, 0, 0, IOVT_UINT32, 0},
+#endif /* DHD PSTA */
+#ifdef DHD_WET
+       /* WET Mode configuration. 0: DIABLED 1: WET */
+       {"wet", IOV_WET, 0, 0, IOVT_UINT32, 0},
+       {"wet_host_ipv4", IOV_WET_HOST_IPV4, 0, 0, IOVT_UINT32, 0},
+       {"wet_host_mac", IOV_WET_HOST_MAC, 0, 0, IOVT_BUFFER, 0},
+#endif /* DHD WET */
+       {"op_mode",     IOV_CFG80211_OPMODE,    0,      0, IOVT_UINT32, 0 },
+       {"assert_type", IOV_ASSERT_TYPE, (0), 0, IOVT_UINT32, 0},
+       {"lmtest", IOV_LMTEST,  0,      0, IOVT_UINT32, 0 },
+#ifdef DHD_MCAST_REGEN
+       {"mcast_regen_bss_enable", IOV_MCAST_REGEN_BSS_ENABLE, 0, 0, IOVT_BOOL, 0},
+#endif
+#ifdef SHOW_LOGTRACE
+       {"dump_trace_buf", IOV_DUMP_TRACE_LOG,  0, 0, IOVT_BUFFER,      sizeof(trace_buf_info_t) },
+#endif /* SHOW_LOGTRACE */
+       {"trap_type", IOV_DONGLE_TRAP_TYPE, 0, 0, IOVT_UINT32, 0 },
+       {"trap_info", IOV_DONGLE_TRAP_INFO, 0, 0, IOVT_BUFFER, sizeof(trap_t) },
+#ifdef DHD_DEBUG
+       {"bpaddr", IOV_BPADDR,  0, 0, IOVT_BUFFER,      sizeof(sdreg_t) },
+#endif /* DHD_DEBUG */
+       {"dump_dongle", IOV_DUMP_DONGLE, 0, 0, IOVT_BUFFER,
+       MAX(sizeof(dump_dongle_in_t), sizeof(dump_dongle_out_t)) },
+#if defined(DHD_LOG_DUMP)
+       {"log_dump", IOV_LOG_DUMP,      0, 0, IOVT_UINT8, 0},
+#endif /* DHD_LOG_DUMP */
+       {"tput_test", IOV_TPUT_TEST, 0, 0, IOVT_BUFFER, sizeof(tput_test_t)},
+       {"debug_buf_dest_stat", IOV_DEBUG_BUF_DEST_STAT, 0, 0, IOVT_UINT32, 0 },
+#if defined(DHD_SSSR_DUMP)
+       {"fis_trigger", IOV_FIS_TRIGGER, 0, 0, IOVT_UINT32, 0},
+#endif
+#ifdef DHD_DEBUG
+       {"induce_error", IOV_INDUCE_ERROR, (0), 0, IOVT_UINT16, 0 },
+#endif /* DHD_DEBUG */
+#ifdef RTT_GEOFENCE_CONT
+#if defined(RTT_SUPPORT) && defined(WL_NAN)
+       {"rtt_geofence_type_ovrd", IOV_RTT_GEOFENCE_TYPE_OVRD, (0), 0, IOVT_BOOL, 0},
+#endif /* RTT_SUPPORT && WL_NAN */
+#endif /* RTT_GEOFENCE_CONT */
+       {"fw_verbose", IOV_FW_VBS, 0, 0, IOVT_UINT32, 0},
+#ifdef DHD_TX_PROFILE
+       {"tx_profile_tag", IOV_TX_PROFILE_TAG, 0, 0, IOVT_BUFFER,
+       sizeof(dhd_tx_profile_protocol_t)},
+       {"tx_profile_enable",   IOV_TX_PROFILE_ENABLE,  0,      0,      IOVT_BOOL,      0},
+       {"tx_profile_dump",     IOV_TX_PROFILE_DUMP,    0,      0,      IOVT_UINT32,    0},
+#endif /* defined(DHD_TX_PROFILE) */
+       /* --- add new iovars *ABOVE* this line --- */
+       {NULL, 0, 0, 0, 0, 0 }
+};
+
+#define DHD_IOVAR_BUF_SIZE     128
+
+bool
+dhd_query_bus_erros(dhd_pub_t *dhdp)
+{
+       bool ret = FALSE;
+
+       if (dhdp->dongle_reset) {
+               DHD_ERROR_RLMT(("%s: Dongle Reset occurred, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+       }
+
+       if (dhdp->dongle_trap_occured) {
+               DHD_ERROR_RLMT(("%s: FW TRAP has occurred, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+               dhdp->hang_reason = HANG_REASON_DONGLE_TRAP;
+               dhd_os_send_hang_message(dhdp);
+       }
+
+       if (dhdp->iovar_timeout_occured) {
+               DHD_ERROR_RLMT(("%s: Resumed on timeout for previous IOVAR, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+       }
+
+#ifdef PCIE_FULL_DONGLE
+       if (dhdp->d3ack_timeout_occured) {
+               DHD_ERROR_RLMT(("%s: Resumed on timeout for previous D3ACK, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+       }
+       if (dhdp->livelock_occured) {
+               DHD_ERROR_RLMT(("%s: LIVELOCK occurred for previous msg, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+       }
+
+       if (dhdp->pktid_audit_failed) {
+               DHD_ERROR_RLMT(("%s: pktid_audit_failed, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+       }
+#endif /* PCIE_FULL_DONGLE */
+
+       if (dhdp->iface_op_failed) {
+               DHD_ERROR_RLMT(("%s: iface_op_failed, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+       }
+
+       if (dhdp->scan_timeout_occurred) {
+               DHD_ERROR_RLMT(("%s: scan_timeout_occurred, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+       }
+
+       if (dhdp->scan_busy_occurred) {
+               DHD_ERROR_RLMT(("%s: scan_busy_occurred, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+       }
+
+#ifdef DNGL_AXI_ERROR_LOGGING
+       if (dhdp->axi_error) {
+               DHD_ERROR_RLMT(("%s: AXI error occurred, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+       }
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+       if (dhd_bus_get_linkdown(dhdp)) {
+               DHD_ERROR_RLMT(("%s : PCIE Link down occurred, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+       }
+
+       if (dhd_bus_get_cto(dhdp)) {
+               DHD_ERROR_RLMT(("%s : CTO Recovery reported, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+       }
+
+       return ret;
+}
+
+void
+dhd_clear_bus_errors(dhd_pub_t *dhdp)
+{
+       if (!dhdp)
+               return;
+
+       dhdp->dongle_reset = FALSE;
+       dhdp->dongle_trap_occured = FALSE;
+       dhdp->iovar_timeout_occured = FALSE;
+#ifdef PCIE_FULL_DONGLE
+       dhdp->d3ack_timeout_occured = FALSE;
+       dhdp->livelock_occured = FALSE;
+       dhdp->pktid_audit_failed = FALSE;
+#endif
+       dhdp->iface_op_failed = FALSE;
+       dhdp->scan_timeout_occurred = FALSE;
+       dhdp->scan_busy_occurred = FALSE;
+}
+
+#ifdef DHD_SSSR_DUMP
+
+/* This can be overwritten by module parameter defined in dhd_linux.c */
+uint sssr_enab = TRUE;
+
+#ifdef DHD_FIS_DUMP
+uint fis_enab = TRUE;
+#else
+uint fis_enab = FALSE;
+#endif /* DHD_FIS_DUMP */
+
+int
+dhd_sssr_mempool_init(dhd_pub_t *dhd)
+{
+       dhd->sssr_mempool = (uint8 *) MALLOCZ(dhd->osh, DHD_SSSR_MEMPOOL_SIZE);
+       if (dhd->sssr_mempool == NULL) {
+               DHD_ERROR(("%s: MALLOC of sssr_mempool failed\n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+       }
+       return BCME_OK;
+}
+
+void
+dhd_sssr_mempool_deinit(dhd_pub_t *dhd)
+{
+       if (dhd->sssr_mempool) {
+               MFREE(dhd->osh, dhd->sssr_mempool, DHD_SSSR_MEMPOOL_SIZE);
+               dhd->sssr_mempool = NULL;
+       }
+}
+
+int
+dhd_sssr_reg_info_init(dhd_pub_t *dhd)
+{
+       dhd->sssr_reg_info = (sssr_reg_info_cmn_t *) MALLOCZ(dhd->osh, sizeof(sssr_reg_info_cmn_t));
+       if (dhd->sssr_reg_info == NULL) {
+               DHD_ERROR(("%s: MALLOC of sssr_reg_info failed\n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+       }
+       return BCME_OK;
+}
+
+void
+dhd_sssr_reg_info_deinit(dhd_pub_t *dhd)
+{
+       if (dhd->sssr_reg_info) {
+               MFREE(dhd->osh, dhd->sssr_reg_info, sizeof(sssr_reg_info_cmn_t));
+               dhd->sssr_reg_info = NULL;
+       }
+}
+
+void
+dhd_dump_sssr_reg_info(dhd_pub_t *dhd)
+{
+}
+
+int
+dhd_get_sssr_reg_info(dhd_pub_t *dhd)
+{
+       int ret;
+       /* get sssr_reg_info from firmware */
+       ret = dhd_iovar(dhd, 0, "sssr_reg_info", NULL, 0,  (char *)dhd->sssr_reg_info,
+               sizeof(sssr_reg_info_cmn_t), FALSE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: sssr_reg_info failed (error=%d)\n",
+                       __FUNCTION__, ret));
+               return BCME_ERROR;
+       }
+
+       dhd_dump_sssr_reg_info(dhd);
+       return BCME_OK;
+}
+
+uint32
+dhd_get_sssr_bufsize(dhd_pub_t *dhd)
+{
+       int i;
+       uint32 sssr_bufsize = 0;
+       uint8 num_d11cores;
+
+       num_d11cores = dhd_d11_slices_num_get(dhd);
+
+       switch (dhd->sssr_reg_info->rev2.version) {
+               case SSSR_REG_INFO_VER_3 :
+                       /* intentional fall through */
+               case SSSR_REG_INFO_VER_2 :
+                       for (i = 0; i < num_d11cores; i++) {
+                               sssr_bufsize += dhd->sssr_reg_info->rev2.mac_regs[i].sr_size;
+                       }
+                       if ((dhd->sssr_reg_info->rev2.length >
+                        OFFSETOF(sssr_reg_info_v2_t, dig_mem_info)) &&
+                        dhd->sssr_reg_info->rev2.dig_mem_info.dig_sr_addr) {
+                               sssr_bufsize += 0; /* TBD */
+                       }
+                       break;
+               case SSSR_REG_INFO_VER_1 :
+                       for (i = 0; i < num_d11cores; i++) {
+                               sssr_bufsize += dhd->sssr_reg_info->rev1.mac_regs[i].sr_size;
+                       }
+                       if (dhd->sssr_reg_info->rev1.vasip_regs.vasip_sr_size) {
+                               sssr_bufsize += dhd->sssr_reg_info->rev1.vasip_regs.vasip_sr_size;
+                       } else if ((dhd->sssr_reg_info->rev1.length > OFFSETOF(sssr_reg_info_v1_t,
+                               dig_mem_info)) && dhd->sssr_reg_info->rev1.
+                               dig_mem_info.dig_sr_addr) {
+                               sssr_bufsize += dhd->sssr_reg_info->rev1.dig_mem_info.dig_sr_size;
+                       }
+                       break;
+               case SSSR_REG_INFO_VER_0 :
+                       for (i = 0; i < num_d11cores; i++) {
+                               sssr_bufsize += dhd->sssr_reg_info->rev0.mac_regs[i].sr_size;
+                       }
+                       if (dhd->sssr_reg_info->rev0.vasip_regs.vasip_sr_size) {
+                               sssr_bufsize += dhd->sssr_reg_info->rev0.vasip_regs.vasip_sr_size;
+                       }
+                       break;
+               default :
+                       DHD_ERROR(("invalid sssr_reg_ver"));
+                       return BCME_UNSUPPORTED;
+       }
+
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+       /* Double the size as different dumps will be saved before and after SR */
+       sssr_bufsize = 2 * sssr_bufsize;
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+       return sssr_bufsize;
+}
+
+int
+dhd_sssr_dump_init(dhd_pub_t *dhd)
+{
+       int i;
+       uint32 sssr_bufsize;
+       uint32 mempool_used = 0;
+       uint8 num_d11cores = 0;
+       bool alloc_sssr = FALSE;
+       uint32 sr_size = 0;
+
+       dhd->sssr_inited = FALSE;
+       if (!sssr_enab) {
+               DHD_ERROR(("%s: sssr dump not inited as instructed by mod param\n", __FUNCTION__));
+               return BCME_OK;
+       }
+
+       /* check if sssr mempool is allocated */
+       if (dhd->sssr_mempool == NULL) {
+               DHD_ERROR(("%s: sssr_mempool is not allocated\n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       /* check if sssr mempool is allocated */
+       if (dhd->sssr_reg_info == NULL) {
+               DHD_ERROR(("%s: sssr_reg_info is not allocated\n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       /* Get SSSR reg info */
+       if (dhd_get_sssr_reg_info(dhd) != BCME_OK) {
+               DHD_ERROR(("%s: dhd_get_sssr_reg_info failed\n", __FUNCTION__));
+               printf("DEBUG_SSSr: %s: dhd_get_sssr_reg_info failed\n", __FUNCTION__);
+               return BCME_ERROR;
+       }
+
+       num_d11cores = dhd_d11_slices_num_get(dhd);
+       /* Validate structure version and length */
+       switch (dhd->sssr_reg_info->rev2.version) {
+               case SSSR_REG_INFO_VER_3 :
+                       if (dhd->sssr_reg_info->rev3.length != sizeof(sssr_reg_info_v3_t)) {
+                               DHD_ERROR(("%s: dhd->sssr_reg_info->rev2.length (%d : %d)"
+                                        "mismatch on rev2\n", __FUNCTION__,
+                                        (int)dhd->sssr_reg_info->rev3.length,
+                                        (int)sizeof(sssr_reg_info_v3_t)));
+                               return BCME_ERROR;
+                       }
+                       break;
+               case SSSR_REG_INFO_VER_2 :
+                       if (dhd->sssr_reg_info->rev2.length != sizeof(sssr_reg_info_v2_t)) {
+                               DHD_ERROR(("%s: dhd->sssr_reg_info->rev2.length (%d : %d)"
+                                        "mismatch on rev2\n", __FUNCTION__,
+                                        (int)dhd->sssr_reg_info->rev2.length,
+                                        (int)sizeof(sssr_reg_info_v2_t)));
+                               return BCME_ERROR;
+                       }
+                       break;
+               case SSSR_REG_INFO_VER_1 :
+                       if (dhd->sssr_reg_info->rev1.length != sizeof(sssr_reg_info_v1_t)) {
+                               DHD_ERROR(("%s: dhd->sssr_reg_info->rev1.length (%d : %d)"
+                                        "mismatch on rev1\n", __FUNCTION__,
+                                        (int)dhd->sssr_reg_info->rev1.length,
+                                        (int)sizeof(sssr_reg_info_v1_t)));
+                               return BCME_ERROR;
+                       }
+                       break;
+               case SSSR_REG_INFO_VER_0 :
+                       if (dhd->sssr_reg_info->rev0.length != sizeof(sssr_reg_info_v0_t)) {
+                               DHD_ERROR(("%s: dhd->sssr_reg_info->rev0.length (%d : %d)"
+                                        "mismatch on rev0\n", __FUNCTION__,
+                                        (int)dhd->sssr_reg_info->rev0.length,
+                                        (int)sizeof(sssr_reg_info_v0_t)));
+                               return BCME_ERROR;
+                       }
+                       break;
+               default :
+                       DHD_ERROR(("invalid sssr_reg_ver"));
+                       return BCME_UNSUPPORTED;
+       }
+
+       /* validate fifo size */
+       sssr_bufsize = dhd_get_sssr_bufsize(dhd);
+       if (sssr_bufsize > DHD_SSSR_MEMPOOL_SIZE) {
+               DHD_ERROR(("%s: sssr_bufsize(%d) is greater than sssr_mempool(%d)\n",
+                       __FUNCTION__, (int)sssr_bufsize, DHD_SSSR_MEMPOOL_SIZE));
+               return BCME_ERROR;
+       }
+
+       /* init all pointers to NULL */
+       for (i = 0; i < num_d11cores; i++) {
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+               dhd->sssr_d11_before[i] = NULL;
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+               dhd->sssr_d11_after[i] = NULL;
+       }
+
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+       dhd->sssr_dig_buf_before = NULL;
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+       dhd->sssr_dig_buf_after = NULL;
+
+       /* Allocate memory */
+       for (i = 0; i < num_d11cores; i++) {
+               alloc_sssr = FALSE;
+               sr_size = 0;
+
+               switch (dhd->sssr_reg_info->rev2.version) {
+                       case SSSR_REG_INFO_VER_3 :
+                               /* intentional fall through */
+                       case SSSR_REG_INFO_VER_2 :
+                               if (dhd->sssr_reg_info->rev2.mac_regs[i].sr_size) {
+                                       alloc_sssr = TRUE;
+                                       sr_size = dhd->sssr_reg_info->rev2.mac_regs[i].sr_size;
+                               }
+                               break;
+                       case SSSR_REG_INFO_VER_1 :
+                               if (dhd->sssr_reg_info->rev1.mac_regs[i].sr_size) {
+                                       alloc_sssr = TRUE;
+                                       sr_size = dhd->sssr_reg_info->rev1.mac_regs[i].sr_size;
+                               }
+                               break;
+                       case SSSR_REG_INFO_VER_0 :
+                               if (dhd->sssr_reg_info->rev0.mac_regs[i].sr_size) {
+                                       alloc_sssr = TRUE;
+                                       sr_size = dhd->sssr_reg_info->rev0.mac_regs[i].sr_size;
+                               }
+                               break;
+                       default :
+                               DHD_ERROR(("invalid sssr_reg_ver"));
+                               return BCME_UNSUPPORTED;
+               }
+
+               if (alloc_sssr) {
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+                       dhd->sssr_d11_before[i] = (uint32 *)(dhd->sssr_mempool + mempool_used);
+                       mempool_used += sr_size;
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+                       dhd->sssr_d11_after[i] = (uint32 *)(dhd->sssr_mempool + mempool_used);
+                       mempool_used += sr_size;
+               }
+       }
+
+       /* Allocate dump memory for VASIP (version 0 or 1) or digital core (version 0, 1, or 2) */
+       alloc_sssr = FALSE;
+       sr_size = 0;
+       switch (dhd->sssr_reg_info->rev2.version) {
+               case SSSR_REG_INFO_VER_3 :
+                       /* intentional fall through */
+               case SSSR_REG_INFO_VER_2 :
+                       if ((dhd->sssr_reg_info->rev2.length >
+                        OFFSETOF(sssr_reg_info_v2_t, dig_mem_info)) &&
+                        dhd->sssr_reg_info->rev2.dig_mem_info.dig_sr_addr) {
+                               alloc_sssr = TRUE;
+                               sr_size = dhd->sssr_reg_info->rev2.dig_mem_info.dig_sr_size;
+                       }
+                       break;
+               case SSSR_REG_INFO_VER_1 :
+                       if (dhd->sssr_reg_info->rev1.vasip_regs.vasip_sr_size) {
+                               alloc_sssr = TRUE;
+                               sr_size = dhd->sssr_reg_info->rev1.vasip_regs.vasip_sr_size;
+                       } else if ((dhd->sssr_reg_info->rev1.length > OFFSETOF(sssr_reg_info_v1_t,
+                               dig_mem_info)) && dhd->sssr_reg_info->rev1.
+                               dig_mem_info.dig_sr_addr) {
+                               alloc_sssr = TRUE;
+                               sr_size = dhd->sssr_reg_info->rev1.dig_mem_info.dig_sr_size;
+                       }
+                       break;
+               case SSSR_REG_INFO_VER_0 :
+                       if (dhd->sssr_reg_info->rev0.vasip_regs.vasip_sr_size) {
+                               alloc_sssr = TRUE;
+                               sr_size = dhd->sssr_reg_info->rev0.vasip_regs.vasip_sr_size;
+                       }
+                       break;
+               default :
+                       DHD_ERROR(("invalid sssr_reg_ver"));
+                       return BCME_UNSUPPORTED;
+       }
+
+       if (alloc_sssr) {
+               dhd->sssr_dig_buf_after = (uint32 *)(dhd->sssr_mempool + mempool_used);
+               mempool_used += sr_size;
+
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+               /* DIG dump before suspend is not applicable. */
+               dhd->sssr_dig_buf_before = NULL;
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+       }
+
+       dhd->sssr_inited = TRUE;
+
+       return BCME_OK;
+
+}
+
+void
+dhd_sssr_dump_deinit(dhd_pub_t *dhd)
+{
+       int i;
+       uint8 num_d11cores;
+
+       num_d11cores = dhd_d11_slices_num_get(dhd);
+
+       dhd->sssr_inited = FALSE;
+       /* init all pointers to NULL */
+       for (i = 0; i < num_d11cores; i++) {
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+               dhd->sssr_d11_before[i] = NULL;
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+               dhd->sssr_d11_after[i] = NULL;
+       }
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+       dhd->sssr_dig_buf_before = NULL;
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+       dhd->sssr_dig_buf_after = NULL;
+
+       return;
+}
+
+void
+dhd_sssr_print_filepath(dhd_pub_t *dhd, char *path)
+{
+       bool print_info = FALSE;
+       int dump_mode;
+
+       if (!dhd || !path) {
+               DHD_ERROR(("%s: dhd or memdump_path is NULL\n",
+                       __FUNCTION__));
+               return;
+       }
+
+       if (!dhd->sssr_dump_collected) {
+               /* SSSR dump is not collected */
+               return;
+       }
+
+       dump_mode = dhd->sssr_dump_mode;
+
+       if (bcmstrstr(path, "core_0_before")) {
+               if (dhd->sssr_d11_outofreset[0] &&
+                       dump_mode == SSSR_DUMP_MODE_SSSR) {
+                       print_info = TRUE;
+               }
+       } else if (bcmstrstr(path, "core_0_after")) {
+               if (dhd->sssr_d11_outofreset[0]) {
+                       print_info = TRUE;
+               }
+       } else if (bcmstrstr(path, "core_1_before")) {
+               if (dhd->sssr_d11_outofreset[1] &&
+                       dump_mode == SSSR_DUMP_MODE_SSSR) {
+                       print_info = TRUE;
+               }
+       } else if (bcmstrstr(path, "core_1_after")) {
+               if (dhd->sssr_d11_outofreset[1]) {
+                       print_info = TRUE;
+               }
+       } else if (bcmstrstr(path, "core_2_before")) {
+               if (dhd->sssr_d11_outofreset[2] &&
+                       dump_mode == SSSR_DUMP_MODE_SSSR) {
+                       print_info = TRUE;
+               }
+       } else if (bcmstrstr(path, "core_2_after")) {
+               if (dhd->sssr_d11_outofreset[2]) {
+                       print_info = TRUE;
+               }
+       } else {
+               print_info = TRUE;
+       }
+
+       if (print_info) {
+               DHD_ERROR(("%s: file_path = %s%s\n", __FUNCTION__,
+                       path, FILE_NAME_HAL_TAG));
+       }
+}
+#endif /* DHD_SSSR_DUMP */
+
+#ifdef DHD_SDTC_ETB_DUMP
+/*
+ * sdtc: system debug trace controller
+ * etb: embedded trace buf
+ */
+void
+dhd_sdtc_etb_init(dhd_pub_t *dhd)
+{
+       bcm_iov_buf_t iov_req;
+       etb_addr_info_t *p_etb_addr_info = NULL;
+       bcm_iov_buf_t *iov_resp;
+       uint8 *buf;
+       int ret = 0;
+       uint16 iovlen = 0;
+       uint16 version = 0;
+
+       BCM_REFERENCE(p_etb_addr_info);
+       dhd->sdtc_etb_inited = FALSE;
+
+       buf = MALLOCZ(dhd->osh, WLC_IOCTL_MAXLEN);
+       if (buf == NULL) {
+               DHD_ERROR(("%s: Failed to alloc buffer for iovar response\n", __FUNCTION__));
+               return;
+       }
+
+       /* fill header */
+       bzero(&iov_req, sizeof(iov_req));
+       iov_req.version = WL_SDTC_IOV_VERSION;
+       iov_req.id = WL_SDTC_CMD_ETB_INFO;
+       iov_req.len = sizeof(etb_addr_info_t);
+       iovlen = OFFSETOF(bcm_iov_buf_t, data) + iov_req.len;
+
+       ret = dhd_iovar(dhd, 0, "sdtc", (char *)&iov_req, iovlen,
+               (char *)buf, WLC_IOCTL_MAXLEN, FALSE);
+       if (ret < 0) {
+               DHD_ERROR(("%s failed to get sdtc etb_info %d\n", __FUNCTION__, ret));
+               goto exit;
+       }
+
+       version = dtoh16(*(uint16 *)buf);
+       /* Check for version */
+       if (version != WL_SDTC_IOV_VERSION) {
+               DHD_ERROR(("%s WL_SDTC_IOV_VERSION mis match\n", __FUNCTION__));
+               goto exit;
+       }
+       iov_resp = (bcm_iov_buf_t *)buf;
+       if (iov_resp->id == iov_req.id) {
+               p_etb_addr_info = (etb_addr_info_t*)iov_resp->data;
+               dhd->etb_addr_info.version = p_etb_addr_info->version;
+               dhd->etb_addr_info.len = p_etb_addr_info->len;
+               dhd->etb_addr_info.etbinfo_addr = p_etb_addr_info->etbinfo_addr;
+
+               DHD_ERROR(("%s etb_addr_info: ver:%d, len:%d, addr:0x%x\n", __FUNCTION__,
+                       dhd->etb_addr_info.version, dhd->etb_addr_info.len,
+                       dhd->etb_addr_info.etbinfo_addr));
+       } else {
+               DHD_ERROR(("%s Unknown CMD-ID (%d) as  response for request ID %d\n",
+                       __FUNCTION__, iov_resp->id, iov_req.id));
+               goto exit;
+       }
+
+       dhd->sdtc_etb_mempool = (uint8 *) MALLOCZ(dhd->osh, DHD_SDTC_ETB_MEMPOOL_SIZE);
+       if (dhd->sdtc_etb_mempool == NULL) {
+               DHD_ERROR(("%s: MALLOC of sdtc_etb_mempool failed\n",
+                       __FUNCTION__));
+               goto exit;
+       }
+
+       /* since all the requirements for SDTC and ETB are met mark the capability as TRUE */
+       dhd->sdtc_etb_inited = TRUE;
+       DHD_ERROR(("%s sdtc_etb_inited: %d\n", __FUNCTION__, dhd->sdtc_etb_inited));
+exit:
+       MFREE(dhd->osh, buf, WLC_IOCTL_MAXLEN);
+       return;
+}
+
+void
+dhd_sdtc_etb_deinit(dhd_pub_t *dhd)
+{
+       dhd->sdtc_etb_inited = FALSE;
+       if (dhd->sdtc_etb_mempool) {
+               MFREE(dhd->osh, dhd->sdtc_etb_mempool, DHD_SDTC_ETB_MEMPOOL_SIZE);
+               dhd->sdtc_etb_mempool = NULL;
+       }
+}
+#endif /* DHD_SDTC_ETB_DUMP */
+
+#ifdef DHD_FW_COREDUMP
+void* dhd_get_fwdump_buf(dhd_pub_t *dhd_pub, uint32 length)
+{
+       if (!dhd_pub->soc_ram) {
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_MEMDUMP)
+               dhd_pub->soc_ram = (uint8*)DHD_OS_PREALLOC(dhd_pub,
+                       DHD_PREALLOC_MEMDUMP_RAM, length);
+#else
+               dhd_pub->soc_ram = (uint8*) MALLOC(dhd_pub->osh, length);
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_MEMDUMP */
+       }
+
+       if (dhd_pub->soc_ram == NULL) {
+               DHD_ERROR(("%s: Failed to allocate memory for fw crash snap shot.\n",
+                       __FUNCTION__));
+               dhd_pub->soc_ram_length = 0;
+       } else {
+               memset(dhd_pub->soc_ram, 0, length);
+               dhd_pub->soc_ram_length = length;
+       }
+
+       /* soc_ram free handled in dhd_{free,clear} */
+       return dhd_pub->soc_ram;
+}
+#endif /* DHD_FW_COREDUMP */
+
+/* to NDIS developer, the structure dhd_common is redundant,
+ * please do NOT merge it back from other branches !!!
+ */
+
+int
+dhd_common_socram_dump(dhd_pub_t *dhdp)
+{
+#ifdef BCMDBUS
+       return 0;
+#else
+       return dhd_socram_dump(dhdp->bus);
+#endif /* BCMDBUS */
+}
+
+int
+dhd_dump(dhd_pub_t *dhdp, char *buf, int buflen)
+{
+       struct bcmstrbuf b;
+       struct bcmstrbuf *strbuf = &b;
+#ifdef DHD_MEM_STATS
+       uint64 malloc_mem = 0;
+       uint64 total_txpath_mem = 0;
+       uint64 txpath_bkpq_len = 0;
+       uint64 txpath_bkpq_mem = 0;
+       uint64 total_dhd_mem = 0;
+#endif /* DHD_MEM_STATS */
+
+       if (!dhdp || !dhdp->prot || !buf) {
+               return BCME_ERROR;
+       }
+
+       bcm_binit(strbuf, buf, buflen);
+
+       /* Base DHD info */
+       bcm_bprintf(strbuf, "%s\n", dhd_version);
+       bcm_bprintf(strbuf, "\n");
+       bcm_bprintf(strbuf, "pub.up %d pub.txoff %d pub.busstate %d\n",
+                   dhdp->up, dhdp->txoff, dhdp->busstate);
+       bcm_bprintf(strbuf, "pub.hdrlen %u pub.maxctl %u pub.rxsz %u\n",
+                   dhdp->hdrlen, dhdp->maxctl, dhdp->rxsz);
+       bcm_bprintf(strbuf, "pub.iswl %d pub.drv_version %ld pub.mac "MACDBG"\n",
+                   dhdp->iswl, dhdp->drv_version, MAC2STRDBG(&dhdp->mac));
+       bcm_bprintf(strbuf, "pub.bcmerror %d tickcnt %u\n", dhdp->bcmerror, dhdp->tickcnt);
+
+       bcm_bprintf(strbuf, "dongle stats:\n");
+       bcm_bprintf(strbuf, "tx_packets %lu tx_bytes %lu tx_errors %lu tx_dropped %lu\n",
+                   dhdp->dstats.tx_packets, dhdp->dstats.tx_bytes,
+                   dhdp->dstats.tx_errors, dhdp->dstats.tx_dropped);
+       bcm_bprintf(strbuf, "rx_packets %lu rx_bytes %lu rx_errors %lu rx_dropped %lu\n",
+                   dhdp->dstats.rx_packets, dhdp->dstats.rx_bytes,
+                   dhdp->dstats.rx_errors, dhdp->dstats.rx_dropped);
+       bcm_bprintf(strbuf, "multicast %lu\n", dhdp->dstats.multicast);
+
+       bcm_bprintf(strbuf, "bus stats:\n");
+       bcm_bprintf(strbuf, "tx_packets %lu  tx_dropped %lu tx_multicast %lu tx_errors %lu\n",
+                   dhdp->tx_packets, dhdp->tx_dropped, dhdp->tx_multicast, dhdp->tx_errors);
+       bcm_bprintf(strbuf, "tx_ctlpkts %lu tx_ctlerrs %lu\n",
+                   dhdp->tx_ctlpkts, dhdp->tx_ctlerrs);
+       bcm_bprintf(strbuf, "rx_packets %lu rx_multicast %lu rx_errors %lu \n",
+                   dhdp->rx_packets, dhdp->rx_multicast, dhdp->rx_errors);
+       bcm_bprintf(strbuf, "rx_ctlpkts %lu rx_ctlerrs %lu rx_dropped %lu\n",
+                   dhdp->rx_ctlpkts, dhdp->rx_ctlerrs, dhdp->rx_dropped);
+       bcm_bprintf(strbuf, "rx_readahead_cnt %lu tx_realloc %lu\n",
+                   dhdp->rx_readahead_cnt, dhdp->tx_realloc);
+       bcm_bprintf(strbuf, "tx_pktgetfail %lu rx_pktgetfail %lu\n",
+                   dhdp->tx_pktgetfail, dhdp->rx_pktgetfail);
+       bcm_bprintf(strbuf, "tx_big_packets %lu\n",
+                   dhdp->tx_big_packets);
+       bcm_bprintf(strbuf, "\n");
+#ifdef DMAMAP_STATS
+       /* Add DMA MAP info */
+       bcm_bprintf(strbuf, "DMA MAP stats: \n");
+       bcm_bprintf(strbuf, "txdata: %lu size: %luK, rxdata: %lu size: %luK\n",
+                       dhdp->dma_stats.txdata, KB(dhdp->dma_stats.txdata_sz),
+                       dhdp->dma_stats.rxdata, KB(dhdp->dma_stats.rxdata_sz));
+#ifndef IOCTLRESP_USE_CONSTMEM
+       bcm_bprintf(strbuf, "IOCTL RX: %lu size: %luK ,",
+                       dhdp->dma_stats.ioctl_rx, KB(dhdp->dma_stats.ioctl_rx_sz));
+#endif /* !IOCTLRESP_USE_CONSTMEM */
+       bcm_bprintf(strbuf, "EVENT RX: %lu size: %luK, INFO RX: %lu size: %luK, "
+                       "TSBUF RX: %lu size %luK\n",
+                       dhdp->dma_stats.event_rx, KB(dhdp->dma_stats.event_rx_sz),
+                       dhdp->dma_stats.info_rx, KB(dhdp->dma_stats.info_rx_sz),
+                       dhdp->dma_stats.tsbuf_rx, KB(dhdp->dma_stats.tsbuf_rx_sz));
+       bcm_bprintf(strbuf, "Total : %luK \n",
+                       KB(dhdp->dma_stats.txdata_sz + dhdp->dma_stats.rxdata_sz +
+                       dhdp->dma_stats.ioctl_rx_sz + dhdp->dma_stats.event_rx_sz +
+                       dhdp->dma_stats.tsbuf_rx_sz));
+#endif /* DMAMAP_STATS */
+       bcm_bprintf(strbuf, "dhd_induce_error : %u\n", dhdp->dhd_induce_error);
+       /* Add any prot info */
+       dhd_prot_dump(dhdp, strbuf);
+       bcm_bprintf(strbuf, "\n");
+
+       /* Add any bus info */
+       dhd_bus_dump(dhdp, strbuf);
+
+#if defined(DHD_LB_STATS)
+       dhd_lb_stats_dump(dhdp, strbuf);
+#endif /* DHD_LB_STATS */
+
+#ifdef DHD_MEM_STATS
+
+       malloc_mem = MALLOCED(dhdp->osh);
+
+       txpath_bkpq_len = dhd_active_tx_flowring_bkpq_len(dhdp);
+       /*
+        * Instead of traversing the entire queue to find the skbs length,
+        * considering MAX_MTU_SZ as lenth of each skb.
+        */
+       txpath_bkpq_mem = (txpath_bkpq_len* MAX_MTU_SZ);
+       total_txpath_mem = dhdp->txpath_mem + txpath_bkpq_mem;
+
+       bcm_bprintf(strbuf, "\nDHD malloc memory_usage: %llubytes %lluKB\n",
+               malloc_mem, (malloc_mem / 1024));
+
+       bcm_bprintf(strbuf, "\nDHD tx-bkpq len: %llu memory_usage: %llubytes %lluKB\n",
+               txpath_bkpq_len, txpath_bkpq_mem, (txpath_bkpq_mem / 1024));
+       bcm_bprintf(strbuf, "DHD tx-path memory_usage: %llubytes %lluKB\n",
+               total_txpath_mem, (total_txpath_mem / 1024));
+
+       total_dhd_mem = malloc_mem + total_txpath_mem;
+#if defined(DHD_LB_STATS)
+       total_dhd_mem += dhd_lb_mem_usage(dhdp, strbuf);
+#endif /* DHD_LB_STATS */
+       bcm_bprintf(strbuf, "\nDHD Totoal memory_usage: %llubytes %lluKB \n",
+               total_dhd_mem, (total_dhd_mem / 1024));
+#endif /* DHD_MEM_STATS */
+
+#if defined(DHD_MQ) && defined(DHD_MQ_STATS)
+       dhd_mqstats_dump(dhdp, strbuf);
+#endif
+
+#ifdef DHD_WET
+       if (dhd_get_wet_mode(dhdp)) {
+               bcm_bprintf(strbuf, "Wet Dump:\n");
+               dhd_wet_dump(dhdp, strbuf);
+               }
+#endif /* DHD_WET */
+
+       /* return remaining buffer length */
+       return (!strbuf->size ? BCME_BUFTOOSHORT : strbuf->size);
+}
+
+void
+dhd_dump_to_kernelog(dhd_pub_t *dhdp)
+{
+       char buf[512];
+
+       DHD_ERROR(("F/W version: %s\n", fw_version));
+       bcm_bprintf_bypass = TRUE;
+       dhd_dump(dhdp, buf, sizeof(buf));
+       bcm_bprintf_bypass = FALSE;
+}
+
+int
+dhd_wl_ioctl_cmd(dhd_pub_t *dhd_pub, int cmd, void *arg, int len, uint8 set, int ifidx)
+{
+       wl_ioctl_t ioc;
+
+       ioc.cmd = cmd;
+       ioc.buf = arg;
+       ioc.len = len;
+       ioc.set = set;
+
+       return dhd_wl_ioctl(dhd_pub, ifidx, &ioc, arg, len);
+}
+
+int
+dhd_wl_ioctl_get_intiovar(dhd_pub_t *dhd_pub, char *name, uint *pval,
+       int cmd, uint8 set, int ifidx)
+{
+       char iovbuf[WLC_IOCTL_SMLEN];
+       int ret = -1;
+
+       memset(iovbuf, 0, sizeof(iovbuf));
+       if (bcm_mkiovar(name, NULL, 0, iovbuf, sizeof(iovbuf))) {
+               ret = dhd_wl_ioctl_cmd(dhd_pub, cmd, iovbuf, sizeof(iovbuf), set, ifidx);
+               if (!ret) {
+                       *pval = ltoh32(*((uint*)iovbuf));
+               } else {
+                       DHD_ERROR(("%s: get int iovar %s failed, ERR %d\n",
+                               __FUNCTION__, name, ret));
+               }
+       } else {
+               DHD_ERROR(("%s: mkiovar %s failed\n",
+                       __FUNCTION__, name));
+       }
+
+       return ret;
+}
+
+int
+dhd_wl_ioctl_set_intiovar(dhd_pub_t *dhd_pub, char *name, uint val,
+       int cmd, uint8 set, int ifidx)
+{
+       char iovbuf[WLC_IOCTL_SMLEN];
+       int ret = -1;
+       int lval = htol32(val);
+       uint len;
+
+       len = bcm_mkiovar(name, (char*)&lval, sizeof(lval), iovbuf, sizeof(iovbuf));
+
+       if (len) {
+               ret = dhd_wl_ioctl_cmd(dhd_pub, cmd, iovbuf, len, set, ifidx);
+               if (ret) {
+                       DHD_ERROR(("%s: set int iovar %s failed, ERR %d\n",
+                               __FUNCTION__, name, ret));
+               }
+       } else {
+               DHD_ERROR(("%s: mkiovar %s failed\n",
+                       __FUNCTION__, name));
+       }
+
+       return ret;
+}
+
+static struct ioctl2str_s {
+       uint32 ioctl;
+       char *name;
+} ioctl2str_array[] = {
+       {WLC_UP, "UP"},
+       {WLC_DOWN, "DOWN"},
+       {WLC_SET_PROMISC, "SET_PROMISC"},
+       {WLC_SET_INFRA, "SET_INFRA"},
+       {WLC_SET_AUTH, "SET_AUTH"},
+       {WLC_SET_SSID, "SET_SSID"},
+       {WLC_RESTART, "RESTART"},
+       {WLC_SET_CHANNEL, "SET_CHANNEL"},
+       {WLC_SET_RATE_PARAMS, "SET_RATE_PARAMS"},
+       {WLC_SET_KEY, "SET_KEY"},
+       {WLC_SCAN, "SCAN"},
+       {WLC_DISASSOC, "DISASSOC"},
+       {WLC_REASSOC, "REASSOC"},
+       {WLC_SET_COUNTRY, "SET_COUNTRY"},
+       {WLC_SET_WAKE, "SET_WAKE"},
+       {WLC_SET_SCANSUPPRESS, "SET_SCANSUPPRESS"},
+       {WLC_SCB_DEAUTHORIZE, "SCB_DEAUTHORIZE"},
+       {WLC_SET_WSEC, "SET_WSEC"},
+       {WLC_SET_INTERFERENCE_MODE, "SET_INTERFERENCE_MODE"},
+       {WLC_SET_RADAR, "SET_RADAR"},
+       {0, NULL}
+};
+
+static char *
+ioctl2str(uint32 ioctl)
+{
+       struct ioctl2str_s *p = ioctl2str_array;
+
+       while (p->name != NULL) {
+               if (p->ioctl == ioctl) {
+                       return p->name;
+               }
+               p++;
+       }
+
+       return "";
+}
+
+/**
+ * @param ioc          IO control struct, members are partially used by this function.
+ * @param buf [inout]  Contains parameters to send to dongle, contains dongle response on return.
+ * @param len          Maximum number of bytes that dongle is allowed to write into 'buf'.
+ */
+int
+dhd_wl_ioctl(dhd_pub_t *dhd_pub, int ifidx, wl_ioctl_t *ioc, void *buf, int len)
+{
+       int ret = BCME_ERROR;
+       unsigned long flags;
+#ifdef DUMP_IOCTL_IOV_LIST
+       dhd_iov_li_t *iov_li;
+#endif /* DUMP_IOCTL_IOV_LIST */
+       int hostsleep_set = 0;
+       int hostsleep_val = 0;
+
+       if (dhd_query_bus_erros(dhd_pub)) {
+               return -ENODEV;
+       }
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       DHD_OS_WAKE_LOCK(dhd_pub);
+       if (pm_runtime_get_sync(dhd_bus_to_dev(dhd_pub->bus)) < 0) {
+               DHD_RPM(("%s: pm_runtime_get_sync error. \n", __FUNCTION__));
+               DHD_OS_WAKE_UNLOCK(dhd_pub);
+               return BCME_ERROR;
+       }
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#ifdef KEEPIF_ON_DEVICE_RESET
+               if (ioc->cmd == WLC_GET_VAR) {
+                       dbus_config_t config;
+                       config.general_param = 0;
+                       if (buf) {
+                               if (!strcmp(buf, "wowl_activate")) {
+                                        /* 1 (TRUE) after decreased by 1 */
+                                       config.general_param = 2;
+                               } else if (!strcmp(buf, "wowl_clear")) {
+                                        /* 0 (FALSE) after decreased by 1 */
+                                       config.general_param = 1;
+                               }
+                       }
+                       if (config.general_param) {
+                               config.config_id = DBUS_CONFIG_ID_KEEPIF_ON_DEVRESET;
+                               config.general_param--;
+                               dbus_set_config(dhd_pub->dbus, &config);
+                       }
+               }
+#endif /* KEEPIF_ON_DEVICE_RESET */
+
+       if (dhd_os_proto_block(dhd_pub))
+       {
+#ifdef DHD_LOG_DUMP
+               int slen, val, lval, min_len;
+               char *msg, tmp[64];
+
+               /* WLC_GET_VAR */
+               if (ioc->cmd == WLC_GET_VAR && buf) {
+                       min_len = MIN(sizeof(tmp) - 1, strlen(buf));
+                       memset(tmp, 0, sizeof(tmp));
+                       bcopy(buf, tmp, min_len);
+                       tmp[min_len] = '\0';
+               }
+#endif /* DHD_LOG_DUMP */
+
+#ifdef DHD_DISCONNECT_TRACE
+               if (WLC_DISASSOC == ioc->cmd || WLC_DOWN == ioc->cmd ||
+                       WLC_DISASSOC_MYAP == ioc->cmd) {
+                       DHD_ERROR(("IOCTL Disconnect WiFi: %d\n", ioc->cmd));
+               }
+#endif /* HW_DISCONNECT_TRACE */
+               /* logging of iovars that are send to the dongle, ./dhd msglevel +iovar */
+               if (ioc->set == TRUE) {
+                       char *pars = (char *)buf; // points at user buffer
+                       if (ioc->cmd == WLC_SET_VAR && buf) {
+                               DHD_DNGL_IOVAR_SET(("iovar:%d: set %s", ifidx, pars));
+                               if (ioc->len > 1 + sizeof(uint32)) {
+                                       // skip iovar name:
+                                       pars += strnlen(pars, ioc->len - 1 - sizeof(uint32));
+                                       pars++;               // skip NULL character
+                               }
+                       } else {
+                               DHD_DNGL_IOVAR_SET(("ioctl:%d: set %d %s",
+                                       ifidx, ioc->cmd, ioctl2str(ioc->cmd)));
+                       }
+                       if (pars != NULL) {
+                               DHD_DNGL_IOVAR_SET((" 0x%x\n", *(uint32*)pars));
+                       } else {
+                               DHD_DNGL_IOVAR_SET((" NULL\n"));
+                       }
+               }
+
+               DHD_LINUX_GENERAL_LOCK(dhd_pub, flags);
+               if (DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(dhd_pub)) {
+                       DHD_INFO(("%s: returning as busstate=%d\n",
+                               __FUNCTION__, dhd_pub->busstate));
+                       DHD_LINUX_GENERAL_UNLOCK(dhd_pub, flags);
+                       dhd_os_proto_unblock(dhd_pub);
+                       return -ENODEV;
+               }
+               DHD_BUS_BUSY_SET_IN_IOVAR(dhd_pub);
+               DHD_LINUX_GENERAL_UNLOCK(dhd_pub, flags);
+
+#ifdef DHD_PCIE_RUNTIMEPM
+               dhdpcie_runtime_bus_wake(dhd_pub, TRUE, dhd_wl_ioctl);
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+               DHD_LINUX_GENERAL_LOCK(dhd_pub, flags);
+               if (DHD_BUS_CHECK_SUSPEND_OR_ANY_SUSPEND_IN_PROGRESS(dhd_pub) ||
+                       dhd_pub->dhd_induce_error == DHD_INDUCE_IOCTL_SUSPEND_ERROR) {
+                       DHD_ERROR(("%s: bus is in suspend(%d) or suspending(0x%x) state!!\n",
+                               __FUNCTION__, dhd_pub->busstate, dhd_pub->dhd_bus_busy_state));
+#ifdef DHD_SEND_HANG_IOCTL_SUSPEND_ERROR
+                       ioctl_suspend_error++;
+                       if (ioctl_suspend_error > MAX_IOCTL_SUSPEND_ERROR) {
+                               dhd_pub->hang_reason = HANG_REASON_IOCTL_SUSPEND_ERROR;
+                               dhd_os_send_hang_message(dhd_pub);
+                               ioctl_suspend_error = 0;
+                       }
+#endif /* DHD_SEND_HANG_IOCTL_SUSPEND_ERROR */
+                       DHD_BUS_BUSY_CLEAR_IN_IOVAR(dhd_pub);
+                       dhd_os_busbusy_wake(dhd_pub);
+                       DHD_LINUX_GENERAL_UNLOCK(dhd_pub, flags);
+                       dhd_os_proto_unblock(dhd_pub);
+                       return -ENODEV;
+               }
+#ifdef DHD_SEND_HANG_IOCTL_SUSPEND_ERROR
+               ioctl_suspend_error = 0;
+#endif /* DHD_SEND_HANG_IOCTL_SUSPEND_ERROR */
+               DHD_LINUX_GENERAL_UNLOCK(dhd_pub, flags);
+
+#ifdef DUMP_IOCTL_IOV_LIST
+               if (ioc->cmd != WLC_GET_MAGIC && ioc->cmd != WLC_GET_VERSION && buf) {
+                       if (!(iov_li = MALLOC(dhd_pub->osh, sizeof(*iov_li)))) {
+                               DHD_ERROR(("iovar dump list item allocation Failed\n"));
+                       } else {
+                               iov_li->cmd = ioc->cmd;
+                               if (buf)
+                                       bcopy((char *)buf, iov_li->buff, strlen((char *)buf)+1);
+                               dhd_iov_li_append(dhd_pub, &dhd_pub->dump_iovlist_head,
+                                               &iov_li->list);
+                       }
+               }
+#endif /* DUMP_IOCTL_IOV_LIST */
+
+               if (dhd_conf_check_hostsleep(dhd_pub, ioc->cmd, ioc->buf, len,
+                               &hostsleep_set, &hostsleep_val, &ret))
+                       goto exit;
+               ret = dhd_prot_ioctl(dhd_pub, ifidx, ioc, buf, len);
+               dhd_conf_get_hostsleep(dhd_pub, hostsleep_set, hostsleep_val, ret);
+
+#ifdef DUMP_IOCTL_IOV_LIST
+               if (ret == -ETIMEDOUT) {
+                       DHD_ERROR(("Last %d issued commands: Latest one is at bottom.\n",
+                               IOV_LIST_MAX_LEN));
+                       dhd_iov_li_print(&dhd_pub->dump_iovlist_head);
+               }
+#endif /* DUMP_IOCTL_IOV_LIST */
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+               if (ret == -ETIMEDOUT) {
+                       copy_hang_info_ioctl_timeout(dhd_pub, ifidx, ioc);
+               }
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+#ifdef DHD_LOG_DUMP
+               if ((ioc->cmd == WLC_GET_VAR || ioc->cmd == WLC_SET_VAR) &&
+                               buf != NULL) {
+                       if (buf) {
+                               lval = 0;
+                               slen = strlen(buf) + 1;
+                               msg = (char*)buf;
+                               if (len >= slen + sizeof(lval)) {
+                                       if (ioc->cmd == WLC_GET_VAR) {
+                                               msg = tmp;
+                                               lval = *(int*)buf;
+                                       } else {
+                                               min_len = MIN(ioc->len - slen, sizeof(int));
+                                               bcopy((msg + slen), &lval, min_len);
+                                       }
+                                       if (!strncmp(msg, "cur_etheraddr",
+                                               strlen("cur_etheraddr"))) {
+                                               lval = 0;
+                                       }
+                               }
+                               DHD_IOVAR_MEM((
+                                       "%s: cmd: %d, msg: %s val: 0x%x,"
+                                       " len: %d, set: %d, txn-id: %d\n",
+                                       ioc->cmd == WLC_GET_VAR ?
+                                       "WLC_GET_VAR" : "WLC_SET_VAR",
+                                       ioc->cmd, msg, lval, ioc->len, ioc->set,
+                                       dhd_prot_get_ioctl_trans_id(dhd_pub)));
+                       } else {
+                               DHD_IOVAR_MEM(("%s: cmd: %d, len: %d, set: %d, txn-id: %d\n",
+                                       ioc->cmd == WLC_GET_VAR ? "WLC_GET_VAR" : "WLC_SET_VAR",
+                                       ioc->cmd, ioc->len, ioc->set,
+                                       dhd_prot_get_ioctl_trans_id(dhd_pub)));
+                       }
+               } else {
+                       slen = ioc->len;
+                       if (buf != NULL && slen != 0) {
+                               if (slen >= 4) {
+                                       val = *(int*)buf;
+                               } else if (slen >= 2) {
+                                       val = *(short*)buf;
+                               } else {
+                                       val = *(char*)buf;
+                               }
+                               /* Do not dump for WLC_GET_MAGIC and WLC_GET_VERSION */
+                               if (ioc->cmd != WLC_GET_MAGIC && ioc->cmd != WLC_GET_VERSION) {
+                                       DHD_IOVAR_MEM(("WLC_IOCTL: cmd: %d, val: %d, len: %d, "
+                                               "set: %d\n", ioc->cmd, val, ioc->len, ioc->set));
+                               }
+                       } else {
+                               DHD_IOVAR_MEM(("WLC_IOCTL: cmd: %d, buf is NULL\n", ioc->cmd));
+                       }
+               }
+#endif /* DHD_LOG_DUMP */
+               if (ret && dhd_pub->up) {
+                       /* Send hang event only if dhd_open() was success */
+                       dhd_os_check_hang(dhd_pub, ifidx, ret);
+               }
+
+               if (ret == -ETIMEDOUT && !dhd_pub->up) {
+                       DHD_ERROR(("%s: 'resumed on timeout' error is "
+                               "occurred before the interface does not"
+                               " bring up\n", __FUNCTION__));
+               }
+
+exit:
+               DHD_LINUX_GENERAL_LOCK(dhd_pub, flags);
+               DHD_BUS_BUSY_CLEAR_IN_IOVAR(dhd_pub);
+               dhd_os_busbusy_wake(dhd_pub);
+               DHD_LINUX_GENERAL_UNLOCK(dhd_pub, flags);
+
+               dhd_os_proto_unblock(dhd_pub);
+
+#if 0
+               if (ret < 0) {
+                       if ((ioc->cmd == WLC_GET_VAR || ioc->cmd == WLC_SET_VAR) &&
+                                       buf != NULL) {
+                               if (ret == BCME_UNSUPPORTED || ret == BCME_NOTASSOCIATED) {
+                                       DHD_ERROR_MEM(("%s: %s: %s, %s\n",
+                                               __FUNCTION__, ioc->cmd == WLC_GET_VAR ?
+                                               "WLC_GET_VAR" : "WLC_SET_VAR",
+                                               buf? (char *)buf:"NO MESSAGE",
+                                               ret == BCME_UNSUPPORTED ? "UNSUPPORTED"
+                                               : "NOT ASSOCIATED"));
+                               } else {
+                                       DHD_ERROR_MEM(("%s: %s: %s, ret = %d\n",
+                                               __FUNCTION__, ioc->cmd == WLC_GET_VAR ?
+                                               "WLC_GET_VAR" : "WLC_SET_VAR",
+                                               (char *)buf, ret));
+                               }
+                       } else {
+                               if (ret == BCME_UNSUPPORTED || ret == BCME_NOTASSOCIATED) {
+                                       DHD_ERROR_MEM(("%s: WLC_IOCTL: cmd: %d, %s\n",
+                                               __FUNCTION__, ioc->cmd,
+                                               ret == BCME_UNSUPPORTED ? "UNSUPPORTED" :
+                                               "NOT ASSOCIATED"));
+                               } else {
+                                       DHD_ERROR_MEM(("%s: WLC_IOCTL: cmd: %d, ret = %d\n",
+                                               __FUNCTION__, ioc->cmd, ret));
+                               }
+                       }
+               }
+#endif
+       }
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       pm_runtime_mark_last_busy(dhd_bus_to_dev(dhd_pub->bus));
+       pm_runtime_put_autosuspend(dhd_bus_to_dev(dhd_pub->bus));
+
+       DHD_OS_WAKE_UNLOCK(dhd_pub);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#ifdef WL_MONITOR
+       /* Intercept monitor ioctl here, add/del monitor if */
+       if (ret == BCME_OK && ioc->cmd == WLC_SET_MONITOR) {
+               int val = 0;
+               if (buf != NULL && len != 0) {
+                       if (len >= 4) {
+                               val = *(int*)buf;
+                       } else if (len >= 2) {
+                               val = *(short*)buf;
+                       } else {
+                               val = *(char*)buf;
+                       }
+               }
+               dhd_set_monitor(dhd_pub, ifidx, val);
+       }
+#endif /* WL_MONITOR */
+
+       return ret;
+}
+
+uint wl_get_port_num(wl_io_pport_t *io_pport)
+{
+       return 0;
+}
+
+/* Get bssidx from iovar params
+ * Input:   dhd_pub - pointer to dhd_pub_t
+ *         params  - IOVAR params
+ * Output:  idx            - BSS index
+ *         val     - ponter to the IOVAR arguments
+ */
+static int
+dhd_iovar_parse_bssidx(dhd_pub_t *dhd_pub, const char *params, uint32 *idx, const char **val)
+{
+       char *prefix = "bsscfg:";
+       uint32  bssidx;
+
+       if (!(strncmp(params, prefix, strlen(prefix)))) {
+               /* per bss setting should be prefixed with 'bsscfg:' */
+               const char *p = params + strlen(prefix);
+
+               /* Skip Name */
+               while (*p != '\0')
+                       p++;
+               /* consider null */
+               p = p + 1;
+               bcopy(p, &bssidx, sizeof(uint32));
+               /* Get corresponding dhd index */
+               bssidx = dhd_bssidx2idx(dhd_pub, htod32(bssidx));
+
+               if (bssidx >= DHD_MAX_IFS) {
+                       DHD_ERROR(("%s Wrong bssidx provided\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+
+               /* skip bss idx */
+               p += sizeof(uint32);
+               *val = p;
+               *idx = bssidx;
+       } else {
+               DHD_ERROR(("%s: bad parameter for per bss iovar\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       return BCME_OK;
+}
+
+#if defined(DHD_DEBUG) && defined(BCMDBUS)
+/* USB Device console input function */
+int dhd_bus_console_in(dhd_pub_t *dhd, uchar *msg, uint msglen)
+{
+       DHD_TRACE(("%s \n", __FUNCTION__));
+
+       return dhd_iovar(dhd, 0, "cons", msg, msglen, NULL, 0, TRUE);
+
+}
+#endif /* DHD_DEBUG && BCMDBUS  */
+
+#ifdef DHD_DEBUG
+int
+dhd_mem_debug(dhd_pub_t *dhd, uchar *msg, uint msglen)
+{
+       unsigned long int_arg = 0;
+       char *p;
+       char *end_ptr = NULL;
+       dhd_dbg_mwli_t *mw_li;
+       dll_t *item, *next;
+       /* check if mwalloc, mwquery or mwfree was supplied arguement with space */
+       p = bcmstrstr((char *)msg, " ");
+       if (p != NULL) {
+               /* space should be converted to null as separation flag for firmware */
+               *p = '\0';
+               /* store the argument in int_arg */
+               int_arg = bcm_strtoul(p+1, &end_ptr, 10);
+       }
+
+       if (!p && !strcmp(msg, "query")) {
+               /* lets query the list inetrnally */
+               if (dll_empty(dll_head_p(&dhd->mw_list_head))) {
+                       DHD_ERROR(("memwaste list is empty, call mwalloc < size > to allocate\n"));
+               } else {
+                       for (item = dll_head_p(&dhd->mw_list_head);
+                                       !dll_end(&dhd->mw_list_head, item); item = next) {
+                               next = dll_next_p(item);
+                               mw_li = (dhd_dbg_mwli_t *)CONTAINEROF(item, dhd_dbg_mwli_t, list);
+                               DHD_ERROR(("item: <id=%d, size=%d>\n", mw_li->id, mw_li->size));
+                       }
+               }
+       } else if (p && end_ptr && (*end_ptr == '\0') && !strcmp(msg, "alloc")) {
+               int32 alloc_handle;
+               /* convert size into KB and append as integer */
+               *((int32 *)(p+1)) = int_arg*1024;
+               *(p+1+sizeof(int32)) = '\0';
+
+               /* recalculated length -> 5 bytes for "alloc" + 4 bytes for size +
+                * 1 bytes for null caracter
+                */
+               msglen = strlen(msg) + sizeof(int32) + 1;
+               if (dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, msg, msglen+1, FALSE, 0) < 0) {
+                       DHD_ERROR(("IOCTL failed for memdebug alloc\n"));
+               }
+
+               /* returned allocated handle from dongle, basically address of the allocated unit */
+               alloc_handle = *((int32 *)msg);
+
+               /* add a node in the list with tuple <id, handle, size> */
+               if (alloc_handle == 0) {
+                       DHD_ERROR(("Reuqested size could not be allocated\n"));
+               } else if (!(mw_li = MALLOC(dhd->osh, sizeof(*mw_li)))) {
+                       DHD_ERROR(("mw list item allocation Failed\n"));
+               } else {
+                       mw_li->id = dhd->mw_id++;
+                       mw_li->handle = alloc_handle;
+                       mw_li->size = int_arg;
+                       /* append the node in the list */
+                       dll_append(&dhd->mw_list_head, &mw_li->list);
+               }
+       } else if (p && end_ptr && (*end_ptr == '\0') && !strcmp(msg, "free")) {
+               /* inform dongle to free wasted chunk */
+               int handle = 0;
+               int size = 0;
+               for (item = dll_head_p(&dhd->mw_list_head);
+                               !dll_end(&dhd->mw_list_head, item); item = next) {
+                       next = dll_next_p(item);
+                       mw_li = (dhd_dbg_mwli_t *)CONTAINEROF(item, dhd_dbg_mwli_t, list);
+
+                       if (mw_li->id == (int)int_arg) {
+                               handle = mw_li->handle;
+                               size = mw_li->size;
+                               dll_delete(item);
+                               MFREE(dhd->osh, mw_li, sizeof(*mw_li));
+                               if (dll_empty(dll_head_p(&dhd->mw_list_head))) {
+                                       /* reset the id */
+                                       dhd->mw_id = 0;
+                               }
+                       }
+               }
+               if (handle) {
+                       int len;
+                       /* append the free handle and the chunk size in first 8 bytes
+                        * after the command and null character
+                        */
+                       *((int32 *)(p+1)) = handle;
+                       *((int32 *)((p+1)+sizeof(int32))) = size;
+                       /* append null as terminator */
+                       *(p+1+2*sizeof(int32)) = '\0';
+                       /* recalculated length -> 4 bytes for "free" + 8 bytes for hadnle and size
+                        * + 1 bytes for null caracter
+                        */
+                       len = strlen(msg) + 2*sizeof(int32) + 1;
+                       /* send iovar to free the chunk */
+                       if (dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, msg, len, FALSE, 0) < 0) {
+                               DHD_ERROR(("IOCTL failed for memdebug free\n"));
+                       }
+               } else {
+                       DHD_ERROR(("specified id does not exist\n"));
+               }
+       } else {
+               /* for all the wrong argument formats */
+               return BCME_BADARG;
+       }
+       return 0;
+}
+extern void
+dhd_mw_list_delete(dhd_pub_t *dhd, dll_t *list_head)
+{
+       dll_t *item;
+       dhd_dbg_mwli_t *mw_li;
+       while (!(dll_empty(list_head))) {
+               item = dll_head_p(list_head);
+               mw_li = (dhd_dbg_mwli_t *)CONTAINEROF(item, dhd_dbg_mwli_t, list);
+               dll_delete(item);
+               MFREE(dhd->osh, mw_li, sizeof(*mw_li));
+       }
+}
+#ifdef BCMPCIE
+int
+dhd_flow_ring_debug(dhd_pub_t *dhd, char *msg, uint msglen)
+{
+       flow_ring_table_t *flow_ring_table;
+       char *cmd;
+       char *end_ptr = NULL;
+       uint8 prio;
+       uint16 flowid;
+       int i;
+       int ret = 0;
+       cmd = bcmstrstr(msg, " ");
+       BCM_REFERENCE(prio);
+       if (cmd != NULL) {
+               /* in order to use string operations append null */
+               *cmd = '\0';
+       } else {
+               DHD_ERROR(("missing: create/delete args\n"));
+               return BCME_ERROR;
+       }
+       if (cmd && !strcmp(msg, "create")) {
+               /* extract <"source address", "destination address", "priority"> */
+               uint8 sa[ETHER_ADDR_LEN], da[ETHER_ADDR_LEN];
+               BCM_REFERENCE(sa);
+               BCM_REFERENCE(da);
+               msg = msg + strlen("create") + 1;
+               /* fill ethernet source address */
+               for (i = 0; i < ETHER_ADDR_LEN; i++) {
+                       sa[i] = (uint8)bcm_strtoul(msg, &end_ptr, 16);
+                       if (*end_ptr == ':') {
+                               msg = (end_ptr + 1);
+                       } else if (i != 5) {
+                               DHD_ERROR(("not a valid source mac addr\n"));
+                               return BCME_ERROR;
+                       }
+               }
+               if (*end_ptr != ' ') {
+                       DHD_ERROR(("missing: destiantion mac id\n"));
+                       return BCME_ERROR;
+               } else {
+                       /* skip space */
+                       msg = end_ptr + 1;
+               }
+               /* fill ethernet destination address */
+               for (i = 0; i < ETHER_ADDR_LEN; i++) {
+                       da[i] = (uint8)bcm_strtoul(msg, &end_ptr, 16);
+                       if (*end_ptr == ':') {
+                               msg = (end_ptr + 1);
+                       } else if (i != 5) {
+                               DHD_ERROR(("not a valid destination  mac addr\n"));
+                               return BCME_ERROR;
+                       }
+               }
+               if (*end_ptr != ' ') {
+                       DHD_ERROR(("missing: priority\n"));
+                       return BCME_ERROR;
+               } else {
+                       msg = end_ptr + 1;
+               }
+               /* parse priority */
+               prio = (uint8)bcm_strtoul(msg, &end_ptr, 10);
+               if (prio > MAXPRIO) {
+                       DHD_ERROR(("%s: invalid priority. Must be between 0-7 inclusive\n",
+                               __FUNCTION__));
+                       return BCME_ERROR;
+               }
+
+               if (*end_ptr != '\0') {
+                       DHD_ERROR(("msg not truncated with NULL character\n"));
+                       return BCME_ERROR;
+               }
+               ret = dhd_flowid_debug_create(dhd, 0, prio, (char *)sa, (char *)da, &flowid);
+               if (ret != BCME_OK) {
+                       DHD_ERROR(("%s: flowring creation failed ret: %d\n", __FUNCTION__, ret));
+                       return BCME_ERROR;
+               }
+               return BCME_OK;
+
+       } else if (cmd && !strcmp(msg, "delete")) {
+               msg = msg + strlen("delete") + 1;
+               /* parse flowid */
+               flowid = (uint16)bcm_strtoul(msg, &end_ptr, 10);
+               if (*end_ptr != '\0') {
+                       DHD_ERROR(("msg not truncated with NULL character\n"));
+                       return BCME_ERROR;
+               }
+
+               /* Find flowid from ifidx 0 since this IOVAR creating flowring with ifidx 0 */
+               if (dhd_flowid_find_by_ifidx(dhd, 0, flowid) != BCME_OK)
+               {
+                       DHD_ERROR(("%s : Deleting not created flowid: %u\n", __FUNCTION__, flowid));
+                       return BCME_ERROR;
+               }
+
+               flow_ring_table = (flow_ring_table_t *)dhd->flow_ring_table;
+               ret = dhd_bus_flow_ring_delete_request(dhd->bus, (void *)&flow_ring_table[flowid]);
+               if (ret != BCME_OK) {
+                       DHD_ERROR(("%s: flowring deletion failed ret: %d\n", __FUNCTION__, ret));
+                       return BCME_ERROR;
+               }
+               return BCME_OK;
+       }
+       DHD_ERROR(("%s: neither create nor delete\n", __FUNCTION__));
+       return BCME_ERROR;
+}
+#endif /* BCMPCIE */
+#endif /* DHD_DEBUG */
+
+static int
+dhd_doiovar(dhd_pub_t *dhd_pub, const bcm_iovar_t *vi, uint32 actionid, const char *name,
+            void *params, int plen, void *arg, uint len, int val_size)
+{
+       int bcmerror = 0;
+       int32 int_val = 0;
+       uint32 dhd_ver_len, bus_api_rev_len;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+       DHD_TRACE(("%s: actionid = %d; name %s\n", __FUNCTION__, actionid, name));
+
+       if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid))) != 0)
+               goto exit;
+
+       if (plen >= (int)sizeof(int_val))
+               bcopy(params, &int_val, sizeof(int_val));
+
+       switch (actionid) {
+       case IOV_GVAL(IOV_VERSION):
+               /* Need to have checked buffer length */
+               dhd_ver_len = sizeof(dhd_version) - 1;
+               bus_api_rev_len = strlen(bus_api_revision);
+               if (len > dhd_ver_len + bus_api_rev_len) {
+                       bcmerror = memcpy_s((char *)arg, len, dhd_version, dhd_ver_len);
+                       if (bcmerror != BCME_OK) {
+                               break;
+                       }
+                       bcmerror = memcpy_s((char *)arg + dhd_ver_len, len - dhd_ver_len,
+                               bus_api_revision, bus_api_rev_len);
+                       if (bcmerror != BCME_OK) {
+                               break;
+                       }
+                       *((char *)arg + dhd_ver_len + bus_api_rev_len) = '\0';
+               }
+#if defined(BCMSDIO) && defined(PKT_STATICS)
+               dhd_bus_clear_txpktstatics(dhd_pub->bus);
+#endif
+               break;
+
+       case IOV_GVAL(IOV_WLMSGLEVEL):
+               printf("android_msg_level=0x%x\n", android_msg_level);
+               printf("config_msg_level=0x%x\n", config_msg_level);
+#if defined(WL_WIRELESS_EXT)
+               int_val = (int32)iw_msg_level;
+               bcopy(&int_val, arg, val_size);
+               printf("iw_msg_level=0x%x\n", iw_msg_level);
+#endif
+#ifdef WL_CFG80211
+               int_val = (int32)wl_dbg_level;
+               bcopy(&int_val, arg, val_size);
+               printf("cfg_msg_level=0x%x\n", wl_dbg_level);
+#endif
+               break;
+
+       case IOV_SVAL(IOV_WLMSGLEVEL):
+               if (int_val & DHD_ANDROID_VAL) {
+                       android_msg_level = (uint)(int_val & 0xFFFF);
+                       printf("android_msg_level=0x%x\n", android_msg_level);
+               }
+               if (int_val & DHD_CONFIG_VAL) {
+                       config_msg_level = (uint)(int_val & 0xFFFF);
+                       printf("config_msg_level=0x%x\n", config_msg_level);
+               }
+#if defined(WL_WIRELESS_EXT)
+               if (int_val & DHD_IW_VAL) {
+                       iw_msg_level = (uint)(int_val & 0xFFFF);
+                       printf("iw_msg_level=0x%x\n", iw_msg_level);
+               }
+#endif
+#ifdef WL_CFG80211
+               if (int_val & DHD_CFG_VAL) {
+                       wl_cfg80211_enable_trace((u32)(int_val & 0xFFFF));
+               }
+#endif
+               break;
+
+       case IOV_GVAL(IOV_MSGLEVEL):
+               int_val = (int32)dhd_msg_level;
+               bcopy(&int_val, arg, val_size);
+#if defined(BCMSDIO) && defined(PKT_STATICS)
+               dhd_bus_dump_txpktstatics(dhd_pub->bus);
+#endif
+               break;
+
+       case IOV_SVAL(IOV_MSGLEVEL):
+               dhd_msg_level = int_val;
+               break;
+
+       case IOV_GVAL(IOV_BCMERRORSTR):
+               bcm_strncpy_s((char *)arg, len, bcmerrorstr(dhd_pub->bcmerror), BCME_STRLEN);
+               ((char *)arg)[BCME_STRLEN - 1] = 0x00;
+               break;
+
+       case IOV_GVAL(IOV_BCMERROR):
+               int_val = (int32)dhd_pub->bcmerror;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+#ifndef BCMDBUS
+       case IOV_GVAL(IOV_WDTICK):
+#ifdef HOST_TPUT_TEST
+               if (dhd_pub->net_ts.tv_sec == 0 && dhd_pub->net_ts.tv_nsec == 0) {
+                       osl_do_gettimeofday(&dhd_pub->net_ts);
+               } else {
+                       struct osl_timespec cur_ts;
+                       uint32 diff_ms;
+                       osl_do_gettimeofday(&cur_ts);
+                       diff_ms = osl_do_gettimediff(&cur_ts, &dhd_pub->net_ts)/1000;
+                       int_val = (int32)((dhd_pub->net_len/1024/1024)*8)*1000/diff_ms;
+                       dhd_pub->net_len = 0;
+                       memcpy(&dhd_pub->net_ts, &cur_ts, sizeof(struct osl_timespec));
+                       bcopy(&int_val, arg, sizeof(int_val));
+               }
+#else
+               int_val = (int32)dhd_watchdog_ms;
+               bcopy(&int_val, arg, val_size);
+#endif
+               break;
+#endif /* !BCMDBUS */
+
+       case IOV_SVAL(IOV_WDTICK):
+               if (!dhd_pub->up) {
+                       bcmerror = BCME_NOTUP;
+                       break;
+               }
+
+               dhd_watchdog_ms = (uint)int_val;
+
+               dhd_os_wd_timer(dhd_pub, (uint)int_val);
+               break;
+
+       case IOV_GVAL(IOV_DUMP):
+               if (dhd_dump(dhd_pub, arg, len) <= 0)
+                       bcmerror = BCME_ERROR;
+               else
+                       bcmerror = BCME_OK;
+               break;
+
+#ifndef BCMDBUS
+       case IOV_GVAL(IOV_DCONSOLE_POLL):
+               int_val = (int32)dhd_pub->dhd_console_ms;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DCONSOLE_POLL):
+               dhd_pub->dhd_console_ms = (uint)int_val;
+               break;
+
+#if defined(DHD_DEBUG)
+       case IOV_SVAL(IOV_CONS):
+               if (len > 0) {
+#ifdef CONSOLE_DPC
+                       bcmerror = dhd_bus_txcons(dhd_pub, arg, len - 1);
+#else
+                       bcmerror = dhd_bus_console_in(dhd_pub, arg, len - 1);
+#endif
+               }
+               break;
+#endif /* DHD_DEBUG */
+#endif /* !BCMDBUS */
+
+       case IOV_SVAL(IOV_CLEARCOUNTS):
+               dhd_pub->tx_packets = dhd_pub->rx_packets = 0;
+               dhd_pub->tx_errors = dhd_pub->rx_errors = 0;
+               dhd_pub->tx_ctlpkts = dhd_pub->rx_ctlpkts = 0;
+               dhd_pub->tx_ctlerrs = dhd_pub->rx_ctlerrs = 0;
+               dhd_pub->tx_dropped = 0;
+               dhd_pub->rx_dropped = 0;
+               dhd_pub->tx_pktgetfail = 0;
+               dhd_pub->rx_pktgetfail = 0;
+               dhd_pub->rx_readahead_cnt = 0;
+               dhd_pub->tx_realloc = 0;
+               dhd_pub->wd_dpc_sched = 0;
+               dhd_pub->tx_big_packets = 0;
+               memset(&dhd_pub->dstats, 0, sizeof(dhd_pub->dstats));
+               dhd_bus_clearcounts(dhd_pub);
+#ifdef PROP_TXSTATUS
+               /* clear proptxstatus related counters */
+               dhd_wlfc_clear_counts(dhd_pub);
+#endif /* PROP_TXSTATUS */
+#if defined(DHD_LB_STATS)
+               DHD_LB_STATS_RESET(dhd_pub);
+#endif /* DHD_LB_STATS */
+               break;
+
+       case IOV_GVAL(IOV_IOCTLTIMEOUT): {
+#ifdef HOST_TPUT_TEST
+               if (dhd_pub->bus_ts.tv_sec == 0 && dhd_pub->bus_ts.tv_nsec == 0) {
+                       osl_do_gettimeofday(&dhd_pub->bus_ts);
+               } else {
+                       struct osl_timespec cur_ts;
+                       uint32 diff_ms;
+                       osl_do_gettimeofday(&cur_ts);
+                       diff_ms = osl_do_gettimediff(&cur_ts, &dhd_pub->bus_ts)/1000;
+                       int_val = (int32)((dhd_pub->dstats.tx_bytes/1024/1024)*8)*1000/diff_ms;
+                       dhd_pub->dstats.tx_bytes = 0;
+                       memcpy(&dhd_pub->bus_ts, &cur_ts, sizeof(struct osl_timespec));
+                       bcopy(&int_val, arg, sizeof(int_val));
+               }
+#else
+               int_val = (int32)dhd_os_get_ioctl_resp_timeout();
+               bcopy(&int_val, arg, sizeof(int_val));
+#endif
+               break;
+       }
+
+       case IOV_SVAL(IOV_IOCTLTIMEOUT): {
+               if (int_val <= 0)
+                       bcmerror = BCME_BADARG;
+               else
+                       dhd_os_set_ioctl_resp_timeout((unsigned int)int_val);
+               break;
+       }
+
+#ifdef PROP_TXSTATUS
+       case IOV_GVAL(IOV_PROPTXSTATUS_ENABLE): {
+               bool wlfc_enab = FALSE;
+               bcmerror = dhd_wlfc_get_enable(dhd_pub, &wlfc_enab);
+               if (bcmerror != BCME_OK)
+                       goto exit;
+               int_val = wlfc_enab ? 1 : 0;
+               bcopy(&int_val, arg, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_PROPTXSTATUS_ENABLE): {
+               bool wlfc_enab = FALSE;
+               bcmerror = dhd_wlfc_get_enable(dhd_pub, &wlfc_enab);
+               if (bcmerror != BCME_OK)
+                       goto exit;
+
+               /* wlfc is already set as desired */
+               if (wlfc_enab == (int_val == 0 ? FALSE : TRUE))
+                       goto exit;
+
+               if (int_val == TRUE)
+                       bcmerror = dhd_wlfc_init(dhd_pub);
+               else
+                       bcmerror = dhd_wlfc_deinit(dhd_pub);
+
+               break;
+       }
+       case IOV_GVAL(IOV_PROPTXSTATUS_MODE):
+               bcmerror = dhd_wlfc_get_mode(dhd_pub, &int_val);
+               if (bcmerror != BCME_OK)
+                       goto exit;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_PROPTXSTATUS_MODE):
+               dhd_wlfc_set_mode(dhd_pub, int_val);
+               break;
+
+       case IOV_GVAL(IOV_PROPTXSTATUS_MODULE_IGNORE):
+               bcmerror = dhd_wlfc_get_module_ignore(dhd_pub, &int_val);
+               if (bcmerror != BCME_OK)
+                       goto exit;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_PROPTXSTATUS_MODULE_IGNORE):
+               dhd_wlfc_set_module_ignore(dhd_pub, int_val);
+               break;
+
+       case IOV_GVAL(IOV_PROPTXSTATUS_CREDIT_IGNORE):
+               bcmerror = dhd_wlfc_get_credit_ignore(dhd_pub, &int_val);
+               if (bcmerror != BCME_OK)
+                       goto exit;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_PROPTXSTATUS_CREDIT_IGNORE):
+               dhd_wlfc_set_credit_ignore(dhd_pub, int_val);
+               break;
+
+       case IOV_GVAL(IOV_PROPTXSTATUS_TXSTATUS_IGNORE):
+               bcmerror = dhd_wlfc_get_txstatus_ignore(dhd_pub, &int_val);
+               if (bcmerror != BCME_OK)
+                       goto exit;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_PROPTXSTATUS_TXSTATUS_IGNORE):
+               dhd_wlfc_set_txstatus_ignore(dhd_pub, int_val);
+               break;
+
+       case IOV_GVAL(IOV_PROPTXSTATUS_RXPKT_CHK):
+               bcmerror = dhd_wlfc_get_rxpkt_chk(dhd_pub, &int_val);
+               if (bcmerror != BCME_OK)
+                       goto exit;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_PROPTXSTATUS_RXPKT_CHK):
+               dhd_wlfc_set_rxpkt_chk(dhd_pub, int_val);
+               break;
+
+#endif /* PROP_TXSTATUS */
+
+       case IOV_GVAL(IOV_BUS_TYPE):
+               /* The dhd application queries the driver to check if its usb or sdio.  */
+#ifdef BCMDBUS
+               int_val = BUS_TYPE_USB;
+#endif
+#ifdef BCMSDIO
+               int_val = BUS_TYPE_SDIO;
+#endif
+#ifdef PCIE_FULL_DONGLE
+               int_val = BUS_TYPE_PCIE;
+#endif
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_CHANGEMTU):
+               int_val &= 0xffff;
+               bcmerror = dhd_change_mtu(dhd_pub, int_val, 0);
+               break;
+
+       case IOV_GVAL(IOV_HOSTREORDER_FLOWS):
+       {
+               uint i = 0;
+               uint8 *ptr = (uint8 *)arg;
+               uint8 count = 0;
+
+               ptr++;
+               for (i = 0; i < WLHOST_REORDERDATA_MAXFLOWS; i++) {
+                       if (dhd_pub->reorder_bufs[i] != NULL) {
+                               *ptr = dhd_pub->reorder_bufs[i]->flow_id;
+                               ptr++;
+                               count++;
+                       }
+               }
+               ptr = (uint8 *)arg;
+               *ptr = count;
+               break;
+       }
+#ifdef DHDTCPACK_SUPPRESS
+       case IOV_GVAL(IOV_TCPACK_SUPPRESS): {
+               int_val = (uint32)dhd_pub->tcpack_sup_mode;
+               bcopy(&int_val, arg, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_TCPACK_SUPPRESS): {
+               bcmerror = dhd_tcpack_suppress_set(dhd_pub, (uint8)int_val);
+               break;
+       }
+#endif /* DHDTCPACK_SUPPRESS */
+
+#ifdef DHD_L2_FILTER
+       case IOV_GVAL(IOV_DHCP_UNICAST): {
+               uint32 bssidx;
+               const char *val;
+               if (dhd_iovar_parse_bssidx(dhd_pub, name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_DHCP_UNICAST: bad parameterand name = %s\n",
+                               __FUNCTION__, name));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               int_val = dhd_get_dhcp_unicast_status(dhd_pub, bssidx);
+               memcpy(arg, &int_val, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_DHCP_UNICAST): {
+               uint32  bssidx;
+               const char *val;
+               if (dhd_iovar_parse_bssidx(dhd_pub, name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_DHCP_UNICAST: bad parameterand name = %s\n",
+                               __FUNCTION__, name));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               memcpy(&int_val, val, sizeof(int_val));
+               bcmerror = dhd_set_dhcp_unicast_status(dhd_pub, bssidx, int_val ? 1 : 0);
+               break;
+       }
+       case IOV_GVAL(IOV_BLOCK_PING): {
+               uint32 bssidx;
+               const char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_BLOCK_PING: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               int_val = dhd_get_block_ping_status(dhd_pub, bssidx);
+               memcpy(arg, &int_val, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_BLOCK_PING): {
+               uint32  bssidx;
+               const char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_BLOCK_PING: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               memcpy(&int_val, val, sizeof(int_val));
+               bcmerror = dhd_set_block_ping_status(dhd_pub, bssidx, int_val ? 1 : 0);
+               break;
+       }
+       case IOV_GVAL(IOV_PROXY_ARP): {
+               uint32  bssidx;
+               const char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_PROXY_ARP: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               int_val = dhd_get_parp_status(dhd_pub, bssidx);
+               bcopy(&int_val, arg, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_PROXY_ARP): {
+               uint32  bssidx;
+               const char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_PROXY_ARP: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               bcopy(val, &int_val, sizeof(int_val));
+
+               /* Issue a iovar request to WL to update the proxy arp capability bit
+                * in the Extended Capability IE of beacons/probe responses.
+                */
+               bcmerror = dhd_iovar(dhd_pub, bssidx, "proxy_arp_advertise", val, sizeof(int_val),
+                               NULL, 0, TRUE);
+               if (bcmerror == BCME_OK) {
+                       dhd_set_parp_status(dhd_pub, bssidx, int_val ? 1 : 0);
+               }
+               break;
+       }
+       case IOV_GVAL(IOV_GRAT_ARP): {
+               uint32 bssidx;
+               const char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_GRAT_ARP: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               int_val = dhd_get_grat_arp_status(dhd_pub, bssidx);
+               memcpy(arg, &int_val, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_GRAT_ARP): {
+               uint32  bssidx;
+               const char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_GRAT_ARP: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               memcpy(&int_val, val, sizeof(int_val));
+               bcmerror = dhd_set_grat_arp_status(dhd_pub, bssidx, int_val ? 1 : 0);
+               break;
+       }
+       case IOV_GVAL(IOV_BLOCK_TDLS): {
+               uint32 bssidx;
+               const char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_BLOCK_TDLS: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               int_val = dhd_get_block_tdls_status(dhd_pub, bssidx);
+               memcpy(arg, &int_val, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_BLOCK_TDLS): {
+               uint32  bssidx;
+               const char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_BLOCK_TDLS: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               memcpy(&int_val, val, sizeof(int_val));
+               bcmerror = dhd_set_block_tdls_status(dhd_pub, bssidx, int_val ? 1 : 0);
+               break;
+       }
+#endif /* DHD_L2_FILTER */
+       case IOV_SVAL(IOV_DHD_IE): {
+               uint32  bssidx;
+               const char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: dhd ie: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               break;
+       }
+       case IOV_GVAL(IOV_AP_ISOLATE): {
+               uint32  bssidx;
+               const char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: ap isoalate: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               int_val = dhd_get_ap_isolate(dhd_pub, bssidx);
+               bcopy(&int_val, arg, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_AP_ISOLATE): {
+               uint32  bssidx;
+               const char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: ap isolate: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               ASSERT(val);
+               bcopy(val, &int_val, sizeof(uint32));
+               dhd_set_ap_isolate(dhd_pub, bssidx, int_val);
+               break;
+       }
+#ifdef DHD_PSTA
+       case IOV_GVAL(IOV_PSTA): {
+               int_val = dhd_get_psta_mode(dhd_pub);
+               bcopy(&int_val, arg, val_size);
+               break;
+               }
+       case IOV_SVAL(IOV_PSTA): {
+               if (int_val >= DHD_MODE_PSTA_DISABLED && int_val <= DHD_MODE_PSR) {
+                       dhd_set_psta_mode(dhd_pub, int_val);
+               } else {
+                       bcmerror = BCME_RANGE;
+               }
+               break;
+               }
+#endif /* DHD_PSTA */
+#ifdef DHD_WET
+       case IOV_GVAL(IOV_WET):
+                int_val = dhd_get_wet_mode(dhd_pub);
+                bcopy(&int_val, arg, val_size);
+                break;
+
+       case IOV_SVAL(IOV_WET):
+                if (int_val == 0 || int_val == 1) {
+                        dhd_set_wet_mode(dhd_pub, int_val);
+                        /* Delete the WET DB when disabled */
+                        if (!int_val) {
+                                dhd_wet_sta_delete_list(dhd_pub);
+                        }
+                } else {
+                        bcmerror = BCME_RANGE;
+                }
+                                break;
+       case IOV_SVAL(IOV_WET_HOST_IPV4):
+                       dhd_set_wet_host_ipv4(dhd_pub, params, plen);
+                       break;
+       case IOV_SVAL(IOV_WET_HOST_MAC):
+                       dhd_set_wet_host_mac(dhd_pub, params, plen);
+               break;
+#endif /* DHD_WET */
+#ifdef DHD_MCAST_REGEN
+       case IOV_GVAL(IOV_MCAST_REGEN_BSS_ENABLE): {
+               uint32  bssidx;
+               const char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: mcast_regen_bss_enable: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               int_val = dhd_get_mcast_regen_bss_enable(dhd_pub, bssidx);
+               bcopy(&int_val, arg, val_size);
+               break;
+       }
+
+       case IOV_SVAL(IOV_MCAST_REGEN_BSS_ENABLE): {
+               uint32  bssidx;
+               const char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: mcast_regen_bss_enable: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               ASSERT(val);
+               bcopy(val, &int_val, sizeof(uint32));
+               dhd_set_mcast_regen_bss_enable(dhd_pub, bssidx, int_val);
+               break;
+       }
+#endif /* DHD_MCAST_REGEN */
+
+       case IOV_GVAL(IOV_CFG80211_OPMODE): {
+               int_val = (int32)dhd_pub->op_mode;
+               bcopy(&int_val, arg, sizeof(int_val));
+               break;
+               }
+       case IOV_SVAL(IOV_CFG80211_OPMODE): {
+               if (int_val <= 0)
+                       bcmerror = BCME_BADARG;
+               else
+                       dhd_pub->op_mode = int_val;
+               break;
+       }
+
+       case IOV_GVAL(IOV_ASSERT_TYPE):
+               int_val = g_assert_type;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_ASSERT_TYPE):
+               g_assert_type = (uint32)int_val;
+               break;
+
+       case IOV_GVAL(IOV_LMTEST): {
+               *(uint32 *)arg = (uint32)lmtest;
+               break;
+       }
+
+       case IOV_SVAL(IOV_LMTEST): {
+               uint32 val = *(uint32 *)arg;
+               if (val > 50)
+                       bcmerror = BCME_BADARG;
+               else {
+                       lmtest = (uint)val;
+                       DHD_ERROR(("%s: lmtest %s\n",
+                               __FUNCTION__, (lmtest == FALSE)? "OFF" : "ON"));
+               }
+               break;
+       }
+
+#ifdef SHOW_LOGTRACE
+       case IOV_GVAL(IOV_DUMP_TRACE_LOG): {
+               trace_buf_info_t *trace_buf_info = (trace_buf_info_t *)arg;
+               dhd_dbg_ring_t *dbg_verbose_ring = NULL;
+
+               dbg_verbose_ring = dhd_dbg_get_ring_from_ring_id(dhd_pub, FW_VERBOSE_RING_ID);
+               if (dbg_verbose_ring == NULL) {
+                       DHD_ERROR(("dbg_verbose_ring is NULL\n"));
+                       bcmerror = BCME_UNSUPPORTED;
+                       break;
+               }
+
+               if (trace_buf_info != NULL) {
+                       bzero(trace_buf_info, sizeof(trace_buf_info_t));
+                       dhd_dbg_read_ring_into_trace_buf(dbg_verbose_ring, trace_buf_info);
+               } else {
+                       DHD_ERROR(("%s: arg is NULL\n", __FUNCTION__));
+                       bcmerror = BCME_NOMEM;
+               }
+               break;
+       }
+#endif /* SHOW_LOGTRACE */
+#ifdef DHD_DEBUG
+#if defined(BCMSDIO) || defined(BCMPCIE)
+       case IOV_GVAL(IOV_DONGLE_TRAP_TYPE):
+               if (dhd_pub->dongle_trap_occured)
+                       int_val = ltoh32(dhd_pub->last_trap_info.type);
+               else
+                       int_val = 0;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_DONGLE_TRAP_INFO):
+       {
+               struct bcmstrbuf strbuf;
+               bcm_binit(&strbuf, arg, len);
+               if (dhd_pub->dongle_trap_occured == FALSE) {
+                       bcm_bprintf(&strbuf, "no trap recorded\n");
+                       break;
+               }
+               dhd_bus_dump_trap_info(dhd_pub->bus, &strbuf);
+               break;
+       }
+
+       case IOV_GVAL(IOV_BPADDR):
+               {
+                       sdreg_t sdreg;
+                       uint32 addr, size;
+
+                       memcpy(&sdreg, params, sizeof(sdreg));
+
+                       addr = sdreg.offset;
+                       size = sdreg.func;
+
+                       bcmerror = dhd_bus_readwrite_bp_addr(dhd_pub, addr, size,
+                               (uint *)&int_val, TRUE);
+
+                       memcpy(arg, &int_val, sizeof(int32));
+
+                       break;
+               }
+
+       case IOV_SVAL(IOV_BPADDR):
+               {
+                       sdreg_t sdreg;
+                       uint32 addr, size;
+
+                       memcpy(&sdreg, params, sizeof(sdreg));
+
+                       addr = sdreg.offset;
+                       size = sdreg.func;
+
+                       bcmerror = dhd_bus_readwrite_bp_addr(dhd_pub, addr, size,
+                               (uint *)&sdreg.value,
+                               FALSE);
+
+                       break;
+               }
+#endif /* BCMSDIO || BCMPCIE */
+#ifdef BCMPCIE
+       case IOV_SVAL(IOV_FLOW_RING_DEBUG):
+               {
+                       bcmerror = dhd_flow_ring_debug(dhd_pub, arg, len);
+                       break;
+               }
+#endif /* BCMPCIE */
+       case IOV_SVAL(IOV_MEM_DEBUG):
+               if (len > 0) {
+                       bcmerror = dhd_mem_debug(dhd_pub, arg, len - 1);
+               }
+               break;
+#endif /* DHD_DEBUG */
+#if defined(DHD_LOG_DUMP)
+       case IOV_GVAL(IOV_LOG_DUMP):
+               {
+                       dhd_prot_debug_info_print(dhd_pub);
+                       dhd_log_dump_trigger(dhd_pub, CMD_DEFAULT);
+                       break;
+               }
+#endif /* DHD_LOG_DUMP */
+
+       case IOV_GVAL(IOV_TPUT_TEST):
+               {
+                       tput_test_t *tput_data = NULL;
+                       if (params && plen >= sizeof(tput_test_t)) {
+                               tput_data = (tput_test_t *)params;
+                               bcmerror = dhd_tput_test(dhd_pub, tput_data);
+                       } else {
+                               DHD_ERROR(("%s: tput test - no input params ! \n", __FUNCTION__));
+                               bcmerror = BCME_BADARG;
+                       }
+                       break;
+               }
+       case IOV_GVAL(IOV_DEBUG_BUF_DEST_STAT):
+               {
+                       if (dhd_pub->debug_buf_dest_support) {
+                               debug_buf_dest_stat_t *debug_buf_dest_stat =
+                                       (debug_buf_dest_stat_t *)arg;
+                               memcpy(debug_buf_dest_stat, dhd_pub->debug_buf_dest_stat,
+                                       sizeof(dhd_pub->debug_buf_dest_stat));
+                       } else {
+                               bcmerror = BCME_DISABLED;
+                       }
+                       break;
+               }
+
+#if defined(DHD_SSSR_DUMP)
+       case IOV_GVAL(IOV_FIS_TRIGGER):
+               bcmerror = dhd_bus_fis_trigger(dhd_pub);
+
+               if (bcmerror == BCME_OK) {
+                       bcmerror = dhd_bus_fis_dump(dhd_pub);
+               }
+
+               int_val = bcmerror;
+               bcopy(&int_val, arg, val_size);
+               break;
+#endif /* defined(DHD_SSSR_DUMP) */
+
+#ifdef DHD_DEBUG
+       case IOV_SVAL(IOV_INDUCE_ERROR): {
+               if (int_val >= DHD_INDUCE_ERROR_MAX) {
+                       DHD_ERROR(("%s: Invalid command : %u\n", __FUNCTION__, (uint16)int_val));
+               } else {
+                       dhd_pub->dhd_induce_error = (uint16)int_val;
+               }
+               break;
+       }
+#endif /* DHD_DEBUG */
+#ifdef RTT_GEOFENCE_CONT
+#if defined(RTT_SUPPORT) && defined(WL_NAN)
+       case IOV_GVAL(IOV_RTT_GEOFENCE_TYPE_OVRD): {
+               bool enable = 0;
+               dhd_rtt_get_geofence_cont_ind(dhd_pub, &enable);
+               int_val = enable ? 1 : 0;
+               bcopy(&int_val, arg, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_RTT_GEOFENCE_TYPE_OVRD): {
+               bool enable = *(bool *)arg;
+               dhd_rtt_set_geofence_cont_ind(dhd_pub, enable);
+               break;
+       }
+#endif /* RTT_SUPPORT && WL_NAN */
+#endif /* RTT_GEOFENCE_CONT */
+       case IOV_GVAL(IOV_FW_VBS): {
+               *(uint32 *)arg = (uint32)dhd_dbg_get_fwverbose(dhd_pub);
+               break;
+       }
+
+       case IOV_SVAL(IOV_FW_VBS): {
+               if (int_val < 0) {
+                       int_val = 0;
+               }
+               dhd_dbg_set_fwverbose(dhd_pub, (uint32)int_val);
+               break;
+       }
+
+#ifdef DHD_TX_PROFILE
+       case IOV_SVAL(IOV_TX_PROFILE_TAG):
+       {
+               /* note: under the current implementation only one type of packet may be
+                * tagged per profile
+                */
+               const dhd_tx_profile_protocol_t *protocol = NULL;
+               /* for example, we might have a profile of profile_index 6, but at
+                * offset 2 from dhd_pub->protocol_filters.
+                */
+               uint8 offset;
+
+               if (params == NULL) {
+                       bcmerror = BCME_ERROR;
+                       break;
+               }
+
+               protocol = (dhd_tx_profile_protocol_t *)params;
+
+               /* validate */
+               if (protocol->version != DHD_TX_PROFILE_VERSION) {
+                       bcmerror = BCME_VERSION;
+                       break;
+               }
+               if (protocol->profile_index > DHD_MAX_PROFILE_INDEX) {
+                       DHD_ERROR(("%s:\tprofile index must be between 0 and %d\n",
+                                       __FUNCTION__, DHD_MAX_PROFILE_INDEX));
+                       bcmerror = BCME_RANGE;
+                       break;
+               }
+               if (protocol->layer != DHD_TX_PROFILE_DATA_LINK_LAYER && protocol->layer
+                               != DHD_TX_PROFILE_NETWORK_LAYER) {
+                       DHD_ERROR(("%s:\tlayer must be %d or %d\n", __FUNCTION__,
+                                       DHD_TX_PROFILE_DATA_LINK_LAYER,
+                                       DHD_TX_PROFILE_NETWORK_LAYER));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               if (protocol->protocol_number > __UINT16_MAX__) {
+                       DHD_ERROR(("%s:\tprotocol number must be <= %d\n", __FUNCTION__,
+                                       __UINT16_MAX__));
+                       bcmerror = BCME_BADLEN;
+                       break;
+               }
+
+               /* find the dhd_tx_profile_protocol_t */
+               for (offset = 0; offset < dhd_pub->num_profiles; offset++) {
+                       if (dhd_pub->protocol_filters[offset].profile_index ==
+                                       protocol->profile_index) {
+                               break;
+                       }
+               }
+
+               if (offset >= DHD_MAX_PROFILES) {
+#if DHD_MAX_PROFILES > 1
+                       DHD_ERROR(("%s:\tonly %d profiles supported at present\n",
+                                       __FUNCTION__, DHD_MAX_PROFILES));
+#else /* DHD_MAX_PROFILES > 1 */
+                       DHD_ERROR(("%s:\tonly %d profile supported at present\n",
+                                       __FUNCTION__, DHD_MAX_PROFILES));
+                       DHD_ERROR(("%s:\tthere is a profile of index %d\n", __FUNCTION__,
+                                       dhd_pub->protocol_filters->profile_index));
+#endif /* DHD_MAX_PROFILES > 1 */
+                       bcmerror = BCME_NOMEM;
+                       break;
+               }
+
+               /* memory already allocated in dhd_attach; just assign the value */
+               dhd_pub->protocol_filters[offset] = *protocol;
+
+               if (offset >= dhd_pub->num_profiles) {
+                       dhd_pub->num_profiles = offset + 1;
+               }
+
+               break;
+       }
+
+       case IOV_SVAL(IOV_TX_PROFILE_ENABLE):
+               dhd_pub->tx_profile_enab = int_val ? TRUE : FALSE;
+               break;
+
+       case IOV_GVAL(IOV_TX_PROFILE_ENABLE):
+               int_val = dhd_pub->tx_profile_enab;
+               bcmerror = memcpy_s(arg, val_size, &int_val, sizeof(int_val));
+               break;
+
+       case IOV_SVAL(IOV_TX_PROFILE_DUMP):
+       {
+               const dhd_tx_profile_protocol_t *protocol = NULL;
+               uint8 offset;
+               char *format = "%s:\ttx_profile %s: %d\n";
+
+               for (offset = 0; offset < dhd_pub->num_profiles; offset++) {
+                       if (dhd_pub->protocol_filters[offset].profile_index == int_val) {
+                               protocol = &(dhd_pub->protocol_filters[offset]);
+                               break;
+                       }
+               }
+
+               if (protocol == NULL) {
+                       DHD_ERROR(("%s:\tno profile with index %d\n", __FUNCTION__,
+                                       int_val));
+                       bcmerror = BCME_ERROR;
+                       break;
+               }
+
+               printf(format, __FUNCTION__, "profile_index", protocol->profile_index);
+               printf(format, __FUNCTION__, "layer", protocol->layer);
+               printf(format, __FUNCTION__, "protocol_number", protocol->protocol_number);
+               printf(format, __FUNCTION__, "src_port", protocol->src_port);
+               printf(format, __FUNCTION__, "dest_port", protocol->dest_port);
+
+               break;
+       }
+#endif /* defined(DHD_TX_PROFILE) */
+
+       default:
+               bcmerror = BCME_UNSUPPORTED;
+               break;
+       }
+
+exit:
+       DHD_TRACE(("%s: actionid %d, bcmerror %d\n", __FUNCTION__, actionid, bcmerror));
+       return bcmerror;
+}
+
+/* Store the status of a connection attempt for later retrieval by an iovar */
+void
+dhd_store_conn_status(uint32 event, uint32 status, uint32 reason)
+{
+       /* Do not overwrite a WLC_E_PRUNE with a WLC_E_SET_SSID
+        * because an encryption/rsn mismatch results in both events, and
+        * the important information is in the WLC_E_PRUNE.
+        */
+       if (!(event == WLC_E_SET_SSID && status == WLC_E_STATUS_FAIL &&
+             dhd_conn_event == WLC_E_PRUNE)) {
+               dhd_conn_event = event;
+               dhd_conn_status = status;
+               dhd_conn_reason = reason;
+       }
+}
+
+bool
+dhd_prec_enq(dhd_pub_t *dhdp, struct pktq *q, void *pkt, int prec)
+{
+       void *p;
+       int eprec = -1;         /* precedence to evict from */
+       bool discard_oldest;
+
+       /* Fast case, precedence queue is not full and we are also not
+        * exceeding total queue length
+        */
+       if (!pktqprec_full(q, prec) && !pktq_full(q)) {
+               pktq_penq(q, prec, pkt);
+               return TRUE;
+       }
+
+       /* Determine precedence from which to evict packet, if any */
+       if (pktqprec_full(q, prec))
+               eprec = prec;
+       else if (pktq_full(q)) {
+               p = pktq_peek_tail(q, &eprec);
+               ASSERT(p);
+               if (eprec > prec || eprec < 0)
+                       return FALSE;
+       }
+
+       /* Evict if needed */
+       if (eprec >= 0) {
+               /* Detect queueing to unconfigured precedence */
+               ASSERT(!pktqprec_empty(q, eprec));
+               discard_oldest = AC_BITMAP_TST(dhdp->wme_dp, eprec);
+               if (eprec == prec && !discard_oldest)
+                       return FALSE;           /* refuse newer (incoming) packet */
+               /* Evict packet according to discard policy */
+               p = discard_oldest ? pktq_pdeq(q, eprec) : pktq_pdeq_tail(q, eprec);
+               ASSERT(p);
+#ifdef DHDTCPACK_SUPPRESS
+               if (dhd_tcpack_check_xmit(dhdp, p) == BCME_ERROR) {
+                       DHD_ERROR(("%s %d: tcpack_suppress ERROR!!! Stop using it\n",
+                               __FUNCTION__, __LINE__));
+                       dhd_tcpack_suppress_set(dhdp, TCPACK_SUP_OFF);
+               }
+#endif /* DHDTCPACK_SUPPRESS */
+               PKTFREE(dhdp->osh, p, TRUE);
+       }
+
+       /* Enqueue */
+       p = pktq_penq(q, prec, pkt);
+       ASSERT(p);
+
+       return TRUE;
+}
+
+/*
+ * Functions to drop proper pkts from queue:
+ *     If one pkt in queue is non-fragmented, drop first non-fragmented pkt only
+ *     If all pkts in queue are all fragmented, find and drop one whole set fragmented pkts
+ *     If can't find pkts matching upper 2 cases, drop first pkt anyway
+ */
+bool
+dhd_prec_drop_pkts(dhd_pub_t *dhdp, struct pktq *pq, int prec, f_droppkt_t fn)
+{
+       struct pktq_prec *q = NULL;
+       void *p, *prev = NULL, *next = NULL, *first = NULL, *last = NULL, *prev_first = NULL;
+       pkt_frag_t frag_info;
+
+       ASSERT(dhdp && pq);
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       q = &pq->q[prec];
+       p = q->head;
+
+       if (p == NULL)
+               return FALSE;
+
+       while (p) {
+               frag_info = pkt_frag_info(dhdp->osh, p);
+               if (frag_info == DHD_PKT_FRAG_NONE) {
+                       break;
+               } else if (frag_info == DHD_PKT_FRAG_FIRST) {
+                       if (first) {
+                               /* No last frag pkt, use prev as last */
+                               last = prev;
+                               break;
+                       } else {
+                               first = p;
+                               prev_first = prev;
+                       }
+               } else if (frag_info == DHD_PKT_FRAG_LAST) {
+                       if (first) {
+                               last = p;
+                               break;
+                       }
+               }
+
+               prev = p;
+               p = PKTLINK(p);
+       }
+
+       if ((p == NULL) || ((frag_info != DHD_PKT_FRAG_NONE) && !(first && last))) {
+               /* Not found matching pkts, use oldest */
+               prev = NULL;
+               p = q->head;
+               frag_info = 0;
+       }
+
+       if (frag_info == DHD_PKT_FRAG_NONE) {
+               first = last = p;
+               prev_first = prev;
+       }
+
+       p = first;
+       while (p) {
+               next = PKTLINK(p);
+               q->n_pkts--;
+               pq->n_pkts_tot--;
+
+#ifdef WL_TXQ_STALL
+               q->dequeue_count++;
+#endif
+
+               PKTSETLINK(p, NULL);
+
+               if (fn)
+                       fn(dhdp, prec, p, TRUE);
+
+               if (p == last)
+                       break;
+
+               p = next;
+       }
+
+       if (prev_first == NULL) {
+               if ((q->head = next) == NULL)
+                       q->tail = NULL;
+       } else {
+               PKTSETLINK(prev_first, next);
+               if (!next)
+                       q->tail = prev_first;
+       }
+
+       return TRUE;
+}
+
+static int
+dhd_iovar_op(dhd_pub_t *dhd_pub, const char *name,
+       void *params, int plen, void *arg, uint len, bool set)
+{
+       int bcmerror = 0;
+       uint val_size;
+       const bcm_iovar_t *vi = NULL;
+       uint32 actionid;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       ASSERT(name);
+
+       /* Get MUST have return space */
+       ASSERT(set || (arg && len));
+
+       /* Set does NOT take qualifiers */
+       ASSERT(!set || (!params && !plen));
+
+       if ((vi = bcm_iovar_lookup(dhd_iovars, name)) == NULL) {
+               bcmerror = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       DHD_CTL(("%s: %s %s, len %d plen %d\n", __FUNCTION__,
+               name, (set ? "set" : "get"), len, plen));
+
+       /* set up 'params' pointer in case this is a set command so that
+        * the convenience int and bool code can be common to set and get
+        */
+       if (params == NULL) {
+               params = arg;
+               plen = len;
+       }
+
+       if (vi->type == IOVT_VOID)
+               val_size = 0;
+       else if (vi->type == IOVT_BUFFER)
+               val_size = len;
+       else
+               /* all other types are integer sized */
+               val_size = sizeof(int);
+
+       actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+
+       bcmerror = dhd_doiovar(dhd_pub, vi, actionid, name, params, plen, arg, len, val_size);
+
+exit:
+       return bcmerror;
+}
+
+int
+dhd_ioctl(dhd_pub_t * dhd_pub, dhd_ioctl_t *ioc, void *buf, uint buflen)
+{
+       int bcmerror = 0;
+       unsigned long flags;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (!buf) {
+               return BCME_BADARG;
+       }
+
+       dhd_os_dhdiovar_lock(dhd_pub);
+       switch (ioc->cmd) {
+               case DHD_GET_MAGIC:
+                       if (buflen < sizeof(int))
+                               bcmerror = BCME_BUFTOOSHORT;
+                       else
+                               *(int*)buf = DHD_IOCTL_MAGIC;
+                       break;
+
+               case DHD_GET_VERSION:
+                       if (buflen < sizeof(int))
+                               bcmerror = BCME_BUFTOOSHORT;
+                       else
+                               *(int*)buf = DHD_IOCTL_VERSION;
+                       break;
+
+               case DHD_GET_VAR:
+               case DHD_SET_VAR:
+                       {
+                               char *arg;
+                               uint arglen;
+
+                               DHD_LINUX_GENERAL_LOCK(dhd_pub, flags);
+                               if (DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(dhd_pub) &&
+                                       bcmstricmp((char *)buf, "devreset")) {
+                                       /* In platforms like FC19, the FW download is done via IOCTL
+                                        * and should not return error for IOCTLs fired before FW
+                                        * Download is done
+                                        */
+                                       if (dhd_fw_download_status(dhd_pub) == FW_DOWNLOAD_DONE) {
+                                               DHD_ERROR(("%s: returning as busstate=%d\n",
+                                                               __FUNCTION__, dhd_pub->busstate));
+                                               DHD_LINUX_GENERAL_UNLOCK(dhd_pub, flags);
+                                               dhd_os_dhdiovar_unlock(dhd_pub);
+                                               return -ENODEV;
+                                       }
+                               }
+                               DHD_BUS_BUSY_SET_IN_DHD_IOVAR(dhd_pub);
+                               DHD_LINUX_GENERAL_UNLOCK(dhd_pub, flags);
+
+#ifdef DHD_PCIE_RUNTIMEPM
+                               dhdpcie_runtime_bus_wake(dhd_pub, TRUE, dhd_ioctl);
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+                               DHD_LINUX_GENERAL_LOCK(dhd_pub, flags);
+                               if (DHD_BUS_CHECK_SUSPEND_OR_SUSPEND_IN_PROGRESS(dhd_pub)) {
+                                       /* If Suspend/Resume is tested via pcie_suspend IOVAR
+                                        * then continue to execute the IOVAR, return from here for
+                                        * other IOVARs, also include pciecfgreg and devreset to go
+                                        * through.
+                                        */
+                                       if (bcmstricmp((char *)buf, "pcie_suspend") &&
+                                           bcmstricmp((char *)buf, "pciecfgreg") &&
+                                           bcmstricmp((char *)buf, "devreset") &&
+                                           bcmstricmp((char *)buf, "sdio_suspend")) {
+                                               DHD_ERROR(("%s: bus is in suspend(%d)"
+                                                       "or suspending(0x%x) state\n",
+                                                       __FUNCTION__, dhd_pub->busstate,
+                                                       dhd_pub->dhd_bus_busy_state));
+                                               DHD_BUS_BUSY_CLEAR_IN_DHD_IOVAR(dhd_pub);
+                                               dhd_os_busbusy_wake(dhd_pub);
+                                               DHD_LINUX_GENERAL_UNLOCK(dhd_pub, flags);
+                                               dhd_os_dhdiovar_unlock(dhd_pub);
+                                               return -ENODEV;
+                                       }
+                               }
+                               /* During devreset ioctl, we call dhdpcie_advertise_bus_cleanup,
+                                * which will wait for all the busy contexts to get over for
+                                * particular time and call ASSERT if timeout happens. As during
+                                * devreset ioctal, we made DHD_BUS_BUSY_SET_IN_DHD_IOVAR,
+                                * to avoid ASSERT, clear the IOCTL busy state. "devreset" ioctl is
+                                * not used in Production platforms but only used in FC19 setups.
+                                */
+                               if (!bcmstricmp((char *)buf, "devreset") ||
+#ifdef BCMPCIE
+                                   (dhd_bus_is_multibp_capable(dhd_pub->bus) &&
+                                   !bcmstricmp((char *)buf, "dwnldstate")) ||
+#endif /* BCMPCIE */
+                                   FALSE)
+                               {
+                                       DHD_BUS_BUSY_CLEAR_IN_DHD_IOVAR(dhd_pub);
+                               }
+                               DHD_LINUX_GENERAL_UNLOCK(dhd_pub, flags);
+
+                               /* scan past the name to any arguments */
+                               for (arg = buf, arglen = buflen; *arg && arglen; arg++, arglen--)
+                                       ;
+
+                               if (arglen == 0 || *arg) {
+                                       bcmerror = BCME_BUFTOOSHORT;
+                                       goto unlock_exit;
+                               }
+
+                               /* account for the NUL terminator */
+                               arg++, arglen--;
+                               /* call with the appropriate arguments */
+                               if (ioc->cmd == DHD_GET_VAR) {
+                                       bcmerror = dhd_iovar_op(dhd_pub, buf, arg, arglen,
+                                                       buf, buflen, IOV_GET);
+                               } else {
+                                       bcmerror = dhd_iovar_op(dhd_pub, buf, NULL, 0,
+                                                       arg, arglen, IOV_SET);
+                               }
+                               if (bcmerror != BCME_UNSUPPORTED) {
+                                       goto unlock_exit;
+                               }
+
+                               /* not in generic table, try protocol module */
+                               if (ioc->cmd == DHD_GET_VAR) {
+                                       bcmerror = dhd_prot_iovar_op(dhd_pub, buf, arg,
+                                                       arglen, buf, buflen, IOV_GET);
+                               } else {
+                                       bcmerror = dhd_prot_iovar_op(dhd_pub, buf,
+                                                       NULL, 0, arg, arglen, IOV_SET);
+                               }
+                               if (bcmerror != BCME_UNSUPPORTED) {
+                                       goto unlock_exit;
+                               }
+
+                               /* if still not found, try bus module */
+                               if (ioc->cmd == DHD_GET_VAR) {
+                                       bcmerror = dhd_bus_iovar_op(dhd_pub, buf,
+                                                       arg, arglen, buf, buflen, IOV_GET);
+                               } else {
+                                       bcmerror = dhd_bus_iovar_op(dhd_pub, buf,
+                                                       NULL, 0, arg, arglen, IOV_SET);
+                               }
+                               if (bcmerror != BCME_UNSUPPORTED) {
+                                       goto unlock_exit;
+                               }
+
+                       }
+                       goto unlock_exit;
+
+               default:
+                       bcmerror = BCME_UNSUPPORTED;
+       }
+       dhd_os_dhdiovar_unlock(dhd_pub);
+       return bcmerror;
+
+unlock_exit:
+       DHD_LINUX_GENERAL_LOCK(dhd_pub, flags);
+       DHD_BUS_BUSY_CLEAR_IN_DHD_IOVAR(dhd_pub);
+       dhd_os_busbusy_wake(dhd_pub);
+       DHD_LINUX_GENERAL_UNLOCK(dhd_pub, flags);
+       dhd_os_dhdiovar_unlock(dhd_pub);
+       return bcmerror;
+}
+
+#ifdef SHOW_EVENTS
+
+static void
+wl_show_roam_event(dhd_pub_t *dhd_pub, uint status, uint datalen,
+       const char *event_name, char *eabuf, void *event_data)
+{
+       if (status == WLC_E_STATUS_SUCCESS) {
+               DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+       } else {
+               if (status == WLC_E_STATUS_FAIL) {
+                       DHD_EVENT(("MACEVENT: %s, failed status %d\n", event_name, status));
+               } else if (status == WLC_E_STATUS_NO_NETWORKS) {
+                       if (datalen) {
+                               uint8 id = *((uint8 *)event_data);
+                               if (id != DOT11_MNG_PROPR_ID) {
+                                       wl_roam_event_t *roam_data =
+                                               (wl_roam_event_t *)event_data;
+                                       bcm_xtlv_t *tlv = (bcm_xtlv_t *)roam_data->xtlvs;
+                                       if (tlv->id == WLC_ROAM_NO_NETWORKS_TLV_ID) {
+                                               uint32 *fail_reason = (uint32 *)tlv->data;
+                                               switch (*fail_reason) {
+                                                       case WLC_E_REASON_NO_NETWORKS:
+                                                               DHD_EVENT(("MACEVENT: %s,"
+                                                                       " no networks found\n",
+                                                                       event_name));
+                                                               break;
+                                                       case WLC_E_REASON_NO_NETWORKS_BY_SCORE:
+                                                               DHD_EVENT(("MACEVENT: %s,"
+                                                               " no networks found by score\n",
+                                                                       event_name));
+                                                               break;
+                                                       default:
+                                                               DHD_ERROR(("MACEVENT: %s,"
+                                                               " unknown fail reason 0x%x\n",
+                                                                       event_name,
+                                                                       *fail_reason));
+                                                               ASSERT(0);
+                                               }
+                                       } else {
+                                               DHD_EVENT(("MACEVENT: %s,"
+                                                       " no networks found\n",
+                                                       event_name));
+                                       }
+                               } else {
+                                       DHD_EVENT(("MACEVENT: %s,"
+                                               " no networks found\n",
+                                               event_name));
+                               }
+                       } else {
+                               DHD_EVENT(("MACEVENT: %s, no networks found\n",
+                                       event_name));
+                       }
+               } else {
+                       DHD_EVENT(("MACEVENT: %s, unexpected status %d\n",
+                               event_name, (int)status));
+               }
+       }
+}
+
+static void
+wl_show_roam_cache_update_event(const char *name, uint status,
+       uint reason, uint datalen, void *event_data)
+{
+       wlc_roam_cache_update_event_t *cache_update;
+       uint16 len_of_tlvs;
+       void *val_tlv_ptr;
+       bcm_xtlv_t *val_xtlv;
+       char ntoa_buf[ETHER_ADDR_STR_LEN];
+       uint idx;
+       const char* reason_name = NULL;
+       const char* status_name = NULL;
+       static struct {
+               uint event;
+               const char *event_name;
+       } reason_names[] = {
+               {WLC_E_REASON_INITIAL_ASSOC, "INITIAL ASSOCIATION"},
+               {WLC_E_REASON_LOW_RSSI, "LOW_RSSI"},
+               {WLC_E_REASON_DEAUTH, "RECEIVED DEAUTHENTICATION"},
+               {WLC_E_REASON_DISASSOC, "RECEIVED DISASSOCATION"},
+               {WLC_E_REASON_BCNS_LOST, "BEACONS LOST"},
+               {WLC_E_REASON_BETTER_AP, "BETTER AP FOUND"},
+               {WLC_E_REASON_MINTXRATE, "STUCK AT MIN TX RATE"},
+               {WLC_E_REASON_BSSTRANS_REQ, "REQUESTED ROAM"},
+               {WLC_E_REASON_TXFAIL, "TOO MANY TXFAILURES"}
+       };
+
+       static struct {
+               uint event;
+               const char *event_name;
+       } status_names[] = {
+               {WLC_E_STATUS_SUCCESS, "operation was successful"},
+               {WLC_E_STATUS_FAIL, "operation failed"},
+               {WLC_E_STATUS_TIMEOUT, "operation timed out"},
+               {WLC_E_STATUS_NO_NETWORKS, "failed due to no matching network found"},
+               {WLC_E_STATUS_ABORT, "operation was aborted"},
+               {WLC_E_STATUS_NO_ACK, "protocol failure: packet not ack'd"},
+               {WLC_E_STATUS_UNSOLICITED, "AUTH or ASSOC packet was unsolicited"},
+               {WLC_E_STATUS_ATTEMPT, "attempt to assoc to an auto auth configuration"},
+               {WLC_E_STATUS_PARTIAL, "scan results are incomplete"},
+               {WLC_E_STATUS_NEWSCAN, "scan aborted by another scan"},
+               {WLC_E_STATUS_NEWASSOC, "scan aborted due to assoc in progress"},
+               {WLC_E_STATUS_11HQUIET, "802.11h quiet period started"},
+               {WLC_E_STATUS_SUPPRESS, "user disabled scanning"},
+               {WLC_E_STATUS_NOCHANS, "no allowable channels to scan"},
+               {WLC_E_STATUS_CS_ABORT, "abort channel select"},
+               {WLC_E_STATUS_ERROR, "request failed due to error"},
+               {WLC_E_STATUS_INVALID, "Invalid status code"}
+       };
+
+       switch (reason) {
+       case WLC_ROAM_CACHE_UPDATE_NEW_ROAM_CACHE:
+               DHD_EVENT(("Current roam cache status %d, "
+                       "reason for cache update is new roam cache\n", status));
+               break;
+       case WLC_ROAM_CACHE_UPDATE_JOIN:
+               DHD_EVENT(("Current roam cache status %d, "
+                       "reason for cache update is start of join\n", status));
+               break;
+       case WLC_ROAM_CACHE_UPDATE_RSSI_DELTA:
+               DHD_EVENT(("Current roam cache status %d, "
+                       "reason for cache update is delta in rssi\n", status));
+               break;
+       case WLC_ROAM_CACHE_UPDATE_MOTION_RSSI_DELTA:
+               DHD_EVENT(("Current roam cache status %d, "
+                       "reason for cache update is motion delta in rssi\n", status));
+               break;
+       case WLC_ROAM_CACHE_UPDATE_CHANNEL_MISS:
+               DHD_EVENT(("Current roam cache status %d, "
+                       "reason for cache update is missed channel\n", status));
+               break;
+       case WLC_ROAM_CACHE_UPDATE_START_SPLIT_SCAN:
+               DHD_EVENT(("Current roam cache status %d, "
+                       "reason for cache update is start of split scan\n", status));
+               break;
+       case WLC_ROAM_CACHE_UPDATE_START_FULL_SCAN:
+               DHD_EVENT(("Current roam cache status %d, "
+                       "reason for cache update is start of full scan\n", status));
+               break;
+       case WLC_ROAM_CACHE_UPDATE_INIT_ASSOC:
+               DHD_EVENT(("Current roam cache status %d, "
+                       "reason for cache update is init association\n", status));
+               break;
+       case WLC_ROAM_CACHE_UPDATE_FULL_SCAN_FAILED:
+               DHD_EVENT(("Current roam cache status %d, "
+                       "reason for cache update is failure in full scan\n", status));
+               break;
+       case WLC_ROAM_CACHE_UPDATE_NO_AP_FOUND:
+               DHD_EVENT(("Current roam cache status %d, "
+                       "reason for cache update is empty scan result\n", status));
+               break;
+       case WLC_ROAM_CACHE_UPDATE_MISSING_AP:
+               DHD_EVENT(("Current roam cache status %d, "
+                       "reason for cache update is missed ap\n", status));
+               break;
+       default:
+               DHD_EVENT(("Current roam cache status %d, "
+                       "reason for cache update is unknown %d\n", status, reason));
+               break;
+       }
+
+       if (datalen < sizeof(wlc_roam_cache_update_event_t)) {
+               DHD_ERROR(("MACEVENT: %s, missing event data\n", name));
+               return;
+       }
+
+       cache_update = (wlc_roam_cache_update_event_t *)event_data;
+       val_tlv_ptr = (void *)cache_update->xtlvs;
+       len_of_tlvs = datalen - sizeof(wlc_roam_cache_update_event_t);
+       val_xtlv = (bcm_xtlv_t *)val_tlv_ptr;
+       if (val_xtlv->id != WL_RMC_RPT_CMD_DATA) {
+               DHD_ERROR(("MACEVENT: %s, unexpected xtlv id %d\n",
+                       name, val_xtlv->id));
+               return;
+       }
+       val_tlv_ptr = (uint8 *)val_tlv_ptr + BCM_XTLV_HDR_SIZE;
+       len_of_tlvs = val_xtlv->len;
+
+       while (len_of_tlvs && len_of_tlvs > BCM_XTLV_HDR_SIZE) {
+               val_xtlv = (bcm_xtlv_t *)val_tlv_ptr;
+               switch (val_xtlv->id) {
+                       case WL_RMC_RPT_XTLV_BSS_INFO:
+                       {
+                               rmc_bss_info_v1_t *bss_info = (rmc_bss_info_v1_t *)(val_xtlv->data);
+                               DHD_EVENT(("\t Current BSS INFO:\n"));
+                               DHD_EVENT(("\t\tRSSI: %d\n", bss_info->rssi));
+                               DHD_EVENT(("\t\tNumber of full scans performed "
+                                       "on current BSS: %d\n", bss_info->fullscan_count));
+                               for (idx = 0; idx < ARRAYSIZE(reason_names); idx++) {
+                                       if (reason_names[idx].event == bss_info->reason) {
+                                               reason_name = reason_names[idx].event_name;
+                                       }
+                               }
+                               DHD_EVENT(("\t\tReason code for last full scan: %s(%d)\n",
+                                       reason_name, bss_info->reason));
+                               DHD_EVENT(("\t\tDelta between current time and "
+                                       "last full scan: %d\n", bss_info->time_full_scan));
+                               for (idx = 0; idx < ARRAYSIZE(status_names); idx++) {
+                                       if (status_names[idx].event == bss_info->status)
+                                               status_name = status_names[idx].event_name;
+                               }
+                               DHD_EVENT(("\t\tLast status code for not roaming: %s(%d)\n",
+                                       status_name, bss_info->status));
+
+                       }
+                               break;
+                       case WL_RMC_RPT_XTLV_CANDIDATE_INFO:
+                       case WL_RMC_RPT_XTLV_USER_CACHE_INFO:
+                       {
+                               rmc_candidate_info_v1_t *candidate_info =
+                                       (rmc_candidate_info_v1_t *)(val_xtlv->data);
+                               if (val_xtlv->id == WL_RMC_RPT_XTLV_CANDIDATE_INFO) {
+                                       DHD_EVENT(("\t Candidate INFO:\n"));
+                               } else {
+                                       DHD_EVENT(("\t User Candidate INFO:\n"));
+                               }
+                               DHD_EVENT(("\t\tBSSID: %s\n",
+                                       bcm_ether_ntoa((const struct ether_addr *)
+                                       &candidate_info->bssid, ntoa_buf)));
+                               DHD_EVENT(("\t\tRSSI: %d\n", candidate_info->rssi));
+                               DHD_EVENT(("\t\tChannel: %d\n", candidate_info->ctl_channel));
+                               DHD_EVENT(("\t\tDelta between current time and last "
+                                       "seen time: %d\n", candidate_info->time_last_seen));
+                               DHD_EVENT(("\t\tBSS load: %d\n", candidate_info->bss_load));
+                       }
+                               break;
+                       default:
+                               DHD_ERROR(("MACEVENT: %s, unexpected xtlv id %d\n",
+                                       name, val_xtlv->id));
+                               return;
+               }
+               val_tlv_ptr = (uint8 *)val_tlv_ptr + bcm_xtlv_size(val_xtlv,
+                       BCM_XTLV_OPTION_NONE);
+               len_of_tlvs -= (uint16)bcm_xtlv_size(val_xtlv, BCM_XTLV_OPTION_NONE);
+       }
+}
+
+static void
+wl_show_host_event(dhd_pub_t *dhd_pub, wl_event_msg_t *event, void *event_data,
+       void *raw_event_ptr, char *eventmask)
+{
+       uint i, status, reason;
+       bool group = FALSE, flush_txq = FALSE, link = FALSE;
+       bool host_data = FALSE; /* prints  event data after the case  when set */
+       const char *auth_str;
+       const char *event_name;
+       const uchar *buf;
+       char err_msg[256], eabuf[ETHER_ADDR_STR_LEN];
+       uint event_type, flags, auth_type, datalen;
+
+       event_type = ntoh32(event->event_type);
+       flags = ntoh16(event->flags);
+       status = ntoh32(event->status);
+       reason = ntoh32(event->reason);
+       BCM_REFERENCE(reason);
+       auth_type = ntoh32(event->auth_type);
+       datalen = (event_data != NULL) ? ntoh32(event->datalen) : 0;
+
+       /* debug dump of event messages */
+       snprintf(eabuf, sizeof(eabuf), MACDBG, MAC2STRDBG(event->addr.octet));
+
+       event_name = bcmevent_get_name(event_type);
+       BCM_REFERENCE(event_name);
+
+       if (flags & WLC_EVENT_MSG_LINK)
+               link = TRUE;
+       if (flags & WLC_EVENT_MSG_GROUP)
+               group = TRUE;
+       if (flags & WLC_EVENT_MSG_FLUSHTXQ)
+               flush_txq = TRUE;
+
+       switch (event_type) {
+       case WLC_E_START:
+       case WLC_E_DEAUTH:
+       case WLC_E_DISASSOC:
+               DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+               break;
+
+       case WLC_E_ASSOC_IND:
+       case WLC_E_REASSOC_IND:
+
+               DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+
+               break;
+
+       case WLC_E_ASSOC:
+       case WLC_E_REASSOC:
+               if (status == WLC_E_STATUS_SUCCESS) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, SUCCESS\n", event_name, eabuf));
+               } else if (status == WLC_E_STATUS_TIMEOUT) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, TIMEOUT\n", event_name, eabuf));
+               } else if (status == WLC_E_STATUS_FAIL) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, FAILURE, status %d reason %d\n",
+                              event_name, eabuf, (int)status, (int)reason));
+               } else if (status == WLC_E_STATUS_SUPPRESS) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, SUPPRESS\n", event_name, eabuf));
+               } else if (status == WLC_E_STATUS_NO_ACK) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, NOACK\n", event_name, eabuf));
+               } else {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, unexpected status %d\n",
+                              event_name, eabuf, (int)status));
+               }
+
+               break;
+
+       case WLC_E_DEAUTH_IND:
+       case WLC_E_DISASSOC_IND:
+               DHD_EVENT(("MACEVENT: %s, MAC %s, reason %d\n", event_name, eabuf, (int)reason));
+               break;
+
+       case WLC_E_AUTH:
+       case WLC_E_AUTH_IND:
+               if (auth_type == DOT11_OPEN_SYSTEM)
+                       auth_str = "Open System";
+               else if (auth_type == DOT11_SHARED_KEY)
+                       auth_str = "Shared Key";
+               else if (auth_type == DOT11_SAE)
+                       auth_str = "SAE";
+               else {
+                       snprintf(err_msg, sizeof(err_msg), "AUTH unknown: %d", (int)auth_type);
+                       auth_str = err_msg;
+               }
+
+               if (event_type == WLC_E_AUTH_IND) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, %s\n", event_name, eabuf, auth_str));
+               } else if (status == WLC_E_STATUS_SUCCESS) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, %s, SUCCESS\n",
+                               event_name, eabuf, auth_str));
+               } else if (status == WLC_E_STATUS_TIMEOUT) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, %s, TIMEOUT\n",
+                               event_name, eabuf, auth_str));
+               } else if (status == WLC_E_STATUS_FAIL) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, %s, FAILURE, status %d reason %d\n",
+                              event_name, eabuf, auth_str, (int)status, (int)reason));
+               } else if (status == WLC_E_STATUS_SUPPRESS) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, %s, SUPPRESS\n",
+                              event_name, eabuf, auth_str));
+               } else if (status == WLC_E_STATUS_NO_ACK) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, %s, NOACK\n",
+                              event_name, eabuf, auth_str));
+               } else {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, %s, status %d reason %d\n",
+                               event_name, eabuf, auth_str, (int)status, (int)reason));
+               }
+               BCM_REFERENCE(auth_str);
+
+               break;
+
+       case WLC_E_ROAM:
+               wl_show_roam_event(dhd_pub, status, datalen,
+                       event_name, eabuf, event_data);
+               break;
+       case WLC_E_ROAM_START:
+               if (datalen >= sizeof(wlc_roam_start_event_t)) {
+                       const wlc_roam_start_event_t *roam_start =
+                               (wlc_roam_start_event_t *)event_data;
+                       DHD_EVENT(("MACEVENT: %s, current bss rssi %d\n",
+                               event_name, (int)roam_start->rssi));
+               }
+               break;
+       case WLC_E_ROAM_PREP:
+               if (datalen >= sizeof(wlc_roam_prep_event_t)) {
+                       const wlc_roam_prep_event_t *roam_prep =
+                               (wlc_roam_prep_event_t *)event_data;
+                       DHD_EVENT(("MACEVENT: %s, target bss rssi %d\n",
+                               event_name, (int)roam_prep->rssi));
+               }
+               break;
+       case WLC_E_ROAM_CACHE_UPDATE:
+               DHD_EVENT(("MACEVENT: %s\n", event_name));
+               wl_show_roam_cache_update_event(event_name, status,
+                       reason, datalen, event_data);
+               break;
+       case WLC_E_JOIN:
+       case WLC_E_SET_SSID:
+               if (status == WLC_E_STATUS_SUCCESS) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+               } else {
+                       if (status == WLC_E_STATUS_FAIL) {
+                               DHD_EVENT(("MACEVENT: %s, failed status %d\n", event_name, status));
+                       } else if (status == WLC_E_STATUS_NO_NETWORKS) {
+                               DHD_EVENT(("MACEVENT: %s, no networks found\n", event_name));
+                       } else {
+                               DHD_EVENT(("MACEVENT: %s, unexpected status %d\n",
+                                       event_name, (int)status));
+                       }
+               }
+               break;
+
+       case WLC_E_BEACON_RX:
+               if (status == WLC_E_STATUS_SUCCESS) {
+                       DHD_EVENT(("MACEVENT: %s, SUCCESS\n", event_name));
+               } else if (status == WLC_E_STATUS_FAIL) {
+                       DHD_EVENT(("MACEVENT: %s, FAIL\n", event_name));
+               } else {
+                       DHD_EVENT(("MACEVENT: %s, status %d\n", event_name, status));
+               }
+               break;
+
+       case WLC_E_LINK:
+               DHD_EVENT(("MACEVENT: %s %s flags:0x%x status:%d reason:%d\n",
+                       event_name, link?"UP":"DOWN", flags, status, reason));
+#ifdef PCIE_FULL_DONGLE
+#endif
+               BCM_REFERENCE(link);
+               break;
+
+       case WLC_E_MIC_ERROR:
+               DHD_EVENT(("MACEVENT: %s, MAC %s, Group %d, Flush %d\n",
+                      event_name, eabuf, group, flush_txq));
+               BCM_REFERENCE(group);
+               BCM_REFERENCE(flush_txq);
+               break;
+
+       case WLC_E_ICV_ERROR:
+       case WLC_E_UNICAST_DECODE_ERROR:
+       case WLC_E_MULTICAST_DECODE_ERROR:
+               DHD_EVENT(("MACEVENT: %s, MAC %s\n",
+                      event_name, eabuf));
+               break;
+
+       case WLC_E_TXFAIL:
+               DHD_EVENT(("MACEVENT: %s, RA %s status %d\n", event_name, eabuf, status));
+               break;
+
+       case WLC_E_ASSOC_REQ_IE:
+       case WLC_E_ASSOC_RESP_IE:
+       case WLC_E_PMKID_CACHE:
+               DHD_EVENT(("MACEVENT: %s\n", event_name));
+               break;
+
+       case WLC_E_SCAN_COMPLETE:
+               DHD_EVENT(("MACEVENT: %s\n", event_name));
+               break;
+       case WLC_E_RSSI_LQM:
+       case WLC_E_PFN_NET_FOUND:
+       case WLC_E_PFN_NET_LOST:
+       case WLC_E_PFN_SCAN_COMPLETE:
+       case WLC_E_PFN_SCAN_NONE:
+       case WLC_E_PFN_SCAN_ALLGONE:
+       case WLC_E_PFN_GSCAN_FULL_RESULT:
+       case WLC_E_PFN_SSID_EXT:
+               DHD_EVENT(("PNOEVENT: %s\n", event_name));
+               break;
+
+       case WLC_E_PFN_SCAN_BACKOFF:
+       case WLC_E_PFN_BSSID_SCAN_BACKOFF:
+               DHD_EVENT(("PNOEVENT: %s, status %d, reason %d\n",
+                          event_name, (int)status, (int)reason));
+               break;
+
+       case WLC_E_PSK_SUP:
+       case WLC_E_PRUNE:
+               DHD_EVENT(("MACEVENT: %s, status %d, reason %d\n",
+                          event_name, (int)status, (int)reason));
+               break;
+
+#ifdef WIFI_ACT_FRAME
+       case WLC_E_ACTION_FRAME:
+               DHD_TRACE(("MACEVENT: %s Bssid %s\n", event_name, eabuf));
+               break;
+       case WLC_E_ACTION_FRAME_COMPLETE:
+               if (datalen >= sizeof(uint32)) {
+                       const uint32 *pktid = event_data;
+                       BCM_REFERENCE(pktid);
+                       DHD_EVENT(("MACEVENT: %s status %d, reason %d, pktid 0x%x\n",
+                               event_name, (int)status, (int)reason, *pktid));
+               }
+               break;
+#endif /* WIFI_ACT_FRAME */
+
+#ifdef SHOW_LOGTRACE
+       case WLC_E_TRACE:
+       {
+               dhd_dbg_trace_evnt_handler(dhd_pub, event_data, raw_event_ptr, datalen);
+               break;
+       }
+#endif /* SHOW_LOGTRACE */
+
+       case WLC_E_RSSI:
+               if (datalen >= sizeof(int)) {
+                       DHD_EVENT(("MACEVENT: %s %d\n", event_name, ntoh32(*((int *)event_data))));
+               }
+               break;
+
+       case WLC_E_SERVICE_FOUND:
+       case WLC_E_P2PO_ADD_DEVICE:
+       case WLC_E_P2PO_DEL_DEVICE:
+               DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+               break;
+
+#ifdef BT_WIFI_HANDOBER
+       case WLC_E_BT_WIFI_HANDOVER_REQ:
+               DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+               break;
+#endif
+
+       case WLC_E_CCA_CHAN_QUAL:
+               if (datalen >= sizeof(cca_chan_qual_event_t)) {
+                       const cca_chan_qual_event_t *cca_event =
+                               (cca_chan_qual_event_t *)event_data;
+                       if (cca_event->id == WL_CHAN_QUAL_FULLPM_CCA) {
+                               const cca_only_chan_qual_event_t *cca_only_event =
+                                       (const cca_only_chan_qual_event_t *)cca_event;
+                               BCM_REFERENCE(cca_only_event);
+                               DHD_EVENT((
+                                       "MACEVENT: %s %d, MAC %s, status %d, reason %d, auth %d,"
+                                       " channel 0x%02x\n",
+                                       event_name, event_type, eabuf, (int)status,
+                                       (int)reason, (int)auth_type, cca_event->chanspec));
+                               DHD_EVENT((
+                                       "\tTOTAL (dur %dms me %dms notme %dms interf %dms"
+                                       " ts 0x%08x)\n",
+                                       cca_only_event->cca_busy_ext.duration,
+                                       cca_only_event->cca_busy_ext.congest_ibss,
+                                       cca_only_event->cca_busy_ext.congest_obss,
+                                       cca_only_event->cca_busy_ext.interference,
+                                       cca_only_event->cca_busy_ext.timestamp));
+                               DHD_EVENT((
+                                       "\t  !PM (dur %dms me %dms notme %dms interf %dms)\n",
+                                       cca_only_event->cca_busy_nopm.duration,
+                                       cca_only_event->cca_busy_nopm.congest_ibss,
+                                       cca_only_event->cca_busy_nopm.congest_obss,
+                                       cca_only_event->cca_busy_nopm.interference));
+                               DHD_EVENT((
+                                       "\t   PM (dur %dms me %dms notme %dms interf %dms)\n",
+                                       cca_only_event->cca_busy_pm.duration,
+                                       cca_only_event->cca_busy_pm.congest_ibss,
+                                       cca_only_event->cca_busy_pm.congest_obss,
+                                       cca_only_event->cca_busy_pm.interference));
+                       } else if (cca_event->id == WL_CHAN_QUAL_FULL_CCA) {
+                               DHD_EVENT((
+                                       "MACEVENT: %s %d, MAC %s, status %d, reason %d, auth %d,"
+                                       " channel 0x%02x (dur %dms ibss %dms obss %dms interf %dms"
+                                       " ts 0x%08x)\n",
+                                       event_name, event_type, eabuf, (int)status,
+                                       (int)reason, (int)auth_type, cca_event->chanspec,
+                                       cca_event->cca_busy_ext.duration,
+                                       cca_event->cca_busy_ext.congest_ibss,
+                                       cca_event->cca_busy_ext.congest_obss,
+                                       cca_event->cca_busy_ext.interference,
+                                       cca_event->cca_busy_ext.timestamp));
+                       } else if (cca_event->id == WL_CHAN_QUAL_CCA) {
+                               DHD_EVENT((
+                                       "MACEVENT: %s %d, MAC %s, status %d, reason %d, auth %d,"
+                                       " channel 0x%02x (dur %dms busy %dms ts 0x%08x)\n",
+                                       event_name, event_type, eabuf, (int)status,
+                                       (int)reason, (int)auth_type, cca_event->chanspec,
+                                       cca_event->cca_busy.duration,
+                                       cca_event->cca_busy.congest,
+                                       cca_event->cca_busy.timestamp));
+                       } else if ((cca_event->id == WL_CHAN_QUAL_NF) ||
+                                  (cca_event->id == WL_CHAN_QUAL_NF_LTE)) {
+                               DHD_EVENT((
+                                       "MACEVENT: %s %d, MAC %s, status %d, reason %d, auth %d,"
+                                       " channel 0x%02x (NF[%d] %ddB)\n",
+                                       event_name, event_type, eabuf, (int)status,
+                                       (int)reason, (int)auth_type, cca_event->chanspec,
+                                       cca_event->id, cca_event->noise));
+                       } else {
+                               DHD_EVENT((
+                                       "MACEVENT: %s %d, MAC %s, status %d, reason %d, auth %d,"
+                                       " channel 0x%02x (unknown ID %d)\n",
+                                       event_name, event_type, eabuf, (int)status,
+                                       (int)reason, (int)auth_type, cca_event->chanspec,
+                                       cca_event->id));
+                       }
+               }
+               break;
+       case WLC_E_ESCAN_RESULT:
+               if (datalen >= sizeof(wl_escan_result_v2_t)) {
+                       const wl_escan_result_v2_t *escan_result =
+                               (wl_escan_result_v2_t *)event_data;
+                       BCM_REFERENCE(escan_result);
+                       /* Because WLC_E_ESCAN_RESULT event log are being print too many.
+                       * So, DHD_EVENT() changes to be used DHD_TRACE() in HW4 platform.
+                       */
+                       DHD_TRACE(("MACEVENT: %s %d, MAC %s, status %d \n",
+                               event_name, event_type, eabuf, (int)status));
+               }
+               break;
+       case WLC_E_IF:
+               if (datalen >= sizeof(struct wl_event_data_if)) {
+                       const struct wl_event_data_if *ifevent =
+                               (struct wl_event_data_if *)event_data;
+                       BCM_REFERENCE(ifevent);
+
+                       DHD_EVENT(("MACEVENT: %s, opcode:0x%d  ifidx:%d role:%d\n",
+                               event_name, ifevent->opcode, ifevent->ifidx, ifevent->role));
+               }
+               break;
+#ifdef SHOW_LOGTRACE
+       case WLC_E_MSCH:
+       {
+               wl_mschdbg_event_handler(dhd_pub, raw_event_ptr, reason, event_data, datalen);
+               break;
+       }
+#endif /* SHOW_LOGTRACE */
+
+       case WLC_E_PSK_AUTH:
+               DHD_EVENT(("MACEVENT: %s, RA %s status %d Reason:%d\n",
+                       event_name, eabuf, status, reason));
+               break;
+       case WLC_E_AGGR_EVENT:
+               if (datalen >= sizeof(event_aggr_data_t)) {
+                       const event_aggr_data_t *aggrbuf = event_data;
+                       int j = 0, len = 0;
+                       const uint8 *data = aggrbuf->data;
+                       DHD_EVENT(("MACEVENT: %s, num of events %d total len %d sub events: ",
+                               event_name, aggrbuf->num_events, aggrbuf->len));
+                       for (j = 0; j < aggrbuf->num_events; j++)
+                       {
+                               const wl_event_msg_t * sub_event = (const wl_event_msg_t *)data;
+                               if (len > aggrbuf->len) {
+                                       DHD_ERROR(("%s: Aggr events corrupted!",
+                                               __FUNCTION__));
+                                       break;
+                               }
+                               DHD_EVENT(("\n Event type: %d ", ntoh32(sub_event->event_type)));
+                               len += ALIGN_SIZE((ntoh32(sub_event->datalen) +
+                                       sizeof(wl_event_msg_t)), sizeof(uint64));
+                               buf = (const uchar *)(data + sizeof(wl_event_msg_t));
+                               BCM_REFERENCE(buf);
+                               DHD_EVENT((" data (%d) : ", ntoh32(sub_event->datalen)));
+                               for (i = 0; i < ntoh32(sub_event->datalen); i++) {
+                                       DHD_EVENT((" 0x%02x ", buf[i]));
+                               }
+                               data = aggrbuf->data + len;
+                       }
+                       DHD_EVENT(("\n"));
+               }
+               break;
+       case WLC_E_PHY_CAL:
+               {
+                       DHD_EVENT(("MACEVENT: %s, reason:%d\n", event_name, reason));
+                       break;
+               }
+       case WLC_E_NAN_CRITICAL:
+               {
+                       DHD_EVENT(("MACEVENT: %s, type:%d\n", event_name, reason));
+                       break;
+               }
+       case WLC_E_NAN_NON_CRITICAL:
+               {
+                       DHD_TRACE(("MACEVENT: %s, type:%d\n", event_name, reason));
+                       break;
+               }
+       case WLC_E_PROXD:
+               if (datalen >= sizeof(wl_proxd_event_t)) {
+                       const wl_proxd_event_t *proxd =
+                               (wl_proxd_event_t*)event_data;
+                       DHD_LOG_MEM(("MACEVENT: %s, event:%d, status:%d\n",
+                               event_name, proxd->type, reason));
+               }
+               break;
+       case WLC_E_RPSNOA:
+               if (datalen >= sizeof(rpsnoa_stats_t)) {
+                       const rpsnoa_stats_t *stat = event_data;
+                       if (datalen == sizeof(*stat)) {
+                               DHD_EVENT(("MACEVENT: %s, band %s, status %d, pps %d\n", event_name,
+                                       (stat->band == WLC_BAND_2G) ? "2G":"5G",
+                                       stat->state, stat->last_pps));
+                       }
+               }
+               break;
+       case WLC_E_WA_LQM:
+               if (datalen >= sizeof(wl_event_wa_lqm_t)) {
+                       const wl_event_wa_lqm_t *event_wa_lqm =
+                               (wl_event_wa_lqm_t *)event_data;
+                       const bcm_xtlv_t *subevent;
+                       const wl_event_wa_lqm_basic_t *elqm_basic;
+
+                       if ((event_wa_lqm->ver != WL_EVENT_WA_LQM_VER) ||
+                           (event_wa_lqm->len < sizeof(wl_event_wa_lqm_t) + BCM_XTLV_HDR_SIZE)) {
+                               DHD_ERROR(("MACEVENT: %s invalid (ver=%d len=%d)\n",
+                                       event_name, event_wa_lqm->ver, event_wa_lqm->len));
+                               break;
+                       }
+
+                       subevent = (const bcm_xtlv_t *)event_wa_lqm->subevent;
+                        if ((subevent->id != WL_EVENT_WA_LQM_BASIC) ||
+                            (subevent->len < sizeof(wl_event_wa_lqm_basic_t))) {
+                               DHD_ERROR(("MACEVENT: %s invalid sub-type (id=%d len=%d)\n",
+                                       event_name, subevent->id, subevent->len));
+                               break;
+                       }
+
+                       elqm_basic = (const wl_event_wa_lqm_basic_t *)subevent->data;
+                       BCM_REFERENCE(elqm_basic);
+                       DHD_EVENT(("MACEVENT: %s (RSSI=%d SNR=%d TxRate=%d RxRate=%d)\n",
+                               event_name, elqm_basic->rssi, elqm_basic->snr,
+                               elqm_basic->tx_rate, elqm_basic->rx_rate));
+               }
+               break;
+
+       case WLC_E_OBSS_DETECTION:
+               {
+                       DHD_EVENT(("MACEVENT: %s, type:%d\n", event_name, reason));
+                       break;
+               }
+
+       case WLC_E_AP_BCN_MUTE:
+               if (datalen >= sizeof(wlc_bcn_mute_miti_event_data_v1_t)) {
+                       const wlc_bcn_mute_miti_event_data_v1_t
+                               *bcn_mute_miti_evnt_data = event_data;
+                       DHD_EVENT(("MACEVENT: %s, reason :%d uatbtt_count: %d\n",
+                               event_name, reason, bcn_mute_miti_evnt_data->uatbtt_count));
+               }
+               break;
+
+       default:
+               DHD_EVENT(("MACEVENT: %s %d, MAC %s, status %d, reason %d, auth %d\n",
+                      event_name, event_type, eabuf, (int)status, (int)reason,
+                      (int)auth_type));
+               break;
+       }
+
+       /* show any appended data if message level is set to bytes or host_data is set */
+       if ((DHD_BYTES_ON() || (host_data == TRUE)) && DHD_EVENT_ON() && datalen) {
+               buf = (uchar *) event_data;
+               BCM_REFERENCE(buf);
+               DHD_EVENT((" data (%d) : ", datalen));
+               for (i = 0; i < datalen; i++) {
+                       DHD_EVENT((" 0x%02x ", buf[i]));
+               }
+               DHD_EVENT(("\n"));
+       }
+} /* wl_show_host_event */
+#endif /* SHOW_EVENTS */
+
+#ifdef DNGL_EVENT_SUPPORT
+/* Check whether packet is a BRCM dngl event pkt. If it is, process event data. */
+int
+dngl_host_event(dhd_pub_t *dhdp, void *pktdata, bcm_dngl_event_msg_t *dngl_event, size_t pktlen)
+{
+       bcm_dngl_event_t *pvt_data = (bcm_dngl_event_t *)pktdata;
+
+       dngl_host_event_process(dhdp, pvt_data, dngl_event, pktlen);
+       return BCME_OK;
+}
+
+#ifdef PARSE_DONGLE_HOST_EVENT
+typedef struct hck_id_to_str_s {
+       uint32 id;
+       char *name;
+} hck_id_to_str_t;
+
+hck_id_to_str_t hck_sw_id_to_str[] = {
+       {WL_HC_DD_PCIE, "WL_HC_DD_PCIE"},
+       {WL_HC_DD_RX_DMA_STALL, "WL_HC_DD_RX_DMA_STALL"},
+       {WL_HC_DD_RX_STALL, "WL_HC_DD_RX_STALL"},
+       {WL_HC_DD_TX_STALL, "WL_HC_DD_TX_STALL"},
+       {WL_HC_DD_SCAN_STALL, "WL_HC_DD_SCAN_STALL"},
+       {WL_HC_DD_PHY, "WL_HC_DD_PHY"},
+       {WL_HC_DD_REINIT, "WL_HC_DD_REINIT"},
+       {WL_HC_DD_TXQ_STALL, "WL_HC_DD_TXQ_STALL"},
+       {0, NULL}
+};
+
+hck_id_to_str_t hck_pcie_module_to_str[] = {
+       {HEALTH_CHECK_PCIEDEV_INDUCED_IND, "PCIEDEV_INDUCED_IND"},
+       {HEALTH_CHECK_PCIEDEV_H2D_DMA_IND, "PCIEDEV_H2D_DMA_IND"},
+       {HEALTH_CHECK_PCIEDEV_D2H_DMA_IND, "PCIEDEV_D2H_DMA_IND"},
+       {HEALTH_CHECK_PCIEDEV_IOCTL_STALL_IND, "PCIEDEV_IOCTL_STALL_IND"},
+       {HEALTH_CHECK_PCIEDEV_D3ACK_STALL_IND, "PCIEDEV_D3ACK_STALL_IND"},
+       {HEALTH_CHECK_PCIEDEV_NODS_IND, "PCIEDEV_NODS_IND"},
+       {HEALTH_CHECK_PCIEDEV_LINKSPEED_FALLBACK_IND, "PCIEDEV_LINKSPEED_FALLBACK_IND"},
+       {HEALTH_CHECK_PCIEDEV_DSACK_STALL_IND, "PCIEDEV_DSACK_STALL_IND"},
+       {0, NULL}
+};
+
+hck_id_to_str_t hck_rx_stall_v2_to_str[] = {
+       {BCM_RX_HC_RESERVED, "BCM_RX_HC_RESERVED"},
+       {BCM_RX_HC_UNSPECIFIED, "BCM_RX_HC_UNSPECIFIED"},
+       {BCM_RX_HC_UNICAST_DECRYPT_FAIL, "BCM_RX_HC_UNICAST_DECRYPT_FAIL"},
+       {BCM_RX_HC_BCMC_DECRYPT_FAIL, "BCM_RX_HC_BCMC_DECRYPT_FAIL"},
+       {BCM_RX_HC_UNICAST_REPLAY, "BCM_RX_HC_UNICAST_REPLAY"},
+       {BCM_RX_HC_BCMC_REPLAY, "BCM_RX_HC_BCMC_REPLAY"},
+       {BCM_RX_HC_AMPDU_DUP, "BCM_RX_HC_AMPDU_DUP"},
+       {0, NULL}
+};
+
+static void
+dhd_print_dongle_hck_id(uint32 id, hck_id_to_str_t *hck)
+{
+       while (hck->name != NULL) {
+               if (hck->id == id) {
+                       DHD_ERROR(("DONGLE_HCK_EVENT: %s\n", hck->name));
+                       return;
+               }
+               hck++;
+       }
+}
+
+void
+dhd_parse_hck_common_sw_event(bcm_xtlv_t *wl_hc)
+{
+
+       wl_rx_hc_info_v2_t *hck_rx_stall_v2;
+       uint16 id;
+
+       id = ltoh16(wl_hc->id);
+
+       if (id == WL_HC_DD_RX_STALL_V2) {
+               /*  map the hck_rx_stall_v2 structure to the value of the XTLV */
+               hck_rx_stall_v2 =
+                       (wl_rx_hc_info_v2_t*)wl_hc;
+               DHD_ERROR(("type:%d len:%d if_idx:%d ac:%d pkts:%d"
+                       " drop:%d alert_th:%d reason:%d peer_ea:"MACF"\n",
+                       hck_rx_stall_v2->type,
+                       hck_rx_stall_v2->length,
+                       hck_rx_stall_v2->if_idx,
+                       hck_rx_stall_v2->ac,
+                       hck_rx_stall_v2->rx_hc_pkts,
+                       hck_rx_stall_v2->rx_hc_dropped_all,
+                       hck_rx_stall_v2->rx_hc_alert_th,
+                       hck_rx_stall_v2->reason,
+                       ETHER_TO_MACF(hck_rx_stall_v2->peer_ea)));
+               dhd_print_dongle_hck_id(
+                               ltoh32(hck_rx_stall_v2->reason),
+                               hck_rx_stall_v2_to_str);
+       } else {
+               dhd_print_dongle_hck_id(ltoh16(wl_hc->id),
+                               hck_sw_id_to_str);
+       }
+
+}
+
+#endif /* PARSE_DONGLE_HOST_EVENT */
+
+void
+dngl_host_event_process(dhd_pub_t *dhdp, bcm_dngl_event_t *event,
+       bcm_dngl_event_msg_t *dngl_event, size_t pktlen)
+{
+       uint8 *p = (uint8 *)(event + 1);
+       uint16 type = ntoh16_ua((void *)&dngl_event->event_type);
+       uint16 datalen = ntoh16_ua((void *)&dngl_event->datalen);
+       uint16 version = ntoh16_ua((void *)&dngl_event->version);
+
+       DHD_EVENT(("VERSION:%d, EVENT TYPE:%d, DATALEN:%d\n", version, type, datalen));
+       if (datalen > (pktlen - sizeof(bcm_dngl_event_t) + ETHER_TYPE_LEN)) {
+               return;
+       }
+       if (version != BCM_DNGL_EVENT_MSG_VERSION) {
+               DHD_ERROR(("%s:version mismatch:%d:%d\n", __FUNCTION__,
+                       version, BCM_DNGL_EVENT_MSG_VERSION));
+               return;
+       }
+       switch (type) {
+          case DNGL_E_SOCRAM_IND:
+               {
+                  bcm_dngl_socramind_t *socramind_ptr = (bcm_dngl_socramind_t *)p;
+                  uint16 tag = ltoh32(socramind_ptr->tag);
+                  uint16 taglen = ltoh32(socramind_ptr->length);
+                  p = (uint8 *)socramind_ptr->value;
+                  DHD_EVENT(("Tag:%d Len:%d Datalen:%d\n", tag, taglen, datalen));
+                  switch (tag) {
+                       case SOCRAM_IND_ASSERT_TAG:
+                           {
+                               /*
+                               * The payload consists of -
+                               * null terminated function name padded till 32 bit boundary +
+                               * Line number - (32 bits)
+                               * Caller address (32 bits)
+                               */
+                               char *fnname = (char *)p;
+                               if (datalen < (ROUNDUP(strlen(fnname) + 1, sizeof(uint32)) +
+                                       sizeof(uint32) * 2)) {
+                                       DHD_ERROR(("Wrong length:%d\n", datalen));
+                                       return;
+                               }
+                               DHD_EVENT(("ASSRT Function:%s ", p));
+                               p += ROUNDUP(strlen(p) + 1, sizeof(uint32));
+                               DHD_EVENT(("Line:%d ", *(uint32 *)p));
+                               p += sizeof(uint32);
+                               DHD_EVENT(("Caller Addr:0x%x\n", *(uint32 *)p));
+#ifdef PARSE_DONGLE_HOST_EVENT
+                               DHD_ERROR(("DONGLE_HCK_EVENT: SOCRAM_IND_ASSERT_TAG\n"));
+#endif /* PARSE_DONGLE_HOST_EVENT */
+                               break;
+                           }
+                       case SOCRAM_IND_TAG_HEALTH_CHECK:
+                          {
+                               bcm_dngl_healthcheck_t *dngl_hc = (bcm_dngl_healthcheck_t *)p;
+                               DHD_EVENT(("SOCRAM_IND_HEALTHCHECK_TAG:%d Len:%d datalen:%d\n",
+                                       ltoh32(dngl_hc->top_module_tag),
+                                       ltoh32(dngl_hc->top_module_len),
+                                       datalen));
+                               if (DHD_EVENT_ON()) {
+                                       prhex("HEALTHCHECK", p, MIN(ltoh32(dngl_hc->top_module_len)
+                                               + BCM_XTLV_HDR_SIZE, datalen));
+                               }
+#ifdef DHD_LOG_DUMP
+                               memset(dhdp->health_chk_event_data, 0, HEALTH_CHK_BUF_SIZE);
+                               memcpy(dhdp->health_chk_event_data, p,
+                                               MIN(ltoh32(dngl_hc->top_module_len),
+                                               HEALTH_CHK_BUF_SIZE));
+#endif /* DHD_LOG_DUMP */
+                               p = (uint8 *)dngl_hc->value;
+
+                               switch (ltoh32(dngl_hc->top_module_tag)) {
+                                       case HEALTH_CHECK_TOP_LEVEL_MODULE_PCIEDEV_RTE:
+                                          {
+                                               bcm_dngl_pcie_hc_t *pcie_hc;
+                                               pcie_hc = (bcm_dngl_pcie_hc_t *)p;
+                                               BCM_REFERENCE(pcie_hc);
+                                               if (ltoh32(dngl_hc->top_module_len) <
+                                                               sizeof(bcm_dngl_pcie_hc_t)) {
+                                                       DHD_ERROR(("Wrong length:%d\n",
+                                                               ltoh32(dngl_hc->top_module_len)));
+                                                       return;
+                                               }
+                                               DHD_EVENT(("%d:PCIE HC error:%d flag:0x%x,"
+                                                       " control:0x%x\n",
+                                                       ltoh32(pcie_hc->version),
+                                                       ltoh32(pcie_hc->pcie_err_ind_type),
+                                                       ltoh32(pcie_hc->pcie_flag),
+                                                       ltoh32(pcie_hc->pcie_control_reg)));
+#ifdef PARSE_DONGLE_HOST_EVENT
+                                               dhd_print_dongle_hck_id(
+                                                       ltoh32(pcie_hc->pcie_err_ind_type),
+                                                               hck_pcie_module_to_str);
+#endif /* PARSE_DONGLE_HOST_EVENT */
+                                               break;
+                                          }
+#ifdef HCHK_COMMON_SW_EVENT
+                                       case HCHK_SW_ENTITY_WL_PRIMARY:
+                                       case HCHK_SW_ENTITY_WL_SECONDARY:
+                                       {
+                                               bcm_xtlv_t *wl_hc = (bcm_xtlv_t*)p;
+
+                                               if (ltoh32(dngl_hc->top_module_len) <
+                                                               sizeof(bcm_xtlv_t)) {
+                                                       DHD_ERROR(("WL SW HC Wrong length:%d\n",
+                                                               ltoh32(dngl_hc->top_module_len)));
+                                                       return;
+                                               }
+                                               BCM_REFERENCE(wl_hc);
+                                               DHD_EVENT(("WL SW HC type %d len %d\n",
+                                               ltoh16(wl_hc->id), ltoh16(wl_hc->len)));
+
+#ifdef PARSE_DONGLE_HOST_EVENT
+                                               dhd_parse_hck_common_sw_event(wl_hc);
+#endif /* PARSE_DONGLE_HOST_EVENT */
+                                               break;
+
+                                       }
+#endif /* HCHK_COMMON_SW_EVENT */
+                                       default:
+                                       {
+                                               DHD_ERROR(("%s:Unknown module TAG:%d\n",
+                                                 __FUNCTION__,
+                                                 ltoh32(dngl_hc->top_module_tag)));
+                                               break;
+                                       }
+                               }
+                               break;
+                          }
+                       default:
+                          DHD_ERROR(("%s:Unknown TAG\n", __FUNCTION__));
+                          if (p && DHD_EVENT_ON()) {
+                                  prhex("SOCRAMIND", p, taglen);
+                          }
+                          break;
+                  }
+                  break;
+               }
+          default:
+               DHD_ERROR(("%s:Unknown DNGL Event Type:%d\n", __FUNCTION__, type));
+               if (p && DHD_EVENT_ON()) {
+                       prhex("SOCRAMIND", p, datalen);
+               }
+               break;
+       }
+#ifndef BCMDBUS
+#ifdef DHD_FW_COREDUMP
+       if (dhdp->memdump_enabled) {
+               dhdp->memdump_type = DUMP_TYPE_DONGLE_HOST_EVENT;
+               if (
+#ifdef GDB_PROXY
+                       !dhdp->gdb_proxy_active &&
+#endif /* GDB_PROXY */
+                       dhd_socram_dump(dhdp->bus)) {
+                               DHD_ERROR(("%s: socram dump failed\n", __FUNCTION__));
+               }
+       }
+#else
+       dhd_dbg_send_urgent_evt(dhdp, p, datalen);
+#endif /* DHD_FW_COREDUMP */
+#endif /* !BCMDBUS */
+}
+
+#endif /* DNGL_EVENT_SUPPORT */
+
+/* Stub for now. Will become real function as soon as shim
+ * is being integrated to Android, Linux etc.
+ */
+int
+wl_event_process_default(wl_event_msg_t *event, struct wl_evt_pport *evt_pport)
+{
+       return BCME_OK;
+}
+
+int
+wl_event_process(dhd_pub_t *dhd_pub, int *ifidx, void *pktdata,
+       uint pktlen, void **data_ptr, void *raw_event)
+{
+       wl_evt_pport_t evt_pport;
+       wl_event_msg_t event;
+       bcm_event_msg_u_t evu;
+       int ret;
+
+       /* make sure it is a BRCM event pkt and record event data */
+       ret = wl_host_event_get_data(pktdata, pktlen, &evu);
+       if (ret != BCME_OK) {
+               return ret;
+       }
+
+       memcpy(&event, &evu.event, sizeof(wl_event_msg_t));
+
+       /* convert event from network order to host order */
+       wl_event_to_host_order(&event);
+
+       /* record event params to evt_pport */
+       evt_pport.dhd_pub = dhd_pub;
+       evt_pport.ifidx = ifidx;
+       evt_pport.pktdata = pktdata;
+       evt_pport.data_ptr = data_ptr;
+       evt_pport.raw_event = raw_event;
+       evt_pport.data_len = pktlen;
+
+       ret = wl_event_process_default(&event, &evt_pport);
+
+       return ret;
+} /* wl_event_process */
+
+/* Check whether packet is a BRCM event pkt. If it is, record event data. */
+int
+wl_host_event_get_data(void *pktdata, uint pktlen, bcm_event_msg_u_t *evu)
+{
+       int ret;
+
+       ret = is_wlc_event_frame(pktdata, pktlen, 0, evu);
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s: Invalid event frame, err = %d\n",
+                       __FUNCTION__, ret));
+       }
+
+       return ret;
+}
+
+int
+wl_process_host_event(dhd_pub_t *dhd_pub, int *ifidx, void *pktdata, uint pktlen,
+       wl_event_msg_t *event, void **data_ptr, void *raw_event)
+{
+       bcm_event_t *pvt_data = (bcm_event_t *)pktdata;
+       bcm_event_msg_u_t evu;
+       uint8 *event_data;
+       uint32 type, status, datalen, reason;
+       uint16 flags;
+       uint evlen;
+       int ret;
+       uint16 usr_subtype;
+#if defined(__linux__)
+       dhd_if_t *ifp = NULL;
+       BCM_REFERENCE(ifp);
+#endif /* DHD_POST_EAPOL_M1_AFTER_ROAM_EVT */
+
+       ret = wl_host_event_get_data(pktdata, pktlen, &evu);
+       if (ret != BCME_OK) {
+               return ret;
+       }
+
+       usr_subtype = ntoh16_ua((void *)&pvt_data->bcm_hdr.usr_subtype);
+       switch (usr_subtype) {
+       case BCMILCP_BCM_SUBTYPE_EVENT:
+               memcpy(event, &evu.event, sizeof(wl_event_msg_t));
+               *data_ptr = &pvt_data[1];
+               break;
+       case BCMILCP_BCM_SUBTYPE_DNGLEVENT:
+#ifdef DNGL_EVENT_SUPPORT
+               /* If it is a DNGL event process it first */
+               if (dngl_host_event(dhd_pub, pktdata, &evu.dngl_event, pktlen) == BCME_OK) {
+                       /*
+                        * Return error purposely to prevent DNGL event being processed
+                        * as BRCM event
+                        */
+                       return BCME_ERROR;
+               }
+#endif /* DNGL_EVENT_SUPPORT */
+               return BCME_NOTFOUND;
+       default:
+               return BCME_NOTFOUND;
+       }
+
+       /* start wl_event_msg process */
+       event_data = *data_ptr;
+       type = ntoh32_ua((void *)&event->event_type);
+       flags = ntoh16_ua((void *)&event->flags);
+       status = ntoh32_ua((void *)&event->status);
+       reason = ntoh32_ua((void *)&event->reason);
+       datalen = ntoh32_ua((void *)&event->datalen);
+       evlen = datalen + sizeof(bcm_event_t);
+
+       switch (type) {
+#ifdef PROP_TXSTATUS
+       case WLC_E_FIFO_CREDIT_MAP:
+               dhd_wlfc_enable(dhd_pub);
+               dhd_wlfc_FIFOcreditmap_event(dhd_pub, event_data);
+               WLFC_DBGMESG(("WLC_E_FIFO_CREDIT_MAP:(AC0,AC1,AC2,AC3),(BC_MC),(OTHER): "
+                       "(%d,%d,%d,%d),(%d),(%d)\n", event_data[0], event_data[1],
+                       event_data[2],
+                       event_data[3], event_data[4], event_data[5]));
+               break;
+
+       case WLC_E_BCMC_CREDIT_SUPPORT:
+               dhd_wlfc_BCMCCredit_support_event(dhd_pub);
+               break;
+#ifdef LIMIT_BORROW
+       case WLC_E_ALLOW_CREDIT_BORROW:
+               dhd_wlfc_disable_credit_borrow_event(dhd_pub, event_data);
+               break;
+#endif /* LIMIT_BORROW */
+#endif /* PROP_TXSTATUS */
+
+       case WLC_E_ULP:
+               break;
+       case WLC_E_TDLS_PEER_EVENT:
+#if defined(WLTDLS) && defined(PCIE_FULL_DONGLE)
+               {
+                       dhd_tdls_event_handler(dhd_pub, event);
+               }
+#endif
+               break;
+
+       case WLC_E_IF:
+               {
+               struct wl_event_data_if *ifevent = (struct wl_event_data_if *)event_data;
+
+               /* Ignore the event if NOIF is set */
+               if (ifevent->reserved & WLC_E_IF_FLAGS_BSSCFG_NOIF) {
+                       DHD_ERROR(("WLC_E_IF: NO_IF set, event Ignored\r\n"));
+                       return (BCME_UNSUPPORTED);
+               }
+#ifdef PCIE_FULL_DONGLE
+               dhd_update_interface_flow_info(dhd_pub, ifevent->ifidx,
+                       ifevent->opcode, ifevent->role);
+#endif
+#ifdef PROP_TXSTATUS
+               {
+                       uint8* ea = pvt_data->eth.ether_dhost;
+                       WLFC_DBGMESG(("WLC_E_IF: idx:%d, action:%s, iftype:%s, ["MACDBG"]\n"
+                                                 ifevent->ifidx,
+                                                 ((ifevent->opcode == WLC_E_IF_ADD) ? "ADD":"DEL"),
+                                                 ((ifevent->role == 0) ? "STA":"AP "),
+                                                 MAC2STRDBG(ea)));
+                       (void)ea;
+
+                       if (ifevent->opcode == WLC_E_IF_CHANGE)
+                               dhd_wlfc_interface_event(dhd_pub,
+                                       eWLFC_MAC_ENTRY_ACTION_UPDATE,
+                                       ifevent->ifidx, ifevent->role, ea);
+                       else
+                               dhd_wlfc_interface_event(dhd_pub,
+                                       ((ifevent->opcode == WLC_E_IF_ADD) ?
+                                       eWLFC_MAC_ENTRY_ACTION_ADD : eWLFC_MAC_ENTRY_ACTION_DEL),
+                                       ifevent->ifidx, ifevent->role, ea);
+
+                       /* dhd already has created an interface by default, for 0 */
+                       if (ifevent->ifidx == 0)
+                               break;
+               }
+#endif /* PROP_TXSTATUS */
+
+               if (ifevent->ifidx > 0 && ifevent->ifidx < DHD_MAX_IFS) {
+                       if (ifevent->opcode == WLC_E_IF_ADD) {
+                               if (dhd_event_ifadd(dhd_pub->info, ifevent, event->ifname,
+                                       event->addr.octet)) {
+
+                                       DHD_ERROR(("%s: dhd_event_ifadd failed ifidx: %d  %s\n",
+                                               __FUNCTION__, ifevent->ifidx, event->ifname));
+                                       return (BCME_ERROR);
+                               }
+                       } else if (ifevent->opcode == WLC_E_IF_DEL) {
+#ifdef PCIE_FULL_DONGLE
+                               dhd_flow_rings_delete(dhd_pub,
+                                       (uint8)dhd_ifname2idx(dhd_pub->info, event->ifname));
+#endif /* PCIE_FULL_DONGLE */
+                               dhd_event_ifdel(dhd_pub->info, ifevent, event->ifname,
+                                       event->addr.octet);
+                       } else if (ifevent->opcode == WLC_E_IF_CHANGE) {
+#ifdef WL_CFG80211
+                               dhd_event_ifchange(dhd_pub->info, ifevent, event->ifname,
+                                       event->addr.octet);
+#endif /* WL_CFG80211 */
+                       }
+               } else {
+#if !defined(PROP_TXSTATUS) && !defined(PCIE_FULL_DONGLE) && defined(WL_CFG80211)
+                       DHD_INFO(("%s: Invalid ifidx %d for %s\n",
+                          __FUNCTION__, ifevent->ifidx, event->ifname));
+#endif /* !PROP_TXSTATUS && !PCIE_FULL_DONGLE && WL_CFG80211 */
+               }
+                       /* send up the if event: btamp user needs it */
+                       *ifidx = dhd_ifname2idx(dhd_pub->info, event->ifname);
+                       /* push up to external supp/auth */
+                       dhd_event(dhd_pub->info, (char *)pvt_data, evlen, *ifidx);
+               break;
+       }
+
+       case WLC_E_NDIS_LINK:
+               break;
+       case WLC_E_PFN_NET_FOUND:
+       case WLC_E_PFN_SCAN_ALLGONE: /* share with WLC_E_PFN_BSSID_NET_LOST */
+       case WLC_E_PFN_NET_LOST:
+               break;
+#if defined(PNO_SUPPORT)
+       case WLC_E_PFN_BSSID_NET_FOUND:
+       case WLC_E_PFN_BEST_BATCHING:
+               dhd_pno_event_handler(dhd_pub, event, (void *)event_data);
+               break;
+#endif
+#if defined(RTT_SUPPORT)
+       case WLC_E_PROXD:
+#ifndef WL_CFG80211
+               dhd_rtt_event_handler(dhd_pub, event, (void *)event_data);
+#endif /* WL_CFG80211 */
+               break;
+#endif /* RTT_SUPPORT */
+               /* These are what external supplicant/authenticator wants */
+       case WLC_E_ASSOC_IND:
+       case WLC_E_AUTH_IND:
+       case WLC_E_REASSOC_IND:
+               dhd_findadd_sta(dhd_pub,
+                       dhd_ifname2idx(dhd_pub->info, event->ifname),
+                       &event->addr.octet);
+               break;
+#ifndef BCMDBUS
+#if defined(DHD_FW_COREDUMP)
+       case WLC_E_PSM_WATCHDOG:
+               DHD_ERROR(("%s: WLC_E_PSM_WATCHDOG event received : \n", __FUNCTION__));
+               if (dhd_socram_dump(dhd_pub->bus) != BCME_OK) {
+                       DHD_ERROR(("%s: socram dump ERROR : \n", __FUNCTION__));
+               }
+       break;
+#endif
+#endif /* !BCMDBUS */
+       case WLC_E_NATOE_NFCT:
+#ifdef WL_NATOE
+               DHD_EVENT(("%s: WLC_E_NATOE_NFCT event received \n", __FUNCTION__));
+               dhd_natoe_ct_event(dhd_pub, event_data);
+#endif /* WL_NATOE */
+       break;
+#ifdef WL_NAN
+       case WLC_E_SLOTTED_BSS_PEER_OP:
+               DHD_EVENT(("%s: WLC_E_SLOTTED_BSS_PEER_OP event received for peer: "
+                       "" MACDBG ", status = %d\n",
+                       __FUNCTION__, MAC2STRDBG(event->addr.octet), status));
+               if (status == WLC_E_STATUS_SLOTTED_PEER_ADD) {
+                       dhd_findadd_sta(dhd_pub, dhd_ifname2idx(dhd_pub->info,
+                               event->ifname), &event->addr.octet);
+               } else if (status == WLC_E_STATUS_SLOTTED_PEER_DEL) {
+                       uint8 ifindex = (uint8)dhd_ifname2idx(dhd_pub->info, event->ifname);
+                       BCM_REFERENCE(ifindex);
+                       dhd_del_sta(dhd_pub, dhd_ifname2idx(dhd_pub->info,
+                               event->ifname), &event->addr.octet);
+#ifdef PCIE_FULL_DONGLE
+                       dhd_flow_rings_delete_for_peer(dhd_pub, ifindex,
+                               (char *)&event->addr.octet[0]);
+#endif
+               } else {
+                       DHD_ERROR(("%s: WLC_E_SLOTTED_BSS_PEER_OP: Status is not expected = %d\n",
+                               __FUNCTION__, status));
+               }
+               break;
+#endif /* WL_NAN */
+#ifdef DHD_POST_EAPOL_M1_AFTER_ROAM_EVT
+       case WLC_E_REASSOC:
+               ifp = dhd_get_ifp(dhd_pub, event->ifidx);
+
+               if (!ifp)
+                       break;
+
+               /* Consider STA role only since roam is disabled on P2P GC.
+                * Drop EAPOL M1 frame only if roam is done to same BSS.
+                */
+               if ((status == WLC_E_STATUS_SUCCESS) &&
+                       IS_STA_IFACE(ndev_to_wdev(ifp->net)) &&
+                       wl_cfg80211_is_event_from_connected_bssid(ifp->net, event, event->ifidx)) {
+                       ifp->recv_reassoc_evt = TRUE;
+               }
+               break;
+#endif /* DHD_POST_EAPOL_M1_AFTER_ROAM_EVT */
+#if defined(CSI_SUPPORT)
+       case WLC_E_CSI:
+               dhd_csi_event_handler(dhd_pub, event, (void *)event_data);
+               break;
+#endif /* CSI_SUPPORT */
+       case WLC_E_LINK:
+#ifdef PCIE_FULL_DONGLE
+               if (dhd_update_interface_link_status(dhd_pub, (uint8)dhd_ifname2idx(dhd_pub->info,
+                       event->ifname), (uint8)flags) != BCME_OK) {
+                       DHD_ERROR(("%s: dhd_update_interface_link_status Failed.\n",
+                               __FUNCTION__));
+                       break;
+               }
+               if (!flags) {
+                       DHD_ERROR(("%s: Deleting all STA from assoc list and flowrings.\n",
+                               __FUNCTION__));
+                       /* Delete all sta and flowrings */
+                       dhd_del_all_sta(dhd_pub, dhd_ifname2idx(dhd_pub->info, event->ifname));
+                       dhd_flow_rings_delete(dhd_pub, (uint8)dhd_ifname2idx(dhd_pub->info,
+                               event->ifname));
+               }
+               /* fall through */
+#endif /* PCIE_FULL_DONGLE */
+       case WLC_E_DEAUTH:
+       case WLC_E_DEAUTH_IND:
+       case WLC_E_DISASSOC:
+       case WLC_E_DISASSOC_IND:
+#ifdef PCIE_FULL_DONGLE
+               if (type != WLC_E_LINK) {
+                       uint8 ifindex = (uint8)dhd_ifname2idx(dhd_pub->info, event->ifname);
+                       uint8 role = dhd_flow_rings_ifindex2role(dhd_pub, ifindex);
+                       uint8 del_sta = TRUE;
+#ifdef WL_CFG80211
+                       if (role == WLC_E_IF_ROLE_STA &&
+                               !wl_cfg80211_is_roam_offload(dhd_idx2net(dhd_pub, ifindex)) &&
+                                       !wl_cfg80211_is_event_from_connected_bssid(
+                                               dhd_idx2net(dhd_pub, ifindex), event, *ifidx)) {
+                               del_sta = FALSE;
+                       }
+#endif /* WL_CFG80211 */
+                       DHD_EVENT(("%s: Link event %d, flags %x, status %x, role %d, del_sta %d\n",
+                               __FUNCTION__, type, flags, status, role, del_sta));
+
+                       if (del_sta) {
+                               DHD_EVENT(("%s: Deleting STA " MACDBG "\n",
+                                       __FUNCTION__, MAC2STRDBG(event->addr.octet)));
+
+                               dhd_del_sta(dhd_pub, dhd_ifname2idx(dhd_pub->info,
+                                       event->ifname), &event->addr.octet);
+                               /* Delete all flowrings for STA and P2P Client */
+                               if (role == WLC_E_IF_ROLE_STA || role == WLC_E_IF_ROLE_P2P_CLIENT) {
+                                       dhd_flow_rings_delete(dhd_pub, ifindex);
+                               } else {
+                                       dhd_flow_rings_delete_for_peer(dhd_pub, ifindex,
+                                               (char *)&event->addr.octet[0]);
+                               }
+                       }
+               }
+#endif /* PCIE_FULL_DONGLE */
+#ifdef DHD_POST_EAPOL_M1_AFTER_ROAM_EVT
+               /* fall through */
+               ifp = dhd_get_ifp(dhd_pub, event->ifidx);
+               if (ifp) {
+                       ifp->recv_reassoc_evt = FALSE;
+                       ifp->post_roam_evt = FALSE;
+               }
+#endif /* DHD_POST_EAPOL_M1_AFTER_ROAM_EVT */
+               /* fall through */
+       default:
+               *ifidx = dhd_ifname2idx(dhd_pub->info, event->ifname);
+#ifdef DHD_UPDATE_INTF_MAC
+               if ((WLC_E_LINK==type)&&(WLC_EVENT_MSG_LINK&flags)) {
+                       dhd_event_ifchange(dhd_pub->info,
+                       (struct wl_event_data_if *)event,
+                       event->ifname,
+                       event->addr.octet);
+               }
+#endif /* DHD_UPDATE_INTF_MAC */
+               /* push up to external supp/auth */
+               dhd_event(dhd_pub->info, (char *)pvt_data, evlen, *ifidx);
+               DHD_TRACE(("%s: MAC event %d, flags %x, status %x\n",
+                       __FUNCTION__, type, flags, status));
+               BCM_REFERENCE(flags);
+               BCM_REFERENCE(status);
+               BCM_REFERENCE(reason);
+
+               break;
+       }
+#if defined(STBAP)
+       /* For routers, EAPD will be working on these events.
+        * Overwrite interface name to that event is pushed
+        * to host with its registered interface name
+        */
+       memcpy(pvt_data->event.ifname, dhd_ifname(dhd_pub, *ifidx), IFNAMSIZ);
+#endif
+
+#ifdef DHD_STATUS_LOGGING
+       if (dhd_pub->statlog) {
+               dhd_statlog_process_event(dhd_pub, type, *ifidx,
+                       status, reason, flags);
+       }
+#endif /* DHD_STATUS_LOGGING */
+
+#ifdef SHOW_EVENTS
+       if (DHD_FWLOG_ON() || DHD_EVENT_ON()) {
+               wl_show_host_event(dhd_pub, event,
+                       (void *)event_data, raw_event, dhd_pub->enable_log);
+       }
+#endif /* SHOW_EVENTS */
+
+       return (BCME_OK);
+} /* wl_process_host_event */
+
+int
+wl_host_event(dhd_pub_t *dhd_pub, int *ifidx, void *pktdata, uint pktlen,
+       wl_event_msg_t *event, void **data_ptr, void *raw_event)
+{
+       return wl_process_host_event(dhd_pub, ifidx, pktdata, pktlen, event, data_ptr,
+                       raw_event);
+}
+
+void
+dhd_print_buf(void *pbuf, int len, int bytes_per_line)
+{
+#ifdef DHD_DEBUG
+       int i, j = 0;
+       unsigned char *buf = pbuf;
+
+       if (bytes_per_line == 0) {
+               bytes_per_line = len;
+       }
+
+       for (i = 0; i < len; i++) {
+               printf("%2.2x", *buf++);
+               j++;
+               if (j == bytes_per_line) {
+                       printf("\n");
+                       j = 0;
+               } else {
+                       printf(":");
+               }
+       }
+       printf("\n");
+#endif /* DHD_DEBUG */
+}
+#ifndef strtoul
+#define strtoul(nptr, endptr, base) bcm_strtoul((nptr), (endptr), (base))
+#endif
+
+/* Convert user's input in hex pattern to byte-size mask */
+int
+wl_pattern_atoh(char *src, char *dst)
+{
+       int i;
+       if (strncmp(src, "0x", 2) != 0 &&
+           strncmp(src, "0X", 2) != 0) {
+               DHD_ERROR(("Mask invalid format. Needs to start with 0x\n"));
+               return -1;
+       }
+       src = src + 2; /* Skip past 0x */
+       if (strlen(src) % 2 != 0) {
+               DHD_ERROR(("Mask invalid format. Needs to be of even length\n"));
+               return -1;
+       }
+       for (i = 0; *src != '\0'; i++) {
+               char num[3];
+               bcm_strncpy_s(num, sizeof(num), src, 2);
+               num[2] = '\0';
+               dst[i] = (uint8)strtoul(num, NULL, 16);
+               src += 2;
+       }
+       return i;
+}
+
+#if defined(PKT_FILTER_SUPPORT) || defined(DHD_PKT_LOGGING)
+int
+pattern_atoh_len(char *src, char *dst, int len)
+{
+       int i;
+       if (strncmp(src, "0x", HD_PREFIX_SIZE) != 0 &&
+                       strncmp(src, "0X", HD_PREFIX_SIZE) != 0) {
+               DHD_ERROR(("Mask invalid format. Needs to start with 0x\n"));
+               return -1;
+       }
+       src = src + HD_PREFIX_SIZE; /* Skip past 0x */
+       if (strlen(src) % HD_BYTE_SIZE != 0) {
+               DHD_ERROR(("Mask invalid format. Needs to be of even length\n"));
+               return -1;
+       }
+       for (i = 0; *src != '\0'; i++) {
+               char num[HD_BYTE_SIZE + 1];
+
+               if (i > len - 1) {
+                       DHD_ERROR(("pattern not in range, idx: %d len: %d\n", i, len));
+                       return -1;
+               }
+               bcm_strncpy_s(num, sizeof(num), src, HD_BYTE_SIZE);
+               num[HD_BYTE_SIZE] = '\0';
+               dst[i] = (uint8)strtoul(num, NULL, 16);
+               src += HD_BYTE_SIZE;
+       }
+       return i;
+}
+#endif /* PKT_FILTER_SUPPORT || DHD_PKT_LOGGING */
+
+#ifdef PKT_FILTER_SUPPORT
+void
+dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode)
+{
+       char                            *argv[8];
+       int                                     i = 0;
+       const char                      *str;
+       int                                     buf_len;
+       int                                     str_len;
+       char                            *arg_save = 0, *arg_org = 0;
+       int                                     rc;
+       char                            buf[32] = {0};
+       wl_pkt_filter_enable_t  enable_parm;
+       wl_pkt_filter_enable_t  * pkt_filterp;
+
+       if (!arg)
+               return;
+
+       if (!(arg_save = MALLOC(dhd->osh, strlen(arg) + 1))) {
+               DHD_ERROR(("%s: malloc failed\n", __FUNCTION__));
+               goto fail;
+       }
+       arg_org = arg_save;
+       memcpy(arg_save, arg, strlen(arg) + 1);
+
+       argv[i] = bcmstrtok(&arg_save, " ", 0);
+
+       i = 0;
+       if (argv[i] == NULL) {
+               DHD_ERROR(("No args provided\n"));
+               goto fail;
+       }
+
+       str = "pkt_filter_enable";
+       str_len = strlen(str);
+       bcm_strncpy_s(buf, sizeof(buf) - 1, str, sizeof(buf) - 1);
+       buf[ sizeof(buf) - 1 ] = '\0';
+       buf_len = str_len + 1;
+
+       pkt_filterp = (wl_pkt_filter_enable_t *)(buf + str_len + 1);
+
+       /* Parse packet filter id. */
+       enable_parm.id = htod32(strtoul(argv[i], NULL, 0));
+       if (dhd_conf_del_pkt_filter(dhd, enable_parm.id))
+               goto fail;
+
+       /* Parse enable/disable value. */
+       enable_parm.enable = htod32(enable);
+
+       buf_len += sizeof(enable_parm);
+       memcpy((char *)pkt_filterp,
+              &enable_parm,
+              sizeof(enable_parm));
+
+       /* Enable/disable the specified filter. */
+       rc = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, buf_len, TRUE, 0);
+       rc = rc >= 0 ? 0 : rc;
+       if (rc) {
+               DHD_ERROR(("%s: failed to %s pktfilter %s, retcode = %d\n",
+               __FUNCTION__, enable?"enable":"disable", arg, rc));
+               dhd_set_packet_filter(dhd);
+               rc = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, buf_len, TRUE, 0);
+               rc = rc >= 0 ? 0 : rc;
+               if (rc) {
+                       DHD_TRACE_HW4(("%s: 2nd retry failed to add pktfilter %s, retcode = %d\n",
+                       __FUNCTION__, arg, rc));
+               } else {
+                       DHD_TRACE_HW4(("%s: 2nd retry successfully added pktfilter %s\n",
+                       __FUNCTION__, arg));
+               }
+       }
+       else
+               DHD_TRACE(("%s: successfully %s pktfilter %s\n",
+               __FUNCTION__, enable?"enable":"disable", arg));
+
+       /* Contorl the master mode */
+       rc = dhd_wl_ioctl_set_intiovar(dhd, "pkt_filter_mode",
+               master_mode, WLC_SET_VAR, TRUE, 0);
+       rc = rc >= 0 ? 0 : rc;
+       if (rc)
+               DHD_TRACE(("%s: failed to set pkt_filter_mode %d, retcode = %d\n",
+                       __FUNCTION__, master_mode, rc));
+
+fail:
+       if (arg_org)
+               MFREE(dhd->osh, arg_org, strlen(arg) + 1);
+}
+
+/* Packet filter section: extended filters have named offsets, add table here */
+typedef struct {
+       char *name;
+       uint16 base;
+} wl_pfbase_t;
+
+static wl_pfbase_t basenames[] = { WL_PKT_FILTER_BASE_NAMES };
+
+static int
+wl_pkt_filter_base_parse(char *name)
+{
+       uint i;
+       char *bname, *uname;
+
+       for (i = 0; i < ARRAYSIZE(basenames); i++) {
+               bname = basenames[i].name;
+               for (uname = name; *uname; bname++, uname++) {
+                       if (*bname != bcm_toupper(*uname)) {
+                               break;
+                       }
+               }
+               if (!*uname && !*bname) {
+                       break;
+               }
+       }
+
+       if (i < ARRAYSIZE(basenames)) {
+               return basenames[i].base;
+       } else {
+               return -1;
+       }
+}
+
+void
+dhd_pktfilter_offload_set(dhd_pub_t * dhd, char *arg)
+{
+       const char                      *str;
+       wl_pkt_filter_t                 pkt_filter;
+       wl_pkt_filter_t                 *pkt_filterp;
+       int                             buf_len;
+       int                             str_len;
+       int                             rc = -1;
+       uint32                          mask_size;
+       uint32                          pattern_size;
+       char                            *argv[MAXPKT_ARG] = {0}, * buf = 0;
+       int                             i = 0;
+       char                            *arg_save = 0, *arg_org = 0;
+
+       if (!arg)
+               return;
+
+       if (!(arg_save = MALLOC(dhd->osh, strlen(arg) + 1))) {
+               DHD_ERROR(("%s: malloc failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+       arg_org = arg_save;
+
+       if (!(buf = MALLOC(dhd->osh, MAX_PKTFLT_BUF_SIZE))) {
+               DHD_ERROR(("%s: malloc failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+       memset(buf, 0, MAX_PKTFLT_BUF_SIZE);
+       memcpy(arg_save, arg, strlen(arg) + 1);
+
+       if (strlen(arg) > MAX_PKTFLT_BUF_SIZE) {
+               DHD_ERROR(("Not enough buffer %d < %d\n", (int)strlen(arg), (int)sizeof(buf)));
+               goto fail;
+       }
+
+       argv[i] = bcmstrtok(&arg_save, " ", 0);
+       while (argv[i++]) {
+               if (i >= MAXPKT_ARG) {
+                       DHD_ERROR(("Invalid args provided\n"));
+                       goto fail;
+               }
+               argv[i] = bcmstrtok(&arg_save, " ", 0);
+       }
+
+       i = 0;
+       if (argv[i] == NULL) {
+               DHD_ERROR(("No args provided\n"));
+               goto fail;
+       }
+
+       str = "pkt_filter_add";
+       str_len = strlen(str);
+       bcm_strncpy_s(buf, MAX_PKTFLT_BUF_SIZE, str, str_len);
+       buf[ str_len ] = '\0';
+       buf_len = str_len + 1;
+
+       pkt_filterp = (wl_pkt_filter_t *) (buf + str_len + 1);
+
+       /* Parse packet filter id. */
+       pkt_filter.id = htod32(strtoul(argv[i], NULL, 0));
+
+       if (argv[++i] == NULL) {
+               DHD_ERROR(("Polarity not provided\n"));
+               goto fail;
+       }
+
+       /* Parse filter polarity. */
+       pkt_filter.negate_match = htod32(strtoul(argv[i], NULL, 0));
+
+       if (argv[++i] == NULL) {
+               DHD_ERROR(("Filter type not provided\n"));
+               goto fail;
+       }
+
+       /* Parse filter type. */
+       pkt_filter.type = htod32(strtoul(argv[i], NULL, 0));
+
+       if ((pkt_filter.type == 0) || (pkt_filter.type == 1)) {
+               if (argv[++i] == NULL) {
+                       DHD_ERROR(("Offset not provided\n"));
+                       goto fail;
+               }
+
+               /* Parse pattern filter offset. */
+               pkt_filter.u.pattern.offset = htod32(strtoul(argv[i], NULL, 0));
+
+               if (argv[++i] == NULL) {
+                       DHD_ERROR(("Bitmask not provided\n"));
+                       goto fail;
+               }
+
+               /* Parse pattern filter mask. */
+               rc  = wl_pattern_atoh(argv[i],
+                       (char *) pkt_filterp->u.pattern.mask_and_pattern);
+
+               if (rc == -1) {
+                       DHD_ERROR(("Rejecting: %s\n", argv[i]));
+                       goto fail;
+               }
+               mask_size = htod32(rc);
+               if (argv[++i] == NULL) {
+                       DHD_ERROR(("Pattern not provided\n"));
+                       goto fail;
+               }
+
+               /* Parse pattern filter pattern. */
+               rc = wl_pattern_atoh(argv[i],
+                       (char *) &pkt_filterp->u.pattern.mask_and_pattern[mask_size]);
+
+               if (rc == -1) {
+                       DHD_ERROR(("Rejecting: %s\n", argv[i]));
+                       goto fail;
+               }
+               pattern_size = htod32(rc);
+               if (mask_size != pattern_size) {
+                       DHD_ERROR(("Mask and pattern not the same size\n"));
+                       goto fail;
+               }
+
+               pkt_filter.u.pattern.size_bytes = mask_size;
+               buf_len += WL_PKT_FILTER_FIXED_LEN;
+               buf_len += (WL_PKT_FILTER_PATTERN_FIXED_LEN + 2 * mask_size);
+
+               /* Keep-alive attributes are set in local       variable (keep_alive_pkt), and
+                * then memcpy'ed into buffer (keep_alive_pktp) since there is no
+                * guarantee that the buffer is properly aligned.
+                */
+               memcpy((char *)pkt_filterp,
+                       &pkt_filter,
+                       WL_PKT_FILTER_FIXED_LEN + WL_PKT_FILTER_PATTERN_FIXED_LEN);
+       } else if ((pkt_filter.type == 2) || (pkt_filter.type == 6)) {
+               int list_cnt = 0;
+               char *endptr = NULL;
+               wl_pkt_filter_pattern_listel_t *pf_el =
+                       (wl_pkt_filter_pattern_listel_t *)&pkt_filterp->u.patlist.patterns[0];
+
+               while (argv[++i] != NULL) {
+                       /* Check valid buffer size. */
+                       if ((buf_len + MAX_PKTFLT_FIXED_BUF_SIZE) > MAX_PKTFLT_BUF_SIZE) {
+                               DHD_ERROR(("buffer over length MAX_PKTFLT_FIXED_BUF_SIZE\n"));
+                               goto fail;
+                       }
+
+                       /* Parse pattern filter base and offset. */
+                       if (bcm_isdigit(*argv[i])) {
+                               /* Numeric base */
+                               rc = strtoul(argv[i], &endptr, 0);
+                       } else {
+                               endptr = strchr(argv[i], ':');
+                               if (endptr) {
+                                       *endptr = '\0';
+                                       rc = wl_pkt_filter_base_parse(argv[i]);
+                                       if (rc == -1) {
+                                                printf("Invalid base %s\n", argv[i]);
+                                               goto fail;
+                                       }
+                                       *endptr = ':';
+                               }
+                       }
+
+                       if (endptr == NULL) {
+                               printf("Invalid [base:]offset format: %s\n", argv[i]);
+                               goto fail;
+                       }
+
+                       if (*endptr == ':') {
+                               pf_el->base_offs = htod16(rc);
+                               rc = strtoul(endptr + 1, &endptr, 0);
+                       } else {
+                               /* Must have had a numeric offset only */
+                               pf_el->base_offs = htod16(0);
+                       }
+
+                       if (*endptr) {
+                               printf("Invalid [base:]offset format: %s\n", argv[i]);
+                               goto fail;
+                       }
+                       if (rc > 0x0000FFFF) {
+                               printf("Offset too large\n");
+                               goto fail;
+                       }
+                       pf_el->rel_offs = htod16(rc);
+
+                       /* Clear match_flag (may be set in parsing which follows) */
+                       pf_el->match_flags = htod16(0);
+
+                       /* Parse pattern filter mask and pattern directly into ioctl buffer */
+                       if (argv[++i] == NULL) {
+                               printf("Bitmask not provided\n");
+                               goto fail;
+                       }
+                       rc = wl_pattern_atoh(argv[i], (char*)pf_el->mask_and_data);
+                       if ((rc == -1) || (rc > MAX_PKTFLT_FIXED_PATTERN_SIZE)) {
+                               printf("Rejecting: %s\n", argv[i]);
+                               goto fail;
+                       }
+                       mask_size = htod16(rc);
+
+                       if (argv[++i] == NULL) {
+                               printf("Pattern not provided\n");
+                               goto fail;
+                       }
+
+                       if (*argv[i] == '!') {
+                               pf_el->match_flags =
+                                       htod16(WL_PKT_FILTER_MFLAG_NEG);
+                               (argv[i])++;
+                       }
+                       if (*argv[i] == '\0') {
+                               printf("Pattern not provided\n");
+                               goto fail;
+                       }
+                       rc = wl_pattern_atoh(argv[i], (char*)&pf_el->mask_and_data[rc]);
+                       if ((rc == -1) || (rc > MAX_PKTFLT_FIXED_PATTERN_SIZE)) {
+                               printf("Rejecting: %s\n", argv[i]);
+                               goto fail;
+                       }
+                       pattern_size = htod16(rc);
+
+                       if (mask_size != pattern_size) {
+                               printf("Mask and pattern not the same size\n");
+                               goto fail;
+                       }
+
+                       pf_el->size_bytes = mask_size;
+
+                       /* Account for the size of this pattern element */
+                       buf_len += WL_PKT_FILTER_PATTERN_LISTEL_FIXED_LEN + 2 * rc;
+
+                       /* Move to next element location in ioctl buffer */
+                       pf_el = (wl_pkt_filter_pattern_listel_t*)
+                               ((uint8*)pf_el + WL_PKT_FILTER_PATTERN_LISTEL_FIXED_LEN + 2 * rc);
+
+                       /* Count list element */
+                       list_cnt++;
+               }
+
+               /* Account for initial fixed size, and copy initial fixed fields */
+               buf_len += WL_PKT_FILTER_FIXED_LEN + WL_PKT_FILTER_PATTERN_LIST_FIXED_LEN;
+
+               if (buf_len > MAX_PKTFLT_BUF_SIZE) {
+                       DHD_ERROR(("buffer over length MAX_PKTFLT_BUF_SIZE\n"));
+                       goto fail;
+               }
+
+               /* Update list count and total size */
+               pkt_filter.u.patlist.list_cnt = list_cnt;
+               pkt_filter.u.patlist.PAD1[0] = 0;
+               pkt_filter.u.patlist.totsize = buf + buf_len - (char*)pkt_filterp;
+               pkt_filter.u.patlist.totsize -= WL_PKT_FILTER_FIXED_LEN;
+
+               memcpy((char *)pkt_filterp, &pkt_filter,
+                       WL_PKT_FILTER_FIXED_LEN + WL_PKT_FILTER_PATTERN_LIST_FIXED_LEN);
+       } else {
+               DHD_ERROR(("Invalid filter type %d\n", pkt_filter.type));
+               goto fail;
+       }
+
+       rc = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, buf_len, TRUE, 0);
+       rc = rc >= 0 ? 0 : rc;
+
+       if (rc)
+               DHD_ERROR(("%s: failed to add pktfilter %s, retcode = %d\n",
+               __FUNCTION__, arg, rc));
+       else
+               DHD_TRACE(("%s: successfully added pktfilter %s\n",
+               __FUNCTION__, arg));
+
+fail:
+       if (arg_org)
+               MFREE(dhd->osh, arg_org, strlen(arg) + 1);
+
+       if (buf)
+               MFREE(dhd->osh, buf, MAX_PKTFLT_BUF_SIZE);
+}
+
+void
+dhd_pktfilter_offload_delete(dhd_pub_t *dhd, int id)
+{
+       int ret;
+
+       ret = dhd_wl_ioctl_set_intiovar(dhd, "pkt_filter_delete",
+               id, WLC_SET_VAR, TRUE, 0);
+       if (ret < 0) {
+               DHD_ERROR(("%s: Failed to delete filter ID:%d, ret=%d\n",
+                       __FUNCTION__, id, ret));
+       }
+       else
+               DHD_TRACE(("%s: successfully deleted pktfilter %d\n",
+               __FUNCTION__, id));
+}
+#endif /* PKT_FILTER_SUPPORT */
+
+/* ========================== */
+/* ==== ARP OFFLOAD SUPPORT = */
+/* ========================== */
+#ifdef ARP_OFFLOAD_SUPPORT
+void
+dhd_arp_offload_set(dhd_pub_t * dhd, int arp_mode)
+{
+       int retcode;
+
+       retcode = dhd_wl_ioctl_set_intiovar(dhd, "arp_ol",
+               arp_mode, WLC_SET_VAR, TRUE, 0);
+
+       retcode = retcode >= 0 ? 0 : retcode;
+       if (retcode) {
+               DHD_ERROR(("%s: failed to set ARP offload mode to 0x%x, retcode = %d\n",
+                       __FUNCTION__, arp_mode, retcode));
+       } else {
+               DHD_ARPOE(("%s: successfully set ARP offload mode to 0x%x\n",
+                       __FUNCTION__, arp_mode));
+               dhd->arpol_configured = TRUE;
+       }
+}
+
+void
+dhd_arp_offload_enable(dhd_pub_t * dhd, int arp_enable)
+{
+       int retcode;
+
+       if (!dhd->arpol_configured) {
+               /* If arpol is not applied, apply it */
+               dhd_arp_offload_set(dhd, dhd_arp_mode);
+       }
+
+       retcode = dhd_wl_ioctl_set_intiovar(dhd, "arpoe",
+               arp_enable, WLC_SET_VAR, TRUE, 0);
+       retcode = retcode >= 0 ? 0 : retcode;
+       if (retcode)
+               DHD_ERROR(("%s: failed to enabe ARP offload to %d, retcode = %d\n",
+                       __FUNCTION__, arp_enable, retcode));
+       else
+#ifdef DHD_LOG_DUMP
+               DHD_LOG_MEM(("%s: successfully enabed ARP offload to %d\n",
+                       __FUNCTION__, arp_enable));
+#else
+               DHD_ARPOE(("%s: successfully enabed ARP offload to %d\n",
+                       __FUNCTION__, arp_enable));
+#endif /* DHD_LOG_DUMP */
+       if (arp_enable) {
+               uint32 version;
+               retcode = dhd_wl_ioctl_get_intiovar(dhd, "arp_version",
+                       &version, WLC_GET_VAR, FALSE, 0);
+               if (retcode) {
+                       DHD_INFO(("%s: fail to get version (maybe version 1:retcode = %d\n",
+                               __FUNCTION__, retcode));
+                       dhd->arp_version = 1;
+               }
+               else {
+                       DHD_INFO(("%s: ARP Version= %x\n", __FUNCTION__, version));
+                       dhd->arp_version = version;
+               }
+       }
+}
+
+/* XXX ANDREY: clear AOE arp_table  */
+void
+dhd_aoe_arp_clr(dhd_pub_t *dhd, int idx)
+{
+       int ret = 0;
+
+       if (dhd == NULL) return;
+       if (dhd->arp_version == 1)
+               idx = 0;
+
+       ret = dhd_iovar(dhd, idx, "arp_table_clear", NULL, 0, NULL, 0, TRUE);
+       if (ret < 0)
+               DHD_ERROR(("%s failed code %d\n", __FUNCTION__, ret));
+       else {
+#ifdef DHD_LOG_DUMP
+               DHD_LOG_MEM(("%s: ARP table clear\n", __FUNCTION__));
+#else
+               DHD_TRACE(("%s: ARP table clear\n", __FUNCTION__));
+#endif /* DHD_LOG_DUMP */
+       }
+       /* mac address isn't cleared here but it will be cleared after dongle off */
+       dhd->hmac_updated = 0;
+}
+
+/* XXX ANDREY: clear hostip table  */
+void
+dhd_aoe_hostip_clr(dhd_pub_t *dhd, int idx)
+{
+       int ret = 0;
+
+       if (dhd == NULL) return;
+       if (dhd->arp_version == 1)
+               idx = 0;
+
+       ret = dhd_iovar(dhd, idx, "arp_hostip_clear", NULL, 0, NULL, 0, TRUE);
+       if (ret < 0)
+               DHD_ERROR(("%s failed code %d\n", __FUNCTION__, ret));
+       else {
+#ifdef DHD_LOG_DUMP
+               DHD_LOG_MEM(("%s: ARP host ip clear\n", __FUNCTION__));
+#else
+               DHD_TRACE(("%s: ARP host ip clear\n", __FUNCTION__));
+#endif /* DHD_LOG_DUMP */
+       }
+}
+
+void
+dhd_arp_offload_add_ip(dhd_pub_t *dhd, uint32 ipaddr, int idx)
+{
+       int ret;
+
+       if (dhd == NULL) return;
+       if (dhd->arp_version == 1)
+               idx = 0;
+
+       ret = dhd_iovar(dhd, idx, "arp_hostip", (char *)&ipaddr, sizeof(ipaddr),
+                       NULL, 0, TRUE);
+       if (ret < 0)
+               DHD_ERROR(("%s: ARP ip addr add failed, ret = %d\n", __FUNCTION__, ret));
+       else {
+               /* mac address is updated in the dongle */
+               dhd->hmac_updated = 1;
+#ifdef DHD_LOG_DUMP
+               DHD_LOG_MEM(("%s: ARP ip addr entry added \n", __FUNCTION__));
+#else
+               DHD_ARPOE(("%s: ARP ip addr entry added \n", __FUNCTION__));
+#endif /* DHD_LOG_DUMP */
+       }
+}
+
+int
+dhd_arp_get_arp_hostip_table(dhd_pub_t *dhd, void *buf, int buflen, int idx)
+{
+       int ret, i;
+       uint32 *ptr32 = buf;
+       bool clr_bottom = FALSE;
+
+       if (!buf)
+               return -1;
+       if (dhd == NULL) return -1;
+       if (dhd->arp_version == 1)
+               idx = 0;
+
+       ret = dhd_iovar(dhd, idx, "arp_hostip", NULL, 0, (char *)buf, buflen,
+                       FALSE);
+       if (ret) {
+               DHD_ERROR(("%s: ioctl WLC_GET_VAR error %d\n",
+               __FUNCTION__, ret));
+
+               return -1;
+       }
+
+       /* clean up the buf, ascii reminder */
+       for (i = 0; i < MAX_IPV4_ENTRIES; i++) {
+               if (!clr_bottom) {
+                       if (*ptr32 == 0)
+                               clr_bottom = TRUE;
+               } else {
+                       *ptr32 = 0;
+               }
+               ptr32++;
+       }
+
+       return 0;
+}
+#endif /* ARP_OFFLOAD_SUPPORT  */
+
+/*
+ * Neighbor Discovery Offload: enable NDO feature
+ * Called  by ipv6 event handler when interface comes up/goes down
+ */
+int
+dhd_ndo_enable(dhd_pub_t * dhd, int ndo_enable)
+{
+       int retcode;
+
+       if (dhd == NULL)
+               return -1;
+
+#if defined(WL_CFG80211) && defined(WL_NAN)
+       if (wl_cfgnan_is_dp_active(dhd_linux_get_primary_netdev(dhd))) {
+               /* If nan dp is active, skip NDO */
+               DHD_INFO(("Active NAN DP, skip NDO\n"));
+               return 0;
+       }
+#endif /* WL_CFG80211 && WL_NAN */
+#ifdef WL_CFG80211
+       if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+               /* NDO disable on STA+SOFTAP mode */
+               ndo_enable = FALSE;
+       }
+#endif /* WL_CFG80211 */
+       retcode = dhd_wl_ioctl_set_intiovar(dhd, "ndoe",
+               ndo_enable, WLC_SET_VAR, TRUE, 0);
+       if (retcode)
+               DHD_ERROR(("%s: failed to enabe ndo to %d, retcode = %d\n",
+                       __FUNCTION__, ndo_enable, retcode));
+       else
+               DHD_TRACE(("%s: successfully enabed ndo offload to %d\n",
+                       __FUNCTION__, ndo_enable));
+
+       return retcode;
+}
+
+/*
+ * Neighbor Discover Offload: enable NDO feature
+ * Called  by ipv6 event handler when interface comes up
+ */
+int
+dhd_ndo_add_ip(dhd_pub_t *dhd, char* ipv6addr, int idx)
+{
+       int iov_len = 0;
+       char iovbuf[DHD_IOVAR_BUF_SIZE];
+       int retcode;
+
+       if (dhd == NULL)
+               return -1;
+
+       iov_len = bcm_mkiovar("nd_hostip", (char *)ipv6addr,
+               IPV6_ADDR_LEN, iovbuf, sizeof(iovbuf));
+       if (!iov_len) {
+               DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+                       __FUNCTION__, sizeof(iovbuf)));
+               return -1;
+       }
+       retcode = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, idx);
+
+       if (retcode)
+               DHD_ERROR(("%s: ndo ip addr add failed, retcode = %d\n",
+               __FUNCTION__, retcode));
+       else
+               DHD_TRACE(("%s: ndo ipaddr entry added \n",
+               __FUNCTION__));
+
+       return retcode;
+}
+
+/*
+ * Neighbor Discover Offload: enable NDO feature
+ * Called  by ipv6 event handler when interface goes down
+ */
+int
+dhd_ndo_remove_ip(dhd_pub_t *dhd, int idx)
+{
+       int iov_len = 0;
+       char iovbuf[DHD_IOVAR_BUF_SIZE];
+       int retcode;
+
+       if (dhd == NULL)
+               return -1;
+
+       iov_len = bcm_mkiovar("nd_hostip_clear", NULL,
+               0, iovbuf, sizeof(iovbuf));
+       if (!iov_len) {
+               DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+                       __FUNCTION__, sizeof(iovbuf)));
+               return -1;
+       }
+       retcode = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, idx);
+
+       if (retcode)
+               DHD_ERROR(("%s: ndo ip addr remove failed, retcode = %d\n",
+               __FUNCTION__, retcode));
+       else
+               DHD_TRACE(("%s: ndo ipaddr entry removed \n",
+               __FUNCTION__));
+
+       return retcode;
+}
+/* Enhanced ND offload */
+uint16
+dhd_ndo_get_version(dhd_pub_t *dhdp)
+{
+       char iovbuf[DHD_IOVAR_BUF_SIZE];
+       wl_nd_hostip_t ndo_get_ver;
+       int iov_len;
+       int retcode;
+       uint16 ver = 0;
+
+       if (dhdp == NULL) {
+               return BCME_ERROR;
+       }
+
+       memset(&iovbuf, 0, sizeof(iovbuf));
+       ndo_get_ver.version = htod16(WL_ND_HOSTIP_IOV_VER);
+       ndo_get_ver.op_type = htod16(WL_ND_HOSTIP_OP_VER);
+       ndo_get_ver.length = htod32(WL_ND_HOSTIP_FIXED_LEN + sizeof(uint16));
+       ndo_get_ver.u.version = 0;
+       iov_len = bcm_mkiovar("nd_hostip", (char *)&ndo_get_ver,
+               WL_ND_HOSTIP_FIXED_LEN + sizeof(uint16), iovbuf, sizeof(iovbuf));
+
+       if (!iov_len) {
+               DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+                       __FUNCTION__, sizeof(iovbuf)));
+               return BCME_ERROR;
+       }
+
+       retcode = dhd_wl_ioctl_cmd(dhdp, WLC_GET_VAR, iovbuf, iov_len, FALSE, 0);
+
+       if (retcode) {
+               DHD_ERROR(("%s: failed, retcode = %d\n", __FUNCTION__, retcode));
+               /* ver iovar not supported. NDO version is 0 */
+               ver = 0;
+       } else {
+               wl_nd_hostip_t *ndo_ver_ret = (wl_nd_hostip_t *)iovbuf;
+
+               if ((dtoh16(ndo_ver_ret->version) == WL_ND_HOSTIP_IOV_VER) &&
+                               (dtoh16(ndo_ver_ret->op_type) == WL_ND_HOSTIP_OP_VER) &&
+                               (dtoh32(ndo_ver_ret->length) == WL_ND_HOSTIP_FIXED_LEN
+                                       + sizeof(uint16))) {
+                       /* nd_hostip iovar version */
+                       ver = dtoh16(ndo_ver_ret->u.version);
+               }
+
+               DHD_TRACE(("%s: successfully get version: %d\n", __FUNCTION__, ver));
+       }
+
+       return ver;
+}
+
+int
+dhd_ndo_add_ip_with_type(dhd_pub_t *dhdp, char *ipv6addr, uint8 type, int idx)
+{
+       char iovbuf[DHD_IOVAR_BUF_SIZE];
+       wl_nd_hostip_t ndo_add_addr;
+       int iov_len;
+       int retcode;
+
+       if (dhdp == NULL || ipv6addr == 0) {
+               return BCME_ERROR;
+       }
+
+       /* wl_nd_hostip_t fixed param */
+       ndo_add_addr.version = htod16(WL_ND_HOSTIP_IOV_VER);
+       ndo_add_addr.op_type = htod16(WL_ND_HOSTIP_OP_ADD);
+       ndo_add_addr.length = htod32(WL_ND_HOSTIP_WITH_ADDR_LEN);
+       /* wl_nd_host_ip_addr_t param for add */
+       memcpy(&ndo_add_addr.u.host_ip.ip_addr, ipv6addr, IPV6_ADDR_LEN);
+       ndo_add_addr.u.host_ip.type = type;
+
+       iov_len = bcm_mkiovar("nd_hostip", (char *)&ndo_add_addr,
+               WL_ND_HOSTIP_WITH_ADDR_LEN, iovbuf, sizeof(iovbuf));
+       if (!iov_len) {
+               DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+                       __FUNCTION__, sizeof(iovbuf)));
+               return BCME_ERROR;
+       }
+
+       retcode = dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR, iovbuf, iov_len, TRUE, idx);
+       if (retcode) {
+               DHD_ERROR(("%s: failed, retcode = %d\n", __FUNCTION__, retcode));
+#ifdef NDO_CONFIG_SUPPORT
+               if (retcode == BCME_NORESOURCE) {
+                       /* number of host ip addr exceeds FW capacity, Deactivate ND offload */
+                       DHD_INFO(("%s: Host IP count exceed device capacity,"
+                               "ND offload deactivated\n", __FUNCTION__));
+                       dhdp->ndo_host_ip_overflow = TRUE;
+                       dhd_ndo_enable(dhdp, FALSE);
+               }
+#endif /* NDO_CONFIG_SUPPORT */
+       } else {
+               DHD_TRACE(("%s: successfully added: %d\n", __FUNCTION__, retcode));
+       }
+
+       return retcode;
+}
+
+int
+dhd_ndo_remove_ip_by_addr(dhd_pub_t *dhdp, char *ipv6addr, int idx)
+{
+       char iovbuf[DHD_IOVAR_BUF_SIZE];
+       wl_nd_hostip_t ndo_del_addr;
+       int iov_len;
+       int retcode;
+
+       if (dhdp == NULL || ipv6addr == 0) {
+               return BCME_ERROR;
+       }
+
+       /* wl_nd_hostip_t fixed param */
+       ndo_del_addr.version = htod16(WL_ND_HOSTIP_IOV_VER);
+       ndo_del_addr.op_type = htod16(WL_ND_HOSTIP_OP_DEL);
+       ndo_del_addr.length = htod32(WL_ND_HOSTIP_WITH_ADDR_LEN);
+       /* wl_nd_host_ip_addr_t param for del */
+       memcpy(&ndo_del_addr.u.host_ip.ip_addr, ipv6addr, IPV6_ADDR_LEN);
+       ndo_del_addr.u.host_ip.type = 0;        /* don't care */
+
+       iov_len = bcm_mkiovar("nd_hostip", (char *)&ndo_del_addr,
+               WL_ND_HOSTIP_WITH_ADDR_LEN, iovbuf, sizeof(iovbuf));
+
+       if (!iov_len) {
+               DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+                       __FUNCTION__, sizeof(iovbuf)));
+               return BCME_ERROR;
+       }
+
+       retcode = dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR, iovbuf, iov_len, TRUE, idx);
+       if (retcode) {
+               DHD_ERROR(("%s: failed, retcode = %d\n", __FUNCTION__, retcode));
+       } else {
+               DHD_TRACE(("%s: successfully removed: %d\n", __FUNCTION__, retcode));
+       }
+
+       return retcode;
+}
+
+int
+dhd_ndo_remove_ip_by_type(dhd_pub_t *dhdp, uint8 type, int idx)
+{
+       char iovbuf[DHD_IOVAR_BUF_SIZE];
+       wl_nd_hostip_t ndo_del_addr;
+       int iov_len;
+       int retcode;
+
+       if (dhdp == NULL) {
+               return BCME_ERROR;
+       }
+
+       /* wl_nd_hostip_t fixed param */
+       ndo_del_addr.version = htod16(WL_ND_HOSTIP_IOV_VER);
+       if (type == WL_ND_IPV6_ADDR_TYPE_UNICAST) {
+               ndo_del_addr.op_type = htod16(WL_ND_HOSTIP_OP_DEL_UC);
+       } else if (type == WL_ND_IPV6_ADDR_TYPE_ANYCAST) {
+               ndo_del_addr.op_type = htod16(WL_ND_HOSTIP_OP_DEL_AC);
+       } else {
+               return BCME_BADARG;
+       }
+       ndo_del_addr.length = htod32(WL_ND_HOSTIP_FIXED_LEN);
+
+       iov_len = bcm_mkiovar("nd_hostip", (char *)&ndo_del_addr, WL_ND_HOSTIP_FIXED_LEN,
+                       iovbuf, sizeof(iovbuf));
+
+       if (!iov_len) {
+               DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+                       __FUNCTION__, sizeof(iovbuf)));
+               return BCME_ERROR;
+       }
+
+       retcode = dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR, iovbuf, iov_len, TRUE, idx);
+       if (retcode) {
+               DHD_ERROR(("%s: failed, retcode = %d\n", __FUNCTION__, retcode));
+       } else {
+               DHD_TRACE(("%s: successfully removed: %d\n", __FUNCTION__, retcode));
+       }
+
+       return retcode;
+}
+
+int
+dhd_ndo_unsolicited_na_filter_enable(dhd_pub_t *dhdp, int enable)
+{
+       char iovbuf[DHD_IOVAR_BUF_SIZE];
+       int iov_len;
+       int retcode;
+
+       if (dhdp == NULL) {
+               return BCME_ERROR;
+       }
+
+       iov_len = bcm_mkiovar("nd_unsolicited_na_filter", (char *)&enable, sizeof(int),
+                       iovbuf, sizeof(iovbuf));
+
+       if (!iov_len) {
+               DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+                       __FUNCTION__, sizeof(iovbuf)));
+               return BCME_ERROR;
+       }
+
+       retcode = dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR, iovbuf, iov_len, TRUE, 0);
+       if (retcode)
+               DHD_ERROR(("%s: failed to enable Unsolicited NA filter to %d, retcode = %d\n",
+                       __FUNCTION__, enable, retcode));
+       else {
+               DHD_TRACE(("%s: successfully enabled Unsolicited NA filter to %d\n",
+                       __FUNCTION__, enable));
+       }
+
+       return retcode;
+}
+#ifdef SIMPLE_ISCAN
+
+uint iscan_thread_id = 0;
+iscan_buf_t * iscan_chain = 0;
+
+iscan_buf_t *
+dhd_iscan_allocate_buf(dhd_pub_t *dhd, iscan_buf_t **iscanbuf)
+{
+       iscan_buf_t *iscanbuf_alloc = 0;
+       iscan_buf_t *iscanbuf_head;
+
+       DHD_ISCAN(("%s: Entered\n", __FUNCTION__));
+       dhd_iscan_lock();
+
+       iscanbuf_alloc = (iscan_buf_t*)MALLOC(dhd->osh, sizeof(iscan_buf_t));
+       if (iscanbuf_alloc == NULL)
+               goto fail;
+
+       iscanbuf_alloc->next = NULL;
+       iscanbuf_head = *iscanbuf;
+
+       DHD_ISCAN(("%s: addr of allocated node = 0x%X"
+                  "addr of iscanbuf_head = 0x%X dhd = 0x%X\n",
+                  __FUNCTION__, iscanbuf_alloc, iscanbuf_head, dhd));
+
+       if (iscanbuf_head == NULL) {
+               *iscanbuf = iscanbuf_alloc;
+               DHD_ISCAN(("%s: Head is allocated\n", __FUNCTION__));
+               goto fail;
+       }
+
+       while (iscanbuf_head->next)
+               iscanbuf_head = iscanbuf_head->next;
+
+       iscanbuf_head->next = iscanbuf_alloc;
+
+fail:
+       dhd_iscan_unlock();
+       return iscanbuf_alloc;
+}
+
+void
+dhd_iscan_free_buf(void *dhdp, iscan_buf_t *iscan_delete)
+{
+       iscan_buf_t *iscanbuf_free = 0;
+       iscan_buf_t *iscanbuf_prv = 0;
+       iscan_buf_t *iscanbuf_cur;
+       dhd_pub_t *dhd = dhd_bus_pub(dhdp);
+       DHD_ISCAN(("%s: Entered\n", __FUNCTION__));
+
+       dhd_iscan_lock();
+
+       iscanbuf_cur = iscan_chain;
+
+       /* If iscan_delete is null then delete the entire
+        * chain or else delete specific one provided
+        */
+       if (!iscan_delete) {
+               while (iscanbuf_cur) {
+                       iscanbuf_free = iscanbuf_cur;
+                       iscanbuf_cur = iscanbuf_cur->next;
+                       iscanbuf_free->next = 0;
+                       MFREE(dhd->osh, iscanbuf_free, sizeof(iscan_buf_t));
+               }
+               iscan_chain = 0;
+       } else {
+               while (iscanbuf_cur) {
+                       if (iscanbuf_cur == iscan_delete)
+                               break;
+                       iscanbuf_prv = iscanbuf_cur;
+                       iscanbuf_cur = iscanbuf_cur->next;
+               }
+               if (iscanbuf_prv)
+                       iscanbuf_prv->next = iscan_delete->next;
+
+               iscan_delete->next = 0;
+               MFREE(dhd->osh, iscan_delete, sizeof(iscan_buf_t));
+
+               if (!iscanbuf_prv)
+                       iscan_chain = 0;
+       }
+       dhd_iscan_unlock();
+}
+
+iscan_buf_t *
+dhd_iscan_result_buf(void)
+{
+       return iscan_chain;
+}
+
+int
+dhd_iscan_issue_request(void * dhdp, wl_iscan_params_t *pParams, uint32 size)
+{
+       int rc = -1;
+       dhd_pub_t *dhd = dhd_bus_pub(dhdp);
+       char *buf;
+       char iovar[] = "iscan";
+       uint32 allocSize = 0;
+       wl_ioctl_t ioctl;
+       int len;
+
+       if (pParams) {
+               allocSize = (size + strlen(iovar) + 1);
+               if ((allocSize < size) || (allocSize < strlen(iovar)))
+               {
+                       DHD_ERROR(("%s: overflow - allocation size too large %d < %d + %d!\n",
+                               __FUNCTION__, allocSize, size, strlen(iovar)));
+                       goto cleanUp;
+               }
+               buf = MALLOC(dhd->osh, allocSize);
+
+               if (buf == NULL)
+                       {
+                       DHD_ERROR(("%s: malloc of size %d failed!\n", __FUNCTION__, allocSize));
+                       goto cleanUp;
+                       }
+               ioctl.cmd = WLC_SET_VAR;
+               len = bcm_mkiovar(iovar, (char *)pParams, size, buf, allocSize);
+               if (len == 0) {
+                       rc = BCME_BUFTOOSHORT;
+                       goto cleanUp;
+               }
+               rc = dhd_wl_ioctl(dhd, 0, &ioctl, buf, len);
+       }
+
+cleanUp:
+       if (buf) {
+               MFREE(dhd->osh, buf, allocSize);
+       }
+
+       return rc;
+}
+
+static int
+dhd_iscan_get_partial_result(void *dhdp, uint *scan_count)
+{
+       wl_iscan_results_t *list_buf;
+       wl_iscan_results_t list;
+       wl_scan_results_t *results;
+       iscan_buf_t *iscan_cur;
+       int status = -1;
+       dhd_pub_t *dhd = dhd_bus_pub(dhdp);
+       int rc;
+       wl_ioctl_t ioctl;
+       int len;
+
+       DHD_ISCAN(("%s: Enter\n", __FUNCTION__));
+
+       iscan_cur = dhd_iscan_allocate_buf(dhd, &iscan_chain);
+       if (!iscan_cur) {
+               DHD_ERROR(("%s: Failed to allocate node\n", __FUNCTION__));
+               dhd_iscan_free_buf(dhdp, 0);
+               dhd_iscan_request(dhdp, WL_SCAN_ACTION_ABORT);
+               dhd_ind_scan_confirm(dhdp, FALSE);
+               goto fail;
+       }
+
+       dhd_iscan_lock();
+
+       memset(iscan_cur->iscan_buf, 0, WLC_IW_ISCAN_MAXLEN);
+       list_buf = (wl_iscan_results_t*)iscan_cur->iscan_buf;
+       results = &list_buf->results;
+       results->buflen = WL_ISCAN_RESULTS_FIXED_SIZE;
+       results->version = 0;
+       results->count = 0;
+
+       memset(&list, 0, sizeof(list));
+       list.results.buflen = htod32(WLC_IW_ISCAN_MAXLEN);
+       len = bcm_mkiovar("iscanresults", (char *)&list, WL_ISCAN_RESULTS_FIXED_SIZE,
+               iscan_cur->iscan_buf, WLC_IW_ISCAN_MAXLEN);
+       if (len == 0) {
+               dhd_iscan_free_buf(dhdp, 0);
+               dhd_iscan_request(dhdp, WL_SCAN_ACTION_ABORT);
+               dhd_ind_scan_confirm(dhdp, FALSE);
+               status = BCME_BUFTOOSHORT;
+               goto fail;
+       }
+       ioctl.cmd = WLC_GET_VAR;
+       ioctl.set = FALSE;
+       rc = dhd_wl_ioctl(dhd, 0, &ioctl, iscan_cur->iscan_buf, WLC_IW_ISCAN_MAXLEN);
+
+       results->buflen = dtoh32(results->buflen);
+       results->version = dtoh32(results->version);
+       *scan_count = results->count = dtoh32(results->count);
+       status = dtoh32(list_buf->status);
+       DHD_ISCAN(("%s: Got %d resuls status = (%x)\n", __FUNCTION__, results->count, status));
+
+       dhd_iscan_unlock();
+
+       if (!(*scan_count)) {
+                /* TODO: race condition when FLUSH already called */
+               dhd_iscan_free_buf(dhdp, 0);
+       }
+fail:
+       return status;
+}
+
+#endif /* SIMPLE_ISCAN */
+
+/*
+ * returns = TRUE if associated, FALSE if not associated
+ */
+bool dhd_is_associated(dhd_pub_t *dhd, uint8 ifidx, int *retval)
+{
+       char bssid[6], zbuf[6];
+       int ret = -1;
+
+       bzero(bssid, 6);
+       bzero(zbuf, 6);
+
+       ret  = dhd_wl_ioctl_cmd(dhd, WLC_GET_BSSID, (char *)&bssid,
+               ETHER_ADDR_LEN, FALSE, ifidx);
+       /* XXX:AS!!! res can be: -17(BCME_NOTASSOCIATED),-22(BCME_NORESOURCE), and 0(OK)
+         OK - doesn't mean associated yet, the returned bssid
+         still needs to be checked for non zero array
+       */
+       DHD_TRACE((" %s WLC_GET_BSSID ioctl res = %d\n", __FUNCTION__, ret));
+
+       if (ret == BCME_NOTASSOCIATED) {
+               DHD_ERROR(("%s: WLC_GET_BSSID, NOT ASSOCIATED\n", __FUNCTION__));
+       }
+
+       if (retval)
+               *retval = ret;
+
+       if (ret < 0)
+               return FALSE;
+
+       if ((memcmp(bssid, zbuf, ETHER_ADDR_LEN) == 0)) {
+               DHD_TRACE(("%s: WLC_GET_BSSID ioctl returned zero bssid\n", __FUNCTION__));
+               return FALSE;
+       }
+       return TRUE;
+}
+
+/* Function to estimate possible DTIM_SKIP value */
+#if defined(BCMPCIE)
+int
+dhd_get_suspend_bcn_li_dtim(dhd_pub_t *dhd, int *dtim_period, int *bcn_interval)
+{
+       int bcn_li_dtim = 1; /* deafult no dtim skip setting */
+       int ret = -1;
+       int allowed_skip_dtim_cnt = 0;
+
+       if (dhd->disable_dtim_in_suspend) {
+               DHD_ERROR(("%s Disable bcn_li_dtim in suspend\n", __FUNCTION__));
+               bcn_li_dtim = 0;
+               return bcn_li_dtim;
+       }
+
+       /* Check if associated */
+       if (dhd_is_associated(dhd, 0, NULL) == FALSE) {
+               DHD_TRACE(("%s NOT assoc ret %d\n", __FUNCTION__, ret));
+               return bcn_li_dtim;
+       }
+
+       if (dtim_period == NULL || bcn_interval == NULL)
+               return bcn_li_dtim;
+
+       /* read associated AP beacon interval */
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_BCNPRD,
+               bcn_interval, sizeof(*bcn_interval), FALSE, 0)) < 0) {
+               DHD_ERROR(("%s get beacon failed code %d\n", __FUNCTION__, ret));
+               return bcn_li_dtim;
+       }
+
+       /* read associated AP dtim setup */
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_DTIMPRD,
+               dtim_period, sizeof(*dtim_period), FALSE, 0)) < 0) {
+               DHD_ERROR(("%s failed code %d\n", __FUNCTION__, ret));
+               return bcn_li_dtim;
+       }
+
+       /* if not assocated just return */
+       if (*dtim_period == 0) {
+               return bcn_li_dtim;
+       }
+
+       if (dhd->max_dtim_enable) {
+               bcn_li_dtim =
+                       (int) (MAX_DTIM_ALLOWED_INTERVAL / ((*dtim_period) * (*bcn_interval)));
+               if (bcn_li_dtim == 0) {
+                       bcn_li_dtim = 1;
+               }
+       } else {
+               /* attemp to use platform defined dtim skip interval */
+               bcn_li_dtim = dhd->suspend_bcn_li_dtim;
+
+               /* check if sta listen interval fits into AP dtim */
+               if (*dtim_period > CUSTOM_LISTEN_INTERVAL) {
+                       /* AP DTIM to big for our Listen Interval : no dtim skiping */
+                       bcn_li_dtim = NO_DTIM_SKIP;
+                       DHD_ERROR(("%s DTIM=%d > Listen=%d : too big ...\n",
+                               __FUNCTION__, *dtim_period, CUSTOM_LISTEN_INTERVAL));
+                       return bcn_li_dtim;
+               }
+
+               if (((*dtim_period) * (*bcn_interval) * bcn_li_dtim) > MAX_DTIM_ALLOWED_INTERVAL) {
+                       allowed_skip_dtim_cnt =
+                               MAX_DTIM_ALLOWED_INTERVAL / ((*dtim_period) * (*bcn_interval));
+                       bcn_li_dtim =
+                               (allowed_skip_dtim_cnt != 0) ? allowed_skip_dtim_cnt : NO_DTIM_SKIP;
+               }
+
+               if ((bcn_li_dtim * (*dtim_period)) > CUSTOM_LISTEN_INTERVAL) {
+                       /* Round up dtim_skip to fit into STAs Listen Interval */
+                       bcn_li_dtim = (int)(CUSTOM_LISTEN_INTERVAL / *dtim_period);
+                       DHD_TRACE(("%s agjust dtim_skip as %d\n", __FUNCTION__, bcn_li_dtim));
+               }
+       }
+
+       if (dhd->conf->suspend_bcn_li_dtim >= 0)
+               bcn_li_dtim = dhd->conf->suspend_bcn_li_dtim;
+       DHD_ERROR(("%s beacon=%d bcn_li_dtim=%d DTIM=%d Listen=%d\n",
+               __FUNCTION__, *bcn_interval, bcn_li_dtim, *dtim_period, CUSTOM_LISTEN_INTERVAL));
+
+       return bcn_li_dtim;
+}
+#else /* OEM_ANDROID && BCMPCIE */
+int
+dhd_get_suspend_bcn_li_dtim(dhd_pub_t *dhd)
+{
+       int bcn_li_dtim = 1; /* deafult no dtim skip setting */
+       int ret = -1;
+       int dtim_period = 0;
+       int ap_beacon = 0;
+       int allowed_skip_dtim_cnt = 0;
+
+       if (dhd->disable_dtim_in_suspend) {
+               DHD_ERROR(("%s Disable bcn_li_dtim in suspend\n", __FUNCTION__));
+               bcn_li_dtim = 0;
+               goto exit;
+       }
+
+       /* Check if associated */
+       if (dhd_is_associated(dhd, 0, NULL) == FALSE) {
+               DHD_TRACE(("%s NOT assoc ret %d\n", __FUNCTION__, ret));
+               goto exit;
+       }
+
+       /* read associated AP beacon interval */
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_BCNPRD,
+               &ap_beacon, sizeof(ap_beacon), FALSE, 0)) < 0) {
+               DHD_ERROR(("%s get beacon failed code %d\n", __FUNCTION__, ret));
+               goto exit;
+       }
+
+       /* read associated ap's dtim setup */
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_DTIMPRD,
+               &dtim_period, sizeof(dtim_period), FALSE, 0)) < 0) {
+               DHD_ERROR(("%s failed code %d\n", __FUNCTION__, ret));
+               goto exit;
+       }
+
+       /* if not assocated just exit */
+       if (dtim_period == 0) {
+               goto exit;
+       }
+
+       if (dhd->max_dtim_enable) {
+               bcn_li_dtim =
+                       (int) (MAX_DTIM_ALLOWED_INTERVAL / (ap_beacon * dtim_period));
+               if (bcn_li_dtim == 0) {
+                       bcn_li_dtim = 1;
+               }
+       } else {
+               /* attemp to use platform defined dtim skip interval */
+               bcn_li_dtim = dhd->suspend_bcn_li_dtim;
+
+               /* check if sta listen interval fits into AP dtim */
+               if (dtim_period > CUSTOM_LISTEN_INTERVAL) {
+                       /* AP DTIM to big for our Listen Interval : no dtim skiping */
+                       bcn_li_dtim = NO_DTIM_SKIP;
+                       DHD_ERROR(("%s DTIM=%d > Listen=%d : too big ...\n",
+                               __FUNCTION__, dtim_period, CUSTOM_LISTEN_INTERVAL));
+                       goto exit;
+               }
+
+               if ((dtim_period * ap_beacon * bcn_li_dtim) > MAX_DTIM_ALLOWED_INTERVAL) {
+                       allowed_skip_dtim_cnt =
+                               MAX_DTIM_ALLOWED_INTERVAL / (dtim_period * ap_beacon);
+                       bcn_li_dtim =
+                               (allowed_skip_dtim_cnt != 0) ? allowed_skip_dtim_cnt : NO_DTIM_SKIP;
+               }
+
+               if ((bcn_li_dtim * dtim_period) > CUSTOM_LISTEN_INTERVAL) {
+                       /* Round up dtim_skip to fit into STAs Listen Interval */
+                       bcn_li_dtim = (int)(CUSTOM_LISTEN_INTERVAL / dtim_period);
+                       DHD_TRACE(("%s agjust dtim_skip as %d\n", __FUNCTION__, bcn_li_dtim));
+               }
+       }
+
+       if (dhd->conf->suspend_bcn_li_dtim >= 0)
+               bcn_li_dtim = dhd->conf->suspend_bcn_li_dtim;
+       DHD_ERROR(("%s beacon=%d bcn_li_dtim=%d DTIM=%d Listen=%d\n",
+               __FUNCTION__, ap_beacon, bcn_li_dtim, dtim_period, CUSTOM_LISTEN_INTERVAL));
+
+exit:
+       return bcn_li_dtim;
+}
+#endif /* OEM_ANDROID && BCMPCIE */
+
+#ifdef CONFIG_SILENT_ROAM
+int
+dhd_sroam_set_mon(dhd_pub_t *dhd, bool set)
+{
+       int ret = BCME_OK;
+       wlc_sroam_t *psroam;
+       wlc_sroam_info_t *sroam;
+       uint sroamlen = sizeof(*sroam) + SROAM_HDRLEN;
+
+       /* Check if associated */
+       if (dhd_is_associated(dhd, 0, NULL) == FALSE) {
+               DHD_TRACE(("%s NOT assoc\n", __FUNCTION__));
+               return ret;
+       }
+
+       if (set && (dhd->op_mode &
+               (DHD_FLAG_HOSTAP_MODE | DHD_FLAG_P2P_GC_MODE | DHD_FLAG_P2P_GO_MODE))) {
+               DHD_INFO((" Failed to set sroam %d, op_mode 0x%04x\n", set, dhd->op_mode));
+               return ret;
+       }
+
+       if (!dhd->sroam_turn_on) {
+               DHD_INFO((" Failed to set sroam %d, sroam turn %d\n", set, dhd->sroam_turn_on));
+               return ret;
+       }
+       psroam = (wlc_sroam_t *)MALLOCZ(dhd->osh, sroamlen);
+       if (!psroam) {
+               DHD_ERROR(("%s Fail to malloc buffer\n", __FUNCTION__));
+               return BCME_NOMEM;
+       }
+
+       ret = dhd_iovar(dhd, 0, "sroam", NULL, 0, (char *)psroam, sroamlen, FALSE);
+       if (ret < 0) {
+               DHD_ERROR(("%s Failed to Get sroam %d\n", __FUNCTION__, ret));
+               goto done;
+       }
+
+       if (psroam->ver != WLC_SILENT_ROAM_CUR_VER) {
+               ret = BCME_VERSION;
+               goto done;
+       }
+
+       sroam = (wlc_sroam_info_t *)psroam->data;
+       sroam->sroam_on = set;
+       DHD_INFO((" Silent roam monitor mode %s\n", set ? "On" : "Off"));
+
+       ret = dhd_iovar(dhd, 0, "sroam", (char *)psroam, sroamlen, NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s Failed to Set sroam %d\n", __FUNCTION__, ret));
+       }
+
+done:
+       if (psroam) {
+           MFREE(dhd->osh, psroam, sroamlen);
+       }
+
+       return ret;
+}
+#endif /* CONFIG_SILENT_ROAM */
+
+/* Check if the mode supports STA MODE */
+bool dhd_support_sta_mode(dhd_pub_t *dhd)
+{
+
+#ifdef  WL_CFG80211
+       if (!(dhd->op_mode & DHD_FLAG_STA_MODE))
+               return FALSE;
+       else
+#endif /* WL_CFG80211 */
+               return TRUE;
+}
+
+#if defined(KEEP_ALIVE)
+int dhd_keep_alive_onoff(dhd_pub_t *dhd)
+{
+       char                            buf[32] = {0};
+       const char                      *str;
+       wl_mkeep_alive_pkt_t    mkeep_alive_pkt = {0, 0, 0, 0, 0, {0}};
+       wl_mkeep_alive_pkt_t    *mkeep_alive_pktp;
+       int                                     buf_len;
+       int                                     str_len;
+       int res                                 = -1;
+
+       if (!dhd_support_sta_mode(dhd))
+               return res;
+
+       DHD_TRACE(("%s execution\n", __FUNCTION__));
+
+       str = "mkeep_alive";
+       str_len = strlen(str);
+       strlcpy(buf, str, sizeof(buf));
+       mkeep_alive_pktp = (wl_mkeep_alive_pkt_t *) (buf + str_len + 1);
+       mkeep_alive_pkt.period_msec = dhd->conf->keep_alive_period;
+       buf_len = str_len + 1;
+       mkeep_alive_pkt.version = htod16(WL_MKEEP_ALIVE_VERSION);
+       mkeep_alive_pkt.length = htod16(WL_MKEEP_ALIVE_FIXED_LEN);
+       /* Setup keep alive zero for null packet generation */
+       mkeep_alive_pkt.keep_alive_id = 0;
+       mkeep_alive_pkt.len_bytes = 0;
+       buf_len += WL_MKEEP_ALIVE_FIXED_LEN;
+       bzero(mkeep_alive_pkt.data, sizeof(mkeep_alive_pkt.data));
+       /* Keep-alive attributes are set in local       variable (mkeep_alive_pkt), and
+        * then memcpy'ed into buffer (mkeep_alive_pktp) since there is no
+        * guarantee that the buffer is properly aligned.
+        */
+       memcpy((char *)mkeep_alive_pktp, &mkeep_alive_pkt, WL_MKEEP_ALIVE_FIXED_LEN);
+
+       res = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, buf_len, TRUE, 0);
+
+       return res;
+}
+#endif /* defined(KEEP_ALIVE) */
+#define        CSCAN_TLV_TYPE_SSID_IE  'S'
+/*
+ *  SSIDs list parsing from cscan tlv list
+ */
+int
+wl_parse_ssid_list_tlv(char** list_str, wlc_ssid_ext_t* ssid, int max, int *bytes_left)
+{
+       char* str;
+       int idx = 0;
+       uint8 len;
+
+       if ((list_str == NULL) || (*list_str == NULL) || (*bytes_left < 0)) {
+               DHD_ERROR(("%s error paramters\n", __FUNCTION__));
+               return BCME_BADARG;
+       }
+       str = *list_str;
+       while (*bytes_left > 0) {
+               if (str[0] != CSCAN_TLV_TYPE_SSID_IE) {
+                       *list_str = str;
+                       DHD_TRACE(("nssid=%d left_parse=%d %d\n", idx, *bytes_left, str[0]));
+                       return idx;
+               }
+
+               if (idx >= max) {
+                       DHD_ERROR(("%s number of SSIDs more than %d\n", __FUNCTION__, idx));
+                       return BCME_BADARG;
+               }
+
+               /* Get proper CSCAN_TLV_TYPE_SSID_IE */
+               *bytes_left -= 1;
+               if (*bytes_left == 0) {
+                       DHD_ERROR(("%s no length field.\n", __FUNCTION__));
+                       return BCME_BADARG;
+               }
+               str += 1;
+               ssid[idx].rssi_thresh = 0;
+               ssid[idx].flags = 0;
+               len = str[0];
+               if (len == 0) {
+                       /* Broadcast SSID */
+                       ssid[idx].SSID_len = 0;
+                       memset((char*)ssid[idx].SSID, 0x0, DOT11_MAX_SSID_LEN);
+                       *bytes_left -= 1;
+                       str += 1;
+
+                       DHD_TRACE(("BROADCAST SCAN  left=%d\n", *bytes_left));
+               } else if (len <= DOT11_MAX_SSID_LEN) {
+                       /* Get proper SSID size */
+                       ssid[idx].SSID_len = len;
+                       *bytes_left -= 1;
+                       /* Get SSID */
+                       if (ssid[idx].SSID_len > *bytes_left) {
+                               DHD_ERROR(("%s out of memory range len=%d but left=%d\n",
+                               __FUNCTION__, ssid[idx].SSID_len, *bytes_left));
+                               return BCME_BADARG;
+                       }
+                       str += 1;
+                       memcpy((char*)ssid[idx].SSID, str, ssid[idx].SSID_len);
+
+                       *bytes_left -= ssid[idx].SSID_len;
+                       str += ssid[idx].SSID_len;
+                       ssid[idx].hidden = TRUE;
+
+                       DHD_TRACE(("%s :size=%d left=%d\n",
+                               (char*)ssid[idx].SSID, ssid[idx].SSID_len, *bytes_left));
+               } else {
+                       DHD_ERROR(("### SSID size more than %d\n", str[0]));
+                       return BCME_BADARG;
+               }
+               idx++;
+       }
+
+       *list_str = str;
+       return idx;
+}
+
+#if defined(WL_WIRELESS_EXT)
+/* Android ComboSCAN support */
+
+/*
+ *  data parsing from ComboScan tlv list
+*/
+int
+wl_iw_parse_data_tlv(char** list_str, void *dst, int dst_size, const char token,
+                     int input_size, int *bytes_left)
+{
+       char* str;
+       uint16 short_temp;
+       uint32 int_temp;
+
+       if ((list_str == NULL) || (*list_str == NULL) ||(bytes_left == NULL) || (*bytes_left < 0)) {
+               DHD_ERROR(("%s error paramters\n", __FUNCTION__));
+               return -1;
+       }
+       str = *list_str;
+
+       /* Clean all dest bytes */
+       memset(dst, 0, dst_size);
+       if (*bytes_left > 0) {
+
+               if (str[0] != token) {
+                       DHD_TRACE(("%s NOT Type=%d get=%d left_parse=%d \n",
+                               __FUNCTION__, token, str[0], *bytes_left));
+                       return -1;
+               }
+
+               *bytes_left -= 1;
+               str += 1;
+
+               if (input_size == 1) {
+                       memcpy(dst, str, input_size);
+               }
+               else if (input_size == 2) {
+                       memcpy(dst, (char *)htod16(memcpy(&short_temp, str, input_size)),
+                               input_size);
+               }
+               else if (input_size == 4) {
+                       memcpy(dst, (char *)htod32(memcpy(&int_temp, str, input_size)),
+                               input_size);
+               }
+
+               *bytes_left -= input_size;
+               str += input_size;
+               *list_str = str;
+               return 1;
+       }
+       return 1;
+}
+
+/*
+ *  channel list parsing from cscan tlv list
+*/
+int
+wl_iw_parse_channel_list_tlv(char** list_str, uint16* channel_list,
+                             int channel_num, int *bytes_left)
+{
+       char* str;
+       int idx = 0;
+
+       if ((list_str == NULL) || (*list_str == NULL) ||(bytes_left == NULL) || (*bytes_left < 0)) {
+               DHD_ERROR(("%s error paramters\n", __FUNCTION__));
+               return -1;
+       }
+       str = *list_str;
+
+       while (*bytes_left > 0) {
+
+               if (str[0] != CSCAN_TLV_TYPE_CHANNEL_IE) {
+                       *list_str = str;
+                       DHD_TRACE(("End channel=%d left_parse=%d %d\n", idx, *bytes_left, str[0]));
+                       return idx;
+               }
+               /* Get proper CSCAN_TLV_TYPE_CHANNEL_IE */
+               *bytes_left -= 1;
+               str += 1;
+
+               if (str[0] == 0) {
+                       /* All channels */
+                       channel_list[idx] = 0x0;
+               }
+               else {
+                       channel_list[idx] = (uint16)str[0];
+                       DHD_TRACE(("%s channel=%d \n", __FUNCTION__,  channel_list[idx]));
+               }
+               *bytes_left -= 1;
+               str += 1;
+
+               if (idx++ > 255) {
+                       DHD_ERROR(("%s Too many channels \n", __FUNCTION__));
+                       return -1;
+               }
+       }
+
+       *list_str = str;
+       return idx;
+}
+
+/* Parse a comma-separated list from list_str into ssid array, starting
+ * at index idx.  Max specifies size of the ssid array.  Parses ssids
+ * and returns updated idx; if idx >= max not all fit, the excess have
+ * not been copied.  Returns -1 on empty string, or on ssid too long.
+ */
+int
+wl_iw_parse_ssid_list(char** list_str, wlc_ssid_t* ssid, int idx, int max)
+{
+       char* str, *ptr;
+
+       if ((list_str == NULL) || (*list_str == NULL))
+               return -1;
+
+       for (str = *list_str; str != NULL; str = ptr) {
+
+               /* check for next TAG */
+               if (!strncmp(str, GET_CHANNEL, strlen(GET_CHANNEL))) {
+                       *list_str        = str + strlen(GET_CHANNEL);
+                       return idx;
+               }
+
+               if ((ptr = strchr(str, ',')) != NULL) {
+                       *ptr++ = '\0';
+               }
+
+               if (strlen(str) > DOT11_MAX_SSID_LEN) {
+                       DHD_ERROR(("ssid <%s> exceeds %d\n", str, DOT11_MAX_SSID_LEN));
+                       return -1;
+               }
+
+               if (strlen(str) == 0)
+                       ssid[idx].SSID_len = 0;
+
+               if (idx < max) {
+                       bzero(ssid[idx].SSID, sizeof(ssid[idx].SSID));
+                       strlcpy((char*)ssid[idx].SSID, str, sizeof(ssid[idx].SSID));
+                       ssid[idx].SSID_len = sizeof(ssid[idx].SSID);
+               }
+               idx++;
+       }
+       return idx;
+}
+
+/*
+ * Parse channel list from iwpriv CSCAN
+ */
+int
+wl_iw_parse_channel_list(char** list_str, uint16* channel_list, int channel_num)
+{
+       int num;
+       int val;
+       char* str;
+       char* endptr = NULL;
+
+       if ((list_str == NULL)||(*list_str == NULL))
+               return -1;
+
+       str = *list_str;
+       num = 0;
+       while (strncmp(str, GET_NPROBE, strlen(GET_NPROBE))) {
+               val = (int)strtoul(str, &endptr, 0);
+               if (endptr == str) {
+                       printf("could not parse channel number starting at"
+                               " substring \"%s\" in list:\n%s\n",
+                               str, *list_str);
+                       return -1;
+               }
+               str = endptr + strspn(endptr, " ,");
+
+               if (num == channel_num) {
+                       DHD_ERROR(("too many channels (more than %d) in channel list:\n%s\n",
+                               channel_num, *list_str));
+                       return -1;
+               }
+
+               channel_list[num++] = (uint16)val;
+       }
+       *list_str = str;
+       return num;
+}
+#endif
+
+/* Given filename and download type,  returns a buffer pointer and length
+* for download to f/w. Type can be FW or NVRAM.
+*
+*/
+int dhd_get_download_buffer(dhd_pub_t  *dhd, char *file_path, download_type_t component,
+       char ** buffer, int *length)
+
+{
+       int ret = BCME_ERROR;
+       int len = 0;
+       int file_len;
+       void *image = NULL;
+       uint8 *buf = NULL;
+
+       /* Point to cache if available. */
+       /* No Valid cache found on this call */
+       if (!len) {
+               file_len = *length;
+               *length = 0;
+
+               if (file_path) {
+                       image = dhd_os_open_image1(dhd, file_path);
+                       if (image == NULL) {
+                               printf("%s: Open image file failed %s\n", __FUNCTION__, file_path);
+                               goto err;
+                       }
+               }
+
+               buf = MALLOCZ(dhd->osh, file_len);
+               if (buf == NULL) {
+                       DHD_ERROR(("%s: Failed to allocate memory %d bytes\n",
+                               __FUNCTION__, file_len));
+                       goto err;
+               }
+
+               /* Download image */
+               len = dhd_os_get_image_block((char *)buf, file_len, image);
+               if ((len <= 0 || len > file_len)) {
+                       MFREE(dhd->osh, buf, file_len);
+                       goto err;
+               }
+       }
+
+       ret = BCME_OK;
+       *length = len;
+       *buffer = (char *)buf;
+
+       /* Cache if first call. */
+
+err:
+       if (image)
+               dhd_os_close_image1(dhd, image);
+
+       return ret;
+}
+
+int
+dhd_download_2_dongle(dhd_pub_t        *dhd, char *iovar, uint16 flag, uint16 dload_type,
+       unsigned char *dload_buf, int len)
+{
+       struct wl_dload_data *dload_ptr = (struct wl_dload_data *)dload_buf;
+       int err = 0;
+       int dload_data_offset;
+       static char iovar_buf[WLC_IOCTL_MEDLEN];
+       int iovar_len;
+
+       memset(iovar_buf, 0, sizeof(iovar_buf));
+
+       dload_data_offset = OFFSETOF(wl_dload_data_t, data);
+       dload_ptr->flag = (DLOAD_HANDLER_VER << DLOAD_FLAG_VER_SHIFT) | flag;
+       dload_ptr->dload_type = dload_type;
+       dload_ptr->len = htod32(len - dload_data_offset);
+       dload_ptr->crc = 0;
+       len = ROUNDUP(len, 8);
+
+       iovar_len = bcm_mkiovar(iovar, (char *)dload_buf,
+               (uint)len, iovar_buf, sizeof(iovar_buf));
+       if (iovar_len == 0) {
+               DHD_ERROR(("%s: insufficient buffer space passed to bcm_mkiovar for '%s' \n",
+                          __FUNCTION__, iovar));
+               return BCME_BUFTOOSHORT;
+       }
+
+       err = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovar_buf,
+                       iovar_len, IOV_SET, 0);
+
+       return err;
+}
+
+int
+dhd_download_blob(dhd_pub_t *dhd, unsigned char *buf,
+               uint32 len, char *iovar)
+
+{
+       int chunk_len;
+       int size2alloc;
+       unsigned char *new_buf;
+       int err = 0, data_offset;
+       uint16 dl_flag = DL_BEGIN;
+
+       data_offset = OFFSETOF(wl_dload_data_t, data);
+       size2alloc = data_offset + MAX_CHUNK_LEN;
+       size2alloc = ROUNDUP(size2alloc, 8);
+
+       if ((new_buf = (unsigned char *)MALLOCZ(dhd->osh, size2alloc)) != NULL) {
+               do {
+                       chunk_len = dhd_os_get_image_block((char *)(new_buf + data_offset),
+                               MAX_CHUNK_LEN, buf);
+                       if (chunk_len < 0) {
+                               DHD_ERROR(("%s: dhd_os_get_image_block failed (%d)\n",
+                                       __FUNCTION__, chunk_len));
+                               err = BCME_ERROR;
+                               goto exit;
+                       }
+                       if (len - chunk_len == 0)
+                               dl_flag |= DL_END;
+
+                       err = dhd_download_2_dongle(dhd, iovar, dl_flag, DL_TYPE_CLM,
+                               new_buf, data_offset + chunk_len);
+
+                       dl_flag &= ~DL_BEGIN;
+
+                       len = len - chunk_len;
+               } while ((len > 0) && (err == 0));
+       } else {
+               err = BCME_NOMEM;
+       }
+exit:
+       if (new_buf) {
+               MFREE(dhd->osh, new_buf, size2alloc);
+       }
+       return err;
+}
+
+int
+dhd_apply_default_txcap(dhd_pub_t  *dhd, char *path)
+{
+       return 0;
+}
+
+int
+dhd_check_current_clm_data(dhd_pub_t *dhd)
+{
+       char iovbuf[WLC_IOCTL_SMLEN];
+       wl_country_t *cspec;
+       int err = BCME_OK;
+
+       memset(iovbuf, 0, sizeof(iovbuf));
+       err = bcm_mkiovar("country", NULL, 0, iovbuf, sizeof(iovbuf));
+       if (err == 0) {
+               err = BCME_BUFTOOSHORT;
+               DHD_ERROR(("%s: bcm_mkiovar failed.", __FUNCTION__));
+               return err;
+       }
+       err = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0);
+       if (err) {
+               DHD_ERROR(("%s: country code get failed\n", __FUNCTION__));
+               return err;
+       }
+       cspec = (wl_country_t *)iovbuf;
+       if ((strncmp(cspec->ccode, WL_CCODE_NULL_COUNTRY, WLC_CNTRY_BUF_SZ)) == 0) {
+               DHD_ERROR(("%s: ----- This FW is not included CLM data -----\n",
+                       __FUNCTION__));
+               return FALSE;
+       }
+       DHD_ERROR(("%s: ----- This FW is included CLM data -----\n",
+               __FUNCTION__));
+       return TRUE;
+}
+
+int
+dhd_apply_default_clm(dhd_pub_t *dhd, char *clm_path)
+{
+       char *clm_blob_path;
+       int len;
+       char *memblock = NULL;
+       int err = BCME_OK;
+       char iovbuf[WLC_IOCTL_SMLEN];
+       int status = FALSE;
+
+       if (clm_path && clm_path[0] != '\0') {
+               if (strlen(clm_path) > MOD_PARAM_PATHLEN) {
+                       DHD_ERROR(("clm path exceeds max len\n"));
+                       return BCME_ERROR;
+               }
+               clm_blob_path = clm_path;
+               DHD_TRACE(("clm path from module param:%s\n", clm_path));
+       } else {
+               clm_blob_path = VENDOR_PATH CONFIG_BCMDHD_CLM_PATH;
+       }
+
+       /* If CLM blob file is found on the filesystem, download the file.
+        * After CLM file download or If the blob file is not present,
+        * validate the country code before proceeding with the initialization.
+        * If country code is not valid, fail the initialization.
+        */
+       memblock = dhd_os_open_image1(dhd, (char *)clm_blob_path);
+       if (memblock == NULL) {
+               printf("%s: Ignore clm file %s\n", __FUNCTION__, clm_path);
+#if defined(DHD_BLOB_EXISTENCE_CHECK)
+               if (dhd->is_blob) {
+                       err = BCME_ERROR;
+               } else {
+                       status = dhd_check_current_clm_data(dhd);
+                       if (status == TRUE) {
+                               err = BCME_OK;
+                       } else {
+                               err = status;
+                       }
+               }
+#endif /* DHD_BLOB_EXISTENCE_CHECK */
+               goto exit;
+       }
+
+       len = dhd_os_get_image_size(memblock);
+
+       if ((len > 0) && (len < MAX_CLM_BUF_SIZE) && memblock) {
+               status = dhd_check_current_clm_data(dhd);
+               if (status == TRUE) {
+#if defined(DHD_BLOB_EXISTENCE_CHECK)
+                       if (dhd->op_mode != DHD_FLAG_MFG_MODE) {
+                               if (dhd->is_blob) {
+                                       err = BCME_ERROR;
+                               }
+                               goto exit;
+                       }
+#else
+                       DHD_ERROR(("%s: CLM already exist in F/W, "
+                               "new CLM data will be added to the end of existing CLM data!\n",
+                               __FUNCTION__));
+#endif /* DHD_BLOB_EXISTENCE_CHECK */
+               } else if (status != FALSE) {
+                       err = status;
+                       goto exit;
+               }
+
+               /* Found blob file. Download the file */
+               DHD_TRACE(("clm file download from %s \n", clm_blob_path));
+               err = dhd_download_blob(dhd, (unsigned char*)memblock, len, "clmload");
+               if (err) {
+                       DHD_ERROR(("%s: CLM download failed err=%d\n", __FUNCTION__, err));
+                       /* Retrieve clmload_status and print */
+                       memset(iovbuf, 0, sizeof(iovbuf));
+                       len = bcm_mkiovar("clmload_status", NULL, 0, iovbuf, sizeof(iovbuf));
+                       if (len == 0) {
+                               err = BCME_BUFTOOSHORT;
+                               goto exit;
+                       }
+                       err = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0);
+                       if (err) {
+                               DHD_ERROR(("%s: clmload_status get failed err=%d \n",
+                                       __FUNCTION__, err));
+                       } else {
+                               DHD_ERROR(("%s: clmload_status: %d \n",
+                                       __FUNCTION__, *((int *)iovbuf)));
+                               if (*((int *)iovbuf) == CHIPID_MISMATCH) {
+                                       DHD_ERROR(("Chip ID mismatch error \n"));
+                               }
+                       }
+                       err = BCME_ERROR;
+                       goto exit;
+               } else {
+                       DHD_INFO(("%s: CLM download succeeded \n", __FUNCTION__));
+               }
+       } else {
+               DHD_INFO(("Skipping the clm download. len:%d memblk:%p \n", len, memblock));
+       }
+
+       /* Verify country code */
+       status = dhd_check_current_clm_data(dhd);
+
+       if (status != TRUE) {
+               /* Country code not initialized or CLM download not proper */
+               DHD_ERROR(("country code not initialized\n"));
+               err = status;
+       }
+exit:
+
+       if (memblock) {
+               dhd_os_close_image1(dhd, memblock);
+       }
+
+       return err;
+}
+
+void dhd_free_download_buffer(dhd_pub_t        *dhd, void *buffer, int length)
+{
+       MFREE(dhd->osh, buffer, length);
+}
+
+#ifdef SHOW_LOGTRACE
+int
+dhd_parse_logstrs_file(osl_t *osh, char *raw_fmts, int logstrs_size,
+               dhd_event_log_t *event_log)
+{
+       uint32 *lognums = NULL;
+       char *logstrs = NULL;
+       logstr_trailer_t *trailer = NULL;
+       int ram_index = 0;
+       char **fmts = NULL;
+       int num_fmts = 0;
+       bool match_fail = TRUE;
+       int32 i = 0;
+       uint8 *pfw_id = NULL;
+       uint32 fwid = 0;
+       void *file = NULL;
+       int file_len = 0;
+       char fwid_str[FWID_STR_LEN];
+       uint32 hdr_logstrs_size = 0;
+
+       /* Read last three words in the logstrs.bin file */
+       trailer = (logstr_trailer_t *) (raw_fmts + logstrs_size -
+               sizeof(logstr_trailer_t));
+
+       if (trailer->log_magic == LOGSTRS_MAGIC) {
+               /*
+               * logstrs.bin has a header.
+               */
+               if (trailer->version == 1) {
+                       logstr_header_v1_t *hdr_v1 = (logstr_header_v1_t *) (raw_fmts +
+                                       logstrs_size - sizeof(logstr_header_v1_t));
+                       DHD_INFO(("%s: logstr header version = %u\n",
+                                       __FUNCTION__, hdr_v1->version));
+                       num_fmts =      hdr_v1->rom_logstrs_offset / sizeof(uint32);
+                       ram_index = (hdr_v1->ram_lognums_offset -
+                               hdr_v1->rom_lognums_offset) / sizeof(uint32);
+                       lognums = (uint32 *) &raw_fmts[hdr_v1->rom_lognums_offset];
+                       logstrs = (char *)       &raw_fmts[hdr_v1->rom_logstrs_offset];
+                       hdr_logstrs_size = hdr_v1->logstrs_size;
+               } else if (trailer->version == 2) {
+                       logstr_header_t *hdr = (logstr_header_t *) (raw_fmts + logstrs_size -
+                                       sizeof(logstr_header_t));
+                       DHD_INFO(("%s: logstr header version = %u; flags = %x\n",
+                                       __FUNCTION__, hdr->version, hdr->flags));
+
+                       /* For ver. 2 of the header, need to match fwid of
+                        *  both logstrs.bin and fw bin
+                        */
+
+                       /* read the FWID from fw bin */
+                       file = dhd_os_open_image1(NULL, st_str_file_path);
+                       if (!file) {
+                               DHD_ERROR(("%s: cannot open fw file !\n", __FUNCTION__));
+                               goto error;
+                       }
+                       file_len = dhd_os_get_image_size(file);
+                       if (file_len <= 0) {
+                               DHD_ERROR(("%s: bad fw file length !\n", __FUNCTION__));
+                               goto error;
+                       }
+                       /* fwid is at the end of fw bin in string format */
+                       if (dhd_os_seek_file(file, file_len - (sizeof(fwid_str) - 1)) < 0) {
+                               DHD_ERROR(("%s: can't seek file \n", __FUNCTION__));
+                               goto error;
+                       }
+
+                       memset(fwid_str, 0, sizeof(fwid_str));
+                       if (dhd_os_get_image_block(fwid_str, sizeof(fwid_str) - 1, file) <= 0) {
+                               DHD_ERROR(("%s: read fw file failed !\n", __FUNCTION__));
+                               goto error;
+                       }
+                       pfw_id = (uint8 *)bcmstrnstr(fwid_str, sizeof(fwid_str) - 1,
+                                       FWID_STR_1, strlen(FWID_STR_1));
+                       if (!pfw_id) {
+                               pfw_id = (uint8 *)bcmstrnstr(fwid_str, sizeof(fwid_str) - 1,
+                                       FWID_STR_2, strlen(FWID_STR_2));
+                               if (!pfw_id) {
+                                       DHD_ERROR(("%s: could not find id in FW bin!\n",
+                                                       __FUNCTION__));
+                                       goto error;
+                               }
+                       }
+                       /* search for the '-' in the fw id str, after which the
+                        * actual 4 byte fw id is present
+                        */
+                       while (pfw_id && *pfw_id != '-') {
+                               ++pfw_id;
+                       }
+                       ++pfw_id;
+                       fwid = bcm_strtoul((char *)pfw_id, NULL, 16);
+
+                       /* check if fw id in logstrs.bin matches the fw one */
+                       if (hdr->fw_id != fwid) {
+                               DHD_ERROR(("%s: logstr id does not match FW!"
+                                       "logstrs_fwid:0x%x, rtecdc_fwid:0x%x\n",
+                                       __FUNCTION__, hdr->fw_id, fwid));
+                               goto error;
+                       }
+
+                       match_fail = FALSE;
+                       num_fmts = hdr->rom_logstrs_offset / sizeof(uint32);
+                       ram_index = (hdr->ram_lognums_offset -
+                               hdr->rom_lognums_offset) / sizeof(uint32);
+                       lognums = (uint32 *) &raw_fmts[hdr->rom_lognums_offset];
+                       logstrs = (char *)       &raw_fmts[hdr->rom_logstrs_offset];
+                       hdr_logstrs_size = hdr->logstrs_size;
+
+error:
+                       if (file) {
+                               dhd_os_close_image1(NULL, file);
+                       }
+                       if (match_fail) {
+                               return BCME_DECERR;
+                       }
+               } else {
+                       DHD_ERROR(("%s: Invalid logstr version %u\n", __FUNCTION__,
+                                       trailer->version));
+                       return BCME_ERROR;
+               }
+               if (logstrs_size != hdr_logstrs_size) {
+                       DHD_ERROR(("%s: bad logstrs_size %d\n", __FUNCTION__, hdr_logstrs_size));
+                       return BCME_ERROR;
+               }
+       } else {
+               /*
+                * Legacy logstrs.bin format without header.
+                */
+               num_fmts = *((uint32 *) (raw_fmts)) / sizeof(uint32);
+
+               /* Legacy RAM-only logstrs.bin format:
+                *        - RAM 'lognums' section
+                *        - RAM 'logstrs' section.
+                *
+                * 'lognums' is an array of indexes for the strings in the
+                * 'logstrs' section. The first uint32 is an index to the
+                * start of 'logstrs'. Therefore, if this index is divided
+                * by 'sizeof(uint32)' it provides the number of logstr
+                *      entries.
+                */
+               ram_index = 0;
+               lognums = (uint32 *) raw_fmts;
+               logstrs = (char *) &raw_fmts[num_fmts << 2];
+       }
+       if (num_fmts) {
+               if (event_log->fmts != NULL) {
+                       fmts = event_log->fmts; /* reuse existing malloced fmts */
+               } else {
+                       fmts = MALLOC(osh, num_fmts  * sizeof(char *));
+               }
+       }
+       if (fmts == NULL) {
+               DHD_ERROR(("%s: Failed to allocate fmts memory\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+       event_log->fmts_size = num_fmts  * sizeof(char *);
+
+       for (i = 0; i < num_fmts; i++) {
+               /* ROM lognums index into logstrs using 'rom_logstrs_offset' as a base
+               * (they are 0-indexed relative to 'rom_logstrs_offset').
+               *
+               * RAM lognums are already indexed to point to the correct RAM logstrs (they
+               * are 0-indexed relative to the start of the logstrs.bin file).
+               */
+               if (i == ram_index) {
+                       logstrs = raw_fmts;
+               }
+               fmts[i] = &logstrs[lognums[i]];
+       }
+       event_log->fmts = fmts;
+       event_log->raw_fmts_size = logstrs_size;
+       event_log->raw_fmts = raw_fmts;
+       event_log->num_fmts = num_fmts;
+       return BCME_OK;
+} /* dhd_parse_logstrs_file */
+
+int dhd_parse_map_file(osl_t *osh, void *file, uint32 *ramstart, uint32 *rodata_start,
+               uint32 *rodata_end)
+{
+       char *raw_fmts =  NULL, *raw_fmts_loc = NULL;
+       uint32 read_size = READ_NUM_BYTES;
+       int error = 0;
+       char * cptr = NULL;
+       char c;
+       uint8 count = 0;
+
+       *ramstart = 0;
+       *rodata_start = 0;
+       *rodata_end = 0;
+
+       /* Allocate 1 byte more than read_size to terminate it with NULL */
+       raw_fmts = MALLOCZ(osh, read_size + 1);
+       if (raw_fmts == NULL) {
+               DHD_ERROR(("%s: Failed to allocate raw_fmts memory \n", __FUNCTION__));
+               goto fail;
+       }
+
+       /* read ram start, rodata_start and rodata_end values from map  file */
+       while (count != ALL_MAP_VAL)
+       {
+               error = dhd_os_read_file(file, raw_fmts, read_size);
+               if (error < 0) {
+                       DHD_ERROR(("%s: map file read failed err:%d \n", __FUNCTION__,
+                                       error));
+                       goto fail;
+               }
+
+               /* End raw_fmts with NULL as strstr expects NULL terminated strings */
+               raw_fmts[read_size] = '\0';
+
+               /* Get ramstart address */
+               raw_fmts_loc = raw_fmts;
+               if (!(count & RAMSTART_BIT) &&
+                       (cptr = bcmstrnstr(raw_fmts_loc, read_size, ramstart_str,
+                       strlen(ramstart_str)))) {
+                       cptr = cptr - BYTES_AHEAD_NUM;
+                       sscanf(cptr, "%x %c text_start", ramstart, &c);
+                       count |= RAMSTART_BIT;
+               }
+
+               /* Get ram rodata start address */
+               raw_fmts_loc = raw_fmts;
+               if (!(count & RDSTART_BIT) &&
+                       (cptr = bcmstrnstr(raw_fmts_loc, read_size, rodata_start_str,
+                       strlen(rodata_start_str)))) {
+                       cptr = cptr - BYTES_AHEAD_NUM;
+                       sscanf(cptr, "%x %c rodata_start", rodata_start, &c);
+                       count |= RDSTART_BIT;
+               }
+
+               /* Get ram rodata end address */
+               raw_fmts_loc = raw_fmts;
+               if (!(count & RDEND_BIT) &&
+                       (cptr = bcmstrnstr(raw_fmts_loc, read_size, rodata_end_str,
+                       strlen(rodata_end_str)))) {
+                       cptr = cptr - BYTES_AHEAD_NUM;
+                       sscanf(cptr, "%x %c rodata_end", rodata_end, &c);
+                       count |= RDEND_BIT;
+               }
+
+               if (error < (int)read_size) {
+                       /*
+                       * since we reset file pos back to earlier pos by
+                       * GO_BACK_FILE_POS_NUM_BYTES bytes we won't reach EOF.
+                       * The reason for this is if string is spreaded across
+                       * bytes, the read function should not miss it.
+                       * So if ret value is less than read_size, reached EOF don't read further
+                       */
+                       break;
+               }
+               memset(raw_fmts, 0, read_size);
+               /*
+               * go back to predefined NUM of bytes so that we won't miss
+               * the string and  addr even if it comes as splited in next read.
+               */
+               dhd_os_seek_file(file, -GO_BACK_FILE_POS_NUM_BYTES);
+       }
+
+fail:
+       if (raw_fmts) {
+               MFREE(osh, raw_fmts, read_size + 1);
+               raw_fmts = NULL;
+       }
+       if (count == ALL_MAP_VAL) {
+               return BCME_OK;
+       }
+       else {
+               DHD_ERROR(("%s: readmap error 0X%x \n", __FUNCTION__,
+                               count));
+               return BCME_ERROR;
+       }
+
+} /* dhd_parse_map_file */
+
+#ifdef PCIE_FULL_DONGLE
+int
+dhd_event_logtrace_infobuf_pkt_process(dhd_pub_t *dhdp, void *pktbuf,
+               dhd_event_log_t *event_data)
+{
+       uint32 infobuf_version;
+       info_buf_payload_hdr_t *payload_hdr_ptr;
+       uint16 payload_hdr_type;
+       uint16 payload_hdr_length;
+
+       DHD_TRACE(("%s:Enter\n", __FUNCTION__));
+
+       if (PKTLEN(dhdp->osh, pktbuf) < sizeof(uint32)) {
+               DHD_ERROR(("%s: infobuf too small for version field\n",
+                       __FUNCTION__));
+               goto exit;
+       }
+       infobuf_version = *((uint32 *)PKTDATA(dhdp->osh, pktbuf));
+       PKTPULL(dhdp->osh, pktbuf, sizeof(uint32));
+       if (infobuf_version != PCIE_INFOBUF_V1) {
+               DHD_ERROR(("%s: infobuf version %d is not PCIE_INFOBUF_V1\n",
+                       __FUNCTION__, infobuf_version));
+               goto exit;
+       }
+
+       /* Version 1 infobuf has a single type/length (and then value) field */
+       if (PKTLEN(dhdp->osh, pktbuf) < sizeof(info_buf_payload_hdr_t)) {
+               DHD_ERROR(("%s: infobuf too small for v1 type/length  fields\n",
+                       __FUNCTION__));
+               goto exit;
+       }
+       /* Process/parse the common info payload header (type/length) */
+       payload_hdr_ptr = (info_buf_payload_hdr_t *)PKTDATA(dhdp->osh, pktbuf);
+       payload_hdr_type = ltoh16(payload_hdr_ptr->type);
+       payload_hdr_length = ltoh16(payload_hdr_ptr->length);
+       if (payload_hdr_type != PCIE_INFOBUF_V1_TYPE_LOGTRACE) {
+               DHD_ERROR(("%s: payload_hdr_type %d is not V1_TYPE_LOGTRACE\n",
+                       __FUNCTION__, payload_hdr_type));
+               goto exit;
+       }
+       PKTPULL(dhdp->osh, pktbuf, sizeof(info_buf_payload_hdr_t));
+
+       /* Validate that the specified length isn't bigger than the
+        * provided data.
+        */
+       if (payload_hdr_length > PKTLEN(dhdp->osh, pktbuf)) {
+               DHD_ERROR(("%s: infobuf logtrace length is bigger"
+                       " than actual buffer data\n", __FUNCTION__));
+               goto exit;
+       }
+       dhd_dbg_trace_evnt_handler(dhdp, PKTDATA(dhdp->osh, pktbuf),
+               event_data, payload_hdr_length);
+
+       return BCME_OK;
+
+exit:
+       return BCME_ERROR;
+} /* dhd_event_logtrace_infobuf_pkt_process */
+#endif /* PCIE_FULL_DONGLE */
+#endif /* SHOW_LOGTRACE */
+
+#if defined(WLTDLS) && defined(PCIE_FULL_DONGLE)
+
+/* To handle the TDLS event in the dhd_common.c
+ */
+int dhd_tdls_event_handler(dhd_pub_t *dhd_pub, wl_event_msg_t *event)
+{
+       int ret = BCME_OK;
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST()
+       ret = dhd_tdls_update_peer_info(dhd_pub, event);
+       GCC_DIAGNOSTIC_POP()
+
+       return ret;
+}
+
+int dhd_free_tdls_peer_list(dhd_pub_t *dhd_pub)
+{
+       tdls_peer_node_t *cur = NULL, *prev = NULL;
+       if (!dhd_pub)
+               return BCME_ERROR;
+       cur = dhd_pub->peer_tbl.node;
+
+       if ((dhd_pub->peer_tbl.node == NULL) && !dhd_pub->peer_tbl.tdls_peer_count)
+               return BCME_ERROR;
+
+       while (cur != NULL) {
+               prev = cur;
+               cur = cur->next;
+               MFREE(dhd_pub->osh, prev, sizeof(tdls_peer_node_t));
+       }
+       dhd_pub->peer_tbl.tdls_peer_count = 0;
+       dhd_pub->peer_tbl.node = NULL;
+       return BCME_OK;
+}
+#endif /* #if defined(WLTDLS) && defined(PCIE_FULL_DONGLE) */
+
+/* pretty hex print a contiguous buffer
+* based on the debug level specified
+*/
+void
+dhd_prhex(const char *msg, volatile uchar *buf, uint nbytes, uint8 dbg_level)
+{
+       char line[128], *p;
+       int len = sizeof(line);
+       int nchar;
+       uint i;
+
+       if (msg && (msg[0] != '\0')) {
+               if (dbg_level == DHD_ERROR_VAL)
+                       DHD_ERROR(("%s:\n", msg));
+               else if (dbg_level == DHD_INFO_VAL)
+                       DHD_INFO(("%s:\n", msg));
+               else if (dbg_level == DHD_TRACE_VAL)
+                       DHD_TRACE(("%s:\n", msg));
+       }
+
+       p = line;
+       for (i = 0; i < nbytes; i++) {
+               if (i % 16 == 0) {
+                       nchar = snprintf(p, len, "  %04x: ", i);        /* line prefix */
+                       p += nchar;
+                       len -= nchar;
+               }
+               if (len > 0) {
+                       nchar = snprintf(p, len, "%02x ", buf[i]);
+                       p += nchar;
+                       len -= nchar;
+               }
+
+               if (i % 16 == 15) {
+                       /* flush line */
+                       if (dbg_level == DHD_ERROR_VAL)
+                               DHD_ERROR(("%s:\n", line));
+                       else if (dbg_level == DHD_INFO_VAL)
+                               DHD_INFO(("%s:\n", line));
+                       else if (dbg_level == DHD_TRACE_VAL)
+                               DHD_TRACE(("%s:\n", line));
+                       p = line;
+                       len = sizeof(line);
+               }
+       }
+
+       /* flush last partial line */
+       if (p != line) {
+               if (dbg_level == DHD_ERROR_VAL)
+                       DHD_ERROR(("%s:\n", line));
+               else if (dbg_level == DHD_INFO_VAL)
+                       DHD_INFO(("%s:\n", line));
+               else if (dbg_level == DHD_TRACE_VAL)
+                       DHD_TRACE(("%s:\n", line));
+       }
+}
+
+int
+dhd_tput_test(dhd_pub_t *dhd, tput_test_t *tput_data)
+{
+       struct ether_header ether_hdr;
+       tput_pkt_t tput_pkt;
+       void *pkt = NULL;
+       uint8 *pktdata = NULL;
+       uint32 pktsize = 0;
+       uint64 total_size = 0;
+       uint32 *crc = 0;
+       uint32 pktid = 0;
+       uint32 total_num_tx_pkts = 0;
+       int err = 0, err_exit = 0;
+       uint32 i = 0;
+       uint64 time_taken = 0;
+       int max_txbufs = 0;
+       uint32 n_batches = 0;
+       uint32 n_remain = 0;
+       uint8 tput_pkt_hdr_size = 0;
+       bool batch_cnt = FALSE;
+       bool tx_stop_pkt = FALSE;
+
+       if (tput_data->version != TPUT_TEST_T_VER ||
+               tput_data->length != TPUT_TEST_T_LEN) {
+               DHD_ERROR(("%s: wrong structure ver/len! \n", __FUNCTION__));
+               err_exit = BCME_BADARG;
+               goto exit_error;
+       }
+
+       if (dhd->tput_data.tput_test_running) {
+               DHD_ERROR(("%s: tput test already running ! \n", __FUNCTION__));
+               err_exit = BCME_BUSY;
+               goto exit_error;
+       }
+#ifdef PCIE_FULL_DONGLE
+       /*
+        * 100 bytes to accommodate ether header and tput header. As of today
+        * both occupy 30 bytes. Rest is reserved.
+        */
+       if ((tput_data->payload_size > TPUT_TEST_MAX_PAYLOAD) ||
+               (tput_data->payload_size > (DHD_FLOWRING_RX_BUFPOST_PKTSZ - 100))) {
+               DHD_ERROR(("%s: payload size is too large! max_payload=%u rx_bufpost_size=%u\n",
+                       __FUNCTION__, TPUT_TEST_MAX_PAYLOAD,
+                       (DHD_FLOWRING_RX_BUFPOST_PKTSZ - 100)));
+               err_exit = BCME_BUFTOOLONG;
+               goto exit_error;
+       }
+#endif
+       max_txbufs = dhd_get_max_txbufs(dhd);
+       max_txbufs = MIN(max_txbufs, DHD_TPUT_MAX_TX_PKTS_BATCH);
+
+       if (!(tput_data->num_pkts > 0)) {
+               DHD_ERROR(("%s: invalid num_pkts: %d to tx\n",
+                       __FUNCTION__, tput_data->num_pkts));
+               err_exit = BCME_ERROR;
+               goto exit_error;
+       }
+
+       memset(&dhd->tput_data, 0, sizeof(dhd->tput_data));
+       memcpy(&dhd->tput_data, tput_data, sizeof(*tput_data));
+       dhd->tput_data.pkts_bad = dhd->tput_data.pkts_good = 0;
+       dhd->tput_data.pkts_cmpl = 0;
+       dhd->tput_start_ts = dhd->tput_stop_ts = 0;
+
+       if (tput_data->flags & TPUT_TEST_USE_ETHERNET_HDR) {
+               pktsize = sizeof(ether_hdr) + sizeof(tput_pkt_t) +
+                               (tput_data->payload_size - 12);
+       } else {
+               pktsize = sizeof(tput_pkt_t) +
+                               (tput_data->payload_size - 12);
+       }
+
+       tput_pkt_hdr_size = (uint8)((uint8 *)&tput_pkt.crc32 -
+                       (uint8 *)&tput_pkt.mac_sta);
+
+       /* mark the tput test as started */
+       dhd->tput_data.tput_test_running = TRUE;
+
+       if (tput_data->direction == TPUT_DIR_TX) {
+               /* for ethernet header */
+               memcpy(ether_hdr.ether_shost, tput_data->mac_sta, ETHER_ADDR_LEN);
+               memcpy(ether_hdr.ether_dhost, tput_data->mac_ap, ETHER_ADDR_LEN);
+               ether_hdr.ether_type = hton16(ETHER_TYPE_IP);
+
+               /* fill in the tput pkt */
+               memset(&tput_pkt, 0, sizeof(tput_pkt));
+               memcpy(tput_pkt.mac_ap, tput_data->mac_ap, ETHER_ADDR_LEN);
+               memcpy(tput_pkt.mac_sta, tput_data->mac_sta, ETHER_ADDR_LEN);
+               tput_pkt.pkt_type = hton16(TPUT_PKT_TYPE_NORMAL);
+               tput_pkt.num_pkts = hton32(tput_data->num_pkts);
+
+               if (tput_data->num_pkts > (uint32)max_txbufs) {
+                       n_batches = tput_data->num_pkts / max_txbufs;
+                       n_remain = tput_data->num_pkts % max_txbufs;
+               } else {
+                       n_batches = 0;
+                       n_remain = tput_data->num_pkts;
+               }
+               DHD_ERROR(("%s: num_pkts: %u n_batches: %u n_remain: %u\n",
+                       __FUNCTION__, tput_data->num_pkts, n_batches, n_remain));
+
+               do {
+                       /* reset before every batch */
+                       dhd->batch_tx_pkts_cmpl = 0;
+                       if (n_batches) {
+                               dhd->batch_tx_num_pkts = max_txbufs;
+                               --n_batches;
+                       } else if (n_remain) {
+                               dhd->batch_tx_num_pkts = n_remain;
+                               n_remain = 0;
+                       } else {
+                               DHD_ERROR(("Invalid. This should not hit\n"));
+                       }
+
+                       dhd->tput_start_ts = OSL_SYSUPTIME_US();
+                       for (i = 0; (i < dhd->batch_tx_num_pkts) || (tx_stop_pkt); ++i) {
+                               pkt = PKTGET(dhd->osh, pktsize, TRUE);
+                               if (!pkt) {
+                                       dhd->tput_data.tput_test_running = FALSE;
+                                       DHD_ERROR(("%s: PKTGET fails ! Not enough Tx buffers\n",
+                                               __FUNCTION__));
+                                       DHD_ERROR(("%s: pkts_good:%u; pkts_bad:%u; pkts_cmpl:%u\n",
+                                               __FUNCTION__, dhd->tput_data.pkts_good,
+                                               dhd->tput_data.pkts_bad, dhd->tput_data.pkts_cmpl));
+                                       err_exit = BCME_NOMEM;
+                                       goto exit_error;
+                               }
+                               pktdata = PKTDATA(dhd->osh, pkt);
+                               PKTSETLEN(dhd->osh, pkt, pktsize);
+                               memset(pktdata, 0, pktsize);
+                               if (tput_data->flags & TPUT_TEST_USE_ETHERNET_HDR) {
+                                       memcpy(pktdata, &ether_hdr, sizeof(ether_hdr));
+                                       pktdata += sizeof(ether_hdr);
+                               }
+                               /* send stop pkt as last pkt */
+                               if (tx_stop_pkt) {
+                                       tput_pkt.pkt_type = hton16(TPUT_PKT_TYPE_STOP);
+                                       tx_stop_pkt = FALSE;
+                               } else
+                                       tput_pkt.pkt_type = hton16(TPUT_PKT_TYPE_NORMAL);
+                               tput_pkt.pkt_id = hton32(pktid++);
+                               tput_pkt.crc32 = 0;
+                               memcpy(pktdata, &tput_pkt, sizeof(tput_pkt));
+                               /* compute crc32 over the pkt-id, num-pkts and data fields */
+                               crc = (uint32 *)(pktdata + tput_pkt_hdr_size);
+                               *crc = hton32(hndcrc32(pktdata + tput_pkt_hdr_size + 4,
+                                               8 + (tput_data->payload_size - 12),
+                                               CRC32_INIT_VALUE));
+
+                               err = dhd_sendpkt(dhd, 0, pkt);
+                               if (err != BCME_OK) {
+                                       DHD_INFO(("%s: send pkt (id = %u) fails (err = %d) ! \n",
+                                               __FUNCTION__, pktid, err));
+                                       dhd->tput_data.pkts_bad++;
+                               }
+                               total_num_tx_pkts++;
+                               if ((total_num_tx_pkts == tput_data->num_pkts) && (!tx_stop_pkt)) {
+                                       tx_stop_pkt = TRUE;
+                               }
+                       }
+                       DHD_INFO(("%s: TX done, wait for completion...\n", __FUNCTION__));
+                       if (!dhd_os_tput_test_wait(dhd, NULL,
+                                       TPUT_TEST_WAIT_TIMEOUT_DEFAULT)) {
+                               dhd->tput_stop_ts = OSL_SYSUPTIME_US();
+                               dhd->tput_data.tput_test_running = FALSE;
+                               DHD_ERROR(("%s: TX completion timeout !"
+                                       " Total Tx pkts (including STOP) = %u; pkts cmpl = %u; \n",
+                                       __FUNCTION__, total_num_tx_pkts, dhd->batch_tx_pkts_cmpl));
+                               err_exit = BCME_ERROR;
+                               goto exit_error;
+                       }
+                       if ((dhd->tput_start_ts && dhd->tput_stop_ts &&
+                               (dhd->tput_stop_ts > dhd->tput_start_ts)) || (time_taken)) {
+                               if (!time_taken) {
+                                       time_taken = dhd->tput_stop_ts - dhd->tput_start_ts;
+                               }
+                       } else {
+                               dhd->tput_data.tput_test_running = FALSE;
+                               DHD_ERROR(("%s: bad timestamp while cal tx batch time\n",
+                                       __FUNCTION__));
+                               err_exit = BCME_ERROR;
+                               goto exit_error;
+                       }
+                       if (n_batches || n_remain) {
+                               batch_cnt = TRUE;
+                       } else {
+                               batch_cnt = FALSE;
+                       }
+               } while (batch_cnt);
+       } else {
+               /* TPUT_DIR_RX */
+               DHD_INFO(("%s: waiting for RX completion... \n", __FUNCTION__));
+               if (!dhd_os_tput_test_wait(dhd, NULL, tput_data->timeout_ms)) {
+                       DHD_ERROR(("%s: RX completion timeout ! \n", __FUNCTION__));
+                       dhd->tput_stop_ts = OSL_SYSUPTIME_US();
+               }
+       }
+
+       /* calculate the throughput in bits per sec */
+       if (dhd->tput_start_ts && dhd->tput_stop_ts &&
+               (dhd->tput_stop_ts > dhd->tput_start_ts)) {
+               time_taken = dhd->tput_stop_ts - dhd->tput_start_ts;
+               time_taken = DIV_U64_BY_U32(time_taken, MSEC_PER_SEC); /* convert to ms */
+               dhd->tput_data.time_ms = time_taken;
+               if (time_taken) {
+                       total_size = pktsize * dhd->tput_data.pkts_cmpl * 8;
+                       dhd->tput_data.tput_bps = DIV_U64_BY_U64(total_size, time_taken);
+                       /* convert from ms to seconds */
+                       dhd->tput_data.tput_bps = dhd->tput_data.tput_bps * 1000;
+               }
+       } else {
+               DHD_ERROR(("%s: bad timestamp !\n", __FUNCTION__));
+       }
+       DHD_INFO(("%s: DONE. tput = %llu bps, time = %llu ms\n", __FUNCTION__,
+               dhd->tput_data.tput_bps, dhd->tput_data.time_ms));
+
+       memcpy(tput_data, &dhd->tput_data, sizeof(dhd->tput_data));
+
+       dhd->tput_data.tput_test_running = FALSE;
+
+       err_exit = BCME_OK;
+
+exit_error:
+       DHD_ERROR(("%s: pkts_good = %u; pkts_bad = %u; pkts_cmpl = %u\n",
+               __FUNCTION__, dhd->tput_data.pkts_good,
+               dhd->tput_data.pkts_bad, dhd->tput_data.pkts_cmpl));
+
+       return err_exit;
+}
+
+void
+dhd_tput_test_rx(dhd_pub_t *dhd, void *pkt)
+{
+       uint8 *pktdata = NULL;
+       tput_pkt_t *tput_pkt = NULL;
+       uint32 crc = 0;
+       uint8 tput_pkt_hdr_size = 0;
+
+       pktdata = PKTDATA(dhd->osh, pkt);
+       if (dhd->tput_data.flags & TPUT_TEST_USE_ETHERNET_HDR)
+               pktdata += sizeof(struct ether_header);
+       tput_pkt = (tput_pkt_t *)pktdata;
+
+       /* record the timestamp of the first packet received */
+       if (dhd->tput_data.pkts_cmpl == 0) {
+               dhd->tput_start_ts = OSL_SYSUPTIME_US();
+       }
+
+       if (ntoh16(tput_pkt->pkt_type) != TPUT_PKT_TYPE_STOP &&
+                       dhd->tput_data.pkts_cmpl <= dhd->tput_data.num_pkts) {
+               dhd->tput_data.pkts_cmpl++;
+       }
+       /* drop rx packets received beyond the specified # */
+       if (dhd->tput_data.pkts_cmpl > dhd->tput_data.num_pkts)
+               return;
+
+       DHD_TRACE(("%s: Rx tput test pkt, id = %u ; type = %u\n", __FUNCTION__,
+               ntoh32(tput_pkt->pkt_id), ntoh16(tput_pkt->pkt_type)));
+
+       /* discard if mac addr of AP/STA does not match the specified ones */
+       if ((memcmp(tput_pkt->mac_ap, dhd->tput_data.mac_ap,
+                       ETHER_ADDR_LEN) != 0) ||
+               (memcmp(tput_pkt->mac_sta, dhd->tput_data.mac_sta,
+                       ETHER_ADDR_LEN) != 0)) {
+               dhd->tput_data.pkts_bad++;
+               DHD_INFO(("%s: dropping tput pkt with id %u due to bad AP/STA mac !\n",
+                       __FUNCTION__, ntoh32(tput_pkt->pkt_id)));
+               return;
+       }
+
+       tput_pkt_hdr_size = (uint8)((uint8 *)&tput_pkt->crc32 -
+                       (uint8 *)&tput_pkt->mac_sta);
+       pktdata += tput_pkt_hdr_size + 4;
+       crc = hndcrc32(pktdata, 8 + (dhd->tput_data.payload_size - 12),
+                       CRC32_INIT_VALUE);
+       if (crc != ntoh32(tput_pkt->crc32)) {
+               DHD_INFO(("%s: dropping tput pkt with id %u due to bad CRC !\n",
+                       __FUNCTION__, ntoh32(tput_pkt->pkt_id)));
+               dhd->tput_data.pkts_bad++;
+               return;
+       }
+
+       if (ntoh16(tput_pkt->pkt_type) != TPUT_PKT_TYPE_STOP)
+               dhd->tput_data.pkts_good++;
+
+       /* if we have received the stop packet or all the # of pkts, we're done */
+       if (ntoh16(tput_pkt->pkt_type) == TPUT_PKT_TYPE_STOP ||
+                       dhd->tput_data.pkts_cmpl == dhd->tput_data.num_pkts) {
+               dhd->tput_stop_ts = OSL_SYSUPTIME_US();
+               dhd_os_tput_test_wake(dhd);
+       }
+}
+
+#ifdef DUMP_IOCTL_IOV_LIST
+void
+dhd_iov_li_append(dhd_pub_t *dhd, dll_t *list_head, dll_t *node)
+{
+       dll_t *item;
+       dhd_iov_li_t *iov_li;
+       dhd->dump_iovlist_len++;
+
+       if (dhd->dump_iovlist_len == IOV_LIST_MAX_LEN+1) {
+               item = dll_head_p(list_head);
+               iov_li = (dhd_iov_li_t *)CONTAINEROF(item, dhd_iov_li_t, list);
+               dll_delete(item);
+               MFREE(dhd->osh, iov_li, sizeof(*iov_li));
+               dhd->dump_iovlist_len--;
+       }
+       dll_append(list_head, node);
+}
+
+void
+dhd_iov_li_print(dll_t *list_head)
+{
+       dhd_iov_li_t *iov_li;
+       dll_t *item, *next;
+       uint8 index = 0;
+       for (item = dll_head_p(list_head); !dll_end(list_head, item); item = next) {
+               next = dll_next_p(item);
+               iov_li = (dhd_iov_li_t *)CONTAINEROF(item, dhd_iov_li_t, list);
+               DHD_ERROR(("%d:cmd_name = %s, cmd = %d.\n", ++index, iov_li->buff, iov_li->cmd));
+       }
+}
+
+void
+dhd_iov_li_delete(dhd_pub_t *dhd, dll_t *list_head)
+{
+       dll_t *item;
+       dhd_iov_li_t *iov_li;
+       while (!(dll_empty(list_head))) {
+               item = dll_head_p(list_head);
+               iov_li = (dhd_iov_li_t *)CONTAINEROF(item, dhd_iov_li_t, list);
+               dll_delete(item);
+               MFREE(dhd->osh, iov_li, sizeof(*iov_li));
+       }
+}
+#endif /* DUMP_IOCTL_IOV_LIST */
+
+#ifdef EWP_EDL
+/* For now we are allocating memory for EDL ring using DMA_ALLOC_CONSISTENT
+* The reason being that, in hikey, if we try to DMA_MAP prealloced memory
+* it is failing with an 'out of space in SWIOTLB' error
+*/
+int
+dhd_edl_mem_init(dhd_pub_t *dhd)
+{
+       int ret = 0;
+
+       memset(&dhd->edl_ring_mem, 0, sizeof(dhd->edl_ring_mem));
+       ret = dhd_dma_buf_alloc(dhd, &dhd->edl_ring_mem, DHD_EDL_RING_SIZE);
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s: alloc of edl_ring_mem failed\n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+       }
+       return BCME_OK;
+}
+
+/*
+ * NOTE:- that dhd_edl_mem_deinit need NOT be called explicitly, because the dma_buf
+ * for EDL is freed during 'dhd_prot_detach_edl_rings' which is called during de-init.
+ */
+void
+dhd_edl_mem_deinit(dhd_pub_t *dhd)
+{
+       if (dhd->edl_ring_mem.va != NULL)
+               dhd_dma_buf_free(dhd, &dhd->edl_ring_mem);
+}
+
+int
+dhd_event_logtrace_process_edl(dhd_pub_t *dhdp, uint8 *data,
+               void *evt_decode_data)
+{
+       msg_hdr_edl_t *msg = NULL;
+       cmn_msg_hdr_t *cmn_msg_hdr = NULL;
+       uint8 *buf = NULL;
+
+       if (!data || !dhdp || !evt_decode_data) {
+               DHD_ERROR(("%s: invalid args ! \n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       /* format of data in each work item in the EDL ring:
+       * |cmn_msg_hdr_t |payload (var len)|cmn_msg_hdr_t|
+       * payload = |infobuf_ver(u32)|info_buf_payload_hdr_t|msgtrace_hdr_t|<var len data>|
+       */
+       cmn_msg_hdr = (cmn_msg_hdr_t *)data;
+       msg = (msg_hdr_edl_t *)(data + sizeof(cmn_msg_hdr_t));
+       buf = (uint8 *)msg;
+       /* validate the fields */
+       if (ltoh32(msg->infobuf_ver) != PCIE_INFOBUF_V1) {
+               DHD_ERROR(("%s: Skipping msg with invalid infobuf ver (0x%x)"
+                       " expected (0x%x)\n", __FUNCTION__,
+                       msg->infobuf_ver, PCIE_INFOBUF_V1));
+               return BCME_VERSION;
+       }
+
+       /* in EDL, the request_id field of cmn_msg_hdr is overloaded to carry payload length */
+       if (sizeof(info_buf_payload_hdr_t) > cmn_msg_hdr->request_id) {
+               DHD_ERROR(("%s: infobuf too small for v1 type/length fields\n",
+                       __FUNCTION__));
+               return BCME_BUFTOOLONG;
+       }
+
+       if (ltoh16(msg->pyld_hdr.type) != PCIE_INFOBUF_V1_TYPE_LOGTRACE) {
+               DHD_ERROR(("%s: payload_hdr_type %d is not V1_TYPE_LOGTRACE\n",
+                       __FUNCTION__, ltoh16(msg->pyld_hdr.type)));
+               return BCME_BADOPTION;
+       }
+
+       if (ltoh16(msg->pyld_hdr.length) > cmn_msg_hdr->request_id) {
+               DHD_ERROR(("%s: infobuf logtrace length %u is bigger"
+                       " than available buffer size %u\n", __FUNCTION__,
+                       ltoh16(msg->pyld_hdr.length), cmn_msg_hdr->request_id));
+               return BCME_BADLEN;
+       }
+
+       /* dhd_dbg_trace_evnt_handler expects the data to start from msgtrace_hdr_t */
+       buf += sizeof(msg->infobuf_ver) + sizeof(msg->pyld_hdr);
+       dhd_dbg_trace_evnt_handler(dhdp, buf, evt_decode_data,
+               ltoh16(msg->pyld_hdr.length));
+
+       /*
+        * check 'dhdp->logtrace_pkt_sendup' and if true alloc an skb
+        * copy the event data to the skb and send it up the stack
+        */
+       if (dhdp->logtrace_pkt_sendup) {
+               DHD_INFO(("%s: send up event log, len %u bytes\n", __FUNCTION__,
+                               (uint32)(ltoh16(msg->pyld_hdr.length) +
+                               sizeof(info_buf_payload_hdr_t) + 4)));
+               dhd_sendup_info_buf(dhdp, (uint8 *)msg);
+       }
+
+       return BCME_OK;
+}
+#endif /* EWP_EDL */
+
+#ifdef DHD_LOG_DUMP
+#define DEBUG_DUMP_TRIGGER_INTERVAL_SEC        4
+void
+dhd_log_dump_trigger(dhd_pub_t *dhdp, int subcmd)
+{
+#if defined(DHD_DUMP_FILE_WRITE_FROM_KERNEL)
+       log_dump_type_t *flush_type;
+#endif /* DHD_DUMP_FILE_WRITE_FROM_KERNEL */
+       uint64 current_time_sec;
+
+       if (!dhdp) {
+               DHD_ERROR(("dhdp is NULL !\n"));
+               return;
+       }
+
+       if (subcmd >= CMD_MAX || subcmd < CMD_DEFAULT) {
+               DHD_ERROR(("%s : Invalid subcmd \n", __FUNCTION__));
+               return;
+       }
+
+       current_time_sec = DIV_U64_BY_U32(OSL_LOCALTIME_NS(), NSEC_PER_SEC);
+
+       DHD_ERROR(("%s: current_time_sec=%lld debug_dump_time_sec=%lld interval=%d\n",
+               __FUNCTION__, current_time_sec, dhdp->debug_dump_time_sec,
+               DEBUG_DUMP_TRIGGER_INTERVAL_SEC));
+
+       if ((current_time_sec - dhdp->debug_dump_time_sec) < DEBUG_DUMP_TRIGGER_INTERVAL_SEC) {
+               DHD_ERROR(("%s : Last debug dump triggered(%lld) within %d seconds, so SKIP\n",
+                       __FUNCTION__, dhdp->debug_dump_time_sec, DEBUG_DUMP_TRIGGER_INTERVAL_SEC));
+               return;
+       }
+
+       clear_debug_dump_time(dhdp->debug_dump_time_str);
+#ifdef DHD_PCIE_RUNTIMEPM
+       /* wake up RPM if SYSDUMP is triggered */
+       dhdpcie_runtime_bus_wake(dhdp, TRUE, __builtin_return_address(0));
+#endif /* DHD_PCIE_RUNTIMEPM */
+       /*  */
+
+       dhdp->debug_dump_subcmd = subcmd;
+
+       dhdp->debug_dump_time_sec = DIV_U64_BY_U32(OSL_LOCALTIME_NS(), NSEC_PER_SEC);
+
+#if defined(DHD_DUMP_FILE_WRITE_FROM_KERNEL)
+       /* flush_type is freed at do_dhd_log_dump function */
+       flush_type = MALLOCZ(dhdp->osh, sizeof(log_dump_type_t));
+       if (flush_type) {
+               *flush_type = DLD_BUF_TYPE_ALL;
+               dhd_schedule_log_dump(dhdp, flush_type);
+       } else {
+               DHD_ERROR(("%s Fail to malloc flush_type\n", __FUNCTION__));
+               return;
+       }
+#endif /* DHD_DUMP_FILE_WRITE_FROM_KERNEL */
+
+       /* Inside dhd_mem_dump, event notification will be sent to HAL and
+        * from other context DHD pushes memdump, debug_dump and pktlog dump
+        * to HAL and HAL will write into file
+        */
+#if (defined(BCMPCIE) || defined(BCMSDIO)) && defined(DHD_FW_COREDUMP)
+       dhdp->memdump_type = DUMP_TYPE_BY_SYSDUMP;
+       dhd_bus_mem_dump(dhdp);
+#endif /* BCMPCIE && DHD_FW_COREDUMP */
+
+#if defined(DHD_PKT_LOGGING) && defined(DHD_DUMP_FILE_WRITE_FROM_KERNEL)
+       dhd_schedule_pktlog_dump(dhdp);
+#endif /* DHD_PKT_LOGGING && DHD_DUMP_FILE_WRITE_FROM_KERNEL */
+}
+#endif /* DHD_LOG_DUMP */
+
+#if defined(SHOW_LOGTRACE)
+int
+dhd_print_fw_ver_from_file(dhd_pub_t *dhdp, char *fwpath)
+{
+       void *file = NULL;
+       int size = 0;
+       char buf[FW_VER_STR_LEN];
+       char *str = NULL;
+       int ret = BCME_OK;
+
+       if (!fwpath)
+               return BCME_BADARG;
+
+       file = dhd_os_open_image1(dhdp, fwpath);
+       if (!file) {
+               ret = BCME_ERROR;
+               goto exit;
+       }
+       size = dhd_os_get_image_size(file);
+       if (!size) {
+               ret = BCME_ERROR;
+               goto exit;
+       }
+
+       /* seek to the last 'X' bytes in the file */
+       if (dhd_os_seek_file(file, size - FW_VER_STR_LEN) != BCME_OK) {
+               ret = BCME_ERROR;
+               goto exit;
+       }
+
+       /* read the last 'X' bytes of the file to a buffer */
+       memset(buf, 0, FW_VER_STR_LEN);
+       if (dhd_os_get_image_block(buf, FW_VER_STR_LEN - 1, file) < 0) {
+               ret = BCME_ERROR;
+               goto exit;
+       }
+       /* search for 'Version' in the buffer */
+       str = bcmstrnstr(buf, FW_VER_STR_LEN, FW_VER_STR, strlen(FW_VER_STR));
+       if (!str) {
+               ret = BCME_ERROR;
+               goto exit;
+       }
+       /* go back in the buffer to the last ascii character */
+       while (str != buf &&
+               (*str >= ' ' && *str <= '~')) {
+               --str;
+       }
+       /* reverse the final decrement, so that str is pointing
+       * to the first ascii character in the buffer
+       */
+       ++str;
+
+       if (strlen(str) > (FW_VER_STR_LEN - 1)) {
+               ret = BCME_BADLEN;
+               goto exit;
+       }
+
+       DHD_ERROR(("FW version in file '%s': %s\n", fwpath, str));
+       /* copy to global variable, so that in case FW load fails, the
+       * core capture logs will contain FW version read from the file
+       */
+       memset(fw_version, 0, FW_VER_STR_LEN);
+       strlcpy(fw_version, str, FW_VER_STR_LEN);
+
+exit:
+       if (file)
+               dhd_os_close_image1(dhdp, file);
+
+       return ret;
+}
+#endif
+
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+
+static void
+copy_hang_info_ioctl_timeout(dhd_pub_t *dhd, int ifidx, wl_ioctl_t *ioc)
+{
+       int remain_len;
+       int i;
+       int *cnt;
+       char *dest;
+       int bytes_written;
+       uint32 ioc_dwlen = 0;
+
+       if (!dhd || !dhd->hang_info) {
+               DHD_ERROR(("%s dhd=%p hang_info=%p\n",
+                       __FUNCTION__, dhd, (dhd ? dhd->hang_info : NULL)));
+               return;
+       }
+
+       cnt = &dhd->hang_info_cnt;
+       dest = dhd->hang_info;
+
+       memset(dest, 0, VENDOR_SEND_HANG_EXT_INFO_LEN);
+       (*cnt) = 0;
+
+       bytes_written = 0;
+       remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - bytes_written;
+
+       get_debug_dump_time(dhd->debug_dump_time_hang_str);
+       copy_debug_dump_time(dhd->debug_dump_time_str, dhd->debug_dump_time_hang_str);
+
+       bytes_written += scnprintf(&dest[bytes_written], remain_len, "%d %d %s %d %d %d %d %d %d ",
+                       HANG_REASON_IOCTL_RESP_TIMEOUT, VENDOR_SEND_HANG_EXT_INFO_VER,
+                       dhd->debug_dump_time_hang_str,
+                       ifidx, ioc->cmd, ioc->len, ioc->set, ioc->used, ioc->needed);
+       (*cnt) = HANG_FIELD_IOCTL_RESP_TIMEOUT_CNT;
+
+       clear_debug_dump_time(dhd->debug_dump_time_hang_str);
+
+       /* Access ioc->buf only if the ioc->len is more than 4 bytes */
+       ioc_dwlen = (uint32)(ioc->len / sizeof(uint32));
+       if (ioc_dwlen > 0) {
+               const uint32 *ioc_buf = (const uint32 *)ioc->buf;
+
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - bytes_written;
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               bytes_written += scnprintf(&dest[bytes_written], remain_len,
+                       "%08x", *(uint32 *)(ioc_buf++));
+               GCC_DIAGNOSTIC_POP();
+               (*cnt)++;
+               if ((*cnt) >= HANG_FIELD_CNT_MAX) {
+                       return;
+               }
+
+               for (i = 1; i < ioc_dwlen && *cnt <= HANG_FIELD_CNT_MAX;
+                       i++, (*cnt)++) {
+                       remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - bytes_written;
+                       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                       bytes_written += scnprintf(&dest[bytes_written], remain_len, "%c%08x",
+                               HANG_RAW_DEL, *(uint32 *)(ioc_buf++));
+                       GCC_DIAGNOSTIC_POP();
+               }
+       }
+
+       DHD_INFO(("%s hang info len: %d data: %s\n",
+               __FUNCTION__, (int)strlen(dhd->hang_info), dhd->hang_info));
+}
+
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+
+#if defined(DHD_H2D_LOG_TIME_SYNC)
+/*
+ * Helper function:
+ * Used for Dongle console message time syncing with Host printk
+ */
+void dhd_h2d_log_time_sync(dhd_pub_t *dhd)
+{
+       uint64 ts;
+
+       /*
+        * local_clock() returns time in nano seconds.
+        * Dongle understand only milli seconds time.
+        */
+       ts = local_clock();
+       /* Nano seconds to milli seconds */
+       do_div(ts, 1000000);
+       if (dhd_wl_ioctl_set_intiovar(dhd,  "rte_timesync", ts, WLC_SET_VAR, TRUE, 0)) {
+               DHD_ERROR(("%s rte_timesync **** FAILED ****\n", __FUNCTION__));
+               /* Stopping HOST Dongle console time syncing */
+               dhd->dhd_rte_time_sync_ms = 0;
+       }
+}
+#endif /* DHD_H2D_LOG_TIME_SYNC */
+
+/* configuations of ecounters to be enabled by default in FW */
+static ecounters_cfg_t ecounters_cfg_tbl[] = {
+       /* Global ecounters */
+       {ECOUNTERS_STATS_TYPES_FLAG_GLOBAL, 0x0, WL_IFSTATS_XTLV_BUS_PCIE},
+       // {ECOUNTERS_STATS_TYPES_FLAG_GLOBAL, 0x0, WL_IFSTATS_XTLV_TX_AMPDU_STATS},
+       // {ECOUNTERS_STATS_TYPES_FLAG_GLOBAL, 0x0, WL_IFSTATS_XTLV_RX_AMPDU_STATS},
+
+       /* Slice specific ecounters */
+       {ECOUNTERS_STATS_TYPES_FLAG_SLICE, 0x0, WL_SLICESTATS_XTLV_PERIODIC_STATE},
+       {ECOUNTERS_STATS_TYPES_FLAG_SLICE, 0x1, WL_SLICESTATS_XTLV_PERIODIC_STATE},
+       {ECOUNTERS_STATS_TYPES_FLAG_SLICE, 0x1, WL_IFSTATS_XTLV_WL_SLICE_BTCOEX},
+
+       /* Interface specific ecounters */
+       {ECOUNTERS_STATS_TYPES_FLAG_IFACE, 0x0, WL_IFSTATS_XTLV_IF_PERIODIC_STATE},
+       {ECOUNTERS_STATS_TYPES_FLAG_IFACE, 0x0, WL_IFSTATS_XTLV_GENERIC},
+       {ECOUNTERS_STATS_TYPES_FLAG_IFACE, 0x0, WL_IFSTATS_XTLV_INFRA_SPECIFIC},
+       {ECOUNTERS_STATS_TYPES_FLAG_IFACE, 0x0, WL_IFSTATS_XTLV_MGT_CNT},
+
+       /* secondary interface */
+       /* XXX REMOVE for temporal, will be enabled after decision
+       {ECOUNTERS_STATS_TYPES_FLAG_IFACE, 0x1, WL_IFSTATS_XTLV_IF_PERIODIC_STATE},
+       {ECOUNTERS_STATS_TYPES_FLAG_IFACE, 0x1, WL_IFSTATS_XTLV_GENERIC},
+       {ECOUNTERS_STATS_TYPES_FLAG_IFACE, 0x1, WL_IFSTATS_XTLV_INFRA_SPECIFIC},
+       {ECOUNTERS_STATS_TYPES_FLAG_IFACE, 0x1, WL_IFSTATS_XTLV_MGT_CNT},
+       */
+};
+
+/* XXX: Same event id shall be defined in consecutive order in the below table */
+static event_ecounters_cfg_t event_ecounters_cfg_tbl[] = {
+       /* Interface specific event ecounters */
+       {WLC_E_DEAUTH_IND, ECOUNTERS_STATS_TYPES_FLAG_IFACE, 0x0, WL_IFSTATS_XTLV_IF_EVENT_STATS},
+};
+
+/* Accepts an argument to -s, -g or -f and creates an XTLV */
+int
+dhd_create_ecounters_params(dhd_pub_t *dhd, uint16 type, uint16 if_slice_idx,
+       uint16 stats_rep, uint8 **xtlv)
+{
+       uint8 *req_xtlv = NULL;
+       ecounters_stats_types_report_req_t *req;
+       bcm_xtlvbuf_t xtlvbuf, container_xtlvbuf;
+       ecountersv2_xtlv_list_elt_t temp;
+       uint16 xtlv_len = 0, total_len = 0;
+       int rc = BCME_OK;
+
+       /* fill in the stat type XTLV. For now there is no explicit TLV for the stat type. */
+       temp.id = stats_rep;
+       temp.len = 0;
+
+       /* Hence len/data = 0/NULL */
+       xtlv_len += temp.len + BCM_XTLV_HDR_SIZE;
+
+       /* Total length of the container */
+       total_len = BCM_XTLV_HDR_SIZE +
+               OFFSETOF(ecounters_stats_types_report_req_t, stats_types_req) + xtlv_len;
+
+       /* Now allocate a structure for the entire request */
+       if ((req_xtlv = (uint8 *)MALLOCZ(dhd->osh, total_len)) == NULL) {
+               rc = BCME_NOMEM;
+               goto fail;
+       }
+
+       /* container XTLV context */
+       bcm_xtlv_buf_init(&container_xtlvbuf, (uint8 *)req_xtlv, total_len,
+               BCM_XTLV_OPTION_ALIGN32);
+
+       /* Fill other XTLVs in the container. Leave space for XTLV headers */
+       req = (ecounters_stats_types_report_req_t *)(req_xtlv + BCM_XTLV_HDR_SIZE);
+       req->flags = type;
+       if (type == ECOUNTERS_STATS_TYPES_FLAG_SLICE) {
+               req->slice_mask = 0x1 << if_slice_idx;
+       } else if (type == ECOUNTERS_STATS_TYPES_FLAG_IFACE) {
+               req->if_index = if_slice_idx;
+       }
+
+       /* Fill remaining XTLVs */
+       bcm_xtlv_buf_init(&xtlvbuf, (uint8*) req->stats_types_req, xtlv_len,
+               BCM_XTLV_OPTION_ALIGN32);
+       if (bcm_xtlv_put_data(&xtlvbuf, temp.id, NULL, temp.len)) {
+               DHD_ERROR(("Error creating XTLV for requested stats type = %d\n", temp.id));
+               rc = BCME_ERROR;
+               goto fail;
+       }
+
+       /* fill the top level container and get done with the XTLV container */
+       rc = bcm_xtlv_put_data(&container_xtlvbuf, WL_ECOUNTERS_XTLV_REPORT_REQ, NULL,
+               bcm_xtlv_buf_len(&xtlvbuf) + OFFSETOF(ecounters_stats_types_report_req_t,
+               stats_types_req));
+
+       if (rc) {
+               DHD_ERROR(("Error creating parent XTLV for type = %d\n", req->flags));
+               goto fail;
+       }
+
+fail:
+       if (rc && req_xtlv) {
+               MFREE(dhd->osh, req_xtlv, total_len);
+               req_xtlv = NULL;
+       }
+
+       /* update the xtlv pointer */
+       *xtlv = req_xtlv;
+       return rc;
+}
+
+static int
+dhd_ecounter_autoconfig(dhd_pub_t *dhd)
+{
+       int rc = BCME_OK;
+       uint32 buf;
+       rc = dhd_iovar(dhd, 0, "ecounters_autoconfig", NULL, 0, (char *)&buf, sizeof(buf), FALSE);
+
+       if (rc != BCME_OK) {
+
+               if (rc != BCME_UNSUPPORTED) {
+                       rc = BCME_OK;
+                       DHD_ERROR(("%s Ecounter autoconfig in fw failed : %d\n", __FUNCTION__, rc));
+               } else {
+                       DHD_ERROR(("%s Ecounter autoconfig in FW not supported\n", __FUNCTION__));
+               }
+       }
+
+       return rc;
+}
+
+int
+dhd_ecounter_configure(dhd_pub_t *dhd, bool enable)
+{
+       int rc = BCME_OK;
+       if (enable) {
+               if (dhd_ecounter_autoconfig(dhd) != BCME_OK) {
+                       if ((rc = dhd_start_ecounters(dhd)) != BCME_OK) {
+                               DHD_ERROR(("%s Ecounters start failed\n", __FUNCTION__));
+                       } else if ((rc = dhd_start_event_ecounters(dhd)) != BCME_OK) {
+                               DHD_ERROR(("%s Event_Ecounters start failed\n", __FUNCTION__));
+                       }
+               }
+       } else {
+               if ((rc = dhd_stop_ecounters(dhd)) != BCME_OK) {
+                       DHD_ERROR(("%s Ecounters stop failed\n", __FUNCTION__));
+               } else if ((rc = dhd_stop_event_ecounters(dhd)) != BCME_OK) {
+                       DHD_ERROR(("%s Event_Ecounters stop failed\n", __FUNCTION__));
+               }
+       }
+       return rc;
+}
+
+int
+dhd_start_ecounters(dhd_pub_t *dhd)
+{
+       uint8 i = 0;
+       uint8 *start_ptr;
+       int rc = BCME_OK;
+       bcm_xtlv_t *elt;
+       ecounters_config_request_v2_t *req = NULL;
+       ecountersv2_processed_xtlv_list_elt *list_elt, *tail = NULL;
+       ecountersv2_processed_xtlv_list_elt *processed_containers_list = NULL;
+       uint16 total_processed_containers_len = 0;
+
+       for (i = 0; i < ARRAYSIZE(ecounters_cfg_tbl); i++) {
+               ecounters_cfg_t *ecounter_stat = &ecounters_cfg_tbl[i];
+
+               if ((list_elt = (ecountersv2_processed_xtlv_list_elt *)
+                       MALLOCZ(dhd->osh, sizeof(*list_elt))) == NULL) {
+                       DHD_ERROR(("Ecounters v2: No memory to process\n"));
+                       goto fail;
+               }
+
+               rc = dhd_create_ecounters_params(dhd, ecounter_stat->type,
+                       ecounter_stat->if_slice_idx, ecounter_stat->stats_rep, &list_elt->data);
+
+               if (rc) {
+                       DHD_ERROR(("Ecounters v2: Could not process: stat: %d return code: %d\n",
+                               ecounter_stat->stats_rep, rc));
+
+                       /* Free allocated memory and go to fail to release any memories allocated
+                        * in previous iterations. Note that list_elt->data gets populated in
+                        * dhd_create_ecounters_params() and gets freed there itself.
+                        */
+                       MFREE(dhd->osh, list_elt, sizeof(*list_elt));
+                       list_elt = NULL;
+                       goto fail;
+               }
+               elt = (bcm_xtlv_t *) list_elt->data;
+
+               /* Put the elements in the order they are processed */
+               if (processed_containers_list == NULL) {
+                       processed_containers_list = list_elt;
+               } else {
+                       tail->next = list_elt;
+               }
+               tail = list_elt;
+               /* Size of the XTLV returned */
+               total_processed_containers_len += BCM_XTLV_LEN(elt) + BCM_XTLV_HDR_SIZE;
+       }
+
+       /* Now create ecounters config request with totallength */
+       req = (ecounters_config_request_v2_t *)MALLOCZ(dhd->osh, sizeof(*req) +
+               total_processed_containers_len);
+
+       if (req == NULL) {
+               rc = BCME_NOMEM;
+               goto fail;
+       }
+
+       req->version = ECOUNTERS_VERSION_2;
+       req->logset = EVENT_LOG_SET_ECOUNTERS;
+       req->reporting_period = ECOUNTERS_DEFAULT_PERIOD;
+       req->num_reports = ECOUNTERS_NUM_REPORTS;
+       req->len = total_processed_containers_len +
+               OFFSETOF(ecounters_config_request_v2_t, ecounters_xtlvs);
+
+       /* Copy config */
+       start_ptr = req->ecounters_xtlvs;
+
+       /* Now go element by element in the list */
+       while (processed_containers_list) {
+               list_elt = processed_containers_list;
+
+               elt = (bcm_xtlv_t *)list_elt->data;
+
+               memcpy(start_ptr, list_elt->data, BCM_XTLV_LEN(elt) + BCM_XTLV_HDR_SIZE);
+               start_ptr += (size_t)(BCM_XTLV_LEN(elt) + BCM_XTLV_HDR_SIZE);
+               processed_containers_list = processed_containers_list->next;
+
+               /* Free allocated memories */
+               MFREE(dhd->osh, elt, elt->len + BCM_XTLV_HDR_SIZE);
+               MFREE(dhd->osh, list_elt, sizeof(*list_elt));
+       }
+
+       if ((rc = dhd_iovar(dhd, 0, "ecounters", (char *)req, req->len, NULL, 0, TRUE)) < 0) {
+               DHD_ERROR(("failed to start ecounters\n"));
+       }
+
+fail:
+       if (req) {
+               MFREE(dhd->osh, req, sizeof(*req) + total_processed_containers_len);
+       }
+
+       /* Now go element by element in the list */
+       while (processed_containers_list) {
+               list_elt = processed_containers_list;
+               elt = (bcm_xtlv_t *)list_elt->data;
+               processed_containers_list = processed_containers_list->next;
+
+               /* Free allocated memories */
+               MFREE(dhd->osh, elt, elt->len + BCM_XTLV_HDR_SIZE);
+               MFREE(dhd->osh, list_elt, sizeof(*list_elt));
+       }
+       return rc;
+}
+
+int
+dhd_stop_ecounters(dhd_pub_t *dhd)
+{
+       int rc = BCME_OK;
+       ecounters_config_request_v2_t *req;
+
+       /* Now create ecounters config request with totallength */
+       req = (ecounters_config_request_v2_t *)MALLOCZ(dhd->osh, sizeof(*req));
+
+       if (req == NULL) {
+               rc = BCME_NOMEM;
+               goto fail;
+       }
+
+       req->version = ECOUNTERS_VERSION_2;
+       req->len = OFFSETOF(ecounters_config_request_v2_t, ecounters_xtlvs);
+
+       if ((rc = dhd_iovar(dhd, 0, "ecounters", (char *)req, req->len, NULL, 0, TRUE)) < 0) {
+               DHD_ERROR(("failed to stop ecounters\n"));
+       }
+
+fail:
+       if (req) {
+               MFREE(dhd->osh, req, sizeof(*req));
+       }
+       return rc;
+}
+
+/* configured event_id_array for event ecounters */
+typedef struct event_id_array {
+       uint8   event_id;
+       uint8   str_idx;
+} event_id_array_t;
+
+/* get event id array only from event_ecounters_cfg_tbl[] */
+static inline int __dhd_event_ecounters_get_event_id_array(event_id_array_t *event_array)
+{
+       uint8 i;
+       uint8 idx = 0;
+       int32 prev_evt_id = -1;
+
+       for (i = 0; i < (uint8)ARRAYSIZE(event_ecounters_cfg_tbl); i++) {
+               if (prev_evt_id != event_ecounters_cfg_tbl[i].event_id) {
+                       if (prev_evt_id >= 0)
+                               idx++;
+                       event_array[idx].event_id = event_ecounters_cfg_tbl[i].event_id;
+                       event_array[idx].str_idx = i;
+               }
+               prev_evt_id = event_ecounters_cfg_tbl[i].event_id;
+       }
+       return idx;
+}
+
+/* One event id has limit xtlv num to request based on wl_ifstats_xtlv_id * 2 interface */
+#define ECNTRS_MAX_XTLV_NUM (31 * 2)
+
+int
+dhd_start_event_ecounters(dhd_pub_t *dhd)
+{
+       uint8 i, j = 0;
+       uint8 event_id_cnt = 0;
+       uint16 processed_containers_len = 0;
+       uint16 max_xtlv_len = 0;
+       int rc = BCME_OK;
+       uint8 *ptr;
+       uint8 *data;
+       event_id_array_t *id_array;
+       bcm_xtlv_t *elt = NULL;
+       event_ecounters_config_request_v2_t *req = NULL;
+
+       /* XXX: the size of id_array is limited by the size of event_ecounters_cfg_tbl */
+       id_array = (event_id_array_t *)MALLOCZ(dhd->osh, sizeof(event_id_array_t) *
+               ARRAYSIZE(event_ecounters_cfg_tbl));
+
+       if (id_array == NULL) {
+               rc = BCME_NOMEM;
+               goto fail;
+       }
+       event_id_cnt = __dhd_event_ecounters_get_event_id_array(id_array);
+
+       max_xtlv_len = ((BCM_XTLV_HDR_SIZE +
+               OFFSETOF(event_ecounters_config_request_v2_t, ecounters_xtlvs)) *
+               ECNTRS_MAX_XTLV_NUM);
+
+       /* Now create ecounters config request with max allowed length */
+       req = (event_ecounters_config_request_v2_t *)MALLOCZ(dhd->osh,
+               sizeof(event_ecounters_config_request_v2_t *) + max_xtlv_len);
+
+       if (req == NULL) {
+               rc = BCME_NOMEM;
+               goto fail;
+       }
+
+       for (i = 0; i <= event_id_cnt; i++) {
+               /* req initialization by event id */
+               req->version = ECOUNTERS_VERSION_2;
+               req->logset = EVENT_LOG_SET_ECOUNTERS;
+               req->event_id = id_array[i].event_id;
+               req->flags = EVENT_ECOUNTERS_FLAGS_ADD;
+               req->len = 0;
+               processed_containers_len = 0;
+
+               /* Copy config */
+               ptr = req->ecounters_xtlvs;
+
+               for (j = id_array[i].str_idx; j < (uint8)ARRAYSIZE(event_ecounters_cfg_tbl); j++) {
+                       event_ecounters_cfg_t *event_ecounter_stat = &event_ecounters_cfg_tbl[j];
+                       if (id_array[i].event_id != event_ecounter_stat->event_id)
+                               break;
+
+                       rc = dhd_create_ecounters_params(dhd, event_ecounter_stat->type,
+                               event_ecounter_stat->if_slice_idx, event_ecounter_stat->stats_rep,
+                               &data);
+
+                       if (rc) {
+                               DHD_ERROR(("%s: Could not process: stat: %d return code: %d\n",
+                                       __FUNCTION__, event_ecounter_stat->stats_rep, rc));
+                               goto fail;
+                       }
+
+                       elt = (bcm_xtlv_t *)data;
+
+                       memcpy(ptr, elt, BCM_XTLV_LEN(elt) + BCM_XTLV_HDR_SIZE);
+                       ptr += (size_t)(BCM_XTLV_LEN(elt) + BCM_XTLV_HDR_SIZE);
+                       processed_containers_len += BCM_XTLV_LEN(elt) + BCM_XTLV_HDR_SIZE;
+
+                       /* Free allocated memories alloced by dhd_create_ecounters_params */
+                       MFREE(dhd->osh, elt, elt->len + BCM_XTLV_HDR_SIZE);
+
+                       if (processed_containers_len > max_xtlv_len) {
+                               DHD_ERROR(("%s XTLV NUM IS OVERFLOWED THAN ALLOWED!!\n",
+                                       __FUNCTION__));
+                               rc = BCME_BADLEN;
+                               goto fail;
+                       }
+               }
+
+               req->len = processed_containers_len +
+                       OFFSETOF(event_ecounters_config_request_v2_t, ecounters_xtlvs);
+
+               DHD_INFO(("%s req version %d logset %d event_id %d flags %d len %d\n",
+                       __FUNCTION__, req->version, req->logset, req->event_id,
+                       req->flags, req->len));
+
+               rc = dhd_iovar(dhd, 0, "event_ecounters", (char *)req, req->len, NULL, 0, TRUE);
+
+               if (rc < 0) {
+                       DHD_ERROR(("failed to start event_ecounters(event id %d) with rc %d\n",
+                               req->event_id, rc));
+                       goto fail;
+               }
+       }
+
+fail:
+       /* Free allocated memories */
+       if (req) {
+               MFREE(dhd->osh, req, sizeof(event_ecounters_config_request_v2_t *) + max_xtlv_len);
+       }
+       if (id_array) {
+               MFREE(dhd->osh, id_array, sizeof(event_id_array_t) *
+                       ARRAYSIZE(event_ecounters_cfg_tbl));
+       }
+
+       return rc;
+}
+
+int
+dhd_stop_event_ecounters(dhd_pub_t *dhd)
+{
+       int rc = BCME_OK;
+       event_ecounters_config_request_v2_t *req;
+
+       /* Now create ecounters config request with totallength */
+       req = (event_ecounters_config_request_v2_t *)MALLOCZ(dhd->osh, sizeof(*req));
+
+       if (req == NULL) {
+               rc = BCME_NOMEM;
+               goto fail;
+       }
+
+       req->version = ECOUNTERS_VERSION_2;
+       req->flags = EVENT_ECOUNTERS_FLAGS_DEL_ALL;
+       req->len = OFFSETOF(event_ecounters_config_request_v2_t, ecounters_xtlvs);
+
+       if ((rc = dhd_iovar(dhd, 0, "event_ecounters", (char *)req, req->len, NULL, 0, TRUE)) < 0) {
+               DHD_ERROR(("failed to stop event_ecounters\n"));
+       }
+
+fail:
+       if (req) {
+               MFREE(dhd->osh, req, sizeof(*req));
+       }
+       return rc;
+}
+#ifdef DHD_LOG_DUMP
+int
+dhd_dump_debug_ring(dhd_pub_t *dhdp, void *ring_ptr, const void *user_buf,
+               log_dump_section_hdr_t *sec_hdr,
+               char *text_hdr, int buflen, uint32 sec_type)
+{
+       uint32 rlen = 0;
+       uint32 data_len = 0;
+       void *data = NULL;
+       unsigned long flags = 0;
+       int ret = 0;
+       dhd_dbg_ring_t *ring = (dhd_dbg_ring_t *)ring_ptr;
+       int pos = 0;
+       int fpos_sechdr = 0;
+
+       if (!dhdp || !ring || !user_buf || !sec_hdr || !text_hdr) {
+               return BCME_BADARG;
+       }
+       /* do not allow further writes to the ring
+        * till we flush it
+        */
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+       ring->state = RING_SUSPEND;
+       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+
+       if (dhdp->concise_dbg_buf) {
+               /* re-use concise debug buffer temporarily
+                * to pull ring data, to write
+                * record by record to file
+                */
+               data_len = CONCISE_DUMP_BUFLEN;
+               data = dhdp->concise_dbg_buf;
+               ret = dhd_export_debug_data(text_hdr, NULL, user_buf, strlen(text_hdr), &pos);
+               /* write the section header now with zero length,
+                * once the correct length is found out, update
+                * it later
+                */
+               fpos_sechdr = pos;
+               sec_hdr->type = sec_type;
+               sec_hdr->length = 0;
+               ret = dhd_export_debug_data((char *)sec_hdr, NULL, user_buf,
+                       sizeof(*sec_hdr), &pos);
+               do {
+                       rlen = dhd_dbg_ring_pull_single(ring, data, data_len, TRUE);
+                       if (rlen > 0) {
+                               /* write the log */
+                               ret = dhd_export_debug_data(data, NULL, user_buf, rlen, &pos);
+                       }
+                       DHD_DBGIF(("%s: rlen : %d\n", __FUNCTION__, rlen));
+               } while ((rlen > 0));
+               /* now update the section header length in the file */
+               /* Complete ring size is dumped by HAL, hence updating length to ring size */
+               sec_hdr->length = ring->ring_size;
+               ret = dhd_export_debug_data((char *)sec_hdr, NULL, user_buf,
+                       sizeof(*sec_hdr), &fpos_sechdr);
+       } else {
+               DHD_ERROR(("%s: No concise buffer available !\n", __FUNCTION__));
+       }
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+       ring->state = RING_ACTIVE;
+       /* Resetting both read and write pointer,
+        * since all items are read.
+        */
+       ring->rp = ring->wp = 0;
+       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+
+       return ret;
+}
+
+int
+dhd_log_dump_ring_to_file(dhd_pub_t *dhdp, void *ring_ptr, void *file,
+               unsigned long *file_posn, log_dump_section_hdr_t *sec_hdr,
+               char *text_hdr, uint32 sec_type)
+{
+       uint32 rlen = 0;
+       uint32 data_len = 0, total_len = 0;
+       void *data = NULL;
+       unsigned long fpos_sechdr = 0;
+       unsigned long flags = 0;
+       int ret = 0;
+       dhd_dbg_ring_t *ring = (dhd_dbg_ring_t *)ring_ptr;
+
+       if (!dhdp || !ring || !file || !sec_hdr ||
+               !file_posn || !text_hdr)
+               return BCME_BADARG;
+
+       /* do not allow further writes to the ring
+        * till we flush it
+        */
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+       ring->state = RING_SUSPEND;
+       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+
+       if (dhdp->concise_dbg_buf) {
+               /* re-use concise debug buffer temporarily
+                * to pull ring data, to write
+                * record by record to file
+                */
+               data_len = CONCISE_DUMP_BUFLEN;
+               data = dhdp->concise_dbg_buf;
+               dhd_os_write_file_posn(file, file_posn, text_hdr,
+                               strlen(text_hdr));
+               /* write the section header now with zero length,
+                * once the correct length is found out, update
+                * it later
+                */
+               dhd_init_sec_hdr(sec_hdr);
+               fpos_sechdr = *file_posn;
+               sec_hdr->type = sec_type;
+               sec_hdr->length = 0;
+               dhd_os_write_file_posn(file, file_posn, (char *)sec_hdr,
+                               sizeof(*sec_hdr));
+               do {
+                       rlen = dhd_dbg_ring_pull_single(ring, data, data_len, TRUE);
+                       if (rlen > 0) {
+                               /* write the log */
+                               ret = dhd_os_write_file_posn(file, file_posn, data, rlen);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s: write file error !\n", __FUNCTION__));
+                                       DHD_DBG_RING_LOCK(ring->lock, flags);
+                                       ring->state = RING_ACTIVE;
+                                       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+                                       return BCME_ERROR;
+                               }
+                       }
+                       total_len += rlen;
+               } while (rlen > 0);
+               /* now update the section header length in the file */
+               sec_hdr->length = total_len;
+               dhd_os_write_file_posn(file, &fpos_sechdr, (char *)sec_hdr, sizeof(*sec_hdr));
+       } else {
+               DHD_ERROR(("%s: No concise buffer available !\n", __FUNCTION__));
+       }
+
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+       ring->state = RING_ACTIVE;
+       /* Resetting both read and write pointer,
+        * since all items are read.
+        */
+       ring->rp = ring->wp = 0;
+       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+       return BCME_OK;
+}
+
+/* logdump cookie */
+#define MAX_LOGUDMP_COOKIE_CNT 10u
+#define LOGDUMP_COOKIE_STR_LEN 50u
+int
+dhd_logdump_cookie_init(dhd_pub_t *dhdp, uint8 *buf, uint32 buf_size)
+{
+       uint32 ring_size;
+
+       if (!dhdp || !buf) {
+               DHD_ERROR(("INVALID PTR: dhdp:%p buf:%p\n", dhdp, buf));
+               return BCME_ERROR;
+       }
+
+       ring_size = dhd_ring_get_hdr_size() + LOGDUMP_COOKIE_STR_LEN * MAX_LOGUDMP_COOKIE_CNT;
+       if (buf_size < ring_size) {
+               DHD_ERROR(("BUF SIZE IS TO SHORT: req:%d buf_size:%d\n",
+                       ring_size, buf_size));
+               return BCME_ERROR;
+       }
+
+       dhdp->logdump_cookie = dhd_ring_init(dhdp, buf, buf_size,
+               LOGDUMP_COOKIE_STR_LEN, MAX_LOGUDMP_COOKIE_CNT,
+               DHD_RING_TYPE_FIXED);
+       if (!dhdp->logdump_cookie) {
+               DHD_ERROR(("FAIL TO INIT COOKIE RING\n"));
+               return BCME_ERROR;
+       }
+
+       return BCME_OK;
+}
+
+void
+dhd_logdump_cookie_deinit(dhd_pub_t *dhdp)
+{
+       if (!dhdp) {
+               return;
+       }
+       if (dhdp->logdump_cookie) {
+               dhd_ring_deinit(dhdp, dhdp->logdump_cookie);
+       }
+
+       return;
+}
+
+#ifdef DHD_TX_PROFILE
+int
+dhd_tx_profile_detach(dhd_pub_t *dhdp)
+{
+       int result = BCME_ERROR;
+
+       if (dhdp != NULL && dhdp->protocol_filters != NULL) {
+               MFREE(dhdp->osh, dhdp->protocol_filters, DHD_MAX_PROFILES *
+                               sizeof(*(dhdp->protocol_filters)));
+               dhdp->protocol_filters = NULL;
+
+               result = BCME_OK;
+       }
+
+       return result;
+}
+
+int
+dhd_tx_profile_attach(dhd_pub_t *dhdp)
+{
+       int result = BCME_ERROR;
+
+       if (dhdp != NULL) {
+               dhdp->protocol_filters = (dhd_tx_profile_protocol_t*)MALLOCZ(dhdp->osh,
+                               DHD_MAX_PROFILES * sizeof(*(dhdp->protocol_filters)));
+
+               if (dhdp->protocol_filters != NULL) {
+                       result = BCME_OK;
+               }
+       }
+
+       if (result != BCME_OK) {
+               DHD_ERROR(("%s:\tMALLOC of tx profile protocol filters failed\n",
+                       __FUNCTION__));
+       }
+
+       return result;
+}
+#endif /* defined(DHD_TX_PROFILE) */
+
+void
+dhd_logdump_cookie_save(dhd_pub_t *dhdp, char *cookie, char *type)
+{
+       char *ptr;
+
+       if (!dhdp || !cookie || !type || !dhdp->logdump_cookie) {
+               DHD_ERROR(("%s: At least one buffer ptr is NULL dhdp=%p cookie=%p"
+                       " type = %p, cookie_cfg:%p\n", __FUNCTION__,
+                       dhdp, cookie, type, dhdp?dhdp->logdump_cookie: NULL));
+               return;
+       }
+       ptr = (char *)dhd_ring_get_empty(dhdp->logdump_cookie);
+       if (ptr == NULL) {
+               DHD_ERROR(("%s : Skip to save due to locking\n", __FUNCTION__));
+               return;
+       }
+       scnprintf(ptr, LOGDUMP_COOKIE_STR_LEN, "%s: %s\n", type, cookie);
+       return;
+}
+
+int
+dhd_logdump_cookie_get(dhd_pub_t *dhdp, char *ret_cookie, uint32 buf_size)
+{
+       char *ptr;
+
+       if (!dhdp || !ret_cookie || !dhdp->logdump_cookie) {
+               DHD_ERROR(("%s: At least one buffer ptr is NULL dhdp=%p"
+                       "cookie=%p cookie_cfg:%p\n", __FUNCTION__,
+                       dhdp, ret_cookie, dhdp?dhdp->logdump_cookie: NULL));
+               return BCME_ERROR;
+       }
+       ptr = (char *)dhd_ring_get_first(dhdp->logdump_cookie);
+       if (ptr == NULL) {
+               DHD_ERROR(("%s : Skip to save due to locking\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+       memcpy(ret_cookie, ptr, MIN(buf_size, strlen(ptr)));
+       dhd_ring_free_first(dhdp->logdump_cookie);
+       return BCME_OK;
+}
+
+int
+dhd_logdump_cookie_count(dhd_pub_t *dhdp)
+{
+       if (!dhdp || !dhdp->logdump_cookie) {
+               DHD_ERROR(("%s: At least one buffer ptr is NULL dhdp=%p cookie=%p\n",
+                       __FUNCTION__, dhdp, dhdp?dhdp->logdump_cookie: NULL));
+               return 0;
+       }
+       return dhd_ring_get_cur_size(dhdp->logdump_cookie);
+}
+
+static inline int
+__dhd_log_dump_cookie_to_file(
+       dhd_pub_t *dhdp, void *fp, const void *user_buf, unsigned long *f_pos,
+       char *buf, uint32 buf_size)
+{
+
+       uint32 remain = buf_size;
+       int ret = BCME_ERROR;
+       char tmp_buf[LOGDUMP_COOKIE_STR_LEN];
+       log_dump_section_hdr_t sec_hdr;
+       uint32 read_idx;
+       uint32 write_idx;
+
+       read_idx = dhd_ring_get_read_idx(dhdp->logdump_cookie);
+       write_idx = dhd_ring_get_write_idx(dhdp->logdump_cookie);
+       while (dhd_logdump_cookie_count(dhdp) > 0) {
+               memset(tmp_buf, 0, sizeof(tmp_buf));
+               ret = dhd_logdump_cookie_get(dhdp, tmp_buf, LOGDUMP_COOKIE_STR_LEN);
+               if (ret != BCME_OK) {
+                       return ret;
+               }
+               remain -= scnprintf(&buf[buf_size - remain], remain, "%s", tmp_buf);
+       }
+       dhd_ring_set_read_idx(dhdp->logdump_cookie, read_idx);
+       dhd_ring_set_write_idx(dhdp->logdump_cookie, write_idx);
+
+       ret = dhd_export_debug_data(COOKIE_LOG_HDR, fp, user_buf, strlen(COOKIE_LOG_HDR), f_pos);
+       if (ret < 0) {
+               DHD_ERROR(("%s : Write file Error for cookie hdr\n", __FUNCTION__));
+               return ret;
+       }
+       sec_hdr.magic = LOG_DUMP_MAGIC;
+       sec_hdr.timestamp = local_clock();
+       sec_hdr.type = LOG_DUMP_SECTION_COOKIE;
+       sec_hdr.length = buf_size - remain;
+
+       ret = dhd_export_debug_data((char *)&sec_hdr, fp, user_buf, sizeof(sec_hdr), f_pos);
+       if (ret < 0) {
+               DHD_ERROR(("%s : Write file Error for section hdr\n", __FUNCTION__));
+               return ret;
+       }
+
+       ret = dhd_export_debug_data(buf, fp, user_buf, sec_hdr.length, f_pos);
+       if (ret < 0) {
+               DHD_ERROR(("%s : Write file Error for cookie data\n", __FUNCTION__));
+       }
+
+       return ret;
+}
+
+uint32
+dhd_log_dump_cookie_len(dhd_pub_t *dhdp)
+{
+       int len = 0;
+       char tmp_buf[LOGDUMP_COOKIE_STR_LEN];
+       log_dump_section_hdr_t sec_hdr;
+       char *buf = NULL;
+       int ret = BCME_ERROR;
+       uint32 buf_size = MAX_LOGUDMP_COOKIE_CNT * LOGDUMP_COOKIE_STR_LEN;
+       uint32 read_idx;
+       uint32 write_idx;
+       uint32 remain;
+
+       remain = buf_size;
+
+       if (!dhdp || !dhdp->logdump_cookie) {
+               DHD_ERROR(("%s At least one ptr is NULL "
+                       "dhdp = %p cookie %p\n",
+                       __FUNCTION__, dhdp, dhdp?dhdp->logdump_cookie:NULL));
+               goto exit;
+       }
+
+       buf = (char *)MALLOCZ(dhdp->osh, buf_size);
+       if (!buf) {
+               DHD_ERROR(("%s Fail to malloc buffer\n", __FUNCTION__));
+               goto exit;
+       }
+
+       read_idx = dhd_ring_get_read_idx(dhdp->logdump_cookie);
+       write_idx = dhd_ring_get_write_idx(dhdp->logdump_cookie);
+       while (dhd_logdump_cookie_count(dhdp) > 0) {
+               memset(tmp_buf, 0, sizeof(tmp_buf));
+               ret = dhd_logdump_cookie_get(dhdp, tmp_buf, LOGDUMP_COOKIE_STR_LEN);
+               if (ret != BCME_OK) {
+                       goto exit;
+               }
+               remain -= (uint32)strlen(tmp_buf);
+       }
+       dhd_ring_set_read_idx(dhdp->logdump_cookie, read_idx);
+       dhd_ring_set_write_idx(dhdp->logdump_cookie, write_idx);
+       len += strlen(COOKIE_LOG_HDR);
+       len += sizeof(sec_hdr);
+       len += (buf_size - remain);
+exit:
+       if (buf)
+               MFREE(dhdp->osh, buf, buf_size);
+       return len;
+}
+
+int
+dhd_log_dump_cookie(dhd_pub_t *dhdp, const void *user_buf)
+{
+       int ret = BCME_ERROR;
+       char tmp_buf[LOGDUMP_COOKIE_STR_LEN];
+       log_dump_section_hdr_t sec_hdr;
+       char *buf = NULL;
+       uint32 buf_size = MAX_LOGUDMP_COOKIE_CNT * LOGDUMP_COOKIE_STR_LEN;
+       int pos = 0;
+       uint32 read_idx;
+       uint32 write_idx;
+       uint32 remain;
+
+       remain = buf_size;
+
+       if (!dhdp || !dhdp->logdump_cookie) {
+               DHD_ERROR(("%s At least one ptr is NULL "
+                       "dhdp = %p cookie %p\n",
+                       __FUNCTION__, dhdp, dhdp?dhdp->logdump_cookie:NULL));
+               goto exit;
+       }
+
+       buf = (char *)MALLOCZ(dhdp->osh, buf_size);
+       if (!buf) {
+               DHD_ERROR(("%s Fail to malloc buffer\n", __FUNCTION__));
+               goto exit;
+       }
+
+       read_idx = dhd_ring_get_read_idx(dhdp->logdump_cookie);
+       write_idx = dhd_ring_get_write_idx(dhdp->logdump_cookie);
+       while (dhd_logdump_cookie_count(dhdp) > 0) {
+               memset(tmp_buf, 0, sizeof(tmp_buf));
+               ret = dhd_logdump_cookie_get(dhdp, tmp_buf, LOGDUMP_COOKIE_STR_LEN);
+               if (ret != BCME_OK) {
+                       goto exit;
+               }
+               remain -= scnprintf(&buf[buf_size - remain], remain, "%s", tmp_buf);
+       }
+       dhd_ring_set_read_idx(dhdp->logdump_cookie, read_idx);
+       dhd_ring_set_write_idx(dhdp->logdump_cookie, write_idx);
+       ret = dhd_export_debug_data(COOKIE_LOG_HDR, NULL, user_buf, strlen(COOKIE_LOG_HDR), &pos);
+       sec_hdr.magic = LOG_DUMP_MAGIC;
+       sec_hdr.timestamp = local_clock();
+       sec_hdr.type = LOG_DUMP_SECTION_COOKIE;
+       sec_hdr.length = buf_size - remain;
+       ret = dhd_export_debug_data((char *)&sec_hdr, NULL, user_buf, sizeof(sec_hdr), &pos);
+       ret = dhd_export_debug_data(buf, NULL, user_buf, sec_hdr.length, &pos);
+exit:
+       if (buf)
+               MFREE(dhdp->osh, buf, buf_size);
+       return ret;
+}
+
+int
+dhd_log_dump_cookie_to_file(dhd_pub_t *dhdp, void *fp, const void *user_buf, unsigned long *f_pos)
+{
+       char *buf;
+       int ret = BCME_ERROR;
+       uint32 buf_size = MAX_LOGUDMP_COOKIE_CNT * LOGDUMP_COOKIE_STR_LEN;
+
+       if (!dhdp || !dhdp->logdump_cookie || (!fp && !user_buf) || !f_pos) {
+               DHD_ERROR(("%s At least one ptr is NULL "
+                       "dhdp = %p cookie %p fp = %p f_pos = %p\n",
+                       __FUNCTION__, dhdp, dhdp?dhdp->logdump_cookie:NULL, fp, f_pos));
+               return ret;
+       }
+
+       buf = (char *)MALLOCZ(dhdp->osh, buf_size);
+       if (!buf) {
+               DHD_ERROR(("%s Fail to malloc buffer\n", __FUNCTION__));
+               return ret;
+       }
+       ret = __dhd_log_dump_cookie_to_file(dhdp, fp, user_buf, f_pos, buf, buf_size);
+       MFREE(dhdp->osh, buf, buf_size);
+
+       return ret;
+}
+#endif /* DHD_LOG_DUMP */
+
+#if defined(DISABLE_HE_ENAB) || defined(CUSTOM_CONTROL_HE_ENAB)
+int
+dhd_control_he_enab(dhd_pub_t * dhd, uint8 he_enab)
+{
+       int ret = BCME_OK;
+       bcm_xtlv_t *pxtlv = NULL;
+       uint8 mybuf[DHD_IOVAR_BUF_SIZE];
+       uint16 mybuf_len = sizeof(mybuf);
+       pxtlv = (bcm_xtlv_t *)mybuf;
+
+       ret = bcm_pack_xtlv_entry((uint8**)&pxtlv, &mybuf_len, WL_HE_CMD_ENAB, sizeof(he_enab),
+                       &he_enab, BCM_XTLV_OPTION_ALIGN32);
+
+       if (ret != BCME_OK) {
+               ret = -EINVAL;
+               DHD_ERROR(("%s failed to pack he enab, err: %s\n", __FUNCTION__, bcmerrorstr(ret)));
+               return ret;
+       }
+
+       ret = dhd_iovar(dhd, 0, "he", (char *)&mybuf, sizeof(mybuf), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s he_enab (%d) set failed, err: %s\n",
+                               __FUNCTION__, he_enab, bcmerrorstr(ret)));
+       } else {
+               DHD_ERROR(("%s he_enab (%d) set successed\n", __FUNCTION__, he_enab));
+       }
+
+       return ret;
+}
+#endif /* DISABLE_HE_ENAB || CUSTOM_CONTROL_HE_ENAB */
+
+#ifdef CONFIG_ROAM_RSSI_LIMIT
+int
+dhd_roam_rssi_limit_get(dhd_pub_t *dhd, int *lmt2g, int *lmt5g)
+{
+       wlc_roam_rssi_limit_t *plmt;
+       wlc_roam_rssi_lmt_info_v1_t *pinfo;
+       int ret = BCME_OK;
+       int plmt_len = sizeof(*pinfo) + ROAMRSSI_HDRLEN;
+
+       plmt = (wlc_roam_rssi_limit_t *)MALLOCZ(dhd->osh, plmt_len);
+       if (!plmt) {
+               DHD_ERROR(("%s Fail to malloc buffer\n", __FUNCTION__));
+               return BCME_NOMEM;
+       }
+
+       /* Get roam rssi limit */
+       ret = dhd_iovar(dhd, 0, "roam_rssi_limit", NULL, 0, (char *)plmt, plmt_len, FALSE);
+       if (ret < 0) {
+               DHD_ERROR(("%s Failed to Get roam_rssi_limit %d\n", __FUNCTION__, ret));
+               goto done;
+       }
+
+       if (plmt->ver != WLC_ROAM_RSSI_LMT_VER_1) {
+           ret = BCME_VERSION;
+           goto done;
+       }
+
+       pinfo = (wlc_roam_rssi_lmt_info_v1_t *)plmt->data;
+       *lmt2g = (int)pinfo->rssi_limit_2g;
+       *lmt5g = (int)pinfo->rssi_limit_5g;
+
+done:
+       if (plmt) {
+               MFREE(dhd->osh, plmt, plmt_len);
+       }
+       return ret;
+}
+
+int
+dhd_roam_rssi_limit_set(dhd_pub_t *dhd, int lmt2g, int lmt5g)
+{
+       wlc_roam_rssi_limit_t *plmt;
+       wlc_roam_rssi_lmt_info_v1_t *pinfo;
+       int ret = BCME_OK;
+       int plmt_len = sizeof(*pinfo) + ROAMRSSI_HDRLEN;
+
+       /* Sanity check RSSI limit Value */
+       if ((lmt2g < ROAMRSSI_2G_MIN) || (lmt2g > ROAMRSSI_2G_MAX)) {
+               DHD_ERROR(("%s Not In Range 2G ROAM RSSI Limit\n", __FUNCTION__));
+               return BCME_RANGE;
+       }
+       if ((lmt2g < ROAMRSSI_5G_MIN) || (lmt2g > ROAMRSSI_5G_MAX)) {
+               DHD_ERROR(("%s Not In Range 5G ROAM RSSI Limit\n", __FUNCTION__));
+               return BCME_RANGE;
+       }
+
+       plmt = (wlc_roam_rssi_limit_t *)MALLOCZ(dhd->osh, plmt_len);
+       if (!plmt) {
+               DHD_ERROR(("%s Fail to malloc buffer\n", __FUNCTION__));
+               return BCME_NOMEM;
+       }
+       plmt->ver = WLC_ROAM_RSSI_LMT_VER_1;
+       plmt->len = sizeof(*pinfo);
+       pinfo = (wlc_roam_rssi_lmt_info_v1_t *)plmt->data;
+       pinfo->rssi_limit_2g = (int16)lmt2g;
+       pinfo->rssi_limit_5g = (int16)lmt5g;
+
+       /* Set roam rssi limit */
+       ret = dhd_iovar(dhd, 0, "roam_rssi_limit", (char *)plmt, plmt_len, NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s Failed to Get roam_rssi_limit %d\n", __FUNCTION__, ret));
+               goto done;
+       }
+done:
+       if (plmt) {
+               MFREE(dhd->osh, plmt, plmt_len);
+       }
+       return ret;
+}
+#endif /* CONFIG_ROAM_RSSI_LIMIT */
+
+int
+dhd_iovar(dhd_pub_t *pub, int ifidx, char *name, char *param_buf, uint param_len, char *res_buf,
+               uint res_len, bool set)
+{
+       char *buf = NULL;
+       uint input_len;
+       wl_ioctl_t ioc;
+       int ret;
+
+       if (res_len > WLC_IOCTL_MAXLEN || param_len > WLC_IOCTL_MAXLEN)
+               return BCME_BADARG;
+
+       input_len = strlen(name) + 1 + param_len;
+       if (input_len > WLC_IOCTL_MAXLEN)
+               return BCME_BADARG;
+
+       buf = NULL;
+       if (set) {
+               if (res_buf || res_len != 0) {
+                       DHD_ERROR(("%s: SET wrong arguemnet\n", __FUNCTION__));
+                       ret = BCME_BADARG;
+                       goto exit;
+               }
+               buf = MALLOCZ(pub->osh, input_len);
+               if (!buf) {
+                       DHD_ERROR(("%s: mem alloc failed\n", __FUNCTION__));
+                       ret = BCME_NOMEM;
+                       goto exit;
+               }
+               ret = bcm_mkiovar(name, param_buf, param_len, buf, input_len);
+               if (!ret) {
+                       ret = BCME_NOMEM;
+                       goto exit;
+               }
+
+               ioc.cmd = WLC_SET_VAR;
+               ioc.buf = buf;
+               ioc.len = input_len;
+               ioc.set = set;
+
+               ret = dhd_wl_ioctl(pub, ifidx, &ioc, ioc.buf, ioc.len);
+       } else {
+               if (!res_buf || !res_len) {
+                       DHD_ERROR(("%s: GET failed. resp_buf NULL or length 0.\n", __FUNCTION__));
+                       ret = BCME_BADARG;
+                       goto exit;
+               }
+
+               if (res_len < input_len) {
+                       DHD_INFO(("%s: res_len(%d) < input_len(%d)\n", __FUNCTION__,
+                                       res_len, input_len));
+                       buf = MALLOCZ(pub->osh, input_len);
+                       if (!buf) {
+                               DHD_ERROR(("%s: mem alloc failed\n", __FUNCTION__));
+                               ret = BCME_NOMEM;
+                               goto exit;
+                       }
+                       ret = bcm_mkiovar(name, param_buf, param_len, buf, input_len);
+                       if (!ret) {
+                               ret = BCME_NOMEM;
+                               goto exit;
+                       }
+
+                       ioc.cmd = WLC_GET_VAR;
+                       ioc.buf = buf;
+                       ioc.len = input_len;
+                       ioc.set = set;
+
+                       ret = dhd_wl_ioctl(pub, ifidx, &ioc, ioc.buf, ioc.len);
+
+                       if (ret == BCME_OK) {
+                               memcpy(res_buf, buf, res_len);
+                       }
+               } else {
+                       memset(res_buf, 0, res_len);
+                       ret = bcm_mkiovar(name, param_buf, param_len, res_buf, res_len);
+                       if (!ret) {
+                               ret = BCME_NOMEM;
+                               goto exit;
+                       }
+
+                       ioc.cmd = WLC_GET_VAR;
+                       ioc.buf = res_buf;
+                       ioc.len = res_len;
+                       ioc.set = set;
+
+                       ret = dhd_wl_ioctl(pub, ifidx, &ioc, ioc.buf, ioc.len);
+               }
+       }
+exit:
+       if (buf) {
+               MFREE(pub->osh, buf, input_len);
+       }
+       return ret;
+}
diff --git a/bcmdhd.101.10.240.x/dhd_config.c b/bcmdhd.101.10.240.x/dhd_config.c
new file mode 100644 (file)
index 0000000..0971ad4
--- /dev/null
@@ -0,0 +1,3989 @@
+\r
+#include <typedefs.h>\r
+#include <osl.h>\r
+\r
+#include <bcmendian.h>\r
+#include <bcmutils.h>\r
+#include <hndsoc.h>\r
+#include <bcmsdbus.h>\r
+#if defined(HW_OOB) || defined(FORCE_WOWLAN)\r
+#include <bcmdefs.h>\r
+#include <bcmsdh.h>\r
+#include <sdio.h>\r
+#include <sbchipc.h>\r
+#endif\r
+#ifdef WL_CFG80211\r
+#include <wl_cfg80211.h>\r
+#endif\r
+\r
+#include <dhd_config.h>\r
+#include <dhd_dbg.h>\r
+#include <wl_android.h>\r
+\r
+/* message levels */\r
+#define CONFIG_ERROR_LEVEL     (1 << 0)\r
+#define CONFIG_TRACE_LEVEL     (1 << 1)\r
+#define CONFIG_MSG_LEVEL       (1 << 0)\r
+\r
+uint config_msg_level = CONFIG_ERROR_LEVEL | CONFIG_MSG_LEVEL;\r
+uint dump_msg_level = 0;\r
+\r
+#define CONFIG_MSG(x, args...) \\r
+       do { \\r
+               if (config_msg_level & CONFIG_MSG_LEVEL) { \\r
+                       printk(KERN_ERR "[dhd] %s : " x, __func__, ## args); \\r
+               } \\r
+       } while (0)\r
+#define CONFIG_ERROR(x, args...) \\r
+       do { \\r
+               if (config_msg_level & CONFIG_ERROR_LEVEL) { \\r
+                       printk(KERN_ERR "[dhd] CONFIG-ERROR) %s : " x, __func__, ## args); \\r
+               } \\r
+       } while (0)\r
+#define CONFIG_TRACE(x, args...) \\r
+       do { \\r
+               if (config_msg_level & CONFIG_TRACE_LEVEL) { \\r
+                       printk(KERN_INFO "[dhd] CONFIG-TRACE) %s : " x, __func__, ## args); \\r
+               } \\r
+       } while (0)\r
+\r
+#define MAXSZ_BUF              4096\r
+#define MAXSZ_CONFIG   8192\r
+\r
+#ifndef WL_CFG80211\r
+#define htod32(i) i\r
+#define htod16(i) i\r
+#define dtoh32(i) i\r
+#define dtoh16(i) i\r
+#define htodchanspec(i) i\r
+#define dtohchanspec(i) i\r
+#endif\r
+\r
+#if defined(PROP_TXSTATUS)\r
+#include <dhd_wlfc.h>\r
+#endif /* PROP_TXSTATUS */\r
+\r
+#define MAX_EVENT_BUF_NUM 16\r
+typedef struct eventmsg_buf {\r
+       u16 num;\r
+       struct {\r
+               u16 type;\r
+               bool set;\r
+       } event [MAX_EVENT_BUF_NUM];\r
+} eventmsg_buf_t;\r
+\r
+typedef struct cihp_name_map_t {\r
+       uint chip;\r
+       uint chiprev;\r
+       uint ag_type;\r
+       char *chip_name;\r
+       char *module_name;\r
+} cihp_name_map_t;\r
+\r
+/* Map of WLC_E events to connection failure strings */\r
+#define DONT_CARE      9999\r
+const cihp_name_map_t chip_name_map[] = {\r
+       /* ChipID                       Chiprev AG              ChipName        ModuleName  */\r
+#ifdef BCMSDIO\r
+       {BCM43362_CHIP_ID,      0,      DONT_CARE,      "bcm40181a0",           ""},\r
+       {BCM43362_CHIP_ID,      1,      DONT_CARE,      "bcm40181a2",           ""},\r
+       {BCM4330_CHIP_ID,       4,      FW_TYPE_G,      "bcm40183b2",           ""},\r
+       {BCM4330_CHIP_ID,       4,      FW_TYPE_AG,     "bcm40183b2_ag",        ""},\r
+       {BCM43430_CHIP_ID,      0,      DONT_CARE,      "bcm43438a0",           "ap6212"},\r
+       {BCM43430_CHIP_ID,      1,      DONT_CARE,      "bcm43438a1",           "ap6212a"},\r
+       {BCM43430_CHIP_ID,      2,      DONT_CARE,      "bcm43436b0",           "ap6236"},\r
+       {BCM43012_CHIP_ID,      1,      FW_TYPE_G,      "bcm43013b0",           ""},\r
+       {BCM43012_CHIP_ID,      1,      FW_TYPE_AG,     "bcm43013c0_ag",        ""},\r
+       {BCM43012_CHIP_ID,      2,      DONT_CARE,      "bcm43013c1_ag",        ""},\r
+       {BCM4334_CHIP_ID,       3,      DONT_CARE,      "bcm4334b1_ag",         ""},\r
+       {BCM43340_CHIP_ID,      2,      DONT_CARE,      "bcm43341b0_ag",        ""},\r
+       {BCM43341_CHIP_ID,      2,      DONT_CARE,      "bcm43341b0_ag",        ""},\r
+       {BCM4324_CHIP_ID,       5,      DONT_CARE,      "bcm43241b4_ag",        ""},\r
+       {BCM4335_CHIP_ID,       2,      DONT_CARE,      "bcm4339a0_ag",         ""},\r
+       {BCM4339_CHIP_ID,       1,      DONT_CARE,      "bcm4339a0_ag",         "ap6335"},\r
+       {BCM4345_CHIP_ID,       6,      DONT_CARE,      "bcm43455c0_ag",        "ap6255"},\r
+       {BCM43454_CHIP_ID,      6,      DONT_CARE,      "bcm43455c0_ag",        ""},\r
+       {BCM4345_CHIP_ID,       9,      DONT_CARE,      "bcm43456c5_ag",        "ap6256"},\r
+       {BCM43454_CHIP_ID,      9,      DONT_CARE,      "bcm43456c5_ag",        ""},\r
+       {BCM4354_CHIP_ID,       1,      DONT_CARE,      "bcm4354a1_ag",         ""},\r
+       {BCM4354_CHIP_ID,       2,      DONT_CARE,      "bcm4356a2_ag",         "ap6356"},\r
+       {BCM4356_CHIP_ID,       2,      DONT_CARE,      "bcm4356a2_ag",         ""},\r
+       {BCM4371_CHIP_ID,       2,      DONT_CARE,      "bcm4356a2_ag",         ""},\r
+       {BCM43569_CHIP_ID,      3,      DONT_CARE,      "bcm4358a3_ag",         ""},\r
+       {BCM4359_CHIP_ID,       5,      DONT_CARE,      "bcm4359b1_ag",         ""},\r
+       {BCM4359_CHIP_ID,       9,      DONT_CARE,      "bcm4359c0_ag",         "ap6398s"},\r
+       {BCM43751_CHIP_ID,      1,      DONT_CARE,      "bcm43751a1_ag",        ""},\r
+       {BCM43751_CHIP_ID,      2,      DONT_CARE,      "bcm43751a2_ag",        ""},\r
+       {BCM43752_CHIP_ID,      1,      DONT_CARE,      "bcm43752a1_ag",        ""},\r
+       {BCM43752_CHIP_ID,      2,      DONT_CARE,      "bcm43752a2_ag",        ""},\r
+#endif\r
+#ifdef BCMPCIE\r
+       {BCM4354_CHIP_ID,       2,      DONT_CARE,      "bcm4356a2_pcie_ag",    ""},\r
+       {BCM4356_CHIP_ID,       2,      DONT_CARE,      "bcm4356a2_pcie_ag",    ""},\r
+       {BCM4359_CHIP_ID,       9,      DONT_CARE,      "bcm4359c0_pcie_ag",    ""},\r
+       {BCM43751_CHIP_ID,      1,      DONT_CARE,      "bcm43751a1_pcie_ag",   ""},\r
+       {BCM43751_CHIP_ID,      2,      DONT_CARE,      "bcm43751a2_pcie_ag",   ""},\r
+       {BCM43752_CHIP_ID,      1,      DONT_CARE,      "bcm43752a1_pcie_ag",   ""},\r
+       {BCM43752_CHIP_ID,      2,      DONT_CARE,      "bcm43752a2_pcie_ag",   ""},\r
+#endif\r
+#ifdef BCMDBUS\r
+       {BCM43143_CHIP_ID,      2,      DONT_CARE,      "bcm43143b0",           ""},\r
+       {BCM43242_CHIP_ID,      1,      DONT_CARE,      "bcm43242a1_ag",        ""},\r
+       {BCM43569_CHIP_ID,      2,      DONT_CARE,      "bcm4358u_ag",          "ap62x8"},\r
+#endif\r
+};\r
+\r
+void\r
+dhd_conf_free_chip_nv_path_list(wl_chip_nv_path_list_ctrl_t *chip_nv_list)\r
+{\r
+       CONFIG_TRACE("called\n");\r
+\r
+       if (chip_nv_list->m_chip_nv_path_head) {\r
+               CONFIG_TRACE("Free %p\n", chip_nv_list->m_chip_nv_path_head);\r
+               kfree(chip_nv_list->m_chip_nv_path_head);\r
+       }\r
+       chip_nv_list->count = 0;\r
+}\r
+\r
+#ifdef BCMSDIO\r
+void\r
+dhd_conf_free_mac_list(wl_mac_list_ctrl_t *mac_list)\r
+{\r
+       int i;\r
+\r
+       CONFIG_TRACE("called\n");\r
+       if (mac_list->m_mac_list_head) {\r
+               for (i=0; i<mac_list->count; i++) {\r
+                       if (mac_list->m_mac_list_head[i].mac) {\r
+                               CONFIG_TRACE("Free mac %p\n", mac_list->m_mac_list_head[i].mac);\r
+                               kfree(mac_list->m_mac_list_head[i].mac);\r
+                       }\r
+               }\r
+               CONFIG_TRACE("Free m_mac_list_head %p\n", mac_list->m_mac_list_head);\r
+               kfree(mac_list->m_mac_list_head);\r
+       }\r
+       mac_list->count = 0;\r
+}\r
+\r
+#if defined(HW_OOB) || defined(FORCE_WOWLAN)\r
+void\r
+dhd_conf_set_hw_oob_intr(bcmsdh_info_t *sdh, struct si_pub *sih)\r
+{\r
+       uint32 gpiocontrol, addr;\r
+\r
+       if (CHIPID(sih->chip) == BCM43362_CHIP_ID) {\r
+               CONFIG_MSG("Enable HW OOB for 43362\n");\r
+               addr = SI_ENUM_BASE(sih) + OFFSETOF(chipcregs_t, gpiocontrol);\r
+               gpiocontrol = bcmsdh_reg_read(sdh, addr, 4);\r
+               gpiocontrol |= 0x2;\r
+               bcmsdh_reg_write(sdh, addr, 4, gpiocontrol);\r
+               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, 0x10005, 0xf, NULL);\r
+               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, 0x10006, 0x0, NULL);\r
+               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, 0x10007, 0x2, NULL);\r
+       }\r
+}\r
+#endif\r
+\r
+#define SBSDIO_CIS_SIZE_LIMIT          0x200\r
+void\r
+dhd_conf_get_otp(dhd_pub_t *dhd, bcmsdh_info_t *sdh, si_t *sih)\r
+{\r
+       int i, err = -1;\r
+       uint8 *ptr = 0, *ptpl_code = NULL;\r
+       unsigned char tpl_code, tpl_link='\0';\r
+       uint8 mac_header[3] = {0x80, 0x07, 0x19};\r
+       uint8 *cis;\r
+\r
+       if (!(cis = MALLOC(dhd->osh, SBSDIO_CIS_SIZE_LIMIT))) {\r
+               CONFIG_ERROR("cis malloc failed\n");\r
+       }\r
+       bzero(cis, SBSDIO_CIS_SIZE_LIMIT);\r
+\r
+       if ((err = bcmsdh_cis_read(sdh, 0, cis, SBSDIO_CIS_SIZE_LIMIT))) {\r
+               CONFIG_ERROR("cis read err %d\n", err);\r
+               MFREE(dhd->osh, cis, SBSDIO_CIS_SIZE_LIMIT);\r
+               return;\r
+       }\r
+       ptr = cis;\r
+       do {\r
+               /* 0xff means we're done */\r
+               tpl_code = *ptr;\r
+               ptpl_code = ptr;\r
+               ptr++;\r
+               if (tpl_code == 0xff)\r
+                       break;\r
+\r
+               /* null entries have no link field or data */\r
+               if (tpl_code == 0x00)\r
+                       continue;\r
+\r
+               tpl_link = *ptr;\r
+               ptr++;\r
+               /* a size of 0xff also means we're done */\r
+               if (tpl_link == 0xff)\r
+                       break;\r
+               if (config_msg_level & CONFIG_TRACE_LEVEL) {\r
+                       prhex("TPL", ptpl_code, tpl_link+2);\r
+               }\r
+\r
+               if (tpl_code == 0x80 && tpl_link == 0x07 && *ptr == 0x19) {\r
+                       memcpy(&dhd->conf->otp_mac, ptr+1, 6);\r
+               }\r
+#ifdef GET_OTP_MODULE_NAME\r
+               else if (tpl_code == 0x8e && *ptr == 0x41) {\r
+                       int len = tpl_link - 1;\r
+                       if (len <= sizeof(dhd->conf->module_name) - 1) {\r
+                               strncpy(dhd->conf->module_name, ptr+1, len);\r
+                               CONFIG_MSG("module_name=%s\n", dhd->conf->module_name);\r
+                       } else {\r
+                               CONFIG_ERROR("len is too long %d >= %d\n",\r
+                                       len, (int)sizeof(dhd->conf->module_name) - 1);\r
+                       }\r
+               }\r
+#endif\r
+\r
+               ptr += tpl_link;\r
+       } while (1);\r
+\r
+       if (!memcmp(&ether_null, &dhd->conf->otp_mac, ETHER_ADDR_LEN)) {\r
+               ptr = cis;\r
+               /* Special OTP */\r
+               if (bcmsdh_reg_read(sdh, SI_ENUM_BASE(sih), 4) == 0x16044330) {\r
+                       for (i=0; i<SBSDIO_CIS_SIZE_LIMIT; i++) {\r
+                               if (!memcmp(mac_header, ptr, 3)) {\r
+                                       memcpy(&dhd->conf->otp_mac, ptr+3, 6);\r
+                                       break;\r
+                               }\r
+                               ptr++;\r
+                       }\r
+               }\r
+       }\r
+\r
+       ASSERT(cis);\r
+       MFREE(dhd->osh, cis, SBSDIO_CIS_SIZE_LIMIT);\r
+}\r
+\r
+void\r
+dhd_conf_set_fw_name_by_mac(dhd_pub_t *dhd, char *fw_path)\r
+{\r
+       int i, j;\r
+       uint8 *mac = (uint8 *)&dhd->conf->otp_mac;\r
+       int fw_num=0, mac_num=0;\r
+       uint32 oui, nic;\r
+       wl_mac_list_t *mac_list;\r
+       wl_mac_range_t *mac_range;\r
+       int fw_type, fw_type_new;\r
+       char *name_ptr;\r
+\r
+       mac_list = dhd->conf->fw_by_mac.m_mac_list_head;\r
+       fw_num = dhd->conf->fw_by_mac.count;\r
+       if (!mac_list || !fw_num)\r
+               return;\r
+\r
+       oui = (mac[0] << 16) | (mac[1] << 8) | (mac[2]);\r
+       nic = (mac[3] << 16) | (mac[4] << 8) | (mac[5]);\r
+\r
+       /* find out the last '/' */\r
+       i = strlen(fw_path);\r
+       while (i > 0) {\r
+               if (fw_path[i] == '/') {\r
+                       i++;\r
+                       break;\r
+               }\r
+               i--;\r
+       }\r
+       name_ptr = &fw_path[i];\r
+\r
+       if (strstr(name_ptr, "_apsta"))\r
+               fw_type = FW_TYPE_APSTA;\r
+       else if (strstr(name_ptr, "_p2p"))\r
+               fw_type = FW_TYPE_P2P;\r
+       else if (strstr(name_ptr, "_mesh"))\r
+               fw_type = FW_TYPE_MESH;\r
+       else if (strstr(name_ptr, "_es"))\r
+               fw_type = FW_TYPE_ES;\r
+       else if (strstr(name_ptr, "_mfg"))\r
+               fw_type = FW_TYPE_MFG;\r
+       else\r
+               fw_type = FW_TYPE_STA;\r
+\r
+       for (i=0; i<fw_num; i++) {\r
+               mac_num = mac_list[i].count;\r
+               mac_range = mac_list[i].mac;\r
+               if (strstr(mac_list[i].name, "_apsta"))\r
+                       fw_type_new = FW_TYPE_APSTA;\r
+               else if (strstr(mac_list[i].name, "_p2p"))\r
+                       fw_type_new = FW_TYPE_P2P;\r
+               else if (strstr(mac_list[i].name, "_mesh"))\r
+                       fw_type_new = FW_TYPE_MESH;\r
+               else if (strstr(mac_list[i].name, "_es"))\r
+                       fw_type_new = FW_TYPE_ES;\r
+               else if (strstr(mac_list[i].name, "_mfg"))\r
+                       fw_type_new = FW_TYPE_MFG;\r
+               else\r
+                       fw_type_new = FW_TYPE_STA;\r
+               if (fw_type != fw_type_new) {\r
+                       CONFIG_MSG("fw_typ=%d != fw_type_new=%d\n", fw_type, fw_type_new);\r
+                       continue;\r
+               }\r
+               for (j=0; j<mac_num; j++) {\r
+                       if (oui == mac_range[j].oui) {\r
+                               if (nic >= mac_range[j].nic_start && nic <= mac_range[j].nic_end) {\r
+                                       strcpy(name_ptr, mac_list[i].name);\r
+                                       CONFIG_MSG("matched oui=0x%06X, nic=0x%06X\n", oui, nic);\r
+                                       CONFIG_MSG("fw_path=%s\n", fw_path);\r
+                                       return;\r
+                               }\r
+                       }\r
+               }\r
+       }\r
+}\r
+\r
+void\r
+dhd_conf_set_nv_name_by_mac(dhd_pub_t *dhd, char *nv_path)\r
+{\r
+       int i, j;\r
+       uint8 *mac = (uint8 *)&dhd->conf->otp_mac;\r
+       int nv_num=0, mac_num=0;\r
+       uint32 oui, nic;\r
+       wl_mac_list_t *mac_list;\r
+       wl_mac_range_t *mac_range;\r
+       char *pnv_name;\r
+\r
+       mac_list = dhd->conf->nv_by_mac.m_mac_list_head;\r
+       nv_num = dhd->conf->nv_by_mac.count;\r
+       if (!mac_list || !nv_num)\r
+               return;\r
+\r
+       oui = (mac[0] << 16) | (mac[1] << 8) | (mac[2]);\r
+       nic = (mac[3] << 16) | (mac[4] << 8) | (mac[5]);\r
+\r
+       /* find out the last '/' */\r
+       i = strlen(nv_path);\r
+       while (i > 0) {\r
+               if (nv_path[i] == '/') break;\r
+               i--;\r
+       }\r
+       pnv_name = &nv_path[i+1];\r
+\r
+       for (i=0; i<nv_num; i++) {\r
+               mac_num = mac_list[i].count;\r
+               mac_range = mac_list[i].mac;\r
+               for (j=0; j<mac_num; j++) {\r
+                       if (oui == mac_range[j].oui) {\r
+                               if (nic >= mac_range[j].nic_start && nic <= mac_range[j].nic_end) {\r
+                                       strcpy(pnv_name, mac_list[i].name);\r
+                                       CONFIG_MSG("matched oui=0x%06X, nic=0x%06X\n", oui, nic);\r
+                                       CONFIG_MSG("nv_path=%s\n", nv_path);\r
+                                       return;\r
+                               }\r
+                       }\r
+               }\r
+       }\r
+}\r
+#endif\r
+\r
+void\r
+dhd_conf_free_country_list(struct dhd_conf *conf)\r
+{\r
+       country_list_t *country = conf->country_head;\r
+       int count = 0;\r
+\r
+       CONFIG_TRACE("called\n");\r
+       while (country) {\r
+               CONFIG_TRACE("Free cspec %s\n", country->cspec.country_abbrev);\r
+               conf->country_head = country->next;\r
+               kfree(country);\r
+               country = conf->country_head;\r
+               count++;\r
+       }\r
+       CONFIG_TRACE("%d country released\n", count);\r
+}\r
+\r
+void\r
+dhd_conf_free_mchan_list(struct dhd_conf *conf)\r
+{\r
+       mchan_params_t *mchan = conf->mchan;\r
+       int count = 0;\r
+\r
+       CONFIG_TRACE("called\n");\r
+       while (mchan) {\r
+               CONFIG_TRACE("Free cspec %p\n", mchan);\r
+               conf->mchan = mchan->next;\r
+               kfree(mchan);\r
+               mchan = conf->mchan;\r
+               count++;\r
+       }\r
+       CONFIG_TRACE("%d mchan released\n", count);\r
+}\r
+\r
+int\r
+dhd_conf_set_fw_name_by_chip(dhd_pub_t *dhd, char *fw_path)\r
+{\r
+       int fw_type, ag_type;\r
+       uint chip, chiprev;\r
+       int i;\r
+       char *name_ptr;\r
+\r
+       chip = dhd->conf->chip;\r
+       chiprev = dhd->conf->chiprev;\r
+\r
+       if (fw_path[0] == '\0') {\r
+#ifdef CONFIG_BCMDHD_FW_PATH\r
+               bcm_strncpy_s(fw_path, MOD_PARAM_PATHLEN-1, CONFIG_BCMDHD_FW_PATH, MOD_PARAM_PATHLEN-1);\r
+               if (fw_path[0] == '\0')\r
+#endif\r
+               {\r
+                       CONFIG_MSG("firmware path is null\n");\r
+                       return 0;\r
+               }\r
+       }\r
+#ifndef FW_PATH_AUTO_SELECT\r
+       return DONT_CARE;\r
+#endif\r
+\r
+       /* find out the last '/' */\r
+       i = strlen(fw_path);\r
+       while (i > 0) {\r
+               if (fw_path[i] == '/') {\r
+                       i++;\r
+                       break;\r
+               }\r
+               i--;\r
+       }\r
+       name_ptr = &fw_path[i];\r
+#ifdef BAND_AG\r
+       ag_type = FW_TYPE_AG;\r
+#else\r
+       ag_type = strstr(name_ptr, "_ag") ? FW_TYPE_AG : FW_TYPE_G;\r
+#endif\r
+       if (strstr(name_ptr, "_apsta"))\r
+               fw_type = FW_TYPE_APSTA;\r
+       else if (strstr(name_ptr, "_p2p"))\r
+               fw_type = FW_TYPE_P2P;\r
+       else if (strstr(name_ptr, "_mesh"))\r
+               fw_type = FW_TYPE_MESH;\r
+       else if (strstr(name_ptr, "_es"))\r
+               fw_type = FW_TYPE_ES;\r
+       else if (strstr(name_ptr, "_mfg"))\r
+               fw_type = FW_TYPE_MFG;\r
+       else if (strstr(name_ptr, "_minime"))\r
+               fw_type = FW_TYPE_MINIME;\r
+       else\r
+               fw_type = FW_TYPE_STA;\r
+\r
+       for (i = 0; i < sizeof(chip_name_map)/sizeof(chip_name_map[0]); i++) {\r
+               const cihp_name_map_t* row = &chip_name_map[i];\r
+               if (row->chip == chip && row->chiprev == chiprev &&\r
+                               (row->ag_type == ag_type || row->ag_type == DONT_CARE)) {\r
+                       strcpy(name_ptr, "fw_");\r
+                       strcat(fw_path, row->chip_name);\r
+#ifdef BCMUSBDEV_COMPOSITE\r
+                       strcat(fw_path, "_cusb");\r
+#endif\r
+                       if (fw_type == FW_TYPE_APSTA)\r
+                               strcat(fw_path, "_apsta.bin");\r
+                       else if (fw_type == FW_TYPE_P2P)\r
+                               strcat(fw_path, "_p2p.bin");\r
+                       else if (fw_type == FW_TYPE_MESH)\r
+                               strcat(fw_path, "_mesh.bin");\r
+                       else if (fw_type == FW_TYPE_ES)\r
+                               strcat(fw_path, "_es.bin");\r
+                       else if (fw_type == FW_TYPE_MFG)\r
+                               strcat(fw_path, "_mfg.bin");\r
+                       else if (fw_type == FW_TYPE_MINIME)\r
+                               strcat(fw_path, "_minime.bin");\r
+                       else\r
+                               strcat(fw_path, ".bin");\r
+               }\r
+       }\r
+\r
+       dhd->conf->fw_type = fw_type;\r
+\r
+#ifndef MINIME\r
+       if (fw_type == FW_TYPE_MINIME)\r
+               CONFIG_ERROR("***** Please enable MINIME in Makefile *****\n");\r
+#endif\r
+\r
+       CONFIG_TRACE("firmware_path=%s\n", fw_path);\r
+       return ag_type;\r
+}\r
+\r
+void\r
+dhd_conf_set_clm_name_by_chip(dhd_pub_t *dhd, char *clm_path, int ag_type)\r
+{\r
+       uint chip, chiprev;\r
+       int i;\r
+       char *name_ptr;\r
+\r
+       chip = dhd->conf->chip;\r
+       chiprev = dhd->conf->chiprev;\r
+\r
+       if (clm_path[0] == '\0') {\r
+               CONFIG_MSG("clm path is null\n");\r
+               return;\r
+       }\r
+\r
+       /* find out the last '/' */\r
+       i = strlen(clm_path);\r
+       while (i > 0) {\r
+               if (clm_path[i] == '/') {\r
+                       i++;\r
+                       break;\r
+               }\r
+               i--;\r
+       }\r
+       name_ptr = &clm_path[i];\r
+\r
+       for (i = 0; i < sizeof(chip_name_map)/sizeof(chip_name_map[0]); i++) {\r
+               const cihp_name_map_t* row = &chip_name_map[i];\r
+               if (row->chip == chip && row->chiprev == chiprev &&\r
+                               (row->ag_type == ag_type || row->ag_type == DONT_CARE)) {\r
+                       strcpy(name_ptr, "clm_");\r
+                       strcat(clm_path, row->chip_name);\r
+                       strcat(clm_path, ".blob");\r
+               }\r
+       }\r
+\r
+       CONFIG_TRACE("clm_path=%s\n", clm_path);\r
+}\r
+\r
+void\r
+dhd_conf_set_nv_name_by_chip(dhd_pub_t *dhd, char *nv_path, int ag_type)\r
+{\r
+       uint chip, chiprev;\r
+       int i;\r
+       char *name_ptr;\r
+\r
+       chip = dhd->conf->chip;\r
+       chiprev = dhd->conf->chiprev;\r
+\r
+       if (nv_path[0] == '\0') {\r
+#ifdef CONFIG_BCMDHD_NVRAM_PATH\r
+               bcm_strncpy_s(nv_path, MOD_PARAM_PATHLEN-1, CONFIG_BCMDHD_NVRAM_PATH, MOD_PARAM_PATHLEN-1);\r
+               if (nv_path[0] == '\0')\r
+#endif\r
+               {\r
+                       CONFIG_MSG("nvram path is null\n");\r
+                       return;\r
+               }\r
+       }\r
+\r
+       /* find out the last '/' */\r
+       i = strlen(nv_path);\r
+       while (i > 0) {\r
+               if (nv_path[i] == '/') {\r
+                       i++;\r
+                       break;\r
+               }\r
+               i--;\r
+       }\r
+       name_ptr = &nv_path[i];\r
+\r
+       for (i = 0; i < sizeof(chip_name_map)/sizeof(chip_name_map[0]); i++) {\r
+               const cihp_name_map_t* row = &chip_name_map[i];\r
+               if (row->chip == chip && row->chiprev == chiprev &&\r
+                               (row->ag_type == ag_type || row->ag_type == DONT_CARE)) {\r
+#ifdef GET_OTP_MODULE_NAME\r
+                       if (strlen(dhd->conf->module_name)) {\r
+                               strcpy(name_ptr, "nvram_");\r
+                               strcat(name_ptr, dhd->conf->module_name);\r
+                       } else\r
+#endif\r
+                       if (strlen(row->module_name)){\r
+                               strcpy(name_ptr, "nvram_");\r
+                               strcat(name_ptr, row->module_name);\r
+                       } else\r
+                               continue;\r
+#ifdef BCMUSBDEV_COMPOSITE\r
+                       strcat(name_ptr, "_cusb");\r
+#endif\r
+                       strcat(name_ptr, ".txt");\r
+               }\r
+       }\r
+\r
+       for (i=0; i<dhd->conf->nv_by_chip.count; i++) {\r
+               if (chip==dhd->conf->nv_by_chip.m_chip_nv_path_head[i].chip &&\r
+                               chiprev==dhd->conf->nv_by_chip.m_chip_nv_path_head[i].chiprev) {\r
+                       strcpy(name_ptr, dhd->conf->nv_by_chip.m_chip_nv_path_head[i].name);\r
+                       break;\r
+               }\r
+       }\r
+\r
+       CONFIG_TRACE("nvram_path=%s\n", nv_path);\r
+}\r
+\r
+void\r
+dhd_conf_copy_path(dhd_pub_t *dhd, char *dst_name, char *dst_path, char *src_path)\r
+{\r
+       int i;\r
+\r
+       if (src_path[0] == '\0') {\r
+               CONFIG_MSG("src_path is null\n");\r
+               return;\r
+       } else\r
+               strcpy(dst_path, src_path);\r
+\r
+       /* find out the last '/' */\r
+       i = strlen(dst_path);\r
+       while (i > 0) {\r
+               if (dst_path[i] == '/') {\r
+                       i++;\r
+                       break;\r
+               }\r
+               i--;\r
+       }\r
+       strcpy(&dst_path[i], dst_name);\r
+\r
+       CONFIG_TRACE("dst_path=%s\n", dst_path);\r
+}\r
+\r
+#ifdef CONFIG_PATH_AUTO_SELECT\r
+void\r
+dhd_conf_set_conf_name_by_chip(dhd_pub_t *dhd, char *conf_path)\r
+{\r
+       uint chip, chiprev;\r
+       int i;\r
+       char *name_ptr;\r
+\r
+       chip = dhd->conf->chip;\r
+       chiprev = dhd->conf->chiprev;\r
+\r
+       if (conf_path[0] == '\0') {\r
+               CONFIG_MSG("config path is null\n");\r
+               return;\r
+       }\r
+\r
+       /* find out the last '/' */\r
+       i = strlen(conf_path);\r
+       while (i > 0) {\r
+               if (conf_path[i] == '/') {\r
+                       i++;\r
+                       break;\r
+               }\r
+               i--;\r
+       }\r
+       name_ptr = &conf_path[i];\r
+\r
+       for (i = 0;  i < sizeof(chip_name_map)/sizeof(chip_name_map[0]);  i++) {\r
+               const cihp_name_map_t* row = &chip_name_map[i];\r
+               if (row->chip == chip && row->chiprev == chiprev) {\r
+                       strcpy(name_ptr, "config_");\r
+                       strcat(conf_path, row->chip_name);\r
+                       strcat(conf_path, ".txt");\r
+               }\r
+       }\r
+\r
+       CONFIG_TRACE("config_path=%s\n", conf_path);\r
+}\r
+#endif\r
+\r
+void\r
+dhd_conf_set_path_params(dhd_pub_t *dhd, char *fw_path, char *nv_path)\r
+{\r
+       int ag_type;\r
+\r
+       /* External conf takes precedence if specified */\r
+       dhd_conf_preinit(dhd);\r
+\r
+       if (dhd->conf_path[0] == '\0') {\r
+               dhd_conf_copy_path(dhd, "config.txt", dhd->conf_path, nv_path);\r
+       }\r
+       if (dhd->clm_path[0] == '\0') {\r
+               dhd_conf_copy_path(dhd, "clm.blob", dhd->clm_path, fw_path);\r
+       }\r
+#ifdef CONFIG_PATH_AUTO_SELECT\r
+       dhd_conf_set_conf_name_by_chip(dhd, dhd->conf_path);\r
+#endif\r
+\r
+       dhd_conf_read_config(dhd, dhd->conf_path);\r
+\r
+       ag_type = dhd_conf_set_fw_name_by_chip(dhd, fw_path);\r
+       dhd_conf_set_nv_name_by_chip(dhd, nv_path, ag_type);\r
+       dhd_conf_set_clm_name_by_chip(dhd, dhd->clm_path, ag_type);\r
+#ifdef BCMSDIO\r
+       dhd_conf_set_fw_name_by_mac(dhd, fw_path);\r
+       dhd_conf_set_nv_name_by_mac(dhd, nv_path);\r
+#endif\r
+\r
+       CONFIG_MSG("Final fw_path=%s\n", fw_path);\r
+       CONFIG_MSG("Final nv_path=%s\n", nv_path);\r
+       CONFIG_MSG("Final clm_path=%s\n", dhd->clm_path);\r
+       CONFIG_MSG("Final conf_path=%s\n", dhd->conf_path);\r
+}\r
+\r
+int\r
+dhd_conf_set_intiovar(dhd_pub_t *dhd, uint cmd, char *name, int val,\r
+       int def, bool down)\r
+{\r
+       int ret = -1;\r
+       char iovbuf[WL_EVENTING_MASK_LEN + 12]; /*  Room for "event_msgs" + '\0' + bitvec  */\r
+\r
+       if (val >= def) {\r
+               if (down) {\r
+                       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_DOWN, NULL, 0, TRUE, 0)) < 0)\r
+                               CONFIG_ERROR("WLC_DOWN setting failed %d\n", ret);\r
+               }\r
+               if (cmd == WLC_SET_VAR) {\r
+                       CONFIG_TRACE("set %s %d\n", name, val);\r
+                       bcm_mkiovar(name, (char *)&val, sizeof(val), iovbuf, sizeof(iovbuf));\r
+                       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)\r
+                               CONFIG_ERROR("%s setting failed %d\n", name, ret);\r
+               } else {\r
+                       CONFIG_TRACE("set %s %d %d\n", name, cmd, val);\r
+                       if ((ret = dhd_wl_ioctl_cmd(dhd, cmd, &val, sizeof(val), TRUE, 0)) < 0)\r
+                               CONFIG_ERROR("%s setting failed %d\n", name, ret);\r
+               }\r
+       }\r
+\r
+       return ret;\r
+}\r
+\r
+int\r
+dhd_conf_set_bufiovar(dhd_pub_t *dhd, int ifidx, uint cmd, char *name,\r
+       char *buf, int len, bool down)\r
+{\r
+       char iovbuf[WLC_IOCTL_SMLEN];\r
+       s32 iovar_len;\r
+       int ret = -1;\r
+\r
+       if (down) {\r
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_DOWN, NULL, 0, TRUE, ifidx)) < 0)\r
+                       CONFIG_ERROR("WLC_DOWN setting failed %d\n", ret);\r
+       }\r
+\r
+       if (cmd == WLC_SET_VAR) {\r
+               iovar_len = bcm_mkiovar(name, buf, len, iovbuf, sizeof(iovbuf));\r
+               if (iovar_len > 0)\r
+                       ret = dhd_wl_ioctl_cmd(dhd, cmd, iovbuf, iovar_len, TRUE, ifidx);\r
+               else\r
+                       ret = BCME_BUFTOOSHORT;\r
+               if (ret < 0)\r
+                       CONFIG_ERROR("%s setting failed %d, len=%d\n", name, ret, len);\r
+       } else {\r
+               if ((ret = dhd_wl_ioctl_cmd(dhd, cmd, buf, len, TRUE, ifidx)) < 0)\r
+                       CONFIG_ERROR("%s setting failed %d\n", name, ret);\r
+       }\r
+\r
+       return ret;\r
+}\r
+\r
+int\r
+dhd_conf_get_iovar(dhd_pub_t *dhd, int ifidx, int cmd, char *name,\r
+       char *buf, int len)\r
+{\r
+       char iovbuf[WLC_IOCTL_SMLEN];\r
+       int ret = -1;\r
+\r
+       if (cmd == WLC_GET_VAR) {\r
+               if (bcm_mkiovar(name, NULL, 0, iovbuf, sizeof(iovbuf))) {\r
+                       ret = dhd_wl_ioctl_cmd(dhd, cmd, iovbuf, sizeof(iovbuf), FALSE, ifidx);\r
+                       if (!ret) {\r
+                               memcpy(buf, iovbuf, len);\r
+                       } else {\r
+                               CONFIG_ERROR("get iovar %s failed %d\n", name, ret);\r
+                       }\r
+               } else {\r
+                       CONFIG_ERROR("mkiovar %s failed\n", name);\r
+               }\r
+       } else {\r
+               ret = dhd_wl_ioctl_cmd(dhd, cmd, buf, len, FALSE, 0);\r
+               if (ret < 0)\r
+                       CONFIG_ERROR("get iovar %s failed %d\n", name, ret);\r
+       }\r
+\r
+       return ret;\r
+}\r
+\r
+static int\r
+dhd_conf_rsdb_mode(dhd_pub_t *dhd, char *buf)\r
+{\r
+       wl_config_t rsdb_mode_cfg = {1, 0};\r
+\r
+       if (buf) {\r
+               rsdb_mode_cfg.config = (int)simple_strtol(buf, NULL, 0);\r
+               CONFIG_MSG("rsdb_mode %d\n", rsdb_mode_cfg.config);\r
+               dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "rsdb_mode", (char *)&rsdb_mode_cfg,\r
+                       sizeof(rsdb_mode_cfg), TRUE);\r
+       }\r
+\r
+       return 0;\r
+}\r
+\r
+typedef struct sub_cmd_t {\r
+       char *name;\r
+       uint16 id;              /* id for the dongle f/w switch/case  */\r
+       uint16 type;            /* base type of argument IOVT_XXXX */\r
+} sub_cmd_t;\r
+\r
+/* wl he sub cmd list */\r
+static const sub_cmd_t he_cmd_list[] = {\r
+       {"enab", WL_HE_CMD_ENAB, IOVT_UINT8},\r
+       {"features", WL_HE_CMD_FEATURES, IOVT_UINT32},\r
+       {"bsscolor", WL_HE_CMD_BSSCOLOR, IOVT_UINT8},\r
+       {"partialbsscolor", WL_HE_CMD_PARTIAL_BSSCOLOR, IOVT_UINT8},\r
+       {"cap", WL_HE_CMD_CAP, IOVT_UINT8},\r
+       {"staid", WL_HE_CMD_STAID, IOVT_UINT16},\r
+       {"rtsdurthresh", WL_HE_CMD_RTSDURTHRESH, IOVT_UINT16},\r
+       {"peduration", WL_HE_CMD_PEDURATION, IOVT_UINT8},\r
+       {"testbed_mode", WL_HE_CMD_TESTBED_MODE, IOVT_UINT32},\r
+       {"omi_ulmu_throttle", WL_HE_CMD_OMI_ULMU_THROTTLE, IOVT_UINT16},\r
+       {"omi_dlmu_rr_mpf_map", WL_HE_CMD_OMI_DLMU_RSD_RCM_MPF_MAP, IOVT_UINT32},\r
+       {"ulmu_disable_policy", WL_HE_CMD_ULMU_DISABLE_POLICY, IOVT_UINT8},\r
+       {"sr_prohibit", WL_HE_CMD_SR_PROHIBIT, IOVT_UINT8},\r
+};\r
+\r
+static uint\r
+wl_he_iovt2len(uint iovt)\r
+{\r
+       switch (iovt) {\r
+       case IOVT_BOOL:\r
+       case IOVT_INT8:\r
+       case IOVT_UINT8:\r
+               return sizeof(uint8);\r
+       case IOVT_INT16:\r
+       case IOVT_UINT16:\r
+               return sizeof(uint16);\r
+       case IOVT_INT32:\r
+       case IOVT_UINT32:\r
+               return sizeof(uint32);\r
+       default:\r
+               /* ASSERT(0); */\r
+               return 0;\r
+       }\r
+}\r
+\r
+static int\r
+dhd_conf_he_cmd(dhd_pub_t * dhd, char *buf)\r
+{\r
+       int ret = BCME_OK, i;\r
+       bcm_xtlv_t *pxtlv = NULL;\r
+       uint8 mybuf[128];\r
+       uint16 he_id = -1, he_len = 0, mybuf_len = sizeof(mybuf);\r
+       uint32 he_val;\r
+       const sub_cmd_t *tpl = he_cmd_list;\r
+       char sub_cmd[32], he_val_str[10];\r
+\r
+       if (buf) {\r
+               sscanf(buf, "%s %s", sub_cmd, he_val_str);\r
+       }\r
+\r
+       for (i=0; i<ARRAY_SIZE(he_cmd_list); i++, tpl++) {\r
+               if (!strcmp(tpl->name, sub_cmd)) {\r
+                       he_id = tpl->id;\r
+                       he_len = wl_he_iovt2len(tpl->type);\r
+                       break;\r
+               }\r
+       }\r
+       if (he_id < 0) {\r
+               CONFIG_ERROR("No he id found for %s\n", sub_cmd);\r
+               return 0;\r
+       }\r
+\r
+       pxtlv = (bcm_xtlv_t *)mybuf;\r
+\r
+       if (strlen(he_val_str)) {\r
+               he_val = simple_strtol(he_val_str, NULL, 0);\r
+               ret = bcm_pack_xtlv_entry((uint8**)&pxtlv, &mybuf_len, he_id,\r
+                       he_len, (uint8 *)&he_val, BCM_XTLV_OPTION_ALIGN32);\r
+               if (ret != BCME_OK) {\r
+                       CONFIG_ERROR("failed to pack he enab, err: %s\n", bcmerrorstr(ret));\r
+                       return 0;\r
+               }\r
+               CONFIG_MSG("he %s 0x%x\n", sub_cmd, he_val);\r
+               dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "he", (char *)&mybuf,\r
+                       sizeof(mybuf), TRUE);\r
+       }\r
+\r
+       return 0;\r
+}\r
+\r
+typedef int (tpl_parse_t)(dhd_pub_t *dhd, char *buf);\r
+\r
+typedef struct iovar_tpl_t {\r
+       int cmd;\r
+       char *name;\r
+       tpl_parse_t *parse;\r
+} iovar_tpl_t;\r
+\r
+const iovar_tpl_t iovar_tpl_list[] = {\r
+       {WLC_SET_VAR,   "rsdb_mode",    dhd_conf_rsdb_mode},\r
+       {WLC_SET_VAR,   "he",           dhd_conf_he_cmd},\r
+};\r
+\r
+static int iovar_tpl_parse(const iovar_tpl_t *tpl, int tpl_count,\r
+       dhd_pub_t *dhd, int cmd, char *name, char *buf)\r
+{\r
+       int i, ret = 0;\r
+\r
+       /* look for a matching code in the table */\r
+       for (i = 0; i < tpl_count; i++, tpl++) {\r
+               if (tpl->cmd == cmd && !strcmp(tpl->name, name))\r
+                       break;\r
+       }\r
+       if (i < tpl_count && tpl->parse) {\r
+               ret = tpl->parse(dhd, buf);\r
+       } else {\r
+               ret = -1;\r
+       }\r
+\r
+       return ret;\r
+}\r
+\r
+bool\r
+dhd_conf_set_wl_cmd(dhd_pub_t *dhd, char *data, bool down)\r
+{\r
+       int cmd, val, ret = 0, len;\r
+       char name[32], *pch, *pick_tmp, *pick_tmp2, *pdata = NULL;\r
+\r
+       /* Process wl_preinit:\r
+        * wl_preinit=[cmd]=[val], [cmd]=[val]\r
+        * Ex: wl_preinit=86=0, mpc=0\r
+        */\r
+\r
+       if (data == NULL)\r
+               return FALSE;\r
+\r
+       len = strlen(data);\r
+       pdata = kmalloc(len+1, GFP_KERNEL);\r
+       if (pdata == NULL) {\r
+               CONFIG_ERROR("Failed to allocate buffer of %d bytes\n", len+1);\r
+               goto exit;\r
+       }\r
+       memset(pdata, 0, len+1);\r
+       strcpy(pdata, data);\r
+\r
+       pick_tmp = pdata;\r
+       while (pick_tmp && (pick_tmp2 = bcmstrtok(&pick_tmp, ",", 0)) != NULL) {\r
+               pch = bcmstrtok(&pick_tmp2, "=", 0);\r
+               if (!pch)\r
+                       break;\r
+               if (*pch == ' ') {\r
+                       pch++;\r
+               }\r
+               memset(name, 0 , sizeof (name));\r
+               cmd = (int)simple_strtol(pch, NULL, 0);\r
+               if (cmd == 0) {\r
+                       cmd = WLC_SET_VAR;\r
+                       strcpy(name, pch);\r
+               }\r
+               pch = bcmstrtok(&pick_tmp2, ",", 0);\r
+               if (!pch) {\r
+                       break;\r
+               }\r
+               ret = iovar_tpl_parse(iovar_tpl_list, ARRAY_SIZE(iovar_tpl_list),\r
+                       dhd, cmd, name, pch);\r
+               if (ret) {\r
+                       val = (int)simple_strtol(pch, NULL, 0);\r
+                       dhd_conf_set_intiovar(dhd, cmd, name, val, -1, down);\r
+               }\r
+       }\r
+\r
+exit:\r
+       if (pdata)\r
+               kfree(pdata);\r
+       return true;\r
+}\r
+\r
+int\r
+dhd_conf_get_band(dhd_pub_t *dhd)\r
+{\r
+       int band = -1;\r
+\r
+       if (dhd && dhd->conf)\r
+               band = dhd->conf->band;\r
+       else\r
+               CONFIG_ERROR("dhd or conf is NULL\n");\r
+\r
+       return band;\r
+}\r
+\r
+int\r
+dhd_conf_get_country(dhd_pub_t *dhd, wl_country_t *cspec)\r
+{\r
+       int bcmerror = -1;\r
+\r
+       memset(cspec, 0, sizeof(wl_country_t));\r
+       bcm_mkiovar("country", NULL, 0, (char*)cspec, sizeof(wl_country_t));\r
+       if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, cspec, sizeof(wl_country_t),\r
+                       FALSE, 0)) < 0)\r
+               CONFIG_ERROR("country code getting failed %d\n", bcmerror);\r
+\r
+       return bcmerror;\r
+}\r
+\r
+int\r
+dhd_conf_map_country_list(dhd_pub_t *dhd, wl_country_t *cspec)\r
+{\r
+       int bcmerror = -1;\r
+       struct dhd_conf *conf = dhd->conf;\r
+       country_list_t *country = conf->country_head;\r
+\r
+#ifdef CCODE_LIST\r
+       bcmerror = dhd_ccode_map_country_list(dhd, cspec);\r
+#endif\r
+\r
+       while (country != NULL) {\r
+               if (!strncmp("**", country->cspec.country_abbrev, 2)) {\r
+                       memcpy(cspec->ccode, country->cspec.ccode, WLC_CNTRY_BUF_SZ);\r
+                       cspec->rev = country->cspec.rev;\r
+                       bcmerror = 0;\r
+                       break;\r
+               } else if (!strncmp(cspec->country_abbrev,\r
+                               country->cspec.country_abbrev, 2)) {\r
+                       memcpy(cspec->ccode, country->cspec.ccode, WLC_CNTRY_BUF_SZ);\r
+                       cspec->rev = country->cspec.rev;\r
+                       bcmerror = 0;\r
+                       break;\r
+               }\r
+               country = country->next;\r
+       }\r
+\r
+       if (!bcmerror)\r
+               CONFIG_MSG("%s/%d\n", cspec->ccode, cspec->rev);\r
+\r
+       return bcmerror;\r
+}\r
+\r
+int\r
+dhd_conf_set_country(dhd_pub_t *dhd, wl_country_t *cspec)\r
+{\r
+       int bcmerror = -1;\r
+\r
+       memset(&dhd->dhd_cspec, 0, sizeof(wl_country_t));\r
+\r
+       CONFIG_MSG("set country %s, revision %d\n", cspec->ccode, cspec->rev);\r
+       bcmerror = dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "country", (char *)cspec,\r
+               sizeof(wl_country_t), FALSE);\r
+       dhd_conf_get_country(dhd, cspec);\r
+       CONFIG_MSG("Country code: %s (%s/%d)\n",\r
+               cspec->country_abbrev, cspec->ccode, cspec->rev);\r
+\r
+       return bcmerror;\r
+}\r
+\r
+int\r
+dhd_conf_fix_country(dhd_pub_t *dhd)\r
+{\r
+       int bcmerror = -1;\r
+       int band;\r
+       wl_uint32_list_t *list;\r
+       u8 valid_chan_list[sizeof(u32)*(WL_NUMCHANNELS + 1)];\r
+       wl_country_t cspec;\r
+\r
+       if (!(dhd && dhd->conf)) {\r
+               return bcmerror;\r
+       }\r
+\r
+       memset(valid_chan_list, 0, sizeof(valid_chan_list));\r
+       list = (wl_uint32_list_t *)(void *) valid_chan_list;\r
+       list->count = htod32(WL_NUMCHANNELS);\r
+       if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_GET_VALID_CHANNELS, valid_chan_list,\r
+                       sizeof(valid_chan_list), FALSE, 0)) < 0) {\r
+               CONFIG_ERROR("get channels failed with %d\n", bcmerror);\r
+       }\r
+\r
+       band = dhd_conf_get_band(dhd);\r
+\r
+       if (bcmerror || ((band==WLC_BAND_AUTO || band==WLC_BAND_2G || band==-1) &&\r
+                       dtoh32(list->count)<11)) {\r
+               CONFIG_ERROR("bcmerror=%d, # of channels %d\n",\r
+                       bcmerror, dtoh32(list->count));\r
+               dhd_conf_map_country_list(dhd, &dhd->conf->cspec);\r
+               if ((bcmerror = dhd_conf_set_country(dhd, &dhd->conf->cspec)) < 0) {\r
+                       strcpy(cspec.country_abbrev, "US");\r
+                       cspec.rev = 0;\r
+                       strcpy(cspec.ccode, "US");\r
+                       dhd_conf_map_country_list(dhd, &cspec);\r
+                       dhd_conf_set_country(dhd, &cspec);\r
+               }\r
+       }\r
+\r
+       return bcmerror;\r
+}\r
+\r
+bool\r
+dhd_conf_match_channel(dhd_pub_t *dhd, uint32 channel)\r
+{\r
+       int i;\r
+       bool match = false;\r
+\r
+       if (dhd && dhd->conf) {\r
+               if (dhd->conf->channels.count == 0)\r
+                       return true;\r
+               for (i=0; i<dhd->conf->channels.count; i++) {\r
+                       if (channel == dhd->conf->channels.channel[i])\r
+                               match = true;\r
+               }\r
+       } else {\r
+               match = true;\r
+               CONFIG_ERROR("dhd or conf is NULL\n");\r
+       }\r
+\r
+       return match;\r
+}\r
+\r
+int\r
+dhd_conf_set_roam(dhd_pub_t *dhd)\r
+{\r
+       int bcmerror = -1;\r
+       struct dhd_conf *conf = dhd->conf;\r
+\r
+       dhd_roam_disable = conf->roam_off;\r
+       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "roam_off", dhd->conf->roam_off, 0, FALSE);\r
+\r
+       if (!conf->roam_off || !conf->roam_off_suspend) {\r
+               CONFIG_MSG("set roam_trigger %d\n", conf->roam_trigger[0]);\r
+               dhd_conf_set_bufiovar(dhd, 0, WLC_SET_ROAM_TRIGGER, "WLC_SET_ROAM_TRIGGER",\r
+                       (char *)conf->roam_trigger, sizeof(conf->roam_trigger), FALSE);\r
+\r
+               CONFIG_MSG("set roam_scan_period %d\n", conf->roam_scan_period[0]);\r
+               dhd_conf_set_bufiovar(dhd, 0, WLC_SET_ROAM_SCAN_PERIOD, "WLC_SET_ROAM_SCAN_PERIOD",\r
+                       (char *)conf->roam_scan_period, sizeof(conf->roam_scan_period), FALSE);\r
+\r
+               CONFIG_MSG("set roam_delta %d\n", conf->roam_delta[0]);\r
+               dhd_conf_set_bufiovar(dhd, 0, WLC_SET_ROAM_DELTA, "WLC_SET_ROAM_DELTA",\r
+                       (char *)conf->roam_delta, sizeof(conf->roam_delta), FALSE);\r
+\r
+               dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "fullroamperiod",\r
+                       dhd->conf->fullroamperiod, 1, FALSE);\r
+       }\r
+\r
+       return bcmerror;\r
+}\r
+\r
+void\r
+dhd_conf_add_to_eventbuffer(struct eventmsg_buf *ev, u16 event, bool set)\r
+{\r
+       if (!ev || (event > WLC_E_LAST))\r
+               return;\r
+\r
+       if (ev->num < MAX_EVENT_BUF_NUM) {\r
+               ev->event[ev->num].type = event;\r
+               ev->event[ev->num].set = set;\r
+               ev->num++;\r
+       } else {\r
+               CONFIG_ERROR("evenbuffer doesn't support > %u events. Update"\r
+                       " the define MAX_EVENT_BUF_NUM \n", MAX_EVENT_BUF_NUM);\r
+               ASSERT(0);\r
+       }\r
+}\r
+\r
+s32\r
+dhd_conf_apply_eventbuffer(dhd_pub_t *dhd, eventmsg_buf_t *ev)\r
+{\r
+       char eventmask[WL_EVENTING_MASK_LEN];\r
+       int i, ret = 0;\r
+\r
+       if (!ev || (!ev->num))\r
+               return -EINVAL;\r
+\r
+       /* Read event_msgs mask */\r
+       ret = dhd_conf_get_iovar(dhd, 0, WLC_GET_VAR, "event_msgs", eventmask,\r
+               sizeof(eventmask));\r
+       if (unlikely(ret)) {\r
+               CONFIG_ERROR("Get event_msgs error (%d)\n", ret);\r
+               goto exit;\r
+       }\r
+\r
+       /* apply the set bits */\r
+       for (i = 0; i < ev->num; i++) {\r
+               if (ev->event[i].set)\r
+                       setbit(eventmask, ev->event[i].type);\r
+               else\r
+                       clrbit(eventmask, ev->event[i].type);\r
+       }\r
+\r
+       /* Write updated Event mask */\r
+       ret = dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "event_msgs", eventmask,\r
+               sizeof(eventmask), FALSE);\r
+       if (unlikely(ret)) {\r
+               CONFIG_ERROR("Set event_msgs error (%d)\n", ret);\r
+       }\r
+\r
+exit:\r
+       return ret;\r
+}\r
+\r
+int\r
+dhd_conf_enable_roam_offload(dhd_pub_t *dhd, int enable)\r
+{\r
+       int err;\r
+       eventmsg_buf_t ev_buf;\r
+\r
+       if (dhd->conf->roam_off_suspend)\r
+               return 0;\r
+\r
+       err = dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "roam_offload", enable, 0, FALSE);\r
+       if (err)\r
+               return err;\r
+\r
+       bzero(&ev_buf, sizeof(eventmsg_buf_t));\r
+       dhd_conf_add_to_eventbuffer(&ev_buf, WLC_E_PSK_SUP, !enable);\r
+       dhd_conf_add_to_eventbuffer(&ev_buf, WLC_E_ASSOC_REQ_IE, !enable);\r
+       dhd_conf_add_to_eventbuffer(&ev_buf, WLC_E_ASSOC_RESP_IE, !enable);\r
+       dhd_conf_add_to_eventbuffer(&ev_buf, WLC_E_REASSOC, !enable);\r
+       dhd_conf_add_to_eventbuffer(&ev_buf, WLC_E_JOIN, !enable);\r
+       dhd_conf_add_to_eventbuffer(&ev_buf, WLC_E_ROAM, !enable);\r
+       err = dhd_conf_apply_eventbuffer(dhd, &ev_buf);\r
+\r
+       CONFIG_TRACE("roam_offload %d\n", enable);\r
+\r
+       return err;\r
+}\r
+\r
+void\r
+dhd_conf_set_bw_cap(dhd_pub_t *dhd)\r
+{\r
+       struct {\r
+               u32 band;\r
+               u32 bw_cap;\r
+       } param = {0, 0};\r
+\r
+       if (dhd->conf->bw_cap[0] >= 0) {\r
+               memset(&param, 0, sizeof(param));\r
+               param.band = WLC_BAND_2G;\r
+               param.bw_cap = (uint)dhd->conf->bw_cap[0];\r
+               CONFIG_MSG("set bw_cap 2g 0x%x\n", param.bw_cap);\r
+               dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "bw_cap", (char *)&param,\r
+                       sizeof(param), TRUE);\r
+       }\r
+\r
+       if (dhd->conf->bw_cap[1] >= 0) {\r
+               memset(&param, 0, sizeof(param));\r
+               param.band = WLC_BAND_5G;\r
+               param.bw_cap = (uint)dhd->conf->bw_cap[1];\r
+               CONFIG_MSG("set bw_cap 5g 0x%x\n", param.bw_cap);\r
+               dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "bw_cap", (char *)&param,\r
+                       sizeof(param), TRUE);\r
+       }\r
+}\r
+\r
+void\r
+dhd_conf_get_wme(dhd_pub_t *dhd, int ifidx, int mode, edcf_acparam_t *acp)\r
+{\r
+       int bcmerror = -1;\r
+       char iovbuf[WLC_IOCTL_SMLEN];\r
+       edcf_acparam_t *acparam;\r
+\r
+       bzero(iovbuf, sizeof(iovbuf));\r
+\r
+       /*\r
+        * Get current acparams, using buf as an input buffer.\r
+        * Return data is array of 4 ACs of wme params.\r
+        */\r
+       if (mode == 0)\r
+               bcm_mkiovar("wme_ac_sta", NULL, 0, iovbuf, sizeof(iovbuf));\r
+       else\r
+               bcm_mkiovar("wme_ac_ap", NULL, 0, iovbuf, sizeof(iovbuf));\r
+       if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf),\r
+                       FALSE, ifidx)) < 0) {\r
+               CONFIG_ERROR("wme_ac_sta getting failed %d\n", bcmerror);\r
+               return;\r
+       }\r
+       memcpy((char*)acp, iovbuf, sizeof(edcf_acparam_t)*AC_COUNT);\r
+\r
+       acparam = &acp[AC_BK];\r
+       CONFIG_TRACE("BK: aci %d aifsn %d ecwmin %d ecwmax %d txop 0x%x\n",\r
+               acparam->ACI, acparam->ACI&EDCF_AIFSN_MASK,\r
+               acparam->ECW&EDCF_ECWMIN_MASK, (acparam->ECW&EDCF_ECWMAX_MASK)>>EDCF_ECWMAX_SHIFT,\r
+               acparam->TXOP);\r
+       acparam = &acp[AC_BE];\r
+       CONFIG_TRACE("BE: aci %d aifsn %d ecwmin %d ecwmax %d txop 0x%x\n",\r
+               acparam->ACI, acparam->ACI&EDCF_AIFSN_MASK,\r
+               acparam->ECW&EDCF_ECWMIN_MASK, (acparam->ECW&EDCF_ECWMAX_MASK)>>EDCF_ECWMAX_SHIFT,\r
+               acparam->TXOP);\r
+       acparam = &acp[AC_VI];\r
+       CONFIG_TRACE("VI: aci %d aifsn %d ecwmin %d ecwmax %d txop 0x%x\n",\r
+               acparam->ACI, acparam->ACI&EDCF_AIFSN_MASK,\r
+               acparam->ECW&EDCF_ECWMIN_MASK, (acparam->ECW&EDCF_ECWMAX_MASK)>>EDCF_ECWMAX_SHIFT,\r
+               acparam->TXOP);\r
+       acparam = &acp[AC_VO];\r
+       CONFIG_TRACE("VO: aci %d aifsn %d ecwmin %d ecwmax %d txop 0x%x\n",\r
+               acparam->ACI, acparam->ACI&EDCF_AIFSN_MASK,\r
+               acparam->ECW&EDCF_ECWMIN_MASK, (acparam->ECW&EDCF_ECWMAX_MASK)>>EDCF_ECWMAX_SHIFT,\r
+               acparam->TXOP);\r
+\r
+       return;\r
+}\r
+\r
+void\r
+dhd_conf_update_wme(dhd_pub_t *dhd, int ifidx, int mode,\r
+       edcf_acparam_t *acparam_cur, int aci)\r
+{\r
+       int aifsn, ecwmin, ecwmax, txop;\r
+       edcf_acparam_t *acp;\r
+       struct dhd_conf *conf = dhd->conf;\r
+       wme_param_t *wme;\r
+\r
+       if (mode == 0)\r
+               wme = &conf->wme_sta;\r
+       else\r
+               wme = &conf->wme_ap;\r
+\r
+       /* Default value */\r
+       aifsn = acparam_cur->ACI&EDCF_AIFSN_MASK;\r
+       ecwmin = acparam_cur->ECW&EDCF_ECWMIN_MASK;\r
+       ecwmax = (acparam_cur->ECW&EDCF_ECWMAX_MASK)>>EDCF_ECWMAX_SHIFT;\r
+       txop = acparam_cur->TXOP;\r
+\r
+       /* Modified value */\r
+       if (wme->aifsn[aci] > 0)\r
+               aifsn = wme->aifsn[aci];\r
+       if (wme->ecwmin[aci] > 0)\r
+               ecwmin = wme->ecwmin[aci];\r
+       if (wme->ecwmax[aci] > 0)\r
+               ecwmax = wme->ecwmax[aci];\r
+       if (wme->txop[aci] > 0)\r
+               txop = wme->txop[aci];\r
+\r
+       if (!(wme->aifsn[aci] || wme->ecwmin[aci] ||\r
+                       wme->ecwmax[aci] || wme->txop[aci]))\r
+               return;\r
+\r
+       /* Update */\r
+       acp = acparam_cur;\r
+       acp->ACI = (acp->ACI & ~EDCF_AIFSN_MASK) | (aifsn & EDCF_AIFSN_MASK);\r
+       acp->ECW = ((ecwmax << EDCF_ECWMAX_SHIFT) & EDCF_ECWMAX_MASK) | (acp->ECW & EDCF_ECWMIN_MASK);\r
+       acp->ECW = ((acp->ECW & EDCF_ECWMAX_MASK) | (ecwmin & EDCF_ECWMIN_MASK));\r
+       acp->TXOP = txop;\r
+\r
+       CONFIG_MSG("wme_ac %s aci %d aifsn %d ecwmin %d ecwmax %d txop 0x%x\n",\r
+               mode?"ap":"sta", acp->ACI, acp->ACI&EDCF_AIFSN_MASK,\r
+               acp->ECW&EDCF_ECWMIN_MASK, (acp->ECW&EDCF_ECWMAX_MASK)>>EDCF_ECWMAX_SHIFT,\r
+               acp->TXOP);\r
+\r
+       /*\r
+       * Now use buf as an output buffer.\r
+       * Put WME acparams after "wme_ac\0" in buf.\r
+       * NOTE: only one of the four ACs can be set at a time.\r
+       */\r
+       if (mode == 0)\r
+               dhd_conf_set_bufiovar(dhd, ifidx, WLC_SET_VAR, "wme_ac_sta", (char *)acp,\r
+                       sizeof(edcf_acparam_t), FALSE);\r
+       else\r
+               dhd_conf_set_bufiovar(dhd, ifidx, WLC_SET_VAR, "wme_ac_ap", (char *)acp,\r
+                       sizeof(edcf_acparam_t), FALSE);\r
+\r
+}\r
+\r
+void\r
+dhd_conf_set_wme(dhd_pub_t *dhd, int ifidx, int mode)\r
+{\r
+       edcf_acparam_t acparam_cur[AC_COUNT];\r
+\r
+       if (dhd && dhd->conf) {\r
+               if (!dhd->conf->force_wme_ac) {\r
+                       CONFIG_TRACE("force_wme_ac is not enabled %d\n",\r
+                               dhd->conf->force_wme_ac);\r
+                       return;\r
+               }\r
+\r
+               CONFIG_TRACE("Before change:\n");\r
+               dhd_conf_get_wme(dhd, ifidx, mode, acparam_cur);\r
+\r
+               dhd_conf_update_wme(dhd, ifidx, mode, &acparam_cur[AC_BK], AC_BK);\r
+               dhd_conf_update_wme(dhd, ifidx, mode, &acparam_cur[AC_BE], AC_BE);\r
+               dhd_conf_update_wme(dhd, ifidx, mode, &acparam_cur[AC_VI], AC_VI);\r
+               dhd_conf_update_wme(dhd, ifidx, mode, &acparam_cur[AC_VO], AC_VO);\r
+\r
+               CONFIG_TRACE("After change:\n");\r
+               dhd_conf_get_wme(dhd, ifidx, mode, acparam_cur);\r
+       } else {\r
+               CONFIG_ERROR("dhd or conf is NULL\n");\r
+       }\r
+\r
+       return;\r
+}\r
+\r
+void\r
+dhd_conf_set_mchan_bw(dhd_pub_t *dhd, int p2p_mode, int miracast_mode)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+       mchan_params_t *mchan = conf->mchan;\r
+       bool set = true;\r
+\r
+       while (mchan != NULL) {\r
+               set = true;\r
+               set &= (mchan->bw >= 0);\r
+               set &= ((mchan->p2p_mode == -1) | (mchan->p2p_mode == p2p_mode));\r
+               set &= ((mchan->miracast_mode == -1) | (mchan->miracast_mode == miracast_mode));\r
+               if (set) {\r
+                       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "mchan_bw", mchan->bw, 0, FALSE);\r
+               }\r
+               mchan = mchan->next;\r
+       }\r
+\r
+       return;\r
+}\r
+\r
+#ifdef PKT_FILTER_SUPPORT\r
+void\r
+dhd_conf_add_pkt_filter(dhd_pub_t *dhd)\r
+{\r
+       int i, j;\r
+       char str[16];\r
+#define MACS "%02x%02x%02x%02x%02x%02x"\r
+\r
+       /*\r
+        * Filter in less pkt: ARP(0x0806, ID is 105), BRCM(0x886C), 802.1X(0x888E)\r
+        *   1) dhd_master_mode=1\r
+        *   2) pkt_filter_delete=100, 102, 103, 104, 105, 106, 107\r
+        *   3) pkt_filter_add=131 0 0 12 0xFFFF 0x886C, 132 0 0 12 0xFFFF 0x888E\r
+        *   4) magic_pkt_filter_add=141 0 1 12\r
+        */\r
+       for(i=0; i<dhd->conf->pkt_filter_add.count; i++) {\r
+               dhd->pktfilter[i+dhd->pktfilter_count] = dhd->conf->pkt_filter_add.filter[i];\r
+               CONFIG_MSG("%s\n", dhd->pktfilter[i+dhd->pktfilter_count]);\r
+       }\r
+       dhd->pktfilter_count += i;\r
+\r
+       if (dhd->conf->magic_pkt_filter_add) {\r
+               strcat(dhd->conf->magic_pkt_filter_add, " 0x");\r
+               strcat(dhd->conf->magic_pkt_filter_add, "FFFFFFFFFFFF");\r
+               for (j=0; j<16; j++)\r
+                       strcat(dhd->conf->magic_pkt_filter_add, "FFFFFFFFFFFF");\r
+               strcat(dhd->conf->magic_pkt_filter_add, " 0x");\r
+               strcat(dhd->conf->magic_pkt_filter_add, "FFFFFFFFFFFF");\r
+               sprintf(str, MACS, MAC2STRDBG(dhd->mac.octet));\r
+               for (j=0; j<16; j++)\r
+                       strncat(dhd->conf->magic_pkt_filter_add, str, 12);\r
+               dhd->pktfilter[dhd->pktfilter_count] = dhd->conf->magic_pkt_filter_add;\r
+               dhd->pktfilter_count += 1;\r
+       }\r
+}\r
+\r
+bool\r
+dhd_conf_del_pkt_filter(dhd_pub_t *dhd, uint32 id)\r
+{\r
+       int i;\r
+\r
+       if (dhd && dhd->conf) {\r
+               for (i=0; i<dhd->conf->pkt_filter_del.count; i++) {\r
+                       if (id == dhd->conf->pkt_filter_del.id[i]) {\r
+                               CONFIG_MSG("%d\n", dhd->conf->pkt_filter_del.id[i]);\r
+                               return true;\r
+                       }\r
+               }\r
+               return false;\r
+       }\r
+       return false;\r
+}\r
+\r
+void\r
+dhd_conf_discard_pkt_filter(dhd_pub_t *dhd)\r
+{\r
+       dhd->pktfilter_count = 6;\r
+       dhd->pktfilter[DHD_UNICAST_FILTER_NUM] = NULL;\r
+       dhd->pktfilter[DHD_BROADCAST_FILTER_NUM] = "101 0 0 0 0xFFFFFFFFFFFF 0xFFFFFFFFFFFF";\r
+       dhd->pktfilter[DHD_MULTICAST4_FILTER_NUM] = "102 0 0 0 0xFFFFFF 0x01005E";\r
+       dhd->pktfilter[DHD_MULTICAST6_FILTER_NUM] = "103 0 0 0 0xFFFF 0x3333";\r
+       dhd->pktfilter[DHD_MDNS_FILTER_NUM] = NULL;\r
+       /* Do not enable ARP to pkt filter if dhd_master_mode is false.*/\r
+       dhd->pktfilter[DHD_ARP_FILTER_NUM] = NULL;\r
+\r
+       /* IPv4 broadcast address XXX.XXX.XXX.255 */\r
+       dhd->pktfilter[dhd->pktfilter_count] = "110 0 0 12 0xFFFF00000000000000000000000000000000000000FF 0x080000000000000000000000000000000000000000FF";\r
+       dhd->pktfilter_count++;\r
+       /* discard IPv4 multicast address 224.0.0.0/4 */\r
+       dhd->pktfilter[dhd->pktfilter_count] = "111 0 0 12 0xFFFF00000000000000000000000000000000F0 0x080000000000000000000000000000000000E0";\r
+       dhd->pktfilter_count++;\r
+       /* discard IPv6 multicast address FF00::/8 */\r
+       dhd->pktfilter[dhd->pktfilter_count] = "112 0 0 12 0xFFFF000000000000000000000000000000000000000000000000FF 0x86DD000000000000000000000000000000000000000000000000FF";\r
+       dhd->pktfilter_count++;\r
+       /* discard Netbios pkt */\r
+       dhd->pktfilter[dhd->pktfilter_count] = "121 0 0 12 0xFFFF000000000000000000FF000000000000000000000000FFFF 0x0800000000000000000000110000000000000000000000000089";\r
+       dhd->pktfilter_count++;\r
+\r
+}\r
+#endif /* PKT_FILTER_SUPPORT */\r
+\r
+int\r
+dhd_conf_get_pm(dhd_pub_t *dhd)\r
+{\r
+       if (dhd && dhd->conf) {\r
+               return dhd->conf->pm;\r
+       }\r
+       return -1;\r
+}\r
+\r
+int\r
+dhd_conf_check_hostsleep(dhd_pub_t *dhd, int cmd, void *buf, int len,\r
+       int *hostsleep_set, int *hostsleep_val, int *ret)\r
+{\r
+       if (dhd->conf->insuspend & (NO_TXCTL_IN_SUSPEND | WOWL_IN_SUSPEND)) {\r
+               if (cmd == WLC_SET_VAR) {\r
+                       char *psleep = NULL;\r
+                       psleep = strstr(buf, "hostsleep");\r
+                       if (psleep) {\r
+                               *hostsleep_set = 1;\r
+                               memcpy(hostsleep_val, psleep+strlen("hostsleep")+1, sizeof(int));\r
+                       }\r
+               }\r
+               if (dhd->hostsleep && (!*hostsleep_set || *hostsleep_val)) {\r
+                       CONFIG_TRACE("block all none hostsleep clr cmd\n");\r
+                       *ret = BCME_EPERM;\r
+                       goto exit;\r
+               } else if (*hostsleep_set && *hostsleep_val) {\r
+                       CONFIG_TRACE("hostsleep %d => %d\n", dhd->hostsleep, *hostsleep_val);\r
+                       dhd->hostsleep = *hostsleep_val;\r
+                       if (dhd->conf->insuspend & NO_TXDATA_IN_SUSPEND) {\r
+                               dhd_txflowcontrol(dhd, ALL_INTERFACES, ON);\r
+                       }\r
+                       if (dhd->hostsleep == 2) {\r
+                               *ret = 0;\r
+                               goto exit;\r
+                       }\r
+               } else if (dhd->hostsleep == 2 && !*hostsleep_val) {\r
+                       CONFIG_TRACE("hostsleep %d => %d\n", dhd->hostsleep, *hostsleep_val);\r
+                       dhd->hostsleep = *hostsleep_val;\r
+                       if (dhd->conf->insuspend & NO_TXDATA_IN_SUSPEND) {\r
+                               dhd_txflowcontrol(dhd, ALL_INTERFACES, OFF);\r
+                       }\r
+                       *ret = 0;\r
+                       goto exit;\r
+               }\r
+       }\r
+#ifdef NO_POWER_SAVE\r
+       if (cmd == WLC_SET_PM) {\r
+               if (*(const u32*)buf != 0) {\r
+                       CONFIG_TRACE("skip PM\n");\r
+                       *ret = BCME_OK;\r
+                       goto exit;\r
+               }\r
+       } else if (cmd == WLC_SET_VAR) {\r
+               int cmd_len = strlen("mpc");\r
+               if (!strncmp(buf, "mpc", cmd_len)) {\r
+                       if (*((u32 *)((u8*)buf+cmd_len+1)) != 0) {\r
+                               CONFIG_TRACE("skip mpc\n");\r
+                               *ret = BCME_OK;\r
+                               goto exit;\r
+                       }\r
+               }\r
+       }\r
+#endif\r
+\r
+       return 0;\r
+exit:\r
+       return -1;\r
+}\r
+\r
+void\r
+dhd_conf_get_hostsleep(dhd_pub_t *dhd,\r
+       int hostsleep_set, int hostsleep_val, int ret)\r
+{\r
+       if (dhd->conf->insuspend & (NO_TXCTL_IN_SUSPEND | WOWL_IN_SUSPEND)) {\r
+               if (hostsleep_set) {\r
+                       if (hostsleep_val && ret) {\r
+                               CONFIG_TRACE("reset hostsleep %d => 0\n", dhd->hostsleep);\r
+                               dhd->hostsleep = 0;\r
+                               if (dhd->conf->insuspend & NO_TXDATA_IN_SUSPEND) {\r
+                                       dhd_txflowcontrol(dhd, ALL_INTERFACES, OFF);\r
+                               }\r
+                       } else if (!hostsleep_val && !ret) {\r
+                               CONFIG_TRACE("set hostsleep %d => 0\n", dhd->hostsleep);\r
+                               dhd->hostsleep = 0;\r
+                               if (dhd->conf->insuspend & NO_TXDATA_IN_SUSPEND) {\r
+                                       dhd_txflowcontrol(dhd, ALL_INTERFACES, OFF);\r
+                               }\r
+                       }\r
+               }\r
+       }\r
+}\r
+\r
+#ifdef WL_EXT_WOWL\r
+#define WL_WOWL_TCPFIN (1 << 26)\r
+typedef struct wl_wowl_pattern2 {\r
+       char cmd[4];\r
+       wl_wowl_pattern_t wowl_pattern;\r
+} wl_wowl_pattern2_t;\r
+static int\r
+dhd_conf_wowl_pattern(dhd_pub_t *dhd, bool add, char *data)\r
+{\r
+       uint buf_len = 0;\r
+       int     id, type, polarity, offset;\r
+       char cmd[4]="\0", mask[128]="\0", pattern[128]="\0", mask_tmp[128]="\0", *pmask_tmp;\r
+       uint32 masksize, patternsize, pad_len = 0;\r
+       wl_wowl_pattern2_t *wowl_pattern2 = NULL;\r
+       char *mask_and_pattern;\r
+       int ret = 0, i, j, v;\r
+\r
+       if (data) {\r
+               if (add)\r
+                       strcpy(cmd, "add");\r
+               else\r
+                       strcpy(cmd, "clr");\r
+               if (!strcmp(cmd, "clr")) {\r
+                       CONFIG_TRACE("wowl_pattern clr\n");\r
+                       ret = dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "wowl_pattern", cmd,\r
+                               sizeof(cmd), FALSE);\r
+                       goto exit;\r
+               }\r
+               sscanf(data, "%d %d %d %d %s %s", &id, &type, &polarity, &offset,\r
+                       mask_tmp, pattern);\r
+               masksize = strlen(mask_tmp) -2;\r
+               CONFIG_TRACE("0 mask_tmp=%s, masksize=%d\n", mask_tmp, masksize);\r
+\r
+               // add pading\r
+               if (masksize % 16)\r
+                       pad_len = (16 - masksize % 16);\r
+               for (i=0; i<pad_len; i++)\r
+                       strcat(mask_tmp, "0");\r
+               masksize += pad_len;\r
+               CONFIG_TRACE("1 mask_tmp=%s, masksize=%d\n", mask_tmp, masksize);\r
+\r
+               // translate 0x00 to 0, others to 1\r
+               j = 0;\r
+               pmask_tmp = &mask_tmp[2];\r
+               for (i=0; i<masksize/2; i++) {\r
+                       if(strncmp(&pmask_tmp[i*2], "00", 2))\r
+                               pmask_tmp[j] = '1';\r
+                       else\r
+                               pmask_tmp[j] = '0';\r
+                       j++;\r
+               }\r
+               pmask_tmp[j] = '\0';\r
+               masksize = masksize / 2;\r
+               CONFIG_TRACE("2 mask_tmp=%s, masksize=%d\n", mask_tmp, masksize);\r
+\r
+               // reorder per 8bits\r
+               pmask_tmp = &mask_tmp[2];\r
+               for (i=0; i<masksize/8; i++) {\r
+                       char c;\r
+                       for (j=0; j<4; j++) {\r
+                               c = pmask_tmp[i*8+j];\r
+                               pmask_tmp[i*8+j] = pmask_tmp[(i+1)*8-j-1];\r
+                               pmask_tmp[(i+1)*8-j-1] = c;\r
+                       }\r
+               }\r
+               CONFIG_TRACE("3 mask_tmp=%s, masksize=%d\n", mask_tmp, masksize);\r
+\r
+               // translate 8bits to 1byte\r
+               j = 0; v = 0;\r
+               pmask_tmp = &mask_tmp[2];\r
+               strcpy(mask, "0x");\r
+               for (i=0; i<masksize; i++) {\r
+                       v = (v<<1) | (pmask_tmp[i]=='1');\r
+                       if (((i+1)%4) == 0) {\r
+                               if (v < 10)\r
+                                       mask[j+2] = v + '0';\r
+                               else\r
+                                       mask[j+2] = (v-10) + 'a';\r
+                               j++;\r
+                               v = 0;\r
+                       }\r
+               }\r
+               mask[j+2] = '\0';\r
+               masksize = j/2;\r
+               CONFIG_TRACE("4 mask=%s, masksize=%d\n", mask, masksize);\r
+\r
+               patternsize = (strlen(pattern)-2)/2;\r
+               buf_len = sizeof(wl_wowl_pattern2_t) + patternsize + masksize;\r
+               wowl_pattern2 = kmalloc(buf_len, GFP_KERNEL);\r
+               if (wowl_pattern2 == NULL) {\r
+                       CONFIG_ERROR("Failed to allocate buffer of %d bytes\n", buf_len);\r
+                       goto exit;\r
+               }\r
+               memset(wowl_pattern2, 0, sizeof(wl_wowl_pattern2_t));\r
+\r
+               strncpy(wowl_pattern2->cmd, cmd, sizeof(cmd));\r
+               wowl_pattern2->wowl_pattern.id = id;\r
+               wowl_pattern2->wowl_pattern.type = 0;\r
+               wowl_pattern2->wowl_pattern.offset = offset;\r
+               mask_and_pattern = (char*)wowl_pattern2 + sizeof(wl_wowl_pattern2_t);\r
+\r
+               wowl_pattern2->wowl_pattern.masksize = masksize;\r
+               ret = wl_pattern_atoh(mask, mask_and_pattern);\r
+               if (ret == -1) {\r
+                       CONFIG_ERROR("rejecting mask=%s\n", mask);\r
+                       goto exit;\r
+               }\r
+\r
+               mask_and_pattern += wowl_pattern2->wowl_pattern.masksize;\r
+               wowl_pattern2->wowl_pattern.patternoffset = sizeof(wl_wowl_pattern_t) +\r
+                       wowl_pattern2->wowl_pattern.masksize;\r
+\r
+               wowl_pattern2->wowl_pattern.patternsize = patternsize;\r
+               ret = wl_pattern_atoh(pattern, mask_and_pattern);\r
+               if (ret == -1) {\r
+                       CONFIG_ERROR("rejecting pattern=%s\n", pattern);\r
+                       goto exit;\r
+               }\r
+\r
+               CONFIG_TRACE("%s %d %s %s\n", cmd, offset, mask, pattern);\r
+\r
+               ret = dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "wowl_pattern",\r
+                       (char *)wowl_pattern2, buf_len, FALSE);\r
+       }\r
+\r
+exit:\r
+       if (wowl_pattern2)\r
+               kfree(wowl_pattern2);\r
+       return ret;\r
+}\r
+\r
+static int\r
+dhd_conf_wowl_wakeind(dhd_pub_t *dhd, bool clear)\r
+{\r
+       s8 iovar_buf[WLC_IOCTL_SMLEN];\r
+       wl_wowl_wakeind_t *wake = NULL;\r
+       int ret = -1;\r
+       char clr[6]="clear", wakeind_str[32]="\0";\r
+\r
+       if (clear) {\r
+               CONFIG_TRACE("wowl_wakeind clear\n");\r
+               ret = dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "wowl_wakeind",\r
+                       clr, sizeof(clr), 0);\r
+       } else {\r
+               ret = dhd_conf_get_iovar(dhd, 0, WLC_GET_VAR, "wowl_wakeind",\r
+                       iovar_buf, sizeof(iovar_buf));\r
+               if (!ret) {\r
+                       wake = (wl_wowl_wakeind_t *) iovar_buf;\r
+                       if (wake->ucode_wakeind & WL_WOWL_MAGIC)\r
+                               strcpy(wakeind_str, "(MAGIC packet)");\r
+                       if (wake->ucode_wakeind & WL_WOWL_NET)\r
+                               strcpy(wakeind_str, "(Netpattern)");\r
+                       if (wake->ucode_wakeind & WL_WOWL_DIS)\r
+                               strcpy(wakeind_str, "(Disassoc/Deauth)");\r
+                       if (wake->ucode_wakeind & WL_WOWL_BCN)\r
+                               strcpy(wakeind_str, "(Loss of beacon)");\r
+                       if (wake->ucode_wakeind & WL_WOWL_TCPKEEP_TIME)\r
+                               strcpy(wakeind_str, "(TCPKA timeout)");\r
+                       if (wake->ucode_wakeind & WL_WOWL_TCPKEEP_DATA)\r
+                               strcpy(wakeind_str, "(TCPKA data)");\r
+                       if (wake->ucode_wakeind & WL_WOWL_TCPFIN)\r
+                               strcpy(wakeind_str, "(TCP FIN)");\r
+                       CONFIG_MSG("wakeind=0x%x %s\n", wake->ucode_wakeind, wakeind_str);\r
+               }\r
+       }\r
+\r
+       return ret;\r
+}\r
+#endif\r
+\r
+int\r
+dhd_conf_mkeep_alive(dhd_pub_t *dhd, int ifidx, int id, int period,\r
+       char *packet, bool bcast)\r
+{\r
+       wl_mkeep_alive_pkt_t *mkeep_alive_pktp;\r
+       int ret = 0, len_bytes=0, buf_len=0;\r
+       char *buf = NULL, *iovar_buf = NULL;\r
+       uint8 *pdata;\r
+\r
+       CONFIG_TRACE("id=%d, period=%d, packet=%s\n", id, period, packet);\r
+       if (period >= 0) {\r
+               buf = kmalloc(WLC_IOCTL_SMLEN, GFP_KERNEL);\r
+               if (buf == NULL) {\r
+                       CONFIG_ERROR("Failed to allocate buffer of %d bytes\n", WLC_IOCTL_SMLEN);\r
+                       goto exit;\r
+               }\r
+               iovar_buf = kmalloc(WLC_IOCTL_SMLEN, GFP_KERNEL);\r
+               if (iovar_buf == NULL) {\r
+                       CONFIG_ERROR("Failed to allocate buffer of %d bytes\n", WLC_IOCTL_SMLEN);\r
+                       goto exit;\r
+               }\r
+               mkeep_alive_pktp = (wl_mkeep_alive_pkt_t *)buf;\r
+               mkeep_alive_pktp->version = htod16(WL_MKEEP_ALIVE_VERSION);\r
+               mkeep_alive_pktp->length = htod16(WL_MKEEP_ALIVE_FIXED_LEN);\r
+               mkeep_alive_pktp->keep_alive_id = id;\r
+               buf_len += WL_MKEEP_ALIVE_FIXED_LEN;\r
+               mkeep_alive_pktp->period_msec = period;\r
+               if (packet && strlen(packet)) {\r
+                       len_bytes = wl_pattern_atoh(packet, (char *)mkeep_alive_pktp->data);\r
+                       buf_len += len_bytes;\r
+                       if (bcast) {\r
+                               memcpy(mkeep_alive_pktp->data, &ether_bcast, ETHER_ADDR_LEN);\r
+                       }\r
+                       ret = dhd_conf_get_iovar(dhd, ifidx, WLC_GET_VAR, "cur_etheraddr",\r
+                               iovar_buf, WLC_IOCTL_SMLEN);\r
+                       if (!ret) {\r
+                               pdata = mkeep_alive_pktp->data;\r
+                               memcpy(pdata+6, iovar_buf, ETHER_ADDR_LEN);\r
+                       }\r
+               }\r
+               mkeep_alive_pktp->len_bytes = htod16(len_bytes);\r
+               ret = dhd_conf_set_bufiovar(dhd, ifidx, WLC_SET_VAR, "mkeep_alive",\r
+                       buf, buf_len, FALSE);\r
+       }\r
+\r
+exit:\r
+       if (buf)\r
+               kfree(buf);\r
+       if (iovar_buf)\r
+               kfree(iovar_buf);\r
+       return ret;\r
+}\r
+\r
+#ifdef ARP_OFFLOAD_SUPPORT\r
+void\r
+dhd_conf_set_garp(dhd_pub_t *dhd, int ifidx, uint32 ipa, bool enable)\r
+{\r
+       int i, len = 0, total_len = WLC_IOCTL_SMLEN;\r
+       char *iovar_buf = NULL, *packet = NULL;\r
+\r
+       if (!dhd->conf->garp || ifidx != 0 || !(dhd->op_mode & DHD_FLAG_STA_MODE))\r
+               return;\r
+\r
+       CONFIG_TRACE("enable=%d\n", enable);\r
+\r
+       if (enable) {\r
+               iovar_buf = kmalloc(total_len, GFP_KERNEL);\r
+               if (iovar_buf == NULL) {\r
+                       CONFIG_ERROR("Failed to allocate buffer of %d bytes\n", total_len);\r
+                       goto exit;\r
+               }\r
+               packet = kmalloc(total_len, GFP_KERNEL);\r
+               if (packet == NULL) {\r
+                       CONFIG_ERROR("Failed to allocate buffer of %d bytes\n", total_len);\r
+                       goto exit;\r
+               }\r
+               dhd_conf_get_iovar(dhd, ifidx, WLC_GET_VAR, "cur_etheraddr", iovar_buf, total_len);\r
+\r
+               len += snprintf(packet+len, total_len, "0xffffffffffff");\r
+               for (i=0; i<ETHER_ADDR_LEN; i++)\r
+                       len += snprintf(packet+len, total_len, "%02x", iovar_buf[i]);\r
+               len += snprintf(packet+len, total_len, "08060001080006040001");\r
+                // Sender Hardware Addr.\r
+               for (i=0; i<ETHER_ADDR_LEN; i++)\r
+                       len += snprintf(packet+len, total_len, "%02x", iovar_buf[i]);\r
+                // Sender IP Addr.\r
+               len += snprintf(packet+len, total_len, "%02x%02x%02x%02x",\r
+                       ipa&0xff, (ipa>>8)&0xff, (ipa>>16)&0xff, (ipa>>24)&0xff);\r
+                // Target Hardware Addr.\r
+               len += snprintf(packet+len, total_len, "ffffffffffff");\r
+                // Target IP Addr.\r
+               len += snprintf(packet+len, total_len, "%02x%02x%02x%02x",\r
+                       ipa&0xff, (ipa>>8)&0xff, (ipa>>16)&0xff, (ipa>>24)&0xff);\r
+               len += snprintf(packet+len, total_len, "000000000000000000000000000000000000");\r
+       }\r
+\r
+       dhd_conf_mkeep_alive(dhd, ifidx, 0, dhd->conf->keep_alive_period, packet, TRUE);\r
+\r
+exit:\r
+       if (iovar_buf)\r
+               kfree(iovar_buf);\r
+       if (packet)\r
+               kfree(packet);\r
+       return;\r
+}\r
+#endif\r
+\r
+uint\r
+dhd_conf_get_insuspend(dhd_pub_t *dhd, uint mask)\r
+{\r
+       uint insuspend = 0;\r
+\r
+       if (dhd->op_mode & DHD_FLAG_STA_MODE) {\r
+               insuspend = dhd->conf->insuspend &\r
+                       (NO_EVENT_IN_SUSPEND | NO_TXDATA_IN_SUSPEND | NO_TXCTL_IN_SUSPEND |\r
+                       ROAM_OFFLOAD_IN_SUSPEND | WOWL_IN_SUSPEND);\r
+       } else if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {\r
+               insuspend = dhd->conf->insuspend &\r
+                       (NO_EVENT_IN_SUSPEND | NO_TXDATA_IN_SUSPEND | NO_TXCTL_IN_SUSPEND |\r
+                       AP_DOWN_IN_SUSPEND | AP_FILTER_IN_SUSPEND);\r
+       }\r
+\r
+       return (insuspend & mask);\r
+}\r
+\r
+#ifdef SUSPEND_EVENT\r
+void\r
+dhd_conf_set_suspend_event(dhd_pub_t *dhd, int suspend)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+       struct ether_addr bssid;\r
+       char suspend_eventmask[WL_EVENTING_MASK_LEN];\r
+       wl_event_msg_t msg;\r
+       int pm;\r
+#ifdef WL_CFG80211\r
+       struct net_device *net;\r
+#endif /* defined(WL_CFG80211) */\r
+\r
+       CONFIG_TRACE("Enter\n");\r
+       if (suspend) {\r
+#ifdef PROP_TXSTATUS\r
+#if defined(BCMSDIO) || defined(BCMDBUS)\r
+               if (dhd->wlfc_enabled) {\r
+                       dhd_wlfc_deinit(dhd);\r
+                       conf->wlfc = TRUE;\r
+               } else {\r
+                       conf->wlfc = FALSE;\r
+               }\r
+#endif /* BCMSDIO || BCMDBUS */\r
+#endif /* PROP_TXSTATUS */\r
+               dhd_conf_get_iovar(dhd, 0, WLC_GET_VAR, "event_msgs",\r
+                       conf->resume_eventmask, sizeof(conf->resume_eventmask));\r
+               memset(suspend_eventmask, 0, sizeof(suspend_eventmask));\r
+               setbit(suspend_eventmask, WLC_E_ESCAN_RESULT);\r
+               dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "event_msgs",\r
+                       suspend_eventmask, sizeof(suspend_eventmask), FALSE);\r
+               if (dhd->op_mode & DHD_FLAG_STA_MODE) {\r
+                       memset(&bssid, 0, ETHER_ADDR_LEN);\r
+                       dhd_wl_ioctl_cmd(dhd, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN, FALSE, 0);\r
+                       if (memcmp(&ether_null, &bssid, ETHER_ADDR_LEN))\r
+                               memcpy(&conf->bssid_insuspend, &bssid, ETHER_ADDR_LEN);\r
+                       else\r
+                               memset(&conf->bssid_insuspend, 0, ETHER_ADDR_LEN);\r
+               }\r
+       }\r
+       else {\r
+               dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "event_msgs",\r
+                       conf->resume_eventmask, sizeof(conf->resume_eventmask), FALSE);\r
+               if (dhd->op_mode & DHD_FLAG_STA_MODE) {\r
+                       if (memcmp(&ether_null, &conf->bssid_insuspend, ETHER_ADDR_LEN)) {\r
+                               memset(&bssid, 0, ETHER_ADDR_LEN);\r
+                               dhd_wl_ioctl_cmd(dhd, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN,\r
+                                       FALSE, 0);\r
+                               if (memcmp(&ether_null, &bssid, ETHER_ADDR_LEN)) {\r
+                                       dhd_conf_set_intiovar(dhd, WLC_SET_PM, "WLC_SET_PM", 0, 0, FALSE);\r
+                                       dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "send_nulldata",\r
+                                               (char *)&bssid, ETHER_ADDR_LEN, FALSE);\r
+                                       OSL_SLEEP(100);\r
+                                       if (conf->pm >= 0)\r
+                                               pm = conf->pm;\r
+                                       else\r
+                                               pm = PM_FAST;\r
+                                       dhd_conf_set_intiovar(dhd, WLC_SET_PM, "WLC_SET_PM", pm, 0, FALSE);\r
+                               } else {\r
+                                       CONFIG_TRACE("send WLC_E_DEAUTH_IND event\n");\r
+                                       bzero(&msg, sizeof(wl_event_msg_t));\r
+                                       memcpy(&msg.addr, &conf->bssid_insuspend, ETHER_ADDR_LEN);\r
+                                       msg.event_type = hton32(WLC_E_DEAUTH_IND);\r
+                                       msg.status = 0;\r
+                                       msg.reason = hton32(DOT11_RC_DEAUTH_LEAVING);\r
+#if defined(WL_EXT_IAPSTA) || defined(USE_IW)\r
+                                       wl_ext_event_send(dhd->event_params, &msg, NULL);\r
+#endif\r
+#ifdef WL_CFG80211\r
+                                       net = dhd_idx2net(dhd, 0);\r
+                                       if (net) {\r
+                                               wl_cfg80211_event(net, &msg, NULL);\r
+                                       }\r
+#endif /* defined(WL_CFG80211) */\r
+                               }\r
+                       }\r
+#ifdef PROP_TXSTATUS\r
+#if defined(BCMSDIO) || defined(BCMDBUS)\r
+                       if (conf->wlfc) {\r
+                               dhd_wlfc_init(dhd);\r
+                               dhd_conf_set_intiovar(dhd, WLC_UP, "WLC_UP", 0, 0, FALSE);\r
+                       }\r
+#endif\r
+#endif /* PROP_TXSTATUS */\r
+               }\r
+       }\r
+\r
+}\r
+#endif\r
+\r
+#if defined(WL_CFG80211) || defined(WL_ESCAN)\r
+static void\r
+dhd_conf_wait_event_complete(struct dhd_pub *dhd, int ifidx)\r
+{\r
+       s32 timeout = -1;\r
+\r
+       timeout = wait_event_interruptible_timeout(dhd->conf->event_complete,\r
+               wl_ext_event_complete(dhd, ifidx), msecs_to_jiffies(10000));\r
+       if (timeout <= 0 || !wl_ext_event_complete(dhd, ifidx)) {\r
+               wl_ext_event_complete(dhd, ifidx);\r
+               CONFIG_ERROR("timeout\n");\r
+       }\r
+}\r
+#endif\r
+\r
+int\r
+dhd_conf_set_suspend_resume(dhd_pub_t *dhd, int suspend)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+       uint insuspend = 0;\r
+       int pm;\r
+#ifdef BCMSDIO\r
+       uint32 intstatus = 0;\r
+       int ret = 0;\r
+#endif\r
+#ifdef WL_EXT_WOWL\r
+       int i;\r
+#endif\r
+\r
+       insuspend = dhd_conf_get_insuspend(dhd, ALL_IN_SUSPEND);\r
+       if (insuspend)\r
+               CONFIG_MSG("op_mode %d, suspend %d, suspended %d, insuspend 0x%x, suspend_mode=%d\n",\r
+                       dhd->op_mode, suspend, conf->suspended, insuspend, conf->suspend_mode);\r
+\r
+       if (conf->suspended == suspend || !dhd->up) {\r
+               return 0;\r
+       }\r
+\r
+       if (suspend) {\r
+               if (dhd->op_mode & DHD_FLAG_STA_MODE) {\r
+                       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "roam_off",\r
+                               dhd->conf->roam_off_suspend, 0, FALSE);\r
+                       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "bcn_li_dtim",\r
+                               dhd->conf->suspend_bcn_li_dtim, 0, FALSE);\r
+                       if (insuspend & ROAM_OFFLOAD_IN_SUSPEND)\r
+                               dhd_conf_enable_roam_offload(dhd, 2);\r
+               } else if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {\r
+                       if (insuspend & AP_DOWN_IN_SUSPEND) {\r
+                               dhd_conf_set_intiovar(dhd, WLC_DOWN, "WLC_DOWN", 1, 0, FALSE);\r
+                       }\r
+               }\r
+#if defined(WL_CFG80211) || defined(WL_ESCAN)\r
+               if (insuspend & (NO_EVENT_IN_SUSPEND|NO_TXCTL_IN_SUSPEND|WOWL_IN_SUSPEND)) {\r
+                       if (conf->suspend_mode == PM_NOTIFIER)\r
+                               dhd_conf_wait_event_complete(dhd, 0);\r
+               }\r
+#endif\r
+               if (insuspend & NO_TXDATA_IN_SUSPEND) {\r
+                       dhd_txflowcontrol(dhd, ALL_INTERFACES, ON);\r
+               }\r
+#if defined(WL_CFG80211) || defined(WL_ESCAN)\r
+               if (insuspend & (NO_EVENT_IN_SUSPEND|NO_TXCTL_IN_SUSPEND|WOWL_IN_SUSPEND)) {\r
+                       if (conf->suspend_mode == PM_NOTIFIER)\r
+                               wl_ext_user_sync(dhd, 0, TRUE);\r
+               }\r
+#endif\r
+#ifdef SUSPEND_EVENT\r
+               if (insuspend & NO_EVENT_IN_SUSPEND) {\r
+                       dhd_conf_set_suspend_event(dhd, suspend);\r
+               }\r
+#endif\r
+               if (dhd->op_mode & DHD_FLAG_STA_MODE) {\r
+                       if (conf->pm_in_suspend >= 0)\r
+                               pm = conf->pm_in_suspend;\r
+                       else if (conf->pm >= 0)\r
+                               pm = conf->pm;\r
+                       else\r
+                               pm = PM_FAST;\r
+                       dhd_conf_set_intiovar(dhd, WLC_SET_PM, "WLC_SET_PM", pm, 0, FALSE);\r
+               }\r
+               dhd_conf_set_wl_cmd(dhd, conf->wl_suspend, FALSE);\r
+#ifdef WL_EXT_WOWL\r
+               if ((insuspend & WOWL_IN_SUSPEND) && dhd_master_mode) {\r
+                       dhd_conf_wowl_pattern(dhd, FALSE, "clr");\r
+                       for(i=0; i<conf->pkt_filter_add.count; i++) {\r
+                               dhd_conf_wowl_pattern(dhd, TRUE, conf->pkt_filter_add.filter[i]);\r
+                       }\r
+                       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "wowl", conf->wowl, 0, FALSE);\r
+                       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "wowl_activate", 1, 0, FALSE);\r
+                       dhd_conf_wowl_wakeind(dhd, TRUE);\r
+                       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "hostsleep", 1, 0, FALSE);\r
+#ifdef BCMSDIO\r
+                       ret = dhd_bus_sleep(dhd, TRUE, &intstatus);\r
+                       CONFIG_TRACE("ret = %d, intstatus = 0x%x\n", ret, intstatus);\r
+#endif\r
+               } else\r
+#endif\r
+               if (insuspend & NO_TXCTL_IN_SUSPEND) {\r
+                       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "hostsleep", 2, 0, FALSE);\r
+#ifdef BCMSDIO\r
+                       ret = dhd_bus_sleep(dhd, TRUE, &intstatus);\r
+                       CONFIG_TRACE("ret = %d, intstatus = 0x%x\n", ret, intstatus);\r
+#endif\r
+               }\r
+               conf->suspended = TRUE;\r
+       } else {\r
+               if (insuspend & (WOWL_IN_SUSPEND | NO_TXCTL_IN_SUSPEND)) {\r
+                       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "hostsleep", 0, 0, FALSE);\r
+               }\r
+#ifdef WL_EXT_WOWL\r
+               if (insuspend & WOWL_IN_SUSPEND) {\r
+                       dhd_conf_wowl_wakeind(dhd, FALSE);\r
+                       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "wowl_activate", 0, 0, FALSE);\r
+                       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "wowl", 0, 0, FALSE);\r
+                       dhd_conf_wowl_pattern(dhd, FALSE, "clr");\r
+               }\r
+#endif\r
+               dhd_conf_set_wl_cmd(dhd, conf->wl_resume, FALSE);\r
+               dhd_conf_get_iovar(dhd, 0, WLC_GET_PM, "WLC_GET_PM", (char *)&pm, sizeof(pm));\r
+               CONFIG_TRACE("PM in suspend = %d\n", pm);\r
+#ifdef SUSPEND_EVENT\r
+               if (insuspend & NO_EVENT_IN_SUSPEND) {\r
+                       dhd_conf_set_suspend_event(dhd, suspend);\r
+               }\r
+#endif\r
+#if defined(WL_CFG80211) || defined(WL_ESCAN)\r
+               if (insuspend & (NO_EVENT_IN_SUSPEND|NO_TXCTL_IN_SUSPEND|WOWL_IN_SUSPEND)) {\r
+                       if (conf->suspend_mode == PM_NOTIFIER)\r
+                               wl_ext_user_sync(dhd, 0, FALSE);\r
+               }\r
+#endif\r
+               if (insuspend & NO_TXDATA_IN_SUSPEND) {\r
+                       dhd_txflowcontrol(dhd, ALL_INTERFACES, OFF);\r
+               }\r
+               if (dhd->op_mode & DHD_FLAG_STA_MODE) {\r
+                       if (insuspend & ROAM_OFFLOAD_IN_SUSPEND)\r
+                               dhd_conf_enable_roam_offload(dhd, 0);\r
+                       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "bcn_li_dtim", 0, 0, FALSE);\r
+                       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "roam_off",\r
+                               dhd->conf->roam_off, 0, FALSE);\r
+               } else if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {\r
+                       if (insuspend & AP_DOWN_IN_SUSPEND) {\r
+                               dhd_conf_set_intiovar(dhd, WLC_UP, "WLC_UP", 0, 0, FALSE);\r
+                       }\r
+               }\r
+               if (dhd->op_mode & DHD_FLAG_STA_MODE) {\r
+                       if (conf->pm >= 0)\r
+                               pm = conf->pm;\r
+                       else\r
+                               pm = PM_FAST;\r
+                       dhd_conf_set_intiovar(dhd, WLC_SET_PM, "WLC_SET_PM", pm, 0, FALSE);\r
+               }\r
+               conf->suspended = FALSE;\r
+       }\r
+\r
+       return 0;\r
+}\r
+\r
+#ifdef PROP_TXSTATUS\r
+int\r
+dhd_conf_get_disable_proptx(dhd_pub_t *dhd)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+       int disable_proptx = -1;\r
+       int fw_proptx = 0;\r
+\r
+       /* check fw proptx priority:\r
+         * 1st: check fw support by wl cap\r
+         * 2nd: 4334/43340/43341/43241 support proptx but not show in wl cap, so enable it by default\r
+         *        if you would like to disable it, please set disable_proptx=1 in config.txt\r
+         * 3th: disable when proptxstatus not support in wl cap\r
+         */\r
+       if (FW_SUPPORTED(dhd, proptxstatus)) {\r
+               fw_proptx = 1;\r
+       } else if (conf->chip == BCM4334_CHIP_ID || conf->chip == BCM43340_CHIP_ID ||\r
+                       dhd->conf->chip == BCM43340_CHIP_ID || conf->chip == BCM4324_CHIP_ID) {\r
+               fw_proptx = 1;\r
+       } else {\r
+               fw_proptx = 0;\r
+       }\r
+\r
+       /* returned disable_proptx value:\r
+         * -1: disable in STA and enable in P2P(follow original dhd settings when PROP_TXSTATUS_VSDB enabled)\r
+         * 0: depend on fw support\r
+         * 1: always disable proptx\r
+         */\r
+       if (conf->disable_proptx == 0) {\r
+               // check fw support as well\r
+               if (fw_proptx)\r
+                       disable_proptx = 0;\r
+               else\r
+                       disable_proptx = 1;\r
+       } else if (conf->disable_proptx >= 1) {\r
+               disable_proptx = 1;\r
+       } else {\r
+               // check fw support as well\r
+               if (fw_proptx)\r
+                       disable_proptx = -1;\r
+               else\r
+                       disable_proptx = 1;\r
+       }\r
+\r
+       CONFIG_MSG("fw_proptx=%d, disable_proptx=%d\n", fw_proptx, disable_proptx);\r
+\r
+       return disable_proptx;\r
+}\r
+#endif\r
+\r
+uint\r
+pick_config_vars(char *varbuf, uint len, uint start_pos, char *pickbuf, int picklen)\r
+{\r
+       bool findNewline, changenewline=FALSE, pick=FALSE;\r
+       int column;\r
+       uint n, pick_column=0;\r
+\r
+       findNewline = FALSE;\r
+       column = 0;\r
+\r
+       if (start_pos >= len) {\r
+               CONFIG_ERROR("wrong start pos\n");\r
+               return 0;\r
+       }\r
+\r
+       for (n = start_pos; n < len; n++) {\r
+               if (varbuf[n] == '\r')\r
+                       continue;\r
+               if ((findNewline || changenewline) && varbuf[n] != '\n')\r
+                       continue;\r
+               findNewline = FALSE;\r
+               if (varbuf[n] == '#') {\r
+                       findNewline = TRUE;\r
+                       continue;\r
+               }\r
+               if (varbuf[n] == '\\') {\r
+                       changenewline = TRUE;\r
+                       continue;\r
+               }\r
+               if (!changenewline && varbuf[n] == '\n') {\r
+                       if (column == 0)\r
+                               continue;\r
+                       column = 0;\r
+                       continue;\r
+               }\r
+               if (changenewline && varbuf[n] == '\n') {\r
+                       changenewline = FALSE;\r
+                       continue;\r
+               }\r
+\r
+               if (column==0 && !pick) { // start to pick\r
+                       pick = TRUE;\r
+                       column++;\r
+                       pick_column = 0;\r
+               } else {\r
+                       if (pick && column==0) { // stop to pick\r
+                               pick = FALSE;\r
+                               break;\r
+                       } else\r
+                               column++;\r
+               }\r
+               if (pick) {\r
+                       if (varbuf[n] == 0x9)\r
+                               continue;\r
+                       if (pick_column >= picklen)\r
+                               break;\r
+                       pickbuf[pick_column] = varbuf[n];\r
+                       pick_column++;\r
+               }\r
+       }\r
+\r
+       return n; // return current position\r
+}\r
+\r
+bool\r
+dhd_conf_read_chiprev(dhd_pub_t *dhd, int *chip_match,\r
+       char *full_param, uint len_param)\r
+{\r
+       char *data = full_param+len_param, *pick_tmp, *pch;\r
+       uint chip = 0, rev = 0;\r
+\r
+       /* Process chip, regrev:\r
+        * chip=[chipid], rev==[rev]\r
+        * Ex: chip=0x4359, rev=9\r
+        */\r
+       if (!strncmp("chip=", full_param, len_param)) {\r
+               chip = (int)simple_strtol(data, NULL, 0);\r
+               pick_tmp = data;\r
+               pch = bcmstrstr(pick_tmp, "rev=");\r
+               if (pch) {\r
+                       rev = (int)simple_strtol(pch+strlen("rev="), NULL, 0);\r
+               }\r
+               if (chip == dhd->conf->chip && rev == dhd->conf->chiprev)\r
+                       *chip_match = 1;\r
+               else\r
+                       *chip_match = 0;\r
+               CONFIG_MSG("chip=0x%x, rev=%d, chip_match=%d\n", chip, rev, *chip_match);\r
+       }\r
+\r
+       return TRUE;\r
+}\r
+\r
+bool\r
+dhd_conf_read_log_level(dhd_pub_t *dhd, char *full_param, uint len_param)\r
+{\r
+       char *data = full_param+len_param;\r
+\r
+       if (!strncmp("dhd_msg_level=", full_param, len_param)) {\r
+               dhd_msg_level = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("dhd_msg_level = 0x%X\n", dhd_msg_level);\r
+       }\r
+       else if (!strncmp("dump_msg_level=", full_param, len_param)) {\r
+               dump_msg_level = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("dump_msg_level = 0x%X\n", dump_msg_level);\r
+       }\r
+#ifdef BCMSDIO\r
+       else if (!strncmp("sd_msglevel=", full_param, len_param)) {\r
+               sd_msglevel = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("sd_msglevel = 0x%X\n", sd_msglevel);\r
+       }\r
+#endif\r
+#ifdef BCMDBUS\r
+       else if (!strncmp("dbus_msglevel=", full_param, len_param)) {\r
+               dbus_msglevel = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("dbus_msglevel = 0x%X\n", dbus_msglevel);\r
+       }\r
+#endif\r
+       else if (!strncmp("android_msg_level=", full_param, len_param)) {\r
+               android_msg_level = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("android_msg_level = 0x%X\n", android_msg_level);\r
+       }\r
+       else if (!strncmp("config_msg_level=", full_param, len_param)) {\r
+               config_msg_level = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("config_msg_level = 0x%X\n", config_msg_level);\r
+       }\r
+#ifdef WL_CFG80211\r
+       else if (!strncmp("wl_dbg_level=", full_param, len_param)) {\r
+               wl_dbg_level = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("wl_dbg_level = 0x%X\n", wl_dbg_level);\r
+       }\r
+#endif\r
+#if defined(WL_WIRELESS_EXT)\r
+       else if (!strncmp("iw_msg_level=", full_param, len_param)) {\r
+               iw_msg_level = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("iw_msg_level = 0x%X\n", iw_msg_level);\r
+       }\r
+#endif\r
+#if defined(DHD_DEBUG)\r
+       else if (!strncmp("dhd_console_ms=", full_param, len_param)) {\r
+               dhd->dhd_console_ms = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("dhd_console_ms = 0x%X\n", dhd->dhd_console_ms);\r
+       }\r
+#endif\r
+       else\r
+               return false;\r
+\r
+       return true;\r
+}\r
+\r
+void\r
+dhd_conf_read_wme_ac_value(wme_param_t *wme, char *pick, int ac_val)\r
+{\r
+       char *pick_tmp, *pch;\r
+\r
+       pick_tmp = pick;\r
+       pch = bcmstrstr(pick_tmp, "aifsn ");\r
+       if (pch) {\r
+               wme->aifsn[ac_val] = (int)simple_strtol(pch+strlen("aifsn "), NULL, 0);\r
+               CONFIG_MSG("ac_val=%d, aifsn=%d\n", ac_val, wme->aifsn[ac_val]);\r
+       }\r
+       pick_tmp = pick;\r
+       pch = bcmstrstr(pick_tmp, "ecwmin ");\r
+       if (pch) {\r
+               wme->ecwmin[ac_val] = (int)simple_strtol(pch+strlen("ecwmin "), NULL, 0);\r
+               CONFIG_MSG("ac_val=%d, ecwmin=%d\n", ac_val, wme->ecwmin[ac_val]);\r
+       }\r
+       pick_tmp = pick;\r
+       pch = bcmstrstr(pick_tmp, "ecwmax ");\r
+       if (pch) {\r
+               wme->ecwmax[ac_val] = (int)simple_strtol(pch+strlen("ecwmax "), NULL, 0);\r
+               CONFIG_MSG("ac_val=%d, ecwmax=%d\n", ac_val, wme->ecwmax[ac_val]);\r
+       }\r
+       pick_tmp = pick;\r
+       pch = bcmstrstr(pick_tmp, "txop ");\r
+       if (pch) {\r
+               wme->txop[ac_val] = (int)simple_strtol(pch+strlen("txop "), NULL, 0);\r
+               CONFIG_MSG("ac_val=%d, txop=0x%x\n", ac_val, wme->txop[ac_val]);\r
+       }\r
+\r
+}\r
+\r
+bool\r
+dhd_conf_read_wme_ac_params(dhd_pub_t *dhd, char *full_param, uint len_param)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+       char *data = full_param+len_param;\r
+\r
+       // wme_ac_sta_be=aifsn 1 ecwmin 2 ecwmax 3 txop 0x5e\r
+       // wme_ac_sta_vo=aifsn 1 ecwmin 1 ecwmax 1 txop 0x5e\r
+\r
+       if (!strncmp("force_wme_ac=", full_param, len_param)) {\r
+               conf->force_wme_ac = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("force_wme_ac = %d\n", conf->force_wme_ac);\r
+       }\r
+       else if (!strncmp("wme_ac_sta_be=", full_param, len_param)) {\r
+               dhd_conf_read_wme_ac_value(&conf->wme_sta, data, AC_BE);\r
+       }\r
+       else if (!strncmp("wme_ac_sta_bk=", full_param, len_param)) {\r
+               dhd_conf_read_wme_ac_value(&conf->wme_sta, data, AC_BK);\r
+       }\r
+       else if (!strncmp("wme_ac_sta_vi=", full_param, len_param)) {\r
+               dhd_conf_read_wme_ac_value(&conf->wme_sta, data, AC_VI);\r
+       }\r
+       else if (!strncmp("wme_ac_sta_vo=", full_param, len_param)) {\r
+               dhd_conf_read_wme_ac_value(&conf->wme_sta, data, AC_VO);\r
+       }\r
+       else if (!strncmp("wme_ac_ap_be=", full_param, len_param)) {\r
+               dhd_conf_read_wme_ac_value(&conf->wme_ap, data, AC_BE);\r
+       }\r
+       else if (!strncmp("wme_ac_ap_bk=", full_param, len_param)) {\r
+               dhd_conf_read_wme_ac_value(&conf->wme_ap, data, AC_BK);\r
+       }\r
+       else if (!strncmp("wme_ac_ap_vi=", full_param, len_param)) {\r
+               dhd_conf_read_wme_ac_value(&conf->wme_ap, data, AC_VI);\r
+       }\r
+       else if (!strncmp("wme_ac_ap_vo=", full_param, len_param)) {\r
+               dhd_conf_read_wme_ac_value(&conf->wme_ap, data, AC_VO);\r
+       }\r
+       else\r
+               return false;\r
+\r
+       return true;\r
+}\r
+\r
+#ifdef BCMSDIO\r
+bool\r
+dhd_conf_read_fw_by_mac(dhd_pub_t *dhd, char *full_param, uint len_param)\r
+{\r
+       int i, j;\r
+       char *pch, *pick_tmp;\r
+       wl_mac_list_t *mac_list;\r
+       wl_mac_range_t *mac_range;\r
+       struct dhd_conf *conf = dhd->conf;\r
+       char *data = full_param+len_param;\r
+\r
+       /* Process fw_by_mac:\r
+        * fw_by_mac=[fw_mac_num] \\r
+        *  [fw_name1] [mac_num1] [oui1-1] [nic_start1-1] [nic_end1-1] \\r
+        *                                    [oui1-1] [nic_start1-1] [nic_end1-1]... \\r
+        *                                    [oui1-n] [nic_start1-n] [nic_end1-n] \\r
+        *  [fw_name2] [mac_num2] [oui2-1] [nic_start2-1] [nic_end2-1] \\r
+        *                                    [oui2-1] [nic_start2-1] [nic_end2-1]... \\r
+        *                                    [oui2-n] [nic_start2-n] [nic_end2-n] \\r
+        * Ex: fw_by_mac=2 \\r
+        *  fw_bcmdhd1.bin 2 0x0022F4 0xE85408 0xE8549D 0x983B16 0x3557A9 0x35582A \\r
+        *  fw_bcmdhd2.bin 3 0x0022F4 0xE85408 0xE8549D 0x983B16 0x3557A9 0x35582A \\r
+        *                           0x983B16 0x916157 0x916487\r
+        */\r
+\r
+       if (!strncmp("fw_by_mac=", full_param, len_param)) {\r
+               dhd_conf_free_mac_list(&conf->fw_by_mac);\r
+               pick_tmp = data;\r
+               pch = bcmstrtok(&pick_tmp, " ", 0);\r
+               conf->fw_by_mac.count = (uint32)simple_strtol(pch, NULL, 0);\r
+               if (!(mac_list = kmalloc(sizeof(wl_mac_list_t)*conf->fw_by_mac.count,\r
+                               GFP_KERNEL))) {\r
+                       conf->fw_by_mac.count = 0;\r
+                       CONFIG_ERROR("kmalloc failed\n");\r
+               }\r
+               CONFIG_MSG("fw_count=%d\n", conf->fw_by_mac.count);\r
+               conf->fw_by_mac.m_mac_list_head = mac_list;\r
+               for (i=0; i<conf->fw_by_mac.count; i++) {\r
+                       pch = bcmstrtok(&pick_tmp, " ", 0);\r
+                       strcpy(mac_list[i].name, pch);\r
+                       pch = bcmstrtok(&pick_tmp, " ", 0);\r
+                       mac_list[i].count = (uint32)simple_strtol(pch, NULL, 0);\r
+                       CONFIG_MSG("name=%s, mac_count=%d\n",\r
+                               mac_list[i].name, mac_list[i].count);\r
+                       if (!(mac_range = kmalloc(sizeof(wl_mac_range_t)*mac_list[i].count,\r
+                                       GFP_KERNEL))) {\r
+                               mac_list[i].count = 0;\r
+                               CONFIG_ERROR("kmalloc failed\n");\r
+                               break;\r
+                       }\r
+                       mac_list[i].mac = mac_range;\r
+                       for (j=0; j<mac_list[i].count; j++) {\r
+                               pch = bcmstrtok(&pick_tmp, " ", 0);\r
+                               mac_range[j].oui = (uint32)simple_strtol(pch, NULL, 0);\r
+                               pch = bcmstrtok(&pick_tmp, " ", 0);\r
+                               mac_range[j].nic_start = (uint32)simple_strtol(pch, NULL, 0);\r
+                               pch = bcmstrtok(&pick_tmp, " ", 0);\r
+                               mac_range[j].nic_end = (uint32)simple_strtol(pch, NULL, 0);\r
+                               CONFIG_MSG("oui=0x%06X, nic_start=0x%06X, nic_end=0x%06X\n",\r
+                                       mac_range[j].oui, mac_range[j].nic_start, mac_range[j].nic_end);\r
+                       }\r
+               }\r
+       }\r
+       else\r
+               return false;\r
+\r
+       return true;\r
+}\r
+\r
+bool\r
+dhd_conf_read_nv_by_mac(dhd_pub_t *dhd, char *full_param, uint len_param)\r
+{\r
+       int i, j;\r
+       char *pch, *pick_tmp;\r
+       wl_mac_list_t *mac_list;\r
+       wl_mac_range_t *mac_range;\r
+       struct dhd_conf *conf = dhd->conf;\r
+       char *data = full_param+len_param;\r
+\r
+       /* Process nv_by_mac:\r
+        * [nv_by_mac]: The same format as fw_by_mac\r
+        */\r
+       if (!strncmp("nv_by_mac=", full_param, len_param)) {\r
+               dhd_conf_free_mac_list(&conf->nv_by_mac);\r
+               pick_tmp = data;\r
+               pch = bcmstrtok(&pick_tmp, " ", 0);\r
+               conf->nv_by_mac.count = (uint32)simple_strtol(pch, NULL, 0);\r
+               if (!(mac_list = kmalloc(sizeof(wl_mac_list_t)*conf->nv_by_mac.count,\r
+                               GFP_KERNEL))) {\r
+                       conf->nv_by_mac.count = 0;\r
+                       CONFIG_ERROR("kmalloc failed\n");\r
+               }\r
+               CONFIG_MSG("nv_count=%d\n", conf->nv_by_mac.count);\r
+               conf->nv_by_mac.m_mac_list_head = mac_list;\r
+               for (i=0; i<conf->nv_by_mac.count; i++) {\r
+                       pch = bcmstrtok(&pick_tmp, " ", 0);\r
+                       strcpy(mac_list[i].name, pch);\r
+                       pch = bcmstrtok(&pick_tmp, " ", 0);\r
+                       mac_list[i].count = (uint32)simple_strtol(pch, NULL, 0);\r
+                       CONFIG_MSG("name=%s, mac_count=%d\n",\r
+                               mac_list[i].name, mac_list[i].count);\r
+                       if (!(mac_range = kmalloc(sizeof(wl_mac_range_t)*mac_list[i].count,\r
+                                       GFP_KERNEL))) {\r
+                               mac_list[i].count = 0;\r
+                               CONFIG_ERROR("kmalloc failed\n");\r
+                               break;\r
+                       }\r
+                       mac_list[i].mac = mac_range;\r
+                       for (j=0; j<mac_list[i].count; j++) {\r
+                               pch = bcmstrtok(&pick_tmp, " ", 0);\r
+                               mac_range[j].oui = (uint32)simple_strtol(pch, NULL, 0);\r
+                               pch = bcmstrtok(&pick_tmp, " ", 0);\r
+                               mac_range[j].nic_start = (uint32)simple_strtol(pch, NULL, 0);\r
+                               pch = bcmstrtok(&pick_tmp, " ", 0);\r
+                               mac_range[j].nic_end = (uint32)simple_strtol(pch, NULL, 0);\r
+                               CONFIG_MSG("oui=0x%06X, nic_start=0x%06X, nic_end=0x%06X\n",\r
+                                       mac_range[j].oui, mac_range[j].nic_start, mac_range[j].nic_end);\r
+                       }\r
+               }\r
+       }\r
+       else\r
+               return false;\r
+\r
+       return true;\r
+}\r
+#endif\r
+\r
+bool\r
+dhd_conf_read_nv_by_chip(dhd_pub_t *dhd, char *full_param, uint len_param)\r
+{\r
+       int i;\r
+       char *pch, *pick_tmp;\r
+       wl_chip_nv_path_t *chip_nv_path;\r
+       struct dhd_conf *conf = dhd->conf;\r
+       char *data = full_param+len_param;\r
+\r
+       /* Process nv_by_chip:\r
+        * nv_by_chip=[nv_chip_num] \\r
+        *  [chip1] [chiprev1] [nv_name1] [chip2] [chiprev2] [nv_name2] \\r
+        * Ex: nv_by_chip=2 \\r
+        *  43430 0 nvram_ap6212.txt 43430 1 nvram_ap6212a.txt \\r
+        */\r
+       if (!strncmp("nv_by_chip=", full_param, len_param)) {\r
+               dhd_conf_free_chip_nv_path_list(&conf->nv_by_chip);\r
+               pick_tmp = data;\r
+               pch = bcmstrtok(&pick_tmp, " ", 0);\r
+               conf->nv_by_chip.count = (uint32)simple_strtol(pch, NULL, 0);\r
+               if (!(chip_nv_path = kmalloc(sizeof(wl_mac_list_t)*conf->nv_by_chip.count,\r
+                               GFP_KERNEL))) {\r
+                       conf->nv_by_chip.count = 0;\r
+                       CONFIG_ERROR("kmalloc failed\n");\r
+               }\r
+               CONFIG_MSG("nv_by_chip_count=%d\n", conf->nv_by_chip.count);\r
+               conf->nv_by_chip.m_chip_nv_path_head = chip_nv_path;\r
+               for (i=0; i<conf->nv_by_chip.count; i++) {\r
+                       pch = bcmstrtok(&pick_tmp, " ", 0);\r
+                       chip_nv_path[i].chip = (uint32)simple_strtol(pch, NULL, 0);\r
+                       pch = bcmstrtok(&pick_tmp, " ", 0);\r
+                       chip_nv_path[i].chiprev = (uint32)simple_strtol(pch, NULL, 0);\r
+                       pch = bcmstrtok(&pick_tmp, " ", 0);\r
+                       strcpy(chip_nv_path[i].name, pch);\r
+                       CONFIG_MSG("chip=0x%x, chiprev=%d, name=%s\n",\r
+                               chip_nv_path[i].chip, chip_nv_path[i].chiprev, chip_nv_path[i].name);\r
+               }\r
+       }\r
+       else\r
+               return false;\r
+\r
+       return true;\r
+}\r
+\r
+bool\r
+dhd_conf_read_roam_params(dhd_pub_t *dhd, char *full_param, uint len_param)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+       char *data = full_param+len_param;\r
+\r
+       if (!strncmp("roam_off=", full_param, len_param)) {\r
+               if (!strncmp(data, "0", 1))\r
+                       conf->roam_off = 0;\r
+               else\r
+                       conf->roam_off = 1;\r
+               CONFIG_MSG("roam_off = %d\n", conf->roam_off);\r
+       }\r
+       else if (!strncmp("roam_off_suspend=", full_param, len_param)) {\r
+               if (!strncmp(data, "0", 1))\r
+                       conf->roam_off_suspend = 0;\r
+               else\r
+                       conf->roam_off_suspend = 1;\r
+               CONFIG_MSG("roam_off_suspend = %d\n", conf->roam_off_suspend);\r
+       }\r
+       else if (!strncmp("roam_trigger=", full_param, len_param)) {\r
+               conf->roam_trigger[0] = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("roam_trigger = %d\n", conf->roam_trigger[0]);\r
+       }\r
+       else if (!strncmp("roam_scan_period=", full_param, len_param)) {\r
+               conf->roam_scan_period[0] = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("roam_scan_period = %d\n", conf->roam_scan_period[0]);\r
+       }\r
+       else if (!strncmp("roam_delta=", full_param, len_param)) {\r
+               conf->roam_delta[0] = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("roam_delta = %d\n", conf->roam_delta[0]);\r
+       }\r
+       else if (!strncmp("fullroamperiod=", full_param, len_param)) {\r
+               conf->fullroamperiod = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("fullroamperiod = %d\n", conf->fullroamperiod);\r
+       } else\r
+               return false;\r
+\r
+       return true;\r
+}\r
+\r
+bool\r
+dhd_conf_read_country(dhd_pub_t *dhd, char *full_param, uint len_param)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+       country_list_t *country_next = NULL, *country;\r
+       int i, count = 0;\r
+       char *pch, *pick_tmp, *pick_tmp2;\r
+       char *data = full_param+len_param;\r
+       uint len_data = strlen(data);\r
+\r
+       /* Process country_list:\r
+        * country_list=[country1]:[ccode1]/[regrev1],\r
+        * [country2]:[ccode2]/[regrev2] \\r
+        * Ex: country_list=US:US/0, TW:TW/1\r
+        */\r
+       if (!strncmp("ccode=", full_param, len_param)) {\r
+               len_data = min((uint)WLC_CNTRY_BUF_SZ, len_data);\r
+               memset(&conf->cspec, 0, sizeof(wl_country_t));\r
+               memcpy(conf->cspec.country_abbrev, data, len_data);\r
+               memcpy(conf->cspec.ccode, data, len_data);\r
+               CONFIG_MSG("ccode = %s\n", conf->cspec.ccode);\r
+       }\r
+       else if (!strncmp("regrev=", full_param, len_param)) {\r
+               conf->cspec.rev = (int32)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("regrev = %d\n", conf->cspec.rev);\r
+       }\r
+       else if (!strncmp("country_list=", full_param, len_param)) {\r
+               dhd_conf_free_country_list(conf);\r
+               pick_tmp = data;\r
+               for (i=0; i<CONFIG_COUNTRY_LIST_SIZE; i++) {\r
+                       pick_tmp2 = bcmstrtok(&pick_tmp, ", ", 0);\r
+                       if (!pick_tmp2)\r
+                               break;\r
+                       pch = bcmstrtok(&pick_tmp2, ":", 0);\r
+                       if (!pch)\r
+                               break;\r
+                       country = NULL;\r
+                       if (!(country = kmalloc(sizeof(country_list_t), GFP_KERNEL))) {\r
+                               CONFIG_ERROR("kmalloc failed\n");\r
+                               break;\r
+                       }\r
+                       memset(country, 0, sizeof(country_list_t));\r
+\r
+                       memcpy(country->cspec.country_abbrev, pch, 2);\r
+                       pch = bcmstrtok(&pick_tmp2, "/", 0);\r
+                       if (!pch) {\r
+                               kfree(country);\r
+                               break;\r
+                       }\r
+                       memcpy(country->cspec.ccode, pch, 2);\r
+                       pch = bcmstrtok(&pick_tmp2, "/", 0);\r
+                       if (!pch) {\r
+                               kfree(country);\r
+                               break;\r
+                       }\r
+                       country->cspec.rev = (int32)simple_strtol(pch, NULL, 10);\r
+                       count++;\r
+                       if (!conf->country_head) {\r
+                               conf->country_head = country;\r
+                               country_next = country;\r
+                       } else {\r
+                               country_next->next = country;\r
+                               country_next = country;\r
+                       }\r
+                       CONFIG_TRACE("abbrev=%s, ccode=%s, regrev=%d\n",\r
+                               country->cspec.country_abbrev, country->cspec.ccode, country->cspec.rev);\r
+               }\r
+               CONFIG_MSG("%d country in list\n", count);\r
+       }\r
+       else\r
+               return false;\r
+\r
+       return true;\r
+}\r
+\r
+bool\r
+dhd_conf_read_mchan_params(dhd_pub_t *dhd, char *full_param, uint len_param)\r
+{\r
+       int i;\r
+       char *pch, *pick_tmp, *pick_tmp2;\r
+       struct dhd_conf *conf = dhd->conf;\r
+       mchan_params_t *mchan_next = NULL, *mchan;\r
+       char *data = full_param+len_param;\r
+\r
+       /* Process mchan_bw:\r
+        * mchan_bw=[val]/[any/go/gc]/[any/source/sink]\r
+        * Ex: mchan_bw=80/go/source, 30/gc/sink\r
+        */\r
+       if (!strncmp("mchan_bw=", full_param, len_param)) {\r
+               dhd_conf_free_mchan_list(conf);\r
+               pick_tmp = data;\r
+               for (i=0; i<MCHAN_MAX_NUM; i++) {\r
+                       pick_tmp2 = bcmstrtok(&pick_tmp, ", ", 0);\r
+                       if (!pick_tmp2)\r
+                               break;\r
+                       pch = bcmstrtok(&pick_tmp2, "/", 0);\r
+                       if (!pch)\r
+                               break;\r
+\r
+                       mchan = NULL;\r
+                       if (!(mchan = kmalloc(sizeof(mchan_params_t), GFP_KERNEL))) {\r
+                               CONFIG_ERROR("kmalloc failed\n");\r
+                               break;\r
+                       }\r
+                       memset(mchan, 0, sizeof(mchan_params_t));\r
+\r
+                       mchan->bw = (int)simple_strtol(pch, NULL, 0);\r
+                       if (mchan->bw < 0 || mchan->bw > 100) {\r
+                               CONFIG_ERROR("wrong bw %d\n", mchan->bw);\r
+                               kfree(mchan);\r
+                               break;\r
+                       }\r
+\r
+                       pch = bcmstrtok(&pick_tmp2, "/", 0);\r
+                       if (!pch) {\r
+                               kfree(mchan);\r
+                               break;\r
+                       } else {\r
+                               if (bcmstrstr(pch, "any")) {\r
+                                       mchan->p2p_mode = -1;\r
+                               } else if (bcmstrstr(pch, "go")) {\r
+                                       mchan->p2p_mode = WL_P2P_IF_GO;\r
+                               } else if (bcmstrstr(pch, "gc")) {\r
+                                       mchan->p2p_mode = WL_P2P_IF_CLIENT;\r
+                               }\r
+                       }\r
+                       pch = bcmstrtok(&pick_tmp2, "/", 0);\r
+                       if (!pch) {\r
+                               kfree(mchan);\r
+                               break;\r
+                       } else {\r
+                               if (bcmstrstr(pch, "any")) {\r
+                                       mchan->miracast_mode = -1;\r
+                               } else if (bcmstrstr(pch, "source")) {\r
+                                       mchan->miracast_mode = MIRACAST_SOURCE;\r
+                               } else if (bcmstrstr(pch, "sink")) {\r
+                                       mchan->miracast_mode = MIRACAST_SINK;\r
+                               }\r
+                       }\r
+                       if (!conf->mchan) {\r
+                               conf->mchan = mchan;\r
+                               mchan_next = mchan;\r
+                       } else {\r
+                               mchan_next->next = mchan;\r
+                               mchan_next = mchan;\r
+                       }\r
+                       CONFIG_TRACE("mchan_bw=%d/%d/%d\n", mchan->bw,mchan->p2p_mode,\r
+                               mchan->miracast_mode);\r
+               }\r
+       }\r
+       else\r
+               return false;\r
+\r
+       return true;\r
+}\r
+\r
+#ifdef PKT_FILTER_SUPPORT\r
+bool\r
+dhd_conf_read_pkt_filter(dhd_pub_t *dhd, char *full_param, uint len_param)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+       char *data = full_param+len_param;\r
+       char *pch, *pick_tmp;\r
+       int i;\r
+\r
+       /* Process pkt filter:\r
+        * 1) pkt_filter_add=99 0 0 0 0x000000000000 0x000000000000\r
+        * 2) pkt_filter_delete=100, 102, 103, 104, 105\r
+        * 3) magic_pkt_filter_add=141 0 1 12\r
+        */\r
+       if (!strncmp("dhd_master_mode=", full_param, len_param)) {\r
+               if (!strncmp(data, "0", 1))\r
+                       dhd_master_mode = FALSE;\r
+               else\r
+                       dhd_master_mode = TRUE;\r
+               CONFIG_MSG("dhd_master_mode = %d\n", dhd_master_mode);\r
+       }\r
+       else if (!strncmp("pkt_filter_add=", full_param, len_param)) {\r
+               pick_tmp = data;\r
+               pch = bcmstrtok(&pick_tmp, ",.-", 0);\r
+               i=0;\r
+               while (pch != NULL && i<DHD_CONF_FILTER_MAX) {\r
+                       strcpy(&conf->pkt_filter_add.filter[i][0], pch);\r
+                       CONFIG_MSG("pkt_filter_add[%d][] = %s\n",\r
+                               i, &conf->pkt_filter_add.filter[i][0]);\r
+                       pch = bcmstrtok(&pick_tmp, ",.-", 0);\r
+                       i++;\r
+               }\r
+               conf->pkt_filter_add.count = i;\r
+       }\r
+       else if (!strncmp("pkt_filter_delete=", full_param, len_param) ||\r
+                       !strncmp("pkt_filter_del=", full_param, len_param)) {\r
+               pick_tmp = data;\r
+               pch = bcmstrtok(&pick_tmp, " ,.-", 0);\r
+               i=0;\r
+               while (pch != NULL && i<DHD_CONF_FILTER_MAX) {\r
+                       conf->pkt_filter_del.id[i] = (uint32)simple_strtol(pch, NULL, 10);\r
+                       pch = bcmstrtok(&pick_tmp, " ,.-", 0);\r
+                       i++;\r
+               }\r
+               conf->pkt_filter_del.count = i;\r
+               CONFIG_MSG("pkt_filter_del id = ");\r
+               for (i=0; i<conf->pkt_filter_del.count; i++)\r
+                       printf("%d ", conf->pkt_filter_del.id[i]);\r
+               printf("\n");\r
+       }\r
+       else if (!strncmp("magic_pkt_filter_add=", full_param, len_param)) {\r
+               if (conf->magic_pkt_filter_add) {\r
+                       kfree(conf->magic_pkt_filter_add);\r
+                       conf->magic_pkt_filter_add = NULL;\r
+               }\r
+               if (!(conf->magic_pkt_filter_add = kmalloc(MAGIC_PKT_FILTER_LEN, GFP_KERNEL))) {\r
+                       CONFIG_ERROR("kmalloc failed\n");\r
+               } else {\r
+                       memset(conf->magic_pkt_filter_add, 0, MAGIC_PKT_FILTER_LEN);\r
+                       strcpy(conf->magic_pkt_filter_add, data);\r
+                       CONFIG_MSG("magic_pkt_filter_add = %s\n", conf->magic_pkt_filter_add);\r
+               }\r
+       }\r
+       else\r
+               return false;\r
+\r
+       return true;\r
+}\r
+#endif\r
+\r
+#ifdef ISAM_PREINIT\r
+#if !defined(WL_EXT_IAPSTA)\r
+#error "WL_EXT_IAPSTA should be defined to enable ISAM_PREINIT"\r
+#endif /* !WL_EXT_IAPSTA */\r
+/*\r
+ * isam_init=mode [sta|ap|apsta|dualap] vifname [wlan1]\r
+ * isam_config=ifname [wlan0|wlan1] ssid [xxx] chan [x]\r
+                hidden [y|n] maxassoc [x]\r
+                amode [open|shared|wpapsk|wpa2psk|wpawpa2psk]\r
+                emode [none|wep|tkip|aes|tkipaes]\r
+                key [xxxxx]\r
+ * isam_enable=ifname [wlan0|wlan1]\r
+*/\r
+bool\r
+dhd_conf_read_isam(dhd_pub_t *dhd, char *full_param, uint len_param)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+       char *data = full_param+len_param;\r
+\r
+       if (!strncmp("isam_init=", full_param, len_param)) {\r
+               sprintf(conf->isam_init, "isam_init %s", data);\r
+               CONFIG_MSG("isam_init=%s\n", conf->isam_init);\r
+       }\r
+       else if (!strncmp("isam_config=", full_param, len_param)) {\r
+               sprintf(conf->isam_config, "isam_config %s", data);\r
+               CONFIG_MSG("isam_config=%s\n", conf->isam_config);\r
+       }\r
+       else if (!strncmp("isam_enable=", full_param, len_param)) {\r
+               sprintf(conf->isam_enable, "isam_enable %s", data);\r
+               CONFIG_MSG("isam_enable=%s\n", conf->isam_enable);\r
+       }\r
+       else\r
+               return false;\r
+\r
+       return true;\r
+}\r
+#endif\r
+\r
+#ifdef IDHCP\r
+bool\r
+dhd_conf_read_dhcp_params(dhd_pub_t *dhd, char *full_param, uint len_param)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+       char *data = full_param+len_param;\r
+       struct ipv4_addr ipa_set;\r
+\r
+       if (!strncmp("dhcpc_enable=", full_param, len_param)) {\r
+               conf->dhcpc_enable = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("dhcpc_enable = %d\n", conf->dhcpc_enable);\r
+       }\r
+       else if (!strncmp("dhcpd_enable=", full_param, len_param)) {\r
+               conf->dhcpd_enable = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("dhcpd_enable = %d\n", conf->dhcpd_enable);\r
+       }\r
+       else if (!strncmp("dhcpd_ip_addr=", full_param, len_param)) {\r
+               if (!bcm_atoipv4(data, &ipa_set)) {\r
+                       CONFIG_ERROR("dhcpd_ip_addr adress setting failed.n");\r
+                       return false;\r
+               }\r
+               memcpy(&conf->dhcpd_ip_addr, &ipa_set, sizeof(struct ipv4_addr));\r
+               CONFIG_MSG("dhcpd_ip_addr = %s\n", data);\r
+       }\r
+       else if (!strncmp("dhcpd_ip_mask=", full_param, len_param)) {\r
+               if (!bcm_atoipv4(data, &ipa_set)) {\r
+                       CONFIG_ERROR("dhcpd_ip_mask adress setting failed\n");\r
+                       return false;\r
+               }\r
+               memcpy(&conf->dhcpd_ip_mask, &ipa_set, sizeof(struct ipv4_addr));\r
+               CONFIG_MSG("dhcpd_ip_mask = %s\n", data);\r
+       }\r
+       else if (!strncmp("dhcpd_ip_start=", full_param, len_param)) {\r
+               if (!bcm_atoipv4(data, &ipa_set)) {\r
+                       CONFIG_ERROR("dhcpd_ip_start adress setting failed\n");\r
+                       return false;\r
+               }\r
+               memcpy(&conf->dhcpd_ip_start, &ipa_set, sizeof(struct ipv4_addr));\r
+               CONFIG_MSG("dhcpd_ip_start = %s\n", data);\r
+       }\r
+       else if (!strncmp("dhcpd_ip_end=", full_param, len_param)) {\r
+               if (!bcm_atoipv4(data, &ipa_set)) {\r
+                       CONFIG_ERROR("dhcpd_ip_end adress setting failed\n");\r
+                       return false;\r
+               }\r
+               memcpy(&conf->dhcpd_ip_end, &ipa_set, sizeof(struct ipv4_addr));\r
+               CONFIG_MSG("dhcpd_ip_end = %s\n", data);\r
+       }\r
+       else\r
+               return false;\r
+\r
+       return true;\r
+}\r
+#endif\r
+\r
+#ifdef BCMSDIO\r
+bool\r
+dhd_conf_read_sdio_params(dhd_pub_t *dhd, char *full_param, uint len_param)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+       char *data = full_param+len_param;\r
+\r
+       if (!strncmp("dhd_doflow=", full_param, len_param)) {\r
+               if (!strncmp(data, "0", 1))\r
+                       dhd_doflow = FALSE;\r
+               else\r
+                       dhd_doflow = TRUE;\r
+               CONFIG_MSG("dhd_doflow = %d\n", dhd_doflow);\r
+       }\r
+       else if (!strncmp("dhd_slpauto=", full_param, len_param) ||\r
+                       !strncmp("kso_enable=", full_param, len_param)) {\r
+               if (!strncmp(data, "0", 1))\r
+                       dhd_slpauto = FALSE;\r
+               else\r
+                       dhd_slpauto = TRUE;\r
+               CONFIG_MSG("dhd_slpauto = %d\n", dhd_slpauto);\r
+       }\r
+       else if (!strncmp("use_rxchain=", full_param, len_param)) {\r
+               conf->use_rxchain = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("use_rxchain = %d\n", conf->use_rxchain);\r
+       }\r
+       else if (!strncmp("dhd_txminmax=", full_param, len_param)) {\r
+               conf->dhd_txminmax = (uint)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("dhd_txminmax = %d\n", conf->dhd_txminmax);\r
+       }\r
+       else if (!strncmp("txinrx_thres=", full_param, len_param)) {\r
+               conf->txinrx_thres = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("txinrx_thres = %d\n", conf->txinrx_thres);\r
+       }\r
+#if defined(HW_OOB)\r
+       else if (!strncmp("oob_enabled_later=", full_param, len_param)) {\r
+               if (!strncmp(data, "0", 1))\r
+                       conf->oob_enabled_later = FALSE;\r
+               else\r
+                       conf->oob_enabled_later = TRUE;\r
+               CONFIG_MSG("oob_enabled_later = %d\n", conf->oob_enabled_later);\r
+       }\r
+#endif\r
+       else if (!strncmp("dpc_cpucore=", full_param, len_param)) {\r
+               conf->dpc_cpucore = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("dpc_cpucore = %d\n", conf->dpc_cpucore);\r
+       }\r
+       else if (!strncmp("rxf_cpucore=", full_param, len_param)) {\r
+               conf->rxf_cpucore = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("rxf_cpucore = %d\n", conf->rxf_cpucore);\r
+       }\r
+#if defined(BCMSDIOH_TXGLOM)\r
+       else if (!strncmp("txglomsize=", full_param, len_param)) {\r
+               conf->txglomsize = (uint)simple_strtol(data, NULL, 10);\r
+               if (conf->txglomsize > SDPCM_MAXGLOM_SIZE)\r
+                       conf->txglomsize = SDPCM_MAXGLOM_SIZE;\r
+               CONFIG_MSG("txglomsize = %d\n", conf->txglomsize);\r
+       }\r
+       else if (!strncmp("txglom_ext=", full_param, len_param)) {\r
+               if (!strncmp(data, "0", 1))\r
+                       conf->txglom_ext = FALSE;\r
+               else\r
+                       conf->txglom_ext = TRUE;\r
+               CONFIG_MSG("txglom_ext = %d\n", conf->txglom_ext);\r
+               if (conf->txglom_ext) {\r
+                       if ((conf->chip == BCM43362_CHIP_ID) || (conf->chip == BCM4330_CHIP_ID))\r
+                               conf->txglom_bucket_size = 1680;\r
+                       else if (conf->chip == BCM43340_CHIP_ID || conf->chip == BCM43341_CHIP_ID ||\r
+                                       conf->chip == BCM4334_CHIP_ID || conf->chip == BCM4324_CHIP_ID)\r
+                               conf->txglom_bucket_size = 1684;\r
+               }\r
+               CONFIG_MSG("txglom_bucket_size = %d\n", conf->txglom_bucket_size);\r
+       }\r
+       else if (!strncmp("bus:rxglom=", full_param, len_param)) {\r
+               if (!strncmp(data, "0", 1))\r
+                       conf->bus_rxglom = FALSE;\r
+               else\r
+                       conf->bus_rxglom = TRUE;\r
+               CONFIG_MSG("bus:rxglom = %d\n", conf->bus_rxglom);\r
+       }\r
+       else if (!strncmp("deferred_tx_len=", full_param, len_param)) {\r
+               conf->deferred_tx_len = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("deferred_tx_len = %d\n", conf->deferred_tx_len);\r
+       }\r
+       else if (!strncmp("txctl_tmo_fix=", full_param, len_param)) {\r
+               conf->txctl_tmo_fix = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("txctl_tmo_fix = %d\n", conf->txctl_tmo_fix);\r
+       }\r
+       else if (!strncmp("tx_max_offset=", full_param, len_param)) {\r
+               conf->tx_max_offset = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("tx_max_offset = %d\n", conf->tx_max_offset);\r
+       }\r
+       else if (!strncmp("txglom_mode=", full_param, len_param)) {\r
+               if (!strncmp(data, "0", 1))\r
+                       conf->txglom_mode = FALSE;\r
+               else\r
+                       conf->txglom_mode = TRUE;\r
+               CONFIG_MSG("txglom_mode = %d\n", conf->txglom_mode);\r
+       }\r
+#if defined(SDIO_ISR_THREAD)\r
+       else if (!strncmp("intr_extn=", full_param, len_param)) {\r
+               if (!strncmp(data, "0", 1))\r
+                       conf->intr_extn = FALSE;\r
+               else\r
+                       conf->intr_extn = TRUE;\r
+               CONFIG_MSG("intr_extn = %d\n", conf->intr_extn);\r
+       }\r
+#endif\r
+#ifdef BCMSDIO_RXLIM_POST\r
+       else if (!strncmp("rxlim_en=", full_param, len_param)) {\r
+               if (!strncmp(data, "0", 1))\r
+                       conf->rxlim_en = FALSE;\r
+               else\r
+                       conf->rxlim_en = TRUE;\r
+               CONFIG_MSG("rxlim_en = %d\n", conf->rxlim_en);\r
+       }\r
+#endif\r
+#endif\r
+#ifdef MINIME\r
+       else if (!strncmp("ramsize=", full_param, len_param)) {\r
+               conf->ramsize = (uint32)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("ramsize = %d\n", conf->ramsize);\r
+       }\r
+#endif\r
+       else\r
+               return false;\r
+\r
+       return true;\r
+}\r
+#endif\r
+\r
+#ifdef BCMPCIE\r
+bool\r
+dhd_conf_read_pcie_params(dhd_pub_t *dhd, char *full_param, uint len_param)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+       char *data = full_param+len_param;\r
+\r
+       if (!strncmp("bus:deepsleep_disable=", full_param, len_param)) {\r
+               if (!strncmp(data, "0", 1))\r
+                       conf->bus_deepsleep_disable = 0;\r
+               else\r
+                       conf->bus_deepsleep_disable = 1;\r
+               CONFIG_MSG("bus:deepsleep_disable = %d\n", conf->bus_deepsleep_disable);\r
+       }\r
+       else\r
+               return false;\r
+\r
+       return true;\r
+}\r
+#endif\r
+\r
+bool\r
+dhd_conf_read_pm_params(dhd_pub_t *dhd, char *full_param, uint len_param)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+       char *data = full_param+len_param;\r
+\r
+       if (!strncmp("deepsleep=", full_param, len_param)) {\r
+               if (!strncmp(data, "1", 1))\r
+                       conf->deepsleep = TRUE;\r
+               else\r
+                       conf->deepsleep = FALSE;\r
+               CONFIG_MSG("deepsleep = %d\n", conf->deepsleep);\r
+       }\r
+       else if (!strncmp("PM=", full_param, len_param)) {\r
+               conf->pm = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("PM = %d\n", conf->pm);\r
+       }\r
+       else if (!strncmp("pm_in_suspend=", full_param, len_param)) {\r
+               conf->pm_in_suspend = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("pm_in_suspend = %d\n", conf->pm_in_suspend);\r
+       }\r
+       else if (!strncmp("suspend_mode=", full_param, len_param)) {\r
+               conf->suspend_mode = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("suspend_mode = %d\n", conf->suspend_mode);\r
+               if (conf->suspend_mode == PM_NOTIFIER)\r
+                       conf->insuspend |= (NO_TXDATA_IN_SUSPEND | NO_TXCTL_IN_SUSPEND);\r
+       }\r
+       else if (!strncmp("suspend_bcn_li_dtim=", full_param, len_param)) {\r
+               conf->suspend_bcn_li_dtim = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("suspend_bcn_li_dtim = %d\n", conf->suspend_bcn_li_dtim);\r
+       }\r
+       else if (!strncmp("xmit_in_suspend=", full_param, len_param)) {\r
+               if (!strncmp(data, "1", 1))\r
+                       conf->insuspend &= ~NO_TXDATA_IN_SUSPEND;\r
+               else\r
+                       conf->insuspend |= NO_TXDATA_IN_SUSPEND;\r
+               CONFIG_MSG("insuspend = 0x%x\n", conf->insuspend);\r
+       }\r
+       else if (!strncmp("insuspend=", full_param, len_param)) {\r
+               conf->insuspend = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("insuspend = 0x%x\n", conf->insuspend);\r
+       }\r
+#ifdef WL_EXT_WOWL\r
+       else if (!strncmp("wowl=", full_param, len_param)) {\r
+               conf->wowl = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("wowl = 0x%x\n", conf->wowl);\r
+       }\r
+#endif\r
+       else\r
+               return false;\r
+\r
+       return true;\r
+}\r
+\r
+#ifdef GET_CUSTOM_MAC_FROM_CONFIG\r
+int\r
+bcm_str2hex(const char *p, char *ea, int size)\r
+{\r
+       int i = 0;\r
+       char *ep;\r
+\r
+       for (;;) {\r
+               ea[i++] = (char) bcm_strtoul(p, &ep, 16);\r
+               p = ep;\r
+               if (!*p++ || i == size)\r
+                       break;\r
+       }\r
+\r
+       return (i == size);\r
+}\r
+#endif\r
+\r
+bool\r
+dhd_conf_read_others(dhd_pub_t *dhd, char *full_param, uint len_param)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+       char *data = full_param+len_param;\r
+       char *pch, *pick_tmp;\r
+       int i;\r
+#ifdef GET_CUSTOM_MAC_FROM_CONFIG\r
+       struct ether_addr ea_addr;\r
+       char macpad[56];\r
+#endif\r
+\r
+       if (!strncmp("dhd_poll=", full_param, len_param)) {\r
+               if (!strncmp(data, "0", 1))\r
+                       conf->dhd_poll = 0;\r
+               else\r
+                       conf->dhd_poll = 1;\r
+               CONFIG_MSG("dhd_poll = %d\n", conf->dhd_poll);\r
+       }\r
+       else if (!strncmp("dhd_watchdog_ms=", full_param, len_param)) {\r
+               dhd_watchdog_ms = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("dhd_watchdog_ms = %d\n", dhd_watchdog_ms);\r
+       }\r
+       else if (!strncmp("band=", full_param, len_param)) {\r
+               /* Process band:\r
+                * band=a for 5GHz only and band=b for 2.4GHz only\r
+                */\r
+               if (!strcmp(data, "b"))\r
+                       conf->band = WLC_BAND_2G;\r
+               else if (!strcmp(data, "a"))\r
+                       conf->band = WLC_BAND_5G;\r
+               else\r
+                       conf->band = WLC_BAND_AUTO;\r
+               CONFIG_MSG("band = %d\n", conf->band);\r
+       }\r
+       else if (!strncmp("bw_cap_2g=", full_param, len_param)) {\r
+               conf->bw_cap[0] = (uint)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("bw_cap_2g = %d\n", conf->bw_cap[0]);\r
+       }\r
+       else if (!strncmp("bw_cap_5g=", full_param, len_param)) {\r
+               conf->bw_cap[1] = (uint)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("bw_cap_5g = %d\n", conf->bw_cap[1]);\r
+       }\r
+       else if (!strncmp("bw_cap=", full_param, len_param)) {\r
+               pick_tmp = data;\r
+               pch = bcmstrtok(&pick_tmp, " ,.-", 0);\r
+               if (pch != NULL) {\r
+                       conf->bw_cap[0] = (uint32)simple_strtol(pch, NULL, 0);\r
+                       CONFIG_MSG("bw_cap 2g = %d\n", conf->bw_cap[0]);\r
+               }\r
+               pch = bcmstrtok(&pick_tmp, " ,.-", 0);\r
+               if (pch != NULL) {\r
+                       conf->bw_cap[1] = (uint32)simple_strtol(pch, NULL, 0);\r
+                       CONFIG_MSG("bw_cap 5g = %d\n", conf->bw_cap[1]);\r
+               }\r
+       }\r
+       else if (!strncmp("channels=", full_param, len_param)) {\r
+               pick_tmp = data;\r
+               pch = bcmstrtok(&pick_tmp, " ,.-", 0);\r
+               i=0;\r
+               while (pch != NULL && i<WL_NUMCHANNELS) {\r
+                       conf->channels.channel[i] = (uint32)simple_strtol(pch, NULL, 10);\r
+                       pch = bcmstrtok(&pick_tmp, " ,.-", 0);\r
+                       i++;\r
+               }\r
+               conf->channels.count = i;\r
+               CONFIG_MSG("channels = ");\r
+               for (i=0; i<conf->channels.count; i++)\r
+                       printf("%d ", conf->channels.channel[i]);\r
+               printf("\n");\r
+       }\r
+       else if (!strncmp("keep_alive_period=", full_param, len_param)) {\r
+               conf->keep_alive_period = (uint)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("keep_alive_period = %d\n", conf->keep_alive_period);\r
+       }\r
+#ifdef ARP_OFFLOAD_SUPPORT\r
+       else if (!strncmp("garp=", full_param, len_param)) {\r
+               if (!strncmp(data, "0", 1))\r
+                       conf->garp = FALSE;\r
+               else\r
+                       conf->garp = TRUE;\r
+               CONFIG_MSG("garp = %d\n", conf->garp);\r
+       }\r
+#endif\r
+       else if (!strncmp("srl=", full_param, len_param)) {\r
+               conf->srl = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("srl = %d\n", conf->srl);\r
+       }\r
+       else if (!strncmp("lrl=", full_param, len_param)) {\r
+               conf->lrl = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("lrl = %d\n", conf->lrl);\r
+       }\r
+       else if (!strncmp("bcn_timeout=", full_param, len_param)) {\r
+               conf->bcn_timeout= (uint)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("bcn_timeout = %d\n", conf->bcn_timeout);\r
+       }\r
+       else if (!strncmp("frameburst=", full_param, len_param)) {\r
+               conf->frameburst = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("frameburst = %d\n", conf->frameburst);\r
+       }\r
+       else if (!strncmp("disable_proptx=", full_param, len_param)) {\r
+               conf->disable_proptx = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("disable_proptx = %d\n", conf->disable_proptx);\r
+       }\r
+#ifdef DHDTCPACK_SUPPRESS\r
+       else if (!strncmp("tcpack_sup_mode=", full_param, len_param)) {\r
+               conf->tcpack_sup_mode = (uint)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("tcpack_sup_mode = %d\n", conf->tcpack_sup_mode);\r
+       }\r
+#endif\r
+       else if (!strncmp("pktprio8021x=", full_param, len_param)) {\r
+               conf->pktprio8021x = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("pktprio8021x = %d\n", conf->pktprio8021x);\r
+       }\r
+#if defined(BCMSDIO) || defined(BCMPCIE)\r
+       else if (!strncmp("dhd_txbound=", full_param, len_param)) {\r
+               dhd_txbound = (uint)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("dhd_txbound = %d\n", dhd_txbound);\r
+       }\r
+       else if (!strncmp("dhd_rxbound=", full_param, len_param)) {\r
+               dhd_rxbound = (uint)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("dhd_rxbound = %d\n", dhd_rxbound);\r
+       }\r
+#endif\r
+       else if (!strncmp("orphan_move=", full_param, len_param)) {\r
+               conf->orphan_move = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("orphan_move = %d\n", conf->orphan_move);\r
+       }\r
+       else if (!strncmp("tsq=", full_param, len_param)) {\r
+               conf->tsq = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("tsq = %d\n", conf->tsq);\r
+       }\r
+       else if (!strncmp("ctrl_resched=", full_param, len_param)) {\r
+               conf->ctrl_resched = (int)simple_strtol(data, NULL, 10);\r
+               CONFIG_MSG("ctrl_resched = %d\n", conf->ctrl_resched);\r
+       }\r
+       else if (!strncmp("in4way=", full_param, len_param)) {\r
+               conf->in4way = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("in4way = 0x%x\n", conf->in4way);\r
+       }\r
+       else if (!strncmp("wl_preinit=", full_param, len_param)) {\r
+               if (conf->wl_preinit) {\r
+                       kfree(conf->wl_preinit);\r
+                       conf->wl_preinit = NULL;\r
+               }\r
+               if (!(conf->wl_preinit = kmalloc(len_param+1, GFP_KERNEL))) {\r
+                       CONFIG_ERROR("kmalloc failed\n");\r
+               } else {\r
+                       memset(conf->wl_preinit, 0, len_param+1);\r
+                       strcpy(conf->wl_preinit, data);\r
+                       CONFIG_MSG("wl_preinit = %s\n", conf->wl_preinit);\r
+               }\r
+       }\r
+       else if (!strncmp("wl_suspend=", full_param, len_param)) {\r
+               if (conf->wl_suspend) {\r
+                       kfree(conf->wl_suspend);\r
+                       conf->wl_suspend = NULL;\r
+               }\r
+               if (!(conf->wl_suspend = kmalloc(len_param+1, GFP_KERNEL))) {\r
+                       CONFIG_ERROR("kmalloc failed\n");\r
+               } else {\r
+                       memset(conf->wl_suspend, 0, len_param+1);\r
+                       strcpy(conf->wl_suspend, data);\r
+                       CONFIG_MSG("wl_suspend = %s\n", conf->wl_suspend);\r
+               }\r
+       }\r
+       else if (!strncmp("wl_resume=", full_param, len_param)) {\r
+               if (conf->wl_resume) {\r
+                       kfree(conf->wl_resume);\r
+                       conf->wl_resume = NULL;\r
+               }\r
+               if (!(conf->wl_resume = kmalloc(len_param+1, GFP_KERNEL))) {\r
+                       CONFIG_ERROR("kmalloc failed\n");\r
+               } else {\r
+                       memset(conf->wl_resume, 0, len_param+1);\r
+                       strcpy(conf->wl_resume, data);\r
+                       CONFIG_MSG("wl_resume = %s\n", conf->wl_resume);\r
+               }\r
+       }\r
+#ifdef GET_CUSTOM_MAC_FROM_CONFIG\r
+       else if (!strncmp("mac=", full_param, len_param)) {\r
+               if (!bcm_ether_atoe(data, &ea_addr)) {\r
+                       CONFIG_ERROR("mac adress read error");\r
+                       return false;\r
+               }\r
+               memcpy(&conf->hw_ether, &ea_addr, ETHER_ADDR_LEN);\r
+               CONFIG_MSG("mac = %s\n", data);\r
+       }\r
+       else if (!strncmp("macpad=", full_param, len_param)) {\r
+               if (!bcm_str2hex(data, macpad, sizeof(macpad))) {\r
+                       CONFIG_ERROR("macpad adress read error");\r
+                       return false;\r
+               }\r
+               memcpy(&conf->hw_ether[ETHER_ADDR_LEN], macpad, sizeof(macpad));\r
+               if (config_msg_level & CONFIG_TRACE_LEVEL) {\r
+                       printf("macpad =\n");\r
+                       for (i=0; i<sizeof(macpad); i++) {\r
+                               printf("0x%02x, ", conf->hw_ether[ETHER_ADDR_LEN+i]);\r
+                               if ((i+1)%8 == 0)\r
+                                       printf("\n");\r
+                       }\r
+               }\r
+       }\r
+#endif\r
+#ifdef PROPTX_MAXCOUNT\r
+       else if (!strncmp("proptx_maxcnt_2g=", full_param, len_param)) {\r
+               conf->proptx_maxcnt_2g = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("proptx_maxcnt_2g = 0x%x\n", conf->proptx_maxcnt_2g);\r
+       }\r
+       else if (!strncmp("proptx_maxcnt_5g=", full_param, len_param)) {\r
+               conf->proptx_maxcnt_5g = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("proptx_maxcnt_5g = 0x%x\n", conf->proptx_maxcnt_5g);\r
+       }\r
+#endif\r
+#ifdef HOST_TPUT_TEST\r
+       else if (!strncmp("data_drop_mode=", full_param, len_param)) {\r
+               conf->data_drop_mode = (int)simple_strtol(data, NULL, 0);\r
+               CONFIG_MSG("data_drop_mode = 0x%x\n", conf->data_drop_mode);\r
+       }\r
+#endif\r
+       else\r
+               return false;\r
+\r
+       return true;\r
+}\r
+\r
+int\r
+dhd_conf_read_config(dhd_pub_t *dhd, char *conf_path)\r
+{\r
+       int bcmerror = -1, chip_match = -1;\r
+       uint len = 0, start_pos=0, end_pos=0;\r
+       void *image = NULL;\r
+       char *memblock = NULL;\r
+       char *bufp, *pick = NULL, *pch;\r
+       bool conf_file_exists;\r
+       uint len_param;\r
+\r
+       conf_file_exists = ((conf_path != NULL) && (conf_path[0] != '\0'));\r
+       if (!conf_file_exists) {\r
+               CONFIG_MSG("config path %s\n", conf_path);\r
+               return (0);\r
+       }\r
+\r
+       if (conf_file_exists) {\r
+               image = dhd_os_open_image1(dhd, conf_path);\r
+               if (image == NULL) {\r
+                       CONFIG_MSG("Ignore config file %s\n", conf_path);\r
+                       goto err;\r
+               }\r
+       }\r
+\r
+       memblock = MALLOC(dhd->osh, MAXSZ_CONFIG);\r
+       if (memblock == NULL) {\r
+               CONFIG_ERROR("Failed to allocate memory %d bytes\n", MAXSZ_CONFIG);\r
+               goto err;\r
+       }\r
+\r
+       pick = MALLOC(dhd->osh, MAXSZ_BUF);\r
+       if (!pick) {\r
+               CONFIG_ERROR("Failed to allocate memory %d bytes\n", MAXSZ_BUF);\r
+               goto err;\r
+       }\r
+\r
+       /* Read variables */\r
+       if (conf_file_exists) {\r
+               len = dhd_os_get_image_block(memblock, MAXSZ_CONFIG, image);\r
+       }\r
+       if (len > 0 && len < MAXSZ_CONFIG) {\r
+               bufp = (char *)memblock;\r
+               bufp[len] = 0;\r
+\r
+               while (start_pos < len) {\r
+                       memset(pick, 0, MAXSZ_BUF);\r
+                       end_pos = pick_config_vars(bufp, len, start_pos, pick, MAXSZ_BUF);\r
+                       if (end_pos - start_pos >= MAXSZ_BUF)\r
+                               CONFIG_ERROR("out of buf to read MAXSIZ_BUF=%d\n", MAXSZ_BUF);\r
+                       start_pos = end_pos;\r
+                       pch = strchr(pick, '=');\r
+                       if (pch != NULL) {\r
+                               len_param = pch-pick+1;\r
+                               if (len_param == strlen(pick)) {\r
+                                       CONFIG_ERROR("not a right parameter %s\n", pick);\r
+                                       continue;\r
+                               }\r
+                       } else {\r
+                               CONFIG_ERROR("not a right parameter %s\n", pick);\r
+                               continue;\r
+                       }\r
+\r
+                       dhd_conf_read_chiprev(dhd, &chip_match, pick, len_param);\r
+                       if (!chip_match)\r
+                               continue;\r
+\r
+                       if (dhd_conf_read_log_level(dhd, pick, len_param))\r
+                               continue;\r
+                       else if (dhd_conf_read_roam_params(dhd, pick, len_param))\r
+                               continue;\r
+                       else if (dhd_conf_read_wme_ac_params(dhd, pick, len_param))\r
+                               continue;\r
+#ifdef BCMSDIO\r
+                       else if (dhd_conf_read_fw_by_mac(dhd, pick, len_param))\r
+                               continue;\r
+                       else if (dhd_conf_read_nv_by_mac(dhd, pick, len_param))\r
+                               continue;\r
+#endif\r
+                       else if (dhd_conf_read_nv_by_chip(dhd, pick, len_param))\r
+                               continue;\r
+                       else if (dhd_conf_read_country(dhd, pick, len_param))\r
+                               continue;\r
+                       else if (dhd_conf_read_mchan_params(dhd, pick, len_param))\r
+                               continue;\r
+#ifdef PKT_FILTER_SUPPORT\r
+                       else if (dhd_conf_read_pkt_filter(dhd, pick, len_param))\r
+                               continue;\r
+#endif /* PKT_FILTER_SUPPORT */\r
+#ifdef ISAM_PREINIT\r
+                       else if (dhd_conf_read_isam(dhd, pick, len_param))\r
+                               continue;\r
+#endif /* ISAM_PREINIT */\r
+#ifdef IDHCP\r
+                       else if (dhd_conf_read_dhcp_params(dhd, pick, len_param))\r
+                               continue;\r
+#endif /* IDHCP */\r
+#ifdef BCMSDIO\r
+                       else if (dhd_conf_read_sdio_params(dhd, pick, len_param))\r
+                               continue;\r
+#endif /* BCMSDIO */\r
+#ifdef BCMPCIE\r
+                       else if (dhd_conf_read_pcie_params(dhd, pick, len_param))\r
+                               continue;\r
+#endif /* BCMPCIE */\r
+                       else if (dhd_conf_read_pm_params(dhd, pick, len_param))\r
+                               continue;\r
+                       else if (dhd_conf_read_others(dhd, pick, len_param))\r
+                               continue;\r
+                       else\r
+                               continue;\r
+               }\r
+\r
+               bcmerror = 0;\r
+       } else {\r
+               CONFIG_ERROR("error reading config file: %d\n", len);\r
+               bcmerror = BCME_SDIO_ERROR;\r
+       }\r
+\r
+err:\r
+       if (pick)\r
+               MFREE(dhd->osh, pick, MAXSZ_BUF);\r
+\r
+       if (memblock)\r
+               MFREE(dhd->osh, memblock, MAXSZ_CONFIG);\r
+\r
+       if (image)\r
+               dhd_os_close_image1(dhd, image);\r
+\r
+       return bcmerror;\r
+}\r
+\r
+int\r
+dhd_conf_set_chiprev(dhd_pub_t *dhd, uint chip, uint chiprev)\r
+{\r
+       CONFIG_MSG("chip=0x%x, chiprev=%d\n", chip, chiprev);\r
+       dhd->conf->chip = chip;\r
+       dhd->conf->chiprev = chiprev;\r
+       return 0;\r
+}\r
+\r
+uint\r
+dhd_conf_get_chip(void *context)\r
+{\r
+       dhd_pub_t *dhd = context;\r
+\r
+       if (dhd && dhd->conf)\r
+               return dhd->conf->chip;\r
+       return 0;\r
+}\r
+\r
+uint\r
+dhd_conf_get_chiprev(void *context)\r
+{\r
+       dhd_pub_t *dhd = context;\r
+\r
+       if (dhd && dhd->conf)\r
+               return dhd->conf->chiprev;\r
+       return 0;\r
+}\r
+\r
+#ifdef BCMSDIO\r
+void\r
+dhd_conf_set_txglom_params(dhd_pub_t *dhd, bool enable)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+\r
+       if (enable) {\r
+#if defined(BCMSDIOH_TXGLOM_EXT)\r
+               if (conf->chip == BCM43362_CHIP_ID || conf->chip == BCM4330_CHIP_ID ||\r
+                               conf->chip == BCM43340_CHIP_ID || conf->chip == BCM43341_CHIP_ID ||\r
+                               conf->chip == BCM4334_CHIP_ID || conf->chip == BCM4324_CHIP_ID) {\r
+                       conf->txglom_mode = SDPCM_TXGLOM_CPY;\r
+               }\r
+#endif\r
+               // other parameters set in preinit or config.txt\r
+               if (conf->txglom_ext)\r
+                       CONFIG_MSG("txglom_ext=%d, txglom_bucket_size=%d\n",\r
+                               conf->txglom_ext, conf->txglom_bucket_size);\r
+               CONFIG_MSG("txglom_mode=%s\n",\r
+                       conf->txglom_mode==SDPCM_TXGLOM_MDESC?"multi-desc":"copy");\r
+               CONFIG_MSG("txglomsize=%d, deferred_tx_len=%d\n",\r
+                       conf->txglomsize, conf->deferred_tx_len);\r
+               CONFIG_MSG("txinrx_thres=%d, dhd_txminmax=%d\n",\r
+                       conf->txinrx_thres, conf->dhd_txminmax);\r
+               CONFIG_MSG("tx_max_offset=%d, txctl_tmo_fix=%d\n",\r
+                       conf->tx_max_offset, conf->txctl_tmo_fix);\r
+       } else {\r
+               // clear txglom parameters\r
+               conf->txglom_ext = FALSE;\r
+               conf->txglom_bucket_size = 0;\r
+               conf->txglomsize = 0;\r
+               conf->deferred_tx_len = 0;\r
+       }\r
+\r
+}\r
+#endif\r
+\r
+void\r
+dhd_conf_postinit_ioctls(dhd_pub_t *dhd)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+       char wl_preinit[] = "assoc_retry_max=20";\r
+#ifdef NO_POWER_SAVE\r
+       char wl_no_power_save[] = "mpc=0, 86=0";\r
+       dhd_conf_set_wl_cmd(dhd, wl_no_power_save, FALSE);\r
+#endif\r
+\r
+       dhd_conf_set_intiovar(dhd, WLC_UP, "WLC_UP", 0, 0, FALSE);\r
+       dhd_conf_map_country_list(dhd, &conf->cspec);\r
+       dhd_conf_set_country(dhd, &conf->cspec);\r
+       dhd_conf_fix_country(dhd);\r
+       dhd_conf_get_country(dhd, &dhd->dhd_cspec);\r
+\r
+       dhd_conf_set_intiovar(dhd, WLC_SET_BAND, "WLC_SET_BAND", conf->band, 0, FALSE);\r
+       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "bcn_timeout", conf->bcn_timeout, 0, FALSE);\r
+       dhd_conf_set_intiovar(dhd, WLC_SET_PM, "WLC_SET_PM", conf->pm, 0, FALSE);\r
+       dhd_conf_set_intiovar(dhd, WLC_SET_SRL, "WLC_SET_SRL", conf->srl, 0, FALSE);\r
+       dhd_conf_set_intiovar(dhd, WLC_SET_LRL, "WLC_SET_LRL", conf->lrl, 0, FALSE);\r
+       dhd_conf_set_bw_cap(dhd);\r
+       dhd_conf_set_roam(dhd);\r
+\r
+#if defined(BCMPCIE)\r
+       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "bus:deepsleep_disable",\r
+               conf->bus_deepsleep_disable, 0, FALSE);\r
+#endif /* defined(BCMPCIE) */\r
+\r
+#ifdef IDHCP\r
+       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "dhcpc_enable", conf->dhcpc_enable,\r
+               0, FALSE);\r
+       if (conf->dhcpd_enable >= 0) {\r
+               dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "dhcpd_ip_addr",\r
+                       (char *)&conf->dhcpd_ip_addr, sizeof(conf->dhcpd_ip_addr), FALSE);\r
+               dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "dhcpd_ip_mask",\r
+                       (char *)&conf->dhcpd_ip_mask, sizeof(conf->dhcpd_ip_mask), FALSE);\r
+               dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "dhcpd_ip_start",\r
+                       (char *)&conf->dhcpd_ip_start, sizeof(conf->dhcpd_ip_start), FALSE);\r
+               dhd_conf_set_bufiovar(dhd, 0, WLC_SET_VAR, "dhcpd_ip_end",\r
+                       (char *)&conf->dhcpd_ip_end, sizeof(conf->dhcpd_ip_end), FALSE);\r
+               dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "dhcpd_enable",\r
+                       conf->dhcpd_enable, 0, FALSE);\r
+       }\r
+#endif\r
+       dhd_conf_set_intiovar(dhd, WLC_SET_FAKEFRAG, "WLC_SET_FAKEFRAG",\r
+               conf->frameburst, 0, FALSE);\r
+\r
+       dhd_conf_set_wl_cmd(dhd, wl_preinit, TRUE);\r
+#if defined(BCMSDIO)\r
+       {\r
+               char ampdu_mpdu[] = "ampdu_mpdu=16";\r
+               dhd_conf_set_wl_cmd(dhd, ampdu_mpdu, TRUE);\r
+       }\r
+#endif\r
+       if (conf->chip == BCM4354_CHIP_ID || conf->chip == BCM4356_CHIP_ID ||\r
+                       conf->chip == BCM4371_CHIP_ID || conf->chip == BCM4359_CHIP_ID ||\r
+                       conf->chip == BCM43569_CHIP_ID ||\r
+                       conf->chip == BCM43751_CHIP_ID || conf->chip == BCM43752_CHIP_ID) {\r
+               dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "txbf", 1, 0, FALSE);\r
+       }\r
+#if defined(WLEASYMESH)\r
+       {\r
+               char ezmesh[] = "mbss=1, rsdb_mode=0";\r
+               dhd_conf_set_wl_cmd(dhd, ezmesh, TRUE);\r
+       }\r
+#endif\r
+       dhd_conf_set_wl_cmd(dhd, conf->wl_preinit, TRUE);\r
+\r
+#ifndef WL_CFG80211\r
+       dhd_conf_set_intiovar(dhd, WLC_UP, "WLC_UP", 0, 0, FALSE);\r
+#endif\r
+\r
+}\r
+\r
+int\r
+dhd_conf_preinit(dhd_pub_t *dhd)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+\r
+       CONFIG_TRACE("Enter\n");\r
+\r
+#ifdef BCMSDIO\r
+       dhd_conf_free_mac_list(&conf->fw_by_mac);\r
+       dhd_conf_free_mac_list(&conf->nv_by_mac);\r
+#endif\r
+       dhd_conf_free_chip_nv_path_list(&conf->nv_by_chip);\r
+       dhd_conf_free_country_list(conf);\r
+       dhd_conf_free_mchan_list(conf);\r
+       if (conf->magic_pkt_filter_add) {\r
+               kfree(conf->magic_pkt_filter_add);\r
+               conf->magic_pkt_filter_add = NULL;\r
+       }\r
+       if (conf->wl_preinit) {\r
+               kfree(conf->wl_preinit);\r
+               conf->wl_preinit = NULL;\r
+       }\r
+       if (conf->wl_suspend) {\r
+               kfree(conf->wl_suspend);\r
+               conf->wl_suspend = NULL;\r
+       }\r
+       if (conf->wl_resume) {\r
+               kfree(conf->wl_resume);\r
+               conf->wl_resume = NULL;\r
+       }\r
+       conf->band = -1;\r
+       memset(&conf->bw_cap, -1, sizeof(conf->bw_cap));\r
+       if (conf->chip == BCM43362_CHIP_ID || conf->chip == BCM4330_CHIP_ID) {\r
+               strcpy(conf->cspec.country_abbrev, "ALL");\r
+               strcpy(conf->cspec.ccode, "ALL");\r
+               conf->cspec.rev = 0;\r
+       } else if (conf->chip == BCM4335_CHIP_ID || conf->chip == BCM4339_CHIP_ID ||\r
+                       conf->chip == BCM4354_CHIP_ID || conf->chip == BCM4356_CHIP_ID ||\r
+                       conf->chip == BCM4345_CHIP_ID || conf->chip == BCM4371_CHIP_ID ||\r
+                       conf->chip == BCM43569_CHIP_ID || conf->chip == BCM4359_CHIP_ID) {\r
+               strcpy(conf->cspec.country_abbrev, "CN");\r
+               strcpy(conf->cspec.ccode, "CN");\r
+               conf->cspec.rev = 38;\r
+       } else {\r
+               strcpy(conf->cspec.country_abbrev, "CN");\r
+               strcpy(conf->cspec.ccode, "CN");\r
+               conf->cspec.rev = 0;\r
+       }\r
+       memset(&conf->channels, 0, sizeof(wl_channel_list_t));\r
+       conf->roam_off = 1;\r
+       conf->roam_off_suspend = 1;\r
+       conf->roam_trigger[0] = -65;\r
+       conf->roam_trigger[1] = WLC_BAND_ALL;\r
+       conf->roam_scan_period[0] = 10;\r
+       conf->roam_scan_period[1] = WLC_BAND_ALL;\r
+       conf->roam_delta[0] = 10;\r
+       conf->roam_delta[1] = WLC_BAND_ALL;\r
+       conf->fullroamperiod = 20;\r
+       conf->keep_alive_period = 30000;\r
+#ifdef ARP_OFFLOAD_SUPPORT\r
+       conf->garp = FALSE;\r
+#endif\r
+       conf->force_wme_ac = 0;\r
+       memset(&conf->wme_sta, 0, sizeof(wme_param_t));\r
+       memset(&conf->wme_ap, 0, sizeof(wme_param_t));\r
+#ifdef PKT_FILTER_SUPPORT\r
+       memset(&conf->pkt_filter_add, 0, sizeof(conf_pkt_filter_add_t));\r
+       memset(&conf->pkt_filter_del, 0, sizeof(conf_pkt_filter_del_t));\r
+#endif\r
+       conf->srl = -1;\r
+       conf->lrl = -1;\r
+       conf->bcn_timeout = 16;\r
+       conf->disable_proptx = -1;\r
+       conf->dhd_poll = -1;\r
+#ifdef BCMSDIO\r
+       conf->use_rxchain = 0;\r
+       conf->bus_rxglom = TRUE;\r
+       conf->txglom_ext = FALSE;\r
+       conf->tx_max_offset = 0;\r
+       conf->txglomsize = SDPCM_DEFGLOM_SIZE;\r
+       conf->txctl_tmo_fix = 300;\r
+       conf->txglom_mode = SDPCM_TXGLOM_MDESC;\r
+       conf->deferred_tx_len = 0;\r
+       conf->dhd_txminmax = 1;\r
+       conf->txinrx_thres = -1;\r
+#ifdef MINIME\r
+       conf->ramsize = 0x80000;\r
+#endif\r
+#if defined(SDIO_ISR_THREAD)\r
+       conf->intr_extn = FALSE;\r
+#endif\r
+#ifdef BCMSDIO_RXLIM_POST\r
+       conf->rxlim_en = TRUE;\r
+#endif\r
+#if defined(HW_OOB)\r
+       conf->oob_enabled_later = FALSE;\r
+#endif\r
+#endif\r
+#ifdef BCMPCIE\r
+       conf->bus_deepsleep_disable = 1;\r
+#endif\r
+       conf->dpc_cpucore = -1;\r
+       conf->rxf_cpucore = -1;\r
+       conf->frameburst = -1;\r
+       conf->deepsleep = FALSE;\r
+       conf->pm = -1;\r
+       conf->pm_in_suspend = -1;\r
+       conf->insuspend = 0;\r
+       conf->suspend_mode = EARLY_SUSPEND;\r
+       conf->suspend_bcn_li_dtim = -1;\r
+#ifdef WL_EXT_WOWL\r
+       dhd_master_mode = TRUE;\r
+       conf->wowl = WL_WOWL_NET|WL_WOWL_DIS|WL_WOWL_BCN;\r
+       conf->insuspend |= (WOWL_IN_SUSPEND | NO_TXDATA_IN_SUSPEND);\r
+#endif\r
+       if (conf->suspend_mode == PM_NOTIFIER)\r
+               conf->insuspend |= (NO_TXDATA_IN_SUSPEND | NO_TXCTL_IN_SUSPEND);\r
+       conf->suspended = FALSE;\r
+#ifdef SUSPEND_EVENT\r
+       memset(&conf->resume_eventmask, 0, sizeof(conf->resume_eventmask));\r
+       memset(&conf->bssid_insuspend, 0, ETHER_ADDR_LEN);\r
+       conf->wlfc = FALSE;\r
+#endif\r
+#ifdef GET_CUSTOM_MAC_FROM_CONFIG\r
+       memset(&conf->hw_ether, 0, sizeof(conf->hw_ether));\r
+#endif\r
+#ifdef IDHCP\r
+       conf->dhcpc_enable = -1;\r
+       conf->dhcpd_enable = -1;\r
+#endif\r
+       conf->orphan_move = 0;\r
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0))\r
+       conf->tsq = 10;\r
+#else\r
+       conf->tsq = 0;\r
+#endif\r
+#ifdef DHDTCPACK_SUPPRESS\r
+#ifdef BCMPCIE\r
+       conf->tcpack_sup_mode = TCPACK_SUP_HOLD;\r
+#else\r
+       conf->tcpack_sup_mode = TCPACK_SUP_OFF;\r
+#endif\r
+#endif\r
+       conf->pktprio8021x = -1;\r
+       conf->ctrl_resched = 2;\r
+       conf->in4way = NO_SCAN_IN4WAY | DONT_DELETE_GC_AFTER_WPS | WAIT_DISCONNECTED;\r
+#ifdef PROPTX_MAXCOUNT\r
+       conf->proptx_maxcnt_2g = 46;\r
+       conf->proptx_maxcnt_5g = WL_TXSTATUS_FREERUNCTR_MASK;\r
+#endif /* DYNAMIC_PROPTX_MAXCOUNT */\r
+#ifdef HOST_TPUT_TEST\r
+       conf->data_drop_mode = 0;\r
+#endif\r
+#ifdef ISAM_PREINIT\r
+       memset(conf->isam_init, 0, sizeof(conf->isam_init));\r
+       memset(conf->isam_config, 0, sizeof(conf->isam_config));\r
+       memset(conf->isam_enable, 0, sizeof(conf->isam_enable));\r
+#endif\r
+#ifdef CUSTOMER_HW_AMLOGIC\r
+       dhd_slpauto = FALSE;\r
+#ifdef BCMSDIO\r
+       conf->txglom_mode = SDPCM_TXGLOM_CPY;\r
+#endif\r
+#endif\r
+#if defined(SDIO_ISR_THREAD)\r
+       if (conf->chip == BCM43012_CHIP_ID ||\r
+                       conf->chip == BCM4335_CHIP_ID || conf->chip == BCM4339_CHIP_ID ||\r
+                       conf->chip == BCM43454_CHIP_ID || conf->chip == BCM4345_CHIP_ID ||\r
+                       conf->chip == BCM4354_CHIP_ID || conf->chip == BCM4356_CHIP_ID ||\r
+                       conf->chip == BCM4345_CHIP_ID || conf->chip == BCM4371_CHIP_ID ||\r
+                       conf->chip == BCM4359_CHIP_ID ||\r
+                       conf->chip == BCM43751_CHIP_ID || conf->chip == BCM43752_CHIP_ID) {\r
+               conf->intr_extn = TRUE;\r
+       }\r
+#endif\r
+       if ((conf->chip == BCM43430_CHIP_ID && conf->chiprev == 2) ||\r
+                       conf->chip == BCM43012_CHIP_ID ||\r
+                       conf->chip == BCM4335_CHIP_ID || conf->chip == BCM4339_CHIP_ID ||\r
+                       conf->chip == BCM43454_CHIP_ID || conf->chip == BCM4345_CHIP_ID ||\r
+                       conf->chip == BCM4354_CHIP_ID || conf->chip == BCM4356_CHIP_ID ||\r
+                       conf->chip == BCM4345_CHIP_ID || conf->chip == BCM4371_CHIP_ID ||\r
+                       conf->chip == BCM43569_CHIP_ID || conf->chip == BCM4359_CHIP_ID ||\r
+                       conf->chip == BCM43751_CHIP_ID || conf->chip == BCM43752_CHIP_ID) {\r
+#ifdef DHDTCPACK_SUPPRESS\r
+#ifdef BCMSDIO\r
+               conf->tcpack_sup_mode = TCPACK_SUP_REPLACE;\r
+#endif\r
+#endif\r
+#if defined(BCMSDIO) || defined(BCMPCIE)\r
+               dhd_rxbound = 128;\r
+               dhd_txbound = 64;\r
+#endif\r
+               conf->frameburst = 1;\r
+#ifdef BCMSDIO\r
+               conf->dhd_txminmax = -1;\r
+               conf->txinrx_thres = 128;\r
+#endif\r
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0))\r
+               conf->orphan_move = 1;\r
+#else\r
+               conf->orphan_move = 0;\r
+#endif\r
+       }\r
+\r
+#ifdef BCMSDIO\r
+#if defined(BCMSDIOH_TXGLOM_EXT)\r
+       if (conf->chip == BCM43362_CHIP_ID || conf->chip == BCM4330_CHIP_ID ||\r
+                       conf->chip == BCM43340_CHIP_ID || conf->chip == BCM43341_CHIP_ID ||\r
+                       conf->chip == BCM4334_CHIP_ID || conf->chip == BCM4324_CHIP_ID) {\r
+               conf->txglom_ext = TRUE;\r
+       } else {\r
+               conf->txglom_ext = FALSE;\r
+       }\r
+       if (conf->chip == BCM43362_CHIP_ID || conf->chip == BCM4330_CHIP_ID) {\r
+               conf->txglom_bucket_size = 1680; // fixed value, don't change\r
+               conf->txglomsize = 6;\r
+       }\r
+       if (conf->chip == BCM4334_CHIP_ID || conf->chip == BCM43340_CHIP_ID ||\r
+                       conf->chip == BCM43341_CHIP_ID || conf->chip == BCM4324_CHIP_ID) {\r
+               conf->txglom_bucket_size = 1684; // fixed value, don't change\r
+               conf->txglomsize = 16;\r
+       }\r
+#endif\r
+       if (conf->txglomsize > SDPCM_MAXGLOM_SIZE)\r
+               conf->txglomsize = SDPCM_MAXGLOM_SIZE;\r
+#endif\r
+       init_waitqueue_head(&conf->event_complete);\r
+\r
+       return 0;\r
+}\r
+\r
+int\r
+dhd_conf_reset(dhd_pub_t *dhd)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+\r
+#ifdef BCMSDIO\r
+       dhd_conf_free_mac_list(&conf->fw_by_mac);\r
+       dhd_conf_free_mac_list(&conf->nv_by_mac);\r
+#endif\r
+       dhd_conf_free_chip_nv_path_list(&conf->nv_by_chip);\r
+       dhd_conf_free_country_list(conf);\r
+       dhd_conf_free_mchan_list(conf);\r
+       if (conf->magic_pkt_filter_add) {\r
+               kfree(conf->magic_pkt_filter_add);\r
+               conf->magic_pkt_filter_add = NULL;\r
+       }\r
+       if (conf->wl_preinit) {\r
+               kfree(conf->wl_preinit);\r
+               conf->wl_preinit = NULL;\r
+       }\r
+       if (conf->wl_suspend) {\r
+               kfree(conf->wl_suspend);\r
+               conf->wl_suspend = NULL;\r
+       }\r
+       if (conf->wl_resume) {\r
+               kfree(conf->wl_resume);\r
+               conf->wl_resume = NULL;\r
+       }\r
+       memset(conf, 0, sizeof(dhd_conf_t));\r
+       return 0;\r
+}\r
+\r
+int\r
+dhd_conf_attach(dhd_pub_t *dhd)\r
+{\r
+       dhd_conf_t *conf;\r
+\r
+       CONFIG_TRACE("Enter\n");\r
+\r
+       if (dhd->conf != NULL) {\r
+               CONFIG_MSG("config is attached before!\n");\r
+               return 0;\r
+       }\r
+       /* Allocate private bus interface state */\r
+       if (!(conf = MALLOC(dhd->osh, sizeof(dhd_conf_t)))) {\r
+               CONFIG_ERROR("MALLOC failed\n");\r
+               goto fail;\r
+       }\r
+       memset(conf, 0, sizeof(dhd_conf_t));\r
+\r
+       dhd->conf = conf;\r
+\r
+       return 0;\r
+\r
+fail:\r
+       if (conf != NULL)\r
+               MFREE(dhd->osh, conf, sizeof(dhd_conf_t));\r
+       return BCME_NOMEM;\r
+}\r
+\r
+void\r
+dhd_conf_detach(dhd_pub_t *dhd)\r
+{\r
+       struct dhd_conf *conf = dhd->conf;\r
+\r
+       CONFIG_TRACE("Enter\n");\r
+       if (dhd->conf) {\r
+#ifdef BCMSDIO\r
+               dhd_conf_free_mac_list(&conf->fw_by_mac);\r
+               dhd_conf_free_mac_list(&conf->nv_by_mac);\r
+#endif\r
+               dhd_conf_free_chip_nv_path_list(&conf->nv_by_chip);\r
+               dhd_conf_free_country_list(conf);\r
+               dhd_conf_free_mchan_list(conf);\r
+               if (conf->magic_pkt_filter_add) {\r
+                       kfree(conf->magic_pkt_filter_add);\r
+                       conf->magic_pkt_filter_add = NULL;\r
+               }\r
+               if (conf->wl_preinit) {\r
+                       kfree(conf->wl_preinit);\r
+                       conf->wl_preinit = NULL;\r
+               }\r
+               if (conf->wl_suspend) {\r
+                       kfree(conf->wl_suspend);\r
+                       conf->wl_suspend = NULL;\r
+               }\r
+               if (conf->wl_resume) {\r
+                       kfree(conf->wl_resume);\r
+                       conf->wl_resume = NULL;\r
+               }\r
+               MFREE(dhd->osh, conf, sizeof(dhd_conf_t));\r
+       }\r
+       dhd->conf = NULL;\r
+}\r
diff --git a/bcmdhd.101.10.240.x/dhd_config.h b/bcmdhd.101.10.240.x/dhd_config.h
new file mode 100644 (file)
index 0000000..7e89703
--- /dev/null
@@ -0,0 +1,348 @@
+
+#ifndef _dhd_config_
+#define _dhd_config_
+
+#include <bcmdevs.h>
+#include <siutils.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <wlioctl.h>
+#include <802.11.h>
+
+#define FW_TYPE_STA     0
+#define FW_TYPE_APSTA   1
+#define FW_TYPE_P2P     2
+#define FW_TYPE_MESH    3
+#define FW_TYPE_ES      4
+#define FW_TYPE_MFG     5
+#define FW_TYPE_MINIME  6
+#define FW_TYPE_G       0
+#define FW_TYPE_AG      1
+
+#define FW_PATH_AUTO_SELECT 1
+//#define CONFIG_PATH_AUTO_SELECT
+extern char firmware_path[MOD_PARAM_PATHLEN];
+#if defined(BCMSDIO) || defined(BCMPCIE)
+extern uint dhd_rxbound;
+extern uint dhd_txbound;
+#endif
+#ifdef BCMSDIO
+#define TXGLOM_RECV_OFFSET 8
+extern uint dhd_doflow;
+extern uint dhd_slpauto;
+#endif
+
+typedef struct wl_mac_range {
+       uint32 oui;
+       uint32 nic_start;
+       uint32 nic_end;
+} wl_mac_range_t;
+
+typedef struct wl_mac_list {
+       int count;
+       wl_mac_range_t *mac;
+       char name[MOD_PARAM_PATHLEN];
+} wl_mac_list_t;
+
+typedef struct wl_mac_list_ctrl {
+       int count;
+       struct wl_mac_list *m_mac_list_head;
+} wl_mac_list_ctrl_t;
+
+typedef struct wl_chip_nv_path {
+       uint chip;
+       uint chiprev;
+       char name[MOD_PARAM_PATHLEN];
+} wl_chip_nv_path_t;
+
+typedef struct wl_chip_nv_path_list_ctrl {
+       int count;
+       struct wl_chip_nv_path *m_chip_nv_path_head;
+} wl_chip_nv_path_list_ctrl_t;
+
+typedef struct wl_channel_list {
+       uint32 count;
+       uint32 channel[WL_NUMCHANNELS];
+} wl_channel_list_t;
+
+typedef struct wmes_param {
+       int aifsn[AC_COUNT];
+       int ecwmin[AC_COUNT];
+       int ecwmax[AC_COUNT];
+       int txop[AC_COUNT];
+} wme_param_t;
+
+#ifdef PKT_FILTER_SUPPORT
+#define DHD_CONF_FILTER_MAX    8
+#define PKT_FILTER_LEN 300
+#define MAGIC_PKT_FILTER_LEN 450
+typedef struct conf_pkt_filter_add {
+       uint32 count;
+       char filter[DHD_CONF_FILTER_MAX][PKT_FILTER_LEN];
+} conf_pkt_filter_add_t;
+
+typedef struct conf_pkt_filter_del {
+       uint32 count;
+       uint32 id[DHD_CONF_FILTER_MAX];
+} conf_pkt_filter_del_t;
+#endif
+
+#define CONFIG_COUNTRY_LIST_SIZE 500
+typedef struct country_list {
+       struct country_list *next;
+       wl_country_t cspec;
+} country_list_t;
+
+/* mchan_params */
+#define MCHAN_MAX_NUM 4
+#define MIRACAST_SOURCE        1
+#define MIRACAST_SINK  2
+typedef struct mchan_params {
+       struct mchan_params *next;
+       int bw;
+       int p2p_mode;
+       int miracast_mode;
+} mchan_params_t;
+
+enum in4way_flags {
+       NO_SCAN_IN4WAY  = (1 << (0)),
+       NO_BTC_IN4WAY   = (1 << (1)),
+       DONT_DELETE_GC_AFTER_WPS        = (1 << (2)),
+       WAIT_DISCONNECTED       = (1 << (3)),
+};
+
+enum in_suspend_flags {
+       NO_EVENT_IN_SUSPEND             = (1 << (0)),
+       NO_TXDATA_IN_SUSPEND    = (1 << (1)),
+       NO_TXCTL_IN_SUSPEND             = (1 << (2)),
+       AP_DOWN_IN_SUSPEND              = (1 << (3)),
+       ROAM_OFFLOAD_IN_SUSPEND = (1 << (4)),
+       AP_FILTER_IN_SUSPEND    = (1 << (5)),
+       WOWL_IN_SUSPEND                 = (1 << (6)),
+       ALL_IN_SUSPEND                  = 0xFFFFFFFF,
+};
+
+enum in_suspend_mode {
+       EARLY_SUSPEND = 0,
+       PM_NOTIFIER = 1
+};
+
+#ifdef HOST_TPUT_TEST
+enum data_drop_mode {
+       NO_DATA_DROP = 0,
+       TXPKT_DROP = 1,
+       XMIT_DROP = 2
+};
+#endif
+
+enum eapol_status {
+       EAPOL_STATUS_NONE = 0,
+       EAPOL_STATUS_REQID = 1,
+       EAPOL_STATUS_RSPID = 2,
+       EAPOL_STATUS_WSC_START = 3,
+       EAPOL_STATUS_WPS_M1 = 4,
+       EAPOL_STATUS_WPS_M2 = 5,
+       EAPOL_STATUS_WPS_M3 = 6,
+       EAPOL_STATUS_WPS_M4 = 7,
+       EAPOL_STATUS_WPS_M5 = 8,
+       EAPOL_STATUS_WPS_M6 = 9,
+       EAPOL_STATUS_WPS_M7 = 10,
+       EAPOL_STATUS_WPS_M8 = 11,
+       EAPOL_STATUS_WSC_DONE = 12,
+       EAPOL_STATUS_4WAY_START = 13,
+       EAPOL_STATUS_4WAY_M1 = 14,
+       EAPOL_STATUS_4WAY_M2 = 15,
+       EAPOL_STATUS_4WAY_M3 = 16,
+       EAPOL_STATUS_4WAY_M4 = 17,
+       EAPOL_STATUS_GROUPKEY_M1 = 18,
+       EAPOL_STATUS_GROUPKEY_M2 = 19,
+       EAPOL_STATUS_4WAY_DONE = 20
+};
+
+typedef struct dhd_conf {
+       uint chip;
+       uint chiprev;
+#ifdef GET_OTP_MODULE_NAME
+       char module_name[16];
+#endif
+       struct ether_addr otp_mac;
+       int fw_type;
+#ifdef BCMSDIO
+       wl_mac_list_ctrl_t fw_by_mac;
+       wl_mac_list_ctrl_t nv_by_mac;
+#endif
+       wl_chip_nv_path_list_ctrl_t nv_by_chip;
+       country_list_t *country_head;
+       int band;
+       int bw_cap[2];
+       wl_country_t cspec;
+       wl_channel_list_t channels;
+       uint roam_off;
+       uint roam_off_suspend;
+       int roam_trigger[2];
+       int roam_scan_period[2];
+       int roam_delta[2];
+       int fullroamperiod;
+       uint keep_alive_period;
+#ifdef ARP_OFFLOAD_SUPPORT
+       bool garp;
+#endif
+       int force_wme_ac;
+       wme_param_t wme_sta;
+       wme_param_t wme_ap;
+#ifdef PKT_FILTER_SUPPORT
+       conf_pkt_filter_add_t pkt_filter_add;
+       conf_pkt_filter_del_t pkt_filter_del;
+       char *magic_pkt_filter_add;
+#endif
+       int srl;
+       int lrl;
+       uint bcn_timeout;
+       int disable_proptx;
+       int dhd_poll;
+#ifdef BCMSDIO
+       int use_rxchain;
+       bool bus_rxglom;
+       bool txglom_ext; /* Only for 43362/4330/43340/43341/43241 */
+       /* terence 20161011:
+           1) conf->tx_max_offset = 1 to fix credict issue in adaptivity testing
+           2) conf->tx_max_offset = 1 will cause to UDP Tx not work in rxglom supported,
+               but not happened in sw txglom
+       */
+       int tx_max_offset;
+       uint txglomsize;
+       int txctl_tmo_fix;
+       bool txglom_mode;
+       uint deferred_tx_len;
+       /*txglom_bucket_size:
+        * 43362/4330: 1680
+        * 43340/43341/43241: 1684
+        */
+       int txglom_bucket_size;
+       int txinrx_thres;
+       int dhd_txminmax; // -1=DATABUFCNT(bus)
+       bool oob_enabled_later;
+#ifdef MINIME
+       uint32 ramsize;
+#endif
+#if defined(SDIO_ISR_THREAD)
+       bool intr_extn;
+#endif
+#ifdef BCMSDIO_RXLIM_POST
+       bool rxlim_en;
+#endif
+#endif
+#ifdef BCMPCIE
+       int bus_deepsleep_disable;
+#endif
+       int dpc_cpucore;
+       int rxf_cpucore;
+       int frameburst;
+       bool deepsleep;
+       int pm;
+       int pm_in_suspend;
+       int suspend_mode;
+       int suspend_bcn_li_dtim;
+#ifdef DHDTCPACK_SUPPRESS
+       uint8 tcpack_sup_mode;
+#endif
+       int pktprio8021x;
+       uint insuspend;
+       bool suspended;
+#ifdef SUSPEND_EVENT
+       char resume_eventmask[WL_EVENTING_MASK_LEN];
+       struct ether_addr bssid_insuspend;
+       bool wlfc;
+#endif
+#ifdef IDHCP
+       int dhcpc_enable;
+       int dhcpd_enable;
+       struct ipv4_addr dhcpd_ip_addr;
+       struct ipv4_addr dhcpd_ip_mask;
+       struct ipv4_addr dhcpd_ip_start;
+       struct ipv4_addr dhcpd_ip_end;
+#endif
+#ifdef ISAM_PREINIT
+       char isam_init[50];
+       char isam_config[300];
+       char isam_enable[50];
+#endif
+       int ctrl_resched;
+       mchan_params_t *mchan;
+       char *wl_preinit;
+       char *wl_suspend;
+       char *wl_resume;
+       int tsq;
+       int orphan_move;
+       uint eapol_status;
+       uint in4way;
+#ifdef WL_EXT_WOWL
+       uint wowl;
+#endif
+#ifdef GET_CUSTOM_MAC_FROM_CONFIG
+       char hw_ether[62];
+#endif
+       wait_queue_head_t event_complete;
+#ifdef PROPTX_MAXCOUNT
+       int proptx_maxcnt_2g;
+       int proptx_maxcnt_5g;
+#endif /* DYNAMIC_PROPTX_MAXCOUNT */
+#ifdef HOST_TPUT_TEST
+       int data_drop_mode;
+#endif
+} dhd_conf_t;
+
+#ifdef BCMSDIO
+void dhd_conf_get_otp(dhd_pub_t *dhd, bcmsdh_info_t *sdh, si_t *sih);
+#if defined(HW_OOB) || defined(FORCE_WOWLAN)
+void dhd_conf_set_hw_oob_intr(bcmsdh_info_t *sdh, struct si_pub *sih);
+#endif
+void dhd_conf_set_txglom_params(dhd_pub_t *dhd, bool enable);
+#endif
+void dhd_conf_set_path_params(dhd_pub_t *dhd, char *fw_path, char *nv_path);
+int dhd_conf_set_intiovar(dhd_pub_t *dhd, uint cmd, char *name, int val,
+       int def, bool down);
+int dhd_conf_get_band(dhd_pub_t *dhd);
+int dhd_conf_set_country(dhd_pub_t *dhd, wl_country_t *cspec);
+int dhd_conf_get_country(dhd_pub_t *dhd, wl_country_t *cspec);
+int dhd_conf_map_country_list(dhd_pub_t *dhd, wl_country_t *cspec);
+#ifdef CCODE_LIST
+int dhd_ccode_map_country_list(dhd_pub_t *dhd, wl_country_t *cspec);
+#endif
+int dhd_conf_fix_country(dhd_pub_t *dhd);
+bool dhd_conf_match_channel(dhd_pub_t *dhd, uint32 channel);
+void dhd_conf_set_wme(dhd_pub_t *dhd, int ifidx, int mode);
+void dhd_conf_set_mchan_bw(dhd_pub_t *dhd, int go, int source);
+void dhd_conf_add_pkt_filter(dhd_pub_t *dhd);
+bool dhd_conf_del_pkt_filter(dhd_pub_t *dhd, uint32 id);
+void dhd_conf_discard_pkt_filter(dhd_pub_t *dhd);
+int dhd_conf_read_config(dhd_pub_t *dhd, char *conf_path);
+int dhd_conf_set_chiprev(dhd_pub_t *dhd, uint chip, uint chiprev);
+uint dhd_conf_get_chip(void *context);
+uint dhd_conf_get_chiprev(void *context);
+int dhd_conf_get_pm(dhd_pub_t *dhd);
+int dhd_conf_check_hostsleep(dhd_pub_t *dhd, int cmd, void *buf, int len,
+       int *hostsleep_set, int *hostsleep_val, int *ret);
+void dhd_conf_get_hostsleep(dhd_pub_t *dhd,
+       int hostsleep_set, int hostsleep_val, int ret);
+int dhd_conf_mkeep_alive(dhd_pub_t *dhd, int ifidx, int id, int period,
+       char *packet, bool bcast);
+#ifdef ARP_OFFLOAD_SUPPORT
+void dhd_conf_set_garp(dhd_pub_t *dhd, int ifidx, uint32 ipa, bool enable);
+#endif
+#ifdef PROP_TXSTATUS
+int dhd_conf_get_disable_proptx(dhd_pub_t *dhd);
+#endif
+uint dhd_conf_get_insuspend(dhd_pub_t *dhd, uint mask);
+int dhd_conf_set_suspend_resume(dhd_pub_t *dhd, int suspend);
+void dhd_conf_postinit_ioctls(dhd_pub_t *dhd);
+int dhd_conf_preinit(dhd_pub_t *dhd);
+int dhd_conf_reset(dhd_pub_t *dhd);
+int dhd_conf_attach(dhd_pub_t *dhd);
+void dhd_conf_detach(dhd_pub_t *dhd);
+void *dhd_get_pub(struct net_device *dev);
+int wl_pattern_atoh(char *src, char *dst);
+#ifdef BCMSDIO
+extern int dhd_bus_sleep(dhd_pub_t *dhdp, bool sleep, uint32 *intstatus);
+#endif
+#endif /* _dhd_config_ */
diff --git a/bcmdhd.101.10.240.x/dhd_csi.c b/bcmdhd.101.10.240.x/dhd_csi.c
new file mode 100644 (file)
index 0000000..dd1a068
--- /dev/null
@@ -0,0 +1,220 @@
+/*\r
+ * Broadcom Dongle Host Driver (DHD)\r
+ *\r
+ * Copyright (C) 1999-2018, Broadcom.\r
+ *\r
+ *      Unless you and Broadcom execute a separate written software license\r
+ * agreement governing use of this software, this software is licensed to you\r
+ * under the terms of the GNU General Public License version 2 (the "GPL"),\r
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the\r
+ * following added to such license:\r
+ *\r
+ *      As a special exception, the copyright holders of this software give you\r
+ * permission to link this software with independent modules, and to copy and\r
+ * distribute the resulting executable under terms of your choice, provided that\r
+ * you also meet, for each linked independent module, the terms and conditions of\r
+ * the license of that module.  An independent module is a module which is not\r
+ * derived from this software.  The special exception does not apply to any\r
+ * modifications of the software.\r
+ *\r
+ *      Notwithstanding the above, under no circumstances may you combine this\r
+ * software in any way with any other Broadcom software provided under a license\r
+ * other than the GPL, without Broadcom's express prior written consent.\r
+ *\r
+ * $Id: dhd_csi.c 606280 2015-12-15 05:28:25Z $\r
+ */\r
+#include <osl.h>\r
+\r
+#include <bcmutils.h>\r
+\r
+#include <bcmendian.h>\r
+#include <linuxver.h>\r
+#include <linux/list.h>\r
+#include <linux/sort.h>\r
+#include <dngl_stats.h>\r
+#include <wlioctl.h>\r
+\r
+#include <bcmevent.h>\r
+#include <dhd.h>\r
+#include <dhd_dbg.h>\r
+#include <dhd_csi.h>\r
+\r
+#define NULL_CHECK(p, s, err)  \\r
+       do { \\r
+               if (!(p)) { \\r
+                       printf("NULL POINTER (%s) : %s\n", __FUNCTION__, (s)); \\r
+                       err = BCME_ERROR; \\r
+                       return err; \\r
+               } \\r
+       } while (0)\r
+\r
+#define TIMESPEC_TO_US(ts)  (((uint64)(ts).tv_sec * USEC_PER_SEC) + \\r
+                                               (ts).tv_nsec / NSEC_PER_USEC)\r
+\r
+#define NULL_ADDR      "\x00\x00\x00\x00\x00\x00"\r
+\r
+int\r
+dhd_csi_event_handler(dhd_pub_t *dhd, wl_event_msg_t *event, void *event_data)\r
+{\r
+       int ret = BCME_OK;\r
+       bool is_new = TRUE;\r
+       cfr_dump_data_t *p_event;\r
+       cfr_dump_list_t *ptr, *next, *new;\r
+\r
+       NULL_CHECK(dhd, "dhd is NULL", ret);\r
+\r
+       DHD_TRACE(("Enter %s\n", __FUNCTION__));\r
+\r
+       if (!event_data) {\r
+               DHD_ERROR(("%s: event_data is NULL\n", __FUNCTION__));\r
+               return -EINVAL;\r
+       }\r
+       p_event = (cfr_dump_data_t *)event_data;\r
+\r
+       /* check if this addr exist */\r
+       if (!list_empty(&dhd->csi_list)) {\r
+               list_for_each_entry_safe(ptr, next, &dhd->csi_list, list) {\r
+                       if (bcmp(&ptr->entry.header.peer_macaddr, &p_event->header.peer_macaddr,\r
+                                       ETHER_ADDR_LEN) == 0) {\r
+                               int pos = 0, dump_len = 0, remain = 0;\r
+                               is_new = FALSE;\r
+                               DHD_INFO(("CSI data exist\n"));\r
+                               if (p_event->header.status == 0) {\r
+                                       bcopy(&p_event->header, &ptr->entry.header, sizeof(cfr_dump_header_t));\r
+                                       dump_len = p_event->header.cfr_dump_length;\r
+                                       if (dump_len < MAX_EVENT_SIZE) {\r
+                                               bcopy(&p_event->data, &ptr->entry.data, dump_len);\r
+                                       } else { \r
+                                               /* for big csi data */\r
+                                               uint8 *p = (uint8 *)&ptr->entry.data;\r
+                                               remain = p_event->header.remain_length;\r
+                                               if (remain) {\r
+                                                       pos = dump_len - remain - MAX_EVENT_SIZE;\r
+                                                       p += pos;\r
+                                                       bcopy(&p_event->data, p, MAX_EVENT_SIZE);\r
+                                               }\r
+                                               /* copy rest of csi data */\r
+                                               else {\r
+                                                       pos = dump_len - (dump_len % MAX_EVENT_SIZE);\r
+                                                       p += pos;\r
+                                                       bcopy(&p_event->data, p, (dump_len % MAX_EVENT_SIZE));\r
+                                               }\r
+                                       }\r
+                                       return BCME_OK;\r
+                               }\r
+                       }\r
+               }\r
+       }\r
+       if (is_new) {\r
+               if (dhd->csi_count < MAX_CSI_NUM) {\r
+                       new = (cfr_dump_list_t *)MALLOCZ(dhd->osh, sizeof(cfr_dump_list_t));\r
+                       if (!new){\r
+                               DHD_ERROR(("Malloc cfr dump list error\n"));\r
+                               return BCME_NOMEM;\r
+                       }\r
+                       bcopy(&p_event->header, &new->entry.header, sizeof(cfr_dump_header_t));\r
+                       DHD_INFO(("New entry data size %d\n", p_event->header.cfr_dump_length));\r
+                       /* for big csi data */\r
+                       if (p_event->header.remain_length) {\r
+                               DHD_TRACE(("remain %d\n", p_event->header.remain_length));\r
+                               bcopy(&p_event->data, &new->entry.data, MAX_EVENT_SIZE);\r
+                       }\r
+                       else\r
+                               bcopy(&p_event->data, &new->entry.data, p_event->header.cfr_dump_length);\r
+                       INIT_LIST_HEAD(&(new->list));\r
+                       list_add_tail(&(new->list), &dhd->csi_list);\r
+                       dhd->csi_count++;\r
+               }\r
+               else {\r
+                       DHD_TRACE(("Over maximum CSI Number 8. SKIP it.\n"));\r
+               }\r
+       }\r
+       return ret;\r
+}\r
+\r
+int\r
+dhd_csi_init(dhd_pub_t *dhd)\r
+{\r
+       int err = BCME_OK;\r
+\r
+       NULL_CHECK(dhd, "dhd is NULL", err);\r
+       INIT_LIST_HEAD(&dhd->csi_list);\r
+       dhd->csi_count = 0;\r
+\r
+       return err;\r
+}\r
+\r
+int\r
+dhd_csi_deinit(dhd_pub_t *dhd)\r
+{\r
+       int err = BCME_OK;\r
+       cfr_dump_list_t *ptr, *next;\r
+\r
+       NULL_CHECK(dhd, "dhd is NULL", err);\r
+\r
+       if (!list_empty(&dhd->csi_list)) {\r
+               list_for_each_entry_safe(ptr, next, &dhd->csi_list, list) {\r
+                       list_del(&ptr->list);\r
+                       MFREE(dhd->osh, ptr, sizeof(cfr_dump_list_t));\r
+               }\r
+       }\r
+       return err;\r
+}\r
+\r
+void\r
+dhd_csi_clean_list(dhd_pub_t *dhd)\r
+{\r
+       cfr_dump_list_t *ptr, *next;\r
+       int num = 0;\r
+\r
+       if (!dhd) {\r
+               DHD_ERROR(("NULL POINTER: %s\n", __FUNCTION__));\r
+               return;\r
+       }\r
+\r
+       if (!list_empty(&dhd->csi_list)) {\r
+               list_for_each_entry_safe(ptr, next, &dhd->csi_list, list) {\r
+                       if (0 == ptr->entry.header.remain_length) {\r
+                               list_del(&ptr->list);\r
+                               num++;\r
+                               MFREE(dhd->osh, ptr, sizeof(cfr_dump_list_t));\r
+                       }\r
+               }\r
+       }\r
+       dhd->csi_count = 0;\r
+       DHD_TRACE(("Clean up %d record\n", num));\r
+}\r
+\r
+int\r
+dhd_csi_dump_list(dhd_pub_t *dhd, char *buf)\r
+{\r
+       int ret = BCME_OK;\r
+       cfr_dump_list_t *ptr, *next;\r
+       uint8 * pbuf = buf;\r
+       int num = 0;\r
+       int length = 0;\r
+\r
+       NULL_CHECK(dhd, "dhd is NULL", ret);\r
+\r
+       /* check if this addr exist */\r
+       if (!list_empty(&dhd->csi_list)) {\r
+               list_for_each_entry_safe(ptr, next, &dhd->csi_list, list) {\r
+                       if (ptr->entry.header.remain_length) {\r
+                               DHD_ERROR(("data not ready %d\n", ptr->entry.header.remain_length));\r
+                               continue;\r
+                       }\r
+                       bcopy(&ptr->entry.header, pbuf, sizeof(cfr_dump_header_t));\r
+                       length += sizeof(cfr_dump_header_t);\r
+                       pbuf += sizeof(cfr_dump_header_t);\r
+                       DHD_TRACE(("Copy data size %d\n", ptr->entry.header.cfr_dump_length));\r
+                       bcopy(&ptr->entry.data, pbuf, ptr->entry.header.cfr_dump_length);\r
+                       length += ptr->entry.header.cfr_dump_length;\r
+                       pbuf += ptr->entry.header.cfr_dump_length;\r
+                       num++;\r
+               }\r
+       }\r
+       DHD_TRACE(("dump %d record %d bytes\n", num, length));\r
+\r
+       return length;\r
+}\r
+\r
diff --git a/bcmdhd.101.10.240.x/dhd_csi.h b/bcmdhd.101.10.240.x/dhd_csi.h
new file mode 100644 (file)
index 0000000..bcc712c
--- /dev/null
@@ -0,0 +1,77 @@
+/*\r
+ * Broadcom Dongle Host Driver (DHD), CSI\r
+ *\r
+ * Copyright (C) 1999-2018, Broadcom.\r
+ *\r
+ *      Unless you and Broadcom execute a separate written software license\r
+ * agreement governing use of this software, this software is licensed to you\r
+ * under the terms of the GNU General Public License version 2 (the "GPL"),\r
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the\r
+ * following added to such license:\r
+ *\r
+ *      As a special exception, the copyright holders of this software give you\r
+ * permission to link this software with independent modules, and to copy and\r
+ * distribute the resulting executable under terms of your choice, provided that\r
+ * you also meet, for each linked independent module, the terms and conditions of\r
+ * the license of that module.  An independent module is a module which is not\r
+ * derived from this software.  The special exception does not apply to any\r
+ * modifications of the software.\r
+ *\r
+ *      Notwithstanding the above, under no circumstances may you combine this\r
+ * software in any way with any other Broadcom software provided under a license\r
+ * other than the GPL, without Broadcom's express prior written consent.\r
+ *\r
+ * $Id: dhd_csi.h 558438 2015-05-22 06:05:11Z $\r
+ */\r
+#ifndef __DHD_CSI_H__\r
+#define __DHD_CSI_H__\r
+\r
+/* Maxinum csi file dump size */\r
+#define MAX_CSI_FILESZ         (32 * 1024)\r
+/* Maxinum subcarrier number */\r
+#define MAXINUM_CFR_DATA       256 * 4\r
+#define CSI_DUMP_PATH          "/sys/bcm-dhd/csi"\r
+#define MAX_EVENT_SIZE         1400\r
+/* maximun csi number stored at dhd */\r
+#define MAX_CSI_NUM            8\r
+\r
+typedef struct cfr_dump_header {\r
+       /* 0 - successful; 1 - Failed */\r
+       uint8 status;\r
+       /* Peer MAC address */\r
+       uint8 peer_macaddr[6];\r
+       /* Number of Space Time Streams */\r
+       uint8 sts;\r
+       /* Number of RX chain */\r
+       uint8 num_rx;\r
+       /* Number of subcarrier */\r
+       uint16 num_carrier;\r
+       /* Length of the CSI dump */\r
+       uint32 cfr_dump_length;\r
+       /* remain unsend CSI data length */\r
+       uint32 remain_length;\r
+       /* RSSI */\r
+       int8 rssi;\r
+} __attribute__((packed)) cfr_dump_header_t;\r
+\r
+typedef struct cfr_dump_data {\r
+       cfr_dump_header_t header;\r
+       uint32 data[MAXINUM_CFR_DATA];\r
+} cfr_dump_data_t;\r
+\r
+typedef struct {\r
+       struct list_head list;\r
+       cfr_dump_data_t entry;\r
+} cfr_dump_list_t;\r
+\r
+int dhd_csi_event_handler(dhd_pub_t *dhd, wl_event_msg_t *event, void *event_data);\r
+\r
+int dhd_csi_init(dhd_pub_t *dhd);\r
+\r
+int dhd_csi_deinit(dhd_pub_t *dhd);\r
+\r
+void dhd_csi_clean_list(dhd_pub_t *dhd);\r
+\r
+int dhd_csi_dump_list(dhd_pub_t *dhd, char *buf);\r
+#endif /* __DHD_CSI_H__ */\r
+\r
diff --git a/bcmdhd.101.10.240.x/dhd_custom_cis.c b/bcmdhd.101.10.240.x/dhd_custom_cis.c
new file mode 100644 (file)
index 0000000..b6ee1db
--- /dev/null
@@ -0,0 +1,1431 @@
+/*
+ * Process CIS information from OTP for customer platform
+ * (Handle the MAC address and module information)
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+
+#include <ethernet.h>
+#include <dngl_stats.h>
+#include <bcmutils.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <dhd_linux.h>
+#include <bcmdevs.h>
+
+#include <linux/fcntl.h>
+#include <linux/fs.h>
+#include <linux/list.h>
+#include <bcmiov.h>
+#ifdef DHD_USE_CISINFO
+
+/* File Location to keep each information */
+#define MACINFO PLATFORM_PATH".mac.info"
+#define CIDINFO PLATFORM_PATH".cid.info"
+#ifdef PLATFORM_SLP
+#define MACINFO_EFS "/csa/.mac.info"
+#else
+#define MACINFO_EFS "/efs/wifi/.mac.info"
+#define CIDINFO_DATA "/data/.cid.info"
+#endif /* PLATFORM_SLP */
+
+/* Definitions for MAC address */
+#define MAC_BUF_SIZE 20
+#define MAC_CUSTOM_FORMAT      "%02X:%02X:%02X:%02X:%02X:%02X"
+
+/* Definitions for CIS information */
+#if defined(BCM4359_CHIP) || defined(BCM4361_CHIP) || defined(BCM4375_CHIP) || \
+       defined(BCM4389_CHIP_DEF)
+#define CIS_BUF_SIZE            1280
+#else
+#define CIS_BUF_SIZE            512
+#endif /* BCM4359_CHIP */
+
+#define DUMP_CIS_SIZE  48
+
+#define CIS_TUPLE_TAG_START            0x80
+#define CIS_TUPLE_TAG_VENDOR           0x81
+#define CIS_TUPLE_TAG_MACADDR          0x19
+#define CIS_TUPLE_TAG_BOARDTYPE                0x1b
+#define CIS_TUPLE_LEN_MACADDR          7
+#define CIS_DUMP_END                    0xff
+#define CIS_TUPLE_NULL                  0X00
+
+#ifdef CONFIG_BCMDHD_PCIE
+#if defined(BCM4361_CHIP) || defined(BCM4375_CHIP)
+#define OTP_OFFSET 208
+#elif defined(BCM4389_CHIP_DEF)
+/* 4389A0 OTP offset is different with 4389B0
+ * due to OTP layout is changed from 4389B0
+ */
+#define OTP_OFFSET_4389A0 208
+#define OTP_OFFSET 0
+#else
+#define OTP_OFFSET 128
+#endif /* BCM4361_CHIP || BCM4375_CHIP || BCM43589_CHIP_DEF */
+#else /* CONFIG_BCMDHD_PCIE */
+#define OTP_OFFSET 12 /* SDIO */
+#endif /* CONFIG_BCMDHD_PCIE */
+
+unsigned char *g_cis_buf = NULL;
+
+/* Definitions for common interface */
+typedef struct tuple_entry {
+       struct list_head list;  /* head of the list */
+       uint32 cis_idx;         /* index of each tuples */
+} tuple_entry_t;
+
+extern int _dhd_set_mac_address(struct dhd_info *dhd, int ifidx, struct ether_addr *addr);
+#if defined(GET_MAC_FROM_OTP) || defined(USE_CID_CHECK)
+static tuple_entry_t *dhd_alloc_tuple_entry(dhd_pub_t *dhdp, const int idx);
+static void dhd_free_tuple_entry(dhd_pub_t *dhdp, struct list_head *head);
+static int dhd_find_tuple_list_from_otp(dhd_pub_t *dhdp, int req_tup,
+       unsigned char* req_tup_len, struct list_head *head);
+#endif /* GET_MAC_FROM_OTP || USE_CID_CHECK */
+
+/* otp region read/write information */
+typedef struct otp_rgn_rw_info {
+       uint8 rgnid;
+       uint8 preview;
+       uint8 integrity_chk;
+       uint16 rgnsize;
+       uint16 datasize;
+       uint8 *data;
+} otp_rgn_rw_info_t;
+
+/* otp region status information */
+typedef struct otp_rgn_stat_info {
+       uint8 rgnid;
+       uint16 rgnstart;
+       uint16 rgnsize;
+} otp_rgn_stat_info_t;
+
+typedef int (pack_handler_t)(void *ctx, uint8 *buf, uint16 *buflen);
+
+/* Common Interface Functions */
+int
+dhd_alloc_cis(dhd_pub_t *dhdp)
+{
+       if (g_cis_buf == NULL) {
+               g_cis_buf = MALLOCZ(dhdp->osh, CIS_BUF_SIZE);
+               if (g_cis_buf == NULL) {
+                       DHD_ERROR(("%s: Failed to alloc buffer for CIS\n", __FUNCTION__));
+                       return BCME_NOMEM;
+               } else {
+                       DHD_ERROR(("%s: Local CIS buffer is alloced\n", __FUNCTION__));
+                       memset(g_cis_buf, 0, CIS_BUF_SIZE);
+               }
+       }
+       return BCME_OK;
+}
+
+void
+dhd_clear_cis(dhd_pub_t *dhdp)
+{
+       if (g_cis_buf) {
+               MFREE(dhdp->osh, g_cis_buf, CIS_BUF_SIZE);
+               g_cis_buf = NULL;
+               DHD_ERROR(("%s: Local CIS buffer is freed\n", __FUNCTION__));
+       }
+}
+
+int
+dhd_read_cis(dhd_pub_t *dhdp)
+{
+       int ret = 0;
+       cis_rw_t *cish;
+       int buf_size = CIS_BUF_SIZE;
+       int length = strlen("cisdump");
+
+       if (length >= buf_size) {
+               DHD_ERROR(("%s: check CIS_BUF_SIZE\n", __FUNCTION__));
+               return BCME_BADLEN;
+       }
+
+       /* Try reading out from CIS */
+       cish = (cis_rw_t *)(g_cis_buf + 8);
+       cish->source = 0;
+       cish->byteoff = 0;
+       cish->nbytes = buf_size;
+       strlcpy(g_cis_buf, "cisdump", buf_size);
+
+       ret = dhd_wl_ioctl_cmd(dhdp, WLC_GET_VAR, g_cis_buf, buf_size, 0, 0);
+       if (ret < 0) {
+               if (ret == BCME_UNSUPPORTED) {
+                       DHD_ERROR(("%s: get cisdump, UNSUPPORTED\n", __FUNCTION__));
+               } else {
+                       DHD_ERROR(("%s : get cisdump err(%d)\n",
+                               __FUNCTION__, ret));
+               }
+               /* free local buf */
+               dhd_clear_cis(dhdp);
+       }
+
+       return ret;
+}
+
+static int
+dhd_otp_process_iov_resp_buf(void *ctx, void *iov_resp, uint16 cmd_id,
+               bcm_xtlv_unpack_cbfn_t cbfn)
+{
+       bcm_iov_buf_t *p_resp = NULL;
+       int ret = BCME_OK;
+       uint16 version;
+
+       /* check for version */
+       version = dtoh16(*(uint16 *)iov_resp);
+       if (version != WL_OTP_IOV_VERSION) {
+               return BCME_VERSION;
+       }
+
+       p_resp = (bcm_iov_buf_t *)iov_resp;
+       if ((p_resp->id == cmd_id) && (cbfn != NULL)) {
+               ret = bcm_unpack_xtlv_buf(ctx, (uint8 *)p_resp->data, p_resp->len,
+                       BCM_XTLV_OPTION_ALIGN32, cbfn);
+       }
+
+       return ret;
+}
+
+static int
+dhd_otp_get_iov_resp(dhd_pub_t *dhdp, const uint16 cmd_id, void *ctx,
+       pack_handler_t packfn, bcm_xtlv_unpack_cbfn_t cbfn)
+{
+       bcm_iov_buf_t *iov_buf = NULL;
+       uint8 *iov_resp = NULL;
+       int ret = BCME_OK;
+       int buf_size = CIS_BUF_SIZE;
+       uint16 iovlen = 0, buflen = 0, buflen_start = 0;
+
+       /* allocate input buffer */
+       iov_buf = MALLOCZ(dhdp->osh, WLC_IOCTL_SMLEN);
+       if (iov_buf == NULL) {
+               DHD_ERROR(("%s: Failed to alloc buffer for iovar input\n", __FUNCTION__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       iov_resp = MALLOCZ(dhdp->osh, WLC_IOCTL_MAXLEN);
+       if (iov_resp == NULL) {
+               DHD_ERROR(("%s: Failed to alloc buffer for iovar response\n", __FUNCTION__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       /* parse and pack config parameters */
+       buflen = buflen_start = (WLC_IOCTL_SMLEN - sizeof(*iov_buf));
+       ret = packfn(ctx, (uint8 *)&iov_buf->data[0], &buflen);
+       if (ret != BCME_OK) {
+               goto fail;
+       }
+
+       /* fill header portion */
+       iov_buf->version = WL_OTP_IOV_VERSION;
+       iov_buf->len = (buflen_start - buflen);
+       iov_buf->id = cmd_id;
+
+       /* issue get iovar and process response */
+       iovlen = sizeof(*iov_buf) + iov_buf->len;
+       ret = dhd_iovar(dhdp, 0, "otp", (char *)iov_buf, iovlen,
+                       iov_resp, WLC_IOCTL_MAXLEN, FALSE);
+       if (ret == BCME_OK) {
+               ret = dhd_otp_process_iov_resp_buf(ctx, iov_resp, cmd_id, cbfn);
+       } else {
+               DHD_ERROR(("%s: Failed to get otp iovar\n", __FUNCTION__));
+       }
+
+fail:
+       if (iov_buf) {
+               MFREE(dhdp->osh, iov_buf, WLC_IOCTL_SMLEN);
+       }
+       if (iov_resp) {
+               MFREE(dhdp->osh, iov_resp, buf_size);
+       }
+       if (ret < 0) {
+               /* free local buf */
+               dhd_clear_cis(dhdp);
+       }
+       return ret;
+}
+
+static int
+dhd_otp_cbfn_rgnstatus(void *ctx, const uint8 *data, uint16 type, uint16 len)
+{
+       otp_rgn_stat_info_t *stat_info = (otp_rgn_stat_info_t *)ctx;
+
+       BCM_REFERENCE(len);
+
+       if (data == NULL) {
+               DHD_ERROR(("%s: bad argument !!!\n", __FUNCTION__));
+               return BCME_BADARG;
+       }
+
+       switch (type) {
+               case WL_OTP_XTLV_RGN:
+                       stat_info->rgnid = *data;
+                       break;
+               case WL_OTP_XTLV_ADDR:
+                       stat_info->rgnstart = dtoh16((uint16)*data);
+                       break;
+               case WL_OTP_XTLV_SIZE:
+                       stat_info->rgnsize = dtoh16((uint16)*data);
+                       break;
+               default:
+                       DHD_ERROR(("%s: unknown tlv %u\n", __FUNCTION__, type));
+                       break;
+       }
+
+       return BCME_OK;
+}
+
+static int
+dhd_otp_packfn_rgnstatus(void *ctx, uint8 *buf, uint16 *buflen)
+{
+       uint8 *pxtlv = buf;
+       int ret = BCME_OK;
+       uint16 len = *buflen;
+       uint8 rgnid = OTP_RGN_SW;
+
+       BCM_REFERENCE(ctx);
+
+       /* pack option <-r region> */
+       ret = bcm_pack_xtlv_entry(&pxtlv, &len, WL_OTP_XTLV_RGN, sizeof(rgnid),
+                       &rgnid, BCM_XTLV_OPTION_ALIGN32);
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s: Failed pack xtlv entry of region: %d\n", __FUNCTION__, ret));
+               return ret;
+       }
+
+       *buflen = len;
+       return ret;
+}
+
+static int
+dhd_otp_packfn_rgndump(void *ctx, uint8 *buf, uint16 *buflen)
+{
+       uint8 *pxtlv = buf;
+       int ret = BCME_OK;
+       uint16 len = *buflen, size = WLC_IOCTL_MAXLEN;
+       uint8 rgnid = OTP_RGN_SW;
+
+       /* pack option <-r region> */
+       ret = bcm_pack_xtlv_entry(&pxtlv, &len, WL_OTP_XTLV_RGN,
+                       sizeof(rgnid), &rgnid, BCM_XTLV_OPTION_ALIGN32);
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s: Failed pack xtlv entry of region: %d\n", __FUNCTION__, ret));
+               goto fail;
+       }
+
+       /* pack option [-s size] */
+       ret = bcm_pack_xtlv_entry(&pxtlv, &len, WL_OTP_XTLV_SIZE,
+                       sizeof(size), (uint8 *)&size, BCM_XTLV_OPTION_ALIGN32);
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s: Failed pack xtlv entry of size: %d\n", __FUNCTION__, ret));
+               goto fail;
+       }
+       *buflen = len;
+fail:
+       return ret;
+}
+
+static int
+dhd_otp_cbfn_rgndump(void *ctx, const uint8 *data, uint16 type, uint16 len)
+{
+       otp_rgn_rw_info_t *rw_info = (otp_rgn_rw_info_t *)ctx;
+
+       BCM_REFERENCE(len);
+
+       if (data == NULL) {
+               DHD_ERROR(("%s: bad argument !!!\n", __FUNCTION__));
+               return BCME_BADARG;
+       }
+
+       switch (type) {
+               case WL_OTP_XTLV_RGN:
+                       rw_info->rgnid = *data;
+                       break;
+               case WL_OTP_XTLV_DATA:
+                       /*
+                        * intentionally ignoring the return value of memcpy_s as it is just
+                        * a variable copy and because of this size is within the bounds
+                        */
+                       (void)memcpy_s(&rw_info->data, sizeof(rw_info->data),
+                                       &data, sizeof(rw_info->data));
+                       rw_info->datasize = len;
+                       break;
+               default:
+                       DHD_ERROR(("%s: unknown tlv %u\n", __FUNCTION__, type));
+                       break;
+       }
+       return BCME_OK;
+}
+
+int
+dhd_read_otp_sw_rgn(dhd_pub_t *dhdp)
+{
+       int ret = BCME_OK;
+       otp_rgn_rw_info_t rw_info;
+       otp_rgn_stat_info_t stat_info;
+
+       memset(&rw_info, 0, sizeof(rw_info));
+       memset(&stat_info, 0, sizeof(stat_info));
+
+       ret = dhd_otp_get_iov_resp(dhdp, WL_OTP_CMD_RGNSTATUS, &stat_info,
+                       dhd_otp_packfn_rgnstatus, dhd_otp_cbfn_rgnstatus);
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s: otp region status failed, ret=%d\n", __FUNCTION__, ret));
+               goto fail;
+       }
+
+       rw_info.rgnsize = stat_info.rgnsize;
+       ret = dhd_otp_get_iov_resp(dhdp, WL_OTP_CMD_RGNDUMP, &rw_info,
+                       dhd_otp_packfn_rgndump, dhd_otp_cbfn_rgndump);
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s: otp region dump failed, ret=%d\n", __FUNCTION__, ret));
+               goto fail;
+       }
+
+       ret = memcpy_s(g_cis_buf, CIS_BUF_SIZE, rw_info.data, rw_info.datasize);
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s: Failed to copy otp dump, ret=%d\n", __FUNCTION__, ret));
+       }
+fail:
+       return ret;
+
+}
+
+#if defined(GET_MAC_FROM_OTP) || defined(USE_CID_CHECK)
+static tuple_entry_t*
+dhd_alloc_tuple_entry(dhd_pub_t *dhdp, const int idx)
+{
+       tuple_entry_t *entry;
+
+       entry = MALLOCZ(dhdp->osh, sizeof(tuple_entry_t));
+       if (!entry) {
+               DHD_ERROR(("%s: failed to alloc entry\n", __FUNCTION__));
+               return NULL;
+       }
+
+       entry->cis_idx = idx;
+
+       return entry;
+}
+
+static void
+dhd_free_tuple_entry(dhd_pub_t *dhdp, struct list_head *head)
+{
+       tuple_entry_t *entry;
+
+       while (!list_empty(head)) {
+               entry = list_entry(head->next, tuple_entry_t, list);
+               list_del(&entry->list);
+
+               MFREE(dhdp->osh, entry, sizeof(tuple_entry_t));
+       }
+}
+
+static int
+dhd_find_tuple_list_from_otp(dhd_pub_t *dhdp, int req_tup,
+       unsigned char* req_tup_len, struct list_head *head)
+{
+       int idx = OTP_OFFSET + sizeof(cis_rw_t);
+       int tup, tup_len = 0;
+       int buf_len = CIS_BUF_SIZE;
+       int found = 0;
+
+#if defined(BCM4389_CHIP_DEF)
+       if (dhd_bus_chip_id(dhdp) == BCM4389_CHIP_GRPID) {
+               int revid = dhd_bus_chiprev_id(dhdp);
+
+               if (revid == 3) {
+                       idx = OTP_OFFSET_4389A0;
+               } else {
+                       idx = OTP_OFFSET;
+               }
+       }
+#endif /* BCM4389_CHIP_DEF */
+
+       if (!g_cis_buf) {
+               DHD_ERROR(("%s: Couldn't find cis info from"
+                       " local buffer\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       do {
+               tup = g_cis_buf[idx++];
+               if (tup == CIS_TUPLE_NULL || tup == CIS_DUMP_END) {
+                       tup_len = 0;
+               } else {
+                       tup_len = g_cis_buf[idx++];
+                       if ((idx + tup_len) > buf_len) {
+                               return BCME_ERROR;
+                       }
+
+                       if (tup == CIS_TUPLE_TAG_START &&
+                               tup_len != CIS_TUPLE_NULL &&
+                               g_cis_buf[idx] == req_tup) {
+                               idx++;
+                               if (head) {
+                                       tuple_entry_t *entry;
+                                       entry = dhd_alloc_tuple_entry(dhdp, idx);
+                                       if (entry) {
+                                               list_add_tail(&entry->list, head);
+                                               found++;
+                                       }
+                               }
+                               if (found == 1 && req_tup_len) {
+                                       *req_tup_len = tup_len;
+                               }
+                               tup_len--;
+                       }
+               }
+               idx += tup_len;
+       } while (tup != CIS_DUMP_END && (idx < buf_len));
+
+       return (found > 0) ? found : BCME_ERROR;
+}
+#endif /* GET_MAC_FROM_OTP || USE_CID_CHECK */
+
+#ifdef DUMP_CIS
+static void
+dhd_dump_cis_buf(dhd_pub_t *dhdp, int size)
+{
+       int i;
+       int cis_offset = OTP_OFFSET + sizeof(cis_rw_t);
+
+#if defined(BCM4389_CHIP_DEF)
+       if (dhd_bus_chip_id(dhdp) == BCM4389_CHIP_GRPID) {
+               int revid = dhd_bus_chiprev_id(dhdp);
+
+               if (revid == 3) {
+                       idx = OTP_OFFSET_4389A0;
+               } else {
+                       idx = OTP_OFFSET;
+               }
+       }
+#endif /* BCM4389_CHIP_DEF */
+
+       if (size <= 0) {
+               return;
+       }
+
+       if (size > CIS_BUF_SIZE) {
+               size = CIS_BUF_SIZE;
+       }
+
+       DHD_ERROR(("========== START CIS DUMP ==========\n"));
+       for (i = 0; i < size; i++) {
+               DHD_ERROR(("%02X ", g_cis_buf[i + cis_offset]));
+               if ((i % 16) == 15) {
+                       DHD_ERROR(("\n"));
+               }
+       }
+       if ((i % 16) != 15) {
+               DHD_ERROR(("\n"));
+       }
+       DHD_ERROR(("========== END CIS DUMP ==========\n"));
+}
+#endif /* DUMP_CIS */
+
+/* MAC address mangement functions */
+#ifdef READ_MACADDR
+static void
+dhd_create_random_mac(char *buf, unsigned int buf_len)
+{
+       char random_mac[3];
+
+       memset(random_mac, 0, sizeof(random_mac));
+       get_random_bytes(random_mac, 3);
+
+       snprintf(buf, buf_len, MAC_CUSTOM_FORMAT, 0x00, 0x12, 0x34,
+               (uint32)random_mac[0], (uint32)random_mac[1], (uint32)random_mac[2]);
+
+       DHD_ERROR(("%s: The Random Generated MAC ID: %s\n",
+               __FUNCTION__, random_mac));
+}
+
+#ifndef DHD_MAC_ADDR_EXPORT
+int
+dhd_set_macaddr_from_file(dhd_pub_t *dhdp)
+{
+       char mac_buf[MAC_BUF_SIZE];
+       char *filepath_efs = MACINFO_EFS;
+#ifdef PLATFORM_SLP
+       char *filepath_mac = MACINFO;
+#endif /* PLATFORM_SLP */
+       int ret;
+       struct dhd_info *dhd;
+       struct ether_addr *mac;
+       char *invalid_mac = "00:00:00:00:00:00";
+
+       if (dhdp) {
+               dhd = dhdp->info;
+               mac = &dhdp->mac;
+       } else {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       memset(mac_buf, 0, sizeof(mac_buf));
+
+       /* Read MAC address from the specified file */
+       ret = dhd_read_file(filepath_efs, mac_buf, sizeof(mac_buf) - 1);
+
+       /* Check if the file does not exist or contains invalid data */
+       if (ret || (!ret && strstr(mac_buf, invalid_mac))) {
+               /* Generate a new random MAC address */
+               dhd_create_random_mac(mac_buf, sizeof(mac_buf));
+
+               /* Write random MAC address to the file */
+               if (dhd_write_file(filepath_efs, mac_buf, strlen(mac_buf)) < 0) {
+                       DHD_ERROR(("%s: MAC address [%s] Failed to write into File:"
+                               " %s\n", __FUNCTION__, mac_buf, filepath_efs));
+                       return BCME_ERROR;
+               } else {
+                       DHD_ERROR(("%s: MAC address [%s] written into File: %s\n",
+                               __FUNCTION__, mac_buf, filepath_efs));
+               }
+       }
+#ifdef PLATFORM_SLP
+       /* Write random MAC address for framework */
+       if (dhd_write_file(filepath_mac, mac_buf, strlen(mac_buf)) < 0) {
+               DHD_ERROR(("%s: MAC address [%c%c:xx:xx:xx:x%c:%c%c] Failed to write into File:"
+                       " %s\n", __FUNCTION__, mac_buf[0], mac_buf[1],
+                       mac_buf[13], mac_buf[15], mac_buf[16], filepath_mac));
+       } else {
+               DHD_ERROR(("%s: MAC address [%c%c:xx:xx:xx:x%c:%c%c] written into File: %s\n",
+                       __FUNCTION__, mac_buf[0], mac_buf[1], mac_buf[13],
+                       mac_buf[15], mac_buf[16], filepath_mac));
+       }
+#endif /* PLATFORM_SLP */
+
+       mac_buf[sizeof(mac_buf) - 1] = '\0';
+
+       /* Write the MAC address to the Dongle */
+       sscanf(mac_buf, MAC_CUSTOM_FORMAT,
+               (uint32 *)&(mac->octet[0]), (uint32 *)&(mac->octet[1]),
+               (uint32 *)&(mac->octet[2]), (uint32 *)&(mac->octet[3]),
+               (uint32 *)&(mac->octet[4]), (uint32 *)&(mac->octet[5]));
+
+       if (_dhd_set_mac_address(dhd, 0, mac) == 0) {
+               DHD_INFO(("%s: MAC Address is overwritten\n", __FUNCTION__));
+       } else {
+               DHD_ERROR(("%s: _dhd_set_mac_address() failed\n", __FUNCTION__));
+       }
+
+       return 0;
+}
+#else
+int
+dhd_set_macaddr_from_file(dhd_pub_t *dhdp)
+{
+       char mac_buf[MAC_BUF_SIZE];
+
+       struct dhd_info *dhd;
+       struct ether_addr *mac;
+
+       if (dhdp) {
+               dhd = dhdp->info;
+               mac = &dhdp->mac;
+       } else {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       memset(mac_buf, 0, sizeof(mac_buf));
+       if (ETHER_ISNULLADDR(&sysfs_mac_addr)) {
+               /* Generate a new random MAC address */
+               dhd_create_random_mac(mac_buf, sizeof(mac_buf));
+               if (!bcm_ether_atoe(mac_buf, &sysfs_mac_addr)) {
+                       DHD_ERROR(("%s : mac parsing err\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+       }
+
+       /* Write the MAC address to the Dongle */
+       memcpy(mac, &sysfs_mac_addr, sizeof(sysfs_mac_addr));
+
+       if (_dhd_set_mac_address(dhd, 0, mac) == 0) {
+               DHD_INFO(("%s: MAC Address is overwritten\n", __FUNCTION__));
+       } else {
+               DHD_ERROR(("%s: _dhd_set_mac_address() failed\n", __FUNCTION__));
+       }
+
+       return 0;
+}
+#endif /* !DHD_MAC_ADDR_EXPORT */
+#endif /* READ_MACADDR */
+
+#ifdef GET_MAC_FROM_OTP
+static int
+dhd_set_default_macaddr(dhd_pub_t *dhdp)
+{
+       char iovbuf[WLC_IOCTL_SMLEN];
+       struct ether_addr *mac;
+       int ret;
+
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return BCME_BADARG;
+       }
+
+       mac = &dhdp->mac;
+
+       /* Read the default MAC address */
+       ret = dhd_iovar(dhdp, 0, "cur_etheraddr", NULL, 0, iovbuf, sizeof(iovbuf),
+                       FALSE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: Can't get the default MAC address\n", __FUNCTION__));
+               return BCME_NOTUP;
+       }
+
+       /* Update the default MAC address */
+       memcpy(mac, iovbuf, ETHER_ADDR_LEN);
+#ifdef DHD_MAC_ADDR_EXPORT
+       memcpy(&sysfs_mac_addr, mac, sizeof(sysfs_mac_addr));
+#endif /* DHD_MAC_ADDR_EXPORT */
+
+       return 0;
+}
+
+static int
+dhd_verify_macaddr(dhd_pub_t *dhdp, struct list_head *head)
+{
+       tuple_entry_t *cur, *next;
+       int idx = -1; /* Invalid index */
+
+       list_for_each_entry(cur, head, list) {
+               list_for_each_entry(next, &cur->list, list) {
+                       if ((unsigned long)next == (unsigned long)head) {
+                               DHD_INFO(("%s: next ptr %p is same as head ptr %p\n",
+                                       __FUNCTION__, next, head));
+                               break;
+                       }
+                       if (!memcmp(&g_cis_buf[cur->cis_idx],
+                               &g_cis_buf[next->cis_idx], ETHER_ADDR_LEN)) {
+                               idx = cur->cis_idx;
+                               break;
+                       }
+               }
+       }
+
+       return idx;
+}
+
+int
+dhd_check_module_mac(dhd_pub_t *dhdp)
+{
+#ifndef DHD_MAC_ADDR_EXPORT
+       char *filepath_efs = MACINFO_EFS;
+#endif /* !DHD_MAC_ADDR_EXPORT */
+       unsigned char otp_mac_buf[MAC_BUF_SIZE];
+       struct ether_addr *mac;
+       struct dhd_info *dhd;
+
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return BCME_BADARG;
+       }
+
+       dhd = dhdp->info;
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return BCME_BADARG;
+       }
+
+       mac = &dhdp->mac;
+       memset(otp_mac_buf, 0, sizeof(otp_mac_buf));
+
+       if (!g_cis_buf) {
+#ifndef DHD_MAC_ADDR_EXPORT
+               char eabuf[ETHER_ADDR_STR_LEN];
+               DHD_INFO(("%s: Couldn't read CIS information\n", __FUNCTION__));
+
+               /* Read the MAC address from the specified file */
+               if (dhd_read_file(filepath_efs, otp_mac_buf, sizeof(otp_mac_buf) - 1) < 0) {
+                       DHD_ERROR(("%s: Couldn't read the file, "
+                               "use the default MAC Address\n", __FUNCTION__));
+                       if (dhd_set_default_macaddr(dhdp) < 0) {
+                               return BCME_BADARG;
+                       }
+               } else {
+                       bzero((char *)eabuf, sizeof(eabuf));
+                       strlcpy(eabuf, otp_mac_buf, sizeof(eabuf));
+                       if (!bcm_ether_atoe(eabuf, mac)) {
+                               DHD_ERROR(("%s : mac parsing err\n", __FUNCTION__));
+                               if (dhd_set_default_macaddr(dhdp) < 0) {
+                                       return BCME_BADARG;
+                               }
+                       }
+               }
+#else
+               DHD_INFO(("%s: Couldn't read CIS information\n", __FUNCTION__));
+
+               /* Read the MAC address from the specified file */
+               if (ETHER_ISNULLADDR(&sysfs_mac_addr)) {
+                       DHD_ERROR(("%s: Couldn't read the file, "
+                               "use the default MAC Address\n", __FUNCTION__));
+                       if (dhd_set_default_macaddr(dhdp) < 0) {
+                               return BCME_BADARG;
+                       }
+               } else {
+                       /* sysfs mac addr is confirmed with valid format in set_mac_addr */
+                       memcpy(mac, &sysfs_mac_addr, sizeof(sysfs_mac_addr));
+               }
+#endif /* !DHD_MAC_ADDR_EXPORT */
+       } else {
+               struct list_head mac_list;
+               unsigned char tuple_len = 0;
+               int found = 0;
+               int idx = -1; /* Invalid index */
+
+#ifdef DUMP_CIS
+               dhd_dump_cis_buf(dhdp, DUMP_CIS_SIZE);
+#endif /* DUMP_CIS */
+
+               /* Find a new tuple tag */
+               INIT_LIST_HEAD(&mac_list);
+               found = dhd_find_tuple_list_from_otp(dhdp, CIS_TUPLE_TAG_MACADDR,
+                       &tuple_len, &mac_list);
+               if ((found > 0) && tuple_len == CIS_TUPLE_LEN_MACADDR) {
+                       if (found == 1) {
+                               tuple_entry_t *cur = list_entry((&mac_list)->next,
+                                       tuple_entry_t, list);
+                               idx = cur->cis_idx;
+                       } else {
+                               /* Find the start index of MAC address */
+                               idx = dhd_verify_macaddr(dhdp, &mac_list);
+                       }
+               }
+
+               /* Find the MAC address */
+               if (idx > 0) {
+                       /* update MAC address */
+                       snprintf(otp_mac_buf, sizeof(otp_mac_buf), MAC_CUSTOM_FORMAT,
+                               (uint32)g_cis_buf[idx], (uint32)g_cis_buf[idx + 1],
+                               (uint32)g_cis_buf[idx + 2], (uint32)g_cis_buf[idx + 3],
+                               (uint32)g_cis_buf[idx + 4], (uint32)g_cis_buf[idx + 5]);
+                       DHD_ERROR(("%s: MAC address is taken from OTP: " MACDBG "\n",
+                               __FUNCTION__, MAC2STRDBG(&g_cis_buf[idx])));
+               } else {
+                       /* Not found MAC address info from the OTP, use the default value */
+                       if (dhd_set_default_macaddr(dhdp) < 0) {
+                               dhd_free_tuple_entry(dhdp, &mac_list);
+                               return BCME_BADARG;
+                       }
+                       snprintf(otp_mac_buf, sizeof(otp_mac_buf), MAC_CUSTOM_FORMAT,
+                               (uint32)mac->octet[0], (uint32)mac->octet[1],
+                               (uint32)mac->octet[2], (uint32)mac->octet[3],
+                               (uint32)mac->octet[4], (uint32)mac->octet[5]);
+                       DHD_ERROR(("%s: Cannot find MAC address info from OTP,"
+                               " Check module mac by initial value: " MACDBG "\n",
+                               __FUNCTION__, MAC2STRDBG(mac->octet)));
+               }
+
+               dhd_free_tuple_entry(dhdp, &mac_list);
+#ifndef DHD_MAC_ADDR_EXPORT
+               dhd_write_file(filepath_efs, otp_mac_buf, strlen(otp_mac_buf));
+#else
+               /* Export otp_mac_buf to the sys/mac_addr */
+               if (!bcm_ether_atoe(otp_mac_buf, &sysfs_mac_addr)) {
+                       DHD_ERROR(("%s : mac parsing err\n", __FUNCTION__));
+                       if (dhd_set_default_macaddr(dhdp) < 0) {
+                               return BCME_BADARG;
+                       }
+               } else {
+                       DHD_INFO(("%s : set mac address properly\n", __FUNCTION__));
+                       /* set otp mac to sysfs */
+                       memcpy(mac, &sysfs_mac_addr, sizeof(sysfs_mac_addr));
+               }
+#endif /* !DHD_MAC_ADDR_EXPORT */
+       }
+
+       if (_dhd_set_mac_address(dhd, 0, mac) == 0) {
+               DHD_INFO(("%s: MAC Address is set\n", __FUNCTION__));
+       } else {
+               DHD_ERROR(("%s: Failed to set MAC address\n", __FUNCTION__));
+       }
+
+       return 0;
+}
+#endif /* GET_MAC_FROM_OTP */
+
+/*
+ * XXX:SWWLAN-210178 SysFS MAC ADDR export
+ * framework controls mac addr with sysfs mac_addr kernel object without file system
+ * For this reason, DHD doesn't need to write mac address to file system directly
+ */
+#ifndef DHD_MAC_ADDR_EXPORT
+#ifdef WRITE_MACADDR
+int
+dhd_write_macaddr(struct ether_addr *mac)
+{
+       char *filepath_data = MACINFO;
+       char *filepath_efs = MACINFO_EFS;
+       char mac_buf[MAC_BUF_SIZE];
+       int ret = 0;
+       int retry_cnt = 0;
+
+       memset(mac_buf, 0, sizeof(mac_buf));
+       snprintf(mac_buf, sizeof(mac_buf), MAC_CUSTOM_FORMAT,
+               (uint32)mac->octet[0], (uint32)mac->octet[1],
+               (uint32)mac->octet[2], (uint32)mac->octet[3],
+               (uint32)mac->octet[4], (uint32)mac->octet[5]);
+
+       if (filepath_data) {
+               for (retry_cnt = 0; retry_cnt < 3; retry_cnt++) {
+                       /* Write MAC information into /data/.mac.info */
+                       ret = dhd_write_file_and_check(filepath_data, mac_buf, strlen(mac_buf));
+                       if (!ret) {
+                               break;
+                       }
+               }
+
+               if (ret < 0) {
+                       DHD_ERROR(("%s: MAC address [%s] Failed to write into"
+                               " File: %s\n", __FUNCTION__, mac_buf, filepath_data));
+                       return BCME_ERROR;
+               }
+       } else {
+               DHD_ERROR(("%s: filepath_data doesn't exist\n", __FUNCTION__));
+       }
+
+       if (filepath_efs) {
+               for (retry_cnt = 0; retry_cnt < 3; retry_cnt++) {
+                       /* Write MAC information into /efs/wifi/.mac.info */
+                       ret = dhd_write_file_and_check(filepath_efs, mac_buf, strlen(mac_buf));
+                       if (!ret) {
+                               break;
+                       }
+               }
+
+               if (ret < 0) {
+                       DHD_ERROR(("%s: MAC address [%s] Failed to write into"
+                               " File: %s\n", __FUNCTION__, mac_buf, filepath_efs));
+                       return BCME_ERROR;
+               }
+       } else {
+               DHD_ERROR(("%s: filepath_efs doesn't exist\n", __FUNCTION__));
+       }
+
+       return ret;
+}
+#endif /* WRITE_MACADDR */
+#endif /* !DHD_MAC_ADDR_EXPORT */
+
+#ifdef USE_CID_CHECK
+/* Definitions for module information */
+#define MAX_VID_LEN            8
+
+#ifdef SUPPORT_MULTIPLE_BOARDTYPE
+#define MAX_BNAME_LEN          6
+
+typedef struct {
+       uint8 b_len;
+       unsigned char btype[MAX_VID_LEN];
+       char bname[MAX_BNAME_LEN];
+} board_info_t;
+
+#if defined(BCM4361_CHIP)
+board_info_t semco_PA_info[] = {
+       { 3, { 0x0f, 0x08, }, { "_ePA" } },     /* semco All ePA */
+       { 3, { 0x27, 0x08, }, { "_iPA" } },     /* semco 2g iPA, 5g ePA */
+       { 3, { 0x1a, 0x08, }, { "_iPA" } },             /* semco 2g iPA, 5g ePA old */
+       { 0, { 0x00, }, { "" } }   /* Default: Not specified yet */
+};
+#else
+board_info_t semco_board_info[] = {
+       { 3, { 0x51, 0x07, }, { "_b90b" } },     /* semco three antenna */
+       { 3, { 0x61, 0x07, }, { "_b90b" } },     /* semco two antenna */
+       { 0, { 0x00, }, { "" } }   /* Default: Not specified yet */
+};
+board_info_t murata_board_info[] = {
+       { 3, { 0xa5, 0x07, }, { "_b90" } },      /* murata three antenna */
+       { 3, { 0xb0, 0x07, }, { "_b90b" } },     /* murata two antenna */
+       { 3, { 0xb1, 0x07, }, { "_es5" } },     /* murata two antenna */
+       { 0, { 0x00, }, { "" } }   /* Default: Not specified yet */
+};
+#endif /* BCM4361_CHIP */
+#endif /* SUPPORT_MULTIPLE_BOARDTYPE */
+
+typedef struct {
+       uint8 vid_length;
+       unsigned char vid[MAX_VID_LEN];
+       char cid_info[MAX_VNAME_LEN];
+} vid_info_t;
+
+#if defined(BCM4335_CHIP)
+vid_info_t vid_info[] = {
+       { 3, { 0x33, 0x66, }, { "semcosh" } },          /* B0 Sharp 5G-FEM */
+       { 3, { 0x33, 0x33, }, { "semco" } },            /* B0 Skyworks 5G-FEM and A0 chip */
+       { 3, { 0x33, 0x88, }, { "semco3rd" } },         /* B0 Syri 5G-FEM */
+       { 3, { 0x00, 0x11, }, { "muratafem1" } },       /* B0 ANADIGICS 5G-FEM */
+       { 3, { 0x00, 0x22, }, { "muratafem2" } },       /* B0 TriQuint 5G-FEM */
+       { 3, { 0x00, 0x33, }, { "muratafem3" } },       /* 3rd FEM: Reserved */
+       { 0, { 0x00, }, { "murata" } }  /* Default: for Murata A0 module */
+};
+#elif defined(BCM4339_CHIP) || defined(BCM4354_CHIP) || \
+       defined(BCM4356_CHIP)
+vid_info_t vid_info[] = {                        /* 4339:2G FEM+5G FEM ,4354: 2G FEM+5G FEM */
+       { 3, { 0x33, 0x33, }, { "semco" } },      /* 4339:Skyworks+sharp,4354:Panasonic+Panasonic */
+       { 3, { 0x33, 0x66, }, { "semco" } },      /* 4339:  , 4354:Panasonic+SEMCO */
+       { 3, { 0x33, 0x88, }, { "semco3rd" } },   /* 4339:  , 4354:SEMCO+SEMCO */
+       { 3, { 0x90, 0x01, }, { "wisol" } },      /* 4339:  , 4354:Microsemi+Panasonic */
+       { 3, { 0x90, 0x02, }, { "wisolfem1" } },  /* 4339:  , 4354:Panasonic+Panasonic */
+       { 3, { 0x90, 0x03, }, { "wisolfem2" } },  /* 4354:Murata+Panasonic */
+       { 3, { 0x00, 0x11, }, { "muratafem1" } }, /* 4339:  , 4354:Murata+Anadigics */
+       { 3, { 0x00, 0x22, }, { "muratafem2"} },  /* 4339:  , 4354:Murata+Triquint */
+       { 0, { 0x00, }, { "samsung" } }           /* Default: Not specified yet */
+};
+#elif defined(BCM4358_CHIP)
+vid_info_t vid_info[] = {
+       { 3, { 0x33, 0x33, }, { "semco_b85" } },
+       { 3, { 0x33, 0x66, }, { "semco_b85" } },
+       { 3, { 0x33, 0x88, }, { "semco3rd_b85" } },
+       { 3, { 0x90, 0x01, }, { "wisol_b85" } },
+       { 3, { 0x90, 0x02, }, { "wisolfem1_b85" } },
+       { 3, { 0x90, 0x03, }, { "wisolfem2_b85" } },
+       { 3, { 0x31, 0x90, }, { "wisol_b85b" } },
+       { 3, { 0x00, 0x11, }, { "murata_b85" } },
+       { 3, { 0x00, 0x22, }, { "murata_b85"} },
+       { 6, { 0x00, 0xFF, 0xFF, 0x00, 0x00, }, { "murata_b85"} },
+       { 3, { 0x10, 0x33, }, { "semco_b85a" } },
+       { 3, { 0x30, 0x33, }, { "semco_b85b" } },
+       { 3, { 0x31, 0x33, }, { "semco_b85b" } },
+       { 3, { 0x10, 0x22, }, { "murata_b85a" } },
+       { 3, { 0x20, 0x22, }, { "murata_b85a" } },
+       { 3, { 0x21, 0x22, }, { "murata_b85a" } },
+       { 3, { 0x23, 0x22, }, { "murata_b85a" } },
+       { 3, { 0x31, 0x22, }, { "murata_b85b" } },
+       { 0, { 0x00, }, { "samsung" } }           /* Default: Not specified yet */
+};
+#elif defined(BCM4359_CHIP)
+vid_info_t vid_info[] = {
+#if defined(SUPPORT_BCM4359_MIXED_MODULES)
+       { 3, { 0x34, 0x33, }, { "semco_b90b" } },
+       { 3, { 0x40, 0x33, }, { "semco_b90b" } },
+       { 3, { 0x41, 0x33, }, { "semco_b90b" } },
+       { 3, { 0x11, 0x33, }, { "semco_b90b" } },
+       { 3, { 0x33, 0x66, }, { "semco_b90b" } },
+       { 3, { 0x23, 0x22, }, { "murata_b90b" } },
+       { 3, { 0x40, 0x22, }, { "murata_b90b" } },
+       { 3, { 0x10, 0x90, }, { "wisol_b90b" } },
+       { 3, { 0x33, 0x33, }, { "semco_b90s_b1" } },
+       { 3, { 0x66, 0x33, }, { "semco_b90s_c0" } },
+       { 3, { 0x60, 0x22, }, { "murata_b90s_b1" } },
+       { 3, { 0x61, 0x22, }, { "murata_b90s_b1" } },
+       { 3, { 0x62, 0x22, }, { "murata_b90s_b1" } },
+       { 3, { 0x63, 0x22, }, { "murata_b90s_b1" } },
+       { 3, { 0x70, 0x22, }, { "murata_b90s_c0" } },
+       { 3, { 0x71, 0x22, }, { "murata_b90s_c0" } },
+       { 3, { 0x72, 0x22, }, { "murata_b90s_c0" } },
+       { 3, { 0x73, 0x22, }, { "murata_b90s_c0" } },
+       { 0, { 0x00, }, { "samsung" } }           /* Default: Not specified yet */
+#else /* SUPPORT_BCM4359_MIXED_MODULES */
+       { 3, { 0x34, 0x33, }, { "semco" } },
+       { 3, { 0x40, 0x33, }, { "semco" } },
+       { 3, { 0x41, 0x33, }, { "semco" } },
+       { 3, { 0x11, 0x33, }, { "semco" } },
+       { 3, { 0x33, 0x66, }, { "semco" } },
+       { 3, { 0x23, 0x22, }, { "murata" } },
+       { 3, { 0x40, 0x22, }, { "murata" } },
+       { 3, { 0x51, 0x22, }, { "murata" } },
+       { 3, { 0x52, 0x22, }, { "murata" } },
+       { 3, { 0x10, 0x90, }, { "wisol" } },
+       { 0, { 0x00, }, { "samsung" } }           /* Default: Not specified yet */
+#endif /* SUPPORT_BCM4359_MIXED_MODULES */
+};
+#elif defined(BCM4361_CHIP)
+vid_info_t vid_info[] = {
+#if defined(SUPPORT_BCM4361_MIXED_MODULES)
+       { 3, { 0x66, 0x33, }, { "semco_sky_r00a_e000_a0" } },
+       { 3, { 0x30, 0x33, }, { "semco_sky_r01a_e30a_a1" } },
+       { 3, { 0x31, 0x33, }, { "semco_sky_r02a_e30a_a1" } },
+       { 3, { 0x32, 0x33, }, { "semco_sky_r02a_e30a_a1" } },
+       { 3, { 0x51, 0x33, }, { "semco_sky_r01d_e31_b0" } },
+       { 3, { 0x61, 0x33, }, { "semco_sem_r01f_e31_b0" } },
+       { 3, { 0x62, 0x33, }, { "semco_sem_r02g_e31_b0" } },
+       { 3, { 0x71, 0x33, }, { "semco_sky_r01h_e32_b0" } },
+       { 3, { 0x81, 0x33, }, { "semco_sem_r01i_e32_b0" } },
+       { 3, { 0x82, 0x33, }, { "semco_sem_r02j_e32_b0" } },
+       { 3, { 0x91, 0x33, }, { "semco_sem_r02a_e32a_b2" } },
+       { 3, { 0xa1, 0x33, }, { "semco_sem_r02b_e32a_b2" } },
+       { 3, { 0x12, 0x22, }, { "murata_nxp_r012_1kl_a1" } },
+       { 3, { 0x13, 0x22, }, { "murata_mur_r013_1kl_b0" } },
+       { 3, { 0x14, 0x22, }, { "murata_mur_r014_1kl_b0" } },
+       { 3, { 0x15, 0x22, }, { "murata_mur_r015_1kl_b0" } },
+       { 3, { 0x20, 0x22, }, { "murata_mur_r020_1kl_b0" } },
+       { 3, { 0x21, 0x22, }, { "murata_mur_r021_1kl_b0" } },
+       { 3, { 0x22, 0x22, }, { "murata_mur_r022_1kl_b0" } },
+       { 3, { 0x23, 0x22, }, { "murata_mur_r023_1kl_b0" } },
+       { 3, { 0x24, 0x22, }, { "murata_mur_r024_1kl_b0" } },
+       { 3, { 0x30, 0x22, }, { "murata_mur_r030_1kl_b0" } },
+       { 3, { 0x31, 0x22, }, { "murata_mur_r031_1kl_b0" } },
+       { 3, { 0x32, 0x22, }, { "murata_mur_r032_1kl_b0" } },
+       { 3, { 0x33, 0x22, }, { "murata_mur_r033_1kl_b0" } },
+       { 3, { 0x34, 0x22, }, { "murata_mur_r034_1kl_b0" } },
+       { 3, { 0x50, 0x22, }, { "murata_mur_r020_1qw_b2" } },
+       { 3, { 0x51, 0x22, }, { "murata_mur_r021_1qw_b2" } },
+       { 3, { 0x52, 0x22, }, { "murata_mur_r022_1qw_b2" } },
+       { 3, { 0x61, 0x22, }, { "murata_mur_r031_1qw_b2" } },
+       { 0, { 0x00, }, { "samsung" } }           /* Default: Not specified yet */
+#endif /* SUPPORT_BCM4359_MIXED_MODULES */
+};
+#elif defined(BCM4375_CHIP)
+vid_info_t vid_info[] = {
+#if defined(SUPPORT_BCM4375_MIXED_MODULES)
+       { 3, { 0x11, 0x33, }, { "semco_sky_e41_es11" } },
+       { 3, { 0x33, 0x33, }, { "semco_sem_e43_es33" } },
+       { 3, { 0x34, 0x33, }, { "semco_sem_e43_es34" } },
+       { 3, { 0x35, 0x33, }, { "semco_sem_e43_es35" } },
+       { 3, { 0x36, 0x33, }, { "semco_sem_e43_es36" } },
+       { 3, { 0x41, 0x33, }, { "semco_sem_e43_cs41" } },
+       { 3, { 0x51, 0x33, }, { "semco_sem_e43_cs51" } },
+       { 3, { 0x53, 0x33, }, { "semco_sem_e43_cs53" } },
+       { 3, { 0x61, 0x33, }, { "semco_sky_e43_cs61" } },
+       { 3, { 0x10, 0x22, }, { "murata_mur_1rh_es10" } },
+       { 3, { 0x11, 0x22, }, { "murata_mur_1rh_es11" } },
+       { 3, { 0x12, 0x22, }, { "murata_mur_1rh_es12" } },
+       { 3, { 0x13, 0x22, }, { "murata_mur_1rh_es13" } },
+       { 3, { 0x20, 0x22, }, { "murata_mur_1rh_es20" } },
+       { 3, { 0x32, 0x22, }, { "murata_mur_1rh_es32" } },
+       { 3, { 0x41, 0x22, }, { "murata_mur_1rh_es41" } },
+       { 3, { 0x42, 0x22, }, { "murata_mur_1rh_es42" } },
+       { 3, { 0x43, 0x22, }, { "murata_mur_1rh_es43" } },
+       { 3, { 0x44, 0x22, }, { "murata_mur_1rh_es44" } }
+#endif /* SUPPORT_BCM4375_MIXED_MODULES */
+};
+#elif defined(BCM4389_CHIP_DEF)
+vid_info_t vid_info[] = {
+#if defined(SUPPORT_BCM4389_MIXED_MODULES)
+       { 3, { 0x11, 0x33, }, { "semco_sem_e51_es11" } },
+       { 3, { 0x12, 0x33, }, { "semco_sem_e51_es12" } },
+       { 3, { 0x21, 0x33, }, { "semco_sem_e53_es23" } },
+       { 3, { 0x23, 0x33, }, { "semco_sem_e53_es23" } },
+       { 3, { 0x21, 0x22, }, { "murata_mur_1wk_es21" } },
+       { 3, { 0x30, 0x22, }, { "murata_mur_1wk_es30" } },
+       { 3, { 0x31, 0x22, }, { "murata_mur_1wk_es31" } }
+#endif /* SUPPORT_BCM4389_MIXED_MODULES */
+};
+#else
+vid_info_t vid_info[] = {
+       { 0, { 0x00, }, { "samsung" } }                 /* Default: Not specified yet */
+};
+#endif /* BCM_CHIP_ID */
+
+/* CID managment functions */
+static int
+dhd_find_tuple_idx_from_otp(dhd_pub_t *dhdp, int req_tup, unsigned char *req_tup_len)
+{
+       struct list_head head;
+       int start_idx;
+       int entry_num;
+
+       if (!g_cis_buf) {
+               DHD_ERROR(("%s: Couldn't find cis info from"
+                       " local buffer\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       INIT_LIST_HEAD(&head);
+       entry_num = dhd_find_tuple_list_from_otp(dhdp, req_tup, req_tup_len, &head);
+       /* find the first cis index from the tuple list */
+       if (entry_num > 0) {
+               tuple_entry_t *cur = list_entry((&head)->next, tuple_entry_t, list);
+               start_idx = cur->cis_idx;
+       } else {
+               start_idx = -1; /* Invalid index */
+       }
+
+       dhd_free_tuple_entry(dhdp, &head);
+
+       return start_idx;
+}
+
+char *
+dhd_get_cid_info(unsigned char *vid, int vid_length)
+{
+       int i;
+
+       for (i = 0; i < ARRAYSIZE(vid_info); i++) {
+               if (vid_info[i].vid_length-1 == vid_length &&
+                               !memcmp(vid_info[i].vid, vid, vid_length)) {
+                       return vid_info[i].cid_info;
+               }
+       }
+
+       return NULL;
+}
+
+int
+dhd_check_module_cid(dhd_pub_t *dhdp)
+{
+       int ret = -1;
+#ifndef DHD_EXPORT_CNTL_FILE
+       const char *cidfilepath = CIDINFO;
+#endif /* DHD_EXPORT_CNTL_FILE */
+       int idx, max;
+       vid_info_t *cur_info;
+       unsigned char *tuple_start = NULL;
+       unsigned char tuple_length = 0;
+       unsigned char cid_info[MAX_VNAME_LEN];
+       int found = FALSE;
+#ifdef SUPPORT_MULTIPLE_BOARDTYPE
+       board_info_t *cur_b_info = NULL;
+       board_info_t *vendor_b_info = NULL;
+       unsigned char *btype_start;
+       unsigned char boardtype_len = 0;
+#endif /* SUPPORT_MULTIPLE_BOARDTYPE */
+
+       /* Try reading out from CIS */
+       if (!g_cis_buf) {
+               DHD_INFO(("%s: Couldn't read CIS info\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       DHD_INFO(("%s: Reading CIS from local buffer\n", __FUNCTION__));
+#ifdef DUMP_CIS
+       dhd_dump_cis_buf(dhdp, DUMP_CIS_SIZE);
+#endif /* DUMP_CIS */
+
+       idx = dhd_find_tuple_idx_from_otp(dhdp, CIS_TUPLE_TAG_VENDOR, &tuple_length);
+       if (idx > 0) {
+               found = TRUE;
+               tuple_start = &g_cis_buf[idx];
+       }
+
+       if (found) {
+               max = sizeof(vid_info) / sizeof(vid_info_t);
+               for (idx = 0; idx < max; idx++) {
+                       cur_info = &vid_info[idx];
+#ifdef BCM4358_CHIP
+                       if (cur_info->vid_length  == 6 && tuple_length == 6) {
+                               if (cur_info->vid[0] == tuple_start[0] &&
+                                       cur_info->vid[3] == tuple_start[3] &&
+                                       cur_info->vid[4] == tuple_start[4]) {
+                                       goto check_board_type;
+                               }
+                       }
+#endif /* BCM4358_CHIP */
+                       if ((cur_info->vid_length == tuple_length) &&
+                               (cur_info->vid_length != 0) &&
+                               (memcmp(cur_info->vid, tuple_start,
+                                       cur_info->vid_length - 1) == 0)) {
+                               goto check_board_type;
+                       }
+               }
+       }
+
+       /* find default nvram, if exist */
+       DHD_ERROR(("%s: cannot find CIS TUPLE set as default\n", __FUNCTION__));
+       max = sizeof(vid_info) / sizeof(vid_info_t);
+       for (idx = 0; idx < max; idx++) {
+               cur_info = &vid_info[idx];
+               if (cur_info->vid_length == 0) {
+                       goto write_cid;
+               }
+       }
+       DHD_ERROR(("%s: cannot find default CID\n", __FUNCTION__));
+       return BCME_ERROR;
+
+check_board_type:
+#ifdef SUPPORT_MULTIPLE_BOARDTYPE
+       idx = dhd_find_tuple_idx_from_otp(dhdp, CIS_TUPLE_TAG_BOARDTYPE, &tuple_length);
+       if (idx > 0) {
+               btype_start = &g_cis_buf[idx];
+               boardtype_len = tuple_length;
+               DHD_INFO(("%s: board type found.\n", __FUNCTION__));
+       } else {
+               boardtype_len = 0;
+       }
+#if defined(BCM4361_CHIP)
+       vendor_b_info = semco_PA_info;
+       max = sizeof(semco_PA_info) / sizeof(board_info_t);
+#else
+       if (strcmp(cur_info->cid_info, "semco") == 0) {
+               vendor_b_info = semco_board_info;
+               max = sizeof(semco_board_info) / sizeof(board_info_t);
+       } else if (strcmp(cur_info->cid_info, "murata") == 0) {
+               vendor_b_info = murata_board_info;
+               max = sizeof(murata_board_info) / sizeof(board_info_t);
+       } else {
+               max = 0;
+       }
+#endif /* BCM4361_CHIP */
+       if (boardtype_len) {
+               for (idx = 0; idx < max; idx++) {
+                       cur_b_info = vendor_b_info;
+                       if ((cur_b_info->b_len == boardtype_len) &&
+                               (cur_b_info->b_len != 0) &&
+                               (memcmp(cur_b_info->btype, btype_start,
+                                       cur_b_info->b_len - 1) == 0)) {
+                               DHD_INFO(("%s : board type name : %s\n",
+                                       __FUNCTION__, cur_b_info->bname));
+                               break;
+                       }
+                       cur_b_info = NULL;
+                       vendor_b_info++;
+               }
+       }
+#endif /* SUPPORT_MULTIPLE_BOARDTYPE */
+
+write_cid:
+#ifdef SUPPORT_MULTIPLE_BOARDTYPE
+       if (cur_b_info && cur_b_info->b_len > 0) {
+               strcpy(cid_info, cur_info->cid_info);
+               strcpy(cid_info + strlen(cur_info->cid_info), cur_b_info->bname);
+       } else
+#endif /* SUPPORT_MULTIPLE_BOARDTYPE */
+               strcpy(cid_info, cur_info->cid_info);
+
+       DHD_INFO(("%s: CIS MATCH FOUND : %s\n", __FUNCTION__, cid_info));
+#ifndef DHD_EXPORT_CNTL_FILE
+       dhd_write_file(cidfilepath, cid_info, strlen(cid_info) + 1);
+#else
+       strlcpy(cidinfostr, cid_info, MAX_VNAME_LEN);
+#endif /* DHD_EXPORT_CNTL_FILE */
+
+       return ret;
+}
+
+#ifdef SUPPORT_MULTIPLE_MODULE_CIS
+#ifndef DHD_EXPORT_CNTL_FILE
+static bool
+dhd_check_module(char *module_name)
+{
+       char vname[MAX_VNAME_LEN];
+       const char *cidfilepath = CIDINFO;
+       int ret;
+
+       memset(vname, 0, sizeof(vname));
+       ret = dhd_read_file(cidfilepath, vname, sizeof(vname) - 1);
+       if (ret < 0) {
+               return FALSE;
+       }
+       DHD_INFO(("%s: This module is %s \n", __FUNCTION__, vname));
+       return strstr(vname, module_name) ? TRUE : FALSE;
+}
+#else
+bool
+dhd_check_module(char *module_name)
+{
+       return strstr(cidinfostr, module_name) ? TRUE : FALSE;
+}
+#endif /* !DHD_EXPORT_CNTL_FILE */
+
+int
+dhd_check_module_b85a(void)
+{
+       int ret;
+       char *vname_b85a = "_b85a";
+
+       if (dhd_check_module(vname_b85a)) {
+               DHD_INFO(("%s: It's a b85a module\n", __FUNCTION__));
+               ret = 1;
+       } else {
+               DHD_INFO(("%s: It is not a b85a module\n", __FUNCTION__));
+               ret = -1;
+       }
+
+       return ret;
+}
+
+int
+dhd_check_module_b90(void)
+{
+       int ret = 0;
+       char *vname_b90b = "_b90b";
+       char *vname_b90s = "_b90s";
+
+       if (dhd_check_module(vname_b90b)) {
+               DHD_INFO(("%s: It's a b90b module \n", __FUNCTION__));
+               ret = BCM4359_MODULE_TYPE_B90B;
+       } else if (dhd_check_module(vname_b90s)) {
+               DHD_INFO(("%s: It's a b90s module\n", __FUNCTION__));
+               ret = BCM4359_MODULE_TYPE_B90S;
+       } else {
+               DHD_ERROR(("%s: It's neither b90b nor b90s\n", __FUNCTION__));
+               ret = BCME_ERROR;
+       }
+
+       return ret;
+}
+#endif /* SUPPORT_MULTIPLE_MODULE_CIS */
+
+#define CID_FEM_MURATA "_mur_"
+/* extract module type from cid information */
+/* XXX: extract string by delimiter '_' at specific counting position.
+ * it would be used for module type information.
+ * for example, cid information is 'semco_sky_r02a_e30a_a1',
+ * then output (module type) is 'r02a_e30a_a1' when index is 3.
+ */
+int
+dhd_check_module_bcm(char *module_type, int index, bool *is_murata_fem)
+{
+       int ret = 0, i;
+       char vname[MAX_VNAME_LEN];
+       char *ptr = NULL;
+#ifndef DHD_EXPORT_CNTL_FILE
+       const char *cidfilepath = CIDINFO;
+#endif /* DHD_EXPORT_CNTL_FILE */
+
+       memset(vname, 0, sizeof(vname));
+
+#ifndef DHD_EXPORT_CNTL_FILE
+       ret = dhd_read_file(cidfilepath, vname, sizeof(vname) - 1);
+       if (ret < 0) {
+               DHD_ERROR(("%s: failed to get module infomaion from .cid.info\n",
+                       __FUNCTION__));
+               return ret;
+       }
+#else
+       strlcpy(vname, cidinfostr, MAX_VNAME_LEN);
+#endif /* DHD_EXPORT_CNTL_FILE */
+
+       for (i = 1, ptr = vname; i < index && ptr; i++) {
+               ptr = bcmstrstr(ptr, "_");
+               if (ptr) {
+                       ptr++;
+               }
+       }
+
+       if (bcmstrnstr(vname, MAX_VNAME_LEN, CID_FEM_MURATA, 5)) {
+               *is_murata_fem = TRUE;
+       }
+
+       if (ptr) {
+               memcpy(module_type, ptr, strlen(ptr));
+       } else {
+               DHD_ERROR(("%s: failed to get module infomaion\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       DHD_INFO(("%s: module type = %s \n", __FUNCTION__, module_type));
+
+       return ret;
+}
+#endif /* USE_CID_CHECK */
+#endif /* DHD_USE_CISINFO */
diff --git a/bcmdhd.101.10.240.x/dhd_custom_exynos.c b/bcmdhd.101.10.240.x/dhd_custom_exynos.c
new file mode 100644 (file)
index 0000000..c1baee0
--- /dev/null
@@ -0,0 +1,310 @@
+/*
+ * Platform Dependent file for Samsung Exynos
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+#include <linux/device.h>
+#include <linux/gpio.h>
+#include <linux/of_gpio.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/slab.h>
+#include <linux/workqueue.h>
+#include <linux/poll.h>
+#include <linux/miscdevice.h>
+#include <linux/sched.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/list.h>
+#include <linux/io.h>
+#include <linux/workqueue.h>
+#include <linux/unistd.h>
+#include <linux/bug.h>
+#include <linux/skbuff.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/wlan_plat.h>
+#if defined(CONFIG_SOC_EXYNOS8895) || defined(CONFIG_SOC_EXYNOS9810) || \
+       defined(CONFIG_SOC_EXYNOS9820) || defined(CONFIG_SOC_EXYNOS9830)
+#include <linux/exynos-pci-ctrl.h>
+#endif /* CONFIG_SOC_EXYNOS8895 || CONFIG_SOC_EXYNOS9810 ||
+       * CONFIG_SOC_EXYNOS9820 || CONFIG_SOC_EXYNOS9830
+       */
+
+#if defined(CONFIG_64BIT)
+#include <asm-generic/gpio.h>
+#endif /* CONFIG_64BIT */
+
+#if defined(CONFIG_SEC_SYSFS)
+#include <linux/sec_sysfs.h>
+#elif defined(CONFIG_DRV_SAMSUNG)
+#include <linux/sec_class.h>
+#endif /* CONFIG_SEC_SYSFS */
+
+#if defined(CONFIG_MACH_A7LTE) || defined(CONFIG_NOBLESSE)
+#define PINCTL_DELAY 150
+#endif /* CONFIG_MACH_A7LTE || CONFIG_NOBLESSE */
+
+#ifdef CONFIG_BROADCOM_WIFI_RESERVED_MEM
+extern int dhd_init_wlan_mem(void);
+extern void *dhd_wlan_mem_prealloc(int section, unsigned long size);
+#endif /* CONFIG_BROADCOM_WIFI_RESERVED_MEM */
+
+#define WIFI_TURNON_DELAY      200
+static int wlan_pwr_on = -1;
+
+#ifdef CONFIG_BCMDHD_OOB_HOST_WAKE
+static int wlan_host_wake_irq = 0;
+EXPORT_SYMBOL(wlan_host_wake_irq);
+static unsigned int wlan_host_wake_up = -1;
+#endif /* CONFIG_BCMDHD_OOB_HOST_WAKE */
+
+#if defined(CONFIG_MACH_A7LTE) || defined(CONFIG_NOBLESSE)
+extern struct device *mmc_dev_for_wlan;
+#endif /* CONFIG_MACH_A7LTE || CONFIG_NOBLESSE */
+
+#ifdef CONFIG_BCMDHD_PCIE
+#if defined(CONFIG_MACH_UNIVERSAL7420) || defined(CONFIG_MACH_EXSOM7420)
+#define SAMSUNG_PCIE_CH_NUM 1
+#else
+#define SAMSUNG_PCIE_CH_NUM 0
+#endif /* PCIE RC CH# by Platform defines */
+extern void exynos_pcie_pm_resume(int);
+extern void exynos_pcie_pm_suspend(int);
+#endif /* CONFIG_BCMDHD_PCIE */
+
+#if defined(CONFIG_SOC_EXYNOS7870) || defined(CONFIG_SOC_EXYNOS9110)
+extern struct mmc_host *wlan_mmc;
+extern void mmc_ctrl_power(struct mmc_host *host, bool onoff);
+#endif /* SOC_EXYNOS7870 || CONFIG_SOC_EXYNOS9110 */
+
+static int
+dhd_wlan_power(int onoff)
+{
+#if defined(CONFIG_MACH_A7LTE) || defined(CONFIG_NOBLESSE)
+       struct pinctrl *pinctrl = NULL;
+#endif /* CONFIG_MACH_A7LTE || ONFIG_NOBLESSE */
+
+       printk(KERN_INFO"%s Enter: power %s\n", __FUNCTION__, onoff ? "on" : "off");
+
+#if defined(CONFIG_MACH_A7LTE) || defined(CONFIG_NOBLESSE)
+       if (onoff) {
+               pinctrl = devm_pinctrl_get_select(mmc_dev_for_wlan, "sdio_wifi_on");
+               if (IS_ERR(pinctrl))
+                       printk(KERN_INFO "%s WLAN SDIO GPIO control error\n", __FUNCTION__);
+               msleep(PINCTL_DELAY);
+       }
+#endif /* CONFIG_MACH_A7LTE || CONFIG_NOBLESSE */
+
+       if (gpio_direction_output(wlan_pwr_on, onoff)) {
+               printk(KERN_ERR "%s failed to control WLAN_REG_ON to %s\n",
+                       __FUNCTION__, onoff ? "HIGH" : "LOW");
+               return -EIO;
+       }
+
+#if defined(CONFIG_MACH_A7LTE) || defined(CONFIG_NOBLESSE)
+       if (!onoff) {
+               pinctrl = devm_pinctrl_get_select(mmc_dev_for_wlan, "sdio_wifi_off");
+               if (IS_ERR(pinctrl))
+                       printk(KERN_INFO "%s WLAN SDIO GPIO control error\n", __FUNCTION__);
+       }
+#endif /* CONFIG_MACH_A7LTE || CONFIG_NOBLESSE */
+
+#if defined(CONFIG_SOC_EXYNOS7870) || defined(CONFIG_SOC_EXYNOS9110)
+       if (wlan_mmc)
+               mmc_ctrl_power(wlan_mmc, onoff);
+#endif /* SOC_EXYNOS7870 || CONFIG_SOC_EXYNOS9110 */
+       return 0;
+}
+
+static int
+dhd_wlan_reset(int onoff)
+{
+       return 0;
+}
+
+#ifndef CONFIG_BCMDHD_PCIE
+extern void (*notify_func_callback)(void *dev_id, int state);
+extern void *mmc_host_dev;
+#endif /* !CONFIG_BCMDHD_PCIE */
+
+static int
+dhd_wlan_set_carddetect(int val)
+{
+#ifndef CONFIG_BCMDHD_PCIE
+       pr_err("%s: notify_func=%p, mmc_host_dev=%p, val=%d\n",
+               __FUNCTION__, notify_func_callback, mmc_host_dev, val);
+
+       if (notify_func_callback) {
+               notify_func_callback(mmc_host_dev, val);
+       } else {
+               pr_warning("%s: Nobody to notify\n", __FUNCTION__);
+       }
+#else
+       if (val) {
+               exynos_pcie_pm_resume(SAMSUNG_PCIE_CH_NUM);
+       } else {
+               exynos_pcie_pm_suspend(SAMSUNG_PCIE_CH_NUM);
+       }
+#endif /* CONFIG_BCMDHD_PCIE */
+
+       return 0;
+}
+
+int __init
+dhd_wlan_init_gpio(void)
+{
+       const char *wlan_node = "samsung,brcm-wlan";
+       struct device_node *root_node = NULL;
+       struct device *wlan_dev;
+
+       wlan_dev = sec_device_create(NULL, "wlan");
+
+       root_node = of_find_compatible_node(NULL, NULL, wlan_node);
+       if (!root_node) {
+               WARN(1, "failed to get device node of bcm4354\n");
+               return -ENODEV;
+       }
+
+       /* ========== WLAN_PWR_EN ============ */
+       wlan_pwr_on = of_get_gpio(root_node, 0);
+       if (!gpio_is_valid(wlan_pwr_on)) {
+               WARN(1, "Invalied gpio pin : %d\n", wlan_pwr_on);
+               return -ENODEV;
+       }
+
+       if (gpio_request(wlan_pwr_on, "WLAN_REG_ON")) {
+               WARN(1, "fail to request gpio(WLAN_REG_ON)\n");
+               return -ENODEV;
+       }
+#ifdef CONFIG_BCMDHD_PCIE
+       gpio_direction_output(wlan_pwr_on, 1);
+       msleep(WIFI_TURNON_DELAY);
+#else
+       gpio_direction_output(wlan_pwr_on, 0);
+#endif /* CONFIG_BCMDHD_PCIE */
+       gpio_export(wlan_pwr_on, 1);
+       if (wlan_dev)
+               gpio_export_link(wlan_dev, "WLAN_REG_ON", wlan_pwr_on);
+
+#ifdef CONFIG_BCMDHD_PCIE
+       exynos_pcie_pm_resume(SAMSUNG_PCIE_CH_NUM);
+#endif /* CONFIG_BCMDHD_PCIE */
+
+#ifdef CONFIG_BCMDHD_OOB_HOST_WAKE
+       /* ========== WLAN_HOST_WAKE ============ */
+       wlan_host_wake_up = of_get_gpio(root_node, 1);
+       if (!gpio_is_valid(wlan_host_wake_up)) {
+               WARN(1, "Invalied gpio pin : %d\n", wlan_host_wake_up);
+               return -ENODEV;
+       }
+
+       if (gpio_request(wlan_host_wake_up, "WLAN_HOST_WAKE")) {
+               WARN(1, "fail to request gpio(WLAN_HOST_WAKE)\n");
+               return -ENODEV;
+       }
+       gpio_direction_input(wlan_host_wake_up);
+       gpio_export(wlan_host_wake_up, 1);
+       if (wlan_dev)
+               gpio_export_link(wlan_dev, "WLAN_HOST_WAKE", wlan_host_wake_up);
+
+       wlan_host_wake_irq = gpio_to_irq(wlan_host_wake_up);
+#endif /* CONFIG_BCMDHD_OOB_HOST_WAKE */
+
+       return 0;
+}
+
+#if defined(CONFIG_BCMDHD_OOB_HOST_WAKE) && defined(CONFIG_BCMDHD_GET_OOB_STATE)
+int
+dhd_get_wlan_oob_gpio(void)
+{
+       return gpio_is_valid(wlan_host_wake_up) ?
+               gpio_get_value(wlan_host_wake_up) : -1;
+}
+EXPORT_SYMBOL(dhd_get_wlan_oob_gpio);
+#endif /* CONFIG_BCMDHD_OOB_HOST_WAKE && CONFIG_BCMDHD_GET_OOB_STATE */
+
+struct resource dhd_wlan_resources = {
+       .name   = "bcmdhd_wlan_irq",
+       .start  = 0,
+       .end    = 0,
+       .flags  = IORESOURCE_IRQ | IORESOURCE_IRQ_SHAREABLE |
+#ifdef CONFIG_BCMDHD_PCIE
+       IORESOURCE_IRQ_HIGHEDGE,
+#else
+       IORESOURCE_IRQ_HIGHLEVEL,
+#endif /* CONFIG_BCMDHD_PCIE */
+};
+EXPORT_SYMBOL(dhd_wlan_resources);
+
+struct wifi_platform_data dhd_wlan_control = {
+       .set_power      = dhd_wlan_power,
+       .set_reset      = dhd_wlan_reset,
+       .set_carddetect = dhd_wlan_set_carddetect,
+#ifdef CONFIG_BROADCOM_WIFI_RESERVED_MEM
+       .mem_prealloc   = dhd_wlan_mem_prealloc,
+#endif /* CONFIG_BROADCOM_WIFI_RESERVED_MEM */
+};
+EXPORT_SYMBOL(dhd_wlan_control);
+
+int __init
+dhd_wlan_init(void)
+{
+       int ret;
+
+       printk(KERN_INFO "%s: START.......\n", __FUNCTION__);
+       ret = dhd_wlan_init_gpio();
+       if (ret < 0) {
+               printk(KERN_ERR "%s: failed to initiate GPIO, ret=%d\n",
+                       __FUNCTION__, ret);
+               goto fail;
+       }
+
+#ifdef CONFIG_BCMDHD_OOB_HOST_WAKE
+       dhd_wlan_resources.start = wlan_host_wake_irq;
+       dhd_wlan_resources.end = wlan_host_wake_irq;
+#endif /* CONFIG_BCMDHD_OOB_HOST_WAKE */
+
+#ifdef CONFIG_BROADCOM_WIFI_RESERVED_MEM
+       ret = dhd_init_wlan_mem();
+       if (ret < 0) {
+               printk(KERN_ERR "%s: failed to alloc reserved memory,"
+                       " ret=%d\n", __FUNCTION__, ret);
+       }
+#endif /* CONFIG_BROADCOM_WIFI_RESERVED_MEM */
+
+fail:
+       return ret;
+}
+
+#if defined(CONFIG_MACH_UNIVERSAL7420) || defined(CONFIG_SOC_EXYNOS8890) || \
+       defined(CONFIG_SOC_EXYNOS8895) || defined(CONFIG_SOC_EXYNOS9810) || \
+       defined(CONFIG_SOC_EXYNOS9820) || defined(CONFIG_SOC_EXYNOS9830)
+#if defined(CONFIG_DEFERRED_INITCALLS)
+deferred_module_init(dhd_wlan_init);
+#else
+late_initcall(dhd_wlan_init);
+#endif /* CONFIG_DEFERRED_INITCALLS */
+#else
+device_initcall(dhd_wlan_init);
+#endif /* CONFIG Exynos PCIE Platforms */
diff --git a/bcmdhd.101.10.240.x/dhd_custom_gpio.c b/bcmdhd.101.10.240.x/dhd_custom_gpio.c
new file mode 100644 (file)
index 0000000..b032264
--- /dev/null
@@ -0,0 +1,294 @@
+/*
+ * Customer code to add GPIO control during WLAN start/stop
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_linux.h>
+
+#include <wlioctl.h>
+
+#define WL_ERROR(x) printf x
+#define WL_TRACE(x)
+
+#if defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID)
+
+#if defined(BCMLXSDMMC)
+extern int sdioh_mmc_irq(int irq);
+#endif /* (BCMLXSDMMC)  */
+
+/* Customer specific Host GPIO defintion  */
+static int dhd_oob_gpio_num = -1;
+
+module_param(dhd_oob_gpio_num, int, 0644);
+MODULE_PARM_DESC(dhd_oob_gpio_num, "DHD oob gpio number");
+
+/* This function will return:
+ *  1) return :  Host gpio interrupt number per customer platform
+ *  2) irq_flags_ptr : Type of Host interrupt as Level or Edge
+ *
+ *  NOTE :
+ *  Customer should check his platform definitions
+ *  and his Host Interrupt spec
+ *  to figure out the proper setting for his platform.
+ *  Broadcom provides just reference settings as example.
+ *
+ */
+int dhd_customer_oob_irq_map(void *adapter, unsigned long *irq_flags_ptr)
+{
+       int  host_oob_irq = 0;
+
+#if defined(CUSTOMER_HW4) || defined(BOARD_HIKEY)
+       host_oob_irq = wifi_platform_get_irq_number(adapter, irq_flags_ptr);
+
+#else
+#if defined(CUSTOM_OOB_GPIO_NUM)
+       if (dhd_oob_gpio_num < 0) {
+               dhd_oob_gpio_num = CUSTOM_OOB_GPIO_NUM;
+       }
+#endif /* CUSTOMER_OOB_GPIO_NUM */
+
+       if (dhd_oob_gpio_num < 0) {
+               WL_ERROR(("%s: ERROR customer specific Host GPIO is NOT defined \n",
+               __FUNCTION__));
+               return (dhd_oob_gpio_num);
+       }
+
+       WL_ERROR(("%s: customer specific Host GPIO number is (%d)\n",
+                __FUNCTION__, dhd_oob_gpio_num));
+
+#endif
+
+       return (host_oob_irq);
+}
+#endif /* defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID) */
+
+/* Customer function to control hw specific wlan gpios */
+int
+dhd_customer_gpio_wlan_ctrl(void *adapter, int onoff)
+{
+       int err = 0;
+
+       return err;
+}
+
+#if 0
+/* Function to get custom MAC address */
+int
+dhd_custom_get_mac_address(void *adapter, unsigned char *buf)
+{
+       int ret = 0;
+
+       WL_TRACE(("%s Enter\n", __FUNCTION__));
+       if (!buf)
+               return -EINVAL;
+
+       /* Customer access to MAC address stored outside of DHD driver */
+#if defined(BOARD_HIKEY) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35))
+       ret = wifi_platform_get_mac_addr(adapter, buf);
+#endif
+
+#ifdef EXAMPLE_GET_MAC
+       /* EXAMPLE code */
+       {
+               struct ether_addr ea_example = {{0x00, 0x11, 0x22, 0x33, 0x44, 0xFF}};
+               bcopy((char *)&ea_example, buf, sizeof(struct ether_addr));
+       }
+#endif /* EXAMPLE_GET_MAC */
+
+       return ret;
+}
+#endif /* GET_CUSTOM_MAC_ENABLE */
+
+#ifndef CUSTOMER_HW4
+/* Customized Locale table : OPTIONAL feature */
+const struct cntry_locales_custom translate_custom_table[] = {
+/* Table should be filled out based on custom platform regulatory requirement */
+#ifdef EXAMPLE_TABLE
+       {"",   "XY", 4},  /* Universal if Country code is unknown or empty */
+       {"US", "US", 69}, /* input ISO "US" to : US regrev 69 */
+       {"CA", "US", 69}, /* input ISO "CA" to : US regrev 69 */
+       {"EU", "EU", 5},  /* European union countries to : EU regrev 05 */
+       {"AT", "EU", 5},
+       {"BE", "EU", 5},
+       {"BG", "EU", 5},
+       {"CY", "EU", 5},
+       {"CZ", "EU", 5},
+       {"DK", "EU", 5},
+       {"EE", "EU", 5},
+       {"FI", "EU", 5},
+       {"FR", "EU", 5},
+       {"DE", "EU", 5},
+       {"GR", "EU", 5},
+       {"HU", "EU", 5},
+       {"IE", "EU", 5},
+       {"IT", "EU", 5},
+       {"LV", "EU", 5},
+       {"LI", "EU", 5},
+       {"LT", "EU", 5},
+       {"LU", "EU", 5},
+       {"MT", "EU", 5},
+       {"NL", "EU", 5},
+       {"PL", "EU", 5},
+       {"PT", "EU", 5},
+       {"RO", "EU", 5},
+       {"SK", "EU", 5},
+       {"SI", "EU", 5},
+       {"ES", "EU", 5},
+       {"SE", "EU", 5},
+       {"GB", "EU", 5},
+       {"KR", "XY", 3},
+       {"AU", "XY", 3},
+       {"CN", "XY", 3}, /* input ISO "CN" to : XY regrev 03 */
+       {"TW", "XY", 3},
+       {"AR", "XY", 3},
+       {"MX", "XY", 3},
+       {"IL", "IL", 0},
+       {"CH", "CH", 0},
+       {"TR", "TR", 0},
+       {"NO", "NO", 0},
+#endif /* EXMAPLE_TABLE */
+#if defined(BOARD_HIKEY)
+#if defined(BCM4335_CHIP)
+       {"",   "XZ", 11},  /* Universal if Country code is unknown or empty */
+#endif
+       {"AE", "AE", 1},
+       {"AR", "AR", 1},
+       {"AT", "AT", 1},
+       {"AU", "AU", 2},
+       {"BE", "BE", 1},
+       {"BG", "BG", 1},
+       {"BN", "BN", 1},
+       {"CA", "CA", 2},
+       {"CH", "CH", 1},
+       {"CY", "CY", 1},
+       {"CZ", "CZ", 1},
+       {"DE", "DE", 3},
+       {"DK", "DK", 1},
+       {"EE", "EE", 1},
+       {"ES", "ES", 1},
+       {"FI", "FI", 1},
+       {"FR", "FR", 1},
+       {"GB", "GB", 1},
+       {"GR", "GR", 1},
+       {"HR", "HR", 1},
+       {"HU", "HU", 1},
+       {"IE", "IE", 1},
+       {"IS", "IS", 1},
+       {"IT", "IT", 1},
+       {"ID", "ID", 1},
+       {"JP", "JP", 8},
+       {"KR", "KR", 24},
+       {"KW", "KW", 1},
+       {"LI", "LI", 1},
+       {"LT", "LT", 1},
+       {"LU", "LU", 1},
+       {"LV", "LV", 1},
+       {"MA", "MA", 1},
+       {"MT", "MT", 1},
+       {"MX", "MX", 1},
+       {"NL", "NL", 1},
+       {"NO", "NO", 1},
+       {"PL", "PL", 1},
+       {"PT", "PT", 1},
+       {"PY", "PY", 1},
+       {"RO", "RO", 1},
+       {"SE", "SE", 1},
+       {"SI", "SI", 1},
+       {"SK", "SK", 1},
+       {"TR", "TR", 7},
+       {"TW", "TW", 1},
+       {"IR", "XZ", 11},       /* Universal if Country code is IRAN, (ISLAMIC REPUBLIC OF) */
+       {"SD", "XZ", 11},       /* Universal if Country code is SUDAN */
+       {"SY", "XZ", 11},       /* Universal if Country code is SYRIAN ARAB REPUBLIC */
+       {"GL", "XZ", 11},       /* Universal if Country code is GREENLAND */
+       {"PS", "XZ", 11},       /* Universal if Country code is PALESTINIAN TERRITORY, OCCUPIED */
+       {"TL", "XZ", 11},       /* Universal if Country code is TIMOR-LESTE (EAST TIMOR) */
+       {"MH", "XZ", 11},       /* Universal if Country code is MARSHALL ISLANDS */
+#endif
+};
+
+/* Customized Locale convertor
+*  input : ISO 3166-1 country abbreviation
+*  output: customized cspec
+*/
+void
+#ifdef CUSTOM_COUNTRY_CODE
+get_customized_country_code(void *adapter, char *country_iso_code,
+       wl_country_t *cspec, u32 flags)
+#else
+get_customized_country_code(void *adapter, char *country_iso_code, wl_country_t *cspec)
+#endif /* CUSTOM_COUNTRY_CODE */
+{
+#if (defined(CUSTOMER_HW) || defined(CUSTOMER_HW2)) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
+
+       struct cntry_locales_custom *cloc_ptr;
+
+       if (!cspec)
+               return;
+#ifdef CUSTOM_COUNTRY_CODE
+       cloc_ptr = wifi_platform_get_country_code(adapter, country_iso_code, flags);
+#else
+       cloc_ptr = wifi_platform_get_country_code(adapter, country_iso_code);
+#endif /* CUSTOM_COUNTRY_CODE */
+
+       if (cloc_ptr) {
+               strlcpy(cspec->ccode, cloc_ptr->custom_locale, WLC_CNTRY_BUF_SZ);
+               cspec->rev = cloc_ptr->custom_locale_rev;
+       }
+       return;
+#else
+       int size, i;
+
+       size = ARRAYSIZE(translate_custom_table);
+
+       if (cspec == 0)
+                return;
+
+       if (size == 0)
+                return;
+
+       for (i = 0; i < size; i++) {
+               if (strcmp(country_iso_code, translate_custom_table[i].iso_abbrev) == 0) {
+                       memcpy(cspec->ccode,
+                               translate_custom_table[i].custom_locale, WLC_CNTRY_BUF_SZ);
+                       cspec->rev = translate_custom_table[i].custom_locale_rev;
+                       return;
+               }
+       }
+#ifdef EXAMPLE_TABLE
+       /* if no country code matched return first universal code from translate_custom_table */
+       memcpy(cspec->ccode, translate_custom_table[0].custom_locale, WLC_CNTRY_BUF_SZ);
+       cspec->rev = translate_custom_table[0].custom_locale_rev;
+#endif /* EXMAPLE_TABLE */
+       return;
+#endif /* (defined(CUSTOMER_HW2) || defined(BOARD_HIKEY)) &&
+       * (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36))
+       */
+}
+#endif /* !CUSTOMER_HW4 */
diff --git a/bcmdhd.101.10.240.x/dhd_custom_hikey.c b/bcmdhd.101.10.240.x/dhd_custom_hikey.c
new file mode 100644 (file)
index 0000000..048f53e
--- /dev/null
@@ -0,0 +1,285 @@
+/*
+ * Platform Dependent file for Hikey
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/gpio.h>
+#include <linux/skbuff.h>
+#include <linux/wlan_plat.h>
+#include <linux/fcntl.h>
+#include <linux/fs.h>
+#include <linux/of_gpio.h>
+
+#ifdef CONFIG_BROADCOM_WIFI_RESERVED_MEM
+extern int dhd_init_wlan_mem(void);
+extern void *dhd_wlan_mem_prealloc(int section, unsigned long size);
+#endif /* CONFIG_BROADCOM_WIFI_RESERVED_MEM */
+
+#define WIFI_TURNON_DELAY              200
+#define WLAN_REG_ON_GPIO               491
+#define WLAN_HOST_WAKE_GPIO            493
+
+static int wlan_reg_on = -1;
+#define DHD_DT_COMPAT_ENTRY            "android,bcmdhd_wlan"
+#define WIFI_WL_REG_ON_PROPNAME                "wl_reg_on"
+
+static int wlan_host_wake_up = -1;
+static int wlan_host_wake_irq = 0;
+#define WIFI_WLAN_HOST_WAKE_PROPNAME    "wl_host_wake"
+
+int
+dhd_wifi_init_gpio(void)
+{
+       int gpio_reg_on_val;
+       /* ========== WLAN_PWR_EN ============ */
+       char *wlan_node = DHD_DT_COMPAT_ENTRY;
+       struct device_node *root_node = NULL;
+
+       root_node = of_find_compatible_node(NULL, NULL, wlan_node);
+       if (root_node) {
+               wlan_reg_on = of_get_named_gpio(root_node, WIFI_WL_REG_ON_PROPNAME, 0);
+               wlan_host_wake_up = of_get_named_gpio(root_node, WIFI_WLAN_HOST_WAKE_PROPNAME, 0);
+       } else {
+               printk(KERN_ERR "failed to get device node of BRCM WLAN, use default GPIOs\n");
+               wlan_reg_on = WLAN_REG_ON_GPIO;
+               wlan_host_wake_up = WLAN_HOST_WAKE_GPIO;
+       }
+
+       /* ========== WLAN_PWR_EN ============ */
+       printk(KERN_INFO "%s: gpio_wlan_power : %d\n", __FUNCTION__, wlan_reg_on);
+
+       /*
+        * For reg_on, gpio_request will fail if the gpio is configured to output-high
+        * in the dts using gpio-hog, so do not return error for failure.
+        */
+       if (gpio_request_one(wlan_reg_on, GPIOF_OUT_INIT_HIGH, "WL_REG_ON")) {
+               printk(KERN_ERR "%s: Failed to request gpio %d for WL_REG_ON, "
+                       "might have configured in the dts\n",
+                       __FUNCTION__, wlan_reg_on);
+       } else {
+               printk(KERN_ERR "%s: gpio_request WL_REG_ON done - WLAN_EN: GPIO %d\n",
+                       __FUNCTION__, wlan_reg_on);
+       }
+
+       gpio_reg_on_val = gpio_get_value(wlan_reg_on);
+       printk(KERN_INFO "%s: Initial WL_REG_ON: [%d]\n",
+               __FUNCTION__, gpio_get_value(wlan_reg_on));
+
+       if (gpio_reg_on_val == 0) {
+               printk(KERN_INFO "%s: WL_REG_ON is LOW, drive it HIGH\n", __FUNCTION__);
+               if (gpio_direction_output(wlan_reg_on, 1)) {
+                       printk(KERN_ERR "%s: WL_REG_ON is failed to pull up\n", __FUNCTION__);
+                       return -EIO;
+               }
+       }
+
+       /* Wait for WIFI_TURNON_DELAY due to power stability */
+       msleep(WIFI_TURNON_DELAY);
+
+       /* ========== WLAN_HOST_WAKE ============ */
+       printk(KERN_INFO "%s: gpio_wlan_host_wake : %d\n", __FUNCTION__, wlan_host_wake_up);
+
+       if (gpio_request_one(wlan_host_wake_up, GPIOF_IN, "WLAN_HOST_WAKE")) {
+               printk(KERN_ERR "%s: Failed to request gpio %d for WLAN_HOST_WAKE\n",
+                       __FUNCTION__, wlan_host_wake_up);
+                       return -ENODEV;
+       } else {
+               printk(KERN_ERR "%s: gpio_request WLAN_HOST_WAKE done"
+                       " - WLAN_HOST_WAKE: GPIO %d\n",
+                       __FUNCTION__, wlan_host_wake_up);
+       }
+
+       if (gpio_direction_input(wlan_host_wake_up)) {
+               printk(KERN_ERR "%s: Failed to set WL_HOST_WAKE gpio direction\n", __FUNCTION__);
+               return -EIO;
+       }
+
+       wlan_host_wake_irq = gpio_to_irq(wlan_host_wake_up);
+
+       return 0;
+}
+
+extern void kirin_pcie_power_on_atu_fixup(void) __attribute__ ((weak));
+extern int kirin_pcie_lp_ctrl(u32 enable) __attribute__ ((weak));
+
+int
+dhd_wlan_power(int onoff)
+{
+       printk(KERN_INFO"------------------------------------------------");
+       printk(KERN_INFO"------------------------------------------------\n");
+       printk(KERN_INFO"%s Enter: power %s\n", __func__, onoff ? "on" : "off");
+
+       if (onoff) {
+               if (gpio_direction_output(wlan_reg_on, 1)) {
+                       printk(KERN_ERR "%s: WL_REG_ON is failed to pull up\n", __FUNCTION__);
+                       return -EIO;
+               }
+               if (gpio_get_value(wlan_reg_on)) {
+                       printk(KERN_INFO"WL_REG_ON on-step-2 : [%d]\n",
+                               gpio_get_value(wlan_reg_on));
+               } else {
+                       printk("[%s] gpio value is 0. We need reinit.\n", __func__);
+                       if (gpio_direction_output(wlan_reg_on, 1)) {
+                               printk(KERN_ERR "%s: WL_REG_ON is "
+                                       "failed to pull up\n", __func__);
+                       }
+               }
+
+               /* Wait for WIFI_TURNON_DELAY due to power stability */
+               msleep(WIFI_TURNON_DELAY);
+
+               /*
+                * Call Kiric RC ATU fixup else si_attach will fail due to
+                * improper BAR0/1 address translations
+                */
+               if (kirin_pcie_power_on_atu_fixup) {
+                       kirin_pcie_power_on_atu_fixup();
+               } else {
+                       printk(KERN_ERR "[%s] kirin_pcie_power_on_atu_fixup is NULL. "
+                               "REG_ON may not work\n", __func__);
+               }
+               /* Enable ASPM after powering ON */
+               if (kirin_pcie_lp_ctrl) {
+                       kirin_pcie_lp_ctrl(onoff);
+               } else {
+                       printk(KERN_ERR "[%s] kirin_pcie_lp_ctrl is NULL. "
+                               "ASPM may not work\n", __func__);
+               }
+       } else {
+               /* Disable ASPM before powering off */
+               if (kirin_pcie_lp_ctrl) {
+                       kirin_pcie_lp_ctrl(onoff);
+               } else {
+                       printk(KERN_ERR "[%s] kirin_pcie_lp_ctrl is NULL. "
+                               "ASPM may not work\n", __func__);
+               }
+               if (gpio_direction_output(wlan_reg_on, 0)) {
+                       printk(KERN_ERR "%s: WL_REG_ON is failed to pull up\n", __FUNCTION__);
+                       return -EIO;
+               }
+               if (gpio_get_value(wlan_reg_on)) {
+                       printk(KERN_INFO"WL_REG_ON on-step-2 : [%d]\n",
+                               gpio_get_value(wlan_reg_on));
+               }
+       }
+       return 0;
+}
+EXPORT_SYMBOL(dhd_wlan_power);
+
+static int
+dhd_wlan_reset(int onoff)
+{
+       return 0;
+}
+
+static int
+dhd_wlan_set_carddetect(int val)
+{
+       return 0;
+}
+
+#ifdef BCMSDIO
+static int dhd_wlan_get_wake_irq(void)
+{
+       return gpio_to_irq(wlan_host_wake_up);
+}
+#endif /* BCMSDIO */
+
+#if defined(CONFIG_BCMDHD_OOB_HOST_WAKE) && defined(CONFIG_BCMDHD_GET_OOB_STATE)
+int
+dhd_get_wlan_oob_gpio(void)
+{
+       return gpio_is_valid(wlan_host_wake_up) ?
+               gpio_get_value(wlan_host_wake_up) : -1;
+}
+EXPORT_SYMBOL(dhd_get_wlan_oob_gpio);
+#endif /* CONFIG_BCMDHD_OOB_HOST_WAKE && CONFIG_BCMDHD_GET_OOB_STATE */
+
+struct resource dhd_wlan_resources = {
+       .name   = "bcmdhd_wlan_irq",
+       .start  = 0, /* Dummy */
+       .end    = 0, /* Dummy */
+       .flags  = IORESOURCE_IRQ | IORESOURCE_IRQ_SHAREABLE |
+       IORESOURCE_IRQ_HIGHEDGE,
+};
+EXPORT_SYMBOL(dhd_wlan_resources);
+
+struct wifi_platform_data dhd_wlan_control = {
+       .set_power      = dhd_wlan_power,
+       .set_reset      = dhd_wlan_reset,
+       .set_carddetect = dhd_wlan_set_carddetect,
+#ifdef CONFIG_BROADCOM_WIFI_RESERVED_MEM
+       .mem_prealloc   = dhd_wlan_mem_prealloc,
+#endif /* CONFIG_BROADCOM_WIFI_RESERVED_MEM */
+#ifdef BCMSDIO
+       .get_wake_irq   = dhd_wlan_get_wake_irq,
+#endif
+};
+EXPORT_SYMBOL(dhd_wlan_control);
+
+int
+dhd_wlan_init(void)
+{
+       int ret;
+
+       printk(KERN_INFO"%s: START.......\n", __FUNCTION__);
+       ret = dhd_wifi_init_gpio();
+       if (ret < 0) {
+               printk(KERN_ERR "%s: failed to initiate GPIO, ret=%d\n",
+                       __FUNCTION__, ret);
+               goto fail;
+       }
+
+       dhd_wlan_resources.start = wlan_host_wake_irq;
+       dhd_wlan_resources.end = wlan_host_wake_irq;
+
+#ifdef CONFIG_BROADCOM_WIFI_RESERVED_MEM
+         ret = dhd_init_wlan_mem();
+         if (ret < 0) {
+                 printk(KERN_ERR "%s: failed to alloc reserved memory,"
+                         " ret=%d\n", __FUNCTION__, ret);
+         }
+#endif /* CONFIG_BROADCOM_WIFI_RESERVED_MEM */
+
+fail:
+       printk(KERN_INFO"%s: FINISH.......\n", __FUNCTION__);
+       return ret;
+}
+
+int
+dhd_wlan_deinit(void)
+{
+       gpio_free(wlan_host_wake_up);
+       gpio_free(wlan_reg_on);
+       return 0;
+}
+#ifndef BCMDHD_MODULAR
+/* Required only for Built-in DHD */
+device_initcall(dhd_wlan_init);
+#endif /* BOARD_HIKEY_MODULAR */
diff --git a/bcmdhd.101.10.240.x/dhd_custom_memprealloc.c b/bcmdhd.101.10.240.x/dhd_custom_memprealloc.c
new file mode 100644 (file)
index 0000000..7825c03
--- /dev/null
@@ -0,0 +1,552 @@
+/*
+ * Platform Dependent file for usage of Preallocted Memory
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#include <linux/device.h>
+#include <linux/slab.h>
+#include <linux/miscdevice.h>
+#include <linux/sched.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/list.h>
+#include <linux/io.h>
+#include <linux/workqueue.h>
+#include <linux/unistd.h>
+#include <linux/bug.h>
+#include <linux/skbuff.h>
+#include <linux/init.h>
+
+#ifdef CONFIG_BROADCOM_WIFI_RESERVED_MEM
+
+#define WLAN_STATIC_SCAN_BUF0          5
+#define WLAN_STATIC_SCAN_BUF1          6
+#define WLAN_STATIC_DHD_INFO_BUF       7
+#define WLAN_STATIC_DHD_WLFC_BUF       8
+#define WLAN_STATIC_DHD_IF_FLOW_LKUP   9
+#define WLAN_STATIC_DHD_MEMDUMP_RAM    11
+#define WLAN_STATIC_DHD_WLFC_HANGER    12
+#define WLAN_STATIC_DHD_PKTID_MAP      13
+#define WLAN_STATIC_DHD_PKTID_IOCTL_MAP        14
+#define WLAN_STATIC_DHD_LOG_DUMP_BUF   15
+#define WLAN_STATIC_DHD_LOG_DUMP_BUF_EX        16
+#define WLAN_STATIC_DHD_PKTLOG_DUMP_BUF        17
+
+#define WLAN_SCAN_BUF_SIZE             (64 * 1024)
+
+#define WLAN_DHD_INFO_BUF_SIZE         (32 * 1024)
+#define WLAN_DHD_WLFC_BUF_SIZE         (64 * 1024)
+#define WLAN_DHD_IF_FLOW_LKUP_SIZE     (64 * 1024)
+/* Have 2MB ramsize to accomodate future chips */
+#define WLAN_DHD_MEMDUMP_SIZE          (3 * 1024 * 1024)
+
+#define PREALLOC_WLAN_SEC_NUM          4
+#define PREALLOC_WLAN_BUF_NUM          160
+#define PREALLOC_WLAN_SECTION_HEADER   24
+
+#ifdef CONFIG_BCMDHD_PCIE
+#define DHD_SKB_1PAGE_BUFSIZE  (PAGE_SIZE*1)
+#define DHD_SKB_2PAGE_BUFSIZE  (PAGE_SIZE*2)
+#define DHD_SKB_4PAGE_BUFSIZE  (PAGE_SIZE*4)
+
+#define WLAN_SECTION_SIZE_0    (PREALLOC_WLAN_BUF_NUM * 128)
+#define WLAN_SECTION_SIZE_1    0
+#define WLAN_SECTION_SIZE_2    0
+#define WLAN_SECTION_SIZE_3    (PREALLOC_WLAN_BUF_NUM * 1024)
+
+#define DHD_SKB_1PAGE_BUF_NUM  0
+#define DHD_SKB_2PAGE_BUF_NUM  128
+#define DHD_SKB_4PAGE_BUF_NUM  0
+
+#else
+#define DHD_SKB_HDRSIZE                336
+#define DHD_SKB_1PAGE_BUFSIZE  ((PAGE_SIZE*1)-DHD_SKB_HDRSIZE)
+#define DHD_SKB_2PAGE_BUFSIZE  ((PAGE_SIZE*2)-DHD_SKB_HDRSIZE)
+#define DHD_SKB_4PAGE_BUFSIZE  ((PAGE_SIZE*4)-DHD_SKB_HDRSIZE)
+
+#define WLAN_SECTION_SIZE_0    (PREALLOC_WLAN_BUF_NUM * 128)
+#define WLAN_SECTION_SIZE_1    (PREALLOC_WLAN_BUF_NUM * 128)
+#define WLAN_SECTION_SIZE_2    (PREALLOC_WLAN_BUF_NUM * 512)
+#define WLAN_SECTION_SIZE_3    (PREALLOC_WLAN_BUF_NUM * 1024)
+
+#define DHD_SKB_1PAGE_BUF_NUM  8
+#define DHD_SKB_2PAGE_BUF_NUM  8
+#define DHD_SKB_4PAGE_BUF_NUM  1
+#endif /* CONFIG_BCMDHD_PCIE */
+
+#define WLAN_SKB_1_2PAGE_BUF_NUM       ((DHD_SKB_1PAGE_BUF_NUM) + \
+               (DHD_SKB_2PAGE_BUF_NUM))
+#define WLAN_SKB_BUF_NUM       ((WLAN_SKB_1_2PAGE_BUF_NUM) + \
+               (DHD_SKB_4PAGE_BUF_NUM))
+
+#define WLAN_MAX_PKTID_ITEMS           (8192)
+#define WLAN_DHD_PKTID_MAP_HDR_SIZE    (20 + 4*(WLAN_MAX_PKTID_ITEMS + 1))
+#define WLAN_DHD_PKTID_MAP_ITEM_SIZE   (32)
+#define WLAN_DHD_PKTID_MAP_SIZE                ((WLAN_DHD_PKTID_MAP_HDR_SIZE) + \
+               ((WLAN_MAX_PKTID_ITEMS+1) * WLAN_DHD_PKTID_MAP_ITEM_SIZE))
+
+#define WLAN_MAX_PKTID_IOCTL_ITEMS     (32)
+#define WLAN_DHD_PKTID_IOCTL_MAP_HDR_SIZE      (20 + 4*(WLAN_MAX_PKTID_IOCTL_ITEMS + 1))
+#define WLAN_DHD_PKTID_IOCTL_MAP_ITEM_SIZE     (32)
+#define WLAN_DHD_PKTID_IOCTL_MAP_SIZE          ((WLAN_DHD_PKTID_IOCTL_MAP_HDR_SIZE) + \
+               ((WLAN_MAX_PKTID_IOCTL_ITEMS+1) * WLAN_DHD_PKTID_IOCTL_MAP_ITEM_SIZE))
+
+#define DHD_LOG_DUMP_BUF_SIZE  (1024 * 1024 * 4)
+#define DHD_LOG_DUMP_BUF_EX_SIZE       (1024 * 1024 * 2)
+
+#define DHD_PKTLOG_DUMP_BUF_SIZE       (64 * 1024)
+
+#define WLAN_DHD_WLFC_HANGER_MAXITEMS          3072
+#define WLAN_DHD_WLFC_HANGER_ITEM_SIZE         32
+#define WLAN_DHD_WLFC_HANGER_SIZE      ((WLAN_DHD_WLFC_HANGER_ITEM_SIZE) + \
+       ((WLAN_DHD_WLFC_HANGER_MAXITEMS) * (WLAN_DHD_WLFC_HANGER_ITEM_SIZE)))
+
+static struct sk_buff *wlan_static_skb[WLAN_SKB_BUF_NUM];
+
+struct wlan_mem_prealloc {
+       void *mem_ptr;
+       unsigned long size;
+};
+
+static struct wlan_mem_prealloc wlan_mem_array[PREALLOC_WLAN_SEC_NUM] = {
+       {NULL, (WLAN_SECTION_SIZE_0 + PREALLOC_WLAN_SECTION_HEADER)},
+       {NULL, (WLAN_SECTION_SIZE_1 + PREALLOC_WLAN_SECTION_HEADER)},
+       {NULL, (WLAN_SECTION_SIZE_2 + PREALLOC_WLAN_SECTION_HEADER)},
+       {NULL, (WLAN_SECTION_SIZE_3 + PREALLOC_WLAN_SECTION_HEADER)}
+};
+
+static void *wlan_static_scan_buf0 = NULL;
+static void *wlan_static_scan_buf1 = NULL;
+static void *wlan_static_dhd_info_buf = NULL;
+static void *wlan_static_dhd_wlfc_buf = NULL;
+static void *wlan_static_if_flow_lkup = NULL;
+static void *wlan_static_dhd_memdump_ram = NULL;
+static void *wlan_static_dhd_wlfc_hanger = NULL;
+static void *wlan_static_dhd_pktid_map = NULL;
+static void *wlan_static_dhd_pktid_ioctl_map = NULL;
+static void *wlan_static_dhd_log_dump_buf = NULL;
+static void *wlan_static_dhd_log_dump_buf_ex = NULL;
+static void *wlan_static_dhd_pktlog_dump_buf = NULL;
+
+void
+*dhd_wlan_mem_prealloc(int section, unsigned long size)
+{
+       if (section == PREALLOC_WLAN_SEC_NUM) {
+               return wlan_static_skb;
+       }
+
+       if (section == WLAN_STATIC_SCAN_BUF0) {
+               return wlan_static_scan_buf0;
+       }
+
+       if (section == WLAN_STATIC_SCAN_BUF1) {
+               return wlan_static_scan_buf1;
+       }
+
+       if (section == WLAN_STATIC_DHD_INFO_BUF) {
+               if (size > WLAN_DHD_INFO_BUF_SIZE) {
+                       pr_err("request DHD_INFO size(%lu) is bigger than"
+                               " static size(%d).\n", size,
+                               WLAN_DHD_INFO_BUF_SIZE);
+                       return NULL;
+               }
+               return wlan_static_dhd_info_buf;
+       }
+
+       if (section == WLAN_STATIC_DHD_WLFC_BUF)  {
+               if (size > WLAN_DHD_WLFC_BUF_SIZE) {
+                       pr_err("request DHD_WLFC size(%lu) is bigger than"
+                               " static size(%d).\n",
+                               size, WLAN_DHD_WLFC_BUF_SIZE);
+                       return NULL;
+               }
+               return wlan_static_dhd_wlfc_buf;
+       }
+
+       if (section == WLAN_STATIC_DHD_WLFC_HANGER) {
+               if (size > WLAN_DHD_WLFC_HANGER_SIZE) {
+                       pr_err("request DHD_WLFC_HANGER size(%lu) is bigger than"
+                               " static size(%d).\n",
+                               size, WLAN_DHD_WLFC_HANGER_SIZE);
+                       return NULL;
+               }
+               return wlan_static_dhd_wlfc_hanger;
+       }
+
+       if (section == WLAN_STATIC_DHD_IF_FLOW_LKUP)  {
+               if (size > WLAN_DHD_IF_FLOW_LKUP_SIZE) {
+                       pr_err("request DHD_WLFC size(%lu) is bigger than"
+                               " static size(%d).\n",
+                               size, WLAN_DHD_WLFC_BUF_SIZE);
+                       return NULL;
+               }
+               return wlan_static_if_flow_lkup;
+       }
+
+       if (section == WLAN_STATIC_DHD_MEMDUMP_RAM) {
+               if (size > WLAN_DHD_MEMDUMP_SIZE) {
+                       pr_err("request DHD_MEMDUMP_RAM size(%lu) is bigger"
+                               " than static size(%d).\n",
+                               size, WLAN_DHD_MEMDUMP_SIZE);
+                       return NULL;
+               }
+               return wlan_static_dhd_memdump_ram;
+       }
+
+       if (section == WLAN_STATIC_DHD_PKTID_MAP)  {
+               if (size > WLAN_DHD_PKTID_MAP_SIZE) {
+                       pr_err("request DHD_PKTID_MAP size(%lu) is bigger than"
+                               " static size(%d).\n",
+                               size, WLAN_DHD_PKTID_MAP_SIZE);
+                       return NULL;
+               }
+               return wlan_static_dhd_pktid_map;
+       }
+
+       if (section == WLAN_STATIC_DHD_PKTID_IOCTL_MAP)  {
+               if (size > WLAN_DHD_PKTID_IOCTL_MAP_SIZE) {
+                       pr_err("request DHD_PKTID_IOCTL_MAP size(%lu) is bigger than"
+                               " static size(%d).\n",
+                               size, WLAN_DHD_PKTID_IOCTL_MAP_SIZE);
+                       return NULL;
+               }
+               return wlan_static_dhd_pktid_ioctl_map;
+       }
+
+       if (section == WLAN_STATIC_DHD_LOG_DUMP_BUF) {
+               if (size > DHD_LOG_DUMP_BUF_SIZE) {
+                       pr_err("request DHD_LOG_DUMP_BUF size(%lu) is bigger then"
+                               " static size(%d).\n",
+                               size, DHD_LOG_DUMP_BUF_SIZE);
+                       return NULL;
+               }
+               return wlan_static_dhd_log_dump_buf;
+       }
+
+       if (section == WLAN_STATIC_DHD_LOG_DUMP_BUF_EX) {
+               if (size > DHD_LOG_DUMP_BUF_EX_SIZE) {
+                       pr_err("request DHD_LOG_DUMP_BUF_EX size(%lu) is bigger then"
+                               " static size(%d).\n",
+                               size, DHD_LOG_DUMP_BUF_EX_SIZE);
+                       return NULL;
+               }
+               return wlan_static_dhd_log_dump_buf_ex;
+       }
+
+       if (section == WLAN_STATIC_DHD_PKTLOG_DUMP_BUF) {
+               if (size > DHD_PKTLOG_DUMP_BUF_SIZE) {
+                       pr_err("request DHD_PKTLOG_DUMP_BUF size(%lu) is bigger then"
+                                       " static size(%d).\n",
+                                       size, DHD_PKTLOG_DUMP_BUF_SIZE);
+                       return NULL;
+               }
+               return wlan_static_dhd_pktlog_dump_buf;
+       }
+
+       if ((section < 0) || (section >= PREALLOC_WLAN_SEC_NUM)) {
+               return NULL;
+       }
+
+       if (wlan_mem_array[section].size < size) {
+               return NULL;
+       }
+
+       return wlan_mem_array[section].mem_ptr;
+}
+EXPORT_SYMBOL(dhd_wlan_mem_prealloc);
+
+int
+dhd_init_wlan_mem(void)
+{
+       int i;
+       int j;
+
+#if !defined(CONFIG_BCMDHD_PCIE)
+       for (i = 0; i < DHD_SKB_1PAGE_BUF_NUM; i++) {
+               wlan_static_skb[i] = __dev_alloc_skb(DHD_SKB_1PAGE_BUFSIZE, GFP_KERNEL);
+               if (!wlan_static_skb[i]) {
+                       goto err_skb_alloc;
+               }
+       }
+#endif /* !CONFIG_BCMDHD_PCIE */
+
+       for (i = DHD_SKB_1PAGE_BUF_NUM; i < WLAN_SKB_1_2PAGE_BUF_NUM; i++) {
+               wlan_static_skb[i] = __dev_alloc_skb(DHD_SKB_2PAGE_BUFSIZE, GFP_KERNEL);
+               if (!wlan_static_skb[i]) {
+                       goto err_skb_alloc;
+               }
+       }
+
+#if !defined(CONFIG_BCMDHD_PCIE)
+       wlan_static_skb[i] = __dev_alloc_skb(DHD_SKB_4PAGE_BUFSIZE, GFP_KERNEL);
+       if (!wlan_static_skb[i]) {
+               goto err_skb_alloc;
+       }
+#endif /* !CONFIG_BCMDHD_PCIE */
+
+       for (i = 0; i < PREALLOC_WLAN_SEC_NUM; i++) {
+               if (wlan_mem_array[i].size > 0) {
+                       wlan_mem_array[i].mem_ptr =
+                               kmalloc(wlan_mem_array[i].size, GFP_KERNEL);
+
+                       if (!wlan_mem_array[i].mem_ptr) {
+                               goto err_mem_alloc;
+                       }
+               }
+       }
+
+       wlan_static_scan_buf0 = kmalloc(WLAN_SCAN_BUF_SIZE, GFP_KERNEL);
+       if (!wlan_static_scan_buf0) {
+               pr_err("Failed to alloc wlan_static_scan_buf0\n");
+               goto err_mem_alloc;
+       }
+
+       wlan_static_scan_buf1 = kmalloc(WLAN_SCAN_BUF_SIZE, GFP_KERNEL);
+       if (!wlan_static_scan_buf1) {
+               pr_err("Failed to alloc wlan_static_scan_buf1\n");
+               goto err_mem_alloc;
+       }
+
+       wlan_static_dhd_log_dump_buf = kmalloc(DHD_LOG_DUMP_BUF_SIZE, GFP_KERNEL);
+       if (!wlan_static_dhd_log_dump_buf) {
+               pr_err("Failed to alloc wlan_static_dhd_log_dump_buf\n");
+               goto err_mem_alloc;
+       }
+
+       wlan_static_dhd_log_dump_buf_ex = kmalloc(DHD_LOG_DUMP_BUF_EX_SIZE, GFP_KERNEL);
+       if (!wlan_static_dhd_log_dump_buf_ex) {
+               pr_err("Failed to alloc wlan_static_dhd_log_dump_buf_ex\n");
+               goto err_mem_alloc;
+       }
+
+       wlan_static_dhd_info_buf = kmalloc(WLAN_DHD_INFO_BUF_SIZE, GFP_KERNEL);
+       if (!wlan_static_dhd_info_buf) {
+               pr_err("Failed to alloc wlan_static_dhd_info_buf\n");
+               goto err_mem_alloc;
+       }
+
+#ifdef CONFIG_BCMDHD_PCIE
+       wlan_static_if_flow_lkup = kmalloc(WLAN_DHD_IF_FLOW_LKUP_SIZE,
+               GFP_KERNEL);
+       if (!wlan_static_if_flow_lkup) {
+               pr_err("Failed to alloc wlan_static_if_flow_lkup\n");
+               goto err_mem_alloc;
+       }
+
+#ifdef CONFIG_BCMDHD_PREALLOC_PKTIDMAP
+       wlan_static_dhd_pktid_map = kmalloc(WLAN_DHD_PKTID_MAP_SIZE,
+               GFP_KERNEL);
+       if (!wlan_static_dhd_pktid_map) {
+               pr_err("Failed to alloc wlan_static_dhd_pktid_map\n");
+               goto err_mem_alloc;
+       }
+
+       wlan_static_dhd_pktid_ioctl_map = kmalloc(WLAN_DHD_PKTID_IOCTL_MAP_SIZE,
+               GFP_KERNEL);
+       if (!wlan_static_dhd_pktid_ioctl_map) {
+               pr_err("Failed to alloc wlan_static_dhd_pktid_ioctl_map\n");
+               goto err_mem_alloc;
+       }
+#endif /* CONFIG_BCMDHD_PREALLOC_PKTIDMAP */
+#else
+       wlan_static_dhd_wlfc_buf = kmalloc(WLAN_DHD_WLFC_BUF_SIZE,
+               GFP_KERNEL);
+       if (!wlan_static_dhd_wlfc_buf) {
+               pr_err("Failed to alloc wlan_static_dhd_wlfc_buf\n");
+               goto err_mem_alloc;
+       }
+
+       wlan_static_dhd_wlfc_hanger = kmalloc(WLAN_DHD_WLFC_HANGER_SIZE,
+               GFP_KERNEL);
+       if (!wlan_static_dhd_wlfc_hanger) {
+               pr_err("Failed to alloc wlan_static_dhd_wlfc_hanger\n");
+               goto err_mem_alloc;
+       }
+#endif /* CONFIG_BCMDHD_PCIE */
+
+#ifdef CONFIG_BCMDHD_PREALLOC_MEMDUMP
+       wlan_static_dhd_memdump_ram = kmalloc(WLAN_DHD_MEMDUMP_SIZE, GFP_KERNEL);
+       if (!wlan_static_dhd_memdump_ram) {
+               pr_err("Failed to alloc wlan_static_dhd_memdump_ram\n");
+               goto err_mem_alloc;
+       }
+#endif /* CONFIG_BCMDHD_PREALLOC_MEMDUMP */
+
+       wlan_static_dhd_pktlog_dump_buf = kmalloc(DHD_PKTLOG_DUMP_BUF_SIZE, GFP_KERNEL);
+       if (!wlan_static_dhd_pktlog_dump_buf) {
+               pr_err("Failed to alloc wlan_static_dhd_pktlog_dump_buf\n");
+               goto err_mem_alloc;
+       }
+
+       pr_err("%s: WIFI MEM Allocated\n", __FUNCTION__);
+       return 0;
+
+err_mem_alloc:
+#ifdef CONFIG_BCMDHD_PREALLOC_MEMDUMP
+       if (wlan_static_dhd_memdump_ram) {
+               kfree(wlan_static_dhd_memdump_ram);
+       }
+
+#endif /* CONFIG_BCMDHD_PREALLOC_MEMDUMP */
+
+#ifdef CONFIG_BCMDHD_PCIE
+       if (wlan_static_if_flow_lkup) {
+               kfree(wlan_static_if_flow_lkup);
+       }
+
+#ifdef CONFIG_BCMDHD_PREALLOC_PKTIDMAP
+       if (wlan_static_dhd_pktid_map) {
+               kfree(wlan_static_dhd_pktid_map);
+       }
+
+       if (wlan_static_dhd_pktid_ioctl_map) {
+               kfree(wlan_static_dhd_pktid_ioctl_map);
+       }
+#endif /* CONFIG_BCMDHD_PREALLOC_PKTIDMAP */
+#else
+       if (wlan_static_dhd_wlfc_buf) {
+               kfree(wlan_static_dhd_wlfc_buf);
+       }
+
+       if (wlan_static_dhd_wlfc_hanger) {
+               kfree(wlan_static_dhd_wlfc_hanger);
+       }
+#endif /* CONFIG_BCMDHD_PCIE */
+       if (wlan_static_dhd_info_buf) {
+               kfree(wlan_static_dhd_info_buf);
+       }
+
+       if (wlan_static_dhd_log_dump_buf) {
+               kfree(wlan_static_dhd_log_dump_buf);
+       }
+
+       if (wlan_static_dhd_log_dump_buf_ex) {
+               kfree(wlan_static_dhd_log_dump_buf_ex);
+       }
+
+       if (wlan_static_scan_buf1) {
+               kfree(wlan_static_scan_buf1);
+       }
+
+       if (wlan_static_scan_buf0) {
+               kfree(wlan_static_scan_buf0);
+       }
+
+       if (wlan_static_dhd_pktlog_dump_buf) {
+               kfree(wlan_static_dhd_pktlog_dump_buf);
+       }
+
+       pr_err("Failed to mem_alloc for WLAN\n");
+
+       for (j = 0; j < i; j++) {
+               kfree(wlan_mem_array[j].mem_ptr);
+       }
+
+       i = WLAN_SKB_BUF_NUM;
+
+err_skb_alloc:
+       pr_err("Failed to skb_alloc for WLAN\n");
+       for (j = 0; j < i; j++) {
+               dev_kfree_skb(wlan_static_skb[j]);
+       }
+
+       return -ENOMEM;
+}
+EXPORT_SYMBOL(dhd_init_wlan_mem);
+
+void
+dhd_exit_wlan_mem(void)
+{
+       int i = 0;
+
+#ifdef CONFIG_BCMDHD_PREALLOC_MEMDUMP
+       if (wlan_static_dhd_memdump_ram) {
+               kfree(wlan_static_dhd_memdump_ram);
+       }
+
+#endif /* CONFIG_BCMDHD_PREALLOC_MEMDUMP */
+
+#ifdef CONFIG_BCMDHD_PCIE
+       if (wlan_static_if_flow_lkup) {
+               kfree(wlan_static_if_flow_lkup);
+       }
+
+#ifdef CONFIG_BCMDHD_PREALLOC_PKTIDMAP
+       if (wlan_static_dhd_pktid_map) {
+               kfree(wlan_static_dhd_pktid_map);
+       }
+
+       if (wlan_static_dhd_pktid_ioctl_map) {
+               kfree(wlan_static_dhd_pktid_ioctl_map);
+       }
+#endif /* CONFIG_BCMDHD_PREALLOC_PKTIDMAP */
+#else
+       if (wlan_static_dhd_wlfc_buf) {
+               kfree(wlan_static_dhd_wlfc_buf);
+       }
+
+       if (wlan_static_dhd_wlfc_hanger) {
+               kfree(wlan_static_dhd_wlfc_hanger);
+       }
+#endif /* CONFIG_BCMDHD_PCIE */
+       if (wlan_static_dhd_info_buf) {
+               kfree(wlan_static_dhd_info_buf);
+       }
+
+       if (wlan_static_dhd_log_dump_buf) {
+               kfree(wlan_static_dhd_log_dump_buf);
+       }
+
+       if (wlan_static_dhd_log_dump_buf_ex) {
+               kfree(wlan_static_dhd_log_dump_buf_ex);
+       }
+
+       if (wlan_static_scan_buf1) {
+               kfree(wlan_static_scan_buf1);
+       }
+
+       if (wlan_static_scan_buf0) {
+               kfree(wlan_static_scan_buf0);
+       }
+
+       if (wlan_static_dhd_pktlog_dump_buf) {
+               kfree(wlan_static_dhd_pktlog_dump_buf);
+       }
+
+       pr_err("Failed to mem_alloc for WLAN\n");
+
+       for (i = 0; i < PREALLOC_WLAN_SEC_NUM; i++) {
+               if (wlan_mem_array[i].mem_ptr) {
+                       kfree(wlan_mem_array[i].mem_ptr);
+               }
+       }
+
+       pr_err("Failed to skb_alloc for WLAN\n");
+       for (i = 0; i < WLAN_SKB_BUF_NUM; i++) {
+               dev_kfree_skb(wlan_static_skb[i]);
+       }
+
+       return;
+}
+EXPORT_SYMBOL(dhd_exit_wlan_mem);
+#endif /* CONFIG_BROADCOM_WIFI_RESERVED_MEM */
diff --git a/bcmdhd.101.10.240.x/dhd_custom_msm.c b/bcmdhd.101.10.240.x/dhd_custom_msm.c
new file mode 100644 (file)
index 0000000..0a36a40
--- /dev/null
@@ -0,0 +1,262 @@
+/*
+ * Platform Dependent file for Qualcomm MSM/APQ
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/gpio.h>
+#include <linux/skbuff.h>
+#include <linux/wlan_plat.h>
+#include <linux/mmc/host.h>
+#include <linux/msm_pcie.h>
+#include <linux/fcntl.h>
+#include <linux/fs.h>
+#include <linux/of_gpio.h>
+#if defined(CONFIG_ARCH_MSM8996) || defined(CONFIG_ARCH_MSM8998) || \
+       defined(CONFIG_ARCH_SDM845) || defined(CONFIG_ARCH_SM8150) || defined(CONFIG_ARCH_KONA)
+#include <linux/msm_pcie.h>
+#endif /* CONFIG_ARCH_MSM8996 || CONFIG_ARCH_MSM8998 ||
+         CONFIG_ARCH_SDM845 || CONFIG_ARCH_SM8150 || CONFIG_ARCH_KONA
+       */
+
+#ifdef CONFIG_BROADCOM_WIFI_RESERVED_MEM
+extern int dhd_init_wlan_mem(void);
+extern void *dhd_wlan_mem_prealloc(int section, unsigned long size);
+#endif /* CONFIG_BROADCOM_WIFI_RESERVED_MEM */
+
+#define WIFI_TURNON_DELAY       200
+static int wlan_reg_on = -1;
+#define DHD_DT_COMPAT_ENTRY            "android,bcmdhd_wlan"
+#define WIFI_WL_REG_ON_PROPNAME                "wlan-en-gpio"
+
+#if defined(CONFIG_ARCH_MSM8996) || defined(CONFIG_ARCH_MSM8998) || \
+       defined(CONFIG_ARCH_SDM845) || defined(CONFIG_ARCH_SM8150) || defined(CONFIG_ARCH_KONA)
+#define MSM_PCIE_CH_NUM                        0
+#else
+#define MSM_PCIE_CH_NUM                        1
+#endif /* CONFIG_ARCH_MSM8996 || CONFIG_ARCH_MSM8998
+         || CONFIG_ARCH_SDM845 || CONFIG_ARCH_SM8150 || CONFIG_ARCH_KONA
+       */
+
+#ifdef CONFIG_BCMDHD_OOB_HOST_WAKE
+static int wlan_host_wake_up = -1;
+static int wlan_host_wake_irq = 0;
+#define WIFI_WLAN_HOST_WAKE_PROPNAME    "wlan-host-wake-gpio"
+#endif /* CONFIG_BCMDHD_OOB_HOST_WAKE */
+
+int __init
+dhd_wifi_init_gpio(void)
+{
+       char *wlan_node = DHD_DT_COMPAT_ENTRY;
+       struct device_node *root_node = NULL;
+
+       root_node = of_find_compatible_node(NULL, NULL, wlan_node);
+       if (!root_node) {
+               WARN(1, "failed to get device node of BRCM WLAN\n");
+               return -ENODEV;
+       }
+
+       /* ========== WLAN_PWR_EN ============ */
+       wlan_reg_on = of_get_named_gpio(root_node, WIFI_WL_REG_ON_PROPNAME, 0);
+       printk(KERN_INFO "%s: gpio_wlan_power : %d\n", __FUNCTION__, wlan_reg_on);
+
+       if (gpio_request_one(wlan_reg_on, GPIOF_OUT_INIT_LOW, "WL_REG_ON")) {
+               printk(KERN_ERR "%s: Faiiled to request gpio %d for WL_REG_ON\n",
+                       __FUNCTION__, wlan_reg_on);
+       } else {
+               printk(KERN_ERR "%s: gpio_request WL_REG_ON done - WLAN_EN: GPIO %d\n",
+                       __FUNCTION__, wlan_reg_on);
+       }
+
+       if (gpio_direction_output(wlan_reg_on, 1)) {
+               printk(KERN_ERR "%s: WL_REG_ON failed to pull up\n", __FUNCTION__);
+       } else {
+               printk(KERN_ERR "%s: WL_REG_ON is pulled up\n", __FUNCTION__);
+       }
+
+       if (gpio_get_value(wlan_reg_on)) {
+               printk(KERN_INFO "%s: Initial WL_REG_ON: [%d]\n",
+                       __FUNCTION__, gpio_get_value(wlan_reg_on));
+       }
+
+       /* Wait for WIFI_TURNON_DELAY due to power stability */
+       msleep(WIFI_TURNON_DELAY);
+
+#ifdef CONFIG_BCMDHD_OOB_HOST_WAKE
+       /* ========== WLAN_HOST_WAKE ============ */
+       wlan_host_wake_up = of_get_named_gpio(root_node, WIFI_WLAN_HOST_WAKE_PROPNAME, 0);
+       printk(KERN_INFO "%s: gpio_wlan_host_wake : %d\n", __FUNCTION__, wlan_host_wake_up);
+
+       if (gpio_request_one(wlan_host_wake_up, GPIOF_IN, "WLAN_HOST_WAKE")) {
+               printk(KERN_ERR "%s: Faiiled to request gpio %d for WLAN_HOST_WAKE\n",
+                       __FUNCTION__, wlan_host_wake_up);
+                       return -ENODEV;
+       } else {
+               printk(KERN_ERR "%s: gpio_request WLAN_HOST_WAKE done"
+                       " - WLAN_HOST_WAKE: GPIO %d\n",
+                       __FUNCTION__, wlan_host_wake_up);
+       }
+
+       gpio_direction_input(wlan_host_wake_up);
+       wlan_host_wake_irq = gpio_to_irq(wlan_host_wake_up);
+#endif /* CONFIG_BCMDHD_OOB_HOST_WAKE */
+
+#if defined(CONFIG_BCM4359) || defined(CONFIG_BCM4361) || defined(CONFIG_BCM4375) || \
+       defined(CONFIG_BCM4389)
+       printk(KERN_INFO "%s: Call msm_pcie_enumerate\n", __FUNCTION__);
+       msm_pcie_enumerate(MSM_PCIE_CH_NUM);
+#endif /* CONFIG_BCM4359 || CONFIG_BCM4361 || CONFIG_BCM4375 || CONFIG_BCM4389 */
+
+       return 0;
+}
+
+int
+dhd_wlan_power(int onoff)
+{
+       printk(KERN_INFO"%s Enter: power %s\n", __func__, onoff ? "on" : "off");
+
+       if (onoff) {
+               if (gpio_direction_output(wlan_reg_on, 1)) {
+                       printk(KERN_ERR "%s: WL_REG_ON is failed to pull up\n", __FUNCTION__);
+                       return -EIO;
+               }
+               if (gpio_get_value(wlan_reg_on)) {
+                       printk(KERN_INFO"WL_REG_ON on-step-2 : [%d]\n",
+                               gpio_get_value(wlan_reg_on));
+               } else {
+                       printk("[%s] gpio value is 0. We need reinit.\n", __func__);
+                       if (gpio_direction_output(wlan_reg_on, 1)) {
+                               printk(KERN_ERR "%s: WL_REG_ON is "
+                                       "failed to pull up\n", __func__);
+                       }
+               }
+       } else {
+               if (gpio_direction_output(wlan_reg_on, 0)) {
+                       printk(KERN_ERR "%s: WL_REG_ON is failed to pull up\n", __FUNCTION__);
+                       return -EIO;
+               }
+               if (gpio_get_value(wlan_reg_on)) {
+                       printk(KERN_INFO"WL_REG_ON on-step-2 : [%d]\n",
+                               gpio_get_value(wlan_reg_on));
+               }
+       }
+       return 0;
+}
+EXPORT_SYMBOL(dhd_wlan_power);
+
+static int
+dhd_wlan_reset(int onoff)
+{
+       return 0;
+}
+
+static int
+dhd_wlan_set_carddetect(int val)
+{
+#ifdef CONFIG_BCMDHD_PCIE
+       printk(KERN_INFO "%s: Call msm_pcie_enumerate\n", __FUNCTION__);
+       msm_pcie_enumerate(MSM_PCIE_CH_NUM);
+#endif /* CONFIG_BCMDHD_PCIE */
+       return 0;
+}
+
+#if defined(CONFIG_BCMDHD_OOB_HOST_WAKE) && defined(CONFIG_BCMDHD_GET_OOB_STATE)
+int
+dhd_get_wlan_oob_gpio(void)
+{
+       return gpio_is_valid(wlan_host_wake_up) ?
+               gpio_get_value(wlan_host_wake_up) : -1;
+}
+EXPORT_SYMBOL(dhd_get_wlan_oob_gpio);
+#endif /* CONFIG_BCMDHD_OOB_HOST_WAKE && CONFIG_BCMDHD_GET_OOB_STATE */
+
+struct resource dhd_wlan_resources = {
+       .name   = "bcmdhd_wlan_irq",
+       .start  = 0, /* Dummy */
+       .end    = 0, /* Dummy */
+       .flags  = IORESOURCE_IRQ | IORESOURCE_IRQ_SHAREABLE |
+#ifdef CONFIG_BCMDHD_PCIE
+       IORESOURCE_IRQ_HIGHEDGE,
+#else
+       IORESOURCE_IRQ_HIGHLEVEL,
+#endif /* CONFIG_BCMDHD_PCIE */
+};
+EXPORT_SYMBOL(dhd_wlan_resources);
+
+struct wifi_platform_data dhd_wlan_control = {
+       .set_power      = dhd_wlan_power,
+       .set_reset      = dhd_wlan_reset,
+       .set_carddetect = dhd_wlan_set_carddetect,
+#ifdef CONFIG_BROADCOM_WIFI_RESERVED_MEM
+       .mem_prealloc   = dhd_wlan_mem_prealloc,
+#endif /* CONFIG_BROADCOM_WIFI_RESERVED_MEM */
+};
+EXPORT_SYMBOL(dhd_wlan_control);
+
+int __init
+dhd_wlan_init(void)
+{
+       int ret;
+
+       printk(KERN_INFO"%s: START.......\n", __FUNCTION__);
+       ret = dhd_wifi_init_gpio();
+       if (ret < 0) {
+               printk(KERN_ERR "%s: failed to initiate GPIO, ret=%d\n",
+                       __FUNCTION__, ret);
+               goto fail;
+       }
+
+#ifdef CONFIG_BCMDHD_OOB_HOST_WAKE
+       dhd_wlan_resources.start = wlan_host_wake_irq;
+       dhd_wlan_resources.end = wlan_host_wake_irq;
+#endif /* CONFIG_BCMDHD_OOB_HOST_WAKE */
+
+#ifdef CONFIG_BROADCOM_WIFI_RESERVED_MEM
+       ret = dhd_init_wlan_mem();
+       if (ret < 0) {
+               printk(KERN_ERR "%s: failed to alloc reserved memory,"
+                       " ret=%d\n", __FUNCTION__, ret);
+       }
+#endif /* CONFIG_BROADCOM_WIFI_RESERVED_MEM */
+
+fail:
+       printk(KERN_INFO"%s: FINISH.......\n", __FUNCTION__);
+       return ret;
+}
+#if defined(CONFIG_ARCH_MSM8996) || defined(CONFIG_ARCH_MSM8998) || \
+       defined(CONFIG_ARCH_SDM845) || defined(CONFIG_ARCH_SM8150) || defined(CONFIG_ARCH_KONA)
+#if defined(CONFIG_DEFERRED_INITCALLS)
+deferred_module_init(dhd_wlan_init);
+#else
+late_initcall(dhd_wlan_init);
+#endif /* CONFIG_DEFERRED_INITCALLS */
+#else
+device_initcall(dhd_wlan_init);
+#endif /* CONFIG_ARCH_MSM8996 || CONFIG_ARCH_MSM8998
+       * CONFIG_ARCH_SDM845 || CONFIG_ARCH_SM8150 || CONFIG_ARCH_KONA
+       */
diff --git a/bcmdhd.101.10.240.x/dhd_custom_sec.c b/bcmdhd.101.10.240.x/dhd_custom_sec.c
new file mode 100644 (file)
index 0000000..ddb97f8
--- /dev/null
@@ -0,0 +1,1040 @@
+/*
+ * Customer HW 4 dependant file
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_custom_sec.c 334946 2012-05-24 20:38:00Z $
+ */
+#if defined(CUSTOMER_HW4) || defined(CUSTOMER_HW40)
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+
+#include <ethernet.h>
+#include <dngl_stats.h>
+#include <bcmutils.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <dhd_linux.h>
+#include <bcmdevs.h>
+#include <bcmdevs_legacy.h>    /* need to still support chips no longer in trunk firmware */
+
+#include <linux/fcntl.h>
+#include <linux/fs.h>
+
+const struct cntry_locales_custom translate_custom_table[] = {
+       /* default ccode/regrev */
+       {"",   "XZ", 11},       /* Universal if Country code is unknown or empty */
+       {"IR", "XZ", 11},       /* Universal if Country code is IRAN, (ISLAMIC REPUBLIC OF) */
+       {"SD", "XZ", 11},       /* Universal if Country code is SUDAN */
+       {"PS", "XZ", 11},       /* Universal if Country code is PALESTINIAN TERRITORY, OCCUPIED */
+       {"TL", "XZ", 11},       /* Universal if Country code is TIMOR-LESTE (EAST TIMOR) */
+       {"MH", "XZ", 11},       /* Universal if Country code is MARSHALL ISLANDS */
+       {"GL", "GP", 2},
+       {"AL", "AL", 2},
+#ifdef DHD_SUPPORT_GB_999
+       {"DZ", "GB", 999},
+#else
+       {"DZ", "GB", 6},
+#endif /* DHD_SUPPORT_GB_999 */
+       {"AS", "AS", 12},
+       {"AI", "AI", 1},
+       {"AF", "AD", 0},
+       {"AG", "AG", 2},
+       {"AR", "AU", 6},
+       {"AW", "AW", 2},
+       {"AU", "AU", 6},
+       {"AT", "AT", 4},
+       {"AZ", "AZ", 2},
+       {"BS", "BS", 2},
+       {"BH", "BH", 4},
+       {"BD", "BD", 1},
+       {"BY", "BY", 3},
+       {"BE", "BE", 4},
+       {"BM", "BM", 12},
+       {"BA", "BA", 2},
+       {"BR", "BR", 2},
+       {"VG", "VG", 2},
+       {"BN", "BN", 4},
+       {"BG", "BG", 4},
+       {"KH", "KH", 2},
+       {"KY", "KY", 3},
+       {"CN", "CN", 38},
+       {"CO", "CO", 17},
+       {"CR", "CR", 17},
+       {"HR", "HR", 4},
+       {"CY", "CY", 4},
+       {"CZ", "CZ", 4},
+       {"DK", "DK", 4},
+       {"EE", "EE", 4},
+       {"ET", "ET", 2},
+       {"FI", "FI", 4},
+       {"FR", "FR", 5},
+       {"GF", "GF", 2},
+       {"DE", "DE", 7},
+       {"GR", "GR", 4},
+       {"GD", "GD", 2},
+       {"GP", "GP", 2},
+       {"GU", "GU", 30},
+       {"HK", "HK", 2},
+       {"HU", "HU", 4},
+       {"IS", "IS", 4},
+       {"IN", "IN", 3},
+       {"ID", "ID", 1},
+       {"IE", "IE", 5},
+       {"IL", "IL", 14},
+       {"IT", "IT", 4},
+       {"JP", "JP", 45},
+       {"JO", "JO", 3},
+       {"KE", "SA", 0},
+       {"KW", "KW", 5},
+       {"LA", "LA", 2},
+       {"LV", "LV", 4},
+       {"LB", "LB", 5},
+       {"LS", "LS", 2},
+       {"LI", "LI", 4},
+       {"LT", "LT", 4},
+       {"LU", "LU", 3},
+       {"MO", "SG", 0},
+       {"MK", "MK", 2},
+       {"MW", "MW", 1},
+       {"MY", "MY", 3},
+       {"MV", "MV", 3},
+       {"MT", "MT", 4},
+       {"MQ", "MQ", 2},
+       {"MR", "MR", 2},
+       {"MU", "MU", 2},
+       {"YT", "YT", 2},
+       {"MX", "MX", 44},
+       {"MD", "MD", 2},
+       {"MC", "MC", 1},
+       {"ME", "ME", 2},
+       {"MA", "MA", 2},
+       {"NL", "NL", 4},
+       {"AN", "GD", 2},
+       {"NZ", "NZ", 4},
+       {"NO", "NO", 4},
+       {"OM", "OM", 4},
+       {"PA", "PA", 17},
+       {"PG", "AU", 6},
+       {"PY", "PY", 2},
+       {"PE", "PE", 20},
+       {"PH", "PH", 5},
+       {"PL", "PL", 4},
+       {"PT", "PT", 4},
+       {"PR", "PR", 38},
+       {"RE", "RE", 2},
+       {"RO", "RO", 4},
+       {"SN", "MA", 2},
+       {"RS", "RS", 2},
+       {"SK", "SK", 4},
+       {"SI", "SI", 4},
+       {"ES", "ES", 4},
+       {"LK", "LK", 1},
+       {"SE", "SE", 4},
+       {"CH", "CH", 4},
+       {"TW", "TW", 1},
+       {"TH", "TH", 5},
+       {"TT", "TT", 3},
+       {"TR", "TR", 7},
+       {"AE", "AE", 6},
+#ifdef DHD_SUPPORT_GB_999
+       {"GB", "GB", 999},
+#else
+       {"GB", "GB", 6},
+#endif /* DHD_SUPPORT_GB_999 */
+       {"UY", "VE", 3},
+       {"VI", "PR", 38},
+       {"VA", "VA", 2},
+       {"VE", "VE", 3},
+       {"VN", "VN", 4},
+       {"ZM", "LA", 2},
+       {"EC", "EC", 21},
+       {"SV", "SV", 25},
+#if defined(BCM4358_CHIP) || defined(BCM4359_CHIP)
+       {"KR", "KR", 70},
+#else
+       {"KR", "KR", 48},
+#endif
+       {"RU", "RU", 13},
+       {"UA", "UA", 8},
+       {"GT", "GT", 1},
+       {"MN", "MN", 1},
+       {"NI", "NI", 2},
+       {"UZ", "MA", 2},
+       {"ZA", "ZA", 6},
+       {"EG", "EG", 13},
+       {"TN", "TN", 1},
+       {"AO", "AD", 0},
+       {"BT", "BJ", 0},
+       {"BW", "BJ", 0},
+       {"LY", "LI", 4},
+       {"BO", "NG", 0},
+       {"UM", "PR", 38},
+       /* Support FCC 15.407 (Part 15E) Changes, effective June 2 2014 */
+       /* US/988, Q2/993 country codes with higher power on UNII-1 5G band */
+       {"US", "US", 988},
+       {"CU", "US", 988},
+       {"CA", "Q2", 993},
+};
+
+/* Customized Locale convertor
+*  input : ISO 3166-1 country abbreviation
+*  output: customized cspec
+*/
+void get_customized_country_code(void *adapter, char *country_iso_code, wl_country_t *cspec)
+{
+       int size, i;
+
+       size = ARRAYSIZE(translate_custom_table);
+
+       if (cspec == 0)
+                return;
+
+       if (size == 0)
+                return;
+
+       for (i = 0; i < size; i++) {
+               if (strcmp(country_iso_code, translate_custom_table[i].iso_abbrev) == 0) {
+                       memcpy(cspec->ccode,
+                               translate_custom_table[i].custom_locale, WLC_CNTRY_BUF_SZ);
+                       cspec->rev = translate_custom_table[i].custom_locale_rev;
+                       return;
+               }
+       }
+       return;
+}
+
+#define PSMINFO PLATFORM_PATH".psm.info"
+#define ANTINFO PLATFORM_PATH".ant.info"
+#define WIFIVERINFO     PLATFORM_PATH".wifiver.info"
+#define LOGTRACEINFO    PLATFORM_PATH".logtrace.info"
+#define SOFTAPINFO             PLATFORM_PATH".softap.info"
+
+#ifdef DHD_PM_CONTROL_FROM_FILE
+/* XXX This function used for setup PM related value control by read from file.
+ * Normally, PM related value Turn Offed for MFG process
+ */
+extern bool g_pm_control;
+#ifdef DHD_EXPORT_CNTL_FILE
+extern uint32 pmmode_val;
+#endif /* !DHD_EXPORT_CNTL_FILE */
+void sec_control_pm(dhd_pub_t *dhd, uint *power_mode)
+{
+#ifndef DHD_EXPORT_CNTL_FILE
+       struct file *fp = NULL;
+       char *filepath = PSMINFO;
+#endif /* DHD_EXPORT_CNTL_FILE */
+       char power_val = 0;
+       int ret = 0;
+#ifdef DHD_ENABLE_LPC
+       uint32 lpc = 0;
+#endif /* DHD_ENABLE_LPC */
+
+#ifndef DHD_EXPORT_CNTL_FILE
+       g_pm_control = FALSE;
+       fp = filp_open(filepath, O_RDONLY, 0);
+       if (IS_ERR(fp) || (fp == NULL)) {
+               /* Enable PowerSave Mode */
+               dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)power_mode,
+                       sizeof(uint), TRUE, 0);
+               DHD_ERROR(("[WIFI_SEC] %s: %s doesn't exist"
+                       " so set PM to %d\n",
+                       __FUNCTION__, filepath, *power_mode));
+               return;
+       } else {
+               kernel_read_compat(fp, fp->f_pos, &power_val, 1);
+               DHD_ERROR(("[WIFI_SEC] %s: POWER_VAL = %c \r\n", __FUNCTION__, power_val));
+               filp_close(fp, NULL);
+       }
+#else
+       g_pm_control = FALSE;
+       /* Not set from the framework side */
+       if (pmmode_val == 0xFFu) {
+               /* Enable PowerSave Mode */
+               dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)power_mode,
+                       sizeof(uint), TRUE, 0);
+               DHD_ERROR(("[WIFI_SEC] %s: doesn't set from sysfs"
+                       " so set PM to %d\n",
+                       __FUNCTION__, *power_mode));
+               return;
+
+       } else {
+               power_val = (char)pmmode_val;
+       }
+#endif /* !DHD_EXPORT_CNTL_FILE */
+
+#ifdef DHD_EXPORT_CNTL_FILE
+       if (power_val == 0) {
+#else
+       /* XXX: power_val is compared with character type read from .psm.info file */
+       if (power_val == '0') {
+#endif /* DHD_EXPORT_CNTL_FILE */
+#ifdef ROAM_ENABLE
+               uint roamvar = 1;
+#endif
+               uint32 wl_updown = 1;
+
+               *power_mode = PM_OFF;
+               /* Disable PowerSave Mode */
+               dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)power_mode,
+                       sizeof(uint), TRUE, 0);
+#ifndef CUSTOM_SET_ANTNPM
+               /* Turn off MPC in AP mode */
+               ret = dhd_iovar(dhd, 0, "mpc", (char *)power_mode, sizeof(*power_mode),
+                               NULL, 0, TRUE);
+#endif /* !CUSTOM_SET_ANTNPM */
+               g_pm_control = TRUE;
+#ifdef ROAM_ENABLE
+               /* Roaming off of dongle */
+               ret = dhd_iovar(dhd, 0, "roam_off", (char *)&roamvar, sizeof(roamvar), NULL,
+                               0, TRUE);
+#endif
+#ifdef DHD_ENABLE_LPC
+               /* Set lpc 0 */
+               ret = dhd_iovar(dhd, 0, "lpc", (char *)&lpc, sizeof(lpc), NULL, 0, TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("[WIFI_SEC] %s: Set lpc failed  %d\n",
+                       __FUNCTION__, ret));
+               }
+#endif /* DHD_ENABLE_LPC */
+#ifdef DHD_PCIE_RUNTIMEPM
+               DHD_ERROR(("[WIFI_SEC] %s : Turn Runtime PM off \n", __FUNCTION__));
+               /* Turn Runtime PM off */
+               dhdpcie_block_runtime_pm(dhd);
+#endif /* DHD_PCIE_RUNTIMEPM */
+               /* Disable ocl */
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_UP, (char *)&wl_updown,
+                               sizeof(wl_updown), TRUE, 0)) < 0) {
+                       DHD_ERROR(("[WIFI_SEC] %s: WLC_UP faield %d\n", __FUNCTION__, ret));
+               }
+#ifndef CUSTOM_SET_OCLOFF
+               {
+                       uint32 ocl_enable = 0;
+                       ret = dhd_iovar(dhd, 0, "ocl_enable", (char *)&ocl_enable,
+                                       sizeof(ocl_enable), NULL, 0, TRUE);
+                       if (ret < 0) {
+                               DHD_ERROR(("[WIFI_SEC] %s: Set ocl_enable %d failed %d\n",
+                                       __FUNCTION__, ocl_enable, ret));
+                       } else {
+                               DHD_ERROR(("[WIFI_SEC] %s: Set ocl_enable %d OK %d\n",
+                                       __FUNCTION__, ocl_enable, ret));
+                       }
+               }
+#else
+               dhd->ocl_off = TRUE;
+#endif /* CUSTOM_SET_OCLOFF */
+#ifdef WLADPS
+               if ((ret = dhd_enable_adps(dhd, ADPS_DISABLE)) < 0) {
+                       DHD_ERROR(("[WIFI_SEC] %s: dhd_enable_adps failed %d\n",
+                                       __FUNCTION__, ret));
+               }
+#endif /* WLADPS */
+
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_DOWN, (char *)&wl_updown,
+                               sizeof(wl_updown), TRUE, 0)) < 0) {
+                       DHD_ERROR(("[WIFI_SEC] %s: WLC_DOWN faield %d\n",
+                                       __FUNCTION__, ret));
+               }
+       } else {
+               dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)power_mode,
+                       sizeof(uint), TRUE, 0);
+       }
+}
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+
+#ifdef MIMO_ANT_SETTING
+int get_ant_val_from_file(uint32 *read_val)
+{
+       int ret = -1;
+       struct file *fp = NULL;
+       char *filepath = ANTINFO;
+       char *p_ant_val = NULL;
+       uint32 ant_val = 0;
+
+       /* Read antenna settings from the file */
+       fp = filp_open(filepath, O_RDONLY, 0);
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("[WIFI_SEC] %s: File [%s] doesn't exist\n", __FUNCTION__, filepath));
+               ret = -ENOENT;
+               return ret;
+       } else {
+               ret = kernel_read_compat(fp, 0, (char *)&ant_val, sizeof(uint32));
+               if (ret < 0) {
+                       DHD_ERROR(("[WIFI_SEC] %s: File read error, ret=%d\n", __FUNCTION__, ret));
+                       filp_close(fp, NULL);
+                       return ret;
+               }
+
+               p_ant_val = (char *)&ant_val;
+               p_ant_val[sizeof(uint32) - 1] = '\0';
+               ant_val = bcm_atoi(p_ant_val);
+
+               DHD_ERROR(("[WIFI_SEC]%s: ANT val = %d\n", __FUNCTION__, ant_val));
+               filp_close(fp, NULL);
+
+               /* Check value from the file */
+               if (ant_val < 1 || ant_val > 3) {
+                       DHD_ERROR(("[WIFI_SEC] %s: Invalid value %d read from the file %s\n",
+                               __FUNCTION__, ant_val, filepath));
+                       return -1;
+               }
+       }
+       *read_val = ant_val;
+       return ret;
+}
+
+int dhd_sel_ant_from_file(dhd_pub_t *dhd)
+{
+       int ret = -1;
+       uint32 ant_val = 0;
+       uint32 btc_mode = 0;
+       uint chip_id = dhd_bus_chip_id(dhd);
+#ifndef CUSTOM_SET_ANTNPM
+       wl_config_t rsdb_mode;
+
+       memset(&rsdb_mode, 0, sizeof(rsdb_mode));
+#endif /* !CUSTOM_SET_ANTNPM */
+
+       /* Check if this chip can support MIMO */
+       if (chip_id != BCM4350_CHIP_ID &&
+               chip_id != BCM4354_CHIP_ID &&
+               chip_id != BCM43569_CHIP_ID &&
+               chip_id != BCM4358_CHIP_ID &&
+               chip_id != BCM4359_CHIP_ID &&
+               chip_id != BCM4355_CHIP_ID &&
+               chip_id != BCM4347_CHIP_ID &&
+               chip_id != BCM4361_CHIP_ID &&
+               chip_id != BCM4375_CHIP_ID &&
+               chip_id != BCM4389_CHIP_ID) {
+               DHD_ERROR(("[WIFI_SEC] %s: This chipset does not support MIMO\n",
+                       __FUNCTION__));
+               return ret;
+       }
+
+#ifndef DHD_EXPORT_CNTL_FILE
+       ret = get_ant_val_from_file(&ant_val);
+#else
+       ant_val = (uint32)antsel;
+#endif /* !DHD_EXPORT_CNTL_FILE */
+       if (ant_val == 0) {
+#ifdef CUSTOM_SET_ANTNPM
+               dhd->mimo_ant_set = 0;
+#endif /* CUSTOM_SET_ANTNPM */
+               return ret;
+       }
+       DHD_ERROR(("[WIFI_SEC]%s: ANT val = %d\n", __FUNCTION__, ant_val));
+
+       /* bt coex mode off */
+       if (dhd_get_fw_mode(dhd->info) == DHD_FLAG_MFG_MODE) {
+               ret = dhd_iovar(dhd, 0, "btc_mode", (char *)&btc_mode, sizeof(btc_mode), NULL, 0,
+                               TRUE);
+               if (ret) {
+                       DHD_ERROR(("[WIFI_SEC] %s: Fail to execute dhd_wl_ioctl_cmd(): "
+                               "btc_mode, ret=%d\n",
+                               __FUNCTION__, ret));
+                       return ret;
+               }
+       }
+
+#ifndef CUSTOM_SET_ANTNPM
+       /* rsdb mode off */
+       DHD_ERROR(("[WIFI_SEC] %s: %s the RSDB mode!\n",
+               __FUNCTION__, rsdb_mode.config ? "Enable" : "Disable"));
+       ret = dhd_iovar(dhd, 0, "rsdb_mode", (char *)&rsdb_mode, sizeof(rsdb_mode), NULL, 0, TRUE);
+       if (ret) {
+               DHD_ERROR(("[WIFI_SEC] %s: Fail to execute dhd_wl_ioctl_cmd(): "
+                       "rsdb_mode, ret=%d\n", __FUNCTION__, ret));
+               return ret;
+       }
+
+       /* Select Antenna */
+       ret = dhd_iovar(dhd, 0, "txchain", (char *)&ant_val, sizeof(ant_val), NULL, 0, TRUE);
+       if (ret) {
+               DHD_ERROR(("[WIFI_SEC] %s: Fail to execute dhd_wl_ioctl_cmd(): txchain, ret=%d\n",
+                       __FUNCTION__, ret));
+               return ret;
+       }
+
+       ret = dhd_iovar(dhd, 0, "rxchain", (char *)&ant_val, sizeof(ant_val), NULL, 0, TRUE);
+       if (ret) {
+               DHD_ERROR(("[WIFI_SEC] %s: Fail to execute dhd_wl_ioctl_cmd(): rxchain, ret=%d\n",
+                       __FUNCTION__, ret));
+               return ret;
+       }
+#else
+       dhd->mimo_ant_set = ant_val;
+       DHD_ERROR(("[WIFI_SEC] %s: mimo_ant_set = %d\n", __FUNCTION__, dhd->mimo_ant_set));
+#endif /* CUSTOM_SET_ANTNPM */
+
+       return 0;
+}
+#endif /* MIMO_ANTENNA_SETTING */
+
+#ifdef LOGTRACE_FROM_FILE
+/*
+ * LOGTRACEINFO = .logtrace.info
+ *  - logtrace = 1            => Enable LOGTRACE Event
+ *  - logtrace = 0            => Disable LOGTRACE Event
+ *  - file not exist          => Disable LOGTRACE Event
+ */
+int dhd_logtrace_from_file(dhd_pub_t *dhd)
+{
+#ifndef DHD_EXPORT_CNTL_FILE
+       struct file *fp = NULL;
+       int ret = -1;
+       uint32 logtrace = 0;
+       char *filepath = LOGTRACEINFO;
+       char *p_logtrace = NULL;
+
+       /* Read LOGTRACE Event on/off request from the file */
+       fp = filp_open(filepath, O_RDONLY, 0);
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("[WIFI_SEC] %s: File [%s] doesn't exist\n", __FUNCTION__, filepath));
+               return 0;
+       } else {
+               ret = kernel_read_compat(fp, 0, (char *)&logtrace, sizeof(uint32));
+               if (ret < 0) {
+                       DHD_ERROR(("[WIFI_SEC] %s: File read error, ret=%d\n", __FUNCTION__, ret));
+                       filp_close(fp, NULL);
+                       return 0;
+               }
+
+               p_logtrace = (char *)&logtrace;
+               p_logtrace[sizeof(uint32) - 1] = '\0';
+               logtrace = bcm_atoi(p_logtrace);
+
+               DHD_ERROR(("[WIFI_SEC] %s: LOGTRACE On/Off from file = %d\n",
+                       __FUNCTION__, logtrace));
+               filp_close(fp, NULL);
+
+               /* Check value from the file */
+               if (logtrace > 2) {
+                       DHD_ERROR(("[WIFI_SEC] %s: Invalid value %d read from the file %s\n",
+                               __FUNCTION__, logtrace, filepath));
+                       return 0;
+               }
+       }
+
+       return (int)logtrace;
+#else
+       DHD_ERROR(("[WIFI_SEC] %s : LOGTRACE On/Off from sysfs = %d\n",
+               __FUNCTION__, (int)logtrace_val));
+       return (int)logtrace_val;
+#endif /* !DHD_EXPORT_CNTL_FILE */
+}
+#endif /* LOGTRACE_FROM_FILE */
+
+#ifdef USE_WFA_CERT_CONF
+#ifndef DHD_EXPORT_CNTL_FILE
+int sec_get_param_wfa_cert(dhd_pub_t *dhd, int mode, uint* read_val)
+{
+       struct file *fp = NULL;
+       char *filepath = NULL;
+       int val = 0;
+       char *p_val = NULL;
+
+       if (!dhd || (mode < SET_PARAM_BUS_TXGLOM_MODE) ||
+               (mode >= PARAM_LAST_VALUE)) {
+               DHD_ERROR(("[WIFI_SEC] %s: invalid argument\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       switch (mode) {
+#ifdef BCMSDIO
+               case SET_PARAM_BUS_TXGLOM_MODE:
+                       filepath = PLATFORM_PATH".bustxglom.info";
+                       break;
+#endif /* BCMSDIO */
+#if defined(ROAM_ENABLE) || defined(DISABLE_BUILTIN_ROAM)
+               case SET_PARAM_ROAMOFF:
+                       filepath = PLATFORM_PATH".roamoff.info";
+                       break;
+#endif /* ROAM_ENABLE || DISABLE_BUILTIN_ROAM */
+#ifdef USE_WL_FRAMEBURST
+               case SET_PARAM_FRAMEBURST:
+                       filepath = PLATFORM_PATH".frameburst.info";
+                       break;
+#endif /* USE_WL_FRAMEBURST */
+#ifdef USE_WL_TXBF
+               case SET_PARAM_TXBF:
+                       filepath = PLATFORM_PATH".txbf.info";
+                       break;
+#endif /* USE_WL_TXBF */
+#ifdef PROP_TXSTATUS
+               case SET_PARAM_PROPTX:
+                       filepath = PLATFORM_PATH".proptx.info";
+                       break;
+#endif /* PROP_TXSTATUS */
+               default:
+                       DHD_ERROR(("[WIFI_SEC] %s: File to find file name for index=%d\n",
+                               __FUNCTION__, mode));
+                       return BCME_ERROR;
+       }
+       fp = filp_open(filepath, O_RDONLY, 0);
+       if (IS_ERR(fp) || (fp == NULL)) {
+               DHD_ERROR(("[WIFI_SEC] %s: File open failed, file path=%s\n",
+                       __FUNCTION__, filepath));
+               return BCME_ERROR;
+       } else {
+               if (kernel_read_compat(fp, fp->f_pos, (char *)&val, sizeof(uint32)) < 0) {
+                       filp_close(fp, NULL);
+                       /* File operation is failed so we will return error code */
+                       DHD_ERROR(("[WIFI_SEC] %s: read failed, file path=%s\n",
+                               __FUNCTION__, filepath));
+                       return BCME_ERROR;
+               }
+               filp_close(fp, NULL);
+       }
+
+       p_val = (char *)&val;
+       p_val[sizeof(uint32) - 1] = '\0';
+       val = bcm_atoi(p_val);
+
+       switch (mode) {
+#if defined(ROAM_ENABLE) || defined(DISABLE_BUILTIN_ROAM)
+               case SET_PARAM_ROAMOFF:
+#endif /* ROAM_ENABLE || DISABLE_BUILTIN_ROAM */
+#ifdef USE_WL_FRAMEBURST
+               case SET_PARAM_FRAMEBURST:
+#endif /* USE_WL_FRAMEBURST */
+#ifdef USE_WL_TXBF
+               case SET_PARAM_TXBF:
+#endif /* USE_WL_TXBF */
+#ifdef PROP_TXSTATUS
+               case SET_PARAM_PROPTX:
+#endif /* PROP_TXSTATUS */
+               if (val < 0 || val > 1) {
+                       DHD_ERROR(("[WIFI_SEC] %s: value[%d] is out of range\n",
+                               __FUNCTION__, *read_val));
+                       return BCME_ERROR;
+               }
+                       break;
+               default:
+                       return BCME_ERROR;
+       }
+       *read_val = (uint)val;
+       return BCME_OK;
+}
+#else
+int sec_get_param_wfa_cert(dhd_pub_t *dhd, int mode, uint* read_val)
+{
+       uint val = 0;
+
+       if (!dhd || (mode < SET_PARAM_BUS_TXGLOM_MODE) ||
+               (mode >= PARAM_LAST_VALUE)) {
+               DHD_ERROR(("[WIFI_SEC] %s: invalid argument\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       switch (mode) {
+#ifdef BCMSDIO
+               case SET_PARAM_BUS_TXGLOM_MODE:
+                       if (bus_txglom == VALUENOTSET)
+                               return BCME_ERROR;
+                       else
+                           val = (uint)bus_txglom;
+                       break;
+#endif /* BCMSDIO */
+#if defined(ROAM_ENABLE) || defined(DISABLE_BUILTIN_ROAM)
+               case SET_PARAM_ROAMOFF:
+                       if (roam_off == VALUENOTSET)
+                               return BCME_ERROR;
+                       else
+                           val = (uint)roam_off;
+                       break;
+#endif /* ROAM_ENABLE || DISABLE_BUILTIN_ROAM */
+#ifdef USE_WL_FRAMEBURST
+               case SET_PARAM_FRAMEBURST:
+                       if (frameburst == VALUENOTSET)
+                               return BCME_ERROR;
+                       else
+                           val = (uint)frameburst;
+                       break;
+#endif /* USE_WL_FRAMEBURST */
+#ifdef USE_WL_TXBF
+               case SET_PARAM_TXBF:
+                       if (txbf == VALUENOTSET)
+                               return BCME_ERROR;
+                       else
+                           val = (uint)txbf;
+                       break;
+#endif /* USE_WL_TXBF */
+#ifdef PROP_TXSTATUS
+               case SET_PARAM_PROPTX:
+                       if (proptx == VALUENOTSET)
+                               return BCME_ERROR;
+                       else
+                           val = (uint)proptx;
+                       break;
+#endif /* PROP_TXSTATUS */
+               default:
+                   return BCME_ERROR;
+       }
+       *read_val = val;
+       return BCME_OK;
+}
+#endif /* !DHD_EXPORT_CNTL_FILE */
+#endif /* USE_WFA_CERT_CONF */
+
+#ifdef WRITE_WLANINFO
+#define FIRM_PREFIX "Firm_ver:"
+#define DHD_PREFIX "DHD_ver:"
+#define NV_PREFIX "Nv_info:"
+#define CLM_PREFIX "CLM_ver:"
+#define max_len(a, b) ((sizeof(a)/(2)) - (strlen(b)) - (3))
+#define tstr_len(a, b) ((strlen(a)) + (strlen(b)) + (3))
+
+char version_info[MAX_VERSION_LEN];
+char version_old_info[MAX_VERSION_LEN];
+
+int write_filesystem(struct file *file, unsigned long long offset,
+       unsigned char* data, unsigned int size)
+{
+       mm_segment_t oldfs;
+       int ret;
+
+       oldfs = get_fs();
+       set_fs(get_ds());
+
+       ret = vfs_write(file, data, size, &offset);
+
+       set_fs(oldfs);
+       return ret;
+}
+
+uint32 sec_save_wlinfo(char *firm_ver, char *dhd_ver, char *nvram_p, char *clm_ver)
+{
+#ifndef DHD_EXPORT_CNTL_FILE
+       struct file *fp = NULL;
+       char *filepath = WIFIVERINFO;
+#endif /* DHD_EXPORT_CNTL_FILE */
+       struct file *nvfp = NULL;
+       int min_len, str_len = 0;
+       int ret = 0;
+       char* nvram_buf;
+       char temp_buf[256];
+
+       DHD_TRACE(("[WIFI_SEC] %s: Entered.\n", __FUNCTION__));
+
+       DHD_INFO(("[WIFI_SEC] firmware version   : %s\n", firm_ver));
+       DHD_INFO(("[WIFI_SEC] dhd driver version : %s\n", dhd_ver));
+       DHD_INFO(("[WIFI_SEC] nvram path : %s\n", nvram_p));
+       DHD_INFO(("[WIFI_SEC] clm version : %s\n", clm_ver));
+
+       memset(version_info, 0, sizeof(version_info));
+
+       if (strlen(dhd_ver)) {
+               min_len = min(strlen(dhd_ver), max_len(temp_buf, DHD_PREFIX));
+               min_len += strlen(DHD_PREFIX) + 3;
+               DHD_INFO(("[WIFI_SEC] DHD ver length : %d\n", min_len));
+               snprintf(version_info+str_len, min_len, DHD_PREFIX " %s\n", dhd_ver);
+               str_len = strlen(version_info);
+
+               DHD_INFO(("[WIFI_SEC] Driver version_info len : %d\n", str_len));
+               DHD_INFO(("[WIFI_SEC] Driver version_info : %s\n", version_info));
+       } else {
+               DHD_ERROR(("[WIFI_SEC] Driver version is missing.\n"));
+       }
+
+       if (strlen(firm_ver)) {
+               min_len = min(strlen(firm_ver), max_len(temp_buf, FIRM_PREFIX));
+               min_len += strlen(FIRM_PREFIX) + 3;
+               DHD_INFO(("[WIFI_SEC] firmware ver length : %d\n", min_len));
+               snprintf(version_info+str_len, min_len, FIRM_PREFIX " %s\n", firm_ver);
+               str_len = strlen(version_info);
+
+               DHD_INFO(("[WIFI_SEC] Firmware version_info len : %d\n", str_len));
+               DHD_INFO(("[WIFI_SEC] Firmware version_info : %s\n", version_info));
+       } else {
+               DHD_ERROR(("[WIFI_SEC] Firmware version is missing.\n"));
+       }
+
+       if (nvram_p) {
+               memset(temp_buf, 0, sizeof(temp_buf));
+               nvfp = filp_open(nvram_p, O_RDONLY, 0);
+               if (IS_ERR(nvfp) || (nvfp == NULL)) {
+                       DHD_ERROR(("[WIFI_SEC] %s: Nvarm File open failed.\n", __FUNCTION__));
+                       return -1;
+               } else {
+                       ret = kernel_read_compat(nvfp, nvfp->f_pos, temp_buf, sizeof(temp_buf));
+                       filp_close(nvfp, NULL);
+               }
+
+               if (strlen(temp_buf)) {
+                       nvram_buf = temp_buf;
+                       bcmstrtok(&nvram_buf, "\n", 0);
+                       DHD_INFO(("[WIFI_SEC] nvram tolkening : %s(%zu) \n",
+                               temp_buf, strlen(temp_buf)));
+                       snprintf(version_info+str_len, tstr_len(temp_buf, NV_PREFIX),
+                               NV_PREFIX " %s\n", temp_buf);
+                       str_len = strlen(version_info);
+                       DHD_INFO(("[WIFI_SEC] NVRAM version_info : %s\n", version_info));
+                       DHD_INFO(("[WIFI_SEC] NVRAM version_info len : %d, nvram len : %zu\n",
+                               str_len, strlen(temp_buf)));
+               } else {
+                       DHD_ERROR(("[WIFI_SEC] NVRAM info is missing.\n"));
+               }
+       } else {
+               DHD_ERROR(("[WIFI_SEC] Not exist nvram path\n"));
+       }
+
+       if (strlen(clm_ver)) {
+               min_len = min(strlen(clm_ver), max_len(temp_buf, CLM_PREFIX));
+               min_len += strlen(CLM_PREFIX) + 3;
+               DHD_INFO(("[WIFI_SEC] clm ver length : %d\n", min_len));
+               snprintf(version_info+str_len, min_len, CLM_PREFIX " %s\n", clm_ver);
+               str_len = strlen(version_info);
+
+               DHD_INFO(("[WIFI_SEC] CLM version_info len : %d\n", str_len));
+               DHD_INFO(("[WIFI_SEC] CLM version_info : %s\n", version_info));
+       } else {
+               DHD_ERROR(("[WIFI_SEC] CLM version is missing.\n"));
+       }
+
+       DHD_INFO(("[WIFI_SEC] version_info : %s, strlen : %zu\n",
+               version_info, strlen(version_info)));
+
+#ifndef DHD_EXPORT_CNTL_FILE
+       fp = filp_open(filepath, O_RDONLY, 0);
+       if (IS_ERR(fp) || (fp == NULL)) {
+               DHD_ERROR(("[WIFI_SEC] %s: .wifiver.info File open failed.\n", __FUNCTION__));
+       } else {
+               memset(version_old_info, 0, sizeof(version_old_info));
+               ret = kernel_read_compat(fp, fp->f_pos, version_old_info, sizeof(version_info));
+               filp_close(fp, NULL);
+               DHD_INFO(("[WIFI_SEC] kernel_read ret : %d.\n", ret));
+               if (strcmp(version_info, version_old_info) == 0) {
+                       DHD_ERROR(("[WIFI_SEC] .wifiver.info already saved.\n"));
+                       return 0;
+               }
+       }
+
+       fp = filp_open(filepath, O_RDWR | O_CREAT, 0664);
+       if (IS_ERR(fp) || (fp == NULL)) {
+               DHD_ERROR(("[WIFI_SEC] %s: .wifiver.info File open failed.\n",
+                       __FUNCTION__));
+       } else {
+               ret = write_filesystem(fp, fp->f_pos, version_info, sizeof(version_info));
+               DHD_INFO(("[WIFI_SEC] sec_save_wlinfo done. ret : %d\n", ret));
+               DHD_ERROR(("[WIFI_SEC] save .wifiver.info file.\n"));
+               filp_close(fp, NULL);
+       }
+#endif /* DHD_EXPORT_CNTL_FILE */
+       return ret;
+}
+#endif /* WRITE_WLANINFO */
+
+#ifdef SUPPORT_MULTIPLE_BOARD_REV_FROM_HW
+unsigned int system_hw_rev;
+static int
+__init get_hw_rev(char *arg)
+{
+       get_option(&arg, &system_hw_rev);
+       printk("dhd : hw_rev : %d\n", system_hw_rev);
+       return 0;
+}
+
+early_param("androidboot.hw_rev", get_hw_rev);
+#endif /* SUPPORT_MULTIPLE_BOARD_REV_FROM_HW */
+
+#ifdef GEN_SOFTAP_INFO_FILE
+#define SOFTAP_INFO_FILE_FIRST_LINE            "#.softap.info"
+/*
+ * # Does RSDB Wifi sharing support?
+ * DualBandConcurrency
+ * # Both wifi and hotspot can be turned on at the same time?
+ * DualInterface
+ * # 5Ghz band support?
+ * 5G
+ * # How many clients can be connected?
+ * maxClient
+ * # Does hotspot support PowerSave mode?
+ * PowerSave
+ * # Does android_net_wifi_set_Country_Code_Hal feature supported?
+ * HalFn_setCountryCodeHal
+ * # Does android_net_wifi_getValidChannels supported?
+ * HalFn_getValidChannels
+ */
+const char *softap_info_items[] = {
+       "DualBandConcurrency",
+#ifdef DHD_SOFTAP_DUAL_IF_INFO
+       "DualInterface",
+#endif /* DHD_SOFTAP_DUAL_IF_INFO */
+       "5G", "maxClient", "PowerSave",
+       "HalFn_setCountryCodeHal", "HalFn_getValidChannels", NULL
+};
+#if defined(BCM4361_CHIP) || defined(BCM4375_CHIP) || defined(BCM4389_CHIP_DEF)
+const char *softap_info_values[] = {
+       "yes",
+#ifdef DHD_SOFTAP_DUAL_IF_INFO
+       "yes",
+#endif /* DHD_SOFTAP_DUAL_IF_INFO */
+       "yes", "10", "yes", "yes", "yes", NULL
+};
+#elif defined(BCM43455_CHIP)
+const char *softap_info_values[] = {
+       "no",
+#ifdef DHD_SOFTAP_DUAL_IF_INFO
+       "no",
+#endif /* DHD_SOFTAP_DUAL_IF_INFO */
+       "yes", "10", "no", "yes", "yes", NULL
+};
+#elif defined(BCM43430_CHIP)
+const char *softap_info_values[] = {
+       "no",
+#ifdef DHD_SOFTAP_DUAL_IF_INFO
+       "no",
+#endif /* DHD_SOFTAP_DUAL_IF_INFO */
+       "no", "10", "no", "yes", "yes", NULL
+};
+#else
+const char *softap_info_values[] = {
+       "UNDEF",
+#ifdef DHD_SOFTAP_DUAL_IF_INFO
+       "UNDEF",
+#endif /* DHD_SOFTAP_DUAL_IF_INFO */
+       "UNDEF", "UNDEF", "UNDEF", "UNDEF", "UNDEF", NULL
+};
+#endif /* defined(BCM4361_CHIP) || defined(BCM4375_CHIP) || defined(BCM4389_CHIP_DEF) */
+#endif /* GEN_SOFTAP_INFO_FILE */
+
+#ifdef GEN_SOFTAP_INFO_FILE
+uint32 sec_save_softap_info(void)
+{
+#ifndef DHD_EXPORT_CNTL_FILE
+       struct file *fp = NULL;
+       char *filepath = SOFTAPINFO;
+#endif /* DHD_EXPORT_CNTL_FILE */
+       char temp_buf[SOFTAP_INFO_BUF_SZ];
+       int ret = -1, idx = 0, rem = 0, written = 0;
+       char *pos = NULL;
+
+       DHD_TRACE(("[WIFI_SEC] %s: Entered.\n", __FUNCTION__));
+       memset(temp_buf, 0, sizeof(temp_buf));
+
+       pos = temp_buf;
+       rem = sizeof(temp_buf);
+       written = snprintf(pos, sizeof(temp_buf), "%s\n",
+               SOFTAP_INFO_FILE_FIRST_LINE);
+       do {
+               int len = strlen(softap_info_items[idx]) +
+                       strlen(softap_info_values[idx]) + 2;
+               pos += written;
+               rem -= written;
+               if (len > rem) {
+                       break;
+               }
+               written = snprintf(pos, rem, "%s=%s\n",
+                       softap_info_items[idx], softap_info_values[idx]);
+       } while (softap_info_items[++idx] != NULL);
+
+#ifndef DHD_EXPORT_CNTL_FILE
+       fp = filp_open(filepath, O_RDWR | O_CREAT, 0664);
+       if (IS_ERR(fp) || (fp == NULL)) {
+               DHD_ERROR(("[WIFI_SEC] %s: %s File open failed.\n",
+                       SOFTAPINFO, __FUNCTION__));
+       } else {
+               ret = write_filesystem(fp, fp->f_pos, temp_buf, strlen(temp_buf));
+               DHD_INFO(("[WIFI_SEC] %s done. ret : %d\n", __FUNCTION__, ret));
+               DHD_ERROR(("[WIFI_SEC] save %s file.\n", SOFTAPINFO));
+               filp_close(fp, NULL);
+       }
+#else
+       strlcpy(softapinfostr, temp_buf, SOFTAP_INFO_BUF_SZ);
+
+       ret = BCME_OK;
+#endif /* !DHD_EXPORT_CNTL_FILE */
+       return ret;
+}
+#endif /* GEN_SOFTAP_INFO_FILE */
+#endif /* CUSTOMER_HW4 || CUSTOMER_HW40 */
+
+/* XXX WAR: disable pm_bcnrx , scan_ps for BCM4354 WISOL module.
+ * WISOL module have ANT_1 Rx sensitivity issue.
+*/
+#if defined(FORCE_DISABLE_SINGLECORE_SCAN)
+void
+dhd_force_disable_singlcore_scan(dhd_pub_t *dhd)
+{
+       int ret = 0;
+       struct file *fp = NULL;
+       char *filepath = PLATFORM_PATH".cid.info";
+       char vender[10] = {0, };
+       uint32 pm_bcnrx = 0;
+       uint32 scan_ps = 0;
+
+       if (BCM4354_CHIP_ID != dhd_bus_chip_id(dhd))
+               return;
+
+       fp = filp_open(filepath, O_RDONLY, 0);
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("%s file open error\n", filepath));
+       } else {
+               ret = kernel_read_compat(fp, 0, (char *)vender, 5);
+
+               if (ret > 0 && NULL != strstr(vender, "wisol")) {
+                       DHD_ERROR(("wisol module : set pm_bcnrx=0, set scan_ps=0\n"));
+
+                       ret = dhd_iovar(dhd, 0, "pm_bcnrx", (char *)&pm_bcnrx, sizeof(pm_bcnrx),
+                                       NULL, 0, TRUE);
+                       if (ret < 0)
+                               DHD_ERROR(("Set pm_bcnrx error (%d)\n", ret));
+
+                       ret = dhd_iovar(dhd, 0, "scan_ps", (char *)&scan_ps, sizeof(scan_ps), NULL,
+                                       0, TRUE);
+                       if (ret < 0)
+                               DHD_ERROR(("Set scan_ps error (%d)\n", ret));
+               }
+               filp_close(fp, NULL);
+       }
+}
+#endif /* FORCE_DISABLE_SINGLECORE_SCAN */
+
+#ifdef BCM4335_XTAL_WAR
+bool
+check_bcm4335_rev(void)
+{
+       int ret = -1;
+       struct file *fp = NULL;
+       char *filepath = "/data/.rev";
+       char chip_rev[10] = {0, };
+       bool is_revb0 = TRUE;
+
+       DHD_ERROR(("check BCM4335, check_bcm4335_rev \n"));
+       fp = filp_open(filepath, O_RDONLY, 0);
+
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("/data/.rev file open error\n"));
+               is_revb0 = TRUE;
+       } else {
+               DHD_ERROR(("/data/.rev file Found\n"));
+               ret = kernel_read_compat(fp, 0, (char *)chip_rev, 9);
+               if (ret != -1 && NULL != strstr(chip_rev, "BCM4335B0")) {
+                       DHD_ERROR(("Found BCM4335B0\n"));
+                       is_revb0 = TRUE;
+               } else {
+                       is_revb0 = FALSE;
+               }
+               filp_close(fp, NULL);
+       }
+       return is_revb0;
+}
+#endif /* BCM4335_XTAL_WAR */
diff --git a/bcmdhd.101.10.240.x/dhd_dbg.h b/bcmdhd.101.10.240.x/dhd_dbg.h
new file mode 100644 (file)
index 0000000..4a8c02c
--- /dev/null
@@ -0,0 +1,369 @@
+/*
+ * Debug/trace/assert driver definitions for Dongle Host Driver.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef _dhd_dbg_
+#define _dhd_dbg_
+
+#ifdef DHD_LOG_DUMP
+extern char *dhd_log_dump_get_timestamp(void);
+extern void dhd_log_dump_write(int type, char *binary_data,
+               int binary_len, const char *fmt, ...);
+#ifndef _DHD_LOG_DUMP_DEFINITIONS_
+#define _DHD_LOG_DUMP_DEFINITIONS_
+#define GENERAL_LOG_HDR "\n-------------------- General log ---------------------------\n"
+#define PRESERVE_LOG_HDR "\n-------------------- Preserve log ---------------------------\n"
+#define SPECIAL_LOG_HDR "\n-------------------- Special log ---------------------------\n"
+#define DHD_DUMP_LOG_HDR "\n-------------------- 'dhd dump' log -----------------------\n"
+#define EXT_TRAP_LOG_HDR "\n-------------------- Extended trap data -------------------\n"
+#define HEALTH_CHK_LOG_HDR "\n-------------------- Health check data --------------------\n"
+#ifdef DHD_DUMP_PCIE_RINGS
+#define FLOWRING_DUMP_HDR "\n-------------------- Flowring dump --------------------\n"
+#endif /* DHD_DUMP_PCIE_RINGS */
+#define DHD_LOG_DUMP_WRITE(fmt, ...) \
+       dhd_log_dump_write(DLD_BUF_TYPE_GENERAL, NULL, 0, fmt, ##__VA_ARGS__)
+#define DHD_LOG_DUMP_WRITE_EX(fmt, ...) \
+       dhd_log_dump_write(DLD_BUF_TYPE_SPECIAL, NULL, 0, fmt, ##__VA_ARGS__)
+#define DHD_LOG_DUMP_WRITE_PRSRV(fmt, ...) \
+       dhd_log_dump_write(DLD_BUF_TYPE_PRESERVE, NULL, 0, fmt, ##__VA_ARGS__)
+#endif /* !_DHD_LOG_DUMP_DEFINITIONS_ */
+#define CONCISE_DUMP_BUFLEN 16 * 1024
+#define ECNTRS_LOG_HDR "\n-------------------- Ecounters log --------------------------\n"
+#ifdef DHD_STATUS_LOGGING
+#define STATUS_LOG_HDR "\n-------------------- Status log -----------------------\n"
+#endif /* DHD_STATUS_LOGGING */
+#define RTT_LOG_HDR "\n-------------------- RTT log --------------------------\n"
+#define COOKIE_LOG_HDR "\n-------------------- Cookie List ----------------------------\n"
+#endif /* DHD_LOG_DUMP */
+
+#if defined(DHD_DEBUG)
+
+/* NON-NDIS cases */
+#ifdef DHD_LOG_DUMP
+/* Common case for EFI and non EFI */
+#define DHD_ERROR(args)        \
+do {   \
+       if (dhd_msg_level & DHD_ERROR_VAL) {    \
+               printf args;    \
+               DHD_LOG_DUMP_WRITE("[%s]: ", dhd_log_dump_get_timestamp());     \
+               DHD_LOG_DUMP_WRITE args;        \
+       }       \
+} while (0)
+
+/* !defined(DHD_EFI) and defined(DHD_LOG_DUMP) */
+#define DHD_INFO(args)         do {if (dhd_msg_level & DHD_INFO_VAL) printf args;} while (0)
+#else /* DHD_LOG_DUMP */
+/* !defined(DHD_LOG_DUMP cases) */
+#define DHD_ERROR(args)                do {if (dhd_msg_level & DHD_ERROR_VAL) printf args;} while (0)
+#define DHD_INFO(args)         do {if (dhd_msg_level & DHD_INFO_VAL) printf args;} while (0)
+#endif /* DHD_LOG_DUMP */
+
+#define DHD_TRACE(args)                do {if (dhd_msg_level & DHD_TRACE_VAL) printf args;} while (0)
+
+#ifdef DHD_LOG_DUMP
+/* LOG_DUMP defines common to EFI and NON-EFI */
+#define DHD_ERROR_MEM(args) \
+do {   \
+       if (dhd_msg_level & DHD_ERROR_VAL) {    \
+               if (dhd_msg_level & DHD_ERROR_MEM_VAL) {        \
+                       printf args; \
+               }       \
+               DHD_LOG_DUMP_WRITE("[%s]: ", dhd_log_dump_get_timestamp());     \
+               DHD_LOG_DUMP_WRITE args;        \
+       }       \
+} while (0)
+#define DHD_IOVAR_MEM(args) \
+do {   \
+       if (dhd_msg_level & DHD_ERROR_VAL) {    \
+               if (dhd_msg_level & DHD_IOVAR_MEM_VAL) {        \
+                       printf args; \
+               }       \
+               DHD_LOG_DUMP_WRITE("[%s]: ", dhd_log_dump_get_timestamp());     \
+               DHD_LOG_DUMP_WRITE args;        \
+       }       \
+} while (0)
+#define DHD_LOG_MEM(args) \
+do {   \
+       if (dhd_msg_level & DHD_ERROR_VAL) {    \
+               DHD_LOG_DUMP_WRITE("[%s]: ", dhd_log_dump_get_timestamp());     \
+               DHD_LOG_DUMP_WRITE args;        \
+       }       \
+} while (0)
+/* NON-EFI builds with LOG DUMP enabled */
+#define DHD_EVENT(args) \
+do {   \
+       if (dhd_msg_level & DHD_EVENT_VAL) {    \
+               printf args; \
+               DHD_LOG_DUMP_WRITE_PRSRV("[%s]: ", dhd_log_dump_get_timestamp());       \
+               DHD_LOG_DUMP_WRITE_PRSRV args;  \
+       }       \
+} while (0)
+#define DHD_PRSRV_MEM(args) \
+do {   \
+       if (dhd_msg_level & DHD_EVENT_VAL) {    \
+               if (dhd_msg_level & DHD_PRSRV_MEM_VAL) \
+                       printf args; \
+               DHD_LOG_DUMP_WRITE("[%s]: ", dhd_log_dump_get_timestamp()); \
+               DHD_LOG_DUMP_WRITE args;        \
+       }       \
+} while (0)
+/* Re-using 'DHD_MSGTRACE_VAL' for controlling printing of ecounter binary event
+* logs to console and debug dump -- need to cleanup in the future to use separate
+* 'DHD_ECNTR_VAL' bitmap flag. 'DHD_MSGTRACE_VAL' will be defined only
+* for non-android builds.
+*/
+#define DHD_ECNTR_LOG(args) \
+do {   \
+       if (dhd_msg_level & DHD_EVENT_VAL) {    \
+               if (dhd_msg_level & DHD_MSGTRACE_VAL) { \
+                       printf args; \
+                       DHD_LOG_DUMP_WRITE("[%s]: ", dhd_log_dump_get_timestamp()); \
+                       DHD_LOG_DUMP_WRITE args;        \
+               }       \
+       }       \
+} while (0)
+#define DHD_ERROR_EX(args)                                     \
+do {                                                                           \
+       if (dhd_msg_level & DHD_ERROR_VAL) {    \
+               printf args;    \
+               DHD_LOG_DUMP_WRITE_EX("[%s]: ", dhd_log_dump_get_timestamp());  \
+               DHD_LOG_DUMP_WRITE_EX args;     \
+       }       \
+} while (0)
+#define DHD_MSGTRACE_LOG(args) \
+do {   \
+       if (dhd_msg_level & DHD_MSGTRACE_VAL) { \
+                       printf args;    \
+       }       \
+       DHD_LOG_DUMP_WRITE("[%s]: ", dhd_log_dump_get_timestamp());     \
+       DHD_LOG_DUMP_WRITE args;        \
+} while (0)
+#else /* DHD_LOG_DUMP */
+/* !DHD_LOG_DUMP */
+#define DHD_MSGTRACE_LOG(args)  do {if (dhd_msg_level & DHD_MSGTRACE_VAL) printf args;} while (0)
+#define DHD_ERROR_MEM(args)    DHD_ERROR(args)
+#define DHD_IOVAR_MEM(args)    DHD_ERROR(args)
+#define DHD_LOG_MEM(args)      DHD_ERROR(args)
+#define DHD_EVENT(args)                do {if (dhd_msg_level & DHD_EVENT_VAL) printf args;} while (0)
+#define DHD_ECNTR_LOG(args)    DHD_EVENT(args)
+#define DHD_PRSRV_MEM(args)    DHD_EVENT(args)
+#define DHD_ERROR_EX(args)     DHD_ERROR(args)
+#endif /* DHD_LOG_DUMP */
+
+#define DHD_DATA(args)         do {if (dhd_msg_level & DHD_DATA_VAL) printf args;} while (0)
+#define DHD_CTL(args)          do {if (dhd_msg_level & DHD_CTL_VAL) printf args;} while (0)
+#define DHD_TIMER(args)                do {if (dhd_msg_level & DHD_TIMER_VAL) printf args;} while (0)
+#define DHD_HDRS(args)         do {if (dhd_msg_level & DHD_HDRS_VAL) printf args;} while (0)
+#define DHD_BYTES(args)                do {if (dhd_msg_level & DHD_BYTES_VAL) printf args;} while (0)
+#define DHD_INTR(args)         do {if (dhd_msg_level & DHD_INTR_VAL) printf args;} while (0)
+#define DHD_GLOM(args)         do {if (dhd_msg_level & DHD_GLOM_VAL) printf args;} while (0)
+#define DHD_BTA(args)          do {if (dhd_msg_level & DHD_BTA_VAL) printf args;} while (0)
+#define DHD_ISCAN(args)                do {if (dhd_msg_level & DHD_ISCAN_VAL) printf args;} while (0)
+#define DHD_ARPOE(args)                do {if (dhd_msg_level & DHD_ARPOE_VAL) printf args;} while (0)
+#define DHD_REORDER(args)      do {if (dhd_msg_level & DHD_REORDER_VAL) printf args;} while (0)
+#define DHD_PNO(args)          do {if (dhd_msg_level & DHD_PNO_VAL) printf args;} while (0)
+#define DHD_RTT(args)          do {if (dhd_msg_level & DHD_RTT_VAL) printf args;} while (0)
+#define DHD_PKT_MON(args)      do {if (dhd_msg_level & DHD_PKT_MON_VAL) printf args;} while (0)
+
+#if defined(DHD_LOG_DUMP)
+#if defined(DHD_LOG_PRINT_RATE_LIMIT)
+#define DHD_FWLOG(args)        \
+       do { \
+               if (dhd_msg_level & DHD_FWLOG_VAL) { \
+                       if (control_logtrace && !log_print_threshold) \
+                               printf args; \
+                       DHD_LOG_DUMP_WRITE args; \
+               } \
+       } while (0)
+#else
+#define DHD_FWLOG(args)        \
+       do { \
+               if (dhd_msg_level & DHD_FWLOG_VAL) { \
+                       if (control_logtrace) \
+                               printf args; \
+                       DHD_LOG_DUMP_WRITE args; \
+               } \
+       } while (0)
+#endif
+#else /* DHD_LOG_DUMP */
+#define DHD_FWLOG(args)                do {if (dhd_msg_level & DHD_FWLOG_VAL) printf args;} while (0)
+#endif /* DHD_LOG_DUMP */
+
+#define DHD_DBGIF(args)                do {if (dhd_msg_level & DHD_DBGIF_VAL) printf args;} while (0)
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+#define DHD_RPM(args)          do {if (dhd_msg_level & DHD_RPM_VAL) printf args;} while (0)
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#ifdef CUSTOMER_HW4_DEBUG
+#define DHD_TRACE_HW4  DHD_ERROR
+#define DHD_INFO_HW4   DHD_ERROR
+#define DHD_ERROR_NO_HW4       DHD_INFO
+#else
+#define DHD_TRACE_HW4  DHD_TRACE
+#define DHD_INFO_HW4   DHD_INFO
+#define DHD_ERROR_NO_HW4       DHD_ERROR
+#endif /* CUSTOMER_HW4_DEBUG */
+
+#define DHD_ERROR_ON()         (dhd_msg_level & DHD_ERROR_VAL)
+#define DHD_TRACE_ON()         (dhd_msg_level & DHD_TRACE_VAL)
+#define DHD_INFO_ON()          (dhd_msg_level & DHD_INFO_VAL)
+#define DHD_DATA_ON()          (dhd_msg_level & DHD_DATA_VAL)
+#define DHD_CTL_ON()           (dhd_msg_level & DHD_CTL_VAL)
+#define DHD_TIMER_ON()         (dhd_msg_level & DHD_TIMER_VAL)
+#define DHD_HDRS_ON()          (dhd_msg_level & DHD_HDRS_VAL)
+#define DHD_BYTES_ON()         (dhd_msg_level & DHD_BYTES_VAL)
+#define DHD_INTR_ON()          (dhd_msg_level & DHD_INTR_VAL)
+#define DHD_GLOM_ON()          (dhd_msg_level & DHD_GLOM_VAL)
+#define DHD_EVENT_ON()         (dhd_msg_level & DHD_EVENT_VAL)
+#define DHD_BTA_ON()           (dhd_msg_level & DHD_BTA_VAL)
+#define DHD_ISCAN_ON()         (dhd_msg_level & DHD_ISCAN_VAL)
+#define DHD_ARPOE_ON()         (dhd_msg_level & DHD_ARPOE_VAL)
+#define DHD_REORDER_ON()       (dhd_msg_level & DHD_REORDER_VAL)
+#define DHD_NOCHECKDIED_ON()   (dhd_msg_level & DHD_NOCHECKDIED_VAL)
+#define DHD_PNO_ON()           (dhd_msg_level & DHD_PNO_VAL)
+#define DHD_RTT_ON()           (dhd_msg_level & DHD_RTT_VAL)
+#define DHD_MSGTRACE_ON()      (dhd_msg_level & DHD_MSGTRACE_VAL)
+#define DHD_FWLOG_ON()         (dhd_msg_level & DHD_FWLOG_VAL)
+#define DHD_DBGIF_ON()         (dhd_msg_level & DHD_DBGIF_VAL)
+#define DHD_PKT_MON_ON()       (dhd_msg_level & DHD_PKT_MON_VAL)
+#define DHD_PKT_MON_DUMP_ON()  (dhd_msg_level & DHD_PKT_MON_DUMP_VAL)
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+#define DHD_RPM_ON()           (dhd_msg_level & DHD_RPM_VAL)
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#else /* defined(BCMDBG) || defined(DHD_DEBUG) */
+
+#define DHD_ERROR(args)                do {if (dhd_msg_level & DHD_ERROR_VAL) \
+                                                               printf args;} while (0)
+#define DHD_TRACE(args)
+#define DHD_INFO(args)
+
+#define DHD_DATA(args)
+#define DHD_CTL(args)
+#define DHD_TIMER(args)
+#define DHD_HDRS(args)
+#define DHD_BYTES(args)
+#define DHD_INTR(args)
+#define DHD_GLOM(args)
+
+#define DHD_EVENT(args)
+#define DHD_ECNTR_LOG(args)    DHD_EVENT(args)
+
+#define DHD_PRSRV_MEM(args)    DHD_EVENT(args)
+
+#define DHD_BTA(args)
+#define DHD_ISCAN(args)
+#define DHD_ARPOE(args)
+#define DHD_REORDER(args)
+#define DHD_PNO(args)
+#define DHD_RTT(args)
+#define DHD_PKT_MON(args)
+
+#define DHD_MSGTRACE_LOG(args)
+#define DHD_FWLOG(args)
+
+#define DHD_DBGIF(args)
+
+#define DHD_ERROR_MEM(args)    DHD_ERROR(args)
+#define DHD_IOVAR_MEM(args)    DHD_ERROR(args)
+#define DHD_LOG_MEM(args)      DHD_ERROR(args)
+#define DHD_ERROR_EX(args)     DHD_ERROR(args)
+
+#ifdef CUSTOMER_HW4_DEBUG
+#define DHD_TRACE_HW4  DHD_ERROR
+#define DHD_INFO_HW4   DHD_ERROR
+#define DHD_ERROR_NO_HW4       DHD_INFO
+#else
+#define DHD_TRACE_HW4  DHD_TRACE
+#define DHD_INFO_HW4   DHD_INFO
+#define DHD_ERROR_NO_HW4       DHD_ERROR
+#endif /* CUSTOMER_HW4_DEBUG */
+
+#define DHD_ERROR_ON()         0
+#define DHD_TRACE_ON()         0
+#define DHD_INFO_ON()          0
+#define DHD_DATA_ON()          0
+#define DHD_CTL_ON()           0
+#define DHD_TIMER_ON()         0
+#define DHD_HDRS_ON()          0
+#define DHD_BYTES_ON()         0
+#define DHD_INTR_ON()          0
+#define DHD_GLOM_ON()          0
+#define DHD_EVENT_ON()         0
+#define DHD_BTA_ON()           0
+#define DHD_ISCAN_ON()         0
+#define DHD_ARPOE_ON()         0
+#define DHD_REORDER_ON()       0
+#define DHD_NOCHECKDIED_ON()   0
+#define DHD_PNO_ON()           0
+#define DHD_RTT_ON()           0
+#define DHD_PKT_MON_ON()       0
+#define DHD_PKT_MON_DUMP_ON()  0
+#define DHD_MSGTRACE_ON()      0
+#define DHD_FWLOG_ON()         0
+#define DHD_DBGIF_ON()         0
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+#define DHD_RPM_ON()           0
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+#endif
+
+#define PRINT_RATE_LIMIT_PERIOD 5000000u /* 5s in units of us */
+#define DHD_ERROR_RLMT(args) \
+do {   \
+       if (dhd_msg_level & DHD_ERROR_VAL) {    \
+               static uint64 __err_ts = 0; \
+               static uint32 __err_cnt = 0; \
+               uint64 __cur_ts = 0; \
+               __cur_ts = OSL_SYSUPTIME_US(); \
+               if (__err_ts == 0 || (__cur_ts > __err_ts && \
+               (__cur_ts - __err_ts > PRINT_RATE_LIMIT_PERIOD))) { \
+                       __err_ts = __cur_ts; \
+                       DHD_ERROR(args);        \
+                       DHD_ERROR(("[Repeats %u times]\n", __err_cnt)); \
+                       __err_cnt = 0; \
+               } else { \
+                       ++__err_cnt; \
+               } \
+       }       \
+} while (0)
+
+/* even in non-BCMDBG builds, logging of dongle iovars should be available */
+#define DHD_DNGL_IOVAR_SET(args) \
+       do {if (dhd_msg_level & DHD_DNGL_IOVAR_SET_VAL) printf args;} while (0)
+
+#define DHD_LOG(args)
+
+#define DHD_BLOG(cp, size)
+
+#define DHD_NONE(args)
+extern int dhd_msg_level;
+#ifdef DHD_LOG_PRINT_RATE_LIMIT
+extern int log_print_threshold;
+#endif /* DHD_LOG_PRINT_RATE_LIMIT */
+
+/* Defines msg bits */
+#include <dhdioctl.h>
+
+#endif /* _dhd_dbg_ */
diff --git a/bcmdhd.101.10.240.x/dhd_dbg_ring.c b/bcmdhd.101.10.240.x/dhd_dbg_ring.c
new file mode 100644 (file)
index 0000000..909f163
--- /dev/null
@@ -0,0 +1,423 @@
+/*
+ * DHD debug ring API and structures - implementation
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <dhd_dbg_ring.h>
+
+int
+dhd_dbg_ring_init(dhd_pub_t *dhdp, dhd_dbg_ring_t *ring, uint16 id, uint8 *name,
+               uint32 ring_sz, void *allocd_buf, bool pull_inactive)
+{
+       void *buf;
+       unsigned long flags = 0;
+
+       if (allocd_buf == NULL) {
+                       return BCME_NOMEM;
+       } else {
+               buf = allocd_buf;
+       }
+
+       ring->lock = DHD_DBG_RING_LOCK_INIT(dhdp->osh);
+
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+       ring->id = id;
+       strlcpy((char *)ring->name, (char *)name, sizeof(ring->name));
+       ring->ring_size = ring_sz;
+       ring->wp = ring->rp = 0;
+       ring->ring_buf = buf;
+       ring->threshold = DBGRING_FLUSH_THRESHOLD(ring);
+       ring->state = RING_SUSPEND;
+       ring->rem_len = 0;
+       ring->sched_pull = TRUE;
+       ring->pull_inactive = pull_inactive;
+       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+
+       return BCME_OK;
+}
+
+void
+dhd_dbg_ring_deinit(dhd_pub_t *dhdp, dhd_dbg_ring_t *ring)
+{
+       unsigned long flags = 0;
+
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+       ring->id = 0;
+       ring->name[0] = 0;
+       ring->wp = ring->rp = 0;
+       memset(&ring->stat, 0, sizeof(ring->stat));
+       ring->threshold = 0;
+       ring->state = RING_STOP;
+       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+
+       DHD_DBG_RING_LOCK_DEINIT(dhdp->osh, ring->lock);
+}
+
+void
+dhd_dbg_ring_sched_pull(dhd_dbg_ring_t *ring, uint32 pending_len,
+               os_pullreq_t pull_fn, void *os_pvt, const int id)
+{
+       unsigned long flags = 0;
+
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+       /* if the current pending size is bigger than threshold and
+        * threshold is set
+        */
+       if (ring->threshold > 0 &&
+          (pending_len >= ring->threshold) && ring->sched_pull) {
+               /*
+                * Update the state and release the lock before calling
+                * the pull_fn. Do not transfer control to other layers
+                * with locks held. If the call back again calls into
+                * the same layer fro this context, can lead to deadlock.
+                */
+               ring->sched_pull = FALSE;
+               DHD_DBG_RING_UNLOCK(ring->lock, flags);
+               pull_fn(os_pvt, id);
+       } else {
+               DHD_DBG_RING_UNLOCK(ring->lock, flags);
+       }
+}
+
+uint32
+dhd_dbg_ring_get_pending_len(dhd_dbg_ring_t *ring)
+{
+       uint32 pending_len = 0;
+       unsigned long flags = 0;
+
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+       if (ring->stat.written_bytes > ring->stat.read_bytes) {
+               pending_len = ring->stat.written_bytes - ring->stat.read_bytes;
+       } else if (ring->stat.written_bytes < ring->stat.read_bytes) {
+               pending_len = PENDING_LEN_MAX - ring->stat.read_bytes + ring->stat.written_bytes;
+       } else {
+               pending_len = 0;
+       }
+       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+
+       return pending_len;
+}
+
+int
+dhd_dbg_ring_push(dhd_dbg_ring_t *ring, dhd_dbg_ring_entry_t *hdr, void *data)
+{
+       unsigned long flags;
+       uint32 w_len;
+       uint32 avail_size;
+       dhd_dbg_ring_entry_t *w_entry, *r_entry;
+
+       if (!ring || !hdr || !data) {
+               return BCME_BADARG;
+       }
+
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+
+       if (ring->state != RING_ACTIVE) {
+               DHD_DBG_RING_UNLOCK(ring->lock, flags);
+               return BCME_OK;
+       }
+
+       w_len = ENTRY_LENGTH(hdr);
+
+       DHD_DBGIF(("%s: RING%d[%s] hdr->len=%u, w_len=%u, wp=%d, rp=%d, ring_start=0x%p;"
+               " ring_size=%u\n",
+               __FUNCTION__, ring->id, ring->name, hdr->len, w_len, ring->wp, ring->rp,
+               ring->ring_buf, ring->ring_size));
+
+       if (w_len > ring->ring_size) {
+               DHD_DBG_RING_UNLOCK(ring->lock, flags);
+               DHD_ERROR(("%s: RING%d[%s] w_len=%u, ring_size=%u,"
+                       " write size exceeds ring size !\n",
+                       __FUNCTION__, ring->id, ring->name, w_len, ring->ring_size));
+               return BCME_ERROR;
+       }
+       /* Claim the space */
+       do {
+               avail_size = DBG_RING_CHECK_WRITE_SPACE(ring->rp, ring->wp, ring->ring_size);
+               if (avail_size <= w_len) {
+                       /* Prepare the space */
+                       if (ring->rp <= ring->wp) {
+                               ring->tail_padded = TRUE;
+                               ring->rem_len = ring->ring_size - ring->wp;
+                               DHD_DBGIF(("%s: RING%d[%s] Insuffient tail space,"
+                                       " rp=%d, wp=%d, rem_len=%d, ring_size=%d,"
+                                       " avail_size=%d, w_len=%d\n", __FUNCTION__,
+                                       ring->id, ring->name, ring->rp, ring->wp,
+                                       ring->rem_len, ring->ring_size, avail_size,
+                                       w_len));
+
+                               /* 0 pad insufficient tail space */
+                               memset((uint8 *)ring->ring_buf + ring->wp, 0, ring->rem_len);
+                               /* If read pointer is still at the beginning, make some room */
+                               if (ring->rp == 0) {
+                                       r_entry = (dhd_dbg_ring_entry_t *)((uint8 *)ring->ring_buf +
+                                               ring->rp);
+                                       ring->rp += ENTRY_LENGTH(r_entry);
+                                       ring->stat.read_bytes += ENTRY_LENGTH(r_entry);
+                                       DHD_DBGIF(("%s: rp at 0, move by one entry length"
+                                               " (%u bytes)\n",
+                                               __FUNCTION__, (uint32)ENTRY_LENGTH(r_entry)));
+                               }
+                               if (ring->rp == ring->wp) {
+                                       ring->rp = 0;
+                               }
+                               ring->wp = 0;
+                               DHD_DBGIF(("%s: new rp=%u, wp=%u\n",
+                                       __FUNCTION__, ring->rp, ring->wp));
+                       } else {
+                               /* Not enough space for new entry, free some up */
+                               r_entry = (dhd_dbg_ring_entry_t *)((uint8 *)ring->ring_buf +
+                                       ring->rp);
+                               /* check bounds before incrementing read ptr */
+                               if (ring->rp + ENTRY_LENGTH(r_entry) >= ring->ring_size) {
+                                       DHD_ERROR(("%s: RING%d[%s] rp points out of boundary,"
+                                               "ring->wp=%u, ring->rp=%u, ring->ring_size=%d\n",
+                                               __FUNCTION__, ring->id, ring->name, ring->wp,
+                                               ring->rp, ring->ring_size));
+                                       ASSERT(0);
+                                       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+                                       return BCME_BUFTOOSHORT;
+                               }
+                               ring->rp += ENTRY_LENGTH(r_entry);
+                               /* skip padding if there is one */
+                               if (ring->tail_padded &&
+                                       ((ring->rp + ring->rem_len) == ring->ring_size)) {
+                                       DHD_DBGIF(("%s: RING%d[%s] Found padding,"
+                                               " avail_size=%d, w_len=%d, set rp = 0\n",
+                                               __FUNCTION__,
+                                               ring->id, ring->name, avail_size, w_len));
+                                       ring->rp = 0;
+                                       ring->tail_padded = FALSE;
+                                       ring->rem_len = 0;
+                               }
+                               ring->stat.read_bytes += ENTRY_LENGTH(r_entry);
+                               DHD_DBGIF(("%s: RING%d[%s] read_bytes=%d, wp=%d, rp=%d\n",
+                                       __FUNCTION__, ring->id, ring->name, ring->stat.read_bytes,
+                                       ring->wp, ring->rp));
+                       }
+               } else {
+                       break;
+               }
+       } while (TRUE);
+
+       /* check before writing to the ring */
+       if (ring->wp + w_len >= ring->ring_size) {
+               DHD_ERROR(("%s: RING%d[%s] wp pointed out of ring boundary, "
+                       "wp=%d, ring_size=%d, w_len=%u\n", __FUNCTION__, ring->id,
+                       ring->name, ring->wp, ring->ring_size, w_len));
+               ASSERT(0);
+               DHD_DBG_RING_UNLOCK(ring->lock, flags);
+               return BCME_BUFTOOLONG;
+       }
+
+       w_entry = (dhd_dbg_ring_entry_t *)((uint8 *)ring->ring_buf + ring->wp);
+       /* header */
+       memcpy(w_entry, hdr, DBG_RING_ENTRY_SIZE);
+       w_entry->len = hdr->len;
+       /* payload */
+       memcpy((char *)w_entry + DBG_RING_ENTRY_SIZE, data, w_entry->len);
+       /* update write pointer */
+       ring->wp += w_len;
+
+       /* update statistics */
+       ring->stat.written_records++;
+       ring->stat.written_bytes += w_len;
+       DHD_DBGIF(("%s : RING%d[%s] written_records %d, written_bytes %d, read_bytes=%d,"
+               " ring->threshold=%d, wp=%d, rp=%d\n", __FUNCTION__, ring->id, ring->name,
+               ring->stat.written_records, ring->stat.written_bytes, ring->stat.read_bytes,
+               ring->threshold, ring->wp, ring->rp));
+
+       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+       return BCME_OK;
+}
+
+/*
+ * This function folds ring->lock, so callers of this function
+ * should not hold ring->lock.
+ */
+int
+dhd_dbg_ring_pull_single(dhd_dbg_ring_t *ring, void *data, uint32 buf_len, bool strip_header)
+{
+       dhd_dbg_ring_entry_t *r_entry = NULL;
+       uint32 rlen = 0;
+       char *buf = NULL;
+       unsigned long flags;
+
+       if (!ring || !data || buf_len <= 0) {
+               return 0;
+       }
+
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+
+       /* pull from ring is allowed for inactive (suspended) ring
+        * in case of ecounters only, this is because, for ecounters
+        * when a trap occurs the ring is suspended and data is then
+        * pulled to dump it to a file. For other rings if ring is
+        * not in active state return without processing (as before)
+        */
+       if (!ring->pull_inactive && (ring->state != RING_ACTIVE)) {
+               goto exit;
+       }
+
+       if (ring->rp == ring->wp) {
+               goto exit;
+       }
+
+       DHD_DBGIF(("%s: RING%d[%s] buf_len=%u, wp=%d, rp=%d, ring_start=0x%p; ring_size=%u\n",
+               __FUNCTION__, ring->id, ring->name, buf_len, ring->wp, ring->rp,
+               ring->ring_buf, ring->ring_size));
+
+       r_entry = (dhd_dbg_ring_entry_t *)((uint8 *)ring->ring_buf + ring->rp);
+
+       /* Boundary Check */
+       rlen = ENTRY_LENGTH(r_entry);
+       if ((ring->rp + rlen) > ring->ring_size) {
+               DHD_ERROR(("%s: entry len %d is out of boundary of ring size %d,"
+                       " current ring %d[%s] - rp=%d\n", __FUNCTION__, rlen,
+                       ring->ring_size, ring->id, ring->name, ring->rp));
+               rlen = 0;
+               goto exit;
+       }
+
+       if (strip_header) {
+               rlen = r_entry->len;
+               buf = (char *)r_entry + DBG_RING_ENTRY_SIZE;
+       } else {
+               rlen = ENTRY_LENGTH(r_entry);
+               buf = (char *)r_entry;
+       }
+       if (rlen > buf_len) {
+               DHD_ERROR(("%s: buf len %d is too small for entry len %d\n",
+                       __FUNCTION__, buf_len, rlen));
+               DHD_ERROR(("%s: ring %d[%s] - ring size=%d, wp=%d, rp=%d\n",
+                       __FUNCTION__, ring->id, ring->name, ring->ring_size,
+                       ring->wp, ring->rp));
+               ASSERT(0);
+               rlen = 0;
+               goto exit;
+       }
+
+       memcpy(data, buf, rlen);
+       /* update ring context */
+       ring->rp += ENTRY_LENGTH(r_entry);
+       /* don't pass wp but skip padding if there is one */
+       if (ring->rp != ring->wp &&
+           ring->tail_padded && ((ring->rp + ring->rem_len) >= ring->ring_size)) {
+               DHD_DBGIF(("%s: RING%d[%s] Found padding, rp=%d, wp=%d\n",
+                       __FUNCTION__, ring->id, ring->name, ring->rp, ring->wp));
+               ring->rp = 0;
+               ring->tail_padded = FALSE;
+               ring->rem_len = 0;
+       }
+       if (ring->rp >= ring->ring_size) {
+               DHD_ERROR(("%s: RING%d[%s] rp pointed out of ring boundary,"
+                       " rp=%d, ring_size=%d\n", __FUNCTION__, ring->id,
+                       ring->name, ring->rp, ring->ring_size));
+               ASSERT(0);
+               rlen = 0;
+               goto exit;
+       }
+       ring->stat.read_bytes += ENTRY_LENGTH(r_entry);
+       DHD_DBGIF(("%s RING%d[%s]read_bytes %d, wp=%d, rp=%d\n", __FUNCTION__,
+               ring->id, ring->name, ring->stat.read_bytes, ring->wp, ring->rp));
+
+exit:
+       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+
+       return rlen;
+}
+
+int
+dhd_dbg_ring_pull(dhd_dbg_ring_t *ring, void *data, uint32 buf_len, bool strip_hdr)
+{
+       int32 r_len, total_r_len = 0;
+       unsigned long flags;
+
+       if (!ring || !data)
+               return 0;
+
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+       if (!ring->pull_inactive && (ring->state != RING_ACTIVE)) {
+               DHD_DBG_RING_UNLOCK(ring->lock, flags);
+               return 0;
+       }
+       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+
+       while (buf_len > 0) {
+               r_len = dhd_dbg_ring_pull_single(ring, data, buf_len, strip_hdr);
+               if (r_len == 0)
+                       break;
+               data = (uint8 *)data + r_len;
+               buf_len -= r_len;
+               total_r_len += r_len;
+       }
+
+       return total_r_len;
+}
+
+int
+dhd_dbg_ring_config(dhd_dbg_ring_t *ring, int log_level, uint32 threshold)
+{
+       unsigned long flags = 0;
+
+       if (!ring)
+               return BCME_BADADDR;
+
+       if (ring->state == RING_STOP)
+               return BCME_UNSUPPORTED;
+
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+
+       if (log_level == 0)
+               ring->state = RING_SUSPEND;
+       else
+               ring->state = RING_ACTIVE;
+
+       ring->log_level = log_level;
+       ring->threshold = MIN(threshold, DBGRING_FLUSH_THRESHOLD(ring));
+
+       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+
+       return BCME_OK;
+}
+
+void
+dhd_dbg_ring_start(dhd_dbg_ring_t *ring)
+{
+       if (!ring)
+               return;
+
+       /* Initialize the information for the ring */
+       ring->state = RING_SUSPEND;
+       ring->log_level = 0;
+       ring->rp = ring->wp = 0;
+       ring->threshold = 0;
+       memset(&ring->stat, 0, sizeof(struct ring_statistics));
+       memset(ring->ring_buf, 0, ring->ring_size);
+}
diff --git a/bcmdhd.101.10.240.x/dhd_dbg_ring.h b/bcmdhd.101.10.240.x/dhd_dbg_ring.h
new file mode 100644 (file)
index 0000000..8245056
--- /dev/null
@@ -0,0 +1,137 @@
+/*
+ * DHD debug ring header file - interface
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef __DHD_DBG_RING_H__
+#define __DHD_DBG_RING_H__
+
+#include <bcmutils.h>
+
+#define PACKED_STRUCT __attribute__ ((packed))
+
+#define DBGRING_NAME_MAX 32
+
+enum dbg_ring_state {
+       RING_STOP = 0,  /* ring is not initialized */
+       RING_ACTIVE,    /* ring is live and logging */
+       RING_SUSPEND    /* ring is initialized but not logging */
+};
+
+/* each entry in dbg ring has below header, to handle
+ * variable length records in ring
+ */
+typedef struct dhd_dbg_ring_entry {
+       uint16 len; /* payload length excluding the header */
+       uint8 flags;
+       uint8 type; /* Per ring specific */
+       uint64 timestamp; /* present if has_timestamp bit is set. */
+} PACKED_STRUCT dhd_dbg_ring_entry_t;
+
+struct ring_statistics {
+       /* number of bytes that was written to the buffer by driver */
+       uint32 written_bytes;
+       /* number of bytes that was read from the buffer by user land */
+       uint32 read_bytes;
+       /* number of records that was written to the buffer by driver */
+       uint32 written_records;
+};
+
+typedef struct dhd_dbg_ring_status {
+       uint8 name[DBGRING_NAME_MAX];
+       uint32 flags;
+       int ring_id; /* unique integer representing the ring */
+       /* total memory size allocated for the buffer */
+       uint32 ring_buffer_byte_size;
+       uint32 verbose_level;
+       /* number of bytes that was written to the buffer by driver */
+       uint32 written_bytes;
+       /* number of bytes that was read from the buffer by user land */
+       uint32 read_bytes;
+       /* number of records that was read from the buffer by user land */
+       uint32 written_records;
+} dhd_dbg_ring_status_t;
+
+typedef struct dhd_dbg_ring {
+       int     id;             /* ring id */
+       uint8   name[DBGRING_NAME_MAX]; /* name string */
+       uint32  ring_size;      /* numbers of item in ring */
+       uint32  wp;             /* write pointer */
+       uint32  rp;             /* read pointer */
+       uint32  rp_tmp;         /* tmp read pointer */
+       uint32  log_level;      /* log_level */
+       uint32  threshold;      /* threshold bytes */
+       void *  ring_buf;       /* pointer of actually ring buffer */
+       void *  lock;           /* lock for ring access */
+       struct ring_statistics stat;    /* statistics */
+       enum dbg_ring_state state;      /* ring state enum */
+       bool tail_padded;       /* writer does not have enough space */
+       uint32 rem_len;         /* number of bytes from wp_pad to end */
+       bool sched_pull;        /* schedule reader immediately */
+       bool pull_inactive;     /* pull contents from ring even if it is inactive */
+} dhd_dbg_ring_t;
+
+#define DBGRING_FLUSH_THRESHOLD(ring)          (ring->ring_size / 3)
+#define RING_STAT_TO_STATUS(ring, status) \
+       do { \
+               /* status.name/ring->name are the same length so no need to check return value */ \
+               (void)memcpy_s(status.name, sizeof(status.name), ring->name, sizeof(ring->name)); \
+               status.ring_id = ring->id;     \
+               status.ring_buffer_byte_size = ring->ring_size;  \
+               status.written_bytes = ring->stat.written_bytes; \
+               status.written_records = ring->stat.written_records; \
+               status.read_bytes = ring->stat.read_bytes; \
+               status.verbose_level = ring->log_level; \
+       } while (0)
+
+#define DBG_RING_ENTRY_SIZE (sizeof(dhd_dbg_ring_entry_t))
+#define ENTRY_LENGTH(hdr) ((hdr)->len + DBG_RING_ENTRY_SIZE)
+#define PAYLOAD_MAX_LEN 65535
+#define PAYLOAD_ECNTR_MAX_LEN 1648u
+#define PAYLOAD_RTT_MAX_LEN 1648u
+#define PENDING_LEN_MAX 0xFFFFFFFF
+#define DBG_RING_STATUS_SIZE (sizeof(dhd_dbg_ring_status_t))
+
+#define TXACTIVESZ(r, w, d)                    (((r) <= (w)) ? ((w) - (r)) : ((d) - (r) + (w)))
+#define DBG_RING_READ_AVAIL_SPACE(w, r, d)             (((w) >= (r)) ? ((w) - (r)) : ((d) - (r)))
+#define DBG_RING_WRITE_SPACE_AVAIL_CONT(r, w, d)       (((w) >= (r)) ? ((d) - (w)) : ((r) - (w)))
+#define DBG_RING_WRITE_SPACE_AVAIL(r, w, d)            (d - (TXACTIVESZ(r, w, d)))
+#define DBG_RING_CHECK_WRITE_SPACE(r, w, d)            \
+               MIN(DBG_RING_WRITE_SPACE_AVAIL(r, w, d), DBG_RING_WRITE_SPACE_AVAIL_CONT(r, w, d))
+
+typedef void (*os_pullreq_t)(void *os_priv, const int ring_id);
+
+int dhd_dbg_ring_init(dhd_pub_t *dhdp, dhd_dbg_ring_t *ring, uint16 id, uint8 *name,
+               uint32 ring_sz, void *allocd_buf, bool pull_inactive);
+void dhd_dbg_ring_deinit(dhd_pub_t *dhdp, dhd_dbg_ring_t *ring);
+int dhd_dbg_ring_push(dhd_dbg_ring_t *ring, dhd_dbg_ring_entry_t *hdr, void *data);
+int dhd_dbg_ring_pull(dhd_dbg_ring_t *ring, void *data, uint32 buf_len,
+               bool strip_hdr);
+int dhd_dbg_ring_pull_single(dhd_dbg_ring_t *ring, void *data, uint32 buf_len,
+       bool strip_header);
+uint32 dhd_dbg_ring_get_pending_len(dhd_dbg_ring_t *ring);
+void dhd_dbg_ring_sched_pull(dhd_dbg_ring_t *ring, uint32 pending_len,
+               os_pullreq_t pull_fn, void *os_pvt, const int id);
+int dhd_dbg_ring_config(dhd_dbg_ring_t *ring, int log_level, uint32 threshold);
+void dhd_dbg_ring_start(dhd_dbg_ring_t *ring);
+#endif /* __DHD_DBG_RING_H__ */
diff --git a/bcmdhd.101.10.240.x/dhd_debug.c b/bcmdhd.101.10.240.x/dhd_debug.c
new file mode 100644 (file)
index 0000000..6875232
--- /dev/null
@@ -0,0 +1,2703 @@
+/*
+ * DHD debugability support
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <dhd_dbg_ring.h>
+#include <dhd_debug.h>
+#include <dhd_mschdbg.h>
+#include <dhd_bus.h>
+
+#include <event_log.h>
+#include <event_trace.h>
+#include <msgtrace.h>
+
+#if defined(DHD_EVENT_LOG_FILTER)
+#include <dhd_event_log_filter.h>
+#endif /* DHD_EVENT_LOG_FILTER */
+
+uint8 control_logtrace = CUSTOM_CONTROL_LOGTRACE;
+
+struct map_table {
+       uint16 fw_id;
+       uint16 host_id;
+       char *desc;
+};
+
+struct map_table event_map[] = {
+       {WLC_E_AUTH, WIFI_EVENT_AUTH_COMPLETE, "AUTH_COMPLETE"},
+       {WLC_E_ASSOC, WIFI_EVENT_ASSOC_COMPLETE, "ASSOC_COMPLETE"},
+       {TRACE_FW_AUTH_STARTED, WIFI_EVENT_FW_AUTH_STARTED, "AUTH STARTED"},
+       {TRACE_FW_ASSOC_STARTED, WIFI_EVENT_FW_ASSOC_STARTED, "ASSOC STARTED"},
+       {TRACE_FW_RE_ASSOC_STARTED, WIFI_EVENT_FW_RE_ASSOC_STARTED, "REASSOC STARTED"},
+       {TRACE_G_SCAN_STARTED, WIFI_EVENT_G_SCAN_STARTED, "GSCAN STARTED"},
+       {WLC_E_PFN_SCAN_COMPLETE, WIFI_EVENT_G_SCAN_COMPLETE, "GSCAN COMPLETE"},
+       {WLC_E_DISASSOC, WIFI_EVENT_DISASSOCIATION_REQUESTED, "DIASSOC REQUESTED"},
+       {WLC_E_REASSOC, WIFI_EVENT_RE_ASSOCIATION_REQUESTED, "REASSOC REQUESTED"},
+       {TRACE_ROAM_SCAN_STARTED, WIFI_EVENT_ROAM_REQUESTED, "ROAM REQUESTED"},
+       {WLC_E_BEACON_FRAME_RX, WIFI_EVENT_BEACON_RECEIVED, "BEACON Received"},
+       {TRACE_ROAM_SCAN_STARTED, WIFI_EVENT_ROAM_SCAN_STARTED, "ROAM SCAN STARTED"},
+       {TRACE_ROAM_SCAN_COMPLETE, WIFI_EVENT_ROAM_SCAN_COMPLETE, "ROAM SCAN COMPLETED"},
+       {TRACE_ROAM_AUTH_STARTED, WIFI_EVENT_ROAM_AUTH_STARTED, "ROAM AUTH STARTED"},
+       {WLC_E_AUTH, WIFI_EVENT_ROAM_AUTH_COMPLETE, "ROAM AUTH COMPLETED"},
+       {TRACE_FW_RE_ASSOC_STARTED, WIFI_EVENT_ROAM_ASSOC_STARTED, "ROAM ASSOC STARTED"},
+       {WLC_E_ASSOC, WIFI_EVENT_ROAM_ASSOC_COMPLETE, "ROAM ASSOC COMPLETED"},
+       {TRACE_ROAM_SCAN_COMPLETE, WIFI_EVENT_ROAM_SCAN_COMPLETE, "ROAM SCAN COMPLETED"},
+       {TRACE_BT_COEX_BT_SCO_START, WIFI_EVENT_BT_COEX_BT_SCO_START, "BT SCO START"},
+       {TRACE_BT_COEX_BT_SCO_STOP, WIFI_EVENT_BT_COEX_BT_SCO_STOP, "BT SCO STOP"},
+       {TRACE_BT_COEX_BT_SCAN_START, WIFI_EVENT_BT_COEX_BT_SCAN_START, "BT COEX SCAN START"},
+       {TRACE_BT_COEX_BT_SCAN_STOP, WIFI_EVENT_BT_COEX_BT_SCAN_STOP, "BT COEX SCAN STOP"},
+       {TRACE_BT_COEX_BT_HID_START, WIFI_EVENT_BT_COEX_BT_HID_START, "BT HID START"},
+       {TRACE_BT_COEX_BT_HID_STOP, WIFI_EVENT_BT_COEX_BT_HID_STOP, "BT HID STOP"},
+       {WLC_E_EAPOL_MSG, WIFI_EVENT_FW_EAPOL_FRAME_RECEIVED, "FW EAPOL PKT RECEIVED"},
+       {TRACE_FW_EAPOL_FRAME_TRANSMIT_START, WIFI_EVENT_FW_EAPOL_FRAME_TRANSMIT_START,
+       "FW EAPOL PKT TRANSMITED"},
+       {TRACE_FW_EAPOL_FRAME_TRANSMIT_STOP, WIFI_EVENT_FW_EAPOL_FRAME_TRANSMIT_STOP,
+       "FW EAPOL PKT TX STOPPED"},
+       {TRACE_BLOCK_ACK_NEGOTIATION_COMPLETE, WIFI_EVENT_BLOCK_ACK_NEGOTIATION_COMPLETE,
+       "BLOCK ACK NEGO COMPLETED"},
+};
+
+struct map_table event_tag_map[] = {
+       {TRACE_TAG_VENDOR_SPECIFIC, WIFI_TAG_VENDOR_SPECIFIC, "VENDOR SPECIFIC DATA"},
+       {TRACE_TAG_BSSID, WIFI_TAG_BSSID, "BSSID"},
+       {TRACE_TAG_ADDR, WIFI_TAG_ADDR, "ADDR_0"},
+       {TRACE_TAG_SSID, WIFI_TAG_SSID, "SSID"},
+       {TRACE_TAG_STATUS, WIFI_TAG_STATUS, "STATUS"},
+       {TRACE_TAG_CHANNEL_SPEC, WIFI_TAG_CHANNEL_SPEC, "CHANSPEC"},
+       {TRACE_TAG_WAKE_LOCK_EVENT, WIFI_TAG_WAKE_LOCK_EVENT, "WAKELOCK EVENT"},
+       {TRACE_TAG_ADDR1, WIFI_TAG_ADDR1, "ADDR_1"},
+       {TRACE_TAG_ADDR2, WIFI_TAG_ADDR2, "ADDR_2"},
+       {TRACE_TAG_ADDR3, WIFI_TAG_ADDR3, "ADDR_3"},
+       {TRACE_TAG_ADDR4, WIFI_TAG_ADDR4, "ADDR_4"},
+       {TRACE_TAG_TSF, WIFI_TAG_TSF, "TSF"},
+       {TRACE_TAG_IE, WIFI_TAG_IE, "802.11 IE"},
+       {TRACE_TAG_INTERFACE, WIFI_TAG_INTERFACE, "INTERFACE"},
+       {TRACE_TAG_REASON_CODE, WIFI_TAG_REASON_CODE, "REASON CODE"},
+       {TRACE_TAG_RATE_MBPS, WIFI_TAG_RATE_MBPS, "RATE"},
+};
+
+/* define log level per ring type */
+struct log_level_table fw_verbose_level_map[] = {
+       {1, EVENT_LOG_TAG_PCI_ERROR, "PCI_ERROR"},
+       {1, EVENT_LOG_TAG_PCI_WARN, "PCI_WARN"},
+       {2, EVENT_LOG_TAG_PCI_INFO, "PCI_INFO"},
+       {3, EVENT_LOG_TAG_PCI_DBG, "PCI_DEBUG"},
+       {3, EVENT_LOG_TAG_BEACON_LOG, "BEACON_LOG"},
+       {2, EVENT_LOG_TAG_WL_ASSOC_LOG, "ASSOC_LOG"},
+       {2, EVENT_LOG_TAG_WL_ROAM_LOG, "ROAM_LOG"},
+       {1, EVENT_LOG_TAG_TRACE_WL_INFO, "WL INFO"},
+       {1, EVENT_LOG_TAG_TRACE_BTCOEX_INFO, "BTCOEX INFO"},
+#ifdef CUSTOMER_HW4_DEBUG
+       {3, EVENT_LOG_TAG_SCAN_WARN, "SCAN_WARN"},
+#else
+       {1, EVENT_LOG_TAG_SCAN_WARN, "SCAN_WARN"},
+#endif /* CUSTOMER_HW4_DEBUG */
+       {1, EVENT_LOG_TAG_SCAN_ERROR, "SCAN_ERROR"},
+       {2, EVENT_LOG_TAG_SCAN_TRACE_LOW, "SCAN_TRACE_LOW"},
+       {2, EVENT_LOG_TAG_SCAN_TRACE_HIGH, "SCAN_TRACE_HIGH"}
+};
+
+/* reference tab table */
+uint ref_tag_tbl[EVENT_LOG_TAG_MAX + 1] = {0};
+
+typedef struct dhddbg_loglist_item {
+       dll_t list;
+       prcd_event_log_hdr_t prcd_log_hdr;
+} loglist_item_t;
+
+typedef struct dhbdbg_pending_item {
+       dll_t list;
+       dhd_dbg_ring_status_t ring_status;
+       dhd_dbg_ring_entry_t *ring_entry;
+} pending_item_t;
+
+/* trace log entry header user space processing */
+struct tracelog_header {
+       int magic_num;
+       int buf_size;
+       int seq_num;
+};
+#define TRACE_LOG_MAGIC_NUMBER 0xEAE47C06
+
+int
+dhd_dbg_push_to_ring(dhd_pub_t *dhdp, int ring_id, dhd_dbg_ring_entry_t *hdr, void *data)
+{
+       dhd_dbg_ring_t *ring;
+       int ret = 0;
+       uint32 pending_len = 0;
+
+       if (!dhdp || !dhdp->dbg) {
+               return BCME_BADADDR;
+       }
+
+       if (!VALID_RING(ring_id)) {
+               DHD_ERROR(("%s : invalid ring_id : %d\n", __FUNCTION__, ring_id));
+               return BCME_RANGE;
+       }
+
+       ring = &dhdp->dbg->dbg_rings[ring_id];
+
+       ret = dhd_dbg_ring_push(ring, hdr, data);
+       if (ret != BCME_OK)
+               return ret;
+
+       pending_len = dhd_dbg_ring_get_pending_len(ring);
+       dhd_dbg_ring_sched_pull(ring, pending_len, dhdp->dbg->pullreq,
+                       dhdp->dbg->private, ring->id);
+
+       return ret;
+}
+
+dhd_dbg_ring_t *
+dhd_dbg_get_ring_from_ring_id(dhd_pub_t *dhdp, int ring_id)
+{
+       if (!dhdp || !dhdp->dbg) {
+               return NULL;
+       }
+
+       if (!VALID_RING(ring_id)) {
+               DHD_ERROR(("%s : invalid ring_id : %d\n", __FUNCTION__, ring_id));
+               return NULL;
+       }
+
+       return &dhdp->dbg->dbg_rings[ring_id];
+}
+
+int
+dhd_dbg_pull_single_from_ring(dhd_pub_t *dhdp, int ring_id, void *data, uint32 buf_len,
+       bool strip_header)
+{
+       dhd_dbg_ring_t *ring;
+
+       if (!dhdp || !dhdp->dbg) {
+               return 0;
+       }
+
+       if (!VALID_RING(ring_id)) {
+               DHD_ERROR(("%s : invalid ring_id : %d\n", __FUNCTION__, ring_id));
+               return BCME_RANGE;
+       }
+
+       ring = &dhdp->dbg->dbg_rings[ring_id];
+
+       return dhd_dbg_ring_pull_single(ring, data, buf_len, strip_header);
+}
+
+int
+dhd_dbg_pull_from_ring(dhd_pub_t *dhdp, int ring_id, void *data, uint32 buf_len)
+{
+       dhd_dbg_ring_t *ring;
+
+       if (!dhdp || !dhdp->dbg)
+               return 0;
+       if (!VALID_RING(ring_id)) {
+               DHD_ERROR(("%s : invalid ring_id : %d\n", __FUNCTION__, ring_id));
+               return BCME_RANGE;
+       }
+       ring = &dhdp->dbg->dbg_rings[ring_id];
+       return dhd_dbg_ring_pull(ring, data, buf_len, FALSE);
+}
+
+static int
+dhd_dbg_msgtrace_seqchk(uint32 *prev, uint32 cur)
+{
+       /* normal case including wrap around */
+       if ((cur == 0 && *prev == 0xFFFFFFFF) || ((cur - *prev) == 1)) {
+               goto done;
+       } else if (cur == *prev) {
+               DHD_EVENT(("%s duplicate trace\n", __FUNCTION__));
+               return -1;
+       } else if (cur > *prev) {
+               DHD_EVENT(("%s lost %d packets\n", __FUNCTION__, cur - *prev));
+       } else {
+               DHD_EVENT(("%s seq out of order, dhd %d, dongle %d\n",
+                       __FUNCTION__, *prev, cur));
+       }
+done:
+       *prev = cur;
+       return 0;
+}
+
+static void
+dhd_dbg_msgtrace_msg_parser(void *event_data)
+{
+       msgtrace_hdr_t *hdr;
+       char *data, *s;
+       static uint32 seqnum_prev = 0;
+
+       if (!event_data) {
+               DHD_ERROR(("%s: event_data is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       hdr = (msgtrace_hdr_t *)event_data;
+       data = (char *)event_data + MSGTRACE_HDRLEN;
+
+       /* There are 2 bytes available at the end of data */
+       data[ntoh16(hdr->len)] = '\0';
+
+       if (ntoh32(hdr->discarded_bytes) || ntoh32(hdr->discarded_printf)) {
+               DHD_DBGIF(("WLC_E_TRACE: [Discarded traces in dongle -->"
+                       "discarded_bytes %d discarded_printf %d]\n",
+                       ntoh32(hdr->discarded_bytes),
+                       ntoh32(hdr->discarded_printf)));
+       }
+
+       if (dhd_dbg_msgtrace_seqchk(&seqnum_prev, ntoh32(hdr->seqnum)))
+               return;
+
+       /* Display the trace buffer. Advance from
+        * \n to \n to avoid display big
+        * printf (issue with Linux printk )
+        */
+       while (*data != '\0' && (s = strstr(data, "\n")) != NULL) {
+               *s = '\0';
+               DHD_FWLOG(("[FWLOG] %s\n", data));
+               data = s+1;
+       }
+       if (*data)
+               DHD_FWLOG(("[FWLOG] %s", data));
+}
+#ifdef SHOW_LOGTRACE
+#define DATA_UNIT_FOR_LOG_CNT 4
+
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+
+int
+replace_percent_p_to_x(char *fmt)
+{
+       int p_to_x_done = FALSE;
+
+       while (*fmt != '\0')
+       {
+               /* Skip characters will we see a % */
+               if (*fmt++ != '%')
+               {
+                       continue;
+               }
+
+               /*
+                * Skip any flags, field width and precision:
+                *Flags: Followed by %
+                * #, 0, -, ' ', +
+                */
+               if (*fmt == '#')
+                       fmt++;
+
+               if (*fmt == '0' || *fmt == '-' || *fmt == '+')
+                       fmt++;
+
+               /*
+                * Field width:
+                * An optional decimal digit string (with non-zero first digit)
+                * specifying a minimum field width
+                */
+               while (*fmt && bcm_isdigit(*fmt))
+                       fmt++;
+
+               /*
+                * Precision:
+                * An optional precision, in the form of a period ('.')  followed by an
+                * optional decimal digit string.
+                */
+               if (*fmt == '.')
+               {
+                       fmt++;
+                       while (*fmt && bcm_isdigit(*fmt)) fmt++;
+               }
+
+               /* If %p is seen, change it to %x */
+               if (*fmt == 'p')
+               {
+                       *fmt = 'x';
+                       p_to_x_done = TRUE;
+               }
+               if (*fmt)
+                       fmt++;
+       }
+
+       return p_to_x_done;
+}
+
+/* To identify format of types %Ns where N >= 0 is a number */
+bool
+check_valid_string_format(char *curr_ptr)
+{
+       char *next_ptr;
+       if ((next_ptr = bcmstrstr(curr_ptr, "s")) != NULL) {
+               /* Default %s format */
+               if (curr_ptr == next_ptr) {
+                       return TRUE;
+               }
+
+               /* Verify each charater between '%' and 's' is a valid number */
+               while (curr_ptr < next_ptr) {
+                       if (bcm_isdigit(*curr_ptr) == FALSE) {
+                               return FALSE;
+                       }
+                       curr_ptr++;
+               }
+
+               return TRUE;
+       } else {
+               return FALSE;
+       }
+}
+
+/* To identify format of non string format types */
+bool
+check_valid_non_string_format(char *curr_ptr)
+{
+       char *next_ptr;
+       char *next_fmt_stptr;
+       char valid_fmt_types[17] = {'d', 'i', 'x', 'X', 'c', 'p', 'u',
+                       'f', 'F', 'e', 'E', 'g', 'G', 'o',
+                       'a', 'A', 'n'};
+       int i;
+       bool valid = FALSE;
+
+       /* Check for next % in the fmt str */
+       next_fmt_stptr = bcmstrstr(curr_ptr, "%");
+
+       for (next_ptr = curr_ptr; *next_ptr != '\0'; next_ptr++) {
+               for (i = 0; i < (int)((sizeof(valid_fmt_types))/sizeof(valid_fmt_types[0])); i++) {
+                       if (*next_ptr == valid_fmt_types[i]) {
+                               /* Check whether format type found corresponds to current %
+                                * and not the next one, if exists.
+                                */
+                               if ((next_fmt_stptr == NULL) ||
+                                               (next_fmt_stptr && (next_ptr < next_fmt_stptr))) {
+                                       /* Not validating for length/width fields in
+                                        * format specifier.
+                                        */
+                                       valid = TRUE;
+                               }
+                               goto done;
+                       }
+               }
+       }
+
+done:
+       return valid;
+}
+
+#define MAX_NO_OF_ARG  16
+#define FMTSTR_SIZE    200
+#define ROMSTR_SIZE    268
+#define SIZE_LOC_STR   50
+#define LOG_PRINT_CNT_MAX      16u
+#define EL_MSEC_PER_SEC        1000
+#ifdef DHD_LOG_PRINT_RATE_LIMIT
+#define MAX_LOG_PRINT_COUNT 100u
+#define LOG_PRINT_THRESH (1u * USEC_PER_SEC)
+#endif
+#define EL_PARSE_VER   "V02"
+static uint64 verboselog_ts_saved = 0;
+
+bool
+dhd_dbg_process_event_log_hdr(event_log_hdr_t *log_hdr, prcd_event_log_hdr_t *prcd_log_hdr)
+{
+       event_log_extended_hdr_t *ext_log_hdr;
+       uint16 event_log_fmt_num;
+       uint8 event_log_hdr_type;
+
+       /* Identify the type of event tag, payload type etc..  */
+       event_log_hdr_type = log_hdr->fmt_num & DHD_EVENT_LOG_HDR_MASK;
+       event_log_fmt_num = (log_hdr->fmt_num >> DHD_EVENT_LOG_FMT_NUM_OFFSET) &
+               DHD_EVENT_LOG_FMT_NUM_MASK;
+
+       switch (event_log_hdr_type) {
+               case DHD_OW_NB_EVENT_LOG_HDR:
+                       prcd_log_hdr->ext_event_log_hdr = FALSE;
+                       prcd_log_hdr->binary_payload = FALSE;
+                       break;
+               case DHD_TW_NB_EVENT_LOG_HDR:
+                       prcd_log_hdr->ext_event_log_hdr = TRUE;
+                       prcd_log_hdr->binary_payload = FALSE;
+                       break;
+               case DHD_BI_EVENT_LOG_HDR:
+                       if (event_log_fmt_num == DHD_OW_BI_EVENT_FMT_NUM) {
+                               prcd_log_hdr->ext_event_log_hdr = FALSE;
+                               prcd_log_hdr->binary_payload = TRUE;
+                       } else if (event_log_fmt_num == DHD_TW_BI_EVENT_FMT_NUM) {
+                               prcd_log_hdr->ext_event_log_hdr = TRUE;
+                               prcd_log_hdr->binary_payload = TRUE;
+                       } else {
+                               DHD_ERROR(("%s: invalid format number 0x%X\n",
+                                       __FUNCTION__, event_log_fmt_num));
+                               return FALSE;
+                       }
+                       break;
+               case DHD_INVALID_EVENT_LOG_HDR:
+               default:
+                       DHD_ERROR(("%s: invalid event log header type 0x%X\n",
+                               __FUNCTION__, event_log_hdr_type));
+                       return FALSE;
+       }
+
+       /* Parse extended and legacy event log headers and populate prcd_event_log_hdr_t */
+       if (prcd_log_hdr->ext_event_log_hdr) {
+               ext_log_hdr = (event_log_extended_hdr_t *)
+                       ((uint8 *)log_hdr - sizeof(event_log_hdr_t));
+               prcd_log_hdr->tag = ((ext_log_hdr->extended_tag &
+                       DHD_TW_VALID_TAG_BITS_MASK) << DHD_TW_EVENT_LOG_TAG_OFFSET) | log_hdr->tag;
+       } else {
+               prcd_log_hdr->tag = log_hdr->tag;
+       }
+       prcd_log_hdr->count = log_hdr->count;
+       prcd_log_hdr->fmt_num_raw = log_hdr->fmt_num;
+       prcd_log_hdr->fmt_num = event_log_fmt_num;
+
+       /* update arm cycle */
+       /*
+        * For loegacy event tag :-
+        * |payload........|Timestamp| Tag
+        *
+        * For extended event tag:-
+        * |payload........|Timestamp|extended Tag| Tag.
+        *
+        */
+       prcd_log_hdr->armcycle = prcd_log_hdr->ext_event_log_hdr ?
+               *(uint32 *)(log_hdr - EVENT_TAG_TIMESTAMP_EXT_OFFSET) :
+               *(uint32 *)(log_hdr - EVENT_TAG_TIMESTAMP_OFFSET);
+
+       /* update event log data pointer address */
+       prcd_log_hdr->log_ptr =
+               (uint32 *)log_hdr - log_hdr->count - prcd_log_hdr->ext_event_log_hdr;
+
+       /* handle error cases above this */
+       return TRUE;
+}
+
+static void
+dhd_dbg_verboselog_handler(dhd_pub_t *dhdp, prcd_event_log_hdr_t *plog_hdr,
+               void *raw_event_ptr, uint32 logset, uint16 block, uint32* data)
+{
+       event_log_hdr_t *ts_hdr;
+       uint32 *log_ptr = plog_hdr->log_ptr;
+       char fmtstr_loc_buf[ROMSTR_SIZE] = { 0 };
+       uint32 rom_str_len = 0;
+       uint32 *ts_data;
+
+       if (!raw_event_ptr) {
+               return;
+       }
+
+       if (log_ptr < data) {
+               DHD_ERROR(("Invalid log pointer, logptr : %p data : %p \n", log_ptr, data));
+               return;
+       }
+
+       if (log_ptr > data) {
+               /* Get time stamp if it's updated */
+               ts_hdr = (event_log_hdr_t *)((char *)log_ptr - sizeof(event_log_hdr_t));
+               if (ts_hdr->tag == EVENT_LOG_TAG_TS) {
+                       ts_data = (uint32 *)ts_hdr - ts_hdr->count;
+                       if (ts_data >= data) {
+                               verboselog_ts_saved = (uint64)ts_data[0];
+                               DHD_MSGTRACE_LOG(("EVENT_LOG_TS[0x%08x]: SYS:%08x CPU:%08x\n",
+                                       ts_data[ts_hdr->count - 1], ts_data[0], ts_data[1]));
+                       }
+               } else if (ts_hdr->tag == EVENT_LOG_TAG_ENHANCED_TS) {
+                       ets_msg_v1_t *ets;
+                       ets = (ets_msg_v1_t *)ts_hdr - ts_hdr->count;
+                       if ((uint32*)ets >= data &&
+                               ts_hdr->count >= (sizeof(ets_msg_v1_t) / sizeof(uint32)) &&
+                               ets->version == ENHANCED_TS_MSG_VERSION_1) {
+                               DHD_MSGTRACE_LOG(("EVENT_LOG_ENHANCED_TS_V1: "
+                                       "SYS:%08x CPU:%08x CPUFREQ:%u\n",
+                                       ets->timestamp, ets->cyclecount, ets->cpu_freq));
+                       }
+               }
+       }
+
+       if (plog_hdr->tag == EVENT_LOG_TAG_ROM_PRINTF) {
+               rom_str_len = (plog_hdr->count - 1) * sizeof(uint32);
+               if (rom_str_len >= (ROMSTR_SIZE -1))
+                       rom_str_len = ROMSTR_SIZE - 1;
+
+               /* copy all ascii data for ROM printf to local string */
+               memcpy(fmtstr_loc_buf, log_ptr, rom_str_len);
+               /* add end of line at last */
+               fmtstr_loc_buf[rom_str_len] = '\0';
+
+               DHD_MSGTRACE_LOG(("EVENT_LOG_ROM[0x%08x]: %s",
+                               log_ptr[plog_hdr->count - 1], fmtstr_loc_buf));
+
+               /* Add newline if missing */
+               if (fmtstr_loc_buf[strlen(fmtstr_loc_buf) - 1] != '\n')
+                       DHD_MSGTRACE_LOG(("\n"));
+
+               return;
+       }
+
+       if (plog_hdr->tag == EVENT_LOG_TAG_MSCHPROFILE ||
+               plog_hdr->tag == EVENT_LOG_TAG_MSCHPROFILE_TLV) {
+               wl_mschdbg_verboselog_handler(dhdp, raw_event_ptr, plog_hdr, log_ptr);
+               return;
+       }
+
+       /* print the message out in a logprint  */
+       dhd_dbg_verboselog_printf(dhdp, plog_hdr, raw_event_ptr, log_ptr, logset, block);
+}
+
+void
+dhd_dbg_verboselog_printf(dhd_pub_t *dhdp, prcd_event_log_hdr_t *plog_hdr,
+       void *raw_event_ptr, uint32 *log_ptr, uint32 logset, uint16 block)
+{
+       dhd_event_log_t *raw_event = (dhd_event_log_t *)raw_event_ptr;
+       uint16 count;
+       int log_level, id;
+       char fmtstr_loc_buf[ROMSTR_SIZE] = { 0 };
+       char (*str_buf)[SIZE_LOC_STR] = NULL;
+       char *str_tmpptr = NULL;
+       uint32 addr = 0;
+       typedef union {
+               uint32 val;
+               char * addr;
+       } u_arg;
+       u_arg arg[MAX_NO_OF_ARG] = {{0}};
+       char *c_ptr = NULL;
+       struct bcmstrbuf b;
+#ifdef DHD_LOG_PRINT_RATE_LIMIT
+       static int log_print_count = 0;
+       static uint64 ts0 = 0;
+       uint64 ts1 = 0;
+#endif /* DHD_LOG_PRINT_RATE_LIMIT */
+
+       BCM_REFERENCE(arg);
+
+#ifdef DHD_LOG_PRINT_RATE_LIMIT
+       if (!ts0)
+               ts0 = OSL_SYSUPTIME_US();
+
+       ts1 = OSL_SYSUPTIME_US();
+
+       if (((ts1 - ts0) <= LOG_PRINT_THRESH) && (log_print_count >= MAX_LOG_PRINT_COUNT)) {
+               log_print_threshold = 1;
+               ts0 = 0;
+               log_print_count = 0;
+               DHD_ERROR(("%s: Log print water mark is reached,"
+                       " console logs are dumped only to debug_dump file\n", __FUNCTION__));
+       } else if ((ts1 - ts0) > LOG_PRINT_THRESH) {
+               log_print_threshold = 0;
+               ts0 = 0;
+               log_print_count = 0;
+       }
+
+#endif /* DHD_LOG_PRINT_RATE_LIMIT */
+       /* print the message out in a logprint  */
+       if ((control_logtrace == LOGTRACE_RAW_FMT) || !(raw_event->fmts)) {
+               if (dhdp->dbg) {
+                       log_level = dhdp->dbg->dbg_rings[FW_VERBOSE_RING_ID].log_level;
+                       for (id = 0; id < ARRAYSIZE(fw_verbose_level_map); id++) {
+                               if ((fw_verbose_level_map[id].tag == plog_hdr->tag) &&
+                                       (fw_verbose_level_map[id].log_level > log_level))
+                                       return;
+                       }
+               }
+               if (plog_hdr->binary_payload) {
+                       DHD_ECNTR_LOG(("%d.%d EL:tag=%d len=%d fmt=0x%x",
+                               (uint32)(log_ptr[plog_hdr->count - 1] / EL_MSEC_PER_SEC),
+                               (uint32)(log_ptr[plog_hdr->count - 1] % EL_MSEC_PER_SEC),
+                               plog_hdr->tag,
+                               plog_hdr->count,
+                               plog_hdr->fmt_num_raw));
+
+                       for (count = 0; count < (plog_hdr->count - 1); count++) {
+                               /* XXX: skip first line feed in case count 0 */
+                               if (count && (count % LOG_PRINT_CNT_MAX == 0)) {
+                                       DHD_ECNTR_LOG(("\n\t%08x", log_ptr[count]));
+                               } else {
+                                       DHD_ECNTR_LOG((" %08x", log_ptr[count]));
+                               }
+                       }
+                       DHD_ECNTR_LOG(("\n"));
+               }
+               else {
+                       bcm_binit(&b, fmtstr_loc_buf, FMTSTR_SIZE);
+                       /* XXX: The 'hdr->count - 1' is dongle time */
+                       bcm_bprintf(&b, "%06d.%03d EL:%s:%u:%u %d %d 0x%x",
+                               (uint32)(log_ptr[plog_hdr->count - 1] / EL_MSEC_PER_SEC),
+                               (uint32)(log_ptr[plog_hdr->count - 1] % EL_MSEC_PER_SEC),
+                               EL_PARSE_VER, logset, block,
+                               plog_hdr->tag,
+                               plog_hdr->count,
+                               plog_hdr->fmt_num_raw);
+                       for (count = 0; count < (plog_hdr->count - 1); count++) {
+                               bcm_bprintf(&b, " %x", log_ptr[count]);
+                       }
+
+                       /* ensure preserve fw logs go to debug_dump only in case of customer4 */
+                       if (logset < dhdp->event_log_max_sets &&
+                               ((0x01u << logset) & dhdp->logset_prsrv_mask)) {
+                               DHD_PRSRV_MEM(("%s\n", b.origbuf));
+                       } else {
+                               DHD_FWLOG(("%s\n", b.origbuf));
+#ifdef DHD_LOG_PRINT_RATE_LIMIT
+                               log_print_count++;
+#endif /* DHD_LOG_PRINT_RATE_LIMIT */
+                       }
+               }
+               return;
+       }
+
+       str_buf = MALLOCZ(dhdp->osh, (MAX_NO_OF_ARG * SIZE_LOC_STR));
+       if (!str_buf) {
+               DHD_ERROR(("%s: malloc failed str_buf\n", __FUNCTION__));
+               return;
+       }
+
+       if ((plog_hdr->fmt_num) < raw_event->num_fmts) {
+               if (plog_hdr->tag == EVENT_LOG_TAG_MSCHPROFILE) {
+                       snprintf(fmtstr_loc_buf, FMTSTR_SIZE, "%s",
+                               raw_event->fmts[plog_hdr->fmt_num]);
+                       plog_hdr->count++;
+               } else {
+                       snprintf(fmtstr_loc_buf, FMTSTR_SIZE, "CONSOLE_E:%u:%u %06d.%03d %s",
+                               logset, block,
+                               (uint32)(log_ptr[plog_hdr->count - 1] / EL_MSEC_PER_SEC),
+                               (uint32)(log_ptr[plog_hdr->count - 1] % EL_MSEC_PER_SEC),
+                               raw_event->fmts[plog_hdr->fmt_num]);
+               }
+               c_ptr = fmtstr_loc_buf;
+       } else {
+               /* for ecounters, don't print the error as it will flood */
+               if ((plog_hdr->fmt_num != DHD_OW_BI_EVENT_FMT_NUM) &&
+                       (plog_hdr->fmt_num != DHD_TW_BI_EVENT_FMT_NUM)) {
+                       DHD_ERROR(("%s: fmt number: 0x%x out of range\n",
+                               __FUNCTION__, plog_hdr->fmt_num));
+               } else {
+                       DHD_INFO(("%s: fmt number: 0x%x out of range\n",
+                               __FUNCTION__, plog_hdr->fmt_num));
+               }
+
+               goto exit;
+       }
+
+       if (plog_hdr->count > MAX_NO_OF_ARG) {
+               DHD_ERROR(("%s: plog_hdr->count(%d) out of range\n",
+                       __FUNCTION__, plog_hdr->count));
+               goto exit;
+       }
+
+       /* print the format string which will be needed for debugging incorrect formats */
+       DHD_INFO(("%s: fmtstr_loc_buf = %s\n", __FUNCTION__, fmtstr_loc_buf));
+
+       /* Replace all %p to %x to handle 32 bit %p */
+       replace_percent_p_to_x(fmtstr_loc_buf);
+
+       for (count = 0; count < (plog_hdr->count - 1); count++) {
+               if (c_ptr != NULL)
+                       if ((c_ptr = bcmstrstr(c_ptr, "%")) != NULL)
+                               c_ptr++;
+
+               if (c_ptr != NULL) {
+                       if (check_valid_string_format(c_ptr)) {
+                               if ((raw_event->raw_sstr) &&
+                                       ((log_ptr[count] > raw_event->rodata_start) &&
+                                       (log_ptr[count] < raw_event->rodata_end))) {
+                                       /* ram static string */
+                                       addr = log_ptr[count] - raw_event->rodata_start;
+                                       str_tmpptr = raw_event->raw_sstr + addr;
+                                       memcpy(str_buf[count], str_tmpptr,
+                                               SIZE_LOC_STR);
+                                       str_buf[count][SIZE_LOC_STR-1] = '\0';
+                                       arg[count].addr = str_buf[count];
+                               } else if ((raw_event->rom_raw_sstr) &&
+                                               ((log_ptr[count] >
+                                               raw_event->rom_rodata_start) &&
+                                               (log_ptr[count] <
+                                               raw_event->rom_rodata_end))) {
+                                       /* rom static string */
+                                       addr = log_ptr[count] - raw_event->rom_rodata_start;
+                                       str_tmpptr = raw_event->rom_raw_sstr + addr;
+                                       memcpy(str_buf[count], str_tmpptr,
+                                               SIZE_LOC_STR);
+                                       str_buf[count][SIZE_LOC_STR-1] = '\0';
+                                       arg[count].addr = str_buf[count];
+                               } else {
+                                       /*
+                                       *  Dynamic string OR
+                                       * No data for static string.
+                                       * So store all string's address as string.
+                                       */
+                                       snprintf(str_buf[count], SIZE_LOC_STR,
+                                               "(s)0x%x", log_ptr[count]);
+                                       arg[count].addr = str_buf[count];
+                               }
+                       } else if (check_valid_non_string_format(c_ptr)) {
+                               /* Other than string format */
+                               arg[count].val = log_ptr[count];
+                       } else {
+                               /* There is nothing copied after % or improper format specifier
+                                * after current %, because of not enough buffer size for complete
+                                * copy of original fmt string.
+                                * This is causing error mentioned below.
+                                * Error: "Please remove unsupported %\x00 in format string"
+                                * error(lib/vsprintf.c:1900 format_decode+0x3bc/0x470).
+                                * Refer to JIRA: SWWLAN-200629 for detailed info.
+                                *
+                                * Terminate the string at current .
+                                */
+                               *(c_ptr - 1) = '\0';
+                               break;
+                       }
+               }
+       }
+
+       /* ensure preserve fw logs go to debug_dump only in case of customer4 */
+       if (logset < dhdp->event_log_max_sets &&
+                       ((0x01u << logset) & dhdp->logset_prsrv_mask)) {
+               DHD_PRSRV_MEM((fmtstr_loc_buf, arg[0], arg[1], arg[2], arg[3],
+                       arg[4], arg[5], arg[6], arg[7], arg[8], arg[9], arg[10],
+                       arg[11], arg[12], arg[13], arg[14], arg[15]));
+       } else {
+               DHD_FWLOG((fmtstr_loc_buf, arg[0], arg[1], arg[2], arg[3],
+                       arg[4], arg[5], arg[6], arg[7], arg[8], arg[9], arg[10],
+                       arg[11], arg[12], arg[13], arg[14], arg[15]));
+#ifdef DHD_LOG_PRINT_RATE_LIMIT
+               log_print_count++;
+#endif /* DHD_LOG_PRINT_RATE_LIMIT */
+       }
+
+exit:
+       MFREE(dhdp->osh, str_buf, (MAX_NO_OF_ARG * SIZE_LOC_STR));
+}
+
+void
+dhd_dbg_msgtrace_log_parser(dhd_pub_t *dhdp, void *event_data,
+       void *raw_event_ptr, uint datalen, bool msgtrace_hdr_present,
+       uint32 msgtrace_seqnum)
+{
+       msgtrace_hdr_t *hdr;
+       char *data, *tmpdata;
+       const uint32 log_hdr_len = sizeof(event_log_hdr_t);
+       uint32 log_pyld_len;
+       static uint32 seqnum_prev = 0;
+       event_log_hdr_t *log_hdr;
+       bool msg_processed = FALSE;
+       prcd_event_log_hdr_t prcd_log_hdr;
+       prcd_event_log_hdr_t *plog_hdr;
+       dll_t list_head, *cur;
+       loglist_item_t *log_item;
+       dhd_dbg_ring_entry_t msg_hdr;
+       char *logbuf;
+       struct tracelog_header *logentry_header;
+       uint ring_data_len = 0;
+       bool ecntr_pushed = FALSE;
+       bool rtt_pushed = FALSE;
+       bool dll_inited = FALSE;
+       uint32 logset = 0;
+       uint16 block = 0;
+       bool event_log_max_sets_queried;
+       uint32 event_log_max_sets;
+       uint min_expected_len = 0;
+       uint16 len_chk = 0;
+
+       BCM_REFERENCE(ecntr_pushed);
+       BCM_REFERENCE(rtt_pushed);
+       BCM_REFERENCE(len_chk);
+
+       /* store event_logset_queried and event_log_max_sets in local variables
+        * to avoid race conditions as they were set from different contexts(preinit)
+        */
+       event_log_max_sets_queried = dhdp->event_log_max_sets_queried;
+       /* Make sure queried is read first with wmb and then max_sets,
+        * as it is done in reverse order during preinit ioctls.
+        */
+       OSL_SMP_WMB();
+       event_log_max_sets = dhdp->event_log_max_sets;
+
+       if (msgtrace_hdr_present)
+               min_expected_len = (MSGTRACE_HDRLEN + EVENT_LOG_BLOCK_LEN);
+       else
+               min_expected_len = EVENT_LOG_BLOCK_LEN;
+
+       /* log trace event consists of:
+        * msgtrace header
+        * event log block header
+        * event log payload
+        */
+       if (!event_data || (datalen <= min_expected_len)) {
+               DHD_ERROR(("%s: Not processing due to invalid event_data : %p or length : %d\n",
+                       __FUNCTION__, event_data, datalen));
+               if (event_data && msgtrace_hdr_present) {
+                       prhex("event_data dump", event_data, datalen);
+                       tmpdata = (char *)event_data + MSGTRACE_HDRLEN;
+                       if (tmpdata) {
+                               DHD_ERROR(("EVENT_LOG_HDR[0x%x]: Set: 0x%08x length = %d\n",
+                                       ltoh16(*((uint16 *)(tmpdata+2))),
+                                       ltoh32(*((uint32 *)(tmpdata + 4))),
+                                       ltoh16(*((uint16 *)(tmpdata)))));
+                       }
+               } else if (!event_data) {
+                       DHD_ERROR(("%s: event_data is NULL, cannot dump prhex\n", __FUNCTION__));
+               }
+
+               return;
+       }
+
+       if (msgtrace_hdr_present) {
+               hdr = (msgtrace_hdr_t *)event_data;
+               data = (char *)event_data + MSGTRACE_HDRLEN;
+               datalen -= MSGTRACE_HDRLEN;
+               msgtrace_seqnum = ntoh32(hdr->seqnum);
+       } else {
+               data = (char *)event_data;
+       }
+
+       if (dhd_dbg_msgtrace_seqchk(&seqnum_prev, msgtrace_seqnum))
+               return;
+
+       /* Save the whole message to event log ring */
+       memset(&msg_hdr, 0, sizeof(dhd_dbg_ring_entry_t));
+       logbuf = VMALLOC(dhdp->osh, sizeof(*logentry_header) + datalen);
+       if (logbuf == NULL)
+               return;
+       logentry_header = (struct tracelog_header *)logbuf;
+       logentry_header->magic_num = TRACE_LOG_MAGIC_NUMBER;
+       logentry_header->buf_size = datalen;
+       logentry_header->seq_num = msgtrace_seqnum;
+       msg_hdr.type = DBG_RING_ENTRY_DATA_TYPE;
+
+       ring_data_len = datalen + sizeof(*logentry_header);
+
+       if ((sizeof(*logentry_header) + datalen) > PAYLOAD_MAX_LEN) {
+               DHD_ERROR(("%s:Payload len=%u exceeds max len\n", __FUNCTION__,
+                       ((uint)sizeof(*logentry_header) + datalen)));
+               goto exit;
+       }
+
+       msg_hdr.len = sizeof(*logentry_header) + datalen;
+       memcpy(logbuf + sizeof(*logentry_header), data, datalen);
+       DHD_DBGIF(("%s: datalen %d %d\n", __FUNCTION__, msg_hdr.len, datalen));
+       dhd_dbg_push_to_ring(dhdp, FW_VERBOSE_RING_ID, &msg_hdr, logbuf);
+
+       /* Print sequence number, originating set and length of received
+        * event log buffer. Refer to event log buffer structure in
+        * event_log.h
+        */
+       DHD_MSGTRACE_LOG(("EVENT_LOG_HDR[0x%x]: Set: 0x%08x length = %d\n",
+               ltoh16(*((uint16 *)(data+2))), ltoh32(*((uint32 *)(data + 4))),
+               ltoh16(*((uint16 *)(data)))));
+
+       logset = ltoh32(*((uint32 *)(data + 4)));
+
+       if (logset >= event_log_max_sets) {
+               DHD_ERROR(("%s logset: %d max: %d out of range queried: %d\n",
+                       __FUNCTION__, logset, event_log_max_sets, event_log_max_sets_queried));
+#ifdef DHD_FW_COREDUMP
+               if (event_log_max_sets_queried) {
+                       DHD_ERROR(("%s: collect socram for DUMP_TYPE_LOGSET_BEYOND_RANGE\n",
+                               __FUNCTION__));
+                       dhdp->memdump_type = DUMP_TYPE_LOGSET_BEYOND_RANGE;
+                       dhd_bus_mem_dump(dhdp);
+               }
+#endif /* DHD_FW_COREDUMP */
+       }
+
+       block = ltoh16(*((uint16 *)(data + 2)));
+
+       data += EVENT_LOG_BLOCK_HDRLEN;
+       datalen -= EVENT_LOG_BLOCK_HDRLEN;
+
+       /* start parsing from the tail of packet
+        * Sameple format of a meessage
+        * 001d3c54 00000064 00000064 001d3c54 001dba08 035d6ce1 0c540639
+        * 001d3c54 00000064 00000064 035d6d89 0c580439
+        * 0x0c580439 -- 39 is tag, 04 is count, 580c is format number
+        * all these uint32 values comes in reverse order as group as EL data
+        * while decoding we can only parse from last to first
+        * |<-                     datalen                     ->|
+        * |----(payload and maybe more logs)----|event_log_hdr_t|
+        * data                                  log_hdr
+        */
+       dll_init(&list_head);
+       dll_inited = TRUE;
+
+       while (datalen > log_hdr_len) {
+               log_hdr = (event_log_hdr_t *)(data + datalen - log_hdr_len);
+               memset(&prcd_log_hdr, 0, sizeof(prcd_log_hdr));
+               if (!dhd_dbg_process_event_log_hdr(log_hdr, &prcd_log_hdr)) {
+                       DHD_ERROR(("%s: Error while parsing event log header\n",
+                               __FUNCTION__));
+               }
+
+               /* skip zero padding at end of frame */
+               if (prcd_log_hdr.tag == EVENT_LOG_TAG_NULL) {
+                       datalen -= log_hdr_len;
+                       continue;
+               }
+               /* Check argument count (for non-ecounter events only),
+                * any event log should contain at least
+                * one argument (4 bytes) for arm cycle count and up to 16
+                * arguments except EVENT_LOG_TAG_STATS which could use the
+                * whole payload of 256 words
+                */
+               if (prcd_log_hdr.count == 0) {
+                       break;
+               }
+               /* Both tag_stats and proxd are binary payloads so skip
+                * argument count check for these.
+                */
+               if ((prcd_log_hdr.tag != EVENT_LOG_TAG_STATS) &&
+                       (prcd_log_hdr.tag != EVENT_LOG_TAG_PROXD_SAMPLE_COLLECT) &&
+                       (prcd_log_hdr.tag != EVENT_LOG_TAG_ROAM_ENHANCED_LOG) &&
+                       (prcd_log_hdr.count > MAX_NO_OF_ARG)) {
+                       break;
+               }
+
+               log_pyld_len = (prcd_log_hdr.count + prcd_log_hdr.ext_event_log_hdr) *
+                       DATA_UNIT_FOR_LOG_CNT;
+               /* log data should not cross the event data boundary */
+               if ((uint32)((char *)log_hdr - data) < log_pyld_len) {
+                       break;
+               }
+               /* skip 4 bytes time stamp packet */
+               if (prcd_log_hdr.tag == EVENT_LOG_TAG_TS ||
+                       prcd_log_hdr.tag == EVENT_LOG_TAG_ENHANCED_TS) {
+                       datalen -= (log_pyld_len + log_hdr_len);
+                       continue;
+               }
+               if (!(log_item = MALLOC(dhdp->osh, sizeof(*log_item)))) {
+                       DHD_ERROR(("%s allocating log list item failed\n",
+                               __FUNCTION__));
+                       break;
+               }
+
+               log_item->prcd_log_hdr.tag = prcd_log_hdr.tag;
+               log_item->prcd_log_hdr.count = prcd_log_hdr.count;
+               log_item->prcd_log_hdr.fmt_num = prcd_log_hdr.fmt_num;
+               log_item->prcd_log_hdr.fmt_num_raw = prcd_log_hdr.fmt_num_raw;
+               log_item->prcd_log_hdr.armcycle = prcd_log_hdr.armcycle;
+               log_item->prcd_log_hdr.log_ptr = prcd_log_hdr.log_ptr;
+               log_item->prcd_log_hdr.payload_len = prcd_log_hdr.payload_len;
+               log_item->prcd_log_hdr.ext_event_log_hdr = prcd_log_hdr.ext_event_log_hdr;
+               log_item->prcd_log_hdr.binary_payload = prcd_log_hdr.binary_payload;
+
+               dll_insert(&log_item->list, &list_head);
+               datalen -= (log_pyld_len + log_hdr_len);
+       }
+
+       while (!dll_empty(&list_head)) {
+               msg_processed = FALSE;
+               cur = dll_head_p(&list_head);
+
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               log_item = (loglist_item_t *)container_of(cur, loglist_item_t, list);
+               GCC_DIAGNOSTIC_POP();
+
+               plog_hdr = &log_item->prcd_log_hdr;
+#if defined(EWP_ECNTRS_LOGGING) && defined(DHD_LOG_DUMP)
+               /* Ecounter tag can be time_data or log_stats+binary paloaod */
+               if ((plog_hdr->tag == EVENT_LOG_TAG_ECOUNTERS_TIME_DATA) ||
+                       ((plog_hdr->tag == EVENT_LOG_TAG_STATS) &&
+                       (plog_hdr->binary_payload))) {
+                       if (!ecntr_pushed && dhd_log_dump_ecntr_enabled()) {
+                               /*
+                                * check msg hdr len before pushing.
+                                * FW msg_hdr.len includes length of event log hdr,
+                                * logentry header and payload.
+                                */
+                               len_chk = (sizeof(*logentry_header) + sizeof(*log_hdr) +
+                                               PAYLOAD_ECNTR_MAX_LEN);
+                               /* account extended event log header(extended_event_log_hdr) */
+                               if (plog_hdr->ext_event_log_hdr) {
+                                       len_chk += sizeof(*log_hdr);
+                               }
+                               if (msg_hdr.len > len_chk) {
+                                       DHD_ERROR(("%s: EVENT_LOG_VALIDATION_FAILS: "
+                                               "msg_hdr.len=%u, max allowed for ecntrs=%u\n",
+                                               __FUNCTION__, msg_hdr.len, len_chk));
+                                       goto exit;
+                               }
+                               dhd_dbg_ring_push(dhdp->ecntr_dbg_ring, &msg_hdr, logbuf);
+                               ecntr_pushed = TRUE;
+                       }
+               }
+#endif /* EWP_ECNTRS_LOGGING && DHD_LOG_DUMP */
+
+               if (plog_hdr->tag == EVENT_LOG_TAG_ROAM_ENHANCED_LOG) {
+                       print_roam_enhanced_log(plog_hdr);
+                       msg_processed = TRUE;
+               }
+#if defined(EWP_RTT_LOGGING) && defined(DHD_LOG_DUMP)
+               if ((plog_hdr->tag == EVENT_LOG_TAG_PROXD_SAMPLE_COLLECT) &&
+                               plog_hdr->binary_payload) {
+                       if (!rtt_pushed && dhd_log_dump_rtt_enabled()) {
+                               /*
+                                * check msg hdr len before pushing.
+                                * FW msg_hdr.len includes length of event log hdr,
+                                * logentry header and payload.
+                                */
+                               len_chk = (sizeof(*logentry_header) + sizeof(*log_hdr) +
+                                       PAYLOAD_RTT_MAX_LEN);
+                               /* account extended event log header(extended_event_log_hdr) */
+                               if (plog_hdr->ext_event_log_hdr) {
+                                       len_chk += sizeof(*log_hdr);
+                               }
+                               if (msg_hdr.len > len_chk) {
+                                       DHD_ERROR(("%s: EVENT_LOG_VALIDATION_FAILS: "
+                                               "msg_hdr.len=%u, max allowed for ecntrs=%u\n",
+                                               __FUNCTION__, msg_hdr.len, len_chk));
+                                       goto exit;
+                               }
+                               dhd_dbg_ring_push(dhdp->rtt_dbg_ring, &msg_hdr, logbuf);
+                               rtt_pushed = TRUE;
+                       }
+               }
+#endif /* EWP_RTT_LOGGING && DHD_LOG_DUMP */
+
+#if defined(DHD_EVENT_LOG_FILTER)
+               if (plog_hdr->tag == EVENT_LOG_TAG_STATS) {
+                       dhd_event_log_filter_event_handler(dhdp, plog_hdr, plog_hdr->log_ptr);
+               }
+#endif /* DHD_EVENT_LOG_FILTER */
+               if (!msg_processed) {
+                       dhd_dbg_verboselog_handler(dhdp, plog_hdr, raw_event_ptr,
+                               logset, block, (uint32 *)data);
+               }
+               dll_delete(cur);
+               MFREE(dhdp->osh, log_item, sizeof(*log_item));
+
+       }
+       BCM_REFERENCE(log_hdr);
+exit:
+       while (dll_inited && (!dll_empty(&list_head))) {
+               cur = dll_head_p(&list_head);
+
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               log_item = (loglist_item_t *)container_of(cur, loglist_item_t, list);
+               GCC_DIAGNOSTIC_POP();
+
+               dll_delete(cur);
+               MFREE(dhdp->osh, log_item, sizeof(*log_item));
+       }
+
+       VMFREE(dhdp->osh, logbuf, ring_data_len);
+}
+#else /* !SHOW_LOGTRACE */
+static INLINE void dhd_dbg_verboselog_handler(dhd_pub_t *dhdp,
+       prcd_event_log_hdr_t *plog_hdr, void *raw_event_ptr, uint32 logset, uint16 block,
+       uint32 *data) {};
+INLINE void dhd_dbg_msgtrace_log_parser(dhd_pub_t *dhdp,
+       void *event_data, void *raw_event_ptr, uint datalen,
+       bool msgtrace_hdr_present, uint32 msgtrace_seqnum) {};
+#endif /* SHOW_LOGTRACE */
+void
+dhd_dbg_trace_evnt_handler(dhd_pub_t *dhdp, void *event_data,
+               void *raw_event_ptr, uint datalen)
+{
+       msgtrace_hdr_t *hdr;
+
+       hdr = (msgtrace_hdr_t *)event_data;
+
+       if (hdr->version != MSGTRACE_VERSION) {
+               DHD_DBGIF(("%s unsupported MSGTRACE version, dhd %d, dongle %d\n",
+                       __FUNCTION__, MSGTRACE_VERSION, hdr->version));
+               return;
+       }
+
+       if (hdr->trace_type == MSGTRACE_HDR_TYPE_MSG)
+               dhd_dbg_msgtrace_msg_parser(event_data);
+       else if (hdr->trace_type == MSGTRACE_HDR_TYPE_LOG)
+               dhd_dbg_msgtrace_log_parser(dhdp, event_data, raw_event_ptr, datalen, TRUE, 0);
+}
+
+/*
+ * dhd_dbg_set_event_log_tag : modify the state of an event log tag
+ */
+void
+dhd_dbg_set_event_log_tag(dhd_pub_t *dhdp, uint16 tag, uint8 set)
+{
+       wl_el_tag_params_t pars;
+       char *cmd = "event_log_tag_control";
+       char iovbuf[WLC_IOCTL_SMLEN] = { 0 };
+       int ret;
+
+       memset(&pars, 0, sizeof(pars));
+       pars.tag = tag;
+       pars.set = set;
+       pars.flags = EVENT_LOG_TAG_FLAG_LOG;
+
+       if (!bcm_mkiovar(cmd, (char *)&pars, sizeof(pars), iovbuf, sizeof(iovbuf))) {
+               DHD_ERROR(("%s mkiovar failed\n", __FUNCTION__));
+               return;
+       }
+
+       ret = dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+       if (ret) {
+               DHD_ERROR(("%s set log tag iovar failed %d\n", __FUNCTION__, ret));
+       }
+}
+
+int
+dhd_dbg_set_configuration(dhd_pub_t *dhdp, int ring_id, int log_level, int flags, uint32 threshold)
+{
+       dhd_dbg_ring_t *ring;
+       uint8 set = 1;
+       int i, array_len = 0;
+       struct log_level_table *log_level_tbl = NULL;
+       if (!dhdp || !dhdp->dbg)
+               return BCME_BADADDR;
+
+       if (!VALID_RING(ring_id)) {
+               DHD_ERROR(("%s : invalid ring_id : %d\n", __FUNCTION__, ring_id));
+               return BCME_RANGE;
+       }
+
+       ring = &dhdp->dbg->dbg_rings[ring_id];
+       dhd_dbg_ring_config(ring, log_level, threshold);
+
+       if (log_level > 0)
+               set = TRUE;
+
+       if (ring->id == FW_VERBOSE_RING_ID) {
+               log_level_tbl = fw_verbose_level_map;
+               array_len = ARRAYSIZE(fw_verbose_level_map);
+       }
+
+       for (i = 0; i < array_len; i++) {
+               if (log_level == 0 || (log_level_tbl[i].log_level > log_level)) {
+                       /* clear the reference per ring */
+                       ref_tag_tbl[log_level_tbl[i].tag] &= ~(1 << ring_id);
+               } else {
+                       /* set the reference per ring */
+                       ref_tag_tbl[log_level_tbl[i].tag] |= (1 << ring_id);
+               }
+               set = (ref_tag_tbl[log_level_tbl[i].tag])? 1 : 0;
+               DHD_DBGIF(("%s TAG(%s) is %s for the ring(%s)\n", __FUNCTION__,
+                       log_level_tbl[i].desc, (set)? "SET" : "CLEAR", ring->name));
+               dhd_dbg_set_event_log_tag(dhdp, log_level_tbl[i].tag, set);
+       }
+       return BCME_OK;
+}
+
+int
+__dhd_dbg_get_ring_status(dhd_dbg_ring_t *ring, dhd_dbg_ring_status_t *get_ring_status)
+{
+       dhd_dbg_ring_status_t ring_status;
+       int ret = BCME_OK;
+
+       if (ring == NULL) {
+               return BCME_BADADDR;
+       }
+
+       bzero(&ring_status, sizeof(dhd_dbg_ring_status_t));
+       RING_STAT_TO_STATUS(ring, ring_status);
+       *get_ring_status = ring_status;
+
+       return ret;
+}
+
+/*
+* dhd_dbg_get_ring_status : get the ring status from the coresponding ring buffer
+* Return: An error code or 0 on success.
+*/
+
+int
+dhd_dbg_get_ring_status(dhd_pub_t *dhdp, int ring_id, dhd_dbg_ring_status_t *dbg_ring_status)
+{
+       int ret = BCME_OK;
+       int id = 0;
+       dhd_dbg_t *dbg;
+       dhd_dbg_ring_t *dbg_ring;
+       if (!dhdp || !dhdp->dbg)
+               return BCME_BADADDR;
+       dbg = dhdp->dbg;
+
+       for (id = DEBUG_RING_ID_INVALID + 1; id < DEBUG_RING_ID_MAX; id++) {
+               dbg_ring = &dbg->dbg_rings[id];
+               if (VALID_RING(dbg_ring->id) && (dbg_ring->id == ring_id)) {
+                       __dhd_dbg_get_ring_status(dbg_ring, dbg_ring_status);
+                       break;
+               }
+       }
+       if (!VALID_RING(id)) {
+               DHD_ERROR(("%s : cannot find the ring_id : %d\n", __FUNCTION__, ring_id));
+               ret = BCME_NOTFOUND;
+       }
+       return ret;
+}
+
+#ifdef SHOW_LOGTRACE
+void
+dhd_dbg_read_ring_into_trace_buf(dhd_dbg_ring_t *ring, trace_buf_info_t *trace_buf_info)
+{
+       dhd_dbg_ring_status_t ring_status;
+       uint32 rlen = 0;
+
+       rlen = dhd_dbg_ring_pull_single(ring, trace_buf_info->buf, TRACE_LOG_BUF_MAX_SIZE, TRUE);
+
+       trace_buf_info->size = rlen;
+       trace_buf_info->availability = NEXT_BUF_NOT_AVAIL;
+       if (rlen == 0) {
+               trace_buf_info->availability = BUF_NOT_AVAILABLE;
+               return;
+       }
+
+       __dhd_dbg_get_ring_status(ring, &ring_status);
+
+       if (ring_status.written_bytes != ring_status.read_bytes) {
+               trace_buf_info->availability = NEXT_BUF_AVAIL;
+       }
+}
+#endif /* SHOW_LOGTRACE */
+
+/*
+* dhd_dbg_find_ring_id : return ring_id based on ring_name
+* Return: An invalid ring id for failure or valid ring id on success.
+*/
+
+int
+dhd_dbg_find_ring_id(dhd_pub_t *dhdp, char *ring_name)
+{
+       int id;
+       dhd_dbg_t *dbg;
+       dhd_dbg_ring_t *ring;
+
+       if (!dhdp || !dhdp->dbg)
+               return BCME_BADADDR;
+
+       dbg = dhdp->dbg;
+       for (id = DEBUG_RING_ID_INVALID + 1; id < DEBUG_RING_ID_MAX; id++) {
+               ring = &dbg->dbg_rings[id];
+               if (!strncmp((char *)ring->name, ring_name, sizeof(ring->name) - 1))
+                       break;
+       }
+       return id;
+}
+
+/*
+* dhd_dbg_get_priv : get the private data of dhd dbugability module
+* Return : An NULL on failure or valid data address
+*/
+void *
+dhd_dbg_get_priv(dhd_pub_t *dhdp)
+{
+       if (!dhdp || !dhdp->dbg)
+               return NULL;
+       return dhdp->dbg->private;
+}
+
+/*
+* dhd_dbg_start : start and stop All of Ring buffers
+* Return: An error code or 0 on success.
+*/
+int
+dhd_dbg_start(dhd_pub_t *dhdp, bool start)
+{
+       int ret = BCME_OK;
+       int ring_id;
+       dhd_dbg_t *dbg;
+       dhd_dbg_ring_t *dbg_ring;
+       if (!dhdp)
+               return BCME_BADARG;
+       dbg = dhdp->dbg;
+
+       for (ring_id = DEBUG_RING_ID_INVALID + 1; ring_id < DEBUG_RING_ID_MAX; ring_id++) {
+               dbg_ring = &dbg->dbg_rings[ring_id];
+               if (!start) {
+                       if (VALID_RING(dbg_ring->id)) {
+                               dhd_dbg_ring_start(dbg_ring);
+                       }
+               }
+       }
+       return ret;
+}
+
+/*
+ * dhd_dbg_send_urgent_evt: send the health check evt to Upper layer
+ *
+ * Return: An error code or 0 on success.
+ */
+
+int
+dhd_dbg_send_urgent_evt(dhd_pub_t *dhdp, const void *data, const uint32 len)
+{
+       dhd_dbg_t *dbg;
+       int ret = BCME_OK;
+       if (!dhdp || !dhdp->dbg)
+               return BCME_BADADDR;
+
+       dbg = dhdp->dbg;
+       if (dbg->urgent_notifier) {
+               dbg->urgent_notifier(dhdp, data, len);
+       }
+       return ret;
+}
+
+#if defined(DBG_PKT_MON) || defined(DHD_PKT_LOGGING)
+uint32
+__dhd_dbg_pkt_hash(uintptr_t pkt, uint32 pktid)
+{
+       uint32 __pkt;
+       uint32 __pktid;
+
+       __pkt = ((int)pkt) >= 0 ? (2 * pkt) : (-2 * pkt - 1);
+       __pktid = ((int)pktid) >= 0 ? (2 * pktid) : (-2 * pktid - 1);
+
+       return (__pkt >= __pktid ? (__pkt * __pkt + __pkt + __pktid) :
+                       (__pkt + __pktid * __pktid));
+}
+
+#define __TIMESPEC_TO_US(ts) \
+       (((uint32)(ts).tv_sec * USEC_PER_SEC) + ((ts).tv_nsec / NSEC_PER_USEC))
+
+uint32
+__dhd_dbg_driver_ts_usec(void)
+{
+       struct osl_timespec ts;
+
+       osl_get_monotonic_boottime(&ts);
+       return ((uint32)(__TIMESPEC_TO_US(ts)));
+}
+
+wifi_tx_packet_fate
+__dhd_dbg_map_tx_status_to_pkt_fate(uint16 status)
+{
+       wifi_tx_packet_fate pkt_fate;
+
+       switch (status) {
+               case WLFC_CTL_PKTFLAG_DISCARD:
+                       pkt_fate = TX_PKT_FATE_ACKED;
+                       break;
+               case WLFC_CTL_PKTFLAG_D11SUPPRESS:
+                       /* intensional fall through */
+               case WLFC_CTL_PKTFLAG_WLSUPPRESS:
+                       pkt_fate = TX_PKT_FATE_FW_QUEUED;
+                       break;
+               case WLFC_CTL_PKTFLAG_TOSSED_BYWLC:
+                       pkt_fate = TX_PKT_FATE_FW_DROP_INVALID;
+                       break;
+               case WLFC_CTL_PKTFLAG_DISCARD_NOACK:
+                       pkt_fate = TX_PKT_FATE_SENT;
+                       break;
+               case WLFC_CTL_PKTFLAG_EXPIRED:
+                       pkt_fate = TX_PKT_FATE_FW_DROP_EXPTIME;
+                       break;
+               case WLFC_CTL_PKTFLAG_MKTFREE:
+                       pkt_fate = TX_PKT_FATE_FW_PKT_FREE;
+                       break;
+               default:
+                       pkt_fate = TX_PKT_FATE_FW_DROP_OTHER;
+                       break;
+       }
+
+       return pkt_fate;
+}
+#endif /* DBG_PKT_MON || DHD_PKT_LOGGING */
+
+#ifdef DBG_PKT_MON
+static int
+__dhd_dbg_free_tx_pkts(dhd_pub_t *dhdp, dhd_dbg_tx_info_t *tx_pkts,
+       uint16 pkt_count)
+{
+       uint16 count;
+
+       count = 0;
+       while ((count < pkt_count) && tx_pkts) {
+               if (tx_pkts->info.pkt) {
+                       PKTFREE(dhdp->osh, tx_pkts->info.pkt, TRUE);
+               }
+               tx_pkts++;
+               count++;
+       }
+
+       return BCME_OK;
+}
+
+static int
+__dhd_dbg_free_rx_pkts(dhd_pub_t *dhdp, dhd_dbg_rx_info_t *rx_pkts,
+       uint16 pkt_count)
+{
+       uint16 count;
+
+       count = 0;
+       while ((count < pkt_count) && rx_pkts) {
+               if (rx_pkts->info.pkt) {
+                       PKTFREE(dhdp->osh, rx_pkts->info.pkt, TRUE);
+               }
+               rx_pkts++;
+               count++;
+       }
+
+       return BCME_OK;
+}
+
+void
+__dhd_dbg_dump_pkt_info(dhd_pub_t *dhdp, dhd_dbg_pkt_info_t *info)
+{
+       if (DHD_PKT_MON_DUMP_ON()) {
+               DHD_PKT_MON(("payload type   = %d\n", info->payload_type));
+               DHD_PKT_MON(("driver ts      = %u\n", info->driver_ts));
+               DHD_PKT_MON(("firmware ts    = %u\n", info->firmware_ts));
+               DHD_PKT_MON(("packet hash    = %u\n", info->pkt_hash));
+               DHD_PKT_MON(("packet length  = %zu\n", info->pkt_len));
+               DHD_PKT_MON(("packet address = %p\n", info->pkt));
+               DHD_PKT_MON(("packet data    = \n"));
+               if (DHD_PKT_MON_ON()) {
+                       prhex(NULL, PKTDATA(dhdp->osh, info->pkt), info->pkt_len);
+               }
+       }
+}
+
+void
+__dhd_dbg_dump_tx_pkt_info(dhd_pub_t *dhdp, dhd_dbg_tx_info_t *tx_pkt,
+       uint16 count)
+{
+       if (DHD_PKT_MON_DUMP_ON()) {
+               DHD_PKT_MON(("\nTX (count: %d)\n", ++count));
+               DHD_PKT_MON(("packet fate    = %d\n", tx_pkt->fate));
+               __dhd_dbg_dump_pkt_info(dhdp, &tx_pkt->info);
+       }
+}
+
+void
+__dhd_dbg_dump_rx_pkt_info(dhd_pub_t *dhdp, dhd_dbg_rx_info_t *rx_pkt,
+       uint16 count)
+{
+       if (DHD_PKT_MON_DUMP_ON()) {
+               DHD_PKT_MON(("\nRX (count: %d)\n", ++count));
+               DHD_PKT_MON(("packet fate    = %d\n", rx_pkt->fate));
+               __dhd_dbg_dump_pkt_info(dhdp, &rx_pkt->info);
+       }
+}
+
+int
+dhd_dbg_attach_pkt_monitor(dhd_pub_t *dhdp,
+       dbg_mon_tx_pkts_t tx_pkt_mon,
+       dbg_mon_tx_status_t tx_status_mon,
+       dbg_mon_rx_pkts_t rx_pkt_mon)
+{
+
+       dhd_dbg_tx_report_t *tx_report = NULL;
+       dhd_dbg_rx_report_t *rx_report = NULL;
+       dhd_dbg_tx_info_t *tx_pkts = NULL;
+       dhd_dbg_rx_info_t *rx_pkts = NULL;
+       dhd_dbg_pkt_mon_state_t tx_pkt_state;
+       dhd_dbg_pkt_mon_state_t tx_status_state;
+       dhd_dbg_pkt_mon_state_t rx_pkt_state;
+       uint32 alloc_len;
+       int ret = BCME_OK;
+       unsigned long flags;
+
+       if (!dhdp || !dhdp->dbg) {
+               DHD_PKT_MON(("%s(): dhdp=%p, dhdp->dbg=%p\n", __FUNCTION__,
+                       dhdp, (dhdp ? dhdp->dbg : NULL)));
+               return -EINVAL;
+       }
+
+       DHD_PKT_MON_LOCK(dhdp->dbg->pkt_mon_lock, flags);
+       tx_pkt_state = dhdp->dbg->pkt_mon.tx_pkt_state;
+       tx_status_state = dhdp->dbg->pkt_mon.tx_pkt_state;
+       rx_pkt_state = dhdp->dbg->pkt_mon.rx_pkt_state;
+
+       if (PKT_MON_ATTACHED(tx_pkt_state) || PKT_MON_ATTACHED(tx_status_state) ||
+                       PKT_MON_ATTACHED(rx_pkt_state)) {
+               DHD_PKT_MON(("%s(): packet monitor is already attached, "
+                       "tx_pkt_state=%d, tx_status_state=%d, rx_pkt_state=%d\n",
+                       __FUNCTION__, tx_pkt_state, tx_status_state, rx_pkt_state));
+               DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+               /* return success as the intention was to initialize packet monitor */
+               return BCME_OK;
+       }
+
+       /* allocate and initialize tx packet monitoring */
+       alloc_len = sizeof(*tx_report);
+       tx_report = (dhd_dbg_tx_report_t *)MALLOCZ(dhdp->osh, alloc_len);
+       if (unlikely(!tx_report)) {
+               DHD_ERROR(("%s(): could not allocate memory for - "
+                       "dhd_dbg_tx_report_t\n", __FUNCTION__));
+               ret = -ENOMEM;
+               goto fail;
+       }
+
+       alloc_len = (sizeof(*tx_pkts) * MAX_FATE_LOG_LEN);
+       tx_pkts = (dhd_dbg_tx_info_t *)MALLOCZ(dhdp->osh, alloc_len);
+       if (unlikely(!tx_pkts)) {
+               DHD_ERROR(("%s(): could not allocate memory for - "
+                       "dhd_dbg_tx_info_t\n", __FUNCTION__));
+               ret = -ENOMEM;
+               goto fail;
+       }
+       dhdp->dbg->pkt_mon.tx_report = tx_report;
+       dhdp->dbg->pkt_mon.tx_report->tx_pkts = tx_pkts;
+       dhdp->dbg->pkt_mon.tx_pkt_mon = tx_pkt_mon;
+       dhdp->dbg->pkt_mon.tx_status_mon = tx_status_mon;
+       dhdp->dbg->pkt_mon.tx_pkt_state = PKT_MON_ATTACHED;
+       dhdp->dbg->pkt_mon.tx_status_state = PKT_MON_ATTACHED;
+
+       /* allocate and initialze rx packet monitoring */
+       alloc_len = sizeof(*rx_report);
+       rx_report = (dhd_dbg_rx_report_t *)MALLOCZ(dhdp->osh, alloc_len);
+       if (unlikely(!rx_report)) {
+               DHD_ERROR(("%s(): could not allocate memory for - "
+                       "dhd_dbg_rx_report_t\n", __FUNCTION__));
+               ret = -ENOMEM;
+               goto fail;
+       }
+
+       alloc_len = (sizeof(*rx_pkts) * MAX_FATE_LOG_LEN);
+       rx_pkts = (dhd_dbg_rx_info_t *)MALLOCZ(dhdp->osh, alloc_len);
+       if (unlikely(!rx_pkts)) {
+               DHD_ERROR(("%s(): could not allocate memory for - "
+                       "dhd_dbg_rx_info_t\n", __FUNCTION__));
+               ret = -ENOMEM;
+               goto fail;
+       }
+       dhdp->dbg->pkt_mon.rx_report = rx_report;
+       dhdp->dbg->pkt_mon.rx_report->rx_pkts = rx_pkts;
+       dhdp->dbg->pkt_mon.rx_pkt_mon = rx_pkt_mon;
+       dhdp->dbg->pkt_mon.rx_pkt_state = PKT_MON_ATTACHED;
+
+       DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+       DHD_PKT_MON(("%s(): packet monitor attach succeeded\n", __FUNCTION__));
+       return ret;
+
+fail:
+       /* tx packet monitoring */
+       if (tx_pkts) {
+               alloc_len = (sizeof(*tx_pkts) * MAX_FATE_LOG_LEN);
+               MFREE(dhdp->osh, tx_pkts, alloc_len);
+       }
+       if (tx_report) {
+               alloc_len = sizeof(*tx_report);
+               MFREE(dhdp->osh, tx_report, alloc_len);
+       }
+       dhdp->dbg->pkt_mon.tx_report = NULL;
+       dhdp->dbg->pkt_mon.tx_report->tx_pkts = NULL;
+       dhdp->dbg->pkt_mon.tx_pkt_mon = NULL;
+       dhdp->dbg->pkt_mon.tx_status_mon = NULL;
+       dhdp->dbg->pkt_mon.tx_pkt_state = PKT_MON_DETACHED;
+       dhdp->dbg->pkt_mon.tx_status_state = PKT_MON_DETACHED;
+
+       /* rx packet monitoring */
+       if (rx_pkts) {
+               alloc_len = (sizeof(*rx_pkts) * MAX_FATE_LOG_LEN);
+               MFREE(dhdp->osh, rx_pkts, alloc_len);
+       }
+       if (rx_report) {
+               alloc_len = sizeof(*rx_report);
+               MFREE(dhdp->osh, rx_report, alloc_len);
+       }
+       dhdp->dbg->pkt_mon.rx_report = NULL;
+       dhdp->dbg->pkt_mon.rx_report->rx_pkts = NULL;
+       dhdp->dbg->pkt_mon.rx_pkt_mon = NULL;
+       dhdp->dbg->pkt_mon.rx_pkt_state = PKT_MON_DETACHED;
+
+       DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+       DHD_ERROR(("%s(): packet monitor attach failed\n", __FUNCTION__));
+       return ret;
+}
+
+int
+dhd_dbg_start_pkt_monitor(dhd_pub_t *dhdp)
+{
+       dhd_dbg_tx_report_t *tx_report;
+       dhd_dbg_rx_report_t *rx_report;
+       dhd_dbg_pkt_mon_state_t tx_pkt_state;
+       dhd_dbg_pkt_mon_state_t tx_status_state;
+       dhd_dbg_pkt_mon_state_t rx_pkt_state;
+       unsigned long flags;
+
+       if (!dhdp || !dhdp->dbg) {
+               DHD_PKT_MON(("%s(): dhdp=%p, dhdp->dbg=%p\n", __FUNCTION__,
+                       dhdp, (dhdp ? dhdp->dbg : NULL)));
+               return -EINVAL;
+       }
+
+       DHD_PKT_MON_LOCK(dhdp->dbg->pkt_mon_lock, flags);
+       tx_pkt_state = dhdp->dbg->pkt_mon.tx_pkt_state;
+       tx_status_state = dhdp->dbg->pkt_mon.tx_status_state;
+       rx_pkt_state = dhdp->dbg->pkt_mon.rx_pkt_state;
+
+       if (PKT_MON_DETACHED(tx_pkt_state) || PKT_MON_DETACHED(tx_status_state) ||
+                       PKT_MON_DETACHED(rx_pkt_state)) {
+               DHD_PKT_MON(("%s(): packet monitor is not yet enabled, "
+                       "tx_pkt_state=%d, tx_status_state=%d, rx_pkt_state=%d\n",
+                       __FUNCTION__, tx_pkt_state, tx_status_state, rx_pkt_state));
+               DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+               return -EINVAL;
+       }
+
+       dhdp->dbg->pkt_mon.tx_pkt_state = PKT_MON_STARTING;
+       dhdp->dbg->pkt_mon.tx_status_state = PKT_MON_STARTING;
+       dhdp->dbg->pkt_mon.rx_pkt_state = PKT_MON_STARTING;
+
+       tx_report = dhdp->dbg->pkt_mon.tx_report;
+       rx_report = dhdp->dbg->pkt_mon.rx_report;
+       if (!tx_report || !rx_report) {
+               DHD_PKT_MON(("%s(): tx_report=%p, rx_report=%p\n",
+                       __FUNCTION__, tx_report, rx_report));
+               DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+               return -EINVAL;
+       }
+
+       tx_pkt_state = dhdp->dbg->pkt_mon.tx_pkt_state;
+       tx_status_state = dhdp->dbg->pkt_mon.tx_status_state;
+       rx_pkt_state = dhdp->dbg->pkt_mon.rx_pkt_state;
+
+       /* Safe to free packets as state pkt_state is STARTING */
+       __dhd_dbg_free_tx_pkts(dhdp, tx_report->tx_pkts, tx_report->pkt_pos);
+
+       __dhd_dbg_free_rx_pkts(dhdp, rx_report->rx_pkts, rx_report->pkt_pos);
+
+       /* reset array postion */
+       tx_report->pkt_pos = 0;
+       tx_report->status_pos = 0;
+       dhdp->dbg->pkt_mon.tx_pkt_state = PKT_MON_STARTED;
+       dhdp->dbg->pkt_mon.tx_status_state = PKT_MON_STARTED;
+
+       rx_report->pkt_pos = 0;
+       dhdp->dbg->pkt_mon.rx_pkt_state = PKT_MON_STARTED;
+       DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+
+       DHD_PKT_MON(("%s(): packet monitor started\n", __FUNCTION__));
+       return BCME_OK;
+}
+
+int
+dhd_dbg_monitor_tx_pkts(dhd_pub_t *dhdp, void *pkt, uint32 pktid)
+{
+       dhd_dbg_tx_report_t *tx_report;
+       dhd_dbg_tx_info_t *tx_pkts;
+       dhd_dbg_pkt_mon_state_t tx_pkt_state;
+       uint32 pkt_hash, driver_ts;
+       uint16 pkt_pos;
+       unsigned long flags;
+
+       if (!dhdp || !dhdp->dbg) {
+               DHD_PKT_MON(("%s(): dhdp=%p, dhdp->dbg=%p\n", __FUNCTION__,
+                       dhdp, (dhdp ? dhdp->dbg : NULL)));
+               return -EINVAL;
+       }
+
+       DHD_PKT_MON_LOCK(dhdp->dbg->pkt_mon_lock, flags);
+       tx_pkt_state = dhdp->dbg->pkt_mon.tx_pkt_state;
+       if (PKT_MON_STARTED(tx_pkt_state)) {
+               tx_report = dhdp->dbg->pkt_mon.tx_report;
+               pkt_pos = tx_report->pkt_pos;
+
+               if (!PKT_MON_PKT_FULL(pkt_pos)) {
+                       tx_pkts = tx_report->tx_pkts;
+                       pkt_hash = __dhd_dbg_pkt_hash((uintptr_t)pkt, pktid);
+                       driver_ts = __dhd_dbg_driver_ts_usec();
+
+                       tx_pkts[pkt_pos].info.pkt = PKTDUP(dhdp->osh, pkt);
+                       tx_pkts[pkt_pos].info.pkt_len = PKTLEN(dhdp->osh, pkt);
+                       tx_pkts[pkt_pos].info.pkt_hash = pkt_hash;
+                       tx_pkts[pkt_pos].info.driver_ts = driver_ts;
+                       tx_pkts[pkt_pos].info.firmware_ts = 0U;
+                       tx_pkts[pkt_pos].info.payload_type = FRAME_TYPE_ETHERNET_II;
+                       tx_pkts[pkt_pos].fate = TX_PKT_FATE_DRV_QUEUED;
+
+                       tx_report->pkt_pos++;
+               } else {
+                       dhdp->dbg->pkt_mon.tx_pkt_state = PKT_MON_STOPPED;
+                       DHD_PKT_MON(("%s(): tx pkt logging stopped, reached "
+                               "max limit\n", __FUNCTION__));
+               }
+       }
+
+       DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+       return BCME_OK;
+}
+
+int
+dhd_dbg_monitor_tx_status(dhd_pub_t *dhdp, void *pkt, uint32 pktid,
+               uint16 status)
+{
+       dhd_dbg_tx_report_t *tx_report;
+       dhd_dbg_tx_info_t *tx_pkt;
+       dhd_dbg_pkt_mon_state_t tx_status_state;
+       wifi_tx_packet_fate pkt_fate;
+       uint32 pkt_hash, temp_hash;
+       uint16 pkt_pos, status_pos;
+       int16 count;
+       bool found = FALSE;
+       unsigned long flags;
+
+       if (!dhdp || !dhdp->dbg) {
+               DHD_PKT_MON(("%s(): dhdp=%p, dhdp->dbg=%p\n", __FUNCTION__,
+                       dhdp, (dhdp ? dhdp->dbg : NULL)));
+               return -EINVAL;
+       }
+
+       DHD_PKT_MON_LOCK(dhdp->dbg->pkt_mon_lock, flags);
+       tx_status_state = dhdp->dbg->pkt_mon.tx_status_state;
+       if (PKT_MON_STARTED(tx_status_state)) {
+               tx_report = dhdp->dbg->pkt_mon.tx_report;
+               pkt_pos = tx_report->pkt_pos;
+               status_pos = tx_report->status_pos;
+
+               if (!PKT_MON_STATUS_FULL(pkt_pos, status_pos)) {
+                       pkt_hash = __dhd_dbg_pkt_hash((uintptr_t)pkt, pktid);
+                       pkt_fate = __dhd_dbg_map_tx_status_to_pkt_fate(status);
+
+                       /* best bet (in-order tx completion) */
+                       count = status_pos;
+                       tx_pkt = (((dhd_dbg_tx_info_t *)tx_report->tx_pkts) + status_pos);
+                       while ((count < pkt_pos) && tx_pkt) {
+                               temp_hash = tx_pkt->info.pkt_hash;
+                               if (temp_hash == pkt_hash) {
+                                       tx_pkt->fate = pkt_fate;
+                                       tx_report->status_pos++;
+                                       found = TRUE;
+                                       break;
+                               }
+                               tx_pkt++;
+                               count++;
+                       }
+
+                       /* search until beginning (handles out-of-order completion) */
+                       if (!found) {
+                               count = status_pos - 1;
+                               tx_pkt = (((dhd_dbg_tx_info_t *)tx_report->tx_pkts) + count);
+                               while ((count >= 0) && tx_pkt) {
+                                       temp_hash = tx_pkt->info.pkt_hash;
+                                       if (temp_hash == pkt_hash) {
+                                               tx_pkt->fate = pkt_fate;
+                                               tx_report->status_pos++;
+                                               found = TRUE;
+                                               break;
+                                       }
+                                       tx_pkt--;
+                                       count--;
+                               }
+
+                               if (!found) {
+                                       /* still couldn't match tx_status */
+                                       DHD_INFO(("%s(): couldn't match tx_status, pkt_pos=%u, "
+                                               "status_pos=%u, pkt_fate=%u\n", __FUNCTION__,
+                                               pkt_pos, status_pos, pkt_fate));
+                               }
+                       }
+               } else {
+                       dhdp->dbg->pkt_mon.tx_status_state = PKT_MON_STOPPED;
+                       DHD_PKT_MON(("%s(): tx_status logging stopped, reached "
+                               "max limit\n", __FUNCTION__));
+               }
+       }
+
+       DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+       return BCME_OK;
+}
+
+int
+dhd_dbg_monitor_rx_pkts(dhd_pub_t *dhdp, void *pkt)
+{
+       dhd_dbg_rx_report_t *rx_report;
+       dhd_dbg_rx_info_t *rx_pkts;
+       dhd_dbg_pkt_mon_state_t rx_pkt_state;
+       uint32 driver_ts;
+       uint16 pkt_pos;
+       unsigned long flags;
+
+       if (!dhdp || !dhdp->dbg) {
+               DHD_PKT_MON(("%s(): dhdp=%p, dhdp->dbg=%p\n", __FUNCTION__,
+                       dhdp, (dhdp ? dhdp->dbg : NULL)));
+               return -EINVAL;
+       }
+
+       DHD_PKT_MON_LOCK(dhdp->dbg->pkt_mon_lock, flags);
+       rx_pkt_state = dhdp->dbg->pkt_mon.rx_pkt_state;
+       if (PKT_MON_STARTED(rx_pkt_state)) {
+               rx_report = dhdp->dbg->pkt_mon.rx_report;
+               pkt_pos = rx_report->pkt_pos;
+
+               if (!PKT_MON_PKT_FULL(pkt_pos)) {
+                       rx_pkts = rx_report->rx_pkts;
+                       driver_ts = __dhd_dbg_driver_ts_usec();
+
+                       rx_pkts[pkt_pos].info.pkt = PKTDUP(dhdp->osh, pkt);
+                       rx_pkts[pkt_pos].info.pkt_len = PKTLEN(dhdp->osh, pkt);
+                       rx_pkts[pkt_pos].info.pkt_hash = 0U;
+                       rx_pkts[pkt_pos].info.driver_ts = driver_ts;
+                       rx_pkts[pkt_pos].info.firmware_ts = 0U;
+                       rx_pkts[pkt_pos].info.payload_type = FRAME_TYPE_ETHERNET_II;
+                       rx_pkts[pkt_pos].fate = RX_PKT_FATE_SUCCESS;
+
+                       rx_report->pkt_pos++;
+               } else {
+                       dhdp->dbg->pkt_mon.rx_pkt_state = PKT_MON_STOPPED;
+                       DHD_PKT_MON(("%s(): rx pkt logging stopped, reached "
+                                       "max limit\n", __FUNCTION__));
+               }
+       }
+
+       DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+       return BCME_OK;
+}
+
+int
+dhd_dbg_stop_pkt_monitor(dhd_pub_t *dhdp)
+{
+       dhd_dbg_pkt_mon_state_t tx_pkt_state;
+       dhd_dbg_pkt_mon_state_t tx_status_state;
+       dhd_dbg_pkt_mon_state_t rx_pkt_state;
+       unsigned long flags;
+
+       if (!dhdp || !dhdp->dbg) {
+               DHD_PKT_MON(("%s(): dhdp=%p, dhdp->dbg=%p\n", __FUNCTION__,
+                       dhdp, (dhdp ? dhdp->dbg : NULL)));
+               return -EINVAL;
+       }
+
+       DHD_PKT_MON_LOCK(dhdp->dbg->pkt_mon_lock, flags);
+       tx_pkt_state = dhdp->dbg->pkt_mon.tx_pkt_state;
+       tx_status_state = dhdp->dbg->pkt_mon.tx_status_state;
+       rx_pkt_state = dhdp->dbg->pkt_mon.rx_pkt_state;
+
+       if (PKT_MON_DETACHED(tx_pkt_state) || PKT_MON_DETACHED(tx_status_state) ||
+                       PKT_MON_DETACHED(rx_pkt_state)) {
+               DHD_PKT_MON(("%s(): packet monitor is not yet enabled, "
+                       "tx_pkt_state=%d, tx_status_state=%d, rx_pkt_state=%d\n",
+                       __FUNCTION__, tx_pkt_state, tx_status_state, rx_pkt_state));
+               DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+               return -EINVAL;
+       }
+       dhdp->dbg->pkt_mon.tx_pkt_state = PKT_MON_STOPPED;
+       dhdp->dbg->pkt_mon.tx_status_state = PKT_MON_STOPPED;
+       dhdp->dbg->pkt_mon.rx_pkt_state = PKT_MON_STOPPED;
+       DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+
+       DHD_PKT_MON(("%s(): packet monitor stopped\n", __FUNCTION__));
+       return BCME_OK;
+}
+
+#define __COPY_TO_USER(to, from, n) \
+       do { \
+               int __ret; \
+               __ret = copy_to_user((void __user *)(to), (void *)(from), \
+                               (unsigned long)(n)); \
+               if (unlikely(__ret)) { \
+                       DHD_ERROR(("%s():%d: copy_to_user failed, ret=%d\n", \
+                               __FUNCTION__, __LINE__, __ret)); \
+                       return __ret; \
+               } \
+       } while (0);
+
+int
+dhd_dbg_monitor_get_tx_pkts(dhd_pub_t *dhdp, void __user *user_buf,
+               uint16 req_count, uint16 *resp_count)
+{
+       dhd_dbg_tx_report_t *tx_report;
+       dhd_dbg_tx_info_t *tx_pkt;
+       wifi_tx_report_t *ptr;
+       compat_wifi_tx_report_t *cptr;
+       dhd_dbg_pkt_mon_state_t tx_pkt_state;
+       dhd_dbg_pkt_mon_state_t tx_status_state;
+       uint16 pkt_count, count;
+       unsigned long flags;
+
+       BCM_REFERENCE(ptr);
+       BCM_REFERENCE(cptr);
+
+       if (!dhdp || !dhdp->dbg) {
+               DHD_PKT_MON(("%s(): dhdp=%p, dhdp->dbg=%p\n", __FUNCTION__,
+                       dhdp, (dhdp ? dhdp->dbg : NULL)));
+               return -EINVAL;
+       }
+
+       DHD_PKT_MON_LOCK(dhdp->dbg->pkt_mon_lock, flags);
+       tx_pkt_state = dhdp->dbg->pkt_mon.tx_pkt_state;
+       tx_status_state = dhdp->dbg->pkt_mon.tx_status_state;
+       if (PKT_MON_DETACHED(tx_pkt_state) || PKT_MON_DETACHED(tx_status_state)) {
+               DHD_PKT_MON(("%s(): packet monitor is not yet enabled, "
+                       "tx_pkt_state=%d, tx_status_state=%d\n", __FUNCTION__,
+                       tx_pkt_state, tx_status_state));
+               DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+               return -EINVAL;
+       }
+
+       count = 0;
+       tx_report = dhdp->dbg->pkt_mon.tx_report;
+       tx_pkt = tx_report->tx_pkts;
+       pkt_count = MIN(req_count, tx_report->status_pos);
+
+#ifdef CONFIG_COMPAT
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 6, 0))
+       if (in_compat_syscall())
+#else
+       if (is_compat_task())
+#endif
+       {
+               cptr = (compat_wifi_tx_report_t *)user_buf;
+               while ((count < pkt_count) && tx_pkt && cptr) {
+                       compat_wifi_tx_report_t *comp_ptr = compat_ptr((uintptr_t) cptr);
+                       compat_dhd_dbg_pkt_info_t compat_tx_pkt;
+                       __dhd_dbg_dump_tx_pkt_info(dhdp, tx_pkt, count);
+                       __COPY_TO_USER(&comp_ptr->fate, &tx_pkt->fate, sizeof(tx_pkt->fate));
+
+                       compat_tx_pkt.payload_type = tx_pkt->info.payload_type;
+                       compat_tx_pkt.pkt_len = tx_pkt->info.pkt_len;
+                       compat_tx_pkt.driver_ts = tx_pkt->info.driver_ts;
+                       compat_tx_pkt.firmware_ts = tx_pkt->info.firmware_ts;
+                       compat_tx_pkt.pkt_hash = tx_pkt->info.pkt_hash;
+                       __COPY_TO_USER(&comp_ptr->frame_inf.payload_type,
+                               &compat_tx_pkt.payload_type,
+                               OFFSETOF(compat_dhd_dbg_pkt_info_t, pkt_hash));
+                       __COPY_TO_USER(comp_ptr->frame_inf.frame_content.ethernet_ii,
+                               PKTDATA(dhdp->osh, tx_pkt->info.pkt), tx_pkt->info.pkt_len);
+
+                       cptr++;
+                       tx_pkt++;
+                       count++;
+               }
+       } else
+#endif /* CONFIG_COMPAT */
+       {
+               ptr = (wifi_tx_report_t *)user_buf;
+               while ((count < pkt_count) && tx_pkt && ptr) {
+                       __dhd_dbg_dump_tx_pkt_info(dhdp, tx_pkt, count);
+                       __COPY_TO_USER(&ptr->fate, &tx_pkt->fate, sizeof(tx_pkt->fate));
+                       __COPY_TO_USER(&ptr->frame_inf.payload_type,
+                               &tx_pkt->info.payload_type,
+                               OFFSETOF(dhd_dbg_pkt_info_t, pkt_hash));
+                       __COPY_TO_USER(ptr->frame_inf.frame_content.ethernet_ii,
+                               PKTDATA(dhdp->osh, tx_pkt->info.pkt), tx_pkt->info.pkt_len);
+
+                       ptr++;
+                       tx_pkt++;
+                       count++;
+               }
+       }
+       *resp_count = pkt_count;
+
+       DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+       if (!pkt_count) {
+               DHD_ERROR(("%s(): no tx_status in tx completion messages, "
+                       "make sure that 'd11status' is enabled in firmware, "
+                       "status_pos=%u\n", __FUNCTION__, pkt_count));
+       }
+
+       return BCME_OK;
+}
+
+int
+dhd_dbg_monitor_get_rx_pkts(dhd_pub_t *dhdp, void __user *user_buf,
+               uint16 req_count, uint16 *resp_count)
+{
+       dhd_dbg_rx_report_t *rx_report;
+       dhd_dbg_rx_info_t *rx_pkt;
+       wifi_rx_report_t *ptr;
+       compat_wifi_rx_report_t *cptr;
+       dhd_dbg_pkt_mon_state_t rx_pkt_state;
+       uint16 pkt_count, count;
+       unsigned long flags;
+
+       BCM_REFERENCE(ptr);
+       BCM_REFERENCE(cptr);
+
+       if (!dhdp || !dhdp->dbg) {
+               DHD_PKT_MON(("%s(): dhdp=%p, dhdp->dbg=%p\n", __FUNCTION__,
+                       dhdp, (dhdp ? dhdp->dbg : NULL)));
+               return -EINVAL;
+       }
+
+       DHD_PKT_MON_LOCK(dhdp->dbg->pkt_mon_lock, flags);
+       rx_pkt_state = dhdp->dbg->pkt_mon.rx_pkt_state;
+       if (PKT_MON_DETACHED(rx_pkt_state)) {
+               DHD_PKT_MON(("%s(): packet fetch is not allowed , "
+                       "rx_pkt_state=%d\n", __FUNCTION__, rx_pkt_state));
+               DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+               return -EINVAL;
+       }
+
+       count = 0;
+       rx_report = dhdp->dbg->pkt_mon.rx_report;
+       rx_pkt = rx_report->rx_pkts;
+       pkt_count = MIN(req_count, rx_report->pkt_pos);
+
+#ifdef CONFIG_COMPAT
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 6, 0))
+       if (in_compat_syscall())
+#else
+       if (is_compat_task())
+#endif
+       {
+               cptr = (compat_wifi_rx_report_t *)user_buf;
+               while ((count < pkt_count) && rx_pkt && cptr) {
+                       compat_wifi_rx_report_t *comp_ptr = compat_ptr((uintptr_t) cptr);
+                       compat_dhd_dbg_pkt_info_t compat_rx_pkt;
+                       __dhd_dbg_dump_rx_pkt_info(dhdp, rx_pkt, count);
+                       __COPY_TO_USER(&comp_ptr->fate, &rx_pkt->fate, sizeof(rx_pkt->fate));
+
+                       compat_rx_pkt.payload_type = rx_pkt->info.payload_type;
+                       compat_rx_pkt.pkt_len = rx_pkt->info.pkt_len;
+                       compat_rx_pkt.driver_ts = rx_pkt->info.driver_ts;
+                       compat_rx_pkt.firmware_ts = rx_pkt->info.firmware_ts;
+                       compat_rx_pkt.pkt_hash = rx_pkt->info.pkt_hash;
+                       __COPY_TO_USER(&comp_ptr->frame_inf.payload_type,
+                               &compat_rx_pkt.payload_type,
+                               OFFSETOF(compat_dhd_dbg_pkt_info_t, pkt_hash));
+                       __COPY_TO_USER(comp_ptr->frame_inf.frame_content.ethernet_ii,
+                               PKTDATA(dhdp->osh, rx_pkt->info.pkt), rx_pkt->info.pkt_len);
+
+                       cptr++;
+                       rx_pkt++;
+                       count++;
+               }
+       } else
+#endif /* CONFIG_COMPAT */
+       {
+               ptr = (wifi_rx_report_t *)user_buf;
+               while ((count < pkt_count) && rx_pkt && ptr) {
+                       __dhd_dbg_dump_rx_pkt_info(dhdp, rx_pkt, count);
+
+                       __COPY_TO_USER(&ptr->fate, &rx_pkt->fate, sizeof(rx_pkt->fate));
+                       __COPY_TO_USER(&ptr->frame_inf.payload_type,
+                               &rx_pkt->info.payload_type,
+                               OFFSETOF(dhd_dbg_pkt_info_t, pkt_hash));
+                       __COPY_TO_USER(ptr->frame_inf.frame_content.ethernet_ii,
+                               PKTDATA(dhdp->osh, rx_pkt->info.pkt), rx_pkt->info.pkt_len);
+
+                       ptr++;
+                       rx_pkt++;
+                       count++;
+               }
+       }
+
+       *resp_count = pkt_count;
+       DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+
+       return BCME_OK;
+}
+
+int
+dhd_dbg_detach_pkt_monitor(dhd_pub_t *dhdp)
+{
+       dhd_dbg_tx_report_t *tx_report;
+       dhd_dbg_rx_report_t *rx_report;
+       dhd_dbg_pkt_mon_state_t tx_pkt_state;
+       dhd_dbg_pkt_mon_state_t tx_status_state;
+       dhd_dbg_pkt_mon_state_t rx_pkt_state;
+       unsigned long flags;
+
+       if (!dhdp || !dhdp->dbg) {
+               DHD_PKT_MON(("%s(): dhdp=%p, dhdp->dbg=%p\n", __FUNCTION__,
+                       dhdp, (dhdp ? dhdp->dbg : NULL)));
+               return -EINVAL;
+       }
+
+       DHD_PKT_MON_LOCK(dhdp->dbg->pkt_mon_lock, flags);
+       tx_pkt_state = dhdp->dbg->pkt_mon.tx_pkt_state;
+       tx_status_state = dhdp->dbg->pkt_mon.tx_status_state;
+       rx_pkt_state = dhdp->dbg->pkt_mon.rx_pkt_state;
+
+       if (PKT_MON_DETACHED(tx_pkt_state) || PKT_MON_DETACHED(tx_status_state) ||
+                       PKT_MON_DETACHED(rx_pkt_state)) {
+               DHD_PKT_MON(("%s(): packet monitor is already detached, "
+                       "tx_pkt_state=%d, tx_status_state=%d, rx_pkt_state=%d\n",
+                       __FUNCTION__, tx_pkt_state, tx_status_state, rx_pkt_state));
+               DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+               return -EINVAL;
+       }
+
+       tx_report = dhdp->dbg->pkt_mon.tx_report;
+       rx_report = dhdp->dbg->pkt_mon.rx_report;
+
+       /* free and de-initalize tx packet monitoring */
+       dhdp->dbg->pkt_mon.tx_pkt_state = PKT_MON_DETACHED;
+       dhdp->dbg->pkt_mon.tx_status_state = PKT_MON_DETACHED;
+       if (tx_report) {
+               if (tx_report->tx_pkts) {
+                       __dhd_dbg_free_tx_pkts(dhdp, tx_report->tx_pkts,
+                               tx_report->pkt_pos);
+                       MFREE(dhdp->osh, tx_report->tx_pkts,
+                               (sizeof(*tx_report->tx_pkts) * MAX_FATE_LOG_LEN));
+                       dhdp->dbg->pkt_mon.tx_report->tx_pkts = NULL;
+               }
+               MFREE(dhdp->osh, tx_report, sizeof(*tx_report));
+               dhdp->dbg->pkt_mon.tx_report = NULL;
+       }
+       dhdp->dbg->pkt_mon.tx_pkt_mon = NULL;
+       dhdp->dbg->pkt_mon.tx_status_mon = NULL;
+
+       /* free and de-initalize rx packet monitoring */
+       dhdp->dbg->pkt_mon.rx_pkt_state = PKT_MON_DETACHED;
+       if (rx_report) {
+               if (rx_report->rx_pkts) {
+                       __dhd_dbg_free_rx_pkts(dhdp, rx_report->rx_pkts,
+                               rx_report->pkt_pos);
+                       MFREE(dhdp->osh, rx_report->rx_pkts,
+                               (sizeof(*rx_report->rx_pkts) * MAX_FATE_LOG_LEN));
+                       dhdp->dbg->pkt_mon.rx_report->rx_pkts = NULL;
+               }
+               MFREE(dhdp->osh, rx_report, sizeof(*rx_report));
+               dhdp->dbg->pkt_mon.rx_report = NULL;
+       }
+       dhdp->dbg->pkt_mon.rx_pkt_mon = NULL;
+
+       DHD_PKT_MON_UNLOCK(dhdp->dbg->pkt_mon_lock, flags);
+       DHD_PKT_MON(("%s(): packet monitor detach succeeded\n", __FUNCTION__));
+       return BCME_OK;
+}
+#endif /* DBG_PKT_MON */
+
+#if defined(DBG_PKT_MON) || defined(DHD_PKT_LOGGING)
+/*
+ * XXX: WAR: Because of the overloading by DMA marker field,
+ * tx_status in TX completion message cannot be used. As a WAR,
+ * send d11 tx_status through unused status field of PCIe
+ * completion header.
+ */
+bool
+dhd_dbg_process_tx_status(dhd_pub_t *dhdp, void *pkt, uint32 pktid,
+               uint16 status)
+{
+       bool pkt_fate = TRUE;
+       if (dhdp->d11_tx_status) {
+               pkt_fate = (status == WLFC_CTL_PKTFLAG_DISCARD) ? TRUE : FALSE;
+               DHD_DBG_PKT_MON_TX_STATUS(dhdp, pkt, pktid, status);
+       }
+       return pkt_fate;
+}
+#else /* DBG_PKT_MON || DHD_PKT_LOGGING */
+bool
+dhd_dbg_process_tx_status(dhd_pub_t *dhdp, void *pkt,
+               uint32 pktid, uint16 status)
+{
+       return TRUE;
+}
+#endif /* DBG_PKT_MON || DHD_PKT_LOGGING */
+
+#define        EL_LOG_STR_LEN  512
+
+#define PRINT_CHN_PER_LINE 8
+#define PRINT_CHAN_LINE(cnt) \
+{\
+       cnt ++; \
+       if (cnt >= PRINT_CHN_PER_LINE) { \
+               DHD_ERROR(("%s\n", b.origbuf)); \
+               bcm_binit(&b, pr_buf, EL_LOG_STR_LEN); \
+               bcm_bprintf(&b, "%s: ", prefix); \
+               cnt = 0; \
+       } \
+}
+
+void print_roam_chan_list(char *prefix, uint chan_num, uint16 band_2g,
+       uint16 uni2a, uint8 uni3, uint8 *uni2c)
+{
+       struct bcmstrbuf b;
+       char pr_buf[EL_LOG_STR_LEN] = { 0 };
+       int cnt = 0;
+       int idx, idx2;
+
+       bcm_binit(&b, pr_buf, EL_LOG_STR_LEN);
+       bcm_bprintf(&b, "%s: count(%d)", prefix, chan_num);
+       /* 2G channnels */
+       for (idx = 0; idx < NBITS(uint16); idx++) {
+               if (BCM_BIT(idx) & band_2g) {
+                       bcm_bprintf(&b, " %d", idx);
+                       PRINT_CHAN_LINE(cnt);
+
+               }
+       }
+
+       /* 5G UNII BAND 1, UNII BAND 2A */
+       for (idx = 0; idx < NBITS(uint16); idx++) {
+               if (BCM_BIT(idx) & uni2a) {
+                       bcm_bprintf(&b, " %u", ROAM_CHN_UNI_2A + idx * ROAM_CHN_SPACE);
+                       PRINT_CHAN_LINE(cnt);
+               }
+       }
+
+       /* 5G UNII BAND 2C */
+       for (idx2 = 0; idx2 < 3; idx2++) {
+               for (idx = 0; idx < NBITS(uint8); idx++) {
+                       if (BCM_BIT(idx) & uni2c[idx2]) {
+                               bcm_bprintf(&b, " %u", ROAM_CHN_UNI_2C +
+                                       idx2 * ROAM_CHN_SPACE * NBITS(uint8) +
+                                       idx * ROAM_CHN_SPACE);
+                               PRINT_CHAN_LINE(cnt);
+                       }
+               }
+       }
+
+       /* 5G UNII BAND 3 */
+       for (idx = 0; idx < NBITS(uint8); idx++) {
+               if (BCM_BIT(idx) & uni3) {
+                       bcm_bprintf(&b, " %u", ROAM_CHN_UNI_3 + idx * ROAM_CHN_SPACE);
+                       PRINT_CHAN_LINE(cnt);
+               }
+       }
+
+       if (cnt != 0) {
+               DHD_ERROR(("%s\n", b.origbuf));
+       }
+}
+
+void pr_roam_scan_start_v1(prcd_event_log_hdr_t *plog_hdr);
+void pr_roam_scan_cmpl_v1(prcd_event_log_hdr_t *plog_hdr);
+void pr_roam_cmpl_v1(prcd_event_log_hdr_t *plog_hdr);
+void pr_roam_nbr_req_v1(prcd_event_log_hdr_t *plog_hdr);
+void pr_roam_nbr_rep_v1(prcd_event_log_hdr_t *plog_hdr);
+void pr_roam_bcn_req_v1(prcd_event_log_hdr_t *plog_hdr);
+void pr_roam_bcn_rep_v1(prcd_event_log_hdr_t *plog_hdr);
+
+void pr_roam_scan_start_v2(prcd_event_log_hdr_t *plog_hdr);
+void pr_roam_scan_cmpl_v2(prcd_event_log_hdr_t *plog_hdr);
+void pr_roam_nbr_rep_v2(prcd_event_log_hdr_t *plog_hdr);
+void pr_roam_bcn_rep_v2(prcd_event_log_hdr_t *plog_hdr);
+void pr_roam_btm_rep_v2(prcd_event_log_hdr_t *plog_hdr);
+
+void pr_roam_bcn_req_v3(prcd_event_log_hdr_t *plog_hdr);
+void pr_roam_bcn_rep_v3(prcd_event_log_hdr_t *plog_hdr);
+void pr_roam_btm_rep_v3(prcd_event_log_hdr_t *plog_hdr);
+
+static const pr_roam_tbl_t roam_log_print_tbl[] =
+{
+       {ROAM_LOG_VER_1, ROAM_LOG_SCANSTART, pr_roam_scan_start_v1},
+       {ROAM_LOG_VER_1, ROAM_LOG_SCAN_CMPLT, pr_roam_scan_cmpl_v1},
+       {ROAM_LOG_VER_1, ROAM_LOG_ROAM_CMPLT, pr_roam_cmpl_v1},
+       {ROAM_LOG_VER_1, ROAM_LOG_NBR_REQ, pr_roam_nbr_req_v1},
+       {ROAM_LOG_VER_1, ROAM_LOG_NBR_REP, pr_roam_nbr_rep_v1},
+       {ROAM_LOG_VER_1, ROAM_LOG_BCN_REQ, pr_roam_bcn_req_v1},
+       {ROAM_LOG_VER_1, ROAM_LOG_BCN_REP, pr_roam_bcn_rep_v1},
+
+       {ROAM_LOG_VER_2, ROAM_LOG_SCANSTART, pr_roam_scan_start_v2},
+       {ROAM_LOG_VER_2, ROAM_LOG_SCAN_CMPLT, pr_roam_scan_cmpl_v2},
+       {ROAM_LOG_VER_2, ROAM_LOG_ROAM_CMPLT, pr_roam_cmpl_v1},
+       {ROAM_LOG_VER_2, ROAM_LOG_NBR_REQ, pr_roam_nbr_req_v1},
+       {ROAM_LOG_VER_2, ROAM_LOG_NBR_REP, pr_roam_nbr_rep_v2},
+       {ROAM_LOG_VER_2, ROAM_LOG_BCN_REQ, pr_roam_bcn_req_v1},
+       {ROAM_LOG_VER_2, ROAM_LOG_BCN_REP, pr_roam_bcn_rep_v2},
+       {ROAM_LOG_VER_2, ROAM_LOG_BTM_REP, pr_roam_btm_rep_v2},
+
+       {ROAM_LOG_VER_3, ROAM_LOG_SCANSTART, pr_roam_scan_start_v2},
+       {ROAM_LOG_VER_3, ROAM_LOG_SCAN_CMPLT, pr_roam_scan_cmpl_v2},
+       {ROAM_LOG_VER_3, ROAM_LOG_ROAM_CMPLT, pr_roam_cmpl_v1},
+       {ROAM_LOG_VER_3, ROAM_LOG_NBR_REQ, pr_roam_nbr_req_v1},
+       {ROAM_LOG_VER_3, ROAM_LOG_NBR_REP, pr_roam_nbr_rep_v2},
+       {ROAM_LOG_VER_3, ROAM_LOG_BCN_REQ, pr_roam_bcn_req_v3},
+       {ROAM_LOG_VER_3, ROAM_LOG_BCN_REP, pr_roam_bcn_rep_v3},
+       {ROAM_LOG_VER_3, ROAM_LOG_BTM_REP, pr_roam_btm_rep_v3},
+
+       {0, PRSV_PERIODIC_ID_MAX, NULL}
+
+};
+
+void pr_roam_scan_start_v1(prcd_event_log_hdr_t *plog_hdr)
+{
+       roam_log_trig_v1_t *log = (roam_log_trig_v1_t *)plog_hdr->log_ptr;
+
+       DHD_ERROR(("ROAM_LOG_SCANSTART time: %d,"
+               " version:%d reason: %d rssi:%d cu:%d result:%d\n",
+               plog_hdr->armcycle, log->hdr.version, log->reason,
+               log->rssi, log->current_cu, log->result));
+       if (log->reason == WLC_E_REASON_DEAUTH ||
+               log->reason == WLC_E_REASON_DISASSOC) {
+               DHD_ERROR(("  ROAM_LOG_PRT_ROAM: RCVD reason:%d\n",
+                       log->prt_roam.rcvd_reason));
+       } else if (log->reason == WLC_E_REASON_BSSTRANS_REQ) {
+               DHD_ERROR(("  ROAM_LOG_BSS_REQ: mode:%d candidate:%d token:%d "
+                       "duration disassoc:%d valid:%d term:%d\n",
+                       log->bss_trans.req_mode, log->bss_trans.nbrlist_size,
+                       log->bss_trans.token, log->bss_trans.disassoc_dur,
+                       log->bss_trans.validity_dur, log->bss_trans.bss_term_dur));
+       }
+}
+
+void pr_roam_scan_cmpl_v1(prcd_event_log_hdr_t *plog_hdr)
+{
+       roam_log_scan_cmplt_v1_t *log = (roam_log_scan_cmplt_v1_t *)plog_hdr->log_ptr;
+       char chanspec_buf[CHANSPEC_STR_LEN];
+       int i;
+
+       DHD_ERROR(("ROAM_LOG_SCAN_CMPL: time:%d version:%d"
+               "is_full:%d scan_count:%d score_delta:%d",
+               plog_hdr->armcycle, log->hdr.version, log->full_scan,
+               log->scan_count, log->score_delta));
+       DHD_ERROR(("  ROAM_LOG_CUR_AP: " MACDBG "rssi:%d score:%d channel:%s\n",
+                       MAC2STRDBG((uint8 *)&log->cur_info.addr),
+                       log->cur_info.rssi,
+                       log->cur_info.score,
+                       wf_chspec_ntoa_ex(log->cur_info.chanspec, chanspec_buf)));
+       for (i = 0; i < log->scan_list_size; i++) {
+               DHD_ERROR(("  ROAM_LOG_CANDIDATE %d: " MACDBG
+                       "rssi:%d score:%d channel:%s TPUT:%dkbps\n",
+                       i, MAC2STRDBG((uint8 *)&log->scan_list[i].addr),
+                       log->scan_list[i].rssi, log->scan_list[i].score,
+                       wf_chspec_ntoa_ex(log->scan_list[i].chanspec,
+                       chanspec_buf),
+                       log->scan_list[i].estm_tput != ROAM_LOG_INVALID_TPUT?
+                       log->scan_list[i].estm_tput:0));
+       }
+}
+
+void pr_roam_cmpl_v1(prcd_event_log_hdr_t *plog_hdr)
+{
+       roam_log_cmplt_v1_t *log = (roam_log_cmplt_v1_t *)plog_hdr->log_ptr;
+       char chanspec_buf[CHANSPEC_STR_LEN];
+
+       DHD_ERROR(("ROAM_LOG_ROAM_CMPL: time: %d, version:%d"
+               "status: %d reason: %d channel:%s retry:%d " MACDBG "\n",
+               plog_hdr->armcycle, log->hdr.version, log->status, log->reason,
+               wf_chspec_ntoa_ex(log->chanspec, chanspec_buf),
+               log->retry, MAC2STRDBG((uint8 *)&log->addr)));
+}
+
+void pr_roam_nbr_req_v1(prcd_event_log_hdr_t *plog_hdr)
+{
+       roam_log_nbrreq_v1_t *log = (roam_log_nbrreq_v1_t *)plog_hdr->log_ptr;
+
+       DHD_ERROR(("ROAM_LOG_NBR_REQ: time: %d, version:%d token:%d\n",
+               plog_hdr->armcycle, log->hdr.version, log->token));
+}
+
+void pr_roam_nbr_rep_v1(prcd_event_log_hdr_t *plog_hdr)
+{
+       roam_log_nbrrep_v1_t *log = (roam_log_nbrrep_v1_t *)plog_hdr->log_ptr;
+
+       DHD_ERROR(("ROAM_LOG_NBR_REP: time:%d, veresion:%d chan_num:%d\n",
+               plog_hdr->armcycle, log->hdr.version, log->channel_num));
+}
+
+void pr_roam_bcn_req_v1(prcd_event_log_hdr_t *plog_hdr)
+{
+       roam_log_bcnrpt_req_v1_t *log = (roam_log_bcnrpt_req_v1_t *)plog_hdr->log_ptr;
+
+       DHD_ERROR(("ROAM_LOG_BCN_REQ: time:%d, version:%d ret:%d"
+               "class:%d num_chan:%d ",
+               plog_hdr->armcycle, log->hdr.version,
+               log->result, log->reg, log->channel));
+       DHD_ERROR(("ROAM_LOG_BCN_REQ: mode:%d is_wild:%d duration:%d"
+               "ssid_len:%d\n", log->mode, log->bssid_wild,
+               log->duration, log->ssid_len));
+}
+
+void pr_roam_bcn_rep_v1(prcd_event_log_hdr_t *plog_hdr)
+{
+       roam_log_bcnrpt_rep_v1_t *log = (roam_log_bcnrpt_rep_v1_t *)plog_hdr->log_ptr;
+       DHD_ERROR(("ROAM_LOG_BCN_REP: time:%d, verseion:%d count:%d\n",
+               plog_hdr->armcycle, log->hdr.version,
+               log->count));
+}
+
+void pr_roam_scan_start_v2(prcd_event_log_hdr_t *plog_hdr)
+{
+       roam_log_trig_v2_t *log = (roam_log_trig_v2_t *)plog_hdr->log_ptr;
+       DHD_ERROR(("ROAM_LOG_SCANSTART time: %d,"
+               " version:%d reason: %d rssi:%d cu:%d result:%d full_scan:%d\n",
+               plog_hdr->armcycle, log->hdr.version, log->reason,
+               log->rssi, log->current_cu, log->result,
+               log->result?(-1):log->full_scan));
+       if (log->reason == WLC_E_REASON_DEAUTH ||
+               log->reason == WLC_E_REASON_DISASSOC) {
+               DHD_ERROR(("  ROAM_LOG_PRT_ROAM: RCVD reason:%d\n",
+                       log->prt_roam.rcvd_reason));
+       } else if (log->reason == WLC_E_REASON_BSSTRANS_REQ) {
+               DHD_ERROR(("  ROAM_LOG_BSS_REQ: mode:%d candidate:%d token:%d "
+                       "duration disassoc:%d valid:%d term:%d\n",
+                       log->bss_trans.req_mode, log->bss_trans.nbrlist_size,
+                       log->bss_trans.token, log->bss_trans.disassoc_dur,
+                       log->bss_trans.validity_dur, log->bss_trans.bss_term_dur));
+       } else if (log->reason == WLC_E_REASON_LOW_RSSI) {
+               DHD_ERROR((" ROAM_LOG_LOW_RSSI: threshold:%d\n",
+                       log->low_rssi.rssi_threshold));
+       }
+}
+
+void pr_roam_scan_cmpl_v2(prcd_event_log_hdr_t *plog_hdr)
+{
+       int i;
+       roam_log_scan_cmplt_v2_t *log = (roam_log_scan_cmplt_v2_t *)plog_hdr->log_ptr;
+       char chanspec_buf[CHANSPEC_STR_LEN];
+
+       DHD_ERROR(("ROAM_LOG_SCAN_CMPL: time:%d version:%d"
+               "scan_count:%d score_delta:%d",
+               plog_hdr->armcycle, log->hdr.version,
+               log->scan_count, log->score_delta));
+       DHD_ERROR(("  ROAM_LOG_CUR_AP: " MACDBG "rssi:%d score:%d channel:%s\n",
+                       MAC2STRDBG((uint8 *)&log->cur_info.addr),
+                       log->cur_info.rssi,
+                       log->cur_info.score,
+                       wf_chspec_ntoa_ex(log->cur_info.chanspec, chanspec_buf)));
+       for (i = 0; i < log->scan_list_size; i++) {
+               DHD_ERROR(("  ROAM_LOG_CANDIDATE %d: " MACDBG
+                       "rssi:%d score:%d cu :%d channel:%s TPUT:%dkbps\n",
+                       i, MAC2STRDBG((uint8 *)&log->scan_list[i].addr),
+                       log->scan_list[i].rssi, log->scan_list[i].score,
+                       log->scan_list[i].cu * 100 / WL_MAX_CHANNEL_USAGE,
+                       wf_chspec_ntoa_ex(log->scan_list[i].chanspec,
+                       chanspec_buf),
+                       log->scan_list[i].estm_tput != ROAM_LOG_INVALID_TPUT?
+                       log->scan_list[i].estm_tput:0));
+       }
+       if (log->chan_num != 0) {
+               print_roam_chan_list("ROAM_LOG_SCAN_CHANLIST", log->chan_num,
+                       log->band2g_chan_list, log->uni2a_chan_list,
+                       log->uni3_chan_list, log->uni2c_chan_list);
+       }
+
+}
+
+void pr_roam_nbr_rep_v2(prcd_event_log_hdr_t *plog_hdr)
+{
+       roam_log_nbrrep_v2_t *log = (roam_log_nbrrep_v2_t *)plog_hdr->log_ptr;
+       DHD_ERROR(("ROAM_LOG_NBR_REP: time:%d, veresion:%d chan_num:%d\n",
+               plog_hdr->armcycle, log->hdr.version, log->channel_num));
+       if (log->channel_num != 0) {
+               print_roam_chan_list("ROAM_LOG_NBR_REP_CHANLIST", log->channel_num,
+                       log->band2g_chan_list, log->uni2a_chan_list,
+                       log->uni3_chan_list, log->uni2c_chan_list);
+       }
+}
+
+void pr_roam_bcn_rep_v2(prcd_event_log_hdr_t *plog_hdr)
+{
+       roam_log_bcnrpt_rep_v2_t *log = (roam_log_bcnrpt_rep_v2_t *)plog_hdr->log_ptr;
+
+       DHD_ERROR(("ROAM_LOG_BCN_REP: time:%d, verseion:%d count:%d mode:%d\n",
+               plog_hdr->armcycle, log->hdr.version,
+               log->count, log->reason));
+}
+
+void pr_roam_btm_rep_v2(prcd_event_log_hdr_t *plog_hdr)
+{
+       roam_log_btm_rep_v2_t *log = (roam_log_btm_rep_v2_t *)plog_hdr->log_ptr;
+       DHD_ERROR(("ROAM_LOG_BTM_REP: time:%d version:%d req_mode:%d "
+               "status:%d ret:%d\n",
+               plog_hdr->armcycle, log->hdr.version,
+               log->req_mode, log->status, log->result));
+}
+
+void pr_roam_bcn_req_v3(prcd_event_log_hdr_t *plog_hdr)
+{
+       roam_log_bcnrpt_req_v3_t *log = (roam_log_bcnrpt_req_v3_t *)plog_hdr->log_ptr;
+
+       DHD_ERROR(("ROAM_LOG_BCN_REQ: time:%d, version:%d ret:%d"
+               "class:%d %s ",
+               plog_hdr->armcycle, log->hdr.version,
+               log->result, log->reg, log->channel?"":"all_chan"));
+       DHD_ERROR(("ROAM_LOG_BCN_REQ: mode:%d is_wild:%d duration:%d"
+               "ssid_len:%d\n", log->mode, log->bssid_wild,
+               log->duration, log->ssid_len));
+       if (log->channel_num != 0) {
+               print_roam_chan_list("ROAM_LOG_BCNREQ_SCAN_CHANLIST", log->channel_num,
+                       log->band2g_chan_list, log->uni2a_chan_list,
+                       log->uni3_chan_list, log->uni2c_chan_list);
+       }
+}
+
+static const char*
+pr_roam_bcn_rep_reason(uint16 reason_detail)
+{
+       static const char* reason_tbl[] = {
+               "BCNRPT_RSN_SUCCESS",
+               "BCNRPT_RSN_BADARG",
+               "BCNRPT_RSN_SCAN_ING",
+               "BCNRPT_RSN_SCAN_FAIL",
+               "UNKNOWN"
+       };
+
+       if (reason_detail >= ARRAYSIZE(reason_tbl)) {
+               DHD_ERROR(("UNKNOWN Reason:%u\n", reason_detail));
+               ASSERT(0);
+               reason_detail = ARRAYSIZE(reason_tbl) - 1;
+
+       }
+       return reason_tbl[reason_detail];
+}
+
+void pr_roam_bcn_rep_v3(prcd_event_log_hdr_t *plog_hdr)
+{
+       roam_log_bcnrpt_rep_v3_t *log = (roam_log_bcnrpt_rep_v3_t *)plog_hdr->log_ptr;
+
+       DHD_ERROR(("ROAM_LOG_BCN_REP: time:%d, verseion:%d count:%d mode:%d\n",
+               plog_hdr->armcycle, log->hdr.version,
+               log->count, log->reason));
+       DHD_ERROR(("ROAM_LOG_BCN_REP: mode reason(%d):%s scan_stus:%u duration:%u\n",
+               log->reason_detail, pr_roam_bcn_rep_reason(log->reason_detail),
+               (log->reason_detail == BCNRPT_RSN_SCAN_FAIL)? log->scan_status:0,
+               log->duration));
+}
+
+void pr_roam_btm_rep_v3(prcd_event_log_hdr_t *plog_hdr)
+{
+       roam_log_btm_rep_v3_t *log = (roam_log_btm_rep_v3_t *)plog_hdr->log_ptr;
+       DHD_ERROR(("ROAM_LOG_BTM_REP: time:%d version:%d req_mode:%d "
+               "status:%d ret:%d target:" MACDBG "\n",
+               plog_hdr->armcycle, log->hdr.version,
+               log->req_mode, log->status, log->result,
+               MAC2STRDBG((uint8 *)&log->target_addr)));
+}
+
+void
+print_roam_enhanced_log(prcd_event_log_hdr_t *plog_hdr)
+{
+       prsv_periodic_log_hdr_t *hdr = (prsv_periodic_log_hdr_t *)plog_hdr->log_ptr;
+       uint32 *ptr = (uint32 *)plog_hdr->log_ptr;
+       int i;
+       int loop_cnt = hdr->length / sizeof(uint32);
+       struct bcmstrbuf b;
+       char pr_buf[EL_LOG_STR_LEN] = { 0 };
+       const pr_roam_tbl_t *cur_elem = &roam_log_print_tbl[0];
+
+       while (cur_elem && cur_elem->pr_func) {
+               if (hdr->version == cur_elem->version &&
+                       hdr->id == cur_elem->id) {
+                       cur_elem->pr_func(plog_hdr);
+                       return;
+               }
+               cur_elem++;
+       }
+
+       bcm_binit(&b, pr_buf, EL_LOG_STR_LEN);
+       bcm_bprintf(&b, "ROAM_LOG_UNKNOWN ID:%d ver:%d armcycle:%d",
+               hdr->id, hdr->version, plog_hdr->armcycle);
+       for (i = 0; i < loop_cnt && b.size > 0; i++) {
+               bcm_bprintf(&b, " %x", *ptr);
+               ptr++;
+       }
+       DHD_ERROR(("%s\n", b.origbuf));
+}
+
+/*
+ * dhd_dbg_attach: initialziation of dhd dbugability module
+ *
+ * Return: An error code or 0 on success.
+ */
+int
+dhd_dbg_attach(dhd_pub_t *dhdp, dbg_pullreq_t os_pullreq,
+       dbg_urgent_noti_t os_urgent_notifier, void *os_priv)
+{
+       dhd_dbg_t *dbg = NULL;
+       dhd_dbg_ring_t *ring = NULL;
+       int ret = BCME_ERROR, ring_id = 0;
+       void *buf = NULL;
+
+       dbg = MALLOCZ(dhdp->osh, sizeof(dhd_dbg_t));
+       if (!dbg)
+               return BCME_NOMEM;
+
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+       buf = DHD_OS_PREALLOC(dhdp, DHD_PREALLOC_FW_VERBOSE_RING, FW_VERBOSE_RING_SIZE);
+#else
+       buf = MALLOCZ(dhdp->osh, FW_VERBOSE_RING_SIZE);
+#endif
+       if (!buf)
+               goto error;
+       ret = dhd_dbg_ring_init(dhdp, &dbg->dbg_rings[FW_VERBOSE_RING_ID], FW_VERBOSE_RING_ID,
+                       (uint8 *)FW_VERBOSE_RING_NAME, FW_VERBOSE_RING_SIZE, buf, FALSE);
+       if (ret)
+               goto error;
+
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+       buf = DHD_OS_PREALLOC(dhdp, DHD_PREALLOC_DHD_EVENT_RING, DHD_EVENT_RING_SIZE);
+#else
+       buf = MALLOCZ(dhdp->osh, DHD_EVENT_RING_SIZE);
+#endif
+       if (!buf)
+               goto error;
+       ret = dhd_dbg_ring_init(dhdp, &dbg->dbg_rings[DHD_EVENT_RING_ID], DHD_EVENT_RING_ID,
+                       (uint8 *)DHD_EVENT_RING_NAME, DHD_EVENT_RING_SIZE, buf, FALSE);
+       if (ret)
+               goto error;
+
+       dbg->private = os_priv;
+       dbg->pullreq = os_pullreq;
+       dbg->urgent_notifier = os_urgent_notifier;
+       dhdp->dbg = dbg;
+
+       return BCME_OK;
+
+error:
+       for (ring_id = DEBUG_RING_ID_INVALID + 1; ring_id < DEBUG_RING_ID_MAX; ring_id++) {
+               if (VALID_RING(dbg->dbg_rings[ring_id].id)) {
+                       ring = &dbg->dbg_rings[ring_id];
+                       dhd_dbg_ring_deinit(dhdp, ring);
+                       if (ring->ring_buf) {
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+                               MFREE(dhdp->osh, ring->ring_buf, ring->ring_size);
+#endif
+                               ring->ring_buf = NULL;
+                       }
+                       ring->ring_size = 0;
+               }
+       }
+       MFREE(dhdp->osh, dbg, sizeof(dhd_dbg_t));
+
+       return ret;
+}
+
+/*
+ * dhd_dbg_detach: clean up dhd dbugability module
+ */
+void
+dhd_dbg_detach(dhd_pub_t *dhdp)
+{
+       int ring_id;
+       dhd_dbg_t *dbg;
+       dhd_dbg_ring_t *ring = NULL;
+
+       if (!dhdp->dbg)
+               return;
+
+       dbg = dhdp->dbg;
+       for (ring_id = DEBUG_RING_ID_INVALID + 1; ring_id < DEBUG_RING_ID_MAX; ring_id++) {
+               if (VALID_RING(dbg->dbg_rings[ring_id].id)) {
+                       ring = &dbg->dbg_rings[ring_id];
+                       dhd_dbg_ring_deinit(dhdp, ring);
+                       if (ring->ring_buf) {
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+                               MFREE(dhdp->osh, ring->ring_buf, ring->ring_size);
+#endif
+                               ring->ring_buf = NULL;
+                       }
+                       ring->ring_size = 0;
+               }
+       }
+       MFREE(dhdp->osh, dhdp->dbg, sizeof(dhd_dbg_t));
+}
+
+uint32
+dhd_dbg_get_fwverbose(dhd_pub_t *dhdp)
+{
+       if (dhdp && dhdp->dbg) {
+               return dhdp->dbg->dbg_rings[FW_VERBOSE_RING_ID].log_level;
+       }
+       return 0;
+}
+
+void
+dhd_dbg_set_fwverbose(dhd_pub_t *dhdp, uint32 new_val)
+{
+
+       if (dhdp && dhdp->dbg) {
+               dhdp->dbg->dbg_rings[FW_VERBOSE_RING_ID].log_level = new_val;
+       }
+}
diff --git a/bcmdhd.101.10.240.x/dhd_debug.h b/bcmdhd.101.10.240.x/dhd_debug.h
new file mode 100644 (file)
index 0000000..df4abef
--- /dev/null
@@ -0,0 +1,868 @@
+/*
+ * DHD debugability header file
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef _dhd_debug_h_
+#define _dhd_debug_h_
+#include <event_log.h>
+#include <bcmutils.h>
+#include <dhd_dbg_ring.h>
+
+enum {
+       DEBUG_RING_ID_INVALID   = 0,
+       FW_VERBOSE_RING_ID,
+       DHD_EVENT_RING_ID,
+       /* add new id here */
+       DEBUG_RING_ID_MAX
+};
+
+enum {
+       /* Feature set */
+       DBG_MEMORY_DUMP_SUPPORTED = (1 << (0)), /* Memory dump of FW */
+       DBG_PER_PACKET_TX_RX_STATUS_SUPPORTED = (1 << (1)), /* PKT Status */
+       DBG_CONNECT_EVENT_SUPPORTED = (1 << (2)), /* Connectivity Event */
+       DBG_POWER_EVENT_SUPOORTED = (1 << (3)), /* POWER of Driver */
+       DBG_WAKE_LOCK_SUPPORTED = (1 << (4)), /* WAKE LOCK of Driver */
+       DBG_VERBOSE_LOG_SUPPORTED = (1 << (5)), /* verbose log of FW */
+       DBG_HEALTH_CHECK_SUPPORTED = (1 << (6)), /* monitor the health of FW */
+       DBG_DRIVER_DUMP_SUPPORTED = (1 << (7)), /* dumps driver state */
+       DBG_PACKET_FATE_SUPPORTED = (1 << (8)), /* tracks connection packets' fate */
+       DBG_NAN_EVENT_SUPPORTED = (1 << (9)), /* NAN Events */
+};
+
+enum {
+       /* set for binary entries */
+       DBG_RING_ENTRY_FLAGS_HAS_BINARY = (1 << (0)),
+       /* set if 64 bits timestamp is present */
+       DBG_RING_ENTRY_FLAGS_HAS_TIMESTAMP = (1 << (1))
+};
+
+/* firmware verbose ring, ring id 1 */
+#define FW_VERBOSE_RING_NAME           "fw_verbose"
+#define FW_VERBOSE_RING_SIZE           (256 * 1024)
+/* firmware event ring, ring id 2 */
+#define FW_EVENT_RING_NAME             "fw_event"
+#define FW_EVENT_RING_SIZE             (64 * 1024)
+/* DHD connection event ring, ring id 3 */
+#define DHD_EVENT_RING_NAME            "dhd_event"
+#define DHD_EVENT_RING_SIZE            (64 * 1024)
+/* NAN event ring, ring id 4 */
+#define NAN_EVENT_RING_NAME            "nan_event"
+#define NAN_EVENT_RING_SIZE            (64 * 1024)
+
+#define TLV_LOG_SIZE(tlv) ((tlv) ? (sizeof(tlv_log) + (tlv)->len) : 0)
+
+#define TLV_LOG_NEXT(tlv) \
+       ((tlv) ? ((tlv_log *)((uint8 *)tlv + TLV_LOG_SIZE(tlv))) : 0)
+
+#define DBG_RING_STATUS_SIZE (sizeof(dhd_dbg_ring_status_t))
+
+#define VALID_RING(id) \
+       ((id > DEBUG_RING_ID_INVALID) && (id < DEBUG_RING_ID_MAX))
+
+#ifdef DEBUGABILITY
+#define DBG_RING_ACTIVE(dhdp, ring_id) \
+       ((dhdp)->dbg->dbg_rings[(ring_id)].state == RING_ACTIVE)
+#else
+#define DBG_RING_ACTIVE(dhdp, ring_id) 0
+#endif /* DEBUGABILITY */
+
+enum {
+       /* driver receive association command from kernel */
+       WIFI_EVENT_ASSOCIATION_REQUESTED        = 0,
+       WIFI_EVENT_AUTH_COMPLETE,
+       WIFI_EVENT_ASSOC_COMPLETE,
+       /* received firmware event indicating auth frames are sent */
+       WIFI_EVENT_FW_AUTH_STARTED,
+       /* received firmware event indicating assoc frames are sent */
+       WIFI_EVENT_FW_ASSOC_STARTED,
+       /* received firmware event indicating reassoc frames are sent */
+       WIFI_EVENT_FW_RE_ASSOC_STARTED,
+       WIFI_EVENT_DRIVER_SCAN_REQUESTED,
+       WIFI_EVENT_DRIVER_SCAN_RESULT_FOUND,
+       WIFI_EVENT_DRIVER_SCAN_COMPLETE,
+       WIFI_EVENT_G_SCAN_STARTED,
+       WIFI_EVENT_G_SCAN_COMPLETE,
+       WIFI_EVENT_DISASSOCIATION_REQUESTED,
+       WIFI_EVENT_RE_ASSOCIATION_REQUESTED,
+       WIFI_EVENT_ROAM_REQUESTED,
+       /* received beacon from AP (event enabled only in verbose mode) */
+       WIFI_EVENT_BEACON_RECEIVED,
+       /* firmware has triggered a roam scan (not g-scan) */
+       WIFI_EVENT_ROAM_SCAN_STARTED,
+       /* firmware has completed a roam scan (not g-scan) */
+       WIFI_EVENT_ROAM_SCAN_COMPLETE,
+       /* firmware has started searching for roam candidates (with reason =xx) */
+       WIFI_EVENT_ROAM_SEARCH_STARTED,
+       /* firmware has stopped searching for roam candidates (with reason =xx) */
+       WIFI_EVENT_ROAM_SEARCH_STOPPED,
+       WIFI_EVENT_UNUSED_0,
+       /* received channel switch anouncement from AP */
+       WIFI_EVENT_CHANNEL_SWITCH_ANOUNCEMENT,
+       /* fw start transmit eapol frame, with EAPOL index 1-4 */
+       WIFI_EVENT_FW_EAPOL_FRAME_TRANSMIT_START,
+       /* fw gives up eapol frame, with rate, success/failure and number retries */
+       WIFI_EVENT_FW_EAPOL_FRAME_TRANSMIT_STOP,
+       /* kernel queue EAPOL for transmission in driver with EAPOL index 1-4 */
+       WIFI_EVENT_DRIVER_EAPOL_FRAME_TRANSMIT_REQUESTED,
+       /* with rate, regardless of the fact that EAPOL frame is accepted or
+        * rejected by firmware
+        */
+       WIFI_EVENT_FW_EAPOL_FRAME_RECEIVED,
+       WIFI_EVENT_UNUSED_1,
+       /* with rate, and eapol index, driver has received */
+       /* EAPOL frame and will queue it up to wpa_supplicant */
+       WIFI_EVENT_DRIVER_EAPOL_FRAME_RECEIVED,
+       /* with success/failure, parameters */
+       WIFI_EVENT_BLOCK_ACK_NEGOTIATION_COMPLETE,
+       WIFI_EVENT_BT_COEX_BT_SCO_START,
+       WIFI_EVENT_BT_COEX_BT_SCO_STOP,
+       /* for paging/scan etc..., when BT starts transmiting twice per BT slot */
+       WIFI_EVENT_BT_COEX_BT_SCAN_START,
+       WIFI_EVENT_BT_COEX_BT_SCAN_STOP,
+       WIFI_EVENT_BT_COEX_BT_HID_START,
+       WIFI_EVENT_BT_COEX_BT_HID_STOP,
+       /* firmware sends auth frame in roaming to next candidate */
+       WIFI_EVENT_ROAM_AUTH_STARTED,
+       /* firmware receive auth confirm from ap */
+       WIFI_EVENT_ROAM_AUTH_COMPLETE,
+       /* firmware sends assoc/reassoc frame in */
+       WIFI_EVENT_ROAM_ASSOC_STARTED,
+       /* firmware receive assoc/reassoc confirm from ap */
+       WIFI_EVENT_ROAM_ASSOC_COMPLETE,
+       /* firmware sends stop G_SCAN */
+       WIFI_EVENT_G_SCAN_STOP,
+       /* firmware indicates G_SCAN scan cycle started */
+       WIFI_EVENT_G_SCAN_CYCLE_STARTED,
+       /* firmware indicates G_SCAN scan cycle completed */
+       WIFI_EVENT_G_SCAN_CYCLE_COMPLETED,
+       /* firmware indicates G_SCAN scan start for a particular bucket */
+       WIFI_EVENT_G_SCAN_BUCKET_STARTED,
+       /* firmware indicates G_SCAN scan completed for particular bucket */
+       WIFI_EVENT_G_SCAN_BUCKET_COMPLETED,
+       /* Event received from firmware about G_SCAN scan results being available */
+       WIFI_EVENT_G_SCAN_RESULTS_AVAILABLE,
+       /* Event received from firmware with G_SCAN capabilities */
+       WIFI_EVENT_G_SCAN_CAPABILITIES,
+       /* Event received from firmware when eligible candidate is found */
+       WIFI_EVENT_ROAM_CANDIDATE_FOUND,
+       /* Event received from firmware when roam scan configuration gets enabled or disabled */
+       WIFI_EVENT_ROAM_SCAN_CONFIG,
+       /* firmware/driver timed out authentication */
+       WIFI_EVENT_AUTH_TIMEOUT,
+       /* firmware/driver timed out association */
+       WIFI_EVENT_ASSOC_TIMEOUT,
+       /* firmware/driver encountered allocation failure */
+       WIFI_EVENT_MEM_ALLOC_FAILURE,
+       /* driver added a PNO network in firmware */
+       WIFI_EVENT_DRIVER_PNO_ADD,
+       /* driver removed a PNO network in firmware */
+       WIFI_EVENT_DRIVER_PNO_REMOVE,
+       /* driver received PNO networks found indication from firmware */
+       WIFI_EVENT_DRIVER_PNO_NETWORK_FOUND,
+       /* driver triggered a scan for PNO networks */
+       WIFI_EVENT_DRIVER_PNO_SCAN_REQUESTED,
+       /* driver received scan results of PNO networks */
+       WIFI_EVENT_DRIVER_PNO_SCAN_RESULT_FOUND,
+       /* driver updated scan results from PNO candidates to cfg */
+       WIFI_EVENT_DRIVER_PNO_SCAN_COMPLETE
+};
+
+enum {
+       WIFI_TAG_VENDOR_SPECIFIC = 0, /* take a byte stream as parameter */
+       WIFI_TAG_BSSID, /* takes a 6 bytes MAC address as parameter */
+       WIFI_TAG_ADDR, /* takes a 6 bytes MAC address as parameter */
+       WIFI_TAG_SSID, /* takes a 32 bytes SSID address as parameter */
+       WIFI_TAG_STATUS, /* takes an integer as parameter */
+       WIFI_TAG_CHANNEL_SPEC, /* takes one or more wifi_channel_spec as parameter */
+       WIFI_TAG_WAKE_LOCK_EVENT, /* takes a wake_lock_event struct as parameter */
+       WIFI_TAG_ADDR1, /* takes a 6 bytes MAC address as parameter */
+       WIFI_TAG_ADDR2, /* takes a 6 bytes MAC address as parameter */
+       WIFI_TAG_ADDR3, /* takes a 6 bytes MAC address as parameter */
+       WIFI_TAG_ADDR4, /* takes a 6 bytes MAC address as parameter */
+       WIFI_TAG_TSF, /* take a 64 bits TSF value as parameter */
+       WIFI_TAG_IE,
+       /* take one or more specific 802.11 IEs parameter, IEs are in turn
+        * indicated in TLV format as per 802.11 spec
+        */
+       WIFI_TAG_INTERFACE,     /* take interface name as parameter */
+       WIFI_TAG_REASON_CODE,   /* take a reason code as per 802.11 as parameter */
+       WIFI_TAG_RATE_MBPS,     /* take a wifi rate in 0.5 mbps */
+       WIFI_TAG_REQUEST_ID,    /* take an integer as parameter */
+       WIFI_TAG_BUCKET_ID,     /* take an integer as parameter */
+       WIFI_TAG_GSCAN_PARAMS,  /* takes a wifi_scan_cmd_params struct as parameter */
+       WIFI_TAG_GSCAN_CAPABILITIES, /* takes a wifi_gscan_capabilities struct as parameter */
+       WIFI_TAG_SCAN_ID,       /* take an integer as parameter */
+       WIFI_TAG_RSSI,          /* takes s16 as parameter */
+       WIFI_TAG_CHANNEL,       /* takes u16 as parameter */
+       WIFI_TAG_LINK_ID,       /* take an integer as parameter */
+       WIFI_TAG_LINK_ROLE,     /* take an integer as parameter */
+       WIFI_TAG_LINK_STATE,    /* take an integer as parameter */
+       WIFI_TAG_LINK_TYPE,     /* take an integer as parameter */
+       WIFI_TAG_TSCO,          /* take an integer as parameter */
+       WIFI_TAG_RSCO,          /* take an integer as parameter */
+       WIFI_TAG_EAPOL_MESSAGE_TYPE /* take an integer as parameter */
+};
+
+/* NAN  events */
+typedef enum {
+       NAN_EVENT_INVALID = 0,
+       NAN_EVENT_CLUSTER_STARTED = 1,
+       NAN_EVENT_CLUSTER_JOINED = 2,
+       NAN_EVENT_CLUSTER_MERGED = 3,
+       NAN_EVENT_ROLE_CHANGED = 4,
+       NAN_EVENT_SCAN_COMPLETE = 5,
+       NAN_EVENT_STATUS_CHNG  = 6,
+       /* ADD new events before this line */
+       NAN_EVENT_MAX
+} nan_event_id_t;
+
+typedef struct {
+    uint16 tag;
+    uint16 len; /* length of value */
+    uint8 value[0];
+} tlv_log;
+
+typedef struct per_packet_status_entry {
+    uint8 flags;
+    uint8 tid; /* transmit or received tid */
+    uint16 MCS; /* modulation and bandwidth */
+       /*
+       * TX: RSSI of ACK for that packet
+       * RX: RSSI of packet
+       */
+    uint8 rssi;
+    uint8 num_retries; /* number of attempted retries */
+    uint16 last_transmit_rate; /* last transmit rate in .5 mbps */
+        /* transmit/reeive sequence for that MPDU packet */
+    uint16 link_layer_transmit_sequence;
+       /*
+       * TX: firmware timestamp (us) when packet is queued within firmware buffer
+       * for SDIO/HSIC or into PCIe buffer
+       * RX : firmware receive timestamp
+       */
+    uint64 firmware_entry_timestamp;
+       /*
+       * firmware timestamp (us) when packet start contending for the
+       * medium for the first time, at head of its AC queue,
+       * or as part of an MPDU or A-MPDU. This timestamp is not updated
+       * for each retry, only the first transmit attempt.
+       */
+    uint64 start_contention_timestamp;
+       /*
+       * fimrware timestamp (us) when packet is successfully transmitted
+       * or aborted because it has exhausted its maximum number of retries
+       */
+       uint64 transmit_success_timestamp;
+       /*
+       * packet data. The length of packet data is determined by the entry_size field of
+       * the wifi_ring_buffer_entry structure. It is expected that first bytes of the
+       * packet, or packet headers only (up to TCP or RTP/UDP headers) will be copied into the ring
+       */
+    uint8 *data;
+} per_packet_status_entry_t;
+
+#define PACKED_STRUCT __attribute__ ((packed))
+
+typedef struct log_conn_event {
+    uint16 event;
+    tlv_log *tlvs;
+       /*
+       * separate parameter structure per event to be provided and optional data
+       * the event_data is expected to include an official android part, with some
+       * parameter as transmit rate, num retries, num scan result found etc...
+       * as well, event_data can include a vendor proprietary part which is
+       * understood by the developer only.
+       */
+} PACKED_STRUCT log_conn_event_t;
+
+/*
+ * Ring buffer name for power events ring. note that power event are extremely frequents
+ * and thus should be stored in their own ring/file so as not to clobber connectivity events
+ */
+
+typedef struct wake_lock_event {
+    uint32 status; /* 0 taken, 1 released */
+    uint32 reason; /* reason why this wake lock is taken */
+    char *name; /* null terminated */
+} wake_lock_event_t;
+
+typedef struct wifi_power_event {
+    uint16 event;
+    tlv_log *tlvs;
+} wifi_power_event_t;
+
+#define NAN_EVENT_VERSION 1
+typedef struct log_nan_event {
+    uint8 version;
+    uint8 pad;
+    uint16 event;
+    tlv_log *tlvs;
+} log_nan_event_t;
+
+/* entry type */
+enum {
+       DBG_RING_ENTRY_EVENT_TYPE = 1,
+       DBG_RING_ENTRY_PKT_TYPE,
+       DBG_RING_ENTRY_WAKE_LOCK_EVENT_TYPE,
+       DBG_RING_ENTRY_POWER_EVENT_TYPE,
+       DBG_RING_ENTRY_DATA_TYPE,
+       DBG_RING_ENTRY_NAN_EVENT_TYPE
+};
+
+struct log_level_table {
+       int log_level;
+       uint16 tag;
+       char *desc;
+};
+
+/*
+ * Assuming that the Ring lock is mutex, bailing out if the
+ * callers are from atomic context. On a long term, one has to
+ * schedule a job to execute in sleepable context so that
+ * contents are pushed to the ring.
+ */
+#define DBG_EVENT_LOG(dhdp, connect_state)                                     \
+{                                                                              \
+       do {                                                                    \
+               uint16 state = connect_state;                                   \
+               if (CAN_SLEEP() && DBG_RING_ACTIVE(dhdp, DHD_EVENT_RING_ID))                    \
+                       dhd_os_push_push_ring_data(dhdp, DHD_EVENT_RING_ID,     \
+                               &state, sizeof(state));                         \
+       } while (0);                                                            \
+}
+
+/*
+ * Packet logging - HAL specific data
+ * XXX: These should be moved to wl_cfgvendor.h
+ */
+
+#define MD5_PREFIX_LEN                         4
+#define MAX_FATE_LOG_LEN                       32
+#define MAX_FRAME_LEN_ETHERNET         1518
+#define MAX_FRAME_LEN_80211_MGMT       2352 /* 802.11-2012 Fig. 8-34 */
+
+typedef enum {
+       /* Sent over air and ACKed. */
+       TX_PKT_FATE_ACKED,
+
+       /* Sent over air but not ACKed. (Normal for broadcast/multicast.) */
+       TX_PKT_FATE_SENT,
+
+       /* Queued within firmware, but not yet sent over air. */
+       TX_PKT_FATE_FW_QUEUED,
+
+       /*
+        * Dropped by firmware as invalid. E.g. bad source address,
+        * bad checksum, or invalid for current state.
+        */
+       TX_PKT_FATE_FW_DROP_INVALID,
+
+       /* Dropped by firmware due to lifetime expiration. */
+       TX_PKT_FATE_FW_DROP_EXPTIME,
+
+       /*
+        * Dropped by firmware for any other reason. Includes
+        * frames that were sent by driver to firmware, but
+        * unaccounted for by firmware.
+        */
+       TX_PKT_FATE_FW_DROP_OTHER,
+
+       /* Queued within driver, not yet sent to firmware. */
+       TX_PKT_FATE_DRV_QUEUED,
+
+       /*
+        * Dropped by driver as invalid. E.g. bad source address,
+        * or invalid for current state.
+        */
+       TX_PKT_FATE_DRV_DROP_INVALID,
+
+       /* Dropped by driver due to lack of buffer space. */
+       TX_PKT_FATE_DRV_DROP_NOBUFS,
+
+       /*  Dropped by driver for any other reason. */
+       TX_PKT_FATE_DRV_DROP_OTHER,
+
+       /* Packet free by firmware. */
+       TX_PKT_FATE_FW_PKT_FREE,
+
+       } wifi_tx_packet_fate;
+
+typedef enum {
+       /* Valid and delivered to network stack (e.g., netif_rx()). */
+       RX_PKT_FATE_SUCCESS,
+
+       /* Queued within firmware, but not yet sent to driver. */
+       RX_PKT_FATE_FW_QUEUED,
+
+       /* Dropped by firmware due to host-programmable filters. */
+       RX_PKT_FATE_FW_DROP_FILTER,
+
+       /*
+        * Dropped by firmware as invalid. E.g. bad checksum,
+        * decrypt failed, or invalid for current state.
+        */
+       RX_PKT_FATE_FW_DROP_INVALID,
+
+       /* Dropped by firmware due to lack of buffer space. */
+       RX_PKT_FATE_FW_DROP_NOBUFS,
+
+       /* Dropped by firmware for any other reason. */
+       RX_PKT_FATE_FW_DROP_OTHER,
+
+       /* Queued within driver, not yet delivered to network stack. */
+       RX_PKT_FATE_DRV_QUEUED,
+
+       /* Dropped by driver due to filter rules. */
+       RX_PKT_FATE_DRV_DROP_FILTER,
+
+       /* Dropped by driver as invalid. E.g. not permitted in current state. */
+       RX_PKT_FATE_DRV_DROP_INVALID,
+
+       /* Dropped by driver due to lack of buffer space. */
+       RX_PKT_FATE_DRV_DROP_NOBUFS,
+
+       /* Dropped by driver for any other reason. */
+       RX_PKT_FATE_DRV_DROP_OTHER,
+
+       } wifi_rx_packet_fate;
+
+typedef enum {
+       FRAME_TYPE_UNKNOWN,
+       FRAME_TYPE_ETHERNET_II,
+       FRAME_TYPE_80211_MGMT,
+       } frame_type;
+
+typedef struct wifi_frame_info {
+       /*
+        * The type of MAC-layer frame that this frame_info holds.
+        * - For data frames, use FRAME_TYPE_ETHERNET_II.
+        * - For management frames, use FRAME_TYPE_80211_MGMT.
+        * - If the type of the frame is unknown, use FRAME_TYPE_UNKNOWN.
+        */
+       frame_type payload_type;
+
+       /*
+        * The number of bytes included in |frame_content|. If the frame
+        * contents are missing (e.g. RX frame dropped in firmware),
+        * |frame_len| should be set to 0.
+        */
+       size_t frame_len;
+
+       /*
+        * Host clock when this frame was received by the driver (either
+        *      outbound from the host network stack, or inbound from the
+        *      firmware).
+        *      - The timestamp should be taken from a clock which includes time
+        *        the host spent suspended (e.g. ktime_get_boottime()).
+        *      - If no host timestamp is available (e.g. RX frame was dropped in
+        *        firmware), this field should be set to 0.
+        */
+       uint32 driver_timestamp_usec;
+
+       /*
+        * Firmware clock when this frame was received by the firmware
+        *      (either outbound from the host, or inbound from a remote
+        *      station).
+        *      - The timestamp should be taken from a clock which includes time
+        *        firmware spent suspended (if applicable).
+        *      - If no firmware timestamp is available (e.g. TX frame was
+        *        dropped by driver), this field should be set to 0.
+        *      - Consumers of |frame_info| should _not_ assume any
+        *        synchronization between driver and firmware clocks.
+        */
+       uint32 firmware_timestamp_usec;
+
+       /*
+        * Actual frame content.
+        * - Should be provided for TX frames originated by the host.
+        * - Should be provided for RX frames received by the driver.
+        * - Optionally provided for TX frames originated by firmware. (At
+        *   discretion of HAL implementation.)
+        * - Optionally provided for RX frames dropped in firmware. (At
+        *   discretion of HAL implementation.)
+        * - If frame content is not provided, |frame_len| should be set
+        *   to 0.
+        */
+       union {
+               char ethernet_ii[MAX_FRAME_LEN_ETHERNET];
+               char ieee_80211_mgmt[MAX_FRAME_LEN_80211_MGMT];
+       } frame_content;
+} wifi_frame_info_t;
+
+typedef struct wifi_tx_report {
+       /*
+        * Prefix of MD5 hash of |frame_inf.frame_content|. If frame
+        * content is not provided, prefix of MD5 hash over the same data
+        * that would be in frame_content, if frame content were provided.
+        */
+       char md5_prefix[MD5_PREFIX_LEN];
+       wifi_tx_packet_fate fate;
+       wifi_frame_info_t frame_inf;
+} wifi_tx_report_t;
+
+typedef struct wifi_rx_report {
+       /*
+        * Prefix of MD5 hash of |frame_inf.frame_content|. If frame
+        * content is not provided, prefix of MD5 hash over the same data
+        * that would be in frame_content, if frame content were provided.
+        */
+       char md5_prefix[MD5_PREFIX_LEN];
+       wifi_rx_packet_fate fate;
+       wifi_frame_info_t frame_inf;
+} wifi_rx_report_t;
+
+typedef struct compat_wifi_frame_info {
+       frame_type payload_type;
+
+       uint32 frame_len;
+
+       uint32 driver_timestamp_usec;
+
+       uint32 firmware_timestamp_usec;
+
+       union {
+               char ethernet_ii[MAX_FRAME_LEN_ETHERNET];
+               char ieee_80211_mgmt[MAX_FRAME_LEN_80211_MGMT];
+       } frame_content;
+} compat_wifi_frame_info_t;
+
+typedef struct compat_wifi_tx_report {
+       char md5_prefix[MD5_PREFIX_LEN];
+       wifi_tx_packet_fate fate;
+       compat_wifi_frame_info_t frame_inf;
+} compat_wifi_tx_report_t;
+
+typedef struct compat_wifi_rx_report {
+       char md5_prefix[MD5_PREFIX_LEN];
+       wifi_rx_packet_fate fate;
+       compat_wifi_frame_info_t frame_inf;
+} compat_wifi_rx_report_t;
+
+/*
+ * Packet logging - internal data
+ */
+
+typedef enum dhd_dbg_pkt_mon_state {
+       PKT_MON_INVALID = 0,
+       PKT_MON_ATTACHED,
+       PKT_MON_STARTING,
+       PKT_MON_STARTED,
+       PKT_MON_STOPPING,
+       PKT_MON_STOPPED,
+       PKT_MON_DETACHED,
+       } dhd_dbg_pkt_mon_state_t;
+
+typedef struct dhd_dbg_pkt_info {
+       frame_type payload_type;
+       size_t pkt_len;
+       uint32 driver_ts;
+       uint32 firmware_ts;
+       uint32 pkt_hash;
+       void *pkt;
+} dhd_dbg_pkt_info_t;
+
+typedef struct compat_dhd_dbg_pkt_info {
+       frame_type payload_type;
+       uint32 pkt_len;
+       uint32 driver_ts;
+       uint32 firmware_ts;
+       uint32 pkt_hash;
+       void *pkt;
+} compat_dhd_dbg_pkt_info_t;
+
+typedef struct dhd_dbg_tx_info
+{
+       wifi_tx_packet_fate fate;
+       dhd_dbg_pkt_info_t info;
+} dhd_dbg_tx_info_t;
+
+typedef struct dhd_dbg_rx_info
+{
+       wifi_rx_packet_fate fate;
+       dhd_dbg_pkt_info_t info;
+} dhd_dbg_rx_info_t;
+
+typedef struct dhd_dbg_tx_report
+{
+       dhd_dbg_tx_info_t *tx_pkts;
+       uint16 pkt_pos;
+       uint16 status_pos;
+} dhd_dbg_tx_report_t;
+
+typedef struct dhd_dbg_rx_report
+{
+       dhd_dbg_rx_info_t *rx_pkts;
+       uint16 pkt_pos;
+} dhd_dbg_rx_report_t;
+
+typedef void (*dbg_pullreq_t)(void *os_priv, const int ring_id);
+typedef void (*dbg_urgent_noti_t) (dhd_pub_t *dhdp, const void *data, const uint32 len);
+typedef int (*dbg_mon_tx_pkts_t) (dhd_pub_t *dhdp, void *pkt, uint32 pktid);
+typedef int (*dbg_mon_tx_status_t) (dhd_pub_t *dhdp, void *pkt,
+       uint32 pktid, uint16 status);
+typedef int (*dbg_mon_rx_pkts_t) (dhd_pub_t *dhdp, void *pkt);
+
+typedef struct dhd_dbg_pkt_mon
+{
+       dhd_dbg_tx_report_t *tx_report;
+       dhd_dbg_rx_report_t *rx_report;
+       dhd_dbg_pkt_mon_state_t tx_pkt_state;
+       dhd_dbg_pkt_mon_state_t tx_status_state;
+       dhd_dbg_pkt_mon_state_t rx_pkt_state;
+
+       /* call backs */
+       dbg_mon_tx_pkts_t tx_pkt_mon;
+       dbg_mon_tx_status_t tx_status_mon;
+       dbg_mon_rx_pkts_t rx_pkt_mon;
+} dhd_dbg_pkt_mon_t;
+
+typedef struct dhd_dbg {
+       dhd_dbg_ring_t dbg_rings[DEBUG_RING_ID_MAX];
+       void *private;          /* os private_data */
+       dhd_dbg_pkt_mon_t pkt_mon;
+       void *pkt_mon_lock; /* spin lock for packet monitoring */
+       dbg_pullreq_t pullreq;
+       dbg_urgent_noti_t urgent_notifier;
+} dhd_dbg_t;
+
+#define PKT_MON_ATTACHED(state) \
+               (((state) > PKT_MON_INVALID) && ((state) < PKT_MON_DETACHED))
+#define PKT_MON_DETACHED(state) \
+               (((state) == PKT_MON_INVALID) || ((state) == PKT_MON_DETACHED))
+#define PKT_MON_STARTED(state) ((state) == PKT_MON_STARTED)
+#define PKT_MON_STOPPED(state) ((state) == PKT_MON_STOPPED)
+#define PKT_MON_NOT_OPERATIONAL(state) \
+       (((state) != PKT_MON_STARTED) && ((state) != PKT_MON_STOPPED))
+#define PKT_MON_SAFE_TO_FREE(state) \
+       (((state) == PKT_MON_STARTING) || ((state) == PKT_MON_STOPPED))
+#define PKT_MON_PKT_FULL(pkt_count) ((pkt_count) >= MAX_FATE_LOG_LEN)
+#define PKT_MON_STATUS_FULL(pkt_count, status_count) \
+               (((status_count) >= (pkt_count)) || ((status_count) >= MAX_FATE_LOG_LEN))
+
+#ifdef DBG_PKT_MON
+#define DHD_DBG_PKT_MON_TX(dhdp, pkt, pktid) \
+       do { \
+               if ((dhdp) && (dhdp)->dbg && (dhdp)->dbg->pkt_mon.tx_pkt_mon && (pkt)) { \
+                       (dhdp)->dbg->pkt_mon.tx_pkt_mon((dhdp), (pkt), (pktid)); \
+               } \
+       } while (0);
+#define DHD_DBG_PKT_MON_TX_STATUS(dhdp, pkt, pktid, status) \
+       do { \
+               if ((dhdp) && (dhdp)->dbg && (dhdp)->dbg->pkt_mon.tx_status_mon && (pkt)) { \
+                       (dhdp)->dbg->pkt_mon.tx_status_mon((dhdp), (pkt), (pktid), (status)); \
+               } \
+       } while (0);
+#define DHD_DBG_PKT_MON_RX(dhdp, pkt) \
+       do { \
+               if ((dhdp) && (dhdp)->dbg && (dhdp)->dbg->pkt_mon.rx_pkt_mon && (pkt)) { \
+                       if (ntoh16((pkt)->protocol) != ETHER_TYPE_BRCM) { \
+                               (dhdp)->dbg->pkt_mon.rx_pkt_mon((dhdp), (pkt)); \
+                       } \
+               } \
+       } while (0);
+
+#define DHD_DBG_PKT_MON_START(dhdp) \
+               dhd_os_dbg_start_pkt_monitor((dhdp));
+#define DHD_DBG_PKT_MON_STOP(dhdp) \
+               dhd_os_dbg_stop_pkt_monitor((dhdp));
+#else
+#define DHD_DBG_PKT_MON_TX(dhdp, pkt, pktid)
+#define DHD_DBG_PKT_MON_TX_STATUS(dhdp, pkt, pktid, status)
+#define DHD_DBG_PKT_MON_RX(dhdp, pkt)
+#define DHD_DBG_PKT_MON_START(dhdp)
+#define DHD_DBG_PKT_MON_STOP(dhdp)
+#endif /* DBG_PKT_MON */
+
+#ifdef DUMP_IOCTL_IOV_LIST
+typedef struct dhd_iov_li {
+       dll_t list;
+       uint32 cmd; /* command number */
+       char buff[100]; /* command name */
+} dhd_iov_li_t;
+#endif /* DUMP_IOCTL_IOV_LIST */
+
+#define IOV_LIST_MAX_LEN 5
+
+#ifdef DHD_DEBUG
+typedef struct {
+       dll_t list;
+       uint32 id; /* wasted chunk id */
+       uint32 handle; /* wasted chunk handle */
+       uint32 size; /* wasted chunk size */
+} dhd_dbg_mwli_t;
+#endif /* DHD_DEBUG */
+
+#define DHD_OW_BI_RAW_EVENT_LOG_FMT 0xFFFF
+
+/* LSB 2 bits of format number to identify the type of event log */
+#define DHD_EVENT_LOG_HDR_MASK 0x3
+
+#define DHD_EVENT_LOG_FMT_NUM_OFFSET 2
+#define DHD_EVENT_LOG_FMT_NUM_MASK 0x3FFF
+/**
+ * OW:- one word
+ * TW:- two word
+ * NB:- non binary
+ * BI:- binary
+ */
+#define        DHD_OW_NB_EVENT_LOG_HDR 0
+#define DHD_TW_NB_EVENT_LOG_HDR 1
+#define DHD_BI_EVENT_LOG_HDR 3
+#define DHD_INVALID_EVENT_LOG_HDR 2
+
+#define DHD_TW_VALID_TAG_BITS_MASK 0xF
+#define DHD_OW_BI_EVENT_FMT_NUM 0x3FFF
+#define DHD_TW_BI_EVENT_FMT_NUM 0x3FFE
+
+#define DHD_TW_EVENT_LOG_TAG_OFFSET 8
+
+#define EVENT_TAG_TIMESTAMP_OFFSET 1
+#define EVENT_TAG_TIMESTAMP_EXT_OFFSET 2
+
+typedef struct prcd_event_log_hdr {
+       uint32 tag;             /* Event_log entry tag */
+       uint32 count;           /* Count of 4-byte entries */
+       uint32 fmt_num_raw;     /* Format number */
+       uint32 fmt_num;         /* Format number >> 2 */
+       uint32 armcycle;        /* global ARM CYCLE for TAG */
+       uint32 *log_ptr;        /* start of payload */
+       uint32  payload_len;
+       /* Extended event log header info
+        * 0 - legacy, 1 - extended event log header present
+        */
+       bool ext_event_log_hdr;
+       bool binary_payload;    /* 0 - non binary payload, 1 - binary payload */
+} prcd_event_log_hdr_t;                /* Processed event log header */
+
+/* dhd_dbg functions */
+extern void dhd_dbg_trace_evnt_handler(dhd_pub_t *dhdp, void *event_data,
+               void *raw_event_ptr, uint datalen);
+void dhd_dbg_msgtrace_log_parser(dhd_pub_t *dhdp, void *event_data,
+       void *raw_event_ptr, uint datalen, bool msgtrace_hdr_present,
+       uint32 msgtrace_seqnum);
+
+extern int dhd_dbg_attach(dhd_pub_t *dhdp, dbg_pullreq_t os_pullreq,
+       dbg_urgent_noti_t os_urgent_notifier, void *os_priv);
+extern void dhd_dbg_detach(dhd_pub_t *dhdp);
+extern int dhd_dbg_start(dhd_pub_t *dhdp, bool start);
+extern int dhd_dbg_set_configuration(dhd_pub_t *dhdp, int ring_id,
+               int log_level, int flags, uint32 threshold);
+extern int dhd_dbg_find_ring_id(dhd_pub_t *dhdp, char *ring_name);
+extern dhd_dbg_ring_t *dhd_dbg_get_ring_from_ring_id(dhd_pub_t *dhdp, int ring_id);
+extern void *dhd_dbg_get_priv(dhd_pub_t *dhdp);
+extern int dhd_dbg_send_urgent_evt(dhd_pub_t *dhdp, const void *data, const uint32 len);
+extern void dhd_dbg_verboselog_printf(dhd_pub_t *dhdp, prcd_event_log_hdr_t *plog_hdr,
+       void *raw_event_ptr, uint32 *log_ptr, uint32 logset, uint16 block);
+int dhd_dbg_pull_from_ring(dhd_pub_t *dhdp, int ring_id, void *data, uint32 buf_len);
+int dhd_dbg_pull_single_from_ring(dhd_pub_t *dhdp, int ring_id, void *data, uint32 buf_len,
+       bool strip_header);
+int dhd_dbg_push_to_ring(dhd_pub_t *dhdp, int ring_id, dhd_dbg_ring_entry_t *hdr,
+               void *data);
+int __dhd_dbg_get_ring_status(dhd_dbg_ring_t *ring, dhd_dbg_ring_status_t *ring_status);
+int dhd_dbg_get_ring_status(dhd_pub_t *dhdp, int ring_id,
+               dhd_dbg_ring_status_t *dbg_ring_status);
+#ifdef SHOW_LOGTRACE
+void dhd_dbg_read_ring_into_trace_buf(dhd_dbg_ring_t *ring, trace_buf_info_t *trace_buf_info);
+#endif /* SHOW_LOGTRACE */
+
+#ifdef DBG_PKT_MON
+extern int dhd_dbg_attach_pkt_monitor(dhd_pub_t *dhdp,
+               dbg_mon_tx_pkts_t tx_pkt_mon,
+               dbg_mon_tx_status_t tx_status_mon,
+               dbg_mon_rx_pkts_t rx_pkt_mon);
+extern int dhd_dbg_start_pkt_monitor(dhd_pub_t *dhdp);
+extern int dhd_dbg_monitor_tx_pkts(dhd_pub_t *dhdp, void *pkt, uint32 pktid);
+extern int dhd_dbg_monitor_tx_status(dhd_pub_t *dhdp, void *pkt,
+               uint32 pktid, uint16 status);
+extern int dhd_dbg_monitor_rx_pkts(dhd_pub_t *dhdp, void *pkt);
+extern int dhd_dbg_stop_pkt_monitor(dhd_pub_t *dhdp);
+extern int dhd_dbg_monitor_get_tx_pkts(dhd_pub_t *dhdp, void __user *user_buf,
+               uint16 req_count, uint16 *resp_count);
+extern int dhd_dbg_monitor_get_rx_pkts(dhd_pub_t *dhdp, void __user *user_buf,
+               uint16 req_count, uint16 *resp_count);
+extern int dhd_dbg_detach_pkt_monitor(dhd_pub_t *dhdp);
+#endif /* DBG_PKT_MON */
+
+extern bool dhd_dbg_process_tx_status(dhd_pub_t *dhdp, void *pkt,
+               uint32 pktid, uint16 status);
+
+/* os wrapper function */
+extern int dhd_os_dbg_attach(dhd_pub_t *dhdp);
+extern void dhd_os_dbg_detach(dhd_pub_t *dhdp);
+extern int dhd_os_dbg_register_callback(int ring_id,
+       void (*dbg_ring_sub_cb)(void *ctx, const int ring_id, const void *data,
+               const uint32 len, const dhd_dbg_ring_status_t dbg_ring_status));
+extern int dhd_os_dbg_register_urgent_notifier(dhd_pub_t *dhdp,
+       void (*urgent_noti)(void *ctx, const void *data, const uint32 len, const uint32 fw_len));
+
+extern int dhd_os_start_logging(dhd_pub_t *dhdp, char *ring_name, int log_level,
+               int flags, int time_intval, int threshold);
+extern int dhd_os_reset_logging(dhd_pub_t *dhdp);
+extern int dhd_os_suppress_logging(dhd_pub_t *dhdp, bool suppress);
+
+extern int dhd_os_get_ring_status(dhd_pub_t *dhdp, int ring_id,
+               dhd_dbg_ring_status_t *dbg_ring_status);
+extern int dhd_os_trigger_get_ring_data(dhd_pub_t *dhdp, char *ring_name);
+extern int dhd_os_push_push_ring_data(dhd_pub_t *dhdp, int ring_id, void *data, int32 data_len);
+extern int dhd_os_dbg_get_feature(dhd_pub_t *dhdp, int32 *features);
+
+#ifdef DBG_PKT_MON
+extern int dhd_os_dbg_attach_pkt_monitor(dhd_pub_t *dhdp);
+extern int dhd_os_dbg_start_pkt_monitor(dhd_pub_t *dhdp);
+extern int dhd_os_dbg_monitor_tx_pkts(dhd_pub_t *dhdp, void *pkt,
+       uint32 pktid);
+extern int dhd_os_dbg_monitor_tx_status(dhd_pub_t *dhdp, void *pkt,
+       uint32 pktid, uint16 status);
+extern int dhd_os_dbg_monitor_rx_pkts(dhd_pub_t *dhdp, void *pkt);
+extern int dhd_os_dbg_stop_pkt_monitor(dhd_pub_t *dhdp);
+extern int dhd_os_dbg_monitor_get_tx_pkts(dhd_pub_t *dhdp,
+       void __user *user_buf, uint16 req_count, uint16 *resp_count);
+extern int dhd_os_dbg_monitor_get_rx_pkts(dhd_pub_t *dhdp,
+       void __user *user_buf, uint16 req_count, uint16 *resp_count);
+extern int dhd_os_dbg_detach_pkt_monitor(dhd_pub_t *dhdp);
+#endif /* DBG_PKT_MON */
+
+#ifdef DUMP_IOCTL_IOV_LIST
+extern void dhd_iov_li_append(dhd_pub_t *dhd, dll_t *list_head, dll_t *node);
+extern void dhd_iov_li_print(dll_t *list_head);
+extern void dhd_iov_li_delete(dhd_pub_t *dhd, dll_t *list_head);
+#endif /* DUMP_IOCTL_IOV_LIST */
+
+#ifdef DHD_DEBUG
+extern void dhd_mw_list_delete(dhd_pub_t *dhd, dll_t *list_head);
+#endif /* DHD_DEBUG */
+
+void print_roam_enhanced_log(prcd_event_log_hdr_t *plog_hdr);
+
+typedef void (*print_roam_enhance_log_func)(prcd_event_log_hdr_t *plog_hdr);
+typedef struct _pr_roam_tbl {
+       uint8 version;
+       uint8 id;
+       print_roam_enhance_log_func pr_func;
+} pr_roam_tbl_t;
+
+extern uint32 dhd_dbg_get_fwverbose(dhd_pub_t *dhdp);
+extern void dhd_dbg_set_fwverbose(dhd_pub_t *dhdp, uint32 new_val);
+#endif /* _dhd_debug_h_ */
diff --git a/bcmdhd.101.10.240.x/dhd_debug_linux.c b/bcmdhd.101.10.240.x/dhd_debug_linux.c
new file mode 100644 (file)
index 0000000..c90d7bf
--- /dev/null
@@ -0,0 +1,510 @@
+/*
+ * DHD debugability Linux os layer
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <dhd_debug.h>
+
+#include <net/cfg80211.h>
+#include <wl_cfgvendor.h>
+#include <dhd_config.h>
+
+typedef void (*dbg_ring_send_sub_t)(void *ctx, const int ring_id, const void *data,
+       const uint32 len, const dhd_dbg_ring_status_t ring_status);
+typedef void (*dbg_urgent_noti_sub_t)(void *ctx, const void *data,
+       const uint32 len, const uint32 fw_len);
+
+static dbg_ring_send_sub_t ring_send_sub_cb[DEBUG_RING_ID_MAX];
+static dbg_urgent_noti_sub_t urgent_noti_sub_cb;
+typedef struct dhd_dbg_os_ring_info {
+       dhd_pub_t *dhdp;
+       int ring_id;
+       int log_level;
+       unsigned long interval;
+       struct delayed_work work;
+       uint64 tsoffset;
+} linux_dbgring_info_t;
+
+struct log_level_table dhd_event_map[] = {
+       {1, WIFI_EVENT_DRIVER_EAPOL_FRAME_TRANSMIT_REQUESTED, "DRIVER EAPOL TX REQ"},
+       {1, WIFI_EVENT_DRIVER_EAPOL_FRAME_RECEIVED, "DRIVER EAPOL RX"},
+       {2, WIFI_EVENT_DRIVER_SCAN_REQUESTED, "SCAN_REQUESTED"},
+       {2, WIFI_EVENT_DRIVER_SCAN_COMPLETE, "SCAN COMPELETE"},
+       {3, WIFI_EVENT_DRIVER_SCAN_RESULT_FOUND, "SCAN RESULT FOUND"},
+       {2, WIFI_EVENT_DRIVER_PNO_ADD, "PNO ADD"},
+       {2, WIFI_EVENT_DRIVER_PNO_REMOVE, "PNO REMOVE"},
+       {2, WIFI_EVENT_DRIVER_PNO_NETWORK_FOUND, "PNO NETWORK FOUND"},
+       {2, WIFI_EVENT_DRIVER_PNO_SCAN_REQUESTED, "PNO SCAN_REQUESTED"},
+       {1, WIFI_EVENT_DRIVER_PNO_SCAN_RESULT_FOUND, "PNO SCAN RESULT FOUND"},
+       {1, WIFI_EVENT_DRIVER_PNO_SCAN_COMPLETE, "PNO SCAN COMPELETE"}
+};
+
+static void
+debug_data_send(dhd_pub_t *dhdp, int ring_id, const void *data, const uint32 len,
+       const dhd_dbg_ring_status_t ring_status)
+{
+       struct net_device *ndev;
+       dbg_ring_send_sub_t ring_sub_send;
+       ndev = dhd_linux_get_primary_netdev(dhdp);
+       if (!ndev)
+               return;
+       if (!VALID_RING(ring_id))
+               return;
+       if (ring_send_sub_cb[ring_id]) {
+               ring_sub_send = ring_send_sub_cb[ring_id];
+               ring_sub_send(ndev, ring_id, data, len, ring_status);
+       }
+}
+
+static void
+dhd_os_dbg_urgent_notifier(dhd_pub_t *dhdp, const void *data, const uint32 len)
+{
+       struct net_device *ndev;
+       ndev = dhd_linux_get_primary_netdev(dhdp);
+       if (!ndev)
+               return;
+       if (urgent_noti_sub_cb) {
+               urgent_noti_sub_cb(ndev, data, len, dhdp->soc_ram_length);
+       }
+}
+
+static void
+dbg_ring_poll_worker(struct work_struct *work)
+{
+       struct delayed_work *d_work = to_delayed_work(work);
+       bool sched = TRUE;
+       dhd_dbg_ring_t *ring;
+       linux_dbgring_info_t *ring_info;
+       dhd_pub_t *dhdp;
+       int ringid;
+       dhd_dbg_ring_status_t ring_status;
+       void *buf;
+       dhd_dbg_ring_entry_t *hdr;
+       uint32 buflen, rlen;
+       unsigned long flags;
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       ring_info = container_of(d_work, linux_dbgring_info_t, work);
+       GCC_DIAGNOSTIC_POP();
+
+       dhdp = ring_info->dhdp;
+       ringid = ring_info->ring_id;
+
+       ring = &dhdp->dbg->dbg_rings[ringid];
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+       dhd_dbg_get_ring_status(dhdp, ringid, &ring_status);
+
+       if (ring->wp > ring->rp) {
+               buflen = ring->wp - ring->rp;
+       } else if (ring->wp < ring->rp) {
+               buflen = ring->ring_size - ring->rp + ring->wp;
+       } else {
+               goto exit;
+       }
+
+       if (buflen > ring->ring_size) {
+               goto exit;
+       }
+
+       buf = MALLOCZ(dhdp->osh, buflen);
+       if (!buf) {
+               DHD_ERROR(("%s failed to allocate read buf\n", __FUNCTION__));
+               sched = FALSE;
+               goto exit;
+       }
+
+       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+       rlen = dhd_dbg_pull_from_ring(dhdp, ringid, buf, buflen);
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+
+       if (!ring->sched_pull) {
+               ring->sched_pull = TRUE;
+       }
+
+       hdr = (dhd_dbg_ring_entry_t *)buf;
+       while (rlen > 0) {
+               ring_status.read_bytes += ENTRY_LENGTH(hdr);
+               /* offset fw ts to host ts */
+               hdr->timestamp += ring_info->tsoffset;
+               debug_data_send(dhdp, ringid, hdr, ENTRY_LENGTH(hdr),
+                       ring_status);
+               rlen -= ENTRY_LENGTH(hdr);
+               hdr = (dhd_dbg_ring_entry_t *)((char *)hdr + ENTRY_LENGTH(hdr));
+       }
+       MFREE(dhdp->osh, buf, buflen);
+
+exit:
+       if (sched) {
+               /* retrigger the work at same interval */
+               if ((ring_status.written_bytes == ring_status.read_bytes) &&
+                               (ring_info->interval)) {
+                       schedule_delayed_work(d_work, ring_info->interval);
+               }
+       }
+
+       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+
+       return;
+}
+
+int
+dhd_os_dbg_register_callback(int ring_id, dbg_ring_send_sub_t callback)
+{
+       if (!VALID_RING(ring_id))
+               return BCME_RANGE;
+
+       ring_send_sub_cb[ring_id] = callback;
+       return BCME_OK;
+}
+
+int
+dhd_os_dbg_register_urgent_notifier(dhd_pub_t *dhdp, dbg_urgent_noti_sub_t urgent_noti_sub)
+{
+       if (!dhdp || !urgent_noti_sub)
+               return BCME_BADARG;
+       urgent_noti_sub_cb = urgent_noti_sub;
+
+       return BCME_OK;
+}
+
+int
+dhd_os_start_logging(dhd_pub_t *dhdp, char *ring_name, int log_level,
+       int flags, int time_intval, int threshold)
+{
+       int ret = BCME_OK;
+       int ring_id;
+       linux_dbgring_info_t *os_priv, *ring_info;
+
+       ring_id = dhd_dbg_find_ring_id(dhdp, ring_name);
+       if (!VALID_RING(ring_id))
+               return BCME_UNSUPPORTED;
+
+       DHD_DBGIF(("%s , log_level : %d, time_intval : %d, threshod %d Bytes\n",
+               __FUNCTION__, log_level, time_intval, threshold));
+
+       /* change the configuration */
+       ret = dhd_dbg_set_configuration(dhdp, ring_id, log_level, flags, threshold);
+       if (ret) {
+               DHD_ERROR(("dhd_set_configuration is failed : %d\n", ret));
+               return ret;
+       }
+
+       os_priv = dhd_dbg_get_priv(dhdp);
+       if (!os_priv)
+               return BCME_ERROR;
+       ring_info = &os_priv[ring_id];
+       ring_info->log_level = log_level;
+       if (time_intval == 0 || log_level == 0) {
+               ring_info->interval = 0;
+               cancel_delayed_work_sync(&ring_info->work);
+       } else {
+               ring_info->interval = msecs_to_jiffies(time_intval * MSEC_PER_SEC);
+               cancel_delayed_work_sync(&ring_info->work);
+               schedule_delayed_work(&ring_info->work, ring_info->interval);
+       }
+
+       return ret;
+}
+
+int
+dhd_os_reset_logging(dhd_pub_t *dhdp)
+{
+       int ret = BCME_OK;
+       int ring_id;
+       linux_dbgring_info_t *os_priv, *ring_info;
+
+       os_priv = dhd_dbg_get_priv(dhdp);
+       if (!os_priv)
+               return BCME_ERROR;
+
+       /* Stop all rings */
+       for (ring_id = DEBUG_RING_ID_INVALID + 1; ring_id < DEBUG_RING_ID_MAX; ring_id++) {
+               DHD_DBGIF(("%s: Stop ring buffer %d\n", __FUNCTION__, ring_id));
+
+               ring_info = &os_priv[ring_id];
+               /* cancel any pending work */
+               cancel_delayed_work_sync(&ring_info->work);
+               /* log level zero makes stop logging on that ring */
+               ring_info->log_level = 0;
+               ring_info->interval = 0;
+               /* change the configuration */
+               ret = dhd_dbg_set_configuration(dhdp, ring_id, 0, 0, 0);
+               if (ret) {
+                       DHD_ERROR(("dhd_set_configuration is failed : %d\n", ret));
+                       return ret;
+               }
+       }
+       return ret;
+}
+
+#define SUPPRESS_LOG_LEVEL 1
+int
+dhd_os_suppress_logging(dhd_pub_t *dhdp, bool suppress)
+{
+       int ret = BCME_OK;
+       int max_log_level;
+       int enable = (suppress) ? 0 : 1;
+       linux_dbgring_info_t *os_priv;
+
+       os_priv = dhd_dbg_get_priv(dhdp);
+       if (!os_priv)
+               return BCME_ERROR;
+
+       max_log_level = os_priv[FW_VERBOSE_RING_ID].log_level;
+
+       if (max_log_level == SUPPRESS_LOG_LEVEL) {
+               /* suppress the logging in FW not to wake up host while device in suspend mode */
+               ret = dhd_iovar(dhdp, 0, "logtrace", (char *)&enable, sizeof(enable), NULL, 0,
+                               TRUE);
+               if (ret < 0 && (ret != BCME_UNSUPPORTED)) {
+                       DHD_ERROR(("logtrace is failed : %d\n", ret));
+               }
+       }
+
+       return ret;
+}
+
+int
+dhd_os_get_ring_status(dhd_pub_t *dhdp, int ring_id, dhd_dbg_ring_status_t *dbg_ring_status)
+{
+       return dhd_dbg_get_ring_status(dhdp, ring_id, dbg_ring_status);
+}
+
+int
+dhd_os_trigger_get_ring_data(dhd_pub_t *dhdp, char *ring_name)
+{
+       int ret = BCME_OK;
+       int ring_id;
+       linux_dbgring_info_t *os_priv, *ring_info;
+       ring_id = dhd_dbg_find_ring_id(dhdp, ring_name);
+       if (!VALID_RING(ring_id))
+               return BCME_UNSUPPORTED;
+       os_priv = dhd_dbg_get_priv(dhdp);
+       if (os_priv) {
+               ring_info = &os_priv[ring_id];
+               if (ring_info->interval) {
+                       cancel_delayed_work_sync(&ring_info->work);
+               }
+               schedule_delayed_work(&ring_info->work, 0);
+       } else {
+               DHD_ERROR(("%s : os_priv is NULL\n", __FUNCTION__));
+               ret = BCME_ERROR;
+       }
+       return ret;
+}
+
+int
+dhd_os_push_push_ring_data(dhd_pub_t *dhdp, int ring_id, void *data, int32 data_len)
+{
+       int ret = BCME_OK, i;
+       dhd_dbg_ring_entry_t msg_hdr;
+       log_conn_event_t *event_data = (log_conn_event_t *)data;
+       linux_dbgring_info_t *os_priv, *ring_info = NULL;
+
+       if (!VALID_RING(ring_id))
+               return BCME_UNSUPPORTED;
+       os_priv = dhd_dbg_get_priv(dhdp);
+
+       if (os_priv) {
+               ring_info = &os_priv[ring_id];
+       } else
+               return BCME_NORESOURCE;
+
+       memset(&msg_hdr, 0, sizeof(dhd_dbg_ring_entry_t));
+
+       if (ring_id == DHD_EVENT_RING_ID) {
+               msg_hdr.type = DBG_RING_ENTRY_EVENT_TYPE;
+               msg_hdr.flags |= DBG_RING_ENTRY_FLAGS_HAS_TIMESTAMP;
+               msg_hdr.flags |= DBG_RING_ENTRY_FLAGS_HAS_BINARY;
+               msg_hdr.timestamp = local_clock();
+               /* convert to ms */
+               msg_hdr.timestamp = DIV_U64_BY_U32(msg_hdr.timestamp, NSEC_PER_MSEC);
+               msg_hdr.len = data_len;
+               /* filter the event for higher log level with current log level */
+               for (i = 0; i < ARRAYSIZE(dhd_event_map); i++) {
+                       if ((dhd_event_map[i].tag == event_data->event) &&
+                               dhd_event_map[i].log_level > ring_info->log_level) {
+                               return ret;
+                       }
+               }
+       }
+       ret = dhd_dbg_push_to_ring(dhdp, ring_id, &msg_hdr, event_data);
+       if (ret) {
+               DHD_ERROR(("%s : failed to push data into the ring (%d) with ret(%d)\n",
+                       __FUNCTION__, ring_id, ret));
+       }
+
+       return ret;
+}
+
+#ifdef DBG_PKT_MON
+int
+dhd_os_dbg_attach_pkt_monitor(dhd_pub_t *dhdp)
+{
+       return dhd_dbg_attach_pkt_monitor(dhdp, dhd_os_dbg_monitor_tx_pkts,
+               dhd_os_dbg_monitor_tx_status, dhd_os_dbg_monitor_rx_pkts);
+}
+
+int
+dhd_os_dbg_start_pkt_monitor(dhd_pub_t *dhdp)
+{
+       return dhd_dbg_start_pkt_monitor(dhdp);
+}
+
+int
+dhd_os_dbg_monitor_tx_pkts(dhd_pub_t *dhdp, void *pkt, uint32 pktid)
+{
+       return dhd_dbg_monitor_tx_pkts(dhdp, pkt, pktid);
+}
+
+int
+dhd_os_dbg_monitor_tx_status(dhd_pub_t *dhdp, void *pkt, uint32 pktid,
+       uint16 status)
+{
+       return dhd_dbg_monitor_tx_status(dhdp, pkt, pktid, status);
+}
+
+int
+dhd_os_dbg_monitor_rx_pkts(dhd_pub_t *dhdp, void *pkt)
+{
+       return dhd_dbg_monitor_rx_pkts(dhdp, pkt);
+}
+
+int
+dhd_os_dbg_stop_pkt_monitor(dhd_pub_t *dhdp)
+{
+       return dhd_dbg_stop_pkt_monitor(dhdp);
+}
+
+int
+dhd_os_dbg_monitor_get_tx_pkts(dhd_pub_t *dhdp, void __user *user_buf,
+       uint16 req_count, uint16 *resp_count)
+{
+       return dhd_dbg_monitor_get_tx_pkts(dhdp, user_buf, req_count, resp_count);
+}
+
+int
+dhd_os_dbg_monitor_get_rx_pkts(dhd_pub_t *dhdp, void __user *user_buf,
+       uint16 req_count, uint16 *resp_count)
+{
+       return dhd_dbg_monitor_get_rx_pkts(dhdp, user_buf, req_count, resp_count);
+}
+
+int
+dhd_os_dbg_detach_pkt_monitor(dhd_pub_t *dhdp)
+{
+       return dhd_dbg_detach_pkt_monitor(dhdp);
+}
+#endif /* DBG_PKT_MON */
+
+int
+dhd_os_dbg_get_feature(dhd_pub_t *dhdp, int32 *features)
+{
+       int ret = BCME_OK;
+       /* XXX : we need to find a way to get the features for dbg */
+       *features = 0;
+#ifdef DEBUGABILITY
+       // fix for RequestFirmwareDebugDump issue of VTS
+       if (dhdp->conf->chip != BCM43752_CHIP_ID)
+               *features |= DBG_MEMORY_DUMP_SUPPORTED;
+       if (FW_SUPPORTED(dhdp, logtrace)) {
+               *features |= DBG_CONNECT_EVENT_SUPPORTED;
+               *features |= DBG_VERBOSE_LOG_SUPPORTED;
+       }
+       if (FW_SUPPORTED(dhdp, hchk)) {
+               *features |= DBG_HEALTH_CHECK_SUPPORTED;
+       }
+#ifdef DBG_PKT_MON
+       if (FW_SUPPORTED(dhdp, d11status)) {
+               *features |= DBG_PACKET_FATE_SUPPORTED;
+       }
+#endif /* DBG_PKT_MON */
+#endif /* DEBUGABILITY */
+       return ret;
+}
+
+static void
+dhd_os_dbg_pullreq(void *os_priv, int ring_id)
+{
+       linux_dbgring_info_t *ring_info;
+
+       ring_info = &((linux_dbgring_info_t *)os_priv)[ring_id];
+       cancel_delayed_work(&ring_info->work);
+       schedule_delayed_work(&ring_info->work, 0);
+}
+
+int
+dhd_os_dbg_attach(dhd_pub_t *dhdp)
+{
+       int ret = BCME_OK;
+       linux_dbgring_info_t *os_priv, *ring_info;
+       int ring_id;
+
+       /* os_dbg data */
+       os_priv = MALLOCZ(dhdp->osh, sizeof(*os_priv) * DEBUG_RING_ID_MAX);
+       if (!os_priv)
+               return BCME_NOMEM;
+
+       for (ring_id = DEBUG_RING_ID_INVALID + 1; ring_id < DEBUG_RING_ID_MAX;
+            ring_id++) {
+               ring_info = &os_priv[ring_id];
+               INIT_DELAYED_WORK(&ring_info->work, dbg_ring_poll_worker);
+               ring_info->dhdp = dhdp;
+               ring_info->ring_id = ring_id;
+       }
+
+       ret = dhd_dbg_attach(dhdp, dhd_os_dbg_pullreq, dhd_os_dbg_urgent_notifier, os_priv);
+       if (ret)
+               MFREE(dhdp->osh, os_priv, sizeof(*os_priv) * DEBUG_RING_ID_MAX);
+
+       return ret;
+}
+
+void
+dhd_os_dbg_detach(dhd_pub_t *dhdp)
+{
+       linux_dbgring_info_t *os_priv, *ring_info;
+       int ring_id;
+       /* free os_dbg data */
+       os_priv = dhd_dbg_get_priv(dhdp);
+       if (!os_priv)
+               return;
+       /* abort pending any job */
+       for (ring_id = DEBUG_RING_ID_INVALID + 1; ring_id < DEBUG_RING_ID_MAX; ring_id++) {
+               ring_info = &os_priv[ring_id];
+               if (ring_info->interval) {
+                       ring_info->interval = 0;
+                       cancel_delayed_work_sync(&ring_info->work);
+               }
+       }
+       MFREE(dhdp->osh, os_priv, sizeof(*os_priv) * DEBUG_RING_ID_MAX);
+
+       return dhd_dbg_detach(dhdp);
+}
diff --git a/bcmdhd.101.10.240.x/dhd_event_log_filter.c b/bcmdhd.101.10.240.x/dhd_event_log_filter.c
new file mode 100644 (file)
index 0000000..a0d8bd0
--- /dev/null
@@ -0,0 +1,3210 @@
+/*
+ * Wifi dongle status Filter and Report
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+/*
+ * Filter MODULE and Report MODULE
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <dhd_debug.h>
+#include <event_log.h>
+#include <event_trace.h>
+#include <bcmtlv.h>
+#include <bcmwifi_channels.h>
+#include <dhd_event_log_filter.h>
+#include <wl_cfg80211.h>
+#include <dhd_bitpack.h>
+#include <dhd_pktlog.h>
+#ifdef DHD_STATUS_LOGGING
+#include <dhd_statlog.h>
+#endif /* DHD_STATUS_LOGGING */
+
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+
+#define DHD_FILTER_ERR_INTERNAL(fmt, ...) DHD_ERROR(("EWPF-" fmt, ##__VA_ARGS__))
+#define DHD_FILTER_TRACE_INTERNAL(fmt, ...) DHD_INFO(("EWPF-" fmt, ##__VA_ARGS__))
+
+#define DHD_FILTER_ERR(x) DHD_FILTER_ERR_INTERNAL x
+#define DHD_FILTER_TRACE(x) DHD_FILTER_TRACE_INTERNAL x
+
+/* ========= EWP Filter functions ============= */
+//#define EWPF_DEBUG
+#define EWPF_DEBUG_BUF_LEN     512
+#define EWPF_VAL_CNT_PLINE     16
+
+#define EWPF_REPORT_MAX_DATA   32      /* MAX record per slice */
+
+#define EWPF_INVALID   (-1)
+#define EWPF_XTLV_INVALID              0
+
+#define EWPF_MAX_IDX_TYPE              4
+#define EWPF_IDX_TYPE_SLICE            1
+#define EWPF_IDX_TYPE_IFACE            2
+#define EWPF_IDX_TYPE_EVENT            3
+#define EWPF_IDX_TYPE_KEY_INFO         4
+
+#define EWPF_MAX_SLICE                 2       /* MAX slice in dongle */
+#define EWPF_SLICE_MAIN                        0       /* SLICE ID for 5GHZ */
+#define EWPF_SLICE_AUX                 1       /* SLICE ID for 2GHZ */
+
+#define EWPF_MAX_IFACE                 2       /* MAX IFACE supported, 0: STA */
+#define EWPF_MAX_EVENT                 1       /* MAX EVENT counter supported */
+#define EWPF_MAX_KEY_INFO                      1       /* MAX KEY INFO counter supported */
+
+#define EWPF_ARM_TO_MSEC               1
+#define EWPF_NO_UNIT_CONV              1
+#define EWPF_MSEC_TO_SEC               1000
+#define EWPF_USEC_TO_MSEC              1000
+#define EWPF_NSEC_TO_MSEC              1000000
+#define EWPF_USEC_TO_SEC               1000000
+#define EWPF_EPOCH                             1000
+#define EWPF_NONSEC_TO_SEC             1000000000
+#define EWPF_REPORT_YEAR_MUL   10000
+#define EWPF_REPORT_MON_MUL            100
+#define EWPF_REPORT_HOUR_MUL   10000
+#define EWPF_REPORT_MIN_MUL            100
+#define EWPF_REPORT_MINUTES            60
+#define EWPF_REPORT_YEAR_BASE  1900
+
+#define EWPF_NO_ABS            FALSE
+#define EWPF_NEED_ABS          TRUE
+
+#define EWPF_MAX_INFO_TYPE     5
+#define EWPF_INFO_VER          0
+#define EWPF_INFO_TYPE         1
+#define EWPF_INFO_ECNT         2
+#define EWPF_INFO_IOVAR                3
+#define EWPF_INFO_CPLOG                4
+#define EWPF_INFO_DHDSTAT      5
+
+#define EWPF_UPDATE_ARM_CYCLE_OFFSET   1
+
+/* EWPF element of slice type */
+typedef struct {
+       uint32 armcycle; /* dongle arm cycle for this record */
+       union {
+               wl_periodic_compact_cntrs_v1_t compact_cntr_v1;
+               wl_periodic_compact_cntrs_v2_t compact_cntr_v2;
+               wl_periodic_compact_cntrs_v3_t compact_cntr_v3;
+       };
+       evt_hist_compact_toss_stats_v1_t hist_tx_toss_stat;
+       evt_hist_compact_toss_stats_v1_t hist_rx_toss_stat;
+       wlc_btc_stats_v4_t btc_stat;
+       wl_compact_he_cnt_wlc_v2_t compact_he_cnt;
+} EWPF_slc_elem_t;
+
+/* EWPF element for interface type */
+typedef struct {
+       uint32 armcycle; /* dongle arm cycle for this record */
+       wl_if_stats_t if_stat;
+       wl_lqm_t lqm;
+       wl_if_infra_stats_t infra;
+       wl_if_mgt_stats_t mgmt_stat;
+       wl_if_state_compact_t if_comp_stat;
+       wl_adps_dump_summary_v2_t adps_dump_summary;
+       wl_adps_energy_gain_v1_t adps_energy_gain;
+       wl_roam_stats_v1_t roam_stat;
+} EWPF_ifc_elem_t;
+
+typedef struct {
+       uint32 first_armcycle; /* first dongle arm cycle for this record */
+       uint32 updated_armcycle; /* last updated dongle arm cycle for this record */
+       wl_event_based_statistics_v4_t event_stat;
+} EWPF_event_elem_t;
+
+typedef struct {
+       uint32 first_armcycle; /* first dongle arm cycle for this record */
+       uint32 updated_armcycle; /* last updaated dongle arm cycle for this record */
+       key_update_info_v1_t key_update_info;
+} EWPF_key_info_elem_t;
+
+typedef struct {
+       uint32 first_armcycle; /* first dongle arm cycle for this record */
+       uint32 updated_armcycle; /* last updated dongle arm cycle for this record */
+       wl_roam_stats_v1_t roam_stat;
+} EWPF_roam_stats_event_elem_t;
+
+typedef struct {
+       int enabled;                    /* enabled/disabled */
+       dhd_pub_t *dhdp;
+       uint32 tmp_armcycle;    /* global ARM CYCLE for TAG */
+       int idx_type;                   /* 0 : SLICE, 1: IFACE */
+       int xtlv_idx;                   /* Slice/Interface index : global for TAG */
+       void *s_ring[EWPF_MAX_SLICE];
+       void *i_ring[EWPF_MAX_IFACE];
+       void *e_ring[EWPF_MAX_EVENT];
+       void *k_ring[EWPF_MAX_KEY_INFO];
+
+       /* used by Report module */
+       uint8 last_bssid[ETHER_ADDR_LEN];       /* BSSID of last conencted/request */
+       int last_channel;
+       uint32 last_armcycle;   /* ARM CYCLE prior last connection */
+} EWP_filter_t;
+
+/* status gathering functions : XTLV callback functions */
+typedef int (*EWPF_filter_cb)(void *ctx, const uint8 *data, uint16 type, uint16 len);
+static int evt_xtlv_print_cb(void *ctx, const uint8 *data, uint16 type, uint16 len);
+static int evt_xtlv_copy_cb(void *ctx, const uint8 *data, uint16 type, uint16 len);
+static int evt_xtlv_idx_cb(void *ctx, const uint8 *data, uint16 type, uint16 len);
+static int evt_xtlv_type_cb(void *ctx, const uint8 *data, uint16 type, uint16 len);
+static int filter_main_cb(void *ctx, const uint8 *data, uint16 type, uint16 len);
+static int evt_xtlv_roam_cb(void *ctx, const uint8 *data, uint16 type, uint16 len);
+
+/* ========= Event Handler functions and its callbacks: ============= */
+typedef struct _EWPF_tbl {
+       uint16 xtlv_id; /* XTLV ID, to handle */
+       EWPF_filter_cb cb_func; /* specific call back function, usually for structre */
+       int idx_type;                   /* structure specific info: belonged type */
+       int     max_idx;                        /* structure specific info: ALLOWED MAX IDX */
+       uint32 offset; /* offset of structure in EWPF_elem-t, valid if cb is not null */
+       uint32 member_length;   /* MAX length of reserved for this structure */
+       struct _EWPF_tbl *tbl; /* sub table if XTLV map to XLTV */
+} EWPF_tbl_t;
+
+/* Context structre for XTLV callback */
+typedef struct {
+       dhd_pub_t *dhdp;
+       EWPF_tbl_t *tbl;
+} EWPF_ctx_t;
+
+#define SLICE_INFO(a) EWPF_IDX_TYPE_SLICE, EWPF_MAX_SLICE, OFFSETOF(EWPF_slc_elem_t, a), \
+       sizeof(((EWPF_slc_elem_t *)NULL)->a)
+#define IFACE_INFO(a) EWPF_IDX_TYPE_IFACE, EWPF_MAX_IFACE, OFFSETOF(EWPF_ifc_elem_t, a), \
+       sizeof(((EWPF_ifc_elem_t *)NULL)->a)
+#define EVENT_INFO(a) EWPF_IDX_TYPE_EVENT, EWPF_MAX_EVENT, OFFSETOF(EWPF_event_elem_t, a), \
+               sizeof(((EWPF_event_elem_t *)NULL)->a)
+#define KEY_INFO(a) EWPF_IDX_TYPE_KEY_INFO, EWPF_MAX_KEY_INFO, OFFSETOF(EWPF_key_info_elem_t, a), \
+               sizeof(((EWPF_key_info_elem_t *)NULL)->a)
+
+#define SLICE_U_SIZE(a) sizeof(((EWPF_slc_elem_t *)NULL)->a)
+#define SLICE_INFO_UNION(a) EWPF_IDX_TYPE_SLICE, EWPF_MAX_SLICE, OFFSETOF(EWPF_slc_elem_t, a)
+#define NONE_INFO(a) 0, 0, a, 0
+/* XTLV TBL for WL_SLICESTATS_XTLV_PERIODIC_STATE */
+static EWPF_tbl_t EWPF_periodic[] =
+{
+       {
+               WL_STATE_COMPACT_COUNTERS,
+               evt_xtlv_copy_cb,
+               SLICE_INFO(compact_cntr_v3),
+               NULL
+       },
+       {
+               WL_STATE_COMPACT_HE_COUNTERS,
+               evt_xtlv_copy_cb,
+               SLICE_INFO(compact_he_cnt),
+               NULL
+       },
+       {EWPF_XTLV_INVALID, NULL, NONE_INFO(0), NULL}
+};
+
+static EWPF_tbl_t EWPF_if_periodic[] =
+{
+       {
+               WL_STATE_IF_COMPACT_STATE,
+               evt_xtlv_copy_cb,
+               IFACE_INFO(if_comp_stat),
+               NULL
+       },
+       {
+               WL_STATE_IF_ADPS_STATE,
+               evt_xtlv_copy_cb,
+               IFACE_INFO(adps_dump_summary),
+               NULL
+       },
+       {
+               WL_STATE_IF_ADPS_ENERGY_GAIN,
+               evt_xtlv_copy_cb,
+               IFACE_INFO(adps_energy_gain),
+               NULL
+       },
+       {EWPF_XTLV_INVALID, NULL, NONE_INFO(0), NULL}
+};
+
+static EWPF_tbl_t EWPF_roam[] =
+{
+       {
+               WL_IFSTATS_XTLV_ROAM_STATS_EVENT,
+               evt_xtlv_print_cb,
+               NONE_INFO(0),
+               NULL
+       },
+       {
+               WL_IFSTATS_XTLV_ROAM_STATS_PERIODIC,
+               evt_xtlv_copy_cb,
+               IFACE_INFO(roam_stat),
+               NULL
+       },
+       {EWPF_XTLV_INVALID, NULL, NONE_INFO(0), NULL}
+};
+
+/* XTLV TBL for EVENT_LOG_TAG_STATS */
+static EWPF_tbl_t EWPF_main[] =
+{
+       /* MAIN XTLV */
+       {
+               WL_IFSTATS_XTLV_WL_SLICE,
+               evt_xtlv_type_cb,
+               NONE_INFO(0),
+               EWPF_main
+       },
+       {
+               WL_IFSTATS_XTLV_IF,
+               evt_xtlv_type_cb,
+               NONE_INFO(0),
+               EWPF_main
+       },
+       /* ID XTLVs */
+       {
+               WL_IFSTATS_XTLV_SLICE_INDEX,
+               evt_xtlv_idx_cb,
+               NONE_INFO(0),
+               NULL
+       },
+       {
+               WL_IFSTATS_XTLV_IF_INDEX,
+               evt_xtlv_idx_cb,
+               NONE_INFO(0),
+               NULL
+       },
+       /* NORMAL XTLVS */
+       {
+               WL_SLICESTATS_XTLV_PERIODIC_STATE,
+               NULL,
+               NONE_INFO(0),
+               EWPF_periodic
+       },
+       {
+               WL_IFSTATS_XTLV_IF_LQM,
+               evt_xtlv_copy_cb,
+               IFACE_INFO(lqm),
+               NULL
+       },
+       {
+               WL_IFSTATS_XTLV_GENERIC,
+               evt_xtlv_copy_cb,
+               IFACE_INFO(if_stat),
+               NULL
+       },
+       {
+               WL_IFSTATS_XTLV_MGT_CNT,
+               evt_xtlv_copy_cb,
+               IFACE_INFO(mgmt_stat),
+               NULL
+       },
+       {
+               WL_IFSTATS_XTLV_IF_PERIODIC_STATE,
+               NULL,
+               NONE_INFO(0),
+               EWPF_if_periodic
+       },
+       {
+               WL_IFSTATS_XTLV_INFRA_SPECIFIC,
+               evt_xtlv_copy_cb,
+               IFACE_INFO(infra),
+               NULL
+       },
+       {
+               WL_SLICESTATS_XTLV_HIST_TX_STATS,
+               evt_xtlv_copy_cb,
+               SLICE_INFO(hist_tx_toss_stat),
+               NULL
+       },
+       {
+               WL_SLICESTATS_XTLV_HIST_RX_STATS,
+               evt_xtlv_copy_cb,
+               SLICE_INFO(hist_rx_toss_stat),
+               NULL
+       },
+       {
+               WL_IFSTATS_XTLV_WL_SLICE_BTCOEX,
+               evt_xtlv_copy_cb,
+               SLICE_INFO(btc_stat),
+               NULL
+       },
+       {
+               WL_IFSTATS_XTLV_IF_EVENT_STATS,
+               evt_xtlv_copy_cb,
+               EVENT_INFO(event_stat),
+               NULL
+       },
+       {
+               WL_IFSTATS_XTLV_IF_EVENT_STATS,
+               evt_xtlv_print_cb,
+               NONE_INFO(0),
+               NULL
+       },
+       {
+               WL_IFSTATS_XTLV_KEY_PLUMB_INFO,
+               evt_xtlv_copy_cb,
+               KEY_INFO(key_update_info),
+               NULL
+       },
+       {
+               WL_IFSTATS_XTLV_ROAM_STATS_EVENT,
+               evt_xtlv_roam_cb,
+               NONE_INFO(0),
+               EWPF_roam
+       },
+       {
+               WL_IFSTATS_XTLV_ROAM_STATS_PERIODIC,
+               evt_xtlv_roam_cb,
+               IFACE_INFO(roam_stat),
+               EWPF_roam
+       },
+
+       {EWPF_XTLV_INVALID, NULL, NONE_INFO(0), NULL}
+};
+
+#if defined(DHD_EWPR_VER2) && defined(DHD_STATUS_LOGGING)
+
+#define EWP_DHD_STAT_SIZE 2
+
+uint8
+dhd_statlog_filter[] =
+{
+       ST(WLAN_POWER_ON),      /* Wi-Fi Power on */
+       ST(WLAN_POWER_OFF),     /* Wi-Fi Power off */
+       ST(ASSOC_START),        /* connect to the AP triggered by upper layer */
+       ST(AUTH_DONE),          /* complete to authenticate with the AP */
+       ST(ASSOC_REQ),          /* send or receive Assoc Req */
+       ST(ASSOC_RESP),         /* send or receive Assoc Resp */
+       ST(ASSOC_DONE),         /* complete to disconnect to the associated AP */
+       ST(DISASSOC_START),     /* disconnect to the associated AP by upper layer */
+       ST(DISASSOC_INT_START), /* initiate the disassoc by DHD */
+       ST(DISASSOC_DONE),      /* complete to disconnect to the associated AP */
+       ST(DISASSOC),           /* send or receive Disassoc */
+       ST(DEAUTH),             /* send or receive Deauth */
+       ST(LINKDOWN),           /* receive the link down event */
+       ST(REASSOC_START),      /* reassoc the candidate AP */
+       ST(REASSOC_INFORM),     /* inform reassoc completion to upper layer */
+       ST(REASSOC_DONE),       /* complete to reassoc */
+       ST(EAPOL_M1),           /* send or receive the EAPOL M1 */
+       ST(EAPOL_M2),           /* send or receive the EAPOL M2 */
+       ST(EAPOL_M3),           /* send or receive the EAPOL M3 */
+       ST(EAPOL_M4),           /* send or receive the EAPOL M4 */
+       ST(EAPOL_GROUPKEY_M1),  /* send or receive the EAPOL Group key handshake M1 */
+       ST(EAPOL_GROUPKEY_M2),  /* send or receive the EAPOL Group key handshake M2 */
+       ST(EAP_REQ_IDENTITY),   /* send or receive the EAP REQ IDENTITY */
+       ST(EAP_RESP_IDENTITY),  /* send or receive the EAP RESP IDENTITY */
+       ST(EAP_REQ_TLS),        /* send or receive the EAP REQ TLS */
+       ST(EAP_RESP_TLS),       /* send or receive the EAP RESP TLS */
+       ST(EAP_REQ_LEAP),       /* send or receive the EAP REQ LEAP */
+       ST(EAP_RESP_LEAP),      /* send or receive the EAP RESP LEAP */
+       ST(EAP_REQ_TTLS),       /* send or receive the EAP REQ TTLS */
+       ST(EAP_RESP_TTLS),      /* send or receive the EAP RESP TTLS */
+       ST(EAP_REQ_AKA),        /* send or receive the EAP REQ AKA */
+       ST(EAP_RESP_AKA),       /* send or receive the EAP RESP AKA */
+       ST(EAP_REQ_PEAP),       /* send or receive the EAP REQ PEAP */
+       ST(EAP_RESP_PEAP),      /* send or receive the EAP RESP PEAP */
+       ST(EAP_REQ_FAST),       /* send or receive the EAP REQ FAST */
+       ST(EAP_RESP_FAST),      /* send or receive the EAP RESP FAST */
+       ST(EAP_REQ_PSK),        /* send or receive the EAP REQ PSK */
+       ST(EAP_RESP_PSK),       /* send or receive the EAP RESP PSK */
+       ST(EAP_REQ_AKAP),       /* send or receive the EAP REQ AKAP */
+       ST(EAP_RESP_AKAP),      /* send or receive the EAP RESP AKAP */
+       ST(EAP_SUCCESS),        /* send or receive the EAP SUCCESS */
+       ST(EAP_FAILURE),        /* send or receive the EAP FAILURE */
+       ST(EAPOL_START),        /* send or receive the EAPOL-START */
+       ST(WSC_START),          /* send or receive the WSC START */
+       ST(WSC_DONE),           /* send or receive the WSC DONE */
+       ST(WPS_M1),             /* send or receive the WPS M1 */
+       ST(WPS_M2),             /* send or receive the WPS M2 */
+       ST(WPS_M3),             /* send or receive the WPS M3 */
+       ST(WPS_M4),             /* send or receive the WPS M4 */
+       ST(WPS_M5),             /* send or receive the WPS M5 */
+       ST(WPS_M6),             /* send or receive the WPS M6 */
+       ST(WPS_M7),             /* send or receive the WPS M7 */
+       ST(WPS_M8),             /* send or receive the WPS M8 */
+       ST(8021X_OTHER),        /* send or receive the other 8021X frames */
+       ST(INSTALL_KEY),        /* install the key */
+       ST(DELETE_KEY),         /* remove the key */
+       ST(INSTALL_PMKSA),      /* install PMKID information */
+       ST(INSTALL_OKC_PMK),    /* install PMKID information for OKC */
+       ST(DHCP_DISCOVER),      /* send or recv DHCP Discover */
+       ST(DHCP_OFFER),         /* send or recv DHCP Offer */
+       ST(DHCP_REQUEST),       /* send or recv DHCP Request */
+       ST(DHCP_DECLINE),       /* send or recv DHCP Decline */
+       ST(DHCP_ACK),           /* send or recv DHCP ACK */
+       ST(DHCP_NAK),           /* send or recv DHCP NACK */
+       ST(DHCP_RELEASE),       /* send or recv DHCP Release */
+       ST(DHCP_INFORM),        /* send or recv DHCP Inform */
+       ST(REASSOC_SUCCESS),    /* reassociation success */
+       ST(REASSOC_FAILURE),    /* reassociation failure */
+       ST(AUTH_TIMEOUT),       /* authentication timeout */
+       ST(AUTH_FAIL),          /* authentication failure */
+       ST(AUTH_NO_ACK),        /* authentication failure due to no ACK */
+       ST(AUTH_OTHERS),        /* authentication failure with other status */
+       ST(ASSOC_TIMEOUT),      /* association timeout */
+       ST(ASSOC_FAIL),         /* association failure */
+       ST(ASSOC_NO_ACK),       /* association failure due to no ACK */
+       ST(ASSOC_ABORT),        /* association abort */
+       ST(ASSOC_UNSOLICITED),  /* association unsolicited */
+       ST(ASSOC_NO_NETWORKS),  /* association failure due to no networks */
+       ST(ASSOC_OTHERS),       /* association failure due to no networks */
+       ST(REASSOC_DONE_OTHERS) /* complete to reassoc with other reason */
+};
+#endif /* DHD_EWPR_VER2 && DHD_STATUS_LOGGING  */
+
+/* ========= Module functions : exposed to others ============= */
+int
+dhd_event_log_filter_init(dhd_pub_t *dhdp, uint8 *buf, uint32 buf_size)
+{
+
+       EWP_filter_t *filter;
+       int idx;
+       uint32 req_size;
+       uint32 s_ring_size; /* slice ring */
+       uint32 i_ring_size; /* interface ring */
+       uint32 e_ring_size; /* event counter ring */
+       uint32 k_ring_size; /* key info ring */
+       uint8 *buf_ptr = buf;
+       EWPF_ctx_t ctx;
+       wl_event_based_statistics_v4_t dummy_event_stat;
+       key_update_info_v1_t dummy_key_update_info;
+#if defined(DHD_EWPR_VER2) && defined(DHD_STATUS_LOGGING)
+       stat_bdmask_req_t req;
+#endif /* DHD_EWPR_VER2 && DHD_STATUS_LOGGING */
+
+       DHD_FILTER_ERR(("STARTED\n"));
+
+       if (!dhdp || !buf) {
+               DHD_FILTER_ERR(("INVALID PTR: dhdp:%p buf:%p\n", dhdp, buf));
+               return BCME_ERROR;
+       }
+
+       i_ring_size = s_ring_size = e_ring_size = k_ring_size = dhd_ring_get_hdr_size();
+       s_ring_size += ((uint32)sizeof(EWPF_slc_elem_t)) * EWPF_REPORT_MAX_DATA;
+       i_ring_size += ((uint32)sizeof(EWPF_ifc_elem_t)) * EWPF_REPORT_MAX_DATA;
+       e_ring_size += ((uint32)sizeof(EWPF_event_elem_t)) * EWPF_REPORT_MAX_DATA;
+       k_ring_size += ((uint32)sizeof(EWPF_key_info_elem_t)) * EWPF_REPORT_MAX_DATA;
+
+       req_size = s_ring_size * EWPF_MAX_SLICE + i_ring_size * EWPF_MAX_IFACE +
+               e_ring_size * EWPF_MAX_EVENT + k_ring_size * EWPF_MAX_KEY_INFO;
+       req_size += (uint32)sizeof(EWP_filter_t);
+
+       if (buf_size < req_size) {
+               DHD_FILTER_ERR(("BUF SIZE IS TO SHORT: req:%d buf_size:%d\n",
+                       req_size, buf_size));
+               return BCME_ERROR;
+       }
+
+       BCM_REFERENCE(dhdp);
+       filter = (EWP_filter_t *)buf;
+       buf_ptr += sizeof(EWP_filter_t);
+
+       /* initialize control block */
+       memset(filter, 0, sizeof(EWP_filter_t));
+
+       filter->idx_type = EWPF_INVALID;
+       filter->xtlv_idx = EWPF_INVALID;
+       filter->tmp_armcycle = 0;
+
+       for (idx = 0; idx < EWPF_MAX_SLICE; idx++) {
+               filter->s_ring[idx] = dhd_ring_init(dhdp, buf_ptr, s_ring_size,
+                       sizeof(EWPF_slc_elem_t), EWPF_REPORT_MAX_DATA,
+                       DHD_RING_TYPE_FIXED);
+               if (!filter->s_ring[idx]) {
+                       DHD_FILTER_ERR(("FAIL TO INIT SLICE RING: %d\n", idx));
+                       return BCME_ERROR;
+               }
+               buf_ptr += s_ring_size;
+       }
+
+       for (idx = 0; idx < EWPF_MAX_IFACE; idx++) {
+               filter->i_ring[idx] = dhd_ring_init(dhdp, buf_ptr, i_ring_size,
+                       sizeof(EWPF_ifc_elem_t), EWPF_REPORT_MAX_DATA,
+                       DHD_RING_TYPE_FIXED);
+               if (!filter->i_ring[idx]) {
+                       DHD_FILTER_ERR(("FAIL TO INIT INTERFACE RING: %d\n", idx));
+                       return BCME_ERROR;
+               }
+               buf_ptr += i_ring_size;
+       }
+
+       for (idx = 0; idx < EWPF_MAX_EVENT; idx++) {
+               filter->e_ring[idx] = dhd_ring_init(dhdp, buf_ptr, e_ring_size,
+                       sizeof(EWPF_event_elem_t), EWPF_REPORT_MAX_DATA,
+                       DHD_RING_TYPE_FIXED);
+               if (!filter->e_ring[idx]) {
+                       DHD_FILTER_ERR(("FAIL TO INIT INTERFACE RING: %d\n", idx));
+                       return BCME_ERROR;
+               }
+               buf_ptr += e_ring_size;
+       }
+
+       for (idx = 0; idx < EWPF_MAX_KEY_INFO; idx++) {
+               filter->k_ring[idx] = dhd_ring_init(dhdp, buf_ptr, k_ring_size,
+                       sizeof(EWPF_key_info_elem_t), EWPF_REPORT_MAX_DATA,
+                       DHD_RING_TYPE_FIXED);
+               if (!filter->k_ring[idx]) {
+                       DHD_FILTER_ERR(("FAIL TO INIT INTERFACE RING: %d\n", idx));
+                       return BCME_ERROR;
+               }
+               buf_ptr += k_ring_size;
+       }
+
+       dhdp->event_log_filter = filter;
+       filter->dhdp = dhdp;
+       filter->enabled = TRUE;
+
+       /*
+        * put dummy element of event based encounters to prevent error
+        * in case of no event happened when data collection is triggered
+        */
+       ctx.dhdp = dhdp;
+       ctx.tbl = EWPF_main;
+       memset(&dummy_event_stat, 0x00, sizeof(dummy_event_stat));
+       evt_xtlv_copy_cb(&ctx, (uint8 *)&dummy_event_stat, WL_IFSTATS_XTLV_IF_EVENT_STATS,
+               sizeof(wl_event_based_statistics_v4_t));
+
+       memset(&dummy_key_update_info, 0x00, sizeof(dummy_key_update_info));
+       evt_xtlv_copy_cb(&ctx, (uint8 *)&dummy_key_update_info, WL_IFSTATS_XTLV_KEY_PLUMB_INFO,
+               sizeof(key_update_info_v1_t));
+
+#if defined(DHD_EWPR_VER2) && defined(DHD_STATUS_LOGGING)
+       /* create status filter for bigdata logging */
+       req.req_buf = dhd_statlog_filter;
+       req.req_buf_len = sizeof(dhd_statlog_filter);
+       dhd_statlog_generate_bdmask(dhdp, &req);
+#endif /* DHD_EWPR_VER2 && DHD_STATUS_LOGGING */
+
+       return BCME_OK;
+}
+
+void
+dhd_event_log_filter_deinit(dhd_pub_t *dhdp)
+{
+       EWP_filter_t *filter;
+       int idx;
+
+       if (!dhdp) {
+               return;
+       }
+
+       if (dhdp->event_log_filter) {
+               filter = (EWP_filter_t *)dhdp->event_log_filter;
+               for (idx = 0; idx < EWPF_MAX_SLICE; idx ++) {
+                       dhd_ring_deinit(dhdp, filter->s_ring[idx]);
+               }
+               for (idx = 0; idx < EWPF_MAX_IFACE; idx ++) {
+                       dhd_ring_deinit(dhdp, filter->i_ring[idx]);
+               }
+               for (idx = 0; idx < EWPF_MAX_EVENT; idx ++) {
+                       dhd_ring_deinit(dhdp, filter->e_ring[idx]);
+               }
+               for (idx = 0; idx < EWPF_MAX_KEY_INFO; idx ++) {
+                       dhd_ring_deinit(dhdp, filter->k_ring[idx]);
+               }
+               dhdp->event_log_filter = NULL;
+       }
+}
+
+void
+dhd_event_log_filter_notify_connect_request(dhd_pub_t *dhdp, uint8 *bssid, int channel)
+{
+       EWP_filter_t *filter;
+       void *last_elem;
+
+       if (!dhdp || !dhdp->event_log_filter) {
+               return;
+       }
+
+       filter = (EWP_filter_t *)dhdp->event_log_filter;
+       if (filter->enabled != TRUE) {
+               DHD_FILTER_ERR(("EWP Filter is not enabled\n"));
+               return;
+       }
+
+       memcpy(filter->last_bssid, bssid, ETHER_ADDR_LEN);
+       filter->last_channel = channel;
+
+       /* Refer STA interface */
+       last_elem = dhd_ring_get_last(filter->i_ring[0]);
+       if (last_elem == NULL) {
+               filter->last_armcycle = 0;
+       } else {
+               /* EXCLUDE before connect start */
+               filter->last_armcycle = *(uint32 *)last_elem + EWPF_EPOCH + 1;
+       }
+}
+
+void
+dhd_event_log_filter_notify_connect_done(dhd_pub_t *dhdp, uint8 *bssid, int roam)
+{
+       EWP_filter_t *filter;
+       void *last_elem;
+       int channel;
+       char buf[EWPF_DEBUG_BUF_LEN];
+       int ret;
+       uint32 armcycle;
+       struct channel_info *ci;
+
+       if (!dhdp || !dhdp->event_log_filter) {
+               return;
+       }
+
+       filter = (EWP_filter_t *)dhdp->event_log_filter;
+       if (filter->enabled != TRUE) {
+               DHD_FILTER_ERR(("EWP Filter is not enabled\n"));
+               return;
+       }
+
+       /* GET CHANNEL */
+       *(uint32 *)buf = htod32(EWPF_DEBUG_BUF_LEN);
+       ret = dhd_wl_ioctl_cmd(dhdp, WLC_GET_CHANNEL, buf, EWPF_DEBUG_BUF_LEN, FALSE, 0);
+       if (ret != BCME_OK) {
+               DHD_FILTER_ERR(("FAIL TO GET BSS INFO: %d\n", ret));
+               return;
+       }
+
+       ci = (struct channel_info *)(buf + sizeof(uint32));
+       channel = dtoh32(ci->hw_channel);
+       DHD_FILTER_TRACE(("CHANNEL:prev %d new:%d\n", filter->last_channel, channel));
+
+       memcpy(filter->last_bssid, bssid, ETHER_ADDR_LEN);
+       filter->last_channel = channel;
+       if (roam == FALSE) {
+               return;
+       }
+
+       /* update connect time for roam */
+       /* Refer STA interface */
+       last_elem = dhd_ring_get_last(filter->i_ring[0]);
+       if (last_elem == NULL) {
+               armcycle = 0;
+       } else {
+               /* EXCLUDE before roam done */
+               armcycle = *(uint32 *)last_elem + EWPF_EPOCH + 1;
+       }
+
+       filter->last_armcycle = armcycle;
+}
+
+static int
+evt_xtlv_print_cb(void *ctx, const uint8 *data, uint16 type, uint16 len)
+{
+       EWPF_ctx_t *cur_ctx = (EWPF_ctx_t *)ctx;
+       EWP_filter_t *filter = (EWP_filter_t *)cur_ctx->dhdp->event_log_filter;
+       uint32 armcycle = 0;
+       uint8 bssid[ETHER_ADDR_LEN];
+       uint32 initial_assoc_time = 0;
+       uint32 prev_roam_time = 0;
+       uint32 last_roam_event_type = 0;
+       uint32 last_roam_event_status = 0;
+       uint32 last_roam_event_reason = 0;
+       wl_wips_event_info_t wips_event;
+       bzero(&wips_event, sizeof(wips_event));
+
+       DHD_FILTER_TRACE(("%s type:%d %x len:%d %x\n", __FUNCTION__, type, type, len, len));
+
+       /* get current armcycle */
+       if (filter) {
+               armcycle = filter->tmp_armcycle;
+       }
+       if (type == WL_IFSTATS_XTLV_IF_EVENT_STATS) {
+               wl_event_based_statistics_v1_t *elem;
+
+               elem = (wl_event_based_statistics_v1_t *)(uintptr_t)data;
+               if (elem->txdeauthivalclass > 0) {
+                       memcpy(bssid, &elem->BSSID, ETHER_ADDR_LEN);
+                       DHD_ERROR(("DHD STA sent DEAUTH frame with invalid class : %d times"
+                               ", BSSID("MACDBG")\n", elem->txdeauthivalclass, MAC2STRDBG(bssid)));
+               }
+               if (elem->version == WL_EVENT_STATISTICS_VER_2) {
+                       wl_event_based_statistics_v2_t *elem_v2;
+
+                       elem_v2 = (wl_event_based_statistics_v2_t *)(uintptr_t)data;
+                       memcpy(&wips_event.bssid, &elem_v2->last_deauth, ETHER_ADDR_LEN);
+                       wips_event.misdeauth = elem_v2->misdeauth;
+                       wips_event.current_RSSI = elem_v2->cur_rssi;
+                       wips_event.deauth_RSSI = elem_v2->deauth_rssi;
+                       wips_event.timestamp = elem_v2->timestamp;
+               } else if (elem->version == WL_EVENT_STATISTICS_VER_3) {
+                       wl_event_based_statistics_v3_t *elem_v3;
+
+                       elem_v3 = (wl_event_based_statistics_v3_t *)(uintptr_t)data;
+                       memcpy(&wips_event.bssid, &elem_v3->last_deauth, ETHER_ADDR_LEN);
+                       wips_event.misdeauth = elem_v3->misdeauth;
+                       wips_event.current_RSSI = elem_v3->cur_rssi;
+                       wips_event.deauth_RSSI = elem_v3->deauth_rssi;
+                       wips_event.timestamp = elem_v3->timestamp;
+                       /* roam statistics */
+                       initial_assoc_time = elem_v3->initial_assoc_time;
+                       prev_roam_time = elem_v3->prev_roam_time;
+                       last_roam_event_type = elem_v3->last_roam_event_type;
+                       last_roam_event_status = elem_v3->last_roam_event_status;
+                       last_roam_event_reason = elem_v3->last_roam_event_reason;
+               } else if (elem->version == WL_EVENT_STATISTICS_VER_4) {
+                       wl_event_based_statistics_v4_t *elem_v4;
+
+                       elem_v4 = (wl_event_based_statistics_v4_t *)(uintptr_t)data;
+                       memcpy(&wips_event.bssid, &elem_v4->last_deauth, ETHER_ADDR_LEN);
+                       wips_event.misdeauth = elem_v4->misdeauth;
+                       wips_event.current_RSSI = elem_v4->cur_rssi;
+                       wips_event.deauth_RSSI = elem_v4->deauth_rssi;
+                       wips_event.timestamp = elem_v4->timestamp;
+               }
+               if (wips_event.misdeauth > 1) {
+                       DHD_ERROR(("WIPS attack!! cnt=%d, curRSSI=%d, deauthRSSI=%d "
+                               ", time=%d, MAC="MACDBG"\n",
+                               wips_event.misdeauth, wips_event.current_RSSI,
+                               wips_event.deauth_RSSI, wips_event.timestamp,
+                               MAC2STRDBG(&wips_event.bssid)));
+#if defined(WL_CFG80211) && defined(WL_WIPSEVT)
+                       wl_cfg80211_wips_event_ext(&wips_event);
+#endif /* WL_CFG80211 && WL_WIPSEVT */
+               }
+       } else if (type == WL_IFSTATS_XTLV_ROAM_STATS_EVENT) {
+               wl_roam_stats_v1_t *roam_elem;
+               roam_elem = (wl_roam_stats_v1_t *)(uintptr_t)data;
+               if (roam_elem->version == WL_ROAM_STATS_VER_1) {
+                       wl_roam_stats_v1_t *roam_elem_v1;
+
+                       roam_elem_v1 = (wl_roam_stats_v1_t *)(uintptr_t)data;
+                       /* roam statistics */
+                       initial_assoc_time = roam_elem_v1->initial_assoc_time;
+                       prev_roam_time = roam_elem_v1->prev_roam_time;
+                       last_roam_event_type = roam_elem_v1->last_roam_event_type;
+                       last_roam_event_status = roam_elem_v1->last_roam_event_status;
+                       last_roam_event_reason = roam_elem_v1->last_roam_event_reason;
+               }
+       } else {
+               DHD_FILTER_ERR(("%s TYPE(%d) IS NOT SUPPORTED TO PRINT\n",
+                       __FUNCTION__, type));
+               return BCME_ERROR;
+       }
+       if (initial_assoc_time > 0 && prev_roam_time > 0) {
+               DHD_ERROR(("Last roam event before disconnection : "
+                       "current armcycle %d, initial assoc time %d, "
+                       "last event time %d, type %d, status %d, reason %d\n",
+                       armcycle, initial_assoc_time, prev_roam_time,
+                       last_roam_event_type, last_roam_event_status,
+                       last_roam_event_reason));
+       }
+
+       return BCME_OK;
+}
+
+#ifdef BCM_SDC
+static int
+evt_get_last_toss_hist(uint8 *ptr, const uint8 *data, uint16 len)
+{
+       bcm_xtlv_t *bcm_xtlv_desc = (bcm_xtlv_t *)data;
+       wl_hist_compact_toss_stats_v2_t *ewp_stats;
+       evt_hist_compact_toss_stats_v1_t bidata_stats;
+       int16 max_rcidx = EWPF_INVALID, secnd_rcidx = EWPF_INVALID;
+       uint16 cur_rnidx = 0, prev_rnidx = 0;
+       uint16 max_rccnt = 0, cur_rccnt = 0;
+       uint16 idx;
+
+       if (!ptr || !data) {
+               return BCME_ERROR;
+       }
+
+       if (bcm_xtlv_desc->len != sizeof(wl_hist_compact_toss_stats_v2_t)) {
+               DHD_FILTER_ERR(("%s : size is not matched  %d\n", __FUNCTION__,
+                       bcm_xtlv_desc->len));
+               return BCME_ERROR;
+       }
+
+       ewp_stats = (wl_hist_compact_toss_stats_v2_t *)(&bcm_xtlv_desc->data[0]);
+       if (ewp_stats->htr_type == WL_STATE_HIST_TX_TOSS_REASONS) {
+               if (ewp_stats->version != WL_HIST_COMPACT_TOSS_STATS_TX_VER_2) {
+                       DHD_FILTER_ERR(("%s : unsupported version %d (type: %d)\n",
+                               __FUNCTION__, ewp_stats->version, ewp_stats->htr_type));
+                       return BCME_ERROR;
+               }
+       } else if (ewp_stats->htr_type == WL_STATE_HIST_RX_TOSS_REASONS) {
+               if (ewp_stats->version != WL_HIST_COMPACT_TOSS_STATS_RX_VER_2) {
+                       DHD_FILTER_ERR(("%s : unsupported version %d (type: %d)\n",
+                               __FUNCTION__, ewp_stats->version, ewp_stats->htr_type));
+                       return BCME_ERROR;
+               }
+       } else {
+               DHD_FILTER_ERR(("%s : unsupported type %d\n", __FUNCTION__,
+                       ewp_stats->htr_type));
+               return BCME_ERROR;
+       }
+       /*
+        * htr_rnidx is pointing the next empty slot to be used
+        * Need to get previous index which is valid
+        */
+       if (ewp_stats->htr_rnidx > 0) {
+               cur_rnidx = ewp_stats->htr_rnidx - 1;
+       } else {
+               cur_rnidx = WLC_HIST_TOSS_LEN - 1;
+       }
+       if (cur_rnidx > 0) {
+               prev_rnidx = cur_rnidx - 1;
+       } else {
+               prev_rnidx = WLC_HIST_TOSS_LEN - 1;
+       }
+       /*
+        * Need to get largest count of toss reasons
+        */
+       for (idx = 0; idx < WLC_HIST_TOSS_LEN; idx ++) {
+               cur_rccnt = (uint16)((ewp_stats->htr_rc[idx] &
+                       HIST_TOSS_RC_COUNT_MASK)>>HIST_TOSS_RC_COUNT_POS);
+               DHD_FILTER_TRACE(("%s: idx %d htr_rc %04x cur_rccnt %d\n",
+                       __FUNCTION__, idx, ewp_stats->htr_rc[idx], cur_rccnt));
+               if (ewp_stats->htr_rc_ts[idx] && max_rccnt < cur_rccnt) {
+                       max_rccnt = cur_rccnt;
+                       secnd_rcidx = max_rcidx;
+                       max_rcidx = idx;
+                       DHD_FILTER_TRACE(("%s: max_rcidx updated -"
+                               "max_rcidx %d secnd_rcidx %d\n",
+                               __FUNCTION__, max_rcidx, secnd_rcidx));
+               }
+       }
+
+       memset(&bidata_stats, 0x00, sizeof(bidata_stats));
+       bidata_stats.version = ewp_stats->version;
+       bidata_stats.htr_type = ewp_stats->htr_type;
+       bidata_stats.htr_num = ewp_stats->htr_num;
+       bidata_stats.htr_rn_last = ewp_stats->htr_running[cur_rnidx];
+       bidata_stats.htr_rn_ts_last = ewp_stats->htr_rn_ts[cur_rnidx];
+       bidata_stats.htr_rn_prev = ewp_stats->htr_running[prev_rnidx];
+       bidata_stats.htr_rn_ts_prev = ewp_stats->htr_rn_ts[prev_rnidx];
+       if (max_rcidx != EWPF_INVALID) {
+               bidata_stats.htr_rc_max = ewp_stats->htr_rc[max_rcidx];
+               bidata_stats.htr_rc_ts_max = ewp_stats->htr_rc_ts[max_rcidx];
+       }
+       if (secnd_rcidx != EWPF_INVALID) {
+               bidata_stats.htr_rc_secnd = ewp_stats->htr_rc[secnd_rcidx];
+               bidata_stats.htr_rc_ts_secnd = ewp_stats->htr_rc_ts[secnd_rcidx];
+       }
+       DHD_FILTER_TRACE(("%s: ver %d type %d num %d "
+               "htr_rn_last %d htr_rn_ts_last %d htr_rn_prev %d htr_rn_ts_prev %d "
+               "htr_rc_max %d htr_rc_ts_max %d htr_rc_secnd %d htr_rc_ts_secnd %d\n",
+               __FUNCTION__, bidata_stats.version,
+               bidata_stats.htr_type, bidata_stats.htr_num,
+               bidata_stats.htr_rn_last, bidata_stats.htr_rn_ts_last,
+               bidata_stats.htr_rn_prev, bidata_stats.htr_rn_ts_prev,
+               bidata_stats.htr_rc_max, bidata_stats.htr_rc_ts_max,
+               bidata_stats.htr_rc_secnd, bidata_stats.htr_rc_ts_secnd));
+
+       memcpy(ptr, &bidata_stats, sizeof(bidata_stats));
+
+       return BCME_OK;
+}
+#endif /* BCM_SDC */
+
+static int
+evt_xtlv_copy_cb(void *ctx, const uint8 *data, uint16 type, uint16 len)
+{
+       EWPF_ctx_t *cur_ctx = (EWPF_ctx_t *)ctx;
+       EWP_filter_t *filter = (EWP_filter_t *)cur_ctx->dhdp->event_log_filter;
+       uint32 *armcycle;
+       EWPF_tbl_t *tbl;
+       void *ring;
+       void *target;
+       uint8 *ptr;
+       int tbl_idx;
+       uint32 elem_size;
+
+       DHD_FILTER_TRACE(("%s type:%d %x len:%d %x\n", __FUNCTION__, type, type, len, len));
+
+       for (tbl_idx = 0; ; tbl_idx++) {
+               if (cur_ctx->tbl[tbl_idx].xtlv_id == EWPF_XTLV_INVALID) {
+                       DHD_FILTER_ERR(("%s NOT SUPPORTED TYPE(%d)\n", __FUNCTION__, type));
+                       return BCME_OK;
+               }
+               if (cur_ctx->tbl[tbl_idx].xtlv_id == type) {
+                       tbl = &cur_ctx->tbl[tbl_idx];
+                       break;
+               }
+       }
+
+       /* Set index type and xtlv_idx for event stats and key plumb info */
+       if (type == WL_IFSTATS_XTLV_IF_EVENT_STATS) {
+               filter->idx_type = EWPF_IDX_TYPE_EVENT;
+               filter->xtlv_idx = 0;
+               DHD_FILTER_TRACE(("EVENT XTLV\n"));
+       } else if (type == WL_IFSTATS_XTLV_KEY_PLUMB_INFO) {
+               filter->idx_type = EWPF_IDX_TYPE_KEY_INFO;
+               filter->xtlv_idx = 0;
+               DHD_FILTER_TRACE(("KEY INFO XTLV\n"));
+       }
+
+       /* Check Validation */
+       if (filter->idx_type == EWPF_INVALID ||
+               filter->xtlv_idx == EWPF_INVALID ||
+               filter->idx_type != tbl->idx_type ||
+               filter->xtlv_idx >= tbl->max_idx) {
+               DHD_FILTER_ERR(("XTLV VALIDATION FAILED: type:%x xtlv:%x idx:%d\n",
+                       filter->idx_type, tbl->xtlv_id, filter->xtlv_idx));
+               return BCME_OK;
+       }
+
+       /* SET RING INFO */
+       if (filter->idx_type == EWPF_IDX_TYPE_SLICE) {
+               ring = filter->s_ring[filter->xtlv_idx];
+               elem_size = sizeof(EWPF_slc_elem_t);
+       } else if (filter->idx_type == EWPF_IDX_TYPE_IFACE) {
+               ring = filter->i_ring[filter->xtlv_idx];
+               elem_size = sizeof(EWPF_ifc_elem_t);
+       } else if (filter->idx_type == EWPF_IDX_TYPE_EVENT) {
+               DHD_FILTER_TRACE(("%s: EWPF_IDX_TYPE_EVENT FOUND\n",
+               __FUNCTION__));
+               ring = filter->e_ring[filter->xtlv_idx];
+               elem_size = sizeof(EWPF_event_elem_t);
+       } else if (filter->idx_type == EWPF_IDX_TYPE_KEY_INFO) {
+               DHD_FILTER_TRACE(("%s: EWPF_IDX_TYPE_KEY_INFO FOUND\n",
+               __FUNCTION__));
+               ring = filter->k_ring[filter->xtlv_idx];
+               elem_size = sizeof(EWPF_key_info_elem_t);
+       } else {
+               DHD_FILTER_TRACE(("%s unsupported idx_type:%d\n",
+                       __FUNCTION__, filter->idx_type));
+               return BCME_OK;
+       }
+
+       /* Check armcycle epoch is changed */
+       target = dhd_ring_get_last(ring);
+       if (target != NULL) {
+               armcycle = (uint32 *)target;
+               if (*armcycle + EWPF_EPOCH <= filter->tmp_armcycle) {
+                       /* EPOCH is changed (longer than 1sec) */
+                       target = NULL;
+               } else if (*armcycle - EWPF_EPOCH >= filter->tmp_armcycle) {
+                       /* dongle is rebooted */
+                       target = NULL;
+               }
+       }
+
+       if (target == NULL) {
+               /* Get new idx */
+               target = dhd_ring_get_empty(ring);
+               if (target == NULL) {
+                       /* no available slot due to oldest slot is locked */
+                       DHD_FILTER_ERR(("SKIP to logging xltv(%x) due to locking\n", type));
+                       return BCME_OK;
+               }
+
+               /* clean up target */
+               armcycle = (uint32 *)target;
+               memset(target, 0, elem_size);
+               memcpy(armcycle, &filter->tmp_armcycle, sizeof(*armcycle));
+       }
+
+#ifdef EWPF_DEBUG
+       DHD_FILTER_ERR(("idx:%d write_:%p %u %u\n",
+               filter->xtlv_idx, target, *armcycle, filter->tmp_armcycle));
+#endif
+
+       /* Additionally put updated armcycle for event based EWP */
+       if (filter->idx_type == EWPF_IDX_TYPE_EVENT ||
+               filter->idx_type == EWPF_IDX_TYPE_KEY_INFO) {
+               DHD_FILTER_TRACE(("%s: updated armcycle for event based EWP\n",
+               __FUNCTION__));
+               memcpy((uint32 *)(armcycle + EWPF_UPDATE_ARM_CYCLE_OFFSET),
+                       &filter->tmp_armcycle, sizeof(*armcycle));
+       }
+
+       ptr = (uint8 *)target;
+
+#ifdef DHD_EWPR_VER2
+       if (tbl->xtlv_id == WL_SLICESTATS_XTLV_HIST_TX_STATS ||
+                       tbl->xtlv_id == WL_SLICESTATS_XTLV_HIST_RX_STATS) {
+#ifdef BCM_SDC
+               int err;
+
+               DHD_FILTER_TRACE(("TOSS_REASONS received (%d)\n", tbl->xtlv_id));
+
+               err = evt_get_last_toss_hist(ptr + cur_ctx->tbl[tbl_idx].offset, data, len);
+               if (err) {
+                       DHD_FILTER_ERR(("%s: get toss hist failed\n",
+                               __FUNCTION__));
+                       return BCME_ERROR;
+               }
+#else
+               DHD_FILTER_ERR(("%s: Unabled to copy hist TX/RX stats, BCM_SDC must be included\n",
+                       __FUNCTION__));
+#endif /* BCM_SDC */
+       } else
+#endif /* DHD_EWPR_VER2 */
+       {
+               /* XXX multiversion shall be use same structure of old version */
+               if (len > cur_ctx->tbl[tbl_idx].member_length) {
+                       DHD_FILTER_TRACE(("data Length is too big to save: (alloc = %d), "
+                               "(data = %d)\n", cur_ctx->tbl[tbl_idx].member_length, len));
+                       len = cur_ctx->tbl[tbl_idx].member_length;
+               }
+
+               memcpy(ptr + cur_ctx->tbl[tbl_idx].offset, data, len);
+       }
+       return BCME_OK;
+}
+
+static int
+evt_xtlv_idx_cb(void *ctx, const uint8 *data, uint16 type, uint16 len)
+{
+       EWPF_ctx_t *cur_ctx = (EWPF_ctx_t *)ctx;
+       EWP_filter_t *filter = (EWP_filter_t *)cur_ctx->dhdp->event_log_filter;
+
+       filter->xtlv_idx = data[0];
+
+       if (filter->idx_type == EWPF_IDX_TYPE_SLICE) {
+               if (type != WL_IFSTATS_XTLV_SLICE_INDEX ||
+                       filter->xtlv_idx >= EWPF_MAX_SLICE) {
+                       goto idx_fail;
+               }
+       } else if (filter->idx_type == EWPF_IDX_TYPE_IFACE) {
+               if (type != WL_IFSTATS_XTLV_IF_INDEX ||
+                       filter->xtlv_idx >= EWPF_MAX_IFACE) {
+                       DHD_FILTER_ERR(("CHANGE IFACE TO 0 in FORCE\n"));
+                       return BCME_OK;
+               }
+       } else {
+               goto idx_fail;
+       }
+       return BCME_OK;
+
+idx_fail:
+       DHD_FILTER_ERR(("UNEXPECTED IDX XTLV: filter_type:%d input_type%x idx:%d\n",
+               filter->idx_type, type, filter->xtlv_idx));
+       filter->idx_type = EWPF_INVALID;
+       filter->xtlv_idx = EWPF_INVALID;
+       return BCME_OK;
+}
+
+static int
+evt_xtlv_type_cb(void *ctx, const uint8 *data, uint16 type, uint16 len)
+{
+       EWPF_ctx_t *cur_ctx = (EWPF_ctx_t *)ctx;
+       EWP_filter_t *filter = (EWP_filter_t *)cur_ctx->dhdp->event_log_filter;
+
+       if (type == WL_IFSTATS_XTLV_WL_SLICE) {
+               filter->idx_type = EWPF_IDX_TYPE_SLICE;
+               DHD_FILTER_TRACE(("SLICE XTLV\n"));
+       } else if (type == WL_IFSTATS_XTLV_IF) {
+               filter->idx_type = EWPF_IDX_TYPE_IFACE;
+               DHD_FILTER_TRACE(("IFACE XTLV\n"));
+       }
+
+       bcm_unpack_xtlv_buf(ctx, data, len,
+               BCM_XTLV_OPTION_ALIGN32, filter_main_cb);
+       return BCME_OK;
+}
+
+static int
+evt_xtlv_roam_cb(void *ctx, const uint8 *data, uint16 type, uint16 len)
+{
+
+       EWPF_ctx_t *cur_ctx = (EWPF_ctx_t *)ctx;
+       EWPF_tbl_t *new_tbl = EWPF_roam;
+       EWPF_ctx_t sub_ctx;
+       int idx;
+
+       for (idx = 0; ; idx++) {
+               if (new_tbl[idx].xtlv_id == EWPF_XTLV_INVALID) {
+                       DHD_FILTER_TRACE(("%s NOT SUPPORTED TYPE(%d)\n", __FUNCTION__, type));
+                       return BCME_OK;
+               }
+               if (new_tbl[idx].xtlv_id == type) {
+                       break;
+               }
+       }
+
+       /* MULTI version may not applied */
+       if (len > sizeof(cur_ctx->dhdp->roam_evt)) {
+               DHD_FILTER_ERR(("data length is too big :max= %d, cur=%d\n",
+                               (int)sizeof(cur_ctx->dhdp->roam_evt), len));
+               len = sizeof(cur_ctx->dhdp->roam_evt);
+       }
+
+       /* save latest roam event to report via get_bss_info */
+       (void)memcpy_s((char *)&cur_ctx->dhdp->roam_evt, sizeof(cur_ctx->dhdp->roam_evt),
+                       data, len);
+
+       sub_ctx.dhdp = cur_ctx->dhdp;
+       sub_ctx.tbl = new_tbl;
+       new_tbl[idx].cb_func(&sub_ctx, data, type, len);
+       return BCME_OK;
+}
+
+static int
+filter_main_cb(void *ctx, const uint8 *data, uint16 type, uint16 len)
+{
+       EWPF_ctx_t *cur_ctx = (EWPF_ctx_t *)ctx;
+       EWPF_ctx_t sub_ctx;
+       int idx;
+       int err = BCME_OK;
+
+       DHD_FILTER_TRACE(("%s type:%x len:%d\n", __FUNCTION__, type, len));
+
+       sub_ctx.dhdp = cur_ctx->dhdp;
+       for (idx = 0; ; idx++) {
+               if (cur_ctx->tbl[idx].xtlv_id == EWPF_XTLV_INVALID) {
+                       DHD_FILTER_TRACE(("%s NOT SUPPORTED TYPE(%d)\n", __FUNCTION__, type));
+                       return BCME_OK;
+               }
+               if (cur_ctx->tbl[idx].xtlv_id == type) {
+                       /* parse sub xtlv */
+                       if (cur_ctx->tbl[idx].cb_func == NULL) {
+                               sub_ctx.tbl = cur_ctx->tbl[idx].tbl;
+                               err = bcm_unpack_xtlv_buf(&sub_ctx, data, len,
+                                               BCM_XTLV_OPTION_ALIGN32, filter_main_cb);
+                               return err;
+                       }
+
+                       /* handle for structure/variable */
+                       err = cur_ctx->tbl[idx].cb_func(ctx, data, type, len);
+                       if (err != BCME_OK) {
+                               return err;
+                       }
+               }
+       }
+
+       return err;
+}
+
+void
+dhd_event_log_filter_event_handler(dhd_pub_t *dhdp, prcd_event_log_hdr_t *plog_hdr, uint32 *data)
+{
+       int err;
+       EWP_filter_t *filter;
+       EWPF_ctx_t ctx;
+
+       if (!dhdp->event_log_filter) {
+               DHD_FILTER_ERR(("NO FILTER MODULE\n"));
+               return;
+       }
+
+       if (!plog_hdr || !data) {
+               /* XXX Validation check is done by caller */
+               DHD_FILTER_ERR(("INVALID PARAMETER\n"));
+               return;
+       }
+
+       filter = (EWP_filter_t *)dhdp->event_log_filter;
+       if (filter->enabled != TRUE) {
+               DHD_FILTER_ERR(("FITLER IS NOT STARTED\n"));
+               return;
+       }
+
+       /* get ARMCYCLE */
+       filter->tmp_armcycle = plog_hdr->armcycle;
+       filter->idx_type = EWPF_INVALID;
+       filter->xtlv_idx = EWPF_INVALID;
+
+#ifdef EWPF_DEBUG
+       {
+               char buf[EWPF_DEBUG_BUF_LEN];
+               int idx;
+
+               memset(buf, 0, sizeof(buf));
+               DHD_FILTER_ERR(("tag %d(%x) count %d(%x)\n",
+                       plog_hdr->tag, plog_hdr->tag, plog_hdr->count, plog_hdr->count));
+               for (idx = 0; idx < plog_hdr->count; idx++) {
+                       sprintf(&buf[strlen(buf)], "%08x ", data[idx]);
+                       if ((idx + 1) % EWPF_VAL_CNT_PLINE == 0) {
+                               DHD_FILTER_ERR(("%s\n", buf));
+                               memset(buf, 0, sizeof(buf));
+                       }
+               }
+               if (strlen(buf) > 0) {
+                       DHD_FILTER_ERR(("%s\n", buf));
+               }
+       }
+#endif /* EWPF_DEBUG */
+
+       ctx.dhdp = dhdp;
+       ctx.tbl = EWPF_main;
+       if ((err = bcm_unpack_xtlv_buf(
+               &ctx,
+               (const uint8 *)data,
+               (plog_hdr->count - 1) * sizeof(uint32),
+               BCM_XTLV_OPTION_ALIGN32,
+               filter_main_cb))) {
+               DHD_FILTER_ERR(("FAIL TO UNPACK XTLV: err(%d)\n", err));
+       }
+}
+/* ========= Private Command(Serialize) ============= */
+/* XXX REPORT MODULE will be done after discuss with customer */
+/* XXX Current implementation is temporal to verify FILTER MODULE works */
+//#define EWPR_DEBUG
+#ifdef EWPR_DEBUG
+#undef DHD_FILTER_TRACE
+#define DHD_FILTER_TRACE DHD_FILTER_ERR
+#endif /* EWPR_DEBUG */
+#define EWPR_DEBUG_BUF_LEN     512
+
+#define EWP_REPORT_ELEM_PRINT_BUF      256
+#define EWP_REPORT_NAME_MAX            64
+
+#ifdef DHD_EWPR_VER2
+#define EWP_REPORT_VERSION     0x20190514
+#define EWP_REPORT_SET_DEFAULT 0x01
+#define EWPR_CSDCLIENT_DIFF    10
+#define EWPR_INTERVAL  3
+#define EWPR_DELTA_CNT 1       /* 3 seconds before */
+#define EWPR_ARRAY_CNT 10      /* INTERVAL * ARRAY total 30 seconds to lock */
+#define EWPR_DELTA_LAST_POS            6
+
+#define INDEX_STR_SIZE         6
+#define        DHD_STAT_STR_SIZE       2
+#define REPORT_VERSION_STR_SIZE        8
+#define DELIMITER_LEN          1
+#else
+#define EWP_REPORT_VERSION     0x20170905
+#define EWPR_CSDCLIENT_DIFF    4
+#define EWPR_INTERVAL  3
+#define EWPR_ARRAY_CNT 10      /* INTERVAL * ARRAY total 30 seconds to lock */
+#endif /* DHD_EWPR_VER2 */
+
+#define EWPR_DELTA3_POS                3
+#define EWPR_DELTA2_POS                2
+#define EWPR_DELTA1_POS                1
+#define EWPR_NOW_POS           0
+
+#define EWPR_DELTA1_CNT        2       /* 6 seconds before */
+#define EWPR_DELTA2_CNT        5       /* 15 seconds before */
+#define EWPR_DELTA3_CNT        9       /* 27 seconds before */
+
+#define EWPR_CNT_PER_LINE      5
+
+/* EWP Reporter display format */
+#define EWP_DEC        1
+#define EWP_HEX        2
+#define EWP_BIN        3
+
+/* EWP Filter Data type */
+/* BASIC : signed + length */
+#define EWP_UINT8      2
+#define EWP_UINT16     4
+#define EWP_UINT32     8
+#define EWP_UINT64     16
+#define EWP_INT8       102
+#define EWP_INT16      104
+#define EWP_INT32      108
+#define EWP_BIT                201
+
+/* NON BAISC : need special handling */
+#define EWP_NON_BASIC  200
+#define EWP_DATE               201
+#define EWP_TIME               202
+#define EWP_BSSID              203
+#define EWP_OUI                        204
+
+/* Delimiter between values */
+#define KEY_DEL        ' '
+#define RAW_DEL '_'
+
+/* IOVAR BUF SIZE */
+#define EWPR_IOV_BUF_LEN       64
+
+typedef struct {
+       void *ring;                             /* INPUT ring to lock */
+       void **elem_list;               /* OUTPUT elem ptr list for each delta */
+       uint32 max_armcycle;    /* IN/OUT arm cycle should be less than this */
+       uint32 min_armcycle;    /* IN/OUT arm cycle should be bigger than this */
+       uint32 max_period;              /* IN allowed time diff between first and last */
+       uint32 delta_cnt;               /* IN finding delta count */
+       uint32 *delta_list;             /* IN delta values to find */
+} ewpr_lock_param_t;
+
+#define MAX_MULTI_VER  3
+typedef struct {
+       uint32  version;                /* VERSION for multiple version struct */
+       uint32  offset;                 /* offset of the member at the version */
+} ewpr_MVT_offset_elem_t;      /* elem for multi version type */
+
+typedef struct {
+       uint32  version_offset;         /* offset of version */
+       ewpr_MVT_offset_elem_t opv[MAX_MULTI_VER];      /* offset per version */
+} ewpr_MVT_offset_t;                   /* multi_version type */
+
+typedef struct {
+       char name[EWP_REPORT_NAME_MAX];
+       int ring_type;          /* Ring Type : EWPF_IDX_TYPE_SLICE, EWPF_IDX_TYPE_IFACE */
+       int     is_multi_version;               /* is multi version */
+       union {
+               uint32 offset;                  /* Offset from start of element structure */
+               ewpr_MVT_offset_t v_info;
+       };
+       int data_type;                          /* Data type : one of EWP Filter Data Type */
+       int display_format;                     /* Display format : one of EWP Reporter display */
+       int display_type;                       /* MAX display BYTE : valid for HEX and BIN FORM */
+#ifdef DHD_EWPR_VER2
+       int info_type;                  /* info type : EWPF_INFO_ECNT, EWPF_INFO_IOVAR, ... */
+       int display_bit_length;         /* packing bit : valid for BIN FORM */
+       int display_array_size;         /* array size */
+       int display_method;             /* serial or diff */
+       int unit_convert;               /* unit conversion
+                                        * 0 or 1 : no conversion, put data as is
+                                        * greater than 1, divide value by unit_convert
+                                        */
+       bool need_abs;                  /* need absolute function for negative value */
+#endif /* DHD_EWPR_VER2 */
+} ewpr_serial_info_t;
+
+/* offset defines */
+#define EWPR_CNT_VERSION_OFFSET \
+       OFFSETOF(EWPF_slc_elem_t, compact_cntr_v3)
+
+#define EWPR_CNT_V1_OFFSET(a) \
+       WL_PERIODIC_COMPACT_CNTRS_VER_1, \
+       (OFFSETOF(EWPF_slc_elem_t, compact_cntr_v1) + OFFSETOF(wl_periodic_compact_cntrs_v1_t, a))
+#define EWPR_CNT_V2_OFFSET(a) \
+       WL_PERIODIC_COMPACT_CNTRS_VER_2, \
+       (OFFSETOF(EWPF_slc_elem_t, compact_cntr_v2) + OFFSETOF(wl_periodic_compact_cntrs_v2_t, a))
+#define EWPR_CNT_V3_OFFSET(a) \
+       WL_PERIODIC_COMPACT_CNTRS_VER_3, \
+       (OFFSETOF(EWPF_slc_elem_t, compact_cntr_v3) + OFFSETOF(wl_periodic_compact_cntrs_v3_t, a))
+#define EWPR_STAT_OFFSET(a) \
+       (OFFSETOF(EWPF_ifc_elem_t, if_stat) + OFFSETOF(wl_if_stats_t, a))
+#define EWPR_INFRA_OFFSET(a) \
+       (OFFSETOF(EWPF_ifc_elem_t, infra) + OFFSETOF(wl_if_infra_stats_t, a))
+#define EWPR_MGMT_OFFSET(a) \
+       (OFFSETOF(EWPF_ifc_elem_t, mgmt_stat) + OFFSETOF(wl_if_mgt_stats_t, a))
+#define EWPR_LQM_OFFSET(a) \
+       (OFFSETOF(EWPF_ifc_elem_t, lqm) + OFFSETOF(wl_lqm_t, a))
+#define EWPR_SIGNAL_OFFSET(a) \
+       (EWPR_LQM_OFFSET(current_bss) + OFFSETOF(wl_rx_signal_metric_t, a))
+#define EWPR_IF_COMP_OFFSET(a) \
+       (OFFSETOF(EWPF_ifc_elem_t, if_comp_stat) + OFFSETOF(wl_if_state_compact_t, a))
+#define EWPR_EVENT_COUNTER_OFFSET(a) \
+       (OFFSETOF(EWPF_event_elem_t, event_stat) + OFFSETOF(wl_event_based_statistics_v4_t, a))
+#define EWPR_KEY_INFO_OFFSET(a) \
+       (OFFSETOF(EWPF_key_info_elem_t, key_update_info) + OFFSETOF(key_update_info_v1_t, a))
+#define EWPR_TX_TOSS_HIST_OFFSET(a) \
+       (OFFSETOF(EWPF_slc_elem_t, hist_tx_toss_stat) + \
+               OFFSETOF(evt_hist_compact_toss_stats_v1_t, a))
+#define EWPR_RX_TOSS_HIST_OFFSET(a) \
+       (OFFSETOF(EWPF_slc_elem_t, hist_rx_toss_stat) + \
+               OFFSETOF(evt_hist_compact_toss_stats_v1_t, a))
+#define EWPR_BTC_STAT_OFFSET(a) \
+       (OFFSETOF(EWPF_slc_elem_t, btc_stat) + \
+               OFFSETOF(wlc_btc_stats_v4_t, a))
+#define EWPR_COMPACT_HE_CNT_OFFSET(a) \
+       (OFFSETOF(EWPF_slc_elem_t, compact_he_cnt) + \
+               OFFSETOF(wl_compact_he_cnt_wlc_v2_t, a))
+#define EWPR_ROAM_STATS_PERIODIC_OFFSET(a) \
+       (OFFSETOF(EWPF_ifc_elem_t, roam_stat) + OFFSETOF(wl_roam_stats_v1_t, a))
+
+/* serail info type define */
+#define EWPR_SERIAL_CNT(a) {\
+       #a, EWPF_IDX_TYPE_SLICE, TRUE, \
+       .v_info = { EWPR_CNT_VERSION_OFFSET, \
+               {{EWPR_CNT_V1_OFFSET(a)}, \
+               {EWPR_CNT_V2_OFFSET(a)}, \
+               {EWPR_CNT_V3_OFFSET(a)}}}, \
+       EWP_UINT32, EWP_HEX, EWP_UINT32}
+#define EWPR_SERIAL_CNT_16(a) {\
+       #a, EWPF_IDX_TYPE_SLICE, TRUE, \
+       .v_info = { EWPR_CNT_VERSION_OFFSET, \
+               {{EWPR_CNT_V1_OFFSET(a)}, \
+               {EWPR_CNT_V2_OFFSET(a)}, \
+               {EWPR_CNT_V3_OFFSET(a)}}}, \
+       EWP_UINT32, EWP_HEX, EWP_UINT16}
+#define EWPR_SERIAL_STAT(a) {\
+       #a, EWPF_IDX_TYPE_IFACE, FALSE, .offset = EWPR_STAT_OFFSET(a), \
+       EWP_UINT64, EWP_HEX, EWP_UINT32}
+#define EWPR_SERIAL_INFRA(a) {\
+       #a, EWPF_IDX_TYPE_IFACE, FALSE, .offset = EWPR_INFRA_OFFSET(a), \
+       EWP_UINT32, EWP_HEX, EWP_UINT16}
+#define EWPR_SERIAL_MGMT(a) {\
+       #a, EWPF_IDX_TYPE_IFACE, FALSE, .offset = EWPR_MGMT_OFFSET(a), \
+       EWP_UINT32, EWP_HEX, EWP_UINT16}
+#define EWPR_SERIAL_LQM(a) {\
+       #a, EWPF_IDX_TYPE_IFACE, FALSE, .offset = EWPR_LQM_OFFSET(a), \
+       EWP_INT32, EWP_DEC, EWP_INT8}
+#define EWPR_SERIAL_SIGNAL(a) {\
+       #a, EWPF_IDX_TYPE_IFACE, FALSE, .offset = EWPR_SIGNAL_OFFSET(a), \
+       EWP_INT32, EWP_DEC, EWP_INT8}
+#define EWPR_SERIAL_IFCOMP_8(a) {\
+       #a, EWPF_IDX_TYPE_IFACE, FALSE, .offset = EWPR_IF_COMP_OFFSET(a), \
+       EWP_INT8, EWP_DEC, EWP_INT8}
+#define EWPR_SERIAL_IFCOMP_16(a) {\
+       #a, EWPF_IDX_TYPE_IFACE, FALSE, .offset = EWPR_IF_COMP_OFFSET(a), \
+       EWP_UINT16, EWP_DEC, EWP_UINT16}
+#define EWPR_SERIAL_ARM(a) {\
+       "armcycle:" #a, EWPF_IDX_TYPE_##a, FALSE, {0, }, \
+       EWP_UINT32, EWP_DEC, EWP_UINT32}
+#define EWPR_SERIAL_NONE {"", EWPF_INVALID, FALSE, {0, }, 0, 0, 0}
+
+#ifdef DHD_EWPR_VER2
+
+#define RAW_BUFFER_SIZE                720u
+#define BASE64_BUFFER_SIZE     960u /* 33 percent larger than original binary data */
+#define EWPR_HEADER_SIZE       39u
+#define        EWPR_MAX_STR_SIZE       EWPR_HEADER_SIZE + EWPR_HEADER_SIZE
+
+#define EWPR_DISPLAY_METHOD_SINGLE     0
+#define EWPR_DISPLAY_METHOD_DIFF       1
+
+#define MAX_BIT_SIZE   8
+#define MAX_BIT_SHIFT  7
+
+#define INDEX_UNSPECIFIED 0u
+
+enum ewpr_context_type {
+       EWP_CONTEXT_TYPE_UNWANTED_NETWORK = 0,
+       EWP_CONTEXT_TYPE_ASSOC_FAIL = 1,
+       EWP_CONTEXT_TYPE_ABNORMAL_DISCONNECT = 2,
+       EWP_CONTEXT_TYPE_MAX = 3
+};
+
+enum ewpr_unwanted_net_sub_type {
+       EWP_UNWANT_NET_SUB_TYPE_UNSPECIFIED = 0,
+       EWP_UNWANT_NET_SUB_TYPE_ARP_FAIL = 1,
+       EWP_UNWANT_NET_SUB_TYPE_TXBAD = 2,
+       EWP_UNWANT_NET_SUB_TYPE_MAX = 3
+};
+
+enum ewpr_assoc_fail_sub_type {
+       EWP_ASSOC_FAIL_SUB_TYPE_UNSPECIFIED = 0,
+       EWP_ASSOC_FAIL_SUB_TYPE_DHCP_FAIL = 1,
+       EWP_ASSOC_FAIL_SUB_TYPE_EAP_FAIL = 2,
+       EWP_ASSOC_FAIL_SUB_TYPE_EAP_TIMEOUT = 3,
+       EWP_ASSOC_FAIL_SUB_TYPE_4WAY_FAIL = 4,
+       EWP_ASSOC_FAIL_SUB_TYPE_MAX = 5
+};
+
+enum ewpr_abnormal_disconnect_sub_type {
+       EWP_ABNRML_DISCONNCET_SUB_TYPE_UNSPECIFIED = 0,
+       EWP_ABNRML_DISCONNCET_SUB_TYPE_DISCONNECT_BY_HOST = 1,
+       EWP_ABNRML_DISCONNCET_SUB_TYPE_MAX = 2
+};
+
+typedef struct {
+       uint32 index1;
+       uint32 index2;
+       uint32 index3;
+       ewpr_serial_info_t *table;
+} ewpr_serial_context_info_t;
+
+#define EWPR_SINGLE_DEFAULT EWPR_DISPLAY_METHOD_SINGLE, EWPF_NO_UNIT_CONV
+#define EWPR_DIFF_DEFAULT EWPR_DISPLAY_METHOD_DIFF, EWPF_NO_UNIT_CONV
+
+#define EWPR_SINGLE_NSEC_TO_MSEC EWPR_DISPLAY_METHOD_SINGLE, EWPF_NSEC_TO_MSEC
+#define EWPR_SINGLE_USEC_TO_MSEC EWPR_DISPLAY_METHOD_SINGLE, EWPF_USEC_TO_MSEC
+#define EWPR_SINGLE_USEC_TO_SEC EWPR_DISPLAY_METHOD_SINGLE, EWPF_USEC_TO_SEC
+
+/* serail info type define */
+#define EWPR_SERIAL_CNT_V3_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_SLICE, TRUE, \
+       .v_info = { EWPR_CNT_VERSION_OFFSET, \
+               {{EWPR_CNT_V3_OFFSET(a)}}}, \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_STAT_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_IFACE, FALSE, .offset = EWPR_STAT_OFFSET(a), \
+       EWP_UINT64, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_INFRA_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_IFACE, FALSE, .offset = EWPR_INFRA_OFFSET(a), \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_MGMT_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_IFACE, FALSE, .offset = EWPR_MGMT_OFFSET(a), \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_LQM_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_IFACE, FALSE, .offset = EWPR_LQM_OFFSET(a), \
+       EWP_INT32, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_SIGNAL_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_IFACE, FALSE, .offset = EWPR_SIGNAL_OFFSET(a), \
+       EWP_INT32, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_IFCOMP_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_IFACE, FALSE, .offset = EWPR_IF_COMP_OFFSET(a), \
+       EWP_INT8, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_EVENT_COUNTER_16_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_EVENT, FALSE, .offset = EWPR_EVENT_COUNTER_OFFSET(a), \
+       EWP_UINT16, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_EVENT_COUNTER_32_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_EVENT, FALSE, .offset = EWPR_EVENT_COUNTER_OFFSET(a), \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_KEY_INFO_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_KEY_INFO, FALSE, .offset = EWPR_KEY_INFO_OFFSET(a), \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_IFACE, FALSE, .offset = EWPR_ROAM_STATS_PERIODIC_OFFSET(a), \
+       EWP_UINT16, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_ROAM_STAT_PERIODIC_32_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_IFACE, FALSE, .offset = EWPR_ROAM_STATS_PERIODIC_OFFSET(a), \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_ARM_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_##a, FALSE, {0, }, \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_IOVAR_BIT(a, b) {\
+       #a, 0, 0, .offset = 0, \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_IOVAR, b, 1, EWPR_SINGLE_DEFAULT}
+#define EWPR_SERIAL_VERSION_BIT(a, b) {\
+       #a, 0, 0, .offset = 0, \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_VER, b, 1, EWPR_SINGLE_DEFAULT}
+#define EWPR_SERIAL_TYPE_BIT(a, b) {\
+       #a, 0, 0, .offset = 0, \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_TYPE, b, 1, EWPR_SINGLE_DEFAULT}
+#define EWPR_SERIAL_CPLOG_BIT(a, b, c) {\
+       #a, 0, 0, .offset = 0, \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_CPLOG, b, c, EWPR_SINGLE_DEFAULT}
+#define EWPR_SERIAL_DHDSTAT_BIT(a, b, c, d) {\
+       #a, 0, 0, .offset = 0, \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_DHDSTAT, b, c, d}
+#define EWPR_SERIAL_TX_TOSS_HIST_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_SLICE, FALSE, .offset = EWPR_TX_TOSS_HIST_OFFSET(a), \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_RX_TOSS_HIST_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_SLICE, FALSE, .offset = EWPR_RX_TOSS_HIST_OFFSET(a), \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_BTC_STAT_16_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_SLICE, FALSE, .offset = EWPR_BTC_STAT_OFFSET(a), \
+       EWP_UINT16, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_BTC_STAT_32_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_SLICE, FALSE, .offset = EWPR_BTC_STAT_OFFSET(a), \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+#define EWPR_SERIAL_COMPACT_HE_CNT_BIT(a, b, c, d) {\
+       #a, EWPF_IDX_TYPE_SLICE, FALSE, .offset = EWPR_COMPACT_HE_CNT_OFFSET(a), \
+       EWP_UINT32, EWP_BIN, EWP_BIT, EWPF_INFO_ECNT, b, c, d}
+
+#define EWPR_SERIAL_NONE_BIT {"", EWPF_INVALID, FALSE, {0, }, 0, 0, 0, 0, 0, 0, 0}
+
+#ifdef EWPR_DEBUG
+static void ewpr_print_byte_as_bits(char val);
+#endif /* EWPR_DEBUG */
+
+static int32
+ewpr_diff_bit_pack(ewpr_serial_info_t *info, char *buf, int buf_len,
+       void *_f_op, void *_s_op, int32 bit_offset);
+static int32
+ewpr_single_bit_pack(ewpr_serial_info_t *info, char *buf, int buf_len,
+       void *_ptr, int32 bit_offset);
+static int32
+ewpr_bit_pack_basic(char *buf, int buf_len, uint32 data, int32 format,
+       int32 display_type, int32 display_bit_length, int32 bit_offset);
+
+static char*
+ewpr_base64_encode(dhd_pub_t *dhdp, char* input, int32 length);
+#endif /* DHD_EWPR_VER2 */
+
+ewpr_serial_info_t
+ewpr_serial_CSDCLIENT_key_tbl[] = {
+       EWPR_SERIAL_STAT(txframe),
+       EWPR_SERIAL_STAT(txerror),
+       EWPR_SERIAL_STAT(rxframe),
+       EWPR_SERIAL_STAT(rxerror),
+       EWPR_SERIAL_STAT(txretrans),
+       EWPR_SERIAL_INFRA(rxbeaconmbss),
+       EWPR_SERIAL_CNT(txallfrm),
+       EWPR_SERIAL_CNT(rxrsptmout),
+       EWPR_SERIAL_CNT(rxbadplcp),
+       EWPR_SERIAL_CNT(rxcrsglitch),
+       EWPR_SERIAL_CNT(rxbadfcs),
+       EWPR_SERIAL_CNT_16(rxbeaconmbss),
+       EWPR_SERIAL_CNT_16(rxbeaconobss),
+       EWPR_SERIAL_NONE
+};
+
+ewpr_serial_info_t
+ewpr_serial_CSDCLIENT_diff_tbl[] = {
+       EWPR_SERIAL_STAT(txframe),
+       EWPR_SERIAL_STAT(txerror),
+       EWPR_SERIAL_STAT(rxframe),
+       EWPR_SERIAL_STAT(rxerror),
+       EWPR_SERIAL_STAT(txretrans),
+       EWPR_SERIAL_INFRA(rxbeaconmbss),
+       EWPR_SERIAL_MGMT(txassocreq),
+       EWPR_SERIAL_MGMT(txreassocreq),
+       EWPR_SERIAL_MGMT(txdisassoc),
+       EWPR_SERIAL_MGMT(rxdisassoc),
+       EWPR_SERIAL_MGMT(rxassocrsp),
+       EWPR_SERIAL_MGMT(rxreassocrsp),
+       EWPR_SERIAL_MGMT(txauth),
+       EWPR_SERIAL_MGMT(rxauth),
+       EWPR_SERIAL_MGMT(txdeauth),
+       EWPR_SERIAL_MGMT(rxdeauth),
+       EWPR_SERIAL_MGMT(txaction),
+       EWPR_SERIAL_MGMT(rxaction),
+       EWPR_SERIAL_CNT(txallfrm),
+       EWPR_SERIAL_CNT(rxrsptmout),
+       EWPR_SERIAL_CNT(rxbadplcp),
+       EWPR_SERIAL_CNT(rxcrsglitch),
+       EWPR_SERIAL_CNT(rxbadfcs),
+       EWPR_SERIAL_CNT_16(rxbeaconmbss),
+       EWPR_SERIAL_CNT_16(rxbeaconobss),
+       EWPR_SERIAL_NONE
+};
+
+ewpr_serial_info_t
+ewpr_serial_CSDCLIENT_array_tbl[] = {
+       EWPR_SERIAL_IFCOMP_8(rssi_sum),
+       EWPR_SERIAL_IFCOMP_8(snr),
+       EWPR_SERIAL_IFCOMP_8(noise_level),
+       EWPR_SERIAL_NONE
+};
+
+#ifdef EWPR_DEBUG
+ewpr_serial_info_t
+ewpr_serial_dbg_tbl[] = {
+       EWPR_SERIAL_ARM(IFACE),
+       EWPR_SERIAL_ARM(SLICE),
+       EWPR_SERIAL_NONE
+};
+#endif /* EWPR_DEBUG */
+
+#ifdef DHD_EWPR_VER2
+
+ewpr_serial_info_t
+ewpr_serial_bit_unwanted_network_default_tbl[] = {
+       EWPR_SERIAL_VERSION_BIT(version, 32),
+       EWPR_SERIAL_TYPE_BIT(type, 5),
+       EWPR_SERIAL_DHDSTAT_BIT(dhdstat_last_ts, 32, 1, EWPR_SINGLE_USEC_TO_SEC),
+       EWPR_SERIAL_DHDSTAT_BIT(dhdstat_last, 8, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_DHDSTAT_BIT(dhdstat_prev_ts, 32, 1, EWPR_SINGLE_USEC_TO_SEC),
+       EWPR_SERIAL_DHDSTAT_BIT(dhdstat_prev, 8, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_IOVAR_BIT(auth, 8),
+       EWPR_SERIAL_IOVAR_BIT(wsec, 8),
+       EWPR_SERIAL_IOVAR_BIT(mfp, 1),
+       EWPR_SERIAL_IOVAR_BIT(bip, 8),
+       EWPR_SERIAL_ARM_BIT(IFACE, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_STAT_BIT(txframe, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_STAT_BIT(txerror, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_STAT_BIT(rxframe, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_STAT_BIT(rxerror, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_STAT_BIT(txretrans, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txassocreq, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txreassocreq, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txdisassoc, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxdisassoc, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxassocrsp, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxreassocrsp, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txauth, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxauth, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txdeauth, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxdeauth, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txaction, 7, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxaction, 7, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(txallfrm, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxrsptmout, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxbadplcp, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxcrsglitch, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxbadfcs, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxbeaconmbss, 5, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxbeaconobss, 12, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(lqcm_report, 19, 6, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(tx_toss_cnt, 18, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rx_toss_cnt, 18, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxretry, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxdup, 15, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(chswitch_cnt, 8, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(pm_dur, 12, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxholes, 15, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_dcsn_map, 16, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_dcsn_cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_a2dp_hiwat_cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_datadelay_cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_crtpri_cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_pri_cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(a2dpbuf5cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(a2dpbuf6cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(a2dpbuf7cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_32_BIT(bt_gnt_dur, 12, 3, EWPR_SINGLE_USEC_TO_MSEC),
+       EWPR_SERIAL_IFCOMP_BIT(rssi_sum, 7, 6, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_IFCOMP_BIT(snr, 7, 6, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_IFCOMP_BIT(noise_level, 7, 6, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_32_BIT(initial_assoc_time, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_32_BIT(prev_roam_time, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_32_BIT(last_roam_event_type, 8, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_32_BIT(last_roam_event_status, 6, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_32_BIT(last_roam_event_reason, 6, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(roam_success_cnt, 10, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(roam_fail_cnt, 10, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(roam_attempt_cnt, 11, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(max_roam_target_cnt, 5, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(min_roam_target_cnt, 5, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(max_cached_ch_cnt, 5, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(min_cached_ch_cnt, 5, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(partial_roam_scan_cnt, 11, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(full_roam_scan_cnt, 11, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_COMPACT_HE_CNT_BIT(he_rxtrig_myaid, 10, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_COMPACT_HE_CNT_BIT(he_colormiss_cnt, 10, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_COMPACT_HE_CNT_BIT(he_rxmsta_back, 10, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_COMPACT_HE_CNT_BIT(he_txtbppdu, 10, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_COMPACT_HE_CNT_BIT(he_null_tbppdu, 10, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_KEY_INFO_BIT(timestamp, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_KEY_INFO_BIT(algo, 6, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_KEY_INFO_BIT(key_flags, 16, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rn_ts_last, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rn_last, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rn_ts_prev, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rn_prev, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rc_ts_max, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rc_max, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rc_ts_secnd, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rc_secnd, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rn_ts_last, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rn_last, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rn_ts_prev, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rn_prev, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rc_ts_max, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rc_max, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rc_ts_secnd, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rc_secnd, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_CPLOG_BIT(packtlog, 22, 70),
+       EWPR_SERIAL_NONE
+};
+
+ewpr_serial_info_t
+ewpr_serial_bit_assoc_fail_default_tbl[] = {
+       EWPR_SERIAL_VERSION_BIT(version, 32),
+       EWPR_SERIAL_TYPE_BIT(type, 5),
+       EWPR_SERIAL_DHDSTAT_BIT(dhdstat_last_ts, 32, 1, EWPR_SINGLE_USEC_TO_SEC),
+       EWPR_SERIAL_DHDSTAT_BIT(dhdstat_last, 8, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_DHDSTAT_BIT(dhdstat_prev_ts, 32, 1, EWPR_SINGLE_USEC_TO_SEC),
+       EWPR_SERIAL_DHDSTAT_BIT(dhdstat_prev, 8, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_IOVAR_BIT(auth, 8),
+       EWPR_SERIAL_IOVAR_BIT(wsec, 8),
+       EWPR_SERIAL_IOVAR_BIT(mfp, 1),
+       EWPR_SERIAL_IOVAR_BIT(bip, 8),
+       EWPR_SERIAL_ARM_BIT(IFACE, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_STAT_BIT(txframe, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_STAT_BIT(txerror, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_STAT_BIT(rxframe, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_STAT_BIT(rxerror, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_STAT_BIT(txretrans, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txassocreq, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txreassocreq, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txdisassoc, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxdisassoc, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxassocrsp, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxreassocrsp, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txauth, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxauth, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txdeauth, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxdeauth, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txaction, 7, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxaction, 7, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(txallfrm, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxrsptmout, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxbadplcp, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxcrsglitch, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxbadfcs, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxbeaconmbss, 5, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxbeaconobss, 12, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(lqcm_report, 19, 6, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(tx_toss_cnt, 18, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rx_toss_cnt, 18, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxretry, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxdup, 15, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(chswitch_cnt, 8, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(pm_dur, 12, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxholes, 15, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_dcsn_map, 16, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_dcsn_cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_a2dp_hiwat_cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_datadelay_cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_crtpri_cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_pri_cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(a2dpbuf5cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(a2dpbuf6cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(a2dpbuf7cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_32_BIT(bt_gnt_dur, 12, 3, EWPR_SINGLE_USEC_TO_MSEC),
+       EWPR_SERIAL_IFCOMP_BIT(rssi_sum, 7, 6, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_IFCOMP_BIT(snr, 7, 6, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_IFCOMP_BIT(noise_level, 7, 6, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_COMPACT_HE_CNT_BIT(he_rxtrig_myaid, 10, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_COMPACT_HE_CNT_BIT(he_colormiss_cnt, 10, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_COMPACT_HE_CNT_BIT(he_rxmsta_back, 10, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_COMPACT_HE_CNT_BIT(he_txtbppdu, 10, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_COMPACT_HE_CNT_BIT(he_null_tbppdu, 10, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_KEY_INFO_BIT(timestamp, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_KEY_INFO_BIT(algo, 6, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_KEY_INFO_BIT(key_flags, 16, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rn_ts_last, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rn_last, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rn_ts_prev, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rn_prev, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rc_ts_max, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rc_max, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rc_ts_secnd, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rc_secnd, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rn_ts_last, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rn_last, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rn_ts_prev, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rn_prev, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rc_ts_max, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rc_max, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rc_ts_secnd, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rc_secnd, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_CPLOG_BIT(packtlog, 22, 70),
+       EWPR_SERIAL_NONE
+};
+
+ewpr_serial_info_t
+ewpr_serial_bit_abnormal_disconnect_default_tbl[] = {
+       EWPR_SERIAL_VERSION_BIT(version, 32),
+       EWPR_SERIAL_TYPE_BIT(type, 5),
+       EWPR_SERIAL_DHDSTAT_BIT(dhdstat_last_ts, 32, 1, EWPR_SINGLE_USEC_TO_SEC),
+       EWPR_SERIAL_DHDSTAT_BIT(dhdstat_last, 8, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_DHDSTAT_BIT(dhdstat_prev_ts, 32, 1, EWPR_SINGLE_USEC_TO_SEC),
+       EWPR_SERIAL_DHDSTAT_BIT(dhdstat_prev, 8, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_IOVAR_BIT(auth, 8),
+       EWPR_SERIAL_IOVAR_BIT(wsec, 8),
+       EWPR_SERIAL_IOVAR_BIT(mfp, 1),
+       EWPR_SERIAL_IOVAR_BIT(bip, 8),
+       EWPR_SERIAL_ARM_BIT(IFACE, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_STAT_BIT(txframe, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_STAT_BIT(txerror, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_STAT_BIT(rxframe, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_STAT_BIT(rxerror, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_STAT_BIT(txretrans, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txassocreq, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txreassocreq, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txdisassoc, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxdisassoc, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxassocrsp, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxreassocrsp, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txauth, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxauth, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txdeauth, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxdeauth, 4, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(txaction, 7, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_MGMT_BIT(rxaction, 7, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(txallfrm, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxrsptmout, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxbadplcp, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxcrsglitch, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxbadfcs, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxbeaconmbss, 5, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxbeaconobss, 12, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(lqcm_report, 19, 6, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(tx_toss_cnt, 18, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rx_toss_cnt, 18, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxretry, 17, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxdup, 15, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(chswitch_cnt, 8, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(pm_dur, 12, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_CNT_V3_BIT(rxholes, 15, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_dcsn_map, 16, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_dcsn_cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_a2dp_hiwat_cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_datadelay_cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_crtpri_cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(bt_pri_cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(a2dpbuf5cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(a2dpbuf6cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_16_BIT(a2dpbuf7cnt, 12, 3, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_BTC_STAT_32_BIT(bt_gnt_dur, 12, 3, EWPR_SINGLE_USEC_TO_MSEC),
+       EWPR_SERIAL_IFCOMP_BIT(rssi_sum, 7, 6, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_IFCOMP_BIT(snr, 7, 6, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_IFCOMP_BIT(noise_level, 7, 6, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_32_BIT(initial_assoc_time, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_32_BIT(prev_roam_time, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_32_BIT(last_roam_event_type, 8, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_32_BIT(last_roam_event_status, 6, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_32_BIT(last_roam_event_reason, 6, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(roam_success_cnt, 10, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(roam_fail_cnt, 10, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(roam_attempt_cnt, 11, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(max_roam_target_cnt, 5, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(min_roam_target_cnt, 5, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(max_cached_ch_cnt, 5, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(min_cached_ch_cnt, 5, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(partial_roam_scan_cnt, 11, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_ROAM_STAT_PERIODIC_16_BIT(full_roam_scan_cnt, 11, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_COMPACT_HE_CNT_BIT(he_rxtrig_myaid, 10, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_COMPACT_HE_CNT_BIT(he_colormiss_cnt, 10, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_COMPACT_HE_CNT_BIT(he_rxmsta_back, 10, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_COMPACT_HE_CNT_BIT(he_txtbppdu, 10, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_COMPACT_HE_CNT_BIT(he_null_tbppdu, 10, 6, EWPR_DIFF_DEFAULT),
+       EWPR_SERIAL_KEY_INFO_BIT(timestamp, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_KEY_INFO_BIT(algo, 6, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_KEY_INFO_BIT(key_flags, 16, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rn_ts_last, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rn_last, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rn_ts_prev, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rn_prev, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rc_ts_max, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rc_max, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rc_ts_secnd, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_TX_TOSS_HIST_BIT(htr_rc_secnd, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rn_ts_last, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rn_last, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rn_ts_prev, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rn_prev, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rc_ts_max, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rc_max, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rc_ts_secnd, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_RX_TOSS_HIST_BIT(htr_rc_secnd, 32, 1, EWPR_SINGLE_DEFAULT),
+       EWPR_SERIAL_CPLOG_BIT(packtlog, 22, 70),
+       EWPR_SERIAL_NONE
+};
+
+ewpr_serial_context_info_t ewpr_serial_context_info[] = {
+       {EWP_CONTEXT_TYPE_UNWANTED_NETWORK, EWP_UNWANT_NET_SUB_TYPE_UNSPECIFIED,
+       INDEX_UNSPECIFIED, &ewpr_serial_bit_unwanted_network_default_tbl[0]},
+       {EWP_CONTEXT_TYPE_UNWANTED_NETWORK, EWP_UNWANT_NET_SUB_TYPE_ARP_FAIL,
+       INDEX_UNSPECIFIED, &ewpr_serial_bit_unwanted_network_default_tbl[0]},
+       {EWP_CONTEXT_TYPE_UNWANTED_NETWORK, EWP_UNWANT_NET_SUB_TYPE_TXBAD,
+       INDEX_UNSPECIFIED, &ewpr_serial_bit_unwanted_network_default_tbl[0]},
+       {EWP_CONTEXT_TYPE_ASSOC_FAIL, EWP_ASSOC_FAIL_SUB_TYPE_UNSPECIFIED,
+       INDEX_UNSPECIFIED, &ewpr_serial_bit_assoc_fail_default_tbl[0]},
+       {EWP_CONTEXT_TYPE_ASSOC_FAIL, EWP_ASSOC_FAIL_SUB_TYPE_DHCP_FAIL,
+       INDEX_UNSPECIFIED, &ewpr_serial_bit_assoc_fail_default_tbl[0]},
+       {EWP_CONTEXT_TYPE_ASSOC_FAIL, EWP_ASSOC_FAIL_SUB_TYPE_EAP_FAIL,
+       INDEX_UNSPECIFIED, &ewpr_serial_bit_assoc_fail_default_tbl[0]},
+       {EWP_CONTEXT_TYPE_ASSOC_FAIL, EWP_ASSOC_FAIL_SUB_TYPE_EAP_TIMEOUT,
+       INDEX_UNSPECIFIED, &ewpr_serial_bit_assoc_fail_default_tbl[0]},
+       {EWP_CONTEXT_TYPE_ASSOC_FAIL, EWP_ASSOC_FAIL_SUB_TYPE_4WAY_FAIL,
+       INDEX_UNSPECIFIED, &ewpr_serial_bit_assoc_fail_default_tbl[0]},
+       {EWP_CONTEXT_TYPE_ABNORMAL_DISCONNECT, EWP_ABNRML_DISCONNCET_SUB_TYPE_UNSPECIFIED,
+       INDEX_UNSPECIFIED, &ewpr_serial_bit_abnormal_disconnect_default_tbl[0]},
+       {EWP_CONTEXT_TYPE_ABNORMAL_DISCONNECT, EWP_ABNRML_DISCONNCET_SUB_TYPE_DISCONNECT_BY_HOST,
+       INDEX_UNSPECIFIED, &ewpr_serial_bit_abnormal_disconnect_default_tbl[0]},
+       {EWP_CONTEXT_TYPE_MAX, INDEX_UNSPECIFIED, INDEX_UNSPECIFIED, NULL}
+};
+#endif /* DHD_EWPR_VER2 */
+
+int ewpr_set_period_lock(ewpr_lock_param_t *param);
+int ewpr_diff_serial(ewpr_serial_info_t *info, char *buf,
+       int buf_len, void *_f_op, void *_s_op, char del);
+int ewpr_single_serial(ewpr_serial_info_t *info, char *buf, int buf_len, void *ptr, char del);
+
+int
+ewpr_serial_basic(char *buf, int buf_len, uint32 data, int format, int display_type, char del)
+{
+       if (format == EWP_HEX) {
+               switch (display_type) {
+                       case EWP_INT8:
+                       case EWP_UINT8:
+                               return scnprintf(buf, buf_len, "%c%02x", del, data & 0xff);
+                       case EWP_INT16:
+                       case EWP_UINT16:
+                               return scnprintf(buf, buf_len, "%c%04x", del, data & 0xffff);
+                       case EWP_INT32:
+                       case EWP_UINT32:
+                               return scnprintf(buf, buf_len, "%c%08x", del, data & 0xffffffff);
+                       default:
+                               DHD_FILTER_ERR(("INVALID TYPE for Serial:%d", display_type));
+                               return 0;
+               }
+       }
+
+       if (format == EWP_DEC) {
+               int32 sdata = (int32) data;
+               switch (display_type) {
+                       case EWP_INT8:
+                       case EWP_UINT8:
+                               return scnprintf(buf, buf_len, "%c%04d", del, sdata);
+                       case EWP_INT16:
+                       case EWP_UINT16:
+                               return scnprintf(buf, buf_len, "%c%06d", del, sdata);
+                       case EWP_INT32:
+                       case EWP_UINT32:
+                               return scnprintf(buf, buf_len, "%c%011d", del, sdata);
+                       default:
+                               DHD_FILTER_ERR(("INVALID TYPE for Serial:%d", display_type));
+                               return 0;
+               }
+       }
+
+       if (format == EWP_BIN) {
+               int32 sdata = (int32) data;
+               switch (display_type) {
+                       case EWP_BIT:
+                               return scnprintf(buf, buf_len, "%c%011d", del, sdata);
+                       default:
+                               DHD_FILTER_ERR(("INVALID TYPE for Serial:%d", display_type));
+                               return 0;
+               }
+       }
+
+       DHD_FILTER_ERR(("INVALID FORMAT for Serial:%d", format));
+       return 0;
+}
+
+static int
+ewpr_get_multi_offset(uint16 looking_version, ewpr_serial_info_t *info)
+{
+       int idx;
+       ewpr_MVT_offset_elem_t *opv;
+
+       DHD_FILTER_TRACE(("FINDING MULTI OFFSET: type = %s version = %d\n",
+               info->name, looking_version));
+       for (idx = 0; idx < MAX_MULTI_VER; idx ++) {
+               opv = &(info->v_info.opv[idx]);
+
+               /* END OF MULTI VERSION */
+               if (opv->version == 0) {
+                       break;
+               }
+               if (looking_version == opv->version) {
+                       return opv->offset;
+               }
+       }
+       /* return first version if no version is found */
+       return info->v_info.opv[0].offset;
+}
+int
+ewpr_single_serial(ewpr_serial_info_t *info, char *buf, int buf_len, void *_ptr, char del)
+{
+       uint32 sval = 0;
+       char *ptr = (char *)_ptr;
+       uint32 offset = EWPF_INVALID;
+       uint16  version;
+
+       if (info->is_multi_version == TRUE) {
+               version = *(uint16 *)((char *)_ptr + info->v_info.version_offset);
+               offset = ewpr_get_multi_offset(version, info);
+       } else {
+               offset = info->offset;
+       }
+
+       if (offset == EWPF_INVALID) {
+               DHD_FILTER_ERR(("INVALID TYPE to OFFSET:%s\n", info->name));
+               return 0;
+       }
+
+       ptr += offset;
+
+       switch (info->data_type) {
+               case EWP_INT8:
+                       sval = *(int8 *)ptr;
+                       break;
+               case EWP_UINT8:
+                       sval = *(uint8 *)ptr;
+                       break;
+               case EWP_INT16:
+                       sval = *(int16 *)ptr;
+                       break;
+               case EWP_UINT16:
+                       sval = *(uint16 *)ptr;
+                       break;
+               case EWP_INT32:
+                       sval = *(int32 *)ptr;
+                       break;
+               case EWP_UINT32:
+                       sval = *(uint32 *)ptr;
+                       break;
+               /* XXX UINT64 is used only for debug */
+#ifdef EWPR_DEBUG
+               case EWP_UINT64:
+                       sval = (uint32)(*(uint64 *)ptr);
+                       break;
+#endif /* EWPR_DEBUG */
+               case EWP_BIT:
+               default:
+                       DHD_FILTER_ERR(("INVALID TYPE for Single Serial:%d", info->data_type));
+                       return 0;
+       }
+
+       return ewpr_serial_basic(buf, buf_len, sval, info->display_format, info->display_type, del);
+}
+
+int
+ewpr_diff_serial(ewpr_serial_info_t *info,
+       char *buf, int buf_len, void *_f_op, void *_s_op, char del)
+{
+       char *f_op = (char *)_f_op;
+       char *s_op = (char *)_s_op;
+       uint32 diff;
+       uint32 offset = EWPF_INVALID;
+       uint16  version;
+
+       if (info->is_multi_version == TRUE) {
+               version = *(uint16 *)(f_op + info->v_info.version_offset);
+               offset = ewpr_get_multi_offset(version, info);
+       } else {
+               offset = info->offset;
+       }
+
+       if (offset == EWPF_INVALID) {
+               DHD_FILTER_ERR(("INVALID TYPE to OFFSET:%s\n", info->name));
+               return 0;
+       }
+
+       f_op = f_op + offset;
+       s_op = s_op + offset;
+
+       switch (info->data_type) {
+               case EWP_INT8:
+               case EWP_UINT8:
+                       diff = *(uint8 *)f_op - *(uint8 *)s_op;
+                       break;
+               case EWP_INT16:
+               case EWP_UINT16:
+                       diff = *(uint16 *)f_op - *(uint16 *)s_op;
+                       break;
+               case EWP_INT32:
+               case EWP_UINT32:
+                       diff = *(uint32 *)f_op - *(uint32 *)s_op;
+                       break;
+               case EWP_UINT64:
+                       diff = (uint32)(*(uint64 *)f_op - *(uint64 *)s_op);
+                       break;
+               case EWP_BIT:
+               default:
+                       DHD_FILTER_ERR(("INVALID TYPE to DIFF:%d", info->data_type));
+                       return 0;
+       }
+
+       return ewpr_serial_basic(buf, buf_len, diff, info->display_format, info->display_type, del);
+}
+
+#ifdef EWPR_DEBUG
+void
+ewpr_debug_dump(ewpr_serial_info_t *tbl, void **ring)
+{
+       void *elem;
+       int idx, idx2;
+       ewpr_serial_info_t *info;
+       char buf[EWPR_DEBUG_BUF_LEN];
+       uint32 bytes_written;
+       int lock_cnt;
+
+       for (idx = 0; strlen(tbl[idx].name) != 0; idx++) {
+               info = &tbl[idx];
+#ifdef DHD_EWPR_VER2
+               if (info->info_type != EWPF_INFO_ECNT) {
+                       DHD_FILTER_ERR(("%s: unable to dump value\n", info->name));
+                       break;
+               }
+#endif /* DHD_EWPR_VER2 */
+               memset(buf, 0, sizeof(buf));
+               lock_cnt = dhd_ring_lock_get_count(ring[info->ring_type - 1]);
+               elem = dhd_ring_lock_get_first(ring[info->ring_type - 1]);
+               bytes_written = scnprintf(buf, EWPR_DEBUG_BUF_LEN, "%s:", info->name);
+               for (idx2 = 0; elem && (idx2 < lock_cnt); idx2++) {
+                       bytes_written += ewpr_single_serial(info, &buf[bytes_written],
+                               EWPR_DEBUG_BUF_LEN - bytes_written, elem, KEY_DEL);
+                       elem = dhd_ring_get_next(ring[info->ring_type - 1], elem);
+               }
+               DHD_FILTER_ERR(("%s\n", buf));
+       }
+}
+#endif /* EWPR_DEBUG */
+
+uint32
+dhd_event_log_filter_serialize(dhd_pub_t *dhdp, char *in_buf, uint32 tot_len, int type)
+{
+       EWP_filter_t *filter = (EWP_filter_t *)dhdp->event_log_filter;
+       void *ring[EWPF_MAX_IDX_TYPE];
+       char *ret_buf = in_buf;
+       int slice_id;
+       int iface_id;
+       int idx, idx2;
+       uint32 bytes_written = 0;
+       void *elem[EWPF_MAX_IDX_TYPE][EWPR_CSDCLIENT_DIFF];
+       void **elem_list;
+       int lock_cnt, lock_cnt2;
+       char *last_print;
+       void *arr_elem;
+       uint32 delta_list[EWPR_CSDCLIENT_DIFF];
+       ewpr_lock_param_t lock_param;
+       int print_name = FALSE;
+       char cookie_str[DEBUG_DUMP_TIME_BUF_LEN];
+       char iov_buf[EWPR_IOV_BUF_LEN];
+
+       if (type != 0) {
+               DHD_FILTER_ERR(("NOT SUPPORTED TYPE: %d\n", type));
+               return 0;
+       }
+
+       iface_id = 0; /* STA INTERFACE ONLY */
+       if (filter->last_channel <= CH_MAX_2G_CHANNEL) {
+               slice_id = EWPF_SLICE_AUX;
+       } else {
+               slice_id = EWPF_SLICE_MAIN;
+       }
+       ring[EWPF_IDX_TYPE_SLICE - 1] = filter->s_ring[slice_id];
+       ring[EWPF_IDX_TYPE_IFACE - 1] = filter->i_ring[iface_id];
+
+       /* Configure common LOCK parameter */
+       lock_param.max_armcycle = (uint32)EWPF_INVALID;
+       lock_param.min_armcycle = filter->last_armcycle;
+       lock_param.max_period = (EWPR_ARRAY_CNT - 1)* EWPR_INTERVAL;
+       lock_param.max_period *= EWPF_MSEC_TO_SEC * EWPF_ARM_TO_MSEC;
+       lock_param.delta_cnt = ARRAYSIZE(delta_list);
+       lock_param.delta_list = delta_list;
+
+       delta_list[EWPR_DELTA3_POS] = EWPR_DELTA3_CNT;
+       delta_list[EWPR_DELTA2_POS] = EWPR_DELTA2_CNT;
+       delta_list[EWPR_DELTA1_POS] = EWPR_DELTA1_CNT;
+       delta_list[EWPR_NOW_POS] = 0;
+       lock_param.ring = ring[EWPF_IDX_TYPE_IFACE -1];
+       lock_param.elem_list = elem[EWPF_IDX_TYPE_IFACE -1];
+       lock_cnt = ewpr_set_period_lock(&lock_param);
+       if (lock_cnt <= 0) {
+               DHD_FILTER_ERR(("FAIL TO GET IFACE LOCK: %d\n", iface_id));
+               bytes_written = 0;
+               goto finished;
+       }
+
+       delta_list[EWPR_DELTA3_POS] = EWPR_DELTA3_CNT;
+       delta_list[EWPR_DELTA2_POS] = EWPR_DELTA2_CNT;
+       delta_list[EWPR_DELTA1_POS] = EWPR_DELTA1_CNT;
+       delta_list[EWPR_NOW_POS] = 0;
+       lock_param.ring = ring[EWPF_IDX_TYPE_SLICE -1];
+       lock_param.elem_list = elem[EWPF_IDX_TYPE_SLICE -1];
+       lock_cnt2 = ewpr_set_period_lock(&lock_param);
+       if (lock_cnt2 <= 0) {
+               DHD_FILTER_ERR(("FAIL TO GET SLICE LOCK: %d\n", slice_id));
+               goto finished;
+       }
+
+       if (lock_cnt != lock_cnt2) {
+               DHD_FILTER_ERR(("Lock Count is Diff: iface:%d slice:%d\n", lock_cnt, lock_cnt2));
+               lock_cnt = MIN(lock_cnt, lock_cnt2);
+       }
+
+#ifdef EWPR_DEBUG
+       print_name = TRUE;
+       ewpr_debug_dump(ewpr_serial_dbg_tbl, ring);
+       ewpr_debug_dump(ewpr_serial_CSDCLIENT_diff_tbl, ring);
+       ewpr_debug_dump(ewpr_serial_CSDCLIENT_array_tbl, ring);
+#endif /* EWPR_DEBUG */
+
+       memset(ret_buf, 0, tot_len);
+       memset(cookie_str, 0, DEBUG_DUMP_TIME_BUF_LEN);
+       bytes_written = 0;
+       last_print = ret_buf;
+
+       /* XXX Counters BIG DATA not matched to file yet */
+       get_debug_dump_time(cookie_str);
+#ifdef DHD_LOG_DUMP
+       dhd_logdump_cookie_save(dhdp, cookie_str, "ECNT");
+#endif
+
+       /* KEY DATA */
+       bytes_written += scnprintf(&ret_buf[bytes_written],
+               tot_len - bytes_written, "%08x", EWP_REPORT_VERSION);
+       bytes_written += scnprintf(&ret_buf[bytes_written],
+               tot_len - bytes_written, "%c%s", KEY_DEL, cookie_str);
+       DHD_FILTER_ERR(("%d: %s\n", bytes_written, last_print));
+       last_print = &ret_buf[bytes_written];
+
+       for (idx = 0; strlen(ewpr_serial_CSDCLIENT_key_tbl[idx].name) != 0; idx++) {
+               ewpr_serial_info_t *info = &ewpr_serial_CSDCLIENT_key_tbl[idx];
+               elem_list = elem[info->ring_type - 1];
+               if (print_name) {
+                       bytes_written += scnprintf(&ret_buf[bytes_written],
+                               tot_len - bytes_written, " %s:", info->name);
+               }
+               bytes_written += ewpr_diff_serial(info, &ret_buf[bytes_written],
+                       tot_len - bytes_written,
+                       elem_list[EWPR_NOW_POS],
+                       elem_list[EWPR_DELTA1_POS],
+                       KEY_DEL);
+               if ((idx + 1) % EWPR_CNT_PER_LINE == 0) {
+                       DHD_FILTER_ERR(("%d:%s\n", bytes_written, last_print));
+                       last_print = &ret_buf[bytes_written];
+               }
+       }
+
+       /* RAW DATA */
+       /* XXX FIRST data shall use space:KEY delimiter */
+       bytes_written += scnprintf(&ret_buf[bytes_written],
+               tot_len - bytes_written, "%c%08x", KEY_DEL, EWP_REPORT_VERSION);
+       bytes_written += scnprintf(&ret_buf[bytes_written],
+               tot_len - bytes_written, "%c%s", RAW_DEL, cookie_str);
+
+       for (idx = 0; strlen(ewpr_serial_CSDCLIENT_diff_tbl[idx].name) != 0; idx++) {
+               ewpr_serial_info_t *info = &ewpr_serial_CSDCLIENT_diff_tbl[idx];
+               elem_list = elem[info->ring_type - 1];
+               if (print_name) {
+                       bytes_written += scnprintf(&ret_buf[bytes_written],
+                               tot_len - bytes_written, " %s:", info->name);
+               }
+               bytes_written += ewpr_diff_serial(info, &ret_buf[bytes_written],
+                       tot_len - bytes_written,
+                       elem_list[EWPR_NOW_POS],
+                       elem_list[EWPR_DELTA1_POS],
+                       RAW_DEL);
+               bytes_written += ewpr_diff_serial(info, &ret_buf[bytes_written],
+                       tot_len - bytes_written,
+                       elem_list[EWPR_DELTA1_POS],
+                       elem_list[EWPR_DELTA2_POS],
+                       RAW_DEL);
+               if ((idx + 1) % EWPR_CNT_PER_LINE == 0) {
+                       DHD_FILTER_ERR(("%d:%s\n", bytes_written, last_print));
+                       last_print = &ret_buf[bytes_written];
+               }
+       }
+
+       /* FILL BSS SPECIFIC DATA LATER */
+       if (dhd_iovar(dhdp, 0, "auth", NULL, 0, iov_buf, ARRAYSIZE(iov_buf), FALSE) < 0) {
+               DHD_FILTER_ERR(("fail to get auth\n"));
+               *(uint32 *)iov_buf = EWPF_INVALID;
+
+       }
+       bytes_written += scnprintf(&ret_buf[bytes_written],
+                       tot_len - bytes_written, "%c%08x", RAW_DEL, *(uint32 *)iov_buf);
+
+       if (dhd_iovar(dhdp, 0, "wsec", NULL, 0, iov_buf, ARRAYSIZE(iov_buf), FALSE) < 0) {
+               DHD_FILTER_ERR(("fail to get wsec\n"));
+               *(uint32 *)iov_buf = EWPF_INVALID;
+
+       }
+       bytes_written += scnprintf(&ret_buf[bytes_written],
+                       tot_len - bytes_written, "%c%08x", RAW_DEL, *(uint32 *)iov_buf);
+
+       if (dhd_iovar(dhdp, 0, "mfp", NULL, 0, iov_buf, ARRAYSIZE(iov_buf), FALSE) < 0) {
+               DHD_FILTER_ERR(("fail to get mfp\n"));
+               *(uint8 *)iov_buf = EWPF_INVALID;
+
+       }
+       bytes_written += scnprintf(&ret_buf[bytes_written],
+                       tot_len - bytes_written, "%c%02x", RAW_DEL, *(uint8 *)iov_buf);
+
+       if (dhd_iovar(dhdp, 0, "bip", NULL, 0, iov_buf, ARRAYSIZE(iov_buf), FALSE) < 0) {
+               DHD_FILTER_ERR(("fail to get bip\n"));
+               *(uint8 *)iov_buf = EWPF_INVALID;
+       }
+       bytes_written += scnprintf(&ret_buf[bytes_written],
+                       tot_len - bytes_written, "%c%02x", RAW_DEL, *(uint8 *)iov_buf);
+
+       for (idx = 0; strlen(ewpr_serial_CSDCLIENT_array_tbl[idx].name) != 0; idx++) {
+               ewpr_serial_info_t *info = &ewpr_serial_CSDCLIENT_array_tbl[idx];
+               if (print_name) {
+                       bytes_written += scnprintf(&ret_buf[bytes_written],
+                               tot_len - bytes_written, " %s:", info->name);
+               }
+               for (idx2 = 0; idx2 < EWPR_ARRAY_CNT - lock_cnt; idx2++) {
+                       bytes_written += ewpr_serial_basic(&ret_buf[bytes_written],
+                               tot_len - bytes_written, 0,
+                               info->display_format, info->display_type, RAW_DEL);
+               }
+               arr_elem = elem[info->ring_type - 1][EWPR_DELTA3_POS];
+               for (; idx2 < EWPR_ARRAY_CNT; idx2++) {
+                       if (arr_elem == NULL) {
+                               DHD_FILTER_ERR(("ARR IS NULL : %d %p \n",
+                                       idx2, elem[info->ring_type - 1][EWPR_DELTA3_POS]));
+                               break;
+                       }
+                       bytes_written += ewpr_single_serial(info, &ret_buf[bytes_written],
+                               tot_len - bytes_written, arr_elem, RAW_DEL);
+                       arr_elem = dhd_ring_get_next(ring[info->ring_type - 1], arr_elem);
+               }
+               DHD_FILTER_ERR(("%d:%s\n", bytes_written, last_print));
+               last_print = &ret_buf[bytes_written];
+       }
+
+finished:
+       DHD_FILTER_ERR(("RET LEN:%d\n", (int)strlen(ret_buf)));
+       dhd_ring_lock_free(ring[EWPF_IDX_TYPE_SLICE - 1]);
+       dhd_ring_lock_free(ring[EWPF_IDX_TYPE_IFACE - 1]);
+       return bytes_written;
+}
+
+int
+ewpr_set_period_lock(ewpr_lock_param_t *param)
+{
+       void *last;
+       void *first;
+       void *cur;
+       int lock_cnt;
+       int idx2;
+       int delta_idx;
+       uint32 last_armcycle;
+       uint32 first_armcycle;
+       uint32 cur_armcycle = 0;
+       void *ring = param->ring;
+
+       /* GET LATEST PTR */
+       last = dhd_ring_get_last(ring);
+       while (TRUE) {
+               if (last == NULL) {
+                       DHD_FILTER_ERR(("NO LAST\n"));
+                       return -1;
+               }
+               last_armcycle = *(uint32 *)last;
+               if (last_armcycle <= param->max_armcycle ||
+                       last_armcycle + EWPF_EPOCH >= param->max_armcycle) {
+                       break;
+               }
+               last = dhd_ring_get_prev(ring, last);
+       }
+
+       if (last_armcycle != param->max_armcycle) {
+               DHD_FILTER_TRACE(("MAX ARMCYCLE IS CHANGEd new:%u prev:%u\n",
+                       last_armcycle, param->max_armcycle));
+               param->max_armcycle = last_armcycle;
+       }
+
+       if (last_armcycle < param->min_armcycle) {
+               param->min_armcycle = 0;
+       }
+
+       /* GET FIRST PTR */
+       first_armcycle = last_armcycle;
+       first = last;
+       while (TRUE) {
+               cur = dhd_ring_get_prev(ring, first);
+               if (cur == NULL) {
+                       break;
+               }
+               cur_armcycle = *(uint32 *)cur;
+               if (cur_armcycle >= first_armcycle) {
+                       DHD_FILTER_TRACE(("case 1: %u %u\n", first_armcycle, cur_armcycle));
+                       /* dongle is rebooted */
+                       break;
+               }
+               if (cur_armcycle + EWPF_EPOCH < param->min_armcycle) {
+                       DHD_FILTER_TRACE(("case 2: %u %u\n", param->min_armcycle, cur_armcycle));
+                       /* Reach Limitation */
+                       break;
+               }
+               if (cur_armcycle + param->max_period + EWPF_EPOCH < last_armcycle) {
+                       DHD_FILTER_TRACE(("case 3: %u %u\n", param->max_period, cur_armcycle));
+                       /* exceed max period */
+                       break;
+               }
+               first = cur;
+               first_armcycle = cur_armcycle;
+       }
+
+       if (first_armcycle != param->min_armcycle) {
+               DHD_FILTER_TRACE(("MIN ARMCYCLE IS CHANGEd new:%u prev:%u %u\n",
+                       first_armcycle, param->min_armcycle, cur_armcycle));
+               param->min_armcycle = first_armcycle;
+       }
+
+       DHD_FILTER_TRACE(("ARM CYCLE of first(%u), last(%u)\n", first_armcycle, last_armcycle));
+
+       dhd_ring_lock(ring, first, last);
+
+       lock_cnt = dhd_ring_lock_get_count(ring);
+       if (lock_cnt <= 0) {
+               DHD_FILTER_ERR((" NO VALID RECORD : %d\n", lock_cnt));
+               return -1;
+       }
+       DHD_FILTER_TRACE(("Lock Count:%d\n", lock_cnt));
+
+       /* Validate delta position */
+       for (idx2 = 0; idx2 < param->delta_cnt - 1; idx2++) {
+               if (param->delta_list[idx2] >= param->delta_list[idx2 + 1]) {
+                       DHD_FILTER_ERR(("INVALID DELTA at %d\n", idx2 + 1));
+                       param->delta_list[idx2 + 1] = param->delta_list[idx2];
+               }
+       }
+
+       delta_idx = 0;
+       for (idx2 = 0; idx2 < lock_cnt && delta_idx < param->delta_cnt; idx2++) {
+               if (idx2 == 0) {
+                       cur = dhd_ring_lock_get_last(ring);
+               } else {
+                       cur = dhd_ring_get_prev(ring, cur);
+               }
+
+               if (idx2 >= param->delta_list[delta_idx]) {
+                       param->elem_list[delta_idx] = cur;
+                       delta_idx ++;
+               }
+       }
+
+       /* COPY last elem to rest of the list */
+       delta_idx--;
+       for (idx2 = delta_idx + 1; idx2 < param->delta_cnt; idx2++) {
+               param->elem_list[idx2] = cur;
+       }
+       return lock_cnt;
+}
+
+#ifdef DHD_EWPR_VER2
+static int
+ewpr_single_bit_pack(ewpr_serial_info_t * info, char * buf, int buf_len,
+       void * _ptr, int bit_offset)
+{
+       int32 sval = 0;
+       char *ptr = (char *)_ptr;
+       uint32 offset = EWPF_INVALID;
+       uint16  version;
+       bool is_signed = FALSE;
+
+       if (info->is_multi_version == TRUE) {
+               version = *(uint16 *)((char *)_ptr + info->v_info.version_offset);
+               offset = ewpr_get_multi_offset(version, info);
+       } else {
+               offset = info->offset;
+       }
+
+       if (offset == EWPF_INVALID) {
+               DHD_FILTER_ERR(("INVALID TYPE to OFFSET:%s\n", info->name));
+               return 0;
+       }
+
+       ptr += offset;
+
+       switch (info->data_type) {
+               case EWP_INT8:
+                       sval = *(int8 *)ptr;
+                       is_signed = TRUE;
+                       break;
+               case EWP_UINT8:
+                       sval = *(uint8 *)ptr;
+                       break;
+               case EWP_INT16:
+                       sval = *(int16 *)ptr;
+                       is_signed = TRUE;
+                       break;
+               case EWP_UINT16:
+                       sval = *(uint16 *)ptr;
+                       break;
+               case EWP_INT32:
+                       sval = *(int32 *)ptr;
+                       is_signed = TRUE;
+                       break;
+               case EWP_UINT32:
+                       sval = *(uint32 *)ptr;
+                       break;
+#ifdef EWPR_DEBUG
+               case EWP_UINT64:
+                       sval = (int32)(*(uint64 *)ptr);
+                       break;
+#endif /* EWPR_DEBUG */
+               default:
+                       DHD_FILTER_ERR(("INVALID TYPE for Single Serial:%d", info->data_type));
+                       return 0;
+       }
+
+       /* convert negative value to positive before bit packing */
+       if (is_signed) {
+               if (sval < 0) {
+                       DHD_FILTER_TRACE(("convert to positive value %d\n", sval));
+                       sval = ABS(sval);
+               }
+       }
+
+       if (info->unit_convert > 1) {
+               DHD_FILTER_TRACE(("convert unit %d / %d\n", sval, info->unit_convert));
+               sval = sval / info->unit_convert;
+       }
+
+       if (is_signed) {
+               DHD_FILTER_TRACE(("%s : signed value : %d, bit length: %d",
+                       info->name, sval, info->display_bit_length));
+       } else {
+               DHD_FILTER_TRACE(("%s : unsigned value : %u, bit length: %d",
+                       info->name, sval, info->display_bit_length));
+       }
+
+       return ewpr_bit_pack_basic(buf, buf_len, sval, info->display_format,
+                       info->display_type, info->display_bit_length, bit_offset);
+}
+
+static int
+ewpr_diff_bit_pack(ewpr_serial_info_t *info, char *buf, int buf_len,
+       void *_f_op, void *_s_op, int bit_offset)
+{
+       char *f_op = (char *)_f_op;
+       char *s_op = (char *)_s_op;
+       int32 diff;
+       uint32 offset = EWPF_INVALID;
+       uint16  version;
+
+       if (info->is_multi_version == TRUE) {
+               version = *(uint16 *)(f_op + info->v_info.version_offset);
+               offset = ewpr_get_multi_offset(version, info);
+       } else {
+               offset = info->offset;
+       }
+
+       if (offset == EWPF_INVALID) {
+               DHD_FILTER_ERR(("INVALID TYPE to OFFSET:%s\n", info->name));
+               return 0;
+       }
+
+       f_op = f_op + offset;
+       s_op = s_op + offset;
+
+       switch (info->data_type) {
+               case EWP_INT8:
+               case EWP_UINT8:
+                       diff = *(uint8 *)f_op - *(uint8 *)s_op;
+                       break;
+               case EWP_INT16:
+               case EWP_UINT16:
+                       diff = *(uint16 *)f_op - *(uint16 *)s_op;
+                       break;
+               case EWP_INT32:
+               case EWP_UINT32:
+                       diff = *(uint32 *)f_op - *(uint32 *)s_op;
+                       break;
+               case EWP_UINT64:
+                       diff = (uint32)(*(uint64 *)f_op - *(uint64 *)s_op);
+                       break;
+               default:
+                       DHD_FILTER_ERR(("INVALID TYPE to DIFF:%d", info->data_type));
+                       return 0;
+       }
+
+       if (diff < 0) {
+               DHD_FILTER_TRACE(("convert to positive value %d\n", diff));
+               diff = ABS(diff);
+       }
+
+       if (info->unit_convert > 1) {
+               DHD_FILTER_TRACE(("convert unit %d / %d\n", diff, info->unit_convert));
+               diff = diff / info->unit_convert;
+       }
+
+       DHD_FILTER_TRACE(("%s : value : %d, bit length: %d",
+               info->name, diff, info->display_bit_length));
+       return ewpr_bit_pack_basic(buf, buf_len, diff, info->display_format,
+               info->display_type, info->display_bit_length, bit_offset);
+}
+
+static int
+ewpr_bit_pack_basic(char *buf, int buf_len, uint32 data, int format, int display_type,
+       int display_bit_length, int bit_offset)
+{
+       if (format == EWP_BIN) {
+               uint32 sdata = (uint32) data;
+               switch (display_type) {
+                       case EWP_BIT:
+                               /* call bit packing */
+                               return dhd_bit_pack(buf, buf_len, bit_offset,
+                                       sdata, display_bit_length);
+                       default:
+                               DHD_FILTER_ERR(("INVALID TYPE for Serial:%d", display_type));
+                               return 0;
+               }
+       }
+
+       DHD_FILTER_ERR(("INVALID FORMAT for Serial:%d", format));
+       return 0;
+}
+
+static ewpr_serial_info_t*
+ewpr_find_context_info(int index1, int index2, int index3)
+{
+       int idx = 0;
+       ewpr_serial_info_t *context_info = NULL;
+
+       for (idx = 0; ewpr_serial_context_info[idx].table != NULL; idx++) {
+               if (index1 == ewpr_serial_context_info[idx].index1 &&
+                               index2 == ewpr_serial_context_info[idx].index2 &&
+                               index3 == ewpr_serial_context_info[idx].index3) {
+                       context_info = ewpr_serial_context_info[idx].table;
+                       break;
+               }
+       }
+
+       if (context_info == NULL) {
+               DHD_FILTER_ERR(("unable to find context info for index number: %02x:%02x:%02x\n",
+                       index1, index2, index3));
+               return NULL;
+       }
+
+       return context_info;
+}
+
+static int
+ewpr_find_context_type(ewpr_serial_info_t* context_info)
+{
+       int idx = 0;
+       int context_type = BCME_ERROR;
+
+       /* index2, index3 are reserved */
+
+       for (idx = 0; ewpr_serial_context_info[idx].table != NULL; idx++) {
+               if (context_info == ewpr_serial_context_info[idx].table) {
+                       context_type = idx;
+                       break;
+               }
+       }
+
+       return context_type;
+}
+
+static uint32
+ewpr_scnprintf(char *buf, uint32 buf_len, uint32 input_len, char *data_type, char *fmt, ...)
+{
+       va_list args;
+
+       if (buf_len < input_len) {
+               DHD_FILTER_ERR(("%s: input length(%d) is larger than "
+                       "remain buffer length(%d)\n", data_type,
+                       input_len, buf_len));
+       }
+       va_start(args, fmt);
+       buf_len = vscnprintf(buf, buf_len, fmt, args);
+       va_end(args);
+
+       return buf_len;
+}
+
+uint32
+dhd_event_log_filter_serialize_bit(dhd_pub_t *dhdp, char *in_buf, uint32 tot_len,
+       int index1, int index2, int index3)
+{
+       EWP_filter_t *filter = (EWP_filter_t *)dhdp->event_log_filter;
+       void *ring[EWPF_MAX_IDX_TYPE];
+       char *ret_buf = in_buf;
+       int slice_id;
+       int iface_id;
+       int event_id;
+       int key_info_id;
+       int idx;
+       int idx2;
+       uint32 bytes_written = 0;
+       int bits_written = 0;
+       void *elem[EWPF_MAX_IDX_TYPE][EWPR_CSDCLIENT_DIFF];
+       void **elem_list;
+       int lock_cnt, lock_cnt2;
+       uint32 delta_list[EWPR_CSDCLIENT_DIFF];
+       ewpr_lock_param_t lock_param;
+       char cookie_str[DEBUG_DUMP_TIME_BUF_LEN];
+       char iov_buf[EWPR_IOV_BUF_LEN];
+       char *raw_buf = NULL;
+       char *raw_encode_buf = NULL;
+       int raw_buf_size;
+       int ret = 0;
+       ewpr_serial_info_t *context_info = NULL;
+       int context_type;
+       uint32 conv_cnt = 0;
+
+#ifdef DHD_STATUS_LOGGING
+       stat_elem_t dhd_stat[EWP_DHD_STAT_SIZE];
+       stat_query_t query;
+
+       memset(&dhd_stat[0], 0x00, sizeof(stat_elem_t) * EWP_DHD_STAT_SIZE);
+#endif /* DHD_STATUS_LOGGING */
+
+       context_info = ewpr_find_context_info(index1, index2, index3);
+       if (!context_info) {
+               return bytes_written;
+       }
+
+       if (tot_len < EWPR_MAX_STR_SIZE) {
+               DHD_FILTER_ERR(("%s: insufficient buffer size %d\n",
+                       __FUNCTION__, tot_len));
+               return bytes_written;
+       }
+
+       iface_id = 0; /* STA INTERFACE ONLY */
+       event_id = 0; /* COMMON ID */
+       key_info_id = 0; /* COMMON ID */
+       if (filter->last_channel <= CH_MAX_2G_CHANNEL) {
+               slice_id = EWPF_SLICE_AUX;
+       } else {
+               slice_id = EWPF_SLICE_MAIN;
+       }
+       ring[EWPF_IDX_TYPE_SLICE - 1] = filter->s_ring[slice_id];
+       ring[EWPF_IDX_TYPE_IFACE - 1] = filter->i_ring[iface_id];
+       ring[EWPF_IDX_TYPE_EVENT - 1] = filter->e_ring[event_id];
+       ring[EWPF_IDX_TYPE_KEY_INFO - 1] = filter->k_ring[key_info_id];
+
+       /* Configure common LOCK parameter */
+       lock_param.max_armcycle = (uint32)EWPF_INVALID;
+       lock_param.min_armcycle = filter->last_armcycle;
+       lock_param.max_period = (EWPR_ARRAY_CNT - 1)* EWPR_INTERVAL;
+       lock_param.max_period *= EWPF_MSEC_TO_SEC * EWPF_ARM_TO_MSEC;
+       lock_param.delta_cnt = ARRAYSIZE(delta_list);
+       lock_param.delta_list = delta_list;
+
+       for (idx = 0; idx < EWPR_CSDCLIENT_DIFF; idx++) {
+               delta_list[idx] = idx * EWPR_DELTA_CNT;
+       }
+
+       lock_param.ring = ring[EWPF_IDX_TYPE_IFACE -1];
+       lock_param.elem_list = elem[EWPF_IDX_TYPE_IFACE -1];
+       lock_cnt = ewpr_set_period_lock(&lock_param);
+       if (lock_cnt <= 0) {
+               DHD_FILTER_ERR(("FAIL TO GET IFACE LOCK: %d\n", iface_id));
+               bytes_written = 0;
+               goto finished;
+       }
+
+       for (idx = 0; idx < EWPR_CSDCLIENT_DIFF; idx++) {
+               delta_list[idx] = idx * EWPR_DELTA_CNT;
+       }
+
+       lock_param.ring = ring[EWPF_IDX_TYPE_SLICE -1];
+       lock_param.elem_list = elem[EWPF_IDX_TYPE_SLICE -1];
+       lock_cnt2 = ewpr_set_period_lock(&lock_param);
+       if (lock_cnt2 <= 0) {
+               DHD_FILTER_ERR(("FAIL TO GET SLICE LOCK: %d\n", slice_id));
+               goto finished;
+       }
+
+       if (lock_cnt != lock_cnt2) {
+               DHD_FILTER_ERR(("Lock Count is Diff: iface:%d slice:%d\n", lock_cnt, lock_cnt2));
+               lock_cnt = MIN(lock_cnt, lock_cnt2);
+       }
+
+       for (idx = 0; idx < EWPR_CSDCLIENT_DIFF; idx++) {
+               delta_list[idx] = idx * EWPR_DELTA_CNT;
+       }
+
+       lock_param.ring = ring[EWPF_IDX_TYPE_EVENT -1];
+       lock_param.elem_list = elem[EWPF_IDX_TYPE_EVENT -1];
+       lock_cnt = ewpr_set_period_lock(&lock_param);
+       if (lock_cnt <= 0) {
+               DHD_FILTER_ERR(("FAIL TO GET EVENT ECNT LOCK: %d\n", iface_id));
+               bytes_written = 0;
+               goto finished;
+       }
+
+       for (idx = 0; idx < EWPR_CSDCLIENT_DIFF; idx++) {
+               delta_list[idx] = idx * EWPR_DELTA_CNT;
+       }
+
+       lock_param.ring = ring[EWPF_IDX_TYPE_KEY_INFO -1];
+       lock_param.elem_list = elem[EWPF_IDX_TYPE_KEY_INFO -1];
+       lock_cnt = ewpr_set_period_lock(&lock_param);
+       if (lock_cnt <= 0) {
+               DHD_FILTER_ERR(("FAIL TO GET KEY INFO LOCK: %d\n", iface_id));
+               bytes_written = 0;
+               goto finished;
+       }
+
+#ifdef EWPR_DEBUG
+       ewpr_debug_dump(context_info, ring);
+#endif /* EWPR_DEBUG */
+
+       memset(ret_buf, 0, tot_len);
+       memset(cookie_str, 0, DEBUG_DUMP_TIME_BUF_LEN);
+       bytes_written = 0;
+       bits_written = 0;
+
+       /* XXX Counters BIG DATA not matched to file yet */
+       get_debug_dump_time(cookie_str);
+#ifdef DHD_LOG_DUMP
+       dhd_logdump_cookie_save(dhdp, cookie_str, "ECNT");
+#endif /* DHD_LOG_DUMP */
+
+       /* KEY DATA */
+       bytes_written += ewpr_scnprintf(&ret_buf[bytes_written],
+               tot_len - bytes_written, REPORT_VERSION_STR_SIZE,
+               "report version", "%08x", EWP_REPORT_VERSION);
+
+       bytes_written += ewpr_scnprintf(&ret_buf[bytes_written],
+               tot_len - bytes_written, DELIMITER_LEN + strlen(cookie_str),
+               "cookie string", "%c%s", KEY_DEL, cookie_str);
+
+       bytes_written += ewpr_scnprintf(&ret_buf[bytes_written],
+               tot_len - bytes_written, DELIMITER_LEN + INDEX_STR_SIZE,
+               "host trigger index", "%c%02x%02x%02x", KEY_DEL, index1, index2, index3);
+
+#ifdef DHD_STATUS_LOGGING
+       DHD_FILTER_TRACE(("print dhd_stat size:%d * %d, size of filter list: %d\n",
+               (uint32)sizeof(dhd_stat[0]), EWP_DHD_STAT_SIZE,
+               (uint32)sizeof(dhd_statlog_filter)));
+       query.req_buf = NULL;
+       query.req_buf_len = 0;
+       query.resp_buf = (char *)dhd_stat;
+       query.resp_buf_len = DHD_STATLOG_RING_SIZE(EWP_DHD_STAT_SIZE);
+       query.req_num = EWP_DHD_STAT_SIZE;
+       ret = dhd_statlog_get_latest_info(dhdp, (void *)&query);
+       if (ret < 0) {
+               DHD_FILTER_ERR(("fail to get dhd statlog - %d\n", ret));
+       }
+#ifdef EWPR_DEBUG
+       for (idx = 0; idx < EWP_DHD_STAT_SIZE; idx++) {
+               DHD_FILTER_TRACE(("DHD status index: %d, timestamp: %llu, stat: %d\n",
+                       idx, dhd_stat[idx].ts, dhd_stat[idx].stat));
+       }
+#endif
+       bytes_written += ewpr_scnprintf(&ret_buf[bytes_written],
+               tot_len - bytes_written, DELIMITER_LEN + DHD_STAT_STR_SIZE,
+               "current dhd status", "%c%02x", KEY_DEL, dhd_stat[0].stat);
+
+       bytes_written += ewpr_scnprintf(&ret_buf[bytes_written],
+               tot_len - bytes_written, DELIMITER_LEN + DHD_STAT_STR_SIZE,
+               "previous dhd status", "%c%02x", KEY_DEL, dhd_stat[1].stat);
+#else
+       /* reserved for dhd status information */
+       bytes_written += ewpr_scnprintf(&ret_buf[bytes_written],
+               tot_len - bytes_written, DELIMITER_LEN + DHD_STAT_STR_SIZE,
+               "current dhd status", "%c%02x", KEY_DEL, 0x00);
+
+       bytes_written += ewpr_scnprintf(&ret_buf[bytes_written],
+               tot_len - bytes_written, DELIMITER_LEN + DHD_STAT_STR_SIZE,
+               "previous dhd status", "%c%02x", KEY_DEL, 0x00);
+#endif /* DHD_STATUS_LOGGING */
+
+       /* RAW DATA */
+       raw_buf = MALLOCZ(dhdp->osh, RAW_BUFFER_SIZE);
+
+       for (idx = 0; strlen(context_info[idx].name) != 0; idx++) {
+               ewpr_serial_info_t *info = &context_info[idx];
+               elem_list = elem[info->ring_type - 1];
+               DHD_FILTER_TRACE(("%s : array_size: %d\n", info->name, info->display_array_size));
+               switch (info->info_type) {
+                       case EWPF_INFO_VER:
+                               DHD_FILTER_TRACE(("write %s - value: %d\n", info->name,
+                                       EWP_REPORT_VERSION));
+                               bits_written = dhd_bit_pack(raw_buf, RAW_BUFFER_SIZE, bits_written,
+                                       EWP_REPORT_VERSION, info->display_bit_length);
+                               break;
+                       case EWPF_INFO_TYPE:
+                               context_type = ewpr_find_context_type(context_info);
+                               if (context_type < 0) {
+                                       DHD_FILTER_ERR(("fail to get context_type - %d\n",
+                                               context_type));
+                                       break;
+                               }
+                               DHD_FILTER_TRACE(("write %s - value: %d\n", info->name,
+                                       (uint32)context_type));
+                               bits_written = dhd_bit_pack(raw_buf, RAW_BUFFER_SIZE, bits_written,
+                                       (uint32)context_type, info->display_bit_length);
+                               break;
+                       case EWPF_INFO_DHDSTAT:
+                               if (strcmp("dhdstat_last_ts", info->name) == 0) {
+#ifdef DHD_STATUS_LOGGING
+                                       if (info->unit_convert > 1) {
+                                               conv_cnt = dhd_stat[0].ts_tz / info->unit_convert;
+                                       } else {
+                                               conv_cnt = dhd_stat[0].ts_tz;
+                                       }
+                                       DHD_FILTER_TRACE(("DHD status last timestamp:"
+                                               " %llu, %u", dhd_stat[0].ts_tz,
+                                               conv_cnt));
+                                       bits_written = dhd_bit_pack(raw_buf, RAW_BUFFER_SIZE,
+                                               bits_written, conv_cnt,
+                                               info->display_bit_length);
+#else
+                                       DHD_FILTER_TRACE(("No DHD status log timestamp\n"));
+                                       bits_written = dhd_bit_pack(raw_buf, RAW_BUFFER_SIZE,
+                                               bits_written, 0x00, info->display_bit_length);
+#endif /* DHD_STATUS_LOGGING */
+                               } else if (strcmp("dhdstat_last", info->name) == 0) {
+#ifdef DHD_STATUS_LOGGING
+                                       DHD_FILTER_TRACE(("DHD status last stat: %d(0x%02x)",
+                                               dhd_stat[0].stat, dhd_stat[0].stat));
+                                       bits_written = dhd_bit_pack(raw_buf, RAW_BUFFER_SIZE,
+                                               bits_written, (uint32)dhd_stat[0].stat,
+                                               info->display_bit_length);
+#else
+                                       DHD_FILTER_TRACE(("No DHD status log value\n"));
+                                       bits_written = dhd_bit_pack(raw_buf, RAW_BUFFER_SIZE,
+                                               bits_written, 0x00, info->display_bit_length);
+#endif /* DHD_STATUS_LOGGING */
+                               } else if (strcmp("dhdstat_prev_ts", info->name) == 0) {
+#ifdef DHD_STATUS_LOGGING
+                                       if (info->unit_convert > 1) {
+                                               conv_cnt = dhd_stat[1].ts_tz / info->unit_convert;
+                                       } else {
+                                               conv_cnt = dhd_stat[1].ts_tz;
+                                       }
+                                       DHD_FILTER_TRACE(("DHD status prev timestamp:"
+                                               " %llu, %u", dhd_stat[1].ts_tz,
+                                               conv_cnt));
+                                       bits_written = dhd_bit_pack(raw_buf, RAW_BUFFER_SIZE,
+                                               bits_written, conv_cnt,
+                                               info->display_bit_length);
+#else
+                                       DHD_FILTER_TRACE(("No DHD status log timestamp\n"));
+                                       bits_written = dhd_bit_pack(raw_buf, RAW_BUFFER_SIZE,
+                                               bits_written, 0x00, info->display_bit_length);
+#endif /* DHD_STATUS_LOGGING */
+                               } else if (strcmp("dhdstat_prev", info->name) == 0) {
+#ifdef DHD_STATUS_LOGGING
+                                       DHD_FILTER_TRACE(("DHD status prev stat: %d(0x%02x)",
+                                               dhd_stat[1].stat, dhd_stat[1].stat));
+                                       bits_written = dhd_bit_pack(raw_buf, RAW_BUFFER_SIZE,
+                                               bits_written, (uint32)dhd_stat[1].stat,
+                                               info->display_bit_length);
+#else
+                                       DHD_FILTER_TRACE(("No DHD status log value\n"));
+                                       bits_written = dhd_bit_pack(raw_buf, RAW_BUFFER_SIZE,
+                                               bits_written, 0x00, info->display_bit_length);
+#endif /* DHD_STATUS_LOGGING */
+                               } else {
+                                       DHD_FILTER_ERR(("unknown dhdstat name - %s\n",
+                                               info->name));
+                               }
+                               break;
+                       case EWPF_INFO_ECNT:
+                               for (idx2 = 0; idx2 < info->display_array_size; idx2++) {
+                                       if (info->display_method == EWPR_DISPLAY_METHOD_SINGLE) {
+                                               bits_written = ewpr_single_bit_pack(info, raw_buf,
+                                                       RAW_BUFFER_SIZE, elem_list[idx2],
+                                                       bits_written);
+                                       } else {
+                                               bits_written = ewpr_diff_bit_pack(info, raw_buf,
+                                                       RAW_BUFFER_SIZE, elem_list[idx2],
+                                                       elem_list[idx2+1], bits_written);
+                                       }
+                               }
+                               break;
+                       case EWPF_INFO_IOVAR:
+                               if (dhd_iovar(dhdp, 0, info->name, NULL, 0, iov_buf,
+                                               ARRAYSIZE(iov_buf), FALSE) < 0) {
+                                       DHD_FILTER_ERR(("fail to get auth\n"));
+                                       *(uint32 *)iov_buf = EWPF_INVALID;
+                               }
+                               DHD_FILTER_TRACE(("write %s - value: %d\n", info->name,
+                                       *(uint8 *)iov_buf));
+                               bits_written = dhd_bit_pack(raw_buf, RAW_BUFFER_SIZE,
+                                       bits_written, *(uint8 *)iov_buf,
+                                       info->display_bit_length);
+                               break;
+                       case EWPF_INFO_CPLOG:
+                               DHD_FILTER_TRACE(("write compact packt log\n"));
+                               ret = 0;
+#if defined(DHD_PKT_LOGGING) && defined(DHD_COMPACT_PKT_LOG)
+                               ret = dhd_cpkt_log_proc(dhdp, raw_buf, RAW_BUFFER_SIZE,
+                                       bits_written, info->display_array_size);
+#endif /* DHD_PKT_LOGGING && DHD_COMPACT_PKT_LOG */
+                               if (ret < 0) {
+                                       DHD_FILTER_ERR(("fail to get compact packet log - %d\n",
+                                               ret));
+                                       break;
+                               }
+                               /* update bit offset */
+                               DHD_FILTER_TRACE(("%d bits written\n", ret));
+                               if (ret > 0) {
+                                       bits_written = ret;
+                               }
+                               break;
+                       default:
+                               DHD_FILTER_ERR(("unsupported info type\n"));
+                               break;
+               }
+               DHD_FILTER_TRACE(("%d bits written\n", bits_written));
+       }
+
+       /* encode data */
+       raw_buf_size = BYTE_SIZE(bits_written);
+       raw_encode_buf = ewpr_base64_encode(dhdp, raw_buf, raw_buf_size);
+
+#ifdef EWPR_DEBUG
+       DHD_FILTER_ERR(("raw_buf:\n"));
+       for (idx = 0; idx < raw_buf_size; idx++) {
+               ewpr_print_byte_as_bits(raw_buf[idx]);
+       }
+#endif /* EWPR_DEBUG */
+       DHD_FILTER_TRACE(("base64 encoding result:\n"));
+       DHD_FILTER_TRACE(("%s", raw_encode_buf));
+
+       bytes_written += ewpr_scnprintf(&ret_buf[bytes_written],
+               tot_len - bytes_written, DELIMITER_LEN + strlen(raw_encode_buf),
+               "base64 encoded raw data", "%c%s", KEY_DEL, raw_encode_buf);
+
+finished:
+       DHD_FILTER_ERR(("RET LEN:%d\n", (int)strlen(ret_buf)));
+       DHD_FILTER_TRACE(("ret_buf: %s", ret_buf));
+
+       dhd_ring_lock_free(ring[EWPF_IDX_TYPE_SLICE - 1]);
+       dhd_ring_lock_free(ring[EWPF_IDX_TYPE_IFACE - 1]);
+       dhd_ring_lock_free(ring[EWPF_IDX_TYPE_EVENT - 1]);
+       dhd_ring_lock_free(ring[EWPF_IDX_TYPE_KEY_INFO - 1]);
+
+       MFREE(dhdp->osh, raw_buf, RAW_BUFFER_SIZE);
+       MFREE(dhdp->osh, raw_encode_buf, BASE64_BUFFER_SIZE);
+       return bytes_written;
+}
+
+#ifdef EWPR_DEBUG
+static void
+ewpr_print_byte_as_bits(char val)
+{
+       int32 idx;
+       char buf[EWPR_DEBUG_BUF_LEN];
+       for (idx = 0; idx < MAX_BIT_SIZE; idx++) {
+               scnprintf(&buf[idx], EWPR_DEBUG_BUF_LEN-idx, "%c",
+                       (val & (1 << (MAX_BIT_SHIFT-idx))) ? '1' : '0');
+       }
+       buf[MAX_BIT_SIZE] = 0x0;
+       DHD_FILTER_ERR(("%s\n", buf));
+}
+#endif /* EWPR_DEBUG */
+
+static char*
+ewpr_base64_encode(dhd_pub_t *dhdp, char* input, int32 length)
+{
+       /* set up a destination buffer large enough to hold the encoded data */
+       char *output = MALLOCZ(dhdp->osh, BASE64_BUFFER_SIZE);
+       int32 cnt = 0;
+
+       if (length > RAW_BUFFER_SIZE) {
+               DHD_FILTER_ERR(("%s: input data size is too big, size is limited to %d\n",
+                       __FUNCTION__, RAW_BUFFER_SIZE));
+               length = RAW_BUFFER_SIZE;
+       }
+
+       cnt = dhd_base64_encode(input, length, output, BASE64_BUFFER_SIZE);
+       if (cnt == 0) {
+               DHD_FILTER_ERR(("%s: base64 encoding error\n", __FUNCTION__));
+       }
+       return output;
+}
+#endif /* DHD_EWPR_VER2 */
+
+#ifdef WLADPS_ENERGY_GAIN
+#define ADPS_GAIN_ENERGY_CONV_UNIT     100000  /* energy unit(10^-2) * dur unit(10^-3) */
+static int
+dhd_calculate_adps_energy_gain(wl_adps_energy_gain_v1_t *data)
+{
+       int i;
+       int energy_gain = 0;
+
+       /* energy unit: (uAh * 10^-2)/sec */
+       int pm0_idle_energy[MAX_BANDS] =
+               {ADPS_GAIN_2G_PM0_IDLE, ADPS_GAIN_5G_PM0_IDLE};
+       int txpspoll_energy[MAX_BANDS] =
+               {ADPS_GAIN_2G_TX_PSPOLL, ADPS_GAIN_5G_TX_PSPOLL};
+
+       /* dur unit: mSec */
+       for (i = 0; i < MAX_BANDS; i++) {
+               energy_gain += (data->gain_data[i].pm_dur_gain * pm0_idle_energy[i]);
+               energy_gain -= (data->gain_data[i].step0_dur * txpspoll_energy[i]);
+       }
+       energy_gain /= ADPS_GAIN_ENERGY_CONV_UNIT;
+
+       return energy_gain;
+}
+
+int dhd_event_log_filter_adps_energy_gain(dhd_pub_t *dhdp)
+{
+       int ret;
+
+       void *last_elem;
+       EWP_filter_t *filter;
+       EWPF_ifc_elem_t *ifc_elem;
+
+       if (!dhdp || !dhdp->event_log_filter) {
+               return 0;
+       }
+
+       filter = (EWP_filter_t *)dhdp->event_log_filter;
+
+       if (filter->enabled != TRUE) {
+               DHD_FILTER_ERR(("%s - EWP Filter is not enabled\n", __FUNCTION__));
+               return 0;
+       }
+
+       /* Refer to STA interface */
+       last_elem = dhd_ring_get_last(filter->i_ring[0]);
+       if (last_elem == NULL) {
+               DHD_FILTER_ERR(("%s - last_elem is NULL\n", __FUNCTION__));
+               return 0;
+       }
+
+       ifc_elem = (EWPF_ifc_elem_t *)last_elem;
+       ret = dhd_calculate_adps_energy_gain(&ifc_elem->adps_energy_gain);
+
+       return ret;
+}
+#endif /* WLADPS_ENERGY_GAIN */
diff --git a/bcmdhd.101.10.240.x/dhd_event_log_filter.h b/bcmdhd.101.10.240.x/dhd_event_log_filter.h
new file mode 100644 (file)
index 0000000..a39da3b
--- /dev/null
@@ -0,0 +1,56 @@
+/*
+ * Wifi dongle status Filter and Report
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef dhd_event_log_filter_h
+#define dhd_event_log_filter_h
+#include <dhd.h>
+#include <event_log_tag.h>
+#include <dhd_debug.h>
+
+typedef struct {
+       uint16  version;
+       uint8   htr_type;       /* from wl_slice_hist_XX_stats_xtlv_id */
+       uint8   htr_num;        /* number of elements in htr_running or htr_rc */
+       uint32  htr_rn_last;    /* last reasons along with seq, etc */
+       uint32  htr_rn_ts_last; /* last time stamps corr to htr_rn_last */
+       uint32  htr_rn_prev;    /* last reasons along with seq, etc */
+       uint32  htr_rn_ts_prev; /* last time stamps corr to htr_rn_prev */
+       uint32  htr_rc_max;     /* largest toss reasons and counts */
+       uint32  htr_rc_ts_max;  /* latest time stamp corr to htr_rc_max */
+       uint32  htr_rc_secnd;   /* second largest toss reasons and counts */
+       uint32  htr_rc_ts_secnd;        /* latest time stamps corr to htr_rc_second */
+} evt_hist_compact_toss_stats_v1_t;
+
+int dhd_event_log_filter_init(dhd_pub_t *dhdp, uint8 *buf, uint32 buf_size);
+void dhd_event_log_filter_deinit(dhd_pub_t *dhdp);
+void dhd_event_log_filter_event_handler(
+       dhd_pub_t *dhdp, prcd_event_log_hdr_t *plog_hdr, uint32 *data);
+
+void dhd_event_log_filter_notify_connect_request(dhd_pub_t *dhdp, uint8 *bssid, int channel);
+void dhd_event_log_filter_notify_connect_done(dhd_pub_t *dhdp, uint8 *bssid, int roam);
+#ifdef WLADPS_ENERGY_GAIN
+int dhd_event_log_filter_adps_energy_gain(dhd_pub_t *dhdp);
+#endif /* WLADPS_ENERGY_GAIN */
+#endif /* !dhd_event_log_filter_h */
diff --git a/bcmdhd.101.10.240.x/dhd_flowring.c b/bcmdhd.101.10.240.x/dhd_flowring.c
new file mode 100644 (file)
index 0000000..6fa2e29
--- /dev/null
@@ -0,0 +1,1387 @@
+/*
+ * @file Broadcom Dongle Host Driver (DHD), Flow ring specific code at top level
+ *
+ * Flow rings are transmit traffic (=propagating towards antenna) related entities
+ *
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+/** XXX Twiki: [PCIeFullDongleArchitecture] */
+
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmdevs.h>
+
+#include <ethernet.h>
+#include <bcmevent.h>
+#include <dngl_stats.h>
+
+#include <dhd.h>
+
+#include <dhd_flowring.h>
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#include <802.1d.h>
+#include <pcie_core.h>
+#include <bcmmsgbuf.h>
+#include <dhd_pcie.h>
+
+static INLINE int dhd_flow_queue_throttle(flow_queue_t *queue);
+
+static INLINE uint16 dhd_flowid_find(dhd_pub_t *dhdp, uint8 ifindex,
+                                     uint8 prio, char *sa, char *da);
+
+static INLINE uint16 dhd_flowid_alloc(dhd_pub_t *dhdp, uint8 ifindex,
+                                      uint8 prio, char *sa, char *da);
+
+static INLINE int dhd_flowid_lookup(dhd_pub_t *dhdp, uint8 ifindex,
+                                uint8 prio, char *sa, char *da, uint16 *flowid);
+int dhd_flow_queue_overflow(flow_queue_t *queue, void *pkt);
+
+#define FLOW_QUEUE_PKT_NEXT(p)          PKTLINK(p)
+#define FLOW_QUEUE_PKT_SETNEXT(p, x)    PKTSETLINK((p), (x))
+
+const uint8 prio2ac[8] = { 0, 1, 1, 0, 2, 2, 3, 3 };
+const uint8 prio2tid[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
+
+/** Queue overflow throttle. Return value: TRUE if throttle needs to be applied */
+static INLINE int
+dhd_flow_queue_throttle(flow_queue_t *queue)
+{
+       return DHD_FLOW_QUEUE_FULL(queue);
+}
+
+int
+BCMFASTPATH(dhd_flow_queue_overflow)(flow_queue_t *queue, void *pkt)
+{
+       return BCME_NORESOURCE;
+}
+
+/** Returns flow ring given a flowid */
+flow_ring_node_t *
+dhd_flow_ring_node(dhd_pub_t *dhdp, uint16 flowid)
+{
+       flow_ring_node_t * flow_ring_node;
+
+       ASSERT(dhdp != (dhd_pub_t*)NULL);
+       ASSERT(flowid <= dhdp->max_tx_flowid);
+       if (flowid > dhdp->max_tx_flowid) {
+               return NULL;
+       }
+
+       flow_ring_node = &(((flow_ring_node_t*)(dhdp->flow_ring_table))[flowid]);
+
+       ASSERT(flow_ring_node->flowid == flowid);
+       return flow_ring_node;
+}
+
+/** Returns 'backup' queue given a flowid */
+flow_queue_t *
+dhd_flow_queue(dhd_pub_t *dhdp, uint16 flowid)
+{
+       flow_ring_node_t * flow_ring_node = NULL;
+
+       flow_ring_node = dhd_flow_ring_node(dhdp, flowid);
+       if (flow_ring_node)
+               return &flow_ring_node->queue;
+       else
+               return NULL;
+}
+
+/* Flow ring's queue management functions */
+
+/** Reinitialize a flow ring's queue. */
+void
+dhd_flow_queue_reinit(dhd_pub_t *dhdp, flow_queue_t *queue, int max)
+{
+       ASSERT((queue != NULL) && (max > 0));
+
+       queue->head = queue->tail = NULL;
+       queue->len = 0;
+
+       /* Set queue's threshold and queue's parent cummulative length counter */
+       ASSERT(max > 1);
+       DHD_FLOW_QUEUE_SET_MAX(queue, max);
+       DHD_FLOW_QUEUE_SET_THRESHOLD(queue, max);
+       DHD_FLOW_QUEUE_SET_CLEN(queue, &dhdp->cumm_ctr);
+       DHD_FLOW_QUEUE_SET_L2CLEN(queue, &dhdp->l2cumm_ctr);
+
+       queue->failures = 0U;
+       queue->cb = &dhd_flow_queue_overflow;
+}
+
+/** Initialize a flow ring's queue, called on driver initialization. */
+void
+dhd_flow_queue_init(dhd_pub_t *dhdp, flow_queue_t *queue, int max)
+{
+       ASSERT((queue != NULL) && (max > 0));
+
+       dll_init(&queue->list);
+       dhd_flow_queue_reinit(dhdp, queue, max);
+}
+
+/** Register an enqueue overflow callback handler */
+void
+dhd_flow_queue_register(flow_queue_t *queue, flow_queue_cb_t cb)
+{
+       ASSERT(queue != NULL);
+       queue->cb = cb;
+}
+
+/**
+ * Enqueue an 802.3 packet at the back of a flow ring's queue. From there, it will travel later on
+ * to the flow ring itself.
+ */
+int
+BCMFASTPATH(dhd_flow_queue_enqueue)(dhd_pub_t *dhdp, flow_queue_t *queue, void *pkt)
+{
+       int ret = BCME_OK;
+
+       ASSERT(queue != NULL);
+
+       if (dhd_flow_queue_throttle(queue)) {
+               queue->failures++;
+               ret = (*queue->cb)(queue, pkt);
+               goto done;
+       }
+
+       if (queue->head) {
+               FLOW_QUEUE_PKT_SETNEXT(queue->tail, pkt);
+       } else {
+               queue->head = pkt;
+       }
+
+       FLOW_QUEUE_PKT_SETNEXT(pkt, NULL);
+
+       queue->tail = pkt; /* at tail */
+
+       queue->len++;
+       /* increment parent's cummulative length */
+       DHD_CUMM_CTR_INCR(DHD_FLOW_QUEUE_CLEN_PTR(queue));
+       /* increment grandparent's cummulative length */
+       DHD_CUMM_CTR_INCR(DHD_FLOW_QUEUE_L2CLEN_PTR(queue));
+
+done:
+       return ret;
+}
+
+/** Dequeue an 802.3 packet from a flow ring's queue, from head (FIFO) */
+void *
+BCMFASTPATH(dhd_flow_queue_dequeue)(dhd_pub_t *dhdp, flow_queue_t *queue)
+{
+       void * pkt;
+
+       ASSERT(queue != NULL);
+
+       pkt = queue->head; /* from head */
+
+       if (pkt == NULL) {
+               ASSERT((queue->len == 0) && (queue->tail == NULL));
+               goto done;
+       }
+
+       queue->head = FLOW_QUEUE_PKT_NEXT(pkt);
+       if (queue->head == NULL)
+               queue->tail = NULL;
+
+       queue->len--;
+       /* decrement parent's cummulative length */
+       DHD_CUMM_CTR_DECR(DHD_FLOW_QUEUE_CLEN_PTR(queue));
+       /* decrement grandparent's cummulative length */
+       DHD_CUMM_CTR_DECR(DHD_FLOW_QUEUE_L2CLEN_PTR(queue));
+
+       FLOW_QUEUE_PKT_SETNEXT(pkt, NULL); /* dettach packet from queue */
+
+done:
+       return pkt;
+}
+
+/** Reinsert a dequeued 802.3 packet back at the head */
+void
+BCMFASTPATH(dhd_flow_queue_reinsert)(dhd_pub_t *dhdp, flow_queue_t *queue, void *pkt)
+{
+       if (queue->head == NULL) {
+               queue->tail = pkt;
+       }
+
+       FLOW_QUEUE_PKT_SETNEXT(pkt, queue->head);
+       queue->head = pkt;
+       queue->len++;
+       /* increment parent's cummulative length */
+       DHD_CUMM_CTR_INCR(DHD_FLOW_QUEUE_CLEN_PTR(queue));
+       /* increment grandparent's cummulative length */
+       DHD_CUMM_CTR_INCR(DHD_FLOW_QUEUE_L2CLEN_PTR(queue));
+}
+
+/** Fetch the backup queue for a flowring, and assign flow control thresholds */
+void
+dhd_flow_ring_config_thresholds(dhd_pub_t *dhdp, uint16 flowid,
+                     int queue_budget, int cumm_threshold, void *cumm_ctr,
+                     int l2cumm_threshold, void *l2cumm_ctr)
+{
+       flow_queue_t * queue = NULL;
+
+       ASSERT(dhdp != (dhd_pub_t*)NULL);
+       ASSERT(queue_budget > 1);
+       ASSERT(cumm_threshold > 1);
+       ASSERT(cumm_ctr != (void*)NULL);
+       ASSERT(l2cumm_threshold > 1);
+       ASSERT(l2cumm_ctr != (void*)NULL);
+
+       queue = dhd_flow_queue(dhdp, flowid);
+       if (queue) {
+               DHD_FLOW_QUEUE_SET_MAX(queue, queue_budget); /* Max queue length */
+
+               /* Set the queue's parent threshold and cummulative counter */
+               DHD_FLOW_QUEUE_SET_THRESHOLD(queue, cumm_threshold);
+               DHD_FLOW_QUEUE_SET_CLEN(queue, cumm_ctr);
+
+               /* Set the queue's grandparent threshold and cummulative counter */
+               DHD_FLOW_QUEUE_SET_L2THRESHOLD(queue, l2cumm_threshold);
+               DHD_FLOW_QUEUE_SET_L2CLEN(queue, l2cumm_ctr);
+       }
+}
+
+uint8
+dhd_num_prio_supported_per_flow_ring(dhd_pub_t *dhdp)
+{
+       uint8 prio_count = 0;
+       int i;
+       // Pick all elements one by one
+       for (i = 0; i < NUMPRIO; i++)
+       {
+               // Check if the picked element is already counted
+               int j;
+               for (j = 0; j < i; j++) {
+                       if (dhdp->flow_prio_map[i] == dhdp->flow_prio_map[j]) {
+                               break;
+                       }
+               }
+               // If not counted earlier, then count it
+               if (i == j) {
+                       prio_count++;
+               }
+       }
+
+#ifdef DHD_LOSSLESS_ROAMING
+       /* For LLR, we are using flowring with prio 7 which is not considered
+        * in prio2ac array. But in __dhd_sendpkt, it is hardcoded hardcoded
+        * prio to PRIO_8021D_NC and send to dhd_flowid_update.
+        * So add 1 to prio_count.
+        */
+       prio_count++;
+#endif /* DHD_LOSSLESS_ROAMING */
+
+       return prio_count;
+}
+
+uint8
+dhd_get_max_multi_client_flow_rings(dhd_pub_t *dhdp)
+{
+       uint8 reserved_infra_sta_flow_rings = dhd_num_prio_supported_per_flow_ring(dhdp);
+       uint8 total_tx_flow_rings = (uint8)dhd_get_max_flow_rings(dhdp);
+       uint8 max_multi_client_flow_rings = total_tx_flow_rings - reserved_infra_sta_flow_rings;
+       return max_multi_client_flow_rings;
+}
+
+int
+dhd_flowid_map_init(dhd_pub_t *dhdp, uint16 max_tx_flow_rings)
+{
+#if defined(DHD_HTPUT_TUNABLES)
+       uint16 max_normal_tx_flow_rings = max_tx_flow_rings - HTPUT_TOTAL_FLOW_RINGS;
+#else
+       uint16 max_normal_tx_flow_rings = max_tx_flow_rings;
+#endif /* DHD_HTPUT_TUNABLES */
+
+       /* Construct a normal flowid allocator from FLOWID_RESERVED to
+        * (max_normal_tx_flow_rings - 1)
+        */
+       dhdp->flowid_allocator = id16_map_init(dhdp->osh, max_normal_tx_flow_rings,
+               FLOWID_RESERVED);
+       if (dhdp->flowid_allocator == NULL) {
+               DHD_ERROR(("%s: flowid allocator init failure\n", __FUNCTION__));
+               return BCME_NOMEM;
+       }
+
+#if defined(DHD_HTPUT_TUNABLES)
+       if (HTPUT_TOTAL_FLOW_RINGS > 0) {
+               dhdp->htput_flow_ring_start = max_normal_tx_flow_rings + FLOWID_RESERVED;
+               /* Construct a htput flowid allocator from htput_flow_ring_start to
+                * (htput_flow_ring_start + HTPUT_TOTAL_FLOW_RINGS - 1)
+                */
+               dhdp->htput_flowid_allocator = id16_map_init(dhdp->osh, HTPUT_TOTAL_FLOW_RINGS,
+                       dhdp->htput_flow_ring_start);
+               if (dhdp->htput_flowid_allocator == NULL) {
+                       DHD_ERROR(("%s: htput flowid allocator init failure\n", __FUNCTION__));
+                       return BCME_NOMEM;
+               }
+               dhdp->htput_client_flow_rings = 0u;
+       }
+#endif /* !DHD_HTPUT_TUNABLES */
+
+       return BCME_OK;
+}
+
+void
+dhd_flowid_map_deinit(dhd_pub_t *dhdp)
+{
+       if (dhdp->flowid_allocator) {
+               dhdp->flowid_allocator = id16_map_fini(dhdp->osh, dhdp->flowid_allocator);
+       }
+       ASSERT(dhdp->flowid_allocator == NULL);
+
+#if defined(DHD_HTPUT_TUNABLES)
+       if (dhdp->htput_flowid_allocator) {
+               dhdp->htput_flowid_allocator = id16_map_fini(dhdp->osh,
+                       dhdp->htput_flowid_allocator);
+               ASSERT(dhdp->htput_flowid_allocator == NULL);
+       }
+       dhdp->htput_client_flow_rings = 0u;
+#endif /* !DHD_HTPUT_TUNABLES */
+       return;
+}
+
+/** Initializes data structures of multiple flow rings
+ * num_h2d_rings - max_h2d_rings including static and dynamic rings
+ */
+int
+dhd_flow_rings_init(dhd_pub_t *dhdp, uint32 num_h2d_rings)
+{
+       uint32 idx;
+       uint32 flow_ring_table_sz = 0;
+       uint32 if_flow_lkup_sz = 0;
+       flow_ring_table_t *flow_ring_table = NULL;
+       if_flow_lkup_t *if_flow_lkup = NULL;
+       void *lock = NULL;
+       void *list_lock = NULL;
+       unsigned long flags;
+       uint16 max_tx_flow_rings;
+
+       DHD_INFO(("%s\n", __FUNCTION__));
+
+       /*
+        * Only 16-bit flowid map will be allocated for actual number of Tx flowrings
+        * excluding common rings.
+        * Rest all flowring data structure will be allocated for all num_h2d_rings.
+        */
+       max_tx_flow_rings = dhd_get_max_flow_rings(dhdp);
+       if (dhd_flowid_map_init(dhdp, max_tx_flow_rings) != BCME_OK) {
+               DHD_ERROR(("%s: dhd_flowid_map_init failure\n", __FUNCTION__));
+               goto fail;
+       }
+
+       /* Any Tx flow id should not be > max_tx_flowid */
+       dhdp->max_tx_flowid = max_tx_flow_rings + FLOWID_RESERVED - 1;
+
+       /* Allocate a flow ring table, comprising of requested number of rings */
+       flow_ring_table_sz = (num_h2d_rings * sizeof(flow_ring_node_t));
+       flow_ring_table = (flow_ring_table_t *)MALLOCZ(dhdp->osh, flow_ring_table_sz);
+       if (flow_ring_table == NULL) {
+               DHD_ERROR(("%s: flow ring table alloc failure\n", __FUNCTION__));
+               goto fail;
+       }
+
+       /* Initialize flow ring table state */
+       DHD_CUMM_CTR_INIT(&dhdp->cumm_ctr);
+       DHD_CUMM_CTR_INIT(&dhdp->l2cumm_ctr);
+       bzero((uchar *)flow_ring_table, flow_ring_table_sz);
+       for (idx = 0; idx < num_h2d_rings; idx++) {
+               flow_ring_table[idx].status = FLOW_RING_STATUS_CLOSED;
+               flow_ring_table[idx].flowid = (uint16)idx;
+               flow_ring_table[idx].lock = osl_spin_lock_init(dhdp->osh);
+#ifdef IDLE_TX_FLOW_MGMT
+               flow_ring_table[idx].last_active_ts = OSL_SYSUPTIME();
+#endif /* IDLE_TX_FLOW_MGMT */
+               if (flow_ring_table[idx].lock == NULL) {
+                       DHD_ERROR(("%s: Failed to init spinlock for queue!\n", __FUNCTION__));
+                       goto fail;
+               }
+
+               dll_init(&flow_ring_table[idx].list);
+
+               /* Initialize the per flow ring backup queue */
+               dhd_flow_queue_init(dhdp, &flow_ring_table[idx].queue,
+                                   FLOW_RING_QUEUE_THRESHOLD);
+       }
+
+       /* Allocate per interface hash table (for fast lookup from interface to flow ring) */
+       if_flow_lkup_sz = sizeof(if_flow_lkup_t) * DHD_MAX_IFS;
+       if_flow_lkup = (if_flow_lkup_t *)DHD_OS_PREALLOC(dhdp,
+               DHD_PREALLOC_IF_FLOW_LKUP, if_flow_lkup_sz);
+       if (if_flow_lkup == NULL) {
+               DHD_ERROR(("%s: if flow lkup alloc failure\n", __FUNCTION__));
+               goto fail;
+       }
+
+       /* Initialize per interface hash table */
+       for (idx = 0; idx < DHD_MAX_IFS; idx++) {
+               int hash_ix;
+               if_flow_lkup[idx].status = 0;
+               if_flow_lkup[idx].role = 0;
+               for (hash_ix = 0; hash_ix < DHD_FLOWRING_HASH_SIZE; hash_ix++)
+                       if_flow_lkup[idx].fl_hash[hash_ix] = NULL;
+       }
+
+       lock = osl_spin_lock_init(dhdp->osh);
+       if (lock == NULL)
+               goto fail;
+
+       list_lock = osl_spin_lock_init(dhdp->osh);
+       if (list_lock == NULL)
+               goto lock_fail;
+
+       dhdp->flow_prio_map_type = DHD_FLOW_PRIO_AC_MAP;
+       bcopy(prio2ac, dhdp->flow_prio_map, sizeof(uint8) * NUMPRIO);
+
+       dhdp->max_multi_client_flow_rings = dhd_get_max_multi_client_flow_rings(dhdp);
+       dhdp->multi_client_flow_rings = 0U;
+
+#ifdef DHD_LOSSLESS_ROAMING
+       dhdp->dequeue_prec_map = ALLPRIO;
+#endif
+       /* Now populate into dhd pub */
+       DHD_FLOWID_LOCK(lock, flags);
+       dhdp->num_h2d_rings = num_h2d_rings;
+       dhdp->flow_ring_table = (void *)flow_ring_table;
+       dhdp->if_flow_lkup = (void *)if_flow_lkup;
+       dhdp->flowid_lock = lock;
+       dhdp->flow_rings_inited = TRUE;
+       dhdp->flowring_list_lock = list_lock;
+       DHD_FLOWID_UNLOCK(lock, flags);
+
+       DHD_INFO(("%s done\n", __FUNCTION__));
+       return BCME_OK;
+
+lock_fail:
+       /* deinit the spinlock */
+       osl_spin_lock_deinit(dhdp->osh, lock);
+
+fail:
+       /* Destruct the per interface flow lkup table */
+       if (if_flow_lkup != NULL) {
+               DHD_OS_PREFREE(dhdp, if_flow_lkup, if_flow_lkup_sz);
+       }
+       if (flow_ring_table != NULL) {
+               for (idx = 0; idx < num_h2d_rings; idx++) {
+                       if (flow_ring_table[idx].lock != NULL)
+                               osl_spin_lock_deinit(dhdp->osh, flow_ring_table[idx].lock);
+               }
+               MFREE(dhdp->osh, flow_ring_table, flow_ring_table_sz);
+       }
+       dhd_flowid_map_deinit(dhdp);
+
+       return BCME_NOMEM;
+}
+
+/** Deinit Flow Ring specific data structures */
+void dhd_flow_rings_deinit(dhd_pub_t *dhdp)
+{
+       uint16 idx;
+       uint32 flow_ring_table_sz;
+       uint32 if_flow_lkup_sz;
+       flow_ring_table_t *flow_ring_table;
+       unsigned long flags;
+       void *lock;
+
+       DHD_INFO(("dhd_flow_rings_deinit\n"));
+
+       if (!(dhdp->flow_rings_inited)) {
+               DHD_ERROR(("dhd_flow_rings not initialized!\n"));
+               return;
+       }
+
+       if (dhdp->flow_ring_table != NULL) {
+
+               ASSERT(dhdp->num_h2d_rings > 0);
+
+               DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+               flow_ring_table = (flow_ring_table_t *)dhdp->flow_ring_table;
+               dhdp->flow_ring_table = NULL;
+               DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+               for (idx = 0; idx < dhdp->num_h2d_rings; idx++) {
+                       if (flow_ring_table[idx].active) {
+                               dhd_bus_clean_flow_ring(dhdp->bus, &flow_ring_table[idx]);
+                       }
+                       ASSERT(DHD_FLOW_QUEUE_EMPTY(&flow_ring_table[idx].queue));
+
+                       /* Deinit flow ring queue locks before destroying flow ring table */
+                       if (flow_ring_table[idx].lock != NULL) {
+                               osl_spin_lock_deinit(dhdp->osh, flow_ring_table[idx].lock);
+                       }
+                       flow_ring_table[idx].lock = NULL;
+
+               }
+
+               /* Destruct the flow ring table */
+               flow_ring_table_sz = dhdp->num_h2d_rings * sizeof(flow_ring_table_t);
+               MFREE(dhdp->osh, flow_ring_table, flow_ring_table_sz);
+       }
+
+       DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+
+       /* Destruct the per interface flow lkup table */
+       if (dhdp->if_flow_lkup != NULL) {
+               if_flow_lkup_sz = sizeof(if_flow_lkup_t) * DHD_MAX_IFS;
+               bzero((uchar *)dhdp->if_flow_lkup, if_flow_lkup_sz);
+               DHD_OS_PREFREE(dhdp, dhdp->if_flow_lkup, if_flow_lkup_sz);
+               dhdp->if_flow_lkup = NULL;
+       }
+
+       /* Destruct the flowid allocator */
+       dhd_flowid_map_deinit(dhdp);
+
+       dhdp->num_h2d_rings = 0U;
+       bzero(dhdp->flow_prio_map, sizeof(uint8) * NUMPRIO);
+
+       dhdp->max_multi_client_flow_rings = 0U;
+       dhdp->multi_client_flow_rings = 0U;
+
+       lock = dhdp->flowid_lock;
+       dhdp->flowid_lock = NULL;
+
+       if (lock) {
+               DHD_FLOWID_UNLOCK(lock, flags);
+               osl_spin_lock_deinit(dhdp->osh, lock);
+       }
+
+       osl_spin_lock_deinit(dhdp->osh, dhdp->flowring_list_lock);
+       dhdp->flowring_list_lock = NULL;
+
+       ASSERT(dhdp->if_flow_lkup == NULL);
+       ASSERT(dhdp->flow_ring_table == NULL);
+       dhdp->flow_rings_inited = FALSE;
+}
+
+/** Uses hash table to quickly map from ifindex to a flow ring 'role' (STA/AP) */
+uint8
+dhd_flow_rings_ifindex2role(dhd_pub_t *dhdp, uint8 ifindex)
+{
+       if_flow_lkup_t *if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+       ASSERT(if_flow_lkup);
+       return if_flow_lkup[ifindex].role;
+}
+
+#ifdef WLTDLS
+bool is_tdls_destination(dhd_pub_t *dhdp, uint8 *da)
+{
+       unsigned long flags;
+       tdls_peer_node_t *cur = NULL;
+
+       DHD_TDLS_LOCK(&dhdp->tdls_lock, flags);
+       cur = dhdp->peer_tbl.node;
+
+       while (cur != NULL) {
+               if (!memcmp(da, cur->addr, ETHER_ADDR_LEN)) {
+                       DHD_TDLS_UNLOCK(&dhdp->tdls_lock, flags);
+                       return TRUE;
+               }
+               cur = cur->next;
+       }
+       DHD_TDLS_UNLOCK(&dhdp->tdls_lock, flags);
+       return FALSE;
+}
+#endif /* WLTDLS */
+
+/** Uses hash table to quickly map from ifindex+prio+da to a flow ring id */
+static INLINE uint16
+dhd_flowid_find(dhd_pub_t *dhdp, uint8 ifindex, uint8 prio, char *sa, char *da)
+{
+       int hash;
+       bool ismcast = FALSE;
+       flow_hash_info_t *cur;
+       if_flow_lkup_t *if_flow_lkup;
+       unsigned long flags;
+
+       ASSERT(ifindex < DHD_MAX_IFS);
+       if (ifindex >= DHD_MAX_IFS)
+               return FLOWID_INVALID;
+
+       DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+       if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+       ASSERT(if_flow_lkup);
+
+       if (DHD_IF_ROLE_GENERIC_STA(dhdp, ifindex)) {
+#ifdef WLTDLS
+               if (dhdp->peer_tbl.tdls_peer_count && !(ETHER_ISMULTI(da)) &&
+                       is_tdls_destination(dhdp, da)) {
+                       hash = DHD_FLOWRING_HASHINDEX(da, prio);
+                       cur = if_flow_lkup[ifindex].fl_hash[hash];
+                       while (cur != NULL) {
+                               if (!memcmp(cur->flow_info.da, da, ETHER_ADDR_LEN)) {
+                                       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+                                       return cur->flowid;
+                               }
+                               cur = cur->next;
+                       }
+                       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+                       return FLOWID_INVALID;
+               }
+#endif /* WLTDLS */
+               /* For STA non TDLS dest and WDS dest flow ring id is mapped based on prio only */
+               cur = if_flow_lkup[ifindex].fl_hash[prio];
+               if (cur) {
+                       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+                       return cur->flowid;
+               }
+       } else {
+
+               if (ETHER_ISMULTI(da)) {
+                       ismcast = TRUE;
+                       hash = 0;
+               } else {
+                       hash = DHD_FLOWRING_HASHINDEX(da, prio);
+               }
+
+               cur = if_flow_lkup[ifindex].fl_hash[hash];
+
+               while (cur) {
+                       if ((ismcast && ETHER_ISMULTI(cur->flow_info.da)) ||
+                               (!memcmp(cur->flow_info.da, da, ETHER_ADDR_LEN) &&
+                               (cur->flow_info.tid == prio))) {
+                               DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+                               return cur->flowid;
+                       }
+                       cur = cur->next;
+               }
+       }
+       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+
+       DHD_INFO(("%s: cannot find flowid\n", __FUNCTION__));
+       return FLOWID_INVALID;
+} /* dhd_flowid_find */
+
+static uint16
+dhd_flowid_map_alloc(dhd_pub_t *dhdp, uint8 ifindex, uint8 prio)
+{
+       uint16 flowid = FLOWID_INVALID;
+       ASSERT(dhdp->flowid_allocator != NULL);
+
+#if defined(DHD_HTPUT_TUNABLES)
+       if (dhdp->htput_flowid_allocator) {
+               if (prio == HTPUT_FLOW_RING_PRIO) {
+                       if (DHD_IF_ROLE_GENERIC_STA(dhdp, ifindex)) {
+                               /* For STA case, only one flowring per PRIO is created,
+                                * so no need to have a HTPUT counter variable for STA case.
+                                * If already HTPUT flowring is allocated for given HTPUT_PRIO,
+                                * then this function will not even get called as dhd_flowid_find
+                                * will take care assigning same for those HTPUT_PRIO packets.
+                                */
+                               flowid = id16_map_alloc(dhdp->htput_flowid_allocator);
+                       } else if (DHD_IF_ROLE_MULTI_CLIENT(dhdp, ifindex)) {
+                               /* Use HTPUT flowrings for only HTPUT_NUM_CLIENT_FLOW_RINGS */
+                               if (dhdp->htput_client_flow_rings < HTPUT_NUM_CLIENT_FLOW_RINGS) {
+                                       flowid = id16_map_alloc(dhdp->htput_flowid_allocator);
+                                       /* increment htput client counter */
+                                       if (flowid != FLOWID_INVALID) {
+                                               dhdp->htput_client_flow_rings++;
+                                       }
+                               }
+                       }
+               }
+       }
+#endif /* !DHD_HTPUT_TUNABLES */
+
+       BCM_REFERENCE(flowid);
+
+       /*
+        * For HTPUT case, if the high throughput flowrings are already allocated
+        * for the given role, the control comes here.
+        */
+       if (flowid == FLOWID_INVALID) {
+               flowid = id16_map_alloc(dhdp->flowid_allocator);
+       }
+
+       return flowid;
+}
+
+/** Create unique Flow ID, called when a flow ring is created. */
+static INLINE uint16
+dhd_flowid_alloc(dhd_pub_t *dhdp, uint8 ifindex, uint8 prio, char *sa, char *da)
+{
+       flow_hash_info_t *fl_hash_node, *cur;
+       if_flow_lkup_t *if_flow_lkup;
+       int hash;
+       uint16 flowid;
+       unsigned long flags;
+
+       fl_hash_node = (flow_hash_info_t *) MALLOCZ(dhdp->osh, sizeof(flow_hash_info_t));
+       if (fl_hash_node == NULL) {
+               DHD_ERROR(("%s: flow_hash_info_t memory allocation failed \n", __FUNCTION__));
+               return FLOWID_INVALID;
+       }
+       memcpy(fl_hash_node->flow_info.da, da, sizeof(fl_hash_node->flow_info.da));
+
+       DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+       flowid = dhd_flowid_map_alloc(dhdp, ifindex, prio);
+       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+
+       if (flowid == FLOWID_INVALID) {
+               MFREE(dhdp->osh, fl_hash_node,  sizeof(flow_hash_info_t));
+               DHD_ERROR_RLMT(("%s: cannot get free flowid \n", __FUNCTION__));
+               return FLOWID_INVALID;
+       }
+
+       fl_hash_node->flowid = flowid;
+       fl_hash_node->flow_info.tid = prio;
+       fl_hash_node->flow_info.ifindex = ifindex;
+       fl_hash_node->next = NULL;
+
+       DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+       if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+       if (DHD_IF_ROLE_GENERIC_STA(dhdp, ifindex)) {
+               /* For STA/GC non TDLS dest and WDS dest we allocate entry based on prio only */
+#ifdef WLTDLS
+               if (dhdp->peer_tbl.tdls_peer_count &&
+                       (is_tdls_destination(dhdp, da))) {
+                       hash = DHD_FLOWRING_HASHINDEX(da, prio);
+                       cur = if_flow_lkup[ifindex].fl_hash[hash];
+                       if (cur) {
+                               while (cur->next) {
+                                       cur = cur->next;
+                               }
+                               cur->next = fl_hash_node;
+                       } else {
+                               if_flow_lkup[ifindex].fl_hash[hash] = fl_hash_node;
+                       }
+               } else
+#endif /* WLTDLS */
+                       if_flow_lkup[ifindex].fl_hash[prio] = fl_hash_node;
+       } else {
+
+               /* For bcast/mcast assign first slot in in interface */
+               hash = ETHER_ISMULTI(da) ? 0 : DHD_FLOWRING_HASHINDEX(da, prio);
+               cur = if_flow_lkup[ifindex].fl_hash[hash];
+               if (cur) {
+                       while (cur->next) {
+                               cur = cur->next;
+                       }
+                       cur->next = fl_hash_node;
+               } else
+                       if_flow_lkup[ifindex].fl_hash[hash] = fl_hash_node;
+       }
+       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+
+       DHD_INFO(("%s: allocated flowid %d\n", __FUNCTION__, fl_hash_node->flowid));
+
+       if (fl_hash_node->flowid > dhdp->max_tx_flowid) {
+               DHD_ERROR(("%s: flowid=%d max_tx_flowid=%d ifindex=%d prio=%d role=%d\n",
+                       __FUNCTION__, fl_hash_node->flowid, dhdp->max_tx_flowid,
+                       ifindex, prio, if_flow_lkup[ifindex].role));
+               dhd_prhex("da", (uchar *)da, ETHER_ADDR_LEN, DHD_ERROR_VAL);
+               dhd_prhex("sa", (uchar *)sa, ETHER_ADDR_LEN, DHD_ERROR_VAL);
+               return FLOWID_INVALID;
+       }
+
+       return fl_hash_node->flowid;
+} /* dhd_flowid_alloc */
+
+/** Get flow ring ID, if not present try to create one */
+static INLINE int
+dhd_flowid_lookup(dhd_pub_t *dhdp, uint8 ifindex,
+                  uint8 prio, char *sa, char *da, uint16 *flowid)
+{
+       uint16 id;
+       flow_ring_node_t *flow_ring_node;
+       flow_ring_table_t *flow_ring_table;
+       unsigned long flags;
+       int ret;
+
+       DHD_TRACE(("%s\n", __FUNCTION__));
+
+       if (!dhdp->flow_ring_table) {
+               return BCME_ERROR;
+       }
+
+       ASSERT(ifindex < DHD_MAX_IFS);
+       if (ifindex >= DHD_MAX_IFS)
+               return BCME_BADARG;
+
+       flow_ring_table = (flow_ring_table_t *)dhdp->flow_ring_table;
+
+       id = dhd_flowid_find(dhdp, ifindex, prio, sa, da);
+
+       if (id == FLOWID_INVALID) {
+               bool if_role_multi_client;
+               if_flow_lkup_t *if_flow_lkup;
+               if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+               if (!if_flow_lkup[ifindex].status)
+                       return BCME_ERROR;
+
+               /* check role for multi client case */
+               if_role_multi_client = DHD_IF_ROLE_MULTI_CLIENT(dhdp, ifindex);
+
+               /* Abort Flowring creation if multi client flowrings crossed the threshold */
+#ifdef DHD_LIMIT_MULTI_CLIENT_FLOWRINGS
+               if (if_role_multi_client &&
+                       (dhdp->multi_client_flow_rings >= dhdp->max_multi_client_flow_rings)) {
+                       DHD_ERROR_RLMT(("%s: Max multi client flow rings reached: %d:%d\n",
+                               __FUNCTION__, dhdp->multi_client_flow_rings,
+                               dhdp->max_multi_client_flow_rings));
+                       return BCME_ERROR;
+               }
+#endif /* DHD_LIMIT_MULTI_CLIENT_FLOWRINGS */
+
+               /* Do not create Flowring if peer is not associated */
+#if defined(PCIE_FULL_DONGLE)
+               if (if_role_multi_client && !ETHER_ISMULTI(da) &&
+                       !dhd_sta_associated(dhdp, ifindex, (uint8 *)da)) {
+                       DHD_ERROR_RLMT(("%s: Skip send pkt without peer addition\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+#endif /* (linux || LINUX) && PCIE_FULL_DONGLE */
+
+               id = dhd_flowid_alloc(dhdp, ifindex, prio, sa, da);
+               if (id == FLOWID_INVALID) {
+                       DHD_ERROR_RLMT(("%s: alloc flowid ifindex %u status %u\n",
+                               __FUNCTION__, ifindex, if_flow_lkup[ifindex].status));
+                       return BCME_ERROR;
+               }
+
+               ASSERT(id <= dhdp->max_tx_flowid);
+
+               /* Only after flowid alloc, increment multi_client_flow_rings */
+               if (if_role_multi_client) {
+                       dhdp->multi_client_flow_rings++;
+               }
+
+               /* register this flowid in dhd_pub */
+               dhd_add_flowid(dhdp, ifindex, prio, da, id);
+
+               flow_ring_node = (flow_ring_node_t *) &flow_ring_table[id];
+
+               DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+               /* Init Flow info */
+               memcpy(flow_ring_node->flow_info.sa, sa, sizeof(flow_ring_node->flow_info.sa));
+               memcpy(flow_ring_node->flow_info.da, da, sizeof(flow_ring_node->flow_info.da));
+               flow_ring_node->flow_info.tid = prio;
+               flow_ring_node->flow_info.ifindex = ifindex;
+               flow_ring_node->active = TRUE;
+               flow_ring_node->status = FLOW_RING_STATUS_CREATE_PENDING;
+
+#ifdef TX_STATUS_LATENCY_STATS
+               flow_ring_node->flow_info.num_tx_status = 0;
+               flow_ring_node->flow_info.cum_tx_status_latency = 0;
+               flow_ring_node->flow_info.num_tx_pkts = 0;
+#endif /* TX_STATUS_LATENCY_STATS */
+               DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+               /* Create and inform device about the new flow */
+               if (dhd_bus_flow_ring_create_request(dhdp->bus, (void *)flow_ring_node)
+                               != BCME_OK) {
+                       DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+                       flow_ring_node->status = FLOW_RING_STATUS_CLOSED;
+                       flow_ring_node->active = FALSE;
+                       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+                       DHD_ERROR(("%s: create error %d\n", __FUNCTION__, id));
+                       return BCME_ERROR;
+               }
+
+               *flowid = id;
+               return BCME_OK;
+       } else {
+               /* if the Flow id was found in the hash */
+
+               if (id > dhdp->max_tx_flowid) {
+                       DHD_ERROR(("%s: Invalid flow id : %u, max_tx_flowid : %u\n",
+                               __FUNCTION__, id, dhdp->max_tx_flowid));
+                       *flowid = FLOWID_INVALID;
+                       ASSERT(0);
+                       return BCME_ERROR;
+               }
+
+               flow_ring_node = (flow_ring_node_t *) &flow_ring_table[id];
+               DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+               /*
+                * If the flow_ring_node is in Open State or Status pending state then
+                * we can return the Flow id to the caller.If the flow_ring_node is in
+                * FLOW_RING_STATUS_PENDING this means the creation is in progress and
+                * hence the packets should be queued.
+                *
+                * If the flow_ring_node is in FLOW_RING_STATUS_DELETE_PENDING Or
+                * FLOW_RING_STATUS_CLOSED, then we should return Error.
+                * Note that if the flowing is being deleted we would mark it as
+                * FLOW_RING_STATUS_DELETE_PENDING.  Now before Dongle could respond and
+                * before we mark it as FLOW_RING_STATUS_CLOSED we could get tx packets.
+                * We should drop the packets in that case.
+                * The decission to return OK should NOT be based on 'active' variable, beause
+                * active is made TRUE when a flow_ring_node gets allocated and is made
+                * FALSE when the flow ring gets removed and does not reflect the True state
+                * of the Flow ring.
+                * In case if IDLE_TX_FLOW_MGMT is defined, we have to handle two more flowring
+                * states. If the flow_ring_node's status is FLOW_RING_STATUS_SUSPENDED, the flowid
+                * is to be returned and from dhd_bus_txdata, the flowring would be resumed again.
+                * The status FLOW_RING_STATUS_RESUME_PENDING, is equivalent to
+                * FLOW_RING_STATUS_CREATE_PENDING.
+                */
+               if (flow_ring_node->status == FLOW_RING_STATUS_DELETE_PENDING ||
+                       flow_ring_node->status == FLOW_RING_STATUS_CLOSED) {
+                       *flowid = FLOWID_INVALID;
+                       ret = BCME_ERROR;
+               } else {
+                       *flowid = id;
+                       ret = BCME_OK;
+               }
+
+               DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+               return ret;
+       } /* Flow Id found in the hash */
+} /* dhd_flowid_lookup */
+
+int
+dhd_flowid_find_by_ifidx(dhd_pub_t *dhdp, uint8 ifindex, uint16 flowid)
+{
+       int hashidx = 0;
+       bool found = FALSE;
+       flow_hash_info_t *cur;
+       if_flow_lkup_t *if_flow_lkup;
+       unsigned long flags;
+
+       if (!dhdp->flow_ring_table) {
+               DHD_ERROR(("%s : dhd->flow_ring_table is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+       if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+       for (hashidx = 0; hashidx < DHD_FLOWRING_HASH_SIZE; hashidx++) {
+               cur = if_flow_lkup[ifindex].fl_hash[hashidx];
+               if (cur) {
+                       if (cur->flowid == flowid) {
+                               found = TRUE;
+                       }
+
+                       while (!found && cur) {
+                               if (cur->flowid == flowid) {
+                                       found = TRUE;
+                                       break;
+                               }
+                               cur = cur->next;
+                       }
+
+                       if (found) {
+                               DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+                               return BCME_OK;
+                       }
+               }
+       }
+       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+
+       return BCME_ERROR;
+}
+
+int
+dhd_flowid_debug_create(dhd_pub_t *dhdp, uint8 ifindex,
+       uint8 prio, char *sa, char *da, uint16 *flowid)
+{
+       return dhd_flowid_lookup(dhdp, ifindex, prio, sa, da, flowid);
+}
+
+/**
+ * Assign existing or newly created flowid to an 802.3 packet. This flowid is later on used to
+ * select the flowring to send the packet to the dongle.
+ */
+int
+BCMFASTPATH(dhd_flowid_update)(dhd_pub_t *dhdp, uint8 ifindex, uint8 prio, void *pktbuf)
+{
+       uint8 *pktdata = (uint8 *)PKTDATA(dhdp->osh, pktbuf);
+       struct ether_header *eh = (struct ether_header *)pktdata;
+       uint16 flowid = 0;
+
+       ASSERT(ifindex < DHD_MAX_IFS);
+
+       if (ifindex >= DHD_MAX_IFS) {
+               return BCME_BADARG;
+       }
+
+       if (!dhdp->flowid_allocator) {
+               DHD_ERROR(("%s: Flow ring not intited yet  \n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (dhd_flowid_lookup(dhdp, ifindex, prio, (char *)eh->ether_shost, (char *)eh->ether_dhost,
+               &flowid) != BCME_OK) {
+               return BCME_ERROR;
+       }
+
+       DHD_INFO(("%s: prio %d flowid %d\n", __FUNCTION__, prio, flowid));
+
+       /* Tag the packet with flowid */
+       DHD_PKT_SET_FLOWID(pktbuf, flowid);
+       return BCME_OK;
+}
+
+static void
+dhd_flowid_map_free(dhd_pub_t *dhdp, uint8 ifindex, uint16 flowid)
+{
+#if defined(DHD_HTPUT_TUNABLES)
+       if (dhdp->htput_flowid_allocator) {
+               if (DHD_IS_FLOWID_HTPUT(dhdp, flowid)) {
+                       id16_map_free(dhdp->htput_flowid_allocator, flowid);
+                       /* decrement htput client counter */
+                       if (DHD_IF_ROLE_MULTI_CLIENT(dhdp, ifindex)) {
+                               dhdp->htput_client_flow_rings--;
+                       }
+                       return;
+               }
+       }
+#endif /* !DHD_HTPUT_TUNABLES */
+
+       id16_map_free(dhdp->flowid_allocator, flowid);
+
+       return;
+}
+
+void
+dhd_flowid_free(dhd_pub_t *dhdp, uint8 ifindex, uint16 flowid)
+{
+       int hashix;
+       bool found = FALSE;
+       flow_hash_info_t *cur, *prev;
+       if_flow_lkup_t *if_flow_lkup;
+       unsigned long flags;
+       bool if_role_multi_client;
+
+       ASSERT(ifindex < DHD_MAX_IFS);
+       if (ifindex >= DHD_MAX_IFS)
+               return;
+
+       DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+       if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+       if_role_multi_client = DHD_IF_ROLE_MULTI_CLIENT(dhdp, ifindex);
+
+       for (hashix = 0; hashix < DHD_FLOWRING_HASH_SIZE; hashix++) {
+
+               cur = if_flow_lkup[ifindex].fl_hash[hashix];
+
+               if (cur) {
+                       if (cur->flowid == flowid) {
+                               found = TRUE;
+                       }
+
+                       prev = NULL;
+                       while (!found && cur) {
+                               if (cur->flowid == flowid) {
+                                       found = TRUE;
+                                       break;
+                               }
+                               prev = cur;
+                               cur = cur->next;
+                       }
+                       if (found) {
+                               if (!prev) {
+                                       if_flow_lkup[ifindex].fl_hash[hashix] = cur->next;
+                               } else {
+                                       prev->next = cur->next;
+                               }
+
+                               /* Decrement multi_client_flow_rings */
+                               if (if_role_multi_client) {
+                                       dhdp->multi_client_flow_rings--;
+                               }
+
+                               /* deregister flowid from dhd_pub. */
+                               dhd_del_flowid(dhdp, ifindex, flowid);
+
+                               dhd_flowid_map_free(dhdp, ifindex, flowid);
+                               DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+                               MFREE(dhdp->osh, cur, sizeof(flow_hash_info_t));
+
+                               return;
+                       }
+               }
+       }
+
+       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+       DHD_ERROR(("%s: could not free flow ring hash entry flowid %d\n",
+                  __FUNCTION__, flowid));
+} /* dhd_flowid_free */
+
+/**
+ * Delete all Flow rings associated with the given interface. Is called when eg the dongle
+ * indicates that a wireless link has gone down.
+ */
+void
+dhd_flow_rings_delete(dhd_pub_t *dhdp, uint8 ifindex)
+{
+       uint32 id;
+       flow_ring_table_t *flow_ring_table;
+
+       DHD_ERROR(("%s: ifindex %u\n", __FUNCTION__, ifindex));
+
+       ASSERT(ifindex < DHD_MAX_IFS);
+       if (ifindex >= DHD_MAX_IFS)
+               return;
+
+       if (!dhdp->flow_ring_table)
+               return;
+
+       flow_ring_table = (flow_ring_table_t *)dhdp->flow_ring_table;
+       for (id = 0; id < dhdp->num_h2d_rings; id++) {
+               if (flow_ring_table[id].active &&
+                       (flow_ring_table[id].flow_info.ifindex == ifindex) &&
+                       (flow_ring_table[id].status == FLOW_RING_STATUS_OPEN)) {
+                       dhd_bus_flow_ring_delete_request(dhdp->bus,
+                                                        (void *) &flow_ring_table[id]);
+               }
+       }
+}
+
+void
+dhd_flow_rings_flush(dhd_pub_t *dhdp, uint8 ifindex)
+{
+       uint32 id;
+       flow_ring_table_t *flow_ring_table;
+
+       DHD_INFO(("%s: ifindex %u\n", __FUNCTION__, ifindex));
+
+       ASSERT(ifindex < DHD_MAX_IFS);
+       if (ifindex >= DHD_MAX_IFS)
+               return;
+
+       if (!dhdp->flow_ring_table)
+               return;
+       flow_ring_table = (flow_ring_table_t *)dhdp->flow_ring_table;
+
+       for (id = 0; id < dhdp->num_h2d_rings; id++) {
+               if (flow_ring_table[id].active &&
+                       (flow_ring_table[id].flow_info.ifindex == ifindex) &&
+                       (flow_ring_table[id].status == FLOW_RING_STATUS_OPEN)) {
+                       dhd_bus_flow_ring_flush_request(dhdp->bus,
+                                                        (void *) &flow_ring_table[id]);
+               }
+       }
+}
+
+/** Delete flow ring(s) for given peer address. */
+void
+dhd_flow_rings_delete_for_peer(dhd_pub_t *dhdp, uint8 ifindex, char *addr)
+{
+       uint32 id;
+       flow_ring_table_t *flow_ring_table;
+
+       DHD_ERROR(("%s: ifindex %u\n", __FUNCTION__, ifindex));
+
+       ASSERT(ifindex < DHD_MAX_IFS);
+       if (ifindex >= DHD_MAX_IFS)
+               return;
+
+       if (!dhdp->flow_ring_table)
+               return;
+
+       flow_ring_table = (flow_ring_table_t *)dhdp->flow_ring_table;
+       for (id = 0; id < dhdp->num_h2d_rings; id++) {
+               /*
+                * Send flowring delete request even if flowring status is
+                * FLOW_RING_STATUS_CREATE_PENDING, to handle cases where DISASSOC_IND
+                * event comes ahead of flowring create response.
+                * Otherwise the flowring will not be deleted later as there will not be any
+                * DISASSOC_IND event. With this change, when create response event comes to DHD,
+                * it will change the status to FLOW_RING_STATUS_OPEN and soon delete response
+                * event will come, upon which DHD will delete the flowring.
+                */
+               if (flow_ring_table[id].active &&
+                       (flow_ring_table[id].flow_info.ifindex == ifindex) &&
+                       (!memcmp(flow_ring_table[id].flow_info.da, addr, ETHER_ADDR_LEN)) &&
+                       ((flow_ring_table[id].status == FLOW_RING_STATUS_OPEN) ||
+                       (flow_ring_table[id].status == FLOW_RING_STATUS_CREATE_PENDING))) {
+                       DHD_ERROR(("%s: deleting flowid %d\n",
+                               __FUNCTION__, flow_ring_table[id].flowid));
+                       dhd_bus_flow_ring_delete_request(dhdp->bus,
+                               (void *) &flow_ring_table[id]);
+               }
+       }
+}
+
+/** Handles interface ADD, CHANGE, DEL indications from the dongle */
+void
+dhd_update_interface_flow_info(dhd_pub_t *dhdp, uint8 ifindex,
+                               uint8 op, uint8 role)
+{
+       if_flow_lkup_t *if_flow_lkup;
+       unsigned long flags;
+
+       ASSERT(ifindex < DHD_MAX_IFS);
+       if (ifindex >= DHD_MAX_IFS)
+               return;
+
+       DHD_INFO(("%s: ifindex %u op %u role is %u \n",
+                 __FUNCTION__, ifindex, op, role));
+       if (!dhdp->flowid_allocator) {
+               DHD_ERROR(("%s: Flow ring not intited yet  \n", __FUNCTION__));
+               return;
+       }
+
+       DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+       if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+       if (op == WLC_E_IF_ADD || op == WLC_E_IF_CHANGE) {
+
+               if_flow_lkup[ifindex].role = role;
+
+               if (role == WLC_E_IF_ROLE_WDS) {
+                       /**
+                        * WDS role does not send WLC_E_LINK event after interface is up.
+                        * So to create flowrings for WDS, make status as TRUE in WLC_E_IF itself.
+                        * same is true while making the status as FALSE.
+                        * TODO: Fix FW to send WLC_E_LINK for WDS role aswell. So that all the
+                        * interfaces are handled uniformly.
+                        */
+                       if_flow_lkup[ifindex].status = TRUE;
+                       DHD_INFO(("%s: Mcast Flow ring for ifindex %d role is %d \n",
+                                 __FUNCTION__, ifindex, role));
+               }
+       } else  if ((op == WLC_E_IF_DEL) && (role == WLC_E_IF_ROLE_WDS)) {
+               if_flow_lkup[ifindex].status = FALSE;
+               DHD_INFO(("%s: cleanup all Flow rings for ifindex %d role is %d \n",
+                         __FUNCTION__, ifindex, role));
+       }
+       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+}
+
+/** Handles a STA 'link' indication from the dongle */
+int
+dhd_update_interface_link_status(dhd_pub_t *dhdp, uint8 ifindex, uint8 status)
+{
+       if_flow_lkup_t *if_flow_lkup;
+       unsigned long flags;
+
+       ASSERT(ifindex < DHD_MAX_IFS);
+       if (ifindex >= DHD_MAX_IFS)
+               return BCME_BADARG;
+
+       DHD_INFO(("%s: ifindex %d status %d\n", __FUNCTION__, ifindex, status));
+
+       DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+       if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+       if (status) {
+               if_flow_lkup[ifindex].status = TRUE;
+       } else {
+               if_flow_lkup[ifindex].status = FALSE;
+       }
+
+       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+
+       return BCME_OK;
+}
+
+/** Update flow priority mapping, called on IOVAR */
+int dhd_update_flow_prio_map(dhd_pub_t *dhdp, uint8 map)
+{
+       uint16 flowid;
+       flow_ring_node_t *flow_ring_node;
+
+       if (map > DHD_FLOW_PRIO_LLR_MAP)
+               return BCME_BADOPTION;
+
+       /* Check if we need to change prio map */
+       if (map == dhdp->flow_prio_map_type)
+               return BCME_OK;
+
+       /* If any ring is active we cannot change priority mapping for flow rings */
+       for (flowid = 0; flowid < dhdp->num_h2d_rings; flowid++) {
+               flow_ring_node = DHD_FLOW_RING(dhdp, flowid);
+               if (flow_ring_node->active)
+                       return BCME_EPERM;
+       }
+
+       /* Inform firmware about new mapping type */
+       if (BCME_OK != dhd_flow_prio_map(dhdp, &map, TRUE))
+               return BCME_ERROR;
+
+       /* update internal structures */
+       dhdp->flow_prio_map_type = map;
+       if (dhdp->flow_prio_map_type == DHD_FLOW_PRIO_TID_MAP)
+               bcopy(prio2tid, dhdp->flow_prio_map, sizeof(uint8) * NUMPRIO);
+       else
+               bcopy(prio2ac, dhdp->flow_prio_map, sizeof(uint8) * NUMPRIO);
+
+       dhdp->max_multi_client_flow_rings = dhd_get_max_multi_client_flow_rings(dhdp);
+
+       return BCME_OK;
+}
+
+/** Inform firmware on updated flow priority mapping, called on IOVAR */
+int dhd_flow_prio_map(dhd_pub_t *dhd, uint8 *map, bool set)
+{
+       uint8 iovbuf[WLC_IOCTL_SMLEN];
+       int len;
+       if (!set) {
+               bzero(&iovbuf, sizeof(iovbuf));
+               len = bcm_mkiovar("bus:fl_prio_map", NULL, 0, (char*)iovbuf, sizeof(iovbuf));
+               if (len == 0) {
+                       return BCME_BUFTOOSHORT;
+               }
+               if (dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0) < 0) {
+                       DHD_ERROR(("%s: failed to get fl_prio_map\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+               *map = iovbuf[0];
+               return BCME_OK;
+       }
+       len = bcm_mkiovar("bus:fl_prio_map", (char *)map, sizeof(uint8),
+               (char*)iovbuf, sizeof(iovbuf));
+       if (len == 0) {
+               return BCME_BUFTOOSHORT;
+       }
+       if (dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, len, TRUE, 0) < 0) {
+               DHD_ERROR(("%s: failed to set fl_prio_map \n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+       }
+       return BCME_OK;
+}
+
+uint32
+dhd_active_tx_flowring_bkpq_len(dhd_pub_t *dhd)
+{
+       unsigned long list_lock_flags;
+       dll_t *item, *prev;
+       flow_ring_node_t *flow_ring_node;
+       dhd_bus_t *bus = dhd->bus;
+       uint32 active_tx_flowring_qlen = 0;
+
+       DHD_FLOWRING_LIST_LOCK(bus->dhd->flowring_list_lock, list_lock_flags);
+
+       for (item = dll_tail_p(&bus->flowring_active_list);
+                       !dll_end(&bus->flowring_active_list, item); item = prev) {
+
+               prev = dll_prev_p(item);
+
+               flow_ring_node = dhd_constlist_to_flowring(item);
+               if (flow_ring_node->active) {
+                       DHD_INFO(("%s :%d\n", __FUNCTION__, flow_ring_node->queue.len));
+                       active_tx_flowring_qlen += flow_ring_node->queue.len;
+               }
+       }
+       DHD_FLOWRING_LIST_UNLOCK(bus->dhd->flowring_list_lock, list_lock_flags);
+       return active_tx_flowring_qlen;
+}
diff --git a/bcmdhd.101.10.240.x/dhd_flowring.h b/bcmdhd.101.10.240.x/dhd_flowring.h
new file mode 100644 (file)
index 0000000..3457d14
--- /dev/null
@@ -0,0 +1,315 @@
+/*
+ * @file Header file describing the flow rings DHD interfaces.
+ *
+ * Flow rings are transmit traffic (=propagating towards antenna) related entities.
+ *
+ * Provides type definitions and function prototypes used to create, delete and manage flow rings at
+ * high level.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+/** XXX Twiki: [PCIeFullDongleArchitecture] */
+
+/****************
+ * Common types *
+ */
+
+#ifndef _dhd_flowrings_h_
+#define _dhd_flowrings_h_
+
+/* Max pkts held in a flow ring's backup queue */
+#define FLOW_RING_QUEUE_THRESHOLD       (2048)
+
+/* Number of H2D common rings */
+#define FLOW_RING_COMMON                BCMPCIE_H2D_COMMON_MSGRINGS
+
+#define FLOWID_INVALID                  (ID16_INVALID)
+#define FLOWID_RESERVED                 (FLOW_RING_COMMON)
+
+#define FLOW_RING_STATUS_OPEN           0
+#define FLOW_RING_STATUS_CREATE_PENDING        1
+#define FLOW_RING_STATUS_CLOSED         2
+#define FLOW_RING_STATUS_DELETE_PENDING 3
+#define FLOW_RING_STATUS_FLUSH_PENDING  4
+
+#ifdef IDLE_TX_FLOW_MGMT
+#define FLOW_RING_STATUS_SUSPENDED     5
+#define FLOW_RING_STATUS_RESUME_PENDING        6
+#endif /* IDLE_TX_FLOW_MGMT */
+#define FLOW_RING_STATUS_STA_FREEING    7
+
+#if defined(DHD_HTPUT_TUNABLES)
+#define HTPUT_FLOW_RING_PRIO           PRIO_8021D_BE
+#define HTPUT_NUM_STA_FLOW_RINGS       1u
+#define HTPUT_NUM_CLIENT_FLOW_RINGS    3u
+#define HTPUT_TOTAL_FLOW_RINGS         (HTPUT_NUM_STA_FLOW_RINGS + HTPUT_NUM_CLIENT_FLOW_RINGS)
+#define DHD_IS_FLOWID_HTPUT(pub, flowid) \
+       ((flowid >= (pub)->htput_flow_ring_start) && \
+       (flowid < ((pub)->htput_flow_ring_start + HTPUT_TOTAL_FLOW_RINGS)))
+#endif /* DHD_HTPUT_TUNABLES */
+
+#define DHD_FLOWRING_RX_BUFPOST_PKTSZ  2048
+
+#define DHD_FLOWRING_RX_BUFPOST_PKTSZ_MAX 4096
+
+#define DHD_FLOWRING_TX_BIG_PKT_SIZE   (3700u)
+
+#define DHD_FLOW_PRIO_AC_MAP           0
+#define DHD_FLOW_PRIO_TID_MAP          1
+/* Flow ring prority map for lossless roaming */
+#define DHD_FLOW_PRIO_LLR_MAP          2
+
+/* Hashing a MacAddress for lkup into a per interface flow hash table */
+#define DHD_FLOWRING_HASH_SIZE    256
+#define        DHD_FLOWRING_HASHINDEX(ea, prio) \
+              ((((uint8 *)(ea))[3] ^ ((uint8 *)(ea))[4] ^ ((uint8 *)(ea))[5] ^ ((uint8)(prio))) \
+               % DHD_FLOWRING_HASH_SIZE)
+
+#define DHD_IF_ROLE(pub, idx)          (((if_flow_lkup_t *)(pub)->if_flow_lkup)[idx].role)
+#define DHD_IF_ROLE_AP(pub, idx)       (DHD_IF_ROLE(pub, idx) == WLC_E_IF_ROLE_AP)
+#define DHD_IF_ROLE_STA(pub, idx)      (DHD_IF_ROLE(pub, idx) == WLC_E_IF_ROLE_STA)
+#define DHD_IF_ROLE_P2PGC(pub, idx)    (DHD_IF_ROLE(pub, idx) == WLC_E_IF_ROLE_P2P_CLIENT)
+#define DHD_IF_ROLE_P2PGO(pub, idx)    (DHD_IF_ROLE(pub, idx) == WLC_E_IF_ROLE_P2P_GO)
+#define DHD_IF_ROLE_WDS(pub, idx)      (DHD_IF_ROLE(pub, idx) == WLC_E_IF_ROLE_WDS)
+#define DHD_IF_ROLE_IBSS(pub, idx)     (DHD_IF_ROLE(pub, idx) == WLC_E_IF_ROLE_IBSS)
+#ifdef WL_NAN
+#define DHD_IF_ROLE_NAN(pub, idx)      (DHD_IF_ROLE(pub, idx) == WLC_E_IF_ROLE_NAN)
+#else
+#define DHD_IF_ROLE_NAN(pub, idx)      (FALSE)
+#endif /* WL_NAN */
+
+#define DHD_IF_ROLE_GENERIC_STA(pub, idx) \
+       (DHD_IF_ROLE_STA(pub, idx) || DHD_IF_ROLE_P2PGC(pub, idx) || DHD_IF_ROLE_WDS(pub, idx))
+
+#define DHD_IF_ROLE_MULTI_CLIENT(pub, idx) \
+       (DHD_IF_ROLE_AP(pub, idx) || DHD_IF_ROLE_P2PGO(pub, idx) ||\
+               DHD_IF_ROLE_NAN(pub, idx))
+
+#define DHD_FLOW_RING(dhdp, flowid) \
+       (flow_ring_node_t *)&(((flow_ring_node_t *)((dhdp)->flow_ring_table))[flowid])
+
+struct flow_queue;
+
+/* Flow Ring Queue Enqueue overflow callback */
+typedef int (*flow_queue_cb_t)(struct flow_queue * queue, void * pkt);
+
+/**
+ * Each flow ring has an associated (tx flow controlled) queue. 802.3 packets are transferred
+ * between queue and ring. A packet from the host stack is first added to the queue, and in a later
+ * stage transferred to the flow ring. Packets in the queue are dhd owned, whereas packets in the
+ * flow ring are device owned.
+ */
+typedef struct flow_queue {
+       dll_t  list;                /* manage a flowring queue in a double linked list */
+       void * head;                /* first packet in the queue */
+       void * tail;                /* last packet in the queue */
+       uint16 len;                 /* number of packets in the queue */
+       uint16 max;                 /* maximum or min budget (used in cumm) */
+       uint32 threshold;           /* parent's cummulative length threshold */
+       void * clen_ptr;            /* parent's cummulative length counter */
+       uint32 failures;            /* enqueue failures due to queue overflow */
+       flow_queue_cb_t cb;         /* callback invoked on threshold crossing */
+       uint32 l2threshold;         /* grandparent's (level 2) cummulative length threshold */
+       void * l2clen_ptr;          /* grandparent's (level 2) cummulative length counter */
+} flow_queue_t;
+
+#define DHD_FLOW_QUEUE_LEN(queue)       ((int)(queue)->len)
+#define DHD_FLOW_QUEUE_MAX(queue)       ((int)(queue)->max)
+#define DHD_FLOW_QUEUE_THRESHOLD(queue) ((int)(queue)->threshold)
+#define DHD_FLOW_QUEUE_L2THRESHOLD(queue) ((int)(queue)->l2threshold)
+#define DHD_FLOW_QUEUE_EMPTY(queue)     ((queue)->len == 0)
+#define DHD_FLOW_QUEUE_FAILURES(queue)  ((queue)->failures)
+
+#define DHD_FLOW_QUEUE_AVAIL(queue)     ((int)((queue)->max - (queue)->len))
+#define DHD_FLOW_QUEUE_FULL(queue)      ((queue)->len >= (queue)->max)
+
+#define DHD_FLOW_QUEUE_OVFL(queue, budget)  \
+       (((queue)->len) > budget)
+
+#define DHD_FLOW_QUEUE_SET_MAX(queue, budget) \
+       ((queue)->max) = ((budget) - 1)
+
+/* Queue's cummulative threshold. */
+#define DHD_FLOW_QUEUE_SET_THRESHOLD(queue, cumm_threshold) \
+       ((queue)->threshold) = ((cumm_threshold) - 1)
+
+/* Queue's cummulative length object accessor. */
+#define DHD_FLOW_QUEUE_CLEN_PTR(queue)  ((queue)->clen_ptr)
+
+/* Set a queue's cumm_len point to a parent's cumm_ctr_t cummulative length */
+#define DHD_FLOW_QUEUE_SET_CLEN(queue, parent_clen_ptr)  \
+       ((queue)->clen_ptr) = (void *)(parent_clen_ptr)
+
+/* Queue's level 2 cummulative threshold. */
+#define DHD_FLOW_QUEUE_SET_L2THRESHOLD(queue, l2cumm_threshold) \
+       ((queue)->l2threshold) = ((l2cumm_threshold) - 1)
+
+/* Queue's level 2 cummulative length object accessor. */
+#define DHD_FLOW_QUEUE_L2CLEN_PTR(queue)  ((queue)->l2clen_ptr)
+
+/* Set a queue's level 2 cumm_len point to a grandparent's cumm_ctr_t cummulative length */
+#define DHD_FLOW_QUEUE_SET_L2CLEN(queue, grandparent_clen_ptr)  \
+       ((queue)->l2clen_ptr) = (void *)(grandparent_clen_ptr)
+
+#define DHD_FLOWRING_TXSTATUS_CNT_UPDATE(bus, flowid, txstatus)
+
+/* Pkttag not compatible with PROP_TXSTATUS or WLFC */
+typedef struct dhd_pkttag_fr {
+       uint16  flowid;
+       uint16  ifid;
+#ifdef DHD_SBN
+       uint8   pkt_udr;
+       uint8   pad;
+#endif /* DHD_SBN */
+#ifdef DHD_LB_TXC
+       int     dataoff;
+       dmaaddr_t physaddr;
+       uint32 pa_len;
+#endif /* DHD_LB_TXC */
+} dhd_pkttag_fr_t;
+
+#define DHD_PKTTAG_SET_IFID(tag, idx)       ((tag)->ifid = (uint16)(idx))
+#define DHD_PKTTAG_SET_PA(tag, pa)          ((tag)->physaddr = (pa))
+#define DHD_PKTTAG_SET_PA_LEN(tag, palen)   ((tag)->pa_len = (palen))
+#define DHD_PKTTAG_IFID(tag)                ((tag)->ifid)
+#define DHD_PKTTAG_PA(tag)                  ((tag)->physaddr)
+#define DHD_PKTTAG_PA_LEN(tag)              ((tag)->pa_len)
+
+#ifdef DHD_SBN
+#define DHD_PKTTAG_SET_PKT_UDR(tag, flag)   ((tag)->pkt_udr = (flag))
+#define DHD_PKTTAG_PKT_UDR(tag)             ((tag)->pkt_udr)
+#define DHD_SBN_SET_FLAGS_FRAME_UDR(tag, flag) \
+       do {  \
+               if (DHD_PKTTAG_PKT_UDR(tag)) { \
+                       flag |= BCMPCIE_PKT_FLAGS_FRAME_UDR; \
+               } \
+       } while (0)
+#else
+#define DHD_PKTTAG_SET_PKT_UDR(tag, flag) \
+       BCM_REFERENCE(flag)
+#define DHD_PKTTAG_PKT_UDR(tag)
+#define DHD_SBN_SET_FLAGS_FRAME_UDR(tag, flag)
+#endif /* DHD_SBN */
+
+/** each flow ring is dedicated to a tid/sa/da combination */
+typedef struct flow_info {
+       uint8           tid;
+       uint8           ifindex;
+       uchar           sa[ETHER_ADDR_LEN];
+       uchar           da[ETHER_ADDR_LEN];
+#ifdef TX_STATUS_LATENCY_STATS
+       /* total number of tx_status received on this flowid */
+       uint64           num_tx_status;
+       /* cumulative tx_status latency for this flowid */
+       uint64          cum_tx_status_latency;
+       /* num tx packets sent on this flowring */
+       uint64          num_tx_pkts;
+#endif /* TX_STATUS_LATENCY_STATS */
+} flow_info_t;
+
+/** a flow ring is used for outbound (towards antenna) 802.3 packets */
+typedef struct flow_ring_node {
+       dll_t           list;  /* manage a constructed flowring in a dll, must be at first place */
+       flow_queue_t    queue; /* queues packets before they enter the flow ring, flow control */
+       bool            active;
+       uint8           status;
+       /*
+        * flowid: unique ID of a flow ring, which can either be unicast or broadcast/multicast. For
+        * unicast flow rings, the flow id accelerates ARM 802.3->802.11 header translation.
+        */
+       uint16          flowid;
+       flow_info_t     flow_info;
+       void            *prot_info;
+       void            *lock; /* lock for flowring access protection */
+
+#ifdef IDLE_TX_FLOW_MGMT
+       uint64          last_active_ts; /* contains last active timestamp */
+#endif /* IDLE_TX_FLOW_MGMT */
+} flow_ring_node_t;
+
+typedef flow_ring_node_t flow_ring_table_t;
+
+typedef struct flow_hash_info {
+       uint16                  flowid;
+       flow_info_t             flow_info;
+       struct flow_hash_info   *next;
+} flow_hash_info_t;
+
+typedef struct if_flow_lkup {
+       bool            status;
+       uint8           role; /* Interface role: STA/AP */
+       flow_hash_info_t *fl_hash[DHD_FLOWRING_HASH_SIZE]; /* Lkup Hash table */
+} if_flow_lkup_t;
+
+static INLINE flow_ring_node_t *
+dhd_constlist_to_flowring(dll_t *item)
+{
+       return ((flow_ring_node_t *)item);
+}
+
+/* Exported API */
+
+/* Flow ring's queue management functions */
+extern flow_ring_node_t * dhd_flow_ring_node(dhd_pub_t *dhdp, uint16 flowid);
+extern flow_queue_t * dhd_flow_queue(dhd_pub_t *dhdp, uint16 flowid);
+
+extern void dhd_flow_queue_init(dhd_pub_t *dhdp, flow_queue_t *queue, int max);
+extern void dhd_flow_queue_reinit(dhd_pub_t *dhdp, flow_queue_t *queue, int max);
+extern void dhd_flow_queue_register(flow_queue_t *queue, flow_queue_cb_t cb);
+extern int  dhd_flow_queue_enqueue(dhd_pub_t *dhdp, flow_queue_t *queue, void *pkt);
+extern void * dhd_flow_queue_dequeue(dhd_pub_t *dhdp, flow_queue_t *queue);
+extern void dhd_flow_queue_reinsert(dhd_pub_t *dhdp, flow_queue_t *queue, void *pkt);
+
+extern void dhd_flow_ring_config_thresholds(dhd_pub_t *dhdp, uint16 flowid,
+                          int queue_budget, int cumm_threshold, void *cumm_ctr,
+                          int l2cumm_threshold, void *l2cumm_ctr);
+extern int  dhd_flow_rings_init(dhd_pub_t *dhdp, uint32 num_h2d_rings);
+
+extern void dhd_flow_rings_deinit(dhd_pub_t *dhdp);
+
+extern int dhd_flowid_update(dhd_pub_t *dhdp, uint8 ifindex, uint8 prio,
+                void *pktbuf);
+extern int dhd_flowid_debug_create(dhd_pub_t *dhdp, uint8 ifindex,
+       uint8 prio, char *sa, char *da, uint16 *flowid);
+extern int dhd_flowid_find_by_ifidx(dhd_pub_t *dhdp, uint8 ifidex, uint16 flowid);
+
+extern void dhd_flowid_free(dhd_pub_t *dhdp, uint8 ifindex, uint16 flowid);
+
+extern void dhd_flow_rings_delete(dhd_pub_t *dhdp, uint8 ifindex);
+extern void dhd_flow_rings_flush(dhd_pub_t *dhdp, uint8 ifindex);
+
+extern void dhd_flow_rings_delete_for_peer(dhd_pub_t *dhdp, uint8 ifindex,
+                char *addr);
+
+/* Handle Interface ADD, DEL operations */
+extern void dhd_update_interface_flow_info(dhd_pub_t *dhdp, uint8 ifindex,
+                uint8 op, uint8 role);
+
+/* Handle a STA interface link status update */
+extern int dhd_update_interface_link_status(dhd_pub_t *dhdp, uint8 ifindex,
+                uint8 status);
+extern int dhd_flow_prio_map(dhd_pub_t *dhd, uint8 *map, bool set);
+extern int dhd_update_flow_prio_map(dhd_pub_t *dhdp, uint8 map);
+extern uint32 dhd_active_tx_flowring_bkpq_len(dhd_pub_t *dhdp);
+extern uint8 dhd_flow_rings_ifindex2role(dhd_pub_t *dhdp, uint8 ifindex);
+#endif /* _dhd_flowrings_h_ */
diff --git a/bcmdhd.101.10.240.x/dhd_gpio.c b/bcmdhd.101.10.240.x/dhd_gpio.c
new file mode 100644 (file)
index 0000000..fc8fd44
--- /dev/null
@@ -0,0 +1,429 @@
+
+#include <osl.h>
+#include <dhd_linux.h>
+#include <linux/gpio.h>
+
+#if defined(BUS_POWER_RESTORE) && defined(BCMSDIO)
+#include <linux/mmc/core.h>
+#include <linux/mmc/card.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/sdio_func.h>
+#endif /* defined(BUS_POWER_RESTORE) && defined(BCMSDIO) */
+
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+extern void *bcmdhd_mem_prealloc(int section, unsigned long size);
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+static int gpio_wl_reg_on = -1; // WL_REG_ON is input pin of WLAN module
+#ifdef CUSTOMER_OOB
+static int gpio_wl_host_wake = -1; // WL_HOST_WAKE is output pin of WLAN module
+#endif
+
+#ifdef CUSTOMER_HW_AMLOGIC
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0))
+#include <linux/amlogic/aml_gpio_consumer.h>
+extern int wifi_irq_trigger_level(void);
+extern u8 *wifi_get_mac(void);
+extern u8 *wifi_get_ap_mac(void);
+#endif
+extern  void sdio_reinit(void);
+extern void set_usb_bt_power(int is_power);
+extern void extern_wifi_set_enable(int is_on);
+extern void pci_remove_reinit(unsigned int vid, unsigned int pid, int delBus);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+extern int wifi_irq_num(void);
+#endif
+#endif
+
+static int
+dhd_wlan_set_power(int on
+#ifdef BUS_POWER_RESTORE
+, wifi_adapter_info_t *adapter
+#endif /* BUS_POWER_RESTORE */
+)
+{
+       int err = 0;
+
+       if (on) {
+               printf("======== PULL WL_REG_ON(%d) HIGH! ========\n", gpio_wl_reg_on);
+               if (gpio_wl_reg_on >= 0) {
+                       err = gpio_direction_output(gpio_wl_reg_on, 1);
+                       if (err) {
+                               printf("%s: WL_REG_ON didn't output high\n", __FUNCTION__);
+                               return -EIO;
+                       }
+               }
+#ifdef CUSTOMER_HW_AMLOGIC
+#ifdef BCMSDIO
+               extern_wifi_set_enable(0);
+               mdelay(200);
+               extern_wifi_set_enable(1);
+               mdelay(200);
+//             sdio_reinit();
+#endif
+#ifdef BCMDBUS
+               set_usb_bt_power(0);
+               mdelay(200);
+               set_usb_bt_power(1);
+               mdelay(200);
+#endif
+#endif
+#if defined(BUS_POWER_RESTORE)
+#if defined(BCMSDIO) && (LINUX_VERSION_CODE < KERNEL_VERSION(4, 19, 0))
+               if (adapter->sdio_func && adapter->sdio_func->card && adapter->sdio_func->card->host) {
+                       mdelay(100);
+                       printf("======== mmc_power_restore_host! ========\n");
+                       mmc_power_restore_host(adapter->sdio_func->card->host);
+               }
+#elif defined(BCMPCIE)
+               if (adapter->pci_dev) {
+                       mdelay(100);
+                       printf("======== pci_set_power_state PCI_D0! ========\n");
+                       pci_set_power_state(adapter->pci_dev, PCI_D0);
+                       if (adapter->pci_saved_state)
+                               pci_load_and_free_saved_state(adapter->pci_dev, &adapter->pci_saved_state);
+                       pci_restore_state(adapter->pci_dev);
+                       err = pci_enable_device(adapter->pci_dev);
+                       if (err < 0)
+                               printf("%s: PCI enable device failed", __FUNCTION__);
+                       pci_set_master(adapter->pci_dev);
+               }
+#endif /* BCMPCIE */
+#endif /* BUS_POWER_RESTORE */
+               /* Lets customer power to get stable */
+               mdelay(100);
+       } else {
+#if defined(BUS_POWER_RESTORE)
+#if defined(BCMSDIO) && (LINUX_VERSION_CODE < KERNEL_VERSION(4, 19, 0))
+               if (adapter->sdio_func && adapter->sdio_func->card && adapter->sdio_func->card->host) {
+                       printf("======== mmc_power_save_host! ========\n");
+                       mmc_power_save_host(adapter->sdio_func->card->host);
+               }
+#elif defined(BCMPCIE)
+               if (adapter->pci_dev) {
+                       printf("======== pci_set_power_state PCI_D3hot! ========\n");
+                       pci_save_state(adapter->pci_dev);
+                       adapter->pci_saved_state = pci_store_saved_state(adapter->pci_dev);
+                       if (pci_is_enabled(adapter->pci_dev))
+                               pci_disable_device(adapter->pci_dev);
+                       pci_set_power_state(adapter->pci_dev, PCI_D3hot);
+               }
+#endif /* BCMPCIE */
+#endif /* BUS_POWER_RESTORE */
+               printf("======== PULL WL_REG_ON(%d) LOW! ========\n", gpio_wl_reg_on);
+               if (gpio_wl_reg_on >= 0) {
+                       err = gpio_direction_output(gpio_wl_reg_on, 0);
+                       if (err) {
+                               printf("%s: WL_REG_ON didn't output low\n", __FUNCTION__);
+                               return -EIO;
+                       }
+               }
+#ifdef CUSTOMER_HW_AMLOGIC
+#ifdef BCMSIDO
+               extern_wifi_set_enable(0);
+               mdelay(200);
+#endif
+#ifdef BCMDBUS
+               set_usb_bt_power(0);
+               mdelay(200);
+#endif
+#endif
+       }
+
+       return err;
+}
+
+static int dhd_wlan_set_reset(int onoff)
+{
+       return 0;
+}
+
+static int dhd_wlan_set_carddetect(int present)
+{
+       int err = 0;
+
+#if !defined(BUS_POWER_RESTORE)
+       if (present) {
+#if defined(BCMSDIO)
+               printf("======== Card detection to detect SDIO card! ========\n");
+#ifdef CUSTOMER_HW_PLATFORM
+               err = sdhci_force_presence_change(&sdmmc_channel, 1);
+#endif /* CUSTOMER_HW_PLATFORM */
+#ifdef CUSTOMER_HW_AMLOGIC
+               sdio_reinit();
+#endif
+#elif defined(BCMPCIE)
+               printf("======== Card detection to detect PCIE card! ========\n");
+#endif
+       } else {
+#if defined(BCMSDIO)
+               printf("======== Card detection to remove SDIO card! ========\n");
+#ifdef CUSTOMER_HW_PLATFORM
+               err = sdhci_force_presence_change(&sdmmc_channel, 0);
+#endif /* CUSTOMER_HW_PLATFORM */
+#ifdef CUSTOMER_HW_AMLOGIC
+               extern_wifi_set_enable(0);
+               mdelay(200);
+#endif
+#elif defined(BCMPCIE)
+               printf("======== Card detection to remove PCIE card! ========\n");
+#ifdef CUSTOMER_HW_AMLOGIC
+               extern_wifi_set_enable(0);
+               mdelay(200);
+#endif
+#endif
+       }
+#endif /* BUS_POWER_RESTORE */
+
+       return err;
+}
+
+static int dhd_wlan_get_mac_addr(unsigned char *buf
+#ifdef CUSTOM_MULTI_MAC
+       , char *name
+#endif
+)
+{
+       int err = 0;
+
+#ifdef CUSTOM_MULTI_MAC
+       if (!strcmp("wlan1", name)) {
+#ifdef CUSTOMER_HW_AMLOGIC
+#ifdef CUSTOM_AP_MAC
+               bcopy((char *)wifi_get_ap_mac(), buf, sizeof(struct ether_addr));
+               if (buf[0] == 0xff) {
+                       printf("custom wifi ap mac is not set\n");
+                       err = -1;
+               } else
+                       printf("custom wifi ap mac-addr: %02x:%02x:%02x:%02x:%02x:%02x\n",
+                               buf[0], buf[1], buf[2],
+                               buf[3], buf[4], buf[5]);
+#else
+               err = -1;
+#endif
+#endif
+       } else
+#endif /* CUSTOM_MULTI_MAC */
+       {
+#ifdef CUSTOMER_HW_AMLOGIC
+               bcopy((char *)wifi_get_mac(), buf, sizeof(struct ether_addr));
+               if (buf[0] == 0xff) {
+                       printf("custom wifi mac is not set\n");
+                       err = -1;
+               } else
+                       printf("custom wifi mac-addr: %02x:%02x:%02x:%02x:%02x:%02x\n",
+                               buf[0], buf[1], buf[2],
+                               buf[3], buf[4], buf[5]);
+#endif
+       }
+
+#ifdef EXAMPLE_GET_MAC_VER2
+       /* EXAMPLE code */
+       {
+               char macpad[56]= {
+               0x00,0xaa,0x9c,0x84,0xc7,0xbc,0x9b,0xf6,
+               0x02,0x33,0xa9,0x4d,0x5c,0xb4,0x0a,0x5d,
+               0xa8,0xef,0xb0,0xcf,0x8e,0xbf,0x24,0x8a,
+               0x87,0x0f,0x6f,0x0d,0xeb,0x83,0x6a,0x70,
+               0x4a,0xeb,0xf6,0xe6,0x3c,0xe7,0x5f,0xfc,
+               0x0e,0xa7,0xb3,0x0f,0x00,0xe4,0x4a,0xaf,
+               0x87,0x08,0x16,0x6d,0x3a,0xe3,0xc7,0x80};
+               bcopy(macpad, buf+6, sizeof(macpad));
+       }
+#endif /* EXAMPLE_GET_MAC_VER2 */
+
+       printf("======== %s err=%d ========\n", __FUNCTION__, err);
+
+       return err;
+}
+
+static struct cntry_locales_custom brcm_wlan_translate_custom_table[] = {
+       /* Table should be filled out based on custom platform regulatory requirement */
+#ifdef EXAMPLE_TABLE
+       {"",   "XT", 49},  /* Universal if Country code is unknown or empty */
+       {"US", "US", 0},
+#endif /* EXMAPLE_TABLE */
+};
+
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+struct cntry_locales_custom brcm_wlan_translate_nodfs_table[] = {
+#ifdef EXAMPLE_TABLE
+       {"",   "XT", 50},  /* Universal if Country code is unknown or empty */
+       {"US", "US", 0},
+#endif /* EXMAPLE_TABLE */
+};
+#endif
+
+static void *dhd_wlan_get_country_code(char *ccode
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+       , u32 flags
+#endif
+)
+{
+       struct cntry_locales_custom *locales;
+       int size;
+       int i;
+
+       if (!ccode)
+               return NULL;
+
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+       if (flags & WLAN_PLAT_NODFS_FLAG) {
+               locales = brcm_wlan_translate_nodfs_table;
+               size = ARRAY_SIZE(brcm_wlan_translate_nodfs_table);
+       } else {
+#endif
+               locales = brcm_wlan_translate_custom_table;
+               size = ARRAY_SIZE(brcm_wlan_translate_custom_table);
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+       }
+#endif
+
+       for (i = 0; i < size; i++)
+               if (strcmp(ccode, locales[i].iso_abbrev) == 0)
+                       return &locales[i];
+       return NULL;
+}
+
+struct resource dhd_wlan_resources[] = {
+       [0] = {
+               .name   = "bcmdhd_wlan_irq",
+               .start  = 0, /* Dummy */
+               .end    = 0, /* Dummy */
+               .flags  = IORESOURCE_IRQ | IORESOURCE_IRQ_SHAREABLE
+                       | IORESOURCE_IRQ_HIGHLEVEL, /* Dummy */
+       },
+};
+
+struct wifi_platform_data dhd_wlan_control = {
+       .set_power      = dhd_wlan_set_power,
+       .set_reset      = dhd_wlan_set_reset,
+       .set_carddetect = dhd_wlan_set_carddetect,
+       .get_mac_addr   = dhd_wlan_get_mac_addr,
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+       .mem_prealloc   = bcmdhd_mem_prealloc,
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+       .get_country_code = dhd_wlan_get_country_code,
+};
+
+int dhd_wlan_init_gpio(void)
+{
+       int err = 0;
+#ifdef CUSTOMER_OOB
+       int host_oob_irq = -1;
+       uint host_oob_irq_flags = 0;
+#endif
+
+       /* Please check your schematic and fill right GPIO number which connected to
+       * WL_REG_ON and WL_HOST_WAKE.
+       */
+       gpio_wl_reg_on = -1;
+#ifdef CUSTOMER_OOB
+       gpio_wl_host_wake = -1;
+#endif
+
+#ifdef CUSTOMER_HW_AMLOGIC
+#if defined(BCMPCIE)
+       printf("======== Card detection to detect PCIE card! ========\n");
+       //pci_remove_reinit(0x14e4, 0x449d, 1);
+#endif
+#endif
+
+       if (gpio_wl_reg_on >= 0) {
+               err = gpio_request(gpio_wl_reg_on, "WL_REG_ON");
+               if (err < 0) {
+                       printf("%s: gpio_request(%d) for WL_REG_ON failed\n",
+                               __FUNCTION__, gpio_wl_reg_on);
+                       gpio_wl_reg_on = -1;
+               }
+       }
+
+#ifdef CUSTOMER_OOB
+       if (gpio_wl_host_wake >= 0) {
+               err = gpio_request(gpio_wl_host_wake, "bcmdhd");
+               if (err < 0) {
+                       printf("%s: gpio_request(%d) for WL_HOST_WAKE failed\n",
+                               __FUNCTION__, gpio_wl_host_wake);
+                       return -1;
+               }
+               err = gpio_direction_input(gpio_wl_host_wake);
+               if (err < 0) {
+                       printf("%s: gpio_direction_input(%d) for WL_HOST_WAKE failed\n",
+                               __FUNCTION__, gpio_wl_host_wake);
+                       gpio_free(gpio_wl_host_wake);
+                       return -1;
+               }
+               host_oob_irq = gpio_to_irq(gpio_wl_host_wake);
+               if (host_oob_irq < 0) {
+                       printf("%s: gpio_to_irq(%d) for WL_HOST_WAKE failed\n",
+                               __FUNCTION__, gpio_wl_host_wake);
+                       gpio_free(gpio_wl_host_wake);
+                       return -1;
+               }
+       }
+#ifdef CUSTOMER_HW_AMLOGIC
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+       host_oob_irq = INT_GPIO_4;
+#else
+       host_oob_irq = wifi_irq_num();
+#endif
+#endif
+
+#ifdef HW_OOB
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0))
+       if (wifi_irq_trigger_level() == GPIO_IRQ_LOW)
+               host_oob_irq_flags = IORESOURCE_IRQ | IORESOURCE_IRQ_LOWLEVEL | IORESOURCE_IRQ_SHAREABLE;
+       else
+               host_oob_irq_flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL | IORESOURCE_IRQ_SHAREABLE;
+#else
+#ifdef HW_OOB_LOW_LEVEL
+       host_oob_irq_flags = IORESOURCE_IRQ | IORESOURCE_IRQ_LOWLEVEL | IORESOURCE_IRQ_SHAREABLE;
+#else
+       host_oob_irq_flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL | IORESOURCE_IRQ_SHAREABLE;
+#endif
+#endif
+#else
+       host_oob_irq_flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHEDGE | IORESOURCE_IRQ_SHAREABLE;
+#endif
+
+       dhd_wlan_resources[0].start = dhd_wlan_resources[0].end = host_oob_irq;
+       dhd_wlan_resources[0].flags = host_oob_irq_flags;
+       printf("%s: WL_HOST_WAKE=%d, oob_irq=%d, oob_irq_flags=0x%x\n", __FUNCTION__,
+               gpio_wl_host_wake, host_oob_irq, host_oob_irq_flags);
+#endif /* CUSTOMER_OOB */
+       printf("%s: WL_REG_ON=%d\n", __FUNCTION__, gpio_wl_reg_on);
+
+       return 0;
+}
+
+static void dhd_wlan_deinit_gpio(void)
+{
+       if (gpio_wl_reg_on >= 0) {
+               printf("%s: gpio_free(WL_REG_ON %d)\n", __FUNCTION__, gpio_wl_reg_on);
+               gpio_free(gpio_wl_reg_on);
+               gpio_wl_reg_on = -1;
+       }
+#ifdef CUSTOMER_OOB
+       if (gpio_wl_host_wake >= 0) {
+               printf("%s: gpio_free(WL_HOST_WAKE %d)\n", __FUNCTION__, gpio_wl_host_wake);
+               gpio_free(gpio_wl_host_wake);
+               gpio_wl_host_wake = -1;
+       }
+#endif /* CUSTOMER_OOB */
+}
+
+int dhd_wlan_init_plat_data(void)
+{
+       int err = 0;
+
+       printf("======== %s ========\n", __FUNCTION__);
+       err = dhd_wlan_init_gpio();
+       return err;
+}
+
+void dhd_wlan_deinit_plat_data(wifi_adapter_info_t *adapter)
+{
+       printf("======== %s ========\n", __FUNCTION__);
+       dhd_wlan_deinit_gpio();
+}
+
diff --git a/bcmdhd.101.10.240.x/dhd_ip.c b/bcmdhd.101.10.240.x/dhd_ip.c
new file mode 100644 (file)
index 0000000..0260841
--- /dev/null
@@ -0,0 +1,1422 @@
+/*
+ * IP Packet Parser Module.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+#include <typedefs.h>
+#include <osl.h>
+
+#include <ethernet.h>
+#include <vlan.h>
+#include <802.3.h>
+#include <bcmip.h>
+#include <bcmendian.h>
+
+#include <dhd_dbg.h>
+
+#include <dhd_ip.h>
+
+#if defined(DHDTCPACK_SUPPRESS) || defined(DHDTCPSYNC_FLOOD_BLK)
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <bcmtcp.h>
+#endif /* DHDTCPACK_SUPPRESS || DHDTCPSYNC_FLOOD_BLK */
+
+/* special values */
+/* 802.3 llc/snap header */
+static const uint8 llc_snap_hdr[SNAP_HDR_LEN] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
+
+pkt_frag_t pkt_frag_info(osl_t *osh, void *p)
+{
+       uint8 *frame;
+       int length;
+       uint8 *pt;                      /* Pointer to type field */
+       uint16 ethertype;
+       struct ipv4_hdr *iph;           /* IP frame pointer */
+       int ipl;                        /* IP frame length */
+       uint16 iph_frag;
+
+       ASSERT(osh && p);
+
+       frame = PKTDATA(osh, p);
+       length = PKTLEN(osh, p);
+
+       /* Process Ethernet II or SNAP-encapsulated 802.3 frames */
+       if (length < ETHER_HDR_LEN) {
+               DHD_INFO(("%s: short eth frame (%d)\n", __FUNCTION__, length));
+               return DHD_PKT_FRAG_NONE;
+       } else if (ntoh16(*(uint16 *)(frame + ETHER_TYPE_OFFSET)) >= ETHER_TYPE_MIN) {
+               /* Frame is Ethernet II */
+               pt = frame + ETHER_TYPE_OFFSET;
+       } else if (length >= ETHER_HDR_LEN + SNAP_HDR_LEN + ETHER_TYPE_LEN &&
+                  !bcmp(llc_snap_hdr, frame + ETHER_HDR_LEN, SNAP_HDR_LEN)) {
+               pt = frame + ETHER_HDR_LEN + SNAP_HDR_LEN;
+       } else {
+               DHD_INFO(("%s: non-SNAP 802.3 frame\n", __FUNCTION__));
+               return DHD_PKT_FRAG_NONE;
+       }
+
+       ethertype = ntoh16(*(uint16 *)pt);
+
+       /* Skip VLAN tag, if any */
+       if (ethertype == ETHER_TYPE_8021Q) {
+               pt += VLAN_TAG_LEN;
+
+               if (pt + ETHER_TYPE_LEN > frame + length) {
+                       DHD_INFO(("%s: short VLAN frame (%d)\n", __FUNCTION__, length));
+                       return DHD_PKT_FRAG_NONE;
+               }
+
+               ethertype = ntoh16(*(uint16 *)pt);
+       }
+
+       if (ethertype != ETHER_TYPE_IP) {
+               DHD_INFO(("%s: non-IP frame (ethertype 0x%x, length %d)\n",
+                       __FUNCTION__, ethertype, length));
+               return DHD_PKT_FRAG_NONE;
+       }
+
+       iph = (struct ipv4_hdr *)(pt + ETHER_TYPE_LEN);
+       ipl = (uint)(length - (pt + ETHER_TYPE_LEN - frame));
+
+       /* We support IPv4 only */
+       if ((ipl < IPV4_OPTIONS_OFFSET) || (IP_VER(iph) != IP_VER_4)) {
+               DHD_INFO(("%s: short frame (%d) or non-IPv4\n", __FUNCTION__, ipl));
+               return DHD_PKT_FRAG_NONE;
+       }
+
+       iph_frag = ntoh16(iph->frag);
+
+       if (iph_frag & IPV4_FRAG_DONT) {
+               return DHD_PKT_FRAG_NONE;
+       } else if ((iph_frag & IPV4_FRAG_MORE) == 0) {
+               return DHD_PKT_FRAG_LAST;
+       } else {
+               return (iph_frag & IPV4_FRAG_OFFSET_MASK)? DHD_PKT_FRAG_CONT : DHD_PKT_FRAG_FIRST;
+       }
+}
+
+#ifdef DHDTCPACK_SUPPRESS
+
+typedef struct {
+       void *pkt_in_q;         /* TCP ACK packet that is already in txq or DelayQ */
+       void *pkt_ether_hdr;    /* Ethernet header pointer of pkt_in_q */
+       int ifidx;
+       uint8 supp_cnt;
+       dhd_pub_t *dhdp;
+#ifndef TCPACK_SUPPRESS_HOLD_HRT
+       timer_list_compat_t timer;
+#else
+       struct tasklet_hrtimer timer;
+#endif /* TCPACK_SUPPRESS_HOLD_HRT */
+} tcpack_info_t;
+
+typedef struct _tdata_psh_info_t {
+       uint32 end_seq;                 /* end seq# of a received TCP PSH DATA pkt */
+       struct _tdata_psh_info_t *next; /* next pointer of the link chain */
+} tdata_psh_info_t;
+
+typedef struct {
+       struct {
+               uint8 src[IPV4_ADDR_LEN];       /* SRC ip addrs of this TCP stream */
+               uint8 dst[IPV4_ADDR_LEN];       /* DST ip addrs of this TCP stream */
+       } ip_addr;
+       struct {
+               uint8 src[TCP_PORT_LEN];        /* SRC tcp ports of this TCP stream */
+               uint8 dst[TCP_PORT_LEN];        /* DST tcp ports of this TCP stream */
+       } tcp_port;
+       tdata_psh_info_t *tdata_psh_info_head;  /* Head of received TCP PSH DATA chain */
+       tdata_psh_info_t *tdata_psh_info_tail;  /* Tail of received TCP PSH DATA chain */
+       uint32 last_used_time;  /* The last time this tcpdata_info was used(in ms) */
+} tcpdata_info_t;
+
+/* TCPACK SUPPRESS module */
+typedef struct {
+       int tcpack_info_cnt;
+       tcpack_info_t tcpack_info_tbl[TCPACK_INFO_MAXNUM];      /* Info of TCP ACK to send */
+       int tcpdata_info_cnt;
+       tcpdata_info_t tcpdata_info_tbl[TCPDATA_INFO_MAXNUM];   /* Info of received TCP DATA */
+       tdata_psh_info_t *tdata_psh_info_pool;  /* Pointer to tdata_psh_info elements pool */
+       tdata_psh_info_t *tdata_psh_info_free;  /* free tdata_psh_info elements chain in pool */
+#ifdef DHDTCPACK_SUP_DBG
+       int psh_info_enq_num;   /* Number of free TCP PSH DATA info elements in pool */
+#endif /* DHDTCPACK_SUP_DBG */
+} tcpack_sup_module_t;
+
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+counter_tbl_t tack_tbl = {"tcpACK", 0, 1000, 10, {0, }, 1};
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+
+static void
+_tdata_psh_info_pool_enq(tcpack_sup_module_t *tcpack_sup_mod,
+       tdata_psh_info_t *tdata_psh_info)
+{
+       if ((tcpack_sup_mod == NULL) || (tdata_psh_info == NULL)) {
+               DHD_ERROR(("%s %d: ERROR %p %p\n", __FUNCTION__, __LINE__,
+                       tcpack_sup_mod, tdata_psh_info));
+               return;
+       }
+
+       ASSERT(tdata_psh_info->next == NULL);
+       tdata_psh_info->next = tcpack_sup_mod->tdata_psh_info_free;
+       tcpack_sup_mod->tdata_psh_info_free = tdata_psh_info;
+#ifdef DHDTCPACK_SUP_DBG
+       tcpack_sup_mod->psh_info_enq_num++;
+#endif
+}
+
+static tdata_psh_info_t*
+_tdata_psh_info_pool_deq(tcpack_sup_module_t *tcpack_sup_mod)
+{
+       tdata_psh_info_t *tdata_psh_info = NULL;
+
+       if (tcpack_sup_mod == NULL) {
+               DHD_ERROR(("%s %d: ERROR %p\n", __FUNCTION__, __LINE__,
+                       tcpack_sup_mod));
+               return NULL;
+       }
+
+       tdata_psh_info = tcpack_sup_mod->tdata_psh_info_free;
+       if (tdata_psh_info == NULL)
+               DHD_ERROR(("%s %d: Out of tdata_disc_grp\n", __FUNCTION__, __LINE__));
+       else {
+               tcpack_sup_mod->tdata_psh_info_free = tdata_psh_info->next;
+               tdata_psh_info->next = NULL;
+#ifdef DHDTCPACK_SUP_DBG
+               tcpack_sup_mod->psh_info_enq_num--;
+#endif /* DHDTCPACK_SUP_DBG */
+       }
+
+       return tdata_psh_info;
+}
+
+#ifdef BCMSDIO
+static int _tdata_psh_info_pool_init(dhd_pub_t *dhdp,
+       tcpack_sup_module_t *tcpack_sup_mod)
+{
+       tdata_psh_info_t *tdata_psh_info_pool = NULL;
+       uint i;
+
+       DHD_TRACE(("%s %d: Enter\n", __FUNCTION__, __LINE__));
+
+       if (tcpack_sup_mod == NULL)
+               return BCME_ERROR;
+
+       ASSERT(tcpack_sup_mod->tdata_psh_info_pool == NULL);
+       ASSERT(tcpack_sup_mod->tdata_psh_info_free == NULL);
+
+       tdata_psh_info_pool =
+               MALLOC(dhdp->osh, sizeof(tdata_psh_info_t) * TCPDATA_PSH_INFO_MAXNUM);
+
+       if (tdata_psh_info_pool == NULL)
+               return BCME_NOMEM;
+       bzero(tdata_psh_info_pool, sizeof(tdata_psh_info_t) * TCPDATA_PSH_INFO_MAXNUM);
+#ifdef DHDTCPACK_SUP_DBG
+       tcpack_sup_mod->psh_info_enq_num = 0;
+#endif /* DHDTCPACK_SUP_DBG */
+
+       /* Enqueue newly allocated tcpdata psh info elements to the pool */
+       for (i = 0; i < TCPDATA_PSH_INFO_MAXNUM; i++)
+               _tdata_psh_info_pool_enq(tcpack_sup_mod, &tdata_psh_info_pool[i]);
+
+       ASSERT(tcpack_sup_mod->tdata_psh_info_free != NULL);
+       tcpack_sup_mod->tdata_psh_info_pool = tdata_psh_info_pool;
+
+       return BCME_OK;
+}
+
+static void _tdata_psh_info_pool_deinit(dhd_pub_t *dhdp,
+       tcpack_sup_module_t *tcpack_sup_mod)
+{
+       uint i;
+       tdata_psh_info_t *tdata_psh_info;
+
+       DHD_TRACE(("%s %d: Enter\n", __FUNCTION__, __LINE__));
+
+       if (tcpack_sup_mod == NULL) {
+               DHD_ERROR(("%s %d: ERROR tcpack_sup_mod NULL!\n",
+                       __FUNCTION__, __LINE__));
+               return;
+       }
+
+       for (i = 0; i < tcpack_sup_mod->tcpdata_info_cnt; i++) {
+               tcpdata_info_t *tcpdata_info = &tcpack_sup_mod->tcpdata_info_tbl[i];
+               /* Return tdata_psh_info elements allocated to each tcpdata_info to the pool */
+               while ((tdata_psh_info = tcpdata_info->tdata_psh_info_head)) {
+                       tcpdata_info->tdata_psh_info_head = tdata_psh_info->next;
+                       tdata_psh_info->next = NULL;
+                       _tdata_psh_info_pool_enq(tcpack_sup_mod, tdata_psh_info);
+               }
+               tcpdata_info->tdata_psh_info_tail = NULL;
+       }
+#ifdef DHDTCPACK_SUP_DBG
+       DHD_ERROR(("%s %d: PSH INFO ENQ %d\n",
+               __FUNCTION__, __LINE__, tcpack_sup_mod->psh_info_enq_num));
+#endif /* DHDTCPACK_SUP_DBG */
+
+       i = 0;
+       /* Be sure we recollected all tdata_psh_info elements */
+       while ((tdata_psh_info = tcpack_sup_mod->tdata_psh_info_free)) {
+               tcpack_sup_mod->tdata_psh_info_free = tdata_psh_info->next;
+               tdata_psh_info->next = NULL;
+               i++;
+       }
+       ASSERT(i == TCPDATA_PSH_INFO_MAXNUM);
+       MFREE(dhdp->osh, tcpack_sup_mod->tdata_psh_info_pool,
+               sizeof(tdata_psh_info_t) * TCPDATA_PSH_INFO_MAXNUM);
+
+       return;
+}
+#endif /* BCMSDIO */
+
+#ifdef BCMPCIE
+#ifndef TCPACK_SUPPRESS_HOLD_HRT
+static void dhd_tcpack_send(ulong data)
+#else
+static enum hrtimer_restart dhd_tcpack_send(struct hrtimer *timer)
+#endif /* TCPACK_SUPPRESS_HOLD_HRT */
+{
+       tcpack_sup_module_t *tcpack_sup_mod;
+       tcpack_info_t *cur_tbl;
+       dhd_pub_t *dhdp;
+       int ifidx;
+       void* pkt;
+       unsigned long flags;
+
+#ifndef TCPACK_SUPPRESS_HOLD_HRT
+       cur_tbl = (tcpack_info_t *)data;
+#else
+       cur_tbl = container_of(timer, tcpack_info_t, timer.timer);
+#endif /* TCPACK_SUPPRESS_HOLD_HRT */
+
+       if (!cur_tbl) {
+               goto done;
+       }
+
+       dhdp = cur_tbl->dhdp;
+       if (!dhdp) {
+               goto done;
+       }
+
+       flags = dhd_os_tcpacklock(dhdp);
+
+       if (unlikely(dhdp->tcpack_sup_mode != TCPACK_SUP_HOLD)) {
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto done;
+       }
+
+       tcpack_sup_mod = dhdp->tcpack_sup_module;
+       if (!tcpack_sup_mod) {
+               DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n",
+                       __FUNCTION__, __LINE__));
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto done;
+       }
+       pkt = cur_tbl->pkt_in_q;
+       ifidx = cur_tbl->ifidx;
+       if (!pkt) {
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto done;
+       }
+       cur_tbl->pkt_in_q = NULL;
+       cur_tbl->pkt_ether_hdr = NULL;
+       cur_tbl->ifidx = 0;
+       cur_tbl->supp_cnt = 0;
+       if (--tcpack_sup_mod->tcpack_info_cnt < 0) {
+               DHD_ERROR(("%s %d: ERROR!!! tcp_ack_info_cnt %d\n",
+                       __FUNCTION__, __LINE__, tcpack_sup_mod->tcpack_info_cnt));
+       }
+
+       dhd_os_tcpackunlock(dhdp, flags);
+
+       dhd_sendpkt(dhdp, ifidx, pkt);
+
+done:
+#ifndef TCPACK_SUPPRESS_HOLD_HRT
+       return;
+#else
+       return HRTIMER_NORESTART;
+#endif /* TCPACK_SUPPRESS_HOLD_HRT */
+}
+#endif /* BCMPCIE */
+
+int dhd_tcpack_suppress_set(dhd_pub_t *dhdp, uint8 mode)
+{
+       int ret = BCME_OK;
+       unsigned long flags;
+       tcpack_sup_module_t *tcpack_sup_module;
+       uint8 invalid_mode = FALSE;
+       int prev_mode;
+       int i = 0;
+
+       flags = dhd_os_tcpacklock(dhdp);
+       tcpack_sup_module = dhdp->tcpack_sup_module;
+       prev_mode = dhdp->tcpack_sup_mode;
+
+       if (prev_mode == mode) {
+               DHD_ERROR(("%s %d: already set to %d\n", __FUNCTION__, __LINE__, mode));
+               goto exit;
+       }
+
+       invalid_mode |= (mode >= TCPACK_SUP_LAST_MODE);
+#ifdef BCMSDIO
+       invalid_mode |= (mode == TCPACK_SUP_HOLD);
+#endif /* BCMSDIO */
+#ifdef BCMPCIE
+       invalid_mode |= ((mode == TCPACK_SUP_REPLACE) || (mode == TCPACK_SUP_DELAYTX));
+#endif /* BCMPCIE */
+
+       if (invalid_mode) {
+               DHD_ERROR(("%s %d: Invalid TCP ACK Suppress mode %d\n",
+                       __FUNCTION__, __LINE__, mode));
+               ret = BCME_BADARG;
+               goto exit;
+       }
+
+       printf("%s: TCP ACK Suppress mode %d -> mode %d\n",
+               __FUNCTION__, dhdp->tcpack_sup_mode, mode);
+
+       /* Pre-process routines to change a new mode as per previous mode */
+       switch (prev_mode) {
+               case TCPACK_SUP_OFF:
+                       if (tcpack_sup_module == NULL) {
+                               tcpack_sup_module = MALLOC(dhdp->osh, sizeof(tcpack_sup_module_t));
+                               if (tcpack_sup_module == NULL) {
+                                       DHD_ERROR(("%s[%d]: Failed to allocate the new memory for "
+                                               "tcpack_sup_module\n", __FUNCTION__, __LINE__));
+                                       dhdp->tcpack_sup_mode = TCPACK_SUP_OFF;
+                                       ret = BCME_NOMEM;
+                                       goto exit;
+                               }
+                               dhdp->tcpack_sup_module = tcpack_sup_module;
+                       }
+                       bzero(tcpack_sup_module, sizeof(tcpack_sup_module_t));
+                       break;
+#ifdef BCMSDIO
+               case TCPACK_SUP_DELAYTX:
+                       if (tcpack_sup_module) {
+                               /* We won't need tdata_psh_info pool and
+                                * tcpddata_info_tbl anymore
+                                */
+                               _tdata_psh_info_pool_deinit(dhdp, tcpack_sup_module);
+                               tcpack_sup_module->tcpdata_info_cnt = 0;
+                               bzero(tcpack_sup_module->tcpdata_info_tbl,
+                                       sizeof(tcpdata_info_t) * TCPDATA_INFO_MAXNUM);
+                       }
+
+                       /* For half duplex bus interface, tx precedes rx by default */
+                       if (dhdp->bus) {
+                               dhd_bus_set_dotxinrx(dhdp->bus, TRUE);
+                       }
+
+                       if (tcpack_sup_module == NULL) {
+                               DHD_ERROR(("%s[%d]: tcpack_sup_module should not be NULL\n",
+                                       __FUNCTION__, __LINE__));
+                               dhdp->tcpack_sup_mode = TCPACK_SUP_OFF;
+                               goto exit;
+                       }
+                       break;
+#endif /* BCMSDIO */
+       }
+
+       /* Update a new mode */
+       dhdp->tcpack_sup_mode = mode;
+
+       /* Process for a new mode */
+       switch (mode) {
+               case TCPACK_SUP_OFF:
+                       ASSERT(tcpack_sup_module != NULL);
+                       /* Clean up timer/data structure for
+                        * any remaining/pending packet or timer.
+                        */
+                       if (tcpack_sup_module) {
+                               /* Check if previous mode is TCAPACK_SUP_HOLD */
+                               if (prev_mode == TCPACK_SUP_HOLD) {
+                                       for (i = 0; i < TCPACK_INFO_MAXNUM; i++) {
+                                               tcpack_info_t *tcpack_info_tbl =
+                                                       &tcpack_sup_module->tcpack_info_tbl[i];
+#ifndef TCPACK_SUPPRESS_HOLD_HRT
+                                               del_timer(&tcpack_info_tbl->timer);
+#else
+                                               hrtimer_cancel(&tcpack_info_tbl->timer.timer);
+#endif /* TCPACK_SUPPRESS_HOLD_HRT */
+                                               if (tcpack_info_tbl->pkt_in_q) {
+                                                       PKTFREE(dhdp->osh,
+                                                               tcpack_info_tbl->pkt_in_q, TRUE);
+                                                       tcpack_info_tbl->pkt_in_q = NULL;
+                                               }
+                                       }
+                               }
+                               MFREE(dhdp->osh, tcpack_sup_module, sizeof(tcpack_sup_module_t));
+                               dhdp->tcpack_sup_module = NULL;
+                       } else {
+                               DHD_ERROR(("%s[%d]: tcpack_sup_module should not be NULL\n",
+                                       __FUNCTION__, __LINE__));
+                       }
+                       break;
+#ifdef BCMSDIO
+               case TCPACK_SUP_REPLACE:
+                       /* There is nothing to configure for this mode */
+                       break;
+               case TCPACK_SUP_DELAYTX:
+                       ret = _tdata_psh_info_pool_init(dhdp, tcpack_sup_module);
+                       if (ret != BCME_OK) {
+                               DHD_ERROR(("%s %d: pool init fail with %d\n",
+                                       __FUNCTION__, __LINE__, ret));
+                               break;
+                       }
+                       if (dhdp->bus) {
+                               dhd_bus_set_dotxinrx(dhdp->bus, FALSE);
+                       }
+                       break;
+#endif /* BCMSDIO */
+#ifdef BCMPCIE
+               case TCPACK_SUP_HOLD:
+                       dhdp->tcpack_sup_ratio = CUSTOM_TCPACK_SUPP_RATIO;
+                       dhdp->tcpack_sup_delay = CUSTOM_TCPACK_DELAY_TIME;
+                       for (i = 0; i < TCPACK_INFO_MAXNUM; i++) {
+                               tcpack_info_t *tcpack_info_tbl =
+                                       &tcpack_sup_module->tcpack_info_tbl[i];
+                               tcpack_info_tbl->dhdp = dhdp;
+#ifndef TCPACK_SUPPRESS_HOLD_HRT
+                               init_timer_compat(&tcpack_info_tbl->timer, dhd_tcpack_send,
+                                       tcpack_info_tbl);
+#else
+                               tasklet_hrtimer_init(&tcpack_info_tbl->timer,
+                                       dhd_tcpack_send, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+#endif /* TCPACK_SUPPRESS_HOLD_HRT */
+                       }
+                       break;
+#endif /* BCMPCIE */
+       }
+
+exit:
+       dhd_os_tcpackunlock(dhdp, flags);
+       return ret;
+}
+
+void
+dhd_tcpack_info_tbl_clean(dhd_pub_t *dhdp)
+{
+       tcpack_sup_module_t *tcpack_sup_mod = dhdp->tcpack_sup_module;
+       int i;
+       unsigned long flags;
+
+       if (dhdp->tcpack_sup_mode == TCPACK_SUP_OFF)
+               goto exit;
+
+       flags = dhd_os_tcpacklock(dhdp);
+
+       if (!tcpack_sup_mod) {
+               DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n",
+                       __FUNCTION__, __LINE__));
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto exit;
+       }
+
+       if (dhdp->tcpack_sup_mode == TCPACK_SUP_HOLD) {
+               for (i = 0; i < TCPACK_INFO_MAXNUM; i++) {
+                       if (tcpack_sup_mod->tcpack_info_tbl[i].pkt_in_q) {
+                               PKTFREE(dhdp->osh, tcpack_sup_mod->tcpack_info_tbl[i].pkt_in_q,
+                                       TRUE);
+                               tcpack_sup_mod->tcpack_info_tbl[i].pkt_in_q = NULL;
+                               tcpack_sup_mod->tcpack_info_tbl[i].pkt_ether_hdr = NULL;
+                               tcpack_sup_mod->tcpack_info_tbl[i].ifidx = 0;
+                               tcpack_sup_mod->tcpack_info_tbl[i].supp_cnt = 0;
+                       }
+               }
+       } else {
+               tcpack_sup_mod->tcpack_info_cnt = 0;
+               bzero(tcpack_sup_mod->tcpack_info_tbl, sizeof(tcpack_info_t) * TCPACK_INFO_MAXNUM);
+       }
+
+       dhd_os_tcpackunlock(dhdp, flags);
+
+       if (dhdp->tcpack_sup_mode == TCPACK_SUP_HOLD) {
+               for (i = 0; i < TCPACK_INFO_MAXNUM; i++) {
+#ifndef TCPACK_SUPPRESS_HOLD_HRT
+                       del_timer_sync(&tcpack_sup_mod->tcpack_info_tbl[i].timer);
+#else
+                       hrtimer_cancel(&tcpack_sup_mod->tcpack_info_tbl[i].timer.timer);
+#endif /* TCPACK_SUPPRESS_HOLD_HRT */
+               }
+       }
+
+exit:
+       return;
+}
+
+inline int dhd_tcpack_check_xmit(dhd_pub_t *dhdp, void *pkt)
+{
+       uint8 i;
+       tcpack_sup_module_t *tcpack_sup_mod;
+       tcpack_info_t *tcpack_info_tbl;
+       int tbl_cnt;
+       int ret = BCME_OK;
+       void *pdata;
+       uint32 pktlen;
+       unsigned long flags;
+
+       if (dhdp->tcpack_sup_mode == TCPACK_SUP_OFF)
+               goto exit;
+
+       pdata = PKTDATA(dhdp->osh, pkt);
+       pktlen = PKTLEN(dhdp->osh, pkt) - dhd_prot_hdrlen(dhdp, pdata);
+
+       if (pktlen < TCPACKSZMIN || pktlen > TCPACKSZMAX) {
+               DHD_TRACE(("%s %d: Too short or long length %d to be TCP ACK\n",
+                       __FUNCTION__, __LINE__, pktlen));
+               goto exit;
+       }
+
+       flags = dhd_os_tcpacklock(dhdp);
+       tcpack_sup_mod = dhdp->tcpack_sup_module;
+
+       if (!tcpack_sup_mod) {
+               DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n", __FUNCTION__, __LINE__));
+               ret = BCME_ERROR;
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto exit;
+       }
+       tbl_cnt = tcpack_sup_mod->tcpack_info_cnt;
+       tcpack_info_tbl = tcpack_sup_mod->tcpack_info_tbl;
+
+       ASSERT(tbl_cnt <= TCPACK_INFO_MAXNUM);
+
+       for (i = 0; i < tbl_cnt; i++) {
+               if (tcpack_info_tbl[i].pkt_in_q == pkt) {
+                       DHD_TRACE(("%s %d: pkt %p sent out. idx %d, tbl_cnt %d\n",
+                               __FUNCTION__, __LINE__, pkt, i, tbl_cnt));
+                       /* This pkt is being transmitted so remove the tcp_ack_info of it. */
+                       if (i < tbl_cnt - 1) {
+                               bcopy(&tcpack_info_tbl[tbl_cnt - 1],
+                                       &tcpack_info_tbl[i], sizeof(tcpack_info_t));
+                       }
+                       bzero(&tcpack_info_tbl[tbl_cnt - 1], sizeof(tcpack_info_t));
+                       if (--tcpack_sup_mod->tcpack_info_cnt < 0) {
+                               DHD_ERROR(("%s %d: ERROR!!! tcp_ack_info_cnt %d\n",
+                                       __FUNCTION__, __LINE__, tcpack_sup_mod->tcpack_info_cnt));
+                               ret = BCME_ERROR;
+                       }
+                       break;
+               }
+       }
+       dhd_os_tcpackunlock(dhdp, flags);
+
+exit:
+       return ret;
+}
+
+static INLINE bool dhd_tcpdata_psh_acked(dhd_pub_t *dhdp, uint8 *ip_hdr,
+       uint8 *tcp_hdr, uint32 tcp_ack_num)
+{
+       tcpack_sup_module_t *tcpack_sup_mod;
+       int i;
+       tcpdata_info_t *tcpdata_info = NULL;
+       tdata_psh_info_t *tdata_psh_info = NULL;
+       bool ret = FALSE;
+
+       if (dhdp->tcpack_sup_mode != TCPACK_SUP_DELAYTX)
+               goto exit;
+
+       tcpack_sup_mod = dhdp->tcpack_sup_module;
+
+       if (!tcpack_sup_mod) {
+               DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n", __FUNCTION__, __LINE__));
+               goto exit;
+       }
+
+       DHD_TRACE(("%s %d: IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+               " TCP port %d %d, ack %u\n", __FUNCTION__, __LINE__,
+               IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_SRC_IP_OFFSET])),
+               IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_DEST_IP_OFFSET])),
+               ntoh16_ua(&tcp_hdr[TCP_SRC_PORT_OFFSET]),
+               ntoh16_ua(&tcp_hdr[TCP_DEST_PORT_OFFSET]),
+               tcp_ack_num));
+
+       for (i = 0; i < tcpack_sup_mod->tcpdata_info_cnt; i++) {
+               tcpdata_info_t *tcpdata_info_tmp = &tcpack_sup_mod->tcpdata_info_tbl[i];
+               DHD_TRACE(("%s %d: data info[%d], IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+                       " TCP port %d %d\n", __FUNCTION__, __LINE__, i,
+                       IPV4_ADDR_TO_STR(ntoh32_ua(tcpdata_info_tmp->ip_addr.src)),
+                       IPV4_ADDR_TO_STR(ntoh32_ua(tcpdata_info_tmp->ip_addr.dst)),
+                       ntoh16_ua(tcpdata_info_tmp->tcp_port.src),
+                       ntoh16_ua(tcpdata_info_tmp->tcp_port.dst)));
+
+               /* If either IP address or TCP port number does not match, skip. */
+               if (memcmp(&ip_hdr[IPV4_SRC_IP_OFFSET],
+                       tcpdata_info_tmp->ip_addr.dst, IPV4_ADDR_LEN) == 0 &&
+                       memcmp(&ip_hdr[IPV4_DEST_IP_OFFSET],
+                       tcpdata_info_tmp->ip_addr.src, IPV4_ADDR_LEN) == 0 &&
+                       memcmp(&tcp_hdr[TCP_SRC_PORT_OFFSET],
+                       tcpdata_info_tmp->tcp_port.dst, TCP_PORT_LEN) == 0 &&
+                       memcmp(&tcp_hdr[TCP_DEST_PORT_OFFSET],
+                       tcpdata_info_tmp->tcp_port.src, TCP_PORT_LEN) == 0) {
+                       tcpdata_info = tcpdata_info_tmp;
+                       break;
+               }
+       }
+
+       if (tcpdata_info == NULL) {
+               DHD_TRACE(("%s %d: no tcpdata_info!\n", __FUNCTION__, __LINE__));
+               goto exit;
+       }
+
+       if (tcpdata_info->tdata_psh_info_head == NULL) {
+               DHD_TRACE(("%s %d: No PSH DATA to be acked!\n", __FUNCTION__, __LINE__));
+       }
+
+       while ((tdata_psh_info = tcpdata_info->tdata_psh_info_head)) {
+               if (IS_TCPSEQ_GE(tcp_ack_num, tdata_psh_info->end_seq)) {
+                       DHD_TRACE(("%s %d: PSH ACKED! %u >= %u\n",
+                               __FUNCTION__, __LINE__, tcp_ack_num, tdata_psh_info->end_seq));
+                       tcpdata_info->tdata_psh_info_head = tdata_psh_info->next;
+                       tdata_psh_info->next = NULL;
+                       _tdata_psh_info_pool_enq(tcpack_sup_mod, tdata_psh_info);
+                       ret = TRUE;
+               } else
+                       break;
+       }
+       if (tdata_psh_info == NULL)
+               tcpdata_info->tdata_psh_info_tail = NULL;
+
+#ifdef DHDTCPACK_SUP_DBG
+       DHD_TRACE(("%s %d: PSH INFO ENQ %d\n",
+               __FUNCTION__, __LINE__, tcpack_sup_mod->psh_info_enq_num));
+#endif /* DHDTCPACK_SUP_DBG */
+
+exit:
+       return ret;
+}
+
+bool
+dhd_tcpack_suppress(dhd_pub_t *dhdp, void *pkt)
+{
+       uint8 *new_ether_hdr;   /* Ethernet header of the new packet */
+       uint16 new_ether_type;  /* Ethernet type of the new packet */
+       uint8 *new_ip_hdr;              /* IP header of the new packet */
+       uint8 *new_tcp_hdr;             /* TCP header of the new packet */
+       uint32 new_ip_hdr_len;  /* IP header length of the new packet */
+       uint32 cur_framelen;
+       uint32 new_tcp_ack_num;         /* TCP acknowledge number of the new packet */
+       uint16 new_ip_total_len;        /* Total length of IP packet for the new packet */
+       uint32 new_tcp_hdr_len;         /* TCP header length of the new packet */
+       tcpack_sup_module_t *tcpack_sup_mod;
+       tcpack_info_t *tcpack_info_tbl;
+       int i;
+       bool ret = FALSE;
+       bool set_dotxinrx = TRUE;
+       unsigned long flags;
+
+       if (dhdp->tcpack_sup_mode == TCPACK_SUP_OFF)
+               goto exit;
+
+       new_ether_hdr = PKTDATA(dhdp->osh, pkt);
+       cur_framelen = PKTLEN(dhdp->osh, pkt);
+
+       if (cur_framelen < TCPACKSZMIN || cur_framelen > TCPACKSZMAX) {
+               DHD_TRACE(("%s %d: Too short or long length %d to be TCP ACK\n",
+                       __FUNCTION__, __LINE__, cur_framelen));
+               goto exit;
+       }
+
+       new_ether_type = new_ether_hdr[12] << 8 | new_ether_hdr[13];
+
+       if (new_ether_type != ETHER_TYPE_IP) {
+               DHD_TRACE(("%s %d: Not a IP packet 0x%x\n",
+                       __FUNCTION__, __LINE__, new_ether_type));
+               goto exit;
+       }
+
+       DHD_TRACE(("%s %d: IP pkt! 0x%x\n", __FUNCTION__, __LINE__, new_ether_type));
+
+       new_ip_hdr = new_ether_hdr + ETHER_HDR_LEN;
+       cur_framelen -= ETHER_HDR_LEN;
+
+       ASSERT(cur_framelen >= IPV4_MIN_HEADER_LEN);
+
+       new_ip_hdr_len = IPV4_HLEN(new_ip_hdr);
+       if (IP_VER(new_ip_hdr) != IP_VER_4 || IPV4_PROT(new_ip_hdr) != IP_PROT_TCP) {
+               DHD_TRACE(("%s %d: Not IPv4 nor TCP! ip ver %d, prot %d\n",
+                       __FUNCTION__, __LINE__, IP_VER(new_ip_hdr), IPV4_PROT(new_ip_hdr)));
+               goto exit;
+       }
+
+       new_tcp_hdr = new_ip_hdr + new_ip_hdr_len;
+       cur_framelen -= new_ip_hdr_len;
+
+       ASSERT(cur_framelen >= TCP_MIN_HEADER_LEN);
+
+       DHD_TRACE(("%s %d: TCP pkt!\n", __FUNCTION__, __LINE__));
+
+       /* is it an ack ? Allow only ACK flag, not to suppress others. */
+       if (new_tcp_hdr[TCP_FLAGS_OFFSET] != TCP_FLAG_ACK) {
+               DHD_TRACE(("%s %d: Do not touch TCP flag 0x%x\n",
+                       __FUNCTION__, __LINE__, new_tcp_hdr[TCP_FLAGS_OFFSET]));
+               goto exit;
+       }
+
+       new_ip_total_len = ntoh16_ua(&new_ip_hdr[IPV4_PKTLEN_OFFSET]);
+       new_tcp_hdr_len = 4 * TCP_HDRLEN(new_tcp_hdr[TCP_HLEN_OFFSET]);
+
+       /* This packet has TCP data, so just send */
+       if (new_ip_total_len > new_ip_hdr_len + new_tcp_hdr_len) {
+               DHD_TRACE(("%s %d: Do nothing for TCP DATA\n", __FUNCTION__, __LINE__));
+               goto exit;
+       }
+
+       ASSERT(new_ip_total_len == new_ip_hdr_len + new_tcp_hdr_len);
+
+       new_tcp_ack_num = ntoh32_ua(&new_tcp_hdr[TCP_ACK_NUM_OFFSET]);
+
+       DHD_TRACE(("%s %d: TCP ACK with zero DATA length"
+               " IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR" TCP port %d %d\n",
+               __FUNCTION__, __LINE__,
+               IPV4_ADDR_TO_STR(ntoh32_ua(&new_ip_hdr[IPV4_SRC_IP_OFFSET])),
+               IPV4_ADDR_TO_STR(ntoh32_ua(&new_ip_hdr[IPV4_DEST_IP_OFFSET])),
+               ntoh16_ua(&new_tcp_hdr[TCP_SRC_PORT_OFFSET]),
+               ntoh16_ua(&new_tcp_hdr[TCP_DEST_PORT_OFFSET])));
+
+       /* Look for tcp_ack_info that has the same ip src/dst addrs and tcp src/dst ports */
+       flags = dhd_os_tcpacklock(dhdp);
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+       counter_printlog(&tack_tbl);
+       tack_tbl.cnt[0]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+
+       tcpack_sup_mod = dhdp->tcpack_sup_module;
+       tcpack_info_tbl = tcpack_sup_mod->tcpack_info_tbl;
+
+       if (!tcpack_sup_mod) {
+               DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n", __FUNCTION__, __LINE__));
+               ret = BCME_ERROR;
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto exit;
+       }
+
+       if (dhd_tcpdata_psh_acked(dhdp, new_ip_hdr, new_tcp_hdr, new_tcp_ack_num)) {
+               /* This TCPACK is ACK to TCPDATA PSH pkt, so keep set_dotxinrx TRUE */
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+               tack_tbl.cnt[5]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+       } else
+               set_dotxinrx = FALSE;
+
+       for (i = 0; i < tcpack_sup_mod->tcpack_info_cnt; i++) {
+               void *oldpkt;   /* TCPACK packet that is already in txq or DelayQ */
+               uint8 *old_ether_hdr, *old_ip_hdr, *old_tcp_hdr;
+               uint32 old_ip_hdr_len, old_tcp_hdr_len;
+               uint32 old_tcpack_num;  /* TCP ACK number of old TCPACK packet in Q */
+
+               if ((oldpkt = tcpack_info_tbl[i].pkt_in_q) == NULL) {
+                       DHD_ERROR(("%s %d: Unexpected error!! cur idx %d, ttl cnt %d\n",
+                               __FUNCTION__, __LINE__, i, tcpack_sup_mod->tcpack_info_cnt));
+                       break;
+               }
+
+               if (PKTDATA(dhdp->osh, oldpkt) == NULL) {
+                       DHD_ERROR(("%s %d: oldpkt data NULL!! cur idx %d, ttl cnt %d\n",
+                               __FUNCTION__, __LINE__, i, tcpack_sup_mod->tcpack_info_cnt));
+                       break;
+               }
+
+               old_ether_hdr = tcpack_info_tbl[i].pkt_ether_hdr;
+               old_ip_hdr = old_ether_hdr + ETHER_HDR_LEN;
+               old_ip_hdr_len = IPV4_HLEN(old_ip_hdr);
+               old_tcp_hdr = old_ip_hdr + old_ip_hdr_len;
+               old_tcp_hdr_len = 4 * TCP_HDRLEN(old_tcp_hdr[TCP_HLEN_OFFSET]);
+
+               DHD_TRACE(("%s %d: oldpkt %p[%d], IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+                       " TCP port %d %d\n", __FUNCTION__, __LINE__, oldpkt, i,
+                       IPV4_ADDR_TO_STR(ntoh32_ua(&old_ip_hdr[IPV4_SRC_IP_OFFSET])),
+                       IPV4_ADDR_TO_STR(ntoh32_ua(&old_ip_hdr[IPV4_DEST_IP_OFFSET])),
+                       ntoh16_ua(&old_tcp_hdr[TCP_SRC_PORT_OFFSET]),
+                       ntoh16_ua(&old_tcp_hdr[TCP_DEST_PORT_OFFSET])));
+
+               /* If either of IP address or TCP port number does not match, skip.
+                * Note that src/dst addr fields in ip header are contiguous being 8 bytes in total.
+                * Also, src/dst port fields in TCP header are contiguous being 4 bytes in total.
+                */
+               if (memcmp(&new_ip_hdr[IPV4_SRC_IP_OFFSET],
+                       &old_ip_hdr[IPV4_SRC_IP_OFFSET], IPV4_ADDR_LEN * 2) ||
+                       memcmp(&new_tcp_hdr[TCP_SRC_PORT_OFFSET],
+                       &old_tcp_hdr[TCP_SRC_PORT_OFFSET], TCP_PORT_LEN * 2))
+                       continue;
+
+               old_tcpack_num = ntoh32_ua(&old_tcp_hdr[TCP_ACK_NUM_OFFSET]);
+
+               if (IS_TCPSEQ_GT(new_tcp_ack_num, old_tcpack_num)) {
+                       /* New packet has higher TCP ACK number, so it replaces the old packet */
+                       if (new_ip_hdr_len == old_ip_hdr_len &&
+                               new_tcp_hdr_len == old_tcp_hdr_len) {
+                               ASSERT(memcmp(new_ether_hdr, old_ether_hdr, ETHER_HDR_LEN) == 0);
+                               bcopy(new_ip_hdr, old_ip_hdr, new_ip_total_len);
+                               PKTFREE(dhdp->osh, pkt, FALSE);
+                               DHD_TRACE(("%s %d: TCP ACK replace %u -> %u\n",
+                                       __FUNCTION__, __LINE__, old_tcpack_num, new_tcp_ack_num));
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+                               tack_tbl.cnt[2]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+                               ret = TRUE;
+                       } else {
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+                               tack_tbl.cnt[6]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+                               DHD_TRACE(("%s %d: lenth mismatch %d != %d || %d != %d"
+                                       " ACK %u -> %u\n", __FUNCTION__, __LINE__,
+                                       new_ip_hdr_len, old_ip_hdr_len,
+                                       new_tcp_hdr_len, old_tcp_hdr_len,
+                                       old_tcpack_num, new_tcp_ack_num));
+                       }
+               } else if (new_tcp_ack_num == old_tcpack_num) {
+                       set_dotxinrx = TRUE;
+                       /* TCPACK retransmission */
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+                       tack_tbl.cnt[3]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+               } else {
+                       DHD_TRACE(("%s %d: ACK number reverse old %u(0x%p) new %u(0x%p)\n",
+                               __FUNCTION__, __LINE__, old_tcpack_num, oldpkt,
+                               new_tcp_ack_num, pkt));
+               }
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto exit;
+       }
+
+       if (i == tcpack_sup_mod->tcpack_info_cnt && i < TCPACK_INFO_MAXNUM) {
+               /* No TCPACK packet with the same IP addr and TCP port is found
+                * in tcp_ack_info_tbl. So add this packet to the table.
+                */
+               DHD_TRACE(("%s %d: Add pkt 0x%p(ether_hdr 0x%p) to tbl[%d]\n",
+                       __FUNCTION__, __LINE__, pkt, new_ether_hdr,
+                       tcpack_sup_mod->tcpack_info_cnt));
+
+               tcpack_info_tbl[tcpack_sup_mod->tcpack_info_cnt].pkt_in_q = pkt;
+               tcpack_info_tbl[tcpack_sup_mod->tcpack_info_cnt].pkt_ether_hdr = new_ether_hdr;
+               tcpack_sup_mod->tcpack_info_cnt++;
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+               tack_tbl.cnt[1]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+       } else {
+               ASSERT(i == tcpack_sup_mod->tcpack_info_cnt);
+               DHD_TRACE(("%s %d: No empty tcp ack info tbl\n",
+                       __FUNCTION__, __LINE__));
+       }
+       dhd_os_tcpackunlock(dhdp, flags);
+
+exit:
+       /* Unless TCPACK_SUP_DELAYTX, dotxinrx is alwasy TRUE, so no need to set here */
+       if (dhdp->tcpack_sup_mode == TCPACK_SUP_DELAYTX && set_dotxinrx)
+               dhd_bus_set_dotxinrx(dhdp->bus, TRUE);
+
+       return ret;
+}
+
+bool
+dhd_tcpdata_info_get(dhd_pub_t *dhdp, void *pkt)
+{
+       uint8 *ether_hdr;       /* Ethernet header of the new packet */
+       uint16 ether_type;      /* Ethernet type of the new packet */
+       uint8 *ip_hdr;          /* IP header of the new packet */
+       uint8 *tcp_hdr;         /* TCP header of the new packet */
+       uint32 ip_hdr_len;      /* IP header length of the new packet */
+       uint32 cur_framelen;
+       uint16 ip_total_len;    /* Total length of IP packet for the new packet */
+       uint32 tcp_hdr_len;             /* TCP header length of the new packet */
+       uint32 tcp_seq_num;             /* TCP sequence number of the new packet */
+       uint16 tcp_data_len;    /* TCP DATA length that excludes IP and TCP headers */
+       uint32 end_tcp_seq_num; /* TCP seq number of the last byte in the new packet */
+       tcpack_sup_module_t *tcpack_sup_mod;
+       tcpdata_info_t *tcpdata_info = NULL;
+       tdata_psh_info_t *tdata_psh_info;
+
+       int i;
+       bool ret = FALSE;
+       unsigned long flags;
+
+       if (dhdp->tcpack_sup_mode != TCPACK_SUP_DELAYTX)
+               goto exit;
+
+       ether_hdr = PKTDATA(dhdp->osh, pkt);
+       cur_framelen = PKTLEN(dhdp->osh, pkt);
+
+       ether_type = ether_hdr[12] << 8 | ether_hdr[13];
+
+       if (ether_type != ETHER_TYPE_IP) {
+               DHD_TRACE(("%s %d: Not a IP packet 0x%x\n",
+                       __FUNCTION__, __LINE__, ether_type));
+               goto exit;
+       }
+
+       DHD_TRACE(("%s %d: IP pkt! 0x%x\n", __FUNCTION__, __LINE__, ether_type));
+
+       ip_hdr = ether_hdr + ETHER_HDR_LEN;
+       cur_framelen -= ETHER_HDR_LEN;
+
+       ASSERT(cur_framelen >= IPV4_MIN_HEADER_LEN);
+
+       ip_hdr_len = IPV4_HLEN(ip_hdr);
+       if (IP_VER(ip_hdr) != IP_VER_4 || IPV4_PROT(ip_hdr) != IP_PROT_TCP) {
+               DHD_TRACE(("%s %d: Not IPv4 nor TCP! ip ver %d, prot %d\n",
+                       __FUNCTION__, __LINE__, IP_VER(ip_hdr), IPV4_PROT(ip_hdr)));
+               goto exit;
+       }
+
+       tcp_hdr = ip_hdr + ip_hdr_len;
+       cur_framelen -= ip_hdr_len;
+
+       ASSERT(cur_framelen >= TCP_MIN_HEADER_LEN);
+
+       DHD_TRACE(("%s %d: TCP pkt!\n", __FUNCTION__, __LINE__));
+
+       ip_total_len = ntoh16_ua(&ip_hdr[IPV4_PKTLEN_OFFSET]);
+       tcp_hdr_len = 4 * TCP_HDRLEN(tcp_hdr[TCP_HLEN_OFFSET]);
+
+       /* This packet is mere TCP ACK, so do nothing */
+       if (ip_total_len == ip_hdr_len + tcp_hdr_len) {
+               DHD_TRACE(("%s %d: Do nothing for no data TCP ACK\n", __FUNCTION__, __LINE__));
+               goto exit;
+       }
+
+       ASSERT(ip_total_len > ip_hdr_len + tcp_hdr_len);
+
+       if ((tcp_hdr[TCP_FLAGS_OFFSET] & TCP_FLAG_PSH) == 0) {
+               DHD_TRACE(("%s %d: Not interested TCP DATA packet\n", __FUNCTION__, __LINE__));
+               goto exit;
+       }
+
+       DHD_TRACE(("%s %d: TCP DATA with nonzero DATA length"
+               " IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR" TCP port %d %d, flag 0x%x\n",
+               __FUNCTION__, __LINE__,
+               IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_SRC_IP_OFFSET])),
+               IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_DEST_IP_OFFSET])),
+               ntoh16_ua(&tcp_hdr[TCP_SRC_PORT_OFFSET]),
+               ntoh16_ua(&tcp_hdr[TCP_DEST_PORT_OFFSET]),
+               tcp_hdr[TCP_FLAGS_OFFSET]));
+
+       flags = dhd_os_tcpacklock(dhdp);
+       tcpack_sup_mod = dhdp->tcpack_sup_module;
+
+       if (!tcpack_sup_mod) {
+               DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n", __FUNCTION__, __LINE__));
+               ret = BCME_ERROR;
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto exit;
+       }
+
+       /* Look for tcpdata_info that has the same ip src/dst addrs and tcp src/dst ports */
+       i = 0;
+       while (i < tcpack_sup_mod->tcpdata_info_cnt) {
+               tcpdata_info_t *tdata_info_tmp = &tcpack_sup_mod->tcpdata_info_tbl[i];
+               uint32 now_in_ms = OSL_SYSUPTIME();
+               DHD_TRACE(("%s %d: data info[%d], IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+                       " TCP port %d %d\n", __FUNCTION__, __LINE__, i,
+                       IPV4_ADDR_TO_STR(ntoh32_ua(tdata_info_tmp->ip_addr.src)),
+                       IPV4_ADDR_TO_STR(ntoh32_ua(tdata_info_tmp->ip_addr.dst)),
+                       ntoh16_ua(tdata_info_tmp->tcp_port.src),
+                       ntoh16_ua(tdata_info_tmp->tcp_port.dst)));
+
+               /* If both IP address and TCP port number match, we found it so break.
+                * Note that src/dst addr fields in ip header are contiguous being 8 bytes in total.
+                * Also, src/dst port fields in TCP header are contiguous being 4 bytes in total.
+                */
+               if (memcmp(&ip_hdr[IPV4_SRC_IP_OFFSET],
+                       (void *)&tdata_info_tmp->ip_addr, IPV4_ADDR_LEN * 2) == 0 &&
+                       memcmp(&tcp_hdr[TCP_SRC_PORT_OFFSET],
+                       (void *)&tdata_info_tmp->tcp_port, TCP_PORT_LEN * 2) == 0) {
+                       tcpdata_info = tdata_info_tmp;
+                       tcpdata_info->last_used_time = now_in_ms;
+                       break;
+               }
+
+               if (now_in_ms - tdata_info_tmp->last_used_time > TCPDATA_INFO_TIMEOUT) {
+                       tdata_psh_info_t *tdata_psh_info_tmp;
+                       tcpdata_info_t *last_tdata_info;
+
+                       while ((tdata_psh_info_tmp = tdata_info_tmp->tdata_psh_info_head)) {
+                               tdata_info_tmp->tdata_psh_info_head = tdata_psh_info_tmp->next;
+                               tdata_psh_info_tmp->next = NULL;
+                               DHD_TRACE(("%s %d: Clean tdata_psh_info(end_seq %u)!\n",
+                                       __FUNCTION__, __LINE__, tdata_psh_info_tmp->end_seq));
+                               _tdata_psh_info_pool_enq(tcpack_sup_mod, tdata_psh_info_tmp);
+                       }
+#ifdef DHDTCPACK_SUP_DBG
+                       DHD_ERROR(("%s %d: PSH INFO ENQ %d\n",
+                               __FUNCTION__, __LINE__, tcpack_sup_mod->psh_info_enq_num));
+#endif /* DHDTCPACK_SUP_DBG */
+                       tcpack_sup_mod->tcpdata_info_cnt--;
+                       ASSERT(tcpack_sup_mod->tcpdata_info_cnt >= 0);
+
+                       last_tdata_info =
+                               &tcpack_sup_mod->tcpdata_info_tbl[tcpack_sup_mod->tcpdata_info_cnt];
+                       if (i < tcpack_sup_mod->tcpdata_info_cnt) {
+                               ASSERT(last_tdata_info != tdata_info_tmp);
+                               bcopy(last_tdata_info, tdata_info_tmp, sizeof(tcpdata_info_t));
+                       }
+                       bzero(last_tdata_info, sizeof(tcpdata_info_t));
+                       DHD_INFO(("%s %d: tcpdata_info(idx %d) is aged out. ttl cnt is now %d\n",
+                               __FUNCTION__, __LINE__, i, tcpack_sup_mod->tcpdata_info_cnt));
+                       /* Don't increase "i" here, so that the prev last tcpdata_info is checked */
+               } else
+                        i++;
+       }
+
+       tcp_seq_num = ntoh32_ua(&tcp_hdr[TCP_SEQ_NUM_OFFSET]);
+       tcp_data_len = ip_total_len - ip_hdr_len - tcp_hdr_len;
+       end_tcp_seq_num = tcp_seq_num + tcp_data_len;
+
+       if (tcpdata_info == NULL) {
+               ASSERT(i == tcpack_sup_mod->tcpdata_info_cnt);
+               if (i >= TCPDATA_INFO_MAXNUM) {
+                       DHD_TRACE(("%s %d: tcp_data_info_tbl FULL! %d %d"
+                               " IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR" TCP port %d %d\n",
+                               __FUNCTION__, __LINE__, i, tcpack_sup_mod->tcpdata_info_cnt,
+                               IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_SRC_IP_OFFSET])),
+                               IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_DEST_IP_OFFSET])),
+                               ntoh16_ua(&tcp_hdr[TCP_SRC_PORT_OFFSET]),
+                               ntoh16_ua(&tcp_hdr[TCP_DEST_PORT_OFFSET])));
+                       dhd_os_tcpackunlock(dhdp, flags);
+                       goto exit;
+               }
+               tcpdata_info = &tcpack_sup_mod->tcpdata_info_tbl[i];
+
+               /* No TCP flow with the same IP addr and TCP port is found
+                * in tcp_data_info_tbl. So add this flow to the table.
+                */
+               DHD_INFO(("%s %d: Add data info to tbl[%d]: IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+                       " TCP port %d %d\n",
+                       __FUNCTION__, __LINE__, tcpack_sup_mod->tcpdata_info_cnt,
+                       IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_SRC_IP_OFFSET])),
+                       IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_DEST_IP_OFFSET])),
+                       ntoh16_ua(&tcp_hdr[TCP_SRC_PORT_OFFSET]),
+                       ntoh16_ua(&tcp_hdr[TCP_DEST_PORT_OFFSET])));
+               /* Note that src/dst addr fields in ip header are contiguous being 8 bytes in total.
+                * Also, src/dst port fields in TCP header are contiguous being 4 bytes in total.
+                */
+               bcopy(&ip_hdr[IPV4_SRC_IP_OFFSET], (void *)&tcpdata_info->ip_addr,
+                       IPV4_ADDR_LEN * 2);
+               bcopy(&tcp_hdr[TCP_SRC_PORT_OFFSET], (void *)&tcpdata_info->tcp_port,
+                       TCP_PORT_LEN * 2);
+
+               tcpdata_info->last_used_time = OSL_SYSUPTIME();
+               tcpack_sup_mod->tcpdata_info_cnt++;
+       }
+
+       ASSERT(tcpdata_info != NULL);
+
+       tdata_psh_info = _tdata_psh_info_pool_deq(tcpack_sup_mod);
+#ifdef DHDTCPACK_SUP_DBG
+       DHD_TRACE(("%s %d: PSH INFO ENQ %d\n",
+               __FUNCTION__, __LINE__, tcpack_sup_mod->psh_info_enq_num));
+#endif /* DHDTCPACK_SUP_DBG */
+
+       if (tdata_psh_info == NULL) {
+               DHD_ERROR(("%s %d: No more free tdata_psh_info!!\n", __FUNCTION__, __LINE__));
+               ret = BCME_ERROR;
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto exit;
+       }
+       tdata_psh_info->end_seq = end_tcp_seq_num;
+
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+       tack_tbl.cnt[4]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+
+       DHD_TRACE(("%s %d: TCP PSH DATA recvd! end seq %u\n",
+               __FUNCTION__, __LINE__, tdata_psh_info->end_seq));
+
+       ASSERT(tdata_psh_info->next == NULL);
+
+       if (tcpdata_info->tdata_psh_info_head == NULL)
+               tcpdata_info->tdata_psh_info_head = tdata_psh_info;
+       else {
+               ASSERT(tcpdata_info->tdata_psh_info_tail);
+               tcpdata_info->tdata_psh_info_tail->next = tdata_psh_info;
+       }
+       tcpdata_info->tdata_psh_info_tail = tdata_psh_info;
+
+       dhd_os_tcpackunlock(dhdp, flags);
+
+exit:
+       return ret;
+}
+
+bool
+dhd_tcpack_hold(dhd_pub_t *dhdp, void *pkt, int ifidx)
+{
+       uint8 *new_ether_hdr;   /* Ethernet header of the new packet */
+       uint16 new_ether_type;  /* Ethernet type of the new packet */
+       uint8 *new_ip_hdr;              /* IP header of the new packet */
+       uint8 *new_tcp_hdr;             /* TCP header of the new packet */
+       uint32 new_ip_hdr_len;  /* IP header length of the new packet */
+       uint32 cur_framelen;
+       uint32 new_tcp_ack_num;         /* TCP acknowledge number of the new packet */
+       uint16 new_ip_total_len;        /* Total length of IP packet for the new packet */
+       uint32 new_tcp_hdr_len;         /* TCP header length of the new packet */
+       tcpack_sup_module_t *tcpack_sup_mod;
+       tcpack_info_t *tcpack_info_tbl;
+       int i, free_slot = TCPACK_INFO_MAXNUM;
+       bool hold = FALSE;
+       unsigned long flags;
+
+       if (dhdp->tcpack_sup_mode != TCPACK_SUP_HOLD) {
+               goto exit;
+       }
+
+       if (dhdp->tcpack_sup_ratio == 1) {
+               goto exit;
+       }
+
+       new_ether_hdr = PKTDATA(dhdp->osh, pkt);
+       cur_framelen = PKTLEN(dhdp->osh, pkt);
+
+       if (cur_framelen < TCPACKSZMIN || cur_framelen > TCPACKSZMAX) {
+               DHD_TRACE(("%s %d: Too short or long length %d to be TCP ACK\n",
+                       __FUNCTION__, __LINE__, cur_framelen));
+               goto exit;
+       }
+
+       new_ether_type = new_ether_hdr[12] << 8 | new_ether_hdr[13];
+
+       if (new_ether_type != ETHER_TYPE_IP) {
+               DHD_TRACE(("%s %d: Not a IP packet 0x%x\n",
+                       __FUNCTION__, __LINE__, new_ether_type));
+               goto exit;
+       }
+
+       DHD_TRACE(("%s %d: IP pkt! 0x%x\n", __FUNCTION__, __LINE__, new_ether_type));
+
+       new_ip_hdr = new_ether_hdr + ETHER_HDR_LEN;
+       cur_framelen -= ETHER_HDR_LEN;
+
+       ASSERT(cur_framelen >= IPV4_MIN_HEADER_LEN);
+
+       new_ip_hdr_len = IPV4_HLEN(new_ip_hdr);
+       if (IP_VER(new_ip_hdr) != IP_VER_4 || IPV4_PROT(new_ip_hdr) != IP_PROT_TCP) {
+               DHD_TRACE(("%s %d: Not IPv4 nor TCP! ip ver %d, prot %d\n",
+                       __FUNCTION__, __LINE__, IP_VER(new_ip_hdr), IPV4_PROT(new_ip_hdr)));
+               goto exit;
+       }
+
+       new_tcp_hdr = new_ip_hdr + new_ip_hdr_len;
+       cur_framelen -= new_ip_hdr_len;
+
+       ASSERT(cur_framelen >= TCP_MIN_HEADER_LEN);
+
+       DHD_TRACE(("%s %d: TCP pkt!\n", __FUNCTION__, __LINE__));
+
+       /* is it an ack ? Allow only ACK flag, not to suppress others. */
+       if (new_tcp_hdr[TCP_FLAGS_OFFSET] != TCP_FLAG_ACK) {
+               DHD_TRACE(("%s %d: Do not touch TCP flag 0x%x\n",
+                       __FUNCTION__, __LINE__, new_tcp_hdr[TCP_FLAGS_OFFSET]));
+               goto exit;
+       }
+
+       new_ip_total_len = ntoh16_ua(&new_ip_hdr[IPV4_PKTLEN_OFFSET]);
+       new_tcp_hdr_len = 4 * TCP_HDRLEN(new_tcp_hdr[TCP_HLEN_OFFSET]);
+
+       /* This packet has TCP data, so just send */
+       if (new_ip_total_len > new_ip_hdr_len + new_tcp_hdr_len) {
+               DHD_TRACE(("%s %d: Do nothing for TCP DATA\n", __FUNCTION__, __LINE__));
+               goto exit;
+       }
+
+       ASSERT(new_ip_total_len == new_ip_hdr_len + new_tcp_hdr_len);
+
+       new_tcp_ack_num = ntoh32_ua(&new_tcp_hdr[TCP_ACK_NUM_OFFSET]);
+
+       DHD_TRACE(("%s %d: TCP ACK with zero DATA length"
+               " IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR" TCP port %d %d\n",
+               __FUNCTION__, __LINE__,
+               IPV4_ADDR_TO_STR(ntoh32_ua(&new_ip_hdr[IPV4_SRC_IP_OFFSET])),
+               IPV4_ADDR_TO_STR(ntoh32_ua(&new_ip_hdr[IPV4_DEST_IP_OFFSET])),
+               ntoh16_ua(&new_tcp_hdr[TCP_SRC_PORT_OFFSET]),
+               ntoh16_ua(&new_tcp_hdr[TCP_DEST_PORT_OFFSET])));
+
+       /* Look for tcp_ack_info that has the same ip src/dst addrs and tcp src/dst ports */
+       flags = dhd_os_tcpacklock(dhdp);
+
+       tcpack_sup_mod = dhdp->tcpack_sup_module;
+       tcpack_info_tbl = tcpack_sup_mod->tcpack_info_tbl;
+
+       if (!tcpack_sup_mod) {
+               DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n", __FUNCTION__, __LINE__));
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto exit;
+       }
+
+       hold = TRUE;
+
+       for (i = 0; i < TCPACK_INFO_MAXNUM; i++) {
+               void *oldpkt;   /* TCPACK packet that is already in txq or DelayQ */
+               uint8 *old_ether_hdr, *old_ip_hdr, *old_tcp_hdr;
+               uint32 old_ip_hdr_len;
+               uint32 old_tcpack_num;  /* TCP ACK number of old TCPACK packet in Q */
+
+               if ((oldpkt = tcpack_info_tbl[i].pkt_in_q) == NULL) {
+                       if (free_slot == TCPACK_INFO_MAXNUM) {
+                               free_slot = i;
+                       }
+                       continue;
+               }
+
+               if (PKTDATA(dhdp->osh, oldpkt) == NULL) {
+                       DHD_ERROR(("%s %d: oldpkt data NULL!! cur idx %d\n",
+                               __FUNCTION__, __LINE__, i));
+                       hold = FALSE;
+                       dhd_os_tcpackunlock(dhdp, flags);
+                       goto exit;
+               }
+
+               old_ether_hdr = tcpack_info_tbl[i].pkt_ether_hdr;
+               old_ip_hdr = old_ether_hdr + ETHER_HDR_LEN;
+               old_ip_hdr_len = IPV4_HLEN(old_ip_hdr);
+               old_tcp_hdr = old_ip_hdr + old_ip_hdr_len;
+
+               DHD_TRACE(("%s %d: oldpkt %p[%d], IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+                       " TCP port %d %d\n", __FUNCTION__, __LINE__, oldpkt, i,
+                       IPV4_ADDR_TO_STR(ntoh32_ua(&old_ip_hdr[IPV4_SRC_IP_OFFSET])),
+                       IPV4_ADDR_TO_STR(ntoh32_ua(&old_ip_hdr[IPV4_DEST_IP_OFFSET])),
+                       ntoh16_ua(&old_tcp_hdr[TCP_SRC_PORT_OFFSET]),
+                       ntoh16_ua(&old_tcp_hdr[TCP_DEST_PORT_OFFSET])));
+
+               /* If either of IP address or TCP port number does not match, skip. */
+               if (memcmp(&new_ip_hdr[IPV4_SRC_IP_OFFSET],
+                       &old_ip_hdr[IPV4_SRC_IP_OFFSET], IPV4_ADDR_LEN * 2) ||
+                       memcmp(&new_tcp_hdr[TCP_SRC_PORT_OFFSET],
+                       &old_tcp_hdr[TCP_SRC_PORT_OFFSET], TCP_PORT_LEN * 2)) {
+                       continue;
+               }
+
+               old_tcpack_num = ntoh32_ua(&old_tcp_hdr[TCP_ACK_NUM_OFFSET]);
+
+               if (IS_TCPSEQ_GE(new_tcp_ack_num, old_tcpack_num)) {
+                       tcpack_info_tbl[i].supp_cnt++;
+                       if (tcpack_info_tbl[i].supp_cnt >= dhdp->tcpack_sup_ratio) {
+                               tcpack_info_tbl[i].pkt_in_q = NULL;
+                               tcpack_info_tbl[i].pkt_ether_hdr = NULL;
+                               tcpack_info_tbl[i].ifidx = 0;
+                               tcpack_info_tbl[i].supp_cnt = 0;
+                               hold = FALSE;
+                       } else {
+                               tcpack_info_tbl[i].pkt_in_q = pkt;
+                               tcpack_info_tbl[i].pkt_ether_hdr = new_ether_hdr;
+                               tcpack_info_tbl[i].ifidx = ifidx;
+                       }
+                       PKTFREE(dhdp->osh, oldpkt, TRUE);
+               } else {
+                       PKTFREE(dhdp->osh, pkt, TRUE);
+               }
+               dhd_os_tcpackunlock(dhdp, flags);
+
+               if (!hold) {
+#ifndef TCPACK_SUPPRESS_HOLD_HRT
+                       del_timer_sync(&tcpack_info_tbl[i].timer);
+#else
+                       hrtimer_cancel(&tcpack_sup_mod->tcpack_info_tbl[i].timer.timer);
+#endif /* TCPACK_SUPPRESS_HOLD_HRT */
+               }
+               goto exit;
+       }
+
+       if (free_slot < TCPACK_INFO_MAXNUM) {
+               /* No TCPACK packet with the same IP addr and TCP port is found
+                * in tcp_ack_info_tbl. So add this packet to the table.
+                */
+               DHD_TRACE(("%s %d: Add pkt 0x%p(ether_hdr 0x%p) to tbl[%d]\n",
+                       __FUNCTION__, __LINE__, pkt, new_ether_hdr,
+                       free_slot));
+
+               tcpack_info_tbl[free_slot].pkt_in_q = pkt;
+               tcpack_info_tbl[free_slot].pkt_ether_hdr = new_ether_hdr;
+               tcpack_info_tbl[free_slot].ifidx = ifidx;
+               tcpack_info_tbl[free_slot].supp_cnt = 1;
+#ifndef TCPACK_SUPPRESS_HOLD_HRT
+               mod_timer(&tcpack_sup_mod->tcpack_info_tbl[free_slot].timer,
+                       jiffies + msecs_to_jiffies(dhdp->tcpack_sup_delay));
+#else
+               tasklet_hrtimer_start(&tcpack_sup_mod->tcpack_info_tbl[free_slot].timer,
+                       ktime_set(0, dhdp->tcpack_sup_delay*1000000),
+                       HRTIMER_MODE_REL);
+#endif /* TCPACK_SUPPRESS_HOLD_HRT */
+               tcpack_sup_mod->tcpack_info_cnt++;
+       } else {
+               DHD_TRACE(("%s %d: No empty tcp ack info tbl\n",
+                       __FUNCTION__, __LINE__));
+       }
+       dhd_os_tcpackunlock(dhdp, flags);
+
+exit:
+       return hold;
+}
+#endif /* DHDTCPACK_SUPPRESS */
+
+#ifdef DHDTCPSYNC_FLOOD_BLK
+tcp_hdr_flag_t
+dhd_tcpdata_get_flag(dhd_pub_t *dhdp, void *pkt)
+{
+       uint8 *ether_hdr;       /* Ethernet header of the new packet */
+       uint16 ether_type;      /* Ethernet type of the new packet */
+       uint8 *ip_hdr;          /* IP header of the new packet */
+       uint8 *tcp_hdr;         /* TCP header of the new packet */
+       uint32 ip_hdr_len;      /* IP header length of the new packet */
+       uint32 cur_framelen;
+       uint8 flags;
+
+       ether_hdr = PKTDATA(dhdp->osh, pkt);
+       cur_framelen = PKTLEN(dhdp->osh, pkt);
+
+       ether_type = ether_hdr[12] << 8 | ether_hdr[13];
+
+       if (ether_type != ETHER_TYPE_IP) {
+               DHD_TRACE(("%s %d: Not a IP packet 0x%x\n",
+                       __FUNCTION__, __LINE__, ether_type));
+               return FLAG_OTHERS;
+       }
+
+       ip_hdr = ether_hdr + ETHER_HDR_LEN;
+       cur_framelen -= ETHER_HDR_LEN;
+
+       if (cur_framelen < IPV4_MIN_HEADER_LEN) {
+               return FLAG_OTHERS;
+       }
+
+       ip_hdr_len = IPV4_HLEN(ip_hdr);
+       if (IP_VER(ip_hdr) != IP_VER_4 || IPV4_PROT(ip_hdr) != IP_PROT_TCP) {
+               DHD_TRACE(("%s %d: Not IPv4 nor TCP! ip ver %d, prot %d\n",
+                       __FUNCTION__, __LINE__, IP_VER(ip_hdr), IPV4_PROT(ip_hdr)));
+               return FLAG_OTHERS;
+       }
+
+       tcp_hdr = ip_hdr + ip_hdr_len;
+
+       flags = (uint8)tcp_hdr[TCP_FLAGS_OFFSET];
+
+       if (flags & TCP_FLAG_SYN) {
+               if (flags & TCP_FLAG_ACK) {
+                       return FLAG_SYNCACK;
+               }
+               return FLAG_SYNC;
+       }
+       return FLAG_OTHERS;
+}
+#endif /* DHDTCPSYNC_FLOOD_BLK */
diff --git a/bcmdhd.101.10.240.x/dhd_ip.h b/bcmdhd.101.10.240.x/dhd_ip.h
new file mode 100644 (file)
index 0000000..483279f
--- /dev/null
@@ -0,0 +1,92 @@
+/*
+ * Header file describing the common ip parser function.
+ *
+ * Provides type definitions and function prototypes used to parse ip packet.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef _dhd_ip_h_
+#define _dhd_ip_h_
+
+#if defined(DHDTCPACK_SUPPRESS) || defined(DHDTCPSYNC_FLOOD_BLK)
+#include <dngl_stats.h>
+#include <bcmutils.h>
+#include <dhd.h>
+#endif /* DHDTCPACK_SUPPRESS || DHDTCPSYNC_FLOOD_BLK */
+
+typedef enum pkt_frag
+{
+       DHD_PKT_FRAG_NONE = 0,
+       DHD_PKT_FRAG_FIRST,
+       DHD_PKT_FRAG_CONT,
+       DHD_PKT_FRAG_LAST
+} pkt_frag_t;
+
+extern pkt_frag_t pkt_frag_info(osl_t *osh, void *p);
+
+#ifdef DHDTCPSYNC_FLOOD_BLK
+typedef enum tcp_hdr_flags {
+       FLAG_SYNC,
+       FLAG_SYNCACK,
+       FLAG_RST,
+       FLAG_OTHERS
+} tcp_hdr_flag_t;
+
+extern tcp_hdr_flag_t dhd_tcpdata_get_flag(dhd_pub_t *dhdp, void *pkt);
+#endif /* DHDTCPSYNC_FLOOD_BLK */
+
+#ifdef DHDTCPACK_SUPPRESS
+#define        TCPACKSZMIN     (ETHER_HDR_LEN + IPV4_MIN_HEADER_LEN + TCP_MIN_HEADER_LEN)
+/* Size of MAX possible TCP ACK packet. Extra bytes for IP/TCP option fields */
+#define        TCPACKSZMAX     (TCPACKSZMIN + 100)
+
+/* Max number of TCP streams that have own src/dst IP addrs and TCP ports */
+#define TCPACK_INFO_MAXNUM 4
+#define TCPDATA_INFO_MAXNUM 4
+#define TCPDATA_PSH_INFO_MAXNUM (8 * TCPDATA_INFO_MAXNUM)
+
+#define TCPDATA_INFO_TIMEOUT 5000      /* Remove tcpdata_info if inactive for this time (in ms) */
+
+#define DEFAULT_TCPACK_SUPP_RATIO 3
+#ifndef CUSTOM_TCPACK_SUPP_RATIO
+#define CUSTOM_TCPACK_SUPP_RATIO DEFAULT_TCPACK_SUPP_RATIO
+#endif /* CUSTOM_TCPACK_SUPP_RATIO */
+
+#define DEFAULT_TCPACK_DELAY_TIME 10 /* ms */
+#ifndef CUSTOM_TCPACK_DELAY_TIME
+#define CUSTOM_TCPACK_DELAY_TIME DEFAULT_TCPACK_DELAY_TIME
+#endif /* CUSTOM_TCPACK_DELAY_TIME */
+
+extern int dhd_tcpack_suppress_set(dhd_pub_t *dhdp, uint8 on);
+extern void dhd_tcpack_info_tbl_clean(dhd_pub_t *dhdp);
+extern int dhd_tcpack_check_xmit(dhd_pub_t *dhdp, void *pkt);
+extern bool dhd_tcpack_suppress(dhd_pub_t *dhdp, void *pkt);
+extern bool dhd_tcpdata_info_get(dhd_pub_t *dhdp, void *pkt);
+extern bool dhd_tcpack_hold(dhd_pub_t *dhdp, void *pkt, int ifidx);
+/* #define DHDTCPACK_SUP_DBG */
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+extern counter_tbl_t tack_tbl;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+#endif /* DHDTCPACK_SUPPRESS */
+
+#endif /* _dhd_ip_h_ */
diff --git a/bcmdhd.101.10.240.x/dhd_linux.c b/bcmdhd.101.10.240.x/dhd_linux.c
new file mode 100644 (file)
index 0000000..67c2bc5
--- /dev/null
@@ -0,0 +1,24855 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Linux-specific network interface.
+ * Basically selected code segments from usb-cdc.c and usb-rndis.c
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#ifdef SHOW_LOGTRACE
+#include <linux/syscalls.h>
+#include <event_log.h>
+#endif /* SHOW_LOGTRACE */
+
+#if defined(PCIE_FULL_DONGLE) || defined(SHOW_LOGTRACE)
+#include <bcmmsgbuf.h>
+#endif /* PCIE_FULL_DONGLE */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/inetdevice.h>
+#include <linux/rtnetlink.h>
+#include <linux/etherdevice.h>
+#include <linux/random.h>
+#include <linux/spinlock.h>
+#include <linux/ethtool.h>
+#include <linux/fcntl.h>
+#include <linux/fs.h>
+#include <linux/ip.h>
+#include <linux/reboot.h>
+#include <linux/notifier.h>
+#include <linux/irq.h>
+#if defined(CONFIG_TIZEN)
+#include <linux/net_stat_tizen.h>
+#endif /* CONFIG_TIZEN */
+#include <net/addrconf.h>
+#ifdef ENABLE_ADAPTIVE_SCHED
+#include <linux/cpufreq.h>
+#endif /* ENABLE_ADAPTIVE_SCHED */
+#include <linux/rtc.h>
+#include <linux/namei.h>
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+#include <dhd_linux_priv.h>
+
+#include <epivers.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmdevs.h>
+#include <bcmdevs_legacy.h>    /* need to still support chips no longer in trunk firmware */
+#include <bcmiov.h>
+#include <bcmstdlib_s.h>
+
+#include <ethernet.h>
+#include <bcmevent.h>
+#include <vlan.h>
+#include <802.3.h>
+
+#include <dhd_linux_wq.h>
+#include <dhd.h>
+#include <dhd_linux.h>
+#include <dhd_linux_pktdump.h>
+#ifdef DHD_WET
+#include <dhd_wet.h>
+#endif /* DHD_WET */
+#ifdef PCIE_FULL_DONGLE
+#include <dhd_flowring.h>
+#endif
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_config.h>
+#ifdef WL_ESCAN
+#include <wl_escan.h>
+#endif
+#include <dhd_dbg.h>
+#include <dhd_dbg_ring.h>
+#include <dhd_debug.h>
+#ifdef CONFIG_HAS_WAKELOCK
+#include <linux/wakelock.h>
+#endif
+#if defined(WL_CFG80211)
+#include <wl_cfg80211.h>
+#ifdef WL_BAM
+#include <wl_bam.h>
+#endif /* WL_BAM */
+#endif /* WL_CFG80211 */
+#ifdef PNO_SUPPORT
+#include <dhd_pno.h>
+#endif
+#ifdef RTT_SUPPORT
+#include <dhd_rtt.h>
+#endif
+
+#include <dhd_linux_sock_qos.h>
+
+#ifdef CSI_SUPPORT
+#include <dhd_csi.h>
+#endif /* CSI_SUPPORT */
+
+#ifdef CONFIG_COMPAT
+#include <linux/compat.h>
+#endif
+
+#ifdef CONFIG_ARCH_EXYNOS
+#ifndef SUPPORT_EXYNOS7420
+#include <linux/exynos-pci-ctrl.h>
+#endif /* SUPPORT_EXYNOS7420 */
+#endif /* CONFIG_ARCH_EXYNOS */
+
+#ifdef DHD_L2_FILTER
+#include <bcmicmp.h>
+#include <bcm_l2_filter.h>
+#include <dhd_l2_filter.h>
+#endif /* DHD_L2_FILTER */
+
+#ifdef DHD_PSTA
+#include <dhd_psta.h>
+#endif /* DHD_PSTA */
+
+#ifdef AMPDU_VO_ENABLE
+/* XXX: Enabling VO AMPDU to reduce FER */
+#include <802.1d.h>
+#endif /* AMPDU_VO_ENABLE */
+
+#if defined(DHDTCPACK_SUPPRESS) || defined(DHDTCPSYNC_FLOOD_BLK)
+#include <dhd_ip.h>
+#endif /* DHDTCPACK_SUPPRESS || DHDTCPSYNC_FLOOD_BLK */
+#include <dhd_daemon.h>
+#ifdef DHD_PKT_LOGGING
+#include <dhd_pktlog.h>
+#endif /* DHD_PKT_LOGGING */
+#ifdef DHD_4WAYM4_FAIL_DISCONNECT
+#include <eapol.h>
+#endif /* DHD_4WAYM4_FAIL_DISCONNECT */
+#ifdef DHD_DEBUG_PAGEALLOC
+typedef void (*page_corrupt_cb_t)(void *handle, void *addr_corrupt, size_t len);
+void dhd_page_corrupt_cb(void *handle, void *addr_corrupt, size_t len);
+extern void register_page_corrupt_cb(page_corrupt_cb_t cb, void* handle);
+#endif /* DHD_DEBUG_PAGEALLOC */
+
+#ifdef ENABLE_DHD_GRO
+#include <net/sch_generic.h>
+#endif /* ENABLE_DHD_GRO */
+
+#define IP_PROT_RESERVED       0xFF
+
+#ifdef DHD_MQ
+#define MQ_MAX_QUEUES AC_COUNT
+#define MQ_MAX_CPUS 16
+int enable_mq = TRUE;
+module_param(enable_mq, int, 0644);
+int mq_select_disable = FALSE;
+#endif
+
+#if defined(DHD_LB)
+#if !defined(PCIE_FULL_DONGLE)
+#error "DHD Loadbalancing only supported on PCIE_FULL_DONGLE"
+#endif /* !PCIE_FULL_DONGLE */
+#endif /* DHD_LB */
+
+#if defined(DHD_LB_RXP) || defined(DHD_LB_RXC) || defined(DHD_LB_TXC) || \
+       defined(DHD_LB_STATS)
+#if !defined(DHD_LB)
+#error "DHD loadbalance derivatives are supported only if DHD_LB is defined"
+#endif /* !DHD_LB */
+#endif /* DHD_LB_RXP || DHD_LB_RXC || DHD_LB_TXC || DHD_LB_STATS */
+
+#ifdef DHD_4WAYM4_FAIL_DISCONNECT
+static void dhd_m4_state_handler(struct work_struct * work);
+#endif /* DHD_4WAYM4_FAIL_DISCONNECT */
+
+#if defined(WL_CFG80211) && defined(DHD_FILE_DUMP_EVENT) && defined(DHD_FW_COREDUMP)
+static int dhd_wait_for_file_dump(dhd_pub_t *dhdp);
+#endif /* WL_CFG80211 && DHD_FILE_DUMP_EVENT && DHD_FW_COREDUMP */
+
+#ifdef FIX_CPU_MIN_CLOCK
+#include <linux/pm_qos.h>
+#endif /* FIX_CPU_MIN_CLOCK */
+
+#ifdef ENABLE_ADAPTIVE_SCHED
+#define DEFAULT_CPUFREQ_THRESH         1000000 /* threshold frequency : 1000000 = 1GHz */
+#ifndef CUSTOM_CPUFREQ_THRESH
+#define CUSTOM_CPUFREQ_THRESH  DEFAULT_CPUFREQ_THRESH
+#endif /* CUSTOM_CPUFREQ_THRESH */
+#endif /* ENABLE_ADAPTIVE_SCHED */
+
+/* enable HOSTIP cache update from the host side when an eth0:N is up */
+#define AOE_IP_ALIAS_SUPPORT 1
+
+#ifdef PROP_TXSTATUS
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+
+#include <wl_android.h>
+
+/* Maximum STA per radio */
+#define DHD_MAX_STA     32
+
+#ifdef CUSTOMER_HW_AMLOGIC
+#include <linux/amlogic/wifi_dt.h>
+#endif
+
+#ifdef DHD_EVENT_LOG_FILTER
+#include <dhd_event_log_filter.h>
+#endif /* DHD_EVENT_LOG_FILTER */
+
+#ifdef DHDTCPSYNC_FLOOD_BLK
+static void dhd_blk_tsfl_handler(struct work_struct * work);
+#endif /* DHDTCPSYNC_FLOOD_BLK */
+
+#ifdef WL_NATOE
+#include <dhd_linux_nfct.h>
+#endif /* WL_NATOE */
+
+#ifdef DHD_TX_PROFILE
+#include <bcmarp.h>
+#include <bcmicmp.h>
+#include <bcmudp.h>
+#include <bcmproto.h>
+#endif /* defined(DHD_TX_PROFILE) */
+
+#ifdef SET_RANDOM_MAC_SOFTAP
+#ifndef CONFIG_DHD_SET_RANDOM_MAC_VAL
+#define CONFIG_DHD_SET_RANDOM_MAC_VAL  0x001A11
+#endif
+static u32 vendor_oui = CONFIG_DHD_SET_RANDOM_MAC_VAL;
+#endif /* SET_RANDOM_MAC_SOFTAP */
+
+/* XXX: where does this belong? */
+/* XXX: this needs to reviewed for host OS. */
+const uint8 wme_fifo2ac[] = { 0, 1, 2, 3, 1, 1 };
+const uint8 prio2fifo[8] = { 1, 0, 0, 1, 2, 2, 3, 3 };
+#define WME_PRIO2AC(prio)  wme_fifo2ac[prio2fifo[(prio)]]
+
+#ifdef ARP_OFFLOAD_SUPPORT
+void aoe_update_host_ipv4_table(dhd_pub_t *dhd_pub, u32 ipa, bool add, int idx);
+static int dhd_inetaddr_notifier_call(struct notifier_block *this,
+       unsigned long event, void *ptr);
+static struct notifier_block dhd_inetaddr_notifier = {
+       .notifier_call = dhd_inetaddr_notifier_call
+};
+/* to make sure we won't register the same notifier twice, otherwise a loop is likely to be
+ * created in the kernel notifier link list (with 'next' pointing to itself)
+ */
+static bool dhd_inetaddr_notifier_registered = FALSE;
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#if defined(CONFIG_IPV6) && defined(IPV6_NDO_SUPPORT)
+int dhd_inet6addr_notifier_call(struct notifier_block *this,
+       unsigned long event, void *ptr);
+static struct notifier_block dhd_inet6addr_notifier = {
+       .notifier_call = dhd_inet6addr_notifier_call
+};
+/* to make sure we won't register the same notifier twice, otherwise a loop is likely to be
+ * created in kernel notifier link list (with 'next' pointing to itself)
+ */
+static bool dhd_inet6addr_notifier_registered = FALSE;
+#endif /* CONFIG_IPV6 && IPV6_NDO_SUPPORT */
+
+#if defined(CONFIG_PM_SLEEP)
+#include <linux/suspend.h>
+volatile bool dhd_mmc_suspend = FALSE;
+DECLARE_WAIT_QUEUE_HEAD(dhd_dpc_wait);
+#ifdef ENABLE_WAKEUP_PKT_DUMP
+volatile bool dhd_mmc_wake = FALSE;
+long long temp_raw;
+#endif /* ENABLE_WAKEUP_PKT_DUMP */
+#endif /* defined(CONFIG_PM_SLEEP) */
+
+#if defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID) || defined(FORCE_WOWLAN)
+extern void dhd_enable_oob_intr(struct dhd_bus *bus, bool enable);
+#endif /* defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID) */
+static void dhd_hang_process(struct work_struct *work_data);
+MODULE_LICENSE("GPL and additional rights");
+
+#if defined(MULTIPLE_SUPPLICANT)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+DEFINE_MUTEX(_dhd_mutex_lock_);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) */
+#endif
+static int dhd_suspend_resume_helper(struct dhd_info *dhd, int val, int force);
+
+#include <dhd_bus.h>
+
+/* XXX Set up an MTU change notifier per linux/notifier.h? */
+#ifndef PROP_TXSTATUS
+#define DBUS_RX_BUFFER_SIZE_DHD(net)   (net->mtu + net->hard_header_len + dhd->pub.hdrlen)
+#else
+#define DBUS_RX_BUFFER_SIZE_DHD(net)   (net->mtu + net->hard_header_len + dhd->pub.hdrlen + 128)
+#endif
+
+#ifdef PROP_TXSTATUS
+extern bool dhd_wlfc_skip_fc(void * dhdp, uint8 idx);
+extern void dhd_wlfc_plat_init(void *dhd);
+extern void dhd_wlfc_plat_deinit(void *dhd);
+#endif /* PROP_TXSTATUS */
+#ifdef USE_DYNAMIC_F2_BLKSIZE
+extern uint sd_f2_blocksize;
+extern int dhdsdio_func_blocksize(dhd_pub_t *dhd, int function_num, int block_size);
+#endif /* USE_DYNAMIC_F2_BLKSIZE */
+
+/* Linux wireless extension support */
+#if defined(WL_WIRELESS_EXT)
+#include <wl_iw.h>
+#endif /* defined(WL_WIRELESS_EXT) */
+
+#ifdef CONFIG_PARTIALSUSPEND_SLP
+/* XXX SLP use defferent earlysuspend header file and some functions
+ * But most of meaning is same as Android
+ */
+#include <linux/partialsuspend_slp.h>
+#define CONFIG_HAS_EARLYSUSPEND
+#define DHD_USE_EARLYSUSPEND
+#define register_early_suspend         register_pre_suspend
+#define unregister_early_suspend       unregister_pre_suspend
+#define early_suspend                          pre_suspend
+#define EARLY_SUSPEND_LEVEL_BLANK_SCREEN               50
+#else
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+#include <linux/earlysuspend.h>
+#endif /* defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND) */
+#endif /* CONFIG_PARTIALSUSPEND_SLP */
+
+#ifdef CONFIG_IRQ_HISTORY
+#include <linux/power/irq_history.h>
+#endif /* CONFIG_IRQ_HISTORY */
+
+#include <linux/nl80211.h>
+
+#if defined(PKT_FILTER_SUPPORT) && defined(APF)
+static int __dhd_apf_add_filter(struct net_device *ndev, uint32 filter_id,
+       u8* program, uint32 program_len);
+static int __dhd_apf_config_filter(struct net_device *ndev, uint32 filter_id,
+       uint32 mode, uint32 enable);
+static int __dhd_apf_delete_filter(struct net_device *ndev, uint32 filter_id);
+#endif /* PKT_FILTER_SUPPORT && APF */
+
+#ifdef DHD_FW_COREDUMP
+static int dhd_mem_dump(void *dhd_info, void *event_info, u8 event);
+#endif /* DHD_FW_COREDUMP */
+
+#ifdef DHD_LOG_DUMP
+
+struct dhd_log_dump_buf g_dld_buf[DLD_BUFFER_NUM];
+
+/* Only header for log dump buffers is stored in array
+ * header for sections like 'dhd dump', 'ext trap'
+ * etc, is not in the array, because they are not log
+ * ring buffers
+ */
+dld_hdr_t dld_hdrs[DLD_BUFFER_NUM] = {
+               {GENERAL_LOG_HDR, LOG_DUMP_SECTION_GENERAL},
+               {PRESERVE_LOG_HDR, LOG_DUMP_SECTION_PRESERVE},
+               {SPECIAL_LOG_HDR, LOG_DUMP_SECTION_SPECIAL}
+};
+static int dld_buf_size[DLD_BUFFER_NUM] = {
+               LOG_DUMP_GENERAL_MAX_BUFSIZE,   /* DLD_BUF_TYPE_GENERAL */
+               LOG_DUMP_PRESERVE_MAX_BUFSIZE,  /* DLD_BUF_TYPE_PRESERVE */
+               LOG_DUMP_SPECIAL_MAX_BUFSIZE,   /* DLD_BUF_TYPE_SPECIAL */
+};
+
+static void dhd_log_dump_init(dhd_pub_t *dhd);
+static void dhd_log_dump_deinit(dhd_pub_t *dhd);
+static void dhd_log_dump(void *handle, void *event_info, u8 event);
+static int do_dhd_log_dump(dhd_pub_t *dhdp, log_dump_type_t *type);
+static void dhd_print_buf_addr(dhd_pub_t *dhdp, char *name, void *buf, unsigned int size);
+static void dhd_log_dump_buf_addr(dhd_pub_t *dhdp, log_dump_type_t *type);
+#endif /* DHD_LOG_DUMP */
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+#include <linux/workqueue.h>
+#include <linux/pm_runtime.h>
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#ifdef DHD_DEBUG_UART
+#include <linux/kmod.h>
+#define DHD_DEBUG_UART_EXEC_PATH       "/system/bin/wldu"
+static void dhd_debug_uart_exec_rd(void *handle, void *event_info, u8 event);
+static void dhd_debug_uart_exec(dhd_pub_t *dhdp, char *cmd);
+#endif /* DHD_DEBUG_UART */
+
+static int dhd_reboot_callback(struct notifier_block *this, unsigned long code, void *unused);
+static struct notifier_block dhd_reboot_notifier = {
+       .notifier_call = dhd_reboot_callback,
+       .priority = 1,
+};
+
+#ifdef BCMPCIE
+static int is_reboot = 0;
+#endif /* BCMPCIE */
+
+dhd_pub_t      *g_dhd_pub = NULL;
+
+#if defined(BT_OVER_SDIO)
+#include "dhd_bt_interface.h"
+#endif /* defined (BT_OVER_SDIO) */
+
+#ifdef WL_STATIC_IF
+bool dhd_is_static_ndev(dhd_pub_t *dhdp, struct net_device *ndev);
+#endif /* WL_STATIC_IF */
+
+atomic_t exit_in_progress = ATOMIC_INIT(0);
+
+static void dhd_process_daemon_msg(struct sk_buff *skb);
+static void dhd_destroy_to_notifier_skt(void);
+static int dhd_create_to_notifier_skt(void);
+static struct sock *nl_to_event_sk = NULL;
+int sender_pid = 0;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+struct netlink_kernel_cfg dhd_netlink_cfg = {
+       .groups = 1,
+       .input = dhd_process_daemon_msg,
+};
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)) */
+
+#if defined(BT_OVER_SDIO)
+/* Flag to indicate if driver is initialized */
+uint dhd_driver_init_done = TRUE;
+#else
+/* Flag to indicate if driver is initialized */
+uint dhd_driver_init_done = FALSE;
+#endif
+/* Flag to indicate if we should download firmware on driver load */
+uint dhd_download_fw_on_driverload = TRUE;
+
+/* Definitions to provide path to the firmware and nvram
+ * example nvram_path[MOD_PARAM_PATHLEN]="/projects/wlan/nvram.txt"
+ */
+char firmware_path[MOD_PARAM_PATHLEN];
+char nvram_path[MOD_PARAM_PATHLEN];
+char clm_path[MOD_PARAM_PATHLEN];
+char config_path[MOD_PARAM_PATHLEN];
+#ifdef DHD_UCODE_DOWNLOAD
+char ucode_path[MOD_PARAM_PATHLEN];
+#endif /* DHD_UCODE_DOWNLOAD */
+
+module_param_string(clm_path, clm_path, MOD_PARAM_PATHLEN, 0660);
+
+/* backup buffer for firmware and nvram path */
+char fw_bak_path[MOD_PARAM_PATHLEN];
+char nv_bak_path[MOD_PARAM_PATHLEN];
+
+/* information string to keep firmware, chio, cheip version info visiable from log */
+char info_string[MOD_PARAM_INFOLEN];
+module_param_string(info_string, info_string, MOD_PARAM_INFOLEN, 0444);
+int op_mode = 0;
+int disable_proptx = 0;
+module_param(op_mode, int, 0644);
+extern int wl_control_wl_start(struct net_device *dev);
+#if defined(BCMLXSDMMC) || defined(BCMDBUS)
+struct semaphore dhd_registration_sem;
+#endif /* BCMXSDMMC */
+void dhd_generate_rand_mac_addr(struct ether_addr *ea_addr);
+
+#ifdef DHD_LOG_DUMP
+int logdump_max_filesize = LOG_DUMP_MAX_FILESIZE;
+module_param(logdump_max_filesize, int, 0644);
+int logdump_max_bufsize = LOG_DUMP_GENERAL_MAX_BUFSIZE;
+module_param(logdump_max_bufsize, int, 0644);
+int logdump_periodic_flush = FALSE;
+module_param(logdump_periodic_flush, int, 0644);
+#ifdef EWP_ECNTRS_LOGGING
+int logdump_ecntr_enable = TRUE;
+#else
+int logdump_ecntr_enable = FALSE;
+#endif /* EWP_ECNTRS_LOGGING */
+module_param(logdump_ecntr_enable, int, 0644);
+#ifdef EWP_RTT_LOGGING
+int logdump_rtt_enable = TRUE;
+#else
+int logdump_rtt_enable = FALSE;
+#endif /* EWP_RTT_LOGGING */
+int logdump_prsrv_tailsize = DHD_LOG_DUMP_MAX_TAIL_FLUSH_SIZE;
+#endif /* DHD_LOG_DUMP */
+
+#ifdef EWP_EDL
+int host_edl_support = TRUE;
+module_param(host_edl_support, int, 0644);
+#endif
+
+/* deferred handlers */
+static void dhd_ifadd_event_handler(void *handle, void *event_info, u8 event);
+static void dhd_ifdel_event_handler(void *handle, void *event_info, u8 event);
+static void dhd_set_mac_addr_handler(void *handle, void *event_info, u8 event);
+static void dhd_set_mcast_list_handler(void *handle, void *event_info, u8 event);
+#ifdef WL_NATOE
+static void dhd_natoe_ct_event_hanlder(void *handle, void *event_info, u8 event);
+static void dhd_natoe_ct_ioctl_handler(void *handle, void *event_info, uint8 event);
+#endif /* WL_NATOE */
+
+#ifdef DHD_UPDATE_INTF_MAC
+static void dhd_ifupdate_event_handler(void *handle, void *event_info, u8 event);
+#endif /* DHD_UPDATE_INTF_MAC */
+#if defined(CONFIG_IPV6) && defined(IPV6_NDO_SUPPORT)
+static void dhd_inet6_work_handler(void *dhd_info, void *event_data, u8 event);
+#endif /* CONFIG_IPV6 && IPV6_NDO_SUPPORT */
+#ifdef WL_CFG80211
+extern void dhd_netdev_free(struct net_device *ndev);
+#endif /* WL_CFG80211 */
+static dhd_if_t * dhd_get_ifp_by_ndev(dhd_pub_t *dhdp, struct net_device *ndev);
+
+#if defined(WLDWDS) && defined(FOURADDR_AUTO_BRG)
+static void dhd_bridge_dev_set(dhd_info_t * dhd, int ifidx, struct net_device * dev);
+#endif /* defiend(WLDWDS) && defined(FOURADDR_AUTO_BRG) */
+
+#if (defined(DHD_WET) || defined(DHD_MCAST_REGEN) || defined(DHD_L2_FILTER))
+/* update rx_pkt_chainable state of dhd interface */
+static void dhd_update_rx_pkt_chainable_state(dhd_pub_t* dhdp, uint32 idx);
+#endif /* DHD_WET || DHD_MCAST_REGEN || DHD_L2_FILTER */
+
+/* Error bits */
+module_param(dhd_msg_level, int, 0);
+#if defined(WL_WIRELESS_EXT)
+module_param(iw_msg_level, int, 0);
+#endif
+#ifdef WL_CFG80211
+module_param(wl_dbg_level, int, 0);
+#endif
+module_param(android_msg_level, int, 0);
+module_param(config_msg_level, int, 0);
+
+#ifdef ARP_OFFLOAD_SUPPORT
+/* ARP offload agent mode : Enable ARP Host Auto-Reply and ARP Peer Auto-Reply */
+/* XXX ARP HOST Auto Reply can cause dongle trap at VSDB situation */
+/* XXX ARP OL SNOOP can be used to more good quility */
+
+#ifdef ENABLE_ARP_SNOOP_MODE
+uint dhd_arp_mode = (ARP_OL_AGENT | ARP_OL_PEER_AUTO_REPLY | ARP_OL_SNOOP | ARP_OL_HOST_AUTO_REPLY |
+               ARP_OL_UPDATE_HOST_CACHE);
+#else
+uint dhd_arp_mode = ARP_OL_AGENT | ARP_OL_PEER_AUTO_REPLY | ARP_OL_UPDATE_HOST_CACHE;
+#endif /* ENABLE_ARP_SNOOP_MODE */
+
+module_param(dhd_arp_mode, uint, 0);
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+/* Disable Prop tx */
+module_param(disable_proptx, int, 0644);
+/* load firmware and/or nvram values from the filesystem */
+module_param_string(firmware_path, firmware_path, MOD_PARAM_PATHLEN, 0660);
+module_param_string(nvram_path, nvram_path, MOD_PARAM_PATHLEN, 0660);
+module_param_string(config_path, config_path, MOD_PARAM_PATHLEN, 0);
+#ifdef DHD_UCODE_DOWNLOAD
+module_param_string(ucode_path, ucode_path, MOD_PARAM_PATHLEN, 0660);
+#endif /* DHD_UCODE_DOWNLOAD */
+
+/* wl event forwarding */
+#ifdef WL_EVENT_ENAB
+uint wl_event_enable = true;
+#else
+uint wl_event_enable = false;
+#endif /* WL_EVENT_ENAB */
+module_param(wl_event_enable, uint, 0660);
+
+/* wl event forwarding */
+#ifdef LOGTRACE_PKT_SENDUP
+uint logtrace_pkt_sendup = true;
+#else
+uint logtrace_pkt_sendup = false;
+#endif /* LOGTRACE_PKT_SENDUP */
+module_param(logtrace_pkt_sendup, uint, 0660);
+
+/* Watchdog interval */
+/* extend watchdog expiration to 2 seconds when DPC is running */
+#define WATCHDOG_EXTEND_INTERVAL (2000)
+
+uint dhd_watchdog_ms = CUSTOM_DHD_WATCHDOG_MS;
+module_param(dhd_watchdog_ms, uint, 0);
+
+#ifdef DHD_PCIE_RUNTIMEPM
+uint dhd_runtimepm_ms = CUSTOM_DHD_RUNTIME_MS;
+#endif /* DHD_PCIE_RUNTIMEPMT */
+#if defined(DHD_DEBUG)
+/* Console poll interval */
+uint dhd_console_ms = 0;  /* XXX andrey by default no fw msg prints */
+module_param(dhd_console_ms, uint, 0644);
+#else
+uint dhd_console_ms = 0;
+#endif /* DHD_DEBUG */
+
+uint dhd_slpauto = TRUE;
+module_param(dhd_slpauto, uint, 0);
+
+#ifdef PKT_FILTER_SUPPORT
+/* Global Pkt filter enable control */
+uint dhd_pkt_filter_enable = TRUE;
+module_param(dhd_pkt_filter_enable, uint, 0);
+#endif
+
+/* Pkt filter init setup */
+uint dhd_pkt_filter_init = 0;
+module_param(dhd_pkt_filter_init, uint, 0);
+
+/* Pkt filter mode control */
+#ifdef GAN_LITE_NAT_KEEPALIVE_FILTER
+uint dhd_master_mode = FALSE;
+#else
+uint dhd_master_mode = FALSE;
+#endif /* GAN_LITE_NAT_KEEPALIVE_FILTER */
+module_param(dhd_master_mode, uint, 0);
+
+int dhd_watchdog_prio = 0;
+module_param(dhd_watchdog_prio, int, 0);
+
+/* DPC thread priority */
+int dhd_dpc_prio = CUSTOM_DPC_PRIO_SETTING;
+module_param(dhd_dpc_prio, int, 0);
+
+/* RX frame thread priority */
+int dhd_rxf_prio = CUSTOM_RXF_PRIO_SETTING;
+module_param(dhd_rxf_prio, int, 0);
+
+#if !defined(BCMDBUS)
+extern int dhd_dongle_ramsize;
+module_param(dhd_dongle_ramsize, int, 0);
+#endif /* !BCMDBUS */
+
+#ifdef WL_CFG80211
+int passive_channel_skip = 0;
+module_param(passive_channel_skip, int, (S_IRUSR|S_IWUSR));
+#endif /* WL_CFG80211 */
+static dhd_if_t * dhd_get_ifp_by_ndev(dhd_pub_t *dhdp, struct net_device *ndev);
+
+#ifdef DHD_MSI_SUPPORT
+uint enable_msi = TRUE;
+module_param(enable_msi, uint, 0);
+#endif /* PCIE_FULL_DONGLE */
+
+#ifdef DHD_SSSR_DUMP
+int dhdpcie_sssr_dump_get_before_after_len(dhd_pub_t *dhd, uint32 *arr_len);
+module_param(sssr_enab, uint, 0);
+module_param(fis_enab, uint, 0);
+#endif /* DHD_SSSR_DUMP */
+
+/* Keep track of number of instances */
+static int dhd_found = 0;
+static int instance_base = 0; /* Starting instance number */
+module_param(instance_base, int, 0644);
+
+#if defined(DHD_LB_RXP) && defined(PCIE_FULL_DONGLE)
+/*
+ * Rx path process budget(dhd_napi_weight) number of packets in one go and hands over
+ * the packets to network stack.
+ *
+ * dhd_dpc tasklet is the producer(packets received from dongle) and dhd_napi_poll()
+ * is the consumer. The maximum number of packets that can be received from the dongle
+ * at any given point of time are D2HRING_RXCMPLT_MAX_ITEM.
+ * Also DHD will always post fresh rx buffers to dongle while processing rx completions.
+ *
+ * The consumer must consume the packets at equal are better rate than the producer.
+ * i.e if dhd_napi_poll() does not process at the same rate as the producer(dhd_dpc),
+ * rx_process_queue depth increases, which can even consume the entire system memory.
+ * During UDP receive use case at 2Gbps, it was observed that the packets queued
+ * in rx_process_queue alone  was taking 1.8GB when the budget is 64.
+ *
+ * Hence the budget must at least be D2HRING_RXCMPLT_MAX_ITEM. Also provide 50%
+ * more buffer to dhd_napi_weight, so that above explained scenario will never hit.
+ */
+static int dhd_napi_weight = (D2HRING_RXCMPLT_MAX_ITEM + (D2HRING_RXCMPLT_MAX_ITEM / 2));
+module_param(dhd_napi_weight, int, 0644);
+#endif /* DHD_LB_RXP && PCIE_FULL_DONGLE */
+
+#ifdef PCIE_FULL_DONGLE
+extern int h2d_max_txpost;
+module_param(h2d_max_txpost, int, 0644);
+
+#if defined(DHD_HTPUT_TUNABLES)
+extern int h2d_htput_max_txpost;
+module_param(h2d_htput_max_txpost, int, 0644);
+#endif /* DHD_HTPUT_TUNABLES */
+
+extern uint dma_ring_indices;
+module_param(dma_ring_indices, uint, 0644);
+
+extern bool h2d_phase;
+module_param(h2d_phase, bool, 0644);
+extern bool force_trap_bad_h2d_phase;
+module_param(force_trap_bad_h2d_phase, bool, 0644);
+#endif /* PCIE_FULL_DONGLE */
+
+#ifdef FORCE_TPOWERON
+/*
+ * On Fire's reference platform, coming out of L1.2,
+ * there is a constant delay of 45us between CLKREQ# and stable REFCLK
+ * Due to this delay, with tPowerOn < 50
+ * there is a chance of the refclk sense to trigger on noise.
+ *
+ * 0x29 when written to L1SSControl2 translates to 50us.
+ */
+#define FORCE_TPOWERON_50US 0x29
+uint32 tpoweron_scale = FORCE_TPOWERON_50US; /* default 50us */
+module_param(tpoweron_scale, uint, 0644);
+#endif /* FORCE_TPOWERON */
+
+#ifdef SHOW_LOGTRACE
+#if defined(CUSTOMER_HW4_DEBUG)
+#define WIFI_PATH "/etc/wifi/"
+static char *logstrs_path = VENDOR_PATH WIFI_PATH"logstrs.bin";
+char *st_str_file_path = VENDOR_PATH WIFI_PATH"rtecdc.bin";
+static char *map_file_path = VENDOR_PATH WIFI_PATH"rtecdc.map";
+static char *rom_st_str_file_path = VENDOR_PATH WIFI_PATH"roml.bin";
+static char *rom_map_file_path = VENDOR_PATH WIFI_PATH"roml.map";
+#else
+static char *logstrs_path = PLATFORM_PATH"logstrs.bin";
+char *st_str_file_path = PLATFORM_PATH"rtecdc.bin";
+static char *map_file_path = PLATFORM_PATH"rtecdc.map";
+static char *rom_st_str_file_path = PLATFORM_PATH"roml.bin";
+static char *rom_map_file_path = PLATFORM_PATH"roml.map";
+#endif /* CUSTOMER_HW4_DEBUG */
+
+static char *ram_file_str = "rtecdc";
+static char *rom_file_str = "roml";
+
+module_param(logstrs_path, charp, S_IRUGO);
+module_param(st_str_file_path, charp, S_IRUGO);
+module_param(map_file_path, charp, S_IRUGO);
+module_param(rom_st_str_file_path, charp, S_IRUGO);
+module_param(rom_map_file_path, charp, S_IRUGO);
+
+static int dhd_init_logstrs_array(osl_t *osh, dhd_event_log_t *temp);
+static int dhd_read_map(osl_t *osh, char *fname, uint32 *ramstart, uint32 *rodata_start,
+       uint32 *rodata_end);
+static int dhd_init_static_strs_array(osl_t *osh, dhd_event_log_t *temp, char *str_file,
+       char *map_file);
+#endif /* SHOW_LOGTRACE */
+
+#define DHD_MEMDUMP_TYPE_STR_LEN 32
+#define DHD_MEMDUMP_PATH_STR_LEN 128
+
+#ifdef DHD_TX_PROFILE
+/* process layer 3 headers, to ultimately determine if a
+ * dhd_tx_profile_protocol_t matches
+ */
+static int process_layer3_headers(uint8 **p, int plen, uint16 *type);
+
+/* process layer 2 headers, to ultimately determine if a
+ * dhd_tx_profile_protocol_t matches
+ */
+static int process_layer2_headers(uint8 **p, int *plen, uint16 *type);
+
+/* whether or not a dhd_tx_profile_protocol_t matches with data in a packet */
+bool dhd_protocol_matches_profile(uint8 *p, int plen, const
+               dhd_tx_profile_protocol_t *proto);
+#endif /* defined(DHD_TX_PROFILE) */
+
+#ifdef CUSTOMER_HW4_DEBUG
+#define PATH_BANDLOCK_INFO PLATFORM_PATH".bandlock.info"
+#elif defined(BOARD_HIKEY)
+#define PATH_BANDLOCK_INFO "/data/misc/wifi/.bandlock.info"
+#elif defined(__ARM_ARCH_7A__)
+#define PATH_BANDLOCK_INFO "/data/misc/wifi/.bandlock.info"
+#else
+#define PATH_BANDLOCK_INFO "/installmedia/.bandlock.info"
+#endif /* CUSTOMER_HW4_DEBUG */
+
+static void dhd_set_bandlock(dhd_pub_t * dhd);
+
+static void
+dhd_tx_stop_queues(struct net_device *net)
+{
+#ifdef DHD_MQ
+       netif_tx_stop_all_queues(net);
+#else
+       netif_stop_queue(net);
+#endif
+}
+
+static void
+dhd_tx_start_queues(struct net_device *net)
+{
+#ifdef DHD_MQ
+       netif_tx_wake_all_queues(net);
+#else
+       netif_wake_queue(net);
+#endif
+}
+
+#ifdef USE_WFA_CERT_CONF
+int g_frameburst = 1;
+#endif /* USE_WFA_CERT_CONF */
+
+static int dhd_get_pend_8021x_cnt(dhd_info_t *dhd);
+
+#ifdef PCIE_FULL_DONGLE
+#define DHD_IF_STA_LIST_LOCK_INIT(lock) spin_lock_init(lock)
+
+#if defined(DHD_IGMP_UCQUERY) || defined(DHD_UCAST_UPNP)
+static struct list_head * dhd_sta_list_snapshot(dhd_info_t *dhd, dhd_if_t *ifp,
+       struct list_head *snapshot_list);
+static void dhd_sta_list_snapshot_free(dhd_info_t *dhd, struct list_head *snapshot_list);
+#define DHD_IF_WMF_UCFORWARD_LOCK(dhd, ifp, slist) ({ dhd_sta_list_snapshot(dhd, ifp, slist); })
+#define DHD_IF_WMF_UCFORWARD_UNLOCK(dhd, slist) ({ dhd_sta_list_snapshot_free(dhd, slist); })
+#endif /* DHD_IGMP_UCQUERY || DHD_UCAST_UPNP */
+#endif /* PCIE_FULL_DONGLE */
+
+/* Control fw roaming */
+#ifdef BCMCCX
+uint dhd_roam_disable = 0;
+#else
+uint dhd_roam_disable = 0;
+#endif /* BCMCCX */
+
+#ifdef BCMDBGFS
+extern void dhd_dbgfs_init(dhd_pub_t *dhdp);
+extern void dhd_dbgfs_remove(void);
+#endif
+
+/* Enable TX status metadta report: 0=disable 1=enable 2=debug */
+static uint pcie_txs_metadata_enable = 0;
+module_param(pcie_txs_metadata_enable, int, 0);
+
+/* Control radio state */
+uint dhd_radio_up = 1;
+
+/* Network inteface name */
+char iface_name[IFNAMSIZ] = {'\0'};
+module_param_string(iface_name, iface_name, IFNAMSIZ, 0);
+
+/* The following are specific to the SDIO dongle */
+
+/* IOCTL response timeout */
+int dhd_ioctl_timeout_msec = IOCTL_RESP_TIMEOUT;
+
+/* DS Exit response timeout */
+int ds_exit_timeout_msec = DS_EXIT_TIMEOUT;
+
+/* Idle timeout for backplane clock */
+int dhd_idletime = DHD_IDLETIME_TICKS;
+module_param(dhd_idletime, int, 0);
+
+/* Use polling */
+uint dhd_poll = FALSE;
+module_param(dhd_poll, uint, 0);
+
+/* Use interrupts */
+uint dhd_intr = TRUE;
+module_param(dhd_intr, uint, 0);
+
+/* SDIO Drive Strength (in milliamps) */
+uint dhd_sdiod_drive_strength = 6;
+module_param(dhd_sdiod_drive_strength, uint, 0);
+
+#ifdef BCMSDIO
+/* Tx/Rx bounds */
+extern uint dhd_txbound;
+extern uint dhd_rxbound;
+module_param(dhd_txbound, uint, 0);
+module_param(dhd_rxbound, uint, 0);
+
+/* Deferred transmits */
+extern uint dhd_deferred_tx;
+module_param(dhd_deferred_tx, uint, 0);
+
+#endif /* BCMSDIO */
+
+#ifdef SDTEST
+/* Echo packet generator (pkts/s) */
+uint dhd_pktgen = 0;
+module_param(dhd_pktgen, uint, 0);
+
+/* Echo packet len (0 => sawtooth, max 2040) */
+uint dhd_pktgen_len = 0;
+module_param(dhd_pktgen_len, uint, 0);
+#endif /* SDTEST */
+
+#if defined(BCMSUP_4WAY_HANDSHAKE)
+/* Use in dongle supplicant for 4-way handshake */
+#if defined(WLFBT) || defined(WL_ENABLE_IDSUP)
+/* Enable idsup by default (if supported in fw) */
+uint dhd_use_idsup = 1;
+#else
+uint dhd_use_idsup = 0;
+#endif /* WLFBT || WL_ENABLE_IDSUP */
+module_param(dhd_use_idsup, uint, 0);
+#endif /* BCMSUP_4WAY_HANDSHAKE */
+
+#ifndef BCMDBUS
+/* Allow delayed firmware download for debug purpose */
+int allow_delay_fwdl = FALSE;
+module_param(allow_delay_fwdl, int, 0);
+#endif /* !BCMDBUS */
+
+#ifdef GDB_PROXY
+/* Adds/replaces deadman_to= in NVRAM file with deadman_to=0 */
+static uint nodeadman = 0;
+module_param(nodeadman, uint, 0);
+#endif /* GDB_PROXY */
+
+#ifdef ECOUNTER_PERIODIC_DISABLE
+uint enable_ecounter = FALSE;
+#else
+uint enable_ecounter = TRUE;
+#endif
+module_param(enable_ecounter, uint, 0);
+
+/* TCM verification flag */
+uint dhd_tcm_test_enable = FALSE;
+module_param(dhd_tcm_test_enable, uint, 0644);
+
+extern char dhd_version[];
+extern char fw_version[];
+extern char clm_version[];
+
+int dhd_net_bus_devreset(struct net_device *dev, uint8 flag);
+static void dhd_net_if_lock_local(dhd_info_t *dhd);
+static void dhd_net_if_unlock_local(dhd_info_t *dhd);
+static void dhd_suspend_lock(dhd_pub_t *dhdp);
+static void dhd_suspend_unlock(dhd_pub_t *dhdp);
+
+/* Monitor interface */
+int dhd_monitor_init(void *dhd_pub);
+int dhd_monitor_uninit(void);
+
+#ifdef DHD_PM_CONTROL_FROM_FILE
+bool g_pm_control;
+#ifdef DHD_EXPORT_CNTL_FILE
+uint32 pmmode_val = 0xFF;
+#endif /* DHD_EXPORT_CNTL_FILE */
+void sec_control_pm(dhd_pub_t *dhd, uint *);
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+
+#if defined(WL_WIRELESS_EXT)
+struct iw_statistics *dhd_get_wireless_stats(struct net_device *dev);
+#endif /* defined(WL_WIRELESS_EXT) */
+
+#ifdef DHD_PM_OVERRIDE
+bool g_pm_override;
+#endif /* DHD_PM_OVERRIDE */
+
+#ifndef BCMDBUS
+static void dhd_dpc(ulong data);
+#endif /* !BCMDBUS */
+/* forward decl */
+extern int dhd_wait_pend8021x(struct net_device *dev);
+void dhd_os_wd_timer_extend(void *bus, bool extend);
+
+#ifdef TOE
+#ifndef BDC
+#error TOE requires BDC
+#endif /* !BDC */
+static int dhd_toe_get(dhd_info_t *dhd, int idx, uint32 *toe_ol);
+static int dhd_toe_set(dhd_info_t *dhd, int idx, uint32 toe_ol);
+#endif /* TOE */
+
+static int dhd_wl_host_event(dhd_info_t *dhd, int ifidx, void *pktdata, uint16 pktlen,
+               wl_event_msg_t *event_ptr, void **data_ptr);
+
+#if defined(CONFIG_PM_SLEEP)
+static int dhd_pm_callback(struct notifier_block *nfb, unsigned long action, void *ignored)
+{
+       int ret = NOTIFY_DONE;
+       bool suspend = FALSE;
+       dhd_info_t *dhdinfo = (dhd_info_t*)container_of(nfb, const dhd_info_t, pm_notifier);;
+
+       BCM_REFERENCE(dhdinfo);
+       BCM_REFERENCE(suspend);
+
+       switch (action) {
+       case PM_HIBERNATION_PREPARE:
+       case PM_SUSPEND_PREPARE:
+               suspend = TRUE;
+               break;
+
+       case PM_POST_HIBERNATION:
+       case PM_POST_SUSPEND:
+               suspend = FALSE;
+               break;
+       }
+
+       printf("%s: action=%ld, suspend=%d, suspend_mode=%d\n",
+               __FUNCTION__, action, suspend, dhdinfo->pub.conf->suspend_mode);
+       if (suspend) {
+               DHD_OS_WAKE_LOCK_WAIVE(&dhdinfo->pub);
+               if (dhdinfo->pub.conf->suspend_mode == PM_NOTIFIER)
+                       dhd_suspend_resume_helper(dhdinfo, suspend, 0);
+#if defined(SUPPORT_P2P_GO_PS) && defined(PROP_TXSTATUS)
+               dhd_wlfc_suspend(&dhdinfo->pub);
+#endif /* defined(SUPPORT_P2P_GO_PS) && defined(PROP_TXSTATUS) */
+               if (dhdinfo->pub.conf->suspend_mode == PM_NOTIFIER)
+                       dhd_conf_set_suspend_resume(&dhdinfo->pub, suspend);
+               DHD_OS_WAKE_LOCK_RESTORE(&dhdinfo->pub);
+       } else {
+               if (dhdinfo->pub.conf->suspend_mode == PM_NOTIFIER)
+                       dhd_conf_set_suspend_resume(&dhdinfo->pub, suspend);
+#if defined(SUPPORT_P2P_GO_PS) && defined(PROP_TXSTATUS)
+               dhd_wlfc_resume(&dhdinfo->pub);
+#endif /* defined(SUPPORT_P2P_GO_PS) && defined(PROP_TXSTATUS) */
+               if (dhdinfo->pub.conf->suspend_mode == PM_NOTIFIER)
+                       dhd_suspend_resume_helper(dhdinfo, suspend, 0);
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && (LINUX_VERSION_CODE <= \
+        KERNEL_VERSION(2, 6, 39))
+       dhd_mmc_suspend = suspend;
+       smp_mb();
+#endif
+
+       return ret;
+}
+
+/* to make sure we won't register the same notifier twice, otherwise a loop is likely to be
+ * created in kernel notifier link list (with 'next' pointing to itself)
+ */
+static bool dhd_pm_notifier_registered = FALSE;
+
+extern int register_pm_notifier(struct notifier_block *nb);
+extern int unregister_pm_notifier(struct notifier_block *nb);
+#endif /* CONFIG_PM_SLEEP */
+
+/* Request scheduling of the bus rx frame */
+static void dhd_sched_rxf(dhd_pub_t *dhdp, void *skb);
+static void dhd_os_rxflock(dhd_pub_t *pub);
+static void dhd_os_rxfunlock(dhd_pub_t *pub);
+
+#if defined(DHD_H2D_LOG_TIME_SYNC)
+static void
+dhd_deferred_work_rte_log_time_sync(void *handle, void *event_info, u8 event);
+#endif /* DHD_H2D_LOG_TIME_SYNC */
+
+/** priv_link is the link between netdev and the dhdif and dhd_info structs. */
+typedef struct dhd_dev_priv {
+       dhd_info_t * dhd; /* cached pointer to dhd_info in netdevice priv */
+       dhd_if_t   * ifp; /* cached pointer to dhd_if in netdevice priv */
+       int          ifidx; /* interface index */
+       void       * lkup;
+} dhd_dev_priv_t;
+
+#define DHD_DEV_PRIV_SIZE       (sizeof(dhd_dev_priv_t))
+#define DHD_DEV_PRIV(dev)       ((dhd_dev_priv_t *)DEV_PRIV(dev))
+#define DHD_DEV_INFO(dev)       (((dhd_dev_priv_t *)DEV_PRIV(dev))->dhd)
+#define DHD_DEV_IFP(dev)        (((dhd_dev_priv_t *)DEV_PRIV(dev))->ifp)
+#define DHD_DEV_IFIDX(dev)      (((dhd_dev_priv_t *)DEV_PRIV(dev))->ifidx)
+#define DHD_DEV_LKUP(dev)              (((dhd_dev_priv_t *)DEV_PRIV(dev))->lkup)
+
+/** Clear the dhd net_device's private structure. */
+static inline void
+dhd_dev_priv_clear(struct net_device * dev)
+{
+       dhd_dev_priv_t * dev_priv;
+       ASSERT(dev != (struct net_device *)NULL);
+       dev_priv = DHD_DEV_PRIV(dev);
+       dev_priv->dhd = (dhd_info_t *)NULL;
+       dev_priv->ifp = (dhd_if_t *)NULL;
+       dev_priv->ifidx = DHD_BAD_IF;
+       dev_priv->lkup = (void *)NULL;
+}
+
+/** Setup the dhd net_device's private structure. */
+static inline void
+dhd_dev_priv_save(struct net_device * dev, dhd_info_t * dhd, dhd_if_t * ifp,
+                  int ifidx)
+{
+       dhd_dev_priv_t * dev_priv;
+       ASSERT(dev != (struct net_device *)NULL);
+       dev_priv = DHD_DEV_PRIV(dev);
+       dev_priv->dhd = dhd;
+       dev_priv->ifp = ifp;
+       dev_priv->ifidx = ifidx;
+}
+
+/* Return interface pointer */
+struct dhd_if * dhd_get_ifp(dhd_pub_t *dhdp, uint32 ifidx)
+{
+       ASSERT(ifidx < DHD_MAX_IFS);
+
+       if (!dhdp || !dhdp->info || ifidx >= DHD_MAX_IFS)
+               return NULL;
+
+       return dhdp->info->iflist[ifidx];
+}
+
+#ifdef PCIE_FULL_DONGLE
+
+/** Dummy objects are defined with state representing bad|down.
+ * Performance gains from reducing branch conditionals, instruction parallelism,
+ * dual issue, reducing load shadows, avail of larger pipelines.
+ * Use DHD_XXX_NULL instead of (dhd_xxx_t *)NULL, whenever an object pointer
+ * is accessed via the dhd_sta_t.
+ */
+
+/* Dummy dhd_info object */
+dhd_info_t dhd_info_null = {
+       .pub = {
+                .info = &dhd_info_null,
+#ifdef DHDTCPACK_SUPPRESS
+                .tcpack_sup_mode = TCPACK_SUP_REPLACE,
+#endif /* DHDTCPACK_SUPPRESS */
+                .up = FALSE,
+                .busstate = DHD_BUS_DOWN
+       }
+};
+#define DHD_INFO_NULL (&dhd_info_null)
+#define DHD_PUB_NULL  (&dhd_info_null.pub)
+
+/* Dummy netdevice object */
+struct net_device dhd_net_dev_null = {
+       .reg_state = NETREG_UNREGISTERED
+};
+#define DHD_NET_DEV_NULL (&dhd_net_dev_null)
+
+/* Dummy dhd_if object */
+dhd_if_t dhd_if_null = {
+#ifdef WMF
+       .wmf = { .wmf_enable = TRUE },
+#endif
+       .info = DHD_INFO_NULL,
+       .net = DHD_NET_DEV_NULL,
+       .idx = DHD_BAD_IF
+};
+#define DHD_IF_NULL  (&dhd_if_null)
+
+/* XXX should we use the sta_pool[0] object as DHD_STA_NULL? */
+#define DHD_STA_NULL ((dhd_sta_t *)NULL)
+
+/** Interface STA list management. */
+
+/** Alloc/Free a dhd_sta object from the dhd instances' sta_pool. */
+static void dhd_sta_free(dhd_pub_t *pub, dhd_sta_t *sta);
+static dhd_sta_t * dhd_sta_alloc(dhd_pub_t * dhdp);
+
+/* Delete a dhd_sta or flush all dhd_sta in an interface's sta_list. */
+static void dhd_if_del_sta_list(dhd_if_t * ifp);
+
+/* Construct/Destruct a sta pool. */
+static int dhd_sta_pool_init(dhd_pub_t *dhdp, int max_sta);
+static void dhd_sta_pool_fini(dhd_pub_t *dhdp, int max_sta);
+/* Clear the pool of dhd_sta_t objects for built-in type driver */
+static void dhd_sta_pool_clear(dhd_pub_t *dhdp, int max_sta);
+
+/** Reset a dhd_sta object and free into the dhd pool. */
+static void
+dhd_sta_free(dhd_pub_t * dhdp, dhd_sta_t * sta)
+{
+       int prio;
+
+       ASSERT((sta != DHD_STA_NULL) && (sta->idx != ID16_INVALID));
+
+       ASSERT((dhdp->staid_allocator != NULL) && (dhdp->sta_pool != NULL));
+
+       /*
+        * Flush and free all packets in all flowring's queues belonging to sta.
+        * Packets in flow ring will be flushed later.
+        */
+       for (prio = 0; prio < (int)NUMPRIO; prio++) {
+               uint16 flowid = sta->flowid[prio];
+
+               if (flowid != FLOWID_INVALID) {
+                       unsigned long flags;
+                       flow_ring_node_t * flow_ring_node;
+
+#ifdef DHDTCPACK_SUPPRESS
+                       /* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+                        * when there is a newly coming packet from network stack.
+                        */
+                       dhd_tcpack_info_tbl_clean(dhdp);
+#endif /* DHDTCPACK_SUPPRESS */
+
+                       flow_ring_node = dhd_flow_ring_node(dhdp, flowid);
+                       if (flow_ring_node) {
+                               flow_queue_t *queue = &flow_ring_node->queue;
+
+                               DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+                               flow_ring_node->status = FLOW_RING_STATUS_STA_FREEING;
+
+                               if (!DHD_FLOW_QUEUE_EMPTY(queue)) {
+                                       void * pkt;
+                                       while ((pkt = dhd_flow_queue_dequeue(dhdp, queue)) !=
+                                               NULL) {
+                                               PKTFREE(dhdp->osh, pkt, TRUE);
+                                       }
+                               }
+
+                               DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+                               ASSERT(DHD_FLOW_QUEUE_EMPTY(queue));
+                       }
+               }
+
+               sta->flowid[prio] = FLOWID_INVALID;
+       }
+
+       id16_map_free(dhdp->staid_allocator, sta->idx);
+       DHD_CUMM_CTR_INIT(&sta->cumm_ctr);
+       sta->ifp = DHD_IF_NULL; /* dummy dhd_if object */
+       sta->ifidx = DHD_BAD_IF;
+       bzero(sta->ea.octet, ETHER_ADDR_LEN);
+       INIT_LIST_HEAD(&sta->list);
+       sta->idx = ID16_INVALID; /* implying free */
+}
+
+/** Allocate a dhd_sta object from the dhd pool. */
+static dhd_sta_t *
+dhd_sta_alloc(dhd_pub_t * dhdp)
+{
+       uint16 idx;
+       dhd_sta_t * sta;
+       dhd_sta_pool_t * sta_pool;
+
+       ASSERT((dhdp->staid_allocator != NULL) && (dhdp->sta_pool != NULL));
+
+       idx = id16_map_alloc(dhdp->staid_allocator);
+       if (idx == ID16_INVALID) {
+               DHD_ERROR(("%s: cannot get free staid\n", __FUNCTION__));
+               return DHD_STA_NULL;
+       }
+
+       sta_pool = (dhd_sta_pool_t *)(dhdp->sta_pool);
+       sta = &sta_pool[idx];
+
+       ASSERT((sta->idx == ID16_INVALID) &&
+              (sta->ifp == DHD_IF_NULL) && (sta->ifidx == DHD_BAD_IF));
+
+       DHD_CUMM_CTR_INIT(&sta->cumm_ctr);
+
+       sta->idx = idx; /* implying allocated */
+
+       return sta;
+}
+
+/** Delete all STAs in an interface's STA list. */
+static void
+dhd_if_del_sta_list(dhd_if_t *ifp)
+{
+       dhd_sta_t *sta, *next;
+       unsigned long flags;
+
+       DHD_IF_STA_LIST_LOCK(&ifp->sta_list_lock, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_entry_safe(sta, next, &ifp->sta_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               list_del(&sta->list);
+               dhd_sta_free(&ifp->info->pub, sta);
+       }
+
+       DHD_IF_STA_LIST_UNLOCK(&ifp->sta_list_lock, flags);
+
+       return;
+}
+
+/** Construct a pool of dhd_sta_t objects to be used by interfaces. */
+static int
+dhd_sta_pool_init(dhd_pub_t *dhdp, int max_sta)
+{
+       int idx, prio, sta_pool_memsz;
+       dhd_sta_t * sta;
+       dhd_sta_pool_t * sta_pool;
+       void * staid_allocator;
+
+       ASSERT(dhdp != (dhd_pub_t *)NULL);
+       ASSERT((dhdp->staid_allocator == NULL) && (dhdp->sta_pool == NULL));
+
+       /* dhd_sta objects per radio are managed in a table. id#0 reserved. */
+       staid_allocator = id16_map_init(dhdp->osh, max_sta, 1);
+       if (staid_allocator == NULL) {
+               DHD_ERROR(("%s: sta id allocator init failure\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       /* Pre allocate a pool of dhd_sta objects (one extra). */
+       sta_pool_memsz = ((max_sta + 1) * sizeof(dhd_sta_t)); /* skip idx 0 */
+       sta_pool = (dhd_sta_pool_t *)MALLOC(dhdp->osh, sta_pool_memsz);
+       if (sta_pool == NULL) {
+               DHD_ERROR(("%s: sta table alloc failure\n", __FUNCTION__));
+               id16_map_fini(dhdp->osh, staid_allocator);
+               return BCME_ERROR;
+       }
+
+       dhdp->sta_pool = sta_pool;
+       dhdp->staid_allocator = staid_allocator;
+
+       /* Initialize all sta(s) for the pre-allocated free pool. */
+       bzero((uchar *)sta_pool, sta_pool_memsz);
+       for (idx = max_sta; idx >= 1; idx--) { /* skip sta_pool[0] */
+               sta = &sta_pool[idx];
+               sta->idx = id16_map_alloc(staid_allocator);
+               ASSERT(sta->idx <= max_sta);
+       }
+
+       /* Now place them into the pre-allocated free pool. */
+       for (idx = 1; idx <= max_sta; idx++) {
+               sta = &sta_pool[idx];
+               for (prio = 0; prio < (int)NUMPRIO; prio++) {
+                       sta->flowid[prio] = FLOWID_INVALID; /* Flow rings do not exist */
+               }
+               dhd_sta_free(dhdp, sta);
+       }
+
+       return BCME_OK;
+}
+
+/** Destruct the pool of dhd_sta_t objects.
+ * Caller must ensure that no STA objects are currently associated with an if.
+ */
+static void
+dhd_sta_pool_fini(dhd_pub_t *dhdp, int max_sta)
+{
+       dhd_sta_pool_t * sta_pool = (dhd_sta_pool_t *)dhdp->sta_pool;
+
+       if (sta_pool) {
+               int idx;
+               int sta_pool_memsz = ((max_sta + 1) * sizeof(dhd_sta_t));
+               for (idx = 1; idx <= max_sta; idx++) {
+                       ASSERT(sta_pool[idx].ifp == DHD_IF_NULL);
+                       ASSERT(sta_pool[idx].idx == ID16_INVALID);
+               }
+               MFREE(dhdp->osh, dhdp->sta_pool, sta_pool_memsz);
+       }
+
+       id16_map_fini(dhdp->osh, dhdp->staid_allocator);
+       dhdp->staid_allocator = NULL;
+}
+
+/* Clear the pool of dhd_sta_t objects for built-in type driver */
+static void
+dhd_sta_pool_clear(dhd_pub_t *dhdp, int max_sta)
+{
+       int idx, prio, sta_pool_memsz;
+       dhd_sta_t * sta;
+       dhd_sta_pool_t * sta_pool;
+       void *staid_allocator;
+
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       sta_pool = (dhd_sta_pool_t *)dhdp->sta_pool;
+       staid_allocator = dhdp->staid_allocator;
+
+       if (!sta_pool) {
+               DHD_ERROR(("%s: sta_pool is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (!staid_allocator) {
+               DHD_ERROR(("%s: staid_allocator is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       /* clear free pool */
+       sta_pool_memsz = ((max_sta + 1) * sizeof(dhd_sta_t));
+       bzero((uchar *)sta_pool, sta_pool_memsz);
+
+       /* dhd_sta objects per radio are managed in a table. id#0 reserved. */
+       id16_map_clear(staid_allocator, max_sta, 1);
+
+       /* Initialize all sta(s) for the pre-allocated free pool. */
+       for (idx = max_sta; idx >= 1; idx--) { /* skip sta_pool[0] */
+               sta = &sta_pool[idx];
+               sta->idx = id16_map_alloc(staid_allocator);
+               ASSERT(sta->idx <= max_sta);
+       }
+       /* Now place them into the pre-allocated free pool. */
+       for (idx = 1; idx <= max_sta; idx++) {
+               sta = &sta_pool[idx];
+               for (prio = 0; prio < (int)NUMPRIO; prio++) {
+                       sta->flowid[prio] = FLOWID_INVALID; /* Flow rings do not exist */
+               }
+               dhd_sta_free(dhdp, sta);
+       }
+}
+
+/** Find STA with MAC address ea in an interface's STA list. */
+dhd_sta_t *
+dhd_find_sta(void *pub, int ifidx, void *ea)
+{
+       dhd_sta_t *sta;
+       dhd_if_t *ifp;
+       unsigned long flags;
+
+       ASSERT(ea != NULL);
+       ifp = dhd_get_ifp((dhd_pub_t *)pub, ifidx);
+       if (ifp == NULL)
+               return DHD_STA_NULL;
+
+       DHD_IF_STA_LIST_LOCK(&ifp->sta_list_lock, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_entry(sta, &ifp->sta_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (!memcmp(sta->ea.octet, ea, ETHER_ADDR_LEN)) {
+                       DHD_INFO(("%s: Found STA " MACDBG "\n",
+                               __FUNCTION__, MAC2STRDBG((char *)ea)));
+                       DHD_IF_STA_LIST_UNLOCK(&ifp->sta_list_lock, flags);
+                       return sta;
+               }
+       }
+
+       DHD_IF_STA_LIST_UNLOCK(&ifp->sta_list_lock, flags);
+
+       return DHD_STA_NULL;
+}
+
+/** Add STA into the interface's STA list. */
+dhd_sta_t *
+dhd_add_sta(void *pub, int ifidx, void *ea)
+{
+       dhd_sta_t *sta;
+       dhd_if_t *ifp;
+       unsigned long flags;
+
+       ASSERT(ea != NULL);
+       ifp = dhd_get_ifp((dhd_pub_t *)pub, ifidx);
+       if (ifp == NULL)
+               return DHD_STA_NULL;
+
+       if (!memcmp(ifp->net->dev_addr, ea, ETHER_ADDR_LEN)) {
+               DHD_ERROR(("%s: Serious FAILURE, receive own MAC %pM !!\n", __FUNCTION__, ea));
+               return DHD_STA_NULL;
+       }
+
+       sta = dhd_sta_alloc((dhd_pub_t *)pub);
+       if (sta == DHD_STA_NULL) {
+               DHD_ERROR(("%s: Alloc failed\n", __FUNCTION__));
+               return DHD_STA_NULL;
+       }
+
+       memcpy(sta->ea.octet, ea, ETHER_ADDR_LEN);
+
+       /* link the sta and the dhd interface */
+       sta->ifp = ifp;
+       sta->ifidx = ifidx;
+       INIT_LIST_HEAD(&sta->list);
+
+       DHD_IF_STA_LIST_LOCK(&ifp->sta_list_lock, flags);
+
+       list_add_tail(&sta->list, &ifp->sta_list);
+
+       DHD_ERROR(("%s: Adding  STA " MACDBG "\n",
+               __FUNCTION__, MAC2STRDBG((char *)ea)));
+
+       DHD_IF_STA_LIST_UNLOCK(&ifp->sta_list_lock, flags);
+
+       return sta;
+}
+
+/** Delete all STAs from the interface's STA list. */
+void
+dhd_del_all_sta(void *pub, int ifidx)
+{
+       dhd_sta_t *sta, *next;
+       dhd_if_t *ifp;
+       unsigned long flags;
+
+       ifp = dhd_get_ifp((dhd_pub_t *)pub, ifidx);
+       if (ifp == NULL)
+               return;
+
+       DHD_IF_STA_LIST_LOCK(&ifp->sta_list_lock, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_entry_safe(sta, next, &ifp->sta_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               list_del(&sta->list);
+               dhd_sta_free(&ifp->info->pub, sta);
+#ifdef DHD_L2_FILTER
+               if (ifp->parp_enable) {
+                       /* clear Proxy ARP cache of specific Ethernet Address */
+                       bcm_l2_filter_arp_table_update(((dhd_pub_t*)pub)->osh,
+                                       ifp->phnd_arp_table, FALSE,
+                                       sta->ea.octet, FALSE, ((dhd_pub_t*)pub)->tickcnt);
+               }
+#endif /* DHD_L2_FILTER */
+       }
+
+       DHD_IF_STA_LIST_UNLOCK(&ifp->sta_list_lock, flags);
+
+       return;
+}
+
+/** Delete STA from the interface's STA list. */
+void
+dhd_del_sta(void *pub, int ifidx, void *ea)
+{
+       dhd_sta_t *sta, *next;
+       dhd_if_t *ifp;
+       unsigned long flags;
+
+       ASSERT(ea != NULL);
+       ifp = dhd_get_ifp((dhd_pub_t *)pub, ifidx);
+       if (ifp == NULL)
+               return;
+
+       DHD_IF_STA_LIST_LOCK(&ifp->sta_list_lock, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_entry_safe(sta, next, &ifp->sta_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (!memcmp(sta->ea.octet, ea, ETHER_ADDR_LEN)) {
+                       DHD_ERROR(("%s: Deleting STA " MACDBG "\n",
+                               __FUNCTION__, MAC2STRDBG(sta->ea.octet)));
+                       list_del(&sta->list);
+                       dhd_sta_free(&ifp->info->pub, sta);
+               }
+       }
+
+       DHD_IF_STA_LIST_UNLOCK(&ifp->sta_list_lock, flags);
+#ifdef DHD_L2_FILTER
+       if (ifp->parp_enable) {
+               /* clear Proxy ARP cache of specific Ethernet Address */
+               bcm_l2_filter_arp_table_update(((dhd_pub_t*)pub)->osh, ifp->phnd_arp_table, FALSE,
+                       ea, FALSE, ((dhd_pub_t*)pub)->tickcnt);
+       }
+#endif /* DHD_L2_FILTER */
+       return;
+}
+
+/** Add STA if it doesn't exist. Not reentrant. */
+dhd_sta_t*
+dhd_findadd_sta(void *pub, int ifidx, void *ea)
+{
+       dhd_sta_t *sta;
+
+       sta = dhd_find_sta(pub, ifidx, ea);
+
+       if (!sta) {
+               /* Add entry */
+               sta = dhd_add_sta(pub, ifidx, ea);
+       }
+
+       return sta;
+}
+
+#if defined(DHD_IGMP_UCQUERY) || defined(DHD_UCAST_UPNP)
+static struct list_head *
+dhd_sta_list_snapshot(dhd_info_t *dhd, dhd_if_t *ifp, struct list_head *snapshot_list)
+{
+       unsigned long flags;
+       dhd_sta_t *sta, *snapshot;
+
+       INIT_LIST_HEAD(snapshot_list);
+
+       DHD_IF_STA_LIST_LOCK(&ifp->sta_list_lock, flags);
+
+       list_for_each_entry(sta, &ifp->sta_list, list) {
+               /* allocate one and add to snapshot */
+               snapshot = (dhd_sta_t *)MALLOC(dhd->pub.osh, sizeof(dhd_sta_t));
+               if (snapshot == NULL) {
+                       DHD_ERROR(("%s: Cannot allocate memory\n", __FUNCTION__));
+                       continue;
+               }
+
+               memcpy(snapshot->ea.octet, sta->ea.octet, ETHER_ADDR_LEN);
+
+               INIT_LIST_HEAD(&snapshot->list);
+               list_add_tail(&snapshot->list, snapshot_list);
+       }
+
+       DHD_IF_STA_LIST_UNLOCK(&ifp->sta_list_lock, flags);
+
+       return snapshot_list;
+}
+
+static void
+dhd_sta_list_snapshot_free(dhd_info_t *dhd, struct list_head *snapshot_list)
+{
+       dhd_sta_t *sta, *next;
+
+       list_for_each_entry_safe(sta, next, snapshot_list, list) {
+               list_del(&sta->list);
+               MFREE(dhd->pub.osh, sta, sizeof(dhd_sta_t));
+       }
+}
+#endif /* DHD_IGMP_UCQUERY || DHD_UCAST_UPNP */
+
+#else
+static inline void dhd_if_del_sta_list(dhd_if_t *ifp) {}
+static inline int dhd_sta_pool_init(dhd_pub_t *dhdp, int max_sta) { return BCME_OK; }
+static inline void dhd_sta_pool_fini(dhd_pub_t *dhdp, int max_sta) {}
+static inline void dhd_sta_pool_clear(dhd_pub_t *dhdp, int max_sta) {}
+dhd_sta_t *dhd_findadd_sta(void *pub, int ifidx, void *ea) { return NULL; }
+dhd_sta_t *dhd_find_sta(void *pub, int ifidx, void *ea) { return NULL; }
+void dhd_del_sta(void *pub, int ifidx, void *ea) {}
+#endif /* PCIE_FULL_DONGLE */
+
+#if defined(DNGL_AXI_ERROR_LOGGING) && defined(DHD_USE_WQ_FOR_DNGL_AXI_ERROR)
+void
+dhd_axi_error_dispatch(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+       schedule_work(&dhd->axi_error_dispatcher_work);
+}
+
+static void dhd_axi_error_dispatcher_fn(struct work_struct * work)
+{
+       struct dhd_info *dhd =
+               container_of(work, struct dhd_info, axi_error_dispatcher_work);
+       dhd_axi_error(&dhd->pub);
+}
+#endif /* DNGL_AXI_ERROR_LOGGING && DHD_USE_WQ_FOR_DNGL_AXI_ERROR */
+
+/** Returns dhd iflist index corresponding the the bssidx provided by apps */
+int dhd_bssidx2idx(dhd_pub_t *dhdp, uint32 bssidx)
+{
+       dhd_if_t *ifp;
+       dhd_info_t *dhd = dhdp->info;
+       int i;
+
+       ASSERT(bssidx < DHD_MAX_IFS);
+       ASSERT(dhdp);
+
+       for (i = 0; i < DHD_MAX_IFS; i++) {
+               ifp = dhd->iflist[i];
+               if (ifp && (ifp->bssidx == bssidx)) {
+                       DHD_TRACE(("Index manipulated for %s from %d to %d\n",
+                               ifp->name, bssidx, i));
+                       break;
+               }
+       }
+       return i;
+}
+
+static inline int dhd_rxf_enqueue(dhd_pub_t *dhdp, void* skb)
+{
+       uint32 store_idx;
+       uint32 sent_idx;
+
+       if (!skb) {
+               DHD_ERROR(("dhd_rxf_enqueue: NULL skb!!!\n"));
+               return BCME_ERROR;
+       }
+
+       dhd_os_rxflock(dhdp);
+       store_idx = dhdp->store_idx;
+       sent_idx = dhdp->sent_idx;
+       if (dhdp->skbbuf[store_idx] != NULL) {
+               /* Make sure the previous packets are processed */
+               dhd_os_rxfunlock(dhdp);
+               DHD_ERROR(("dhd_rxf_enqueue: pktbuf not consumed %p, store idx %d sent idx %d\n",
+                       skb, store_idx, sent_idx));
+               /* removed msleep here, should use wait_event_timeout if we
+                * want to give rx frame thread a chance to run
+                */
+#if defined(WAIT_DEQUEUE)
+               OSL_SLEEP(1);
+#endif
+               return BCME_ERROR;
+       }
+       DHD_TRACE(("dhd_rxf_enqueue: Store SKB %p. idx %d -> %d\n",
+               skb, store_idx, (store_idx + 1) & (MAXSKBPEND - 1)));
+       dhdp->skbbuf[store_idx] = skb;
+       dhdp->store_idx = (store_idx + 1) & (MAXSKBPEND - 1);
+       dhd_os_rxfunlock(dhdp);
+
+       return BCME_OK;
+}
+
+static inline void* dhd_rxf_dequeue(dhd_pub_t *dhdp)
+{
+       uint32 store_idx;
+       uint32 sent_idx;
+       void *skb;
+
+       dhd_os_rxflock(dhdp);
+
+       store_idx = dhdp->store_idx;
+       sent_idx = dhdp->sent_idx;
+       skb = dhdp->skbbuf[sent_idx];
+
+       if (skb == NULL) {
+               dhd_os_rxfunlock(dhdp);
+               DHD_ERROR(("dhd_rxf_dequeue: Dequeued packet is NULL, store idx %d sent idx %d\n",
+                       store_idx, sent_idx));
+               return NULL;
+       }
+
+       dhdp->skbbuf[sent_idx] = NULL;
+       dhdp->sent_idx = (sent_idx + 1) & (MAXSKBPEND - 1);
+
+       DHD_TRACE(("dhd_rxf_dequeue: netif_rx_ni(%p), sent idx %d\n",
+               skb, sent_idx));
+
+       dhd_os_rxfunlock(dhdp);
+
+       return skb;
+}
+
+int dhd_process_cid_mac(dhd_pub_t *dhdp, bool prepost)
+{
+       uint chipid = dhd_bus_chip_id(dhdp);
+       uint revid = dhd_bus_chiprev_id(dhdp);
+       int ret = BCME_OK;
+       if (prepost) { /* pre process */
+               ret = dhd_alloc_cis(dhdp);
+               if (ret != BCME_OK) {
+                       return ret;
+               }
+               switch (chipid) {
+                       case BCM4389_CHIP_GRPID:
+                               if (revid == 3) {
+                                       /* BCM4389A0 is used legacy cisdump iovar */
+                                       dhd_read_cis(dhdp);
+                               } else {
+                                       /* BCM4389B0 or higher rev is used new otp iovar */
+                                       dhd_read_otp_sw_rgn(dhdp);
+                               }
+                               break;
+                       default:
+                               dhd_read_cis(dhdp);
+                               break;
+               }
+               dhd_check_module_cid(dhdp);
+               dhd_check_module_mac(dhdp);
+               dhd_set_macaddr_from_file(dhdp);
+       } else { /* post process */
+               dhd_write_macaddr(&dhdp->mac);
+               dhd_clear_cis(dhdp);
+       }
+
+       return BCME_OK;
+}
+
+// terence 20160615: fix building error if ARP_OFFLOAD_SUPPORT removed
+#if defined(PKT_FILTER_SUPPORT)
+#if defined(ARP_OFFLOAD_SUPPORT) && !defined(GAN_LITE_NAT_KEEPALIVE_FILTER)
+static bool
+_turn_on_arp_filter(dhd_pub_t *dhd, int op_mode_param)
+{
+       bool _apply = FALSE;
+       /* In case of IBSS mode, apply arp pkt filter */
+       if (op_mode_param & DHD_FLAG_IBSS_MODE) {
+               _apply = TRUE;
+               goto exit;
+       }
+       /* In case of P2P GO or GC, apply pkt filter to pass arp pkt to host */
+       if (op_mode_param & (DHD_FLAG_P2P_GC_MODE | DHD_FLAG_P2P_GO_MODE)) {
+               _apply = TRUE;
+               goto exit;
+       }
+
+exit:
+       return _apply;
+}
+#endif /* !GAN_LITE_NAT_KEEPALIVE_FILTER */
+
+void
+dhd_set_packet_filter(dhd_pub_t *dhd)
+{
+       int i;
+
+       DHD_TRACE(("%s: enter\n", __FUNCTION__));
+       if (dhd_pkt_filter_enable) {
+               for (i = 0; i < dhd->pktfilter_count; i++) {
+                       dhd_pktfilter_offload_set(dhd, dhd->pktfilter[i]);
+               }
+       }
+}
+
+void
+dhd_enable_packet_filter(int value, dhd_pub_t *dhd)
+{
+       int i;
+
+       DHD_ERROR(("%s: enter, value = %d\n", __FUNCTION__, value));
+       if ((dhd->op_mode & DHD_FLAG_HOSTAP_MODE) && value &&
+                       !dhd_conf_get_insuspend(dhd, AP_FILTER_IN_SUSPEND)) {
+               DHD_ERROR(("%s: DHD_FLAG_HOSTAP_MODE\n", __FUNCTION__));
+               return;
+       }
+       /* 1 - Enable packet filter, only allow unicast packet to send up */
+       /* 0 - Disable packet filter */
+       if (dhd_pkt_filter_enable && (!value ||
+           (dhd_support_sta_mode(dhd) && !dhd->dhcp_in_progress) ||
+           dhd_conf_get_insuspend(dhd, AP_FILTER_IN_SUSPEND)))
+       {
+               for (i = 0; i < dhd->pktfilter_count; i++) {
+// terence 20160615: fix building error if ARP_OFFLOAD_SUPPORT removed
+#if defined(ARP_OFFLOAD_SUPPORT) && !defined(GAN_LITE_NAT_KEEPALIVE_FILTER)
+                       if (value && (i == DHD_ARP_FILTER_NUM) &&
+                               !_turn_on_arp_filter(dhd, dhd->op_mode)) {
+                               DHD_TRACE(("Do not turn on ARP white list pkt filter:"
+                                       "val %d, cnt %d, op_mode 0x%x\n",
+                                       value, i, dhd->op_mode));
+                               continue;
+                       }
+#endif /* !GAN_LITE_NAT_KEEPALIVE_FILTER */
+#ifdef APSTA_BLOCK_ARP_DURING_DHCP
+                       if (value && (i == DHD_BROADCAST_ARP_FILTER_NUM) &&
+                               dhd->pktfilter[DHD_BROADCAST_ARP_FILTER_NUM]) {
+                               /* XXX: BROADCAST_ARP_FILTER is only for the
+                                * STA/SoftAP concurrent mode (Please refer to RB:90348)
+                                * Remove the filter for other cases explicitly
+                                */
+                               DHD_ERROR(("%s: Remove the DHD_BROADCAST_ARP_FILTER\n",
+                                       __FUNCTION__));
+                               dhd_packet_filter_add_remove(dhd, FALSE,
+                                       DHD_BROADCAST_ARP_FILTER_NUM);
+                       }
+#endif /* APSTA_BLOCK_ARP_DURING_DHCP */
+                       dhd_pktfilter_offload_enable(dhd, dhd->pktfilter[i],
+                               value, dhd_master_mode);
+               }
+       }
+}
+
+int
+dhd_packet_filter_add_remove(dhd_pub_t *dhdp, int add_remove, int num)
+{
+       char *filterp = NULL;
+       int filter_id = 0;
+
+       switch (num) {
+               case DHD_BROADCAST_FILTER_NUM:
+                       filterp = "101 0 0 0 0xFFFFFFFFFFFF 0xFFFFFFFFFFFF";
+                       filter_id = 101;
+                       break;
+               case DHD_MULTICAST4_FILTER_NUM:
+                       filter_id = 102;
+                       if (FW_SUPPORTED((dhdp), pf6)) {
+                               if (dhdp->pktfilter[num] != NULL) {
+                                       dhd_pktfilter_offload_delete(dhdp, filter_id);
+                                       dhdp->pktfilter[num] = NULL;
+                               }
+                               if (!add_remove) {
+                                       filterp = DISCARD_IPV4_MCAST;
+                                       add_remove = 1;
+                                       break;
+                               }
+                       } /* XXX: intend omitting else case */
+                       filterp = "102 0 0 0 0xFFFFFF 0x01005E";
+                       break;
+               case DHD_MULTICAST6_FILTER_NUM:
+                       filter_id = 103;
+                       if (FW_SUPPORTED((dhdp), pf6)) {
+                               if (dhdp->pktfilter[num] != NULL) {
+                                       dhd_pktfilter_offload_delete(dhdp, filter_id);
+                                       dhdp->pktfilter[num] = NULL;
+                               }
+                               if (!add_remove) {
+                                       filterp = DISCARD_IPV6_MCAST;
+                                       add_remove = 1;
+                                       break;
+                               }
+                       } /* XXX: intend omitting else case */
+                       filterp = "103 0 0 0 0xFFFF 0x3333";
+                       break;
+               case DHD_MDNS_FILTER_NUM:
+                       filterp = "104 0 0 0 0xFFFFFFFFFFFF 0x01005E0000FB";
+                       filter_id = 104;
+                       break;
+               case DHD_ARP_FILTER_NUM:
+                       filterp = "105 0 0 12 0xFFFF 0x0806";
+                       filter_id = 105;
+                       break;
+               case DHD_BROADCAST_ARP_FILTER_NUM:
+                       filterp = "106 0 0 0 0xFFFFFFFFFFFF0000000000000806"
+                               " 0xFFFFFFFFFFFF0000000000000806";
+                       filter_id = 106;
+                       break;
+               default:
+                       return -EINVAL;
+       }
+
+       /* Add filter */
+       if (add_remove) {
+               dhdp->pktfilter[num] = filterp;
+               dhd_pktfilter_offload_set(dhdp, dhdp->pktfilter[num]);
+       } else { /* Delete filter */
+               if (dhdp->pktfilter[num] != NULL) {
+                       dhd_pktfilter_offload_delete(dhdp, filter_id);
+                       dhdp->pktfilter[num] = NULL;
+               }
+       }
+
+       return 0;
+}
+#endif /* PKT_FILTER_SUPPORT */
+
+static int dhd_set_suspend(int value, dhd_pub_t *dhd)
+{
+#ifndef SUPPORT_PM2_ONLY
+       int power_mode = PM_MAX;
+#endif /* SUPPORT_PM2_ONLY */
+       /* wl_pkt_filter_enable_t       enable_parm; */
+       int bcn_li_dtim = 0; /* Default bcn_li_dtim in resume mode is 0 */
+       int ret = 0;
+#ifdef DHD_USE_EARLYSUSPEND
+#ifdef CUSTOM_BCN_TIMEOUT_IN_SUSPEND
+       int bcn_timeout = 0;
+#endif /* CUSTOM_BCN_TIMEOUT_IN_SUSPEND */
+#ifdef CUSTOM_ROAM_TIME_THRESH_IN_SUSPEND
+       int roam_time_thresh = 0;   /* (ms) */
+#endif /* CUSTOM_ROAM_TIME_THRESH_IN_SUSPEND */
+#ifndef ENABLE_FW_ROAM_SUSPEND
+       uint roamvar = 1;
+#endif /* ENABLE_FW_ROAM_SUSPEND */
+#ifdef ENABLE_BCN_LI_BCN_WAKEUP
+       int bcn_li_bcn = 1;
+#endif /* ENABLE_BCN_LI_BCN_WAKEUP */
+       uint nd_ra_filter = 0;
+#ifdef ENABLE_IPMCAST_FILTER
+       int ipmcast_l2filter;
+#endif /* ENABLE_IPMCAST_FILTER */
+#ifdef CUSTOM_EVENT_PM_WAKE
+       uint32 pm_awake_thresh = CUSTOM_EVENT_PM_WAKE;
+#endif /* CUSTOM_EVENT_PM_WAKE */
+#endif /* DHD_USE_EARLYSUSPEND */
+#ifdef PASS_ALL_MCAST_PKTS
+       struct dhd_info *dhdinfo;
+       uint32 allmulti;
+       uint i;
+#endif /* PASS_ALL_MCAST_PKTS */
+#ifdef DYNAMIC_SWOOB_DURATION
+#ifndef CUSTOM_INTR_WIDTH
+#define CUSTOM_INTR_WIDTH 100
+       int intr_width = 0;
+#endif /* CUSTOM_INTR_WIDTH */
+#endif /* DYNAMIC_SWOOB_DURATION */
+
+#if defined(BCMPCIE)
+       int lpas = 0;
+       int dtim_period = 0;
+       int bcn_interval = 0;
+       int bcn_to_dly = 0;
+#if defined(CUSTOM_BCN_TIMEOUT_IN_SUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+       bcn_timeout = CUSTOM_BCN_TIMEOUT_SETTING;
+#else
+       int bcn_timeout = CUSTOM_BCN_TIMEOUT_SETTING;
+#endif /* CUSTOM_BCN_TIMEOUT_IN_SUSPEND && DHD_USE_EARLYSUSPEND */
+#endif /* OEM_ANDROID && BCMPCIE */
+
+       if (!dhd)
+               return -ENODEV;
+
+#ifdef PASS_ALL_MCAST_PKTS
+       dhdinfo = dhd->info;
+#endif /* PASS_ALL_MCAST_PKTS */
+
+       DHD_TRACE(("%s: enter, value = %d in_suspend=%d\n",
+               __FUNCTION__, value, dhd->in_suspend));
+
+       dhd_suspend_lock(dhd);
+
+#ifdef CUSTOM_SET_CPUCORE
+       DHD_TRACE(("%s set cpucore(suspend%d)\n", __FUNCTION__, value));
+       /* set specific cpucore */
+       dhd_set_cpucore(dhd, TRUE);
+#endif /* CUSTOM_SET_CPUCORE */
+       if (dhd->up) {
+               if (value && dhd->in_suspend) {
+#ifdef PKT_FILTER_SUPPORT
+                               dhd->early_suspended = 1;
+#endif
+                               /* Kernel suspended */
+                               DHD_ERROR(("%s: force extra Suspend setting \n", __FUNCTION__));
+
+#ifndef SUPPORT_PM2_ONLY
+                               dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)&power_mode,
+                                                sizeof(power_mode), TRUE, 0);
+#endif /* SUPPORT_PM2_ONLY */
+
+#ifdef PKT_FILTER_SUPPORT
+                               /* Enable packet filter,
+                                * only allow unicast packet to send up
+                                */
+                               dhd_enable_packet_filter(1, dhd);
+#ifdef APF
+                               dhd_dev_apf_enable_filter(dhd_linux_get_primary_netdev(dhd));
+#endif /* APF */
+#endif /* PKT_FILTER_SUPPORT */
+#ifdef ARP_OFFLOAD_SUPPORT
+                               if (dhd->arpoe_enable) {
+                                       dhd_arp_offload_enable(dhd, TRUE);
+                               }
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#ifdef PASS_ALL_MCAST_PKTS
+                               allmulti = 0;
+                               for (i = 0; i < DHD_MAX_IFS; i++) {
+                                       if (dhdinfo->iflist[i] && dhdinfo->iflist[i]->net)
+                                               ret = dhd_iovar(dhd, i, "allmulti",
+                                                               (char *)&allmulti,
+                                                               sizeof(allmulti),
+                                                               NULL, 0, TRUE);
+                                               if (ret < 0) {
+                                                       DHD_ERROR(("%s allmulti failed %d\n",
+                                                               __FUNCTION__, ret));
+                                               }
+                               }
+#endif /* PASS_ALL_MCAST_PKTS */
+
+                               /* If DTIM skip is set up as default, force it to wake
+                                * each third DTIM for better power savings.  Note that
+                                * one side effect is a chance to miss BC/MC packet.
+                                */
+#ifdef WLTDLS
+                               /* Do not set bcn_li_ditm on WFD mode */
+                               if (dhd->tdls_mode) {
+                                       bcn_li_dtim = 0;
+                               } else
+#endif /* WLTDLS */
+#if defined(BCMPCIE)
+                               bcn_li_dtim = dhd_get_suspend_bcn_li_dtim(dhd, &dtim_period,
+                                               &bcn_interval);
+                               ret = dhd_iovar(dhd, 0, "bcn_li_dtim", (char *)&bcn_li_dtim,
+                                               sizeof(bcn_li_dtim), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s bcn_li_dtim failed %d\n",
+                                                       __FUNCTION__, ret));
+                               }
+                               if ((bcn_li_dtim * dtim_period * bcn_interval) >=
+                                       MIN_DTIM_FOR_ROAM_THRES_EXTEND) {
+                                       /*
+                                        * Increase max roaming threshold from 2 secs to 8 secs
+                                        * the real roam threshold is MIN(max_roam_threshold,
+                                        * bcn_timeout/2)
+                                        */
+                                       lpas = 1;
+                                       ret = dhd_iovar(dhd, 0, "lpas", (char *)&lpas, sizeof(lpas),
+                                                       NULL, 0, TRUE);
+                                       if (ret < 0) {
+                                               if (ret == BCME_UNSUPPORTED) {
+                                                       DHD_ERROR(("%s lpas, UNSUPPORTED\n",
+                                                               __FUNCTION__));
+                                               } else {
+                                                       DHD_ERROR(("%s set lpas failed %d\n",
+                                                               __FUNCTION__, ret));
+                                               }
+                                       }
+                                       bcn_to_dly = 1;
+                                       /*
+                                        * if bcn_to_dly is 1, the real roam threshold is
+                                        * MIN(max_roam_threshold, bcn_timeout -1);
+                                        * notify link down event after roaming procedure complete
+                                        * if we hit bcn_timeout while we are in roaming progress.
+                                        */
+                                       ret = dhd_iovar(dhd, 0, "bcn_to_dly", (char *)&bcn_to_dly,
+                                                       sizeof(bcn_to_dly), NULL, 0, TRUE);
+                                       if (ret < 0) {
+                                               if (ret == BCME_UNSUPPORTED) {
+                                                       DHD_ERROR(("%s bcn_to_dly, UNSUPPORTED\n",
+                                                               __FUNCTION__));
+                                               } else {
+                                                       DHD_ERROR(("%s set bcn_to_dly failed %d\n",
+                                                               __FUNCTION__, ret));
+                                               }
+                                       }
+                                       /* Increase beacon timeout to 6 secs or use bigger one */
+                                       bcn_timeout = max(bcn_timeout, BCN_TIMEOUT_IN_SUSPEND);
+                                       ret = dhd_iovar(dhd, 0, "bcn_timeout", (char *)&bcn_timeout,
+                                                       sizeof(bcn_timeout), NULL, 0, TRUE);
+                                       if (ret < 0) {
+                                               DHD_ERROR(("%s set bcn_timeout failed %d\n",
+                                                               __FUNCTION__, ret));
+                                       }
+                               }
+#else
+                               bcn_li_dtim = dhd_get_suspend_bcn_li_dtim(dhd);
+                               if (dhd_iovar(dhd, 0, "bcn_li_dtim", (char *)&bcn_li_dtim,
+                                               sizeof(bcn_li_dtim), NULL, 0, TRUE) < 0)
+                                       DHD_ERROR(("%s: set dtim failed\n", __FUNCTION__));
+#endif /* OEM_ANDROID && BCMPCIE */
+
+#ifdef DHD_USE_EARLYSUSPEND
+#ifdef CUSTOM_BCN_TIMEOUT_IN_SUSPEND
+                               bcn_timeout = CUSTOM_BCN_TIMEOUT_IN_SUSPEND;
+                               ret = dhd_iovar(dhd, 0, "bcn_timeout", (char *)&bcn_timeout,
+                                               sizeof(bcn_timeout), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s bcn_timeout failed %d\n", __FUNCTION__,
+                                               ret));
+                               }
+#endif /* CUSTOM_BCN_TIMEOUT_IN_SUSPEND */
+#ifdef CUSTOM_ROAM_TIME_THRESH_IN_SUSPEND
+                               roam_time_thresh = CUSTOM_ROAM_TIME_THRESH_IN_SUSPEND;
+                               ret = dhd_iovar(dhd, 0, "roam_time_thresh",
+                                               (char *)&roam_time_thresh,
+                                               sizeof(roam_time_thresh), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s roam_time_thresh failed %d\n",
+                                               __FUNCTION__, ret));
+                               }
+#endif /* CUSTOM_ROAM_TIME_THRESH_IN_SUSPEND */
+#ifndef ENABLE_FW_ROAM_SUSPEND
+                               /* Disable firmware roaming during suspend */
+                               ret = dhd_iovar(dhd, 0, "roam_off", (char *)&roamvar,
+                                               sizeof(roamvar), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s roam_off failed %d\n",
+                                               __FUNCTION__, ret));
+                               }
+#endif /* ENABLE_FW_ROAM_SUSPEND */
+#ifdef ENABLE_BCN_LI_BCN_WAKEUP
+                               if (bcn_li_dtim) {
+                                       bcn_li_bcn = 0;
+                               }
+                               ret = dhd_iovar(dhd, 0, "bcn_li_bcn", (char *)&bcn_li_bcn,
+                                               sizeof(bcn_li_bcn), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s bcn_li_bcn failed %d\n", __FUNCTION__, ret));
+                               }
+#endif /* ENABLE_BCN_LI_BCN_WAKEUP */
+#if defined(WL_CFG80211) && defined(WL_BCNRECV)
+                               ret = wl_android_bcnrecv_suspend(dhd_linux_get_primary_netdev(dhd));
+                               if (ret != BCME_OK) {
+                                       DHD_ERROR(("failed to stop beacon recv event on"
+                                               " suspend state (%d)\n", ret));
+                               }
+#endif /* WL_CFG80211 && WL_BCNRECV */
+#ifdef NDO_CONFIG_SUPPORT
+                               if (dhd->ndo_enable) {
+                                       if (!dhd->ndo_host_ip_overflow) {
+                                               /* enable ND offload on suspend */
+                                               ret = dhd_ndo_enable(dhd, TRUE);
+                                               if (ret < 0) {
+                                                       DHD_ERROR(("%s: failed to enable NDO\n",
+                                                               __FUNCTION__));
+                                               }
+                                       } else {
+                                               DHD_INFO(("%s: NDO disabled on suspend due to"
+                                                               "HW capacity\n", __FUNCTION__));
+                                       }
+                               }
+#endif /* NDO_CONFIG_SUPPORT */
+#ifndef APF
+                               if (FW_SUPPORTED(dhd, ndoe))
+#else
+                               if (FW_SUPPORTED(dhd, ndoe) && !FW_SUPPORTED(dhd, apf))
+#endif /* APF */
+                               {
+                                       /* enable IPv6 RA filter in  firmware during suspend */
+                                       nd_ra_filter = 1;
+                                       ret = dhd_iovar(dhd, 0, "nd_ra_filter_enable",
+                                                       (char *)&nd_ra_filter, sizeof(nd_ra_filter),
+                                                       NULL, 0, TRUE);
+                                       if (ret < 0)
+                                               DHD_ERROR(("failed to set nd_ra_filter (%d)\n",
+                                                       ret));
+                               }
+                               dhd_os_suppress_logging(dhd, TRUE);
+#ifdef ENABLE_IPMCAST_FILTER
+                               ipmcast_l2filter = 1;
+                               ret = dhd_iovar(dhd, 0, "ipmcast_l2filter",
+                                               (char *)&ipmcast_l2filter, sizeof(ipmcast_l2filter),
+                                               NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("failed to set ipmcast_l2filter (%d)\n", ret));
+                               }
+#endif /* ENABLE_IPMCAST_FILTER */
+#ifdef DYNAMIC_SWOOB_DURATION
+                               intr_width = CUSTOM_INTR_WIDTH;
+                               ret = dhd_iovar(dhd, 0, "bus:intr_width", (char *)&intr_width,
+                                               sizeof(intr_width), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("failed to set intr_width (%d)\n", ret));
+                               }
+#endif /* DYNAMIC_SWOOB_DURATION */
+#ifdef CUSTOM_EVENT_PM_WAKE
+                               pm_awake_thresh = CUSTOM_EVENT_PM_WAKE * 4;
+                               ret = dhd_iovar(dhd, 0, "const_awake_thresh",
+                                       (char *)&pm_awake_thresh,
+                                       sizeof(pm_awake_thresh), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s set const_awake_thresh failed %d\n",
+                                               __FUNCTION__, ret));
+                               }
+#endif /* CUSTOM_EVENT_PM_WAKE */
+#ifdef CONFIG_SILENT_ROAM
+                               if (!dhd->sroamed) {
+                                       ret = dhd_sroam_set_mon(dhd, TRUE);
+                                       if (ret < 0) {
+                                               DHD_ERROR(("%s set sroam failed %d\n",
+                                                       __FUNCTION__, ret));
+                                       }
+                               }
+                               dhd->sroamed = FALSE;
+#endif /* CONFIG_SILENT_ROAM */
+#endif /* DHD_USE_EARLYSUSPEND */
+                       } else {
+#ifdef PKT_FILTER_SUPPORT
+                               dhd->early_suspended = 0;
+#endif
+                               /* Kernel resumed  */
+                               DHD_ERROR(("%s: Remove extra suspend setting \n", __FUNCTION__));
+#ifdef DYNAMIC_SWOOB_DURATION
+                               intr_width = 0;
+                               ret = dhd_iovar(dhd, 0, "bus:intr_width", (char *)&intr_width,
+                                               sizeof(intr_width), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("failed to set intr_width (%d)\n", ret));
+                               }
+#endif /* DYNAMIC_SWOOB_DURATION */
+#ifndef SUPPORT_PM2_ONLY
+                               power_mode = PM_FAST;
+                               dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)&power_mode,
+                                                sizeof(power_mode), TRUE, 0);
+#endif /* SUPPORT_PM2_ONLY */
+#if defined(WL_CFG80211) && defined(WL_BCNRECV)
+                               ret = wl_android_bcnrecv_resume(dhd_linux_get_primary_netdev(dhd));
+                               if (ret != BCME_OK) {
+                                       DHD_ERROR(("failed to resume beacon recv state (%d)\n",
+                                                       ret));
+                               }
+#endif /* WL_CF80211 && WL_BCNRECV */
+#ifdef ARP_OFFLOAD_SUPPORT
+                               if (dhd->arpoe_enable) {
+                                       dhd_arp_offload_enable(dhd, FALSE);
+                               }
+#endif /* ARP_OFFLOAD_SUPPORT */
+#ifdef PKT_FILTER_SUPPORT
+                               /* disable pkt filter */
+                               dhd_enable_packet_filter(0, dhd);
+#ifdef APF
+                               dhd_dev_apf_disable_filter(dhd_linux_get_primary_netdev(dhd));
+#endif /* APF */
+#endif /* PKT_FILTER_SUPPORT */
+#ifdef PASS_ALL_MCAST_PKTS
+                               allmulti = 1;
+                               for (i = 0; i < DHD_MAX_IFS; i++) {
+                                       if (dhdinfo->iflist[i] && dhdinfo->iflist[i]->net)
+                                               ret = dhd_iovar(dhd, i, "allmulti",
+                                                               (char *)&allmulti,
+                                                               sizeof(allmulti), NULL,
+                                                               0, TRUE);
+                                       if (ret < 0) {
+                                               DHD_ERROR(("%s: allmulti failed:%d\n",
+                                                               __FUNCTION__, ret));
+                                       }
+                               }
+#endif /* PASS_ALL_MCAST_PKTS */
+#if defined(BCMPCIE)
+                               /* restore pre-suspend setting */
+                               ret = dhd_iovar(dhd, 0, "bcn_li_dtim", (char *)&bcn_li_dtim,
+                                               sizeof(bcn_li_dtim), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s:bcn_li_ditm failed:%d\n",
+                                                       __FUNCTION__, ret));
+                               }
+                               ret = dhd_iovar(dhd, 0, "lpas", (char *)&lpas, sizeof(lpas), NULL,
+                                               0, TRUE);
+                               if (ret < 0) {
+                                       if (ret == BCME_UNSUPPORTED) {
+                                               DHD_ERROR(("%s lpas, UNSUPPORTED\n", __FUNCTION__));
+                                        } else {
+                                               DHD_ERROR(("%s set lpas failed %d\n",
+                                                       __FUNCTION__, ret));
+                                        }
+                               }
+                               ret = dhd_iovar(dhd, 0, "bcn_to_dly", (char *)&bcn_to_dly,
+                                               sizeof(bcn_to_dly), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       if (ret == BCME_UNSUPPORTED) {
+                                               DHD_ERROR(("%s bcn_to_dly UNSUPPORTED\n",
+                                                       __FUNCTION__));
+                                       } else {
+                                               DHD_ERROR(("%s set bcn_to_dly failed %d\n",
+                                                       __FUNCTION__, ret));
+                                       }
+                               }
+                               ret = dhd_iovar(dhd, 0, "bcn_timeout", (char *)&bcn_timeout,
+                                               sizeof(bcn_timeout), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s:bcn_timeout failed:%d\n",
+                                                       __FUNCTION__, ret));
+                               }
+#else
+                               /* restore pre-suspend setting for dtim_skip */
+                               ret = dhd_iovar(dhd, 0, "bcn_li_dtim", (char *)&bcn_li_dtim,
+                                               sizeof(bcn_li_dtim), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s:bcn_li_ditm fail:%d\n", __FUNCTION__, ret));
+                               }
+#endif /* OEM_ANDROID && BCMPCIE */
+#ifdef DHD_USE_EARLYSUSPEND
+#ifdef CUSTOM_BCN_TIMEOUT_IN_SUSPEND
+                               bcn_timeout = CUSTOM_BCN_TIMEOUT;
+                               ret = dhd_iovar(dhd, 0, "bcn_timeout", (char *)&bcn_timeout,
+                                               sizeof(bcn_timeout), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s:bcn_timeout failed:%d\n",
+                                               __FUNCTION__, ret));
+                               }
+#endif /* CUSTOM_BCN_TIMEOUT_IN_SUSPEND */
+#ifdef CUSTOM_ROAM_TIME_THRESH_IN_SUSPEND
+                               roam_time_thresh = 2000;
+                               ret = dhd_iovar(dhd, 0, "roam_time_thresh",
+                                               (char *)&roam_time_thresh,
+                                               sizeof(roam_time_thresh), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s:roam_time_thresh failed:%d\n",
+                                                       __FUNCTION__, ret));
+                               }
+
+#endif /* CUSTOM_ROAM_TIME_THRESH_IN_SUSPEND */
+#ifndef ENABLE_FW_ROAM_SUSPEND
+                               roamvar = dhd_roam_disable;
+                               ret = dhd_iovar(dhd, 0, "roam_off", (char *)&roamvar,
+                                               sizeof(roamvar), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s: roam_off fail:%d\n", __FUNCTION__, ret));
+                               }
+#endif /* ENABLE_FW_ROAM_SUSPEND */
+#ifdef ENABLE_BCN_LI_BCN_WAKEUP
+                               ret = dhd_iovar(dhd, 0, "bcn_li_bcn", (char *)&bcn_li_bcn,
+                                               sizeof(bcn_li_bcn), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s: bcn_li_bcn failed:%d\n",
+                                               __FUNCTION__, ret));
+                               }
+#endif /* ENABLE_BCN_LI_BCN_WAKEUP */
+#ifdef NDO_CONFIG_SUPPORT
+                               if (dhd->ndo_enable) {
+                                       /* Disable ND offload on resume */
+                                       ret = dhd_ndo_enable(dhd, FALSE);
+                                       if (ret < 0) {
+                                               DHD_ERROR(("%s: failed to disable NDO\n",
+                                                       __FUNCTION__));
+                                       }
+                               }
+#endif /* NDO_CONFIG_SUPPORT */
+#ifndef APF
+                               if (FW_SUPPORTED(dhd, ndoe))
+#else
+                               if (FW_SUPPORTED(dhd, ndoe) && !FW_SUPPORTED(dhd, apf))
+#endif /* APF */
+                               {
+                                       /* disable IPv6 RA filter in  firmware during suspend */
+                                       nd_ra_filter = 0;
+                                       ret = dhd_iovar(dhd, 0, "nd_ra_filter_enable",
+                                                       (char *)&nd_ra_filter, sizeof(nd_ra_filter),
+                                                       NULL, 0, TRUE);
+                                       if (ret < 0) {
+                                               DHD_ERROR(("failed to set nd_ra_filter (%d)\n",
+                                                       ret));
+                                       }
+                               }
+                               dhd_os_suppress_logging(dhd, FALSE);
+#ifdef ENABLE_IPMCAST_FILTER
+                               ipmcast_l2filter = 0;
+                               ret = dhd_iovar(dhd, 0, "ipmcast_l2filter",
+                                               (char *)&ipmcast_l2filter, sizeof(ipmcast_l2filter),
+                                               NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("failed to clear ipmcast_l2filter ret:%d", ret));
+                               }
+#endif /* ENABLE_IPMCAST_FILTER */
+#ifdef CUSTOM_EVENT_PM_WAKE
+                               ret = dhd_iovar(dhd, 0, "const_awake_thresh",
+                                       (char *)&pm_awake_thresh,
+                                       sizeof(pm_awake_thresh), NULL, 0, TRUE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s set const_awake_thresh failed %d\n",
+                                               __FUNCTION__, ret));
+                               }
+#endif /* CUSTOM_EVENT_PM_WAKE */
+#ifdef CONFIG_SILENT_ROAM
+                               ret = dhd_sroam_set_mon(dhd, FALSE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("%s set sroam failed %d\n", __FUNCTION__, ret));
+                               }
+#endif /* CONFIG_SILENT_ROAM */
+#endif /* DHD_USE_EARLYSUSPEND */
+                       }
+       }
+       dhd_suspend_unlock(dhd);
+
+       return 0;
+}
+
+static int dhd_suspend_resume_helper(struct dhd_info *dhd, int val, int force)
+{
+       dhd_pub_t *dhdp = &dhd->pub;
+       int ret = 0;
+
+       DHD_OS_WAKE_LOCK(dhdp);
+
+       /* Set flag when early suspend was called */
+       dhdp->in_suspend = val;
+       if ((force || !dhdp->suspend_disable_flag) &&
+               (dhd_support_sta_mode(dhdp) || dhd_conf_get_insuspend(dhdp, ALL_IN_SUSPEND)))
+       {
+               ret = dhd_set_suspend(val, dhdp);
+       }
+
+       DHD_OS_WAKE_UNLOCK(dhdp);
+       return ret;
+}
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+static void dhd_early_suspend(struct early_suspend *h)
+{
+       struct dhd_info *dhd = container_of(h, struct dhd_info, early_suspend);
+       DHD_TRACE_HW4(("%s: enter\n", __FUNCTION__));
+
+       if (dhd && dhd->pub.conf->suspend_mode == EARLY_SUSPEND) {
+               dhd_suspend_resume_helper(dhd, 1, 0);
+               dhd_conf_set_suspend_resume(&dhd->pub, 1);
+       }
+}
+
+static void dhd_late_resume(struct early_suspend *h)
+{
+       struct dhd_info *dhd = container_of(h, struct dhd_info, early_suspend);
+       DHD_TRACE_HW4(("%s: enter\n", __FUNCTION__));
+
+       if (dhd && dhd->pub.conf->suspend_mode == EARLY_SUSPEND) {
+               dhd_conf_set_suspend_resume(&dhd->pub, 0);
+               dhd_suspend_resume_helper(dhd, 0, 0);
+       }
+}
+#endif /* CONFIG_HAS_EARLYSUSPEND && DHD_USE_EARLYSUSPEND */
+
+/*
+ * Generalized timeout mechanism.  Uses spin sleep with exponential back-off until
+ * the sleep time reaches one jiffy, then switches over to task delay.  Usage:
+ *
+ *      dhd_timeout_start(&tmo, usec);
+ *      while (!dhd_timeout_expired(&tmo))
+ *              if (poll_something())
+ *                      break;
+ *      if (dhd_timeout_expired(&tmo))
+ *              fatal();
+ */
+
+void
+dhd_timeout_start(dhd_timeout_t *tmo, uint usec)
+{
+       tmo->limit = usec;
+       tmo->increment = 0;
+       tmo->elapsed = 0;
+       tmo->tick = 10 * USEC_PER_MSEC; /* 10 msec */
+}
+
+int
+dhd_timeout_expired(dhd_timeout_t *tmo)
+{
+       /* Does nothing the first call */
+       if (tmo->increment == 0) {
+               tmo->increment = USEC_PER_MSEC; /* Start with 1 msec */
+               return 0;
+       }
+
+       if (tmo->elapsed >= tmo->limit)
+               return 1;
+
+       DHD_INFO(("%s: CAN_SLEEP():%d tmo->increment=%ld msec\n",
+               __FUNCTION__, CAN_SLEEP(), tmo->increment / USEC_PER_MSEC));
+
+       CAN_SLEEP() ? OSL_SLEEP(tmo->increment / USEC_PER_MSEC) : OSL_DELAY(tmo->increment);
+
+       /* Till tmo->tick, the delay will be in 2x, after that delay will be constant
+        * tmo->tick (10 msec), till timer elapses.
+        */
+       tmo->increment = (tmo->increment >= tmo->tick) ? tmo->tick : (tmo->increment * 2);
+
+       /* Add the delay that's about to take place */
+       tmo->elapsed += tmo->increment;
+
+       return 0;
+}
+
+int
+dhd_net2idx(dhd_info_t *dhd, struct net_device *net)
+{
+       int i = 0;
+
+       if (!dhd) {
+               DHD_ERROR(("%s : DHD_BAD_IF return\n", __FUNCTION__));
+               return DHD_BAD_IF;
+       }
+
+       while (i < DHD_MAX_IFS) {
+               if (dhd->iflist[i] && dhd->iflist[i]->net && (dhd->iflist[i]->net == net))
+                       return i;
+               i++;
+       }
+
+       return DHD_BAD_IF;
+}
+
+struct net_device * dhd_idx2net(void *pub, int ifidx)
+{
+       struct dhd_pub *dhd_pub = (struct dhd_pub *)pub;
+       struct dhd_info *dhd_info;
+
+       if (!dhd_pub || ifidx < 0 || ifidx >= DHD_MAX_IFS)
+               return NULL;
+       dhd_info = dhd_pub->info;
+       if (dhd_info && dhd_info->iflist[ifidx])
+               return dhd_info->iflist[ifidx]->net;
+       return NULL;
+}
+
+int
+dhd_ifname2idx(dhd_info_t *dhd, char *name)
+{
+       int i = DHD_MAX_IFS;
+
+       ASSERT(dhd);
+
+       if (name == NULL || *name == '\0')
+               return 0;
+
+       while (--i > 0)
+               if (dhd->iflist[i] && !strncmp(dhd->iflist[i]->dngl_name, name, IFNAMSIZ))
+                               break;
+
+       DHD_TRACE(("%s: return idx %d for \"%s\"\n", __FUNCTION__, i, name));
+
+       return i;       /* default - the primary interface */
+}
+
+char *
+dhd_ifname(dhd_pub_t *dhdp, int ifidx)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+
+       ASSERT(dhd);
+
+       if (ifidx < 0 || ifidx >= DHD_MAX_IFS) {
+               DHD_ERROR(("%s: ifidx %d out of range\n", __FUNCTION__, ifidx));
+               return "<if_bad>";
+       }
+
+       if (dhd->iflist[ifidx] == NULL) {
+               DHD_ERROR(("%s: null i/f %d\n", __FUNCTION__, ifidx));
+               return "<if_null>";
+       }
+
+       if (dhd->iflist[ifidx]->net)
+               return dhd->iflist[ifidx]->net->name;
+
+       return "<if_none>";
+}
+
+uint8 *
+dhd_bssidx2bssid(dhd_pub_t *dhdp, int idx)
+{
+       int i;
+       dhd_info_t *dhd = (dhd_info_t *)dhdp;
+
+       ASSERT(dhd);
+       for (i = 0; i < DHD_MAX_IFS; i++)
+       if (dhd->iflist[i] && dhd->iflist[i]->bssidx == idx)
+               return dhd->iflist[i]->mac_addr;
+
+       return NULL;
+}
+
+static void
+_dhd_set_multicast_list(dhd_info_t *dhd, int ifidx)
+{
+       struct net_device *dev;
+       struct netdev_hw_addr *ha;
+       uint32 allmulti, cnt;
+
+       wl_ioctl_t ioc;
+       char *buf, *bufp;
+       uint buflen;
+       int ret;
+
+#ifdef MCAST_LIST_ACCUMULATION
+       int i;
+       uint32 cnt_iface[DHD_MAX_IFS];
+       cnt = 0;
+       allmulti = 0;
+
+       for (i = 0; i < DHD_MAX_IFS; i++) {
+               if (dhd->iflist[i]) {
+                       dev = dhd->iflist[i]->net;
+                       if (!dev)
+                               continue;
+                       netif_addr_lock_bh(dev);
+                       cnt_iface[i] = netdev_mc_count(dev);
+                       cnt += cnt_iface[i];
+                       netif_addr_unlock_bh(dev);
+
+                       /* Determine initial value of allmulti flag */
+                       allmulti |= (dev->flags & IFF_ALLMULTI) ? TRUE : FALSE;
+               }
+       }
+#else /* !MCAST_LIST_ACCUMULATION */
+       if (!dhd->iflist[ifidx]) {
+               DHD_ERROR(("%s : dhd->iflist[%d] was NULL\n", __FUNCTION__, ifidx));
+               return;
+       }
+       dev = dhd->iflist[ifidx]->net;
+       if (!dev)
+               return;
+       netif_addr_lock_bh(dev);
+       cnt = netdev_mc_count(dev);
+       netif_addr_unlock_bh(dev);
+
+       /* Determine initial value of allmulti flag */
+       allmulti = (dev->flags & IFF_ALLMULTI) ? TRUE : FALSE;
+#endif /* MCAST_LIST_ACCUMULATION */
+
+#ifdef PASS_ALL_MCAST_PKTS
+#ifdef PKT_FILTER_SUPPORT
+       if (!dhd->pub.early_suspended)
+#endif /* PKT_FILTER_SUPPORT */
+               allmulti = TRUE;
+#endif /* PASS_ALL_MCAST_PKTS */
+
+       /* Send down the multicast list first. */
+
+       /* XXX Not using MAXMULTILIST to avoid including wlc_pub.h; but
+        * maybe we should?  (Or should that be in wlioctl.h instead?)
+        */
+
+       buflen = sizeof("mcast_list") + sizeof(cnt) + (cnt * ETHER_ADDR_LEN);
+       if (!(bufp = buf = MALLOC(dhd->pub.osh, buflen))) {
+               DHD_ERROR(("%s: out of memory for mcast_list, cnt %d\n",
+                          dhd_ifname(&dhd->pub, ifidx), cnt));
+               return;
+       }
+
+       strlcpy(bufp, "mcast_list", buflen);
+       bufp += strlen("mcast_list") + 1;
+
+       cnt = htol32(cnt);
+       memcpy(bufp, &cnt, sizeof(cnt));
+       bufp += sizeof(cnt);
+
+#ifdef MCAST_LIST_ACCUMULATION
+       for (i = 0; i < DHD_MAX_IFS; i++) {
+               if (dhd->iflist[i]) {
+                       DHD_TRACE(("_dhd_set_multicast_list: ifidx %d\n", i));
+                       dev = dhd->iflist[i]->net;
+
+                       netif_addr_lock_bh(dev);
+                       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                       netdev_for_each_mc_addr(ha, dev) {
+                               GCC_DIAGNOSTIC_POP();
+                               if (!cnt_iface[i])
+                                       break;
+                               memcpy(bufp, ha->addr, ETHER_ADDR_LEN);
+                               bufp += ETHER_ADDR_LEN;
+                               DHD_TRACE(("_dhd_set_multicast_list: cnt "
+                                       "%d " MACDBG "\n",
+                                       cnt_iface[i], MAC2STRDBG(ha->addr)));
+                               cnt_iface[i]--;
+                       }
+                       netif_addr_unlock_bh(dev);
+               }
+       }
+#else /* !MCAST_LIST_ACCUMULATION */
+       netif_addr_lock_bh(dev);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       netdev_for_each_mc_addr(ha, dev) {
+               GCC_DIAGNOSTIC_POP();
+               if (!cnt)
+                       break;
+               memcpy(bufp, ha->addr, ETHER_ADDR_LEN);
+               bufp += ETHER_ADDR_LEN;
+               cnt--;
+       }
+       netif_addr_unlock_bh(dev);
+#endif /* MCAST_LIST_ACCUMULATION */
+
+       memset(&ioc, 0, sizeof(ioc));
+       ioc.cmd = WLC_SET_VAR;
+       ioc.buf = buf;
+       ioc.len = buflen;
+       ioc.set = TRUE;
+
+       ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len);
+       if (ret < 0) {
+               DHD_ERROR(("%s: set mcast_list failed, cnt %d\n",
+                       dhd_ifname(&dhd->pub, ifidx), cnt));
+               allmulti = cnt ? TRUE : allmulti;
+       }
+
+       MFREE(dhd->pub.osh, buf, buflen);
+
+       /* Now send the allmulti setting.  This is based on the setting in the
+        * net_device flags, but might be modified above to be turned on if we
+        * were trying to set some addresses and dongle rejected it...
+        */
+
+       allmulti = htol32(allmulti);
+       ret = dhd_iovar(&dhd->pub, ifidx, "allmulti", (char *)&allmulti,
+                       sizeof(allmulti), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: set allmulti %d failed\n",
+                          dhd_ifname(&dhd->pub, ifidx), ltoh32(allmulti)));
+       }
+
+       /* Finally, pick up the PROMISC flag as well, like the NIC driver does */
+
+#ifdef MCAST_LIST_ACCUMULATION
+       allmulti = 0;
+       for (i = 0; i < DHD_MAX_IFS; i++) {
+               if (dhd->iflist[i]) {
+                       dev = dhd->iflist[i]->net;
+                       allmulti |= (dev->flags & IFF_PROMISC) ? TRUE : FALSE;
+               }
+       }
+#else
+       allmulti = (dev->flags & IFF_PROMISC) ? TRUE : FALSE;
+#endif /* MCAST_LIST_ACCUMULATION */
+
+       allmulti = htol32(allmulti);
+
+       memset(&ioc, 0, sizeof(ioc));
+       ioc.cmd = WLC_SET_PROMISC;
+       ioc.buf = &allmulti;
+       ioc.len = sizeof(allmulti);
+       ioc.set = TRUE;
+
+       ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len);
+       if (ret < 0) {
+               DHD_ERROR(("%s: set promisc %d failed\n",
+                          dhd_ifname(&dhd->pub, ifidx), ltoh32(allmulti)));
+       }
+}
+
+int
+_dhd_set_mac_address(dhd_info_t *dhd, int ifidx, uint8 *addr, bool skip_stop)
+{
+       int ret;
+
+#ifdef DHD_NOTIFY_MAC_CHANGED
+       if (skip_stop) {
+               WL_MSG(dhd_ifname(&dhd->pub, ifidx), "close dev for mac changing\n");
+               dhd->pub.skip_dhd_stop = TRUE;
+               dev_close(dhd->iflist[ifidx]->net);
+       }
+#endif /* DHD_NOTIFY_MAC_CHANGED */
+
+       ret = dhd_iovar(&dhd->pub, ifidx, "cur_etheraddr", (char *)addr,
+                       ETHER_ADDR_LEN, NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: set cur_etheraddr failed\n", dhd_ifname(&dhd->pub, ifidx)));
+#ifdef DHD_NOTIFY_MAC_CHANGED
+               if (skip_stop)
+                       dhd->pub.skip_dhd_stop = FALSE;
+               return ret;
+#endif /* DHD_NOTIFY_MAC_CHANGED */
+       } else {
+               memcpy(dhd->iflist[ifidx]->net->dev_addr, addr, ETHER_ADDR_LEN);
+               if (ifidx == 0)
+                       memcpy(dhd->pub.mac.octet, addr, ETHER_ADDR_LEN);
+       }
+
+#ifdef DHD_NOTIFY_MAC_CHANGED
+       if (skip_stop) {
+               dev_open(dhd->iflist[ifidx]->net);
+               dhd->pub.skip_dhd_stop = FALSE;
+               WL_MSG(dhd_ifname(&dhd->pub, ifidx), "notify mac changed done\n");
+       }
+#endif /* DHD_NOTIFY_MAC_CHANGED */
+
+       return ret;
+}
+
+int dhd_update_rand_mac_addr(dhd_pub_t *dhd)
+{
+       struct ether_addr mac_addr;
+       dhd_generate_rand_mac_addr(&mac_addr);
+       if (_dhd_set_mac_address(dhd->info, 0, mac_addr.octet, TRUE) != 0) {
+               DHD_ERROR(("randmac setting failed\n"));
+#ifdef STA_RANDMAC_ENFORCED
+               return  BCME_BADADDR;
+#endif /* STA_RANDMAC_ENFORCED */
+       }
+       return BCME_OK;
+}
+
+#ifdef DHD_PSTA
+/* Get psta/psr configuration configuration */
+int dhd_get_psta_mode(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+       return (int)dhd->psta_mode;
+}
+/* Set psta/psr configuration configuration */
+int dhd_set_psta_mode(dhd_pub_t *dhdp, uint32 val)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd->psta_mode = val;
+       return 0;
+}
+#endif /* DHD_PSTA */
+
+#if (defined(DHD_WET) || defined(DHD_MCAST_REGEN) || defined(DHD_L2_FILTER))
+static void
+dhd_update_rx_pkt_chainable_state(dhd_pub_t* dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       if (
+#ifdef DHD_L2_FILTER
+               (ifp->block_ping) ||
+#endif
+#ifdef DHD_WET
+               (dhd->wet_mode) ||
+#endif
+#ifdef DHD_MCAST_REGEN
+               (ifp->mcast_regen_bss_enable) ||
+#endif
+               FALSE) {
+               ifp->rx_pkt_chainable = FALSE;
+       }
+}
+#endif /* DHD_WET || DHD_MCAST_REGEN || DHD_L2_FILTER */
+
+#ifdef DHD_WET
+/* Get wet configuration configuration */
+int dhd_get_wet_mode(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+       return (int)dhd->wet_mode;
+}
+
+/* Set wet configuration configuration */
+int dhd_set_wet_mode(dhd_pub_t *dhdp, uint32 val)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd->wet_mode = val;
+       dhd_update_rx_pkt_chainable_state(dhdp, 0);
+       return 0;
+}
+#endif /* DHD_WET */
+
+#if defined(WL_CFG80211) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+int32 dhd_role_to_nl80211_iftype(int32 role)
+{
+       switch (role) {
+       case WLC_E_IF_ROLE_STA:
+               return NL80211_IFTYPE_STATION;
+       case WLC_E_IF_ROLE_AP:
+               return NL80211_IFTYPE_AP;
+       case WLC_E_IF_ROLE_WDS:
+               return NL80211_IFTYPE_WDS;
+       case WLC_E_IF_ROLE_P2P_GO:
+               return NL80211_IFTYPE_P2P_GO;
+       case WLC_E_IF_ROLE_P2P_CLIENT:
+               return NL80211_IFTYPE_P2P_CLIENT;
+       case WLC_E_IF_ROLE_IBSS:
+       case WLC_E_IF_ROLE_NAN:
+               return NL80211_IFTYPE_ADHOC;
+       default:
+               return NL80211_IFTYPE_UNSPECIFIED;
+       }
+}
+#endif /* WL_CFG80211 && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+
+static void
+dhd_ifadd_event_handler(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+       dhd_if_event_t *if_event = event_info;
+       int ifidx, bssidx;
+       int ret;
+#if defined(WL_CFG80211) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       struct wl_if_event_info info;
+#if defined(WLDWDS) && defined(FOURADDR_AUTO_BRG)
+       struct net_device *ndev = NULL;
+#endif
+#else
+       struct net_device *ndev;
+#endif /* WL_CFG80211 && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+
+       BCM_REFERENCE(ret);
+       if (event != DHD_WQ_WORK_IF_ADD) {
+               DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+               return;
+       }
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+               return;
+       }
+
+       if (!if_event) {
+               DHD_ERROR(("%s: event data is null \n", __FUNCTION__));
+               return;
+       }
+
+       dhd_net_if_lock_local(dhd);
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+
+       ifidx = if_event->event.ifidx;
+       bssidx = if_event->event.bssidx;
+       DHD_TRACE(("%s: registering if with ifidx %d\n", __FUNCTION__, ifidx));
+
+#if defined(WL_CFG80211) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       if (if_event->event.ifidx > 0) {
+               u8 *mac_addr;
+               bzero(&info, sizeof(info));
+               info.ifidx = ifidx;
+               info.bssidx = bssidx;
+               info.role = if_event->event.role;
+               strlcpy(info.name, if_event->name, sizeof(info.name));
+               if (is_valid_ether_addr(if_event->mac)) {
+                       mac_addr = if_event->mac;
+               } else {
+                       mac_addr = NULL;
+               }
+
+#if defined(WLDWDS) && defined(FOURADDR_AUTO_BRG)
+               if ((ndev = wl_cfg80211_post_ifcreate(dhd->pub.info->iflist[0]->net,
+                       &info, mac_addr, NULL, true)) == NULL)
+#else
+               if (wl_cfg80211_post_ifcreate(dhd->pub.info->iflist[0]->net,
+                       &info, mac_addr, NULL, true) == NULL)
+#endif
+               {
+                       /* Do the post interface create ops */
+                       DHD_ERROR(("Post ifcreate ops failed. Returning \n"));
+                       goto done;
+               }
+       }
+#else
+       /* This path is for non-android case */
+       /* The interface name in host and in event msg are same */
+       /* if name in event msg is used to create dongle if list on host */
+       ndev = dhd_allocate_if(&dhd->pub, ifidx, if_event->name,
+               if_event->mac, bssidx, TRUE, if_event->name);
+       if (!ndev) {
+               DHD_ERROR(("%s: net device alloc failed  \n", __FUNCTION__));
+               goto done;
+       }
+
+       ret = dhd_register_if(&dhd->pub, ifidx, TRUE);
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s: dhd_register_if failed\n", __FUNCTION__));
+               dhd_remove_if(&dhd->pub, ifidx, TRUE);
+               goto done;
+       }
+#endif /* WL_CFG80211 && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+
+#ifndef PCIE_FULL_DONGLE
+       /* Turn on AP isolation in the firmware for interfaces operating in AP mode */
+       if (FW_SUPPORTED((&dhd->pub), ap) && (if_event->event.role != WLC_E_IF_ROLE_STA)) {
+               uint32 var_int =  1;
+               ret = dhd_iovar(&dhd->pub, ifidx, "ap_isolate", (char *)&var_int, sizeof(var_int),
+                               NULL, 0, TRUE);
+               if (ret != BCME_OK) {
+                       DHD_ERROR(("%s: Failed to set ap_isolate to dongle\n", __FUNCTION__));
+                       dhd_remove_if(&dhd->pub, ifidx, TRUE);
+               }
+       }
+#endif /* PCIE_FULL_DONGLE */
+
+done:
+       MFREE(dhd->pub.osh, if_event, sizeof(dhd_if_event_t));
+#if defined(WLDWDS) && defined(FOURADDR_AUTO_BRG)
+       dhd_bridge_dev_set(dhd, ifidx, ndev);
+#endif /* defiend(WLDWDS) && defined(FOURADDR_AUTO_BRG) */
+
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+       dhd_net_if_unlock_local(dhd);
+}
+
+static void
+dhd_ifdel_event_handler(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+       int ifidx;
+       dhd_if_event_t *if_event = event_info;
+
+       if (event != DHD_WQ_WORK_IF_DEL) {
+               DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+               return;
+       }
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+               return;
+       }
+
+       if (!if_event) {
+               DHD_ERROR(("%s: event data is null \n", __FUNCTION__));
+               return;
+       }
+
+       dhd_net_if_lock_local(dhd);
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+
+       ifidx = if_event->event.ifidx;
+       DHD_TRACE(("Removing interface with idx %d\n", ifidx));
+#if defined(WLDWDS) && defined(FOURADDR_AUTO_BRG)
+       dhd_bridge_dev_set(dhd, ifidx, NULL);
+#endif /* defiend(WLDWDS) && defined(FOURADDR_AUTO_BRG) */
+
+       if (!dhd->pub.info->iflist[ifidx]) {
+               /* No matching netdev found */
+               DHD_ERROR(("Netdev not found! Do nothing.\n"));
+               goto done;
+       }
+#if defined(WL_CFG80211) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       if (if_event->event.ifidx > 0) {
+               /* Do the post interface del ops */
+               if (wl_cfg80211_post_ifdel(dhd->pub.info->iflist[ifidx]->net,
+                               true, if_event->event.ifidx) != 0) {
+                       DHD_TRACE(("Post ifdel ops failed. Returning \n"));
+                       goto done;
+               }
+       }
+#else
+       /* For non-cfg80211 drivers */
+       dhd_remove_if(&dhd->pub, ifidx, TRUE);
+#endif /* WL_CFG80211 && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+
+done:
+       MFREE(dhd->pub.osh, if_event, sizeof(dhd_if_event_t));
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+       dhd_net_if_unlock_local(dhd);
+}
+
+#ifdef DHD_UPDATE_INTF_MAC
+static void
+dhd_ifupdate_event_handler(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+       int ifidx;
+       dhd_if_event_t *if_event = event_info;
+
+       if (event != DHD_WQ_WORK_IF_UPDATE) {
+               DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+               return;
+       }
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+               return;
+       }
+
+       if (!if_event) {
+               DHD_ERROR(("%s: event data is null \n", __FUNCTION__));
+               return;
+       }
+
+       dhd_net_if_lock_local(dhd);
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+
+       ifidx = if_event->event.ifidx;
+       DHD_TRACE(("%s: Update interface with idx %d\n", __FUNCTION__, ifidx));
+
+       dhd_op_if_update(&dhd->pub, ifidx);
+
+       MFREE(dhd->pub.osh, if_event, sizeof(dhd_if_event_t));
+
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+       dhd_net_if_unlock_local(dhd);
+}
+
+int dhd_op_if_update(dhd_pub_t *dhdpub, int ifidx)
+{
+       dhd_info_t *    dhdinfo = NULL;
+       dhd_if_t   *    ifp = NULL;
+       int             ret = 0;
+       char            buf[128];
+
+       if ((NULL==dhdpub)||(NULL==dhdpub->info)) {
+               DHD_ERROR(("%s: *** DHD handler is NULL!\n", __FUNCTION__));
+               return -1;
+       } else {
+               dhdinfo = (dhd_info_t *)dhdpub->info;
+               ifp = dhdinfo->iflist[ifidx];
+               if (NULL==ifp) {
+                   DHD_ERROR(("%s: *** ifp handler is NULL!\n", __FUNCTION__));
+                   return -2;
+               }
+       }
+
+       DHD_TRACE(("%s: idx %d\n", __FUNCTION__, ifidx));
+       // Get MAC address
+       strcpy(buf, "cur_etheraddr");
+       ret = dhd_wl_ioctl_cmd(&dhdinfo->pub, WLC_GET_VAR, buf, sizeof(buf), FALSE, ifp->idx);
+       if (0>ret) {
+               DHD_ERROR(("Failed to upudate the MAC address for itf=%s, ret=%d\n", ifp->name, ret));
+               // avoid collision
+               dhdinfo->iflist[ifp->idx]->mac_addr[5] += 1;
+               // force locally administrate address
+               ETHER_SET_LOCALADDR(&dhdinfo->iflist[ifp->idx]->mac_addr);
+       } else {
+               DHD_EVENT(("Got mac for itf %s, idx %d, MAC=%02X:%02X:%02X:%02X:%02X:%02X\n",
+                          ifp->name, ifp->idx,
+                          (unsigned char)buf[0], (unsigned char)buf[1], (unsigned char)buf[2],
+                          (unsigned char)buf[3], (unsigned char)buf[4], (unsigned char)buf[5]));
+               memcpy(dhdinfo->iflist[ifp->idx]->mac_addr, buf, ETHER_ADDR_LEN);
+               if (dhdinfo->iflist[ifp->idx]->net) {
+                   memcpy(dhdinfo->iflist[ifp->idx]->net->dev_addr, buf, ETHER_ADDR_LEN);
+               }
+       }
+
+       return ret;
+}
+#endif /* DHD_UPDATE_INTF_MAC */
+
+static void
+dhd_set_mac_addr_handler(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+       dhd_if_t *ifp = event_info;
+
+       if (event != DHD_WQ_WORK_SET_MAC) {
+               DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+       }
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+               return;
+       }
+
+       dhd_net_if_lock_local(dhd);
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+
+       // terence 20160907: fix for not able to set mac when wlan0 is down
+       if (ifp == NULL || !ifp->set_macaddress) {
+               goto done;
+       }
+       if (ifp == NULL || !dhd->pub.up) {
+               DHD_ERROR(("%s: interface info not available/down \n", __FUNCTION__));
+               goto done;
+       }
+
+       ifp->set_macaddress = FALSE;
+
+#ifdef DHD_NOTIFY_MAC_CHANGED
+       rtnl_lock();
+#endif /* DHD_NOTIFY_MAC_CHANGED */
+
+       if (_dhd_set_mac_address(dhd, ifp->idx, ifp->mac_addr, TRUE) == 0)
+               WL_MSG(dhd_ifname(&dhd->pub, ifp->idx), "MACID is overwritten\n");
+       else
+               DHD_ERROR(("%s: _dhd_set_mac_address() failed\n", __FUNCTION__));
+
+#ifdef DHD_NOTIFY_MAC_CHANGED
+       rtnl_unlock();
+#endif /* DHD_NOTIFY_MAC_CHANGED */
+
+done:
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+       dhd_net_if_unlock_local(dhd);
+}
+
+static void
+dhd_set_mcast_list_handler(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+       int ifidx = (int)((long int)event_info);
+       dhd_if_t *ifp = NULL;
+
+       if (event != DHD_WQ_WORK_SET_MCAST_LIST) {
+               DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+               return;
+       }
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+               return;
+       }
+
+       dhd_net_if_lock_local(dhd);
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+
+       ifp = dhd->iflist[ifidx];
+
+       if (ifp == NULL || !dhd->pub.up) {
+               DHD_ERROR(("%s: interface info not available/down \n", __FUNCTION__));
+               goto done;
+       }
+
+       if (ifp == NULL || !dhd->pub.up) {
+               DHD_ERROR(("%s: interface info not available/down \n", __FUNCTION__));
+               goto done;
+       }
+
+       ifidx = ifp->idx;
+
+#ifdef MCAST_LIST_ACCUMULATION
+       ifidx = 0;
+#endif /* MCAST_LIST_ACCUMULATION */
+
+       _dhd_set_multicast_list(dhd, ifidx);
+       DHD_INFO(("%s: set multicast list for if %d\n", __FUNCTION__, ifidx));
+
+done:
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+       dhd_net_if_unlock_local(dhd);
+}
+
+static int
+dhd_set_mac_address(struct net_device *dev, void *addr)
+{
+       int ret = 0;
+
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       struct sockaddr *sa = (struct sockaddr *)addr;
+       int ifidx;
+       dhd_if_t *dhdif;
+#ifdef WL_STATIC_IF
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+#endif /* WL_STATIC_IF */
+       dhd_pub_t *dhdp = &dhd->pub;
+
+       BCM_REFERENCE(ifidx);
+
+       DHD_TRACE(("%s \n", __func__));
+
+       dhdif = dhd_get_ifp_by_ndev(dhdp, dev);
+       if (!dhdif) {
+               return -ENODEV;
+       }
+       ifidx = dhdif->idx;
+       dhd_net_if_lock_local(dhd);
+       memcpy(dhdif->mac_addr, sa->sa_data, ETHER_ADDR_LEN);
+       dhdif->set_macaddress = TRUE;
+       dhd_net_if_unlock_local(dhd);
+
+       WL_MSG(dev->name, "iftype = %d macaddr = "MACDBG"\n",
+               dev->ieee80211_ptr->iftype, MAC2STRDBG(&dhdif->mac_addr));
+#ifdef WL_CFG80211
+       /* Check wdev->iftype for the role */
+       if (wl_cfg80211_macaddr_sync_reqd(dev)) {
+               /* Supplicant and certain user layer applications expect macaddress to be
+                * set once the context returns. so set it from the same context
+                */
+#ifdef WL_STATIC_IF
+               if (IS_CFG80211_STATIC_IF(cfg, dev) && !(dev->flags & IFF_UP)) {
+                       /* In softap case, the macaddress will be applied before interface up
+                        * and hence curether_addr can't be done at this stage (no fw iface
+                        * available). Store the address and return. macaddr will be applied
+                        * from interface create context.
+                        */
+                       (void)memcpy_s(dev->dev_addr, ETH_ALEN, dhdif->mac_addr, ETH_ALEN);
+#ifdef DHD_NOTIFY_MAC_CHANGED
+                       dev_open(dev);
+#endif /* DHD_NOTIFY_MAC_CHANGED */
+                       return ret;
+               }
+#endif /* WL_STATIC_IF */
+               wl_cfg80211_handle_macaddr_change(dev, dhdif->mac_addr);
+               return _dhd_set_mac_address(dhd, ifidx, dhdif->mac_addr, TRUE);
+       }
+#endif /* WL_CFG80211 */
+
+       dhd_deferred_schedule_work(dhd->dhd_deferred_wq, (void *)dhdif, DHD_WQ_WORK_SET_MAC,
+               dhd_set_mac_addr_handler, DHD_WQ_WORK_PRIORITY_LOW);
+       return ret;
+}
+
+static void
+dhd_set_multicast_list(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ifidx;
+
+       ifidx = dhd_net2idx(dhd, dev);
+       if (ifidx == DHD_BAD_IF)
+               return;
+
+       dhd->iflist[ifidx]->set_multicast = TRUE;
+       dhd_deferred_schedule_work(dhd->dhd_deferred_wq, (void *)((long int)ifidx),
+               DHD_WQ_WORK_SET_MCAST_LIST, dhd_set_mcast_list_handler, DHD_WQ_WORK_PRIORITY_LOW);
+
+       // terence 20160907: fix for not able to set mac when wlan0 is down
+       dhd_deferred_schedule_work(dhd->dhd_deferred_wq, (void *)dhd->iflist[ifidx],
+               DHD_WQ_WORK_SET_MAC, dhd_set_mac_addr_handler, DHD_WQ_WORK_PRIORITY_LOW);
+}
+
+#ifdef DHD_UCODE_DOWNLOAD
+/* Get ucode path */
+char *
+dhd_get_ucode_path(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+       return dhd->uc_path;
+}
+#endif /* DHD_UCODE_DOWNLOAD */
+
+#ifdef PROP_TXSTATUS
+int
+dhd_os_wlfc_block(dhd_pub_t *pub)
+{
+       dhd_info_t *di = (dhd_info_t *)(pub->info);
+       ASSERT(di != NULL);
+       /* terence 20161229: don't do spin lock if proptx not enabled */
+       if (disable_proptx)
+               return 1;
+#ifdef BCMDBUS
+       spin_lock_irqsave(&di->wlfc_spinlock, di->wlfc_lock_flags);
+#else
+       spin_lock_bh(&di->wlfc_spinlock);
+#endif /* BCMDBUS */
+       return 1;
+}
+
+int
+dhd_os_wlfc_unblock(dhd_pub_t *pub)
+{
+       dhd_info_t *di = (dhd_info_t *)(pub->info);
+
+       ASSERT(di != NULL);
+       /* terence 20161229: don't do spin lock if proptx not enabled */
+       if (disable_proptx)
+               return 1;
+#ifdef BCMDBUS
+       spin_unlock_irqrestore(&di->wlfc_spinlock, di->wlfc_lock_flags);
+#else
+       spin_unlock_bh(&di->wlfc_spinlock);
+#endif /* BCMDBUS */
+       return 1;
+}
+
+#endif /* PROP_TXSTATUS */
+
+#if defined(WL_MONITOR) && defined(BCMSDIO)
+static void
+dhd_rx_mon_pkt_sdio(dhd_pub_t *dhdp, void *pkt, int ifidx);
+bool
+dhd_monitor_enabled(dhd_pub_t *dhd, int ifidx);
+#endif /* WL_MONITOR && BCMSDIO */
+
+/*  This routine do not support Packet chain feature, Currently tested for
+ *  proxy arp feature
+ */
+int dhd_sendup(dhd_pub_t *dhdp, int ifidx, void *p)
+{
+       struct sk_buff *skb;
+       void *skbhead = NULL;
+       void *skbprev = NULL;
+       dhd_if_t *ifp;
+       ASSERT(!PKTISCHAINED(p));
+       skb = PKTTONATIVE(dhdp->osh, p);
+
+       ifp = dhdp->info->iflist[ifidx];
+       skb->dev = ifp->net;
+       skb->protocol = eth_type_trans(skb, skb->dev);
+
+       if (in_interrupt()) {
+               bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE,
+                       __FUNCTION__, __LINE__);
+               netif_rx(skb);
+       } else {
+               if (dhdp->info->rxthread_enabled) {
+                       if (!skbhead) {
+                               skbhead = skb;
+                       } else {
+                               PKTSETNEXT(dhdp->osh, skbprev, skb);
+                       }
+                       skbprev = skb;
+               } else {
+                       /* If the receive is not processed inside an ISR,
+                        * the softirqd must be woken explicitly to service
+                        * the NET_RX_SOFTIRQ.  In 2.6 kernels, this is handled
+                        * by netif_rx_ni(), but in earlier kernels, we need
+                        * to do it manually.
+                        */
+                       bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE,
+                               __FUNCTION__, __LINE__);
+#if defined(WL_MONITOR) && defined(BCMSDIO)
+                       if (dhd_monitor_enabled(dhdp, ifidx)) 
+                               dhd_rx_mon_pkt_sdio(dhdp, skb, ifidx);
+                       else
+#endif /* WL_MONITOR && BCMSDIO */
+                       netif_rx_ni(skb);
+               }
+       }
+
+       if (dhdp->info->rxthread_enabled && skbhead)
+               dhd_sched_rxf(dhdp, skbhead);
+
+       return BCME_OK;
+}
+
+int
+BCMFASTPATH(__dhd_sendpkt)(dhd_pub_t *dhdp, int ifidx, void *pktbuf)
+{
+       int ret = BCME_OK;
+       dhd_info_t *dhd = (dhd_info_t *)(dhdp->info);
+       struct ether_header *eh = NULL;
+       bool pkt_ether_type_802_1x = FALSE;
+       uint8 pkt_flow_prio;
+       uint8 dhd_udr = FALSE;
+
+#if defined(DHD_L2_FILTER)
+       dhd_if_t *ifp = dhd_get_ifp(dhdp, ifidx);
+#endif
+
+       /* Reject if down */
+       if (!dhdp->up || (dhdp->busstate == DHD_BUS_DOWN)) {
+               /* free the packet here since the caller won't */
+               PKTCFREE(dhdp->osh, pktbuf, TRUE);
+               return -ENODEV;
+       }
+
+#ifdef PCIE_FULL_DONGLE
+       if (dhdp->busstate == DHD_BUS_SUSPEND) {
+               DHD_ERROR(("%s : pcie is still in suspend state!!\n", __FUNCTION__));
+               PKTCFREE(dhdp->osh, pktbuf, TRUE);
+               return NETDEV_TX_BUSY;
+       }
+#endif /* PCIE_FULL_DONGLE */
+
+       /* Reject if pktlen > MAX_MTU_SZ */
+       if (PKTLEN(dhdp->osh, pktbuf) > MAX_MTU_SZ) {
+               /* free the packet here since the caller won't */
+               dhdp->tx_big_packets++;
+               PKTCFREE(dhdp->osh, pktbuf, TRUE);
+               return BCME_ERROR;
+       }
+
+#ifdef DHD_L2_FILTER
+       /* if dhcp_unicast is enabled, we need to convert the */
+       /* broadcast DHCP ACK/REPLY packets to Unicast. */
+       if (ifp->dhcp_unicast) {
+           uint8* mac_addr;
+           uint8* ehptr = NULL;
+           int ret;
+           ret = bcm_l2_filter_get_mac_addr_dhcp_pkt(dhdp->osh, pktbuf, ifidx, &mac_addr);
+           if (ret == BCME_OK) {
+               /*  if given mac address having valid entry in sta list
+                *  copy the given mac address, and return with BCME_OK
+               */
+               if (dhd_find_sta(dhdp, ifidx, mac_addr)) {
+                   ehptr = PKTDATA(dhdp->osh, pktbuf);
+                   bcopy(mac_addr, ehptr + ETHER_DEST_OFFSET, ETHER_ADDR_LEN);
+               }
+           }
+       }
+
+       if (ifp->grat_arp && DHD_IF_ROLE_AP(dhdp, ifidx)) {
+           if (bcm_l2_filter_gratuitous_arp(dhdp->osh, pktbuf) == BCME_OK) {
+                       PKTCFREE(dhdp->osh, pktbuf, TRUE);
+                       return BCME_ERROR;
+           }
+       }
+
+       if (ifp->parp_enable && DHD_IF_ROLE_AP(dhdp, ifidx)) {
+               ret = dhd_l2_filter_pkt_handle(dhdp, ifidx, pktbuf, TRUE);
+
+               /* Drop the packets if l2 filter has processed it already
+                * otherwise continue with the normal path
+                */
+               if (ret == BCME_OK) {
+                       PKTCFREE(dhdp->osh, pktbuf, TRUE);
+                       return BCME_ERROR;
+               }
+       }
+#endif /* DHD_L2_FILTER */
+       /* Update multicast statistic */
+       if (PKTLEN(dhdp->osh, pktbuf) >= ETHER_HDR_LEN) {
+               uint8 *pktdata = (uint8 *)PKTDATA(dhdp->osh, pktbuf);
+               eh = (struct ether_header *)pktdata;
+
+               if (ETHER_ISMULTI(eh->ether_dhost))
+                       dhdp->tx_multicast++;
+               if (ntoh16(eh->ether_type) == ETHER_TYPE_802_1X) {
+#ifdef DHD_LOSSLESS_ROAMING
+                       uint8 prio = (uint8)PKTPRIO(pktbuf);
+
+                       /* back up 802.1x's priority */
+                       dhdp->prio_8021x = prio;
+#endif /* DHD_LOSSLESS_ROAMING */
+                       pkt_ether_type_802_1x = TRUE;
+                       DBG_EVENT_LOG(dhdp, WIFI_EVENT_DRIVER_EAPOL_FRAME_TRANSMIT_REQUESTED);
+                       atomic_inc(&dhd->pend_8021x_cnt);
+#if defined(WL_CFG80211) && defined(WL_WPS_SYNC)
+                       wl_handle_wps_states(dhd_idx2net(dhdp, ifidx),
+                               pktdata, PKTLEN(dhdp->osh, pktbuf), TRUE);
+#endif /* WL_CFG80211 && WL_WPS_SYNC */
+               }
+               if (ntoh16(eh->ether_type) == ETHER_TYPE_IP) {
+                       if (dhd_check_dhcp(pktdata)) {
+                               dhd_udr = TRUE;
+                       } else if (dhd_check_dns(pktdata)) {
+                               dhd_udr = TRUE;
+                       }
+               }
+               if (ntoh16(eh->ether_type) == ETHER_TYPE_ARP) {
+                       if (dhd_check_arp(pktdata)) {
+                               dhd_udr = TRUE;
+                       }
+               }
+               dhd_dump_pkt(dhdp, ifidx, pktdata,
+                       (uint32)PKTLEN(dhdp->osh, pktbuf), TRUE, NULL, NULL);
+       } else {
+               PKTCFREE(dhdp->osh, pktbuf, TRUE);
+               return BCME_ERROR;
+       }
+
+       {
+               /* Look into the packet and update the packet priority */
+#ifndef PKTPRIO_OVERRIDE
+               /* XXX RB:6270 Ignore skb->priority from TCP/IP stack */
+               if (PKTPRIO(pktbuf) == 0)
+#endif /* !PKTPRIO_OVERRIDE */
+               {
+#if defined(QOS_MAP_SET)
+                       pktsetprio_qms(pktbuf, wl_get_up_table(dhdp, ifidx), FALSE);
+#else
+                       pktsetprio(pktbuf, FALSE);
+#endif /* QOS_MAP_SET */
+               }
+#ifndef PKTPRIO_OVERRIDE
+               else {
+                       /* Some protocols like OZMO use priority values from 256..263.
+                        * these are magic values to indicate a specific 802.1d priority.
+                        * make sure that priority field is in range of 0..7
+                        */
+                       PKTSETPRIO(pktbuf, PKTPRIO(pktbuf) & 0x7);
+               }
+#endif /* !PKTPRIO_OVERRIDE */
+       }
+
+       BCM_REFERENCE(pkt_ether_type_802_1x);
+       BCM_REFERENCE(pkt_flow_prio);
+       /* Intercept and create Socket level statistics */
+       /*
+        * TODO: Some how moving this code block above the pktsetprio code
+        * is resetting the priority back to 0, but this does not happen for
+        * packets generated from iperf uisng -S option. Can't understand why.
+        */
+       dhd_update_sock_flows(dhd, pktbuf);
+
+#ifdef SUPPORT_SET_TID
+       dhd_set_tid_based_on_uid(dhdp, pktbuf);
+#endif /* SUPPORT_SET_TID */
+
+#ifdef PCIE_FULL_DONGLE
+       /*
+        * Lkup the per interface hash table, for a matching flowring. If one is not
+        * available, allocate a unique flowid and add a flowring entry.
+        * The found or newly created flowid is placed into the pktbuf's tag.
+        */
+
+#ifdef DHD_LOSSLESS_ROAMING
+       /* For LLR override and use flowring with prio 7 for 802.1x packets */
+       if (pkt_ether_type_802_1x) {
+               pkt_flow_prio = PRIO_8021D_NC;
+       } else
+#endif /* DHD_LOSSLESS_ROAMING */
+#ifdef DHD_TX_PROFILE
+       if (dhdp->tx_profile_enab && dhdp->num_profiles > 0 &&
+               dhd_protocol_matches_profile(PKTDATA(dhdp->osh, pktbuf),
+               PKTLEN(dhdp->osh, pktbuf), dhdp->protocol_filters)) {
+               /* we only have support for one tx_profile at the moment */
+
+               /* tagged packets must be put into TID 6 */
+               pkt_flow_prio = PRIO_8021D_VO;
+       } else
+#endif /* defined(DHD_TX_PROFILE) */
+       {
+               pkt_flow_prio = dhdp->flow_prio_map[(PKTPRIO(pktbuf))];
+       }
+
+       ret = dhd_flowid_update(dhdp, ifidx, pkt_flow_prio, pktbuf);
+       if (ret != BCME_OK) {
+               PKTCFREE(dhd->pub.osh, pktbuf, TRUE);
+               return ret;
+       }
+#endif /* PCIE_FULL_DONGLE */
+       /* terence 20150901: Micky add to ajust the 802.1X priority */
+       /* Set the 802.1X packet with the highest priority 7 */
+       if (dhdp->conf->pktprio8021x >= 0)
+               pktset8021xprio(pktbuf, dhdp->conf->pktprio8021x);
+
+#ifdef PROP_TXSTATUS
+       if (dhd_wlfc_is_supported(dhdp)) {
+               /* store the interface ID */
+               DHD_PKTTAG_SETIF(PKTTAG(pktbuf), ifidx);
+
+               /* store destination MAC in the tag as well */
+               DHD_PKTTAG_SETDSTN(PKTTAG(pktbuf), eh->ether_dhost);
+
+               /* decide which FIFO this packet belongs to */
+               if (ETHER_ISMULTI(eh->ether_dhost))
+                       /* one additional queue index (highest AC + 1) is used for bc/mc queue */
+                       DHD_PKTTAG_SETFIFO(PKTTAG(pktbuf), AC_COUNT);
+               else
+                       DHD_PKTTAG_SETFIFO(PKTTAG(pktbuf), WME_PRIO2AC(PKTPRIO(pktbuf)));
+       } else
+#endif /* PROP_TXSTATUS */
+       {
+               /* If the protocol uses a data header, apply it */
+               dhd_prot_hdrpush(dhdp, ifidx, pktbuf);
+       }
+#ifdef PCIE_FULL_DONGLE
+       DHD_PKTTAG_SET_PKT_UDR((dhd_pkttag_fr_t *)PKTTAG(pktbuf), dhd_udr);
+#else
+       BCM_REFERENCE(dhd_udr);
+#endif /* PCIE_FULL_DONGLE */
+
+       /* Use bus module to send data frame */
+#ifdef PROP_TXSTATUS
+       {
+               if (dhd_wlfc_commit_packets(dhdp, (f_commitpkt_t)dhd_bus_txdata,
+                       dhdp->bus, pktbuf, TRUE) == WLFC_UNSUPPORTED) {
+                       /* non-proptxstatus way */
+#ifdef BCMPCIE
+                       ret = dhd_bus_txdata(dhdp->bus, pktbuf, (uint8)ifidx);
+#else
+                       ret = dhd_bus_txdata(dhdp->bus, pktbuf);
+#endif /* BCMPCIE */
+               }
+       }
+#else
+#ifdef BCMPCIE
+       ret = dhd_bus_txdata(dhdp->bus, pktbuf, (uint8)ifidx);
+#else
+       ret = dhd_bus_txdata(dhdp->bus, pktbuf);
+#endif /* BCMPCIE */
+#endif /* PROP_TXSTATUS */
+#ifdef BCMDBUS
+       if (ret)
+               PKTCFREE(dhdp->osh, pktbuf, TRUE);
+#endif /* BCMDBUS */
+
+       return ret;
+}
+
+int
+BCMFASTPATH(dhd_sendpkt)(dhd_pub_t *dhdp, int ifidx, void *pktbuf)
+{
+       int ret = 0;
+       unsigned long flags;
+       dhd_if_t *ifp;
+
+       DHD_GENERAL_LOCK(dhdp, flags);
+       ifp = dhd_get_ifp(dhdp, ifidx);
+       if (!ifp || ifp->del_in_progress) {
+               DHD_ERROR(("%s: ifp:%p del_in_progress:%d\n",
+                       __FUNCTION__, ifp, ifp ? ifp->del_in_progress : 0));
+               DHD_GENERAL_UNLOCK(dhdp, flags);
+               PKTCFREE(dhdp->osh, pktbuf, TRUE);
+               return -ENODEV;
+       }
+       if (DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(dhdp)) {
+               DHD_ERROR(("%s: returning as busstate=%d\n",
+                       __FUNCTION__, dhdp->busstate));
+               DHD_GENERAL_UNLOCK(dhdp, flags);
+               PKTCFREE(dhdp->osh, pktbuf, TRUE);
+               return -ENODEV;
+       }
+       DHD_IF_SET_TX_ACTIVE(ifp, DHD_TX_SEND_PKT);
+       DHD_BUS_BUSY_SET_IN_SEND_PKT(dhdp);
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       if (dhdpcie_runtime_bus_wake(dhdp, FALSE, __builtin_return_address(0))) {
+               DHD_ERROR(("%s : pcie is still in suspend state!!\n", __FUNCTION__));
+               PKTCFREE(dhdp->osh, pktbuf, TRUE);
+               ret = -EBUSY;
+               goto exit;
+       }
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       DHD_GENERAL_LOCK(dhdp, flags);
+       if (DHD_BUS_CHECK_SUSPEND_OR_SUSPEND_IN_PROGRESS(dhdp)) {
+               DHD_ERROR(("%s: bus is in suspend(%d) or suspending(0x%x) state!!\n",
+                       __FUNCTION__, dhdp->busstate, dhdp->dhd_bus_busy_state));
+               DHD_BUS_BUSY_CLEAR_IN_SEND_PKT(dhdp);
+               DHD_IF_CLR_TX_ACTIVE(ifp, DHD_TX_SEND_PKT);
+               dhd_os_tx_completion_wake(dhdp);
+               dhd_os_busbusy_wake(dhdp);
+               DHD_GENERAL_UNLOCK(dhdp, flags);
+               PKTCFREE(dhdp->osh, pktbuf, TRUE);
+               return -ENODEV;
+       }
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+
+       ret = __dhd_sendpkt(dhdp, ifidx, pktbuf);
+
+#ifdef DHD_PCIE_RUNTIMEPM
+exit:
+#endif
+       DHD_GENERAL_LOCK(dhdp, flags);
+       DHD_BUS_BUSY_CLEAR_IN_SEND_PKT(dhdp);
+       DHD_IF_CLR_TX_ACTIVE(ifp, DHD_TX_SEND_PKT);
+       dhd_os_tx_completion_wake(dhdp);
+       dhd_os_busbusy_wake(dhdp);
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+       return ret;
+}
+
+#ifdef DHD_MQ
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+static uint16
+BCMFASTPATH(dhd_select_queue)(struct net_device *net, struct sk_buff *skb,
+       void *accel_priv, select_queue_fallback_t fallback)
+#else
+static uint16
+BCMFASTPATH(dhd_select_queue)(struct net_device *net, struct sk_buff *skb)
+#endif /* LINUX_VERSION_CODE */
+{
+       dhd_info_t *dhd_info = DHD_DEV_INFO(net);
+       dhd_pub_t *dhdp = &dhd_info->pub;
+       uint16 prio = 0;
+
+       BCM_REFERENCE(dhd_info);
+       BCM_REFERENCE(dhdp);
+       BCM_REFERENCE(prio);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+       if (mq_select_disable) {
+               /* if driver side queue selection is disabled via sysfs, call the kernel
+               * supplied fallback function to select the queue, which is usually
+               * '__netdev_pick_tx()' in net/core/dev.c
+               */
+               return fallback(net, skb);
+       }
+#endif /* LINUX_VERSION */
+
+       prio = dhdp->flow_prio_map[skb->priority];
+       if (prio < AC_COUNT)
+               return prio;
+       else
+               return AC_BK;
+}
+#endif /* DHD_MQ */
+
+int
+BCMFASTPATH(dhd_start_xmit)(struct sk_buff *skb, struct net_device *net)
+{
+       int ret;
+       uint datalen;
+       void *pktbuf;
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+       dhd_if_t *ifp = NULL;
+       int ifidx;
+       unsigned long flags;
+       uint8 htsfdlystat_sz = 0;
+#if defined(DHD_MQ) && defined(DHD_MQ_STATS)
+       int qidx = 0;
+       int cpuid = 0;
+       int prio = 0;
+#endif /* DHD_MQ && DHD_MQ_STATS */
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#if defined(DHD_MQ) && defined(DHD_MQ_STATS)
+       qidx = skb_get_queue_mapping(skb);
+       /* if in a non pre-emptable context, smp_processor_id can be used
+       * else get_cpu and put_cpu should be used
+       */
+       if (!CAN_SLEEP()) {
+               cpuid = smp_processor_id();
+       }
+       else {
+               cpuid = get_cpu();
+               put_cpu();
+       }
+       prio = dhd->pub.flow_prio_map[skb->priority];
+       DHD_TRACE(("%s: Q idx = %d, CPU = %d, prio = %d \n", __FUNCTION__,
+               qidx, cpuid, prio));
+       dhd->pktcnt_qac_histo[qidx][prio]++;
+       dhd->pktcnt_per_ac[prio]++;
+       dhd->cpu_qstats[qidx][cpuid]++;
+#endif /* DHD_MQ && DHD_MQ_STATS */
+
+       if (dhd_query_bus_erros(&dhd->pub)) {
+               return -ENODEV;
+       }
+
+       DHD_GENERAL_LOCK(&dhd->pub, flags);
+       DHD_BUS_BUSY_SET_IN_TX(&dhd->pub);
+       DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       if (dhdpcie_runtime_bus_wake(&dhd->pub, FALSE, dhd_start_xmit)) {
+               /* In order to avoid pkt loss. Return NETDEV_TX_BUSY until run-time resumed. */
+               /* stop the network queue temporarily until resume done */
+               DHD_GENERAL_LOCK(&dhd->pub, flags);
+               if (!dhdpcie_is_resume_done(&dhd->pub)) {
+                       dhd_bus_stop_queue(dhd->pub.bus);
+               }
+               DHD_BUS_BUSY_CLEAR_IN_TX(&dhd->pub);
+               dhd_os_busbusy_wake(&dhd->pub);
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+               return NETDEV_TX_BUSY;
+       }
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       DHD_GENERAL_LOCK(&dhd->pub, flags);
+#ifdef BCMPCIE
+       if (DHD_BUS_CHECK_SUSPEND_OR_SUSPEND_IN_PROGRESS(&dhd->pub)) {
+               DHD_ERROR(("%s: bus is in suspend(%d) or suspending(0x%x) state!!\n",
+                       __FUNCTION__, dhd->pub.busstate, dhd->pub.dhd_bus_busy_state));
+               DHD_BUS_BUSY_CLEAR_IN_TX(&dhd->pub);
+#ifdef PCIE_FULL_DONGLE
+               /* Stop tx queues if suspend is in progress */
+               if (DHD_BUS_CHECK_ANY_SUSPEND_IN_PROGRESS(&dhd->pub)) {
+                       dhd_bus_stop_queue(dhd->pub.bus);
+               }
+#endif /* PCIE_FULL_DONGLE */
+               dhd_os_busbusy_wake(&dhd->pub);
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+               return NETDEV_TX_BUSY;
+       }
+#else
+       if (DHD_BUS_CHECK_SUSPEND_OR_SUSPEND_IN_PROGRESS(&dhd->pub)) {
+               DHD_ERROR(("%s: bus is in suspend(%d) or suspending(0x%x) state!!\n",
+                       __FUNCTION__, dhd->pub.busstate, dhd->pub.dhd_bus_busy_state));
+       }
+#endif
+
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+
+#if defined(DHD_HANG_SEND_UP_TEST)
+       if (dhd->pub.req_hang_type == HANG_REASON_BUS_DOWN) {
+               DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+               dhd->pub.busstate = DHD_BUS_DOWN;
+       }
+#endif /* DHD_HANG_SEND_UP_TEST */
+
+       /* Reject if down */
+       /* XXX kernel panic issue when first bootup time,
+        *       rmmod without interface down make unnecessary hang event.
+        */
+       if (dhd->pub.hang_was_sent || DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(&dhd->pub)) {
+               DHD_ERROR(("%s: xmit rejected pub.up=%d busstate=%d \n",
+                       __FUNCTION__, dhd->pub.up, dhd->pub.busstate));
+               dhd_tx_stop_queues(net);
+               /* Send Event when bus down detected during data session */
+               if (dhd->pub.up && !dhd->pub.hang_was_sent && !DHD_BUS_CHECK_REMOVE(&dhd->pub)) {
+                       DHD_ERROR(("%s: Event HANG sent up\n", __FUNCTION__));
+                       dhd->pub.hang_reason = HANG_REASON_BUS_DOWN;
+                       net_os_send_hang_message(net);
+               }
+               DHD_BUS_BUSY_CLEAR_IN_TX(&dhd->pub);
+               dhd_os_busbusy_wake(&dhd->pub);
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+               return NETDEV_TX_BUSY;
+       }
+
+       ifp = DHD_DEV_IFP(net);
+       ifidx = DHD_DEV_IFIDX(net);
+       if (ifidx == DHD_BAD_IF) {
+               DHD_ERROR(("%s: bad ifidx %d\n", __FUNCTION__, ifidx));
+               dhd_tx_stop_queues(net);
+               DHD_BUS_BUSY_CLEAR_IN_TX(&dhd->pub);
+               dhd_os_busbusy_wake(&dhd->pub);
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+               return NETDEV_TX_BUSY;
+       }
+
+       DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+
+       /* If tput test is in progress */
+       if (dhd->pub.tput_data.tput_test_running) {
+               return NETDEV_TX_BUSY;
+       }
+
+       ASSERT(ifidx == dhd_net2idx(dhd, net));
+       ASSERT((ifp != NULL) && ((ifidx < DHD_MAX_IFS) && (ifp == dhd->iflist[ifidx])));
+
+       bcm_object_trace_opr(skb, BCM_OBJDBG_ADD_PKT, __FUNCTION__, __LINE__);
+
+       /* re-align socket buffer if "skb->data" is odd address */
+       if (((unsigned long)(skb->data)) & 0x1) {
+               unsigned char *data = skb->data;
+               uint32 length = skb->len;
+               PKTPUSH(dhd->pub.osh, skb, 1);
+               memmove(skb->data, data, length);
+               PKTSETLEN(dhd->pub.osh, skb, length);
+       }
+
+       datalen  = PKTLEN(dhd->pub.osh, skb);
+
+#ifdef HOST_TPUT_TEST
+       dhd_os_sdlock_txq(&dhd->pub);
+       dhd->pub.net_len += datalen;
+       dhd_os_sdunlock_txq(&dhd->pub);
+       if ((dhd->pub.conf->data_drop_mode == XMIT_DROP) &&
+                       (PKTLEN(dhd->pub.osh, skb) > 500)) {
+               dev_kfree_skb(skb);
+               return NETDEV_TX_OK;
+       }
+#endif
+       /* Make sure there's enough room for any header */
+       if (skb_headroom(skb) < dhd->pub.hdrlen + htsfdlystat_sz) {
+               struct sk_buff *skb2;
+
+               DHD_INFO(("%s: insufficient headroom\n",
+                         dhd_ifname(&dhd->pub, ifidx)));
+               dhd->pub.tx_realloc++;
+
+               bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE, __FUNCTION__, __LINE__);
+               skb2 = skb_realloc_headroom(skb, dhd->pub.hdrlen + htsfdlystat_sz);
+
+               dev_kfree_skb(skb);
+               if ((skb = skb2) == NULL) {
+                       DHD_ERROR(("%s: skb_realloc_headroom failed\n",
+                                  dhd_ifname(&dhd->pub, ifidx)));
+                       ret = -ENOMEM;
+                       goto done;
+               }
+               bcm_object_trace_opr(skb, BCM_OBJDBG_ADD_PKT, __FUNCTION__, __LINE__);
+       }
+
+       /* move from dhdsdio_sendfromq(), try to orphan skb early */
+       if (dhd->pub.conf->orphan_move == 2)
+               PKTORPHAN(skb, dhd->pub.conf->tsq);
+       else if (dhd->pub.conf->orphan_move == 3)
+               skb_orphan(skb);
+
+       /* Convert to packet */
+       if (!(pktbuf = PKTFRMNATIVE(dhd->pub.osh, skb))) {
+               DHD_ERROR(("%s: PKTFRMNATIVE failed\n",
+                          dhd_ifname(&dhd->pub, ifidx)));
+               bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE, __FUNCTION__, __LINE__);
+               dev_kfree_skb_any(skb);
+               ret = -ENOMEM;
+               goto done;
+       }
+
+#ifdef DHD_WET
+       /* wet related packet proto manipulation should be done in DHD
+          since dongle doesn't have complete payload
+        */
+       if (WET_ENABLED(&dhd->pub) &&
+                       (dhd_wet_send_proc(dhd->pub.wet_info, pktbuf, &pktbuf) < 0)) {
+               DHD_INFO(("%s:%s: wet send proc failed\n",
+                               __FUNCTION__, dhd_ifname(&dhd->pub, ifidx)));
+               PKTFREE(dhd->pub.osh, pktbuf, FALSE);
+               ret =  -EFAULT;
+               goto done;
+       }
+#endif /* DHD_WET */
+
+#ifdef DHD_PSTA
+       /* PSR related packet proto manipulation should be done in DHD
+        * since dongle doesn't have complete payload
+        */
+       if (PSR_ENABLED(&dhd->pub) &&
+               (dhd_psta_proc(&dhd->pub, ifidx, &pktbuf, TRUE) < 0)) {
+
+                       DHD_ERROR(("%s:%s: psta send proc failed\n", __FUNCTION__,
+                               dhd_ifname(&dhd->pub, ifidx)));
+       }
+#endif /* DHD_PSTA */
+
+#ifdef DHDTCPSYNC_FLOOD_BLK
+       if (dhd_tcpdata_get_flag(&dhd->pub, pktbuf) == FLAG_SYNCACK) {
+               ifp->tsyncack_txed ++;
+       }
+#endif /* DHDTCPSYNC_FLOOD_BLK */
+
+#ifdef DHDTCPACK_SUPPRESS
+       if (dhd->pub.tcpack_sup_mode == TCPACK_SUP_HOLD) {
+               /* If this packet has been hold or got freed, just return */
+               if (dhd_tcpack_hold(&dhd->pub, pktbuf, ifidx)) {
+                       ret = 0;
+                       goto done;
+               }
+       } else {
+               /* If this packet has replaced another packet and got freed, just return */
+               if (dhd_tcpack_suppress(&dhd->pub, pktbuf)) {
+                       ret = 0;
+                       goto done;
+               }
+       }
+#endif /* DHDTCPACK_SUPPRESS */
+
+       /*
+        * If Load Balance is enabled queue the packet
+        * else send directly from here.
+        */
+#if defined(DHD_LB_TXP)
+       ret = dhd_lb_sendpkt(dhd, net, ifidx, pktbuf);
+#else
+       ret = __dhd_sendpkt(&dhd->pub, ifidx, pktbuf);
+#endif
+
+done:
+       /* XXX Bus modules may have different "native" error spaces? */
+       /* XXX USB is native linux and it'd be nice to retain errno  */
+       /* XXX meaning, but SDIO is not so we'd need an OSL_ERROR.   */
+       if (ret) {
+               ifp->stats.tx_dropped++;
+               dhd->pub.tx_dropped++;
+       } else {
+#ifdef PROP_TXSTATUS
+               /* tx_packets counter can counted only when wlfc is disabled */
+               if (!dhd_wlfc_is_supported(&dhd->pub))
+#endif
+               {
+                       dhd->pub.tx_packets++;
+                       ifp->stats.tx_packets++;
+                       ifp->stats.tx_bytes += datalen;
+               }
+               dhd->pub.actual_tx_pkts++;
+       }
+
+       DHD_GENERAL_LOCK(&dhd->pub, flags);
+       DHD_BUS_BUSY_CLEAR_IN_TX(&dhd->pub);
+       DHD_IF_CLR_TX_ACTIVE(ifp, DHD_TX_START_XMIT);
+       dhd_os_tx_completion_wake(&dhd->pub);
+       dhd_os_busbusy_wake(&dhd->pub);
+       DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+       /* Return ok: we always eat the packet */
+       return NETDEV_TX_OK;
+}
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+void dhd_rx_wq_wakeup(struct work_struct *ptr)
+{
+       struct dhd_rx_tx_work *work;
+       struct dhd_pub * pub;
+
+       work = container_of(ptr, struct dhd_rx_tx_work, work);
+
+       pub = work->pub;
+
+       DHD_RPM(("%s: ENTER. \n", __FUNCTION__));
+
+       if (atomic_read(&pub->block_bus) || pub->busstate == DHD_BUS_DOWN) {
+               return;
+       }
+
+       DHD_OS_WAKE_LOCK(pub);
+       if (pm_runtime_get_sync(dhd_bus_to_dev(pub->bus)) >= 0) {
+
+               // do nothing but wakeup the bus.
+               pm_runtime_mark_last_busy(dhd_bus_to_dev(pub->bus));
+               pm_runtime_put_autosuspend(dhd_bus_to_dev(pub->bus));
+       }
+       DHD_OS_WAKE_UNLOCK(pub);
+       kfree(work);
+}
+
+void dhd_start_xmit_wq_adapter(struct work_struct *ptr)
+{
+       struct dhd_rx_tx_work *work;
+       int ret;
+       dhd_info_t *dhd;
+       struct dhd_bus * bus;
+
+       work = container_of(ptr, struct dhd_rx_tx_work, work);
+
+       dhd = DHD_DEV_INFO(work->net);
+
+       bus = dhd->pub.bus;
+
+       if (atomic_read(&dhd->pub.block_bus)) {
+               kfree_skb(work->skb);
+               kfree(work);
+               dhd_netif_start_queue(bus);
+               return;
+       }
+
+       if (pm_runtime_get_sync(dhd_bus_to_dev(bus)) >= 0) {
+               ret = dhd_start_xmit(work->skb, work->net);
+               pm_runtime_mark_last_busy(dhd_bus_to_dev(bus));
+               pm_runtime_put_autosuspend(dhd_bus_to_dev(bus));
+       }
+       kfree(work);
+       dhd_netif_start_queue(bus);
+
+       if (ret)
+               netdev_err(work->net,
+                          "error: dhd_start_xmit():%d\n", ret);
+}
+
+int
+BCMFASTPATH(dhd_start_xmit_wrapper)(struct sk_buff *skb, struct net_device *net)
+{
+       struct dhd_rx_tx_work *start_xmit_work;
+       int ret;
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+
+       if (dhd->pub.busstate == DHD_BUS_SUSPEND) {
+               DHD_RPM(("%s: wakeup the bus using workqueue.\n", __FUNCTION__));
+
+               dhd_netif_stop_queue(dhd->pub.bus);
+
+               start_xmit_work = (struct dhd_rx_tx_work*)
+                       kmalloc(sizeof(*start_xmit_work), GFP_ATOMIC);
+
+               if (!start_xmit_work) {
+                       netdev_err(net,
+                                  "error: failed to alloc start_xmit_work\n");
+                       ret = -ENOMEM;
+                       goto exit;
+               }
+
+               INIT_WORK(&start_xmit_work->work, dhd_start_xmit_wq_adapter);
+               start_xmit_work->skb = skb;
+               start_xmit_work->net = net;
+               queue_work(dhd->tx_wq, &start_xmit_work->work);
+               ret = NET_XMIT_SUCCESS;
+
+       } else if (dhd->pub.busstate == DHD_BUS_DATA) {
+               ret = dhd_start_xmit(skb, net);
+       } else {
+               /* when bus is down */
+               ret = -ENODEV;
+       }
+
+exit:
+       return ret;
+}
+void
+dhd_bus_wakeup_work(dhd_pub_t *dhdp)
+{
+       struct dhd_rx_tx_work *rx_work;
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+
+       rx_work = kmalloc(sizeof(*rx_work), GFP_ATOMIC);
+       if (!rx_work) {
+               DHD_ERROR(("%s: start_rx_work alloc error. \n", __FUNCTION__));
+               return;
+       }
+
+       INIT_WORK(&rx_work->work, dhd_rx_wq_wakeup);
+       rx_work->pub = dhdp;
+       queue_work(dhd->rx_wq, &rx_work->work);
+
+}
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+static void
+__dhd_txflowcontrol(dhd_pub_t *dhdp, struct net_device *net, bool state)
+{
+       if (state == ON) {
+               if (!netif_queue_stopped(net)) {
+                       DHD_ERROR(("%s: Stop Netif Queue\n", __FUNCTION__));
+                       netif_stop_queue(net);
+               } else {
+                       DHD_LOG_MEM(("%s: Netif Queue already stopped\n", __FUNCTION__));
+               }
+       }
+
+       if (state == OFF) {
+               if (netif_queue_stopped(net)) {
+                       DHD_ERROR(("%s: Start Netif Queue\n", __FUNCTION__));
+                       netif_wake_queue(net);
+               } else {
+                       DHD_LOG_MEM(("%s: Netif Queue already started\n", __FUNCTION__));
+               }
+       }
+}
+
+void
+dhd_txflowcontrol(dhd_pub_t *dhdp, int ifidx, bool state)
+{
+       struct net_device *net;
+       dhd_info_t *dhd = dhdp->info;
+       int i;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       ASSERT(dhd);
+
+#ifdef DHD_LOSSLESS_ROAMING
+       /* block flowcontrol during roaming */
+       if ((dhdp->dequeue_prec_map == 1 << PRIO_8021D_NC) && state == ON) {
+               return;
+       }
+#endif
+
+       if (ifidx == ALL_INTERFACES) {
+               for (i = 0; i < DHD_MAX_IFS; i++) {
+                       if (dhd->iflist[i]) {
+                               net = dhd->iflist[i]->net;
+                               __dhd_txflowcontrol(dhdp, net, state);
+                       }
+               }
+       } else {
+               if (dhd->iflist[ifidx]) {
+                       net = dhd->iflist[ifidx]->net;
+                       __dhd_txflowcontrol(dhdp, net, state);
+               }
+       }
+       dhdp->txoff = state;
+}
+
+#ifdef DHD_MCAST_REGEN
+/*
+ * Description: This function is called to do the reverse translation
+ *
+ * Input    eh - pointer to the ethernet header
+ */
+int32
+dhd_mcast_reverse_translation(struct ether_header *eh)
+{
+       uint8 *iph;
+       uint32 dest_ip;
+
+       iph = (uint8 *)eh + ETHER_HDR_LEN;
+       dest_ip = ntoh32(*((uint32 *)(iph + IPV4_DEST_IP_OFFSET)));
+
+       /* Only IP packets are handled */
+       if (eh->ether_type != hton16(ETHER_TYPE_IP))
+               return BCME_ERROR;
+
+       /* Non-IPv4 multicast packets are not handled */
+       if (IP_VER(iph) != IP_VER_4)
+               return BCME_ERROR;
+
+       /*
+        * The packet has a multicast IP and unicast MAC. That means
+        * we have to do the reverse translation
+        */
+       if (IPV4_ISMULTI(dest_ip) && !ETHER_ISMULTI(&eh->ether_dhost)) {
+               ETHER_FILL_MCAST_ADDR_FROM_IP(eh->ether_dhost, dest_ip);
+               return BCME_OK;
+       }
+
+       return BCME_ERROR;
+}
+#endif /* MCAST_REGEN */
+
+#ifdef SHOW_LOGTRACE
+static void
+dhd_netif_rx_ni(struct sk_buff * skb)
+{
+       /* Do not call netif_recieve_skb as this workqueue scheduler is
+        * not from NAPI Also as we are not in INTR context, do not call
+        * netif_rx, instead call netif_rx_ni (for kerenl >= 2.6) which
+        * does netif_rx, disables irq, raise NET_IF_RX softirq and
+        * enables interrupts back
+        */
+       netif_rx_ni(skb);
+}
+
+static int
+dhd_event_logtrace_pkt_process(dhd_pub_t *dhdp, struct sk_buff * skb)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+       int ret = BCME_OK;
+       uint datalen;
+       bcm_event_msg_u_t evu;
+       void *data = NULL;
+       void *pktdata = NULL;
+       bcm_event_t *pvt_data;
+       uint pktlen;
+
+       DHD_TRACE(("%s:Enter\n", __FUNCTION__));
+
+       /* In dhd_rx_frame, header is stripped using skb_pull
+        * of size ETH_HLEN, so adjust pktlen accordingly
+        */
+       pktlen = skb->len + ETH_HLEN;
+
+       pktdata = (void *)skb_mac_header(skb);
+       ret = wl_host_event_get_data(pktdata, pktlen, &evu);
+
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s: wl_host_event_get_data err = %d\n",
+                       __FUNCTION__, ret));
+               goto exit;
+       }
+
+       datalen = ntoh32(evu.event.datalen);
+
+       pvt_data = (bcm_event_t *)pktdata;
+       data = &pvt_data[1];
+
+       dhd_dbg_trace_evnt_handler(dhdp, data, &dhd->event_data, datalen);
+
+exit:
+       return ret;
+}
+
+/*
+ * dhd_event_logtrace_process_items processes
+ * each skb from evt_trace_queue.
+ * Returns TRUE if more packets to be processed
+ * else returns FALSE
+ */
+
+static int
+dhd_event_logtrace_process_items(dhd_info_t *dhd)
+{
+       dhd_pub_t *dhdp;
+       struct sk_buff *skb;
+       uint32 qlen;
+       uint32 process_len;
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+               return 0;
+       }
+
+       dhdp = &dhd->pub;
+
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhd pub is null \n", __FUNCTION__));
+               return 0;
+       }
+
+       qlen = skb_queue_len(&dhd->evt_trace_queue);
+       process_len = MIN(qlen, DHD_EVENT_LOGTRACE_BOUND);
+
+       /* Run while loop till bound is reached or skb queue is empty */
+       while (process_len--) {
+               int ifid = 0;
+               skb = skb_dequeue(&dhd->evt_trace_queue);
+               if (skb == NULL) {
+                       DHD_ERROR(("%s: skb is NULL, which is not valid case\n",
+                               __FUNCTION__));
+                       break;
+               }
+               BCM_REFERENCE(ifid);
+#ifdef PCIE_FULL_DONGLE
+               /* Check if pkt is from INFO ring or WLC_E_TRACE */
+               ifid = DHD_PKTTAG_IFID((dhd_pkttag_fr_t *)PKTTAG(skb));
+               if (ifid == DHD_DUMMY_INFO_IF) {
+                       /* Process logtrace from info rings */
+                       dhd_event_logtrace_infobuf_pkt_process(dhdp, skb, &dhd->event_data);
+               } else
+#endif /* PCIE_FULL_DONGLE */
+               {
+                       /* Processing WLC_E_TRACE case OR non PCIE PCIE_FULL_DONGLE case */
+                       dhd_event_logtrace_pkt_process(dhdp, skb);
+               }
+
+               /* Dummy sleep so that scheduler kicks in after processing any logprints */
+               OSL_SLEEP(0);
+
+               /* Send packet up if logtrace_pkt_sendup is TRUE */
+               if (dhdp->logtrace_pkt_sendup) {
+#ifdef DHD_USE_STATIC_CTRLBUF
+                       /* If bufs are allocated via static buf pool
+                        * and logtrace_pkt_sendup enabled, make a copy,
+                        * free the local one and send the copy up.
+                        */
+                       void *npkt = PKTDUP(dhdp->osh, skb);
+                       /* Clone event and send it up */
+                       PKTFREE_STATIC(dhdp->osh, skb, FALSE);
+                       if (npkt) {
+                               skb = npkt;
+                       } else {
+                               DHD_ERROR(("skb clone failed. dropping logtrace pkt.\n"));
+                               /* Packet is already freed, go to next packet */
+                               continue;
+                       }
+#endif /* DHD_USE_STATIC_CTRLBUF */
+#ifdef PCIE_FULL_DONGLE
+                       /* For infobuf packets as if is DHD_DUMMY_INFO_IF,
+                        * to send skb to network layer, assign skb->dev with
+                        * Primary interface n/w device
+                        */
+                       if (ifid == DHD_DUMMY_INFO_IF) {
+                               skb = PKTTONATIVE(dhdp->osh, skb);
+                               skb->dev = dhd->iflist[0]->net;
+                       }
+#endif /* PCIE_FULL_DONGLE */
+                       /* Send pkt UP */
+                       dhd_netif_rx_ni(skb);
+               } else  {
+                       /* Don't send up. Free up the packet. */
+#ifdef DHD_USE_STATIC_CTRLBUF
+                       PKTFREE_STATIC(dhdp->osh, skb, FALSE);
+#else
+                       PKTFREE(dhdp->osh, skb, FALSE);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+               }
+       }
+
+       /* Reschedule if more packets to be processed */
+       return (qlen >= DHD_EVENT_LOGTRACE_BOUND);
+}
+
+#ifdef DHD_USE_KTHREAD_FOR_LOGTRACE
+static int
+dhd_logtrace_thread(void *data)
+{
+       tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+       dhd_info_t *dhd = (dhd_info_t *)tsk->parent;
+       dhd_pub_t *dhdp = (dhd_pub_t *)&dhd->pub;
+       int ret;
+
+       while (1) {
+               dhdp->logtrace_thr_ts.entry_time = OSL_LOCALTIME_NS();
+               if (!binary_sema_down(tsk)) {
+                       dhdp->logtrace_thr_ts.sem_down_time = OSL_LOCALTIME_NS();
+                       SMP_RD_BARRIER_DEPENDS();
+                       if (dhd->pub.dongle_reset == FALSE) {
+                               do {
+                                       /* Check terminated before processing the items */
+                                       if (tsk->terminated) {
+                                               DHD_ERROR(("%s: task terminated\n", __FUNCTION__));
+                                               goto exit;
+                                       }
+#ifdef EWP_EDL
+                                       /* check if EDL is being used */
+                                       if (dhd->pub.dongle_edl_support) {
+                                               ret = dhd_prot_process_edl_complete(&dhd->pub,
+                                                               &dhd->event_data);
+                                       } else {
+                                               ret = dhd_event_logtrace_process_items(dhd);
+                                       }
+#else
+                                       ret = dhd_event_logtrace_process_items(dhd);
+#endif /* EWP_EDL */
+                                       /* if ret > 0, bound has reached so to be fair to other
+                                        * processes need to yield the scheduler.
+                                        * The comment above yield()'s definition says:
+                                        * If you want to use yield() to wait for something,
+                                        * use wait_event().
+                                        * If you want to use yield() to be 'nice' for others,
+                                        * use cond_resched().
+                                        * If you still want to use yield(), do not!
+                                        */
+                                       if (ret > 0) {
+                                               cond_resched();
+                                               OSL_SLEEP(DHD_EVENT_LOGTRACE_RESCHEDULE_DELAY_MS);
+                                       } else if (ret < 0) {
+                                               DHD_ERROR(("%s: ERROR should not reach here\n",
+                                                       __FUNCTION__));
+                                       }
+                               } while (ret > 0);
+                       }
+                       if (tsk->flush_ind) {
+                               DHD_ERROR(("%s: flushed\n", __FUNCTION__));
+                               dhdp->logtrace_thr_ts.flush_time = OSL_LOCALTIME_NS();
+                               tsk->flush_ind = 0;
+                               complete(&tsk->flushed);
+                       }
+               } else {
+                       DHD_ERROR(("%s: unexpted break\n", __FUNCTION__));
+                       dhdp->logtrace_thr_ts.unexpected_break_time = OSL_LOCALTIME_NS();
+                       break;
+               }
+       }
+exit:
+       complete_and_exit(&tsk->completed, 0);
+       dhdp->logtrace_thr_ts.complete_time = OSL_LOCALTIME_NS();
+}
+#else
+static void
+dhd_event_logtrace_process(struct work_struct * work)
+{
+/* Ignore compiler warnings due to -Werror=cast-qual */
+       struct delayed_work *dw = to_delayed_work(work);
+       struct dhd_info *dhd;
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       dhd = container_of(dw, struct dhd_info, event_log_dispatcher_work);
+       GCC_DIAGNOSTIC_POP();
+
+#ifdef EWP_EDL
+       if (dhd->pub.dongle_edl_support) {
+               ret = dhd_prot_process_edl_complete(&dhd->pub, &dhd->event_data);
+       } else {
+               ret = dhd_event_logtrace_process_items(dhd);
+       }
+#else
+       ret = dhd_event_logtrace_process_items(dhd);
+#endif /* EWP_EDL */
+
+       if (ret > 0) {
+               schedule_delayed_work(&(dhd)->event_log_dispatcher_work,
+                       msecs_to_jiffies(DHD_EVENT_LOGTRACE_RESCHEDULE_DELAY_MS));
+       }
+       return;
+}
+#endif /* DHD_USE_KTHREAD_FOR_LOGTRACE */
+
+void
+dhd_schedule_logtrace(void *dhd_info)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhd_info;
+
+#ifdef DHD_USE_KTHREAD_FOR_LOGTRACE
+       if (dhd->thr_logtrace_ctl.thr_pid >= 0) {
+               binary_sema_up(&dhd->thr_logtrace_ctl);
+       } else {
+               DHD_ERROR(("%s: thr_logtrace_ctl(%ld) not inited\n", __FUNCTION__,
+                       dhd->thr_logtrace_ctl.thr_pid));
+       }
+#else
+       schedule_delayed_work(&dhd->event_log_dispatcher_work, 0);
+#endif /* DHD_USE_KTHREAD_FOR_LOGTRACE */
+       return;
+}
+
+void
+dhd_cancel_logtrace_process_sync(dhd_info_t *dhd)
+{
+#ifdef DHD_USE_KTHREAD_FOR_LOGTRACE
+       if (dhd->thr_logtrace_ctl.thr_pid >= 0) {
+               PROC_STOP_USING_BINARY_SEMA(&dhd->thr_logtrace_ctl);
+       } else {
+               DHD_ERROR(("%s: thr_logtrace_ctl(%ld) not inited\n", __FUNCTION__,
+                       dhd->thr_logtrace_ctl.thr_pid));
+       }
+#else
+       cancel_delayed_work_sync(&dhd->event_log_dispatcher_work);
+#endif /* DHD_USE_KTHREAD_FOR_LOGTRACE */
+}
+
+void
+dhd_flush_logtrace_process(dhd_info_t *dhd)
+{
+#ifdef DHD_USE_KTHREAD_FOR_LOGTRACE
+       if (dhd->thr_logtrace_ctl.thr_pid >= 0) {
+               PROC_FLUSH_USING_BINARY_SEMA(&dhd->thr_logtrace_ctl);
+       } else {
+               DHD_ERROR(("%s: thr_logtrace_ctl(%ld) not inited\n", __FUNCTION__,
+                       dhd->thr_logtrace_ctl.thr_pid));
+       }
+#else
+       flush_delayed_work(&dhd->event_log_dispatcher_work);
+#endif /* DHD_USE_KTHREAD_FOR_LOGTRACE */
+}
+
+int
+dhd_init_logtrace_process(dhd_info_t *dhd)
+{
+#ifdef DHD_USE_KTHREAD_FOR_LOGTRACE
+       dhd->thr_logtrace_ctl.thr_pid = DHD_PID_KT_INVALID;
+       PROC_START(dhd_logtrace_thread, dhd, &dhd->thr_logtrace_ctl, 0, "dhd_logtrace_thread");
+       if (dhd->thr_logtrace_ctl.thr_pid < 0) {
+               DHD_ERROR(("%s: init logtrace process failed\n", __FUNCTION__));
+               return BCME_ERROR;
+       } else {
+               DHD_ERROR(("%s: thr_logtrace_ctl(%ld) not inited\n", __FUNCTION__,
+                       dhd->thr_logtrace_ctl.thr_pid));
+       }
+#else
+       INIT_DELAYED_WORK(&dhd->event_log_dispatcher_work, dhd_event_logtrace_process);
+#endif /* DHD_USE_KTHREAD_FOR_LOGTRACE */
+       return BCME_OK;
+}
+
+int
+dhd_reinit_logtrace_process(dhd_info_t *dhd)
+{
+#ifdef DHD_USE_KTHREAD_FOR_LOGTRACE
+       /* Re-init only if PROC_STOP from dhd_stop was called
+        * which can be checked via thr_pid
+        */
+       if (dhd->thr_logtrace_ctl.thr_pid < 0) {
+               PROC_START(dhd_logtrace_thread, dhd, &dhd->thr_logtrace_ctl,
+                       0, "dhd_logtrace_thread");
+               if (dhd->thr_logtrace_ctl.thr_pid < 0) {
+                       DHD_ERROR(("%s: reinit logtrace process failed\n", __FUNCTION__));
+                       return BCME_ERROR;
+               } else {
+               DHD_ERROR(("%s: thr_logtrace_ctl(%ld) not inited\n", __FUNCTION__,
+                       dhd->thr_logtrace_ctl.thr_pid));
+       }
+       }
+#else
+       /* No need to re-init for WQ as calcel_delayed_work_sync will
+        * will not delete the WQ
+        */
+#endif /* DHD_USE_KTHREAD_FOR_LOGTRACE */
+       return BCME_OK;
+}
+
+void
+dhd_event_logtrace_enqueue(dhd_pub_t *dhdp, int ifidx, void *pktbuf)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+
+#ifdef PCIE_FULL_DONGLE
+       /* Add ifidx in the PKTTAG */
+       DHD_PKTTAG_SET_IFID((dhd_pkttag_fr_t *)PKTTAG(pktbuf), ifidx);
+#endif /* PCIE_FULL_DONGLE */
+       skb_queue_tail(&dhd->evt_trace_queue, pktbuf);
+
+       dhd_schedule_logtrace(dhd);
+}
+
+void
+dhd_event_logtrace_flush_queue(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+       struct sk_buff *skb;
+
+       while ((skb = skb_dequeue(&dhd->evt_trace_queue)) != NULL) {
+#ifdef DHD_USE_STATIC_CTRLBUF
+               PKTFREE_STATIC(dhdp->osh, skb, FALSE);
+#else
+               PKTFREE(dhdp->osh, skb, FALSE);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+       }
+}
+
+#ifdef EWP_EDL
+void
+dhd_sendup_info_buf(dhd_pub_t *dhdp, uint8 *msg)
+{
+       struct sk_buff *skb = NULL;
+       uint32 pktsize = 0;
+       void *pkt = NULL;
+       info_buf_payload_hdr_t *infobuf = NULL;
+       dhd_info_t *dhd = dhdp->info;
+       uint8 *pktdata = NULL;
+
+       if (!msg)
+               return;
+
+       /* msg = |infobuf_ver(u32)|info_buf_payload_hdr_t|msgtrace_hdr_t|<var len data>| */
+       infobuf = (info_buf_payload_hdr_t *)(msg + sizeof(uint32));
+       pktsize = (uint32)(ltoh16(infobuf->length) + sizeof(info_buf_payload_hdr_t) +
+                       sizeof(uint32));
+       pkt = PKTGET(dhdp->osh, pktsize, FALSE);
+       if (!pkt) {
+               DHD_ERROR(("%s: skb alloc failed ! not sending event log up.\n", __FUNCTION__));
+       } else {
+               PKTSETLEN(dhdp->osh, pkt, pktsize);
+               pktdata = PKTDATA(dhdp->osh, pkt);
+               memcpy(pktdata, msg, pktsize);
+               /* For infobuf packets assign skb->dev with
+                * Primary interface n/w device
+                */
+               skb = PKTTONATIVE(dhdp->osh, pkt);
+               skb->dev = dhd->iflist[0]->net;
+               /* Send pkt UP */
+               dhd_netif_rx_ni(skb);
+       }
+}
+#endif /* EWP_EDL */
+#endif /* SHOW_LOGTRACE */
+
+#ifdef EWP_EDL
+static void
+dhd_edl_process_work(struct work_struct *work)
+{
+       struct delayed_work *dw = to_delayed_work(work);
+       struct dhd_info *dhd_info;
+       /* Ignore compiler warnings due to -Werror=cast-qual */
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       dhd_info = container_of(dw, struct dhd_info, edl_dispatcher_work);
+       GCC_DIAGNOSTIC_POP();
+
+       if (dhd_info)
+               dhd_prot_process_edl_complete(&dhd_info->pub, &dhd_info->event_data);
+}
+
+void
+dhd_schedule_edl_work(dhd_pub_t *dhdp, uint delay_ms)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+       schedule_delayed_work(&dhd->edl_dispatcher_work, msecs_to_jiffies(delay_ms));
+}
+#endif /* EWP_EDL */
+
+#ifdef ENABLE_WAKEUP_PKT_DUMP
+static void
+update_wake_pkt_info(struct sk_buff *skb)
+{
+       struct iphdr *ip_header;
+       struct ipv6hdr *ipv6_header;
+       struct udphdr *udp_header;
+       struct tcphdr *tcp_header;
+       uint16 dport = 0;
+
+       ip_header = (struct iphdr *)(skb->data);
+
+       temp_raw |= ((long long)ntoh16(skb->protocol)) << 48;
+
+       DHD_INFO(("eth_hdr(skb)->h_dest : %pM\n", eth_hdr(skb)->h_dest));
+       if (eth_hdr(skb)->h_dest[0] & 0x01) {
+               temp_raw |= (long long)1 << 39;
+       }
+
+       if (ntoh16(skb->protocol) == ETHER_TYPE_BRCM) {
+               wl_event_msg_t event;
+               bcm_event_msg_u_t evu;
+               int ret;
+               uint event_type;
+
+               ret = wl_host_event_get_data(
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+                       skb_mac_header(skb),
+#else
+                       skb->mac.raw,
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22) */
+                       skb->len, &evu);
+               if (ret != BCME_OK) {
+                       DHD_ERROR(("%s: wl_host_event_get_data err = %d\n",
+                               __FUNCTION__, ret));
+               }
+
+               memcpy(&event, &evu.event, sizeof(wl_event_msg_t));
+               event_type = ntoh32_ua((void *)&event.event_type);
+
+               temp_raw |= (long long)event_type << 40;
+       } else if (ntoh16(skb->protocol) == ETHER_TYPE_IP ||
+                       ntoh16(skb->protocol) == ETHER_TYPE_IPV6) {
+               if (ip_header->version == 6) {
+                       ipv6_header = (struct ipv6hdr *)ip_header;
+                       temp_raw |= ((long long)ipv6_header->nexthdr) << 40;
+                       dport = 0;
+
+                       if (ipv6_header->daddr.s6_addr[0] & 0xff) {
+                               temp_raw |= (long long)1 << 38;
+                       }
+
+                       DHD_INFO(("IPv6 [%x]%pI6c > %pI6c:%d\n",
+                               ip_header->protocol, &(ipv6_header->saddr.s6_addr),
+                               &(ipv6_header->daddr.s6_addr), dport));
+               } else if (ip_header->version == 4) {
+                       temp_raw |= ((long long)ip_header->protocol) << 40;
+
+#define IP_HDR_OFFSET  ((char *)ip_header + IPV4_HLEN(ip_header))
+                       if (ip_header->protocol == IPPROTO_TCP) {
+                               tcp_header = (struct tcphdr *)IP_HDR_OFFSET;
+                               dport = ntohs(tcp_header->dest);
+                       }
+                       else if (ip_header->protocol == IPPROTO_UDP) {
+                               udp_header = (struct udphdr *)IP_HDR_OFFSET;
+                               dport = ntohs(udp_header->dest);
+                       }
+
+                       if (ipv4_is_multicast(ip_header->daddr)) {
+                               temp_raw |= (long long)1 << 38;
+                       }
+
+                       DHD_INFO(("IP [%x] %pI4 > %pI4:%d\n",
+                               ip_header->protocol, &(ip_header->saddr),
+                               &(ip_header->daddr), dport));
+               }
+
+               temp_raw |= (long long)dport << 16;
+       }
+}
+#endif /* ENABLE_WAKEUP_PKT_DUMP */
+
+/** Called when a frame is received by the dongle on interface 'ifidx' */
+void
+dhd_rx_frame(dhd_pub_t *dhdp, int ifidx, void *pktbuf, int numpkt, uint8 chan)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+       struct sk_buff *skb;
+       uchar *eth;
+       uint len;
+       void *data, *pnext = NULL;
+       int i;
+       dhd_if_t *ifp;
+       wl_event_msg_t event;
+       int tout_rx = 0;
+       int tout_ctrl = 0;
+       void *skbhead = NULL;
+       void *skbprev = NULL;
+       uint16 protocol;
+       unsigned char *dump_data;
+#ifdef DHD_MCAST_REGEN
+       uint8 interface_role;
+       if_flow_lkup_t *if_flow_lkup;
+       unsigned long flags;
+#endif
+#ifdef DHD_WAKE_STATUS
+       int pkt_wake = 0;
+       wake_counts_t *wcp = NULL;
+#endif /* DHD_WAKE_STATUS */
+#ifdef ENABLE_DHD_GRO
+       bool dhd_gro_enable = TRUE;
+#endif /* ENABLE_DHD_GRO */
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+       BCM_REFERENCE(dump_data);
+
+#ifdef ENABLE_DHD_GRO
+       if (ifidx < DHD_MAX_IFS) {
+               ifp = dhd->iflist[ifidx];
+               if (ifp && ifp->net->qdisc) {
+                       if (!ifp->net->qdisc->ops->cl_ops) {
+                               dhd_gro_enable = TRUE;
+                               DHD_TRACE(("%s: enable sw gro\n", __FUNCTION__));
+                       } else {
+                               dhd_gro_enable = FALSE;
+                               DHD_TRACE(("%s: disable sw gro becasue of qdisc traffic control\n",
+                                               __FUNCTION__));
+                       }
+               }
+       }
+#endif /* ENABLE_DHD_GRO */
+
+       for (i = 0; pktbuf && i < numpkt; i++, pktbuf = pnext) {
+               struct ether_header *eh;
+
+               pnext = PKTNEXT(dhdp->osh, pktbuf);
+               PKTSETNEXT(dhdp->osh, pktbuf, NULL);
+
+               /* info ring "debug" data, which is not a 802.3 frame, is sent/hacked with a
+                * special ifidx of DHD_DUMMY_INFO_IF.  This is just internal to dhd to get the data
+                * from dhd_msgbuf.c:dhd_prot_infobuf_cmplt_process() to here (dhd_rx_frame).
+                */
+               if (ifidx == DHD_DUMMY_INFO_IF) {
+                       /* Event msg printing is called from dhd_rx_frame which is in Tasklet
+                        * context in case of PCIe FD, in case of other bus this will be from
+                        * DPC context. If we get bunch of events from Dongle then printing all
+                        * of them from Tasklet/DPC context that too in data path is costly.
+                        * Also in the new Dongle SW(4359, 4355 onwards) console prints too come as
+                        * events with type WLC_E_TRACE.
+                        * We'll print this console logs from the WorkQueue context by enqueing SKB
+                        * here and Dequeuing will be done in WorkQueue and will be freed only if
+                        * logtrace_pkt_sendup is TRUE
+                        */
+#ifdef SHOW_LOGTRACE
+                       dhd_event_logtrace_enqueue(dhdp, ifidx, pktbuf);
+#else /* !SHOW_LOGTRACE */
+               /* If SHOW_LOGTRACE not defined and ifidx is DHD_DUMMY_INFO_IF,
+                * free the PKT here itself
+                */
+#ifdef DHD_USE_STATIC_CTRLBUF
+               PKTFREE_STATIC(dhdp->osh, pktbuf, FALSE);
+#else
+               PKTFREE(dhdp->osh, pktbuf, FALSE);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+#endif /* SHOW_LOGTRACE */
+                       continue;
+               }
+#ifdef DHD_WAKE_STATUS
+#ifdef BCMDBUS
+               wcp = NULL;
+#else
+               pkt_wake = dhd_bus_get_bus_wake(dhdp);
+               wcp = dhd_bus_get_wakecount(dhdp);
+#endif /* BCMDBUS */
+               if (wcp == NULL) {
+                       /* If wakeinfo count buffer is null do not  update wake count values */
+                       pkt_wake = 0;
+               }
+#endif /* DHD_WAKE_STATUS */
+
+               eh = (struct ether_header *)PKTDATA(dhdp->osh, pktbuf);
+               if (dhd->pub.tput_data.tput_test_running &&
+                       dhd->pub.tput_data.direction == TPUT_DIR_RX &&
+                       ntoh16(eh->ether_type) == ETHER_TYPE_IP) {
+                       dhd_tput_test_rx(dhdp, pktbuf);
+                       PKTFREE(dhd->pub.osh, pktbuf, FALSE);
+                       continue;
+               }
+
+               if (ifidx >= DHD_MAX_IFS) {
+                       DHD_ERROR(("%s: ifidx(%d) Out of bound. drop packet\n",
+                               __FUNCTION__, ifidx));
+                       if (ntoh16(eh->ether_type) == ETHER_TYPE_BRCM) {
+#ifdef DHD_USE_STATIC_CTRLBUF
+                               PKTFREE_STATIC(dhdp->osh, pktbuf, FALSE);
+#else
+                               PKTFREE(dhdp->osh, pktbuf, FALSE);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+                       } else {
+                               PKTCFREE(dhdp->osh, pktbuf, FALSE);
+                       }
+                       continue;
+               }
+
+               ifp = dhd->iflist[ifidx];
+               if (ifp == NULL) {
+                       DHD_ERROR_RLMT(("%s: ifp is NULL. drop packet\n",
+                               __FUNCTION__));
+                       if (ntoh16(eh->ether_type) == ETHER_TYPE_BRCM) {
+#ifdef DHD_USE_STATIC_CTRLBUF
+                               PKTFREE_STATIC(dhdp->osh, pktbuf, FALSE);
+#else
+                               PKTFREE(dhdp->osh, pktbuf, FALSE);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+                       } else {
+                               PKTCFREE(dhdp->osh, pktbuf, FALSE);
+                       }
+                       continue;
+               }
+
+               /* Dropping only data packets before registering net device to avoid kernel panic */
+#ifndef PROP_TXSTATUS_VSDB
+               if ((!ifp->net || ifp->net->reg_state != NETREG_REGISTERED) &&
+                       (ntoh16(eh->ether_type) != ETHER_TYPE_BRCM))
+#else
+               if ((!ifp->net || ifp->net->reg_state != NETREG_REGISTERED || !dhd->pub.up) &&
+                       (ntoh16(eh->ether_type) != ETHER_TYPE_BRCM))
+#endif /* PROP_TXSTATUS_VSDB */
+               {
+                       DHD_ERROR(("%s: net device is NOT registered yet. drop packet\n",
+                       __FUNCTION__));
+                       PKTCFREE(dhdp->osh, pktbuf, FALSE);
+                       continue;
+               }
+
+#ifdef PROP_TXSTATUS
+               if (dhd_wlfc_is_header_only_pkt(dhdp, pktbuf)) {
+                       /* WLFC may send header only packet when
+                       there is an urgent message but no packet to
+                       piggy-back on
+                       */
+                       PKTCFREE(dhdp->osh, pktbuf, FALSE);
+                       continue;
+               }
+#endif
+#ifdef DHD_L2_FILTER
+               /* If block_ping is enabled drop the ping packet */
+               if (ifp->block_ping) {
+                       if (bcm_l2_filter_block_ping(dhdp->osh, pktbuf) == BCME_OK) {
+                               PKTCFREE(dhdp->osh, pktbuf, FALSE);
+                               continue;
+                       }
+               }
+               if (ifp->grat_arp && DHD_IF_ROLE_STA(dhdp, ifidx)) {
+                   if (bcm_l2_filter_gratuitous_arp(dhdp->osh, pktbuf) == BCME_OK) {
+                               PKTCFREE(dhdp->osh, pktbuf, FALSE);
+                               continue;
+                   }
+               }
+               if (ifp->parp_enable && DHD_IF_ROLE_AP(dhdp, ifidx)) {
+                       int ret = dhd_l2_filter_pkt_handle(dhdp, ifidx, pktbuf, FALSE);
+
+                       /* Drop the packets if l2 filter has processed it already
+                        * otherwise continue with the normal path
+                        */
+                       if (ret == BCME_OK) {
+                               PKTCFREE(dhdp->osh, pktbuf, TRUE);
+                               continue;
+                       }
+               }
+               if (ifp->block_tdls) {
+                       if (bcm_l2_filter_block_tdls(dhdp->osh, pktbuf) == BCME_OK) {
+                               PKTCFREE(dhdp->osh, pktbuf, FALSE);
+                               continue;
+                       }
+               }
+#endif /* DHD_L2_FILTER */
+
+#ifdef DHD_MCAST_REGEN
+               DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+               if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+               ASSERT(if_flow_lkup);
+
+               interface_role = if_flow_lkup[ifidx].role;
+               DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+
+               if (ifp->mcast_regen_bss_enable && (interface_role != WLC_E_IF_ROLE_WDS) &&
+                               !DHD_IF_ROLE_AP(dhdp, ifidx) &&
+                               ETHER_ISUCAST(eh->ether_dhost)) {
+                       if (dhd_mcast_reverse_translation(eh) ==  BCME_OK) {
+#ifdef DHD_PSTA
+                               /* Change bsscfg to primary bsscfg for unicast-multicast packets */
+                               if ((dhd_get_psta_mode(dhdp) == DHD_MODE_PSTA) ||
+                                               (dhd_get_psta_mode(dhdp) == DHD_MODE_PSR)) {
+                                       if (ifidx != 0) {
+                                               /* Let the primary in PSTA interface handle this
+                                                * frame after unicast to Multicast conversion
+                                                */
+                                               ifp = dhd_get_ifp(dhdp, 0);
+                                               ASSERT(ifp);
+                                       }
+                               }
+                       }
+#endif /* PSTA */
+               }
+#endif /* MCAST_REGEN */
+
+#ifdef DHDTCPSYNC_FLOOD_BLK
+               if (dhd_tcpdata_get_flag(dhdp, pktbuf) == FLAG_SYNC) {
+                       int delta_sec;
+                       int delta_sync;
+                       int sync_per_sec;
+                       u64 curr_time = DIV_U64_BY_U32(OSL_LOCALTIME_NS(), NSEC_PER_SEC);
+                       ifp->tsync_rcvd ++;
+                       delta_sync = ifp->tsync_rcvd - ifp->tsyncack_txed;
+                       delta_sec = curr_time - ifp->last_sync;
+                       if (delta_sec > 1) {
+                               sync_per_sec = delta_sync/delta_sec;
+                               if (sync_per_sec > TCP_SYNC_FLOOD_LIMIT) {
+                                       schedule_work(&ifp->blk_tsfl_work);
+                                       DHD_ERROR(("ifx %d TCP SYNC Flood attack suspected! "
+                                               "sync recvied %d pkt/sec \n",
+                                               ifidx, sync_per_sec));
+                                       ifp->tsync_per_sec = sync_per_sec;
+                               }
+                               dhd_reset_tcpsync_info_by_ifp(ifp);
+                       }
+
+               }
+#endif /* DHDTCPSYNC_FLOOD_BLK */
+
+#ifdef DHDTCPACK_SUPPRESS
+               dhd_tcpdata_info_get(dhdp, pktbuf);
+#endif
+               skb = PKTTONATIVE(dhdp->osh, pktbuf);
+
+               ASSERT(ifp);
+               skb->dev = ifp->net;
+#ifdef DHD_WET
+               /* wet related packet proto manipulation should be done in DHD
+                * since dongle doesn't have complete payload
+                */
+               if (WET_ENABLED(&dhd->pub) && (dhd_wet_recv_proc(dhd->pub.wet_info,
+                               pktbuf) < 0)) {
+                       DHD_INFO(("%s:%s: wet recv proc failed\n",
+                               __FUNCTION__, dhd_ifname(dhdp, ifidx)));
+               }
+#endif /* DHD_WET */
+
+#ifdef DHD_PSTA
+               if (PSR_ENABLED(dhdp) &&
+                               (dhd_psta_proc(dhdp, ifidx, &pktbuf, FALSE) < 0)) {
+                       DHD_ERROR(("%s:%s: psta recv proc failed\n", __FUNCTION__,
+                               dhd_ifname(dhdp, ifidx)));
+               }
+#endif /* DHD_PSTA */
+
+#ifdef PCIE_FULL_DONGLE
+               if ((DHD_IF_ROLE_AP(dhdp, ifidx) || DHD_IF_ROLE_P2PGO(dhdp, ifidx)) &&
+                       (!ifp->ap_isolate)) {
+                       eh = (struct ether_header *)PKTDATA(dhdp->osh, pktbuf);
+                       if (ETHER_ISUCAST(eh->ether_dhost)) {
+                               if (dhd_find_sta(dhdp, ifidx, (void *)eh->ether_dhost)) {
+                                       dhd_sendpkt(dhdp, ifidx, pktbuf);
+                                       continue;
+                               }
+                       } else {
+                               void *npktbuf = NULL;
+                               if ((ntoh16(eh->ether_type) != ETHER_TYPE_IAPP_L2_UPDATE) &&
+                                       (npktbuf = PKTDUP(dhdp->osh, pktbuf)) != NULL) {
+                                       dhd_sendpkt(dhdp, ifidx, npktbuf);
+                               }
+                       }
+               }
+#endif /* PCIE_FULL_DONGLE */
+#ifdef DHD_POST_EAPOL_M1_AFTER_ROAM_EVT
+               if (IS_STA_IFACE(ndev_to_wdev(ifp->net)) &&
+                       (ifp->recv_reassoc_evt == TRUE) && (ifp->post_roam_evt == FALSE) &&
+                       (dhd_is_4way_msg((char *)(skb->data)) == EAPOL_4WAY_M1)) {
+                               DHD_ERROR(("%s: Reassoc is in progress. "
+                                       "Drop EAPOL M1 frame\n", __FUNCTION__));
+                               PKTFREE(dhdp->osh, pktbuf, FALSE);
+                               continue;
+               }
+#endif /* DHD_POST_EAPOL_M1_AFTER_ROAM_EVT */
+               /* Get the protocol, maintain skb around eth_type_trans()
+                * The main reason for this hack is for the limitation of
+                * Linux 2.4 where 'eth_type_trans' uses the 'net->hard_header_len'
+                * to perform skb_pull inside vs ETH_HLEN. Since to avoid
+                * coping of the packet coming from the network stack to add
+                * BDC, Hardware header etc, during network interface registration
+                * we set the 'net->hard_header_len' to ETH_HLEN + extra space required
+                * for BDC, Hardware header etc. and not just the ETH_HLEN
+                */
+               eth = skb->data;
+               len = skb->len;
+               dump_data = skb->data;
+               protocol = (skb->data[12] << 8) | skb->data[13];
+
+               if (protocol == ETHER_TYPE_802_1X) {
+                       DBG_EVENT_LOG(dhdp, WIFI_EVENT_DRIVER_EAPOL_FRAME_RECEIVED);
+#if defined(WL_CFG80211) && defined(WL_WPS_SYNC)
+                       wl_handle_wps_states(ifp->net, dump_data, len, FALSE);
+#endif /* WL_CFG80211 && WL_WPS_SYNC */
+#ifdef DHD_4WAYM4_FAIL_DISCONNECT
+                       if (dhd_is_4way_msg((uint8 *)(skb->data)) == EAPOL_4WAY_M3) {
+                               OSL_ATOMIC_SET(dhdp->osh, &ifp->m4state, M3_RXED);
+                       }
+#endif /* DHD_4WAYM4_FAIL_DISCONNECT */
+               }
+               dhd_dump_pkt(dhdp, ifidx, dump_data, len, FALSE, NULL, NULL);
+
+#if defined(DHD_WAKE_STATUS) && defined(DHD_WAKEPKT_DUMP)
+               if (pkt_wake) {
+                       prhex("[wakepkt_dump]", (char*)dump_data, MIN(len, 32));
+                       DHD_ERROR(("config check in_suspend: %d ", dhdp->in_suspend));
+#ifdef ARP_OFFLOAD_SUPPORT
+                       DHD_ERROR(("arp hmac_update:%d \n", dhdp->hmac_updated));
+#endif /* ARP_OFFLOAD_SUPPORT */
+               }
+#endif /* DHD_WAKE_STATUS && DHD_WAKEPKT_DUMP */
+
+               skb->protocol = eth_type_trans(skb, skb->dev);
+
+               if (skb->pkt_type == PACKET_MULTICAST) {
+                       dhd->pub.rx_multicast++;
+                       ifp->stats.multicast++;
+               }
+
+               skb->data = eth;
+               skb->len = len;
+
+               /* TODO: XXX: re-look into dropped packets. */
+               DHD_DBG_PKT_MON_RX(dhdp, skb);
+#ifdef DHD_PKT_LOGGING
+               DHD_PKTLOG_RX(dhdp, skb);
+#endif /* DHD_PKT_LOGGING */
+               /* Strip header, count, deliver upward */
+               skb_pull(skb, ETH_HLEN);
+
+#ifdef ENABLE_WAKEUP_PKT_DUMP
+               if (dhd_mmc_wake) {
+                       DHD_INFO(("wake_pkt %s(%d)\n", __FUNCTION__, __LINE__));
+                       if (DHD_INFO_ON()) {
+                               prhex("wake_pkt", (char*) eth, MIN(len, 48));
+                       }
+                       update_wake_pkt_info(skb);
+#ifdef CONFIG_IRQ_HISTORY
+                       add_irq_history(0, "WIFI");
+#endif
+                       dhd_mmc_wake = FALSE;
+               }
+#endif /* ENABLE_WAKEUP_PKT_DUMP */
+
+               /* Process special event packets and then discard them */
+               /* XXX Decide on a better way to fit this in */
+               memset(&event, 0, sizeof(event));
+
+               if (ntoh16(skb->protocol) == ETHER_TYPE_BRCM) {
+                       bcm_event_msg_u_t evu;
+                       int ret_event, event_type;
+                       void *pkt_data = skb_mac_header(skb);
+
+                       ret_event = wl_host_event_get_data(pkt_data, len, &evu);
+
+                       if (ret_event != BCME_OK) {
+                               DHD_ERROR(("%s: wl_host_event_get_data err = %d\n",
+                                       __FUNCTION__, ret_event));
+#ifdef DHD_USE_STATIC_CTRLBUF
+                               PKTFREE_STATIC(dhdp->osh, pktbuf, FALSE);
+#else
+                               PKTFREE(dhdp->osh, pktbuf, FALSE);
+#endif
+                               continue;
+                       }
+
+                       memcpy(&event, &evu.event, sizeof(wl_event_msg_t));
+                       event_type = ntoh32_ua((void *)&event.event_type);
+#ifdef SHOW_LOGTRACE
+                       /* Event msg printing is called from dhd_rx_frame which is in Tasklet
+                        * context in case of PCIe FD, in case of other bus this will be from
+                        * DPC context. If we get bunch of events from Dongle then printing all
+                        * of them from Tasklet/DPC context that too in data path is costly.
+                        * Also in the new Dongle SW(4359, 4355 onwards) console prints too come as
+                        * events with type WLC_E_TRACE.
+                        * We'll print this console logs from the WorkQueue context by enqueing SKB
+                        * here and Dequeuing will be done in WorkQueue and will be freed only if
+                        * logtrace_pkt_sendup is true
+                        */
+                       if (event_type == WLC_E_TRACE) {
+                               DHD_EVENT(("%s: WLC_E_TRACE\n", __FUNCTION__));
+                               dhd_event_logtrace_enqueue(dhdp, ifidx, pktbuf);
+                               continue;
+                       }
+#endif /* SHOW_LOGTRACE */
+
+                       ret_event = dhd_wl_host_event(dhd, ifidx, pkt_data, len, &event, &data);
+
+                       wl_event_to_host_order(&event);
+                       if (!tout_ctrl)
+                               tout_ctrl = DHD_PACKET_TIMEOUT_MS;
+
+#if defined(PNO_SUPPORT)
+                       if (event_type == WLC_E_PFN_NET_FOUND) {
+                               /* enforce custom wake lock to garantee that Kernel not suspended */
+                               tout_ctrl = CUSTOM_PNO_EVENT_LOCK_xTIME * DHD_PACKET_TIMEOUT_MS;
+                       }
+#endif /* PNO_SUPPORT */
+                       if (numpkt != 1) {
+                               DHD_TRACE(("%s: Got BRCM event packet in a chained packet.\n",
+                               __FUNCTION__));
+                       }
+
+#ifdef DHD_WAKE_STATUS
+                       if (unlikely(pkt_wake)) {
+#ifdef DHD_WAKE_EVENT_STATUS
+                               if (event.event_type < WLC_E_LAST) {
+                                       wcp->rc_event[event.event_type]++;
+                                       wcp->rcwake++;
+                                       pkt_wake = 0;
+                               }
+#endif /* DHD_WAKE_EVENT_STATUS */
+                       }
+#endif /* DHD_WAKE_STATUS */
+
+                       /* For delete virtual interface event, wl_host_event returns positive
+                        * i/f index, do not proceed. just free the pkt.
+                        */
+                       if ((event_type == WLC_E_IF) && (ret_event > 0)) {
+                               DHD_ERROR(("%s: interface is deleted. Free event packet\n",
+                               __FUNCTION__));
+#ifdef DHD_USE_STATIC_CTRLBUF
+                               PKTFREE_STATIC(dhdp->osh, pktbuf, FALSE);
+#else
+                               PKTFREE(dhdp->osh, pktbuf, FALSE);
+#endif
+                               continue;
+                       }
+
+                       /*
+                        * For the event packets, there is a possibility
+                        * of ifidx getting modifed.Thus update the ifp
+                        * once again.
+                        */
+                       ASSERT(ifidx < DHD_MAX_IFS && dhd->iflist[ifidx]);
+                       ifp = dhd->iflist[ifidx];
+#ifndef PROP_TXSTATUS_VSDB
+                       if (!(ifp && ifp->net && (ifp->net->reg_state == NETREG_REGISTERED)))
+#else
+                       if (!(ifp && ifp->net && (ifp->net->reg_state == NETREG_REGISTERED) &&
+                               dhd->pub.up))
+#endif /* PROP_TXSTATUS_VSDB */
+                       {
+                               DHD_ERROR(("%s: net device is NOT registered. drop event packet\n",
+                               __FUNCTION__));
+#ifdef DHD_USE_STATIC_CTRLBUF
+                               PKTFREE_STATIC(dhdp->osh, pktbuf, FALSE);
+#else
+                               PKTFREE(dhdp->osh, pktbuf, FALSE);
+#endif
+                               continue;
+                       }
+
+#ifdef SENDPROB
+                       if (dhdp->wl_event_enabled ||
+                               (dhdp->recv_probereq && (event.event_type == WLC_E_PROBREQ_MSG)))
+#else
+                       if (dhdp->wl_event_enabled)
+#endif
+                       {
+#ifdef DHD_USE_STATIC_CTRLBUF
+                               /* If event bufs are allocated via static buf pool
+                                * and wl events are enabled, make a copy, free the
+                                * local one and send the copy up.
+                                */
+                               struct sk_buff *nskb = skb_copy(skb, GFP_ATOMIC);
+                               /* Copy event and send it up */
+                               PKTFREE_STATIC(dhdp->osh, pktbuf, FALSE);
+                               if (nskb) {
+                                       skb = nskb;
+                               } else {
+                                       DHD_ERROR(("skb clone failed. dropping event.\n"));
+                                       continue;
+                               }
+#endif /* DHD_USE_STATIC_CTRLBUF */
+                       } else {
+                               /* If event enabled not explictly set, drop events */
+#ifdef DHD_USE_STATIC_CTRLBUF
+                               PKTFREE_STATIC(dhdp->osh, pktbuf, FALSE);
+#else
+                               PKTFREE(dhdp->osh, pktbuf, FALSE);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+                               continue;
+                       }
+               } else {
+                       tout_rx = DHD_PACKET_TIMEOUT_MS;
+
+#ifdef PROP_TXSTATUS
+                       dhd_wlfc_save_rxpath_ac_time(dhdp, (uint8)PKTPRIO(skb));
+#endif /* PROP_TXSTATUS */
+
+#ifdef DHD_WAKE_STATUS
+                       if (unlikely(pkt_wake)) {
+                               wcp->rxwake++;
+#ifdef DHD_WAKE_RX_STATUS
+#define ETHER_ICMP6_HEADER     20
+#define ETHER_IPV6_SADDR (ETHER_ICMP6_HEADER + 2)
+#define ETHER_IPV6_DAADR (ETHER_IPV6_SADDR + IPV6_ADDR_LEN)
+#define ETHER_ICMPV6_TYPE (ETHER_IPV6_DAADR + IPV6_ADDR_LEN)
+
+                               if (ntoh16(skb->protocol) == ETHER_TYPE_ARP) /* ARP */
+                                       wcp->rx_arp++;
+                               if (dump_data[0] == 0xFF) { /* Broadcast */
+                                       wcp->rx_bcast++;
+                               } else if (dump_data[0] & 0x01) { /* Multicast */
+                                       wcp->rx_mcast++;
+                                       if (ntoh16(skb->protocol) == ETHER_TYPE_IPV6) {
+                                           wcp->rx_multi_ipv6++;
+                                           if ((skb->len > ETHER_ICMP6_HEADER) &&
+                                               (dump_data[ETHER_ICMP6_HEADER] == IPPROTO_ICMPV6)) {
+                                               wcp->rx_icmpv6++;
+                                               if (skb->len > ETHER_ICMPV6_TYPE) {
+                                                   switch (dump_data[ETHER_ICMPV6_TYPE]) {
+                                                   case NDISC_ROUTER_ADVERTISEMENT:
+                                                       wcp->rx_icmpv6_ra++;
+                                                       break;
+                                                   case NDISC_NEIGHBOUR_ADVERTISEMENT:
+                                                       wcp->rx_icmpv6_na++;
+                                                       break;
+                                                   case NDISC_NEIGHBOUR_SOLICITATION:
+                                                       wcp->rx_icmpv6_ns++;
+                                                       break;
+                                                   }
+                                               }
+                                           }
+                                       } else if (dump_data[2] == 0x5E) {
+                                               wcp->rx_multi_ipv4++;
+                                       } else {
+                                               wcp->rx_multi_other++;
+                                       }
+                               } else { /* Unicast */
+                                       wcp->rx_ucast++;
+                               }
+#undef ETHER_ICMP6_HEADER
+#undef ETHER_IPV6_SADDR
+#undef ETHER_IPV6_DAADR
+#undef ETHER_ICMPV6_TYPE
+#endif /* DHD_WAKE_RX_STATUS */
+                               pkt_wake = 0;
+                       }
+#endif /* DHD_WAKE_STATUS */
+               }
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 11, 0)
+               ifp->net->last_rx = jiffies;
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(4, 11, 0) */
+
+               if (ntoh16(skb->protocol) != ETHER_TYPE_BRCM) {
+                       dhdp->dstats.rx_bytes += skb->len;
+                       dhdp->rx_packets++; /* Local count */
+                       ifp->stats.rx_bytes += skb->len;
+                       ifp->stats.rx_packets++;
+               }
+
+               /* XXX WL here makes sure data is 4-byte aligned? */
+               if (in_interrupt()) {
+                       bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE,
+                               __FUNCTION__, __LINE__);
+#if defined(DHD_LB_RXP)
+#ifdef ENABLE_DHD_GRO
+                       /* The pktlog module clones a skb using skb_clone and
+                        * stores the skb point to the ring buffer of the pktlog module.
+                        * Once the buffer is full,
+                        * the PKTFREE is called for removing the oldest skb.
+                        * The kernel panic occurred when the pktlog module free
+                        * the rx frame handled by napi_gro_receive().
+                        * It is a fix code that DHD don't use napi_gro_receive() for
+                        * the packet used in pktlog module.
+                        */
+                       if (dhd_gro_enable && !skb_cloned(skb) &&
+                               ntoh16(skb->protocol) != ETHER_TYPE_BRCM) {
+                               napi_gro_receive(&dhd->rx_napi_struct, skb);
+                       } else {
+                               netif_receive_skb(skb);
+                       }
+#else
+#if defined(WL_MONITOR) && defined(BCMSDIO)
+                       if (dhd_monitor_enabled(dhdp, ifidx)) 
+                               dhd_rx_mon_pkt_sdio(dhdp, skb, ifidx);
+                       else
+#endif /* WL_MONITOR && BCMSDIO */
+                       netif_receive_skb(skb);
+#endif /* ENABLE_DHD_GRO */
+#else /* !defined(DHD_LB_RXP) */
+                       netif_rx(skb);
+#endif /* !defined(DHD_LB_RXP) */
+               } else {
+                       if (dhd->rxthread_enabled) {
+                               if (!skbhead)
+                                       skbhead = skb;
+                               else
+                                       PKTSETNEXT(dhdp->osh, skbprev, skb);
+                               skbprev = skb;
+                       } else {
+
+                               /* If the receive is not processed inside an ISR,
+                                * the softirqd must be woken explicitly to service
+                                * the NET_RX_SOFTIRQ.  In 2.6 kernels, this is handled
+                                * by netif_rx_ni(), but in earlier kernels, we need
+                                * to do it manually.
+                                */
+                               bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE,
+                                       __FUNCTION__, __LINE__);
+
+#if defined(BCMPCIE) && defined(DHDTCPACK_SUPPRESS)
+                               dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_OFF);
+#endif /* BCMPCIE && DHDTCPACK_SUPPRESS */
+#if defined(DHD_LB_RXP)
+#ifdef ENABLE_DHD_GRO
+                               if (dhd_gro_enable && !skb_cloned(skb) &&
+                                       ntoh16(skb->protocol) != ETHER_TYPE_BRCM) {
+                                       napi_gro_receive(&dhd->rx_napi_struct, skb);
+                               } else {
+                                       netif_receive_skb(skb);
+                               }
+#else
+                               netif_receive_skb(skb);
+#endif /* ENABLE_DHD_GRO */
+#else /* !defined(DHD_LB_RXP) */
+                               netif_rx_ni(skb);
+#endif /* !defined(DHD_LB_RXP) */
+                       }
+               }
+       }
+
+       if (dhd->rxthread_enabled && skbhead)
+               dhd_sched_rxf(dhdp, skbhead);
+
+       DHD_OS_WAKE_LOCK_RX_TIMEOUT_ENABLE(dhdp, tout_rx);
+       DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE(dhdp, tout_ctrl);
+}
+
+void
+dhd_event(struct dhd_info *dhd, char *evpkt, int evlen, int ifidx)
+{
+       /* Linux version has nothing to do */
+       return;
+}
+
+void
+dhd_txcomplete(dhd_pub_t *dhdp, void *txp, bool success)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(dhdp->info);
+       struct ether_header *eh;
+       uint16 type;
+
+       if (dhdp->tput_data.tput_test_running) {
+
+               dhdp->batch_tx_pkts_cmpl++;
+
+               /* don't count the stop pkt */
+               if (success &&
+                       dhdp->batch_tx_pkts_cmpl <= dhdp->batch_tx_num_pkts)
+                       dhdp->tput_data.pkts_good++;
+               else if (!success)
+                       dhdp->tput_data.pkts_bad++;
+
+               /* we dont care for the stop packet in tput test */
+               if (dhdp->batch_tx_pkts_cmpl == dhdp->batch_tx_num_pkts) {
+                       dhdp->tput_stop_ts = OSL_SYSUPTIME_US();
+                       dhdp->tput_data.pkts_cmpl += dhdp->batch_tx_pkts_cmpl;
+                       dhdp->tput_data.num_pkts += dhdp->batch_tx_num_pkts;
+                       dhd_os_tput_test_wake(dhdp);
+               }
+       }
+       /* XXX where does this stuff belong to? */
+       dhd_prot_hdrpull(dhdp, NULL, txp, NULL, NULL);
+
+       /* XXX Use packet tag when it is available to identify its type */
+
+       eh = (struct ether_header *)PKTDATA(dhdp->osh, txp);
+       type  = ntoh16(eh->ether_type);
+
+       if (type == ETHER_TYPE_802_1X) {
+               atomic_dec(&dhd->pend_8021x_cnt);
+       }
+
+#ifdef PROP_TXSTATUS
+       if (dhdp->wlfc_state && (dhdp->proptxstatus_mode != WLFC_FCMODE_NONE)) {
+               dhd_if_t *ifp = dhd->iflist[DHD_PKTTAG_IF(PKTTAG(txp))];
+               uint datalen  = PKTLEN(dhd->pub.osh, txp);
+               if (ifp != NULL) {
+                       if (success) {
+                               dhd->pub.tx_packets++;
+                               ifp->stats.tx_packets++;
+                               ifp->stats.tx_bytes += datalen;
+                       } else {
+                               ifp->stats.tx_dropped++;
+                       }
+               }
+       }
+#endif
+       if (success) {
+               dhd->pub.tot_txcpl++;
+       }
+}
+
+int dhd_os_tput_test_wait(dhd_pub_t *pub, uint *condition,
+               uint timeout_ms)
+{
+       int timeout;
+
+       /* Convert timeout in millsecond to jiffies */
+       timeout = msecs_to_jiffies(timeout_ms);
+       pub->tput_test_done = FALSE;
+       condition = (uint *)&pub->tput_test_done;
+       timeout = wait_event_timeout(pub->tx_tput_test_wait,
+               (*condition), timeout);
+
+       return timeout;
+}
+
+int dhd_os_tput_test_wake(dhd_pub_t * pub)
+{
+       OSL_SMP_WMB();
+       pub->tput_test_done = TRUE;
+       OSL_SMP_WMB();
+       wake_up(&(pub->tx_tput_test_wait));
+       return 0;
+}
+
+static struct net_device_stats *
+dhd_get_stats(struct net_device *net)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+       dhd_if_t *ifp;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (!dhd) {
+               DHD_ERROR(("%s : dhd is NULL\n", __FUNCTION__));
+               goto error;
+       }
+
+       ifp = dhd_get_ifp_by_ndev(&dhd->pub, net);
+       if (!ifp) {
+               /* return empty stats */
+               DHD_ERROR(("%s: BAD_IF\n", __FUNCTION__));
+               goto error;
+       }
+
+       if (dhd->pub.up) {
+               /* Use the protocol to get dongle stats */
+               dhd_prot_dstats(&dhd->pub);
+       }
+       return &ifp->stats;
+
+error:
+       memset(&net->stats, 0, sizeof(net->stats));
+       return &net->stats;
+}
+
+#ifndef BCMDBUS
+static int
+dhd_watchdog_thread(void *data)
+{
+       tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+       dhd_info_t *dhd = (dhd_info_t *)tsk->parent;
+       /* This thread doesn't need any user-level access,
+        * so get rid of all our resources
+        */
+       if (dhd_watchdog_prio > 0) {
+               struct sched_param param;
+               param.sched_priority = (dhd_watchdog_prio < MAX_RT_PRIO)?
+                       dhd_watchdog_prio:(MAX_RT_PRIO-1);
+               setScheduler(current, SCHED_FIFO, &param);
+       }
+
+       while (1) {
+               if (down_interruptible (&tsk->sema) == 0) {
+                       unsigned long flags;
+                       unsigned long jiffies_at_start = jiffies;
+                       unsigned long time_lapse;
+#ifdef BCMPCIE
+                       DHD_OS_WD_WAKE_LOCK(&dhd->pub);
+#endif /* BCMPCIE */
+
+                       SMP_RD_BARRIER_DEPENDS();
+                       if (tsk->terminated) {
+#ifdef BCMPCIE
+                               DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+#endif /* BCMPCIE */
+                               break;
+                       }
+
+                       if (dhd->pub.dongle_reset == FALSE) {
+                               DHD_TIMER(("%s:\n", __FUNCTION__));
+                               dhd_analyze_sock_flows(dhd, dhd_watchdog_ms);
+                               dhd_bus_watchdog(&dhd->pub);
+
+                               DHD_GENERAL_LOCK(&dhd->pub, flags);
+                               /* Count the tick for reference */
+                               dhd->pub.tickcnt++;
+#ifdef DHD_L2_FILTER
+                               dhd_l2_filter_watchdog(&dhd->pub);
+#endif /* DHD_L2_FILTER */
+                               time_lapse = jiffies - jiffies_at_start;
+
+                               /* Reschedule the watchdog */
+                               if (dhd->wd_timer_valid) {
+                                       mod_timer(&dhd->timer,
+                                           jiffies +
+                                           msecs_to_jiffies(dhd_watchdog_ms) -
+                                           min(msecs_to_jiffies(dhd_watchdog_ms), time_lapse));
+                               }
+                               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+                       }
+#ifdef BCMPCIE
+                       DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+#endif /* BCMPCIE */
+               } else {
+                       break;
+               }
+       }
+
+       complete_and_exit(&tsk->completed, 0);
+}
+
+static void dhd_watchdog(ulong data)
+{
+       dhd_info_t *dhd = (dhd_info_t *)data;
+       unsigned long flags;
+
+       if (dhd->pub.dongle_reset) {
+               return;
+       }
+
+       if (dhd->thr_wdt_ctl.thr_pid >= 0) {
+               up(&dhd->thr_wdt_ctl.sema);
+               return;
+       }
+
+#ifdef BCMPCIE
+       DHD_OS_WD_WAKE_LOCK(&dhd->pub);
+#endif /* BCMPCIE */
+       /* Call the bus module watchdog */
+       dhd_bus_watchdog(&dhd->pub);
+
+       DHD_GENERAL_LOCK(&dhd->pub, flags);
+       /* Count the tick for reference */
+       dhd->pub.tickcnt++;
+
+#ifdef DHD_L2_FILTER
+       dhd_l2_filter_watchdog(&dhd->pub);
+#endif /* DHD_L2_FILTER */
+       /* Reschedule the watchdog */
+       if (dhd->wd_timer_valid)
+               mod_timer(&dhd->timer, jiffies + msecs_to_jiffies(dhd_watchdog_ms));
+       DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+#ifdef BCMPCIE
+       DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+#endif /* BCMPCIE */
+}
+
+#ifdef DHD_PCIE_RUNTIMEPM
+static int
+dhd_rpm_state_thread(void *data)
+{
+       tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+       dhd_info_t *dhd = (dhd_info_t *)tsk->parent;
+
+       while (1) {
+               if (down_interruptible (&tsk->sema) == 0) {
+                       unsigned long flags;
+                       unsigned long jiffies_at_start = jiffies;
+                       unsigned long time_lapse;
+
+                       SMP_RD_BARRIER_DEPENDS();
+                       if (tsk->terminated) {
+                               break;
+                       }
+
+                       if (dhd->pub.dongle_reset == FALSE) {
+                               DHD_TIMER(("%s:\n", __FUNCTION__));
+                               if (dhd->pub.up) {
+#if defined(PCIE_INB_DW)
+                                       dhd_bus_dw_deassert(&dhd->pub);
+#endif
+                                       if (dhd_get_rpm_state(&dhd->pub)) {
+                                               dhd_runtimepm_state(&dhd->pub);
+                                       }
+                               }
+                               DHD_GENERAL_LOCK(&dhd->pub, flags);
+                               time_lapse = jiffies - jiffies_at_start;
+
+                               /* Reschedule the watchdog */
+                               if (dhd->rpm_timer_valid) {
+                                       mod_timer(&dhd->rpm_timer,
+                                               jiffies +
+                                               msecs_to_jiffies(dhd_runtimepm_ms) -
+                                               min(msecs_to_jiffies(dhd_runtimepm_ms),
+                                                       time_lapse));
+                               }
+                               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+                       }
+               } else {
+                       break;
+               }
+       }
+
+       complete_and_exit(&tsk->completed, 0);
+}
+
+static void dhd_runtimepm(ulong data)
+{
+       dhd_info_t *dhd = (dhd_info_t *)data;
+
+       if (dhd->pub.dongle_reset) {
+               return;
+       }
+
+       if (dhd->thr_rpm_ctl.thr_pid >= 0) {
+               up(&dhd->thr_rpm_ctl.sema);
+               return;
+       }
+}
+
+void dhd_runtime_pm_disable(dhd_pub_t *dhdp)
+{
+       dhd_set_rpm_state(dhdp, FALSE);
+       dhdpcie_runtime_bus_wake(dhdp, CAN_SLEEP(), __builtin_return_address(0));
+}
+
+void dhd_runtime_pm_enable(dhd_pub_t *dhdp)
+{
+       /* Enable Runtime PM except for MFG Mode */
+       if (!(dhdp->op_mode & DHD_FLAG_MFG_MODE)) {
+               if (dhd_get_idletime(dhdp)) {
+                       dhd_set_rpm_state(dhdp, TRUE);
+               }
+       }
+}
+
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+#ifdef ENABLE_ADAPTIVE_SCHED
+static void
+dhd_sched_policy(int prio)
+{
+       struct sched_param param;
+       if (cpufreq_quick_get(0) <= CUSTOM_CPUFREQ_THRESH) {
+               param.sched_priority = 0;
+               setScheduler(current, SCHED_NORMAL, &param);
+       } else {
+               if (get_scheduler_policy(current) != SCHED_FIFO) {
+                       param.sched_priority = (prio < MAX_RT_PRIO)? prio : (MAX_RT_PRIO-1);
+                       setScheduler(current, SCHED_FIFO, &param);
+               }
+       }
+}
+#endif /* ENABLE_ADAPTIVE_SCHED */
+#ifdef DEBUG_CPU_FREQ
+static int dhd_cpufreq_notifier(struct notifier_block *nb, unsigned long val, void *data)
+{
+       dhd_info_t *dhd = container_of(nb, struct dhd_info, freq_trans);
+       struct cpufreq_freqs *freq = data;
+       if (dhd) {
+               if (!dhd->new_freq)
+                       goto exit;
+               if (val == CPUFREQ_POSTCHANGE) {
+                       DHD_ERROR(("cpu freq is changed to %u kHZ on CPU %d\n",
+                               freq->new, freq->cpu));
+                       *per_cpu_ptr(dhd->new_freq, freq->cpu) = freq->new;
+               }
+       }
+exit:
+       return 0;
+}
+#endif /* DEBUG_CPU_FREQ */
+
+static int
+dhd_dpc_thread(void *data)
+{
+       tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+       dhd_info_t *dhd = (dhd_info_t *)tsk->parent;
+
+       /* This thread doesn't need any user-level access,
+        * so get rid of all our resources
+        */
+       if (dhd_dpc_prio > 0)
+       {
+               struct sched_param param;
+               param.sched_priority = (dhd_dpc_prio < MAX_RT_PRIO)?dhd_dpc_prio:(MAX_RT_PRIO-1);
+               setScheduler(current, SCHED_FIFO, &param);
+       }
+
+#ifdef CUSTOM_DPC_CPUCORE
+       set_cpus_allowed_ptr(current, cpumask_of(CUSTOM_DPC_CPUCORE));
+#endif
+#ifdef CUSTOM_SET_CPUCORE
+       dhd->pub.current_dpc = current;
+#endif /* CUSTOM_SET_CPUCORE */
+       /* Run until signal received */
+       while (1) {
+               if (dhd->pub.conf->dpc_cpucore >= 0) {
+                       printf("%s: set dpc_cpucore %d\n", __FUNCTION__, dhd->pub.conf->dpc_cpucore);
+                       set_cpus_allowed_ptr(current, cpumask_of(dhd->pub.conf->dpc_cpucore));
+                       dhd->pub.conf->dpc_cpucore = -1;
+               }
+               if (!binary_sema_down(tsk)) {
+#ifdef ENABLE_ADAPTIVE_SCHED
+                       dhd_sched_policy(dhd_dpc_prio);
+#endif /* ENABLE_ADAPTIVE_SCHED */
+                       SMP_RD_BARRIER_DEPENDS();
+                       if (tsk->terminated) {
+                               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                               break;
+                       }
+
+                       /* Call bus dpc unless it indicated down (then clean stop) */
+                       if (dhd->pub.busstate != DHD_BUS_DOWN) {
+#ifdef DEBUG_DPC_THREAD_WATCHDOG
+                               int resched_cnt = 0;
+#endif /* DEBUG_DPC_THREAD_WATCHDOG */
+                               dhd_os_wd_timer_extend(&dhd->pub, TRUE);
+                               while (dhd_bus_dpc(dhd->pub.bus)) {
+                                       /* process all data */
+#ifdef DEBUG_DPC_THREAD_WATCHDOG
+                                       resched_cnt++;
+                                       if (resched_cnt > MAX_RESCHED_CNT) {
+                                               DHD_INFO(("%s Calling msleep to"
+                                                       "let other processes run. \n",
+                                                       __FUNCTION__));
+                                               dhd->pub.dhd_bug_on = true;
+                                               resched_cnt = 0;
+                                               OSL_SLEEP(1);
+                                       }
+#endif /* DEBUG_DPC_THREAD_WATCHDOG */
+                               }
+                               dhd_os_wd_timer_extend(&dhd->pub, FALSE);
+                               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                       } else {
+                               if (dhd->pub.up)
+                                       dhd_bus_stop(dhd->pub.bus, TRUE);
+                               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                       }
+               } else {
+                       break;
+               }
+       }
+       complete_and_exit(&tsk->completed, 0);
+}
+
+static int
+dhd_rxf_thread(void *data)
+{
+       tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+       dhd_info_t *dhd = (dhd_info_t *)tsk->parent;
+#if defined(WAIT_DEQUEUE)
+#define RXF_WATCHDOG_TIME 250 /* BARK_TIME(1000) /  */
+       ulong watchdogTime = OSL_SYSUPTIME(); /* msec */
+#endif
+       dhd_pub_t *pub = &dhd->pub;
+
+       /* This thread doesn't need any user-level access,
+        * so get rid of all our resources
+        */
+       if (dhd_rxf_prio > 0)
+       {
+               struct sched_param param;
+               param.sched_priority = (dhd_rxf_prio < MAX_RT_PRIO)?dhd_rxf_prio:(MAX_RT_PRIO-1);
+               setScheduler(current, SCHED_FIFO, &param);
+       }
+
+#ifdef CUSTOM_SET_CPUCORE
+       dhd->pub.current_rxf = current;
+#endif /* CUSTOM_SET_CPUCORE */
+       /* Run until signal received */
+       while (1) {
+               if (dhd->pub.conf->rxf_cpucore >= 0) {
+                       printf("%s: set rxf_cpucore %d\n", __FUNCTION__, dhd->pub.conf->rxf_cpucore);
+                       set_cpus_allowed_ptr(current, cpumask_of(dhd->pub.conf->rxf_cpucore));
+                       dhd->pub.conf->rxf_cpucore = -1;
+               }
+               if (down_interruptible(&tsk->sema) == 0) {
+                       void *skb;
+#ifdef ENABLE_ADAPTIVE_SCHED
+                       dhd_sched_policy(dhd_rxf_prio);
+#endif /* ENABLE_ADAPTIVE_SCHED */
+
+                       SMP_RD_BARRIER_DEPENDS();
+
+                       if (tsk->terminated) {
+                               DHD_OS_WAKE_UNLOCK(pub);
+                               break;
+                       }
+                       skb = dhd_rxf_dequeue(pub);
+
+                       if (skb == NULL) {
+                               continue;
+                       }
+                       while (skb) {
+                               void *skbnext = PKTNEXT(pub->osh, skb);
+                               PKTSETNEXT(pub->osh, skb, NULL);
+                               bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE,
+                                       __FUNCTION__, __LINE__);
+#if defined(WL_MONITOR) && defined(BCMSDIO)
+                               if (dhd_monitor_enabled(pub, 0)) 
+                                       dhd_rx_mon_pkt_sdio(pub, skb, 0);
+                               else
+#endif /* WL_MONITOR && BCMSDIO */
+                               netif_rx_ni(skb);
+                               skb = skbnext;
+                       }
+#if defined(WAIT_DEQUEUE)
+                       if (OSL_SYSUPTIME() - watchdogTime > RXF_WATCHDOG_TIME) {
+                               OSL_SLEEP(1);
+                               watchdogTime = OSL_SYSUPTIME();
+                       }
+#endif
+
+                       DHD_OS_WAKE_UNLOCK(pub);
+               } else {
+                       break;
+               }
+       }
+       complete_and_exit(&tsk->completed, 0);
+}
+
+#ifdef BCMPCIE
+void dhd_dpc_enable(dhd_pub_t *dhdp)
+{
+#if defined(DHD_LB_RXP) || defined(DHD_LB_TXP)
+       dhd_info_t *dhd;
+
+       if (!dhdp || !dhdp->info)
+               return;
+       dhd = dhdp->info;
+#endif /* DHD_LB_RXP || DHD_LB_TXP */
+
+#ifdef DHD_LB_RXP
+       __skb_queue_head_init(&dhd->rx_pend_queue);
+#endif /* DHD_LB_RXP */
+
+#ifdef DHD_LB_TXP
+       skb_queue_head_init(&dhd->tx_pend_queue);
+#endif /* DHD_LB_TXP */
+}
+#endif /* BCMPCIE */
+
+#ifdef BCMPCIE
+void
+dhd_dpc_kill(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd;
+
+       if (!dhdp) {
+               return;
+       }
+
+       dhd = dhdp->info;
+
+       if (!dhd) {
+               return;
+       }
+
+       if (dhd->thr_dpc_ctl.thr_pid < 0) {
+               tasklet_kill(&dhd->tasklet);
+               DHD_ERROR(("%s: tasklet disabled\n", __FUNCTION__));
+       }
+
+#ifdef DHD_LB
+#ifdef DHD_LB_RXP
+       cancel_work_sync(&dhd->rx_napi_dispatcher_work);
+       __skb_queue_purge(&dhd->rx_pend_queue);
+#endif /* DHD_LB_RXP */
+#ifdef DHD_LB_TXP
+       cancel_work_sync(&dhd->tx_dispatcher_work);
+       skb_queue_purge(&dhd->tx_pend_queue);
+#endif /* DHD_LB_TXP */
+
+       /* Kill the Load Balancing Tasklets */
+#if defined(DHD_LB_TXC)
+       tasklet_kill(&dhd->tx_compl_tasklet);
+#endif /* DHD_LB_TXC */
+#if defined(DHD_LB_RXC)
+       tasklet_kill(&dhd->rx_compl_tasklet);
+#endif /* DHD_LB_RXC */
+#if defined(DHD_LB_TXP)
+       tasklet_kill(&dhd->tx_tasklet);
+#endif /* DHD_LB_TXP */
+#endif /* DHD_LB */
+}
+
+void
+dhd_dpc_tasklet_kill(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd;
+
+       if (!dhdp) {
+               return;
+       }
+
+       dhd = dhdp->info;
+
+       if (!dhd) {
+               return;
+       }
+
+       if (dhd->thr_dpc_ctl.thr_pid < 0) {
+               tasklet_kill(&dhd->tasklet);
+       }
+}
+#endif /* BCMPCIE */
+
+static void
+dhd_dpc(ulong data)
+{
+       dhd_info_t *dhd;
+
+       dhd = (dhd_info_t *)data;
+
+       /* this (tasklet) can be scheduled in dhd_sched_dpc[dhd_linux.c]
+        * down below , wake lock is set,
+        * the tasklet is initialized in dhd_attach()
+        */
+       /* Call bus dpc unless it indicated down (then clean stop) */
+       if (dhd->pub.busstate != DHD_BUS_DOWN) {
+#if defined(DHD_LB_STATS) && defined(PCIE_FULL_DONGLE)
+               DHD_LB_STATS_INCR(dhd->dhd_dpc_cnt);
+#endif /* DHD_LB_STATS && PCIE_FULL_DONGLE */
+               if (dhd_bus_dpc(dhd->pub.bus)) {
+                       tasklet_schedule(&dhd->tasklet);
+               }
+       } else {
+               dhd_bus_stop(dhd->pub.bus, TRUE);
+       }
+}
+
+void
+dhd_sched_dpc(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+
+       if (dhd->thr_dpc_ctl.thr_pid >= 0) {
+               DHD_OS_WAKE_LOCK(dhdp);
+               /* If the semaphore does not get up,
+               * wake unlock should be done here
+               */
+               if (!binary_sema_up(&dhd->thr_dpc_ctl)) {
+                       DHD_OS_WAKE_UNLOCK(dhdp);
+               }
+               return;
+       } else {
+               tasklet_schedule(&dhd->tasklet);
+       }
+}
+#endif /* BCMDBUS */
+
+static void
+dhd_sched_rxf(dhd_pub_t *dhdp, void *skb)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+
+       DHD_OS_WAKE_LOCK(dhdp);
+
+       DHD_TRACE(("dhd_sched_rxf: Enter\n"));
+       do {
+               if (dhd_rxf_enqueue(dhdp, skb) == BCME_OK)
+                       break;
+       } while (1);
+       if (dhd->thr_rxf_ctl.thr_pid >= 0) {
+               up(&dhd->thr_rxf_ctl.sema);
+       } else {
+               DHD_OS_WAKE_UNLOCK(dhdp);
+       }
+       return;
+}
+
+#if defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW)
+#endif /* defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW) */
+
+#ifdef TOE
+/* Retrieve current toe component enables, which are kept as a bitmap in toe_ol iovar */
+static int
+dhd_toe_get(dhd_info_t *dhd, int ifidx, uint32 *toe_ol)
+{
+       char buf[32];
+       int ret;
+
+       ret = dhd_iovar(&dhd->pub, ifidx, "toe_ol", NULL, 0, (char *)&buf, sizeof(buf), FALSE);
+
+       if (ret < 0) {
+               if (ret == -EIO) {
+                       DHD_ERROR(("%s: toe not supported by device\n", dhd_ifname(&dhd->pub,
+                               ifidx)));
+                       return -EOPNOTSUPP;
+               }
+
+               DHD_INFO(("%s: could not get toe_ol: ret=%d\n", dhd_ifname(&dhd->pub, ifidx), ret));
+               return ret;
+       }
+
+       memcpy(toe_ol, buf, sizeof(uint32));
+       return 0;
+}
+
+/* Set current toe component enables in toe_ol iovar, and set toe global enable iovar */
+static int
+dhd_toe_set(dhd_info_t *dhd, int ifidx, uint32 toe_ol)
+{
+       int toe, ret;
+
+       /* Set toe_ol as requested */
+       ret = dhd_iovar(&dhd->pub, ifidx, "toe_ol", (char *)&toe_ol, sizeof(toe_ol), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: could not set toe_ol: ret=%d\n",
+                       dhd_ifname(&dhd->pub, ifidx), ret));
+               return ret;
+       }
+
+       /* Enable toe globally only if any components are enabled. */
+       toe = (toe_ol != 0);
+       ret = dhd_iovar(&dhd->pub, ifidx, "toe", (char *)&toe, sizeof(toe), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: could not set toe: ret=%d\n", dhd_ifname(&dhd->pub, ifidx), ret));
+               return ret;
+       }
+
+       return 0;
+}
+#endif /* TOE */
+
+#if defined(WL_CFG80211) && defined(NUM_SCB_MAX_PROBE)
+void dhd_set_scb_probe(dhd_pub_t *dhd)
+{
+       wl_scb_probe_t scb_probe;
+       char iovbuf[WL_EVENTING_MASK_LEN + sizeof(wl_scb_probe_t)];
+       int ret;
+
+       if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+               return;
+       }
+
+       ret = dhd_iovar(dhd, 0, "scb_probe", NULL, 0, iovbuf, sizeof(iovbuf), FALSE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: GET max_scb_probe failed\n", __FUNCTION__));
+       }
+
+       memcpy(&scb_probe, iovbuf, sizeof(wl_scb_probe_t));
+
+       scb_probe.scb_max_probe = NUM_SCB_MAX_PROBE;
+
+       ret = dhd_iovar(dhd, 0, "scb_probe", (char *)&scb_probe, sizeof(wl_scb_probe_t), NULL, 0,
+                       TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: max_scb_probe setting failed\n", __FUNCTION__));
+               return;
+       }
+}
+#endif /* WL_CFG80211 && NUM_SCB_MAX_PROBE */
+
+static void
+dhd_ethtool_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *info)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+
+       snprintf(info->driver, sizeof(info->driver), "wl");
+       snprintf(info->version, sizeof(info->version), "%lu", dhd->pub.drv_version);
+}
+
+struct ethtool_ops dhd_ethtool_ops = {
+       .get_drvinfo = dhd_ethtool_get_drvinfo
+};
+
+static int
+dhd_ethtool(dhd_info_t *dhd, void *uaddr)
+{
+       struct ethtool_drvinfo info;
+       char drvname[sizeof(info.driver)];
+       uint32 cmd;
+#ifdef TOE
+       struct ethtool_value edata;
+       uint32 toe_cmpnt, csum_dir;
+       int ret;
+#endif
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       /* all ethtool calls start with a cmd word */
+       if (copy_from_user(&cmd, uaddr, sizeof (uint32)))
+               return -EFAULT;
+
+       switch (cmd) {
+       case ETHTOOL_GDRVINFO:
+               /* Copy out any request driver name */
+               bzero(&info.driver, sizeof(info.driver));
+               if (copy_from_user(&info, uaddr, sizeof(info)))
+                       return -EFAULT;
+               if (info.driver[sizeof(info.driver) - 1] != '\0') {
+                       DHD_ERROR(("%s: Exceeds the size of info.driver"
+                               "truncating last byte with null\n", __FUNCTION__));
+                       info.driver[sizeof(info.driver) - 1] = '\0';
+               }
+               strlcpy(drvname, info.driver, sizeof(drvname));
+
+               /* clear struct for return */
+               memset(&info, 0, sizeof(info));
+               info.cmd = cmd;
+
+               /* if dhd requested, identify ourselves */
+               if (strcmp(drvname, "?dhd") == 0) {
+                       snprintf(info.driver, sizeof(info.driver), "dhd");
+                       strlcpy(info.version, EPI_VERSION_STR, sizeof(info.version));
+               }
+
+               /* otherwise, require dongle to be up */
+               else if (!dhd->pub.up) {
+                       DHD_ERROR(("%s: dongle is not up\n", __FUNCTION__));
+                       return -ENODEV;
+               }
+
+               /* finally, report dongle driver type */
+               else if (dhd->pub.iswl)
+                       snprintf(info.driver, sizeof(info.driver), "wl");
+               else
+                       snprintf(info.driver, sizeof(info.driver), "xx");
+
+               snprintf(info.version, sizeof(info.version), "%lu", dhd->pub.drv_version);
+               if (copy_to_user(uaddr, &info, sizeof(info)))
+                       return -EFAULT;
+               DHD_CTL(("%s: given %*s, returning %s\n", __FUNCTION__,
+                        (int)sizeof(drvname), drvname, info.driver));
+               break;
+
+#ifdef TOE
+       /* Get toe offload components from dongle */
+       case ETHTOOL_GRXCSUM:
+       case ETHTOOL_GTXCSUM:
+               if ((ret = dhd_toe_get(dhd, 0, &toe_cmpnt)) < 0)
+                       return ret;
+
+               csum_dir = (cmd == ETHTOOL_GTXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
+
+               edata.cmd = cmd;
+               edata.data = (toe_cmpnt & csum_dir) ? 1 : 0;
+
+               if (copy_to_user(uaddr, &edata, sizeof(edata)))
+                       return -EFAULT;
+               break;
+
+       /* Set toe offload components in dongle */
+       case ETHTOOL_SRXCSUM:
+       case ETHTOOL_STXCSUM:
+               if (copy_from_user(&edata, uaddr, sizeof(edata)))
+                       return -EFAULT;
+
+               /* Read the current settings, update and write back */
+               if ((ret = dhd_toe_get(dhd, 0, &toe_cmpnt)) < 0)
+                       return ret;
+
+               csum_dir = (cmd == ETHTOOL_STXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
+
+               if (edata.data != 0)
+                       toe_cmpnt |= csum_dir;
+               else
+                       toe_cmpnt &= ~csum_dir;
+
+               if ((ret = dhd_toe_set(dhd, 0, toe_cmpnt)) < 0)
+                       return ret;
+
+               /* If setting TX checksum mode, tell Linux the new mode */
+               if (cmd == ETHTOOL_STXCSUM) {
+                       if (edata.data)
+                               dhd->iflist[0]->net->features |= NETIF_F_IP_CSUM;
+                       else
+                               dhd->iflist[0]->net->features &= ~NETIF_F_IP_CSUM;
+               }
+
+               break;
+#endif /* TOE */
+
+       default:
+               return -EOPNOTSUPP;
+       }
+
+       return 0;
+}
+
+/* XXX function to detect that FW is dead and send Event up */
+static bool dhd_check_hang(struct net_device *net, dhd_pub_t *dhdp, int error)
+{
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       if (!dhdp->up)
+               return FALSE;
+
+#if !defined(BCMPCIE) && !defined(BCMDBUS)
+       if (dhdp->info->thr_dpc_ctl.thr_pid < 0) {
+               DHD_ERROR(("%s : skipped due to negative pid - unloading?\n", __FUNCTION__));
+               return FALSE;
+       }
+#endif /* !BCMPCIE && !BCMDBUS */
+
+       if ((error == -ETIMEDOUT) || (error == -EREMOTEIO) ||
+               ((dhdp->busstate == DHD_BUS_DOWN) && (!dhdp->dongle_reset))) {
+#ifdef BCMPCIE
+               DHD_ERROR(("%s: Event HANG send up due to  re=%d te=%d d3acke=%d e=%d s=%d\n",
+                       __FUNCTION__, dhdp->rxcnt_timeout, dhdp->txcnt_timeout,
+                       dhdp->d3ackcnt_timeout, error, dhdp->busstate));
+#else
+               DHD_ERROR(("%s: Event HANG send up due to  re=%d te=%d e=%d s=%d\n", __FUNCTION__,
+                       dhdp->rxcnt_timeout, dhdp->txcnt_timeout, error, dhdp->busstate));
+#endif /* BCMPCIE */
+               if (dhdp->hang_reason == 0) {
+                       if (dhdp->dongle_trap_occured) {
+                               dhdp->hang_reason = HANG_REASON_DONGLE_TRAP;
+#ifdef BCMPCIE
+                       } else if (dhdp->d3ackcnt_timeout) {
+                               dhdp->hang_reason = dhdp->is_sched_error ?
+                                       HANG_REASON_D3_ACK_TIMEOUT_SCHED_ERROR :
+                                       HANG_REASON_D3_ACK_TIMEOUT;
+#endif /* BCMPCIE */
+                       } else {
+                               dhdp->hang_reason = dhdp->is_sched_error ?
+                                       HANG_REASON_IOCTL_RESP_TIMEOUT_SCHED_ERROR :
+                                       HANG_REASON_IOCTL_RESP_TIMEOUT;
+                       }
+               }
+               printf("%s\n", info_string);
+               net_os_send_hang_message(net);
+               return TRUE;
+       }
+       return FALSE;
+}
+
+#ifdef WL_MONITOR
+bool
+dhd_monitor_enabled(dhd_pub_t *dhd, int ifidx)
+{
+       return (dhd->info->monitor_type != 0);
+}
+
+#ifdef BCMSDIO
+static void
+dhd_rx_mon_pkt_sdio(dhd_pub_t *dhdp, void *pkt, int ifidx)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+
+       if (!dhd->monitor_skb) {
+               if ((dhd->monitor_skb = PKTTONATIVE(dhdp->osh, pkt)) == NULL)
+                       return;
+       }
+
+       if (dhd->monitor_type && dhd->monitor_dev)
+               dhd->monitor_skb->dev = dhd->monitor_dev;
+       else {
+               PKTFREE(dhdp->osh, pkt, FALSE);
+               dhd->monitor_skb = NULL;
+               return;
+       }
+
+       dhd->monitor_skb->protocol =
+               eth_type_trans(dhd->monitor_skb, dhd->monitor_skb->dev);
+       dhd->monitor_len = 0;
+
+       netif_rx_ni(dhd->monitor_skb);
+
+       dhd->monitor_skb = NULL;
+}
+#elif defined(BCMPCIE)
+void
+dhd_rx_mon_pkt(dhd_pub_t *dhdp, host_rxbuf_cmpl_t* msg, void *pkt, int ifidx)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+       {
+               uint8 amsdu_flag = (msg->flags & BCMPCIE_PKT_FLAGS_MONITOR_MASK) >>
+                       BCMPCIE_PKT_FLAGS_MONITOR_SHIFT;
+               switch (amsdu_flag) {
+                       case BCMPCIE_PKT_FLAGS_MONITOR_NO_AMSDU:
+                       default:
+                               if (!dhd->monitor_skb) {
+                                       if ((dhd->monitor_skb = PKTTONATIVE(dhdp->osh, pkt))
+                                               == NULL)
+                                               return;
+                               }
+                               if (dhd->monitor_type && dhd->monitor_dev)
+                                       dhd->monitor_skb->dev = dhd->monitor_dev;
+                               else {
+                                       PKTFREE(dhdp->osh, pkt, FALSE);
+                                       dhd->monitor_skb = NULL;
+                                       return;
+                               }
+                               dhd->monitor_skb->protocol =
+                                       eth_type_trans(dhd->monitor_skb, dhd->monitor_skb->dev);
+                               dhd->monitor_len = 0;
+                               break;
+
+                       case BCMPCIE_PKT_FLAGS_MONITOR_FIRST_PKT:
+                               if (!dhd->monitor_skb) {
+                                       if ((dhd->monitor_skb = dev_alloc_skb(MAX_MON_PKT_SIZE))
+                                               == NULL)
+                                               return;
+                                       dhd->monitor_len = 0;
+                               }
+                               if (dhd->monitor_type && dhd->monitor_dev)
+                                       dhd->monitor_skb->dev = dhd->monitor_dev;
+                               else {
+                                       PKTFREE(dhdp->osh, pkt, FALSE);
+                                       dev_kfree_skb(dhd->monitor_skb);
+                                       return;
+                               }
+                               memcpy(PKTDATA(dhdp->osh, dhd->monitor_skb),
+                               PKTDATA(dhdp->osh, pkt), PKTLEN(dhdp->osh, pkt));
+                               dhd->monitor_len = PKTLEN(dhdp->osh, pkt);
+                               PKTFREE(dhdp->osh, pkt, FALSE);
+                               return;
+
+                       case BCMPCIE_PKT_FLAGS_MONITOR_INTER_PKT:
+                               memcpy(PKTDATA(dhdp->osh, dhd->monitor_skb) + dhd->monitor_len,
+                               PKTDATA(dhdp->osh, pkt), PKTLEN(dhdp->osh, pkt));
+                               dhd->monitor_len += PKTLEN(dhdp->osh, pkt);
+                               PKTFREE(dhdp->osh, pkt, FALSE);
+                               return;
+
+                       case BCMPCIE_PKT_FLAGS_MONITOR_LAST_PKT:
+                               memcpy(PKTDATA(dhdp->osh, dhd->monitor_skb) + dhd->monitor_len,
+                               PKTDATA(dhdp->osh, pkt), PKTLEN(dhdp->osh, pkt));
+                               dhd->monitor_len += PKTLEN(dhdp->osh, pkt);
+                               PKTFREE(dhdp->osh, pkt, FALSE);
+                               skb_put(dhd->monitor_skb, dhd->monitor_len);
+                               dhd->monitor_skb->protocol =
+                                       eth_type_trans(dhd->monitor_skb, dhd->monitor_skb->dev);
+                               dhd->monitor_len = 0;
+                               break;
+               }
+       }
+
+       /* XXX WL here makes sure data is 4-byte aligned? */
+       if (in_interrupt()) {
+               bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE,
+                       __FUNCTION__, __LINE__);
+               netif_rx(dhd->monitor_skb);
+       } else {
+               /* If the receive is not processed inside an ISR,
+                * the softirqd must be woken explicitly to service
+                * the NET_RX_SOFTIRQ.  In 2.6 kernels, this is handled
+                * by netif_rx_ni(), but in earlier kernels, we need
+                * to do it manually.
+                */
+               bcm_object_trace_opr(dhd->monitor_skb, BCM_OBJDBG_REMOVE,
+                       __FUNCTION__, __LINE__);
+
+               netif_rx_ni(dhd->monitor_skb);
+       }
+
+       dhd->monitor_skb = NULL;
+}
+#endif
+
+typedef struct dhd_mon_dev_priv {
+       struct net_device_stats stats;
+} dhd_mon_dev_priv_t;
+
+#define DHD_MON_DEV_PRIV_SIZE          (sizeof(dhd_mon_dev_priv_t))
+#define DHD_MON_DEV_PRIV(dev)          ((dhd_mon_dev_priv_t *)DEV_PRIV(dev))
+#define DHD_MON_DEV_STATS(dev)         (((dhd_mon_dev_priv_t *)DEV_PRIV(dev))->stats)
+
+static int
+dhd_monitor_start(struct sk_buff *skb, struct net_device *dev)
+{
+       PKTFREE(NULL, skb, FALSE);
+       return 0;
+}
+
+#if defined(BT_OVER_SDIO)
+
+void
+dhdsdio_bus_usr_cnt_inc(dhd_pub_t *dhdp)
+{
+       dhdp->info->bus_user_count++;
+}
+
+void
+dhdsdio_bus_usr_cnt_dec(dhd_pub_t *dhdp)
+{
+       dhdp->info->bus_user_count--;
+}
+
+/* Return values:
+ * Success: Returns 0
+ * Failure: Returns -1 or errono code
+ */
+int
+dhd_bus_get(wlan_bt_handle_t handle, bus_owner_t owner)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)handle;
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+       int ret = 0;
+
+       mutex_lock(&dhd->bus_user_lock);
+       ++dhd->bus_user_count;
+       if (dhd->bus_user_count < 0) {
+               DHD_ERROR(("%s(): bus_user_count is negative, which is invalid\n", __FUNCTION__));
+               ret = -1;
+               goto exit;
+       }
+
+       if (dhd->bus_user_count == 1) {
+
+               dhd->pub.hang_was_sent = 0;
+
+               /* First user, turn on WL_REG, start the bus */
+               DHD_ERROR(("%s(): First user Turn On WL_REG & start the bus", __FUNCTION__));
+
+               if (!wifi_platform_set_power(dhd->adapter, TRUE, WIFI_TURNON_DELAY)) {
+                       /* Enable F1 */
+                       ret = dhd_bus_resume(dhdp, 0);
+                       if (ret) {
+                               DHD_ERROR(("%s(): Failed to enable F1, err=%d\n",
+                                       __FUNCTION__, ret));
+                               goto exit;
+                       }
+               }
+
+               /* XXX Some DHD modules (e.g. cfg80211) configures operation mode based on firmware
+                * name. This is indeed a hack but we have to make it work properly before we have
+                * a better solution
+                */
+               dhd_update_fw_nv_path(dhd);
+               /* update firmware and nvram path to sdio bus */
+               dhd_bus_update_fw_nv_path(dhd->pub.bus,
+                       dhd->fw_path, dhd->nv_path);
+               /* download the firmware, Enable F2 */
+               /* TODO: Should be done only in case of FW switch */
+               ret = dhd_bus_devreset(dhdp, FALSE);
+               dhd_bus_resume(dhdp, 1);
+               if (!ret) {
+                       if (dhd_sync_with_dongle(&dhd->pub) < 0) {
+                               DHD_ERROR(("%s(): Sync with dongle failed!!\n", __FUNCTION__));
+                               ret = -EFAULT;
+                       }
+               } else {
+                       DHD_ERROR(("%s(): Failed to download, err=%d\n", __FUNCTION__, ret));
+               }
+       } else {
+               DHD_ERROR(("%s(): BUS is already acquired, just increase the count %d \r\n",
+                       __FUNCTION__, dhd->bus_user_count));
+       }
+exit:
+       mutex_unlock(&dhd->bus_user_lock);
+       return ret;
+}
+EXPORT_SYMBOL(dhd_bus_get);
+
+/* Return values:
+ * Success: Returns 0
+ * Failure: Returns -1 or errono code
+ */
+int
+dhd_bus_put(wlan_bt_handle_t handle, bus_owner_t owner)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)handle;
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+       int ret = 0;
+       BCM_REFERENCE(owner);
+
+       mutex_lock(&dhd->bus_user_lock);
+       --dhd->bus_user_count;
+       if (dhd->bus_user_count < 0) {
+               DHD_ERROR(("%s(): bus_user_count is negative, which is invalid\n", __FUNCTION__));
+               dhd->bus_user_count = 0;
+               ret = -1;
+               goto exit;
+       }
+
+       if (dhd->bus_user_count == 0) {
+               /* Last user, stop the bus and turn Off WL_REG */
+               DHD_ERROR(("%s(): There are no owners left Trunf Off WL_REG & stop the bus \r\n",
+                       __FUNCTION__));
+#ifdef PROP_TXSTATUS
+               if (dhd->pub.wlfc_enabled) {
+                       dhd_wlfc_deinit(&dhd->pub);
+               }
+#endif /* PROP_TXSTATUS */
+#ifdef PNO_SUPPORT
+               if (dhd->pub.pno_state) {
+                       dhd_pno_deinit(&dhd->pub);
+               }
+#endif /* PNO_SUPPORT */
+#ifdef RTT_SUPPORT
+               if (dhd->pub.rtt_state) {
+                       dhd_rtt_deinit(&dhd->pub);
+               }
+#endif /* RTT_SUPPORT */
+               ret = dhd_bus_devreset(dhdp, TRUE);
+               if (!ret) {
+                       dhd_bus_suspend(dhdp);
+                       wifi_platform_set_power(dhd->adapter, FALSE, WIFI_TURNOFF_DELAY);
+               }
+       } else {
+               DHD_ERROR(("%s(): Other owners using bus, decrease the count %d \r\n",
+                       __FUNCTION__, dhd->bus_user_count));
+       }
+exit:
+       mutex_unlock(&dhd->bus_user_lock);
+       return ret;
+}
+EXPORT_SYMBOL(dhd_bus_put);
+
+int
+dhd_net_bus_get(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return dhd_bus_get(&dhd->pub, WLAN_MODULE);
+}
+
+int
+dhd_net_bus_put(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return dhd_bus_put(&dhd->pub, WLAN_MODULE);
+}
+
+/*
+ * Function to enable the Bus Clock
+ * Returns BCME_OK on success and BCME_xxx on failure
+ *
+ * This function is not callable from non-sleepable context
+ */
+int dhd_bus_clk_enable(wlan_bt_handle_t handle, bus_owner_t owner)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)handle;
+
+       int ret;
+
+       dhd_os_sdlock(dhdp);
+       /*
+        * The second argument is TRUE, that means, we expect
+        * the function to "wait" until the clocks are really
+        * available
+        */
+       ret = __dhdsdio_clk_enable(dhdp->bus, owner, TRUE);
+       dhd_os_sdunlock(dhdp);
+
+       return ret;
+}
+EXPORT_SYMBOL(dhd_bus_clk_enable);
+
+/*
+ * Function to disable the Bus Clock
+ * Returns BCME_OK on success and BCME_xxx on failure
+ *
+ * This function is not callable from non-sleepable context
+ */
+int dhd_bus_clk_disable(wlan_bt_handle_t handle, bus_owner_t owner)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)handle;
+
+       int ret;
+
+       dhd_os_sdlock(dhdp);
+       /*
+        * The second argument is TRUE, that means, we expect
+        * the function to "wait" until the clocks are really
+        * disabled
+        */
+       ret = __dhdsdio_clk_disable(dhdp->bus, owner, TRUE);
+       dhd_os_sdunlock(dhdp);
+
+       return ret;
+}
+EXPORT_SYMBOL(dhd_bus_clk_disable);
+
+/*
+ * Function to reset bt_use_count counter to zero.
+ *
+ * This function is not callable from non-sleepable context
+ */
+void dhd_bus_reset_bt_use_count(wlan_bt_handle_t handle)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)handle;
+
+       /* take the lock and reset bt use count */
+       dhd_os_sdlock(dhdp);
+       dhdsdio_reset_bt_use_count(dhdp->bus);
+       dhd_os_sdunlock(dhdp);
+}
+EXPORT_SYMBOL(dhd_bus_reset_bt_use_count);
+
+void dhd_bus_retry_hang_recovery(wlan_bt_handle_t handle)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)handle;
+       dhd_info_t *dhd = (dhd_info_t*)dhdp->info;
+
+       dhdp->hang_was_sent = 0;
+
+       dhd_os_send_hang_message(&dhd->pub);
+}
+EXPORT_SYMBOL(dhd_bus_retry_hang_recovery);
+
+#endif /* BT_OVER_SDIO */
+
+static int
+dhd_monitor_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+{
+       return 0;
+}
+
+static struct net_device_stats*
+dhd_monitor_get_stats(struct net_device *dev)
+{
+       return &DHD_MON_DEV_STATS(dev);
+}
+
+static const struct net_device_ops netdev_monitor_ops =
+{
+       .ndo_start_xmit = dhd_monitor_start,
+       .ndo_get_stats = dhd_monitor_get_stats,
+       .ndo_do_ioctl = dhd_monitor_ioctl
+};
+
+static void
+dhd_add_monitor_if(dhd_info_t *dhd)
+{
+       struct net_device *dev;
+       char *devname;
+       uint32 scan_suppress = FALSE;
+       int ret = BCME_OK;
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+               return;
+       }
+
+       if (dhd->monitor_dev) {
+               DHD_ERROR(("%s: monitor i/f already exists", __FUNCTION__));
+               return;
+       }
+
+       dev = alloc_etherdev(DHD_MON_DEV_PRIV_SIZE);
+       if (!dev) {
+               DHD_ERROR(("%s: alloc wlif failed\n", __FUNCTION__));
+               return;
+       }
+
+       devname = "radiotap";
+
+       snprintf(dev->name, sizeof(dev->name), "%s%u", devname, dhd->unit);
+
+#ifndef ARPHRD_IEEE80211_PRISM  /* From Linux 2.4.18 */
+#define ARPHRD_IEEE80211_PRISM 802
+#endif
+
+#ifndef ARPHRD_IEEE80211_RADIOTAP
+#define ARPHRD_IEEE80211_RADIOTAP      803 /* IEEE 802.11 + radiotap header */
+#endif /* ARPHRD_IEEE80211_RADIOTAP */
+
+       dev->type = ARPHRD_IEEE80211_RADIOTAP;
+
+       dev->netdev_ops = &netdev_monitor_ops;
+
+       /* XXX: This is called from IOCTL path, in this case, rtnl_lock is already taken.
+        * So, register_netdev() shouldn't be called. It leads to deadlock.
+        * To avoid deadlock due to rtnl_lock(), register_netdevice() should be used.
+        */
+       if (register_netdevice(dev)) {
+               DHD_ERROR(("%s, register_netdev failed for %s\n",
+                       __FUNCTION__, dev->name));
+               free_netdev(dev);
+               return;
+       }
+
+       if (FW_SUPPORTED((&dhd->pub), monitor)) {
+#ifdef DHD_PCIE_RUNTIMEPM
+               /* Disable RuntimePM in monitor mode */
+               DHD_DISABLE_RUNTIME_PM(&dhd->pub);
+               DHD_ERROR(("%s : disable runtime PM in monitor mode\n", __FUNCTION__));
+#endif /* DHD_PCIE_RUNTIME_PM */
+               scan_suppress = TRUE;
+               /* Set the SCAN SUPPRESS Flag in the firmware to disable scan in Monitor mode */
+               ret = dhd_iovar(&dhd->pub, 0, "scansuppress", (char *)&scan_suppress,
+                       sizeof(scan_suppress), NULL, 0, TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: scansuppress set failed, ret=%d\n", __FUNCTION__, ret));
+               }
+       }
+
+       dhd->monitor_dev = dev;
+}
+
+static void
+dhd_del_monitor_if(dhd_info_t *dhd)
+{
+       int ret = BCME_OK;
+       uint32 scan_suppress = FALSE;
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+               return;
+       }
+
+       if (!dhd->monitor_dev) {
+               DHD_ERROR(("%s: monitor i/f doesn't exist\n", __FUNCTION__));
+               return;
+       }
+
+       if (FW_SUPPORTED((&dhd->pub), monitor)) {
+#ifdef DHD_PCIE_RUNTIMEPM
+               /* Enable RuntimePM */
+               DHD_ENABLE_RUNTIME_PM(&dhd->pub);
+               DHD_ERROR(("%s : enabled runtime PM\n", __FUNCTION__));
+#endif /* DHD_PCIE_RUNTIME_PM */
+               scan_suppress = FALSE;
+               /* Unset the SCAN SUPPRESS Flag in the firmware to enable scan */
+               ret = dhd_iovar(&dhd->pub, 0, "scansuppress", (char *)&scan_suppress,
+                               sizeof(scan_suppress), NULL, 0, TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: scansuppress set failed, ret=%d\n", __FUNCTION__, ret));
+               }
+       }
+
+       if (dhd->monitor_dev) {
+               if (dhd->monitor_dev->reg_state == NETREG_UNINITIALIZED) {
+                       free_netdev(dhd->monitor_dev);
+               } else {
+                       if (rtnl_is_locked()) {
+                               unregister_netdevice(dhd->monitor_dev);
+                       } else {
+                               unregister_netdev(dhd->monitor_dev);
+                       }
+               }
+               dhd->monitor_dev = NULL;
+       }
+}
+
+void
+dhd_set_monitor(dhd_pub_t *pub, int ifidx, int val)
+{
+       dhd_info_t *dhd = pub->info;
+
+       DHD_TRACE(("%s: val %d\n", __FUNCTION__, val));
+
+       dhd_net_if_lock_local(dhd);
+       if (!val) {
+                       /* Delete monitor */
+                       dhd_del_monitor_if(dhd);
+       } else {
+                       /* Add monitor */
+                       dhd_add_monitor_if(dhd);
+       }
+       dhd->monitor_type = val;
+       dhd_net_if_unlock_local(dhd);
+}
+#endif /* WL_MONITOR */
+
+#if defined(DHD_H2D_LOG_TIME_SYNC)
+/*
+ * Helper function:
+ * Used for RTE console message time syncing with Host printk
+ */
+void dhd_h2d_log_time_sync_deferred_wq_schedule(dhd_pub_t *dhdp)
+{
+       dhd_info_t *info = dhdp->info;
+
+       /* Ideally the "state" should be always TRUE */
+       dhd_deferred_schedule_work(info->dhd_deferred_wq, NULL,
+                       DHD_WQ_WORK_H2D_CONSOLE_TIME_STAMP_MATCH,
+                       dhd_deferred_work_rte_log_time_sync,
+                       DHD_WQ_WORK_PRIORITY_LOW);
+}
+
+void
+dhd_deferred_work_rte_log_time_sync(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd_info = handle;
+       dhd_pub_t *dhd;
+
+       if (event != DHD_WQ_WORK_H2D_CONSOLE_TIME_STAMP_MATCH) {
+               DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+               return;
+       }
+
+       if (!dhd_info) {
+               DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+               return;
+       }
+
+       dhd = &dhd_info->pub;
+
+       /*
+        * Function to send IOVAR for console timesyncing
+        * between Host and Dongle.
+        * If the IOVAR fails,
+        * 1. dhd_rte_time_sync_ms is set to 0 and
+        * 2. HOST Dongle console time sync will *not* happen.
+        */
+       dhd_h2d_log_time_sync(dhd);
+}
+#endif /* DHD_H2D_LOG_TIME_SYNC */
+
+int dhd_ioctl_process(dhd_pub_t *pub, int ifidx, dhd_ioctl_t *ioc, void *data_buf)
+{
+       int bcmerror = BCME_OK;
+       int buflen = 0;
+       struct net_device *net;
+
+       net = dhd_idx2net(pub, ifidx);
+       if (!net) {
+               bcmerror = BCME_BADARG;
+               /*
+                * The netdev pointer is bad means the DHD can't communicate
+                * to higher layers, so just return from here
+                */
+               return bcmerror;
+       }
+
+       /* check for local dhd ioctl and handle it */
+       if (ioc->driver == DHD_IOCTL_MAGIC) {
+               if (data_buf) {
+                       /* Return error if nvram size is too big */
+                       if (!bcmstricmp((char *)data_buf, "vars")) {
+                               DHD_ERROR(("%s: nvram len(%d) MAX_NVRAMBUF_SIZE(%d)\n",
+                                       __FUNCTION__, ioc->len, MAX_NVRAMBUF_SIZE));
+                               if (ioc->len > MAX_NVRAMBUF_SIZE) {
+                                       DHD_ERROR(("%s: nvram len(%d) > MAX_NVRAMBUF_SIZE(%d)\n",
+                                               __FUNCTION__, ioc->len, MAX_NVRAMBUF_SIZE));
+                                       bcmerror = BCME_BUFTOOLONG;
+                                       goto done;
+                               }
+                               buflen = ioc->len;
+                       } else {
+                               /* This is a DHD IOVAR, truncate buflen to DHD_IOCTL_MAXLEN */
+                               buflen = MIN(ioc->len, DHD_IOCTL_MAXLEN);
+                       }
+               }
+               bcmerror = dhd_ioctl((void *)pub, ioc, data_buf, buflen);
+               if (bcmerror)
+                       pub->bcmerror = bcmerror;
+               goto done;
+       }
+
+       /* This is a WL IOVAR, truncate buflen to WLC_IOCTL_MAXLEN */
+       if (data_buf)
+               buflen = MIN(ioc->len, WLC_IOCTL_MAXLEN);
+
+#ifndef BCMDBUS
+       /* send to dongle (must be up, and wl). */
+       if (pub->busstate == DHD_BUS_DOWN || pub->busstate == DHD_BUS_LOAD) {
+               if ((!pub->dongle_trap_occured) && allow_delay_fwdl) {
+                       int ret;
+                       if (atomic_read(&exit_in_progress)) {
+                               DHD_ERROR(("%s module exit in progress\n", __func__));
+                               bcmerror = BCME_DONGLE_DOWN;
+                               goto done;
+                       }
+                       ret = dhd_bus_start(pub);
+                       if (ret != 0) {
+                               DHD_ERROR(("%s: failed with code %d\n", __FUNCTION__, ret));
+                               bcmerror = BCME_DONGLE_DOWN;
+                               goto done;
+                       }
+               } else {
+                       bcmerror = BCME_DONGLE_DOWN;
+                       goto done;
+               }
+       }
+
+       if (!pub->iswl) {
+               bcmerror = BCME_DONGLE_DOWN;
+               goto done;
+       }
+#endif /* !BCMDBUS */
+
+       /*
+        * Flush the TX queue if required for proper message serialization:
+        * Intercept WLC_SET_KEY IOCTL - serialize M4 send and set key IOCTL to
+        * prevent M4 encryption and
+        * intercept WLC_DISASSOC IOCTL - serialize WPS-DONE and WLC_DISASSOC IOCTL to
+        * prevent disassoc frame being sent before WPS-DONE frame.
+        */
+       if (ioc->cmd == WLC_SET_KEY ||
+           (ioc->cmd == WLC_SET_VAR && data_buf != NULL &&
+            strncmp("wsec_key", data_buf, 9) == 0) ||
+           (ioc->cmd == WLC_SET_VAR && data_buf != NULL &&
+            strncmp("bsscfg:wsec_key", data_buf, 15) == 0) ||
+           ioc->cmd == WLC_DISASSOC)
+               dhd_wait_pend8021x(net);
+
+       if ((ioc->cmd == WLC_SET_VAR || ioc->cmd == WLC_GET_VAR) &&
+               data_buf != NULL && strncmp("rpc_", data_buf, 4) == 0) {
+               bcmerror = BCME_UNSUPPORTED;
+               goto done;
+       }
+
+       /* XXX this typecast is BAD !!! */
+       bcmerror = dhd_wl_ioctl(pub, ifidx, (wl_ioctl_t *)ioc, data_buf, buflen);
+
+done:
+       dhd_check_hang(net, pub, bcmerror);
+
+       return bcmerror;
+}
+
+/* XXX For the moment, local ioctls will return BCM errors */
+/* XXX Others return linux codes, need to be changed... */
+/**
+ * Called by the OS (optionally via a wrapper function).
+ * @param net  Linux per dongle instance
+ * @param ifr  Linux request structure
+ * @param cmd  e.g. SIOCETHTOOL
+ */
+static int
+dhd_ioctl_entry(struct net_device *net, struct ifreq *ifr, int cmd)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+       dhd_ioctl_t ioc;
+       int bcmerror = 0;
+       int ifidx;
+       int ret;
+       void *local_buf = NULL;           /**< buffer in kernel space */
+       void __user *ioc_buf_user = NULL; /**< buffer in user space */
+       u16 buflen = 0;
+
+       if (atomic_read(&exit_in_progress)) {
+               DHD_ERROR(("%s module exit in progress\n", __func__));
+               bcmerror = BCME_DONGLE_DOWN;
+               return OSL_ERROR(bcmerror);
+       }
+
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+
+       /* Interface up check for built-in type */
+       if (!dhd_download_fw_on_driverload && dhd->pub.up == FALSE) {
+               DHD_ERROR(("%s: Interface is down \n", __FUNCTION__));
+               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+               return OSL_ERROR(BCME_NOTUP);
+       }
+
+       ifidx = dhd_net2idx(dhd, net);
+       DHD_TRACE(("%s: ifidx %d, cmd 0x%04x\n", __FUNCTION__, ifidx, cmd));
+
+#if defined(WL_STATIC_IF)
+       /* skip for static ndev when it is down */
+       if (dhd_is_static_ndev(&dhd->pub, net) && !(net->flags & IFF_UP)) {
+               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+               return -1;
+       }
+#endif /* WL_STATIC_iF */
+
+       if (ifidx == DHD_BAD_IF) {
+               DHD_ERROR(("%s: BAD IF\n", __FUNCTION__));
+               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+               return -1;
+       }
+
+#if defined(WL_WIRELESS_EXT)
+       /* linux wireless extensions */
+       if ((cmd >= SIOCIWFIRST) && (cmd <= SIOCIWLAST)) {
+               /* may recurse, do NOT lock */
+               ret = wl_iw_ioctl(net, ifr, cmd);
+               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+               return ret;
+       }
+#endif /* defined(WL_WIRELESS_EXT) */
+
+       if (cmd == SIOCETHTOOL) {
+               ret = dhd_ethtool(dhd, (void*)ifr->ifr_data);
+               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+               return ret;
+       }
+
+       if (cmd == SIOCDEVPRIVATE+1) {
+               ret = wl_android_priv_cmd(net, ifr);
+               dhd_check_hang(net, &dhd->pub, ret);
+               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+               return ret;
+       }
+
+       if (cmd != SIOCDEVPRIVATE) {
+               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+               return -EOPNOTSUPP;
+       }
+
+       memset(&ioc, 0, sizeof(ioc));
+
+#ifdef CONFIG_COMPAT
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 6, 0))
+       if (in_compat_syscall())
+#else
+       if (is_compat_task()) 
+#endif /* LINUX_VER >= 4.6 */
+       {
+               compat_wl_ioctl_t compat_ioc;
+               if (copy_from_user(&compat_ioc, ifr->ifr_data, sizeof(compat_wl_ioctl_t))) {
+                       bcmerror = BCME_BADADDR;
+                       goto done;
+               }
+               ioc.cmd = compat_ioc.cmd;
+               if (ioc.cmd & WLC_SPEC_FLAG) {
+                       memset(&ioc, 0, sizeof(ioc));
+                       /* Copy the ioc control structure part of ioctl request */
+                       if (copy_from_user(&ioc, ifr->ifr_data, sizeof(wl_ioctl_t))) {
+                               bcmerror = BCME_BADADDR;
+                               goto done;
+                       }
+                       ioc.cmd &= ~WLC_SPEC_FLAG; /* Clear the FLAG */
+
+                       /* To differentiate between wl and dhd read 4 more byes */
+                       if ((copy_from_user(&ioc.driver, (char *)ifr->ifr_data + sizeof(wl_ioctl_t),
+                               sizeof(uint)) != 0)) {
+                               bcmerror = BCME_BADADDR;
+                               goto done;
+                       }
+
+               } else { /* ioc.cmd & WLC_SPEC_FLAG */
+                       ioc.buf = compat_ptr(compat_ioc.buf);
+                       ioc.len = compat_ioc.len;
+                       ioc.set = compat_ioc.set;
+                       ioc.used = compat_ioc.used;
+                       ioc.needed = compat_ioc.needed;
+                       /* To differentiate between wl and dhd read 4 more byes */
+                       if ((copy_from_user(&ioc.driver, (char *)ifr->ifr_data + sizeof(compat_wl_ioctl_t),
+                               sizeof(uint)) != 0)) {
+                               bcmerror = BCME_BADADDR;
+                               goto done;
+                       }
+               } /* ioc.cmd & WLC_SPEC_FLAG */
+       } else
+#endif /* CONFIG_COMPAT */
+       {
+               /* Copy the ioc control structure part of ioctl request */
+               if (copy_from_user(&ioc, ifr->ifr_data, sizeof(wl_ioctl_t))) {
+                       bcmerror = BCME_BADADDR;
+                       goto done;
+               }
+#ifdef CONFIG_COMPAT
+               ioc.cmd &= ~WLC_SPEC_FLAG; /* make sure it was clear when it isn't a compat task*/
+#endif
+
+               /* To differentiate between wl and dhd read 4 more byes */
+               if ((copy_from_user(&ioc.driver, (char *)ifr->ifr_data + sizeof(wl_ioctl_t),
+                       sizeof(uint)) != 0)) {
+                       bcmerror = BCME_BADADDR;
+                       goto done;
+               }
+       }
+
+#ifndef CONFIG_VTS_SUPPORT
+       if (!capable(CAP_NET_ADMIN)) {
+               bcmerror = BCME_EPERM;
+               goto done;
+       }
+#endif
+
+       /* Take backup of ioc.buf and restore later */
+       ioc_buf_user = ioc.buf;
+
+       if (ioc.len > 0) {
+               buflen = MIN(ioc.len, DHD_IOCTL_MAXLEN);
+               if (!(local_buf = MALLOC(dhd->pub.osh, buflen+1))) {
+                       bcmerror = BCME_NOMEM;
+                       goto done;
+               }
+
+               if (copy_from_user(local_buf, ioc.buf, buflen)) {
+                       bcmerror = BCME_BADADDR;
+                       goto done;
+               }
+
+               *((char *)local_buf + buflen) = '\0';
+
+               /* For some platforms accessing userspace memory
+                * of ioc.buf is causing kernel panic, so to avoid that
+                * make ioc.buf pointing to kernel space memory local_buf
+                */
+               ioc.buf = local_buf;
+       }
+
+       /* Skip all the non DHD iovars (wl iovars) after f/w hang */
+       if (ioc.driver != DHD_IOCTL_MAGIC && dhd->pub.hang_was_sent) {
+               DHD_TRACE(("%s: HANG was sent up earlier\n", __FUNCTION__));
+               DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE(&dhd->pub, DHD_EVENT_TIMEOUT_MS);
+               bcmerror = BCME_DONGLE_DOWN;
+               goto done;
+       }
+
+       bcmerror = dhd_ioctl_process(&dhd->pub, ifidx, &ioc, local_buf);
+
+       /* Restore back userspace pointer to ioc.buf */
+       ioc.buf = ioc_buf_user;
+
+       if (!bcmerror && buflen && local_buf && ioc.buf) {
+               if (copy_to_user(ioc.buf, local_buf, buflen))
+                       bcmerror = -EFAULT;
+       }
+
+done:
+       if (local_buf)
+               MFREE(dhd->pub.osh, local_buf, buflen+1);
+
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+       return OSL_ERROR(bcmerror);
+}
+
+#if defined(WL_CFG80211) && defined(SUPPORT_DEEP_SLEEP)
+/* Flags to indicate if we distingish power off policy when
+ * user set the memu "Keep Wi-Fi on during sleep" to "Never"
+ */
+int trigger_deep_sleep = 0;
+#endif /* WL_CFG80211 && SUPPORT_DEEP_SLEEP */
+
+#ifdef FIX_CPU_MIN_CLOCK
+static int dhd_init_cpufreq_fix(dhd_info_t *dhd)
+{
+       if (dhd) {
+               mutex_init(&dhd->cpufreq_fix);
+               dhd->cpufreq_fix_status = FALSE;
+       }
+       return 0;
+}
+
+static void dhd_fix_cpu_freq(dhd_info_t *dhd)
+{
+       mutex_lock(&dhd->cpufreq_fix);
+       if (dhd && !dhd->cpufreq_fix_status) {
+               pm_qos_add_request(&dhd->dhd_cpu_qos, PM_QOS_CPU_FREQ_MIN, 300000);
+#ifdef FIX_BUS_MIN_CLOCK
+               pm_qos_add_request(&dhd->dhd_bus_qos, PM_QOS_BUS_THROUGHPUT, 400000);
+#endif /* FIX_BUS_MIN_CLOCK */
+               DHD_ERROR(("pm_qos_add_requests called\n"));
+
+               dhd->cpufreq_fix_status = TRUE;
+       }
+       mutex_unlock(&dhd->cpufreq_fix);
+}
+
+static void dhd_rollback_cpu_freq(dhd_info_t *dhd)
+{
+       mutex_lock(&dhd ->cpufreq_fix);
+       if (dhd && dhd->cpufreq_fix_status != TRUE) {
+               mutex_unlock(&dhd->cpufreq_fix);
+               return;
+       }
+
+       pm_qos_remove_request(&dhd->dhd_cpu_qos);
+#ifdef FIX_BUS_MIN_CLOCK
+       pm_qos_remove_request(&dhd->dhd_bus_qos);
+#endif /* FIX_BUS_MIN_CLOCK */
+       DHD_ERROR(("pm_qos_add_requests called\n"));
+
+       dhd->cpufreq_fix_status = FALSE;
+       mutex_unlock(&dhd->cpufreq_fix);
+}
+#endif /* FIX_CPU_MIN_CLOCK */
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+static int
+dhd_ioctl_entry_wrapper(struct net_device *net, struct ifreq *ifr, int cmd)
+{
+       int error;
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+
+       if (atomic_read(&dhd->pub.block_bus))
+               return -EHOSTDOWN;
+
+       if (pm_runtime_get_sync(dhd_bus_to_dev(dhd->pub.bus)) < 0)
+               return BCME_ERROR;
+
+       error = dhd_ioctl_entry(net, ifr, cmd);
+
+       pm_runtime_mark_last_busy(dhd_bus_to_dev(dhd->pub.bus));
+       pm_runtime_put_autosuspend(dhd_bus_to_dev(dhd->pub.bus));
+
+       return error;
+}
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+static int
+dhd_stop(struct net_device *net)
+{
+       int ifidx = 0;
+       bool skip_reset = false;
+#ifdef WL_CFG80211
+       unsigned long flags = 0;
+#ifdef WL_STATIC_IF
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+#endif /* WL_STATIC_IF */
+#endif /* WL_CFG80211 */
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+       WL_MSG(net->name, "Enter\n");
+       dhd->pub.rxcnt_timeout = 0;
+       dhd->pub.txcnt_timeout = 0;
+
+#ifdef BCMPCIE
+       dhd->pub.d3ackcnt_timeout = 0;
+#endif /* BCMPCIE */
+
+       mutex_lock(&dhd->pub.ndev_op_sync);
+       if (dhd->pub.up == 0) {
+               goto exit;
+       }
+#if defined(DHD_HANG_SEND_UP_TEST)
+       if (dhd->pub.req_hang_type) {
+               DHD_ERROR(("%s, Clear HANG test request 0x%x\n",
+                       __FUNCTION__, dhd->pub.req_hang_type));
+               dhd->pub.req_hang_type = 0;
+       }
+#endif /* DHD_HANG_SEND_UP_TEST */
+
+#ifdef FIX_CPU_MIN_CLOCK
+       if (dhd_get_fw_mode(dhd) == DHD_FLAG_HOSTAP_MODE)
+               dhd_rollback_cpu_freq(dhd);
+#endif /* FIX_CPU_MIN_CLOCK */
+
+       ifidx = dhd_net2idx(dhd, net);
+       BCM_REFERENCE(ifidx);
+
+       DHD_ERROR(("%s: ######### called for ifidx=%d #########\n", __FUNCTION__, ifidx));
+
+#if defined(WL_STATIC_IF) && defined(WL_CFG80211)
+       /* If static if is operational, don't reset the chip */
+       if (IS_CFG80211_STATIC_IF_ACTIVE(cfg)) {
+               WL_MSG(net->name, "static if operational. skip chip reset.\n");
+               skip_reset = true;
+               wl_cfg80211_sta_ifdown(net);
+               goto exit;
+       }
+#endif /* WL_STATIC_IF && WL_CFG80211 */
+       if (dhd->pub.skip_dhd_stop) {
+               WL_MSG(net->name, "skip chip reset.\n");
+               skip_reset = true;
+#if defined(WL_CFG80211)
+               wl_cfg80211_sta_ifdown(net);
+#endif /* WL_CFG80211 */
+               goto exit;
+       }
+
+#ifdef WL_CFG80211
+       if (ifidx == 0) {
+               dhd_if_t *ifp;
+               wl_cfg80211_down(net);
+
+               DHD_ERROR(("%s: making dhdpub up FALSE\n", __FUNCTION__));
+#ifdef WL_CFG80211
+               /* Disable Runtime PM before interface down */
+               DHD_STOP_RPM_TIMER(&dhd->pub);
+
+               DHD_UP_LOCK(&dhd->pub.up_lock, flags);
+               dhd->pub.up = 0;
+               DHD_UP_UNLOCK(&dhd->pub.up_lock, flags);
+#else
+               dhd->pub.up = 0;
+#endif /* WL_CFG80211 */
+
+               ifp = dhd->iflist[0];
+               /*
+                * For CFG80211: Clean up all the left over virtual interfaces
+                * when the primary Interface is brought down. [ifconfig wlan0 down]
+                */
+               if (!dhd_download_fw_on_driverload) {
+                       DHD_STATLOG_CTRL(&dhd->pub, ST(WLAN_POWER_OFF), ifidx, 0);
+                       if ((dhd->dhd_state & DHD_ATTACH_STATE_ADD_IF) &&
+                               (dhd->dhd_state & DHD_ATTACH_STATE_CFG80211)) {
+                               int i;
+#ifdef DHD_4WAYM4_FAIL_DISCONNECT
+                               dhd_cleanup_m4_state_work(&dhd->pub, ifidx);
+#endif /* DHD_4WAYM4_FAIL_DISCONNECT */
+#ifdef DHD_PKTDUMP_ROAM
+                               dhd_dump_pkt_clear(&dhd->pub);
+#endif /* DHD_PKTDUMP_ROAM */
+
+                               dhd_net_if_lock_local(dhd);
+                               for (i = 1; i < DHD_MAX_IFS; i++)
+                                       dhd_remove_if(&dhd->pub, i, FALSE);
+
+                               if (ifp && ifp->net) {
+                                       dhd_if_del_sta_list(ifp);
+                               }
+#ifdef ARP_OFFLOAD_SUPPORT
+                               if (dhd_inetaddr_notifier_registered) {
+                                       dhd_inetaddr_notifier_registered = FALSE;
+                                       unregister_inetaddr_notifier(&dhd_inetaddr_notifier);
+                               }
+#endif /* ARP_OFFLOAD_SUPPORT */
+#if defined(CONFIG_IPV6) && defined(IPV6_NDO_SUPPORT)
+                               if (dhd_inet6addr_notifier_registered) {
+                                       dhd_inet6addr_notifier_registered = FALSE;
+                                       unregister_inet6addr_notifier(&dhd_inet6addr_notifier);
+                               }
+#endif /* CONFIG_IPV6 && IPV6_NDO_SUPPORT */
+                               dhd_net_if_unlock_local(dhd);
+                       }
+#if 0
+                       // terence 20161024: remove this to prevent dev_close() get stuck in dhd_hang_process
+                       cancel_work_sync(dhd->dhd_deferred_wq);
+#endif
+
+#ifdef SHOW_LOGTRACE
+                       /* Wait till event logs work/kthread finishes */
+                       dhd_cancel_logtrace_process_sync(dhd);
+#endif /* SHOW_LOGTRACE */
+
+#ifdef EWP_EDL
+                       cancel_delayed_work_sync(&dhd->edl_dispatcher_work);
+#endif
+
+#if defined(DHD_LB_RXP)
+                       __skb_queue_purge(&dhd->rx_pend_queue);
+#endif /* DHD_LB_RXP */
+
+#if defined(DHD_LB_TXP)
+                       skb_queue_purge(&dhd->tx_pend_queue);
+#endif /* DHD_LB_TXP */
+               }
+#ifdef DHDTCPACK_SUPPRESS
+               dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_OFF);
+#endif /* DHDTCPACK_SUPPRESS */
+#if defined(DHD_LB_RXP)
+               if (ifp && ifp->net == dhd->rx_napi_netdev) {
+                       DHD_INFO(("%s napi<%p> disabled ifp->net<%p,%s>\n",
+                               __FUNCTION__, &dhd->rx_napi_struct, net, net->name));
+                       skb_queue_purge(&dhd->rx_napi_queue);
+                       napi_disable(&dhd->rx_napi_struct);
+                       netif_napi_del(&dhd->rx_napi_struct);
+                       dhd->rx_napi_netdev = NULL;
+               }
+#endif /* DHD_LB_RXP */
+       }
+#endif /* WL_CFG80211 */
+
+       DHD_SSSR_DUMP_DEINIT(&dhd->pub);
+#ifdef DHD_SDTC_ETB_DUMP
+       if (dhd->pub.sdtc_etb_inited) {
+               dhd_sdtc_etb_deinit(&dhd->pub);
+       }
+#endif /* DHD_SDTC_ETB_DUMP */
+
+#ifdef PROP_TXSTATUS
+       dhd_wlfc_cleanup(&dhd->pub, NULL, 0);
+#endif
+#ifdef SHOW_LOGTRACE
+       if (!dhd_download_fw_on_driverload) {
+               /* Release the skbs from queue for WLC_E_TRACE event */
+               dhd_event_logtrace_flush_queue(&dhd->pub);
+               if (dhd->dhd_state & DHD_ATTACH_LOGTRACE_INIT) {
+                       if (dhd->event_data.fmts) {
+                               MFREE(dhd->pub.osh, dhd->event_data.fmts,
+                                       dhd->event_data.fmts_size);
+                       }
+                       if (dhd->event_data.raw_fmts) {
+                               MFREE(dhd->pub.osh, dhd->event_data.raw_fmts,
+                                       dhd->event_data.raw_fmts_size);
+                       }
+                       if (dhd->event_data.raw_sstr) {
+                               MFREE(dhd->pub.osh, dhd->event_data.raw_sstr,
+                                       dhd->event_data.raw_sstr_size);
+                       }
+                       if (dhd->event_data.rom_raw_sstr) {
+                               MFREE(dhd->pub.osh, dhd->event_data.rom_raw_sstr,
+                                       dhd->event_data.rom_raw_sstr_size);
+                       }
+                       dhd->dhd_state &= ~DHD_ATTACH_LOGTRACE_INIT;
+               }
+       }
+#endif /* SHOW_LOGTRACE */
+#ifdef APF
+       dhd_dev_apf_delete_filter(net);
+#endif /* APF */
+
+       /* Stop the protocol module */
+       dhd_prot_stop(&dhd->pub);
+
+       OLD_MOD_DEC_USE_COUNT;
+exit:
+       if (skip_reset == false) {
+#if defined(WL_WIRELESS_EXT)
+               if (ifidx == 0) {
+                       wl_iw_down(net, &dhd->pub);
+               }
+#endif /* defined(WL_WIRELESS_EXT) */
+#ifdef WL_ESCAN
+               if (ifidx == 0) {
+                       wl_escan_down(net, &dhd->pub);
+               }
+#endif /* WL_ESCAN */
+               if (ifidx == 0 && !dhd_download_fw_on_driverload) {
+#if defined(WLAN_ACCEL_BOOT)
+                       wl_android_wifi_accel_off(net, dhd->wl_accel_force_reg_on);
+#else
+#if defined(BT_OVER_SDIO)
+                       dhd_bus_put(&dhd->pub, WLAN_MODULE);
+                       wl_android_set_wifi_on_flag(FALSE);
+#else
+                       wl_android_wifi_off(net, TRUE);
+#if defined(WL_EXT_IAPSTA) || defined(USE_IW) || defined(WL_ESCAN)
+#ifdef WL_EXT_IAPSTA
+                       wl_ext_iapsta_dettach_netdev(net, ifidx);
+#endif /* WL_EXT_IAPSTA */
+#ifdef WL_ESCAN
+                       wl_escan_event_dettach(net, &dhd->pub);
+#endif /* WL_ESCAN */
+                       wl_ext_event_dettach_netdev(net, ifidx);
+#endif /* WL_EXT_IAPSTA || USE_IW || WL_ESCAN */
+#endif /* BT_OVER_SDIO */
+#endif /* WLAN_ACCEL_BOOT */
+               }
+#ifdef SUPPORT_DEEP_SLEEP
+               else {
+                       /* CSP#505233: Flags to indicate if we distingish
+                        * power off policy when user set the memu
+                        * "Keep Wi-Fi on during sleep" to "Never"
+                        */
+                       if (trigger_deep_sleep) {
+                               dhd_deepsleep(net, 1);
+                               trigger_deep_sleep = 0;
+                       }
+               }
+#endif /* SUPPORT_DEEP_SLEEP */
+               dhd->pub.hang_was_sent = 0;
+               dhd->pub.hang_was_pending = 0;
+
+               /* Clear country spec for for built-in type driver */
+               if (!dhd_download_fw_on_driverload) {
+                       dhd->pub.dhd_cspec.country_abbrev[0] = 0x00;
+                       dhd->pub.dhd_cspec.rev = 0;
+                       dhd->pub.dhd_cspec.ccode[0] = 0x00;
+               }
+
+#ifdef BCMDBGFS
+               dhd_dbgfs_remove();
+#endif
+       }
+
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+       /* Destroy wakelock */
+       if (!dhd_download_fw_on_driverload &&
+               (dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT) &&
+               (skip_reset == false)) {
+               DHD_OS_WAKE_LOCK_DESTROY(dhd);
+               dhd->dhd_state &= ~DHD_ATTACH_STATE_WAKELOCKS_INIT;
+       }
+       WL_MSG(net->name, "Exit\n");
+
+       mutex_unlock(&dhd->pub.ndev_op_sync);
+       return 0;
+}
+
+#if defined(WL_CFG80211) && (defined(USE_INITIAL_2G_SCAN) || \
+       defined(USE_INITIAL_SHORT_DWELL_TIME))
+extern bool g_first_broadcast_scan;
+#endif /* OEM_ANDROID && WL_CFG80211 && (USE_INITIAL_2G_SCAN || USE_INITIAL_SHORT_DWELL_TIME) */
+
+#ifdef WL11U
+static int dhd_interworking_enable(dhd_pub_t *dhd)
+{
+       uint32 enable = true;
+       int ret = BCME_OK;
+
+       ret = dhd_iovar(dhd, 0, "interworking", (char *)&enable, sizeof(enable), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: enableing interworking failed, ret=%d\n", __FUNCTION__, ret));
+       }
+
+       return ret;
+}
+#endif /* WL11u */
+
+#if defined(WLAN_ACCEL_BOOT)
+void
+dhd_verify_firmware_name_change(dhd_info_t *dhd)
+{
+       DHD_ERROR(("%s: firmware_path:%s dhd->fw_path=%s\n", __FUNCTION__,
+               firmware_path, dhd->fw_path));
+
+       if (firmware_path[0] == '\0') {
+               strlcpy(firmware_path, dhd->fw_path, sizeof(firmware_path));
+       }
+
+       /*
+        * In phones, dhd->fw_path will be appended with chip versions (eg bcmdhd_sta.bin_b0),
+        * so instead of direct compare with module param, search for sub string presence.
+        */
+       if (bcmstrnstr(dhd->fw_path, sizeof(dhd->fw_path), firmware_path, sizeof(firmware_path))
+               == NULL) {
+               DHD_ERROR(("%s: firmware path has changed, set force reg on", __FUNCTION__));
+               dhd->wl_accel_force_reg_on = TRUE;
+       }
+}
+#endif /* WLAN_ACCEL_BOOT */
+
+int
+dhd_open(struct net_device *net)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+#ifdef TOE
+       uint32 toe_ol;
+#endif
+       int ifidx;
+       int32 ret = 0;
+#if defined(OOB_INTR_ONLY)
+       uint32 bus_type = -1;
+       uint32 bus_num = -1;
+       uint32 slot_num = -1;
+       wifi_adapter_info_t *adapter = NULL;
+#endif
+#if defined(WL_EXT_IAPSTA) && defined(ISAM_PREINIT)
+       int bytes_written = 0;
+#endif
+
+#if defined(PREVENT_REOPEN_DURING_HANG)
+       /* WAR : to prevent calling dhd_open abnormally in quick succession after hang event */
+       if (dhd->pub.hang_was_sent == 1) {
+               DHD_ERROR(("%s: HANG was sent up earlier\n", __FUNCTION__));
+               /* Force to bring down WLAN interface in case dhd_stop() is not called
+                * from the upper layer when HANG event is triggered.
+                */
+               if (!dhd_download_fw_on_driverload && dhd->pub.up == 1) {
+                       DHD_ERROR(("%s: WLAN interface is not brought down\n", __FUNCTION__));
+                       dhd_stop(net);
+               } else {
+                       return -1;
+               }
+       }
+#endif /* PREVENT_REOPEN_DURING_HANG */
+
+       mutex_lock(&dhd->pub.ndev_op_sync);
+
+       if (dhd->pub.up == 1) {
+               /* already up */
+               WL_MSG(net->name, "Primary net_device is already up\n");
+               mutex_unlock(&dhd->pub.ndev_op_sync);
+               return BCME_OK;
+       }
+
+       if (!dhd_download_fw_on_driverload) {
+#if defined(WLAN_ACCEL_BOOT)
+               if (dhd->wl_accel_boot_on_done == FALSE) {
+                       DHD_ERROR(("%s: WLAN accel boot not done yet\n", __FUNCTION__));
+                       mutex_unlock(&dhd->pub.ndev_op_sync);
+                       return -1;
+               }
+#endif /* WLAN_ACCEL_BOOT */
+               if (!dhd_driver_init_done) {
+                       DHD_ERROR(("%s: WLAN driver is not initialized\n", __FUNCTION__));
+                       mutex_unlock(&dhd->pub.ndev_op_sync);
+                       return -1;
+               }
+       }
+
+       WL_MSG(net->name, "Enter\n");
+       DHD_MUTEX_LOCK();
+       /* Init wakelock */
+       if (!dhd_download_fw_on_driverload) {
+               if (!(dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT)) {
+                       DHD_OS_WAKE_LOCK_INIT(dhd);
+                       dhd->dhd_state |= DHD_ATTACH_STATE_WAKELOCKS_INIT;
+               }
+
+#ifdef SHOW_LOGTRACE
+               skb_queue_head_init(&dhd->evt_trace_queue);
+
+               if (!(dhd->dhd_state & DHD_ATTACH_LOGTRACE_INIT)) {
+                       ret = dhd_init_logstrs_array(dhd->pub.osh, &dhd->event_data);
+                       if (ret == BCME_OK) {
+                               dhd_init_static_strs_array(dhd->pub.osh, &dhd->event_data,
+                                       st_str_file_path, map_file_path);
+                               dhd_init_static_strs_array(dhd->pub.osh, &dhd->event_data,
+                                       rom_st_str_file_path, rom_map_file_path);
+                               dhd->dhd_state |= DHD_ATTACH_LOGTRACE_INIT;
+                       }
+               }
+#endif /* SHOW_LOGTRACE */
+       }
+
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+       dhd->pub.dongle_trap_occured = 0;
+       dhd->pub.hang_was_sent = 0;
+       dhd->pub.hang_was_pending = 0;
+       dhd->pub.hang_reason = 0;
+       dhd->pub.iovar_timeout_occured = 0;
+#ifdef PCIE_FULL_DONGLE
+       dhd->pub.d3ack_timeout_occured = 0;
+       dhd->pub.livelock_occured = 0;
+       dhd->pub.pktid_audit_failed = 0;
+#endif /* PCIE_FULL_DONGLE */
+       dhd->pub.iface_op_failed = 0;
+       dhd->pub.scan_timeout_occurred = 0;
+       dhd->pub.scan_busy_occurred = 0;
+       dhd->pub.smmu_fault_occurred = 0;
+#ifdef DHD_LOSSLESS_ROAMING
+       dhd->pub.dequeue_prec_map = ALLPRIO;
+#endif
+#if 0
+       /*
+        * Force start if ifconfig_up gets called before START command
+        *  We keep WEXT's wl_control_wl_start to provide backward compatibility
+        *  This should be removed in the future
+        */
+       ret = wl_control_wl_start(net);
+       if (ret != 0) {
+               DHD_ERROR(("%s: failed with code %d\n", __FUNCTION__, ret));
+               ret = -1;
+               goto exit;
+       }
+
+#endif
+
+       ifidx = dhd_net2idx(dhd, net);
+       DHD_TRACE(("%s: ifidx %d\n", __FUNCTION__, ifidx));
+
+       if (ifidx < 0) {
+               DHD_ERROR(("%s: Error: called with invalid IF\n", __FUNCTION__));
+               ret = -1;
+               goto exit;
+       }
+
+       if (!dhd->iflist[ifidx]) {
+               DHD_ERROR(("%s: Error: called when IF already deleted\n", __FUNCTION__));
+               ret = -1;
+               goto exit;
+       }
+
+       DHD_ERROR(("%s: ######### called for ifidx=%d #########\n", __FUNCTION__, ifidx));
+
+#if defined(WLAN_ACCEL_BOOT)
+       dhd_verify_firmware_name_change(dhd);
+#endif /* WLAN_ACCEL_BOOT */
+
+       if (ifidx == 0) {
+               atomic_set(&dhd->pend_8021x_cnt, 0);
+               if (!dhd_download_fw_on_driverload) {
+                       DHD_ERROR(("\n%s\n", dhd_version));
+                       DHD_STATLOG_CTRL(&dhd->pub, ST(WLAN_POWER_ON), ifidx, 0);
+#if defined(WL_EXT_IAPSTA) || defined(USE_IW) || defined(WL_ESCAN)
+                       wl_ext_event_attach_netdev(net, ifidx, dhd->iflist[ifidx]->bssidx);
+#ifdef WL_ESCAN
+                       wl_escan_event_attach(net, &dhd->pub);
+#endif /* WL_ESCAN */
+#ifdef WL_EXT_IAPSTA
+                       wl_ext_iapsta_attach_netdev(net, ifidx, dhd->iflist[ifidx]->bssidx);
+#endif /* WL_EXT_IAPSTA */
+#endif /* WL_EXT_IAPSTA || USE_IW || WL_ESCAN */
+#if defined(USE_INITIAL_2G_SCAN) || defined(USE_INITIAL_SHORT_DWELL_TIME)
+                       g_first_broadcast_scan = TRUE;
+#endif /* USE_INITIAL_2G_SCAN || USE_INITIAL_SHORT_DWELL_TIME */
+#ifdef SHOW_LOGTRACE
+                       /* dhd_cancel_logtrace_process_sync is called in dhd_stop
+                        * for built-in models. Need to start logtrace kthread before
+                        * calling wifi on, because once wifi is on, EDL will be in action
+                        * any moment, and if kthread is not active, FW event logs will
+                        * not be available
+                        */
+                       if (dhd_reinit_logtrace_process(dhd) != BCME_OK) {
+                               goto exit;
+                       }
+#endif /* SHOW_LOGTRACE */
+#if defined(WLAN_ACCEL_BOOT)
+                       ret = wl_android_wifi_accel_on(net, dhd->wl_accel_force_reg_on);
+                       /* Enable wl_accel_force_reg_on if ON fails, else disable it */
+                       if (ret) {
+                               dhd->wl_accel_force_reg_on = TRUE;
+                       } else {
+                               dhd->wl_accel_force_reg_on = FALSE;
+                       }
+#else
+#if defined(BT_OVER_SDIO)
+                       ret = dhd_bus_get(&dhd->pub, WLAN_MODULE);
+                       wl_android_set_wifi_on_flag(TRUE);
+#else
+                       ret = wl_android_wifi_on(net);
+#endif /* BT_OVER_SDIO */
+#endif /* WLAN_ACCEL_BOOT */
+                       if (ret != 0) {
+                               DHD_ERROR(("%s : wl_android_wifi_on failed (%d)\n",
+                                       __FUNCTION__, ret));
+                               ret = -1;
+                               goto exit;
+                       }
+               }
+#ifdef SUPPORT_DEEP_SLEEP
+               else {
+                       /* Flags to indicate if we distingish
+                        * power off policy when user set the memu
+                        * "Keep Wi-Fi on during sleep" to "Never"
+                        */
+                       if (trigger_deep_sleep) {
+#if defined(USE_INITIAL_2G_SCAN) || defined(USE_INITIAL_SHORT_DWELL_TIME)
+                               g_first_broadcast_scan = TRUE;
+#endif /* USE_INITIAL_2G_SCAN || USE_INITIAL_SHORT_DWELL_TIME */
+                               dhd_deepsleep(net, 0);
+                               trigger_deep_sleep = 0;
+                       }
+               }
+#endif /* SUPPORT_DEEP_SLEEP */
+#ifdef FIX_CPU_MIN_CLOCK
+               if (dhd_get_fw_mode(dhd) == DHD_FLAG_HOSTAP_MODE) {
+                       dhd_init_cpufreq_fix(dhd);
+                       dhd_fix_cpu_freq(dhd);
+               }
+#endif /* FIX_CPU_MIN_CLOCK */
+#if defined(OOB_INTR_ONLY)
+               if (dhd->pub.conf->dpc_cpucore >= 0) {
+                       dhd_bus_get_ids(dhd->pub.bus, &bus_type, &bus_num, &slot_num);
+                       adapter = dhd_wifi_platform_get_adapter(bus_type, bus_num, slot_num);
+                       if (adapter) {
+                               printf("%s: set irq affinity hit %d\n", __FUNCTION__, dhd->pub.conf->dpc_cpucore);
+                               irq_set_affinity_hint(adapter->irq_num, cpumask_of(dhd->pub.conf->dpc_cpucore));
+                       }
+               }
+#endif
+
+               if (dhd->pub.busstate != DHD_BUS_DATA) {
+#ifdef BCMDBUS
+                       dhd_set_path(&dhd->pub);
+                       DHD_MUTEX_UNLOCK();
+                       wait_event_interruptible_timeout(dhd->adapter->status_event,
+                               wifi_get_adapter_status(dhd->adapter, WIFI_STATUS_FW_READY),
+                               msecs_to_jiffies(DHD_FW_READY_TIMEOUT));
+                       DHD_MUTEX_LOCK();
+                       if ((ret = dbus_up(dhd->pub.bus)) != 0) {
+                               DHD_ERROR(("%s: failed to dbus_up with code %d\n", __FUNCTION__, ret));
+                               goto exit;
+                       } else {
+                               dhd->pub.busstate = DHD_BUS_DATA;
+                       }
+                       if ((ret = dhd_sync_with_dongle(&dhd->pub)) < 0) {
+                               DHD_ERROR(("%s: failed with code %d\n", __FUNCTION__, ret));
+                               goto exit;
+                       }
+#else
+                       /* try to bring up bus */
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+                       if (pm_runtime_get_sync(dhd_bus_to_dev(dhd->pub.bus)) >= 0) {
+                               ret = dhd_bus_start(&dhd->pub);
+                               pm_runtime_mark_last_busy(dhd_bus_to_dev(dhd->pub.bus));
+                               pm_runtime_put_autosuspend(dhd_bus_to_dev(dhd->pub.bus));
+                       }
+#else
+                       ret = dhd_bus_start(&dhd->pub);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+                       if (ret) {
+                               DHD_ERROR(("%s: failed with code %d\n", __FUNCTION__, ret));
+                               ret = -1;
+                               goto exit;
+                       }
+#endif /* !BCMDBUS */
+
+               }
+#ifdef WL_EXT_IAPSTA
+               wl_ext_iapsta_attach_name(net, ifidx);
+#endif
+
+#ifdef BT_OVER_SDIO
+               if (dhd->pub.is_bt_recovery_required) {
+                       DHD_ERROR(("%s: Send Hang Notification 2 to BT\n", __FUNCTION__));
+                       bcmsdh_btsdio_process_dhd_hang_notification(TRUE);
+               }
+               dhd->pub.is_bt_recovery_required = FALSE;
+#endif
+
+               /* dhd_sync_with_dongle has been called in dhd_bus_start or wl_android_wifi_on */
+               memcpy(net->dev_addr, dhd->pub.mac.octet, ETHER_ADDR_LEN);
+
+#ifdef TOE
+               /* Get current TOE mode from dongle */
+               if (dhd_toe_get(dhd, ifidx, &toe_ol) >= 0 && (toe_ol & TOE_TX_CSUM_OL) != 0) {
+                       dhd->iflist[ifidx]->net->features |= NETIF_F_IP_CSUM;
+               } else {
+                       dhd->iflist[ifidx]->net->features &= ~NETIF_F_IP_CSUM;
+               }
+#endif /* TOE */
+
+#ifdef ENABLE_DHD_GRO
+               dhd->iflist[ifidx]->net->features |= NETIF_F_GRO;
+#endif /* ENABLE_DHD_GRO */
+               netdev_update_features(net);
+
+#if defined(DHD_LB_RXP)
+               __skb_queue_head_init(&dhd->rx_pend_queue);
+               if (dhd->rx_napi_netdev == NULL) {
+                       dhd->rx_napi_netdev = dhd->iflist[ifidx]->net;
+                       memset(&dhd->rx_napi_struct, 0, sizeof(struct napi_struct));
+                       netif_napi_add(dhd->rx_napi_netdev, &dhd->rx_napi_struct,
+                               dhd_napi_poll, dhd_napi_weight);
+                       DHD_INFO(("%s napi<%p> enabled ifp->net<%p,%s>\n",
+                               __FUNCTION__, &dhd->rx_napi_struct, net, net->name));
+                       napi_enable(&dhd->rx_napi_struct);
+                       DHD_INFO(("%s load balance init rx_napi_struct\n", __FUNCTION__));
+                       skb_queue_head_init(&dhd->rx_napi_queue);
+                       __skb_queue_head_init(&dhd->rx_process_queue);
+               } /* rx_napi_netdev == NULL */
+#endif /* DHD_LB_RXP */
+
+#if defined(DHD_LB_TXP)
+               /* Use the variant that uses locks */
+               skb_queue_head_init(&dhd->tx_pend_queue);
+#endif /* DHD_LB_TXP */
+
+#ifdef DHD_PM_OVERRIDE
+               g_pm_override = FALSE;
+#endif /* DHD_PM_OVERRIDE */
+#if defined(WL_CFG80211)
+               if (unlikely(wl_cfg80211_up(net))) {
+                       DHD_ERROR(("%s: failed to bring up cfg80211\n", __FUNCTION__));
+                       ret = -1;
+                       goto exit;
+               }
+               if (!dhd_download_fw_on_driverload) {
+#ifdef ARP_OFFLOAD_SUPPORT
+                       dhd->pend_ipaddr = 0;
+                       if (!dhd_inetaddr_notifier_registered) {
+                               dhd_inetaddr_notifier_registered = TRUE;
+                               register_inetaddr_notifier(&dhd_inetaddr_notifier);
+                       }
+#endif /* ARP_OFFLOAD_SUPPORT */
+#if defined(CONFIG_IPV6) && defined(IPV6_NDO_SUPPORT)
+                       if (!dhd_inet6addr_notifier_registered) {
+                               dhd_inet6addr_notifier_registered = TRUE;
+                               register_inet6addr_notifier(&dhd_inet6addr_notifier);
+                       }
+#endif /* CONFIG_IPV6 && IPV6_NDO_SUPPORT */
+               }
+
+#if defined(DHD_CONTROL_PCIE_ASPM_WIFI_TURNON)
+               dhd_bus_aspm_enable_rc_ep(dhd->pub.bus, TRUE);
+#endif /* DHD_CONTROL_PCIE_ASPM_WIFI_TURNON */
+#if defined(DHD_CONTROL_PCIE_CPUCORE_WIFI_TURNON)
+               dhd_irq_set_affinity(&dhd->pub, cpumask_of(0));
+#endif /* DHD_CONTROL_PCIE_CPUCORE_WIFI_TURNON */
+#if defined(NUM_SCB_MAX_PROBE)
+               dhd_set_scb_probe(&dhd->pub);
+#endif /* NUM_SCB_MAX_PROBE */
+#endif /* WL_CFG80211 */
+#if defined(WL_WIRELESS_EXT)
+               if (unlikely(wl_iw_up(net, &dhd->pub))) {
+                       DHD_ERROR(("%s: failed to bring up wext\n", __FUNCTION__));
+                       ret = -1;
+                       goto exit;
+               }
+#endif
+#ifdef WL_ESCAN
+               if (unlikely(wl_escan_up(net, &dhd->pub))) {
+                       DHD_ERROR(("%s: failed to bring up escan\n", __FUNCTION__));
+                       ret = -1;
+                       goto exit;
+               }
+#endif /* WL_ESCAN */
+#if defined(ISAM_PREINIT)
+               if (!dhd_download_fw_on_driverload) {
+                       if (dhd->pub.conf) {
+                               wl_android_ext_priv_cmd(net, dhd->pub.conf->isam_init, 0, &bytes_written);
+                               wl_android_ext_priv_cmd(net, dhd->pub.conf->isam_config, 0, &bytes_written);
+                               wl_android_ext_priv_cmd(net, dhd->pub.conf->isam_enable, 0, &bytes_written);
+                       }
+               }
+#endif
+       }
+
+       dhd->pub.up = 1;
+       DHD_START_RPM_TIMER(&dhd->pub);
+
+       if (wl_event_enable) {
+               /* For wl utility to receive events */
+               dhd->pub.wl_event_enabled = true;
+       } else {
+               dhd->pub.wl_event_enabled = false;
+       }
+
+       if (logtrace_pkt_sendup) {
+               /* For any deamon to recieve logtrace */
+               dhd->pub.logtrace_pkt_sendup = true;
+       } else {
+               dhd->pub.logtrace_pkt_sendup = false;
+       }
+
+       OLD_MOD_INC_USE_COUNT;
+
+#ifdef BCMDBGFS
+       dhd_dbgfs_init(&dhd->pub);
+#endif
+
+exit:
+       mutex_unlock(&dhd->pub.ndev_op_sync);
+       if (ret) {
+               dhd_stop(net);
+       }
+
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+       DHD_MUTEX_UNLOCK();
+
+       WL_MSG(net->name, "Exit ret=%d\n", ret);
+       return ret;
+}
+
+/*
+ * ndo_start handler for primary ndev
+ */
+static int
+dhd_pri_open(struct net_device *net)
+{
+       s32 ret;
+
+       ret = dhd_open(net);
+       if (unlikely(ret)) {
+               DHD_ERROR(("Failed to open primary dev ret %d\n", ret));
+               return ret;
+       }
+
+       /* Allow transmit calls */
+       dhd_tx_start_queues(net);
+       WL_MSG(net->name, "tx queue started\n");
+       return ret;
+}
+
+/*
+ * ndo_stop handler for primary ndev
+ */
+static int
+dhd_pri_stop(struct net_device *net)
+{
+       s32 ret;
+
+       /* Set state and stop OS transmissions */
+       dhd_tx_stop_queues(net);
+       WL_MSG(net->name, "tx queue stopped\n");
+
+       ret = dhd_stop(net);
+       if (unlikely(ret)) {
+               DHD_ERROR(("dhd_stop failed: %d\n", ret));
+               return ret;
+       }
+
+       return ret;
+}
+
+#ifdef PCIE_INB_DW
+bool
+dhd_check_cfg_in_progress(dhd_pub_t *dhdp)
+{
+#if defined(WL_CFG80211)
+       return wl_cfg80211_check_in_progress(dhd_linux_get_primary_netdev(dhdp));
+#endif /* WL_CFG80211 */
+       return FALSE;
+}
+#endif
+
+#if defined(WL_STATIC_IF) && defined(WL_CFG80211)
+/*
+ * For static I/Fs, the firmware interface init
+ * is done from the IFF_UP context.
+ */
+static int
+dhd_static_if_open(struct net_device *net)
+{
+       s32 ret = 0;
+       struct bcm_cfg80211 *cfg;
+       struct net_device *primary_netdev = NULL;
+
+       cfg = wl_get_cfg(net);
+       primary_netdev = bcmcfg_to_prmry_ndev(cfg);
+
+       if (!IS_CFG80211_STATIC_IF(cfg, net)) {
+               DHD_TRACE(("non-static interface (%s)..do nothing \n", net->name));
+               ret = BCME_OK;
+               goto done;
+       }
+
+       WL_MSG(net->name, "Enter\n");
+       /* Ensure fw is initialized. If it is already initialized,
+        * dhd_open will return success.
+        */
+       ret = dhd_open(primary_netdev);
+       if (unlikely(ret)) {
+               DHD_ERROR(("Failed to open primary dev ret %d\n", ret));
+               goto done;
+       }
+
+       ret = wl_cfg80211_static_if_open(net);
+       if (ret == BCME_OK) {
+               /* Allow transmit calls */
+               netif_start_queue(net);
+       }
+done:
+       WL_MSG(net->name, "Exit ret=%d\n", ret);
+       return ret;
+}
+
+static int
+dhd_static_if_stop(struct net_device *net)
+{
+       struct bcm_cfg80211 *cfg;
+       struct net_device *primary_netdev = NULL;
+       int ret = BCME_OK;
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+
+       WL_MSG(net->name, "Enter\n");
+
+       cfg = wl_get_cfg(net);
+       if (!IS_CFG80211_STATIC_IF(cfg, net)) {
+               DHD_TRACE(("non-static interface (%s)..do nothing \n", net->name));
+               return BCME_OK;
+       }
+       if (dhd->pub.skip_dhd_stop) {
+               WL_MSG(net->name, "Exit skip stop\n");
+               return BCME_OK;
+       }
+
+       /* Ensure queue is disabled */
+       netif_tx_disable(net);
+
+       ret = wl_cfg80211_static_if_close(net);
+
+       if (dhd->pub.up == 0) {
+               /* If fw is down, return */
+               DHD_ERROR(("fw down\n"));
+               return BCME_OK;
+       }
+       /* If STA iface is not in operational, invoke dhd_close from this
+       * context.
+       */
+       primary_netdev = bcmcfg_to_prmry_ndev(cfg);
+       if (!(primary_netdev->flags & IFF_UP)) {
+               ret = dhd_stop(primary_netdev);
+       } else {
+               DHD_ERROR(("Skipped dhd_stop, as sta is operational\n"));
+       }
+       WL_MSG(net->name, "Exit ret=%d\n", ret);
+
+       return ret;
+}
+#endif /* WL_STATIC_IF && WL_CF80211 */
+
+int dhd_do_driver_init(struct net_device *net)
+{
+       dhd_info_t *dhd = NULL;
+
+       if (!net) {
+               DHD_ERROR(("Primary Interface not initialized \n"));
+               return -EINVAL;
+       }
+
+       DHD_MUTEX_IS_LOCK_RETURN();
+
+       /*  && defined(OEM_ANDROID) && defined(BCMSDIO) */
+       dhd = DHD_DEV_INFO(net);
+
+       /* If driver is already initialized, do nothing
+        */
+       if (dhd->pub.busstate == DHD_BUS_DATA) {
+               DHD_TRACE(("Driver already Inititalized. Nothing to do"));
+               return 0;
+       }
+
+       if (dhd_open(net) < 0) {
+               DHD_ERROR(("Driver Init Failed \n"));
+               return -1;
+       }
+
+       return 0;
+}
+
+int
+dhd_event_ifadd(dhd_info_t *dhdinfo, wl_event_data_if_t *ifevent, char *name, uint8 *mac)
+{
+
+#ifdef WL_CFG80211
+               if (wl_cfg80211_notify_ifadd(dhd_linux_get_primary_netdev(&dhdinfo->pub),
+                       ifevent->ifidx, name, mac, ifevent->bssidx, ifevent->role) == BCME_OK)
+               return BCME_OK;
+#endif
+
+       /* handle IF event caused by wl commands, SoftAP, WEXT and
+        * anything else. This has to be done asynchronously otherwise
+        * DPC will be blocked (and iovars will timeout as DPC has no chance
+        * to read the response back)
+        */
+       if (ifevent->ifidx > 0) {
+               dhd_if_event_t *if_event = MALLOC(dhdinfo->pub.osh, sizeof(dhd_if_event_t));
+               if (if_event == NULL) {
+                       DHD_ERROR(("dhd_event_ifadd: Failed MALLOC, malloced %d bytes",
+                               MALLOCED(dhdinfo->pub.osh)));
+                       return BCME_NOMEM;
+               }
+
+               memcpy(&if_event->event, ifevent, sizeof(if_event->event));
+               memcpy(if_event->mac, mac, ETHER_ADDR_LEN);
+               strlcpy(if_event->name, name, sizeof(if_event->name));
+               dhd_deferred_schedule_work(dhdinfo->dhd_deferred_wq, (void *)if_event,
+                       DHD_WQ_WORK_IF_ADD, dhd_ifadd_event_handler, DHD_WQ_WORK_PRIORITY_LOW);
+       }
+
+       return BCME_OK;
+}
+
+int
+dhd_event_ifdel(dhd_info_t *dhdinfo, wl_event_data_if_t *ifevent, char *name, uint8 *mac)
+{
+       dhd_if_event_t *if_event;
+
+#ifdef WL_CFG80211
+               if (wl_cfg80211_notify_ifdel(dhd_linux_get_primary_netdev(&dhdinfo->pub),
+                       ifevent->ifidx, name, mac, ifevent->bssidx) == BCME_OK)
+               return BCME_OK;
+#endif /* WL_CFG80211 */
+
+       /* handle IF event caused by wl commands, SoftAP, WEXT and
+        * anything else
+        */
+       if_event = MALLOC(dhdinfo->pub.osh, sizeof(dhd_if_event_t));
+       if (if_event == NULL) {
+               DHD_ERROR(("dhd_event_ifdel: malloc failed for if_event, malloced %d bytes",
+                       MALLOCED(dhdinfo->pub.osh)));
+               return BCME_NOMEM;
+       }
+       memcpy(&if_event->event, ifevent, sizeof(if_event->event));
+       memcpy(if_event->mac, mac, ETHER_ADDR_LEN);
+       strlcpy(if_event->name, name, sizeof(if_event->name));
+       dhd_deferred_schedule_work(dhdinfo->dhd_deferred_wq, (void *)if_event, DHD_WQ_WORK_IF_DEL,
+               dhd_ifdel_event_handler, DHD_WQ_WORK_PRIORITY_LOW);
+
+       return BCME_OK;
+}
+
+int
+dhd_event_ifchange(dhd_info_t *dhdinfo, wl_event_data_if_t *ifevent, char *name, uint8 *mac)
+{
+#ifdef DHD_UPDATE_INTF_MAC
+       dhd_if_event_t *if_event;
+#endif /* DHD_UPDATE_INTF_MAC */
+
+#ifdef WL_CFG80211
+       wl_cfg80211_notify_ifchange(dhd_linux_get_primary_netdev(&dhdinfo->pub),
+               ifevent->ifidx, name, mac, ifevent->bssidx);
+#endif /* WL_CFG80211 */
+
+#ifdef DHD_UPDATE_INTF_MAC
+       /* handle IF event caused by wl commands, SoftAP, WEXT, MBSS and
+        * anything else
+        */
+       if_event = MALLOC(dhdinfo->pub.osh, sizeof(dhd_if_event_t));
+       if (if_event == NULL) {
+               DHD_ERROR(("dhd_event_ifdel: malloc failed for if_event, malloced %d bytes",
+                       MALLOCED(dhdinfo->pub.osh)));
+               return BCME_NOMEM;
+       }
+       memcpy(&if_event->event, ifevent, sizeof(if_event->event));
+       // construct a change event
+       if_event->event.ifidx = dhd_ifname2idx(dhdinfo, name);
+       if_event->event.opcode = WLC_E_IF_CHANGE;
+       memcpy(if_event->mac, mac, ETHER_ADDR_LEN);
+       strncpy(if_event->name, name, IFNAMSIZ);
+       if_event->name[IFNAMSIZ - 1] = '\0';
+       dhd_deferred_schedule_work(dhdinfo->dhd_deferred_wq, (void *)if_event, DHD_WQ_WORK_IF_UPDATE,
+               dhd_ifupdate_event_handler, DHD_WQ_WORK_PRIORITY_LOW);
+#endif /* DHD_UPDATE_INTF_MAC */
+
+       return BCME_OK;
+}
+
+#ifdef WL_NATOE
+/* Handler to update natoe info and bind with new subscriptions if there is change in config */
+static void
+dhd_natoe_ct_event_hanlder(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+       wl_event_data_natoe_t *natoe = event_info;
+       dhd_nfct_info_t *nfct = dhd->pub.nfct;
+
+       if (event != DHD_WQ_WORK_NATOE_EVENT) {
+               DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+               return;
+       }
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+               return;
+       }
+       if (natoe->natoe_active && natoe->sta_ip && natoe->start_port && natoe->end_port &&
+                       (natoe->start_port < natoe->end_port)) {
+               /* Rebind subscriptions to start receiving notifications from groups */
+               if (dhd_ct_nl_bind(nfct, nfct->subscriptions) < 0) {
+                       dhd_ct_close(nfct);
+               }
+               dhd_ct_send_dump_req(nfct);
+       } else if (!natoe->natoe_active) {
+               /* Rebind subscriptions to stop receiving notifications from groups */
+               if (dhd_ct_nl_bind(nfct, CT_NULL_SUBSCRIPTION) < 0) {
+                       dhd_ct_close(nfct);
+               }
+       }
+}
+
+/* As NATOE enable/disbale event is received, we have to bind with new NL subscriptions.
+ * Scheduling workq to switch from tasklet context as bind call may sleep in handler
+ */
+int
+dhd_natoe_ct_event(dhd_pub_t *dhd, char *data)
+{
+       wl_event_data_natoe_t *event_data = (wl_event_data_natoe_t *)data;
+
+       if (dhd->nfct) {
+               wl_event_data_natoe_t *natoe = dhd->nfct->natoe_info;
+               uint8 prev_enable = natoe->natoe_active;
+
+               spin_lock_bh(&dhd->nfct_lock);
+               memcpy(natoe, event_data, sizeof(*event_data));
+               spin_unlock_bh(&dhd->nfct_lock);
+
+               if (prev_enable != event_data->natoe_active) {
+                       dhd_deferred_schedule_work(dhd->info->dhd_deferred_wq,
+                                       (void *)natoe, DHD_WQ_WORK_NATOE_EVENT,
+                                       dhd_natoe_ct_event_hanlder, DHD_WQ_WORK_PRIORITY_LOW);
+               }
+               return BCME_OK;
+       }
+       DHD_ERROR(("%s ERROR NFCT is not enabled \n", __FUNCTION__));
+       return BCME_ERROR;
+}
+
+/* Handler to send natoe ioctl to dongle */
+static void
+dhd_natoe_ct_ioctl_handler(void *handle, void *event_info, uint8 event)
+{
+       dhd_info_t *dhd = handle;
+       dhd_ct_ioc_t *ct_ioc = event_info;
+
+       if (event != DHD_WQ_WORK_NATOE_IOCTL) {
+               DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+               return;
+       }
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+               return;
+       }
+
+       if (dhd_natoe_prep_send_exception_port_ioctl(&dhd->pub, ct_ioc) < 0) {
+               DHD_ERROR(("%s: Error in sending NATOE IOCTL \n", __FUNCTION__));
+       }
+}
+
+/* When Netlink message contains port collision info, the info must be sent to dongle FW
+ * For that we have to switch context from softirq/tasklet by scheduling workq for natoe_ct ioctl
+ */
+void
+dhd_natoe_ct_ioctl_schedule_work(dhd_pub_t *dhd, dhd_ct_ioc_t *ioc)
+{
+
+       dhd_deferred_schedule_work(dhd->info->dhd_deferred_wq, (void *)ioc,
+                       DHD_WQ_WORK_NATOE_IOCTL, dhd_natoe_ct_ioctl_handler,
+                       DHD_WQ_WORK_PRIORITY_HIGH);
+}
+#endif /* WL_NATOE */
+
+/* This API maps ndev to ifp inclusive of static IFs */
+static dhd_if_t *
+dhd_get_ifp_by_ndev(dhd_pub_t *dhdp, struct net_device *ndev)
+{
+       dhd_if_t *ifp = NULL;
+#ifdef WL_STATIC_IF
+       u32 ifidx = (DHD_MAX_IFS + DHD_MAX_STATIC_IFS - 1);
+#else
+       u32 ifidx = (DHD_MAX_IFS - 1);
+#endif /* WL_STATIC_IF */
+
+       dhd_info_t *dhdinfo = (dhd_info_t *)dhdp->info;
+       do {
+               ifp = dhdinfo->iflist[ifidx];
+               if (ifp && (ifp->net == ndev)) {
+                       DHD_TRACE(("match found for %s. ifidx:%d\n",
+                               ndev->name, ifidx));
+                       return ifp;
+               }
+       } while (ifidx--);
+
+       DHD_ERROR(("no entry found for %s\n", ndev->name));
+       return NULL;
+}
+
+bool
+dhd_is_static_ndev(dhd_pub_t *dhdp, struct net_device *ndev)
+{
+       dhd_if_t *ifp = NULL;
+
+       if (!dhdp || !ndev) {
+               DHD_ERROR(("wrong input\n"));
+               ASSERT(0);
+               return false;
+       }
+
+       ifp = dhd_get_ifp_by_ndev(dhdp, ndev);
+       return (ifp && (ifp->static_if == true));
+}
+
+#ifdef WL_STATIC_IF
+/* In some cases, while registering I/F, the actual ifidx, bssidx and dngl_name
+ * are not known. For e.g: static i/f case. This function lets to update it once
+ * it is known.
+ */
+s32
+dhd_update_iflist_info(dhd_pub_t *dhdp, struct net_device *ndev, int ifidx,
+       uint8 *mac, uint8 bssidx, const char *dngl_name, int if_state)
+{
+       dhd_info_t *dhdinfo = (dhd_info_t *)dhdp->info;
+       dhd_if_t *ifp, *ifp_new;
+       s32 cur_idx;
+       dhd_dev_priv_t * dev_priv;
+
+       DHD_TRACE(("[STATIC_IF] update ifinfo for state:%d ifidx:%d\n",
+                       if_state, ifidx));
+
+       ASSERT(dhdinfo && (ifidx < (DHD_MAX_IFS + DHD_MAX_STATIC_IFS)));
+
+       if ((ifp = dhd_get_ifp_by_ndev(dhdp, ndev)) == NULL) {
+               return -ENODEV;
+       }
+       cur_idx = ifp->idx;
+
+       if (if_state == NDEV_STATE_OS_IF_CREATED) {
+               /* mark static if */
+               ifp->static_if = TRUE;
+               return BCME_OK;
+       }
+
+       ifp_new = dhdinfo->iflist[ifidx];
+       if (ifp_new && (ifp_new != ifp)) {
+               /* There should be only one entry for a given ifidx. */
+               DHD_ERROR(("ifp ptr already present for ifidx:%d\n", ifidx));
+               ASSERT(0);
+               dhdp->hang_reason = HANG_REASON_IFACE_ADD_FAILURE;
+               net_os_send_hang_message(ifp->net);
+               return -EINVAL;
+       }
+
+       /* For static if delete case, cleanup the if before ifidx update */
+       if ((if_state == NDEV_STATE_FW_IF_DELETED) ||
+               (if_state == NDEV_STATE_FW_IF_FAILED)) {
+               dhd_cleanup_if(ifp->net);
+               dev_priv = DHD_DEV_PRIV(ndev);
+               dev_priv->ifidx = ifidx;
+       }
+
+       /* update the iflist ifidx slot with cached info */
+       dhdinfo->iflist[ifidx] = ifp;
+       dhdinfo->iflist[cur_idx] = NULL;
+
+       /* update the values */
+       ifp->idx = ifidx;
+       ifp->bssidx = bssidx;
+
+       if (if_state == NDEV_STATE_FW_IF_CREATED) {
+               dhd_dev_priv_save(ndev, dhdinfo, ifp, ifidx);
+               /* initialize the dongle provided if name */
+               if (dngl_name) {
+                       strncpy(ifp->dngl_name, dngl_name, IFNAMSIZ);
+               } else if (ndev->name[0] != '\0') {
+                       strncpy(ifp->dngl_name, ndev->name, IFNAMSIZ);
+               }
+               if (mac != NULL && ifp->set_macaddress == FALSE) {
+                       /* To and fro locations have same size - ETHER_ADDR_LEN */
+                       (void)memcpy_s(&ifp->mac_addr, ETHER_ADDR_LEN, mac, ETHER_ADDR_LEN);
+               }
+#if defined(WL_EXT_IAPSTA) || defined(USE_IW) || defined(WL_ESCAN)
+               wl_ext_event_attach_netdev(ndev, ifidx, bssidx);
+#ifdef WL_ESCAN
+               wl_escan_event_attach(ndev, dhdp);
+#endif /* WL_ESCAN */
+#ifdef WL_EXT_IAPSTA
+               wl_ext_iapsta_ifadding(ndev, ifidx);
+               wl_ext_iapsta_attach_netdev(ndev, ifidx, bssidx);
+               wl_ext_iapsta_attach_name(ndev, ifidx);
+#endif /* WL_EXT_IAPSTA */
+       } else if (if_state == NDEV_STATE_FW_IF_DELETED) {
+#ifdef WL_EXT_IAPSTA
+               wl_ext_iapsta_dettach_netdev(ndev, cur_idx);
+#endif /* WL_EXT_IAPSTA */
+#ifdef WL_ESCAN
+               wl_escan_event_dettach(ndev, dhdp);
+#endif /* WL_ESCAN */
+               wl_ext_event_dettach_netdev(ndev, cur_idx);
+#endif /* WL_EXT_IAPSTA || USE_IW || WL_ESCAN */
+       }
+       DHD_INFO(("[STATIC_IF] ifp ptr updated for ifidx:%d curidx:%d if_state:%d\n",
+               ifidx, cur_idx, if_state));
+       return BCME_OK;
+}
+#endif /* WL_STATIC_IF */
+
+/* unregister and free the existing net_device interface (if any) in iflist and
+ * allocate a new one. the slot is reused. this function does NOT register the
+ * new interface to linux kernel. dhd_register_if does the job
+ */
+struct net_device*
+dhd_allocate_if(dhd_pub_t *dhdpub, int ifidx, const char *name,
+       uint8 *mac, uint8 bssidx, bool need_rtnl_lock, const char *dngl_name)
+{
+       dhd_info_t *dhdinfo = (dhd_info_t *)dhdpub->info;
+       dhd_if_t *ifp;
+
+       ASSERT(dhdinfo && (ifidx < (DHD_MAX_IFS + DHD_MAX_STATIC_IFS)));
+
+       ifp = dhdinfo->iflist[ifidx];
+
+       if (ifp != NULL) {
+               if (ifp->net != NULL) {
+                       DHD_ERROR(("%s: free existing IF %s ifidx:%d \n",
+                               __FUNCTION__, ifp->net->name, ifidx));
+
+                       if (ifidx == 0) {
+                               /* For primary ifidx (0), there shouldn't be
+                                * any netdev present already.
+                                */
+                               DHD_ERROR(("Primary ifidx populated already\n"));
+                               ASSERT(0);
+                               return NULL;
+                       }
+
+                       dhd_dev_priv_clear(ifp->net); /* clear net_device private */
+
+                       /* in unregister_netdev case, the interface gets freed by net->destructor
+                        * (which is set to free_netdev)
+                        */
+#if defined(CONFIG_TIZEN)
+                       net_stat_tizen_unregister(ifp->net);
+#endif /* CONFIG_TIZEN */
+                       if (ifp->net->reg_state == NETREG_UNINITIALIZED) {
+                               free_netdev(ifp->net);
+                       } else {
+                               dhd_tx_stop_queues(ifp->net);
+                               if (need_rtnl_lock)
+                                       unregister_netdev(ifp->net);
+                               else
+                                       unregister_netdevice(ifp->net);
+                       }
+                       ifp->net = NULL;
+               }
+       } else {
+               ifp = MALLOC(dhdinfo->pub.osh, sizeof(dhd_if_t));
+               if (ifp == NULL) {
+                       DHD_ERROR(("%s: OOM - dhd_if_t(%zu)\n", __FUNCTION__, sizeof(dhd_if_t)));
+                       return NULL;
+               }
+       }
+
+       memset(ifp, 0, sizeof(dhd_if_t));
+       ifp->info = dhdinfo;
+       ifp->idx = ifidx;
+       ifp->bssidx = bssidx;
+#ifdef DHD_MCAST_REGEN
+       ifp->mcast_regen_bss_enable = FALSE;
+#endif
+       /* set to TRUE rx_pkt_chainable at alloc time */
+       ifp->rx_pkt_chainable = TRUE;
+
+       if (mac != NULL)
+               memcpy(&ifp->mac_addr, mac, ETHER_ADDR_LEN);
+
+       /* Allocate etherdev, including space for private structure */
+#ifdef DHD_MQ
+       if (enable_mq) {
+               ifp->net = alloc_etherdev_mq(DHD_DEV_PRIV_SIZE, MQ_MAX_QUEUES);
+       } else {
+               ifp->net = alloc_etherdev(DHD_DEV_PRIV_SIZE);
+       }
+#else
+       ifp->net = alloc_etherdev(DHD_DEV_PRIV_SIZE);
+#endif /* DHD_MQ */
+
+       if (ifp->net == NULL) {
+               DHD_ERROR(("%s: OOM - alloc_etherdev(%zu)\n", __FUNCTION__, sizeof(dhdinfo)));
+               goto fail;
+       }
+
+       /* Setup the dhd interface's netdevice private structure. */
+       dhd_dev_priv_save(ifp->net, dhdinfo, ifp, ifidx);
+
+       if (name && name[0]) {
+               strlcpy(ifp->net->name, name, IFNAMSIZ);
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 9))
+       /* as priv_destructor calls free_netdev, no need to set need_free_netdev */
+       ifp->net->needs_free_netdev = 0;
+#ifdef WL_CFG80211
+       if (ifidx == 0)
+               ifp->net->priv_destructor = free_netdev;
+       else
+               ifp->net->priv_destructor = dhd_netdev_free;
+#else
+       ifp->net->priv_destructor = free_netdev;
+#endif /* WL_CFG80211 */
+#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 9) */
+#ifdef WL_CFG80211
+       if (ifidx == 0)
+               ifp->net->destructor = free_netdev;
+       else
+               ifp->net->destructor = dhd_netdev_free;
+#else
+       ifp->net->destructor = free_netdev;
+#endif /* WL_CFG80211 */
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 9) */
+       strlcpy(ifp->name, ifp->net->name, sizeof(ifp->name));
+       dhdinfo->iflist[ifidx] = ifp;
+
+/* initialize the dongle provided if name */
+       if (dngl_name) {
+               strlcpy(ifp->dngl_name, dngl_name, sizeof(ifp->dngl_name));
+       } else if (name) {
+               strlcpy(ifp->dngl_name, name, sizeof(ifp->dngl_name));
+       }
+
+#ifdef PCIE_FULL_DONGLE
+       /* Initialize STA info list */
+       INIT_LIST_HEAD(&ifp->sta_list);
+       DHD_IF_STA_LIST_LOCK_INIT(&ifp->sta_list_lock);
+#endif /* PCIE_FULL_DONGLE */
+
+#ifdef DHD_L2_FILTER
+       ifp->phnd_arp_table = init_l2_filter_arp_table(dhdpub->osh);
+       ifp->parp_allnode = TRUE;
+#endif /* DHD_L2_FILTER */
+
+       DHD_CUMM_CTR_INIT(&ifp->cumm_ctr);
+
+#ifdef DHD_4WAYM4_FAIL_DISCONNECT
+       INIT_DELAYED_WORK(&ifp->m4state_work, dhd_m4_state_handler);
+#endif /* DHD_4WAYM4_FAIL_DISCONNECT */
+
+#ifdef DHD_POST_EAPOL_M1_AFTER_ROAM_EVT
+       ifp->recv_reassoc_evt = FALSE;
+       ifp->post_roam_evt = FALSE;
+#endif /* DHD_POST_EAPOL_M1_AFTER_ROAM_EVT */
+
+#ifdef DHDTCPSYNC_FLOOD_BLK
+       INIT_WORK(&ifp->blk_tsfl_work, dhd_blk_tsfl_handler);
+       dhd_reset_tcpsync_info_by_ifp(ifp);
+#endif /* DHDTCPSYNC_FLOOD_BLK */
+
+       return ifp->net;
+
+fail:
+       if (ifp != NULL) {
+               if (ifp->net != NULL) {
+#if defined(DHD_LB_RXP) && defined(PCIE_FULL_DONGLE)
+                       if (ifp->net == dhdinfo->rx_napi_netdev) {
+                               napi_disable(&dhdinfo->rx_napi_struct);
+                               netif_napi_del(&dhdinfo->rx_napi_struct);
+                               skb_queue_purge(&dhdinfo->rx_napi_queue);
+                               dhdinfo->rx_napi_netdev = NULL;
+                       }
+#endif /* DHD_LB_RXP && PCIE_FULL_DONGLE */
+                       dhd_dev_priv_clear(ifp->net);
+                       free_netdev(ifp->net);
+                       ifp->net = NULL;
+               }
+               MFREE(dhdinfo->pub.osh, ifp, sizeof(*ifp));
+       }
+       dhdinfo->iflist[ifidx] = NULL;
+       return NULL;
+}
+
+static void
+dhd_cleanup_ifp(dhd_pub_t *dhdp, dhd_if_t *ifp)
+{
+#ifdef PCIE_FULL_DONGLE
+       s32 ifidx = 0;
+       if_flow_lkup_t *if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+#endif /* PCIE_FULL_DONGLE */
+
+       if (ifp != NULL) {
+               if ((ifp->idx < 0) || (ifp->idx >= DHD_MAX_IFS)) {
+                       DHD_ERROR(("Wrong idx:%d \n", ifp->idx));
+                       ASSERT(0);
+                       return;
+               }
+#ifdef DHD_L2_FILTER
+               bcm_l2_filter_arp_table_update(dhdpub->osh, ifp->phnd_arp_table, TRUE,
+                       NULL, FALSE, dhdpub->tickcnt);
+               deinit_l2_filter_arp_table(dhdpub->osh, ifp->phnd_arp_table);
+               ifp->phnd_arp_table = NULL;
+#endif /* DHD_L2_FILTER */
+
+               dhd_if_del_sta_list(ifp);
+#ifdef PCIE_FULL_DONGLE
+               /* Delete flowrings of virtual interface */
+               ifidx = ifp->idx;
+               if ((ifidx != 0) &&
+                   ((if_flow_lkup != NULL) && (if_flow_lkup[ifidx].role != WLC_E_IF_ROLE_AP))) {
+                       dhd_flow_rings_delete(dhdp, ifidx);
+               }
+#endif /* PCIE_FULL_DONGLE */
+       }
+}
+
+void
+dhd_cleanup_if(struct net_device *net)
+{
+       dhd_info_t *dhdinfo = DHD_DEV_INFO(net);
+       dhd_pub_t *dhdp = &dhdinfo->pub;
+       dhd_if_t *ifp;
+
+       ifp = dhd_get_ifp_by_ndev(dhdp, net);
+       if (ifp) {
+               if (ifp->idx >= DHD_MAX_IFS) {
+                       DHD_ERROR(("Wrong ifidx: %p, %d\n", ifp, ifp->idx));
+                       ASSERT(0);
+                       return;
+               }
+               dhd_cleanup_ifp(dhdp, ifp);
+       }
+}
+
+/* unregister and free the the net_device interface associated with the indexed
+ * slot, also free the slot memory and set the slot pointer to NULL
+ */
+#define DHD_TX_COMPLETION_TIMEOUT 5000
+int
+dhd_remove_if(dhd_pub_t *dhdpub, int ifidx, bool need_rtnl_lock)
+{
+       dhd_info_t *dhdinfo = (dhd_info_t *)dhdpub->info;
+       dhd_if_t *ifp;
+       unsigned long flags;
+       long timeout;
+
+       ifp = dhdinfo->iflist[ifidx];
+
+       if (ifp != NULL) {
+#ifdef DHD_4WAYM4_FAIL_DISCONNECT
+               cancel_delayed_work_sync(&ifp->m4state_work);
+#endif /* DHD_4WAYM4_FAIL_DISCONNECT */
+
+#ifdef DHDTCPSYNC_FLOOD_BLK
+               cancel_work_sync(&ifp->blk_tsfl_work);
+#endif /* DHDTCPSYNC_FLOOD_BLK */
+
+               dhd_cleanup_ifp(dhdpub, ifp);
+#ifdef WL_STATIC_IF
+               if (ifp->static_if) {
+                       /* static IF will be handled in detach */
+                       DHD_TRACE(("Skip del iface for static interface\n"));
+                       return BCME_OK;
+               }
+#endif /* WL_STATIC_IF */
+               if (ifp->net != NULL) {
+                       DHD_ERROR(("deleting interface '%s' idx %d\n", ifp->net->name, ifp->idx));
+
+                       DHD_GENERAL_LOCK(dhdpub, flags);
+                       ifp->del_in_progress = true;
+                       DHD_GENERAL_UNLOCK(dhdpub, flags);
+
+                       /* If TX is in progress, hold the if del */
+                       if (DHD_IF_IS_TX_ACTIVE(ifp)) {
+                               DHD_INFO(("TX in progress. Wait for it to be complete."));
+                               timeout = wait_event_timeout(dhdpub->tx_completion_wait,
+                                       ((ifp->tx_paths_active & DHD_TX_CONTEXT_MASK) == 0),
+                                       msecs_to_jiffies(DHD_TX_COMPLETION_TIMEOUT));
+                               if (!timeout) {
+                                       /* Tx completion timeout. Attempt proceeding ahead */
+                                       DHD_ERROR(("Tx completion timed out!\n"));
+                                       ASSERT(0);
+                               }
+                       } else {
+                               DHD_TRACE(("No outstanding TX!\n"));
+                       }
+                       dhdinfo->iflist[ifidx] = NULL;
+                       /* in unregister_netdev case, the interface gets freed by net->destructor
+                        * (which is set to free_netdev)
+                        */
+                       if (ifp->net->reg_state == NETREG_UNINITIALIZED) {
+                               free_netdev(ifp->net);
+                       } else {
+                               netif_tx_disable(ifp->net);
+
+#if (defined(DHDTCPACK_SUPPRESS) && defined(BCMPCIE))
+                               dhd_tcpack_suppress_set(dhdpub, TCPACK_SUP_OFF);
+#endif /* DHDTCPACK_SUPPRESS && BCMPCIE */
+                               if (need_rtnl_lock)
+                                       unregister_netdev(ifp->net);
+                               else
+                                       unregister_netdevice(ifp->net);
+#if defined(WL_EXT_IAPSTA) || defined(USE_IW) || defined(WL_ESCAN)
+#ifdef WL_EXT_IAPSTA
+                               wl_ext_iapsta_dettach_netdev(ifp->net, ifidx);
+#endif /* WL_EXT_IAPSTA */
+#ifdef WL_ESCAN
+                               wl_escan_event_dettach(ifp->net, dhdpub);
+#endif /* WL_ESCAN */
+                               wl_ext_event_dettach_netdev(ifp->net, ifidx);
+#endif /* WL_EXT_IAPSTA || USE_IW || WL_ESCAN */
+                       }
+                       ifp->net = NULL;
+                       DHD_GENERAL_LOCK(dhdpub, flags);
+                       ifp->del_in_progress = false;
+                       DHD_GENERAL_UNLOCK(dhdpub, flags);
+               }
+               DHD_CUMM_CTR_INIT(&ifp->cumm_ctr);
+
+               MFREE(dhdinfo->pub.osh, ifp, sizeof(*ifp));
+               ifp = NULL;
+       }
+
+       return BCME_OK;
+}
+
+static struct net_device_ops dhd_ops_pri = {
+       .ndo_open = dhd_pri_open,
+       .ndo_stop = dhd_pri_stop,
+       .ndo_get_stats = dhd_get_stats,
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       .ndo_do_ioctl = dhd_ioctl_entry_wrapper,
+       .ndo_start_xmit = dhd_start_xmit_wrapper,
+#else
+       .ndo_do_ioctl = dhd_ioctl_entry,
+       .ndo_start_xmit = dhd_start_xmit,
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+       .ndo_set_mac_address = dhd_set_mac_address,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
+       .ndo_set_rx_mode = dhd_set_multicast_list,
+#else
+       .ndo_set_multicast_list = dhd_set_multicast_list,
+#endif
+#ifdef DHD_MQ
+       .ndo_select_queue = dhd_select_queue
+#endif
+};
+
+static struct net_device_ops dhd_ops_virt = {
+#if defined(WL_CFG80211) && defined(WL_STATIC_IF)
+       .ndo_open = dhd_static_if_open,
+       .ndo_stop = dhd_static_if_stop,
+#endif
+       .ndo_get_stats = dhd_get_stats,
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       .ndo_do_ioctl = dhd_ioctl_entry_wrapper,
+       .ndo_start_xmit = dhd_start_xmit_wrapper,
+#else
+       .ndo_do_ioctl = dhd_ioctl_entry,
+       .ndo_start_xmit = dhd_start_xmit,
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+       .ndo_set_mac_address = dhd_set_mac_address,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
+       .ndo_set_rx_mode = dhd_set_multicast_list,
+#else
+       .ndo_set_multicast_list = dhd_set_multicast_list,
+#endif
+};
+
+int
+dhd_os_write_file_posn(void *fp, unsigned long *posn, void *buf,
+               unsigned long buflen)
+{
+       loff_t wr_posn = *posn;
+
+       if (!fp || !buf || buflen == 0)
+               return -1;
+
+       if (vfs_write((struct file *)fp, buf, buflen, &wr_posn) < 0)
+               return -1;
+
+       *posn = wr_posn;
+       return 0;
+}
+
+#ifdef SHOW_LOGTRACE
+int
+dhd_os_read_file(void *file, char *buf, uint32 size)
+{
+       struct file *filep = (struct file *)file;
+
+       if (!file || !buf)
+               return -1;
+
+       return vfs_read(filep, buf, size, &filep->f_pos);
+}
+
+int
+dhd_os_seek_file(void *file, int64 offset)
+{
+       struct file *filep = (struct file *)file;
+       if (!file)
+               return -1;
+
+       /* offset can be -ve */
+       filep->f_pos = filep->f_pos + offset;
+
+       return 0;
+}
+
+static int
+dhd_init_logstrs_array(osl_t *osh, dhd_event_log_t *temp)
+{
+       struct file *filep = NULL;
+       struct kstat stat;
+       mm_segment_t fs;
+       char *raw_fmts =  NULL;
+       int logstrs_size = 0;
+       int error = 0;
+
+       if (control_logtrace != LOGTRACE_PARSED_FMT) {
+               DHD_ERROR_NO_HW4(("%s : turned off logstr parsing\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       filep = filp_open(logstrs_path, O_RDONLY, 0);
+
+       if (IS_ERR(filep)) {
+               DHD_ERROR_NO_HW4(("%s: Failed to open the file %s \n", __FUNCTION__, logstrs_path));
+               goto fail;
+       }
+       error = vfs_stat(logstrs_path, &stat);
+       if (error) {
+               DHD_ERROR_NO_HW4(("%s: Failed to stat file %s \n", __FUNCTION__, logstrs_path));
+               goto fail;
+       }
+       logstrs_size = (int) stat.size;
+
+       if (logstrs_size == 0) {
+               DHD_ERROR(("%s: return as logstrs_size is 0\n", __FUNCTION__));
+               goto fail1;
+       }
+
+       if (temp->raw_fmts != NULL) {
+               raw_fmts = temp->raw_fmts;      /* reuse already malloced raw_fmts */
+       } else {
+               raw_fmts = MALLOC(osh, logstrs_size);
+               if (raw_fmts == NULL) {
+                       DHD_ERROR(("%s: Failed to allocate memory \n", __FUNCTION__));
+                       goto fail;
+               }
+       }
+
+       if (vfs_read(filep, raw_fmts, logstrs_size, &filep->f_pos) !=   logstrs_size) {
+               DHD_ERROR_NO_HW4(("%s: Failed to read file %s\n", __FUNCTION__, logstrs_path));
+               goto fail;
+       }
+
+       if (dhd_parse_logstrs_file(osh, raw_fmts, logstrs_size, temp)
+                               == BCME_OK) {
+               filp_close(filep, NULL);
+               set_fs(fs);
+               return BCME_OK;
+       }
+
+fail:
+       if (raw_fmts) {
+               MFREE(osh, raw_fmts, logstrs_size);
+       }
+       if (temp->fmts != NULL) {
+               MFREE(osh, temp->fmts, temp->num_fmts * sizeof(char *));
+       }
+
+fail1:
+       if (!IS_ERR(filep))
+               filp_close(filep, NULL);
+
+       set_fs(fs);
+       temp->fmts = NULL;
+       temp->raw_fmts = NULL;
+
+       return BCME_ERROR;
+}
+
+static int
+dhd_read_map(osl_t *osh, char *fname, uint32 *ramstart, uint32 *rodata_start,
+               uint32 *rodata_end)
+{
+       struct file *filep = NULL;
+       mm_segment_t fs;
+       int err = BCME_ERROR;
+
+       if (fname == NULL) {
+               DHD_ERROR(("%s: ERROR fname is NULL \n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       filep = filp_open(fname, O_RDONLY, 0);
+       if (IS_ERR(filep)) {
+               DHD_ERROR_NO_HW4(("%s: Failed to open %s \n",  __FUNCTION__, fname));
+               goto fail;
+       }
+
+       if ((err = dhd_parse_map_file(osh, filep, ramstart,
+                       rodata_start, rodata_end)) < 0)
+               goto fail;
+
+fail:
+       if (!IS_ERR(filep))
+               filp_close(filep, NULL);
+
+       set_fs(fs);
+
+       return err;
+}
+
+static int
+dhd_init_static_strs_array(osl_t *osh, dhd_event_log_t *temp, char *str_file, char *map_file)
+{
+       struct file *filep = NULL;
+       mm_segment_t fs;
+       char *raw_fmts =  NULL;
+       uint32 logstrs_size = 0;
+       int error = 0;
+       uint32 ramstart = 0;
+       uint32 rodata_start = 0;
+       uint32 rodata_end = 0;
+       uint32 logfilebase = 0;
+
+       error = dhd_read_map(osh, map_file, &ramstart, &rodata_start, &rodata_end);
+       if (error != BCME_OK) {
+               DHD_ERROR(("readmap Error!! \n"));
+               /* don't do event log parsing in actual case */
+               if (strstr(str_file, ram_file_str) != NULL) {
+                       temp->raw_sstr = NULL;
+               } else if (strstr(str_file, rom_file_str) != NULL) {
+                       temp->rom_raw_sstr = NULL;
+               }
+               return error;
+       }
+       DHD_ERROR(("ramstart: 0x%x, rodata_start: 0x%x, rodata_end:0x%x\n",
+               ramstart, rodata_start, rodata_end));
+
+       fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       filep = filp_open(str_file, O_RDONLY, 0);
+       if (IS_ERR(filep)) {
+               DHD_ERROR(("%s: Failed to open the file %s \n",  __FUNCTION__, str_file));
+               goto fail;
+       }
+
+       if (TRUE) {
+               /* Full file size is huge. Just read required part */
+               logstrs_size = rodata_end - rodata_start;
+               logfilebase = rodata_start - ramstart;
+       }
+
+       if (logstrs_size == 0) {
+               DHD_ERROR(("%s: return as logstrs_size is 0\n", __FUNCTION__));
+               goto fail1;
+       }
+
+       if (strstr(str_file, ram_file_str) != NULL && temp->raw_sstr != NULL) {
+               raw_fmts = temp->raw_sstr;      /* reuse already malloced raw_fmts */
+       } else if (strstr(str_file, rom_file_str) != NULL && temp->rom_raw_sstr != NULL) {
+               raw_fmts = temp->rom_raw_sstr;  /* reuse already malloced raw_fmts */
+       } else {
+               raw_fmts = MALLOC(osh, logstrs_size);
+
+               if (raw_fmts == NULL) {
+                       DHD_ERROR(("%s: Failed to allocate raw_fmts memory \n", __FUNCTION__));
+                       goto fail;
+               }
+       }
+
+       if (TRUE) {
+               error = generic_file_llseek(filep, logfilebase, SEEK_SET);
+               if (error < 0) {
+                       DHD_ERROR(("%s: %s llseek failed %d \n", __FUNCTION__, str_file, error));
+                       goto fail;
+               }
+       }
+
+       error = vfs_read(filep, raw_fmts, logstrs_size, (&filep->f_pos));
+       if (error != logstrs_size) {
+               DHD_ERROR(("%s: %s read failed %d \n", __FUNCTION__, str_file, error));
+               goto fail;
+       }
+
+       if (strstr(str_file, ram_file_str) != NULL) {
+               temp->raw_sstr = raw_fmts;
+               temp->raw_sstr_size = logstrs_size;
+               temp->rodata_start = rodata_start;
+               temp->rodata_end = rodata_end;
+       } else if (strstr(str_file, rom_file_str) != NULL) {
+               temp->rom_raw_sstr = raw_fmts;
+               temp->rom_raw_sstr_size = logstrs_size;
+               temp->rom_rodata_start = rodata_start;
+               temp->rom_rodata_end = rodata_end;
+       }
+
+       filp_close(filep, NULL);
+       set_fs(fs);
+
+       return BCME_OK;
+
+fail:
+       if (raw_fmts) {
+               MFREE(osh, raw_fmts, logstrs_size);
+       }
+
+fail1:
+       if (!IS_ERR(filep))
+               filp_close(filep, NULL);
+
+       set_fs(fs);
+
+       if (strstr(str_file, ram_file_str) != NULL) {
+               temp->raw_sstr = NULL;
+       } else if (strstr(str_file, rom_file_str) != NULL) {
+               temp->rom_raw_sstr = NULL;
+       }
+
+       return error;
+} /* dhd_init_static_strs_array */
+
+#endif /* SHOW_LOGTRACE */
+
+#ifdef DHD_ERPOM
+uint enable_erpom = 0;
+module_param(enable_erpom, int, 0);
+
+int
+dhd_wlan_power_off_handler(void *handler, unsigned char reason)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)handler;
+       bool dongle_isolation = dhdp->dongle_isolation;
+
+       DHD_ERROR(("%s: WLAN DHD cleanup reason: %d\n", __FUNCTION__, reason));
+
+       if ((reason == BY_BT_DUE_TO_BT) || (reason == BY_BT_DUE_TO_WLAN)) {
+#if defined(DHD_FW_COREDUMP)
+               /* save core dump to a file */
+               if (dhdp->memdump_enabled) {
+#ifdef DHD_SSSR_DUMP
+                       DHD_ERROR(("%s : Set collect_sssr as TRUE\n", __FUNCTION__));
+                       dhdp->collect_sssr = TRUE;
+#endif /* DHD_SSSR_DUMP */
+                       dhdp->memdump_type = DUMP_TYPE_DUE_TO_BT;
+                       dhd_bus_mem_dump(dhdp);
+               }
+#endif /* DHD_FW_COREDUMP */
+       }
+
+       /* pause data on all the interfaces */
+       dhd_bus_stop_queue(dhdp->bus);
+
+       /* Devreset function will perform FLR again, to avoid it set dongle_isolation */
+       dhdp->dongle_isolation = TRUE;
+       dhd_bus_devreset(dhdp, 1); /* DHD structure cleanup */
+       dhdp->dongle_isolation = dongle_isolation; /* Restore the old value */
+       return 0;
+}
+
+int
+dhd_wlan_power_on_handler(void *handler, unsigned char reason)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)handler;
+       bool dongle_isolation = dhdp->dongle_isolation;
+
+       DHD_ERROR(("%s: WLAN DHD re-init reason: %d\n", __FUNCTION__, reason));
+       /* Devreset function will perform FLR again, to avoid it set dongle_isolation */
+       dhdp->dongle_isolation = TRUE;
+       dhd_bus_devreset(dhdp, 0); /* DHD structure re-init */
+       dhdp->dongle_isolation = dongle_isolation; /* Restore the old value */
+       /* resume data on all the interfaces */
+       dhd_bus_start_queue(dhdp->bus);
+       return 0;
+
+}
+
+#endif /* DHD_ERPOM */
+
+#ifdef BCMDBUS
+uint
+dhd_get_rxsz(dhd_pub_t *pub)
+{
+       struct net_device *net = NULL;
+       dhd_info_t *dhd = NULL;
+       uint rxsz;
+
+       /* Assign rxsz for dbus_attach */
+       dhd = pub->info;
+       net = dhd->iflist[0]->net;
+       net->hard_header_len = ETH_HLEN + pub->hdrlen;
+       rxsz = DBUS_RX_BUFFER_SIZE_DHD(net);
+
+       return rxsz;
+}
+
+void
+dhd_set_path(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = NULL;
+
+       dhd = pub->info;
+
+       /* try to download image and nvram to the dongle */
+       if      (dhd_update_fw_nv_path(dhd) && dhd->pub.bus) {
+               DHD_INFO(("%s: fw %s, nv %s, conf %s\n",
+                       __FUNCTION__, dhd->fw_path, dhd->nv_path, dhd->conf_path));
+               dhd_bus_update_fw_nv_path(dhd->pub.bus,
+                               dhd->fw_path, dhd->nv_path, dhd->clm_path, dhd->conf_path);
+       }
+}
+#endif
+
+/** Called once for each hardware (dongle) instance that this DHD manages */
+dhd_pub_t *
+dhd_attach(osl_t *osh, struct dhd_bus *bus, uint bus_hdrlen
+#ifdef BCMDBUS
+       , void *data
+#endif
+)
+{
+       dhd_info_t *dhd = NULL;
+       struct net_device *net = NULL;
+       char if_name[IFNAMSIZ] = {'\0'};
+#ifdef SHOW_LOGTRACE
+       int ret;
+#endif /* SHOW_LOGTRACE */
+#ifdef DHD_ERPOM
+       pom_func_handler_t *pom_handler;
+#endif /* DHD_ERPOM */
+#if defined(BCMSDIO) || defined(BCMPCIE)
+       uint32 bus_type = -1;
+       uint32 bus_num = -1;
+       uint32 slot_num = -1;
+       wifi_adapter_info_t *adapter = NULL;
+#elif defined(BCMDBUS)
+       wifi_adapter_info_t *adapter = data;
+#endif
+#ifdef GET_CUSTOM_MAC_ENABLE
+       char hw_ether[62];
+#endif /* GET_CUSTOM_MAC_ENABLE */
+
+       dhd_attach_states_t dhd_state = DHD_ATTACH_STATE_INIT;
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef PCIE_FULL_DONGLE
+       ASSERT(sizeof(dhd_pkttag_fd_t) <= OSL_PKTTAG_SZ);
+       ASSERT(sizeof(dhd_pkttag_fr_t) <= OSL_PKTTAG_SZ);
+#endif /* PCIE_FULL_DONGLE */
+
+       /* will implement get_ids for DBUS later */
+#if defined(BCMSDIO)
+       dhd_bus_get_ids(bus, &bus_type, &bus_num, &slot_num);
+#endif
+#if defined(BCMSDIO) || defined(BCMPCIE)
+       adapter = dhd_wifi_platform_get_adapter(bus_type, bus_num, slot_num);
+#endif
+
+       /* Allocate primary dhd_info */
+       dhd = wifi_platform_prealloc(adapter, DHD_PREALLOC_DHD_INFO, sizeof(dhd_info_t));
+       if (dhd == NULL) {
+               dhd = MALLOC(osh, sizeof(dhd_info_t));
+               if (dhd == NULL) {
+                       DHD_ERROR(("%s: OOM - alloc dhd_info\n", __FUNCTION__));
+                       goto dhd_null_flag;
+               }
+       }
+       memset(dhd, 0, sizeof(dhd_info_t));
+       dhd_state |= DHD_ATTACH_STATE_DHD_ALLOC;
+
+       dhd->unit = dhd_found + instance_base; /* do not increment dhd_found, yet */
+
+       dhd->pub.osh = osh;
+#ifdef DUMP_IOCTL_IOV_LIST
+       dll_init(&(dhd->pub.dump_iovlist_head));
+#endif /* DUMP_IOCTL_IOV_LIST */
+
+       dhd->pub.dhd_console_ms = dhd_console_ms; /* assigns default value */
+
+       dhd->adapter = adapter;
+       dhd->pub.adapter = (void *)adapter;
+#ifdef BT_OVER_SDIO
+       dhd->pub.is_bt_recovery_required = FALSE;
+       mutex_init(&dhd->bus_user_lock);
+#endif /* BT_OVER_SDIO */
+
+       g_dhd_pub = &dhd->pub;
+
+#ifdef DHD_DEBUG
+       dll_init(&(dhd->pub.mw_list_head));
+#endif /* DHD_DEBUG */
+
+#ifdef GET_CUSTOM_MAC_ENABLE
+       wifi_platform_get_mac_addr(dhd->adapter, hw_ether, iface_name);
+       bcopy(hw_ether, dhd->pub.mac.octet, sizeof(struct ether_addr));
+#endif /* GET_CUSTOM_MAC_ENABLE */
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+       dhd->pub.dhd_cflags |= WLAN_PLAT_NODFS_FLAG;
+       dhd->pub.force_country_change = TRUE;
+#endif /* CUSTOM_FORCE_NODFS_FLAG */
+#ifdef CUSTOM_COUNTRY_CODE
+       get_customized_country_code(dhd->adapter,
+               dhd->pub.dhd_cspec.country_abbrev, &dhd->pub.dhd_cspec,
+               dhd->pub.dhd_cflags);
+#endif /* CUSTOM_COUNTRY_CODE */
+#ifndef BCMDBUS
+       dhd->thr_dpc_ctl.thr_pid = DHD_PID_KT_TL_INVALID;
+       dhd->thr_wdt_ctl.thr_pid = DHD_PID_KT_INVALID;
+#ifdef DHD_WET
+       dhd->pub.wet_info = dhd_get_wet_info(&dhd->pub);
+#endif /* DHD_WET */
+       /* Initialize thread based operation and lock */
+       sema_init(&dhd->sdsem, 1);
+#endif /* !BCMDBUS */
+       dhd->pub.pcie_txs_metadata_enable = pcie_txs_metadata_enable;
+
+       /* Link to info module */
+       dhd->pub.info = dhd;
+
+       /* Link to bus module */
+       dhd->pub.bus = bus;
+       dhd->pub.hdrlen = bus_hdrlen;
+       dhd->pub.txoff = FALSE;
+
+       /* dhd_conf must be attached after linking dhd to dhd->pub.info,
+        * because dhd_detech will check .info is NULL or not.
+       */
+       if (dhd_conf_attach(&dhd->pub) != 0) {
+               DHD_ERROR(("dhd_conf_attach failed\n"));
+               goto fail;
+       }
+#ifndef BCMDBUS
+       dhd_conf_reset(&dhd->pub);
+       dhd_conf_set_chiprev(&dhd->pub, dhd_bus_chip(bus), dhd_bus_chiprev(bus));
+       dhd_conf_preinit(&dhd->pub);
+#endif /* !BCMDBUS */
+
+       /* Some DHD modules (e.g. cfg80211) configures operation mode based on firmware name.
+        * This is indeed a hack but we have to make it work properly before we have a better
+        * solution
+        */
+       dhd_update_fw_nv_path(dhd);
+
+       /* Set network interface name if it was provided as module parameter */
+       if (iface_name[0]) {
+               int len;
+               char ch;
+               strlcpy(if_name, iface_name, sizeof(if_name));
+               len = strlen(if_name);
+               ch = if_name[len - 1];
+               if ((ch > '9' || ch < '0') && (len < IFNAMSIZ - 2)) {
+                       strcat(if_name, "%d");
+               }
+       }
+
+       /* Passing NULL to dngl_name to ensure host gets if_name in dngl_name member */
+       net = dhd_allocate_if(&dhd->pub, 0, if_name, NULL, 0, TRUE, NULL);
+       if (net == NULL) {
+               goto fail;
+       }
+       mutex_init(&dhd->pub.ndev_op_sync);
+
+       dhd_state |= DHD_ATTACH_STATE_ADD_IF;
+#ifdef DHD_L2_FILTER
+       /* initialize the l2_filter_cnt */
+       dhd->pub.l2_filter_cnt = 0;
+#endif
+       net->netdev_ops = NULL;
+
+       mutex_init(&dhd->dhd_iovar_mutex);
+       sema_init(&dhd->proto_sem, 1);
+
+#if defined(DHD_HANG_SEND_UP_TEST)
+       dhd->pub.req_hang_type = 0;
+#endif /* DHD_HANG_SEND_UP_TEST */
+
+#ifdef PROP_TXSTATUS
+       spin_lock_init(&dhd->wlfc_spinlock);
+
+       dhd->pub.skip_fc = dhd_wlfc_skip_fc;
+       dhd->pub.plat_init = dhd_wlfc_plat_init;
+       dhd->pub.plat_deinit = dhd_wlfc_plat_deinit;
+
+#ifdef DHD_WLFC_THREAD
+       init_waitqueue_head(&dhd->pub.wlfc_wqhead);
+       dhd->pub.wlfc_thread = kthread_create(dhd_wlfc_transfer_packets, &dhd->pub, "wlfc-thread");
+       if (IS_ERR(dhd->pub.wlfc_thread)) {
+               DHD_ERROR(("create wlfc thread failed\n"));
+               goto fail;
+       } else {
+               wake_up_process(dhd->pub.wlfc_thread);
+       }
+#endif /* DHD_WLFC_THREAD */
+#endif /* PROP_TXSTATUS */
+
+       /* Initialize other structure content */
+       /* XXX Some of this goes away, leftover from USB */
+       /* XXX Some could also move to bus_init()? */
+       init_waitqueue_head(&dhd->ioctl_resp_wait);
+       init_waitqueue_head(&dhd->pub.tx_tput_test_wait);
+       init_waitqueue_head(&dhd->d3ack_wait);
+#ifdef PCIE_INB_DW
+       init_waitqueue_head(&dhd->ds_exit_wait);
+#endif /* PCIE_INB_DW */
+       init_waitqueue_head(&dhd->ctrl_wait);
+       init_waitqueue_head(&dhd->dhd_bus_busy_state_wait);
+       init_waitqueue_head(&dhd->dmaxfer_wait);
+       init_waitqueue_head(&dhd->pub.tx_completion_wait);
+       dhd->pub.dhd_bus_busy_state = 0;
+       /* Initialize the spinlocks */
+       spin_lock_init(&dhd->sdlock);
+       spin_lock_init(&dhd->txqlock);
+       spin_lock_init(&dhd->dhd_lock);
+       spin_lock_init(&dhd->rxf_lock);
+#ifdef WLTDLS
+       spin_lock_init(&dhd->pub.tdls_lock);
+#endif /* WLTDLS */
+#if defined(RXFRAME_THREAD)
+       dhd->rxthread_enabled = TRUE;
+#endif /* defined(RXFRAME_THREAD) */
+
+#ifdef DHDTCPACK_SUPPRESS
+       spin_lock_init(&dhd->tcpack_lock);
+#endif /* DHDTCPACK_SUPPRESS */
+
+       /* Initialize Wakelock stuff */
+       spin_lock_init(&dhd->wakelock_spinlock);
+       spin_lock_init(&dhd->wakelock_evt_spinlock);
+       DHD_OS_WAKE_LOCK_INIT(dhd);
+       dhd->wakelock_counter = 0;
+       /* wakelocks prevent a system from going into a low power state */
+#ifdef CONFIG_HAS_WAKELOCK
+       // terence 20161023: can not destroy wl_wifi when wlan down, it will happen null pointer in dhd_ioctl_entry
+       wake_lock_init(&dhd->wl_wifi, WAKE_LOCK_SUSPEND, "wlan_wake");
+       wake_lock_init(&dhd->wl_wdwake, WAKE_LOCK_SUSPEND, "wlan_wd_wake");
+#endif /* CONFIG_HAS_WAKELOCK */
+
+       mutex_init(&dhd->dhd_net_if_mutex);
+       mutex_init(&dhd->dhd_suspend_mutex);
+#if defined(PKT_FILTER_SUPPORT) && defined(APF)
+       mutex_init(&dhd->dhd_apf_mutex);
+#endif /* PKT_FILTER_SUPPORT && APF */
+       dhd_state |= DHD_ATTACH_STATE_WAKELOCKS_INIT;
+
+       /* Attach and link in the protocol */
+       if (dhd_prot_attach(&dhd->pub) != 0) {
+               DHD_ERROR(("dhd_prot_attach failed\n"));
+               goto fail;
+       }
+       dhd_state |= DHD_ATTACH_STATE_PROT_ATTACH;
+
+#ifdef WL_CFG80211
+       spin_lock_init(&dhd->pub.up_lock);
+       /* Attach and link in the cfg80211 */
+       if (unlikely(wl_cfg80211_attach(net, &dhd->pub))) {
+               DHD_ERROR(("wl_cfg80211_attach failed\n"));
+               goto fail;
+       }
+
+       dhd_monitor_init(&dhd->pub);
+       dhd_state |= DHD_ATTACH_STATE_CFG80211;
+#endif
+
+#if defined(WL_EXT_IAPSTA) || defined(USE_IW) || defined(WL_ESCAN)
+       if (wl_ext_event_attach(net, &dhd->pub) != 0) {
+               DHD_ERROR(("wl_ext_event_attach failed\n"));
+               goto fail;
+       }
+#ifdef WL_ESCAN
+       /* Attach and link in the escan */
+       if (wl_escan_attach(net, &dhd->pub) != 0) {
+               DHD_ERROR(("wl_escan_attach failed\n"));
+               goto fail;
+       }
+#endif /* WL_ESCAN */
+#ifdef WL_EXT_IAPSTA
+       if (wl_ext_iapsta_attach(&dhd->pub) != 0) {
+               DHD_ERROR(("wl_ext_iapsta_attach failed\n"));
+               goto fail;
+       }
+#endif /* WL_EXT_IAPSTA */
+#endif /* WL_EXT_IAPSTA || USE_IW || WL_ESCAN */
+#if defined(WL_WIRELESS_EXT)
+       /* Attach and link in the iw */
+       if (wl_iw_attach(net, &dhd->pub) != 0) {
+               DHD_ERROR(("wl_iw_attach failed\n"));
+               goto fail;
+       }
+       dhd_state |= DHD_ATTACH_STATE_WL_ATTACH;
+#endif /* defined(WL_WIRELESS_EXT) */
+
+#ifdef SHOW_LOGTRACE
+       ret = dhd_init_logstrs_array(osh, &dhd->event_data);
+       if (ret == BCME_OK) {
+               dhd_init_static_strs_array(osh, &dhd->event_data, st_str_file_path, map_file_path);
+               dhd_init_static_strs_array(osh, &dhd->event_data, rom_st_str_file_path,
+                       rom_map_file_path);
+               dhd_state |= DHD_ATTACH_LOGTRACE_INIT;
+       }
+#endif /* SHOW_LOGTRACE */
+
+       /* attach debug if support */
+       if (dhd_os_dbg_attach(&dhd->pub)) {
+               DHD_ERROR(("%s debug module attach failed\n", __FUNCTION__));
+               goto fail;
+       }
+#ifdef DEBUGABILITY
+
+#ifdef DBG_PKT_MON
+       dhd->pub.dbg->pkt_mon_lock = osl_spin_lock_init(dhd->pub.osh);
+#ifdef DBG_PKT_MON_INIT_DEFAULT
+       dhd_os_dbg_attach_pkt_monitor(&dhd->pub);
+#endif /* DBG_PKT_MON_INIT_DEFAULT */
+#endif /* DBG_PKT_MON */
+
+#endif /* DEBUGABILITY */
+
+#ifdef DHD_MEM_STATS
+       dhd->pub.mem_stats_lock = osl_spin_lock_init(dhd->pub.osh);
+       dhd->pub.txpath_mem = 0;
+       dhd->pub.rxpath_mem = 0;
+#endif /* DHD_MEM_STATS */
+
+#ifdef DHD_STATUS_LOGGING
+       dhd->pub.statlog = dhd_attach_statlog(&dhd->pub, MAX_STATLOG_ITEM,
+               MAX_STATLOG_REQ_ITEM, STATLOG_LOGBUF_LEN);
+       if (dhd->pub.statlog == NULL) {
+               DHD_ERROR(("%s: alloc statlog failed\n", __FUNCTION__));
+       }
+#endif /* DHD_STATUS_LOGGING */
+
+#ifdef DHD_LOG_DUMP
+       dhd_log_dump_init(&dhd->pub);
+#endif /* DHD_LOG_DUMP */
+#ifdef DHD_PKTDUMP_ROAM
+       dhd_dump_pkt_init(&dhd->pub);
+#endif /* DHD_PKTDUMP_ROAM */
+#ifdef DHD_PKT_LOGGING
+       dhd_os_attach_pktlog(&dhd->pub);
+#endif /* DHD_PKT_LOGGING */
+
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+       dhd->pub.hang_info = MALLOCZ(osh, VENDOR_SEND_HANG_EXT_INFO_LEN);
+       if (dhd->pub.hang_info == NULL) {
+               DHD_ERROR(("%s: alloc hang_info failed\n", __FUNCTION__));
+       }
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+       if (dhd_sta_pool_init(&dhd->pub, DHD_MAX_STA) != BCME_OK) {
+               DHD_ERROR(("%s: Initializing %u sta\n", __FUNCTION__, DHD_MAX_STA));
+               goto fail;
+       }
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       dhd->tx_wq = alloc_workqueue("bcmdhd-tx-wq", WQ_HIGHPRI | WQ_UNBOUND | WQ_MEM_RECLAIM, 1);
+       if (!dhd->tx_wq) {
+               DHD_ERROR(("%s: alloc_workqueue(bcmdhd-tx-wq) failed\n", __FUNCTION__));
+               goto fail;
+       }
+       dhd->rx_wq = alloc_workqueue("bcmdhd-rx-wq", WQ_HIGHPRI | WQ_UNBOUND | WQ_MEM_RECLAIM, 1);
+       if (!dhd->rx_wq) {
+               DHD_ERROR(("%s: alloc_workqueue(bcmdhd-rx-wq) failed\n", __FUNCTION__));
+               destroy_workqueue(dhd->tx_wq);
+               dhd->tx_wq = NULL;
+               goto fail;
+       }
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#ifndef BCMDBUS
+       /* Set up the watchdog timer */
+       init_timer_compat(&dhd->timer, dhd_watchdog, dhd);
+       dhd->default_wd_interval = dhd_watchdog_ms;
+
+       if (dhd_watchdog_prio >= 0) {
+               /* Initialize watchdog thread */
+               PROC_START(dhd_watchdog_thread, dhd, &dhd->thr_wdt_ctl, 0, "dhd_watchdog_thread");
+               if (dhd->thr_wdt_ctl.thr_pid < 0) {
+                       goto fail;
+               }
+
+       } else {
+               dhd->thr_wdt_ctl.thr_pid = -1;
+       }
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       /* Setup up the runtime PM Idlecount timer */
+       init_timer_compat(&dhd->rpm_timer, dhd_runtimepm, dhd);
+       dhd->rpm_timer_valid = FALSE;
+
+       dhd->thr_rpm_ctl.thr_pid = DHD_PID_KT_INVALID;
+       PROC_START(dhd_rpm_state_thread, dhd, &dhd->thr_rpm_ctl, 0, "dhd_rpm_state_thread");
+       if (dhd->thr_rpm_ctl.thr_pid < 0) {
+               goto fail;
+       }
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+#ifdef SHOW_LOGTRACE
+       skb_queue_head_init(&dhd->evt_trace_queue);
+
+       /* Create ring proc entries */
+       dhd_dbg_ring_proc_create(&dhd->pub);
+#endif /* SHOW_LOGTRACE */
+
+       /* Set up the bottom half handler */
+       if (dhd_dpc_prio >= 0) {
+               /* Initialize DPC thread */
+               PROC_START(dhd_dpc_thread, dhd, &dhd->thr_dpc_ctl, 0, "dhd_dpc");
+               if (dhd->thr_dpc_ctl.thr_pid < 0) {
+                       goto fail;
+               }
+       } else {
+               /*  use tasklet for dpc */
+               tasklet_init(&dhd->tasklet, dhd_dpc, (ulong)dhd);
+               dhd->thr_dpc_ctl.thr_pid = -1;
+       }
+
+       if (dhd->rxthread_enabled) {
+               bzero(&dhd->pub.skbbuf[0], sizeof(void *) * MAXSKBPEND);
+               /* Initialize RXF thread */
+               PROC_START(dhd_rxf_thread, dhd, &dhd->thr_rxf_ctl, 0, "dhd_rxf");
+               if (dhd->thr_rxf_ctl.thr_pid < 0) {
+                       goto fail;
+               }
+       }
+#endif /* !BCMDBUS */
+
+       dhd_state |= DHD_ATTACH_STATE_THREADS_CREATED;
+
+#if defined(CONFIG_PM_SLEEP)
+       if (!dhd_pm_notifier_registered) {
+               dhd_pm_notifier_registered = TRUE;
+               dhd->pm_notifier.notifier_call = dhd_pm_callback;
+               dhd->pm_notifier.priority = 10;
+               register_pm_notifier(&dhd->pm_notifier);
+       }
+
+#endif /* CONFIG_PM_SLEEP */
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+       dhd->early_suspend.level = EARLY_SUSPEND_LEVEL_BLANK_SCREEN + 20;
+       dhd->early_suspend.suspend = dhd_early_suspend;
+       dhd->early_suspend.resume = dhd_late_resume;
+       register_early_suspend(&dhd->early_suspend);
+       dhd_state |= DHD_ATTACH_STATE_EARLYSUSPEND_DONE;
+#endif /* CONFIG_HAS_EARLYSUSPEND && DHD_USE_EARLYSUSPEND */
+
+#ifdef ARP_OFFLOAD_SUPPORT
+       dhd->pend_ipaddr = 0;
+       if (!dhd_inetaddr_notifier_registered) {
+               dhd_inetaddr_notifier_registered = TRUE;
+               register_inetaddr_notifier(&dhd_inetaddr_notifier);
+       }
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#if defined(CONFIG_IPV6) && defined(IPV6_NDO_SUPPORT)
+       if (!dhd_inet6addr_notifier_registered) {
+               dhd_inet6addr_notifier_registered = TRUE;
+               register_inet6addr_notifier(&dhd_inet6addr_notifier);
+       }
+#endif /* CONFIG_IPV6 && IPV6_NDO_SUPPORT */
+       dhd->dhd_deferred_wq = dhd_deferred_work_init((void *)dhd);
+       INIT_WORK(&dhd->dhd_hang_process_work, dhd_hang_process);
+#ifdef DEBUG_CPU_FREQ
+       dhd->new_freq = alloc_percpu(int);
+       dhd->freq_trans.notifier_call = dhd_cpufreq_notifier;
+       cpufreq_register_notifier(&dhd->freq_trans, CPUFREQ_TRANSITION_NOTIFIER);
+#endif
+#ifdef DHDTCPACK_SUPPRESS
+#ifdef BCMSDIO
+       dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_DELAYTX);
+#elif defined(BCMPCIE)
+       /* xxx : In case of PCIe based Samsung Android project, enable TCP ACK Suppress
+        *       when throughput is higher than threshold, following rps_cpus setting.
+        */
+       dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_HOLD);
+#else
+       dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_OFF);
+#endif /* BCMSDIO */
+#endif /* DHDTCPACK_SUPPRESS */
+
+#if defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW)
+#endif /* defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW) */
+
+#ifdef DHD_DEBUG_PAGEALLOC
+       register_page_corrupt_cb(dhd_page_corrupt_cb, &dhd->pub);
+#endif /* DHD_DEBUG_PAGEALLOC */
+
+#if defined(DHD_LB)
+
+       dhd_lb_set_default_cpus(dhd);
+       DHD_LB_STATS_INIT(&dhd->pub);
+
+       /* Initialize the CPU Masks */
+       if (dhd_cpumasks_init(dhd) == 0) {
+               /* Now we have the current CPU maps, run through candidacy */
+               dhd_select_cpu_candidacy(dhd);
+
+               /* Register the call backs to CPU Hotplug sub-system */
+               dhd_register_cpuhp_callback(dhd);
+
+       } else {
+               /*
+               * We are unable to initialize CPU masks, so candidacy algorithm
+               * won't run, but still Load Balancing will be honoured based
+               * on the CPUs allocated for a given job statically during init
+               */
+               dhd->cpu_notifier.notifier_call = NULL;
+               DHD_ERROR(("%s():dhd_cpumasks_init failed CPUs for JOB would be static\n",
+                       __FUNCTION__));
+       }
+
+#ifdef DHD_LB_TXP
+#ifdef DHD_LB_TXP_DEFAULT_ENAB
+       /* Trun ON the feature by default */
+       atomic_set(&dhd->lb_txp_active, 1);
+#else
+       /* Trun OFF the feature by default */
+       atomic_set(&dhd->lb_txp_active, 0);
+#endif /* DHD_LB_TXP_DEFAULT_ENAB */
+#endif /* DHD_LB_TXP */
+
+#ifdef DHD_LB_RXP
+       /* Trun ON the feature by default */
+       atomic_set(&dhd->lb_rxp_active, 1);
+#endif /* DHD_LB_RXP */
+
+       /* Initialize the Load Balancing Tasklets and Napi object */
+#if defined(DHD_LB_TXC)
+       tasklet_init(&dhd->tx_compl_tasklet,
+               dhd_lb_tx_compl_handler, (ulong)(&dhd->pub));
+       INIT_WORK(&dhd->tx_compl_dispatcher_work, dhd_tx_compl_dispatcher_fn);
+       DHD_INFO(("%s load balance init tx_compl_tasklet\n", __FUNCTION__));
+#endif /* DHD_LB_TXC */
+#if defined(DHD_LB_RXC)
+       tasklet_init(&dhd->rx_compl_tasklet,
+               dhd_lb_rx_compl_handler, (ulong)(&dhd->pub));
+       INIT_WORK(&dhd->rx_compl_dispatcher_work, dhd_rx_compl_dispatcher_fn);
+       DHD_INFO(("%s load balance init rx_compl_tasklet\n", __FUNCTION__));
+#endif /* DHD_LB_RXC */
+
+#if defined(DHD_LB_RXP)
+       __skb_queue_head_init(&dhd->rx_pend_queue);
+       skb_queue_head_init(&dhd->rx_napi_queue);
+       __skb_queue_head_init(&dhd->rx_process_queue);
+       /* Initialize the work that dispatches NAPI job to a given core */
+       INIT_WORK(&dhd->rx_napi_dispatcher_work, dhd_rx_napi_dispatcher_work);
+       DHD_INFO(("%s load balance init rx_napi_queue\n", __FUNCTION__));
+#endif /* DHD_LB_RXP */
+
+#if defined(DHD_LB_TXP)
+       INIT_WORK(&dhd->tx_dispatcher_work, dhd_tx_dispatcher_work);
+       skb_queue_head_init(&dhd->tx_pend_queue);
+       /* Initialize the work that dispatches TX job to a given core */
+       tasklet_init(&dhd->tx_tasklet,
+               dhd_lb_tx_handler, (ulong)(dhd));
+       DHD_INFO(("%s load balance init tx_pend_queue\n", __FUNCTION__));
+#endif /* DHD_LB_TXP */
+
+       dhd_state |= DHD_ATTACH_STATE_LB_ATTACH_DONE;
+#endif /* DHD_LB */
+
+#if defined(DNGL_AXI_ERROR_LOGGING) && defined(DHD_USE_WQ_FOR_DNGL_AXI_ERROR)
+       INIT_WORK(&dhd->axi_error_dispatcher_work, dhd_axi_error_dispatcher_fn);
+#endif /* DNGL_AXI_ERROR_LOGGING && DHD_USE_WQ_FOR_DNGL_AXI_ERROR */
+
+#if defined(BCMPCIE)
+       dhd->pub.extended_trap_data = MALLOCZ(osh, BCMPCIE_EXT_TRAP_DATA_MAXLEN);
+       if (dhd->pub.extended_trap_data == NULL) {
+               DHD_ERROR(("%s: Failed to alloc extended_trap_data\n", __FUNCTION__));
+       }
+#ifdef DNGL_AXI_ERROR_LOGGING
+       dhd->pub.axi_err_dump = MALLOCZ(osh, sizeof(dhd_axi_error_dump_t));
+       if (dhd->pub.axi_err_dump == NULL) {
+               DHD_ERROR(("%s: Failed to alloc axi_err_dump\n", __FUNCTION__));
+       }
+#endif /* DNGL_AXI_ERROR_LOGGING */
+#endif /* BCMPCIE */
+
+#ifdef SHOW_LOGTRACE
+       if (dhd_init_logtrace_process(dhd) != BCME_OK) {
+               goto fail;
+       }
+#endif /* SHOW_LOGTRACE */
+
+#ifdef EWP_EDL
+       INIT_DELAYED_WORK(&dhd->edl_dispatcher_work, dhd_edl_process_work);
+#endif
+
+       DHD_SSSR_MEMPOOL_INIT(&dhd->pub);
+       DHD_SSSR_REG_INFO_INIT(&dhd->pub);
+
+#ifdef EWP_EDL
+       if (host_edl_support) {
+               if (DHD_EDL_MEM_INIT(&dhd->pub) != BCME_OK) {
+                       host_edl_support = FALSE;
+               }
+       }
+#endif /* EWP_EDL */
+
+       dhd_init_sock_flows_buf(dhd, dhd_watchdog_ms);
+
+       (void)dhd_sysfs_init(dhd);
+
+#ifdef WL_NATOE
+       /* Open Netlink socket for NF_CONNTRACK notifications */
+       dhd->pub.nfct = dhd_ct_open(&dhd->pub, NFNL_SUBSYS_CTNETLINK | NFNL_SUBSYS_CTNETLINK_EXP,
+                       CT_ALL);
+#endif /* WL_NATOE */
+#ifdef GDB_PROXY
+       dhd->pub.gdb_proxy_nodeadman = nodeadman != 0;
+#endif /* GDB_PROXY */
+       dhd_state |= DHD_ATTACH_STATE_DONE;
+       dhd->dhd_state = dhd_state;
+
+       dhd_found++;
+       
+#ifdef CSI_SUPPORT
+       dhd_csi_init(&dhd->pub);
+#endif /* CSI_SUPPORT */
+
+#ifdef DHD_FW_COREDUMP
+       /* Set memdump default values */
+#ifdef CUSTOMER_HW4_DEBUG
+       dhd->pub.memdump_enabled = DUMP_DISABLED;
+#else
+       dhd->pub.memdump_enabled = DUMP_MEMFILE_BUGON;
+#endif /* CUSTOMER_HW4_DEBUG */
+       /* Check the memdump capability */
+       dhd_get_memdump_info(&dhd->pub);
+#endif /* DHD_FW_COREDUMP */
+
+#ifdef DHD_ERPOM
+       if (enable_erpom) {
+               pom_handler = &dhd->pub.pom_wlan_handler;
+               pom_handler->func_id = WLAN_FUNC_ID;
+               pom_handler->handler = (void *)g_dhd_pub;
+               pom_handler->power_off = dhd_wlan_power_off_handler;
+               pom_handler->power_on = dhd_wlan_power_on_handler;
+
+               dhd->pub.pom_func_register = NULL;
+               dhd->pub.pom_func_deregister = NULL;
+               dhd->pub.pom_toggle_reg_on = NULL;
+
+               dhd->pub.pom_func_register = symbol_get(pom_func_register);
+               dhd->pub.pom_func_deregister = symbol_get(pom_func_deregister);
+               dhd->pub.pom_toggle_reg_on = symbol_get(pom_toggle_reg_on);
+
+               symbol_put(pom_func_register);
+               symbol_put(pom_func_deregister);
+               symbol_put(pom_toggle_reg_on);
+
+               if (!dhd->pub.pom_func_register ||
+                       !dhd->pub.pom_func_deregister ||
+                       !dhd->pub.pom_toggle_reg_on) {
+                       DHD_ERROR(("%s, enable_erpom enabled through module parameter but "
+                               "POM is not loaded\n", __FUNCTION__));
+                       ASSERT(0);
+                       goto fail;
+               }
+               dhd->pub.pom_func_register(pom_handler);
+               dhd->pub.enable_erpom = TRUE;
+
+       }
+#endif /* DHD_ERPOM */
+
+#ifdef DHD_DUMP_MNGR
+       dhd->pub.dump_file_manage =
+               (dhd_dump_file_manage_t *)MALLOCZ(dhd->pub.osh, sizeof(dhd_dump_file_manage_t));
+       if (unlikely(!dhd->pub.dump_file_manage)) {
+               DHD_ERROR(("%s(): could not allocate memory for - "
+                                       "dhd_dump_file_manage_t\n", __FUNCTION__));
+       }
+#endif /* DHD_DUMP_MNGR */
+
+#ifdef RTT_SUPPORT
+       if (dhd_rtt_attach(&dhd->pub)) {
+               DHD_ERROR(("dhd_rtt_attach has failed\n"));
+               goto fail;
+       }
+#endif /* RTT_SUPPORT */
+
+#ifdef DHD_TX_PROFILE
+       if (dhd_tx_profile_attach(&dhd->pub) != BCME_OK) {
+               DHD_ERROR(("%s:\tdhd_tx_profile_attach has failed\n", __FUNCTION__));
+               goto fail;
+       }
+#endif /* defined(DHD_TX_PROFILE) */
+
+       return &dhd->pub;
+
+fail:
+       if (dhd_state >= DHD_ATTACH_STATE_DHD_ALLOC) {
+               DHD_TRACE(("%s: Calling dhd_detach dhd_state 0x%x &dhd->pub %p\n",
+                       __FUNCTION__, dhd_state, &dhd->pub));
+               dhd->dhd_state = dhd_state;
+               dhd_detach(&dhd->pub);
+               dhd_free(&dhd->pub);
+       }
+
+dhd_null_flag:
+       return NULL;
+}
+
+int dhd_get_fw_mode(dhd_info_t *dhdinfo)
+{
+       if (strstr(dhdinfo->fw_path, "_apsta") != NULL)
+               return DHD_FLAG_HOSTAP_MODE;
+       if (strstr(dhdinfo->fw_path, "_p2p") != NULL)
+               return DHD_FLAG_P2P_MODE;
+       if (strstr(dhdinfo->fw_path, "_ibss") != NULL)
+               return DHD_FLAG_IBSS_MODE;
+       if (strstr(dhdinfo->fw_path, "_mfg") != NULL)
+               return DHD_FLAG_MFG_MODE;
+
+       return DHD_FLAG_STA_MODE;
+}
+
+int dhd_bus_get_fw_mode(dhd_pub_t *dhdp)
+{
+       return dhd_get_fw_mode(dhdp->info);
+}
+
+extern char * nvram_get(const char *name);
+bool dhd_update_fw_nv_path(dhd_info_t *dhdinfo)
+{
+       int fw_len;
+       int nv_len;
+       int clm_len;
+       int conf_len;
+       const char *fw = NULL;
+       const char *nv = NULL;
+       const char *clm = NULL;
+       const char *conf = NULL;
+#ifdef DHD_UCODE_DOWNLOAD
+       int uc_len;
+       const char *uc = NULL;
+#endif /* DHD_UCODE_DOWNLOAD */
+       wifi_adapter_info_t *adapter = dhdinfo->adapter;
+       int fw_path_len = sizeof(dhdinfo->fw_path);
+       int nv_path_len = sizeof(dhdinfo->nv_path);
+
+       /* Update firmware and nvram path. The path may be from adapter info or module parameter
+        * The path from adapter info is used for initialization only (as it won't change).
+        *
+        * The firmware_path/nvram_path module parameter may be changed by the system at run
+        * time. When it changes we need to copy it to dhdinfo->fw_path. Also Android private
+        * command may change dhdinfo->fw_path. As such we need to clear the path info in
+        * module parameter after it is copied. We won't update the path until the module parameter
+        * is changed again (first character is not '\0')
+        */
+
+       /* set default firmware and nvram path for built-in type driver */
+//     if (!dhd_download_fw_on_driverload) {
+#ifdef CONFIG_BCMDHD_FW_PATH
+               fw = VENDOR_PATH CONFIG_BCMDHD_FW_PATH;
+#endif /* CONFIG_BCMDHD_FW_PATH */
+#ifdef CONFIG_BCMDHD_NVRAM_PATH
+               nv = VENDOR_PATH CONFIG_BCMDHD_NVRAM_PATH;
+#endif /* CONFIG_BCMDHD_NVRAM_PATH */
+//     }
+
+       /* check if we need to initialize the path */
+       if (dhdinfo->fw_path[0] == '\0') {
+               if (adapter && adapter->fw_path && adapter->fw_path[0] != '\0')
+                       fw = adapter->fw_path;
+
+       }
+       if (dhdinfo->nv_path[0] == '\0') {
+               if (adapter && adapter->nv_path && adapter->nv_path[0] != '\0')
+                       nv = adapter->nv_path;
+       }
+       if (dhdinfo->clm_path[0] == '\0') {
+               if (adapter && adapter->clm_path && adapter->clm_path[0] != '\0')
+                       clm = adapter->clm_path;
+       }
+       if (dhdinfo->conf_path[0] == '\0') {
+               if (adapter && adapter->conf_path && adapter->conf_path[0] != '\0')
+                       conf = adapter->conf_path;
+       }
+
+       /* Use module parameter if it is valid, EVEN IF the path has not been initialized
+        *
+        * TODO: need a solution for multi-chip, can't use the same firmware for all chips
+        */
+       if (firmware_path[0] != '\0')
+               fw = firmware_path;
+
+       if (nvram_path[0] != '\0')
+               nv = nvram_path;
+       if (clm_path[0] != '\0')
+               clm = clm_path;
+       if (config_path[0] != '\0')
+               conf = config_path;
+
+#ifdef DHD_UCODE_DOWNLOAD
+       if (ucode_path[0] != '\0')
+               uc = ucode_path;
+#endif /* DHD_UCODE_DOWNLOAD */
+
+       if (fw && fw[0] != '\0') {
+               fw_len = strlen(fw);
+               if (fw_len >= fw_path_len) {
+                       DHD_ERROR(("fw path len exceeds max len of dhdinfo->fw_path\n"));
+                       return FALSE;
+               }
+               strlcpy(dhdinfo->fw_path, fw, fw_path_len);
+       }
+       if (nv && nv[0] != '\0') {
+               nv_len = strlen(nv);
+               if (nv_len >= nv_path_len) {
+                       DHD_ERROR(("nvram path len exceeds max len of dhdinfo->nv_path\n"));
+                       return FALSE;
+               }
+               memset(dhdinfo->nv_path, 0, nv_path_len);
+               strlcpy(dhdinfo->nv_path, nv, nv_path_len);
+#ifdef DHD_USE_SINGLE_NVRAM_FILE
+               /* Remove "_net" or "_mfg" tag from current nvram path */
+               {
+                       char *nvram_tag = "nvram_";
+                       char *ext_tag = ".txt";
+                       char *sp_nvram = strnstr(dhdinfo->nv_path, nvram_tag, nv_path_len);
+                       bool valid_buf = sp_nvram && ((uint32)(sp_nvram + strlen(nvram_tag) +
+                               strlen(ext_tag) - dhdinfo->nv_path) <= nv_path_len);
+                       if (valid_buf) {
+                               char *sp = sp_nvram + strlen(nvram_tag) - 1;
+                               uint32 padding_size = (uint32)(dhdinfo->nv_path +
+                                       nv_path_len - sp);
+                               memset(sp, 0, padding_size);
+                               strncat(dhdinfo->nv_path, ext_tag, strlen(ext_tag));
+                               nv_len = strlen(dhdinfo->nv_path);
+                               DHD_INFO(("%s: new nvram path = %s\n",
+                                       __FUNCTION__, dhdinfo->nv_path));
+                       } else if (sp_nvram) {
+                               DHD_ERROR(("%s: buffer space for nvram path is not enough\n",
+                                       __FUNCTION__));
+                               return FALSE;
+                       } else {
+                               DHD_ERROR(("%s: Couldn't find the nvram tag. current"
+                                       " nvram path = %s\n", __FUNCTION__, dhdinfo->nv_path));
+                       }
+               }
+#endif /* DHD_USE_SINGLE_NVRAM_FILE */
+       }
+       if (clm && clm[0] != '\0') {
+               clm_len = strlen(clm);
+               if (clm_len >= sizeof(dhdinfo->clm_path)) {
+                       DHD_ERROR(("clm path len exceeds max len of dhdinfo->clm_path\n"));
+                       return FALSE;
+               }
+               strncpy(dhdinfo->clm_path, clm, sizeof(dhdinfo->clm_path));
+               if (dhdinfo->clm_path[clm_len-1] == '\n')
+                      dhdinfo->clm_path[clm_len-1] = '\0';
+       }
+       if (conf && conf[0] != '\0') {
+               conf_len = strlen(conf);
+               if (conf_len >= sizeof(dhdinfo->conf_path)) {
+                       DHD_ERROR(("config path len exceeds max len of dhdinfo->conf_path\n"));
+                       return FALSE;
+               }
+               strncpy(dhdinfo->conf_path, conf, sizeof(dhdinfo->conf_path));
+               if (dhdinfo->conf_path[conf_len-1] == '\n')
+                      dhdinfo->conf_path[conf_len-1] = '\0';
+       }
+#ifdef DHD_UCODE_DOWNLOAD
+       if (uc && uc[0] != '\0') {
+               uc_len = strlen(uc);
+               if (uc_len >= sizeof(dhdinfo->uc_path)) {
+                       DHD_ERROR(("uc path len exceeds max len of dhdinfo->uc_path\n"));
+                       return FALSE;
+               }
+               strlcpy(dhdinfo->uc_path, uc, sizeof(dhdinfo->uc_path));
+       }
+#endif /* DHD_UCODE_DOWNLOAD */
+
+#if 0
+       /* clear the path in module parameter */
+       if (dhd_download_fw_on_driverload) {
+               firmware_path[0] = '\0';
+               nvram_path[0] = '\0';
+               clm_path[0] = '\0';
+               config_path[0] = '\0';
+       }
+#endif
+#ifdef DHD_UCODE_DOWNLOAD
+       ucode_path[0] = '\0';
+       DHD_ERROR(("ucode path: %s\n", dhdinfo->uc_path));
+#endif /* DHD_UCODE_DOWNLOAD */
+
+       /* fw_path and nv_path are not mandatory for BCMEMBEDIMAGE */
+       if (dhdinfo->fw_path[0] == '\0') {
+               DHD_ERROR(("firmware path not found\n"));
+               return FALSE;
+       }
+       if (dhdinfo->nv_path[0] == '\0') {
+               DHD_ERROR(("nvram path not found\n"));
+               return FALSE;
+       }
+
+       return TRUE;
+}
+
+#if defined(BT_OVER_SDIO)
+extern bool dhd_update_btfw_path(dhd_info_t *dhdinfo, char* btfw_path)
+{
+       int fw_len;
+       const char *fw = NULL;
+       wifi_adapter_info_t *adapter = dhdinfo->adapter;
+
+       /* Update bt firmware path. The path may be from adapter info or module parameter
+        * The path from adapter info is used for initialization only (as it won't change).
+        *
+        * The btfw_path module parameter may be changed by the system at run
+        * time. When it changes we need to copy it to dhdinfo->btfw_path. Also Android private
+        * command may change dhdinfo->btfw_path. As such we need to clear the path info in
+        * module parameter after it is copied. We won't update the path until the module parameter
+        * is changed again (first character is not '\0')
+        */
+
+       /* set default firmware and nvram path for built-in type driver */
+       if (!dhd_download_fw_on_driverload) {
+#ifdef CONFIG_BCMDHD_BTFW_PATH
+               fw = CONFIG_BCMDHD_BTFW_PATH;
+#endif /* CONFIG_BCMDHD_FW_PATH */
+       }
+
+       /* check if we need to initialize the path */
+       if (dhdinfo->btfw_path[0] == '\0') {
+               if (adapter && adapter->btfw_path && adapter->btfw_path[0] != '\0')
+                       fw = adapter->btfw_path;
+       }
+
+       /* Use module parameter if it is valid, EVEN IF the path has not been initialized
+        */
+       if (btfw_path[0] != '\0')
+               fw = btfw_path;
+
+       if (fw && fw[0] != '\0') {
+               fw_len = strlen(fw);
+               if (fw_len >= sizeof(dhdinfo->btfw_path)) {
+                       DHD_ERROR(("fw path len exceeds max len of dhdinfo->btfw_path\n"));
+                       return FALSE;
+               }
+               strlcpy(dhdinfo->btfw_path, fw, sizeof(dhdinfo->btfw_path));
+       }
+
+       /* clear the path in module parameter */
+       btfw_path[0] = '\0';
+
+       if (dhdinfo->btfw_path[0] == '\0') {
+               DHD_ERROR(("bt firmware path not found\n"));
+               return FALSE;
+       }
+
+       return TRUE;
+}
+#endif /* defined (BT_OVER_SDIO) */
+
+#ifdef CUSTOMER_HW4_DEBUG
+bool dhd_validate_chipid(dhd_pub_t *dhdp)
+{
+       uint chipid = dhd_bus_chip_id(dhdp);
+       uint config_chipid;
+
+#ifdef BCM4389_CHIP_DEF
+       config_chipid = BCM4389_CHIP_ID;
+#elif defined(BCM4375_CHIP)
+       config_chipid = BCM4375_CHIP_ID;
+#elif defined(BCM4361_CHIP)
+       config_chipid = BCM4361_CHIP_ID;
+#elif defined(BCM4359_CHIP)
+       config_chipid = BCM4359_CHIP_ID;
+#elif defined(BCM4358_CHIP)
+       config_chipid = BCM4358_CHIP_ID;
+#elif defined(BCM4354_CHIP)
+       config_chipid = BCM4354_CHIP_ID;
+#elif defined(BCM4339_CHIP)
+       config_chipid = BCM4339_CHIP_ID;
+#elif defined(BCM4335_CHIP)
+       config_chipid = BCM4335_CHIP_ID;
+#elif defined(BCM43430_CHIP)
+       config_chipid = BCM43430_CHIP_ID;
+#elif defined(BCM43018_CHIP)
+       config_chipid = BCM43018_CHIP_ID;
+#elif defined(BCM43455_CHIP)
+       config_chipid = BCM4345_CHIP_ID;
+#elif defined(BCM43454_CHIP)
+       config_chipid = BCM43454_CHIP_ID;
+#elif defined(BCM43012_CHIP_)
+       config_chipid = BCM43012_CHIP_ID;
+#elif defined(BCM43013_CHIP)
+       config_chipid = BCM43012_CHIP_ID;
+#else
+       DHD_ERROR(("%s: Unknown chip id, if you use new chipset,"
+               " please add CONFIG_BCMXXXX into the Kernel and"
+               " BCMXXXX_CHIP definition into the DHD driver\n",
+               __FUNCTION__));
+       config_chipid = 0;
+
+       return FALSE;
+#endif /* BCM4354_CHIP */
+
+#if defined(BCM4354_CHIP) && defined(SUPPORT_MULTIPLE_REVISION)
+       if (chipid == BCM4350_CHIP_ID && config_chipid == BCM4354_CHIP_ID) {
+               return TRUE;
+       }
+#endif /* BCM4354_CHIP && SUPPORT_MULTIPLE_REVISION */
+#if defined(BCM4358_CHIP) && defined(SUPPORT_MULTIPLE_REVISION)
+       if (chipid == BCM43569_CHIP_ID && config_chipid == BCM4358_CHIP_ID) {
+               return TRUE;
+       }
+#endif /* BCM4358_CHIP && SUPPORT_MULTIPLE_REVISION */
+#if defined(BCM4359_CHIP)
+       if (chipid == BCM4355_CHIP_ID && config_chipid == BCM4359_CHIP_ID) {
+               return TRUE;
+       }
+#endif /* BCM4359_CHIP */
+#if defined(BCM4361_CHIP)
+       if (chipid == BCM4347_CHIP_ID && config_chipid == BCM4361_CHIP_ID) {
+               return TRUE;
+       }
+#endif /* BCM4361_CHIP */
+
+       return config_chipid == chipid;
+}
+#endif /* CUSTOMER_HW4_DEBUG */
+
+#if defined(BT_OVER_SDIO)
+wlan_bt_handle_t dhd_bt_get_pub_hndl(void)
+{
+       DHD_ERROR(("%s: g_dhd_pub %p\n", __FUNCTION__, g_dhd_pub));
+       /* assuming that dhd_pub_t type pointer is available from a global variable */
+       return (wlan_bt_handle_t) g_dhd_pub;
+} EXPORT_SYMBOL(dhd_bt_get_pub_hndl);
+
+int dhd_download_btfw(wlan_bt_handle_t handle, char* btfw_path)
+{
+       int ret = -1;
+       dhd_pub_t *dhdp = (dhd_pub_t *)handle;
+       dhd_info_t *dhd = (dhd_info_t*)dhdp->info;
+
+       /* Download BT firmware image to the dongle */
+       if (dhd->pub.busstate == DHD_BUS_DATA && dhd_update_btfw_path(dhd, btfw_path)) {
+               DHD_INFO(("%s: download btfw from: %s\n", __FUNCTION__, dhd->btfw_path));
+               ret = dhd_bus_download_btfw(dhd->pub.bus, dhd->pub.osh, dhd->btfw_path);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: failed to download btfw from: %s\n",
+                               __FUNCTION__, dhd->btfw_path));
+                       return ret;
+               }
+       }
+       return ret;
+} EXPORT_SYMBOL(dhd_download_btfw);
+#endif /* defined (BT_OVER_SDIO) */
+
+#ifndef BCMDBUS
+int
+dhd_bus_start(dhd_pub_t *dhdp)
+{
+       int ret = -1;
+       dhd_info_t *dhd = (dhd_info_t*)dhdp->info;
+       unsigned long flags;
+
+#if defined(DHD_DEBUG) && defined(BCMSDIO)
+       int fw_download_start = 0, fw_download_end = 0, f2_sync_start = 0, f2_sync_end = 0;
+#endif /* DHD_DEBUG && BCMSDIO */
+       ASSERT(dhd);
+
+       DHD_TRACE(("Enter %s:\n", __FUNCTION__));
+       dhdp->memdump_type = 0;
+       dhdp->dongle_trap_occured = 0;
+#ifdef DHD_SSSR_DUMP
+       /* Flag to indicate sssr dump is collected */
+       dhdp->sssr_dump_collected = 0;
+#endif /* DHD_SSSR_DUMP */
+       dhdp->iovar_timeout_occured = 0;
+#ifdef PCIE_FULL_DONGLE
+       dhdp->d3ack_timeout_occured = 0;
+       dhdp->livelock_occured = 0;
+       dhdp->pktid_audit_failed = 0;
+#endif /* PCIE_FULL_DONGLE */
+       dhd->pub.iface_op_failed = 0;
+       dhd->pub.scan_timeout_occurred = 0;
+       dhd->pub.scan_busy_occurred = 0;
+       /* Clear induced error during initialize */
+       dhd->pub.dhd_induce_error = DHD_INDUCE_ERROR_CLEAR;
+       dhd->pub.tput_test_done = FALSE;
+
+       /* try to download image and nvram to the dongle */
+       if  (dhd->pub.busstate == DHD_BUS_DOWN && dhd_update_fw_nv_path(dhd)) {
+               /* Indicate FW Download has not yet done */
+               dhd->pub.fw_download_status = FW_DOWNLOAD_IN_PROGRESS;
+               DHD_INFO(("%s download fw %s, nv %s, conf %s\n",
+                       __FUNCTION__, dhd->fw_path, dhd->nv_path, dhd->conf_path));
+#if defined(DHD_DEBUG) && defined(BCMSDIO)
+               fw_download_start = OSL_SYSUPTIME();
+#endif /* DHD_DEBUG && BCMSDIO */
+               ret = dhd_bus_download_firmware(dhd->pub.bus, dhd->pub.osh,
+                       dhd->fw_path, dhd->nv_path, dhd->clm_path, dhd->conf_path);
+#if defined(DHD_DEBUG) && defined(BCMSDIO)
+               fw_download_end = OSL_SYSUPTIME();
+#endif /* DHD_DEBUG && BCMSDIO */
+               if (ret < 0) {
+                       DHD_ERROR(("%s: failed to download firmware %s\n",
+                               __FUNCTION__, dhd->fw_path));
+                       return ret;
+               }
+               /* Indicate FW Download has succeeded */
+               dhd->pub.fw_download_status = FW_DOWNLOAD_DONE;
+       }
+       if (dhd->pub.busstate != DHD_BUS_LOAD) {
+               return -ENETDOWN;
+       }
+
+#ifdef BCMSDIO
+       dhd_os_sdlock(dhdp);
+#endif /* BCMSDIO */
+
+       /* Start the watchdog timer */
+       dhd->pub.tickcnt = 0;
+       dhd_os_wd_timer(&dhd->pub, dhd_watchdog_ms);
+
+       /* Bring up the bus */
+       if ((ret = dhd_bus_init(&dhd->pub, FALSE)) != 0) {
+
+               DHD_ERROR(("%s, dhd_bus_init failed %d\n", __FUNCTION__, ret));
+#ifdef BCMSDIO
+               dhd_os_sdunlock(dhdp);
+#endif /* BCMSDIO */
+               return ret;
+       }
+#if defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID) || defined(BCMPCIE_OOB_HOST_WAKE)
+       /* Host registration for OOB interrupt */
+       if (dhd_bus_oob_intr_register(dhdp)) {
+               /* deactivate timer and wait for the handler to finish */
+#if !defined(BCMPCIE_OOB_HOST_WAKE)
+               DHD_GENERAL_LOCK(&dhd->pub, flags);
+               dhd->wd_timer_valid = FALSE;
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+               del_timer_sync(&dhd->timer);
+
+#endif /* !BCMPCIE_OOB_HOST_WAKE */
+               DHD_STOP_RPM_TIMER(&dhd->pub);
+
+               DHD_ERROR(("%s Host failed to register for OOB\n", __FUNCTION__));
+               DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+               return -ENODEV;
+       }
+
+#if defined(BCMPCIE_OOB_HOST_WAKE)
+       dhd_bus_oob_intr_set(dhdp, TRUE);
+#else
+       /* Enable oob at firmware */
+       dhd_enable_oob_intr(dhd->pub.bus, TRUE);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#elif defined(FORCE_WOWLAN)
+       /* Enable oob at firmware */
+       dhd_enable_oob_intr(dhd->pub.bus, TRUE);
+#endif /* OOB_INTR_ONLY || BCMSPI_ANDROID || BCMPCIE_OOB_HOST_WAKE */
+#ifdef PCIE_FULL_DONGLE
+       {
+               /* max_h2d_rings includes H2D common rings */
+               uint32 max_h2d_rings = dhd_bus_max_h2d_queues(dhd->pub.bus);
+
+               DHD_ERROR(("%s: Initializing %u h2drings\n", __FUNCTION__,
+                       max_h2d_rings));
+               if ((ret = dhd_flow_rings_init(&dhd->pub, max_h2d_rings)) != BCME_OK) {
+#ifdef BCMSDIO
+                       dhd_os_sdunlock(dhdp);
+#endif /* BCMSDIO */
+                       return ret;
+               }
+       }
+#endif /* PCIE_FULL_DONGLE */
+
+       /* set default value for now. Will be updated again in dhd_preinit_ioctls()
+        * after querying FW
+        */
+       dhdp->event_log_max_sets = NUM_EVENT_LOG_SETS;
+       dhdp->event_log_max_sets_queried = FALSE;
+
+       dhdp->smmu_fault_occurred = 0;
+#ifdef DNGL_AXI_ERROR_LOGGING
+       dhdp->axi_error = FALSE;
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+       /* Do protocol initialization necessary for IOCTL/IOVAR */
+       ret = dhd_prot_init(&dhd->pub);
+       if (unlikely(ret) != BCME_OK) {
+               DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+               return ret;
+       }
+
+       /* If bus is not ready, can't come up */
+       if (dhd->pub.busstate != DHD_BUS_DATA) {
+               DHD_GENERAL_LOCK(&dhd->pub, flags);
+               dhd->wd_timer_valid = FALSE;
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+               del_timer_sync(&dhd->timer);
+               DHD_ERROR(("%s failed bus is not ready\n", __FUNCTION__));
+               DHD_STOP_RPM_TIMER(&dhd->pub);
+#ifdef BCMSDIO
+               dhd_os_sdunlock(dhdp);
+#endif /* BCMSDIO */
+               DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+               return -ENODEV;
+       }
+
+#ifdef BCMSDIO
+       dhd_os_sdunlock(dhdp);
+#endif /* BCMSDIO */
+
+       /* Bus is ready, query any dongle information */
+       /* XXX Since dhd_sync_with_dongle can sleep, should module count surround it? */
+#if defined(DHD_DEBUG) && defined(BCMSDIO)
+       f2_sync_start = OSL_SYSUPTIME();
+#endif /* DHD_DEBUG && BCMSDIO */
+       if ((ret = dhd_sync_with_dongle(&dhd->pub)) < 0) {
+               DHD_GENERAL_LOCK(&dhd->pub, flags);
+               dhd->wd_timer_valid = FALSE;
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+               del_timer_sync(&dhd->timer);
+               DHD_ERROR(("%s failed to sync with dongle\n", __FUNCTION__));
+               DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+               return ret;
+       }
+
+#if defined(CONFIG_ARCH_EXYNOS) && defined(BCMPCIE)
+#if !defined(CONFIG_SOC_EXYNOS8890) && !defined(SUPPORT_EXYNOS7420)
+       /* XXX: JIRA SWWLAN-139454: Added L1ss enable
+        * after firmware download completion due to link down issue
+        * JIRA SWWLAN-142236: Amendment - Changed L1ss enable point
+        */
+       DHD_ERROR(("%s: Enable L1ss EP side\n", __FUNCTION__));
+       exynos_pcie_l1ss_ctrl(1, PCIE_L1SS_CTRL_WIFI);
+#endif /* !CONFIG_SOC_EXYNOS8890 && !SUPPORT_EXYNOS7420 */
+#endif /* CONFIG_ARCH_EXYNOS && BCMPCIE */
+#if defined(DHD_DEBUG) && defined(BCMSDIO)
+       f2_sync_end = OSL_SYSUPTIME();
+       DHD_ERROR(("Time taken for FW download and F2 ready is: %d msec\n",
+                       (fw_download_end - fw_download_start) + (f2_sync_end - f2_sync_start)));
+#endif /* DHD_DEBUG && BCMSDIO */
+
+#ifdef ARP_OFFLOAD_SUPPORT
+       if (dhd->pend_ipaddr) {
+#ifdef AOE_IP_ALIAS_SUPPORT
+               /* XXX Assume pending ip address is belong to primary interface */
+               aoe_update_host_ipv4_table(&dhd->pub, dhd->pend_ipaddr, TRUE, 0);
+#endif /* AOE_IP_ALIAS_SUPPORT */
+               dhd->pend_ipaddr = 0;
+       }
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+       return 0;
+}
+#endif /* !BCMDBUS */
+
+#ifdef WLTDLS
+int _dhd_tdls_enable(dhd_pub_t *dhd, bool tdls_on, bool auto_on, struct ether_addr *mac)
+{
+       uint32 tdls = tdls_on;
+       int ret = 0;
+       uint32 tdls_auto_op = 0;
+       uint32 tdls_idle_time = CUSTOM_TDLS_IDLE_MODE_SETTING;
+       int32 tdls_rssi_high = CUSTOM_TDLS_RSSI_THRESHOLD_HIGH;
+       int32 tdls_rssi_low = CUSTOM_TDLS_RSSI_THRESHOLD_LOW;
+       uint32 tdls_pktcnt_high = CUSTOM_TDLS_PCKTCNT_THRESHOLD_HIGH;
+       uint32 tdls_pktcnt_low = CUSTOM_TDLS_PCKTCNT_THRESHOLD_LOW;
+
+       BCM_REFERENCE(mac);
+       if (!FW_SUPPORTED(dhd, tdls))
+               return BCME_ERROR;
+
+       if (dhd->tdls_enable == tdls_on)
+               goto auto_mode;
+       ret = dhd_iovar(dhd, 0, "tdls_enable", (char *)&tdls, sizeof(tdls), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: tdls %d failed %d\n", __FUNCTION__, tdls, ret));
+               goto exit;
+       }
+       dhd->tdls_enable = tdls_on;
+auto_mode:
+
+       tdls_auto_op = auto_on;
+       ret = dhd_iovar(dhd, 0, "tdls_auto_op", (char *)&tdls_auto_op, sizeof(tdls_auto_op), NULL,
+                       0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: tdls_auto_op failed %d\n", __FUNCTION__, ret));
+               goto exit;
+       }
+
+       if (tdls_auto_op) {
+               ret = dhd_iovar(dhd, 0, "tdls_idle_time", (char *)&tdls_idle_time,
+                               sizeof(tdls_idle_time), NULL, 0, TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: tdls_idle_time failed %d\n", __FUNCTION__, ret));
+                       goto exit;
+               }
+               ret = dhd_iovar(dhd, 0, "tdls_rssi_high", (char *)&tdls_rssi_high,
+                               sizeof(tdls_rssi_high), NULL, 0, TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: tdls_rssi_high failed %d\n", __FUNCTION__, ret));
+                       goto exit;
+               }
+               ret = dhd_iovar(dhd, 0, "tdls_rssi_low", (char *)&tdls_rssi_low,
+                               sizeof(tdls_rssi_low), NULL, 0, TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: tdls_rssi_low failed %d\n", __FUNCTION__, ret));
+                       goto exit;
+               }
+               ret = dhd_iovar(dhd, 0, "tdls_trigger_pktcnt_high", (char *)&tdls_pktcnt_high,
+                               sizeof(tdls_pktcnt_high), NULL, 0, TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: tdls_trigger_pktcnt_high failed %d\n", __FUNCTION__, ret));
+                       goto exit;
+               }
+               ret = dhd_iovar(dhd, 0, "tdls_trigger_pktcnt_low", (char *)&tdls_pktcnt_low,
+                               sizeof(tdls_pktcnt_low), NULL, 0, TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: tdls_trigger_pktcnt_low failed %d\n", __FUNCTION__, ret));
+                       goto exit;
+               }
+       }
+
+exit:
+       return ret;
+}
+
+int dhd_tdls_enable(struct net_device *dev, bool tdls_on, bool auto_on, struct ether_addr *mac)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+       if (dhd)
+               ret = _dhd_tdls_enable(&dhd->pub, tdls_on, auto_on, mac);
+       else
+               ret = BCME_ERROR;
+       return ret;
+}
+
+int
+dhd_tdls_set_mode(dhd_pub_t *dhd, bool wfd_mode)
+{
+       int ret = 0;
+       bool auto_on = false;
+       uint32 mode =  wfd_mode;
+
+#ifdef ENABLE_TDLS_AUTO_MODE
+       if (wfd_mode) {
+               auto_on = false;
+       } else {
+               auto_on = true;
+       }
+#else
+       auto_on = false;
+#endif /* ENABLE_TDLS_AUTO_MODE */
+       ret = _dhd_tdls_enable(dhd, false, auto_on, NULL);
+       if (ret < 0) {
+               DHD_ERROR(("Disable tdls_auto_op failed. %d\n", ret));
+               return ret;
+       }
+
+       ret = dhd_iovar(dhd, 0, "tdls_wfd_mode", (char *)&mode, sizeof(mode), NULL, 0, TRUE);
+       if ((ret < 0) && (ret != BCME_UNSUPPORTED)) {
+               DHD_ERROR(("%s: tdls_wfd_mode faile_wfd_mode %d\n", __FUNCTION__, ret));
+               return ret;
+       }
+
+       ret = _dhd_tdls_enable(dhd, true, auto_on, NULL);
+       if (ret < 0) {
+               DHD_ERROR(("enable tdls_auto_op failed. %d\n", ret));
+               return ret;
+       }
+
+       dhd->tdls_mode = mode;
+       return ret;
+}
+#ifdef PCIE_FULL_DONGLE
+int dhd_tdls_update_peer_info(dhd_pub_t *dhdp, wl_event_msg_t *event)
+{
+       dhd_pub_t *dhd_pub = dhdp;
+       tdls_peer_node_t *cur = dhd_pub->peer_tbl.node;
+       tdls_peer_node_t *new = NULL, *prev = NULL;
+       int ifindex = dhd_ifname2idx(dhd_pub->info, event->ifname);
+       uint8 *da = (uint8 *)&event->addr.octet[0];
+       bool connect = FALSE;
+       uint32 reason = ntoh32(event->reason);
+       unsigned long flags;
+
+       /* No handling needed for peer discovered reason */
+       if (reason == WLC_E_TDLS_PEER_DISCOVERED) {
+               return BCME_ERROR;
+       }
+       if (reason == WLC_E_TDLS_PEER_CONNECTED)
+               connect = TRUE;
+       else if (reason == WLC_E_TDLS_PEER_DISCONNECTED)
+               connect = FALSE;
+       else
+       {
+               DHD_ERROR(("%s: TDLS Event reason is unknown\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+       if (ifindex == DHD_BAD_IF)
+               return BCME_ERROR;
+
+       if (connect) {
+               while (cur != NULL) {
+                       if (!memcmp(da, cur->addr, ETHER_ADDR_LEN)) {
+                               DHD_ERROR(("%s: TDLS Peer exist already %d\n",
+                                       __FUNCTION__, __LINE__));
+                               return BCME_ERROR;
+                       }
+                       cur = cur->next;
+               }
+
+               new = MALLOC(dhd_pub->osh, sizeof(tdls_peer_node_t));
+               if (new == NULL) {
+                       DHD_ERROR(("%s: Failed to allocate memory\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+               memcpy(new->addr, da, ETHER_ADDR_LEN);
+               DHD_TDLS_LOCK(&dhdp->tdls_lock, flags);
+               new->next = dhd_pub->peer_tbl.node;
+               dhd_pub->peer_tbl.node = new;
+               dhd_pub->peer_tbl.tdls_peer_count++;
+               DHD_TDLS_UNLOCK(&dhdp->tdls_lock, flags);
+
+       } else {
+               while (cur != NULL) {
+                       if (!memcmp(da, cur->addr, ETHER_ADDR_LEN)) {
+                               dhd_flow_rings_delete_for_peer(dhd_pub, (uint8)ifindex, da);
+                               DHD_TDLS_LOCK(&dhdp->tdls_lock, flags);
+                               if (prev)
+                                       prev->next = cur->next;
+                               else
+                                       dhd_pub->peer_tbl.node = cur->next;
+                               MFREE(dhd_pub->osh, cur, sizeof(tdls_peer_node_t));
+                               dhd_pub->peer_tbl.tdls_peer_count--;
+                               DHD_TDLS_UNLOCK(&dhdp->tdls_lock, flags);
+                               return BCME_OK;
+                       }
+                       prev = cur;
+                       cur = cur->next;
+               }
+               DHD_ERROR(("%s: TDLS Peer Entry Not found\n", __FUNCTION__));
+       }
+       return BCME_OK;
+}
+#endif /* PCIE_FULL_DONGLE */
+#endif
+
+bool dhd_is_concurrent_mode(dhd_pub_t *dhd)
+{
+       if (!dhd)
+               return FALSE;
+
+       if (dhd->op_mode & DHD_FLAG_CONCURR_MULTI_CHAN_MODE)
+               return TRUE;
+       else if ((dhd->op_mode & DHD_FLAG_CONCURR_SINGLE_CHAN_MODE) ==
+               DHD_FLAG_CONCURR_SINGLE_CHAN_MODE)
+               return TRUE;
+       else
+               return FALSE;
+}
+#if !defined(AP) && defined(WLP2P)
+/* From Android JerryBean release, the concurrent mode is enabled by default and the firmware
+ * name would be fw_bcmdhd.bin. So we need to determine whether P2P is enabled in the STA
+ * firmware and accordingly enable concurrent mode (Apply P2P settings). SoftAP firmware
+ * would still be named as fw_bcmdhd_apsta.
+ */
+uint32
+dhd_get_concurrent_capabilites(dhd_pub_t *dhd)
+{
+       int32 ret = 0;
+       char buf[WLC_IOCTL_SMLEN];
+       bool mchan_supported = FALSE;
+       /* if dhd->op_mode is already set for HOSTAP and Manufacturing
+        * test mode, that means we only will use the mode as it is
+        */
+       if (dhd->op_mode & (DHD_FLAG_HOSTAP_MODE | DHD_FLAG_MFG_MODE))
+               return 0;
+       if (FW_SUPPORTED(dhd, vsdb)) {
+               mchan_supported = TRUE;
+       }
+       if (!FW_SUPPORTED(dhd, p2p)) {
+               DHD_TRACE(("Chip does not support p2p\n"));
+               return 0;
+       } else {
+               /* Chip supports p2p but ensure that p2p is really implemented in firmware or not */
+               memset(buf, 0, sizeof(buf));
+               ret = dhd_iovar(dhd, 0, "p2p", NULL, 0, (char *)&buf,
+                               sizeof(buf), FALSE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: Get P2P failed (error=%d)\n", __FUNCTION__, ret));
+                       return 0;
+               } else {
+                       if (buf[0] == 1) {
+                               /* By default, chip supports single chan concurrency,
+                               * now lets check for mchan
+                               */
+                               ret = DHD_FLAG_CONCURR_SINGLE_CHAN_MODE;
+                               if (mchan_supported)
+                                       ret |= DHD_FLAG_CONCURR_MULTI_CHAN_MODE;
+                               if (FW_SUPPORTED(dhd, rsdb)) {
+                                       ret |= DHD_FLAG_RSDB_MODE;
+                               }
+#ifdef WL_SUPPORT_MULTIP2P
+                               if (FW_SUPPORTED(dhd, mp2p)) {
+                                       ret |= DHD_FLAG_MP2P_MODE;
+                               }
+#endif /* WL_SUPPORT_MULTIP2P */
+#if defined(WL_ENABLE_P2P_IF) || defined(WL_CFG80211_P2P_DEV_IF)
+                               return ret;
+#else
+                               return 0;
+#endif /* WL_ENABLE_P2P_IF || WL_CFG80211_P2P_DEV_IF */
+                       }
+               }
+       }
+       return 0;
+}
+#endif
+
+#ifdef WLAIBSS
+int
+dhd_preinit_aibss_ioctls(dhd_pub_t *dhd, char *iov_buf_smlen)
+{
+       int ret = BCME_OK;
+       aibss_bcn_force_config_t bcn_config;
+       uint32 aibss;
+#ifdef WLAIBSS_PS
+       uint32 aibss_ps;
+       s32 atim;
+#endif /* WLAIBSS_PS */
+       int ibss_coalesce;
+
+       aibss = 1;
+       ret = dhd_iovar(dhd, 0, "aibss", (char *)&aibss, sizeof(aibss), NULL, 0, TRUE);
+       if (ret < 0) {
+               if (ret == BCME_UNSUPPORTED) {
+                       DHD_ERROR(("%s aibss , UNSUPPORTED\n", __FUNCTION__));
+                       return BCME_OK;
+               } else {
+                       DHD_ERROR(("%s Set aibss to %d err(%d)\n", __FUNCTION__, aibss, ret));
+                       return ret;
+               }
+       }
+
+#ifdef WLAIBSS_PS
+       aibss_ps = 1;
+       ret = dhd_iovar(dhd, 0, "aibss_ps", (char *)&aibss_ps, sizeof(aibss_ps), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s Set aibss PS to %d failed  %d\n",
+                       __FUNCTION__, aibss, ret));
+               return ret;
+       }
+
+       atim = 10;
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_ATIM,
+               (char *)&atim, sizeof(atim), TRUE, 0)) < 0) {
+               DHD_ERROR(("%s Enable custom IBSS ATIM mode failed %d\n",
+                       __FUNCTION__, ret));
+               return ret;
+       }
+#endif /* WLAIBSS_PS */
+
+       memset(&bcn_config, 0, sizeof(bcn_config));
+       bcn_config.initial_min_bcn_dur = AIBSS_INITIAL_MIN_BCN_DUR;
+       bcn_config.min_bcn_dur = AIBSS_MIN_BCN_DUR;
+       bcn_config.bcn_flood_dur = AIBSS_BCN_FLOOD_DUR;
+       bcn_config.version = AIBSS_BCN_FORCE_CONFIG_VER_0;
+       bcn_config.len = sizeof(bcn_config);
+
+       ret = dhd_iovar(dhd, 0, "aibss_bcn_force_config", (char *)&bcn_config,
+                       sizeof(aibss_bcn_force_config_t), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s Set aibss_bcn_force_config to %d, %d, %d failed %d\n",
+                       __FUNCTION__, AIBSS_INITIAL_MIN_BCN_DUR, AIBSS_MIN_BCN_DUR,
+                       AIBSS_BCN_FLOOD_DUR, ret));
+               return ret;
+       }
+
+       ibss_coalesce = IBSS_COALESCE_DEFAULT;
+       ret = dhd_iovar(dhd, 0, "ibss_coalesce_allowed", (char *)&ibss_coalesce,
+                       sizeof(ibss_coalesce), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s Set ibss_coalesce_allowed failed  %d\n",
+                       __FUNCTION__, ret));
+               return ret;
+       }
+
+       dhd->op_mode |= DHD_FLAG_IBSS_MODE;
+       return BCME_OK;
+}
+#endif /* WLAIBSS */
+
+#if defined(WLADPS) || defined(WLADPS_PRIVATE_CMD)
+#ifdef WL_BAM
+static int
+dhd_check_adps_bad_ap(dhd_pub_t *dhd)
+{
+       struct net_device *ndev;
+       struct bcm_cfg80211 *cfg;
+       struct wl_profile *profile;
+       struct ether_addr bssid;
+
+       if (!dhd_is_associated(dhd, 0, NULL)) {
+               DHD_ERROR(("%s - not associated\n", __FUNCTION__));
+               return BCME_OK;
+       }
+
+       ndev = dhd_linux_get_primary_netdev(dhd);
+       if (!ndev) {
+               DHD_ERROR(("%s: Cannot find primary netdev\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       cfg = wl_get_cfg(ndev);
+       if (!cfg) {
+               DHD_ERROR(("%s: Cannot find cfg\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       profile = wl_get_profile_by_netdev(cfg, ndev);
+       memcpy(bssid.octet, profile->bssid, ETHER_ADDR_LEN);
+       if (wl_adps_bad_ap_check(cfg, &bssid)) {
+               if (wl_adps_enabled(cfg, ndev)) {
+                       wl_adps_set_suspend(cfg, ndev, ADPS_SUSPEND);
+               }
+       }
+
+       return BCME_OK;
+}
+#endif /* WL_BAM */
+
+int
+dhd_enable_adps(dhd_pub_t *dhd, uint8 on)
+{
+       int i;
+       int len;
+       int ret = BCME_OK;
+
+       bcm_iov_buf_t *iov_buf = NULL;
+       wl_adps_params_v1_t *data = NULL;
+
+       len = OFFSETOF(bcm_iov_buf_t, data) + sizeof(*data);
+       iov_buf = MALLOC(dhd->osh, len);
+       if (iov_buf == NULL) {
+               DHD_ERROR(("%s - failed to allocate %d bytes for iov_buf\n", __FUNCTION__, len));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+
+       iov_buf->version = WL_ADPS_IOV_VER;
+       iov_buf->len = sizeof(*data);
+       iov_buf->id = WL_ADPS_IOV_MODE;
+
+       data = (wl_adps_params_v1_t *)iov_buf->data;
+       data->version = ADPS_SUB_IOV_VERSION_1;
+       data->length = sizeof(*data);
+       data->mode = on;
+
+       for (i = 1; i <= MAX_BANDS; i++) {
+               data->band = i;
+               ret = dhd_iovar(dhd, 0, "adps", (char *)iov_buf, len, NULL, 0, TRUE);
+               if (ret < 0) {
+                       if (ret == BCME_UNSUPPORTED) {
+                               DHD_ERROR(("%s adps, UNSUPPORTED\n", __FUNCTION__));
+                               ret = BCME_OK;
+                               goto exit;
+                       }
+                       else {
+                               DHD_ERROR(("%s fail to set adps %s for band %d (%d)\n",
+                                       __FUNCTION__, on ? "On" : "Off", i, ret));
+                               goto exit;
+                       }
+               }
+       }
+
+#ifdef WL_BAM
+       if (on) {
+               dhd_check_adps_bad_ap(dhd);
+       }
+#endif /* WL_BAM */
+
+exit:
+       if (iov_buf) {
+               MFREE(dhd->osh, iov_buf, len);
+       }
+       return ret;
+}
+#endif /* WLADPS || WLADPS_PRIVATE_CMD */
+
+int
+dhd_get_preserve_log_numbers(dhd_pub_t *dhd, uint32 *logset_mask)
+{
+       wl_el_set_type_t logset_type, logset_op;
+       wl_el_set_all_type_v1_t *logset_all_type_op = NULL;
+       bool use_logset_all_type = FALSE;
+       int ret = BCME_ERROR;
+       int err = 0;
+       uint8 i = 0;
+       int el_set_all_type_len;
+
+       if (!dhd || !logset_mask)
+               return BCME_BADARG;
+
+       el_set_all_type_len = OFFSETOF(wl_el_set_all_type_v1_t, set_type) +
+               (sizeof(wl_el_set_type_v1_t) * dhd->event_log_max_sets);
+
+       logset_all_type_op = (wl_el_set_all_type_v1_t *) MALLOC(dhd->osh, el_set_all_type_len);
+       if (logset_all_type_op == NULL) {
+               DHD_ERROR(("%s: failed to allocate %d bytes for logset_all_type_op\n",
+                       __FUNCTION__, el_set_all_type_len));
+               return BCME_NOMEM;
+       }
+
+       *logset_mask = 0;
+       memset(&logset_type, 0, sizeof(logset_type));
+       memset(&logset_op, 0, sizeof(logset_op));
+       logset_type.version = htod16(EVENT_LOG_SET_TYPE_CURRENT_VERSION);
+       logset_type.len = htod16(sizeof(wl_el_set_type_t));
+
+       /* Try with set = event_log_max_sets, if fails, use legacy event_log_set_type */
+       logset_type.set = dhd->event_log_max_sets;
+       err = dhd_iovar(dhd, 0, "event_log_set_type", (char *)&logset_type, sizeof(logset_type),
+               (char *)logset_all_type_op, el_set_all_type_len, FALSE);
+       if (err == BCME_OK) {
+               DHD_ERROR(("%s: use optimised use_logset_all_type\n", __FUNCTION__));
+               use_logset_all_type = TRUE;
+       }
+
+       for (i = 0; i < dhd->event_log_max_sets; i++) {
+               if (use_logset_all_type) {
+                       logset_op.type = logset_all_type_op->set_type[i].type_val;
+               } else {
+                       logset_type.set = i;
+                       err = dhd_iovar(dhd, 0, "event_log_set_type", (char *)&logset_type,
+                               sizeof(logset_type), (char *)&logset_op, sizeof(logset_op), FALSE);
+               }
+               /* the iovar may return 'unsupported' error if a log set number is not present
+               * in the fw, so we should not return on error !
+               */
+               if (err == BCME_OK &&
+                               logset_op.type == EVENT_LOG_SET_TYPE_PRSRV) {
+                       *logset_mask |= 0x01u << i;
+                       ret = BCME_OK;
+                       DHD_ERROR(("[INIT] logset:%d is preserve/chatty\n", i));
+               }
+       }
+
+       MFREE(dhd->osh, logset_all_type_op, el_set_all_type_len);
+       return ret;
+}
+
+int
+dhd_optimised_preinit_ioctls(dhd_pub_t * dhd)
+{
+       int ret = 0;
+       /*  Room for "event_msgs_ext" + '\0' + bitvec  */
+       char iovbuf[WL_EVENTING_MASK_EXT_LEN + EVENTMSGS_EXT_STRUCT_SIZE + 16];
+       uint32 event_log_max_sets = 0;
+       char* iov_buf = NULL;
+       /* XXX: Use ret2 for return check of IOVARS that might return BCME_UNSUPPORTED,
+       *       based on FW build tag.
+       */
+       int ret2 = 0;
+#if defined(BCMSUP_4WAY_HANDSHAKE)
+       uint32 sup_wpa = 1;
+#endif /* BCMSUP_4WAY_HANDSHAKE */
+
+       uint32 frameburst = CUSTOM_FRAMEBURST_SET;
+       uint wnm_bsstrans_resp = 0;
+#ifdef DHD_PM_CONTROL_FROM_FILE
+       uint power_mode = PM_FAST;
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+       char buf[WLC_IOCTL_SMLEN];
+       char *ptr;
+#ifdef ROAM_ENABLE
+       uint roamvar = 0;
+#ifdef ROAM_AP_ENV_DETECTION
+       int roam_env_mode = 0;
+#endif /* ROAM_AP_ENV_DETECTION */
+#endif /* ROAM_ENABLE */
+#if defined(SOFTAP)
+       uint dtim = 1;
+#endif
+/* xxx andrey tmp fix for dk8000 build error  */
+       struct ether_addr p2p_ea;
+#ifdef GET_CUSTOM_MAC_ENABLE
+       struct ether_addr ea_addr;
+#endif /* GET_CUSTOM_MAC_ENABLE */
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       uint32 hostwake_oob = 0;
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+       wl_wlc_version_t wlc_ver;
+
+#ifdef PKT_FILTER_SUPPORT
+       dhd_pkt_filter_enable = TRUE;
+#ifdef APF
+       dhd->apf_set = FALSE;
+#endif /* APF */
+#endif /* PKT_FILTER_SUPPORT */
+       dhd->suspend_bcn_li_dtim = CUSTOM_SUSPEND_BCN_LI_DTIM;
+#ifdef ENABLE_MAX_DTIM_IN_SUSPEND
+       dhd->max_dtim_enable = TRUE;
+#else
+       dhd->max_dtim_enable = FALSE;
+#endif /* ENABLE_MAX_DTIM_IN_SUSPEND */
+       dhd->disable_dtim_in_suspend = FALSE;
+#ifdef CUSTOM_SET_OCLOFF
+       dhd->ocl_off = FALSE;
+#endif /* CUSTOM_SET_OCLOFF */
+#ifdef SUPPORT_SET_TID
+       dhd->tid_mode = SET_TID_OFF;
+       dhd->target_uid = 0;
+       dhd->target_tid = 0;
+#endif /* SUPPORT_SET_TID */
+       DHD_TRACE(("Enter %s\n", __FUNCTION__));
+       dhd->op_mode = 0;
+
+#ifdef ARP_OFFLOAD_SUPPORT
+       /* arpoe will be applied from the supsend context */
+       dhd->arpoe_enable = TRUE;
+       dhd->arpol_configured = FALSE;
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+       /* clear AP flags */
+#if defined(CUSTOM_COUNTRY_CODE)
+       dhd->dhd_cflags &= ~WLAN_PLAT_AP_FLAG;
+#endif /* CUSTOM_COUNTRY_CODE */
+
+#ifdef CUSTOMER_HW4_DEBUG
+       if (!dhd_validate_chipid(dhd)) {
+               DHD_ERROR(("%s: CONFIG_BCMXXX and CHIP ID(%x) is mismatched\n",
+                       __FUNCTION__, dhd_bus_chip_id(dhd)));
+#ifndef SUPPORT_MULTIPLE_CHIPS
+               ret = BCME_BADARG;
+               goto done;
+#endif /* !SUPPORT_MULTIPLE_CHIPS */
+       }
+#endif /* CUSTOMER_HW4_DEBUG */
+
+       /* query for 'ver' to get version info from firmware */
+       memset(buf, 0, sizeof(buf));
+       ptr = buf;
+       ret = dhd_iovar(dhd, 0, "ver", NULL, 0, (char *)&buf, sizeof(buf), FALSE);
+       if (ret < 0)
+               DHD_ERROR(("%s failed %d\n", __FUNCTION__, ret));
+       else {
+               bcmstrtok(&ptr, "\n", 0);
+               /* Print fw version info */
+               DHD_ERROR(("Firmware version = %s\n", buf));
+               strncpy(fw_version, buf, FW_VER_STR_LEN);
+               fw_version[FW_VER_STR_LEN-1] = '\0';
+#if defined(BCMSDIO) || defined(BCMPCIE)
+               dhd_set_version_info(dhd, buf);
+#endif /* BCMSDIO || BCMPCIE */
+       }
+
+       /* query for 'wlc_ver' to get version info from firmware */
+       /* memsetting to zero */
+       memset_s(&wlc_ver, sizeof(wl_wlc_version_t), 0,
+               sizeof(wl_wlc_version_t));
+       ret = dhd_iovar(dhd, 0, "wlc_ver", NULL, 0, (char *)&wlc_ver,
+                       sizeof(wl_wlc_version_t), FALSE);
+       if (ret < 0)
+               DHD_ERROR(("%s failed %d\n", __FUNCTION__, ret));
+       else {
+               dhd->wlc_ver_major = wlc_ver.wlc_ver_major;
+               dhd->wlc_ver_minor = wlc_ver.wlc_ver_minor;
+       }
+#ifdef BOARD_HIKEY
+       /* Set op_mode as MFG_MODE if WLTEST is present in "wl ver" */
+       if (strstr(fw_version, "WLTEST") != NULL) {
+               DHD_ERROR(("%s: wl ver has WLTEST, setting op_mode as DHD_FLAG_MFG_MODE\n",
+                       __FUNCTION__));
+               op_mode = DHD_FLAG_MFG_MODE;
+       }
+#endif /* BOARD_HIKEY */
+
+       if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_MFG_MODE) ||
+               (op_mode == DHD_FLAG_MFG_MODE)) {
+               dhd->op_mode = DHD_FLAG_MFG_MODE;
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+               /* disable runtimePM by default in MFG mode. */
+               pm_runtime_disable(dhd_bus_to_dev(dhd->bus));
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+#ifdef DHD_PCIE_RUNTIMEPM
+               /* Disable RuntimePM in mfg mode */
+               DHD_DISABLE_RUNTIME_PM(dhd);
+               DHD_ERROR(("%s : Disable RuntimePM in Manufactring Firmware\n", __FUNCTION__));
+#endif /* DHD_PCIE_RUNTIME_PM */
+               /* Check and adjust IOCTL response timeout for Manufactring firmware */
+               dhd_os_set_ioctl_resp_timeout(MFG_IOCTL_RESP_TIMEOUT);
+               DHD_ERROR(("%s : Set IOCTL response time for Manufactring Firmware\n",
+                       __FUNCTION__));
+
+#if defined(ARP_OFFLOAD_SUPPORT)
+               dhd->arpoe_enable = FALSE;
+#endif /* ARP_OFFLOAD_SUPPORT */
+#ifdef PKT_FILTER_SUPPORT
+               dhd_pkt_filter_enable = FALSE;
+#endif /* PKT_FILTER_SUPPORT */
+#ifndef CUSTOM_SET_ANTNPM
+               if (FW_SUPPORTED(dhd, rsdb)) {
+                       wl_config_t rsdb_mode;
+                       memset(&rsdb_mode, 0, sizeof(rsdb_mode));
+                       ret = dhd_iovar(dhd, 0, "rsdb_mode", (char *)&rsdb_mode, sizeof(rsdb_mode),
+                               NULL, 0, TRUE);
+                       if (ret < 0) {
+                               DHD_ERROR(("%s Disable rsdb_mode is failed ret= %d\n",
+                                       __FUNCTION__, ret));
+                       }
+               }
+#endif /* !CUSTOM_SET_ANTNPM */
+       } else {
+               uint32 concurrent_mode = 0;
+               dhd_os_set_ioctl_resp_timeout(IOCTL_RESP_TIMEOUT);
+               DHD_INFO(("%s : Set IOCTL response time.\n", __FUNCTION__));
+
+               BCM_REFERENCE(concurrent_mode);
+
+               dhd->op_mode = DHD_FLAG_STA_MODE;
+
+               BCM_REFERENCE(p2p_ea);
+#if !defined(AP) && defined(WLP2P)
+               if ((concurrent_mode = dhd_get_concurrent_capabilites(dhd))) {
+                       dhd->op_mode |= concurrent_mode;
+               }
+
+               /* Check if we are enabling p2p */
+               if (dhd->op_mode & DHD_FLAG_P2P_MODE) {
+                       memcpy(&p2p_ea, &dhd->mac, ETHER_ADDR_LEN);
+                       ETHER_SET_LOCALADDR(&p2p_ea);
+                       ret = dhd_iovar(dhd, 0, "p2p_da_override", (char *)&p2p_ea, sizeof(p2p_ea),
+                                       NULL, 0, TRUE);
+                       if (ret < 0)
+                               DHD_ERROR(("%s p2p_da_override ret= %d\n", __FUNCTION__, ret));
+                       else
+                               DHD_INFO(("dhd_preinit_ioctls: p2p_da_override succeeded\n"));
+               }
+#endif
+
+       }
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       ret = dhd_iovar(dhd, 0, "bus:hostwake_oob", NULL, 0, (char *)&hostwake_oob,
+               sizeof(hostwake_oob), FALSE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: hostwake_oob IOVAR not present, proceed\n", __FUNCTION__));
+       } else {
+               if (hostwake_oob == 0) {
+                       DHD_ERROR(("%s: hostwake_oob is not enabled in the NVRAM, STOP\n",
+                               __FUNCTION__));
+                       ret = BCME_UNSUPPORTED;
+                       goto done;
+               } else {
+                       DHD_ERROR(("%s: hostwake_oob enabled\n", __FUNCTION__));
+               }
+       }
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+#ifdef DNGL_AXI_ERROR_LOGGING
+       ret = dhd_iovar(dhd, 0, "axierror_logbuf_addr", NULL, 0, (char *)&dhd->axierror_logbuf_addr,
+               sizeof(dhd->axierror_logbuf_addr), FALSE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: axierror_logbuf_addr IOVAR not present, proceed\n", __FUNCTION__));
+               dhd->axierror_logbuf_addr = 0;
+       } else {
+               DHD_ERROR(("%s: axierror_logbuf_addr : 0x%x\n",
+                       __FUNCTION__, dhd->axierror_logbuf_addr));
+       }
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+#ifdef GET_CUSTOM_MAC_ENABLE
+       ret = wifi_platform_get_mac_addr(dhd->info->adapter, ea_addr.octet);
+       if (!ret) {
+               ret = dhd_iovar(dhd, 0, "cur_etheraddr", (char *)&ea_addr, ETHER_ADDR_LEN, NULL, 0,
+                               TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: can't set MAC address , error=%d\n", __FUNCTION__, ret));
+                       ret = BCME_NOTUP;
+                       goto done;
+               }
+               memcpy(dhd->mac.octet, ea_addr.octet, ETHER_ADDR_LEN);
+       } else
+#endif /* GET_CUSTOM_MAC_ENABLE */
+       {
+               /* Get the default device MAC address directly from firmware */
+               ret = dhd_iovar(dhd, 0, "cur_etheraddr", NULL, 0, (char *)&buf, sizeof(buf), FALSE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: can't get MAC address , error=%d\n", __FUNCTION__, ret));
+                       ret = BCME_NOTUP;
+                       goto done;
+               }
+
+               DHD_ERROR(("%s: use firmware generated mac_address "MACDBG"\n",
+                       __FUNCTION__, MAC2STRDBG(&buf)));
+
+#ifdef MACADDR_PROVISION_ENFORCED
+               if (ETHER_IS_LOCALADDR(buf)) {
+                       DHD_ERROR(("%s: error! not using provision mac addr!\n", __FUNCTION__));
+                       ret = BCME_BADADDR;
+                       goto done;
+               }
+#endif /* MACADDR_PROVISION_ENFORCED */
+
+               /* Update public MAC address after reading from Firmware */
+               memcpy(dhd->mac.octet, buf, ETHER_ADDR_LEN);
+       }
+
+       if (ETHER_ISNULLADDR(dhd->mac.octet)) {
+               DHD_ERROR(("%s: NULL MAC address during pre-init\n", __FUNCTION__));
+               ret = BCME_BADADDR;
+               goto done;
+       } else {
+               (void)memcpy_s(dhd_linux_get_primary_netdev(dhd)->perm_addr, ETHER_ADDR_LEN,
+                       dhd->mac.octet, ETHER_ADDR_LEN);
+       }
+
+       if ((ret = dhd_apply_default_clm(dhd, dhd->clm_path)) < 0) {
+               DHD_ERROR(("%s: CLM set failed. Abort initialization.\n", __FUNCTION__));
+               goto done;
+       }
+
+       /* get a capabilities from firmware */
+       {
+               uint32 cap_buf_size = sizeof(dhd->fw_capabilities);
+               memset(dhd->fw_capabilities, 0, cap_buf_size);
+               ret = dhd_iovar(dhd, 0, "cap", NULL, 0, dhd->fw_capabilities, (cap_buf_size - 1),
+                               FALSE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: Get Capability failed (error=%d)\n",
+                               __FUNCTION__, ret));
+                       return 0;
+               }
+
+               memmove(&dhd->fw_capabilities[1], dhd->fw_capabilities, (cap_buf_size - 1));
+               dhd->fw_capabilities[0] = ' ';
+               dhd->fw_capabilities[cap_buf_size - 2] = ' ';
+               dhd->fw_capabilities[cap_buf_size - 1] = '\0';
+       }
+
+       DHD_ERROR(("Firmware up: op_mode=0x%04x, MAC="MACDBG"\n",
+               dhd->op_mode, MAC2STRDBG(dhd->mac.octet)));
+#if defined(DHD_BLOB_EXISTENCE_CHECK)
+       if (!dhd->is_blob)
+#endif /* DHD_BLOB_EXISTENCE_CHECK */
+       {
+               /* get a ccode and revision for the country code */
+#if defined(CUSTOM_COUNTRY_CODE)
+               get_customized_country_code(dhd->info->adapter, dhd->dhd_cspec.country_abbrev,
+                       &dhd->dhd_cspec, dhd->dhd_cflags);
+#else
+               get_customized_country_code(dhd->info->adapter, dhd->dhd_cspec.country_abbrev,
+                       &dhd->dhd_cspec);
+#endif /* CUSTOM_COUNTRY_CODE */
+       }
+
+#if defined(RXFRAME_THREAD) && defined(RXTHREAD_ONLYSTA)
+       if (dhd->op_mode == DHD_FLAG_HOSTAP_MODE)
+               dhd->info->rxthread_enabled = FALSE;
+       else
+               dhd->info->rxthread_enabled = TRUE;
+#endif
+       /* Set Country code  */
+       if (dhd->dhd_cspec.ccode[0] != 0) {
+               ret = dhd_iovar(dhd, 0, "country", (char *)&dhd->dhd_cspec, sizeof(wl_country_t),
+                               NULL, 0, TRUE);
+               if (ret < 0)
+                       DHD_ERROR(("%s: country code setting failed\n", __FUNCTION__));
+       }
+
+#if defined(ROAM_ENABLE)
+       BCM_REFERENCE(roamvar);
+#ifdef USE_WFA_CERT_CONF
+       if (sec_get_param_wfa_cert(dhd, SET_PARAM_ROAMOFF, &roamvar) == BCME_OK) {
+               DHD_ERROR(("%s: read roam_off param =%d\n", __FUNCTION__, roamvar));
+       }
+       /* roamvar is set to 0 by preinit fw, change only if roamvar is non-zero */
+       if (roamvar != 0) {
+               /* Disable built-in roaming to allowed ext supplicant to take care of roaming */
+               ret = dhd_iovar(dhd, 0, "roam_off", (char *)&roamvar, sizeof(roamvar), NULL, 0,
+                       TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s roam_off failed %d\n", __FUNCTION__, ret));
+               }
+       }
+#endif /* USE_WFA_CERT_CONF */
+
+#ifdef ROAM_AP_ENV_DETECTION
+       /* Changed to GET iovar to read roam_env_mode */
+       dhd->roam_env_detection = FALSE;
+       ret = dhd_iovar(dhd, 0, "roam_env_detection", NULL, 0, (char *)&roam_env_mode,
+                       sizeof(roam_env_mode), FALSE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: roam_env_detection IOVAR not present\n", __FUNCTION__));
+       } else {
+               if (roam_env_mode == AP_ENV_INDETERMINATE) {
+                       dhd->roam_env_detection = TRUE;
+               }
+       }
+#endif /* ROAM_AP_ENV_DETECTION */
+#ifdef CONFIG_ROAM_RSSI_LIMIT
+       ret = dhd_roam_rssi_limit_set(dhd, CUSTOM_ROAMRSSI_2G, CUSTOM_ROAMRSSI_5G);
+       if (ret < 0) {
+               DHD_ERROR(("%s set roam_rssi_limit failed ret %d\n", __FUNCTION__, ret));
+       }
+#endif /* CONFIG_ROAM_RSSI_LIMIT */
+#endif /* ROAM_ENABLE */
+
+#ifdef WLTDLS
+       dhd->tdls_enable = FALSE;
+       /* query tdls_eable */
+       ret = dhd_iovar(dhd, 0, "tdls_enable", NULL, 0, (char *)&dhd->tdls_enable,
+               sizeof(dhd->tdls_enable), FALSE);
+       DHD_ERROR(("%s: tdls_enable=%d ret=%d\n", __FUNCTION__, dhd->tdls_enable, ret));
+#endif /* WLTDLS */
+
+#ifdef DHD_PM_CONTROL_FROM_FILE
+       sec_control_pm(dhd, &power_mode);
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+
+#ifdef MIMO_ANT_SETTING
+       dhd_sel_ant_from_file(dhd);
+#endif /* MIMO_ANT_SETTING */
+
+#if defined(SOFTAP)
+       if (ap_fw_loaded == TRUE) {
+               dhd_wl_ioctl_cmd(dhd, WLC_SET_DTIMPRD, (char *)&dtim, sizeof(dtim), TRUE, 0);
+       }
+#endif
+
+#if defined(KEEP_ALIVE)
+       /* Set Keep Alive : be sure to use FW with -keepalive */
+       if (!(dhd->op_mode &
+               (DHD_FLAG_HOSTAP_MODE | DHD_FLAG_MFG_MODE))) {
+               if ((ret = dhd_keep_alive_onoff(dhd)) < 0)
+                       DHD_ERROR(("%s set keeplive failed %d\n",
+                       __FUNCTION__, ret));
+       }
+#endif /* defined(KEEP_ALIVE) */
+
+       ret = dhd_iovar(dhd, 0, "event_log_max_sets", NULL, 0, (char *)&event_log_max_sets,
+               sizeof(event_log_max_sets), FALSE);
+       if (ret == BCME_OK) {
+               dhd->event_log_max_sets = event_log_max_sets;
+       } else {
+               dhd->event_log_max_sets = NUM_EVENT_LOG_SETS;
+       }
+       BCM_REFERENCE(iovbuf);
+       /* Make sure max_sets is set first with wmb and then sets_queried,
+        * this will be used during parsing the logsets in the reverse order.
+        */
+       OSL_SMP_WMB();
+       dhd->event_log_max_sets_queried = TRUE;
+       DHD_ERROR(("%s: event_log_max_sets: %d ret: %d\n",
+               __FUNCTION__, dhd->event_log_max_sets, ret));
+
+#ifdef USE_WFA_CERT_CONF
+#ifdef USE_WL_FRAMEBURST
+        if (sec_get_param_wfa_cert(dhd, SET_PARAM_FRAMEBURST, &frameburst) == BCME_OK) {
+               DHD_ERROR(("%s, read frameburst param=%d\n", __FUNCTION__, frameburst));
+        }
+#endif /* USE_WL_FRAMEBURST */
+        g_frameburst = frameburst;
+#endif /* USE_WFA_CERT_CONF */
+
+#ifdef DISABLE_WL_FRAMEBURST_SOFTAP
+       /* Disable Framebursting for SofAP */
+       if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+               frameburst = 0;
+       }
+#endif /* DISABLE_WL_FRAMEBURST_SOFTAP */
+
+       BCM_REFERENCE(frameburst);
+#if defined(USE_WL_FRAMEBURST) || defined(DISABLE_WL_FRAMEBURST_SOFTAP)
+       /* frameburst is set to 1 by preinit fw, change if otherwise */
+       if (frameburst != 1) {
+               /* Set frameburst to value */
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_FAKEFRAG, (char *)&frameburst,
+                       sizeof(frameburst), TRUE, 0)) < 0) {
+                       DHD_INFO(("%s frameburst not supported  %d\n", __FUNCTION__, ret));
+               }
+       }
+#endif /* USE_WL_FRAMEBURST || DISABLE_WL_FRAMEBURST_SOFTAP */
+
+       iov_buf = (char*)MALLOC(dhd->osh, WLC_IOCTL_SMLEN);
+       if (iov_buf == NULL) {
+               DHD_ERROR(("failed to allocate %d bytes for iov_buf\n", WLC_IOCTL_SMLEN));
+               ret = BCME_NOMEM;
+               goto done;
+       }
+
+#if defined(BCMSUP_4WAY_HANDSHAKE)
+       /* Read 4-way handshake requirements */
+       if (dhd_use_idsup == 1) {
+               ret = dhd_iovar(dhd, 0, "sup_wpa", (char *)&sup_wpa, sizeof(sup_wpa),
+                               (char *)&iovbuf, sizeof(iovbuf), FALSE);
+               /* sup_wpa iovar returns NOTREADY status on some platforms using modularized
+                * in-dongle supplicant.
+                */
+               if (ret >= 0 || ret == BCME_NOTREADY)
+                       dhd->fw_4way_handshake = TRUE;
+               DHD_TRACE(("4-way handshake mode is: %d\n", dhd->fw_4way_handshake));
+       }
+#endif /* BCMSUP_4WAY_HANDSHAKE */
+
+#if defined(PCIE_FULL_DONGLE) && defined(DHD_LOSSLESS_ROAMING)
+       dhd_update_flow_prio_map(dhd, DHD_FLOW_PRIO_LLR_MAP);
+#endif /* defined(PCIE_FULL_DONGLE) && defined(DHD_LOSSLESS_ROAMING) */
+
+#if defined(BCMPCIE) && defined(EAPOL_PKT_PRIO)
+       dhd_update_flow_prio_map(dhd, DHD_FLOW_PRIO_LLR_MAP);
+#endif /* defined(BCMPCIE) && defined(EAPOL_PKT_PRIO) */
+
+#ifdef ARP_OFFLOAD_SUPPORT
+       DHD_ERROR(("arp_enable:%d arp_ol:%d\n",
+               dhd->arpoe_enable, dhd->arpol_configured));
+#endif /* ARP_OFFLOAD_SUPPORT */
+       /*
+        * Retaining pktfilter fotr temporary, once fw preinit includes this,
+        * this will be removed. Caution is to skip the pktfilter check during
+        * each pktfilter removal.
+        */
+#ifdef PKT_FILTER_SUPPORT
+       /* Setup default defintions for pktfilter , enable in suspend */
+       dhd->pktfilter_count = 6;
+       dhd->pktfilter[DHD_BROADCAST_FILTER_NUM] = NULL;
+       if (!FW_SUPPORTED(dhd, pf6)) {
+               dhd->pktfilter[DHD_MULTICAST4_FILTER_NUM] = NULL;
+               dhd->pktfilter[DHD_MULTICAST6_FILTER_NUM] = NULL;
+       } else {
+               /* Immediately pkt filter TYPE 6 Discard IPv4/IPv6 Multicast Packet */
+               dhd->pktfilter[DHD_MULTICAST4_FILTER_NUM] = DISCARD_IPV4_MCAST;
+               dhd->pktfilter[DHD_MULTICAST6_FILTER_NUM] = DISCARD_IPV6_MCAST;
+       }
+       /* apply APP pktfilter */
+       dhd->pktfilter[DHD_ARP_FILTER_NUM] = "105 0 0 12 0xFFFF 0x0806";
+
+#ifdef BLOCK_IPV6_PACKET
+       /* Setup filter to allow only IPv4 unicast frames */
+       dhd->pktfilter[DHD_UNICAST_FILTER_NUM] = "100 0 0 0 "
+               HEX_PREF_STR UNI_FILTER_STR ZERO_ADDR_STR ETHER_TYPE_STR IPV6_FILTER_STR
+               " "
+               HEX_PREF_STR ZERO_ADDR_STR ZERO_ADDR_STR ETHER_TYPE_STR ZERO_TYPE_STR;
+#else
+       /* Setup filter to allow only unicast */
+       dhd->pktfilter[DHD_UNICAST_FILTER_NUM] = "100 0 0 0 0x01 0x00";
+#endif /* BLOCK_IPV6_PACKET */
+
+#ifdef PASS_IPV4_SUSPEND
+       /* XXX customer want to get IPv4 multicast packets */
+       dhd->pktfilter[DHD_MDNS_FILTER_NUM] = "104 0 0 0 0xFFFFFF 0x01005E";
+#else
+       /* Add filter to pass multicastDNS packet and NOT filter out as Broadcast */
+       dhd->pktfilter[DHD_MDNS_FILTER_NUM] = NULL;
+#endif /* PASS_IPV4_SUSPEND */
+       if (FW_SUPPORTED(dhd, pf6)) {
+               /* Immediately pkt filter TYPE 6 Dicard Broadcast IP packet */
+               dhd->pktfilter[DHD_IP4BCAST_DROP_FILTER_NUM] = DISCARD_IPV4_BCAST;
+               /* Immediately pkt filter TYPE 6 Dicard Cisco STP packet */
+               dhd->pktfilter[DHD_LLC_STP_DROP_FILTER_NUM] = DISCARD_LLC_STP;
+               /* Immediately pkt filter TYPE 6 Dicard Cisco XID protocol */
+               dhd->pktfilter[DHD_LLC_XID_DROP_FILTER_NUM] = DISCARD_LLC_XID;
+               /* Immediately pkt filter TYPE 6 Dicard NETBIOS packet(port 137) */
+               dhd->pktfilter[DHD_UDPNETBIOS_DROP_FILTER_NUM] = DISCARD_UDPNETBIOS;
+               dhd->pktfilter_count = 11;
+       }
+
+#ifdef GAN_LITE_NAT_KEEPALIVE_FILTER
+       dhd->pktfilter_count = 4;
+       /* Setup filter to block broadcast and NAT Keepalive packets */
+       /* discard all broadcast packets */
+       dhd->pktfilter[DHD_UNICAST_FILTER_NUM] = "100 0 0 0 0xffffff 0xffffff";
+       /* discard NAT Keepalive packets */
+       dhd->pktfilter[DHD_BROADCAST_FILTER_NUM] = "102 0 0 36 0xffffffff 0x11940009";
+       /* discard NAT Keepalive packets */
+       dhd->pktfilter[DHD_MULTICAST4_FILTER_NUM] = "104 0 0 38 0xffffffff 0x11940009";
+       dhd->pktfilter[DHD_MULTICAST6_FILTER_NUM] = NULL;
+#endif /* GAN_LITE_NAT_KEEPALIVE_FILTER */
+
+#if defined(SOFTAP)
+       if (ap_fw_loaded) {
+               /* XXX Andrey: fo SOFTAP disable pkt filters (if there were any )  */
+               dhd_enable_packet_filter(0, dhd);
+       }
+#endif /* defined(SOFTAP) */
+       dhd_set_packet_filter(dhd);
+#endif /* PKT_FILTER_SUPPORT */
+
+       /* query for 'clmver' to get clm version info from firmware */
+       bzero(buf, sizeof(buf));
+       ret = dhd_iovar(dhd, 0, "clmver", NULL, 0, buf, sizeof(buf), FALSE);
+       if (ret < 0)
+               DHD_ERROR(("%s failed %d\n", __FUNCTION__, ret));
+       else {
+               char *ver_temp_buf = NULL;
+
+               if ((ver_temp_buf = bcmstrstr(buf, "Data:")) == NULL) {
+                       DHD_ERROR(("Couldn't find \"Data:\"\n"));
+               } else {
+                       ptr = (ver_temp_buf + strlen("Data:"));
+                       if ((ver_temp_buf = bcmstrtok(&ptr, "\n", 0)) == NULL) {
+                               DHD_ERROR(("Couldn't find New line character\n"));
+                       } else {
+                               bzero(clm_version, CLM_VER_STR_LEN);
+                               strlcpy(clm_version, ver_temp_buf,
+                                       MIN(strlen(ver_temp_buf) + 1, CLM_VER_STR_LEN));
+                               DHD_INFO(("CLM version = %s\n", clm_version));
+                       }
+               }
+
+#if defined(CUSTOMER_HW4_DEBUG)
+               if ((ver_temp_buf = bcmstrstr(ptr, "Customization:")) == NULL) {
+                       DHD_ERROR(("Couldn't find \"Customization:\"\n"));
+               } else {
+                       char tokenlim;
+                       ptr = (ver_temp_buf + strlen("Customization:"));
+                       if ((ver_temp_buf = bcmstrtok(&ptr, "(\n", &tokenlim)) == NULL) {
+                               DHD_ERROR(("Couldn't find project blob version"
+                                       "or New line character\n"));
+                       } else if (tokenlim == '(') {
+                               snprintf(clm_version,
+                                       CLM_VER_STR_LEN - 1, "%s, Blob ver = Major : %s minor : ",
+                                       clm_version, ver_temp_buf);
+                               DHD_INFO(("[INFO]CLM/Blob version = %s\n", clm_version));
+                               if ((ver_temp_buf = bcmstrtok(&ptr, "\n", &tokenlim)) == NULL) {
+                                       DHD_ERROR(("Couldn't find New line character\n"));
+                               } else {
+                                       snprintf(clm_version,
+                                               strlen(clm_version) + strlen(ver_temp_buf),
+                                               "%s%s", clm_version, ver_temp_buf);
+                                       DHD_INFO(("[INFO]CLM/Blob/project version = %s\n",
+                                               clm_version));
+
+                               }
+                       } else if (tokenlim == '\n') {
+                               snprintf(clm_version,
+                                       strlen(clm_version) + strlen(", Blob ver = Major : ") + 1,
+                                       "%s, Blob ver = Major : ", clm_version);
+                               snprintf(clm_version,
+                                       strlen(clm_version) + strlen(ver_temp_buf) + 1,
+                                       "%s%s", clm_version, ver_temp_buf);
+                               DHD_INFO(("[INFO]CLM/Blob/project version = %s\n", clm_version));
+                       }
+               }
+#endif /* CUSTOMER_HW4_DEBUG */
+               if (strlen(clm_version)) {
+                       DHD_ERROR(("CLM version = %s\n", clm_version));
+               } else {
+                       DHD_ERROR(("Couldn't find CLM version!\n"));
+               }
+
+       }
+
+#ifdef WRITE_WLANINFO
+       sec_save_wlinfo(fw_version, EPI_VERSION_STR, dhd->info->nv_path, clm_version);
+#endif /* WRITE_WLANINFO */
+
+#ifdef GEN_SOFTAP_INFO_FILE
+       sec_save_softap_info();
+#endif /* GEN_SOFTAP_INFO_FILE */
+
+#ifdef PNO_SUPPORT
+       if (!dhd->pno_state) {
+               dhd_pno_init(dhd);
+       }
+#endif
+
+#ifdef RTT_SUPPORT
+       if (dhd->rtt_state) {
+               ret = dhd_rtt_init(dhd);
+               if (ret < 0) {
+                       DHD_ERROR(("%s failed to initialize RTT\n", __FUNCTION__));
+               }
+       }
+#endif
+
+#ifdef FILTER_IE
+       /* Failure to configure filter IE is not a fatal error, ignore it. */
+       if (FW_SUPPORTED(dhd, fie) &&
+               !(dhd->op_mode & (DHD_FLAG_HOSTAP_MODE | DHD_FLAG_MFG_MODE))) {
+               dhd_read_from_file(dhd);
+       }
+#endif /* FILTER_IE */
+
+#ifdef NDO_CONFIG_SUPPORT
+       dhd->ndo_enable = FALSE;
+       dhd->ndo_host_ip_overflow = FALSE;
+       dhd->ndo_max_host_ip = NDO_MAX_HOST_IP_ENTRIES;
+#endif /* NDO_CONFIG_SUPPORT */
+
+       /* ND offload version supported */
+       dhd->ndo_version = dhd_ndo_get_version(dhd);
+
+       /* check dongle supports wbtext (product policy) or not */
+       dhd->wbtext_support = FALSE;
+       if (dhd_wl_ioctl_get_intiovar(dhd, "wnm_bsstrans_resp", &wnm_bsstrans_resp,
+                       WLC_GET_VAR, FALSE, 0) != BCME_OK) {
+               DHD_ERROR(("failed to get wnm_bsstrans_resp\n"));
+       }
+       dhd->wbtext_policy = wnm_bsstrans_resp;
+       if (dhd->wbtext_policy == WL_BSSTRANS_POLICY_PRODUCT_WBTEXT) {
+               dhd->wbtext_support = TRUE;
+       }
+#ifndef WBTEXT
+       /* driver can turn off wbtext feature through makefile */
+       if (dhd->wbtext_support) {
+               if (dhd_wl_ioctl_set_intiovar(dhd, "wnm_bsstrans_resp",
+                               WL_BSSTRANS_POLICY_ROAM_ALWAYS,
+                               WLC_SET_VAR, FALSE, 0) != BCME_OK) {
+                       DHD_ERROR(("failed to disable WBTEXT\n"));
+               }
+       }
+#endif /* !WBTEXT */
+
+#ifdef DHD_NON_DMA_M2M_CORRUPTION
+       /* check pcie non dma loopback */
+       if (dhd->op_mode == DHD_FLAG_MFG_MODE &&
+               (dhd_bus_dmaxfer_lpbk(dhd, M2M_NON_DMA_LPBK) < 0)) {
+                       goto done;
+       }
+#endif /* DHD_NON_DMA_M2M_CORRUPTION */
+
+#ifdef CUSTOM_ASSOC_TIMEOUT
+       /* set recreate_bi_timeout to increase assoc timeout :
+       * 20 * 100TU * 1024 / 1000 = 2 secs
+       * (beacon wait time = recreate_bi_timeout * beacon_period * 1024 / 1000)
+       */
+       if (dhd_wl_ioctl_set_intiovar(dhd, "recreate_bi_timeout",
+                       CUSTOM_ASSOC_TIMEOUT,
+                       WLC_SET_VAR, TRUE, 0) != BCME_OK) {
+               DHD_ERROR(("failed to set assoc timeout\n"));
+       }
+#endif /* CUSTOM_ASSOC_TIMEOUT */
+
+       BCM_REFERENCE(ret2);
+#ifdef WL_MONITOR
+       if (FW_SUPPORTED(dhd, monitor)) {
+               dhd->monitor_enable = TRUE;
+               DHD_ERROR(("%s: Monitor mode is enabled in FW cap\n", __FUNCTION__));
+       } else {
+               dhd->monitor_enable = FALSE;
+               DHD_ERROR(("%s: Monitor mode is not enabled in FW cap\n", __FUNCTION__));
+       }
+#endif /* WL_MONITOR */
+
+       /* store the preserve log set numbers */
+       if (dhd_get_preserve_log_numbers(dhd, &dhd->logset_prsrv_mask)
+                       != BCME_OK) {
+               DHD_ERROR(("%s: Failed to get preserve log # !\n", __FUNCTION__));
+       }
+
+#ifdef CONFIG_SILENT_ROAM
+       dhd->sroam_turn_on = TRUE;
+       dhd->sroamed = FALSE;
+#endif /* CONFIG_SILENT_ROAM */
+
+       dhd_set_bandlock(dhd);
+
+done:
+       if (iov_buf) {
+               MFREE(dhd->osh, iov_buf, WLC_IOCTL_SMLEN);
+       }
+       return ret;
+}
+
+int
+dhd_legacy_preinit_ioctls(dhd_pub_t *dhd)
+{
+       int ret = 0;
+       /*  Room for "event_msgs_ext" + '\0' + bitvec  */
+//     char iovbuf[WL_EVENTING_MASK_EXT_LEN + EVENTMSGS_EXT_STRUCT_SIZE + 16];
+       char *mask;
+       uint32 buf_key_b4_m4 = 1;
+       uint8 msglen;
+       eventmsgs_ext_t *eventmask_msg = NULL;
+       uint32 event_log_max_sets = 0;
+       char* iov_buf = NULL;
+       /* XXX: Use ret2 for return check of IOVARS that might return BCME_UNSUPPORTED,
+       *       based on FW build tag.
+       */
+       int ret2 = 0;
+       uint32 wnm_cap = 0;
+#if defined(BCMSUP_4WAY_HANDSHAKE)
+       uint32 sup_wpa = 1;
+#endif /* BCMSUP_4WAY_HANDSHAKE */
+#if defined(CUSTOM_AMPDU_BA_WSIZE) || (defined(WLAIBSS) && \
+       defined(CUSTOM_IBSS_AMPDU_BA_WSIZE))
+       uint32 ampdu_ba_wsize = 0;
+#endif /* CUSTOM_AMPDU_BA_WSIZE ||(WLAIBSS && CUSTOM_IBSS_AMPDU_BA_WSIZE) */
+#if defined(CUSTOM_AMPDU_MPDU)
+       int32 ampdu_mpdu = 0;
+#endif
+#if defined(CUSTOM_AMPDU_RELEASE)
+       int32 ampdu_release = 0;
+#endif
+#if defined(CUSTOM_AMSDU_AGGSF)
+       int32 amsdu_aggsf = 0;
+#endif
+
+#if defined(BCMSDIO) || defined(BCMDBUS)
+#ifdef PROP_TXSTATUS
+       int wlfc_enable = TRUE;
+#ifndef DISABLE_11N
+       uint32 hostreorder = 1;
+       uint wl_down = 1;
+#endif /* DISABLE_11N */
+#endif /* PROP_TXSTATUS */
+#endif /* BCMSDIO || BCMDBUS */
+
+#ifndef PCIE_FULL_DONGLE
+       uint32 wl_ap_isolate;
+#endif /* PCIE_FULL_DONGLE */
+       uint32 frameburst = CUSTOM_FRAMEBURST_SET;
+       uint wnm_bsstrans_resp = 0;
+#ifdef SUPPORT_SET_CAC
+       uint32 cac = 1;
+#endif /* SUPPORT_SET_CAC */
+#if defined(SUPPORT_2G_VHT) || defined(SUPPORT_5G_1024QAM_VHT)
+       uint32 vht_features = 0; /* init to 0, will be set based on each support */
+#endif /* SUPPORT_2G_VHT || SUPPORT_5G_1024QAM_VHT */
+
+#ifdef DHD_ENABLE_LPC
+       uint32 lpc = 1;
+#endif /* DHD_ENABLE_LPC */
+       uint power_mode = PM_FAST;
+#if defined(BCMSDIO)
+       uint32 dongle_align = DHD_SDALIGN;
+       uint32 glom = CUSTOM_GLOM_SETTING;
+#endif /* defined(BCMSDIO) */
+       uint bcn_timeout = CUSTOM_BCN_TIMEOUT;
+       uint scancache_enab = TRUE;
+#ifdef ENABLE_BCN_LI_BCN_WAKEUP
+       uint32 bcn_li_bcn = 1;
+#endif /* ENABLE_BCN_LI_BCN_WAKEUP */
+       uint retry_max = CUSTOM_ASSOC_RETRY_MAX;
+       int scan_assoc_time = DHD_SCAN_ASSOC_ACTIVE_TIME;
+       int scan_unassoc_time = DHD_SCAN_UNASSOC_ACTIVE_TIME;
+       int scan_passive_time = DHD_SCAN_PASSIVE_TIME;
+       char buf[WLC_IOCTL_SMLEN];
+       char *ptr;
+       uint32 listen_interval = CUSTOM_LISTEN_INTERVAL; /* Default Listen Interval in Beacons */
+#if defined(DHD_8021X_DUMP) && defined(SHOW_LOGTRACE)
+       wl_el_tag_params_t *el_tag = NULL;
+#endif /* DHD_8021X_DUMP */
+#ifdef ROAM_ENABLE
+       uint roamvar = 0;
+       int roam_trigger[2] = {CUSTOM_ROAM_TRIGGER_SETTING, WLC_BAND_ALL};
+       int roam_scan_period[2] = {10, WLC_BAND_ALL};
+       int roam_delta[2] = {CUSTOM_ROAM_DELTA_SETTING, WLC_BAND_ALL};
+#ifdef ROAM_AP_ENV_DETECTION
+       int roam_env_mode = AP_ENV_INDETERMINATE;
+#endif /* ROAM_AP_ENV_DETECTION */
+#ifdef FULL_ROAMING_SCAN_PERIOD_60_SEC
+       int roam_fullscan_period = 60;
+#else /* FULL_ROAMING_SCAN_PERIOD_60_SEC */
+       int roam_fullscan_period = 120;
+#endif /* FULL_ROAMING_SCAN_PERIOD_60_SEC */
+#ifdef DISABLE_BCNLOSS_ROAM
+       uint roam_bcnloss_off = 1;
+#endif /* DISABLE_BCNLOSS_ROAM */
+#else
+#ifdef DISABLE_BUILTIN_ROAM
+       uint roamvar = 1;
+#endif /* DISABLE_BUILTIN_ROAM */
+#endif /* ROAM_ENABLE */
+
+#if defined(SOFTAP)
+       uint dtim = 1;
+#endif
+/* xxx andrey tmp fix for dk8000 build error  */
+#if (defined(AP) && !defined(WLP2P)) || (!defined(AP) && defined(WL_CFG80211))
+       struct ether_addr p2p_ea;
+#endif
+#ifdef BCMCCX
+       uint32 ccx = 1;
+#endif
+#ifdef SOFTAP_UAPSD_OFF
+       uint32 wme_apsd = 0;
+#endif /* SOFTAP_UAPSD_OFF */
+#if (defined(AP) || defined(WLP2P)) && !defined(SOFTAP_AND_GC)
+       uint32 apsta = 1; /* Enable APSTA mode */
+#elif defined(SOFTAP_AND_GC)
+       uint32 apsta = 0;
+       int ap_mode = 1;
+#endif /* (defined(AP) || defined(WLP2P)) && !defined(SOFTAP_AND_GC) */
+#ifdef GET_CUSTOM_MAC_ENABLE
+       struct ether_addr ea_addr;
+       char hw_ether[62];
+#endif /* GET_CUSTOM_MAC_ENABLE */
+#ifdef OKC_SUPPORT
+       uint32 okc = 1;
+#endif
+
+#ifdef DISABLE_11N
+       uint32 nmode = 0;
+#endif /* DISABLE_11N */
+
+#ifdef USE_WL_TXBF
+       uint32 txbf = 1;
+#endif /* USE_WL_TXBF */
+#ifdef DISABLE_TXBFR
+       uint32 txbf_bfr_cap = 0;
+#endif /* DISABLE_TXBFR */
+#ifdef AMPDU_VO_ENABLE
+       /* XXX: Enabling VO AMPDU to reduce FER */
+       struct ampdu_tid_control tid;
+#endif
+#if defined(PROP_TXSTATUS)
+#ifdef USE_WFA_CERT_CONF
+       uint32 proptx = 0;
+#endif /* USE_WFA_CERT_CONF */
+#endif /* PROP_TXSTATUS */
+#ifdef DHD_SET_FW_HIGHSPEED
+       uint32 ack_ratio = 250;
+       uint32 ack_ratio_depth = 64;
+#endif /* DHD_SET_FW_HIGHSPEED */
+#ifdef DISABLE_11N_PROPRIETARY_RATES
+       uint32 ht_features = 0;
+#endif /* DISABLE_11N_PROPRIETARY_RATES */
+#ifdef CUSTOM_PSPRETEND_THR
+       uint32 pspretend_thr = CUSTOM_PSPRETEND_THR;
+#endif
+#ifdef CUSTOM_EVENT_PM_WAKE
+       uint32 pm_awake_thresh = CUSTOM_EVENT_PM_WAKE;
+#endif /* CUSTOM_EVENT_PM_WAKE */
+#ifdef DISABLE_PRUNED_SCAN
+       uint32 scan_features = 0;
+#endif /* DISABLE_PRUNED_SCAN */
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       uint32 hostwake_oob = 0;
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef EVENT_LOG_RATE_HC
+       /* threshold number of lines per second */
+#define EVENT_LOG_RATE_HC_THRESHOLD    1000
+       uint32 event_log_rate_hc = EVENT_LOG_RATE_HC_THRESHOLD;
+#endif /* EVENT_LOG_RATE_HC */
+#if defined(WBTEXT) && defined(WBTEXT_BTMDELTA)
+       uint32 btmdelta = WBTEXT_BTMDELTA;
+#endif /* WBTEXT && WBTEXT_BTMDELTA */
+#if defined(WBTEXT) && defined(RRM_BCNREQ_MAX_CHAN_TIME)
+       uint32 rrm_bcn_req_thrtl_win = RRM_BCNREQ_MAX_CHAN_TIME * 2;
+       uint32 rrm_bcn_req_max_off_chan_time = RRM_BCNREQ_MAX_CHAN_TIME;
+#endif /* WBTEXT && RRM_BCNREQ_MAX_CHAN_TIME */
+#ifdef PKT_FILTER_SUPPORT
+       dhd_pkt_filter_enable = TRUE;
+#ifdef APF
+       dhd->apf_set = FALSE;
+#endif /* APF */
+#endif /* PKT_FILTER_SUPPORT */
+       dhd->suspend_bcn_li_dtim = CUSTOM_SUSPEND_BCN_LI_DTIM;
+#ifdef ENABLE_MAX_DTIM_IN_SUSPEND
+       dhd->max_dtim_enable = TRUE;
+#else
+       dhd->max_dtim_enable = FALSE;
+#endif /* ENABLE_MAX_DTIM_IN_SUSPEND */
+       dhd->disable_dtim_in_suspend = FALSE;
+#ifdef CUSTOM_SET_OCLOFF
+       dhd->ocl_off = FALSE;
+#endif /* CUSTOM_SET_OCLOFF */
+#ifdef SUPPORT_SET_TID
+       dhd->tid_mode = SET_TID_OFF;
+       dhd->target_uid = 0;
+       dhd->target_tid = 0;
+#endif /* SUPPORT_SET_TID */
+       DHD_TRACE(("Enter %s\n", __FUNCTION__));
+
+#ifdef DHDTCPACK_SUPPRESS
+       dhd_tcpack_suppress_set(dhd, dhd->conf->tcpack_sup_mode);
+#endif
+       dhd->op_mode = 0;
+#ifdef ARP_OFFLOAD_SUPPORT
+       /* arpoe will be applied from the supsend context */
+       dhd->arpoe_enable = TRUE;
+       dhd->arpol_configured = FALSE;
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+       /* clear AP flags */
+#if defined(CUSTOM_COUNTRY_CODE)
+       dhd->dhd_cflags &= ~WLAN_PLAT_AP_FLAG;
+#endif /* CUSTOM_COUNTRY_CODE */
+
+#ifdef CUSTOMER_HW4_DEBUG
+       if (!dhd_validate_chipid(dhd)) {
+               DHD_ERROR(("%s: CONFIG_BCMXXX and CHIP ID(%x) is mismatched\n",
+                       __FUNCTION__, dhd_bus_chip_id(dhd)));
+#ifndef SUPPORT_MULTIPLE_CHIPS
+               ret = BCME_BADARG;
+               goto done;
+#endif /* !SUPPORT_MULTIPLE_CHIPS */
+       }
+#endif /* CUSTOMER_HW4_DEBUG */
+
+       /* query for 'ver' to get version info from firmware */
+       memset(buf, 0, sizeof(buf));
+       ptr = buf;
+       ret = dhd_iovar(dhd, 0, "ver", NULL, 0, (char *)&buf, sizeof(buf), FALSE);
+       if (ret < 0)
+               DHD_ERROR(("%s failed %d\n", __FUNCTION__, ret));
+       else {
+               bcmstrtok(&ptr, "\n", 0);
+               /* Print fw version info */
+               strncpy(fw_version, buf, FW_VER_STR_LEN);
+               fw_version[FW_VER_STR_LEN-1] = '\0';
+       }
+
+#ifdef BOARD_HIKEY
+       /* Set op_mode as MFG_MODE if WLTEST is present in "wl ver" */
+       if (strstr(fw_version, "WLTEST") != NULL) {
+               DHD_ERROR(("%s: wl ver has WLTEST, setting op_mode as DHD_FLAG_MFG_MODE\n",
+                       __FUNCTION__));
+               op_mode = DHD_FLAG_MFG_MODE;
+       }
+#endif /* BOARD_HIKEY */
+
+       if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_MFG_MODE) ||
+               (op_mode == DHD_FLAG_MFG_MODE)) {
+               dhd->op_mode = DHD_FLAG_MFG_MODE;
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+               /* disable runtimePM by default in MFG mode. */
+               pm_runtime_disable(dhd_bus_to_dev(dhd->bus));
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+#ifdef DHD_PCIE_RUNTIMEPM
+               /* Disable RuntimePM in mfg mode */
+               DHD_DISABLE_RUNTIME_PM(dhd);
+               DHD_ERROR(("%s : Disable RuntimePM in Manufactring Firmware\n", __FUNCTION__));
+#endif /* DHD_PCIE_RUNTIME_PM */
+               /* Check and adjust IOCTL response timeout for Manufactring firmware */
+               dhd_os_set_ioctl_resp_timeout(MFG_IOCTL_RESP_TIMEOUT);
+               DHD_ERROR(("%s : Set IOCTL response time for Manufactring Firmware\n",
+                       __FUNCTION__));
+       } else {
+               dhd_os_set_ioctl_resp_timeout(IOCTL_RESP_TIMEOUT);
+               DHD_INFO(("%s : Set IOCTL response time.\n", __FUNCTION__));
+       }
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       ret = dhd_iovar(dhd, 0, "bus:hostwake_oob", NULL, 0, (char *)&hostwake_oob,
+               sizeof(hostwake_oob), FALSE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: hostwake_oob IOVAR not present, proceed\n", __FUNCTION__));
+       } else {
+               if (hostwake_oob == 0) {
+                       DHD_ERROR(("%s: hostwake_oob is not enabled in the NVRAM, STOP\n",
+                               __FUNCTION__));
+                       ret = BCME_UNSUPPORTED;
+                       goto done;
+               } else {
+                       DHD_ERROR(("%s: hostwake_oob enabled\n", __FUNCTION__));
+               }
+       }
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+#ifdef DNGL_AXI_ERROR_LOGGING
+       ret = dhd_iovar(dhd, 0, "axierror_logbuf_addr", NULL, 0, (char *)&dhd->axierror_logbuf_addr,
+               sizeof(dhd->axierror_logbuf_addr), FALSE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: axierror_logbuf_addr IOVAR not present, proceed\n", __FUNCTION__));
+               dhd->axierror_logbuf_addr = 0;
+       } else {
+               DHD_ERROR(("%s: axierror_logbuf_addr : 0x%x\n",
+                       __FUNCTION__, dhd->axierror_logbuf_addr));
+       }
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+#ifdef EVENT_LOG_RATE_HC
+       ret = dhd_iovar(dhd, 0, "event_log_rate_hc", (char *)&event_log_rate_hc,
+               sizeof(event_log_rate_hc), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s event_log_rate_hc set failed %d\n", __FUNCTION__, ret));
+       } else  {
+               DHD_ERROR(("%s event_log_rate_hc set with threshold:%d\n", __FUNCTION__,
+                       event_log_rate_hc));
+       }
+#endif /* EVENT_LOG_RATE_HC */
+
+#ifdef GET_CUSTOM_MAC_ENABLE
+       memset(hw_ether, 0, sizeof(hw_ether));
+       ret = wifi_platform_get_mac_addr(dhd->info->adapter, hw_ether, iface_name);
+#ifdef GET_CUSTOM_MAC_FROM_CONFIG
+       if (!memcmp(&ether_null, &dhd->conf->hw_ether, ETHER_ADDR_LEN)) {
+               ret = 0;
+       } else
+#endif
+       if (!ret) {
+               memset(buf, 0, sizeof(buf));
+#ifdef GET_CUSTOM_MAC_FROM_CONFIG
+               memcpy(hw_ether, &dhd->conf->hw_ether, sizeof(dhd->conf->hw_ether));
+#endif
+               bcopy(hw_ether, ea_addr.octet, sizeof(struct ether_addr));
+               bcm_mkiovar("cur_etheraddr", (void *)&ea_addr, ETHER_ADDR_LEN, buf, sizeof(buf));
+               ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, sizeof(buf), TRUE, 0);
+               if (ret < 0) {
+                       memset(buf, 0, sizeof(buf));
+                       bcm_mkiovar("hw_ether", hw_ether, sizeof(hw_ether), buf, sizeof(buf));
+                       ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, sizeof(buf), TRUE, 0);
+                       if (ret) {
+                               DHD_ERROR(("%s: can't set MAC address MAC="MACDBG", error=%d\n",
+                                       __FUNCTION__, MAC2STRDBG(hw_ether), ret));
+                               prhex("MACPAD", &hw_ether[ETHER_ADDR_LEN], sizeof(hw_ether)-ETHER_ADDR_LEN);
+                               ret = BCME_NOTUP;
+                               goto done;
+                       }
+               }
+       } else {
+               DHD_ERROR(("%s: can't get custom MAC address, ret=%d\n", __FUNCTION__, ret));
+               ret = BCME_NOTUP;
+               goto done;
+       }
+#endif /* GET_CUSTOM_MAC_ENABLE */
+       /* Get the default device MAC address directly from firmware */
+       ret = dhd_iovar(dhd, 0, "cur_etheraddr", NULL, 0, (char *)&buf, sizeof(buf), FALSE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: can't get MAC address , error=%d\n", __FUNCTION__, ret));
+               ret = BCME_NOTUP;
+               goto done;
+       }
+
+       DHD_ERROR(("%s: use firmware generated mac_address "MACDBG"\n",
+               __FUNCTION__, MAC2STRDBG(&buf)));
+
+#ifdef MACADDR_PROVISION_ENFORCED
+       if (ETHER_IS_LOCALADDR(buf)) {
+               DHD_ERROR(("%s: error! not using provision mac addr!\n", __FUNCTION__));
+               ret = BCME_BADADDR;
+               goto done;
+       }
+#endif /* MACADDR_PROVISION_ENFORCED */
+
+       /* Update public MAC address after reading from Firmware */
+       memcpy(dhd->mac.octet, buf, ETHER_ADDR_LEN);
+
+       if (ETHER_ISNULLADDR(dhd->mac.octet)) {
+               DHD_ERROR(("%s: NULL MAC address during pre-init\n", __FUNCTION__));
+               ret = BCME_BADADDR;
+               goto done;
+       } else {
+               (void)memcpy_s(dhd_linux_get_primary_netdev(dhd)->perm_addr, ETHER_ADDR_LEN,
+                       dhd->mac.octet, ETHER_ADDR_LEN);
+       }
+#if defined(WL_STA_ASSOC_RAND) && defined(WL_STA_INIT_RAND)
+       /* Set cur_etheraddr of primary interface to randomized address to ensure
+        * that any action frame transmission will happen using randomized macaddr
+        * primary netdev->perm_addr will hold the original factory MAC.
+        */
+       {
+               if ((ret = dhd_update_rand_mac_addr(dhd)) < 0) {
+                       DHD_ERROR(("%s: failed to set macaddress\n", __FUNCTION__));
+                       goto done;
+               }
+       }
+#endif /* WL_STA_ASSOC_RAND && WL_STA_INIT_RAND */
+
+       if ((ret = dhd_apply_default_clm(dhd, dhd->clm_path)) < 0) {
+               DHD_ERROR(("%s: CLM set failed. Abort initialization.\n", __FUNCTION__));
+               goto done;
+       }
+
+       /* get a capabilities from firmware */
+       {
+               uint32 cap_buf_size = sizeof(dhd->fw_capabilities);
+               memset(dhd->fw_capabilities, 0, cap_buf_size);
+               ret = dhd_iovar(dhd, 0, "cap", NULL, 0, dhd->fw_capabilities, (cap_buf_size - 1),
+                               FALSE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: Get Capability failed (error=%d)\n",
+                               __FUNCTION__, ret));
+                       return 0;
+               }
+
+               memmove(&dhd->fw_capabilities[1], dhd->fw_capabilities, (cap_buf_size - 1));
+               dhd->fw_capabilities[0] = ' ';
+               dhd->fw_capabilities[cap_buf_size - 2] = ' ';
+               dhd->fw_capabilities[cap_buf_size - 1] = '\0';
+       }
+
+       if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_HOSTAP_MODE) ||
+               (op_mode == DHD_FLAG_HOSTAP_MODE)) {
+#ifdef SET_RANDOM_MAC_SOFTAP
+               uint rand_mac;
+#endif /* SET_RANDOM_MAC_SOFTAP */
+               dhd->op_mode = DHD_FLAG_HOSTAP_MODE;
+#ifdef PKT_FILTER_SUPPORT
+               if (dhd_conf_get_insuspend(dhd, AP_FILTER_IN_SUSPEND))
+                       dhd_pkt_filter_enable = TRUE;
+               else
+                       dhd_pkt_filter_enable = FALSE;
+#endif
+#ifdef SET_RANDOM_MAC_SOFTAP
+               SRANDOM32((uint)jiffies);
+               rand_mac = RANDOM32();
+               iovbuf[0] = (unsigned char)(vendor_oui >> 16) | 0x02;   /* local admin bit */
+               iovbuf[1] = (unsigned char)(vendor_oui >> 8);
+               iovbuf[2] = (unsigned char)vendor_oui;
+               iovbuf[3] = (unsigned char)(rand_mac & 0x0F) | 0xF0;
+               iovbuf[4] = (unsigned char)(rand_mac >> 8);
+               iovbuf[5] = (unsigned char)(rand_mac >> 16);
+
+               ret = dhd_iovar(dhd, 0, "cur_etheraddr", (char *)&iovbuf, ETHER_ADDR_LEN, NULL, 0,
+                               TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: can't set MAC address , error=%d\n", __FUNCTION__, ret));
+               } else
+                       memcpy(dhd->mac.octet, iovbuf, ETHER_ADDR_LEN);
+#endif /* SET_RANDOM_MAC_SOFTAP */
+#ifdef USE_DYNAMIC_F2_BLKSIZE
+               dhdsdio_func_blocksize(dhd, 2, DYNAMIC_F2_BLKSIZE_FOR_NONLEGACY);
+#endif /* USE_DYNAMIC_F2_BLKSIZE */
+#ifdef SOFTAP_UAPSD_OFF
+               ret = dhd_iovar(dhd, 0, "wme_apsd", (char *)&wme_apsd, sizeof(wme_apsd), NULL, 0,
+                               TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: set wme_apsd 0 fail (error=%d)\n",
+                               __FUNCTION__, ret));
+               }
+#endif /* SOFTAP_UAPSD_OFF */
+
+               /* set AP flag for specific country code of SOFTAP */
+#if defined(CUSTOM_COUNTRY_CODE)
+               dhd->dhd_cflags |= WLAN_PLAT_AP_FLAG | WLAN_PLAT_NODFS_FLAG;
+#endif /* CUSTOM_COUNTRY_CODE */
+       } else if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_MFG_MODE) ||
+               (op_mode == DHD_FLAG_MFG_MODE)) {
+#if defined(ARP_OFFLOAD_SUPPORT)
+               dhd->arpoe_enable = FALSE;
+#endif /* ARP_OFFLOAD_SUPPORT */
+#ifdef PKT_FILTER_SUPPORT
+               dhd_pkt_filter_enable = FALSE;
+#endif /* PKT_FILTER_SUPPORT */
+               dhd->op_mode = DHD_FLAG_MFG_MODE;
+#ifdef USE_DYNAMIC_F2_BLKSIZE
+               /* XXX The 'wl counters' command triggers SDIO bus error
+                * if F2 block size is greater than 128 bytes using 4354A1
+                * manufacturing firmware. To avoid this problem, F2 block
+                * size is set to 128 bytes only for DHD_FLAG_MFG_MODE.
+                * There is no problem for other chipset since big data
+                * transcation through SDIO bus is not happened during
+                * manufacturing test.
+                */
+               dhdsdio_func_blocksize(dhd, 2, DYNAMIC_F2_BLKSIZE_FOR_NONLEGACY);
+#endif /* USE_DYNAMIC_F2_BLKSIZE */
+#ifndef CUSTOM_SET_ANTNPM
+               if (FW_SUPPORTED(dhd, rsdb)) {
+                       wl_config_t rsdb_mode;
+                       memset(&rsdb_mode, 0, sizeof(rsdb_mode));
+                       ret = dhd_iovar(dhd, 0, "rsdb_mode", (char *)&rsdb_mode, sizeof(rsdb_mode),
+                               NULL, 0, TRUE);
+                       if (ret < 0) {
+                               DHD_ERROR(("%s Disable rsdb_mode is failed ret= %d\n",
+                                       __FUNCTION__, ret));
+                       }
+               }
+#endif /* !CUSTOM_SET_ANTNPM */
+       } else {
+               uint32 concurrent_mode = 0;
+               if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_P2P_MODE) ||
+                       (op_mode == DHD_FLAG_P2P_MODE)) {
+#ifdef PKT_FILTER_SUPPORT
+                       dhd_pkt_filter_enable = FALSE;
+#endif
+                       dhd->op_mode = DHD_FLAG_P2P_MODE;
+               } else if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_IBSS_MODE) ||
+                       (op_mode == DHD_FLAG_IBSS_MODE)) {
+                       dhd->op_mode = DHD_FLAG_IBSS_MODE;
+               } else
+                       dhd->op_mode = DHD_FLAG_STA_MODE;
+#if !defined(AP) && defined(WLP2P)
+               if (dhd->op_mode != DHD_FLAG_IBSS_MODE &&
+                       (concurrent_mode = dhd_get_concurrent_capabilites(dhd))) {
+                       dhd->op_mode |= concurrent_mode;
+               }
+
+               /* Check if we are enabling p2p */
+               if (dhd->op_mode & DHD_FLAG_P2P_MODE) {
+                       ret = dhd_iovar(dhd, 0, "apsta", (char *)&apsta, sizeof(apsta), NULL, 0,
+                                       TRUE);
+                       if (ret < 0)
+                               DHD_ERROR(("%s APSTA for P2P failed ret= %d\n", __FUNCTION__, ret));
+
+#if defined(SOFTAP_AND_GC)
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_AP,
+                       (char *)&ap_mode, sizeof(ap_mode), TRUE, 0)) < 0) {
+                               DHD_ERROR(("%s WLC_SET_AP failed %d\n", __FUNCTION__, ret));
+               }
+#endif
+                       memcpy(&p2p_ea, &dhd->mac, ETHER_ADDR_LEN);
+                       ETHER_SET_LOCALADDR(&p2p_ea);
+                       ret = dhd_iovar(dhd, 0, "p2p_da_override", (char *)&p2p_ea, sizeof(p2p_ea),
+                                       NULL, 0, TRUE);
+                       if (ret < 0)
+                               DHD_ERROR(("%s p2p_da_override ret= %d\n", __FUNCTION__, ret));
+                       else
+                               DHD_INFO(("dhd_preinit_ioctls: p2p_da_override succeeded\n"));
+               }
+#else
+       (void)concurrent_mode;
+#endif
+       }
+
+#ifdef DISABLE_PRUNED_SCAN
+       if (FW_SUPPORTED(dhd, rsdb)) {
+               ret = dhd_iovar(dhd, 0, "scan_features", (char *)&scan_features,
+                               sizeof(scan_features), iovbuf, sizeof(iovbuf), FALSE);
+               if (ret < 0) {
+                       if (ret == BCME_UNSUPPORTED) {
+                               DHD_ERROR(("%s get scan_features, UNSUPPORTED\n",
+                                       __FUNCTION__));
+                       } else {
+                               DHD_ERROR(("%s get scan_features err(%d)\n",
+                                       __FUNCTION__, ret));
+                       }
+
+               } else {
+                       memcpy(&scan_features, iovbuf, 4);
+                       scan_features &= ~RSDB_SCAN_DOWNGRADED_CH_PRUNE_ROAM;
+                       ret = dhd_iovar(dhd, 0, "scan_features", (char *)&scan_features,
+                                       sizeof(scan_features), NULL, 0, TRUE);
+                       if (ret < 0) {
+                               DHD_ERROR(("%s set scan_features err(%d)\n",
+                                       __FUNCTION__, ret));
+                       }
+               }
+       }
+#endif /* DISABLE_PRUNED_SCAN */
+
+       DHD_ERROR(("Firmware up: op_mode=0x%04x, MAC="MACDBG"\n",
+               dhd->op_mode, MAC2STRDBG(dhd->mac.octet)));
+#if defined(DHD_BLOB_EXISTENCE_CHECK)
+       if (!dhd->is_blob)
+#endif /* DHD_BLOB_EXISTENCE_CHECK */
+       {
+               /* get a ccode and revision for the country code */
+#if defined(CUSTOM_COUNTRY_CODE)
+               get_customized_country_code(dhd->info->adapter, dhd->dhd_cspec.country_abbrev,
+                       &dhd->dhd_cspec, dhd->dhd_cflags);
+#else
+               get_customized_country_code(dhd->info->adapter, dhd->dhd_cspec.country_abbrev,
+                       &dhd->dhd_cspec);
+#endif /* CUSTOM_COUNTRY_CODE */
+       }
+
+#if defined(RXFRAME_THREAD) && defined(RXTHREAD_ONLYSTA)
+       if (dhd->op_mode == DHD_FLAG_HOSTAP_MODE)
+               dhd->info->rxthread_enabled = FALSE;
+       else
+               dhd->info->rxthread_enabled = TRUE;
+#endif
+       /* Set Country code  */
+       if (dhd->dhd_cspec.ccode[0] != 0) {
+               ret = dhd_iovar(dhd, 0, "country", (char *)&dhd->dhd_cspec, sizeof(wl_country_t),
+                               NULL, 0, TRUE);
+               if (ret < 0)
+                       DHD_ERROR(("%s: country code setting failed\n", __FUNCTION__));
+       }
+
+       /* Set Listen Interval */
+       ret = dhd_iovar(dhd, 0, "assoc_listen", (char *)&listen_interval, sizeof(listen_interval),
+                       NULL, 0, TRUE);
+       if (ret < 0)
+               DHD_ERROR(("%s assoc_listen failed %d\n", __FUNCTION__, ret));
+
+#if defined(ROAM_ENABLE) || defined(DISABLE_BUILTIN_ROAM)
+#ifdef USE_WFA_CERT_CONF
+       if (sec_get_param_wfa_cert(dhd, SET_PARAM_ROAMOFF, &roamvar) == BCME_OK) {
+               DHD_ERROR(("%s: read roam_off param =%d\n", __FUNCTION__, roamvar));
+       }
+#endif /* USE_WFA_CERT_CONF */
+       /* Disable built-in roaming to allowed ext supplicant to take care of roaming */
+       ret = dhd_iovar(dhd, 0, "roam_off", (char *)&roamvar, sizeof(roamvar), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s roam_off failed %d\n", __FUNCTION__, ret));
+       }
+#endif /* ROAM_ENABLE || DISABLE_BUILTIN_ROAM */
+#if defined(ROAM_ENABLE)
+#ifdef DISABLE_BCNLOSS_ROAM
+       ret = dhd_iovar(dhd, 0, "roam_bcnloss_off", (char *)&roam_bcnloss_off,
+                       sizeof(roam_bcnloss_off), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s roam_bcnloss_off failed %d\n", __FUNCTION__, ret));
+       }
+#endif /* DISABLE_BCNLOSS_ROAM */
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_ROAM_TRIGGER, roam_trigger,
+               sizeof(roam_trigger), TRUE, 0)) < 0)
+               DHD_ERROR(("%s: roam trigger set failed %d\n", __FUNCTION__, ret));
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_ROAM_SCAN_PERIOD, roam_scan_period,
+               sizeof(roam_scan_period), TRUE, 0)) < 0)
+               DHD_ERROR(("%s: roam scan period set failed %d\n", __FUNCTION__, ret));
+       if ((dhd_wl_ioctl_cmd(dhd, WLC_SET_ROAM_DELTA, roam_delta,
+               sizeof(roam_delta), TRUE, 0)) < 0)
+               DHD_ERROR(("%s: roam delta set failed %d\n", __FUNCTION__, ret));
+       ret = dhd_iovar(dhd, 0, "fullroamperiod", (char *)&roam_fullscan_period,
+                       sizeof(roam_fullscan_period), NULL, 0, TRUE);
+       if (ret < 0)
+               DHD_ERROR(("%s: roam fullscan period set failed %d\n", __FUNCTION__, ret));
+#ifdef ROAM_AP_ENV_DETECTION
+       if (roam_trigger[0] == WL_AUTO_ROAM_TRIGGER) {
+               if (dhd_iovar(dhd, 0, "roam_env_detection", (char *)&roam_env_mode,
+                               sizeof(roam_env_mode), NULL, 0, TRUE) == BCME_OK)
+                       dhd->roam_env_detection = TRUE;
+               else
+                       dhd->roam_env_detection = FALSE;
+       }
+#endif /* ROAM_AP_ENV_DETECTION */
+#ifdef CONFIG_ROAM_RSSI_LIMIT
+       ret = dhd_roam_rssi_limit_set(dhd, CUSTOM_ROAMRSSI_2G, CUSTOM_ROAMRSSI_5G);
+       if (ret < 0) {
+               DHD_ERROR(("%s set roam_rssi_limit failed ret %d\n", __FUNCTION__, ret));
+       }
+#endif /* CONFIG_ROAM_RSSI_LIMIT */
+#endif /* ROAM_ENABLE */
+
+#ifdef CUSTOM_EVENT_PM_WAKE
+       /* XXX need to check time value */
+       ret = dhd_iovar(dhd, 0, "const_awake_thresh", (char *)&pm_awake_thresh,
+                       sizeof(pm_awake_thresh), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s set const_awake_thresh failed %d\n", __FUNCTION__, ret));
+       }
+#endif /* CUSTOM_EVENT_PM_WAKE */
+#ifdef OKC_SUPPORT
+       dhd_iovar(dhd, 0, "okc_enable", (char *)&okc, sizeof(okc), NULL, 0, TRUE);
+#endif
+#ifdef BCMCCX
+       dhd_iovar(dhd, 0, "ccx_enable", (char *)&ccx, sizeof(ccx), NULL, 0, TRUE);
+#endif /* BCMCCX */
+
+#ifdef WLTDLS
+       dhd->tdls_enable = FALSE;
+       dhd_tdls_set_mode(dhd, false);
+#endif /* WLTDLS */
+
+#ifdef DHD_ENABLE_LPC
+       /* Set lpc 1 */
+       ret = dhd_iovar(dhd, 0, "lpc", (char *)&lpc, sizeof(lpc), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s Set lpc failed  %d\n", __FUNCTION__, ret));
+
+               if (ret == BCME_NOTDOWN) {
+                       uint wl_down = 1;
+                       ret = dhd_wl_ioctl_cmd(dhd, WLC_DOWN,
+                               (char *)&wl_down, sizeof(wl_down), TRUE, 0);
+                       DHD_ERROR(("%s lpc fail WL_DOWN : %d, lpc = %d\n", __FUNCTION__, ret, lpc));
+
+                       ret = dhd_iovar(dhd, 0, "lpc", (char *)&lpc, sizeof(lpc), NULL, 0, TRUE);
+                       DHD_ERROR(("%s Set lpc ret --> %d\n", __FUNCTION__, ret));
+               }
+       }
+#endif /* DHD_ENABLE_LPC */
+
+#ifdef WLADPS
+       if (dhd->op_mode & DHD_FLAG_STA_MODE) {
+               if ((ret = dhd_enable_adps(dhd, ADPS_ENABLE)) != BCME_OK &&
+                       (ret != BCME_UNSUPPORTED)) {
+                       DHD_ERROR(("%s dhd_enable_adps failed %d\n",
+                               __FUNCTION__, ret));
+               }
+       }
+#endif /* WLADPS */
+
+#ifdef DHD_PM_CONTROL_FROM_FILE
+       sec_control_pm(dhd, &power_mode);
+#else
+       /* Set PowerSave mode */
+       (void) dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)&power_mode, sizeof(power_mode), TRUE, 0);
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+
+#if defined(BCMSDIO)
+       /* Match Host and Dongle rx alignment */
+       ret = dhd_iovar(dhd, 0, "bus:txglomalign", (char *)&dongle_align, sizeof(dongle_align),
+                       NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s set bus:txglomalign failed %d\n", __FUNCTION__, ret));
+       }
+
+#ifdef USE_WFA_CERT_CONF
+       if (sec_get_param_wfa_cert(dhd, SET_PARAM_BUS_TXGLOM_MODE, &glom) == BCME_OK) {
+               DHD_ERROR(("%s, read txglom param =%d\n", __FUNCTION__, glom));
+       }
+#endif /* USE_WFA_CERT_CONF */
+       if (glom != DEFAULT_GLOM_VALUE) {
+               DHD_INFO(("%s set glom=0x%X\n", __FUNCTION__, glom));
+               ret = dhd_iovar(dhd, 0, "bus:txglom", (char *)&glom, sizeof(glom), NULL, 0, TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s set bus:txglom failed %d\n", __FUNCTION__, ret));
+               }
+       }
+#endif /* defined(BCMSDIO) */
+
+       /* Setup timeout if Beacons are lost and roam is off to report link down */
+       ret = dhd_iovar(dhd, 0, "bcn_timeout", (char *)&bcn_timeout, sizeof(bcn_timeout),
+                       NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s set bcn_timeout failed %d\n", __FUNCTION__, ret));
+       }
+
+       /* Setup assoc_retry_max count to reconnect target AP in dongle */
+       ret = dhd_iovar(dhd, 0, "assoc_retry_max", (char *)&retry_max, sizeof(retry_max),
+                       NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s set assoc_retry_max failed %d\n", __FUNCTION__, ret));
+       }
+
+#if defined(AP) && !defined(WLP2P)
+       ret = dhd_iovar(dhd, 0, "apsta", (char *)&apsta, sizeof(apsta), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s set apsta failed %d\n", __FUNCTION__, ret));
+       }
+
+#endif /* defined(AP) && !defined(WLP2P) */
+
+#ifdef MIMO_ANT_SETTING
+       dhd_sel_ant_from_file(dhd);
+#endif /* MIMO_ANT_SETTING */
+
+#if defined(SOFTAP)
+       if (ap_fw_loaded == TRUE) {
+               dhd_wl_ioctl_cmd(dhd, WLC_SET_DTIMPRD, (char *)&dtim, sizeof(dtim), TRUE, 0);
+       }
+#endif
+
+#if defined(KEEP_ALIVE)
+       {
+       /* Set Keep Alive : be sure to use FW with -keepalive */
+       int res;
+
+#if defined(SOFTAP)
+       if (ap_fw_loaded == FALSE)
+#endif
+               if (!(dhd->op_mode &
+                       (DHD_FLAG_HOSTAP_MODE | DHD_FLAG_MFG_MODE))) {
+                       if ((res = dhd_keep_alive_onoff(dhd)) < 0)
+                               DHD_ERROR(("%s set keeplive failed %d\n",
+                               __FUNCTION__, res));
+               }
+       }
+#endif /* defined(KEEP_ALIVE) */
+
+#ifdef USE_WL_TXBF
+       ret = dhd_iovar(dhd, 0, "txbf", (char *)&txbf, sizeof(txbf), NULL, 0, TRUE);
+       if (ret < 0)
+               DHD_ERROR(("%s Set txbf failed  %d\n", __FUNCTION__, ret));
+
+#endif /* USE_WL_TXBF */
+
+       ret = dhd_iovar(dhd, 0, "scancache", (char *)&scancache_enab, sizeof(scancache_enab), NULL,
+                       0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s Set scancache failed %d\n", __FUNCTION__, ret));
+       }
+
+       ret = dhd_iovar(dhd, 0, "event_log_max_sets", NULL, 0, (char *)&event_log_max_sets,
+               sizeof(event_log_max_sets), FALSE);
+       if (ret == BCME_OK) {
+               dhd->event_log_max_sets = event_log_max_sets;
+       } else {
+               dhd->event_log_max_sets = NUM_EVENT_LOG_SETS;
+       }
+       /* Make sure max_sets is set first with wmb and then sets_queried,
+        * this will be used during parsing the logsets in the reverse order.
+        */
+       OSL_SMP_WMB();
+       dhd->event_log_max_sets_queried = TRUE;
+       DHD_ERROR(("%s: event_log_max_sets: %d ret: %d\n",
+               __FUNCTION__, dhd->event_log_max_sets, ret));
+
+#ifdef DISABLE_TXBFR
+       ret = dhd_iovar(dhd, 0, "txbf_bfr_cap", (char *)&txbf_bfr_cap, sizeof(txbf_bfr_cap), NULL,
+                       0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s Clear txbf_bfr_cap failed  %d\n", __FUNCTION__, ret));
+       }
+#endif /* DISABLE_TXBFR */
+
+#ifdef USE_WFA_CERT_CONF
+#ifdef USE_WL_FRAMEBURST
+        if (sec_get_param_wfa_cert(dhd, SET_PARAM_FRAMEBURST, &frameburst) == BCME_OK) {
+               DHD_ERROR(("%s, read frameburst param=%d\n", __FUNCTION__, frameburst));
+        }
+#endif /* USE_WL_FRAMEBURST */
+        g_frameburst = frameburst;
+#endif /* USE_WFA_CERT_CONF */
+#ifdef DISABLE_WL_FRAMEBURST_SOFTAP
+       /* Disable Framebursting for SofAP */
+       if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+               frameburst = 0;
+       }
+#endif /* DISABLE_WL_FRAMEBURST_SOFTAP */
+       /* Set frameburst to value */
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_FAKEFRAG, (char *)&frameburst,
+               sizeof(frameburst), TRUE, 0)) < 0) {
+               DHD_INFO(("%s frameburst not supported  %d\n", __FUNCTION__, ret));
+       }
+#ifdef DHD_SET_FW_HIGHSPEED
+       /* Set ack_ratio */
+       ret = dhd_iovar(dhd, 0, "ack_ratio", (char *)&ack_ratio, sizeof(ack_ratio), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s Set ack_ratio failed  %d\n", __FUNCTION__, ret));
+       }
+
+       /* Set ack_ratio_depth */
+       ret = dhd_iovar(dhd, 0, "ack_ratio_depth", (char *)&ack_ratio_depth,
+                       sizeof(ack_ratio_depth), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s Set ack_ratio_depth failed  %d\n", __FUNCTION__, ret));
+       }
+#endif /* DHD_SET_FW_HIGHSPEED */
+
+       iov_buf = (char*)MALLOC(dhd->osh, WLC_IOCTL_SMLEN);
+       if (iov_buf == NULL) {
+               DHD_ERROR(("failed to allocate %d bytes for iov_buf\n", WLC_IOCTL_SMLEN));
+               ret = BCME_NOMEM;
+               goto done;
+       }
+
+       BCM_REFERENCE(ret2);
+
+#ifdef WLAIBSS
+       /* Apply AIBSS configurations */
+       if ((ret = dhd_preinit_aibss_ioctls(dhd, iov_buf)) != BCME_OK) {
+               DHD_ERROR(("%s dhd_preinit_aibss_ioctls failed %d\n",
+                               __FUNCTION__, ret));
+               goto done;
+       }
+#endif /* WLAIBSS */
+
+#if defined(CUSTOM_AMPDU_BA_WSIZE) || (defined(WLAIBSS) && \
+       defined(CUSTOM_IBSS_AMPDU_BA_WSIZE))
+       /* Set ampdu ba wsize to 64 or 16 */
+#ifdef CUSTOM_AMPDU_BA_WSIZE
+       ampdu_ba_wsize = CUSTOM_AMPDU_BA_WSIZE;
+#endif
+#if defined(WLAIBSS) && defined(CUSTOM_IBSS_AMPDU_BA_WSIZE)
+       if (dhd->op_mode == DHD_FLAG_IBSS_MODE)
+               ampdu_ba_wsize = CUSTOM_IBSS_AMPDU_BA_WSIZE;
+#endif /* WLAIBSS && CUSTOM_IBSS_AMPDU_BA_WSIZE */
+       if (ampdu_ba_wsize != 0) {
+               ret = dhd_iovar(dhd, 0, "ampdu_ba_wsize", (char *)&ampdu_ba_wsize,
+                               sizeof(ampdu_ba_wsize), NULL, 0, TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s Set ampdu_ba_wsize to %d failed  %d\n",
+                               __FUNCTION__, ampdu_ba_wsize, ret));
+               }
+       }
+#endif /* CUSTOM_AMPDU_BA_WSIZE || (WLAIBSS && CUSTOM_IBSS_AMPDU_BA_WSIZE) */
+
+#if defined(CUSTOM_AMPDU_MPDU)
+       ampdu_mpdu = CUSTOM_AMPDU_MPDU;
+       if (ampdu_mpdu != 0 && (ampdu_mpdu <= ampdu_ba_wsize)) {
+               ret = dhd_iovar(dhd, 0, "ampdu_mpdu", (char *)&ampdu_mpdu, sizeof(ampdu_mpdu),
+                               NULL, 0, TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s Set ampdu_mpdu to %d failed  %d\n",
+                               __FUNCTION__, CUSTOM_AMPDU_MPDU, ret));
+               }
+       }
+#endif /* CUSTOM_AMPDU_MPDU */
+
+#if defined(CUSTOM_AMPDU_RELEASE)
+       ampdu_release = CUSTOM_AMPDU_RELEASE;
+       if (ampdu_release != 0 && (ampdu_release <= ampdu_ba_wsize)) {
+               ret = dhd_iovar(dhd, 0, "ampdu_release", (char *)&ampdu_release,
+                               sizeof(ampdu_release), NULL, 0, TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s Set ampdu_release to %d failed  %d\n",
+                               __FUNCTION__, CUSTOM_AMPDU_RELEASE, ret));
+               }
+       }
+#endif /* CUSTOM_AMPDU_RELEASE */
+
+#if defined(CUSTOM_AMSDU_AGGSF)
+       amsdu_aggsf = CUSTOM_AMSDU_AGGSF;
+       if (amsdu_aggsf != 0) {
+               ret = dhd_iovar(dhd, 0, "amsdu_aggsf", (char *)&amsdu_aggsf, sizeof(amsdu_aggsf),
+                               NULL, 0, TRUE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s Set amsdu_aggsf to %d failed  %d\n",
+                               __FUNCTION__, CUSTOM_AMSDU_AGGSF, ret));
+               }
+       }
+#endif /* CUSTOM_AMSDU_AGGSF */
+
+#if defined(BCMSUP_4WAY_HANDSHAKE)
+       /* Read 4-way handshake requirements */
+       if (dhd_use_idsup == 1) {
+               ret = dhd_iovar(dhd, 0, "sup_wpa", (char *)&sup_wpa, sizeof(sup_wpa),
+                               (char *)&iovbuf, sizeof(iovbuf), FALSE);
+               /* sup_wpa iovar returns NOTREADY status on some platforms using modularized
+                * in-dongle supplicant.
+                */
+               if (ret >= 0 || ret == BCME_NOTREADY)
+                       dhd->fw_4way_handshake = TRUE;
+               DHD_TRACE(("4-way handshake mode is: %d\n", dhd->fw_4way_handshake));
+       }
+#endif /* BCMSUP_4WAY_HANDSHAKE */
+#if defined(SUPPORT_2G_VHT) || defined(SUPPORT_5G_1024QAM_VHT)
+       ret = dhd_iovar(dhd, 0, "vht_features", (char *)&vht_features, sizeof(vht_features),
+                       (char *)&vht_features, sizeof(vht_features), FALSE);
+       if (ret < 0) {
+               DHD_ERROR(("%s vht_features get failed %d\n", __FUNCTION__, ret));
+               vht_features = 0;
+       } else {
+#ifdef SUPPORT_2G_VHT
+               vht_features |= 0x3; /* 2G support */
+#endif /* SUPPORT_2G_VHT */
+#ifdef SUPPORT_5G_1024QAM_VHT
+               vht_features |= 0x6; /* 5G 1024 QAM support */
+#endif /* SUPPORT_5G_1024QAM_VHT */
+       }
+       if (vht_features) {
+               ret = dhd_iovar(dhd, 0, "vht_features", (char *)&vht_features, sizeof(vht_features),
+                               NULL, 0, TRUE);
+               if (ret < 0) {
+                       if (ret == BCME_NOTDOWN) {
+                               uint wl_down = 1;
+                               ret = dhd_wl_ioctl_cmd(dhd, WLC_DOWN,
+                                       (char *)&wl_down, sizeof(wl_down), TRUE, 0);
+                               DHD_ERROR(("%s vht_features fail WL_DOWN : %d,"
+                                       " vht_features = 0x%x\n",
+                                       __FUNCTION__, ret, vht_features));
+
+                               ret = dhd_iovar(dhd, 0, "vht_features", (char *)&vht_features,
+                                               sizeof(vht_features), NULL, 0, TRUE);
+
+                               DHD_ERROR(("%s vht_features set. ret --> %d\n", __FUNCTION__, ret));
+                       }
+                       if (ret != BCME_BADOPTION) {
+                               DHD_ERROR(("%s vht_features set failed %d\n", __FUNCTION__, ret));
+                       } else {
+                               DHD_INFO(("%s vht_features ret(%d) - need to check BANDLOCK\n",
+                                       __FUNCTION__, ret));
+                       }
+               }
+       }
+#endif /* SUPPORT_2G_VHT || SUPPORT_5G_1024QAM_VHT */
+#ifdef DISABLE_11N_PROPRIETARY_RATES
+       ret = dhd_iovar(dhd, 0, "ht_features", (char *)&ht_features, sizeof(ht_features), NULL, 0,
+                       TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s ht_features set failed %d\n", __FUNCTION__, ret));
+       }
+#endif /* DISABLE_11N_PROPRIETARY_RATES */
+#if defined(DISABLE_HE_ENAB) || defined(CUSTOM_CONTROL_HE_ENAB)
+#if defined(DISABLE_HE_ENAB)
+       /* XXX DISABLE_HE_ENAB has higher priority than CUSTOM_CONTROL_HE_ENAB */
+       control_he_enab = 0;
+#endif /* DISABLE_HE_ENAB */
+       dhd_control_he_enab(dhd, control_he_enab);
+#endif /* DISABLE_HE_ENAB || CUSTOM_CONTROL_HE_ENAB */
+
+#ifdef CUSTOM_PSPRETEND_THR
+       /* Turn off MPC in AP mode */
+       ret = dhd_iovar(dhd, 0, "pspretend_threshold", (char *)&pspretend_thr,
+                       sizeof(pspretend_thr), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s pspretend_threshold for HostAPD failed  %d\n",
+                       __FUNCTION__, ret));
+       }
+#endif
+
+       /* XXX Enable firmware key buffering before sent 4-way M4 */
+       ret = dhd_iovar(dhd, 0, "buf_key_b4_m4", (char *)&buf_key_b4_m4, sizeof(buf_key_b4_m4),
+                       NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s buf_key_b4_m4 set failed %d\n", __FUNCTION__, ret));
+       }
+#ifdef SUPPORT_SET_CAC
+       ret = dhd_iovar(dhd, 0, "cac", (char *)&cac, sizeof(cac), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s Failed to set cac to %d, %d\n", __FUNCTION__, cac, ret));
+       }
+#endif /* SUPPORT_SET_CAC */
+       /* make up event mask ext message iovar for event larger than 128 */
+       msglen = WL_EVENTING_MASK_EXT_LEN + EVENTMSGS_EXT_STRUCT_SIZE;
+       eventmask_msg = (eventmsgs_ext_t*)MALLOC(dhd->osh, msglen);
+       if (eventmask_msg == NULL) {
+               DHD_ERROR(("failed to allocate %d bytes for event_msg_ext\n", msglen));
+               ret = BCME_NOMEM;
+               goto done;
+       }
+       bzero(eventmask_msg, msglen);
+       eventmask_msg->ver = EVENTMSGS_VER;
+       eventmask_msg->len = ROUNDUP(WLC_E_LAST, NBBY)/NBBY;
+
+       /* Read event_msgs_ext mask */
+       ret = dhd_iovar(dhd, 0, "event_msgs_ext", (char *)eventmask_msg, msglen, iov_buf,
+                       WLC_IOCTL_SMLEN, FALSE);
+
+       /* event_msgs_ext must be supported */
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s read event mask ext failed %d\n", __FUNCTION__, ret));
+               goto done;
+       }
+
+       bcopy(iov_buf, eventmask_msg, msglen);
+       /* make up event mask ext message iovar for event larger than 128 */
+       mask = eventmask_msg->mask;
+
+       /* Setup event_msgs */
+       setbit(mask, WLC_E_SET_SSID);
+       setbit(mask, WLC_E_PRUNE);
+       setbit(mask, WLC_E_AUTH);
+       setbit(mask, WLC_E_AUTH_IND);
+       setbit(mask, WLC_E_ASSOC);
+       setbit(mask, WLC_E_REASSOC);
+       setbit(mask, WLC_E_REASSOC_IND);
+       if (!(dhd->op_mode & DHD_FLAG_IBSS_MODE))
+               setbit(mask, WLC_E_DEAUTH);
+       setbit(mask, WLC_E_DEAUTH_IND);
+       setbit(mask, WLC_E_DISASSOC_IND);
+       setbit(mask, WLC_E_DISASSOC);
+       setbit(mask, WLC_E_JOIN);
+       setbit(mask, WLC_E_START);
+       setbit(mask, WLC_E_ASSOC_IND);
+       setbit(mask, WLC_E_PSK_SUP);
+       setbit(mask, WLC_E_LINK);
+       setbit(mask, WLC_E_MIC_ERROR);
+       setbit(mask, WLC_E_ASSOC_REQ_IE);
+       setbit(mask, WLC_E_ASSOC_RESP_IE);
+#ifdef LIMIT_BORROW
+       setbit(mask, WLC_E_ALLOW_CREDIT_BORROW);
+#endif
+#ifndef WL_CFG80211
+       setbit(mask, WLC_E_PMKID_CACHE);
+//     setbit(mask, WLC_E_TXFAIL); // terence 20181106: remove unnecessary event
+#endif
+       setbit(mask, WLC_E_JOIN_START);
+//     setbit(mask, WLC_E_SCAN_COMPLETE); // terence 20150628: remove redundant event
+#ifdef DHD_DEBUG
+       setbit(mask, WLC_E_SCAN_CONFIRM_IND);
+#endif
+#ifdef PNO_SUPPORT
+       setbit(mask, WLC_E_PFN_NET_FOUND);
+       setbit(mask, WLC_E_PFN_BEST_BATCHING);
+       setbit(mask, WLC_E_PFN_BSSID_NET_FOUND);
+       setbit(mask, WLC_E_PFN_BSSID_NET_LOST);
+#endif /* PNO_SUPPORT */
+       /* enable dongle roaming event */
+#ifdef WL_CFG80211
+#if !defined(ROAM_EVT_DISABLE)
+       setbit(mask, WLC_E_ROAM);
+#endif /* !ROAM_EVT_DISABLE */
+       setbit(mask, WLC_E_BSSID);
+#endif /* WL_CFG80211 */
+#ifdef BCMCCX
+       setbit(mask, WLC_E_ADDTS_IND);
+       setbit(mask, WLC_E_DELTS_IND);
+#endif /* BCMCCX */
+#ifdef WLTDLS
+       setbit(mask, WLC_E_TDLS_PEER_EVENT);
+#endif /* WLTDLS */
+#ifdef WL_ESCAN
+       setbit(mask, WLC_E_ESCAN_RESULT);
+#endif /* WL_ESCAN */
+#ifdef CSI_SUPPORT
+       setbit(eventmask, WLC_E_CSI);
+#endif /* CSI_SUPPORT */
+#ifdef RTT_SUPPORT
+       setbit(mask, WLC_E_PROXD);
+#endif /* RTT_SUPPORT */
+#ifdef WL_CFG80211
+       setbit(mask, WLC_E_ESCAN_RESULT);
+       setbit(mask, WLC_E_AP_STARTED);
+       setbit(mask, WLC_E_ACTION_FRAME_RX);
+       if (dhd->op_mode & DHD_FLAG_P2P_MODE) {
+               setbit(mask, WLC_E_P2P_DISC_LISTEN_COMPLETE);
+       }
+#endif /* WL_CFG80211 */
+#ifdef WLAIBSS
+       setbit(mask, WLC_E_AIBSS_TXFAIL);
+#endif /* WLAIBSS */
+
+#if defined(SHOW_LOGTRACE) && defined(LOGTRACE_FROM_FILE)
+       if (dhd_logtrace_from_file(dhd)) {
+               setbit(mask, WLC_E_TRACE);
+       } else {
+               clrbit(mask, WLC_E_TRACE);
+       }
+#elif defined(SHOW_LOGTRACE)
+       setbit(mask, WLC_E_TRACE);
+#else
+       clrbit(mask, WLC_E_TRACE);
+       if (dhd->conf->chip == BCM43752_CHIP_ID)
+               setbit(mask, WLC_E_TRACE);
+#endif /* defined(SHOW_LOGTRACE) && defined(LOGTRACE_FROM_FILE) */
+
+       setbit(mask, WLC_E_CSA_COMPLETE_IND);
+#ifdef CUSTOM_EVENT_PM_WAKE
+       setbit(mask, WLC_E_EXCESS_PM_WAKE_EVENT);
+#endif /* CUSTOM_EVENT_PM_WAKE */
+#ifdef DHD_LOSSLESS_ROAMING
+       setbit(mask, WLC_E_ROAM_PREP);
+#endif
+       /* nan events */
+       setbit(mask, WLC_E_NAN);
+#if defined(PCIE_FULL_DONGLE) && defined(DHD_LOSSLESS_ROAMING)
+       dhd_update_flow_prio_map(dhd, DHD_FLOW_PRIO_LLR_MAP);
+#endif /* defined(PCIE_FULL_DONGLE) && defined(DHD_LOSSLESS_ROAMING) */
+
+#if defined(BCMPCIE) && defined(EAPOL_PKT_PRIO)
+       dhd_update_flow_prio_map(dhd, DHD_FLOW_PRIO_LLR_MAP);
+#endif /* defined(BCMPCIE) && defined(EAPOL_PKT_PRIO) */
+
+#ifdef RSSI_MONITOR_SUPPORT
+       setbit(mask, WLC_E_RSSI_LQM);
+#endif /* RSSI_MONITOR_SUPPORT */
+#ifdef GSCAN_SUPPORT
+       setbit(mask, WLC_E_PFN_GSCAN_FULL_RESULT);
+       setbit(mask, WLC_E_PFN_SCAN_COMPLETE);
+       setbit(mask, WLC_E_PFN_SSID_EXT);
+       setbit(mask, WLC_E_ROAM_EXP_EVENT);
+#endif /* GSCAN_SUPPORT */
+       setbit(mask, WLC_E_RSSI_LQM);
+#ifdef BT_WIFI_HANDOVER
+       setbit(mask, WLC_E_BT_WIFI_HANDOVER_REQ);
+#endif /* BT_WIFI_HANDOVER */
+#ifdef DBG_PKT_MON
+       setbit(mask, WLC_E_ROAM_PREP);
+#endif /* DBG_PKT_MON */
+#ifdef WL_NATOE
+       setbit(mask, WLC_E_NATOE_NFCT);
+#endif /* WL_NATOE */
+#ifdef WL_NAN
+       setbit(mask, WLC_E_SLOTTED_BSS_PEER_OP);
+#endif /* WL_NAN */
+#ifdef WL_BCNRECV
+       setbit(mask, WLC_E_BCNRECV_ABORTED);
+#endif /* WL_BCNRECV */
+#ifdef WL_MBO
+       setbit(mask, WLC_E_MBO);
+#endif /* WL_MBO */
+#ifdef WL_CLIENT_SAE
+               setbit(eventmask_msg->mask, WLC_E_JOIN_START);
+#endif /* WL_CLIENT_SAE */
+#ifdef WL_CAC_TS
+       setbit(mask, WLC_E_ADDTS_IND);
+       setbit(mask, WLC_E_DELTS_IND);
+#endif /* WL_BCNRECV */
+
+       /* Write updated Event mask */
+       eventmask_msg->ver = EVENTMSGS_VER;
+       eventmask_msg->command = EVENTMSGS_SET_MASK;
+       eventmask_msg->len = WL_EVENTING_MASK_EXT_LEN;
+       ret = dhd_iovar(dhd, 0, "event_msgs_ext", (char *)eventmask_msg, msglen, NULL, 0,
+                       TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s write event mask ext failed %d\n", __FUNCTION__, ret));
+               goto done;
+       }
+
+#if defined(DHD_8021X_DUMP) && defined(SHOW_LOGTRACE)
+       /* Enabling event log trace for EAP events */
+       el_tag = (wl_el_tag_params_t *)MALLOC(dhd->osh, sizeof(wl_el_tag_params_t));
+       if (el_tag == NULL) {
+               DHD_ERROR(("failed to allocate %d bytes for event_msg_ext\n",
+                               (int)sizeof(wl_el_tag_params_t)));
+               ret = BCME_NOMEM;
+               goto done;
+       }
+       el_tag->tag = EVENT_LOG_TAG_4WAYHANDSHAKE;
+       el_tag->set = 1;
+       el_tag->flags = EVENT_LOG_TAG_FLAG_LOG;
+       ret = dhd_iovar(dhd, 0, "event_log_tag_control", (char *)el_tag, sizeof(*el_tag), NULL,
+                       0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s set event_log_tag_control fail %d\n", __FUNCTION__, ret));
+       }
+#endif /* DHD_8021X_DUMP */
+
+       dhd_wl_ioctl_cmd(dhd, WLC_SET_SCAN_CHANNEL_TIME, (char *)&scan_assoc_time,
+                       sizeof(scan_assoc_time), TRUE, 0);
+       dhd_wl_ioctl_cmd(dhd, WLC_SET_SCAN_UNASSOC_TIME, (char *)&scan_unassoc_time,
+                       sizeof(scan_unassoc_time), TRUE, 0);
+       dhd_wl_ioctl_cmd(dhd, WLC_SET_SCAN_PASSIVE_TIME, (char *)&scan_passive_time,
+                       sizeof(scan_passive_time), TRUE, 0);
+
+#ifdef ARP_OFFLOAD_SUPPORT
+       DHD_ERROR(("arp_enable:%d arp_ol:%d\n",
+               dhd->arpoe_enable, dhd->arpol_configured));
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#ifdef PKT_FILTER_SUPPORT
+       /* Setup default defintions for pktfilter , enable in suspend */
+       if (dhd_master_mode) {
+               dhd->pktfilter_count = 6;
+               dhd->pktfilter[DHD_BROADCAST_FILTER_NUM] = NULL;
+               if (!FW_SUPPORTED(dhd, pf6)) {
+                       dhd->pktfilter[DHD_MULTICAST4_FILTER_NUM] = NULL;
+                       dhd->pktfilter[DHD_MULTICAST6_FILTER_NUM] = NULL;
+               } else {
+                       /* Immediately pkt filter TYPE 6 Discard IPv4/IPv6 Multicast Packet */
+                       dhd->pktfilter[DHD_MULTICAST4_FILTER_NUM] = DISCARD_IPV4_MCAST;
+                       dhd->pktfilter[DHD_MULTICAST6_FILTER_NUM] = DISCARD_IPV6_MCAST;
+               }
+               /* apply APP pktfilter */
+               dhd->pktfilter[DHD_ARP_FILTER_NUM] = "105 0 0 12 0xFFFF 0x0806";
+
+#ifdef BLOCK_IPV6_PACKET
+               /* Setup filter to allow only IPv4 unicast frames */
+               dhd->pktfilter[DHD_UNICAST_FILTER_NUM] = "100 0 0 0 "
+                       HEX_PREF_STR UNI_FILTER_STR ZERO_ADDR_STR ETHER_TYPE_STR IPV6_FILTER_STR
+                       " "
+                       HEX_PREF_STR ZERO_ADDR_STR ZERO_ADDR_STR ETHER_TYPE_STR ZERO_TYPE_STR;
+#else
+               /* Setup filter to allow only unicast */
+               dhd->pktfilter[DHD_UNICAST_FILTER_NUM] = "100 0 0 0 0x01 0x00";
+#endif /* BLOCK_IPV6_PACKET */
+
+#ifdef PASS_IPV4_SUSPEND
+               /* XXX customer want to get IPv4 multicast packets */
+               dhd->pktfilter[DHD_MDNS_FILTER_NUM] = "104 0 0 0 0xFFFFFF 0x01005E";
+#else
+               /* Add filter to pass multicastDNS packet and NOT filter out as Broadcast */
+               dhd->pktfilter[DHD_MDNS_FILTER_NUM] = NULL;
+#endif /* PASS_IPV4_SUSPEND */
+               if (FW_SUPPORTED(dhd, pf6)) {
+                       /* Immediately pkt filter TYPE 6 Dicard Broadcast IP packet */
+                       dhd->pktfilter[DHD_IP4BCAST_DROP_FILTER_NUM] = DISCARD_IPV4_BCAST;
+                       dhd->pktfilter_count = 8;
+               }
+
+#ifdef GAN_LITE_NAT_KEEPALIVE_FILTER
+               dhd->pktfilter_count = 4;
+               /* Setup filter to block broadcast and NAT Keepalive packets */
+               /* discard all broadcast packets */
+               dhd->pktfilter[DHD_UNICAST_FILTER_NUM] = "100 0 0 0 0xffffff 0xffffff";
+               /* discard NAT Keepalive packets */
+               dhd->pktfilter[DHD_BROADCAST_FILTER_NUM] = "102 0 0 36 0xffffffff 0x11940009";
+               /* discard NAT Keepalive packets */
+               dhd->pktfilter[DHD_MULTICAST4_FILTER_NUM] = "104 0 0 38 0xffffffff 0x11940009";
+               dhd->pktfilter[DHD_MULTICAST6_FILTER_NUM] = NULL;
+#endif /* GAN_LITE_NAT_KEEPALIVE_FILTER */
+       } else
+               dhd_conf_discard_pkt_filter(dhd);
+       dhd_conf_add_pkt_filter(dhd);
+
+#if defined(SOFTAP)
+       if (ap_fw_loaded) {
+               /* XXX Andrey: fo SOFTAP disable pkt filters (if there were any )  */
+               dhd_enable_packet_filter(0, dhd);
+       }
+#endif /* defined(SOFTAP) */
+       dhd_set_packet_filter(dhd);
+#endif /* PKT_FILTER_SUPPORT */
+#ifdef DISABLE_11N
+       ret = dhd_iovar(dhd, 0, "nmode", (char *)&nmode, sizeof(nmode), NULL, 0, TRUE);
+       if (ret < 0)
+               DHD_ERROR(("%s wl nmode 0 failed %d\n", __FUNCTION__, ret));
+#endif /* DISABLE_11N */
+
+#ifdef ENABLE_BCN_LI_BCN_WAKEUP
+       ret = dhd_iovar(dhd, 0, "bcn_li_bcn", (char *)&bcn_li_bcn, sizeof(bcn_li_bcn),
+                       NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s: set bcn_li_bcn failed %d\n", __FUNCTION__, ret));
+       }
+#endif /* ENABLE_BCN_LI_BCN_WAKEUP */
+#ifdef AMPDU_VO_ENABLE
+       /* XXX: Enabling VO AMPDU to reduce FER */
+       tid.tid = PRIO_8021D_VO; /* Enable TID(6) for voice */
+       tid.enable = TRUE;
+       ret = dhd_iovar(dhd, 0, "ampdu_tid", (char *)&tid, sizeof(tid), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s ampdu_tid %d\n", __FUNCTION__, ret));
+       }
+
+       tid.tid = PRIO_8021D_NC; /* Enable TID(7) for voice */
+       tid.enable = TRUE;
+       ret = dhd_iovar(dhd, 0, "ampdu_tid", (char *)&tid, sizeof(tid), NULL, 0, TRUE);
+       if (ret < 0) {
+               DHD_ERROR(("%s ampdu_tid %d\n", __FUNCTION__, ret));
+       }
+#endif
+       /* query for 'clmver' to get clm version info from firmware */
+       bzero(buf, sizeof(buf));
+       ret = dhd_iovar(dhd, 0, "clmver", NULL, 0, buf, sizeof(buf), FALSE);
+       if (ret < 0)
+               DHD_ERROR(("%s clmver failed %d\n", __FUNCTION__, ret));
+       else {
+               char *ver_temp_buf = NULL, *ver_date_buf = NULL;
+               int len;
+
+               if ((ver_temp_buf = bcmstrstr(buf, "Data:")) == NULL) {
+                       DHD_ERROR(("Couldn't find \"Data:\"\n"));
+               } else {
+                       ver_date_buf = bcmstrstr(buf, "Creation:");
+                       ptr = (ver_temp_buf + strlen("Data:"));
+                       if ((ver_temp_buf = bcmstrtok(&ptr, "\n", 0)) == NULL) {
+                               DHD_ERROR(("Couldn't find New line character\n"));
+                       } else {
+                               memset(clm_version, 0, CLM_VER_STR_LEN);
+                               len = snprintf(clm_version, CLM_VER_STR_LEN - 1, "%s", ver_temp_buf);
+                               if (ver_date_buf) {
+                                       ptr = (ver_date_buf + strlen("Creation:"));
+                                       ver_date_buf = bcmstrtok(&ptr, "\n", 0);
+                                       if (ver_date_buf)
+                                               snprintf(clm_version+len, CLM_VER_STR_LEN-1-len,
+                                                       " (%s)", ver_date_buf);
+                               }
+                               DHD_INFO(("CLM version = %s\n", clm_version));
+                       }
+               }
+
+#if defined(CUSTOMER_HW4_DEBUG)
+               if ((ver_temp_buf = bcmstrstr(ptr, "Customization:")) == NULL) {
+                       DHD_ERROR(("Couldn't find \"Customization:\"\n"));
+               } else {
+                       char tokenlim;
+                       ptr = (ver_temp_buf + strlen("Customization:"));
+                       if ((ver_temp_buf = bcmstrtok(&ptr, "(\n", &tokenlim)) == NULL) {
+                               DHD_ERROR(("Couldn't find project blob version"
+                                       "or New line character\n"));
+                       } else if (tokenlim == '(') {
+                               snprintf(clm_version,
+                                       CLM_VER_STR_LEN - 1, "%s, Blob ver = Major : %s minor : ",
+                                       clm_version, ver_temp_buf);
+                               DHD_INFO(("[INFO]CLM/Blob version = %s\n", clm_version));
+                               if ((ver_temp_buf = bcmstrtok(&ptr, "\n", &tokenlim)) == NULL) {
+                                       DHD_ERROR(("Couldn't find New line character\n"));
+                               } else {
+                                       snprintf(clm_version,
+                                               strlen(clm_version) + strlen(ver_temp_buf),
+                                               "%s%s", clm_version, ver_temp_buf);
+                                       DHD_INFO(("[INFO]CLM/Blob/project version = %s\n",
+                                               clm_version));
+
+                               }
+                       } else if (tokenlim == '\n') {
+                               snprintf(clm_version,
+                                       strlen(clm_version) + strlen(", Blob ver = Major : ") + 1,
+                                       "%s, Blob ver = Major : ", clm_version);
+                               snprintf(clm_version,
+                                       strlen(clm_version) + strlen(ver_temp_buf) + 1,
+                                       "%s%s", clm_version, ver_temp_buf);
+                               DHD_INFO(("[INFO]CLM/Blob/project version = %s\n", clm_version));
+                       }
+               }
+#endif /* CUSTOMER_HW4_DEBUG */
+               if (strlen(clm_version)) {
+                       DHD_INFO(("CLM version = %s\n", clm_version));
+               } else {
+                       DHD_ERROR(("Couldn't find CLM version!\n"));
+               }
+       }
+       dhd_set_version_info(dhd, fw_version);
+
+#ifdef WRITE_WLANINFO
+       sec_save_wlinfo(fw_version, EPI_VERSION_STR, dhd->info->nv_path, clm_version);
+#endif /* WRITE_WLANINFO */
+#ifdef GEN_SOFTAP_INFO_FILE
+       sec_save_softap_info();
+#endif /* GEN_SOFTAP_INFO_FILE */
+
+#if defined(BCMSDIO)
+       dhd_txglom_enable(dhd, dhd->conf->bus_rxglom);
+#endif /* defined(BCMSDIO) */
+
+#if defined(BCMSDIO) || defined(BCMDBUS)
+#ifdef PROP_TXSTATUS
+       if (disable_proptx ||
+#ifdef PROP_TXSTATUS_VSDB
+               /* enable WLFC only if the firmware is VSDB when it is in STA mode */
+               (dhd->op_mode != DHD_FLAG_HOSTAP_MODE &&
+                dhd->op_mode != DHD_FLAG_IBSS_MODE) ||
+#endif /* PROP_TXSTATUS_VSDB */
+               FALSE) {
+               wlfc_enable = FALSE;
+       }
+       ret = dhd_conf_get_disable_proptx(dhd);
+       if (ret == 0){
+               disable_proptx = 0;
+               wlfc_enable = TRUE;
+       } else if (ret >= 1) {
+               disable_proptx = 1;
+               wlfc_enable = FALSE;
+               /* terence 20161229: we should set ampdu_hostreorder=0 when disable_proptx=1 */
+               hostreorder = 0;
+       }
+
+#if defined(PROP_TXSTATUS)
+#ifdef USE_WFA_CERT_CONF
+       if (sec_get_param_wfa_cert(dhd, SET_PARAM_PROPTX, &proptx) == BCME_OK) {
+               DHD_ERROR(("%s , read proptx param=%d\n", __FUNCTION__, proptx));
+               wlfc_enable = proptx;
+       }
+#endif /* USE_WFA_CERT_CONF */
+#endif /* PROP_TXSTATUS */
+
+#ifndef DISABLE_11N
+       ret = dhd_wl_ioctl_cmd(dhd, WLC_DOWN, (char *)&wl_down, sizeof(wl_down), TRUE, 0);
+       ret2 = dhd_iovar(dhd, 0, "ampdu_hostreorder", (char *)&hostreorder, sizeof(hostreorder),
+                       NULL, 0, TRUE);
+       if (ret2 < 0) {
+               DHD_ERROR(("%s wl ampdu_hostreorder failed %d\n", __FUNCTION__, ret2));
+               if (ret2 != BCME_UNSUPPORTED)
+                       ret = ret2;
+
+               if (ret == BCME_NOTDOWN) {
+                       uint wl_down = 1;
+                       ret2 = dhd_wl_ioctl_cmd(dhd, WLC_DOWN, (char *)&wl_down,
+                               sizeof(wl_down), TRUE, 0);
+                       DHD_ERROR(("%s ampdu_hostreorder fail WL_DOWN : %d, hostreorder :%d\n",
+                               __FUNCTION__, ret2, hostreorder));
+
+                       ret2 = dhd_iovar(dhd, 0, "ampdu_hostreorder", (char *)&hostreorder,
+                                       sizeof(hostreorder), NULL, 0, TRUE);
+                       DHD_ERROR(("%s wl ampdu_hostreorder. ret --> %d\n", __FUNCTION__, ret2));
+                       if (ret2 != BCME_UNSUPPORTED)
+                                       ret = ret2;
+               }
+               if (ret2 != BCME_OK)
+                       hostreorder = 0;
+       }
+#endif /* DISABLE_11N */
+
+       if (wlfc_enable) {
+               dhd_wlfc_init(dhd);
+               /* terence 20161229: enable ampdu_hostreorder if tlv enabled */
+               dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "ampdu_hostreorder", 1, 0, TRUE);
+       }
+#ifndef DISABLE_11N
+       else if (hostreorder)
+               dhd_wlfc_hostreorder_init(dhd);
+#endif /* DISABLE_11N */
+#else
+       /* terence 20161229: disable ampdu_hostreorder if PROP_TXSTATUS not defined */
+       printf("%s: not define PROP_TXSTATUS\n", __FUNCTION__);
+       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "ampdu_hostreorder", 0, 0, TRUE);
+#endif /* PROP_TXSTATUS */
+#endif /* BCMSDIO || BCMDBUS */
+#ifndef PCIE_FULL_DONGLE
+       /* For FD we need all the packets at DHD to handle intra-BSS forwarding */
+       if (FW_SUPPORTED(dhd, ap)) {
+               wl_ap_isolate = AP_ISOLATE_SENDUP_ALL;
+               ret = dhd_iovar(dhd, 0, "ap_isolate", (char *)&wl_ap_isolate, sizeof(wl_ap_isolate),
+                               NULL, 0, TRUE);
+               if (ret < 0)
+                       DHD_ERROR(("%s failed %d\n", __FUNCTION__, ret));
+       }
+#endif /* PCIE_FULL_DONGLE */
+#ifdef PNO_SUPPORT
+       if (!dhd->pno_state) {
+               dhd_pno_init(dhd);
+       }
+#endif
+
+#ifdef RTT_SUPPORT
+       if (dhd->rtt_state) {
+               ret = dhd_rtt_init(dhd);
+               if (ret < 0) {
+                       DHD_ERROR(("%s failed to initialize RTT\n", __FUNCTION__));
+               }
+       }
+#endif
+#ifdef FILTER_IE
+       /* Failure to configure filter IE is not a fatal error, ignore it. */
+       if (FW_SUPPORTED(dhd, fie) &&
+               !(dhd->op_mode & (DHD_FLAG_HOSTAP_MODE | DHD_FLAG_MFG_MODE))) {
+               dhd_read_from_file(dhd);
+       }
+#endif /* FILTER_IE */
+#ifdef WL11U
+       dhd_interworking_enable(dhd);
+#endif /* WL11U */
+
+#ifdef NDO_CONFIG_SUPPORT
+       dhd->ndo_enable = FALSE;
+       dhd->ndo_host_ip_overflow = FALSE;
+       dhd->ndo_max_host_ip = NDO_MAX_HOST_IP_ENTRIES;
+#endif /* NDO_CONFIG_SUPPORT */
+
+       /* ND offload version supported */
+       dhd->ndo_version = dhd_ndo_get_version(dhd);
+       if (dhd->ndo_version > 0) {
+               DHD_INFO(("%s: ndo version %d\n", __FUNCTION__, dhd->ndo_version));
+
+#ifdef NDO_CONFIG_SUPPORT
+               /* enable Unsolicited NA filter */
+               ret = dhd_ndo_unsolicited_na_filter_enable(dhd, 1);
+               if (ret < 0) {
+                       DHD_ERROR(("%s failed to enable Unsolicited NA filter\n", __FUNCTION__));
+               }
+#endif /* NDO_CONFIG_SUPPORT */
+       }
+
+       /* check dongle supports wbtext (product policy) or not */
+       dhd->wbtext_support = FALSE;
+       if (dhd_wl_ioctl_get_intiovar(dhd, "wnm_bsstrans_resp", &wnm_bsstrans_resp,
+                       WLC_GET_VAR, FALSE, 0) != BCME_OK) {
+               DHD_ERROR(("failed to get wnm_bsstrans_resp\n"));
+       }
+       dhd->wbtext_policy = wnm_bsstrans_resp;
+       if (dhd->wbtext_policy == WL_BSSTRANS_POLICY_PRODUCT_WBTEXT) {
+               dhd->wbtext_support = TRUE;
+       }
+#ifndef WBTEXT
+       /* driver can turn off wbtext feature through makefile */
+       if (dhd->wbtext_support) {
+               if (dhd_wl_ioctl_set_intiovar(dhd, "wnm_bsstrans_resp",
+                               WL_BSSTRANS_POLICY_ROAM_ALWAYS,
+                               WLC_SET_VAR, FALSE, 0) != BCME_OK) {
+                       DHD_ERROR(("failed to disable WBTEXT\n"));
+               }
+       }
+#endif /* !WBTEXT */
+
+#ifdef DHD_NON_DMA_M2M_CORRUPTION
+       /* check pcie non dma loopback */
+       if (dhd->op_mode == DHD_FLAG_MFG_MODE &&
+               (dhd_bus_dmaxfer_lpbk(dhd, M2M_NON_DMA_LPBK) < 0)) {
+                       goto done;
+       }
+#endif /* DHD_NON_DMA_M2M_CORRUPTION */
+
+       /* WNM capabilities */
+       wnm_cap = 0
+#ifdef WL11U
+               | WL_WNM_BSSTRANS | WL_WNM_NOTIF
+#endif
+#ifdef WBTEXT
+               | WL_WNM_BSSTRANS | WL_WNM_MAXIDLE
+#endif
+               ;
+#if defined(WL_MBO) && defined(WL_OCE)
+       if (FW_SUPPORTED(dhd, estm)) {
+               wnm_cap |= WL_WNM_ESTM;
+       }
+#endif /* WL_MBO && WL_OCE */
+       if (dhd_iovar(dhd, 0, "wnm", (char *)&wnm_cap, sizeof(wnm_cap), NULL, 0, TRUE) < 0) {
+               DHD_ERROR(("failed to set WNM capabilities\n"));
+       }
+
+#ifdef CUSTOM_ASSOC_TIMEOUT
+       /* set recreate_bi_timeout to increase assoc timeout :
+       * 20 * 100TU * 1024 / 1000 = 2 secs
+       * (beacon wait time = recreate_bi_timeout * beacon_period * 1024 / 1000)
+       */
+       if (dhd_wl_ioctl_set_intiovar(dhd, "recreate_bi_timeout",
+                       CUSTOM_ASSOC_TIMEOUT,
+                       WLC_SET_VAR, TRUE, 0) != BCME_OK) {
+               DHD_ERROR(("failed to set assoc timeout\n"));
+       }
+#endif /* CUSTOM_ASSOC_TIMEOUT */
+
+#if defined(WBTEXT) && defined(WBTEXT_BTMDELTA)
+       if (dhd_iovar(dhd, 0, "wnm_btmdelta", (char *)&btmdelta, sizeof(btmdelta),
+                       NULL, 0, TRUE) < 0) {
+               DHD_ERROR(("failed to set BTM delta\n"));
+       }
+#endif /* WBTEXT && WBTEXT_BTMDELTA */
+#if defined(WBTEXT) && defined(RRM_BCNREQ_MAX_CHAN_TIME)
+       if (dhd_iovar(dhd, 0, "rrm_bcn_req_thrtl_win",
+               (char *)&rrm_bcn_req_thrtl_win, sizeof(rrm_bcn_req_thrtl_win),
+               NULL, 0, TRUE) < 0) {
+               DHD_ERROR(("failed to set RRM BCN request thrtl_win\n"));
+       }
+       if (dhd_iovar(dhd, 0, "rrm_bcn_req_max_off_chan_time",
+               (char *)&rrm_bcn_req_max_off_chan_time, sizeof(rrm_bcn_req_max_off_chan_time),
+               NULL, 0, TRUE) < 0) {
+               DHD_ERROR(("failed to set RRM BCN Request max_off_chan_time\n"));
+       }
+#endif /* WBTEXT && RRM_BCNREQ_MAX_CHAN_TIME */
+
+#ifdef WL_MONITOR
+       if (FW_SUPPORTED(dhd, monitor)) {
+               dhd->monitor_enable = TRUE;
+               DHD_ERROR(("%s: Monitor mode is enabled in FW cap\n", __FUNCTION__));
+       } else {
+               dhd->monitor_enable = FALSE;
+               DHD_ERROR(("%s: Monitor mode is not enabled in FW cap\n", __FUNCTION__));
+       }
+#endif /* WL_MONITOR */
+
+       /* store the preserve log set numbers */
+       if (dhd_get_preserve_log_numbers(dhd, &dhd->logset_prsrv_mask)
+                       != BCME_OK) {
+               DHD_ERROR(("%s: Failed to get preserve log # !\n", __FUNCTION__));
+       }
+
+       if (FW_SUPPORTED(dhd, ecounters) && enable_ecounter) {
+               dhd_ecounter_configure(dhd, TRUE);
+       }
+
+#ifdef CONFIG_SILENT_ROAM
+       dhd->sroam_turn_on = TRUE;
+       dhd->sroamed = FALSE;
+#endif /* CONFIG_SILENT_ROAM */
+       dhd_set_bandlock(dhd);
+
+       dhd_conf_postinit_ioctls(dhd);
+done:
+
+       if (eventmask_msg) {
+               MFREE(dhd->osh, eventmask_msg, msglen);
+       }
+       if (iov_buf) {
+               MFREE(dhd->osh, iov_buf, WLC_IOCTL_SMLEN);
+       }
+#if defined(DHD_8021X_DUMP) && defined(SHOW_LOGTRACE)
+       if (el_tag) {
+               MFREE(dhd->osh, el_tag, sizeof(wl_el_tag_params_t));
+       }
+#endif /* DHD_8021X_DUMP */
+       return ret;
+}
+
+/* Deafult enable preinit optimisation */
+#define DHD_PREINIT_OPTIMISATION
+
+int
+dhd_preinit_ioctls(dhd_pub_t *dhd)
+{
+       int ret = 0;
+
+#ifdef DHD_PREINIT_OPTIMISATION
+       int preinit_status = 0;
+       ret = dhd_iovar(dhd, 0, "preinit_status", NULL, 0, (char *)&preinit_status,
+               sizeof(preinit_status), FALSE);
+
+       if (ret == BCME_OK) {
+               DHD_ERROR(("%s: preinit_status IOVAR present, use optimised preinit\n",
+                       __FUNCTION__));
+               dhd->fw_preinit = TRUE;
+               ret = dhd_optimised_preinit_ioctls(dhd);
+       } else if (ret == BCME_UNSUPPORTED) {
+               DHD_ERROR(("%s: preinit_status IOVAR not supported, use legacy preinit\n",
+                       __FUNCTION__));
+               dhd->fw_preinit = FALSE;
+               ret = dhd_legacy_preinit_ioctls(dhd);
+       } else {
+               DHD_ERROR(("%s: preinit_status IOVAR returned err(%d), ABORT\n",
+                       __FUNCTION__, ret));
+       }
+#else
+       dhd->fw_preinit = FALSE;
+       ret = dhd_legacy_preinit_ioctls(dhd);
+#endif /* DHD_PREINIT_OPTIMISATION */
+       return ret;
+}
+
+int
+dhd_getiovar(dhd_pub_t *pub, int ifidx, char *name, char *cmd_buf,
+       uint cmd_len, char **resptr, uint resp_len)
+{
+       int len = resp_len;
+       int ret;
+       char *buf = *resptr;
+       wl_ioctl_t ioc;
+       if (resp_len > WLC_IOCTL_MAXLEN)
+               return BCME_BADARG;
+
+       memset(buf, 0, resp_len);
+
+       ret = bcm_mkiovar(name, cmd_buf, cmd_len, buf, len);
+       if (ret == 0) {
+               return BCME_BUFTOOSHORT;
+       }
+
+       memset(&ioc, 0, sizeof(ioc));
+
+       ioc.cmd = WLC_GET_VAR;
+       ioc.buf = buf;
+       ioc.len = len;
+       ioc.set = 0;
+
+       ret = dhd_wl_ioctl(pub, ifidx, &ioc, ioc.buf, ioc.len);
+
+       return ret;
+}
+
+int dhd_change_mtu(dhd_pub_t *dhdp, int new_mtu, int ifidx)
+{
+       struct dhd_info *dhd = dhdp->info;
+       struct net_device *dev = NULL;
+
+       ASSERT(dhd && dhd->iflist[ifidx]);
+       dev = dhd->iflist[ifidx]->net;
+       ASSERT(dev);
+
+       if (netif_running(dev)) {
+               DHD_ERROR(("%s: Must be down to change its MTU\n", dev->name));
+               return BCME_NOTDOWN;
+       }
+
+#define DHD_MIN_MTU 1500
+#define DHD_MAX_MTU 1752
+
+       if ((new_mtu < DHD_MIN_MTU) || (new_mtu > DHD_MAX_MTU)) {
+               DHD_ERROR(("%s: MTU size %d is invalid.\n", __FUNCTION__, new_mtu));
+               return BCME_BADARG;
+       }
+
+       dev->mtu = new_mtu;
+       return 0;
+}
+
+#if defined(WL_CFG80211) && defined(DHD_FILE_DUMP_EVENT) && defined(DHD_FW_COREDUMP)
+static int dhd_wait_for_file_dump(dhd_pub_t *dhdp)
+{
+       struct net_device *primary_ndev;
+       struct bcm_cfg80211 *cfg;
+       unsigned long flags = 0;
+       primary_ndev = dhd_linux_get_primary_netdev(dhdp);
+
+       if (!primary_ndev) {
+               DHD_ERROR(("%s: Cannot find primary netdev\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+       cfg = wl_get_cfg(primary_ndev);
+
+       if (!cfg) {
+               DHD_ERROR(("%s: Cannot find cfg\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       DHD_GENERAL_LOCK(dhdp, flags);
+       if (DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(dhdp)) {
+               DHD_BUS_BUSY_CLEAR_IN_HALDUMP(dhdp);
+               dhd_os_busbusy_wake(dhdp);
+               DHD_GENERAL_UNLOCK(dhdp, flags);
+               DHD_ERROR(("%s: bus is down! can't collect log dump. \n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+       DHD_BUS_BUSY_SET_IN_HALDUMP(dhdp);
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+
+       DHD_OS_WAKE_LOCK(dhdp);
+       /* check for hal started and only then send event if not clear dump state here */
+       if (wl_cfg80211_is_hal_started(cfg)) {
+               int timeleft = 0;
+
+               DHD_ERROR(("[DUMP] %s: HAL started. send urgent event\n", __FUNCTION__));
+               dhd_dbg_send_urgent_evt(dhdp, NULL, 0);
+
+               DHD_ERROR(("%s: wait to clear dhd_bus_busy_state: 0x%x\n",
+                       __FUNCTION__, dhdp->dhd_bus_busy_state));
+               timeleft = dhd_os_busbusy_wait_bitmask(dhdp,
+                               &dhdp->dhd_bus_busy_state, DHD_BUS_BUSY_IN_HALDUMP, 0);
+               if ((dhdp->dhd_bus_busy_state & DHD_BUS_BUSY_IN_HALDUMP) != 0) {
+                       DHD_ERROR(("%s: Timed out(%d) dhd_bus_busy_state=0x%x\n",
+                                       __FUNCTION__, timeleft, dhdp->dhd_bus_busy_state));
+               }
+       } else {
+               DHD_ERROR(("[DUMP] %s: HAL Not started. skip urgent event\n", __FUNCTION__));
+       }
+       DHD_OS_WAKE_UNLOCK(dhdp);
+       /* In case of dhd_os_busbusy_wait_bitmask() timeout,
+        * hal dump bit will not be cleared. Hence clearing it here.
+        */
+       DHD_GENERAL_LOCK(dhdp, flags);
+       DHD_BUS_BUSY_CLEAR_IN_HALDUMP(dhdp);
+       dhd_os_busbusy_wake(dhdp);
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+
+       return BCME_OK;
+}
+#endif /* WL_CFG80211 && DHD_FILE_DUMP_EVENT && DHD_FW_CORE_DUMP */
+
+#ifdef ARP_OFFLOAD_SUPPORT
+/* add or remove AOE host ip(s) (up to 8 IPs on the interface)  */
+/* XXX add operation is more efficent */
+void
+aoe_update_host_ipv4_table(dhd_pub_t *dhd_pub, u32 ipa, bool add, int idx)
+{
+       u32 ipv4_buf[MAX_IPV4_ENTRIES]; /* temp save for AOE host_ip table */
+       int i;
+       int ret;
+
+       bzero(ipv4_buf, sizeof(ipv4_buf));
+
+       /* display what we've got */
+       ret = dhd_arp_get_arp_hostip_table(dhd_pub, ipv4_buf, sizeof(ipv4_buf), idx);
+       DHD_ARPOE(("%s: hostip table read from Dongle:\n", __FUNCTION__));
+#ifdef AOE_DBG
+       dhd_print_buf(ipv4_buf, 32, 4); /* max 8 IPs 4b each */
+#endif
+       /* now we saved hoste_ip table, clr it in the dongle AOE */
+       dhd_aoe_hostip_clr(dhd_pub, idx);
+
+       if (ret) {
+               DHD_ERROR(("%s failed\n", __FUNCTION__));
+               return;
+       }
+
+       for (i = 0; i < MAX_IPV4_ENTRIES; i++) {
+               if (add && (ipv4_buf[i] == 0)) {
+                               ipv4_buf[i] = ipa;
+                               add = FALSE; /* added ipa to local table  */
+                               DHD_ARPOE(("%s: Saved new IP in temp arp_hostip[%d]\n",
+                               __FUNCTION__, i));
+               } else if (ipv4_buf[i] == ipa) {
+                       ipv4_buf[i]     = 0;
+                       DHD_ARPOE(("%s: removed IP:%x from temp table %d\n",
+                               __FUNCTION__, ipa, i));
+               }
+
+               if (ipv4_buf[i] != 0) {
+                       /* add back host_ip entries from our local cache */
+                       dhd_arp_offload_add_ip(dhd_pub, ipv4_buf[i], idx);
+                       DHD_ARPOE(("%s: added IP:%x to dongle arp_hostip[%d]\n\n",
+                               __FUNCTION__, ipv4_buf[i], i));
+               }
+       }
+#ifdef AOE_DBG
+       /* see the resulting hostip table */
+       dhd_arp_get_arp_hostip_table(dhd_pub, ipv4_buf, sizeof(ipv4_buf), idx);
+       DHD_ARPOE(("%s: read back arp_hostip table:\n", __FUNCTION__));
+       dhd_print_buf(ipv4_buf, 32, 4); /* max 8 IPs 4b each */
+#endif
+}
+
+/* XXX this function is only for IP address */
+/*
+ * Notification mechanism from kernel to our driver. This function is called by the Linux kernel
+ * whenever there is an event related to an IP address.
+ * ptr : kernel provided pointer to IP address that has changed
+ */
+static int dhd_inetaddr_notifier_call(struct notifier_block *this,
+       unsigned long event,
+       void *ptr)
+{
+       struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
+
+       dhd_info_t *dhd;
+       dhd_pub_t *dhd_pub;
+       int idx;
+
+       if (!ifa || !(ifa->ifa_dev->dev))
+               return NOTIFY_DONE;
+
+       /* Filter notifications meant for non Broadcom devices */
+       if ((ifa->ifa_dev->dev->netdev_ops != &dhd_ops_pri) &&
+           (ifa->ifa_dev->dev->netdev_ops != &dhd_ops_virt)) {
+#if defined(WL_ENABLE_P2P_IF)
+               if (!wl_cfgp2p_is_ifops(ifa->ifa_dev->dev->netdev_ops))
+#endif /* WL_ENABLE_P2P_IF */
+                       return NOTIFY_DONE;
+       }
+
+       dhd = DHD_DEV_INFO(ifa->ifa_dev->dev);
+       if (!dhd)
+               return NOTIFY_DONE;
+
+       dhd_pub = &dhd->pub;
+
+       if (!dhd_pub->arpoe_enable) {
+               DHD_ERROR(("arpoe_enable not set"));
+               return NOTIFY_DONE;
+       }
+
+       if (dhd_pub->arp_version == 1) {
+               idx = 0;
+       } else {
+               for (idx = 0; idx < DHD_MAX_IFS; idx++) {
+                       if (dhd->iflist[idx] && dhd->iflist[idx]->net == ifa->ifa_dev->dev)
+                       break;
+               }
+               if (idx < DHD_MAX_IFS)
+                       DHD_TRACE(("ifidx : %p %s %d\n", dhd->iflist[idx]->net,
+                               dhd->iflist[idx]->name, dhd->iflist[idx]->idx));
+               else {
+                       DHD_ERROR(("Cannot find ifidx for(%s) set to 0\n", ifa->ifa_label));
+                       idx = 0;
+               }
+       }
+
+       switch (event) {
+               case NETDEV_UP:
+                       DHD_ARPOE(("%s: [%s] Up IP: 0x%x\n",
+                               __FUNCTION__, ifa->ifa_label, ifa->ifa_address));
+
+                       /*
+                        * Skip if Bus is not in a state to transport the IOVAR
+                        * (or) the Dongle is not ready.
+                        */
+                       if (DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(&dhd->pub) ||
+                               dhd->pub.busstate ==  DHD_BUS_LOAD) {
+                               DHD_ERROR(("%s: bus not ready, exit NETDEV_UP : %d\n",
+                                       __FUNCTION__, dhd->pub.busstate));
+                               if (dhd->pend_ipaddr) {
+                                       DHD_ERROR(("%s: overwrite pending ipaddr: 0x%x\n",
+                                               __FUNCTION__, dhd->pend_ipaddr));
+                               }
+                               dhd->pend_ipaddr = ifa->ifa_address;
+                               break;
+                       }
+
+#ifdef AOE_IP_ALIAS_SUPPORT
+                       /* XXX HOSTAPD will be rerturned at first */
+                       DHD_ARPOE(("%s:add aliased IP to AOE hostip cache\n",
+                               __FUNCTION__));
+                       aoe_update_host_ipv4_table(dhd_pub, ifa->ifa_address, TRUE, idx);
+#endif /* AOE_IP_ALIAS_SUPPORT */
+                       dhd_conf_set_garp(dhd_pub, idx, ifa->ifa_address, TRUE);
+                       break;
+
+               case NETDEV_DOWN:
+                       DHD_ARPOE(("%s: [%s] Down IP: 0x%x\n",
+                               __FUNCTION__, ifa->ifa_label, ifa->ifa_address));
+                       dhd->pend_ipaddr = 0;
+#ifdef AOE_IP_ALIAS_SUPPORT
+                       /* XXX HOSTAPD will be rerturned at first */
+                       DHD_ARPOE(("%s:interface is down, AOE clr all for this if\n",
+                               __FUNCTION__));
+                       if ((dhd_pub->op_mode & DHD_FLAG_HOSTAP_MODE) ||
+                               (ifa->ifa_dev->dev != dhd_linux_get_primary_netdev(dhd_pub))) {
+                               aoe_update_host_ipv4_table(dhd_pub, ifa->ifa_address, FALSE, idx);
+                       } else
+#endif /* AOE_IP_ALIAS_SUPPORT */
+                       {
+                               /* XXX clear ALL arp and hostip tables */
+                               dhd_aoe_hostip_clr(&dhd->pub, idx);
+                               dhd_aoe_arp_clr(&dhd->pub, idx);
+                       }
+                       dhd_conf_set_garp(dhd_pub, idx, ifa->ifa_address, FALSE);
+                       break;
+
+               default:
+                       DHD_ARPOE(("%s: do noting for [%s] Event: %lu\n",
+                               __func__, ifa->ifa_label, event));
+                       break;
+       }
+       return NOTIFY_DONE;
+}
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#if defined(CONFIG_IPV6) && defined(IPV6_NDO_SUPPORT)
+/* Neighbor Discovery Offload: defered handler */
+static void
+dhd_inet6_work_handler(void *dhd_info, void *event_data, u8 event)
+{
+       struct ipv6_work_info_t *ndo_work = (struct ipv6_work_info_t *)event_data;
+       dhd_info_t *dhd = (dhd_info_t *)dhd_info;
+       dhd_pub_t *dhdp;
+       int ret;
+
+       if (!dhd) {
+               DHD_ERROR(("%s: invalid dhd_info\n", __FUNCTION__));
+               goto done;
+       }
+       dhdp = &dhd->pub;
+
+       if (event != DHD_WQ_WORK_IPV6_NDO) {
+               DHD_ERROR(("%s: unexpected event\n", __FUNCTION__));
+               goto done;
+       }
+
+       if (!ndo_work) {
+               DHD_ERROR(("%s: ipv6 work info is not initialized\n", __FUNCTION__));
+               return;
+       }
+
+       switch (ndo_work->event) {
+               case NETDEV_UP:
+#ifndef NDO_CONFIG_SUPPORT
+                       DHD_TRACE(("%s: Enable NDO \n ", __FUNCTION__));
+                       ret = dhd_ndo_enable(dhdp, TRUE);
+                       if (ret < 0) {
+                               DHD_ERROR(("%s: Enabling NDO Failed %d\n", __FUNCTION__, ret));
+                       }
+#endif /* !NDO_CONFIG_SUPPORT */
+                       DHD_TRACE(("%s: Add a host ip for NDO\n", __FUNCTION__));
+                       if (dhdp->ndo_version > 0) {
+                               /* inet6 addr notifier called only for unicast address */
+                               ret = dhd_ndo_add_ip_with_type(dhdp, &ndo_work->ipv6_addr[0],
+                                       WL_ND_IPV6_ADDR_TYPE_UNICAST, ndo_work->if_idx);
+                       } else {
+                               ret = dhd_ndo_add_ip(dhdp, &ndo_work->ipv6_addr[0],
+                                       ndo_work->if_idx);
+                       }
+                       if (ret < 0) {
+                               DHD_ERROR(("%s: Adding a host ip for NDO failed %d\n",
+                                       __FUNCTION__, ret));
+                       }
+                       break;
+               case NETDEV_DOWN:
+                       if (dhdp->ndo_version > 0) {
+                               DHD_TRACE(("%s: Remove a host ip for NDO\n", __FUNCTION__));
+                               ret = dhd_ndo_remove_ip_by_addr(dhdp,
+                                       &ndo_work->ipv6_addr[0], ndo_work->if_idx);
+                       } else {
+                               DHD_TRACE(("%s: Clear host ip table for NDO \n", __FUNCTION__));
+                               ret = dhd_ndo_remove_ip(dhdp, ndo_work->if_idx);
+                       }
+                       if (ret < 0) {
+                               DHD_ERROR(("%s: Removing host ip for NDO failed %d\n",
+                                       __FUNCTION__, ret));
+                               goto done;
+                       }
+#ifdef NDO_CONFIG_SUPPORT
+                       if (dhdp->ndo_host_ip_overflow) {
+                               ret = dhd_dev_ndo_update_inet6addr(
+                                       dhd_idx2net(dhdp, ndo_work->if_idx));
+                               if ((ret < 0) && (ret != BCME_NORESOURCE)) {
+                                       DHD_ERROR(("%s: Updating host ip for NDO failed %d\n",
+                                               __FUNCTION__, ret));
+                                       goto done;
+                               }
+                       }
+#else /* !NDO_CONFIG_SUPPORT */
+                       DHD_TRACE(("%s: Disable NDO\n ", __FUNCTION__));
+                       ret = dhd_ndo_enable(dhdp, FALSE);
+                       if (ret < 0) {
+                               DHD_ERROR(("%s: disabling NDO Failed %d\n", __FUNCTION__, ret));
+                               goto done;
+                       }
+#endif /* NDO_CONFIG_SUPPORT */
+                       break;
+
+               default:
+                       DHD_ERROR(("%s: unknown notifier event \n", __FUNCTION__));
+                       break;
+       }
+done:
+
+       /* free ndo_work. alloced while scheduling the work */
+       if (ndo_work) {
+               kfree(ndo_work);
+       }
+
+       return;
+} /* dhd_init_logstrs_array */
+
+/*
+ * Neighbor Discovery Offload: Called when an interface
+ * is assigned with ipv6 address.
+ * Handles only primary interface
+ */
+int dhd_inet6addr_notifier_call(struct notifier_block *this, unsigned long event, void *ptr)
+{
+       dhd_info_t *dhd;
+       dhd_pub_t *dhdp;
+       struct inet6_ifaddr *inet6_ifa = ptr;
+       struct ipv6_work_info_t *ndo_info;
+       int idx;
+
+       /* Filter notifications meant for non Broadcom devices */
+       if (inet6_ifa->idev->dev->netdev_ops != &dhd_ops_pri) {
+                       return NOTIFY_DONE;
+       }
+
+       dhd = DHD_DEV_INFO(inet6_ifa->idev->dev);
+       if (!dhd) {
+               return NOTIFY_DONE;
+       }
+       dhdp = &dhd->pub;
+
+       /* Supports only primary interface */
+       idx = dhd_net2idx(dhd, inet6_ifa->idev->dev);
+       if (idx != 0) {
+               return NOTIFY_DONE;
+       }
+
+       /* FW capability */
+       if (!FW_SUPPORTED(dhdp, ndoe)) {
+               return NOTIFY_DONE;
+       }
+
+       ndo_info = (struct ipv6_work_info_t *)kzalloc(sizeof(struct ipv6_work_info_t), GFP_ATOMIC);
+       if (!ndo_info) {
+               DHD_ERROR(("%s: ipv6 work alloc failed\n", __FUNCTION__));
+               return NOTIFY_DONE;
+       }
+
+       /* fill up ndo_info */
+       ndo_info->event = event;
+       ndo_info->if_idx = idx;
+       memcpy(ndo_info->ipv6_addr, &inet6_ifa->addr, IPV6_ADDR_LEN);
+
+       /* defer the work to thread as it may block kernel */
+       dhd_deferred_schedule_work(dhd->dhd_deferred_wq, (void *)ndo_info, DHD_WQ_WORK_IPV6_NDO,
+               dhd_inet6_work_handler, DHD_WQ_WORK_PRIORITY_LOW);
+       return NOTIFY_DONE;
+}
+#endif /* CONFIG_IPV6 && IPV6_NDO_SUPPORT */
+
+/* Network attach to be invoked from the bus probe handlers */
+int
+dhd_attach_net(dhd_pub_t *dhdp, bool need_rtnl_lock)
+{
+       struct net_device *primary_ndev;
+       BCM_REFERENCE(primary_ndev);
+
+       /* Register primary net device */
+       if (dhd_register_if(dhdp, 0, need_rtnl_lock) != 0) {
+               return BCME_ERROR;
+       }
+
+#if defined(WL_CFG80211)
+       primary_ndev =  dhd_linux_get_primary_netdev(dhdp);
+       if (wl_cfg80211_net_attach(primary_ndev) < 0) {
+               /* fail the init */
+               dhd_remove_if(dhdp, 0, TRUE);
+               return BCME_ERROR;
+       }
+#endif /* WL_CFG80211 */
+       return BCME_OK;
+}
+
+#if defined(WLAN_ACCEL_BOOT)
+
+#ifndef DHD_FS_CHECK_RETRY_DELAY_MS
+#define DHD_FS_CHECK_RETRY_DELAY_MS    3000
+#endif
+
+#ifndef DHD_FS_CHECK_RETRIES
+#define DHD_FS_CHECK_RETRIES   3
+#endif
+
+static bool
+dhd_check_filesystem_is_up(void)
+{
+       struct file *fp;
+       const char *fw = VENDOR_PATH CONFIG_BCMDHD_FW_PATH;
+       fp = filp_open(fw, O_RDONLY, 0);
+
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("%s: filp_open(%s) failed(%d) schedule wl_accel_work\n",
+                       __FUNCTION__, fw, (int)IS_ERR(fp)));
+               return FALSE;
+       }
+       filp_close(fp, NULL);
+
+       return TRUE;
+}
+
+static void
+dhd_wifi_accel_on_work_cb(struct work_struct *work)
+{
+       int ret = 0;
+       struct delayed_work *dw = to_delayed_work(work);
+       struct dhd_info *dhd;
+       struct net_device *net;
+
+       /* Ignore compiler warnings due to -Werror=cast-qual */
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       dhd = container_of(dw, struct dhd_info, wl_accel_work);
+       GCC_DIAGNOSTIC_POP();
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       if (!dhd_check_filesystem_is_up()) {
+               if (!dhd->fs_check_retry--) {
+                       DHD_ERROR(("%s: max retry reached, BACKOFF\n", __FUNCTION__));
+                       return;
+               }
+               schedule_delayed_work(&dhd->wl_accel_work,
+                       msecs_to_jiffies(DHD_FS_CHECK_RETRY_DELAY_MS));
+               return;
+       }
+
+       net = dhd->iflist[0]->net;
+
+       /*
+        * Keep wlan turn on and download firmware during bootup
+        * by making g_wifi_on = FALSE
+        */
+       wl_android_set_wifi_on_flag(FALSE);
+       ret = wl_android_wifi_on(net);
+       if (ret) {
+               DHD_ERROR(("%s: wl_android_wifi_on failed(%d)\n", __FUNCTION__, ret));
+               goto fail;
+       }
+
+       /* After bootup keep in suspend state */
+       ret = dhd_net_bus_suspend(net);
+       if (ret) {
+               DHD_ERROR(("%s: dhd_net_bus_suspend failed(%d)\n", __FUNCTION__, ret));
+               goto fail;
+       }
+
+       /* Initilise force regon to FALSE and it will be set for Big Hammer case */
+       dhd->wl_accel_force_reg_on = FALSE;
+
+       /* Mark wl_accel_boot_on_done */
+       dhd->wl_accel_boot_on_done = TRUE;
+       return;
+
+fail:
+       DHD_ERROR(("%s: enable wl_accel_force_reg_on to recover\n", __FUNCTION__));
+       /* Toggle REG_ON and download firmware during UP */
+       dhd->wl_accel_force_reg_on = TRUE;
+
+       /* Reset wl_accel_boot_on_done */
+       dhd->wl_accel_boot_on_done = FALSE;
+       return;
+
+}
+#endif /* WLAN_ACCEL_BOOT */
+
+int
+dhd_register_if(dhd_pub_t *dhdp, int ifidx, bool need_rtnl_lock)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+       dhd_if_t *ifp;
+       struct net_device *net = NULL;
+       int err = 0;
+       uint8 temp_addr[ETHER_ADDR_LEN] = { 0x00, 0x90, 0x4c, 0x11, 0x22, 0x33 };
+
+       DHD_TRACE(("%s: ifidx %d\n", __FUNCTION__, ifidx));
+
+       if (dhd == NULL || dhd->iflist[ifidx] == NULL) {
+               DHD_ERROR(("%s: Invalid Interface\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       ASSERT(dhd && dhd->iflist[ifidx]);
+       ifp = dhd->iflist[ifidx];
+       net = ifp->net;
+       ASSERT(net && (ifp->idx == ifidx));
+
+       ASSERT(!net->netdev_ops);
+       net->netdev_ops = &dhd_ops_virt;
+
+       /* Ok, link into the network layer... */
+       if (ifidx == 0) {
+               /*
+                * device functions for the primary interface only
+                */
+               net->netdev_ops = &dhd_ops_pri;
+               if (!ETHER_ISNULLADDR(dhd->pub.mac.octet))
+                       memcpy(temp_addr, dhd->pub.mac.octet, ETHER_ADDR_LEN);
+       } else {
+               /*
+                * We have to use the primary MAC for virtual interfaces
+                */
+               memcpy(temp_addr, ifp->mac_addr, ETHER_ADDR_LEN);
+               /*
+                * Android sets the locally administered bit to indicate that this is a
+                * portable hotspot.  This will not work in simultaneous AP/STA mode,
+                * nor with P2P.  Need to set the Donlge's MAC address, and then use that.
+                */
+               if (!memcmp(temp_addr, dhd->iflist[0]->mac_addr,
+                       ETHER_ADDR_LEN)) {
+                       DHD_ERROR(("%s interface [%s]: set locally administered bit in MAC\n",
+                       __func__, net->name));
+                       temp_addr[0] |= 0x02;
+               }
+       }
+
+       net->hard_header_len = ETH_HLEN + dhd->pub.hdrlen;
+       net->ethtool_ops = &dhd_ethtool_ops;
+
+#if defined(WL_WIRELESS_EXT)
+#if WIRELESS_EXT < 19
+       net->get_wireless_stats = dhd_get_wireless_stats;
+#endif /* WIRELESS_EXT < 19 */
+#if WIRELESS_EXT > 12
+       net->wireless_handlers = &wl_iw_handler_def;
+#endif /* WIRELESS_EXT > 12 */
+#endif /* defined(WL_WIRELESS_EXT) */
+
+       /* XXX Set up an MTU change notifier as per linux/notifier.h? */
+       dhd->pub.rxsz = DBUS_RX_BUFFER_SIZE_DHD(net);
+
+#ifdef WLMESH
+       if (ifidx >= 2 && dhdp->conf->fw_type == FW_TYPE_MESH) {
+               temp_addr[4] ^= 0x80;
+               temp_addr[4] += ifidx;
+               temp_addr[5] += ifidx;
+       }
+#endif
+       /*
+        * XXX Linux 2.6.25 does not like a blank MAC address, so use a
+        * dummy address until the interface is brought up.
+        */
+       memcpy(net->dev_addr, temp_addr, ETHER_ADDR_LEN);
+
+       if (ifidx == 0)
+               printf("%s\n", dhd_version);
+       else {
+#ifdef WL_EXT_IAPSTA
+               wl_ext_iapsta_update_net_device(net, ifidx);
+#endif /* WL_EXT_IAPSTA */
+               if (dhd->pub.up == 1) {
+                       if (_dhd_set_mac_address(dhd, ifidx, net->dev_addr, FALSE) == 0)
+                               DHD_INFO(("%s: MACID is overwritten\n", __FUNCTION__));
+                       else
+                               DHD_ERROR(("%s: _dhd_set_mac_address() failed\n", __FUNCTION__));
+               }
+       }
+
+       if (need_rtnl_lock)
+               err = register_netdev(net);
+       else
+               err = register_netdevice(net);
+
+       if (err != 0) {
+               DHD_ERROR(("couldn't register the net device [%s], err %d\n", net->name, err));
+               goto fail;
+       }
+#if defined(WL_EXT_IAPSTA) || defined(USE_IW) || defined(WL_ESCAN)
+       wl_ext_event_attach_netdev(net, ifidx, ifp->bssidx);
+#ifdef WL_ESCAN
+       wl_escan_event_attach(net, dhdp);
+#endif /* WL_ESCAN */
+#ifdef WL_EXT_IAPSTA
+       wl_ext_iapsta_attach_netdev(net, ifidx, ifp->bssidx);
+       wl_ext_iapsta_attach_name(net, ifidx);
+#endif /* WL_EXT_IAPSTA */
+#endif /* WL_EXT_IAPSTA || USE_IW || WL_ESCAN */
+
+#if defined(CONFIG_TIZEN)
+       net_stat_tizen_register(net);
+#endif /* CONFIG_TIZEN */
+
+       printf("Register interface [%s]  MAC: "MACDBG"\n\n", net->name,
+#if defined(CUSTOMER_HW4_DEBUG)
+               MAC2STRDBG(dhd->pub.mac.octet));
+#else
+               MAC2STRDBG(net->dev_addr));
+#endif /* CUSTOMER_HW4_DEBUG */
+
+#if (defined(BCMPCIE) || defined(BCMLXSDMMC) || defined(BCMDBUS))
+       if (ifidx == 0) {
+#if defined(BCMLXSDMMC) && !defined(DHD_PRELOAD)
+               up(&dhd_registration_sem);
+#endif /* BCMLXSDMMC */
+               if (!dhd_download_fw_on_driverload) {
+#ifdef WL_CFG80211
+                       wl_terminate_event_handler(net);
+#endif /* WL_CFG80211 */
+#if defined(DHD_LB_RXP)
+                       __skb_queue_purge(&dhd->rx_pend_queue);
+#endif /* DHD_LB_RXP */
+
+#if defined(DHD_LB_TXP)
+                       skb_queue_purge(&dhd->tx_pend_queue);
+#endif /* DHD_LB_TXP */
+
+#ifdef SHOW_LOGTRACE
+                       /* Release the skbs from queue for WLC_E_TRACE event */
+                       dhd_event_logtrace_flush_queue(dhdp);
+#endif /* SHOW_LOGTRACE */
+
+#if defined(BCMPCIE) && defined(DHDTCPACK_SUPPRESS)
+                       dhd_tcpack_suppress_set(dhdp, TCPACK_SUP_OFF);
+#endif /* BCMPCIE && DHDTCPACK_SUPPRESS */
+
+#if defined(WLAN_ACCEL_BOOT)
+                       dhd->fs_check_retry = DHD_FS_CHECK_RETRIES;
+                       dhd->wl_accel_boot_on_done = FALSE;
+                       INIT_DELAYED_WORK(&dhd->wl_accel_work, dhd_wifi_accel_on_work_cb);
+                       schedule_delayed_work(&dhd->wl_accel_work,
+                               msecs_to_jiffies(DHD_FS_CHECK_RETRY_DELAY_MS));
+#else
+                       /* Turn off Wifi after boot up */
+#if defined(BT_OVER_SDIO)
+                       dhd_bus_put(&dhd->pub, WLAN_MODULE);
+                       wl_android_set_wifi_on_flag(FALSE);
+#else
+                       wl_android_wifi_off(net, TRUE);
+#endif /* BT_OVER_SDIO */
+#endif /* WLAN_ACCEL_BOOT */
+
+               }
+#if defined(WL_WIRELESS_EXT)
+               wl_iw_down(net, &dhd->pub);
+#endif /* defined(WL_WIRELESS_EXT) */
+       }
+#endif /* OEM_ANDROID && (BCMPCIE || (BCMLXSDMMC) */
+       return 0;
+
+fail:
+       net->netdev_ops = NULL;
+       return err;
+}
+
+void
+dhd_bus_detach(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (dhdp) {
+               dhd = (dhd_info_t *)dhdp->info;
+               if (dhd) {
+
+                       /*
+                        * In case of Android cfg80211 driver, the bus is down in dhd_stop,
+                        *  calling stop again will cuase SD read/write errors.
+                        */
+                       if (dhd->pub.busstate != DHD_BUS_DOWN && dhd_download_fw_on_driverload) {
+                               /* Stop the protocol module */
+                               dhd_prot_stop(&dhd->pub);
+
+                               /* Stop the bus module */
+#ifdef BCMDBUS
+                               /* Force Dongle terminated */
+                               if (dhd_wl_ioctl_cmd(dhdp, WLC_TERMINATED, NULL, 0, TRUE, 0) < 0)
+                                       DHD_ERROR(("%s Setting WLC_TERMINATED failed\n",
+                                               __FUNCTION__));
+                               dbus_stop(dhd->pub.bus);
+                               dhd->pub.busstate = DHD_BUS_DOWN;
+#else
+                               dhd_bus_stop(dhd->pub.bus, TRUE);
+#endif /* BCMDBUS */
+                       }
+
+#if defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID) || defined(BCMPCIE_OOB_HOST_WAKE)
+                       dhd_bus_oob_intr_unregister(dhdp);
+#endif /* OOB_INTR_ONLY || BCMSPI_ANDROID || BCMPCIE_OOB_HOST_WAKE */
+               }
+       }
+}
+
+void dhd_detach(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd;
+       unsigned long flags;
+       int timer_valid = FALSE;
+       struct net_device *dev;
+#ifdef WL_CFG80211
+       struct bcm_cfg80211 *cfg = NULL;
+#endif
+       if (!dhdp)
+               return;
+
+       dhd = (dhd_info_t *)dhdp->info;
+       if (!dhd)
+               return;
+
+       dev = dhd->iflist[0]->net;
+
+       if (dev) {
+               rtnl_lock();
+#if defined(WL_CFG80211) && defined(WL_STATIC_IF)
+               if (dhd->dhd_state & DHD_ATTACH_STATE_CFG80211) {
+                       cfg = wl_get_cfg(dev);
+                       if (cfg && cfg->static_ndev && (cfg->static_ndev->flags & IFF_UP)) {
+                               dev_close(cfg->static_ndev);
+                       }
+               }
+#endif /* WL_CFG80211 && WL_STATIC_IF */
+               if (dev->flags & IFF_UP) {
+                       /* If IFF_UP is still up, it indicates that
+                        * "ifconfig wlan0 down" hasn't been called.
+                        * So invoke dev_close explicitly here to
+                        * bring down the interface.
+                        */
+                       DHD_TRACE(("IFF_UP flag is up. Enforcing dev_close from detach \n"));
+                       dev_close(dev);
+               }
+               rtnl_unlock();
+       }
+
+       DHD_TRACE(("%s: Enter state 0x%x\n", __FUNCTION__, dhd->dhd_state));
+
+       /* XXX  kernel panic issue when first bootup time,
+        *       rmmod without interface down make unnecessary hang event.
+        */
+       DHD_ERROR(("%s: making dhdpub up FALSE\n", __FUNCTION__));
+       dhd->pub.up = 0;
+       if (!(dhd->dhd_state & DHD_ATTACH_STATE_DONE)) {
+               /* Give sufficient time for threads to start running in case
+                * dhd_attach() has failed
+                */
+               OSL_SLEEP(100);
+       }
+#ifdef DHD_WET
+       dhd_free_wet_info(&dhd->pub, dhd->pub.wet_info);
+#endif /* DHD_WET */
+#if defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW)
+#endif /* defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW) */
+
+#ifdef PROP_TXSTATUS
+#ifdef DHD_WLFC_THREAD
+       if (dhd->pub.wlfc_thread) {
+               kthread_stop(dhd->pub.wlfc_thread);
+               dhdp->wlfc_thread_go = TRUE;
+               wake_up_interruptible(&dhdp->wlfc_wqhead);
+       }
+       dhd->pub.wlfc_thread = NULL;
+#endif /* DHD_WLFC_THREAD */
+#endif /* PROP_TXSTATUS */
+
+#ifdef WL_CFG80211
+       if (dev)
+               wl_cfg80211_down(dev);
+#endif /* WL_CFG80211 */
+
+       if (dhd->dhd_state & DHD_ATTACH_STATE_PROT_ATTACH) {
+
+               dhd_bus_detach(dhdp);
+#ifdef BCMPCIE
+               if (is_reboot == SYS_RESTART) {
+                       extern bcmdhd_wifi_platdata_t *dhd_wifi_platdata;
+                       if (dhd_wifi_platdata && !dhdp->dongle_reset) {
+                               dhdpcie_bus_stop_host_dev(dhdp->bus);
+                               wifi_platform_set_power(dhd_wifi_platdata->adapters,
+                                       FALSE, WIFI_TURNOFF_DELAY);
+                       }
+               }
+#endif /* BCMPCIE */
+#ifndef PCIE_FULL_DONGLE
+               if (dhdp->prot)
+                       dhd_prot_detach(dhdp);
+#endif /* !PCIE_FULL_DONGLE */
+       }
+
+#ifdef ARP_OFFLOAD_SUPPORT
+       if (dhd_inetaddr_notifier_registered) {
+               dhd_inetaddr_notifier_registered = FALSE;
+               unregister_inetaddr_notifier(&dhd_inetaddr_notifier);
+       }
+#endif /* ARP_OFFLOAD_SUPPORT */
+#if defined(CONFIG_IPV6) && defined(IPV6_NDO_SUPPORT)
+       if (dhd_inet6addr_notifier_registered) {
+               dhd_inet6addr_notifier_registered = FALSE;
+               unregister_inet6addr_notifier(&dhd_inet6addr_notifier);
+       }
+#endif /* CONFIG_IPV6 && IPV6_NDO_SUPPORT */
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+       if (dhd->dhd_state & DHD_ATTACH_STATE_EARLYSUSPEND_DONE) {
+               if (dhd->early_suspend.suspend)
+                       unregister_early_suspend(&dhd->early_suspend);
+       }
+#endif /* CONFIG_HAS_EARLYSUSPEND && DHD_USE_EARLYSUSPEND */
+
+#if defined(WL_WIRELESS_EXT)
+       if (dhd->dhd_state & DHD_ATTACH_STATE_WL_ATTACH) {
+               /* Detatch and unlink in the iw */
+               wl_iw_detach(dev, dhdp);
+       }
+#endif /* defined(WL_WIRELESS_EXT) */
+#if defined(WL_EXT_IAPSTA) || defined(USE_IW) || defined(WL_ESCAN)
+#ifdef WL_EXT_IAPSTA
+       wl_ext_iapsta_dettach(dhdp);
+#endif /* WL_EXT_IAPSTA */
+#ifdef WL_ESCAN
+       wl_escan_detach(dev, dhdp);
+#endif /* WL_ESCAN */
+       wl_ext_event_dettach(dhdp);
+#endif /* WL_EXT_IAPSTA || USE_IW || WL_ESCAN */
+
+       /* delete all interfaces, start with virtual  */
+       if (dhd->dhd_state & DHD_ATTACH_STATE_ADD_IF) {
+               int i = 1;
+               dhd_if_t *ifp;
+
+               /* Cleanup virtual interfaces */
+               dhd_net_if_lock_local(dhd);
+               for (i = 1; i < DHD_MAX_IFS; i++) {
+                       if (dhd->iflist[i]) {
+                               dhd_remove_if(&dhd->pub, i, TRUE);
+                       }
+               }
+               dhd_net_if_unlock_local(dhd);
+
+               /*  delete primary interface 0 */
+               ifp = dhd->iflist[0];
+               if (ifp && ifp->net) {
+
+#ifdef WL_CFG80211
+                       cfg = wl_get_cfg(ifp->net);
+#endif
+                       /* in unregister_netdev case, the interface gets freed by net->destructor
+                        * (which is set to free_netdev)
+                        */
+                       if (ifp->net->reg_state == NETREG_UNINITIALIZED) {
+                               free_netdev(ifp->net);
+                       } else {
+                               netif_tx_disable(ifp->net);
+                               unregister_netdev(ifp->net);
+                       }
+#ifdef PCIE_FULL_DONGLE
+                       ifp->net = DHD_NET_DEV_NULL;
+#else
+                       ifp->net = NULL;
+#endif /* PCIE_FULL_DONGLE */
+
+#ifdef DHD_L2_FILTER
+                       bcm_l2_filter_arp_table_update(dhdp->osh, ifp->phnd_arp_table, TRUE,
+                               NULL, FALSE, dhdp->tickcnt);
+                       deinit_l2_filter_arp_table(dhdp->osh, ifp->phnd_arp_table);
+                       ifp->phnd_arp_table = NULL;
+#endif /* DHD_L2_FILTER */
+
+                       dhd_if_del_sta_list(ifp);
+
+                       MFREE(dhd->pub.osh, ifp, sizeof(*ifp));
+                       dhd->iflist[0] = NULL;
+#ifdef WL_CFG80211
+                       if (cfg && cfg->wdev)
+                               cfg->wdev->netdev = NULL;
+#endif
+               }
+       }
+
+       /* Clear the watchdog timer */
+       DHD_GENERAL_LOCK(&dhd->pub, flags);
+       timer_valid = dhd->wd_timer_valid;
+       dhd->wd_timer_valid = FALSE;
+       DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+       if (timer_valid)
+               del_timer_sync(&dhd->timer);
+       DHD_STOP_RPM_TIMER(&dhd->pub);
+
+#ifdef BCMDBUS
+       tasklet_kill(&dhd->tasklet);
+#else
+       if (dhd->dhd_state & DHD_ATTACH_STATE_THREADS_CREATED) {
+#ifdef DHD_PCIE_RUNTIMEPM
+               if (dhd->thr_rpm_ctl.thr_pid >= 0) {
+                       PROC_STOP(&dhd->thr_rpm_ctl);
+               }
+#endif /* DHD_PCIE_RUNTIMEPM */
+               if (dhd->thr_wdt_ctl.thr_pid >= 0) {
+                       PROC_STOP(&dhd->thr_wdt_ctl);
+               }
+
+               if (dhd->rxthread_enabled && dhd->thr_rxf_ctl.thr_pid >= 0) {
+                       PROC_STOP(&dhd->thr_rxf_ctl);
+               }
+
+               if (dhd->thr_dpc_ctl.thr_pid >= 0) {
+                       PROC_STOP(&dhd->thr_dpc_ctl);
+               } else
+               {
+                       tasklet_kill(&dhd->tasklet);
+               }
+       }
+#endif /* BCMDBUS */
+
+#ifdef WL_NATOE
+       if (dhd->pub.nfct) {
+               dhd_ct_close(dhd->pub.nfct);
+       }
+#endif /* WL_NATOE */
+
+#ifdef DHD_LB
+       if (dhd->dhd_state & DHD_ATTACH_STATE_LB_ATTACH_DONE) {
+               /* Clear the flag first to avoid calling the cpu notifier */
+               dhd->dhd_state &= ~DHD_ATTACH_STATE_LB_ATTACH_DONE;
+
+               /* Kill the Load Balancing Tasklets */
+#ifdef DHD_LB_RXP
+               cancel_work_sync(&dhd->rx_napi_dispatcher_work);
+               __skb_queue_purge(&dhd->rx_pend_queue);
+#endif /* DHD_LB_RXP */
+#ifdef DHD_LB_TXP
+               cancel_work_sync(&dhd->tx_dispatcher_work);
+               tasklet_kill(&dhd->tx_tasklet);
+               __skb_queue_purge(&dhd->tx_pend_queue);
+#endif /* DHD_LB_TXP */
+#ifdef DHD_LB_TXC
+               cancel_work_sync(&dhd->tx_compl_dispatcher_work);
+               tasklet_kill(&dhd->tx_compl_tasklet);
+#endif /* DHD_LB_TXC */
+#ifdef DHD_LB_RXC
+               tasklet_kill(&dhd->rx_compl_tasklet);
+#endif /* DHD_LB_RXC */
+
+               /* Unregister from CPU Hotplug framework */
+               dhd_unregister_cpuhp_callback(dhd);
+
+               dhd_cpumasks_deinit(dhd);
+               DHD_LB_STATS_DEINIT(&dhd->pub);
+       }
+#endif /* DHD_LB */
+
+#ifdef CSI_SUPPORT
+       dhd_csi_deinit(dhdp);
+#endif /* CSI_SUPPORT */
+
+#if defined(DNGL_AXI_ERROR_LOGGING) && defined(DHD_USE_WQ_FOR_DNGL_AXI_ERROR)
+       cancel_work_sync(&dhd->axi_error_dispatcher_work);
+#endif /* DNGL_AXI_ERROR_LOGGING && DHD_USE_WQ_FOR_DNGL_AXI_ERROR */
+
+       DHD_SSSR_REG_INFO_DEINIT(&dhd->pub);
+       DHD_SSSR_MEMPOOL_DEINIT(&dhd->pub);
+
+#ifdef EWP_EDL
+       if (host_edl_support) {
+               DHD_EDL_MEM_DEINIT(dhdp);
+               host_edl_support = FALSE;
+       }
+#endif /* EWP_EDL */
+
+#ifdef WL_CFG80211
+       if (dhd->dhd_state & DHD_ATTACH_STATE_CFG80211) {
+               if (!cfg) {
+                       DHD_ERROR(("cfg NULL!\n"));
+                       ASSERT(0);
+               } else {
+                       wl_cfg80211_detach(cfg);
+                       dhd_monitor_uninit();
+               }
+       }
+#endif
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       destroy_workqueue(dhd->tx_wq);
+       dhd->tx_wq = NULL;
+       destroy_workqueue(dhd->rx_wq);
+       dhd->rx_wq = NULL;
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+#ifdef DEBUGABILITY
+       if (dhdp->dbg) {
+#ifdef DBG_PKT_MON
+               dhd_os_dbg_detach_pkt_monitor(dhdp);
+               osl_spin_lock_deinit(dhd->pub.osh, dhd->pub.dbg->pkt_mon_lock);
+#endif /* DBG_PKT_MON */
+       }
+#endif /* DEBUGABILITY */
+       if (dhdp->dbg) {
+               dhd_os_dbg_detach(dhdp);
+       }
+#ifdef DHD_MEM_STATS
+       osl_spin_lock_deinit(dhd->pub.osh, dhd->pub.mem_stats_lock);
+#endif /* DHD_MEM_STATS */
+
+#ifdef DHD_PKT_LOGGING
+       dhd_os_detach_pktlog(dhdp);
+#endif /* DHD_PKT_LOGGING */
+#ifdef DHD_STATUS_LOGGING
+       dhd_detach_statlog(dhdp);
+#endif /* DHD_STATUS_LOGGING */
+#ifdef DHD_PKTDUMP_ROAM
+       dhd_dump_pkt_deinit(dhdp);
+#endif /* DHD_PKTDUMP_ROAM */
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+       if (dhd->pub.hang_info) {
+               MFREE(dhd->pub.osh, dhd->pub.hang_info, VENDOR_SEND_HANG_EXT_INFO_LEN);
+       }
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+#ifdef SHOW_LOGTRACE
+       /* Release the skbs from queue for WLC_E_TRACE event */
+       dhd_event_logtrace_flush_queue(dhdp);
+
+       /* Wait till event logtrace context finishes */
+       dhd_cancel_logtrace_process_sync(dhd);
+
+       /* Remove ring proc entries */
+       dhd_dbg_ring_proc_destroy(&dhd->pub);
+
+       if (dhd->dhd_state & DHD_ATTACH_LOGTRACE_INIT) {
+               if (dhd->event_data.fmts) {
+                       MFREE(dhd->pub.osh, dhd->event_data.fmts,
+                                       dhd->event_data.fmts_size);
+               }
+               if (dhd->event_data.raw_fmts) {
+                       MFREE(dhd->pub.osh, dhd->event_data.raw_fmts,
+                                       dhd->event_data.raw_fmts_size);
+               }
+               if (dhd->event_data.raw_sstr) {
+                       MFREE(dhd->pub.osh, dhd->event_data.raw_sstr,
+                                       dhd->event_data.raw_sstr_size);
+               }
+               if (dhd->event_data.rom_raw_sstr) {
+                       MFREE(dhd->pub.osh, dhd->event_data.rom_raw_sstr,
+                                       dhd->event_data.rom_raw_sstr_size);
+               }
+               dhd->dhd_state &= ~DHD_ATTACH_LOGTRACE_INIT;
+       }
+#endif /* SHOW_LOGTRACE */
+#ifdef PNO_SUPPORT
+       if (dhdp->pno_state)
+               dhd_pno_deinit(dhdp);
+#endif
+#ifdef RTT_SUPPORT
+       if (dhdp->rtt_state) {
+               dhd_rtt_detach(dhdp);
+       }
+#endif
+#if defined(CONFIG_PM_SLEEP)
+       if (dhd_pm_notifier_registered) {
+               unregister_pm_notifier(&dhd->pm_notifier);
+               dhd_pm_notifier_registered = FALSE;
+       }
+#endif /* CONFIG_PM_SLEEP */
+
+#ifdef DEBUG_CPU_FREQ
+               if (dhd->new_freq)
+                       free_percpu(dhd->new_freq);
+               dhd->new_freq = NULL;
+               cpufreq_unregister_notifier(&dhd->freq_trans, CPUFREQ_TRANSITION_NOTIFIER);
+#endif
+       DHD_TRACE(("wd wakelock count:%d\n", dhd->wakelock_wd_counter));
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd->wakelock_wd_counter = 0;
+       wake_lock_destroy(&dhd->wl_wdwake);
+       // terence 20161023: can not destroy wl_wifi when wlan down, it will happen null pointer in dhd_ioctl_entry
+       wake_lock_destroy(&dhd->wl_wifi);
+#endif /* CONFIG_HAS_WAKELOCK */
+       if (dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT) {
+               DHD_OS_WAKE_LOCK_DESTROY(dhd);
+       }
+
+#ifdef DHDTCPACK_SUPPRESS
+       /* This will free all MEM allocated for TCPACK SUPPRESS */
+       dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_OFF);
+#endif /* DHDTCPACK_SUPPRESS */
+
+#ifdef PCIE_FULL_DONGLE
+       dhd_flow_rings_deinit(dhdp);
+       if (dhdp->prot)
+               dhd_prot_detach(dhdp);
+#endif
+
+#if defined(WLTDLS) && defined(PCIE_FULL_DONGLE)
+               dhd_free_tdls_peer_list(dhdp);
+#endif
+
+#ifdef DUMP_IOCTL_IOV_LIST
+       dhd_iov_li_delete(dhdp, &(dhdp->dump_iovlist_head));
+#endif /* DUMP_IOCTL_IOV_LIST */
+#ifdef DHD_DEBUG
+       /* memory waste feature list initilization */
+       dhd_mw_list_delete(dhdp, &(dhdp->mw_list_head));
+#endif /* DHD_DEBUG */
+#ifdef WL_MONITOR
+       dhd_del_monitor_if(dhd);
+#endif /* WL_MONITOR */
+
+#ifdef DHD_ERPOM
+       if (dhdp->enable_erpom) {
+               dhdp->pom_func_deregister(&dhdp->pom_wlan_handler);
+       }
+#endif /* DHD_ERPOM */
+
+       cancel_work_sync(&dhd->dhd_hang_process_work);
+
+       /* Prefer adding de-init code above this comment unless necessary.
+        * The idea is to cancel work queue, sysfs and flags at the end.
+        */
+       dhd_deferred_work_deinit(dhd->dhd_deferred_wq);
+       dhd->dhd_deferred_wq = NULL;
+
+       /* log dump related buffers should be freed after wq is purged */
+#ifdef DHD_LOG_DUMP
+       dhd_log_dump_deinit(&dhd->pub);
+#endif /* DHD_LOG_DUMP */
+#if defined(BCMPCIE)
+       if (dhdp->extended_trap_data)
+       {
+               MFREE(dhdp->osh, dhdp->extended_trap_data, BCMPCIE_EXT_TRAP_DATA_MAXLEN);
+               dhdp->extended_trap_data = NULL;
+       }
+#ifdef DNGL_AXI_ERROR_LOGGING
+       if (dhdp->axi_err_dump)
+       {
+               MFREE(dhdp->osh, dhdp->axi_err_dump, sizeof(dhd_axi_error_dump_t));
+               dhdp->axi_err_dump = NULL;
+       }
+#endif /* DNGL_AXI_ERROR_LOGGING */
+#endif /* BCMPCIE */
+
+#ifdef EWP_EDL
+       cancel_delayed_work_sync(&dhd->edl_dispatcher_work);
+#endif
+
+       (void)dhd_deinit_sock_flows_buf(dhd);
+
+#ifdef DHD_DUMP_MNGR
+       if (dhd->pub.dump_file_manage) {
+               MFREE(dhd->pub.osh, dhd->pub.dump_file_manage,
+                               sizeof(dhd_dump_file_manage_t));
+       }
+#endif /* DHD_DUMP_MNGR */
+
+       dhd_sysfs_exit(dhd);
+       dhd->pub.fw_download_status = FW_UNLOADED;
+
+#if defined(BT_OVER_SDIO)
+       mutex_destroy(&dhd->bus_user_lock);
+#endif /* BT_OVER_SDIO */
+
+#ifdef DHD_TX_PROFILE
+       (void)dhd_tx_profile_detach(dhdp);
+#endif /* defined(DHD_TX_PROFILE) */
+       dhd_conf_detach(dhdp);
+
+} /* dhd_detach */
+
+void
+dhd_free(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd;
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (dhdp) {
+               int i;
+               for (i = 0; i < ARRAYSIZE(dhdp->reorder_bufs); i++) {
+                       if (dhdp->reorder_bufs[i]) {
+                               reorder_info_t *ptr;
+                               uint32 buf_size = sizeof(struct reorder_info);
+
+                               ptr = dhdp->reorder_bufs[i];
+
+                               buf_size += ((ptr->max_idx + 1) * sizeof(void*));
+                               DHD_REORDER(("free flow id buf %d, maxidx is %d, buf_size %d\n",
+                                       i, ptr->max_idx, buf_size));
+
+                               MFREE(dhdp->osh, dhdp->reorder_bufs[i], buf_size);
+                       }
+               }
+
+               dhd_sta_pool_fini(dhdp, DHD_MAX_STA);
+
+               dhd = (dhd_info_t *)dhdp->info;
+               if (dhdp->soc_ram) {
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_MEMDUMP)
+                       DHD_OS_PREFREE(dhdp, dhdp->soc_ram, dhdp->soc_ram_length);
+#else
+                       MFREE(dhdp->osh, dhdp->soc_ram, dhdp->soc_ram_length);
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_MEMDUMP */
+               }
+               if (dhd != NULL) {
+
+                       /* If pointer is allocated by dhd_os_prealloc then avoid MFREE */
+                       if (dhd != (dhd_info_t *)dhd_os_prealloc(dhdp,
+                                       DHD_PREALLOC_DHD_INFO, 0, FALSE))
+                               MFREE(dhd->pub.osh, dhd, sizeof(*dhd));
+                       dhd = NULL;
+               }
+       }
+}
+
+void
+dhd_clear(dhd_pub_t *dhdp)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (dhdp) {
+               int i;
+#ifdef DHDTCPACK_SUPPRESS
+               /* Clean up timer/data structure for any remaining/pending packet or timer. */
+               dhd_tcpack_info_tbl_clean(dhdp);
+#endif /* DHDTCPACK_SUPPRESS */
+               for (i = 0; i < ARRAYSIZE(dhdp->reorder_bufs); i++) {
+                       if (dhdp->reorder_bufs[i]) {
+                               reorder_info_t *ptr;
+                               uint32 buf_size = sizeof(struct reorder_info);
+
+                               ptr = dhdp->reorder_bufs[i];
+
+                               buf_size += ((ptr->max_idx + 1) * sizeof(void*));
+                               DHD_REORDER(("free flow id buf %d, maxidx is %d, buf_size %d\n",
+                                       i, ptr->max_idx, buf_size));
+
+                               MFREE(dhdp->osh, dhdp->reorder_bufs[i], buf_size);
+                       }
+               }
+
+               dhd_sta_pool_clear(dhdp, DHD_MAX_STA);
+
+               if (dhdp->soc_ram) {
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_MEMDUMP)
+                       DHD_OS_PREFREE(dhdp, dhdp->soc_ram, dhdp->soc_ram_length);
+#else
+                       MFREE(dhdp->osh, dhdp->soc_ram, dhdp->soc_ram_length);
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_MEMDUMP */
+                       dhdp->soc_ram = NULL;
+               }
+       }
+}
+
+static void
+dhd_module_cleanup(void)
+{
+       printf("%s: Enter\n", __FUNCTION__);
+
+       dhd_bus_unregister();
+
+       wl_android_exit();
+
+       dhd_wifi_platform_unregister_drv();
+
+#ifdef CUSTOMER_HW_AMLOGIC
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+       wifi_teardown_dt();
+#endif
+#endif
+       printf("%s: Exit\n", __FUNCTION__);
+}
+
+static void __exit
+dhd_module_exit(void)
+{
+       atomic_set(&exit_in_progress, 1);
+       dhd_module_cleanup();
+       unregister_reboot_notifier(&dhd_reboot_notifier);
+       dhd_destroy_to_notifier_skt();
+}
+
+static int
+_dhd_module_init(void)
+{
+       int err;
+       int retry = POWERUP_MAX_RETRY;
+
+       printf("%s: in %s\n", __FUNCTION__, dhd_version);
+#ifdef CUSTOMER_HW_AMLOGIC
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+       if (wifi_setup_dt()) {
+               printf("wifi_dt : fail to setup dt\n");
+       }
+#endif
+#endif
+
+       if (firmware_path[0] != '\0') {
+               strlcpy(fw_bak_path, firmware_path, sizeof(fw_bak_path));
+       }
+
+       if (nvram_path[0] != '\0') {
+               strlcpy(nv_bak_path, nvram_path, sizeof(nv_bak_path));
+       }
+
+       do {
+               err = dhd_wifi_platform_register_drv();
+               if (!err) {
+                       register_reboot_notifier(&dhd_reboot_notifier);
+                       break;
+               } else {
+                       DHD_ERROR(("%s: Failed to load the driver, try cnt %d\n",
+                               __FUNCTION__, retry));
+                       strlcpy(firmware_path, fw_bak_path, sizeof(firmware_path));
+                       strlcpy(nvram_path, nv_bak_path, sizeof(nvram_path));
+               }
+       } while (retry--);
+
+       dhd_create_to_notifier_skt();
+
+       if (err) {
+#ifdef CUSTOMER_HW_AMLOGIC
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+               wifi_teardown_dt();
+#endif
+#endif
+               DHD_ERROR(("%s: Failed to load driver max retry reached**\n", __FUNCTION__));
+       } else {
+               if (!dhd_download_fw_on_driverload) {
+                       dhd_driver_init_done = TRUE;
+               }
+       }
+
+       printf("%s: Exit err=%d\n", __FUNCTION__, err);
+       return err;
+}
+
+static int __init
+dhd_module_init(void)
+{
+       int err;
+
+       err = _dhd_module_init();
+#ifdef DHD_SUPPORT_HDM
+       if (err && !dhd_download_fw_on_driverload) {
+               dhd_hdm_wlan_sysfs_init();
+       }
+#endif /* DHD_SUPPORT_HDM */
+       return err;
+
+}
+
+#ifdef DHD_SUPPORT_HDM
+bool hdm_trigger_init = FALSE;
+struct delayed_work hdm_sysfs_wq;
+
+int
+dhd_module_init_hdm(void)
+{
+       int err = 0;
+
+       hdm_trigger_init = TRUE;
+
+       if (dhd_driver_init_done) {
+               DHD_INFO(("%s : Module is already inited\n", __FUNCTION__));
+               return err;
+       }
+
+       err = _dhd_module_init();
+
+       /* remove sysfs file after module load properly */
+       if (!err && !dhd_download_fw_on_driverload) {
+               INIT_DELAYED_WORK(&hdm_sysfs_wq, dhd_hdm_wlan_sysfs_deinit);
+               schedule_delayed_work(&hdm_sysfs_wq, msecs_to_jiffies(SYSFS_DEINIT_MS));
+       }
+
+       hdm_trigger_init = FALSE;
+       return err;
+}
+#endif /* DHD_SUPPORT_HDM */
+
+static int
+dhd_reboot_callback(struct notifier_block *this, unsigned long code, void *unused)
+{
+       DHD_TRACE(("%s: code = %ld\n", __FUNCTION__, code));
+       if (code == SYS_RESTART) {
+#ifdef BCMPCIE
+               is_reboot = code;
+#endif /* BCMPCIE */
+       }
+       return NOTIFY_DONE;
+}
+
+#if defined(CONFIG_DEFERRED_INITCALLS) && !defined(EXYNOS_PCIE_MODULE_PATCH)
+/* XXX To decrease the device boot time, deferred_module_init() macro can be
+ * used. The detailed principle and implemenation of deferred_module_init()
+ * is found at http://elinux.org/Deferred_Initcalls
+ * To enable this feature for module build, it needs to add another
+ * deferred_module_init() definition to include/linux/init.h in Linux Kernel.
+ * #define deferred_module_init(fn)    module_init(fn)
+ */
+#if defined(CONFIG_ARCH_MSM) || defined(CONFIG_ARCH_EXYNOS)
+deferred_module_init_sync(dhd_module_init);
+#else
+deferred_module_init(dhd_module_init);
+#endif /* CONFIG_ARCH_MSM || CONFIG_ARCH_EXYNOS */
+#elif defined(USE_LATE_INITCALL_SYNC)
+late_initcall_sync(dhd_module_init);
+#else
+late_initcall(dhd_module_init);
+#endif /* USE_LATE_INITCALL_SYNC */
+
+module_exit(dhd_module_exit);
+
+/*
+ * OS specific functions required to implement DHD driver in OS independent way
+ */
+int
+dhd_os_proto_block(dhd_pub_t *pub)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               down(&dhd->proto_sem);
+
+               return 1;
+       }
+
+       return 0;
+}
+
+int
+dhd_os_proto_unblock(dhd_pub_t *pub)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               up(&dhd->proto_sem);
+               return 1;
+       }
+
+       return 0;
+}
+
+void
+dhd_os_dhdiovar_lock(dhd_pub_t *pub)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               mutex_lock(&dhd->dhd_iovar_mutex);
+       }
+}
+
+void
+dhd_os_dhdiovar_unlock(dhd_pub_t *pub)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               mutex_unlock(&dhd->dhd_iovar_mutex);
+       }
+}
+
+void
+dhd_os_logdump_lock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = NULL;
+
+       if (!pub)
+               return;
+
+       dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               mutex_lock(&dhd->logdump_lock);
+       }
+}
+
+void
+dhd_os_logdump_unlock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = NULL;
+
+       if (!pub)
+               return;
+
+       dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               mutex_unlock(&dhd->logdump_lock);
+       }
+}
+
+unsigned long
+dhd_os_dbgring_lock(void *lock)
+{
+       if (!lock)
+               return 0;
+
+       mutex_lock((struct mutex *)lock);
+
+       return 0;
+}
+
+void
+dhd_os_dbgring_unlock(void *lock, unsigned long flags)
+{
+       BCM_REFERENCE(flags);
+
+       if (!lock)
+               return;
+
+       mutex_unlock((struct mutex *)lock);
+}
+
+unsigned int
+dhd_os_get_ioctl_resp_timeout(void)
+{
+       return ((unsigned int)dhd_ioctl_timeout_msec);
+}
+
+void
+dhd_os_set_ioctl_resp_timeout(unsigned int timeout_msec)
+{
+       dhd_ioctl_timeout_msec = (int)timeout_msec;
+}
+
+int
+dhd_os_ioctl_resp_wait(dhd_pub_t *pub, uint *condition)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+       int timeout;
+
+       /* Convert timeout in millsecond to jiffies */
+       timeout = msecs_to_jiffies(dhd_ioctl_timeout_msec);
+
+       timeout = wait_event_timeout(dhd->ioctl_resp_wait, (*condition), timeout);
+
+       return timeout;
+}
+
+int
+dhd_os_ioctl_resp_wake(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       wake_up(&dhd->ioctl_resp_wait);
+       return 0;
+}
+
+int
+dhd_os_d3ack_wait(dhd_pub_t *pub, uint *condition)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+       int timeout;
+
+       /* Convert timeout in millsecond to jiffies */
+       timeout = msecs_to_jiffies(D3_ACK_RESP_TIMEOUT);
+
+       timeout = wait_event_timeout(dhd->d3ack_wait, (*condition), timeout);
+
+       return timeout;
+}
+
+#ifdef PCIE_INB_DW
+int
+dhd_os_ds_exit_wait(dhd_pub_t *pub, uint *condition)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+       int timeout;
+
+       /* Convert timeout in millsecond to jiffies */
+       timeout = msecs_to_jiffies(ds_exit_timeout_msec);
+
+       timeout = wait_event_timeout(dhd->ds_exit_wait, (*condition), timeout);
+
+       return timeout;
+}
+
+int
+dhd_os_ds_exit_wake(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       wake_up_all(&dhd->ds_exit_wait);
+       return 0;
+}
+
+#endif /* PCIE_INB_DW */
+
+int
+dhd_os_d3ack_wake(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       wake_up(&dhd->d3ack_wait);
+       return 0;
+}
+
+int
+dhd_os_busbusy_wait_negation(dhd_pub_t *pub, uint *condition)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+       int timeout;
+
+       /* Wait for bus usage contexts to gracefully exit within some timeout value
+        * Set time out to little higher than dhd_ioctl_timeout_msec,
+        * so that IOCTL timeout should not get affected.
+        */
+       /* Convert timeout in millsecond to jiffies */
+       timeout = msecs_to_jiffies(DHD_BUS_BUSY_TIMEOUT);
+
+       timeout = wait_event_timeout(dhd->dhd_bus_busy_state_wait, !(*condition), timeout);
+
+       return timeout;
+}
+
+/*
+ * Wait until the condition *var == condition is met.
+ * Returns 0 if the @condition evaluated to false after the timeout elapsed
+ * Returns 1 if the @condition evaluated to true
+ */
+int
+dhd_os_busbusy_wait_condition(dhd_pub_t *pub, uint *var, uint condition)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+       int timeout;
+
+       /* Convert timeout in millsecond to jiffies */
+       timeout = msecs_to_jiffies(DHD_BUS_BUSY_TIMEOUT);
+
+       timeout = wait_event_timeout(dhd->dhd_bus_busy_state_wait, (*var == condition), timeout);
+
+       return timeout;
+}
+
+/*
+ * Wait until the '(*var & bitmask) == condition' is met.
+ * Returns 0 if the @condition evaluated to false after the timeout elapsed
+ * Returns 1 if the @condition evaluated to true
+ */
+int
+dhd_os_busbusy_wait_bitmask(dhd_pub_t *pub, uint *var,
+               uint bitmask, uint condition)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+       int timeout;
+
+       /* Convert timeout in millsecond to jiffies */
+       timeout = msecs_to_jiffies(DHD_BUS_BUSY_TIMEOUT);
+
+       timeout = wait_event_timeout(dhd->dhd_bus_busy_state_wait,
+                       ((*var & bitmask) == condition), timeout);
+
+       return timeout;
+}
+
+int
+dhd_os_dmaxfer_wait(dhd_pub_t *pub, uint *condition)
+{
+       int ret = 0;
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+       int timeout;
+
+       timeout = msecs_to_jiffies(IOCTL_DMAXFER_TIMEOUT);
+
+       ret = wait_event_timeout(dhd->dmaxfer_wait, (*condition), timeout);
+
+       return ret;
+
+}
+
+int
+dhd_os_dmaxfer_wake(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       wake_up(&dhd->dmaxfer_wait);
+       return 0;
+}
+
+void
+dhd_os_tx_completion_wake(dhd_pub_t *dhd)
+{
+       /* Call wmb() to make sure before waking up the other event value gets updated */
+       OSL_SMP_WMB();
+       wake_up(&dhd->tx_completion_wait);
+}
+
+/* Fix compilation error for FC11 */
+INLINE int
+dhd_os_busbusy_wake(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       /* Call wmb() to make sure before waking up the other event value gets updated */
+       OSL_SMP_WMB();
+       wake_up(&dhd->dhd_bus_busy_state_wait);
+       return 0;
+}
+
+void
+dhd_os_wd_timer_extend(void *bus, bool extend)
+{
+#ifndef BCMDBUS
+       dhd_pub_t *pub = bus;
+       dhd_info_t *dhd = (dhd_info_t *)pub->info;
+
+       if (extend)
+               dhd_os_wd_timer(bus, WATCHDOG_EXTEND_INTERVAL);
+       else
+               dhd_os_wd_timer(bus, dhd->default_wd_interval);
+#endif /* !BCMDBUS */
+}
+
+void
+dhd_os_wd_timer(void *bus, uint wdtick)
+{
+#ifndef BCMDBUS
+       dhd_pub_t *pub = bus;
+       dhd_info_t *dhd = (dhd_info_t *)pub->info;
+       unsigned long flags;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd NULL\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_GENERAL_LOCK(pub, flags);
+
+       /* don't start the wd until fw is loaded */
+       if (pub->busstate == DHD_BUS_DOWN) {
+               DHD_GENERAL_UNLOCK(pub, flags);
+#ifdef BCMSDIO
+               if (!wdtick) {
+                       DHD_OS_WD_WAKE_UNLOCK(pub);
+               }
+#endif /* BCMSDIO */
+               return;
+       }
+
+       /* Totally stop the timer */
+       if (!wdtick && dhd->wd_timer_valid == TRUE) {
+               dhd->wd_timer_valid = FALSE;
+               DHD_GENERAL_UNLOCK(pub, flags);
+               del_timer_sync(&dhd->timer);
+#ifdef BCMSDIO
+               DHD_OS_WD_WAKE_UNLOCK(pub);
+#endif /* BCMSDIO */
+               return;
+       }
+
+        if (wdtick) {
+#ifdef BCMSDIO
+               DHD_OS_WD_WAKE_LOCK(pub);
+               dhd_watchdog_ms = (uint)wdtick;
+#endif /* BCMSDIO */
+               /* Re arm the timer, at last watchdog period */
+               mod_timer(&dhd->timer, jiffies + msecs_to_jiffies(dhd_watchdog_ms));
+               dhd->wd_timer_valid = TRUE;
+       }
+       DHD_GENERAL_UNLOCK(pub, flags);
+#endif /* !BCMDBUS */
+}
+
+#ifdef DHD_PCIE_RUNTIMEPM
+void
+dhd_os_runtimepm_timer(void *bus, uint tick)
+{
+       dhd_pub_t *pub = bus;
+       dhd_info_t *dhd = (dhd_info_t *)pub->info;
+       unsigned long flags;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_GENERAL_LOCK(pub, flags);
+
+       /* don't start the RPM until fw is loaded */
+       if (DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(pub)) {
+               DHD_GENERAL_UNLOCK(pub, flags);
+               return;
+       }
+
+       /* If tick is non-zero, the request is to start the timer */
+       if (tick) {
+               /* Start the timer only if its not already running */
+               if (dhd->rpm_timer_valid == FALSE) {
+                       mod_timer(&dhd->rpm_timer, jiffies + msecs_to_jiffies(dhd_runtimepm_ms));
+                       dhd->rpm_timer_valid = TRUE;
+                       DHD_ERROR(("DHD Runtime PM Timer ON\n"));
+               }
+       } else {
+               /* tick is zero, we have to stop the timer */
+               /* Stop the timer only if its running, otherwise we don't have to do anything */
+               if (dhd->rpm_timer_valid == TRUE) {
+                       dhd->rpm_timer_valid = FALSE;
+                       DHD_GENERAL_UNLOCK(pub, flags);
+                       del_timer_sync(&dhd->rpm_timer);
+                       DHD_ERROR(("DHD Runtime PM Timer OFF \n"));
+                       /* we have already released the lock, so just go to exit */
+                       goto exit;
+               }
+       }
+
+       DHD_GENERAL_UNLOCK(pub, flags);
+exit:
+       return;
+
+}
+
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+void *
+dhd_os_open_image1(dhd_pub_t *pub, char *filename)
+{
+       struct file *fp;
+       int size;
+
+       fp = filp_open(filename, O_RDONLY, 0);
+       /*
+        * 2.6.11 (FC4) supports filp_open() but later revs don't?
+        * Alternative:
+        * fp = open_namei(AT_FDCWD, filename, O_RD, 0);
+        * ???
+        */
+        if (IS_ERR(fp)) {
+                fp = NULL;
+                goto err;
+        }
+
+        if (!S_ISREG(file_inode(fp)->i_mode)) {
+                DHD_ERROR(("%s: %s is not regular file\n", __FUNCTION__, filename));
+                fp = NULL;
+                goto err;
+        }
+
+        size = i_size_read(file_inode(fp));
+        if (size <= 0) {
+                DHD_ERROR(("%s: %s file size invalid %d\n", __FUNCTION__, filename, size));
+                fp = NULL;
+                goto err;
+        }
+
+        DHD_ERROR(("%s: %s (%d bytes) open success\n", __FUNCTION__, filename, size));
+
+err:
+        return fp;
+}
+
+int
+dhd_os_get_image_block(char *buf, int len, void *image)
+{
+       struct file *fp = (struct file *)image;
+       int rdlen;
+       int size;
+
+       if (!image) {
+               return 0;
+       }
+
+       size = i_size_read(file_inode(fp));
+       rdlen = kernel_read_compat(fp, fp->f_pos, buf, MIN(len, size));
+
+       if (len >= size && size != rdlen) {
+               return -EIO;
+       }
+
+       if (rdlen > 0) {
+               fp->f_pos += rdlen;
+       }
+
+       return rdlen;
+}
+
+#if defined(BT_OVER_SDIO)
+int
+dhd_os_gets_image(dhd_pub_t *pub, char *str, int len, void *image)
+{
+       struct file *fp = (struct file *)image;
+       int rd_len;
+       uint str_len = 0;
+       char *str_end = NULL;
+
+       if (!image)
+               return 0;
+
+       rd_len = kernel_read_compat(fp, fp->f_pos, str, len);
+       str_end = strnchr(str, len, '\n');
+       if (str_end == NULL) {
+               goto err;
+       }
+       str_len = (uint)(str_end - str);
+
+       /* Advance file pointer past the string length */
+       fp->f_pos += str_len + 1;
+       bzero(str_end, rd_len - str_len);
+
+err:
+       return str_len;
+}
+#endif /* defined (BT_OVER_SDIO) */
+
+int
+dhd_os_get_image_size(void *image)
+{
+       struct file *fp = (struct file *)image;
+       int size;
+       if (!image) {
+               return 0;
+       }
+
+       size = i_size_read(file_inode(fp));
+
+       return size;
+}
+
+void
+dhd_os_close_image1(dhd_pub_t *pub, void *image)
+{
+       if (image) {
+               filp_close((struct file *)image, NULL);
+       }
+}
+
+void
+dhd_os_sdlock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd;
+
+       dhd = (dhd_info_t *)(pub->info);
+
+#ifdef BCMDBUS
+       spin_lock_bh(&dhd->sdlock);
+#else
+       if (dhd_dpc_prio >= 0)
+               down(&dhd->sdsem);
+       else
+               spin_lock_bh(&dhd->sdlock);
+#endif /* !BCMDBUS */
+}
+
+void
+dhd_os_sdunlock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd;
+
+       dhd = (dhd_info_t *)(pub->info);
+
+#ifdef BCMDBUS
+       spin_unlock_bh(&dhd->sdlock);
+#else
+       if (dhd_dpc_prio >= 0)
+               up(&dhd->sdsem);
+       else
+               spin_unlock_bh(&dhd->sdlock);
+#endif /* !BCMDBUS */
+}
+
+void
+dhd_os_sdlock_txq(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd;
+
+       dhd = (dhd_info_t *)(pub->info);
+#ifdef BCMDBUS
+       spin_lock_irqsave(&dhd->txqlock, dhd->txqlock_flags);
+#else
+       spin_lock_bh(&dhd->txqlock);
+#endif /* BCMDBUS */
+}
+
+void
+dhd_os_sdunlock_txq(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd;
+
+       dhd = (dhd_info_t *)(pub->info);
+#ifdef BCMDBUS
+       spin_unlock_irqrestore(&dhd->txqlock, dhd->txqlock_flags);
+#else
+       spin_unlock_bh(&dhd->txqlock);
+#endif /* BCMDBUS */
+}
+
+void
+dhd_os_sdlock_rxq(dhd_pub_t *pub)
+{
+}
+
+void
+dhd_os_sdunlock_rxq(dhd_pub_t *pub)
+{
+}
+
+static void
+dhd_os_rxflock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd;
+
+       dhd = (dhd_info_t *)(pub->info);
+       spin_lock_bh(&dhd->rxf_lock);
+
+}
+
+static void
+dhd_os_rxfunlock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd;
+
+       dhd = (dhd_info_t *)(pub->info);
+       spin_unlock_bh(&dhd->rxf_lock);
+}
+
+#ifdef DHDTCPACK_SUPPRESS
+unsigned long
+dhd_os_tcpacklock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd;
+       unsigned long flags = 0;
+
+       dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+#ifdef BCMSDIO
+               spin_lock_bh(&dhd->tcpack_lock);
+#else
+               flags = osl_spin_lock(&dhd->tcpack_lock);
+#endif /* BCMSDIO */
+       }
+
+       return flags;
+}
+
+void
+dhd_os_tcpackunlock(dhd_pub_t *pub, unsigned long flags)
+{
+       dhd_info_t *dhd;
+
+#ifdef BCMSDIO
+       BCM_REFERENCE(flags);
+#endif /* BCMSDIO */
+
+       dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+#ifdef BCMSDIO
+               spin_unlock_bh(&dhd->tcpack_lock);
+#else
+               osl_spin_unlock(&dhd->tcpack_lock, flags);
+#endif /* BCMSDIO */
+       }
+}
+#endif /* DHDTCPACK_SUPPRESS */
+
+uint8* dhd_os_prealloc(dhd_pub_t *dhdpub, int section, uint size, bool kmalloc_if_fail)
+{
+       uint8* buf;
+       gfp_t flags = CAN_SLEEP() ? GFP_KERNEL: GFP_ATOMIC;
+
+       buf = (uint8*)wifi_platform_prealloc(dhdpub->info->adapter, section, size);
+       if (buf == NULL && kmalloc_if_fail)
+               buf = kmalloc(size, flags);
+
+       return buf;
+}
+
+void dhd_os_prefree(dhd_pub_t *dhdpub, void *addr, uint size)
+{
+}
+
+#if defined(WL_WIRELESS_EXT)
+struct iw_statistics *
+dhd_get_wireless_stats(struct net_device *dev)
+{
+       int res = 0;
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (!dhd->pub.up) {
+               return NULL;
+       }
+
+       if (!(dev->flags & IFF_UP)) {
+               return NULL;
+       }
+
+       res = wl_iw_get_wireless_stats(dev, &dhd->iw.wstats);
+
+       if (res == 0)
+               return &dhd->iw.wstats;
+       else
+               return NULL;
+}
+#endif /* defined(WL_WIRELESS_EXT) */
+
+static int
+dhd_wl_host_event(dhd_info_t *dhd, int ifidx, void *pktdata, uint16 pktlen,
+       wl_event_msg_t *event, void **data)
+{
+       int bcmerror = 0;
+#ifdef WL_CFG80211
+       unsigned long flags = 0;
+#endif /* WL_CFG80211 */
+       ASSERT(dhd != NULL);
+
+#ifdef SHOW_LOGTRACE
+       bcmerror = wl_process_host_event(&dhd->pub, &ifidx, pktdata, pktlen, event, data,
+               &dhd->event_data);
+#else
+       bcmerror = wl_process_host_event(&dhd->pub, &ifidx, pktdata, pktlen, event, data,
+               NULL);
+#endif /* SHOW_LOGTRACE */
+       if (unlikely(bcmerror != BCME_OK)) {
+               return bcmerror;
+       }
+
+       if (ntoh32(event->event_type) == WLC_E_IF) {
+               /* WLC_E_IF event types are consumed by wl_process_host_event.
+                * For ifadd/del ops, the netdev ptr may not be valid at this
+                * point. so return before invoking cfg80211/wext handlers.
+                */
+               return BCME_OK;
+       }
+
+#if defined(WL_EXT_IAPSTA) || defined(USE_IW)
+       wl_ext_event_send(dhd->pub.event_params, event, *data);
+#endif
+
+#ifdef WL_CFG80211
+       if (dhd->iflist[ifidx]->net) {
+               DHD_UP_LOCK(&dhd->pub.up_lock, flags);
+               if (dhd->pub.up) {
+                       wl_cfg80211_event(dhd->iflist[ifidx]->net, event, *data);
+               }
+               DHD_UP_UNLOCK(&dhd->pub.up_lock, flags);
+       }
+#endif /* defined(WL_CFG80211) */
+
+       return (bcmerror);
+}
+
+/* send up locally generated event */
+void
+dhd_sendup_event(dhd_pub_t *dhdp, wl_event_msg_t *event, void *data)
+{
+       switch (ntoh32(event->event_type)) {
+       /* Handle error case or further events here */
+       default:
+               break;
+       }
+}
+
+#ifdef LOG_INTO_TCPDUMP
+void
+dhd_sendup_log(dhd_pub_t *dhdp, void *data, int data_len)
+{
+       struct sk_buff *p, *skb;
+       uint32 pktlen;
+       int len;
+       dhd_if_t *ifp;
+       dhd_info_t *dhd;
+       uchar *skb_data;
+       int ifidx = 0;
+       struct ether_header eth;
+
+       pktlen = sizeof(eth) + data_len;
+       dhd = dhdp->info;
+
+       if ((p = PKTGET(dhdp->osh, pktlen, FALSE))) {
+               ASSERT(ISALIGNED((uintptr)PKTDATA(dhdp->osh, p), sizeof(uint32)));
+
+               bcopy(&dhdp->mac, &eth.ether_dhost, ETHER_ADDR_LEN);
+               bcopy(&dhdp->mac, &eth.ether_shost, ETHER_ADDR_LEN);
+               ETHER_TOGGLE_LOCALADDR(&eth.ether_shost);
+               eth.ether_type = hton16(ETHER_TYPE_BRCM);
+
+               bcopy((void *)&eth, PKTDATA(dhdp->osh, p), sizeof(eth));
+               bcopy(data, PKTDATA(dhdp->osh, p) + sizeof(eth), data_len);
+               skb = PKTTONATIVE(dhdp->osh, p);
+               skb_data = skb->data;
+               len = skb->len;
+
+               ifidx = dhd_ifname2idx(dhd, "wlan0");
+               ifp = dhd->iflist[ifidx];
+               if (ifp == NULL)
+                        ifp = dhd->iflist[0];
+
+               ASSERT(ifp);
+               skb->dev = ifp->net;
+               skb->protocol = eth_type_trans(skb, skb->dev);
+               skb->data = skb_data;
+               skb->len = len;
+
+               /* Strip header, count, deliver upward */
+               skb_pull(skb, ETH_HLEN);
+
+               bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE,
+                       __FUNCTION__, __LINE__);
+               /* Send the packet */
+               if (in_interrupt()) {
+                       netif_rx(skb);
+               } else {
+                       netif_rx_ni(skb);
+               }
+       } else {
+               /* Could not allocate a sk_buf */
+               DHD_ERROR(("%s: unable to alloc sk_buf\n", __FUNCTION__));
+       }
+}
+#endif /* LOG_INTO_TCPDUMP */
+
+void dhd_wait_for_event(dhd_pub_t *dhd, bool *lockvar)
+{
+#if defined(BCMSDIO)
+       struct dhd_info *dhdinfo =  dhd->info;
+
+       int timeout = msecs_to_jiffies(IOCTL_RESP_TIMEOUT);
+
+       dhd_os_sdunlock(dhd);
+       wait_event_timeout(dhdinfo->ctrl_wait, (*lockvar == FALSE), timeout);
+       dhd_os_sdlock(dhd);
+#endif /* defined(BCMSDIO) */
+       return;
+} /* dhd_init_static_strs_array */
+
+void dhd_wait_event_wakeup(dhd_pub_t *dhd)
+{
+#if defined(BCMSDIO)
+       struct dhd_info *dhdinfo =  dhd->info;
+       if (waitqueue_active(&dhdinfo->ctrl_wait))
+               wake_up(&dhdinfo->ctrl_wait);
+#endif
+       return;
+}
+
+#if defined(BCMSDIO) || defined(BCMPCIE) || defined(BCMDBUS)
+int
+dhd_net_bus_devreset(struct net_device *dev, uint8 flag)
+{
+       int ret;
+
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       if (pm_runtime_get_sync(dhd_bus_to_dev(dhd->pub.bus)) < 0)
+               return BCME_ERROR;
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+       if (flag == TRUE) {
+#ifndef WL_CFG80211
+               /* Issue wl down command for non-cfg before resetting the chip */
+               if (dhd_wl_ioctl_cmd(&dhd->pub, WLC_DOWN, NULL, 0, TRUE, 0) < 0) {
+                       DHD_TRACE(("%s: wl down failed\n", __FUNCTION__));
+               }
+#endif /* !WL_CFG80211 */
+#ifdef PROP_TXSTATUS
+               if (dhd->pub.wlfc_enabled) {
+                       dhd_wlfc_deinit(&dhd->pub);
+               }
+#endif /* PROP_TXSTATUS */
+#ifdef PNO_SUPPORT
+               if (dhd->pub.pno_state) {
+                       dhd_pno_deinit(&dhd->pub);
+               }
+#endif
+#ifdef RTT_SUPPORT
+               if (dhd->pub.rtt_state) {
+                       dhd_rtt_deinit(&dhd->pub);
+               }
+#endif /* RTT_SUPPORT */
+
+/*
+ * XXX Detach only if the module is not attached by default at dhd_attach.
+ * If attached by default, we need to keep it till dhd_detach, so that
+ * module is not detached at wifi on/off
+ */
+#if defined(DBG_PKT_MON) && !defined(DBG_PKT_MON_INIT_DEFAULT)
+               dhd_os_dbg_detach_pkt_monitor(&dhd->pub);
+#endif /* DBG_PKT_MON */
+       }
+
+#ifdef BCMSDIO
+       /* XXX Some DHD modules (e.g. cfg80211) configures operation mode based on firmware name.
+        * This is indeed a hack but we have to make it work properly before we have a better
+        * solution
+        */
+       if (!flag) {
+               dhd_update_fw_nv_path(dhd);
+               /* update firmware and nvram path to sdio bus */
+               dhd_bus_update_fw_nv_path(dhd->pub.bus,
+                       dhd->fw_path, dhd->nv_path, dhd->clm_path, dhd->conf_path);
+       }
+#endif /* BCMSDIO */
+#if defined(CONFIG_ARCH_EXYNOS) && defined(BCMPCIE)
+#if !defined(CONFIG_SOC_EXYNOS8890) && !defined(SUPPORT_EXYNOS7420)
+       /* XXX: JIRA SWWLAN-139454: Added L1ss enable
+        * after firmware download completion due to link down issue
+        * JIRA SWWLAN-142236: Amendment - Changed L1ss enable point
+        */
+       printk(KERN_ERR "%s Disable L1ss EP side\n", __FUNCTION__);
+       if (flag == FALSE && dhd->pub.busstate == DHD_BUS_DOWN)
+               exynos_pcie_l1ss_ctrl(0, PCIE_L1SS_CTRL_WIFI);
+#endif /* !CONFIG_SOC_EXYNOS8890 && !defined(SUPPORT_EXYNOS7420)  */
+#endif /* CONFIG_ARCH_EXYNOS && BCMPCIE */
+
+       ret = dhd_bus_devreset(&dhd->pub, flag);
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       pm_runtime_mark_last_busy(dhd_bus_to_dev(dhd->pub.bus));
+       pm_runtime_put_autosuspend(dhd_bus_to_dev(dhd->pub.bus));
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+       if (flag) {
+               /* Clear some flags for recovery logic */
+               dhd->pub.dongle_trap_occured = 0;
+               dhd->pub.iovar_timeout_occured = 0;
+#ifdef PCIE_FULL_DONGLE
+               dhd->pub.d3ack_timeout_occured = 0;
+               dhd->pub.livelock_occured = 0;
+               dhd->pub.pktid_audit_failed = 0;
+#endif /* PCIE_FULL_DONGLE */
+               dhd->pub.smmu_fault_occurred = 0;
+               dhd->pub.iface_op_failed = 0;
+               dhd->pub.scan_timeout_occurred = 0;
+               dhd->pub.scan_busy_occurred = 0;
+       }
+
+       if (ret) {
+               DHD_ERROR(("%s: dhd_bus_devreset: %d\n", __FUNCTION__, ret));
+       }
+
+       return ret;
+}
+
+int
+dhd_net_bus_suspend(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return dhd_bus_suspend(&dhd->pub);
+}
+
+int
+dhd_net_bus_resume(struct net_device *dev, uint8 stage)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return dhd_bus_resume(&dhd->pub, stage);
+}
+
+#endif /* BCMSDIO || BCMPCIE || BCMDBUS */
+
+int net_os_set_suspend_disable(struct net_device *dev, int val)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+
+       if (dhd) {
+               ret = dhd->pub.suspend_disable_flag;
+               dhd->pub.suspend_disable_flag = val;
+       }
+       return ret;
+}
+
+int net_os_set_suspend(struct net_device *dev, int val, int force)
+{
+       int ret = 0;
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (dhd && dhd->pub.conf->suspend_mode == EARLY_SUSPEND) {
+               if (!val)
+                       dhd_conf_set_suspend_resume(&dhd->pub, val);
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+               ret = dhd_set_suspend(val, &dhd->pub);
+#else
+               ret = dhd_suspend_resume_helper(dhd, val, force);
+#endif
+#ifdef WL_CFG80211
+               wl_cfg80211_update_power_mode(dev);
+#endif
+               if (val)
+                       dhd_conf_set_suspend_resume(&dhd->pub, val);
+       }
+       return ret;
+}
+
+int net_os_set_suspend_bcn_li_dtim(struct net_device *dev, int val)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (dhd) {
+               DHD_ERROR(("%s: Set bcn_li_dtim in suspend %d\n",
+                       __FUNCTION__, val));
+               dhd->pub.suspend_bcn_li_dtim = val;
+       }
+
+       return 0;
+}
+
+int net_os_set_max_dtim_enable(struct net_device *dev, int val)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (dhd) {
+               DHD_ERROR(("%s: use MAX bcn_li_dtim in suspend %s\n",
+                       __FUNCTION__, (val ? "Enable" : "Disable")));
+               if (val) {
+                       dhd->pub.max_dtim_enable = TRUE;
+               } else {
+                       dhd->pub.max_dtim_enable = FALSE;
+               }
+       } else {
+               return -1;
+       }
+
+       return 0;
+}
+
+#ifdef DISABLE_DTIM_IN_SUSPEND
+int net_os_set_disable_dtim_in_suspend(struct net_device *dev, int val)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (dhd) {
+               DHD_ERROR(("%s: Disable bcn_li_dtim in suspend %s\n",
+                       __FUNCTION__, (val ? "Enable" : "Disable")));
+               if (val) {
+                       dhd->pub.disable_dtim_in_suspend = TRUE;
+               } else {
+                       dhd->pub.disable_dtim_in_suspend = FALSE;
+               }
+       } else {
+               return BCME_ERROR;
+       }
+
+       return BCME_OK;
+}
+#endif /* DISABLE_DTIM_IN_SUSPEND */
+
+#ifdef PKT_FILTER_SUPPORT
+int net_os_rxfilter_add_remove(struct net_device *dev, int add_remove, int num)
+{
+       int ret = 0;
+
+#ifndef GAN_LITE_NAT_KEEPALIVE_FILTER
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (!dhd_master_mode)
+               add_remove = !add_remove;
+       DHD_ERROR(("%s: add_remove = %d, num = %d\n", __FUNCTION__, add_remove, num));
+       if (!dhd || (num == DHD_UNICAST_FILTER_NUM)) {
+               return 0;
+       }
+
+#ifdef BLOCK_IPV6_PACKET
+       /* customer want to use NO IPV6 packets only */
+       if (num == DHD_MULTICAST6_FILTER_NUM) {
+               return 0;
+       }
+#endif /* BLOCK_IPV6_PACKET */
+
+       if (num >= dhd->pub.pktfilter_count) {
+               return -EINVAL;
+       }
+
+       ret = dhd_packet_filter_add_remove(&dhd->pub, add_remove, num);
+#endif /* !GAN_LITE_NAT_KEEPALIVE_FILTER */
+
+       return ret;
+}
+
+/* XXX RB:4238 Change net_os_set_packet_filter() function name to net_os_enable_packet_filter()
+ * previous code do 'set' & 'enable' in one fucntion.
+ * but from now on, we are going to separate 'set' and 'enable' feature.
+ *  - set : net_os_rxfilter_add_remove() -> dhd_set_packet_filter() -> dhd_pktfilter_offload_set()
+ *  - enable : net_os_enable_packet_filter() -> dhd_enable_packet_filter()
+ *                                                              -> dhd_pktfilter_offload_enable()
+ */
+int dhd_os_enable_packet_filter(dhd_pub_t *dhdp, int val)
+
+{
+       int ret = 0;
+
+       /* Packet filtering is set only if we still in early-suspend and
+        * we need either to turn it ON or turn it OFF
+        * We can always turn it OFF in case of early-suspend, but we turn it
+        * back ON only if suspend_disable_flag was not set
+       */
+       if (dhdp && dhdp->up) {
+               if (dhdp->in_suspend) {
+                       if (!val || (val && !dhdp->suspend_disable_flag))
+                               dhd_enable_packet_filter(val, dhdp);
+               }
+       }
+       return ret;
+}
+
+/* function to enable/disable packet for Network device */
+int net_os_enable_packet_filter(struct net_device *dev, int val)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       DHD_ERROR(("%s: val = %d\n", __FUNCTION__, val));
+       return dhd_os_enable_packet_filter(&dhd->pub, val);
+}
+#endif /* PKT_FILTER_SUPPORT */
+
+int
+dhd_dev_init_ioctl(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret;
+
+       if ((ret = dhd_sync_with_dongle(&dhd->pub)) < 0)
+               goto done;
+
+done:
+       return ret;
+}
+
+int
+dhd_dev_get_feature_set(struct net_device *dev)
+{
+       dhd_info_t *ptr = *(dhd_info_t **)netdev_priv(dev);
+       dhd_pub_t *dhd = (&ptr->pub);
+       int feature_set = 0;
+
+       if (FW_SUPPORTED(dhd, sta))
+               feature_set |= WIFI_FEATURE_INFRA;
+       if (FW_SUPPORTED(dhd, dualband))
+               feature_set |= WIFI_FEATURE_INFRA_5G;
+       if (FW_SUPPORTED(dhd, p2p))
+               feature_set |= WIFI_FEATURE_P2P;
+       if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE)
+               feature_set |= WIFI_FEATURE_SOFT_AP;
+       if (FW_SUPPORTED(dhd, tdls))
+               feature_set |= WIFI_FEATURE_TDLS;
+       if (FW_SUPPORTED(dhd, vsdb))
+               feature_set |= WIFI_FEATURE_TDLS_OFFCHANNEL;
+       if (FW_SUPPORTED(dhd, nan)) {
+               feature_set |= WIFI_FEATURE_NAN;
+               /* NAN is essentail for d2d rtt */
+               if (FW_SUPPORTED(dhd, rttd2d))
+                       feature_set |= WIFI_FEATURE_D2D_RTT;
+       }
+#ifdef RTT_SUPPORT
+       if (dhd->rtt_supported) {
+               feature_set |= WIFI_FEATURE_D2D_RTT;
+               feature_set |= WIFI_FEATURE_D2AP_RTT;
+       }
+#endif /* RTT_SUPPORT */
+#ifdef LINKSTAT_SUPPORT
+       feature_set |= WIFI_FEATURE_LINKSTAT;
+#endif /* LINKSTAT_SUPPORT */
+
+#if defined(PNO_SUPPORT) && !defined(DISABLE_ANDROID_PNO)
+       if (dhd_is_pno_supported(dhd)) {
+               feature_set |= WIFI_FEATURE_PNO;
+#ifdef BATCH_SCAN
+               /* Deprecated */
+               feature_set |= WIFI_FEATURE_BATCH_SCAN;
+#endif /* BATCH_SCAN */
+#ifdef GSCAN_SUPPORT
+               /* terence 20171115: remove to get GTS PASS
+                * com.google.android.gts.wifi.WifiHostTest#testWifiScannerBatchTimestamp
+                */
+//             feature_set |= WIFI_FEATURE_GSCAN;
+//             feature_set |= WIFI_FEATURE_HAL_EPNO;
+#endif /* GSCAN_SUPPORT */
+       }
+#endif /* PNO_SUPPORT && !DISABLE_ANDROID_PNO */
+#ifdef RSSI_MONITOR_SUPPORT
+       if (FW_SUPPORTED(dhd, rssi_mon)) {
+               feature_set |= WIFI_FEATURE_RSSI_MONITOR;
+       }
+#endif /* RSSI_MONITOR_SUPPORT */
+#ifdef WL11U
+       feature_set |= WIFI_FEATURE_HOTSPOT;
+#endif /* WL11U */
+#ifdef NDO_CONFIG_SUPPORT
+       feature_set |= WIFI_FEATURE_CONFIG_NDO;
+#endif /* NDO_CONFIG_SUPPORT */
+#ifdef SUPPORT_RANDOM_MAC_SCAN
+       feature_set |= WIFI_FEATURE_SCAN_RAND;
+#endif /* SUPPORT_RANDOM_MAC_SCAN */
+#ifdef FILTER_IE
+       if (FW_SUPPORTED(dhd, fie)) {
+               feature_set |= WIFI_FEATURE_FILTER_IE;
+       }
+#endif /* FILTER_IE */
+#ifdef ROAMEXP_SUPPORT
+        feature_set |= WIFI_FEATURE_CONTROL_ROAMING;
+#endif /* ROAMEXP_SUPPORT */
+#ifdef WL_P2P_RAND
+       feature_set |= WIFI_FEATURE_P2P_RAND_MAC;
+#endif /* WL_P2P_RAND */
+#ifdef WL_SAR_TX_POWER
+       feature_set |= WIFI_FEATURE_SET_TX_POWER_LIMIT;
+       feature_set |= WIFI_FEATURE_USE_BODY_HEAD_SAR;
+#endif /* WL_SAR_TX_POWER */
+#ifdef WL_STATIC_IF
+       feature_set |= WIFI_FEATURE_AP_STA;
+#endif /* WL_STATIC_IF */
+       return feature_set;
+}
+
+int
+dhd_dev_get_feature_set_matrix(struct net_device *dev, int num)
+{
+       int feature_set_full;
+       int ret = 0;
+
+       feature_set_full = dhd_dev_get_feature_set(dev);
+
+       /* Common feature set for all interface */
+       ret = (feature_set_full & WIFI_FEATURE_INFRA) |
+               (feature_set_full & WIFI_FEATURE_INFRA_5G) |
+               (feature_set_full & WIFI_FEATURE_D2D_RTT) |
+               (feature_set_full & WIFI_FEATURE_D2AP_RTT) |
+               (feature_set_full & WIFI_FEATURE_RSSI_MONITOR) |
+               (feature_set_full & WIFI_FEATURE_EPR);
+
+       /* Specific feature group for each interface */
+       switch (num) {
+       case 0:
+               ret |= (feature_set_full & WIFI_FEATURE_P2P) |
+                       /* Not supported yet */
+                       /* (feature_set_full & WIFI_FEATURE_NAN) | */
+                       (feature_set_full & WIFI_FEATURE_TDLS) |
+                       (feature_set_full & WIFI_FEATURE_PNO) |
+                       (feature_set_full & WIFI_FEATURE_HAL_EPNO) |
+                       (feature_set_full & WIFI_FEATURE_BATCH_SCAN) |
+                       (feature_set_full & WIFI_FEATURE_GSCAN) |
+                       (feature_set_full & WIFI_FEATURE_HOTSPOT) |
+                       (feature_set_full & WIFI_FEATURE_ADDITIONAL_STA);
+               break;
+
+       case 1:
+               ret |= (feature_set_full & WIFI_FEATURE_P2P);
+               /* Not yet verified NAN with P2P */
+               /* (feature_set_full & WIFI_FEATURE_NAN) | */
+               break;
+
+       case 2:
+               ret |= (feature_set_full & WIFI_FEATURE_NAN) |
+                       (feature_set_full & WIFI_FEATURE_TDLS) |
+                       (feature_set_full & WIFI_FEATURE_TDLS_OFFCHANNEL);
+               break;
+
+       default:
+               ret = WIFI_FEATURE_INVALID;
+               DHD_ERROR(("%s: Out of index(%d) for get feature set\n", __FUNCTION__, num));
+               break;
+       }
+
+       return ret;
+}
+
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+int
+dhd_dev_set_nodfs(struct net_device *dev, u32 nodfs)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (nodfs)
+               dhd->pub.dhd_cflags |= WLAN_PLAT_NODFS_FLAG;
+       else
+               dhd->pub.dhd_cflags &= ~WLAN_PLAT_NODFS_FLAG;
+       dhd->pub.force_country_change = TRUE;
+       return 0;
+}
+#endif /* CUSTOM_FORCE_NODFS_FLAG */
+
+#ifdef NDO_CONFIG_SUPPORT
+int
+dhd_dev_ndo_cfg(struct net_device *dev, u8 enable)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+       dhd_pub_t *dhdp = &dhd->pub;
+       int ret = 0;
+
+       if (enable) {
+               /* enable ND offload feature (will be enabled in FW on suspend) */
+               dhdp->ndo_enable = TRUE;
+
+               /* Update changes of anycast address & DAD failed address */
+               ret = dhd_dev_ndo_update_inet6addr(dev);
+               if ((ret < 0) && (ret != BCME_NORESOURCE)) {
+                       DHD_ERROR(("%s: failed to update host ip addr: %d\n", __FUNCTION__, ret));
+                       return ret;
+               }
+       } else {
+               /* disable ND offload feature */
+               dhdp->ndo_enable = FALSE;
+
+               /* disable ND offload in FW */
+               ret = dhd_ndo_enable(dhdp, FALSE);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: failed to disable NDO: %d\n", __FUNCTION__, ret));
+               }
+       }
+       return ret;
+}
+
+static int
+dhd_dev_ndo_get_valid_inet6addr_count(struct inet6_dev *inet6)
+{
+       struct inet6_ifaddr *ifa;
+       struct ifacaddr6 *acaddr = NULL;
+       int addr_count = 0;
+
+       /* lock */
+       read_lock_bh(&inet6->lock);
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       /* Count valid unicast address */
+       list_for_each_entry(ifa, &inet6->addr_list, if_list) {
+               GCC_DIAGNOSTIC_POP();
+               if ((ifa->flags & IFA_F_DADFAILED) == 0) {
+                       addr_count++;
+               }
+       }
+
+       /* Count anycast address */
+       acaddr = inet6->ac_list;
+       while (acaddr) {
+               addr_count++;
+               acaddr = acaddr->aca_next;
+       }
+
+       /* unlock */
+       read_unlock_bh(&inet6->lock);
+
+       return addr_count;
+}
+
+int
+dhd_dev_ndo_update_inet6addr(struct net_device *dev)
+{
+       dhd_info_t *dhd;
+       dhd_pub_t *dhdp;
+       struct inet6_dev *inet6;
+       struct inet6_ifaddr *ifa;
+       struct ifacaddr6 *acaddr = NULL;
+       struct in6_addr *ipv6_addr = NULL;
+       int cnt, i;
+       int ret = BCME_OK;
+
+       /*
+        * this function evaulates host ip address in struct inet6_dev
+        * unicast addr in inet6_dev->addr_list
+        * anycast addr in inet6_dev->ac_list
+        * while evaluating inet6_dev, read_lock_bh() is required to prevent
+        * access on null(freed) pointer.
+        */
+
+       if (dev) {
+               inet6 = dev->ip6_ptr;
+               if (!inet6) {
+                       DHD_ERROR(("%s: Invalid inet6_dev\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+
+               dhd = DHD_DEV_INFO(dev);
+               if (!dhd) {
+                       DHD_ERROR(("%s: Invalid dhd_info\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+               dhdp = &dhd->pub;
+
+               if (dhd_net2idx(dhd, dev) != 0) {
+                       DHD_ERROR(("%s: Not primary interface\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+       } else {
+               DHD_ERROR(("%s: Invalid net_device\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       /* Check host IP overflow */
+       cnt = dhd_dev_ndo_get_valid_inet6addr_count(inet6);
+       if (cnt > dhdp->ndo_max_host_ip) {
+               if (!dhdp->ndo_host_ip_overflow) {
+                       dhdp->ndo_host_ip_overflow = TRUE;
+                       /* Disable ND offload in FW */
+                       DHD_INFO(("%s: Host IP overflow, disable NDO\n", __FUNCTION__));
+                       ret = dhd_ndo_enable(dhdp, FALSE);
+               }
+
+               return ret;
+       }
+
+       /*
+        * Allocate ipv6 addr buffer to store addresses to be added/removed.
+        * driver need to lock inet6_dev while accessing structure. but, driver
+        * cannot use ioctl while inet6_dev locked since it requires scheduling
+        * hence, copy addresses to the buffer and do ioctl after unlock.
+        */
+       ipv6_addr = (struct in6_addr *)MALLOC(dhdp->osh,
+               sizeof(struct in6_addr) * dhdp->ndo_max_host_ip);
+       if (!ipv6_addr) {
+               DHD_ERROR(("%s: failed to alloc ipv6 addr buffer\n", __FUNCTION__));
+               return BCME_NOMEM;
+       }
+
+       /* Find DAD failed unicast address to be removed */
+       cnt = 0;
+       read_lock_bh(&inet6->lock);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_entry(ifa, &inet6->addr_list, if_list) {
+               GCC_DIAGNOSTIC_POP();
+               /* DAD failed unicast address */
+               if ((ifa->flags & IFA_F_DADFAILED) &&
+                       (cnt < dhdp->ndo_max_host_ip)) {
+                               memcpy(&ipv6_addr[cnt], &ifa->addr, sizeof(struct in6_addr));
+                               cnt++;
+               }
+       }
+       read_unlock_bh(&inet6->lock);
+
+       /* Remove DAD failed unicast address */
+       for (i = 0; i < cnt; i++) {
+               DHD_INFO(("%s: Remove DAD failed addr\n", __FUNCTION__));
+               ret = dhd_ndo_remove_ip_by_addr(dhdp, (char *)&ipv6_addr[i], 0);
+               if (ret < 0) {
+                       goto done;
+               }
+       }
+
+       /* Remove all anycast address */
+       ret = dhd_ndo_remove_ip_by_type(dhdp, WL_ND_IPV6_ADDR_TYPE_ANYCAST, 0);
+       if (ret < 0) {
+               goto done;
+       }
+
+       /*
+        * if ND offload was disabled due to host ip overflow,
+        * attempt to add valid unicast address.
+        */
+       if (dhdp->ndo_host_ip_overflow) {
+               /* Find valid unicast address */
+               cnt = 0;
+               read_lock_bh(&inet6->lock);
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               list_for_each_entry(ifa, &inet6->addr_list, if_list) {
+                       GCC_DIAGNOSTIC_POP();
+                       /* valid unicast address */
+                       if (!(ifa->flags & IFA_F_DADFAILED) &&
+                               (cnt < dhdp->ndo_max_host_ip)) {
+                                       memcpy(&ipv6_addr[cnt], &ifa->addr,
+                                               sizeof(struct in6_addr));
+                                       cnt++;
+                       }
+               }
+               read_unlock_bh(&inet6->lock);
+
+               /* Add valid unicast address */
+               for (i = 0; i < cnt; i++) {
+                       ret = dhd_ndo_add_ip_with_type(dhdp,
+                               (char *)&ipv6_addr[i], WL_ND_IPV6_ADDR_TYPE_UNICAST, 0);
+                       if (ret < 0) {
+                               goto done;
+                       }
+               }
+       }
+
+       /* Find anycast address */
+       cnt = 0;
+       read_lock_bh(&inet6->lock);
+       acaddr = inet6->ac_list;
+       while (acaddr) {
+               if (cnt < dhdp->ndo_max_host_ip) {
+                       memcpy(&ipv6_addr[cnt], &acaddr->aca_addr, sizeof(struct in6_addr));
+                       cnt++;
+               }
+               acaddr = acaddr->aca_next;
+       }
+       read_unlock_bh(&inet6->lock);
+
+       /* Add anycast address */
+       for (i = 0; i < cnt; i++) {
+               ret = dhd_ndo_add_ip_with_type(dhdp,
+                       (char *)&ipv6_addr[i], WL_ND_IPV6_ADDR_TYPE_ANYCAST, 0);
+               if (ret < 0) {
+                       goto done;
+               }
+       }
+
+       /* Now All host IP addr were added successfully */
+       if (dhdp->ndo_host_ip_overflow) {
+               dhdp->ndo_host_ip_overflow = FALSE;
+               if (dhdp->in_suspend) {
+                       /* drvier is in (early) suspend state, need to enable ND offload in FW */
+                       DHD_INFO(("%s: enable NDO\n", __FUNCTION__));
+                       ret = dhd_ndo_enable(dhdp, TRUE);
+               }
+       }
+
+done:
+       if (ipv6_addr) {
+               MFREE(dhdp->osh, ipv6_addr, sizeof(struct in6_addr) * dhdp->ndo_max_host_ip);
+       }
+
+       return ret;
+}
+
+#endif /* NDO_CONFIG_SUPPORT */
+
+#ifdef PNO_SUPPORT
+/* Linux wrapper to call common dhd_pno_stop_for_ssid */
+int
+dhd_dev_pno_stop_for_ssid(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       return (dhd_pno_stop_for_ssid(&dhd->pub));
+}
+
+/* Linux wrapper to call common dhd_pno_set_for_ssid */
+int
+dhd_dev_pno_set_for_ssid(struct net_device *dev, wlc_ssid_ext_t* ssids_local, int nssid,
+       uint16  scan_fr, int pno_repeat, int pno_freq_expo_max, uint16 *channel_list, int nchan)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       return (dhd_pno_set_for_ssid(&dhd->pub, ssids_local, nssid, scan_fr,
+               pno_repeat, pno_freq_expo_max, channel_list, nchan));
+}
+
+/* Linux wrapper to call common dhd_pno_enable */
+int
+dhd_dev_pno_enable(struct net_device *dev, int enable)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       return (dhd_pno_enable(&dhd->pub, enable));
+}
+
+/* Linux wrapper to call common dhd_pno_set_for_hotlist */
+int
+dhd_dev_pno_set_for_hotlist(struct net_device *dev, wl_pfn_bssid_t *p_pfn_bssid,
+       struct dhd_pno_hotlist_params *hotlist_params)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return (dhd_pno_set_for_hotlist(&dhd->pub, p_pfn_bssid, hotlist_params));
+}
+/* Linux wrapper to call common dhd_dev_pno_stop_for_batch */
+int
+dhd_dev_pno_stop_for_batch(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return (dhd_pno_stop_for_batch(&dhd->pub));
+}
+
+/* Linux wrapper to call common dhd_dev_pno_set_for_batch */
+int
+dhd_dev_pno_set_for_batch(struct net_device *dev, struct dhd_pno_batch_params *batch_params)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return (dhd_pno_set_for_batch(&dhd->pub, batch_params));
+}
+
+/* Linux wrapper to call common dhd_dev_pno_get_for_batch */
+int
+dhd_dev_pno_get_for_batch(struct net_device *dev, char *buf, int bufsize)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return (dhd_pno_get_for_batch(&dhd->pub, buf, bufsize, PNO_STATUS_NORMAL));
+}
+#endif /* PNO_SUPPORT */
+
+#if defined(PNO_SUPPORT)
+#ifdef GSCAN_SUPPORT
+bool
+dhd_dev_is_legacy_pno_enabled(struct net_device *dev)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_is_legacy_pno_enabled(&dhd->pub));
+}
+
+int
+dhd_dev_set_epno(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       if (!dhd) {
+               return BCME_ERROR;
+       }
+       return dhd_pno_set_epno(&dhd->pub);
+}
+int
+dhd_dev_flush_fw_epno(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       if (!dhd) {
+               return BCME_ERROR;
+       }
+       return dhd_pno_flush_fw_epno(&dhd->pub);
+}
+
+/* Linux wrapper to call common dhd_pno_set_cfg_gscan */
+int
+dhd_dev_pno_set_cfg_gscan(struct net_device *dev, dhd_pno_gscan_cmd_cfg_t type,
+ void *buf, bool flush)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_pno_set_cfg_gscan(&dhd->pub, type, buf, flush));
+}
+
+/* Linux wrapper to call common dhd_pno_get_gscan */
+void *
+dhd_dev_pno_get_gscan(struct net_device *dev, dhd_pno_gscan_cmd_cfg_t type,
+                      void *info, uint32 *len)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_pno_get_gscan(&dhd->pub, type, info, len));
+}
+
+/* Linux wrapper to call common dhd_wait_batch_results_complete */
+int
+dhd_dev_wait_batch_results_complete(struct net_device *dev)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_wait_batch_results_complete(&dhd->pub));
+}
+
+/* Linux wrapper to call common dhd_pno_lock_batch_results */
+int
+dhd_dev_pno_lock_access_batch_results(struct net_device *dev)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_pno_lock_batch_results(&dhd->pub));
+}
+/* Linux wrapper to call common dhd_pno_unlock_batch_results */
+void
+dhd_dev_pno_unlock_access_batch_results(struct net_device *dev)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_pno_unlock_batch_results(&dhd->pub));
+}
+
+/* Linux wrapper to call common dhd_pno_initiate_gscan_request */
+int
+dhd_dev_pno_run_gscan(struct net_device *dev, bool run, bool flush)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_pno_initiate_gscan_request(&dhd->pub, run, flush));
+}
+
+/* Linux wrapper to call common dhd_pno_enable_full_scan_result */
+int
+dhd_dev_pno_enable_full_scan_result(struct net_device *dev, bool real_time_flag)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_pno_enable_full_scan_result(&dhd->pub, real_time_flag));
+}
+
+/* Linux wrapper to call common dhd_handle_hotlist_scan_evt */
+void *
+dhd_dev_hotlist_scan_event(struct net_device *dev,
+      const void  *data, int *send_evt_bytes, hotlist_type_t type, u32 *buf_len)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_handle_hotlist_scan_evt(&dhd->pub, data, send_evt_bytes, type, buf_len));
+}
+
+/* Linux wrapper to call common dhd_process_full_gscan_result */
+void *
+dhd_dev_process_full_gscan_result(struct net_device *dev,
+const void  *data, uint32 len, int *send_evt_bytes)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_process_full_gscan_result(&dhd->pub, data, len, send_evt_bytes));
+}
+
+void
+dhd_dev_gscan_hotlist_cache_cleanup(struct net_device *dev, hotlist_type_t type)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       dhd_gscan_hotlist_cache_cleanup(&dhd->pub, type);
+
+       return;
+}
+
+int
+dhd_dev_gscan_batch_cache_cleanup(struct net_device *dev)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_gscan_batch_cache_cleanup(&dhd->pub));
+}
+
+/* Linux wrapper to call common dhd_retreive_batch_scan_results */
+int
+dhd_dev_retrieve_batch_scan(struct net_device *dev)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_retreive_batch_scan_results(&dhd->pub));
+}
+
+/* Linux wrapper to call common dhd_pno_process_epno_result */
+void * dhd_dev_process_epno_result(struct net_device *dev,
+       const void  *data, uint32 event, int *send_evt_bytes)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_pno_process_epno_result(&dhd->pub, data, event, send_evt_bytes));
+}
+
+int
+dhd_dev_set_lazy_roam_cfg(struct net_device *dev,
+             wlc_roam_exp_params_t *roam_param)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+       wl_roam_exp_cfg_t roam_exp_cfg;
+       int err;
+
+       if (!roam_param) {
+               return BCME_BADARG;
+       }
+
+       DHD_INFO(("a_band_boost_thr %d a_band_penalty_thr %d\n",
+             roam_param->a_band_boost_threshold, roam_param->a_band_penalty_threshold));
+       DHD_INFO(("a_band_boost_factor %d a_band_penalty_factor %d cur_bssid_boost %d\n",
+             roam_param->a_band_boost_factor, roam_param->a_band_penalty_factor,
+             roam_param->cur_bssid_boost));
+       DHD_INFO(("alert_roam_trigger_thr %d a_band_max_boost %d\n",
+             roam_param->alert_roam_trigger_threshold, roam_param->a_band_max_boost));
+
+       memcpy(&roam_exp_cfg.params, roam_param, sizeof(*roam_param));
+       roam_exp_cfg.version = ROAM_EXP_CFG_VERSION;
+       roam_exp_cfg.flags = ROAM_EXP_CFG_PRESENT;
+       if (dhd->pub.lazy_roam_enable) {
+               roam_exp_cfg.flags |= ROAM_EXP_ENABLE_FLAG;
+       }
+       err = dhd_iovar(&dhd->pub, 0, "roam_exp_params",
+                       (char *)&roam_exp_cfg, sizeof(roam_exp_cfg), NULL, 0,
+                       TRUE);
+       if (err < 0) {
+               DHD_ERROR(("%s : Failed to execute roam_exp_params %d\n", __FUNCTION__, err));
+       }
+       return err;
+}
+
+int
+dhd_dev_lazy_roam_enable(struct net_device *dev, uint32 enable)
+{
+       int err;
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+       wl_roam_exp_cfg_t roam_exp_cfg;
+
+       memset(&roam_exp_cfg, 0, sizeof(roam_exp_cfg));
+       roam_exp_cfg.version = ROAM_EXP_CFG_VERSION;
+       if (enable) {
+               roam_exp_cfg.flags = ROAM_EXP_ENABLE_FLAG;
+       }
+
+       err = dhd_iovar(&dhd->pub, 0, "roam_exp_params",
+                       (char *)&roam_exp_cfg, sizeof(roam_exp_cfg), NULL, 0,
+                       TRUE);
+       if (err < 0) {
+               DHD_ERROR(("%s : Failed to execute roam_exp_params %d\n", __FUNCTION__, err));
+       } else {
+               dhd->pub.lazy_roam_enable = (enable != 0);
+       }
+       return err;
+}
+
+int
+dhd_dev_set_lazy_roam_bssid_pref(struct net_device *dev,
+       wl_bssid_pref_cfg_t *bssid_pref, uint32 flush)
+{
+       int err;
+       uint len;
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       bssid_pref->version = BSSID_PREF_LIST_VERSION;
+       /* By default programming bssid pref flushes out old values */
+       bssid_pref->flags = (flush && !bssid_pref->count) ? ROAM_EXP_CLEAR_BSSID_PREF: 0;
+       len = sizeof(wl_bssid_pref_cfg_t);
+       if (bssid_pref->count) {
+               len += (bssid_pref->count - 1) * sizeof(wl_bssid_pref_list_t);
+       }
+       err = dhd_iovar(&dhd->pub, 0, "roam_exp_bssid_pref",
+                       (char *)bssid_pref, len, NULL, 0, TRUE);
+       if (err != BCME_OK) {
+               DHD_ERROR(("%s : Failed to execute roam_exp_bssid_pref %d\n", __FUNCTION__, err));
+       }
+       return err;
+}
+#endif /* GSCAN_SUPPORT */
+
+#if defined(GSCAN_SUPPORT) || defined(ROAMEXP_SUPPORT)
+int
+dhd_dev_set_blacklist_bssid(struct net_device *dev, maclist_t *blacklist,
+    uint32 len, uint32 flush)
+{
+       int err;
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+       int macmode;
+
+       if (blacklist) {
+               err = dhd_wl_ioctl_cmd(&(dhd->pub), WLC_SET_MACLIST, (char *)blacklist,
+                               len, TRUE, 0);
+               if (err != BCME_OK) {
+                       DHD_ERROR(("%s : WLC_SET_MACLIST failed %d\n", __FUNCTION__, err));
+                       return err;
+               }
+       }
+       /* By default programming blacklist flushes out old values */
+       macmode = (flush && !blacklist) ? WLC_MACMODE_DISABLED : WLC_MACMODE_DENY;
+       err = dhd_wl_ioctl_cmd(&(dhd->pub), WLC_SET_MACMODE, (char *)&macmode,
+                     sizeof(macmode), TRUE, 0);
+       if (err != BCME_OK) {
+               DHD_ERROR(("%s : WLC_SET_MACMODE failed %d\n", __FUNCTION__, err));
+       }
+       return err;
+}
+
+int
+dhd_dev_set_whitelist_ssid(struct net_device *dev, wl_ssid_whitelist_t *ssid_whitelist,
+    uint32 len, uint32 flush)
+{
+       int err;
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+       wl_ssid_whitelist_t whitelist_ssid_flush;
+
+       if (!ssid_whitelist) {
+               if (flush) {
+                       ssid_whitelist = &whitelist_ssid_flush;
+                       ssid_whitelist->ssid_count = 0;
+               } else {
+                       DHD_ERROR(("%s : Nothing to do here\n", __FUNCTION__));
+                       return BCME_BADARG;
+               }
+       }
+       ssid_whitelist->version = SSID_WHITELIST_VERSION;
+       ssid_whitelist->flags = flush ? ROAM_EXP_CLEAR_SSID_WHITELIST : 0;
+       err = dhd_iovar(&dhd->pub, 0, "roam_exp_ssid_whitelist", (char *)ssid_whitelist, len, NULL,
+                       0, TRUE);
+       if (err != BCME_OK) {
+               if (err == BCME_UNSUPPORTED) {
+                       DHD_ERROR(("%s : roam_exp_bssid_pref, UNSUPPORTED \n", __FUNCTION__));
+               } else {
+                       DHD_ERROR(("%s : Failed to execute roam_exp_bssid_pref %d\n",
+                               __FUNCTION__, err));
+               }
+       }
+       return err;
+}
+#endif /* GSCAN_SUPPORT || ROAMEXP_SUPPORT */
+#endif
+
+#ifdef RSSI_MONITOR_SUPPORT
+int
+dhd_dev_set_rssi_monitor_cfg(struct net_device *dev, int start,
+             int8 max_rssi, int8 min_rssi)
+{
+       int err;
+       wl_rssi_monitor_cfg_t rssi_monitor;
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       rssi_monitor.version = RSSI_MONITOR_VERSION;
+       rssi_monitor.max_rssi = max_rssi;
+       rssi_monitor.min_rssi = min_rssi;
+       rssi_monitor.flags = start ? 0: RSSI_MONITOR_STOP;
+       err = dhd_iovar(&dhd->pub, 0, "rssi_monitor", (char *)&rssi_monitor, sizeof(rssi_monitor),
+                       NULL, 0, TRUE);
+       if (err < 0 && err != BCME_UNSUPPORTED) {
+               DHD_ERROR(("%s : Failed to execute rssi_monitor %d\n", __FUNCTION__, err));
+       }
+       return err;
+}
+#endif /* RSSI_MONITOR_SUPPORT */
+
+#ifdef DHDTCPACK_SUPPRESS
+int
+dhd_dev_set_tcpack_sup_mode_cfg(struct net_device *dev, uint8 enable)
+{
+       int err;
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       err = dhd_tcpack_suppress_set(&dhd->pub, enable);
+       if (err != BCME_OK) {
+               DHD_ERROR(("%s : Failed to set tcpack_suppress mode: %d\n", __FUNCTION__, err));
+       }
+       return err;
+}
+#endif /* DHDTCPACK_SUPPRESS */
+
+int
+dhd_dev_cfg_rand_mac_oui(struct net_device *dev, uint8 *oui)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+       dhd_pub_t *dhdp = &dhd->pub;
+
+       if (!dhdp || !oui) {
+               DHD_ERROR(("NULL POINTER : %s\n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+       }
+       if (ETHER_ISMULTI(oui)) {
+               DHD_ERROR(("Expected unicast OUI\n"));
+               return BCME_ERROR;
+       } else {
+               uint8 *rand_mac_oui = dhdp->rand_mac_oui;
+               memcpy(rand_mac_oui, oui, DOT11_OUI_LEN);
+               DHD_ERROR(("Random MAC OUI to be used - "MACOUIDBG"\n",
+                       MACOUI2STRDBG(rand_mac_oui)));
+       }
+       return BCME_OK;
+}
+
+int
+dhd_set_rand_mac_oui(dhd_pub_t *dhd)
+{
+       int err;
+       wl_pfn_macaddr_cfg_t wl_cfg;
+       uint8 *rand_mac_oui = dhd->rand_mac_oui;
+
+       memset(&wl_cfg.macaddr, 0, ETHER_ADDR_LEN);
+       memcpy(&wl_cfg.macaddr, rand_mac_oui, DOT11_OUI_LEN);
+       wl_cfg.version = WL_PFN_MACADDR_CFG_VER;
+       if (ETHER_ISNULLADDR(&wl_cfg.macaddr)) {
+               wl_cfg.flags = 0;
+       } else {
+               wl_cfg.flags = (WL_PFN_MAC_OUI_ONLY_MASK | WL_PFN_SET_MAC_UNASSOC_MASK);
+       }
+
+       DHD_ERROR(("Setting rand mac oui to FW - "MACOUIDBG"\n",
+               MACOUI2STRDBG(rand_mac_oui)));
+
+       err = dhd_iovar(dhd, 0, "pfn_macaddr", (char *)&wl_cfg, sizeof(wl_cfg), NULL, 0, TRUE);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfn_macaddr %d\n", __FUNCTION__, err));
+       }
+       return err;
+}
+
+#if defined(RTT_SUPPORT) && defined(WL_CFG80211)
+/* Linux wrapper to call common dhd_pno_set_cfg_gscan */
+int
+dhd_dev_rtt_set_cfg(struct net_device *dev, void *buf)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_rtt_set_cfg(&dhd->pub, buf));
+}
+
+int
+dhd_dev_rtt_cancel_cfg(struct net_device *dev, struct ether_addr *mac_list, int mac_cnt)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_rtt_stop(&dhd->pub, mac_list, mac_cnt));
+}
+
+int
+dhd_dev_rtt_register_noti_callback(struct net_device *dev, void *ctx, dhd_rtt_compl_noti_fn noti_fn)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_rtt_register_noti_callback(&dhd->pub, ctx, noti_fn));
+}
+
+int
+dhd_dev_rtt_unregister_noti_callback(struct net_device *dev, dhd_rtt_compl_noti_fn noti_fn)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_rtt_unregister_noti_callback(&dhd->pub, noti_fn));
+}
+
+int
+dhd_dev_rtt_capability(struct net_device *dev, rtt_capabilities_t *capa)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_rtt_capability(&dhd->pub, capa));
+}
+
+int
+dhd_dev_rtt_avail_channel(struct net_device *dev, wifi_channel_info *channel_info)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+       return (dhd_rtt_avail_channel(&dhd->pub, channel_info));
+}
+
+int
+dhd_dev_rtt_enable_responder(struct net_device *dev, wifi_channel_info *channel_info)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+       return (dhd_rtt_enable_responder(&dhd->pub, channel_info));
+}
+
+int dhd_dev_rtt_cancel_responder(struct net_device *dev)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+       return (dhd_rtt_cancel_responder(&dhd->pub));
+}
+
+#endif /* RTT_SUPPORT */
+#if defined(PKT_FILTER_SUPPORT) && defined(APF)
+static void _dhd_apf_lock_local(dhd_info_t *dhd)
+{
+       if (dhd) {
+               mutex_lock(&dhd->dhd_apf_mutex);
+       }
+}
+
+static void _dhd_apf_unlock_local(dhd_info_t *dhd)
+{
+       if (dhd) {
+               mutex_unlock(&dhd->dhd_apf_mutex);
+       }
+}
+
+static int
+__dhd_apf_add_filter(struct net_device *ndev, uint32 filter_id,
+       u8* program, uint32 program_len)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(ndev);
+       dhd_pub_t *dhdp = &dhd->pub;
+       wl_pkt_filter_t * pkt_filterp;
+       wl_apf_program_t *apf_program;
+       char *buf;
+       u32 cmd_len, buf_len;
+       int ifidx, ret;
+       char cmd[] = "pkt_filter_add";
+
+       ifidx = dhd_net2idx(dhd, ndev);
+       if (ifidx == DHD_BAD_IF) {
+               DHD_ERROR(("%s: bad ifidx\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       cmd_len = sizeof(cmd);
+
+       /* Check if the program_len is more than the expected len
+        * and if the program is NULL return from here.
+        */
+       if ((program_len > WL_APF_PROGRAM_MAX_SIZE) || (program == NULL)) {
+               DHD_ERROR(("%s Invalid program_len: %d, program: %pK\n",
+                               __FUNCTION__, program_len, program));
+               return -EINVAL;
+       }
+       buf_len = cmd_len + WL_PKT_FILTER_FIXED_LEN +
+               WL_APF_PROGRAM_FIXED_LEN + program_len;
+
+       buf = MALLOCZ(dhdp->osh, buf_len);
+       if (unlikely(!buf)) {
+               DHD_ERROR(("%s: MALLOC failure, %d bytes\n", __FUNCTION__, buf_len));
+               return -ENOMEM;
+       }
+
+       memcpy(buf, cmd, cmd_len);
+
+       pkt_filterp = (wl_pkt_filter_t *) (buf + cmd_len);
+       pkt_filterp->id = htod32(filter_id);
+       pkt_filterp->negate_match = htod32(FALSE);
+       pkt_filterp->type = htod32(WL_PKT_FILTER_TYPE_APF_MATCH);
+
+       apf_program = &pkt_filterp->u.apf_program;
+       apf_program->version = htod16(WL_APF_INTERNAL_VERSION);
+       apf_program->instr_len = htod16(program_len);
+       memcpy(apf_program->instrs, program, program_len);
+
+       ret = dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR, buf, buf_len, TRUE, ifidx);
+       if (unlikely(ret)) {
+               DHD_ERROR(("%s: failed to add APF filter, id=%d, ret=%d\n",
+                       __FUNCTION__, filter_id, ret));
+       }
+
+       if (buf) {
+               MFREE(dhdp->osh, buf, buf_len);
+       }
+       return ret;
+}
+
+static int
+__dhd_apf_config_filter(struct net_device *ndev, uint32 filter_id,
+       uint32 mode, uint32 enable)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(ndev);
+       dhd_pub_t *dhdp = &dhd->pub;
+       wl_pkt_filter_enable_t * pkt_filterp;
+       char *buf;
+       u32 cmd_len, buf_len;
+       int ifidx, ret;
+       char cmd[] = "pkt_filter_enable";
+
+       ifidx = dhd_net2idx(dhd, ndev);
+       if (ifidx == DHD_BAD_IF) {
+               DHD_ERROR(("%s: bad ifidx\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       cmd_len = sizeof(cmd);
+       buf_len = cmd_len + sizeof(*pkt_filterp);
+
+       buf = MALLOCZ(dhdp->osh, buf_len);
+       if (unlikely(!buf)) {
+               DHD_ERROR(("%s: MALLOC failure, %d bytes\n", __FUNCTION__, buf_len));
+               return -ENOMEM;
+       }
+
+       memcpy(buf, cmd, cmd_len);
+
+       pkt_filterp = (wl_pkt_filter_enable_t *) (buf + cmd_len);
+       pkt_filterp->id = htod32(filter_id);
+       pkt_filterp->enable = htod32(enable);
+
+       ret = dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR, buf, buf_len, TRUE, ifidx);
+       if (unlikely(ret)) {
+               DHD_ERROR(("%s: failed to enable APF filter, id=%d, ret=%d\n",
+                       __FUNCTION__, filter_id, ret));
+               goto exit;
+       }
+
+       ret = dhd_wl_ioctl_set_intiovar(dhdp, "pkt_filter_mode", dhd_master_mode,
+               WLC_SET_VAR, TRUE, ifidx);
+       if (unlikely(ret)) {
+               DHD_ERROR(("%s: failed to set APF filter mode, id=%d, ret=%d\n",
+                       __FUNCTION__, filter_id, ret));
+       }
+
+exit:
+       if (buf) {
+               MFREE(dhdp->osh, buf, buf_len);
+       }
+       return ret;
+}
+
+static int
+__dhd_apf_delete_filter(struct net_device *ndev, uint32 filter_id)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(ndev);
+       dhd_pub_t *dhdp = &dhd->pub;
+       int ifidx, ret;
+
+       ifidx = dhd_net2idx(dhd, ndev);
+       if (ifidx == DHD_BAD_IF) {
+               DHD_ERROR(("%s: bad ifidx\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       ret = dhd_wl_ioctl_set_intiovar(dhdp, "pkt_filter_delete",
+               htod32(filter_id), WLC_SET_VAR, TRUE, ifidx);
+       if (unlikely(ret)) {
+               DHD_ERROR(("%s: failed to delete APF filter, id=%d, ret=%d\n",
+                       __FUNCTION__, filter_id, ret));
+       }
+
+       return ret;
+}
+
+void dhd_apf_lock(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       _dhd_apf_lock_local(dhd);
+}
+
+void dhd_apf_unlock(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       _dhd_apf_unlock_local(dhd);
+}
+
+int
+dhd_dev_apf_get_version(struct net_device *ndev, uint32 *version)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(ndev);
+       dhd_pub_t *dhdp = &dhd->pub;
+       int ifidx, ret;
+
+       if (!FW_SUPPORTED(dhdp, apf)) {
+               DHD_ERROR(("%s: firmware doesn't support APF\n", __FUNCTION__));
+
+               /*
+                * Notify Android framework that APF is not supported by setting
+                * version as zero.
+                */
+               *version = 0;
+               return BCME_OK;
+       }
+
+       ifidx = dhd_net2idx(dhd, ndev);
+       if (ifidx == DHD_BAD_IF) {
+               DHD_ERROR(("%s: bad ifidx\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       ret = dhd_wl_ioctl_get_intiovar(dhdp, "apf_ver", version,
+               WLC_GET_VAR, FALSE, ifidx);
+       if (unlikely(ret)) {
+               DHD_ERROR(("%s: failed to get APF version, ret=%d\n",
+                       __FUNCTION__, ret));
+       }
+
+       return ret;
+}
+
+int
+dhd_dev_apf_get_max_len(struct net_device *ndev, uint32 *max_len)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(ndev);
+       dhd_pub_t *dhdp = &dhd->pub;
+       int ifidx, ret;
+
+       if (!FW_SUPPORTED(dhdp, apf)) {
+               DHD_ERROR(("%s: firmware doesn't support APF\n", __FUNCTION__));
+               *max_len = 0;
+               return BCME_OK;
+       }
+
+       ifidx = dhd_net2idx(dhd, ndev);
+       if (ifidx == DHD_BAD_IF) {
+               DHD_ERROR(("%s bad ifidx\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       ret = dhd_wl_ioctl_get_intiovar(dhdp, "apf_size_limit", max_len,
+               WLC_GET_VAR, FALSE, ifidx);
+       if (unlikely(ret)) {
+               DHD_ERROR(("%s: failed to get APF size limit, ret=%d\n",
+                       __FUNCTION__, ret));
+       }
+
+       return ret;
+}
+
+int
+dhd_dev_apf_add_filter(struct net_device *ndev, u8* program,
+       uint32 program_len)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(ndev);
+       dhd_pub_t *dhdp = &dhd->pub;
+       int ret;
+
+       DHD_APF_LOCK(ndev);
+
+       /* delete, if filter already exists */
+       if (dhdp->apf_set) {
+               ret = __dhd_apf_delete_filter(ndev, PKT_FILTER_APF_ID);
+               if (unlikely(ret)) {
+                       goto exit;
+               }
+               dhdp->apf_set = FALSE;
+       }
+
+       ret = __dhd_apf_add_filter(ndev, PKT_FILTER_APF_ID, program, program_len);
+       if (ret) {
+               goto exit;
+       }
+       dhdp->apf_set = TRUE;
+
+       if (dhdp->in_suspend && dhdp->apf_set && !(dhdp->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+               /* Driver is still in (early) suspend state, enable APF filter back */
+               ret = __dhd_apf_config_filter(ndev, PKT_FILTER_APF_ID,
+                       PKT_FILTER_MODE_FORWARD_ON_MATCH, TRUE);
+       }
+exit:
+       DHD_APF_UNLOCK(ndev);
+
+       return ret;
+}
+
+int
+dhd_dev_apf_enable_filter(struct net_device *ndev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(ndev);
+       dhd_pub_t *dhdp = &dhd->pub;
+       int ret = 0;
+       bool nan_dp_active = false;
+
+       DHD_APF_LOCK(ndev);
+#ifdef WL_NAN
+       nan_dp_active = wl_cfgnan_is_dp_active(ndev);
+#endif /* WL_NAN */
+       if (dhdp->apf_set && (!(dhdp->op_mode & DHD_FLAG_HOSTAP_MODE) &&
+               !nan_dp_active)) {
+               ret = __dhd_apf_config_filter(ndev, PKT_FILTER_APF_ID,
+                       PKT_FILTER_MODE_FORWARD_ON_MATCH, TRUE);
+       }
+
+       DHD_APF_UNLOCK(ndev);
+
+       return ret;
+}
+
+int
+dhd_dev_apf_disable_filter(struct net_device *ndev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(ndev);
+       dhd_pub_t *dhdp = &dhd->pub;
+       int ret = 0;
+
+       DHD_APF_LOCK(ndev);
+
+       if (dhdp->apf_set) {
+               ret = __dhd_apf_config_filter(ndev, PKT_FILTER_APF_ID,
+                       PKT_FILTER_MODE_FORWARD_ON_MATCH, FALSE);
+       }
+
+       DHD_APF_UNLOCK(ndev);
+
+       return ret;
+}
+
+int
+dhd_dev_apf_delete_filter(struct net_device *ndev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(ndev);
+       dhd_pub_t *dhdp = &dhd->pub;
+       int ret = 0;
+
+       DHD_APF_LOCK(ndev);
+
+       if (dhdp->apf_set) {
+               ret = __dhd_apf_delete_filter(ndev, PKT_FILTER_APF_ID);
+               if (!ret) {
+                       dhdp->apf_set = FALSE;
+               }
+       }
+
+       DHD_APF_UNLOCK(ndev);
+
+       return ret;
+}
+#endif /* PKT_FILTER_SUPPORT && APF */
+
+static void dhd_hang_process(struct work_struct *work_data)
+{
+       struct net_device *dev;
+#ifdef IFACE_HANG_FORCE_DEV_CLOSE
+       struct net_device *ndev;
+       uint8 i = 0;
+#endif /* IFACE_HANG_FORCE_DEV_CLOSE */
+       struct dhd_info *dhd;
+       /* Ignore compiler warnings due to -Werror=cast-qual */
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       dhd = container_of(work_data, dhd_info_t, dhd_hang_process_work);
+       GCC_DIAGNOSTIC_POP();
+
+       if (!dhd || !dhd->iflist[0])
+               return;
+       dev = dhd->iflist[0]->net;
+
+       if (dev) {
+#if defined(WL_WIRELESS_EXT)
+               wl_iw_send_priv_event(dev, "HANG");
+#endif
+#if defined(WL_CFG80211)
+               wl_cfg80211_hang(dev, WLAN_REASON_UNSPECIFIED);
+#endif
+       }
+#ifdef IFACE_HANG_FORCE_DEV_CLOSE
+       /*
+        * For HW2, dev_close need to be done to recover
+        * from upper layer after hang. For Interposer skip
+        * dev_close so that dhd iovars can be used to take
+        * socramdump after crash, also skip for HW4 as
+        * handling of hang event is different
+        */
+
+       rtnl_lock();
+       for (i = 0; i < DHD_MAX_IFS; i++) {
+               ndev = dhd->iflist[i] ? dhd->iflist[i]->net : NULL;
+               if (ndev && (ndev->flags & IFF_UP)) {
+                       DHD_ERROR(("ndev->name : %s dev close\n",
+                                       ndev->name));
+                       dev_close(ndev);
+               }
+       }
+       rtnl_unlock();
+#endif /* IFACE_HANG_FORCE_DEV_CLOSE */
+}
+
+#ifdef CONFIG_ARCH_EXYNOS
+extern dhd_pub_t *link_recovery;
+void dhd_host_recover_link(void)
+{
+       DHD_ERROR(("****** %s ******\n", __FUNCTION__));
+       link_recovery->hang_reason = HANG_REASON_PCIE_LINK_DOWN_RC_DETECT;
+       dhd_bus_set_linkdown(link_recovery, TRUE);
+       dhd_os_send_hang_message(link_recovery);
+}
+EXPORT_SYMBOL(dhd_host_recover_link);
+#endif /* CONFIG_ARCH_EXYNOS */
+
+#ifdef DHD_DETECT_CONSECUTIVE_MFG_HANG
+#define MAX_CONSECUTIVE_MFG_HANG_COUNT 2
+#endif /* DHD_DETECT_CONSECUTIVE_MFG_HANG */
+int dhd_os_send_hang_message(dhd_pub_t *dhdp)
+{
+       int ret = 0;
+       dhd_info_t *dhd_info = NULL;
+#ifdef WL_CFG80211
+       struct net_device *primary_ndev;
+       struct bcm_cfg80211 *cfg;
+#endif /* WL_CFG80211 */
+
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is null\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       if (!dhdp->hang_report) {
+               DHD_ERROR(("%s: hang_report is disabled\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       dhd_info = (dhd_info_t *)dhdp->info;
+       BCM_REFERENCE(dhd_info);
+
+#if defined(WL_CFG80211) && defined(DHD_FILE_DUMP_EVENT)
+       if (dhd_info->scheduled_memdump) {
+               DHD_ERROR_RLMT(("[DUMP]:%s, memdump in progress. return\n", __FUNCTION__));
+               dhdp->hang_was_pending = 1;
+               return BCME_OK;
+       }
+#endif /* WL_CFG80211 && DHD_FILE_DUMP_EVENT */
+
+#ifdef WL_CFG80211
+       primary_ndev = dhd_linux_get_primary_netdev(dhdp);
+       if (!primary_ndev) {
+               DHD_ERROR(("%s: Cannot find primary netdev\n", __FUNCTION__));
+               return -ENODEV;
+       }
+       cfg = wl_get_cfg(primary_ndev);
+       if (!cfg) {
+               DHD_ERROR(("%s: Cannot find cfg\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       /* Skip sending HANG event to framework if driver is not ready */
+       if (!wl_get_drv_status(cfg, READY, primary_ndev)) {
+               DHD_ERROR(("%s: device is not ready\n", __FUNCTION__));
+               return -ENODEV;
+       }
+#endif /* WL_CFG80211 */
+
+#if defined(DHD_HANG_SEND_UP_TEST)
+       if (dhdp->req_hang_type) {
+               DHD_ERROR(("%s, Clear HANG test request 0x%x\n",
+                       __FUNCTION__, dhdp->req_hang_type));
+               dhdp->req_hang_type = 0;
+       }
+#endif /* DHD_HANG_SEND_UP_TEST */
+
+       if (!dhdp->hang_was_sent) {
+#ifdef DHD_DETECT_CONSECUTIVE_MFG_HANG
+               if (dhdp->op_mode & DHD_FLAG_MFG_MODE) {
+                       dhdp->hang_count++;
+                       if (dhdp->hang_count >= MAX_CONSECUTIVE_MFG_HANG_COUNT) {
+                               DHD_ERROR(("%s, Consecutive hang from Dongle :%u\n",
+                                       __FUNCTION__, dhdp->hang_count));
+                               BUG_ON(1);
+                       }
+               }
+#endif /* DHD_DETECT_CONSECUTIVE_MFG_HANG */
+#ifdef DHD_DEBUG_UART
+               /* If PCIe lane has broken, execute the debug uart application
+                * to gether a ramdump data from dongle via uart
+                */
+               if (!dhdp->info->duart_execute) {
+                       dhd_deferred_schedule_work(dhdp->info->dhd_deferred_wq,
+                                       (void *)dhdp, DHD_WQ_WORK_DEBUG_UART_DUMP,
+                                       dhd_debug_uart_exec_rd, DHD_WQ_WORK_PRIORITY_HIGH);
+               }
+#endif /* DHD_DEBUG_UART */
+               dhdp->hang_was_sent = 1;
+#ifdef BT_OVER_SDIO
+               dhdp->is_bt_recovery_required = TRUE;
+#endif
+               schedule_work(&dhdp->info->dhd_hang_process_work);
+
+#if defined(WLAN_ACCEL_BOOT)
+               DHD_ERROR(("%s: hang event sent, set force reg on", __FUNCTION__));
+               dhd_info->wl_accel_force_reg_on = TRUE;
+#endif /* WLAN_ACCEL_BOOT */
+               DHD_ERROR(("%s: Event HANG send up due to  re=%d te=%d s=%d\n", __FUNCTION__,
+                       dhdp->rxcnt_timeout, dhdp->txcnt_timeout, dhdp->busstate));
+       }
+       return ret;
+}
+
+int net_os_send_hang_message(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+
+       if (dhd) {
+               /* Report FW problem when enabled */
+               if (dhd->pub.hang_report) {
+#ifdef BT_OVER_SDIO
+                       if (netif_running(dev)) {
+#endif /* BT_OVER_SDIO */
+                               ret = dhd_os_send_hang_message(&dhd->pub);
+#ifdef BT_OVER_SDIO
+                       }
+                       DHD_ERROR(("%s: HANG -> Reset BT\n", __FUNCTION__));
+                       bcmsdh_btsdio_process_dhd_hang_notification(!netif_running(dev));
+#endif /* BT_OVER_SDIO */
+               } else {
+                       DHD_ERROR(("%s: FW HANG ignored (for testing purpose) and not sent up\n",
+                               __FUNCTION__));
+               }
+       }
+       return ret;
+}
+
+int net_os_send_hang_message_reason(struct net_device *dev, const char *string_num)
+{
+       dhd_info_t *dhd = NULL;
+       dhd_pub_t *dhdp = NULL;
+       int reason;
+
+       dhd = DHD_DEV_INFO(dev);
+       if (dhd) {
+               dhdp = &dhd->pub;
+       }
+
+       if (!dhd || !dhdp) {
+               return 0;
+       }
+
+       reason = bcm_strtoul(string_num, NULL, 0);
+       DHD_INFO(("%s: Enter, reason=0x%x\n", __FUNCTION__, reason));
+
+       if ((reason <= HANG_REASON_MASK) || (reason >= HANG_REASON_MAX)) {
+               reason = 0;
+       }
+
+       dhdp->hang_reason = reason;
+
+       return net_os_send_hang_message(dev);
+}
+
+int dhd_net_wifi_platform_set_power(struct net_device *dev, bool on, unsigned long delay_msec)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return wifi_platform_set_power(dhd->adapter, on, delay_msec);
+}
+
+int dhd_wifi_platform_set_power(dhd_pub_t *pub, bool on)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long delay_msec = on ? WIFI_TURNON_DELAY : WIFI_TURNOFF_DELAY;
+       return wifi_platform_set_power(dhd->adapter, on, delay_msec);
+}
+
+bool dhd_force_country_change(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (dhd && dhd->pub.up)
+               return dhd->pub.force_country_change;
+       return FALSE;
+}
+
+void dhd_get_customized_country_code(struct net_device *dev, char *country_iso_code,
+       wl_country_t *cspec)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+#if defined(DHD_BLOB_EXISTENCE_CHECK)
+       if (!dhd->pub.is_blob)
+#endif /* DHD_BLOB_EXISTENCE_CHECK */
+       {
+#if defined(CUSTOM_COUNTRY_CODE)
+               get_customized_country_code(dhd->adapter, country_iso_code, cspec,
+                       dhd->pub.dhd_cflags);
+#else
+               get_customized_country_code(dhd->adapter, country_iso_code, cspec);
+#endif /* CUSTOM_COUNTRY_CODE */
+       }
+#if defined(DHD_BLOB_EXISTENCE_CHECK) && !defined(CUSTOM_COUNTRY_CODE)
+       else {
+               /* Replace the ccode to XZ if ccode is undefined country */
+               if (strncmp(country_iso_code, "", WLC_CNTRY_BUF_SZ) == 0) {
+                       strlcpy(country_iso_code, "XZ", WLC_CNTRY_BUF_SZ);
+                       strlcpy(cspec->country_abbrev, country_iso_code, WLC_CNTRY_BUF_SZ);
+                       strlcpy(cspec->ccode, country_iso_code, WLC_CNTRY_BUF_SZ);
+                       DHD_ERROR(("%s: ccode change to %s\n", __FUNCTION__, country_iso_code));
+               }
+       }
+#endif /* DHD_BLOB_EXISTENCE_CHECK && !CUSTOM_COUNTRY_CODE */
+
+#ifdef KEEP_JP_REGREV
+/* XXX Needed by customer's request */
+       if (strncmp(country_iso_code, "JP", 3) == 0) {
+#if defined(DHD_BLOB_EXISTENCE_CHECK)
+               if (dhd->pub.is_blob) {
+                       if (strncmp(dhd->pub.vars_ccode, "J1", 3) == 0) {
+                               memcpy(cspec->ccode, dhd->pub.vars_ccode,
+                                       sizeof(dhd->pub.vars_ccode));
+                       }
+               } else
+#endif /* DHD_BLOB_EXISTENCE_CHECK */
+               {
+                       if (strncmp(dhd->pub.vars_ccode, "JP", 3) == 0) {
+                               cspec->rev = dhd->pub.vars_regrev;
+                       }
+               }
+       }
+#endif /* KEEP_JP_REGREV */
+       BCM_REFERENCE(dhd);
+}
+
+void dhd_bus_country_set(struct net_device *dev, wl_country_t *cspec, bool notify)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+#ifdef WL_CFG80211
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+#endif
+
+       if (dhd && dhd->pub.up) {
+               memcpy(&dhd->pub.dhd_cspec, cspec, sizeof(wl_country_t));
+#ifdef WL_CFG80211
+               wl_update_wiphybands(cfg, notify);
+#endif
+       }
+}
+
+void dhd_bus_band_set(struct net_device *dev, uint band)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+#ifdef WL_CFG80211
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+#endif
+       if (dhd && dhd->pub.up) {
+#ifdef WL_CFG80211
+               wl_update_wiphybands(cfg, true);
+#endif
+       }
+}
+
+int dhd_net_set_fw_path(struct net_device *dev, char *fw)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (!fw || fw[0] == '\0')
+               return -EINVAL;
+
+       strlcpy(dhd->fw_path, fw, sizeof(dhd->fw_path));
+
+#if defined(SOFTAP)
+       if (strstr(fw, "apsta") != NULL) {
+               DHD_INFO(("GOT APSTA FIRMWARE\n"));
+               ap_fw_loaded = TRUE;
+       } else {
+               DHD_INFO(("GOT STA FIRMWARE\n"));
+               ap_fw_loaded = FALSE;
+       }
+#endif
+       return 0;
+}
+
+void dhd_net_if_lock(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       dhd_net_if_lock_local(dhd);
+}
+
+void dhd_net_if_unlock(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       dhd_net_if_unlock_local(dhd);
+}
+
+static void dhd_net_if_lock_local(dhd_info_t *dhd)
+{
+       if (dhd)
+               mutex_lock(&dhd->dhd_net_if_mutex);
+}
+
+static void dhd_net_if_unlock_local(dhd_info_t *dhd)
+{
+       if (dhd)
+               mutex_unlock(&dhd->dhd_net_if_mutex);
+}
+
+static void dhd_suspend_lock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       if (dhd)
+               mutex_lock(&dhd->dhd_suspend_mutex);
+}
+
+static void dhd_suspend_unlock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       if (dhd)
+               mutex_unlock(&dhd->dhd_suspend_mutex);
+}
+
+unsigned long dhd_os_general_spin_lock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags = 0;
+
+       if (dhd) {
+               flags = osl_spin_lock(&dhd->dhd_lock);
+       }
+
+       return flags;
+}
+
+void dhd_os_general_spin_unlock(dhd_pub_t *pub, unsigned long flags)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               osl_spin_unlock(&dhd->dhd_lock, flags);
+       }
+}
+
+void *
+dhd_os_dbgring_lock_init(osl_t *osh)
+{
+       struct mutex *mtx = NULL;
+
+       mtx = MALLOCZ(osh, sizeof(*mtx));
+       if (mtx)
+               mutex_init(mtx);
+
+       return mtx;
+}
+
+void
+dhd_os_dbgring_lock_deinit(osl_t *osh, void *mtx)
+{
+       if (mtx) {
+               mutex_destroy(mtx);
+               MFREE(osh, mtx, sizeof(struct mutex));
+       }
+}
+
+static int
+dhd_get_pend_8021x_cnt(dhd_info_t *dhd)
+{
+       return (atomic_read(&dhd->pend_8021x_cnt));
+}
+
+#define MAX_WAIT_FOR_8021X_TX  100
+
+int
+dhd_wait_pend8021x(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int timeout = msecs_to_jiffies(10);
+       int ntimes = MAX_WAIT_FOR_8021X_TX;
+       int pend = dhd_get_pend_8021x_cnt(dhd);
+
+       while (ntimes && pend) {
+               if (pend) {
+                       set_current_state(TASK_INTERRUPTIBLE);
+                       schedule_timeout(timeout);
+                       set_current_state(TASK_RUNNING);
+                       ntimes--;
+               }
+               pend = dhd_get_pend_8021x_cnt(dhd);
+       }
+       if (ntimes == 0)
+       {
+               atomic_set(&dhd->pend_8021x_cnt, 0);
+               WL_MSG(dev->name, "TIMEOUT\n");
+       }
+       return pend;
+}
+
+#if defined(DHD_DEBUG)
+int write_file(const char * file_name, uint32 flags, uint8 *buf, int size)
+{
+       int ret = 0;
+       struct file *fp = NULL;
+       mm_segment_t old_fs;
+       loff_t pos = 0;
+
+       /* change to KERNEL_DS address limit */
+       old_fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       /* open file to write */
+       fp = filp_open(file_name, flags, 0664);
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("open file error, err = %ld\n", PTR_ERR(fp)));
+               goto exit;
+       }
+
+       /* Write buf to file */
+       ret = vfs_write(fp, buf, size, &pos);
+       if (ret < 0) {
+               DHD_ERROR(("write file error, err = %d\n", ret));
+               goto exit;
+       }
+
+       /* Sync file from filesystem to physical media */
+       ret = vfs_fsync(fp, 0);
+       if (ret < 0) {
+               DHD_ERROR(("sync file error, error = %d\n", ret));
+               goto exit;
+       }
+       ret = BCME_OK;
+
+exit:
+       /* close file before return */
+       if (!IS_ERR(fp))
+               filp_close(fp, current->files);
+
+       /* restore previous address limit */
+       set_fs(old_fs);
+
+       return ret;
+}
+#endif
+
+#ifdef DHD_DEBUG
+static void
+dhd_convert_memdump_type_to_str(uint32 type, char *buf, size_t buf_len, int substr_type)
+{
+       char *type_str = NULL;
+
+       switch (type) {
+               case DUMP_TYPE_RESUMED_ON_TIMEOUT:
+                       type_str = "resumed_on_timeout";
+                       break;
+               case DUMP_TYPE_D3_ACK_TIMEOUT:
+                       type_str = "D3_ACK_timeout";
+                       break;
+               case DUMP_TYPE_DONGLE_TRAP:
+                       type_str = "Dongle_Trap";
+                       break;
+               case DUMP_TYPE_MEMORY_CORRUPTION:
+                       type_str = "Memory_Corruption";
+                       break;
+               case DUMP_TYPE_PKTID_AUDIT_FAILURE:
+                       type_str = "PKTID_AUDIT_Fail";
+                       break;
+               case DUMP_TYPE_PKTID_INVALID:
+                       type_str = "PKTID_INVALID";
+                       break;
+               case DUMP_TYPE_SCAN_TIMEOUT:
+                       type_str = "SCAN_timeout";
+                       break;
+               case DUMP_TYPE_SCAN_BUSY:
+                       type_str = "SCAN_Busy";
+                       break;
+               case DUMP_TYPE_BY_SYSDUMP:
+                       if (substr_type == CMD_UNWANTED) {
+                               type_str = "BY_SYSDUMP_FORUSER_unwanted";
+                       } else if (substr_type == CMD_DISCONNECTED) {
+                               type_str = "BY_SYSDUMP_FORUSER_disconnected";
+                       } else {
+                               type_str = "BY_SYSDUMP_FORUSER";
+                       }
+                       break;
+               case DUMP_TYPE_BY_LIVELOCK:
+                       type_str = "BY_LIVELOCK";
+                       break;
+               case DUMP_TYPE_AP_LINKUP_FAILURE:
+                       type_str = "BY_AP_LINK_FAILURE";
+                       break;
+               case DUMP_TYPE_AP_ABNORMAL_ACCESS:
+                       type_str = "INVALID_ACCESS";
+                       break;
+               case DUMP_TYPE_RESUMED_ON_TIMEOUT_RX:
+                       type_str = "ERROR_RX_TIMED_OUT";
+                       break;
+               case DUMP_TYPE_RESUMED_ON_TIMEOUT_TX:
+                       type_str = "ERROR_TX_TIMED_OUT";
+                       break;
+               case DUMP_TYPE_CFG_VENDOR_TRIGGERED:
+                       type_str = "CFG_VENDOR_TRIGGERED";
+                       break;
+               case DUMP_TYPE_RESUMED_ON_INVALID_RING_RDWR:
+                       type_str = "BY_INVALID_RING_RDWR";
+                       break;
+               case DUMP_TYPE_IFACE_OP_FAILURE:
+                       type_str = "BY_IFACE_OP_FAILURE";
+                       break;
+               case DUMP_TYPE_TRANS_ID_MISMATCH:
+                       type_str = "BY_TRANS_ID_MISMATCH";
+                       break;
+#ifdef DEBUG_DNGL_INIT_FAIL
+               case DUMP_TYPE_DONGLE_INIT_FAILURE:
+                       type_str = "DONGLE_INIT_FAIL";
+                       break;
+#endif /* DEBUG_DNGL_INIT_FAIL */
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+               case DUMP_TYPE_READ_SHM_FAIL:
+                       type_str = "READ_SHM_FAIL";
+                       break;
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+               case DUMP_TYPE_DONGLE_HOST_EVENT:
+                       type_str = "BY_DONGLE_HOST_EVENT";
+                       break;
+               case DUMP_TYPE_SMMU_FAULT:
+                       type_str = "SMMU_FAULT";
+                       break;
+#ifdef DHD_ERPOM
+               case DUMP_TYPE_DUE_TO_BT:
+                       type_str = "DUE_TO_BT";
+                       break;
+#endif /* DHD_ERPOM */
+               case DUMP_TYPE_BY_USER:
+                       type_str = "BY_USER";
+                       break;
+               case DUMP_TYPE_LOGSET_BEYOND_RANGE:
+                       type_str = "LOGSET_BEYOND_RANGE";
+                       break;
+               case DUMP_TYPE_CTO_RECOVERY:
+                       type_str = "CTO_RECOVERY";
+                       break;
+               case DUMP_TYPE_SEQUENTIAL_PRIVCMD_ERROR:
+                       type_str = "SEQUENTIAL_PRIVCMD_ERROR";
+                       break;
+               case DUMP_TYPE_PROXD_TIMEOUT:
+                       type_str = "PROXD_TIMEOUT";
+                       break;
+               case DUMP_TYPE_INBAND_DEVICE_WAKE_FAILURE:
+                       type_str = "INBAND_DEVICE_WAKE_FAILURE";
+                       break;
+               case DUMP_TYPE_PKTID_POOL_DEPLETED:
+                       type_str = "PKTID_POOL_DEPLETED";
+                       break;
+               case DUMP_TYPE_ESCAN_SYNCID_MISMATCH:
+                       type_str = "ESCAN_SYNCID_MISMATCH";
+                       break;
+               default:
+                       type_str = "Unknown_type";
+                       break;
+       }
+
+       strlcpy(buf, type_str, buf_len);
+}
+
+void
+dhd_get_memdump_filename(struct net_device *ndev, char *memdump_path, int len, char *fname)
+{
+       char memdump_type[DHD_MEMDUMP_TYPE_STR_LEN];
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(ndev);
+       dhd_pub_t *dhdp = &dhd->pub;
+
+       /* Init file name */
+       memset(memdump_path, 0, len);
+       memset(memdump_type, 0, DHD_MEMDUMP_TYPE_STR_LEN);
+       dhd_convert_memdump_type_to_str(dhdp->memdump_type, memdump_type, DHD_MEMDUMP_TYPE_STR_LEN,
+               dhdp->debug_dump_subcmd);
+       clear_debug_dump_time(dhdp->debug_dump_time_str);
+       get_debug_dump_time(dhdp->debug_dump_time_str);
+       snprintf(memdump_path, len, "%s%s_%s_" "%s",
+               DHD_COMMON_DUMP_PATH, fname, memdump_type,  dhdp->debug_dump_time_str);
+
+       if (strstr(fname, "sssr_dump")) {
+               DHD_SSSR_PRINT_FILEPATH(dhdp, memdump_path);
+       } else {
+               DHD_ERROR(("%s: file_path = %s%s\n", __FUNCTION__,
+                       memdump_path, FILE_NAME_HAL_TAG));
+       }
+}
+
+int
+write_dump_to_file(dhd_pub_t *dhd, uint8 *buf, int size, char *fname)
+{
+       int ret = 0;
+       char memdump_path[DHD_MEMDUMP_PATH_STR_LEN];
+       char memdump_type[DHD_MEMDUMP_TYPE_STR_LEN];
+       uint32 file_mode;
+
+       /* Init file name */
+       memset(memdump_path, 0, DHD_MEMDUMP_PATH_STR_LEN);
+       memset(memdump_type, 0, DHD_MEMDUMP_TYPE_STR_LEN);
+       dhd_convert_memdump_type_to_str(dhd->memdump_type, memdump_type, DHD_MEMDUMP_TYPE_STR_LEN,
+                       dhd->debug_dump_subcmd);
+       clear_debug_dump_time(dhd->debug_dump_time_str);
+       get_debug_dump_time(dhd->debug_dump_time_str);
+
+       snprintf(memdump_path, sizeof(memdump_path), "%s%s_%s_" "%s",
+               DHD_COMMON_DUMP_PATH, fname, memdump_type, dhd->debug_dump_time_str);
+#ifdef CUSTOMER_HW4_DEBUG
+       file_mode = O_CREAT | O_WRONLY | O_SYNC;
+#elif defined(BOARD_HIKEY)
+       file_mode = O_CREAT | O_WRONLY | O_SYNC;
+#elif defined(__ARM_ARCH_7A__)
+       file_mode = O_CREAT | O_WRONLY;
+#else
+       /* Extra flags O_DIRECT and O_SYNC are required for Brix Android, as we are
+        * calling BUG_ON immediately after collecting the socram dump.
+        * So the file write operation should directly write the contents into the
+        * file instead of caching it. O_TRUNC flag ensures that file will be re-written
+        * instead of appending.
+        */
+       file_mode = O_CREAT | O_WRONLY | O_SYNC;
+       {
+               struct file *fp = filp_open(memdump_path, file_mode, 0664);
+               /* Check if it is live Brix image having /installmedia, else use /data */
+               if (IS_ERR(fp)) {
+                       DHD_ERROR(("open file %s, try /data/\n", memdump_path));
+                       snprintf(memdump_path, sizeof(memdump_path), "%s%s_%s_" "%s",
+                               "/data/", fname, memdump_type,  dhd->debug_dump_time_str);
+               } else {
+                       filp_close(fp, NULL);
+               }
+       }
+#endif /* CUSTOMER_HW4_DEBUG */
+
+       /* print SOCRAM dump file path */
+       DHD_ERROR(("%s: file_path = %s\n", __FUNCTION__, memdump_path));
+
+#ifdef DHD_LOG_DUMP
+       dhd_print_buf_addr(dhd, "write_dump_to_file", buf, size);
+#endif /* DHD_LOG_DUMP */
+
+       /* Write file */
+       ret = write_file(memdump_path, file_mode, buf, size);
+
+#ifdef DHD_DUMP_MNGR
+       if (ret == BCME_OK) {
+               dhd_dump_file_manage_enqueue(dhd, memdump_path, fname);
+       }
+#endif /* DHD_DUMP_MNGR */
+
+       return ret;
+}
+#endif /* DHD_DEBUG */
+
+int dhd_os_wake_lock_timeout(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+       int ret = 0;
+
+       if (dhd && (dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT)) {
+               DHD_WAKE_SPIN_LOCK(&dhd->wakelock_spinlock, flags);
+               ret = dhd->wakelock_rx_timeout_enable > dhd->wakelock_ctrl_timeout_enable ?
+                       dhd->wakelock_rx_timeout_enable : dhd->wakelock_ctrl_timeout_enable;
+#ifdef CONFIG_HAS_WAKELOCK
+               if (dhd->wakelock_rx_timeout_enable)
+                       wake_lock_timeout(&dhd->wl_rxwake,
+                               msecs_to_jiffies(dhd->wakelock_rx_timeout_enable));
+               if (dhd->wakelock_ctrl_timeout_enable)
+                       wake_lock_timeout(&dhd->wl_ctrlwake,
+                               msecs_to_jiffies(dhd->wakelock_ctrl_timeout_enable));
+#endif
+               dhd->wakelock_rx_timeout_enable = 0;
+               dhd->wakelock_ctrl_timeout_enable = 0;
+               DHD_WAKE_SPIN_UNLOCK(&dhd->wakelock_spinlock, flags);
+       }
+       return ret;
+}
+
+int net_os_wake_lock_timeout(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+
+       if (dhd)
+               ret = dhd_os_wake_lock_timeout(&dhd->pub);
+       return ret;
+}
+
+int dhd_os_wake_lock_rx_timeout_enable(dhd_pub_t *pub, int val)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+
+       if (dhd && (dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT)) {
+               DHD_WAKE_SPIN_LOCK(&dhd->wakelock_spinlock, flags);
+               if (val > dhd->wakelock_rx_timeout_enable)
+                       dhd->wakelock_rx_timeout_enable = val;
+               DHD_WAKE_SPIN_UNLOCK(&dhd->wakelock_spinlock, flags);
+       }
+       return 0;
+}
+
+int dhd_os_wake_lock_ctrl_timeout_enable(dhd_pub_t *pub, int val)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+
+       if (dhd && (dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT)) {
+               DHD_WAKE_SPIN_LOCK(&dhd->wakelock_spinlock, flags);
+               if (val > dhd->wakelock_ctrl_timeout_enable)
+                       dhd->wakelock_ctrl_timeout_enable = val;
+               DHD_WAKE_SPIN_UNLOCK(&dhd->wakelock_spinlock, flags);
+       }
+       return 0;
+}
+
+int dhd_os_wake_lock_ctrl_timeout_cancel(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+
+       if (dhd && (dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT)) {
+               DHD_WAKE_SPIN_LOCK(&dhd->wakelock_spinlock, flags);
+               dhd->wakelock_ctrl_timeout_enable = 0;
+#ifdef CONFIG_HAS_WAKELOCK
+               if (wake_lock_active(&dhd->wl_ctrlwake))
+                       wake_unlock(&dhd->wl_ctrlwake);
+#endif
+               DHD_WAKE_SPIN_UNLOCK(&dhd->wakelock_spinlock, flags);
+       }
+       return 0;
+}
+
+int net_os_wake_lock_rx_timeout_enable(struct net_device *dev, int val)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+
+       if (dhd)
+               ret = dhd_os_wake_lock_rx_timeout_enable(&dhd->pub, val);
+       return ret;
+}
+
+int net_os_wake_lock_ctrl_timeout_enable(struct net_device *dev, int val)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+
+       if (dhd)
+               ret = dhd_os_wake_lock_ctrl_timeout_enable(&dhd->pub, val);
+       return ret;
+}
+
+#if defined(DHD_TRACE_WAKE_LOCK)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+#include <linux/hashtable.h>
+#else
+#include <linux/hash.h>
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+/* Define 2^5 = 32 bucket size hash table */
+DEFINE_HASHTABLE(wklock_history, 5);
+#else
+/* Define 2^5 = 32 bucket size hash table */
+struct hlist_head wklock_history[32] = { [0 ... 31] = HLIST_HEAD_INIT };
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0) */
+
+atomic_t trace_wklock_onoff;
+typedef enum dhd_wklock_type {
+       DHD_WAKE_LOCK,
+       DHD_WAKE_UNLOCK,
+       DHD_WAIVE_LOCK,
+       DHD_RESTORE_LOCK
+} dhd_wklock_t;
+
+struct wk_trace_record {
+       unsigned long addr;                 /* Address of the instruction */
+       dhd_wklock_t lock_type;         /* lock_type */
+       unsigned long long counter;             /* counter information */
+       struct hlist_node wklock_node;  /* hash node */
+};
+
+static struct wk_trace_record *find_wklock_entry(unsigned long addr)
+{
+       struct wk_trace_record *wklock_info;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       hash_for_each_possible(wklock_history, wklock_info, wklock_node, addr)
+#else
+       struct hlist_node *entry;
+       int index = hash_long(addr, ilog2(ARRAY_SIZE(wklock_history)));
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       hlist_for_each_entry(wklock_info, entry, &wklock_history[index], wklock_node)
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0) */
+       {
+               GCC_DIAGNOSTIC_POP();
+               if (wklock_info->addr == addr) {
+                       return wklock_info;
+               }
+       }
+       return NULL;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+#define HASH_ADD(hashtable, node, key) \
+       do { \
+               hash_add(hashtable, node, key); \
+       } while (0);
+#else
+#define HASH_ADD(hashtable, node, key) \
+       do { \
+               int index = hash_long(key, ilog2(ARRAY_SIZE(hashtable))); \
+               hlist_add_head(node, &hashtable[index]); \
+       } while (0);
+#endif /* KERNEL_VER < KERNEL_VERSION(3, 7, 0) */
+
+#define STORE_WKLOCK_RECORD(wklock_type) \
+       do { \
+               struct wk_trace_record *wklock_info = NULL; \
+               unsigned long func_addr = (unsigned long)__builtin_return_address(0); \
+               wklock_info = find_wklock_entry(func_addr); \
+               if (wklock_info) { \
+                       if (wklock_type == DHD_WAIVE_LOCK || wklock_type == DHD_RESTORE_LOCK) { \
+                               wklock_info->counter = dhd->wakelock_counter; \
+                       } else { \
+                               wklock_info->counter++; \
+                       } \
+               } else { \
+                       wklock_info = kzalloc(sizeof(*wklock_info), GFP_ATOMIC); \
+                       if (!wklock_info) {\
+                               printk("Can't allocate wk_trace_record \n"); \
+                       } else { \
+                               wklock_info->addr = func_addr; \
+                               wklock_info->lock_type = wklock_type; \
+                               if (wklock_type == DHD_WAIVE_LOCK || \
+                                               wklock_type == DHD_RESTORE_LOCK) { \
+                                       wklock_info->counter = dhd->wakelock_counter; \
+                               } else { \
+                                       wklock_info->counter++; \
+                               } \
+                               HASH_ADD(wklock_history, &wklock_info->wklock_node, func_addr); \
+                       } \
+               } \
+       } while (0);
+
+static inline void dhd_wk_lock_rec_dump(void)
+{
+       int bkt;
+       struct wk_trace_record *wklock_info;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       hash_for_each(wklock_history, bkt, wklock_info, wklock_node)
+#else
+       struct hlist_node *entry = NULL;
+       int max_index = ARRAY_SIZE(wklock_history);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       for (bkt = 0; bkt < max_index; bkt++)
+               hlist_for_each_entry(wklock_info, entry, &wklock_history[bkt], wklock_node)
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0) */
+               {
+                       GCC_DIAGNOSTIC_POP();
+                       switch (wklock_info->lock_type) {
+                               case DHD_WAKE_LOCK:
+                                       printk("wakelock lock : %pS  lock_counter : %llu \n",
+                                               (void *)wklock_info->addr, wklock_info->counter);
+                                       break;
+                               case DHD_WAKE_UNLOCK:
+                                       printk("wakelock unlock : %pS, unlock_counter : %llu \n",
+                                               (void *)wklock_info->addr, wklock_info->counter);
+                                       break;
+                               case DHD_WAIVE_LOCK:
+                                       printk("wakelock waive : %pS  before_waive : %llu \n",
+                                               (void *)wklock_info->addr, wklock_info->counter);
+                                       break;
+                               case DHD_RESTORE_LOCK:
+                                       printk("wakelock restore : %pS, after_waive : %llu \n",
+                                               (void *)wklock_info->addr, wklock_info->counter);
+                                       break;
+                       }
+               }
+}
+
+static void dhd_wk_lock_trace_init(struct dhd_info *dhd)
+{
+       unsigned long flags;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0))
+       int i;
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0) */
+
+       DHD_WAKE_SPIN_LOCK(&dhd->wakelock_spinlock, flags);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+       hash_init(wklock_history);
+#else
+       for (i = 0; i < ARRAY_SIZE(wklock_history); i++)
+               INIT_HLIST_HEAD(&wklock_history[i]);
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0) */
+       DHD_WAKE_SPIN_UNLOCK(&dhd->wakelock_spinlock, flags);
+       atomic_set(&trace_wklock_onoff, 1);
+}
+
+static void dhd_wk_lock_trace_deinit(struct dhd_info *dhd)
+{
+       int bkt;
+       struct wk_trace_record *wklock_info;
+       struct hlist_node *tmp;
+       unsigned long flags;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0))
+       struct hlist_node *entry = NULL;
+       int max_index = ARRAY_SIZE(wklock_history);
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0) */
+
+       DHD_WAKE_SPIN_LOCK(&dhd->wakelock_spinlock, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+       hash_for_each_safe(wklock_history, bkt, tmp, wklock_info, wklock_node)
+#else
+       for (bkt = 0; bkt < max_index; bkt++)
+               hlist_for_each_entry_safe(wklock_info, entry, tmp,
+                       &wklock_history[bkt], wklock_node)
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0)) */
+               {
+                       GCC_DIAGNOSTIC_POP();
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+                       hash_del(&wklock_info->wklock_node);
+#else
+                       hlist_del_init(&wklock_info->wklock_node);
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0)) */
+                       kfree(wklock_info);
+               }
+       DHD_WAKE_SPIN_UNLOCK(&dhd->wakelock_spinlock, flags);
+}
+
+void dhd_wk_lock_stats_dump(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(dhdp->info);
+       unsigned long flags;
+
+       printk(KERN_ERR"DHD Printing wl_wake Lock/Unlock Record \r\n");
+       DHD_WAKE_SPIN_LOCK(&dhd->wakelock_spinlock, flags);
+       dhd_wk_lock_rec_dump();
+       DHD_WAKE_SPIN_UNLOCK(&dhd->wakelock_spinlock, flags);
+
+}
+#else
+#define STORE_WKLOCK_RECORD(wklock_type)
+#endif /* ! DHD_TRACE_WAKE_LOCK */
+
+int dhd_os_wake_lock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+       int ret = 0;
+
+       if (dhd && (dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT)) {
+               DHD_WAKE_SPIN_LOCK(&dhd->wakelock_spinlock, flags);
+               if (dhd->wakelock_counter == 0 && !dhd->waive_wakelock) {
+#ifdef CONFIG_HAS_WAKELOCK
+                       wake_lock(&dhd->wl_wifi);
+#elif defined(BCMSDIO)
+                       dhd_bus_dev_pm_stay_awake(pub);
+#endif
+               }
+#ifdef DHD_TRACE_WAKE_LOCK
+               if (atomic_read(&trace_wklock_onoff)) {
+                       STORE_WKLOCK_RECORD(DHD_WAKE_LOCK);
+               }
+#endif /* DHD_TRACE_WAKE_LOCK */
+               dhd->wakelock_counter++;
+               ret = dhd->wakelock_counter;
+               DHD_WAKE_SPIN_UNLOCK(&dhd->wakelock_spinlock, flags);
+       }
+
+       return ret;
+}
+
+void dhd_event_wake_lock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+#ifdef CONFIG_HAS_WAKELOCK
+               wake_lock(&dhd->wl_evtwake);
+#elif defined(BCMSDIO)
+               dhd_bus_dev_pm_stay_awake(pub);
+#endif
+       }
+}
+
+void
+dhd_pm_wake_lock_timeout(dhd_pub_t *pub, int val)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               wake_lock_timeout(&dhd->wl_pmwake, msecs_to_jiffies(val));
+       }
+#endif /* CONFIG_HAS_WAKE_LOCK */
+}
+
+void
+dhd_txfl_wake_lock_timeout(dhd_pub_t *pub, int val)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               wake_lock_timeout(&dhd->wl_txflwake, msecs_to_jiffies(val));
+       }
+#endif /* CONFIG_HAS_WAKE_LOCK */
+}
+
+void
+dhd_nan_wake_lock_timeout(dhd_pub_t *pub, int val)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               wake_lock_timeout(&dhd->wl_nanwake, msecs_to_jiffies(val));
+       }
+#endif /* CONFIG_HAS_WAKE_LOCK */
+}
+
+int net_os_wake_lock(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+
+       if (dhd)
+               ret = dhd_os_wake_lock(&dhd->pub);
+       return ret;
+}
+
+int dhd_os_wake_unlock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+       int ret = 0;
+
+       dhd_os_wake_lock_timeout(pub);
+       if (dhd && (dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT)) {
+               DHD_WAKE_SPIN_LOCK(&dhd->wakelock_spinlock, flags);
+
+               if (dhd->wakelock_counter > 0) {
+                       dhd->wakelock_counter--;
+#ifdef DHD_TRACE_WAKE_LOCK
+                       if (atomic_read(&trace_wklock_onoff)) {
+                               STORE_WKLOCK_RECORD(DHD_WAKE_UNLOCK);
+                       }
+#endif /* DHD_TRACE_WAKE_LOCK */
+                       if (dhd->wakelock_counter == 0 && !dhd->waive_wakelock) {
+#ifdef CONFIG_HAS_WAKELOCK
+                               wake_unlock(&dhd->wl_wifi);
+#elif defined(BCMSDIO)
+                               dhd_bus_dev_pm_relax(pub);
+#endif
+                       }
+                       ret = dhd->wakelock_counter;
+               }
+               DHD_WAKE_SPIN_UNLOCK(&dhd->wakelock_spinlock, flags);
+       }
+       return ret;
+}
+
+void dhd_event_wake_unlock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+#ifdef CONFIG_HAS_WAKELOCK
+               wake_unlock(&dhd->wl_evtwake);
+#elif defined(BCMSDIO)
+               dhd_bus_dev_pm_relax(pub);
+#endif
+       }
+}
+
+void dhd_pm_wake_unlock(dhd_pub_t *pub)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               /* if wl_pmwake is active, unlock it */
+               if (wake_lock_active(&dhd->wl_pmwake)) {
+                       wake_unlock(&dhd->wl_pmwake);
+               }
+       }
+#endif /* CONFIG_HAS_WAKELOCK */
+}
+
+void dhd_txfl_wake_unlock(dhd_pub_t *pub)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               /* if wl_txflwake is active, unlock it */
+               if (wake_lock_active(&dhd->wl_txflwake)) {
+                       wake_unlock(&dhd->wl_txflwake);
+               }
+       }
+#endif /* CONFIG_HAS_WAKELOCK */
+}
+
+void dhd_nan_wake_unlock(dhd_pub_t *pub)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               /* if wl_nanwake is active, unlock it */
+               if (wake_lock_active(&dhd->wl_nanwake)) {
+                       wake_unlock(&dhd->wl_nanwake);
+               }
+       }
+#endif /* CONFIG_HAS_WAKELOCK */
+}
+
+int dhd_os_check_wakelock(dhd_pub_t *pub)
+{
+#if defined(CONFIG_HAS_WAKELOCK) || defined(BCMSDIO)
+       dhd_info_t *dhd;
+
+       if (!pub)
+               return 0;
+       dhd = (dhd_info_t *)(pub->info);
+#endif /* CONFIG_HAS_WAKELOCK || BCMSDIO */
+
+#ifdef CONFIG_HAS_WAKELOCK
+       /* Indicate to the SD Host to avoid going to suspend if internal locks are up */
+       if (dhd && (wake_lock_active(&dhd->wl_wifi) ||
+               (wake_lock_active(&dhd->wl_wdwake))))
+               return 1;
+#elif defined(BCMSDIO)
+       if (dhd && (dhd->wakelock_counter > 0) && dhd_bus_dev_pm_enabled(pub))
+               return 1;
+#endif
+       return 0;
+}
+
+int
+dhd_os_check_wakelock_all(dhd_pub_t *pub)
+{
+#if defined(CONFIG_HAS_WAKELOCK) || defined(BCMSDIO)
+#if defined(CONFIG_HAS_WAKELOCK)
+       int l1, l2, l3, l4, l7, l8, l9, l10;
+       int l5 = 0, l6 = 0;
+       int c, lock_active;
+#endif /* CONFIG_HAS_WAKELOCK */
+       dhd_info_t *dhd;
+
+       if (!pub) {
+               return 0;
+       }
+       if (pub->up == 0) {
+               DHD_ERROR(("%s: skip as down in progress\n", __FUNCTION__));
+               return 0;
+       }
+       dhd = (dhd_info_t *)(pub->info);
+       if (!dhd) {
+               return 0;
+       }
+#endif /* CONFIG_HAS_WAKELOCK || BCMSDIO */
+
+#ifdef CONFIG_HAS_WAKELOCK
+       c = dhd->wakelock_counter;
+       l1 = wake_lock_active(&dhd->wl_wifi);
+       l2 = wake_lock_active(&dhd->wl_wdwake);
+       l3 = wake_lock_active(&dhd->wl_rxwake);
+       l4 = wake_lock_active(&dhd->wl_ctrlwake);
+       l7 = wake_lock_active(&dhd->wl_evtwake);
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       l5 = wake_lock_active(&dhd->wl_intrwake);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef DHD_USE_SCAN_WAKELOCK
+       l6 = wake_lock_active(&dhd->wl_scanwake);
+#endif /* DHD_USE_SCAN_WAKELOCK */
+       l8 = wake_lock_active(&dhd->wl_pmwake);
+       l9 = wake_lock_active(&dhd->wl_txflwake);
+       l10 = wake_lock_active(&dhd->wl_nanwake);
+       lock_active = (l1 || l2 || l3 || l4 || l5 || l6 || l7 || l8 || l9 || l10);
+
+       /* Indicate to the Host to avoid going to suspend if internal locks are up */
+       if (lock_active) {
+               DHD_ERROR(("%s wakelock c-%d wl-%d wd-%d rx-%d "
+                       "ctl-%d intr-%d scan-%d evt-%d, pm-%d, txfl-%d nan-%d\n",
+                       __FUNCTION__, c, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10));
+               return 1;
+       }
+#elif defined(BCMSDIO)
+       if (dhd && (dhd->wakelock_counter > 0) && dhd_bus_dev_pm_enabled(pub)) {
+               return 1;
+       }
+#endif /* defined(BCMSDIO) */
+       return 0;
+}
+
+int net_os_wake_unlock(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+
+       if (dhd)
+               ret = dhd_os_wake_unlock(&dhd->pub);
+       return ret;
+}
+
+int dhd_os_wd_wake_lock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+       int ret = 0;
+
+       if (dhd) {
+               DHD_WAKE_SPIN_LOCK(&dhd->wakelock_spinlock, flags);
+               if (dhd->wakelock_wd_counter == 0 && !dhd->waive_wakelock) {
+#ifdef CONFIG_HAS_WAKELOCK
+                       /* if wakelock_wd_counter was never used : lock it at once */
+                       wake_lock(&dhd->wl_wdwake);
+#endif
+               }
+               dhd->wakelock_wd_counter++;
+               ret = dhd->wakelock_wd_counter;
+               DHD_WAKE_SPIN_UNLOCK(&dhd->wakelock_spinlock, flags);
+       }
+       return ret;
+}
+
+int dhd_os_wd_wake_unlock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+       int ret = 0;
+
+       if (dhd) {
+               DHD_WAKE_SPIN_LOCK(&dhd->wakelock_spinlock, flags);
+               if (dhd->wakelock_wd_counter > 0) {
+                       dhd->wakelock_wd_counter = 0;
+                       if (!dhd->waive_wakelock) {
+#ifdef CONFIG_HAS_WAKELOCK
+                               wake_unlock(&dhd->wl_wdwake);
+#endif
+                       }
+               }
+               DHD_WAKE_SPIN_UNLOCK(&dhd->wakelock_spinlock, flags);
+       }
+       return ret;
+}
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+void
+dhd_os_oob_irq_wake_lock_timeout(dhd_pub_t *pub, int val)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               wake_lock_timeout(&dhd->wl_intrwake, msecs_to_jiffies(val));
+       }
+#endif /* CONFIG_HAS_WAKELOCK */
+}
+
+void
+dhd_os_oob_irq_wake_unlock(dhd_pub_t *pub)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               /* if wl_intrwake is active, unlock it */
+               if (wake_lock_active(&dhd->wl_intrwake)) {
+                       wake_unlock(&dhd->wl_intrwake);
+               }
+       }
+#endif /* CONFIG_HAS_WAKELOCK */
+}
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+#ifdef DHD_USE_SCAN_WAKELOCK
+void
+dhd_os_scan_wake_lock_timeout(dhd_pub_t *pub, int val)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               wake_lock_timeout(&dhd->wl_scanwake, msecs_to_jiffies(val));
+       }
+#endif /* CONFIG_HAS_WAKELOCK */
+}
+
+void
+dhd_os_scan_wake_unlock(dhd_pub_t *pub)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               /* if wl_scanwake is active, unlock it */
+               if (wake_lock_active(&dhd->wl_scanwake)) {
+                       wake_unlock(&dhd->wl_scanwake);
+               }
+       }
+#endif /* CONFIG_HAS_WAKELOCK */
+}
+#endif /* DHD_USE_SCAN_WAKELOCK */
+
+/* waive wakelocks for operations such as IOVARs in suspend function, must be closed
+ * by a paired function call to dhd_wakelock_restore. returns current wakelock counter
+ */
+int dhd_os_wake_lock_waive(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+       int ret = 0;
+
+       if (dhd && (dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT)) {
+               DHD_WAKE_SPIN_LOCK(&dhd->wakelock_spinlock, flags);
+
+               /* dhd_wakelock_waive/dhd_wakelock_restore must be paired */
+               if (dhd->waive_wakelock == FALSE) {
+#ifdef DHD_TRACE_WAKE_LOCK
+                       if (atomic_read(&trace_wklock_onoff)) {
+                               STORE_WKLOCK_RECORD(DHD_WAIVE_LOCK);
+                       }
+#endif /* DHD_TRACE_WAKE_LOCK */
+                       /* record current lock status */
+                       dhd->wakelock_before_waive = dhd->wakelock_counter;
+                       dhd->waive_wakelock = TRUE;
+               }
+               ret = dhd->wakelock_wd_counter;
+               DHD_WAKE_SPIN_UNLOCK(&dhd->wakelock_spinlock, flags);
+       }
+       return ret;
+}
+
+int dhd_os_wake_lock_restore(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+       int ret = 0;
+
+       if (!dhd)
+               return 0;
+       if ((dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT) == 0)
+               return 0;
+
+       DHD_WAKE_SPIN_LOCK(&dhd->wakelock_spinlock, flags);
+
+       /* dhd_wakelock_waive/dhd_wakelock_restore must be paired */
+       if (!dhd->waive_wakelock)
+               goto exit;
+
+       dhd->waive_wakelock = FALSE;
+       /* if somebody else acquires wakelock between dhd_wakelock_waive/dhd_wakelock_restore,
+        * we need to make it up by calling wake_lock or pm_stay_awake. or if somebody releases
+        * the lock in between, do the same by calling wake_unlock or pm_relax
+        */
+#ifdef DHD_TRACE_WAKE_LOCK
+       if (atomic_read(&trace_wklock_onoff)) {
+               STORE_WKLOCK_RECORD(DHD_RESTORE_LOCK);
+       }
+#endif /* DHD_TRACE_WAKE_LOCK */
+
+       if (dhd->wakelock_before_waive == 0 && dhd->wakelock_counter > 0) {
+#ifdef CONFIG_HAS_WAKELOCK
+               wake_lock(&dhd->wl_wifi);
+#elif defined(BCMSDIO)
+               dhd_bus_dev_pm_stay_awake(&dhd->pub);
+#endif
+       } else if (dhd->wakelock_before_waive > 0 && dhd->wakelock_counter == 0) {
+#ifdef CONFIG_HAS_WAKELOCK
+               wake_unlock(&dhd->wl_wifi);
+#elif defined(BCMSDIO)
+               dhd_bus_dev_pm_relax(&dhd->pub);
+#endif
+       }
+       dhd->wakelock_before_waive = 0;
+exit:
+       ret = dhd->wakelock_wd_counter;
+       DHD_WAKE_SPIN_UNLOCK(&dhd->wakelock_spinlock, flags);
+       return ret;
+}
+
+void dhd_os_wake_lock_init(struct dhd_info *dhd)
+{
+       DHD_TRACE(("%s: initialize wake_lock_counters\n", __FUNCTION__));
+       dhd->wakelock_counter = 0;
+       dhd->wakelock_rx_timeout_enable = 0;
+       dhd->wakelock_ctrl_timeout_enable = 0;
+       /* wakelocks prevent a system from going into a low power state */
+#ifdef CONFIG_HAS_WAKELOCK
+       // terence 20161023: can not destroy wl_wifi when wlan down, it will happen null pointer in dhd_ioctl_entry
+       wake_lock_init(&dhd->wl_rxwake, WAKE_LOCK_SUSPEND, "wlan_rx_wake");
+       wake_lock_init(&dhd->wl_ctrlwake, WAKE_LOCK_SUSPEND, "wlan_ctrl_wake");
+       wake_lock_init(&dhd->wl_evtwake, WAKE_LOCK_SUSPEND, "wlan_evt_wake");
+       wake_lock_init(&dhd->wl_pmwake, WAKE_LOCK_SUSPEND, "wlan_pm_wake");
+       wake_lock_init(&dhd->wl_txflwake, WAKE_LOCK_SUSPEND, "wlan_txfl_wake");
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       wake_lock_init(&dhd->wl_intrwake, WAKE_LOCK_SUSPEND, "wlan_oob_irq_wake");
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef DHD_USE_SCAN_WAKELOCK
+       wake_lock_init(&dhd->wl_scanwake, WAKE_LOCK_SUSPEND, "wlan_scan_wake");
+#endif /* DHD_USE_SCAN_WAKELOCK */
+       wake_lock_init(&dhd->wl_nanwake, WAKE_LOCK_SUSPEND, "wlan_nan_wake");
+#endif /* CONFIG_HAS_WAKELOCK */
+#ifdef DHD_TRACE_WAKE_LOCK
+       dhd_wk_lock_trace_init(dhd);
+#endif /* DHD_TRACE_WAKE_LOCK */
+}
+
+void dhd_os_wake_lock_destroy(struct dhd_info *dhd)
+{
+       DHD_TRACE(("%s: deinit wake_lock_counters\n", __FUNCTION__));
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd->wakelock_counter = 0;
+       dhd->wakelock_rx_timeout_enable = 0;
+       dhd->wakelock_ctrl_timeout_enable = 0;
+       // terence 20161023: can not destroy wl_wifi when wlan down, it will happen null pointer in dhd_ioctl_entry
+       wake_lock_destroy(&dhd->wl_rxwake);
+       wake_lock_destroy(&dhd->wl_ctrlwake);
+       wake_lock_destroy(&dhd->wl_evtwake);
+       wake_lock_destroy(&dhd->wl_pmwake);
+       wake_lock_destroy(&dhd->wl_txflwake);
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       wake_lock_destroy(&dhd->wl_intrwake);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef DHD_USE_SCAN_WAKELOCK
+       wake_lock_destroy(&dhd->wl_scanwake);
+#endif /* DHD_USE_SCAN_WAKELOCK */
+       wake_lock_destroy(&dhd->wl_nanwake);
+#ifdef DHD_TRACE_WAKE_LOCK
+       dhd_wk_lock_trace_deinit(dhd);
+#endif /* DHD_TRACE_WAKE_LOCK */
+#else /* !CONFIG_HAS_WAKELOCK */
+       if (dhd->wakelock_counter > 0) {
+               DHD_ERROR(("%s: wake lock count=%d\n",
+                       __FUNCTION__, dhd->wakelock_counter));
+               while (dhd_os_wake_unlock(&dhd->pub));
+       }
+#endif /* CONFIG_HAS_WAKELOCK */
+}
+
+bool dhd_os_check_if_up(dhd_pub_t *pub)
+{
+       if (!pub)
+               return FALSE;
+       return pub->up;
+}
+
+/* function to collect firmware, chip id and chip version info */
+void dhd_set_version_info(dhd_pub_t *dhdp, char *fw)
+{
+       int i;
+
+       i = snprintf(info_string, sizeof(info_string),
+               "  Driver: %s\n  Firmware: %s\n  CLM: %s ", EPI_VERSION_STR, fw, clm_version);
+       printf("%s\n", info_string);
+
+       if (!dhdp)
+               return;
+
+       i = snprintf(&info_string[i], sizeof(info_string) - i,
+               "\n  Chip: %x Rev %x", dhd_conf_get_chip(dhdp),
+               dhd_conf_get_chiprev(dhdp));
+}
+
+int dhd_ioctl_entry_local(struct net_device *net, wl_ioctl_t *ioc, int cmd)
+{
+       int ifidx;
+       int ret = 0;
+       dhd_info_t *dhd = NULL;
+
+       if (!net || !DEV_PRIV(net)) {
+               DHD_ERROR(("%s invalid parameter net %p dev_priv %p\n",
+                       __FUNCTION__, net, DEV_PRIV(net)));
+               return -EINVAL;
+       }
+
+       dhd = DHD_DEV_INFO(net);
+       if (!dhd)
+               return -EINVAL;
+
+       ifidx = dhd_net2idx(dhd, net);
+       if (ifidx == DHD_BAD_IF) {
+               DHD_ERROR(("%s bad ifidx\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+
+       ret = dhd_wl_ioctl(&dhd->pub, ifidx, ioc, ioc->buf, ioc->len);
+       dhd_check_hang(net, &dhd->pub, ret);
+
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+       return ret;
+}
+
+bool dhd_os_check_hang(dhd_pub_t *dhdp, int ifidx, int ret)
+{
+       struct net_device *net;
+
+       net = dhd_idx2net(dhdp, ifidx);
+       if (!net) {
+               DHD_ERROR(("%s : Invalid index : %d\n", __FUNCTION__, ifidx));
+               return -EINVAL;
+       }
+
+       return dhd_check_hang(net, dhdp, ret);
+}
+
+/* Return instance */
+int dhd_get_instance(dhd_pub_t *dhdp)
+{
+       return dhdp->info->unit;
+}
+
+#if defined(WL_CFG80211) && defined(SUPPORT_DEEP_SLEEP)
+#define MAX_TRY_CNT             5 /* Number of tries to disable deepsleep */
+int dhd_deepsleep(struct net_device *dev, int flag)
+{
+       char iovbuf[20];
+       uint powervar = 0;
+       dhd_info_t *dhd;
+       dhd_pub_t *dhdp;
+       int cnt = 0;
+       int ret = 0;
+
+       dhd = DHD_DEV_INFO(dev);
+       dhdp = &dhd->pub;
+
+       switch (flag) {
+               case 1 :  /* Deepsleep on */
+                       DHD_ERROR(("[WiFi] Deepsleep On\n"));
+                       /* give some time to sysioc_work before deepsleep */
+                       OSL_SLEEP(200);
+#ifdef PKT_FILTER_SUPPORT
+               /* disable pkt filter */
+               dhd_enable_packet_filter(0, dhdp);
+#endif /* PKT_FILTER_SUPPORT */
+                       /* Disable MPC */
+                       powervar = 0;
+                       ret = dhd_iovar(dhdp, 0, "mpc", (char *)&powervar, sizeof(powervar), NULL,
+                                       0, TRUE);
+                       if (ret) {
+                               DHD_ERROR(("%s: mpc failed:%d\n", __FUNCTION__, ret));
+                       }
+                       /* Enable Deepsleep */
+                       powervar = 1;
+                       ret = dhd_iovar(dhdp, 0, "deepsleep", (char *)&powervar, sizeof(powervar),
+                                       NULL, 0, TRUE);
+                       if (ret) {
+                               DHD_ERROR(("%s: deepsleep failed:%d\n", __FUNCTION__, ret));
+                       }
+                       break;
+
+               case 0: /* Deepsleep Off */
+                       DHD_ERROR(("[WiFi] Deepsleep Off\n"));
+
+                       /* Disable Deepsleep */
+                       for (cnt = 0; cnt < MAX_TRY_CNT; cnt++) {
+                               powervar = 0;
+                               ret = dhd_iovar(dhdp, 0, "deepsleep", (char *)&powervar,
+                                               sizeof(powervar), NULL, 0, TRUE);
+                               if (ret) {
+                                       DHD_ERROR(("%s: deepsleep failed:%d\n", __FUNCTION__, ret));
+                               }
+
+                               ret = dhd_iovar(dhdp, 0, "deepsleep", (char *)&powervar,
+                                               sizeof(powervar), iovbuf, sizeof(iovbuf), FALSE);
+                               if (ret < 0) {
+                                       DHD_ERROR(("the error of dhd deepsleep status"
+                                               " ret value :%d\n", ret));
+                               } else {
+                                       if (!(*(int *)iovbuf)) {
+                                               DHD_ERROR(("deepsleep mode is 0,"
+                                                       " count: %d\n", cnt));
+                                               break;
+                                       }
+                               }
+                       }
+
+                       /* Enable MPC */
+                       powervar = 1;
+                       ret = dhd_iovar(dhdp, 0, "mpc", (char *)&powervar, sizeof(powervar),
+                                       NULL, 0, TRUE);
+                       if (ret) {
+                               DHD_ERROR(("%s: mpc failed:%d\n", __FUNCTION__, ret));
+                       }
+                       break;
+       }
+
+       return 0;
+}
+#endif /* WL_CFG80211 && SUPPORT_DEEP_SLEEP */
+
+#ifdef PROP_TXSTATUS
+
+void dhd_wlfc_plat_init(void *dhd)
+{
+#ifdef USE_DYNAMIC_F2_BLKSIZE
+       dhdsdio_func_blocksize((dhd_pub_t *)dhd, 2, DYNAMIC_F2_BLKSIZE_FOR_NONLEGACY);
+#endif /* USE_DYNAMIC_F2_BLKSIZE */
+       return;
+}
+
+void dhd_wlfc_plat_deinit(void *dhd)
+{
+#ifdef USE_DYNAMIC_F2_BLKSIZE
+       dhdsdio_func_blocksize((dhd_pub_t *)dhd, 2, sd_f2_blocksize);
+#endif /* USE_DYNAMIC_F2_BLKSIZE */
+       return;
+}
+
+bool dhd_wlfc_skip_fc(void * dhdp, uint8 idx)
+{
+#ifdef SKIP_WLFC_ON_CONCURRENT
+
+#ifdef WL_CFG80211
+       struct net_device * net =  dhd_idx2net((dhd_pub_t *)dhdp, idx);
+       if (net)
+       /* enable flow control in vsdb mode */
+       return !(wl_cfg80211_is_concurrent_mode(net));
+#else
+       return TRUE; /* skip flow control */
+#endif /* WL_CFG80211 */
+
+#else
+       return FALSE;
+#endif /* SKIP_WLFC_ON_CONCURRENT */
+       return FALSE;
+}
+#endif /* PROP_TXSTATUS */
+
+#ifdef BCMDBGFS
+#include <linux/debugfs.h>
+
+typedef struct dhd_dbgfs {
+       struct dentry   *debugfs_dir;
+       struct dentry   *debugfs_mem;
+       dhd_pub_t       *dhdp;
+       uint32          size;
+} dhd_dbgfs_t;
+
+dhd_dbgfs_t g_dbgfs;
+
+extern uint32 dhd_readregl(void *bp, uint32 addr);
+extern uint32 dhd_writeregl(void *bp, uint32 addr, uint32 data);
+
+static int
+dhd_dbg_state_open(struct inode *inode, struct file *file)
+{
+       file->private_data = inode->i_private;
+       return 0;
+}
+
+static ssize_t
+dhd_dbg_state_read(struct file *file, char __user *ubuf,
+                       size_t count, loff_t *ppos)
+{
+       ssize_t rval;
+       uint32 tmp;
+       loff_t pos = *ppos;
+       size_t ret;
+
+       if (pos < 0)
+               return -EINVAL;
+       if (pos >= g_dbgfs.size || !count)
+               return 0;
+       if (count > g_dbgfs.size - pos)
+               count = g_dbgfs.size - pos;
+
+       /* XXX: The user can request any length they want, but they are getting 4 bytes */
+       /* Basically enforce aligned 4 byte reads. It's up to the user to work out the details */
+       tmp = dhd_readregl(g_dbgfs.dhdp->bus, file->f_pos & (~3));
+
+       ret = copy_to_user(ubuf, &tmp, 4);
+       if (ret == count)
+               return -EFAULT;
+
+       count -= ret;
+       *ppos = pos + count;
+       rval = count;
+
+       return rval;
+}
+
+static ssize_t
+dhd_debugfs_write(struct file *file, const char __user *ubuf, size_t count, loff_t *ppos)
+{
+       loff_t pos = *ppos;
+       size_t ret;
+       uint32 buf;
+
+       if (pos < 0)
+               return -EINVAL;
+       if (pos >= g_dbgfs.size || !count)
+               return 0;
+       if (count > g_dbgfs.size - pos)
+               count = g_dbgfs.size - pos;
+
+       ret = copy_from_user(&buf, ubuf, sizeof(uint32));
+       if (ret == count)
+               return -EFAULT;
+
+       /* XXX: The user can request any length they want, but they are getting 4 bytes */
+       /* Basically enforce aligned 4 byte writes. It's up to the user to work out the details */
+       dhd_writeregl(g_dbgfs.dhdp->bus, file->f_pos & (~3), buf);
+
+       return count;
+}
+
+loff_t
+dhd_debugfs_lseek(struct file *file, loff_t off, int whence)
+{
+       loff_t pos = -1;
+
+       switch (whence) {
+               case 0:
+                       pos = off;
+                       break;
+               case 1:
+                       pos = file->f_pos + off;
+                       break;
+               case 2:
+                       pos = g_dbgfs.size - off;
+       }
+       return (pos < 0 || pos > g_dbgfs.size) ? -EINVAL : (file->f_pos = pos);
+}
+
+static const struct file_operations dhd_dbg_state_ops = {
+       .read   = dhd_dbg_state_read,
+       .write  = dhd_debugfs_write,
+       .open   = dhd_dbg_state_open,
+       .llseek = dhd_debugfs_lseek
+};
+
+static void dhd_dbgfs_create(void)
+{
+       if (g_dbgfs.debugfs_dir) {
+               g_dbgfs.debugfs_mem = debugfs_create_file("mem", 0644, g_dbgfs.debugfs_dir,
+                       NULL, &dhd_dbg_state_ops);
+       }
+}
+
+void dhd_dbgfs_init(dhd_pub_t *dhdp)
+{
+       g_dbgfs.dhdp = dhdp;
+       g_dbgfs.size = 0x20000000; /* Allow access to various cores regs */
+
+       g_dbgfs.debugfs_dir = debugfs_create_dir("dhd", 0);
+       if (IS_ERR(g_dbgfs.debugfs_dir)) {
+               g_dbgfs.debugfs_dir = NULL;
+               return;
+       }
+
+       dhd_dbgfs_create();
+
+       return;
+}
+
+void dhd_dbgfs_remove(void)
+{
+       debugfs_remove(g_dbgfs.debugfs_mem);
+       debugfs_remove(g_dbgfs.debugfs_dir);
+
+       bzero((unsigned char *) &g_dbgfs, sizeof(g_dbgfs));
+}
+#endif /* BCMDBGFS */
+
+#ifdef CUSTOM_SET_CPUCORE
+void dhd_set_cpucore(dhd_pub_t *dhd, int set)
+{
+       int e_dpc = 0, e_rxf = 0, retry_set = 0;
+
+       if (!(dhd->chan_isvht80)) {
+               DHD_ERROR(("%s: chan_status(%d) cpucore!!!\n", __FUNCTION__, dhd->chan_isvht80));
+               return;
+       }
+
+       if (DPC_CPUCORE) {
+               do {
+                       if (set == TRUE) {
+                               e_dpc = set_cpus_allowed_ptr(dhd->current_dpc,
+                                       cpumask_of(DPC_CPUCORE));
+                       } else {
+                               e_dpc = set_cpus_allowed_ptr(dhd->current_dpc,
+                                       cpumask_of(PRIMARY_CPUCORE));
+                       }
+                       if (retry_set++ > MAX_RETRY_SET_CPUCORE) {
+                               DHD_ERROR(("%s: dpc(%d) invalid cpu!\n", __FUNCTION__, e_dpc));
+                               return;
+                       }
+                       if (e_dpc < 0)
+                               OSL_SLEEP(1);
+               } while (e_dpc < 0);
+       }
+       if (RXF_CPUCORE) {
+               do {
+                       if (set == TRUE) {
+                               e_rxf = set_cpus_allowed_ptr(dhd->current_rxf,
+                                       cpumask_of(RXF_CPUCORE));
+                       } else {
+                               e_rxf = set_cpus_allowed_ptr(dhd->current_rxf,
+                                       cpumask_of(PRIMARY_CPUCORE));
+                       }
+                       if (retry_set++ > MAX_RETRY_SET_CPUCORE) {
+                               DHD_ERROR(("%s: rxf(%d) invalid cpu!\n", __FUNCTION__, e_rxf));
+                               return;
+                       }
+                       if (e_rxf < 0)
+                               OSL_SLEEP(1);
+               } while (e_rxf < 0);
+       }
+       DHD_TRACE(("%s: set(%d) cpucore success!\n", __FUNCTION__, set));
+
+       return;
+}
+#endif /* CUSTOM_SET_CPUCORE */
+
+#ifdef DHD_MCAST_REGEN
+/* Get interface specific ap_isolate configuration */
+int dhd_get_mcast_regen_bss_enable(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       return ifp->mcast_regen_bss_enable;
+}
+
+/* Set interface specific mcast_regen configuration */
+int dhd_set_mcast_regen_bss_enable(dhd_pub_t *dhdp, uint32 idx, int val)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       ifp->mcast_regen_bss_enable = val;
+
+       /* Disable rx_pkt_chain feature for interface, if mcast_regen feature
+        * is enabled
+        */
+       dhd_update_rx_pkt_chainable_state(dhdp, idx);
+       return BCME_OK;
+}
+#endif /* DHD_MCAST_REGEN */
+
+/* Get interface specific ap_isolate configuration */
+int dhd_get_ap_isolate(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       return ifp->ap_isolate;
+}
+
+/* Set interface specific ap_isolate configuration */
+int dhd_set_ap_isolate(dhd_pub_t *dhdp, uint32 idx, int val)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       if (ifp)
+               ifp->ap_isolate = val;
+
+       return 0;
+}
+
+#ifdef DHD_FW_COREDUMP
+void dhd_schedule_memdump(dhd_pub_t *dhdp, uint8 *buf, uint32 size)
+{
+       dhd_dump_t *dump = NULL;
+       unsigned long flags = 0;
+       dhd_info_t *dhd_info = NULL;
+#if defined(DHD_LOG_DUMP) && !defined(DHD_DUMP_FILE_WRITE_FROM_KERNEL)
+       log_dump_type_t type = DLD_BUF_TYPE_ALL;
+#endif /* DHD_LOG_DUMP && !DHD_DUMP_FILE_WRITE_FROM_KERNEL */
+
+       dhd_info = (dhd_info_t *)dhdp->info;
+       dump = (dhd_dump_t *)MALLOC(dhdp->osh, sizeof(dhd_dump_t));
+       if (dump == NULL) {
+               DHD_ERROR(("%s: dhd dump memory allocation failed\n", __FUNCTION__));
+               return;
+       }
+       dump->buf = buf;
+       dump->bufsize = size;
+#ifdef BCMPCIE
+       dhd_get_hscb_info(dhdp, (void*)(&dump->hscb_buf),
+                       (uint32 *)(&dump->hscb_bufsize));
+#else
+       dump->hscb_bufsize = 0;
+#endif /* BCMPCIE */
+
+#ifdef DHD_LOG_DUMP
+       dhd_print_buf_addr(dhdp, "memdump", buf, size);
+#if !defined(DHD_DUMP_FILE_WRITE_FROM_KERNEL)
+       /* Print out buffer infomation */
+       dhd_log_dump_buf_addr(dhdp, &type);
+#endif /* !DHD_DUMP_FILE_WRITE_FROM_KERNEL */
+#endif /* DHD_LOG_DUMP */
+
+       if (dhdp->memdump_enabled == DUMP_MEMONLY) {
+               BUG_ON(1);
+       }
+
+       if ((dhdp->memdump_type == DUMP_TYPE_DONGLE_INIT_FAILURE) ||
+               (dhdp->memdump_type == DUMP_TYPE_DUE_TO_BT) ||
+               (dhdp->memdump_type == DUMP_TYPE_SMMU_FAULT))
+       {
+               dhd_info->scheduled_memdump = FALSE;
+               (void)dhd_mem_dump((void *)dhdp->info, (void *)dump, 0);
+               /* No need to collect debug dump for init failure */
+               if (dhdp->memdump_type == DUMP_TYPE_DONGLE_INIT_FAILURE) {
+                       return;
+               }
+#ifdef DHD_LOG_DUMP
+               {
+                       log_dump_type_t *flush_type = NULL;
+                       /* for dongle init fail cases, 'dhd_mem_dump' does
+                        * not call 'dhd_log_dump', so call it here.
+                       */
+                       flush_type = MALLOCZ(dhdp->osh,
+                               sizeof(log_dump_type_t));
+                       if (flush_type) {
+                               *flush_type = DLD_BUF_TYPE_ALL;
+                               DHD_ERROR(("%s: calling log dump.. \n", __FUNCTION__));
+                               dhd_log_dump(dhdp->info, flush_type, 0);
+                       }
+               }
+#endif /* DHD_LOG_DUMP */
+               return;
+       }
+
+       dhd_info->scheduled_memdump = TRUE;
+
+       /* bus busy bit for mem dump will be cleared in mem dump
+       * work item context, after mem dump file is written
+       */
+       DHD_GENERAL_LOCK(dhdp, flags);
+       DHD_BUS_BUSY_SET_IN_MEMDUMP(dhdp);
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+       DHD_ERROR(("%s: scheduling mem dump.. \n", __FUNCTION__));
+       dhd_deferred_schedule_work(dhdp->info->dhd_deferred_wq, (void *)dump,
+               DHD_WQ_WORK_SOC_RAM_DUMP, (void *)dhd_mem_dump, DHD_WQ_WORK_PRIORITY_HIGH);
+}
+
+static int
+dhd_mem_dump(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+       dhd_pub_t *dhdp = NULL;
+       unsigned long flags = 0;
+       int ret = 0;
+       dhd_dump_t *dump = NULL;
+
+       DHD_ERROR(("%s: ENTER \n", __FUNCTION__));
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       dhdp = &dhd->pub;
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       DHD_GENERAL_LOCK(dhdp, flags);
+       if (DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(dhdp)) {
+               DHD_GENERAL_UNLOCK(dhdp, flags);
+               DHD_ERROR(("%s: bus is down! can't collect mem dump. \n", __FUNCTION__));
+               ret = -ENODEV;
+               goto exit;
+       }
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+
+#ifdef DHD_SDTC_ETB_DUMP
+       if (dhdp->collect_sdtc) {
+               dhd_sdtc_etb_dump(dhdp);
+               dhdp->collect_sdtc = FALSE;
+       }
+#endif /* DHD_SDTC_ETB_DUMP */
+
+#ifdef DHD_SSSR_DUMP
+       if (sssr_enab && dhdp->sssr_inited && dhdp->collect_sssr) {
+               if (fis_enab && dhdp->sssr_reg_info->rev3.fis_enab) {
+                       int bcmerror = dhd_bus_fis_trigger(dhdp);
+
+                       if (bcmerror == BCME_OK) {
+                               dhd_bus_fis_dump(dhdp);
+                       } else {
+                               DHD_ERROR(("%s: FIS trigger failed: %d\n",
+                                       __FUNCTION__, bcmerror));
+                       }
+               } else  {
+                       DHD_ERROR(("%s: FIS not enabled (%d:%d), collect legacy sssr\n",
+                               __FUNCTION__, fis_enab, dhdp->sssr_reg_info->rev3.fis_enab));
+                       dhdpcie_sssr_dump(dhdp);
+               }
+       }
+       dhdp->collect_sssr = FALSE;
+#endif /* DHD_SSSR_DUMP */
+#if defined(WL_CFG80211) && defined(DHD_FILE_DUMP_EVENT)
+       dhd_wait_for_file_dump(dhdp);
+#endif /* WL_CFG80211 && DHD_FILE_DUMP_EVENT */
+
+       dump = (dhd_dump_t *)event_info;
+       if (!dump) {
+               DHD_ERROR(("%s: dump is NULL\n", __FUNCTION__));
+               ret = -EINVAL;
+               goto exit;
+       }
+
+       /*
+        * If kernel does not have file write access enabled
+        * then skip writing dumps to files.
+        * The dumps will be pushed to HAL layer which will
+        * write into files
+        */
+#ifdef DHD_DUMP_FILE_WRITE_FROM_KERNEL
+
+       if (write_dump_to_file(&dhd->pub, dump->buf, dump->bufsize, "mem_dump")) {
+               DHD_ERROR(("%s: writing SoC_RAM dump to the file failed\n", __FUNCTION__));
+#ifdef DHD_DEBUG_UART
+               dhd->pub.memdump_success = FALSE;
+#endif /* DHD_DEBUG_UART */
+       }
+
+       if (dump->hscb_buf && dump->hscb_bufsize) {
+               if (write_dump_to_file(&dhd->pub, dump->hscb_buf,
+                       dump->hscb_bufsize, "mem_dump_hscb")) {
+                       DHD_ERROR(("%s: writing HSCB dump to the file failed\n", __FUNCTION__));
+#ifdef DHD_DEBUG_UART
+                       dhd->pub.memdump_success = FALSE;
+#endif /* DHD_DEBUG_UART */
+               }
+       }
+
+#ifndef DHD_PKT_LOGGING
+       clear_debug_dump_time(dhdp->debug_dump_time_str);
+#endif /* !DHD_PKT_LOGGING */
+
+       /* directly call dhd_log_dump for debug_dump collection from the mem_dump work queue
+       * context, no need to schedule another work queue for log dump. In case of
+       * user initiated DEBUG_DUMP wpa_cli command (DUMP_TYPE_BY_SYSDUMP),
+       * cfg layer is itself scheduling the log_dump work queue.
+       * that path is not disturbed. If 'dhd_mem_dump' is called directly then we will not
+       * collect debug_dump as it may be called from non-sleepable context.
+       */
+#ifdef DHD_LOG_DUMP
+       if (dhd->scheduled_memdump &&
+               dhdp->memdump_type != DUMP_TYPE_BY_SYSDUMP) {
+               log_dump_type_t *flush_type = MALLOCZ(dhdp->osh,
+                               sizeof(log_dump_type_t));
+               if (flush_type) {
+                       *flush_type = DLD_BUF_TYPE_ALL;
+                       DHD_ERROR(("%s: calling log dump.. \n", __FUNCTION__));
+                       dhd_log_dump(dhd, flush_type, 0);
+               }
+       }
+#endif /* DHD_LOG_DUMP */
+
+       /* before calling bug on, wait for other logs to be dumped.
+       * we cannot wait in case dhd_mem_dump is called directly
+       * as it may not be from a sleepable context
+       */
+       if (dhd->scheduled_memdump) {
+               uint bitmask = 0;
+               int timeleft = 0;
+#ifdef DHD_SSSR_DUMP
+               bitmask |= DHD_BUS_BUSY_IN_SSSRDUMP;
+#endif
+               if (bitmask != 0) {
+                       DHD_ERROR(("%s: wait to clear dhd_bus_busy_state: 0x%x\n",
+                               __FUNCTION__, dhdp->dhd_bus_busy_state));
+                       timeleft = dhd_os_busbusy_wait_bitmask(dhdp,
+                                       &dhdp->dhd_bus_busy_state, bitmask, 0);
+                       if ((timeleft == 0) || (timeleft == 1)) {
+                               DHD_ERROR(("%s: Timed out dhd_bus_busy_state=0x%x\n",
+                                       __FUNCTION__, dhdp->dhd_bus_busy_state));
+                       }
+               }
+       }
+#endif /* DHD_DUMP_FILE_WRITE_FROM_KERNEL */
+
+       if (dhd->pub.memdump_enabled == DUMP_MEMFILE_BUGON &&
+#ifdef DHD_LOG_DUMP
+               dhd->pub.memdump_type != DUMP_TYPE_BY_SYSDUMP &&
+#endif /* DHD_LOG_DUMP */
+               dhd->pub.memdump_type != DUMP_TYPE_BY_USER &&
+#ifdef DHD_DEBUG_UART
+               dhd->pub.memdump_success == TRUE &&
+#endif /* DHD_DEBUG_UART */
+#ifdef DNGL_EVENT_SUPPORT
+               dhd->pub.memdump_type != DUMP_TYPE_DONGLE_HOST_EVENT &&
+#endif /* DNGL_EVENT_SUPPORT */
+               dhd->pub.memdump_type != DUMP_TYPE_CFG_VENDOR_TRIGGERED) {
+#ifdef SHOW_LOGTRACE
+               /* Wait till logtrace context is flushed */
+               dhd_flush_logtrace_process(dhd);
+#endif /* SHOW_LOGTRACE */
+
+#ifdef EWP_EDL
+               cancel_delayed_work_sync(&dhd->edl_dispatcher_work);
+#endif
+
+               BUG_ON(1);
+       }
+
+exit:
+       if (dump) {
+               MFREE(dhd->pub.osh, dump, sizeof(dhd_dump_t));
+       }
+       DHD_GENERAL_LOCK(dhdp, flags);
+       DHD_BUS_BUSY_CLEAR_IN_MEMDUMP(&dhd->pub);
+       dhd_os_busbusy_wake(dhdp);
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+       dhd->scheduled_memdump = FALSE;
+
+       if (dhdp->hang_was_pending) {
+               DHD_ERROR(("%s: Send pending HANG event...\n", __FUNCTION__));
+               dhd_os_send_hang_message(dhdp);
+               dhdp->hang_was_pending = 0;
+       }
+       DHD_ERROR(("%s: EXIT \n", __FUNCTION__));
+
+       return ret;
+}
+#endif /* DHD_FW_COREDUMP */
+
+#ifdef DHD_SSSR_DUMP
+uint
+dhd_sssr_dig_buf_size(dhd_pub_t *dhdp)
+{
+       uint dig_buf_size = 0;
+
+       /* SSSR register information structure v0 and v1 shares most except dig_mem */
+       switch (dhdp->sssr_reg_info->rev2.version) {
+               case SSSR_REG_INFO_VER_3:
+                       /* intentional fall through */
+               case SSSR_REG_INFO_VER_2 :
+                       if ((dhdp->sssr_reg_info->rev2.length >
+                        OFFSETOF(sssr_reg_info_v2_t, dig_mem_info)) &&
+                        dhdp->sssr_reg_info->rev2.dig_mem_info.dig_sr_size) {
+                               dig_buf_size = dhdp->sssr_reg_info->rev2.dig_mem_info.dig_sr_size;
+                       }
+                       break;
+               case SSSR_REG_INFO_VER_1 :
+                       if (dhdp->sssr_reg_info->rev1.vasip_regs.vasip_sr_size) {
+                               dig_buf_size = dhdp->sssr_reg_info->rev1.vasip_regs.vasip_sr_size;
+                       } else if ((dhdp->sssr_reg_info->rev1.length >
+                        OFFSETOF(sssr_reg_info_v1_t, dig_mem_info)) &&
+                        dhdp->sssr_reg_info->rev1.dig_mem_info.dig_sr_size) {
+                               dig_buf_size = dhdp->sssr_reg_info->rev1.dig_mem_info.dig_sr_size;
+                       }
+                       break;
+               case SSSR_REG_INFO_VER_0 :
+                       if (dhdp->sssr_reg_info->rev0.vasip_regs.vasip_sr_size) {
+                               dig_buf_size = dhdp->sssr_reg_info->rev0.vasip_regs.vasip_sr_size;
+                       }
+                       break;
+               default :
+                       DHD_ERROR(("invalid sssr_reg_ver"));
+                       return BCME_UNSUPPORTED;
+       }
+
+       return dig_buf_size;
+}
+
+uint
+dhd_sssr_dig_buf_addr(dhd_pub_t *dhdp)
+{
+       uint dig_buf_addr = 0;
+
+       /* SSSR register information structure v0 and v1 shares most except dig_mem */
+       switch (dhdp->sssr_reg_info->rev2.version) {
+               case SSSR_REG_INFO_VER_3 :
+                       /* intentional fall through */
+               case SSSR_REG_INFO_VER_2 :
+                       if ((dhdp->sssr_reg_info->rev2.length >
+                        OFFSETOF(sssr_reg_info_v2_t, dig_mem_info)) &&
+                        dhdp->sssr_reg_info->rev2.dig_mem_info.dig_sr_size) {
+                               dig_buf_addr = dhdp->sssr_reg_info->rev2.dig_mem_info.dig_sr_addr;
+                       }
+                       break;
+               case SSSR_REG_INFO_VER_1 :
+                       if (dhdp->sssr_reg_info->rev1.vasip_regs.vasip_sr_size) {
+                               dig_buf_addr = dhdp->sssr_reg_info->rev1.vasip_regs.vasip_sr_addr;
+                       } else if ((dhdp->sssr_reg_info->rev1.length >
+                        OFFSETOF(sssr_reg_info_v1_t, dig_mem_info)) &&
+                        dhdp->sssr_reg_info->rev1.dig_mem_info.dig_sr_size) {
+                               dig_buf_addr = dhdp->sssr_reg_info->rev1.dig_mem_info.dig_sr_addr;
+                       }
+                       break;
+               case SSSR_REG_INFO_VER_0 :
+                       if (dhdp->sssr_reg_info->rev0.vasip_regs.vasip_sr_size) {
+                               dig_buf_addr = dhdp->sssr_reg_info->rev0.vasip_regs.vasip_sr_addr;
+                       }
+                       break;
+               default :
+                       DHD_ERROR(("invalid sssr_reg_ver"));
+                       return BCME_UNSUPPORTED;
+       }
+
+       return dig_buf_addr;
+}
+
+uint
+dhd_sssr_mac_buf_size(dhd_pub_t *dhdp, uint8 core_idx)
+{
+       uint mac_buf_size = 0;
+       uint8 num_d11cores;
+
+       num_d11cores = dhd_d11_slices_num_get(dhdp);
+
+       /* SSSR register information structure v0 and v1 shares most except dig_mem */
+       if (core_idx < num_d11cores) {
+               switch (dhdp->sssr_reg_info->rev2.version) {
+                       case SSSR_REG_INFO_VER_3 :
+                               /* intentional fall through */
+                       case SSSR_REG_INFO_VER_2 :
+                               mac_buf_size = dhdp->sssr_reg_info->rev2.mac_regs[core_idx].sr_size;
+                               break;
+                       case SSSR_REG_INFO_VER_1 :
+                               mac_buf_size = dhdp->sssr_reg_info->rev1.mac_regs[core_idx].sr_size;
+                               break;
+                       case SSSR_REG_INFO_VER_0 :
+                               mac_buf_size = dhdp->sssr_reg_info->rev0.mac_regs[core_idx].sr_size;
+                               break;
+                       default :
+                               DHD_ERROR(("invalid sssr_reg_ver"));
+                               return BCME_UNSUPPORTED;
+               }
+       }
+
+       return mac_buf_size;
+}
+
+uint
+dhd_sssr_mac_xmtaddress(dhd_pub_t *dhdp, uint8 core_idx)
+{
+       uint xmtaddress = 0;
+       uint8 num_d11cores;
+
+       num_d11cores = dhd_d11_slices_num_get(dhdp);
+
+       /* SSSR register information structure v0 and v1 shares most except dig_mem */
+       if (core_idx < num_d11cores) {
+               switch (dhdp->sssr_reg_info->rev2.version) {
+                       case SSSR_REG_INFO_VER_3 :
+                               /* intentional fall through */
+                       case SSSR_REG_INFO_VER_2 :
+                               xmtaddress = dhdp->sssr_reg_info->rev2.
+                                       mac_regs[core_idx].base_regs.xmtaddress;
+                               break;
+                       case SSSR_REG_INFO_VER_1 :
+                               xmtaddress = dhdp->sssr_reg_info->rev1.
+                                       mac_regs[core_idx].base_regs.xmtaddress;
+                               break;
+                       case SSSR_REG_INFO_VER_0 :
+                               xmtaddress = dhdp->sssr_reg_info->rev0.
+                                       mac_regs[core_idx].base_regs.xmtaddress;
+                               break;
+                       default :
+                               DHD_ERROR(("invalid sssr_reg_ver"));
+                               return BCME_UNSUPPORTED;
+               }
+       }
+
+       return xmtaddress;
+}
+
+uint
+dhd_sssr_mac_xmtdata(dhd_pub_t *dhdp, uint8 core_idx)
+{
+       uint xmtdata = 0;
+       uint8 num_d11cores;
+
+       num_d11cores = dhd_d11_slices_num_get(dhdp);
+
+       /* SSSR register information structure v0 and v1 shares most except dig_mem */
+       if (core_idx < num_d11cores) {
+               switch (dhdp->sssr_reg_info->rev2.version) {
+                       case SSSR_REG_INFO_VER_3 :
+                               /* intentional fall through */
+                       case SSSR_REG_INFO_VER_2 :
+                               xmtdata = dhdp->sssr_reg_info->rev2.
+                                       mac_regs[core_idx].base_regs.xmtdata;
+                               break;
+                       case SSSR_REG_INFO_VER_1 :
+                               xmtdata = dhdp->sssr_reg_info->rev1.
+                                       mac_regs[core_idx].base_regs.xmtdata;
+                               break;
+                       case SSSR_REG_INFO_VER_0 :
+                               xmtdata = dhdp->sssr_reg_info->rev0.
+                                       mac_regs[core_idx].base_regs.xmtdata;
+                               break;
+                       default :
+                               DHD_ERROR(("invalid sssr_reg_ver"));
+                               return BCME_UNSUPPORTED;
+               }
+       }
+
+       return xmtdata;
+}
+
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+int
+dhd_sssr_dump_dig_buf_before(void *dev, const void *user_buf, uint32 len)
+{
+       dhd_info_t *dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)dev);
+       dhd_pub_t *dhdp = &dhd_info->pub;
+       int pos = 0, ret = BCME_ERROR;
+       uint dig_buf_size = 0;
+
+       dig_buf_size = dhd_sssr_dig_buf_size(dhdp);
+
+       if (dhdp->sssr_dig_buf_before && (dhdp->sssr_dump_mode == SSSR_DUMP_MODE_SSSR)) {
+               ret = dhd_export_debug_data((char *)dhdp->sssr_dig_buf_before,
+                       NULL, user_buf, dig_buf_size, &pos);
+       }
+       return ret;
+}
+
+int
+dhd_sssr_dump_d11_buf_before(void *dev, const void *user_buf, uint32 len, int core)
+{
+       dhd_info_t *dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)dev);
+       dhd_pub_t *dhdp = &dhd_info->pub;
+       int pos = 0, ret = BCME_ERROR;
+
+       if (dhdp->sssr_d11_before[core] &&
+               dhdp->sssr_d11_outofreset[core] &&
+               (dhdp->sssr_dump_mode == SSSR_DUMP_MODE_SSSR)) {
+               ret = dhd_export_debug_data((char *)dhdp->sssr_d11_before[core],
+                       NULL, user_buf, len, &pos);
+       }
+       return ret;
+}
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+int
+dhd_sssr_dump_dig_buf_after(void *dev, const void *user_buf, uint32 len)
+{
+       dhd_info_t *dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)dev);
+       dhd_pub_t *dhdp = &dhd_info->pub;
+       int pos = 0, ret = BCME_ERROR;
+       uint dig_buf_size = 0;
+
+       dig_buf_size = dhd_sssr_dig_buf_size(dhdp);
+
+       if (dhdp->sssr_dig_buf_after) {
+               ret = dhd_export_debug_data((char *)dhdp->sssr_dig_buf_after,
+                       NULL, user_buf, dig_buf_size, &pos);
+       }
+       return ret;
+}
+
+int
+dhd_sssr_dump_d11_buf_after(void *dev, const void *user_buf, uint32 len, int core)
+{
+       dhd_info_t *dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)dev);
+       dhd_pub_t *dhdp = &dhd_info->pub;
+       int pos = 0, ret = BCME_ERROR;
+
+       if (dhdp->sssr_d11_after[core] &&
+               dhdp->sssr_d11_outofreset[core]) {
+               ret = dhd_export_debug_data((char *)dhdp->sssr_d11_after[core],
+                       NULL, user_buf, len, &pos);
+       }
+       return ret;
+}
+
+void
+dhd_sssr_dump_to_file(dhd_info_t* dhdinfo)
+{
+       dhd_info_t *dhd = dhdinfo;
+       dhd_pub_t *dhdp;
+       int i;
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+       char before_sr_dump[128];
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+       char after_sr_dump[128];
+       unsigned long flags = 0;
+       uint dig_buf_size = 0;
+       uint8 num_d11cores = 0;
+       uint d11_buf_size = 0;
+
+       DHD_ERROR(("%s: ENTER \n", __FUNCTION__));
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       dhdp = &dhd->pub;
+
+       DHD_GENERAL_LOCK(dhdp, flags);
+       DHD_BUS_BUSY_SET_IN_SSSRDUMP(dhdp);
+       if (DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(dhdp)) {
+               DHD_GENERAL_UNLOCK(dhdp, flags);
+               DHD_ERROR(("%s: bus is down! can't collect sssr dump. \n", __FUNCTION__));
+               goto exit;
+       }
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+
+       num_d11cores = dhd_d11_slices_num_get(dhdp);
+
+       for (i = 0; i < num_d11cores; i++) {
+               /* Init file name */
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+               memset(before_sr_dump, 0, sizeof(before_sr_dump));
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+               memset(after_sr_dump, 0, sizeof(after_sr_dump));
+
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+               snprintf(before_sr_dump, sizeof(before_sr_dump), "%s_%d_%s",
+                       "sssr_dump_core", i, "before_SR");
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+               snprintf(after_sr_dump, sizeof(after_sr_dump), "%s_%d_%s",
+                       "sssr_dump_core", i, "after_SR");
+
+               d11_buf_size = dhd_sssr_mac_buf_size(dhdp, i);
+
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+               if (dhdp->sssr_d11_before[i] && dhdp->sssr_d11_outofreset[i] &&
+                       (dhdp->sssr_dump_mode == SSSR_DUMP_MODE_SSSR)) {
+                       if (write_dump_to_file(dhdp, (uint8 *)dhdp->sssr_d11_before[i],
+                               d11_buf_size, before_sr_dump)) {
+                               DHD_ERROR(("%s: writing SSSR MAIN dump before to the file failed\n",
+                                       __FUNCTION__));
+                       }
+               }
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+               if (dhdp->sssr_d11_after[i] && dhdp->sssr_d11_outofreset[i]) {
+                       if (write_dump_to_file(dhdp, (uint8 *)dhdp->sssr_d11_after[i],
+                               d11_buf_size, after_sr_dump)) {
+                               DHD_ERROR(("%s: writing SSSR AUX dump after to the file failed\n",
+                                       __FUNCTION__));
+                       }
+               }
+       }
+
+       dig_buf_size = dhd_sssr_dig_buf_size(dhdp);
+
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+       if (dhdp->sssr_dig_buf_before && (dhdp->sssr_dump_mode == SSSR_DUMP_MODE_SSSR)) {
+               if (write_dump_to_file(dhdp, (uint8 *)dhdp->sssr_dig_buf_before,
+                       dig_buf_size, "sssr_dump_dig_before_SR")) {
+                       DHD_ERROR(("%s: writing SSSR Dig dump before to the file failed\n",
+                               __FUNCTION__));
+               }
+       }
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+       if (dhdp->sssr_dig_buf_after) {
+               if (write_dump_to_file(dhdp, (uint8 *)dhdp->sssr_dig_buf_after,
+                       dig_buf_size, "sssr_dump_dig_after_SR")) {
+                       DHD_ERROR(("%s: writing SSSR Dig VASIP dump after to the file failed\n",
+                        __FUNCTION__));
+               }
+       }
+
+exit:
+       DHD_GENERAL_LOCK(dhdp, flags);
+       DHD_BUS_BUSY_CLEAR_IN_SSSRDUMP(dhdp);
+       dhd_os_busbusy_wake(dhdp);
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+}
+
+void
+dhd_write_sssr_dump(dhd_pub_t *dhdp, uint32 dump_mode)
+{
+#if defined(DHD_DUMP_FILE_WRITE_FROM_KERNEL)
+       dhdp->sssr_dump_mode = dump_mode;
+#endif /* DHD_DUMP_FILE_WRITE_FROM_KERNEL */
+
+       /*
+        * If kernel does not have file write access enabled
+        * then skip writing dumps to files.
+        * The dumps will be pushed to HAL layer which will
+        * write into files
+        */
+#if !defined(DHD_DUMP_FILE_WRITE_FROM_KERNEL)
+       return;
+#else
+       /*
+        * dhd_mem_dump -> dhd_sssr_dump -> dhd_write_sssr_dump
+        * Without workqueue -
+        * DUMP_TYPE_DONGLE_INIT_FAILURE/DUMP_TYPE_DUE_TO_BT/DUMP_TYPE_SMMU_FAULT
+        * : These are called in own handler, not in the interrupt context
+        * With workqueue - all other DUMP_TYPEs : dhd_mem_dump is called in workqueue
+        * Thus, it doesn't neeed to dump SSSR in workqueue
+        */
+       DHD_ERROR(("%s: writing sssr dump to file... \n", __FUNCTION__));
+       dhd_sssr_dump_to_file(dhdp->info);
+#endif /* !DHD_DUMP_FILE_WRITE_FROM_KERNEL */
+}
+#endif /* DHD_SSSR_DUMP */
+
+#ifdef DHD_SDTC_ETB_DUMP
+void
+dhd_sdtc_etb_dump(dhd_pub_t *dhd)
+{
+       etb_info_t etb_info;
+       uint8 *sdtc_etb_dump;
+       uint8 *sdtc_etb_mempool;
+       uint etb_dump_len;
+       int ret = 0;
+
+       if (!dhd->sdtc_etb_inited) {
+               DHD_ERROR(("%s, SDTC ETB dump not supported\n", __FUNCTION__));
+               return;
+       }
+
+       bzero(&etb_info, sizeof(etb_info));
+
+       if ((ret = dhd_bus_get_etb_info(dhd, dhd->etb_addr_info.etbinfo_addr, &etb_info))) {
+               DHD_ERROR(("%s: failed to get etb info %d\n", __FUNCTION__, ret));
+               return;
+       }
+
+       if (etb_info.read_bytes == 0) {
+               DHD_ERROR(("%s ETB is of zero size. Hence donot collect SDTC ETB\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_ERROR(("%s etb_info ver:%d len:%d rwp:%d etb_full:%d etb:addr:0x%x, len:%d\n",
+               __FUNCTION__, etb_info.version, etb_info.len,
+               etb_info.read_write_p, etb_info.etb_full,
+               etb_info.addr, etb_info.read_bytes));
+
+       /*
+        * etb mempool format = etb_info + etb
+        */
+       etb_dump_len = etb_info.read_bytes + sizeof(etb_info);
+       if (etb_dump_len > DHD_SDTC_ETB_MEMPOOL_SIZE) {
+               DHD_ERROR(("%s etb_dump_len: %d is more than the alloced %d.Hence cannot collect\n",
+                       __FUNCTION__, etb_dump_len, DHD_SDTC_ETB_MEMPOOL_SIZE));
+               return;
+       }
+       sdtc_etb_mempool = dhd->sdtc_etb_mempool;
+       memcpy(sdtc_etb_mempool, &etb_info, sizeof(etb_info));
+       sdtc_etb_dump = sdtc_etb_mempool + sizeof(etb_info);
+       if ((ret = dhd_bus_get_sdtc_etb(dhd, sdtc_etb_dump, etb_info.addr, etb_info.read_bytes))) {
+               DHD_ERROR(("%s: error to get SDTC ETB ret: %d\n", __FUNCTION__, ret));
+               return;
+       }
+
+       if (write_dump_to_file(dhd, (uint8 *)sdtc_etb_mempool,
+               etb_dump_len, "sdtc_etb_dump")) {
+               DHD_ERROR(("%s: failed to dump sdtc_etb to file\n",
+                       __FUNCTION__));
+       }
+}
+#endif /* DHD_SDTC_ETB_DUMP */
+
+#ifdef DHD_LOG_DUMP
+static void
+dhd_log_dump(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+       log_dump_type_t *type = (log_dump_type_t *)event_info;
+
+       if (!dhd || !type) {
+               DHD_ERROR(("%s: dhd/type is NULL\n", __FUNCTION__));
+               return;
+       }
+
+#ifdef WL_CFG80211
+       /* flush the fw preserve logs */
+       wl_flush_fw_log_buffer(dhd_linux_get_primary_netdev(&dhd->pub),
+               FW_LOGSET_MASK_ALL);
+#endif
+
+       /* there are currently 3 possible contexts from which
+        * log dump can be scheduled -
+        * 1.TRAP 2.supplicant DEBUG_DUMP pvt driver command
+        * 3.HEALTH CHECK event
+        * The concise debug info buffer is a shared resource
+        * and in case a trap is one of the contexts then both the
+        * scheduled work queues need to run because trap data is
+        * essential for debugging. Hence a mutex lock is acquired
+        * before calling do_dhd_log_dump().
+        */
+       DHD_ERROR(("%s: calling log dump.. \n", __FUNCTION__));
+       dhd_os_logdump_lock(&dhd->pub);
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+       if (do_dhd_log_dump(&dhd->pub, type) != BCME_OK) {
+               DHD_ERROR(("%s: writing debug dump to the file failed\n", __FUNCTION__));
+       }
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+       dhd_os_logdump_unlock(&dhd->pub);
+}
+
+void dhd_schedule_log_dump(dhd_pub_t *dhdp, void *type)
+{
+       DHD_ERROR(("%s: scheduling log dump.. \n", __FUNCTION__));
+
+       dhd_deferred_schedule_work(dhdp->info->dhd_deferred_wq,
+               type, DHD_WQ_WORK_DHD_LOG_DUMP,
+               dhd_log_dump, DHD_WQ_WORK_PRIORITY_HIGH);
+}
+
+static void
+dhd_print_buf_addr(dhd_pub_t *dhdp, char *name, void *buf, unsigned int size)
+{
+#ifdef DHD_FW_COREDUMP
+       if ((dhdp->memdump_enabled == DUMP_MEMONLY) ||
+               (dhdp->memdump_enabled == DUMP_MEMFILE_BUGON) ||
+               (dhdp->memdump_type == DUMP_TYPE_SMMU_FAULT) ||
+#ifdef DHD_DETECT_CONSECUTIVE_MFG_HANG
+               (dhdp->op_mode & DHD_FLAG_MFG_MODE &&
+                       (dhdp->hang_count >= MAX_CONSECUTIVE_MFG_HANG_COUNT-1)) ||
+#endif /* DHD_DETECT_CONSECUTIVE_MFG_HANG */
+               FALSE)
+#else
+       if (dhdp->memdump_type == DUMP_TYPE_SMMU_FAULT)
+#endif
+       {
+#if defined(CONFIG_ARM64)
+               DHD_ERROR(("-------- %s: buf(va)=%llx, buf(pa)=%llx, bufsize=%d\n",
+                       name, (uint64)buf, (uint64)__virt_to_phys((ulong)buf), size));
+#elif defined(__ARM_ARCH_7A__)
+               DHD_ERROR(("-------- %s: buf(va)=%x, buf(pa)=%x, bufsize=%d\n",
+                       name, (uint32)buf, (uint32)__virt_to_phys((ulong)buf), size));
+#endif /* __ARM_ARCH_7A__ */
+       }
+}
+
+static void
+dhd_log_dump_buf_addr(dhd_pub_t *dhdp, log_dump_type_t *type)
+{
+       int i;
+       unsigned long wr_size = 0;
+       struct dhd_log_dump_buf *dld_buf = &g_dld_buf[0];
+       size_t log_size = 0;
+       char buf_name[DHD_PRINT_BUF_NAME_LEN];
+       dhd_dbg_ring_t *ring = NULL;
+
+       BCM_REFERENCE(ring);
+
+       for (i = 0; i < DLD_BUFFER_NUM; i++) {
+               dld_buf = &g_dld_buf[i];
+               log_size = (unsigned long)dld_buf->max -
+                       (unsigned long)dld_buf->buffer;
+               if (dld_buf->wraparound) {
+                       wr_size = log_size;
+               } else {
+                       wr_size = (unsigned long)dld_buf->present -
+                               (unsigned long)dld_buf->front;
+               }
+               scnprintf(buf_name, sizeof(buf_name), "dlb_buf[%d]", i);
+               dhd_print_buf_addr(dhdp, buf_name, dld_buf, dld_buf_size[i]);
+               scnprintf(buf_name, sizeof(buf_name), "dlb_buf[%d] buffer", i);
+               dhd_print_buf_addr(dhdp, buf_name, dld_buf->buffer, wr_size);
+               scnprintf(buf_name, sizeof(buf_name), "dlb_buf[%d] present", i);
+               dhd_print_buf_addr(dhdp, buf_name, dld_buf->present, wr_size);
+               scnprintf(buf_name, sizeof(buf_name), "dlb_buf[%d] front", i);
+               dhd_print_buf_addr(dhdp, buf_name, dld_buf->front, wr_size);
+       }
+
+#ifdef DEBUGABILITY_ECNTRS_LOGGING
+       /* periodic flushing of ecounters is NOT supported */
+       if (*type == DLD_BUF_TYPE_ALL &&
+                       logdump_ecntr_enable &&
+                       dhdp->ecntr_dbg_ring) {
+
+               ring = (dhd_dbg_ring_t *)dhdp->ecntr_dbg_ring;
+               dhd_print_buf_addr(dhdp, "ecntr_dbg_ring", ring, LOG_DUMP_ECNTRS_MAX_BUFSIZE);
+               dhd_print_buf_addr(dhdp, "ecntr_dbg_ring ring_buf", ring->ring_buf,
+                               LOG_DUMP_ECNTRS_MAX_BUFSIZE);
+       }
+#endif /* DEBUGABILITY_ECNTRS_LOGGING */
+
+#if defined(BCMPCIE)
+       if (dhdp->dongle_trap_occured && dhdp->extended_trap_data) {
+               dhd_print_buf_addr(dhdp, "extended_trap_data", dhdp->extended_trap_data,
+                               BCMPCIE_EXT_TRAP_DATA_MAXLEN);
+       }
+#endif /* BCMPCIE */
+
+#if defined(DHD_FW_COREDUMP) && defined(DNGL_EVENT_SUPPORT)
+       /* if health check event was received */
+       if (dhdp->memdump_type == DUMP_TYPE_DONGLE_HOST_EVENT) {
+               dhd_print_buf_addr(dhdp, "health_chk_event_data", dhdp->health_chk_event_data,
+                               HEALTH_CHK_BUF_SIZE);
+       }
+#endif /* DHD_FW_COREDUMP && DNGL_EVENT_SUPPORT */
+
+       /* append the concise debug information */
+       if (dhdp->concise_dbg_buf) {
+               dhd_print_buf_addr(dhdp, "concise_dbg_buf", dhdp->concise_dbg_buf,
+                               CONCISE_DUMP_BUFLEN);
+       }
+}
+
+#ifdef CUSTOMER_HW4_DEBUG
+static void
+dhd_log_dump_print_to_kmsg(char *bufptr, unsigned long len)
+{
+       char tmp_buf[DHD_LOG_DUMP_MAX_TEMP_BUFFER_SIZE + 1];
+       char *end = NULL;
+       unsigned long plen = 0;
+
+       if (!bufptr || !len)
+               return;
+
+       memset(tmp_buf, 0, DHD_LOG_DUMP_MAX_TEMP_BUFFER_SIZE);
+       end = bufptr + len;
+       while (bufptr < end) {
+               if ((bufptr + DHD_LOG_DUMP_MAX_TEMP_BUFFER_SIZE) < end) {
+                       memcpy(tmp_buf, bufptr, DHD_LOG_DUMP_MAX_TEMP_BUFFER_SIZE);
+                       tmp_buf[DHD_LOG_DUMP_MAX_TEMP_BUFFER_SIZE] = '\0';
+                       printf("%s", tmp_buf);
+                       bufptr += DHD_LOG_DUMP_MAX_TEMP_BUFFER_SIZE;
+               } else {
+                       plen = (unsigned long)end - (unsigned long)bufptr;
+                       memcpy(tmp_buf, bufptr, plen);
+                       tmp_buf[plen] = '\0';
+                       printf("%s", tmp_buf);
+                       bufptr += plen;
+               }
+       }
+}
+
+static void
+dhd_log_dump_print_tail(dhd_pub_t *dhdp,
+               struct dhd_log_dump_buf *dld_buf,
+               uint tail_len)
+{
+       char *flush_ptr1 = NULL, *flush_ptr2 = NULL;
+       unsigned long len_flush1 = 0, len_flush2 = 0;
+       unsigned long flags = 0;
+
+       /* need to hold the lock before accessing 'present' and 'remain' ptrs */
+       DHD_LOG_DUMP_BUF_LOCK(&dld_buf->lock, flags);
+       flush_ptr1 = dld_buf->present - tail_len;
+       if (flush_ptr1 >= dld_buf->front) {
+               /* tail content is within the buffer */
+               flush_ptr2 = NULL;
+               len_flush1 = tail_len;
+       } else if (dld_buf->wraparound) {
+               /* tail content spans the buffer length i.e, wrap around */
+               flush_ptr1 = dld_buf->front;
+               len_flush1 = (unsigned long)dld_buf->present - (unsigned long)flush_ptr1;
+               len_flush2 = (unsigned long)tail_len - len_flush1;
+               flush_ptr2 = (char *)((unsigned long)dld_buf->max -
+                       (unsigned long)len_flush2);
+       } else {
+               /* amt of logs in buffer is less than tail size */
+               flush_ptr1 = dld_buf->front;
+               flush_ptr2 = NULL;
+               len_flush1 = (unsigned long)dld_buf->present - (unsigned long)dld_buf->front;
+       }
+       DHD_LOG_DUMP_BUF_UNLOCK(&dld_buf->lock, flags);
+
+       printf("\n================= LOG_DUMP tail =================\n");
+       if (flush_ptr2) {
+               dhd_log_dump_print_to_kmsg(flush_ptr2, len_flush2);
+       }
+       dhd_log_dump_print_to_kmsg(flush_ptr1, len_flush1);
+       printf("\n===================================================\n");
+}
+#endif /* CUSTOMER_HW4_DEBUG */
+
+#ifdef DHD_SSSR_DUMP
+int
+dhdpcie_sssr_dump_get_before_after_len(dhd_pub_t *dhd, uint32 *arr_len)
+{
+       int i = 0;
+       uint dig_buf_size = 0;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       /* core 0 */
+       i = 0;
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+       if (dhd->sssr_d11_before[i] && dhd->sssr_d11_outofreset[i] &&
+               (dhd->sssr_dump_mode == SSSR_DUMP_MODE_SSSR)) {
+
+               arr_len[SSSR_C0_D11_BEFORE]  = dhd_sssr_mac_buf_size(dhd, i);
+               DHD_ERROR(("%s: arr_len[SSSR_C0_D11_BEFORE] : %d\n", __FUNCTION__,
+                       arr_len[SSSR_C0_D11_BEFORE]));
+#ifdef DHD_LOG_DUMP
+               dhd_print_buf_addr(dhd, "SSSR_C0_D11_BEFORE",
+                       dhd->sssr_d11_before[i], arr_len[SSSR_C0_D11_BEFORE]);
+#endif /* DHD_LOG_DUMP */
+       }
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+       if (dhd->sssr_d11_after[i] && dhd->sssr_d11_outofreset[i]) {
+               arr_len[SSSR_C0_D11_AFTER]  = dhd_sssr_mac_buf_size(dhd, i);
+               DHD_ERROR(("%s: arr_len[SSSR_C0_D11_AFTER] : %d\n", __FUNCTION__,
+                       arr_len[SSSR_C0_D11_AFTER]));
+#ifdef DHD_LOG_DUMP
+               dhd_print_buf_addr(dhd, "SSSR_C0_D11_AFTER",
+                       dhd->sssr_d11_after[i], arr_len[SSSR_C0_D11_AFTER]);
+#endif /* DHD_LOG_DUMP */
+       }
+
+       /* core 1 */
+       i = 1;
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+       if (dhd->sssr_d11_before[i] && dhd->sssr_d11_outofreset[i] &&
+               (dhd->sssr_dump_mode == SSSR_DUMP_MODE_SSSR)) {
+               arr_len[SSSR_C1_D11_BEFORE]  = dhd_sssr_mac_buf_size(dhd, i);
+               DHD_ERROR(("%s: arr_len[SSSR_C1_D11_BEFORE] : %d\n", __FUNCTION__,
+                       arr_len[SSSR_C1_D11_BEFORE]));
+#ifdef DHD_LOG_DUMP
+               dhd_print_buf_addr(dhd, "SSSR_C1_D11_BEFORE",
+                       dhd->sssr_d11_before[i], arr_len[SSSR_C1_D11_BEFORE]);
+#endif /* DHD_LOG_DUMP */
+       }
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+       if (dhd->sssr_d11_after[i] && dhd->sssr_d11_outofreset[i]) {
+               arr_len[SSSR_C1_D11_AFTER]  = dhd_sssr_mac_buf_size(dhd, i);
+               DHD_ERROR(("%s: arr_len[SSSR_C1_D11_AFTER] : %d\n", __FUNCTION__,
+                       arr_len[SSSR_C1_D11_AFTER]));
+#ifdef DHD_LOG_DUMP
+               dhd_print_buf_addr(dhd, "SSSR_C1_D11_AFTER",
+                       dhd->sssr_d11_after[i], arr_len[SSSR_C1_D11_AFTER]);
+#endif /* DHD_LOG_DUMP */
+       }
+
+       /* core 2 scan core */
+       if (dhd->sssr_reg_info->rev2.version >= SSSR_REG_INFO_VER_2) {
+               i = 2;
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+               if (dhd->sssr_d11_before[i] && dhd->sssr_d11_outofreset[i] &&
+                       (dhd->sssr_dump_mode == SSSR_DUMP_MODE_SSSR)) {
+                       arr_len[SSSR_C2_D11_BEFORE]  = dhd_sssr_mac_buf_size(dhd, i);
+                       DHD_ERROR(("%s: arr_len[SSSR_C2_D11_BEFORE] : %d\n", __FUNCTION__,
+                               arr_len[SSSR_C2_D11_BEFORE]));
+#ifdef DHD_LOG_DUMP
+                       dhd_print_buf_addr(dhd, "SSSR_C2_D11_BEFORE",
+                               dhd->sssr_d11_before[i], arr_len[SSSR_C2_D11_BEFORE]);
+#endif /* DHD_LOG_DUMP */
+               }
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+               if (dhd->sssr_d11_after[i] && dhd->sssr_d11_outofreset[i]) {
+                       arr_len[SSSR_C2_D11_AFTER]  = dhd_sssr_mac_buf_size(dhd, i);
+                       DHD_ERROR(("%s: arr_len[SSSR_C2_D11_AFTER] : %d\n", __FUNCTION__,
+                               arr_len[SSSR_C2_D11_AFTER]));
+#ifdef DHD_LOG_DUMP
+                       dhd_print_buf_addr(dhd, "SSSR_C2_D11_AFTER",
+                               dhd->sssr_d11_after[i], arr_len[SSSR_C2_D11_AFTER]);
+#endif /* DHD_LOG_DUMP */
+               }
+       }
+
+       /* DIG core or VASIP */
+       dig_buf_size = dhd_sssr_dig_buf_size(dhd);
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+       arr_len[SSSR_DIG_BEFORE] = (dhd->sssr_dig_buf_before) ? dig_buf_size : 0;
+       DHD_ERROR(("%s: arr_len[SSSR_DIG_BEFORE] : %d\n", __FUNCTION__,
+               arr_len[SSSR_DIG_BEFORE]));
+#ifdef DHD_LOG_DUMP
+               if (dhd->sssr_dig_buf_before) {
+                       dhd_print_buf_addr(dhd, "SSSR_DIG_BEFORE",
+                               dhd->sssr_dig_buf_before, arr_len[SSSR_DIG_BEFORE]);
+               }
+#endif /* DHD_LOG_DUMP */
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+       arr_len[SSSR_DIG_AFTER] = (dhd->sssr_dig_buf_after) ? dig_buf_size : 0;
+       DHD_ERROR(("%s: arr_len[SSSR_DIG_AFTER] : %d\n", __FUNCTION__,
+               arr_len[SSSR_DIG_AFTER]));
+#ifdef DHD_LOG_DUMP
+       if (dhd->sssr_dig_buf_after) {
+               dhd_print_buf_addr(dhd, "SSSR_DIG_AFTER",
+                       dhd->sssr_dig_buf_after, arr_len[SSSR_DIG_AFTER]);
+       }
+#endif /* DHD_LOG_DUMP */
+
+       return BCME_OK;
+}
+
+void
+dhd_nla_put_sssr_dump_len(void *ndev, uint32 *arr_len)
+{
+       dhd_info_t *dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)ndev);
+       dhd_pub_t *dhdp = &dhd_info->pub;
+
+       if (dhdp->sssr_dump_collected) {
+               dhdpcie_sssr_dump_get_before_after_len(dhdp, arr_len);
+       }
+}
+#endif /* DHD_SSSR_DUMP */
+
+uint32
+dhd_get_time_str_len()
+{
+       char *ts = NULL, time_str[128];
+
+       ts = dhd_log_dump_get_timestamp();
+       snprintf(time_str, sizeof(time_str),
+                       "\n\n ========== LOG DUMP TAKEN AT : %s =========\n", ts);
+       return strlen(time_str);
+}
+
+#if defined(BCMPCIE)
+uint32
+dhd_get_ext_trap_len(void *ndev, dhd_pub_t *dhdp)
+{
+       int length = 0;
+       log_dump_section_hdr_t sec_hdr;
+       dhd_info_t *dhd_info;
+
+       if (ndev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)ndev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp)
+               return length;
+
+       if (dhdp->extended_trap_data) {
+               length = (strlen(EXT_TRAP_LOG_HDR)
+                                       + sizeof(sec_hdr) + BCMPCIE_EXT_TRAP_DATA_MAXLEN);
+       }
+       return length;
+}
+#endif /* BCMPCIE */
+
+#if defined(DHD_FW_COREDUMP) && defined(DNGL_EVENT_SUPPORT)
+uint32
+dhd_get_health_chk_len(void *ndev, dhd_pub_t *dhdp)
+{
+       int length = 0;
+       log_dump_section_hdr_t sec_hdr;
+       dhd_info_t *dhd_info;
+
+       if (ndev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)ndev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp)
+               return length;
+
+       if (dhdp->memdump_type == DUMP_TYPE_DONGLE_HOST_EVENT) {
+               length = (strlen(HEALTH_CHK_LOG_HDR)
+                       + sizeof(sec_hdr) + HEALTH_CHK_BUF_SIZE);
+       }
+       return length;
+}
+#endif /* DHD_FW_COREDUMP && DNGL_EVENT_SUPPORT */
+
+uint32
+dhd_get_dhd_dump_len(void *ndev, dhd_pub_t *dhdp)
+{
+       uint32 length = 0;
+       log_dump_section_hdr_t sec_hdr;
+       dhd_info_t *dhd_info;
+       int remain_len = 0;
+
+       if (ndev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)ndev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp)
+               return length;
+
+       if (dhdp->concise_dbg_buf) {
+               remain_len = dhd_dump(dhdp, (char *)dhdp->concise_dbg_buf, CONCISE_DUMP_BUFLEN);
+                if (remain_len <= 0 || remain_len >= CONCISE_DUMP_BUFLEN) {
+                       DHD_ERROR(("%s: error getting concise debug info !\n",
+                                       __FUNCTION__));
+                       return length;
+               }
+
+               length += (uint32)(CONCISE_DUMP_BUFLEN - remain_len);
+       }
+
+       length += (uint32)(strlen(DHD_DUMP_LOG_HDR) + sizeof(sec_hdr));
+       return length;
+}
+
+uint32
+dhd_get_cookie_log_len(void *ndev, dhd_pub_t *dhdp)
+{
+       int length = 0;
+       dhd_info_t *dhd_info;
+
+       if (ndev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)ndev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp)
+               return length;
+
+       if (dhdp->logdump_cookie && dhd_logdump_cookie_count(dhdp) > 0) {
+               length = dhd_log_dump_cookie_len(dhdp);
+       }
+       return length;
+
+}
+
+#ifdef DHD_DUMP_PCIE_RINGS
+uint32
+dhd_get_flowring_len(void *ndev, dhd_pub_t *dhdp)
+{
+       uint32 length = 0;
+       log_dump_section_hdr_t sec_hdr;
+       dhd_info_t *dhd_info;
+       uint16 h2d_flowrings_total;
+       int remain_len = 0;
+
+       if (ndev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)ndev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp)
+               return length;
+
+       if (dhdp->concise_dbg_buf) {
+               remain_len = dhd_dump(dhdp, (char *)dhdp->concise_dbg_buf, CONCISE_DUMP_BUFLEN);
+               if (remain_len <= 0 || remain_len >= CONCISE_DUMP_BUFLEN) {
+                       DHD_ERROR(("%s: error getting concise debug info !\n",
+                               __FUNCTION__));
+                  return length;
+               }
+
+               length += (uint32)(CONCISE_DUMP_BUFLEN - remain_len);
+       }
+
+       length += (uint32) strlen(FLOWRING_DUMP_HDR);
+       length += (uint32) sizeof(sec_hdr);
+       h2d_flowrings_total = dhd_get_max_flow_rings(dhdp);
+       length += ((D2HRING_TXCMPLT_ITEMSIZE * D2HRING_TXCMPLT_MAX_ITEM)
+                               + (H2DRING_RXPOST_ITEMSIZE * H2DRING_RXPOST_MAX_ITEM)
+                               + (D2HRING_RXCMPLT_ITEMSIZE * D2HRING_RXCMPLT_MAX_ITEM)
+                               + (H2DRING_CTRL_SUB_ITEMSIZE * H2DRING_CTRL_SUB_MAX_ITEM)
+                               + (D2HRING_CTRL_CMPLT_ITEMSIZE * D2HRING_CTRL_CMPLT_MAX_ITEM)
+#ifdef EWP_EDL
+                               + (D2HRING_EDL_HDR_SIZE * D2HRING_EDL_MAX_ITEM));
+#else
+                               + (H2DRING_INFO_BUFPOST_ITEMSIZE * H2DRING_DYNAMIC_INFO_MAX_ITEM)
+                               + (D2HRING_INFO_BUFCMPLT_ITEMSIZE * D2HRING_DYNAMIC_INFO_MAX_ITEM));
+#endif /* EWP_EDL */
+
+#if defined(DHD_HTPUT_TUNABLES)
+       /* flowring lengths are different for HTPUT rings, handle accordingly */
+       length += ((H2DRING_TXPOST_ITEMSIZE * dhd_prot_get_h2d_htput_max_txpost(dhdp) *
+               HTPUT_TOTAL_FLOW_RINGS) +
+               (H2DRING_TXPOST_ITEMSIZE * dhd_prot_get_h2d_max_txpost(dhdp) *
+               (h2d_flowrings_total - HTPUT_TOTAL_FLOW_RINGS)));
+#else
+       length += (H2DRING_TXPOST_ITEMSIZE * dhd_prot_get_h2d_max_txpost(dhdp) *
+               h2d_flowrings_total);
+#endif /* DHD_HTPUT_TUNABLES */
+
+       return length;
+}
+#endif /* DHD_DUMP_PCIE_RINGS */
+
+#ifdef EWP_ECNTRS_LOGGING
+uint32
+dhd_get_ecntrs_len(void *ndev, dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd_info;
+       log_dump_section_hdr_t sec_hdr;
+       int length = 0;
+       dhd_dbg_ring_t *ring;
+
+       if (ndev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)ndev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp)
+               return length;
+
+       if (logdump_ecntr_enable && dhdp->ecntr_dbg_ring) {
+               ring = (dhd_dbg_ring_t *)dhdp->ecntr_dbg_ring;
+               length = ring->ring_size + strlen(ECNTRS_LOG_HDR) + sizeof(sec_hdr);
+       }
+       return length;
+}
+#endif /* EWP_ECNTRS_LOGGING */
+
+int
+dhd_get_dld_log_dump(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+       void *fp, uint32 len, int type, void *pos)
+{
+       int ret = BCME_OK;
+       struct dhd_log_dump_buf *dld_buf;
+       log_dump_section_hdr_t sec_hdr;
+       dhd_info_t *dhd_info;
+
+       dld_buf = &g_dld_buf[type];
+
+       if (dev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)dev);
+               dhdp = &dhd_info->pub;
+       } else if (!dhdp) {
+               return BCME_ERROR;
+       }
+
+       DHD_ERROR(("%s: ENTER \n", __FUNCTION__));
+
+       dhd_init_sec_hdr(&sec_hdr);
+
+       /* write the section header first */
+       ret = dhd_export_debug_data(dld_hdrs[type].hdr_str, fp, user_buf,
+               strlen(dld_hdrs[type].hdr_str), pos);
+       if (ret < 0)
+               goto exit;
+       len -= (uint32)strlen(dld_hdrs[type].hdr_str);
+       len -= (uint32)sizeof(sec_hdr);
+       sec_hdr.type = dld_hdrs[type].sec_type;
+       sec_hdr.length = len;
+       ret = dhd_export_debug_data((char *)&sec_hdr, fp, user_buf, sizeof(sec_hdr), pos);
+       if (ret < 0)
+               goto exit;
+       ret = dhd_export_debug_data(dld_buf->buffer, fp, user_buf, len, pos);
+       if (ret < 0)
+               goto exit;
+
+exit:
+       return ret;
+}
+
+static int
+dhd_log_flush(dhd_pub_t *dhdp, log_dump_type_t *type)
+{
+       unsigned long flags = 0;
+#ifdef EWP_EDL
+       int i = 0;
+#endif /* EWP_EDL */
+       dhd_info_t *dhd_info = NULL;
+
+       BCM_REFERENCE(dhd_info);
+
+       /* if dhdp is null, its extremely unlikely that log dump will be scheduled
+        * so not freeing 'type' here is ok, even if we want to free 'type'
+        * we cannot do so, since 'dhdp->osh' is unavailable
+        * as dhdp is null
+        */
+       if (!dhdp || !type) {
+               if (dhdp) {
+                       DHD_GENERAL_LOCK(dhdp, flags);
+                       DHD_BUS_BUSY_CLEAR_IN_LOGDUMP(dhdp);
+                       dhd_os_busbusy_wake(dhdp);
+                       DHD_GENERAL_UNLOCK(dhdp, flags);
+               }
+               return BCME_ERROR;
+       }
+
+#if defined(BCMPCIE)
+       if (dhd_bus_get_linkdown(dhdp)) {
+               /* As link is down donot collect any data over PCIe.
+                * Also return BCME_OK to caller, so that caller can
+                * dump all the outstanding data to file
+                */
+               return BCME_OK;
+       }
+#endif /* BCMPCIE */
+
+       dhd_info = (dhd_info_t *)dhdp->info;
+       /* in case of trap get preserve logs from ETD */
+#if defined(BCMPCIE) && defined(EWP_ETD_PRSRV_LOGS)
+       if (dhdp->dongle_trap_occured &&
+                       dhdp->extended_trap_data) {
+               dhdpcie_get_etd_preserve_logs(dhdp, (uint8 *)dhdp->extended_trap_data,
+                               &dhd_info->event_data);
+       }
+#endif /* BCMPCIE */
+
+       /* flush the event work items to get any fw events/logs
+        * flush_work is a blocking call
+        */
+#ifdef SHOW_LOGTRACE
+#ifdef EWP_EDL
+       if (dhd_info->pub.dongle_edl_support) {
+               /* wait till existing edl items are processed */
+               dhd_flush_logtrace_process(dhd_info);
+               /* dhd_flush_logtrace_process will ensure the work items in the ring
+               * (EDL ring) from rd to wr are processed. But if wr had
+               * wrapped around, only the work items from rd to ring-end are processed.
+               * So to ensure that the work items at the
+               * beginning of ring are also processed in the wrap around case, call
+               * it twice
+               */
+               for (i = 0; i < 2; i++) {
+                       /* blocks till the edl items are processed */
+                       dhd_flush_logtrace_process(dhd_info);
+               }
+       } else {
+               dhd_flush_logtrace_process(dhd_info);
+       }
+#else
+       dhd_flush_logtrace_process(dhd_info);
+#endif /* EWP_EDL */
+#endif /* SHOW_LOGTRACE */
+
+#ifdef CUSTOMER_HW4_DEBUG
+       /* print last 'x' KB of preserve buffer data to kmsg console
+       * this is to address cases where debug_dump is not
+       * available for debugging
+       */
+       dhd_log_dump_print_tail(dhdp,
+               &g_dld_buf[DLD_BUF_TYPE_PRESERVE], logdump_prsrv_tailsize);
+#endif /* CUSTOMER_HW4_DEBUG */
+       return BCME_OK;
+}
+
+int
+dhd_get_debug_dump_file_name(void *dev, dhd_pub_t *dhdp, char *dump_path, int size)
+{
+       dhd_info_t *dhd_info;
+
+       if (dev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)dev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp)
+               return BCME_ERROR;
+
+       memset(dump_path, 0, size);
+
+       switch (dhdp->debug_dump_subcmd) {
+       case CMD_UNWANTED:
+               snprintf(dump_path, size, "%s",
+                       DHD_COMMON_DUMP_PATH DHD_DEBUG_DUMP_TYPE
+                       DHD_DUMP_SUBSTR_UNWANTED);
+               break;
+       case CMD_DISCONNECTED:
+               snprintf(dump_path, size, "%s",
+                       DHD_COMMON_DUMP_PATH DHD_DEBUG_DUMP_TYPE
+                       DHD_DUMP_SUBSTR_DISCONNECTED);
+               break;
+       default:
+               snprintf(dump_path, size, "%s",
+                       DHD_COMMON_DUMP_PATH DHD_DEBUG_DUMP_TYPE);
+       }
+
+       if (!dhdp->logdump_periodic_flush) {
+               get_debug_dump_time(dhdp->debug_dump_time_str);
+               snprintf(dump_path + strlen(dump_path),
+                       size - strlen(dump_path),
+                       "_%s", dhdp->debug_dump_time_str);
+       }
+       return BCME_OK;
+}
+
+uint32
+dhd_get_dld_len(int log_type)
+{
+       unsigned long wr_size = 0;
+       unsigned long buf_size = 0;
+       unsigned long flags = 0;
+       struct dhd_log_dump_buf *dld_buf;
+       log_dump_section_hdr_t sec_hdr;
+
+       /* calculate the length of the log */
+       dld_buf = &g_dld_buf[log_type];
+       buf_size = (unsigned long)dld_buf->max -
+                       (unsigned long)dld_buf->buffer;
+
+       if (dld_buf->wraparound) {
+               wr_size = buf_size;
+       } else {
+               /* need to hold the lock before accessing 'present' and 'remain' ptrs */
+               DHD_LOG_DUMP_BUF_LOCK(&dld_buf->lock, flags);
+               wr_size = (unsigned long)dld_buf->present -
+                               (unsigned long)dld_buf->front;
+               DHD_LOG_DUMP_BUF_UNLOCK(&dld_buf->lock, flags);
+       }
+       return (wr_size + sizeof(sec_hdr) + strlen(dld_hdrs[log_type].hdr_str));
+}
+
+static void
+dhd_get_time_str(dhd_pub_t *dhdp, char *time_str, int size)
+{
+       char *ts = NULL;
+       memset(time_str, 0, size);
+       ts = dhd_log_dump_get_timestamp();
+       snprintf(time_str, size,
+                       "\n\n ========== LOG DUMP TAKEN AT : %s =========\n", ts);
+}
+
+int
+dhd_print_time_str(const void *user_buf, void *fp, uint32 len, void *pos)
+{
+       char *ts = NULL;
+       int ret = 0;
+       char time_str[128];
+
+       memset_s(time_str, sizeof(time_str), 0, sizeof(time_str));
+       ts = dhd_log_dump_get_timestamp();
+       snprintf(time_str, sizeof(time_str),
+                       "\n\n ========== LOG DUMP TAKEN AT : %s =========\n", ts);
+
+       /* write the timestamp hdr to the file first */
+       ret = dhd_export_debug_data(time_str, fp, user_buf, strlen(time_str), pos);
+       if (ret < 0) {
+               DHD_ERROR(("write file error, err = %d\n", ret));
+       }
+       return ret;
+}
+
+#if defined(DHD_FW_COREDUMP) && defined(DNGL_EVENT_SUPPORT)
+int
+dhd_print_health_chk_data(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+       void *fp, uint32 len, void *pos)
+{
+       int ret = BCME_OK;
+       log_dump_section_hdr_t sec_hdr;
+       dhd_info_t *dhd_info;
+
+       if (dev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)dev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp)
+               return BCME_ERROR;
+
+       dhd_init_sec_hdr(&sec_hdr);
+
+       if (dhdp->memdump_type == DUMP_TYPE_DONGLE_HOST_EVENT) {
+               /* write the section header first */
+               ret = dhd_export_debug_data(HEALTH_CHK_LOG_HDR, fp, user_buf,
+                       strlen(HEALTH_CHK_LOG_HDR), pos);
+               if (ret < 0)
+                       goto exit;
+
+               len -= (uint32)strlen(HEALTH_CHK_LOG_HDR);
+               sec_hdr.type = LOG_DUMP_SECTION_HEALTH_CHK;
+               sec_hdr.length = HEALTH_CHK_BUF_SIZE;
+               ret = dhd_export_debug_data((char *)&sec_hdr, fp, user_buf, sizeof(sec_hdr), pos);
+               if (ret < 0)
+                       goto exit;
+
+               len -= (uint32)sizeof(sec_hdr);
+               /* write the log */
+               ret = dhd_export_debug_data((char *)dhdp->health_chk_event_data, fp,
+                       user_buf, len, pos);
+               if (ret < 0)
+                       goto exit;
+       }
+exit:
+       return ret;
+}
+#endif /* DHD_FW_COREDUMP && DNGL_EVENT_SUPPORT */
+
+#if defined(BCMPCIE)
+int
+dhd_print_ext_trap_data(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+       void *fp, uint32 len, void *pos)
+{
+       int ret = BCME_OK;
+       log_dump_section_hdr_t sec_hdr;
+       dhd_info_t *dhd_info;
+
+       if (dev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)dev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp)
+               return BCME_ERROR;
+
+       dhd_init_sec_hdr(&sec_hdr);
+
+       /* append extended trap data to the file in case of traps */
+       if (dhdp->dongle_trap_occured &&
+                       dhdp->extended_trap_data) {
+               /* write the section header first */
+               ret = dhd_export_debug_data(EXT_TRAP_LOG_HDR, fp, user_buf,
+                       strlen(EXT_TRAP_LOG_HDR), pos);
+               if (ret < 0)
+                       goto exit;
+
+               len -= (uint32)strlen(EXT_TRAP_LOG_HDR);
+               sec_hdr.type = LOG_DUMP_SECTION_EXT_TRAP;
+               sec_hdr.length = BCMPCIE_EXT_TRAP_DATA_MAXLEN;
+               ret = dhd_export_debug_data((uint8 *)&sec_hdr, fp, user_buf, sizeof(sec_hdr), pos);
+               if (ret < 0)
+                       goto exit;
+
+               len -= (uint32)sizeof(sec_hdr);
+               /* write the log */
+               ret = dhd_export_debug_data((uint8 *)dhdp->extended_trap_data, fp,
+                       user_buf, len, pos);
+               if (ret < 0)
+                       goto exit;
+       }
+exit:
+       return ret;
+}
+#endif /* BCMPCIE */
+
+int
+dhd_print_dump_data(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+       void *fp, uint32 len, void *pos)
+{
+       int ret = BCME_OK;
+       log_dump_section_hdr_t sec_hdr;
+       dhd_info_t *dhd_info;
+
+       if (dev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)dev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp)
+               return BCME_ERROR;
+
+       dhd_init_sec_hdr(&sec_hdr);
+
+       ret = dhd_export_debug_data(DHD_DUMP_LOG_HDR, fp, user_buf, strlen(DHD_DUMP_LOG_HDR), pos);
+       if (ret < 0)
+               goto exit;
+
+       len -= (uint32)strlen(DHD_DUMP_LOG_HDR);
+       sec_hdr.type = LOG_DUMP_SECTION_DHD_DUMP;
+       sec_hdr.length = len;
+       ret = dhd_export_debug_data((char *)&sec_hdr, fp, user_buf, sizeof(sec_hdr), pos);
+       if (ret < 0)
+               goto exit;
+
+       len -= (uint32)sizeof(sec_hdr);
+
+       if (dhdp->concise_dbg_buf) {
+               dhd_dump(dhdp, (char *)dhdp->concise_dbg_buf, CONCISE_DUMP_BUFLEN);
+               ret = dhd_export_debug_data(dhdp->concise_dbg_buf, fp, user_buf, len, pos);
+               if (ret < 0)
+                       goto exit;
+       }
+
+exit:
+       return ret;
+}
+
+int
+dhd_print_cookie_data(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+       void *fp, uint32 len, void *pos)
+{
+       int ret = BCME_OK;
+       dhd_info_t *dhd_info;
+
+       if (dev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)dev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp)
+               return BCME_ERROR;
+
+       if (dhdp->logdump_cookie && dhd_logdump_cookie_count(dhdp) > 0) {
+               ret = dhd_log_dump_cookie_to_file(dhdp, fp, user_buf, (unsigned long *)pos);
+       }
+       return ret;
+}
+
+#ifdef DHD_DUMP_PCIE_RINGS
+int
+dhd_print_flowring_data(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+               void *fp, uint32 len, void *pos)
+{
+       log_dump_section_hdr_t sec_hdr;
+       int ret = BCME_OK;
+       int remain_len = 0;
+       dhd_info_t *dhd_info;
+
+       if (dev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)dev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp)
+               return BCME_ERROR;
+
+       dhd_init_sec_hdr(&sec_hdr);
+
+       remain_len = dhd_dump(dhdp, (char *)dhdp->concise_dbg_buf, CONCISE_DUMP_BUFLEN);
+       if (remain_len <= 0 || remain_len >= CONCISE_DUMP_BUFLEN) {
+               DHD_ERROR(("%s: error getting concise debug info !\n",
+                       __FUNCTION__));
+          return BCME_ERROR;
+       }
+       memset(dhdp->concise_dbg_buf, 0, CONCISE_DUMP_BUFLEN);
+
+       /* write the section header first */
+       ret = dhd_export_debug_data(FLOWRING_DUMP_HDR, fp, user_buf,
+               strlen(FLOWRING_DUMP_HDR), pos);
+       if (ret < 0)
+               goto exit;
+
+       /* Write the ring summary */
+       ret = dhd_export_debug_data(dhdp->concise_dbg_buf, fp, user_buf,
+               (CONCISE_DUMP_BUFLEN - remain_len), pos);
+       if (ret < 0)
+               goto exit;
+
+       sec_hdr.type = LOG_DUMP_SECTION_FLOWRING;
+       sec_hdr.length = len;
+       ret = dhd_export_debug_data((char *)&sec_hdr, fp, user_buf, sizeof(sec_hdr), pos);
+       if (ret < 0)
+               goto exit;
+
+       /* write the log */
+       ret = dhd_d2h_h2d_ring_dump(dhdp, fp, user_buf, (unsigned long *)pos, TRUE);
+       if (ret < 0)
+               goto exit;
+
+exit:
+       return ret;
+}
+#endif /* DHD_DUMP_PCIE_RINGS */
+
+#ifdef EWP_ECNTRS_LOGGING
+int
+dhd_print_ecntrs_data(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+               void *fp, uint32 len, void *pos)
+{
+       log_dump_section_hdr_t sec_hdr;
+       int ret = BCME_OK;
+       dhd_info_t *dhd_info;
+
+       if (dev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)dev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp)
+               return BCME_ERROR;
+
+       dhd_init_sec_hdr(&sec_hdr);
+
+       if (logdump_ecntr_enable &&
+                       dhdp->ecntr_dbg_ring) {
+               sec_hdr.type = LOG_DUMP_SECTION_ECNTRS;
+               ret = dhd_dump_debug_ring(dhdp, dhdp->ecntr_dbg_ring,
+                               user_buf, &sec_hdr, ECNTRS_LOG_HDR, len, LOG_DUMP_SECTION_ECNTRS);
+       }
+       return ret;
+
+}
+#endif /* EWP_ECNTRS_LOGGING */
+
+#ifdef EWP_RTT_LOGGING
+int
+dhd_print_rtt_data(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+               void *fp, uint32 len, void *pos)
+{
+       log_dump_section_hdr_t sec_hdr;
+       int ret = BCME_OK;
+       dhd_info_t *dhd_info;
+
+       if (dev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)dev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp)
+               return BCME_ERROR;
+
+       dhd_init_sec_hdr(&sec_hdr);
+
+       if (logdump_rtt_enable && dhdp->rtt_dbg_ring) {
+               ret = dhd_dump_debug_ring(dhdp, dhdp->rtt_dbg_ring,
+                               user_buf, &sec_hdr, RTT_LOG_HDR, len, LOG_DUMP_SECTION_RTT);
+       }
+       return ret;
+
+}
+#endif /* EWP_RTT_LOGGING */
+
+#ifdef DHD_STATUS_LOGGING
+int
+dhd_print_status_log_data(void *dev, dhd_pub_t *dhdp, const void *user_buf,
+       void *fp, uint32 len, void *pos)
+{
+       dhd_info_t *dhd_info;
+
+       if (dev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)dev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp) {
+               return BCME_ERROR;
+       }
+
+       return dhd_statlog_write_logdump(dhdp, user_buf, fp, len, pos);
+}
+
+uint32
+dhd_get_status_log_len(void *ndev, dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd_info;
+       uint32 length = 0;
+
+       if (ndev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)ndev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (dhdp) {
+               length = dhd_statlog_get_logbuf_len(dhdp);
+       }
+
+       return length;
+}
+#endif /* DHD_STATUS_LOGGING */
+
+void
+dhd_init_sec_hdr(log_dump_section_hdr_t *sec_hdr)
+{
+       /* prep the section header */
+       memset(sec_hdr, 0, sizeof(*sec_hdr));
+       sec_hdr->magic = LOG_DUMP_MAGIC;
+       sec_hdr->timestamp = local_clock();
+}
+
+/* Must hold 'dhd_os_logdump_lock' before calling this function ! */
+static int
+do_dhd_log_dump(dhd_pub_t *dhdp, log_dump_type_t *type)
+{
+       int ret = 0, i = 0;
+       struct file *fp = NULL;
+       mm_segment_t old_fs;
+       loff_t pos = 0;
+       char dump_path[128];
+       uint32 file_mode;
+       unsigned long flags = 0;
+       size_t log_size = 0;
+       size_t fspace_remain = 0;
+       struct kstat stat;
+       char time_str[128];
+       unsigned int len = 0;
+       log_dump_section_hdr_t sec_hdr;
+
+       DHD_ERROR(("%s: ENTER \n", __FUNCTION__));
+
+       DHD_GENERAL_LOCK(dhdp, flags);
+       if (DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(dhdp)) {
+               DHD_GENERAL_UNLOCK(dhdp, flags);
+               DHD_ERROR(("%s: bus is down! can't collect log dump. \n", __FUNCTION__));
+               goto exit1;
+       }
+       DHD_BUS_BUSY_SET_IN_LOGDUMP(dhdp);
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+
+       if ((ret = dhd_log_flush(dhdp, type)) < 0) {
+               goto exit1;
+       }
+       /* change to KERNEL_DS address limit */
+       old_fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       dhd_get_debug_dump_file_name(NULL, dhdp, dump_path, sizeof(dump_path));
+
+       DHD_ERROR(("debug_dump_path = %s\n", dump_path));
+       DHD_ERROR(("DHD version: %s\n", dhd_version));
+       DHD_ERROR(("F/W version: %s\n", fw_version));
+
+       dhd_log_dump_buf_addr(dhdp, type);
+
+       dhd_get_time_str(dhdp, time_str, 128);
+
+       /* if this is the first time after dhd is loaded,
+        * or, if periodic flush is disabled, clear the log file
+        */
+       if (!dhdp->logdump_periodic_flush || dhdp->last_file_posn == 0)
+               file_mode = O_CREAT | O_WRONLY | O_SYNC | O_TRUNC;
+       else
+               file_mode = O_CREAT | O_RDWR | O_SYNC;
+
+       fp = filp_open(dump_path, file_mode, 0664);
+       if (IS_ERR(fp)) {
+               /* If android installed image, try '/data' directory */
+#if defined(CONFIG_X86)
+               DHD_ERROR(("%s: File open error on Installed android image, trying /data...\n",
+                       __FUNCTION__));
+               snprintf(dump_path, sizeof(dump_path), "/data/" DHD_DEBUG_DUMP_TYPE);
+               if (!dhdp->logdump_periodic_flush) {
+                       snprintf(dump_path + strlen(dump_path),
+                               sizeof(dump_path) - strlen(dump_path),
+                               "_%s", dhdp->debug_dump_time_str);
+               }
+               fp = filp_open(dump_path, file_mode, 0664);
+               if (IS_ERR(fp)) {
+                       ret = PTR_ERR(fp);
+                       DHD_ERROR(("open file error, err = %d\n", ret));
+                       goto exit2;
+               }
+               DHD_ERROR(("debug_dump_path = %s\n", dump_path));
+#else
+               ret = PTR_ERR(fp);
+               DHD_ERROR(("open file error, err = %d\n", ret));
+               goto exit2;
+#endif /* CONFIG_X86 && OEM_ANDROID */
+       }
+
+       ret = vfs_stat(dump_path, &stat);
+       if (ret < 0) {
+               DHD_ERROR(("file stat error, err = %d\n", ret));
+               goto exit2;
+       }
+
+       /* if some one else has changed the file */
+       if (dhdp->last_file_posn != 0 &&
+                       stat.size < dhdp->last_file_posn) {
+               dhdp->last_file_posn = 0;
+       }
+
+       /* XXX: periodic flush is disabled by default, if enabled
+        * only periodic flushing of 'GENERAL' log dump buffer
+        * is supported, its not recommended to turn on periodic
+        * flushing, except for developer unit test.
+        */
+       if (dhdp->logdump_periodic_flush) {
+               log_size = strlen(time_str) + strlen(DHD_DUMP_LOG_HDR) + sizeof(sec_hdr);
+               /* calculate the amount of space required to dump all logs */
+               for (i = 0; i < DLD_BUFFER_NUM; ++i) {
+                       if (*type != DLD_BUF_TYPE_ALL && i != *type)
+                               continue;
+
+                       if (g_dld_buf[i].wraparound) {
+                               log_size += (unsigned long)g_dld_buf[i].max
+                                               - (unsigned long)g_dld_buf[i].buffer;
+                       } else {
+                               DHD_LOG_DUMP_BUF_LOCK(&g_dld_buf[i].lock, flags);
+                               log_size += (unsigned long)g_dld_buf[i].present -
+                                               (unsigned long)g_dld_buf[i].front;
+                               DHD_LOG_DUMP_BUF_UNLOCK(&g_dld_buf[i].lock, flags);
+                       }
+                       log_size += strlen(dld_hdrs[i].hdr_str) + sizeof(sec_hdr);
+
+                       if (*type != DLD_BUF_TYPE_ALL && i == *type)
+                               break;
+               }
+
+               ret = generic_file_llseek(fp, dhdp->last_file_posn, SEEK_CUR);
+               if (ret < 0) {
+                       DHD_ERROR(("file seek last posn error ! err = %d \n", ret));
+                       goto exit2;
+               }
+               pos = fp->f_pos;
+
+               /* if the max file size is reached, wrap around to beginning of the file
+                * we're treating the file as a large ring buffer
+                */
+               fspace_remain = logdump_max_filesize - pos;
+               if (log_size > fspace_remain) {
+                       fp->f_pos -= pos;
+                       pos = fp->f_pos;
+               }
+       }
+
+       dhd_print_time_str(0, fp, len, &pos);
+
+       for (i = 0; i < DLD_BUFFER_NUM; ++i) {
+
+               if (*type != DLD_BUF_TYPE_ALL && i != *type)
+                       continue;
+
+               len = dhd_get_dld_len(i);
+               dhd_get_dld_log_dump(NULL, dhdp, 0, fp, len, i, &pos);
+               if (*type != DLD_BUF_TYPE_ALL)
+                       break;
+       }
+
+#ifdef EWP_ECNTRS_LOGGING
+       /* periodic flushing of ecounters is NOT supported */
+       if (*type == DLD_BUF_TYPE_ALL &&
+                       logdump_ecntr_enable &&
+                       dhdp->ecntr_dbg_ring) {
+               dhd_log_dump_ring_to_file(dhdp, dhdp->ecntr_dbg_ring,
+                               fp, (unsigned long *)&pos,
+                               &sec_hdr, ECNTRS_LOG_HDR, LOG_DUMP_SECTION_ECNTRS);
+       }
+#endif /* EWP_ECNTRS_LOGGING */
+
+#ifdef DHD_STATUS_LOGGING
+       if (dhdp->statlog) {
+               /* write the statlog */
+               len = dhd_get_status_log_len(NULL, dhdp);
+               if (len) {
+                       if (dhd_print_status_log_data(NULL, dhdp, 0, fp,
+                               len, &pos) < 0) {
+                               goto exit2;
+                       }
+               }
+       }
+#endif /* DHD_STATUS_LOGGING */
+
+#ifdef DHD_STATUS_LOGGING
+       if (dhdp->statlog) {
+               dhd_print_buf_addr(dhdp, "statlog_logbuf", dhd_statlog_get_logbuf(dhdp),
+                       dhd_statlog_get_logbuf_len(dhdp));
+       }
+#endif /* DHD_STATUS_LOGGING */
+
+#ifdef EWP_RTT_LOGGING
+       /* periodic flushing of rtt log is NOT supported */
+       if (*type == DLD_BUF_TYPE_ALL &&
+                       logdump_rtt_enable &&
+                       dhdp->rtt_dbg_ring) {
+               dhd_log_dump_ring_to_file(dhdp, dhdp->rtt_dbg_ring,
+                               fp, (unsigned long *)&pos,
+                               &sec_hdr, RTT_LOG_HDR, LOG_DUMP_SECTION_RTT);
+       }
+#endif /* EWP_RTT_LOGGING */
+
+#ifdef BCMPCIE
+       len = dhd_get_ext_trap_len(NULL, dhdp);
+       if (len) {
+               if (dhd_print_ext_trap_data(NULL, dhdp, 0, fp, len, &pos) < 0)
+                       goto exit2;
+       }
+#endif /* BCMPCIE */
+
+#if defined(DHD_FW_COREDUMP) && defined(DNGL_EVENT_SUPPORT)
+       len = dhd_get_health_chk_len(NULL, dhdp);
+       if (len) {
+               if (dhd_print_health_chk_data(NULL, dhdp, 0, fp, len, &pos) < 0)
+                       goto exit2;
+       }
+#endif /* DHD_FW_COREDUMP && DNGL_EVENT_SUPPORT */
+
+       len = dhd_get_dhd_dump_len(NULL, dhdp);
+       if (len) {
+               if (dhd_print_dump_data(NULL, dhdp, 0, fp, len, &pos) < 0)
+                       goto exit2;
+       }
+
+       len = dhd_get_cookie_log_len(NULL, dhdp);
+       if (len) {
+               if (dhd_print_cookie_data(NULL, dhdp, 0, fp, len, &pos) < 0)
+                       goto exit2;
+       }
+
+#ifdef DHD_DUMP_PCIE_RINGS
+       len = dhd_get_flowring_len(NULL, dhdp);
+       if (len) {
+               if (dhd_print_flowring_data(NULL, dhdp, 0, fp, len, &pos) < 0)
+                       goto exit2;
+       }
+#endif
+
+       if (dhdp->logdump_periodic_flush) {
+               /* store the last position written to in the file for future use */
+               dhdp->last_file_posn = pos;
+       }
+
+exit2:
+       if (!IS_ERR(fp) && fp != NULL) {
+               filp_close(fp, NULL);
+               DHD_ERROR(("%s: Finished writing log dump to file - '%s' \n",
+                               __FUNCTION__, dump_path));
+       }
+       set_fs(old_fs);
+exit1:
+       if (type) {
+               MFREE(dhdp->osh, type, sizeof(*type));
+       }
+       DHD_GENERAL_LOCK(dhdp, flags);
+       DHD_BUS_BUSY_CLEAR_IN_LOGDUMP(dhdp);
+       dhd_os_busbusy_wake(dhdp);
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+
+#ifdef DHD_DUMP_MNGR
+       if (ret >= 0) {
+               dhd_dump_file_manage_enqueue(dhdp, dump_path, DHD_DEBUG_DUMP_TYPE);
+       }
+#endif /* DHD_DUMP_MNGR */
+
+       return (ret < 0) ? BCME_ERROR : BCME_OK;
+}
+#endif /* DHD_LOG_DUMP */
+
+/* This function writes data to the file pointed by fp, OR
+ * copies data to the user buffer sent by upper layer(HAL).
+ */
+int
+dhd_export_debug_data(void *mem_buf, void *fp, const void *user_buf, uint32 buf_len, void *pos)
+{
+       int ret = BCME_OK;
+
+       if (fp) {
+               ret = vfs_write(fp, mem_buf, buf_len, (loff_t *)pos);
+               if (ret < 0) {
+                       DHD_ERROR(("write file error, err = %d\n", ret));
+                       goto exit;
+               }
+       } else {
+#ifdef CONFIG_COMPAT
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 6, 0))
+               if (in_compat_syscall())
+#else
+               if (is_compat_task())
+#endif /* LINUX_VER >= 4.6 */
+               {
+                       void * usr_ptr =  compat_ptr((uintptr_t) user_buf);
+                       ret = copy_to_user((void *)((uintptr_t)usr_ptr + (*(int *)pos)),
+                               mem_buf, buf_len);
+                       if (ret) {
+                               DHD_ERROR(("failed to copy into user buffer : %d\n", ret));
+                               goto exit;
+                       }
+               }
+               else
+#endif /* CONFIG_COMPAT */
+               {
+                       ret = copy_to_user((void *)((uintptr_t)user_buf + (*(int *)pos)),
+                               mem_buf, buf_len);
+                       if (ret) {
+                               DHD_ERROR(("failed to copy into user buffer : %d\n", ret));
+                               goto exit;
+                       }
+               }
+               (*(int *)pos) += buf_len;
+       }
+exit:
+       return ret;
+}
+
+/*
+ * This call is to get the memdump size so that,
+ * halutil can alloc that much buffer in user space.
+ */
+int
+dhd_os_socram_dump(struct net_device *dev, uint32 *dump_size)
+{
+       int ret = BCME_OK;
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+       dhd_pub_t *dhdp = &dhd->pub;
+
+       if (dhdp->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s: bus is down\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (DHD_BUS_CHECK_SUSPEND_OR_SUSPEND_IN_PROGRESS(dhdp)) {
+               DHD_ERROR(("%s: bus is in suspend(%d) or suspending(0x%x) state, so skip\n",
+                       __FUNCTION__, dhdp->busstate, dhdp->dhd_bus_busy_state));
+               return BCME_ERROR;
+       }
+#ifdef DHD_PCIE_RUNTIMEPM
+       dhdpcie_runtime_bus_wake(dhdp, TRUE, __builtin_return_address(0));
+#endif /* DHD_PCIE_RUNTIMEPM */
+       ret = dhd_common_socram_dump(dhdp);
+       if (ret == BCME_OK) {
+               *dump_size = dhdp->soc_ram_length;
+       }
+       return ret;
+}
+
+/*
+ * This is to get the actual memdup after getting the memdump size
+ */
+int
+dhd_os_get_socram_dump(struct net_device *dev, char **buf, uint32 *size)
+{
+       int ret = BCME_OK;
+       int orig_len = 0;
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+       dhd_pub_t *dhdp = &dhd->pub;
+       if (buf == NULL)
+               return BCME_ERROR;
+       orig_len = *size;
+       if (dhdp->soc_ram) {
+               if (orig_len >= dhdp->soc_ram_length) {
+                       *buf = dhdp->soc_ram;
+                       *size = dhdp->soc_ram_length;
+               } else {
+                       ret = BCME_BUFTOOSHORT;
+                       DHD_ERROR(("The length of the buffer is too short"
+                               " to save the memory dump with %d\n", dhdp->soc_ram_length));
+               }
+       } else {
+               DHD_ERROR(("socram_dump is not ready to get\n"));
+               ret = BCME_NOTREADY;
+       }
+       return ret;
+}
+
+#ifdef EWP_RTT_LOGGING
+uint32
+dhd_get_rtt_len(void *ndev, dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd_info;
+       log_dump_section_hdr_t sec_hdr;
+       int length = 0;
+       dhd_dbg_ring_t *ring;
+
+       if (ndev) {
+               dhd_info = *(dhd_info_t **)netdev_priv((struct net_device *)ndev);
+               dhdp = &dhd_info->pub;
+       }
+
+       if (!dhdp)
+               return length;
+
+       if (logdump_rtt_enable && dhdp->rtt_dbg_ring) {
+               ring = (dhd_dbg_ring_t *)dhdp->rtt_dbg_ring;
+               length = ring->ring_size + strlen(RTT_LOG_HDR) + sizeof(sec_hdr);
+       }
+       return length;
+}
+#endif /* EWP_RTT_LOGGING */
+
+int
+dhd_os_get_version(struct net_device *dev, bool dhd_ver, char **buf, uint32 size)
+{
+       char *fw_str;
+
+       if (size == 0)
+               return BCME_BADARG;
+
+       fw_str = strstr(info_string, "Firmware: ");
+       if (fw_str == NULL) {
+               return BCME_ERROR;
+       }
+
+       bzero(*buf, size);
+       if (dhd_ver) {
+               strlcpy(*buf, dhd_version, size);
+       } else {
+               strlcpy(*buf, fw_str, size);
+       }
+       return BCME_OK;
+}
+
+#ifdef DHD_PKT_LOGGING
+int
+dhd_os_get_pktlog_dump(void *dev, const void *user_buf, uint32 len)
+{
+       int ret = BCME_OK;
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+       dhd_pub_t *dhdp = &dhd->pub;
+       if (user_buf == NULL) {
+               DHD_ERROR(("%s(): user buffer is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       ret = dhd_pktlog_dump_write_memory(dhdp, user_buf, len);
+       if (ret < 0) {
+               DHD_ERROR(("%s(): fail to dump pktlog, err = %d\n", __FUNCTION__, ret));
+               return ret;
+       }
+       return ret;
+}
+
+uint32
+dhd_os_get_pktlog_dump_size(struct net_device *dev)
+{
+       uint32 size = 0;
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+       dhd_pub_t *dhdp = &dhd->pub;
+
+       size = dhd_pktlog_get_dump_length(dhdp);
+       if (size == 0) {
+               DHD_ERROR(("%s(): fail to get pktlog size, err = %d\n", __FUNCTION__, size));
+       }
+       return size;
+}
+
+void
+dhd_os_get_pktlogdump_filename(struct net_device *dev, char *dump_path, int len)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+       dhd_pub_t *dhdp = &dhd->pub;
+
+       dhd_pktlog_get_filename(dhdp, dump_path, len);
+}
+#endif /* DHD_PKT_LOGGING */
+#ifdef DNGL_AXI_ERROR_LOGGING
+int
+dhd_os_get_axi_error_dump(void *dev, const void *user_buf, uint32 len)
+{
+       int ret = BCME_OK;
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+       dhd_pub_t *dhdp = &dhd->pub;
+       loff_t pos = 0;
+       if (user_buf == NULL) {
+               DHD_ERROR(("%s(): user buffer is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       ret = dhd_export_debug_data((char *)dhdp->axi_err_dump,
+                       NULL, user_buf, sizeof(dhd_axi_error_dump_t), &pos);
+
+       if (ret < 0) {
+               DHD_ERROR(("%s(): fail to dump pktlog, err = %d\n", __FUNCTION__, ret));
+               return ret;
+       }
+       return ret;
+}
+
+int
+dhd_os_get_axi_error_dump_size(struct net_device *dev)
+{
+       int size = -1;
+
+       size = sizeof(dhd_axi_error_dump_t);
+       if (size < 0) {
+               DHD_ERROR(("%s(): fail to get axi error size, err = %d\n", __FUNCTION__, size));
+       }
+       return size;
+}
+
+void
+dhd_os_get_axi_error_filename(struct net_device *dev, char *dump_path, int len)
+{
+       snprintf(dump_path, len, "%s",
+               DHD_COMMON_DUMP_PATH DHD_DUMP_AXI_ERROR_FILENAME);
+}
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+bool dhd_sta_associated(dhd_pub_t *dhdp, uint32 bssidx, uint8 *mac)
+{
+       return dhd_find_sta(dhdp, bssidx, mac) ? TRUE : FALSE;
+}
+
+#ifdef DHD_L2_FILTER
+arp_table_t*
+dhd_get_ifp_arp_table_handle(dhd_pub_t *dhdp, uint32 bssidx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(bssidx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[bssidx];
+       return ifp->phnd_arp_table;
+}
+
+int dhd_get_parp_status(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       if (ifp)
+               return ifp->parp_enable;
+       else
+               return FALSE;
+}
+
+/* Set interface specific proxy arp configuration */
+int dhd_set_parp_status(dhd_pub_t *dhdp, uint32 idx, int val)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+       ASSERT(idx < DHD_MAX_IFS);
+       ifp = dhd->iflist[idx];
+
+       if (!ifp)
+           return BCME_ERROR;
+
+       /* At present all 3 variables are being
+        * handled at once
+        */
+       ifp->parp_enable = val;
+       ifp->parp_discard = val;
+       ifp->parp_allnode = val;
+
+       /* Flush ARP entries when disabled */
+       if (val == FALSE) {
+               bcm_l2_filter_arp_table_update(dhdp->osh, ifp->phnd_arp_table, TRUE, NULL,
+                       FALSE, dhdp->tickcnt);
+       }
+       return BCME_OK;
+}
+
+bool dhd_parp_discard_is_enabled(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+       return ifp->parp_discard;
+}
+
+bool
+dhd_parp_allnode_is_enabled(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       return ifp->parp_allnode;
+}
+
+int dhd_get_dhcp_unicast_status(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       return ifp->dhcp_unicast;
+}
+
+int dhd_set_dhcp_unicast_status(dhd_pub_t *dhdp, uint32 idx, int val)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+       ASSERT(idx < DHD_MAX_IFS);
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       ifp->dhcp_unicast = val;
+       return BCME_OK;
+}
+
+int dhd_get_block_ping_status(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       return ifp->block_ping;
+}
+
+int dhd_set_block_ping_status(dhd_pub_t *dhdp, uint32 idx, int val)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+       ASSERT(idx < DHD_MAX_IFS);
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       ifp->block_ping = val;
+       /* Disable rx_pkt_chain feature for interface if block_ping option is
+        * enabled
+        */
+       dhd_update_rx_pkt_chainable_state(dhdp, idx);
+       return BCME_OK;
+}
+
+int dhd_get_grat_arp_status(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       return ifp->grat_arp;
+}
+
+int dhd_set_grat_arp_status(dhd_pub_t *dhdp, uint32 idx, int val)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+       ASSERT(idx < DHD_MAX_IFS);
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       ifp->grat_arp = val;
+
+       return BCME_OK;
+}
+
+int dhd_get_block_tdls_status(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       return ifp->block_tdls;
+}
+
+int dhd_set_block_tdls_status(dhd_pub_t *dhdp, uint32 idx, int val)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+       ASSERT(idx < DHD_MAX_IFS);
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       ifp->block_tdls = val;
+
+       return BCME_OK;
+}
+#endif /* DHD_L2_FILTER */
+
+#ifdef DHD_DEBUG_PAGEALLOC
+/* XXX Additional Kernel implemenation is needed to use this function at
+ * the top of the check_poison_mem() function in mm/debug-pagealloc.c file.
+ * Please check if below codes are implemenated your Linux Kernel first.
+ *
+ * - mm/debug-pagealloc.c
+ *
+ * // for DHD_DEBUG_PAGEALLOC
+ * typedef void (*page_corrupt_cb_t)(void *handle, void *addr_corrupt, uint addr_len);
+ * page_corrupt_cb_t corrupt_cb = NULL;
+ * void *corrupt_cb_handle = NULL;
+ *
+ * void register_page_corrupt_cb(page_corrupt_cb_t cb, void *handle)
+ * {
+ *      corrupt_cb = cb;
+ *      corrupt_cb_handle = handle;
+ * }
+ * EXPORT_SYMBOL(register_page_corrupt_cb);
+ *
+ * extern void dhd_page_corrupt_cb(void *handle, void *addr_corrupt, size_t len);
+ *
+ * static void check_poison_mem(unsigned char *mem, size_t bytes)
+ * {
+ * ......
+ *
+ *      if (!__ratelimit(&ratelimit))
+ *               return;
+ *      else if (start == end && single_bit_flip(*start, PAGE_POISON))
+ *              printk(KERN_ERR "pagealloc: single bit error\n");
+ *      else
+ *              printk(KERN_ERR "pagealloc: memory corruption\n");
+ *
+ *      print_hex_dump(KERN_ERR, "", DUMP_PREFIX_ADDRESS, 16, 1, start,
+ *              end - start + 1, 1);
+ *
+ *      // for DHD_DEBUG_PAGEALLOC
+ *      dhd_page_corrupt_cb(corrupt_cb_handle, start, end - start + 1);
+ *
+ *      dump_stack();
+ * }
+ *
+ */
+
+void
+dhd_page_corrupt_cb(void *handle, void *addr_corrupt, size_t len)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)handle;
+
+       DHD_ERROR(("%s: Got dhd_page_corrupt_cb 0x%p %d\n",
+               __FUNCTION__, addr_corrupt, (uint32)len));
+
+       DHD_OS_WAKE_LOCK(dhdp);
+       prhex("Page Corruption:", addr_corrupt, len);
+       dhd_dump_to_kernelog(dhdp);
+#if defined(BCMPCIE) && defined(DHD_FW_COREDUMP)
+       /* Load the dongle side dump to host memory and then BUG_ON() */
+       dhdp->memdump_enabled = DUMP_MEMONLY;
+       dhdp->memdump_type = DUMP_TYPE_MEMORY_CORRUPTION;
+       dhd_bus_mem_dump(dhdp);
+#endif /* BCMPCIE && DHD_FW_COREDUMP */
+       DHD_OS_WAKE_UNLOCK(dhdp);
+}
+EXPORT_SYMBOL(dhd_page_corrupt_cb);
+#endif /* DHD_DEBUG_PAGEALLOC */
+
+#if defined(BCMPCIE) && defined(DHD_PKTID_AUDIT_ENABLED)
+void
+dhd_pktid_error_handler(dhd_pub_t *dhdp)
+{
+       DHD_ERROR(("%s: Got Pkt Id Audit failure \n", __FUNCTION__));
+       DHD_OS_WAKE_LOCK(dhdp);
+       dhd_dump_to_kernelog(dhdp);
+#ifdef DHD_FW_COREDUMP
+       /* Load the dongle side dump to host memory */
+       if (dhdp->memdump_enabled == DUMP_DISABLED) {
+               dhdp->memdump_enabled = DUMP_MEMFILE;
+       }
+       dhdp->memdump_type = DUMP_TYPE_PKTID_AUDIT_FAILURE;
+       dhd_bus_mem_dump(dhdp);
+#endif /* DHD_FW_COREDUMP */
+       /* XXX Send HANG event to Android Framework for recovery */
+       dhdp->hang_reason = HANG_REASON_PCIE_PKTID_ERROR;
+       dhd_os_check_hang(dhdp, 0, -EREMOTEIO);
+       DHD_OS_WAKE_UNLOCK(dhdp);
+}
+#endif /* BCMPCIE && DHD_PKTID_AUDIT_ENABLED */
+
+struct net_device *
+dhd_linux_get_primary_netdev(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+
+       if (dhd->iflist[0] && dhd->iflist[0]->net)
+               return dhd->iflist[0]->net;
+       else
+               return NULL;
+}
+
+fw_download_status_t
+dhd_fw_download_status(dhd_pub_t * dhd_pub)
+{
+       return dhd_pub->fw_download_status;
+}
+
+static int
+dhd_create_to_notifier_skt(void)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+       /* Kernel 3.7 onwards this API accepts only 3 arguments. */
+       /* Kernel version 3.6 is a special case which accepts 4 arguments */
+       nl_to_event_sk = netlink_kernel_create(&init_net, BCM_NL_USER, &dhd_netlink_cfg);
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
+       /* Kernel version 3.5 and below use this old API format */
+       nl_to_event_sk = netlink_kernel_create(&init_net, BCM_NL_USER, 0,
+                       dhd_process_daemon_msg, NULL, THIS_MODULE);
+#else
+       nl_to_event_sk = netlink_kernel_create(&init_net, BCM_NL_USER, THIS_MODULE,
+                       &dhd_netlink_cfg);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0)) */
+       if (!nl_to_event_sk)
+       {
+               printf("Error creating socket.\n");
+               return -1;
+       }
+       DHD_INFO(("nl_to socket created successfully...\n"));
+       return 0;
+}
+
+void
+dhd_destroy_to_notifier_skt(void)
+{
+       DHD_INFO(("Destroying nl_to socket\n"));
+       netlink_kernel_release(nl_to_event_sk);
+}
+
+static void
+dhd_recv_msg_from_daemon(struct sk_buff *skb)
+{
+       struct nlmsghdr *nlh;
+       bcm_to_info_t *cmd;
+
+       nlh = (struct nlmsghdr *)skb->data;
+       cmd = (bcm_to_info_t *)nlmsg_data(nlh);
+       if ((cmd->magic == BCM_TO_MAGIC) && (cmd->reason == REASON_DAEMON_STARTED)) {
+               sender_pid = ((struct nlmsghdr *)(skb->data))->nlmsg_pid;
+               DHD_INFO(("DHD Daemon Started\n"));
+       }
+}
+
+int
+dhd_send_msg_to_daemon(struct sk_buff *skb, void *data, int size)
+{
+       struct nlmsghdr *nlh;
+       struct sk_buff *skb_out;
+       int ret = BCME_ERROR;
+
+       BCM_REFERENCE(skb);
+       if (sender_pid == 0) {
+               DHD_INFO(("Invalid PID 0\n"));
+               skb_out = NULL;
+               goto err;
+       }
+
+       if ((skb_out = nlmsg_new(size, 0)) == NULL) {
+               DHD_ERROR(("%s: skb alloc failed\n", __FUNCTION__));
+               ret = BCME_NOMEM;
+               goto err;
+       }
+       nlh = nlmsg_put(skb_out, 0, 0, NLMSG_DONE, size, 0);
+       if (nlh == NULL) {
+               DHD_ERROR(("%s: nlmsg_put failed\n", __FUNCTION__));
+               goto err;
+       }
+       NETLINK_CB(skb_out).dst_group = 0; /* Unicast */
+       (void)memcpy_s(nlmsg_data(nlh), size, (char *)data, size);
+
+       if ((ret = nlmsg_unicast(nl_to_event_sk, skb_out, sender_pid)) < 0) {
+               DHD_ERROR(("Error sending message, ret:%d\n", ret));
+               /* skb is already freed inside nlmsg_unicast() on error case */
+               /* explicitly making skb_out to NULL to avoid double free */
+               skb_out = NULL;
+               goto err;
+       }
+       return BCME_OK;
+err:
+       if (skb_out) {
+               nlmsg_free(skb_out);
+       }
+       return ret;
+}
+
+static void
+dhd_process_daemon_msg(struct sk_buff *skb)
+{
+       bcm_to_info_t to_info;
+
+       to_info.magic = BCM_TO_MAGIC;
+       to_info.reason = REASON_DAEMON_STARTED;
+       to_info.trap = NO_TRAP;
+
+       dhd_recv_msg_from_daemon(skb);
+       dhd_send_msg_to_daemon(skb, &to_info, sizeof(to_info));
+}
+
+#ifdef DHD_LOG_DUMP
+bool
+dhd_log_dump_ecntr_enabled(void)
+{
+       return (bool)logdump_ecntr_enable;
+}
+
+bool
+dhd_log_dump_rtt_enabled(void)
+{
+       return (bool)logdump_rtt_enable;
+}
+
+void
+dhd_log_dump_init(dhd_pub_t *dhd)
+{
+       struct dhd_log_dump_buf *dld_buf, *dld_buf_special;
+       int i = 0;
+       uint8 *prealloc_buf = NULL, *bufptr = NULL;
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_MEMDUMP)
+       int prealloc_idx = DHD_PREALLOC_DHD_LOG_DUMP_BUF;
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_MEMDUMP */
+       int ret;
+       dhd_dbg_ring_t *ring = NULL;
+       unsigned long flags = 0;
+       dhd_info_t *dhd_info = dhd->info;
+#if defined(EWP_ECNTRS_LOGGING)
+       void *cookie_buf = NULL;
+#endif
+
+       BCM_REFERENCE(ret);
+       BCM_REFERENCE(ring);
+       BCM_REFERENCE(flags);
+
+       /* sanity check */
+       if (logdump_prsrv_tailsize <= 0 ||
+               logdump_prsrv_tailsize > DHD_LOG_DUMP_MAX_TAIL_FLUSH_SIZE) {
+               logdump_prsrv_tailsize = DHD_LOG_DUMP_MAX_TAIL_FLUSH_SIZE;
+       }
+       /* now adjust the preserve log flush size based on the
+       * kernel printk log buffer size
+       */
+#ifdef CONFIG_LOG_BUF_SHIFT
+       DHD_ERROR(("%s: kernel log buf size = %uKB; logdump_prsrv_tailsize = %uKB;"
+               " limit prsrv tail size to = %uKB\n",
+               __FUNCTION__, (1 << CONFIG_LOG_BUF_SHIFT)/1024,
+               logdump_prsrv_tailsize/1024, LOG_DUMP_KERNEL_TAIL_FLUSH_SIZE/1024));
+
+       if (logdump_prsrv_tailsize > LOG_DUMP_KERNEL_TAIL_FLUSH_SIZE) {
+               logdump_prsrv_tailsize = LOG_DUMP_KERNEL_TAIL_FLUSH_SIZE;
+       }
+#else
+       DHD_ERROR(("%s: logdump_prsrv_tailsize = %uKB \n",
+               __FUNCTION__, logdump_prsrv_tailsize/1024);
+#endif /* CONFIG_LOG_BUF_SHIFT */
+
+       mutex_init(&dhd_info->logdump_lock);
+       /* initialize log dump buf structures */
+       memset(g_dld_buf, 0, sizeof(struct dhd_log_dump_buf) * DLD_BUFFER_NUM);
+
+       /* set the log dump buffer size based on the module_param */
+       if (logdump_max_bufsize > LOG_DUMP_GENERAL_MAX_BUFSIZE ||
+                       logdump_max_bufsize <= 0)
+               dld_buf_size[DLD_BUF_TYPE_GENERAL] = LOG_DUMP_GENERAL_MAX_BUFSIZE;
+       else
+               dld_buf_size[DLD_BUF_TYPE_GENERAL] = logdump_max_bufsize;
+
+       /* pre-alloc the memory for the log buffers & 'special' buffer */
+       dld_buf_special = &g_dld_buf[DLD_BUF_TYPE_SPECIAL];
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_MEMDUMP)
+       prealloc_buf = DHD_OS_PREALLOC(dhd, prealloc_idx++, LOG_DUMP_TOTAL_BUFSIZE);
+       dld_buf_special->buffer = DHD_OS_PREALLOC(dhd, prealloc_idx++,
+                       dld_buf_size[DLD_BUF_TYPE_SPECIAL]);
+#else
+       prealloc_buf = MALLOCZ(dhd->osh, LOG_DUMP_TOTAL_BUFSIZE);
+       dld_buf_special->buffer = MALLOCZ(dhd->osh, dld_buf_size[DLD_BUF_TYPE_SPECIAL]);
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_MEMDUMP */
+
+       if (!prealloc_buf) {
+               DHD_ERROR(("Failed to allocate memory for log buffers\n"));
+               goto fail;
+       }
+       if (!dld_buf_special->buffer) {
+               DHD_ERROR(("Failed to allocate memory for special buffer\n"));
+               goto fail;
+       }
+
+       bufptr = prealloc_buf;
+       for (i = 0; i < DLD_BUFFER_NUM; i++) {
+               dld_buf = &g_dld_buf[i];
+               dld_buf->dhd_pub = dhd;
+               spin_lock_init(&dld_buf->lock);
+               dld_buf->wraparound = 0;
+               if (i != DLD_BUF_TYPE_SPECIAL) {
+                       dld_buf->buffer = bufptr;
+                       dld_buf->max = (unsigned long)dld_buf->buffer + dld_buf_size[i];
+                       bufptr = (uint8 *)dld_buf->max;
+               } else {
+                       dld_buf->max = (unsigned long)dld_buf->buffer + dld_buf_size[i];
+               }
+               dld_buf->present = dld_buf->front = dld_buf->buffer;
+               dld_buf->remain = dld_buf_size[i];
+               dld_buf->enable = 1;
+       }
+#ifdef EWP_ECNTRS_LOGGING
+       /* now use the rest of the pre-alloc'd memory for filter and ecounter log */
+       dhd->ecntr_dbg_ring = MALLOCZ(dhd->osh, sizeof(dhd_dbg_ring_t));
+       if (!dhd->ecntr_dbg_ring)
+               goto fail;
+
+       ring = (dhd_dbg_ring_t *)dhd->ecntr_dbg_ring;
+       ret = dhd_dbg_ring_init(dhd, ring, ECNTR_RING_ID,
+                       ECNTR_RING_NAME, LOG_DUMP_ECNTRS_MAX_BUFSIZE,
+                       bufptr, TRUE);
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s: unable to init ecntr ring !\n",
+                               __FUNCTION__));
+               goto fail;
+       }
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+       ring->state = RING_ACTIVE;
+       ring->threshold = 0;
+       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+
+       bufptr += LOG_DUMP_ECNTRS_MAX_BUFSIZE;
+#endif /* EWP_ECNTRS_LOGGING */
+
+#ifdef EWP_RTT_LOGGING
+       /* now use the rest of the pre-alloc'd memory for filter and ecounter log */
+       dhd->rtt_dbg_ring = MALLOCZ(dhd->osh, sizeof(dhd_dbg_ring_t));
+       if (!dhd->rtt_dbg_ring)
+               goto fail;
+
+       ring = (dhd_dbg_ring_t *)dhd->rtt_dbg_ring;
+       ret = dhd_dbg_ring_init(dhd, ring, RTT_RING_ID,
+                       RTT_RING_NAME, LOG_DUMP_RTT_MAX_BUFSIZE,
+                       bufptr, TRUE);
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s: unable to init ecntr ring !\n",
+                               __FUNCTION__));
+               goto fail;
+       }
+       DHD_DBG_RING_LOCK(ring->lock, flags);
+       ring->state = RING_ACTIVE;
+       ring->threshold = 0;
+       DHD_DBG_RING_UNLOCK(ring->lock, flags);
+
+       bufptr += LOG_DUMP_RTT_MAX_BUFSIZE;
+#endif /* EWP_RTT_LOGGING */
+
+       /* Concise buffer is used as intermediate buffer for following purposes
+       * a) pull ecounters records temporarily before
+       *  writing it to file
+       * b) to store dhd dump data before putting it to file
+       * It should have a size equal to
+       * MAX(largest possible ecntr record, 'dhd dump' data size)
+       */
+       dhd->concise_dbg_buf = MALLOC(dhd->osh, CONCISE_DUMP_BUFLEN);
+       if (!dhd->concise_dbg_buf) {
+               DHD_ERROR(("%s: unable to alloc mem for concise debug info !\n",
+                               __FUNCTION__));
+               goto fail;
+       }
+
+#if defined(DHD_EVENT_LOG_FILTER)
+       /* XXX init filter last, because filter use buffer which alloced by log dump */
+       ret = dhd_event_log_filter_init(dhd,
+               bufptr,
+               LOG_DUMP_FILTER_MAX_BUFSIZE);
+       if (ret != BCME_OK) {
+               goto fail;
+       }
+#endif /* DHD_EVENT_LOG_FILTER */
+
+#if defined(EWP_ECNTRS_LOGGING)
+       cookie_buf = MALLOC(dhd->osh, LOG_DUMP_COOKIE_BUFSIZE);
+       if (!cookie_buf) {
+               DHD_ERROR(("%s: unable to alloc mem for logdump cookie buffer\n",
+                       __FUNCTION__));
+               goto fail;
+       }
+
+       ret = dhd_logdump_cookie_init(dhd, cookie_buf, LOG_DUMP_COOKIE_BUFSIZE);
+       if (ret != BCME_OK) {
+               MFREE(dhd->osh, cookie_buf, LOG_DUMP_COOKIE_BUFSIZE);
+               goto fail;
+       }
+#endif /* EWP_ECNTRS_LOGGING */
+       return;
+
+fail:
+
+#if defined(DHD_EVENT_LOG_FILTER)
+       /* XXX deinit filter first, because filter use buffer which alloced by log dump */
+       if (dhd->event_log_filter) {
+               dhd_event_log_filter_deinit(dhd);
+       }
+#endif /* DHD_EVENT_LOG_FILTER */
+
+       if (dhd->concise_dbg_buf) {
+               MFREE(dhd->osh, dhd->concise_dbg_buf, CONCISE_DUMP_BUFLEN);
+       }
+
+#ifdef EWP_ECNTRS_LOGGING
+       if (dhd->logdump_cookie) {
+               dhd_logdump_cookie_deinit(dhd);
+               MFREE(dhd->osh, dhd->logdump_cookie, LOG_DUMP_COOKIE_BUFSIZE);
+               dhd->logdump_cookie = NULL;
+       }
+       if (dhd->ecntr_dbg_ring) {
+               ring = (dhd_dbg_ring_t *)dhd->ecntr_dbg_ring;
+               dhd_dbg_ring_deinit(dhd, ring);
+               ring->ring_buf = NULL;
+               ring->ring_size = 0;
+               MFREE(dhd->osh, dhd->ecntr_dbg_ring, sizeof(dhd_dbg_ring_t));
+               dhd->ecntr_dbg_ring = NULL;
+       }
+#endif /* EWP_ECNTRS_LOGGING */
+
+#ifdef EWP_RTT_LOGGING
+       if (dhd->rtt_dbg_ring) {
+               ring = (dhd_dbg_ring_t *)dhd->rtt_dbg_ring;
+               dhd_dbg_ring_deinit(dhd, ring);
+               ring->ring_buf = NULL;
+               ring->ring_size = 0;
+               MFREE(dhd->osh, ring, sizeof(dhd_dbg_ring_t));
+               dhd->rtt_dbg_ring = NULL;
+       }
+#endif /* EWP_RTT_LOGGING */
+
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_MEMDUMP)
+       if (prealloc_buf) {
+               DHD_OS_PREFREE(dhd, prealloc_buf, LOG_DUMP_TOTAL_BUFSIZE);
+       }
+       if (dld_buf_special->buffer) {
+               DHD_OS_PREFREE(dhd, dld_buf_special->buffer,
+                               dld_buf_size[DLD_BUF_TYPE_SPECIAL]);
+       }
+#else
+       if (prealloc_buf) {
+               MFREE(dhd->osh, prealloc_buf, LOG_DUMP_TOTAL_BUFSIZE);
+       }
+       if (dld_buf_special->buffer) {
+               MFREE(dhd->osh, dld_buf_special->buffer,
+                               dld_buf_size[DLD_BUF_TYPE_SPECIAL]);
+       }
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+       for (i = 0; i < DLD_BUFFER_NUM; i++) {
+               dld_buf = &g_dld_buf[i];
+               dld_buf->enable = 0;
+               dld_buf->buffer = NULL;
+       }
+       mutex_destroy(&dhd_info->logdump_lock);
+}
+
+void
+dhd_log_dump_deinit(dhd_pub_t *dhd)
+{
+       struct dhd_log_dump_buf *dld_buf = NULL, *dld_buf_special = NULL;
+       int i = 0;
+       dhd_info_t *dhd_info = dhd->info;
+       dhd_dbg_ring_t *ring = NULL;
+
+       BCM_REFERENCE(ring);
+
+       if (dhd->concise_dbg_buf) {
+               MFREE(dhd->osh, dhd->concise_dbg_buf, CONCISE_DUMP_BUFLEN);
+               dhd->concise_dbg_buf = NULL;
+       }
+
+#ifdef EWP_ECNTRS_LOGGING
+       if (dhd->logdump_cookie) {
+               dhd_logdump_cookie_deinit(dhd);
+               MFREE(dhd->osh, dhd->logdump_cookie, LOG_DUMP_COOKIE_BUFSIZE);
+               dhd->logdump_cookie = NULL;
+       }
+
+       if (dhd->ecntr_dbg_ring) {
+               ring = (dhd_dbg_ring_t *)dhd->ecntr_dbg_ring;
+               dhd_dbg_ring_deinit(dhd, ring);
+               ring->ring_buf = NULL;
+               ring->ring_size = 0;
+               MFREE(dhd->osh, dhd->ecntr_dbg_ring, sizeof(dhd_dbg_ring_t));
+               dhd->ecntr_dbg_ring = NULL;
+       }
+#endif /* EWP_ECNTRS_LOGGING */
+
+#ifdef EWP_RTT_LOGGING
+       if (dhd->rtt_dbg_ring) {
+               ring = (dhd_dbg_ring_t *)dhd->rtt_dbg_ring;
+               dhd_dbg_ring_deinit(dhd, ring);
+               ring->ring_buf = NULL;
+               ring->ring_size = 0;
+               MFREE(dhd->osh, ring, sizeof(dhd_dbg_ring_t));
+               dhd->rtt_dbg_ring = NULL;
+       }
+#endif /* EWP_RTT_LOGGING */
+
+       /* 'general' buffer points to start of the pre-alloc'd memory */
+       dld_buf = &g_dld_buf[DLD_BUF_TYPE_GENERAL];
+       dld_buf_special = &g_dld_buf[DLD_BUF_TYPE_SPECIAL];
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_MEMDUMP)
+       if (dld_buf->buffer) {
+               DHD_OS_PREFREE(dhd, dld_buf->buffer, LOG_DUMP_TOTAL_BUFSIZE);
+       }
+       if (dld_buf_special->buffer) {
+               DHD_OS_PREFREE(dhd, dld_buf_special->buffer,
+                               dld_buf_size[DLD_BUF_TYPE_SPECIAL]);
+       }
+#else
+       if (dld_buf->buffer) {
+               MFREE(dhd->osh, dld_buf->buffer, LOG_DUMP_TOTAL_BUFSIZE);
+       }
+       if (dld_buf_special->buffer) {
+               MFREE(dhd->osh, dld_buf_special->buffer,
+                               dld_buf_size[DLD_BUF_TYPE_SPECIAL]);
+       }
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+       for (i = 0; i < DLD_BUFFER_NUM; i++) {
+               dld_buf = &g_dld_buf[i];
+               dld_buf->enable = 0;
+               dld_buf->buffer = NULL;
+       }
+       mutex_destroy(&dhd_info->logdump_lock);
+}
+
+void
+dhd_log_dump_write(int type, char *binary_data,
+               int binary_len, const char *fmt, ...)
+{
+       int len = 0;
+       char tmp_buf[DHD_LOG_DUMP_MAX_TEMP_BUFFER_SIZE] = {0, };
+       va_list args;
+       unsigned long flags = 0;
+       struct dhd_log_dump_buf *dld_buf = NULL;
+       bool flush_log = FALSE;
+
+       if (type < 0 || type >= DLD_BUFFER_NUM) {
+               DHD_INFO(("%s: Unsupported DHD_LOG_DUMP_BUF_TYPE(%d).\n",
+                       __FUNCTION__, type));
+               return;
+       }
+
+       dld_buf = &g_dld_buf[type];
+       if (dld_buf->enable != 1) {
+               return;
+       }
+
+       va_start(args, fmt);
+       len = vsnprintf(tmp_buf, DHD_LOG_DUMP_MAX_TEMP_BUFFER_SIZE, fmt, args);
+       /* Non ANSI C99 compliant returns -1,
+        * ANSI compliant return len >= DHD_LOG_DUMP_MAX_TEMP_BUFFER_SIZE
+        */
+       va_end(args);
+       if (len < 0) {
+               return;
+       }
+
+       if (len >= DHD_LOG_DUMP_MAX_TEMP_BUFFER_SIZE) {
+               len = DHD_LOG_DUMP_MAX_TEMP_BUFFER_SIZE - 1;
+               tmp_buf[len] = '\0';
+       }
+
+       /* make a critical section to eliminate race conditions */
+       DHD_LOG_DUMP_BUF_LOCK(&dld_buf->lock, flags);
+       if (dld_buf->remain < len) {
+               dld_buf->wraparound = 1;
+               dld_buf->present = dld_buf->front;
+               dld_buf->remain = dld_buf_size[type];
+               /* if wrap around happens, flush the ring buffer to the file */
+               flush_log = TRUE;
+       }
+
+       memcpy(dld_buf->present, tmp_buf, len);
+       dld_buf->remain -= len;
+       dld_buf->present += len;
+       DHD_LOG_DUMP_BUF_UNLOCK(&dld_buf->lock, flags);
+
+       /* double check invalid memory operation */
+       ASSERT((unsigned long)dld_buf->present <= dld_buf->max);
+
+       if (dld_buf->dhd_pub) {
+               dhd_pub_t *dhdp = (dhd_pub_t *)dld_buf->dhd_pub;
+               dhdp->logdump_periodic_flush =
+                       logdump_periodic_flush;
+               if (logdump_periodic_flush && flush_log) {
+                       log_dump_type_t *flush_type = MALLOCZ(dhdp->osh,
+                                       sizeof(log_dump_type_t));
+                       if (flush_type) {
+                               *flush_type = type;
+                               dhd_schedule_log_dump(dld_buf->dhd_pub, flush_type);
+                       }
+               }
+       }
+}
+
+char*
+dhd_log_dump_get_timestamp(void)
+{
+       static char buf[32];
+       u64 ts_nsec;
+       unsigned long rem_nsec;
+
+       ts_nsec = local_clock();
+       rem_nsec = DIV_AND_MOD_U64_BY_U32(ts_nsec, NSEC_PER_SEC);
+       snprintf(buf, sizeof(buf), "%5lu.%06lu",
+               (unsigned long)ts_nsec, rem_nsec / NSEC_PER_USEC);
+
+       return buf;
+}
+#endif /* DHD_LOG_DUMP */
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+void
+dhd_flush_rx_tx_wq(dhd_pub_t *dhdp)
+{
+       dhd_info_t * dhd;
+
+       if (dhdp) {
+               dhd = dhdp->info;
+               if (dhd) {
+                       flush_workqueue(dhd->tx_wq);
+                       flush_workqueue(dhd->rx_wq);
+               }
+       }
+
+       return;
+}
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#ifdef DHD_DEBUG_UART
+bool
+dhd_debug_uart_is_running(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (dhd->duart_execute) {
+               return TRUE;
+       }
+
+       return FALSE;
+}
+
+static void
+dhd_debug_uart_exec_rd(void *handle, void *event_info, u8 event)
+{
+       dhd_pub_t *dhdp = handle;
+       dhd_debug_uart_exec(dhdp, "rd");
+}
+
+static void
+dhd_debug_uart_exec(dhd_pub_t *dhdp, char *cmd)
+{
+       int ret;
+
+       char *argv[] = {DHD_DEBUG_UART_EXEC_PATH, cmd, NULL};
+       char *envp[] = {"HOME=/", "TERM=linux", "PATH=/sbin:/system/bin", NULL};
+
+#ifdef DHD_FW_COREDUMP
+       if (dhdp->memdump_enabled == DUMP_MEMFILE_BUGON)
+#endif
+       {
+               if (dhdp->hang_reason == HANG_REASON_PCIE_LINK_DOWN_RC_DETECT ||
+                       dhdp->hang_reason == HANG_REASON_PCIE_LINK_DOWN_EP_DETECT ||
+#ifdef DHD_FW_COREDUMP
+                       dhdp->memdump_success == FALSE ||
+#endif
+                       FALSE) {
+                       dhdp->info->duart_execute = TRUE;
+                       DHD_ERROR(("DHD: %s - execute %s %s\n",
+                               __FUNCTION__, DHD_DEBUG_UART_EXEC_PATH, cmd));
+                       ret = call_usermodehelper(argv[0], argv, envp, UMH_WAIT_PROC);
+                       DHD_ERROR(("DHD: %s - %s %s ret = %d\n",
+                               __FUNCTION__, DHD_DEBUG_UART_EXEC_PATH, cmd, ret));
+                       dhdp->info->duart_execute = FALSE;
+
+#ifdef DHD_LOG_DUMP
+                       if (dhdp->memdump_type != DUMP_TYPE_BY_SYSDUMP)
+#endif
+                       {
+                               BUG_ON(1);
+                       }
+               }
+       }
+}
+#endif /* DHD_DEBUG_UART */
+
+#if defined(DHD_BLOB_EXISTENCE_CHECK)
+void
+dhd_set_blob_support(dhd_pub_t *dhdp, char *fw_path)
+{
+       struct file *fp;
+       char *filepath = VENDOR_PATH CONFIG_BCMDHD_CLM_PATH;
+
+       fp = filp_open(filepath, O_RDONLY, 0);
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("%s: ----- blob file doesn't exist (%s) -----\n", __FUNCTION__,
+                       filepath));
+               dhdp->is_blob = FALSE;
+       } else {
+               DHD_ERROR(("%s: ----- blob file exists (%s) -----\n", __FUNCTION__, filepath));
+               dhdp->is_blob = TRUE;
+#if defined(CONCATE_BLOB)
+               strncat(fw_path, "_blob", strlen("_blob"));
+#else
+               BCM_REFERENCE(fw_path);
+#endif /* SKIP_CONCATE_BLOB */
+               filp_close(fp, NULL);
+       }
+}
+#endif /* DHD_BLOB_EXISTENCE_CHECK */
+
+#if defined(PCIE_FULL_DONGLE)
+/** test / loopback */
+void
+dmaxfer_free_dmaaddr_handler(void *handle, void *event_info, u8 event)
+{
+       dmaxref_mem_map_t *dmmap = (dmaxref_mem_map_t *)event_info;
+       dhd_info_t *dhd_info = (dhd_info_t *)handle;
+
+       if (event != DHD_WQ_WORK_DMA_LB_MEM_REL) {
+               DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+               return;
+       }
+       if (dhd_info == NULL) {
+               DHD_ERROR(("%s: invalid dhd_info\n", __FUNCTION__));
+               return;
+       }
+       if (dmmap == NULL) {
+               DHD_ERROR(("%s: dmmap is null\n", __FUNCTION__));
+               return;
+       }
+       dmaxfer_free_prev_dmaaddr(&dhd_info->pub, dmmap);
+}
+
+void
+dhd_schedule_dmaxfer_free(dhd_pub_t *dhdp, dmaxref_mem_map_t *dmmap)
+{
+       dhd_info_t *dhd_info = dhdp->info;
+
+       dhd_deferred_schedule_work(dhd_info->dhd_deferred_wq, (void *)dmmap,
+               DHD_WQ_WORK_DMA_LB_MEM_REL, dmaxfer_free_dmaaddr_handler, DHD_WQ_WORK_PRIORITY_LOW);
+}
+#endif /* PCIE_FULL_DONGLE */
+/* ---------------------------- End of sysfs implementation ------------------------------------- */
+#ifdef SET_PCIE_IRQ_CPU_CORE
+void
+dhd_set_irq_cpucore(dhd_pub_t *dhdp, int affinity_cmd)
+{
+       unsigned int pcie_irq = 0;
+
+       if (!dhdp) {
+               DHD_ERROR(("%s : dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (!dhdp->bus) {
+               DHD_ERROR(("%s : dhd->bus is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_ERROR(("Enter %s, PCIe affinity cmd=0x%x\n", __FUNCTION__, affinity_cmd));
+
+       if (dhdpcie_get_pcieirq(dhdp->bus, &pcie_irq)) {
+               DHD_ERROR(("%s : Can't get interrupt number\n", __FUNCTION__));
+               return;
+       }
+
+       /*
+               irq_set_affinity() assign dedicated CPU core PCIe interrupt
+               If dedicated CPU core is not on-line,
+               PCIe interrupt scheduled on CPU core 0
+       */
+       switch (affinity_cmd) {
+               case PCIE_IRQ_AFFINITY_OFF:
+                       break;
+               case PCIE_IRQ_AFFINITY_BIG_CORE_ANY:
+#if defined(CONFIG_ARCH_SM8150) || defined(CONFIG_ARCH_KONA)
+                       irq_set_affinity_hint(pcie_irq, dhdp->info->cpumask_primary);
+                       irq_set_affinity(pcie_irq, dhdp->info->cpumask_primary);
+#else /* Exynos and Others */
+                       irq_set_affinity(pcie_irq, dhdp->info->cpumask_primary);
+#endif /* CONFIG_ARCH_SM8150 || CONFIG_ARCH_KONA */
+                       irq_set_affinity(pcie_irq, dhdp->info->cpumask_primary);
+                       break;
+#if defined(CONFIG_SOC_EXYNOS9810) || defined(CONFIG_SOC_EXYNOS9820) || \
+       defined(CONFIG_SOC_EXYNOS9830)
+               case PCIE_IRQ_AFFINITY_BIG_CORE_EXYNOS:
+                       DHD_ERROR(("%s, PCIe IRQ:%u set Core %d\n",
+                               __FUNCTION__, pcie_irq, PCIE_IRQ_CPU_CORE));
+                       irq_set_affinity(pcie_irq, cpumask_of(PCIE_IRQ_CPU_CORE));
+                       break;
+#endif /* CONFIG_SOC_EXYNOS9810 || CONFIG_SOC_EXYNOS9820 ||
+       * CONFIG_SOC_EXYNOS9830
+       */
+               default:
+                       DHD_ERROR(("%s, Unknown PCIe affinity cmd=0x%x\n",
+                               __FUNCTION__, affinity_cmd));
+       }
+}
+#endif /* SET_PCIE_IRQ_CPU_CORE */
+
+int
+dhd_write_file(const char *filepath, char *buf, int buf_len)
+{
+       struct file *fp = NULL;
+       mm_segment_t old_fs;
+       int ret = 0;
+
+       /* change to KERNEL_DS address limit */
+       old_fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       /* File is always created. */
+       fp = filp_open(filepath, O_RDWR | O_CREAT, 0664);
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("%s: Couldn't open file '%s' err %ld\n",
+                       __FUNCTION__, filepath, PTR_ERR(fp)));
+               ret = BCME_ERROR;
+       } else {
+               if (fp->f_mode & FMODE_WRITE) {
+                       ret = vfs_write(fp, buf, buf_len, &fp->f_pos);
+                       if (ret < 0) {
+                               DHD_ERROR(("%s: Couldn't write file '%s'\n",
+                                       __FUNCTION__, filepath));
+                               ret = BCME_ERROR;
+                       } else {
+                               ret = BCME_OK;
+                       }
+               }
+               filp_close(fp, NULL);
+       }
+
+       /* restore previous address limit */
+       set_fs(old_fs);
+
+       return ret;
+}
+
+int
+dhd_read_file(const char *filepath, char *buf, int buf_len)
+{
+       struct file *fp = NULL;
+       mm_segment_t old_fs;
+       int ret;
+
+       /* change to KERNEL_DS address limit */
+       old_fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       fp = filp_open(filepath, O_RDONLY, 0);
+       if (IS_ERR(fp)) {
+               set_fs(old_fs);
+               DHD_ERROR(("%s: File %s doesn't exist\n", __FUNCTION__, filepath));
+               return BCME_ERROR;
+       }
+
+       ret = kernel_read_compat(fp, 0, buf, buf_len);
+       filp_close(fp, NULL);
+
+       /* restore previous address limit */
+       set_fs(old_fs);
+
+       /* Return the number of bytes read */
+       if (ret > 0) {
+               /* Success to read */
+               ret = 0;
+       } else {
+               DHD_ERROR(("%s: Couldn't read the file %s, ret=%d\n",
+                       __FUNCTION__, filepath, ret));
+               ret = BCME_ERROR;
+       }
+
+       return ret;
+}
+
+int
+dhd_write_file_and_check(const char *filepath, char *buf, int buf_len)
+{
+       int ret;
+
+       ret = dhd_write_file(filepath, buf, buf_len);
+       if (ret < 0) {
+               return ret;
+       }
+
+       /* Read the file again and check if the file size is not zero */
+       memset(buf, 0, buf_len);
+       ret = dhd_read_file(filepath, buf, buf_len);
+
+       return ret;
+}
+
+#ifdef FILTER_IE
+int dhd_read_from_file(dhd_pub_t *dhd)
+{
+       int ret = 0, nread = 0;
+       void *fd;
+       uint8 *buf;
+       NULL_CHECK(dhd, "dhd is NULL", ret);
+
+       buf = MALLOCZ(dhd->osh, FILE_BLOCK_READ_SIZE);
+       if (!buf) {
+               DHD_ERROR(("error: failed to alllocate buf.\n"));
+               return BCME_NOMEM;
+       }
+
+       /* open file to read */
+       fd = dhd_os_open_image1(dhd, FILTER_IE_PATH);
+       if (!fd) {
+               DHD_ERROR(("No filter file(not an error), filter path%s\n", FILTER_IE_PATH));
+               ret = BCME_EPERM;
+               goto exit;
+       }
+       nread = dhd_os_get_image_block(buf, (FILE_BLOCK_READ_SIZE - 1), fd);
+       if (nread > 0) {
+               buf[nread] = '\0';
+               if ((ret = dhd_parse_filter_ie(dhd, buf)) < 0) {
+                       DHD_ERROR(("error: failed to parse filter ie\n"));
+               }
+       } else {
+               DHD_ERROR(("error: zero length file.failed to read\n"));
+               ret = BCME_ERROR;
+       }
+       dhd_os_close_image1(dhd, fd);
+exit:
+       if (buf) {
+               MFREE(dhd->osh, buf, FILE_BLOCK_READ_SIZE);
+       }
+       return ret;
+}
+
+int dhd_get_filter_ie_count(dhd_pub_t *dhdp, uint8* buf)
+{
+       uint8* pstr = buf;
+       int element_count = 0;
+
+       if (buf == NULL) {
+               return BCME_ERROR;
+       }
+
+       while (*pstr != '\0') {
+               if (*pstr == '\n') {
+                       element_count++;
+               }
+               pstr++;
+       }
+       /*
+        * New line character must not be present after last line.
+        * To count last line
+        */
+       element_count++;
+
+       return element_count;
+}
+
+int dhd_parse_oui(dhd_pub_t *dhd, uint8 *inbuf, uint8 *oui, int len)
+{
+       uint8 i, j, msb, lsb, oui_len = 0;
+       /*
+        * OUI can vary from 3 bytes to 5 bytes.
+        * While reading from file as ascii input it can
+        * take maximum size of 14 bytes and minumum size of
+        * 8 bytes including ":"
+        * Example 5byte OUI <AB:DE:BE:CD:FA>
+        * Example 3byte OUI <AB:DC:EF>
+        */
+
+       if ((inbuf == NULL) || (len < 8) || (len > 14)) {
+               DHD_ERROR(("error: failed to parse OUI \n"));
+               return BCME_ERROR;
+       }
+
+       for (j = 0, i = 0; i < len; i += 3, ++j) {
+               if (!bcm_isxdigit(inbuf[i]) || !bcm_isxdigit(inbuf[i + 1])) {
+                       DHD_ERROR(("error: invalid OUI format \n"));
+                       return BCME_ERROR;
+               }
+               msb = inbuf[i] > '9' ? bcm_toupper(inbuf[i]) - 'A' + 10 : inbuf[i] - '0';
+               lsb = inbuf[i + 1] > '9' ? bcm_toupper(inbuf[i + 1]) -
+                       'A' + 10 : inbuf[i + 1] - '0';
+               oui[j] = (msb << 4) | lsb;
+       }
+       /* Size of oui.It can vary from 3/4/5 */
+       oui_len = j;
+
+       return oui_len;
+}
+
+int dhd_check_valid_ie(dhd_pub_t *dhdp, uint8* buf, int len)
+{
+       int i = 0;
+
+       while (i < len) {
+               if (!bcm_isdigit(buf[i])) {
+                       DHD_ERROR(("error: non digit value found in filter_ie \n"));
+                       return BCME_ERROR;
+               }
+               i++;
+       }
+       if (bcm_atoi((char*)buf) > 255) {
+               DHD_ERROR(("error: element id cannot be greater than 255 \n"));
+               return BCME_ERROR;
+       }
+
+       return BCME_OK;
+}
+
+int dhd_parse_filter_ie(dhd_pub_t *dhd, uint8 *buf)
+{
+       int element_count = 0, i = 0, oui_size = 0, ret = 0;
+       uint16 bufsize, buf_space_left, id = 0, len = 0;
+       uint16 filter_iovsize, all_tlvsize;
+       wl_filter_ie_tlv_t *p_ie_tlv = NULL;
+       wl_filter_ie_iov_v1_t *p_filter_iov = (wl_filter_ie_iov_v1_t *) NULL;
+       char *token = NULL, *ele_token = NULL, *oui_token = NULL, *type = NULL;
+       uint8 data[20];
+
+       element_count = dhd_get_filter_ie_count(dhd, buf);
+       DHD_INFO(("total element count %d \n", element_count));
+       /* Calculate the whole buffer size */
+       filter_iovsize = sizeof(wl_filter_ie_iov_v1_t) + FILTER_IE_BUFSZ;
+       p_filter_iov = MALLOCZ(dhd->osh, filter_iovsize);
+
+       if (p_filter_iov == NULL) {
+               DHD_ERROR(("error: failed to allocate %d bytes of memory\n", filter_iovsize));
+               return BCME_ERROR;
+       }
+
+       /* setup filter iovar header */
+       p_filter_iov->version = WL_FILTER_IE_VERSION;
+       p_filter_iov->len = filter_iovsize;
+       p_filter_iov->fixed_length = p_filter_iov->len - FILTER_IE_BUFSZ;
+       p_filter_iov->pktflag = FC_PROBE_REQ;
+       p_filter_iov->option = WL_FILTER_IE_CHECK_SUB_OPTION;
+       /* setup TLVs */
+       bufsize = filter_iovsize - WL_FILTER_IE_IOV_HDR_SIZE; /* adjust available size for TLVs */
+       p_ie_tlv = (wl_filter_ie_tlv_t *)&p_filter_iov->tlvs[0];
+       buf_space_left = bufsize;
+
+       while ((i < element_count) && (buf != NULL)) {
+               len = 0;
+               /* token contains one line of input data */
+               token = bcmstrtok((char**)&buf, "\n", NULL);
+               if (token == NULL) {
+                       break;
+               }
+               if ((ele_token = bcmstrstr(token, ",")) == NULL) {
+               /* only element id is present */
+                       if (dhd_check_valid_ie(dhd, token, strlen(token)) == BCME_ERROR) {
+                               DHD_ERROR(("error: Invalid element id \n"));
+                               ret = BCME_ERROR;
+                               goto exit;
+                       }
+                       id = bcm_atoi((char*)token);
+                       data[len++] = WL_FILTER_IE_SET;
+               } else {
+                       /* oui is present */
+                       ele_token = bcmstrtok(&token, ",", NULL);
+                       if ((ele_token == NULL) || (dhd_check_valid_ie(dhd, ele_token,
+                               strlen(ele_token)) == BCME_ERROR)) {
+                               DHD_ERROR(("error: Invalid element id \n"));
+                               ret = BCME_ERROR;
+                               goto exit;
+                       }
+                       id =  bcm_atoi((char*)ele_token);
+                       data[len++] = WL_FILTER_IE_SET;
+                       if ((oui_token = bcmstrstr(token, ",")) == NULL) {
+                               oui_size = dhd_parse_oui(dhd, token, &(data[len]), strlen(token));
+                               if (oui_size == BCME_ERROR) {
+                                       DHD_ERROR(("error: Invalid OUI \n"));
+                                       ret = BCME_ERROR;
+                                       goto exit;
+                               }
+                               len += oui_size;
+                       } else {
+                               /* type is present */
+                               oui_token = bcmstrtok(&token, ",", NULL);
+                               if ((oui_token == NULL) || ((oui_size =
+                                       dhd_parse_oui(dhd, oui_token,
+                                       &(data[len]), strlen(oui_token))) == BCME_ERROR)) {
+                                       DHD_ERROR(("error: Invalid OUI \n"));
+                                       ret = BCME_ERROR;
+                                       goto exit;
+                               }
+                               len += oui_size;
+                               if ((type = bcmstrstr(token, ",")) == NULL) {
+                                       if (dhd_check_valid_ie(dhd, token,
+                                               strlen(token)) == BCME_ERROR) {
+                                               DHD_ERROR(("error: Invalid type \n"));
+                                               ret = BCME_ERROR;
+                                               goto exit;
+                                       }
+                                       data[len++] = bcm_atoi((char*)token);
+                               } else {
+                                       /* subtype is present */
+                                       type = bcmstrtok(&token, ",", NULL);
+                                       if ((type == NULL) || (dhd_check_valid_ie(dhd, type,
+                                               strlen(type)) == BCME_ERROR)) {
+                                               DHD_ERROR(("error: Invalid type \n"));
+                                               ret = BCME_ERROR;
+                                               goto exit;
+                                       }
+                                       data[len++] = bcm_atoi((char*)type);
+                                       /* subtype is last element */
+                                       if ((token == NULL) || (*token == '\0') ||
+                                               (dhd_check_valid_ie(dhd, token,
+                                               strlen(token)) == BCME_ERROR)) {
+                                               DHD_ERROR(("error: Invalid subtype \n"));
+                                               ret = BCME_ERROR;
+                                               goto exit;
+                                       }
+                                       data[len++] = bcm_atoi((char*)token);
+                               }
+                       }
+               }
+               ret = bcm_pack_xtlv_entry((uint8 **)&p_ie_tlv,
+                       &buf_space_left, id, len, data, BCM_XTLV_OPTION_ALIGN32);
+               if (ret != BCME_OK) {
+                       DHD_ERROR(("%s : bcm_pack_xtlv_entry() failed ,"
+                               "status=%d\n", __FUNCTION__, ret));
+                       goto exit;
+               }
+               i++;
+       }
+       if (i == 0) {
+               /* file is empty or first line is blank */
+               DHD_ERROR(("error: filter_ie file is empty or first line is blank \n"));
+               ret = BCME_ERROR;
+               goto exit;
+       }
+       /* update the iov header, set len to include all TLVs + header */
+       all_tlvsize = (bufsize - buf_space_left);
+       p_filter_iov->len = htol16(all_tlvsize + WL_FILTER_IE_IOV_HDR_SIZE);
+       ret = dhd_iovar(dhd, 0, "filter_ie", (void *)p_filter_iov,
+                       p_filter_iov->len, NULL, 0, TRUE);
+       if (ret != BCME_OK) {
+               DHD_ERROR(("error: IOVAR failed, status=%d\n", ret));
+       }
+exit:
+       /* clean up */
+       if (p_filter_iov) {
+               MFREE(dhd->osh, p_filter_iov, filter_iovsize);
+       }
+       return ret;
+}
+#endif /* FILTER_IE */
+#ifdef DHD_WAKE_STATUS
+wake_counts_t*
+dhd_get_wakecount(dhd_pub_t *dhdp)
+{
+#ifdef BCMDBUS
+       return NULL;
+#else
+       return dhd_bus_get_wakecount(dhdp);
+#endif /* BCMDBUS */
+}
+#endif /* DHD_WAKE_STATUS */
+
+int
+dhd_get_random_bytes(uint8 *buf, uint len)
+{
+#ifdef BCMPCIE
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 19, 0))
+       int rndlen = get_random_bytes_arch(buf, len);
+       if (rndlen != len) {
+               bzero(buf, len);
+               get_random_bytes(buf, len);
+       }
+#else
+       get_random_bytes_arch(buf, len);
+#endif
+#endif /* BCMPCIE */
+       return BCME_OK;
+}
+
+#if defined(DHD_HANG_SEND_UP_TEST)
+void
+dhd_make_hang_with_reason(struct net_device *dev, const char *string_num)
+{
+       dhd_info_t *dhd = NULL;
+       dhd_pub_t *dhdp = NULL;
+       uint reason = HANG_REASON_MAX;
+       uint32 fw_test_code = 0;
+       dhd = DHD_DEV_INFO(dev);
+
+       if (dhd) {
+               dhdp = &dhd->pub;
+       }
+
+       if (!dhd || !dhdp) {
+               return;
+       }
+
+       reason = (uint) bcm_strtoul(string_num, NULL, 0);
+       DHD_ERROR(("Enter %s, reason=0x%x\n", __FUNCTION__,  reason));
+
+       if (reason == 0) {
+               if (dhdp->req_hang_type) {
+                       DHD_ERROR(("%s, Clear HANG test request 0x%x\n",
+                               __FUNCTION__, dhdp->req_hang_type));
+                       dhdp->req_hang_type = 0;
+                       return;
+               } else {
+                       DHD_ERROR(("%s, No requested HANG test\n", __FUNCTION__));
+                       return;
+               }
+       } else if ((reason <= HANG_REASON_MASK) || (reason >= HANG_REASON_MAX)) {
+               DHD_ERROR(("Invalid HANG request, reason 0x%x\n", reason));
+               return;
+       }
+
+       if (dhdp->req_hang_type != 0) {
+               DHD_ERROR(("Already HANG requested for test\n"));
+               return;
+       }
+
+       switch (reason) {
+               case HANG_REASON_IOCTL_RESP_TIMEOUT:
+                       DHD_ERROR(("Make HANG!!!: IOCTL response timeout(0x%x)\n", reason));
+                       dhdp->req_hang_type = reason;
+                       fw_test_code = 102; /* resumed on timeour */
+                       (void) dhd_wl_ioctl_set_intiovar(dhdp, "bus:disconnect", fw_test_code,
+                               WLC_SET_VAR, TRUE, 0);
+                       break;
+               case HANG_REASON_DONGLE_TRAP:
+                       DHD_ERROR(("Make HANG!!!: Dongle trap (0x%x)\n", reason));
+                       dhdp->req_hang_type = reason;
+                       fw_test_code = 99; /* dongle trap */
+                       (void) dhd_wl_ioctl_set_intiovar(dhdp, "bus:disconnect", fw_test_code,
+                               WLC_SET_VAR, TRUE, 0);
+                       break;
+               case HANG_REASON_D3_ACK_TIMEOUT:
+                       DHD_ERROR(("Make HANG!!!: D3 ACK timeout (0x%x)\n", reason));
+                       dhdp->req_hang_type = reason;
+                       break;
+               case HANG_REASON_BUS_DOWN:
+                       DHD_ERROR(("Make HANG!!!: BUS down(0x%x)\n", reason));
+                       dhdp->req_hang_type = reason;
+                       break;
+               case HANG_REASON_PCIE_LINK_DOWN_RC_DETECT:
+               case HANG_REASON_PCIE_LINK_DOWN_EP_DETECT:
+               case HANG_REASON_MSGBUF_LIVELOCK:
+                       dhdp->req_hang_type = 0;
+                       DHD_ERROR(("Does not support requested HANG(0x%x)\n", reason));
+                       break;
+               case HANG_REASON_IFACE_DEL_FAILURE:
+                       dhdp->req_hang_type = 0;
+                       DHD_ERROR(("Does not support requested HANG(0x%x)\n", reason));
+                       break;
+               case HANG_REASON_HT_AVAIL_ERROR:
+                       dhdp->req_hang_type = 0;
+                       DHD_ERROR(("PCIe does not support requested HANG(0x%x)\n", reason));
+                       break;
+               case HANG_REASON_PCIE_RC_LINK_UP_FAIL:
+                       DHD_ERROR(("Make HANG!!!:Link Up(0x%x)\n", reason));
+                       dhdp->req_hang_type = reason;
+                       break;
+               default:
+                       dhdp->req_hang_type = 0;
+                       DHD_ERROR(("Unknown HANG request (0x%x)\n", reason));
+                       break;
+       }
+}
+#endif /* DHD_HANG_SEND_UP_TEST */
+
+#ifdef DHD_TX_PROFILE
+static int
+process_layer2_headers(uint8 **p, int *plen, uint16 *type)
+{
+       int err = BCME_OK;
+
+       if (*type < ETHER_TYPE_MIN) {
+               struct dot3_mac_llc_snap_header *sh = (struct dot3_mac_llc_snap_header *)*p;
+
+               if (bcmp(&sh->dsap, llc_snap_hdr, SNAP_HDR_LEN) == 0) {
+                       *type = ntoh16(sh->type);
+                       if (*type == ETHER_TYPE_8021Q) {
+                               *p += sizeof(struct dot3_mac_llc_snap_header);
+                               if ((*plen -= sizeof(struct dot3_mac_llc_snap_header)) <= 0) {
+                                       err = BCME_ERROR;
+                               }
+                       }
+                       else {
+                               struct dot3_mac_llc_snapvlan_header *svh = (struct
+                                       dot3_mac_llc_snapvlan_header *)*p;
+
+                               *type = ntoh16(svh->ether_type);
+                               *p += sizeof(struct dot3_mac_llc_snapvlan_header);
+                               if ((*plen -= sizeof(struct dot3_mac_llc_snapvlan_header)) <= 0) {
+                                       err = BCME_ERROR;
+                               }
+                       }
+               }
+               else {
+                       err = BCME_ERROR;
+               }
+       }
+       else {
+               if (*type == ETHER_TYPE_8021Q) {
+                       struct ethervlan_header *evh = (struct ethervlan_header *)*p;
+
+                       *type = ntoh16(evh->ether_type);
+                       *p += ETHERVLAN_HDR_LEN;
+                       if ((*plen -= ETHERVLAN_HDR_LEN) <= 0) {
+                               err = BCME_ERROR;
+                       }
+               }
+               else {
+                       *p += ETHER_HDR_LEN;
+                       if ((*plen -= ETHER_HDR_LEN) <= 0) {
+                               err = BCME_ERROR;
+                       }
+               }
+       }
+
+       return err;
+}
+
+static int
+process_layer3_headers(uint8 **p, int plen, uint16 *type)
+{
+       int err = BCME_OK;
+
+       if (*type == ETHER_TYPE_IP) {
+               struct ipv4_hdr *iph = (struct ipv4_hdr *)*p;
+               uint16 len = IPV4_HLEN(iph);
+               if ((plen -= len) <= 0) {
+                       err = BCME_ERROR;
+               } else if (IP_VER(iph) == IP_VER_4 && len >= IPV4_MIN_HEADER_LEN) {
+                       *type = IPV4_PROT(iph);
+                       *p += len;
+               } else {
+                       err = BCME_ERROR;
+               }
+       } else if (*type == ETHER_TYPE_IPV6) {
+               struct ipv6_hdr *ip6h = (struct ipv6_hdr *)*p;
+               if ((plen -= IPV6_MIN_HLEN) <= 0) {
+                       err = BCME_ERROR;
+               } else if (IP_VER(ip6h) == IP_VER_6) {
+                       *type = IPV6_PROT(ip6h);
+                       *p += IPV6_MIN_HLEN;
+                       if (IPV6_EXTHDR(*type)) {
+                               uint8 proto_6 = 0;
+                               int32 exth_len = ipv6_exthdr_len(*p, &proto_6);
+                               if (exth_len < 0 || ((plen -= exth_len) <= 0)) {
+                                       err = BCME_ERROR;
+                               } else {
+                                       *type = proto_6;
+                                       *p += exth_len;
+                               }
+                       }
+               } else {
+                       err = BCME_ERROR;
+               }
+       }
+
+       return err;
+}
+
+bool
+dhd_protocol_matches_profile(uint8 *p, int plen, const dhd_tx_profile_protocol_t
+               *proto)
+{
+       struct ether_header *eh = (struct ether_header *)p;
+       bool result = FALSE;
+       uint16 type;
+
+       ASSERT(proto != NULL);
+       ASSERT(p != NULL);
+
+       if (plen <= 0) {
+               result = FALSE;
+       } else {
+               type = ntoh16(eh->ether_type);
+
+               if (proto->layer == DHD_TX_PROFILE_DATA_LINK_LAYER &&
+                               proto->protocol_number == type) {
+                       result = TRUE;
+               } else if (process_layer2_headers(&p, &plen, &type) != BCME_OK) {
+                       result = FALSE;
+               } else if (proto->layer == DHD_TX_PROFILE_DATA_LINK_LAYER) {
+                       result = proto->protocol_number == type;
+               } else if (proto->layer != DHD_TX_PROFILE_NETWORK_LAYER) {
+                       result = FALSE;
+               } else if (process_layer3_headers(&p, plen, &type) != BCME_OK) {
+                       result = FALSE;
+               } else if (proto->protocol_number == type) {
+                       /* L4, only check TCP/UDP case */
+                       if ((type == IP_PROT_TCP) || (type == IP_PROT_UDP)) {
+                               /* src/dst port are the first two uint16 fields in both tcp/udp
+                                * hdr
+                                */
+                               struct bcmudp_hdr *hdr = (struct bcmudp_hdr *)p;
+
+                               /* note that a src_port or dest_port of zero counts as a match
+                                */
+                               result = ((proto->src_port == 0) || (proto->src_port ==
+                                       ntoh16(hdr->src_port))) && ((proto->dest_port == 0) ||
+                                       (proto->dest_port == ntoh16(hdr->dst_port)));
+                       } else {
+                               /* at this point we know we are dealing with layer 3, and we
+                                * know we are not dealing with TCP or UDP; this is considered a
+                                * match
+                                */
+                               result = TRUE;
+                       }
+               }
+       }
+
+       return result;
+}
+#endif /* defined(DHD_TX_PROFILE) */
+
+#ifdef BCMPCIE
+#define KIRQ_PRINT_BUF_LEN 256
+
+void
+dhd_print_kirqstats(dhd_pub_t *dhd, unsigned int irq_num)
+{
+       unsigned long flags = 0;
+       struct irq_desc *desc;
+       int i;          /* cpu iterator */
+       struct bcmstrbuf strbuf;
+       char tmp_buf[KIRQ_PRINT_BUF_LEN];
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28))
+       desc = irq_to_desc(irq_num);
+       if (!desc) {
+               DHD_ERROR(("%s : irqdesc is not found \n", __FUNCTION__));
+               return;
+       }
+       bcm_binit(&strbuf, tmp_buf, KIRQ_PRINT_BUF_LEN);
+       raw_spin_lock_irqsave(&desc->lock, flags);
+       bcm_bprintf(&strbuf, "dhd irq %u:", irq_num);
+       for_each_online_cpu(i)
+               bcm_bprintf(&strbuf, "%10u ",
+                       desc->kstat_irqs ? *per_cpu_ptr(desc->kstat_irqs, i) : 0);
+       if (desc->irq_data.chip) {
+               if (desc->irq_data.chip->name)
+                       bcm_bprintf(&strbuf, " %8s", desc->irq_data.chip->name);
+               else
+                       bcm_bprintf(&strbuf, " %8s", "-");
+       } else {
+               bcm_bprintf(&strbuf, " %8s", "None");
+       }
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0))
+       if (desc->irq_data.domain)
+               bcm_bprintf(&strbuf, " %d", (int)desc->irq_data.hwirq);
+#ifdef CONFIG_GENERIC_IRQ_SHOW_LEVEL
+       bcm_bprintf(&strbuf, " %-8s", irqd_is_level_type(&desc->irq_data) ? "Level" : "Edge");
+#endif
+#endif /* LINUX VERSION > 3.1.0 */
+
+       if (desc->name)
+               bcm_bprintf(&strbuf, "-%-8s", desc->name);
+
+       DHD_ERROR(("%s\n", strbuf.origbuf));
+       raw_spin_unlock_irqrestore(&desc->lock, flags);
+#endif /* LINUX VERSION > 2.6.28 */
+}
+#endif /* BCMPCIE */
+
+void
+dhd_show_kirqstats(dhd_pub_t *dhd)
+{
+       unsigned int irq = -1;
+#ifdef BCMPCIE
+       dhdpcie_get_pcieirq(dhd->bus, &irq);
+#endif /* BCMPCIE */
+#ifdef BCMSDIO
+       irq = ((wifi_adapter_info_t *)dhd->info->adapter)->irq_num;
+#endif /* BCMSDIO */
+       if (irq != -1) {
+#ifdef BCMPCIE
+               DHD_ERROR(("DUMP data kernel irq stats : \n"));
+               dhd_print_kirqstats(dhd, irq);
+#endif /* BCMPCIE */
+#ifdef BCMSDIO
+               DHD_ERROR(("DUMP data/host wakeup kernel irq stats : \n"));
+#endif /* BCMSDIO */
+       }
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       irq = dhd_bus_get_oob_irq_num(dhd);
+       if (irq) {
+               DHD_ERROR(("DUMP PCIE host wakeup kernel irq stats : \n"));
+               dhd_print_kirqstats(dhd, irq);
+       }
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+}
+
+void
+dhd_print_tasklet_status(dhd_pub_t *dhd)
+{
+       dhd_info_t *dhdinfo;
+
+       if (!dhd) {
+               DHD_ERROR(("%s : DHD is null\n", __FUNCTION__));
+               return;
+       }
+
+       dhdinfo = dhd->info;
+
+       if (!dhdinfo) {
+               DHD_ERROR(("%s : DHD INFO is null \n", __FUNCTION__));
+               return;
+       }
+
+       DHD_ERROR(("DHD Tasklet status : 0x%lx\n", dhdinfo->tasklet.state));
+}
+
+#if defined(DHD_MQ) && defined(DHD_MQ_STATS)
+void
+dhd_mqstats_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+       dhd_info_t *dhd = NULL;
+       int i = 0, j = 0;
+
+       if (!dhdp || !strbuf)
+               return;
+
+       dhd = dhdp->info;
+       bcm_bprintf(strbuf, "\nMQ STATS:\n=========\n");
+
+       bcm_bprintf(strbuf, "\nTx packet arrival AC histogram:\n");
+       bcm_bprintf(strbuf, "AC_BE    \tAC_BK    \tAC_VI    \tAC_VO\n");
+       bcm_bprintf(strbuf, "-----    \t-----    \t-----    \t-----\n");
+       for (i = 0; i < AC_COUNT; i++)
+               bcm_bprintf(strbuf, "%-10d\t", dhd->pktcnt_per_ac[i]);
+
+       bcm_bprintf(strbuf, "\n\nTx packet arrival Q-AC histogram:\n");
+       bcm_bprintf(strbuf, "\tAC_BE    \tAC_BK    \tAC_VI    \tAC_VO\n");
+       bcm_bprintf(strbuf, "\t-----    \t-----    \t-----    \t-----");
+       for (i = 0; i < MQ_MAX_QUEUES; i++) {
+               bcm_bprintf(strbuf, "\nQ%d\t", i);
+               for (j = 0; j < AC_COUNT; j++)
+                       bcm_bprintf(strbuf, "%-8d\t", dhd->pktcnt_qac_histo[i][j]);
+       }
+
+       bcm_bprintf(strbuf, "\n\nTx Q-CPU scheduling histogram:\n");
+       bcm_bprintf(strbuf, "\t");
+       for (i = 0; i < nr_cpu_ids; i++)
+               bcm_bprintf(strbuf, "CPU%d    \t", i);
+       for (i = 0; i < MQ_MAX_QUEUES; i++) {
+               bcm_bprintf(strbuf, "\nQ%d\t", i);
+               for (j = 0; j < nr_cpu_ids; j++)
+                       bcm_bprintf(strbuf, "%-8d\t", dhd->cpu_qstats[i][j]);
+       }
+       bcm_bprintf(strbuf, "\n");
+}
+#endif /* DHD_MQ && DHD_MQ_STATS */
+
+#ifdef DHD_MAP_LOGGING
+/* Will be called from SMMU fault handler */
+void
+dhd_smmu_fault_handler(uint32 axid, ulong fault_addr)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)g_dhd_pub;
+       uint32 irq = (uint32)-1;
+
+       DHD_ERROR(("%s: Trigger SMMU Fault\n", __FUNCTION__));
+       DHD_ERROR(("%s: axid:0x%x, fault_addr:0x%lx", __FUNCTION__, axid, fault_addr));
+       dhdp->smmu_fault_occurred = TRUE;
+#ifdef DNGL_AXI_ERROR_LOGGING
+       dhdp->axi_error = TRUE;
+       dhdp->axi_err_dump->axid = axid;
+       dhdp->axi_err_dump->fault_address = fault_addr;
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+       /* Disable PCIe IRQ */
+       dhdpcie_get_pcieirq(dhdp->bus, &irq);
+       if (irq != (uint32)-1) {
+               disable_irq_nosync(irq);
+       }
+
+       /* Take debug information first */
+       DHD_OS_WAKE_LOCK(dhdp);
+       dhd_prot_smmu_fault_dump(dhdp);
+       DHD_OS_WAKE_UNLOCK(dhdp);
+
+       /* Take AXI information if possible */
+#ifdef DNGL_AXI_ERROR_LOGGING
+#ifdef DHD_USE_WQ_FOR_DNGL_AXI_ERROR
+       dhd_axi_error_dispatch(dhdp);
+#else
+       dhd_axi_error(dhdp);
+#endif /* DHD_USE_WQ_FOR_DNGL_AXI_ERROR */
+#endif /* DNGL_AXI_ERROR_LOGGING */
+}
+EXPORT_SYMBOL(dhd_smmu_fault_handler);
+#endif /* DHD_MAP_LOGGING */
+
+#ifdef DHD_ERPOM
+static void
+dhd_error_recovery(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+       dhd_pub_t *dhdp;
+       int ret = 0;
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       dhdp = &dhd->pub;
+
+       if (!(dhd->dhd_state & DHD_ATTACH_STATE_DONE)) {
+               DHD_ERROR(("%s: init not completed, cannot initiate recovery\n",
+                       __FUNCTION__));
+               return;
+       }
+
+       ret = dhd_bus_perform_flr_with_quiesce(dhdp, dhdp->bus, FALSE);
+       if (ret != BCME_DNGL_DEVRESET) {
+               DHD_ERROR(("%s: dhd_bus_perform_flr_with_quiesce failed with ret: %d,"
+                       "toggle REG_ON\n", __FUNCTION__, ret));
+               /* toggle REG_ON */
+               dhdp->pom_toggle_reg_on(WLAN_FUNC_ID, BY_WLAN_DUE_TO_WLAN);
+               return;
+       }
+}
+
+void
+dhd_schedule_reset(dhd_pub_t *dhdp)
+{
+       if (dhdp->enable_erpom) {
+               dhd_deferred_schedule_work(dhdp->info->dhd_deferred_wq, NULL,
+                       DHD_WQ_WORK_ERROR_RECOVERY, dhd_error_recovery, DHD_WQ_WORK_PRIORITY_HIGH);
+       }
+}
+#endif /* DHD_ERPOM */
+
+#ifdef DHD_PKT_LOGGING
+int
+dhd_pktlog_debug_dump(dhd_pub_t *dhdp)
+{
+       struct net_device *primary_ndev;
+       struct bcm_cfg80211 *cfg;
+       unsigned long flags = 0;
+
+       primary_ndev = dhd_linux_get_primary_netdev(dhdp);
+       if (!primary_ndev) {
+               DHD_ERROR(("%s: Cannot find primary netdev\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       cfg = wl_get_cfg(primary_ndev);
+       if (!cfg) {
+               DHD_ERROR(("%s: Cannot find cfg\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       DHD_GENERAL_LOCK(dhdp, flags);
+       if (DHD_BUS_BUSY_CHECK_IN_HALDUMP(dhdp)) {
+               DHD_GENERAL_UNLOCK(dhdp, flags);
+               DHD_ERROR(("%s: HAL dump is already triggered \n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       DHD_BUS_BUSY_SET_IN_HALDUMP(dhdp);
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+       DHD_OS_WAKE_LOCK(dhdp);
+
+       if (wl_cfg80211_is_hal_started(cfg)) {
+               dhdp->pktlog_debug = TRUE;
+               dhd_dbg_send_urgent_evt(dhdp, NULL, 0);
+       } else {
+               DHD_ERROR(("[DUMP] %s: HAL Not started. skip urgent event\n", __FUNCTION__));
+       }
+       DHD_OS_WAKE_UNLOCK(dhdp);
+       /* In case of dhd_os_busbusy_wait_bitmask() timeout,
+        * hal dump bit will not be cleared. Hence clearing it here.
+        */
+       DHD_GENERAL_LOCK(dhdp, flags);
+       DHD_BUS_BUSY_CLEAR_IN_HALDUMP(dhdp);
+       dhd_os_busbusy_wake(dhdp);
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+
+       return BCME_OK;
+}
+
+void
+dhd_pktlog_dump(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (dhd_pktlog_dump_write_file(&dhd->pub)) {
+               DHD_ERROR(("%s: writing pktlog dump file failed\n", __FUNCTION__));
+               return;
+       }
+}
+
+void
+dhd_schedule_pktlog_dump(dhd_pub_t *dhdp)
+{
+       dhd_deferred_schedule_work(dhdp->info->dhd_deferred_wq,
+                       (void*)NULL, DHD_WQ_WORK_PKTLOG_DUMP,
+                       dhd_pktlog_dump, DHD_WQ_WORK_PRIORITY_HIGH);
+}
+#endif /* DHD_PKT_LOGGING */
+
+#ifdef DHDTCPSYNC_FLOOD_BLK
+static void dhd_blk_tsfl_handler(struct work_struct * work)
+{
+       dhd_if_t *ifp = NULL;
+       dhd_pub_t *dhdp = NULL;
+       /* Ignore compiler warnings due to -Werror=cast-qual */
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       ifp = container_of(work, dhd_if_t, blk_tsfl_work);
+       GCC_DIAGNOSTIC_POP();
+
+       if (ifp) {
+               dhdp = &ifp->info->pub;
+               if (dhdp) {
+                       if ((dhdp->op_mode & DHD_FLAG_P2P_GO_MODE)||
+                               (dhdp->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+                               DHD_ERROR(("Disassoc due to TCP SYNC FLOOD ATTACK\n"));
+                               wl_cfg80211_del_all_sta(ifp->net, WLAN_REASON_UNSPECIFIED);
+                       } else if ((dhdp->op_mode & DHD_FLAG_P2P_GC_MODE)||
+                               (dhdp->op_mode & DHD_FLAG_STA_MODE)) {
+                               DHD_ERROR(("Diconnect due to TCP SYNC FLOOD ATTACK\n"));
+                               wl_cfg80211_disassoc(ifp->net, WLAN_REASON_UNSPECIFIED);
+                       }
+                       ifp->disconnect_tsync_flood = TRUE;
+               }
+       }
+}
+void dhd_reset_tcpsync_info_by_ifp(dhd_if_t *ifp)
+{
+       ifp->tsync_rcvd = 0;
+       ifp->tsyncack_txed = 0;
+       ifp->last_sync = DIV_U64_BY_U32(OSL_LOCALTIME_NS(), NSEC_PER_SEC);
+}
+void dhd_reset_tcpsync_info_by_dev(struct net_device *dev)
+{
+       dhd_if_t *ifp = NULL;
+       if (dev) {
+               ifp = DHD_DEV_IFP(dev);
+       }
+       if (ifp) {
+               ifp->tsync_rcvd = 0;
+               ifp->tsyncack_txed = 0;
+               ifp->last_sync = DIV_U64_BY_U32(OSL_LOCALTIME_NS(), NSEC_PER_SEC);
+               ifp->tsync_per_sec = 0;
+               ifp->disconnect_tsync_flood = FALSE;
+       }
+}
+#endif /* DHDTCPSYNC_FLOOD_BLK */
+
+#ifdef DHD_4WAYM4_FAIL_DISCONNECT
+static void dhd_m4_state_handler(struct work_struct *work)
+{
+       dhd_if_t *ifp = NULL;
+       /* Ignore compiler warnings due to -Werror=cast-qual */
+       struct delayed_work *dw = to_delayed_work(work);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       ifp = container_of(dw, dhd_if_t, m4state_work);
+       GCC_DIAGNOSTIC_POP();
+
+       if (ifp && ifp->net &&
+               (OSL_ATOMIC_READ(ifp->info->pub->osh, &ifp->m4state) == M4_TXFAILED)) {
+               DHD_ERROR(("Disassoc for 4WAY_HANDSHAKE_TIMEOUT at %s\n",
+                               ifp->net->name));
+               wl_cfg80211_disassoc(ifp->net, WLAN_REASON_4WAY_HANDSHAKE_TIMEOUT);
+       }
+}
+
+void
+dhd_eap_txcomplete(dhd_pub_t *dhdp, void *txp, bool success, int ifidx)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(dhdp->info);
+       struct ether_header *eh;
+       uint16 type;
+
+       if (!success) {
+               /* XXX where does this stuff belong to? */
+               dhd_prot_hdrpull(dhdp, NULL, txp, NULL, NULL);
+
+               /* XXX Use packet tag when it is available to identify its type */
+               eh = (struct ether_header *)PKTDATA(dhdp->osh, txp);
+               type  = ntoh16(eh->ether_type);
+               if (type == ETHER_TYPE_802_1X) {
+                       if (dhd_is_4way_msg((uint8 *)eh) == EAPOL_4WAY_M4) {
+                               dhd_if_t *ifp = NULL;
+                               ifp = dhd->iflist[ifidx];
+                               if (!ifp || !ifp->net) {
+                                       return;
+                               }
+
+                               DHD_INFO(("%s: M4 TX failed on %d.\n",
+                                       __FUNCTION__, ifidx));
+
+                               OSL_ATOMIC_SET(dhdp->osh, &ifp->m4state, M4_TXFAILED);
+                               schedule_delayed_work(&ifp->m4state_work,
+                                       msecs_to_jiffies(MAX_4WAY_TIMEOUT_MS));
+                       }
+               }
+       }
+}
+
+void
+dhd_cleanup_m4_state_work(dhd_pub_t *dhdp, int ifidx)
+{
+       dhd_info_t *dhdinfo;
+       dhd_if_t *ifp;
+
+       if ((ifidx < 0) || (ifidx >= DHD_MAX_IFS)) {
+               DHD_ERROR(("%s: invalid ifidx %d\n", __FUNCTION__, ifidx));
+               return;
+       }
+
+       dhdinfo = (dhd_info_t *)(dhdp->info);
+       if (!dhdinfo) {
+               DHD_ERROR(("%s: dhdinfo is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       ifp = dhdinfo->iflist[ifidx];
+       if (ifp) {
+               cancel_delayed_work_sync(&ifp->m4state_work);
+       }
+}
+#endif /* DHD_4WAYM4_FAIL_DISCONNECT */
+
+#ifdef BIGDATA_SOFTAP
+void dhd_schedule_gather_ap_stadata(void *bcm_cfg, void *ndev, const wl_event_msg_t *e)
+{
+       struct bcm_cfg80211 *cfg;
+       dhd_pub_t *dhdp;
+       ap_sta_wq_data_t *p_wq_data;
+
+       if  (!bcm_cfg || !ndev || !e) {
+               WL_ERR(("bcm_cfg=%p ndev=%p e=%p\n", bcm_cfg, ndev, e));
+               return;
+       }
+
+       cfg = (struct bcm_cfg80211 *)bcm_cfg;
+       dhdp = (dhd_pub_t *)cfg->pub;
+
+       if (!dhdp || !cfg->ap_sta_info) {
+               WL_ERR(("dhdp=%p ap_sta_info=%p\n", dhdp, cfg->ap_sta_info));
+               return;
+       }
+
+       p_wq_data = (ap_sta_wq_data_t *)MALLOCZ(dhdp->osh, sizeof(ap_sta_wq_data_t));
+       if (unlikely(!p_wq_data)) {
+               DHD_ERROR(("%s(): could not allocate memory for - "
+                                       "ap_sta_wq_data_t\n", __FUNCTION__));
+               return;
+       }
+
+       mutex_lock(&cfg->ap_sta_info->wq_data_sync);
+
+       memcpy(&p_wq_data->e, e, sizeof(wl_event_msg_t));
+       p_wq_data->dhdp = dhdp;
+       p_wq_data->bcm_cfg = cfg;
+       p_wq_data->ndev = (struct net_device *)ndev;
+
+       mutex_unlock(&cfg->ap_sta_info->wq_data_sync);
+
+       dhd_deferred_schedule_work(dhdp->info->dhd_deferred_wq,
+                       p_wq_data, DHD_WQ_WORK_GET_BIGDATA_AP,
+                       wl_gather_ap_stadata, DHD_WQ_WORK_PRIORITY_HIGH);
+
+}
+#endif /* BIGDATA_SOFTAP */
+
+void
+get_debug_dump_time(char *str)
+{
+       struct osl_timespec curtime;
+       unsigned long local_time;
+       struct rtc_time tm;
+
+       if (!strlen(str)) {
+               osl_do_gettimeofday(&curtime);
+               local_time = (u32)(curtime.tv_sec -
+                               (sys_tz.tz_minuteswest * DHD_LOG_DUMP_TS_MULTIPLIER_VALUE));
+               rtc_time_to_tm(local_time, &tm);
+
+               snprintf(str, DEBUG_DUMP_TIME_BUF_LEN, DHD_LOG_DUMP_TS_FMT_YYMMDDHHMMSSMSMS,
+                               tm.tm_year - 100, tm.tm_mon + 1, tm.tm_mday, tm.tm_hour, tm.tm_min,
+                               tm.tm_sec, (int)(curtime.tv_usec/NSEC_PER_USEC));
+       }
+}
+
+void
+clear_debug_dump_time(char *str)
+{
+       memset(str, 0, DEBUG_DUMP_TIME_BUF_LEN);
+}
+#if defined(WL_CFGVENDOR_SEND_HANG_EVENT) || defined(DHD_PKT_LOGGING)
+void
+copy_debug_dump_time(char *dest, char *src)
+{
+       memcpy(dest, src, DEBUG_DUMP_TIME_BUF_LEN);
+}
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT || DHD_PKT_LOGGING */
+
+/*
+ * DHD RING
+ */
+#define DHD_RING_ERR_INTERNAL(fmt, ...) DHD_ERROR(("EWPF-" fmt, ##__VA_ARGS__))
+#define DHD_RING_TRACE_INTERNAL(fmt, ...) DHD_INFO(("EWPF-" fmt, ##__VA_ARGS__))
+
+#define DHD_RING_ERR(x) DHD_RING_ERR_INTERNAL x
+#define DHD_RING_TRACE(x) DHD_RING_TRACE_INTERNAL x
+
+#define DHD_RING_MAGIC 0x20170910
+#define DHD_RING_IDX_INVALID   0xffffffff
+
+#define DHD_RING_SYNC_LOCK_INIT(osh)           osl_spin_lock_init(osh)
+#define DHD_RING_SYNC_LOCK_DEINIT(osh, lock)   osl_spin_lock_deinit(osh, lock)
+#define DHD_RING_SYNC_LOCK(lock, flags)                (flags) = osl_spin_lock(lock)
+#define DHD_RING_SYNC_UNLOCK(lock, flags)      osl_spin_unlock(lock, flags)
+
+typedef struct {
+       uint32 elem_size;
+       uint32 elem_cnt;
+       uint32 write_idx;       /* next write index, -1 : not started */
+       uint32 read_idx;        /* next read index, -1 : not start */
+
+       /* protected elements during serialization */
+       int lock_idx;   /* start index of locked, element will not be overried */
+       int lock_count; /* number of locked, from lock idx */
+
+       /* saved data elements */
+       void *elem;
+} dhd_fixed_ring_info_t;
+
+typedef struct {
+       uint32 elem_size;
+       uint32 elem_cnt;
+       uint32 idx;             /* -1 : not started */
+       uint32 rsvd;            /* reserved for future use */
+
+       /* protected elements during serialization */
+       atomic_t ring_locked;
+       /* check the overwriting */
+       uint32 ring_overwrited;
+
+       /* saved data elements */
+       void *elem;
+} dhd_singleidx_ring_info_t;
+
+typedef struct {
+       uint32 magic;
+       uint32 type;
+       void *ring_sync; /* spinlock for sync */
+       union {
+               dhd_fixed_ring_info_t fixed;
+               dhd_singleidx_ring_info_t single;
+       };
+} dhd_ring_info_t;
+
+uint32
+dhd_ring_get_hdr_size(void)
+{
+       return sizeof(dhd_ring_info_t);
+}
+
+void *
+dhd_ring_init(dhd_pub_t *dhdp, uint8 *buf, uint32 buf_size, uint32 elem_size,
+       uint32 elem_cnt, uint32 type)
+{
+       dhd_ring_info_t *ret_ring;
+
+       if (!buf) {
+               DHD_RING_ERR(("NO RING BUFFER\n"));
+               return NULL;
+       }
+
+       if (buf_size < dhd_ring_get_hdr_size() + elem_size * elem_cnt) {
+               DHD_RING_ERR(("RING SIZE IS TOO SMALL\n"));
+               return NULL;
+       }
+
+       if (type != DHD_RING_TYPE_FIXED && type != DHD_RING_TYPE_SINGLE_IDX) {
+               DHD_RING_ERR(("UNSUPPORTED RING TYPE\n"));
+               return NULL;
+       }
+
+       ret_ring = (dhd_ring_info_t *)buf;
+       ret_ring->type = type;
+       ret_ring->ring_sync = (void *)DHD_RING_SYNC_LOCK_INIT(dhdp->osh);
+       ret_ring->magic = DHD_RING_MAGIC;
+
+       if (type == DHD_RING_TYPE_FIXED) {
+               ret_ring->fixed.read_idx = DHD_RING_IDX_INVALID;
+               ret_ring->fixed.write_idx = DHD_RING_IDX_INVALID;
+               ret_ring->fixed.lock_idx = DHD_RING_IDX_INVALID;
+               ret_ring->fixed.elem = buf + sizeof(dhd_ring_info_t);
+               ret_ring->fixed.elem_size = elem_size;
+               ret_ring->fixed.elem_cnt = elem_cnt;
+       } else {
+               ret_ring->single.idx = DHD_RING_IDX_INVALID;
+               atomic_set(&ret_ring->single.ring_locked, 0);
+               ret_ring->single.ring_overwrited = 0;
+               ret_ring->single.rsvd = 0;
+               ret_ring->single.elem = buf + sizeof(dhd_ring_info_t);
+               ret_ring->single.elem_size = elem_size;
+               ret_ring->single.elem_cnt = elem_cnt;
+       }
+
+       return ret_ring;
+}
+
+void
+dhd_ring_deinit(dhd_pub_t *dhdp, void *_ring)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       if (!ring) {
+               return;
+       }
+
+       if (ring->magic != DHD_RING_MAGIC) {
+               return;
+       }
+
+       if (ring->type != DHD_RING_TYPE_FIXED &&
+               ring->type != DHD_RING_TYPE_SINGLE_IDX) {
+               return;
+       }
+
+       DHD_RING_SYNC_LOCK_DEINIT(dhdp->osh, ring->ring_sync);
+       ring->ring_sync = NULL;
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               dhd_fixed_ring_info_t *fixed = &ring->fixed;
+               memset(fixed->elem, 0, fixed->elem_size * fixed->elem_cnt);
+               fixed->elem_size = fixed->elem_cnt = 0;
+       } else {
+               dhd_singleidx_ring_info_t *single = &ring->single;
+               memset(single->elem, 0, single->elem_size * single->elem_cnt);
+               single->elem_size = single->elem_cnt = 0;
+       }
+       ring->type = 0;
+       ring->magic = 0;
+}
+
+static inline uint32
+__dhd_ring_ptr2idx(void *ring, void *ptr, char *sig, uint32 type)
+{
+       uint32 diff;
+       uint32 ret_idx = (uint32)DHD_RING_IDX_INVALID;
+       uint32 elem_size, elem_cnt;
+       void *elem;
+
+       if (type == DHD_RING_TYPE_FIXED) {
+               dhd_fixed_ring_info_t *fixed = (dhd_fixed_ring_info_t *)ring;
+               elem_size = fixed->elem_size;
+               elem_cnt = fixed->elem_cnt;
+               elem = fixed->elem;
+       } else if (type == DHD_RING_TYPE_SINGLE_IDX) {
+               dhd_singleidx_ring_info_t *single = (dhd_singleidx_ring_info_t *)ring;
+               elem_size = single->elem_size;
+               elem_cnt = single->elem_cnt;
+               elem = single->elem;
+       } else {
+               DHD_RING_ERR(("UNSUPPORTED RING TYPE %d\n", type));
+               return ret_idx;
+       }
+
+       if (ptr < elem) {
+               DHD_RING_ERR(("INVALID POINTER %s:%p, ring->elem:%p\n", sig, ptr, elem));
+               return ret_idx;
+       }
+       diff = (uint32)((uint8 *)ptr - (uint8 *)elem);
+       if (diff % elem_size != 0) {
+               DHD_RING_ERR(("INVALID POINTER %s:%p, ring->elem:%p\n", sig, ptr, elem));
+               return ret_idx;
+       }
+       ret_idx = diff / elem_size;
+       if (ret_idx >= elem_cnt) {
+               DHD_RING_ERR(("INVALID POINTER max:%d cur:%d\n", elem_cnt, ret_idx));
+       }
+       return ret_idx;
+}
+
+/* Sub functions for fixed ring */
+/* get counts between two indexes of ring buffer (internal only) */
+static inline int
+__dhd_fixed_ring_get_count(dhd_fixed_ring_info_t *ring, int start, int end)
+{
+       if (start == DHD_RING_IDX_INVALID || end == DHD_RING_IDX_INVALID) {
+               return 0;
+       }
+
+       return (ring->elem_cnt + end - start) % ring->elem_cnt + 1;
+}
+
+static inline int
+__dhd_fixed_ring_get_cur_size(dhd_fixed_ring_info_t *ring)
+{
+       return __dhd_fixed_ring_get_count(ring, ring->read_idx, ring->write_idx);
+}
+
+static inline void *
+__dhd_fixed_ring_get_first(dhd_fixed_ring_info_t *ring)
+{
+       if (ring->read_idx == DHD_RING_IDX_INVALID) {
+               return NULL;
+       }
+       return (uint8 *)ring->elem + (ring->elem_size * ring->read_idx);
+}
+
+static inline void
+__dhd_fixed_ring_free_first(dhd_fixed_ring_info_t *ring)
+{
+       uint32 next_idx;
+
+       if (ring->read_idx == DHD_RING_IDX_INVALID) {
+               DHD_RING_ERR(("EMPTY RING\n"));
+               return;
+       }
+
+       next_idx = (ring->read_idx + 1) % ring->elem_cnt;
+       if (ring->read_idx == ring->write_idx) {
+               /* Become empty */
+               ring->read_idx = ring->write_idx = DHD_RING_IDX_INVALID;
+               return;
+       }
+
+       ring->read_idx = next_idx;
+       return;
+}
+
+static inline void *
+__dhd_fixed_ring_get_last(dhd_fixed_ring_info_t *ring)
+{
+       if (ring->read_idx == DHD_RING_IDX_INVALID) {
+               return NULL;
+       }
+       return (uint8 *)ring->elem + (ring->elem_size * ring->write_idx);
+}
+
+static inline void *
+__dhd_fixed_ring_get_empty(dhd_fixed_ring_info_t *ring)
+{
+       uint32 tmp_idx;
+
+       if (ring->read_idx == DHD_RING_IDX_INVALID) {
+               ring->read_idx = ring->write_idx = 0;
+               return (uint8 *)ring->elem;
+       }
+
+       /* check next index is not locked */
+       tmp_idx = (ring->write_idx + 1) % ring->elem_cnt;
+       if (ring->lock_idx == tmp_idx) {
+               return NULL;
+       }
+
+       ring->write_idx = tmp_idx;
+       if (ring->write_idx == ring->read_idx) {
+               /* record is full, drop oldest one */
+               ring->read_idx = (ring->read_idx + 1) % ring->elem_cnt;
+
+       }
+       return (uint8 *)ring->elem + (ring->elem_size * ring->write_idx);
+}
+
+static inline void *
+__dhd_fixed_ring_get_next(dhd_fixed_ring_info_t *ring, void *prev, uint32 type)
+{
+       uint32 cur_idx;
+
+       if (ring->read_idx == DHD_RING_IDX_INVALID) {
+               DHD_RING_ERR(("EMPTY RING\n"));
+               return NULL;
+       }
+
+       cur_idx = __dhd_ring_ptr2idx(ring, prev, "NEXT", type);
+       if (cur_idx >= ring->elem_cnt) {
+               return NULL;
+       }
+
+       if (cur_idx == ring->write_idx) {
+               /* no more new record */
+               return NULL;
+       }
+
+       cur_idx = (cur_idx + 1) % ring->elem_cnt;
+       return (uint8 *)ring->elem + ring->elem_size * cur_idx;
+}
+
+static inline void *
+__dhd_fixed_ring_get_prev(dhd_fixed_ring_info_t *ring, void *prev, uint32 type)
+{
+       uint32 cur_idx;
+
+       if (ring->read_idx == DHD_RING_IDX_INVALID) {
+               DHD_RING_ERR(("EMPTY RING\n"));
+               return NULL;
+       }
+       cur_idx = __dhd_ring_ptr2idx(ring, prev, "PREV", type);
+       if (cur_idx >= ring->elem_cnt) {
+               return NULL;
+       }
+       if (cur_idx == ring->read_idx) {
+               /* no more new record */
+               return NULL;
+       }
+
+       cur_idx = (cur_idx + ring->elem_cnt - 1) % ring->elem_cnt;
+       return (uint8 *)ring->elem + ring->elem_size * cur_idx;
+}
+
+static inline void
+__dhd_fixed_ring_lock(dhd_fixed_ring_info_t *ring, void *first_ptr, void *last_ptr, uint32 type)
+{
+       uint32 first_idx;
+       uint32 last_idx;
+       uint32 ring_filled_cnt;
+       uint32 tmp_cnt;
+
+       if (ring->read_idx == DHD_RING_IDX_INVALID) {
+               DHD_RING_ERR(("EMPTY RING\n"));
+               return;
+       }
+
+       if (first_ptr) {
+               first_idx = __dhd_ring_ptr2idx(ring, first_ptr, "LCK FIRST", type);
+               if (first_idx >= ring->elem_cnt) {
+                       return;
+               }
+       } else {
+               first_idx = ring->read_idx;
+       }
+
+       if (last_ptr) {
+               last_idx = __dhd_ring_ptr2idx(ring, last_ptr, "LCK LAST", type);
+               if (last_idx >= ring->elem_cnt) {
+                       return;
+               }
+       } else {
+               last_idx = ring->write_idx;
+       }
+
+       ring_filled_cnt = __dhd_fixed_ring_get_count(ring, ring->read_idx, ring->write_idx);
+       tmp_cnt = __dhd_fixed_ring_get_count(ring, ring->read_idx, first_idx);
+       if (tmp_cnt > ring_filled_cnt) {
+               DHD_RING_ERR(("LOCK FIRST IS TO EMPTY ELEM: write: %d read: %d cur:%d\n",
+                       ring->write_idx, ring->read_idx, first_idx));
+               return;
+       }
+
+       tmp_cnt = __dhd_fixed_ring_get_count(ring, ring->read_idx, last_idx);
+       if (tmp_cnt > ring_filled_cnt) {
+               DHD_RING_ERR(("LOCK LAST IS TO EMPTY ELEM: write: %d read: %d cur:%d\n",
+                       ring->write_idx, ring->read_idx, last_idx));
+               return;
+       }
+
+       ring->lock_idx = first_idx;
+       ring->lock_count = __dhd_fixed_ring_get_count(ring, first_idx, last_idx);
+       return;
+}
+
+static inline void
+__dhd_fixed_ring_lock_free(dhd_fixed_ring_info_t *ring)
+{
+       if (ring->read_idx == DHD_RING_IDX_INVALID) {
+               DHD_RING_ERR(("EMPTY RING\n"));
+               return;
+       }
+
+       ring->lock_idx = DHD_RING_IDX_INVALID;
+       ring->lock_count = 0;
+       return;
+}
+static inline void *
+__dhd_fixed_ring_lock_get_first(dhd_fixed_ring_info_t *ring)
+{
+       if (ring->read_idx == DHD_RING_IDX_INVALID) {
+               DHD_RING_ERR(("EMPTY RING\n"));
+               return NULL;
+       }
+       if (ring->lock_idx == DHD_RING_IDX_INVALID) {
+               DHD_RING_ERR(("NO LOCK POINT\n"));
+               return NULL;
+       }
+       return (uint8 *)ring->elem + ring->elem_size * ring->lock_idx;
+}
+
+static inline void *
+__dhd_fixed_ring_lock_get_last(dhd_fixed_ring_info_t *ring)
+{
+       int lock_last_idx;
+       if (ring->read_idx == DHD_RING_IDX_INVALID) {
+               DHD_RING_ERR(("EMPTY RING\n"));
+               return NULL;
+       }
+       if (ring->lock_idx == DHD_RING_IDX_INVALID) {
+               DHD_RING_ERR(("NO LOCK POINT\n"));
+               return NULL;
+       }
+
+       lock_last_idx = (ring->lock_idx + ring->lock_count - 1) % ring->elem_cnt;
+       return (uint8 *)ring->elem + ring->elem_size * lock_last_idx;
+}
+
+static inline int
+__dhd_fixed_ring_lock_get_count(dhd_fixed_ring_info_t *ring)
+{
+       if (ring->read_idx == DHD_RING_IDX_INVALID) {
+               DHD_RING_ERR(("EMPTY RING\n"));
+               return BCME_ERROR;
+       }
+       if (ring->lock_idx == DHD_RING_IDX_INVALID) {
+               DHD_RING_ERR(("NO LOCK POINT\n"));
+               return BCME_ERROR;
+       }
+       return ring->lock_count;
+}
+
+static inline void
+__dhd_fixed_ring_lock_free_first(dhd_fixed_ring_info_t *ring)
+{
+       if (ring->read_idx == DHD_RING_IDX_INVALID) {
+               DHD_RING_ERR(("EMPTY RING\n"));
+               return;
+       }
+       if (ring->lock_idx == DHD_RING_IDX_INVALID) {
+               DHD_RING_ERR(("NO LOCK POINT\n"));
+               return;
+       }
+
+       ring->lock_count--;
+       if (ring->lock_count <= 0) {
+               ring->lock_idx = DHD_RING_IDX_INVALID;
+       } else {
+               ring->lock_idx = (ring->lock_idx + 1) % ring->elem_cnt;
+       }
+       return;
+}
+
+static inline void
+__dhd_fixed_ring_set_read_idx(dhd_fixed_ring_info_t *ring, uint32 idx)
+{
+       ring->read_idx = idx;
+}
+
+static inline void
+__dhd_fixed_ring_set_write_idx(dhd_fixed_ring_info_t *ring, uint32 idx)
+{
+       ring->write_idx = idx;
+}
+
+static inline uint32
+__dhd_fixed_ring_get_read_idx(dhd_fixed_ring_info_t *ring)
+{
+       return ring->read_idx;
+}
+
+static inline uint32
+__dhd_fixed_ring_get_write_idx(dhd_fixed_ring_info_t *ring)
+{
+       return ring->write_idx;
+}
+
+/* Sub functions for single index ring */
+static inline void *
+__dhd_singleidx_ring_get_first(dhd_singleidx_ring_info_t *ring)
+{
+       uint32 tmp_idx = 0;
+
+       if (ring->idx == DHD_RING_IDX_INVALID) {
+               return NULL;
+       }
+
+       if (ring->ring_overwrited) {
+               tmp_idx = (ring->idx + 1) % ring->elem_cnt;
+       }
+
+       return (uint8 *)ring->elem + (ring->elem_size * tmp_idx);
+}
+
+static inline void *
+__dhd_singleidx_ring_get_last(dhd_singleidx_ring_info_t *ring)
+{
+       if (ring->idx == DHD_RING_IDX_INVALID) {
+               return NULL;
+       }
+
+       return (uint8 *)ring->elem + (ring->elem_size * ring->idx);
+}
+
+static inline void *
+__dhd_singleidx_ring_get_empty(dhd_singleidx_ring_info_t *ring)
+{
+       if (ring->idx == DHD_RING_IDX_INVALID) {
+               ring->idx = 0;
+               return (uint8 *)ring->elem;
+       }
+
+       /* check the lock is held */
+       if (atomic_read(&ring->ring_locked)) {
+               return NULL;
+       }
+
+       /* check the index rollover */
+       if (!ring->ring_overwrited && ring->idx == (ring->elem_cnt - 1)) {
+               ring->ring_overwrited = 1;
+       }
+
+       ring->idx = (ring->idx + 1) % ring->elem_cnt;
+
+       return (uint8 *)ring->elem + (ring->elem_size * ring->idx);
+}
+
+static inline void *
+__dhd_singleidx_ring_get_next(dhd_singleidx_ring_info_t *ring, void *prev, uint32 type)
+{
+       uint32 cur_idx;
+
+       if (ring->idx == DHD_RING_IDX_INVALID) {
+               DHD_RING_ERR(("EMPTY RING\n"));
+               return NULL;
+       }
+
+       cur_idx = __dhd_ring_ptr2idx(ring, prev, "NEXT", type);
+       if (cur_idx >= ring->elem_cnt) {
+               return NULL;
+       }
+
+       if (cur_idx == ring->idx) {
+               /* no more new record */
+               return NULL;
+       }
+
+       cur_idx = (cur_idx + 1) % ring->elem_cnt;
+
+       return (uint8 *)ring->elem + ring->elem_size * cur_idx;
+}
+
+static inline void *
+__dhd_singleidx_ring_get_prev(dhd_singleidx_ring_info_t *ring, void *prev, uint32 type)
+{
+       uint32 cur_idx;
+
+       if (ring->idx == DHD_RING_IDX_INVALID) {
+               DHD_RING_ERR(("EMPTY RING\n"));
+               return NULL;
+       }
+       cur_idx = __dhd_ring_ptr2idx(ring, prev, "PREV", type);
+       if (cur_idx >= ring->elem_cnt) {
+               return NULL;
+       }
+
+       if (!ring->ring_overwrited && cur_idx == 0) {
+               /* no more new record */
+               return NULL;
+       }
+
+       cur_idx = (cur_idx + ring->elem_cnt - 1) % ring->elem_cnt;
+       if (ring->ring_overwrited && cur_idx == ring->idx) {
+               /* no more new record */
+               return NULL;
+       }
+
+       return (uint8 *)ring->elem + ring->elem_size * cur_idx;
+}
+
+static inline void
+__dhd_singleidx_ring_whole_lock(dhd_singleidx_ring_info_t *ring)
+{
+       if (!atomic_read(&ring->ring_locked)) {
+               atomic_set(&ring->ring_locked, 1);
+       }
+}
+
+static inline void
+__dhd_singleidx_ring_whole_unlock(dhd_singleidx_ring_info_t *ring)
+{
+       if (atomic_read(&ring->ring_locked)) {
+               atomic_set(&ring->ring_locked, 0);
+       }
+}
+
+/* Get first element : oldest element */
+void *
+dhd_ring_get_first(void *_ring)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       void *ret = NULL;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return NULL;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               ret = __dhd_fixed_ring_get_first(&ring->fixed);
+       }
+       if (ring->type == DHD_RING_TYPE_SINGLE_IDX) {
+               ret = __dhd_singleidx_ring_get_first(&ring->single);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+       return ret;
+}
+
+/* Free first element : oldest element */
+void
+dhd_ring_free_first(void *_ring)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               __dhd_fixed_ring_free_first(&ring->fixed);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+}
+
+void
+dhd_ring_set_read_idx(void *_ring, uint32 read_idx)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               __dhd_fixed_ring_set_read_idx(&ring->fixed, read_idx);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+}
+
+void
+dhd_ring_set_write_idx(void *_ring, uint32 write_idx)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               __dhd_fixed_ring_set_write_idx(&ring->fixed, write_idx);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+}
+
+uint32
+dhd_ring_get_read_idx(void *_ring)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       uint32 read_idx = DHD_RING_IDX_INVALID;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return read_idx;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               read_idx = __dhd_fixed_ring_get_read_idx(&ring->fixed);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+
+       return read_idx;
+}
+
+uint32
+dhd_ring_get_write_idx(void *_ring)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       uint32 write_idx = DHD_RING_IDX_INVALID;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return write_idx;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               write_idx = __dhd_fixed_ring_get_write_idx(&ring->fixed);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+
+       return write_idx;
+}
+
+/* Get latest element */
+void *
+dhd_ring_get_last(void *_ring)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       void *ret = NULL;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return NULL;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               ret = __dhd_fixed_ring_get_last(&ring->fixed);
+       }
+       if (ring->type == DHD_RING_TYPE_SINGLE_IDX) {
+               ret = __dhd_singleidx_ring_get_last(&ring->single);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+       return ret;
+}
+
+/* Get next point can be written
+ * will overwrite which doesn't read
+ * will return NULL if next pointer is locked.
+ */
+void *
+dhd_ring_get_empty(void *_ring)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       void *ret = NULL;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return NULL;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               ret = __dhd_fixed_ring_get_empty(&ring->fixed);
+       }
+       if (ring->type == DHD_RING_TYPE_SINGLE_IDX) {
+               ret = __dhd_singleidx_ring_get_empty(&ring->single);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+       return ret;
+}
+
+void *
+dhd_ring_get_next(void *_ring, void *cur)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       void *ret = NULL;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return NULL;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               ret = __dhd_fixed_ring_get_next(&ring->fixed, cur, ring->type);
+       }
+       if (ring->type == DHD_RING_TYPE_SINGLE_IDX) {
+               ret = __dhd_singleidx_ring_get_next(&ring->single, cur, ring->type);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+       return ret;
+}
+
+void *
+dhd_ring_get_prev(void *_ring, void *cur)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       void *ret = NULL;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return NULL;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               ret = __dhd_fixed_ring_get_prev(&ring->fixed, cur, ring->type);
+       }
+       if (ring->type == DHD_RING_TYPE_SINGLE_IDX) {
+               ret = __dhd_singleidx_ring_get_prev(&ring->single, cur, ring->type);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+       return ret;
+}
+
+int
+dhd_ring_get_cur_size(void *_ring)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       int cnt = 0;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return cnt;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               cnt = __dhd_fixed_ring_get_cur_size(&ring->fixed);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+       return cnt;
+}
+
+/* protect element between lock_ptr and write_idx */
+void
+dhd_ring_lock(void *_ring, void *first_ptr, void *last_ptr)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               __dhd_fixed_ring_lock(&ring->fixed, first_ptr, last_ptr, ring->type);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+}
+
+/* free all lock */
+void
+dhd_ring_lock_free(void *_ring)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               __dhd_fixed_ring_lock_free(&ring->fixed);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+}
+
+void *
+dhd_ring_lock_get_first(void *_ring)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       void *ret = NULL;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return NULL;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               ret = __dhd_fixed_ring_lock_get_first(&ring->fixed);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+       return ret;
+}
+
+void *
+dhd_ring_lock_get_last(void *_ring)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       void *ret = NULL;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return NULL;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               ret = __dhd_fixed_ring_lock_get_last(&ring->fixed);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+       return ret;
+}
+
+int
+dhd_ring_lock_get_count(void *_ring)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       int ret = BCME_ERROR;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return ret;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               ret = __dhd_fixed_ring_lock_get_count(&ring->fixed);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+       return ret;
+}
+
+/* free first locked element */
+void
+dhd_ring_lock_free_first(void *_ring)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_FIXED) {
+               __dhd_fixed_ring_lock_free_first(&ring->fixed);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+}
+
+void
+dhd_ring_whole_lock(void *_ring)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_SINGLE_IDX) {
+               __dhd_singleidx_ring_whole_lock(&ring->single);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+}
+
+void
+dhd_ring_whole_unlock(void *_ring)
+{
+       dhd_ring_info_t *ring = (dhd_ring_info_t *)_ring;
+       unsigned long flags;
+
+       if (!ring || ring->magic != DHD_RING_MAGIC) {
+               DHD_RING_ERR(("%s :INVALID RING INFO\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_RING_SYNC_LOCK(ring->ring_sync, flags);
+       if (ring->type == DHD_RING_TYPE_SINGLE_IDX) {
+               __dhd_singleidx_ring_whole_unlock(&ring->single);
+       }
+       DHD_RING_SYNC_UNLOCK(ring->ring_sync, flags);
+}
+/* END of DHD RING */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 19, 0))
+#define DHD_VFS_INODE(dir) (dir->d_inode)
+#else
+#define DHD_VFS_INODE(dir) d_inode(dir)
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3, 19, 0) */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 13, 0))
+#define DHD_VFS_UNLINK(dir, b, c) vfs_unlink(DHD_VFS_INODE(dir), b)
+#else
+#define DHD_VFS_UNLINK(dir, b, c) vfs_unlink(DHD_VFS_INODE(dir), b, c)
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3, 13, 0) */
+int
+dhd_file_delete(char *path)
+{
+       struct path file_path;
+       int err;
+       struct dentry *dir;
+
+       err = kern_path(path, 0, &file_path);
+
+       if (err < 0) {
+               DHD_ERROR(("Failed to get kern-path delete file: %s error: %d\n", path, err));
+               return err;
+       }
+       if (
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0))
+               !d_is_file(file_path.dentry) ||
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(4, 1, 0))
+               d_really_is_negative(file_path.dentry) ||
+#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(4, 1, 0) */
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0) */
+               FALSE)
+       {
+               err = -EINVAL;
+       } else {
+               dir = dget_parent(file_path.dentry);
+
+               if (!IS_ERR(dir)) {
+                       err = DHD_VFS_UNLINK(dir, file_path.dentry, NULL);
+                       dput(dir);
+               } else {
+                       err = PTR_ERR(dir);
+               }
+       }
+
+       path_put(&file_path);
+
+       if (err < 0) {
+               DHD_ERROR(("Failed to delete file: %s error: %d\n", path, err));
+       }
+
+       return err;
+}
+#ifdef DHD_DUMP_MNGR
+static int
+dhd_dump_file_manage_idx(dhd_dump_file_manage_t *fm_ptr, char *fname)
+{
+       int i;
+       int fm_idx = -1;
+
+       for (i = 0; i < DHD_DUMP_TYPE_COUNT_MAX; i++) {
+               /* XXX dump file manager enqueues the type name to empty slot,
+                * so it's impossible that empty slot is in the middle.
+                */
+               if (strlen(fm_ptr->elems[i].type_name) == 0) {
+                       fm_idx = i;
+                       break;
+               }
+               if (!(strncmp(fname, fm_ptr->elems[i].type_name, strlen(fname)))) {
+                       fm_idx = i;
+                       break;
+               }
+       }
+
+       if (fm_idx == -1) {
+               return fm_idx;
+       }
+
+       if (strlen(fm_ptr->elems[fm_idx].type_name) == 0) {
+               strncpy(fm_ptr->elems[fm_idx].type_name, fname, DHD_DUMP_TYPE_NAME_SIZE);
+               fm_ptr->elems[fm_idx].type_name[DHD_DUMP_TYPE_NAME_SIZE - 1] = '\0';
+               fm_ptr->elems[fm_idx].file_idx = 0;
+       }
+
+       return fm_idx;
+}
+
+/*
+ * dhd_dump_file_manage_enqueue - enqueue dump file path
+ * and delete odest file if file count is max.
+ */
+void
+dhd_dump_file_manage_enqueue(dhd_pub_t *dhd, char *dump_path, char *fname)
+{
+       int fm_idx;
+       int fp_idx;
+       dhd_dump_file_manage_t *fm_ptr;
+       DFM_elem_t *elem;
+
+       if (!dhd || !dhd->dump_file_manage) {
+               DHD_ERROR(("%s(): dhdp=%p dump_file_manage=%p\n",
+                       __FUNCTION__, dhd, (dhd ? dhd->dump_file_manage : NULL)));
+               return;
+       }
+
+       fm_ptr = dhd->dump_file_manage;
+
+       /* find file_manage idx */
+       DHD_INFO(("%s(): fname: %s dump_path: %s\n", __FUNCTION__, fname, dump_path));
+       if ((fm_idx = dhd_dump_file_manage_idx(fm_ptr, fname)) < 0) {
+               DHD_ERROR(("%s(): Out of file manager entries, fname: %s\n",
+                       __FUNCTION__, fname));
+               return;
+       }
+
+       elem = &fm_ptr->elems[fm_idx];
+       fp_idx = elem->file_idx;
+       DHD_INFO(("%s(): fm_idx: %d fp_idx: %d path: %s\n",
+               __FUNCTION__, fm_idx, fp_idx, elem->file_path[fp_idx]));
+
+       /* delete oldest file */
+       if (strlen(elem->file_path[fp_idx]) != 0) {
+               if (dhd_file_delete(elem->file_path[fp_idx]) < 0) {
+                       DHD_ERROR(("%s(): Failed to delete file: %s\n",
+                               __FUNCTION__, elem->file_path[fp_idx]));
+               } else {
+                       DHD_ERROR(("%s(): Successed to delete file: %s\n",
+                               __FUNCTION__, elem->file_path[fp_idx]));
+               }
+       }
+
+       /* save dump file path */
+       strncpy(elem->file_path[fp_idx], dump_path, DHD_DUMP_FILE_PATH_SIZE);
+       elem->file_path[fp_idx][DHD_DUMP_FILE_PATH_SIZE - 1] = '\0';
+
+       /* change file index to next file index */
+       elem->file_idx = (elem->file_idx + 1) % DHD_DUMP_FILE_COUNT_MAX;
+}
+#endif /* DHD_DUMP_MNGR */
+
+#ifdef DNGL_AXI_ERROR_LOGGING
+static void
+dhd_axi_error_dump(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = (dhd_info_t *)handle;
+       dhd_pub_t *dhdp = NULL;
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               goto exit;
+       }
+
+       dhdp = &dhd->pub;
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               goto exit;
+       }
+
+       /**
+        * First save axi error information to a file
+        * because panic should happen right after this.
+        * After dhd reset, dhd reads the file, and do hang event process
+        * to send axi error stored on the file to Bigdata server
+        */
+       if (dhdp->axi_err_dump->etd_axi_error_v1.version != HND_EXT_TRAP_AXIERROR_VERSION_1) {
+               DHD_ERROR(("%s: Invalid AXI version: 0x%x\n",
+                       __FUNCTION__, dhdp->axi_err_dump->etd_axi_error_v1.version));
+       }
+
+       DHD_OS_WAKE_LOCK(dhdp);
+#ifdef DHD_FW_COREDUMP
+#ifdef DHD_SSSR_DUMP
+       DHD_ERROR(("%s : Set collect_sssr as TRUE\n", __FUNCTION__));
+       dhdp->collect_sssr = TRUE;
+#endif /* DHD_SSSR_DUMP */
+       DHD_ERROR(("%s: scheduling mem dump.. \n", __FUNCTION__));
+       dhd_schedule_memdump(dhdp, dhdp->soc_ram, dhdp->soc_ram_length);
+#endif /* DHD_FW_COREDUMP */
+       DHD_OS_WAKE_UNLOCK(dhdp);
+
+exit:
+       /* Trigger kernel panic after taking necessary dumps */
+       BUG_ON(1);
+}
+
+void dhd_schedule_axi_error_dump(dhd_pub_t *dhdp, void *type)
+{
+       DHD_ERROR(("%s: scheduling axi_error_dump.. \n", __FUNCTION__));
+       dhd_deferred_schedule_work(dhdp->info->dhd_deferred_wq,
+               type, DHD_WQ_WORK_AXI_ERROR_DUMP,
+               dhd_axi_error_dump, DHD_WQ_WORK_PRIORITY_HIGH);
+}
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+#ifdef SUPPORT_SET_TID
+/*
+ * Set custom TID value for UDP frame based on UID value.
+ * This will be triggered by android private command below.
+ * DRIVER SET_TID <Mode:uint8> <Target UID:uint32> <Custom TID:uint8>
+ * Mode 0(SET_TID_OFF) : Disable changing TID
+ * Mode 1(SET_TID_ALL_UDP) : Change TID for all UDP frames
+ * Mode 2(SET_TID_BASED_ON_UID) : Change TID for UDP frames based on target UID
+*/
+void
+dhd_set_tid_based_on_uid(dhd_pub_t *dhdp, void *pkt)
+{
+       struct ether_header *eh = NULL;
+       struct sock *sk = NULL;
+       uint8 *pktdata = NULL;
+       uint8 *ip_hdr = NULL;
+       uint8 cur_prio;
+       uint8 prio;
+       uint32 uid;
+
+       if (dhdp->tid_mode == SET_TID_OFF) {
+               return;
+       }
+
+       pktdata = (uint8 *)PKTDATA(dhdp->osh, pkt);
+       eh = (struct ether_header *) pktdata;
+       ip_hdr = (uint8 *)eh + ETHER_HDR_LEN;
+
+       if (IPV4_PROT(ip_hdr) != IP_PROT_UDP) {
+               return;
+       }
+
+       cur_prio = PKTPRIO(pkt);
+       prio = dhdp->target_tid;
+       uid = dhdp->target_uid;
+
+       if ((cur_prio == prio) ||
+               (cur_prio != PRIO_8021D_BE)) {
+                       return;
+       }
+
+       sk = ((struct sk_buff*)(pkt))->sk;
+
+       if ((dhdp->tid_mode == SET_TID_ALL_UDP) ||
+               (sk && (uid == __kuid_val(sock_i_uid(sk))))) {
+               PKTSETPRIO(pkt, prio);
+       }
+}
+#endif /* SUPPORT_SET_TID */
+
+#ifdef BCMPCIE
+static void
+dhd_cto_recovery_handler(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+       dhd_pub_t *dhdp = NULL;
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               BUG_ON(1);
+               return;
+       }
+
+       dhdp = &dhd->pub;
+       dhdpcie_cto_recovery_handler(dhdp);
+}
+
+void
+dhd_schedule_cto_recovery(dhd_pub_t *dhdp)
+{
+       DHD_ERROR(("%s: scheduling cto recovery.. \n", __FUNCTION__));
+       dhd_deferred_schedule_work(dhdp->info->dhd_deferred_wq,
+               NULL, DHD_WQ_WORK_CTO_RECOVERY,
+               dhd_cto_recovery_handler, DHD_WQ_WORK_PRIORITY_HIGH);
+}
+#endif /* BCMPCIE */
+
+#ifdef DHD_WIFI_SHUTDOWN
+void wifi_plat_dev_drv_shutdown(struct platform_device *pdev)
+{
+       dhd_pub_t *dhd_pub = NULL;
+       dhd_info_t *dhd_info = NULL;
+       dhd_if_t *dhd_if = NULL;
+
+       DHD_ERROR(("%s enter\n", __FUNCTION__));
+       dhd_pub = g_dhd_pub;
+
+       if (dhd_os_check_if_up(dhd_pub)) {
+               dhd_info = (dhd_info_t *)dhd_pub->info;
+               dhd_if = dhd_info->iflist[0];
+               ASSERT(dhd_if);
+               ASSERT(dhd_if->net);
+               if (dhd_if && dhd_if->net) {
+                       dhd_stop(dhd_if->net);
+               }
+       }
+}
+#endif /* DHD_WIFI_SHUTDOWN */
+#ifdef WL_AUTO_QOS
+void
+dhd_wl_sock_qos_set_status(dhd_pub_t *dhdp, unsigned long on_off)
+{
+       dhd_sock_qos_set_status(dhdp->info, on_off);
+}
+#endif /* WL_AUTO_QOS */
+
+#ifdef DHD_CFG80211_SUSPEND_RESUME
+void
+dhd_cfg80211_suspend(dhd_pub_t *dhdp)
+{
+       struct net_device *net = dhd_idx2net((dhd_pub_t *)dhdp, 0);
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+       wl_cfg80211_suspend(cfg);
+}
+
+void
+dhd_cfg80211_resume(dhd_pub_t *dhdp)
+{
+       struct net_device * net = dhd_idx2net((dhd_pub_t *)dhdp, 0);
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+       wl_cfg80211_resume(cfg);
+}
+#endif /* DHD_CFG80211_SUSPEND_RESUME */
+
+void
+dhd_generate_rand_mac_addr(struct ether_addr *ea_addr)
+{
+       RANDOM_BYTES(ea_addr->octet, ETHER_ADDR_LEN);
+       /* restore mcast and local admin bits to 0 and 1 */
+       ETHER_SET_UNICAST(ea_addr->octet);
+       ETHER_SET_LOCALADDR(ea_addr->octet);
+       DHD_ERROR(("%s:generated new MAC="MACDBG" \n",
+               __FUNCTION__, MAC2STRDBG(ea_addr->octet)));
+       return;
+}
+
+void *
+dhd_get_roam_evt(dhd_pub_t *dhdp)
+{
+#if defined(DHD_PUB_ROAM_EVT)
+       return (void *)&(dhdp->roam_evt);
+#else
+       return NULL;
+#endif /* DHD_PUB_ROAM_EVT */
+}
+
+/* BANDLOCK_FILE is for Hikey only and BANDLOCK has a priority than BANDLOCK_FILE */
+static void dhd_set_bandlock(dhd_pub_t * dhd)
+{
+#if defined(BANDLOCK)
+       int band = BANDLOCK;
+       if (dhd_wl_ioctl_cmd(dhd, WLC_SET_BAND, &band, sizeof(band), TRUE, 0) < 0) {
+               DHD_ERROR(("%s: set band(%d) error\n", __FUNCTION__, band));
+       }
+#elif defined(BANDLOCK_FILE)
+       int band;
+       char val[2] = {0, 0};
+       if (dhd_read_file(PATH_BANDLOCK_INFO, (char *)val, sizeof(char)) == BCME_OK) {
+               band = bcm_atoi(val);
+               if (dhd_wl_ioctl_cmd(dhd, WLC_SET_BAND, &band, sizeof(band), TRUE, 0) < 0) {
+                       DHD_ERROR(("%s: set band(%d) error\n", __FUNCTION__, band));
+               }
+       }
+#endif /* BANDLOCK */
+}
+
+#ifdef PCIE_FULL_DONGLE
+/* API to delete flowings and Stations
+* corresponding to the interface(ndev)
+*/
+void
+dhd_net_del_flowrings_sta(dhd_pub_t *dhd, struct net_device *ndev)
+{
+       dhd_if_t *ifp = NULL;
+
+       ifp = dhd_get_ifp_by_ndev(dhd, ndev);
+       if (ifp == NULL) {
+               DHD_ERROR(("DHD Iface Info corresponding to %s not found\n", ndev->name));
+               return;
+       }
+
+       /* For now called only in iface delete path..
+       * Add reason codes if this API need to be reused in any other paths.
+       */
+       DHD_ERROR(("%s:Clean up IFACE idx %d due to interface delete\n",
+               __FUNCTION__, ifp->idx));
+
+       dhd_del_all_sta(dhd, ifp->idx);
+       dhd_flow_rings_delete(dhd, ifp->idx);
+}
+#endif /* PCIE_FULL_DONGLE */
+
+void *dhd_get_pub(struct net_device *dev)
+{
+       dhd_info_t *dhdinfo = *(dhd_info_t **)netdev_priv(dev);
+       if (dhdinfo)
+               return (void *)&dhdinfo->pub;
+       else {
+               printf("%s: null dhdinfo\n", __FUNCTION__);
+               return NULL;
+       }
+}
+
+void *dhd_get_conf(struct net_device *dev)
+{
+       dhd_info_t *dhdinfo = *(dhd_info_t **)netdev_priv(dev);
+       if (dhdinfo)
+               return (void *)dhdinfo->pub.conf;
+       else {
+               printf("%s: null dhdinfo\n", __FUNCTION__);
+               return NULL;
+       }
+}
+
+bool dhd_os_wd_timer_enabled(void *bus)
+{
+       dhd_pub_t *pub = bus;
+       dhd_info_t *dhd = (dhd_info_t *)pub->info;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd NULL\n", __FUNCTION__));
+               return FALSE;
+       }
+       return dhd->wd_timer_valid;
+}
+
+#if defined(WLDWDS) && defined(FOURADDR_AUTO_BRG)
+/* This function is to automatically add/del interface to the bridged dev that priamy dev is in */
+static void dhd_bridge_dev_set(dhd_info_t *dhd, int ifidx, struct net_device *dev)
+{
+       struct net_device *primary_ndev = NULL, *br_dev = NULL;
+       int cmd;
+       struct ifreq ifr;
+
+       /* add new interface to bridge dev */
+       if (dev) {
+               int found = 0, i;
+               DHD_ERROR(("bssidx %d\n", dhd->pub.info->iflist[ifidx]->bssidx));
+               for (i = 0 ; i < ifidx; i++) {
+                       DHD_ERROR(("bssidx %d %d\n", i, dhd->pub.info->iflist[i]->bssidx));
+                       /* search the primary interface */
+                       if (dhd->pub.info->iflist[i]->bssidx == dhd->pub.info->iflist[ifidx]->bssidx) {
+                               primary_ndev = dhd->pub.info->iflist[i]->net;
+                               DHD_ERROR(("%dst is primary dev %s\n", i, primary_ndev->name));
+                               found = 1;
+                               break;
+                       }
+               }
+               if (found == 0) {
+                       DHD_ERROR(("Can not find primary dev %s\n", dev->name));
+                       return;
+               }
+               cmd = SIOCBRADDIF;
+               ifr.ifr_ifindex = dev->ifindex;
+       } else { /* del interface from bridge dev */
+               primary_ndev = dhd->pub.info->iflist[ifidx]->net;
+               cmd = SIOCBRDELIF;
+               ifr.ifr_ifindex = primary_ndev->ifindex;
+       }
+       /* if primary net device is bridged */
+       if (primary_ndev->priv_flags & IFF_BRIDGE_PORT) {
+               rtnl_lock();
+               /* get bridge device */
+               br_dev = netdev_master_upper_dev_get(primary_ndev);
+               if (br_dev) {
+                       const struct net_device_ops *ops = br_dev->netdev_ops;
+                       DHD_ERROR(("br %s pri %s\n", br_dev->name, primary_ndev->name));
+                       if (ops) {
+                               if (cmd == SIOCBRADDIF) {
+                                       DHD_ERROR(("br call ndo_add_slave\n"));
+                                       ops->ndo_add_slave(br_dev, dev);
+                                       /* Also bring wds0.x interface up automatically */
+                                       dev_change_flags(dev, dev->flags | IFF_UP);
+                               }
+                               else {
+                                       DHD_ERROR(("br call ndo_del_slave\n"));
+                                       ops->ndo_del_slave(br_dev, primary_ndev);
+                               }
+                       }
+               }
+               else {
+                       DHD_ERROR(("no br dev\n"));
+               }
+               rtnl_unlock();
+       }
+       else {
+               DHD_ERROR(("device %s is not bridged\n", primary_ndev->name));
+       }
+}
+#endif /* defiend(WLDWDS) && defined(FOURADDR_AUTO_BRG) */
diff --git a/bcmdhd.101.10.240.x/dhd_linux.h b/bcmdhd.101.10.240.x/dhd_linux.h
new file mode 100644 (file)
index 0000000..b5e25ab
--- /dev/null
@@ -0,0 +1,460 @@
+/*
+ * DHD Linux header file (dhd_linux exports for cfg80211 and other components)
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+/* wifi platform functions for power, interrupt and pre-alloc, either
+ * from Android-like platform device data, or Broadcom wifi platform
+ * device data.
+ *
+ */
+#ifndef __DHD_LINUX_H__
+#define __DHD_LINUX_H__
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/fs.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+/* Linux wireless extension support */
+#if defined(WL_WIRELESS_EXT)
+#include <wl_iw.h>
+#endif /* defined(WL_WIRELESS_EXT) */
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+#include <linux/earlysuspend.h>
+#endif /* defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND) */
+
+#ifdef BCMPCIE
+#include <bcmmsgbuf.h>
+#endif /* BCMPCIE */
+
+#ifdef PCIE_FULL_DONGLE
+#include <etd.h>
+#endif /* PCIE_FULL_DONGLE */
+
+#ifdef WL_MONITOR
+#define MAX_RADIOTAP_SIZE      256 /* Maximum size to hold HE Radiotap header format */
+#define MAX_MON_PKT_SIZE       (4096 + MAX_RADIOTAP_SIZE)
+#endif /* WL_MONITOR */
+
+/* dongle status */
+enum wifi_adapter_status {
+       WIFI_STATUS_POWER_ON = 0,
+       WIFI_STATUS_ATTACH,
+       WIFI_STATUS_FW_READY,
+       WIFI_STATUS_DETTACH
+};
+#define wifi_chk_adapter_status(adapter, stat) (test_bit(stat, &(adapter)->status))
+#define wifi_get_adapter_status(adapter, stat) (test_bit(stat, &(adapter)->status))
+#define wifi_set_adapter_status(adapter, stat) (set_bit(stat, &(adapter)->status))
+#define wifi_clr_adapter_status(adapter, stat) (clear_bit(stat, &(adapter)->status))
+#define wifi_chg_adapter_status(adapter, stat) (change_bit(stat, &(adapter)->status))
+
+#define DHD_REGISTRATION_TIMEOUT  12000  /* msec : allowed time to finished dhd registration */
+#define DHD_FW_READY_TIMEOUT  5000  /* msec : allowed time to finished fw download */
+
+typedef struct wifi_adapter_info {
+       const char      *name;
+       uint            irq_num;
+       uint            intr_flags;
+       const char      *fw_path;
+       const char      *nv_path;
+       const char      *clm_path;
+       const char      *conf_path;
+       void            *wifi_plat_data;        /* wifi ctrl func, for backward compatibility */
+       uint            bus_type;
+       uint            bus_num;
+       uint            slot_num;
+       wait_queue_head_t status_event;
+       unsigned long status;
+#if defined(BT_OVER_SDIO)
+       const char      *btfw_path;
+#endif /* defined (BT_OVER_SDIO) */
+#ifdef BUS_POWER_RESTORE
+#if defined(BCMSDIO)
+       struct sdio_func *sdio_func;
+#endif /* BCMSDIO */
+#if defined(BCMPCIE)
+       struct pci_dev *pci_dev;
+       struct pci_saved_state *pci_saved_state;
+#endif /* BCMPCIE */
+#endif
+} wifi_adapter_info_t;
+
+#define WLAN_PLAT_NODFS_FLAG   0x01
+#define WLAN_PLAT_AP_FLAG      0x02
+#if !defined(CONFIG_WIFI_CONTROL_FUNC)
+struct wifi_platform_data {
+#ifdef BUS_POWER_RESTORE
+       int (*set_power)(int val, wifi_adapter_info_t *adapter);
+#else
+       int (*set_power)(int val);
+#endif
+       int (*set_reset)(int val);
+       int (*set_carddetect)(int val);
+       void *(*mem_prealloc)(int section, unsigned long size);
+#ifdef CUSTOM_MULTI_MAC
+       int (*get_mac_addr)(unsigned char *buf, char *name);
+#else
+       int (*get_mac_addr)(unsigned char *buf);
+#endif
+#ifdef BCMSDIO
+       int (*get_wake_irq)(void);
+#endif // endif
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+       void *(*get_country_code)(char *ccode, u32 flags);
+#else /* defined (CUSTOM_FORCE_NODFS_FLAG) */
+       void *(*get_country_code)(char *ccode);
+#endif
+};
+#endif
+
+typedef struct bcmdhd_wifi_platdata {
+       uint                            num_adapters;
+       wifi_adapter_info_t     *adapters;
+} bcmdhd_wifi_platdata_t;
+
+/** Per STA params. A list of dhd_sta objects are managed in dhd_if */
+typedef struct dhd_sta {
+       cumm_ctr_t cumm_ctr;    /* cummulative queue length of child flowrings */
+       uint16 flowid[NUMPRIO]; /* allocated flow ring ids (by priority) */
+       void * ifp;             /* associated dhd_if */
+       struct ether_addr ea;   /* stations ethernet mac address */
+       struct list_head list;  /* link into dhd_if::sta_list */
+       int idx;                /* index of self in dhd_pub::sta_pool[] */
+       int ifidx;              /* index of interface in dhd */
+} dhd_sta_t;
+typedef dhd_sta_t dhd_sta_pool_t;
+
+#ifdef DHD_4WAYM4_FAIL_DISCONNECT
+typedef enum {
+       NONE_4WAY,
+       M1_4WAY,
+       M2_4WAY,
+       M3_4WAY,
+       M4_4WAY
+} msg_4way_t;
+typedef enum {
+       M3_RXED,
+       M4_TXFAILED
+} msg_4way_state_t;
+#define MAX_4WAY_TIMEOUT_MS 2000
+#endif /* DHD_4WAYM4_FAIL_DISCONNECT */
+
+#if defined(DHD_LB)
+/* Dynamic CPU selection for load balancing. */
+#include <linux/cpu.h>
+#include <linux/cpumask.h>
+#include <linux/notifier.h>
+#include <linux/workqueue.h>
+#include <asm/atomic.h>
+
+/* FIXME: Make this a module param or a sysfs. */
+#if !defined(DHD_LB_PRIMARY_CPUS)
+#define DHD_LB_PRIMARY_CPUS     0x0 /* Big CPU coreids mask */
+#endif
+#if !defined(DHD_LB_SECONDARY_CPUS)
+#define DHD_LB_SECONDARY_CPUS   0xFE /* Little CPU coreids mask */
+#endif
+
+#define HIST_BIN_SIZE  9
+
+#if defined(DHD_LB_TXP)
+/* Pkttag not compatible with PROP_TXSTATUS or WLFC */
+typedef struct dhd_tx_lb_pkttag_fr {
+       struct net_device *net;
+       int ifidx;
+} dhd_tx_lb_pkttag_fr_t;
+
+#define DHD_LB_TX_PKTTAG_SET_NETDEV(tag, netdevp)      ((tag)->net = netdevp)
+#define DHD_LB_TX_PKTTAG_NETDEV(tag)                   ((tag)->net)
+
+#define DHD_LB_TX_PKTTAG_SET_IFIDX(tag, ifidx) ((tag)->ifidx = ifidx)
+#define DHD_LB_TX_PKTTAG_IFIDX(tag)            ((tag)->ifidx)
+#endif /* DHD_LB_TXP */
+#endif /* DHD_LB */
+
+#define FILE_DUMP_MAX_WAIT_TIME 4000
+
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+
+#ifdef BLOCK_IPV6_PACKET
+#define HEX_PREF_STR   "0x"
+#define UNI_FILTER_STR "010000000000"
+#define ZERO_ADDR_STR  "000000000000"
+#define ETHER_TYPE_STR "0000"
+#define IPV6_FILTER_STR        "20"
+#define ZERO_TYPE_STR  "00"
+#endif /* BLOCK_IPV6_PACKET */
+
+#if defined(SOFTAP)
+extern bool ap_cfg_running;
+extern bool ap_fw_loaded;
+#endif
+
+#if defined(BCMPCIE)
+extern int dhd_get_suspend_bcn_li_dtim(dhd_pub_t *dhd, int *dtim_period, int *bcn_interval);
+#else
+extern int dhd_get_suspend_bcn_li_dtim(dhd_pub_t *dhd);
+#endif /* OEM_ANDROID && BCMPCIE */
+
+#ifdef CUSTOMER_HW4
+#ifdef MIMO_ANT_SETTING
+#ifdef DHD_EXPORT_CNTL_FILE
+extern unsigned long antsel;
+#endif /* DHD_EXPORT_CNTL_FILE */
+extern int dhd_sel_ant_from_file(dhd_pub_t *dhd);
+#endif /* MIMO_ANT_SETTING */
+#ifdef WRITE_WLANINFO
+#define MAX_VERSION_LEN                512
+#ifdef DHD_EXPORT_CNTL_FILE
+extern char version_info[MAX_VERSION_LEN];
+#endif /* DHD_EXPORT_CNTL_FILE */
+extern uint32 sec_save_wlinfo(char *firm_ver, char *dhd_ver, char *nvram_p, char *clm_ver);
+#endif /* WRITE_WLANINFO */
+#ifdef LOGTRACE_FROM_FILE
+extern int dhd_logtrace_from_file(dhd_pub_t *dhd);
+#ifdef DHD_EXPORT_CNTL_FILE
+extern unsigned long logtrace_val;
+#endif /* DHD_EXPORT_CNTL_FILE */
+#endif /* LOGTRACE_FROM_FILE */
+#ifdef GEN_SOFTAP_INFO_FILE
+#define SOFTAP_INFO_BUF_SZ 512
+#ifdef DHD_EXPORT_CNTL_FILE
+extern char softapinfostr[SOFTAP_INFO_BUF_SZ];
+#endif /* DHD_EXPORT_CNTL_FILE */
+extern uint32 sec_save_softap_info(void);
+#endif /* GEN_SOFTAP_INFO_FILE */
+#endif /* CUSTOMER_HW4 */
+
+#ifdef DHD_SEND_HANG_PRIVCMD_ERRORS
+extern uint32 report_hang_privcmd_err;
+#endif /* DHD_SEND_HANG_PRIVCMD_ERRORS */
+
+#ifdef DHD_LOG_DUMP
+/* 0: DLD_BUF_TYPE_GENERAL, 1: DLD_BUF_TYPE_PRESERVE
+* 2: DLD_BUF_TYPE_SPECIAL
+*/
+#define DLD_BUFFER_NUM 3
+
+#ifndef CUSTOM_LOG_DUMP_BUFSIZE_MB
+#define CUSTOM_LOG_DUMP_BUFSIZE_MB     4 /* DHD_LOG_DUMP_BUF_SIZE 4 MB static memory in kernel */
+#endif /* CUSTOM_LOG_DUMP_BUFSIZE_MB */
+
+#define LOG_DUMP_TOTAL_BUFSIZE (1024 * 1024 * CUSTOM_LOG_DUMP_BUFSIZE_MB)
+
+/*
+ * Below are different sections that use the prealloced buffer
+ * and sum of the sizes of these should not cross LOG_DUMP_TOTAL_BUFSIZE
+ */
+#define LOG_DUMP_GENERAL_MAX_BUFSIZE (256 * 1024 * CUSTOM_LOG_DUMP_BUFSIZE_MB)
+#define LOG_DUMP_PRESERVE_MAX_BUFSIZE (128 * 1024 * CUSTOM_LOG_DUMP_BUFSIZE_MB)
+#define LOG_DUMP_ECNTRS_MAX_BUFSIZE (256 * 1024 * CUSTOM_LOG_DUMP_BUFSIZE_MB)
+#define LOG_DUMP_RTT_MAX_BUFSIZE (256 * 1024 * CUSTOM_LOG_DUMP_BUFSIZE_MB)
+#define LOG_DUMP_FILTER_MAX_BUFSIZE (128 * 1024 * CUSTOM_LOG_DUMP_BUFSIZE_MB)
+
+#if LOG_DUMP_TOTAL_BUFSIZE < (LOG_DUMP_GENERAL_MAX_BUFSIZE + \
+       LOG_DUMP_PRESERVE_MAX_BUFSIZE + LOG_DUMP_ECNTRS_MAX_BUFSIZE + LOG_DUMP_RTT_MAX_BUFSIZE \
+       + LOG_DUMP_FILTER_MAX_BUFSIZE)
+#error "LOG_DUMP_TOTAL_BUFSIZE is lesser than sum of all rings"
+#endif
+
+/* Special buffer is allocated as separately in prealloc */
+#define LOG_DUMP_SPECIAL_MAX_BUFSIZE (8 * 1024)
+
+#define LOG_DUMP_MAX_FILESIZE (8 *1024 * 1024) /* 8 MB default */
+
+#ifdef CONFIG_LOG_BUF_SHIFT
+/* 15% of kernel log buf size, if for example klog buf size is 512KB
+* 15% of 512KB ~= 80KB
+*/
+#define LOG_DUMP_KERNEL_TAIL_FLUSH_SIZE \
+       (15 * ((1 << CONFIG_LOG_BUF_SHIFT)/100))
+#endif /* CONFIG_LOG_BUF_SHIFT */
+
+#define LOG_DUMP_COOKIE_BUFSIZE        1024u
+typedef struct {
+       char *hdr_str;
+       log_dump_section_type_t sec_type;
+} dld_hdr_t;
+
+#define DHD_PRINT_BUF_NAME_LEN 30
+void dhd_get_debug_dump_len(void *handle, struct sk_buff *skb, void *event_info, u8 event);
+void cfgvendor_log_dump_len(dhd_pub_t *dhdp, log_dump_type_t *type, struct sk_buff *skb);
+#endif /* DHD_LOG_DUMP */
+
+typedef struct dhd_if_event {
+       struct list_head        list;
+       wl_event_data_if_t      event;
+       char                    name[IFNAMSIZ+1];
+       uint8                   mac[ETHER_ADDR_LEN];
+} dhd_if_event_t;
+
+/* Interface control information */
+typedef struct dhd_if {
+       struct dhd_info *info;                  /* back pointer to dhd_info */
+       /* OS/stack specifics */
+       struct net_device *net;
+       int                             idx;                    /* iface idx in dongle */
+       uint                    subunit;                /* subunit */
+       uint8                   mac_addr[ETHER_ADDR_LEN];       /* assigned MAC address */
+       bool                    set_macaddress;
+       bool                    set_multicast;
+       uint8                   bssidx;                 /* bsscfg index for the interface */
+       bool                    attached;               /* Delayed attachment when unset */
+       bool                    txflowcontrol;  /* Per interface flow control indicator */
+       char                    name[IFNAMSIZ+1]; /* linux interface name */
+       char                    dngl_name[IFNAMSIZ+1]; /* corresponding dongle interface name */
+       struct net_device_stats stats;
+#ifdef PCIE_FULL_DONGLE
+       struct list_head sta_list;              /* sll of associated stations */
+       spinlock_t      sta_list_lock;          /* lock for manipulating sll */
+#endif /* PCIE_FULL_DONGLE */
+       uint32  ap_isolate;                     /* ap-isolation settings */
+#ifdef DHD_L2_FILTER
+       bool parp_enable;
+       bool parp_discard;
+       bool parp_allnode;
+       arp_table_t *phnd_arp_table;
+       /* for Per BSS modification */
+       bool dhcp_unicast;
+       bool block_ping;
+       bool grat_arp;
+       bool block_tdls;
+#endif /* DHD_L2_FILTER */
+#ifdef DHD_MCAST_REGEN
+       bool mcast_regen_bss_enable;
+#endif
+       bool rx_pkt_chainable;          /* set all rx packet to chainable config by default */
+       cumm_ctr_t cumm_ctr;            /* cummulative queue length of child flowrings */
+       uint8 tx_paths_active;
+       bool del_in_progress;
+       bool static_if;                 /* used to avoid some operations on static_if */
+#ifdef DHD_4WAYM4_FAIL_DISCONNECT
+       struct delayed_work m4state_work;
+       atomic_t m4state;
+#endif /* DHD_4WAYM4_FAIL_DISCONNECT */
+#ifdef DHDTCPSYNC_FLOOD_BLK
+       uint32 tsync_rcvd;
+       uint32 tsyncack_txed;
+       u64 last_sync;
+       struct work_struct  blk_tsfl_work;
+       uint32 tsync_per_sec;
+       bool disconnect_tsync_flood;
+#endif /* DHDTCPSYNC_FLOOD_BLK */
+#ifdef DHD_POST_EAPOL_M1_AFTER_ROAM_EVT
+       bool recv_reassoc_evt;
+       bool post_roam_evt;
+#endif /* DHD_POST_EAPOL_M1_AFTER_ROAM_EVT */
+} dhd_if_t;
+
+struct ipv6_work_info_t {
+       uint8                   if_idx;
+       char                    ipv6_addr[IPV6_ADDR_LEN];
+       unsigned long           event;
+};
+
+typedef struct dhd_dump {
+       uint8 *buf;
+       int bufsize;
+       uint8 *hscb_buf;
+       int hscb_bufsize;
+} dhd_dump_t;
+#ifdef DNGL_AXI_ERROR_LOGGING
+typedef struct dhd_axi_error_dump {
+       ulong fault_address;
+       uint32 axid;
+       struct hnd_ext_trap_axi_error_v1 etd_axi_error_v1;
+} dhd_axi_error_dump_t;
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+struct dhd_rx_tx_work {
+       struct work_struct work;
+       struct sk_buff *skb;
+       struct net_device *net;
+       struct dhd_pub *pub;
+};
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#ifdef FILTER_IE
+#define FILTER_IE_PATH "/etc/wifi/filter_ie"
+#define FILTER_IE_BUFSZ 1024 /* ioc buffsize for FILTER_IE */
+#define FILE_BLOCK_READ_SIZE 256
+#define WL_FILTER_IE_IOV_HDR_SIZE OFFSETOF(wl_filter_ie_iov_v1_t, tlvs)
+#endif /* FILTER_IE */
+
+#define NULL_CHECK(p, s, err)  \
+                       do { \
+                               if (!(p)) { \
+                                       printk("NULL POINTER (%s) : %s\n", __FUNCTION__, (s)); \
+                                       err = BCME_ERROR; \
+                                       return err; \
+                               } \
+                       } while (0)
+
+int dhd_wifi_platform_register_drv(void);
+void dhd_wifi_platform_unregister_drv(void);
+wifi_adapter_info_t* dhd_wifi_platform_attach_adapter(uint32 bus_type,
+       uint32 bus_num, uint32 slot_num, unsigned long status);
+wifi_adapter_info_t* dhd_wifi_platform_get_adapter(uint32 bus_type, uint32 bus_num,
+       uint32 slot_num);
+int wifi_platform_set_power(wifi_adapter_info_t *adapter, bool on, unsigned long msec);
+int wifi_platform_bus_enumerate(wifi_adapter_info_t *adapter, bool device_present);
+int wifi_platform_get_irq_number(wifi_adapter_info_t *adapter, unsigned long *irq_flags_ptr);
+int wifi_platform_get_mac_addr(wifi_adapter_info_t *adapter, unsigned char *buf, char *name);
+#ifdef CUSTOM_COUNTRY_CODE
+void *wifi_platform_get_country_code(wifi_adapter_info_t *adapter, char *ccode,
+       u32 flags);
+#else
+void *wifi_platform_get_country_code(wifi_adapter_info_t *adapter, char *ccode);
+#endif /* CUSTOM_COUNTRY_CODE */
+void* wifi_platform_prealloc(wifi_adapter_info_t *adapter, int section, unsigned long size);
+void* wifi_platform_get_prealloc_func_ptr(wifi_adapter_info_t *adapter);
+
+int dhd_get_fw_mode(struct dhd_info *dhdinfo);
+bool dhd_update_fw_nv_path(struct dhd_info *dhdinfo);
+
+#if defined(BT_OVER_SDIO)
+int dhd_net_bus_get(struct net_device *dev);
+int dhd_net_bus_put(struct net_device *dev);
+#endif /* BT_OVER_SDIO */
+#if defined(WLADPS) || defined(WLADPS_PRIVATE_CMD)
+#define ADPS_ENABLE    1
+#define ADPS_DISABLE   0
+
+int dhd_enable_adps(dhd_pub_t *dhd, uint8 on);
+#endif /* WLADPS || WLADPS_PRIVATE_CMD */
+#ifdef DHDTCPSYNC_FLOOD_BLK
+extern void dhd_reset_tcpsync_info_by_ifp(dhd_if_t *ifp);
+extern void dhd_reset_tcpsync_info_by_dev(struct net_device *dev);
+#endif /* DHDTCPSYNC_FLOOD_BLK */
+#ifdef PCIE_FULL_DONGLE
+extern void dhd_net_del_flowrings_sta(dhd_pub_t * dhd, struct net_device * ndev);
+#endif /* PCIE_FULL_DONGLE */
+#endif /* __DHD_LINUX_H__ */
diff --git a/bcmdhd.101.10.240.x/dhd_linux_exportfs.c b/bcmdhd.101.10.240.x/dhd_linux_exportfs.c
new file mode 100644 (file)
index 0000000..893bb70
--- /dev/null
@@ -0,0 +1,1667 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Linux-specific network interface
+ * Basically selected code segments from usb-cdc.c and usb-rndis.c
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+#include <linux/kobject.h>
+#include <linux/proc_fs.h>
+#include <linux/sysfs.h>
+#include <osl.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <dhd_linux_priv.h>
+#if defined(DHD_ADPS_BAM_EXPORT) && defined(WL_BAM)
+#include <wl_bam.h>
+#endif /* DHD_ADPS_BAM_EXPORT && WL_BAM */
+#ifdef CSI_SUPPORT
+#include <dhd_csi.h>
+#endif /* CSI_SUPPORT */
+
+#ifdef SHOW_LOGTRACE
+extern dhd_pub_t* g_dhd_pub;
+static int dhd_ring_proc_open(struct inode *inode, struct file *file);
+ssize_t dhd_ring_proc_read(struct file *file, char *buffer, size_t tt, loff_t *loff);
+
+static const struct file_operations dhd_ring_proc_fops = {
+       .open = dhd_ring_proc_open,
+       .read = dhd_ring_proc_read,
+       .release = single_release,
+};
+
+static int
+dhd_ring_proc_open(struct inode *inode, struct file *file)
+{
+       int ret = BCME_ERROR;
+       if (inode) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0))
+               ret = single_open(file, 0, PDE_DATA(inode));
+#else
+               /* This feature is not supported for lower kernel versions */
+               ret = single_open(file, 0, NULL);
+#endif
+       } else {
+               DHD_ERROR(("%s: inode is NULL\n", __FUNCTION__));
+       }
+       return ret;
+}
+
+ssize_t
+dhd_ring_proc_read(struct file *file, char __user *buffer, size_t tt, loff_t *loff)
+{
+       trace_buf_info_t *trace_buf_info;
+       int ret = BCME_ERROR;
+       dhd_dbg_ring_t *ring = (dhd_dbg_ring_t *)((struct seq_file *)(file->private_data))->private;
+
+       if (ring == NULL) {
+               DHD_ERROR(("%s: ring is NULL\n", __FUNCTION__));
+               return ret;
+       }
+
+       ASSERT(g_dhd_pub);
+
+       trace_buf_info = (trace_buf_info_t *)MALLOCZ(g_dhd_pub->osh, sizeof(trace_buf_info_t));
+       if (trace_buf_info) {
+               dhd_dbg_read_ring_into_trace_buf(ring, trace_buf_info);
+               if (copy_to_user(buffer, (void*)trace_buf_info->buf, MIN(trace_buf_info->size, tt)))
+               {
+                       ret = -EFAULT;
+                       goto exit;
+               }
+               if (trace_buf_info->availability == BUF_NOT_AVAILABLE)
+                       ret = BUF_NOT_AVAILABLE;
+               else
+                       ret = trace_buf_info->size;
+       } else
+               DHD_ERROR(("Memory allocation Failed\n"));
+
+exit:
+       if (trace_buf_info) {
+               MFREE(g_dhd_pub->osh, trace_buf_info, sizeof(trace_buf_info_t));
+       }
+       return ret;
+}
+
+void
+dhd_dbg_ring_proc_create(dhd_pub_t *dhdp)
+{
+#ifdef DEBUGABILITY
+       dhd_dbg_ring_t *dbg_verbose_ring = NULL;
+
+       dbg_verbose_ring = dhd_dbg_get_ring_from_ring_id(dhdp, FW_VERBOSE_RING_ID);
+       if (dbg_verbose_ring) {
+               if (!proc_create_data("dhd_trace", S_IRUSR, NULL, &dhd_ring_proc_fops,
+                       dbg_verbose_ring)) {
+                       DHD_ERROR(("Failed to create /proc/dhd_trace procfs interface\n"));
+               } else {
+                       DHD_ERROR(("Created /proc/dhd_trace procfs interface\n"));
+               }
+       } else {
+               DHD_ERROR(("dbg_verbose_ring is NULL, /proc/dhd_trace not created\n"));
+       }
+#endif /* DEBUGABILITY */
+
+#ifdef EWP_ECNTRS_LOGGING
+       if (!proc_create_data("dhd_ecounters", S_IRUSR, NULL, &dhd_ring_proc_fops,
+               dhdp->ecntr_dbg_ring)) {
+               DHD_ERROR(("Failed to create /proc/dhd_ecounters procfs interface\n"));
+       } else {
+               DHD_ERROR(("Created /proc/dhd_ecounters procfs interface\n"));
+       }
+#endif /* EWP_ECNTRS_LOGGING */
+
+#ifdef EWP_RTT_LOGGING
+       if (!proc_create_data("dhd_rtt", S_IRUSR, NULL, &dhd_ring_proc_fops,
+               dhdp->rtt_dbg_ring)) {
+               DHD_ERROR(("Failed to create /proc/dhd_rtt procfs interface\n"));
+       } else {
+               DHD_ERROR(("Created /proc/dhd_rtt procfs interface\n"));
+       }
+#endif /* EWP_RTT_LOGGING */
+}
+
+void
+dhd_dbg_ring_proc_destroy(dhd_pub_t *dhdp)
+{
+#ifdef DEBUGABILITY
+       remove_proc_entry("dhd_trace", NULL);
+#endif /* DEBUGABILITY */
+
+#ifdef EWP_ECNTRS_LOGGING
+       remove_proc_entry("dhd_ecounters", NULL);
+#endif /* EWP_ECNTRS_LOGGING */
+
+#ifdef EWP_RTT_LOGGING
+       remove_proc_entry("dhd_rtt", NULL);
+#endif /* EWP_RTT_LOGGING */
+
+}
+#endif /* SHOW_LOGTRACE */
+
+/* ----------------------------------------------------------------------------
+ * Infrastructure code for sysfs interface support for DHD
+ *
+ * What is sysfs interface?
+ * https://www.kernel.org/doc/Documentation/filesystems/sysfs.txt
+ *
+ * Why sysfs interface?
+ * This is the Linux standard way of changing/configuring Run Time parameters
+ * for a driver. We can use this interface to control "linux" specific driver
+ * parameters.
+ *
+ * -----------------------------------------------------------------------------
+ */
+
+#if defined(DHD_TRACE_WAKE_LOCK)
+extern atomic_t trace_wklock_onoff;
+
+/* Function to show the history buffer */
+static ssize_t
+show_wklock_trace(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+       dhd_info_t *dhd = (dhd_info_t *)dev;
+
+       buf[ret] = '\n';
+       buf[ret+1] = 0;
+
+       dhd_wk_lock_stats_dump(&dhd->pub);
+       return ret+1;
+}
+
+/* Function to enable/disable wakelock trace */
+static ssize_t
+wklock_trace_onoff(struct dhd_info *dev, const char *buf, size_t count)
+{
+       unsigned long onoff;
+       dhd_info_t *dhd = (dhd_info_t *)dev;
+       BCM_REFERENCE(dhd);
+
+       onoff = bcm_strtoul(buf, NULL, 10);
+       if (onoff != 0 && onoff != 1) {
+               return -EINVAL;
+       }
+
+       atomic_set(&trace_wklock_onoff, onoff);
+       if (atomic_read(&trace_wklock_onoff)) {
+               printk("ENABLE WAKLOCK TRACE\n");
+       } else {
+               printk("DISABLE WAKELOCK TRACE\n");
+       }
+
+       return (ssize_t)(onoff+1);
+}
+#endif /* DHD_TRACE_WAKE_LOCK */
+
+#if defined(DHD_LB_TXP)
+static ssize_t
+show_lbtxp(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+       unsigned long onoff;
+       dhd_info_t *dhd = (dhd_info_t *)dev;
+
+       onoff = atomic_read(&dhd->lb_txp_active);
+       ret = scnprintf(buf, PAGE_SIZE - 1, "%lu \n",
+               onoff);
+       return ret;
+}
+
+static ssize_t
+lbtxp_onoff(struct dhd_info *dev, const char *buf, size_t count)
+{
+       unsigned long onoff;
+       dhd_info_t *dhd = (dhd_info_t *)dev;
+       int i;
+
+       onoff = bcm_strtoul(buf, NULL, 10);
+
+       sscanf(buf, "%lu", &onoff);
+       if (onoff != 0 && onoff != 1) {
+               return -EINVAL;
+       }
+       atomic_set(&dhd->lb_txp_active, onoff);
+
+       /* Since the scheme is changed clear the counters */
+       for (i = 0; i < NR_CPUS; i++) {
+               DHD_LB_STATS_CLR(dhd->txp_percpu_run_cnt[i]);
+               DHD_LB_STATS_CLR(dhd->tx_start_percpu_run_cnt[i]);
+       }
+
+       return count;
+}
+
+#endif /* DHD_LB_TXP */
+
+#if defined(DHD_LB_RXP)
+static ssize_t
+show_lbrxp(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+       unsigned long onoff;
+       dhd_info_t *dhd = (dhd_info_t *)dev;
+
+       onoff = atomic_read(&dhd->lb_rxp_active);
+       ret = scnprintf(buf, PAGE_SIZE - 1, "%lu \n",
+               onoff);
+       return ret;
+}
+
+static ssize_t
+lbrxp_onoff(struct dhd_info *dev, const char *buf, size_t count)
+{
+       unsigned long onoff;
+       dhd_info_t *dhd = (dhd_info_t *)dev;
+
+       onoff = bcm_strtoul(buf, NULL, 10);
+
+       sscanf(buf, "%lu", &onoff);
+       if (onoff != 0 && onoff != 1) {
+               return -EINVAL;
+       }
+       atomic_set(&dhd->lb_rxp_active, onoff);
+
+       return count;
+}
+#endif /* DHD_LB_RXP */
+
+#ifdef DHD_LOG_DUMP
+extern int logdump_periodic_flush;
+extern int logdump_ecntr_enable;
+static ssize_t
+show_logdump_periodic_flush(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+       unsigned long val;
+
+       val = logdump_periodic_flush;
+       ret = scnprintf(buf, PAGE_SIZE - 1, "%lu \n", val);
+       return ret;
+}
+
+static ssize_t
+logdump_periodic_flush_onoff(struct dhd_info *dev, const char *buf, size_t count)
+{
+       unsigned long val;
+
+       val = bcm_strtoul(buf, NULL, 10);
+
+       sscanf(buf, "%lu", &val);
+       if (val != 0 && val != 1) {
+                return -EINVAL;
+       }
+       logdump_periodic_flush = val;
+       return count;
+}
+
+static ssize_t
+show_logdump_ecntr(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+       unsigned long val;
+
+       val = logdump_ecntr_enable;
+       ret = scnprintf(buf, PAGE_SIZE - 1, "%lu \n", val);
+       return ret;
+}
+
+static ssize_t
+logdump_ecntr_onoff(struct dhd_info *dev, const char *buf, size_t count)
+{
+       unsigned long val;
+
+       val = bcm_strtoul(buf, NULL, 10);
+
+       sscanf(buf, "%lu", &val);
+       if (val != 0 && val != 1) {
+                return -EINVAL;
+       }
+       logdump_ecntr_enable = val;
+       return count;
+}
+
+#endif /* DHD_LOG_DUMP */
+
+extern uint enable_ecounter;
+static ssize_t
+show_enable_ecounter(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+       unsigned long onoff;
+
+       onoff = enable_ecounter;
+       ret = scnprintf(buf, PAGE_SIZE - 1, "%lu \n",
+               onoff);
+       return ret;
+}
+
+static ssize_t
+ecounter_onoff(struct dhd_info *dev, const char *buf, size_t count)
+{
+       unsigned long onoff;
+       dhd_info_t *dhd = (dhd_info_t *)dev;
+       dhd_pub_t *dhdp;
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return count;
+       }
+       dhdp = &dhd->pub;
+       if (!FW_SUPPORTED(dhdp, ecounters)) {
+               DHD_ERROR(("%s: ecounters not supported by FW\n", __FUNCTION__));
+               return count;
+       }
+
+       onoff = bcm_strtoul(buf, NULL, 10);
+
+       sscanf(buf, "%lu", &onoff);
+       if (onoff != 0 && onoff != 1) {
+               return -EINVAL;
+       }
+
+       if (enable_ecounter == onoff) {
+               DHD_ERROR(("%s: ecounters already %d\n", __FUNCTION__, enable_ecounter));
+               return count;
+       }
+
+       enable_ecounter = onoff;
+       dhd_ecounter_configure(dhdp, enable_ecounter);
+
+       return count;
+}
+
+#ifdef DHD_SSSR_DUMP
+static ssize_t
+show_sssr_enab(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+       unsigned long onoff;
+
+       onoff = sssr_enab;
+       ret = scnprintf(buf, PAGE_SIZE - 1, "%lu \n",
+               onoff);
+       return ret;
+}
+
+static ssize_t
+set_sssr_enab(struct dhd_info *dev, const char *buf, size_t count)
+{
+       unsigned long onoff;
+
+       onoff = bcm_strtoul(buf, NULL, 10);
+
+       sscanf(buf, "%lu", &onoff);
+       if (onoff != 0 && onoff != 1) {
+               return -EINVAL;
+       }
+
+       sssr_enab = (uint)onoff;
+
+       return count;
+}
+
+static ssize_t
+show_fis_enab(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+       unsigned long onoff;
+
+       onoff = fis_enab;
+       ret = scnprintf(buf, PAGE_SIZE - 1, "%lu \n",
+               onoff);
+       return ret;
+}
+
+static ssize_t
+set_fis_enab(struct dhd_info *dev, const char *buf, size_t count)
+{
+       unsigned long onoff;
+
+       onoff = bcm_strtoul(buf, NULL, 10);
+
+       sscanf(buf, "%lu", &onoff);
+       if (onoff != 0 && onoff != 1) {
+               return -EINVAL;
+       }
+
+       fis_enab = (uint)onoff;
+
+       return count;
+}
+#endif /* DHD_SSSR_DUMP */
+
+extern char firmware_path[];
+
+static ssize_t
+show_firmware_path(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+       ret = scnprintf(buf, PAGE_SIZE - 1, "%s\n", firmware_path);
+
+       return ret;
+}
+
+static ssize_t
+store_firmware_path(struct dhd_info *dev, const char *buf, size_t count)
+{
+       if ((int)strlen(buf) >= MOD_PARAM_PATHLEN) {
+               return -EINVAL;
+       }
+
+       sscanf(buf, "%s", firmware_path);
+
+       return count;
+}
+
+extern char nvram_path[];
+
+static ssize_t
+show_nvram_path(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+       ret = scnprintf(buf, PAGE_SIZE - 1, "%s\n", nvram_path);
+
+       return ret;
+}
+
+static ssize_t
+store_nvram_path(struct dhd_info *dev, const char *buf, size_t count)
+{
+       if ((int)strlen(buf) >= MOD_PARAM_PATHLEN) {
+               return -EINVAL;
+       }
+
+       sscanf(buf, "%s", nvram_path);
+
+       return count;
+}
+
+/*
+ * Generic Attribute Structure for DHD.
+ * If we have to add a new sysfs entry under /sys/bcm-dhd/, we have
+ * to instantiate an object of type dhd_attr,  populate it with
+ * the required show/store functions (ex:- dhd_attr_cpumask_primary)
+ * and add the object to default_attrs[] array, that gets registered
+ * to the kobject of dhd (named bcm-dhd).
+ */
+
+struct dhd_attr {
+       struct attribute attr;
+       ssize_t(*show)(struct dhd_info *, char *);
+       ssize_t(*store)(struct dhd_info *, const char *, size_t count);
+};
+
+#if defined(DHD_TRACE_WAKE_LOCK)
+static struct dhd_attr dhd_attr_wklock =
+       __ATTR(wklock_trace, 0660, show_wklock_trace, wklock_trace_onoff);
+#endif /* defined(DHD_TRACE_WAKE_LOCK */
+
+#if defined(DHD_LB_TXP)
+static struct dhd_attr dhd_attr_lbtxp =
+       __ATTR(lbtxp, 0660, show_lbtxp, lbtxp_onoff);
+#endif /* DHD_LB_TXP */
+
+#if defined(DHD_LB_RXP)
+static struct dhd_attr dhd_attr_lbrxp =
+       __ATTR(lbrxp, 0660, show_lbrxp, lbrxp_onoff);
+#endif /* DHD_LB_RXP */
+
+#ifdef DHD_LOG_DUMP
+static struct dhd_attr dhd_attr_logdump_periodic_flush =
+     __ATTR(logdump_periodic_flush, 0660, show_logdump_periodic_flush,
+               logdump_periodic_flush_onoff);
+static struct dhd_attr dhd_attr_logdump_ecntr =
+       __ATTR(logdump_ecntr_enable, 0660, show_logdump_ecntr,
+               logdump_ecntr_onoff);
+#endif /* DHD_LOG_DUMP */
+
+static struct dhd_attr dhd_attr_ecounters =
+       __ATTR(ecounters, 0660, show_enable_ecounter, ecounter_onoff);
+
+#ifdef DHD_SSSR_DUMP
+static struct dhd_attr dhd_attr_sssr_enab =
+       __ATTR(sssr_enab, 0660, show_sssr_enab, set_sssr_enab);
+static struct dhd_attr dhd_attr_fis_enab =
+       __ATTR(fis_enab, 0660, show_fis_enab, set_fis_enab);
+#endif /* DHD_SSSR_DUMP */
+
+static struct dhd_attr dhd_attr_firmware_path =
+       __ATTR(firmware_path, 0660, show_firmware_path, store_firmware_path);
+
+static struct dhd_attr dhd_attr_nvram_path =
+       __ATTR(nvram_path, 0660, show_nvram_path, store_nvram_path);
+
+#define to_dhd(k) container_of(k, struct dhd_info, dhd_kobj)
+#define to_attr(a) container_of(a, struct dhd_attr, attr)
+
+#ifdef DHD_MAC_ADDR_EXPORT
+struct ether_addr sysfs_mac_addr;
+static ssize_t
+show_mac_addr(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       ret = scnprintf(buf, PAGE_SIZE - 1, MACF,
+               (uint32)sysfs_mac_addr.octet[0], (uint32)sysfs_mac_addr.octet[1],
+               (uint32)sysfs_mac_addr.octet[2], (uint32)sysfs_mac_addr.octet[3],
+               (uint32)sysfs_mac_addr.octet[4], (uint32)sysfs_mac_addr.octet[5]);
+
+       return ret;
+}
+
+static ssize_t
+set_mac_addr(struct dhd_info *dev, const char *buf, size_t count)
+{
+       if (!bcm_ether_atoe(buf, &sysfs_mac_addr)) {
+               DHD_ERROR(("Invalid Mac Address \n"));
+               return -EINVAL;
+       }
+
+       DHD_ERROR(("Mac Address set with "MACDBG"\n", MAC2STRDBG(&sysfs_mac_addr)));
+
+       return count;
+}
+
+static struct dhd_attr dhd_attr_macaddr =
+       __ATTR(mac_addr, 0660, show_mac_addr, set_mac_addr);
+#endif /* DHD_MAC_ADDR_EXPORT */
+
+#ifdef DHD_FW_COREDUMP
+/*
+ * XXX The filename to store memdump is defined for each platform.
+ * - The default path of CUSTOMER_HW4 device is "PLATFORM_PATH/.memdump.info"
+ * - Brix platform will take default path "/installmedia/.memdump.info"
+ * New platforms can add their ifdefs accordingly below.
+ */
+
+#ifdef CUSTOMER_HW4_DEBUG
+#define MEMDUMPINFO PLATFORM_PATH".memdump.info"
+#elif defined(BOARD_HIKEY)
+#define MEMDUMPINFO "/data/misc/wifi/.memdump.info"
+#elif defined(__ARM_ARCH_7A__)
+#define MEMDUMPINFO "/data/misc/wifi/.memdump.info"
+#else
+#define MEMDUMPINFO_LIVE "/installmedia/.memdump.info"
+#define MEMDUMPINFO_INST "/data/.memdump.info"
+#define MEMDUMPINFO MEMDUMPINFO_LIVE
+#endif /* CUSTOMER_HW4_DEBUG */
+
+uint32
+get_mem_val_from_file(void)
+{
+       struct file *fp = NULL;
+       uint32 mem_val = DUMP_MEMFILE_MAX;
+       char *p_mem_val = NULL;
+       char *filepath = MEMDUMPINFO;
+       int ret = 0;
+
+       /* Read memdump info from the file */
+       fp = filp_open(filepath, O_RDONLY, 0);
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("%s: File [%s] doesn't exist\n", __FUNCTION__, filepath));
+#if defined(CONFIG_X86)
+               /* Check if it is Live Brix Image */
+               if (strcmp(filepath, MEMDUMPINFO_LIVE) != 0) {
+                       goto done;
+               }
+               /* Try if it is Installed Brix Image */
+               filepath = MEMDUMPINFO_INST;
+               DHD_ERROR(("%s: Try File [%s]\n", __FUNCTION__, filepath));
+               fp = filp_open(filepath, O_RDONLY, 0);
+               if (IS_ERR(fp)) {
+                       DHD_ERROR(("%s: File [%s] doesn't exist\n", __FUNCTION__, filepath));
+                       goto done;
+               }
+#else /* Non Brix Android platform */
+               goto done;
+#endif /* CONFIG_X86 && OEM_ANDROID */
+       }
+
+       /* Handle success case */
+       ret = kernel_read_compat(fp, 0, (char *)&mem_val, sizeof(uint32));
+       if (ret < 0) {
+               DHD_ERROR(("%s: File read error, ret=%d\n", __FUNCTION__, ret));
+               filp_close(fp, NULL);
+               goto done;
+       }
+
+       p_mem_val = (char*)&mem_val;
+       p_mem_val[sizeof(uint32) - 1] = '\0';
+       mem_val = bcm_atoi(p_mem_val);
+
+       filp_close(fp, NULL);
+
+done:
+       return mem_val;
+}
+
+void dhd_get_memdump_info(dhd_pub_t *dhd)
+{
+#ifndef DHD_EXPORT_CNTL_FILE
+       uint32 mem_val = DUMP_MEMFILE_MAX;
+
+       mem_val = get_mem_val_from_file();
+       if (mem_val != DUMP_MEMFILE_MAX)
+               dhd->memdump_enabled = mem_val;
+#ifdef DHD_INIT_DEFAULT_MEMDUMP
+       if (mem_val == 0 || mem_val == DUMP_MEMFILE_MAX)
+               mem_val = DUMP_MEMFILE_BUGON;
+#endif /* DHD_INIT_DEFAULT_MEMDUMP */
+#else
+#ifdef DHD_INIT_DEFAULT_MEMDUMP
+       if (dhd->memdump_enabled == 0 || dhd->memdump_enabled == DUMP_MEMFILE_MAX)
+               dhd->memdump_enabled = DUMP_MEMFILE;
+#endif /* DHD_INIT_DEFAULT_MEMDUMP */
+#endif /* !DHD_EXPORT_CNTL_FILE */
+#ifdef DHD_DETECT_CONSECUTIVE_MFG_HANG
+       /* override memdump_enabled value to avoid once trap issues */
+       if (dhd_bus_get_fw_mode(dhd) == DHD_FLAG_MFG_MODE &&
+                       (dhd->memdump_enabled == DUMP_MEMONLY ||
+                       dhd->memdump_enabled == DUMP_MEMFILE_BUGON)) {
+               dhd->memdump_enabled = DUMP_MEMFILE;
+               DHD_ERROR(("%s : Override memdump_value to %d\n",
+                               __FUNCTION__, dhd->memdump_enabled));
+       }
+#endif /* DHD_DETECT_CONSECUTIVE_MFG_HANG */
+       DHD_ERROR(("%s: MEMDUMP ENABLED = %u\n", __FUNCTION__, dhd->memdump_enabled));
+}
+
+#ifdef DHD_EXPORT_CNTL_FILE
+static ssize_t
+show_memdump_info(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+       dhd_pub_t *dhdp;
+
+       if (!dev) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return ret;
+       }
+
+       dhdp = &dev->pub;
+       ret = scnprintf(buf, PAGE_SIZE -1, "%u\n", dhdp->memdump_enabled);
+       return ret;
+}
+
+static ssize_t
+set_memdump_info(struct dhd_info *dev, const char *buf, size_t count)
+{
+       unsigned long memval;
+       dhd_pub_t *dhdp;
+
+       if (!dev) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return count;
+       }
+       dhdp = &dev->pub;
+
+       memval = bcm_strtoul(buf, NULL, 10);
+       sscanf(buf, "%lu", &memval);
+
+       dhdp->memdump_enabled = (uint32)memval;
+
+       DHD_ERROR(("%s: MEMDUMP ENABLED = %u\n", __FUNCTION__, dhdp->memdump_enabled));
+       return count;
+}
+
+static struct dhd_attr dhd_attr_memdump =
+       __ATTR(memdump, 0660, show_memdump_info, set_memdump_info);
+#endif /* DHD_EXPORT_CNTL_FILE */
+#endif /* DHD_FW_COREDUMP */
+
+#ifdef BCMASSERT_LOG
+/*
+ * XXX The filename to store assert type is defined for each platform.
+ * New platforms can add their ifdefs accordingly below.
+ */
+#ifdef CUSTOMER_HW4_DEBUG
+#define ASSERTINFO PLATFORM_PATH".assert.info"
+#elif defined(BOARD_HIKEY)
+#define ASSERTINFO "/data/misc/wifi/.assert.info"
+#else
+#define ASSERTINFO "/installmedia/.assert.info"
+#endif /* CUSTOMER_HW4_DEBUG */
+int
+get_assert_val_from_file(void)
+{
+       struct file *fp = NULL;
+       char *filepath = ASSERTINFO;
+       char *p_mem_val = NULL;
+       int mem_val = -1;
+
+       /*
+        * Read assert info from the file
+        * 0: Trigger Kernel crash by panic()
+        * 1: Print out the logs and don't trigger Kernel panic. (default)
+        * 2: Trigger Kernel crash by BUG()
+        * File doesn't exist: Keep default value (1).
+        */
+       fp = filp_open(filepath, O_RDONLY, 0);
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("%s: File [%s] doesn't exist\n", __FUNCTION__, filepath));
+       } else {
+               int ret = kernel_read_compat(fp, 0, (char *)&mem_val, sizeof(uint32));
+               if (ret < 0) {
+                       DHD_ERROR(("%s: File read error, ret=%d\n", __FUNCTION__, ret));
+               } else {
+                       p_mem_val = (char *)&mem_val;
+                       p_mem_val[sizeof(uint32) - 1] = '\0';
+                       mem_val = bcm_atoi(p_mem_val);
+                       DHD_ERROR(("%s: ASSERT ENABLED = %d\n", __FUNCTION__, mem_val));
+               }
+               filp_close(fp, NULL);
+       }
+
+#ifdef CUSTOMER_HW4_DEBUG
+       mem_val = (mem_val >= 0) ? mem_val : 1;
+#else
+       mem_val = (mem_val >= 0) ? mem_val : 0;
+#endif /* CUSTOMER_HW4_DEBUG */
+       return mem_val;
+}
+
+void dhd_get_assert_info(dhd_pub_t *dhd)
+{
+#ifndef DHD_EXPORT_CNTL_FILE
+       int mem_val = -1;
+
+       mem_val = get_assert_val_from_file();
+
+       g_assert_type = mem_val;
+#endif /* !DHD_EXPORT_CNTL_FILE */
+}
+
+#ifdef DHD_EXPORT_CNTL_FILE
+static ssize_t
+show_assert_info(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       if (!dev) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return ret;
+       }
+
+       ret = scnprintf(buf, PAGE_SIZE -1, "%d\n", g_assert_type);
+       return ret;
+
+}
+
+static ssize_t
+set_assert_info(struct dhd_info *dev, const char *buf, size_t count)
+{
+       unsigned long assert_val;
+
+       assert_val = bcm_strtoul(buf, NULL, 10);
+       sscanf(buf, "%lu", &assert_val);
+
+       g_assert_type = (uint32)assert_val;
+
+       DHD_ERROR(("%s: ASSERT ENABLED = %lu\n", __FUNCTION__, assert_val));
+       return count;
+
+}
+
+static struct dhd_attr dhd_attr_assert =
+       __ATTR(assert, 0660, show_assert_info, set_assert_info);
+#endif /* DHD_EXPORT_CNTL_FILE */
+#endif /* BCMASSERT_LOG */
+
+#ifdef DHD_EXPORT_CNTL_FILE
+#if defined(WRITE_WLANINFO)
+static ssize_t
+show_wifiver_info(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       ret = scnprintf(buf, PAGE_SIZE -1, "%s", version_info);
+       return ret;
+}
+
+static ssize_t
+set_wifiver_info(struct dhd_info *dev, const char *buf, size_t count)
+{
+       DHD_ERROR(("Do not set version info\n"));
+       return -EINVAL;
+}
+
+static struct dhd_attr dhd_attr_wifiver =
+       __ATTR(wifiver, 0660, show_wifiver_info, set_wifiver_info);
+#endif /* WRITE_WLANINFO */
+
+#if defined(USE_CID_CHECK)
+char cidinfostr[MAX_VNAME_LEN];
+
+static ssize_t
+show_cid_info(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       ret = scnprintf(buf, PAGE_SIZE -1, "%s", cidinfostr);
+       return ret;
+}
+
+static ssize_t
+set_cid_info(struct dhd_info *dev, const char *buf, size_t count)
+{
+       int len = strlen(buf) + 1;
+       int maxstrsz;
+       maxstrsz = MAX_VNAME_LEN;
+
+       scnprintf(cidinfostr, ((len > maxstrsz) ? maxstrsz : len), "%s", buf);
+       DHD_INFO(("%s : CID info string\n", cidinfostr));
+       return count;
+}
+
+static struct dhd_attr dhd_attr_cidinfo =
+       __ATTR(cid, 0660, show_cid_info, set_cid_info);
+#endif /* USE_CID_CHECK */
+
+#if defined(GEN_SOFTAP_INFO_FILE)
+char softapinfostr[SOFTAP_INFO_BUF_SZ];
+static ssize_t
+show_softap_info(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       ret = scnprintf(buf, PAGE_SIZE -1, "%s", softapinfostr);
+       return ret;
+}
+
+static ssize_t
+set_softap_info(struct dhd_info *dev, const char *buf, size_t count)
+{
+       DHD_ERROR(("Do not set sofap related info\n"));
+       return -EINVAL;
+}
+
+static struct dhd_attr dhd_attr_softapinfo =
+       __ATTR(softap, 0660, show_softap_info, set_softap_info);
+#endif /* GEN_SOFTAP_INFO_FILE */
+
+#if defined(MIMO_ANT_SETTING)
+unsigned long antsel;
+
+static ssize_t
+show_ant_info(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       ret = scnprintf(buf, PAGE_SIZE -1, "%lu\n", antsel);
+       return ret;
+}
+
+static ssize_t
+set_ant_info(struct dhd_info *dev, const char *buf, size_t count)
+{
+       unsigned long ant_val;
+
+       ant_val = bcm_strtoul(buf, NULL, 10);
+       sscanf(buf, "%lu", &ant_val);
+
+       /*
+        * Check value
+        * 0 - Not set, handle same as file not exist
+        */
+       if (ant_val > 3) {
+               DHD_ERROR(("[WIFI_SEC] %s: Set Invalid value %lu \n",
+                       __FUNCTION__, ant_val));
+               return -EINVAL;
+       }
+
+       antsel = ant_val;
+       DHD_ERROR(("[WIFI_SEC] %s: Set Antinfo val = %lu \n", __FUNCTION__, antsel));
+       return count;
+}
+
+static struct dhd_attr dhd_attr_antinfo =
+       __ATTR(ant, 0660, show_ant_info, set_ant_info);
+#endif /* MIMO_ANT_SETTING */
+
+#ifdef DHD_PM_CONTROL_FROM_FILE
+extern uint32 pmmode_val;
+static ssize_t
+show_pm_info(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       if (pmmode_val == 0xFF) {
+               ret = scnprintf(buf, PAGE_SIZE -1, "PM mode is not set\n");
+       } else {
+               ret = scnprintf(buf, PAGE_SIZE -1, "%u\n", pmmode_val);
+       }
+       return ret;
+}
+
+static ssize_t
+set_pm_info(struct dhd_info *dev, const char *buf, size_t count)
+{
+       unsigned long pm_val;
+
+       pm_val = bcm_strtoul(buf, NULL, 10);
+       sscanf(buf, "%lu", &pm_val);
+
+       if (pm_val > 2) {
+               DHD_ERROR(("[WIFI_SEC] %s: Set Invalid value %lu \n",
+                       __FUNCTION__, pm_val));
+               return -EINVAL;
+       }
+
+       pmmode_val = (uint32)pm_val;
+       DHD_ERROR(("[WIFI_SEC] %s: Set pminfo val = %u\n", __FUNCTION__, pmmode_val));
+       return count;
+}
+
+static struct dhd_attr dhd_attr_pminfo =
+       __ATTR(pm, 0660, show_pm_info, set_pm_info);
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+
+#ifdef LOGTRACE_FROM_FILE
+unsigned long logtrace_val = 1;
+
+static ssize_t
+show_logtrace_info(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       ret = scnprintf(buf, PAGE_SIZE -1, "%lu\n", logtrace_val);
+       return ret;
+}
+
+static ssize_t
+set_logtrace_info(struct dhd_info *dev, const char *buf, size_t count)
+{
+       unsigned long onoff;
+
+       onoff = bcm_strtoul(buf, NULL, 10);
+       sscanf(buf, "%lu", &onoff);
+
+       if (onoff > 2) {
+               DHD_ERROR(("[WIFI_SEC] %s: Set Invalid value %lu \n",
+                       __FUNCTION__, onoff));
+               return -EINVAL;
+       }
+
+       logtrace_val = onoff;
+       DHD_ERROR(("[WIFI_SEC] %s: LOGTRACE On/Off from sysfs = %lu\n",
+               __FUNCTION__, logtrace_val));
+       return count;
+}
+
+static struct dhd_attr dhd_attr_logtraceinfo =
+       __ATTR(logtrace, 0660, show_logtrace_info, set_logtrace_info);
+#endif /* LOGTRACE_FROM_FILE */
+
+#ifdef  USE_WFA_CERT_CONF
+#ifdef BCMSDIO
+uint32 bus_txglom = VALUENOTSET;
+
+static ssize_t
+show_bustxglom(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       if (bus_txglom == VALUENOTSET) {
+               ret = scnprintf(buf, PAGE_SIZE - 1, "%s\n", "bustxglom not set from sysfs");
+       } else {
+               ret = scnprintf(buf, PAGE_SIZE -1, "%u\n", bus_txglom);
+       }
+       return ret;
+}
+
+static ssize_t
+set_bustxglom(struct dhd_info *dev, const char *buf, size_t count)
+{
+       uint32 onoff;
+
+       onoff = (uint32)bcm_atoi(buf);
+       sscanf(buf, "%u", &onoff);
+
+       if (onoff > 2) {
+               DHD_ERROR(("[WIFI_SEC] %s: Set Invalid value %u \n",
+                       __FUNCTION__, onoff));
+               return -EINVAL;
+       }
+
+       bus_txglom = onoff;
+       DHD_ERROR(("[WIFI_SEC] %s: BUS TXGLOM On/Off from sysfs = %u\n",
+                       __FUNCTION__, bus_txglom));
+       return count;
+}
+
+static struct dhd_attr dhd_attr_bustxglom =
+       __ATTR(bustxglom, 0660, show_bustxglom, set_bustxglom);
+#endif /* BCMSDIO */
+
+#if defined(ROAM_ENABLE) || defined(DISABLE_BUILTIN_ROAM)
+uint32 roam_off = VALUENOTSET;
+
+static ssize_t
+show_roamoff(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       if (roam_off == VALUENOTSET) {
+               ret = scnprintf(buf, PAGE_SIZE -1, "%s\n", "roam_off not set from sysfs");
+       } else {
+               ret = scnprintf(buf, PAGE_SIZE -1, "%u\n", roam_off);
+       }
+       return ret;
+}
+
+static ssize_t
+set_roamoff(struct dhd_info *dev, const char *buf, size_t count)
+{
+       uint32 onoff;
+
+       onoff = bcm_atoi(buf);
+       sscanf(buf, "%u", &onoff);
+
+       if (onoff > 2) {
+               DHD_ERROR(("[WIFI_SEC] %s: Set Invalid value %u \n",
+                       __FUNCTION__, onoff));
+               return -EINVAL;
+       }
+
+       roam_off = onoff;
+       DHD_ERROR(("[WIFI_SEC] %s: ROAM On/Off from sysfs = %u\n",
+               __FUNCTION__, roam_off));
+       return count;
+}
+
+static struct dhd_attr dhd_attr_roamoff =
+       __ATTR(roamoff, 0660, show_roamoff, set_roamoff);
+#endif /* ROAM_ENABLE || DISABLE_BUILTIN_ROAM */
+
+#ifdef USE_WL_FRAMEBURST
+uint32 frameburst = VALUENOTSET;
+
+static ssize_t
+show_frameburst(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       if (frameburst == VALUENOTSET) {
+               ret = scnprintf(buf, PAGE_SIZE -1, "%s\n", "frameburst not set from sysfs");
+       } else {
+               ret = scnprintf(buf, PAGE_SIZE -1, "%u\n", frameburst);
+       }
+       return ret;
+}
+
+static ssize_t
+set_frameburst(struct dhd_info *dev, const char *buf, size_t count)
+{
+       uint32 onoff;
+
+       onoff = bcm_atoi(buf);
+       sscanf(buf, "%u", &onoff);
+
+       if (onoff > 2) {
+               DHD_ERROR(("[WIFI_SEC] %s: Set Invalid value %u \n",
+                       __FUNCTION__, onoff));
+               return -EINVAL;
+       }
+
+       frameburst = onoff;
+       DHD_ERROR(("[WIFI_SEC] %s: FRAMEBURST On/Off from sysfs = %u\n",
+               __FUNCTION__, frameburst));
+       return count;
+}
+
+static struct dhd_attr dhd_attr_frameburst =
+       __ATTR(frameburst, 0660, show_frameburst, set_frameburst);
+#endif /* USE_WL_FRAMEBURST */
+
+#ifdef USE_WL_TXBF
+uint32 txbf = VALUENOTSET;
+
+static ssize_t
+show_txbf(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       if (txbf == VALUENOTSET) {
+               ret = scnprintf(buf, PAGE_SIZE -1, "%s\n", "txbf not set from sysfs");
+       } else {
+               ret = scnprintf(buf, PAGE_SIZE -1, "%u\n", txbf);
+       }
+       return ret;
+}
+
+static ssize_t
+set_txbf(struct dhd_info *dev, const char *buf, size_t count)
+{
+       uint32 onoff;
+
+       onoff = bcm_atoi(buf);
+       sscanf(buf, "%u", &onoff);
+
+       if (onoff > 2) {
+               DHD_ERROR(("[WIFI_SEC] %s: Set Invalid value %u \n",
+                       __FUNCTION__, onoff));
+               return -EINVAL;
+       }
+
+       txbf = onoff;
+       DHD_ERROR(("[WIFI_SEC] %s: FRAMEBURST On/Off from sysfs = %u\n",
+               __FUNCTION__, txbf));
+       return count;
+}
+
+static struct dhd_attr dhd_attr_txbf =
+       __ATTR(txbf, 0660, show_txbf, set_txbf);
+#endif /* USE_WL_TXBF */
+
+#ifdef PROP_TXSTATUS
+uint32 proptx = VALUENOTSET;
+
+static ssize_t
+show_proptx(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       if (proptx == VALUENOTSET) {
+               ret = scnprintf(buf, PAGE_SIZE -1, "%s\n", "proptx not set from sysfs");
+       } else {
+               ret = scnprintf(buf, PAGE_SIZE -1, "%u\n", proptx);
+       }
+       return ret;
+}
+
+static ssize_t
+set_proptx(struct dhd_info *dev, const char *buf, size_t count)
+{
+       uint32 onoff;
+
+       onoff = bcm_strtoul(buf, NULL, 10);
+       sscanf(buf, "%u", &onoff);
+
+       if (onoff > 2) {
+               DHD_ERROR(("[WIFI_SEC] %s: Set Invalid value %u \n",
+                       __FUNCTION__, onoff));
+               return -EINVAL;
+       }
+
+       proptx = onoff;
+       DHD_ERROR(("[WIFI_SEC] %s: FRAMEBURST On/Off from sysfs = %u\n",
+               __FUNCTION__, txbf));
+       return count;
+}
+
+static struct dhd_attr dhd_attr_proptx =
+       __ATTR(proptx, 0660, show_proptx, set_proptx);
+
+#endif /* PROP_TXSTATUS */
+#endif /* USE_WFA_CERT_CONF */
+#endif /* DHD_EXPORT_CNTL_FILE */
+
+#if defined(DHD_ADPS_BAM_EXPORT) && defined(WL_BAM)
+#define BAD_AP_MAC_ADDR_ELEMENT_NUM    6
+wl_bad_ap_mngr_t *g_bad_ap_mngr = NULL;
+
+static ssize_t
+show_adps_bam_list(struct dhd_info *dev, char *buf)
+{
+       int offset = 0;
+       ssize_t ret = 0;
+
+       wl_bad_ap_info_t *bad_ap;
+       wl_bad_ap_info_entry_t *entry;
+
+       if (g_bad_ap_mngr == NULL)
+               return ret;
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_entry(entry, &g_bad_ap_mngr->list, list) {
+               bad_ap = &entry->bad_ap;
+
+               ret = scnprintf(buf + offset, PAGE_SIZE - 1, MACF"\n",
+                       bad_ap->bssid.octet[0], bad_ap->bssid.octet[1],
+                       bad_ap->bssid.octet[2], bad_ap->bssid.octet[3],
+                       bad_ap->bssid.octet[4], bad_ap->bssid.octet[5]);
+
+               offset += ret;
+       }
+       GCC_DIAGNOSTIC_POP();
+
+       return offset;
+}
+
+static ssize_t
+store_adps_bam_list(struct dhd_info *dev, const char *buf, size_t count)
+{
+       int ret;
+       size_t len;
+       int offset;
+       char tmp[128];
+       wl_bad_ap_info_t bad_ap;
+
+       if (g_bad_ap_mngr == NULL)
+               return count;
+
+       len = count;
+       offset = 0;
+       do {
+               ret = sscanf(buf + offset, MACF"\n",
+                       (uint32 *)&bad_ap.bssid.octet[0], (uint32 *)&bad_ap.bssid.octet[1],
+                       (uint32 *)&bad_ap.bssid.octet[2], (uint32 *)&bad_ap.bssid.octet[3],
+                       (uint32 *)&bad_ap.bssid.octet[4], (uint32 *)&bad_ap.bssid.octet[5]);
+               if (ret != BAD_AP_MAC_ADDR_ELEMENT_NUM) {
+                       DHD_ERROR(("%s - fail to parse bad ap data\n", __FUNCTION__));
+                       return -EINVAL;
+               }
+
+               ret = wl_bad_ap_mngr_add(g_bad_ap_mngr, &bad_ap);
+               if (ret < 0)
+                       return ret;
+
+               ret = snprintf(tmp, ARRAYSIZE(tmp), MACF"\n",
+                       bad_ap.bssid.octet[0], bad_ap.bssid.octet[1],
+                       bad_ap.bssid.octet[2], bad_ap.bssid.octet[3],
+                       bad_ap.bssid.octet[4], bad_ap.bssid.octet[5]);
+               if (ret < 0) {
+                       DHD_ERROR(("%s - fail to get bad ap data length(%d)\n", __FUNCTION__, ret));
+                       return ret;
+               }
+
+               len -= ret;
+               offset += ret;
+       } while (len > 0);
+
+       return count;
+}
+
+static struct dhd_attr dhd_attr_adps_bam =
+       __ATTR(bad_ap_list, 0660, show_adps_bam_list, store_adps_bam_list);
+#endif /* DHD_ADPS_BAM_EXPORT && WL_BAM */
+
+#ifdef DHD_SEND_HANG_PRIVCMD_ERRORS
+uint32 report_hang_privcmd_err = 1;
+
+static ssize_t
+show_hang_privcmd_err(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       ret = scnprintf(buf, PAGE_SIZE - 1, "%u\n", report_hang_privcmd_err);
+       return ret;
+}
+
+static ssize_t
+set_hang_privcmd_err(struct dhd_info *dev, const char *buf, size_t count)
+{
+       uint32 val;
+
+       val = bcm_atoi(buf);
+       sscanf(buf, "%u", &val);
+
+       report_hang_privcmd_err = val ? 1 : 0;
+       DHD_INFO(("%s: Set report HANG for private cmd error: %d\n",
+               __FUNCTION__, report_hang_privcmd_err));
+       return count;
+}
+
+static struct dhd_attr dhd_attr_hang_privcmd_err =
+       __ATTR(hang_privcmd_err, 0660, show_hang_privcmd_err, set_hang_privcmd_err);
+#endif /* DHD_SEND_HANG_PRIVCMD_ERRORS */
+
+#if defined(SHOW_LOGTRACE)
+static ssize_t
+show_control_logtrace(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       ret = scnprintf(buf, PAGE_SIZE - 1, "%d\n", control_logtrace);
+       return ret;
+}
+
+static ssize_t
+set_control_logtrace(struct dhd_info *dev, const char *buf, size_t count)
+{
+       uint32 val;
+
+       val = bcm_atoi(buf);
+
+       control_logtrace = val;
+       DHD_ERROR(("%s: Set control logtrace: %d\n", __FUNCTION__, control_logtrace));
+       return count;
+}
+
+static struct dhd_attr dhd_attr_control_logtrace =
+__ATTR(control_logtrace, 0660, show_control_logtrace, set_control_logtrace);
+#endif /* SHOW_LOGTRACE */
+
+#if defined(DISABLE_HE_ENAB) || defined(CUSTOM_CONTROL_HE_ENAB)
+uint8 control_he_enab = 1;
+#endif /* DISABLE_HE_ENAB || CUSTOM_CONTROL_HE_ENAB */
+
+#if defined(CUSTOM_CONTROL_HE_ENAB)
+static ssize_t
+show_control_he_enab(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+
+       ret = scnprintf(buf, PAGE_SIZE - 1, "%d\n", control_he_enab);
+       return ret;
+}
+
+static ssize_t
+set_control_he_enab(struct dhd_info *dev, const char *buf, size_t count)
+{
+       uint32 val;
+
+       val = bcm_atoi(buf);
+
+       control_he_enab = val ? 1 : 0;
+       DHD_ERROR(("%s: Set control he enab: %d\n", __FUNCTION__, control_he_enab));
+       return count;
+}
+
+static struct dhd_attr dhd_attr_control_he_enab=
+__ATTR(control_he_enab, 0660, show_control_he_enab, set_control_he_enab);
+#endif /* CUSTOM_CONTROL_HE_ENAB */
+
+#if defined(WLAN_ACCEL_BOOT)
+static ssize_t
+show_wl_accel_force_reg_on(struct dhd_info *dhd, char *buf)
+{
+       ssize_t ret = 0;
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return ret;
+       }
+
+       ret = scnprintf(buf, PAGE_SIZE - 1, "%d\n", dhd->wl_accel_force_reg_on);
+       return ret;
+}
+
+static ssize_t
+set_wl_accel_force_reg_on(struct dhd_info *dhd, const char *buf, size_t count)
+{
+       uint32 val;
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return count;
+       }
+
+       val = bcm_atoi(buf);
+
+       dhd->wl_accel_force_reg_on = val ? 1 : 0;
+       DHD_ERROR(("%s: wl_accel_force_reg_on: %d\n", __FUNCTION__, dhd->wl_accel_force_reg_on));
+       return count;
+}
+
+static struct dhd_attr dhd_attr_wl_accel_force_reg_on=
+__ATTR(wl_accel_force_reg_on, 0660, show_wl_accel_force_reg_on, set_wl_accel_force_reg_on);
+#endif /* WLAN_ACCEL_BOOT */
+
+/* Attribute object that gets registered with "wifi" kobject tree */
+static struct attribute *default_file_attrs[] = {
+#ifdef DHD_MAC_ADDR_EXPORT
+       &dhd_attr_macaddr.attr,
+#endif /* DHD_MAC_ADDR_EXPORT */
+#ifdef DHD_EXPORT_CNTL_FILE
+#ifdef DHD_FW_COREDUMP
+       &dhd_attr_memdump.attr,
+#endif /* DHD_FW_COREDUMP */
+#ifdef BCMASSERT_LOG
+       &dhd_attr_assert.attr,
+#endif /* BCMASSERT_LOG */
+#ifdef WRITE_WLANINFO
+       &dhd_attr_wifiver.attr,
+#endif /* WRITE_WLANINFO */
+#ifdef USE_CID_CHECK
+       &dhd_attr_cidinfo.attr,
+#endif /* USE_CID_CHECK */
+#ifdef GEN_SOFTAP_INFO_FILE
+       &dhd_attr_softapinfo.attr,
+#endif /* GEN_SOFTAP_INFO_FILE */
+#ifdef MIMO_ANT_SETTING
+       &dhd_attr_antinfo.attr,
+#endif /* MIMO_ANT_SETTING */
+#ifdef DHD_PM_CONTROL_FROM_FILE
+       &dhd_attr_pminfo.attr,
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+#ifdef LOGTRACE_FROM_FILE
+       &dhd_attr_logtraceinfo.attr,
+#endif /* LOGTRACE_FROM_FILE */
+#ifdef USE_WFA_CERT_CONF
+#ifdef BCMSDIO
+       &dhd_attr_bustxglom.attr,
+#endif /* BCMSDIO */
+       &dhd_attr_roamoff.attr,
+#ifdef USE_WL_FRAMEBURST
+       &dhd_attr_frameburst.attr,
+#endif /* USE_WL_FRAMEBURST */
+#ifdef USE_WL_TXBF
+       &dhd_attr_txbf.attr,
+#endif /* USE_WL_TXBF */
+#ifdef PROP_TXSTATUS
+       &dhd_attr_proptx.attr,
+#endif /* PROP_TXSTATUS */
+#endif /* USE_WFA_CERT_CONF */
+#endif /* DHD_EXPORT_CNTL_FILE */
+#if defined(DHD_ADPS_BAM_EXPORT) && defined(WL_BAM)
+       &dhd_attr_adps_bam.attr,
+#endif /* DHD_ADPS_BAM_EXPORT && WL_BAM */
+#ifdef DHD_SEND_HANG_PRIVCMD_ERRORS
+       &dhd_attr_hang_privcmd_err.attr,
+#endif /* DHD_SEND_HANG_PRIVCMD_ERRORS */
+#if defined(SHOW_LOGTRACE)
+       &dhd_attr_control_logtrace.attr,
+#endif /* SHOW_LOGTRACE */
+#if defined(DHD_TRACE_WAKE_LOCK)
+       &dhd_attr_wklock.attr,
+#endif
+#if defined(DHD_LB_TXP)
+       &dhd_attr_lbtxp.attr,
+#endif /* DHD_LB_TXP */
+#if defined(DHD_LB_RXP)
+       &dhd_attr_lbrxp.attr,
+#endif /* DHD_LB_RXP */
+#ifdef DHD_LOG_DUMP
+       &dhd_attr_logdump_periodic_flush.attr,
+       &dhd_attr_logdump_ecntr.attr,
+#endif
+       &dhd_attr_ecounters.attr,
+#ifdef DHD_SSSR_DUMP
+       &dhd_attr_sssr_enab.attr,
+       &dhd_attr_fis_enab.attr,
+#endif /* DHD_SSSR_DUMP */
+       &dhd_attr_firmware_path.attr,
+       &dhd_attr_nvram_path.attr,
+#if defined(CUSTOM_CONTROL_HE_ENAB)
+       &dhd_attr_control_he_enab.attr,
+#endif /* CUSTOM_CONTROL_HE_ENAB */
+#if defined(WLAN_ACCEL_BOOT)
+       &dhd_attr_wl_accel_force_reg_on.attr,
+#endif /* WLAN_ACCEL_BOOT */
+       NULL
+};
+
+/*
+ * wifi kobject show function, the "attr" attribute specifices to which
+ * node under "sys/wifi" the show function is called.
+ */
+static ssize_t dhd_show(struct kobject *kobj, struct attribute *attr, char *buf)
+{
+       dhd_info_t *dhd;
+       struct dhd_attr *d_attr;
+       int ret;
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       dhd = to_dhd(kobj);
+       d_attr = to_attr(attr);
+       GCC_DIAGNOSTIC_POP();
+
+       if (d_attr->show)
+               ret = d_attr->show(dhd, buf);
+       else
+               ret = -EIO;
+
+       return ret;
+}
+
+/*
+ * wifi kobject show function, the "attr" attribute specifices to which
+ * node under "sys/wifi" the store function is called.
+ */
+static ssize_t dhd_store(struct kobject *kobj, struct attribute *attr,
+       const char *buf, size_t count)
+{
+       dhd_info_t *dhd;
+       struct dhd_attr *d_attr;
+       int ret;
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       dhd = to_dhd(kobj);
+       d_attr = to_attr(attr);
+       GCC_DIAGNOSTIC_POP();
+
+       if (d_attr->store)
+               ret = d_attr->store(dhd, buf, count);
+       else
+               ret = -EIO;
+
+       return ret;
+
+}
+
+static struct sysfs_ops dhd_sysfs_ops = {
+       .show = dhd_show,
+       .store = dhd_store,
+};
+
+static struct kobj_type dhd_ktype = {
+       .sysfs_ops = &dhd_sysfs_ops,
+       .default_attrs = default_file_attrs,
+};
+
+#ifdef CSI_SUPPORT
+/* Function to show current ccode */
+static ssize_t read_csi_data(struct file *filp, struct kobject *kobj,
+       struct bin_attribute *bin_attr, char *buf, loff_t off, size_t count)
+{
+       dhd_info_t *dhd = to_dhd(kobj);
+       int n = 0;
+
+       n = dhd_csi_dump_list(&dhd->pub, buf);
+       DHD_INFO(("Dump data to file, size %d\n", n));
+       dhd_csi_clean_list(&dhd->pub);
+
+       return n;
+}
+
+static struct bin_attribute dhd_attr_csi = {
+       .attr = { .name = "csi",
+                 .mode = 0660, },
+       .size = MAX_CSI_FILESZ,
+       .read = read_csi_data,
+};
+#endif /* CSI_SUPPORT */
+
+/* Create a kobject and attach to sysfs interface */
+int dhd_sysfs_init(dhd_info_t *dhd)
+{
+       int ret = -1;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("%s(): dhd is NULL \r\n", __FUNCTION__));
+               return ret;
+       }
+
+       /* Initialize the kobject */
+       ret = kobject_init_and_add(&dhd->dhd_kobj, &dhd_ktype, NULL, "wifi");
+       if (ret) {
+               kobject_put(&dhd->dhd_kobj);
+               DHD_ERROR(("%s(): Unable to allocate kobject \r\n", __FUNCTION__));
+               return ret;
+       }
+
+#ifdef CSI_SUPPORT
+       ret = sysfs_create_bin_file(&dhd->dhd_kobj, &dhd_attr_csi);
+       if (ret) {
+               DHD_ERROR(("%s: can't create %s\n", __FUNCTION__, dhd_attr_csi.attr.name));
+               kobject_put(&dhd->dhd_kobj);
+               return ret;
+       }
+#endif /* CSI_SUPPORT */
+
+       /*
+        * We are always responsible for sending the uevent that the kobject
+        * was added to the system.
+        */
+       kobject_uevent(&dhd->dhd_kobj, KOBJ_ADD);
+
+       return ret;
+}
+
+/* Done with the kobject and detach the sysfs interface */
+void dhd_sysfs_exit(dhd_info_t *dhd)
+{
+       if (dhd == NULL) {
+               DHD_ERROR(("%s(): dhd is NULL \r\n", __FUNCTION__));
+               return;
+       }
+
+       /* Releae the kobject */
+       if (dhd->dhd_kobj.state_initialized)
+               kobject_put(&dhd->dhd_kobj);
+}
+
+#ifdef DHD_SUPPORT_HDM
+static ssize_t
+hdm_load_module(struct kobject *kobj, struct kobj_attribute *attr, const char *buf, size_t count)
+{
+       int val = bcm_atoi(buf);
+
+       if (val == 1) {
+               DHD_ERROR(("%s : Load module from the hdm %d\n", __FUNCTION__, val));
+               dhd_module_init_hdm();
+       } else {
+               DHD_ERROR(("Module load triggered with invalid value : %d\n", val));
+       }
+
+       return count;
+}
+
+static struct kobj_attribute hdm_wlan_attr =
+       __ATTR(hdm_wlan_loader, 0660, NULL, hdm_load_module);
+
+void
+dhd_hdm_wlan_sysfs_init()
+{
+       DHD_ERROR(("export hdm_wlan_loader\n"));
+       if (sysfs_create_file(kernel_kobj, &hdm_wlan_attr.attr)) {
+               DHD_ERROR(("export hdm_load failed\n"));
+       }
+}
+
+void
+dhd_hdm_wlan_sysfs_deinit(struct work_struct *work)
+{
+       sysfs_remove_file(kernel_kobj,  &hdm_wlan_attr.attr);
+
+}
+#endif /* DHD_SUPPORT_HDM */
diff --git a/bcmdhd.101.10.240.x/dhd_linux_lb.c b/bcmdhd.101.10.240.x/dhd_linux_lb.c
new file mode 100644 (file)
index 0000000..882866f
--- /dev/null
@@ -0,0 +1,1384 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Linux-specific network interface
+ * Basically selected code segments from usb-cdc.c and usb-rndis.c
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#include <dhd_linux_priv.h>
+
+extern dhd_pub_t* g_dhd_pub;
+
+#if defined(DHD_LB)
+
+void
+dhd_lb_set_default_cpus(dhd_info_t *dhd)
+{
+       /* Default CPU allocation for the jobs */
+       atomic_set(&dhd->rx_napi_cpu, 1);
+       atomic_set(&dhd->rx_compl_cpu, 2);
+       atomic_set(&dhd->tx_compl_cpu, 2);
+       atomic_set(&dhd->tx_cpu, 2);
+       atomic_set(&dhd->net_tx_cpu, 0);
+       atomic_set(&dhd->dpc_cpu, 0);
+}
+
+void
+dhd_cpumasks_deinit(dhd_info_t *dhd)
+{
+       free_cpumask_var(dhd->cpumask_curr_avail);
+       free_cpumask_var(dhd->cpumask_primary);
+       free_cpumask_var(dhd->cpumask_primary_new);
+       free_cpumask_var(dhd->cpumask_secondary);
+       free_cpumask_var(dhd->cpumask_secondary_new);
+}
+
+int
+dhd_cpumasks_init(dhd_info_t *dhd)
+{
+       int id;
+       uint32 cpus, num_cpus = num_possible_cpus();
+       int ret = 0;
+
+       DHD_ERROR(("%s CPU masks primary(big)=0x%x secondary(little)=0x%x\n", __FUNCTION__,
+               DHD_LB_PRIMARY_CPUS, DHD_LB_SECONDARY_CPUS));
+
+       /* FIXME: If one alloc fails we must free_cpumask_var the previous */
+       if (!alloc_cpumask_var(&dhd->cpumask_curr_avail, GFP_KERNEL) ||
+           !alloc_cpumask_var(&dhd->cpumask_primary, GFP_KERNEL) ||
+           !alloc_cpumask_var(&dhd->cpumask_primary_new, GFP_KERNEL) ||
+           !alloc_cpumask_var(&dhd->cpumask_secondary, GFP_KERNEL) ||
+           !alloc_cpumask_var(&dhd->cpumask_secondary_new, GFP_KERNEL)) {
+               DHD_ERROR(("%s Failed to init cpumasks\n", __FUNCTION__));
+               ret = -ENOMEM;
+               goto fail;
+       }
+
+       cpumask_copy(dhd->cpumask_curr_avail, cpu_online_mask);
+       cpumask_clear(dhd->cpumask_primary);
+       cpumask_clear(dhd->cpumask_secondary);
+
+       if (num_cpus > 32) {
+               DHD_ERROR(("%s max cpus must be 32, %d too big\n", __FUNCTION__, num_cpus));
+               ASSERT(0);
+       }
+
+       cpus = DHD_LB_PRIMARY_CPUS;
+       for (id = 0; id < num_cpus; id++) {
+               if (isset(&cpus, id))
+                       cpumask_set_cpu(id, dhd->cpumask_primary);
+       }
+
+       cpus = DHD_LB_SECONDARY_CPUS;
+       for (id = 0; id < num_cpus; id++) {
+               if (isset(&cpus, id))
+                       cpumask_set_cpu(id, dhd->cpumask_secondary);
+       }
+
+       return ret;
+fail:
+       dhd_cpumasks_deinit(dhd);
+       return ret;
+}
+
+/*
+ * The CPU Candidacy Algorithm
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ * The available CPUs for selection are divided into two groups
+ *  Primary Set - A CPU mask that carries the First Choice CPUs
+ *  Secondary Set - A CPU mask that carries the Second Choice CPUs.
+ *
+ * There are two types of Job, that needs to be assigned to
+ * the CPUs, from one of the above mentioned CPU group. The Jobs are
+ * 1) Rx Packet Processing - napi_cpu
+ * 2) Completion Processiong (Tx, RX) - compl_cpu
+ *
+ * To begin with both napi_cpu and compl_cpu are on CPU0. Whenever a CPU goes
+ * on-line/off-line the CPU candidacy algorithm is triggerd. The candidacy
+ * algo tries to pickup the first available non boot CPU (CPU0) for napi_cpu.
+ * If there are more processors free, it assigns one to compl_cpu.
+ * It also tries to ensure that both napi_cpu and compl_cpu are not on the same
+ * CPU, as much as possible.
+ *
+ * By design, both Tx and Rx completion jobs are run on the same CPU core, as it
+ * would allow Tx completion skb's to be released into a local free pool from
+ * which the rx buffer posts could have been serviced. it is important to note
+ * that a Tx packet may not have a large enough buffer for rx posting.
+ */
+void dhd_select_cpu_candidacy(dhd_info_t *dhd)
+{
+       uint32 primary_available_cpus; /* count of primary available cpus */
+       uint32 secondary_available_cpus; /* count of secondary available cpus */
+       uint32 napi_cpu = 0; /* cpu selected for napi rx processing */
+       uint32 compl_cpu = 0; /* cpu selected for completion jobs */
+       uint32 tx_cpu = 0; /* cpu selected for tx processing job */
+       uint32 dpc_cpu = atomic_read(&dhd->dpc_cpu);
+       uint32 net_tx_cpu = atomic_read(&dhd->net_tx_cpu);
+
+       cpumask_clear(dhd->cpumask_primary_new);
+       cpumask_clear(dhd->cpumask_secondary_new);
+
+       /*
+        * Now select from the primary mask. Even if a Job is
+        * already running on a CPU in secondary group, we still move
+        * to primary CPU. So no conditional checks.
+        */
+       cpumask_and(dhd->cpumask_primary_new, dhd->cpumask_primary,
+               dhd->cpumask_curr_avail);
+
+       cpumask_and(dhd->cpumask_secondary_new, dhd->cpumask_secondary,
+               dhd->cpumask_curr_avail);
+
+       /* Clear DPC cpu from new masks so that dpc cpu is not chosen for LB */
+       cpumask_clear_cpu(dpc_cpu, dhd->cpumask_primary_new);
+       cpumask_clear_cpu(dpc_cpu, dhd->cpumask_secondary_new);
+
+       /* Clear net_tx_cpu from new masks so that same is not chosen for LB */
+       cpumask_clear_cpu(net_tx_cpu, dhd->cpumask_primary_new);
+       cpumask_clear_cpu(net_tx_cpu, dhd->cpumask_secondary_new);
+
+       primary_available_cpus = cpumask_weight(dhd->cpumask_primary_new);
+
+       if (primary_available_cpus > 0) {
+               napi_cpu = cpumask_first(dhd->cpumask_primary_new);
+
+               /* If no further CPU is available,
+                * cpumask_next returns >= nr_cpu_ids
+                */
+               tx_cpu = cpumask_next(napi_cpu, dhd->cpumask_primary_new);
+               if (tx_cpu >= nr_cpu_ids)
+                       tx_cpu = 0;
+
+               /* In case there are no more CPUs, do completions & Tx in same CPU */
+               compl_cpu = cpumask_next(tx_cpu, dhd->cpumask_primary_new);
+               if (compl_cpu >= nr_cpu_ids)
+                       compl_cpu = tx_cpu;
+       }
+
+       DHD_INFO(("%s After primary CPU check napi_cpu %d compl_cpu %d tx_cpu %d\n",
+               __FUNCTION__, napi_cpu, compl_cpu, tx_cpu));
+
+       /* -- Now check for the CPUs from the secondary mask -- */
+       secondary_available_cpus = cpumask_weight(dhd->cpumask_secondary_new);
+
+       DHD_INFO(("%s Available secondary cpus %d nr_cpu_ids %d\n",
+               __FUNCTION__, secondary_available_cpus, nr_cpu_ids));
+
+       if (secondary_available_cpus > 0) {
+               /* At this point if napi_cpu is unassigned it means no CPU
+                * is online from Primary Group
+                */
+               if (napi_cpu == 0) {
+                       napi_cpu = cpumask_first(dhd->cpumask_secondary_new);
+                       tx_cpu = cpumask_next(napi_cpu, dhd->cpumask_secondary_new);
+                       compl_cpu = cpumask_next(tx_cpu, dhd->cpumask_secondary_new);
+               } else if (tx_cpu == 0) {
+                       tx_cpu = cpumask_first(dhd->cpumask_secondary_new);
+                       compl_cpu = cpumask_next(tx_cpu, dhd->cpumask_secondary_new);
+               } else if (compl_cpu == 0) {
+                       compl_cpu = cpumask_first(dhd->cpumask_secondary_new);
+               }
+
+               /* If no CPU was available for tx processing, choose CPU 0 */
+               if (tx_cpu >= nr_cpu_ids)
+                       tx_cpu = 0;
+
+               /* If no CPU was available for completion, choose CPU 0 */
+               if (compl_cpu >= nr_cpu_ids)
+                       compl_cpu = 0;
+       }
+       if ((primary_available_cpus == 0) &&
+               (secondary_available_cpus == 0)) {
+               /* No CPUs available from primary or secondary mask */
+               napi_cpu = 1;
+               compl_cpu = 0;
+               tx_cpu = 2;
+       }
+
+       DHD_INFO(("%s After secondary CPU check napi_cpu %d compl_cpu %d tx_cpu %d\n",
+               __FUNCTION__, napi_cpu, compl_cpu, tx_cpu));
+
+       ASSERT(napi_cpu < nr_cpu_ids);
+       ASSERT(compl_cpu < nr_cpu_ids);
+       ASSERT(tx_cpu < nr_cpu_ids);
+
+       atomic_set(&dhd->rx_napi_cpu, napi_cpu);
+       atomic_set(&dhd->tx_compl_cpu, compl_cpu);
+       atomic_set(&dhd->rx_compl_cpu, compl_cpu);
+       atomic_set(&dhd->tx_cpu, tx_cpu);
+
+       return;
+}
+
+/*
+ * Function to handle CPU Hotplug notifications.
+ * One of the task it does is to trigger the CPU Candidacy algorithm
+ * for load balancing.
+ */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 10, 0))
+
+int dhd_cpu_startup_callback(unsigned int cpu)
+{
+       dhd_info_t *dhd = g_dhd_pub->info;
+
+       DHD_INFO(("%s(): \r\n cpu:%d", __FUNCTION__, cpu));
+       DHD_LB_STATS_INCR(dhd->cpu_online_cnt[cpu]);
+       cpumask_set_cpu(cpu, dhd->cpumask_curr_avail);
+       dhd_select_cpu_candidacy(dhd);
+
+       return 0;
+}
+
+int dhd_cpu_teardown_callback(unsigned int cpu)
+{
+       dhd_info_t *dhd = g_dhd_pub->info;
+
+       DHD_INFO(("%s(): \r\n cpu:%d", __FUNCTION__, cpu));
+       DHD_LB_STATS_INCR(dhd->cpu_offline_cnt[cpu]);
+       cpumask_clear_cpu(cpu, dhd->cpumask_curr_avail);
+       dhd_select_cpu_candidacy(dhd);
+
+       return 0;
+}
+#else
+int
+dhd_cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
+{
+       unsigned long int cpu = (unsigned long int)hcpu;
+       dhd_info_t *dhd;
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       dhd = container_of(nfb, dhd_info_t, cpu_notifier);
+       GCC_DIAGNOSTIC_POP();
+
+       if (!dhd || !(dhd->dhd_state & DHD_ATTACH_STATE_LB_ATTACH_DONE)) {
+               DHD_INFO(("%s(): LB data is not initialized yet.\n",
+                       __FUNCTION__));
+               return NOTIFY_BAD;
+       }
+
+       /* XXX: Do we need other action types ? */
+       switch (action)
+       {
+               case CPU_ONLINE:
+               case CPU_ONLINE_FROZEN:
+                       DHD_LB_STATS_INCR(dhd->cpu_online_cnt[cpu]);
+                       cpumask_set_cpu(cpu, dhd->cpumask_curr_avail);
+                       dhd_select_cpu_candidacy(dhd);
+                       break;
+
+               case CPU_DOWN_PREPARE:
+               case CPU_DOWN_PREPARE_FROZEN:
+                       DHD_LB_STATS_INCR(dhd->cpu_offline_cnt[cpu]);
+                       cpumask_clear_cpu(cpu, dhd->cpumask_curr_avail);
+                       dhd_select_cpu_candidacy(dhd);
+                       break;
+               default:
+                       break;
+       }
+
+       return NOTIFY_OK;
+}
+#endif /* LINUX_VERSION_CODE < 4.10.0 */
+
+int dhd_register_cpuhp_callback(dhd_info_t *dhd)
+{
+       int cpuhp_ret = 0;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 10, 0))
+       cpuhp_ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "dhd",
+               dhd_cpu_startup_callback, dhd_cpu_teardown_callback);
+
+       if (cpuhp_ret < 0) {
+               DHD_ERROR(("%s(): cpuhp_setup_state failed %d RX LB won't happen \r\n",
+                       __FUNCTION__, cpuhp_ret));
+       }
+#else
+       /*
+        * If we are able to initialize CPU masks, lets register to the
+        * CPU Hotplug framework to change the CPU for each job dynamically
+        * using candidacy algorithm.
+        */
+       dhd->cpu_notifier.notifier_call = dhd_cpu_callback;
+       register_hotcpu_notifier(&dhd->cpu_notifier); /* Register a callback */
+#endif /* LINUX_VERSION_CODE < 4.10.0 */
+       return cpuhp_ret;
+}
+
+int dhd_unregister_cpuhp_callback(dhd_info_t *dhd)
+{
+       int ret = 0;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 10, 0))
+       /* Don't want to call tear down while unregistering */
+       cpuhp_remove_state_nocalls(CPUHP_AP_ONLINE_DYN);
+#else
+       if (dhd->cpu_notifier.notifier_call != NULL) {
+               unregister_cpu_notifier(&dhd->cpu_notifier);
+       }
+#endif
+       return ret;
+}
+
+#if defined(DHD_LB_STATS)
+void dhd_lb_stats_init(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd;
+       int i, j, num_cpus = num_possible_cpus();
+       int alloc_size = sizeof(uint32) * num_cpus;
+
+       if (dhdp == NULL) {
+               DHD_ERROR(("%s(): Invalid argument dhd pubb pointer is NULL \n",
+                       __FUNCTION__));
+               return;
+       }
+
+       dhd = dhdp->info;
+       if (dhd == NULL) {
+               DHD_ERROR(("%s(): DHD pointer is NULL \n", __FUNCTION__));
+               return;
+       }
+
+       DHD_LB_STATS_CLR(dhd->dhd_dpc_cnt);
+       DHD_LB_STATS_CLR(dhd->napi_sched_cnt);
+
+       dhd->napi_percpu_run_cnt = (uint32 *)MALLOC(dhdp->osh, alloc_size);
+       if (!dhd->napi_percpu_run_cnt) {
+               DHD_ERROR(("%s(): napi_percpu_run_cnt malloc failed \n",
+                       __FUNCTION__));
+               return;
+       }
+       for (i = 0; i < num_cpus; i++)
+               DHD_LB_STATS_CLR(dhd->napi_percpu_run_cnt[i]);
+
+       DHD_LB_STATS_CLR(dhd->rxc_sched_cnt);
+
+       dhd->rxc_percpu_run_cnt = (uint32 *)MALLOC(dhdp->osh, alloc_size);
+       if (!dhd->rxc_percpu_run_cnt) {
+               DHD_ERROR(("%s(): rxc_percpu_run_cnt malloc failed \n",
+                       __FUNCTION__));
+               return;
+       }
+       for (i = 0; i < num_cpus; i++)
+               DHD_LB_STATS_CLR(dhd->rxc_percpu_run_cnt[i]);
+
+       DHD_LB_STATS_CLR(dhd->txc_sched_cnt);
+
+       dhd->txc_percpu_run_cnt = (uint32 *)MALLOC(dhdp->osh, alloc_size);
+       if (!dhd->txc_percpu_run_cnt) {
+               DHD_ERROR(("%s(): txc_percpu_run_cnt malloc failed \n",
+                       __FUNCTION__));
+               return;
+       }
+       for (i = 0; i < num_cpus; i++)
+               DHD_LB_STATS_CLR(dhd->txc_percpu_run_cnt[i]);
+
+       dhd->cpu_online_cnt = (uint32 *)MALLOC(dhdp->osh, alloc_size);
+       if (!dhd->cpu_online_cnt) {
+               DHD_ERROR(("%s(): cpu_online_cnt malloc failed \n",
+                       __FUNCTION__));
+               return;
+       }
+       for (i = 0; i < num_cpus; i++)
+               DHD_LB_STATS_CLR(dhd->cpu_online_cnt[i]);
+
+       dhd->cpu_offline_cnt = (uint32 *)MALLOC(dhdp->osh, alloc_size);
+       if (!dhd->cpu_offline_cnt) {
+               DHD_ERROR(("%s(): cpu_offline_cnt malloc failed \n",
+                       __FUNCTION__));
+               return;
+       }
+       for (i = 0; i < num_cpus; i++)
+               DHD_LB_STATS_CLR(dhd->cpu_offline_cnt[i]);
+
+       dhd->txp_percpu_run_cnt = (uint32 *)MALLOC(dhdp->osh, alloc_size);
+       if (!dhd->txp_percpu_run_cnt) {
+               DHD_ERROR(("%s(): txp_percpu_run_cnt malloc failed \n",
+                       __FUNCTION__));
+               return;
+       }
+       for (i = 0; i < num_cpus; i++)
+               DHD_LB_STATS_CLR(dhd->txp_percpu_run_cnt[i]);
+
+       dhd->tx_start_percpu_run_cnt = (uint32 *)MALLOC(dhdp->osh, alloc_size);
+       if (!dhd->tx_start_percpu_run_cnt) {
+               DHD_ERROR(("%s(): tx_start_percpu_run_cnt malloc failed \n",
+                       __FUNCTION__));
+               return;
+       }
+       for (i = 0; i < num_cpus; i++)
+               DHD_LB_STATS_CLR(dhd->tx_start_percpu_run_cnt[i]);
+
+       for (j = 0; j < HIST_BIN_SIZE; j++) {
+               dhd->napi_rx_hist[j] = (uint32 *)MALLOC(dhdp->osh, alloc_size);
+               if (!dhd->napi_rx_hist[j]) {
+                       DHD_ERROR(("%s(): dhd->napi_rx_hist[%d] malloc failed \n",
+                               __FUNCTION__, j));
+                       return;
+               }
+               for (i = 0; i < num_cpus; i++) {
+                       DHD_LB_STATS_CLR(dhd->napi_rx_hist[j][i]);
+               }
+       }
+#ifdef DHD_LB_TXC
+       for (j = 0; j < HIST_BIN_SIZE; j++) {
+               dhd->txc_hist[j] = (uint32 *)MALLOC(dhdp->osh, alloc_size);
+               if (!dhd->txc_hist[j]) {
+                       DHD_ERROR(("%s(): dhd->txc_hist[%d] malloc failed \n",
+                                __FUNCTION__, j));
+                       return;
+               }
+               for (i = 0; i < num_cpus; i++) {
+                       DHD_LB_STATS_CLR(dhd->txc_hist[j][i]);
+               }
+       }
+#endif /* DHD_LB_TXC */
+#ifdef DHD_LB_RXC
+       for (j = 0; j < HIST_BIN_SIZE; j++) {
+               dhd->rxc_hist[j] = (uint32 *)MALLOC(dhdp->osh, alloc_size);
+               if (!dhd->rxc_hist[j]) {
+                       DHD_ERROR(("%s(): dhd->rxc_hist[%d] malloc failed \n",
+                               __FUNCTION__, j));
+                       return;
+               }
+               for (i = 0; i < num_cpus; i++) {
+                       DHD_LB_STATS_CLR(dhd->rxc_hist[j][i]);
+               }
+       }
+#endif /* DHD_LB_RXC */
+       return;
+}
+
+void dhd_lb_stats_deinit(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd;
+       int j, num_cpus = num_possible_cpus();
+       int alloc_size = sizeof(uint32) * num_cpus;
+
+       if (dhdp == NULL) {
+               DHD_ERROR(("%s(): Invalid argument dhd pubb pointer is NULL \n",
+                       __FUNCTION__));
+               return;
+       }
+
+       dhd = dhdp->info;
+       if (dhd == NULL) {
+               DHD_ERROR(("%s(): DHD pointer is NULL \n", __FUNCTION__));
+               return;
+       }
+
+       if (dhd->napi_percpu_run_cnt) {
+               MFREE(dhdp->osh, dhd->napi_percpu_run_cnt, alloc_size);
+       }
+       if (dhd->rxc_percpu_run_cnt) {
+               MFREE(dhdp->osh, dhd->rxc_percpu_run_cnt, alloc_size);
+       }
+       if (dhd->txc_percpu_run_cnt) {
+               MFREE(dhdp->osh, dhd->txc_percpu_run_cnt, alloc_size);
+       }
+       if (dhd->cpu_online_cnt) {
+               MFREE(dhdp->osh, dhd->cpu_online_cnt, alloc_size);
+       }
+       if (dhd->cpu_offline_cnt) {
+               MFREE(dhdp->osh, dhd->cpu_offline_cnt, alloc_size);
+       }
+
+       if (dhd->txp_percpu_run_cnt) {
+               MFREE(dhdp->osh, dhd->txp_percpu_run_cnt, alloc_size);
+       }
+       if (dhd->tx_start_percpu_run_cnt) {
+               MFREE(dhdp->osh, dhd->tx_start_percpu_run_cnt, alloc_size);
+       }
+
+       for (j = 0; j < HIST_BIN_SIZE; j++) {
+               if (dhd->napi_rx_hist[j]) {
+                       MFREE(dhdp->osh, dhd->napi_rx_hist[j], alloc_size);
+               }
+#ifdef DHD_LB_TXC
+               if (dhd->txc_hist[j]) {
+                       MFREE(dhdp->osh, dhd->txc_hist[j], alloc_size);
+               }
+#endif /* DHD_LB_TXC */
+#ifdef DHD_LB_RXC
+               if (dhd->rxc_hist[j]) {
+                       MFREE(dhdp->osh, dhd->rxc_hist[j], alloc_size);
+               }
+#endif /* DHD_LB_RXC */
+       }
+
+       return;
+}
+
+void dhd_lb_stats_dump_histo(dhd_pub_t *dhdp,
+       struct bcmstrbuf *strbuf, uint32 **hist)
+{
+       int i, j;
+       uint32 *per_cpu_total;
+       uint32 total = 0;
+       uint32 num_cpus = num_possible_cpus();
+
+       per_cpu_total = (uint32 *)MALLOC(dhdp->osh, sizeof(uint32) * num_cpus);
+       if (!per_cpu_total) {
+               DHD_ERROR(("%s(): dhd->per_cpu_total malloc failed \n", __FUNCTION__));
+               return;
+       }
+       bzero(per_cpu_total, sizeof(uint32) * num_cpus);
+
+       bcm_bprintf(strbuf, "CPU: \t\t");
+       for (i = 0; i < num_cpus; i++)
+               bcm_bprintf(strbuf, "%d\t", i);
+       bcm_bprintf(strbuf, "\nBin\n");
+
+       for (i = 0; i < HIST_BIN_SIZE; i++) {
+               bcm_bprintf(strbuf, "%d:\t\t", 1<<i);
+               for (j = 0; j < num_cpus; j++) {
+                       bcm_bprintf(strbuf, "%d\t", hist[i][j]);
+               }
+               bcm_bprintf(strbuf, "\n");
+       }
+       bcm_bprintf(strbuf, "Per CPU Total \t");
+       total = 0;
+       for (i = 0; i < num_cpus; i++) {
+               for (j = 0; j < HIST_BIN_SIZE; j++) {
+                       per_cpu_total[i] += (hist[j][i] * (1<<j));
+               }
+               bcm_bprintf(strbuf, "%d\t", per_cpu_total[i]);
+               total += per_cpu_total[i];
+       }
+       bcm_bprintf(strbuf, "\nTotal\t\t%d \n", total);
+
+       if (per_cpu_total) {
+               MFREE(dhdp->osh, per_cpu_total, sizeof(uint32) * num_cpus);
+       }
+       return;
+}
+
+void dhd_lb_stats_dump_cpu_array(struct bcmstrbuf *strbuf, uint32 *p)
+{
+       int i, num_cpus = num_possible_cpus();
+
+       bcm_bprintf(strbuf, "CPU: \t\t");
+       for (i = 0; i < num_cpus; i++)
+               bcm_bprintf(strbuf, "%d\t", i);
+       bcm_bprintf(strbuf, "\n");
+
+       bcm_bprintf(strbuf, "Val: \t\t");
+       for (i = 0; i < num_cpus; i++)
+               bcm_bprintf(strbuf, "%u\t", *(p+i));
+       bcm_bprintf(strbuf, "\n");
+       return;
+}
+
+#ifdef DHD_MEM_STATS
+uint64 dhd_lb_mem_usage(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+       dhd_info_t *dhd;
+       uint16 rxbufpost_sz;
+       uint16 rx_post_active = 0;
+       uint16 rx_cmpl_active = 0;
+       uint64 rx_path_memory_usage = 0;
+
+       if (dhdp == NULL || strbuf == NULL) {
+               DHD_ERROR(("%s(): Invalid argument dhdp %p strbuf %p \n",
+                       __FUNCTION__, dhdp, strbuf));
+               return 0;
+       }
+
+       dhd = dhdp->info;
+       if (dhd == NULL) {
+               DHD_ERROR(("%s(): DHD pointer is NULL \n", __FUNCTION__));
+               return 0;
+       }
+       rxbufpost_sz = dhd_prot_get_rxbufpost_sz(dhdp);
+       if (rxbufpost_sz == 0) {
+               rxbufpost_sz = DHD_FLOWRING_RX_BUFPOST_PKTSZ;
+       }
+       rx_path_memory_usage = rxbufpost_sz * (skb_queue_len(&dhd->rx_pend_queue) +
+               skb_queue_len(&dhd->rx_napi_queue) +
+               skb_queue_len(&dhd->rx_process_queue));
+       rx_post_active = dhd_prot_get_h2d_rx_post_active(dhdp);
+       if (rx_post_active != 0) {
+               rx_path_memory_usage += (rxbufpost_sz * rx_post_active);
+       }
+
+       rx_cmpl_active = dhd_prot_get_d2h_rx_cpln_active(dhdp);
+       if (rx_cmpl_active != 0) {
+               rx_path_memory_usage += (rxbufpost_sz * rx_cmpl_active);
+       }
+
+       dhdp->rxpath_mem = rx_path_memory_usage;
+       bcm_bprintf(strbuf, "\nrxbufpost_sz: %d rx_post_active: %d rx_cmpl_active: %d "
+               "pend_queue_len: %d napi_queue_len: %d process_queue_len: %d\n",
+               rxbufpost_sz, rx_post_active, rx_cmpl_active,
+               skb_queue_len(&dhd->rx_pend_queue),
+               skb_queue_len(&dhd->rx_napi_queue), skb_queue_len(&dhd->rx_process_queue));
+       bcm_bprintf(strbuf, "DHD rx-path memory_usage: %llubytes %lluKB \n",
+               rx_path_memory_usage, (rx_path_memory_usage/ 1024));
+       return rx_path_memory_usage;
+}
+#endif /* DHD_MEM_STATS */
+
+void dhd_lb_stats_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+       dhd_info_t *dhd;
+
+       if (dhdp == NULL || strbuf == NULL) {
+               DHD_ERROR(("%s(): Invalid argument dhdp %p strbuf %p \n",
+                       __FUNCTION__, dhdp, strbuf));
+               return;
+       }
+
+       dhd = dhdp->info;
+       if (dhd == NULL) {
+               DHD_ERROR(("%s(): DHD pointer is NULL \n", __FUNCTION__));
+               return;
+       }
+
+       bcm_bprintf(strbuf, "\ncpu_online_cnt:\n");
+       dhd_lb_stats_dump_cpu_array(strbuf, dhd->cpu_online_cnt);
+
+       bcm_bprintf(strbuf, "\ncpu_offline_cnt:\n");
+       dhd_lb_stats_dump_cpu_array(strbuf, dhd->cpu_offline_cnt);
+
+       bcm_bprintf(strbuf, "\nsched_cnt: dhd_dpc %u napi %u rxc %u txc %u\n",
+               dhd->dhd_dpc_cnt, dhd->napi_sched_cnt, dhd->rxc_sched_cnt,
+               dhd->txc_sched_cnt);
+
+       bcm_bprintf(strbuf, "\nCPUs: dpc_cpu %u napi_cpu %u net_tx_cpu %u tx_cpu %u\n",
+               atomic_read(&dhd->dpc_cpu),
+               atomic_read(&dhd->rx_napi_cpu),
+               atomic_read(&dhd->net_tx_cpu),
+               atomic_read(&dhd->tx_cpu));
+
+#ifdef DHD_LB_RXP
+       bcm_bprintf(strbuf, "\nnapi_percpu_run_cnt:\n");
+       dhd_lb_stats_dump_cpu_array(strbuf, dhd->napi_percpu_run_cnt);
+       bcm_bprintf(strbuf, "\nNAPI Packets Received Histogram:\n");
+       dhd_lb_stats_dump_histo(dhdp, strbuf, dhd->napi_rx_hist);
+#endif /* DHD_LB_RXP */
+
+#ifdef DHD_LB_RXC
+       bcm_bprintf(strbuf, "\nrxc_percpu_run_cnt:\n");
+       dhd_lb_stats_dump_cpu_array(strbuf, dhd->rxc_percpu_run_cnt);
+       bcm_bprintf(strbuf, "\nRX Completions (Buffer Post) Histogram:\n");
+       dhd_lb_stats_dump_histo(dhdp, strbuf, dhd->rxc_hist);
+#endif /* DHD_LB_RXC */
+
+#ifdef DHD_LB_TXC
+       bcm_bprintf(strbuf, "\ntxc_percpu_run_cnt:\n");
+       dhd_lb_stats_dump_cpu_array(strbuf, dhd->txc_percpu_run_cnt);
+       bcm_bprintf(strbuf, "\nTX Completions (Buffer Free) Histogram:\n");
+       dhd_lb_stats_dump_histo(dhdp, strbuf, dhd->txc_hist);
+#endif /* DHD_LB_TXC */
+
+#ifdef DHD_LB_TXP
+       bcm_bprintf(strbuf, "\ntxp_percpu_run_cnt:\n");
+       dhd_lb_stats_dump_cpu_array(strbuf, dhd->txp_percpu_run_cnt);
+
+       bcm_bprintf(strbuf, "\ntx_start_percpu_run_cnt:\n");
+       dhd_lb_stats_dump_cpu_array(strbuf, dhd->tx_start_percpu_run_cnt);
+#endif /* DHD_LB_TXP */
+}
+
+/* Given a number 'n' returns 'm' that is next larger power of 2 after n */
+static inline uint32 next_larger_power2(uint32 num)
+{
+       num--;
+       num |= (num >> 1);
+       num |= (num >> 2);
+       num |= (num >> 4);
+       num |= (num >> 8);
+       num |= (num >> 16);
+
+       return (num + 1);
+}
+
+void dhd_lb_stats_update_histo(uint32 **bin, uint32 count, uint32 cpu)
+{
+       uint32 bin_power;
+       uint32 *p;
+       bin_power = next_larger_power2(count);
+
+       switch (bin_power) {
+               case   1: p = bin[0] + cpu; break;
+               case   2: p = bin[1] + cpu; break;
+               case   4: p = bin[2] + cpu; break;
+               case   8: p = bin[3] + cpu; break;
+               case  16: p = bin[4] + cpu; break;
+               case  32: p = bin[5] + cpu; break;
+               case  64: p = bin[6] + cpu; break;
+               case 128: p = bin[7] + cpu; break;
+               default : p = bin[8] + cpu; break;
+       }
+
+       *p = *p + 1;
+       return;
+}
+
+void dhd_lb_stats_update_napi_histo(dhd_pub_t *dhdp, uint32 count)
+{
+       int cpu;
+       dhd_info_t *dhd = dhdp->info;
+
+       cpu = get_cpu();
+       put_cpu();
+       dhd_lb_stats_update_histo(dhd->napi_rx_hist, count, cpu);
+
+       return;
+}
+
+void dhd_lb_stats_update_txc_histo(dhd_pub_t *dhdp, uint32 count)
+{
+       int cpu;
+       dhd_info_t *dhd = dhdp->info;
+
+       cpu = get_cpu();
+       put_cpu();
+       dhd_lb_stats_update_histo(dhd->txc_hist, count, cpu);
+
+       return;
+}
+
+void dhd_lb_stats_update_rxc_histo(dhd_pub_t *dhdp, uint32 count)
+{
+       int cpu;
+       dhd_info_t *dhd = dhdp->info;
+
+       cpu = get_cpu();
+       put_cpu();
+       dhd_lb_stats_update_histo(dhd->rxc_hist, count, cpu);
+
+       return;
+}
+
+void dhd_lb_stats_txc_percpu_cnt_incr(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+       DHD_LB_STATS_PERCPU_ARR_INCR(dhd->txc_percpu_run_cnt);
+}
+
+void dhd_lb_stats_rxc_percpu_cnt_incr(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+       DHD_LB_STATS_PERCPU_ARR_INCR(dhd->rxc_percpu_run_cnt);
+}
+#endif /* DHD_LB_STATS */
+
+/**
+ * dhd_tasklet_schedule - Function that runs in IPI context of the destination
+ * CPU and schedules a tasklet.
+ * @tasklet: opaque pointer to the tasklet
+ */
+INLINE void
+dhd_tasklet_schedule(void *tasklet)
+{
+       tasklet_schedule((struct tasklet_struct *)tasklet);
+}
+/**
+ * dhd_tasklet_schedule_on - Executes the passed takslet in a given CPU
+ * @tasklet: tasklet to be scheduled
+ * @on_cpu: cpu core id
+ *
+ * If the requested cpu is online, then an IPI is sent to this cpu via the
+ * smp_call_function_single with no wait and the tasklet_schedule function
+ * will be invoked to schedule the specified tasklet on the requested CPU.
+ */
+INLINE void
+dhd_tasklet_schedule_on(struct tasklet_struct *tasklet, int on_cpu)
+{
+       const int wait = 0;
+       smp_call_function_single(on_cpu,
+               dhd_tasklet_schedule, (void *)tasklet, wait);
+}
+
+/**
+ * dhd_work_schedule_on - Executes the passed work in a given CPU
+ * @work: work to be scheduled
+ * @on_cpu: cpu core id
+ *
+ * If the requested cpu is online, then an IPI is sent to this cpu via the
+ * schedule_work_on and the work function
+ * will be invoked to schedule the specified work on the requested CPU.
+ */
+
+INLINE void
+dhd_work_schedule_on(struct work_struct *work, int on_cpu)
+{
+       schedule_work_on(on_cpu, work);
+}
+
+#if defined(DHD_LB_TXC)
+/**
+ * dhd_lb_tx_compl_dispatch - load balance by dispatching the tx_compl_tasklet
+ * on another cpu. The tx_compl_tasklet will take care of DMA unmapping and
+ * freeing the packets placed in the tx_compl workq
+ */
+void
+dhd_lb_tx_compl_dispatch(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+       int curr_cpu, on_cpu;
+
+       if (dhd->rx_napi_netdev == NULL) {
+               DHD_ERROR(("%s: dhd->rx_napi_netdev is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_LB_STATS_INCR(dhd->txc_sched_cnt);
+       /*
+        * If the destination CPU is NOT online or is same as current CPU
+        * no need to schedule the work
+        */
+       curr_cpu = get_cpu();
+       put_cpu();
+
+       on_cpu = atomic_read(&dhd->tx_compl_cpu);
+
+       if ((on_cpu == curr_cpu) || (!cpu_online(on_cpu))) {
+               dhd_tasklet_schedule(&dhd->tx_compl_tasklet);
+       } else {
+               schedule_work(&dhd->tx_compl_dispatcher_work);
+       }
+}
+
+static void dhd_tx_compl_dispatcher_fn(struct work_struct * work)
+{
+       struct dhd_info *dhd =
+               container_of(work, struct dhd_info, tx_compl_dispatcher_work);
+       int cpu;
+
+       get_online_cpus();
+       cpu = atomic_read(&dhd->tx_compl_cpu);
+       if (!cpu_online(cpu))
+               dhd_tasklet_schedule(&dhd->tx_compl_tasklet);
+       else
+               dhd_tasklet_schedule_on(&dhd->tx_compl_tasklet, cpu);
+       put_online_cpus();
+}
+#endif /* DHD_LB_TXC */
+
+#if defined(DHD_LB_RXC)
+/**
+ * dhd_lb_rx_compl_dispatch - load balance by dispatching the rx_compl_tasklet
+ * on another cpu. The rx_compl_tasklet will take care of reposting rx buffers
+ * in the H2D RxBuffer Post common ring, by using the recycled pktids that were
+ * placed in the rx_compl workq.
+ *
+ * @dhdp: pointer to dhd_pub object
+ */
+void
+dhd_lb_rx_compl_dispatch(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+       int curr_cpu, on_cpu;
+
+       if (dhd->rx_napi_netdev == NULL) {
+               DHD_ERROR(("%s: dhd->rx_napi_netdev is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_LB_STATS_INCR(dhd->rxc_sched_cnt);
+       /*
+        * If the destination CPU is NOT online or is same as current CPU
+        * no need to schedule the work
+        */
+       curr_cpu = get_cpu();
+       put_cpu();
+       on_cpu = atomic_read(&dhd->rx_compl_cpu);
+
+       if ((on_cpu == curr_cpu) || (!cpu_online(on_cpu))) {
+               dhd_tasklet_schedule(&dhd->rx_compl_tasklet);
+       } else {
+               schedule_work(&dhd->rx_compl_dispatcher_work);
+       }
+}
+
+void dhd_rx_compl_dispatcher_fn(struct work_struct * work)
+{
+       struct dhd_info *dhd =
+               container_of(work, struct dhd_info, rx_compl_dispatcher_work);
+       int cpu;
+
+       get_online_cpus();
+       cpu = atomic_read(&dhd->rx_compl_cpu);
+       if (!cpu_online(cpu))
+               dhd_tasklet_schedule(&dhd->rx_compl_tasklet);
+       else {
+               dhd_tasklet_schedule_on(&dhd->rx_compl_tasklet, cpu);
+       }
+       put_online_cpus();
+}
+#endif /* DHD_LB_RXC */
+
+#if defined(DHD_LB_TXP)
+void dhd_tx_dispatcher_work(struct work_struct * work)
+{
+       struct dhd_info *dhd;
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       dhd = container_of(work, struct dhd_info, tx_dispatcher_work);
+       GCC_DIAGNOSTIC_POP();
+
+       dhd_tasklet_schedule(&dhd->tx_tasklet);
+}
+
+/**
+ * dhd_lb_tx_dispatch - load balance by dispatching the tx_tasklet
+ * on another cpu. The tx_tasklet will take care of actually putting
+ * the skbs into appropriate flow ring and ringing H2D interrupt
+ *
+ * @dhdp: pointer to dhd_pub object
+ */
+void
+dhd_lb_tx_dispatch(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+       int curr_cpu;
+       int tx_cpu;
+       int prev_net_tx_cpu;
+
+       /*
+        * Get cpu will disable pre-ermption and will not allow any cpu to go offline
+        * and call put_cpu() only after scheduling rx_napi_dispatcher_work.
+        */
+       curr_cpu = get_cpu();
+
+       /* Record the CPU in which the TX request from Network stack came */
+       prev_net_tx_cpu = atomic_read(&dhd->net_tx_cpu);
+       atomic_set(&dhd->net_tx_cpu, curr_cpu);
+
+       tx_cpu = atomic_read(&dhd->tx_cpu);
+
+       /*
+        * Now if the NET TX has scheduled in the same CPU that is chosen for Tx processing
+        * OR scheduled on different cpu than previously it was scheduled,
+        * OR if tx_cpu is offline,
+        * Call cpu candidacy algorithm to recompute tx_cpu.
+        */
+       if ((curr_cpu == tx_cpu) || (curr_cpu != prev_net_tx_cpu) || !cpu_online(tx_cpu)) {
+               /* Re compute LB CPUs */
+               dhd_select_cpu_candidacy(dhd);
+               /* Use updated tx cpu */
+               tx_cpu = atomic_read(&dhd->tx_cpu);
+       }
+
+       /*
+        * Schedule tx_dispatcher_work to on the cpu which
+        * in turn will schedule tx_tasklet.
+        */
+       dhd_work_schedule_on(&dhd->tx_dispatcher_work, tx_cpu);
+
+       put_cpu();
+}
+#endif /* DHD_LB_TXP */
+
+#if defined(DHD_LB_RXP)
+/**
+ * dhd_napi_poll - Load balance napi poll function to process received
+ * packets and send up the network stack using netif_receive_skb()
+ *
+ * @napi: napi object in which context this poll function is invoked
+ * @budget: number of packets to be processed.
+ *
+ * Fetch the dhd_info given the rx_napi_struct. Move all packets from the
+ * rx_napi_queue into a local rx_process_queue (lock and queue move and unlock).
+ * Dequeue each packet from head of rx_process_queue, fetch the ifid from the
+ * packet tag and sendup.
+ */
+int
+dhd_napi_poll(struct napi_struct *napi, int budget)
+{
+       int ifid;
+       const int pkt_count = 1;
+       const int chan = 0;
+       struct sk_buff * skb;
+       unsigned long flags;
+       struct dhd_info *dhd;
+       int processed = 0;
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       dhd = container_of(napi, struct dhd_info, rx_napi_struct);
+       GCC_DIAGNOSTIC_POP();
+
+       DHD_INFO(("%s napi_queue<%d> budget<%d>\n",
+               __FUNCTION__, skb_queue_len(&dhd->rx_napi_queue), budget));
+
+       /*
+        * Extract the entire rx_napi_queue into another rx_process_queue
+        * and process only 'budget' number of skbs from rx_process_queue.
+        * If there are more items to be processed, napi poll will be rescheduled
+        * During the next iteration, next set of skbs from
+        * rx_napi_queue will be extracted and attached to the tail of rx_process_queue.
+        * Again budget number of skbs will be processed from rx_process_queue.
+        * If there are less than budget number of skbs in rx_process_queue,
+        * call napi_complete to stop rescheduling napi poll.
+        */
+       DHD_RX_NAPI_QUEUE_LOCK(&dhd->rx_napi_queue.lock, flags);
+       skb_queue_splice_tail_init(&dhd->rx_napi_queue, &dhd->rx_process_queue);
+       DHD_RX_NAPI_QUEUE_UNLOCK(&dhd->rx_napi_queue.lock, flags);
+
+       while ((processed < budget) && (skb = __skb_dequeue(&dhd->rx_process_queue)) != NULL) {
+               OSL_PREFETCH(skb->data);
+
+               ifid = DHD_PKTTAG_IFID((dhd_pkttag_fr_t *)PKTTAG(skb));
+
+               DHD_INFO(("%s dhd_rx_frame pkt<%p> ifid<%d>\n",
+                       __FUNCTION__, skb, ifid));
+
+               dhd_rx_frame(&dhd->pub, ifid, skb, pkt_count, chan);
+               processed++;
+       }
+
+       DHD_LB_STATS_UPDATE_NAPI_HISTO(&dhd->pub, processed);
+
+       DHD_INFO(("%s processed %d\n", __FUNCTION__, processed));
+
+       if (processed < budget) {
+               napi_complete(napi);
+               DHD_GENERAL_LOCK(&dhd->pub, flags);
+               DHD_BUS_BUSY_CLEAR_IN_NAPI(&dhd->pub);
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+       }
+
+       return processed;
+}
+
+/**
+ * dhd_napi_schedule - Place the napi struct into the current cpus softnet napi
+ * poll list. This function may be invoked via the smp_call_function_single
+ * from a remote CPU.
+ *
+ * This function will essentially invoke __raise_softirq_irqoff(NET_RX_SOFTIRQ)
+ * after the napi_struct is added to the softnet data's poll_list
+ *
+ * @info: pointer to a dhd_info struct
+ */
+static void
+dhd_napi_schedule(void *info)
+{
+       dhd_info_t *dhd = (dhd_info_t *)info;
+       unsigned long flags;
+
+       DHD_INFO(("%s rx_napi_struct<%p> on cpu<%d>\n",
+               __FUNCTION__, &dhd->rx_napi_struct, atomic_read(&dhd->rx_napi_cpu)));
+
+       /*
+        * Set busbusystate in NAPI, which will be cleared after
+        * napi_complete from napi_poll context
+        */
+       DHD_GENERAL_LOCK(&dhd->pub, flags);
+       DHD_BUS_BUSY_SET_IN_NAPI(&dhd->pub);
+       DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+
+       /* add napi_struct to softnet data poll list and raise NET_RX_SOFTIRQ */
+       if (napi_schedule_prep(&dhd->rx_napi_struct)) {
+               __napi_schedule(&dhd->rx_napi_struct);
+#ifdef WAKEUP_KSOFTIRQD_POST_NAPI_SCHEDULE
+               raise_softirq(NET_RX_SOFTIRQ);
+#endif /* WAKEUP_KSOFTIRQD_POST_NAPI_SCHEDULE */
+       }
+
+       /*
+        * If the rx_napi_struct was already running, then we let it complete
+        * processing all its packets. The rx_napi_struct may only run on one
+        * core at a time, to avoid out-of-order handling.
+        */
+}
+
+/**
+ * dhd_napi_schedule_on - API to schedule on a desired CPU core a NET_RX_SOFTIRQ
+ * action after placing the dhd's rx_process napi object in the the remote CPU's
+ * softnet data's poll_list.
+ *
+ * @dhd: dhd_info which has the rx_process napi object
+ * @on_cpu: desired remote CPU id
+ */
+static INLINE int
+dhd_napi_schedule_on(dhd_info_t *dhd, int on_cpu)
+{
+       int wait = 0; /* asynchronous IPI */
+       DHD_INFO(("%s dhd<%p> napi<%p> on_cpu<%d>\n",
+               __FUNCTION__, dhd, &dhd->rx_napi_struct, on_cpu));
+
+       if (smp_call_function_single(on_cpu, dhd_napi_schedule, dhd, wait)) {
+               DHD_ERROR(("%s smp_call_function_single on_cpu<%d> failed\n",
+                       __FUNCTION__, on_cpu));
+       }
+
+       DHD_LB_STATS_INCR(dhd->napi_sched_cnt);
+
+       return 0;
+}
+
+/*
+ * Call get_online_cpus/put_online_cpus around dhd_napi_schedule_on
+ * Why should we do this?
+ * The candidacy algorithm is run from the call back function
+ * registered to CPU hotplug notifier. This call back happens from Worker
+ * context. The dhd_napi_schedule_on is also from worker context.
+ * Note that both of this can run on two different CPUs at the same time.
+ * So we can possibly have a window where a given CPUn is being brought
+ * down from CPUm while we try to run a function on CPUn.
+ * To prevent this its better have the whole code to execute an SMP
+ * function under get_online_cpus.
+ * This function call ensures that hotplug mechanism does not kick-in
+ * until we are done dealing with online CPUs
+ * If the hotplug worker is already running, no worries because the
+ * candidacy algo would then reflect the same in dhd->rx_napi_cpu.
+ *
+ * The below mentioned code structure is proposed in
+ * https://www.kernel.org/doc/Documentation/cpu-hotplug.txt
+ * for the question
+ * Q: I need to ensure that a particular cpu is not removed when there is some
+ *    work specific to this cpu is in progress
+ *
+ * According to the documentation calling get_online_cpus is NOT required, if
+ * we are running from tasklet context. Since dhd_rx_napi_dispatcher_work can
+ * run from Work Queue context we have to call these functions
+ */
+void dhd_rx_napi_dispatcher_work(struct work_struct * work)
+{
+       struct dhd_info *dhd;
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       dhd = container_of(work, struct dhd_info, rx_napi_dispatcher_work);
+       GCC_DIAGNOSTIC_POP();
+
+       dhd_napi_schedule(dhd);
+}
+
+/**
+ * dhd_lb_rx_napi_dispatch - load balance by dispatching the rx_napi_struct
+ * to run on another CPU. The rx_napi_struct's poll function will retrieve all
+ * the packets enqueued into the rx_napi_queue and sendup.
+ * The producer's rx packet queue is appended to the rx_napi_queue before
+ * dispatching the rx_napi_struct.
+ */
+void
+dhd_lb_rx_napi_dispatch(dhd_pub_t *dhdp)
+{
+       unsigned long flags;
+       dhd_info_t *dhd = dhdp->info;
+       int curr_cpu;
+       int rx_napi_cpu;
+       int prev_dpc_cpu;
+
+       if (dhd->rx_napi_netdev == NULL) {
+               DHD_ERROR(("%s: dhd->rx_napi_netdev is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_INFO(("%s append napi_queue<%d> pend_queue<%d>\n", __FUNCTION__,
+               skb_queue_len(&dhd->rx_napi_queue), skb_queue_len(&dhd->rx_pend_queue)));
+
+       /* append the producer's queue of packets to the napi's rx process queue */
+       DHD_RX_NAPI_QUEUE_LOCK(&dhd->rx_napi_queue.lock, flags);
+       skb_queue_splice_tail_init(&dhd->rx_pend_queue, &dhd->rx_napi_queue);
+       DHD_RX_NAPI_QUEUE_UNLOCK(&dhd->rx_napi_queue.lock, flags);
+
+       DHD_LB_STATS_PERCPU_ARR_INCR(dhd->napi_percpu_run_cnt);
+
+       /* If sysfs lb_rxp_active is not set, schedule on current cpu */
+       if (!atomic_read(&dhd->lb_rxp_active))
+       {
+               dhd_napi_schedule(dhd);
+               return;
+       }
+
+       /*
+        * Get cpu will disable pre-ermption and will not allow any cpu to go offline
+        * and call put_cpu() only after scheduling rx_napi_dispatcher_work.
+        */
+       curr_cpu = get_cpu();
+
+       prev_dpc_cpu = atomic_read(&dhd->dpc_cpu);
+       atomic_set(&dhd->dpc_cpu, curr_cpu);
+
+       rx_napi_cpu = atomic_read(&dhd->rx_napi_cpu);
+
+       /*
+        * Now if the DPC has scheduled in the same CPU that is chosen for Rx napi processing
+        * OR scheduled on different cpu than previously it was scheduled,
+        * OR if rx_napi_cpu is offline,
+        * Call cpu candidacy algorithm to recompute napi_cpu.
+        */
+       if ((curr_cpu == rx_napi_cpu) || (curr_cpu != prev_dpc_cpu) || !cpu_online(rx_napi_cpu)) {
+               /* Re compute LB CPUs */
+               dhd_select_cpu_candidacy(dhd);
+               /* Use updated napi cpu */
+               rx_napi_cpu = atomic_read(&dhd->rx_napi_cpu);
+       }
+
+       DHD_INFO(("%s : schedule to curr_cpu : %d, rx_napi_cpu : %d\n",
+               __FUNCTION__, curr_cpu, rx_napi_cpu));
+       dhd_work_schedule_on(&dhd->rx_napi_dispatcher_work, rx_napi_cpu);
+       DHD_LB_STATS_INCR(dhd->napi_sched_cnt);
+
+       put_cpu();
+}
+
+/**
+ * dhd_lb_rx_pkt_enqueue - Enqueue the packet into the producer's queue
+ */
+void
+dhd_lb_rx_pkt_enqueue(dhd_pub_t *dhdp, void *pkt, int ifidx)
+{
+       dhd_info_t *dhd = dhdp->info;
+
+       DHD_INFO(("%s enqueue pkt<%p> ifidx<%d> pend_queue<%d>\n", __FUNCTION__,
+               pkt, ifidx, skb_queue_len(&dhd->rx_pend_queue)));
+       DHD_PKTTAG_SET_IFID((dhd_pkttag_fr_t *)PKTTAG(pkt), ifidx);
+       __skb_queue_tail(&dhd->rx_pend_queue, pkt);
+}
+
+unsigned long
+dhd_read_lb_rxp(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+       return atomic_read(&dhd->lb_rxp_active);
+}
+#endif /* DHD_LB_RXP */
+
+#if defined(DHD_LB_TXP)
+int
+BCMFASTPATH(dhd_lb_sendpkt)(dhd_info_t *dhd, struct net_device *net,
+       int ifidx, void *skb)
+{
+       DHD_LB_STATS_PERCPU_ARR_INCR(dhd->tx_start_percpu_run_cnt);
+
+       /* If the feature is disabled run-time do TX from here */
+       if (atomic_read(&dhd->lb_txp_active) == 0) {
+               DHD_LB_STATS_PERCPU_ARR_INCR(dhd->txp_percpu_run_cnt);
+                return __dhd_sendpkt(&dhd->pub, ifidx, skb);
+       }
+
+       /* Store the address of net device and interface index in the Packet tag */
+       DHD_LB_TX_PKTTAG_SET_NETDEV((dhd_tx_lb_pkttag_fr_t *)PKTTAG(skb), net);
+       DHD_LB_TX_PKTTAG_SET_IFIDX((dhd_tx_lb_pkttag_fr_t *)PKTTAG(skb), ifidx);
+
+       /* Enqueue the skb into tx_pend_queue */
+       skb_queue_tail(&dhd->tx_pend_queue, skb);
+
+       DHD_TRACE(("%s(): Added skb %p for netdev %p \r\n", __FUNCTION__, skb, net));
+
+       /* Dispatch the Tx job to be processed by the tx_tasklet */
+       dhd_lb_tx_dispatch(&dhd->pub);
+
+       return NETDEV_TX_OK;
+}
+#endif /* DHD_LB_TXP */
+
+#ifdef DHD_LB_TXP
+#define DHD_LB_TXBOUND 64
+/*
+ * Function that performs the TX processing on a given CPU
+ */
+bool
+dhd_lb_tx_process(dhd_info_t *dhd)
+{
+       struct sk_buff *skb;
+       int cnt = 0;
+       struct net_device *net;
+       int ifidx;
+       bool resched = FALSE;
+
+       DHD_TRACE(("%s(): TX Processing \r\n", __FUNCTION__));
+       if (dhd == NULL) {
+               DHD_ERROR((" Null pointer DHD \r\n"));
+               return resched;
+       }
+
+       BCM_REFERENCE(net);
+
+       DHD_LB_STATS_PERCPU_ARR_INCR(dhd->txp_percpu_run_cnt);
+
+       /* Base Loop to perform the actual Tx */
+       do {
+               skb = skb_dequeue(&dhd->tx_pend_queue);
+               if (skb == NULL) {
+                       DHD_TRACE(("Dequeued a Null Packet \r\n"));
+                       break;
+               }
+               cnt++;
+
+               net =  DHD_LB_TX_PKTTAG_NETDEV((dhd_tx_lb_pkttag_fr_t *)PKTTAG(skb));
+               ifidx = DHD_LB_TX_PKTTAG_IFIDX((dhd_tx_lb_pkttag_fr_t *)PKTTAG(skb));
+
+               DHD_TRACE(("Processing skb %p for net %p index %d \r\n", skb,
+                       net, ifidx));
+
+               __dhd_sendpkt(&dhd->pub, ifidx, skb);
+
+               if (cnt >= DHD_LB_TXBOUND) {
+                       resched = TRUE;
+                       break;
+               }
+
+       } while (1);
+
+       DHD_INFO(("%s(): Processed %d packets \r\n", __FUNCTION__, cnt));
+
+       return resched;
+}
+
+void
+dhd_lb_tx_handler(unsigned long data)
+{
+       dhd_info_t *dhd = (dhd_info_t *)data;
+
+       if (dhd_lb_tx_process(dhd)) {
+               dhd_tasklet_schedule(&dhd->tx_tasklet);
+       }
+}
+
+#endif /* DHD_LB_TXP */
+#endif /* DHD_LB */
+
+#if defined(DHD_CONTROL_PCIE_CPUCORE_WIFI_TURNON)
+void
+dhd_irq_set_affinity(dhd_pub_t *dhdp, const struct cpumask *cpumask)
+{
+       unsigned int irq = (unsigned int)-1;
+       int err = BCME_OK;
+
+       if (!dhdp) {
+               DHD_ERROR(("%s : dhdp is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (!dhdp->bus) {
+               DHD_ERROR(("%s : bus is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_ERROR(("%s : irq set affinity cpu:0x%lx\n",
+                       __FUNCTION__, *cpumask_bits(cpumask)));
+
+       dhdpcie_get_pcieirq(dhdp->bus, &irq);
+#ifdef BCMDHD_MODULAR
+       err = irq_set_affinity_hint(irq, cpumask);
+#else
+       err = irq_set_affinity(irq, cpumask);
+#endif /* BCMDHD_MODULAR */
+       if (err)
+               DHD_ERROR(("%s : irq set affinity is failed cpu:0x%lx\n",
+                               __FUNCTION__, *cpumask_bits(cpumask)));
+}
+#endif /* DHD_CONTROL_PCIE_CPUCORE_WIFI_TURNON */
diff --git a/bcmdhd.101.10.240.x/dhd_linux_pktdump.c b/bcmdhd.101.10.240.x/dhd_linux_pktdump.c
new file mode 100644 (file)
index 0000000..112a22c
--- /dev/null
@@ -0,0 +1,1491 @@
+/*
+ * Packet dump helper functions
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#include <typedefs.h>
+#include <ethernet.h>
+#include <bcmutils.h>
+#include <bcmevent.h>
+#include <bcmendian.h>
+#include <bcmtlv.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <bcmip.h>
+#include <bcmudp.h>
+#include <bcmdhcp.h>
+#include <bcmarp.h>
+#include <bcmicmp.h>
+#include <dhd_linux_pktdump.h>
+#include <dhd_config.h>
+
+#define DHD_PKTDUMP(arg)       printk arg
+#define DHD_PKTDUMP_MEM(arg)   printk arg
+#define PACKED_STRUCT __attribute__ ((packed))
+
+#define EAPOL_HDR_LEN          4
+
+/* EAPOL types */
+#define EAP_PACKET             0
+#define EAPOL_START            1
+#define EAPOL_LOGOFF           2
+#define EAPOL_KEY              3
+#define EAPOL_ASF              4
+
+/* EAPOL-Key types */
+#define EAPOL_RC4_KEY          1
+#define EAPOL_WPA2_KEY         2       /* 802.11i/WPA2 */
+#define EAPOL_WPA_KEY          254     /* WPA */
+
+/* EAPOL-Key header field size */
+#define AKW_BLOCK_LEN          8
+#define WPA_KEY_REPLAY_LEN     8
+#define WPA_KEY_NONCE_LEN      32
+#define WPA_KEY_IV_LEN         16
+#define WPA_KEY_RSC_LEN                8
+#define WPA_KEY_ID_LEN         8
+#define WPA_KEY_MIC_LEN                16
+#define WPA_MAX_KEY_SIZE       32
+#define WPA_KEY_DATA_LEN       (WPA_MAX_KEY_SIZE + AKW_BLOCK_LEN)
+
+/* Key information bit */
+#define KEYINFO_TYPE_MASK      (1 << 3)
+#define KEYINFO_INSTALL_MASK   (1 << 6)
+#define KEYINFO_KEYACK_MASK    (1 << 7)
+#define KEYINFO_KEYMIC_MASK    (1 << 8)
+#define KEYINFO_SECURE_MASK    (1 << 9)
+#define KEYINFO_ERROR_MASK     (1 << 10)
+#define KEYINFO_REQ_MASK       (1 << 11)
+
+/* EAP Code */
+#define EAP_CODE_REQUEST       1       /* Request */
+#define EAP_CODE_RESPONSE      2       /* Response */
+#define EAP_CODE_SUCCESS       3       /* Success */
+#define EAP_CODE_FAILURE       4       /* Failure */
+
+/* EAP Type */
+#define EAP_TYPE_RSVD          0       /* Reserved */
+#define EAP_TYPE_IDENT         1       /* Identify */
+#define EAP_TYPE_NOTI          2       /* Notification */
+#define EAP_TYPE_TLS           13      /* EAP-TLS */
+#define EAP_TYPE_LEAP          17      /* Cisco-LEAP */
+#define EAP_TYPE_TTLS          21      /* EAP-TTLS */
+#define EAP_TYPE_AKA           23      /* EAP-AKA */
+#define EAP_TYPE_PEAP          25      /* EAP-PEAP */
+#define EAP_TYPE_FAST          43      /* EAP-FAST */
+#define EAP_TYPE_PSK           47      /* EAP-PSK */
+#define EAP_TYPE_AKAP          50      /* EAP-AKA' */
+#define EAP_TYPE_EXP           254     /* Reserved for Expended Type */
+
+/* WSC */
+#define EAP_HDR_LEN            5
+#define EAP_WSC_NONCE_OFFSET   10
+#define EAP_WSC_DATA_OFFSET    (OFFSETOF(eap_wsc_fmt_t, data))
+#define EAP_WSC_MIN_DATA_LEN   ((EAP_HDR_LEN) + (EAP_WSC_DATA_OFFSET))
+#define WFA_VID                        "\x00\x37\x2A"  /* WFA SMI code */
+#define WFA_VID_LEN            3               /* WFA VID length */
+#define WFA_VTYPE              1u              /* WFA Vendor type */
+
+/* WSC opcode */
+#define WSC_OPCODE_UPNP                0
+#define WSC_OPCODE_START       1
+#define WSC_OPCODE_ACK         2
+#define WSC_OPCODE_NACK                3
+#define WSC_OPCODE_MSG         4
+#define WSC_OPCODE_DONE                5
+#define WSC_OPCODE_FRAG_ACK    6
+
+/* WSC flag */
+#define WSC_FLAG_MF            1       /* more fragements */
+#define WSC_FLAG_LF            2       /* length field */
+
+/* WSC message code */
+#define WSC_ATTR_MSG           0x1022
+#define WSC_MSG_M1             0x04
+#define WSC_MSG_M2             0x05
+#define WSC_MSG_M3             0x07
+#define WSC_MSG_M4             0x08
+#define WSC_MSG_M5             0x09
+#define WSC_MSG_M6             0x0A
+#define WSC_MSG_M7             0x0B
+#define WSC_MSG_M8             0x0C
+
+/* Debug prints */
+typedef enum pkt_cnt_type {
+       PKT_CNT_TYPE_INVALID    = 0,
+       PKT_CNT_TYPE_ARP        = 1,
+       PKT_CNT_TYPE_DNS        = 2,
+       PKT_CNT_TYPE_MAX        = 3
+} pkt_cnt_type_t;
+
+typedef struct pkt_cnt {
+       uint32 tx_cnt;
+       uint32 tx_err_cnt;
+       uint32 rx_cnt;
+} pkt_cnt_t;
+
+typedef struct pkt_cnt_log {
+       bool enabled;
+       uint16 reason;
+       timer_list_compat_t pktcnt_timer;
+       pkt_cnt_t arp_cnt;
+       pkt_cnt_t dns_cnt;
+} pkt_cnts_log_t;
+
+#define PKT_CNT_TIMER_INTERNVAL_MS             5000    /* packet count timeout(ms) */
+#define PKT_CNT_RSN_VALID(rsn) \
+       (((rsn) > (PKT_CNT_RSN_INVALID)) && ((rsn) < (PKT_CNT_RSN_MAX)))
+
+#ifdef DHD_PKTDUMP_ROAM
+static const char pkt_cnt_msg[][20] = {
+       "INVALID",
+       "ROAM_SUCCESS",
+       "GROUP_KEY_UPDATE",
+       "CONNECT_SUCCESS",
+       "INVALID"
+};
+#endif
+
+static const char tx_pktfate[][30] = {
+       "TX_PKT_FATE_ACKED",            /* 0: WLFC_CTL_PKTFLAG_DISCARD */
+       "TX_PKT_FATE_FW_QUEUED",        /* 1: WLFC_CTL_PKTFLAG_D11SUPPRESS */
+       "TX_PKT_FATE_FW_QUEUED",        /* 2: WLFC_CTL_PKTFLAG_WLSUPPRESS */
+       "TX_PKT_FATE_FW_DROP_INVALID",  /* 3: WLFC_CTL_PKTFLAG_TOSSED_BYWLC */
+       "TX_PKT_FATE_SENT",             /* 4: WLFC_CTL_PKTFLAG_DISCARD_NOACK */
+       "TX_PKT_FATE_FW_DROP_OTHER",    /* 5: WLFC_CTL_PKTFLAG_SUPPRESS_ACKED */
+       "TX_PKT_FATE_FW_DROP_EXPTIME",  /* 6: WLFC_CTL_PKTFLAG_EXPIRED */
+       "TX_PKT_FATE_FW_DROP_OTHER",    /* 7: WLFC_CTL_PKTFLAG_DROPPED */
+       "TX_PKT_FATE_FW_PKT_FREE",      /* 8: WLFC_CTL_PKTFLAG_MKTFREE */
+};
+
+#define DBGREPLAY              " Replay Counter: %02x%02x%02x%02x%02x%02x%02x%02x"
+#define REPLAY_FMT(key)                ((const eapol_key_hdr_t *)(key))->replay[0], \
+                               ((const eapol_key_hdr_t *)(key))->replay[1], \
+                               ((const eapol_key_hdr_t *)(key))->replay[2], \
+                               ((const eapol_key_hdr_t *)(key))->replay[3], \
+                               ((const eapol_key_hdr_t *)(key))->replay[4], \
+                               ((const eapol_key_hdr_t *)(key))->replay[5], \
+                               ((const eapol_key_hdr_t *)(key))->replay[6], \
+                               ((const eapol_key_hdr_t *)(key))->replay[7]
+#define TXFATE_FMT             " TX_PKTHASH:0x%X TX_PKT_FATE:%s"
+#define TX_PKTHASH(pkthash)            ((pkthash) ? (*pkthash) : (0))
+#define TX_FATE_STR(fate)      (((*fate) <= (WLFC_CTL_PKTFLAG_MKTFREE)) ? \
+                               (tx_pktfate[(*fate)]) : "TX_PKT_FATE_FW_DROP_OTHER")
+#define TX_FATE(fate)          ((fate) ? (TX_FATE_STR(fate)) : "N/A")
+#define TX_FATE_ACKED(fate)    ((fate) ? ((*fate) == (WLFC_CTL_PKTFLAG_DISCARD)) : (0))
+
+#define EAP_PRINT(x, args...) \
+       do { \
+               if (dump_msg_level & DUMP_EAPOL_VAL) { \
+                       if (tx) { \
+                               DHD_PKTDUMP(("[dhd-%s] 802_1X " x " [TX] : (%s) %s (%s)"TXFATE_FMT"\n", \
+                                       ifname, ## args, \
+                                       tx?seabuf:deabuf, tx?"->":"<-", tx?deabuf:seabuf, \
+                                       TX_PKTHASH(pkthash), TX_FATE(pktfate))); \
+                       } else { \
+                               DHD_PKTDUMP(("[dhd-%s] 802_1X " x " [RX] : (%s) %s (%s)\n", \
+                                       ifname, ## args, \
+                                       tx?seabuf:deabuf, tx?"->":"<-", tx?deabuf:seabuf)); \
+                       } \
+               } \
+       } while (0)
+
+#define EAP_PRINT_REPLAY(x, args...) \
+       do { \
+               if (dump_msg_level & DUMP_EAPOL_VAL) { \
+                       if (tx) { \
+                               DHD_PKTDUMP(("[dhd-%s] 802_1X " x " [TX] : (%s) %s (%s)"DBGREPLAY TXFATE_FMT"\n", \
+                                       ifname, ## args, \
+                                       tx?seabuf:deabuf, tx?"->":"<-", tx?deabuf:seabuf, \
+                                       REPLAY_FMT(eap_key), TX_PKTHASH(pkthash), TX_FATE(pktfate))); \
+                       } else { \
+                               DHD_PKTDUMP(("[dhd-%s] 802_1X " x " [RX] : (%s) %s (%s)"DBGREPLAY"\n", \
+                                       ifname, ## args, \
+                                       tx?seabuf:deabuf, tx?"->":"<-", tx?deabuf:seabuf, \
+                                       REPLAY_FMT(eap_key))); \
+                       } \
+               } \
+       } while (0)
+
+#define EAP_PRINT_OTHER(x, args...) \
+       do { \
+               if (dump_msg_level & DUMP_EAPOL_VAL) { \
+                       if (tx) { \
+                               DHD_PKTDUMP(("[dhd-%s] 802_1X " x " [TX] : (%s) %s (%s) " \
+                                       "ver %d, type %d"TXFATE_FMT"\n", \
+                                       ifname, ## args, \
+                                       tx?seabuf:deabuf, tx?"->":"<-", tx?deabuf:seabuf, \
+                                       eapol_hdr->version, eapol_hdr->type, \
+                                       TX_PKTHASH(pkthash), TX_FATE(pktfate))); \
+                       } else { \
+                               DHD_PKTDUMP(("[dhd-%s] 802_1X " x " [RX] : (%s) %s (%s) " \
+                                       "ver %d, type %d\n", \
+                                       ifname, ## args, \
+                                       tx?seabuf:deabuf, tx?"->":"<-", tx?deabuf:seabuf, \
+                                       eapol_hdr->version, eapol_hdr->type)); \
+                       } \
+               } \
+       } while (0)
+
+#define EAP_PRINT_OTHER_4WAY(x, args...) \
+       do { \
+               if (dump_msg_level & DUMP_EAPOL_VAL) { \
+                       if (tx) { \
+                               DHD_PKTDUMP(("[dhd-%s] 802_1X " x " [TX] : (%s) %s (%s) " \
+                                       "ver %d type %d keytype %d keyinfo 0x%02X"TXFATE_FMT"\n", \
+                                       ifname, ## args, \
+                                       tx?seabuf:deabuf, tx?"->":"<-", tx?deabuf:seabuf, \
+                                       eapol_hdr->version, eapol_hdr->type, eap_key->type, \
+                                       (uint32)hton16(eap_key->key_info), \
+                                       TX_PKTHASH(pkthash), TX_FATE(pktfate))); \
+                       } else { \
+                               DHD_PKTDUMP(("[dhd-%s] 802_1X " x " [RX] : (%s) %s (%s) " \
+                                       "ver %d type %d keytype %d keyinfo 0x%02X\n", \
+                                       ifname, ## args, \
+                                       tx?seabuf:deabuf, tx?"->":"<-", tx?deabuf:seabuf, \
+                                       eapol_hdr->version, eapol_hdr->type, eap_key->type, \
+                                       (uint32)hton16(eap_key->key_info))); \
+                       } \
+               } \
+       } while (0)
+
+#define UDP_PORT_DNS   53      /* UDP DNS port */
+
+/* EAPOL header */
+typedef struct eapol_header {
+       struct ether_header eth;        /* 802.3/Ethernet header */
+       uint8 version;                  /* EAPOL protocol version */
+       uint8 type;                     /* EAPOL type */
+       uint16 length;                  /* Length of body */
+       uint8 body[1];                  /* Body (optional) */
+} PACKED_STRUCT eapol_header_t;
+
+/* EAP header */
+typedef struct eap_header_fmt {
+       uint8 code;
+       uint8 id;
+       uint16 len;
+       uint8 type;
+       uint8 data[1];
+} PACKED_STRUCT eap_header_fmt_t;
+
+/* WSC EAP format */
+typedef struct eap_wsc_fmt {
+       uint8 oui[3];
+       uint32 ouitype;
+       uint8 opcode;
+       uint8 flags;
+       uint8 data[1];
+} PACKED_STRUCT eap_wsc_fmt_t;
+
+/* EAPOL-Key */
+typedef struct eapol_key_hdr {
+       uint8 type;                             /* Key Descriptor Type */
+       uint16 key_info;                        /* Key Information (unaligned) */
+       uint16 key_len;                         /* Key Length (unaligned) */
+       uint8 replay[WPA_KEY_REPLAY_LEN];       /* Replay Counter */
+       uint8 nonce[WPA_KEY_NONCE_LEN];         /* Nonce */
+       uint8 iv[WPA_KEY_IV_LEN];               /* Key IV */
+       uint8 rsc[WPA_KEY_RSC_LEN];             /* Key RSC */
+       uint8 id[WPA_KEY_ID_LEN];               /* WPA:Key ID, 802.11i/WPA2: Reserved */
+       uint8 mic[WPA_KEY_MIC_LEN];             /* Key MIC */
+       uint16 data_len;                        /* Key Data Length */
+       uint8 data[WPA_KEY_DATA_LEN];           /* Key data */
+} PACKED_STRUCT eapol_key_hdr_t;
+
+typedef struct hdr_fmt {
+       struct ipv4_hdr iph;
+       struct bcmudp_hdr udph;
+} PACKED_STRUCT hdr_fmt_t;
+
+msg_eapol_t
+dhd_is_4way_msg(uint8 *pktdata)
+{
+       eapol_header_t *eapol_hdr;
+       eapol_key_hdr_t *eap_key;
+       msg_eapol_t type = EAPOL_OTHER;
+       bool pair, ack, mic, kerr, req, sec, install;
+       uint16 key_info;
+
+       if (!pktdata) {
+               DHD_PKTDUMP(("%s: pktdata is NULL\n", __FUNCTION__));
+               return type;
+       }
+
+       eapol_hdr = (eapol_header_t *)pktdata;
+       eap_key = (eapol_key_hdr_t *)(eapol_hdr->body);
+       if (eap_key->type != EAPOL_WPA2_KEY) {
+               return type;
+       }
+
+       key_info = hton16(eap_key->key_info);
+       pair = !!(key_info & KEYINFO_TYPE_MASK);
+       ack = !!(key_info & KEYINFO_KEYACK_MASK);
+       mic = !!(key_info & KEYINFO_KEYMIC_MASK);
+       kerr = !!(key_info & KEYINFO_ERROR_MASK);
+       req = !!(key_info & KEYINFO_REQ_MASK);
+       sec = !!(key_info & KEYINFO_SECURE_MASK);
+       install = !!(key_info & KEYINFO_INSTALL_MASK);
+
+       if (pair && !install && ack && !mic && !sec && !kerr && !req) {
+               type = EAPOL_4WAY_M1;
+       } else if (pair && !install && !ack && mic && !sec && !kerr && !req) {
+               type = EAPOL_4WAY_M2;
+       } else if (pair && ack && mic && sec && !kerr && !req) {
+               type = EAPOL_4WAY_M3;
+       } else if (pair && !install && !ack && mic && sec && !req && !kerr) {
+               type = EAPOL_4WAY_M4;
+       } else if (!pair && !install && ack && mic && sec && !req && !kerr) {
+               type = EAPOL_GROUPKEY_M1;
+       } else if (!pair && !install && !ack && mic && sec && !req && !kerr) {
+               type = EAPOL_GROUPKEY_M2;
+       } else {
+               type = EAPOL_OTHER;
+       }
+
+       return type;
+}
+
+void
+dhd_dump_pkt(dhd_pub_t *dhdp, int ifidx, uint8 *pktdata, uint32 pktlen,
+       bool tx, uint32 *pkthash, uint16 *pktfate)
+{
+       struct ether_header *eh;
+       uint16 ether_type;
+
+       if (!pktdata || pktlen < ETHER_HDR_LEN) {
+               return;
+       }
+
+#if defined(BCMPCIE) && defined(DHD_PKT_LOGGING)
+       if (tx && !pkthash && !pktfate) {
+               return;
+       }
+#endif /* BCMPCIE && DHD_PKT_LOGGING */
+
+       eh = (struct ether_header *)pktdata;
+       ether_type = ntoh16(eh->ether_type);
+       if (ether_type == ETHER_TYPE_802_1X) {
+               dhd_dump_eapol_message(dhdp, ifidx, pktdata, pktlen,
+                       tx, pkthash, pktfate);
+       }
+       if (ether_type == ETHER_TYPE_IP) {
+               if (dhd_check_dhcp(pktdata)) {
+                       dhd_dhcp_dump(dhdp, ifidx, pktdata, tx, pkthash, pktfate);
+               } else if (dhd_check_icmp(pktdata)) {
+                       dhd_icmp_dump(dhdp, ifidx, pktdata, tx, pkthash, pktfate);
+               } else if (dhd_check_dns(pktdata)) {
+                       dhd_dns_dump(dhdp, ifidx, pktdata, tx, pkthash, pktfate);
+               }
+       }
+       if (ether_type == ETHER_TYPE_ARP) {
+               if (dhd_check_arp(pktdata)) {
+                       dhd_arp_dump(dhdp, ifidx, pktdata, tx, pkthash, pktfate);
+               }
+       }
+       dhd_trx_pkt_dump(dhdp, ifidx, pktdata, pktlen, tx);
+}
+
+#ifdef DHD_PKTDUMP_ROAM
+static void
+dhd_dump_pkt_cnts_inc(dhd_pub_t *dhdp, bool tx, uint16 *pktfate, uint16 pkttype)
+{
+       pkt_cnts_log_t *pktcnts;
+       pkt_cnt_t *cnt;
+
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       pktcnts = (pkt_cnts_log_t *)(dhdp->pktcnts);
+       if (!pktcnts) {
+               DHD_ERROR(("%s: pktcnts is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (!pktcnts->enabled || (tx && !pktfate)) {
+               return;
+       }
+
+       if (pkttype == PKT_CNT_TYPE_ARP) {
+               cnt = (pkt_cnt_t *)&pktcnts->arp_cnt;
+       } else if (pkttype == PKT_CNT_TYPE_DNS) {
+               cnt = (pkt_cnt_t *)&pktcnts->dns_cnt;
+       } else {
+               /* invalid packet type */
+               return;
+       }
+
+       if (tx) {
+               TX_FATE_ACKED(pktfate) ? cnt->tx_cnt++ : cnt->tx_err_cnt++;
+       } else {
+               cnt->rx_cnt++;
+       }
+}
+
+static void
+dhd_dump_pkt_timer(unsigned long data)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)data;
+       pkt_cnts_log_t *pktcnts = (pkt_cnts_log_t *)(dhdp->pktcnts);
+
+       pktcnts->enabled = FALSE;
+
+       /* print out the packet counter value */
+       DHD_PKTDUMP(("============= PACKET COUNT SUMMARY ============\n"));
+       DHD_PKTDUMP(("- Reason: %s\n", pkt_cnt_msg[pktcnts->reason]));
+       DHD_PKTDUMP(("- Duration: %d msec(s)\n", PKT_CNT_TIMER_INTERNVAL_MS));
+       DHD_PKTDUMP(("- ARP PACKETS: tx_success:%d tx_fail:%d rx_cnt:%d\n",
+               pktcnts->arp_cnt.tx_cnt, pktcnts->arp_cnt.tx_err_cnt,
+               pktcnts->arp_cnt.rx_cnt));
+       DHD_PKTDUMP(("- DNS PACKETS: tx_success:%d tx_fail:%d rx_cnt:%d\n",
+               pktcnts->dns_cnt.tx_cnt, pktcnts->dns_cnt.tx_err_cnt,
+               pktcnts->dns_cnt.rx_cnt));
+       DHD_PKTDUMP(("============= END OF COUNT SUMMARY ============\n"));
+}
+
+void
+dhd_dump_mod_pkt_timer(dhd_pub_t *dhdp, uint16 rsn)
+{
+       pkt_cnts_log_t *pktcnts;
+
+       if (!dhdp || !dhdp->pktcnts) {
+               DHD_ERROR(("%s: dhdp or dhdp->pktcnts is NULL\n",
+                       __FUNCTION__));
+               return;
+       }
+
+       if (!PKT_CNT_RSN_VALID(rsn)) {
+               DHD_ERROR(("%s: invalid reason code %d\n",
+                       __FUNCTION__, rsn));
+               return;
+       }
+
+       pktcnts = (pkt_cnts_log_t *)(dhdp->pktcnts);
+       if (timer_pending(&pktcnts->pktcnt_timer)) {
+               del_timer_sync(&pktcnts->pktcnt_timer);
+       }
+
+       bzero(&pktcnts->arp_cnt, sizeof(pkt_cnt_t));
+       bzero(&pktcnts->dns_cnt, sizeof(pkt_cnt_t));
+       pktcnts->reason = rsn;
+       pktcnts->enabled = TRUE;
+       mod_timer(&pktcnts->pktcnt_timer,
+               jiffies + msecs_to_jiffies(PKT_CNT_TIMER_INTERNVAL_MS));
+       DHD_PKTDUMP(("%s: Arm the pktcnt timer. reason=%d\n",
+               __FUNCTION__, rsn));
+}
+
+void
+dhd_dump_pkt_init(dhd_pub_t *dhdp)
+{
+       pkt_cnts_log_t *pktcnts;
+
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       pktcnts = (pkt_cnts_log_t *)MALLOCZ(dhdp->osh, sizeof(pkt_cnts_log_t));
+       if (!pktcnts) {
+               DHD_ERROR(("%s: failed to allocate memory for pktcnts\n",
+                       __FUNCTION__));
+               return;
+       }
+
+       /* init timers */
+       init_timer_compat(&pktcnts->pktcnt_timer, dhd_dump_pkt_timer, dhdp);
+       dhdp->pktcnts = pktcnts;
+}
+
+void
+dhd_dump_pkt_deinit(dhd_pub_t *dhdp)
+{
+       pkt_cnts_log_t *pktcnts;
+
+       if (!dhdp || !dhdp->pktcnts) {
+               DHD_ERROR(("%s: dhdp or pktcnts is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       pktcnts = (pkt_cnts_log_t *)(dhdp->pktcnts);
+       pktcnts->enabled = FALSE;
+       del_timer_sync(&pktcnts->pktcnt_timer);
+       MFREE(dhdp->osh, dhdp->pktcnts, sizeof(pkt_cnts_log_t));
+       dhdp->pktcnts = NULL;
+}
+
+void
+dhd_dump_pkt_clear(dhd_pub_t *dhdp)
+{
+       pkt_cnts_log_t *pktcnts;
+
+       if (!dhdp || !dhdp->pktcnts) {
+               DHD_ERROR(("%s: dhdp or pktcnts is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       pktcnts = (pkt_cnts_log_t *)(dhdp->pktcnts);
+       pktcnts->enabled = FALSE;
+       del_timer_sync(&pktcnts->pktcnt_timer);
+       pktcnts->reason = 0;
+       bzero(&pktcnts->arp_cnt, sizeof(pkt_cnt_t));
+       bzero(&pktcnts->dns_cnt, sizeof(pkt_cnt_t));
+}
+
+bool
+dhd_dump_pkt_enabled(dhd_pub_t *dhdp)
+{
+       pkt_cnts_log_t *pktcnts;
+
+       if (!dhdp || !dhdp->pktcnts) {
+               return FALSE;
+       }
+
+       pktcnts = (pkt_cnts_log_t *)(dhdp->pktcnts);
+
+       return pktcnts->enabled;
+}
+#else
+static INLINE void
+dhd_dump_pkt_cnts_inc(dhd_pub_t *dhdp, bool tx, uint16 *pktfate, uint16 pkttype) { }
+static INLINE bool
+dhd_dump_pkt_enabled(dhd_pub_t *dhdp) { return FALSE; }
+#endif /* DHD_PKTDUMP_ROAM */
+
+#ifdef DHD_8021X_DUMP
+static void
+dhd_dump_wsc_message(dhd_pub_t *dhd, int ifidx, uint8 *pktdata,
+       uint32 pktlen, bool tx, uint32 *pkthash, uint16 *pktfate)
+{
+       eapol_header_t *eapol_hdr;
+       eap_header_fmt_t *eap_hdr;
+       eap_wsc_fmt_t *eap_wsc;
+       char *ifname;
+       uint16 eap_len;
+       bool cond;
+       char seabuf[ETHER_ADDR_STR_LEN]="";
+       char deabuf[ETHER_ADDR_STR_LEN]="";
+
+       if (!pktdata) {
+               DHD_ERROR(("%s: pktdata is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (pktlen < (ETHER_HDR_LEN + EAPOL_HDR_LEN)) {
+               DHD_ERROR(("%s: invalid pkt length\n", __FUNCTION__));
+               return;
+       }
+
+       bcm_ether_ntoa((struct ether_addr *)pktdata, deabuf);
+       bcm_ether_ntoa((struct ether_addr *)(pktdata+6), seabuf);
+
+       eapol_hdr = (eapol_header_t *)pktdata;
+       eap_hdr = (eap_header_fmt_t *)(eapol_hdr->body);
+       if (eap_hdr->type != EAP_TYPE_EXP) {
+               return;
+       }
+
+       eap_len = ntoh16(eap_hdr->len);
+       if (eap_len < EAP_WSC_MIN_DATA_LEN) {
+               return;
+       }
+
+       eap_wsc = (eap_wsc_fmt_t *)(eap_hdr->data);
+       if (bcmp(eap_wsc->oui, (const uint8 *)WFA_VID, WFA_VID_LEN) ||
+               (ntoh32(eap_wsc->ouitype) != WFA_VTYPE)) {
+               return;
+       }
+
+       if (eap_wsc->flags) {
+               return;
+       }
+
+       ifname = dhd_ifname(dhd, ifidx);
+       cond = (tx && pktfate) ? FALSE : TRUE;
+
+       if (eap_wsc->opcode == WSC_OPCODE_MSG) {
+               const uint8 *tlv_buf = (const uint8 *)(eap_wsc->data);
+               const uint8 *msg;
+               uint16 msglen;
+               uint16 wsc_data_len = (uint16)(eap_len - EAP_HDR_LEN - EAP_WSC_DATA_OFFSET);
+               bcm_xtlv_opts_t opt = BCM_XTLV_OPTION_IDBE | BCM_XTLV_OPTION_LENBE;
+
+               msg = bcm_get_data_from_xtlv_buf(tlv_buf, wsc_data_len,
+                       WSC_ATTR_MSG, &msglen, opt);
+               if (msg && msglen) {
+                       switch (*msg) {
+                       case WSC_MSG_M1:
+                               dhd->conf->eapol_status = EAPOL_STATUS_WPS_M1;
+                               DHD_STATLOG_DATA(dhd, ST(WPS_M1), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, WPS M1");
+                               break;
+                       case WSC_MSG_M2:
+                               dhd->conf->eapol_status = EAPOL_STATUS_WPS_M2;
+                               DHD_STATLOG_DATA(dhd, ST(WPS_M2), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, WPS M2");
+                               break;
+                       case WSC_MSG_M3:
+                               dhd->conf->eapol_status = EAPOL_STATUS_WPS_M3;
+                               DHD_STATLOG_DATA(dhd, ST(WPS_M3), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, WPS M3");
+                               break;
+                       case WSC_MSG_M4:
+                               dhd->conf->eapol_status = EAPOL_STATUS_WPS_M4;
+                               DHD_STATLOG_DATA(dhd, ST(WPS_M4), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, WPS M4");
+                               break;
+                       case WSC_MSG_M5:
+                               dhd->conf->eapol_status = EAPOL_STATUS_WPS_M5;
+                               DHD_STATLOG_DATA(dhd, ST(WPS_M5), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, WPS M5");
+                               break;
+                       case WSC_MSG_M6:
+                               dhd->conf->eapol_status = EAPOL_STATUS_WPS_M6;
+                               DHD_STATLOG_DATA(dhd, ST(WPS_M6), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, WPS M6");
+                               break;
+                       case WSC_MSG_M7:
+                               dhd->conf->eapol_status = EAPOL_STATUS_WPS_M7;
+                               DHD_STATLOG_DATA(dhd, ST(WPS_M7), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, WPS M7");
+                               break;
+                       case WSC_MSG_M8:
+                               dhd->conf->eapol_status = EAPOL_STATUS_WPS_M8;
+                               DHD_STATLOG_DATA(dhd, ST(WPS_M8), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, WPS M8");
+                               break;
+                       default:
+                               break;
+                       }
+               }
+       } else if (eap_wsc->opcode == WSC_OPCODE_START) {
+               dhd->conf->eapol_status = EAPOL_STATUS_WSC_START;
+               DHD_STATLOG_DATA(dhd, ST(WSC_START), ifidx, tx, cond);
+               EAP_PRINT("EAP Packet, WSC Start");
+       } else if (eap_wsc->opcode == WSC_OPCODE_DONE) {
+               dhd->conf->eapol_status = EAPOL_STATUS_WSC_DONE;
+               DHD_STATLOG_DATA(dhd, ST(WSC_DONE), ifidx, tx, cond);
+               EAP_PRINT("EAP Packet, WSC Done");
+       }
+}
+
+static void
+dhd_dump_eap_packet(dhd_pub_t *dhd, int ifidx, uint8 *pktdata,
+       uint32 pktlen, bool tx, uint32 *pkthash, uint16 *pktfate)
+{
+       eapol_header_t *eapol_hdr;
+       eap_header_fmt_t *eap_hdr;
+       char *ifname;
+       bool cond;
+       char seabuf[ETHER_ADDR_STR_LEN]="";
+       char deabuf[ETHER_ADDR_STR_LEN]="";
+
+       if (!pktdata) {
+               DHD_PKTDUMP(("%s: pktdata is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       bcm_ether_ntoa((struct ether_addr *)pktdata, deabuf);
+       bcm_ether_ntoa((struct ether_addr *)(pktdata+6), seabuf);
+
+       eapol_hdr = (eapol_header_t *)pktdata;
+       eap_hdr = (eap_header_fmt_t *)(eapol_hdr->body);
+       ifname = dhd_ifname(dhd, ifidx);
+       cond = (tx && pktfate) ? FALSE : TRUE;
+
+       if (eap_hdr->code == EAP_CODE_REQUEST ||
+               eap_hdr->code == EAP_CODE_RESPONSE) {
+               bool isreq = (eap_hdr->code == EAP_CODE_REQUEST);
+               switch (eap_hdr->type) {
+               case EAP_TYPE_IDENT:
+                       if (isreq) {
+                               dhd->conf->eapol_status = EAPOL_STATUS_REQID;
+                               DHD_STATLOG_DATA(dhd, ST(EAP_REQ_IDENTITY), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Request, Identity");
+                       } else {
+                               dhd->conf->eapol_status = EAPOL_STATUS_RSPID;
+                               DHD_STATLOG_DATA(dhd, ST(EAP_RESP_IDENTITY), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Response, Identity");
+                       }
+                       break;
+               case EAP_TYPE_TLS:
+                       if (isreq) {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_REQ_TLS), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Request, TLS");
+                       } else {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_RESP_TLS), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Response, TLS");
+                       }
+                       break;
+               case EAP_TYPE_LEAP:
+                       if (isreq) {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_REQ_LEAP), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Request, LEAP");
+                       } else {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_RESP_LEAP), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Response, LEAP");
+                       }
+                       break;
+               case EAP_TYPE_TTLS:
+                       if (isreq) {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_REQ_TTLS), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Request, TTLS");
+                       } else {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_RESP_TTLS), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Response, TTLS");
+                       }
+                       break;
+               case EAP_TYPE_AKA:
+                       if (isreq) {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_REQ_AKA), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Request, AKA");
+                       } else {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_RESP_AKA), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Response, AKA");
+                       }
+                       break;
+               case EAP_TYPE_PEAP:
+                       if (isreq) {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_REQ_PEAP), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Request, PEAP");
+                       } else {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_RESP_PEAP), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Response, PEAP");
+                       }
+                       break;
+               case EAP_TYPE_FAST:
+                       if (isreq) {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_REQ_FAST), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Request, FAST");
+                       } else {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_RESP_FAST), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Response, FAST");
+                       }
+                       break;
+               case EAP_TYPE_PSK:
+                       if (isreq) {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_REQ_PSK), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Request, PSK");
+                       } else {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_RESP_PSK), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Response, PSK");
+                       }
+                       break;
+               case EAP_TYPE_AKAP:
+                       if (isreq) {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_REQ_AKAP), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Request, AKAP");
+                       } else {
+                               DHD_STATLOG_DATA(dhd, ST(EAP_RESP_AKAP), ifidx, tx, cond);
+                               EAP_PRINT("EAP Packet, Response, AKAP");
+                       }
+                       break;
+               case EAP_TYPE_EXP:
+                       dhd_dump_wsc_message(dhd, ifidx, pktdata, pktlen, tx,
+                               pkthash, pktfate);
+                       break;
+               default:
+                       break;
+               }
+       } else if (eap_hdr->code == EAP_CODE_SUCCESS) {
+               DHD_STATLOG_DATA(dhd, ST(EAP_SUCCESS), ifidx, tx, cond);
+               EAP_PRINT("EAP Packet, Success");
+       } else if (eap_hdr->code == EAP_CODE_FAILURE) {
+               DHD_STATLOG_DATA(dhd, ST(EAP_FAILURE), ifidx, tx, cond);
+               EAP_PRINT("EAP Packet, Failure");
+       }
+}
+
+static void
+dhd_dump_eapol_4way_message(dhd_pub_t *dhd, int ifidx, uint8 *pktdata, bool tx,
+       uint32 *pkthash, uint16 *pktfate)
+{
+       eapol_header_t *eapol_hdr;
+       eapol_key_hdr_t *eap_key;
+       msg_eapol_t type;
+       char *ifname;
+       bool cond;
+       char seabuf[ETHER_ADDR_STR_LEN]="";
+       char deabuf[ETHER_ADDR_STR_LEN]="";
+
+       if (!pktdata) {
+               DHD_PKTDUMP(("%s: pktdata is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       bcm_ether_ntoa((struct ether_addr *)pktdata, deabuf);
+       bcm_ether_ntoa((struct ether_addr *)(pktdata+6), seabuf);
+
+       type = dhd_is_4way_msg(pktdata);
+       ifname = dhd_ifname(dhd, ifidx);
+       eapol_hdr = (eapol_header_t *)pktdata;
+       eap_key = (eapol_key_hdr_t *)(eapol_hdr->body);
+       cond = (tx && pktfate) ? FALSE : TRUE;
+
+       if (eap_key->type != EAPOL_WPA2_KEY) {
+               EAP_PRINT_OTHER("NON EAPOL_WPA2_KEY");
+               return;
+       }
+
+       switch (type) {
+       case EAPOL_4WAY_M1:
+               dhd->conf->eapol_status = EAPOL_STATUS_4WAY_M1;
+               DHD_STATLOG_DATA(dhd, ST(EAPOL_M1), ifidx, tx, cond);
+               EAP_PRINT("EAPOL Packet, 4-way handshake, M1");
+               break;
+       case EAPOL_4WAY_M2:
+               dhd->conf->eapol_status = EAPOL_STATUS_4WAY_M2;
+               DHD_STATLOG_DATA(dhd, ST(EAPOL_M2), ifidx, tx, cond);
+               EAP_PRINT("EAPOL Packet, 4-way handshake, M2");
+               break;
+       case EAPOL_4WAY_M3:
+               dhd->conf->eapol_status = EAPOL_STATUS_4WAY_M3;
+               DHD_STATLOG_DATA(dhd, ST(EAPOL_M3), ifidx, tx, cond);
+               EAP_PRINT("EAPOL Packet, 4-way handshake, M3");
+               break;
+       case EAPOL_4WAY_M4:
+               dhd->conf->eapol_status = EAPOL_STATUS_4WAY_M4;
+               DHD_STATLOG_DATA(dhd, ST(EAPOL_M4), ifidx, tx, cond);
+               EAP_PRINT("EAPOL Packet, 4-way handshake, M4");
+               break;
+       case EAPOL_GROUPKEY_M1:
+               DHD_STATLOG_DATA(dhd, ST(EAPOL_GROUPKEY_M1), ifidx, tx, cond);
+               EAP_PRINT_REPLAY("EAPOL Packet, GROUP Key handshake, M1");
+               break;
+       case EAPOL_GROUPKEY_M2:
+               DHD_STATLOG_DATA(dhd, ST(EAPOL_GROUPKEY_M2), ifidx, tx, cond);
+               EAP_PRINT_REPLAY("EAPOL Packet, GROUP Key handshake, M2");
+               if (ifidx == 0 && tx && pktfate) {
+                       dhd_dump_mod_pkt_timer(dhd, PKT_CNT_RSN_GRPKEY_UP);
+               }
+               break;
+       default:
+               DHD_STATLOG_DATA(dhd, ST(8021X_OTHER), ifidx, tx, cond);
+               EAP_PRINT_OTHER("OTHER 4WAY");
+               break;
+       }
+}
+
+void
+dhd_dump_eapol_message(dhd_pub_t *dhd, int ifidx, uint8 *pktdata,
+       uint32 pktlen, bool tx, uint32 *pkthash, uint16 *pktfate)
+{
+       char *ifname;
+       eapol_header_t *eapol_hdr = (eapol_header_t *)pktdata;
+       bool cond;
+       char seabuf[ETHER_ADDR_STR_LEN]="";
+       char deabuf[ETHER_ADDR_STR_LEN]="";
+
+       if (!pktdata) {
+               DHD_ERROR(("%s: pktdata is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       bcm_ether_ntoa((struct ether_addr *)pktdata, deabuf);
+       bcm_ether_ntoa((struct ether_addr *)(pktdata+6), seabuf);
+
+       eapol_hdr = (eapol_header_t *)pktdata;
+       ifname = dhd_ifname(dhd, ifidx);
+       cond = (tx && pktfate) ? FALSE : TRUE;
+
+       if (eapol_hdr->type == EAP_PACKET) {
+               dhd_dump_eap_packet(dhd, ifidx, pktdata, pktlen, tx,
+                       pkthash, pktfate);
+       } else if (eapol_hdr->type == EAPOL_START) {
+               DHD_STATLOG_DATA(dhd, ST(EAPOL_START), ifidx, tx, cond);
+               EAP_PRINT("EAP Packet, EAPOL-Start");
+       } else if (eapol_hdr->type == EAPOL_KEY) {
+               dhd_dump_eapol_4way_message(dhd, ifidx, pktdata, tx,
+                       pkthash, pktfate);
+       } else {
+               DHD_STATLOG_DATA(dhd, ST(8021X_OTHER), ifidx, tx, cond);
+               EAP_PRINT_OTHER("OTHER 8021X");
+       }
+}
+#endif /* DHD_8021X_DUMP */
+
+bool
+dhd_check_dhcp(uint8 *pktdata)
+{
+       hdr_fmt_t *b = (hdr_fmt_t *)&pktdata[ETHER_HDR_LEN];
+       struct ipv4_hdr *iph = &b->iph;
+
+       /* check IP header */
+       if ((IPV4_HLEN(iph) < IPV4_HLEN_MIN) ||
+               IP_VER(iph) != IP_VER_4 ||
+               IPV4_PROT(iph) != IP_PROT_UDP) {
+               return FALSE;
+       }
+
+       /* check UDP port for bootp (67, 68) */
+       if (b->udph.src_port != htons(DHCP_PORT_SERVER) &&
+               b->udph.src_port != htons(DHCP_PORT_CLIENT) &&
+               b->udph.dst_port != htons(DHCP_PORT_SERVER) &&
+               b->udph.dst_port != htons(DHCP_PORT_CLIENT)) {
+               return FALSE;
+       }
+
+       /* check header length */
+       if (ntohs(iph->tot_len) < ntohs(b->udph.len) + sizeof(struct bcmudp_hdr)) {
+               return FALSE;
+       }
+       return TRUE;
+}
+
+#ifdef DHD_DHCP_DUMP
+#define BOOTP_CHADDR_LEN               16
+#define BOOTP_SNAME_LEN                        64
+#define BOOTP_FILE_LEN                 128
+#define BOOTP_MIN_DHCP_OPT_LEN         312
+#define BOOTP_MAGIC_COOKIE_LEN         4
+
+#define DHCP_MSGTYPE_DISCOVER          1
+#define DHCP_MSGTYPE_OFFER             2
+#define DHCP_MSGTYPE_REQUEST           3
+#define DHCP_MSGTYPE_DECLINE           4
+#define DHCP_MSGTYPE_ACK               5
+#define DHCP_MSGTYPE_NAK               6
+#define DHCP_MSGTYPE_RELEASE           7
+#define DHCP_MSGTYPE_INFORM            8
+
+#define DHCP_PRINT(str) \
+       do { \
+               if (tx) { \
+                       DHD_PKTDUMP(("[dhd-%s] " str " %8s[%8s] [TX] : %s(%s) %s %s(%s)"TXFATE_FMT"\n", \
+                               ifname, typestr, opstr, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                               tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf, \
+                               TX_PKTHASH(pkthash), TX_FATE(pktfate))); \
+               } else { \
+                       DHD_PKTDUMP(("[dhd-%s] " str " %8s[%8s] [RX] : %s(%s) %s %s(%s)\n", \
+                               ifname, typestr, opstr, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                               tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf)); \
+               } \
+       } while (0)
+
+typedef struct bootp_fmt {
+       struct ipv4_hdr iph;
+       struct bcmudp_hdr udph;
+       uint8 op;
+       uint8 htype;
+       uint8 hlen;
+       uint8 hops;
+       uint32 transaction_id;
+       uint16 secs;
+       uint16 flags;
+       uint32 client_ip;
+       uint32 assigned_ip;
+       uint32 server_ip;
+       uint32 relay_ip;
+       uint8 hw_address[BOOTP_CHADDR_LEN];
+       uint8 server_name[BOOTP_SNAME_LEN];
+       uint8 file_name[BOOTP_FILE_LEN];
+       uint8 options[BOOTP_MIN_DHCP_OPT_LEN];
+} PACKED_STRUCT bootp_fmt_t;
+
+static const uint8 bootp_magic_cookie[4] = { 99, 130, 83, 99 };
+static char dhcp_ops[][10] = {
+       "NA", "REQUEST", "REPLY"
+};
+static char dhcp_types[][10] = {
+       "NA", "DISCOVER", "OFFER", "REQUEST", "DECLINE", "ACK", "NAK", "RELEASE", "INFORM"
+};
+
+#ifdef DHD_STATUS_LOGGING
+static const int dhcp_types_stat[9] = {
+       ST(INVALID), ST(DHCP_DISCOVER), ST(DHCP_OFFER), ST(DHCP_REQUEST),
+       ST(DHCP_DECLINE), ST(DHCP_ACK), ST(DHCP_NAK), ST(DHCP_RELEASE),
+       ST(DHCP_INFORM)
+};
+#endif /* DHD_STATUS_LOGGING */
+
+void
+dhd_dhcp_dump(dhd_pub_t *dhdp, int ifidx, uint8 *pktdata, bool tx,
+       uint32 *pkthash, uint16 *pktfate)
+{
+       bootp_fmt_t *b = (bootp_fmt_t *)&pktdata[ETHER_HDR_LEN];
+       struct ipv4_hdr *iph = &b->iph;
+       uint8 *ptr, *opt, *end = (uint8 *) b + ntohs(b->iph.tot_len);
+       int dhcp_type = 0, len, opt_len;
+       char *ifname = NULL, *typestr = NULL, *opstr = NULL;
+       bool cond;
+       char sabuf[20]="", dabuf[20]="";
+       char seabuf[ETHER_ADDR_STR_LEN]="";
+       char deabuf[ETHER_ADDR_STR_LEN]="";
+
+       if (!(dump_msg_level & DUMP_DHCP_VAL))
+               return;
+       bcm_ip_ntoa((struct ipv4_addr *)iph->src_ip, sabuf);
+       bcm_ip_ntoa((struct ipv4_addr *)iph->dst_ip, dabuf);
+       bcm_ether_ntoa((struct ether_addr *)pktdata, deabuf);
+       bcm_ether_ntoa((struct ether_addr *)(pktdata+6), seabuf);
+
+       ifname = dhd_ifname(dhdp, ifidx);
+       cond = (tx && pktfate) ? FALSE : TRUE;
+       len = ntohs(b->udph.len) - sizeof(struct bcmudp_hdr);
+       opt_len = len - (sizeof(*b) - sizeof(struct ipv4_hdr) -
+               sizeof(struct bcmudp_hdr) - sizeof(b->options));
+
+       /* parse bootp options */
+       if (opt_len >= BOOTP_MAGIC_COOKIE_LEN &&
+               !memcmp(b->options, bootp_magic_cookie, BOOTP_MAGIC_COOKIE_LEN)) {
+               ptr = &b->options[BOOTP_MAGIC_COOKIE_LEN];
+               while (ptr < end && *ptr != 0xff) {
+                       opt = ptr++;
+                       if (*opt == 0) {
+                               continue;
+                       }
+                       ptr += *ptr + 1;
+                       if (ptr >= end) {
+                               break;
+                       }
+                       if (*opt == DHCP_OPT_MSGTYPE) {
+                               if (opt[1]) {
+                                       dhcp_type = opt[2];
+                                       typestr = dhcp_types[dhcp_type];
+                                       opstr = dhcp_ops[b->op];
+                                       DHD_STATLOG_DATA(dhdp, dhcp_types_stat[dhcp_type],
+                                               ifidx, tx, cond);
+                                       DHCP_PRINT("DHCP");
+                                       break;
+                               }
+                       }
+               }
+       }
+}
+#endif /* DHD_DHCP_DUMP */
+
+bool
+dhd_check_icmp(uint8 *pktdata)
+{
+       uint8 *pkt = (uint8 *)&pktdata[ETHER_HDR_LEN];
+       struct ipv4_hdr *iph = (struct ipv4_hdr *)pkt;
+
+       /* check IP header */
+       if ((IPV4_HLEN(iph) < IPV4_HLEN_MIN) ||
+               IP_VER(iph) != IP_VER_4 ||
+               IPV4_PROT(iph) != IP_PROT_ICMP) {
+               return FALSE;
+       }
+
+       /* check header length */
+       if (ntohs(iph->tot_len) - IPV4_HLEN(iph) < sizeof(struct bcmicmp_hdr)) {
+               return FALSE;
+       }
+       return TRUE;
+}
+
+#ifdef DHD_ICMP_DUMP
+#define ICMP_TYPE_DEST_UNREACH         3
+#define ICMP_ECHO_SEQ_OFFSET           6
+#define ICMP_ECHO_SEQ(h) (*(uint16 *)((uint8 *)(h) + (ICMP_ECHO_SEQ_OFFSET)))
+#define ICMP_PING_PRINT(str) \
+       do { \
+               if (tx) { \
+                       DHD_PKTDUMP_MEM(("[dhd-%s] "str " [TX] : %s(%s) %s %s(%s) SEQNUM=%d" \
+                               TXFATE_FMT"\n", ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                               tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf, seqnum, \
+                               TX_PKTHASH(pkthash), TX_FATE(pktfate))); \
+               } else { \
+                       DHD_PKTDUMP_MEM(("[dhd-%s] "str " [RX] : %s(%s) %s %s(%s) SEQNUM=%d\n", \
+                               ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                               tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf, seqnum)); \
+               } \
+       } while (0)
+
+#define ICMP_PRINT(str) \
+       do { \
+               if (tx) { \
+                       DHD_PKTDUMP_MEM(("[dhd-%s] "str " [TX] : %s(%s) %s %s(%s) TYPE=%d, CODE=%d" \
+                               TXFATE_FMT "\n", ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                               tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf, type, code, \
+                               TX_PKTHASH(pkthash), TX_FATE(pktfate))); \
+               } else { \
+                       DHD_PKTDUMP_MEM(("[dhd-%s] "str " [RX] : %s(%s) %s %s(%s) TYPE=%d," \
+                               " CODE=%d\n", ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                               tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf, type, code)); \
+               } \
+       } while (0)
+
+void
+dhd_icmp_dump(dhd_pub_t *dhdp, int ifidx, uint8 *pktdata, bool tx,
+       uint32 *pkthash, uint16 *pktfate)
+{
+       uint8 *pkt = (uint8 *)&pktdata[ETHER_HDR_LEN];
+       struct ipv4_hdr *iph = (struct ipv4_hdr *)pkt;
+       struct bcmicmp_hdr *icmph;
+       char *ifname;
+       bool cond;
+       uint16 seqnum, type, code;
+       char sabuf[20]="", dabuf[20]="";
+       char seabuf[ETHER_ADDR_STR_LEN]="";
+       char deabuf[ETHER_ADDR_STR_LEN]="";
+
+       if (!(dump_msg_level & DUMP_ICMP_VAL))
+               return;
+
+       ifname = dhd_ifname(dhdp, ifidx);
+       cond = (tx && pktfate) ? FALSE : TRUE;
+       icmph = (struct bcmicmp_hdr *)((uint8 *)pkt + sizeof(struct ipv4_hdr));
+       seqnum = 0;
+       type = icmph->type;
+       code = icmph->code;
+       bcm_ip_ntoa((struct ipv4_addr *)iph->src_ip, sabuf);
+       bcm_ip_ntoa((struct ipv4_addr *)iph->dst_ip, dabuf);
+       bcm_ether_ntoa((struct ether_addr *)pktdata, deabuf);
+       bcm_ether_ntoa((struct ether_addr *)(pktdata+6), seabuf);
+       if (type == ICMP_TYPE_ECHO_REQUEST) {
+               seqnum = ntoh16(ICMP_ECHO_SEQ(icmph));
+               DHD_STATLOG_DATA(dhdp, ST(ICMP_PING_REQ), ifidx, tx, cond);
+               ICMP_PING_PRINT("PING REQUEST");
+       } else if (type == ICMP_TYPE_ECHO_REPLY) {
+               seqnum = ntoh16(ICMP_ECHO_SEQ(icmph));
+               DHD_STATLOG_DATA(dhdp, ST(ICMP_PING_RESP), ifidx, tx, cond);
+               ICMP_PING_PRINT("PING REPLY  ");
+       } else if (type == ICMP_TYPE_DEST_UNREACH) {
+               DHD_STATLOG_DATA(dhdp, ST(ICMP_DEST_UNREACH), ifidx, tx, cond);
+               ICMP_PRINT("ICMP DEST UNREACH");
+       } else {
+               DHD_STATLOG_DATA(dhdp, ST(ICMP_OTHER), ifidx, tx, cond);
+               ICMP_PRINT("ICMP OTHER");
+       }
+}
+#endif /* DHD_ICMP_DUMP */
+
+bool
+dhd_check_arp(uint8 *pktdata)
+{
+       uint8 *pkt = (uint8 *)&pktdata[ETHER_HDR_LEN];
+       struct bcmarp *arph = (struct bcmarp *)pkt;
+
+       /* validation check */
+       if (arph->htype != hton16(HTYPE_ETHERNET) ||
+               arph->hlen != ETHER_ADDR_LEN ||
+               arph->plen != 4) {
+               return FALSE;
+       }
+       return TRUE;
+}
+
+#ifdef DHD_ARP_DUMP
+#ifdef BOARD_HIKEY
+/* On Hikey, due to continuous ARP prints
+ * DPC not scheduled. Hence rate limit the prints.
+ */
+#define DHD_PKTDUMP_ARP DHD_ERROR_RLMT
+#else
+#define DHD_PKTDUMP_ARP DHD_PKTDUMP
+#endif /* BOARD_HIKEY */
+
+#define ARP_PRINT(str) \
+       do { \
+               if (tx) { \
+                       if (dump_enabled && pktfate && !TX_FATE_ACKED(pktfate)) { \
+                               DHD_PKTDUMP(("[dhd-%s] "str " [TX] : %s(%s) %s %s(%s)"TXFATE_FMT"\n", \
+                                       ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                                       tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf, \
+                                       TX_PKTHASH(pkthash), TX_FATE(pktfate))); \
+                       } else { \
+                               DHD_PKTDUMP_MEM(("[dhd-%s] "str " [TX] : %s(%s) %s %s(%s)"TXFATE_FMT"\n", \
+                                       ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                                       tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf, \
+                                       TX_PKTHASH(pkthash), TX_FATE(pktfate))); \
+                       } \
+               } else { \
+                       DHD_PKTDUMP_MEM(("[dhd-%s] "str " [RX] : %s(%s) %s %s(%s)\n", \
+                               ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                               tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf)); \
+               } \
+       } while (0) \
+
+#define ARP_PRINT_OTHER(str) \
+       do { \
+               if (tx) { \
+                       if (dump_enabled && pktfate && !TX_FATE_ACKED(pktfate)) { \
+                               DHD_PKTDUMP(("[dhd-%s] "str " [TX] : %s(%s) %s %s(%s) op_code=%d" \
+                                       TXFATE_FMT "\n", ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                                       tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf, opcode, \
+                                       TX_PKTHASH(pkthash), TX_FATE(pktfate))); \
+                       } else { \
+                               DHD_PKTDUMP_MEM(("[dhd-%s] "str " [TX] : %s(%s) %s %s(%s) op_code=%d" \
+                               TXFATE_FMT "\n", ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                                       tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf, opcode, \
+                               TX_PKTHASH(pkthash), TX_FATE(pktfate))); \
+                       } \
+               } else { \
+                       DHD_PKTDUMP_MEM(("[dhd-%s] "str " [RX] : %s(%s) %s %s(%s) op_code=%d\n", \
+                               ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                                       tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf, opcode)); \
+               } \
+       } while (0)
+
+void
+dhd_arp_dump(dhd_pub_t *dhdp, int ifidx, uint8 *pktdata, bool tx,
+       uint32 *pkthash, uint16 *pktfate)
+{
+       uint8 *pkt = (uint8 *)&pktdata[ETHER_HDR_LEN];
+       struct bcmarp *arph = (struct bcmarp *)pkt;
+       char *ifname;
+       uint16 opcode;
+       bool cond, dump_enabled;
+       char sabuf[20]="", dabuf[20]="";
+       char seabuf[ETHER_ADDR_STR_LEN]="";
+       char deabuf[ETHER_ADDR_STR_LEN]="";
+
+       if (!(dump_msg_level & DUMP_ARP_VAL))
+               return;
+
+       ifname = dhd_ifname(dhdp, ifidx);
+       opcode = ntoh16(arph->oper);
+       cond = (tx && pktfate) ? FALSE : TRUE;
+       dump_enabled = dhd_dump_pkt_enabled(dhdp);
+       bcm_ip_ntoa((struct ipv4_addr *)arph->src_ip, sabuf);
+       bcm_ip_ntoa((struct ipv4_addr *)arph->dst_ip, dabuf);
+       bcm_ether_ntoa((struct ether_addr *)arph->dst_eth, deabuf);
+       bcm_ether_ntoa((struct ether_addr *)arph->src_eth, seabuf);
+       if (opcode == ARP_OPC_REQUEST) {
+               DHD_STATLOG_DATA(dhdp, ST(ARP_REQ), ifidx, tx, cond);
+               ARP_PRINT("ARP REQUEST ");
+       } else if (opcode == ARP_OPC_REPLY) {
+               DHD_STATLOG_DATA(dhdp, ST(ARP_RESP), ifidx, tx, cond);
+               ARP_PRINT("ARP RESPONSE");
+       } else {
+               ARP_PRINT_OTHER("ARP OTHER");
+       }
+
+       if (ifidx == 0) {
+               dhd_dump_pkt_cnts_inc(dhdp, tx, pktfate, PKT_CNT_TYPE_ARP);
+       }
+}
+#endif /* DHD_ARP_DUMP */
+
+bool
+dhd_check_dns(uint8 *pktdata)
+{
+       hdr_fmt_t *dnsh = (hdr_fmt_t *)&pktdata[ETHER_HDR_LEN];
+       struct ipv4_hdr *iph = &dnsh->iph;
+
+       /* check IP header */
+       if ((IPV4_HLEN(iph) < IPV4_HLEN_MIN) ||
+               IP_VER(iph) != IP_VER_4 ||
+               IPV4_PROT(iph) != IP_PROT_UDP) {
+               return FALSE;
+       }
+
+       /* check UDP port for DNS */
+       if (dnsh->udph.src_port != hton16(UDP_PORT_DNS) &&
+               dnsh->udph.dst_port != hton16(UDP_PORT_DNS)) {
+               return FALSE;
+       }
+
+       /* check header length */
+       if (ntoh16(iph->tot_len) < (ntoh16(dnsh->udph.len) +
+               sizeof(struct bcmudp_hdr))) {
+               return FALSE;
+       }
+       return TRUE;
+}
+
+#ifdef DHD_DNS_DUMP
+typedef struct dns_fmt {
+       struct ipv4_hdr iph;
+       struct bcmudp_hdr udph;
+       uint16 id;
+       uint16 flags;
+       uint16 qdcount;
+       uint16 ancount;
+       uint16 nscount;
+       uint16 arcount;
+} PACKED_STRUCT dns_fmt_t;
+
+#define DNS_QR_LOC             15
+#define DNS_OPCODE_LOC         11
+#define DNS_RCODE_LOC          0
+#define DNS_QR_MASK            ((0x1) << (DNS_QR_LOC))
+#define DNS_OPCODE_MASK                ((0xF) << (DNS_OPCODE_LOC))
+#define DNS_RCODE_MASK         ((0xF) << (DNS_RCODE_LOC))
+#define GET_DNS_QR(flags)      (((flags) & (DNS_QR_MASK)) >> (DNS_QR_LOC))
+#define GET_DNS_OPCODE(flags)  (((flags) & (DNS_OPCODE_MASK)) >> (DNS_OPCODE_LOC))
+#define GET_DNS_RCODE(flags)   (((flags) & (DNS_RCODE_MASK)) >> (DNS_RCODE_LOC))
+#define DNS_UNASSIGNED_OPCODE(flags) ((GET_DNS_OPCODE(flags) >= (6)))
+
+static const char dns_opcode_types[][11] = {
+       "QUERY", "IQUERY", "STATUS", "UNASSIGNED", "NOTIFY", "UPDATE"
+};
+
+#define DNSOPCODE(op)  \
+       (DNS_UNASSIGNED_OPCODE(flags) ? "UNASSIGNED" : dns_opcode_types[op])
+
+#define DNS_REQ_PRINT(str) \
+       do { \
+               if (tx) { \
+                       if (dump_enabled && pktfate && !TX_FATE_ACKED(pktfate)) { \
+                               DHD_PKTDUMP(("[dhd-%s] " str " [TX] : %s(%s) %s %s(%s) ID:0x%04X OPCODE:%s" \
+                                       TXFATE_FMT "\n", ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                                       tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf, \
+                                       id, DNSOPCODE(opcode), TX_PKTHASH(pkthash), TX_FATE(pktfate))); \
+                       } else { \
+                               DHD_PKTDUMP_MEM(("[dhd-%s] " str " [TX] : %s(%s) %s %s(%s) ID:0x%04X OPCODE:%s" \
+                                       TXFATE_FMT "\n", ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                                       tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf, \
+                                       id, DNSOPCODE(opcode), TX_PKTHASH(pkthash), TX_FATE(pktfate))); \
+                       } \
+               } else { \
+                       DHD_PKTDUMP_MEM(("[dhd-%s] " str " [RX] : %s(%s) %s %s(%s) ID:0x%04X OPCODE:%s\n", \
+                               ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, tx?"->":"<-", \
+                               tx?dabuf:sabuf, tx?deabuf:seabuf, id, DNSOPCODE(opcode))); \
+               } \
+       } while (0)
+
+#define DNS_RESP_PRINT(str) \
+       do { \
+               if (tx) { \
+                       if (dump_enabled && pktfate && !TX_FATE_ACKED(pktfate)) { \
+                               DHD_PKTDUMP(("[dhd-%s] " str " [TX] : %s(%s) %s %s(%s) ID:0x%04X OPCODE:%s RCODE:%d" \
+                                       TXFATE_FMT "\n", ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                                       tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf, id, DNSOPCODE(opcode), \
+                                       GET_DNS_RCODE(flags), TX_PKTHASH(pkthash), TX_FATE(pktfate))); \
+                       } else { \
+                               DHD_PKTDUMP_MEM(("[dhd-%s] " str " [TX] : %s(%s) %s %s(%s) ID:0x%04X OPCODE:%s RCODE:%d" \
+                                       TXFATE_FMT "\n", ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                                       tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf, id, DNSOPCODE(opcode), \
+                                       GET_DNS_RCODE(flags), TX_PKTHASH(pkthash), TX_FATE(pktfate))); \
+                       } \
+               } else { \
+                       DHD_PKTDUMP_MEM(("[dhd-%s] " str " [RX] : %s(%s) %s %s(%s) ID:0x%04X OPCODE:%s RCODE:%d\n", \
+                               ifname, tx?sabuf:dabuf, tx?seabuf:deabuf, \
+                               tx?"->":"<-", tx?dabuf:sabuf, tx?deabuf:seabuf, \
+                               id, DNSOPCODE(opcode), GET_DNS_RCODE(flags))); \
+               } \
+       } while (0)
+
+void
+dhd_dns_dump(dhd_pub_t *dhdp, int ifidx, uint8 *pktdata, bool tx,
+       uint32 *pkthash, uint16 *pktfate)
+{
+       dns_fmt_t *dnsh = (dns_fmt_t *)&pktdata[ETHER_HDR_LEN];
+       struct ipv4_hdr *iph = &dnsh->iph;
+       uint16 flags, opcode, id;
+       char *ifname;
+       bool cond, dump_enabled;
+       char sabuf[20]="", dabuf[20]="";
+       char seabuf[ETHER_ADDR_STR_LEN]="";
+       char deabuf[ETHER_ADDR_STR_LEN]="";
+
+       if (!(dump_msg_level & DUMP_DNS_VAL))
+               return;
+
+       ifname = dhd_ifname(dhdp, ifidx);
+       cond = (tx && pktfate) ? FALSE : TRUE;
+       dump_enabled = dhd_dump_pkt_enabled(dhdp);
+       flags = hton16(dnsh->flags);
+       opcode = GET_DNS_OPCODE(flags);
+       id = hton16(dnsh->id);
+       bcm_ip_ntoa((struct ipv4_addr *)iph->src_ip, sabuf);
+       bcm_ip_ntoa((struct ipv4_addr *)iph->dst_ip, dabuf);
+       bcm_ether_ntoa((struct ether_addr *)pktdata, deabuf);
+       bcm_ether_ntoa((struct ether_addr *)(pktdata+6), seabuf);
+       if (GET_DNS_QR(flags)) {
+               /* Response */
+               DHD_STATLOG_DATA(dhdp, ST(DNS_RESP), ifidx, tx, cond);
+               DNS_RESP_PRINT("DNS RESPONSE");
+       } else {
+               /* Request */
+               DHD_STATLOG_DATA(dhdp, ST(DNS_QUERY), ifidx, tx, cond);
+               DNS_REQ_PRINT("DNS REQUEST");
+       }
+
+       if (ifidx == 0) {
+               dhd_dump_pkt_cnts_inc(dhdp, tx, pktfate, PKT_CNT_TYPE_DNS);
+       }
+}
+#endif /* DHD_DNS_DUMP */
+
+#ifdef DHD_TRX_DUMP
+void
+dhd_trx_pkt_dump(dhd_pub_t *dhdp, int ifidx, uint8 *pktdata, uint32 pktlen, bool tx)
+{
+       struct ether_header *eh;
+       uint16 protocol;
+       char *pkttype = "UNKNOWN";
+
+       if (!(dump_msg_level & DUMP_TRX_VAL))
+               return;
+
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (!pktdata) {
+               DHD_ERROR(("%s: pktdata is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       eh = (struct ether_header *)pktdata;
+       protocol = hton16(eh->ether_type);
+       BCM_REFERENCE(pktlen);
+
+       switch (protocol) {
+       case ETHER_TYPE_IP:
+               pkttype = "IP";
+               break;
+       case ETHER_TYPE_ARP:
+               pkttype = "ARP";
+               break;
+       case ETHER_TYPE_BRCM:
+               pkttype = "BRCM";
+               break;
+       case ETHER_TYPE_802_1X:
+               pkttype = "802.1X";
+               break;
+       case ETHER_TYPE_WAI:
+               pkttype = "WAPI";
+               break;
+       default:
+               break;
+       }
+
+       if (protocol != ETHER_TYPE_BRCM) {
+               if (pktdata[0] == 0xFF) {
+                       DHD_PKTDUMP(("[dhd-%s] %s BROADCAST DUMP - %s\n",
+                               dhd_ifname(dhdp, ifidx), tx?"TX":"RX", pkttype));
+               } else if (pktdata[0] & 1) {
+                       DHD_PKTDUMP(("[dhd-%s] %s MULTICAST DUMP " MACDBG " - %s\n",
+                               dhd_ifname(dhdp, ifidx), tx?"TX":"RX", MAC2STRDBG(pktdata), pkttype));
+               } else {
+                       DHD_PKTDUMP(("[dhd-%s] %s DUMP - %s\n",
+                               dhd_ifname(dhdp, ifidx), tx?"TX":"RX", pkttype));
+               }
+#ifdef DHD_RX_FULL_DUMP
+               prhex("Data", pktdata, pktlen);
+#endif /* DHD_RX_FULL_DUMP */
+       }
+       else {
+               DHD_PKTDUMP(("[dhd-%s] %s DUMP - %s\n",
+                       dhd_ifname(dhdp, ifidx), tx?"TX":"RX", pkttype));
+       }
+}
+#endif /* DHD_RX_DUMP */
diff --git a/bcmdhd.101.10.240.x/dhd_linux_pktdump.h b/bcmdhd.101.10.240.x/dhd_linux_pktdump.h
new file mode 100644 (file)
index 0000000..1d03929
--- /dev/null
@@ -0,0 +1,124 @@
+/*
+ * Header file for the Packet dump helper functions
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef __DHD_LINUX_PKTDUMP_H_
+#define __DHD_LINUX_PKTDUMP_H_
+
+#include <typedefs.h>
+#include <dhd.h>
+
+typedef enum {
+       EAPOL_OTHER = 0,
+       EAPOL_4WAY_M1,
+       EAPOL_4WAY_M2,
+       EAPOL_4WAY_M3,
+       EAPOL_4WAY_M4,
+       EAPOL_GROUPKEY_M1,
+       EAPOL_GROUPKEY_M2
+} msg_eapol_t;
+
+typedef enum pkt_cnt_rsn {
+       PKT_CNT_RSN_INVALID     = 0,
+       PKT_CNT_RSN_ROAM        = 1,
+       PKT_CNT_RSN_GRPKEY_UP   = 2,
+       PKT_CNT_RSN_CONNECT     = 3,
+       PKT_CNT_RSN_MAX         = 4
+} pkt_cnt_rsn_t;
+
+extern msg_eapol_t dhd_is_4way_msg(uint8 *pktdata);
+extern void dhd_dump_pkt(dhd_pub_t *dhd, int ifidx, uint8 *pktdata,
+       uint32 pktlen, bool tx, uint32 *pkthash, uint16 *pktfate);
+
+#ifdef DHD_PKTDUMP_ROAM
+extern void dhd_dump_mod_pkt_timer(dhd_pub_t *dhdp, uint16 rsn);
+extern void dhd_dump_pkt_init(dhd_pub_t *dhdp);
+extern void dhd_dump_pkt_deinit(dhd_pub_t *dhdp);
+extern void dhd_dump_pkt_clear(dhd_pub_t *dhdp);
+#else
+static INLINE void dhd_dump_mod_pkt_timer(dhd_pub_t *dhdp, uint16 rsn) { }
+static INLINE void dhd_dump_pkt_init(dhd_pub_t *dhdp) { }
+static INLINE void dhd_dump_pkt_deinit(dhd_pub_t *dhdp) { }
+static INLINE void dhd_dump_pkt_clear(dhd_pub_t *dhdp) { }
+#endif /* DHD_PKTDUMP_ROAM */
+
+/* Rx packet dump */
+#ifdef DHD_TRX_DUMP
+extern void dhd_trx_pkt_dump(dhd_pub_t *dhdp, int ifidx,
+       uint8 *pktdata, uint32 pktlen, bool tx);
+#else
+static INLINE void dhd_trx_pkt_dump(dhd_pub_t *dhdp, int ifidx,
+       uint8 *pktdata, uint32 pktlen, bool tx) { }
+#endif /* DHD_TRX_DUMP */
+
+/* DHCP packet dump */
+#ifdef DHD_DHCP_DUMP
+extern void dhd_dhcp_dump(dhd_pub_t *dhdp, int ifidx, uint8 *pktdata, bool tx,
+       uint32 *pkthash, uint16 *pktfate);
+#else
+static INLINE void dhd_dhcp_dump(dhd_pub_t *dhdp, int ifidx,
+       uint8 *pktdata, bool tx, uint32 *pkthash, uint16 *pktfate) { }
+#endif /* DHD_DHCP_DUMP */
+
+/* DNS packet dump */
+#ifdef DHD_DNS_DUMP
+extern void dhd_dns_dump(dhd_pub_t *dhdp, int ifidx, uint8 *pktdata, bool tx,
+       uint32 *pkthash, uint16 *pktfate);
+#else
+static INLINE void dhd_dns_dump(dhd_pub_t *dhdp, int ifidx,
+       uint8 *pktdata, bool tx, uint32 *pkthash, uint16 *pktfate) { }
+#endif /* DHD_DNS_DUMP */
+
+/* ICMP packet dump */
+#ifdef DHD_ICMP_DUMP
+extern void dhd_icmp_dump(dhd_pub_t *dhdp, int ifidx, uint8 *pktdata, bool tx,
+       uint32 *pkthash, uint16 *pktfate);
+#else
+static INLINE void dhd_icmp_dump(dhd_pub_t *dhdp, int ifidx,
+       uint8 *pktdata, bool tx, uint32 *pkthash, uint16 *pktfate) { }
+#endif /* DHD_ICMP_DUMP */
+
+/* ARP packet dump */
+#ifdef DHD_ARP_DUMP
+extern void dhd_arp_dump(dhd_pub_t *dhdp, int ifidx, uint8 *pktdata, bool tx,
+       uint32 *pkthash, uint16 *pktfate);
+#else
+static INLINE void dhd_arp_dump(dhd_pub_t *dhdp, int ifidx,
+       uint8 *pktdata, bool tx, uint32 *pkthash, uint16 *pktfate) { }
+#endif /* DHD_ARP_DUMP */
+
+/* 802.1X packet dump */
+#ifdef DHD_8021X_DUMP
+extern void dhd_dump_eapol_message(dhd_pub_t *dhd, int ifidx,
+        uint8 *pktdata, uint32 pktlen, bool tx, uint32 *pkthash, uint16 *pktfate);
+#else
+static INLINE void dhd_dump_eapol_message(dhd_pub_t *dhd, int ifidx,
+        uint8 *pktdata, uint32 pktlen, bool tx, uint32 *pkthash, uint16 *pktfate) { }
+#endif /* DHD_8021X_DUMP */
+
+extern bool dhd_check_dhcp(uint8 *pktdata);
+extern bool dhd_check_icmp(uint8 *pktdata);
+extern bool dhd_check_arp(uint8 *pktdata);
+extern bool dhd_check_dns(uint8 *pktdata);
+#endif /* __DHD_LINUX_PKTDUMP_H_ */
diff --git a/bcmdhd.101.10.240.x/dhd_linux_platdev.c b/bcmdhd.101.10.240.x/dhd_linux_platdev.c
new file mode 100644 (file)
index 0000000..18046a4
--- /dev/null
@@ -0,0 +1,1045 @@
+/*
+ * Linux platform device for DHD WLAN adapter
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+#include <typedefs.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <bcmutils.h>
+#include <linux_osl.h>
+#include <dhd_dbg.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_linux.h>
+#include <wl_android.h>
+#if defined(CONFIG_WIFI_CONTROL_FUNC)
+#include <linux/wlan_plat.h>
+#endif
+#ifdef CONFIG_DTS
+#include<linux/regulator/consumer.h>
+#include<linux/of_gpio.h>
+#endif /* CONFIG_DTS */
+
+#if defined(CUSTOMER_HW)
+extern int dhd_wlan_init_plat_data(void);
+extern void dhd_wlan_deinit_plat_data(wifi_adapter_info_t *adapter);
+#endif /* CUSTOMER_HW */
+
+#define WIFI_PLAT_NAME         "bcmdhd_wlan"
+#define WIFI_PLAT_NAME2                "bcm4329_wlan"
+#define WIFI_PLAT_EXT          "bcmdhd_wifi_platform"
+
+#ifdef DHD_WIFI_SHUTDOWN
+extern void wifi_plat_dev_drv_shutdown(struct platform_device *pdev);
+#endif
+
+#ifdef CONFIG_DTS
+struct regulator *wifi_regulator = NULL;
+#endif /* CONFIG_DTS */
+
+bool cfg_multichip = FALSE;
+bcmdhd_wifi_platdata_t *dhd_wifi_platdata = NULL;
+static int wifi_plat_dev_probe_ret = 0;
+static bool is_power_on = FALSE;
+/* XXX Some Qualcomm based CUSTOMER_HW4 platforms are using platform
+ * device structure even if the Kernel uses device tree structure.
+ * Therefore, the CONFIG_ARCH_MSM condition is temporarly remained
+ * to support in this case.
+ */
+#if !defined(CONFIG_DTS)
+#if defined(DHD_OF_SUPPORT)
+static bool dts_enabled = TRUE;
+extern struct resource dhd_wlan_resources;
+extern struct wifi_platform_data dhd_wlan_control;
+#else
+static bool dts_enabled = FALSE;
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wmissing-field-initializers"
+#endif
+struct resource dhd_wlan_resources = {0};
+struct wifi_platform_data dhd_wlan_control = {0};
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+#endif /* CONFIG_OF && !defined(CONFIG_ARCH_MSM) */
+#endif /* !defind(CONFIG_DTS) */
+
+static int dhd_wifi_platform_load(void);
+
+extern void* wl_cfg80211_get_dhdp(struct net_device *dev);
+
+#ifdef BCMDHD_MODULAR
+extern int dhd_wlan_init(void);
+extern int dhd_wlan_deinit(void);
+#endif /* BCMDHD_MODULAR */
+
+#ifdef ENABLE_4335BT_WAR
+extern int bcm_bt_lock(int cookie);
+extern void bcm_bt_unlock(int cookie);
+static int lock_cookie_wifi = 'W' | 'i'<<8 | 'F'<<16 | 'i'<<24;        /* cookie is "WiFi" */
+#endif /* ENABLE_4335BT_WAR */
+
+#ifdef BCM4335_XTAL_WAR
+extern bool check_bcm4335_rev(void);
+#endif /* BCM4335_XTAL_WAR */
+
+wifi_adapter_info_t* dhd_wifi_platform_attach_adapter(uint32 bus_type,
+       uint32 bus_num, uint32 slot_num, unsigned long status)
+{
+       int i;
+
+       if (dhd_wifi_platdata == NULL)
+               return NULL;
+
+       for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+               wifi_adapter_info_t *adapter = &dhd_wifi_platdata->adapters[i];
+               if ((adapter->bus_type == -1 || adapter->bus_type == bus_type) &&
+                       (adapter->bus_num == -1 || adapter->bus_num == bus_num) &&
+                       (adapter->slot_num == -1 || adapter->slot_num == slot_num)
+#if defined(ENABLE_INSMOD_NO_FW_LOAD)
+                       && (wifi_chk_adapter_status(adapter, status))
+#endif
+               ) {
+                       DHD_ERROR(("attach adapter info '%s'\n", adapter->name));
+                       return adapter;
+               }
+       }
+       return NULL;
+}
+
+wifi_adapter_info_t* dhd_wifi_platform_get_adapter(uint32 bus_type, uint32 bus_num, uint32 slot_num)
+{
+       int i;
+
+       if (dhd_wifi_platdata == NULL)
+               return NULL;
+
+       for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+               wifi_adapter_info_t *adapter = &dhd_wifi_platdata->adapters[i];
+               if ((adapter->bus_type == -1 || adapter->bus_type == bus_type) &&
+                       (adapter->bus_num == -1 || adapter->bus_num == bus_num) &&
+                       (adapter->slot_num == -1 || adapter->slot_num == slot_num)) {
+                       DHD_TRACE(("found adapter info '%s'\n", adapter->name));
+                       return adapter;
+               }
+       }
+       return NULL;
+}
+
+void* wifi_platform_prealloc(wifi_adapter_info_t *adapter, int section, unsigned long size)
+{
+       void *alloc_ptr = NULL;
+       struct wifi_platform_data *plat_data;
+
+       if (!adapter || !adapter->wifi_plat_data)
+               return NULL;
+       plat_data = adapter->wifi_plat_data;
+       if (plat_data->mem_prealloc) {
+               alloc_ptr = plat_data->mem_prealloc(section, size);
+               if (alloc_ptr) {
+                       DHD_INFO(("success alloc section %d\n", section));
+                       if (size != 0L)
+                               bzero(alloc_ptr, size);
+                       return alloc_ptr;
+               }
+       } else
+               return NULL;
+
+       DHD_ERROR(("%s: failed to alloc static mem section %d\n", __FUNCTION__, section));
+       return NULL;
+}
+
+void* wifi_platform_get_prealloc_func_ptr(wifi_adapter_info_t *adapter)
+{
+       struct wifi_platform_data *plat_data;
+
+       if (!adapter || !adapter->wifi_plat_data)
+               return NULL;
+       plat_data = adapter->wifi_plat_data;
+       return plat_data->mem_prealloc;
+}
+
+int wifi_platform_get_irq_number(wifi_adapter_info_t *adapter, unsigned long *irq_flags_ptr)
+{
+       if (adapter == NULL)
+               return -1;
+       if (irq_flags_ptr)
+               *irq_flags_ptr = adapter->intr_flags;
+       return adapter->irq_num;
+}
+
+int wifi_platform_set_power(wifi_adapter_info_t *adapter, bool on, unsigned long msec)
+{
+       int err = 0;
+#ifndef CONFIG_DTS
+       struct wifi_platform_data *plat_data;
+#endif
+#ifdef BT_OVER_SDIO
+       if (is_power_on == on) {
+               return -EINVAL;
+       }
+#endif /* BT_OVER_SDIO */
+       if (on) {
+               wifi_set_adapter_status(adapter, WIFI_STATUS_POWER_ON);
+       } else {
+               wifi_clr_adapter_status(adapter, WIFI_STATUS_POWER_ON);
+       }
+#ifdef CONFIG_DTS
+       if (on) {
+               printf("======== PULL WL_REG_ON HIGH! ========\n");
+               err = regulator_enable(wifi_regulator);
+               is_power_on = TRUE;
+       }
+       else {
+               printf("======== PULL WL_REG_ON LOW! ========\n");
+               err = regulator_disable(wifi_regulator);
+               is_power_on = FALSE;
+       }
+       if (err < 0) {
+               DHD_ERROR(("%s: regulator enable/disable failed", __FUNCTION__));
+               goto fail;
+       }
+#else
+       if (!adapter || !adapter->wifi_plat_data) {
+               err = -EINVAL;
+               goto fail;
+       }
+       plat_data = adapter->wifi_plat_data;
+
+       DHD_ERROR(("%s = %d, delay: %lu msec\n", __FUNCTION__, on, msec));
+       if (plat_data->set_power) {
+#ifdef ENABLE_4335BT_WAR
+               if (on) {
+                       printk("WiFi: trying to acquire BT lock\n");
+                       if (bcm_bt_lock(lock_cookie_wifi) != 0)
+                               printk("** WiFi: timeout in acquiring bt lock**\n");
+                       printk("%s: btlock acquired\n", __FUNCTION__);
+               }
+               else {
+                       /* For a exceptional case, release btlock */
+                       bcm_bt_unlock(lock_cookie_wifi);
+               }
+#endif /* ENABLE_4335BT_WAR */
+
+#ifdef BUS_POWER_RESTORE
+               err = plat_data->set_power(on, adapter);
+#else
+               err = plat_data->set_power(on);
+#endif
+       }
+
+       if (msec && !err)
+               OSL_SLEEP(msec);
+
+       if (on && !err)
+               is_power_on = TRUE;
+       else
+               is_power_on = FALSE;
+
+#endif /* CONFIG_DTS */
+
+       return err;
+fail:
+       if (on) {
+               wifi_clr_adapter_status(adapter, WIFI_STATUS_POWER_ON);
+       } else {
+               wifi_set_adapter_status(adapter, WIFI_STATUS_POWER_ON);
+       }
+       return err;
+}
+
+int wifi_platform_bus_enumerate(wifi_adapter_info_t *adapter, bool device_present)
+{
+       int err = 0;
+       struct wifi_platform_data *plat_data;
+
+       if (!adapter || !adapter->wifi_plat_data)
+               return -EINVAL;
+       plat_data = adapter->wifi_plat_data;
+
+       DHD_ERROR(("%s device present %d\n", __FUNCTION__, device_present));
+       if (plat_data->set_carddetect) {
+               err = plat_data->set_carddetect(device_present);
+       }
+       return err;
+
+}
+
+int wifi_platform_get_mac_addr(wifi_adapter_info_t *adapter, unsigned char *buf,
+       char *name)
+{
+       struct wifi_platform_data *plat_data;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+       if (!buf || !adapter || !adapter->wifi_plat_data)
+               return -EINVAL;
+       plat_data = adapter->wifi_plat_data;
+       if (plat_data->get_mac_addr) {
+#ifdef CUSTOM_MULTI_MAC
+               return plat_data->get_mac_addr(buf, name);
+#else
+               return plat_data->get_mac_addr(buf);
+#endif
+       }
+       return -EOPNOTSUPP;
+}
+
+void *
+#ifdef CUSTOM_COUNTRY_CODE
+wifi_platform_get_country_code(wifi_adapter_info_t *adapter, char *ccode, u32 flags)
+#else
+wifi_platform_get_country_code(wifi_adapter_info_t *adapter, char *ccode)
+#endif /* CUSTOM_COUNTRY_CODE */
+{
+       /* get_country_code was added after 2.6.39 */
+#if    (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
+       struct wifi_platform_data *plat_data;
+
+       if (!ccode || !adapter || !adapter->wifi_plat_data)
+               return NULL;
+       plat_data = adapter->wifi_plat_data;
+
+       DHD_TRACE(("%s\n", __FUNCTION__));
+       if (plat_data->get_country_code) {
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+               return plat_data->get_country_code(ccode, flags);
+#else
+               return plat_data->get_country_code(ccode);
+#endif /* CUSTOM_COUNTRY_CODE */
+       }
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)) */
+
+       return NULL;
+}
+
+#ifndef CUSTOMER_HW
+static int wifi_plat_dev_drv_probe(struct platform_device *pdev)
+{
+       struct resource *resource;
+       wifi_adapter_info_t *adapter;
+#if defined(CONFIG_DTS) && defined(CUSTOMER_OOB)
+       int irq, gpio;
+#endif /* CONFIG_DTS */
+
+       /* Android style wifi platform data device ("bcmdhd_wlan" or "bcm4329_wlan")
+        * is kept for backward compatibility and supports only 1 adapter
+        */
+       ASSERT(dhd_wifi_platdata != NULL);
+       ASSERT(dhd_wifi_platdata->num_adapters == 1);
+       adapter = &dhd_wifi_platdata->adapters[0];
+#if defined(CONFIG_WIFI_CONTROL_FUNC)
+       adapter->wifi_plat_data = (struct wifi_platform_data *)(pdev->dev.platform_data);
+#else
+       adapter->wifi_plat_data = (void *)&dhd_wlan_control;
+#endif
+
+       resource = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "bcmdhd_wlan_irq");
+       if (resource == NULL)
+               resource = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "bcm4329_wlan_irq");
+       if (resource) {
+               adapter->irq_num = resource->start;
+               adapter->intr_flags = resource->flags & IRQF_TRIGGER_MASK;
+#ifdef DHD_ISR_NO_SUSPEND
+               adapter->intr_flags |= IRQF_NO_SUSPEND;
+#endif
+       }
+
+#ifdef CONFIG_DTS
+       wifi_regulator = regulator_get(&pdev->dev, "wlreg_on");
+       if (wifi_regulator == NULL) {
+               DHD_ERROR(("%s regulator is null\n", __FUNCTION__));
+               return -1;
+       }
+
+#if defined(CUSTOMER_OOB)
+       /* This is to get the irq for the OOB */
+       gpio = of_get_gpio(pdev->dev.of_node, 0);
+
+       if (gpio < 0) {
+               DHD_ERROR(("%s gpio information is incorrect\n", __FUNCTION__));
+               return -1;
+       }
+       irq = gpio_to_irq(gpio);
+       if (irq < 0) {
+               DHD_ERROR(("%s irq information is incorrect\n", __FUNCTION__));
+               return -1;
+       }
+       adapter->irq_num = irq;
+
+       /* need to change the flags according to our requirement */
+       adapter->intr_flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL |
+               IORESOURCE_IRQ_SHAREABLE;
+#endif
+#endif /* CONFIG_DTS */
+
+       wifi_plat_dev_probe_ret = dhd_wifi_platform_load();
+       return wifi_plat_dev_probe_ret;
+}
+
+static int wifi_plat_dev_drv_remove(struct platform_device *pdev)
+{
+       wifi_adapter_info_t *adapter;
+
+       /* Android style wifi platform data device ("bcmdhd_wlan" or "bcm4329_wlan")
+        * is kept for backward compatibility and supports only 1 adapter
+        */
+       ASSERT(dhd_wifi_platdata != NULL);
+       ASSERT(dhd_wifi_platdata->num_adapters == 1);
+       adapter = &dhd_wifi_platdata->adapters[0];
+       if (is_power_on) {
+#ifdef BCMPCIE
+               wifi_platform_bus_enumerate(adapter, FALSE);
+               wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+#else
+               wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+               wifi_platform_bus_enumerate(adapter, FALSE);
+#endif /* BCMPCIE */
+       }
+
+#ifdef CONFIG_DTS
+       regulator_put(wifi_regulator);
+#endif /* CONFIG_DTS */
+       return 0;
+}
+
+static int wifi_plat_dev_drv_suspend(struct platform_device *pdev, pm_message_t state)
+{
+       DHD_TRACE(("##> %s\n", __FUNCTION__));
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)) && defined(OOB_INTR_ONLY) && \
+       defined(BCMSDIO)
+       bcmsdh_oob_intr_set(0);
+#endif /* (OOB_INTR_ONLY) */
+       return 0;
+}
+
+static int wifi_plat_dev_drv_resume(struct platform_device *pdev)
+{
+       DHD_TRACE(("##> %s\n", __FUNCTION__));
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)) && defined(OOB_INTR_ONLY) && \
+       defined(BCMSDIO)
+       if (dhd_os_check_if_up(wl_cfg80211_get_dhdp()))
+               bcmsdh_oob_intr_set(1);
+#endif /* (OOB_INTR_ONLY) */
+       return 0;
+}
+
+#ifdef CONFIG_DTS
+static const struct of_device_id wifi_device_dt_match[] = {
+       { .compatible = "android,bcmdhd_wlan", },
+       {},
+};
+#endif /* CONFIG_DTS */
+
+static struct platform_driver wifi_platform_dev_driver = {
+       .probe          = wifi_plat_dev_drv_probe,
+       .remove         = wifi_plat_dev_drv_remove,
+       .suspend        = wifi_plat_dev_drv_suspend,
+       .resume         = wifi_plat_dev_drv_resume,
+#ifdef DHD_WIFI_SHUTDOWN
+       .shutdown       = wifi_plat_dev_drv_shutdown,
+#endif /* DHD_WIFI_SHUTDOWN */
+       .driver         = {
+       .name   = WIFI_PLAT_NAME,
+#ifdef CONFIG_DTS
+       .of_match_table = wifi_device_dt_match,
+#endif /* CONFIG_DTS */
+       }
+};
+
+static struct platform_driver wifi_platform_dev_driver_legacy = {
+       .probe          = wifi_plat_dev_drv_probe,
+       .remove         = wifi_plat_dev_drv_remove,
+       .suspend        = wifi_plat_dev_drv_suspend,
+       .resume         = wifi_plat_dev_drv_resume,
+#ifdef DHD_WIFI_SHUTDOWN
+       .shutdown       = wifi_plat_dev_drv_shutdown,
+#endif /* DHD_WIFI_SHUTDOWN */
+       .driver         = {
+       .name   = WIFI_PLAT_NAME2,
+       }
+};
+
+static int wifi_platdev_match(struct device *dev, void *data)
+{
+       char *name = (char*)data;
+       const struct platform_device *pdev;
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       pdev = to_platform_device(dev);
+       GCC_DIAGNOSTIC_POP();
+
+       if (strcmp(pdev->name, name) == 0) {
+               DHD_ERROR(("found wifi platform device %s\n", name));
+               return TRUE;
+       }
+
+       return FALSE;
+}
+#endif
+
+static int wifi_ctrlfunc_register_drv(void)
+{
+       wifi_adapter_info_t *adapter;
+
+#ifndef CUSTOMER_HW
+       int err = 0;
+       struct device *dev1, *dev2;
+       dev1 = bus_find_device(&platform_bus_type, NULL, WIFI_PLAT_NAME, wifi_platdev_match);
+       dev2 = bus_find_device(&platform_bus_type, NULL, WIFI_PLAT_NAME2, wifi_platdev_match);
+#endif
+
+#ifdef BCMDHD_MODULAR
+       dhd_wlan_init();
+#endif /* BCMDHD_MODULAR */
+
+#if !defined(CONFIG_DTS) && !defined(CUSTOMER_HW)
+       if (!dts_enabled) {
+               if (dev1 == NULL && dev2 == NULL) {
+                       DHD_ERROR(("no wifi platform data, skip\n"));
+                       return -ENXIO;
+               }
+       }
+#endif /* !defined(CONFIG_DTS) */
+
+       /* multi-chip support not enabled, build one adapter information for
+        * DHD (either SDIO, USB or PCIe)
+        */
+       adapter = kzalloc(sizeof(wifi_adapter_info_t), GFP_KERNEL);
+       if (adapter == NULL) {
+               DHD_ERROR(("%s:adapter alloc failed", __FUNCTION__));
+               return -ENOMEM;
+       }
+       adapter->name = "DHD generic adapter";
+       adapter->bus_type = -1;
+       adapter->bus_num = -1;
+       adapter->slot_num = -1;
+       adapter->irq_num = -1;
+       is_power_on = FALSE;
+       wifi_plat_dev_probe_ret = 0;
+       dhd_wifi_platdata = kzalloc(sizeof(bcmdhd_wifi_platdata_t), GFP_KERNEL);
+       dhd_wifi_platdata->num_adapters = 1;
+       dhd_wifi_platdata->adapters = adapter;
+       init_waitqueue_head(&adapter->status_event);
+
+#ifndef CUSTOMER_HW
+       if (dev1) {
+               err = platform_driver_register(&wifi_platform_dev_driver);
+               if (err) {
+                       DHD_ERROR(("%s: failed to register wifi ctrl func driver\n",
+                               __FUNCTION__));
+                       return err;
+               }
+       }
+       if (dev2) {
+               err = platform_driver_register(&wifi_platform_dev_driver_legacy);
+               if (err) {
+                       DHD_ERROR(("%s: failed to register wifi ctrl func legacy driver\n",
+                               __FUNCTION__));
+                       return err;
+               }
+       }
+#endif
+
+#if !defined(CONFIG_DTS)
+       if (dts_enabled) {
+               struct resource *resource;
+               adapter->wifi_plat_data = (void *)&dhd_wlan_control;
+               resource = &dhd_wlan_resources;
+#ifdef CUSTOMER_HW
+               wifi_plat_dev_probe_ret = dhd_wlan_init_plat_data();
+               if (wifi_plat_dev_probe_ret)
+                       return wifi_plat_dev_probe_ret;
+#endif
+               adapter->irq_num = resource->start;
+               adapter->intr_flags = resource->flags & IRQF_TRIGGER_MASK;
+#ifdef DHD_ISR_NO_SUSPEND
+               adapter->intr_flags |= IRQF_NO_SUSPEND;
+#endif
+               wifi_plat_dev_probe_ret = dhd_wifi_platform_load();
+       }
+#endif /* !defined(CONFIG_DTS) */
+
+#if defined(CONFIG_DTS) && !defined(CUSTOMER_HW)
+       wifi_plat_dev_probe_ret = platform_driver_register(&wifi_platform_dev_driver);
+#endif /* CONFIG_DTS */
+
+       /* return probe function's return value if registeration succeeded */
+       return wifi_plat_dev_probe_ret;
+}
+
+void wifi_ctrlfunc_unregister_drv(void)
+{
+#ifndef CONFIG_DTS
+       wifi_adapter_info_t *adapter;
+#endif
+
+#if defined(CONFIG_DTS) && !defined(CUSTOMER_HW)
+       DHD_ERROR(("unregister wifi platform drivers\n"));
+       platform_driver_unregister(&wifi_platform_dev_driver);
+#else
+#ifndef CUSTOMER_HW
+       struct device *dev1, *dev2;
+       dev1 = bus_find_device(&platform_bus_type, NULL, WIFI_PLAT_NAME, wifi_platdev_match);
+       dev2 = bus_find_device(&platform_bus_type, NULL, WIFI_PLAT_NAME2, wifi_platdev_match);
+       if (!dts_enabled)
+               if (dev1 == NULL && dev2 == NULL)
+                       return;
+#endif
+       DHD_ERROR(("unregister wifi platform drivers\n"));
+#ifndef CUSTOMER_HW
+       if (dev1)
+               platform_driver_unregister(&wifi_platform_dev_driver);
+       if (dev2)
+               platform_driver_unregister(&wifi_platform_dev_driver_legacy);
+#endif
+       if (dts_enabled) {
+               adapter = &dhd_wifi_platdata->adapters[0];
+               if (is_power_on) {
+                       wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+               }
+               wifi_platform_bus_enumerate(adapter, FALSE);
+       }
+#ifdef BCMDHD_MODULAR
+       dhd_wlan_deinit();
+#endif /* BCMDHD_MODULAR */
+#endif /* !defined(CONFIG_DTS) */
+
+#if defined(CUSTOMER_HW)
+       dhd_wlan_deinit_plat_data(adapter);
+#endif
+
+       kfree(dhd_wifi_platdata->adapters);
+       dhd_wifi_platdata->adapters = NULL;
+       dhd_wifi_platdata->num_adapters = 0;
+       kfree(dhd_wifi_platdata);
+       dhd_wifi_platdata = NULL;
+}
+
+#ifndef CUSTOMER_HW
+static int bcmdhd_wifi_plat_dev_drv_probe(struct platform_device *pdev)
+{
+       dhd_wifi_platdata = (bcmdhd_wifi_platdata_t *)(pdev->dev.platform_data);
+
+       return dhd_wifi_platform_load();
+}
+
+static int bcmdhd_wifi_plat_dev_drv_remove(struct platform_device *pdev)
+{
+       int i;
+       wifi_adapter_info_t *adapter;
+       ASSERT(dhd_wifi_platdata != NULL);
+
+       /* power down all adapters */
+       for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+               adapter = &dhd_wifi_platdata->adapters[i];
+               wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+               wifi_platform_bus_enumerate(adapter, FALSE);
+       }
+       return 0;
+}
+
+static struct platform_driver dhd_wifi_platform_dev_driver = {
+       .probe          = bcmdhd_wifi_plat_dev_drv_probe,
+       .remove         = bcmdhd_wifi_plat_dev_drv_remove,
+       .driver         = {
+       .name   = WIFI_PLAT_EXT,
+       }
+};
+#endif
+
+int dhd_wifi_platform_register_drv(void)
+{
+       int err = 0;
+#ifndef CUSTOMER_HW
+       struct device *dev;
+
+       /* register Broadcom wifi platform data driver if multi-chip is enabled,
+        * otherwise use Android style wifi platform data (aka wifi control function)
+        * if it exists
+        *
+        * to support multi-chip DHD, Broadcom wifi platform data device must
+        * be added in kernel early boot (e.g. board config file).
+        */
+       if (cfg_multichip) {
+               dev = bus_find_device(&platform_bus_type, NULL, WIFI_PLAT_EXT, wifi_platdev_match);
+               if (dev == NULL) {
+                       DHD_ERROR(("bcmdhd wifi platform data device not found!!\n"));
+                       return -ENXIO;
+               }
+               err = platform_driver_register(&dhd_wifi_platform_dev_driver);
+       } else
+#endif
+       {
+               err = wifi_ctrlfunc_register_drv();
+
+               /* no wifi ctrl func either, load bus directly and ignore this error */
+               if (err) {
+                       if (err == -ENXIO) {
+                               /* wifi ctrl function does not exist */
+                               err = dhd_wifi_platform_load();
+                       } else {
+                               /* unregister driver due to initialization failure */
+                               wifi_ctrlfunc_unregister_drv();
+                       }
+               }
+       }
+
+       return err;
+}
+
+#ifdef BCMPCIE
+static int dhd_wifi_platform_load_pcie(void)
+{
+       int err = 0;
+       int i;
+       wifi_adapter_info_t *adapter;
+
+       BCM_REFERENCE(i);
+       BCM_REFERENCE(adapter);
+
+       if (dhd_wifi_platdata == NULL) {
+               /* XXX For x86 Bringup PC or BRIX */
+               err = dhd_bus_register();
+       } else {
+#ifdef DHD_SUPPORT_HDM
+               if (dhd_download_fw_on_driverload || hdm_trigger_init) {
+#else
+               if (dhd_download_fw_on_driverload) {
+#endif /* DHD_SUPPORT_HDM */
+                       /* power up all adapters */
+                       for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+                               int retry = POWERUP_MAX_RETRY;
+                               adapter = &dhd_wifi_platdata->adapters[i];
+
+                               DHD_ERROR(("Power-up adapter '%s'\n", adapter->name));
+                               DHD_INFO((" - irq %d [flags %d], firmware: %s, nvram: %s\n",
+                                       adapter->irq_num, adapter->intr_flags, adapter->fw_path,
+                                       adapter->nv_path));
+                               DHD_INFO((" - bus type %d, bus num %d, slot num %d\n\n",
+                                       adapter->bus_type, adapter->bus_num, adapter->slot_num));
+
+                               do {
+                                       err = wifi_platform_set_power(adapter,
+                                               TRUE, WIFI_TURNON_DELAY);
+                                       if (err) {
+                                               DHD_ERROR(("failed to power up %s,"
+                                                       " %d retry left\n",
+                                                       adapter->name, retry));
+                                               /* WL_REG_ON state unknown, Power off forcely */
+                                               wifi_platform_set_power(adapter,
+                                                       FALSE, WIFI_TURNOFF_DELAY);
+                                               continue;
+                                       } else {
+                                               err = wifi_platform_bus_enumerate(adapter, TRUE);
+                                               if (err) {
+                                                       DHD_ERROR(("failed to enumerate bus %s, "
+                                                               "%d retry left\n",
+                                                               adapter->name, retry));
+                                                       wifi_platform_set_power(adapter, FALSE,
+                                                               WIFI_TURNOFF_DELAY);
+                                               } else {
+                                                       break;
+                                               }
+                                       }
+                               } while (retry--);
+
+                               if (retry < 0) {
+                                       DHD_ERROR(("failed to power up %s, max retry reached**\n",
+                                               adapter->name));
+                                       return -ENODEV;
+                               }
+                       }
+               }
+
+               err = dhd_bus_register();
+
+               if (err) {
+                       DHD_ERROR(("%s: pcie_register_driver failed\n", __FUNCTION__));
+                       if (dhd_download_fw_on_driverload) {
+                               /* power down all adapters */
+                               for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+                                       adapter = &dhd_wifi_platdata->adapters[i];
+                                       wifi_platform_bus_enumerate(adapter, FALSE);
+                                       wifi_platform_set_power(adapter,
+                                               FALSE, WIFI_TURNOFF_DELAY);
+                               }
+                       }
+               }
+       }
+
+       return err;
+}
+#else
+static int dhd_wifi_platform_load_pcie(void)
+{
+       return 0;
+}
+#endif /* BCMPCIE  */
+
+void dhd_wifi_platform_unregister_drv(void)
+{
+#ifndef CUSTOMER_HW
+       if (cfg_multichip)
+               platform_driver_unregister(&dhd_wifi_platform_dev_driver);
+       else
+#endif
+               wifi_ctrlfunc_unregister_drv();
+}
+
+extern int dhd_watchdog_prio;
+extern int dhd_dpc_prio;
+extern uint dhd_deferred_tx;
+#if defined(BCMLXSDMMC) || defined(BCMDBUS)
+extern struct semaphore dhd_registration_sem;
+#endif
+
+#ifdef BCMSDIO
+static int dhd_wifi_platform_load_sdio(void)
+{
+       int i;
+       int err = 0;
+       wifi_adapter_info_t *adapter;
+
+       BCM_REFERENCE(i);
+       BCM_REFERENCE(adapter);
+       /* Sanity check on the module parameters
+        * - Both watchdog and DPC as tasklets are ok
+        * - If both watchdog and DPC are threads, TX must be deferred
+        */
+       if (!(dhd_watchdog_prio < 0 && dhd_dpc_prio < 0) &&
+               !(dhd_watchdog_prio >= 0 && dhd_dpc_prio >= 0 && dhd_deferred_tx))
+               return -EINVAL;
+
+#if defined(BCMLXSDMMC) && !defined(DHD_PRELOAD)
+       sema_init(&dhd_registration_sem, 0);
+#endif
+
+       if (dhd_wifi_platdata == NULL) {
+               DHD_ERROR(("DHD wifi platform data is required for Android build\n"));
+               DHD_ERROR(("DHD registering bus directly\n"));
+               /* x86 bring-up PC needs no power-up operations */
+               err = dhd_bus_register();
+               return err;
+       }
+
+#if defined(BCMLXSDMMC) && !defined(DHD_PRELOAD)
+       /* power up all adapters */
+       for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+               bool chip_up = FALSE;
+               int retry = POWERUP_MAX_RETRY;
+               struct semaphore dhd_chipup_sem;
+
+               adapter = &dhd_wifi_platdata->adapters[i];
+
+               DHD_ERROR(("Power-up adapter '%s'\n", adapter->name));
+               DHD_INFO((" - irq %d [flags %d], firmware: %s, nvram: %s\n",
+                       adapter->irq_num, adapter->intr_flags, adapter->fw_path, adapter->nv_path));
+               DHD_INFO((" - bus type %d, bus num %d, slot num %d\n\n",
+                       adapter->bus_type, adapter->bus_num, adapter->slot_num));
+
+               do {
+#ifndef CUSTOMER_HW_AMLOGIC
+                       sema_init(&dhd_chipup_sem, 0);
+                       err = dhd_bus_reg_sdio_notify(&dhd_chipup_sem);
+                       if (err) {
+                               DHD_ERROR(("%s dhd_bus_reg_sdio_notify fail(%d)\n\n",
+                                       __FUNCTION__, err));
+                               return err;
+                       }
+#endif
+                       err = wifi_platform_set_power(adapter, TRUE, WIFI_TURNON_DELAY);
+                       if (err) {
+                               DHD_ERROR(("%s: wifi pwr on error ! \n", __FUNCTION__));
+                               dhd_bus_unreg_sdio_notify();
+                               /* WL_REG_ON state unknown, Power off forcely */
+                               wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+                               continue;
+                       } else {
+                               wifi_platform_bus_enumerate(adapter, TRUE);
+                       }
+#ifdef CUSTOMER_HW_AMLOGIC
+                       sema_init(&dhd_chipup_sem, 0);
+                       err = dhd_bus_reg_sdio_notify(&dhd_chipup_sem);
+                       if (err) {
+                               DHD_ERROR(("%s dhd_bus_reg_sdio_notify fail(%d)\n\n",
+                                       __FUNCTION__, err));
+                               return err;
+                       }
+#endif
+
+                       if (down_timeout(&dhd_chipup_sem, msecs_to_jiffies(POWERUP_WAIT_MS)) == 0) {
+                               dhd_bus_unreg_sdio_notify();
+                               chip_up = TRUE;
+                               break;
+                       }
+
+                       DHD_ERROR(("failed to power up %s, %d retry left\n", adapter->name, retry));
+                       dhd_bus_unreg_sdio_notify();
+                       wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+                       wifi_platform_bus_enumerate(adapter, FALSE);
+               } while (retry--);
+
+               if (!chip_up) {
+                       DHD_ERROR(("failed to power up %s, max retry reached**\n", adapter->name));
+                       return -ENODEV;
+               }
+
+       }
+
+       err = dhd_bus_register();
+
+       if (err) {
+               DHD_ERROR(("%s: sdio_register_driver failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+       /*
+        * Wait till MMC sdio_register_driver callback called and made driver attach.
+        * It's needed to make sync up exit from dhd insmod  and
+        * Kernel MMC sdio device callback registration
+        */
+       err = down_timeout(&dhd_registration_sem, msecs_to_jiffies(DHD_REGISTRATION_TIMEOUT));
+       if (err) {
+               DHD_ERROR(("%s: sdio_register_driver timeout or error \n", __FUNCTION__));
+               dhd_bus_unregister();
+               goto fail;
+       }
+
+       return err;
+
+fail:
+       /* power down all adapters */
+       for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+               adapter = &dhd_wifi_platdata->adapters[i];
+               wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+               wifi_platform_bus_enumerate(adapter, FALSE);
+       }
+#else
+       /* x86 bring-up PC needs no power-up operations */
+       err = dhd_bus_register();
+#endif // endif
+
+       return err;
+}
+#else /* BCMSDIO */
+static int dhd_wifi_platform_load_sdio(void)
+{
+       return 0;
+}
+#endif /* BCMSDIO */
+
+#ifdef BCMDBUS
+static int dhd_wifi_platform_load_usb(void)
+{
+       int err = 0;
+#if !defined(DHD_PRELOAD)
+       wifi_adapter_info_t *adapter;
+       s32 timeout = -1;
+       int i;
+       enum wifi_adapter_status wait_status;
+#endif
+
+       err = dhd_bus_register();
+       if (err) {
+               DHD_ERROR(("%s: usb_register failed\n", __FUNCTION__));
+               goto exit;
+       }
+
+#if !defined(DHD_PRELOAD)
+       /* power up all adapters */
+       for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+               adapter = &dhd_wifi_platdata->adapters[i];
+               DHD_ERROR(("Power-up adapter '%s'\n", adapter->name));
+               DHD_INFO((" - irq %d [flags %d], firmware: %s, nvram: %s\n",
+                       adapter->irq_num, adapter->intr_flags, adapter->fw_path, adapter->nv_path));
+               DHD_INFO((" - bus type %d, bus num %d, slot num %d\n\n",
+                       adapter->bus_type, adapter->bus_num, adapter->slot_num));
+               err = wifi_platform_set_power(adapter, TRUE, WIFI_TURNON_DELAY);
+               if (err) {
+                       DHD_ERROR(("failed to wifi_platform_set_power on %s\n", adapter->name));
+                       goto fail;
+               }
+               if (dhd_download_fw_on_driverload)
+                       wait_status = WIFI_STATUS_ATTACH;
+               else
+                       wait_status = WIFI_STATUS_DETTACH;
+               timeout = wait_event_interruptible_timeout(adapter->status_event,
+                       wifi_get_adapter_status(adapter, wait_status),
+                       msecs_to_jiffies(DHD_REGISTRATION_TIMEOUT));
+               if (timeout <= 0) {
+                       err = -1;
+                       DHD_ERROR(("%s: usb_register_driver timeout\n", __FUNCTION__));
+                       goto fail;
+               }
+       }
+#endif
+
+exit:
+       return err;
+
+#if !defined(DHD_PRELOAD)
+fail:
+       dhd_bus_unregister();
+       /* power down all adapters */
+       for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+               adapter = &dhd_wifi_platdata->adapters[i];
+               wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+       }
+
+       return err;
+#endif
+}
+#else /* BCMDBUS */
+static int dhd_wifi_platform_load_usb(void)
+{
+       return 0;
+}
+#endif /* BCMDBUS */
+
+static int dhd_wifi_platform_load()
+{
+       int err = 0;
+       printf("%s: Enter\n", __FUNCTION__);
+
+       wl_android_init();
+
+       if ((err = dhd_wifi_platform_load_usb()))
+               goto end;
+       else if ((err = dhd_wifi_platform_load_sdio()))
+               goto end;
+       else
+               err = dhd_wifi_platform_load_pcie();
+
+end:
+       if (err)
+               wl_android_exit();
+#if !defined(MULTIPLE_SUPPLICANT)
+       else
+               wl_android_post_init();
+#endif
+
+       return err;
+}
diff --git a/bcmdhd.101.10.240.x/dhd_linux_priv.h b/bcmdhd.101.10.240.x/dhd_linux_priv.h
new file mode 100644 (file)
index 0000000..4c2604f
--- /dev/null
@@ -0,0 +1,456 @@
+/*
+ * DHD Linux header file - contains private structure definition of the Linux specific layer
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef __DHD_LINUX_PRIV_H__
+#define __DHD_LINUX_PRIV_H__
+
+#include <osl.h>
+
+#ifdef SHOW_LOGTRACE
+#include <linux/syscalls.h>
+#include <event_log.h>
+#endif /* SHOW_LOGTRACE */
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#ifdef CONFIG_COMPAT
+#include <linux/compat.h>
+#endif /* CONFIG COMPAT */
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <dhd_debug.h>
+#include <dhd_linux.h>
+#include <dhd_bus.h>
+
+#ifdef PCIE_FULL_DONGLE
+#include <bcmmsgbuf.h>
+#include <dhd_flowring.h>
+#endif /* PCIE_FULL_DONGLE */
+
+/*
+ * Do not include this header except for the dhd_linux.c dhd_linux_sysfs.c
+ * Local private structure (extension of pub)
+ */
+typedef struct dhd_info {
+#if defined(WL_WIRELESS_EXT)
+       wl_iw_t         iw;             /* wireless extensions state (must be first) */
+#endif /* defined(WL_WIRELESS_EXT) */
+       dhd_pub_t pub;
+       /* for supporting multiple interfaces.
+       * static_ifs hold the net ifaces without valid FW IF
+       */
+       dhd_if_t *iflist[DHD_MAX_IFS + DHD_MAX_STATIC_IFS];
+       wifi_adapter_info_t *adapter;                   /* adapter information, interrupt, fw path etc. */
+       char fw_path[PATH_MAX];         /* path to firmware image */
+       char nv_path[PATH_MAX];         /* path to nvram vars file */
+       char clm_path[PATH_MAX];                /* path to clm vars file */
+       char conf_path[PATH_MAX];       /* path to config vars file */
+#ifdef DHD_UCODE_DOWNLOAD
+       char uc_path[PATH_MAX]; /* path to ucode image */
+#endif /* DHD_UCODE_DOWNLOAD */
+
+       /* serialize dhd iovars */
+       struct mutex dhd_iovar_mutex;
+
+       struct semaphore proto_sem;
+#ifdef PROP_TXSTATUS
+       spinlock_t      wlfc_spinlock;
+
+#ifdef BCMDBUS
+       ulong           wlfc_lock_flags;
+       ulong           wlfc_pub_lock_flags;
+#endif /* BCMDBUS */
+#endif /* PROP_TXSTATUS */
+       wait_queue_head_t ioctl_resp_wait;
+       wait_queue_head_t d3ack_wait;
+       wait_queue_head_t dhd_bus_busy_state_wait;
+       wait_queue_head_t dmaxfer_wait;
+       uint32  default_wd_interval;
+
+       timer_list_compat_t timer;
+       bool wd_timer_valid;
+#ifdef DHD_PCIE_RUNTIMEPM
+       timer_list_compat_t rpm_timer;
+       bool rpm_timer_valid;
+       tsk_ctl_t         thr_rpm_ctl;
+#endif /* DHD_PCIE_RUNTIMEPM */
+       struct tasklet_struct tasklet;
+       spinlock_t      sdlock;
+       spinlock_t      txqlock;
+       spinlock_t      dhd_lock;
+#ifdef BCMDBUS
+       ulong           txqlock_flags;
+#else
+
+       struct semaphore sdsem;
+       tsk_ctl_t       thr_dpc_ctl;
+       tsk_ctl_t       thr_wdt_ctl;
+#endif /* BCMDBUS */
+
+       tsk_ctl_t       thr_rxf_ctl;
+       spinlock_t      rxf_lock;
+       bool            rxthread_enabled;
+
+       /* Wakelocks */
+#if defined(CONFIG_HAS_WAKELOCK)
+       struct wake_lock wl_wifi;   /* Wifi wakelock */
+       struct wake_lock wl_rxwake; /* Wifi rx wakelock */
+       struct wake_lock wl_ctrlwake; /* Wifi ctrl wakelock */
+       struct wake_lock wl_wdwake; /* Wifi wd wakelock */
+       struct wake_lock wl_evtwake; /* Wifi event wakelock */
+       struct wake_lock wl_pmwake;   /* Wifi pm handler wakelock */
+       struct wake_lock wl_txflwake; /* Wifi tx flow wakelock */
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       struct wake_lock wl_intrwake; /* Host wakeup wakelock */
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef DHD_USE_SCAN_WAKELOCK
+       struct wake_lock wl_scanwake;  /* Wifi scan wakelock */
+#endif /* DHD_USE_SCAN_WAKELOCK */
+       struct wake_lock wl_nanwake; /* NAN wakelock */
+#endif /* CONFIG_HAS_WAKELOCK */
+
+       /* net_device interface lock, prevent race conditions among net_dev interface
+        * calls and wifi_on or wifi_off
+        */
+       struct mutex dhd_net_if_mutex;
+       struct mutex dhd_suspend_mutex;
+#if defined(PKT_FILTER_SUPPORT) && defined(APF)
+       struct mutex dhd_apf_mutex;
+#endif /* PKT_FILTER_SUPPORT && APF */
+       spinlock_t wakelock_spinlock;
+       spinlock_t wakelock_evt_spinlock;
+       uint32 wakelock_counter;
+       int wakelock_wd_counter;
+       int wakelock_rx_timeout_enable;
+       int wakelock_ctrl_timeout_enable;
+       bool waive_wakelock;
+       uint32 wakelock_before_waive;
+
+       /* Thread to issue ioctl for multicast */
+       wait_queue_head_t ctrl_wait;
+       atomic_t pend_8021x_cnt;
+       dhd_attach_states_t dhd_state;
+#ifdef SHOW_LOGTRACE
+       dhd_event_log_t event_data;
+#endif /* SHOW_LOGTRACE */
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+       struct early_suspend early_suspend;
+#endif /* CONFIG_HAS_EARLYSUSPEND && DHD_USE_EARLYSUSPEND */
+
+#ifdef ARP_OFFLOAD_SUPPORT
+       u32 pend_ipaddr;
+#endif /* ARP_OFFLOAD_SUPPORT */
+#ifdef DHDTCPACK_SUPPRESS
+       spinlock_t      tcpack_lock;
+#endif /* DHDTCPACK_SUPPRESS */
+#ifdef FIX_CPU_MIN_CLOCK
+       bool cpufreq_fix_status;
+       struct mutex cpufreq_fix;
+       struct pm_qos_request dhd_cpu_qos;
+#ifdef FIX_BUS_MIN_CLOCK
+       struct pm_qos_request dhd_bus_qos;
+#endif /* FIX_BUS_MIN_CLOCK */
+#endif /* FIX_CPU_MIN_CLOCK */
+       void                    *dhd_deferred_wq;
+#ifdef DEBUG_CPU_FREQ
+       struct notifier_block freq_trans;
+       int __percpu *new_freq;
+#endif
+       unsigned int unit;
+       struct notifier_block pm_notifier;
+#ifdef DHD_PSTA
+       uint32  psta_mode;      /* PSTA or PSR */
+#endif /* DHD_PSTA */
+#ifdef DHD_WET
+               uint32  wet_mode;
+#endif /* DHD_WET */
+#ifdef DHD_DEBUG
+       dhd_dump_t *dump;
+       timer_list_compat_t join_timer;
+       u32 join_timeout_val;
+       bool join_timer_active;
+       uint scan_time_count;
+       timer_list_compat_t scan_timer;
+       bool scan_timer_active;
+#endif
+#if defined(DHD_LB)
+       /* CPU Load Balance dynamic CPU selection */
+
+       /* Variable that tracks the currect CPUs available for candidacy */
+       cpumask_var_t cpumask_curr_avail;
+
+       /* Primary and secondary CPU mask */
+       cpumask_var_t cpumask_primary, cpumask_secondary; /* configuration */
+       cpumask_var_t cpumask_primary_new, cpumask_secondary_new; /* temp */
+
+       struct notifier_block cpu_notifier;
+
+       /* Tasklet to handle Tx Completion packet freeing */
+       struct tasklet_struct tx_compl_tasklet;
+       atomic_t                   tx_compl_cpu;
+
+       /* Tasklet to handle RxBuf Post during Rx completion */
+       struct tasklet_struct rx_compl_tasklet;
+       atomic_t                   rx_compl_cpu;
+
+       /* Napi struct for handling rx packet sendup. Packets are removed from
+        * H2D RxCompl ring and placed into rx_pend_queue. rx_pend_queue is then
+        * appended to rx_napi_queue (w/ lock) and the rx_napi_struct is scheduled
+        * to run to rx_napi_cpu.
+        */
+       struct sk_buff_head   rx_pend_queue  ____cacheline_aligned;
+       struct sk_buff_head   rx_napi_queue  ____cacheline_aligned;
+       struct sk_buff_head   rx_process_queue  ____cacheline_aligned;
+       struct napi_struct    rx_napi_struct ____cacheline_aligned;
+       atomic_t                   rx_napi_cpu; /* cpu on which the napi is dispatched */
+       struct net_device    *rx_napi_netdev; /* netdev of primary interface */
+
+       struct work_struct    rx_napi_dispatcher_work;
+       struct work_struct        tx_compl_dispatcher_work;
+       struct work_struct    tx_dispatcher_work;
+       struct work_struct        rx_compl_dispatcher_work;
+
+       /* Number of times DPC Tasklet ran */
+       uint32  dhd_dpc_cnt;
+       /* Number of times NAPI processing got scheduled */
+       uint32  napi_sched_cnt;
+       /* Number of times NAPI processing ran on each available core */
+       uint32  *napi_percpu_run_cnt;
+       /* Number of times RX Completions got scheduled */
+       uint32  rxc_sched_cnt;
+       /* Number of times RX Completion ran on each available core */
+       uint32  *rxc_percpu_run_cnt;
+       /* Number of times TX Completions got scheduled */
+       uint32  txc_sched_cnt;
+       /* Number of times TX Completions ran on each available core */
+       uint32  *txc_percpu_run_cnt;
+       /* CPU status */
+       /* Number of times each CPU came online */
+       uint32  *cpu_online_cnt;
+       /* Number of times each CPU went offline */
+       uint32  *cpu_offline_cnt;
+
+       /* Number of times TX processing run on each core */
+       uint32  *txp_percpu_run_cnt;
+       /* Number of times TX start run on each core */
+       uint32  *tx_start_percpu_run_cnt;
+
+       /* Tx load balancing */
+
+       /* TODO: Need to see if batch processing is really required in case of TX
+        * processing. In case of RX the Dongle can send a bunch of rx completions,
+        * hence we took a 3 queue approach
+        * enque - adds the skbs to rx_pend_queue
+        * dispatch - uses a lock and adds the list of skbs from pend queue to
+        *            napi queue
+        * napi processing - copies the pend_queue into a local queue and works
+        * on it.
+        * But for TX its going to be 1 skb at a time, so we are just thinking
+        * of using only one queue and use the lock supported skb queue functions
+        * to add and process it. If its in-efficient we'll re-visit the queue
+        * design.
+        */
+
+       /* When the NET_TX tries to send a TX packet put it into tx_pend_queue */
+       /* struct sk_buff_head          tx_pend_queue  ____cacheline_aligned;  */
+       /*
+        * From the Tasklet that actually sends out data
+        * copy the list tx_pend_queue into tx_active_queue. There by we need
+        * to spinlock to only perform the copy the rest of the code ie to
+        * construct the tx_pend_queue and the code to process tx_active_queue
+        * can be lockless. The concept is borrowed as is from RX processing
+        */
+       /* struct sk_buff_head          tx_active_queue  ____cacheline_aligned; */
+
+       /* Control TXP in runtime, enable by default */
+       atomic_t                lb_txp_active;
+
+       /* Control RXP in runtime, enable by default */
+       atomic_t                lb_rxp_active;
+
+       /*
+        * When the NET_TX tries to send a TX packet put it into tx_pend_queue
+        * For now, the processing tasklet will also direcly operate on this
+        * queue
+        */
+       struct sk_buff_head     tx_pend_queue  ____cacheline_aligned;
+
+       /* cpu on which the DHD Tx is happenning */
+       atomic_t                tx_cpu;
+
+       /* CPU on which the Network stack is calling the DHD's xmit function */
+       atomic_t                net_tx_cpu;
+
+       /* Tasklet context from which the DHD's TX processing happens */
+       struct tasklet_struct tx_tasklet;
+
+       /* CPU on which the DHD DPC is running */
+       atomic_t                dpc_cpu;
+
+       /*
+        * Consumer Histogram - NAPI RX Packet processing
+        * -----------------------------------------------
+        * On Each CPU, when the NAPI RX Packet processing call back was invoked
+        * how many packets were processed is captured in this data structure.
+        * Now its difficult to capture the "exact" number of packets processed.
+        * So considering the packet counter to be a 32 bit one, we have a
+        * bucket with 8 bins (2^1, 2^2 ... 2^8). The "number" of packets
+        * processed is rounded off to the next power of 2 and put in the
+        * approriate "bin" the value in the bin gets incremented.
+        * For example, assume that in CPU 1 if NAPI Rx runs 3 times
+        * and the packet count processed is as follows (assume the bin counters are 0)
+        * iteration 1 - 10 (the bin counter 2^4 increments to 1)
+        * iteration 2 - 30 (the bin counter 2^5 increments to 1)
+        * iteration 3 - 15 (the bin counter 2^4 increments by 1 to become 2)
+        */
+       uint32 *napi_rx_hist[HIST_BIN_SIZE];
+       uint32 *txc_hist[HIST_BIN_SIZE];
+       uint32 *rxc_hist[HIST_BIN_SIZE];
+#endif /* DHD_LB */
+#if defined(DNGL_AXI_ERROR_LOGGING) && defined(DHD_USE_WQ_FOR_DNGL_AXI_ERROR)
+       struct work_struct        axi_error_dispatcher_work;
+#endif /* DNGL_AXI_ERROR_LOGGING && DHD_USE_WQ_FOR_DNGL_AXI_ERROR */
+#ifdef SHOW_LOGTRACE
+#ifdef DHD_USE_KTHREAD_FOR_LOGTRACE
+       tsk_ctl_t         thr_logtrace_ctl;
+#else
+       struct delayed_work       event_log_dispatcher_work;
+#endif /* DHD_USE_KTHREAD_FOR_LOGTRACE */
+#endif /* SHOW_LOGTRACE */
+
+#ifdef EWP_EDL
+       struct delayed_work edl_dispatcher_work;
+#endif
+#if defined(WLAN_ACCEL_BOOT)
+       int fs_check_retry;
+       struct delayed_work wl_accel_work;
+       bool wl_accel_force_reg_on;
+       bool wl_accel_boot_on_done;
+#endif
+#if defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW)
+#endif /* defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW) */
+       struct kobject dhd_kobj;
+       timer_list_compat_t timesync_timer;
+#if defined(BT_OVER_SDIO)
+    char btfw_path[PATH_MAX];
+#endif /* defined (BT_OVER_SDIO) */
+#ifdef WL_MONITOR
+       struct net_device *monitor_dev; /* monitor pseudo device */
+       struct sk_buff *monitor_skb;
+       uint    monitor_len;
+       uint    monitor_type;   /* monitor pseudo device */
+#endif /* WL_MONITOR */
+#if defined(BT_OVER_SDIO)
+    struct mutex bus_user_lock; /* lock for sdio bus apis shared between WLAN & BT */
+    int     bus_user_count; /* User counts of sdio bus shared between WLAN & BT */
+#endif /* BT_OVER_SDIO */
+#ifdef SHOW_LOGTRACE
+       struct sk_buff_head   evt_trace_queue     ____cacheline_aligned;
+#endif
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       struct workqueue_struct *tx_wq;
+       struct workqueue_struct *rx_wq;
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+#ifdef PCIE_INB_DW
+       wait_queue_head_t ds_exit_wait;
+#endif /* PCIE_INB_DW */
+#ifdef DHD_DEBUG_UART
+       bool duart_execute;
+#endif /* DHD_DEBUG_UART */
+       struct mutex logdump_lock;
+#if defined(DHD_MQ) && defined(DHD_MQ_STATS)
+       uint64 pktcnt_qac_histo[MQ_MAX_QUEUES][AC_COUNT];
+       uint64 pktcnt_per_ac[AC_COUNT];
+       uint64 cpu_qstats[MQ_MAX_QUEUES][MQ_MAX_CPUS];
+#endif /* DHD_MQ && DHD_MQ_STATS */
+       /* indicates mem_dump was scheduled as work queue or called directly */
+       bool scheduled_memdump;
+       struct work_struct dhd_hang_process_work;
+} dhd_info_t;
+
+#ifdef WL_MONITOR
+#define MONPKT_EXTRA_LEN       48u
+#endif /* WL_MONITOR */
+
+extern int dhd_sysfs_init(dhd_info_t *dhd);
+extern void dhd_sysfs_exit(dhd_info_t *dhd);
+extern void dhd_dbg_ring_proc_create(dhd_pub_t *dhdp);
+extern void dhd_dbg_ring_proc_destroy(dhd_pub_t *dhdp);
+
+int __dhd_sendpkt(dhd_pub_t *dhdp, int ifidx, void *pktbuf);
+
+#if defined(DHD_LB)
+#if defined(DHD_LB_TXP)
+int dhd_lb_sendpkt(dhd_info_t *dhd, struct net_device *net, int ifidx, void *skb);
+void dhd_tx_dispatcher_work(struct work_struct * work);
+void dhd_tx_dispatcher_fn(dhd_pub_t *dhdp);
+void dhd_lb_tx_dispatch(dhd_pub_t *dhdp);
+void dhd_lb_tx_handler(unsigned long data);
+#endif /* DHD_LB_TXP */
+
+#if defined(DHD_LB_RXP)
+int dhd_napi_poll(struct napi_struct *napi, int budget);
+void dhd_rx_napi_dispatcher_work(struct work_struct * work);
+void dhd_lb_rx_napi_dispatch(dhd_pub_t *dhdp);
+void dhd_lb_rx_pkt_enqueue(dhd_pub_t *dhdp, void *pkt, int ifidx);
+unsigned long dhd_read_lb_rxp(dhd_pub_t *dhdp);
+#endif /* DHD_LB_RXP */
+
+void dhd_lb_set_default_cpus(dhd_info_t *dhd);
+void dhd_cpumasks_deinit(dhd_info_t *dhd);
+int dhd_cpumasks_init(dhd_info_t *dhd);
+
+void dhd_select_cpu_candidacy(dhd_info_t *dhd);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 10, 0))
+int dhd_cpu_startup_callback(unsigned int cpu);
+int dhd_cpu_teardown_callback(unsigned int cpu);
+#else
+int dhd_cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu);
+#endif /* LINUX_VERSION_CODE < 4.10.0 */
+
+int dhd_register_cpuhp_callback(dhd_info_t *dhd);
+int dhd_unregister_cpuhp_callback(dhd_info_t *dhd);
+
+#if defined(DHD_LB_TXC)
+void dhd_lb_tx_compl_dispatch(dhd_pub_t *dhdp);
+#endif /* DHD_LB_TXC */
+
+#if defined(DHD_LB_RXC)
+void dhd_lb_rx_compl_dispatch(dhd_pub_t *dhdp);
+void dhd_rx_compl_dispatcher_fn(struct work_struct * work);
+#endif /* DHD_LB_RXC */
+
+#endif /* DHD_LB */
+
+#if defined(DHD_CONTROL_PCIE_CPUCORE_WIFI_TURNON)
+void dhd_irq_set_affinity(dhd_pub_t *dhdp, const struct cpumask *cpumask);
+#endif /* DHD_CONTROL_PCIE_CPUCORE_WIFI_TURNON */
+#ifdef DHD_SSSR_DUMP
+extern uint sssr_enab;
+extern uint fis_enab;
+#endif /* DHD_SSSR_DUMP */
+#endif /* __DHD_LINUX_PRIV_H__ */
diff --git a/bcmdhd.101.10.240.x/dhd_linux_sched.c b/bcmdhd.101.10.240.x/dhd_linux_sched.c
new file mode 100644 (file)
index 0000000..40cb785
--- /dev/null
@@ -0,0 +1,43 @@
+/*
+ * Expose some of the kernel scheduler routines
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <typedefs.h>
+#include <linuxver.h>
+
+int setScheduler(struct task_struct *p, int policy, struct sched_param *param)
+{
+       int rc = 0;
+       rc = sched_setscheduler(p, policy, param);
+       return rc;
+}
+
+int get_scheduler_policy(struct task_struct *p)
+{
+       int rc = SCHED_NORMAL;
+       rc = p->policy;
+       return rc;
+}
diff --git a/bcmdhd.101.10.240.x/dhd_linux_sock_qos.h b/bcmdhd.101.10.240.x/dhd_linux_sock_qos.h
new file mode 100644 (file)
index 0000000..8e233b7
--- /dev/null
@@ -0,0 +1,71 @@
+/*
+ * Header file for DHD TPA (Traffic Pattern Analyzer)
+ *
+ * Provides type definitions and function prototypes to call into
+ * DHD's QOS on Socket Flow module.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ *
+ */
+
+#ifndef _DHD_LINUX_TPA_H_
+#define _DHD_LINUX_TPA_H_
+
+struct dhd_sock_flow_info;
+
+/* Feature Disabled dummy implementations */
+
+inline int dhd_init_sock_flows_buf(dhd_info_t *dhd, uint watchdog_ms)
+{
+               BCM_REFERENCE(dhd);
+               return BCME_UNSUPPORTED;
+}
+
+inline int dhd_deinit_sock_flows_buf(dhd_info_t *dhd)
+{
+               BCM_REFERENCE(dhd);
+               return BCME_UNSUPPORTED;
+}
+
+inline void dhd_update_sock_flows(dhd_info_t *dhd, struct sk_buff *skb)
+{
+               BCM_REFERENCE(dhd);
+               BCM_REFERENCE(skb);
+               return;
+}
+
+inline void dhd_analyze_sock_flows(dhd_info_t *dhd, uint32 watchdog_ms)
+{
+       BCM_REFERENCE(dhd);
+       BCM_REFERENCE(dhd_watchdog_ms);
+       return;
+}
+
+inline void dhd_sock_qos_update_bus_flowid(dhd_info_t *dhd, void *pktbuf,
+       uint32 bus_flow_id)
+{
+       BCM_REFERENCE(dhd);
+       BCM_REFERENCE(pktbuf);
+       BCM_REFERENCE(bus_flow_id);
+}
+
+#endif /* _DHD_LINUX_TPA_H_ */
diff --git a/bcmdhd.101.10.240.x/dhd_linux_wq.c b/bcmdhd.101.10.240.x/dhd_linux_wq.c
new file mode 100644 (file)
index 0000000..72d3078
--- /dev/null
@@ -0,0 +1,405 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Generic work queue framework
+ * Generic interface to handle dhd deferred work events
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/spinlock.h>
+#include <linux/fcntl.h>
+#include <linux/fs.h>
+#include <linux/ip.h>
+#include <linux/kfifo.h>
+
+#include <linuxver.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmdevs.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <dhd_linux_wq.h>
+
+/*
+ * XXX: always make sure that the size of this structure is aligned to
+ * the power of 2 (2^n) i.e, if any new variable has to be added then
+ * modify the padding accordingly
+ */
+typedef struct dhd_deferred_event {
+       u8 event;               /* holds the event */
+       void *event_data;       /* holds event specific data */
+       event_handler_t event_handler;
+       unsigned long pad;      /* for memory alignment to power of 2 */
+} dhd_deferred_event_t;
+
+#define DEFRD_EVT_SIZE (sizeof(dhd_deferred_event_t))
+
+/*
+ * work events may occur simultaneously.
+ * can hold upto 64 low priority events and 16 high priority events
+ */
+#define DHD_PRIO_WORK_FIFO_SIZE        (16 * DEFRD_EVT_SIZE)
+#define DHD_WORK_FIFO_SIZE     (64 * DEFRD_EVT_SIZE)
+
+#define DHD_FIFO_HAS_FREE_SPACE(fifo) \
+       ((fifo) && (kfifo_avail(fifo) >= DEFRD_EVT_SIZE))
+#define DHD_FIFO_HAS_ENOUGH_DATA(fifo) \
+       ((fifo) && (kfifo_len(fifo) >= DEFRD_EVT_SIZE))
+
+struct dhd_deferred_wq {
+       struct work_struct deferred_work; /* should be the first member */
+
+       struct kfifo *prio_fifo;
+       struct kfifo                    *work_fifo;
+       u8                              *prio_fifo_buf;
+       u8                              *work_fifo_buf;
+       spinlock_t                      work_lock;
+       void                            *dhd_info; /* review: does it require */
+       u32                             event_skip_mask;
+};
+
+static inline struct kfifo*
+dhd_kfifo_init(u8 *buf, int size, spinlock_t *lock)
+{
+       struct kfifo *fifo;
+       gfp_t flags = CAN_SLEEP()? GFP_KERNEL : GFP_ATOMIC;
+
+       fifo = (struct kfifo *)kzalloc(sizeof(struct kfifo), flags);
+       if (!fifo) {
+               return NULL;
+       }
+       kfifo_init(fifo, buf, size);
+       return fifo;
+}
+
+static inline void
+dhd_kfifo_free(struct kfifo *fifo)
+{
+       kfifo_free(fifo);
+       kfree(fifo);
+}
+
+/* deferred work functions */
+static void dhd_deferred_work_handler(struct work_struct *data);
+
+void*
+dhd_deferred_work_init(void *dhd_info)
+{
+       struct dhd_deferred_wq  *work = NULL;
+       u8*     buf;
+       unsigned long   fifo_size = 0;
+       gfp_t   flags = CAN_SLEEP()? GFP_KERNEL : GFP_ATOMIC;
+
+       if (!dhd_info) {
+               DHD_ERROR(("%s: dhd info not initialized\n", __FUNCTION__));
+               goto return_null;
+       }
+
+       work = (struct dhd_deferred_wq *)kzalloc(sizeof(struct dhd_deferred_wq),
+               flags);
+       if (!work) {
+               DHD_ERROR(("%s: work queue creation failed\n", __FUNCTION__));
+               goto return_null;
+       }
+
+       INIT_WORK((struct work_struct *)work, dhd_deferred_work_handler);
+
+       /* initialize event fifo */
+       spin_lock_init(&work->work_lock);
+
+       /* allocate buffer to hold prio events */
+       fifo_size = DHD_PRIO_WORK_FIFO_SIZE;
+       fifo_size = is_power_of_2(fifo_size) ? fifo_size :
+                       roundup_pow_of_two(fifo_size);
+       buf = (u8*)kzalloc(fifo_size, flags);
+       if (!buf) {
+               DHD_ERROR(("%s: prio work fifo allocation failed\n",
+                       __FUNCTION__));
+               goto return_null;
+       }
+
+       /* Initialize prio event fifo */
+       work->prio_fifo = dhd_kfifo_init(buf, fifo_size, &work->work_lock);
+       if (!work->prio_fifo) {
+               kfree(buf);
+               goto return_null;
+       }
+
+       /* allocate buffer to hold work events */
+       fifo_size = DHD_WORK_FIFO_SIZE;
+       fifo_size = is_power_of_2(fifo_size) ? fifo_size :
+                       roundup_pow_of_two(fifo_size);
+       buf = (u8*)kzalloc(fifo_size, flags);
+       if (!buf) {
+               DHD_ERROR(("%s: work fifo allocation failed\n", __FUNCTION__));
+               goto return_null;
+       }
+
+       /* Initialize event fifo */
+       work->work_fifo = dhd_kfifo_init(buf, fifo_size, &work->work_lock);
+       if (!work->work_fifo) {
+               kfree(buf);
+               goto return_null;
+       }
+
+       work->dhd_info = dhd_info;
+       work->event_skip_mask = 0;
+       DHD_ERROR(("%s: work queue initialized\n", __FUNCTION__));
+       return work;
+
+return_null:
+       if (work) {
+               dhd_deferred_work_deinit(work);
+       }
+
+       return NULL;
+}
+
+void
+dhd_deferred_work_deinit(void *work)
+{
+       struct dhd_deferred_wq *deferred_work = work;
+
+       if (!deferred_work) {
+               DHD_ERROR(("%s: deferred work has been freed already\n",
+                       __FUNCTION__));
+               return;
+       }
+
+       /* cancel the deferred work handling */
+       cancel_work_sync((struct work_struct *)deferred_work);
+
+       /*
+        * free work event fifo.
+        * kfifo_free frees locally allocated fifo buffer
+        */
+       if (deferred_work->prio_fifo) {
+               dhd_kfifo_free(deferred_work->prio_fifo);
+       }
+
+       if (deferred_work->work_fifo) {
+               dhd_kfifo_free(deferred_work->work_fifo);
+       }
+
+       kfree(deferred_work);
+}
+
+/* select kfifo according to priority */
+static inline struct kfifo *
+dhd_deferred_work_select_kfifo(struct dhd_deferred_wq *deferred_wq,
+       u8 priority)
+{
+       if (priority == DHD_WQ_WORK_PRIORITY_HIGH) {
+               return deferred_wq->prio_fifo;
+       } else if (priority == DHD_WQ_WORK_PRIORITY_LOW) {
+               return deferred_wq->work_fifo;
+       } else {
+               return NULL;
+       }
+}
+
+/*
+ *     Prepares event to be queued
+ *     Schedules the event
+ */
+int
+dhd_deferred_schedule_work(void *workq, void *event_data, u8 event,
+       event_handler_t event_handler, u8 priority)
+{
+       struct dhd_deferred_wq *deferred_wq = (struct dhd_deferred_wq *)workq;
+       struct kfifo *fifo;
+       dhd_deferred_event_t deferred_event;
+       int bytes_copied = 0;
+
+       if (!deferred_wq) {
+               DHD_ERROR(("%s: work queue not initialized\n", __FUNCTION__));
+               ASSERT(0);
+               return DHD_WQ_STS_UNINITIALIZED;
+       }
+
+       if (!event || (event >= DHD_MAX_WQ_EVENTS)) {
+               DHD_ERROR(("%s: unknown event, event=%d\n", __FUNCTION__,
+                       event));
+               return DHD_WQ_STS_UNKNOWN_EVENT;
+       }
+
+       if (!priority || (priority >= DHD_WQ_MAX_PRIORITY)) {
+               DHD_ERROR(("%s: unknown priority, priority=%d\n",
+                       __FUNCTION__, priority));
+               return DHD_WQ_STS_UNKNOWN_PRIORITY;
+       }
+
+       if ((deferred_wq->event_skip_mask & (1 << event))) {
+               DHD_ERROR(("%s: Skip event requested. Mask = 0x%x\n",
+                       __FUNCTION__, deferred_wq->event_skip_mask));
+               return DHD_WQ_STS_EVENT_SKIPPED;
+       }
+
+       /*
+        * default element size is 1, which can be changed
+        * using kfifo_esize(). Older kernel(FC11) doesn't support
+        * changing element size. For compatibility changing
+        * element size is not prefered
+        */
+       ASSERT(kfifo_esize(deferred_wq->prio_fifo) == 1);
+       ASSERT(kfifo_esize(deferred_wq->work_fifo) == 1);
+
+       deferred_event.event = event;
+       deferred_event.event_data = event_data;
+       deferred_event.event_handler = event_handler;
+
+       fifo = dhd_deferred_work_select_kfifo(deferred_wq, priority);
+       if (DHD_FIFO_HAS_FREE_SPACE(fifo)) {
+               bytes_copied = kfifo_in_spinlocked(fifo, &deferred_event,
+                       DEFRD_EVT_SIZE, &deferred_wq->work_lock);
+       }
+       if (bytes_copied != DEFRD_EVT_SIZE) {
+               DHD_ERROR(("%s: failed to schedule deferred work, "
+                       "priority=%d, bytes_copied=%d\n", __FUNCTION__,
+                       priority, bytes_copied));
+               return DHD_WQ_STS_SCHED_FAILED;
+       }
+       schedule_work((struct work_struct *)deferred_wq);
+       return DHD_WQ_STS_OK;
+}
+
+static bool
+dhd_get_scheduled_work(struct dhd_deferred_wq *deferred_wq,
+       dhd_deferred_event_t *event)
+{
+       int bytes_copied = 0;
+
+       if (!deferred_wq) {
+               DHD_ERROR(("%s: work queue not initialized\n", __FUNCTION__));
+               return DHD_WQ_STS_UNINITIALIZED;
+       }
+
+       /*
+        * default element size is 1 byte, which can be changed
+        * using kfifo_esize(). Older kernel(FC11) doesn't support
+        * changing element size. For compatibility changing
+        * element size is not prefered
+        */
+       ASSERT(kfifo_esize(deferred_wq->prio_fifo) == 1);
+       ASSERT(kfifo_esize(deferred_wq->work_fifo) == 1);
+
+       /* handle priority work */
+       if (DHD_FIFO_HAS_ENOUGH_DATA(deferred_wq->prio_fifo)) {
+               bytes_copied = kfifo_out_spinlocked(deferred_wq->prio_fifo,
+                       event, DEFRD_EVT_SIZE, &deferred_wq->work_lock);
+       }
+
+       /* handle normal work if priority work doesn't have enough data */
+       if ((bytes_copied != DEFRD_EVT_SIZE) &&
+               DHD_FIFO_HAS_ENOUGH_DATA(deferred_wq->work_fifo)) {
+               bytes_copied = kfifo_out_spinlocked(deferred_wq->work_fifo,
+                       event, DEFRD_EVT_SIZE, &deferred_wq->work_lock);
+       }
+
+       return (bytes_copied == DEFRD_EVT_SIZE);
+}
+
+static inline void
+dhd_deferred_dump_work_event(dhd_deferred_event_t *work_event)
+{
+       if (!work_event) {
+               DHD_ERROR(("%s: work_event is null\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_ERROR(("%s: work_event->event = %d\n", __FUNCTION__,
+               work_event->event));
+       DHD_ERROR(("%s: work_event->event_data = %p\n", __FUNCTION__,
+               work_event->event_data));
+       DHD_ERROR(("%s: work_event->event_handler = %p\n", __FUNCTION__,
+               work_event->event_handler));
+}
+
+/*
+ *     Called when work is scheduled
+ */
+static void
+dhd_deferred_work_handler(struct work_struct *work)
+{
+       struct dhd_deferred_wq *deferred_work = (struct dhd_deferred_wq *)work;
+       dhd_deferred_event_t work_event;
+
+       if (!deferred_work) {
+               DHD_ERROR(("%s: work queue not initialized\n", __FUNCTION__));
+               return;
+       }
+
+       do {
+               if (!dhd_get_scheduled_work(deferred_work, &work_event)) {
+                       DHD_TRACE(("%s: no event to handle\n", __FUNCTION__));
+                       break;
+               }
+
+               if (work_event.event >= DHD_MAX_WQ_EVENTS) {
+                       DHD_ERROR(("%s: unknown event\n", __FUNCTION__));
+                       dhd_deferred_dump_work_event(&work_event);
+                       ASSERT(work_event.event < DHD_MAX_WQ_EVENTS);
+                       continue;
+               }
+
+               /*
+                * XXX: don't do NULL check for 'work_event.event_data'
+                * as for some events like DHD_WQ_WORK_DHD_LOG_DUMP the
+                * event data is always NULL even though rest of the
+                * event parameters are valid
+                */
+
+               if (work_event.event_handler) {
+                       work_event.event_handler(deferred_work->dhd_info,
+                               work_event.event_data, work_event.event);
+               } else {
+                       DHD_ERROR(("%s: event handler is null\n",
+                               __FUNCTION__));
+                       dhd_deferred_dump_work_event(&work_event);
+                       ASSERT(work_event.event_handler != NULL);
+               }
+       } while (1);
+
+       return;
+}
+
+void
+dhd_deferred_work_set_skip(void *work, u8 event, bool set)
+{
+       struct dhd_deferred_wq *deferred_wq = (struct dhd_deferred_wq *)work;
+
+       if (!deferred_wq || !event || (event >= DHD_MAX_WQ_EVENTS)) {
+               DHD_ERROR(("%s: Invalid!!\n", __FUNCTION__));
+               return;
+       }
+
+       if (set) {
+               /* Set */
+               deferred_wq->event_skip_mask |= (1 << event);
+       } else {
+               /* Clear */
+               deferred_wq->event_skip_mask &= ~(1 << event);
+       }
+}
diff --git a/bcmdhd.101.10.240.x/dhd_linux_wq.h b/bcmdhd.101.10.240.x/dhd_linux_wq.h
new file mode 100644 (file)
index 0000000..984ac92
--- /dev/null
@@ -0,0 +1,88 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Generic work queue framework
+ * Generic interface to handle dhd deferred work events
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+#ifndef _dhd_linux_wq_h_
+#define _dhd_linux_wq_h_
+/*
+ *     Work event definitions
+ */
+enum _wq_event {
+       DHD_WQ_WORK_IF_ADD = 1,
+       DHD_WQ_WORK_IF_DEL,
+       DHD_WQ_WORK_SET_MAC,
+       DHD_WQ_WORK_SET_MCAST_LIST,
+       DHD_WQ_WORK_IPV6_NDO,
+       DHD_WQ_WORK_HANG_MSG,
+       DHD_WQ_WORK_DHD_LOG_DUMP,
+       DHD_WQ_WORK_PKTLOG_DUMP,
+       DHD_WQ_WORK_INFORM_DHD_MON,
+       DHD_WQ_WORK_EVENT_LOGTRACE,
+       DHD_WQ_WORK_DMA_LB_MEM_REL,
+       DHD_WQ_WORK_NATOE_EVENT,
+       DHD_WQ_WORK_NATOE_IOCTL,
+       DHD_WQ_WORK_MACDBG,
+       DHD_WQ_WORK_DEBUG_UART_DUMP,
+       DHD_WQ_WORK_GET_BIGDATA_AP,
+       DHD_WQ_WORK_SOC_RAM_DUMP,
+#ifdef DHD_ERPOM
+       DHD_WQ_WORK_ERROR_RECOVERY,
+#endif /* DHD_ERPOM */
+       DHD_WQ_WORK_H2D_CONSOLE_TIME_STAMP_MATCH,
+       DHD_WQ_WORK_AXI_ERROR_DUMP,
+       DHD_WQ_WORK_CTO_RECOVERY,
+#ifdef DHD_UPDATE_INTF_MAC
+       DHD_WQ_WORK_IF_UPDATE,
+#endif /* DHD_UPDATE_INTF_MAC */
+       DHD_MAX_WQ_EVENTS
+};
+
+/*
+ *     Work event priority
+ */
+enum wq_priority {
+       DHD_WQ_WORK_PRIORITY_LOW = 1,
+       DHD_WQ_WORK_PRIORITY_HIGH,
+       DHD_WQ_MAX_PRIORITY
+};
+
+/*
+ *     Error definitions
+ */
+#define DHD_WQ_STS_OK                   0
+#define DHD_WQ_STS_FAILED              -1      /* General failure */
+#define DHD_WQ_STS_UNINITIALIZED       -2
+#define DHD_WQ_STS_SCHED_FAILED                -3
+#define DHD_WQ_STS_UNKNOWN_EVENT       -4
+#define DHD_WQ_STS_UNKNOWN_PRIORITY    -5
+#define DHD_WQ_STS_EVENT_SKIPPED       -6
+
+typedef void (*event_handler_t)(void *handle, void *event_data, u8 event);
+
+void *dhd_deferred_work_init(void *dhd);
+void dhd_deferred_work_deinit(void *workq);
+int dhd_deferred_schedule_work(void *workq, void *event_data, u8 event,
+       event_handler_t evt_handler, u8 priority);
+void dhd_deferred_work_set_skip(void *work, u8 event, bool set);
+#endif /* _dhd_linux_wq_h_ */
diff --git a/bcmdhd.101.10.240.x/dhd_mschdbg.c b/bcmdhd.101.10.240.x/dhd_mschdbg.c
new file mode 100644 (file)
index 0000000..f705688
--- /dev/null
@@ -0,0 +1,786 @@
+/*
+ * DHD debugability support
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_mschdbg.c 639872 2016-05-25 05:39:30Z $
+ */
+#ifdef SHOW_LOGTRACE
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <dhd_debug.h>
+#include <dhd_mschdbg.h>
+
+#include <event_log.h>
+#include <event_trace.h>
+#include <msgtrace.h>
+
+static const char *head_log = "";
+#define MSCH_EVENT_HEAD(space) \
+       do { \
+               MSCH_EVENT(("%s_E:  ", head_log)); \
+               if (space > 0) { \
+                       int ii; \
+                       for (ii = 0; ii < space; ii += 4) MSCH_EVENT(("    ")); \
+               } \
+       } while (0)
+
+#define MSCH_EVENT(args) do {if (dhd_msg_level & DHD_EVENT_VAL) printf args;} while (0)
+
+static uint64 solt_start_time[4], req_start_time[4], profiler_start_time[4];
+static uint32 solt_chanspec[4] = {0, }, req_start[4] = {0, };
+static bool lastMessages = FALSE;
+
+#define US_PRE_SEC             1000000
+#define DATA_UNIT_FOR_LOG_CNT  4
+
+static void dhd_mschdbg_us_to_sec(uint32 time_h, uint32 time_l, uint32 *sec, uint32 *remain)
+{
+       uint64 cur_time = ((uint64)(ntoh32(time_h)) << 32) | ntoh32(time_l);
+       uint64 r, u = 0;
+
+       r = cur_time;
+       while (time_h != 0) {
+               u += (uint64)((0xffffffff / US_PRE_SEC)) * time_h;
+               r = cur_time - u * US_PRE_SEC;
+               time_h = (uint32)(r >> 32);
+       }
+
+       *sec = (uint32)(u + ((uint32)(r) / US_PRE_SEC));
+       *remain = (uint32)(r) % US_PRE_SEC;
+}
+
+static char *dhd_mschdbg_display_time(uint32 time_h, uint32 time_l)
+{
+       static char display_time[32];
+       uint32 s, ss;
+
+       if (time_h == 0xffffffff && time_l == 0xffffffff) {
+               snprintf(display_time, 31, "-1");
+       } else {
+               dhd_mschdbg_us_to_sec(time_h, time_l, &s, &ss);
+               snprintf(display_time, 31, "%d.%06d", s, ss);
+       }
+       return display_time;
+}
+
+static void
+dhd_mschdbg_chanspec_list(int sp, char *data, uint16 ptr, uint16 chanspec_cnt)
+{
+       int i, cnt = (int)ntoh16(chanspec_cnt);
+       uint16 *chanspec_list = (uint16 *)(data + ntoh16(ptr));
+       char buf[CHANSPEC_STR_LEN];
+       chanspec_t c;
+
+       MSCH_EVENT_HEAD(sp);
+       MSCH_EVENT(("<chanspec_list>:"));
+       for (i = 0; i < cnt; i++) {
+               c = (chanspec_t)ntoh16(chanspec_list[i]);
+               MSCH_EVENT((" %s", wf_chspec_ntoa(c, buf)));
+       }
+       MSCH_EVENT(("\n"));
+}
+
+static void
+dhd_mschdbg_elem_list(int sp, char *title, char *data, uint16 ptr, uint16 list_cnt)
+{
+       int i, cnt = (int)ntoh16(list_cnt);
+       uint32 *list = (uint32 *)(data + ntoh16(ptr));
+
+       MSCH_EVENT_HEAD(sp);
+       MSCH_EVENT(("%s_list: ", title));
+       for (i = 0; i < cnt; i++) {
+               MSCH_EVENT(("0x%08x->", ntoh32(list[i])));
+       }
+       MSCH_EVENT(("null\n"));
+}
+
+static void
+dhd_mschdbg_req_param_profiler_event_data(int sp, int ver, char *data, uint16 ptr)
+{
+       int sn = sp + 4;
+       msch_req_param_profiler_event_data_t *p =
+               (msch_req_param_profiler_event_data_t *)(data + ntoh16(ptr));
+       uint32 type, flags;
+
+       MSCH_EVENT_HEAD(sp);
+       MSCH_EVENT(("<request parameters>\n"));
+       MSCH_EVENT_HEAD(sn);
+       MSCH_EVENT(("req_type: "));
+
+       type = p->req_type;
+       if (type < 4) {
+               char *req_type[] = {"fixed", "start-flexible", "duration-flexible",
+                       "both-flexible"};
+               MSCH_EVENT(("%s", req_type[type]));
+       }
+       else
+               MSCH_EVENT(("unknown(%d)", type));
+
+       flags = ntoh16(p->flags);
+       if (flags & WL_MSCH_REQ_FLAGS_CHAN_CONTIGUOUS)
+               MSCH_EVENT((", CHAN_CONTIGUOUS"));
+       if (flags & WL_MSCH_REQ_FLAGS_MERGE_CONT_SLOTS)
+               MSCH_EVENT((", MERGE_CONT_SLOTS"));
+       if (flags & WL_MSCH_REQ_FLAGS_PREMTABLE)
+               MSCH_EVENT((", PREMTABLE"));
+       if (flags & WL_MSCH_REQ_FLAGS_PREMT_CURTS)
+               MSCH_EVENT((", PREMT_CURTS"));
+       if (flags & WL_MSCH_REQ_FLAGS_PREMT_IMMEDIATE)
+               MSCH_EVENT((", PREMT_IMMEDIATE"));
+       MSCH_EVENT((", priority: %d\n", p->priority));
+
+       MSCH_EVENT_HEAD(sn);
+       MSCH_EVENT(("start-time: %s, duration: %d(us), interval: %d(us)\n",
+               dhd_mschdbg_display_time(p->start_time_h, p->start_time_l),
+               ntoh32(p->duration), ntoh32(p->interval)));
+
+       if (type == WL_MSCH_RT_DUR_FLEX) {
+               MSCH_EVENT_HEAD(sn);
+               MSCH_EVENT(("dur_flex: %d(us)\n", ntoh32(p->flex.dur_flex)));
+       } else if (type == WL_MSCH_RT_BOTH_FLEX) {
+               MSCH_EVENT_HEAD(sn);
+               MSCH_EVENT(("min_dur: %d(us), max_away_dur: %d(us)\n",
+                       ntoh32(p->flex.bf.min_dur), ntoh32(p->flex.bf.max_away_dur)));
+
+               MSCH_EVENT_HEAD(sn);
+               MSCH_EVENT(("hi_prio_time: %s, hi_prio_interval: %d(us)\n",
+                       dhd_mschdbg_display_time(p->flex.bf.hi_prio_time_h,
+                       p->flex.bf.hi_prio_time_l),
+                       ntoh32(p->flex.bf.hi_prio_interval)));
+       }
+}
+
+static void
+dhd_mschdbg_timeslot_profiler_event_data(int sp, int ver, char *title, char *data,
+       uint16 ptr, bool empty)
+{
+       int s, sn = sp + 4;
+       msch_timeslot_profiler_event_data_t *p =
+               (msch_timeslot_profiler_event_data_t *)(data + ntoh16(ptr));
+       char *state[] = {"NONE", "CHN_SW", "ONCHAN_FIRE", "OFF_CHN_PREP",
+               "OFF_CHN_DONE", "TS_COMPLETE"};
+
+       MSCH_EVENT_HEAD(sp);
+       MSCH_EVENT(("<%s timeslot>: ", title));
+       if (empty) {
+               MSCH_EVENT((" null\n"));
+               return;
+       }
+       else
+               MSCH_EVENT(("0x%08x\n", ntoh32(p->p_timeslot)));
+
+       s = (int)(ntoh32(p->state));
+       if (s > 5) s = 0;
+
+       MSCH_EVENT_HEAD(sn);
+       MSCH_EVENT(("id: %d, state[%d]: %s, chan_ctxt: [0x%08x]\n",
+               ntoh32(p->timeslot_id), ntoh32(p->state), state[s], ntoh32(p->p_chan_ctxt)));
+
+       MSCH_EVENT_HEAD(sn);
+       MSCH_EVENT(("fire_time: %s",
+               dhd_mschdbg_display_time(p->fire_time_h, p->fire_time_l)));
+
+       MSCH_EVENT((", pre_start_time: %s",
+               dhd_mschdbg_display_time(p->pre_start_time_h, p->pre_start_time_l)));
+
+       MSCH_EVENT((", end_time: %s",
+               dhd_mschdbg_display_time(p->end_time_h, p->end_time_l)));
+
+       MSCH_EVENT((", sch_dur: %s\n",
+               dhd_mschdbg_display_time(p->sch_dur_h, p->sch_dur_l)));
+}
+
+static void
+dhd_mschdbg_req_timing_profiler_event_data(int sp, int ver, char *title, char *data,
+       uint16 ptr, bool empty)
+{
+       int sn = sp + 4;
+       msch_req_timing_profiler_event_data_t *p =
+               (msch_req_timing_profiler_event_data_t *)(data + ntoh16(ptr));
+       uint32 type;
+
+       MSCH_EVENT_HEAD(sp);
+       MSCH_EVENT(("<%s req_timing>: ", title));
+       if (empty) {
+               MSCH_EVENT((" null\n"));
+               return;
+       }
+       else
+               MSCH_EVENT(("0x%08x (prev 0x%08x, next 0x%08x)\n",
+                       ntoh32(p->p_req_timing), ntoh32(p->p_prev), ntoh32(p->p_next)));
+
+       MSCH_EVENT_HEAD(sn);
+       MSCH_EVENT(("flags:"));
+       type = ntoh16(p->flags);
+       if ((type & 0x7f) == 0)
+               MSCH_EVENT((" NONE"));
+       else {
+               if (type & WL_MSCH_RC_FLAGS_ONCHAN_FIRE)
+                       MSCH_EVENT((" ONCHAN_FIRE"));
+               if (type & WL_MSCH_RC_FLAGS_START_FIRE_DONE)
+                       MSCH_EVENT((" START_FIRE"));
+               if (type & WL_MSCH_RC_FLAGS_END_FIRE_DONE)
+                       MSCH_EVENT((" END_FIRE"));
+               if (type & WL_MSCH_RC_FLAGS_ONFIRE_DONE)
+                       MSCH_EVENT((" ONFIRE_DONE"));
+               if (type & WL_MSCH_RC_FLAGS_SPLIT_SLOT_START)
+                       MSCH_EVENT((" SPLIT_SLOT_START"));
+               if (type & WL_MSCH_RC_FLAGS_SPLIT_SLOT_END)
+                       MSCH_EVENT((" SPLIT_SLOT_END"));
+               if (type & WL_MSCH_RC_FLAGS_PRE_ONFIRE_DONE)
+                       MSCH_EVENT((" PRE_ONFIRE_DONE"));
+       }
+       MSCH_EVENT(("\n"));
+
+       MSCH_EVENT_HEAD(sn);
+       MSCH_EVENT(("pre_start_time: %s",
+               dhd_mschdbg_display_time(p->pre_start_time_h, p->pre_start_time_l)));
+
+       MSCH_EVENT((", start_time: %s",
+               dhd_mschdbg_display_time(p->start_time_h, p->start_time_l)));
+
+       MSCH_EVENT((", end_time: %s\n",
+               dhd_mschdbg_display_time(p->end_time_h, p->end_time_l)));
+
+       if (p->p_timeslot && (p->timeslot_ptr == 0)) {
+               MSCH_EVENT_HEAD(sn);
+               MSCH_EVENT(("<%s timeslot>: 0x%08x\n", title, ntoh32(p->p_timeslot)));
+       } else
+               dhd_mschdbg_timeslot_profiler_event_data(sn, ver, title, data, p->timeslot_ptr,
+                       (p->timeslot_ptr == 0));
+}
+
+static void
+dhd_mschdbg_chan_ctxt_profiler_event_data(int sp, int ver, char *data, uint16 ptr, bool empty)
+{
+       int sn = sp + 4;
+       msch_chan_ctxt_profiler_event_data_t *p =
+               (msch_chan_ctxt_profiler_event_data_t *)(data + ntoh16(ptr));
+       chanspec_t c;
+       char buf[CHANSPEC_STR_LEN];
+
+       MSCH_EVENT_HEAD(sp);
+       MSCH_EVENT(("<chan_ctxt>: "));
+       if (empty) {
+               MSCH_EVENT((" null\n"));
+               return;
+       }
+       else
+               MSCH_EVENT(("0x%08x (prev 0x%08x, next 0x%08x)\n",
+                       ntoh32(p->p_chan_ctxt), ntoh32(p->p_prev), ntoh32(p->p_next)));
+
+       c = (chanspec_t)ntoh16(p->chanspec);
+
+       MSCH_EVENT_HEAD(sn);
+       MSCH_EVENT(("channel: %s, bf_sch_pending: %s, bf_skipped: %d\n",
+               wf_chspec_ntoa(c, buf), p->bf_sch_pending? "TRUE" : "FALSE",
+               ntoh32(p->bf_skipped_count)));
+
+       MSCH_EVENT_HEAD(sn);
+       MSCH_EVENT(("bf_link: prev 0x%08x, next 0x%08x\n",
+               ntoh32(p->bf_link_prev), ntoh32(p->bf_link_next)));
+
+       MSCH_EVENT_HEAD(sn);
+       MSCH_EVENT(("onchan_time: %s",
+               dhd_mschdbg_display_time(p->onchan_time_h, p->onchan_time_l)));
+       MSCH_EVENT((", actual_onchan_dur: %s",
+               dhd_mschdbg_display_time(p->actual_onchan_dur_h, p->actual_onchan_dur_l)));
+       MSCH_EVENT((", pend_onchan_dur: %s\n",
+               dhd_mschdbg_display_time(p->pend_onchan_dur_h, p->pend_onchan_dur_l)));
+
+       dhd_mschdbg_elem_list(sn, "req_entity", data, p->req_entity_list_ptr,
+               p->req_entity_list_cnt);
+       dhd_mschdbg_elem_list(sn, "bf_entity", data, p->bf_entity_list_ptr,
+               p->bf_entity_list_cnt);
+}
+
+static void
+dhd_mschdbg_req_entity_profiler_event_data(int sp, int ver, char *data, uint16 ptr, bool empty)
+{
+       int sn = sp + 4;
+       msch_req_entity_profiler_event_data_t *p =
+               (msch_req_entity_profiler_event_data_t *)(data + ntoh16(ptr));
+       char buf[CHANSPEC_STR_LEN];
+       chanspec_t c;
+       uint32 flags;
+
+       MSCH_EVENT_HEAD(sp);
+       MSCH_EVENT(("<req_entity>: "));
+       if (empty) {
+               MSCH_EVENT((" null\n"));
+               return;
+       }
+       else
+               MSCH_EVENT(("0x%08x (prev 0x%08x, next 0x%08x)\n",
+                       ntoh32(p->p_req_entity), ntoh32(p->req_hdl_link_prev),
+                       ntoh32(p->req_hdl_link_next)));
+
+       MSCH_EVENT_HEAD(sn);
+       MSCH_EVENT(("req_hdl: [0x%08x]\n", ntoh32(p->p_req_hdl)));
+
+       MSCH_EVENT_HEAD(sn);
+       MSCH_EVENT(("chan_ctxt_link: prev 0x%08x, next 0x%08x\n",
+               ntoh32(p->chan_ctxt_link_prev), ntoh32(p->chan_ctxt_link_next)));
+       MSCH_EVENT_HEAD(sn);
+       MSCH_EVENT(("rt_specific_link: prev 0x%08x, next 0x%08x\n",
+               ntoh32(p->rt_specific_link_prev), ntoh32(p->rt_specific_link_next)));
+       MSCH_EVENT_HEAD(sn);
+       MSCH_EVENT(("start_fixed_link: prev 0x%08x, next 0x%08x\n",
+               ntoh32(p->start_fixed_link_prev), ntoh32(p->start_fixed_link_next)));
+       MSCH_EVENT_HEAD(sn);
+       MSCH_EVENT(("both_flex_list: prev 0x%08x, next 0x%08x\n",
+               ntoh32(p->both_flex_list_prev), ntoh32(p->both_flex_list_next)));
+
+       c = (chanspec_t)ntoh16(p->chanspec);
+       MSCH_EVENT_HEAD(sn);
+       if (ver >= 2) {
+               MSCH_EVENT(("channel: %s, onchan Id %d, current chan Id %d, priority %d",
+                       wf_chspec_ntoa(c, buf), ntoh16(p->onchan_chn_idx), ntoh16(p->cur_chn_idx),
+                       ntoh16(p->priority)));
+               flags = ntoh32(p->flags);
+               if (flags & WL_MSCH_ENTITY_FLAG_MULTI_INSTANCE)
+                       MSCH_EVENT((" : MULTI_INSTANCE\n"));
+               else
+                       MSCH_EVENT(("\n"));
+               MSCH_EVENT_HEAD(sn);
+               MSCH_EVENT(("actual_start_time: %s, ",
+                       dhd_mschdbg_display_time(p->actual_start_time_h, p->actual_start_time_l)));
+               MSCH_EVENT(("curts_fire_time: %s, ",
+                       dhd_mschdbg_display_time(p->curts_fire_time_h, p->curts_fire_time_l)));
+       } else {
+               MSCH_EVENT(("channel: %s, priority %d, ", wf_chspec_ntoa(c, buf),
+                       ntoh16(p->priority)));
+       }
+       MSCH_EVENT(("bf_last_serv_time: %s\n",
+               dhd_mschdbg_display_time(p->bf_last_serv_time_h, p->bf_last_serv_time_l)));
+
+       dhd_mschdbg_req_timing_profiler_event_data(sn, ver, "current", data, p->cur_slot_ptr,
+               (p->cur_slot_ptr == 0));
+       dhd_mschdbg_req_timing_profiler_event_data(sn, ver, "pending", data, p->pend_slot_ptr,
+               (p->pend_slot_ptr == 0));
+
+       if (p->p_chan_ctxt && (p->chan_ctxt_ptr == 0)) {
+               MSCH_EVENT_HEAD(sn);
+               MSCH_EVENT(("<chan_ctxt>: 0x%08x\n", ntoh32(p->p_chan_ctxt)));
+       }
+       else
+               dhd_mschdbg_chan_ctxt_profiler_event_data(sn, ver, data, p->chan_ctxt_ptr,
+                       (p->chan_ctxt_ptr == 0));
+}
+
+static void
+dhd_mschdbg_req_handle_profiler_event_data(int sp, int ver, char *data, uint16 ptr, bool empty)
+{
+       int sn = sp + 4;
+       msch_req_handle_profiler_event_data_t *p =
+               (msch_req_handle_profiler_event_data_t *)(data + ntoh16(ptr));
+       uint32 flags;
+
+       MSCH_EVENT_HEAD(sp);
+       MSCH_EVENT(("<req_handle>: "));
+       if (empty) {
+               MSCH_EVENT((" null\n"));
+               return;
+       }
+       else
+               MSCH_EVENT(("0x%08x (prev 0x%08x, next 0x%08x)\n",
+                       ntoh32(p->p_req_handle), ntoh32(p->p_prev), ntoh32(p->p_next)));
+
+       dhd_mschdbg_elem_list(sn, "req_entity", data, p->req_entity_list_ptr,
+               p->req_entity_list_cnt);
+       MSCH_EVENT_HEAD(sn);
+       MSCH_EVENT(("cb_func: [0x%08x], cb_func: [0x%08x]",
+               ntoh32(p->cb_func), ntoh32(p->cb_ctxt)));
+       if (ver < 2) {
+               MSCH_EVENT((", chan_cnt: %d", ntoh16(p->chan_cnt)));
+       }
+       flags = ntoh32(p->flags);
+       if (flags & WL_MSCH_REQ_HDL_FLAGS_NEW_REQ)
+               MSCH_EVENT((", NEW_REQ"));
+       MSCH_EVENT(("\n"));
+
+       dhd_mschdbg_req_param_profiler_event_data(sn, ver, data, p->req_param_ptr);
+
+       if (ver >= 2) {
+               MSCH_EVENT_HEAD(sn);
+               MSCH_EVENT(("req_time: %s\n",
+                       dhd_mschdbg_display_time(p->req_time_h, p->req_time_l)));
+               MSCH_EVENT_HEAD(sn);
+               MSCH_EVENT(("chan_cnt: %d, chan idx %d, last chan idx %d\n",
+                       ntoh16(p->chan_cnt), ntoh16(p->chan_idx), ntoh16(p->last_chan_idx)));
+               if (p->chanspec_list && p->chanspec_cnt) {
+                       dhd_mschdbg_chanspec_list(sn, data, p->chanspec_list, p->chanspec_cnt);
+               }
+       }
+}
+
+static void
+dhd_mschdbg_profiler_profiler_event_data(int sp, int ver, char *data, uint16 ptr)
+{
+       msch_profiler_profiler_event_data_t *p =
+               (msch_profiler_profiler_event_data_t *)(data + ntoh16(ptr));
+       uint32 flags;
+
+       MSCH_EVENT_HEAD(sp);
+       MSCH_EVENT(("free list: req_hdl 0x%08x, req_entity 0x%08x,"
+               " chan_ctxt 0x%08x, chanspec 0x%08x\n",
+               ntoh32(p->free_req_hdl_list), ntoh32(p->free_req_entity_list),
+               ntoh32(p->free_chan_ctxt_list), ntoh32(p->free_chanspec_list)));
+
+       MSCH_EVENT_HEAD(sp);
+       MSCH_EVENT(("alloc count: chanspec %d, req_entity %d, req_hdl %d, "
+               "chan_ctxt %d, timeslot %d\n",
+               ntoh16(p->msch_chanspec_alloc_cnt), ntoh16(p->msch_req_entity_alloc_cnt),
+               ntoh16(p->msch_req_hdl_alloc_cnt), ntoh16(p->msch_chan_ctxt_alloc_cnt),
+               ntoh16(p->msch_timeslot_alloc_cnt)));
+
+       dhd_mschdbg_elem_list(sp, "req_hdl", data, p->msch_req_hdl_list_ptr,
+               p->msch_req_hdl_list_cnt);
+       dhd_mschdbg_elem_list(sp, "chan_ctxt", data, p->msch_chan_ctxt_list_ptr,
+               p->msch_chan_ctxt_list_cnt);
+       dhd_mschdbg_elem_list(sp, "req_timing", data, p->msch_req_timing_list_ptr,
+               p->msch_req_timing_list_cnt);
+       dhd_mschdbg_elem_list(sp, "start_fixed", data, p->msch_start_fixed_list_ptr,
+               p->msch_start_fixed_list_cnt);
+       dhd_mschdbg_elem_list(sp, "both_flex_req_entity", data,
+               p->msch_both_flex_req_entity_list_ptr,
+               p->msch_both_flex_req_entity_list_cnt);
+       dhd_mschdbg_elem_list(sp, "start_flex", data, p->msch_start_flex_list_ptr,
+               p->msch_start_flex_list_cnt);
+       dhd_mschdbg_elem_list(sp, "both_flex", data, p->msch_both_flex_list_ptr,
+               p->msch_both_flex_list_cnt);
+
+       if (p->p_cur_msch_timeslot && (p->cur_msch_timeslot_ptr == 0)) {
+               MSCH_EVENT_HEAD(sp);
+               MSCH_EVENT(("<cur_msch timeslot>: 0x%08x\n",
+                       ntoh32(p->p_cur_msch_timeslot)));
+       } else
+               dhd_mschdbg_timeslot_profiler_event_data(sp, ver, "cur_msch", data,
+                       p->cur_msch_timeslot_ptr, (p->cur_msch_timeslot_ptr == 0));
+
+       if (p->p_next_timeslot && (p->next_timeslot_ptr == 0)) {
+               MSCH_EVENT_HEAD(sp);
+               MSCH_EVENT(("<next timeslot>: 0x%08x\n",
+                       ntoh32(p->p_next_timeslot)));
+       } else
+               dhd_mschdbg_timeslot_profiler_event_data(sp, ver, "next", data,
+                       p->next_timeslot_ptr, (p->next_timeslot_ptr == 0));
+
+       MSCH_EVENT_HEAD(sp);
+       MSCH_EVENT(("ts_id: %d, ", ntoh32(p->ts_id)));
+       flags = ntoh32(p->flags);
+       if (flags & WL_MSCH_STATE_IN_TIEMR_CTXT)
+               MSCH_EVENT(("IN_TIEMR_CTXT, "));
+       if (flags & WL_MSCH_STATE_SCHD_PENDING)
+               MSCH_EVENT(("SCHD_PENDING, "));
+       MSCH_EVENT(("slotskip_flags: %d, cur_armed_timeslot: 0x%08x\n",
+               (ver >= 2)? ntoh32(p->slotskip_flag) : 0, ntoh32(p->cur_armed_timeslot)));
+       MSCH_EVENT_HEAD(sp);
+       MSCH_EVENT(("flex_list_cnt: %d, service_interval: %d, "
+               "max_lo_prio_interval: %d\n",
+               ntoh16(p->flex_list_cnt), ntoh32(p->service_interval),
+               ntoh32(p->max_lo_prio_interval)));
+}
+
+static void dhd_mschdbg_dump_data(dhd_pub_t *dhdp, void *raw_event_ptr, int type,
+       char *data, int len)
+{
+       uint64 t = 0, tt = 0;
+       uint32 s = 0, ss = 0;
+       int wlc_index, ver;
+
+       ver = (type & WL_MSCH_PROFILER_VER_MASK) >> WL_MSCH_PROFILER_VER_SHIFT;
+       wlc_index = (type & WL_MSCH_PROFILER_WLINDEX_MASK) >> WL_MSCH_PROFILER_WLINDEX_SHIFT;
+       if (wlc_index >= 4)
+               return;
+
+       type &= WL_MSCH_PROFILER_TYPE_MASK;
+       if (type <= WL_MSCH_PROFILER_PROFILE_END) {
+               msch_profiler_event_data_t *pevent = (msch_profiler_event_data_t *)data;
+               tt = ((uint64)(ntoh32(pevent->time_hi)) << 32) | ntoh32(pevent->time_lo);
+               dhd_mschdbg_us_to_sec(pevent->time_hi, pevent->time_lo, &s, &ss);
+       }
+
+       if (lastMessages && (type != WL_MSCH_PROFILER_MESSAGE) &&
+               (type != WL_MSCH_PROFILER_EVENT_LOG)) {
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("\n"));
+               lastMessages = FALSE;
+       }
+
+       switch (type) {
+       case WL_MSCH_PROFILER_START:
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("%06d.%06d START\n", s, ss));
+               break;
+
+       case WL_MSCH_PROFILER_EXIT:
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("%06d.%06d EXIT\n", s, ss));
+               break;
+
+       case WL_MSCH_PROFILER_REQ:
+       {
+               msch_req_profiler_event_data_t *p = (msch_req_profiler_event_data_t *)data;
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("\n"));
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("===============================\n"));
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("%06d.%06d [wl%d] REGISTER:\n", s, ss, wlc_index));
+               dhd_mschdbg_req_param_profiler_event_data(4, ver, data, p->req_param_ptr);
+               dhd_mschdbg_chanspec_list(4, data, p->chanspec_ptr, p->chanspec_cnt);
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("===============================\n"));
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("\n"));
+       }
+               break;
+
+       case WL_MSCH_PROFILER_CALLBACK:
+       {
+               msch_callback_profiler_event_data_t *p =
+                       (msch_callback_profiler_event_data_t *)data;
+               char buf[CHANSPEC_STR_LEN];
+               chanspec_t chanspec;
+               uint16 cbtype;
+
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("%06d.%06d [wl%d] CALLBACK: ", s, ss, wlc_index));
+               chanspec = (chanspec_t)ntoh16(p->chanspec);
+               MSCH_EVENT(("req_hdl[0x%08x], channel %s --",
+                       ntoh32(p->p_req_hdl), wf_chspec_ntoa(chanspec, buf)));
+
+               cbtype = ntoh16(p->type);
+               if (cbtype & WL_MSCH_CT_ON_CHAN)
+                       MSCH_EVENT((" ON_CHAN"));
+               if (cbtype & WL_MSCH_CT_OFF_CHAN)
+                       MSCH_EVENT((" OFF_CHAN"));
+               if (cbtype & WL_MSCH_CT_REQ_START)
+                       MSCH_EVENT((" REQ_START"));
+               if (cbtype & WL_MSCH_CT_REQ_END)
+                       MSCH_EVENT((" REQ_END"));
+               if (cbtype & WL_MSCH_CT_SLOT_START)
+                       MSCH_EVENT((" SLOT_START"));
+               if (cbtype & WL_MSCH_CT_SLOT_SKIP)
+                       MSCH_EVENT((" SLOT_SKIP"));
+               if (cbtype & WL_MSCH_CT_SLOT_END)
+                       MSCH_EVENT((" SLOT_END"));
+               if (cbtype & WL_MSCH_CT_OFF_CHAN_DONE)
+                       MSCH_EVENT((" OFF_CHAN_DONE"));
+               if (cbtype & WL_MSCH_CT_PARTIAL)
+                       MSCH_EVENT((" PARTIAL"));
+               if (cbtype & WL_MSCH_CT_PRE_ONCHAN)
+                       MSCH_EVENT((" PRE_ONCHAN"));
+               if (cbtype & WL_MSCH_CT_PRE_REQ_START)
+                       MSCH_EVENT((" PRE_REQ_START"));
+
+               if (cbtype & WL_MSCH_CT_REQ_START) {
+                       req_start[wlc_index] = 1;
+                       req_start_time[wlc_index] = tt;
+               } else if (cbtype & WL_MSCH_CT_REQ_END) {
+                       if (req_start[wlc_index]) {
+                               MSCH_EVENT((" : REQ duration %d",
+                                       (uint32)(tt - req_start_time[wlc_index])));
+                               req_start[wlc_index] = 0;
+                       }
+               }
+
+               if (cbtype & WL_MSCH_CT_SLOT_START) {
+                       solt_chanspec[wlc_index] = p->chanspec;
+                       solt_start_time[wlc_index] = tt;
+               } else if (cbtype & WL_MSCH_CT_SLOT_END) {
+                       if (p->chanspec == solt_chanspec[wlc_index]) {
+                               MSCH_EVENT((" : SLOT duration %d",
+                                       (uint32)(tt - solt_start_time[wlc_index])));
+                               solt_chanspec[wlc_index] = 0;
+                       }
+               }
+               MSCH_EVENT(("\n"));
+
+               if (cbtype & (WL_MSCH_CT_ON_CHAN | WL_MSCH_CT_SLOT_SKIP)) {
+                       MSCH_EVENT_HEAD(4);
+                       if (cbtype & WL_MSCH_CT_ON_CHAN) {
+                               MSCH_EVENT(("ID %d onchan idx %d cur_chan_seq_start %s ",
+                                       ntoh32(p->timeslot_id), ntoh32(p->onchan_idx),
+                                       dhd_mschdbg_display_time(p->cur_chan_seq_start_time_h,
+                                       p->cur_chan_seq_start_time_l)));
+                       }
+                       t = ((uint64)(ntoh32(p->start_time_h)) << 32) |
+                               ntoh32(p->start_time_l);
+                       MSCH_EVENT(("start %s ",
+                               dhd_mschdbg_display_time(p->start_time_h,
+                               p->start_time_l)));
+                       tt = ((uint64)(ntoh32(p->end_time_h)) << 32) | ntoh32(p->end_time_l);
+                       MSCH_EVENT(("end %s duration %d\n",
+                               dhd_mschdbg_display_time(p->end_time_h, p->end_time_l),
+                               (p->end_time_h == 0xffffffff && p->end_time_l == 0xffffffff)?
+                               -1 : (int)(tt - t)));
+               }
+
+       }
+               break;
+
+       case WL_MSCH_PROFILER_EVENT_LOG:
+       {
+               while (len >= (int)WL_MSCH_EVENT_LOG_HEAD_SIZE) {
+                       msch_event_log_profiler_event_data_t *p =
+                               (msch_event_log_profiler_event_data_t *)data;
+                       /* TODO: How to parse MSCH if extended event tag is present ??? */
+                       prcd_event_log_hdr_t hdr;
+                       int size = WL_MSCH_EVENT_LOG_HEAD_SIZE + p->hdr.count * sizeof(uint32);
+                       if (len < size || size > sizeof(msch_event_log_profiler_event_data_t)) {
+                               break;
+                       }
+                       data += size;
+                       len -= size;
+                       dhd_mschdbg_us_to_sec(p->time_hi, p->time_lo, &s, &ss);
+                       MSCH_EVENT_HEAD(0);
+                       MSCH_EVENT(("%06d.%06d [wl%d]: ", s, ss, p->hdr.tag));
+                       bzero(&hdr, sizeof(hdr));
+                       hdr.tag = EVENT_LOG_TAG_MSCHPROFILE;
+                       hdr.count = p->hdr.count + 1;
+                       /* exclude LSB 2 bits which indicate binary/non-binary data */
+                       hdr.fmt_num = ntoh16(p->hdr.fmt_num) >> 2;
+                       hdr.fmt_num_raw = ntoh16(p->hdr.fmt_num);
+                       if (ntoh16(p->hdr.fmt_num) == DHD_OW_BI_RAW_EVENT_LOG_FMT) {
+                               hdr.binary_payload = TRUE;
+                       }
+                       dhd_dbg_verboselog_printf(dhdp, &hdr, raw_event_ptr, p->data, 0, 0);
+               }
+               lastMessages = TRUE;
+               break;
+       }
+
+       case WL_MSCH_PROFILER_MESSAGE:
+       {
+               msch_message_profiler_event_data_t *p = (msch_message_profiler_event_data_t *)data;
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("%06d.%06d [wl%d]: %s", s, ss, wlc_index, p->message));
+               lastMessages = TRUE;
+               break;
+       }
+
+       case WL_MSCH_PROFILER_PROFILE_START:
+               profiler_start_time[wlc_index] = tt;
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("-------------------------------\n"));
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("%06d.%06d [wl%d] PROFILE DATA:\n", s, ss, wlc_index));
+               dhd_mschdbg_profiler_profiler_event_data(4, ver, data, 0);
+               break;
+
+       case WL_MSCH_PROFILER_PROFILE_END:
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("%06d.%06d [wl%d] PROFILE END: take time %d\n", s, ss,
+                       wlc_index, (uint32)(tt - profiler_start_time[wlc_index])));
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("-------------------------------\n"));
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("\n"));
+               break;
+
+       case WL_MSCH_PROFILER_REQ_HANDLE:
+               dhd_mschdbg_req_handle_profiler_event_data(4, ver, data, 0, FALSE);
+               break;
+
+       case WL_MSCH_PROFILER_REQ_ENTITY:
+               dhd_mschdbg_req_entity_profiler_event_data(4, ver, data, 0, FALSE);
+               break;
+
+       case WL_MSCH_PROFILER_CHAN_CTXT:
+               dhd_mschdbg_chan_ctxt_profiler_event_data(4, ver, data, 0, FALSE);
+               break;
+
+       case WL_MSCH_PROFILER_REQ_TIMING:
+               dhd_mschdbg_req_timing_profiler_event_data(4, ver, "msch", data, 0, FALSE);
+               break;
+
+       default:
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("[wl%d] ERROR: unsupported EVENT reason code:%d; ",
+                       wlc_index, type));
+               break;
+       }
+}
+
+void
+wl_mschdbg_event_handler(dhd_pub_t *dhdp, void *raw_event_ptr, int type, void *data, int len)
+{
+       head_log = "MSCH";
+       dhd_mschdbg_dump_data(dhdp, raw_event_ptr, type, (char *)data, len);
+}
+
+void
+wl_mschdbg_verboselog_handler(dhd_pub_t *dhdp, void *raw_event_ptr, prcd_event_log_hdr_t *plog_hdr,
+       uint32 *log_ptr)
+{
+       uint32 log_pyld_len;
+       head_log = "CONSOLE";
+
+       if (plog_hdr->count == 0) {
+               return;
+       }
+       log_pyld_len = (plog_hdr->count - 1) * DATA_UNIT_FOR_LOG_CNT;
+
+       if (plog_hdr->tag == EVENT_LOG_TAG_MSCHPROFILE) {
+               msch_event_log_profiler_event_data_t *p =
+                       (msch_event_log_profiler_event_data_t *)log_ptr;
+               /* TODO: How to parse MSCH if extended event tag is present ??? */
+               prcd_event_log_hdr_t hdr;
+               uint32 s, ss;
+
+               if (log_pyld_len < OFFSETOF(msch_event_log_profiler_event_data_t, data) ||
+                       log_pyld_len > sizeof(msch_event_log_profiler_event_data_t)) {
+                       return;
+               }
+
+               dhd_mschdbg_us_to_sec(p->time_hi, p->time_lo, &s, &ss);
+               MSCH_EVENT_HEAD(0);
+               MSCH_EVENT(("%06d.%06d [wl%d]: ", s, ss, p->hdr.tag));
+               bzero(&hdr, sizeof(hdr));
+               hdr.tag = EVENT_LOG_TAG_MSCHPROFILE;
+               hdr.count = p->hdr.count + 1;
+               /* exclude LSB 2 bits which indicate binary/non-binary data */
+               hdr.fmt_num = ntoh16(p->hdr.fmt_num) >> 2;
+               hdr.fmt_num_raw = ntoh16(p->hdr.fmt_num);
+               if (ntoh16(p->hdr.fmt_num) == DHD_OW_BI_RAW_EVENT_LOG_FMT) {
+                       hdr.binary_payload = TRUE;
+               }
+               dhd_dbg_verboselog_printf(dhdp, &hdr, raw_event_ptr, p->data, 0, 0);
+       } else {
+               msch_collect_tlv_t *p = (msch_collect_tlv_t *)log_ptr;
+               int type = ntoh16(p->type);
+               int len = ntoh16(p->size);
+
+               if (log_pyld_len < OFFSETOF(msch_collect_tlv_t, value) + len) {
+                       return;
+               }
+
+               dhd_mschdbg_dump_data(dhdp, raw_event_ptr, type, p->value, len);
+       }
+}
+#endif /* SHOW_LOGTRACE */
diff --git a/bcmdhd.101.10.240.x/dhd_mschdbg.h b/bcmdhd.101.10.240.x/dhd_mschdbg.h
new file mode 100644 (file)
index 0000000..7a81b61
--- /dev/null
@@ -0,0 +1,36 @@
+/*
+ * DHD debugability header file
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_mschdbg.h 571265 2015-07-14 20:50:18Z $
+ */
+
+#ifndef _dhd_mschdbg_h_
+#define _dhd_mschdbg_h_
+
+#ifdef SHOW_LOGTRACE
+extern void wl_mschdbg_event_handler(dhd_pub_t *dhdp, void *raw_event_ptr, int type,
+       void *data, int len);
+extern void wl_mschdbg_verboselog_handler(dhd_pub_t *dhdp, void *raw_event_ptr,
+       prcd_event_log_hdr_t *plog_hdr, uint32 *log_ptr);
+#endif /* SHOW_LOGTRACE */
+
+#endif /* _dhd_mschdbg_h_ */
diff --git a/bcmdhd.101.10.240.x/dhd_msgbuf.c b/bcmdhd.101.10.240.x/dhd_msgbuf.c
new file mode 100644 (file)
index 0000000..40b6e0d
--- /dev/null
@@ -0,0 +1,11854 @@
+/**
+ * @file definition of host message ring functionality
+ * Provides type definitions and function prototypes used to link the
+ * DHD OS, bus, and protocol modules.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+/** XXX Twiki: [PCIeFullDongleArchitecture] */
+
+#include <typedefs.h>
+#include <osl.h>
+
+#include <bcmutils.h>
+#include <bcmmsgbuf.h>
+#include <bcmendian.h>
+#include <bcmstdlib_s.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_proto.h>
+
+#include <dhd_bus.h>
+
+#include <dhd_dbg.h>
+#include <siutils.h>
+#include <dhd_debug.h>
+
+#include <dhd_flowring.h>
+
+#include <pcie_core.h>
+#include <bcmpcie.h>
+#include <dhd_pcie.h>
+#include <dhd_config.h>
+
+#if defined(DHD_LB)
+#include <linux/cpu.h>
+#include <bcm_ring.h>
+#define DHD_LB_WORKQ_SZ                            (8192)
+#define DHD_LB_WORKQ_SYNC           (16)
+#define DHD_LB_WORK_SCHED           (DHD_LB_WORKQ_SYNC * 2)
+#endif /* DHD_LB */
+
+#include <etd.h>
+#include <hnd_debug.h>
+#include <bcmtlv.h>
+#include <hnd_armtrap.h>
+#include <dnglevent.h>
+
+#ifdef DHD_PKT_LOGGING
+#include <dhd_pktlog.h>
+#include <dhd_linux_pktdump.h>
+#endif /* DHD_PKT_LOGGING */
+#ifdef DHD_EWPR_VER2
+#include <dhd_bitpack.h>
+#endif /* DHD_EWPR_VER2 */
+
+extern char dhd_version[];
+extern char fw_version[];
+
+/**
+ * Host configures a soft doorbell for d2h rings, by specifying a 32bit host
+ * address where a value must be written. Host may also interrupt coalescing
+ * on this soft doorbell.
+ * Use Case: Hosts with network processors, may register with the dongle the
+ * network processor's thread wakeup register and a value corresponding to the
+ * core/thread context. Dongle will issue a write transaction <address,value>
+ * to the PCIE RC which will need to be routed to the mapped register space, by
+ * the host.
+ */
+/* #define DHD_D2H_SOFT_DOORBELL_SUPPORT */
+
+/* Dependency Check */
+#if defined(IOCTLRESP_USE_CONSTMEM) && defined(DHD_USE_STATIC_CTRLBUF)
+#error "DHD_USE_STATIC_CTRLBUF is NOT working with DHD_USE_OSLPKT_FOR_RESPBUF"
+#endif /* IOCTLRESP_USE_CONSTMEM && DHD_USE_STATIC_CTRLBUF */
+
+#define RETRIES 2              /* # of retries to retrieve matching ioctl response */
+
+#if defined(DHD_HTPUT_TUNABLES)
+#define DEFAULT_RX_BUFFERS_TO_POST             1024
+#define RX_BUF_BURST                           64 /* Rx buffers for MSDU Data */
+#else
+#define DEFAULT_RX_BUFFERS_TO_POST             256
+#define RX_BUF_BURST                           32 /* Rx buffers for MSDU Data */
+#endif /* DHD_HTPUT_TUNABLES */
+
+#define RXBUFPOST_THRESHOLD                    32
+
+#define DHD_STOP_QUEUE_THRESHOLD       200
+#define DHD_START_QUEUE_THRESHOLD      100
+
+#define RX_DMA_OFFSET          8 /* Mem2mem DMA inserts an extra 8 */
+#define IOCT_RETBUF_SIZE       (RX_DMA_OFFSET + WLC_IOCTL_MAXLEN)
+
+/* flags for ioctl pending status */
+#define MSGBUF_IOCTL_ACK_PENDING       (1<<0)
+#define MSGBUF_IOCTL_RESP_PENDING      (1<<1)
+
+#define DHD_IOCTL_REQ_PKTBUFSZ         2048
+#define MSGBUF_IOCTL_MAX_RQSTLEN       (DHD_IOCTL_REQ_PKTBUFSZ - H2DRING_CTRL_SUB_ITEMSIZE)
+
+/**
+ * XXX: DMA_ALIGN_LEN use is overloaded:
+ * - as align bits: in DMA_ALLOC_CONSISTENT 1 << 4
+ * - in ensuring that a buffer's va is 4 Byte aligned
+ * - in rounding up a buffer length to 4 Bytes.
+ */
+#define DMA_ALIGN_LEN          4
+
+#define DMA_D2H_SCRATCH_BUF_LEN        8
+#define DMA_XFER_LEN_LIMIT     0x400000
+
+#ifdef BCM_HOST_BUF
+#ifndef DMA_HOST_BUFFER_LEN
+#define DMA_HOST_BUFFER_LEN    0x200000
+#endif
+#endif /* BCM_HOST_BUF */
+
+#define DHD_FLOWRING_IOCTL_BUFPOST_PKTSZ               8192
+
+#define DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D         1
+#define DHD_FLOWRING_MAX_EVENTBUF_POST                 32
+#define DHD_FLOWRING_MAX_IOCTLRESPBUF_POST             8
+#define DHD_H2D_INFORING_MAX_BUF_POST                  32
+#define DHD_MAX_TSBUF_POST                     8
+
+#define DHD_PROT_FUNCS 43
+
+/* Length of buffer in host for bus throughput measurement */
+#define DHD_BUS_TPUT_BUF_LEN 2048
+
+#define TXP_FLUSH_NITEMS
+
+/* optimization to write "n" tx items at a time to ring */
+#define TXP_FLUSH_MAX_ITEMS_FLUSH_CNT  48
+
+#define RING_NAME_MAX_LENGTH           24
+#define CTRLSUB_HOSTTS_MEESAGE_SIZE            1024
+/* Giving room before ioctl_trans_id rollsover. */
+#define BUFFER_BEFORE_ROLLOVER 300
+
+/* 512K memory + 32K registers */
+#define SNAPSHOT_UPLOAD_BUF_SIZE       ((512 + 32) * 1024)
+
+struct msgbuf_ring; /* ring context for common and flow rings */
+
+#define PCIE_DMA_LOOPBACK      0
+#define D11_DMA_LOOPBACK       1
+#define BMC_DMA_LOOPBACK       2
+
+/**
+ * PCIE D2H DMA Complete Sync Modes
+ *
+ * Firmware may interrupt the host, prior to the D2H Mem2Mem DMA completes into
+ * Host system memory. A WAR using one of 3 approaches is needed:
+ * 1. Dongle places a modulo-253 seqnum in last word of each D2H message
+ * 2. XOR Checksum, with epoch# in each work item. Dongle builds an XOR checksum
+ *    writes in the last word of each work item. Each work item has a seqnum
+ *    number = sequence num % 253.
+ *
+ * 3. Read Barrier: Dongle does a host memory read access prior to posting an
+ *    interrupt, ensuring that D2H data transfer indeed completed.
+ * 4. Dongle DMA's all indices after producing items in the D2H ring, flushing
+ *    ring contents before the indices.
+ *
+ * Host does not sync for DMA to complete with option #3 or #4, and a noop sync
+ * callback (see dhd_prot_d2h_sync_none) may be bound.
+ *
+ * Dongle advertizes host side sync mechanism requirements.
+ */
+
+#define PCIE_D2H_SYNC_WAIT_TRIES    (512U)
+#define PCIE_D2H_SYNC_NUM_OF_STEPS  (5U)
+#define PCIE_D2H_SYNC_DELAY         (100UL)    /* in terms of usecs */
+
+/**
+ * Custom callback attached based upon D2H DMA Sync mode advertized by dongle.
+ *
+ * On success: return cmn_msg_hdr_t::msg_type
+ * On failure: return 0 (invalid msg_type)
+ */
+typedef uint8 (* d2h_sync_cb_t)(dhd_pub_t *dhd, struct msgbuf_ring *ring,
+                                volatile cmn_msg_hdr_t *msg, int msglen);
+
+/**
+ * Custom callback attached based upon D2H DMA Sync mode advertized by dongle.
+ * For EDL messages.
+ *
+ * On success: return cmn_msg_hdr_t::msg_type
+ * On failure: return 0 (invalid msg_type)
+ */
+#ifdef EWP_EDL
+typedef int (* d2h_edl_sync_cb_t)(dhd_pub_t *dhd, struct msgbuf_ring *ring,
+                                volatile cmn_msg_hdr_t *msg);
+#endif /* EWP_EDL */
+
+/*
+ * +----------------------------------------------------------------------------
+ *
+ * RingIds and FlowId are not equivalent as ringids include D2H rings whereas
+ * flowids do not.
+ *
+ * Dongle advertizes the max H2D rings, as max_sub_queues = 'N' which includes
+ * the H2D common rings as well as the (N-BCMPCIE_H2D_COMMON_MSGRINGS) flowrings
+ *
+ * Here is a sample mapping for (based on PCIE Full Dongle Rev5) where,
+ *  BCMPCIE_H2D_COMMON_MSGRINGS = 2, i.e. 2 H2D common rings,
+ *  BCMPCIE_COMMON_MSGRINGS     = 5, i.e. include 3 D2H common rings.
+ *
+ *  H2D Control  Submit   RingId = 0        FlowId = 0 reserved never allocated
+ *  H2D RxPost   Submit   RingId = 1        FlowId = 1 reserved never allocated
+ *
+ *  D2H Control  Complete RingId = 2
+ *  D2H Transmit Complete RingId = 3
+ *  D2H Receive  Complete RingId = 4
+ *
+ *  H2D TxPost   FLOWRING RingId = 5         FlowId = 2     (1st flowring)
+ *  H2D TxPost   FLOWRING RingId = 6         FlowId = 3     (2nd flowring)
+ *  H2D TxPost   FLOWRING RingId = 5 + (N-1) FlowId = (N-1) (Nth flowring)
+ *
+ * When TxPost FlowId(s) are allocated, the FlowIds [0..FLOWID_RESERVED) are
+ * unused, where FLOWID_RESERVED is BCMPCIE_H2D_COMMON_MSGRINGS.
+ *
+ * Example: when a system supports 4 bc/mc and 128 uc flowrings, with
+ * BCMPCIE_H2D_COMMON_MSGRINGS = 2, and BCMPCIE_H2D_COMMON_MSGRINGS = 5, and the
+ * FlowId values would be in the range [2..133] and the corresponding
+ * RingId values would be in the range [5..136].
+ *
+ * The flowId allocator, may chose to, allocate Flowids:
+ *   bc/mc (per virtual interface) in one consecutive range [2..(2+VIFS))
+ *   X# of uc flowids in consecutive ranges (per station Id), where X is the
+ *   packet's access category (e.g. 4 uc flowids per station).
+ *
+ * CAUTION:
+ * When DMA indices array feature is used, RingId=5, corresponding to the 0th
+ * FLOWRING, will actually use the FlowId as index into the H2D DMA index,
+ * since the FlowId truly represents the index in the H2D DMA indices array.
+ *
+ * Likewise, in the D2H direction, the RingId - BCMPCIE_H2D_COMMON_MSGRINGS,
+ * will represent the index in the D2H DMA indices array.
+ *
+ * +----------------------------------------------------------------------------
+ */
+
+/* First TxPost Flowring Id */
+#define DHD_FLOWRING_START_FLOWID   BCMPCIE_H2D_COMMON_MSGRINGS
+
+/* Determine whether a ringid belongs to a TxPost flowring */
+#define DHD_IS_FLOWRING(ringid, max_flow_rings) \
+       ((ringid) >= BCMPCIE_COMMON_MSGRINGS && \
+       (ringid) < ((max_flow_rings) + BCMPCIE_COMMON_MSGRINGS))
+
+/* Convert a H2D TxPost FlowId to a MsgBuf RingId */
+#define DHD_FLOWID_TO_RINGID(flowid) \
+       (BCMPCIE_COMMON_MSGRINGS + ((flowid) - BCMPCIE_H2D_COMMON_MSGRINGS))
+
+/* Convert a MsgBuf RingId to a H2D TxPost FlowId */
+#define DHD_RINGID_TO_FLOWID(ringid) \
+       (BCMPCIE_H2D_COMMON_MSGRINGS + ((ringid) - BCMPCIE_COMMON_MSGRINGS))
+
+/* Convert a H2D MsgBuf RingId to an offset index into the H2D DMA indices array
+ * This may be used for the H2D DMA WR index array or H2D DMA RD index array or
+ * any array of H2D rings.
+ */
+#define DHD_H2D_RING_OFFSET(ringid) \
+       (((ringid) >= BCMPCIE_COMMON_MSGRINGS) ? DHD_RINGID_TO_FLOWID(ringid) : (ringid))
+
+/* Convert a H2D MsgBuf Flowring Id to an offset index into the H2D DMA indices array
+ * This may be used for IFRM.
+ */
+#define DHD_H2D_FRM_FLOW_RING_OFFSET(ringid) \
+       ((ringid) - BCMPCIE_COMMON_MSGRINGS)
+
+/* Convert a D2H MsgBuf RingId to an offset index into the D2H DMA indices array
+ * This may be used for the D2H DMA WR index array or D2H DMA RD index array or
+ * any array of D2H rings.
+ * d2h debug ring is located at the end, i.e. after all the tx flow rings and h2d debug ring
+ * max_h2d_rings: total number of h2d rings
+ */
+#define DHD_D2H_RING_OFFSET(ringid, max_h2d_rings) \
+       ((ringid) > (max_h2d_rings) ? \
+               ((ringid) - max_h2d_rings) : \
+               ((ringid) - BCMPCIE_H2D_COMMON_MSGRINGS))
+
+/* Convert a D2H DMA Indices Offset to a RingId */
+#define DHD_D2H_RINGID(offset) \
+       ((offset) + BCMPCIE_H2D_COMMON_MSGRINGS)
+
+/* XXX: The ringid and flowid and dma indices array index idiosyncracy is error
+ * prone. While a simplification is possible, the backward compatability
+ * requirement (DHD should operate with any PCIE rev version of firmware),
+ * limits what may be accomplished.
+ *
+ * At the minimum, implementation should use macros for any conversions
+ * facilitating introduction of future PCIE FD revs that need more "common" or
+ * other dynamic rings.
+ */
+
+/* XXX: Presently there is no need for maintaining both a dmah and a secdmah */
+#define DHD_DMAH_NULL      ((void*)NULL)
+
+/*
+ * Pad a DMA-able buffer by an additional cachline. If the end of the DMA-able
+ * buffer does not occupy the entire cacheline, and another object is placed
+ * following the DMA-able buffer, data corruption may occur if the DMA-able
+ * buffer is used to DMAing into (e.g. D2H direction), when HW cache coherency
+ * is not available.
+ */
+#if defined(L1_CACHE_BYTES)
+#define DHD_DMA_PAD        (L1_CACHE_BYTES)
+#else
+#define DHD_DMA_PAD        (128)
+#endif
+
+/*
+ * +----------------------------------------------------------------------------
+ * Flowring Pool
+ *
+ * Unlike common rings, which are attached very early on (dhd_prot_attach),
+ * flowrings are dynamically instantiated. Moreover, flowrings may require a
+ * larger DMA-able buffer. To avoid issues with fragmented cache coherent
+ * DMA-able memory, a pre-allocated pool of msgbuf_ring_t is allocated once.
+ * The DMA-able buffers are attached to these pre-allocated msgbuf_ring.
+ *
+ * Each DMA-able buffer may be allocated independently, or may be carved out
+ * of a single large contiguous region that is registered with the protocol
+ * layer into flowrings_dma_buf. On a 64bit platform, this contiguous region
+ * may not span 0x00000000FFFFFFFF (avoid dongle side 64bit ptr arithmetic).
+ *
+ * No flowring pool action is performed in dhd_prot_attach(), as the number
+ * of h2d rings is not yet known.
+ *
+ * In dhd_prot_init(), the dongle advertized number of h2d rings is used to
+ * determine the number of flowrings required, and a pool of msgbuf_rings are
+ * allocated and a DMA-able buffer (carved or allocated) is attached.
+ * See: dhd_prot_flowrings_pool_attach()
+ *
+ * A flowring msgbuf_ring object may be fetched from this pool during flowring
+ * creation, using the flowid. Likewise, flowrings may be freed back into the
+ * pool on flowring deletion.
+ * See: dhd_prot_flowrings_pool_fetch(), dhd_prot_flowrings_pool_release()
+ *
+ * In dhd_prot_detach(), the flowring pool is detached. The DMA-able buffers
+ * are detached (returned back to the carved region or freed), and the pool of
+ * msgbuf_ring and any objects allocated against it are freed.
+ * See: dhd_prot_flowrings_pool_detach()
+ *
+ * In dhd_prot_reset(), the flowring pool is simply reset by returning it to a
+ * state as-if upon an attach. All DMA-able buffers are retained.
+ * Following a dhd_prot_reset(), in a subsequent dhd_prot_init(), the flowring
+ * pool attach will notice that the pool persists and continue to use it. This
+ * will avoid the case of a fragmented DMA-able region.
+ *
+ * +----------------------------------------------------------------------------
+ */
+
+/* Conversion of a flowid to a flowring pool index */
+#define DHD_FLOWRINGS_POOL_OFFSET(flowid) \
+       ((flowid) - BCMPCIE_H2D_COMMON_MSGRINGS)
+
+/* Fetch the msgbuf_ring_t from the flowring pool given a flowid */
+#define DHD_RING_IN_FLOWRINGS_POOL(prot, flowid) \
+       (msgbuf_ring_t*)((prot)->h2d_flowrings_pool) + \
+           DHD_FLOWRINGS_POOL_OFFSET(flowid)
+
+/* Traverse each flowring in the flowring pool, assigning ring and flowid */
+#define FOREACH_RING_IN_FLOWRINGS_POOL(prot, ring, flowid, total_flowrings) \
+       for ((flowid) = DHD_FLOWRING_START_FLOWID, \
+               (ring) = DHD_RING_IN_FLOWRINGS_POOL(prot, flowid); \
+                (flowid) < ((total_flowrings) + DHD_FLOWRING_START_FLOWID); \
+                (ring)++, (flowid)++)
+
+/* Used in loopback tests */
+typedef struct dhd_dmaxfer {
+       dhd_dma_buf_t srcmem;
+       dhd_dma_buf_t dstmem;
+       uint32        srcdelay;
+       uint32        destdelay;
+       uint32        len;
+       bool          in_progress;
+       uint64        start_usec;
+       uint64        time_taken;
+       uint32        d11_lpbk;
+       int           status;
+} dhd_dmaxfer_t;
+
+/**
+ * msgbuf_ring : This object manages the host side ring that includes a DMA-able
+ * buffer, the WR and RD indices, ring parameters such as max number of items
+ * an length of each items, and other miscellaneous runtime state.
+ * A msgbuf_ring may be used to represent a H2D or D2H common ring or a
+ * H2D TxPost ring as specified in the PCIE FullDongle Spec.
+ * Ring parameters are conveyed to the dongle, which maintains its own peer end
+ * ring state. Depending on whether the DMA Indices feature is supported, the
+ * host will update the WR/RD index in the DMA indices array in host memory or
+ * directly in dongle memory.
+ */
+typedef struct msgbuf_ring {
+       bool           inited;
+       uint16         idx;       /* ring id */
+       uint16         rd;        /* read index */
+       uint16         curr_rd;   /* read index for debug */
+       uint16         wr;        /* write index */
+       uint16         max_items; /* maximum number of items in ring */
+       uint16         item_len;  /* length of each item in the ring */
+       sh_addr_t      base_addr; /* LITTLE ENDIAN formatted: base address */
+       dhd_dma_buf_t  dma_buf;   /* DMA-able buffer: pa, va, len, dmah, secdma */
+       uint32         seqnum;    /* next expected item's sequence number */
+#ifdef TXP_FLUSH_NITEMS
+       void           *start_addr;
+       /* # of messages on ring not yet announced to dongle */
+       uint16         pend_items_count;
+#endif /* TXP_FLUSH_NITEMS */
+
+       uint8   ring_type;
+       uint8   n_completion_ids;
+       bool    create_pending;
+       uint16  create_req_id;
+       uint8   current_phase;
+       uint16  compeltion_ring_ids[MAX_COMPLETION_RING_IDS_ASSOCIATED];
+       uchar           name[RING_NAME_MAX_LENGTH];
+       uint32          ring_mem_allocated;
+       void    *ring_lock;
+} msgbuf_ring_t;
+
+#define DHD_RING_BGN_VA(ring)           ((ring)->dma_buf.va)
+#define DHD_RING_END_VA(ring) \
+       ((uint8 *)(DHD_RING_BGN_VA((ring))) + \
+        (((ring)->max_items - 1) * (ring)->item_len))
+
+/* This can be overwritten by module parameter defined in dhd_linux.c
+ * or by dhd iovar h2d_max_txpost.
+ */
+int h2d_max_txpost = H2DRING_TXPOST_MAX_ITEM;
+#if defined(DHD_HTPUT_TUNABLES)
+int h2d_htput_max_txpost = H2DRING_HTPUT_TXPOST_MAX_ITEM;
+#endif /* DHD_HTPUT_TUNABLES */
+
+/** DHD protocol handle. Is an opaque type to other DHD software layers. */
+typedef struct dhd_prot {
+       osl_t *osh;             /* OSL handle */
+       uint16 rxbufpost_sz;
+       uint16 rxbufpost;
+       uint16 max_rxbufpost;
+       uint32 tot_rxbufpost;
+       uint32 tot_rxcpl;
+       uint16 max_eventbufpost;
+       uint16 max_ioctlrespbufpost;
+       uint16 max_tsbufpost;
+       uint16 max_infobufpost;
+       uint16 infobufpost;
+       uint16 cur_event_bufs_posted;
+       uint16 cur_ioctlresp_bufs_posted;
+       uint16 cur_ts_bufs_posted;
+
+       /* Flow control mechanism based on active transmits pending */
+       osl_atomic_t active_tx_count; /* increments/decrements on every packet tx/tx_status */
+       uint16 h2d_max_txpost;
+#if defined(DHD_HTPUT_TUNABLES)
+       uint16 h2d_htput_max_txpost;
+#endif /* DHD_HTPUT_TUNABLES */
+       uint16 txp_threshold;  /* optimization to write "n" tx items at a time to ring */
+
+       /* MsgBuf Ring info: has a dhd_dma_buf that is dynamically allocated */
+       msgbuf_ring_t h2dring_ctrl_subn; /* H2D ctrl message submission ring */
+       msgbuf_ring_t h2dring_rxp_subn; /* H2D RxBuf post ring */
+       msgbuf_ring_t d2hring_ctrl_cpln; /* D2H ctrl completion ring */
+       msgbuf_ring_t d2hring_tx_cpln; /* D2H Tx complete message ring */
+       msgbuf_ring_t d2hring_rx_cpln; /* D2H Rx complete message ring */
+       msgbuf_ring_t *h2dring_info_subn; /* H2D info submission ring */
+       msgbuf_ring_t *d2hring_info_cpln; /* D2H info completion ring */
+       msgbuf_ring_t *d2hring_edl; /* D2H Enhanced Debug Lane (EDL) ring */
+
+       msgbuf_ring_t *h2d_flowrings_pool; /* Pool of preallocated flowings */
+       dhd_dma_buf_t flowrings_dma_buf; /* Contiguous DMA buffer for flowrings */
+       uint16        h2d_rings_total; /* total H2D (common rings + flowrings) */
+
+       uint32          rx_dataoffset;
+
+       dhd_mb_ring_t   mb_ring_fn;     /* called when dongle needs to be notified of new msg */
+       dhd_mb_ring_2_t mb_2_ring_fn;   /* called when dongle needs to be notified of new msg */
+
+       /* ioctl related resources */
+       uint8 ioctl_state;
+       int16 ioctl_status;             /* status returned from dongle */
+       uint16 ioctl_resplen;
+       dhd_ioctl_recieved_status_t ioctl_received;
+       uint curr_ioctl_cmd;
+       dhd_dma_buf_t   retbuf;         /* For holding ioctl response */
+       dhd_dma_buf_t   ioctbuf;        /* For holding ioctl request */
+
+       dhd_dma_buf_t   d2h_dma_scratch_buf;    /* For holding d2h scratch */
+
+       /* DMA-able arrays for holding WR and RD indices */
+       uint32          rw_index_sz; /* Size of a RD or WR index in dongle */
+       dhd_dma_buf_t   h2d_dma_indx_wr_buf;    /* Array of H2D WR indices */
+       dhd_dma_buf_t   h2d_dma_indx_rd_buf;    /* Array of H2D RD indices */
+       dhd_dma_buf_t   d2h_dma_indx_wr_buf;    /* Array of D2H WR indices */
+       dhd_dma_buf_t   d2h_dma_indx_rd_buf;    /* Array of D2H RD indices */
+       dhd_dma_buf_t h2d_ifrm_indx_wr_buf;     /* Array of H2D WR indices for ifrm */
+
+       dhd_dma_buf_t   host_bus_throughput_buf; /* bus throughput measure buffer */
+
+       dhd_dma_buf_t   *flowring_buf;    /* pool of flow ring buf */
+       uint32                  flowring_num;
+
+       d2h_sync_cb_t d2h_sync_cb; /* Sync on D2H DMA done: SEQNUM or XORCSUM */
+#ifdef EWP_EDL
+       d2h_edl_sync_cb_t d2h_edl_sync_cb; /* Sync on EDL D2H DMA done: SEQNUM or XORCSUM */
+#endif /* EWP_EDL */
+       ulong d2h_sync_wait_max; /* max number of wait loops to receive one msg */
+       ulong d2h_sync_wait_tot; /* total wait loops */
+
+       dhd_dmaxfer_t   dmaxfer; /* for test/DMA loopback */
+
+       uint16          ioctl_seq_no;
+       uint16          data_seq_no;  /* XXX this field is obsolete */
+       uint16          ioctl_trans_id;
+       void            *pktid_ctrl_map; /* a pktid maps to a packet and its metadata */
+       void            *pktid_rx_map;  /* pktid map for rx path */
+       void            *pktid_tx_map;  /* pktid map for tx path */
+       bool            metadata_dbg;
+       void            *pktid_map_handle_ioctl;
+#ifdef DHD_MAP_PKTID_LOGGING
+       void            *pktid_dma_map; /* pktid map for DMA MAP */
+       void            *pktid_dma_unmap; /* pktid map for DMA UNMAP */
+#endif /* DHD_MAP_PKTID_LOGGING */
+       uint32          pktid_depleted_cnt;     /* pktid depleted count */
+       /* netif tx queue stop count */
+       uint8           pktid_txq_stop_cnt;
+       /* netif tx queue start count */
+       uint8           pktid_txq_start_cnt;
+       uint64          ioctl_fillup_time;      /* timestamp for ioctl fillup */
+       uint64          ioctl_ack_time;         /* timestamp for ioctl ack */
+       uint64          ioctl_cmplt_time;       /* timestamp for ioctl completion */
+
+       /* Applications/utilities can read tx and rx metadata using IOVARs */
+       uint16          rx_metadata_offset;
+       uint16          tx_metadata_offset;
+
+#if defined(DHD_D2H_SOFT_DOORBELL_SUPPORT)
+       /* Host's soft doorbell configuration */
+       bcmpcie_soft_doorbell_t soft_doorbell[BCMPCIE_D2H_COMMON_MSGRINGS];
+#endif /* DHD_D2H_SOFT_DOORBELL_SUPPORT */
+
+       /* Work Queues to be used by the producer and the consumer, and threshold
+        * when the WRITE index must be synced to consumer's workq
+        */
+#if defined(DHD_LB_TXC)
+       uint32 tx_compl_prod_sync ____cacheline_aligned;
+       bcm_workq_t tx_compl_prod, tx_compl_cons;
+#endif /* DHD_LB_TXC */
+#if defined(DHD_LB_RXC)
+       uint32 rx_compl_prod_sync ____cacheline_aligned;
+       bcm_workq_t rx_compl_prod, rx_compl_cons;
+#endif /* DHD_LB_RXC */
+
+       dhd_dma_buf_t   fw_trap_buf; /* firmware trap buffer */
+
+       uint32  host_ipc_version; /* Host sypported IPC rev */
+       uint32  device_ipc_version; /* FW supported IPC rev */
+       uint32  active_ipc_version; /* Host advertised IPC rev */
+       dhd_dma_buf_t   hostts_req_buf; /* For holding host timestamp request buf */
+       bool    hostts_req_buf_inuse;
+       bool    rx_ts_log_enabled;
+       bool    tx_ts_log_enabled;
+       bool no_retry;
+       bool no_aggr;
+       bool fixed_rate;
+       dhd_dma_buf_t   host_scb_buf; /* scb host offload buffer */
+       bool no_tx_resource;
+       uint32 txcpl_db_cnt;
+} dhd_prot_t;
+
+#ifdef DHD_EWPR_VER2
+#define HANG_INFO_BASE64_BUFFER_SIZE 640
+#endif
+
+#ifdef DHD_DUMP_PCIE_RINGS
+static
+int dhd_ring_write(dhd_pub_t *dhd, msgbuf_ring_t *ring, void *file,
+       const void *user_buf, unsigned long *file_posn);
+#ifdef EWP_EDL
+static
+int dhd_edl_ring_hdr_write(dhd_pub_t *dhd, msgbuf_ring_t *ring, void *file, const void *user_buf,
+       unsigned long *file_posn);
+#endif /* EWP_EDL */
+#endif /* DHD_DUMP_PCIE_RINGS */
+extern bool dhd_timesync_delay_post_bufs(dhd_pub_t *dhdp);
+extern void dhd_schedule_dmaxfer_free(dhd_pub_t* dhdp, dmaxref_mem_map_t *dmmap);
+/* Convert a dmaaddr_t to a base_addr with htol operations */
+static INLINE void dhd_base_addr_htolpa(sh_addr_t *base_addr, dmaaddr_t pa);
+
+/* APIs for managing a DMA-able buffer */
+static int  dhd_dma_buf_audit(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf);
+static void dhd_dma_buf_reset(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf);
+
+/* msgbuf ring management */
+static int dhd_prot_allocate_bufs(dhd_pub_t *dhd, dhd_prot_t *prot);
+static int dhd_prot_ring_attach(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+       const char *name, uint16 max_items, uint16 len_item, uint16 ringid);
+static void dhd_prot_ring_init(dhd_pub_t *dhd, msgbuf_ring_t *ring);
+static void dhd_prot_ring_reset(dhd_pub_t *dhd, msgbuf_ring_t *ring);
+static void dhd_prot_ring_detach(dhd_pub_t *dhd, msgbuf_ring_t *ring);
+static void dhd_prot_process_fw_timestamp(dhd_pub_t *dhd, void* buf);
+
+/* Pool of pre-allocated msgbuf_ring_t with DMA-able buffers for Flowrings */
+static int  dhd_prot_flowrings_pool_attach(dhd_pub_t *dhd);
+static void dhd_prot_flowrings_pool_reset(dhd_pub_t *dhd);
+static void dhd_prot_flowrings_pool_detach(dhd_pub_t *dhd);
+
+/* Fetch and Release a flowring msgbuf_ring from flowring  pool */
+static msgbuf_ring_t *dhd_prot_flowrings_pool_fetch(dhd_pub_t *dhd,
+       uint16 flowid);
+/* see also dhd_prot_flowrings_pool_release() in dhd_prot.h */
+
+/* Producer: Allocate space in a msgbuf ring */
+static void* dhd_prot_alloc_ring_space(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+       uint16 nitems, uint16 *alloced, bool exactly_nitems);
+static void* dhd_prot_get_ring_space(msgbuf_ring_t *ring, uint16 nitems,
+       uint16 *alloced, bool exactly_nitems);
+
+/* Consumer: Determine the location where the next message may be consumed */
+static uint8* dhd_prot_get_read_addr(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+       uint32 *available_len);
+
+/* Producer (WR index update) or Consumer (RD index update) indication */
+static void dhd_prot_ring_write_complete(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+       void *p, uint16 len);
+static void dhd_prot_upd_read_idx(dhd_pub_t *dhd, msgbuf_ring_t *ring);
+
+static INLINE int dhd_prot_dma_indx_alloc(dhd_pub_t *dhd, uint8 type,
+       dhd_dma_buf_t *dma_buf, uint32 bufsz);
+
+/* Set/Get a RD or WR index in the array of indices */
+/* See also: dhd_prot_dma_indx_init() */
+void dhd_prot_dma_indx_set(dhd_pub_t *dhd, uint16 new_index, uint8 type,
+       uint16 ringid);
+static uint16 dhd_prot_dma_indx_get(dhd_pub_t *dhd, uint8 type, uint16 ringid);
+
+/* Locate a packet given a pktid */
+static INLINE void *dhd_prot_packet_get(dhd_pub_t *dhd, uint32 pktid, uint8 pkttype,
+       bool free_pktid);
+/* Locate a packet given a PktId and free it. */
+static INLINE void dhd_prot_packet_free(dhd_pub_t *dhd, void *pkt, uint8 pkttype, bool send);
+
+static int dhd_msgbuf_query_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd,
+       void *buf, uint len, uint8 action);
+static int dhd_msgbuf_set_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd,
+       void *buf, uint len, uint8 action);
+static int dhd_msgbuf_wait_ioctl_cmplt(dhd_pub_t *dhd, uint32 len, void *buf);
+static int dhd_fillup_ioct_reqst(dhd_pub_t *dhd, uint16 len, uint cmd,
+       void *buf, int ifidx);
+
+/* Post buffers for Rx, control ioctl response and events */
+static uint16 dhd_msgbuf_rxbuf_post_ctrlpath(dhd_pub_t *dhd, uint8 msgid, uint32 max_to_post);
+static void dhd_msgbuf_rxbuf_post_ioctlresp_bufs(dhd_pub_t *pub);
+static void dhd_msgbuf_rxbuf_post_event_bufs(dhd_pub_t *pub);
+static void dhd_msgbuf_rxbuf_post(dhd_pub_t *dhd, bool use_rsv_pktid);
+static int dhd_prot_rxbuf_post(dhd_pub_t *dhd, uint16 count, bool use_rsv_pktid);
+static int dhd_msgbuf_rxbuf_post_ts_bufs(dhd_pub_t *pub);
+
+static void dhd_prot_return_rxbuf(dhd_pub_t *dhd, uint32 pktid, uint32 rxcnt);
+
+/* D2H Message handling */
+static int dhd_prot_process_msgtype(dhd_pub_t *dhd, msgbuf_ring_t *ring, uint8 *buf, uint32 len);
+
+/* D2H Message handlers */
+static void dhd_prot_noop(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_txstatus_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_ioctcmplt_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_ioctack_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_ringstatus_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_genstatus_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_event_process(dhd_pub_t *dhd, void *msg);
+
+/* Loopback test with dongle */
+static void dmaxfer_free_dmaaddr(dhd_pub_t *dhd, dhd_dmaxfer_t *dma);
+static int dmaxfer_prepare_dmaaddr(dhd_pub_t *dhd, uint len, uint srcdelay,
+       uint destdelay, dhd_dmaxfer_t *dma);
+static void dhd_msgbuf_dmaxfer_process(dhd_pub_t *dhd, void *msg);
+
+/* Flowring management communication with dongle */
+static void dhd_prot_flow_ring_create_response_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_flow_ring_delete_response_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_flow_ring_flush_response_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_process_flow_ring_resume_response(dhd_pub_t *dhd, void* msg);
+static void dhd_prot_process_flow_ring_suspend_response(dhd_pub_t *dhd, void* msg);
+
+/* Monitor Mode */
+#ifdef WL_MONITOR
+extern bool dhd_monitor_enabled(dhd_pub_t *dhd, int ifidx);
+extern void dhd_rx_mon_pkt(dhd_pub_t *dhdp, host_rxbuf_cmpl_t* msg, void *pkt, int ifidx);
+#endif /* WL_MONITOR */
+
+/* Configure a soft doorbell per D2H ring */
+static void dhd_msgbuf_ring_config_d2h_soft_doorbell(dhd_pub_t *dhd);
+static void dhd_prot_process_d2h_ring_config_complete(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_process_d2h_ring_create_complete(dhd_pub_t *dhd, void *buf);
+static void dhd_prot_process_h2d_ring_create_complete(dhd_pub_t *dhd, void *buf);
+static void dhd_prot_process_infobuf_complete(dhd_pub_t *dhd, void* buf);
+static void dhd_prot_process_d2h_mb_data(dhd_pub_t *dhd, void* buf);
+static void dhd_prot_detach_info_rings(dhd_pub_t *dhd);
+#ifdef EWP_EDL
+static void dhd_prot_detach_edl_rings(dhd_pub_t *dhd);
+#endif
+static void dhd_prot_process_d2h_host_ts_complete(dhd_pub_t *dhd, void* buf);
+static void dhd_prot_process_snapshot_complete(dhd_pub_t *dhd, void *buf);
+
+#ifdef DHD_TX_PROFILE
+extern bool dhd_protocol_matches_profile(uint8 *p, int plen, const
+               dhd_tx_profile_protocol_t *proto);
+#endif /* defined(DHD_TX_PROFILE) */
+
+typedef void (*dhd_msgbuf_func_t)(dhd_pub_t *dhd, void *msg);
+
+/** callback functions for messages generated by the dongle */
+#define MSG_TYPE_INVALID 0
+
+static dhd_msgbuf_func_t table_lookup[DHD_PROT_FUNCS] = {
+       dhd_prot_noop, /* 0 is MSG_TYPE_INVALID */
+       dhd_prot_genstatus_process, /* MSG_TYPE_GEN_STATUS */
+       dhd_prot_ringstatus_process, /* MSG_TYPE_RING_STATUS */
+       NULL,
+       dhd_prot_flow_ring_create_response_process, /* MSG_TYPE_FLOW_RING_CREATE_CMPLT */
+       NULL,
+       dhd_prot_flow_ring_delete_response_process, /* MSG_TYPE_FLOW_RING_DELETE_CMPLT */
+       NULL,
+       dhd_prot_flow_ring_flush_response_process, /* MSG_TYPE_FLOW_RING_FLUSH_CMPLT */
+       NULL,
+       dhd_prot_ioctack_process, /* MSG_TYPE_IOCTLPTR_REQ_ACK */
+       NULL,
+       dhd_prot_ioctcmplt_process, /* MSG_TYPE_IOCTL_CMPLT */
+       NULL,
+       dhd_prot_event_process, /* MSG_TYPE_WL_EVENT */
+       NULL,
+       dhd_prot_txstatus_process, /* MSG_TYPE_TX_STATUS */
+       NULL,
+       NULL,   /* MSG_TYPE_RX_CMPLT use dedicated handler */
+       NULL,
+       dhd_msgbuf_dmaxfer_process, /* MSG_TYPE_LPBK_DMAXFER_CMPLT */
+       NULL, /* MSG_TYPE_FLOW_RING_RESUME */
+       dhd_prot_process_flow_ring_resume_response, /* MSG_TYPE_FLOW_RING_RESUME_CMPLT */
+       NULL, /* MSG_TYPE_FLOW_RING_SUSPEND */
+       dhd_prot_process_flow_ring_suspend_response, /* MSG_TYPE_FLOW_RING_SUSPEND_CMPLT */
+       NULL, /* MSG_TYPE_INFO_BUF_POST */
+       dhd_prot_process_infobuf_complete, /* MSG_TYPE_INFO_BUF_CMPLT */
+       NULL, /* MSG_TYPE_H2D_RING_CREATE */
+       NULL, /* MSG_TYPE_D2H_RING_CREATE */
+       dhd_prot_process_h2d_ring_create_complete, /* MSG_TYPE_H2D_RING_CREATE_CMPLT */
+       dhd_prot_process_d2h_ring_create_complete, /* MSG_TYPE_D2H_RING_CREATE_CMPLT */
+       NULL, /* MSG_TYPE_H2D_RING_CONFIG */
+       NULL, /* MSG_TYPE_D2H_RING_CONFIG */
+       NULL, /* MSG_TYPE_H2D_RING_CONFIG_CMPLT */
+       dhd_prot_process_d2h_ring_config_complete, /* MSG_TYPE_D2H_RING_CONFIG_CMPLT */
+       NULL, /* MSG_TYPE_H2D_MAILBOX_DATA */
+       dhd_prot_process_d2h_mb_data, /* MSG_TYPE_D2H_MAILBOX_DATA */
+       NULL,   /* MSG_TYPE_TIMSTAMP_BUFPOST */
+       NULL,   /* MSG_TYPE_HOSTTIMSTAMP */
+       dhd_prot_process_d2h_host_ts_complete,  /* MSG_TYPE_HOSTTIMSTAMP_CMPLT */
+       dhd_prot_process_fw_timestamp,  /* MSG_TYPE_FIRMWARE_TIMESTAMP */
+       NULL,   /* MSG_TYPE_SNAPSHOT_UPLOAD */
+       dhd_prot_process_snapshot_complete,     /* MSG_TYPE_SNAPSHOT_CMPLT */
+};
+
+#ifdef DHD_RX_CHAINING
+
+#define PKT_CTF_CHAINABLE(dhd, ifidx, evh, prio, h_sa, h_da, h_prio) \
+       (dhd_wet_chainable(dhd) && \
+       dhd_rx_pkt_chainable((dhd), (ifidx)) && \
+       !ETHER_ISNULLDEST(((struct ether_header *)(evh))->ether_dhost) && \
+       !ETHER_ISMULTI(((struct ether_header *)(evh))->ether_dhost) && \
+       !eacmp((h_da), ((struct ether_header *)(evh))->ether_dhost) && \
+       !eacmp((h_sa), ((struct ether_header *)(evh))->ether_shost) && \
+       ((h_prio) == (prio)) && (dhd_ctf_hotbrc_check((dhd), (evh), (ifidx))) && \
+       ((((struct ether_header *)(evh))->ether_type == HTON16(ETHER_TYPE_IP)) || \
+       (((struct ether_header *)(evh))->ether_type == HTON16(ETHER_TYPE_IPV6))))
+
+static INLINE void dhd_rxchain_reset(rxchain_info_t *rxchain);
+static void dhd_rxchain_frame(dhd_pub_t *dhd, void *pkt, uint ifidx);
+static void dhd_rxchain_commit(dhd_pub_t *dhd);
+
+#define DHD_PKT_CTF_MAX_CHAIN_LEN      64
+
+#endif /* DHD_RX_CHAINING */
+
+#define DHD_LPBKDTDUMP_ON()    (dhd_msg_level & DHD_LPBKDTDUMP_VAL)
+
+static void dhd_prot_h2d_sync_init(dhd_pub_t *dhd);
+
+uint16
+dhd_prot_get_rxbufpost_sz(dhd_pub_t *dhd)
+{
+       return dhd->prot->rxbufpost_sz;
+}
+
+uint16
+dhd_prot_get_h2d_rx_post_active(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       msgbuf_ring_t *flow_ring = &prot->h2dring_rxp_subn;
+       uint16 rd, wr;
+
+       /* Since wr is owned by host in h2d direction, directly read wr */
+       wr = flow_ring->wr;
+
+       if (dhd->dma_d2h_ring_upd_support) {
+               rd = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_RD_UPD, flow_ring->idx);
+       } else {
+               dhd_bus_cmn_readshared(dhd->bus, &rd, RING_RD_UPD, flow_ring->idx);
+       }
+       return NTXPACTIVE(rd, wr, flow_ring->max_items);
+}
+
+uint16
+dhd_prot_get_d2h_rx_cpln_active(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       msgbuf_ring_t *flow_ring = &prot->d2hring_rx_cpln;
+       uint16 rd, wr;
+
+       if (dhd->dma_d2h_ring_upd_support) {
+               wr = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_WR_UPD, flow_ring->idx);
+       } else {
+               dhd_bus_cmn_readshared(dhd->bus, &wr, RING_WR_UPD, flow_ring->idx);
+       }
+
+       /* Since rd is owned by host in d2h direction, directly read rd */
+       rd = flow_ring->rd;
+
+       return NTXPACTIVE(rd, wr, flow_ring->max_items);
+}
+
+bool
+dhd_prot_is_cmpl_ring_empty(dhd_pub_t *dhd, void *prot_info)
+{
+       msgbuf_ring_t *flow_ring = (msgbuf_ring_t *)prot_info;
+       uint16 rd, wr;
+       bool ret;
+
+       if (dhd->dma_d2h_ring_upd_support) {
+               wr = flow_ring->wr;
+       } else {
+               dhd_bus_cmn_readshared(dhd->bus, &wr, RING_WR_UPD, flow_ring->idx);
+       }
+       if (dhd->dma_h2d_ring_upd_support) {
+               rd = flow_ring->rd;
+       } else {
+               dhd_bus_cmn_readshared(dhd->bus, &rd, RING_RD_UPD, flow_ring->idx);
+       }
+       ret = (wr == rd) ? TRUE : FALSE;
+       return ret;
+}
+
+void
+dhd_prot_dump_ring_ptrs(void *prot_info)
+{
+       msgbuf_ring_t *ring = (msgbuf_ring_t *)prot_info;
+       DHD_ERROR(("%s curr_rd: %d rd: %d wr: %d \n", __FUNCTION__,
+               ring->curr_rd, ring->rd, ring->wr));
+}
+
+uint16
+dhd_prot_get_h2d_max_txpost(dhd_pub_t *dhd)
+{
+       return (uint16)h2d_max_txpost;
+}
+void
+dhd_prot_set_h2d_max_txpost(dhd_pub_t *dhd, uint16 max_txpost)
+{
+       h2d_max_txpost = max_txpost;
+}
+#if defined(DHD_HTPUT_TUNABLES)
+uint16
+dhd_prot_get_h2d_htput_max_txpost(dhd_pub_t *dhd)
+{
+       return (uint16)h2d_htput_max_txpost;
+}
+void
+dhd_prot_set_h2d_htput_max_txpost(dhd_pub_t *dhd, uint16 htput_max_txpost)
+{
+       h2d_htput_max_txpost = htput_max_txpost;
+}
+
+#endif /* DHD_HTPUT_TUNABLES */
+/**
+ * D2H DMA to completion callback handlers. Based on the mode advertised by the
+ * dongle through the PCIE shared region, the appropriate callback will be
+ * registered in the proto layer to be invoked prior to precessing any message
+ * from a D2H DMA ring. If the dongle uses a read barrier or another mode that
+ * does not require host participation, then a noop callback handler will be
+ * bound that simply returns the msg_type.
+ */
+static void dhd_prot_d2h_sync_livelock(dhd_pub_t *dhd, uint32 msg_seqnum, msgbuf_ring_t *ring,
+                                       uint32 tries, volatile uchar *msg, int msglen);
+static uint8 dhd_prot_d2h_sync_seqnum(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                                      volatile cmn_msg_hdr_t *msg, int msglen);
+static uint8 dhd_prot_d2h_sync_xorcsum(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                                       volatile cmn_msg_hdr_t *msg, int msglen);
+static uint8 dhd_prot_d2h_sync_none(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                                    volatile cmn_msg_hdr_t *msg, int msglen);
+static void dhd_prot_d2h_sync_init(dhd_pub_t *dhd);
+static int dhd_send_d2h_ringcreate(dhd_pub_t *dhd, msgbuf_ring_t *ring_to_create,
+       uint16 ring_type, uint32 id);
+static int dhd_send_h2d_ringcreate(dhd_pub_t *dhd, msgbuf_ring_t *ring_to_create,
+       uint8 type, uint32 id);
+
+/**
+ * dhd_prot_d2h_sync_livelock - when the host determines that a DMA transfer has
+ * not completed, a livelock condition occurs. Host will avert this livelock by
+ * dropping this message and moving to the next. This dropped message can lead
+ * to a packet leak, or even something disastrous in the case the dropped
+ * message happens to be a control response.
+ * Here we will log this condition. One may choose to reboot the dongle.
+ *
+ */
+static void
+dhd_prot_d2h_sync_livelock(dhd_pub_t *dhd, uint32 msg_seqnum, msgbuf_ring_t *ring, uint32 tries,
+                           volatile uchar *msg, int msglen)
+{
+       uint32 ring_seqnum = ring->seqnum;
+
+       if (dhd_query_bus_erros(dhd)) {
+               return;
+       }
+
+       DHD_ERROR((
+               "LIVELOCK DHD<%p> ring<%s> msg_seqnum<%u> ring_seqnum<%u:%u> tries<%u> max<%lu>"
+               " tot<%lu> dma_buf va<%p> msg<%p> curr_rd<%d> rd<%d> wr<%d>\n",
+               dhd, ring->name, msg_seqnum, ring_seqnum, ring_seqnum% D2H_EPOCH_MODULO, tries,
+               dhd->prot->d2h_sync_wait_max, dhd->prot->d2h_sync_wait_tot,
+               ring->dma_buf.va, msg, ring->curr_rd, ring->rd, ring->wr));
+
+       dhd_prhex("D2H MsgBuf Failure", msg, msglen, DHD_ERROR_VAL);
+
+       /* Try to resume if already suspended or suspend in progress */
+#ifdef DHD_PCIE_RUNTIMEPM
+       dhdpcie_runtime_bus_wake(dhd, CAN_SLEEP(), __builtin_return_address(0));
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       /* Skip if still in suspended or suspend in progress */
+       if (DHD_BUS_CHECK_SUSPEND_OR_ANY_SUSPEND_IN_PROGRESS(dhd)) {
+               DHD_ERROR(("%s: bus is in suspend(%d) or suspending(0x%x) state, so skip\n",
+                       __FUNCTION__, dhd->busstate, dhd->dhd_bus_busy_state));
+               goto exit;
+       }
+
+       dhd_bus_dump_console_buffer(dhd->bus);
+       dhd_prot_debug_info_print(dhd);
+
+#ifdef DHD_FW_COREDUMP
+       if (dhd->memdump_enabled) {
+               /* collect core dump */
+               dhd->memdump_type = DUMP_TYPE_BY_LIVELOCK;
+               dhd_bus_mem_dump(dhd);
+       }
+#endif /* DHD_FW_COREDUMP */
+
+exit:
+       dhd_schedule_reset(dhd);
+
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+       dhd->bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+       /* XXX Trigger HANG event for recovery */
+       dhd->hang_reason = HANG_REASON_MSGBUF_LIVELOCK;
+       dhd_os_send_hang_message(dhd);
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+       dhd->livelock_occured = TRUE;
+}
+
+/**
+ * dhd_prot_d2h_sync_seqnum - Sync on a D2H DMA completion using the SEQNUM
+ * mode. Sequence number is always in the last word of a message.
+ */
+static uint8
+BCMFASTPATH(dhd_prot_d2h_sync_seqnum)(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                         volatile cmn_msg_hdr_t *msg, int msglen)
+{
+       uint32 tries;
+       uint32 ring_seqnum = ring->seqnum % D2H_EPOCH_MODULO;
+       int num_words = msglen / sizeof(uint32); /* num of 32bit words */
+       volatile uint32 *marker = (volatile uint32 *)msg + (num_words - 1); /* last word */
+       dhd_prot_t *prot = dhd->prot;
+       uint32 msg_seqnum;
+       uint32 step = 0;
+       uint32 delay = PCIE_D2H_SYNC_DELAY;
+       uint32 total_tries = 0;
+
+       ASSERT(msglen == ring->item_len);
+
+       BCM_REFERENCE(delay);
+       /*
+        * For retries we have to make some sort of stepper algorithm.
+        * We see that every time when the Dongle comes out of the D3
+        * Cold state, the first D2H mem2mem DMA takes more time to
+        * complete, leading to livelock issues.
+        *
+        * Case 1 - Apart from Host CPU some other bus master is
+        * accessing the DDR port, probably page close to the ring
+        * so, PCIE does not get a change to update the memory.
+        * Solution - Increase the number of tries.
+        *
+        * Case 2 - The 50usec delay given by the Host CPU is not
+        * sufficient for the PCIe RC to start its work.
+        * In this case the breathing time of 50usec given by
+        * the Host CPU is not sufficient.
+        * Solution: Increase the delay in a stepper fashion.
+        * This is done to ensure that there are no
+        * unwanted extra delay introdcued in normal conditions.
+        */
+       for (step = 1; step <= PCIE_D2H_SYNC_NUM_OF_STEPS; step++) {
+               for (tries = 0; tries < PCIE_D2H_SYNC_WAIT_TRIES; tries++) {
+                       msg_seqnum = *marker;
+                       if (ltoh32(msg_seqnum) == ring_seqnum) { /* dma upto last word done */
+                               ring->seqnum++; /* next expected sequence number */
+                               /* Check for LIVELOCK induce flag, which is set by firing
+                                * dhd iovar to induce LIVELOCK error. If flag is set,
+                                * MSG_TYPE_INVALID is returned, which results in to LIVELOCK error.
+                                */
+                               if (dhd->dhd_induce_error != DHD_INDUCE_LIVELOCK) {
+                                       goto dma_completed;
+                               }
+                       }
+
+                       total_tries = (uint32)(((step-1) * PCIE_D2H_SYNC_WAIT_TRIES) + tries);
+
+                       if (total_tries > prot->d2h_sync_wait_max)
+                               prot->d2h_sync_wait_max = total_tries;
+
+                       OSL_CACHE_INV(msg, msglen); /* invalidate and try again */
+                       OSL_CPU_RELAX(); /* CPU relax for msg_seqnum  value to update */
+                       OSL_DELAY(delay * step); /* Add stepper delay */
+
+               } /* for PCIE_D2H_SYNC_WAIT_TRIES */
+       } /* for PCIE_D2H_SYNC_NUM_OF_STEPS */
+
+       dhd_prot_d2h_sync_livelock(dhd, msg_seqnum, ring, total_tries,
+               (volatile uchar *) msg, msglen);
+
+       ring->seqnum++; /* skip this message ... leak of a pktid */
+       return MSG_TYPE_INVALID; /* invalid msg_type 0 -> noop callback */
+
+dma_completed:
+
+       prot->d2h_sync_wait_tot += tries;
+       return msg->msg_type;
+}
+
+/**
+ * dhd_prot_d2h_sync_xorcsum - Sync on a D2H DMA completion using the XORCSUM
+ * mode. The xorcsum is placed in the last word of a message. Dongle will also
+ * place a seqnum in the epoch field of the cmn_msg_hdr.
+ */
+static uint8
+BCMFASTPATH(dhd_prot_d2h_sync_xorcsum)(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                          volatile cmn_msg_hdr_t *msg, int msglen)
+{
+       uint32 tries;
+       uint32 prot_checksum = 0; /* computed checksum */
+       int num_words = msglen / sizeof(uint32); /* num of 32bit words */
+       uint8 ring_seqnum = ring->seqnum % D2H_EPOCH_MODULO;
+       dhd_prot_t *prot = dhd->prot;
+       uint32 step = 0;
+       uint32 delay = PCIE_D2H_SYNC_DELAY;
+       uint32 total_tries = 0;
+
+       ASSERT(msglen == ring->item_len);
+
+       BCM_REFERENCE(delay);
+       /*
+        * For retries we have to make some sort of stepper algorithm.
+        * We see that every time when the Dongle comes out of the D3
+        * Cold state, the first D2H mem2mem DMA takes more time to
+        * complete, leading to livelock issues.
+        *
+        * Case 1 - Apart from Host CPU some other bus master is
+        * accessing the DDR port, probably page close to the ring
+        * so, PCIE does not get a change to update the memory.
+        * Solution - Increase the number of tries.
+        *
+        * Case 2 - The 50usec delay given by the Host CPU is not
+        * sufficient for the PCIe RC to start its work.
+        * In this case the breathing time of 50usec given by
+        * the Host CPU is not sufficient.
+        * Solution: Increase the delay in a stepper fashion.
+        * This is done to ensure that there are no
+        * unwanted extra delay introdcued in normal conditions.
+        */
+       for (step = 1; step <= PCIE_D2H_SYNC_NUM_OF_STEPS; step++) {
+               for (tries = 0; tries < PCIE_D2H_SYNC_WAIT_TRIES; tries++) {
+                       /* First verify if the seqnumber has been update,
+                        * if yes, then only check xorcsum.
+                        * Once seqnum and xorcsum is proper that means
+                        * complete message has arrived.
+                        */
+                       if (msg->epoch == ring_seqnum) {
+                               prot_checksum = bcm_compute_xor32((volatile uint32 *)msg,
+                                       num_words);
+                               if (prot_checksum == 0U) { /* checksum is OK */
+                                       ring->seqnum++; /* next expected sequence number */
+                                       /* Check for LIVELOCK induce flag, which is set by firing
+                                        * dhd iovar to induce LIVELOCK error. If flag is set,
+                                        * MSG_TYPE_INVALID is returned, which results in to
+                                        * LIVELOCK error.
+                                        */
+                                       if (dhd->dhd_induce_error != DHD_INDUCE_LIVELOCK) {
+                                               goto dma_completed;
+                                       }
+                               }
+                       }
+
+                       total_tries = ((step-1) * PCIE_D2H_SYNC_WAIT_TRIES) + tries;
+
+                       if (total_tries > prot->d2h_sync_wait_max)
+                               prot->d2h_sync_wait_max = total_tries;
+
+                       OSL_CACHE_INV(msg, msglen); /* invalidate and try again */
+                       OSL_CPU_RELAX(); /* CPU relax for msg_seqnum  value to update */
+                       OSL_DELAY(delay * step); /* Add stepper delay */
+
+               } /* for PCIE_D2H_SYNC_WAIT_TRIES */
+       } /* for PCIE_D2H_SYNC_NUM_OF_STEPS */
+
+       DHD_ERROR(("%s: prot_checksum = 0x%x\n", __FUNCTION__, prot_checksum));
+       dhd_prot_d2h_sync_livelock(dhd, msg->epoch, ring, total_tries,
+               (volatile uchar *) msg, msglen);
+
+       ring->seqnum++; /* skip this message ... leak of a pktid */
+       return MSG_TYPE_INVALID; /* invalid msg_type 0 -> noop callback */
+
+dma_completed:
+
+       prot->d2h_sync_wait_tot += tries;
+       return msg->msg_type;
+}
+
+/**
+ * dhd_prot_d2h_sync_none - Dongle ensure that the DMA will complete and host
+ * need to try to sync. This noop sync handler will be bound when the dongle
+ * advertises that neither the SEQNUM nor XORCSUM mode of DMA sync is required.
+ */
+static uint8
+BCMFASTPATH(dhd_prot_d2h_sync_none)(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                       volatile cmn_msg_hdr_t *msg, int msglen)
+{
+       /* Check for LIVELOCK induce flag, which is set by firing
+       * dhd iovar to induce LIVELOCK error. If flag is set,
+       * MSG_TYPE_INVALID is returned, which results in to LIVELOCK error.
+       */
+       if (dhd->dhd_induce_error == DHD_INDUCE_LIVELOCK) {
+               DHD_ERROR(("%s: Inducing livelock\n", __FUNCTION__));
+               return MSG_TYPE_INVALID;
+       } else {
+               return msg->msg_type;
+       }
+}
+
+#ifdef EWP_EDL
+/**
+ * dhd_prot_d2h_sync_edl - Sync on a D2H DMA completion by validating the cmn_msg_hdr_t
+ * header values at both the beginning and end of the payload.
+ * The cmn_msg_hdr_t is placed at the start and end of the payload
+ * in each work item in the EDL ring.
+ * Dongle will place a seqnum inside the cmn_msg_hdr_t 'epoch' field
+ * and the length of the payload in the 'request_id' field.
+ * Structure of each work item in the EDL ring:
+ * | cmn_msg_hdr_t | payload (var len) | cmn_msg_hdr_t |
+ * NOTE: - it was felt that calculating xorcsum for the entire payload (max length of 1648 bytes) is
+ * too costly on the dongle side and might take up too many ARM cycles,
+ * hence the xorcsum sync method is not being used for EDL ring.
+ */
+static int
+BCMFASTPATH(dhd_prot_d2h_sync_edl)(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                          volatile cmn_msg_hdr_t *msg)
+{
+       uint32 tries;
+       int msglen = 0, len = 0;
+       uint32 ring_seqnum = ring->seqnum % D2H_EPOCH_MODULO;
+       dhd_prot_t *prot = dhd->prot;
+       uint32 step = 0;
+       uint32 delay = PCIE_D2H_SYNC_DELAY;
+       uint32 total_tries = 0;
+       volatile cmn_msg_hdr_t *trailer = NULL;
+       volatile uint8 *buf = NULL;
+       bool valid_msg = FALSE;
+
+       BCM_REFERENCE(delay);
+       /*
+        * For retries we have to make some sort of stepper algorithm.
+        * We see that every time when the Dongle comes out of the D3
+        * Cold state, the first D2H mem2mem DMA takes more time to
+        * complete, leading to livelock issues.
+        *
+        * Case 1 - Apart from Host CPU some other bus master is
+        * accessing the DDR port, probably page close to the ring
+        * so, PCIE does not get a change to update the memory.
+        * Solution - Increase the number of tries.
+        *
+        * Case 2 - The 50usec delay given by the Host CPU is not
+        * sufficient for the PCIe RC to start its work.
+        * In this case the breathing time of 50usec given by
+        * the Host CPU is not sufficient.
+        * Solution: Increase the delay in a stepper fashion.
+        * This is done to ensure that there are no
+        * unwanted extra delay introdcued in normal conditions.
+        */
+       for (step = 1; step <= PCIE_D2H_SYNC_NUM_OF_STEPS; step++) {
+               for (tries = 0; tries < PCIE_D2H_SYNC_WAIT_TRIES; tries++) {
+                       /* First verify if the seqnumber has been updated,
+                        * if yes, only then validate the header and trailer.
+                        * Once seqnum, header and trailer have been validated, it means
+                        * that the complete message has arrived.
+                        */
+                       valid_msg = FALSE;
+                       if (msg->epoch == ring_seqnum &&
+                               msg->msg_type == MSG_TYPE_INFO_PYLD &&
+                               msg->request_id > 0 &&
+                               msg->request_id <= ring->item_len) {
+                               /* proceed to check trailer only if header is valid */
+                               buf = (volatile uint8 *)msg;
+                               msglen = sizeof(cmn_msg_hdr_t) + msg->request_id;
+                               buf += msglen;
+                               if (msglen + sizeof(cmn_msg_hdr_t) <= ring->item_len) {
+                                       trailer = (volatile cmn_msg_hdr_t *)buf;
+                                       valid_msg = (trailer->epoch == ring_seqnum) &&
+                                               (trailer->msg_type == msg->msg_type) &&
+                                               (trailer->request_id == msg->request_id);
+                                       if (!valid_msg) {
+                                               DHD_TRACE(("%s:invalid trailer! seqnum=%u;reqid=%u"
+                                               " expected, seqnum=%u; reqid=%u. Retrying... \n",
+                                               __FUNCTION__, trailer->epoch, trailer->request_id,
+                                               msg->epoch, msg->request_id));
+                                       }
+                               } else {
+                                       DHD_TRACE(("%s: invalid payload length (%u)! Retrying.. \n",
+                                               __FUNCTION__, msg->request_id));
+                               }
+
+                               if (valid_msg) {
+                                       /* data is OK */
+                                       ring->seqnum++; /* next expected sequence number */
+                                       if (dhd->dhd_induce_error != DHD_INDUCE_LIVELOCK) {
+                                               goto dma_completed;
+                                       }
+                               }
+                       } else {
+                               DHD_TRACE(("%s: wrong hdr, seqnum expected %u, got %u."
+                                       " msg_type=0x%x, request_id=%u."
+                                       " Retrying...\n",
+                                       __FUNCTION__, ring_seqnum, msg->epoch,
+                                       msg->msg_type, msg->request_id));
+                       }
+
+                       total_tries = ((step-1) * PCIE_D2H_SYNC_WAIT_TRIES) + tries;
+
+                       if (total_tries > prot->d2h_sync_wait_max)
+                               prot->d2h_sync_wait_max = total_tries;
+
+                       OSL_CACHE_INV(msg, msglen); /* invalidate and try again */
+                       OSL_CPU_RELAX(); /* CPU relax for msg_seqnum  value to update */
+                       OSL_DELAY(delay * step); /* Add stepper delay */
+
+               } /* for PCIE_D2H_SYNC_WAIT_TRIES */
+       } /* for PCIE_D2H_SYNC_NUM_OF_STEPS */
+
+       DHD_ERROR(("%s: EDL header check fails !\n", __FUNCTION__));
+       DHD_ERROR(("%s: header: seqnum=%u; expected-seqnum=%u"
+               " msgtype=0x%x; expected-msgtype=0x%x"
+               " length=%u; expected-max-length=%u", __FUNCTION__,
+               msg->epoch, ring_seqnum, msg->msg_type, MSG_TYPE_INFO_PYLD,
+               msg->request_id, ring->item_len));
+       dhd_prhex("msg header bytes: ", (volatile uchar *)msg, sizeof(*msg), DHD_ERROR_VAL);
+       if (trailer && msglen > 0 &&
+                       (msglen + sizeof(cmn_msg_hdr_t)) <= ring->item_len) {
+               DHD_ERROR(("%s: trailer: seqnum=%u; expected-seqnum=%u"
+                       " msgtype=0x%x; expected-msgtype=0x%x"
+                       " length=%u; expected-length=%u", __FUNCTION__,
+                       trailer->epoch, ring_seqnum, trailer->msg_type, MSG_TYPE_INFO_PYLD,
+                       trailer->request_id, msg->request_id));
+               dhd_prhex("msg trailer bytes: ", (volatile uchar *)trailer,
+                       sizeof(*trailer), DHD_ERROR_VAL);
+       }
+
+       if ((msglen + sizeof(cmn_msg_hdr_t)) <= ring->item_len)
+               len = msglen + sizeof(cmn_msg_hdr_t);
+       else
+               len = ring->item_len;
+
+       dhd_prot_d2h_sync_livelock(dhd, msg->epoch, ring, total_tries,
+               (volatile uchar *) msg, len);
+
+       ring->seqnum++; /* skip this message */
+       return BCME_ERROR; /* invalid msg_type 0 -> noop callback */
+
+dma_completed:
+       DHD_TRACE(("%s: EDL header check pass, seqnum=%u; reqid=%u\n", __FUNCTION__,
+               msg->epoch, msg->request_id));
+
+       prot->d2h_sync_wait_tot += tries;
+       return BCME_OK;
+}
+
+/**
+ * dhd_prot_d2h_sync_edl_none - Dongle ensure that the DMA will complete and host
+ * need to try to sync. This noop sync handler will be bound when the dongle
+ * advertises that neither the SEQNUM nor XORCSUM mode of DMA sync is required.
+ */
+static int BCMFASTPATH
+(dhd_prot_d2h_sync_edl_none)(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                       volatile cmn_msg_hdr_t *msg)
+{
+       /* Check for LIVELOCK induce flag, which is set by firing
+       * dhd iovar to induce LIVELOCK error. If flag is set,
+       * MSG_TYPE_INVALID is returned, which results in to LIVELOCK error.
+       */
+       if (dhd->dhd_induce_error == DHD_INDUCE_LIVELOCK) {
+               DHD_ERROR(("%s: Inducing livelock\n", __FUNCTION__));
+               return BCME_ERROR;
+       } else {
+               if (msg->msg_type == MSG_TYPE_INFO_PYLD)
+                       return BCME_OK;
+               else
+                       return msg->msg_type;
+       }
+}
+#endif /* EWP_EDL */
+
+INLINE void
+dhd_wakeup_ioctl_event(dhd_pub_t *dhd, dhd_ioctl_recieved_status_t reason)
+{
+       /* To synchronize with the previous memory operations call wmb() */
+       OSL_SMP_WMB();
+       dhd->prot->ioctl_received = reason;
+       /* Call another wmb() to make sure before waking up the other event value gets updated */
+       OSL_SMP_WMB();
+       dhd_os_ioctl_resp_wake(dhd);
+}
+
+/**
+ * dhd_prot_d2h_sync_init - Setup the host side DMA sync mode based on what
+ * dongle advertizes.
+ */
+static void
+dhd_prot_d2h_sync_init(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       prot->d2h_sync_wait_max = 0UL;
+       prot->d2h_sync_wait_tot = 0UL;
+
+       prot->d2hring_ctrl_cpln.seqnum = D2H_EPOCH_INIT_VAL;
+       prot->d2hring_ctrl_cpln.current_phase = BCMPCIE_CMNHDR_PHASE_BIT_INIT;
+
+       prot->d2hring_tx_cpln.seqnum = D2H_EPOCH_INIT_VAL;
+       prot->d2hring_tx_cpln.current_phase = BCMPCIE_CMNHDR_PHASE_BIT_INIT;
+
+       prot->d2hring_rx_cpln.seqnum = D2H_EPOCH_INIT_VAL;
+       prot->d2hring_rx_cpln.current_phase = BCMPCIE_CMNHDR_PHASE_BIT_INIT;
+
+       if (dhd->d2h_sync_mode & PCIE_SHARED_D2H_SYNC_SEQNUM) {
+               prot->d2h_sync_cb = dhd_prot_d2h_sync_seqnum;
+#ifdef EWP_EDL
+               prot->d2h_edl_sync_cb = dhd_prot_d2h_sync_edl;
+#endif /* EWP_EDL */
+               DHD_ERROR(("%s(): D2H sync mechanism is SEQNUM \r\n", __FUNCTION__));
+       } else if (dhd->d2h_sync_mode & PCIE_SHARED_D2H_SYNC_XORCSUM) {
+               prot->d2h_sync_cb = dhd_prot_d2h_sync_xorcsum;
+#ifdef EWP_EDL
+               prot->d2h_edl_sync_cb = dhd_prot_d2h_sync_edl;
+#endif /* EWP_EDL */
+               DHD_ERROR(("%s(): D2H sync mechanism is XORCSUM \r\n", __FUNCTION__));
+       } else {
+               prot->d2h_sync_cb = dhd_prot_d2h_sync_none;
+#ifdef EWP_EDL
+               prot->d2h_edl_sync_cb = dhd_prot_d2h_sync_edl_none;
+#endif /* EWP_EDL */
+               DHD_ERROR(("%s(): D2H sync mechanism is NONE \r\n", __FUNCTION__));
+       }
+}
+
+/**
+ * dhd_prot_h2d_sync_init - Per H2D common ring, setup the msgbuf ring seqnum
+ */
+static void
+dhd_prot_h2d_sync_init(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       prot->h2dring_rxp_subn.seqnum = H2D_EPOCH_INIT_VAL;
+
+       prot->h2dring_rxp_subn.current_phase = 0;
+
+       prot->h2dring_ctrl_subn.seqnum = H2D_EPOCH_INIT_VAL;
+       prot->h2dring_ctrl_subn.current_phase = 0;
+}
+
+/* +-----------------  End of PCIE DHD H2D DMA SYNC ------------------------+ */
+
+/*
+ * +---------------------------------------------------------------------------+
+ * PCIE DMA-able buffer. Sets up a dhd_dma_buf_t object, which includes the
+ * virtual and physical address, the buffer lenght and the DMA handler.
+ * A secdma handler is also included in the dhd_dma_buf object.
+ * +---------------------------------------------------------------------------+
+ */
+
+static INLINE void
+dhd_base_addr_htolpa(sh_addr_t *base_addr, dmaaddr_t pa)
+{
+       base_addr->low_addr = htol32(PHYSADDRLO(pa));
+       base_addr->high_addr = htol32(PHYSADDRHI(pa));
+}
+
+/**
+ * dhd_dma_buf_audit - Any audits on a DHD DMA Buffer.
+ */
+static int
+dhd_dma_buf_audit(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf)
+{
+       uint32 pa_lowaddr, end; /* dongle uses 32bit ptr arithmetic */
+       ASSERT(dma_buf);
+       pa_lowaddr = PHYSADDRLO(dma_buf->pa);
+       ASSERT(PHYSADDRLO(dma_buf->pa) || PHYSADDRHI(dma_buf->pa));
+       ASSERT(ISALIGNED(pa_lowaddr, DMA_ALIGN_LEN));
+       ASSERT(dma_buf->len != 0);
+
+       /* test 32bit offset arithmetic over dma buffer for loss of carry-over */
+       end = (pa_lowaddr + dma_buf->len); /* end address */
+
+       if ((end & 0xFFFFFFFF) < (pa_lowaddr & 0xFFFFFFFF)) { /* exclude carryover */
+               DHD_ERROR(("%s: dma_buf %x len %d spans dongle 32bit ptr arithmetic\n",
+                       __FUNCTION__, pa_lowaddr, dma_buf->len));
+               return BCME_ERROR;
+       }
+
+       return BCME_OK;
+}
+
+/**
+ * dhd_dma_buf_alloc - Allocate a cache coherent DMA-able buffer.
+ * returns BCME_OK=0 on success
+ * returns non-zero negative error value on failure.
+ */
+int
+dhd_dma_buf_alloc(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf, uint32 buf_len)
+{
+       uint32 dma_pad = 0;
+       osl_t *osh = dhd->osh;
+       uint16 dma_align = DMA_ALIGN_LEN;
+       uint32 rem = 0;
+
+       ASSERT(dma_buf != NULL);
+       ASSERT(dma_buf->va == NULL);
+       ASSERT(dma_buf->len == 0);
+
+       /* Pad the buffer length to align to cacheline size. */
+       rem = (buf_len % DHD_DMA_PAD);
+       dma_pad = rem ? (DHD_DMA_PAD - rem) : 0;
+
+       dma_buf->va = DMA_ALLOC_CONSISTENT(osh, buf_len + dma_pad,
+               dma_align, &dma_buf->_alloced, &dma_buf->pa, &dma_buf->dmah);
+
+       if (dma_buf->va == NULL) {
+               DHD_ERROR(("%s: buf_len %d, no memory available\n",
+                       __FUNCTION__, buf_len));
+               return BCME_NOMEM;
+       }
+
+       dma_buf->len = buf_len; /* not including padded len */
+
+       if (dhd_dma_buf_audit(dhd, dma_buf) != BCME_OK) { /* audit dma buf */
+               dhd_dma_buf_free(dhd, dma_buf);
+               return BCME_ERROR;
+       }
+
+       dhd_dma_buf_reset(dhd, dma_buf); /* zero out and cache flush */
+
+       return BCME_OK;
+}
+
+/**
+ * dhd_dma_buf_reset - Reset a cache coherent DMA-able buffer.
+ */
+static void
+dhd_dma_buf_reset(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf)
+{
+       if ((dma_buf == NULL) || (dma_buf->va == NULL))
+               return;
+
+       (void)dhd_dma_buf_audit(dhd, dma_buf);
+
+       /* Zero out the entire buffer and cache flush */
+       memset((void*)dma_buf->va, 0, dma_buf->len);
+       OSL_CACHE_FLUSH((void *)dma_buf->va, dma_buf->len);
+}
+
+/**
+ * dhd_dma_buf_free - Free a DMA-able buffer that was previously allocated using
+ * dhd_dma_buf_alloc().
+ */
+void
+dhd_dma_buf_free(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf)
+{
+       osl_t *osh = dhd->osh;
+
+       ASSERT(dma_buf);
+
+       if (dma_buf->va == NULL)
+               return; /* Allow for free invocation, when alloc failed */
+
+       /* DEBUG: dhd_dma_buf_reset(dhd, dma_buf) */
+       (void)dhd_dma_buf_audit(dhd, dma_buf);
+
+       /* dma buffer may have been padded at allocation */
+       DMA_FREE_CONSISTENT(osh, dma_buf->va, dma_buf->_alloced,
+               dma_buf->pa, dma_buf->dmah);
+
+       memset(dma_buf, 0, sizeof(dhd_dma_buf_t));
+}
+
+/**
+ * dhd_dma_buf_init - Initialize a dhd_dma_buf with speicifed values.
+ * Do not use dhd_dma_buf_init to zero out a dhd_dma_buf_t object. Use memset 0.
+ */
+void
+dhd_dma_buf_init(dhd_pub_t *dhd, void *dhd_dma_buf,
+       void *va, uint32 len, dmaaddr_t pa, void *dmah, void *secdma)
+{
+       dhd_dma_buf_t *dma_buf;
+       ASSERT(dhd_dma_buf);
+       dma_buf = (dhd_dma_buf_t *)dhd_dma_buf;
+       dma_buf->va = va;
+       dma_buf->len = len;
+       dma_buf->pa = pa;
+       dma_buf->dmah = dmah;
+       dma_buf->secdma = secdma;
+
+       /* Audit user defined configuration */
+       (void)dhd_dma_buf_audit(dhd, dma_buf);
+}
+
+/* +------------------  End of PCIE DHD DMA BUF ADT ------------------------+ */
+
+/*
+ * +---------------------------------------------------------------------------+
+ * DHD_MAP_PKTID_LOGGING
+ * Logging the PKTID and DMA map/unmap information for the SMMU fault issue
+ * debugging in customer platform.
+ * +---------------------------------------------------------------------------+
+ */
+
+#ifdef DHD_MAP_PKTID_LOGGING
+typedef struct dhd_pktid_log_item {
+       dmaaddr_t pa;           /* DMA bus address */
+       uint64 ts_nsec;         /* Timestamp: nsec */
+       uint32 size;            /* DMA map/unmap size */
+       uint32 pktid;           /* Packet ID */
+       uint8 pkttype;          /* Packet Type */
+       uint8 rsvd[7];          /* Reserved for future use */
+} dhd_pktid_log_item_t;
+
+typedef struct dhd_pktid_log {
+       uint32 items;           /* number of total items */
+       uint32 index;           /* index of pktid_log_item */
+       dhd_pktid_log_item_t map[0];    /* metadata storage */
+} dhd_pktid_log_t;
+
+typedef void * dhd_pktid_log_handle_t; /* opaque handle to pktid log */
+
+#define        MAX_PKTID_LOG                           (2048)
+#define DHD_PKTID_LOG_ITEM_SZ                  (sizeof(dhd_pktid_log_item_t))
+#define DHD_PKTID_LOG_SZ(items)                        ((sizeof(dhd_pktid_log_t)) + \
+                                       ((DHD_PKTID_LOG_ITEM_SZ) * (items)))
+
+#define DHD_PKTID_LOG_INIT(dhd, hdl)           dhd_pktid_logging_init((dhd), (hdl))
+#define DHD_PKTID_LOG_FINI(dhd, hdl)           dhd_pktid_logging_fini((dhd), (hdl))
+#define DHD_PKTID_LOG(dhd, hdl, pa, pktid, len, pkttype)       \
+       dhd_pktid_logging((dhd), (hdl), (pa), (pktid), (len), (pkttype))
+#define DHD_PKTID_LOG_DUMP(dhd)                        dhd_pktid_logging_dump((dhd))
+
+static dhd_pktid_log_handle_t *
+dhd_pktid_logging_init(dhd_pub_t *dhd, uint32 num_items)
+{
+       dhd_pktid_log_t *log;
+       uint32 log_size;
+
+       log_size = DHD_PKTID_LOG_SZ(num_items);
+       log = (dhd_pktid_log_t *)MALLOCZ(dhd->osh, log_size);
+       if (log == NULL) {
+               DHD_ERROR(("%s: MALLOC failed for size %d\n",
+                       __FUNCTION__, log_size));
+               return (dhd_pktid_log_handle_t *)NULL;
+       }
+
+       log->items = num_items;
+       log->index = 0;
+
+       return (dhd_pktid_log_handle_t *)log; /* opaque handle */
+}
+
+static void
+dhd_pktid_logging_fini(dhd_pub_t *dhd, dhd_pktid_log_handle_t *handle)
+{
+       dhd_pktid_log_t *log;
+       uint32 log_size;
+
+       if (handle == NULL) {
+               DHD_ERROR(("%s: handle is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       log = (dhd_pktid_log_t *)handle;
+       log_size = DHD_PKTID_LOG_SZ(log->items);
+       MFREE(dhd->osh, handle, log_size);
+}
+
+static void
+dhd_pktid_logging(dhd_pub_t *dhd, dhd_pktid_log_handle_t *handle, dmaaddr_t pa,
+       uint32 pktid, uint32 len, uint8 pkttype)
+{
+       dhd_pktid_log_t *log;
+       uint32 idx;
+
+       if (handle == NULL) {
+               DHD_ERROR(("%s: handle is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       log = (dhd_pktid_log_t *)handle;
+       idx = log->index;
+       log->map[idx].ts_nsec = OSL_LOCALTIME_NS();
+       log->map[idx].pa = pa;
+       log->map[idx].pktid = pktid;
+       log->map[idx].size = len;
+       log->map[idx].pkttype = pkttype;
+       log->index = (idx + 1) % (log->items);  /* update index */
+}
+
+void
+dhd_pktid_logging_dump(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       dhd_pktid_log_t *map_log, *unmap_log;
+       uint64 ts_sec, ts_usec;
+
+       if (prot == NULL) {
+               DHD_ERROR(("%s: prot is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       map_log = (dhd_pktid_log_t *)(prot->pktid_dma_map);
+       unmap_log = (dhd_pktid_log_t *)(prot->pktid_dma_unmap);
+       OSL_GET_LOCALTIME(&ts_sec, &ts_usec);
+       if (map_log && unmap_log) {
+               DHD_ERROR(("%s: map_idx=%d unmap_idx=%d "
+                       "current time=[%5lu.%06lu]\n", __FUNCTION__,
+                       map_log->index, unmap_log->index,
+                       (unsigned long)ts_sec, (unsigned long)ts_usec));
+               DHD_ERROR(("%s: pktid_map_log(pa)=0x%llx size=%d, "
+                       "pktid_unmap_log(pa)=0x%llx size=%d\n", __FUNCTION__,
+                       (uint64)__virt_to_phys((ulong)(map_log->map)),
+                       (uint32)(DHD_PKTID_LOG_ITEM_SZ * map_log->items),
+                       (uint64)__virt_to_phys((ulong)(unmap_log->map)),
+                       (uint32)(DHD_PKTID_LOG_ITEM_SZ * unmap_log->items)));
+       }
+}
+#endif /* DHD_MAP_PKTID_LOGGING */
+
+/* +-----------------  End of DHD_MAP_PKTID_LOGGING -----------------------+ */
+
+/*
+ * +---------------------------------------------------------------------------+
+ * PktId Map: Provides a native packet pointer to unique 32bit PktId mapping.
+ * Main purpose is to save memory on the dongle, has other purposes as well.
+ * The packet id map, also includes storage for some packet parameters that
+ * may be saved. A native packet pointer along with the parameters may be saved
+ * and a unique 32bit pkt id will be returned. Later, the saved packet pointer
+ * and the metadata may be retrieved using the previously allocated packet id.
+ * +---------------------------------------------------------------------------+
+ */
+#define DHD_PCIE_PKTID
+#define MAX_CTRL_PKTID         (1024) /* Maximum number of pktids supported */
+#define MAX_RX_PKTID           (1024)
+#define MAX_TX_PKTID           (3072 * 2)
+
+/* On Router, the pktptr serves as a pktid. */
+
+/* XXX: PROP_TXSTATUS: WLFS defines a private pkttag layout.
+ * Hence cannot store the dma parameters in the pkttag and the pktidmap locker
+ * is required.
+ */
+#if defined(PROP_TXSTATUS) && !defined(DHD_PCIE_PKTID)
+#error "PKTIDMAP must be supported with PROP_TXSTATUS/WLFC"
+#endif
+
+/* Enum for marking the buffer color based on usage */
+typedef enum dhd_pkttype {
+       PKTTYPE_DATA_TX = 0,
+       PKTTYPE_DATA_RX,
+       PKTTYPE_IOCTL_RX,
+       PKTTYPE_EVENT_RX,
+       PKTTYPE_INFO_RX,
+       /* dhd_prot_pkt_free no check, if pktid reserved and no space avail case */
+       PKTTYPE_NO_CHECK,
+       PKTTYPE_TSBUF_RX
+} dhd_pkttype_t;
+
+#define DHD_PKTID_MIN_AVAIL_COUNT              512U
+#define DHD_PKTID_DEPLETED_MAX_COUNT           (DHD_PKTID_MIN_AVAIL_COUNT * 2U)
+#define DHD_PKTID_INVALID                      (0U)
+#define DHD_IOCTL_REQ_PKTID                    (0xFFFE)
+#define DHD_FAKE_PKTID                         (0xFACE)
+#define DHD_H2D_DBGRING_REQ_PKTID              0xFFFD
+#define DHD_D2H_DBGRING_REQ_PKTID              0xFFFC
+#define DHD_H2D_HOSTTS_REQ_PKTID               0xFFFB
+#define DHD_H2D_BTLOGRING_REQ_PKTID            0xFFFA
+#define DHD_D2H_BTLOGRING_REQ_PKTID            0xFFF9
+#define DHD_H2D_SNAPSHOT_UPLOAD_REQ_PKTID      0xFFF8
+
+#define IS_FLOWRING(ring) \
+       ((strncmp(ring->name, "h2dflr", sizeof("h2dflr"))) == (0))
+
+typedef void * dhd_pktid_map_handle_t; /* opaque handle to a pktid map */
+
+/* Construct a packet id mapping table, returning an opaque map handle */
+static dhd_pktid_map_handle_t *dhd_pktid_map_init(dhd_pub_t *dhd, uint32 num_items);
+
+/* Destroy a packet id mapping table, freeing all packets active in the table */
+static void dhd_pktid_map_fini(dhd_pub_t *dhd, dhd_pktid_map_handle_t *map);
+
+#define DHD_NATIVE_TO_PKTID_INIT(dhd, items) dhd_pktid_map_init((dhd), (items))
+#define DHD_NATIVE_TO_PKTID_RESET(dhd, map)  dhd_pktid_map_reset((dhd), (map))
+#define DHD_NATIVE_TO_PKTID_FINI(dhd, map)   dhd_pktid_map_fini((dhd), (map))
+#define DHD_NATIVE_TO_PKTID_FINI_IOCTL(osh, map)  dhd_pktid_map_fini_ioctl((osh), (map))
+
+#if defined(DHD_PCIE_PKTID)
+
+/* Determine number of pktids that are available */
+static INLINE uint32 dhd_pktid_map_avail_cnt(dhd_pktid_map_handle_t *handle);
+
+/* Allocate a unique pktid against which a pkt and some metadata is saved */
+static INLINE uint32 dhd_pktid_map_reserve(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle,
+       void *pkt, dhd_pkttype_t pkttype);
+static INLINE void dhd_pktid_map_save(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle,
+       void *pkt, uint32 nkey, dmaaddr_t pa, uint32 len, uint8 dma,
+       void *dmah, void *secdma, dhd_pkttype_t pkttype);
+static uint32 dhd_pktid_map_alloc(dhd_pub_t *dhd, dhd_pktid_map_handle_t *map,
+       void *pkt, dmaaddr_t pa, uint32 len, uint8 dma,
+       void *dmah, void *secdma, dhd_pkttype_t pkttype);
+
+/* Return an allocated pktid, retrieving previously saved pkt and metadata */
+static void *dhd_pktid_map_free(dhd_pub_t *dhd, dhd_pktid_map_handle_t *map,
+       uint32 id, dmaaddr_t *pa, uint32 *len, void **dmah,
+       void **secdma, dhd_pkttype_t pkttype, bool rsv_locker);
+
+/*
+ * DHD_PKTID_AUDIT_ENABLED: Audit of PktIds in DHD for duplicate alloc and frees
+ *
+ * DHD_PKTID_AUDIT_MAP: Audit the LIFO or FIFO PktIdMap allocator
+ * DHD_PKTID_AUDIT_RING: Audit the pktid during producer/consumer ring operation
+ *
+ * CAUTION: When DHD_PKTID_AUDIT_ENABLED is defined,
+ *    either DHD_PKTID_AUDIT_MAP or DHD_PKTID_AUDIT_RING may be selected.
+ */
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+#define USE_DHD_PKTID_AUDIT_LOCK 1
+/* Audit the pktidmap allocator */
+/* #define DHD_PKTID_AUDIT_MAP */
+
+/* Audit the pktid during production/consumption of workitems */
+#define DHD_PKTID_AUDIT_RING
+
+#if defined(DHD_PKTID_AUDIT_MAP) && defined(DHD_PKTID_AUDIT_RING)
+#error "May only enabled audit of MAP or RING, at a time."
+#endif /* DHD_PKTID_AUDIT_MAP && DHD_PKTID_AUDIT_RING */
+
+#define DHD_DUPLICATE_ALLOC     1
+#define DHD_DUPLICATE_FREE      2
+#define DHD_TEST_IS_ALLOC       3
+#define DHD_TEST_IS_FREE        4
+
+typedef enum dhd_pktid_map_type {
+       DHD_PKTID_MAP_TYPE_CTRL = 1,
+       DHD_PKTID_MAP_TYPE_TX,
+       DHD_PKTID_MAP_TYPE_RX,
+       DHD_PKTID_MAP_TYPE_UNKNOWN
+} dhd_pktid_map_type_t;
+
+#ifdef USE_DHD_PKTID_AUDIT_LOCK
+#define DHD_PKTID_AUDIT_LOCK_INIT(osh)          osl_spin_lock_init(osh)
+#define DHD_PKTID_AUDIT_LOCK_DEINIT(osh, lock)  osl_spin_lock_deinit(osh, lock)
+#define DHD_PKTID_AUDIT_LOCK(lock)              osl_spin_lock(lock)
+#define DHD_PKTID_AUDIT_UNLOCK(lock, flags)     osl_spin_unlock(lock, flags)
+#else
+#define DHD_PKTID_AUDIT_LOCK_INIT(osh)          (void *)(1)
+#define DHD_PKTID_AUDIT_LOCK_DEINIT(osh, lock)  do { /* noop */ } while (0)
+#define DHD_PKTID_AUDIT_LOCK(lock)              0
+#define DHD_PKTID_AUDIT_UNLOCK(lock, flags)     do { /* noop */ } while (0)
+#endif /* !USE_DHD_PKTID_AUDIT_LOCK */
+
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+#define USE_DHD_PKTID_LOCK   1
+
+#ifdef USE_DHD_PKTID_LOCK
+#define DHD_PKTID_LOCK_INIT(osh)                osl_spin_lock_init(osh)
+#define DHD_PKTID_LOCK_DEINIT(osh, lock)        osl_spin_lock_deinit(osh, lock)
+#define DHD_PKTID_LOCK(lock, flags)             (flags) = osl_spin_lock(lock)
+#define DHD_PKTID_UNLOCK(lock, flags)           osl_spin_unlock(lock, flags)
+#else
+#define DHD_PKTID_LOCK_INIT(osh)                (void *)(1)
+#define DHD_PKTID_LOCK_DEINIT(osh, lock)       \
+       do { \
+               BCM_REFERENCE(osh); \
+               BCM_REFERENCE(lock); \
+       } while (0)
+#define DHD_PKTID_LOCK(lock)                    0
+#define DHD_PKTID_UNLOCK(lock, flags)           \
+       do { \
+               BCM_REFERENCE(lock); \
+               BCM_REFERENCE(flags); \
+       } while (0)
+#endif /* !USE_DHD_PKTID_LOCK */
+
+typedef enum dhd_locker_state {
+       LOCKER_IS_FREE,
+       LOCKER_IS_BUSY,
+       LOCKER_IS_RSVD
+} dhd_locker_state_t;
+
+/* Packet metadata saved in packet id mapper */
+
+typedef struct dhd_pktid_item {
+       dhd_locker_state_t state;  /* tag a locker to be free, busy or reserved */
+       uint8       dir;      /* dma map direction (Tx=flush or Rx=invalidate) */
+       dhd_pkttype_t pkttype; /* pktlists are maintained based on pkttype */
+       uint16      len;      /* length of mapped packet's buffer */
+       void        *pkt;     /* opaque native pointer to a packet */
+       dmaaddr_t   pa;       /* physical address of mapped packet's buffer */
+       void        *dmah;    /* handle to OS specific DMA map */
+       void            *secdma;
+} dhd_pktid_item_t;
+
+typedef uint32 dhd_pktid_key_t;
+
+typedef struct dhd_pktid_map {
+       uint32      items;    /* total items in map */
+       uint32      avail;    /* total available items */
+       int         failures; /* lockers unavailable count */
+       /* Spinlock to protect dhd_pktid_map in process/tasklet context */
+       void        *pktid_lock; /* Used when USE_DHD_PKTID_LOCK is defined */
+
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+       void            *pktid_audit_lock;
+       struct bcm_mwbmap *pktid_audit; /* multi word bitmap based audit */
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+       dhd_pktid_key_t *keys; /* map_items +1 unique pkt ids */
+       dhd_pktid_item_t lockers[0];           /* metadata storage */
+} dhd_pktid_map_t;
+
+/*
+ * PktId (Locker) #0 is never allocated and is considered invalid.
+ *
+ * On request for a pktid, a value DHD_PKTID_INVALID must be treated as a
+ * depleted pktid pool and must not be used by the caller.
+ *
+ * Likewise, a caller must never free a pktid of value DHD_PKTID_INVALID.
+ */
+
+#define DHD_PKTID_FREE_LOCKER           (FALSE)
+#define DHD_PKTID_RSV_LOCKER            (TRUE)
+
+#define DHD_PKTID_ITEM_SZ               (sizeof(dhd_pktid_item_t))
+#define DHD_PKIDMAP_ITEMS(items)        (items)
+#define DHD_PKTID_MAP_SZ(items)         (sizeof(dhd_pktid_map_t) + \
+                                            (DHD_PKTID_ITEM_SZ * ((items) + 1)))
+#define DHD_PKTIDMAP_KEYS_SZ(items)     (sizeof(dhd_pktid_key_t) * ((items) + 1))
+
+#define DHD_NATIVE_TO_PKTID_RESET_IOCTL(dhd, map)  dhd_pktid_map_reset_ioctl((dhd), (map))
+
+/* Convert a packet to a pktid, and save pkt pointer in busy locker */
+#define DHD_NATIVE_TO_PKTID_RSV(dhd, map, pkt, pkttype)    \
+       dhd_pktid_map_reserve((dhd), (map), (pkt), (pkttype))
+/* Reuse a previously reserved locker to save packet params */
+#define DHD_NATIVE_TO_PKTID_SAVE(dhd, map, pkt, nkey, pa, len, dir, dmah, secdma, pkttype) \
+       dhd_pktid_map_save((dhd), (map), (void *)(pkt), (nkey), (pa), (uint32)(len), \
+               (uint8)(dir), (void *)(dmah), (void *)(secdma), \
+               (dhd_pkttype_t)(pkttype))
+/* Convert a packet to a pktid, and save packet params in locker */
+#define DHD_NATIVE_TO_PKTID(dhd, map, pkt, pa, len, dir, dmah, secdma, pkttype) \
+       dhd_pktid_map_alloc((dhd), (map), (void *)(pkt), (pa), (uint32)(len), \
+               (uint8)(dir), (void *)(dmah), (void *)(secdma), \
+               (dhd_pkttype_t)(pkttype))
+
+/* Convert pktid to a packet, and free the locker */
+#define DHD_PKTID_TO_NATIVE(dhd, map, pktid, pa, len, dmah, secdma, pkttype) \
+       dhd_pktid_map_free((dhd), (map), (uint32)(pktid), \
+               (dmaaddr_t *)&(pa), (uint32 *)&(len), (void **)&(dmah), \
+               (void **)&(secdma), (dhd_pkttype_t)(pkttype), DHD_PKTID_FREE_LOCKER)
+
+/* Convert the pktid to a packet, empty locker, but keep it reserved */
+#define DHD_PKTID_TO_NATIVE_RSV(dhd, map, pktid, pa, len, dmah, secdma, pkttype) \
+       dhd_pktid_map_free((dhd), (map), (uint32)(pktid), \
+                          (dmaaddr_t *)&(pa), (uint32 *)&(len), (void **)&(dmah), \
+                          (void **)&(secdma), (dhd_pkttype_t)(pkttype), DHD_PKTID_RSV_LOCKER)
+
+#define DHD_PKTID_AVAIL(map)                 dhd_pktid_map_avail_cnt(map)
+
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+
+static int
+dhd_get_pktid_map_type(dhd_pub_t *dhd, dhd_pktid_map_t *pktid_map)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int pktid_map_type;
+
+       if (pktid_map == prot->pktid_ctrl_map) {
+               pktid_map_type = DHD_PKTID_MAP_TYPE_CTRL;
+       } else if (pktid_map == prot->pktid_tx_map) {
+               pktid_map_type = DHD_PKTID_MAP_TYPE_TX;
+       } else if (pktid_map == prot->pktid_rx_map) {
+               pktid_map_type = DHD_PKTID_MAP_TYPE_RX;
+       } else {
+               pktid_map_type = DHD_PKTID_MAP_TYPE_UNKNOWN;
+       }
+
+       return pktid_map_type;
+}
+
+/**
+* __dhd_pktid_audit - Use the mwbmap to audit validity of a pktid.
+*/
+static int
+__dhd_pktid_audit(dhd_pub_t *dhd, dhd_pktid_map_t *pktid_map, uint32 pktid,
+       const int test_for, const char *errmsg)
+{
+#define DHD_PKT_AUDIT_STR "ERROR: %16s Host PktId Audit: "
+       struct bcm_mwbmap *handle;
+       uint32  flags;
+       bool ignore_audit;
+       int error = BCME_OK;
+
+       if (pktid_map == (dhd_pktid_map_t *)NULL) {
+               DHD_ERROR((DHD_PKT_AUDIT_STR "Pkt id map NULL\n", errmsg));
+               return BCME_OK;
+       }
+
+       flags = DHD_PKTID_AUDIT_LOCK(pktid_map->pktid_audit_lock);
+
+       handle = pktid_map->pktid_audit;
+       if (handle == (struct bcm_mwbmap *)NULL) {
+               DHD_ERROR((DHD_PKT_AUDIT_STR "Handle NULL\n", errmsg));
+               goto out;
+       }
+
+       /* Exclude special pktids from audit */
+       ignore_audit = (pktid == DHD_IOCTL_REQ_PKTID) | (pktid == DHD_FAKE_PKTID);
+       if (ignore_audit) {
+               goto out;
+       }
+
+       if ((pktid == DHD_PKTID_INVALID) || (pktid > pktid_map->items)) {
+               DHD_ERROR((DHD_PKT_AUDIT_STR "PktId<%d> invalid\n", errmsg, pktid));
+               error = BCME_ERROR;
+               goto out;
+       }
+
+       /* Perform audit */
+       switch (test_for) {
+               case DHD_DUPLICATE_ALLOC:
+                       if (!bcm_mwbmap_isfree(handle, pktid)) {
+                               DHD_ERROR((DHD_PKT_AUDIT_STR "PktId<%d> alloc duplicate\n",
+                                          errmsg, pktid));
+                               error = BCME_ERROR;
+                       } else {
+                               bcm_mwbmap_force(handle, pktid);
+                       }
+                       break;
+
+               case DHD_DUPLICATE_FREE:
+                       if (bcm_mwbmap_isfree(handle, pktid)) {
+                               DHD_ERROR((DHD_PKT_AUDIT_STR "PktId<%d> free duplicate\n",
+                                          errmsg, pktid));
+                               error = BCME_ERROR;
+                       } else {
+                               bcm_mwbmap_free(handle, pktid);
+                       }
+                       break;
+
+               case DHD_TEST_IS_ALLOC:
+                       if (bcm_mwbmap_isfree(handle, pktid)) {
+                               DHD_ERROR((DHD_PKT_AUDIT_STR "PktId<%d> is not allocated\n",
+                                          errmsg, pktid));
+                               error = BCME_ERROR;
+                       }
+                       break;
+
+               case DHD_TEST_IS_FREE:
+                       if (!bcm_mwbmap_isfree(handle, pktid)) {
+                               DHD_ERROR((DHD_PKT_AUDIT_STR "PktId<%d> is not free",
+                                          errmsg, pktid));
+                               error = BCME_ERROR;
+                       }
+                       break;
+
+               default:
+                       DHD_ERROR(("%s: Invalid test case: %d\n", __FUNCTION__, test_for));
+                       error = BCME_ERROR;
+                       break;
+       }
+
+out:
+       DHD_PKTID_AUDIT_UNLOCK(pktid_map->pktid_audit_lock, flags);
+
+       if (error != BCME_OK) {
+               dhd->pktid_audit_failed = TRUE;
+       }
+
+       return error;
+}
+
+static int
+dhd_pktid_audit(dhd_pub_t *dhd, dhd_pktid_map_t *pktid_map, uint32 pktid,
+       const int test_for, const char *errmsg)
+{
+       int ret = BCME_OK;
+       ret = __dhd_pktid_audit(dhd, pktid_map, pktid, test_for, errmsg);
+       if (ret == BCME_ERROR) {
+               DHD_ERROR(("%s: Got Pkt Id Audit failure: PKTID<%d> PKTID MAP TYPE<%d>\n",
+                       __FUNCTION__, pktid, dhd_get_pktid_map_type(dhd, pktid_map)));
+               dhd_pktid_error_handler(dhd);
+       }
+
+       return ret;
+}
+
+#define DHD_PKTID_AUDIT(dhdp, map, pktid, test_for) \
+       dhd_pktid_audit((dhdp), (dhd_pktid_map_t *)(map), (pktid), (test_for), __FUNCTION__)
+
+static int
+dhd_pktid_audit_ring_debug(dhd_pub_t *dhdp, dhd_pktid_map_t *map, uint32 pktid,
+       const int test_for, void *msg, uint32 msg_len, const char *func)
+{
+       int ret = BCME_OK;
+
+       if (dhd_query_bus_erros(dhdp)) {
+               return BCME_ERROR;
+       }
+
+       ret = __dhd_pktid_audit(dhdp, map, pktid, test_for, func);
+       if (ret == BCME_ERROR) {
+               DHD_ERROR(("%s: Got Pkt Id Audit failure: PKTID<%d> PKTID MAP TYPE<%d>\n",
+                       __FUNCTION__, pktid, dhd_get_pktid_map_type(dhdp, map)));
+               prhex(func, (uchar *)msg, msg_len);
+               dhd_pktid_error_handler(dhdp);
+       }
+       return ret;
+}
+#define DHD_PKTID_AUDIT_RING_DEBUG(dhdp, map, pktid, test_for, msg, msg_len) \
+       dhd_pktid_audit_ring_debug((dhdp), (dhd_pktid_map_t *)(map), \
+               (pktid), (test_for), msg, msg_len, __FUNCTION__)
+
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+/**
+ * +---------------------------------------------------------------------------+
+ * Packet to Packet Id mapper using a <numbered_key, locker> paradigm.
+ *
+ * dhd_pktid_map manages a set of unique Packet Ids range[1..MAX_xxx_PKTID].
+ *
+ * dhd_pktid_map_alloc() may be used to save some packet metadata, and a unique
+ * packet id is returned. This unique packet id may be used to retrieve the
+ * previously saved packet metadata, using dhd_pktid_map_free(). On invocation
+ * of dhd_pktid_map_free(), the unique packet id is essentially freed. A
+ * subsequent call to dhd_pktid_map_alloc() may reuse this packet id.
+ *
+ * Implementation Note:
+ * Convert this into a <key,locker> abstraction and place into bcmutils !
+ * Locker abstraction should treat contents as opaque storage, and a
+ * callback should be registered to handle busy lockers on destructor.
+ *
+ * +---------------------------------------------------------------------------+
+ */
+
+/** Allocate and initialize a mapper of num_items <numbered_key, locker> */
+
+static dhd_pktid_map_handle_t *
+dhd_pktid_map_init(dhd_pub_t *dhd, uint32 num_items)
+{
+       void* osh;
+       uint32 nkey;
+       dhd_pktid_map_t *map;
+       uint32 dhd_pktid_map_sz;
+       uint32 map_items;
+       uint32 map_keys_sz;
+       osh = dhd->osh;
+
+       dhd_pktid_map_sz = DHD_PKTID_MAP_SZ(num_items);
+
+       map = (dhd_pktid_map_t *)VMALLOC(osh, dhd_pktid_map_sz);
+       if (map == NULL) {
+               DHD_ERROR(("%s:%d: MALLOC failed for size %d\n",
+                       __FUNCTION__, __LINE__, dhd_pktid_map_sz));
+               return (dhd_pktid_map_handle_t *)NULL;
+       }
+
+       map->items = num_items;
+       map->avail = num_items;
+
+       map_items = DHD_PKIDMAP_ITEMS(map->items);
+
+       map_keys_sz = DHD_PKTIDMAP_KEYS_SZ(map->items);
+
+       /* Initialize the lock that protects this structure */
+       map->pktid_lock = DHD_PKTID_LOCK_INIT(osh);
+       if (map->pktid_lock == NULL) {
+               DHD_ERROR(("%s:%d: Lock init failed \r\n", __FUNCTION__, __LINE__));
+               goto error;
+       }
+
+       map->keys = (dhd_pktid_key_t *)MALLOC(osh, map_keys_sz);
+       if (map->keys == NULL) {
+               DHD_ERROR(("%s:%d: MALLOC failed for map->keys size %d\n",
+                       __FUNCTION__, __LINE__, map_keys_sz));
+               goto error;
+       }
+
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+               /* Incarnate a hierarchical multiword bitmap for auditing pktid allocator */
+               map->pktid_audit = bcm_mwbmap_init(osh, map_items + 1);
+               if (map->pktid_audit == (struct bcm_mwbmap *)NULL) {
+                       DHD_ERROR(("%s:%d: pktid_audit init failed\r\n", __FUNCTION__, __LINE__));
+                       goto error;
+               } else {
+                       DHD_ERROR(("%s:%d: pktid_audit init succeeded %d\n",
+                               __FUNCTION__, __LINE__, map_items + 1));
+               }
+               map->pktid_audit_lock = DHD_PKTID_AUDIT_LOCK_INIT(osh);
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+       for (nkey = 1; nkey <= map_items; nkey++) { /* locker #0 is reserved */
+               map->keys[nkey] = nkey; /* populate with unique keys */
+               map->lockers[nkey].state = LOCKER_IS_FREE;
+               map->lockers[nkey].pkt   = NULL; /* bzero: redundant */
+               map->lockers[nkey].len   = 0;
+       }
+
+       /* Reserve pktid #0, i.e. DHD_PKTID_INVALID to be inuse */
+       map->lockers[DHD_PKTID_INVALID].state = LOCKER_IS_BUSY; /* tag locker #0 as inuse */
+       map->lockers[DHD_PKTID_INVALID].pkt   = NULL; /* bzero: redundant */
+       map->lockers[DHD_PKTID_INVALID].len   = 0;
+
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+       /* do not use dhd_pktid_audit() here, use bcm_mwbmap_force directly */
+       bcm_mwbmap_force(map->pktid_audit, DHD_PKTID_INVALID);
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+       return (dhd_pktid_map_handle_t *)map; /* opaque handle */
+
+error:
+       if (map) {
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+               if (map->pktid_audit != (struct bcm_mwbmap *)NULL) {
+                       bcm_mwbmap_fini(osh, map->pktid_audit); /* Destruct pktid_audit */
+                       map->pktid_audit = (struct bcm_mwbmap *)NULL;
+                       if (map->pktid_audit_lock)
+                               DHD_PKTID_AUDIT_LOCK_DEINIT(osh, map->pktid_audit_lock);
+               }
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+               if (map->keys) {
+                       MFREE(osh, map->keys, map_keys_sz);
+               }
+
+               if (map->pktid_lock) {
+                       DHD_PKTID_LOCK_DEINIT(osh, map->pktid_lock);
+               }
+
+               VMFREE(osh, map, dhd_pktid_map_sz);
+       }
+       return (dhd_pktid_map_handle_t *)NULL;
+}
+
+/**
+ * Retrieve all allocated keys and free all <numbered_key, locker>.
+ * Freeing implies: unmapping the buffers and freeing the native packet
+ * This could have been a callback registered with the pktid mapper.
+ */
+static void
+dhd_pktid_map_reset(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle)
+{
+       void *osh;
+       uint32 nkey;
+       dhd_pktid_map_t *map;
+       dhd_pktid_item_t *locker;
+       uint32 map_items;
+       unsigned long flags;
+       bool data_tx = FALSE;
+
+       map = (dhd_pktid_map_t *)handle;
+       DHD_PKTID_LOCK(map->pktid_lock, flags);
+       osh = dhd->osh;
+
+       map_items = DHD_PKIDMAP_ITEMS(map->items);
+       /* skip reserved KEY #0, and start from 1 */
+
+       for (nkey = 1; nkey <= map_items; nkey++) {
+               if (map->lockers[nkey].state == LOCKER_IS_BUSY) {
+                       locker = &map->lockers[nkey];
+                       locker->state = LOCKER_IS_FREE;
+                       data_tx = (locker->pkttype == PKTTYPE_DATA_TX);
+                       if (data_tx) {
+                               OSL_ATOMIC_DEC(dhd->osh, &dhd->prot->active_tx_count);
+                       }
+
+#ifdef DHD_PKTID_AUDIT_RING
+                       DHD_PKTID_AUDIT(dhd, map, nkey, DHD_DUPLICATE_FREE); /* duplicate frees */
+#endif /* DHD_PKTID_AUDIT_RING */
+#ifdef DHD_MAP_PKTID_LOGGING
+                       DHD_PKTID_LOG(dhd, dhd->prot->pktid_dma_unmap,
+                               locker->pa, nkey, locker->len,
+                               locker->pkttype);
+#endif /* DHD_MAP_PKTID_LOGGING */
+
+                       DMA_UNMAP(osh, locker->pa, locker->len, locker->dir, 0, locker->dmah);
+                       dhd_prot_packet_free(dhd, (ulong*)locker->pkt,
+                               locker->pkttype, data_tx);
+               }
+               else {
+#ifdef DHD_PKTID_AUDIT_RING
+                       DHD_PKTID_AUDIT(dhd, map, nkey, DHD_TEST_IS_FREE);
+#endif /* DHD_PKTID_AUDIT_RING */
+               }
+               map->keys[nkey] = nkey; /* populate with unique keys */
+       }
+
+       map->avail = map_items;
+       memset(&map->lockers[1], 0, sizeof(dhd_pktid_item_t) * map_items);
+       DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+}
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+/** Called in detach scenario. Releasing IOCTL buffers. */
+static void
+dhd_pktid_map_reset_ioctl(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle)
+{
+       uint32 nkey;
+       dhd_pktid_map_t *map;
+       dhd_pktid_item_t *locker;
+       uint32 map_items;
+       unsigned long flags;
+
+       map = (dhd_pktid_map_t *)handle;
+       DHD_PKTID_LOCK(map->pktid_lock, flags);
+
+       map_items = DHD_PKIDMAP_ITEMS(map->items);
+       /* skip reserved KEY #0, and start from 1 */
+       for (nkey = 1; nkey <= map_items; nkey++) {
+               if (map->lockers[nkey].state == LOCKER_IS_BUSY) {
+                       dhd_dma_buf_t retbuf;
+
+#ifdef DHD_PKTID_AUDIT_RING
+                       DHD_PKTID_AUDIT(dhd, map, nkey, DHD_DUPLICATE_FREE); /* duplicate frees */
+#endif /* DHD_PKTID_AUDIT_RING */
+
+                       locker = &map->lockers[nkey];
+                       retbuf.va = locker->pkt;
+                       retbuf.len = locker->len;
+                       retbuf.pa = locker->pa;
+                       retbuf.dmah = locker->dmah;
+                       retbuf.secdma = locker->secdma;
+
+                       free_ioctl_return_buffer(dhd, &retbuf);
+               }
+               else {
+#ifdef DHD_PKTID_AUDIT_RING
+                       DHD_PKTID_AUDIT(dhd, map, nkey, DHD_TEST_IS_FREE);
+#endif /* DHD_PKTID_AUDIT_RING */
+               }
+               map->keys[nkey] = nkey; /* populate with unique keys */
+       }
+
+       map->avail = map_items;
+       memset(&map->lockers[1], 0, sizeof(dhd_pktid_item_t) * map_items);
+       DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+}
+#endif /* IOCTLRESP_USE_CONSTMEM */
+
+/**
+ * Free the pktid map.
+ */
+static void
+dhd_pktid_map_fini(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle)
+{
+       dhd_pktid_map_t *map;
+       uint32 dhd_pktid_map_sz;
+       uint32 map_keys_sz;
+
+       if (handle == NULL)
+               return;
+
+       /* Free any pending packets */
+       dhd_pktid_map_reset(dhd, handle);
+
+       map = (dhd_pktid_map_t *)handle;
+       dhd_pktid_map_sz = DHD_PKTID_MAP_SZ(map->items);
+       map_keys_sz = DHD_PKTIDMAP_KEYS_SZ(map->items);
+
+       DHD_PKTID_LOCK_DEINIT(dhd->osh, map->pktid_lock);
+
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+       if (map->pktid_audit != (struct bcm_mwbmap *)NULL) {
+               bcm_mwbmap_fini(dhd->osh, map->pktid_audit); /* Destruct pktid_audit */
+               map->pktid_audit = (struct bcm_mwbmap *)NULL;
+               if (map->pktid_audit_lock) {
+                       DHD_PKTID_AUDIT_LOCK_DEINIT(dhd->osh, map->pktid_audit_lock);
+               }
+       }
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+       MFREE(dhd->osh, map->keys, map_keys_sz);
+       VMFREE(dhd->osh, handle, dhd_pktid_map_sz);
+}
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+static void
+dhd_pktid_map_fini_ioctl(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle)
+{
+       dhd_pktid_map_t *map;
+       uint32 dhd_pktid_map_sz;
+       uint32 map_keys_sz;
+
+       if (handle == NULL)
+               return;
+
+       /* Free any pending packets */
+       dhd_pktid_map_reset_ioctl(dhd, handle);
+
+       map = (dhd_pktid_map_t *)handle;
+       dhd_pktid_map_sz = DHD_PKTID_MAP_SZ(map->items);
+       map_keys_sz = DHD_PKTIDMAP_KEYS_SZ(map->items);
+
+       DHD_PKTID_LOCK_DEINIT(dhd->osh, map->pktid_lock);
+
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+       if (map->pktid_audit != (struct bcm_mwbmap *)NULL) {
+               bcm_mwbmap_fini(dhd->osh, map->pktid_audit); /* Destruct pktid_audit */
+               map->pktid_audit = (struct bcm_mwbmap *)NULL;
+               if (map->pktid_audit_lock) {
+                       DHD_PKTID_AUDIT_LOCK_DEINIT(dhd->osh, map->pktid_audit_lock);
+               }
+       }
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+       MFREE(dhd->osh, map->keys, map_keys_sz);
+       VMFREE(dhd->osh, handle, dhd_pktid_map_sz);
+}
+#endif /* IOCTLRESP_USE_CONSTMEM */
+
+/** Get the pktid free count */
+static INLINE uint32
+BCMFASTPATH(dhd_pktid_map_avail_cnt)(dhd_pktid_map_handle_t *handle)
+{
+       dhd_pktid_map_t *map;
+       uint32  avail;
+       unsigned long flags;
+
+       ASSERT(handle != NULL);
+       map = (dhd_pktid_map_t *)handle;
+
+       DHD_PKTID_LOCK(map->pktid_lock, flags);
+       avail = map->avail;
+       DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+
+       return avail;
+}
+
+/**
+ * dhd_pktid_map_reserve - reserve a unique numbered key. Reserved locker is not
+ * yet populated. Invoke the pktid save api to populate the packet parameters
+ * into the locker. This function is not reentrant, and is the caller's
+ * responsibility. Caller must treat a returned value DHD_PKTID_INVALID as
+ * a failure case, implying a depleted pool of pktids.
+ */
+static INLINE uint32
+dhd_pktid_map_reserve(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle,
+       void *pkt, dhd_pkttype_t pkttype)
+{
+       uint32 nkey;
+       dhd_pktid_map_t *map;
+       dhd_pktid_item_t *locker;
+       unsigned long flags;
+
+       ASSERT(handle != NULL);
+       map = (dhd_pktid_map_t *)handle;
+
+       DHD_PKTID_LOCK(map->pktid_lock, flags);
+
+       if ((int)(map->avail) <= 0) { /* no more pktids to allocate */
+               map->failures++;
+               DHD_INFO(("%s:%d: failed, no free keys\n", __FUNCTION__, __LINE__));
+               DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+               return DHD_PKTID_INVALID; /* failed alloc request */
+       }
+
+       ASSERT(map->avail <= map->items);
+       nkey = map->keys[map->avail]; /* fetch a free locker, pop stack */
+
+       if ((map->avail > map->items) || (nkey > map->items)) {
+               map->failures++;
+               DHD_ERROR(("%s:%d: failed to allocate a new pktid,"
+                       " map->avail<%u>, nkey<%u>, pkttype<%u>\n",
+                       __FUNCTION__, __LINE__, map->avail, nkey,
+                       pkttype));
+               DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+               return DHD_PKTID_INVALID; /* failed alloc request */
+       }
+
+       locker = &map->lockers[nkey]; /* save packet metadata in locker */
+       map->avail--;
+       locker->pkt = pkt; /* pkt is saved, other params not yet saved. */
+       locker->len = 0;
+       locker->state = LOCKER_IS_BUSY; /* reserve this locker */
+
+       DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+
+       ASSERT(nkey != DHD_PKTID_INVALID);
+
+       return nkey; /* return locker's numbered key */
+}
+
+/*
+ * dhd_pktid_map_save - Save a packet's parameters into a locker
+ * corresponding to a previously reserved unique numbered key.
+ */
+static INLINE void
+dhd_pktid_map_save(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle, void *pkt,
+       uint32 nkey, dmaaddr_t pa, uint32 len, uint8 dir, void *dmah, void *secdma,
+       dhd_pkttype_t pkttype)
+{
+       dhd_pktid_map_t *map;
+       dhd_pktid_item_t *locker;
+       unsigned long flags;
+
+       ASSERT(handle != NULL);
+       map = (dhd_pktid_map_t *)handle;
+
+       DHD_PKTID_LOCK(map->pktid_lock, flags);
+
+       if ((nkey == DHD_PKTID_INVALID) || (nkey > DHD_PKIDMAP_ITEMS(map->items))) {
+               DHD_ERROR(("%s:%d: Error! saving invalid pktid<%u> pkttype<%u>\n",
+                       __FUNCTION__, __LINE__, nkey, pkttype));
+               DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+#ifdef DHD_FW_COREDUMP
+               if (dhd->memdump_enabled) {
+                       /* collect core dump */
+                       dhd->memdump_type = DUMP_TYPE_PKTID_INVALID;
+                       dhd_bus_mem_dump(dhd);
+               }
+#else
+               ASSERT(0);
+#endif /* DHD_FW_COREDUMP */
+               return;
+       }
+
+       locker = &map->lockers[nkey];
+
+       ASSERT(((locker->state == LOCKER_IS_BUSY) && (locker->pkt == pkt)) ||
+               ((locker->state == LOCKER_IS_RSVD) && (locker->pkt == NULL)));
+
+       /* store contents in locker */
+       locker->dir = dir;
+       locker->pa = pa;
+       locker->len = (uint16)len; /* 16bit len */
+       locker->dmah = dmah; /* 16bit len */
+       locker->secdma = secdma;
+       locker->pkttype = pkttype;
+       locker->pkt = pkt;
+       locker->state = LOCKER_IS_BUSY; /* make this locker busy */
+#ifdef DHD_MAP_PKTID_LOGGING
+       DHD_PKTID_LOG(dhd, dhd->prot->pktid_dma_map, pa, nkey, len, pkttype);
+#endif /* DHD_MAP_PKTID_LOGGING */
+       DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+}
+
+/**
+ * dhd_pktid_map_alloc - Allocate a unique numbered key and save the packet
+ * contents into the corresponding locker. Return the numbered key.
+ */
+static uint32
+BCMFASTPATH(dhd_pktid_map_alloc)(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle, void *pkt,
+       dmaaddr_t pa, uint32 len, uint8 dir, void *dmah, void *secdma,
+       dhd_pkttype_t pkttype)
+{
+       uint32 nkey;
+
+       nkey = dhd_pktid_map_reserve(dhd, handle, pkt, pkttype);
+       if (nkey != DHD_PKTID_INVALID) {
+               dhd_pktid_map_save(dhd, handle, pkt, nkey, pa,
+                       len, dir, dmah, secdma, pkttype);
+       }
+
+       return nkey;
+}
+
+/**
+ * dhd_pktid_map_free - Given a numbered key, return the locker contents.
+ * dhd_pktid_map_free() is not reentrant, and is the caller's responsibility.
+ * Caller may not free a pktid value DHD_PKTID_INVALID or an arbitrary pktid
+ * value. Only a previously allocated pktid may be freed.
+ */
+static void *
+BCMFASTPATH(dhd_pktid_map_free)(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle, uint32 nkey,
+       dmaaddr_t *pa, uint32 *len, void **dmah, void **secdma, dhd_pkttype_t pkttype,
+       bool rsv_locker)
+{
+       dhd_pktid_map_t *map;
+       dhd_pktid_item_t *locker;
+       void * pkt;
+       unsigned long long locker_addr;
+       unsigned long flags;
+
+       ASSERT(handle != NULL);
+
+       map = (dhd_pktid_map_t *)handle;
+
+       DHD_PKTID_LOCK(map->pktid_lock, flags);
+
+       /* XXX PLEASE DO NOT remove this ASSERT, fix the bug in caller. */
+       if ((nkey == DHD_PKTID_INVALID) || (nkey > DHD_PKIDMAP_ITEMS(map->items))) {
+               DHD_ERROR(("%s:%d: Error! Try to free invalid pktid<%u>, pkttype<%d>\n",
+                          __FUNCTION__, __LINE__, nkey, pkttype));
+               DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+#ifdef DHD_FW_COREDUMP
+               if (dhd->memdump_enabled) {
+                       /* collect core dump */
+                       dhd->memdump_type = DUMP_TYPE_PKTID_INVALID;
+                       dhd_bus_mem_dump(dhd);
+               }
+#else
+               ASSERT(0);
+#endif /* DHD_FW_COREDUMP */
+               return NULL;
+       }
+
+       locker = &map->lockers[nkey];
+
+#if defined(DHD_PKTID_AUDIT_MAP)
+       DHD_PKTID_AUDIT(dhd, map, nkey, DHD_DUPLICATE_FREE); /* Audit duplicate FREE */
+#endif /* DHD_PKTID_AUDIT_MAP */
+
+       /* Debug check for cloned numbered key */
+       if (locker->state == LOCKER_IS_FREE) {
+               DHD_ERROR(("%s:%d: Error! freeing already freed invalid pktid<%u>\n",
+                          __FUNCTION__, __LINE__, nkey));
+               DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+               /* XXX PLEASE DO NOT remove this ASSERT, fix the bug in caller. */
+#ifdef DHD_FW_COREDUMP
+               if (dhd->memdump_enabled) {
+                       /* collect core dump */
+                       dhd->memdump_type = DUMP_TYPE_PKTID_INVALID;
+                       dhd_bus_mem_dump(dhd);
+               }
+#else
+               ASSERT(0);
+#endif /* DHD_FW_COREDUMP */
+               return NULL;
+       }
+
+       /* Check for the colour of the buffer i.e The buffer posted for TX,
+        * should be freed for TX completion. Similarly the buffer posted for
+        * IOCTL should be freed for IOCT completion etc.
+        */
+       if ((pkttype != PKTTYPE_NO_CHECK) && (locker->pkttype != pkttype)) {
+
+               DHD_ERROR(("%s:%d: Error! Invalid Buffer Free for pktid<%u> \n",
+                       __FUNCTION__, __LINE__, nkey));
+#ifdef BCMDMA64OSL
+               PHYSADDRTOULONG(locker->pa, locker_addr);
+#else
+               locker_addr = PHYSADDRLO(locker->pa);
+#endif /* BCMDMA64OSL */
+               DHD_ERROR(("%s:%d: locker->state <%d>, locker->pkttype <%d>,"
+                       "pkttype <%d> locker->pa <0x%llx> \n",
+                       __FUNCTION__, __LINE__, locker->state, locker->pkttype,
+                       pkttype, locker_addr));
+               DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+#ifdef DHD_FW_COREDUMP
+               if (dhd->memdump_enabled) {
+                       /* collect core dump */
+                       dhd->memdump_type = DUMP_TYPE_PKTID_INVALID;
+                       dhd_bus_mem_dump(dhd);
+               }
+#else
+               ASSERT(0);
+#endif /* DHD_FW_COREDUMP */
+               return NULL;
+       }
+
+       if (rsv_locker == DHD_PKTID_FREE_LOCKER) {
+               map->avail++;
+               map->keys[map->avail] = nkey; /* make this numbered key available */
+               locker->state = LOCKER_IS_FREE; /* open and free Locker */
+       } else {
+               /* pktid will be reused, but the locker does not have a valid pkt */
+               locker->state = LOCKER_IS_RSVD;
+       }
+
+#if defined(DHD_PKTID_AUDIT_MAP)
+       DHD_PKTID_AUDIT(dhd, map, nkey, DHD_TEST_IS_FREE);
+#endif /* DHD_PKTID_AUDIT_MAP */
+#ifdef DHD_MAP_PKTID_LOGGING
+       DHD_PKTID_LOG(dhd, dhd->prot->pktid_dma_unmap, locker->pa, nkey,
+               (uint32)locker->len, pkttype);
+#endif /* DHD_MAP_PKTID_LOGGING */
+
+       *pa = locker->pa; /* return contents of locker */
+       *len = (uint32)locker->len;
+       *dmah = locker->dmah;
+       *secdma = locker->secdma;
+
+       pkt = locker->pkt;
+       locker->pkt = NULL; /* Clear pkt */
+       locker->len = 0;
+
+       DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+
+       return pkt;
+}
+
+#else /* ! DHD_PCIE_PKTID */
+
+typedef struct pktlist {
+       PKT_LIST *tx_pkt_list;          /* list for tx packets */
+       PKT_LIST *rx_pkt_list;          /* list for rx packets */
+       PKT_LIST *ctrl_pkt_list;        /* list for ioctl/event buf post */
+} pktlists_t;
+
+/*
+ * Given that each workitem only uses a 32bit pktid, only 32bit hosts may avail
+ * of a one to one mapping 32bit pktptr and a 32bit pktid.
+ *
+ * - When PKTIDMAP is not used, DHD_NATIVE_TO_PKTID variants will never fail.
+ * - Neither DHD_NATIVE_TO_PKTID nor DHD_PKTID_TO_NATIVE need to be protected by
+ *   a lock.
+ * - Hence DHD_PKTID_INVALID is not defined when DHD_PCIE_PKTID is undefined.
+ */
+#define DHD_PKTID32(pktptr32)  ((uint32)(pktptr32))
+#define DHD_PKTPTR32(pktid32)  ((void *)(pktid32))
+
+static INLINE uint32 dhd_native_to_pktid(dhd_pktid_map_handle_t *map, void *pktptr32,
+       dmaaddr_t pa, uint32 dma_len, void *dmah, void *secdma,
+       dhd_pkttype_t pkttype);
+static INLINE void * dhd_pktid_to_native(dhd_pktid_map_handle_t *map, uint32 pktid32,
+       dmaaddr_t *pa, uint32 *dma_len, void **dmah, void **secdma,
+       dhd_pkttype_t pkttype);
+
+static dhd_pktid_map_handle_t *
+dhd_pktid_map_init(dhd_pub_t *dhd, uint32 num_items)
+{
+       osl_t *osh = dhd->osh;
+       pktlists_t *handle = NULL;
+
+       if ((handle = (pktlists_t *) MALLOCZ(osh, sizeof(pktlists_t))) == NULL) {
+               DHD_ERROR(("%s:%d: MALLOC failed for lists allocation, size=%d\n",
+                          __FUNCTION__, __LINE__, sizeof(pktlists_t)));
+               goto error_done;
+       }
+
+       if ((handle->tx_pkt_list = (PKT_LIST *) MALLOC(osh, sizeof(PKT_LIST))) == NULL) {
+               DHD_ERROR(("%s:%d: MALLOC failed for list allocation, size=%d\n",
+                          __FUNCTION__, __LINE__, sizeof(PKT_LIST)));
+               goto error;
+       }
+
+       if ((handle->rx_pkt_list = (PKT_LIST *) MALLOC(osh, sizeof(PKT_LIST))) == NULL) {
+               DHD_ERROR(("%s:%d: MALLOC failed for list allocation, size=%d\n",
+                          __FUNCTION__, __LINE__, sizeof(PKT_LIST)));
+               goto error;
+       }
+
+       if ((handle->ctrl_pkt_list = (PKT_LIST *) MALLOC(osh, sizeof(PKT_LIST))) == NULL) {
+               DHD_ERROR(("%s:%d: MALLOC failed for list allocation, size=%d\n",
+                          __FUNCTION__, __LINE__, sizeof(PKT_LIST)));
+               goto error;
+       }
+
+       PKTLIST_INIT(handle->tx_pkt_list);
+       PKTLIST_INIT(handle->rx_pkt_list);
+       PKTLIST_INIT(handle->ctrl_pkt_list);
+
+       return (dhd_pktid_map_handle_t *) handle;
+
+error:
+       if (handle->ctrl_pkt_list) {
+               MFREE(osh, handle->ctrl_pkt_list, sizeof(PKT_LIST));
+       }
+
+       if (handle->rx_pkt_list) {
+               MFREE(osh, handle->rx_pkt_list, sizeof(PKT_LIST));
+       }
+
+       if (handle->tx_pkt_list) {
+               MFREE(osh, handle->tx_pkt_list, sizeof(PKT_LIST));
+       }
+
+       if (handle) {
+               MFREE(osh, handle, sizeof(pktlists_t));
+       }
+
+error_done:
+       return (dhd_pktid_map_handle_t *)NULL;
+}
+
+static void
+dhd_pktid_map_reset(dhd_pub_t *dhd, pktlists_t *handle)
+{
+       osl_t *osh = dhd->osh;
+
+       if (handle->ctrl_pkt_list) {
+               PKTLIST_FINI(handle->ctrl_pkt_list);
+               MFREE(osh, handle->ctrl_pkt_list, sizeof(PKT_LIST));
+       }
+
+       if (handle->rx_pkt_list) {
+               PKTLIST_FINI(handle->rx_pkt_list);
+               MFREE(osh, handle->rx_pkt_list, sizeof(PKT_LIST));
+       }
+
+       if (handle->tx_pkt_list) {
+               PKTLIST_FINI(handle->tx_pkt_list);
+               MFREE(osh, handle->tx_pkt_list, sizeof(PKT_LIST));
+       }
+}
+
+static void
+dhd_pktid_map_fini(dhd_pub_t *dhd, dhd_pktid_map_handle_t *map)
+{
+       osl_t *osh = dhd->osh;
+       pktlists_t *handle = (pktlists_t *) map;
+
+       ASSERT(handle != NULL);
+       if (handle == (pktlists_t *)NULL) {
+               return;
+       }
+
+       dhd_pktid_map_reset(dhd, handle);
+
+       if (handle) {
+               MFREE(osh, handle, sizeof(pktlists_t));
+       }
+}
+
+/** Save dma parameters into the packet's pkttag and convert a pktptr to pktid */
+static INLINE uint32
+dhd_native_to_pktid(dhd_pktid_map_handle_t *map, void *pktptr32,
+       dmaaddr_t pa, uint32 dma_len, void *dmah, void *secdma,
+       dhd_pkttype_t pkttype)
+{
+       pktlists_t *handle = (pktlists_t *) map;
+       ASSERT(pktptr32 != NULL);
+       DHD_PKT_SET_DMA_LEN(pktptr32, dma_len);
+       DHD_PKT_SET_DMAH(pktptr32, dmah);
+       DHD_PKT_SET_PA(pktptr32, pa);
+       DHD_PKT_SET_SECDMA(pktptr32, secdma);
+
+       /* XXX optimize these branch conditionals */
+       if (pkttype == PKTTYPE_DATA_TX) {
+               PKTLIST_ENQ(handle->tx_pkt_list,  pktptr32);
+       } else if (pkttype == PKTTYPE_DATA_RX) {
+               PKTLIST_ENQ(handle->rx_pkt_list,  pktptr32);
+       } else {
+               PKTLIST_ENQ(handle->ctrl_pkt_list,  pktptr32);
+       }
+
+       return DHD_PKTID32(pktptr32);
+}
+
+/** Convert a pktid to pktptr and retrieve saved dma parameters from packet */
+static INLINE void *
+dhd_pktid_to_native(dhd_pktid_map_handle_t *map, uint32 pktid32,
+       dmaaddr_t *pa, uint32 *dma_len, void **dmah, void **secdma,
+       dhd_pkttype_t pkttype)
+{
+       pktlists_t *handle = (pktlists_t *) map;
+       void *pktptr32;
+
+       ASSERT(pktid32 != 0U);
+       pktptr32 = DHD_PKTPTR32(pktid32);
+       *dma_len = DHD_PKT_GET_DMA_LEN(pktptr32);
+       *dmah = DHD_PKT_GET_DMAH(pktptr32);
+       *pa = DHD_PKT_GET_PA(pktptr32);
+       *secdma = DHD_PKT_GET_SECDMA(pktptr32);
+
+       /* XXX optimize these branch conditionals */
+       if (pkttype == PKTTYPE_DATA_TX) {
+               PKTLIST_UNLINK(handle->tx_pkt_list,  pktptr32);
+       } else if (pkttype == PKTTYPE_DATA_RX) {
+               PKTLIST_UNLINK(handle->rx_pkt_list,  pktptr32);
+       } else {
+               PKTLIST_UNLINK(handle->ctrl_pkt_list,  pktptr32);
+       }
+
+       return pktptr32;
+}
+
+#define DHD_NATIVE_TO_PKTID_RSV(dhd, map, pkt, pkttype)  DHD_PKTID32(pkt)
+
+#define DHD_NATIVE_TO_PKTID_SAVE(dhd, map, pkt, nkey, pa, len, dma_dir, dmah, secdma, pkttype) \
+       ({ BCM_REFERENCE(dhd); BCM_REFERENCE(nkey); BCM_REFERENCE(dma_dir); \
+          dhd_native_to_pktid((dhd_pktid_map_handle_t *) map, (pkt), (pa), (len), \
+                          (dmah), (secdma), (dhd_pkttype_t)(pkttype)); \
+       })
+
+#define DHD_NATIVE_TO_PKTID(dhd, map, pkt, pa, len, dma_dir, dmah, secdma, pkttype) \
+       ({ BCM_REFERENCE(dhd); BCM_REFERENCE(dma_dir); \
+          dhd_native_to_pktid((dhd_pktid_map_handle_t *) map, (pkt), (pa), (len), \
+                          (dmah), (secdma), (dhd_pkttype_t)(pkttype)); \
+       })
+
+#define DHD_PKTID_TO_NATIVE(dhd, map, pktid, pa, len, dmah, secdma, pkttype) \
+       ({ BCM_REFERENCE(dhd); BCM_REFERENCE(pkttype);  \
+               dhd_pktid_to_native((dhd_pktid_map_handle_t *) map, (uint32)(pktid), \
+                               (dmaaddr_t *)&(pa), (uint32 *)&(len), (void **)&(dmah), \
+                               (void **)&secdma, (dhd_pkttype_t)(pkttype)); \
+       })
+
+#define DHD_PKTID_AVAIL(map)  (~0)
+
+#endif /* ! DHD_PCIE_PKTID */
+
+/* +------------------ End of PCIE DHD PKTID MAPPER  -----------------------+ */
+
+/*
+ * Allocating buffers for common rings.
+ * also allocating Buffers for hmaptest, Scratch buffer for dma rx offset,
+ * bus_throughput_measurement and snapshot upload
+ */
+static int
+dhd_prot_allocate_bufs(dhd_pub_t *dhd, dhd_prot_t *prot)
+{
+
+       /* Common Ring Allocations */
+
+       /* Ring  0: H2D Control Submission */
+       if (dhd_prot_ring_attach(dhd, &prot->h2dring_ctrl_subn, "h2dctrl",
+               H2DRING_CTRL_SUB_MAX_ITEM, H2DRING_CTRL_SUB_ITEMSIZE,
+               BCMPCIE_H2D_MSGRING_CONTROL_SUBMIT) != BCME_OK) {
+               DHD_ERROR(("%s: dhd_prot_ring_attach H2D Ctrl Submission failed\n",
+                       __FUNCTION__));
+               goto fail;
+       }
+
+       /* Ring  1: H2D Receive Buffer Post */
+       if (dhd_prot_ring_attach(dhd, &prot->h2dring_rxp_subn, "h2drxp",
+               H2DRING_RXPOST_MAX_ITEM, H2DRING_RXPOST_ITEMSIZE,
+               BCMPCIE_H2D_MSGRING_RXPOST_SUBMIT) != BCME_OK) {
+               DHD_ERROR(("%s: dhd_prot_ring_attach H2D RxPost failed\n",
+                       __FUNCTION__));
+               goto fail;
+       }
+
+       /* Ring  2: D2H Control Completion */
+       if (dhd_prot_ring_attach(dhd, &prot->d2hring_ctrl_cpln, "d2hctrl",
+               D2HRING_CTRL_CMPLT_MAX_ITEM, D2HRING_CTRL_CMPLT_ITEMSIZE,
+               BCMPCIE_D2H_MSGRING_CONTROL_COMPLETE) != BCME_OK) {
+               DHD_ERROR(("%s: dhd_prot_ring_attach D2H Ctrl Completion failed\n",
+                       __FUNCTION__));
+               goto fail;
+       }
+
+       /* Ring  3: D2H Transmit Complete */
+       if (dhd_prot_ring_attach(dhd, &prot->d2hring_tx_cpln, "d2htxcpl",
+               D2HRING_TXCMPLT_MAX_ITEM, D2HRING_TXCMPLT_ITEMSIZE,
+               BCMPCIE_D2H_MSGRING_TX_COMPLETE) != BCME_OK) {
+               DHD_ERROR(("%s: dhd_prot_ring_attach D2H Tx Completion failed\n",
+                       __FUNCTION__));
+               goto fail;
+
+       }
+
+       /* Ring  4: D2H Receive Complete */
+       if (dhd_prot_ring_attach(dhd, &prot->d2hring_rx_cpln, "d2hrxcpl",
+               D2HRING_RXCMPLT_MAX_ITEM, D2HRING_RXCMPLT_ITEMSIZE,
+               BCMPCIE_D2H_MSGRING_RX_COMPLETE) != BCME_OK) {
+               DHD_ERROR(("%s: dhd_prot_ring_attach D2H Rx Completion failed\n",
+                       __FUNCTION__));
+               goto fail;
+
+       }
+
+       /*
+        * Max number of flowrings is not yet known. msgbuf_ring_t with DMA-able
+        * buffers for flowrings will be instantiated, in dhd_prot_init() .
+        * See dhd_prot_flowrings_pool_attach()
+        */
+       /* ioctl response buffer */
+       if (dhd_dma_buf_alloc(dhd, &prot->retbuf, IOCT_RETBUF_SIZE)) {
+               goto fail;
+       }
+
+       /* IOCTL request buffer */
+       if (dhd_dma_buf_alloc(dhd, &prot->ioctbuf, IOCT_RETBUF_SIZE)) {
+               goto fail;
+       }
+
+       /* Host TS request buffer one buffer for now */
+       if (dhd_dma_buf_alloc(dhd, &prot->hostts_req_buf, CTRLSUB_HOSTTS_MEESAGE_SIZE)) {
+               goto fail;
+       }
+       prot->hostts_req_buf_inuse = FALSE;
+
+       /* Scratch buffer for dma rx offset */
+#ifdef BCM_HOST_BUF
+       if (dhd_dma_buf_alloc(dhd, &prot->d2h_dma_scratch_buf,
+               ROUNDUP(DMA_D2H_SCRATCH_BUF_LEN, 16) + DMA_HOST_BUFFER_LEN))
+#else
+       if (dhd_dma_buf_alloc(dhd, &prot->d2h_dma_scratch_buf, DMA_D2H_SCRATCH_BUF_LEN))
+
+#endif /* BCM_HOST_BUF */
+       {
+               goto fail;
+       }
+
+       /* scratch buffer bus throughput measurement */
+       if (dhd_dma_buf_alloc(dhd, &prot->host_bus_throughput_buf, DHD_BUS_TPUT_BUF_LEN)) {
+               goto fail;
+       }
+
+       return BCME_OK;
+
+fail:
+       return BCME_NOMEM;
+}
+
+/**
+ * The PCIE FD protocol layer is constructed in two phases:
+ *    Phase 1. dhd_prot_attach()
+ *    Phase 2. dhd_prot_init()
+ *
+ * dhd_prot_attach() - Allocates a dhd_prot_t object and resets all its fields.
+ * All Common rings are also attached (msgbuf_ring_t objects are allocated
+ * with DMA-able buffers).
+ * All dhd_dma_buf_t objects are also allocated here.
+ *
+ * As dhd_prot_attach is invoked prior to the pcie_shared object is read, any
+ * initialization of objects that requires information advertized by the dongle
+ * may not be performed here.
+ * E.g. the number of TxPost flowrings is not know at this point, neither do
+ * we know shich form of D2H DMA sync mechanism is advertized by the dongle, or
+ * whether the dongle supports DMA-ing of WR/RD indices for the H2D and/or D2H
+ * rings (common + flow).
+ *
+ * dhd_prot_init() is invoked after the bus layer has fetched the information
+ * advertized by the dongle in the pcie_shared_t.
+ */
+int
+dhd_prot_attach(dhd_pub_t *dhd)
+{
+       osl_t *osh = dhd->osh;
+       dhd_prot_t *prot;
+       uint32 trap_buf_len;
+
+       /* Allocate prot structure */
+       if (!(prot = (dhd_prot_t *)DHD_OS_PREALLOC(dhd, DHD_PREALLOC_PROT,
+               sizeof(dhd_prot_t)))) {
+               DHD_ERROR(("%s: kmalloc failed\n", __FUNCTION__));
+               goto fail;
+       }
+       memset(prot, 0, sizeof(*prot));
+
+       prot->osh = osh;
+       dhd->prot = prot;
+
+       /* DMAing ring completes supported? FALSE by default  */
+       dhd->dma_d2h_ring_upd_support = FALSE;
+       dhd->dma_h2d_ring_upd_support = FALSE;
+       dhd->dma_ring_upd_overwrite = FALSE;
+
+       dhd->hwa_inited = 0;
+       dhd->idma_inited = 0;
+       dhd->ifrm_inited = 0;
+       dhd->dar_inited = 0;
+
+       if (dhd_prot_allocate_bufs(dhd, prot) != BCME_OK) {
+               goto fail;
+       }
+
+#ifdef DHD_RX_CHAINING
+       dhd_rxchain_reset(&prot->rxchain);
+#endif
+
+       prot->pktid_ctrl_map = DHD_NATIVE_TO_PKTID_INIT(dhd, MAX_CTRL_PKTID);
+       if (prot->pktid_ctrl_map == NULL) {
+               goto fail;
+       }
+
+       prot->pktid_rx_map = DHD_NATIVE_TO_PKTID_INIT(dhd, MAX_RX_PKTID);
+       if (prot->pktid_rx_map == NULL)
+               goto fail;
+
+       prot->pktid_tx_map = DHD_NATIVE_TO_PKTID_INIT(dhd, MAX_TX_PKTID);
+       if (prot->pktid_rx_map == NULL)
+               goto fail;
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+       prot->pktid_map_handle_ioctl = DHD_NATIVE_TO_PKTID_INIT(dhd,
+               DHD_FLOWRING_MAX_IOCTLRESPBUF_POST);
+       if (prot->pktid_map_handle_ioctl == NULL) {
+               goto fail;
+       }
+#endif /* IOCTLRESP_USE_CONSTMEM */
+
+#ifdef DHD_MAP_PKTID_LOGGING
+       prot->pktid_dma_map = DHD_PKTID_LOG_INIT(dhd, MAX_PKTID_LOG);
+       if (prot->pktid_dma_map == NULL) {
+               DHD_ERROR(("%s: failed to allocate pktid_dma_map\n",
+                       __FUNCTION__));
+       }
+
+       prot->pktid_dma_unmap = DHD_PKTID_LOG_INIT(dhd, MAX_PKTID_LOG);
+       if (prot->pktid_dma_unmap == NULL) {
+               DHD_ERROR(("%s: failed to allocate pktid_dma_unmap\n",
+                       __FUNCTION__));
+       }
+#endif /* DHD_MAP_PKTID_LOGGING */
+
+          /* Initialize the work queues to be used by the Load Balancing logic */
+#if defined(DHD_LB_TXC)
+       {
+               void *buffer;
+               buffer = MALLOC(dhd->osh, sizeof(void*) * DHD_LB_WORKQ_SZ);
+               if (buffer == NULL) {
+                       DHD_ERROR(("%s: failed to allocate RXC work buffer\n", __FUNCTION__));
+                       goto fail;
+               }
+               bcm_workq_init(&prot->tx_compl_prod, &prot->tx_compl_cons,
+                       buffer, DHD_LB_WORKQ_SZ);
+               prot->tx_compl_prod_sync = 0;
+               DHD_INFO(("%s: created tx_compl_workq <%p,%d>\n",
+                       __FUNCTION__, buffer, DHD_LB_WORKQ_SZ));
+          }
+#endif /* DHD_LB_TXC */
+
+#if defined(DHD_LB_RXC)
+          {
+               void *buffer;
+               buffer = MALLOC(dhd->osh, sizeof(void*) * DHD_LB_WORKQ_SZ);
+               if (buffer == NULL) {
+                       DHD_ERROR(("%s: failed to allocate RXC work buffer\n", __FUNCTION__));
+                       goto fail;
+               }
+               bcm_workq_init(&prot->rx_compl_prod, &prot->rx_compl_cons,
+                       buffer, DHD_LB_WORKQ_SZ);
+               prot->rx_compl_prod_sync = 0;
+               DHD_INFO(("%s: created rx_compl_workq <%p,%d>\n",
+                       __FUNCTION__, buffer, DHD_LB_WORKQ_SZ));
+          }
+#endif /* DHD_LB_RXC */
+
+       /* FW going to DMA extended trap data,
+        * allocate buffer for the maximum extended trap data.
+        */
+       trap_buf_len = BCMPCIE_EXT_TRAP_DATA_MAXLEN;
+
+       /* Initialize trap buffer */
+       if (dhd_dma_buf_alloc(dhd, &dhd->prot->fw_trap_buf, trap_buf_len)) {
+               DHD_ERROR(("%s: dhd_init_trap_buffer falied\n", __FUNCTION__));
+               goto fail;
+       }
+
+       return BCME_OK;
+
+fail:
+
+       if (prot) {
+               /* Free up all allocated memories */
+               dhd_prot_detach(dhd);
+       }
+
+       return BCME_NOMEM;
+} /* dhd_prot_attach */
+
+static int
+dhd_alloc_host_scbs(dhd_pub_t *dhd)
+{
+       int ret = BCME_OK;
+       sh_addr_t base_addr;
+       dhd_prot_t *prot = dhd->prot;
+       uint32 host_scb_size = 0;
+
+       if (dhd->hscb_enable) {
+               /* read number of bytes to allocate from F/W */
+               dhd_bus_cmn_readshared(dhd->bus, &host_scb_size, HOST_SCB_ADDR, 0);
+               if (host_scb_size) {
+                       /* In fw reload scenario the buffer could have been allocated for previous
+                        * run. Check the existing buffer if there is one that can accommodate
+                        * the new firmware requirement and reuse the buffer is possible.
+                        */
+                       if (prot->host_scb_buf.va) {
+                               if (prot->host_scb_buf.len >= host_scb_size) {
+                                       prot->host_scb_buf.len = host_scb_size;
+                               } else {
+                                       dhd_dma_buf_free(dhd, &prot->host_scb_buf);
+                               }
+                       }
+                       /* alloc array of host scbs */
+                       if (prot->host_scb_buf.va == NULL) {
+                               ret = dhd_dma_buf_alloc(dhd, &prot->host_scb_buf, host_scb_size);
+                       }
+                       /* write host scb address to F/W */
+                       if (ret == BCME_OK) {
+                               dhd_base_addr_htolpa(&base_addr, prot->host_scb_buf.pa);
+                               dhd_bus_cmn_writeshared(dhd->bus, &base_addr, sizeof(base_addr),
+                                       HOST_SCB_ADDR, 0);
+                       }
+               }
+       } else {
+               DHD_TRACE(("%s: Host scb not supported in F/W. \n", __FUNCTION__));
+       }
+
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s dhd_alloc_host_scbs, alloc failed: Err Code %d\n",
+                       __FUNCTION__, ret));
+       }
+       return ret;
+}
+
+void
+dhd_set_host_cap(dhd_pub_t *dhd)
+{
+       uint32 data = 0;
+       dhd_prot_t *prot = dhd->prot;
+
+       if (dhd->bus->api.fw_rev >= PCIE_SHARED_VERSION_6) {
+               if (dhd->h2d_phase_supported) {
+                       data |= HOSTCAP_H2D_VALID_PHASE;
+                       if (dhd->force_dongletrap_on_bad_h2d_phase)
+                               data |= HOSTCAP_H2D_ENABLE_TRAP_ON_BADPHASE;
+               }
+               if (prot->host_ipc_version > prot->device_ipc_version)
+                       prot->active_ipc_version = prot->device_ipc_version;
+               else
+                       prot->active_ipc_version = prot->host_ipc_version;
+
+               data |= prot->active_ipc_version;
+
+               if (dhdpcie_bus_get_pcie_hostready_supported(dhd->bus)) {
+                       DHD_INFO(("Advertise Hostready Capability\n"));
+                       data |= HOSTCAP_H2D_ENABLE_HOSTRDY;
+               }
+#ifdef PCIE_INB_DW
+               if (dhdpcie_bus_get_pcie_inband_dw_supported(dhd->bus)) {
+                       DHD_INFO(("Advertise Inband-DW Capability\n"));
+                       data |= HOSTCAP_DS_INBAND_DW;
+                       data |= HOSTCAP_DS_NO_OOB_DW;
+                       dhdpcie_bus_enab_pcie_dw(dhd->bus, DEVICE_WAKE_INB);
+               } else
+#endif /* PCIE_INB_DW */
+               {
+                       /* Disable DS altogether */
+                       data |= HOSTCAP_DS_NO_OOB_DW;
+                       dhdpcie_bus_enab_pcie_dw(dhd->bus, DEVICE_WAKE_NONE);
+               }
+
+               /* Indicate support for extended trap data */
+               data |= HOSTCAP_EXTENDED_TRAP_DATA;
+
+               /* Indicate support for TX status metadata */
+               if (dhd->pcie_txs_metadata_enable != 0)
+                       data |= HOSTCAP_TXSTATUS_METADATA;
+
+               /* Enable fast delete ring in firmware if supported */
+               if (dhd->fast_delete_ring_support) {
+                       data |= HOSTCAP_FAST_DELETE_RING;
+               }
+
+               if (dhdpcie_bus_get_pcie_hwa_supported(dhd->bus)) {
+                       DHD_ERROR(("HWA inited\n"));
+                       data |= HOSTCAP_HWA;
+                       dhd->hwa_inited = TRUE;
+               } else {
+                       DHD_ERROR(("HWA not enabled in FW !!\n"));
+                       dhd->hwa_inited = FALSE;
+               }
+
+               if (dhdpcie_bus_get_pcie_idma_supported(dhd->bus)) {
+                       DHD_ERROR(("IDMA inited\n"));
+                       data |= HOSTCAP_H2D_IDMA;
+                       dhd->idma_inited = TRUE;
+               } else {
+                       DHD_ERROR(("IDMA not enabled in FW !!\n"));
+                       dhd->idma_inited = FALSE;
+               }
+
+               if (dhdpcie_bus_get_pcie_ifrm_supported(dhd->bus)) {
+                       DHD_ERROR(("IFRM Inited\n"));
+                       data |= HOSTCAP_H2D_IFRM;
+                       dhd->ifrm_inited = TRUE;
+                       dhd->dma_h2d_ring_upd_support = FALSE;
+                       dhd_prot_dma_indx_free(dhd);
+               } else {
+                       DHD_ERROR(("IFRM not enabled in FW !!\n"));
+                       dhd->ifrm_inited = FALSE;
+               }
+
+               if (dhdpcie_bus_get_pcie_dar_supported(dhd->bus)) {
+                       DHD_ERROR(("DAR doorbell Use\n"));
+                       data |= HOSTCAP_H2D_DAR;
+                       dhd->dar_inited = TRUE;
+               } else {
+                       DHD_ERROR(("DAR not enabled in FW !!\n"));
+                       dhd->dar_inited = FALSE;
+               }
+
+               /* FW Checks for HOSTCAP_UR_FW_NO_TRAP and Does not TRAP if set
+                * Radar 36403220 JIRA SWWLAN-182145
+                */
+               data |= HOSTCAP_UR_FW_NO_TRAP;
+
+               if (dhd->hscb_enable) {
+                       data |= HOSTCAP_HSCB;
+               }
+
+#ifdef EWP_EDL
+               if (dhd->dongle_edl_support) {
+                       data |= HOSTCAP_EDL_RING;
+                       DHD_ERROR(("Enable EDL host cap\n"));
+               } else {
+                       DHD_ERROR(("DO NOT SET EDL host cap\n"));
+               }
+#endif /* EWP_EDL */
+
+#ifdef DHD_DB0TS
+               if (dhd->db0ts_capable) {
+                       data |= HOSTCAP_DB0_TIMESTAMP;
+                       DHD_ERROR(("Enable DB0 TS in host cap\n"));
+               } else {
+                       DHD_ERROR(("DB0 TS not enabled in host cap\n"));
+               }
+#endif /* DHD_DB0TS */
+               if (dhd->extdtxs_in_txcpl) {
+                       DHD_ERROR(("Enable hostcap: EXTD TXS in txcpl\n"));
+                       data |= HOSTCAP_PKT_TXSTATUS;
+               }
+               else {
+                       DHD_ERROR(("Enable hostcap: EXTD TXS in txcpl\n"));
+               }
+
+               DHD_INFO(("%s:Active Ver:%d, Host Ver:%d, FW Ver:%d\n",
+                       __FUNCTION__,
+                       prot->active_ipc_version, prot->host_ipc_version,
+                       prot->device_ipc_version));
+
+               dhd_bus_cmn_writeshared(dhd->bus, &data, sizeof(uint32), HOST_API_VERSION, 0);
+               dhd_bus_cmn_writeshared(dhd->bus, &prot->fw_trap_buf.pa,
+                       sizeof(prot->fw_trap_buf.pa), DNGL_TO_HOST_TRAP_ADDR, 0);
+       }
+
+}
+
+/**
+ * dhd_prot_init - second stage of dhd_prot_attach. Now that the dongle has
+ * completed it's initialization of the pcie_shared structure, we may now fetch
+ * the dongle advertized features and adjust the protocol layer accordingly.
+ *
+ * dhd_prot_init() may be invoked again after a dhd_prot_reset().
+ */
+int
+dhd_prot_init(dhd_pub_t *dhd)
+{
+       sh_addr_t base_addr;
+       dhd_prot_t *prot = dhd->prot;
+       int ret = 0;
+       uint32 idmacontrol;
+       uint32 waitcount = 0;
+
+       /**
+        * A user defined value can be assigned to global variable h2d_max_txpost via
+        * 1. DHD IOVAR h2d_max_txpost, before firmware download
+        * 2. module parameter h2d_max_txpost
+        * prot->h2d_max_txpost is assigned with DHD_H2DRING_TXPOST_MAX_ITEM,
+        * if user has not defined any buffers by one of the above methods.
+        */
+       prot->h2d_max_txpost = (uint16)h2d_max_txpost;
+       DHD_ERROR(("%s:%d: h2d_max_txpost = %d\n", __FUNCTION__, __LINE__, prot->h2d_max_txpost));
+
+#if defined(DHD_HTPUT_TUNABLES)
+       prot->h2d_htput_max_txpost = (uint16)h2d_htput_max_txpost;
+       DHD_ERROR(("%s:%d: h2d_htput_max_txpost = %d\n",
+               __FUNCTION__, __LINE__, prot->h2d_htput_max_txpost));
+#endif /* DHD_HTPUT_TUNABLES */
+
+       /* Read max rx packets supported by dongle */
+       dhd_bus_cmn_readshared(dhd->bus, &prot->max_rxbufpost, MAX_HOST_RXBUFS, 0);
+       if (prot->max_rxbufpost == 0) {
+               /* This would happen if the dongle firmware is not */
+               /* using the latest shared structure template */
+               prot->max_rxbufpost = DEFAULT_RX_BUFFERS_TO_POST;
+       }
+       DHD_ERROR(("%s:%d: MAX_RXBUFPOST = %d\n", __FUNCTION__, __LINE__, prot->max_rxbufpost));
+
+       /* Initialize.  bzero() would blow away the dma pointers. */
+       prot->max_eventbufpost = DHD_FLOWRING_MAX_EVENTBUF_POST;
+       prot->max_ioctlrespbufpost = DHD_FLOWRING_MAX_IOCTLRESPBUF_POST;
+       prot->max_infobufpost = DHD_H2D_INFORING_MAX_BUF_POST;
+       prot->max_tsbufpost = DHD_MAX_TSBUF_POST;
+
+       prot->cur_ioctlresp_bufs_posted = 0;
+       OSL_ATOMIC_INIT(dhd->osh, &prot->active_tx_count);
+       prot->data_seq_no = 0;
+       prot->ioctl_seq_no = 0;
+       prot->rxbufpost = 0;
+       prot->tot_rxbufpost = 0;
+       prot->tot_rxcpl = 0;
+       prot->cur_event_bufs_posted = 0;
+       prot->ioctl_state = 0;
+       prot->curr_ioctl_cmd = 0;
+       prot->cur_ts_bufs_posted = 0;
+       prot->infobufpost = 0;
+
+       prot->dmaxfer.srcmem.va = NULL;
+       prot->dmaxfer.dstmem.va = NULL;
+       prot->dmaxfer.in_progress = FALSE;
+
+       prot->metadata_dbg = FALSE;
+       prot->rx_metadata_offset = 0;
+       prot->tx_metadata_offset = 0;
+       prot->txp_threshold = TXP_FLUSH_MAX_ITEMS_FLUSH_CNT;
+
+       /* To catch any rollover issues fast, starting with higher ioctl_trans_id */
+       prot->ioctl_trans_id = MAXBITVAL(NBITS(prot->ioctl_trans_id)) - BUFFER_BEFORE_ROLLOVER;
+       prot->ioctl_state = 0;
+       prot->ioctl_status = 0;
+       prot->ioctl_resplen = 0;
+       prot->ioctl_received = IOCTL_WAIT;
+
+       /* Initialize Common MsgBuf Rings */
+
+       prot->device_ipc_version = dhd->bus->api.fw_rev;
+       prot->host_ipc_version = PCIE_SHARED_VERSION;
+       prot->no_tx_resource = FALSE;
+
+       /* Init the host API version */
+       dhd_set_host_cap(dhd);
+
+       /* alloc and configure scb host address for dongle */
+       if ((ret = dhd_alloc_host_scbs(dhd))) {
+               return ret;
+       }
+
+       /* Register the interrupt function upfront */
+       /* remove corerev checks in data path */
+       /* do this after host/fw negotiation for DAR */
+       prot->mb_ring_fn = dhd_bus_get_mbintr_fn(dhd->bus);
+       prot->mb_2_ring_fn = dhd_bus_get_mbintr_2_fn(dhd->bus);
+
+       dhd->bus->_dar_war = (dhd->bus->sih->buscorerev < 64) ? TRUE : FALSE;
+
+       dhd_prot_ring_init(dhd, &prot->h2dring_ctrl_subn);
+       dhd_prot_ring_init(dhd, &prot->h2dring_rxp_subn);
+       dhd_prot_ring_init(dhd, &prot->d2hring_ctrl_cpln);
+
+       /* Make it compatibile with pre-rev7 Firmware */
+       if (prot->active_ipc_version < PCIE_SHARED_VERSION_7) {
+               prot->d2hring_tx_cpln.item_len =
+                       D2HRING_TXCMPLT_ITEMSIZE_PREREV7;
+               prot->d2hring_rx_cpln.item_len =
+                       D2HRING_RXCMPLT_ITEMSIZE_PREREV7;
+       }
+       dhd_prot_ring_init(dhd, &prot->d2hring_tx_cpln);
+       dhd_prot_ring_init(dhd, &prot->d2hring_rx_cpln);
+
+       dhd_prot_d2h_sync_init(dhd);
+
+       dhd_prot_h2d_sync_init(dhd);
+
+#ifdef PCIE_INB_DW
+       /* Set the initial DS state */
+       if (INBAND_DW_ENAB(dhd->bus)) {
+               dhdpcie_bus_set_pcie_inband_dw_state(dhd->bus,
+                       DW_DEVICE_DS_ACTIVE);
+       }
+#endif /* PCIE_INB_DW */
+
+       /* init the scratch buffer */
+       dhd_base_addr_htolpa(&base_addr, prot->d2h_dma_scratch_buf.pa);
+       dhd_bus_cmn_writeshared(dhd->bus, &base_addr, sizeof(base_addr),
+               D2H_DMA_SCRATCH_BUF, 0);
+       dhd_bus_cmn_writeshared(dhd->bus, &prot->d2h_dma_scratch_buf.len,
+               sizeof(prot->d2h_dma_scratch_buf.len), D2H_DMA_SCRATCH_BUF_LEN, 0);
+
+       /* If supported by the host, indicate the memory block
+        * for completion writes / submission reads to shared space
+        */
+       if (dhd->dma_d2h_ring_upd_support) {
+               dhd_base_addr_htolpa(&base_addr, prot->d2h_dma_indx_wr_buf.pa);
+               dhd_bus_cmn_writeshared(dhd->bus, &base_addr, sizeof(base_addr),
+                       D2H_DMA_INDX_WR_BUF, 0);
+               dhd_base_addr_htolpa(&base_addr, prot->h2d_dma_indx_rd_buf.pa);
+               dhd_bus_cmn_writeshared(dhd->bus, &base_addr, sizeof(base_addr),
+                       H2D_DMA_INDX_RD_BUF, 0);
+       }
+
+       if (dhd->dma_h2d_ring_upd_support || IDMA_ENAB(dhd)) {
+               dhd_base_addr_htolpa(&base_addr, prot->h2d_dma_indx_wr_buf.pa);
+               dhd_bus_cmn_writeshared(dhd->bus, &base_addr, sizeof(base_addr),
+                       H2D_DMA_INDX_WR_BUF, 0);
+               dhd_base_addr_htolpa(&base_addr, prot->d2h_dma_indx_rd_buf.pa);
+               dhd_bus_cmn_writeshared(dhd->bus, &base_addr, sizeof(base_addr),
+                       D2H_DMA_INDX_RD_BUF, 0);
+       }
+       /* Signal to the dongle that common ring init is complete */
+       if (dhd->hostrdy_after_init)
+               dhd_bus_hostready(dhd->bus);
+
+       /*
+        * If the DMA-able buffers for flowring needs to come from a specific
+        * contiguous memory region, then setup prot->flowrings_dma_buf here.
+        * dhd_prot_flowrings_pool_attach() will carve out DMA-able buffers from
+        * this contiguous memory region, for each of the flowrings.
+        */
+
+       /* Pre-allocate pool of msgbuf_ring for flowrings */
+       if (dhd_prot_flowrings_pool_attach(dhd) != BCME_OK) {
+               return BCME_ERROR;
+       }
+
+       dhd->ring_attached = TRUE;
+
+       /* If IFRM is enabled, wait for FW to setup the DMA channel */
+       if (IFRM_ENAB(dhd)) {
+               dhd_base_addr_htolpa(&base_addr, prot->h2d_ifrm_indx_wr_buf.pa);
+               dhd_bus_cmn_writeshared(dhd->bus, &base_addr, sizeof(base_addr),
+                       H2D_IFRM_INDX_WR_BUF, 0);
+       }
+
+       /* If IDMA is enabled and initied, wait for FW to setup the IDMA descriptors
+        * Waiting just before configuring doorbell
+        */
+#define        IDMA_ENABLE_WAIT  10
+       if (IDMA_ACTIVE(dhd)) {
+               /* wait for idma_en bit in IDMAcontrol register to be set */
+               /* Loop till idma_en is not set */
+               uint buscorerev = dhd->bus->sih->buscorerev;
+               idmacontrol = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                       IDMAControl(buscorerev), 0, 0);
+               while (!(idmacontrol & PCIE_IDMA_MODE_EN(buscorerev)) &&
+                       (waitcount++ < IDMA_ENABLE_WAIT)) {
+
+                       DHD_ERROR(("iDMA not enabled yet,waiting 1 ms c=%d IDMAControl = %08x\n",
+                               waitcount, idmacontrol));
+                       OSL_DELAY(1000); /* 1ms as its onetime only */
+                       idmacontrol = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                               IDMAControl(buscorerev), 0, 0);
+               }
+
+               if (waitcount < IDMA_ENABLE_WAIT) {
+                       DHD_ERROR(("iDMA enabled PCIEControl = %08x\n", idmacontrol));
+               } else {
+                       DHD_ERROR(("Error: wait for iDMA timed out wait=%d IDMAControl = %08x\n",
+                               waitcount, idmacontrol));
+                       return BCME_ERROR;
+               }
+       }
+
+       /* Host should configure soft doorbells if needed ... here */
+
+       /* Post to dongle host configured soft doorbells */
+       dhd_msgbuf_ring_config_d2h_soft_doorbell(dhd);
+
+       dhd_msgbuf_rxbuf_post_ioctlresp_bufs(dhd);
+       dhd_msgbuf_rxbuf_post_event_bufs(dhd);
+
+       prot->no_retry = FALSE;
+       prot->no_aggr = FALSE;
+       prot->fixed_rate = FALSE;
+
+       /*
+        * Note that any communication with the Dongle should be added
+        * below this point. Any other host data structure initialiation that
+        * needs to be done prior to the DPC starts executing should be done
+        * befor this point.
+        * Because once we start sending H2D requests to Dongle, the Dongle
+        * respond immediately. So the DPC context to handle this
+        * D2H response could preempt the context in which dhd_prot_init is running.
+        * We want to ensure that all the Host part of dhd_prot_init is
+        * done before that.
+        */
+
+       /* See if info rings could be created, info rings should be created
+       * only if dongle does not support EDL
+       */
+#ifdef EWP_EDL
+       if (dhd->bus->api.fw_rev >= PCIE_SHARED_VERSION_6 && !dhd->dongle_edl_support) {
+#else
+       if (dhd->bus->api.fw_rev >= PCIE_SHARED_VERSION_6) {
+#endif /* EWP_EDL */
+               if ((ret = dhd_prot_init_info_rings(dhd)) != BCME_OK) {
+                       /* For now log and proceed, further clean up action maybe necessary
+                        * when we have more clarity.
+                        */
+                       DHD_ERROR(("%s Info rings couldn't be created: Err Code%d",
+                               __FUNCTION__, ret));
+               }
+       }
+
+#ifdef EWP_EDL
+               /* Create Enhanced Debug Lane rings (EDL) if dongle supports it */
+               if (dhd->dongle_edl_support) {
+                       if ((ret = dhd_prot_init_edl_rings(dhd)) != BCME_OK) {
+                               DHD_ERROR(("%s EDL rings couldn't be created: Err Code%d",
+                                       __FUNCTION__, ret));
+                       }
+               }
+#endif /* EWP_EDL */
+
+       return BCME_OK;
+} /* dhd_prot_init */
+
+/**
+ * dhd_prot_detach - PCIE FD protocol layer destructor.
+ * Unlink, frees allocated protocol memory (including dhd_prot)
+ */
+void dhd_prot_detach(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+
+       /* Stop the protocol module */
+       if (prot) {
+
+               /* free up all DMA-able buffers allocated during prot attach/init */
+
+               dhd_dma_buf_free(dhd, &prot->d2h_dma_scratch_buf);
+               dhd_dma_buf_free(dhd, &prot->retbuf);
+               dhd_dma_buf_free(dhd, &prot->ioctbuf);
+               dhd_dma_buf_free(dhd, &prot->host_bus_throughput_buf);
+               dhd_dma_buf_free(dhd, &prot->hostts_req_buf);
+               dhd_dma_buf_free(dhd, &prot->fw_trap_buf);
+               dhd_dma_buf_free(dhd, &prot->host_scb_buf);
+
+               /* DMA-able buffers for DMAing H2D/D2H WR/RD indices */
+               dhd_dma_buf_free(dhd, &prot->h2d_dma_indx_wr_buf);
+               dhd_dma_buf_free(dhd, &prot->h2d_dma_indx_rd_buf);
+               dhd_dma_buf_free(dhd, &prot->d2h_dma_indx_wr_buf);
+               dhd_dma_buf_free(dhd, &prot->d2h_dma_indx_rd_buf);
+
+               dhd_dma_buf_free(dhd, &prot->h2d_ifrm_indx_wr_buf);
+
+               /* Common MsgBuf Rings */
+               dhd_prot_ring_detach(dhd, &prot->h2dring_ctrl_subn);
+               dhd_prot_ring_detach(dhd, &prot->h2dring_rxp_subn);
+               dhd_prot_ring_detach(dhd, &prot->d2hring_ctrl_cpln);
+               dhd_prot_ring_detach(dhd, &prot->d2hring_tx_cpln);
+               dhd_prot_ring_detach(dhd, &prot->d2hring_rx_cpln);
+
+               /* Detach each DMA-able buffer and free the pool of msgbuf_ring_t */
+               dhd_prot_flowrings_pool_detach(dhd);
+
+               /* detach info rings */
+               dhd_prot_detach_info_rings(dhd);
+
+#ifdef EWP_EDL
+               dhd_prot_detach_edl_rings(dhd);
+#endif
+
+               /* if IOCTLRESP_USE_CONSTMEM is defined IOCTL PKTs use pktid_map_handle_ioctl
+                * handler and PKT memory is allocated using alloc_ioctl_return_buffer(), Otherwise
+                * they will be part of pktid_ctrl_map handler and PKT memory is allocated using
+                * PKTGET_STATIC (if DHD_USE_STATIC_CTRLBUF is defined) OR PKGET.
+                * Similarly for freeing PKT buffers DHD_NATIVE_TO_PKTID_FINI will be used
+                * which calls PKTFREE_STATIC (if DHD_USE_STATIC_CTRLBUF is defined) OR PKFREE.
+                * Else if IOCTLRESP_USE_CONSTMEM is defined IOCTL PKTs will be freed using
+                * DHD_NATIVE_TO_PKTID_FINI_IOCTL which calls free_ioctl_return_buffer.
+                */
+               DHD_NATIVE_TO_PKTID_FINI(dhd, prot->pktid_ctrl_map);
+               DHD_NATIVE_TO_PKTID_FINI(dhd, prot->pktid_rx_map);
+               DHD_NATIVE_TO_PKTID_FINI(dhd, prot->pktid_tx_map);
+#ifdef IOCTLRESP_USE_CONSTMEM
+               DHD_NATIVE_TO_PKTID_FINI_IOCTL(dhd, prot->pktid_map_handle_ioctl);
+#endif
+#ifdef DHD_MAP_PKTID_LOGGING
+               DHD_PKTID_LOG_FINI(dhd, prot->pktid_dma_map);
+               DHD_PKTID_LOG_FINI(dhd, prot->pktid_dma_unmap);
+#endif /* DHD_MAP_PKTID_LOGGING */
+
+#if defined(DHD_LB_TXC)
+               if (prot->tx_compl_prod.buffer)
+                       MFREE(dhd->osh, prot->tx_compl_prod.buffer,
+                             sizeof(void*) * DHD_LB_WORKQ_SZ);
+#endif /* DHD_LB_TXC */
+#if defined(DHD_LB_RXC)
+               if (prot->rx_compl_prod.buffer)
+                       MFREE(dhd->osh, prot->rx_compl_prod.buffer,
+                             sizeof(void*) * DHD_LB_WORKQ_SZ);
+#endif /* DHD_LB_RXC */
+
+               DHD_OS_PREFREE(dhd, dhd->prot, sizeof(dhd_prot_t));
+
+               dhd->prot = NULL;
+       }
+} /* dhd_prot_detach */
+
+/**
+ * dhd_prot_reset - Reset the protocol layer without freeing any objects.
+ * This may be invoked to soft reboot the dongle, without having to
+ * detach and attach the entire protocol layer.
+ *
+ * After dhd_prot_reset(), dhd_prot_init() may be invoked
+ * without going througha dhd_prot_attach() phase.
+ */
+void
+dhd_prot_reset(dhd_pub_t *dhd)
+{
+       struct dhd_prot *prot = dhd->prot;
+
+       DHD_TRACE(("%s\n", __FUNCTION__));
+
+       if (prot == NULL) {
+               return;
+       }
+
+       dhd->ring_attached = FALSE;
+
+       dhd_prot_flowrings_pool_reset(dhd);
+
+       /* Reset Common MsgBuf Rings */
+       dhd_prot_ring_reset(dhd, &prot->h2dring_ctrl_subn);
+       dhd_prot_ring_reset(dhd, &prot->h2dring_rxp_subn);
+       dhd_prot_ring_reset(dhd, &prot->d2hring_ctrl_cpln);
+       dhd_prot_ring_reset(dhd, &prot->d2hring_tx_cpln);
+       dhd_prot_ring_reset(dhd, &prot->d2hring_rx_cpln);
+
+       /* Reset info rings */
+       if (prot->h2dring_info_subn) {
+               dhd_prot_ring_reset(dhd, prot->h2dring_info_subn);
+       }
+
+       if (prot->d2hring_info_cpln) {
+               dhd_prot_ring_reset(dhd, prot->d2hring_info_cpln);
+       }
+
+#ifdef EWP_EDL
+       if (prot->d2hring_edl) {
+               dhd_prot_ring_reset(dhd, prot->d2hring_edl);
+       }
+#endif /* EWP_EDL */
+
+       /* Reset all DMA-able buffers allocated during prot attach */
+       dhd_dma_buf_reset(dhd, &prot->d2h_dma_scratch_buf);
+       dhd_dma_buf_reset(dhd, &prot->retbuf);
+       dhd_dma_buf_reset(dhd, &prot->ioctbuf);
+       dhd_dma_buf_reset(dhd, &prot->host_bus_throughput_buf);
+       dhd_dma_buf_reset(dhd, &prot->hostts_req_buf);
+       dhd_dma_buf_reset(dhd, &prot->fw_trap_buf);
+       dhd_dma_buf_reset(dhd, &prot->host_scb_buf);
+
+       dhd_dma_buf_reset(dhd, &prot->h2d_ifrm_indx_wr_buf);
+
+       /* Rest all DMA-able buffers for DMAing H2D/D2H WR/RD indices */
+       dhd_dma_buf_reset(dhd, &prot->h2d_dma_indx_rd_buf);
+       dhd_dma_buf_reset(dhd, &prot->h2d_dma_indx_wr_buf);
+       dhd_dma_buf_reset(dhd, &prot->d2h_dma_indx_rd_buf);
+       dhd_dma_buf_reset(dhd, &prot->d2h_dma_indx_wr_buf);
+
+       /* XXX: dmaxfer src and dst? */
+
+       prot->rx_metadata_offset = 0;
+       prot->tx_metadata_offset = 0;
+
+       prot->rxbufpost = 0;
+       prot->cur_event_bufs_posted = 0;
+       prot->cur_ioctlresp_bufs_posted = 0;
+
+       OSL_ATOMIC_INIT(dhd->osh, &prot->active_tx_count);
+       prot->data_seq_no = 0;
+       prot->ioctl_seq_no = 0;
+       prot->ioctl_state = 0;
+       prot->curr_ioctl_cmd = 0;
+       prot->ioctl_received = IOCTL_WAIT;
+       /* To catch any rollover issues fast, starting with higher ioctl_trans_id */
+       prot->ioctl_trans_id = MAXBITVAL(NBITS(prot->ioctl_trans_id)) - BUFFER_BEFORE_ROLLOVER;
+       prot->txcpl_db_cnt = 0;
+
+       /* dhd_flow_rings_init is located at dhd_bus_start,
+        * so when stopping bus, flowrings shall be deleted
+        */
+       if (dhd->flow_rings_inited) {
+               dhd_flow_rings_deinit(dhd);
+       }
+
+       /* Reset PKTID map */
+       DHD_NATIVE_TO_PKTID_RESET(dhd, prot->pktid_ctrl_map);
+       DHD_NATIVE_TO_PKTID_RESET(dhd, prot->pktid_rx_map);
+       DHD_NATIVE_TO_PKTID_RESET(dhd, prot->pktid_tx_map);
+#ifdef IOCTLRESP_USE_CONSTMEM
+       DHD_NATIVE_TO_PKTID_RESET_IOCTL(dhd, prot->pktid_map_handle_ioctl);
+#endif /* IOCTLRESP_USE_CONSTMEM */
+#ifdef DMAMAP_STATS
+       dhd->dma_stats.txdata = dhd->dma_stats.txdata_sz = 0;
+       dhd->dma_stats.rxdata = dhd->dma_stats.rxdata_sz = 0;
+#ifndef IOCTLRESP_USE_CONSTMEM
+       dhd->dma_stats.ioctl_rx = dhd->dma_stats.ioctl_rx_sz = 0;
+#endif /* IOCTLRESP_USE_CONSTMEM */
+       dhd->dma_stats.event_rx = dhd->dma_stats.event_rx_sz = 0;
+       dhd->dma_stats.info_rx = dhd->dma_stats.info_rx_sz = 0;
+       dhd->dma_stats.tsbuf_rx = dhd->dma_stats.tsbuf_rx_sz = 0;
+#endif /* DMAMAP_STATS */
+} /* dhd_prot_reset */
+
+#if defined(DHD_LB_RXP)
+#define DHD_LB_DISPATCH_RX_PROCESS(dhdp)       dhd_lb_dispatch_rx_process(dhdp)
+#else /* !DHD_LB_RXP */
+#define DHD_LB_DISPATCH_RX_PROCESS(dhdp)       do { /* noop */ } while (0)
+#endif /* !DHD_LB_RXP */
+
+#if defined(DHD_LB_RXC)
+#define DHD_LB_DISPATCH_RX_COMPL(dhdp) dhd_lb_dispatch_rx_compl(dhdp)
+#else /* !DHD_LB_RXC */
+#define DHD_LB_DISPATCH_RX_COMPL(dhdp) do { /* noop */ } while (0)
+#endif /* !DHD_LB_RXC */
+
+#if defined(DHD_LB_TXC)
+#define DHD_LB_DISPATCH_TX_COMPL(dhdp) dhd_lb_dispatch_tx_compl(dhdp)
+#else /* !DHD_LB_TXC */
+#define DHD_LB_DISPATCH_TX_COMPL(dhdp) do { /* noop */ } while (0)
+#endif /* !DHD_LB_TXC */
+
+#if defined(DHD_LB)
+/* DHD load balancing: deferral of work to another online CPU */
+/* DHD_LB_TXC DHD_LB_RXC DHD_LB_RXP dispatchers, in dhd_linux.c */
+extern void dhd_lb_tx_compl_dispatch(dhd_pub_t *dhdp);
+extern void dhd_lb_rx_compl_dispatch(dhd_pub_t *dhdp);
+extern void dhd_lb_rx_napi_dispatch(dhd_pub_t *dhdp);
+extern void dhd_lb_rx_pkt_enqueue(dhd_pub_t *dhdp, void *pkt, int ifidx);
+extern unsigned long dhd_read_lb_rxp(dhd_pub_t *dhdp);
+
+#if defined(DHD_LB_RXP)
+/**
+ * dhd_lb_dispatch_rx_process - load balance by dispatch Rx processing work
+ * to other CPU cores
+ */
+static INLINE void
+dhd_lb_dispatch_rx_process(dhd_pub_t *dhdp)
+{
+       dhd_lb_rx_napi_dispatch(dhdp); /* dispatch rx_process_napi */
+}
+#endif /* DHD_LB_RXP */
+
+#if defined(DHD_LB_TXC)
+/**
+ * dhd_lb_dispatch_tx_compl - load balance by dispatch Tx complition work
+ * to other CPU cores
+ */
+static INLINE void
+dhd_lb_dispatch_tx_compl(dhd_pub_t *dhdp, uint16 ring_idx)
+{
+       bcm_workq_prod_sync(&dhdp->prot->tx_compl_prod); /* flush WR index */
+       dhd_lb_tx_compl_dispatch(dhdp); /* dispatch tx_compl_tasklet */
+}
+
+/**
+ * DHD load balanced tx completion tasklet handler, that will perform the
+ * freeing of packets on the selected CPU. Packet pointers are delivered to
+ * this tasklet via the tx complete workq.
+ */
+void
+dhd_lb_tx_compl_handler(unsigned long data)
+{
+       int elem_ix;
+       void *pkt, **elem;
+       dmaaddr_t pa;
+       uint32 pa_len;
+       dhd_pub_t *dhd = (dhd_pub_t *)data;
+       dhd_prot_t *prot = dhd->prot;
+       bcm_workq_t *workq = &prot->tx_compl_cons;
+       uint32 count = 0;
+
+       int curr_cpu;
+       curr_cpu = get_cpu();
+       put_cpu();
+
+       DHD_LB_STATS_TXC_PERCPU_CNT_INCR(dhd);
+
+       while (1) {
+               elem_ix = bcm_ring_cons(WORKQ_RING(workq), DHD_LB_WORKQ_SZ);
+
+               if (elem_ix == BCM_RING_EMPTY) {
+                       break;
+               }
+
+               elem = WORKQ_ELEMENT(void *, workq, elem_ix);
+               pkt = *elem;
+
+               DHD_INFO(("%s: tx_compl_cons pkt<%p>\n", __FUNCTION__, pkt));
+
+               OSL_PREFETCH(PKTTAG(pkt));
+               OSL_PREFETCH(pkt);
+
+               pa = DHD_PKTTAG_PA((dhd_pkttag_fr_t *)PKTTAG(pkt));
+               pa_len = DHD_PKTTAG_PA_LEN((dhd_pkttag_fr_t *)PKTTAG(pkt));
+
+               DMA_UNMAP(dhd->osh, pa, pa_len, DMA_RX, 0, 0);
+#if defined(BCMPCIE)
+               dhd_txcomplete(dhd, pkt, true);
+#ifdef DHD_4WAYM4_FAIL_DISCONNECT
+               dhd_eap_txcomplete(dhd, pkt, TRUE, txstatus->cmn_hdr.if_id);
+#endif /* DHD_4WAYM4_FAIL_DISCONNECT */
+#endif
+
+               PKTFREE(dhd->osh, pkt, TRUE);
+               count++;
+       }
+
+       /* smp_wmb(); */
+       bcm_workq_cons_sync(workq);
+       DHD_LB_STATS_UPDATE_TXC_HISTO(dhd, count);
+}
+#endif /* DHD_LB_TXC */
+
+#if defined(DHD_LB_RXC)
+
+/**
+ * dhd_lb_dispatch_rx_compl - load balance by dispatch rx complition work
+ * to other CPU cores
+ */
+static INLINE void
+dhd_lb_dispatch_rx_compl(dhd_pub_t *dhdp)
+{
+       dhd_prot_t *prot = dhdp->prot;
+       /* Schedule the takslet only if we have to */
+       if (prot->rxbufpost <= (prot->max_rxbufpost - RXBUFPOST_THRESHOLD)) {
+               /* flush WR index */
+               bcm_workq_prod_sync(&dhdp->prot->rx_compl_prod);
+               dhd_lb_rx_compl_dispatch(dhdp); /* dispatch rx_compl_tasklet */
+       }
+}
+
+void
+dhd_lb_rx_compl_handler(unsigned long data)
+{
+       dhd_pub_t *dhd = (dhd_pub_t *)data;
+       bcm_workq_t *workq = &dhd->prot->rx_compl_cons;
+
+       DHD_LB_STATS_RXC_PERCPU_CNT_INCR(dhd);
+
+       dhd_msgbuf_rxbuf_post(dhd, TRUE); /* re-use pktids */
+       bcm_workq_cons_sync(workq);
+}
+#endif /* DHD_LB_RXC */
+#endif /* DHD_LB */
+
+void
+dhd_prot_rx_dataoffset(dhd_pub_t *dhd, uint32 rx_offset)
+{
+       dhd_prot_t *prot = dhd->prot;
+       prot->rx_dataoffset = rx_offset;
+}
+
+static int
+dhd_check_create_info_rings(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int ret = BCME_ERROR;
+       uint16 ringid;
+
+       {
+               /* dongle may increase max_submission_rings so keep
+                * ringid at end of dynamic rings
+                */
+               ringid = dhd->bus->max_tx_flowrings +
+                       (dhd->bus->max_submission_rings - dhd->bus->max_tx_flowrings) +
+                       BCMPCIE_H2D_COMMON_MSGRINGS;
+       }
+
+       if (prot->d2hring_info_cpln) {
+               /* for d2hring re-entry case, clear inited flag */
+               prot->d2hring_info_cpln->inited = FALSE;
+       }
+
+       if (prot->h2dring_info_subn && prot->d2hring_info_cpln) {
+               return BCME_OK; /* dhd_prot_init rentry after a dhd_prot_reset */
+       }
+
+       if (prot->h2dring_info_subn == NULL) {
+               prot->h2dring_info_subn = MALLOCZ(prot->osh, sizeof(msgbuf_ring_t));
+
+               if (prot->h2dring_info_subn == NULL) {
+                       DHD_ERROR(("%s: couldn't alloc memory for h2dring_info_subn\n",
+                               __FUNCTION__));
+                       return BCME_NOMEM;
+               }
+
+               DHD_INFO(("%s: about to create debug submit ring\n", __FUNCTION__));
+               ret = dhd_prot_ring_attach(dhd, prot->h2dring_info_subn, "h2dinfo",
+                       H2DRING_DYNAMIC_INFO_MAX_ITEM, H2DRING_INFO_BUFPOST_ITEMSIZE,
+                       ringid);
+               if (ret != BCME_OK) {
+                       DHD_ERROR(("%s: couldn't alloc resources for dbg submit ring\n",
+                               __FUNCTION__));
+                       goto err;
+               }
+       }
+
+       if (prot->d2hring_info_cpln == NULL) {
+               prot->d2hring_info_cpln = MALLOCZ(prot->osh, sizeof(msgbuf_ring_t));
+
+               if (prot->d2hring_info_cpln == NULL) {
+                       DHD_ERROR(("%s: couldn't alloc memory for h2dring_info_subn\n",
+                               __FUNCTION__));
+                       return BCME_NOMEM;
+               }
+
+               /* create the debug info completion ring next to debug info submit ring
+               * ringid = id next to debug info submit ring
+               */
+               ringid = ringid + 1;
+
+               DHD_INFO(("%s: about to create debug cpl ring\n", __FUNCTION__));
+               ret = dhd_prot_ring_attach(dhd, prot->d2hring_info_cpln, "d2hinfo",
+                       D2HRING_DYNAMIC_INFO_MAX_ITEM, D2HRING_INFO_BUFCMPLT_ITEMSIZE,
+                       ringid);
+               if (ret != BCME_OK) {
+                       DHD_ERROR(("%s: couldn't alloc resources for dbg cpl ring\n",
+                               __FUNCTION__));
+                       dhd_prot_ring_detach(dhd, prot->h2dring_info_subn);
+                       goto err;
+               }
+       }
+
+       return ret;
+err:
+       MFREE(prot->osh, prot->h2dring_info_subn, sizeof(msgbuf_ring_t));
+
+       if (prot->d2hring_info_cpln) {
+               MFREE(prot->osh, prot->d2hring_info_cpln, sizeof(msgbuf_ring_t));
+       }
+       return ret;
+} /* dhd_check_create_info_rings */
+
+int
+dhd_prot_init_info_rings(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int ret = BCME_OK;
+
+       if ((ret = dhd_check_create_info_rings(dhd)) != BCME_OK) {
+               DHD_ERROR(("%s: info rings aren't created! \n",
+                       __FUNCTION__));
+               return ret;
+       }
+
+       if ((prot->d2hring_info_cpln->inited) || (prot->d2hring_info_cpln->create_pending)) {
+               DHD_INFO(("Info completion ring was created!\n"));
+               return ret;
+       }
+
+       DHD_TRACE(("trying to send create d2h info ring: id %d\n", prot->d2hring_info_cpln->idx));
+       ret = dhd_send_d2h_ringcreate(dhd, prot->d2hring_info_cpln,
+               BCMPCIE_D2H_RING_TYPE_DBGBUF_CPL, DHD_D2H_DBGRING_REQ_PKTID);
+       if (ret != BCME_OK)
+               return ret;
+
+       prot->h2dring_info_subn->seqnum = H2D_EPOCH_INIT_VAL;
+       prot->h2dring_info_subn->current_phase = 0;
+       prot->d2hring_info_cpln->seqnum = D2H_EPOCH_INIT_VAL;
+       prot->d2hring_info_cpln->current_phase = BCMPCIE_CMNHDR_PHASE_BIT_INIT;
+
+       DHD_TRACE(("trying to send create h2d info ring id %d\n", prot->h2dring_info_subn->idx));
+       prot->h2dring_info_subn->n_completion_ids = 1;
+       prot->h2dring_info_subn->compeltion_ring_ids[0] = prot->d2hring_info_cpln->idx;
+
+       ret = dhd_send_h2d_ringcreate(dhd, prot->h2dring_info_subn,
+               BCMPCIE_H2D_RING_TYPE_DBGBUF_SUBMIT, DHD_H2D_DBGRING_REQ_PKTID);
+
+       /* Note that there is no way to delete d2h or h2d ring deletion incase either fails,
+        * so can not cleanup if one ring was created while the other failed
+        */
+       return ret;
+} /* dhd_prot_init_info_rings */
+
+static void
+dhd_prot_detach_info_rings(dhd_pub_t *dhd)
+{
+       if (dhd->prot->h2dring_info_subn) {
+               dhd_prot_ring_detach(dhd, dhd->prot->h2dring_info_subn);
+               MFREE(dhd->prot->osh, dhd->prot->h2dring_info_subn, sizeof(msgbuf_ring_t));
+       }
+       if (dhd->prot->d2hring_info_cpln) {
+               dhd_prot_ring_detach(dhd, dhd->prot->d2hring_info_cpln);
+               MFREE(dhd->prot->osh, dhd->prot->d2hring_info_cpln, sizeof(msgbuf_ring_t));
+       }
+}
+
+#ifdef EWP_EDL
+static int
+dhd_check_create_edl_rings(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int ret = BCME_ERROR;
+       uint16 ringid;
+
+       {
+               /* dongle may increase max_submission_rings so keep
+                * ringid at end of dynamic rings (re-use info ring cpl ring id)
+                */
+               ringid = dhd->bus->max_tx_flowrings +
+                       (dhd->bus->max_submission_rings - dhd->bus->max_tx_flowrings) +
+                       BCMPCIE_H2D_COMMON_MSGRINGS + 1;
+       }
+
+       if (prot->d2hring_edl) {
+               prot->d2hring_edl->inited = FALSE;
+               return BCME_OK; /* dhd_prot_init rentry after a dhd_prot_reset */
+       }
+
+       if (prot->d2hring_edl == NULL) {
+               prot->d2hring_edl = MALLOCZ(prot->osh, sizeof(msgbuf_ring_t));
+
+               if (prot->d2hring_edl == NULL) {
+                       DHD_ERROR(("%s: couldn't alloc memory for d2hring_edl\n",
+                               __FUNCTION__));
+                       return BCME_NOMEM;
+               }
+
+               DHD_ERROR(("%s: about to create EDL ring, ringid: %u \n", __FUNCTION__,
+                       ringid));
+               ret = dhd_prot_ring_attach(dhd, prot->d2hring_edl, "d2hring_edl",
+                       D2HRING_EDL_MAX_ITEM, D2HRING_EDL_ITEMSIZE,
+                       ringid);
+               if (ret != BCME_OK) {
+                       DHD_ERROR(("%s: couldn't alloc resources for EDL ring\n",
+                               __FUNCTION__));
+                       goto err;
+               }
+       }
+
+       return ret;
+err:
+       MFREE(prot->osh, prot->d2hring_edl, sizeof(msgbuf_ring_t));
+       prot->d2hring_edl = NULL;
+
+       return ret;
+} /* dhd_check_create_btlog_rings */
+
+int
+dhd_prot_init_edl_rings(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int ret = BCME_ERROR;
+
+       if ((ret = dhd_check_create_edl_rings(dhd)) != BCME_OK) {
+               DHD_ERROR(("%s: EDL rings aren't created! \n",
+                       __FUNCTION__));
+               return ret;
+       }
+
+       if ((prot->d2hring_edl->inited) || (prot->d2hring_edl->create_pending)) {
+               DHD_INFO(("EDL completion ring was created!\n"));
+               return ret;
+       }
+
+       DHD_ERROR(("trying to send create d2h edl ring: idx %d\n", prot->d2hring_edl->idx));
+       ret = dhd_send_d2h_ringcreate(dhd, prot->d2hring_edl,
+               BCMPCIE_D2H_RING_TYPE_EDL, DHD_D2H_DBGRING_REQ_PKTID);
+       if (ret != BCME_OK)
+               return ret;
+
+       prot->d2hring_edl->seqnum = D2H_EPOCH_INIT_VAL;
+       prot->d2hring_edl->current_phase = BCMPCIE_CMNHDR_PHASE_BIT_INIT;
+
+       return BCME_OK;
+} /* dhd_prot_init_btlog_rings */
+
+static void
+dhd_prot_detach_edl_rings(dhd_pub_t *dhd)
+{
+       if (dhd->prot->d2hring_edl) {
+               dhd_prot_ring_detach(dhd, dhd->prot->d2hring_edl);
+               MFREE(dhd->prot->osh, dhd->prot->d2hring_edl, sizeof(msgbuf_ring_t));
+               dhd->prot->d2hring_edl = NULL;
+       }
+}
+#endif /* EWP_EDL */
+
+/**
+ * Initialize protocol: sync w/dongle state.
+ * Sets dongle media info (iswl, drv_version, mac address).
+ */
+int dhd_sync_with_dongle(dhd_pub_t *dhd)
+{
+       int ret = 0;
+       uint len = 0;
+       wlc_rev_info_t revinfo;
+       char buf[128];
+       dhd_prot_t *prot = dhd->prot;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       dhd_os_set_ioctl_resp_timeout(IOCTL_RESP_TIMEOUT);
+
+       /* Post ts buffer after shim layer is attached */
+       ret = dhd_msgbuf_rxbuf_post_ts_bufs(dhd);
+
+       /* query for 'wlc_ver' to get version info from firmware */
+       /* memsetting to zero */
+       bzero(buf, sizeof(buf));
+       len = bcm_mkiovar("wlc_ver", NULL, 0, buf, sizeof(buf));
+       if (len == 0) {
+               DHD_ERROR(("%s failed in calling bcm_mkiovar %u\n", __FUNCTION__, len));
+               ret = BCME_ERROR;
+               goto done;
+       }
+       ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, sizeof(buf), FALSE, 0);
+       if (ret < 0) {
+               DHD_ERROR(("%s failed %d\n", __FUNCTION__, ret));
+       } else {
+               dhd->wlc_ver_major = ((wl_wlc_version_t*)buf)->wlc_ver_major;
+               dhd->wlc_ver_minor = ((wl_wlc_version_t*)buf)->wlc_ver_minor;
+       }
+
+       DHD_ERROR(("wlc_ver_major %d, wlc_ver_minor %d\n", dhd->wlc_ver_major, dhd->wlc_ver_minor));
+
+#ifdef DHD_FW_COREDUMP
+       /* Check the memdump capability */
+       dhd_get_memdump_info(dhd);
+#endif /* DHD_FW_COREDUMP */
+#ifdef BCMASSERT_LOG
+       dhd_get_assert_info(dhd);
+#endif /* BCMASSERT_LOG */
+
+       /* Get the device rev info */
+       memset(&revinfo, 0, sizeof(revinfo));
+       ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_REVINFO, &revinfo, sizeof(revinfo), FALSE, 0);
+       if (ret < 0) {
+               DHD_ERROR(("%s: GET revinfo FAILED\n", __FUNCTION__));
+               goto done;
+       }
+       DHD_ERROR(("%s: GET_REVINFO device 0x%x, vendor 0x%x, chipnum 0x%x\n", __FUNCTION__,
+               revinfo.deviceid, revinfo.vendorid, revinfo.chipnum));
+
+       /* Get the RxBuf post size */
+       /* Use default value in case of failure */
+       prot->rxbufpost_sz = DHD_FLOWRING_RX_BUFPOST_PKTSZ;
+       memset(buf, 0, sizeof(buf));
+       len = bcm_mkiovar("rxbufpost_sz", NULL, 0, buf, sizeof(buf));
+       if (len == 0) {
+               DHD_ERROR(("%s failed in calling bcm_mkiovar %u\n", __FUNCTION__, len));
+       } else {
+               ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, sizeof(buf), FALSE, 0);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: GET RxBuf post FAILED, use default %d\n",
+                               __FUNCTION__, DHD_FLOWRING_RX_BUFPOST_PKTSZ));
+               } else {
+                       if (memcpy_s(&(prot->rxbufpost_sz), sizeof(prot->rxbufpost_sz),
+                                       buf, sizeof(uint16)) != BCME_OK) {
+                               DHD_ERROR(("%s: rxbufpost_sz memcpy failed\n", __FUNCTION__));
+                       }
+
+                       if (prot->rxbufpost_sz > DHD_FLOWRING_RX_BUFPOST_PKTSZ_MAX) {
+                               DHD_ERROR(("%s: Invalid RxBuf post size : %d, default to %d\n",
+                                       __FUNCTION__, prot->rxbufpost_sz,
+                                       DHD_FLOWRING_RX_BUFPOST_PKTSZ));
+                                       prot->rxbufpost_sz = DHD_FLOWRING_RX_BUFPOST_PKTSZ;
+                       } else {
+                               DHD_ERROR(("%s: RxBuf Post : %d\n",
+                                       __FUNCTION__, prot->rxbufpost_sz));
+                       }
+               }
+       }
+
+       /* Post buffers for packet reception */
+       dhd_msgbuf_rxbuf_post(dhd, FALSE); /* alloc pkt ids */
+
+       DHD_SSSR_DUMP_INIT(dhd);
+
+       dhd_process_cid_mac(dhd, TRUE);
+       ret = dhd_preinit_ioctls(dhd);
+       dhd_process_cid_mac(dhd, FALSE);
+#if defined(DHD_SDTC_ETB_DUMP)
+       dhd_sdtc_etb_init(dhd);
+#endif /* DHD_SDTC_ETB_DUMP */
+#if defined(DHD_H2D_LOG_TIME_SYNC)
+       if (FW_SUPPORTED(dhd, h2dlogts)) {
+               dhd->dhd_rte_time_sync_ms = DHD_H2D_LOG_TIME_STAMP_MATCH;
+               dhd->bus->dhd_rte_time_sync_count = OSL_SYSUPTIME_US();
+               /* This is during initialization. */
+               dhd_h2d_log_time_sync(dhd);
+       } else {
+               dhd->dhd_rte_time_sync_ms = 0;
+       }
+#endif /* DHD_H2D_LOG_TIME_SYNC */
+
+       /* Always assumes wl for now */
+       dhd->iswl = TRUE;
+done:
+       return ret;
+} /* dhd_sync_with_dongle */
+
+#define DHD_DBG_SHOW_METADATA  0
+
+#if DHD_DBG_SHOW_METADATA
+static void
+BCMFASTPATH(dhd_prot_print_metadata)(dhd_pub_t *dhd, void *ptr, int len)
+{
+       uint8 tlv_t;
+       uint8 tlv_l;
+       uint8 *tlv_v = (uint8 *)ptr;
+
+       if (len <= BCMPCIE_D2H_METADATA_HDRLEN)
+               return;
+
+       len -= BCMPCIE_D2H_METADATA_HDRLEN;
+       tlv_v += BCMPCIE_D2H_METADATA_HDRLEN;
+
+       while (len > TLV_HDR_LEN) {
+               tlv_t = tlv_v[TLV_TAG_OFF];
+               tlv_l = tlv_v[TLV_LEN_OFF];
+
+               len -= TLV_HDR_LEN;
+               tlv_v += TLV_HDR_LEN;
+               if (len < tlv_l)
+                       break;
+               if ((tlv_t == 0) || (tlv_t == WLFC_CTL_TYPE_FILLER))
+                       break;
+
+               switch (tlv_t) {
+               case WLFC_CTL_TYPE_TXSTATUS: {
+                       uint32 txs;
+                       memcpy(&txs, tlv_v, sizeof(uint32));
+                       if (tlv_l < (sizeof(wl_txstatus_additional_info_t) + sizeof(uint32))) {
+                               printf("METADATA TX_STATUS: %08x\n", txs);
+                       } else {
+                               wl_txstatus_additional_info_t tx_add_info;
+                               memcpy(&tx_add_info, tlv_v + sizeof(uint32),
+                                       sizeof(wl_txstatus_additional_info_t));
+                               printf("METADATA TX_STATUS: %08x WLFCTS[%04x | %08x - %08x - %08x]"
+                                       " rate = %08x tries = %d - %d\n", txs,
+                                       tx_add_info.seq, tx_add_info.entry_ts,
+                                       tx_add_info.enq_ts, tx_add_info.last_ts,
+                                       tx_add_info.rspec, tx_add_info.rts_cnt,
+                                       tx_add_info.tx_cnt);
+                       }
+                       } break;
+
+               case WLFC_CTL_TYPE_RSSI: {
+                       if (tlv_l == 1)
+                               printf("METADATA RX_RSSI: rssi = %d\n", *tlv_v);
+                       else
+                               printf("METADATA RX_RSSI[%04x]: rssi = %d snr = %d\n",
+                                       (*(tlv_v + 3) << 8) | *(tlv_v + 2),
+                                       (int8)(*tlv_v), *(tlv_v + 1));
+                       } break;
+
+               case WLFC_CTL_TYPE_FIFO_CREDITBACK:
+                       bcm_print_bytes("METADATA FIFO_CREDITBACK", tlv_v, tlv_l);
+                       break;
+
+               case WLFC_CTL_TYPE_TX_ENTRY_STAMP:
+                       bcm_print_bytes("METADATA TX_ENTRY", tlv_v, tlv_l);
+                       break;
+
+               case WLFC_CTL_TYPE_RX_STAMP: {
+                       struct {
+                               uint32 rspec;
+                               uint32 bus_time;
+                               uint32 wlan_time;
+                       } rx_tmstamp;
+                       memcpy(&rx_tmstamp, tlv_v, sizeof(rx_tmstamp));
+                       printf("METADATA RX TIMESTMAP: WLFCTS[%08x - %08x] rate = %08x\n",
+                               rx_tmstamp.wlan_time, rx_tmstamp.bus_time, rx_tmstamp.rspec);
+                       } break;
+
+               case WLFC_CTL_TYPE_TRANS_ID:
+                       bcm_print_bytes("METADATA TRANS_ID", tlv_v, tlv_l);
+                       break;
+
+               case WLFC_CTL_TYPE_COMP_TXSTATUS:
+                       bcm_print_bytes("METADATA COMP_TXSTATUS", tlv_v, tlv_l);
+                       break;
+
+               default:
+                       bcm_print_bytes("METADATA UNKNOWN", tlv_v, tlv_l);
+                       break;
+               }
+
+               len -= tlv_l;
+               tlv_v += tlv_l;
+       }
+}
+#endif /* DHD_DBG_SHOW_METADATA */
+
+static INLINE void
+BCMFASTPATH(dhd_prot_packet_free)(dhd_pub_t *dhd, void *pkt, uint8 pkttype, bool send)
+{
+       if (pkt) {
+               if (pkttype == PKTTYPE_IOCTL_RX ||
+                       pkttype == PKTTYPE_EVENT_RX ||
+                       pkttype == PKTTYPE_INFO_RX ||
+                       pkttype == PKTTYPE_TSBUF_RX) {
+#ifdef DHD_USE_STATIC_CTRLBUF
+                       PKTFREE_STATIC(dhd->osh, pkt, send);
+#else
+                       PKTFREE(dhd->osh, pkt, send);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+               } else {
+                       PKTFREE(dhd->osh, pkt, send);
+               }
+       }
+}
+
+/**
+ * dhd_prot_packet_get should be called only for items having pktid_ctrl_map handle
+ * and all the bottom most functions like dhd_pktid_map_free hold separate DHD_PKTID_LOCK
+ * to ensure thread safety, so no need to hold any locks for this function
+ */
+static INLINE void *
+BCMFASTPATH(dhd_prot_packet_get)(dhd_pub_t *dhd, uint32 pktid, uint8 pkttype, bool free_pktid)
+{
+       void *PKTBUF;
+       dmaaddr_t pa;
+       uint32 len;
+       void *dmah;
+       void *secdma;
+
+#ifdef DHD_PCIE_PKTID
+       if (free_pktid) {
+               PKTBUF = DHD_PKTID_TO_NATIVE(dhd, dhd->prot->pktid_ctrl_map,
+                       pktid, pa, len, dmah, secdma, pkttype);
+       } else {
+               PKTBUF = DHD_PKTID_TO_NATIVE_RSV(dhd, dhd->prot->pktid_ctrl_map,
+                       pktid, pa, len, dmah, secdma, pkttype);
+       }
+#else
+       PKTBUF = DHD_PKTID_TO_NATIVE(dhd, dhd->prot->pktid_ctrl_map, pktid, pa,
+               len, dmah, secdma, pkttype);
+#endif /* DHD_PCIE_PKTID */
+       if (PKTBUF) {
+               DMA_UNMAP(dhd->osh, pa, (uint) len, DMA_RX, 0, dmah);
+#ifdef DMAMAP_STATS
+               switch (pkttype) {
+#ifndef IOCTLRESP_USE_CONSTMEM
+                       case PKTTYPE_IOCTL_RX:
+                               dhd->dma_stats.ioctl_rx--;
+                               dhd->dma_stats.ioctl_rx_sz -= len;
+                               break;
+#endif /* IOCTLRESP_USE_CONSTMEM */
+                       case PKTTYPE_EVENT_RX:
+                               dhd->dma_stats.event_rx--;
+                               dhd->dma_stats.event_rx_sz -= len;
+                               break;
+                       case PKTTYPE_INFO_RX:
+                               dhd->dma_stats.info_rx--;
+                               dhd->dma_stats.info_rx_sz -= len;
+                               break;
+                       case PKTTYPE_TSBUF_RX:
+                               dhd->dma_stats.tsbuf_rx--;
+                               dhd->dma_stats.tsbuf_rx_sz -= len;
+                               break;
+               }
+#endif /* DMAMAP_STATS */
+       }
+
+       return PKTBUF;
+}
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+static INLINE void
+BCMFASTPATH(dhd_prot_ioctl_ret_buffer_get)(dhd_pub_t *dhd, uint32 pktid, dhd_dma_buf_t *retbuf)
+{
+       memset(retbuf, 0, sizeof(dhd_dma_buf_t));
+       retbuf->va = DHD_PKTID_TO_NATIVE(dhd, dhd->prot->pktid_map_handle_ioctl, pktid,
+               retbuf->pa, retbuf->len, retbuf->dmah, retbuf->secdma, PKTTYPE_IOCTL_RX);
+
+       return;
+}
+#endif
+
+#ifdef PCIE_INB_DW
+static int
+dhd_prot_inc_hostactive_devwake_assert(dhd_bus_t *bus)
+{
+       unsigned long flags = 0;
+
+       if (INBAND_DW_ENAB(bus)) {
+               DHD_BUS_INB_DW_LOCK(bus->inb_lock, flags);
+               bus->host_active_cnt++;
+               DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+               if (dhd_bus_set_device_wake(bus, TRUE) != BCME_OK) {
+                       DHD_BUS_INB_DW_LOCK(bus->inb_lock, flags);
+                       bus->host_active_cnt--;
+                       dhd_bus_inb_ack_pending_ds_req(bus);
+                       DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+                       return BCME_ERROR;
+               }
+       }
+
+       return BCME_OK;
+}
+
+static void
+dhd_prot_dec_hostactive_ack_pending_dsreq(dhd_bus_t *bus)
+{
+       unsigned long flags = 0;
+       if (INBAND_DW_ENAB(bus)) {
+               DHD_BUS_INB_DW_LOCK(bus->inb_lock, flags);
+               bus->host_active_cnt--;
+               dhd_bus_inb_ack_pending_ds_req(bus);
+               DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+       }
+}
+#endif /* PCIE_INB_DW */
+
+static void
+BCMFASTPATH(dhd_msgbuf_rxbuf_post)(dhd_pub_t *dhd, bool use_rsv_pktid)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int16 fillbufs;
+       int retcount = 0;
+
+       fillbufs = prot->max_rxbufpost - prot->rxbufpost;
+       while (fillbufs >= RX_BUF_BURST) {
+               /* Post in a burst of 32 buffers at a time */
+               fillbufs = MIN(fillbufs, RX_BUF_BURST);
+
+               /* Post buffers */
+               retcount = dhd_prot_rxbuf_post(dhd, fillbufs, use_rsv_pktid);
+
+               if (retcount > 0) {
+                       prot->rxbufpost += (uint16)retcount;
+#ifdef DHD_LB_RXC
+                       /* dhd_prot_rxbuf_post returns the number of buffers posted */
+                       DHD_LB_STATS_UPDATE_RXC_HISTO(dhd, retcount);
+#endif /* DHD_LB_RXC */
+                       /* how many more to post */
+                       fillbufs = prot->max_rxbufpost - prot->rxbufpost;
+               } else {
+                       /* Make sure we don't run loop any further */
+                       fillbufs = 0;
+               }
+       }
+}
+
+/** Post 'count' no of rx buffers to dongle */
+static int
+BCMFASTPATH(dhd_prot_rxbuf_post)(dhd_pub_t *dhd, uint16 count, bool use_rsv_pktid)
+{
+       void *p, **pktbuf;
+       uint8 *rxbuf_post_tmp;
+       host_rxbuf_post_t *rxbuf_post;
+       void *msg_start;
+       dmaaddr_t pa, *pktbuf_pa;
+       uint32 *pktlen;
+       uint16 i = 0, alloced = 0;
+       unsigned long flags;
+       uint32 pktid;
+       dhd_prot_t *prot = dhd->prot;
+       msgbuf_ring_t *ring = &prot->h2dring_rxp_subn;
+       void *lcl_buf;
+       uint16 lcl_buf_size;
+       uint16 pktsz = prot->rxbufpost_sz;
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK)
+               return BCME_ERROR;
+#endif /* PCIE_INB_DW */
+       /* allocate a local buffer to store pkt buffer va, pa and length */
+       lcl_buf_size = (sizeof(void *) + sizeof(dmaaddr_t) + sizeof(uint32)) *
+               RX_BUF_BURST;
+       lcl_buf = MALLOC(dhd->osh, lcl_buf_size);
+       if (!lcl_buf) {
+               DHD_ERROR(("%s: local scratch buffer allocation failed\n", __FUNCTION__));
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+               return 0;
+       }
+       pktbuf = lcl_buf;
+       pktbuf_pa = (dmaaddr_t *)((uint8 *)pktbuf + sizeof(void *) * RX_BUF_BURST);
+       pktlen = (uint32 *)((uint8 *)pktbuf_pa + sizeof(dmaaddr_t) * RX_BUF_BURST);
+
+       for (i = 0; i < count; i++) {
+               if ((p = PKTGET(dhd->osh, pktsz, FALSE)) == NULL) {
+                       DHD_ERROR(("%s:%d: PKTGET for rxbuf failed\n", __FUNCTION__, __LINE__));
+                       dhd->rx_pktgetfail++;
+                       break;
+               }
+
+               pktlen[i] = PKTLEN(dhd->osh, p);
+               pa = DMA_MAP(dhd->osh, PKTDATA(dhd->osh, p), pktlen[i], DMA_RX, p, 0);
+
+               if (PHYSADDRISZERO(pa)) {
+                       PKTFREE(dhd->osh, p, FALSE);
+                       DHD_ERROR(("Invalid phyaddr 0\n"));
+                       ASSERT(0);
+                       break;
+               }
+#ifdef DMAMAP_STATS
+               dhd->dma_stats.rxdata++;
+               dhd->dma_stats.rxdata_sz += pktlen[i];
+#endif /* DMAMAP_STATS */
+
+               PKTPULL(dhd->osh, p, prot->rx_metadata_offset);
+               pktlen[i] = PKTLEN(dhd->osh, p);
+               pktbuf[i] = p;
+               pktbuf_pa[i] = pa;
+       }
+
+       /* only post what we have */
+       count = i;
+
+       /* grab the ring lock to allocate pktid and post on ring */
+       DHD_RING_LOCK(ring->ring_lock, flags);
+
+       /* Claim space for exactly 'count' no of messages, for mitigation purpose */
+       msg_start = (void *)
+               dhd_prot_alloc_ring_space(dhd, ring, count, &alloced, TRUE);
+       if (msg_start == NULL) {
+               DHD_INFO(("%s:%d: Rxbufpost Msgbuf Not available\n", __FUNCTION__, __LINE__));
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+               goto cleanup;
+       }
+       /* if msg_start !=  NULL, we should have alloced space for atleast 1 item */
+       ASSERT(alloced > 0);
+
+       rxbuf_post_tmp = (uint8*)msg_start;
+
+       for (i = 0; i < alloced; i++) {
+               rxbuf_post = (host_rxbuf_post_t *)rxbuf_post_tmp;
+               p = pktbuf[i];
+               pa = pktbuf_pa[i];
+
+#if defined(DHD_LB_RXC)
+               if (use_rsv_pktid == TRUE) {
+                       bcm_workq_t *workq = &prot->rx_compl_cons;
+                       int elem_ix = bcm_ring_cons(WORKQ_RING(workq), DHD_LB_WORKQ_SZ);
+
+                       if (elem_ix == BCM_RING_EMPTY) {
+                               DHD_INFO(("%s rx_compl_cons ring is empty\n", __FUNCTION__));
+                               pktid = DHD_PKTID_INVALID;
+                               goto alloc_pkt_id;
+                       } else {
+                               uint32 *elem = WORKQ_ELEMENT(uint32, workq, elem_ix);
+                               pktid = *elem;
+                       }
+
+                       rxbuf_post->cmn_hdr.request_id = htol32(pktid);
+
+                       /* Now populate the previous locker with valid information */
+                       if (pktid != DHD_PKTID_INVALID) {
+                               DHD_NATIVE_TO_PKTID_SAVE(dhd, dhd->prot->pktid_rx_map,
+                                       p, pktid, pa, pktlen[i], DMA_RX, NULL, NULL,
+                                       PKTTYPE_DATA_RX);
+                       }
+               } else
+#endif /* ! DHD_LB_RXC */
+               {
+#if defined(DHD_LB_RXC)
+alloc_pkt_id:
+#endif /* DHD_LB_RXC */
+               pktid = DHD_NATIVE_TO_PKTID(dhd, dhd->prot->pktid_rx_map, p, pa,
+                       pktlen[i], DMA_RX, NULL, ring->dma_buf.secdma, PKTTYPE_DATA_RX);
+#if defined(DHD_PCIE_PKTID)
+               if (pktid == DHD_PKTID_INVALID) {
+                       break;
+               }
+#endif /* DHD_PCIE_PKTID */
+               }
+
+               dhd->prot->tot_rxbufpost++;
+               /* Common msg header */
+               rxbuf_post->cmn_hdr.msg_type = MSG_TYPE_RXBUF_POST;
+               rxbuf_post->cmn_hdr.if_id = 0;
+               rxbuf_post->cmn_hdr.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+               rxbuf_post->cmn_hdr.flags = ring->current_phase;
+               ring->seqnum++;
+               rxbuf_post->data_buf_len = htol16((uint16)pktlen[i]);
+               rxbuf_post->data_buf_addr.high_addr = htol32(PHYSADDRHI(pa));
+               rxbuf_post->data_buf_addr.low_addr =
+                       htol32(PHYSADDRLO(pa) + prot->rx_metadata_offset);
+
+               if (prot->rx_metadata_offset) {
+                       rxbuf_post->metadata_buf_len = prot->rx_metadata_offset;
+                       rxbuf_post->metadata_buf_addr.high_addr = htol32(PHYSADDRHI(pa));
+                       rxbuf_post->metadata_buf_addr.low_addr  = htol32(PHYSADDRLO(pa));
+               } else {
+                       rxbuf_post->metadata_buf_len = 0;
+                       rxbuf_post->metadata_buf_addr.high_addr = 0;
+                       rxbuf_post->metadata_buf_addr.low_addr  = 0;
+               }
+
+#ifdef DHD_PKTID_AUDIT_RING
+               DHD_PKTID_AUDIT(dhd, prot->pktid_rx_map, pktid, DHD_DUPLICATE_ALLOC);
+#endif /* DHD_PKTID_AUDIT_RING */
+
+               rxbuf_post->cmn_hdr.request_id = htol32(pktid);
+
+               /* Move rxbuf_post_tmp to next item */
+               rxbuf_post_tmp = rxbuf_post_tmp + ring->item_len;
+#ifdef DHD_LBUF_AUDIT
+               PKTAUDIT(dhd->osh, p);
+#endif
+       }
+
+       if (i < alloced) {
+               if (ring->wr < (alloced - i))
+                       ring->wr = ring->max_items - (alloced - i);
+               else
+                       ring->wr -= (alloced - i);
+
+               if (ring->wr == 0) {
+                       DHD_INFO(("%s: flipping the phase now\n", ring->name));
+                               ring->current_phase = ring->current_phase ?
+                               0 : BCMPCIE_CMNHDR_PHASE_BIT_INIT;
+               }
+
+               alloced = i;
+       }
+
+       /* update ring's WR index and ring doorbell to dongle */
+       if (alloced > 0) {
+               dhd_prot_ring_write_complete(dhd, ring, msg_start, alloced);
+       }
+
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+cleanup:
+       for (i = alloced; i < count; i++) {
+               p = pktbuf[i];
+               pa = pktbuf_pa[i];
+
+               DMA_UNMAP(dhd->osh, pa, pktlen[i], DMA_RX, 0, DHD_DMAH_NULL);
+               PKTFREE(dhd->osh, p, FALSE);
+       }
+
+       MFREE(dhd->osh, lcl_buf, lcl_buf_size);
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+
+       return alloced;
+} /* dhd_prot_rxbufpost */
+
+static int
+dhd_prot_infobufpost(dhd_pub_t *dhd, msgbuf_ring_t *ring)
+{
+       unsigned long flags;
+       uint32 pktid;
+       dhd_prot_t *prot = dhd->prot;
+       uint16 alloced = 0;
+       uint16 pktsz = DHD_INFOBUF_RX_BUFPOST_PKTSZ;
+       uint32 pktlen;
+       info_buf_post_msg_t *infobuf_post;
+       uint8 *infobuf_post_tmp;
+       void *p;
+       void* msg_start;
+       uint8 i = 0;
+       dmaaddr_t pa;
+       int16 count = 0;
+
+       if (ring == NULL)
+               return 0;
+
+       if (ring->inited != TRUE)
+               return 0;
+       if (ring == dhd->prot->h2dring_info_subn) {
+               if (prot->max_infobufpost == 0)
+                       return 0;
+
+               count = prot->max_infobufpost - prot->infobufpost;
+       }
+       else {
+               DHD_ERROR(("Unknown ring\n"));
+               return 0;
+       }
+
+       if (count <= 0) {
+               DHD_INFO(("%s: Cannot post more than max info resp buffers\n",
+                       __FUNCTION__));
+               return 0;
+       }
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK)
+               return BCME_ERROR;
+#endif /* PCIE_INB_DW */
+
+       /* grab the ring lock to allocate pktid and post on ring */
+       DHD_RING_LOCK(ring->ring_lock, flags);
+
+       /* Claim space for exactly 'count' no of messages, for mitigation purpose */
+       msg_start = (void *) dhd_prot_alloc_ring_space(dhd, ring, count, &alloced, FALSE);
+
+       if (msg_start == NULL) {
+               DHD_INFO(("%s:%d: infobufpost Msgbuf Not available\n", __FUNCTION__, __LINE__));
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+               return -1;
+       }
+
+       /* if msg_start !=  NULL, we should have alloced space for atleast 1 item */
+       ASSERT(alloced > 0);
+
+       infobuf_post_tmp = (uint8*) msg_start;
+
+       /* loop through each allocated message in the host ring */
+       for (i = 0; i < alloced; i++) {
+               infobuf_post = (info_buf_post_msg_t *) infobuf_post_tmp;
+               /* Create a rx buffer */
+#ifdef DHD_USE_STATIC_CTRLBUF
+               p = PKTGET_STATIC(dhd->osh, pktsz, FALSE);
+#else
+               p = PKTGET(dhd->osh, pktsz, FALSE);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+               if (p == NULL) {
+                       DHD_ERROR(("%s:%d: PKTGET for infobuf failed\n", __FUNCTION__, __LINE__));
+                       dhd->rx_pktgetfail++;
+                       break;
+               }
+               pktlen = PKTLEN(dhd->osh, p);
+               pa = DMA_MAP(dhd->osh, PKTDATA(dhd->osh, p), pktlen, DMA_RX, p, 0);
+               if (PHYSADDRISZERO(pa)) {
+                       DMA_UNMAP(dhd->osh, pa, pktlen, DMA_RX, 0, DHD_DMAH_NULL);
+#ifdef DHD_USE_STATIC_CTRLBUF
+                       PKTFREE_STATIC(dhd->osh, p, FALSE);
+#else
+                       PKTFREE(dhd->osh, p, FALSE);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+                       DHD_ERROR(("Invalid phyaddr 0\n"));
+                       ASSERT(0);
+                       break;
+               }
+#ifdef DMAMAP_STATS
+               dhd->dma_stats.info_rx++;
+               dhd->dma_stats.info_rx_sz += pktlen;
+#endif /* DMAMAP_STATS */
+               pktlen = PKTLEN(dhd->osh, p);
+
+               /* Common msg header */
+               infobuf_post->cmn_hdr.msg_type = MSG_TYPE_INFO_BUF_POST;
+               infobuf_post->cmn_hdr.if_id = 0;
+               infobuf_post->cmn_hdr.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+               infobuf_post->cmn_hdr.flags = ring->current_phase;
+               ring->seqnum++;
+
+               pktid = DHD_NATIVE_TO_PKTID(dhd, dhd->prot->pktid_ctrl_map, p, pa,
+                       pktlen, DMA_RX, NULL, ring->dma_buf.secdma, PKTTYPE_INFO_RX);
+
+#if defined(DHD_PCIE_PKTID)
+               if (pktid == DHD_PKTID_INVALID) {
+                       DMA_UNMAP(dhd->osh, pa, pktlen, DMA_RX, 0, 0);
+
+#ifdef DHD_USE_STATIC_CTRLBUF
+                       PKTFREE_STATIC(dhd->osh, p, FALSE);
+#else
+                       PKTFREE(dhd->osh, p, FALSE);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+                       DHD_ERROR_RLMT(("%s: Pktid pool depleted.\n", __FUNCTION__));
+                       break;
+               }
+#endif /* DHD_PCIE_PKTID */
+
+               infobuf_post->host_buf_len = htol16((uint16)pktlen);
+               infobuf_post->host_buf_addr.high_addr = htol32(PHYSADDRHI(pa));
+               infobuf_post->host_buf_addr.low_addr = htol32(PHYSADDRLO(pa));
+
+#ifdef DHD_PKTID_AUDIT_RING
+               DHD_PKTID_AUDIT(dhd, prot->pktid_ctrl_map, pktid, DHD_DUPLICATE_ALLOC);
+#endif /* DHD_PKTID_AUDIT_RING */
+
+               DHD_INFO(("ID %d, low_addr 0x%08x, high_addr 0x%08x\n",
+                       infobuf_post->cmn_hdr.request_id,  infobuf_post->host_buf_addr.low_addr,
+                       infobuf_post->host_buf_addr.high_addr));
+
+               infobuf_post->cmn_hdr.request_id = htol32(pktid);
+               /* Move rxbuf_post_tmp to next item */
+               infobuf_post_tmp = infobuf_post_tmp + ring->item_len;
+#ifdef DHD_LBUF_AUDIT
+               PKTAUDIT(dhd->osh, p);
+#endif
+       }
+
+       if (i < alloced) {
+               if (ring->wr < (alloced - i))
+                       ring->wr = ring->max_items - (alloced - i);
+               else
+                       ring->wr -= (alloced - i);
+
+               alloced = i;
+               if (alloced && ring->wr == 0) {
+                       DHD_INFO(("%s: flipping the phase now\n", ring->name));
+                       ring->current_phase = ring->current_phase ?
+                               0 : BCMPCIE_CMNHDR_PHASE_BIT_INIT;
+               }
+       }
+
+       /* Update the write pointer in TCM & ring bell */
+       if (alloced > 0) {
+               if (ring == dhd->prot->h2dring_info_subn) {
+                       prot->infobufpost += alloced;
+               }
+               dhd_prot_ring_write_complete(dhd, ring, msg_start, alloced);
+       }
+
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+       return alloced;
+} /* dhd_prot_infobufpost */
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+static int
+alloc_ioctl_return_buffer(dhd_pub_t *dhd, dhd_dma_buf_t *retbuf)
+{
+       int err;
+       memset(retbuf, 0, sizeof(dhd_dma_buf_t));
+
+       if ((err = dhd_dma_buf_alloc(dhd, retbuf, IOCT_RETBUF_SIZE)) != BCME_OK) {
+               DHD_ERROR(("%s: dhd_dma_buf_alloc err %d\n", __FUNCTION__, err));
+               ASSERT(0);
+               return BCME_NOMEM;
+       }
+
+       return BCME_OK;
+}
+
+static void
+free_ioctl_return_buffer(dhd_pub_t *dhd, dhd_dma_buf_t *retbuf)
+{
+       /* retbuf (declared on stack) not fully populated ...  */
+       if (retbuf->va) {
+               uint32 dma_pad;
+               dma_pad = (IOCT_RETBUF_SIZE % DHD_DMA_PAD) ? DHD_DMA_PAD : 0;
+               retbuf->len = IOCT_RETBUF_SIZE;
+               retbuf->_alloced = retbuf->len + dma_pad;
+       }
+
+       dhd_dma_buf_free(dhd, retbuf);
+       return;
+}
+#endif /* IOCTLRESP_USE_CONSTMEM */
+
+static int
+dhd_prot_rxbufpost_ctrl(dhd_pub_t *dhd, uint8 msg_type)
+{
+       void *p;
+       uint16 pktsz;
+       ioctl_resp_evt_buf_post_msg_t *rxbuf_post;
+       dmaaddr_t pa;
+       uint32 pktlen;
+       dhd_prot_t *prot = dhd->prot;
+       uint16 alloced = 0;
+       unsigned long flags;
+       dhd_dma_buf_t retbuf;
+       void *dmah = NULL;
+       uint32 pktid;
+       void *map_handle;
+       msgbuf_ring_t *ring = &prot->h2dring_ctrl_subn;
+       bool non_ioctl_resp_buf = 0;
+       dhd_pkttype_t buf_type;
+
+       if (dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s: bus is already down.\n", __FUNCTION__));
+               return -1;
+       }
+       memset(&retbuf, 0, sizeof(dhd_dma_buf_t));
+
+       if (msg_type == MSG_TYPE_IOCTLRESP_BUF_POST)
+               buf_type = PKTTYPE_IOCTL_RX;
+       else if (msg_type == MSG_TYPE_EVENT_BUF_POST)
+               buf_type = PKTTYPE_EVENT_RX;
+       else if (msg_type == MSG_TYPE_TIMSTAMP_BUFPOST)
+               buf_type = PKTTYPE_TSBUF_RX;
+       else {
+               DHD_ERROR(("invalid message type to be posted to Ctrl ring %d\n", msg_type));
+               /* XXX: may be add an assert */
+               return -1;
+       }
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK) {
+                return BCME_ERROR;
+       }
+#endif /* PCIE_INB_DW */
+
+       if ((msg_type == MSG_TYPE_EVENT_BUF_POST) || (msg_type == MSG_TYPE_TIMSTAMP_BUFPOST))
+               non_ioctl_resp_buf = TRUE;
+       else
+               non_ioctl_resp_buf = FALSE;
+
+       if (non_ioctl_resp_buf) {
+               /* Allocate packet for not ioctl resp buffer post */
+               pktsz = DHD_FLOWRING_RX_BUFPOST_PKTSZ;
+       } else {
+               /* Allocate packet for ctrl/ioctl buffer post */
+               pktsz = DHD_FLOWRING_IOCTL_BUFPOST_PKTSZ;
+       }
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+       if (!non_ioctl_resp_buf) {
+               if (alloc_ioctl_return_buffer(dhd, &retbuf) != BCME_OK) {
+                       DHD_ERROR(("Could not allocate IOCTL response buffer\n"));
+                       goto fail;
+               }
+               ASSERT(retbuf.len == IOCT_RETBUF_SIZE);
+               p = retbuf.va;
+               pktlen = retbuf.len;
+               pa = retbuf.pa;
+               dmah = retbuf.dmah;
+       } else
+#endif /* IOCTLRESP_USE_CONSTMEM */
+       {
+#ifdef DHD_USE_STATIC_CTRLBUF
+               p = PKTGET_STATIC(dhd->osh, pktsz, FALSE);
+#else
+               p = PKTGET(dhd->osh, pktsz, FALSE);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+               if (p == NULL) {
+                       DHD_ERROR(("%s:%d: PKTGET for %s buf failed\n",
+                               __FUNCTION__, __LINE__, non_ioctl_resp_buf ?
+                               "EVENT" : "IOCTL RESP"));
+                       dhd->rx_pktgetfail++;
+                       goto fail;
+               }
+
+               pktlen = PKTLEN(dhd->osh, p);
+               pa = DMA_MAP(dhd->osh, PKTDATA(dhd->osh, p), pktlen, DMA_RX, p, 0);
+
+               if (PHYSADDRISZERO(pa)) {
+                       DHD_ERROR(("Invalid physaddr 0\n"));
+                       ASSERT(0);
+                       goto free_pkt_return;
+               }
+
+#ifdef DMAMAP_STATS
+               switch (buf_type) {
+#ifndef IOCTLRESP_USE_CONSTMEM
+                       case PKTTYPE_IOCTL_RX:
+                               dhd->dma_stats.ioctl_rx++;
+                               dhd->dma_stats.ioctl_rx_sz += pktlen;
+                               break;
+#endif /* !IOCTLRESP_USE_CONSTMEM */
+                       case PKTTYPE_EVENT_RX:
+                               dhd->dma_stats.event_rx++;
+                               dhd->dma_stats.event_rx_sz += pktlen;
+                               break;
+                       case PKTTYPE_TSBUF_RX:
+                               dhd->dma_stats.tsbuf_rx++;
+                               dhd->dma_stats.tsbuf_rx_sz += pktlen;
+                               break;
+                       default:
+                               break;
+               }
+#endif /* DMAMAP_STATS */
+
+       }
+
+       /* grab the ring lock to allocate pktid and post on ring */
+       DHD_RING_LOCK(ring->ring_lock, flags);
+
+       rxbuf_post = (ioctl_resp_evt_buf_post_msg_t *)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+
+       if (rxbuf_post == NULL) {
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+               DHD_ERROR(("%s:%d: Ctrl submit Msgbuf Not available to post buffer \n",
+                       __FUNCTION__, __LINE__));
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+               if (non_ioctl_resp_buf)
+#endif /* IOCTLRESP_USE_CONSTMEM */
+               {
+                       DMA_UNMAP(dhd->osh, pa, pktlen, DMA_RX, 0, DHD_DMAH_NULL);
+               }
+               goto free_pkt_return;
+       }
+
+       /* CMN msg header */
+       rxbuf_post->cmn_hdr.msg_type = msg_type;
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+       if (!non_ioctl_resp_buf) {
+               map_handle = dhd->prot->pktid_map_handle_ioctl;
+               pktid = DHD_NATIVE_TO_PKTID(dhd, map_handle, p, pa, pktlen, DMA_RX, dmah,
+                       ring->dma_buf.secdma, buf_type);
+       } else
+#endif /* IOCTLRESP_USE_CONSTMEM */
+       {
+               map_handle = dhd->prot->pktid_ctrl_map;
+               pktid = DHD_NATIVE_TO_PKTID(dhd, map_handle,
+                       p, pa, pktlen, DMA_RX, dmah, ring->dma_buf.secdma,
+                       buf_type);
+       }
+
+       if (pktid == DHD_PKTID_INVALID) {
+               if (ring->wr == 0) {
+                       ring->wr = ring->max_items - 1;
+               } else {
+                       ring->wr--;
+                       if (ring->wr == 0) {
+                               ring->current_phase = ring->current_phase ? 0 :
+                                       BCMPCIE_CMNHDR_PHASE_BIT_INIT;
+                       }
+               }
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+               DMA_UNMAP(dhd->osh, pa, pktlen, DMA_RX, 0, DHD_DMAH_NULL);
+               DHD_ERROR_RLMT(("%s: Pktid pool depleted.\n", __FUNCTION__));
+               goto free_pkt_return;
+       }
+
+#ifdef DHD_PKTID_AUDIT_RING
+       DHD_PKTID_AUDIT(dhd, map_handle, pktid, DHD_DUPLICATE_ALLOC);
+#endif /* DHD_PKTID_AUDIT_RING */
+
+       rxbuf_post->cmn_hdr.request_id = htol32(pktid);
+       rxbuf_post->cmn_hdr.if_id = 0;
+       rxbuf_post->cmn_hdr.epoch =  ring->seqnum % H2D_EPOCH_MODULO;
+       ring->seqnum++;
+       rxbuf_post->cmn_hdr.flags = ring->current_phase;
+
+#if defined(DHD_PCIE_PKTID)
+       if (rxbuf_post->cmn_hdr.request_id == DHD_PKTID_INVALID) {
+               if (ring->wr == 0) {
+                       ring->wr = ring->max_items - 1;
+               } else {
+                       if (ring->wr == 0) {
+                               ring->current_phase = ring->current_phase ? 0 :
+                                       BCMPCIE_CMNHDR_PHASE_BIT_INIT;
+                       }
+               }
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+#ifdef IOCTLRESP_USE_CONSTMEM
+               if (non_ioctl_resp_buf)
+#endif /* IOCTLRESP_USE_CONSTMEM */
+               {
+                       DMA_UNMAP(dhd->osh, pa, pktlen, DMA_RX, 0, DHD_DMAH_NULL);
+               }
+               goto free_pkt_return;
+       }
+#endif /* DHD_PCIE_PKTID */
+
+#ifndef IOCTLRESP_USE_CONSTMEM
+       rxbuf_post->host_buf_len = htol16((uint16)PKTLEN(dhd->osh, p));
+#else
+       rxbuf_post->host_buf_len = htol16((uint16)pktlen);
+#endif /* IOCTLRESP_USE_CONSTMEM */
+       rxbuf_post->host_buf_addr.high_addr = htol32(PHYSADDRHI(pa));
+       rxbuf_post->host_buf_addr.low_addr  = htol32(PHYSADDRLO(pa));
+#ifdef DHD_LBUF_AUDIT
+       if (non_ioctl_resp_buf)
+               PKTAUDIT(dhd->osh, p);
+#endif
+       /* update ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ring, rxbuf_post, 1);
+
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+       return 1;
+
+free_pkt_return:
+       if (!non_ioctl_resp_buf) {
+#ifdef IOCTLRESP_USE_CONSTMEM
+               free_ioctl_return_buffer(dhd, &retbuf);
+#else
+               dhd_prot_packet_free(dhd, p, buf_type, FALSE);
+#endif /* IOCTLRESP_USE_CONSTMEM */
+       } else {
+               dhd_prot_packet_free(dhd, p, buf_type, FALSE);
+       }
+
+fail:
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+       return -1;
+} /* dhd_prot_rxbufpost_ctrl */
+
+static uint16
+dhd_msgbuf_rxbuf_post_ctrlpath(dhd_pub_t *dhd, uint8 msg_type, uint32 max_to_post)
+{
+       uint32 i = 0;
+       int32 ret_val;
+
+       DHD_INFO(("max to post %d, event %d \n", max_to_post, msg_type));
+
+       if (dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s: bus is already down.\n", __FUNCTION__));
+               return 0;
+       }
+
+       while (i < max_to_post) {
+               ret_val  = dhd_prot_rxbufpost_ctrl(dhd, msg_type);
+               if (ret_val < 0)
+                       break;
+               i++;
+       }
+       DHD_INFO(("posted %d buffers of type %d\n", i, msg_type));
+       return (uint16)i;
+}
+
+static void
+dhd_msgbuf_rxbuf_post_ioctlresp_bufs(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int max_to_post;
+
+       DHD_INFO(("ioctl resp buf post\n"));
+       max_to_post = prot->max_ioctlrespbufpost - prot->cur_ioctlresp_bufs_posted;
+       if (max_to_post <= 0) {
+               DHD_INFO(("%s: Cannot post more than max IOCTL resp buffers\n",
+                       __FUNCTION__));
+               return;
+       }
+       prot->cur_ioctlresp_bufs_posted += dhd_msgbuf_rxbuf_post_ctrlpath(dhd,
+               MSG_TYPE_IOCTLRESP_BUF_POST, max_to_post);
+}
+
+static void
+dhd_msgbuf_rxbuf_post_event_bufs(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int max_to_post;
+
+       max_to_post = prot->max_eventbufpost - prot->cur_event_bufs_posted;
+       if (max_to_post <= 0) {
+               DHD_ERROR(("%s: Cannot post more than max event buffers\n",
+                       __FUNCTION__));
+               return;
+       }
+       prot->cur_event_bufs_posted += dhd_msgbuf_rxbuf_post_ctrlpath(dhd,
+               MSG_TYPE_EVENT_BUF_POST, max_to_post);
+}
+
+static int
+dhd_msgbuf_rxbuf_post_ts_bufs(dhd_pub_t *dhd)
+{
+       return 0;
+}
+
+bool
+BCMFASTPATH(dhd_prot_process_msgbuf_infocpl)(dhd_pub_t *dhd, uint bound)
+{
+       dhd_prot_t *prot = dhd->prot;
+       bool more = TRUE;
+       uint n = 0;
+       msgbuf_ring_t *ring = prot->d2hring_info_cpln;
+       unsigned long flags;
+
+       if (ring == NULL)
+               return FALSE;
+       if (ring->inited != TRUE)
+               return FALSE;
+
+       /* Process all the messages - DTOH direction */
+       while (!dhd_is_device_removed(dhd)) {
+               uint8 *msg_addr;
+               uint32 msg_len;
+
+               if (dhd->hang_was_sent) {
+                       more = FALSE;
+                       break;
+               }
+
+               if (dhd->smmu_fault_occurred) {
+                       more = FALSE;
+                       break;
+               }
+
+               DHD_RING_LOCK(ring->ring_lock, flags);
+               /* Get the message from ring */
+               msg_addr = dhd_prot_get_read_addr(dhd, ring, &msg_len);
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+               if (msg_addr == NULL) {
+                       more = FALSE;
+                       break;
+               }
+
+               /* Prefetch data to populate the cache */
+               OSL_PREFETCH(msg_addr);
+
+               if (dhd_prot_process_msgtype(dhd, ring, msg_addr, msg_len) != BCME_OK) {
+                       DHD_ERROR(("%s: Error at  process rxpl msgbuf of len %d\n",
+                               __FUNCTION__, msg_len));
+               }
+
+               /* Update read pointer */
+               dhd_prot_upd_read_idx(dhd, ring);
+
+               /* After batch processing, check RX bound */
+               n += msg_len / ring->item_len;
+               if (n >= bound) {
+                       break;
+               }
+       }
+
+       return more;
+}
+
+#ifdef EWP_EDL
+bool
+dhd_prot_process_msgbuf_edl(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       msgbuf_ring_t *ring = prot->d2hring_edl;
+       unsigned long flags = 0;
+       uint32 items = 0;
+       uint16 rd = 0;
+       uint16 depth = 0;
+
+       if (ring == NULL)
+               return FALSE;
+       if (ring->inited != TRUE)
+               return FALSE;
+       if (ring->item_len == 0) {
+               DHD_ERROR(("%s: Bad ring ! ringidx %d, item_len %d \n",
+                       __FUNCTION__, ring->idx, ring->item_len));
+               return FALSE;
+       }
+
+       if (dhd_query_bus_erros(dhd)) {
+               return FALSE;
+       }
+
+       if (dhd->hang_was_sent) {
+               return FALSE;
+       }
+
+       /* in this DPC context just check if wr index has moved
+        * and schedule deferred context to actually process the
+        * work items.
+       */
+
+       /* update the write index */
+       DHD_RING_LOCK(ring->ring_lock, flags);
+       if (dhd->dma_d2h_ring_upd_support) {
+               /* DMAing write/read indices supported */
+               ring->wr = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_WR_UPD, ring->idx);
+       } else {
+               dhd_bus_cmn_readshared(dhd->bus, &ring->wr, RING_WR_UPD, ring->idx);
+       }
+       rd = ring->rd;
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+       depth = ring->max_items;
+       /* check for avail space, in number of ring items */
+       items = READ_AVAIL_SPACE(ring->wr, rd, depth);
+       if (items == 0) {
+               /* no work items in edl ring */
+               return FALSE;
+       }
+       if (items > ring->max_items) {
+               DHD_ERROR(("\r\n======================= \r\n"));
+               DHD_ERROR(("%s(): ring %p, ring->name %s, ring->max_items %d, items %d \r\n",
+                       __FUNCTION__, ring, ring->name, ring->max_items, items));
+               DHD_ERROR(("wr: %d,  rd: %d,  depth: %d  \r\n",
+                       ring->wr, ring->rd, depth));
+               DHD_ERROR(("dhd->busstate %d bus->wait_for_d3_ack %d \r\n",
+                       dhd->busstate, dhd->bus->wait_for_d3_ack));
+               DHD_ERROR(("\r\n======================= \r\n"));
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+               if (ring->wr >= ring->max_items) {
+                       dhd->bus->read_shm_fail = TRUE;
+               }
+#else
+#ifdef DHD_FW_COREDUMP
+               if (dhd->memdump_enabled) {
+                       /* collect core dump */
+                       dhd->memdump_type = DUMP_TYPE_RESUMED_ON_INVALID_RING_RDWR;
+                       dhd_bus_mem_dump(dhd);
+
+               }
+#endif /* DHD_FW_COREDUMP */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+               dhd_schedule_reset(dhd);
+
+               return FALSE;
+       }
+
+       if (items > D2HRING_EDL_WATERMARK) {
+               DHD_ERROR_RLMT(("%s: WARNING! EDL watermark hit, num items=%u;"
+                       " rd=%u; wr=%u; depth=%u;\n", __FUNCTION__, items,
+                       ring->rd, ring->wr, depth));
+       }
+
+       dhd_schedule_logtrace(dhd->info);
+
+       return FALSE;
+}
+
+/*
+ * This is called either from work queue context of 'event_log_dispatcher_work' or
+ * from the kthread context of dhd_logtrace_thread
+ */
+int
+dhd_prot_process_edl_complete(dhd_pub_t *dhd, void *evt_decode_data)
+{
+       dhd_prot_t *prot = NULL;
+       msgbuf_ring_t *ring = NULL;
+       int err = 0;
+       unsigned long flags = 0;
+       cmn_msg_hdr_t *msg = NULL;
+       uint8 *msg_addr = NULL;
+       uint32 max_items_to_process = 0, n = 0;
+       uint32 num_items = 0, new_items = 0;
+       uint16 depth = 0;
+       volatile uint16 wr = 0;
+
+       if (!dhd || !dhd->prot)
+               return 0;
+
+       prot = dhd->prot;
+       ring = prot->d2hring_edl;
+
+       if (!ring || !evt_decode_data) {
+               return 0;
+       }
+
+       if (dhd->hang_was_sent) {
+               return FALSE;
+       }
+
+       DHD_RING_LOCK(ring->ring_lock, flags);
+       ring->curr_rd = ring->rd;
+       wr = ring->wr;
+       depth = ring->max_items;
+       /* check for avail space, in number of ring items
+        * Note, that this will only give the # of items
+        * from rd to wr if wr>=rd, or from rd to ring end
+        * if wr < rd. So in the latter case strictly speaking
+        * not all the items are read. But this is OK, because
+        * these will be processed in the next doorbell as rd
+        * would have wrapped around. Processing in the next
+        * doorbell is acceptable since EDL only contains debug data
+        */
+       num_items = READ_AVAIL_SPACE(wr, ring->rd, depth);
+
+       if (num_items == 0) {
+               /* no work items in edl ring */
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+               return 0;
+       }
+
+       DHD_INFO(("%s: EDL work items [%u] available \n",
+                       __FUNCTION__, num_items));
+
+       /* if space is available, calculate address to be read */
+       msg_addr = (char*)ring->dma_buf.va + (ring->rd * ring->item_len);
+
+       max_items_to_process = MIN(num_items, DHD_EVENT_LOGTRACE_BOUND);
+
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+       /* Prefetch data to populate the cache */
+       OSL_PREFETCH(msg_addr);
+
+       n = max_items_to_process;
+       while (n > 0) {
+               msg = (cmn_msg_hdr_t *)msg_addr;
+               /* wait for DMA of work item to complete */
+               if ((err = dhd->prot->d2h_edl_sync_cb(dhd, ring, msg)) != BCME_OK) {
+                       DHD_ERROR(("%s: Error waiting for DMA to cmpl in EDL ring; err = %d\n",
+                               __FUNCTION__, err));
+               }
+               /*
+                * Update the curr_rd to the current index in the ring, from where
+                * the work item is fetched. This way if the fetched work item
+                * fails in LIVELOCK, we can print the exact read index in the ring
+                * that shows up the corrupted work item.
+                */
+               if ((ring->curr_rd + 1) >= ring->max_items) {
+                       ring->curr_rd = 0;
+               } else {
+                       ring->curr_rd += 1;
+               }
+
+               if (err != BCME_OK) {
+                       return 0;
+               }
+
+               /* process the edl work item, i.e, the event log */
+               err = dhd_event_logtrace_process_edl(dhd, msg_addr, evt_decode_data);
+
+               /* Dummy sleep so that scheduler kicks in after processing any logprints */
+               OSL_SLEEP(0);
+
+               /* Prefetch data to populate the cache */
+               OSL_PREFETCH(msg_addr + ring->item_len);
+
+               msg_addr += ring->item_len;
+               --n;
+       }
+
+       DHD_RING_LOCK(ring->ring_lock, flags);
+       /* update host ring read pointer */
+       if ((ring->rd + max_items_to_process) >= ring->max_items)
+               ring->rd = 0;
+       else
+               ring->rd += max_items_to_process;
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+       /* Now after processing max_items_to_process update dongle rd index.
+        * The TCM rd index is updated only if bus is not
+        * in D3. Else, the rd index is updated from resume
+        * context in - 'dhdpcie_bus_suspend'
+        */
+       DHD_GENERAL_LOCK(dhd, flags);
+       if (DHD_BUS_CHECK_SUSPEND_OR_ANY_SUSPEND_IN_PROGRESS(dhd)) {
+               DHD_INFO(("%s: bus is in suspend(%d) or suspending(0x%x) state!!\n",
+                       __FUNCTION__, dhd->busstate, dhd->dhd_bus_busy_state));
+               DHD_GENERAL_UNLOCK(dhd, flags);
+       } else {
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               DHD_EDL_RING_TCM_RD_UPDATE(dhd);
+       }
+
+       /* if num_items > bound, then anyway we will reschedule and
+        * this function runs again, so that if in between the DPC has
+        * updated the wr index, then the updated wr is read. But if
+        * num_items <= bound, and if DPC executes and updates the wr index
+        * when the above while loop is running, then the updated 'wr' index
+        * needs to be re-read from here, If we don't do so, then till
+        * the next time this function is scheduled
+        * the event logs will not be processed.
+       */
+       if (num_items <= DHD_EVENT_LOGTRACE_BOUND) {
+               /* read the updated wr index if reqd. and update num_items */
+               DHD_RING_LOCK(ring->ring_lock, flags);
+               if (wr != (volatile uint16)ring->wr) {
+                       wr = (volatile uint16)ring->wr;
+                       new_items = READ_AVAIL_SPACE(wr, ring->rd, depth);
+                       DHD_INFO(("%s: new items [%u] avail in edl\n",
+                               __FUNCTION__, new_items));
+                       num_items += new_items;
+               }
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+       }
+
+       /* if # of items processed is less than num_items, need to re-schedule
+       * the deferred ctx
+       */
+       if (max_items_to_process < num_items) {
+               DHD_INFO(("%s: EDL bound hit / new items found, "
+                               "items processed=%u; remaining=%u, "
+                               "resched deferred ctx...\n",
+                               __FUNCTION__, max_items_to_process,
+                               num_items - max_items_to_process));
+               return (num_items - max_items_to_process);
+       }
+
+       return 0;
+
+}
+
+void
+dhd_prot_edl_ring_tcm_rd_update(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = NULL;
+       unsigned long flags = 0;
+       msgbuf_ring_t *ring = NULL;
+
+       if (!dhd)
+               return;
+
+       prot = dhd->prot;
+       if (!prot || !prot->d2hring_edl)
+               return;
+
+       ring = prot->d2hring_edl;
+       DHD_RING_LOCK(ring->ring_lock, flags);
+       dhd_prot_upd_read_idx(dhd, ring);
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+}
+#endif /* EWP_EDL */
+
+static void
+dhd_prot_rx_frame(dhd_pub_t *dhd, void *pkt, int ifidx, uint pkt_count)
+{
+
+#ifdef DHD_LB_RXP
+       if (dhd_read_lb_rxp(dhd) == 1) {
+               dhd_lb_rx_pkt_enqueue(dhd, pkt, ifidx);
+               return;
+       }
+#endif /* DHD_LB_RXP */
+       dhd_bus_rx_frame(dhd->bus, pkt, ifidx, pkt_count);
+}
+
+/** called when DHD needs to check for 'receive complete' messages from the dongle */
+bool
+BCMFASTPATH(dhd_prot_process_msgbuf_rxcpl)(dhd_pub_t *dhd, uint bound, int ringtype)
+{
+       bool more = FALSE;
+       uint n = 0;
+       dhd_prot_t *prot = dhd->prot;
+       msgbuf_ring_t *ring;
+       uint16 item_len;
+       host_rxbuf_cmpl_t *msg = NULL;
+       uint8 *msg_addr;
+       uint32 msg_len;
+       uint16 pkt_cnt, pkt_cnt_newidx;
+       unsigned long flags;
+       dmaaddr_t pa;
+       uint32 len;
+       void *dmah;
+       void *secdma;
+       int ifidx = 0, if_newidx = 0;
+       void *pkt, *pktqhead = NULL, *prevpkt = NULL, *pkt_newidx, *nextpkt;
+       uint32 pktid;
+       int i;
+       uint8 sync;
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       /* Set rx_pending_due_to_rpm if device is not in resume state */
+       if (dhdpcie_runtime_bus_wake(dhd, FALSE, dhd_prot_process_msgbuf_rxcpl)) {
+               dhd->rx_pending_due_to_rpm = TRUE;
+               return more;
+       }
+       dhd->rx_pending_due_to_rpm = FALSE;
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+               ring = &prot->d2hring_rx_cpln;
+       item_len = ring->item_len;
+       while (1) {
+               if (dhd_is_device_removed(dhd))
+                       break;
+
+               if (dhd_query_bus_erros(dhd))
+                       break;
+
+               if (dhd->hang_was_sent)
+                       break;
+
+               if (dhd->smmu_fault_occurred) {
+                       break;
+               }
+
+               pkt_cnt = 0;
+               pktqhead = pkt_newidx = NULL;
+               pkt_cnt_newidx = 0;
+
+               DHD_RING_LOCK(ring->ring_lock, flags);
+
+               /* Get the address of the next message to be read from ring */
+               msg_addr = dhd_prot_get_read_addr(dhd, ring, &msg_len);
+               if (msg_addr == NULL) {
+                       DHD_RING_UNLOCK(ring->ring_lock, flags);
+                       break;
+               }
+
+               while (msg_len > 0) {
+                       msg = (host_rxbuf_cmpl_t *)msg_addr;
+
+                       /* Wait until DMA completes, then fetch msg_type */
+                       sync = prot->d2h_sync_cb(dhd, ring, &msg->cmn_hdr, item_len);
+                       /*
+                        * Update the curr_rd to the current index in the ring, from where
+                        * the work item is fetched. This way if the fetched work item
+                        * fails in LIVELOCK, we can print the exact read index in the ring
+                        * that shows up the corrupted work item.
+                        */
+                       if ((ring->curr_rd + 1) >= ring->max_items) {
+                               ring->curr_rd = 0;
+                       } else {
+                               ring->curr_rd += 1;
+                       }
+
+                       if (!sync) {
+                               msg_len -= item_len;
+                               msg_addr += item_len;
+                               continue;
+                       }
+
+                       pktid = ltoh32(msg->cmn_hdr.request_id);
+
+#ifdef DHD_PKTID_AUDIT_RING
+                       DHD_PKTID_AUDIT_RING_DEBUG(dhd, dhd->prot->pktid_rx_map, pktid,
+                               DHD_DUPLICATE_FREE, msg, D2HRING_RXCMPLT_ITEMSIZE);
+#endif /* DHD_PKTID_AUDIT_RING */
+
+                       pkt = DHD_PKTID_TO_NATIVE(dhd, prot->pktid_rx_map, pktid, pa,
+                               len, dmah, secdma, PKTTYPE_DATA_RX);
+                       if (!pkt) {
+                               msg_len -= item_len;
+                               msg_addr += item_len;
+                               continue;
+                       }
+                       dhd->prot->tot_rxcpl++;
+
+                       DMA_UNMAP(dhd->osh, pa, (uint) len, DMA_RX, 0, dmah);
+
+#ifdef DMAMAP_STATS
+                       dhd->dma_stats.rxdata--;
+                       dhd->dma_stats.rxdata_sz -= len;
+#endif /* DMAMAP_STATS */
+                       DHD_INFO(("id 0x%04x, offset %d, len %d, idx %d, phase 0x%02x, "
+                               "pktdata %p, metalen %d\n",
+                               ltoh32(msg->cmn_hdr.request_id),
+                               ltoh16(msg->data_offset),
+                               ltoh16(msg->data_len), msg->cmn_hdr.if_id,
+                               msg->cmn_hdr.flags, PKTDATA(dhd->osh, pkt),
+                               ltoh16(msg->metadata_len)));
+
+                       pkt_cnt++;
+                       msg_len -= item_len;
+                       msg_addr += item_len;
+
+#if DHD_DBG_SHOW_METADATA
+                       if (prot->metadata_dbg && prot->rx_metadata_offset &&
+                               msg->metadata_len) {
+                               uchar *ptr;
+                               ptr = PKTDATA(dhd->osh, pkt) - (prot->rx_metadata_offset);
+                               /* header followed by data */
+                               bcm_print_bytes("rxmetadata", ptr, msg->metadata_len);
+                               dhd_prot_print_metadata(dhd, ptr, msg->metadata_len);
+                       }
+#endif /* DHD_DBG_SHOW_METADATA */
+
+                       /* data_offset from buf start */
+                       if (ltoh16(msg->data_offset)) {
+                               /* data offset given from dongle after split rx */
+                               PKTPULL(dhd->osh, pkt, ltoh16(msg->data_offset));
+                       }
+                       else if (prot->rx_dataoffset) {
+                               /* DMA RX offset updated through shared area */
+                               PKTPULL(dhd->osh, pkt, prot->rx_dataoffset);
+                       }
+                       /* Actual length of the packet */
+                       PKTSETLEN(dhd->osh, pkt, ltoh16(msg->data_len));
+
+#if defined(WL_MONITOR)
+                       if (dhd_monitor_enabled(dhd, ifidx)) {
+                               if (msg->flags & BCMPCIE_PKT_FLAGS_FRAME_802_11) {
+                                       dhd_rx_mon_pkt(dhd, msg, pkt, ifidx);
+                                       continue;
+                               } else {
+                                       DHD_ERROR(("Received non 802.11 packet, "
+                                               "when monitor mode is enabled\n"));
+                               }
+                       }
+#endif /* WL_MONITOR */
+
+                       if (!pktqhead) {
+                               pktqhead = prevpkt = pkt;
+                               ifidx = msg->cmn_hdr.if_id;
+                       } else {
+                               if (ifidx != msg->cmn_hdr.if_id) {
+                                       pkt_newidx = pkt;
+                                       if_newidx = msg->cmn_hdr.if_id;
+                                       pkt_cnt--;
+                                       pkt_cnt_newidx = 1;
+                                       break;
+                               } else {
+                                       PKTSETNEXT(dhd->osh, prevpkt, pkt);
+                                       prevpkt = pkt;
+                               }
+                       }
+
+#ifdef DHD_LBUF_AUDIT
+                       PKTAUDIT(dhd->osh, pkt);
+#endif
+               }
+
+               /* roll back read pointer for unprocessed message */
+               if (msg_len > 0) {
+                       if (ring->rd < msg_len / item_len)
+                               ring->rd = ring->max_items - msg_len / item_len;
+                       else
+                               ring->rd -= msg_len / item_len;
+               }
+
+               /* Update read pointer */
+               dhd_prot_upd_read_idx(dhd, ring);
+
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+               pkt = pktqhead;
+               for (i = 0; pkt && i < pkt_cnt; i++, pkt = nextpkt) {
+                       nextpkt = PKTNEXT(dhd->osh, pkt);
+                       PKTSETNEXT(dhd->osh, pkt, NULL);
+#ifdef DHD_RX_CHAINING
+                       dhd_rxchain_frame(dhd, pkt, ifidx);
+#else
+                       dhd_prot_rx_frame(dhd, pkt, ifidx, 1);
+#endif /* DHD_LB_RXP */
+               }
+
+               if (pkt_newidx) {
+#ifdef DHD_RX_CHAINING
+                       dhd_rxchain_frame(dhd, pkt_newidx, if_newidx);
+#else
+                       dhd_prot_rx_frame(dhd, pkt_newidx, if_newidx, 1);
+#endif /* DHD_LB_RXP */
+               }
+
+               pkt_cnt += pkt_cnt_newidx;
+
+               /* Post another set of rxbufs to the device */
+               dhd_prot_return_rxbuf(dhd, 0, pkt_cnt);
+
+#ifdef DHD_RX_CHAINING
+               dhd_rxchain_commit(dhd);
+#endif
+
+               /* After batch processing, check RX bound */
+               n += pkt_cnt;
+               if (n >= bound) {
+                       more = TRUE;
+                       break;
+               }
+       }
+
+       /* Call lb_dispatch only if packets are queued */
+       if (n &&
+#ifdef WL_MONITOR
+       !(dhd_monitor_enabled(dhd, ifidx)) &&
+#endif /* WL_MONITOR */
+       TRUE) {
+               DHD_LB_DISPATCH_RX_COMPL(dhd);
+               DHD_LB_DISPATCH_RX_PROCESS(dhd);
+       }
+
+       return more;
+
+}
+
+/**
+ * Hands transmit packets (with a caller provided flow_id) over to dongle territory (the flow ring)
+ */
+void
+dhd_prot_update_txflowring(dhd_pub_t *dhd, uint16 flowid, void *msgring)
+{
+       msgbuf_ring_t *ring = (msgbuf_ring_t *)msgring;
+
+       if (ring == NULL) {
+               DHD_ERROR(("%s: NULL txflowring. exiting...\n",  __FUNCTION__));
+               return;
+       }
+       /* Update read pointer */
+       if (dhd->dma_d2h_ring_upd_support) {
+               ring->rd = dhd_prot_dma_indx_get(dhd, H2D_DMA_INDX_RD_UPD, ring->idx);
+       }
+
+       DHD_TRACE(("ringid %d flowid %d write %d read %d \n\n",
+               ring->idx, flowid, ring->wr, ring->rd));
+
+       /* Need more logic here, but for now use it directly */
+       dhd_bus_schedule_queue(dhd->bus, flowid, TRUE); /* from queue to flowring */
+}
+
+/** called when DHD needs to check for 'transmit complete' messages from the dongle */
+bool
+BCMFASTPATH(dhd_prot_process_msgbuf_txcpl)(dhd_pub_t *dhd, uint bound, int ringtype)
+{
+       bool more = TRUE;
+       uint n = 0;
+       msgbuf_ring_t *ring;
+       unsigned long flags;
+
+               ring = &dhd->prot->d2hring_tx_cpln;
+
+       /* Process all the messages - DTOH direction */
+       while (!dhd_is_device_removed(dhd)) {
+               uint8 *msg_addr;
+               uint32 msg_len;
+
+               if (dhd_query_bus_erros(dhd)) {
+                       more = FALSE;
+                       break;
+               }
+
+               if (dhd->hang_was_sent) {
+                       more = FALSE;
+                       break;
+               }
+
+               if (dhd->smmu_fault_occurred) {
+                       more = FALSE;
+                       break;
+               }
+
+               DHD_RING_LOCK(ring->ring_lock, flags);
+               /* Get the address of the next message to be read from ring */
+               msg_addr = dhd_prot_get_read_addr(dhd, ring, &msg_len);
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+               if (msg_addr == NULL) {
+                       more = FALSE;
+                       break;
+               }
+
+               /* Prefetch data to populate the cache */
+               OSL_PREFETCH(msg_addr);
+
+               if (dhd_prot_process_msgtype(dhd, ring, msg_addr, msg_len) != BCME_OK) {
+                       DHD_ERROR(("%s: process %s msg addr %p len %d\n",
+                               __FUNCTION__, ring->name, msg_addr, msg_len));
+               }
+
+               /* Write to dngl rd ptr */
+               dhd_prot_upd_read_idx(dhd, ring);
+
+               /* After batch processing, check bound */
+               n += msg_len / ring->item_len;
+               if (n >= bound) {
+                       break;
+               }
+       }
+
+       DHD_LB_DISPATCH_TX_COMPL(dhd);
+       if (n) {
+               /* For IDMA and HWA case, doorbell is sent along with read index update.
+                * For DMA indices case ring doorbell once n items are read to sync with dongle.
+                */
+               if (dhd->dma_h2d_ring_upd_support && !HWA_ACTIVE(dhd) && !IDMA_ACTIVE(dhd)) {
+                       dhd->prot->mb_ring_fn(dhd->bus, 0x12345678);
+                       dhd->prot->txcpl_db_cnt++;
+               }
+       }
+       return more;
+}
+
+int
+BCMFASTPATH(dhd_prot_process_trapbuf)(dhd_pub_t *dhd)
+{
+       uint32 data;
+       dhd_dma_buf_t *trap_addr = &dhd->prot->fw_trap_buf;
+
+       /* Interrupts can come in before this struct
+        *  has been initialized.
+        */
+       if (trap_addr->va == NULL) {
+               DHD_ERROR(("%s: trap_addr->va is NULL\n", __FUNCTION__));
+               return 0;
+       }
+
+       OSL_CACHE_INV((void *)trap_addr->va, sizeof(uint32));
+       data = *(uint32 *)(trap_addr->va);
+
+       if (data & D2H_DEV_FWHALT) {
+               if (dhd->db7_trap.fw_db7w_trap_inprogress) {
+                       DHD_ERROR(("DB7 FW responded 0x%04x\n", data));
+               } else {
+                       DHD_ERROR(("Firmware trapped and trap_data is 0x%04x\n", data));
+               }
+
+               if (data & D2H_DEV_EXT_TRAP_DATA)
+               {
+                       if (dhd->extended_trap_data) {
+                               OSL_CACHE_INV((void *)trap_addr->va,
+                                      BCMPCIE_EXT_TRAP_DATA_MAXLEN);
+                               memcpy(dhd->extended_trap_data, (uint32 *)trap_addr->va,
+                                      BCMPCIE_EXT_TRAP_DATA_MAXLEN);
+                       }
+                       if (dhd->db7_trap.fw_db7w_trap_inprogress == FALSE) {
+                               DHD_ERROR(("Extended trap data available\n"));
+                       }
+               }
+               return data;
+       }
+       return 0;
+}
+
+/** called when DHD needs to check for 'ioctl complete' messages from the dongle */
+int
+BCMFASTPATH(dhd_prot_process_ctrlbuf)(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       msgbuf_ring_t *ring = &prot->d2hring_ctrl_cpln;
+       unsigned long flags;
+
+       /* Process all the messages - DTOH direction */
+       while (!dhd_is_device_removed(dhd)) {
+               uint8 *msg_addr;
+               uint32 msg_len;
+
+               if (dhd_query_bus_erros(dhd)) {
+                       break;
+               }
+
+               if (dhd->hang_was_sent) {
+                       break;
+               }
+
+               if (dhd->smmu_fault_occurred) {
+                       break;
+               }
+
+               DHD_RING_LOCK(ring->ring_lock, flags);
+               /* Get the address of the next message to be read from ring */
+               msg_addr = dhd_prot_get_read_addr(dhd, ring, &msg_len);
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+               if (msg_addr == NULL) {
+                       break;
+               }
+
+               /* Prefetch data to populate the cache */
+               OSL_PREFETCH(msg_addr);
+               if (dhd_prot_process_msgtype(dhd, ring, msg_addr, msg_len) != BCME_OK) {
+                       DHD_ERROR(("%s: process %s msg addr %p len %d\n",
+                               __FUNCTION__, ring->name, msg_addr, msg_len));
+               }
+
+               /* Write to dngl rd ptr */
+               dhd_prot_upd_read_idx(dhd, ring);
+       }
+
+       return 0;
+}
+
+/**
+ * Consume messages out of the D2H ring. Ensure that the message's DMA to host
+ * memory has completed, before invoking the message handler via a table lookup
+ * of the cmn_msg_hdr::msg_type.
+ */
+static int
+BCMFASTPATH(dhd_prot_process_msgtype)(dhd_pub_t *dhd, msgbuf_ring_t *ring, uint8 *buf, uint32 len)
+{
+       uint32 buf_len = len;
+       uint16 item_len;
+       uint8 msg_type;
+       cmn_msg_hdr_t *msg = NULL;
+       int ret = BCME_OK;
+
+       ASSERT(ring);
+       item_len = ring->item_len;
+       if (item_len == 0) {
+               DHD_ERROR(("%s: ringidx %d, item_len %d buf_len %d \n",
+                       __FUNCTION__, ring->idx, item_len, buf_len));
+               return BCME_ERROR;
+       }
+
+       while (buf_len > 0) {
+               if (dhd->hang_was_sent) {
+                       ret = BCME_ERROR;
+                       goto done;
+               }
+
+               if (dhd->smmu_fault_occurred) {
+                       ret = BCME_ERROR;
+                       goto done;
+               }
+
+               msg = (cmn_msg_hdr_t *)buf;
+
+               /* Wait until DMA completes, then fetch msg_type */
+               msg_type = dhd->prot->d2h_sync_cb(dhd, ring, msg, item_len);
+
+               /*
+                * Update the curr_rd to the current index in the ring, from where
+                * the work item is fetched. This way if the fetched work item
+                * fails in LIVELOCK, we can print the exact read index in the ring
+                * that shows up the corrupted work item.
+                */
+               if ((ring->curr_rd + 1) >= ring->max_items) {
+                       ring->curr_rd = 0;
+               } else {
+                       ring->curr_rd += 1;
+               }
+
+               /* Prefetch data to populate the cache */
+               OSL_PREFETCH(buf + item_len);
+
+               DHD_INFO(("msg_type %d item_len %d buf_len %d\n",
+                       msg_type, item_len, buf_len));
+
+               if (msg_type == MSG_TYPE_LOOPBACK) {
+                       bcm_print_bytes("LPBK RESP: ", (uint8 *)msg, item_len);
+                       DHD_ERROR((" MSG_TYPE_LOOPBACK, len %d\n", item_len));
+               }
+
+               ASSERT(msg_type < DHD_PROT_FUNCS);
+               if (msg_type >= DHD_PROT_FUNCS) {
+                       DHD_ERROR(("%s: msg_type %d, item_len %d buf_len %d\n",
+                               __FUNCTION__, msg_type, item_len, buf_len));
+                       ret = BCME_ERROR;
+                       goto done;
+               }
+
+               if (msg_type == MSG_TYPE_INFO_BUF_CMPLT) {
+                       if (ring == dhd->prot->d2hring_info_cpln) {
+                               if (!dhd->prot->infobufpost) {
+                                       DHD_ERROR(("infobuf posted are zero,"
+                                                  "but there is a completion\n"));
+                                       goto done;
+                               }
+                               dhd->prot->infobufpost--;
+                               dhd_prot_infobufpost(dhd, dhd->prot->h2dring_info_subn);
+                               dhd_prot_process_infobuf_complete(dhd, buf);
+                       }
+               } else
+               if (table_lookup[msg_type]) {
+                       table_lookup[msg_type](dhd, buf);
+               }
+
+               if (buf_len < item_len) {
+                       ret = BCME_ERROR;
+                       goto done;
+               }
+               buf_len = buf_len - item_len;
+               buf = buf + item_len;
+       }
+
+done:
+
+#ifdef DHD_RX_CHAINING
+       dhd_rxchain_commit(dhd);
+#endif
+
+       return ret;
+} /* dhd_prot_process_msgtype */
+
+static void
+dhd_prot_noop(dhd_pub_t *dhd, void *msg)
+{
+       return;
+}
+
+/** called on MSG_TYPE_RING_STATUS message received from dongle */
+static void
+dhd_prot_ringstatus_process(dhd_pub_t *dhd, void *msg)
+{
+       pcie_ring_status_t *ring_status = (pcie_ring_status_t *) msg;
+       uint32 request_id = ltoh32(ring_status->cmn_hdr.request_id);
+       uint16 status = ltoh16(ring_status->compl_hdr.status);
+       uint16 ring_id = ltoh16(ring_status->compl_hdr.flow_ring_id);
+
+       DHD_ERROR(("ring status: request_id %d, status 0x%04x, flow ring %d, write_idx %d \n",
+               request_id, status, ring_id, ltoh16(ring_status->write_idx)));
+
+       if (ltoh16(ring_status->compl_hdr.ring_id) != BCMPCIE_H2D_MSGRING_CONTROL_SUBMIT)
+               return;
+       if (status == BCMPCIE_BAD_PHASE) {
+               /* bad phase report from */
+               /* XXX: if the request is ioctl request finish the ioctl, rather than timing out */
+               DHD_ERROR(("Bad phase\n"));
+       }
+       if (status != BCMPCIE_BADOPTION)
+               return;
+
+       if (request_id == DHD_H2D_DBGRING_REQ_PKTID) {
+               /* XXX: see if the debug ring create is pending */
+               if (dhd->prot->h2dring_info_subn != NULL) {
+                       if (dhd->prot->h2dring_info_subn->create_pending == TRUE) {
+                               DHD_ERROR(("H2D ring create failed for info ring\n"));
+                               dhd->prot->h2dring_info_subn->create_pending = FALSE;
+                       }
+                       else
+                               DHD_ERROR(("ring create ID for a ring, create not pending\n"));
+               } else {
+                       DHD_ERROR(("%s info submit ring doesn't exist\n", __FUNCTION__));
+               }
+       }
+       else if (request_id == DHD_D2H_DBGRING_REQ_PKTID) {
+               /* XXX: see if the debug ring create is pending */
+               if (dhd->prot->d2hring_info_cpln != NULL) {
+                       if (dhd->prot->d2hring_info_cpln->create_pending == TRUE) {
+                               DHD_ERROR(("D2H ring create failed for info ring\n"));
+                               dhd->prot->d2hring_info_cpln->create_pending = FALSE;
+                       }
+                       else
+                               DHD_ERROR(("ring create ID for info ring, create not pending\n"));
+               } else {
+                       DHD_ERROR(("%s info cpl ring doesn't exist\n", __FUNCTION__));
+               }
+       }
+       else {
+               DHD_ERROR(("don;t know how to pair with original request\n"));
+       }
+       /* How do we track this to pair it with ??? */
+       return;
+}
+
+/** called on MSG_TYPE_GEN_STATUS ('general status') message received from dongle */
+static void
+dhd_prot_genstatus_process(dhd_pub_t *dhd, void *msg)
+{
+       pcie_gen_status_t *gen_status = (pcie_gen_status_t *)msg;
+       DHD_ERROR(("ERROR: gen status: request_id %d, STATUS 0x%04x, flow ring %d \n",
+               gen_status->cmn_hdr.request_id, gen_status->compl_hdr.status,
+               gen_status->compl_hdr.flow_ring_id));
+
+       /* How do we track this to pair it with ??? */
+       return;
+}
+
+/**
+ * Called on MSG_TYPE_IOCTLPTR_REQ_ACK ('ioctl ack') message received from dongle, meaning that the
+ * dongle received the ioctl message in dongle memory.
+ */
+static void
+dhd_prot_ioctack_process(dhd_pub_t *dhd, void *msg)
+{
+       ioctl_req_ack_msg_t *ioct_ack = (ioctl_req_ack_msg_t *)msg;
+       unsigned long flags;
+#if defined(DHD_PKTID_AUDIT_RING)
+       uint32 pktid = ltoh32(ioct_ack->cmn_hdr.request_id);
+#endif
+
+#if defined(DHD_PKTID_AUDIT_RING)
+       /* Skip audit for ADHD_IOCTL_REQ_PKTID = 0xFFFE */
+       if (pktid != DHD_IOCTL_REQ_PKTID) {
+#ifndef IOCTLRESP_USE_CONSTMEM
+               DHD_PKTID_AUDIT_RING_DEBUG(dhd, dhd->prot->pktid_ctrl_map, pktid,
+                       DHD_TEST_IS_ALLOC, msg, D2HRING_CTRL_CMPLT_ITEMSIZE);
+#else
+               DHD_PKTID_AUDIT_RING_DEBUG(dhd, dhd->prot->pktid_map_handle_ioctl, pktid,
+                       DHD_TEST_IS_ALLOC, msg, D2HRING_CTRL_CMPLT_ITEMSIZE);
+#endif /* !IOCTLRESP_USE_CONSTMEM */
+       }
+#endif
+
+       dhd->prot->ioctl_ack_time = OSL_LOCALTIME_NS();
+
+       DHD_GENERAL_LOCK(dhd, flags);
+       if ((dhd->prot->ioctl_state & MSGBUF_IOCTL_ACK_PENDING) &&
+               (dhd->prot->ioctl_state & MSGBUF_IOCTL_RESP_PENDING)) {
+               dhd->prot->ioctl_state &= ~MSGBUF_IOCTL_ACK_PENDING;
+       } else {
+               DHD_ERROR(("%s: received ioctl ACK with state %02x trans_id = %d\n",
+                       __FUNCTION__, dhd->prot->ioctl_state, dhd->prot->ioctl_trans_id));
+               prhex("dhd_prot_ioctack_process:",
+                       (uchar *)msg, D2HRING_CTRL_CMPLT_ITEMSIZE);
+       }
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       DHD_CTL(("ioctl req ack: request_id %d, status 0x%04x, flow ring %d \n",
+               ioct_ack->cmn_hdr.request_id, ioct_ack->compl_hdr.status,
+               ioct_ack->compl_hdr.flow_ring_id));
+       if (ioct_ack->compl_hdr.status != 0)  {
+               DHD_ERROR(("got an error status for the ioctl request...need to handle that\n"));
+               /* FIXME: should we fail the pending IOCTL compelteion wait process... */
+       }
+}
+
+/** called on MSG_TYPE_IOCTL_CMPLT message received from dongle */
+static void
+dhd_prot_ioctcmplt_process(dhd_pub_t *dhd, void *msg)
+{
+       dhd_prot_t *prot = dhd->prot;
+       uint32 pkt_id, xt_id;
+       ioctl_comp_resp_msg_t *ioct_resp = (ioctl_comp_resp_msg_t *)msg;
+       void *pkt;
+       unsigned long flags;
+       dhd_dma_buf_t retbuf;
+
+       /* Check for ioctl timeout induce flag, which is set by firing
+        * dhd iovar to induce IOCTL timeout. If flag is set,
+        * return from here, which results in to IOCTL timeout.
+        */
+       if (dhd->dhd_induce_error == DHD_INDUCE_IOCTL_TIMEOUT) {
+               DHD_ERROR(("%s: Inducing resumed on timeout\n", __FUNCTION__));
+               return;
+       }
+
+       memset(&retbuf, 0, sizeof(dhd_dma_buf_t));
+
+       pkt_id = ltoh32(ioct_resp->cmn_hdr.request_id);
+
+#if defined(DHD_PKTID_AUDIT_RING)
+#ifndef IOCTLRESP_USE_CONSTMEM
+       DHD_PKTID_AUDIT_RING_DEBUG(dhd, prot->pktid_ctrl_map, pkt_id,
+               DHD_DUPLICATE_FREE, msg, D2HRING_CTRL_CMPLT_ITEMSIZE);
+#else
+       DHD_PKTID_AUDIT_RING_DEBUG(dhd, prot->pktid_map_handle_ioctl, pkt_id,
+               DHD_DUPLICATE_FREE, msg, D2HRING_CTRL_CMPLT_ITEMSIZE);
+#endif /* !IOCTLRESP_USE_CONSTMEM */
+#endif
+
+       DHD_GENERAL_LOCK(dhd, flags);
+       if ((prot->ioctl_state & MSGBUF_IOCTL_ACK_PENDING) ||
+               !(prot->ioctl_state & MSGBUF_IOCTL_RESP_PENDING)) {
+               DHD_ERROR(("%s: received ioctl response with state %02x trans_id = %d\n",
+                       __FUNCTION__, dhd->prot->ioctl_state, dhd->prot->ioctl_trans_id));
+               prhex("dhd_prot_ioctcmplt_process:",
+                       (uchar *)msg, D2HRING_CTRL_CMPLT_ITEMSIZE);
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               return;
+       }
+
+       dhd->prot->ioctl_cmplt_time = OSL_LOCALTIME_NS();
+
+       /* Clear Response pending bit */
+       prot->ioctl_state &= ~MSGBUF_IOCTL_RESP_PENDING;
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+#ifndef IOCTLRESP_USE_CONSTMEM
+       pkt = dhd_prot_packet_get(dhd, pkt_id, PKTTYPE_IOCTL_RX, TRUE);
+#else
+       dhd_prot_ioctl_ret_buffer_get(dhd, pkt_id, &retbuf);
+       pkt = retbuf.va;
+#endif /* !IOCTLRESP_USE_CONSTMEM */
+       if (!pkt) {
+               DHD_ERROR(("%s: received ioctl response with NULL pkt\n", __FUNCTION__));
+               prhex("dhd_prot_ioctcmplt_process:",
+                       (uchar *)msg, D2HRING_CTRL_CMPLT_ITEMSIZE);
+               return;
+       }
+
+       prot->ioctl_resplen = ltoh16(ioct_resp->resp_len);
+       prot->ioctl_status = ltoh16(ioct_resp->compl_hdr.status);
+       xt_id = ltoh16(ioct_resp->trans_id);
+
+       if (xt_id != prot->ioctl_trans_id || prot->curr_ioctl_cmd != ioct_resp->cmd) {
+               DHD_ERROR(("%s: transaction id(%d %d) or cmd(%d %d) mismatch\n",
+                       __FUNCTION__, xt_id, prot->ioctl_trans_id,
+                       prot->curr_ioctl_cmd, ioct_resp->cmd));
+               dhd_wakeup_ioctl_event(dhd, IOCTL_RETURN_ON_ERROR);
+               dhd_prot_debug_info_print(dhd);
+#ifdef DHD_FW_COREDUMP
+               if (dhd->memdump_enabled) {
+                       /* collect core dump */
+                       dhd->memdump_type = DUMP_TYPE_TRANS_ID_MISMATCH;
+                       dhd_bus_mem_dump(dhd);
+               }
+#else
+               ASSERT(0);
+#endif /* DHD_FW_COREDUMP */
+               dhd_schedule_reset(dhd);
+               goto exit;
+       }
+       DHD_CTL(("IOCTL_COMPLETE: req_id %x transid %d status %x resplen %d\n",
+               pkt_id, xt_id, prot->ioctl_status, prot->ioctl_resplen));
+
+       if (prot->ioctl_resplen > 0) {
+#ifndef IOCTLRESP_USE_CONSTMEM
+               bcopy(PKTDATA(dhd->osh, pkt), prot->retbuf.va, prot->ioctl_resplen);
+#else
+               bcopy(pkt, prot->retbuf.va, prot->ioctl_resplen);
+#endif /* !IOCTLRESP_USE_CONSTMEM */
+       }
+
+       /* wake up any dhd_os_ioctl_resp_wait() */
+       dhd_wakeup_ioctl_event(dhd, IOCTL_RETURN_ON_SUCCESS);
+
+exit:
+#ifndef IOCTLRESP_USE_CONSTMEM
+       dhd_prot_packet_free(dhd, pkt,
+               PKTTYPE_IOCTL_RX, FALSE);
+#else
+       free_ioctl_return_buffer(dhd, &retbuf);
+#endif /* !IOCTLRESP_USE_CONSTMEM */
+
+       /* Post another ioctl buf to the device */
+       if (prot->cur_ioctlresp_bufs_posted > 0) {
+               prot->cur_ioctlresp_bufs_posted--;
+       }
+
+       dhd_msgbuf_rxbuf_post_ioctlresp_bufs(dhd);
+}
+
+int
+dhd_prot_check_tx_resource(dhd_pub_t *dhd)
+{
+       return dhd->prot->no_tx_resource;
+}
+
+/** called on MSG_TYPE_TX_STATUS message received from dongle */
+static void
+BCMFASTPATH(dhd_prot_txstatus_process)(dhd_pub_t *dhd, void *msg)
+{
+       dhd_prot_t *prot = dhd->prot;
+       host_txbuf_cmpl_t * txstatus;
+       unsigned long flags;
+       uint32 pktid;
+       void *pkt;
+       dmaaddr_t pa;
+       uint32 len;
+       void *dmah;
+       void *secdma;
+       bool pkt_fate;
+       msgbuf_ring_t *ring = &dhd->prot->d2hring_tx_cpln;
+#if defined(TX_STATUS_LATENCY_STATS)
+       flow_info_t *flow_info;
+       uint64 tx_status_latency;
+#endif /* TX_STATUS_LATENCY_STATS */
+#if defined(TX_STATUS_LATENCY_STATS)
+       flow_ring_node_t *flow_ring_node;
+       uint16 flowid;
+#endif
+       txstatus = (host_txbuf_cmpl_t *)msg;
+#if defined(TX_STATUS_LATENCY_STATS)
+       flowid = txstatus->compl_hdr.flow_ring_id;
+       flow_ring_node = DHD_FLOW_RING(dhd, flowid);
+#endif
+
+       /* locks required to protect circular buffer accesses */
+       DHD_RING_LOCK(ring->ring_lock, flags);
+       pktid = ltoh32(txstatus->cmn_hdr.request_id);
+
+       if (dhd->pcie_txs_metadata_enable > 1) {
+               /* Return metadata format (little endian):
+                * |<--- txstatus --->|<- metadatalen ->|
+                * |____|____|________|________|________|
+                * |    |    |        |        |> total delay from fetch to report (8-bit 1 = 4ms)
+                * |    |    |        |> ucode delay from enqueue to completion (8-bit 1 = 4ms)
+                * |    |    |> 8-bit reserved (pre-filled with original TX status by caller)
+                * |    |> delay time first fetch to the last fetch (4-bit 1 = 32ms)
+                * |> fetch count (4-bit)
+                */
+               printf("TX status[%d] = %04x-%04x -> status = %d (%d/%dms + %d/%dms)\n", pktid,
+                       ltoh16(txstatus->tx_status_ext), ltoh16(txstatus->tx_status),
+                       (txstatus->tx_status & WLFC_CTL_PKTFLAG_MASK),
+                       ((txstatus->tx_status >> 12) & 0xf),
+                       ((txstatus->tx_status >> 8) & 0xf) * 32,
+                       ((txstatus->tx_status_ext & 0xff) * 4),
+                       ((txstatus->tx_status_ext >> 8) & 0xff) * 4);
+       }
+       pkt_fate = TRUE;
+
+#if defined(DHD_PKTID_AUDIT_RING)
+       DHD_PKTID_AUDIT_RING_DEBUG(dhd, dhd->prot->pktid_tx_map, pktid,
+                       DHD_DUPLICATE_FREE, msg, D2HRING_TXCMPLT_ITEMSIZE);
+#endif
+
+       DHD_INFO(("txstatus for pktid 0x%04x\n", pktid));
+       if (OSL_ATOMIC_DEC_RETURN(dhd->osh, &prot->active_tx_count) < 0) {
+               DHD_ERROR(("Extra packets are freed\n"));
+       }
+       ASSERT(pktid != 0);
+
+       pkt = DHD_PKTID_TO_NATIVE(dhd, dhd->prot->pktid_tx_map, pktid,
+               pa, len, dmah, secdma, PKTTYPE_DATA_TX);
+       if (!pkt) {
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+               DHD_ERROR(("%s: received txstatus with NULL pkt\n", __FUNCTION__));
+               prhex("dhd_prot_txstatus_process:", (uchar *)msg, D2HRING_TXCMPLT_ITEMSIZE);
+#ifdef DHD_FW_COREDUMP
+               if (dhd->memdump_enabled) {
+                       /* collect core dump */
+                       dhd->memdump_type = DUMP_TYPE_PKTID_INVALID;
+                       dhd_bus_mem_dump(dhd);
+               }
+#else
+               ASSERT(0);
+#endif /* DHD_FW_COREDUMP */
+               return;
+       }
+
+       if (DHD_PKTID_AVAIL(dhd->prot->pktid_tx_map) == DHD_PKTID_MIN_AVAIL_COUNT) {
+               DHD_ERROR_RLMT(("%s: start tx queue as min pktids are available\n",
+                       __FUNCTION__));
+               prot->pktid_txq_stop_cnt--;
+               dhd->prot->no_tx_resource = FALSE;
+               dhd_bus_start_queue(dhd->bus);
+       }
+
+       DMA_UNMAP(dhd->osh, pa, (uint) len, DMA_RX, 0, dmah);
+
+#ifdef TX_STATUS_LATENCY_STATS
+       /* update the tx status latency for flowid */
+       flow_info = &flow_ring_node->flow_info;
+       tx_status_latency = OSL_SYSUPTIME_US() - DHD_PKT_GET_QTIME(pkt);
+       flow_info->cum_tx_status_latency += tx_status_latency;
+       flow_info->num_tx_status++;
+#endif /* TX_STATUS_LATENCY_STATS */
+#if defined(DHD_LB_TXC)
+       {
+               int elem_ix;
+               void **elem;
+               bcm_workq_t *workq;
+
+               workq = &prot->tx_compl_prod;
+               /*
+                * Produce the packet into the tx_compl workq for the tx compl tasklet
+                * to consume.
+                */
+               OSL_PREFETCH(PKTTAG(pkt));
+
+               /* fetch next available slot in workq */
+               elem_ix = bcm_ring_prod(WORKQ_RING(workq), DHD_LB_WORKQ_SZ);
+
+               /* FIXME FABIAN remove this from locker! */
+               DHD_PKTTAG_SET_PA((dhd_pkttag_fr_t *)PKTTAG(pkt), pa);
+               DHD_PKTTAG_SET_PA_LEN((dhd_pkttag_fr_t *)PKTTAG(pkt), len);
+
+               if (elem_ix == BCM_RING_FULL) {
+                       DHD_ERROR(("tx_compl_prod BCM_RING_FULL\n"));
+                       goto workq_ring_full;
+               }
+
+               elem = WORKQ_ELEMENT(void *, &prot->tx_compl_prod, elem_ix);
+               *elem = pkt;
+
+               smp_wmb();
+
+               /* Sync WR index to consumer if the SYNC threshold has been reached */
+               if (++prot->tx_compl_prod_sync >= DHD_LB_WORKQ_SYNC) {
+                       bcm_workq_prod_sync(workq);
+                       prot->tx_compl_prod_sync = 0;
+               }
+
+               DHD_INFO(("%s: tx_compl_prod pkt<%p> sync<%d>\n",
+                       __FUNCTION__, pkt, prot->tx_compl_prod_sync));
+
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+               return;
+       }
+
+workq_ring_full:
+
+#endif /* !DHD_LB_TXC */
+
+#ifdef DMAMAP_STATS
+       dhd->dma_stats.txdata--;
+       dhd->dma_stats.txdata_sz -= len;
+#endif /* DMAMAP_STATS */
+       pkt_fate = dhd_dbg_process_tx_status(dhd, pkt, pktid,
+               ltoh16(txstatus->compl_hdr.status) & WLFC_CTL_PKTFLAG_MASK);
+#ifdef DHD_PKT_LOGGING
+       if (dhd->d11_tx_status) {
+               uint16 status = ltoh16(txstatus->compl_hdr.status) &
+                       WLFC_CTL_PKTFLAG_MASK;
+               uint32 pkthash = __dhd_dbg_pkt_hash((uintptr_t)pkt, pktid);
+               DHD_PKTLOG_TXS(dhd, pkt, pktid, status);
+               dhd_dump_pkt(dhd, ltoh32(txstatus->cmn_hdr.if_id),
+                       (uint8 *)PKTDATA(dhd->osh, pkt), len, TRUE,
+                       &pkthash, &status);
+       }
+#endif /* DHD_PKT_LOGGING */
+#if defined(BCMPCIE)
+       dhd_txcomplete(dhd, pkt, pkt_fate);
+#ifdef DHD_4WAYM4_FAIL_DISCONNECT
+       dhd_eap_txcomplete(dhd, pkt, pkt_fate, txstatus->cmn_hdr.if_id);
+#endif /* DHD_4WAYM4_FAIL_DISCONNECT */
+#endif
+
+#if DHD_DBG_SHOW_METADATA
+       if (dhd->prot->metadata_dbg &&
+                       dhd->prot->tx_metadata_offset && txstatus->metadata_len) {
+               uchar *ptr;
+               /* The Ethernet header of TX frame was copied and removed.
+                * Here, move the data pointer forward by Ethernet header size.
+                */
+               PKTPULL(dhd->osh, pkt, ETHER_HDR_LEN);
+               ptr = PKTDATA(dhd->osh, pkt)  - (dhd->prot->tx_metadata_offset);
+               bcm_print_bytes("txmetadata", ptr, txstatus->metadata_len);
+               dhd_prot_print_metadata(dhd, ptr, txstatus->metadata_len);
+       }
+#endif /* DHD_DBG_SHOW_METADATA */
+
+#ifdef DHD_LBUF_AUDIT
+       PKTAUDIT(dhd->osh, pkt);
+#endif
+       DHD_FLOWRING_TXSTATUS_CNT_UPDATE(dhd->bus, txstatus->compl_hdr.flow_ring_id,
+               txstatus->tx_status);
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+#ifdef DHD_MEM_STATS
+       DHD_MEM_STATS_LOCK(dhd->mem_stats_lock, flags);
+       DHD_INFO(("%s txpath_mem: %llu PKTLEN: %d\n",
+               __FUNCTION__, dhd->txpath_mem, PKTLEN(dhd->osh, pkt)));
+       dhd->txpath_mem -= PKTLEN(dhd->osh, pkt);
+       DHD_MEM_STATS_UNLOCK(dhd->mem_stats_lock, flags);
+#endif /* DHD_MEM_STATS */
+       PKTFREE(dhd->osh, pkt, TRUE);
+
+       return;
+} /* dhd_prot_txstatus_process */
+
+/* FIXME: assuming that it is getting inline data related to the event data */
+/** called on MSG_TYPE_WL_EVENT message received from dongle */
+static void
+dhd_prot_event_process(dhd_pub_t *dhd, void *msg)
+{
+       wlevent_req_msg_t *evnt;
+       uint32 bufid;
+       uint16 buflen;
+       int ifidx = 0;
+       void* pkt;
+       dhd_prot_t *prot = dhd->prot;
+
+       /* Event complete header */
+       evnt = (wlevent_req_msg_t *)msg;
+       bufid = ltoh32(evnt->cmn_hdr.request_id);
+
+#if defined(DHD_PKTID_AUDIT_RING)
+       DHD_PKTID_AUDIT_RING_DEBUG(dhd, dhd->prot->pktid_ctrl_map, bufid,
+                       DHD_DUPLICATE_FREE, msg, D2HRING_CTRL_CMPLT_ITEMSIZE);
+#endif
+
+       buflen = ltoh16(evnt->event_data_len);
+
+       ifidx = BCMMSGBUF_API_IFIDX(&evnt->cmn_hdr);
+       /* FIXME: check the event status */
+
+       /* Post another rxbuf to the device */
+       if (prot->cur_event_bufs_posted)
+               prot->cur_event_bufs_posted--;
+       dhd_msgbuf_rxbuf_post_event_bufs(dhd);
+
+       pkt = dhd_prot_packet_get(dhd, bufid, PKTTYPE_EVENT_RX, TRUE);
+
+       if (!pkt) {
+               DHD_ERROR(("%s: pkt is NULL for pktid %d\n", __FUNCTION__, bufid));
+               return;
+       }
+
+       /* FIXME: make sure the length is more than dataoffset */
+       /* DMA RX offset updated through shared area */
+       if (dhd->prot->rx_dataoffset)
+               PKTPULL(dhd->osh, pkt, dhd->prot->rx_dataoffset);
+
+       PKTSETLEN(dhd->osh, pkt, buflen);
+#ifdef DHD_LBUF_AUDIT
+       PKTAUDIT(dhd->osh, pkt);
+#endif
+       dhd_bus_rx_frame(dhd->bus, pkt, ifidx, 1);
+}
+
+/** called on MSG_TYPE_INFO_BUF_CMPLT message received from dongle */
+static void
+BCMFASTPATH(dhd_prot_process_infobuf_complete)(dhd_pub_t *dhd, void* buf)
+{
+       info_buf_resp_t *resp;
+       uint32 pktid;
+       uint16 buflen;
+       void * pkt;
+
+       resp = (info_buf_resp_t *)buf;
+       pktid = ltoh32(resp->cmn_hdr.request_id);
+       buflen = ltoh16(resp->info_data_len);
+
+#ifdef DHD_PKTID_AUDIT_RING
+       DHD_PKTID_AUDIT_RING_DEBUG(dhd, dhd->prot->pktid_ctrl_map, pktid,
+                       DHD_DUPLICATE_FREE, buf, D2HRING_INFO_BUFCMPLT_ITEMSIZE);
+#endif /* DHD_PKTID_AUDIT_RING */
+
+       DHD_INFO(("id 0x%04x, len %d, phase 0x%02x, seqnum %d, rx_dataoffset %d\n",
+               pktid, buflen, resp->cmn_hdr.flags, ltoh16(resp->seqnum),
+               dhd->prot->rx_dataoffset));
+
+       if (dhd->debug_buf_dest_support) {
+               if (resp->dest < DEBUG_BUF_DEST_MAX) {
+                       dhd->debug_buf_dest_stat[resp->dest]++;
+               }
+       }
+
+       pkt = dhd_prot_packet_get(dhd, pktid, PKTTYPE_INFO_RX, TRUE);
+       if (!pkt)
+               return;
+
+       /* FIXME: make sure the length is more than dataoffset */
+       /* DMA RX offset updated through shared area */
+       if (dhd->prot->rx_dataoffset)
+               PKTPULL(dhd->osh, pkt, dhd->prot->rx_dataoffset);
+
+       PKTSETLEN(dhd->osh, pkt, buflen);
+#ifdef DHD_LBUF_AUDIT
+       PKTAUDIT(dhd->osh, pkt);
+#endif
+       /* info ring "debug" data, which is not a 802.3 frame, is sent/hacked with a
+        * special ifidx of -1.  This is just internal to dhd to get the data to
+        * dhd_linux.c:dhd_rx_frame() from here (dhd_prot_infobuf_cmplt_process).
+        */
+       dhd_bus_rx_frame(dhd->bus, pkt, DHD_DUMMY_INFO_IF /* ifidx HACK */, 1);
+}
+
+/** called on MSG_TYPE_SNAPSHOT_CMPLT message received from dongle */
+static void
+BCMFASTPATH(dhd_prot_process_snapshot_complete)(dhd_pub_t *dhd, void *buf)
+{
+}
+
+/** Stop protocol: sync w/dongle state. */
+void dhd_prot_stop(dhd_pub_t *dhd)
+{
+       ASSERT(dhd);
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+}
+
+/* Add any protocol-specific data header.
+ * Caller must reserve prot_hdrlen prepend space.
+ */
+void
+BCMFASTPATH(dhd_prot_hdrpush)(dhd_pub_t *dhd, int ifidx, void *PKTBUF)
+{
+       return;
+}
+
+uint
+dhd_prot_hdrlen(dhd_pub_t *dhd, void *PKTBUF)
+{
+       return 0;
+}
+
+#define PKTBUF pktbuf
+
+/**
+ * Called when a tx ethernet packet has been dequeued from a flow queue, and has to be inserted in
+ * the corresponding flow ring.
+ */
+int
+BCMFASTPATH(dhd_prot_txdata)(dhd_pub_t *dhd, void *PKTBUF, uint8 ifidx)
+{
+       unsigned long flags;
+       dhd_prot_t *prot = dhd->prot;
+       host_txbuf_post_t *txdesc = NULL;
+       dmaaddr_t pa, meta_pa;
+       uint8 *pktdata;
+       uint32 pktlen;
+       uint32 pktid;
+       uint8   prio;
+       uint16 flowid = 0;
+       uint16 alloced = 0;
+       uint16  headroom;
+       msgbuf_ring_t *ring;
+       flow_ring_table_t *flow_ring_table;
+       flow_ring_node_t *flow_ring_node;
+#ifdef DHD_PKT_LOGGING
+       uint32 pkthash;
+#endif /* DHD_PKT_LOGGING */
+       void *big_pktbuf = NULL;
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK) {
+               DHD_ERROR(("failed to increment hostactive_devwake\n"));
+               return BCME_ERROR;
+       }
+#endif /* PCIE_INB_DW */
+
+       if (dhd->flow_ring_table == NULL) {
+               DHD_ERROR(("dhd flow_ring_table is NULL\n"));
+               goto fail;
+       }
+
+#ifdef DHD_PCIE_PKTID
+               if (!DHD_PKTID_AVAIL(dhd->prot->pktid_tx_map)) {
+                       if (dhd->prot->pktid_depleted_cnt == DHD_PKTID_DEPLETED_MAX_COUNT) {
+                               DHD_ERROR(("%s: stop tx queue as pktid_depleted_cnt maxed\n",
+                                       __FUNCTION__));
+                               prot->pktid_txq_stop_cnt++;
+                               dhd_bus_stop_queue(dhd->bus);
+                               dhd->prot->no_tx_resource = TRUE;
+                       }
+                       dhd->prot->pktid_depleted_cnt++;
+                       goto fail;
+               } else {
+                       dhd->prot->pktid_depleted_cnt = 0;
+               }
+#endif /* DHD_PCIE_PKTID */
+
+       if (dhd->dhd_induce_error == DHD_INDUCE_TX_BIG_PKT) {
+               if ((big_pktbuf = PKTGET(dhd->osh, DHD_FLOWRING_TX_BIG_PKT_SIZE, TRUE)) == NULL) {
+                       DHD_ERROR(("%s:%d: PKTGET for txbuf failed\n", __FUNCTION__, __LINE__));
+                       goto fail;
+               }
+
+               memset(PKTDATA(dhd->osh, big_pktbuf), 0xff, DHD_FLOWRING_TX_BIG_PKT_SIZE);
+               DHD_ERROR(("PKTBUF len = %d big_pktbuf len = %d\n", PKTLEN(dhd->osh, PKTBUF),
+                               PKTLEN(dhd->osh, big_pktbuf)));
+               if (memcpy_s(PKTDATA(dhd->osh, big_pktbuf), DHD_FLOWRING_TX_BIG_PKT_SIZE,
+                               PKTDATA(dhd->osh, PKTBUF), PKTLEN(dhd->osh, PKTBUF)) != BCME_OK) {
+                       DHD_ERROR(("%s:%d: memcpy_s big_pktbuf failed\n", __FUNCTION__, __LINE__));
+                       ASSERT(0);
+               }
+       }
+
+       flowid = DHD_PKT_GET_FLOWID(PKTBUF);
+       flow_ring_table = (flow_ring_table_t *)dhd->flow_ring_table;
+       flow_ring_node = (flow_ring_node_t *)&flow_ring_table[flowid];
+
+       ring = (msgbuf_ring_t *)flow_ring_node->prot_info;
+
+       /*
+        * XXX:
+        * JIRA SW4349-436:
+        * Copying the TX Buffer to an SKB that lives in the DMA Zone
+        * is done here. Previously this was done from dhd_stat_xmit
+        * On conditions where the Host is pumping heavy traffic to
+        * the dongle, we see that the Queue that is backing up the
+        * flow rings is getting full and holds the precious memory
+        * from DMA Zone, leading the host to run out of memory in DMA
+        * Zone. So after this change the back up queue would continue to
+        * hold the pointers from Network Stack, just before putting
+        * the PHY ADDR in the flow rings, we'll do the copy.
+        */
+
+       if (dhd->dhd_induce_error == DHD_INDUCE_TX_BIG_PKT && big_pktbuf) {
+               PKTFREE(dhd->osh, PKTBUF, TRUE);
+               PKTBUF = big_pktbuf;
+       }
+
+       DHD_RING_LOCK(ring->ring_lock, flags);
+
+       /* Create a unique 32-bit packet id */
+       pktid = DHD_NATIVE_TO_PKTID_RSV(dhd, dhd->prot->pktid_tx_map,
+               PKTBUF, PKTTYPE_DATA_TX);
+#if defined(DHD_PCIE_PKTID)
+       if (pktid == DHD_PKTID_INVALID) {
+               DHD_ERROR_RLMT(("%s: Pktid pool depleted.\n", __FUNCTION__));
+               /*
+                * If we return error here, the caller would queue the packet
+                * again. So we'll just free the skb allocated in DMA Zone.
+                * Since we have not freed the original SKB yet the caller would
+                * requeue the same.
+                */
+               goto err_no_res_pktfree;
+       }
+#endif /* DHD_PCIE_PKTID */
+
+       /* Reserve space in the circular buffer */
+       txdesc = (host_txbuf_post_t *)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+       if (txdesc == NULL) {
+               DHD_INFO(("%s:%d: HTOD Msgbuf Not available TxCount = %d\n",
+                       __FUNCTION__, __LINE__, OSL_ATOMIC_READ(dhd->osh, &prot->active_tx_count)));
+               goto err_free_pktid;
+       }
+
+       /* Extract the data pointer and length information */
+       pktdata = PKTDATA(dhd->osh, PKTBUF);
+       pktlen  = PKTLEN(dhd->osh, PKTBUF);
+
+       /* TODO: XXX: re-look into dropped packets */
+       DHD_DBG_PKT_MON_TX(dhd, PKTBUF, pktid);
+#ifdef DHD_PKT_LOGGING
+       DHD_PKTLOG_TX(dhd, PKTBUF, pktid);
+       /* Dump TX packet */
+       pkthash = __dhd_dbg_pkt_hash((uintptr_t)PKTBUF, pktid);
+       dhd_dump_pkt(dhd, ifidx, pktdata, pktlen, TRUE, &pkthash, NULL);
+#endif /* DHD_PKT_LOGGING */
+
+       /* Ethernet header: Copy before we cache flush packet using DMA_MAP */
+       bcopy(pktdata, txdesc->txhdr, ETHER_HDR_LEN);
+
+       /* Extract the ethernet header and adjust the data pointer and length */
+       pktdata = PKTPULL(dhd->osh, PKTBUF, ETHER_HDR_LEN);
+       pktlen -= ETHER_HDR_LEN;
+
+       /* Map the data pointer to a DMA-able address */
+       pa = DMA_MAP(dhd->osh, PKTDATA(dhd->osh, PKTBUF), pktlen, DMA_TX, PKTBUF, 0);
+
+       if (PHYSADDRISZERO(pa)) {
+               DHD_ERROR(("%s: Something really bad, unless 0 is "
+                       "a valid phyaddr for pa\n", __FUNCTION__));
+               ASSERT(0);
+               /* XXX if ASSERT() doesn't work like as Android platform,
+                * try to requeue the packet to the backup queue.
+                */
+               goto err_rollback_idx;
+       }
+
+#ifdef DMAMAP_STATS
+       dhd->dma_stats.txdata++;
+       dhd->dma_stats.txdata_sz += pktlen;
+#endif /* DMAMAP_STATS */
+       /* No need to lock. Save the rest of the packet's metadata */
+       DHD_NATIVE_TO_PKTID_SAVE(dhd, dhd->prot->pktid_tx_map, PKTBUF, pktid,
+           pa, pktlen, DMA_TX, NULL, ring->dma_buf.secdma, PKTTYPE_DATA_TX);
+
+#ifdef TXP_FLUSH_NITEMS
+       if (ring->pend_items_count == 0)
+               ring->start_addr = (void *)txdesc;
+       ring->pend_items_count++;
+#endif
+
+       /* Form the Tx descriptor message buffer */
+
+       /* Common message hdr */
+       txdesc->cmn_hdr.msg_type = MSG_TYPE_TX_POST;
+       txdesc->cmn_hdr.if_id = ifidx;
+       txdesc->cmn_hdr.flags = ring->current_phase;
+
+       txdesc->flags = BCMPCIE_PKT_FLAGS_FRAME_802_3;
+       prio = (uint8)PKTPRIO(PKTBUF);
+
+       txdesc->flags |= (prio & 0x7) << BCMPCIE_PKT_FLAGS_PRIO_SHIFT;
+       txdesc->seg_cnt = 1;
+
+       txdesc->data_len = htol16((uint16) pktlen);
+       txdesc->data_buf_addr.high_addr = htol32(PHYSADDRHI(pa));
+       txdesc->data_buf_addr.low_addr  = htol32(PHYSADDRLO(pa));
+
+       /* Move data pointer to keep ether header in local PKTBUF for later reference */
+       PKTPUSH(dhd->osh, PKTBUF, ETHER_HDR_LEN);
+       txdesc->ext_flags = 0;
+
+       DHD_SBN_SET_FLAGS_FRAME_UDR((dhd_pkttag_fr_t *)PKTTAG(PKTBUF), txdesc->ext_flags);
+
+#ifdef DHD_TX_PROFILE
+       if (dhd->tx_profile_enab && dhd->num_profiles > 0)
+       {
+               uint8 offset;
+
+               for (offset = 0; offset < dhd->num_profiles; offset++) {
+                       if (dhd_protocol_matches_profile((uint8 *)PKTDATA(dhd->osh, PKTBUF),
+                               PKTLEN(dhd->osh, PKTBUF), &(dhd->protocol_filters[offset]))) {
+                               /* mask so other reserved bits are not modified. */
+                               txdesc->rate |=
+                                       (((uint8)dhd->protocol_filters[offset].profile_index) &
+                                       BCMPCIE_TXPOST_RATE_PROFILE_IDX_MASK);
+
+                               /* so we can use the rate field for our purposes */
+                               txdesc->rate |= BCMPCIE_TXPOST_RATE_EXT_USAGE;
+
+                               break;
+                       }
+               }
+       }
+#endif /* defined(DHD_TX_PROFILE) */
+
+       /* Handle Tx metadata */
+       headroom = (uint16)PKTHEADROOM(dhd->osh, PKTBUF);
+       if (prot->tx_metadata_offset && (headroom < prot->tx_metadata_offset))
+               DHD_ERROR(("No headroom for Metadata tx %d %d\n",
+               prot->tx_metadata_offset, headroom));
+
+       if (prot->tx_metadata_offset && (headroom >= prot->tx_metadata_offset)) {
+               DHD_TRACE(("Metadata in tx %d\n", prot->tx_metadata_offset));
+
+               /* Adjust the data pointer to account for meta data in DMA_MAP */
+               PKTPUSH(dhd->osh, PKTBUF, prot->tx_metadata_offset);
+
+               meta_pa = DMA_MAP(dhd->osh, PKTDATA(dhd->osh, PKTBUF),
+                       prot->tx_metadata_offset, DMA_RX, PKTBUF, 0);
+
+               if (PHYSADDRISZERO(meta_pa)) {
+                       /* Unmap the data pointer to a DMA-able address */
+                       DMA_UNMAP(dhd->osh, pa, pktlen, DMA_TX, 0, DHD_DMAH_NULL);
+#ifdef TXP_FLUSH_NITEMS
+                       /* update pend_items_count */
+                       ring->pend_items_count--;
+#endif /* TXP_FLUSH_NITEMS */
+
+                       DHD_ERROR(("%s: Something really bad, unless 0 is "
+                               "a valid phyaddr for meta_pa\n", __FUNCTION__));
+                       ASSERT(0);
+                       /* XXX if ASSERT() doesn't work like as Android platform,
+                        * try to requeue the packet to the backup queue.
+                        */
+                       goto err_rollback_idx;
+               }
+
+               /* Adjust the data pointer back to original value */
+               PKTPULL(dhd->osh, PKTBUF, prot->tx_metadata_offset);
+
+               txdesc->metadata_buf_len = prot->tx_metadata_offset;
+               txdesc->metadata_buf_addr.high_addr = htol32(PHYSADDRHI(meta_pa));
+               txdesc->metadata_buf_addr.low_addr = htol32(PHYSADDRLO(meta_pa));
+       } else {
+               if (1) {
+                       txdesc->metadata_buf_len = htol16(0);
+                       txdesc->metadata_buf_addr.high_addr = 0;
+                       txdesc->metadata_buf_addr.low_addr = 0;
+               }
+       }
+
+#ifdef DHD_PKTID_AUDIT_RING
+       DHD_PKTID_AUDIT(dhd, prot->pktid_tx_map, pktid, DHD_DUPLICATE_ALLOC);
+#endif /* DHD_PKTID_AUDIT_RING */
+
+       txdesc->cmn_hdr.request_id = htol32(pktid);
+
+       DHD_TRACE(("txpost: data_len %d, pktid 0x%04x\n", txdesc->data_len,
+               txdesc->cmn_hdr.request_id));
+
+#ifdef DHD_LBUF_AUDIT
+       PKTAUDIT(dhd->osh, PKTBUF);
+#endif
+
+       /* Update the write pointer in TCM & ring bell */
+#if defined(TXP_FLUSH_NITEMS)
+       /* Flush if we have either hit the txp_threshold or if this msg is */
+       /* occupying the last slot in the flow_ring - before wrap around.  */
+       if ((ring->pend_items_count == prot->txp_threshold) ||
+               ((uint8 *) txdesc == (uint8 *) DHD_RING_END_VA(ring))) {
+               dhd_prot_txdata_write_flush(dhd, flowid);
+       }
+#else
+       /* update ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ring, txdesc, 1);
+#endif
+#ifdef TX_STATUS_LATENCY_STATS
+       /* set the time when pkt is queued to flowring */
+       DHD_PKT_SET_QTIME(PKTBUF, OSL_SYSUPTIME_US());
+#endif /* TX_STATUS_LATENCY_STATS */
+
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+       OSL_ATOMIC_INC(dhd->osh, &prot->active_tx_count);
+
+       /*
+        * Take a wake lock, do not sleep if we have atleast one packet
+        * to finish.
+        */
+       DHD_TXFL_WAKE_LOCK_TIMEOUT(dhd, MAX_TX_TIMEOUT);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+#ifdef TX_STATUS_LATENCY_STATS
+       flow_ring_node->flow_info.num_tx_pkts++;
+#endif /* TX_STATUS_LATENCY_STATS */
+       return BCME_OK;
+
+err_rollback_idx:
+       /* roll back write pointer for unprocessed message */
+       if (ring->wr == 0) {
+               ring->wr = ring->max_items - 1;
+       } else {
+               ring->wr--;
+               if (ring->wr == 0) {
+                       DHD_INFO(("%s: flipping the phase now\n", ring->name));
+                       ring->current_phase = ring->current_phase ?
+                               0 : BCMPCIE_CMNHDR_PHASE_BIT_INIT;
+               }
+       }
+
+err_free_pktid:
+#if defined(DHD_PCIE_PKTID)
+       {
+               void *dmah;
+               void *secdma;
+               /* Free up the PKTID. physaddr and pktlen will be garbage. */
+               DHD_PKTID_TO_NATIVE(dhd, dhd->prot->pktid_tx_map, pktid,
+                       pa, pktlen, dmah, secdma, PKTTYPE_NO_CHECK);
+       }
+
+err_no_res_pktfree:
+#endif /* DHD_PCIE_PKTID */
+
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+fail:
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+       return BCME_NORESOURCE;
+} /* dhd_prot_txdata */
+
+/* called with a ring_lock */
+/** optimization to write "n" tx items at a time to ring */
+void
+BCMFASTPATH(dhd_prot_txdata_write_flush)(dhd_pub_t *dhd, uint16 flowid)
+{
+#ifdef TXP_FLUSH_NITEMS
+       flow_ring_table_t *flow_ring_table;
+       flow_ring_node_t *flow_ring_node;
+       msgbuf_ring_t *ring;
+
+       if (dhd->flow_ring_table == NULL) {
+               return;
+       }
+
+       flow_ring_table = (flow_ring_table_t *)dhd->flow_ring_table;
+       flow_ring_node = (flow_ring_node_t *)&flow_ring_table[flowid];
+       ring = (msgbuf_ring_t *)flow_ring_node->prot_info;
+
+       if (ring->pend_items_count) {
+               /* update ring's WR index and ring doorbell to dongle */
+               dhd_prot_ring_write_complete(dhd, ring, ring->start_addr,
+                       ring->pend_items_count);
+               ring->pend_items_count = 0;
+               ring->start_addr = NULL;
+       }
+#endif /* TXP_FLUSH_NITEMS */
+}
+
+#undef PKTBUF  /* Only defined in the above routine */
+
+int
+BCMFASTPATH(dhd_prot_hdrpull)(dhd_pub_t *dhd, int *ifidx, void *pkt, uchar *buf, uint *len)
+{
+       return 0;
+}
+
+/** post a set of receive buffers to the dongle */
+static void
+BCMFASTPATH(dhd_prot_return_rxbuf)(dhd_pub_t *dhd, uint32 pktid, uint32 rxcnt)
+/* XXX function name could be more descriptive, eg dhd_prot_post_rxbufs */
+{
+       dhd_prot_t *prot = dhd->prot;
+#if defined(DHD_LB_RXC)
+       int elem_ix;
+       uint32 *elem;
+       bcm_workq_t *workq;
+
+       workq = &prot->rx_compl_prod;
+
+       /* Produce the work item */
+       elem_ix = bcm_ring_prod(WORKQ_RING(workq), DHD_LB_WORKQ_SZ);
+       if (elem_ix == BCM_RING_FULL) {
+               DHD_ERROR(("%s LB RxCompl workQ is full\n", __FUNCTION__));
+               ASSERT(0);
+               return;
+       }
+
+       elem = WORKQ_ELEMENT(uint32, workq, elem_ix);
+       *elem = pktid;
+
+       smp_wmb();
+
+       /* Sync WR index to consumer if the SYNC threshold has been reached */
+       if (++prot->rx_compl_prod_sync >= DHD_LB_WORKQ_SYNC) {
+               bcm_workq_prod_sync(workq);
+               prot->rx_compl_prod_sync = 0;
+       }
+
+       DHD_INFO(("%s: rx_compl_prod pktid<%u> sync<%d>\n",
+               __FUNCTION__, pktid, prot->rx_compl_prod_sync));
+
+#endif /* DHD_LB_RXC */
+
+       if (prot->rxbufpost >= rxcnt) {
+               prot->rxbufpost -= (uint16)rxcnt;
+       } else {
+               /* XXX: I have seen this assert hitting.
+                * Will be removed once rootcaused.
+                */
+               /* ASSERT(0); */
+               prot->rxbufpost = 0;
+       }
+
+#if !defined(DHD_LB_RXC)
+       if (prot->rxbufpost <= (prot->max_rxbufpost - RXBUFPOST_THRESHOLD))
+               dhd_msgbuf_rxbuf_post(dhd, FALSE); /* alloc pkt ids */
+#endif /* !DHD_LB_RXC */
+       return;
+}
+
+/* called before an ioctl is sent to the dongle */
+static void
+dhd_prot_wlioctl_intercept(dhd_pub_t *dhd, wl_ioctl_t * ioc, void * buf)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int slen = 0;
+
+       if (ioc->cmd == WLC_SET_VAR && buf != NULL && !strcmp(buf, "pcie_bus_tput")) {
+               pcie_bus_tput_params_t *tput_params;
+
+               slen = strlen("pcie_bus_tput") + 1;
+               tput_params = (pcie_bus_tput_params_t*)((char *)buf + slen);
+               bcopy(&prot->host_bus_throughput_buf.pa, &tput_params->host_buf_addr,
+                       sizeof(tput_params->host_buf_addr));
+               tput_params->host_buf_len = DHD_BUS_TPUT_BUF_LEN;
+       }
+
+}
+
+/* called after an ioctl returns from dongle */
+static void
+dhd_prot_wl_ioctl_ret_intercept(dhd_pub_t *dhd, wl_ioctl_t * ioc, void * buf,
+       int ifidx, int ret, int len)
+{
+
+       if (!ret && ioc->cmd == WLC_SET_VAR && buf != NULL) {
+               /* Intercept the wme_dp ioctl here */
+               if (!strcmp(buf, "wme_dp")) {
+                       int slen, val = 0;
+
+                       slen = strlen("wme_dp") + 1;
+                       if (len >= (int)(slen + sizeof(int)))
+                               bcopy(((char *)buf + slen), &val, sizeof(int));
+                       dhd->wme_dp = (uint8) ltoh32(val);
+               }
+
+       }
+
+}
+
+#ifdef DHD_PM_CONTROL_FROM_FILE
+extern bool g_pm_control;
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+
+/** Use protocol to issue ioctl to dongle. Only one ioctl may be in transit. */
+int dhd_prot_ioctl(dhd_pub_t *dhd, int ifidx, wl_ioctl_t * ioc, void * buf, int len)
+{
+       int ret = -1;
+       uint8 action;
+
+       if (dhd->bus->is_linkdown) {
+               DHD_ERROR_RLMT(("%s : PCIe link is down. we have nothing to do\n", __FUNCTION__));
+               goto done;
+       }
+
+       if (dhd_query_bus_erros(dhd)) {
+               DHD_ERROR_RLMT(("%s : some BUS error. we have nothing to do\n", __FUNCTION__));
+               goto done;
+       }
+
+       if ((dhd->busstate == DHD_BUS_DOWN) || dhd->hang_was_sent) {
+               DHD_ERROR_RLMT(("%s : bus is down. we have nothing to do -"
+                       " bus state: %d, sent hang: %d\n", __FUNCTION__,
+                       dhd->busstate, dhd->hang_was_sent));
+               goto done;
+       }
+
+       if (dhd->busstate == DHD_BUS_SUSPEND) {
+               DHD_ERROR(("%s : bus is suspended\n", __FUNCTION__));
+               goto done;
+       }
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (ioc->cmd == WLC_SET_PM) {
+#ifdef DHD_PM_CONTROL_FROM_FILE
+               if (g_pm_control == TRUE) {
+                       DHD_ERROR(("%s: SET PM ignored!(Requested:%d)\n",
+                               __FUNCTION__, buf ? *(char *)buf : 0));
+                       goto done;
+               }
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+#ifdef DHD_PM_OVERRIDE
+               {
+                       extern bool g_pm_override;
+                       if (g_pm_override == TRUE) {
+                               DHD_ERROR(("%s: PM override SET PM ignored!(Requested:%d)\n",
+                                       __FUNCTION__, buf ? *(char *)buf : 0));
+                               goto done;
+                       }
+               }
+#endif /* DHD_PM_OVERRIDE */
+               DHD_TRACE_HW4(("%s: SET PM to %d\n", __FUNCTION__, buf ? *(char *)buf : 0));
+       }
+
+       ASSERT(len <= WLC_IOCTL_MAXLEN);
+
+       if (len > WLC_IOCTL_MAXLEN)
+               goto done;
+
+       action = ioc->set;
+
+       dhd_prot_wlioctl_intercept(dhd, ioc, buf);
+
+       if (action & WL_IOCTL_ACTION_SET) {
+               ret = dhd_msgbuf_set_ioctl(dhd, ifidx, ioc->cmd, buf, len, action);
+       } else {
+               ret = dhd_msgbuf_query_ioctl(dhd, ifidx, ioc->cmd, buf, len, action);
+               if (ret > 0)
+                       ioc->used = ret;
+       }
+
+       /* Too many programs assume ioctl() returns 0 on success */
+       if (ret >= 0) {
+               ret = 0;
+       } else {
+               dhd->dongle_error = ret;
+       }
+
+       dhd_prot_wl_ioctl_ret_intercept(dhd, ioc, buf, ifidx, ret, len);
+
+done:
+       return ret;
+
+} /* dhd_prot_ioctl */
+
+/** test / loopback */
+
+/*
+ * XXX: This will fail with new PCIe Split header Full Dongle using fixed
+ * sized messages in control submission ring. We seem to be sending the lpbk
+ * data via the control message, wherein the lpbk data may be larger than 1
+ * control message that is being committed.
+ */
+int
+dhdmsgbuf_lpbk_req(dhd_pub_t *dhd, uint len)
+{
+       unsigned long flags;
+       dhd_prot_t *prot = dhd->prot;
+       uint16 alloced = 0;
+
+       ioct_reqst_hdr_t *ioct_rqst;
+
+       uint16 hdrlen = sizeof(ioct_reqst_hdr_t);
+       uint16 msglen = len + hdrlen;
+       msgbuf_ring_t *ring = &prot->h2dring_ctrl_subn;
+
+       msglen = ALIGN_SIZE(msglen, DMA_ALIGN_LEN);
+       msglen = LIMIT_TO_MAX(msglen, MSGBUF_MAX_MSG_SIZE);
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK)
+               return BCME_ERROR;
+#endif /* PCIE_INB_DW */
+
+       DHD_RING_LOCK(ring->ring_lock, flags);
+
+       ioct_rqst = (ioct_reqst_hdr_t *)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+
+       if (ioct_rqst == NULL) {
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+               return 0;
+       }
+
+       {
+               uint8 *ptr;
+               uint16 i;
+
+               ptr = (uint8 *)ioct_rqst; /* XXX: failure!!! */
+               for (i = 0; i < msglen; i++) {
+                       ptr[i] = i % 256;
+               }
+       }
+
+       /* Common msg buf hdr */
+       ioct_rqst->msg.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+       ring->seqnum++;
+
+       ioct_rqst->msg.msg_type = MSG_TYPE_LOOPBACK;
+       ioct_rqst->msg.if_id = 0;
+       ioct_rqst->msg.flags = ring->current_phase;
+
+       bcm_print_bytes("LPBK REQ: ", (uint8 *)ioct_rqst, msglen);
+
+       /* update ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ring, ioct_rqst, 1);
+
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+
+       return 0;
+}
+
+/** test / loopback */
+void dmaxfer_free_dmaaddr(dhd_pub_t *dhd, dhd_dmaxfer_t *dmaxfer)
+{
+       if (dmaxfer == NULL)
+               return;
+
+       dhd_dma_buf_free(dhd, &dmaxfer->srcmem);
+       dhd_dma_buf_free(dhd, &dmaxfer->dstmem);
+}
+
+/** test / loopback */
+int
+dhd_prepare_schedule_dmaxfer_free(dhd_pub_t *dhdp)
+{
+       dhd_prot_t *prot = dhdp->prot;
+       dhd_dmaxfer_t *dmaxfer = &prot->dmaxfer;
+       dmaxref_mem_map_t *dmap = NULL;
+
+       dmap = MALLOCZ(dhdp->osh, sizeof(dmaxref_mem_map_t));
+       if (!dmap) {
+               DHD_ERROR(("%s: dmap alloc failed\n", __FUNCTION__));
+               goto mem_alloc_fail;
+       }
+       dmap->srcmem = &(dmaxfer->srcmem);
+       dmap->dstmem = &(dmaxfer->dstmem);
+
+       DMAXFER_FREE(dhdp, dmap);
+       return BCME_OK;
+
+mem_alloc_fail:
+       if (dmap) {
+               MFREE(dhdp->osh, dmap, sizeof(dmaxref_mem_map_t));
+       }
+       return BCME_NOMEM;
+} /* dhd_prepare_schedule_dmaxfer_free */
+
+/** test / loopback */
+void
+dmaxfer_free_prev_dmaaddr(dhd_pub_t *dhdp, dmaxref_mem_map_t *dmmap)
+{
+
+       dhd_dma_buf_free(dhdp, dmmap->srcmem);
+       dhd_dma_buf_free(dhdp, dmmap->dstmem);
+
+       MFREE(dhdp->osh, dmmap, sizeof(dmaxref_mem_map_t));
+
+       dhdp->bus->dmaxfer_complete = TRUE;
+       dhd_os_dmaxfer_wake(dhdp);
+} /* dmaxfer_free_prev_dmaaddr */
+
+/** test / loopback */
+int dmaxfer_prepare_dmaaddr(dhd_pub_t *dhd, uint len,
+       uint srcdelay, uint destdelay, dhd_dmaxfer_t *dmaxfer)
+{
+       uint i = 0, j = 0;
+       if (!dmaxfer)
+               return BCME_ERROR;
+
+       /* First free up existing buffers */
+       dmaxfer_free_dmaaddr(dhd, dmaxfer);
+
+       if (dhd_dma_buf_alloc(dhd, &dmaxfer->srcmem, len)) {
+               return BCME_NOMEM;
+       }
+
+       if (dhd_dma_buf_alloc(dhd, &dmaxfer->dstmem, len + 8)) {
+               dhd_dma_buf_free(dhd, &dmaxfer->srcmem);
+               return BCME_NOMEM;
+       }
+
+       dmaxfer->len = len;
+
+       /* Populate source with a pattern like below
+        * 0x00000000
+        * 0x01010101
+        * 0x02020202
+        * 0x03030303
+        * 0x04040404
+        * 0x05050505
+        * ...
+        * 0xFFFFFFFF
+        */
+       while (i < dmaxfer->len) {
+               ((uint8*)dmaxfer->srcmem.va)[i] = j % 256;
+               i++;
+               if (i % 4 == 0) {
+                       j++;
+               }
+       }
+
+       OSL_CACHE_FLUSH(dmaxfer->srcmem.va, dmaxfer->len);
+
+       dmaxfer->srcdelay = srcdelay;
+       dmaxfer->destdelay = destdelay;
+
+       return BCME_OK;
+} /* dmaxfer_prepare_dmaaddr */
+
+static void
+dhd_msgbuf_dmaxfer_process(dhd_pub_t *dhd, void *msg)
+{
+       dhd_prot_t *prot = dhd->prot;
+       uint64 end_usec;
+       pcie_dmaxfer_cmplt_t *cmplt = (pcie_dmaxfer_cmplt_t *)msg;
+       int buf_free_scheduled;
+
+       BCM_REFERENCE(cmplt);
+       end_usec = OSL_SYSUPTIME_US();
+
+       DHD_ERROR(("DMA loopback status: %d\n", cmplt->compl_hdr.status));
+       prot->dmaxfer.status = cmplt->compl_hdr.status;
+       OSL_CACHE_INV(prot->dmaxfer.dstmem.va, prot->dmaxfer.len);
+       if (prot->dmaxfer.srcmem.va && prot->dmaxfer.dstmem.va) {
+               if (memcmp(prot->dmaxfer.srcmem.va,
+                       prot->dmaxfer.dstmem.va, prot->dmaxfer.len) ||
+                       cmplt->compl_hdr.status != BCME_OK) {
+                       DHD_ERROR(("DMA loopback failed\n"));
+                       /* it is observed that some times the completion
+                        * header status is set as OK, but the memcmp fails
+                        * hence always explicitly set the dmaxfer status
+                        * as error if this happens.
+                        */
+                       prot->dmaxfer.status = BCME_ERROR;
+                       prhex("XFER SRC: ",
+                           prot->dmaxfer.srcmem.va, prot->dmaxfer.len);
+                       prhex("XFER DST: ",
+                           prot->dmaxfer.dstmem.va, prot->dmaxfer.len);
+               }
+               else {
+                       switch (prot->dmaxfer.d11_lpbk) {
+                       case M2M_DMA_LPBK: {
+                               DHD_ERROR(("DMA successful pcie m2m DMA loopback\n"));
+                               } break;
+                       case D11_LPBK: {
+                               DHD_ERROR(("DMA successful with d11 loopback\n"));
+                               } break;
+                       case BMC_LPBK: {
+                               DHD_ERROR(("DMA successful with bmc loopback\n"));
+                               } break;
+                       case M2M_NON_DMA_LPBK: {
+                               DHD_ERROR(("DMA successful pcie m2m NON DMA loopback\n"));
+                               } break;
+                       case D11_HOST_MEM_LPBK: {
+                               DHD_ERROR(("DMA successful d11 host mem loopback\n"));
+                               } break;
+                       case BMC_HOST_MEM_LPBK: {
+                               DHD_ERROR(("DMA successful bmc host mem loopback\n"));
+                               } break;
+                       default: {
+                               DHD_ERROR(("Invalid loopback option\n"));
+                               } break;
+                       }
+
+                       if (DHD_LPBKDTDUMP_ON()) {
+                               /* debug info print of the Tx and Rx buffers */
+                               dhd_prhex("XFER SRC: ", prot->dmaxfer.srcmem.va,
+                                       prot->dmaxfer.len, DHD_INFO_VAL);
+                               dhd_prhex("XFER DST: ", prot->dmaxfer.dstmem.va,
+                                       prot->dmaxfer.len, DHD_INFO_VAL);
+                       }
+               }
+       }
+
+       buf_free_scheduled = dhd_prepare_schedule_dmaxfer_free(dhd);
+       end_usec -= prot->dmaxfer.start_usec;
+       if (end_usec) {
+               prot->dmaxfer.time_taken = end_usec;
+               DHD_ERROR(("DMA loopback %d bytes in %lu usec, %u kBps\n",
+                       prot->dmaxfer.len, (unsigned long)end_usec,
+                       (prot->dmaxfer.len * (1000 * 1000 / 1024) / (uint32)end_usec)));
+       }
+       dhd->prot->dmaxfer.in_progress = FALSE;
+
+       if (buf_free_scheduled != BCME_OK) {
+               dhd->bus->dmaxfer_complete = TRUE;
+               dhd_os_dmaxfer_wake(dhd);
+       }
+}
+
+/** Test functionality.
+ * Transfers bytes from host to dongle and to host again using DMA
+ * This function is not reentrant, as prot->dmaxfer.in_progress is not protected
+ * by a spinlock.
+ */
+int
+dhdmsgbuf_dmaxfer_req(dhd_pub_t *dhd, uint len, uint srcdelay, uint destdelay,
+       uint d11_lpbk, uint core_num)
+{
+       unsigned long flags;
+       int ret = BCME_OK;
+       dhd_prot_t *prot = dhd->prot;
+       pcie_dma_xfer_params_t *dmap;
+       uint32 xferlen = LIMIT_TO_MAX(len, DMA_XFER_LEN_LIMIT);
+       uint16 alloced = 0;
+       msgbuf_ring_t *ring = &prot->h2dring_ctrl_subn;
+
+       /* XXX: prot->dmaxfer.in_progress is not protected by lock */
+       if (prot->dmaxfer.in_progress) {
+               DHD_ERROR(("DMA is in progress...\n"));
+               return BCME_ERROR;
+       }
+
+       if (d11_lpbk >= MAX_LPBK) {
+               DHD_ERROR(("loopback mode should be either"
+                       " 0-PCIE_M2M_DMA, 1-D11, 2-BMC or 3-PCIE_M2M_NonDMA\n"));
+               return BCME_ERROR;
+       }
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK) {
+               return BCME_ERROR;
+       }
+#endif /* PCIE_INB_DW */
+
+       prot->dmaxfer.in_progress = TRUE;
+       if ((ret = dmaxfer_prepare_dmaaddr(dhd, xferlen, srcdelay, destdelay,
+               &prot->dmaxfer)) != BCME_OK) {
+               prot->dmaxfer.in_progress = FALSE;
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+               return ret;
+       }
+       DHD_RING_LOCK(ring->ring_lock, flags);
+       dmap = (pcie_dma_xfer_params_t *)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+
+       if (dmap == NULL) {
+               dmaxfer_free_dmaaddr(dhd, &prot->dmaxfer);
+               prot->dmaxfer.in_progress = FALSE;
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+               return BCME_NOMEM;
+       }
+
+       /* Common msg buf hdr */
+       dmap->cmn_hdr.msg_type = MSG_TYPE_LPBK_DMAXFER;
+       dmap->cmn_hdr.request_id = htol32(DHD_FAKE_PKTID);
+       dmap->cmn_hdr.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+       dmap->cmn_hdr.flags = ring->current_phase;
+       ring->seqnum++;
+
+       dmap->host_input_buf_addr.high = htol32(PHYSADDRHI(prot->dmaxfer.srcmem.pa));
+       dmap->host_input_buf_addr.low = htol32(PHYSADDRLO(prot->dmaxfer.srcmem.pa));
+       dmap->host_ouput_buf_addr.high = htol32(PHYSADDRHI(prot->dmaxfer.dstmem.pa));
+       dmap->host_ouput_buf_addr.low = htol32(PHYSADDRLO(prot->dmaxfer.dstmem.pa));
+       dmap->xfer_len = htol32(prot->dmaxfer.len);
+       dmap->srcdelay = htol32(prot->dmaxfer.srcdelay);
+       dmap->destdelay = htol32(prot->dmaxfer.destdelay);
+       prot->dmaxfer.d11_lpbk = d11_lpbk;
+       dmap->flags = (((core_num & PCIE_DMA_XFER_FLG_CORE_NUMBER_MASK)
+                       << PCIE_DMA_XFER_FLG_CORE_NUMBER_SHIFT) |
+                       ((prot->dmaxfer.d11_lpbk & PCIE_DMA_XFER_FLG_D11_LPBK_MASK)
+                        << PCIE_DMA_XFER_FLG_D11_LPBK_SHIFT));
+       prot->dmaxfer.start_usec = OSL_SYSUPTIME_US();
+
+       /* update ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ring, dmap, 1);
+
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+       DHD_ERROR(("DMA loopback Started... on core[%d]\n", core_num));
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+
+       return BCME_OK;
+} /* dhdmsgbuf_dmaxfer_req */
+
+int
+dhdmsgbuf_dmaxfer_status(dhd_pub_t *dhd, dma_xfer_info_t *result)
+{
+       dhd_prot_t *prot = dhd->prot;
+
+       if (prot->dmaxfer.in_progress)
+               result->status = DMA_XFER_IN_PROGRESS;
+       else if (prot->dmaxfer.status == 0)
+               result->status = DMA_XFER_SUCCESS;
+       else
+               result->status = DMA_XFER_FAILED;
+
+       result->type = prot->dmaxfer.d11_lpbk;
+       result->error_code = prot->dmaxfer.status;
+       result->num_bytes = prot->dmaxfer.len;
+       result->time_taken = prot->dmaxfer.time_taken;
+       if (prot->dmaxfer.time_taken) {
+               /* throughput in kBps */
+               result->tput =
+                       (prot->dmaxfer.len * (1000 * 1000 / 1024)) /
+                       (uint32)prot->dmaxfer.time_taken;
+       }
+
+       return BCME_OK;
+}
+
+/** Called in the process of submitting an ioctl to the dongle */
+static int
+dhd_msgbuf_query_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len, uint8 action)
+{
+       int ret = 0;
+       uint copylen = 0;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (dhd->bus->is_linkdown) {
+               DHD_ERROR(("%s : PCIe link is down. we have nothing to do\n",
+                       __FUNCTION__));
+               return -EIO;
+       }
+
+       if (dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+               return -EIO;
+       }
+
+       /* don't talk to the dongle if fw is about to be reloaded */
+       if (dhd->hang_was_sent) {
+               DHD_ERROR(("%s: HANG was sent up earlier. Not talking to the chip\n",
+                       __FUNCTION__));
+               return -EIO;
+       }
+
+       if (cmd == WLC_GET_VAR && buf)
+       {
+               if (!len || !*(uint8 *)buf) {
+                       DHD_ERROR(("%s(): Zero length bailing\n", __FUNCTION__));
+                       ret = BCME_BADARG;
+                       goto done;
+               }
+
+               /* Respond "bcmerror" and "bcmerrorstr" with local cache */
+               copylen = MIN(len, BCME_STRLEN);
+
+               if ((len >= strlen("bcmerrorstr")) &&
+                       (!strcmp((char *)buf, "bcmerrorstr"))) {
+                       strlcpy((char *)buf, bcmerrorstr(dhd->dongle_error), copylen);
+                       goto done;
+               } else if ((len >= strlen("bcmerror")) &&
+                       !strcmp((char *)buf, "bcmerror")) {
+                       *(uint32 *)(uint32 *)buf = dhd->dongle_error;
+                       goto done;
+               }
+       }
+
+       DHD_CTL(("query_ioctl: ACTION %d ifdix %d cmd %d len %d \n",
+           action, ifidx, cmd, len));
+
+       ret = dhd_fillup_ioct_reqst(dhd, (uint16)len, cmd, buf, ifidx);
+
+       if (ret < 0) {
+               DHD_ERROR(("%s(): dhd_fillup_ioct_reqst failed \r\n", __FUNCTION__));
+               goto done;
+       }
+
+       /* wait for IOCTL completion message from dongle and get first fragment */
+       ret = dhd_msgbuf_wait_ioctl_cmplt(dhd, len, buf);
+
+done:
+       return ret;
+}
+
+void
+dhd_msgbuf_iovar_timeout_dump(dhd_pub_t *dhd)
+{
+       uint32 intstatus;
+       dhd_prot_t *prot = dhd->prot;
+       dhd->rxcnt_timeout++;
+       dhd->rx_ctlerrs++;
+       dhd->iovar_timeout_occured = TRUE;
+       DHD_ERROR(("%s: resumed on timeout rxcnt_timeout%s %d ioctl_cmd %d "
+               "trans_id %d state %d busstate=%d ioctl_received=%d\n", __FUNCTION__,
+               dhd->is_sched_error ? " due to scheduling problem" : "",
+               dhd->rxcnt_timeout, prot->curr_ioctl_cmd, prot->ioctl_trans_id,
+               prot->ioctl_state, dhd->busstate, prot->ioctl_received));
+#if defined(DHD_KERNEL_SCHED_DEBUG) && defined(DHD_FW_COREDUMP)
+               /* XXX DHD triggers Kernel panic if the resumed on timeout occurrs
+                * due to tasklet or workqueue scheduling problems in the Linux Kernel.
+                * Customer informs that it is hard to find any clue from the
+                * host memory dump since the important tasklet or workqueue information
+                * is already disappered due the latency while printing out the timestamp
+                * logs for debugging scan timeout issue.
+                * For this reason, customer requestes us to trigger Kernel Panic rather than
+                * taking a SOCRAM dump.
+                */
+               if (dhd->is_sched_error && dhd->memdump_enabled == DUMP_MEMFILE_BUGON) {
+                       /* change g_assert_type to trigger Kernel panic */
+                       g_assert_type = 2;
+                       /* use ASSERT() to trigger panic */
+                       ASSERT(0);
+               }
+#endif /* DHD_KERNEL_SCHED_DEBUG && DHD_FW_COREDUMP */
+
+       if (prot->curr_ioctl_cmd == WLC_SET_VAR ||
+                       prot->curr_ioctl_cmd == WLC_GET_VAR) {
+               char iovbuf[32];
+               int dump_size = 128;
+               uint8 *ioctl_buf = (uint8 *)prot->ioctbuf.va;
+               memset(iovbuf, 0, sizeof(iovbuf));
+               strncpy(iovbuf, ioctl_buf, sizeof(iovbuf) - 1);
+               iovbuf[sizeof(iovbuf) - 1] = '\0';
+               DHD_ERROR(("Current IOVAR (%s): %s\n",
+                       prot->curr_ioctl_cmd == WLC_SET_VAR ?
+                       "WLC_SET_VAR" : "WLC_GET_VAR", iovbuf));
+               DHD_ERROR(("========== START IOCTL REQBUF DUMP ==========\n"));
+               prhex("ioctl_buf", (const u8 *) ioctl_buf, dump_size);
+               DHD_ERROR(("\n========== END IOCTL REQBUF DUMP ==========\n"));
+       }
+
+       /* Check the PCIe link status by reading intstatus register */
+       intstatus = si_corereg(dhd->bus->sih,
+               dhd->bus->sih->buscoreidx, dhd->bus->pcie_mailbox_int, 0, 0);
+       if (intstatus == (uint32)-1) {
+               DHD_ERROR(("%s : PCIe link might be down\n", __FUNCTION__));
+               dhd->bus->is_linkdown = TRUE;
+       }
+
+       dhd_bus_dump_console_buffer(dhd->bus);
+       dhd_prot_debug_info_print(dhd);
+}
+
+/**
+ * Waits for IOCTL completion message from the dongle, copies this into caller
+ * provided parameter 'buf'.
+ */
+static int
+dhd_msgbuf_wait_ioctl_cmplt(dhd_pub_t *dhd, uint32 len, void *buf)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int timeleft;
+       unsigned long flags;
+       int ret = 0;
+       static uint cnt = 0;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (dhd_query_bus_erros(dhd)) {
+               ret = -EIO;
+               goto out;
+       }
+#ifdef GDB_PROXY
+       /* Loop while timeout is caused by firmware stop in GDB */
+       {
+               uint32 prev_stop_count;
+               do {
+                       prev_stop_count = dhd->gdb_proxy_stop_count;
+                       timeleft = dhd_os_ioctl_resp_wait(dhd, (uint *)&prot->ioctl_received);
+               } while ((timeleft == 0) && ((dhd->gdb_proxy_stop_count != prev_stop_count) ||
+                       (dhd->gdb_proxy_stop_count & GDB_PROXY_STOP_MASK)));
+       }
+#else
+       timeleft = dhd_os_ioctl_resp_wait(dhd, (uint *)&prot->ioctl_received);
+#endif /* GDB_PROXY */
+
+#ifdef DHD_RECOVER_TIMEOUT
+       if (prot->ioctl_received == 0) {
+               uint32 intstatus = si_corereg(dhd->bus->sih,
+                       dhd->bus->sih->buscoreidx, dhd->bus->pcie_mailbox_int, 0, 0);
+               int host_irq_disbled = dhdpcie_irq_disabled(dhd->bus);
+               if ((intstatus) && (intstatus != (uint32)-1) &&
+                       (timeleft == 0) && (!dhd_query_bus_erros(dhd))) {
+                       DHD_ERROR(("%s: iovar timeout trying again intstatus=%x"
+                               " host_irq_disabled=%d\n",
+                               __FUNCTION__, intstatus, host_irq_disbled));
+                       dhd_pcie_intr_count_dump(dhd);
+                       dhd_print_tasklet_status(dhd);
+                       dhd_prot_process_ctrlbuf(dhd);
+                       timeleft = dhd_os_ioctl_resp_wait(dhd, (uint *)&prot->ioctl_received);
+                       /* Clear Interrupts */
+                       dhdpcie_bus_clear_intstatus(dhd->bus);
+               }
+       }
+#endif /* DHD_RECOVER_TIMEOUT */
+
+       if (dhd->conf->ctrl_resched > 0 && timeleft == 0 && (!dhd_query_bus_erros(dhd))) {
+               cnt++;
+               if (cnt <= dhd->conf->ctrl_resched) {
+                       uint buscorerev = dhd->bus->sih->buscorerev;
+                       uint32 intstatus = 0, intmask = 0;
+                       intstatus = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, PCIMailBoxInt(buscorerev), 0, 0);
+                       intmask = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, PCIMailBoxMask(buscorerev), 0, 0);
+                       if (intstatus) {
+                               DHD_ERROR(("%s: reschedule dhd_dpc, cnt=%d, intstatus=0x%x, intmask=0x%x\n",
+                                       __FUNCTION__, cnt, intstatus, intmask));
+                               dhd->bus->intstatus = intstatus;
+                               dhd->bus->ipend = TRUE;
+                               dhd->bus->dpc_sched = TRUE;
+                               dhd_sched_dpc(dhd);
+                               timeleft = dhd_os_ioctl_resp_wait(dhd, &prot->ioctl_received);
+                       }
+               }
+       } else {
+               cnt = 0;
+       }
+
+       if (timeleft == 0 && (!dhd_query_bus_erros(dhd))) {
+               /* check if resumed on time out related to scheduling issue */
+               dhd->is_sched_error = FALSE;
+               if (dhd->bus->isr_entry_time > prot->ioctl_fillup_time) {
+                       dhd->is_sched_error = dhd_bus_query_dpc_sched_errors(dhd);
+               }
+
+               dhd_msgbuf_iovar_timeout_dump(dhd);
+
+#ifdef DHD_FW_COREDUMP
+               /* Collect socram dump */
+               if (dhd->memdump_enabled) {
+                       /* collect core dump */
+                       dhd->memdump_type = DUMP_TYPE_RESUMED_ON_TIMEOUT;
+                       dhd_bus_mem_dump(dhd);
+               }
+#endif /* DHD_FW_COREDUMP */
+
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+               dhd->bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+               ret = -ETIMEDOUT;
+               goto out;
+       } else {
+               if (prot->ioctl_received != IOCTL_RETURN_ON_SUCCESS) {
+                       DHD_ERROR(("%s: IOCTL failure due to ioctl_received = %d\n",
+                               __FUNCTION__, prot->ioctl_received));
+                       ret = -EINVAL;
+                       goto out;
+               }
+               dhd->rxcnt_timeout = 0;
+               dhd->rx_ctlpkts++;
+               DHD_CTL(("%s: ioctl resp resumed, got %d\n",
+                       __FUNCTION__, prot->ioctl_resplen));
+       }
+
+       if (dhd->prot->ioctl_resplen > len)
+               dhd->prot->ioctl_resplen = (uint16)len;
+       if (buf)
+               bcopy(dhd->prot->retbuf.va, buf, dhd->prot->ioctl_resplen);
+
+       ret = (int)(dhd->prot->ioctl_status);
+
+out:
+       DHD_GENERAL_LOCK(dhd, flags);
+       dhd->prot->ioctl_state = 0;
+       dhd->prot->ioctl_resplen = 0;
+       dhd->prot->ioctl_received = IOCTL_WAIT;
+       dhd->prot->curr_ioctl_cmd = 0;
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       return ret;
+} /* dhd_msgbuf_wait_ioctl_cmplt */
+
+static int
+dhd_msgbuf_set_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len, uint8 action)
+{
+       int ret = 0;
+
+       DHD_TRACE(("%s: Enter \n", __FUNCTION__));
+
+       if (dhd->bus->is_linkdown) {
+               DHD_ERROR(("%s : PCIe link is down. we have nothing to do\n",
+                       __FUNCTION__));
+               return -EIO;
+       }
+
+       if (dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+               return -EIO;
+       }
+
+       /* don't talk to the dongle if fw is about to be reloaded */
+       if (dhd->hang_was_sent) {
+               DHD_ERROR(("%s: HANG was sent up earlier. Not talking to the chip\n",
+                       __FUNCTION__));
+               return -EIO;
+       }
+
+       DHD_CTL(("ACTION %d ifdix %d cmd %d len %d \n",
+               action, ifidx, cmd, len));
+
+       /* Fill up msgbuf for ioctl req */
+       ret = dhd_fillup_ioct_reqst(dhd, (uint16)len, cmd, buf, ifidx);
+
+       if (ret < 0) {
+               DHD_ERROR(("%s(): dhd_fillup_ioct_reqst failed \r\n", __FUNCTION__));
+               goto done;
+       }
+
+       ret = dhd_msgbuf_wait_ioctl_cmplt(dhd, len, buf);
+
+done:
+       return ret;
+}
+
+/** Called by upper DHD layer. Handles a protocol control response asynchronously. */
+int dhd_prot_ctl_complete(dhd_pub_t *dhd)
+{
+       return 0;
+}
+
+/** Called by upper DHD layer. Check for and handle local prot-specific iovar commands */
+int dhd_prot_iovar_op(dhd_pub_t *dhd, const char *name,
+                             void *params, int plen, void *arg, int len, bool set)
+{
+       return BCME_UNSUPPORTED;
+}
+
+#ifdef DHD_DUMP_PCIE_RINGS
+int dhd_d2h_h2d_ring_dump(dhd_pub_t *dhd, void *file, const void *user_buf,
+       unsigned long *file_posn, bool file_write)
+{
+       dhd_prot_t *prot;
+       msgbuf_ring_t *ring;
+       int ret = 0;
+       uint16 h2d_flowrings_total;
+       uint16 flowid;
+
+       if (!(dhd) || !(dhd->prot)) {
+               goto exit;
+       }
+       prot = dhd->prot;
+
+       /* Below is the same ring dump sequence followed in parser as well. */
+       ring = &prot->h2dring_ctrl_subn;
+       if ((ret = dhd_ring_write(dhd, ring, file, user_buf, file_posn)) < 0)
+               goto exit;
+
+       ring = &prot->h2dring_rxp_subn;
+       if ((ret = dhd_ring_write(dhd, ring, file, user_buf, file_posn)) < 0)
+               goto exit;
+
+       ring = &prot->d2hring_ctrl_cpln;
+       if ((ret = dhd_ring_write(dhd, ring, file, user_buf, file_posn)) < 0)
+               goto exit;
+
+       ring = &prot->d2hring_tx_cpln;
+       if ((ret = dhd_ring_write(dhd, ring, file, user_buf, file_posn)) < 0)
+               goto exit;
+
+       ring = &prot->d2hring_rx_cpln;
+       if ((ret = dhd_ring_write(dhd, ring, file, user_buf, file_posn)) < 0)
+               goto exit;
+
+       h2d_flowrings_total = dhd_get_max_flow_rings(dhd);
+       FOREACH_RING_IN_FLOWRINGS_POOL(prot, ring, flowid, h2d_flowrings_total) {
+               if ((ret = dhd_ring_write(dhd, ring, file, user_buf, file_posn)) < 0) {
+                       goto exit;
+               }
+       }
+
+#ifdef EWP_EDL
+       if (dhd->dongle_edl_support) {
+               ring = prot->d2hring_edl;
+               if ((ret = dhd_edl_ring_hdr_write(dhd, ring, file, user_buf, file_posn)) < 0)
+                       goto exit;
+       }
+       else if (dhd->bus->api.fw_rev >= PCIE_SHARED_VERSION_6 && !dhd->dongle_edl_support)
+#else
+       if (dhd->bus->api.fw_rev >= PCIE_SHARED_VERSION_6)
+#endif /* EWP_EDL */
+       {
+               ring = prot->h2dring_info_subn;
+               if ((ret = dhd_ring_write(dhd, ring, file, user_buf, file_posn)) < 0)
+                       goto exit;
+
+               ring = prot->d2hring_info_cpln;
+               if ((ret = dhd_ring_write(dhd, ring, file, user_buf, file_posn)) < 0)
+                       goto exit;
+       }
+
+exit :
+       return ret;
+}
+
+/* Write to file */
+static
+int dhd_ring_write(dhd_pub_t *dhd, msgbuf_ring_t *ring, void *file,
+       const void *user_buf, unsigned long *file_posn)
+{
+       int ret = 0;
+
+       if (ring == NULL) {
+               DHD_ERROR(("%s: Ring not initialised, failed to dump ring contents\n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+       }
+       if (file) {
+               ret = dhd_os_write_file_posn(file, file_posn, (char *)(ring->dma_buf.va),
+                               ((unsigned long)(ring->max_items) * (ring->item_len)));
+               if (ret < 0) {
+                       DHD_ERROR(("%s: write file error !\n", __FUNCTION__));
+                       ret = BCME_ERROR;
+               }
+       } else if (user_buf) {
+               ret = dhd_export_debug_data((char *)(ring->dma_buf.va), NULL, user_buf,
+                       ((unsigned long)(ring->max_items) * (ring->item_len)), (int *)file_posn);
+       }
+       return ret;
+}
+
+#ifdef EWP_EDL
+/* Write to file */
+static
+int dhd_edl_ring_hdr_write(dhd_pub_t *dhd, msgbuf_ring_t *ring, void *file, const void *user_buf,
+       unsigned long *file_posn)
+{
+       int ret = 0, nitems = 0;
+       char *buf = NULL, *ptr = NULL;
+       uint8 *msg_addr = NULL;
+       uint16  rd = 0;
+
+       if (ring == NULL) {
+               DHD_ERROR(("%s: Ring not initialised, failed to dump ring contents\n",
+                       __FUNCTION__));
+               ret = BCME_ERROR;
+               goto done;
+       }
+
+       buf = MALLOCZ(dhd->osh, (D2HRING_EDL_MAX_ITEM * D2HRING_EDL_HDR_SIZE));
+       if (buf == NULL) {
+               DHD_ERROR(("%s: buffer allocation failed\n", __FUNCTION__));
+               ret = BCME_ERROR;
+               goto done;
+       }
+       ptr = buf;
+
+       for (; nitems < D2HRING_EDL_MAX_ITEM; nitems++, rd++) {
+               msg_addr = (uint8 *)ring->dma_buf.va + (rd * ring->item_len);
+               memcpy(ptr, (char *)msg_addr, D2HRING_EDL_HDR_SIZE);
+               ptr += D2HRING_EDL_HDR_SIZE;
+       }
+       if (file) {
+               ret = dhd_os_write_file_posn(file, file_posn, buf,
+                               (D2HRING_EDL_HDR_SIZE * D2HRING_EDL_MAX_ITEM));
+               if (ret < 0) {
+                       DHD_ERROR(("%s: write file error !\n", __FUNCTION__));
+                       goto done;
+               }
+       }
+       else {
+               ret = dhd_export_debug_data(buf, NULL, user_buf,
+                       (D2HRING_EDL_HDR_SIZE * D2HRING_EDL_MAX_ITEM), file_posn);
+       }
+
+done:
+       if (buf) {
+               MFREE(dhd->osh, buf, (D2HRING_EDL_MAX_ITEM * D2HRING_EDL_HDR_SIZE));
+       }
+       return ret;
+}
+#endif /* EWP_EDL */
+#endif /* DHD_DUMP_PCIE_RINGS */
+
+/** Add prot dump output to a buffer */
+void dhd_prot_dump(dhd_pub_t *dhd, struct bcmstrbuf *b)
+{
+
+       if (dhd->d2h_sync_mode & PCIE_SHARED_D2H_SYNC_SEQNUM)
+               bcm_bprintf(b, "\nd2h_sync: SEQNUM:");
+       else if (dhd->d2h_sync_mode & PCIE_SHARED_D2H_SYNC_XORCSUM)
+               bcm_bprintf(b, "\nd2h_sync: XORCSUM:");
+       else
+               bcm_bprintf(b, "\nd2h_sync: NONE:");
+       bcm_bprintf(b, " d2h_sync_wait max<%lu> tot<%lu>\n",
+               dhd->prot->d2h_sync_wait_max, dhd->prot->d2h_sync_wait_tot);
+
+       bcm_bprintf(b, "\nDongle DMA Indices: h2d %d  d2h %d index size %d bytes\n",
+               dhd->dma_h2d_ring_upd_support,
+               dhd->dma_d2h_ring_upd_support,
+               dhd->prot->rw_index_sz);
+       bcm_bprintf(b, "h2d_max_txpost: %d, prot->h2d_max_txpost: %d\n",
+               h2d_max_txpost, dhd->prot->h2d_max_txpost);
+#if defined(DHD_HTPUT_TUNABLES)
+       bcm_bprintf(b, "h2d_htput_max_txpost: %d, prot->h2d_htput_max_txpost: %d\n",
+               h2d_htput_max_txpost, dhd->prot->h2d_htput_max_txpost);
+#endif /* DHD_HTPUT_TUNABLES */
+       bcm_bprintf(b, "pktid_txq_start_cnt: %d\n", dhd->prot->pktid_txq_start_cnt);
+       bcm_bprintf(b, "pktid_txq_stop_cnt: %d\n", dhd->prot->pktid_txq_stop_cnt);
+       bcm_bprintf(b, "pktid_depleted_cnt: %d\n", dhd->prot->pktid_depleted_cnt);
+       bcm_bprintf(b, "txcpl_db_cnt: %d\n", dhd->prot->txcpl_db_cnt);
+}
+
+/* Update local copy of dongle statistics */
+void dhd_prot_dstats(dhd_pub_t *dhd)
+{
+       return;
+}
+
+/** Called by upper DHD layer */
+int dhd_process_pkt_reorder_info(dhd_pub_t *dhd, uchar *reorder_info_buf,
+       uint reorder_info_len, void **pkt, uint32 *free_buf_count)
+{
+       return 0;
+}
+
+/** Debug related, post a dummy message to interrupt dongle. Used to process cons commands. */
+int
+dhd_post_dummy_msg(dhd_pub_t *dhd)
+{
+       unsigned long flags;
+       hostevent_hdr_t *hevent = NULL;
+       uint16 alloced = 0;
+
+       dhd_prot_t *prot = dhd->prot;
+       msgbuf_ring_t *ring = &prot->h2dring_ctrl_subn;
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK)
+               return BCME_ERROR;
+#endif /* PCIE_INB_DW */
+       DHD_RING_LOCK(ring->ring_lock, flags);
+
+       hevent = (hostevent_hdr_t *)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+
+       if (hevent == NULL) {
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+               return -1;
+       }
+
+       /* CMN msg header */
+       hevent->msg.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+       ring->seqnum++;
+       hevent->msg.msg_type = MSG_TYPE_HOST_EVNT;
+       hevent->msg.if_id = 0;
+       hevent->msg.flags = ring->current_phase;
+
+       /* Event payload */
+       hevent->evnt_pyld = htol32(HOST_EVENT_CONS_CMD);
+
+       /* Since, we are filling the data directly into the bufptr obtained
+        * from the msgbuf, we can directly call the write_complete
+        */
+       dhd_prot_ring_write_complete(dhd, ring, hevent, 1);
+
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+
+       return 0;
+}
+
+/**
+ * If exactly_nitems is true, this function will allocate space for nitems or fail
+ * If exactly_nitems is false, this function will allocate space for nitems or less
+ */
+static void *
+BCMFASTPATH(dhd_prot_alloc_ring_space)(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+       uint16 nitems, uint16 * alloced, bool exactly_nitems)
+{
+       void * ret_buf;
+
+       if (nitems == 0) {
+               DHD_ERROR(("%s: nitems is 0 - ring(%s)\n", __FUNCTION__, ring->name));
+               return NULL;
+       }
+
+       /* Alloc space for nitems in the ring */
+       ret_buf = dhd_prot_get_ring_space(ring, nitems, alloced, exactly_nitems);
+
+       if (ret_buf == NULL) {
+               /* HWA TODO, need to get RD pointer from different array
+                * which HWA will directly write into host memory
+                */
+               /* if alloc failed , invalidate cached read ptr */
+               if (dhd->dma_d2h_ring_upd_support) {
+                       ring->rd = dhd_prot_dma_indx_get(dhd, H2D_DMA_INDX_RD_UPD, ring->idx);
+               } else {
+                       dhd_bus_cmn_readshared(dhd->bus, &(ring->rd), RING_RD_UPD, ring->idx);
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+                       /* Check if ring->rd is valid */
+                       if (ring->rd >= ring->max_items) {
+                               DHD_ERROR(("%s: Invalid rd idx=%d\n", ring->name, ring->rd));
+                               dhd->bus->read_shm_fail = TRUE;
+                               return NULL;
+                       }
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+               }
+
+               /* Try allocating once more */
+               ret_buf = dhd_prot_get_ring_space(ring, nitems, alloced, exactly_nitems);
+
+               if (ret_buf == NULL) {
+                       DHD_INFO(("%s: Ring space not available  \n", ring->name));
+                       return NULL;
+               }
+       }
+
+       if (ret_buf == HOST_RING_BASE(ring)) {
+               DHD_INFO(("%s: setting the phase now\n", ring->name));
+               ring->current_phase = ring->current_phase ? 0 : BCMPCIE_CMNHDR_PHASE_BIT_INIT;
+       }
+
+       /* Return alloced space */
+       return ret_buf;
+}
+
+/**
+ * Non inline ioct request.
+ * Form a ioctl request first as per ioctptr_reqst_hdr_t header in the circular buffer
+ * Form a separate request buffer where a 4 byte cmn header is added in the front
+ * buf contents from parent function is copied to remaining section of this buffer
+ */
+static int
+dhd_fillup_ioct_reqst(dhd_pub_t *dhd, uint16 len, uint cmd, void* buf, int ifidx)
+{
+       dhd_prot_t *prot = dhd->prot;
+       ioctl_req_msg_t *ioct_rqst;
+       void * ioct_buf;        /* For ioctl payload */
+       uint16  rqstlen, resplen;
+       unsigned long flags;
+       uint16 alloced = 0;
+       msgbuf_ring_t *ring = &prot->h2dring_ctrl_subn;
+
+       if (dhd_query_bus_erros(dhd)) {
+               return -EIO;
+       }
+
+       rqstlen = len;
+       resplen = len;
+
+       /* Limit ioct request to MSGBUF_MAX_MSG_SIZE bytes including hdrs */
+       /* 8K allocation of dongle buffer fails */
+       /* dhd doesnt give separate input & output buf lens */
+       /* so making the assumption that input length can never be more than 2k */
+       rqstlen = MIN(rqstlen, MSGBUF_IOCTL_MAX_RQSTLEN);
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK)
+               return BCME_ERROR;
+#endif /* PCIE_INB_DW */
+
+       DHD_RING_LOCK(ring->ring_lock, flags);
+
+       if (prot->ioctl_state) {
+               DHD_ERROR(("%s: pending ioctl %02x\n", __FUNCTION__, prot->ioctl_state));
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+               return BCME_BUSY;
+       } else {
+               prot->ioctl_state = MSGBUF_IOCTL_ACK_PENDING | MSGBUF_IOCTL_RESP_PENDING;
+       }
+
+       /* Request for cbuf space */
+       ioct_rqst = (ioctl_req_msg_t*)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+       if (ioct_rqst == NULL) {
+               DHD_ERROR(("couldn't allocate space on msgring to send ioctl request\n"));
+               prot->ioctl_state = 0;
+               prot->curr_ioctl_cmd = 0;
+               prot->ioctl_received = IOCTL_WAIT;
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+               return -1;
+       }
+
+       /* Common msg buf hdr */
+       ioct_rqst->cmn_hdr.msg_type = MSG_TYPE_IOCTLPTR_REQ;
+       ioct_rqst->cmn_hdr.if_id = (uint8)ifidx;
+       ioct_rqst->cmn_hdr.flags = ring->current_phase;
+       ioct_rqst->cmn_hdr.request_id = htol32(DHD_IOCTL_REQ_PKTID);
+       ioct_rqst->cmn_hdr.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+       ring->seqnum++;
+
+       ioct_rqst->cmd = htol32(cmd);
+       prot->curr_ioctl_cmd = cmd;
+       ioct_rqst->output_buf_len = htol16(resplen);
+       prot->ioctl_trans_id++;
+       ioct_rqst->trans_id = prot->ioctl_trans_id;
+
+       /* populate ioctl buffer info */
+       ioct_rqst->input_buf_len = htol16(rqstlen);
+       ioct_rqst->host_input_buf_addr.high = htol32(PHYSADDRHI(prot->ioctbuf.pa));
+       ioct_rqst->host_input_buf_addr.low = htol32(PHYSADDRLO(prot->ioctbuf.pa));
+       /* copy ioct payload */
+       ioct_buf = (void *) prot->ioctbuf.va;
+
+       prot->ioctl_fillup_time = OSL_LOCALTIME_NS();
+
+       if (buf)
+               memcpy(ioct_buf, buf, len);
+
+       OSL_CACHE_FLUSH((void *) prot->ioctbuf.va, len);
+
+       if (!ISALIGNED(ioct_buf, DMA_ALIGN_LEN))
+               DHD_ERROR(("host ioct address unaligned !!!!! \n"));
+
+       DHD_CTL(("submitted IOCTL request request_id %d, cmd %d, output_buf_len %d, tx_id %d\n",
+               ioct_rqst->cmn_hdr.request_id, cmd, ioct_rqst->output_buf_len,
+               ioct_rqst->trans_id));
+
+       /* update ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ring, ioct_rqst, 1);
+
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+
+       return 0;
+} /* dhd_fillup_ioct_reqst */
+
+/**
+ * dhd_prot_ring_attach - Initialize the msgbuf_ring object and attach a
+ * DMA-able buffer to it. The ring is NOT tagged as inited until all the ring
+ * information is posted to the dongle.
+ *
+ * Invoked in dhd_prot_attach for the common rings, and in dhd_prot_init for
+ * each flowring in pool of flowrings.
+ *
+ * returns BCME_OK=0 on success
+ * returns non-zero negative error value on failure.
+ */
+static int
+dhd_prot_ring_attach(dhd_pub_t *dhd, msgbuf_ring_t *ring, const char *name,
+       uint16 max_items, uint16 item_len, uint16 ringid)
+{
+       int dma_buf_alloced = BCME_NOMEM;
+       uint32 dma_buf_len;
+       dhd_prot_t *prot = dhd->prot;
+       uint16 max_flowrings = dhd->bus->max_tx_flowrings;
+       dhd_dma_buf_t *dma_buf = NULL;
+
+       ASSERT(ring);
+       ASSERT(name);
+       ASSERT((max_items < 0xFFFF) && (item_len < 0xFFFF) && (ringid < 0xFFFF));
+
+       /* Init name */
+       strlcpy((char *)ring->name, name, sizeof(ring->name));
+
+       ring->idx = ringid;
+
+#if defined(DHD_HTPUT_TUNABLES)
+       /* Use HTPUT max items */
+       if (DHD_IS_FLOWRING(ringid, max_flowrings) &&
+               DHD_IS_FLOWID_HTPUT(dhd, DHD_RINGID_TO_FLOWID(ringid))) {
+               max_items = prot->h2d_htput_max_txpost;
+       }
+#endif /* DHD_HTPUT_TUNABLES */
+
+       dma_buf_len = max_items * item_len;
+
+       ring->max_items = max_items;
+       ring->item_len = item_len;
+
+       /* A contiguous space may be reserved for all flowrings */
+       if (DHD_IS_FLOWRING(ringid, max_flowrings) && (prot->flowrings_dma_buf.va)) {
+               /* Carve out from the contiguous DMA-able flowring buffer */
+               uint16 flowid;
+               uint32 base_offset;
+               dhd_dma_buf_t *rsv_buf = &prot->flowrings_dma_buf;
+
+               dma_buf = &ring->dma_buf;
+
+               flowid = DHD_RINGID_TO_FLOWID(ringid);
+               base_offset = (flowid - BCMPCIE_H2D_COMMON_MSGRINGS) * dma_buf_len;
+
+               ASSERT(base_offset + dma_buf_len <= rsv_buf->len);
+
+               dma_buf->len = dma_buf_len;
+               dma_buf->va = (void *)((uintptr)rsv_buf->va + base_offset);
+               PHYSADDRHISET(dma_buf->pa, PHYSADDRHI(rsv_buf->pa));
+               PHYSADDRLOSET(dma_buf->pa, PHYSADDRLO(rsv_buf->pa) + base_offset);
+
+               /* On 64bit, contiguous space may not span across 0x00000000FFFFFFFF */
+               ASSERT(PHYSADDRLO(dma_buf->pa) >= PHYSADDRLO(rsv_buf->pa));
+
+               dma_buf->dmah   = rsv_buf->dmah;
+               dma_buf->secdma = rsv_buf->secdma;
+
+               (void)dhd_dma_buf_audit(dhd, &ring->dma_buf);
+       } else {
+#ifdef EWP_EDL
+               if (ring == dhd->prot->d2hring_edl) {
+                       /* For EDL ring, memory is alloced during attach,
+                       * so just need to copy the dma_buf to the ring's dma_buf
+                       */
+                       memcpy(&ring->dma_buf, &dhd->edl_ring_mem, sizeof(ring->dma_buf));
+                       dma_buf = &ring->dma_buf;
+                       if (dma_buf->va == NULL) {
+                               return BCME_NOMEM;
+                       }
+               } else
+#endif /* EWP_EDL */
+               {
+                       /* Allocate a dhd_dma_buf */
+                       dma_buf_alloced = dhd_dma_buf_alloc(dhd, &ring->dma_buf, dma_buf_len);
+                       if (dma_buf_alloced != BCME_OK) {
+                               return BCME_NOMEM;
+                       }
+               }
+       }
+
+       /* CAUTION: Save ring::base_addr in little endian format! */
+       dhd_base_addr_htolpa(&ring->base_addr, ring->dma_buf.pa);
+
+       ring->ring_lock = osl_spin_lock_init(dhd->osh);
+
+       DHD_INFO(("RING_ATTACH : %s Max item %d len item %d total size %d "
+               "ring start %p buf phys addr  %x:%x \n",
+               ring->name, ring->max_items, ring->item_len,
+               dma_buf_len, ring->dma_buf.va, ltoh32(ring->base_addr.high_addr),
+               ltoh32(ring->base_addr.low_addr)));
+
+       return BCME_OK;
+} /* dhd_prot_ring_attach */
+
+/**
+ * dhd_prot_ring_init - Post the common ring information to dongle.
+ *
+ * Used only for common rings.
+ *
+ * The flowrings information is passed via the create flowring control message
+ * (tx_flowring_create_request_t) sent over the H2D control submission common
+ * ring.
+ */
+static void
+dhd_prot_ring_init(dhd_pub_t *dhd, msgbuf_ring_t *ring)
+{
+       ring->wr = 0;
+       ring->rd = 0;
+       ring->curr_rd = 0;
+
+       /* CAUTION: ring::base_addr already in Little Endian */
+       dhd_bus_cmn_writeshared(dhd->bus, &ring->base_addr,
+               sizeof(sh_addr_t), RING_BUF_ADDR, ring->idx);
+       dhd_bus_cmn_writeshared(dhd->bus, &ring->max_items,
+               sizeof(uint16), RING_MAX_ITEMS, ring->idx);
+       dhd_bus_cmn_writeshared(dhd->bus, &ring->item_len,
+               sizeof(uint16), RING_ITEM_LEN, ring->idx);
+
+       dhd_bus_cmn_writeshared(dhd->bus, &(ring->wr),
+               sizeof(uint16), RING_WR_UPD, ring->idx);
+       dhd_bus_cmn_writeshared(dhd->bus, &(ring->rd),
+               sizeof(uint16), RING_RD_UPD, ring->idx);
+
+       /* ring inited */
+       ring->inited = TRUE;
+
+} /* dhd_prot_ring_init */
+
+/**
+ * dhd_prot_ring_reset - bzero a ring's DMA-ble buffer and cache flush
+ * Reset WR and RD indices to 0.
+ */
+static void
+dhd_prot_ring_reset(dhd_pub_t *dhd, msgbuf_ring_t *ring)
+{
+       DHD_TRACE(("%s\n", __FUNCTION__));
+
+       dhd_dma_buf_reset(dhd, &ring->dma_buf);
+
+       ring->rd = ring->wr = 0;
+       ring->curr_rd = 0;
+       ring->inited = FALSE;
+       ring->create_pending = FALSE;
+}
+
+/**
+ * dhd_prot_ring_detach - Detach the DMA-able buffer and any other objects
+ * hanging off the msgbuf_ring.
+ */
+static void
+dhd_prot_ring_detach(dhd_pub_t *dhd, msgbuf_ring_t *ring)
+{
+       dhd_prot_t *prot = dhd->prot;
+       uint16 max_flowrings = dhd->bus->max_tx_flowrings;
+       ASSERT(ring);
+
+       ring->inited = FALSE;
+       /* rd = ~0, wr = ring->rd - 1, max_items = 0, len_item = ~0 */
+
+       /* If the DMA-able buffer was carved out of a pre-reserved contiguous
+        * memory, then simply stop using it.
+        */
+       if (DHD_IS_FLOWRING(ring->idx, max_flowrings) && (prot->flowrings_dma_buf.va)) {
+               (void)dhd_dma_buf_audit(dhd, &ring->dma_buf);
+               memset(&ring->dma_buf, 0, sizeof(dhd_dma_buf_t));
+       } else {
+#ifdef EWP_EDL
+               if (ring == dhd->prot->d2hring_edl) {
+                       /* For EDL ring, do not free ring mem here,
+                       * it is done in dhd_detach
+                       */
+                       memset(&ring->dma_buf, 0, sizeof(ring->dma_buf));
+               } else
+#endif /* EWP_EDL */
+               {
+                       dhd_dma_buf_free(dhd, &ring->dma_buf);
+               }
+       }
+
+       osl_spin_lock_deinit(dhd->osh, ring->ring_lock);
+
+} /* dhd_prot_ring_detach */
+
+/* Fetch number of H2D flowrings given the total number of h2d rings */
+uint16
+dhd_get_max_flow_rings(dhd_pub_t *dhd)
+{
+       if (dhd->bus->api.fw_rev >= PCIE_SHARED_VERSION_6)
+               return dhd->bus->max_tx_flowrings;
+       else
+               return (dhd->bus->max_tx_flowrings - BCMPCIE_H2D_COMMON_MSGRINGS);
+}
+
+/**
+ * dhd_prot_flowrings_pool_attach - Initialize a pool of flowring msgbuf_ring_t.
+ *
+ * Allocate a pool of msgbuf_ring along with DMA-able buffers for flowrings.
+ * Dongle includes common rings when it advertizes the number of H2D rings.
+ * Allocates a pool of msgbuf_ring_t and invokes dhd_prot_ring_attach to
+ * allocate the DMA-able buffer and initialize each msgbuf_ring_t object.
+ *
+ * dhd_prot_ring_attach is invoked to perform the actual initialization and
+ * attaching the DMA-able buffer.
+ *
+ * Later dhd_prot_flowrings_pool_fetch() may be used to fetch a preallocated and
+ * initialized msgbuf_ring_t object.
+ *
+ * returns BCME_OK=0 on success
+ * returns non-zero negative error value on failure.
+ */
+static int
+dhd_prot_flowrings_pool_attach(dhd_pub_t *dhd)
+{
+       uint16 flowid;
+       msgbuf_ring_t *ring;
+       uint16 h2d_flowrings_total; /* exclude H2D common rings */
+       dhd_prot_t *prot = dhd->prot;
+       char ring_name[RING_NAME_MAX_LENGTH];
+
+       if (prot->h2d_flowrings_pool != NULL)
+               return BCME_OK; /* dhd_prot_init rentry after a dhd_prot_reset */
+
+       ASSERT(prot->h2d_rings_total == 0);
+
+       /* h2d_rings_total includes H2D common rings: ctrl and rxbuf subn */
+       prot->h2d_rings_total = (uint16)dhd_bus_max_h2d_queues(dhd->bus);
+
+       if (prot->h2d_rings_total < BCMPCIE_H2D_COMMON_MSGRINGS) {
+               DHD_ERROR(("%s: h2d_rings_total advertized as %u\n",
+                       __FUNCTION__, prot->h2d_rings_total));
+               return BCME_ERROR;
+       }
+
+       /* Subtract number of H2D common rings, to determine number of flowrings */
+       h2d_flowrings_total = dhd_get_max_flow_rings(dhd);
+
+       DHD_ERROR(("Attach flowrings pool for %d rings\n", h2d_flowrings_total));
+
+       /* Allocate pool of msgbuf_ring_t objects for all flowrings */
+       prot->h2d_flowrings_pool = (msgbuf_ring_t *)MALLOCZ(prot->osh,
+               (h2d_flowrings_total * sizeof(msgbuf_ring_t)));
+
+       if (prot->h2d_flowrings_pool == NULL) {
+               DHD_ERROR(("%s: flowrings pool for %d flowrings, alloc failure\n",
+                       __FUNCTION__, h2d_flowrings_total));
+               goto fail;
+       }
+
+       /* Setup & Attach a DMA-able buffer to each flowring in the flowring pool */
+       FOREACH_RING_IN_FLOWRINGS_POOL(prot, ring, flowid, h2d_flowrings_total) {
+               snprintf(ring_name, sizeof(ring_name), "h2dflr_%03u", flowid);
+               /* For HTPUT case max_items will be changed inside dhd_prot_ring_attach */
+               if (dhd_prot_ring_attach(dhd, ring, ring_name,
+                       prot->h2d_max_txpost, H2DRING_TXPOST_ITEMSIZE,
+                       DHD_FLOWID_TO_RINGID(flowid)) != BCME_OK) {
+                       goto attach_fail;
+               }
+       }
+
+       return BCME_OK;
+
+attach_fail:
+       /* XXX: On a per project basis, one may decide whether to continue with
+        * "fewer" flowrings, and what value of fewer suffices.
+        */
+       dhd_prot_flowrings_pool_detach(dhd); /* Free entire pool of flowrings */
+
+fail:
+       prot->h2d_rings_total = 0;
+       return BCME_NOMEM;
+
+} /* dhd_prot_flowrings_pool_attach */
+
+/**
+ * dhd_prot_flowrings_pool_reset - Reset all msgbuf_ring_t objects in the pool.
+ * Invokes dhd_prot_ring_reset to perform the actual reset.
+ *
+ * The DMA-able buffer is not freed during reset and neither is the flowring
+ * pool freed.
+ *
+ * dhd_prot_flowrings_pool_reset will be invoked in dhd_prot_reset. Following
+ * the dhd_prot_reset, dhd_prot_init will be re-invoked, and the flowring pool
+ * from a previous flowring pool instantiation will be reused.
+ *
+ * This will avoid a fragmented DMA-able memory condition, if multiple
+ * dhd_prot_reset were invoked to reboot the dongle without a full detach/attach
+ * cycle.
+ */
+static void
+dhd_prot_flowrings_pool_reset(dhd_pub_t *dhd)
+{
+       uint16 flowid, h2d_flowrings_total;
+       msgbuf_ring_t *ring;
+       dhd_prot_t *prot = dhd->prot;
+
+       if (prot->h2d_flowrings_pool == NULL) {
+               ASSERT(prot->h2d_rings_total == 0);
+               return;
+       }
+       h2d_flowrings_total = dhd_get_max_flow_rings(dhd);
+       /* Reset each flowring in the flowring pool */
+       FOREACH_RING_IN_FLOWRINGS_POOL(prot, ring, flowid, h2d_flowrings_total) {
+               dhd_prot_ring_reset(dhd, ring);
+               ring->inited = FALSE;
+       }
+
+       /* Flowring pool state must be as-if dhd_prot_flowrings_pool_attach */
+}
+
+/**
+ * dhd_prot_flowrings_pool_detach - Free pool of msgbuf_ring along with
+ * DMA-able buffers for flowrings.
+ * dhd_prot_ring_detach is invoked to free the DMA-able buffer and perform any
+ * de-initialization of each msgbuf_ring_t.
+ */
+static void
+dhd_prot_flowrings_pool_detach(dhd_pub_t *dhd)
+{
+       int flowid;
+       msgbuf_ring_t *ring;
+       uint16 h2d_flowrings_total; /* exclude H2D common rings */
+       dhd_prot_t *prot = dhd->prot;
+
+       if (prot->h2d_flowrings_pool == NULL) {
+               ASSERT(prot->h2d_rings_total == 0);
+               return;
+       }
+
+       h2d_flowrings_total = dhd_get_max_flow_rings(dhd);
+       /* Detach the DMA-able buffer for each flowring in the flowring pool */
+       FOREACH_RING_IN_FLOWRINGS_POOL(prot, ring, flowid, h2d_flowrings_total) {
+               dhd_prot_ring_detach(dhd, ring);
+       }
+
+       MFREE(prot->osh, prot->h2d_flowrings_pool,
+               (h2d_flowrings_total * sizeof(msgbuf_ring_t)));
+
+       prot->h2d_rings_total = 0;
+
+} /* dhd_prot_flowrings_pool_detach */
+
+/**
+ * dhd_prot_flowrings_pool_fetch - Fetch a preallocated and initialized
+ * msgbuf_ring from the flowring pool, and assign it.
+ *
+ * Unlike common rings, which uses a dhd_prot_ring_init() to pass the common
+ * ring information to the dongle, a flowring's information is passed via a
+ * flowring create control message.
+ *
+ * Only the ring state (WR, RD) index are initialized.
+ */
+static msgbuf_ring_t *
+dhd_prot_flowrings_pool_fetch(dhd_pub_t *dhd, uint16 flowid)
+{
+       msgbuf_ring_t *ring;
+       dhd_prot_t *prot = dhd->prot;
+
+       ASSERT(flowid >= DHD_FLOWRING_START_FLOWID);
+       ASSERT(flowid < prot->h2d_rings_total);
+       ASSERT(prot->h2d_flowrings_pool != NULL);
+
+       ring = DHD_RING_IN_FLOWRINGS_POOL(prot, flowid);
+
+       /* ASSERT flow_ring->inited == FALSE */
+
+       ring->wr = 0;
+       ring->rd = 0;
+       ring->curr_rd = 0;
+       ring->inited = TRUE;
+       /**
+        * Every time a flowring starts dynamically, initialize current_phase with 0
+        * then flip to BCMPCIE_CMNHDR_PHASE_BIT_INIT
+        */
+       ring->current_phase = 0;
+       return ring;
+}
+
+/**
+ * dhd_prot_flowrings_pool_release - release a previously fetched flowring's
+ * msgbuf_ring back to the flow_ring pool.
+ */
+void
+dhd_prot_flowrings_pool_release(dhd_pub_t *dhd, uint16 flowid, void *flow_ring)
+{
+       msgbuf_ring_t *ring;
+       dhd_prot_t *prot = dhd->prot;
+
+       ASSERT(flowid >= DHD_FLOWRING_START_FLOWID);
+       ASSERT(flowid < prot->h2d_rings_total);
+       ASSERT(prot->h2d_flowrings_pool != NULL);
+
+       ring = DHD_RING_IN_FLOWRINGS_POOL(prot, flowid);
+
+       ASSERT(ring == (msgbuf_ring_t*)flow_ring);
+       /* ASSERT flow_ring->inited == TRUE */
+
+       (void)dhd_dma_buf_audit(dhd, &ring->dma_buf);
+
+       ring->wr = 0;
+       ring->rd = 0;
+       ring->inited = FALSE;
+
+       ring->curr_rd = 0;
+}
+
+/* Assumes only one index is updated at a time */
+/* FIXME Need to fix it */
+/* If exactly_nitems is true, this function will allocate space for nitems or fail */
+/*    Exception: when wrap around is encountered, to prevent hangup (last nitems of ring buffer) */
+/* If exactly_nitems is false, this function will allocate space for nitems or less */
+static void *
+BCMFASTPATH(dhd_prot_get_ring_space)(msgbuf_ring_t *ring, uint16 nitems, uint16 * alloced,
+       bool exactly_nitems)
+{
+       void *ret_ptr = NULL;
+       uint16 ring_avail_cnt;
+
+       ASSERT(nitems <= ring->max_items);
+
+       ring_avail_cnt = CHECK_WRITE_SPACE(ring->rd, ring->wr, ring->max_items);
+
+       if ((ring_avail_cnt == 0) ||
+              (exactly_nitems && (ring_avail_cnt < nitems) &&
+              ((ring->max_items - ring->wr) >= nitems))) {
+               DHD_INFO(("Space not available: ring %s items %d write %d read %d\n",
+                       ring->name, nitems, ring->wr, ring->rd));
+               return NULL;
+       }
+       *alloced = MIN(nitems, ring_avail_cnt);
+
+       /* Return next available space */
+       ret_ptr = (char *)DHD_RING_BGN_VA(ring) + (ring->wr * ring->item_len);
+
+       /* Update write index */
+       if ((ring->wr + *alloced) == ring->max_items)
+               ring->wr = 0;
+       else if ((ring->wr + *alloced) < ring->max_items)
+               ring->wr += *alloced;
+       else {
+               /* Should never hit this */
+               ASSERT(0);
+               return NULL;
+       }
+
+       return ret_ptr;
+} /* dhd_prot_get_ring_space */
+
+/**
+ * dhd_prot_ring_write_complete - Host updates the new WR index on producing
+ * new messages in a H2D ring. The messages are flushed from cache prior to
+ * posting the new WR index. The new WR index will be updated in the DMA index
+ * array or directly in the dongle's ring state memory.
+ * A PCIE doorbell will be generated to wake up the dongle.
+ * This is a non-atomic function, make sure the callers
+ * always hold appropriate locks.
+ */
+static void
+BCMFASTPATH(__dhd_prot_ring_write_complete)(dhd_pub_t *dhd, msgbuf_ring_t * ring, void* p,
+       uint16 nitems)
+{
+       dhd_prot_t *prot = dhd->prot;
+       uint32 db_index;
+       uint16 max_flowrings = dhd->bus->max_tx_flowrings;
+       uint corerev;
+
+       /* cache flush */
+       OSL_CACHE_FLUSH(p, ring->item_len * nitems);
+
+       /* For HWA, update db_index and ring mb2 DB and return */
+       if (HWA_ACTIVE(dhd) && RING_HWA_DB_IDX(dhd, ring->idx)) {
+               db_index = HWA_RING_INDEX_SHIFT(ring->wr) | RING_HWA_DB_IDX(dhd, ring->idx);
+               DHD_TRACE(("%s: ring(%s) wr(0x%x) ring_hwa_db_idx(0x%x) db_index(0x%x)\n",
+                       __FUNCTION__, ring->name, ring->wr,
+                       RING_HWA_DB_IDX(dhd, ring->idx), db_index));
+               prot->mb_2_ring_fn(dhd->bus, db_index, TRUE);
+               return;
+       }
+
+       if (IDMA_ACTIVE(dhd) || dhd->dma_h2d_ring_upd_support) {
+                       dhd_prot_dma_indx_set(dhd, ring->wr,
+                                             H2D_DMA_INDX_WR_UPD, ring->idx);
+       } else if (IFRM_ACTIVE(dhd) && DHD_IS_FLOWRING(ring->idx, max_flowrings)) {
+                       dhd_prot_dma_indx_set(dhd, ring->wr,
+                       H2D_IFRM_INDX_WR_UPD, ring->idx);
+       } else {
+                       dhd_bus_cmn_writeshared(dhd->bus, &(ring->wr),
+                               sizeof(uint16), RING_WR_UPD, ring->idx);
+       }
+
+       /* raise h2d interrupt */
+       if (IDMA_ACTIVE(dhd) ||
+               (IFRM_ACTIVE(dhd) && DHD_IS_FLOWRING(ring->idx, max_flowrings))) {
+               db_index = IDMA_IDX0;
+               /* this api is called in wl down path..in that case sih is freed already */
+               if (dhd->bus->sih) {
+                       corerev = dhd->bus->sih->buscorerev;
+                       /* We need to explictly configure the type of DMA for core rev >= 24 */
+                       if (corerev >= 24) {
+                               db_index |= (DMA_TYPE_IDMA << DMA_TYPE_SHIFT);
+                       }
+               }
+               prot->mb_2_ring_fn(dhd->bus, db_index, TRUE);
+       } else {
+               prot->mb_ring_fn(dhd->bus, ring->wr);
+       }
+}
+
+static void
+BCMFASTPATH(dhd_prot_ring_write_complete)(dhd_pub_t *dhd, msgbuf_ring_t * ring, void* p,
+       uint16 nitems)
+{
+       unsigned long flags_bus;
+       DHD_BUS_LP_STATE_LOCK(dhd->bus->bus_lp_state_lock, flags_bus);
+       __dhd_prot_ring_write_complete(dhd, ring, p, nitems);
+       DHD_BUS_LP_STATE_UNLOCK(dhd->bus->bus_lp_state_lock, flags_bus);
+}
+
+/**
+ * dhd_prot_ring_write_complete_mbdata - will be called from dhd_prot_h2d_mbdata_send_ctrlmsg,
+ * which will hold DHD_BUS_LP_STATE_LOCK to update WR pointer, Ring DB and also update
+ * bus_low_power_state to indicate D3_INFORM sent in the same BUS_LP_STATE_LOCK.
+ */
+static void
+BCMFASTPATH(dhd_prot_ring_write_complete_mbdata)(dhd_pub_t *dhd, msgbuf_ring_t * ring, void *p,
+       uint16 nitems, uint32 mb_data)
+{
+       unsigned long flags_bus;
+
+       DHD_BUS_LP_STATE_LOCK(dhd->bus->bus_lp_state_lock, flags_bus);
+
+       __dhd_prot_ring_write_complete(dhd, ring, p, nitems);
+
+       /* Mark D3_INFORM in the same context to skip ringing H2D DB after D3_INFORM */
+       if (mb_data == H2D_HOST_D3_INFORM) {
+               __DHD_SET_BUS_LPS_D3_INFORMED(dhd->bus);
+       }
+
+       DHD_BUS_LP_STATE_UNLOCK(dhd->bus->bus_lp_state_lock, flags_bus);
+}
+
+/**
+ * dhd_prot_upd_read_idx - Host updates the new RD index on consuming messages
+ * from a D2H ring. The new RD index will be updated in the DMA Index array or
+ * directly in dongle's ring state memory.
+ */
+static void
+dhd_prot_upd_read_idx(dhd_pub_t *dhd, msgbuf_ring_t * ring)
+{
+       dhd_prot_t *prot = dhd->prot;
+       uint32 db_index;
+       uint corerev;
+
+       /* For HWA, update db_index and ring mb2 DB and return */
+       if (HWA_ACTIVE(dhd) && RING_HWA_DB_IDX(dhd, ring->idx)) {
+               db_index = HWA_RING_INDEX_SHIFT(ring->rd) | RING_HWA_DB_IDX(dhd, ring->idx);
+               DHD_TRACE(("%s: ring(%s) rd(0x%x) ring_hwa_db_idx(0x%x) db_index(0x%x)\n",
+                       __FUNCTION__, ring->name, ring->rd,
+                       RING_HWA_DB_IDX(dhd, ring->idx), db_index));
+               prot->mb_2_ring_fn(dhd->bus, db_index, FALSE);
+               return;
+       }
+
+       /* update read index */
+       /* If dma'ing h2d indices supported
+        * update the r -indices in the
+        * host memory o/w in TCM
+        */
+       if (IDMA_ACTIVE(dhd)) {
+               dhd_prot_dma_indx_set(dhd, ring->rd,
+                       D2H_DMA_INDX_RD_UPD, ring->idx);
+               db_index = IDMA_IDX1;
+               if (dhd->bus->sih) {
+                       corerev = dhd->bus->sih->buscorerev;
+                       /* We need to explictly configure the type of DMA for core rev >= 24 */
+                       if (corerev >= 24) {
+                               db_index |= (DMA_TYPE_IDMA << DMA_TYPE_SHIFT);
+                       }
+               }
+               prot->mb_2_ring_fn(dhd->bus, db_index, FALSE);
+       } else if (dhd->dma_h2d_ring_upd_support) {
+               dhd_prot_dma_indx_set(dhd, ring->rd,
+                                     D2H_DMA_INDX_RD_UPD, ring->idx);
+       } else {
+               dhd_bus_cmn_writeshared(dhd->bus, &(ring->rd),
+                       sizeof(uint16), RING_RD_UPD, ring->idx);
+       }
+}
+
+static int
+dhd_send_d2h_ringcreate(dhd_pub_t *dhd, msgbuf_ring_t *ring_to_create,
+       uint16 ring_type, uint32 req_id)
+{
+       unsigned long flags;
+       d2h_ring_create_req_t  *d2h_ring;
+       uint16 alloced = 0;
+       int ret = BCME_OK;
+       uint16 max_h2d_rings = dhd->bus->max_submission_rings;
+       msgbuf_ring_t *ctrl_ring = &dhd->prot->h2dring_ctrl_subn;
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK)
+               return BCME_ERROR;
+#endif /* PCIE_INB_DW */
+       DHD_RING_LOCK(ctrl_ring->ring_lock, flags);
+
+       DHD_TRACE(("%s trying to send D2H ring create Req\n", __FUNCTION__));
+
+       if (ring_to_create == NULL) {
+               DHD_ERROR(("%s: FATAL: ring_to_create is NULL\n", __FUNCTION__));
+               ret = BCME_ERROR;
+               goto err;
+       }
+
+       /* Request for ring buffer space */
+       d2h_ring = (d2h_ring_create_req_t *) dhd_prot_alloc_ring_space(dhd,
+               ctrl_ring, DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D,
+               &alloced, FALSE);
+
+       if (d2h_ring == NULL) {
+               DHD_ERROR(("%s: FATAL: No space in control ring to send D2H ring create\n",
+                       __FUNCTION__));
+               ret = BCME_NOMEM;
+               goto err;
+       }
+       ring_to_create->create_req_id = (uint16)req_id;
+       ring_to_create->create_pending = TRUE;
+
+       /* Common msg buf hdr */
+       d2h_ring->msg.msg_type = MSG_TYPE_D2H_RING_CREATE;
+       d2h_ring->msg.if_id = 0;
+       d2h_ring->msg.flags = ctrl_ring->current_phase;
+       d2h_ring->msg.request_id = htol32(ring_to_create->create_req_id);
+       d2h_ring->ring_id = htol16(DHD_D2H_RING_OFFSET(ring_to_create->idx, max_h2d_rings));
+       DHD_ERROR(("%s ringid: %d idx: %d max_h2d: %d\n", __FUNCTION__, d2h_ring->ring_id,
+                       ring_to_create->idx, max_h2d_rings));
+
+       d2h_ring->ring_type = ring_type;
+       d2h_ring->max_items = htol16(ring_to_create->max_items);
+       d2h_ring->len_item = htol16(ring_to_create->item_len);
+       d2h_ring->ring_ptr.low_addr = ring_to_create->base_addr.low_addr;
+       d2h_ring->ring_ptr.high_addr = ring_to_create->base_addr.high_addr;
+
+       d2h_ring->flags = 0;
+       d2h_ring->msg.epoch =
+               ctrl_ring->seqnum % H2D_EPOCH_MODULO;
+       ctrl_ring->seqnum++;
+
+#ifdef EWP_EDL
+       if (ring_type == BCMPCIE_D2H_RING_TYPE_EDL) {
+               DHD_ERROR(("%s: sending d2h EDL ring create: "
+                       "\n max items=%u; len_item=%u; ring_id=%u; low_addr=0x%x; high_addr=0x%x\n",
+                       __FUNCTION__, ltoh16(d2h_ring->max_items),
+                       ltoh16(d2h_ring->len_item),
+                       ltoh16(d2h_ring->ring_id),
+                       d2h_ring->ring_ptr.low_addr,
+                       d2h_ring->ring_ptr.high_addr));
+       }
+#endif /* EWP_EDL */
+
+       /* Update the flow_ring's WRITE index */
+       dhd_prot_ring_write_complete(dhd, ctrl_ring, d2h_ring,
+               DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D);
+
+       DHD_RING_UNLOCK(ctrl_ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+
+       return ret;
+err:
+       DHD_RING_UNLOCK(ctrl_ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+       return ret;
+}
+
+static int
+dhd_send_h2d_ringcreate(dhd_pub_t *dhd, msgbuf_ring_t *ring_to_create, uint8 ring_type, uint32 id)
+{
+       unsigned long flags;
+       h2d_ring_create_req_t  *h2d_ring;
+       uint16 alloced = 0;
+       uint8 i = 0;
+       int ret = BCME_OK;
+       msgbuf_ring_t *ctrl_ring = &dhd->prot->h2dring_ctrl_subn;
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK)
+               return BCME_ERROR;
+#endif /* PCIE_INB_DW */
+       DHD_RING_LOCK(ctrl_ring->ring_lock, flags);
+
+       DHD_TRACE(("%s trying to send H2D ring create Req\n", __FUNCTION__));
+
+       if (ring_to_create == NULL) {
+               DHD_ERROR(("%s: FATAL: ring_to_create is NULL\n", __FUNCTION__));
+               ret = BCME_ERROR;
+               goto err;
+       }
+
+       /* Request for ring buffer space */
+       h2d_ring = (h2d_ring_create_req_t *)dhd_prot_alloc_ring_space(dhd,
+               ctrl_ring, DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D,
+               &alloced, FALSE);
+
+       if (h2d_ring == NULL) {
+               DHD_ERROR(("%s: FATAL: No space in control ring to send H2D ring create\n",
+                       __FUNCTION__));
+               ret = BCME_NOMEM;
+               goto err;
+       }
+       ring_to_create->create_req_id = (uint16)id;
+       ring_to_create->create_pending = TRUE;
+
+       /* Common msg buf hdr */
+       h2d_ring->msg.msg_type = MSG_TYPE_H2D_RING_CREATE;
+       h2d_ring->msg.if_id = 0;
+       h2d_ring->msg.request_id = htol32(ring_to_create->create_req_id);
+       h2d_ring->msg.flags = ctrl_ring->current_phase;
+       h2d_ring->ring_id = htol16(DHD_H2D_RING_OFFSET(ring_to_create->idx));
+       h2d_ring->ring_type = ring_type;
+       h2d_ring->max_items = htol16(H2DRING_DYNAMIC_INFO_MAX_ITEM);
+       h2d_ring->n_completion_ids = ring_to_create->n_completion_ids;
+       h2d_ring->len_item = htol16(H2DRING_INFO_BUFPOST_ITEMSIZE);
+       h2d_ring->ring_ptr.low_addr = ring_to_create->base_addr.low_addr;
+       h2d_ring->ring_ptr.high_addr = ring_to_create->base_addr.high_addr;
+
+       for (i = 0; i < ring_to_create->n_completion_ids; i++) {
+               h2d_ring->completion_ring_ids[i] = htol16(ring_to_create->compeltion_ring_ids[i]);
+       }
+
+       h2d_ring->flags = 0;
+       h2d_ring->msg.epoch =
+               ctrl_ring->seqnum % H2D_EPOCH_MODULO;
+       ctrl_ring->seqnum++;
+
+       /* Update the flow_ring's WRITE index */
+       dhd_prot_ring_write_complete(dhd, ctrl_ring, h2d_ring,
+               DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D);
+
+       DHD_RING_UNLOCK(ctrl_ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+       return ret;
+err:
+       DHD_RING_UNLOCK(ctrl_ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+       return ret;
+}
+
+/**
+ * dhd_prot_dma_indx_set - set a new WR or RD index in the DMA index array.
+ * Dongle will DMA the entire array (if DMA_INDX feature is enabled).
+ * See dhd_prot_dma_indx_init()
+ */
+void
+dhd_prot_dma_indx_set(dhd_pub_t *dhd, uint16 new_index, uint8 type, uint16 ringid)
+{
+       uint8 *ptr;
+       uint16 offset;
+       dhd_prot_t *prot = dhd->prot;
+       uint16 max_h2d_rings = dhd->bus->max_submission_rings;
+
+       switch (type) {
+               case H2D_DMA_INDX_WR_UPD:
+                       ptr = (uint8 *)(prot->h2d_dma_indx_wr_buf.va);
+                       offset = DHD_H2D_RING_OFFSET(ringid);
+                       break;
+
+               case D2H_DMA_INDX_RD_UPD:
+                       ptr = (uint8 *)(prot->d2h_dma_indx_rd_buf.va);
+                       offset = DHD_D2H_RING_OFFSET(ringid, max_h2d_rings);
+                       break;
+
+               case H2D_IFRM_INDX_WR_UPD:
+                       ptr = (uint8 *)(prot->h2d_ifrm_indx_wr_buf.va);
+                       offset = DHD_H2D_FRM_FLOW_RING_OFFSET(ringid);
+                       break;
+
+               default:
+                       DHD_ERROR(("%s: Invalid option for DMAing read/write index\n",
+                               __FUNCTION__));
+                       return;
+       }
+
+       ASSERT(prot->rw_index_sz != 0);
+       ptr += offset * prot->rw_index_sz;
+
+       /* XXX: Test casting ptr to uint16* for 32bit indices case on Big Endian */
+       *(uint16*)ptr = htol16(new_index);
+
+       OSL_CACHE_FLUSH((void *)ptr, prot->rw_index_sz);
+
+       DHD_TRACE(("%s: data %d type %d ringid %d ptr 0x%p offset %d\n",
+               __FUNCTION__, new_index, type, ringid, ptr, offset));
+
+} /* dhd_prot_dma_indx_set */
+
+/**
+ * dhd_prot_dma_indx_get - Fetch a WR or RD index from the dongle DMA-ed index
+ * array.
+ * Dongle DMAes an entire array to host memory (if the feature is enabled).
+ * See dhd_prot_dma_indx_init()
+ */
+static uint16
+dhd_prot_dma_indx_get(dhd_pub_t *dhd, uint8 type, uint16 ringid)
+{
+       uint8 *ptr;
+       uint16 data;
+       uint16 offset;
+       dhd_prot_t *prot = dhd->prot;
+       uint16 max_h2d_rings = dhd->bus->max_submission_rings;
+
+       switch (type) {
+               case H2D_DMA_INDX_WR_UPD:
+                       ptr = (uint8 *)(prot->h2d_dma_indx_wr_buf.va);
+                       offset = DHD_H2D_RING_OFFSET(ringid);
+                       break;
+
+               case H2D_DMA_INDX_RD_UPD:
+                       ptr = (uint8 *)(prot->h2d_dma_indx_rd_buf.va);
+                       offset = DHD_H2D_RING_OFFSET(ringid);
+                       break;
+
+               case D2H_DMA_INDX_WR_UPD:
+                       ptr = (uint8 *)(prot->d2h_dma_indx_wr_buf.va);
+                       offset = DHD_D2H_RING_OFFSET(ringid, max_h2d_rings);
+                       break;
+
+               case D2H_DMA_INDX_RD_UPD:
+                       ptr = (uint8 *)(prot->d2h_dma_indx_rd_buf.va);
+                       offset = DHD_D2H_RING_OFFSET(ringid, max_h2d_rings);
+                       break;
+
+               default:
+                       DHD_ERROR(("%s: Invalid option for DMAing read/write index\n",
+                               __FUNCTION__));
+                       return 0;
+       }
+
+       ASSERT(prot->rw_index_sz != 0);
+       ptr += offset * prot->rw_index_sz;
+
+       OSL_CACHE_INV((void *)ptr, prot->rw_index_sz);
+
+       /* XXX: Test casting ptr to uint16* for 32bit indices case on Big Endian */
+       data = LTOH16(*((uint16*)ptr));
+
+       DHD_TRACE(("%s: data %d type %d ringid %d ptr 0x%p offset %d\n",
+               __FUNCTION__, data, type, ringid, ptr, offset));
+
+       return (data);
+
+} /* dhd_prot_dma_indx_get */
+
+/**
+ * An array of DMA read/write indices, containing information about host rings, can be maintained
+ * either in host memory or in device memory, dependent on preprocessor options. This function is,
+ * dependent on these options, called during driver initialization. It reserves and initializes
+ * blocks of DMA'able host memory containing an array of DMA read or DMA write indices. The physical
+ * address of these host memory blocks are communicated to the dongle later on. By reading this host
+ * memory, the dongle learns about the state of the host rings.
+ */
+
+static INLINE int
+dhd_prot_dma_indx_alloc(dhd_pub_t *dhd, uint8 type,
+       dhd_dma_buf_t *dma_buf, uint32 bufsz)
+{
+       int rc;
+
+       if ((dma_buf->len == bufsz) || (dma_buf->va != NULL))
+               return BCME_OK;
+
+       rc = dhd_dma_buf_alloc(dhd, dma_buf, bufsz);
+
+       return rc;
+}
+
+int
+dhd_prot_dma_indx_init(dhd_pub_t *dhd, uint32 rw_index_sz, uint8 type, uint32 length)
+{
+       uint32 bufsz;
+       dhd_prot_t *prot = dhd->prot;
+       dhd_dma_buf_t *dma_buf;
+
+       if (prot == NULL) {
+               DHD_ERROR(("prot is not inited\n"));
+               return BCME_ERROR;
+       }
+
+       /* Dongle advertizes 2B or 4B RW index size */
+       ASSERT(rw_index_sz != 0);
+       prot->rw_index_sz = rw_index_sz;
+
+       bufsz = rw_index_sz * length;
+
+       switch (type) {
+               case H2D_DMA_INDX_WR_BUF:
+                       dma_buf = &prot->h2d_dma_indx_wr_buf;
+                       if (dhd_prot_dma_indx_alloc(dhd, type, dma_buf, bufsz))
+                               goto ret_no_mem;
+                       DHD_ERROR(("H2D DMA WR INDX : array size %d = %d * %d\n",
+                               dma_buf->len, rw_index_sz, length));
+                       break;
+
+               case H2D_DMA_INDX_RD_BUF:
+                       dma_buf = &prot->h2d_dma_indx_rd_buf;
+                       if (dhd_prot_dma_indx_alloc(dhd, type, dma_buf, bufsz))
+                               goto ret_no_mem;
+                       DHD_ERROR(("H2D DMA RD INDX : array size %d = %d * %d\n",
+                               dma_buf->len, rw_index_sz, length));
+                       break;
+
+               case D2H_DMA_INDX_WR_BUF:
+                       dma_buf = &prot->d2h_dma_indx_wr_buf;
+                       if (dhd_prot_dma_indx_alloc(dhd, type, dma_buf, bufsz))
+                               goto ret_no_mem;
+                       DHD_ERROR(("D2H DMA WR INDX : array size %d = %d * %d\n",
+                               dma_buf->len, rw_index_sz, length));
+                       break;
+
+               case D2H_DMA_INDX_RD_BUF:
+                       dma_buf = &prot->d2h_dma_indx_rd_buf;
+                       if (dhd_prot_dma_indx_alloc(dhd, type, dma_buf, bufsz))
+                               goto ret_no_mem;
+                       DHD_ERROR(("D2H DMA RD INDX : array size %d = %d * %d\n",
+                               dma_buf->len, rw_index_sz, length));
+                       break;
+
+               case H2D_IFRM_INDX_WR_BUF:
+                       dma_buf = &prot->h2d_ifrm_indx_wr_buf;
+                       if (dhd_prot_dma_indx_alloc(dhd, type, dma_buf, bufsz))
+                               goto ret_no_mem;
+                       DHD_ERROR(("H2D IFRM WR INDX : array size %d = %d * %d\n",
+                               dma_buf->len, rw_index_sz, length));
+                       break;
+
+               default:
+                       DHD_ERROR(("%s: Unexpected option\n", __FUNCTION__));
+                       return BCME_BADOPTION;
+       }
+
+       return BCME_OK;
+
+ret_no_mem:
+       DHD_ERROR(("%s: dhd_prot_dma_indx_alloc type %d buf_sz %d failure\n",
+               __FUNCTION__, type, bufsz));
+       return BCME_NOMEM;
+
+} /* dhd_prot_dma_indx_init */
+
+/**
+ * Called on checking for 'completion' messages from the dongle. Returns next host buffer to read
+ * from, or NULL if there are no more messages to read.
+ */
+static uint8*
+dhd_prot_get_read_addr(dhd_pub_t *dhd, msgbuf_ring_t *ring, uint32 *available_len)
+{
+       uint16 wr;
+       uint16 rd;
+       uint16 depth;
+       uint16 items;
+       void  *read_addr = NULL; /* address of next msg to be read in ring */
+       uint16 d2h_wr = 0;
+
+       DHD_TRACE(("%s: d2h_dma_indx_rd_buf %p, d2h_dma_indx_wr_buf %p\n",
+               __FUNCTION__, (uint32 *)(dhd->prot->d2h_dma_indx_rd_buf.va),
+               (uint32 *)(dhd->prot->d2h_dma_indx_wr_buf.va)));
+
+       /* Remember the read index in a variable.
+        * This is becuase ring->rd gets updated in the end of this function
+        * So if we have to print the exact read index from which the
+        * message is read its not possible.
+        */
+       ring->curr_rd = ring->rd;
+
+       /* update write pointer */
+       if (dhd->dma_d2h_ring_upd_support) {
+               /* DMAing write/read indices supported */
+               d2h_wr = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_WR_UPD, ring->idx);
+               ring->wr = d2h_wr;
+       } else {
+               dhd_bus_cmn_readshared(dhd->bus, &(ring->wr), RING_WR_UPD, ring->idx);
+       }
+
+       wr = ring->wr;
+       rd = ring->rd;
+       depth = ring->max_items;
+
+       /* check for avail space, in number of ring items */
+       items = READ_AVAIL_SPACE(wr, rd, depth);
+       if (items == 0)
+               return NULL;
+
+       /*
+        * Note that there are builds where Assert translates to just printk
+        * so, even if we had hit this condition we would never halt. Now
+        * dhd_prot_process_msgtype can get into an big loop if this
+        * happens.
+        */
+       if (items > ring->max_items) {
+               DHD_ERROR(("\r\n======================= \r\n"));
+               DHD_ERROR(("%s(): ring %p, ring->name %s, ring->max_items %d, items %d \r\n",
+                       __FUNCTION__, ring, ring->name, ring->max_items, items));
+               DHD_ERROR(("wr: %d,  rd: %d,  depth: %d  \r\n", wr, rd, depth));
+               DHD_ERROR(("dhd->busstate %d bus->wait_for_d3_ack %d \r\n",
+                       dhd->busstate, dhd->bus->wait_for_d3_ack));
+               DHD_ERROR(("\r\n======================= \r\n"));
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+               if (wr >= ring->max_items) {
+                       dhd->bus->read_shm_fail = TRUE;
+               }
+#else
+#ifdef DHD_FW_COREDUMP
+               if (dhd->memdump_enabled) {
+                       /* collect core dump */
+                       dhd->memdump_type = DUMP_TYPE_RESUMED_ON_INVALID_RING_RDWR;
+                       dhd_bus_mem_dump(dhd);
+
+               }
+#endif /* DHD_FW_COREDUMP */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+
+               *available_len = 0;
+               dhd_schedule_reset(dhd);
+
+               return NULL;
+       }
+
+       /* if space is available, calculate address to be read */
+       read_addr = (char*)ring->dma_buf.va + (rd * ring->item_len);
+
+       /* update read pointer */
+       if ((ring->rd + items) >= ring->max_items)
+               ring->rd = 0;
+       else
+               ring->rd += items;
+
+       ASSERT(ring->rd < ring->max_items);
+
+       /* convert items to bytes : available_len must be 32bits */
+       *available_len = (uint32)(items * ring->item_len);
+
+       /* XXX Double cache invalidate for ARM with L2 cache/prefetch */
+       OSL_CACHE_INV(read_addr, *available_len);
+
+       /* return read address */
+       return read_addr;
+
+} /* dhd_prot_get_read_addr */
+
+/**
+ * dhd_prot_h2d_mbdata_send_ctrlmsg is a non-atomic function,
+ * make sure the callers always hold appropriate locks.
+ */
+int dhd_prot_h2d_mbdata_send_ctrlmsg(dhd_pub_t *dhd, uint32 mb_data)
+{
+       h2d_mailbox_data_t *h2d_mb_data;
+       uint16 alloced = 0;
+       msgbuf_ring_t *ctrl_ring = &dhd->prot->h2dring_ctrl_subn;
+       unsigned long flags;
+       int num_post = 1;
+       int i;
+
+       DHD_INFO(("%s Sending H2D MB data Req data 0x%04x\n",
+               __FUNCTION__, mb_data));
+       if (!ctrl_ring->inited) {
+               DHD_ERROR(("%s: Ctrl Submit Ring: not inited\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+#ifdef PCIE_INB_DW
+       if ((INBAND_DW_ENAB(dhd->bus)) &&
+               (dhdpcie_bus_get_pcie_inband_dw_state(dhd->bus) ==
+                       DW_DEVICE_DS_DEV_SLEEP)) {
+               if (mb_data == H2D_HOST_CONS_INT) {
+                       /* One additional device_wake post needed */
+                       num_post = 2;
+               }
+       }
+#endif /* PCIE_INB_DW */
+
+       for (i = 0; i < num_post; i ++) {
+               DHD_RING_LOCK(ctrl_ring->ring_lock, flags);
+               /* Request for ring buffer space */
+               h2d_mb_data = (h2d_mailbox_data_t *)dhd_prot_alloc_ring_space(dhd,
+                       ctrl_ring, DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D,
+                       &alloced, FALSE);
+
+               if (h2d_mb_data == NULL) {
+                       DHD_ERROR(("%s: FATAL: No space in control ring to send H2D Mb data\n",
+                               __FUNCTION__));
+                       DHD_RING_UNLOCK(ctrl_ring->ring_lock, flags);
+                       return BCME_NOMEM;
+               }
+
+               memset(h2d_mb_data, 0, sizeof(h2d_mailbox_data_t));
+               /* Common msg buf hdr */
+               h2d_mb_data->msg.msg_type = MSG_TYPE_H2D_MAILBOX_DATA;
+               h2d_mb_data->msg.flags = ctrl_ring->current_phase;
+
+               h2d_mb_data->msg.epoch =
+                       ctrl_ring->seqnum % H2D_EPOCH_MODULO;
+               ctrl_ring->seqnum++;
+
+               /* Update flow create message */
+               h2d_mb_data->mail_box_data = htol32(mb_data);
+#ifdef PCIE_INB_DW
+               /* post device_wake first */
+               if ((num_post == 2) && (i == 0)) {
+                       h2d_mb_data->mail_box_data = htol32(H2DMB_DS_DEVICE_WAKE);
+               } else
+#endif /* PCIE_INB_DW */
+               {
+                       h2d_mb_data->mail_box_data = htol32(mb_data);
+               }
+
+               DHD_INFO(("%s Send H2D MB data Req data 0x%04x\n", __FUNCTION__, mb_data));
+
+               /* upd wrt ptr and raise interrupt */
+               dhd_prot_ring_write_complete_mbdata(dhd, ctrl_ring, h2d_mb_data,
+                       DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D, mb_data);
+
+               DHD_RING_UNLOCK(ctrl_ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+               /* Add a delay if device_wake is posted */
+               if ((num_post == 2) && (i == 0)) {
+                       OSL_DELAY(1000);
+               }
+#endif /* PCIE_INB_DW */
+       }
+       return 0;
+}
+
+/** Creates a flow ring and informs dongle of this event */
+int
+dhd_prot_flow_ring_create(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node)
+{
+       tx_flowring_create_request_t *flow_create_rqst;
+       msgbuf_ring_t *flow_ring;
+       dhd_prot_t *prot = dhd->prot;
+       unsigned long flags;
+       uint16 alloced = 0;
+       msgbuf_ring_t *ctrl_ring = &prot->h2dring_ctrl_subn;
+       uint16 max_flowrings = dhd->bus->max_tx_flowrings;
+
+       /* Fetch a pre-initialized msgbuf_ring from the flowring pool */
+       flow_ring = dhd_prot_flowrings_pool_fetch(dhd, flow_ring_node->flowid);
+       if (flow_ring == NULL) {
+               DHD_ERROR(("%s: dhd_prot_flowrings_pool_fetch TX Flowid %d failed\n",
+                       __FUNCTION__, flow_ring_node->flowid));
+               return BCME_NOMEM;
+       }
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK)
+               return BCME_ERROR;
+#endif /* PCIE_INB_DW */
+       DHD_RING_LOCK(ctrl_ring->ring_lock, flags);
+
+       /* Request for ctrl_ring buffer space */
+       flow_create_rqst = (tx_flowring_create_request_t *)
+               dhd_prot_alloc_ring_space(dhd, ctrl_ring, 1, &alloced, FALSE);
+
+       if (flow_create_rqst == NULL) {
+               dhd_prot_flowrings_pool_release(dhd, flow_ring_node->flowid, flow_ring);
+               DHD_ERROR(("%s: Flow Create Req flowid %d - failure ring space\n",
+                       __FUNCTION__, flow_ring_node->flowid));
+               DHD_RING_UNLOCK(ctrl_ring->ring_lock, flags);
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+               return BCME_NOMEM;
+       }
+
+       flow_ring_node->prot_info = (void *)flow_ring;
+
+       /* Common msg buf hdr */
+       flow_create_rqst->msg.msg_type = MSG_TYPE_FLOW_RING_CREATE;
+       flow_create_rqst->msg.if_id = (uint8)flow_ring_node->flow_info.ifindex;
+       flow_create_rqst->msg.request_id = htol32(0); /* TBD */
+       flow_create_rqst->msg.flags = ctrl_ring->current_phase;
+
+       flow_create_rqst->msg.epoch = ctrl_ring->seqnum % H2D_EPOCH_MODULO;
+       ctrl_ring->seqnum++;
+
+       /* Update flow create message */
+       flow_create_rqst->tid = flow_ring_node->flow_info.tid;
+       flow_create_rqst->flow_ring_id = htol16((uint16)flow_ring_node->flowid);
+       memcpy(flow_create_rqst->sa, flow_ring_node->flow_info.sa, sizeof(flow_create_rqst->sa));
+       memcpy(flow_create_rqst->da, flow_ring_node->flow_info.da, sizeof(flow_create_rqst->da));
+       /* CAUTION: ring::base_addr already in Little Endian */
+       flow_create_rqst->flow_ring_ptr.low_addr = flow_ring->base_addr.low_addr;
+       flow_create_rqst->flow_ring_ptr.high_addr = flow_ring->base_addr.high_addr;
+       flow_create_rqst->max_items = htol16(flow_ring->max_items);
+       flow_create_rqst->len_item = htol16(H2DRING_TXPOST_ITEMSIZE);
+       flow_create_rqst->if_flags = 0;
+
+       /* definition for ifrm mask : bit0:d11ac core, bit1:d11ad core
+        * currently it is not used for priority. so uses solely for ifrm mask
+        */
+       if (IFRM_ACTIVE(dhd))
+               flow_create_rqst->priority_ifrmmask = (1 << IFRM_DEV_0);
+
+       DHD_ERROR(("%s: Send Flow Create Req flow ID %d for peer " MACDBG
+               " prio %d ifindex %d items %d\n", __FUNCTION__, flow_ring_node->flowid,
+               MAC2STRDBG(flow_ring_node->flow_info.da), flow_ring_node->flow_info.tid,
+               flow_ring_node->flow_info.ifindex, flow_ring->max_items));
+
+       /* Update the flow_ring's WRITE index */
+       if (IDMA_ACTIVE(dhd) || dhd->dma_h2d_ring_upd_support) {
+               dhd_prot_dma_indx_set(dhd, flow_ring->wr,
+                                     H2D_DMA_INDX_WR_UPD, flow_ring->idx);
+       } else if (IFRM_ACTIVE(dhd) && DHD_IS_FLOWRING(flow_ring->idx, max_flowrings)) {
+               dhd_prot_dma_indx_set(dhd, flow_ring->wr,
+                       H2D_IFRM_INDX_WR_UPD, flow_ring->idx);
+       } else {
+               dhd_bus_cmn_writeshared(dhd->bus, &(flow_ring->wr),
+                       sizeof(uint16), RING_WR_UPD, flow_ring->idx);
+       }
+
+       /* update control subn ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ctrl_ring, flow_create_rqst, 1);
+
+       DHD_RING_UNLOCK(ctrl_ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+       return BCME_OK;
+} /* dhd_prot_flow_ring_create */
+
+/** called on receiving MSG_TYPE_FLOW_RING_CREATE_CMPLT message from dongle */
+static void
+dhd_prot_flow_ring_create_response_process(dhd_pub_t *dhd, void *msg)
+{
+       tx_flowring_create_response_t *flow_create_resp = (tx_flowring_create_response_t *)msg;
+
+       DHD_ERROR(("%s: Flow Create Response status = %d Flow %d\n", __FUNCTION__,
+               ltoh16(flow_create_resp->cmplt.status),
+               ltoh16(flow_create_resp->cmplt.flow_ring_id)));
+
+       dhd_bus_flow_ring_create_response(dhd->bus,
+               ltoh16(flow_create_resp->cmplt.flow_ring_id),
+               ltoh16(flow_create_resp->cmplt.status));
+}
+
+static void
+dhd_prot_process_h2d_ring_create_complete(dhd_pub_t *dhd, void *buf)
+{
+       h2d_ring_create_response_t *resp = (h2d_ring_create_response_t *)buf;
+       DHD_INFO(("%s ring create Response status = %d ring %d, id 0x%04x\n", __FUNCTION__,
+               ltoh16(resp->cmplt.status),
+               ltoh16(resp->cmplt.ring_id),
+               ltoh32(resp->cmn_hdr.request_id)));
+       if ((ltoh32(resp->cmn_hdr.request_id) != DHD_H2D_DBGRING_REQ_PKTID) &&
+               (ltoh32(resp->cmn_hdr.request_id) != DHD_H2D_BTLOGRING_REQ_PKTID)) {
+               DHD_ERROR(("invalid request ID with h2d ring create complete\n"));
+               return;
+       }
+       if (dhd->prot->h2dring_info_subn->create_req_id == ltoh32(resp->cmn_hdr.request_id) &&
+               !dhd->prot->h2dring_info_subn->create_pending) {
+               DHD_ERROR(("info ring create status for not pending submit ring\n"));
+       }
+
+       if (ltoh16(resp->cmplt.status) != BCMPCIE_SUCCESS) {
+               DHD_ERROR(("info/btlog ring create failed with status %d\n",
+                       ltoh16(resp->cmplt.status)));
+               return;
+       }
+       if (dhd->prot->h2dring_info_subn->create_req_id == ltoh32(resp->cmn_hdr.request_id)) {
+               dhd->prot->h2dring_info_subn->create_pending = FALSE;
+               dhd->prot->h2dring_info_subn->inited = TRUE;
+               DHD_ERROR(("info buffer post after ring create\n"));
+               dhd_prot_infobufpost(dhd, dhd->prot->h2dring_info_subn);
+       }
+}
+
+static void
+dhd_prot_process_d2h_ring_create_complete(dhd_pub_t *dhd, void *buf)
+{
+       d2h_ring_create_response_t *resp = (d2h_ring_create_response_t *)buf;
+       DHD_ERROR(("%s ring create Response status = %d ring %d, id 0x%04x\n", __FUNCTION__,
+               ltoh16(resp->cmplt.status),
+               ltoh16(resp->cmplt.ring_id),
+               ltoh32(resp->cmn_hdr.request_id)));
+       if ((ltoh32(resp->cmn_hdr.request_id) != DHD_D2H_DBGRING_REQ_PKTID) &&
+               (ltoh32(resp->cmn_hdr.request_id) != DHD_D2H_BTLOGRING_REQ_PKTID) &&
+               TRUE) {
+               DHD_ERROR(("invalid request ID with d2h ring create complete\n"));
+               return;
+       }
+       if (ltoh32(resp->cmn_hdr.request_id) == DHD_D2H_DBGRING_REQ_PKTID) {
+#ifdef EWP_EDL
+               if (!dhd->dongle_edl_support)
+#endif
+               {
+
+                       if (!dhd->prot->d2hring_info_cpln->create_pending) {
+                               DHD_ERROR(("info ring create status for not pending cpl ring\n"));
+                               return;
+                       }
+
+                       if (ltoh16(resp->cmplt.status) != BCMPCIE_SUCCESS) {
+                               DHD_ERROR(("info cpl ring create failed with status %d\n",
+                                       ltoh16(resp->cmplt.status)));
+                               return;
+                       }
+                       dhd->prot->d2hring_info_cpln->create_pending = FALSE;
+                       dhd->prot->d2hring_info_cpln->inited = TRUE;
+               }
+#ifdef EWP_EDL
+               else {
+                       if (!dhd->prot->d2hring_edl->create_pending) {
+                               DHD_ERROR(("edl ring create status for not pending cpl ring\n"));
+                               return;
+                       }
+
+                       if (ltoh16(resp->cmplt.status) != BCMPCIE_SUCCESS) {
+                               DHD_ERROR(("edl cpl ring create failed with status %d\n",
+                                       ltoh16(resp->cmplt.status)));
+                               return;
+                       }
+                       dhd->prot->d2hring_edl->create_pending = FALSE;
+                       dhd->prot->d2hring_edl->inited = TRUE;
+               }
+#endif /* EWP_EDL */
+       }
+
+}
+
+static void
+dhd_prot_process_d2h_mb_data(dhd_pub_t *dhd, void* buf)
+{
+       d2h_mailbox_data_t *d2h_data;
+
+       d2h_data = (d2h_mailbox_data_t *)buf;
+       DHD_INFO(("%s dhd_prot_process_d2h_mb_data, 0x%04x\n", __FUNCTION__,
+               d2h_data->d2h_mailbox_data));
+       dhd_bus_handle_mb_data(dhd->bus, d2h_data->d2h_mailbox_data);
+}
+
+static void
+dhd_prot_process_d2h_host_ts_complete(dhd_pub_t *dhd, void* buf)
+{
+       DHD_ERROR(("Timesunc feature not compiled in but GOT HOST_TS_COMPLETE\n"));
+
+}
+
+/** called on e.g. flow ring delete */
+void dhd_prot_clean_flow_ring(dhd_pub_t *dhd, void *msgbuf_flow_info)
+{
+       msgbuf_ring_t *flow_ring = (msgbuf_ring_t *)msgbuf_flow_info;
+       dhd_prot_ring_detach(dhd, flow_ring);
+       DHD_INFO(("%s Cleaning up Flow \n", __FUNCTION__));
+}
+
+void dhd_prot_print_flow_ring(dhd_pub_t *dhd, void *msgbuf_flow_info, bool h2d,
+       struct bcmstrbuf *strbuf, const char * fmt)
+{
+       const char *default_fmt =
+               "TRD:%d HLRD:%d HDRD:%d TWR:%d HLWR:%d HDWR:%d  BASE(VA) %p BASE(PA) %x:%x SIZE %d "
+               "WORK_ITEM_SIZE %d MAX_WORK_ITEMS %d TOTAL_SIZE %d\n";
+       msgbuf_ring_t *flow_ring = (msgbuf_ring_t *)msgbuf_flow_info;
+       uint16 rd, wr, drd = 0, dwr = 0;
+       uint32 dma_buf_len = flow_ring->max_items * flow_ring->item_len;
+
+       if (fmt == NULL) {
+               fmt = default_fmt;
+       }
+
+       if (dhd->bus->is_linkdown) {
+               DHD_ERROR(("%s: Skip dumping flowring due to Link down\n", __FUNCTION__));
+               return;
+       }
+
+       dhd_bus_cmn_readshared(dhd->bus, &rd, RING_RD_UPD, flow_ring->idx);
+       dhd_bus_cmn_readshared(dhd->bus, &wr, RING_WR_UPD, flow_ring->idx);
+       if (dhd->dma_d2h_ring_upd_support) {
+               if (h2d) {
+                       drd = dhd_prot_dma_indx_get(dhd, H2D_DMA_INDX_RD_UPD, flow_ring->idx);
+                       dwr = dhd_prot_dma_indx_get(dhd, H2D_DMA_INDX_WR_UPD, flow_ring->idx);
+               } else {
+                       drd = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_RD_UPD, flow_ring->idx);
+                       dwr = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_WR_UPD, flow_ring->idx);
+               }
+       }
+       bcm_bprintf(strbuf, fmt, rd, flow_ring->rd, drd, wr, flow_ring->wr, dwr,
+               flow_ring->dma_buf.va,
+               ltoh32(flow_ring->base_addr.high_addr),
+               ltoh32(flow_ring->base_addr.low_addr),
+               flow_ring->item_len, flow_ring->max_items,
+               dma_buf_len);
+}
+
+void dhd_prot_print_info(dhd_pub_t *dhd, struct bcmstrbuf *strbuf)
+{
+       dhd_prot_t *prot = dhd->prot;
+       bcm_bprintf(strbuf, "IPCrevs: Dev %d, \t Host %d, \tactive %d\n",
+               dhd->prot->device_ipc_version,
+               dhd->prot->host_ipc_version,
+               dhd->prot->active_ipc_version);
+
+       bcm_bprintf(strbuf, "max Host TS bufs to post: %d, \t posted %d \n",
+               dhd->prot->max_tsbufpost, dhd->prot->cur_ts_bufs_posted);
+       bcm_bprintf(strbuf, "max INFO bufs to post: %d, \t posted %d \n",
+               dhd->prot->max_infobufpost, dhd->prot->infobufpost);
+       bcm_bprintf(strbuf, "max event bufs to post: %d, \t posted %d \n",
+               dhd->prot->max_eventbufpost, dhd->prot->cur_event_bufs_posted);
+       bcm_bprintf(strbuf, "max ioctlresp bufs to post: %d, \t posted %d \n",
+               dhd->prot->max_ioctlrespbufpost, dhd->prot->cur_ioctlresp_bufs_posted);
+       bcm_bprintf(strbuf, "max RX bufs to post: %d, \t posted %d \n",
+               dhd->prot->max_rxbufpost, dhd->prot->rxbufpost);
+
+       bcm_bprintf(strbuf, "Total RX bufs posted: %d, \t RX cpl got %d \n",
+               dhd->prot->tot_rxbufpost, dhd->prot->tot_rxcpl);
+
+       bcm_bprintf(strbuf, "Total TX packets: %lu, \t TX cpl got %lu \n",
+               dhd->actual_tx_pkts, dhd->tot_txcpl);
+
+       bcm_bprintf(strbuf,
+               "%14s %18s %18s %17s %17s %14s %14s %10s\n",
+               "Type", "TRD: HLRD: HDRD", "TWR: HLWR: HDWR", "BASE(VA)", "BASE(PA)",
+               "WORK_ITEM_SIZE", "MAX_WORK_ITEMS", "TOTAL_SIZE");
+       bcm_bprintf(strbuf, "%14s", "H2DCtrlPost");
+       dhd_prot_print_flow_ring(dhd, &prot->h2dring_ctrl_subn, TRUE, strbuf,
+               " %5d:%5d:%5d %5d:%5d:%5d %17p %8x:%8x %14d %14d %10d\n");
+       bcm_bprintf(strbuf, "%14s", "D2HCtrlCpl");
+       dhd_prot_print_flow_ring(dhd, &prot->d2hring_ctrl_cpln, FALSE, strbuf,
+               " %5d:%5d:%5d %5d:%5d:%5d %17p %8x:%8x %14d %14d %10d\n");
+       bcm_bprintf(strbuf, "%14s", "H2DRxPost");
+       dhd_prot_print_flow_ring(dhd, &prot->h2dring_rxp_subn, TRUE, strbuf,
+               " %5d:%5d:%5d %5d:%5d:%5d %17p %8x:%8x %14d %14d %10d\n");
+       bcm_bprintf(strbuf, "%14s", "D2HRxCpl");
+       dhd_prot_print_flow_ring(dhd, &prot->d2hring_rx_cpln, FALSE, strbuf,
+               " %5d:%5d:%5d %5d:%5d:%5d %17p %8x:%8x %14d %14d %10d\n");
+       bcm_bprintf(strbuf, "%14s", "D2HTxCpl");
+       dhd_prot_print_flow_ring(dhd, &prot->d2hring_tx_cpln, FALSE, strbuf,
+               " %5d:%5d:%5d %5d:%5d:%5d %17p %8x:%8x %14d %14d %10d\n");
+       if (dhd->prot->h2dring_info_subn != NULL && dhd->prot->d2hring_info_cpln != NULL) {
+               bcm_bprintf(strbuf, "%14s", "H2DRingInfoSub");
+               dhd_prot_print_flow_ring(dhd, prot->h2dring_info_subn, TRUE, strbuf,
+                       " %5d:%5d:%5d %5d:%5d:%5d %17p %8x:%8x %14d %14d %10d\n");
+               bcm_bprintf(strbuf, "%14s", "D2HRingInfoCpl");
+               dhd_prot_print_flow_ring(dhd, prot->d2hring_info_cpln, FALSE, strbuf,
+                       " %5d:%5d:%5d %5d:%5d:%5d %17p %8x:%8x %14d %14d %10d\n");
+       }
+       if (dhd->prot->d2hring_edl != NULL) {
+               bcm_bprintf(strbuf, "%14s", "D2HRingEDL");
+               dhd_prot_print_flow_ring(dhd, prot->d2hring_edl, FALSE, strbuf,
+                       " %5d:%5d:%5d %5d:%5d:%5d %17p %8x:%8x %14d %14d %10d\n");
+       }
+
+       bcm_bprintf(strbuf, "active_tx_count %d  pktidmap_avail(ctrl/rx/tx) %d %d %d\n",
+               OSL_ATOMIC_READ(dhd->osh, &dhd->prot->active_tx_count),
+               DHD_PKTID_AVAIL(dhd->prot->pktid_ctrl_map),
+               DHD_PKTID_AVAIL(dhd->prot->pktid_rx_map),
+               DHD_PKTID_AVAIL(dhd->prot->pktid_tx_map));
+
+       dhd_dump_bus_ds_trace(dhd->bus, strbuf);
+}
+
+int
+dhd_prot_flow_ring_delete(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node)
+{
+       tx_flowring_delete_request_t *flow_delete_rqst;
+       dhd_prot_t *prot = dhd->prot;
+       unsigned long flags;
+       uint16 alloced = 0;
+       msgbuf_ring_t *ring = &prot->h2dring_ctrl_subn;
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK)
+               return BCME_ERROR;
+#endif /* PCIE_INB_DW */
+
+       DHD_RING_LOCK(ring->ring_lock, flags);
+
+       /* Request for ring buffer space */
+       flow_delete_rqst = (tx_flowring_delete_request_t *)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+
+       if (flow_delete_rqst == NULL) {
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+               DHD_ERROR(("%s: Flow Delete Req - failure ring space\n", __FUNCTION__));
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+               return BCME_NOMEM;
+       }
+
+       /* Common msg buf hdr */
+       flow_delete_rqst->msg.msg_type = MSG_TYPE_FLOW_RING_DELETE;
+       flow_delete_rqst->msg.if_id = (uint8)flow_ring_node->flow_info.ifindex;
+       flow_delete_rqst->msg.request_id = htol32(0); /* TBD */
+       flow_delete_rqst->msg.flags = ring->current_phase;
+
+       flow_delete_rqst->msg.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+       ring->seqnum++;
+
+       /* Update Delete info */
+       flow_delete_rqst->flow_ring_id = htol16((uint16)flow_ring_node->flowid);
+       flow_delete_rqst->reason = htol16(BCME_OK);
+
+       DHD_ERROR(("%s: Send Flow Delete Req RING ID %d for peer " MACDBG
+               " prio %d ifindex %d\n", __FUNCTION__, flow_ring_node->flowid,
+               MAC2STRDBG(flow_ring_node->flow_info.da), flow_ring_node->flow_info.tid,
+               flow_ring_node->flow_info.ifindex));
+
+       /* update ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ring, flow_delete_rqst, 1);
+
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+       return BCME_OK;
+}
+
+static void
+BCMFASTPATH(dhd_prot_flow_ring_fastdelete)(dhd_pub_t *dhd, uint16 flowid, uint16 rd_idx)
+{
+       flow_ring_node_t *flow_ring_node = DHD_FLOW_RING(dhd, flowid);
+       msgbuf_ring_t *ring = (msgbuf_ring_t *)flow_ring_node->prot_info;
+       host_txbuf_cmpl_t txstatus;
+       host_txbuf_post_t *txdesc;
+       uint16 wr_idx;
+
+       DHD_INFO(("%s: FAST delete ring, flowid=%d, rd_idx=%d, wr_idx=%d\n",
+               __FUNCTION__, flowid, rd_idx, ring->wr));
+
+       memset(&txstatus, 0, sizeof(txstatus));
+       txstatus.compl_hdr.flow_ring_id = flowid;
+       txstatus.cmn_hdr.if_id = flow_ring_node->flow_info.ifindex;
+       wr_idx = ring->wr;
+
+       while (wr_idx != rd_idx) {
+               if (wr_idx)
+                       wr_idx--;
+               else
+                       wr_idx = ring->max_items - 1;
+               txdesc = (host_txbuf_post_t *)((char *)DHD_RING_BGN_VA(ring) +
+                       (wr_idx * ring->item_len));
+               txstatus.cmn_hdr.request_id = txdesc->cmn_hdr.request_id;
+               dhd_prot_txstatus_process(dhd, &txstatus);
+       }
+}
+
+static void
+dhd_prot_flow_ring_delete_response_process(dhd_pub_t *dhd, void *msg)
+{
+       tx_flowring_delete_response_t *flow_delete_resp = (tx_flowring_delete_response_t *)msg;
+
+       DHD_ERROR(("%s: Flow Delete Response status = %d Flow %d\n", __FUNCTION__,
+               flow_delete_resp->cmplt.status, flow_delete_resp->cmplt.flow_ring_id));
+
+       if (dhd->fast_delete_ring_support) {
+               dhd_prot_flow_ring_fastdelete(dhd, flow_delete_resp->cmplt.flow_ring_id,
+                       flow_delete_resp->read_idx);
+       }
+       dhd_bus_flow_ring_delete_response(dhd->bus, flow_delete_resp->cmplt.flow_ring_id,
+               flow_delete_resp->cmplt.status);
+}
+
+static void
+dhd_prot_process_flow_ring_resume_response(dhd_pub_t *dhd, void* msg)
+{
+#ifdef IDLE_TX_FLOW_MGMT
+       tx_idle_flowring_resume_response_t      *flow_resume_resp =
+               (tx_idle_flowring_resume_response_t *)msg;
+
+       DHD_ERROR(("%s Flow resume Response status = %d Flow %d\n", __FUNCTION__,
+               flow_resume_resp->cmplt.status, flow_resume_resp->cmplt.flow_ring_id));
+
+       dhd_bus_flow_ring_resume_response(dhd->bus, flow_resume_resp->cmplt.flow_ring_id,
+               flow_resume_resp->cmplt.status);
+#endif /* IDLE_TX_FLOW_MGMT */
+}
+
+static void
+dhd_prot_process_flow_ring_suspend_response(dhd_pub_t *dhd, void* msg)
+{
+#ifdef IDLE_TX_FLOW_MGMT
+       int16 status;
+       tx_idle_flowring_suspend_response_t     *flow_suspend_resp =
+               (tx_idle_flowring_suspend_response_t *)msg;
+       status = flow_suspend_resp->cmplt.status;
+
+       DHD_ERROR(("%s Flow id %d suspend Response status = %d\n",
+               __FUNCTION__, flow_suspend_resp->cmplt.flow_ring_id,
+               status));
+
+       if (status != BCME_OK) {
+
+               DHD_ERROR(("%s Error in Suspending Flow rings!!"
+                       "Dongle will still be polling idle rings!!Status = %d \n",
+                       __FUNCTION__, status));
+       }
+#endif /* IDLE_TX_FLOW_MGMT */
+}
+
+int
+dhd_prot_flow_ring_flush(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node)
+{
+       tx_flowring_flush_request_t *flow_flush_rqst;
+       dhd_prot_t *prot = dhd->prot;
+       unsigned long flags;
+       uint16 alloced = 0;
+       msgbuf_ring_t *ring = &prot->h2dring_ctrl_subn;
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK)
+               return BCME_ERROR;
+#endif /* PCIE_INB_DW */
+
+       DHD_RING_LOCK(ring->ring_lock, flags);
+
+       /* Request for ring buffer space */
+       flow_flush_rqst = (tx_flowring_flush_request_t *)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+       if (flow_flush_rqst == NULL) {
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+               DHD_ERROR(("%s: Flow Flush Req - failure ring space\n", __FUNCTION__));
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+               return BCME_NOMEM;
+       }
+
+       /* Common msg buf hdr */
+       flow_flush_rqst->msg.msg_type = MSG_TYPE_FLOW_RING_FLUSH;
+       flow_flush_rqst->msg.if_id = (uint8)flow_ring_node->flow_info.ifindex;
+       flow_flush_rqst->msg.request_id = htol32(0); /* TBD */
+       flow_flush_rqst->msg.flags = ring->current_phase;
+       flow_flush_rqst->msg.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+       ring->seqnum++;
+
+       flow_flush_rqst->flow_ring_id = htol16((uint16)flow_ring_node->flowid);
+       flow_flush_rqst->reason = htol16(BCME_OK);
+
+       DHD_INFO(("%s: Send Flow Flush Req\n", __FUNCTION__));
+
+       /* update ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ring, flow_flush_rqst, 1);
+
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+       return BCME_OK;
+} /* dhd_prot_flow_ring_flush */
+
+static void
+dhd_prot_flow_ring_flush_response_process(dhd_pub_t *dhd, void *msg)
+{
+       tx_flowring_flush_response_t *flow_flush_resp = (tx_flowring_flush_response_t *)msg;
+
+       DHD_INFO(("%s: Flow Flush Response status = %d\n", __FUNCTION__,
+               flow_flush_resp->cmplt.status));
+
+       dhd_bus_flow_ring_flush_response(dhd->bus, flow_flush_resp->cmplt.flow_ring_id,
+               flow_flush_resp->cmplt.status);
+}
+
+/**
+ * Request dongle to configure soft doorbells for D2H rings. Host populated soft
+ * doorbell information is transferred to dongle via the d2h ring config control
+ * message.
+ */
+void
+dhd_msgbuf_ring_config_d2h_soft_doorbell(dhd_pub_t *dhd)
+{
+#if defined(DHD_D2H_SOFT_DOORBELL_SUPPORT)
+       uint16 ring_idx;
+       uint8 *msg_next;
+       void *msg_start;
+       uint16 alloced = 0;
+       unsigned long flags;
+       dhd_prot_t *prot = dhd->prot;
+       ring_config_req_t *ring_config_req;
+       bcmpcie_soft_doorbell_t *soft_doorbell;
+       msgbuf_ring_t *ctrl_ring = &prot->h2dring_ctrl_subn;
+       const uint16 d2h_rings = BCMPCIE_D2H_COMMON_MSGRINGS;
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK)
+               return BCME_ERROR;
+#endif /* PCIE_INB_DW */
+       /* Claim space for d2h_ring number of d2h_ring_config_req_t messages */
+       DHD_RING_LOCK(ctrl_ring->ring_lock, flags);
+       msg_start = dhd_prot_alloc_ring_space(dhd, ctrl_ring, d2h_rings, &alloced, TRUE);
+
+       if (msg_start == NULL) {
+               DHD_ERROR(("%s Msgbuf no space for %d D2H ring config soft doorbells\n",
+                       __FUNCTION__, d2h_rings));
+               DHD_RING_UNLOCK(ctrl_ring->ring_lock, flags);
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+               return;
+       }
+
+       msg_next = (uint8*)msg_start;
+
+       for (ring_idx = 0; ring_idx < d2h_rings; ring_idx++) {
+
+               /* position the ring_config_req into the ctrl subm ring */
+               ring_config_req = (ring_config_req_t *)msg_next;
+
+               /* Common msg header */
+               ring_config_req->msg.msg_type = MSG_TYPE_D2H_RING_CONFIG;
+               ring_config_req->msg.if_id = 0;
+               ring_config_req->msg.flags = 0;
+
+               ring_config_req->msg.epoch = ctrl_ring->seqnum % H2D_EPOCH_MODULO;
+               ctrl_ring->seqnum++;
+
+               ring_config_req->msg.request_id = htol32(DHD_FAKE_PKTID); /* unused */
+
+               /* Ring Config subtype and d2h ring_id */
+               ring_config_req->subtype = htol16(D2H_RING_CONFIG_SUBTYPE_SOFT_DOORBELL);
+               ring_config_req->ring_id = htol16(DHD_D2H_RINGID(ring_idx));
+
+               /* Host soft doorbell configuration */
+               soft_doorbell = &prot->soft_doorbell[ring_idx];
+
+               ring_config_req->soft_doorbell.value = htol32(soft_doorbell->value);
+               ring_config_req->soft_doorbell.haddr.high =
+                       htol32(soft_doorbell->haddr.high);
+               ring_config_req->soft_doorbell.haddr.low =
+                       htol32(soft_doorbell->haddr.low);
+               ring_config_req->soft_doorbell.items = htol16(soft_doorbell->items);
+               ring_config_req->soft_doorbell.msecs = htol16(soft_doorbell->msecs);
+
+               DHD_INFO(("%s: Soft doorbell haddr 0x%08x 0x%08x value 0x%08x\n",
+                       __FUNCTION__, ring_config_req->soft_doorbell.haddr.high,
+                       ring_config_req->soft_doorbell.haddr.low,
+                       ring_config_req->soft_doorbell.value));
+
+               msg_next = msg_next + ctrl_ring->item_len;
+       }
+
+       /* update control subn ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ctrl_ring, msg_start, d2h_rings);
+
+       DHD_RING_UNLOCK(ctrl_ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+#endif /* DHD_D2H_SOFT_DOORBELL_SUPPORT */
+}
+
+static void
+dhd_prot_process_d2h_ring_config_complete(dhd_pub_t *dhd, void *msg)
+{
+       DHD_INFO(("%s: Ring Config Response - status %d ringid %d\n",
+               __FUNCTION__, ltoh16(((ring_config_resp_t *)msg)->compl_hdr.status),
+               ltoh16(((ring_config_resp_t *)msg)->compl_hdr.flow_ring_id)));
+}
+
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+void
+copy_ext_trap_sig(dhd_pub_t *dhd, trap_t *tr)
+{
+       uint32 *ext_data = dhd->extended_trap_data;
+       hnd_ext_trap_hdr_t *hdr;
+       const bcm_tlv_t *tlv;
+
+       if (ext_data == NULL) {
+               return;
+       }
+       /* First word is original trap_data */
+       ext_data++;
+
+       /* Followed by the extended trap data header */
+       hdr = (hnd_ext_trap_hdr_t *)ext_data;
+
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_SIGNATURE);
+       if (tlv) {
+               memcpy(tr, &tlv->data, sizeof(struct _trap_struct));
+       }
+}
+#define TRAP_T_NAME_OFFSET(var) {#var, OFFSETOF(trap_t, var)}
+
+typedef struct {
+       char name[HANG_INFO_TRAP_T_NAME_MAX];
+       uint32 offset;
+} hang_info_trap_t;
+
+#ifdef DHD_EWPR_VER2
+static hang_info_trap_t hang_info_trap_tbl[] = {
+       {"reason", 0},
+       {"ver", VENDOR_SEND_HANG_EXT_INFO_VER},
+       {"stype", 0},
+       TRAP_T_NAME_OFFSET(type),
+       TRAP_T_NAME_OFFSET(epc),
+       {"resrvd", 0},
+       {"resrvd", 0},
+       {"resrvd", 0},
+       {"resrvd", 0},
+       {"", 0}
+};
+#else
+static hang_info_trap_t hang_info_trap_tbl[] = {
+       {"reason", 0},
+       {"ver", VENDOR_SEND_HANG_EXT_INFO_VER},
+       {"stype", 0},
+       TRAP_T_NAME_OFFSET(type),
+       TRAP_T_NAME_OFFSET(epc),
+       TRAP_T_NAME_OFFSET(cpsr),
+       TRAP_T_NAME_OFFSET(spsr),
+       TRAP_T_NAME_OFFSET(r0),
+       TRAP_T_NAME_OFFSET(r1),
+       TRAP_T_NAME_OFFSET(r2),
+       TRAP_T_NAME_OFFSET(r3),
+       TRAP_T_NAME_OFFSET(r4),
+       TRAP_T_NAME_OFFSET(r5),
+       TRAP_T_NAME_OFFSET(r6),
+       TRAP_T_NAME_OFFSET(r7),
+       TRAP_T_NAME_OFFSET(r8),
+       TRAP_T_NAME_OFFSET(r9),
+       TRAP_T_NAME_OFFSET(r10),
+       TRAP_T_NAME_OFFSET(r11),
+       TRAP_T_NAME_OFFSET(r12),
+       TRAP_T_NAME_OFFSET(r13),
+       TRAP_T_NAME_OFFSET(r14),
+       TRAP_T_NAME_OFFSET(pc),
+       {"", 0}
+};
+#endif /* DHD_EWPR_VER2 */
+
+#define TAG_TRAP_IS_STATE(tag) \
+       ((tag == TAG_TRAP_MEMORY) || (tag == TAG_TRAP_PCIE_Q) || \
+       (tag == TAG_TRAP_WLC_STATE) || (tag == TAG_TRAP_LOG_DATA) || \
+       (tag == TAG_TRAP_CODE))
+
+static void
+copy_hang_info_head(char *dest, trap_t *src, int len, int field_name,
+               int *bytes_written, int *cnt, char *cookie)
+{
+       uint8 *ptr;
+       int remain_len;
+       int i;
+
+       ptr = (uint8 *)src;
+
+       memset(dest, 0, len);
+       remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+
+       /* hang reason, hang info ver */
+       for (i = 0; (i < HANG_INFO_TRAP_T_SUBTYPE_IDX) && (*cnt < HANG_FIELD_CNT_MAX);
+                       i++, (*cnt)++) {
+               if (field_name) {
+                       remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+                       *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%s:%c",
+                                       hang_info_trap_tbl[i].name, HANG_KEY_DEL);
+               }
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%d%c",
+                               hang_info_trap_tbl[i].offset, HANG_KEY_DEL);
+
+       }
+
+       if (*cnt < HANG_FIELD_CNT_MAX) {
+               if (field_name) {
+                       remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+                       *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%s:%c",
+                                       "cookie", HANG_KEY_DEL);
+               }
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%s%c",
+                               cookie, HANG_KEY_DEL);
+               (*cnt)++;
+       }
+
+       if (*cnt < HANG_FIELD_CNT_MAX) {
+               if (field_name) {
+                       remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+                       *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%s:%c",
+                                       hang_info_trap_tbl[HANG_INFO_TRAP_T_SUBTYPE_IDX].name,
+                                       HANG_KEY_DEL);
+               }
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%08x%c",
+                               hang_info_trap_tbl[HANG_INFO_TRAP_T_SUBTYPE_IDX].offset,
+                               HANG_KEY_DEL);
+               (*cnt)++;
+       }
+
+       if (*cnt < HANG_FIELD_CNT_MAX) {
+               if (field_name) {
+                       remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+                       *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%s:%c",
+                                       hang_info_trap_tbl[HANG_INFO_TRAP_T_EPC_IDX].name,
+                                       HANG_KEY_DEL);
+               }
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%08x%c",
+                               *(uint32 *)
+                               (ptr + hang_info_trap_tbl[HANG_INFO_TRAP_T_EPC_IDX].offset),
+                               HANG_KEY_DEL);
+               (*cnt)++;
+       }
+#ifdef DHD_EWPR_VER2
+       /* put 0 for HG03 ~ HG06 (reserved for future use) */
+       for (i = 0; (i < HANG_INFO_BIGDATA_EXTRA_KEY) && (*cnt < HANG_FIELD_CNT_MAX);
+                       i++, (*cnt)++) {
+               if (field_name) {
+                       remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+                       *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%s:%c",
+                               hang_info_trap_tbl[HANG_INFO_TRAP_T_EXTRA_KEY_IDX+i].name,
+                               HANG_KEY_DEL);
+               }
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%d%c",
+                       hang_info_trap_tbl[HANG_INFO_TRAP_T_EXTRA_KEY_IDX+i].offset,
+                       HANG_KEY_DEL);
+       }
+#endif /* DHD_EWPR_VER2 */
+}
+#ifndef DHD_EWPR_VER2
+static void
+copy_hang_info_trap_t(char *dest, trap_t *src, int len, int field_name,
+               int *bytes_written, int *cnt, char *cookie)
+{
+       uint8 *ptr;
+       int remain_len;
+       int i;
+
+       ptr = (uint8 *)src;
+
+       remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+
+       for (i = HANG_INFO_TRAP_T_OFFSET_IDX;
+                       (hang_info_trap_tbl[i].name[0] != 0) && (*cnt < HANG_FIELD_CNT_MAX);
+                       i++, (*cnt)++) {
+               if (field_name) {
+                       remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+                       *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%c%s:",
+                                       HANG_RAW_DEL, hang_info_trap_tbl[i].name);
+               }
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%c%08x",
+                               HANG_RAW_DEL, *(uint32 *)(ptr + hang_info_trap_tbl[i].offset));
+       }
+}
+
+static void
+copy_hang_info_stack(dhd_pub_t *dhd, char *dest, int *bytes_written, int *cnt)
+{
+       int remain_len;
+       int i = 0;
+       const uint32 *stack;
+       uint32 *ext_data = dhd->extended_trap_data;
+       hnd_ext_trap_hdr_t *hdr;
+       const bcm_tlv_t *tlv;
+       int remain_stack_cnt = 0;
+       uint32 dummy_data = 0;
+       int bigdata_key_stack_cnt = 0;
+
+       if (ext_data == NULL) {
+               return;
+       }
+       /* First word is original trap_data */
+       ext_data++;
+
+       /* Followed by the extended trap data header */
+       hdr = (hnd_ext_trap_hdr_t *)ext_data;
+
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_STACK);
+
+       remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       if (tlv) {
+               stack = (const uint32 *)tlv->data;
+               *bytes_written += scnprintf(&dest[*bytes_written], remain_len,
+                               "%08x", *(uint32 *)(stack++));
+               (*cnt)++;
+               if (*cnt >= HANG_FIELD_CNT_MAX) {
+                       return;
+               }
+               for (i = 1; i < (uint32)(tlv->len / sizeof(uint32)); i++, bigdata_key_stack_cnt++) {
+                       remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+                       /* Raw data for bigdata use '_' and Key data for bigdata use space */
+                       *bytes_written += scnprintf(&dest[*bytes_written], remain_len,
+                               "%c%08x",
+                               i <= HANG_INFO_BIGDATA_KEY_STACK_CNT ? HANG_KEY_DEL : HANG_RAW_DEL,
+                               *(uint32 *)(stack++));
+
+                       (*cnt)++;
+                       if ((*cnt >= HANG_FIELD_CNT_MAX) ||
+                                       (i >= HANG_FIELD_TRAP_T_STACK_CNT_MAX)) {
+                               return;
+                       }
+               }
+       }
+
+       remain_stack_cnt = HANG_FIELD_TRAP_T_STACK_CNT_MAX - i;
+
+       for (i = 0; i < remain_stack_cnt; i++) {
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%c%08x",
+                               HANG_RAW_DEL, dummy_data);
+               (*cnt)++;
+               if (*cnt >= HANG_FIELD_CNT_MAX) {
+                       return;
+               }
+       }
+       GCC_DIAGNOSTIC_POP();
+
+}
+
+static void
+copy_hang_info_specific(dhd_pub_t *dhd, char *dest, int *bytes_written, int *cnt)
+{
+       int remain_len;
+       int i;
+       const uint32 *data;
+       uint32 *ext_data = dhd->extended_trap_data;
+       hnd_ext_trap_hdr_t *hdr;
+       const bcm_tlv_t *tlv;
+       int remain_trap_data = 0;
+       uint8 buf_u8[sizeof(uint32)] = { 0, };
+       const uint8 *p_u8;
+
+       if (ext_data == NULL) {
+               return;
+       }
+       /* First word is original trap_data */
+       ext_data++;
+
+       /* Followed by the extended trap data header */
+       hdr = (hnd_ext_trap_hdr_t *)ext_data;
+
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_SIGNATURE);
+       if (tlv) {
+               /* header include tlv hader */
+               remain_trap_data = (hdr->len - tlv->len - sizeof(uint16));
+       }
+
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_STACK);
+       if (tlv) {
+               /* header include tlv hader */
+               remain_trap_data -= (tlv->len + sizeof(uint16));
+       }
+
+       data = (const uint32 *)(hdr->data + (hdr->len  - remain_trap_data));
+
+       remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+
+       for (i = 0; i < (uint32)(remain_trap_data / sizeof(uint32)) && *cnt < HANG_FIELD_CNT_MAX;
+                       i++, (*cnt)++) {
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%c%08x",
+                               HANG_RAW_DEL, *(uint32 *)(data++));
+               GCC_DIAGNOSTIC_POP();
+       }
+
+       if (*cnt >= HANG_FIELD_CNT_MAX) {
+               return;
+       }
+
+       remain_trap_data -= (sizeof(uint32) * i);
+
+       if (remain_trap_data > sizeof(buf_u8)) {
+               DHD_ERROR(("%s: resize remain_trap_data\n", __FUNCTION__));
+               remain_trap_data =  sizeof(buf_u8);
+       }
+
+       if (remain_trap_data) {
+               p_u8 = (const uint8 *)data;
+               for (i = 0; i < remain_trap_data; i++) {
+                       buf_u8[i] = *(const uint8 *)(p_u8++);
+               }
+
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%c%08x",
+                               HANG_RAW_DEL, ltoh32_ua(buf_u8));
+               (*cnt)++;
+       }
+}
+#endif /* DHD_EWPR_VER2 */
+
+static void
+get_hang_info_trap_subtype(dhd_pub_t *dhd, uint32 *subtype)
+{
+       uint32 i;
+       uint32 *ext_data = dhd->extended_trap_data;
+       hnd_ext_trap_hdr_t *hdr;
+       const bcm_tlv_t *tlv;
+
+       /* First word is original trap_data */
+       ext_data++;
+
+       /* Followed by the extended trap data header */
+       hdr = (hnd_ext_trap_hdr_t *)ext_data;
+
+       /* Dump a list of all tags found  before parsing data */
+       for (i = TAG_TRAP_DEEPSLEEP; i < TAG_TRAP_LAST; i++) {
+               tlv = bcm_parse_tlvs(hdr->data, hdr->len, i);
+               if (tlv) {
+                       if (!TAG_TRAP_IS_STATE(i)) {
+                               *subtype = i;
+                               return;
+                       }
+               }
+       }
+}
+#ifdef DHD_EWPR_VER2
+static void
+copy_hang_info_etd_base64(dhd_pub_t *dhd, char *dest, int *bytes_written, int *cnt)
+{
+       int remain_len;
+       uint32 *ext_data = dhd->extended_trap_data;
+       hnd_ext_trap_hdr_t *hdr;
+       char *base64_out = NULL;
+       int base64_cnt;
+       int max_base64_len = HANG_INFO_BASE64_BUFFER_SIZE;
+
+       if (ext_data == NULL) {
+               return;
+       }
+       /* First word is original trap_data */
+       ext_data++;
+
+       /* Followed by the extended trap data header */
+       hdr = (hnd_ext_trap_hdr_t *)ext_data;
+
+       remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+
+       if (remain_len <= 0) {
+               DHD_ERROR(("%s: no space to put etd\n", __FUNCTION__));
+               return;
+       }
+
+       if (remain_len < max_base64_len) {
+               DHD_ERROR(("%s: change max base64 length to remain length %d\n", __FUNCTION__,
+                       remain_len));
+               max_base64_len = remain_len;
+       }
+
+       base64_out = MALLOCZ(dhd->osh, HANG_INFO_BASE64_BUFFER_SIZE);
+       if (base64_out == NULL) {
+               DHD_ERROR(("%s: MALLOC failed for size %d\n",
+                       __FUNCTION__, HANG_INFO_BASE64_BUFFER_SIZE));
+               return;
+       }
+
+       if (hdr->len > 0) {
+               base64_cnt = dhd_base64_encode(hdr->data, hdr->len, base64_out, max_base64_len);
+               if (base64_cnt == 0) {
+                       DHD_ERROR(("%s: base64 encoding error\n", __FUNCTION__));
+               }
+       }
+
+       *bytes_written += scnprintf(&dest[*bytes_written], remain_len, "%s",
+                       base64_out);
+       (*cnt)++;
+       MFREE(dhd->osh, base64_out, HANG_INFO_BASE64_BUFFER_SIZE);
+}
+#endif /* DHD_EWPR_VER2 */
+
+void
+copy_hang_info_trap(dhd_pub_t *dhd)
+{
+       trap_t tr;
+       int bytes_written;
+       int trap_subtype = 0;
+
+       if (!dhd || !dhd->hang_info) {
+               DHD_ERROR(("%s dhd=%p hang_info=%p\n", __FUNCTION__,
+                       dhd, (dhd ? dhd->hang_info : NULL)));
+               return;
+       }
+
+       if (!dhd->dongle_trap_occured) {
+               DHD_ERROR(("%s: dongle_trap_occured is FALSE\n", __FUNCTION__));
+               return;
+       }
+
+       memset(&tr, 0x00, sizeof(struct _trap_struct));
+
+       copy_ext_trap_sig(dhd, &tr);
+       get_hang_info_trap_subtype(dhd, &trap_subtype);
+
+       hang_info_trap_tbl[HANG_INFO_TRAP_T_REASON_IDX].offset = HANG_REASON_DONGLE_TRAP;
+       hang_info_trap_tbl[HANG_INFO_TRAP_T_SUBTYPE_IDX].offset = trap_subtype;
+
+       bytes_written = 0;
+       dhd->hang_info_cnt = 0;
+       get_debug_dump_time(dhd->debug_dump_time_hang_str);
+       copy_debug_dump_time(dhd->debug_dump_time_str, dhd->debug_dump_time_hang_str);
+
+       copy_hang_info_head(dhd->hang_info, &tr, VENDOR_SEND_HANG_EXT_INFO_LEN, FALSE,
+                       &bytes_written, &dhd->hang_info_cnt, dhd->debug_dump_time_hang_str);
+
+       DHD_INFO(("hang info haed cnt: %d len: %d data: %s\n",
+               dhd->hang_info_cnt, (int)strlen(dhd->hang_info), dhd->hang_info));
+
+       clear_debug_dump_time(dhd->debug_dump_time_hang_str);
+
+#ifdef DHD_EWPR_VER2
+       /* stack info & trap info are included in etd data */
+
+       /* extended trap data dump */
+       if (dhd->hang_info_cnt < HANG_FIELD_CNT_MAX) {
+               copy_hang_info_etd_base64(dhd, dhd->hang_info, &bytes_written, &dhd->hang_info_cnt);
+               DHD_INFO(("hang info specific cnt: %d len: %d data: %s\n",
+                       dhd->hang_info_cnt, (int)strlen(dhd->hang_info), dhd->hang_info));
+       }
+#else
+       if (dhd->hang_info_cnt < HANG_FIELD_CNT_MAX) {
+               copy_hang_info_stack(dhd, dhd->hang_info, &bytes_written, &dhd->hang_info_cnt);
+               DHD_INFO(("hang info stack cnt: %d len: %d data: %s\n",
+                       dhd->hang_info_cnt, (int)strlen(dhd->hang_info), dhd->hang_info));
+       }
+
+       if (dhd->hang_info_cnt < HANG_FIELD_CNT_MAX) {
+               copy_hang_info_trap_t(dhd->hang_info, &tr, VENDOR_SEND_HANG_EXT_INFO_LEN, FALSE,
+                               &bytes_written, &dhd->hang_info_cnt, dhd->debug_dump_time_hang_str);
+               DHD_INFO(("hang info trap_t cnt: %d len: %d data: %s\n",
+                       dhd->hang_info_cnt, (int)strlen(dhd->hang_info), dhd->hang_info));
+       }
+
+       if (dhd->hang_info_cnt < HANG_FIELD_CNT_MAX) {
+               copy_hang_info_specific(dhd, dhd->hang_info, &bytes_written, &dhd->hang_info_cnt);
+               DHD_INFO(("hang info specific cnt: %d len: %d data: %s\n",
+                       dhd->hang_info_cnt, (int)strlen(dhd->hang_info), dhd->hang_info));
+       }
+#endif /* DHD_EWPR_VER2 */
+}
+
+void
+copy_hang_info_linkdown(dhd_pub_t *dhd)
+{
+       int bytes_written = 0;
+       int remain_len;
+
+       if (!dhd || !dhd->hang_info) {
+               DHD_ERROR(("%s dhd=%p hang_info=%p\n", __FUNCTION__,
+                       dhd, (dhd ? dhd->hang_info : NULL)));
+               return;
+       }
+
+       if (!dhd->bus->is_linkdown) {
+               DHD_ERROR(("%s: link down is not happened\n", __FUNCTION__));
+               return;
+       }
+
+       dhd->hang_info_cnt = 0;
+
+       get_debug_dump_time(dhd->debug_dump_time_hang_str);
+       copy_debug_dump_time(dhd->debug_dump_time_str, dhd->debug_dump_time_hang_str);
+
+       /* hang reason code (0x8808) */
+       if (dhd->hang_info_cnt < HANG_FIELD_CNT_MAX) {
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - bytes_written;
+               bytes_written += scnprintf(&dhd->hang_info[bytes_written], remain_len, "%d%c",
+                               HANG_REASON_PCIE_LINK_DOWN_EP_DETECT, HANG_KEY_DEL);
+               dhd->hang_info_cnt++;
+       }
+
+       /* EWP version */
+       if (dhd->hang_info_cnt < HANG_FIELD_CNT_MAX) {
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - bytes_written;
+               bytes_written += scnprintf(&dhd->hang_info[bytes_written], remain_len, "%d%c",
+                               VENDOR_SEND_HANG_EXT_INFO_VER, HANG_KEY_DEL);
+               dhd->hang_info_cnt++;
+       }
+
+       /* cookie - dump time stamp */
+       if (dhd->hang_info_cnt < HANG_FIELD_CNT_MAX) {
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - bytes_written;
+               bytes_written += scnprintf(&dhd->hang_info[bytes_written], remain_len, "%s%c",
+                               dhd->debug_dump_time_hang_str, HANG_KEY_DEL);
+               dhd->hang_info_cnt++;
+       }
+
+       clear_debug_dump_time(dhd->debug_dump_time_hang_str);
+
+       /* dump PCIE RC registers */
+       dhd_dump_pcie_rc_regs_for_linkdown(dhd, &bytes_written);
+
+       DHD_INFO(("hang info haed cnt: %d len: %d data: %s\n",
+               dhd->hang_info_cnt, (int)strlen(dhd->hang_info), dhd->hang_info));
+
+}
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+
+int
+dhd_prot_debug_info_print(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       msgbuf_ring_t *ring;
+       uint16 rd, wr, drd, dwr;
+       uint32 dma_buf_len;
+       uint64 current_time;
+       ulong ring_tcm_rd_addr; /* dongle address */
+       ulong ring_tcm_wr_addr; /* dongle address */
+
+       DHD_ERROR(("\n ------- DUMPING VERSION INFORMATION ------- \r\n"));
+       DHD_ERROR(("DHD: %s\n", dhd_version));
+       DHD_ERROR(("Firmware: %s\n", fw_version));
+
+#ifdef DHD_FW_COREDUMP
+       DHD_ERROR(("\n ------- DUMPING CONFIGURATION INFORMATION ------ \r\n"));
+       DHD_ERROR(("memdump mode: %d\n", dhd->memdump_enabled));
+#endif /* DHD_FW_COREDUMP */
+
+       DHD_ERROR(("\n ------- DUMPING PROTOCOL INFORMATION ------- \r\n"));
+       DHD_ERROR(("ICPrevs: Dev %d, Host %d, active %d\n",
+               prot->device_ipc_version,
+               prot->host_ipc_version,
+               prot->active_ipc_version));
+       DHD_ERROR(("d2h_intr_method -> %s\n",
+                       dhd->bus->d2h_intr_method ? "PCIE_MSI" : "PCIE_INTX"));
+       DHD_ERROR(("max Host TS bufs to post: %d, posted %d\n",
+               prot->max_tsbufpost, prot->cur_ts_bufs_posted));
+       DHD_ERROR(("max INFO bufs to post: %d, posted %d\n",
+               prot->max_infobufpost, prot->infobufpost));
+       DHD_ERROR(("max event bufs to post: %d, posted %d\n",
+               prot->max_eventbufpost, prot->cur_event_bufs_posted));
+       DHD_ERROR(("max ioctlresp bufs to post: %d, posted %d\n",
+               prot->max_ioctlrespbufpost, prot->cur_ioctlresp_bufs_posted));
+       DHD_ERROR(("max RX bufs to post: %d, posted %d\n",
+               prot->max_rxbufpost, prot->rxbufpost));
+       DHD_ERROR(("h2d_max_txpost: %d, prot->h2d_max_txpost: %d\n",
+               h2d_max_txpost, prot->h2d_max_txpost));
+#if defined(DHD_HTPUT_TUNABLES)
+       DHD_ERROR(("h2d_max_txpost: %d, prot->h2d_max_txpost: %d\n",
+               h2d_htput_max_txpost, prot->h2d_htput_max_txpost));
+#endif /* DHD_HTPUT_TUNABLES */
+
+       current_time = OSL_LOCALTIME_NS();
+       DHD_ERROR(("current_time="SEC_USEC_FMT"\n", GET_SEC_USEC(current_time)));
+       DHD_ERROR(("ioctl_fillup_time="SEC_USEC_FMT
+               " ioctl_ack_time="SEC_USEC_FMT
+               " ioctl_cmplt_time="SEC_USEC_FMT"\n",
+               GET_SEC_USEC(prot->ioctl_fillup_time),
+               GET_SEC_USEC(prot->ioctl_ack_time),
+               GET_SEC_USEC(prot->ioctl_cmplt_time)));
+
+       /* Check PCIe INT registers */
+       if (!dhd_pcie_dump_int_regs(dhd)) {
+               DHD_ERROR(("%s : PCIe link might be down\n", __FUNCTION__));
+               dhd->bus->is_linkdown = TRUE;
+       }
+
+       DHD_ERROR(("\n ------- DUMPING IOCTL RING RD WR Pointers ------- \r\n"));
+
+       ring = &prot->h2dring_ctrl_subn;
+       dma_buf_len = ring->max_items * ring->item_len;
+       ring_tcm_rd_addr = dhd->bus->ring_sh[ring->idx].ring_state_r;
+       ring_tcm_wr_addr = dhd->bus->ring_sh[ring->idx].ring_state_w;
+       DHD_ERROR(("CtrlPost: Mem Info: BASE(VA) %p BASE(PA) %x:%x tcm_rd_wr 0x%lx:0x%lx "
+               "SIZE %d \r\n",
+               ring->dma_buf.va, ltoh32(ring->base_addr.high_addr),
+               ltoh32(ring->base_addr.low_addr), ring_tcm_rd_addr, ring_tcm_wr_addr, dma_buf_len));
+       DHD_ERROR(("CtrlPost: From Host mem: RD: %d WR %d \r\n", ring->rd, ring->wr));
+       if (dhd->dma_d2h_ring_upd_support) {
+               drd = dhd_prot_dma_indx_get(dhd, H2D_DMA_INDX_RD_UPD, ring->idx);
+               dwr = dhd_prot_dma_indx_get(dhd, H2D_DMA_INDX_WR_UPD, ring->idx);
+               DHD_ERROR(("CtrlPost: From Host DMA mem: RD: %d WR %d \r\n", drd, dwr));
+       }
+       if (dhd->bus->is_linkdown) {
+               DHD_ERROR(("CtrlPost: From Shared Mem: RD and WR are invalid"
+                       " due to PCIe link down\r\n"));
+       } else {
+               dhd_bus_cmn_readshared(dhd->bus, &rd, RING_RD_UPD, ring->idx);
+               dhd_bus_cmn_readshared(dhd->bus, &wr, RING_WR_UPD, ring->idx);
+               DHD_ERROR(("CtrlPost: From Shared Mem: RD: %d WR %d \r\n", rd, wr));
+       }
+       DHD_ERROR(("CtrlPost: seq num: %d \r\n", ring->seqnum % H2D_EPOCH_MODULO));
+
+       ring = &prot->d2hring_ctrl_cpln;
+       dma_buf_len = ring->max_items * ring->item_len;
+       ring_tcm_rd_addr = dhd->bus->ring_sh[ring->idx].ring_state_r;
+       ring_tcm_wr_addr = dhd->bus->ring_sh[ring->idx].ring_state_w;
+       DHD_ERROR(("CtrlCpl: Mem Info: BASE(VA) %p BASE(PA) %x:%x tcm_rd_wr 0x%lx:0x%lx "
+               "SIZE %d \r\n",
+               ring->dma_buf.va, ltoh32(ring->base_addr.high_addr),
+               ltoh32(ring->base_addr.low_addr), ring_tcm_rd_addr, ring_tcm_wr_addr, dma_buf_len));
+       DHD_ERROR(("CtrlCpl: From Host mem: RD: %d WR %d \r\n", ring->rd, ring->wr));
+       if (dhd->dma_d2h_ring_upd_support) {
+               drd = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_RD_UPD, ring->idx);
+               dwr = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_WR_UPD, ring->idx);
+               DHD_ERROR(("CtrlCpl: From Host DMA mem: RD: %d WR %d \r\n", drd, dwr));
+       }
+       if (dhd->bus->is_linkdown) {
+               DHD_ERROR(("CtrlCpl: From Shared Mem: RD and WR are invalid"
+                       " due to PCIe link down\r\n"));
+       } else {
+               dhd_bus_cmn_readshared(dhd->bus, &rd, RING_RD_UPD, ring->idx);
+               dhd_bus_cmn_readshared(dhd->bus, &wr, RING_WR_UPD, ring->idx);
+               DHD_ERROR(("CtrlCpl: From Shared Mem: RD: %d WR %d \r\n", rd, wr));
+       }
+       DHD_ERROR(("CtrlCpl: Expected seq num: %d \r\n", ring->seqnum % H2D_EPOCH_MODULO));
+
+       ring = prot->h2dring_info_subn;
+       if (ring) {
+               dma_buf_len = ring->max_items * ring->item_len;
+               ring_tcm_rd_addr = dhd->bus->ring_sh[ring->idx].ring_state_r;
+               ring_tcm_wr_addr = dhd->bus->ring_sh[ring->idx].ring_state_w;
+               DHD_ERROR(("InfoSub: Mem Info: BASE(VA) %p BASE(PA) %x:%x tcm_rd_wr 0x%lx:0x%lx "
+                       "SIZE %d \r\n",
+                       ring->dma_buf.va, ltoh32(ring->base_addr.high_addr),
+                       ltoh32(ring->base_addr.low_addr), ring_tcm_rd_addr, ring_tcm_wr_addr,
+                       dma_buf_len));
+               DHD_ERROR(("InfoSub: From Host mem: RD: %d WR %d \r\n", ring->rd, ring->wr));
+               if (dhd->dma_d2h_ring_upd_support) {
+                       drd = dhd_prot_dma_indx_get(dhd, H2D_DMA_INDX_RD_UPD, ring->idx);
+                       dwr = dhd_prot_dma_indx_get(dhd, H2D_DMA_INDX_WR_UPD, ring->idx);
+                       DHD_ERROR(("InfoSub: From Host DMA mem: RD: %d WR %d \r\n", drd, dwr));
+               }
+               if (dhd->bus->is_linkdown) {
+                       DHD_ERROR(("InfoSub: From Shared Mem: RD and WR are invalid"
+                               " due to PCIe link down\r\n"));
+               } else {
+                       dhd_bus_cmn_readshared(dhd->bus, &rd, RING_RD_UPD, ring->idx);
+                       dhd_bus_cmn_readshared(dhd->bus, &wr, RING_WR_UPD, ring->idx);
+                       DHD_ERROR(("InfoSub: From Shared Mem: RD: %d WR %d \r\n", rd, wr));
+               }
+               DHD_ERROR(("InfoSub: seq num: %d \r\n", ring->seqnum % H2D_EPOCH_MODULO));
+       }
+       ring = prot->d2hring_info_cpln;
+       if (ring) {
+               dma_buf_len = ring->max_items * ring->item_len;
+               ring_tcm_rd_addr = dhd->bus->ring_sh[ring->idx].ring_state_r;
+               ring_tcm_wr_addr = dhd->bus->ring_sh[ring->idx].ring_state_w;
+               DHD_ERROR(("InfoCpl: Mem Info: BASE(VA) %p BASE(PA) %x:%x tcm_rd_wr 0x%lx:0x%lx "
+                       "SIZE %d \r\n",
+                       ring->dma_buf.va, ltoh32(ring->base_addr.high_addr),
+                       ltoh32(ring->base_addr.low_addr), ring_tcm_rd_addr, ring_tcm_wr_addr,
+                       dma_buf_len));
+               DHD_ERROR(("InfoCpl: From Host mem: RD: %d WR %d \r\n", ring->rd, ring->wr));
+               if (dhd->dma_d2h_ring_upd_support) {
+                       drd = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_RD_UPD, ring->idx);
+                       dwr = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_WR_UPD, ring->idx);
+                       DHD_ERROR(("InfoCpl: From Host DMA mem: RD: %d WR %d \r\n", drd, dwr));
+               }
+               if (dhd->bus->is_linkdown) {
+                       DHD_ERROR(("InfoCpl: From Shared Mem: RD and WR are invalid"
+                               " due to PCIe link down\r\n"));
+               } else {
+                       dhd_bus_cmn_readshared(dhd->bus, &rd, RING_RD_UPD, ring->idx);
+                       dhd_bus_cmn_readshared(dhd->bus, &wr, RING_WR_UPD, ring->idx);
+                       DHD_ERROR(("InfoCpl: From Shared Mem: RD: %d WR %d \r\n", rd, wr));
+               }
+               DHD_ERROR(("InfoCpl: Expected seq num: %d \r\n", ring->seqnum % D2H_EPOCH_MODULO));
+       }
+#ifdef EWP_EDL
+       ring = prot->d2hring_edl;
+       if (ring) {
+               ring_tcm_rd_addr = dhd->bus->ring_sh[ring->idx].ring_state_r;
+               ring_tcm_wr_addr = dhd->bus->ring_sh[ring->idx].ring_state_w;
+               dma_buf_len = ring->max_items * ring->item_len;
+               DHD_ERROR(("EdlRing: Mem Info: BASE(VA) %p BASE(PA) %x:%x tcm_rd_wr 0x%lx:0x%lx "
+                       "SIZE %d \r\n",
+                       ring->dma_buf.va, ltoh32(ring->base_addr.high_addr),
+                       ltoh32(ring->base_addr.low_addr), ring_tcm_rd_addr, ring_tcm_wr_addr,
+                       dma_buf_len));
+               DHD_ERROR(("EdlRing: From Host mem: RD: %d WR %d \r\n", ring->rd, ring->wr));
+               if (dhd->dma_d2h_ring_upd_support) {
+                       drd = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_RD_UPD, ring->idx);
+                       dwr = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_WR_UPD, ring->idx);
+                       DHD_ERROR(("EdlRing: From Host DMA mem: RD: %d WR %d \r\n", drd, dwr));
+               }
+               if (dhd->bus->is_linkdown) {
+                       DHD_ERROR(("EdlRing: From Shared Mem: RD and WR are invalid"
+                               " due to PCIe link down\r\n"));
+               } else {
+                       dhd_bus_cmn_readshared(dhd->bus, &rd, RING_RD_UPD, ring->idx);
+                       dhd_bus_cmn_readshared(dhd->bus, &wr, RING_WR_UPD, ring->idx);
+                       DHD_ERROR(("EdlRing: From Shared Mem: RD: %d WR %d \r\n", rd, wr));
+               }
+               DHD_ERROR(("EdlRing: Expected seq num: %d \r\n",
+                       ring->seqnum % D2H_EPOCH_MODULO));
+       }
+#endif /* EWP_EDL */
+
+       ring = &prot->d2hring_tx_cpln;
+       if (ring) {
+               ring_tcm_rd_addr = dhd->bus->ring_sh[ring->idx].ring_state_r;
+               ring_tcm_wr_addr = dhd->bus->ring_sh[ring->idx].ring_state_w;
+               dma_buf_len = ring->max_items * ring->item_len;
+               DHD_ERROR(("TxCpl: Mem Info: BASE(VA) %p BASE(PA) %x:%x tcm_rd_wr 0x%lx:0x%lx "
+                       "SIZE %d \r\n",
+                       ring->dma_buf.va, ltoh32(ring->base_addr.high_addr),
+                       ltoh32(ring->base_addr.low_addr), ring_tcm_rd_addr, ring_tcm_wr_addr,
+                       dma_buf_len));
+               DHD_ERROR(("TxCpl: From Host mem: RD: %d WR %d \r\n", ring->rd, ring->wr));
+               if (dhd->dma_d2h_ring_upd_support) {
+                       drd = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_RD_UPD, ring->idx);
+                       dwr = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_WR_UPD, ring->idx);
+                       DHD_ERROR(("TxCpl: From Host DMA mem: RD: %d WR %d \r\n", drd, dwr));
+               }
+               if (dhd->bus->is_linkdown) {
+                       DHD_ERROR(("TxCpl: From Shared Mem: RD and WR are invalid"
+                               " due to PCIe link down\r\n"));
+               } else {
+                       dhd_bus_cmn_readshared(dhd->bus, &rd, RING_RD_UPD, ring->idx);
+                       dhd_bus_cmn_readshared(dhd->bus, &wr, RING_WR_UPD, ring->idx);
+                       DHD_ERROR(("TxCpl: From Shared Mem: RD: %d WR %d \r\n", rd, wr));
+               }
+               DHD_ERROR(("TxCpl: Expected seq num: %d \r\n", ring->seqnum % D2H_EPOCH_MODULO));
+       }
+
+       ring = &prot->d2hring_rx_cpln;
+       if (ring) {
+               ring_tcm_rd_addr = dhd->bus->ring_sh[ring->idx].ring_state_r;
+               ring_tcm_wr_addr = dhd->bus->ring_sh[ring->idx].ring_state_w;
+               dma_buf_len = ring->max_items * ring->item_len;
+               DHD_ERROR(("RxCpl: Mem Info: BASE(VA) %p BASE(PA) %x:%x tcm_rd_wr 0x%lx:0x%lx "
+                       "SIZE %d \r\n",
+                       ring->dma_buf.va, ltoh32(ring->base_addr.high_addr),
+                       ltoh32(ring->base_addr.low_addr), ring_tcm_rd_addr, ring_tcm_wr_addr,
+                       dma_buf_len));
+               DHD_ERROR(("RxCpl: From Host mem: RD: %d WR %d \r\n", ring->rd, ring->wr));
+               if (dhd->dma_d2h_ring_upd_support) {
+                       drd = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_RD_UPD, ring->idx);
+                       dwr = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_WR_UPD, ring->idx);
+                       DHD_ERROR(("RxCpl: From Host DMA mem: RD: %d WR %d \r\n", drd, dwr));
+               }
+               if (dhd->bus->is_linkdown) {
+                       DHD_ERROR(("RxCpl: From Shared Mem: RD and WR are invalid"
+                               " due to PCIe link down\r\n"));
+               } else {
+                       dhd_bus_cmn_readshared(dhd->bus, &rd, RING_RD_UPD, ring->idx);
+                       dhd_bus_cmn_readshared(dhd->bus, &wr, RING_WR_UPD, ring->idx);
+                       DHD_ERROR(("RxCpl: From Shared Mem: RD: %d WR %d \r\n", rd, wr));
+               }
+               DHD_ERROR(("RxCpl: Expected seq num: %d \r\n", ring->seqnum % D2H_EPOCH_MODULO));
+       }
+
+       ring = &prot->h2dring_rxp_subn;
+       if (ring) {
+               ring_tcm_rd_addr = dhd->bus->ring_sh[ring->idx].ring_state_r;
+               ring_tcm_wr_addr = dhd->bus->ring_sh[ring->idx].ring_state_w;
+               dma_buf_len = ring->max_items * ring->item_len;
+               DHD_ERROR(("RxSub: Mem Info: BASE(VA) %p BASE(PA) %x:%x tcm_rd_wr 0x%lx:0x%lx "
+                       "SIZE %d \r\n",
+                       ring->dma_buf.va, ltoh32(ring->base_addr.high_addr),
+                       ltoh32(ring->base_addr.low_addr), ring_tcm_rd_addr, ring_tcm_wr_addr,
+                       dma_buf_len));
+               DHD_ERROR(("RxSub: From Host mem: RD: %d WR %d \r\n", ring->rd, ring->wr));
+               if (dhd->dma_d2h_ring_upd_support) {
+                       drd = dhd_prot_dma_indx_get(dhd, H2D_DMA_INDX_RD_UPD, ring->idx);
+                       dwr = dhd_prot_dma_indx_get(dhd, H2D_DMA_INDX_WR_UPD, ring->idx);
+                       DHD_ERROR(("RxSub: From Host DMA mem: RD: %d WR %d \r\n", drd, dwr));
+               }
+               if (dhd->bus->is_linkdown) {
+                       DHD_ERROR(("RxSub: From Shared Mem: RD and WR are invalid"
+                               " due to PCIe link down\r\n"));
+               } else {
+                       dhd_bus_cmn_readshared(dhd->bus, &rd, RING_RD_UPD, ring->idx);
+                       dhd_bus_cmn_readshared(dhd->bus, &wr, RING_WR_UPD, ring->idx);
+                       DHD_ERROR(("RxSub: From Shared Mem: RD: %d WR %d \r\n", rd, wr));
+               }
+               DHD_ERROR(("RxSub: Expected seq num: %d \r\n", ring->seqnum % D2H_EPOCH_MODULO));
+       }
+
+       DHD_ERROR(("%s: cur_ioctlresp_bufs_posted %d cur_event_bufs_posted %d\n",
+               __FUNCTION__, prot->cur_ioctlresp_bufs_posted, prot->cur_event_bufs_posted));
+#ifdef DHD_LIMIT_MULTI_CLIENT_FLOWRINGS
+       DHD_ERROR(("%s: multi_client_flow_rings:%d max_multi_client_flow_rings:%d\n",
+               __FUNCTION__, dhd->multi_client_flow_rings, dhd->max_multi_client_flow_rings));
+#endif /* DHD_LIMIT_MULTI_CLIENT_FLOWRINGS */
+
+       DHD_ERROR(("pktid_txq_start_cnt: %d\n", prot->pktid_txq_start_cnt));
+       DHD_ERROR(("pktid_txq_stop_cnt: %d\n", prot->pktid_txq_stop_cnt));
+       DHD_ERROR(("pktid_depleted_cnt: %d\n", prot->pktid_depleted_cnt));
+
+       dhd_pcie_debug_info_dump(dhd);
+       return 0;
+}
+
+int
+dhd_prot_ringupd_dump(dhd_pub_t *dhd, struct bcmstrbuf *b)
+{
+       uint32 *ptr;
+       uint32 value;
+
+       if (dhd->prot->d2h_dma_indx_wr_buf.va) {
+               uint32 i;
+               uint32 max_h2d_queues = dhd_bus_max_h2d_queues(dhd->bus);
+
+               OSL_CACHE_INV((void *)dhd->prot->d2h_dma_indx_wr_buf.va,
+                       dhd->prot->d2h_dma_indx_wr_buf.len);
+
+               ptr = (uint32 *)(dhd->prot->d2h_dma_indx_wr_buf.va);
+
+               bcm_bprintf(b, "\n max_tx_queues %d\n", max_h2d_queues);
+
+               bcm_bprintf(b, "\nRPTR block H2D common rings, 0x%4p\n", ptr);
+               value = ltoh32(*ptr);
+               bcm_bprintf(b, "\tH2D CTRL: value 0x%04x\n", value);
+               ptr++;
+               value = ltoh32(*ptr);
+               bcm_bprintf(b, "\tH2D RXPOST: value 0x%04x\n", value);
+
+               ptr++;
+               bcm_bprintf(b, "RPTR block Flow rings , 0x%4p\n", ptr);
+               for (i = BCMPCIE_H2D_COMMON_MSGRINGS; i < max_h2d_queues; i++) {
+                       value = ltoh32(*ptr);
+                       bcm_bprintf(b, "\tflowring ID %d: value 0x%04x\n", i, value);
+                       ptr++;
+               }
+       }
+
+       if (dhd->prot->h2d_dma_indx_rd_buf.va) {
+               OSL_CACHE_INV((void *)dhd->prot->h2d_dma_indx_rd_buf.va,
+                       dhd->prot->h2d_dma_indx_rd_buf.len);
+
+               ptr = (uint32 *)(dhd->prot->h2d_dma_indx_rd_buf.va);
+
+               bcm_bprintf(b, "\nWPTR block D2H common rings, 0x%4p\n", ptr);
+               value = ltoh32(*ptr);
+               bcm_bprintf(b, "\tD2H CTRLCPLT: value 0x%04x\n", value);
+               ptr++;
+               value = ltoh32(*ptr);
+               bcm_bprintf(b, "\tD2H TXCPLT: value 0x%04x\n", value);
+               ptr++;
+               value = ltoh32(*ptr);
+               bcm_bprintf(b, "\tD2H RXCPLT: value 0x%04x\n", value);
+       }
+
+       return 0;
+}
+
+uint32
+dhd_prot_metadata_dbg_set(dhd_pub_t *dhd, bool val)
+{
+       dhd_prot_t *prot = dhd->prot;
+#if DHD_DBG_SHOW_METADATA
+       prot->metadata_dbg = val;
+#endif
+       return (uint32)prot->metadata_dbg;
+}
+
+uint32
+dhd_prot_metadata_dbg_get(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       return (uint32)prot->metadata_dbg;
+}
+
+uint32
+dhd_prot_metadatalen_set(dhd_pub_t *dhd, uint32 val, bool rx)
+{
+       dhd_prot_t *prot = dhd->prot;
+       if (rx)
+               prot->rx_metadata_offset = (uint16)val;
+       else
+               prot->tx_metadata_offset = (uint16)val;
+       return dhd_prot_metadatalen_get(dhd, rx);
+}
+
+uint32
+dhd_prot_metadatalen_get(dhd_pub_t *dhd, bool rx)
+{
+       dhd_prot_t *prot = dhd->prot;
+       if (rx)
+               return prot->rx_metadata_offset;
+       else
+               return prot->tx_metadata_offset;
+}
+
+/** optimization to write "n" tx items at a time to ring */
+uint32
+dhd_prot_txp_threshold(dhd_pub_t *dhd, bool set, uint32 val)
+{
+       dhd_prot_t *prot = dhd->prot;
+       if (set)
+               prot->txp_threshold = (uint16)val;
+       val = prot->txp_threshold;
+       return val;
+}
+
+#ifdef DHD_RX_CHAINING
+
+static INLINE void
+BCMFASTPATH(dhd_rxchain_reset)(rxchain_info_t *rxchain)
+{
+       rxchain->pkt_count = 0;
+}
+
+static void
+BCMFASTPATH(dhd_rxchain_frame)(dhd_pub_t *dhd, void *pkt, uint ifidx)
+{
+       uint8 *eh;
+       uint8 prio;
+       dhd_prot_t *prot = dhd->prot;
+       rxchain_info_t *rxchain = &prot->rxchain;
+
+       ASSERT(!PKTISCHAINED(pkt));
+       ASSERT(PKTCLINK(pkt) == NULL);
+       ASSERT(PKTCGETATTR(pkt) == 0);
+
+       eh = PKTDATA(dhd->osh, pkt);
+       prio = IP_TOS46(eh + ETHER_HDR_LEN) >> IPV4_TOS_PREC_SHIFT;
+
+       if (rxchain->pkt_count && !(PKT_CTF_CHAINABLE(dhd, ifidx, eh, prio, rxchain->h_sa,
+               rxchain->h_da, rxchain->h_prio))) {
+               /* Different flow - First release the existing chain */
+               dhd_rxchain_commit(dhd);
+       }
+
+       /* For routers, with HNDCTF, link the packets using PKTSETCLINK, */
+       /* so that the chain can be handed off to CTF bridge as is. */
+       if (rxchain->pkt_count == 0) {
+               /* First packet in chain */
+               rxchain->pkthead = rxchain->pkttail = pkt;
+
+               /* Keep a copy of ptr to ether_da, ether_sa and prio */
+               rxchain->h_da = ((struct ether_header *)eh)->ether_dhost;
+               rxchain->h_sa = ((struct ether_header *)eh)->ether_shost;
+               rxchain->h_prio = prio;
+               rxchain->ifidx = ifidx;
+               rxchain->pkt_count++;
+       } else {
+               /* Same flow - keep chaining */
+               PKTSETCLINK(rxchain->pkttail, pkt);
+               rxchain->pkttail = pkt;
+               rxchain->pkt_count++;
+       }
+
+       if ((dhd_rx_pkt_chainable(dhd, ifidx)) && (!ETHER_ISMULTI(rxchain->h_da)) &&
+               ((((struct ether_header *)eh)->ether_type == HTON16(ETHER_TYPE_IP)) ||
+               (((struct ether_header *)eh)->ether_type == HTON16(ETHER_TYPE_IPV6)))) {
+               PKTSETCHAINED(dhd->osh, pkt);
+               PKTCINCRCNT(rxchain->pkthead);
+               PKTCADDLEN(rxchain->pkthead, PKTLEN(dhd->osh, pkt));
+       } else {
+               dhd_rxchain_commit(dhd);
+               return;
+       }
+
+       /* If we have hit the max chain length, dispatch the chain and reset */
+       if (rxchain->pkt_count >= DHD_PKT_CTF_MAX_CHAIN_LEN) {
+               dhd_rxchain_commit(dhd);
+       }
+}
+
+static void
+BCMFASTPATH(dhd_rxchain_commit)(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       rxchain_info_t *rxchain = &prot->rxchain;
+
+       if (rxchain->pkt_count == 0)
+               return;
+
+       /* Release the packets to dhd_linux */
+       dhd_bus_rx_frame(dhd->bus, rxchain->pkthead, rxchain->ifidx, rxchain->pkt_count);
+
+       /* Reset the chain */
+       dhd_rxchain_reset(rxchain);
+}
+
+#endif /* DHD_RX_CHAINING */
+
+#ifdef IDLE_TX_FLOW_MGMT
+int
+dhd_prot_flow_ring_resume(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node)
+{
+       tx_idle_flowring_resume_request_t *flow_resume_rqst;
+       msgbuf_ring_t *flow_ring;
+       dhd_prot_t *prot = dhd->prot;
+       unsigned long flags;
+       uint16 alloced = 0;
+       msgbuf_ring_t *ctrl_ring = &prot->h2dring_ctrl_subn;
+
+       /* Fetch a pre-initialized msgbuf_ring from the flowring pool */
+       flow_ring = dhd_prot_flowrings_pool_fetch(dhd, flow_ring_node->flowid);
+       if (flow_ring == NULL) {
+               DHD_ERROR(("%s: dhd_prot_flowrings_pool_fetch TX Flowid %d failed\n",
+                       __FUNCTION__, flow_ring_node->flowid));
+               return BCME_NOMEM;
+       }
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK)
+               return BCME_ERROR;
+#endif /* PCIE_INB_DW */
+
+       DHD_RING_LOCK(ctrl_ring->ring_lock, flags);
+
+       /* Request for ctrl_ring buffer space */
+       flow_resume_rqst = (tx_idle_flowring_resume_request_t *)
+               dhd_prot_alloc_ring_space(dhd, ctrl_ring, 1, &alloced, FALSE);
+
+       if (flow_resume_rqst == NULL) {
+               dhd_prot_flowrings_pool_release(dhd, flow_ring_node->flowid, flow_ring);
+               DHD_ERROR(("%s: Flow resume Req flowid %d - failure ring space\n",
+                       __FUNCTION__, flow_ring_node->flowid));
+               DHD_RING_UNLOCK(ctrl_ring->ring_lock, flags);
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+               return BCME_NOMEM;
+       }
+
+       flow_ring_node->prot_info = (void *)flow_ring;
+
+       /* Common msg buf hdr */
+       flow_resume_rqst->msg.msg_type = MSG_TYPE_FLOW_RING_RESUME;
+       flow_resume_rqst->msg.if_id = (uint8)flow_ring_node->flow_info.ifindex;
+       flow_resume_rqst->msg.request_id = htol32(0); /* TBD */
+
+       flow_resume_rqst->msg.epoch = ctrl_ring->seqnum % H2D_EPOCH_MODULO;
+       ctrl_ring->seqnum++;
+
+       flow_resume_rqst->flow_ring_id = htol16((uint16)flow_ring_node->flowid);
+       DHD_ERROR(("%s Send Flow resume Req flow ID %d\n",
+               __FUNCTION__, flow_ring_node->flowid));
+
+       /* Update the flow_ring's WRITE index */
+       if (IDMA_ACTIVE(dhd) || dhd->dma_h2d_ring_upd_support) {
+               dhd_prot_dma_indx_set(dhd, flow_ring->wr,
+                                     H2D_DMA_INDX_WR_UPD, flow_ring->idx);
+       } else if (IFRM_ACTIVE(dhd) && (flow_ring->idx >= BCMPCIE_H2D_MSGRING_TXFLOW_IDX_START)) {
+               dhd_prot_dma_indx_set(dhd, flow_ring->wr,
+                       H2D_IFRM_INDX_WR_UPD,
+                       (flow_ring->idx - BCMPCIE_H2D_MSGRING_TXFLOW_IDX_START));
+       } else {
+               dhd_bus_cmn_writeshared(dhd->bus, &(flow_ring->wr),
+                       sizeof(uint16), RING_WR_UPD, flow_ring->idx);
+       }
+
+       /* update control subn ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ctrl_ring, flow_resume_rqst, 1);
+
+       DHD_RING_UNLOCK(ctrl_ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+       return BCME_OK;
+} /* dhd_prot_flow_ring_create */
+
+int
+dhd_prot_flow_ring_batch_suspend_request(dhd_pub_t *dhd, uint16 *ringid, uint16 count)
+{
+       tx_idle_flowring_suspend_request_t *flow_suspend_rqst;
+       dhd_prot_t *prot = dhd->prot;
+       unsigned long flags;
+       uint16 index;
+       uint16 alloced = 0;
+       msgbuf_ring_t *ring = &prot->h2dring_ctrl_subn;
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhd->bus) != BCME_OK)
+               return BCME_ERROR;
+#endif /* PCIE_INB_DW */
+
+       DHD_RING_LOCK(ring->ring_lock, flags);
+
+       /* Request for ring buffer space */
+       flow_suspend_rqst = (tx_idle_flowring_suspend_request_t *)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+
+       if (flow_suspend_rqst == NULL) {
+               DHD_RING_UNLOCK(ring->ring_lock, flags);
+               DHD_ERROR(("%s: Flow suspend Req - failure ring space\n", __FUNCTION__));
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+               return BCME_NOMEM;
+       }
+
+       /* Common msg buf hdr */
+       flow_suspend_rqst->msg.msg_type = MSG_TYPE_FLOW_RING_SUSPEND;
+       /* flow_suspend_rqst->msg.if_id = (uint8)flow_ring_node->flow_info.ifindex; */
+       flow_suspend_rqst->msg.request_id = htol32(0); /* TBD */
+
+       flow_suspend_rqst->msg.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+       ring->seqnum++;
+
+       /* Update flow id  info */
+       for (index = 0; index < count; index++)
+       {
+               flow_suspend_rqst->ring_id[index] = ringid[index];
+       }
+       flow_suspend_rqst->num = count;
+
+       DHD_ERROR(("%s sending batch suspend!! count is %d\n", __FUNCTION__, count));
+
+       /* update ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ring, flow_suspend_rqst, 1);
+
+       DHD_RING_UNLOCK(ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhd->bus);
+#endif
+
+       return BCME_OK;
+}
+#endif /* IDLE_TX_FLOW_MGMT */
+
+static void dump_psmwd_v1(const bcm_tlv_t *tlv, struct bcmstrbuf *b)
+{
+       const hnd_ext_trap_psmwd_v1_t* psmwd = NULL;
+       uint32 i;
+       psmwd = (const hnd_ext_trap_psmwd_v1_t *)tlv;
+       for (i = 0; i < PSMDBG_REG_READ_CNT_FOR_PSMWDTRAP_V1; i++) {
+               bcm_bprintf(b, " psmdebug[%d]: 0x%x\n", i, psmwd->i32_psmdebug[i]);
+       }
+       bcm_bprintf(b, " gated clock en: 0x%x\n", psmwd->i16_0x1a8);
+       bcm_bprintf(b, " Rcv Fifo Ctrl: 0x%x\n", psmwd->i16_0x406);
+       bcm_bprintf(b, " Rx ctrl 1: 0x%x\n", psmwd->i16_0x408);
+       bcm_bprintf(b, " Rxe Status 1: 0x%x\n", psmwd->i16_0x41a);
+       bcm_bprintf(b, " Rxe Status 2: 0x%x\n", psmwd->i16_0x41c);
+       bcm_bprintf(b, " rcv wrd count 0: 0x%x\n", psmwd->i16_0x424);
+       bcm_bprintf(b, " rcv wrd count 1: 0x%x\n", psmwd->i16_0x426);
+       bcm_bprintf(b, " RCV_LFIFO_STS: 0x%x\n", psmwd->i16_0x456);
+       bcm_bprintf(b, " PSM_SLP_TMR: 0x%x\n", psmwd->i16_0x480);
+       bcm_bprintf(b, " TXE CTRL: 0x%x\n", psmwd->i16_0x500);
+       bcm_bprintf(b, " TXE Status: 0x%x\n", psmwd->i16_0x50e);
+       bcm_bprintf(b, " TXE_xmtdmabusy: 0x%x\n", psmwd->i16_0x55e);
+       bcm_bprintf(b, " TXE_XMTfifosuspflush: 0x%x\n", psmwd->i16_0x566);
+       bcm_bprintf(b, " IFS Stat: 0x%x\n", psmwd->i16_0x690);
+       bcm_bprintf(b, " IFS_MEDBUSY_CTR: 0x%x\n", psmwd->i16_0x692);
+       bcm_bprintf(b, " IFS_TX_DUR: 0x%x\n", psmwd->i16_0x694);
+       bcm_bprintf(b, " SLow_CTL: 0x%x\n", psmwd->i16_0x6a0);
+       bcm_bprintf(b, " PSM BRC: 0x%x\n", psmwd->i16_0x490);
+       bcm_bprintf(b, " TXE_AQM fifo Ready: 0x%x\n", psmwd->i16_0x838);
+       bcm_bprintf(b, " Dagg ctrl: 0x%x\n", psmwd->i16_0x8c0);
+       bcm_bprintf(b, " shm_prewds_cnt: 0x%x\n", psmwd->shm_prewds_cnt);
+       bcm_bprintf(b, " shm_txtplufl_cnt: 0x%x\n", psmwd->shm_txtplufl_cnt);
+       bcm_bprintf(b, " shm_txphyerr_cnt: 0x%x\n", psmwd->shm_txphyerr_cnt);
+
+}
+
+static void dump_psmwd_v2(const bcm_tlv_t *tlv, struct bcmstrbuf *b)
+{
+       const hnd_ext_trap_psmwd_t* psmwd = NULL;
+       uint32 i;
+       psmwd = (const hnd_ext_trap_psmwd_t *)tlv;
+       for (i = 0; i < PSMDBG_REG_READ_CNT_FOR_PSMWDTRAP_V2; i++) {
+               bcm_bprintf(b, " psmdebug[%d]: 0x%x\n", i, psmwd->i32_psmdebug[i]);
+       }
+
+       bcm_bprintf(b, " psm_brwk0: 0x%x\n", psmwd->i16_0x4b8);
+       bcm_bprintf(b, " psm_brwk1: 0x%x\n", psmwd->i16_0x4ba);
+       bcm_bprintf(b, " psm_brwk2: 0x%x\n", psmwd->i16_0x4bc);
+       bcm_bprintf(b, " psm_brwk3: 0x%x\n", psmwd->i16_0x4be);
+       bcm_bprintf(b, " PSM BRC_1: 0x%x\n", psmwd->i16_0x4da);
+       bcm_bprintf(b, " gated clock en: 0x%x\n", psmwd->i16_0x1a8);
+       bcm_bprintf(b, " Rcv Fifo Ctrl: 0x%x\n", psmwd->i16_0x406);
+       bcm_bprintf(b, " Rx ctrl 1: 0x%x\n", psmwd->i16_0x408);
+       bcm_bprintf(b, " Rxe Status 1: 0x%x\n", psmwd->i16_0x41a);
+       bcm_bprintf(b, " Rxe Status 2: 0x%x\n", psmwd->i16_0x41c);
+       bcm_bprintf(b, " rcv wrd count 0: 0x%x\n", psmwd->i16_0x424);
+       bcm_bprintf(b, " rcv wrd count 1: 0x%x\n", psmwd->i16_0x426);
+       bcm_bprintf(b, " RCV_LFIFO_STS: 0x%x\n", psmwd->i16_0x456);
+       bcm_bprintf(b, " PSM_SLP_TMR: 0x%x\n", psmwd->i16_0x480);
+       bcm_bprintf(b, " TXE CTRL: 0x%x\n", psmwd->i16_0x500);
+       bcm_bprintf(b, " TXE Status: 0x%x\n", psmwd->i16_0x50e);
+       bcm_bprintf(b, " TXE_xmtdmabusy: 0x%x\n", psmwd->i16_0x55e);
+       bcm_bprintf(b, " TXE_XMTfifosuspflush: 0x%x\n", psmwd->i16_0x566);
+       bcm_bprintf(b, " IFS Stat: 0x%x\n", psmwd->i16_0x690);
+       bcm_bprintf(b, " IFS_MEDBUSY_CTR: 0x%x\n", psmwd->i16_0x692);
+       bcm_bprintf(b, " IFS_TX_DUR: 0x%x\n", psmwd->i16_0x694);
+       bcm_bprintf(b, " SLow_CTL: 0x%x\n", psmwd->i16_0x6a0);
+       bcm_bprintf(b, " PSM BRC: 0x%x\n", psmwd->i16_0x490);
+       bcm_bprintf(b, " TXE_AQM fifo Ready: 0x%x\n", psmwd->i16_0x838);
+       bcm_bprintf(b, " Dagg ctrl: 0x%x\n", psmwd->i16_0x8c0);
+       bcm_bprintf(b, " shm_prewds_cnt: 0x%x\n", psmwd->shm_prewds_cnt);
+       bcm_bprintf(b, " shm_txtplufl_cnt: 0x%x\n", psmwd->shm_txtplufl_cnt);
+       bcm_bprintf(b, " shm_txphyerr_cnt: 0x%x\n", psmwd->shm_txphyerr_cnt);
+}
+
+static const char* etd_trap_name(hnd_ext_tag_trap_t tag)
+{
+       switch (tag)
+       {
+       case TAG_TRAP_SIGNATURE: return "TAG_TRAP_SIGNATURE";
+       case TAG_TRAP_STACK: return "TAG_TRAP_STACK";
+       case TAG_TRAP_MEMORY: return "TAG_TRAP_MEMORY";
+       case TAG_TRAP_DEEPSLEEP: return "TAG_TRAP_DEEPSLEEP";
+       case TAG_TRAP_PSM_WD: return "TAG_TRAP_PSM_WD";
+       case TAG_TRAP_PHY: return "TAG_TRAP_PHY";
+       case TAG_TRAP_BUS: return "TAG_TRAP_BUS";
+       case TAG_TRAP_MAC_SUSP: return "TAG_TRAP_MAC_SUSP";
+       case TAG_TRAP_BACKPLANE: return "TAG_TRAP_BACKPLANE";
+       case TAG_TRAP_PCIE_Q: return "TAG_TRAP_PCIE_Q";
+       case TAG_TRAP_WLC_STATE: return "TAG_TRAP_WLC_STATE";
+       case TAG_TRAP_MAC_WAKE: return "TAG_TRAP_MAC_WAKE";
+       case TAG_TRAP_HMAP: return "TAG_TRAP_HMAP";
+       case TAG_TRAP_PHYTXERR_THRESH: return "TAG_TRAP_PHYTXERR_THRESH";
+       case TAG_TRAP_HC_DATA: return "TAG_TRAP_HC_DATA";
+       case TAG_TRAP_LOG_DATA: return "TAG_TRAP_LOG_DATA";
+       case TAG_TRAP_CODE: return "TAG_TRAP_CODE";
+       case TAG_TRAP_LAST:
+       default:
+               return "Unknown";
+       }
+       return "Unknown";
+}
+
+int dhd_prot_dump_extended_trap(dhd_pub_t *dhdp, struct bcmstrbuf *b, bool raw)
+{
+       uint32 i;
+       uint32 *ext_data;
+       hnd_ext_trap_hdr_t *hdr;
+       const bcm_tlv_t *tlv;
+       const trap_t *tr;
+       const uint32 *stack;
+       const hnd_ext_trap_bp_err_t *bpe;
+       uint32 raw_len;
+
+       ext_data = dhdp->extended_trap_data;
+
+       /* return if there is no extended trap data */
+       if (!ext_data || !(dhdp->dongle_trap_data & D2H_DEV_EXT_TRAP_DATA))
+       {
+               bcm_bprintf(b, "%d (0x%x)", dhdp->dongle_trap_data, dhdp->dongle_trap_data);
+               return BCME_OK;
+       }
+
+       bcm_bprintf(b, "Extended trap data\n");
+
+       /* First word is original trap_data */
+       bcm_bprintf(b, "trap_data = 0x%08x\n", *ext_data);
+       ext_data++;
+
+       /* Followed by the extended trap data header */
+       hdr = (hnd_ext_trap_hdr_t *)ext_data;
+       bcm_bprintf(b, "version: %d, len: %d\n", hdr->version, hdr->len);
+
+       /* Dump a list of all tags found  before parsing data */
+       bcm_bprintf(b, "\nTags Found:\n");
+       for (i = 0; i < TAG_TRAP_LAST; i++) {
+               tlv = bcm_parse_tlvs(hdr->data, hdr->len, i);
+               if (tlv)
+                       bcm_bprintf(b, "Tag: %d (%s), Length: %d\n", i, etd_trap_name(i), tlv->len);
+       }
+
+       /* XXX debug dump */
+       if (raw)
+       {
+               raw_len = sizeof(hnd_ext_trap_hdr_t) + (hdr->len / 4) + (hdr->len % 4 ? 1 : 0);
+               for (i = 0; i < raw_len; i++)
+               {
+                       bcm_bprintf(b, "0x%08x ", ext_data[i]);
+                       if (i % 4 == 3)
+                               bcm_bprintf(b, "\n");
+               }
+               return BCME_OK;
+       }
+
+       /* Extract the various supported TLVs from the extended trap data */
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_CODE);
+       if (tlv)
+       {
+               bcm_bprintf(b, "\n%s len: %d\n", etd_trap_name(TAG_TRAP_CODE), tlv->len);
+               bcm_bprintf(b, "ETD TYPE: %d\n", tlv->data[0]);
+       }
+
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_SIGNATURE);
+       if (tlv)
+       {
+               bcm_bprintf(b, "\n%s len: %d\n", etd_trap_name(TAG_TRAP_SIGNATURE), tlv->len);
+               tr = (const trap_t *)tlv->data;
+
+               bcm_bprintf(b, "TRAP %x: pc %x, lr %x, sp %x, cpsr %x, spsr %x\n",
+                      tr->type, tr->pc, tr->r14, tr->r13, tr->cpsr, tr->spsr);
+               bcm_bprintf(b, "  r0 %x, r1 %x, r2 %x, r3 %x, r4 %x, r5 %x, r6 %x\n",
+                      tr->r0, tr->r1, tr->r2, tr->r3, tr->r4, tr->r5, tr->r6);
+               bcm_bprintf(b, "  r7 %x, r8 %x, r9 %x, r10 %x, r11 %x, r12 %x\n",
+                      tr->r7, tr->r8, tr->r9, tr->r10, tr->r11, tr->r12);
+       }
+
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_STACK);
+       if (tlv)
+       {
+               bcm_bprintf(b, "\n%s len: %d\n", etd_trap_name(TAG_TRAP_STACK), tlv->len);
+               stack = (const uint32 *)tlv->data;
+               for (i = 0; i < (uint32)(tlv->len / 4); i++)
+               {
+                       bcm_bprintf(b, "  0x%08x\n", *stack);
+                       stack++;
+               }
+       }
+
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_BACKPLANE);
+       if (tlv)
+       {
+               bcm_bprintf(b, "\n%s len: %d\n", etd_trap_name(TAG_TRAP_BACKPLANE), tlv->len);
+               bpe = (const hnd_ext_trap_bp_err_t *)tlv->data;
+               bcm_bprintf(b, " error: %x\n", bpe->error);
+               bcm_bprintf(b, " coreid: %x\n", bpe->coreid);
+               bcm_bprintf(b, " baseaddr: %x\n", bpe->baseaddr);
+               bcm_bprintf(b, " ioctrl: %x\n", bpe->ioctrl);
+               bcm_bprintf(b, " iostatus: %x\n", bpe->iostatus);
+               bcm_bprintf(b, " resetctrl: %x\n", bpe->resetctrl);
+               bcm_bprintf(b, " resetstatus: %x\n", bpe->resetstatus);
+               bcm_bprintf(b, " errlogctrl: %x\n", bpe->errlogctrl);
+               bcm_bprintf(b, " errlogdone: %x\n", bpe->errlogdone);
+               bcm_bprintf(b, " errlogstatus: %x\n", bpe->errlogstatus);
+               bcm_bprintf(b, " errlogaddrlo: %x\n", bpe->errlogaddrlo);
+               bcm_bprintf(b, " errlogaddrhi: %x\n", bpe->errlogaddrhi);
+               bcm_bprintf(b, " errlogid: %x\n", bpe->errlogid);
+               bcm_bprintf(b, " errloguser: %x\n", bpe->errloguser);
+               bcm_bprintf(b, " errlogflags: %x\n", bpe->errlogflags);
+       }
+
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_MEMORY);
+       if (tlv)
+       {
+               const hnd_ext_trap_heap_err_t* hme;
+
+               bcm_bprintf(b, "\n%s len: %d\n", etd_trap_name(TAG_TRAP_MEMORY), tlv->len);
+               hme = (const hnd_ext_trap_heap_err_t *)tlv->data;
+               bcm_bprintf(b, " arena total: %d\n", hme->arena_total);
+               bcm_bprintf(b, " heap free: %d\n", hme->heap_free);
+               bcm_bprintf(b, " heap in use: %d\n", hme->heap_inuse);
+               bcm_bprintf(b, " mf count: %d\n", hme->mf_count);
+               bcm_bprintf(b, " stack LWM: %x\n", hme->stack_lwm);
+
+               bcm_bprintf(b, " Histogram:\n");
+               for (i = 0; i < (HEAP_HISTOGRAM_DUMP_LEN * 2); i += 2) {
+                       if (hme->heap_histogm[i] == 0xfffe)
+                               bcm_bprintf(b, " Others\t%d\t?\n", hme->heap_histogm[i + 1]);
+                       else if (hme->heap_histogm[i] == 0xffff)
+                               bcm_bprintf(b, " >= 256K\t%d\t?\n", hme->heap_histogm[i + 1]);
+                       else
+                               bcm_bprintf(b, " %d\t%d\t%d\n", hme->heap_histogm[i] << 2,
+                                       hme->heap_histogm[i + 1], (hme->heap_histogm[i] << 2)
+                                       * hme->heap_histogm[i + 1]);
+               }
+
+               bcm_bprintf(b, " Max free block: %d\n", hme->max_sz_free_blk[0] << 2);
+               for (i = 1; i < HEAP_MAX_SZ_BLKS_LEN; i++) {
+                       bcm_bprintf(b, " Next lgst free block: %d\n", hme->max_sz_free_blk[i] << 2);
+               }
+       }
+
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_PCIE_Q);
+       if (tlv)
+       {
+               const hnd_ext_trap_pcie_mem_err_t* pqme;
+
+               bcm_bprintf(b, "\n%s len: %d\n", etd_trap_name(TAG_TRAP_PCIE_Q), tlv->len);
+               pqme = (const hnd_ext_trap_pcie_mem_err_t *)tlv->data;
+               bcm_bprintf(b, " d2h queue len: %x\n", pqme->d2h_queue_len);
+               bcm_bprintf(b, " d2h req queue len: %x\n", pqme->d2h_req_queue_len);
+       }
+
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_WLC_STATE);
+       if (tlv)
+       {
+               const hnd_ext_trap_wlc_mem_err_t* wsme;
+
+               bcm_bprintf(b, "\n%s len: %d\n", etd_trap_name(TAG_TRAP_WLC_STATE), tlv->len);
+               wsme = (const hnd_ext_trap_wlc_mem_err_t *)tlv->data;
+               bcm_bprintf(b, " instance: %d\n", wsme->instance);
+               bcm_bprintf(b, " associated: %d\n", wsme->associated);
+               bcm_bprintf(b, " peer count: %d\n", wsme->peer_cnt);
+               bcm_bprintf(b, " client count: %d\n", wsme->soft_ap_client_cnt);
+               bcm_bprintf(b, " TX_AC_BK_FIFO: %d\n", wsme->txqueue_len[0]);
+               bcm_bprintf(b, " TX_AC_BE_FIFO: %d\n", wsme->txqueue_len[1]);
+               bcm_bprintf(b, " TX_AC_VI_FIFO: %d\n", wsme->txqueue_len[2]);
+               bcm_bprintf(b, " TX_AC_VO_FIFO: %d\n", wsme->txqueue_len[3]);
+
+               if (tlv->len >= (sizeof(*wsme) * 2)) {
+                       wsme++;
+                       bcm_bprintf(b, "\n instance: %d\n", wsme->instance);
+                       bcm_bprintf(b, " associated: %d\n", wsme->associated);
+                       bcm_bprintf(b, " peer count: %d\n", wsme->peer_cnt);
+                       bcm_bprintf(b, " client count: %d\n", wsme->soft_ap_client_cnt);
+                       bcm_bprintf(b, " TX_AC_BK_FIFO: %d\n", wsme->txqueue_len[0]);
+                       bcm_bprintf(b, " TX_AC_BE_FIFO: %d\n", wsme->txqueue_len[1]);
+                       bcm_bprintf(b, " TX_AC_VI_FIFO: %d\n", wsme->txqueue_len[2]);
+                       bcm_bprintf(b, " TX_AC_VO_FIFO: %d\n", wsme->txqueue_len[3]);
+               }
+       }
+
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_PHY);
+       if (tlv)
+       {
+               const hnd_ext_trap_phydbg_t* phydbg;
+               bcm_bprintf(b, "\n%s len: %d\n", etd_trap_name(TAG_TRAP_PHY), tlv->len);
+               phydbg = (const hnd_ext_trap_phydbg_t *)tlv->data;
+               bcm_bprintf(b, " err: 0x%x\n", phydbg->err);
+               bcm_bprintf(b, " RxFeStatus: 0x%x\n", phydbg->RxFeStatus);
+               bcm_bprintf(b, " TxFIFOStatus0: 0x%x\n", phydbg->TxFIFOStatus0);
+               bcm_bprintf(b, " TxFIFOStatus1: 0x%x\n", phydbg->TxFIFOStatus1);
+               bcm_bprintf(b, " RfseqMode: 0x%x\n", phydbg->RfseqMode);
+               bcm_bprintf(b, " RfseqStatus0: 0x%x\n", phydbg->RfseqStatus0);
+               bcm_bprintf(b, " RfseqStatus1: 0x%x\n", phydbg->RfseqStatus1);
+               bcm_bprintf(b, " RfseqStatus_Ocl: 0x%x\n", phydbg->RfseqStatus_Ocl);
+               bcm_bprintf(b, " RfseqStatus_Ocl1: 0x%x\n", phydbg->RfseqStatus_Ocl1);
+               bcm_bprintf(b, " OCLControl1: 0x%x\n", phydbg->OCLControl1);
+               bcm_bprintf(b, " TxError: 0x%x\n", phydbg->TxError);
+               bcm_bprintf(b, " bphyTxError: 0x%x\n", phydbg->bphyTxError);
+               bcm_bprintf(b, " TxCCKError: 0x%x\n", phydbg->TxCCKError);
+               bcm_bprintf(b, " TxCtrlWrd0: 0x%x\n", phydbg->TxCtrlWrd0);
+               bcm_bprintf(b, " TxCtrlWrd1: 0x%x\n", phydbg->TxCtrlWrd1);
+               bcm_bprintf(b, " TxCtrlWrd2: 0x%x\n", phydbg->TxCtrlWrd2);
+               bcm_bprintf(b, " TxLsig0: 0x%x\n", phydbg->TxLsig0);
+               bcm_bprintf(b, " TxLsig1: 0x%x\n", phydbg->TxLsig1);
+               bcm_bprintf(b, " TxVhtSigA10: 0x%x\n", phydbg->TxVhtSigA10);
+               bcm_bprintf(b, " TxVhtSigA11: 0x%x\n", phydbg->TxVhtSigA11);
+               bcm_bprintf(b, " TxVhtSigA20: 0x%x\n", phydbg->TxVhtSigA20);
+               bcm_bprintf(b, " TxVhtSigA21: 0x%x\n", phydbg->TxVhtSigA21);
+               bcm_bprintf(b, " txPktLength: 0x%x\n", phydbg->txPktLength);
+               bcm_bprintf(b, " txPsdulengthCtr: 0x%x\n", phydbg->txPsdulengthCtr);
+               bcm_bprintf(b, " gpioClkControl: 0x%x\n", phydbg->gpioClkControl);
+               bcm_bprintf(b, " gpioSel: 0x%x\n", phydbg->gpioSel);
+               bcm_bprintf(b, " pktprocdebug: 0x%x\n", phydbg->pktprocdebug);
+               for (i = 0; i < 3; i++)
+                       bcm_bprintf(b, " gpioOut[%d]: 0x%x\n", i, phydbg->gpioOut[i]);
+       }
+
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_PSM_WD);
+       if (tlv)
+       {
+               const hnd_ext_trap_psmwd_t* psmwd;
+
+               bcm_bprintf(b, "\n%s len: %d\n", etd_trap_name(TAG_TRAP_PSM_WD), tlv->len);
+               psmwd = (const hnd_ext_trap_psmwd_t *)tlv->data;
+               bcm_bprintf(b, " version: 0x%x\n", psmwd->version);
+               bcm_bprintf(b, " maccontrol: 0x%x\n", psmwd->i32_maccontrol);
+               bcm_bprintf(b, " maccommand: 0x%x\n", psmwd->i32_maccommand);
+               bcm_bprintf(b, " macintstatus: 0x%x\n", psmwd->i32_macintstatus);
+               bcm_bprintf(b, " phydebug: 0x%x\n", psmwd->i32_phydebug);
+               bcm_bprintf(b, " clk_ctl_st: 0x%x\n", psmwd->i32_clk_ctl_st);
+               if (psmwd->version == 1) {
+                       dump_psmwd_v1(tlv, b);
+               }
+               if (psmwd->version == 2) {
+                       dump_psmwd_v2(tlv, b);
+               }
+       }
+/* PHY TxErr MacDump */
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_PHYTXERR_THRESH);
+       if (tlv)
+       {
+               const hnd_ext_trap_macphytxerr_t* phytxerr = NULL;
+               bcm_bprintf(b, "\n%s len: %d\n", etd_trap_name(TAG_TRAP_PHYTXERR_THRESH), tlv->len);
+               phytxerr = (const hnd_ext_trap_macphytxerr_t *)tlv->data;
+               bcm_bprintf(b, " version: 0x%x\n", phytxerr->version);
+               bcm_bprintf(b, " trap_reason: %d\n", phytxerr->trap_reason);
+               bcm_bprintf(b, " Tsf_rx_ts_0x63E: 0x%x\n", phytxerr->i16_0x63E);
+               bcm_bprintf(b, " Tsf_tx_ts_0x640: 0x%x\n", phytxerr->i16_0x640);
+               bcm_bprintf(b, " tsf_tmr_rx_end_ts_0x642: 0x%x\n", phytxerr->i16_0x642);
+               bcm_bprintf(b, " TDC_FrmLen0_0x846: 0x%x\n", phytxerr->i16_0x846);
+               bcm_bprintf(b, " TDC_FrmLen1_0x848: 0x%x\n", phytxerr->i16_0x848);
+               bcm_bprintf(b, " TDC_Txtime_0x84a: 0x%x\n", phytxerr->i16_0x84a);
+               bcm_bprintf(b, " TXE_BytCntInTxFrmLo_0xa5a: 0x%x\n", phytxerr->i16_0xa5a);
+               bcm_bprintf(b, " TXE_BytCntInTxFrmHi_0xa5c: 0x%x\n", phytxerr->i16_0xa5c);
+               bcm_bprintf(b, " TDC_VhtPsduLen0_0x856: 0x%x\n", phytxerr->i16_0x856);
+               bcm_bprintf(b, " TDC_VhtPsduLen1_0x858: 0x%x\n", phytxerr->i16_0x858);
+               bcm_bprintf(b, " PSM_BRC: 0x%x\n", phytxerr->i16_0x490);
+               bcm_bprintf(b, " PSM_BRC_1: 0x%x\n", phytxerr->i16_0x4d8);
+               bcm_bprintf(b, " shm_txerr_reason: 0x%x\n", phytxerr->shm_txerr_reason);
+               bcm_bprintf(b, " shm_pctl0: 0x%x\n", phytxerr->shm_pctl0);
+               bcm_bprintf(b, " shm_pctl1: 0x%x\n", phytxerr->shm_pctl1);
+               bcm_bprintf(b, " shm_pctl2: 0x%x\n", phytxerr->shm_pctl2);
+               bcm_bprintf(b, " shm_lsig0: 0x%x\n", phytxerr->shm_lsig0);
+               bcm_bprintf(b, " shm_lsig1: 0x%x\n", phytxerr->shm_lsig1);
+               bcm_bprintf(b, " shm_plcp0: 0x%x\n", phytxerr->shm_plcp0);
+               bcm_bprintf(b, " shm_plcp1: 0x%x\n", phytxerr->shm_plcp1);
+               bcm_bprintf(b, " shm_plcp2: 0x%x\n", phytxerr->shm_plcp2);
+               bcm_bprintf(b, " shm_vht_sigb0: 0x%x\n", phytxerr->shm_vht_sigb0);
+               bcm_bprintf(b, " shm_vht_sigb1: 0x%x\n", phytxerr->shm_vht_sigb1);
+               bcm_bprintf(b, " shm_tx_tst: 0x%x\n", phytxerr->shm_tx_tst);
+               bcm_bprintf(b, " shm_txerr_tm: 0x%x\n", phytxerr->shm_txerr_tm);
+               bcm_bprintf(b, " shm_curchannel: 0x%x\n", phytxerr->shm_curchannel);
+               bcm_bprintf(b, " shm_blk_crx_rxtsf_pos: 0x%x\n", phytxerr->shm_crx_rxtsf_pos);
+               bcm_bprintf(b, " shm_lasttx_tsf: 0x%x\n", phytxerr->shm_lasttx_tsf);
+               bcm_bprintf(b, " shm_s_rxtsftmrval: 0x%x\n", phytxerr->shm_s_rxtsftmrval);
+               bcm_bprintf(b, " Phy_0x29: 0x%x\n", phytxerr->i16_0x29);
+               bcm_bprintf(b, " Phy_0x2a: 0x%x\n", phytxerr->i16_0x2a);
+       }
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_MAC_SUSP);
+       if (tlv)
+       {
+               const hnd_ext_trap_macsusp_t* macsusp;
+               bcm_bprintf(b, "\n%s len: %d\n", etd_trap_name(TAG_TRAP_MAC_SUSP), tlv->len);
+               macsusp = (const hnd_ext_trap_macsusp_t *)tlv->data;
+               bcm_bprintf(b, " version: %d\n", macsusp->version);
+               bcm_bprintf(b, " trap_reason: %d\n", macsusp->trap_reason);
+               bcm_bprintf(b, " maccontrol: 0x%x\n", macsusp->i32_maccontrol);
+               bcm_bprintf(b, " maccommand: 0x%x\n", macsusp->i32_maccommand);
+               bcm_bprintf(b, " macintstatus: 0x%x\n", macsusp->i32_macintstatus);
+               for (i = 0; i < 4; i++)
+                       bcm_bprintf(b, " phydebug[%d]: 0x%x\n", i, macsusp->i32_phydebug[i]);
+               for (i = 0; i < 8; i++)
+                       bcm_bprintf(b, " psmdebug[%d]: 0x%x\n", i, macsusp->i32_psmdebug[i]);
+               bcm_bprintf(b, " Rxe Status_1: 0x%x\n", macsusp->i16_0x41a);
+               bcm_bprintf(b, " Rxe Status_2: 0x%x\n", macsusp->i16_0x41c);
+               bcm_bprintf(b, " PSM BRC: 0x%x\n", macsusp->i16_0x490);
+               bcm_bprintf(b, " TXE Status: 0x%x\n", macsusp->i16_0x50e);
+               bcm_bprintf(b, " TXE xmtdmabusy: 0x%x\n", macsusp->i16_0x55e);
+               bcm_bprintf(b, " TXE XMTfifosuspflush: 0x%x\n", macsusp->i16_0x566);
+               bcm_bprintf(b, " IFS Stat: 0x%x\n", macsusp->i16_0x690);
+               bcm_bprintf(b, " IFS MEDBUSY CTR: 0x%x\n", macsusp->i16_0x692);
+               bcm_bprintf(b, " IFS TX DUR: 0x%x\n", macsusp->i16_0x694);
+               bcm_bprintf(b, " WEP CTL: 0x%x\n", macsusp->i16_0x7c0);
+               bcm_bprintf(b, " TXE AQM fifo Ready: 0x%x\n", macsusp->i16_0x838);
+               bcm_bprintf(b, " MHP status: 0x%x\n", macsusp->i16_0x880);
+               bcm_bprintf(b, " shm_prewds_cnt: 0x%x\n", macsusp->shm_prewds_cnt);
+               bcm_bprintf(b, " shm_ucode_dbgst: 0x%x\n", macsusp->shm_ucode_dbgst);
+       }
+
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_MAC_WAKE);
+       if (tlv)
+       {
+               const hnd_ext_trap_macenab_t* macwake;
+               bcm_bprintf(b, "\n%s len: %d\n", etd_trap_name(TAG_TRAP_MAC_WAKE), tlv->len);
+               macwake = (const hnd_ext_trap_macenab_t *)tlv->data;
+               bcm_bprintf(b, " version: 0x%x\n", macwake->version);
+               bcm_bprintf(b, " trap_reason: 0x%x\n", macwake->trap_reason);
+               bcm_bprintf(b, " maccontrol: 0x%x\n", macwake->i32_maccontrol);
+               bcm_bprintf(b, " maccommand: 0x%x\n", macwake->i32_maccommand);
+               bcm_bprintf(b, " macintstatus: 0x%x\n", macwake->i32_macintstatus);
+               for (i = 0; i < 8; i++)
+                       bcm_bprintf(b, " psmdebug[%d]: 0x%x\n", i, macwake->i32_psmdebug[i]);
+               bcm_bprintf(b, " clk_ctl_st: 0x%x\n", macwake->i32_clk_ctl_st);
+               bcm_bprintf(b, " powerctl: 0x%x\n", macwake->i32_powerctl);
+               bcm_bprintf(b, " gated clock en: 0x%x\n", macwake->i16_0x1a8);
+               bcm_bprintf(b, " PSM_SLP_TMR: 0x%x\n", macwake->i16_0x480);
+               bcm_bprintf(b, " PSM BRC: 0x%x\n", macwake->i16_0x490);
+               bcm_bprintf(b, " TSF CTL: 0x%x\n", macwake->i16_0x600);
+               bcm_bprintf(b, " IFS Stat: 0x%x\n", macwake->i16_0x690);
+               bcm_bprintf(b, " IFS_MEDBUSY_CTR: 0x%x\n", macwake->i16_0x692);
+               bcm_bprintf(b, " Slow_CTL: 0x%x\n", macwake->i16_0x6a0);
+               bcm_bprintf(b, " Slow_FRAC: 0x%x\n", macwake->i16_0x6a6);
+               bcm_bprintf(b, " fast power up delay: 0x%x\n", macwake->i16_0x6a8);
+               bcm_bprintf(b, " Slow_PER: 0x%x\n", macwake->i16_0x6aa);
+               bcm_bprintf(b, " shm_ucode_dbgst: 0x%x\n", macwake->shm_ucode_dbgst);
+       }
+
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_BUS);
+       if (tlv)
+       {
+               const bcm_dngl_pcie_hc_t* hc;
+               bcm_bprintf(b, "\n%s len: %d\n", etd_trap_name(TAG_TRAP_BUS), tlv->len);
+               hc = (const bcm_dngl_pcie_hc_t *)tlv->data;
+               bcm_bprintf(b, " version: 0x%x\n", hc->version);
+               bcm_bprintf(b, " reserved: 0x%x\n", hc->reserved);
+               bcm_bprintf(b, " pcie_err_ind_type: 0x%x\n", hc->pcie_err_ind_type);
+               bcm_bprintf(b, " pcie_flag: 0x%x\n", hc->pcie_flag);
+               bcm_bprintf(b, " pcie_control_reg: 0x%x\n", hc->pcie_control_reg);
+               for (i = 0; i < HC_PCIEDEV_CONFIG_REGLIST_MAX; i++)
+                       bcm_bprintf(b, " pcie_config_regs[%d]: 0x%x\n", i, hc->pcie_config_regs[i]);
+       }
+
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_HMAP);
+       if (tlv)
+       {
+               const pcie_hmapviolation_t* hmap;
+               hmap = (const pcie_hmapviolation_t *)tlv->data;
+               bcm_bprintf(b, "\n%s len: %d\n", etd_trap_name(TAG_TRAP_HMAP), tlv->len);
+               bcm_bprintf(b, " HMAP Vio Addr Low: 0x%x\n", hmap->hmap_violationaddr_lo);
+               bcm_bprintf(b, " HMAP Vio Addr Hi: 0x%x\n", hmap->hmap_violationaddr_hi);
+               bcm_bprintf(b, " HMAP Vio Info: 0x%x\n", hmap->hmap_violation_info);
+       }
+
+       return BCME_OK;
+}
+
+#ifdef BCMPCIE
+int
+dhd_prot_send_host_timestamp(dhd_pub_t *dhdp, uchar *tlvs, uint16 tlv_len,
+       uint16 seqnum, uint16 xt_id)
+{
+       dhd_prot_t *prot = dhdp->prot;
+       host_timestamp_msg_t *ts_req;
+       unsigned long flags;
+       uint16 alloced = 0;
+       uchar *ts_tlv_buf;
+       msgbuf_ring_t *ctrl_ring = &prot->h2dring_ctrl_subn;
+
+       if ((tlvs == NULL) || (tlv_len == 0)) {
+               DHD_ERROR(("%s: argument error tlv: %p, tlv_len %d\n",
+                       __FUNCTION__, tlvs, tlv_len));
+               return -1;
+       }
+
+#ifdef PCIE_INB_DW
+       if (dhd_prot_inc_hostactive_devwake_assert(dhdp->bus) != BCME_OK)
+               return BCME_ERROR;
+#endif /* PCIE_INB_DW */
+
+       DHD_RING_LOCK(ctrl_ring->ring_lock, flags);
+
+       /* if Host TS req already pending go away */
+       if (prot->hostts_req_buf_inuse == TRUE) {
+               DHD_ERROR(("one host TS request already pending at device\n"));
+               DHD_RING_UNLOCK(ctrl_ring->ring_lock, flags);
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhdp->bus);
+#endif
+               return -1;
+       }
+
+       /* Request for cbuf space */
+       ts_req = (host_timestamp_msg_t*)dhd_prot_alloc_ring_space(dhdp, ctrl_ring,
+               DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D, &alloced, FALSE);
+       if (ts_req == NULL) {
+               DHD_ERROR(("couldn't allocate space on msgring to send host TS request\n"));
+               DHD_RING_UNLOCK(ctrl_ring->ring_lock, flags);
+#ifdef PCIE_INB_DW
+               dhd_prot_dec_hostactive_ack_pending_dsreq(dhdp->bus);
+#endif
+               return -1;
+       }
+
+       /* Common msg buf hdr */
+       ts_req->msg.msg_type = MSG_TYPE_HOSTTIMSTAMP;
+       ts_req->msg.if_id = 0;
+       ts_req->msg.flags =  ctrl_ring->current_phase;
+       ts_req->msg.request_id = DHD_H2D_HOSTTS_REQ_PKTID;
+
+       ts_req->msg.epoch = ctrl_ring->seqnum % H2D_EPOCH_MODULO;
+       ctrl_ring->seqnum++;
+
+       ts_req->xt_id = xt_id;
+       ts_req->seqnum = seqnum;
+       /* populate TS req buffer info */
+       ts_req->input_data_len = htol16(tlv_len);
+       ts_req->host_buf_addr.high = htol32(PHYSADDRHI(prot->hostts_req_buf.pa));
+       ts_req->host_buf_addr.low = htol32(PHYSADDRLO(prot->hostts_req_buf.pa));
+       /* copy ioct payload */
+       ts_tlv_buf = (void *) prot->hostts_req_buf.va;
+       prot->hostts_req_buf_inuse = TRUE;
+       memcpy(ts_tlv_buf, tlvs, tlv_len);
+
+       OSL_CACHE_FLUSH((void *) prot->hostts_req_buf.va, tlv_len);
+
+       if (ISALIGNED(ts_tlv_buf, DMA_ALIGN_LEN) == FALSE) {
+               DHD_ERROR(("host TS req buffer address unaligned !!!!! \n"));
+       }
+
+       DHD_CTL(("submitted Host TS request request_id %d, data_len %d, tx_id %d, seq %d\n",
+               ts_req->msg.request_id, ts_req->input_data_len,
+               ts_req->xt_id, ts_req->seqnum));
+
+       /* upd wrt ptr and raise interrupt */
+       dhd_prot_ring_write_complete(dhdp, ctrl_ring, ts_req,
+               DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D);
+
+       DHD_RING_UNLOCK(ctrl_ring->ring_lock, flags);
+
+#ifdef PCIE_INB_DW
+       dhd_prot_dec_hostactive_ack_pending_dsreq(dhdp->bus);
+#endif
+       return 0;
+} /* dhd_prot_send_host_timestamp */
+
+bool
+dhd_prot_data_path_tx_timestamp_logging(dhd_pub_t *dhd,  bool enable, bool set)
+{
+       if (set)
+               dhd->prot->tx_ts_log_enabled = enable;
+
+       return dhd->prot->tx_ts_log_enabled;
+}
+
+bool
+dhd_prot_data_path_rx_timestamp_logging(dhd_pub_t *dhd,  bool enable, bool set)
+{
+       if (set)
+               dhd->prot->rx_ts_log_enabled = enable;
+
+       return dhd->prot->rx_ts_log_enabled;
+}
+
+bool
+dhd_prot_pkt_noretry(dhd_pub_t *dhd, bool enable, bool set)
+{
+       if (set)
+               dhd->prot->no_retry = enable;
+
+       return dhd->prot->no_retry;
+}
+
+bool
+dhd_prot_pkt_noaggr(dhd_pub_t *dhd, bool enable, bool set)
+{
+       if (set)
+               dhd->prot->no_aggr = enable;
+
+       return dhd->prot->no_aggr;
+}
+
+bool
+dhd_prot_pkt_fixed_rate(dhd_pub_t *dhd, bool enable, bool set)
+{
+       if (set)
+               dhd->prot->fixed_rate = enable;
+
+       return dhd->prot->fixed_rate;
+}
+#endif /* BCMPCIE */
+
+void
+dhd_prot_dma_indx_free(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+
+       dhd_dma_buf_free(dhd, &prot->h2d_dma_indx_wr_buf);
+       dhd_dma_buf_free(dhd, &prot->d2h_dma_indx_rd_buf);
+}
+
+void
+dhd_msgbuf_delay_post_ts_bufs(dhd_pub_t *dhd)
+{
+       if (dhd->prot->max_tsbufpost > 0)
+               dhd_msgbuf_rxbuf_post_ts_bufs(dhd);
+}
+
+static void
+BCMFASTPATH(dhd_prot_process_fw_timestamp)(dhd_pub_t *dhd, void* buf)
+{
+       DHD_ERROR(("Timesunc feature not compiled in but GOT FW TS message\n"));
+
+}
+
+uint16
+dhd_prot_get_ioctl_trans_id(dhd_pub_t *dhdp)
+{
+       return dhdp->prot->ioctl_trans_id;
+}
+
+int dhd_get_hscb_info(dhd_pub_t *dhd, void ** va, uint32 *len)
+{
+       if (!dhd->hscb_enable) {
+               if (len) {
+                       /* prevent "Operation not supported" dhd message */
+                       *len = 0;
+                       return BCME_OK;
+               }
+               return BCME_UNSUPPORTED;
+       }
+
+       if (va) {
+               *va = dhd->prot->host_scb_buf.va;
+       }
+       if (len) {
+               *len = dhd->prot->host_scb_buf.len;
+       }
+
+       return BCME_OK;
+}
+
+#ifdef DHD_MAP_LOGGING
+void
+dhd_prot_smmu_fault_dump(dhd_pub_t *dhdp)
+{
+       dhd_prot_debug_info_print(dhdp);
+       OSL_DMA_MAP_DUMP(dhdp->osh);
+#ifdef DHD_MAP_PKTID_LOGGING
+       dhd_pktid_logging_dump(dhdp);
+#endif /* DHD_MAP_PKTID_LOGGING */
+#ifdef DHD_FW_COREDUMP
+       dhdp->memdump_type = DUMP_TYPE_SMMU_FAULT;
+#ifdef DNGL_AXI_ERROR_LOGGING
+       dhdp->memdump_enabled = DUMP_MEMFILE;
+       dhd_bus_get_mem_dump(dhdp);
+#else
+       dhdp->memdump_enabled = DUMP_MEMONLY;
+       dhd_bus_mem_dump(dhdp);
+#endif /* DNGL_AXI_ERROR_LOGGING */
+#endif /* DHD_FW_COREDUMP */
+}
+#endif /* DHD_MAP_LOGGING */
diff --git a/bcmdhd.101.10.240.x/dhd_pcie.c b/bcmdhd.101.10.240.x/dhd_pcie.c
new file mode 100644 (file)
index 0000000..36e716f
--- /dev/null
@@ -0,0 +1,14444 @@
+/*
+ * DHD Bus Module for PCIE
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+/** XXX Twiki: [PCIeFullDongleArchitecture] */
+
+/* include files */
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <bcmrand.h>
+#include <bcmdevs.h>
+#include <bcmdevs_legacy.h>    /* need to still support chips no longer in trunk firmware */
+#include <siutils.h>
+#include <hndoobr.h>
+#include <hndsoc.h>
+#include <hndpmu.h>
+#include <etd.h>
+#include <hnd_debug.h>
+#include <sbchipc.h>
+#include <sbhndarm.h>
+#include <hnd_armtrap.h>
+#if defined(DHD_DEBUG)
+#include <hnd_cons.h>
+#endif /* defined(DHD_DEBUG) */
+#include <dngl_stats.h>
+#include <pcie_core.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_flowring.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#include <dhd_debug.h>
+#include <dhd_daemon.h>
+#include <dhdioctl.h>
+#include <sdiovar.h>
+#include <bcmmsgbuf.h>
+#include <pcicfg.h>
+#include <dhd_pcie.h>
+#include <bcmpcie.h>
+#include <bcmendian.h>
+#include <bcmstdlib_s.h>
+#ifdef DHDTCPACK_SUPPRESS
+#include <dhd_ip.h>
+#endif /* DHDTCPACK_SUPPRESS */
+#include <bcmevent.h>
+#include <dhd_config.h>
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+#include <linux/pm_runtime.h>
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#if defined(DEBUGGER) || defined(DHD_DSCOPE)
+#include <debugger.h>
+#endif /* DEBUGGER || DHD_DSCOPE */
+
+#if defined(FW_SIGNATURE)
+#include <dngl_rtlv.h>
+#include <bcm_fwsign.h>
+#endif /* FW_SIGNATURE */
+
+#ifdef DNGL_AXI_ERROR_LOGGING
+#include <dhd_linux_wq.h>
+#include <dhd_linux.h>
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+#if defined(DHD_CONTROL_PCIE_CPUCORE_WIFI_TURNON)
+#include <dhd_linux_priv.h>
+#endif /* DHD_CONTROL_PCIE_CPUCORE_WIFI_TURNON */
+
+#define EXTENDED_PCIE_DEBUG_DUMP 1     /* Enable Extended pcie registers dump */
+
+#define MEMBLOCK       2048            /* Block size used for downloading of dongle image */
+#define MAX_WKLK_IDLE_CHECK    3       /* times wake_lock checked before deciding not to suspend */
+
+#define        DHD_MAX_ITEMS_HPP_TXCPL_RING    512
+#define        DHD_MAX_ITEMS_HPP_RXCPL_RING    512
+#define MAX_HP2P_CMPL_RINGS            2u
+
+/* XXX defines for 4378 */
+#define ARMCR4REG_CORECAP      (0x4/sizeof(uint32))
+#define ARMCR4REG_MPUCTRL      (0x90/sizeof(uint32))
+#define ACC_MPU_SHIFT          25
+#define ACC_MPU_MASK           (0x1u << ACC_MPU_SHIFT)
+
+/* XXX Offset for 4375 work around register */
+#define REG_WORK_AROUND                (0x1e4/sizeof(uint32))
+
+/* XXX defines for 43602a0 workaround JIRA CRWLARMCR4-53 */
+#define ARMCR4REG_BANKIDX      (0x40/sizeof(uint32))
+#define ARMCR4REG_BANKPDA      (0x4C/sizeof(uint32))
+/* Temporary war to fix precommit till sync issue between trunk & precommit branch is resolved */
+
+/* CTO Prevention Recovery */
+#define CTO_TO_CLEAR_WAIT_MS 50
+#define CTO_TO_CLEAR_WAIT_MAX_CNT 200
+
+/* FLR setting */
+#define PCIE_FLR_CAPAB_BIT             28
+#define PCIE_FUNCTION_LEVEL_RESET_BIT  15
+
+#define DHD_FUNCTION_LEVEL_RESET_DELAY 70u     /* 70 msec delay */
+#define DHD_SSRESET_STATUS_RETRY_DELAY 40u
+/*
+ * Increase SSReset de-assert time to 8ms.
+ * since it takes longer time if re-scan time on 4378B0.
+ */
+#define DHD_SSRESET_STATUS_RETRIES     200u
+
+/* Fetch address of a member in the pciedev_shared structure in dongle memory */
+#define DHD_PCIE_SHARED_MEMBER_ADDR(bus, member) \
+       (bus)->shared_addr + OFFSETOF(pciedev_shared_t, member)
+
+/* Fetch address of a member in rings_info_ptr structure in dongle memory */
+#define DHD_RING_INFO_MEMBER_ADDR(bus, member) \
+       (bus)->pcie_sh->rings_info_ptr + OFFSETOF(ring_info_t, member)
+
+/* Fetch address of a member in the ring_mem structure in dongle memory */
+#define DHD_RING_MEM_MEMBER_ADDR(bus, ringid, member) \
+       (bus)->ring_sh[ringid].ring_mem_addr + OFFSETOF(ring_mem_t, member)
+
+#if defined(SUPPORT_MULTIPLE_BOARD_REV)
+       extern unsigned int system_rev;
+#endif /* SUPPORT_MULTIPLE_BOARD_REV */
+
+#ifdef EWP_EDL
+extern int host_edl_support;
+#endif
+
+/* This can be overwritten by module parameter(dma_ring_indices) defined in dhd_linux.c */
+uint dma_ring_indices = 0;
+/* This can be overwritten by module parameter(h2d_phase) defined in dhd_linux.c */
+bool h2d_phase = 0;
+/* This can be overwritten by module parameter(force_trap_bad_h2d_phase)
+ * defined in dhd_linux.c
+ */
+bool force_trap_bad_h2d_phase = 0;
+
+int dhd_dongle_ramsize;
+struct dhd_bus *g_dhd_bus = NULL;
+#ifdef DNGL_AXI_ERROR_LOGGING
+static void dhd_log_dump_axi_error(uint8 *axi_err);
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+static int dhdpcie_checkdied(dhd_bus_t *bus, char *data, uint size);
+static int dhdpcie_bus_readconsole(dhd_bus_t *bus);
+#if defined(DHD_FW_COREDUMP)
+static int dhdpcie_mem_dump(dhd_bus_t *bus);
+static int dhdpcie_get_mem_dump(dhd_bus_t *bus);
+#endif /* DHD_FW_COREDUMP */
+
+static int dhdpcie_bus_membytes(dhd_bus_t *bus, bool write, ulong address, uint8 *data, uint size);
+static int dhdpcie_bus_doiovar(dhd_bus_t *bus, const bcm_iovar_t *vi, uint32 actionid,
+       const char *name, void *params,
+       uint plen, void *arg, uint len, int val_size);
+static int dhdpcie_bus_lpback_req(struct  dhd_bus *bus, uint32 intval);
+static int dhdpcie_bus_dmaxfer_req(struct  dhd_bus *bus,
+       uint32 len, uint32 srcdelay, uint32 destdelay,
+       uint32 d11_lpbk, uint32 core_num, uint32 wait);
+static uint serialized_backplane_access(dhd_bus_t* bus, uint addr, uint size, uint* val, bool read);
+static int dhdpcie_bus_download_state(dhd_bus_t *bus, bool enter);
+static int _dhdpcie_download_firmware(struct dhd_bus *bus);
+static int dhdpcie_download_firmware(dhd_bus_t *bus, osl_t *osh);
+
+#if defined(FW_SIGNATURE)
+static int dhdpcie_bus_download_fw_signature(dhd_bus_t *bus, bool *do_write);
+static int dhdpcie_bus_download_ram_bootloader(dhd_bus_t *bus);
+static int dhdpcie_bus_write_fws_status(dhd_bus_t *bus);
+static int dhdpcie_bus_write_fws_mem_info(dhd_bus_t *bus);
+static int dhdpcie_bus_write_fwsig(dhd_bus_t *bus, char *fwsig_path, char *nvsig_path);
+static int dhdpcie_download_rtlv_end(dhd_bus_t *bus);
+static int dhdpcie_bus_save_download_info(dhd_bus_t *bus, uint32 download_addr,
+       uint32 download_size, const char *signature_fname,
+       const char *bloader_fname, uint32 bloader_download_addr);
+#endif /* FW_SIGNATURE */
+
+static int dhdpcie_bus_write_vars(dhd_bus_t *bus);
+static bool dhdpcie_bus_process_mailbox_intr(dhd_bus_t *bus, uint32 intstatus);
+static bool dhdpci_bus_read_frames(dhd_bus_t *bus);
+static int dhdpcie_readshared(dhd_bus_t *bus);
+static void dhdpcie_init_shared_addr(dhd_bus_t *bus);
+static bool dhdpcie_dongle_attach(dhd_bus_t *bus);
+static void dhdpcie_bus_dongle_setmemsize(dhd_bus_t *bus, int mem_size);
+static void dhdpcie_bus_release_dongle(dhd_bus_t *bus, osl_t *osh,
+       bool dongle_isolation, bool reset_flag);
+static void dhdpcie_bus_release_malloc(dhd_bus_t *bus, osl_t *osh);
+static int dhdpcie_downloadvars(dhd_bus_t *bus, void *arg, int len);
+static void dhdpcie_setbar1win(dhd_bus_t *bus, uint32 addr);
+static void dhd_init_bar1_switch_lock(dhd_bus_t *bus);
+static void dhd_deinit_bar1_switch_lock(dhd_bus_t *bus);
+static void dhd_init_pwr_req_lock(dhd_bus_t *bus);
+static void dhd_deinit_pwr_req_lock(dhd_bus_t *bus);
+static void dhd_init_bus_lp_state_lock(dhd_bus_t *bus);
+static void dhd_deinit_bus_lp_state_lock(dhd_bus_t *bus);
+static void dhd_init_backplane_access_lock(dhd_bus_t *bus);
+static void dhd_deinit_backplane_access_lock(dhd_bus_t *bus);
+static uint8 dhdpcie_bus_rtcm8(dhd_bus_t *bus, ulong offset);
+static void dhdpcie_bus_wtcm8(dhd_bus_t *bus, ulong offset, uint8 data);
+static void dhdpcie_bus_wtcm16(dhd_bus_t *bus, ulong offset, uint16 data);
+static uint16 dhdpcie_bus_rtcm16(dhd_bus_t *bus, ulong offset);
+static void dhdpcie_bus_wtcm32(dhd_bus_t *bus, ulong offset, uint32 data);
+static uint32 dhdpcie_bus_rtcm32(dhd_bus_t *bus, ulong offset);
+#ifdef DHD_SUPPORT_64BIT
+static void dhdpcie_bus_wtcm64(dhd_bus_t *bus, ulong offset, uint64 data) __attribute__ ((used));
+static uint64 dhdpcie_bus_rtcm64(dhd_bus_t *bus, ulong offset) __attribute__ ((used));
+#endif /* DHD_SUPPORT_64BIT */
+static void dhdpcie_bus_cfg_set_bar0_win(dhd_bus_t *bus, uint32 data);
+static void dhdpcie_bus_reg_unmap(osl_t *osh, volatile char *addr, int size);
+static int dhdpcie_cc_nvmshadow(dhd_bus_t *bus, struct bcmstrbuf *b);
+static void dhdpcie_fw_trap(dhd_bus_t *bus);
+static void dhd_fillup_ring_sharedptr_info(dhd_bus_t *bus, ring_info_t *ring_info);
+static void dhdpcie_handle_mb_data(dhd_bus_t *bus);
+extern void dhd_dpc_enable(dhd_pub_t *dhdp);
+#ifdef PCIE_INB_DW
+static void dhd_bus_ds_trace(dhd_bus_t *bus, uint32 dsval,
+       bool d2h, enum dhd_bus_ds_state inbstate);
+#else
+static void dhd_bus_ds_trace(dhd_bus_t *bus, uint32 dsval, bool d2h);
+#endif /* PCIE_INB_DW */
+extern void dhd_dpc_kill(dhd_pub_t *dhdp);
+
+#ifdef IDLE_TX_FLOW_MGMT
+static void dhd_bus_check_idle_scan(dhd_bus_t *bus);
+static void dhd_bus_idle_scan(dhd_bus_t *bus);
+#endif /* IDLE_TX_FLOW_MGMT */
+
+#ifdef EXYNOS_PCIE_DEBUG
+extern void exynos_pcie_register_dump(int ch_num);
+#endif /* EXYNOS_PCIE_DEBUG */
+
+#if defined(DHD_H2D_LOG_TIME_SYNC)
+static void dhdpci_bus_rte_log_time_sync_poll(dhd_bus_t *bus);
+#endif /* DHD_H2D_LOG_TIME_SYNC */
+
+#define     PCI_VENDOR_ID_BROADCOM          0x14e4
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+#define MAX_D3_ACK_TIMEOUT     100
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#define DHD_DEFAULT_DOORBELL_TIMEOUT 200       /* ms */
+#if defined(PCIE_INB_DW)
+static uint dhd_doorbell_timeout = DHD_DEFAULT_DOORBELL_TIMEOUT;
+#endif
+
+static bool dhdpcie_check_firmware_compatible(uint32 f_api_version, uint32 h_api_version);
+static int dhdpcie_cto_error_recovery(struct dhd_bus *bus);
+
+static int dhdpcie_init_d11status(struct dhd_bus *bus);
+
+static int dhdpcie_wrt_rnd(struct dhd_bus *bus);
+
+#define NUM_PATTERNS 2
+static bool dhd_bus_tcm_test(struct dhd_bus *bus);
+
+#if defined(FW_SIGNATURE)
+static int dhd_bus_dump_fws(dhd_bus_t *bus, struct bcmstrbuf *strbuf);
+#endif
+static void dhdpcie_pme_stat_clear(dhd_bus_t *bus);
+
+/* IOVar table */
+enum {
+       IOV_INTR = 1,
+       IOV_MEMSIZE,
+       IOV_SET_DOWNLOAD_STATE,
+       IOV_SET_DOWNLOAD_INFO,
+       IOV_DEVRESET,
+       IOV_VARS,
+       IOV_MSI_SIM,
+       IOV_PCIE_LPBK,
+       IOV_CC_NVMSHADOW,
+       IOV_RAMSIZE,
+       IOV_RAMSTART,
+       IOV_SLEEP_ALLOWED,
+       IOV_PCIE_DMAXFER,
+       IOV_PCIE_SUSPEND,
+       IOV_DONGLEISOLATION,
+       IOV_LTRSLEEPON_UNLOOAD,
+       IOV_METADATA_DBG,
+       IOV_RX_METADATALEN,
+       IOV_TX_METADATALEN,
+       IOV_TXP_THRESHOLD,
+       IOV_BUZZZ_DUMP,
+       IOV_DUMP_RINGUPD_BLOCK,
+       IOV_DMA_RINGINDICES,
+       IOV_FORCE_FW_TRAP,
+       IOV_DB1_FOR_MB,
+       IOV_FLOW_PRIO_MAP,
+#ifdef DHD_PCIE_RUNTIMEPM
+       IOV_IDLETIME,
+#endif /* DHD_PCIE_RUNTIMEPM */
+       IOV_RXBOUND,
+       IOV_TXBOUND,
+       IOV_HANGREPORT,
+       IOV_H2D_MAILBOXDATA,
+       IOV_INFORINGS,
+       IOV_H2D_PHASE,
+       IOV_H2D_ENABLE_TRAP_BADPHASE,
+       IOV_H2D_TXPOST_MAX_ITEM,
+#if defined(DHD_HTPUT_TUNABLES)
+       IOV_H2D_HTPUT_TXPOST_MAX_ITEM,
+#endif /* DHD_HTPUT_TUNABLES */
+       IOV_TRAPDATA,
+       IOV_TRAPDATA_RAW,
+       IOV_CTO_PREVENTION,
+       IOV_PCIE_WD_RESET,
+       IOV_DUMP_DONGLE,
+       IOV_HWA_ENABLE,
+       IOV_IDMA_ENABLE,
+       IOV_IFRM_ENABLE,
+       IOV_CLEAR_RING,
+       IOV_DAR_ENABLE,
+       IOV_DNGL_CAPS,   /**< returns string with dongle capabilities */
+#if defined(DEBUGGER) || defined(DHD_DSCOPE)
+       IOV_GDB_SERVER,  /**< starts gdb server on given interface */
+#endif /* DEBUGGER || DHD_DSCOPE */
+#if defined(GDB_PROXY)
+       IOV_GDB_PROXY_PROBE, /**< gdb proxy support presence check */
+       IOV_GDB_PROXY_STOP_COUNT, /**< gdb proxy firmware stop count */
+#endif /* GDB_PROXY */
+       IOV_INB_DW_ENABLE,
+#if defined(PCIE_INB_DW)
+       IOV_DEEP_SLEEP,
+#endif
+       IOV_CTO_THRESHOLD,
+       IOV_HSCBSIZE, /* get HSCB buffer size */
+       IOV_HP2P_ENABLE,
+       IOV_HP2P_PKT_THRESHOLD,
+       IOV_HP2P_TIME_THRESHOLD,
+       IOV_HP2P_PKT_EXPIRY,
+       IOV_HP2P_TXCPL_MAXITEMS,
+       IOV_HP2P_RXCPL_MAXITEMS,
+       IOV_EXTDTXS_IN_TXCPL,
+       IOV_HOSTRDY_AFTER_INIT,
+       IOV_HP2P_MF_ENABLE,
+       IOV_PCIE_LAST /**< unused IOVAR */
+};
+
+const bcm_iovar_t dhdpcie_iovars[] = {
+       {"intr",        IOV_INTR,       0,      0, IOVT_BOOL,   0 },
+       {"memsize",     IOV_MEMSIZE,    0,      0, IOVT_UINT32, 0 },
+       {"dwnldstate",  IOV_SET_DOWNLOAD_STATE, 0,      0, IOVT_BOOL,   0 },
+       {"dwnldinfo",   IOV_SET_DOWNLOAD_INFO,  0,      0, IOVT_BUFFER,
+       sizeof(fw_download_info_t) },
+       {"vars",        IOV_VARS,       0,      0, IOVT_BUFFER, 0 },
+       {"devreset",    IOV_DEVRESET,   0,      0, IOVT_UINT8,  0 },
+       {"pcie_device_trap", IOV_FORCE_FW_TRAP, 0,      0, 0,   0 },
+       {"pcie_lpbk",   IOV_PCIE_LPBK,  0,      0, IOVT_UINT32, 0 },
+       {"cc_nvmshadow", IOV_CC_NVMSHADOW, 0,   0, IOVT_BUFFER, 0 },
+       {"ramsize",     IOV_RAMSIZE,    0,      0, IOVT_UINT32, 0 },
+       {"ramstart",    IOV_RAMSTART,   0,      0, IOVT_UINT32, 0 },
+       {"pcie_dmaxfer", IOV_PCIE_DMAXFER, 0, 0, IOVT_BUFFER, sizeof(dma_xfer_info_t)},
+       {"pcie_suspend", IOV_PCIE_SUSPEND,      DHD_IOVF_PWRREQ_BYPASS, 0, IOVT_UINT32, 0 },
+       {"sleep_allowed",       IOV_SLEEP_ALLOWED,      0,      0, IOVT_BOOL,   0 },
+       {"dngl_isolation", IOV_DONGLEISOLATION, 0,      0, IOVT_UINT32, 0 },
+       {"ltrsleep_on_unload", IOV_LTRSLEEPON_UNLOOAD,  0,      0, IOVT_UINT32, 0 },
+       {"dump_ringupdblk", IOV_DUMP_RINGUPD_BLOCK,     0,      0, IOVT_BUFFER, 0 },
+       {"dma_ring_indices", IOV_DMA_RINGINDICES,       0,      0, IOVT_UINT32, 0},
+       {"metadata_dbg", IOV_METADATA_DBG,      0,      0, IOVT_BOOL,   0 },
+       {"rx_metadata_len", IOV_RX_METADATALEN, 0,      0, IOVT_UINT32, 0 },
+       {"tx_metadata_len", IOV_TX_METADATALEN, 0,      0, IOVT_UINT32, 0 },
+       {"db1_for_mb", IOV_DB1_FOR_MB,  0,      0, IOVT_UINT32, 0 },
+       {"txp_thresh", IOV_TXP_THRESHOLD,       0,      0, IOVT_UINT32, 0 },
+       {"buzzz_dump", IOV_BUZZZ_DUMP,          0,      0, IOVT_UINT32, 0 },
+       {"flow_prio_map", IOV_FLOW_PRIO_MAP,    0,      0, IOVT_UINT32, 0 },
+#ifdef DHD_PCIE_RUNTIMEPM
+       {"idletime",    IOV_IDLETIME,   0,      0, IOVT_INT32,     0 },
+#endif /* DHD_PCIE_RUNTIMEPM */
+       {"rxbound",     IOV_RXBOUND,    0, 0,   IOVT_UINT32,    0 },
+       {"txbound",     IOV_TXBOUND,    0, 0,   IOVT_UINT32,    0 },
+       {"fw_hang_report", IOV_HANGREPORT,      0, 0,   IOVT_BOOL,      0 },
+       {"h2d_mb_data",     IOV_H2D_MAILBOXDATA,    0, 0,      IOVT_UINT32,    0 },
+       {"inforings",   IOV_INFORINGS,    0, 0,      IOVT_UINT32,    0 },
+       {"h2d_phase",   IOV_H2D_PHASE,    0, 0,      IOVT_UINT32,    0 },
+       {"force_trap_bad_h2d_phase", IOV_H2D_ENABLE_TRAP_BADPHASE,    0, 0,
+       IOVT_UINT32,    0 },
+       {"h2d_max_txpost",   IOV_H2D_TXPOST_MAX_ITEM,    0, 0,      IOVT_UINT32,    0 },
+#if defined(DHD_HTPUT_TUNABLES)
+       {"h2d_htput_max_txpost", IOV_H2D_HTPUT_TXPOST_MAX_ITEM,    0, 0,      IOVT_UINT32,    0 },
+#endif /* DHD_HTPUT_TUNABLES */
+       {"trap_data",   IOV_TRAPDATA,   0, 0,   IOVT_BUFFER,    0 },
+       {"trap_data_raw",       IOV_TRAPDATA_RAW,       0, 0,   IOVT_BUFFER,    0 },
+       {"cto_prevention",      IOV_CTO_PREVENTION,     0, 0,   IOVT_UINT32,    0 },
+       {"pcie_wd_reset",       IOV_PCIE_WD_RESET,      0,      0, IOVT_BOOL,   0 },
+       {"dump_dongle", IOV_DUMP_DONGLE, 0, 0, IOVT_BUFFER,
+       MAX(sizeof(dump_dongle_in_t), sizeof(dump_dongle_out_t))},
+       {"clear_ring",   IOV_CLEAR_RING,    0, 0,  IOVT_UINT32,    0 },
+       {"hwa_enable",   IOV_HWA_ENABLE,    0, 0,  IOVT_UINT32,    0 },
+       {"idma_enable",   IOV_IDMA_ENABLE,    0, 0,  IOVT_UINT32,    0 },
+       {"ifrm_enable",   IOV_IFRM_ENABLE,    0, 0,  IOVT_UINT32,    0 },
+       {"dar_enable",   IOV_DAR_ENABLE,    0, 0,  IOVT_UINT32,    0 },
+       {"cap", IOV_DNGL_CAPS,  0, 0, IOVT_BUFFER,      0},
+#if defined(DEBUGGER) || defined(DHD_DSCOPE)
+       {"gdb_server", IOV_GDB_SERVER,    0, 0,      IOVT_UINT32,    0 },
+#endif /* DEBUGGER || DHD_DSCOPE */
+#if defined(GDB_PROXY)
+       {"gdb_proxy_probe", IOV_GDB_PROXY_PROBE, 0, 0, IOVT_BUFFER, 2 * sizeof(int32) },
+       {"gdb_proxy_stop_count", IOV_GDB_PROXY_STOP_COUNT, 0, 0, IOVT_UINT32, 0 },
+#endif /* GDB_PROXY */
+       {"inb_dw_enable",   IOV_INB_DW_ENABLE,    0, 0,  IOVT_UINT32,    0 },
+#if defined(PCIE_INB_DW)
+       {"deep_sleep", IOV_DEEP_SLEEP, 0, 0, IOVT_UINT32,    0},
+#endif
+       {"cto_threshold",       IOV_CTO_THRESHOLD,      0,      0, IOVT_UINT32, 0 },
+       {"hscbsize",    IOV_HSCBSIZE,   0,      0,      IOVT_UINT32,    0 },
+
+       {"extdtxs_in_txcpl", IOV_EXTDTXS_IN_TXCPL,      0,      0, IOVT_UINT32, 0 },
+       {"hostrdy_after_init", IOV_HOSTRDY_AFTER_INIT,  0,      0, IOVT_UINT32, 0 },
+       {"hp2p_mf_enable", IOV_HP2P_MF_ENABLE,  0,      0, IOVT_UINT32, 0 },
+       {NULL, 0, 0, 0, 0, 0 }
+};
+
+#define MAX_READ_TIMEOUT       2 * 1000 * 1000
+
+#ifndef DHD_RXBOUND
+#define DHD_RXBOUND            64
+#endif
+#ifndef DHD_TXBOUND
+#define DHD_TXBOUND            64
+#endif
+
+#define DHD_INFORING_BOUND     32
+#define DHD_BTLOGRING_BOUND    32
+
+uint dhd_rxbound = DHD_RXBOUND;
+uint dhd_txbound = DHD_TXBOUND;
+
+#if defined(DEBUGGER) || defined(DHD_DSCOPE)
+/** the GDB debugger layer will call back into this (bus) layer to read/write dongle memory */
+static struct dhd_gdb_bus_ops_s  bus_ops = {
+       .read_u16 = dhdpcie_bus_rtcm16,
+       .read_u32 = dhdpcie_bus_rtcm32,
+       .write_u32 = dhdpcie_bus_wtcm32,
+};
+#endif /* DEBUGGER || DHD_DSCOPE */
+
+bool
+dhd_bus_get_flr_force_fail(struct dhd_bus *bus)
+{
+       return bus->flr_force_fail;
+}
+
+/**
+ * Register/Unregister functions are called by the main DHD entry point (eg module insertion) to
+ * link with the bus driver, in order to look for or await the device.
+ */
+int
+dhd_bus_register(void)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       return dhdpcie_bus_register();
+}
+
+void
+dhd_bus_unregister(void)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       dhdpcie_bus_unregister();
+       return;
+}
+
+/** returns a host virtual address */
+uint32 *
+dhdpcie_bus_reg_map(osl_t *osh, ulong addr, int size)
+{
+       return (uint32 *)REG_MAP(addr, size);
+}
+
+void
+dhdpcie_bus_reg_unmap(osl_t *osh, volatile char *addr, int size)
+{
+       REG_UNMAP(addr);
+       return;
+}
+
+/**
+ * retrun H2D Doorbell registers address
+ * use DAR registers instead of enum register for corerev >= 23 (4347B0)
+ */
+static INLINE uint
+dhd_bus_db0_addr_get(struct dhd_bus *bus)
+{
+       uint addr = PCIH2D_MailBox;
+       uint dar_addr = DAR_PCIH2D_DB0_0(bus->sih->buscorerev);
+
+       return ((DAR_ACTIVE(bus->dhd)) ? dar_addr : addr);
+}
+
+static INLINE uint
+dhd_bus_db0_addr_2_get(struct dhd_bus *bus)
+{
+       return ((DAR_ACTIVE(bus->dhd)) ? DAR_PCIH2D_DB2_0(bus->sih->buscorerev) : PCIH2D_MailBox_2);
+}
+
+static INLINE uint
+dhd_bus_db1_addr_get(struct dhd_bus *bus)
+{
+       return ((DAR_ACTIVE(bus->dhd)) ? DAR_PCIH2D_DB0_1(bus->sih->buscorerev) : PCIH2D_DB1);
+}
+
+static INLINE uint
+dhd_bus_db1_addr_3_get(struct dhd_bus *bus)
+{
+       return ((DAR_ACTIVE(bus->dhd)) ? DAR_PCIH2D_DB3_1(bus->sih->buscorerev) : PCIH2D_DB1_3);
+}
+
+static void
+dhd_init_pwr_req_lock(dhd_bus_t *bus)
+{
+       if (!bus->pwr_req_lock) {
+               bus->pwr_req_lock = osl_spin_lock_init(bus->osh);
+       }
+}
+
+static void
+dhd_deinit_pwr_req_lock(dhd_bus_t *bus)
+{
+       if (bus->pwr_req_lock) {
+               osl_spin_lock_deinit(bus->osh, bus->pwr_req_lock);
+               bus->pwr_req_lock = NULL;
+       }
+}
+
+/*
+ * WAR for SWWLAN-215055 - [4378B0] ARM fails to boot without DAR WL domain request
+ */
+static INLINE void
+dhd_bus_pcie_pwr_req_wl_domain(struct dhd_bus *bus, uint offset, bool enable)
+{
+       if (enable) {
+               si_corereg(bus->sih, bus->sih->buscoreidx, offset,
+                       SRPWR_DMN1_ARMBPSD_MASK << SRPWR_REQON_SHIFT,
+                       SRPWR_DMN1_ARMBPSD_MASK << SRPWR_REQON_SHIFT);
+       } else {
+               si_corereg(bus->sih, bus->sih->buscoreidx, offset,
+                       SRPWR_DMN1_ARMBPSD_MASK << SRPWR_REQON_SHIFT, 0);
+       }
+}
+
+static INLINE void
+_dhd_bus_pcie_pwr_req_clear_cmn(struct dhd_bus *bus)
+{
+       uint mask;
+
+       /*
+        * If multiple de-asserts, decrement ref and return
+        * Clear power request when only one pending
+        * so initial request is not removed unexpectedly
+        */
+       if (bus->pwr_req_ref > 1) {
+               bus->pwr_req_ref--;
+               return;
+       }
+
+       ASSERT(bus->pwr_req_ref == 1);
+
+       if (MULTIBP_ENAB(bus->sih)) {
+               /* Common BP controlled by HW so only need to toggle WL/ARM backplane */
+               mask = SRPWR_DMN1_ARMBPSD_MASK;
+       } else {
+               mask = SRPWR_DMN0_PCIE_MASK | SRPWR_DMN1_ARMBPSD_MASK;
+       }
+
+       si_srpwr_request(bus->sih, mask, 0);
+       bus->pwr_req_ref = 0;
+}
+
+static INLINE void
+dhd_bus_pcie_pwr_req_clear(struct dhd_bus *bus)
+{
+       unsigned long flags = 0;
+
+       DHD_BUS_PWR_REQ_LOCK(bus->pwr_req_lock, flags);
+       _dhd_bus_pcie_pwr_req_clear_cmn(bus);
+       DHD_BUS_PWR_REQ_UNLOCK(bus->pwr_req_lock, flags);
+}
+
+static INLINE void
+dhd_bus_pcie_pwr_req_clear_nolock(struct dhd_bus *bus)
+{
+       _dhd_bus_pcie_pwr_req_clear_cmn(bus);
+}
+
+static INLINE void
+_dhd_bus_pcie_pwr_req_cmn(struct dhd_bus *bus)
+{
+       uint mask, val;
+
+       /* If multiple request entries, increment reference and return */
+       if (bus->pwr_req_ref > 0) {
+               bus->pwr_req_ref++;
+               return;
+       }
+
+       ASSERT(bus->pwr_req_ref == 0);
+
+       if (MULTIBP_ENAB(bus->sih)) {
+               /* Common BP controlled by HW so only need to toggle WL/ARM backplane */
+               mask = SRPWR_DMN1_ARMBPSD_MASK;
+               val = SRPWR_DMN1_ARMBPSD_MASK;
+       } else {
+               mask = SRPWR_DMN0_PCIE_MASK | SRPWR_DMN1_ARMBPSD_MASK;
+               val = SRPWR_DMN0_PCIE_MASK | SRPWR_DMN1_ARMBPSD_MASK;
+       }
+
+       si_srpwr_request(bus->sih, mask, val);
+
+       bus->pwr_req_ref = 1;
+}
+
+static INLINE void
+dhd_bus_pcie_pwr_req(struct dhd_bus *bus)
+{
+       unsigned long flags = 0;
+
+       DHD_BUS_PWR_REQ_LOCK(bus->pwr_req_lock, flags);
+       _dhd_bus_pcie_pwr_req_cmn(bus);
+       DHD_BUS_PWR_REQ_UNLOCK(bus->pwr_req_lock, flags);
+}
+
+static INLINE void
+_dhd_bus_pcie_pwr_req_pd0123_cmn(struct dhd_bus *bus)
+{
+       uint mask, val;
+
+       mask = SRPWR_DMN_ALL_MASK(bus->sih);
+       val = SRPWR_DMN_ALL_MASK(bus->sih);
+
+       si_srpwr_request(bus->sih, mask, val);
+}
+
+void
+dhd_bus_pcie_pwr_req_reload_war(struct dhd_bus *bus)
+{
+       unsigned long flags = 0;
+
+       /*
+        * Few corerevs need the power domain to be active for FLR.
+        * Return if the pwr req is not applicable for the corerev
+        */
+       if (!(PCIE_PWR_REQ_RELOAD_WAR_ENAB(bus->sih->buscorerev))) {
+               return;
+       }
+
+       DHD_BUS_PWR_REQ_LOCK(bus->pwr_req_lock, flags);
+       _dhd_bus_pcie_pwr_req_pd0123_cmn(bus);
+       DHD_BUS_PWR_REQ_UNLOCK(bus->pwr_req_lock, flags);
+}
+
+static INLINE void
+_dhd_bus_pcie_pwr_req_clear_pd0123_cmn(struct dhd_bus *bus)
+{
+       uint mask;
+
+       mask = SRPWR_DMN_ALL_MASK(bus->sih);
+
+       si_srpwr_request(bus->sih, mask, 0);
+}
+
+void
+dhd_bus_pcie_pwr_req_clear_reload_war(struct dhd_bus *bus)
+{
+       unsigned long flags = 0;
+
+       /* return if the pwr clear is not applicable for the corerev */
+       if (!(PCIE_PWR_REQ_RELOAD_WAR_ENAB(bus->sih->buscorerev))) {
+               return;
+       }
+       DHD_BUS_PWR_REQ_LOCK(bus->pwr_req_lock, flags);
+       _dhd_bus_pcie_pwr_req_clear_pd0123_cmn(bus);
+       DHD_BUS_PWR_REQ_UNLOCK(bus->pwr_req_lock, flags);
+}
+
+static INLINE void
+dhd_bus_pcie_pwr_req_nolock(struct dhd_bus *bus)
+{
+       _dhd_bus_pcie_pwr_req_cmn(bus);
+}
+
+bool
+dhdpcie_chip_support_msi(dhd_bus_t *bus)
+{
+       /* XXX For chips with buscorerev <= 14 intstatus
+        * is not getting cleared from these firmwares.
+        * Either host can read and clear intstatus for these
+        * or not enable MSI at all.
+        * Here option 2 of not enabling MSI is choosen.
+        * Also for hw4 chips, msi is not enabled.
+        */
+       DHD_INFO(("%s: buscorerev=%d chipid=0x%x\n",
+               __FUNCTION__, bus->sih->buscorerev, si_chipid(bus->sih)));
+       if (bus->sih->buscorerev <= 14 ||
+               si_chipid(bus->sih) == BCM4389_CHIP_ID ||
+               si_chipid(bus->sih) == BCM4385_CHIP_ID ||
+               si_chipid(bus->sih) == BCM4375_CHIP_ID ||
+               si_chipid(bus->sih) == BCM4376_CHIP_ID ||
+               si_chipid(bus->sih) == BCM4362_CHIP_ID ||
+               si_chipid(bus->sih) == BCM43751_CHIP_ID ||
+               si_chipid(bus->sih) == BCM43752_CHIP_ID ||
+               si_chipid(bus->sih) == BCM4361_CHIP_ID ||
+               si_chipid(bus->sih) == BCM4359_CHIP_ID) {
+               return FALSE;
+       } else {
+               return TRUE;
+       }
+}
+
+/**
+ * Called once for each hardware (dongle) instance that this DHD manages.
+ *
+ * 'regs' is the host virtual address that maps to the start of the PCIe BAR0 window. The first 4096
+ * bytes in this window are mapped to the backplane address in the PCIEBAR0Window register. The
+ * precondition is that the PCIEBAR0Window register 'points' at the PCIe core.
+ *
+ * 'tcm' is the *host* virtual address at which tcm is mapped.
+ */
+int dhdpcie_bus_attach(osl_t *osh, dhd_bus_t **bus_ptr,
+       volatile char *regs, volatile char *tcm, void *pci_dev)
+{
+       dhd_bus_t *bus = NULL;
+       int ret = BCME_OK;
+
+       DHD_TRACE(("%s: ENTER\n", __FUNCTION__));
+
+       do {
+               if (!(bus = MALLOCZ(osh, sizeof(dhd_bus_t)))) {
+                       DHD_ERROR(("%s: MALLOC of dhd_bus_t failed\n", __FUNCTION__));
+                       ret = BCME_NORESOURCE;
+                       break;
+               }
+
+               bus->regs = regs;
+               bus->tcm = tcm;
+               bus->osh = osh;
+               /* Save pci_dev into dhd_bus, as it may be needed in dhd_attach */
+               bus->dev = (struct pci_dev *)pci_dev;
+
+               dll_init(&bus->flowring_active_list);
+#ifdef IDLE_TX_FLOW_MGMT
+               bus->active_list_last_process_ts = OSL_SYSUPTIME();
+#endif /* IDLE_TX_FLOW_MGMT */
+
+               /* Attach pcie shared structure */
+               if (!(bus->pcie_sh = MALLOCZ(osh, sizeof(pciedev_shared_t)))) {
+                       DHD_ERROR(("%s: MALLOC of bus->pcie_sh failed\n", __FUNCTION__));
+                       ret = BCME_NORESOURCE;
+                       break;
+               }
+
+               /* dhd_common_init(osh); */
+
+               if (dhdpcie_dongle_attach(bus)) {
+                       DHD_ERROR(("%s: dhdpcie_probe_attach failed\n", __FUNCTION__));
+                       ret = BCME_NOTREADY;
+                       break;
+               }
+
+               /* software resources */
+               if (!(bus->dhd = dhd_attach(osh, bus, PCMSGBUF_HDRLEN))) {
+                       DHD_ERROR(("%s: dhd_attach failed\n", __FUNCTION__));
+                       ret = BCME_NORESOURCE;
+                       break;
+               }
+               DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+               bus->dhd->busstate = DHD_BUS_DOWN;
+               bus->dhd->hostrdy_after_init = TRUE;
+               bus->db1_for_mb = TRUE;
+               bus->dhd->hang_report = TRUE;
+               bus->use_mailbox = FALSE;
+               bus->use_d0_inform = FALSE;
+               bus->intr_enabled = FALSE;
+               bus->flr_force_fail = FALSE;
+               /* update the dma indices if set through module parameter. */
+               if (dma_ring_indices != 0) {
+                       dhdpcie_set_dma_ring_indices(bus->dhd, dma_ring_indices);
+               }
+               /* update h2d phase support if set through module parameter */
+               bus->dhd->h2d_phase_supported = h2d_phase ? TRUE : FALSE;
+               /* update force trap on bad phase if set through module parameter */
+               bus->dhd->force_dongletrap_on_bad_h2d_phase =
+                       force_trap_bad_h2d_phase ? TRUE : FALSE;
+#ifdef IDLE_TX_FLOW_MGMT
+               bus->enable_idle_flowring_mgmt = FALSE;
+#endif /* IDLE_TX_FLOW_MGMT */
+               bus->irq_registered = FALSE;
+
+#ifdef DHD_MSI_SUPPORT
+               bus->d2h_intr_method = enable_msi && dhdpcie_chip_support_msi(bus) ?
+                       PCIE_MSI : PCIE_INTX;
+#else
+               bus->d2h_intr_method = PCIE_INTX;
+#endif /* DHD_MSI_SUPPORT */
+
+               DHD_TRACE(("%s: EXIT SUCCESS\n",
+                       __FUNCTION__));
+               g_dhd_bus = bus;
+               *bus_ptr = bus;
+               return ret;
+       } while (0);
+
+       DHD_TRACE(("%s: EXIT FAILURE\n", __FUNCTION__));
+       if (bus && bus->pcie_sh) {
+               MFREE(osh, bus->pcie_sh, sizeof(pciedev_shared_t));
+       }
+
+       if (bus) {
+               MFREE(osh, bus, sizeof(dhd_bus_t));
+       }
+
+       return ret;
+}
+
+bool
+dhd_bus_skip_clm(dhd_pub_t *dhdp)
+{
+       switch (dhd_bus_chip_id(dhdp)) {
+               case BCM4369_CHIP_ID:
+                       return TRUE;
+               default:
+                       return FALSE;
+       }
+}
+
+uint
+dhd_bus_chip(struct dhd_bus *bus)
+{
+       ASSERT(bus->sih != NULL);
+       return bus->sih->chip;
+}
+
+uint
+dhd_bus_chiprev(struct dhd_bus *bus)
+{
+       ASSERT(bus);
+       ASSERT(bus->sih != NULL);
+       return bus->sih->chiprev;
+}
+
+void *
+dhd_bus_pub(struct dhd_bus *bus)
+{
+       return bus->dhd;
+}
+
+void *
+dhd_bus_sih(struct dhd_bus *bus)
+{
+       return (void *)bus->sih;
+}
+
+void *
+dhd_bus_txq(struct dhd_bus *bus)
+{
+       return &bus->txq;
+}
+
+/** Get Chip ID version */
+uint dhd_bus_chip_id(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       return  bus->sih->chip;
+}
+
+/** Get Chip Rev ID version */
+uint dhd_bus_chiprev_id(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       return bus->sih->chiprev;
+}
+
+/** Get Chip Pkg ID version */
+uint dhd_bus_chippkg_id(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       return bus->sih->chippkg;
+}
+
+/** Conduct Loopback test */
+int
+dhd_bus_dmaxfer_lpbk(dhd_pub_t *dhdp, uint32 type)
+{
+       dma_xfer_info_t dmaxfer_lpbk;
+       int ret = BCME_OK;
+
+#define PCIE_DMAXFER_LPBK_LENGTH       4096
+       memset(&dmaxfer_lpbk, 0, sizeof(dma_xfer_info_t));
+       dmaxfer_lpbk.version = DHD_DMAXFER_VERSION;
+       dmaxfer_lpbk.length = (uint16)sizeof(dma_xfer_info_t);
+       dmaxfer_lpbk.num_bytes = PCIE_DMAXFER_LPBK_LENGTH;
+       dmaxfer_lpbk.type = type;
+       dmaxfer_lpbk.should_wait = TRUE;
+
+       ret = dhd_bus_iovar_op(dhdp, "pcie_dmaxfer", NULL, 0,
+               (char *)&dmaxfer_lpbk, sizeof(dma_xfer_info_t), IOV_SET);
+       if (ret < 0) {
+               DHD_ERROR(("failed to start PCIe Loopback Test!!! "
+                       "Type:%d Reason:%d\n", type, ret));
+               return ret;
+       }
+
+       if (dmaxfer_lpbk.status != DMA_XFER_SUCCESS) {
+               DHD_ERROR(("failed to check PCIe Loopback Test!!! "
+                       "Type:%d Status:%d Error code:%d\n", type,
+                       dmaxfer_lpbk.status, dmaxfer_lpbk.error_code));
+               ret = BCME_ERROR;
+       } else {
+               DHD_ERROR(("successful to check PCIe Loopback Test"
+                       " Type:%d\n", type));
+       }
+#undef PCIE_DMAXFER_LPBK_LENGTH
+
+       return ret;
+}
+
+/* Check if there is DPC scheduling errors */
+bool
+dhd_bus_query_dpc_sched_errors(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       bool sched_err;
+
+       if (bus->dpc_entry_time < bus->isr_exit_time) {
+               /* Kernel doesn't schedule the DPC after processing PCIe IRQ */
+               sched_err = TRUE;
+       } else if (bus->dpc_entry_time < bus->resched_dpc_time) {
+               /* Kernel doesn't schedule the DPC after DHD tries to reschedule
+                * the DPC due to pending work items to be processed.
+                */
+               sched_err = TRUE;
+       } else {
+               sched_err = FALSE;
+       }
+
+       if (sched_err) {
+               /* print out minimum timestamp info */
+               DHD_ERROR(("isr_entry_time="SEC_USEC_FMT
+                       " isr_exit_time="SEC_USEC_FMT
+                       " dpc_entry_time="SEC_USEC_FMT
+                       "\ndpc_exit_time="SEC_USEC_FMT
+                       " isr_sched_dpc_time="SEC_USEC_FMT
+                       " resched_dpc_time="SEC_USEC_FMT"\n",
+                       GET_SEC_USEC(bus->isr_entry_time),
+                       GET_SEC_USEC(bus->isr_exit_time),
+                       GET_SEC_USEC(bus->dpc_entry_time),
+                       GET_SEC_USEC(bus->dpc_exit_time),
+                       GET_SEC_USEC(bus->isr_sched_dpc_time),
+                       GET_SEC_USEC(bus->resched_dpc_time)));
+       }
+
+       return sched_err;
+}
+
+/** Read and clear intstatus. This should be called with interrupts disabled or inside isr */
+uint32
+dhdpcie_bus_intstatus(dhd_bus_t *bus)
+{
+       uint32 intstatus = 0;
+       uint32 intmask = 0;
+
+       if (__DHD_CHK_BUS_LPS_D3_ACKED(bus)) {
+               DHD_ERROR(("%s: trying to clear intstatus after D3 Ack\n", __FUNCTION__));
+               return intstatus;
+       }
+       /* XXX: check for PCIE Gen2 also */
+       if ((bus->sih->buscorerev == 6) || (bus->sih->buscorerev == 4) ||
+               (bus->sih->buscorerev == 2)) {
+               intstatus = dhdpcie_bus_cfg_read_dword(bus, PCIIntstatus, 4);
+               dhdpcie_bus_cfg_write_dword(bus, PCIIntstatus, 4, intstatus);
+               intstatus &= I_MB;
+       } else {
+               /* this is a PCIE core register..not a config register... */
+               intstatus = si_corereg(bus->sih, bus->sih->buscoreidx, bus->pcie_mailbox_int, 0, 0);
+
+               /* this is a PCIE core register..not a config register... */
+               intmask = si_corereg(bus->sih, bus->sih->buscoreidx, bus->pcie_mailbox_mask, 0, 0);
+               /* Is device removed. intstatus & intmask read 0xffffffff */
+               if (intstatus == (uint32)-1 || intmask == (uint32)-1) {
+                       DHD_ERROR(("%s: Device is removed or Link is down.\n", __FUNCTION__));
+                       DHD_ERROR(("%s: INTSTAT : 0x%x INTMASK : 0x%x.\n",
+                           __FUNCTION__, intstatus, intmask));
+                       bus->is_linkdown = TRUE;
+                       dhd_pcie_debug_info_dump(bus->dhd);
+#ifdef CUSTOMER_HW4_DEBUG
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+                       bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+                       bus->dhd->hang_reason = HANG_REASON_PCIE_LINK_DOWN_EP_DETECT;
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+                       copy_hang_info_linkdown(bus->dhd);
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+                       dhd_os_send_hang_message(bus->dhd);
+#endif /* CUSTOMER_HW4_DEBUG */
+                       return intstatus;
+               }
+
+#ifndef DHD_READ_INTSTATUS_IN_DPC
+               intstatus &= intmask;
+#endif /* DHD_READ_INTSTATUS_IN_DPC */
+
+               /* XXX: define the mask in a .h file  */
+               /*
+                * The fourth argument to si_corereg is the "mask" fields of the register to update
+                * and the fifth field is the "value" to update. Now if we are interested in only
+                * few fields of the "mask" bit map, we should not be writing back what we read
+                * By doing so, we might clear/ack interrupts that are not handled yet.
+                */
+               si_corereg(bus->sih, bus->sih->buscoreidx, bus->pcie_mailbox_int, bus->def_intmask,
+                       intstatus);
+
+               intstatus &= bus->def_intmask;
+       }
+
+       return intstatus;
+}
+
+void
+dhdpcie_cto_recovery_handler(dhd_pub_t *dhd)
+{
+       dhd_bus_t *bus = dhd->bus;
+       int ret;
+
+       /* Disable PCIe Runtime PM to avoid D3_ACK timeout.
+        */
+       DHD_DISABLE_RUNTIME_PM(dhd);
+
+       /* Sleep for 1 seconds so that any AXI timeout
+        * if running on ALP clock also will be captured
+        */
+       OSL_SLEEP(1000);
+
+       /* reset backplane and cto,
+        * then access through pcie is recovered.
+        */
+       ret = dhdpcie_cto_error_recovery(bus);
+       if (!ret) {
+               /* Waiting for backplane reset */
+               OSL_SLEEP(10);
+               /* Dump debug Info */
+               dhd_prot_debug_info_print(bus->dhd);
+               /* Dump console buffer */
+               dhd_bus_dump_console_buffer(bus);
+#if defined(DHD_FW_COREDUMP)
+               /* save core dump or write to a file */
+               if (!bus->is_linkdown && bus->dhd->memdump_enabled) {
+#ifdef DHD_SSSR_DUMP
+                       DHD_ERROR(("%s : Set collect_sssr as TRUE\n", __FUNCTION__));
+                       bus->dhd->collect_sssr = TRUE;
+#endif /* DHD_SSSR_DUMP */
+                       bus->dhd->memdump_type = DUMP_TYPE_CTO_RECOVERY;
+                       dhdpcie_mem_dump(bus);
+               }
+#endif /* DHD_FW_COREDUMP */
+       }
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+       bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+       bus->is_linkdown = TRUE;
+       bus->dhd->hang_reason = HANG_REASON_PCIE_CTO_DETECT;
+       /* Send HANG event */
+       dhd_os_send_hang_message(bus->dhd);
+}
+
+void
+dhd_bus_dump_imp_cfg_registers(struct dhd_bus *bus)
+{
+       uint32 status_cmd = dhd_pcie_config_read(bus, PCIECFGREG_STATUS_CMD, sizeof(uint32));
+       uint32 pmcsr = dhd_pcie_config_read(bus, PCIE_CFG_PMCSR, sizeof(uint32));
+       uint32 base_addr0 = dhd_pcie_config_read(bus, PCIECFGREG_BASEADDR0, sizeof(uint32));
+       uint32 base_addr1 = dhd_pcie_config_read(bus, PCIECFGREG_BASEADDR1, sizeof(uint32));
+       uint32 linkctl = dhd_pcie_config_read(bus, PCIECFGREG_LINK_STATUS_CTRL, sizeof(uint32));
+       uint32 l1ssctrl =
+               dhd_pcie_config_read(bus, PCIECFGREG_PML1_SUB_CTRL1, sizeof(uint32));
+       uint32 devctl = dhd_pcie_config_read(bus, PCIECFGREG_DEV_STATUS_CTRL, sizeof(uint32));
+       uint32 devctl2 = dhd_pcie_config_read(bus, PCIECFGGEN_DEV_STATUS_CTRL2, sizeof(uint32));
+
+       DHD_ERROR(("status_cmd(0x%x)=0x%x, pmcsr(0x%x)=0x%x "
+               "base_addr0(0x%x)=0x%x base_addr1(0x%x)=0x%x "
+               "linkctl(0x%x)=0x%x l1ssctrl(0x%x)=0x%x "
+               "devctl(0x%x)=0x%x devctl2(0x%x)=0x%x \n",
+               PCIECFGREG_STATUS_CMD, status_cmd,
+               PCIE_CFG_PMCSR, pmcsr,
+               PCIECFGREG_BASEADDR0, base_addr0,
+               PCIECFGREG_BASEADDR1, base_addr1,
+               PCIECFGREG_LINK_STATUS_CTRL, linkctl,
+               PCIECFGREG_PML1_SUB_CTRL1, l1ssctrl,
+               PCIECFGREG_DEV_STATUS_CTRL, devctl,
+               PCIECFGGEN_DEV_STATUS_CTRL2, devctl2));
+}
+
+/**
+ * Name:  dhdpcie_bus_isr
+ * Parameters:
+ * 1: IN int irq   -- interrupt vector
+ * 2: IN void *arg      -- handle to private data structure
+ * Return value:
+ * Status (TRUE or FALSE)
+ *
+ * Description:
+ * Interrupt Service routine checks for the status register,
+ * disable interrupt and queue DPC if mail box interrupts are raised.
+ */
+int32
+dhdpcie_bus_isr(dhd_bus_t *bus)
+{
+       uint32 intstatus = 0;
+
+       do {
+               DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+               /* verify argument */
+               if (!bus) {
+                       DHD_LOG_MEM(("%s : bus is null pointer, exit \n", __FUNCTION__));
+                       break;
+               }
+
+               if (bus->dhd->dongle_reset) {
+                       DHD_LOG_MEM(("%s : dongle is reset\n", __FUNCTION__));
+                       break;
+               }
+
+               if (bus->dhd->busstate == DHD_BUS_DOWN) {
+                       DHD_LOG_MEM(("%s : bus is down \n", __FUNCTION__));
+                       break;
+               }
+
+               /* avoid processing of interrupts until msgbuf prot is inited */
+               if (!bus->intr_enabled) {
+                       DHD_INFO(("%s, not ready to receive interrupts\n", __FUNCTION__));
+                       break;
+               }
+
+               if (PCIECTO_ENAB(bus)) {
+                       /* read pci_intstatus */
+                       intstatus = dhdpcie_bus_cfg_read_dword(bus, PCI_INT_STATUS, 4);
+
+                       if (intstatus == (uint32)-1) {
+                               DHD_ERROR(("%s : Invalid intstatus for cto recovery\n",
+                                       __FUNCTION__));
+                               dhdpcie_disable_irq_nosync(bus);
+                               break;
+                       }
+
+                       if (intstatus & PCI_CTO_INT_MASK) {
+                               DHD_ERROR(("%s: ##### CTO RECOVERY REPORTED BY DONGLE "
+                                       "intstat=0x%x enab=%d\n", __FUNCTION__,
+                                       intstatus, bus->cto_enable));
+                               bus->cto_triggered = 1;
+                               dhd_bus_dump_imp_cfg_registers(bus);
+                               /*
+                                * DAR still accessible
+                                */
+                               dhd_bus_dump_dar_registers(bus);
+
+                               /* Disable further PCIe interrupts */
+                               dhdpcie_disable_irq_nosync(bus); /* Disable interrupt!! */
+                               /* Stop Tx flow */
+                               dhd_bus_stop_queue(bus);
+
+                               /* Schedule CTO recovery */
+                               dhd_schedule_cto_recovery(bus->dhd);
+
+                               return TRUE;
+                       }
+               }
+
+               if (bus->d2h_intr_method == PCIE_MSI) {
+                       /* For MSI, as intstatus is cleared by firmware, no need to read */
+                       goto skip_intstatus_read;
+               }
+
+#ifndef DHD_READ_INTSTATUS_IN_DPC
+               intstatus = dhdpcie_bus_intstatus(bus);
+
+               /* Check if the interrupt is ours or not */
+               if (intstatus == 0) {
+                       bus->non_ours_irq_count++;
+                       bus->last_non_ours_irq_time = OSL_LOCALTIME_NS();
+                       DHD_INFO(("%s : this interrupt is not ours\n", __FUNCTION__));
+                       break;
+               }
+
+               /* save the intstatus */
+               /* read interrupt status register!! Status bits will be cleared in DPC !! */
+               bus->intstatus = intstatus;
+
+               /* return error for 0xFFFFFFFF */
+               if (intstatus == (uint32)-1) {
+                       DHD_LOG_MEM(("%s : wrong interrupt status val : 0x%x\n",
+                               __FUNCTION__, intstatus));
+                       dhdpcie_disable_irq_nosync(bus);
+                       break;
+               }
+
+skip_intstatus_read:
+               /*  Overall operation:
+                *    - Mask further interrupts
+                *    - Read/ack intstatus
+                *    - Take action based on bits and state
+                *    - Reenable interrupts (as per state)
+                */
+
+               /* Count the interrupt call */
+               bus->intrcount++;
+#endif /* DHD_READ_INTSTATUS_IN_DPC */
+
+               bus->ipend = TRUE;
+
+               bus->isr_intr_disable_count++;
+
+               /* For Linux, Macos etc (otherthan NDIS) instead of disabling
+               * dongle interrupt by clearing the IntMask, disable directly
+               * interrupt from the host side, so that host will not recieve
+               * any interrupts at all, even though dongle raises interrupts
+               */
+               dhdpcie_disable_irq_nosync(bus); /* Disable interrupt!! */
+
+               bus->intdis = TRUE;
+
+#if defined(PCIE_ISR_THREAD)
+
+               DHD_TRACE(("Calling dhd_bus_dpc() from %s\n", __FUNCTION__));
+               DHD_OS_WAKE_LOCK(bus->dhd);
+               while (dhd_bus_dpc(bus));
+               DHD_OS_WAKE_UNLOCK(bus->dhd);
+#else
+               bus->dpc_sched = TRUE;
+               bus->isr_sched_dpc_time = OSL_LOCALTIME_NS();
+               dhd_sched_dpc(bus->dhd);     /* queue DPC now!! */
+#endif /* defined(SDIO_ISR_THREAD) */
+
+               DHD_TRACE(("%s: Exit Success DPC Queued\n", __FUNCTION__));
+               return TRUE;
+
+       } while (0);
+
+       DHD_TRACE(("%s: Exit Failure\n", __FUNCTION__));
+       return FALSE;
+}
+
+int
+dhdpcie_set_pwr_state(dhd_bus_t *bus, uint state)
+{
+       uint32 cur_state = 0;
+       uint32 pm_csr = 0;
+       osl_t *osh = bus->osh;
+
+       pm_csr = OSL_PCI_READ_CONFIG(osh, PCIECFGREG_PM_CSR, sizeof(uint32));
+       cur_state = pm_csr & PCIECFGREG_PM_CSR_STATE_MASK;
+
+       if (cur_state == state) {
+               DHD_ERROR(("%s: Already in state %u \n", __FUNCTION__, cur_state));
+               return BCME_OK;
+       }
+
+       if (state > PCIECFGREG_PM_CSR_STATE_D3_HOT)
+               return BCME_ERROR;
+
+       /* Validate the state transition
+       * if already in a lower power state, return error
+       */
+       if (state != PCIECFGREG_PM_CSR_STATE_D0 &&
+                       cur_state <= PCIECFGREG_PM_CSR_STATE_D3_COLD &&
+                       cur_state > state) {
+               DHD_ERROR(("%s: Invalid power state transition !\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       pm_csr &= ~PCIECFGREG_PM_CSR_STATE_MASK;
+       pm_csr |= state;
+
+       OSL_PCI_WRITE_CONFIG(osh, PCIECFGREG_PM_CSR, sizeof(uint32), pm_csr);
+
+       /* need to wait for the specified mandatory pcie power transition delay time */
+       if (state == PCIECFGREG_PM_CSR_STATE_D3_HOT ||
+                       cur_state == PCIECFGREG_PM_CSR_STATE_D3_HOT)
+                       OSL_DELAY(DHDPCIE_PM_D3_DELAY);
+       else if (state == PCIECFGREG_PM_CSR_STATE_D2 ||
+                       cur_state == PCIECFGREG_PM_CSR_STATE_D2)
+                       OSL_DELAY(DHDPCIE_PM_D2_DELAY);
+
+       /* read back the power state and verify */
+       pm_csr = OSL_PCI_READ_CONFIG(osh, PCIECFGREG_PM_CSR, sizeof(uint32));
+       cur_state = pm_csr & PCIECFGREG_PM_CSR_STATE_MASK;
+       if (cur_state != state) {
+               DHD_ERROR(("%s: power transition failed ! Current state is %u \n",
+                               __FUNCTION__, cur_state));
+               return BCME_ERROR;
+       } else {
+               DHD_ERROR(("%s: power transition to %u success \n",
+                               __FUNCTION__, cur_state));
+       }
+
+       return BCME_OK;
+}
+
+int
+dhdpcie_config_check(dhd_bus_t *bus)
+{
+       uint32 i, val;
+       int ret = BCME_ERROR;
+
+       for (i = 0; i < DHDPCIE_CONFIG_CHECK_RETRY_COUNT; i++) {
+               val = OSL_PCI_READ_CONFIG(bus->osh, PCI_CFG_VID, sizeof(uint32));
+               if ((val & 0xFFFF) == VENDOR_BROADCOM) {
+                       ret = BCME_OK;
+                       break;
+               }
+               OSL_DELAY(DHDPCIE_CONFIG_CHECK_DELAY_MS * 1000);
+       }
+
+       return ret;
+}
+
+int
+dhdpcie_config_restore(dhd_bus_t *bus, bool restore_pmcsr)
+{
+       uint32 i;
+       osl_t *osh = bus->osh;
+
+       if (BCME_OK != dhdpcie_config_check(bus)) {
+               return BCME_ERROR;
+       }
+
+       for (i = PCI_CFG_REV >> 2; i < DHDPCIE_CONFIG_HDR_SIZE; i++) {
+               OSL_PCI_WRITE_CONFIG(osh, i << 2, sizeof(uint32), bus->saved_config.header[i]);
+       }
+       OSL_PCI_WRITE_CONFIG(osh, PCI_CFG_CMD, sizeof(uint32), bus->saved_config.header[1]);
+
+       if (restore_pmcsr)
+               OSL_PCI_WRITE_CONFIG(osh, PCIECFGREG_PM_CSR,
+                       sizeof(uint32), bus->saved_config.pmcsr);
+
+       OSL_PCI_WRITE_CONFIG(osh, PCIECFGREG_MSI_CAP, sizeof(uint32), bus->saved_config.msi_cap);
+       OSL_PCI_WRITE_CONFIG(osh, PCIECFGREG_MSI_ADDR_L, sizeof(uint32),
+                       bus->saved_config.msi_addr0);
+       OSL_PCI_WRITE_CONFIG(osh, PCIECFGREG_MSI_ADDR_H,
+                       sizeof(uint32), bus->saved_config.msi_addr1);
+       OSL_PCI_WRITE_CONFIG(osh, PCIECFGREG_MSI_DATA,
+                       sizeof(uint32), bus->saved_config.msi_data);
+
+       OSL_PCI_WRITE_CONFIG(osh, PCIECFGREG_DEV_STATUS_CTRL,
+                       sizeof(uint32), bus->saved_config.exp_dev_ctrl_stat);
+       OSL_PCI_WRITE_CONFIG(osh, PCIECFGGEN_DEV_STATUS_CTRL2,
+                       sizeof(uint32), bus->saved_config.exp_dev_ctrl_stat2);
+       OSL_PCI_WRITE_CONFIG(osh, PCIECFGREG_LINK_STATUS_CTRL,
+                       sizeof(uint32), bus->saved_config.exp_link_ctrl_stat);
+       OSL_PCI_WRITE_CONFIG(osh, PCIECFGREG_LINK_STATUS_CTRL2,
+                       sizeof(uint32), bus->saved_config.exp_link_ctrl_stat2);
+
+       OSL_PCI_WRITE_CONFIG(osh, PCIECFGREG_PML1_SUB_CTRL1,
+                       sizeof(uint32), bus->saved_config.l1pm0);
+       OSL_PCI_WRITE_CONFIG(osh, PCIECFGREG_PML1_SUB_CTRL2,
+                       sizeof(uint32), bus->saved_config.l1pm1);
+
+       OSL_PCI_WRITE_CONFIG(bus->osh, PCI_BAR0_WIN, sizeof(uint32),
+                       bus->saved_config.bar0_win);
+       dhdpcie_setbar1win(bus, bus->saved_config.bar1_win);
+
+       return BCME_OK;
+}
+
+int
+dhdpcie_config_save(dhd_bus_t *bus)
+{
+       uint32 i;
+       osl_t *osh = bus->osh;
+
+       if (BCME_OK != dhdpcie_config_check(bus)) {
+               return BCME_ERROR;
+       }
+
+       for (i = 0; i < DHDPCIE_CONFIG_HDR_SIZE; i++) {
+               bus->saved_config.header[i] = OSL_PCI_READ_CONFIG(osh, i << 2, sizeof(uint32));
+       }
+
+       bus->saved_config.pmcsr = OSL_PCI_READ_CONFIG(osh, PCIECFGREG_PM_CSR, sizeof(uint32));
+
+       bus->saved_config.msi_cap = OSL_PCI_READ_CONFIG(osh, PCIECFGREG_MSI_CAP,
+                       sizeof(uint32));
+       bus->saved_config.msi_addr0 = OSL_PCI_READ_CONFIG(osh, PCIECFGREG_MSI_ADDR_L,
+                       sizeof(uint32));
+       bus->saved_config.msi_addr1 = OSL_PCI_READ_CONFIG(osh, PCIECFGREG_MSI_ADDR_H,
+                       sizeof(uint32));
+       bus->saved_config.msi_data = OSL_PCI_READ_CONFIG(osh, PCIECFGREG_MSI_DATA,
+                       sizeof(uint32));
+
+       bus->saved_config.exp_dev_ctrl_stat = OSL_PCI_READ_CONFIG(osh,
+                       PCIECFGREG_DEV_STATUS_CTRL, sizeof(uint32));
+       bus->saved_config.exp_dev_ctrl_stat2 = OSL_PCI_READ_CONFIG(osh,
+                       PCIECFGGEN_DEV_STATUS_CTRL2, sizeof(uint32));
+       bus->saved_config.exp_link_ctrl_stat = OSL_PCI_READ_CONFIG(osh,
+                       PCIECFGREG_LINK_STATUS_CTRL, sizeof(uint32));
+       bus->saved_config.exp_link_ctrl_stat2 = OSL_PCI_READ_CONFIG(osh,
+                       PCIECFGREG_LINK_STATUS_CTRL2, sizeof(uint32));
+
+       bus->saved_config.l1pm0 = OSL_PCI_READ_CONFIG(osh, PCIECFGREG_PML1_SUB_CTRL1,
+                       sizeof(uint32));
+       bus->saved_config.l1pm1 = OSL_PCI_READ_CONFIG(osh, PCIECFGREG_PML1_SUB_CTRL2,
+                       sizeof(uint32));
+
+       bus->saved_config.bar0_win = OSL_PCI_READ_CONFIG(osh, PCI_BAR0_WIN,
+                       sizeof(uint32));
+       bus->saved_config.bar1_win = OSL_PCI_READ_CONFIG(osh, PCI_BAR1_WIN,
+                       sizeof(uint32));
+
+       return BCME_OK;
+}
+
+#ifdef CONFIG_ARCH_EXYNOS
+dhd_pub_t *link_recovery = NULL;
+#endif /* CONFIG_ARCH_EXYNOS */
+
+static void
+dhdpcie_bus_intr_init(dhd_bus_t *bus)
+{
+       uint buscorerev = bus->sih->buscorerev;
+       bus->pcie_mailbox_int = PCIMailBoxInt(buscorerev);
+       bus->pcie_mailbox_mask = PCIMailBoxMask(buscorerev);
+       bus->d2h_mb_mask = PCIE_MB_D2H_MB_MASK(buscorerev);
+       bus->def_intmask = PCIE_MB_D2H_MB_MASK(buscorerev);
+       if (buscorerev < 64) {
+               bus->def_intmask |= PCIE_MB_TOPCIE_FN0_0 | PCIE_MB_TOPCIE_FN0_1;
+       }
+}
+
+static void
+dhdpcie_cc_watchdog_reset(dhd_bus_t *bus)
+{
+       uint32 wd_en = (bus->sih->buscorerev >= 66) ? WD_SSRESET_PCIE_F0_EN :
+               (WD_SSRESET_PCIE_F0_EN | WD_SSRESET_PCIE_ALL_FN_EN);
+       pcie_watchdog_reset(bus->osh, bus->sih, WD_ENABLE_MASK, wd_en);
+}
+void
+dhdpcie_dongle_reset(dhd_bus_t *bus)
+{
+
+       /* if the pcie link is down, watchdog reset
+        * should not be done, as it may hang
+        */
+       if (bus->is_linkdown) {
+               return;
+       }
+
+       /* Currently BP reset using CFG reg is done only for android platforms */
+#ifdef DHD_USE_BP_RESET_SPROM
+       /* This is for architectures that does NOT control subsystem reset */
+       (void)dhd_bus_cfg_sprom_ctrl_bp_reset(bus);
+       return;
+#elif defined(DHD_USE_BP_RESET_SS_CTRL)
+       /* This is for architectures that supports Subsystem Control */
+       (void)dhd_bus_cfg_ss_ctrl_bp_reset(bus);
+       return;
+#else
+
+       /* dhd_bus_perform_flr will return BCME_UNSUPPORTED if chip is not FLR capable */
+       if (dhd_bus_perform_flr(bus, FALSE) == BCME_UNSUPPORTED)
+       {
+               /* Legacy chipcommon watchdog reset */
+               dhdpcie_cc_watchdog_reset(bus);
+       }
+       return;
+#endif /* DHD_USE_BP_RESET */
+}
+
+static bool
+is_bmpu_supported(dhd_bus_t *bus)
+{
+       if (BCM4378_CHIP(bus->sih->chip) ||
+               BCM4376_CHIP(bus->sih->chip) ||
+               BCM4387_CHIP(bus->sih->chip) ||
+               BCM4385_CHIP(bus->sih->chip)) {
+               return TRUE;
+       }
+       return FALSE;
+}
+
+#define CHIP_COMMON_SCR_DHD_TO_BL_ADDR(sih) (SI_ENUM_BASE(sih) + CC_SCR_DHD_TO_BL)
+#define CHIP_COMMON_SCR_BL_TO_DHD_ADDR(sih) (SI_ENUM_BASE(sih) + CC_SCR_BL_TO_DHD)
+void
+dhdpcie_bus_mpu_disable(dhd_bus_t *bus)
+{
+       volatile uint32 *cr4_regs;
+       uint val = 0;
+
+       if (is_bmpu_supported(bus) == FALSE) {
+               return;
+       }
+
+       /* reset to default values dhd_to_bl and bl_to_dhd regs */
+       (void)serialized_backplane_access(bus, CHIP_COMMON_SCR_DHD_TO_BL_ADDR(bus->sih),
+               sizeof(val), &val, FALSE);
+       (void)serialized_backplane_access(bus, CHIP_COMMON_SCR_BL_TO_DHD_ADDR(bus->sih),
+               sizeof(val), &val, FALSE);
+
+       cr4_regs = si_setcore(bus->sih, ARMCR4_CORE_ID, 0);
+       if (cr4_regs == NULL) {
+               DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
+               return;
+       }
+       if (R_REG(bus->osh, cr4_regs + ARMCR4REG_CORECAP) & ACC_MPU_MASK) {
+               /* bus mpu is supported */
+               W_REG(bus->osh, cr4_regs + ARMCR4REG_MPUCTRL, 0);
+       }
+}
+
+static bool
+dhdpcie_dongle_attach(dhd_bus_t *bus)
+{
+       osl_t *osh = bus->osh;
+       volatile void *regsva = (volatile void*)bus->regs;
+       uint16 devid;
+       uint32 val;
+       sbpcieregs_t *sbpcieregs;
+       bool dongle_reset_needed;
+       uint16 chipid;
+
+       BCM_REFERENCE(chipid);
+
+       DHD_TRACE(("%s: ENTER\n", __FUNCTION__));
+
+       /* Configure CTO Prevention functionality */
+#if defined(BCMPCIE_CTO_PREVENTION)
+       chipid = dhd_get_chipid(bus);
+
+       if (BCM4349_CHIP(chipid) || BCM4350_CHIP(chipid) || BCM4345_CHIP(chipid)) {
+               DHD_ERROR(("Disable CTO\n"));
+               bus->cto_enable = FALSE;
+       } else {
+               DHD_ERROR(("Enable CTO\n"));
+               bus->cto_enable = TRUE;
+       }
+#else
+       DHD_ERROR(("Disable CTO\n"));
+       bus->cto_enable = FALSE;
+#endif /* BCMPCIE_CTO_PREVENTION */
+
+       if (PCIECTO_ENAB(bus)) {
+               dhdpcie_cto_init(bus, TRUE);
+       }
+
+#ifdef CONFIG_ARCH_EXYNOS
+       link_recovery = bus->dhd;
+#endif /* CONFIG_ARCH_EXYNOS */
+
+       dhd_init_pwr_req_lock(bus);
+       dhd_init_bus_lp_state_lock(bus);
+       dhd_init_backplane_access_lock(bus);
+
+       bus->alp_only = TRUE;
+       bus->sih = NULL;
+
+       /* Checking PCIe bus status with reading configuration space */
+       val = OSL_PCI_READ_CONFIG(osh, PCI_CFG_VID, sizeof(uint32));
+       if ((val & 0xFFFF) != VENDOR_BROADCOM) {
+               DHD_ERROR(("%s : failed to read PCI configuration space!\n", __FUNCTION__));
+               goto fail;
+       }
+       devid = (val >> 16) & 0xFFFF;
+       bus->cl_devid = devid;
+
+       /* Set bar0 window to si_enum_base */
+       dhdpcie_bus_cfg_set_bar0_win(bus, si_enum_base(devid));
+
+       /*
+        * Checking PCI_SPROM_CONTROL register for preventing invalid address access
+        * due to switch address space from PCI_BUS to SI_BUS.
+        */
+       val = OSL_PCI_READ_CONFIG(osh, PCI_SPROM_CONTROL, sizeof(uint32));
+       if (val == 0xffffffff) {
+               DHD_ERROR(("%s : failed to read SPROM control register\n", __FUNCTION__));
+               goto fail;
+       }
+
+       /* si_attach() will provide an SI handle and scan the backplane */
+       if (!(bus->sih = si_attach((uint)devid, osh, regsva, PCI_BUS, bus,
+                                  &bus->vars, &bus->varsz))) {
+               DHD_ERROR(("%s: si_attach failed!\n", __FUNCTION__));
+               goto fail;
+       }
+
+       if (MULTIBP_ENAB(bus->sih) && (bus->sih->buscorerev >= 66)) {
+               /*
+                * HW JIRA - CRWLPCIEGEN2-672
+                * Producer Index Feature which is used by F1 gets reset on F0 FLR
+                * fixed in REV68
+                */
+               if (PCIE_ENUM_RESET_WAR_ENAB(bus->sih->buscorerev)) {
+                       dhdpcie_ssreset_dis_enum_rst(bus);
+               }
+
+               /* IOV_DEVRESET could exercise si_detach()/si_attach() again so reset
+               *   dhdpcie_bus_release_dongle() --> si_detach()
+               *   dhdpcie_dongle_attach() --> si_attach()
+               */
+               bus->pwr_req_ref = 0;
+       }
+
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req_nolock(bus);
+       }
+
+       /* Get info on the ARM and SOCRAM cores... */
+       /* Should really be qualified by device id */
+       if ((si_setcore(bus->sih, ARM7S_CORE_ID, 0)) ||
+           (si_setcore(bus->sih, ARMCM3_CORE_ID, 0)) ||
+           (si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) ||
+           (si_setcore(bus->sih, ARMCA7_CORE_ID, 0))) {
+               bus->armrev = si_corerev(bus->sih);
+               bus->coreid = si_coreid(bus->sih);
+       } else {
+               DHD_ERROR(("%s: failed to find ARM core!\n", __FUNCTION__));
+               goto fail;
+       }
+
+       /* CA7 requires coherent bits on */
+       if (bus->coreid == ARMCA7_CORE_ID) {
+               val = dhdpcie_bus_cfg_read_dword(bus, PCIE_CFG_SUBSYSTEM_CONTROL, 4);
+               dhdpcie_bus_cfg_write_dword(bus, PCIE_CFG_SUBSYSTEM_CONTROL, 4,
+                       (val | PCIE_BARCOHERENTACCEN_MASK));
+       }
+
+       /* EFI requirement - stop driver load if FW is already running
+       *  need to do this here before pcie_watchdog_reset, because
+       *  pcie_watchdog_reset will put the ARM back into halt state
+       */
+       if (!dhdpcie_is_arm_halted(bus)) {
+               DHD_ERROR(("%s: ARM is not halted,FW is already running! Abort.\n",
+                               __FUNCTION__));
+               goto fail;
+       }
+
+       BCM_REFERENCE(dongle_reset_needed);
+
+       /* For inbuilt drivers pcie clk req will be done by RC,
+        * so do not do clkreq from dhd
+        */
+       if (dhd_download_fw_on_driverload)
+       {
+               /* Enable CLKREQ# */
+               dhdpcie_clkreq(bus->osh, 1, 1);
+       }
+
+       /* Calculate htclkratio only for QT, for FPGA it is fixed at 30 */
+
+       /*
+        * bus->dhd will be NULL if it is called from dhd_bus_attach, so need to reset
+        * without checking dongle_isolation flag, but if it is called via some other path
+        * like quiesce FLR, then based on dongle_isolation flag, watchdog_reset should
+        * be called.
+        */
+       if (bus->dhd == NULL) {
+               /* dhd_attach not yet happened, do dongle reset */
+#ifdef DHD_SKIP_DONGLE_RESET_IN_ATTACH
+               dongle_reset_needed = FALSE;
+#else
+               dongle_reset_needed = TRUE;
+#endif /* DHD_SKIP_DONGLE_RESET_IN_ATTACH */
+       } else {
+               /* Based on dongle_isolationflag, reset dongle */
+               dongle_reset_needed = !(bus->dhd->dongle_isolation);
+       }
+
+       /*
+        * Issue dongle to reset all the cores on the chip - similar to rmmod dhd
+        * This is required to avoid spurious interrupts to the Host and bring back
+        * dongle to a sane state (on host soft-reboot / watchdog-reboot).
+        */
+       if (dongle_reset_needed) {
+               dhdpcie_dongle_reset(bus);
+       }
+
+       /* need to set the force_bt_quiesce flag here
+        * before calling dhdpcie_dongle_flr_or_pwr_toggle
+        */
+       bus->force_bt_quiesce = TRUE;
+       /*
+        * For buscorerev = 66 and after, F0 FLR should be done independent from F1.
+        * So don't need BT quiesce.
+        */
+       if (bus->sih->buscorerev >= 66) {
+               bus->force_bt_quiesce = FALSE;
+       }
+
+       dhdpcie_dongle_flr_or_pwr_toggle(bus);
+
+       dhdpcie_bus_mpu_disable(bus);
+
+       si_setcore(bus->sih, PCIE2_CORE_ID, 0);
+       sbpcieregs = (sbpcieregs_t*)(bus->regs);
+
+       /* WAR where the BAR1 window may not be sized properly */
+       W_REG(osh, &sbpcieregs->configaddr, 0x4e0);
+       val = R_REG(osh, &sbpcieregs->configdata);
+       W_REG(osh, &sbpcieregs->configdata, val);
+
+       /* if chip uses sysmem instead of tcm, typically ARM CA chips */
+       if (si_setcore(bus->sih, SYSMEM_CORE_ID, 0)) {
+               if (!(bus->orig_ramsize = si_sysmem_size(bus->sih))) {
+                       DHD_ERROR(("%s: failed to find SYSMEM memory!\n", __FUNCTION__));
+                       goto fail;
+               }
+               /* also populate base address */
+               switch ((uint16)bus->sih->chip) {
+                       case BCM4368_CHIP_ID:
+                               bus->dongle_ram_base = CA7_4368_RAM_BASE;
+                               break;
+                       case BCM4385_CHIP_ID:
+                               bus->dongle_ram_base = CA7_4385_RAM_BASE;
+                               break;
+                       case BCM4388_CHIP_ID:
+                       case BCM4389_CHIP_ID:
+                               bus->dongle_ram_base = CA7_4389_RAM_BASE;
+                               break;
+                       default:
+                               /* also populate base address */
+                               bus->dongle_ram_base = 0x200000;
+                               DHD_ERROR(("%s: WARNING: Using default ram base at 0x%x\n",
+                                       __FUNCTION__, bus->dongle_ram_base));
+                               break;
+               }
+       } else if (!si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+               if (!(bus->orig_ramsize = si_socram_size(bus->sih))) {
+                       DHD_ERROR(("%s: failed to find SOCRAM memory!\n", __FUNCTION__));
+                       goto fail;
+               }
+       } else {
+               /* cr4 has a different way to find the RAM size from TCM's */
+               if (!(bus->orig_ramsize = si_tcm_size(bus->sih))) {
+                       DHD_ERROR(("%s: failed to find CR4-TCM memory!\n", __FUNCTION__));
+                       goto fail;
+               }
+               /* also populate base address */
+               switch ((uint16)bus->sih->chip) {
+               case BCM4339_CHIP_ID:
+               case BCM4335_CHIP_ID:
+                       bus->dongle_ram_base = CR4_4335_RAM_BASE;
+                       break;
+               case BCM4358_CHIP_ID:
+               case BCM4354_CHIP_ID:
+               case BCM43567_CHIP_ID:
+               case BCM43569_CHIP_ID:
+               case BCM4350_CHIP_ID:
+               case BCM43570_CHIP_ID:
+                       bus->dongle_ram_base = CR4_4350_RAM_BASE;
+                       break;
+               case BCM4360_CHIP_ID:
+                       bus->dongle_ram_base = CR4_4360_RAM_BASE;
+                       break;
+
+               case BCM4364_CHIP_ID:
+                       bus->dongle_ram_base = CR4_4364_RAM_BASE;
+                       break;
+
+               CASE_BCM4345_CHIP:
+                       bus->dongle_ram_base = (bus->sih->chiprev < 6)  /* changed at 4345C0 */
+                               ? CR4_4345_LT_C0_RAM_BASE : CR4_4345_GE_C0_RAM_BASE;
+                       break;
+               CASE_BCM43602_CHIP:
+                       bus->dongle_ram_base = CR4_43602_RAM_BASE;
+                       break;
+               case BCM4349_CHIP_GRPID:
+                       /* RAM based changed from 4349c0(revid=9) onwards */
+                       bus->dongle_ram_base = ((bus->sih->chiprev < 9) ?
+                               CR4_4349_RAM_BASE : CR4_4349_RAM_BASE_FROM_REV_9);
+                       break;
+               case BCM4347_CHIP_ID:
+               case BCM4357_CHIP_ID:
+               case BCM4361_CHIP_ID:
+                       bus->dongle_ram_base = CR4_4347_RAM_BASE;
+                       break;
+               case BCM43751_CHIP_ID:
+                       bus->dongle_ram_base = CR4_43751_RAM_BASE;
+                       break;
+               case BCM43752_CHIP_ID:
+                       bus->dongle_ram_base = CR4_43752_RAM_BASE;
+                       break;
+               case BCM4376_CHIP_GRPID:
+                       bus->dongle_ram_base = CR4_4376_RAM_BASE;
+                       break;
+               case BCM4378_CHIP_GRPID:
+                       bus->dongle_ram_base = CR4_4378_RAM_BASE;
+                       break;
+               case BCM4362_CHIP_ID:
+                       bus->dongle_ram_base = CR4_4362_RAM_BASE;
+                       break;
+               case BCM4375_CHIP_ID:
+               case BCM4369_CHIP_ID:
+                       bus->dongle_ram_base = CR4_4369_RAM_BASE;
+                       break;
+               case BCM4377_CHIP_ID:
+                       bus->dongle_ram_base = CR4_4377_RAM_BASE;
+                       break;
+               case BCM4387_CHIP_GRPID:
+                       bus->dongle_ram_base = CR4_4387_RAM_BASE;
+                       break;
+               case BCM4385_CHIP_ID:
+                       bus->dongle_ram_base = CR4_4385_RAM_BASE;
+                       break;
+               case BCM4389_CHIP_ID:
+                       /* XXX: For corerev 3, use 4387 rambase */
+                       bus->dongle_ram_base = CR4_4387_RAM_BASE;
+                       break;
+               default:
+                       bus->dongle_ram_base = 0;
+                       DHD_ERROR(("%s: WARNING: Using default ram base at 0x%x\n",
+                                  __FUNCTION__, bus->dongle_ram_base));
+               }
+       }
+       bus->ramsize = bus->orig_ramsize;
+       if (dhd_dongle_ramsize) {
+               dhdpcie_bus_dongle_setmemsize(bus, dhd_dongle_ramsize);
+       }
+
+       if (bus->ramsize > DONGLE_TCM_MAP_SIZE) {
+               DHD_ERROR(("%s : invalid ramsize %d(0x%x) is returned from dongle\n",
+                               __FUNCTION__, bus->ramsize, bus->ramsize));
+               goto fail;
+       }
+
+       DHD_ERROR(("DHD: dongle ram size is set to %d(orig %d) at 0x%x\n",
+                  bus->ramsize, bus->orig_ramsize, bus->dongle_ram_base));
+
+       dhdpcie_bar1_window_switch_enab(bus);
+
+       /* Init bar1_switch_lock only after bar1_switch_enab is inited */
+       dhd_init_bar1_switch_lock(bus);
+
+       bus->srmemsize = si_socram_srmem_size(bus->sih);
+
+       dhdpcie_bus_intr_init(bus);
+
+       /* Set the poll and/or interrupt flags */
+       bus->intr = (bool)dhd_intr;
+       if ((bus->poll = (bool)dhd_poll))
+               bus->pollrate = 1;
+#ifdef DHD_DISABLE_ASPM
+       dhd_bus_aspm_enable_rc_ep(bus, FALSE);
+#endif /* DHD_DISABLE_ASPM */
+#ifdef PCIE_INB_DW
+       bus->inb_enabled = TRUE;
+#endif /* PCIE_INB_DW */
+#if defined(PCIE_INB_DW)
+       bus->ds_enabled = TRUE;
+#endif
+
+       bus->hwa_enabled = TRUE;
+       bus->idma_enabled = TRUE;
+       bus->ifrm_enabled = TRUE;
+
+       dhdpcie_pme_stat_clear(bus);
+
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req_clear_nolock(bus);
+
+               /*
+                * One time clearing of Common Power Domain since HW default is set
+                * Needs to be after FLR because FLR resets PCIe enum back to HW defaults
+                * for 4378B0 (rev 68).
+                * On 4378A0 (rev 66), PCIe enum reset is disabled due to CRWLPCIEGEN2-672
+                */
+               si_srpwr_request(bus->sih, SRPWR_DMN0_PCIE_MASK, 0);
+
+               /*
+                * WAR to fix ARM cold boot;
+                * Assert WL domain in DAR helps but not enum
+                */
+               if (bus->sih->buscorerev >= 68) {
+                       dhd_bus_pcie_pwr_req_wl_domain(bus,
+                               DAR_PCIE_PWR_CTRL((bus->sih)->buscorerev), TRUE);
+               }
+       }
+
+       DHD_TRACE(("%s: EXIT: SUCCESS\n", __FUNCTION__));
+
+       return 0;
+
+fail:
+/* for EFI even if there is an error, load still succeeds
+* so si_detach should not be called here, it is called during unload
+*/
+
+       dhd_deinit_pwr_req_lock(bus);
+       dhd_deinit_bus_lp_state_lock(bus);
+       dhd_deinit_backplane_access_lock(bus);
+
+       if (bus->sih != NULL) {
+               if (MULTIBP_ENAB(bus->sih)) {
+                       dhd_bus_pcie_pwr_req_clear_nolock(bus);
+               }
+
+               si_detach(bus->sih);
+               bus->sih = NULL;
+       }
+       DHD_TRACE(("%s: EXIT: FAILURE\n", __FUNCTION__));
+       return -1;
+}
+
+int
+dhpcie_bus_unmask_interrupt(dhd_bus_t *bus)
+{
+       dhdpcie_bus_cfg_write_dword(bus, PCIIntmask, 4, I_MB);
+       return 0;
+}
+int
+dhpcie_bus_mask_interrupt(dhd_bus_t *bus)
+{
+       dhdpcie_bus_cfg_write_dword(bus, PCIIntmask, 4, 0x0);
+       return 0;
+}
+
+/* Non atomic function, caller should hold appropriate lock */
+void
+dhdpcie_bus_intr_enable(dhd_bus_t *bus)
+{
+       DHD_TRACE(("%s Enter\n", __FUNCTION__));
+       if (bus) {
+               if (bus->sih && !bus->is_linkdown) {
+                       /* Skip after recieving D3 ACK */
+                       if (bus->bus_low_power_state == DHD_BUS_D3_ACK_RECIEVED) {
+                               return;
+                       }
+                       if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+                               (bus->sih->buscorerev == 4)) {
+                               dhpcie_bus_unmask_interrupt(bus);
+                       } else {
+                               si_corereg(bus->sih, bus->sih->buscoreidx, bus->pcie_mailbox_mask,
+                                       bus->def_intmask, bus->def_intmask);
+                       }
+               }
+
+       }
+
+       DHD_TRACE(("%s Exit\n", __FUNCTION__));
+}
+
+/* Non atomic function, caller should hold appropriate lock */
+void
+dhdpcie_bus_intr_disable(dhd_bus_t *bus)
+{
+       DHD_TRACE(("%s Enter\n", __FUNCTION__));
+       if (bus && bus->sih && !bus->is_linkdown) {
+               /* Skip after recieving D3 ACK */
+               if (DHD_CHK_BUS_LPS_D3_ACKED(bus)) {
+                       return;
+               }
+
+               if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+                       (bus->sih->buscorerev == 4)) {
+                       dhpcie_bus_mask_interrupt(bus);
+               } else {
+                       si_corereg(bus->sih, bus->sih->buscoreidx, bus->pcie_mailbox_mask,
+                               bus->def_intmask, 0);
+               }
+       }
+
+       DHD_TRACE(("%s Exit\n", __FUNCTION__));
+}
+
+/*
+ *  dhdpcie_advertise_bus_cleanup advertises that clean up is under progress
+ * to other bus user contexts like Tx, Rx, IOVAR, WD etc and it waits for other contexts
+ * to gracefully exit. All the bus usage contexts before marking busstate as busy, will check for
+ * whether the busstate is DHD_BUS_DOWN or DHD_BUS_DOWN_IN_PROGRESS, if so
+ * they will exit from there itself without marking dhd_bus_busy_state as BUSY.
+ */
+void
+dhdpcie_advertise_bus_cleanup(dhd_pub_t *dhdp)
+{
+       unsigned long flags;
+       int timeleft;
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       dhdpcie_runtime_bus_wake(dhdp, TRUE, dhdpcie_advertise_bus_cleanup);
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       dhdp->dhd_watchdog_ms_backup = dhd_watchdog_ms;
+       if (dhdp->dhd_watchdog_ms_backup) {
+               DHD_ERROR(("%s: Disabling wdtick before dhd deinit\n",
+                       __FUNCTION__));
+               dhd_os_wd_timer(dhdp, 0);
+       }
+       if (dhdp->busstate != DHD_BUS_DOWN) {
+#ifdef DHD_DONGLE_TRAP_IN_DETACH
+               /*
+                * For x86 platforms, rmmod/insmod is failing due to some power
+                * resources are not held high.
+                * Hence induce DB7 trap during detach and in FW trap handler all
+                * power resources are held high.
+                */
+               if (!dhd_query_bus_erros(dhdp) && dhdp->db7_trap.fw_db7w_trap) {
+                       dhdp->db7_trap.fw_db7w_trap_inprogress = TRUE;
+                       dhdpcie_fw_trap(dhdp->bus);
+                       OSL_DELAY(100 * 1000); // wait 100 msec
+                       dhdp->db7_trap.fw_db7w_trap_inprogress = FALSE;
+               } else {
+                       DHD_ERROR(("%s: DB7 Not sent!!!\n",
+                               __FUNCTION__));
+               }
+#endif /* DHD_DONGLE_TRAP_IN_DETACH */
+               DHD_GENERAL_LOCK(dhdp, flags);
+               dhdp->busstate = DHD_BUS_DOWN_IN_PROGRESS;
+               DHD_GENERAL_UNLOCK(dhdp, flags);
+       }
+
+       timeleft = dhd_os_busbusy_wait_negation(dhdp, &dhdp->dhd_bus_busy_state);
+       if ((timeleft == 0) || (timeleft == 1)) {
+               /* XXX This condition ideally should not occur, this means some
+                * bus usage context is not clearing the respective usage bit, print
+                * dhd_bus_busy_state and crash the host for further debugging.
+                */
+               DHD_ERROR(("%s : Timeout due to dhd_bus_busy_state=0x%x\n",
+                               __FUNCTION__, dhdp->dhd_bus_busy_state));
+               ASSERT(0);
+       }
+
+       return;
+}
+
+static void
+dhdpcie_advertise_bus_remove(dhd_pub_t  *dhdp)
+{
+       unsigned long flags;
+       int timeleft;
+
+       DHD_GENERAL_LOCK(dhdp, flags);
+       dhdp->busstate = DHD_BUS_REMOVE;
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+
+       timeleft = dhd_os_busbusy_wait_negation(dhdp, &dhdp->dhd_bus_busy_state);
+       if ((timeleft == 0) || (timeleft == 1)) {
+               DHD_ERROR(("%s : Timeout due to dhd_bus_busy_state=0x%x\n",
+                               __FUNCTION__, dhdp->dhd_bus_busy_state));
+               ASSERT(0);
+       }
+
+       return;
+}
+
+static void
+dhdpcie_bus_remove_prep(dhd_bus_t *bus)
+{
+       unsigned long flags;
+       DHD_TRACE(("%s Enter\n", __FUNCTION__));
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+       bus->dhd->busstate = DHD_BUS_DOWN;
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+#ifdef PCIE_INB_DW
+       /* De-Initialize the lock to serialize Device Wake Inband activities */
+       if (bus->inb_lock) {
+               osl_spin_lock_deinit(bus->dhd->osh, bus->inb_lock);
+               bus->inb_lock = NULL;
+       }
+#endif
+
+       dhd_os_sdlock(bus->dhd);
+
+       if (bus->sih && !bus->dhd->dongle_isolation) {
+
+               dhd_bus_pcie_pwr_req_reload_war(bus);
+
+               /* Skip below WARs for Android as insmod fails after rmmod in Brix Android */
+
+               /* if the pcie link is down, watchdog reset
+               * should not be done, as it may hang
+               */
+
+               if (!bus->is_linkdown) {
+                       /* For Non-EFI modular builds, do dongle reset during rmmod */
+                       /* For EFI-DHD this compile flag will be defined.
+                        * In EFI, depending on bt over pcie mode
+                        * we either power toggle or do F0 FLR
+                        * from dhdpcie_bus_release dongle. So no need to
+                        * do dongle reset from here
+                        */
+                       dhdpcie_dongle_reset(bus);
+               }
+
+               bus->dhd->is_pcie_watchdog_reset = TRUE;
+       }
+
+       dhd_os_sdunlock(bus->dhd);
+
+       DHD_TRACE(("%s Exit\n", __FUNCTION__));
+}
+
+void
+dhd_init_bus_lp_state_lock(dhd_bus_t *bus)
+{
+       if (!bus->bus_lp_state_lock) {
+               bus->bus_lp_state_lock = osl_spin_lock_init(bus->osh);
+       }
+}
+
+void
+dhd_deinit_bus_lp_state_lock(dhd_bus_t *bus)
+{
+       if (bus->bus_lp_state_lock) {
+               osl_spin_lock_deinit(bus->osh, bus->bus_lp_state_lock);
+               bus->bus_lp_state_lock = NULL;
+       }
+}
+
+void
+dhd_init_backplane_access_lock(dhd_bus_t *bus)
+{
+       if (!bus->backplane_access_lock) {
+               bus->backplane_access_lock = osl_spin_lock_init(bus->osh);
+       }
+}
+
+void
+dhd_deinit_backplane_access_lock(dhd_bus_t *bus)
+{
+       if (bus->backplane_access_lock) {
+               osl_spin_lock_deinit(bus->osh, bus->backplane_access_lock);
+               bus->backplane_access_lock = NULL;
+       }
+}
+
+/** Detach and free everything */
+void
+dhdpcie_bus_release(dhd_bus_t *bus)
+{
+       bool dongle_isolation = FALSE;
+       osl_t *osh = NULL;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus) {
+
+               osh = bus->osh;
+               ASSERT(osh);
+
+               if (bus->dhd) {
+#if defined(DEBUGGER) || defined(DHD_DSCOPE)
+                       debugger_close();
+#endif /* DEBUGGER || DHD_DSCOPE */
+                       dhdpcie_advertise_bus_remove(bus->dhd);
+                       dongle_isolation = bus->dhd->dongle_isolation;
+                       bus->dhd->is_pcie_watchdog_reset = FALSE;
+                       dhdpcie_bus_remove_prep(bus);
+
+                       if (bus->intr) {
+                               dhdpcie_bus_intr_disable(bus);
+                               dhdpcie_free_irq(bus);
+                       }
+                       dhd_deinit_bus_lp_state_lock(bus);
+                       dhd_deinit_bar1_switch_lock(bus);
+                       dhd_deinit_backplane_access_lock(bus);
+                       dhd_deinit_pwr_req_lock(bus);
+                       /**
+                        * dhdpcie_bus_release_dongle free bus->sih  handle, which is needed to
+                        * access Dongle registers.
+                        * dhd_detach will communicate with dongle to delete flowring ..etc.
+                        * So dhdpcie_bus_release_dongle should be called only after the dhd_detach.
+                        */
+                       dhd_detach(bus->dhd);
+                       dhdpcie_bus_release_dongle(bus, osh, dongle_isolation, TRUE);
+                       dhd_free(bus->dhd);
+                       bus->dhd = NULL;
+               }
+               /* unmap the regs and tcm here!! */
+               if (bus->regs) {
+                       dhdpcie_bus_reg_unmap(osh, bus->regs, DONGLE_REG_MAP_SIZE);
+                       bus->regs = NULL;
+               }
+               if (bus->tcm) {
+                       dhdpcie_bus_reg_unmap(osh, bus->tcm, DONGLE_TCM_MAP_SIZE);
+                       bus->tcm = NULL;
+               }
+
+               dhdpcie_bus_release_malloc(bus, osh);
+               /* Detach pcie shared structure */
+               if (bus->pcie_sh) {
+                       MFREE(osh, bus->pcie_sh, sizeof(pciedev_shared_t));
+               }
+
+               if (bus->console.buf != NULL) {
+                       MFREE(osh, bus->console.buf, bus->console.bufsize);
+               }
+
+               /* Finally free bus info */
+               MFREE(osh, bus, sizeof(dhd_bus_t));
+
+               g_dhd_bus = NULL;
+       }
+
+       DHD_TRACE(("%s: Exit\n", __FUNCTION__));
+} /* dhdpcie_bus_release */
+
+void
+dhdpcie_bus_release_dongle(dhd_bus_t *bus, osl_t *osh, bool dongle_isolation, bool reset_flag)
+{
+       DHD_TRACE(("%s: Enter bus->dhd %p bus->dhd->dongle_reset %d \n", __FUNCTION__,
+               bus->dhd, bus->dhd->dongle_reset));
+
+       if ((bus->dhd && bus->dhd->dongle_reset) && reset_flag) {
+               DHD_TRACE(("%s Exit\n", __FUNCTION__));
+               return;
+       }
+
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s : Skip release dongle due to linkdown \n", __FUNCTION__));
+               return;
+       }
+
+       if (bus->sih) {
+
+               /*
+                * Perform dongle reset only if dongle isolation is not enabled.
+                * In android platforms, dongle isolation will be enabled and
+                * quiescing dongle will be done using DB7 trap.
+                */
+               if (!dongle_isolation &&
+                       bus->dhd && !bus->dhd->is_pcie_watchdog_reset) {
+                       dhdpcie_dongle_reset(bus);
+               }
+
+               /* Only for EFI this will be effective */
+               dhdpcie_dongle_flr_or_pwr_toggle(bus);
+
+               if (bus->ltrsleep_on_unload) {
+                       si_corereg(bus->sih, bus->sih->buscoreidx,
+                               OFFSETOF(sbpcieregs_t, u.pcie2.ltr_state), ~0, 0);
+               }
+
+               if (bus->sih->buscorerev == 13)
+                        pcie_serdes_iddqdisable(bus->osh, bus->sih,
+                                                (sbpcieregs_t *) bus->regs);
+
+               /* For inbuilt drivers pcie clk req will be done by RC,
+                * so do not do clkreq from dhd
+                */
+               if (dhd_download_fw_on_driverload)
+               {
+                       /* Disable CLKREQ# */
+                       dhdpcie_clkreq(bus->osh, 1, 0);
+               }
+
+               if (bus->sih != NULL) {
+                       si_detach(bus->sih);
+                       bus->sih = NULL;
+               }
+               if (bus->vars && bus->varsz)
+                       MFREE(osh, bus->vars, bus->varsz);
+               bus->vars = NULL;
+       }
+
+       DHD_TRACE(("%s Exit\n", __FUNCTION__));
+}
+
+uint32
+dhdpcie_bus_cfg_read_dword(dhd_bus_t *bus, uint32 addr, uint32 size)
+{
+       uint32 data = OSL_PCI_READ_CONFIG(bus->osh, addr, size);
+       return data;
+}
+
+/** 32 bit config write */
+void
+dhdpcie_bus_cfg_write_dword(dhd_bus_t *bus, uint32 addr, uint32 size, uint32 data)
+{
+       OSL_PCI_WRITE_CONFIG(bus->osh, addr, size, data);
+}
+
+void
+dhdpcie_bus_cfg_set_bar0_win(dhd_bus_t *bus, uint32 data)
+{
+       OSL_PCI_WRITE_CONFIG(bus->osh, PCI_BAR0_WIN, 4, data);
+}
+
+void
+dhdpcie_bus_dongle_setmemsize(struct dhd_bus *bus, int mem_size)
+{
+       int32 min_size =  DONGLE_MIN_MEMSIZE;
+       /* Restrict the memsize to user specified limit */
+       DHD_ERROR(("user: Restrict the dongle ram size to %d, min accepted %d max accepted %d\n",
+               mem_size, min_size, (int32)bus->orig_ramsize));
+       if ((mem_size > min_size) &&
+               (mem_size < (int32)bus->orig_ramsize)) {
+               bus->ramsize = mem_size;
+       } else {
+               DHD_ERROR(("%s: Invalid mem_size %d\n", __FUNCTION__, mem_size));
+       }
+}
+
+void
+dhdpcie_bus_release_malloc(dhd_bus_t *bus, osl_t *osh)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus->dhd && bus->dhd->dongle_reset)
+               return;
+
+       if (bus->vars && bus->varsz) {
+               MFREE(osh, bus->vars, bus->varsz);
+       }
+
+       DHD_TRACE(("%s: Exit\n", __FUNCTION__));
+       return;
+
+}
+
+/** Stop bus module: clear pending frames, disable data flow */
+void dhd_bus_stop(struct dhd_bus *bus, bool enforce_mutex)
+{
+       unsigned long flags;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (!bus->dhd)
+               return;
+
+       if (bus->dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s: already down by net_dev_reset\n", __FUNCTION__));
+               goto done;
+       }
+
+       DHD_STOP_RPM_TIMER(bus->dhd);
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+       bus->dhd->busstate = DHD_BUS_DOWN;
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       atomic_set(&bus->dhd->block_bus, TRUE);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+       dhdpcie_bus_intr_disable(bus);
+
+       if (!bus->is_linkdown) {
+               uint32 status;
+               status = dhdpcie_bus_cfg_read_dword(bus, PCIIntstatus, 4);
+               dhdpcie_bus_cfg_write_dword(bus, PCIIntstatus, 4, status);
+       }
+
+       if (!dhd_download_fw_on_driverload) {
+               dhd_dpc_kill(bus->dhd);
+       }
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       pm_runtime_disable(dhd_bus_to_dev(bus));
+       pm_runtime_set_suspended(dhd_bus_to_dev(bus));
+       pm_runtime_enable(dhd_bus_to_dev(bus));
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+       /* Clear rx control and wake any waiters */
+       /* XXX More important in disconnect, but no context? */
+       dhd_os_set_ioctl_resp_timeout(IOCTL_DISABLE_TIMEOUT);
+       dhd_wakeup_ioctl_event(bus->dhd, IOCTL_RETURN_ON_BUS_STOP);
+
+done:
+       return;
+}
+
+/**
+ * Watchdog timer function.
+ * @param dhd   Represents a specific hardware (dongle) instance that this DHD manages
+ */
+bool dhd_bus_watchdog(dhd_pub_t *dhd)
+{
+       unsigned long flags;
+       dhd_bus_t *bus = dhd->bus;
+
+       if (dhd_query_bus_erros(bus->dhd)) {
+               return FALSE;
+       }
+
+       DHD_GENERAL_LOCK(dhd, flags);
+       if (DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(dhd) ||
+                       DHD_BUS_CHECK_SUSPEND_OR_SUSPEND_IN_PROGRESS(dhd)) {
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               return FALSE;
+       }
+       DHD_BUS_BUSY_SET_IN_WD(dhd);
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       dhdpcie_runtime_bus_wake(dhd, TRUE, __builtin_return_address(0));
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       /* Poll for console output periodically */
+       if (dhd->busstate == DHD_BUS_DATA &&
+               dhd->dhd_console_ms != 0 &&
+               DHD_CHK_BUS_NOT_IN_LPS(bus)) {
+               bus->console.count += dhd_watchdog_ms;
+               if (bus->console.count >= dhd->dhd_console_ms) {
+                       bus->console.count -= dhd->dhd_console_ms;
+
+                       if (MULTIBP_ENAB(bus->sih)) {
+                               dhd_bus_pcie_pwr_req(bus);
+                       }
+
+                       /* Make sure backplane clock is on */
+                       if (dhd->db7_trap.fw_db7w_trap_inprogress == FALSE) {
+                               if (dhdpcie_bus_readconsole(bus) < 0) {
+                                       dhd->dhd_console_ms = 0; /* On error, stop trying */
+                               }
+                       }
+
+                       if (MULTIBP_ENAB(bus->sih)) {
+                               dhd_bus_pcie_pwr_req_clear(bus);
+                       }
+               }
+       }
+
+#ifdef DHD_READ_INTSTATUS_IN_DPC
+       if (bus->poll) {
+               bus->ipend = TRUE;
+               bus->dpc_sched = TRUE;
+               dhd_sched_dpc(bus->dhd);     /* queue DPC now!! */
+       }
+#endif /* DHD_READ_INTSTATUS_IN_DPC */
+
+       DHD_GENERAL_LOCK(dhd, flags);
+       DHD_BUS_BUSY_CLEAR_IN_WD(dhd);
+       dhd_os_busbusy_wake(dhd);
+       DHD_GENERAL_UNLOCK(dhd, flags);
+#if !defined(DHD_PCIE_RUNTIMEPM) && defined(PCIE_INB_DW)
+       dhd->bus->inb_dw_deassert_cnt += dhd_watchdog_ms;
+       if (dhd->bus->inb_dw_deassert_cnt >=
+               DHD_INB_DW_DEASSERT_MS) {
+               dhd->bus->inb_dw_deassert_cnt = 0;
+               /* Inband device wake is deasserted from DPC context after DS_Exit is received,
+                * but if at all there is no d2h interrupt received, dpc will not be scheduled
+                * and inband DW is not deasserted, hence DW is deasserted from watchdog thread
+                * for every 250ms.
+                */
+               dhd_bus_dw_deassert(dhd);
+       }
+#endif
+       return TRUE;
+} /* dhd_bus_watchdog */
+
+#if defined(SUPPORT_MULTIPLE_REVISION)
+static int concate_revision_bcm4358(dhd_bus_t *bus, char *fw_path, char *nv_path)
+{
+       uint32 chiprev;
+#if defined(SUPPORT_MULTIPLE_CHIPS)
+       char chipver_tag[20] = "_4358";
+#else
+       char chipver_tag[10] = {0, };
+#endif /* SUPPORT_MULTIPLE_CHIPS */
+
+       chiprev = dhd_bus_chiprev(bus);
+       if (chiprev == 0) {
+               DHD_ERROR(("----- CHIP 4358 A0 -----\n"));
+               strcat(chipver_tag, "_a0");
+       } else if (chiprev == 1) {
+               DHD_ERROR(("----- CHIP 4358 A1 -----\n"));
+#if defined(SUPPORT_MULTIPLE_CHIPS) || defined(SUPPORT_MULTIPLE_MODULE_CIS)
+               strcat(chipver_tag, "_a1");
+#endif /* defined(SUPPORT_MULTIPLE_CHIPS) || defined(SUPPORT_MULTIPLE_MODULE_CIS) */
+       } else if (chiprev == 3) {
+               DHD_ERROR(("----- CHIP 4358 A3 -----\n"));
+#if defined(SUPPORT_MULTIPLE_CHIPS)
+               strcat(chipver_tag, "_a3");
+#endif /* SUPPORT_MULTIPLE_CHIPS */
+       } else {
+               DHD_ERROR(("----- Unknown chip version, ver=%x -----\n", chiprev));
+       }
+
+       strcat(fw_path, chipver_tag);
+
+#if defined(SUPPORT_MULTIPLE_MODULE_CIS) && defined(USE_CID_CHECK)
+       if (chiprev == 1 || chiprev == 3) {
+               int ret = dhd_check_module_b85a();
+               if ((chiprev == 1) && (ret < 0)) {
+                       memset(chipver_tag, 0x00, sizeof(chipver_tag));
+                       strcat(chipver_tag, "_b85");
+                       strcat(chipver_tag, "_a1");
+               }
+       }
+
+       DHD_ERROR(("%s: chipver_tag %s \n", __FUNCTION__, chipver_tag));
+#endif /* defined(SUPPORT_MULTIPLE_MODULE_CIS) && defined(USE_CID_CHECK) */
+
+#if defined(SUPPORT_MULTIPLE_BOARD_REV)
+       if (system_rev >= 10) {
+               DHD_ERROR(("----- Board Rev  [%d]-----\n", system_rev));
+               strcat(chipver_tag, "_r10");
+       }
+#endif /* SUPPORT_MULTIPLE_BOARD_REV */
+       strcat(nv_path, chipver_tag);
+
+       return 0;
+}
+
+static int concate_revision_bcm4359(dhd_bus_t *bus, char *fw_path, char *nv_path)
+{
+       uint32 chip_ver;
+       char chipver_tag[10] = {0, };
+#if defined(SUPPORT_MULTIPLE_MODULE_CIS) && defined(USE_CID_CHECK) && \
+       defined(SUPPORT_BCM4359_MIXED_MODULES)
+       int module_type = -1;
+#endif /* SUPPORT_MULTIPLE_MODULE_CIS && USE_CID_CHECK && SUPPORT_BCM4359_MIXED_MODULES */
+
+       chip_ver = bus->sih->chiprev;
+       if (chip_ver == 4) {
+               DHD_ERROR(("----- CHIP 4359 B0 -----\n"));
+               strncat(chipver_tag, "_b0", strlen("_b0"));
+       } else if (chip_ver == 5) {
+               DHD_ERROR(("----- CHIP 4359 B1 -----\n"));
+               strncat(chipver_tag, "_b1", strlen("_b1"));
+       } else if (chip_ver == 9) {
+               DHD_ERROR(("----- CHIP 4359 C0 -----\n"));
+               strncat(chipver_tag, "_c0", strlen("_c0"));
+       } else {
+               DHD_ERROR(("----- Unknown chip version, ver=%x -----\n", chip_ver));
+               return -1;
+       }
+
+#if defined(SUPPORT_MULTIPLE_MODULE_CIS) && defined(USE_CID_CHECK) && \
+       defined(SUPPORT_BCM4359_MIXED_MODULES)
+       module_type =  dhd_check_module_b90();
+
+       switch (module_type) {
+               case BCM4359_MODULE_TYPE_B90B:
+                       strcat(fw_path, chipver_tag);
+                       break;
+               case BCM4359_MODULE_TYPE_B90S:
+               default:
+                       /*
+                        * .cid.info file not exist case,
+                        * loading B90S FW force for initial MFG boot up.
+                       */
+                       if (chip_ver == 5) {
+                               strncat(fw_path, "_b90s", strlen("_b90s"));
+                       }
+                       strcat(fw_path, chipver_tag);
+                       strcat(nv_path, chipver_tag);
+                       break;
+       }
+#else /* SUPPORT_MULTIPLE_MODULE_CIS && USE_CID_CHECK && SUPPORT_BCM4359_MIXED_MODULES */
+       strcat(fw_path, chipver_tag);
+       strcat(nv_path, chipver_tag);
+#endif /* SUPPORT_MULTIPLE_MODULE_CIS && USE_CID_CHECK && SUPPORT_BCM4359_MIXED_MODULES */
+
+       return 0;
+}
+
+#if defined(USE_CID_CHECK)
+
+#define MAX_EXTENSION 20
+#define MODULE_BCM4361_INDEX   3
+#define CHIP_REV_A0    1
+#define CHIP_REV_A1    2
+#define CHIP_REV_B0    3
+#define CHIP_REV_B1    4
+#define CHIP_REV_B2    5
+#define CHIP_REV_C0    6
+#define BOARD_TYPE_EPA                         0x080f
+#define BOARD_TYPE_IPA                         0x0827
+#define BOARD_TYPE_IPA_OLD                     0x081a
+#define DEFAULT_CIDINFO_FOR_EPA                "r00a_e000_a0_ePA"
+#define DEFAULT_CIDINFO_FOR_IPA                "r00a_e000_a0_iPA"
+#define DEFAULT_CIDINFO_FOR_A1         "r01a_e30a_a1"
+#define DEFAULT_CIDINFO_FOR_B0         "r01i_e32_b0"
+#define MAX_VID_LEN                                    8
+#define CIS_TUPLE_HDR_LEN              2
+#if defined(BCM4375_CHIP)
+#define CIS_TUPLE_START_ADDRESS     0x18011120
+#define CIS_TUPLE_END_ADDRESS       0x18011177
+#elif defined(BCM4389_CHIP_DEF)
+/* 4389A0 CIS tuple start address is different with 4389B0
+ * due to OTP layout is changed from 4389B0
+ */
+#define CIS_TUPLE_START_ADDRESS     0x1801113C
+#define CIS_TUPLE_END_ADDRESS       0x18011193
+#define CIS_TUPLE_START_ADDRESS_89B0     0x18011058
+#define CIS_TUPLE_END_ADDRESS_89B0       0x180110AF
+#else
+#define CIS_TUPLE_START_ADDRESS     0x18011110
+#define CIS_TUPLE_END_ADDRESS       0x18011167
+#endif /* defined(BCM4375_CHIP) */
+#define CIS_TUPLE_MAX_COUNT            (uint32)((CIS_TUPLE_END_ADDRESS - CIS_TUPLE_START_ADDRESS\
+                                               + 1) / sizeof(uint32))
+#define CIS_TUPLE_TAG_START                    0x80
+#define CIS_TUPLE_TAG_VENDOR           0x81
+#define CIS_TUPLE_TAG_BOARDTYPE                0x1b
+#define CIS_TUPLE_TAG_LENGTH           1
+#define NVRAM_FEM_MURATA                       "_murata"
+#define CID_FEM_MURATA                         "_mur_"
+
+typedef struct cis_tuple_format {
+       uint8   id;
+       uint8   len;    /* total length of tag and data */
+       uint8   tag;
+       uint8   data[1];
+} cis_tuple_format_t;
+
+typedef struct {
+       char cid_ext[MAX_EXTENSION];
+       char nvram_ext[MAX_EXTENSION];
+       char fw_ext[MAX_EXTENSION];
+} naming_info_t;
+
+naming_info_t bcm4361_naming_table[] = {
+       { {""}, {""}, {""} },
+       { {"r00a_e000_a0_ePA"}, {"_a0_ePA"}, {"_a0_ePA"} },
+       { {"r00a_e000_a0_iPA"}, {"_a0"}, {"_a1"} },
+       { {"r01a_e30a_a1"}, {"_r01a_a1"}, {"_a1"} },
+       { {"r02a_e30a_a1"}, {"_r02a_a1"}, {"_a1"} },
+       { {"r02c_e30a_a1"}, {"_r02c_a1"}, {"_a1"} },
+       { {"r01d_e31_b0"}, {"_r01d_b0"}, {"_b0"} },
+       { {"r01f_e31_b0"}, {"_r01f_b0"}, {"_b0"} },
+       { {"r02g_e31_b0"}, {"_r02g_b0"}, {"_b0"} },
+       { {"r01h_e32_b0"}, {"_r01h_b0"}, {"_b0"} },
+       { {"r01i_e32_b0"}, {"_r01i_b0"}, {"_b0"} },
+       { {"r02j_e32_b0"}, {"_r02j_b0"}, {"_b0"} },
+       { {"r012_1kl_a1"}, {"_r012_a1"}, {"_a1"} },
+       { {"r013_1kl_b0"}, {"_r013_b0"}, {"_b0"} },
+       { {"r013_1kl_b0"}, {"_r013_b0"}, {"_b0"} },
+       { {"r014_1kl_b0"}, {"_r014_b0"}, {"_b0"} },
+       { {"r015_1kl_b0"}, {"_r015_b0"}, {"_b0"} },
+       { {"r020_1kl_b0"}, {"_r020_b0"}, {"_b0"} },
+       { {"r021_1kl_b0"}, {"_r021_b0"}, {"_b0"} },
+       { {"r022_1kl_b0"}, {"_r022_b0"}, {"_b0"} },
+       { {"r023_1kl_b0"}, {"_r023_b0"}, {"_b0"} },
+       { {"r024_1kl_b0"}, {"_r024_b0"}, {"_b0"} },
+       { {"r030_1kl_b0"}, {"_r030_b0"}, {"_b0"} },
+       { {"r031_1kl_b0"}, {"_r030_b0"}, {"_b0"} },     /* exceptional case : r31 -> r30 */
+       { {"r032_1kl_b0"}, {"_r032_b0"}, {"_b0"} },
+       { {"r033_1kl_b0"}, {"_r033_b0"}, {"_b0"} },
+       { {"r034_1kl_b0"}, {"_r034_b0"}, {"_b0"} },
+       { {"r02a_e32a_b2"}, {"_r02a_b2"}, {"_b2"} },
+       { {"r02b_e32a_b2"}, {"_r02b_b2"}, {"_b2"} },
+       { {"r020_1qw_b2"}, {"_r020_b2"}, {"_b2"} },
+       { {"r021_1qw_b2"}, {"_r021_b2"}, {"_b2"} },
+       { {"r022_1qw_b2"}, {"_r022_b2"}, {"_b2"} },
+       { {"r031_1qw_b2"}, {"_r031_b2"}, {"_b2"} }
+};
+
+#define MODULE_BCM4375_INDEX    3
+
+naming_info_t bcm4375_naming_table[] = {
+       { {""}, {""}, {""} },
+       { {"e41_es11"}, {"_ES00_semco_b0"}, {"_b0"} },
+       { {"e43_es33"}, {"_ES01_semco_b0"}, {"_b0"} },
+       { {"e43_es34"}, {"_ES02_semco_b0"}, {"_b0"} },
+       { {"e43_es35"}, {"_ES02_semco_b0"}, {"_b0"} },
+       { {"e43_es36"}, {"_ES03_semco_b0"}, {"_b0"} },
+       { {"e43_cs41"}, {"_CS00_semco_b1"}, {"_b1"} },
+       { {"e43_cs51"}, {"_CS01_semco_b1"}, {"_b1"} },
+       { {"e43_cs53"}, {"_CS01_semco_b1"}, {"_b1"} },
+       { {"e43_cs61"}, {"_CS00_skyworks_b1"}, {"_b1"} },
+       { {"1rh_es10"}, {"_1rh_es10_b0"}, {"_b0"} },
+       { {"1rh_es11"}, {"_1rh_es11_b0"}, {"_b0"} },
+       { {"1rh_es12"}, {"_1rh_es12_b0"}, {"_b0"} },
+       { {"1rh_es13"}, {"_1rh_es13_b0"}, {"_b0"} },
+       { {"1rh_es20"}, {"_1rh_es20_b0"}, {"_b0"} },
+       { {"1rh_es32"}, {"_1rh_es32_b0"}, {"_b0"} },
+       { {"1rh_es41"}, {"_1rh_es41_b1"}, {"_b1"} },
+       { {"1rh_es42"}, {"_1rh_es42_b1"}, {"_b1"} },
+       { {"1rh_es43"}, {"_1rh_es43_b1"}, {"_b1"} },
+       { {"1rh_es44"}, {"_1rh_es44_b1"}, {"_b1"} }
+};
+
+#define MODULE_BCM4389_INDEX   3
+
+naming_info_t bcm4389_naming_table[] = {
+       { {""}, {""}, {""} },
+       { {"e51_es11"}, {"_ES01_semco_a0"}, {"_a0"} },
+       { {"e51_es12"}, {"_ES02_semco_a0"}, {"_a0"} },
+       { {"e53_es23"}, {"_ES10_semco_b0"}, {"_b0"} },
+       { {"1wk_es21"}, {"_1wk_es21_b0"}, {"_b0"} },
+       { {"1wk_es30"}, {"_1wk_es30_b0"}, {"_b0"} },
+       { {"1wk_es31"}, {"_1wk_es31_b0"}, {"_b0"} }
+};
+
+#if defined(BCM4361_CHIP) || defined(BCM4375_CHIP) || defined(BCM4389_CHIP_DEF)
+static naming_info_t *
+dhd_find_naming_info(naming_info_t table[], int table_size, char *module_type)
+{
+       int index_found = 0, i = 0;
+
+       if (module_type && strlen(module_type) > 0) {
+               for (i = 1; i < table_size; i++) {
+                       if (!strncmp(table[i].cid_ext, module_type, strlen(table[i].cid_ext))) {
+                               index_found = i;
+                               break;
+                       }
+               }
+       }
+
+       DHD_INFO(("%s: index_found=%d\n", __FUNCTION__, index_found));
+
+       return &table[index_found];
+}
+
+static naming_info_t *
+dhd_find_naming_info_by_cid(naming_info_t table[], int table_size,
+       char *cid_info)
+{
+       int index_found = 0, i = 0;
+       char *ptr;
+
+       /* truncate extension */
+       for (i = 1, ptr = cid_info; i < MODULE_BCM4361_INDEX && ptr; i++) {
+               ptr = bcmstrstr(ptr, "_");
+               if (ptr) {
+                       ptr++;
+               }
+       }
+
+       for (i = 1; i < table_size && ptr; i++) {
+               if (!strncmp(table[i].cid_ext, ptr, strlen(table[i].cid_ext))) {
+                       index_found = i;
+                       break;
+               }
+       }
+
+       DHD_INFO(("%s: index_found=%d\n", __FUNCTION__, index_found));
+
+       return &table[index_found];
+}
+
+static int
+dhd_parse_board_information_bcm(dhd_bus_t *bus, int *boardtype,
+               unsigned char *vid, int *vid_length)
+{
+       int boardtype_backplane_addr[] = {
+               0x18010324, /* OTP Control 1 */
+               0x18012618, /* PMU min resource mask */
+       };
+       int boardtype_backplane_data[] = {
+               0x00fa0000,
+               0x0e4fffff /* Keep on ARMHTAVAIL */
+       };
+       int int_val = 0, i = 0;
+       cis_tuple_format_t *tuple;
+       int totlen, len;
+       uint32 raw_data[CIS_TUPLE_MAX_COUNT];
+       uint32 cis_start_addr = CIS_TUPLE_START_ADDRESS;
+#ifdef BCM4389_CHIP_DEF
+       uint chipid = dhd_bus_chip_id(bus->dhd);
+       uint revid = dhd_bus_chiprev_id(bus->dhd);
+
+       if ((BCM4389_CHIP_GRPID == chipid) && (revid == 1)) {
+               cis_start_addr = CIS_TUPLE_START_ADDRESS_89B0;
+       }
+       DHD_INFO(("%s : chipid :%u, revid %u\n", __FUNCTION__, chipid, revid));
+#endif /* BCM4389_CHIP_DEF */
+       for (i = 0; i < ARRAYSIZE(boardtype_backplane_addr); i++) {
+               /* Write new OTP and PMU configuration */
+               if (si_backplane_access(bus->sih, boardtype_backplane_addr[i], sizeof(int),
+                               &boardtype_backplane_data[i], FALSE) != BCME_OK) {
+                       DHD_ERROR(("invalid size/addr combination\n"));
+                       return BCME_ERROR;
+               }
+
+               if (si_backplane_access(bus->sih, boardtype_backplane_addr[i], sizeof(int),
+                               &int_val, TRUE) != BCME_OK) {
+                       DHD_ERROR(("invalid size/addr combination\n"));
+                       return BCME_ERROR;
+               }
+
+               DHD_INFO(("%s: boardtype_backplane_addr 0x%08x rdata 0x%04x\n",
+                       __FUNCTION__, boardtype_backplane_addr[i], int_val));
+       }
+
+       /* read tuple raw data */
+       for (i = 0; i < CIS_TUPLE_MAX_COUNT; i++) {
+               if (si_backplane_access(bus->sih, cis_start_addr + i * sizeof(uint32),
+                               sizeof(uint32), &raw_data[i], TRUE) != BCME_OK) {
+                       break;
+               }
+               DHD_INFO(("%s: tuple index %d, raw data 0x%08x\n", __FUNCTION__, i,  raw_data[i]));
+       }
+
+       totlen = i * sizeof(uint32);
+       tuple = (cis_tuple_format_t *)raw_data;
+
+       /* check the first tuple has tag 'start' */
+       if (tuple->id != CIS_TUPLE_TAG_START) {
+               DHD_ERROR(("%s: Can not find the TAG\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       *vid_length = *boardtype = 0;
+
+       /* find tagged parameter */
+       while ((totlen >= (tuple->len + CIS_TUPLE_HDR_LEN)) &&
+                       (*vid_length == 0 || *boardtype == 0)) {
+               len = tuple->len;
+
+               if ((tuple->tag == CIS_TUPLE_TAG_VENDOR) &&
+                               (totlen >= (int)(len + CIS_TUPLE_HDR_LEN))) {
+                       /* found VID */
+                       memcpy(vid, tuple->data, tuple->len - CIS_TUPLE_TAG_LENGTH);
+                       *vid_length = tuple->len - CIS_TUPLE_TAG_LENGTH;
+                       prhex("OTP VID", tuple->data, tuple->len - CIS_TUPLE_TAG_LENGTH);
+               }
+               else if ((tuple->tag == CIS_TUPLE_TAG_BOARDTYPE) &&
+                               (totlen >= (int)(len + CIS_TUPLE_HDR_LEN))) {
+                       /* found boardtype */
+                       *boardtype = (int)tuple->data[0];
+                       prhex("OTP boardtype", tuple->data, tuple->len - CIS_TUPLE_TAG_LENGTH);
+               }
+
+               tuple = (cis_tuple_format_t*)((uint8*)tuple + (len + CIS_TUPLE_HDR_LEN));
+               totlen -= (len + CIS_TUPLE_HDR_LEN);
+       }
+
+       if (*vid_length <= 0 || *boardtype <= 0) {
+               DHD_ERROR(("failed to parse information (vid=%d, boardtype=%d)\n",
+                       *vid_length, *boardtype));
+               return BCME_ERROR;
+       }
+
+       return BCME_OK;
+
+}
+
+static naming_info_t *
+dhd_find_naming_info_by_chip_rev(naming_info_t table[], int table_size,
+       dhd_bus_t *bus, bool *is_murata_fem)
+{
+       int board_type = 0, chip_rev = 0, vid_length = 0;
+       unsigned char vid[MAX_VID_LEN];
+       naming_info_t *info = &table[0];
+       char *cid_info = NULL;
+
+       if (!bus || !bus->sih) {
+               DHD_ERROR(("%s:bus(%p) or bus->sih is NULL\n", __FUNCTION__, bus));
+               return NULL;
+       }
+       chip_rev = bus->sih->chiprev;
+
+       if (dhd_parse_board_information_bcm(bus, &board_type, vid, &vid_length)
+                       != BCME_OK) {
+               DHD_ERROR(("%s:failed to parse board information\n", __FUNCTION__));
+               return NULL;
+       }
+
+       DHD_INFO(("%s:chip version %d\n", __FUNCTION__, chip_rev));
+
+#if defined(BCM4361_CHIP)
+       /* A0 chipset has exception only */
+       if (chip_rev == CHIP_REV_A0) {
+               if (board_type == BOARD_TYPE_EPA) {
+                       info = dhd_find_naming_info(table, table_size,
+                               DEFAULT_CIDINFO_FOR_EPA);
+               } else if ((board_type == BOARD_TYPE_IPA) ||
+                               (board_type == BOARD_TYPE_IPA_OLD)) {
+                       info = dhd_find_naming_info(table, table_size,
+                               DEFAULT_CIDINFO_FOR_IPA);
+               }
+       } else {
+               cid_info = dhd_get_cid_info(vid, vid_length);
+               if (cid_info) {
+                       info = dhd_find_naming_info_by_cid(table, table_size, cid_info);
+                       if (strstr(cid_info, CID_FEM_MURATA)) {
+                               *is_murata_fem = TRUE;
+                       }
+               }
+       }
+#else
+       cid_info = dhd_get_cid_info(vid, vid_length);
+       if (cid_info) {
+               info = dhd_find_naming_info_by_cid(table, table_size, cid_info);
+               if (strstr(cid_info, CID_FEM_MURATA)) {
+                       *is_murata_fem = TRUE;
+               }
+       }
+#endif /* BCM4361_CHIP */
+
+       return info;
+}
+#endif /* BCM4361_CHIP || BCM4375_CHIP || BCM4389_CHIP_DEF */
+#endif /* USE_CID_CHECK */
+
+static int
+concate_revision_bcm4361(dhd_bus_t *bus, char *fw_path, char *nv_path)
+{
+       int ret = BCME_OK;
+#if defined(SUPPORT_BCM4361_MIXED_MODULES) && defined(USE_CID_CHECK)
+       char module_type[MAX_VNAME_LEN];
+       naming_info_t *info = NULL;
+       bool is_murata_fem = FALSE;
+
+       memset(module_type, 0, sizeof(module_type));
+
+       if (dhd_check_module_bcm(module_type,
+                       MODULE_BCM4361_INDEX, &is_murata_fem) == BCME_OK) {
+               info = dhd_find_naming_info(bcm4361_naming_table,
+                       ARRAYSIZE(bcm4361_naming_table), module_type);
+       } else {
+               /* in case of .cid.info doesn't exists */
+               info = dhd_find_naming_info_by_chip_rev(bcm4361_naming_table,
+                       ARRAYSIZE(bcm4361_naming_table), bus, &is_murata_fem);
+       }
+
+       if (bcmstrnstr(nv_path, PATH_MAX,  "_murata", 7)) {
+               is_murata_fem = FALSE;
+       }
+
+       if (info) {
+               if (is_murata_fem) {
+                       strncat(nv_path, NVRAM_FEM_MURATA, strlen(NVRAM_FEM_MURATA));
+               }
+               strncat(nv_path, info->nvram_ext, strlen(info->nvram_ext));
+               strncat(fw_path, info->fw_ext, strlen(info->fw_ext));
+       } else {
+               DHD_ERROR(("%s:failed to find extension for nvram and firmware\n", __FUNCTION__));
+               ret = BCME_ERROR;
+       }
+#else /* SUPPORT_MULTIPLE_MODULE_CIS && USE_CID_CHECK */
+       char chipver_tag[10] = {0, };
+
+       strcat(fw_path, chipver_tag);
+       strcat(nv_path, chipver_tag);
+#endif /* SUPPORT_MULTIPLE_MODULE_CIS && USE_CID_CHECK */
+
+       return ret;
+}
+
+static int
+concate_revision_bcm4375(dhd_bus_t *bus, char *fw_path, char *nv_path)
+{
+       int ret = BCME_OK;
+#if defined(SUPPORT_BCM4375_MIXED_MODULES) && defined(USE_CID_CHECK)
+       char module_type[MAX_VNAME_LEN];
+       naming_info_t *info = NULL;
+       bool is_murata_fem = FALSE;
+
+       memset(module_type, 0, sizeof(module_type));
+
+       if (dhd_check_module_bcm(module_type,
+                       MODULE_BCM4375_INDEX, &is_murata_fem) == BCME_OK) {
+               info = dhd_find_naming_info(bcm4375_naming_table,
+                               ARRAYSIZE(bcm4375_naming_table), module_type);
+       } else {
+               /* in case of .cid.info doesn't exists */
+               info = dhd_find_naming_info_by_chip_rev(bcm4375_naming_table,
+                               ARRAYSIZE(bcm4375_naming_table), bus, &is_murata_fem);
+       }
+
+       if (info) {
+               strncat(nv_path, info->nvram_ext, strlen(info->nvram_ext));
+               strncat(fw_path, info->fw_ext, strlen(info->fw_ext));
+       } else {
+               DHD_ERROR(("%s:failed to find extension for nvram and firmware\n", __FUNCTION__));
+               ret = BCME_ERROR;
+       }
+#else /* SUPPORT_BCM4375_MIXED_MODULES && USE_CID_CHECK */
+       char chipver_tag[10] = {0, };
+
+       strcat(fw_path, chipver_tag);
+       strcat(nv_path, chipver_tag);
+#endif /* SUPPORT_BCM4375_MIXED_MODULES && USE_CID_CHECK */
+
+       return ret;
+}
+
+static int
+concate_revision_bcm4389(dhd_bus_t *bus, char *fw_path, char *nv_path)
+{
+       int ret = BCME_OK;
+#if defined(SUPPORT_BCM4389_MIXED_MODULES) && defined(USE_CID_CHECK)
+       char module_type[MAX_VNAME_LEN];
+       naming_info_t *info = NULL;
+       bool is_murata_fem = FALSE;
+
+       memset(module_type, 0, sizeof(module_type));
+
+       if (dhd_check_module_bcm(module_type,
+                       MODULE_BCM4389_INDEX, &is_murata_fem) == BCME_OK) {
+               info = dhd_find_naming_info(bcm4389_naming_table,
+                               ARRAYSIZE(bcm4389_naming_table), module_type);
+       } else {
+               /* in case of .cid.info doesn't exists */
+               info = dhd_find_naming_info_by_chip_rev(bcm4389_naming_table,
+                               ARRAYSIZE(bcm4389_naming_table), bus, &is_murata_fem);
+       }
+
+       if (info) {
+               strncat(nv_path, info->nvram_ext, strlen(info->nvram_ext));
+               strncat(fw_path, info->fw_ext, strlen(info->fw_ext));
+       } else {
+               DHD_ERROR(("%s:failed to find extension for nvram and firmware\n", __FUNCTION__));
+               ret = BCME_ERROR;
+       }
+#else /* SUPPORT_BCM4389_MIXED_MODULES && USE_CID_CHECK */
+       char chipver_tag[10] = {0, };
+
+       strcat(fw_path, chipver_tag);
+       strcat(nv_path, chipver_tag);
+#endif /* SUPPORT_BCM4389_MIXED_MODULES && USE_CID_CHECK */
+       return ret;
+}
+
+int
+concate_revision(dhd_bus_t *bus, char *fw_path, char *nv_path)
+{
+       int res = 0;
+
+       if (!bus || !bus->sih) {
+               DHD_ERROR(("%s:Bus is Invalid\n", __FUNCTION__));
+               return -1;
+       }
+
+       if (!fw_path || !nv_path) {
+               DHD_ERROR(("fw_path or nv_path is null.\n"));
+               return res;
+       }
+
+       switch (si_chipid(bus->sih)) {
+
+       case BCM43569_CHIP_ID:
+       case BCM4358_CHIP_ID:
+               res = concate_revision_bcm4358(bus, fw_path, nv_path);
+               break;
+       case BCM4355_CHIP_ID:
+       case BCM4359_CHIP_ID:
+               res = concate_revision_bcm4359(bus, fw_path, nv_path);
+               break;
+       case BCM4361_CHIP_ID:
+       case BCM4347_CHIP_ID:
+               res = concate_revision_bcm4361(bus, fw_path, nv_path);
+               break;
+       case BCM4375_CHIP_ID:
+               res = concate_revision_bcm4375(bus, fw_path, nv_path);
+               break;
+       case BCM4389_CHIP_ID:
+               res = concate_revision_bcm4389(bus, fw_path, nv_path);
+               break;
+       default:
+               DHD_ERROR(("REVISION SPECIFIC feature is not required\n"));
+               return res;
+       }
+
+       return res;
+}
+#endif /* SUPPORT_MULTIPLE_REVISION */
+
+uint16
+dhd_get_chipid(struct dhd_bus *bus)
+{
+       if (bus && bus->sih) {
+               return (uint16)si_chipid(bus->sih);
+       } else if (bus && bus->regs) {
+               chipcregs_t *cc = (chipcregs_t *)bus->regs;
+               uint w, chipid;
+
+               /* Set bar0 window to si_enum_base */
+               dhdpcie_bus_cfg_set_bar0_win(bus, si_enum_base(0));
+
+               w = R_REG(bus->osh, &cc->chipid);
+               chipid = w & CID_ID_MASK;
+
+               return (uint16)chipid;
+       } else {
+               return 0;
+       }
+}
+
+/**
+ * Loads firmware given by caller supplied path and nvram image into PCIe dongle.
+ *
+ * BCM_REQUEST_FW specific :
+ * Given the chip type, determines the to be used file paths within /lib/firmware/brcm/ containing
+ * firmware and nvm for that chip. If the download fails, retries download with a different nvm file
+ *
+ * BCMEMBEDIMAGE specific:
+ * If bus->fw_path is empty, or if the download of bus->fw_path failed, firmware contained in header
+ * file will be used instead.
+ *
+ * @return BCME_OK on success
+ */
+int
+dhd_bus_download_firmware(struct dhd_bus *bus, osl_t *osh,
+                          char *pfw_path, char *pnv_path,
+                          char *pclm_path, char *pconf_path)
+{
+       int ret;
+
+       bus->fw_path = pfw_path;
+       bus->nv_path = pnv_path;
+       bus->dhd->clm_path = pclm_path;
+       bus->dhd->conf_path = pconf_path;
+
+#if defined(SUPPORT_MULTIPLE_REVISION)
+       if (concate_revision(bus, bus->fw_path, bus->nv_path) != 0) {
+               DHD_ERROR(("%s: fail to concatnate revison \n",
+                       __FUNCTION__));
+               /* Proceed if SUPPORT_MULTIPLE_CHIPS is enabled */
+#ifndef SUPPORT_MULTIPLE_CHIPS
+               return BCME_BADARG;
+#endif /* !SUPPORT_MULTIPLE_CHIPS */
+       }
+#endif /* SUPPORT_MULTIPLE_REVISION */
+
+#if defined(DHD_BLOB_EXISTENCE_CHECK)
+       dhd_set_blob_support(bus->dhd, bus->fw_path);
+#endif /* DHD_BLOB_EXISTENCE_CHECK */
+
+       DHD_ERROR(("%s: firmware path=%s, nvram path=%s\n",
+               __FUNCTION__, bus->fw_path, bus->nv_path));
+       dhdpcie_dump_resource(bus);
+
+       ret = dhdpcie_download_firmware(bus, osh);
+
+       return ret;
+}
+
+void
+dhd_set_bus_params(struct dhd_bus *bus)
+{
+       if (bus->dhd->conf->dhd_poll >= 0) {
+               bus->poll = bus->dhd->conf->dhd_poll;
+               if (!bus->pollrate)
+                       bus->pollrate = 1;
+               printf("%s: set polling mode %d\n", __FUNCTION__, bus->dhd->conf->dhd_poll);
+       }
+}
+
+/**
+ * Loads firmware given by 'bus->fw_path' into PCIe dongle.
+ *
+ * BCM_REQUEST_FW specific :
+ * Given the chip type, determines the to be used file paths within /lib/firmware/brcm/ containing
+ * firmware and nvm for that chip. If the download fails, retries download with a different nvm file
+ *
+ * BCMEMBEDIMAGE specific:
+ * If bus->fw_path is empty, or if the download of bus->fw_path failed, firmware contained in header
+ * file will be used instead.
+ *
+ * @return BCME_OK on success
+ */
+static int
+dhdpcie_download_firmware(struct dhd_bus *bus, osl_t *osh)
+{
+       int ret = 0;
+#if defined(BCM_REQUEST_FW)
+       uint chipid = bus->sih->chip;
+       uint revid = bus->sih->chiprev;
+       char fw_path[64] = "/lib/firmware/brcm/bcm";    /* path to firmware image */
+       char nv_path[64];               /* path to nvram vars file */
+       bus->fw_path = fw_path;
+       bus->nv_path = nv_path;
+       switch (chipid) {
+       case BCM43570_CHIP_ID:
+               bcmstrncat(fw_path, "43570", 5);
+               switch (revid) {
+               case 0:
+                       bcmstrncat(fw_path, "a0", 2);
+                       break;
+               case 2:
+                       bcmstrncat(fw_path, "a2", 2);
+                       break;
+               default:
+                       DHD_ERROR(("%s: revid is not found %x\n", __FUNCTION__,
+                       revid));
+                       break;
+               }
+               break;
+       default:
+               DHD_ERROR(("%s: unsupported device %x\n", __FUNCTION__,
+               chipid));
+               return 0;
+       }
+       /* load board specific nvram file */
+       snprintf(bus->nv_path, sizeof(nv_path), "%s.nvm", fw_path);
+       /* load firmware */
+       snprintf(bus->fw_path, sizeof(fw_path), "%s-firmware.bin", fw_path);
+#endif /* BCM_REQUEST_FW */
+
+       DHD_OS_WAKE_LOCK(bus->dhd);
+
+       dhd_conf_set_path_params(bus->dhd, bus->fw_path, bus->nv_path);
+       dhd_set_bus_params(bus);
+
+       ret = _dhdpcie_download_firmware(bus);
+
+       DHD_OS_WAKE_UNLOCK(bus->dhd);
+       return ret;
+} /* dhdpcie_download_firmware */
+
+/**
+ * Downloads a file containing firmware into dongle memory. In case of a .bea file, the DHD
+ * is updated with the event logging partitions within that file as well.
+ *
+ * @param pfw_path    Path to .bin or .bea file
+ */
+static int
+dhdpcie_download_code_file(struct dhd_bus *bus, char *pfw_path)
+{
+       int bcmerror = BCME_ERROR;
+       int offset = 0;
+       int len = 0;
+       bool store_reset;
+       char *imgbuf = NULL; /**< XXX a file pointer, contradicting its name and type */
+       uint8 *memblock = NULL, *memptr = NULL;
+       uint8 *memptr_tmp = NULL; // terence: check downloaded firmware is correct
+       int offset_end = bus->ramsize;
+       uint32 file_size = 0, read_len = 0;
+
+#if defined(DHD_FW_MEM_CORRUPTION)
+       if (dhd_bus_get_fw_mode(bus->dhd) == DHD_FLAG_MFG_MODE) {
+               dhd_tcm_test_enable = TRUE;
+       } else {
+               dhd_tcm_test_enable = FALSE;
+       }
+#endif /* DHD_FW_MEM_CORRUPTION */
+       DHD_ERROR(("%s: dhd_tcm_test_enable %u\n", __FUNCTION__, dhd_tcm_test_enable));
+       /* TCM check */
+       if (dhd_tcm_test_enable && !dhd_bus_tcm_test(bus)) {
+               DHD_ERROR(("dhd_bus_tcm_test failed\n"));
+               bcmerror = BCME_ERROR;
+               goto err;
+       }
+       DHD_ERROR(("%s: download firmware %s\n", __FUNCTION__, pfw_path));
+
+       /* Should succeed in opening image if it is actually given through registry
+        * entry or in module param.
+        */
+       imgbuf = dhd_os_open_image1(bus->dhd, pfw_path);
+       if (imgbuf == NULL) {
+               printf("%s: Open firmware file failed %s\n", __FUNCTION__, pfw_path);
+               goto err;
+       }
+
+       file_size = dhd_os_get_image_size(imgbuf);
+       if (!file_size) {
+               DHD_ERROR(("%s: get file size fails ! \n", __FUNCTION__));
+               goto err;
+       }
+
+       memptr = memblock = MALLOC(bus->dhd->osh, MEMBLOCK + DHD_SDALIGN);
+       if (memblock == NULL) {
+               DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__, MEMBLOCK));
+               bcmerror = BCME_NOMEM;
+               goto err;
+       }
+       if (dhd_msg_level & DHD_TRACE_VAL) {
+               memptr_tmp = MALLOC(bus->dhd->osh, MEMBLOCK + DHD_SDALIGN);
+               if (memptr_tmp == NULL) {
+                       DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__, MEMBLOCK));
+                       goto err;
+               }
+       }
+       if ((uint32)(uintptr)memblock % DHD_SDALIGN) {
+               memptr += (DHD_SDALIGN - ((uint32)(uintptr)memblock % DHD_SDALIGN));
+       }
+
+       /* check if CR4/CA7 */
+       store_reset = (si_setcore(bus->sih, ARMCR4_CORE_ID, 0) ||
+                       si_setcore(bus->sih, ARMCA7_CORE_ID, 0));
+       /* Download image with MEMBLOCK size */
+       while ((len = dhd_os_get_image_block((char*)memptr, MEMBLOCK, imgbuf))) {
+               if (len < 0) {
+                       DHD_ERROR(("%s: dhd_os_get_image_block failed (%d)\n", __FUNCTION__, len));
+                       bcmerror = BCME_ERROR;
+                       goto err;
+               }
+
+               read_len += len;
+               if (read_len > file_size) {
+                       DHD_ERROR(("%s: WARNING! reading beyond EOF, len=%d; read_len=%u;"
+                               " file_size=%u truncating len to %d \n", __FUNCTION__,
+                               len, read_len, file_size, (len - (read_len - file_size))));
+                       len -= (read_len - file_size);
+               }
+
+               /* if address is 0, store the reset instruction to be written in 0 */
+               if (store_reset) {
+                       ASSERT(offset == 0);
+                       bus->resetinstr = *(((uint32*)memptr));
+                       /* Add start of RAM address to the address given by user */
+                       offset += bus->dongle_ram_base;
+                       offset_end += offset;
+                       store_reset = FALSE;
+               }
+
+               bcmerror = dhdpcie_bus_membytes(bus, TRUE, offset, (uint8 *)memptr, len);
+               if (bcmerror) {
+                       DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                               __FUNCTION__, bcmerror, MEMBLOCK, offset));
+                       goto err;
+               }
+
+               if (dhd_msg_level & DHD_TRACE_VAL) {
+                       bcmerror = dhdpcie_bus_membytes(bus, FALSE, offset, memptr_tmp, len);
+                       if (bcmerror) {
+                               DHD_ERROR(("%s: error %d on reading %d membytes at 0x%08x\n",
+                                       __FUNCTION__, bcmerror, MEMBLOCK, offset));
+                               goto err;
+                       }
+                       if (memcmp(memptr_tmp, memptr, len)) {
+                               DHD_ERROR(("%s: Downloaded image is corrupted.\n", __FUNCTION__));
+                               goto err;
+                       } else
+                               DHD_INFO(("%s: Download, Upload and compare succeeded.\n", __FUNCTION__));
+               }
+               offset += MEMBLOCK;
+
+               if (offset >= offset_end) {
+                       DHD_ERROR(("%s: invalid address access to %x (offset end: %x)\n",
+                               __FUNCTION__, offset, offset_end));
+                       bcmerror = BCME_ERROR;
+                       goto err;
+               }
+
+               if (read_len >= file_size) {
+                       break;
+               }
+       }
+err:
+       if (memblock) {
+               MFREE(bus->dhd->osh, memblock, MEMBLOCK + DHD_SDALIGN);
+               if (dhd_msg_level & DHD_TRACE_VAL) {
+                       if (memptr_tmp)
+                               MFREE(bus->dhd->osh, memptr_tmp, MEMBLOCK + DHD_SDALIGN);
+               }
+       }
+
+       if (imgbuf) {
+               dhd_os_close_image1(bus->dhd, imgbuf);
+       }
+
+       return bcmerror;
+} /* dhdpcie_download_code_file */
+
+#ifdef CUSTOMER_HW4_DEBUG
+#define MIN_NVRAMVARS_SIZE 128
+#endif /* CUSTOMER_HW4_DEBUG */
+
+static int
+dhdpcie_download_nvram(struct dhd_bus *bus)
+{
+       int bcmerror = BCME_ERROR;
+       uint len;
+       char * memblock = NULL;
+       char *bufp;
+       char *pnv_path;
+       bool nvram_file_exists;
+       bool nvram_uefi_exists = FALSE;
+       bool local_alloc = FALSE;
+       pnv_path = bus->nv_path;
+
+       nvram_file_exists = ((pnv_path != NULL) && (pnv_path[0] != '\0'));
+
+       /* First try UEFI */
+       len = MAX_NVRAMBUF_SIZE;
+       dhd_get_download_buffer(bus->dhd, NULL, NVRAM, &memblock, (int *)&len);
+
+       /* If UEFI empty, then read from file system */
+       if ((len <= 0) || (memblock == NULL)) {
+
+               if (nvram_file_exists) {
+                       len = MAX_NVRAMBUF_SIZE;
+                       dhd_get_download_buffer(bus->dhd, pnv_path, NVRAM, &memblock, (int *)&len);
+                       if ((len <= 0 || len > MAX_NVRAMBUF_SIZE)) {
+                               goto err;
+                       }
+               }
+               else {
+                       /* For SROM OTP no external file or UEFI required */
+                       bcmerror = BCME_OK;
+               }
+       } else {
+               nvram_uefi_exists = TRUE;
+       }
+
+       DHD_ERROR(("%s: dhd_get_download_buffer len %d\n", __FUNCTION__, len));
+
+       if (len > 0 && len <= MAX_NVRAMBUF_SIZE && memblock != NULL) {
+               bufp = (char *) memblock;
+
+               {
+                       bufp[len] = 0;
+                       if (nvram_uefi_exists || nvram_file_exists) {
+                               len = process_nvram_vars(bufp, len);
+                       }
+               }
+
+               DHD_ERROR(("%s: process_nvram_vars len %d\n", __FUNCTION__, len));
+#ifdef CUSTOMER_HW4_DEBUG
+               if (len < MIN_NVRAMVARS_SIZE) {
+                       DHD_ERROR(("%s: invalid nvram size in process_nvram_vars \n",
+                               __FUNCTION__));
+                       bcmerror = BCME_ERROR;
+                       goto err;
+               }
+#endif /* CUSTOMER_HW4_DEBUG */
+
+               if (len % 4) {
+                       len += 4 - (len % 4);
+               }
+               bufp += len;
+               *bufp++ = 0;
+               if (len)
+                       bcmerror = dhdpcie_downloadvars(bus, memblock, len + 1);
+               if (bcmerror) {
+                       DHD_ERROR(("%s: error downloading vars: %d\n",
+                               __FUNCTION__, bcmerror));
+               }
+       }
+
+err:
+       if (memblock) {
+               if (local_alloc) {
+                       MFREE(bus->dhd->osh, memblock, MAX_NVRAMBUF_SIZE);
+               } else {
+                       dhd_free_download_buffer(bus->dhd, memblock, MAX_NVRAMBUF_SIZE);
+               }
+       }
+
+       return bcmerror;
+}
+
+/**
+ * Downloads firmware file given by 'bus->fw_path' into PCIe dongle
+ *
+ * BCMEMBEDIMAGE specific:
+ * If bus->fw_path is empty, or if the download of bus->fw_path failed, firmware contained in header
+ * file will be used instead.
+ *
+ */
+static int
+_dhdpcie_download_firmware(struct dhd_bus *bus)
+{
+       int bcmerror = -1;
+
+       bool embed = FALSE;     /* download embedded firmware */
+       bool dlok = FALSE;      /* download firmware succeeded */
+
+       /* Out immediately if no image to download */
+       if ((bus->fw_path == NULL) || (bus->fw_path[0] == '\0')) {
+               DHD_ERROR(("%s: no fimrware file\n", __FUNCTION__));
+               return 0;
+       }
+       /* Keep arm in reset */
+       if (dhdpcie_bus_download_state(bus, TRUE)) {
+               DHD_ERROR(("%s: error placing ARM core in reset\n", __FUNCTION__));
+               goto err;
+       }
+
+       /* External image takes precedence if specified */
+       if ((bus->fw_path != NULL) && (bus->fw_path[0] != '\0')) {
+               if (dhdpcie_download_code_file(bus, bus->fw_path)) {
+                       DHD_ERROR(("%s:%d dongle image file download failed\n", __FUNCTION__,
+                               __LINE__));
+                       goto err;
+               } else {
+                       embed = FALSE;
+                       dlok = TRUE;
+               }
+       }
+
+       BCM_REFERENCE(embed);
+       if (!dlok) {
+               DHD_ERROR(("%s:%d dongle image download failed\n", __FUNCTION__, __LINE__));
+               goto err;
+       }
+
+       /* EXAMPLE: nvram_array */
+       /* If a valid nvram_arry is specified as above, it can be passed down to dongle */
+       /* dhd_bus_set_nvram_params(bus, (char *)&nvram_array); */
+
+       /* External nvram takes precedence if specified */
+       if (dhdpcie_download_nvram(bus)) {
+               DHD_ERROR(("%s:%d dongle nvram file download failed\n", __FUNCTION__, __LINE__));
+               goto err;
+       }
+
+       /* Take arm out of reset */
+       if (dhdpcie_bus_download_state(bus, FALSE)) {
+               DHD_ERROR(("%s: error getting out of ARM core reset\n", __FUNCTION__));
+               goto err;
+       }
+
+       bcmerror = 0;
+
+err:
+       return bcmerror;
+} /* _dhdpcie_download_firmware */
+
+static int
+dhdpcie_bus_readconsole(dhd_bus_t *bus)
+{
+       dhd_console_t *c = &bus->console;
+       uint8 line[CONSOLE_LINE_MAX], ch;
+       uint32 n, idx, addr;
+       int rv;
+       uint readlen = 0;
+       uint i = 0;
+
+       /* Don't do anything until FWREADY updates console address */
+       if (bus->console_addr == 0)
+               return -1;
+
+       /* Read console log struct */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, log);
+
+       if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr, (uint8 *)&c->log, sizeof(c->log))) < 0)
+               return rv;
+
+       /* Allocate console buffer (one time only) */
+       if (c->buf == NULL) {
+               c->bufsize = ltoh32(c->log.buf_size);
+               if ((c->buf = MALLOC(bus->dhd->osh, c->bufsize)) == NULL)
+                       return BCME_NOMEM;
+               DHD_INFO(("conlog: bufsize=0x%x\n", c->bufsize));
+       }
+       idx = ltoh32(c->log.idx);
+
+       /* Protect against corrupt value */
+       if (idx > c->bufsize)
+               return BCME_ERROR;
+
+       /* Skip reading the console buffer if the index pointer has not moved */
+       if (idx == c->last)
+               return BCME_OK;
+
+       DHD_INFO(("conlog: addr=0x%x, idx=0x%x, last=0x%x \n", c->log.buf,
+          idx, c->last));
+
+       /* Read the console buffer data to a local buffer
+        * optimize and read only the portion of the buffer needed, but
+        * important to handle wrap-around. Read ptr is 'c->last',
+        * write ptr is 'idx'
+        */
+       addr = ltoh32(c->log.buf);
+
+       /* wrap around case - write ptr < read ptr */
+       if (idx < c->last) {
+               /* from read ptr to end of buffer */
+               readlen = c->bufsize - c->last;
+               if ((rv = dhdpcie_bus_membytes(bus, FALSE,
+                               addr + c->last, c->buf, readlen)) < 0) {
+                       DHD_ERROR(("conlog: read error[1] ! \n"));
+                       return rv;
+               }
+               /* from beginning of buffer to write ptr */
+               if ((rv = dhdpcie_bus_membytes(bus, FALSE,
+                               addr, c->buf + readlen,
+                               idx)) < 0) {
+                       DHD_ERROR(("conlog: read error[2] ! \n"));
+                       return rv;
+               }
+               readlen += idx;
+       } else {
+               /* non-wraparound case, write ptr > read ptr */
+               readlen = (uint)idx - c->last;
+               if ((rv = dhdpcie_bus_membytes(bus, FALSE,
+                               addr + c->last, c->buf, readlen)) < 0) {
+                       DHD_ERROR(("conlog: read error[3] ! \n"));
+                       return rv;
+               }
+       }
+       /* update read ptr */
+       c->last = idx;
+
+       /* now output the read data from the local buffer to the host console */
+       while (i < readlen) {
+               for (n = 0; n < CONSOLE_LINE_MAX - 2 && i < readlen; n++) {
+                       ch = c->buf[i];
+                       ++i;
+                       if (ch == '\n')
+                               break;
+                       line[n] = ch;
+               }
+
+               if (n > 0) {
+                       if (line[n - 1] == '\r')
+                               n--;
+                       line[n] = 0;
+                       DHD_FWLOG(("CONSOLE: %s\n", line));
+               }
+       }
+
+       return BCME_OK;
+
+} /* dhdpcie_bus_readconsole */
+
+void
+dhd_bus_dump_console_buffer(dhd_bus_t *bus)
+{
+       uint32 n, i;
+       uint32 addr;
+       char *console_buffer = NULL;
+       uint32 console_ptr, console_size, console_index;
+       uint8 line[CONSOLE_LINE_MAX], ch;
+       int rv;
+
+       DHD_ERROR(("%s: Dump Complete Console Buffer\n", __FUNCTION__));
+
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: Skip dump Console Buffer due to PCIe link down\n", __FUNCTION__));
+               return;
+       }
+
+       addr =  bus->pcie_sh->console_addr + OFFSETOF(hnd_cons_t, log);
+       if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr,
+               (uint8 *)&console_ptr, sizeof(console_ptr))) < 0) {
+               goto exit;
+       }
+
+       addr =  bus->pcie_sh->console_addr + OFFSETOF(hnd_cons_t, log.buf_size);
+       if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr,
+               (uint8 *)&console_size, sizeof(console_size))) < 0) {
+               goto exit;
+       }
+
+       addr =  bus->pcie_sh->console_addr + OFFSETOF(hnd_cons_t, log.idx);
+       if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr,
+               (uint8 *)&console_index, sizeof(console_index))) < 0) {
+               goto exit;
+       }
+
+       console_ptr = ltoh32(console_ptr);
+       console_size = ltoh32(console_size);
+       console_index = ltoh32(console_index);
+
+       if (console_size > CONSOLE_BUFFER_MAX ||
+               !(console_buffer = MALLOC(bus->dhd->osh, console_size))) {
+               goto exit;
+       }
+
+       if ((rv = dhdpcie_bus_membytes(bus, FALSE, console_ptr,
+               (uint8 *)console_buffer, console_size)) < 0) {
+               goto exit;
+       }
+
+       for (i = 0, n = 0; i < console_size; i += n + 1) {
+               for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
+                       ch = console_buffer[(console_index + i + n) % console_size];
+                       if (ch == '\n')
+                               break;
+                       line[n] = ch;
+               }
+
+               if (n > 0) {
+                       if (line[n - 1] == '\r')
+                               n--;
+                       line[n] = 0;
+                       /* Don't use DHD_ERROR macro since we print
+                        * a lot of information quickly. The macro
+                        * will truncate a lot of the printfs
+                        */
+
+                       DHD_FWLOG(("CONSOLE: %s\n", line));
+               }
+       }
+
+exit:
+       if (console_buffer)
+               MFREE(bus->dhd->osh, console_buffer, console_size);
+       return;
+}
+
+static void
+dhdpcie_schedule_log_dump(dhd_bus_t *bus)
+{
+#if defined(DHD_DUMP_FILE_WRITE_FROM_KERNEL) && defined(DHD_LOG_DUMP)
+       log_dump_type_t *flush_type;
+
+       /* flush_type is freed at do_dhd_log_dump function */
+       flush_type = MALLOCZ(bus->dhd->osh, sizeof(log_dump_type_t));
+       if (flush_type) {
+               *flush_type = DLD_BUF_TYPE_ALL;
+               dhd_schedule_log_dump(bus->dhd, flush_type);
+       } else {
+               DHD_ERROR(("%s Fail to malloc flush_type\n", __FUNCTION__));
+       }
+#endif /* DHD_DUMP_FILE_WRITE_FROM_KERNEL && DHD_LOG_DUMP */
+}
+
+/**
+ * Opens the file given by bus->fw_path, reads part of the file into a buffer and closes the file.
+ *
+ * @return BCME_OK on success
+ */
+static int
+dhdpcie_checkdied(dhd_bus_t *bus, char *data, uint size)
+{
+       int bcmerror = 0;
+       uint msize = 512;
+       char *mbuffer = NULL;
+       uint maxstrlen = 256;
+       char *str = NULL;
+       pciedev_shared_t *local_pciedev_shared = bus->pcie_sh;
+       struct bcmstrbuf strbuf;
+       unsigned long flags;
+       bool dongle_trap_occured = FALSE;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (DHD_NOCHECKDIED_ON()) {
+               return 0;
+       }
+
+       if (data == NULL) {
+               /*
+                * Called after a rx ctrl timeout. "data" is NULL.
+                * allocate memory to trace the trap or assert.
+                */
+               size = msize;
+               mbuffer = data = MALLOC(bus->dhd->osh, msize);
+
+               if (mbuffer == NULL) {
+                       DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, msize));
+                       bcmerror = BCME_NOMEM;
+                       goto done2;
+               }
+       }
+
+       if ((str = MALLOC(bus->dhd->osh, maxstrlen)) == NULL) {
+               DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, maxstrlen));
+               bcmerror = BCME_NOMEM;
+               goto done2;
+       }
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       DHD_BUS_BUSY_SET_IN_CHECKDIED(bus->dhd);
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req(bus);
+       }
+       if ((bcmerror = dhdpcie_readshared(bus)) < 0) {
+               goto done1;
+       }
+
+       bcm_binit(&strbuf, data, size);
+
+       bcm_bprintf(&strbuf, "msgtrace address : 0x%08X\nconsole address  : 0x%08X\n",
+                   local_pciedev_shared->msgtrace_addr, local_pciedev_shared->console_addr);
+
+       if ((local_pciedev_shared->flags & PCIE_SHARED_ASSERT_BUILT) == 0) {
+               /* NOTE: Misspelled assert is intentional - DO NOT FIX.
+                * (Avoids conflict with real asserts for programmatic parsing of output.)
+                */
+               bcm_bprintf(&strbuf, "Assrt not built in dongle\n");
+       }
+
+       if ((bus->pcie_sh->flags & (PCIE_SHARED_ASSERT|PCIE_SHARED_TRAP)) == 0) {
+               /* NOTE: Misspelled assert is intentional - DO NOT FIX.
+                * (Avoids conflict with real asserts for programmatic parsing of output.)
+                */
+               bcm_bprintf(&strbuf, "No trap%s in dongle",
+                         (bus->pcie_sh->flags & PCIE_SHARED_ASSERT_BUILT)
+                         ?"/assrt" :"");
+       } else {
+               if (bus->pcie_sh->flags & PCIE_SHARED_ASSERT) {
+                       /* Download assert */
+                       bcm_bprintf(&strbuf, "Dongle assert");
+                       if (bus->pcie_sh->assert_exp_addr != 0) {
+                               str[0] = '\0';
+                               if ((bcmerror = dhdpcie_bus_membytes(bus, FALSE,
+                                       bus->pcie_sh->assert_exp_addr,
+                                       (uint8 *)str, maxstrlen)) < 0) {
+                                       goto done1;
+                               }
+
+                               str[maxstrlen - 1] = '\0';
+                               bcm_bprintf(&strbuf, " expr \"%s\"", str);
+                       }
+
+                       if (bus->pcie_sh->assert_file_addr != 0) {
+                               str[0] = '\0';
+                               if ((bcmerror = dhdpcie_bus_membytes(bus, FALSE,
+                                       bus->pcie_sh->assert_file_addr,
+                                       (uint8 *)str, maxstrlen)) < 0) {
+                                       goto done1;
+                               }
+
+                               str[maxstrlen - 1] = '\0';
+                               bcm_bprintf(&strbuf, " file \"%s\"", str);
+                       }
+
+                       bcm_bprintf(&strbuf, " line %d ",  bus->pcie_sh->assert_line);
+               }
+
+               if (bus->pcie_sh->flags & PCIE_SHARED_TRAP) {
+                       trap_t *tr = &bus->dhd->last_trap_info;
+                       dongle_trap_occured = TRUE;
+                       if ((bcmerror = dhdpcie_bus_membytes(bus, FALSE,
+                               bus->pcie_sh->trap_addr, (uint8*)tr, sizeof(trap_t))) < 0) {
+                               bus->dhd->dongle_trap_occured = TRUE;
+                               goto done1;
+                       }
+                       dhd_bus_dump_trap_info(bus, &strbuf);
+               }
+       }
+
+       if (bus->pcie_sh->flags & (PCIE_SHARED_ASSERT | PCIE_SHARED_TRAP)) {
+               DHD_ERROR(("%s: %s\n", __FUNCTION__, strbuf.origbuf));
+
+               /* wake up IOCTL wait event */
+               dhd_wakeup_ioctl_event(bus->dhd, IOCTL_RETURN_ON_TRAP);
+
+               dhd_bus_dump_console_buffer(bus);
+               dhd_prot_debug_info_print(bus->dhd);
+
+#if defined(DHD_FW_COREDUMP)
+               /* save core dump or write to a file */
+               if (bus->dhd->memdump_enabled) {
+#ifdef DHD_SSSR_DUMP
+                       DHD_ERROR(("%s : Set collect_sssr as TRUE\n", __FUNCTION__));
+                       bus->dhd->collect_sssr = TRUE;
+#endif /* DHD_SSSR_DUMP */
+#ifdef DHD_SDTC_ETB_DUMP
+                       DHD_ERROR(("%s : Set collect_sdtc as TRUE\n", __FUNCTION__));
+                       bus->dhd->collect_sdtc = TRUE;
+#endif /* DHD_SDTC_ETB_DUMP */
+                       bus->dhd->memdump_type = DUMP_TYPE_DONGLE_TRAP;
+                       dhdpcie_mem_dump(bus);
+               }
+#endif /* DHD_FW_COREDUMP */
+
+               /* set the trap occured flag only after all the memdump,
+               * logdump and sssr dump collection has been scheduled
+               */
+               if (dongle_trap_occured) {
+                       bus->dhd->dongle_trap_occured = TRUE;
+               }
+
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+               copy_hang_info_trap(bus->dhd);
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+
+               dhd_schedule_reset(bus->dhd);
+
+       }
+
+done1:
+       if (bcmerror) {
+               /* dhdpcie_checkdied is invoked only when dongle has trapped
+                * or after PCIe link down..etc. so set dongle_trap_occured so that
+                * log_dump logic can rely on only one flag dongle_trap_occured.
+                */
+               bus->dhd->dongle_trap_occured = TRUE;
+               dhdpcie_schedule_log_dump(bus);
+       }
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req_clear(bus);
+       }
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       DHD_BUS_BUSY_CLEAR_IN_CHECKDIED(bus->dhd);
+       dhd_os_busbusy_wake(bus->dhd);
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+done2:
+       if (mbuffer)
+               MFREE(bus->dhd->osh, mbuffer, msize);
+       if (str)
+               MFREE(bus->dhd->osh, str, maxstrlen);
+
+       return bcmerror;
+} /* dhdpcie_checkdied */
+
+/* Custom copy of dhdpcie_mem_dump() that can be called at interrupt level */
+void dhdpcie_mem_dump_bugcheck(dhd_bus_t *bus, uint8 *buf)
+{
+       int ret = 0;
+       int size; /* Full mem size */
+       int start; /* Start address */
+       int read_size = 0; /* Read size of each iteration */
+       uint8 *databuf = buf;
+
+       if (bus == NULL) {
+               return;
+       }
+
+       start = bus->dongle_ram_base;
+       read_size = 4;
+       /* check for dead bus */
+       {
+               uint test_word = 0;
+               ret = dhdpcie_bus_membytes(bus, FALSE, start, (uint8*)&test_word, read_size);
+               /* if read error or bus timeout */
+               if (ret || (test_word == 0xFFFFFFFF)) {
+                       return;
+               }
+       }
+
+       /* Get full mem size */
+       size = bus->ramsize;
+       /* Read mem content */
+       while (size)
+       {
+               read_size = MIN(MEMBLOCK, size);
+               if ((ret = dhdpcie_bus_membytes(bus, FALSE, start, databuf, read_size))) {
+                       return;
+               }
+
+               /* Decrement size and increment start address */
+               size -= read_size;
+               start += read_size;
+               databuf += read_size;
+       }
+       bus->dhd->soc_ram = buf;
+       bus->dhd->soc_ram_length = bus->ramsize;
+       return;
+}
+
+#if defined(DHD_FW_COREDUMP)
+static int
+dhdpcie_get_mem_dump(dhd_bus_t *bus)
+{
+       int ret = BCME_OK;
+       int size = 0;
+       int start = 0;
+       int read_size = 0; /* Read size of each iteration */
+       uint8 *p_buf = NULL, *databuf = NULL;
+       unsigned long flags_bus;
+
+       if (!bus) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (!bus->dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       size = bus->ramsize; /* Full mem size */
+       start = bus->dongle_ram_base; /* Start address */
+
+       /* Get full mem size */
+       p_buf = dhd_get_fwdump_buf(bus->dhd, size);
+       if (!p_buf) {
+               DHD_ERROR(("%s: Out of memory (%d bytes)\n",
+                       __FUNCTION__, size));
+               return BCME_ERROR;
+       }
+
+       /* Read mem content */
+       DHD_TRACE_HW4(("Dump dongle memory\n"));
+       databuf = p_buf;
+
+       /* Hold BUS_LP_STATE_LOCK to avoid simultaneous bus access */
+       DHD_BUS_LP_STATE_LOCK(bus->bus_lp_state_lock, flags_bus);
+       while (size > 0) {
+               read_size = MIN(MEMBLOCK, size);
+               ret = dhdpcie_bus_membytes(bus, FALSE, start, databuf, read_size);
+               if (ret) {
+                       DHD_ERROR(("%s: Error membytes %d\n", __FUNCTION__, ret));
+#ifdef DHD_DEBUG_UART
+                       bus->dhd->memdump_success = FALSE;
+#endif /* DHD_DEBUG_UART */
+                       break;
+               }
+               DHD_TRACE(("."));
+
+               /* Decrement size and increment start address */
+               size -= read_size;
+               start += read_size;
+               databuf += read_size;
+       }
+       DHD_BUS_LP_STATE_UNLOCK(bus->bus_lp_state_lock, flags_bus);
+
+       return ret;
+}
+
+static int
+dhdpcie_mem_dump(dhd_bus_t *bus)
+{
+       dhd_pub_t *dhdp;
+       int ret;
+       uint32 dhd_console_ms_prev = 0;
+
+       dhdp = bus->dhd;
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+       dhd_console_ms_prev = dhdp->dhd_console_ms;
+       if (dhd_console_ms_prev) {
+               DHD_ERROR(("%s: Disabling console msgs(0x%d) before mem dump to local buf\n",
+                       __FUNCTION__, dhd_console_ms_prev));
+               dhdp->dhd_console_ms = 0;
+       }
+
+#ifdef EXYNOS_PCIE_DEBUG
+       exynos_pcie_register_dump(1);
+#endif /* EXYNOS_PCIE_DEBUG */
+
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link is down so skip\n", __FUNCTION__));
+               /* panic only for DUMP_MEMFILE_BUGON */
+               ASSERT(bus->dhd->memdump_enabled != DUMP_MEMFILE_BUGON);
+               return BCME_ERROR;
+       }
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+
+       if (DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(dhdp)) {
+               DHD_ERROR(("%s: bus is down! can't collect mem dump. \n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       /* Induce DB7 trap for below non-trap cases */
+       switch (dhdp->memdump_type) {
+               case DUMP_TYPE_RESUMED_ON_TIMEOUT:
+                       /* intentional fall through */
+               case DUMP_TYPE_D3_ACK_TIMEOUT:
+                       /* intentional fall through */
+               case DUMP_TYPE_PKTID_AUDIT_FAILURE:
+                       /* intentional fall through */
+               case DUMP_TYPE_PKTID_INVALID:
+                       /* intentional fall through */
+               case DUMP_TYPE_SCAN_TIMEOUT:
+                       /* intentional fall through */
+               case DUMP_TYPE_SCAN_BUSY:
+                       /* intentional fall through */
+               case DUMP_TYPE_BY_LIVELOCK:
+                       /* intentional fall through */
+               case DUMP_TYPE_IFACE_OP_FAILURE:
+                       /* intentional fall through */
+               case DUMP_TYPE_PKTID_POOL_DEPLETED:
+                       /* intentional fall through */
+               case DUMP_TYPE_ESCAN_SYNCID_MISMATCH:
+                       if (dhdp->db7_trap.fw_db7w_trap) {
+                               /* Set fw_db7w_trap_inprogress here and clear from DPC */
+                               dhdp->db7_trap.fw_db7w_trap_inprogress = TRUE;
+                               dhdpcie_fw_trap(dhdp->bus);
+                               OSL_DELAY(100 * 1000); // wait 100 msec
+                       } else {
+                               DHD_ERROR(("%s: DB7 Not supported!!!\n",
+                                       __FUNCTION__));
+                       }
+                       break;
+               default:
+                       break;
+       }
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       if (pm_runtime_get_sync(dhd_bus_to_dev(bus)) < 0)
+               return BCME_ERROR;
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+       ret = dhdpcie_get_mem_dump(bus);
+       if (ret) {
+               DHD_ERROR(("%s: failed to get mem dump, err=%d\n",
+                       __FUNCTION__, ret));
+               return ret;
+       }
+#ifdef DHD_DEBUG_UART
+       bus->dhd->memdump_success = TRUE;
+#endif /* DHD_DEBUG_UART */
+
+       if (dhd_console_ms_prev) {
+               DHD_ERROR(("%s: enable console msgs(0x%d) after collecting memdump to local buf\n",
+                       __FUNCTION__, dhd_console_ms_prev));
+               dhdp->dhd_console_ms = dhd_console_ms_prev;
+       }
+
+       dhd_schedule_memdump(dhdp, dhdp->soc_ram, dhdp->soc_ram_length);
+       /* buf, actually soc_ram free handled in dhd_{free,clear} */
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       pm_runtime_mark_last_busy(dhd_bus_to_dev(bus));
+       pm_runtime_put_autosuspend(dhd_bus_to_dev(bus));
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+       return ret;
+}
+
+int
+dhd_bus_get_mem_dump(dhd_pub_t *dhdp)
+{
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       return dhdpcie_get_mem_dump(dhdp->bus);
+}
+
+int
+dhd_bus_mem_dump(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       int ret = BCME_ERROR;
+
+       if (dhdp->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s bus is down\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       /* Try to resume if already suspended or suspend in progress */
+#ifdef DHD_PCIE_RUNTIMEPM
+       dhdpcie_runtime_bus_wake(dhdp, CAN_SLEEP(), __builtin_return_address(0));
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       /* Skip if still in suspended or suspend in progress */
+       if (DHD_BUS_CHECK_SUSPEND_OR_ANY_SUSPEND_IN_PROGRESS(dhdp)) {
+               DHD_ERROR(("%s: bus is in suspend(%d) or suspending(0x%x) state, so skip\n",
+                       __FUNCTION__, dhdp->busstate, dhdp->dhd_bus_busy_state));
+               return BCME_ERROR;
+       }
+
+       DHD_OS_WAKE_LOCK(dhdp);
+       ret = dhdpcie_mem_dump(bus);
+       DHD_OS_WAKE_UNLOCK(dhdp);
+       return ret;
+}
+#endif /* DHD_FW_COREDUMP */
+
+int
+dhd_socram_dump(dhd_bus_t *bus)
+{
+#if defined(DHD_FW_COREDUMP)
+       DHD_OS_WAKE_LOCK(bus->dhd);
+       dhd_bus_mem_dump(bus->dhd);
+       DHD_OS_WAKE_UNLOCK(bus->dhd);
+       return 0;
+#else
+       return -1;
+#endif
+}
+
+/**
+ * Transfers bytes from host to dongle using pio mode.
+ * Parameter 'address' is a backplane address.
+ */
+static int
+dhdpcie_bus_membytes(dhd_bus_t *bus, bool write, ulong address, uint8 *data, uint size)
+{
+       uint dsize;
+       int detect_endian_flag = 0x01;
+       bool little_endian;
+
+       if (write && bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link was down\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req(bus);
+       }
+       /* Detect endianness. */
+       little_endian = *(char *)&detect_endian_flag;
+
+       /* In remap mode, adjust address beyond socram and redirect
+        * to devram at SOCDEVRAM_BP_ADDR since remap address > orig_ramsize
+        * is not backplane accessible
+        */
+
+       /* Determine initial transfer parameters */
+#ifdef DHD_SUPPORT_64BIT
+       dsize = sizeof(uint64);
+#else /* !DHD_SUPPORT_64BIT */
+       dsize = sizeof(uint32);
+#endif /* DHD_SUPPORT_64BIT */
+
+       /* Do the transfer(s) */
+       DHD_INFO(("%s: %s %d bytes in window 0x%08lx\n",
+                 __FUNCTION__, (write ? "write" : "read"), size, address));
+       if (write) {
+               while (size) {
+#ifdef DHD_SUPPORT_64BIT
+                       if (size >= sizeof(uint64) && little_endian &&  !(address % 8)) {
+                               dhdpcie_bus_wtcm64(bus, address, *((uint64 *)data));
+                       }
+#else /* !DHD_SUPPORT_64BIT */
+                       if (size >= sizeof(uint32) && little_endian &&  !(address % 4)) {
+                               dhdpcie_bus_wtcm32(bus, address, *((uint32*)data));
+                       }
+#endif /* DHD_SUPPORT_64BIT */
+                       else {
+                               dsize = sizeof(uint8);
+                               dhdpcie_bus_wtcm8(bus, address, *data);
+                       }
+
+                       /* Adjust for next transfer (if any) */
+                       if ((size -= dsize)) {
+                               data += dsize;
+                               address += dsize;
+                       }
+               }
+       } else {
+               while (size) {
+#ifdef DHD_SUPPORT_64BIT
+                       if (size >= sizeof(uint64) && little_endian &&  !(address % 8))
+                       {
+                               *(uint64 *)data = dhdpcie_bus_rtcm64(bus, address);
+                       }
+#else /* !DHD_SUPPORT_64BIT */
+                       if (size >= sizeof(uint32) && little_endian &&  !(address % 4))
+                       {
+                               *(uint32 *)data = dhdpcie_bus_rtcm32(bus, address);
+                       }
+#endif /* DHD_SUPPORT_64BIT */
+                       else {
+                               dsize = sizeof(uint8);
+                               *data = dhdpcie_bus_rtcm8(bus, address);
+                       }
+
+                       /* Adjust for next transfer (if any) */
+                       if ((size -= dsize) > 0) {
+                               data += dsize;
+                               address += dsize;
+                       }
+               }
+       }
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req_clear(bus);
+       }
+       return BCME_OK;
+} /* dhdpcie_bus_membytes */
+
+/**
+ * Transfers one transmit (ethernet) packet that was queued in the (flow controlled) flow ring queue
+ * to the (non flow controlled) flow ring.
+ */
+int
+BCMFASTPATH(dhd_bus_schedule_queue)(struct dhd_bus  *bus, uint16 flow_id, bool txs)
+/** XXX function name could be more descriptive, eg use 'tx' and 'flow ring' in name */
+{
+       flow_ring_node_t *flow_ring_node;
+       int ret = BCME_OK;
+#ifdef DHD_LOSSLESS_ROAMING
+       dhd_pub_t *dhdp = bus->dhd;
+#endif
+
+       DHD_INFO(("%s: flow_id is %d\n", __FUNCTION__, flow_id));
+
+       /* ASSERT on flow_id */
+       if (flow_id >= bus->max_submission_rings) {
+               DHD_ERROR(("%s: flow_id is invalid %d, max %d\n", __FUNCTION__,
+                       flow_id, bus->max_submission_rings));
+               return 0;
+       }
+
+       flow_ring_node = DHD_FLOW_RING(bus->dhd, flow_id);
+
+       if (flow_ring_node->prot_info == NULL) {
+           DHD_ERROR((" %s : invalid flow_ring_node \n", __FUNCTION__));
+           return BCME_NOTREADY;
+       }
+
+#ifdef DHD_LOSSLESS_ROAMING
+       if ((dhdp->dequeue_prec_map & (1 << flow_ring_node->flow_info.tid)) == 0) {
+               DHD_INFO(("%s: tid %d is not in precedence map. block scheduling\n",
+                       __FUNCTION__, flow_ring_node->flow_info.tid));
+               return BCME_OK;
+       }
+#endif /* DHD_LOSSLESS_ROAMING */
+
+       {
+               unsigned long flags;
+               void *txp = NULL;
+               flow_queue_t *queue;
+#ifdef DHD_LOSSLESS_ROAMING
+               struct ether_header *eh;
+               uint8 *pktdata;
+#endif /* DHD_LOSSLESS_ROAMING */
+
+               queue = &flow_ring_node->queue; /* queue associated with flow ring */
+
+               DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+               if (flow_ring_node->status != FLOW_RING_STATUS_OPEN) {
+                       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+                       return BCME_NOTREADY;
+               }
+
+               while ((txp = dhd_flow_queue_dequeue(bus->dhd, queue)) != NULL) {
+                       if (bus->dhd->conf->orphan_move <= 1)
+                               PKTORPHAN(txp, bus->dhd->conf->tsq);
+
+                       /*
+                        * Modifying the packet length caused P2P cert failures.
+                        * Specifically on test cases where a packet of size 52 bytes
+                        * was injected, the sniffer capture showed 62 bytes because of
+                        * which the cert tests failed. So making the below change
+                        * only Router specific.
+                        */
+
+#ifdef DHDTCPACK_SUPPRESS
+                       if (bus->dhd->tcpack_sup_mode != TCPACK_SUP_HOLD) {
+                               ret = dhd_tcpack_check_xmit(bus->dhd, txp);
+                               if (ret != BCME_OK) {
+                                       DHD_ERROR(("%s: dhd_tcpack_check_xmit() error.\n",
+                                               __FUNCTION__));
+                               }
+                       }
+#endif /* DHDTCPACK_SUPPRESS */
+#ifdef DHD_LOSSLESS_ROAMING
+                       pktdata = (uint8 *)PKTDATA(OSH_NULL, txp);
+                       eh = (struct ether_header *) pktdata;
+                       if (eh->ether_type == hton16(ETHER_TYPE_802_1X)) {
+                               uint8 prio = (uint8)PKTPRIO(txp);
+                               /* Restore to original priority for 802.1X packet */
+                               if (prio == PRIO_8021D_NC) {
+                                       PKTSETPRIO(txp, dhdp->prio_8021x);
+                               }
+                       }
+#endif /* DHD_LOSSLESS_ROAMING */
+                       /* Attempt to transfer packet over flow ring */
+                       /* XXX: ifidx is wrong */
+                       ret = dhd_prot_txdata(bus->dhd, txp, flow_ring_node->flow_info.ifindex);
+                       if (ret != BCME_OK) { /* may not have resources in flow ring */
+                               DHD_INFO(("%s: Reinserrt %d\n", __FUNCTION__, ret));
+                               dhd_prot_txdata_write_flush(bus->dhd, flow_id);
+                               /* reinsert at head */
+                               dhd_flow_queue_reinsert(bus->dhd, queue, txp);
+                               DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+                               /* If we are able to requeue back, return success */
+                               return BCME_OK;
+                       }
+
+#ifdef DHD_MEM_STATS
+                       DHD_MEM_STATS_LOCK(bus->dhd->mem_stats_lock, flags);
+                       bus->dhd->txpath_mem += PKTLEN(bus->dhd->osh, txp);
+                       DHD_INFO(("%s txpath_mem: %llu PKTLEN: %d\n",
+                               __FUNCTION__, bus->dhd->txpath_mem, PKTLEN(bus->dhd->osh, txp)));
+                       DHD_MEM_STATS_UNLOCK(bus->dhd->mem_stats_lock, flags);
+#endif /* DHD_MEM_STATS */
+               }
+
+               dhd_prot_txdata_write_flush(bus->dhd, flow_id);
+               DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+       }
+
+       return ret;
+} /* dhd_bus_schedule_queue */
+
+/** Sends an (ethernet) data frame (in 'txp') to the dongle. Callee disposes of txp. */
+int
+BCMFASTPATH(dhd_bus_txdata)(struct dhd_bus *bus, void *txp, uint8 ifidx)
+{
+       uint16 flowid;
+#ifdef IDLE_TX_FLOW_MGMT
+       uint8   node_status;
+#endif /* IDLE_TX_FLOW_MGMT */
+       flow_queue_t *queue;
+       flow_ring_node_t *flow_ring_node;
+       unsigned long flags;
+       int ret = BCME_OK;
+       void *txp_pend = NULL;
+
+       if (!bus->dhd->flowid_allocator) {
+               DHD_ERROR(("%s: Flow ring not intited yet  \n", __FUNCTION__));
+               goto toss;
+       }
+
+       flowid = DHD_PKT_GET_FLOWID(txp);
+
+       flow_ring_node = DHD_FLOW_RING(bus->dhd, flowid);
+
+       DHD_TRACE(("%s: pkt flowid %d, status %d active %d\n",
+               __FUNCTION__, flowid, flow_ring_node->status, flow_ring_node->active));
+
+       DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+       if ((flowid > bus->dhd->max_tx_flowid) ||
+#ifdef IDLE_TX_FLOW_MGMT
+               (!flow_ring_node->active))
+#else
+               (!flow_ring_node->active) ||
+               (flow_ring_node->status == FLOW_RING_STATUS_DELETE_PENDING) ||
+               (flow_ring_node->status == FLOW_RING_STATUS_STA_FREEING))
+#endif /* IDLE_TX_FLOW_MGMT */
+       {
+               DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+               DHD_INFO(("%s: Dropping pkt flowid %d, status %d active %d\n",
+                       __FUNCTION__, flowid, flow_ring_node->status,
+                       flow_ring_node->active));
+               ret = BCME_ERROR;
+                       goto toss;
+       }
+
+#ifdef IDLE_TX_FLOW_MGMT
+       node_status = flow_ring_node->status;
+
+       /* handle diffrent status states here!! */
+       switch (node_status)
+       {
+               case FLOW_RING_STATUS_OPEN:
+
+                       if (bus->enable_idle_flowring_mgmt) {
+                               /* Move the node to the head of active list */
+                               dhd_flow_ring_move_to_active_list_head(bus, flow_ring_node);
+                       }
+                       break;
+
+               case FLOW_RING_STATUS_SUSPENDED:
+                       DHD_INFO(("Need to Initiate TX Flow resume\n"));
+                       /* Issue resume_ring request */
+                       dhd_bus_flow_ring_resume_request(bus,
+                                       flow_ring_node);
+                       break;
+
+               case FLOW_RING_STATUS_CREATE_PENDING:
+               case FLOW_RING_STATUS_RESUME_PENDING:
+                       /* Dont do anything here!! */
+                       DHD_INFO(("Waiting for Flow create/resume! status is %u\n",
+                               node_status));
+                       break;
+
+               case FLOW_RING_STATUS_DELETE_PENDING:
+               default:
+                       DHD_ERROR(("Dropping packet!! flowid %u status is %u\n",
+                               flowid, node_status));
+                       /* error here!! */
+                       ret = BCME_ERROR;
+                       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+                       goto toss;
+       }
+       /* Now queue the packet */
+#endif /* IDLE_TX_FLOW_MGMT */
+
+       queue = &flow_ring_node->queue; /* queue associated with flow ring */
+
+       if ((ret = dhd_flow_queue_enqueue(bus->dhd, queue, txp)) != BCME_OK)
+               txp_pend = txp;
+
+       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+       if (flow_ring_node->status) {
+               DHD_INFO(("%s: Enq pkt flowid %d, status %d active %d\n",
+                   __FUNCTION__, flowid, flow_ring_node->status,
+                   flow_ring_node->active));
+               if (txp_pend) {
+                       txp = txp_pend;
+                       goto toss;
+               }
+               return BCME_OK;
+       }
+       ret = dhd_bus_schedule_queue(bus, flowid, FALSE); /* from queue to flowring */
+
+       /* If we have anything pending, try to push into q */
+       if (txp_pend) {
+               DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+               if ((ret = dhd_flow_queue_enqueue(bus->dhd, queue, txp_pend)) != BCME_OK) {
+                       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+                       txp = txp_pend;
+                       goto toss;
+               }
+
+               DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+       }
+
+       return ret;
+
+toss:
+       DHD_INFO(("%s: Toss %d\n", __FUNCTION__, ret));
+       PKTCFREE(bus->dhd->osh, txp, TRUE);
+       return ret;
+} /* dhd_bus_txdata */
+
+void
+dhd_bus_stop_queue(struct dhd_bus *bus)
+{
+       dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, ON);
+}
+
+void
+dhd_bus_start_queue(struct dhd_bus *bus)
+{
+       /*
+        * Tx queue has been stopped due to resource shortage (or)
+        * bus is not in a state to turn on.
+        *
+        * Note that we try to re-start network interface only
+        * when we have enough resources, one has to first change the
+        * flag indicating we have all the resources.
+        */
+       if (dhd_prot_check_tx_resource(bus->dhd)) {
+               DHD_ERROR(("%s: Interface NOT started, previously stopped "
+                       "due to resource shortage\n", __FUNCTION__));
+               return;
+       }
+       dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, OFF);
+}
+
+/* Device console input function */
+int dhd_bus_console_in(dhd_pub_t *dhd, uchar *msg, uint msglen)
+{
+       dhd_bus_t *bus = dhd->bus;
+       uint32 addr, val;
+       int rv;
+#ifdef PCIE_INB_DW
+       unsigned long flags = 0;
+#endif /* PCIE_INB_DW */
+
+       /* Address could be zero if CONSOLE := 0 in dongle Makefile */
+       if (bus->console_addr == 0)
+               return BCME_UNSUPPORTED;
+
+       /* Don't allow input if dongle is in reset */
+       if (bus->dhd->dongle_reset) {
+               return BCME_NOTREADY;
+       }
+
+       /* Zero cbuf_index */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, cbuf_idx);
+       /* handle difference in definition of hnd_log_t in certain branches */
+       if (dhd->wlc_ver_major < 14) {
+               addr -= (uint32)sizeof(uint32);
+       }
+       val = htol32(0);
+       if ((rv = dhdpcie_bus_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
+               goto done;
+
+       /* Write message into cbuf */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, cbuf);
+       /* handle difference in definition of hnd_log_t in certain branches */
+       if (dhd->wlc_ver_major < 14) {
+               addr -= sizeof(uint32);
+       }
+       if ((rv = dhdpcie_bus_membytes(bus, TRUE, addr, (uint8 *)msg, msglen)) < 0)
+               goto done;
+
+       /* Write length into vcons_in */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, vcons_in);
+       val = htol32(msglen);
+       if ((rv = dhdpcie_bus_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
+               goto done;
+
+#ifdef PCIE_INB_DW
+       /* Use a lock to ensure this tx DEVICE_WAKE + tx H2D_HOST_CONS_INT sequence is
+        * mutually exclusive with the rx D2H_DEV_DS_ENTER_REQ + tx H2D_HOST_DS_ACK sequence.
+        */
+       DHD_BUS_INB_DW_LOCK(bus->inb_lock, flags);
+#endif /* PCIE_INB_DW */
+
+       /* generate an interrupt to dongle to indicate that it needs to process cons command */
+       dhdpcie_send_mb_data(bus, H2D_HOST_CONS_INT);
+
+#ifdef PCIE_INB_DW
+       DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+#endif /* PCIE_INB_DW */
+done:
+       return rv;
+} /* dhd_bus_console_in */
+
+/**
+ * Called on frame reception, the frame was received from the dongle on interface 'ifidx' and is
+ * contained in 'pkt'. Processes rx frame, forwards up the layer to netif.
+ */
+void
+BCMFASTPATH(dhd_bus_rx_frame)(struct dhd_bus *bus, void* pkt, int ifidx, uint pkt_count)
+{
+       dhd_rx_frame(bus->dhd, ifidx, pkt, pkt_count, 0);
+}
+
+/* Aquire/Release bar1_switch_lock only if the chip supports bar1 switching */
+#define DHD_BUS_BAR1_SWITCH_LOCK(bus, flags) \
+       ((bus)->bar1_switch_enab) ? DHD_BAR1_SWITCH_LOCK((bus)->bar1_switch_lock, flags) : \
+               BCM_REFERENCE(flags)
+
+#define DHD_BUS_BAR1_SWITCH_UNLOCK(bus, flags) \
+       ((bus)->bar1_switch_enab) ? DHD_BAR1_SWITCH_UNLOCK((bus)->bar1_switch_lock, flags) : \
+               BCM_REFERENCE(flags)
+
+/* Init/Deinit bar1_switch_lock only if the chip supports bar1 switching */
+static void
+dhd_init_bar1_switch_lock(dhd_bus_t *bus)
+{
+       if (bus->bar1_switch_enab && !bus->bar1_switch_lock) {
+               bus->bar1_switch_lock = osl_spin_lock_init(bus->osh);
+       }
+}
+
+static void
+dhd_deinit_bar1_switch_lock(dhd_bus_t *bus)
+{
+       if (bus->bar1_switch_enab && bus->bar1_switch_lock) {
+               osl_spin_lock_deinit(bus->osh, bus->bar1_switch_lock);
+               bus->bar1_switch_lock = NULL;
+       }
+}
+
+/*
+ * The bpwindow for any address will be lower bound of multiples of bar1_size.
+ * For eg, if addr=0x938fff and bar1_size is 0x400000, then
+ * address will fall in the window of 0x800000-0xbfffff, so need
+ * to select bpwindow as 0x800000.
+ * To achieve this mask the LSB nibbles of bar1_size of the given addr.
+ */
+#define DHD_BUS_BAR1_BPWIN(addr, bar1_size) \
+       (uint32)((addr) & ~((bar1_size) - 1))
+
+/**
+ * dhdpcie_bar1_window_switch_enab
+ *
+ * Check if the chip requires BAR1 window switching based on
+ * dongle_ram_base, ramsize and mapped bar1_size and sets
+ * bus->bar1_switch_enab accordingly
+ * @bus: dhd bus context
+ *
+ */
+void
+dhdpcie_bar1_window_switch_enab(dhd_bus_t *bus)
+{
+       uint32 ramstart = bus->dongle_ram_base;
+       uint32 ramend = bus->dongle_ram_base + bus->ramsize - 1;
+       uint32 bpwinstart = DHD_BUS_BAR1_BPWIN(ramstart, bus->bar1_size);
+       uint32 bpwinend = DHD_BUS_BAR1_BPWIN(ramend, bus->bar1_size);
+
+       bus->bar1_switch_enab = FALSE;
+
+       /*
+        * Window switch is needed to access complete BAR1
+        * if bpwinstart and bpwinend are different
+        */
+       if (bpwinstart != bpwinend) {
+               bus->bar1_switch_enab = TRUE;
+       }
+
+       DHD_ERROR(("%s: bar1_switch_enab=%d ramstart=0x%x ramend=0x%x bar1_size=0x%x\n",
+               __FUNCTION__, bus->bar1_switch_enab, ramstart, ramend, bus->bar1_size));
+}
+
+/**
+ * dhdpcie_setbar1win
+ *
+ * os independendent function for setting bar1 window in order to allow
+ * also set current window positon.
+ *
+ * @bus: dhd bus context
+ * @addr: new backplane windows address for BAR1
+ */
+static void
+dhdpcie_setbar1win(dhd_bus_t *bus, uint32 addr)
+{
+       OSL_PCI_WRITE_CONFIG(bus->osh, PCI_BAR1_WIN, 4, addr);
+       bus->curr_bar1_win = addr;
+}
+
+/**
+ * dhdpcie_bus_chkandshift_bpoffset
+ *
+ * Check the provided address is within the current BAR1 window,
+ * if not, shift the window
+ *
+ * @bus: dhd bus context
+ * @offset: back plane address that the caller wants to access
+ *
+ * Return: new offset for access
+ */
+static ulong
+dhdpcie_bus_chkandshift_bpoffset(dhd_bus_t *bus, ulong offset)
+{
+
+       uint32 bpwin;
+
+       if (!bus->bar1_switch_enab) {
+               return offset;
+       }
+
+       /* Determine BAR1 backplane window using window size
+        * Window address mask should be ~(size - 1)
+        */
+       bpwin = DHD_BUS_BAR1_BPWIN(offset, bus->bar1_size);
+
+       if (bpwin != bus->curr_bar1_win) {
+               DHD_INFO(("%s: move BAR1 window curr_bar1_win=0x%x bpwin=0x%x offset=0x%lx\n",
+                       __FUNCTION__, bus->curr_bar1_win, bpwin, offset));
+               /* Move BAR1 window */
+               dhdpcie_setbar1win(bus, bpwin);
+       }
+
+       return offset - bpwin;
+}
+
+/** 'offset' is a backplane address */
+void
+dhdpcie_bus_wtcm8(dhd_bus_t *bus, ulong offset, uint8 data)
+{
+       ulong flags = 0;
+
+       if (bus->is_linkdown) {
+               DHD_LOG_MEM(("%s: PCIe link was down\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_BUS_BAR1_SWITCH_LOCK(bus, flags);
+
+       offset = dhdpcie_bus_chkandshift_bpoffset(bus, offset);
+
+       W_REG(bus->dhd->osh, (volatile uint8 *)(bus->tcm + offset), data);
+
+       DHD_BUS_BAR1_SWITCH_UNLOCK(bus, flags);
+}
+
+void
+dhdpcie_bus_wtcm16(dhd_bus_t *bus, ulong offset, uint16 data)
+{
+       ulong flags = 0;
+
+       if (bus->is_linkdown) {
+               DHD_LOG_MEM(("%s: PCIe link was down\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_BUS_BAR1_SWITCH_LOCK(bus, flags);
+
+       offset = dhdpcie_bus_chkandshift_bpoffset(bus, offset);
+
+       W_REG(bus->dhd->osh, (volatile uint16 *)(bus->tcm + offset), data);
+
+       DHD_BUS_BAR1_SWITCH_UNLOCK(bus, flags);
+}
+
+void
+dhdpcie_bus_wtcm32(dhd_bus_t *bus, ulong offset, uint32 data)
+{
+       ulong flags = 0;
+
+       if (bus->is_linkdown) {
+               DHD_LOG_MEM(("%s: PCIe link was down\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_BUS_BAR1_SWITCH_LOCK(bus, flags);
+
+       offset = dhdpcie_bus_chkandshift_bpoffset(bus, offset);
+
+       W_REG(bus->dhd->osh, (volatile uint32 *)(bus->tcm + offset), data);
+
+       DHD_BUS_BAR1_SWITCH_UNLOCK(bus, flags);
+}
+
+#ifdef DHD_SUPPORT_64BIT
+void
+dhdpcie_bus_wtcm64(dhd_bus_t *bus, ulong offset, uint64 data)
+{
+       ulong flags = 0;
+
+       if (bus->is_linkdown) {
+               DHD_LOG_MEM(("%s: PCIe link was down\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_BUS_BAR1_SWITCH_LOCK(bus, flags);
+
+       offset = dhdpcie_bus_chkandshift_bpoffset(bus, offset);
+
+       W_REG(bus->dhd->osh, (volatile uint64 *)(bus->tcm + offset), data);
+
+       DHD_BUS_BAR1_SWITCH_UNLOCK(bus, flags);
+}
+#endif /* DHD_SUPPORT_64BIT */
+
+uint8
+dhdpcie_bus_rtcm8(dhd_bus_t *bus, ulong offset)
+{
+       volatile uint8 data;
+       ulong flags = 0;
+
+       if (bus->is_linkdown) {
+               DHD_LOG_MEM(("%s: PCIe link was down\n", __FUNCTION__));
+               data = (uint8)-1;
+               return data;
+       }
+
+       DHD_BUS_BAR1_SWITCH_LOCK(bus, flags);
+
+       offset = dhdpcie_bus_chkandshift_bpoffset(bus, offset);
+
+       data = R_REG(bus->dhd->osh, (volatile uint8 *)(bus->tcm + offset));
+
+       DHD_BUS_BAR1_SWITCH_UNLOCK(bus, flags);
+       return data;
+}
+
+uint16
+dhdpcie_bus_rtcm16(dhd_bus_t *bus, ulong offset)
+{
+       volatile uint16 data;
+       ulong flags = 0;
+
+       if (bus->is_linkdown) {
+               DHD_LOG_MEM(("%s: PCIe link was down\n", __FUNCTION__));
+               data = (uint16)-1;
+               return data;
+       }
+
+       DHD_BUS_BAR1_SWITCH_LOCK(bus, flags);
+
+       offset = dhdpcie_bus_chkandshift_bpoffset(bus, offset);
+
+       data = R_REG(bus->dhd->osh, (volatile uint16 *)(bus->tcm + offset));
+
+       DHD_BUS_BAR1_SWITCH_UNLOCK(bus, flags);
+       return data;
+}
+
+uint32
+dhdpcie_bus_rtcm32(dhd_bus_t *bus, ulong offset)
+{
+       volatile uint32 data;
+       ulong flags = 0;
+
+       if (bus->is_linkdown) {
+               DHD_LOG_MEM(("%s: PCIe link was down\n", __FUNCTION__));
+               data = (uint32)-1;
+               return data;
+       }
+
+       DHD_BUS_BAR1_SWITCH_LOCK(bus, flags);
+
+       offset = dhdpcie_bus_chkandshift_bpoffset(bus, offset);
+
+       data = R_REG(bus->dhd->osh, (volatile uint32 *)(bus->tcm + offset));
+
+       DHD_BUS_BAR1_SWITCH_UNLOCK(bus, flags);
+       return data;
+}
+
+#ifdef DHD_SUPPORT_64BIT
+uint64
+dhdpcie_bus_rtcm64(dhd_bus_t *bus, ulong offset)
+{
+       volatile uint64 data;
+       ulong flags = 0;
+
+       if (bus->is_linkdown) {
+               DHD_LOG_MEM(("%s: PCIe link was down\n", __FUNCTION__));
+               data = (uint64)-1;
+               return data;
+       }
+
+       DHD_BUS_BAR1_SWITCH_LOCK(bus, flags);
+
+       offset = dhdpcie_bus_chkandshift_bpoffset(bus, offset);
+
+       data = R_REG(bus->dhd->osh, (volatile uint64 *)(bus->tcm + offset));
+
+       DHD_BUS_BAR1_SWITCH_UNLOCK(bus, flags);
+       return data;
+}
+#endif /* DHD_SUPPORT_64BIT */
+
+/** A snippet of dongle memory is shared between host and dongle */
+void
+dhd_bus_cmn_writeshared(dhd_bus_t *bus, void *data, uint32 len, uint8 type, uint16 ringid)
+{
+       uint64 long_data;
+       ulong addr; /* dongle address */
+
+       DHD_INFO(("%s: writing to dongle type %d len %d\n", __FUNCTION__, type, len));
+
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link was down\n", __FUNCTION__));
+               return;
+       }
+
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req(bus);
+       }
+       switch (type) {
+               case D2H_DMA_SCRATCH_BUF:
+                       addr = DHD_PCIE_SHARED_MEMBER_ADDR(bus, host_dma_scratch_buffer);
+                       long_data = HTOL64(*(uint64 *)data);
+                       dhdpcie_bus_membytes(bus, TRUE, addr, (uint8*) &long_data, len);
+                       if (dhd_msg_level & DHD_INFO_VAL) {
+                               prhex(__FUNCTION__, data, len);
+                       }
+                       break;
+
+               case D2H_DMA_SCRATCH_BUF_LEN :
+                       addr = DHD_PCIE_SHARED_MEMBER_ADDR(bus, host_dma_scratch_buffer_len);
+                       dhdpcie_bus_wtcm32(bus, addr, (uint32) HTOL32(*(uint32 *)data));
+                       if (dhd_msg_level & DHD_INFO_VAL) {
+                               prhex(__FUNCTION__, data, len);
+                       }
+                       break;
+
+               case H2D_DMA_INDX_WR_BUF:
+                       long_data = HTOL64(*(uint64 *)data);
+                       addr = DHD_RING_INFO_MEMBER_ADDR(bus, h2d_w_idx_hostaddr);
+                       dhdpcie_bus_membytes(bus, TRUE, addr, (uint8*) &long_data, len);
+                       if (dhd_msg_level & DHD_INFO_VAL) {
+                               prhex(__FUNCTION__, data, len);
+                       }
+                       break;
+
+               case H2D_DMA_INDX_RD_BUF:
+                       long_data = HTOL64(*(uint64 *)data);
+                       addr = DHD_RING_INFO_MEMBER_ADDR(bus, h2d_r_idx_hostaddr);
+                       dhdpcie_bus_membytes(bus, TRUE, addr, (uint8*) &long_data, len);
+                       if (dhd_msg_level & DHD_INFO_VAL) {
+                               prhex(__FUNCTION__, data, len);
+                       }
+                       break;
+
+               case D2H_DMA_INDX_WR_BUF:
+                       long_data = HTOL64(*(uint64 *)data);
+                       addr = DHD_RING_INFO_MEMBER_ADDR(bus, d2h_w_idx_hostaddr);
+                       dhdpcie_bus_membytes(bus, TRUE, addr, (uint8*) &long_data, len);
+                       if (dhd_msg_level & DHD_INFO_VAL) {
+                               prhex(__FUNCTION__, data, len);
+                       }
+                       break;
+
+               case D2H_DMA_INDX_RD_BUF:
+                       long_data = HTOL64(*(uint64 *)data);
+                       addr = DHD_RING_INFO_MEMBER_ADDR(bus, d2h_r_idx_hostaddr);
+                       dhdpcie_bus_membytes(bus, TRUE, addr, (uint8*) &long_data, len);
+                       if (dhd_msg_level & DHD_INFO_VAL) {
+                               prhex(__FUNCTION__, data, len);
+                       }
+                       break;
+
+               case H2D_IFRM_INDX_WR_BUF:
+                       long_data = HTOL64(*(uint64 *)data);
+                       addr = DHD_RING_INFO_MEMBER_ADDR(bus, ifrm_w_idx_hostaddr);
+                       dhdpcie_bus_membytes(bus, TRUE, addr, (uint8*) &long_data, len);
+                       if (dhd_msg_level & DHD_INFO_VAL) {
+                               prhex(__FUNCTION__, data, len);
+                       }
+                       break;
+
+               case RING_ITEM_LEN :
+                       addr = DHD_RING_MEM_MEMBER_ADDR(bus, ringid, len_items);
+                       dhdpcie_bus_wtcm16(bus, addr, (uint16) HTOL16(*(uint16 *)data));
+                       break;
+
+               case RING_MAX_ITEMS :
+                       addr = DHD_RING_MEM_MEMBER_ADDR(bus, ringid, max_item);
+                       dhdpcie_bus_wtcm16(bus, addr, (uint16) HTOL16(*(uint16 *)data));
+                       break;
+
+               case RING_BUF_ADDR :
+                       long_data = HTOL64(*(uint64 *)data);
+                       addr = DHD_RING_MEM_MEMBER_ADDR(bus, ringid, base_addr);
+                       dhdpcie_bus_membytes(bus, TRUE, addr, (uint8 *) &long_data, len);
+                       if (dhd_msg_level & DHD_INFO_VAL) {
+                               prhex(__FUNCTION__, data, len);
+                       }
+                       break;
+
+               case RING_WR_UPD :
+                       addr = bus->ring_sh[ringid].ring_state_w;
+                       dhdpcie_bus_wtcm16(bus, addr, (uint16) HTOL16(*(uint16 *)data));
+                       break;
+
+               case RING_RD_UPD :
+                       addr = bus->ring_sh[ringid].ring_state_r;
+                       dhdpcie_bus_wtcm16(bus, addr, (uint16) HTOL16(*(uint16 *)data));
+                       break;
+
+               case D2H_MB_DATA:
+                       addr = bus->d2h_mb_data_ptr_addr;
+                       dhdpcie_bus_wtcm32(bus, addr, (uint32) HTOL32(*(uint32 *)data));
+                       break;
+
+               case H2D_MB_DATA:
+                       addr = bus->h2d_mb_data_ptr_addr;
+                       dhdpcie_bus_wtcm32(bus, addr, (uint32) HTOL32(*(uint32 *)data));
+                       break;
+
+               case HOST_API_VERSION:
+                       addr = DHD_PCIE_SHARED_MEMBER_ADDR(bus, host_cap);
+                       dhdpcie_bus_wtcm32(bus, addr, (uint32) HTOL32(*(uint32 *)data));
+                       break;
+
+               case DNGL_TO_HOST_TRAP_ADDR:
+                       long_data = HTOL64(*(uint64 *)data);
+                       addr = DHD_PCIE_SHARED_MEMBER_ADDR(bus, host_trap_addr);
+                       dhdpcie_bus_membytes(bus, TRUE, addr, (uint8 *) &long_data, len);
+                       DHD_INFO(("Wrote trap addr:0x%x\n", (uint32) HTOL32(*(uint32 *)data)));
+                       break;
+
+               case HOST_SCB_ADDR:
+                       addr = DHD_PCIE_SHARED_MEMBER_ADDR(bus, host_scb_addr);
+#ifdef DHD_SUPPORT_64BIT
+                       dhdpcie_bus_wtcm64(bus, addr, (uint64) HTOL64(*(uint64 *)data));
+#else /* !DHD_SUPPORT_64BIT */
+                       dhdpcie_bus_wtcm32(bus, addr, *((uint32*)data));
+#endif /* DHD_SUPPORT_64BIT */
+                       DHD_INFO(("Wrote host_scb_addr:0x%x\n",
+                               (uint32) HTOL32(*(uint32 *)data)));
+                       break;
+
+               default:
+                       break;
+       }
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req_clear(bus);
+       }
+} /* dhd_bus_cmn_writeshared */
+
+/** A snippet of dongle memory is shared between host and dongle */
+void
+dhd_bus_cmn_readshared(dhd_bus_t *bus, void* data, uint8 type, uint16 ringid)
+{
+       ulong addr; /* dongle address */
+
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req(bus);
+       }
+       switch (type) {
+               case RING_WR_UPD :
+                       addr = bus->ring_sh[ringid].ring_state_w;
+                       *(uint16*)data = LTOH16(dhdpcie_bus_rtcm16(bus, addr));
+                       break;
+
+               case RING_RD_UPD :
+                       addr = bus->ring_sh[ringid].ring_state_r;
+                       *(uint16*)data = LTOH16(dhdpcie_bus_rtcm16(bus, addr));
+                       break;
+
+               case TOTAL_LFRAG_PACKET_CNT :
+                       addr = DHD_PCIE_SHARED_MEMBER_ADDR(bus, total_lfrag_pkt_cnt);
+                       *(uint16*)data = LTOH16(dhdpcie_bus_rtcm16(bus, addr));
+                       break;
+
+               case H2D_MB_DATA:
+                       addr = bus->h2d_mb_data_ptr_addr;
+                       *(uint32*)data = LTOH32(dhdpcie_bus_rtcm32(bus, addr));
+                       break;
+
+               case D2H_MB_DATA:
+                       addr = bus->d2h_mb_data_ptr_addr;
+                       *(uint32*)data = LTOH32(dhdpcie_bus_rtcm32(bus, addr));
+                       break;
+
+               case MAX_HOST_RXBUFS :
+                       addr = DHD_PCIE_SHARED_MEMBER_ADDR(bus, max_host_rxbufs);
+                       *(uint16*)data = LTOH16(dhdpcie_bus_rtcm16(bus, addr));
+                       break;
+
+               case HOST_SCB_ADDR:
+                       addr = DHD_PCIE_SHARED_MEMBER_ADDR(bus, host_scb_size);
+                       *(uint32*)data = LTOH32(dhdpcie_bus_rtcm32(bus, addr));
+                       break;
+
+               default :
+                       break;
+       }
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req_clear(bus);
+       }
+}
+
+uint32 dhd_bus_get_sharedflags(dhd_bus_t *bus)
+{
+       return ((pciedev_shared_t*)bus->pcie_sh)->flags;
+}
+
+void
+dhd_bus_clearcounts(dhd_pub_t *dhdp)
+{
+}
+
+/**
+ * @param params    input buffer, NULL for 'set' operation.
+ * @param plen      length of 'params' buffer, 0 for 'set' operation.
+ * @param arg       output buffer
+ */
+int
+dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
+                 void *params, uint plen, void *arg, uint len, bool set)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       const bcm_iovar_t *vi = NULL;
+       int bcmerror = BCME_UNSUPPORTED;
+       uint val_size;
+       uint32 actionid;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       ASSERT(name);
+       if (!name)
+               return BCME_BADARG;
+
+       /* Get MUST have return space */
+       ASSERT(set || (arg && len));
+       if (!(set || (arg && len)))
+               return BCME_BADARG;
+
+       /* Set does NOT take qualifiers */
+       ASSERT(!set || (!params && !plen));
+       if (!(!set || (!params && !plen)))
+               return BCME_BADARG;
+
+       DHD_INFO(("%s: %s %s, len %d plen %d\n", __FUNCTION__,
+                name, (set ? "set" : "get"), len, plen));
+
+       /* Look up var locally; if not found pass to host driver */
+       if ((vi = bcm_iovar_lookup(dhdpcie_iovars, name)) == NULL) {
+               goto exit;
+       }
+
+       if (MULTIBP_ENAB(bus->sih)) {
+               if (vi->flags & DHD_IOVF_PWRREQ_BYPASS) {
+                       DHD_ERROR(("%s: Bypass pwr request\n", __FUNCTION__));
+               } else {
+                       dhd_bus_pcie_pwr_req(bus);
+               }
+       }
+
+       /* set up 'params' pointer in case this is a set command so that
+        * the convenience int and bool code can be common to set and get
+        */
+       if (params == NULL) {
+               params = arg;
+               plen = len;
+       }
+
+       if (vi->type == IOVT_VOID)
+               val_size = 0;
+       else if (vi->type == IOVT_BUFFER)
+               val_size = len;
+       else
+               /* all other types are integer sized */
+               val_size = sizeof(int);
+
+       actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+       bcmerror = dhdpcie_bus_doiovar(bus, vi, actionid, name, params, plen, arg, len, val_size);
+
+exit:
+       /* In DEVRESET_QUIESCE/DEVRESET_ON,
+        * this includes dongle re-attach which initialize pwr_req_ref count to 0 and
+        * causes pwr_req_ref count miss-match in pwr req clear function and hang.
+        * In this case, bypass pwr req clear.
+        */
+       if (bcmerror == BCME_DNGL_DEVRESET) {
+               bcmerror = BCME_OK;
+       } else {
+               if (MULTIBP_ENAB(bus->sih)) {
+                       if (vi != NULL) {
+                               if (vi->flags & DHD_IOVF_PWRREQ_BYPASS) {
+                                       DHD_ERROR(("%s: Bypass pwr request clear\n", __FUNCTION__));
+                               } else {
+                                       dhd_bus_pcie_pwr_req_clear(bus);
+                               }
+                       }
+               }
+       }
+       return bcmerror;
+} /* dhd_bus_iovar_op */
+
+#ifdef BCM_BUZZZ
+#include <bcm_buzzz.h>
+
+int
+dhd_buzzz_dump_cntrs(char *p, uint32 *core, uint32 *log,
+       const int num_counters)
+{
+       int bytes = 0;
+       uint32 ctr;
+       uint32 curr[BCM_BUZZZ_COUNTERS_MAX], prev[BCM_BUZZZ_COUNTERS_MAX];
+       uint32 delta[BCM_BUZZZ_COUNTERS_MAX];
+
+       /* Compute elapsed counter values per counter event type */
+       for (ctr = 0U; ctr < num_counters; ctr++) {
+               prev[ctr] = core[ctr];
+               curr[ctr] = *log++;
+               core[ctr] = curr[ctr];  /* saved for next log */
+
+               if (curr[ctr] < prev[ctr])
+                       delta[ctr] = curr[ctr] + (~0U - prev[ctr]);
+               else
+                       delta[ctr] = (curr[ctr] - prev[ctr]);
+
+               bytes += sprintf(p + bytes, "%12u ", delta[ctr]);
+       }
+
+       return bytes;
+}
+
+typedef union cm3_cnts { /* export this in bcm_buzzz.h */
+       uint32 u32;
+       uint8  u8[4];
+       struct {
+               uint8 cpicnt;
+               uint8 exccnt;
+               uint8 sleepcnt;
+               uint8 lsucnt;
+       };
+} cm3_cnts_t;
+
+int
+dhd_bcm_buzzz_dump_cntrs6(char *p, uint32 *core, uint32 *log)
+{
+       int bytes = 0;
+
+       uint32 cyccnt, instrcnt;
+       cm3_cnts_t cm3_cnts;
+       uint8 foldcnt;
+
+       {   /* 32bit cyccnt */
+               uint32 curr, prev, delta;
+               prev = core[0]; curr = *log++; core[0] = curr;
+               if (curr < prev)
+                       delta = curr + (~0U - prev);
+               else
+                       delta = (curr - prev);
+
+               bytes += sprintf(p + bytes, "%12u ", delta);
+               cyccnt = delta;
+       }
+
+       {       /* Extract the 4 cnts: cpi, exc, sleep and lsu */
+               int i;
+               uint8 max8 = ~0;
+               cm3_cnts_t curr, prev, delta;
+               prev.u32 = core[1]; curr.u32 = * log++; core[1] = curr.u32;
+               for (i = 0; i < 4; i++) {
+                       if (curr.u8[i] < prev.u8[i])
+                               delta.u8[i] = curr.u8[i] + (max8 - prev.u8[i]);
+                       else
+                               delta.u8[i] = (curr.u8[i] - prev.u8[i]);
+                       bytes += sprintf(p + bytes, "%4u ", delta.u8[i]);
+               }
+               cm3_cnts.u32 = delta.u32;
+       }
+
+       {   /* Extract the foldcnt from arg0 */
+               uint8 curr, prev, delta, max8 = ~0;
+               bcm_buzzz_arg0_t arg0; arg0.u32 = *log;
+               prev = core[2]; curr = arg0.klog.cnt; core[2] = curr;
+               if (curr < prev)
+                       delta = curr + (max8 - prev);
+               else
+                       delta = (curr - prev);
+               bytes += sprintf(p + bytes, "%4u ", delta);
+               foldcnt = delta;
+       }
+
+       instrcnt = cyccnt - (cm3_cnts.u8[0] + cm3_cnts.u8[1] + cm3_cnts.u8[2]
+                                + cm3_cnts.u8[3]) + foldcnt;
+       if (instrcnt > 0xFFFFFF00)
+               bytes += sprintf(p + bytes, "[%10s] ", "~");
+       else
+               bytes += sprintf(p + bytes, "[%10u] ", instrcnt);
+       return bytes;
+}
+
+int
+dhd_buzzz_dump_log(char *p, uint32 *core, uint32 *log, bcm_buzzz_t *buzzz)
+{
+       int bytes = 0;
+       bcm_buzzz_arg0_t arg0;
+       static uint8 * fmt[] = BCM_BUZZZ_FMT_STRINGS;
+
+       if (buzzz->counters == 6) {
+               bytes += dhd_bcm_buzzz_dump_cntrs6(p, core, log);
+               log += 2; /* 32bit cyccnt + (4 x 8bit) CM3 */
+       } else {
+               bytes += dhd_buzzz_dump_cntrs(p, core, log, buzzz->counters);
+               log += buzzz->counters; /* (N x 32bit) CR4=3, CA7=4 */
+       }
+
+       /* Dump the logged arguments using the registered formats */
+       arg0.u32 = *log++;
+
+       switch (arg0.klog.args) {
+               case 0:
+                       bytes += sprintf(p + bytes, fmt[arg0.klog.id]);
+                       break;
+               case 1:
+               {
+                       uint32 arg1 = *log++;
+                       bytes += sprintf(p + bytes, fmt[arg0.klog.id], arg1);
+                       break;
+               }
+               case 2:
+               {
+                       uint32 arg1, arg2;
+                       arg1 = *log++; arg2 = *log++;
+                       bytes += sprintf(p + bytes, fmt[arg0.klog.id], arg1, arg2);
+                       break;
+               }
+               case 3:
+               {
+                       uint32 arg1, arg2, arg3;
+                       arg1 = *log++; arg2 = *log++; arg3 = *log++;
+                       bytes += sprintf(p + bytes, fmt[arg0.klog.id], arg1, arg2, arg3);
+                       break;
+               }
+               case 4:
+               {
+                       uint32 arg1, arg2, arg3, arg4;
+                       arg1 = *log++; arg2 = *log++;
+                       arg3 = *log++; arg4 = *log++;
+                       bytes += sprintf(p + bytes, fmt[arg0.klog.id], arg1, arg2, arg3, arg4);
+                       break;
+               }
+               default:
+                       printf("%s: Maximum one argument supported\n", __FUNCTION__);
+                       break;
+       }
+
+       bytes += sprintf(p + bytes, "\n");
+
+       return bytes;
+}
+
+void dhd_buzzz_dump(bcm_buzzz_t *buzzz_p, void *buffer_p, char *p)
+{
+       int i;
+       uint32 total, part1, part2, log_sz, core[BCM_BUZZZ_COUNTERS_MAX];
+       void * log;
+
+       for (i = 0; i < BCM_BUZZZ_COUNTERS_MAX; i++) {
+               core[i] = 0;
+       }
+
+       log_sz = buzzz_p->log_sz;
+
+       part1 = ((uint32)buzzz_p->cur - (uint32)buzzz_p->log) / log_sz;
+
+       if (buzzz_p->wrap == TRUE) {
+               part2 = ((uint32)buzzz_p->end - (uint32)buzzz_p->cur) / log_sz;
+               total = (buzzz_p->buffer_sz - BCM_BUZZZ_LOGENTRY_MAXSZ) / log_sz;
+       } else {
+               part2 = 0U;
+               total = buzzz_p->count;
+       }
+
+       if (total == 0U) {
+               printf("%s: bcm_buzzz_dump total<%u> done\n", __FUNCTION__, total);
+               return;
+       } else {
+               printf("%s: bcm_buzzz_dump total<%u> : part2<%u> + part1<%u>\n", __FUNCTION__,
+                      total, part2, part1);
+       }
+
+       if (part2) {   /* with wrap */
+               log = (void*)((size_t)buffer_p + (buzzz_p->cur - buzzz_p->log));
+               while (part2--) {   /* from cur to end : part2 */
+                       p[0] = '\0';
+                       dhd_buzzz_dump_log(p, core, (uint32 *)log, buzzz_p);
+                       printf("%s", p);
+                       log = (void*)((size_t)log + buzzz_p->log_sz);
+               }
+       }
+
+       log = (void*)buffer_p;
+       while (part1--) {
+               p[0] = '\0';
+               dhd_buzzz_dump_log(p, core, (uint32 *)log, buzzz_p);
+               printf("%s", p);
+               log = (void*)((size_t)log + buzzz_p->log_sz);
+       }
+
+       printf("%s: bcm_buzzz_dump done.\n", __FUNCTION__);
+}
+
+int dhd_buzzz_dump_dngl(dhd_bus_t *bus)
+{
+       bcm_buzzz_t * buzzz_p = NULL;
+       void * buffer_p = NULL;
+       char * page_p = NULL;
+       pciedev_shared_t *sh;
+       int ret = 0;
+
+       if (bus->dhd->busstate != DHD_BUS_DATA) {
+               return BCME_UNSUPPORTED;
+       }
+       if ((page_p = (char *)MALLOC(bus->dhd->osh, 4096)) == NULL) {
+               printf("%s: Page memory allocation failure\n", __FUNCTION__);
+               goto done;
+       }
+       if ((buzzz_p = MALLOC(bus->dhd->osh, sizeof(bcm_buzzz_t))) == NULL) {
+               printf("%s: BCM BUZZZ memory allocation failure\n", __FUNCTION__);
+               goto done;
+       }
+
+       ret = dhdpcie_readshared(bus);
+       if (ret < 0) {
+               DHD_ERROR(("%s :Shared area read failed \n", __FUNCTION__));
+               goto done;
+       }
+
+       sh = bus->pcie_sh;
+
+       DHD_INFO(("%s buzzz:%08x\n", __FUNCTION__, sh->buzz_dbg_ptr));
+
+       if (sh->buzz_dbg_ptr != 0U) {   /* Fetch and display dongle BUZZZ Trace */
+
+               dhdpcie_bus_membytes(bus, FALSE, (ulong)sh->buzz_dbg_ptr,
+                                    (uint8 *)buzzz_p, sizeof(bcm_buzzz_t));
+
+               printf("BUZZZ[0x%08x]: log<0x%08x> cur<0x%08x> end<0x%08x> "
+                       "count<%u> status<%u> wrap<%u>\n"
+                       "cpu<0x%02X> counters<%u> group<%u> buffer_sz<%u> log_sz<%u>\n",
+                       (int)sh->buzz_dbg_ptr,
+                       (int)buzzz_p->log, (int)buzzz_p->cur, (int)buzzz_p->end,
+                       buzzz_p->count, buzzz_p->status, buzzz_p->wrap,
+                       buzzz_p->cpu_idcode, buzzz_p->counters, buzzz_p->group,
+                       buzzz_p->buffer_sz, buzzz_p->log_sz);
+
+               if (buzzz_p->count == 0) {
+                       printf("%s: Empty dongle BUZZZ trace\n\n", __FUNCTION__);
+                       goto done;
+               }
+
+               /* Allocate memory for trace buffer and format strings */
+               buffer_p = MALLOC(bus->dhd->osh, buzzz_p->buffer_sz);
+               if (buffer_p == NULL) {
+                       printf("%s: Buffer memory allocation failure\n", __FUNCTION__);
+                       goto done;
+               }
+
+               /* Fetch the trace. format strings are exported via bcm_buzzz.h */
+               dhdpcie_bus_membytes(bus, FALSE, (uint32)buzzz_p->log,   /* Trace */
+                                    (uint8 *)buffer_p, buzzz_p->buffer_sz);
+
+               /* Process and display the trace using formatted output */
+
+               {
+                       int ctr;
+                       for (ctr = 0; ctr < buzzz_p->counters; ctr++) {
+                               printf("<Evt[%02X]> ", buzzz_p->eventid[ctr]);
+                       }
+                       printf("<code execution point>\n");
+               }
+
+               dhd_buzzz_dump(buzzz_p, buffer_p, page_p);
+
+               printf("%s: ----- End of dongle BCM BUZZZ Trace -----\n\n", __FUNCTION__);
+
+               MFREE(bus->dhd->osh, buffer_p, buzzz_p->buffer_sz); buffer_p = NULL;
+       }
+
+done:
+
+       if (page_p)   MFREE(bus->dhd->osh, page_p, 4096);
+       if (buzzz_p)  MFREE(bus->dhd->osh, buzzz_p, sizeof(bcm_buzzz_t));
+       if (buffer_p) MFREE(bus->dhd->osh, buffer_p, buzzz_p->buffer_sz);
+
+       return BCME_OK;
+}
+#endif /* BCM_BUZZZ */
+
+#define PCIE_GEN2(sih) ((BUSTYPE((sih)->bustype) == PCI_BUS) &&        \
+       ((sih)->buscoretype == PCIE2_CORE_ID))
+
+static void
+dhdpcie_enum_reg_init(dhd_bus_t *bus)
+{
+       /* initialize Function control register (clear bit 4) to HW init value */
+       si_corereg(bus->sih, bus->sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, ftn_ctrl.control), ~0,
+               PCIE_CPLCA_ENABLE | PCIE_DLY_PERST_TO_COE);
+
+       /* clear IntMask */
+       si_corereg(bus->sih, bus->sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, ftn_ctrl.intmask), ~0, 0);
+       /* clear IntStatus */
+       si_corereg(bus->sih, bus->sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, ftn_ctrl.intstatus), ~0,
+               si_corereg(bus->sih, bus->sih->buscoreidx,
+                       OFFSETOF(sbpcieregs_t, ftn_ctrl.intstatus), 0, 0));
+
+       /* clear MSIVector */
+       si_corereg(bus->sih, bus->sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, ftn_ctrl.msi_vector), ~0, 0);
+       /* clear MSIIntMask */
+       si_corereg(bus->sih, bus->sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, ftn_ctrl.msi_intmask), ~0, 0);
+       /* clear MSIIntStatus */
+       si_corereg(bus->sih, bus->sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, ftn_ctrl.msi_intstatus), ~0,
+               si_corereg(bus->sih, bus->sih->buscoreidx,
+                       OFFSETOF(sbpcieregs_t, ftn_ctrl.msi_intstatus), 0, 0));
+
+       /* clear PowerIntMask */
+       si_corereg(bus->sih, bus->sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, ftn_ctrl.pwr_intmask), ~0, 0);
+       /* clear PowerIntStatus */
+       si_corereg(bus->sih, bus->sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, ftn_ctrl.pwr_intstatus), ~0,
+               si_corereg(bus->sih, bus->sih->buscoreidx,
+                       OFFSETOF(sbpcieregs_t, ftn_ctrl.pwr_intstatus), 0, 0));
+
+       /* clear MailboxIntMask */
+       si_corereg(bus->sih, bus->sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, ftn_ctrl.mbox_intmask), ~0, 0);
+       /* clear MailboxInt */
+       si_corereg(bus->sih, bus->sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, ftn_ctrl.mbox_intstatus), ~0,
+               si_corereg(bus->sih, bus->sih->buscoreidx,
+                       OFFSETOF(sbpcieregs_t, ftn_ctrl.mbox_intstatus), 0, 0));
+}
+
+int
+dhd_bus_perform_flr(dhd_bus_t *bus, bool force_fail)
+{
+       uint flr_capab;
+       uint val;
+       int retry = 0;
+
+       DHD_ERROR(("******** Perform FLR ********\n"));
+
+       /* Kernel Panic for 4378Ax during traptest/devreset4 reload case:
+        * For 4378Ax, enum registers will not be reset with FLR (producer index WAR).
+        * So, the MailboxIntMask is left as 0xffff during fw boot-up,
+        * and the fw trap handling during fw boot causes Kernel Panic.
+        * Jira: SWWLAN-212578: [4378A0 PCIe DVT] :
+        *       Kernel Panic seen in F0 FLR with BT Idle/Traffic/DMA
+        */
+       if (bus->sih && PCIE_ENUM_RESET_WAR_ENAB(bus->sih->buscorerev)) {
+               if (bus->pcie_mailbox_mask != 0) {
+                       dhdpcie_bus_intr_disable(bus);
+               }
+               /* initialize F0 enum registers before FLR for rev66/67 */
+               dhdpcie_enum_reg_init(bus);
+       }
+
+       /* Read PCIE_CFG_DEVICE_CAPABILITY bit 28 to check FLR capability */
+       val = OSL_PCI_READ_CONFIG(bus->osh, PCIE_CFG_DEVICE_CAPABILITY, sizeof(val));
+       flr_capab =  val & (1 << PCIE_FLR_CAPAB_BIT);
+       DHD_INFO(("Read Device Capability: reg=0x%x read val=0x%x flr_capab=0x%x\n",
+               PCIE_CFG_DEVICE_CAPABILITY, val, flr_capab));
+       if (!flr_capab) {
+              DHD_ERROR(("Chip does not support FLR\n"));
+              return BCME_UNSUPPORTED;
+       }
+
+       /* Save pcie config space */
+       DHD_INFO(("Save Pcie Config Space\n"));
+       DHD_PCIE_CONFIG_SAVE(bus);
+
+       /* Set bit 15 of PCIE_CFG_DEVICE_CONTROL */
+       DHD_INFO(("Set PCIE_FUNCTION_LEVEL_RESET_BIT(%d) of PCIE_CFG_DEVICE_CONTROL(0x%x)\n",
+               PCIE_FUNCTION_LEVEL_RESET_BIT, PCIE_CFG_DEVICE_CONTROL));
+       val = OSL_PCI_READ_CONFIG(bus->osh, PCIE_CFG_DEVICE_CONTROL, sizeof(val));
+       DHD_INFO(("read_config: reg=0x%x read val=0x%x\n", PCIE_CFG_DEVICE_CONTROL, val));
+       val = val | (1 << PCIE_FUNCTION_LEVEL_RESET_BIT);
+       DHD_INFO(("write_config: reg=0x%x write val=0x%x\n", PCIE_CFG_DEVICE_CONTROL, val));
+       OSL_PCI_WRITE_CONFIG(bus->osh, PCIE_CFG_DEVICE_CONTROL, sizeof(val), val);
+
+       /* wait for DHD_FUNCTION_LEVEL_RESET_DELAY msec */
+       DHD_INFO(("Delay of %d msec\n", DHD_FUNCTION_LEVEL_RESET_DELAY));
+
+       CAN_SLEEP() ? OSL_SLEEP(DHD_FUNCTION_LEVEL_RESET_DELAY) :
+               OSL_DELAY(DHD_FUNCTION_LEVEL_RESET_DELAY * USEC_PER_MSEC);
+
+       if (force_fail) {
+               DHD_ERROR(("Set PCIE_SSRESET_DISABLE_BIT(%d) of PCIE_CFG_SUBSYSTEM_CONTROL(0x%x)\n",
+                       PCIE_SSRESET_DISABLE_BIT, PCIE_CFG_SUBSYSTEM_CONTROL));
+               val = OSL_PCI_READ_CONFIG(bus->osh, PCIE_CFG_SUBSYSTEM_CONTROL, sizeof(val));
+               DHD_ERROR(("read_config: reg=0x%x read val=0x%x\n", PCIE_CFG_SUBSYSTEM_CONTROL,
+                       val));
+               val = val | (1 << PCIE_SSRESET_DISABLE_BIT);
+               DHD_ERROR(("write_config: reg=0x%x write val=0x%x\n", PCIE_CFG_SUBSYSTEM_CONTROL,
+                       val));
+               OSL_PCI_WRITE_CONFIG(bus->osh, PCIE_CFG_SUBSYSTEM_CONTROL, sizeof(val), val);
+
+               val = OSL_PCI_READ_CONFIG(bus->osh, PCIE_CFG_SUBSYSTEM_CONTROL, sizeof(val));
+               DHD_ERROR(("read_config: reg=0x%x read val=0x%x\n", PCIE_CFG_SUBSYSTEM_CONTROL,
+                       val));
+       }
+
+       /* Clear bit 15 of PCIE_CFG_DEVICE_CONTROL */
+       DHD_INFO(("Clear PCIE_FUNCTION_LEVEL_RESET_BIT(%d) of PCIE_CFG_DEVICE_CONTROL(0x%x)\n",
+               PCIE_FUNCTION_LEVEL_RESET_BIT, PCIE_CFG_DEVICE_CONTROL));
+       val = OSL_PCI_READ_CONFIG(bus->osh, PCIE_CFG_DEVICE_CONTROL, sizeof(val));
+       DHD_INFO(("read_config: reg=0x%x read val=0x%x\n", PCIE_CFG_DEVICE_CONTROL, val));
+       val = val & ~(1 << PCIE_FUNCTION_LEVEL_RESET_BIT);
+       DHD_INFO(("write_config: reg=0x%x write val=0x%x\n", PCIE_CFG_DEVICE_CONTROL, val));
+       OSL_PCI_WRITE_CONFIG(bus->osh, PCIE_CFG_DEVICE_CONTROL, sizeof(val), val);
+
+       /* Wait till bit 13 of PCIE_CFG_SUBSYSTEM_CONTROL is cleared */
+       DHD_INFO(("Wait till PCIE_SSRESET_STATUS_BIT(%d) of PCIE_CFG_SUBSYSTEM_CONTROL(0x%x)"
+               "is cleared\n", PCIE_SSRESET_STATUS_BIT, PCIE_CFG_SUBSYSTEM_CONTROL));
+       do {
+               val = OSL_PCI_READ_CONFIG(bus->osh, PCIE_CFG_SUBSYSTEM_CONTROL, sizeof(val));
+               DHD_ERROR(("read_config: reg=0x%x read val=0x%x\n",
+                       PCIE_CFG_SUBSYSTEM_CONTROL, val));
+               val = val & (1 << PCIE_SSRESET_STATUS_BIT);
+               OSL_DELAY(DHD_SSRESET_STATUS_RETRY_DELAY);
+       } while (val && (retry++ < DHD_SSRESET_STATUS_RETRIES));
+
+       if (val) {
+               DHD_ERROR(("ERROR: reg=0x%x bit %d is not cleared\n",
+                       PCIE_CFG_SUBSYSTEM_CONTROL, PCIE_SSRESET_STATUS_BIT));
+               /* User has to fire the IOVAR again, if force_fail is needed */
+               if (force_fail) {
+                       bus->flr_force_fail = FALSE;
+                       DHD_ERROR(("%s cleared flr_force_fail flag\n", __FUNCTION__));
+               }
+               return BCME_DONGLE_DOWN;
+       }
+
+       /* Restore pcie config space */
+       DHD_INFO(("Restore Pcie Config Space\n"));
+       DHD_PCIE_CONFIG_RESTORE(bus);
+
+       DHD_ERROR(("******** FLR Succedeed ********\n"));
+
+       return BCME_OK;
+}
+
+#define DHD_BP_RESET_ASPM_DISABLE_DELAY                500u    /* usec */
+
+#define DHD_BP_RESET_STATUS_RETRY_DELAY                40u     /* usec */
+#define DHD_BP_RESET_STATUS_RETRIES            50u
+
+#define PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_BIT                10
+#define PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_STATUS_BIT 12
+
+int
+dhd_bus_cfg_ss_ctrl_bp_reset(struct dhd_bus *bus)
+{
+       uint val;
+       int retry = 0;
+       int ret = BCME_OK;
+       bool reset_stat_bit;
+
+       DHD_ERROR(("******** Perform BP reset ********\n"));
+
+       /* Disable ASPM */
+       DHD_ERROR(("Disable ASPM: Clear bits(1-0) of PCIECFGREG_LINK_STATUS_CTRL(0x%x)\n",
+               PCIECFGREG_LINK_STATUS_CTRL));
+       val = OSL_PCI_READ_CONFIG(bus->osh, PCIECFGREG_LINK_STATUS_CTRL, sizeof(val));
+       DHD_ERROR(("read_config: reg=0x%x read val=0x%x\n", PCIECFGREG_LINK_STATUS_CTRL, val));
+       val = val & (~PCIE_ASPM_ENAB);
+       DHD_ERROR(("write_config: reg=0x%x write val=0x%x\n", PCIECFGREG_LINK_STATUS_CTRL, val));
+       OSL_PCI_WRITE_CONFIG(bus->osh, PCIECFGREG_LINK_STATUS_CTRL, sizeof(val), val);
+
+       /* wait for delay usec */
+       DHD_ERROR(("Delay of %d usec\n", DHD_BP_RESET_ASPM_DISABLE_DELAY));
+       OSL_DELAY(DHD_BP_RESET_ASPM_DISABLE_DELAY);
+
+       /* Set bp reset bit 10 of PCIE_CFG_SUBSYSTEM_CONTROL */
+       DHD_ERROR(("Set PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_BIT(%d)"
+               " of PCIE_CFG_SUBSYSTEM_CONTROL(0x%x)\n",
+               PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_BIT, PCIE_CFG_SUBSYSTEM_CONTROL));
+       val = OSL_PCI_READ_CONFIG(bus->osh, PCIE_CFG_SUBSYSTEM_CONTROL, sizeof(val));
+       DHD_ERROR(("read_config: reg=0x%x read val=0x%x\n", PCIE_CFG_SUBSYSTEM_CONTROL, val));
+       val = val | (1 << PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_BIT);
+       DHD_ERROR(("write_config: reg=0x%x write val=0x%x\n", PCIE_CFG_SUBSYSTEM_CONTROL, val));
+       OSL_PCI_WRITE_CONFIG(bus->osh, PCIE_CFG_SUBSYSTEM_CONTROL, sizeof(val), val);
+
+       /* Wait till bp reset status bit 12 of PCIE_CFG_SUBSYSTEM_CONTROL is set */
+       DHD_ERROR(("Wait till PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_STATUS_BIT(%d) of "
+               "PCIE_CFG_SUBSYSTEM_CONTROL(0x%x) is set\n",
+               PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_STATUS_BIT, PCIE_CFG_SUBSYSTEM_CONTROL));
+       do {
+               val = OSL_PCI_READ_CONFIG(bus->osh, PCIE_CFG_SUBSYSTEM_CONTROL, sizeof(val));
+               DHD_ERROR(("read_config: reg=0x%x read val=0x%x\n",
+                       PCIE_CFG_SUBSYSTEM_CONTROL, val));
+               reset_stat_bit = val & (1 << PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_STATUS_BIT);
+               OSL_DELAY(DHD_BP_RESET_STATUS_RETRY_DELAY);
+       } while (!reset_stat_bit && (retry++ < DHD_BP_RESET_STATUS_RETRIES));
+
+       if (!reset_stat_bit) {
+               DHD_ERROR(("ERROR: reg=0x%x bit %d is not set\n",
+                       PCIE_CFG_SUBSYSTEM_CONTROL,
+                       PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_STATUS_BIT));
+               ret = BCME_ERROR;
+               goto aspm_enab;
+       }
+
+       /* Clear bp reset bit 10 of PCIE_CFG_SUBSYSTEM_CONTROL */
+       DHD_ERROR(("Clear PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_BIT(%d)"
+               " of PCIECFGREG_SPROM_CTRL(0x%x)\n",
+               PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_BIT, PCIE_CFG_SUBSYSTEM_CONTROL));
+       val = OSL_PCI_READ_CONFIG(bus->osh, PCIE_CFG_SUBSYSTEM_CONTROL, sizeof(val));
+       DHD_ERROR(("read_config: reg=0x%x read val=0x%x\n", PCIE_CFG_SUBSYSTEM_CONTROL, val));
+       val = val & ~(1 << PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_BIT);
+       DHD_ERROR(("write_config: reg=0x%x write val=0x%x\n", PCIE_CFG_SUBSYSTEM_CONTROL, val));
+       OSL_PCI_WRITE_CONFIG(bus->osh, PCIE_CFG_SUBSYSTEM_CONTROL, sizeof(val), val);
+
+       /* Wait till bp reset status bit 12 of PCIE_CFG_SUBSYSTEM_CONTROL is cleared */
+       DHD_ERROR(("Wait till PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_STATUS_BIT(%d) of "
+               "PCIE_CFG_SUBSYSTEM_CONTROL(0x%x) is cleared\n",
+               PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_STATUS_BIT, PCIE_CFG_SUBSYSTEM_CONTROL));
+       do {
+               val = OSL_PCI_READ_CONFIG(bus->osh, PCIE_CFG_SUBSYSTEM_CONTROL, sizeof(val));
+               DHD_ERROR(("read_config: reg=0x%x read val=0x%x\n",
+                       PCIE_CFG_SUBSYSTEM_CONTROL, val));
+               reset_stat_bit = val & (1 << PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_STATUS_BIT);
+               OSL_DELAY(DHD_BP_RESET_STATUS_RETRY_DELAY);
+       } while (reset_stat_bit && (retry++ < DHD_BP_RESET_STATUS_RETRIES));
+
+       if (reset_stat_bit) {
+               DHD_ERROR(("ERROR: reg=0x%x bit %d is not cleared\n",
+                       PCIE_CFG_SUBSYSTEM_CONTROL,
+                       PCIE_CFG_SUBSYSTEM_CONTROL_BP_RESET_STATUS_BIT));
+               ret = BCME_ERROR;
+       }
+
+aspm_enab:
+       /* Enable ASPM */
+       DHD_ERROR(("Enable ASPM: set bit 1 of PCIECFGREG_LINK_STATUS_CTRL(0x%x)\n",
+               PCIECFGREG_LINK_STATUS_CTRL));
+       val = OSL_PCI_READ_CONFIG(bus->osh, PCIECFGREG_LINK_STATUS_CTRL, sizeof(val));
+       DHD_ERROR(("read_config: reg=0x%x read val=0x%x\n", PCIECFGREG_LINK_STATUS_CTRL, val));
+       val = val | (PCIE_ASPM_L1_ENAB);
+       DHD_ERROR(("write_config: reg=0x%x write val=0x%x\n", PCIECFGREG_LINK_STATUS_CTRL, val));
+       OSL_PCI_WRITE_CONFIG(bus->osh, PCIECFGREG_LINK_STATUS_CTRL, sizeof(val), val);
+
+       if (ret) {
+               DHD_ERROR(("******** BP reset Failed ********\n"));
+       } else {
+               DHD_ERROR(("******** BP reset Succedeed ********\n"));
+       }
+
+       return ret;
+}
+
+#define PCIE_CFG_SPROM_CTRL_SB_RESET_BIT       10
+#define PCIE_CFG_CLOCK_CTRL_STATUS_BP_RESET_BIT        21
+
+int
+dhd_bus_cfg_sprom_ctrl_bp_reset(struct dhd_bus *bus)
+{
+       uint val;
+       int retry = 0;
+       uint dar_clk_ctrl_status_reg = DAR_CLK_CTRL(bus->sih->buscorerev);
+       int ret = BCME_OK;
+       bool cond;
+
+       DHD_ERROR(("******** Perform BP reset ********\n"));
+
+       /* Disable ASPM */
+       DHD_INFO(("Disable ASPM: Clear bits(1-0) of PCIECFGREG_LINK_STATUS_CTRL(0x%x)\n",
+               PCIECFGREG_LINK_STATUS_CTRL));
+       val = OSL_PCI_READ_CONFIG(bus->osh, PCIECFGREG_LINK_STATUS_CTRL, sizeof(val));
+       DHD_INFO(("read_config: reg=0x%x read val=0x%x\n", PCIECFGREG_LINK_STATUS_CTRL, val));
+       val = val & (~PCIE_ASPM_ENAB);
+       DHD_INFO(("write_config: reg=0x%x write val=0x%x\n", PCIECFGREG_LINK_STATUS_CTRL, val));
+       OSL_PCI_WRITE_CONFIG(bus->osh, PCIECFGREG_LINK_STATUS_CTRL, sizeof(val), val);
+
+       /* wait for delay usec */
+       DHD_INFO(("Delay of %d usec\n", DHD_BP_RESET_ASPM_DISABLE_DELAY));
+       OSL_DELAY(DHD_BP_RESET_ASPM_DISABLE_DELAY);
+
+       /* Set bit 10 of PCIECFGREG_SPROM_CTRL */
+       DHD_INFO(("Set PCIE_CFG_SPROM_CTRL_SB_RESET_BIT(%d) of PCIECFGREG_SPROM_CTRL(0x%x)\n",
+               PCIE_CFG_SPROM_CTRL_SB_RESET_BIT, PCIECFGREG_SPROM_CTRL));
+       val = OSL_PCI_READ_CONFIG(bus->osh, PCIECFGREG_SPROM_CTRL, sizeof(val));
+       DHD_INFO(("read_config: reg=0x%x read val=0x%x\n", PCIECFGREG_SPROM_CTRL, val));
+       val = val | (1 << PCIE_CFG_SPROM_CTRL_SB_RESET_BIT);
+       DHD_INFO(("write_config: reg=0x%x write val=0x%x\n", PCIECFGREG_SPROM_CTRL, val));
+       OSL_PCI_WRITE_CONFIG(bus->osh, PCIECFGREG_SPROM_CTRL, sizeof(val), val);
+
+       /* Wait till bit backplane reset is ASSERTED i,e
+        * bit 10 of PCIECFGREG_SPROM_CTRL is cleared.
+        * Only after this, poll for 21st bit of DAR reg 0xAE0 is valid
+        * else DAR register will read previous old value
+        */
+       DHD_INFO(("Wait till PCIE_CFG_SPROM_CTRL_SB_RESET_BIT(%d) of "
+               "PCIECFGREG_SPROM_CTRL(0x%x) is cleared\n",
+               PCIE_CFG_SPROM_CTRL_SB_RESET_BIT, PCIECFGREG_SPROM_CTRL));
+       do {
+               val = OSL_PCI_READ_CONFIG(bus->osh, PCIECFGREG_SPROM_CTRL, sizeof(val));
+               DHD_INFO(("read_config: reg=0x%x read val=0x%x\n", PCIECFGREG_SPROM_CTRL, val));
+               cond = val & (1 << PCIE_CFG_SPROM_CTRL_SB_RESET_BIT);
+               OSL_DELAY(DHD_BP_RESET_STATUS_RETRY_DELAY);
+       } while (cond && (retry++ < DHD_BP_RESET_STATUS_RETRIES));
+
+       if (cond) {
+               DHD_ERROR(("ERROR: reg=0x%x bit %d is not cleared\n",
+                       PCIECFGREG_SPROM_CTRL, PCIE_CFG_SPROM_CTRL_SB_RESET_BIT));
+               ret = BCME_ERROR;
+               goto aspm_enab;
+       }
+
+       /* Wait till bit 21 of dar_clk_ctrl_status_reg is cleared */
+       DHD_INFO(("Wait till PCIE_CFG_CLOCK_CTRL_STATUS_BP_RESET_BIT(%d) of "
+               "dar_clk_ctrl_status_reg(0x%x) is cleared\n",
+               PCIE_CFG_CLOCK_CTRL_STATUS_BP_RESET_BIT, dar_clk_ctrl_status_reg));
+       do {
+               val = si_corereg(bus->sih, bus->sih->buscoreidx,
+                       dar_clk_ctrl_status_reg, 0, 0);
+               DHD_INFO(("read_dar si_corereg: reg=0x%x read val=0x%x\n",
+                       dar_clk_ctrl_status_reg, val));
+               cond = val & (1 << PCIE_CFG_CLOCK_CTRL_STATUS_BP_RESET_BIT);
+               OSL_DELAY(DHD_BP_RESET_STATUS_RETRY_DELAY);
+       } while (cond && (retry++ < DHD_BP_RESET_STATUS_RETRIES));
+
+       if (cond) {
+               DHD_ERROR(("ERROR: reg=0x%x bit %d is not cleared\n",
+                       dar_clk_ctrl_status_reg, PCIE_CFG_CLOCK_CTRL_STATUS_BP_RESET_BIT));
+               ret = BCME_ERROR;
+       }
+
+aspm_enab:
+       /* Enable ASPM */
+       DHD_INFO(("Enable ASPM: set bit 1 of PCIECFGREG_LINK_STATUS_CTRL(0x%x)\n",
+               PCIECFGREG_LINK_STATUS_CTRL));
+       val = OSL_PCI_READ_CONFIG(bus->osh, PCIECFGREG_LINK_STATUS_CTRL, sizeof(val));
+       DHD_INFO(("read_config: reg=0x%x read val=0x%x\n", PCIECFGREG_LINK_STATUS_CTRL, val));
+       val = val | (PCIE_ASPM_L1_ENAB);
+       DHD_INFO(("write_config: reg=0x%x write val=0x%x\n", PCIECFGREG_LINK_STATUS_CTRL, val));
+       OSL_PCI_WRITE_CONFIG(bus->osh, PCIECFGREG_LINK_STATUS_CTRL, sizeof(val), val);
+
+       DHD_ERROR(("******** BP reset Succedeed ********\n"));
+
+       return ret;
+}
+
+int
+dhd_bus_devreset(dhd_pub_t *dhdp, uint8 flag)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       int bcmerror = 0;
+       unsigned long flags;
+       int retry = POWERUP_MAX_RETRY;
+
+       if (flag == TRUE) { /* Turn off WLAN */
+               /* Removing Power */
+               DHD_ERROR(("%s: == Power OFF ==\n", __FUNCTION__));
+
+               /* wait for other contexts to finish -- if required a call
+               * to OSL_DELAY for 1s can be added to give other contexts
+               * a chance to finish
+               */
+               dhdpcie_advertise_bus_cleanup(bus->dhd);
+
+               if (bus->dhd->busstate != DHD_BUS_DOWN) {
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+                       atomic_set(&bus->dhd->block_bus, TRUE);
+                       dhd_flush_rx_tx_wq(bus->dhd);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+                       /* Clean up any pending host wake IRQ */
+                       dhd_bus_oob_intr_set(bus->dhd, FALSE);
+                       dhd_bus_oob_intr_unregister(bus->dhd);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+                       dhd_os_wd_timer(dhdp, 0);
+                       dhd_bus_stop(bus, TRUE);
+                       if (bus->intr) {
+                               dhdpcie_bus_intr_disable(bus);
+                               dhdpcie_free_irq(bus);
+                       }
+                       dhd_deinit_bus_lp_state_lock(bus);
+                       dhd_deinit_bar1_switch_lock(bus);
+                       dhd_deinit_backplane_access_lock(bus);
+                       dhd_deinit_pwr_req_lock(bus);
+                       dhd_bus_release_dongle(bus);
+                       dhdpcie_bus_free_resource(bus);
+                       bcmerror = dhdpcie_bus_disable_device(bus);
+                       if (bcmerror) {
+                               DHD_ERROR(("%s: dhdpcie_bus_disable_device: %d\n",
+                                       __FUNCTION__, bcmerror));
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+                               atomic_set(&bus->dhd->block_bus, FALSE);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+                       }
+                       /* Clean up protocol data after Bus Master Enable bit clear
+                        * so that host can safely unmap DMA and remove the allocated buffers
+                        * from the PKTID MAP. Some Applicantion Processors supported
+                        * System MMU triggers Kernel panic when they detect to attempt to
+                        * DMA-unmapped memory access from the devices which use the
+                        * System MMU. Therefore, Kernel panic can be happened since it is
+                        * possible that dongle can access to DMA-unmapped memory after
+                        * calling the dhd_prot_reset().
+                        * For this reason, the dhd_prot_reset() and dhd_clear() functions
+                        * should be located after the dhdpcie_bus_disable_device().
+                        */
+                       dhd_prot_reset(dhdp);
+                       /* XXX Reset dhd_pub_t instance to initial status
+                        * for built-in type driver
+                        */
+                       dhd_clear(dhdp);
+
+                       bcmerror = dhdpcie_bus_stop_host_dev(bus);
+                       if (bcmerror) {
+                               DHD_ERROR(("%s: dhdpcie_bus_stop host_dev failed: %d\n",
+                                       __FUNCTION__, bcmerror));
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+                               atomic_set(&bus->dhd->block_bus, FALSE);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+                               goto done;
+                       }
+
+                       DHD_GENERAL_LOCK(bus->dhd, flags);
+                       DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+                       bus->dhd->busstate = DHD_BUS_DOWN;
+                       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+                       atomic_set(&bus->dhd->block_bus, FALSE);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+               } else {
+                       if (bus->intr) {
+                               dhdpcie_free_irq(bus);
+                       }
+#ifdef BCMPCIE_OOB_HOST_WAKE
+                       /* Clean up any pending host wake IRQ */
+                       dhd_bus_oob_intr_set(bus->dhd, FALSE);
+                       dhd_bus_oob_intr_unregister(bus->dhd);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+                       dhd_dpc_kill(bus->dhd);
+                       if (!bus->no_bus_init) {
+                               dhd_bus_release_dongle(bus);
+                               dhdpcie_bus_free_resource(bus);
+                               bcmerror = dhdpcie_bus_disable_device(bus);
+                               if (bcmerror) {
+                                       DHD_ERROR(("%s: dhdpcie_bus_disable_device: %d\n",
+                                               __FUNCTION__, bcmerror));
+                               }
+
+                               /* Clean up protocol data after Bus Master Enable bit clear
+                                * so that host can safely unmap DMA and remove the allocated
+                                * buffers from the PKTID MAP. Some Applicantion Processors
+                                * supported System MMU triggers Kernel panic when they detect
+                                * to attempt to DMA-unmapped memory access from the devices
+                                * which use the System MMU.
+                                * Therefore, Kernel panic can be happened since it is possible
+                                * that dongle can access to DMA-unmapped memory after calling
+                                * the dhd_prot_reset().
+                                * For this reason, the dhd_prot_reset() and dhd_clear() functions
+                                * should be located after the dhdpcie_bus_disable_device().
+                                */
+                               dhd_prot_reset(dhdp);
+                               /* XXX Reset dhd_pub_t instance to initial status
+                                * for built-in type driver
+                                */
+                               dhd_clear(dhdp);
+                       } else {
+                               bus->no_bus_init = FALSE;
+                       }
+
+                       bcmerror = dhdpcie_bus_stop_host_dev(bus);
+                       if (bcmerror) {
+                               DHD_ERROR(("%s: dhdpcie_bus_stop_host_dev failed: %d\n",
+                                       __FUNCTION__, bcmerror));
+                               goto done;
+                       }
+               }
+
+               bus->dhd->dongle_reset = TRUE;
+               DHD_ERROR(("%s:  WLAN OFF Done\n", __FUNCTION__));
+
+       } else { /* Turn on WLAN */
+               if (bus->dhd->busstate == DHD_BUS_DOWN) {
+                       /* Powering On */
+                       DHD_ERROR(("%s: == Power ON ==\n", __FUNCTION__));
+                       /* PCIe RC Turn on */
+                       do {
+                               bcmerror = dhdpcie_bus_start_host_dev(bus);
+                               if (!bcmerror) {
+                                       DHD_ERROR(("%s: dhdpcie_bus_start_host_dev OK\n",
+                                               __FUNCTION__));
+                                       break;
+                               } else {
+                                       OSL_SLEEP(10);
+                               }
+                       } while (retry--);
+
+                       if (bcmerror) {
+                               DHD_ERROR(("%s: host pcie clock enable failed: %d\n",
+                                       __FUNCTION__, bcmerror));
+                               goto done;
+                       }
+#if defined(DHD_CONTROL_PCIE_ASPM_WIFI_TURNON)
+                       dhd_bus_aspm_enable_rc_ep(bus, FALSE);
+#endif /* DHD_CONTROL_PCIE_ASPM_WIFI_TURNON */
+                       bus->is_linkdown = 0;
+                       bus->cto_triggered = 0;
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+                       bus->read_shm_fail = FALSE;
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+                       bcmerror = dhdpcie_bus_enable_device(bus);
+                       if (bcmerror) {
+                               DHD_ERROR(("%s: host configuration restore failed: %d\n",
+                                       __FUNCTION__, bcmerror));
+                               goto done;
+                       }
+
+                       bcmerror = dhdpcie_bus_alloc_resource(bus);
+                       if (bcmerror) {
+                               DHD_ERROR(("%s: dhdpcie_bus_resource_alloc failed: %d\n",
+                                       __FUNCTION__, bcmerror));
+                               goto done;
+                       }
+
+#ifdef FORCE_DONGLE_RESET_IN_DEVRESET_ON
+                       /*
+                        * This will be enabled from phone platforms to
+                        * reset dongle during Wifi ON
+                        */
+                       dhdpcie_dongle_reset(bus);
+#endif /* FORCE_DONGLE_RESET_IN_DEVRESET_ON */
+
+                       bcmerror = dhdpcie_bus_dongle_attach(bus);
+                       if (bcmerror) {
+                               /*
+                                * As request irq is done later, till then CTO will not be detected,
+                                * so unconditionally dump cfg and DAR registers.
+                                */
+                               dhd_bus_dump_imp_cfg_registers(bus);
+                               dhd_bus_dump_dar_registers(bus);
+                               /* Check if CTO has happened */
+                               if (PCIECTO_ENAB(bus)) {
+                                       /* read pci_intstatus */
+                                       uint32 pci_intstatus =
+                                               dhdpcie_bus_cfg_read_dword(bus, PCI_INT_STATUS, 4);
+                                       if (pci_intstatus == (uint32)-1) {
+                                               DHD_ERROR(("%s : Invalid pci_intstatus(0x%x)\n",
+                                                       __FUNCTION__, pci_intstatus));
+                                       } else if (pci_intstatus & PCI_CTO_INT_MASK) {
+                                               DHD_ERROR(("%s: ##### CTO REPORTED BY DONGLE "
+                                                       "intstat=0x%x enab=%d\n", __FUNCTION__,
+                                                       pci_intstatus, bus->cto_enable));
+                                       }
+                               }
+                               DHD_ERROR(("%s: dhdpcie_bus_dongle_attach failed: %d\n",
+                                       __FUNCTION__, bcmerror));
+                               goto done;
+                       }
+
+                       bcmerror = dhd_bus_request_irq(bus);
+                       if (bcmerror) {
+                               DHD_ERROR(("%s: dhd_bus_request_irq failed: %d\n",
+                                       __FUNCTION__, bcmerror));
+                               goto done;
+                       }
+
+                       bus->dhd->dongle_reset = FALSE;
+
+#if defined(DHD_CONTROL_PCIE_CPUCORE_WIFI_TURNON)
+                       dhd_irq_set_affinity(bus->dhd, cpumask_of(1));
+#endif /* DHD_CONTROL_PCIE_CPUCORE_WIFI_TURNON */
+
+                       bcmerror = dhd_bus_start(dhdp);
+                       if (bcmerror) {
+                               DHD_ERROR(("%s: dhd_bus_start: %d\n",
+                                       __FUNCTION__, bcmerror));
+#ifdef DEBUG_DNGL_INIT_FAIL
+#ifdef DHD_DUMP_FILE_WRITE_FROM_KERNEL
+                               bus->dhd->memdump_enabled = DUMP_MEMFILE;
+#else
+                               /* Force panic as HAL will not be inited yet */
+                               bus->dhd->memdump_enabled = DUMP_MEMONLY;
+#endif /* DHD_DUMP_FILE_WRITE_FROM_KERNEL */
+                               if (bus->dhd->memdump_enabled) {
+                                       bus->dhd->memdump_type = DUMP_TYPE_DONGLE_INIT_FAILURE;
+                                       dhdpcie_mem_dump(bus);
+                               }
+#endif /* DEBUG_DNGL_INIT_FAIL */
+                               goto done;
+                       }
+
+                       /* Renabling watchdog which is disabled in dhdpcie_advertise_bus_cleanup */
+                       if (bus->dhd->dhd_watchdog_ms_backup) {
+                               DHD_ERROR(("%s: Enabling wdtick after dhd init\n",
+                                       __FUNCTION__));
+                               dhd_os_wd_timer(bus->dhd, bus->dhd->dhd_watchdog_ms_backup);
+                       }
+                       DHD_ERROR(("%s: WLAN Power On Done\n", __FUNCTION__));
+               } else {
+                       DHD_ERROR(("%s: what should we do here\n", __FUNCTION__));
+                       goto done;
+               }
+       }
+
+done:
+       if (bcmerror) {
+               DHD_GENERAL_LOCK(bus->dhd, flags);
+               DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+               bus->dhd->busstate = DHD_BUS_DOWN;
+               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+       }
+       return bcmerror;
+}
+
+static int
+dhdpcie_get_dma_ring_indices(dhd_pub_t *dhd)
+{
+       int h2d_support, d2h_support;
+
+       d2h_support = dhd->dma_d2h_ring_upd_support ? 1 : 0;
+       h2d_support = dhd->dma_h2d_ring_upd_support ? 1 : 0;
+       return (d2h_support | (h2d_support << 1));
+
+}
+int
+dhdpcie_set_dma_ring_indices(dhd_pub_t *dhd, int32 int_val)
+{
+       int bcmerror = 0;
+       /* Can change it only during initialization/FW download */
+       if (dhd->busstate == DHD_BUS_DOWN) {
+               if ((int_val > 3) || (int_val < 0)) {
+                       DHD_ERROR(("Bad argument. Possible values: 0, 1, 2 & 3\n"));
+                       bcmerror = BCME_BADARG;
+               } else {
+                       dhd->dma_d2h_ring_upd_support = (int_val & 1) ? TRUE : FALSE;
+                       dhd->dma_h2d_ring_upd_support = (int_val & 2) ? TRUE : FALSE;
+                       dhd->dma_ring_upd_overwrite = TRUE;
+               }
+       } else {
+               DHD_ERROR(("%s: Can change only when bus down (before FW download)\n",
+                       __FUNCTION__));
+               bcmerror = BCME_NOTDOWN;
+       }
+
+       return bcmerror;
+
+}
+
+/* si_backplane_access() manages a shared resource - BAR0 mapping, hence its
+ * calls shall be serialized. This wrapper function provides such serialization
+ * and shall be used everywjer einstead of direct call of si_backplane_access()
+ *
+ * Linux DHD driver calls si_backplane_access() from 3 three contexts: tasklet
+ * (that may call dhdpcie_sssr_dump() from dhdpcie_sssr_dump()), iovar
+ * ("sbreg", "membyres", etc.) and procfs (used by GDB proxy). To avoid race
+ * conditions calls of si_backplane_access() shall be serialized. Presence of
+ * tasklet context implies that serialization shall b ebased on spinlock. Hence
+ * Linux implementation of dhd_pcie_backplane_access_[un]lock() is
+ * spinlock-based.
+ *
+ * Other platforms may add their own implementations of
+ * dhd_pcie_backplane_access_[un]lock() as needed (e.g. if serialization is not
+ * needed implementation might be empty)
+ */
+static uint
+serialized_backplane_access(dhd_bus_t *bus, uint addr, uint size, uint *val, bool read)
+{
+       uint ret;
+       unsigned long flags;
+       DHD_BACKPLANE_ACCESS_LOCK(bus->backplane_access_lock, flags);
+       ret = si_backplane_access(bus->sih, addr, size, val, read);
+       DHD_BACKPLANE_ACCESS_UNLOCK(bus->backplane_access_lock, flags);
+       return ret;
+}
+
+/**
+ * IOVAR handler of the DHD bus layer (in this case, the PCIe bus).
+ *
+ * @param actionid  e.g. IOV_SVAL(IOV_PCIEREG)
+ * @param params    input buffer
+ * @param plen      length in [bytes] of input buffer 'params'
+ * @param arg       output buffer
+ * @param len       length in [bytes] of output buffer 'arg'
+ */
+static int
+dhdpcie_bus_doiovar(dhd_bus_t *bus, const bcm_iovar_t *vi, uint32 actionid, const char *name,
+                void *params, uint plen, void *arg, uint len, int val_size)
+{
+       int bcmerror = 0;
+       int32 int_val = 0;
+       int32 int_val2 = 0;
+       int32 int_val3 = 0;
+       bool bool_val = 0;
+
+       DHD_TRACE(("%s: Enter, action %d name %s params %p plen %d arg %p len %d val_size %d\n",
+                  __FUNCTION__, actionid, name, params, plen, arg, len, val_size));
+
+       if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid))) != 0)
+               goto exit;
+
+       if (plen >= sizeof(int_val))
+               bcopy(params, &int_val, sizeof(int_val));
+
+       if (plen >= sizeof(int_val) * 2)
+               bcopy((void*)((uintptr)params + sizeof(int_val)), &int_val2, sizeof(int_val2));
+
+       if (plen >= sizeof(int_val) * 3)
+               bcopy((void*)((uintptr)params + 2 * sizeof(int_val)), &int_val3, sizeof(int_val3));
+
+       bool_val = (int_val != 0) ? TRUE : FALSE;
+
+       /* Check if dongle is in reset. If so, only allow DEVRESET iovars */
+       if (bus->dhd->dongle_reset && !(actionid == IOV_SVAL(IOV_DEVRESET) ||
+                                       actionid == IOV_GVAL(IOV_DEVRESET))) {
+               bcmerror = BCME_NOTREADY;
+               goto exit;
+       }
+
+       switch (actionid) {
+
+       case IOV_SVAL(IOV_VARS):
+               bcmerror = dhdpcie_downloadvars(bus, arg, len);
+               break;
+       case IOV_SVAL(IOV_PCIE_LPBK):
+               bcmerror = dhdpcie_bus_lpback_req(bus, int_val);
+               break;
+
+       case IOV_SVAL(IOV_PCIE_DMAXFER): {
+               dma_xfer_info_t *dmaxfer = (dma_xfer_info_t *)arg;
+
+               if (!dmaxfer)
+                       return BCME_BADARG;
+               if (dmaxfer->version != DHD_DMAXFER_VERSION)
+                       return BCME_VERSION;
+               if (dmaxfer->length != sizeof(dma_xfer_info_t)) {
+                       return BCME_BADLEN;
+               }
+
+               bcmerror = dhdpcie_bus_dmaxfer_req(bus, dmaxfer->num_bytes,
+                               dmaxfer->src_delay, dmaxfer->dest_delay,
+                               dmaxfer->type, dmaxfer->core_num,
+                               dmaxfer->should_wait);
+
+               if (dmaxfer->should_wait && bcmerror >= 0) {
+                       bcmerror = dhdmsgbuf_dmaxfer_status(bus->dhd, dmaxfer);
+               }
+               break;
+       }
+
+       case IOV_GVAL(IOV_PCIE_DMAXFER): {
+               dma_xfer_info_t *dmaxfer = (dma_xfer_info_t *)params;
+               if (!dmaxfer)
+                       return BCME_BADARG;
+               if (dmaxfer->version != DHD_DMAXFER_VERSION)
+                       return BCME_VERSION;
+               if (dmaxfer->length != sizeof(dma_xfer_info_t)) {
+                       return BCME_BADLEN;
+               }
+               bcmerror = dhdmsgbuf_dmaxfer_status(bus->dhd, dmaxfer);
+               break;
+       }
+
+#ifdef PCIE_INB_DW
+       case IOV_GVAL(IOV_INB_DW_ENABLE):
+               int_val = bus->inb_enabled;
+               bcopy(&int_val, arg, val_size);
+               break;
+       case IOV_SVAL(IOV_INB_DW_ENABLE):
+               bus->inb_enabled = (bool)int_val;
+               break;
+#endif /* PCIE_INB_DW */
+#if defined(PCIE_INB_DW)
+       case IOV_GVAL(IOV_DEEP_SLEEP):
+               int_val = bus->ds_enabled;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DEEP_SLEEP):
+               if (int_val == 1) {
+                       if (!bus->ds_enabled) {
+                               bus->ds_enabled = TRUE;
+                               /* Deassert */
+                               if (dhd_bus_set_device_wake(bus, FALSE) == BCME_OK) {
+#ifdef PCIE_INB_DW
+                                       if (INBAND_DW_ENAB(bus)) {
+                                               int timeleft;
+                                               timeleft = dhd_os_ds_enter_wait(bus->dhd, NULL);
+                                               if (timeleft == 0) {
+                                                       DHD_ERROR(("DS-ENTER timeout\n"));
+                                                       bus->ds_enabled = FALSE;
+                                                       break;
+                                               }
+                                       }
+#endif /* PCIE_INB_DW */
+                               }
+                               else {
+                                       DHD_ERROR(("%s: Enable Deep Sleep failed !\n",
+                                                       __FUNCTION__));
+                                       bus->ds_enabled = FALSE;
+                               }
+                       } else {
+                               DHD_ERROR(("%s: Deep Sleep already enabled !\n", __FUNCTION__));
+                       }
+               }
+               else if (int_val == 0) {
+                       if (bus->ds_enabled) {
+                               bus->calc_ds_exit_latency = TRUE;
+                               /* Assert */
+                               if (dhd_bus_set_device_wake(bus, TRUE) == BCME_OK) {
+                                       bus->ds_enabled = FALSE;
+                                       if (INBAND_DW_ENAB(bus)) {
+                                               if (bus->ds_exit_latency != 0) {
+                                                       DHD_ERROR(("DS-EXIT latency = %llu us\n",
+                                                               bus->ds_exit_latency));
+                                               } else {
+                                                       DHD_ERROR(("Failed to measure DS-EXIT"
+                                                               " latency!(Possibly a non"
+                                                               " waitable context)\n"));
+                                               }
+                                       }
+                               } else {
+                                       DHD_ERROR(("%s: Disable Deep Sleep failed !\n",
+                                               __FUNCTION__));
+                               }
+                               bus->calc_ds_exit_latency = FALSE;
+                       } else {
+                               DHD_ERROR(("%s: Deep Sleep already disabled !\n", __FUNCTION__));
+                       }
+               }
+               else
+                       DHD_ERROR(("%s: Invalid number, allowed only 0|1\n", __FUNCTION__));
+
+               break;
+#endif
+       case IOV_GVAL(IOV_PCIE_SUSPEND):
+               int_val = (bus->dhd->busstate == DHD_BUS_SUSPEND) ? 1 : 0;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_PCIE_SUSPEND):
+               if (bool_val) { /* Suspend */
+                       int ret;
+                       unsigned long flags;
+
+                       /*
+                        * If some other context is busy, wait until they are done,
+                        * before starting suspend
+                        */
+                       ret = dhd_os_busbusy_wait_condition(bus->dhd,
+                               &bus->dhd->dhd_bus_busy_state, DHD_BUS_BUSY_IN_DHD_IOVAR);
+                       if (ret == 0) {
+                               DHD_ERROR(("%s:Wait Timedout, dhd_bus_busy_state = 0x%x\n",
+                                       __FUNCTION__, bus->dhd->dhd_bus_busy_state));
+                               return BCME_BUSY;
+                       }
+
+                       DHD_GENERAL_LOCK(bus->dhd, flags);
+                       DHD_BUS_BUSY_SET_SUSPEND_IN_PROGRESS(bus->dhd);
+                       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+                       dhdpcie_bus_suspend(bus, TRUE, TRUE);
+#else
+                       dhdpcie_bus_suspend(bus, TRUE);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+                       DHD_GENERAL_LOCK(bus->dhd, flags);
+                       DHD_BUS_BUSY_CLEAR_SUSPEND_IN_PROGRESS(bus->dhd);
+                       dhd_os_busbusy_wake(bus->dhd);
+                       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+               } else { /* Resume */
+                       unsigned long flags;
+                       DHD_GENERAL_LOCK(bus->dhd, flags);
+                       DHD_BUS_BUSY_SET_RESUME_IN_PROGRESS(bus->dhd);
+                       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+                       dhdpcie_bus_suspend(bus, FALSE);
+
+                       DHD_GENERAL_LOCK(bus->dhd, flags);
+                       DHD_BUS_BUSY_CLEAR_RESUME_IN_PROGRESS(bus->dhd);
+                       dhd_os_busbusy_wake(bus->dhd);
+                       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+               }
+               break;
+
+       case IOV_GVAL(IOV_MEMSIZE):
+               int_val = (int32)bus->ramsize;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       /* Debug related. Dumps core registers or one of the dongle memory */
+       case IOV_GVAL(IOV_DUMP_DONGLE):
+       {
+               dump_dongle_in_t ddi = *(dump_dongle_in_t*)params;
+               dump_dongle_out_t *ddo = (dump_dongle_out_t*)arg;
+               uint32 *p = ddo->val;
+               const uint max_offset = 4096 - 1; /* one core contains max 4096/4 registers */
+
+               if (plen < sizeof(ddi) || len < sizeof(ddo)) {
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               switch (ddi.type) {
+               case DUMP_DONGLE_COREREG:
+                       ddo->n_bytes = 0;
+
+                       if (si_setcoreidx(bus->sih, ddi.index) == NULL) {
+                               break; // beyond last core: core enumeration ended
+                       }
+
+                       ddo->address = si_addrspace(bus->sih, CORE_SLAVE_PORT_0, CORE_BASE_ADDR_0);
+                       ddo->address += ddi.offset; // BP address at which this dump starts
+
+                       ddo->id = si_coreid(bus->sih);
+                       ddo->rev = si_corerev(bus->sih);
+
+                       while (ddi.offset < max_offset &&
+                               sizeof(dump_dongle_out_t) + ddo->n_bytes < (uint)len) {
+                               *p++ = si_corereg(bus->sih, ddi.index, ddi.offset, 0, 0);
+                               ddi.offset += sizeof(uint32);
+                               ddo->n_bytes += sizeof(uint32);
+                       }
+                       break;
+               default:
+                       // TODO: implement d11 SHM/TPL dumping
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               break;
+       }
+
+       /* Debug related. Returns a string with dongle capabilities */
+       case IOV_GVAL(IOV_DNGL_CAPS):
+       {
+               strlcpy(arg, bus->dhd->fw_capabilities, (size_t)len);
+               break;
+       }
+
+#if defined(DEBUGGER) || defined(DHD_DSCOPE)
+       case IOV_SVAL(IOV_GDB_SERVER):
+               /* debugger_*() functions may sleep, so cannot hold spinlock */
+               if (int_val > 0) {
+                       debugger_init((void *) bus, &bus_ops, int_val, SI_ENUM_BASE(bus->sih));
+               } else {
+                       debugger_close();
+               }
+               break;
+#endif /* DEBUGGER || DHD_DSCOPE */
+#if defined(GDB_PROXY)
+       case IOV_GVAL(IOV_GDB_PROXY_PROBE):
+       {
+               dhd_gdb_proxy_probe_data_t ret;
+               ret.data_len = (uint32)sizeof(ret);
+               ret.magic = DHD_IOCTL_MAGIC;
+               ret.flags = 0;
+               if (bus->gdb_proxy_access_enabled) {
+                       ret.flags |= DHD_GDB_PROXY_PROBE_ACCESS_ENABLED;
+                       if (bus->dhd->busstate < DHD_BUS_LOAD) {
+                               ret.flags |= DHD_GDB_PROXY_PROBE_FIRMWARE_NOT_RUNNING;
+                       } else {
+                               ret.flags |= DHD_GDB_PROXY_PROBE_FIRMWARE_RUNNING;
+                       }
+               }
+               if (bus->gdb_proxy_bootloader_mode) {
+                       ret.flags |= DHD_GDB_PROXY_PROBE_BOOTLOADER_MODE;
+               }
+               ret.last_id = bus->gdb_proxy_last_id;
+               if (plen && int_val) {
+                       bus->gdb_proxy_last_id = (uint32)int_val;
+               }
+               if (len >= sizeof(ret)) {
+                       bcopy(&ret, arg, sizeof(ret));
+                       bus->dhd->gdb_proxy_active = TRUE;
+               } else {
+                       bcmerror = BCME_BADARG;
+               }
+               break;
+       }
+       case IOV_GVAL(IOV_GDB_PROXY_STOP_COUNT):
+               int_val = (int32)bus->dhd->gdb_proxy_stop_count;
+               bcopy(&int_val, arg, sizeof(int_val));
+               break;
+       case IOV_SVAL(IOV_GDB_PROXY_STOP_COUNT):
+               bus->dhd->gdb_proxy_stop_count = (uint32)int_val;
+               break;
+#endif /* GDB_PROXY */
+
+#ifdef BCM_BUZZZ
+       /* Dump dongle side buzzz trace to console */
+       case IOV_GVAL(IOV_BUZZZ_DUMP):
+               bcmerror = dhd_buzzz_dump_dngl(bus);
+               break;
+#endif /* BCM_BUZZZ */
+
+       case IOV_SVAL(IOV_SET_DOWNLOAD_STATE):
+               bcmerror = dhdpcie_bus_download_state(bus, bool_val);
+               break;
+
+#if defined(FW_SIGNATURE)
+       case IOV_SVAL(IOV_SET_DOWNLOAD_INFO):
+       {
+               fw_download_info_t *info = (fw_download_info_t*)params;
+               DHD_INFO(("dwnldinfo: sig=%s fw=%x,%u bl=%s,0x%x\n",
+                       info->fw_signature_fname,
+                       info->fw_start_addr, info->fw_size,
+                       info->bootloader_fname, info->bootloader_start_addr));
+               bcmerror = dhdpcie_bus_save_download_info(bus,
+                       info->fw_start_addr, info->fw_size, info->fw_signature_fname,
+                       info->bootloader_fname, info->bootloader_start_addr);
+               break;
+       }
+#endif /* FW_SIGNATURE */
+
+       case IOV_GVAL(IOV_RAMSIZE):
+               int_val = (int32)bus->ramsize;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_RAMSIZE):
+               bus->ramsize = int_val;
+               bus->orig_ramsize = int_val;
+               break;
+
+       case IOV_GVAL(IOV_RAMSTART):
+               int_val = (int32)bus->dongle_ram_base;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_CC_NVMSHADOW):
+       {
+               struct bcmstrbuf dump_b;
+
+               bcm_binit(&dump_b, arg, len);
+               bcmerror = dhdpcie_cc_nvmshadow(bus, &dump_b);
+               break;
+       }
+
+       case IOV_GVAL(IOV_SLEEP_ALLOWED):
+               bool_val = bus->sleep_allowed;
+               bcopy(&bool_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_SLEEP_ALLOWED):
+               bus->sleep_allowed = bool_val;
+               break;
+
+       case IOV_GVAL(IOV_DONGLEISOLATION):
+               int_val = bus->dhd->dongle_isolation;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DONGLEISOLATION):
+               bus->dhd->dongle_isolation = bool_val;
+               break;
+
+       case IOV_GVAL(IOV_LTRSLEEPON_UNLOOAD):
+               int_val = bus->ltrsleep_on_unload;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_LTRSLEEPON_UNLOOAD):
+               bus->ltrsleep_on_unload = bool_val;
+               break;
+
+       case IOV_GVAL(IOV_DUMP_RINGUPD_BLOCK):
+       {
+               struct bcmstrbuf dump_b;
+               bcm_binit(&dump_b, arg, len);
+               bcmerror = dhd_prot_ringupd_dump(bus->dhd, &dump_b);
+               break;
+       }
+       case IOV_GVAL(IOV_DMA_RINGINDICES):
+       {
+               int_val = dhdpcie_get_dma_ring_indices(bus->dhd);
+               bcopy(&int_val, arg, sizeof(int_val));
+               break;
+       }
+       case IOV_SVAL(IOV_DMA_RINGINDICES):
+               bcmerror = dhdpcie_set_dma_ring_indices(bus->dhd, int_val);
+               break;
+
+       case IOV_GVAL(IOV_METADATA_DBG):
+               int_val = dhd_prot_metadata_dbg_get(bus->dhd);
+               bcopy(&int_val, arg, val_size);
+               break;
+       case IOV_SVAL(IOV_METADATA_DBG):
+               dhd_prot_metadata_dbg_set(bus->dhd, (int_val != 0));
+               break;
+
+       case IOV_GVAL(IOV_RX_METADATALEN):
+               int_val = dhd_prot_metadatalen_get(bus->dhd, TRUE);
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_RX_METADATALEN):
+               if (int_val > 64) {
+                       bcmerror = BCME_BUFTOOLONG;
+                       break;
+               }
+               dhd_prot_metadatalen_set(bus->dhd, int_val, TRUE);
+               break;
+
+       case IOV_SVAL(IOV_TXP_THRESHOLD):
+               dhd_prot_txp_threshold(bus->dhd, TRUE, int_val);
+               break;
+
+       case IOV_GVAL(IOV_TXP_THRESHOLD):
+               int_val = dhd_prot_txp_threshold(bus->dhd, FALSE, int_val);
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DB1_FOR_MB):
+               if (int_val)
+                       bus->db1_for_mb = TRUE;
+               else
+                       bus->db1_for_mb = FALSE;
+               break;
+
+       case IOV_GVAL(IOV_DB1_FOR_MB):
+               if (bus->db1_for_mb)
+                       int_val = 1;
+               else
+                       int_val = 0;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_TX_METADATALEN):
+               int_val = dhd_prot_metadatalen_get(bus->dhd, FALSE);
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_TX_METADATALEN):
+               if (int_val > 64) {
+                       bcmerror = BCME_BUFTOOLONG;
+                       break;
+               }
+               dhd_prot_metadatalen_set(bus->dhd, int_val, FALSE);
+               break;
+
+       case IOV_SVAL(IOV_DEVRESET):
+       {
+               devreset_info_t *devreset = (devreset_info_t *)arg;
+
+               if (!devreset) {
+                       return BCME_BADARG;
+               }
+
+               if (devreset->length == sizeof(devreset_info_t)) {
+                       if (devreset->version != DHD_DEVRESET_VERSION) {
+                               return BCME_VERSION;
+                       }
+                       int_val = devreset->mode;
+               }
+
+               switch (int_val) {
+                       case DHD_BUS_DEVRESET_ON:
+                               bcmerror = dhd_bus_devreset(bus->dhd, (uint8)int_val);
+                               break;
+                       case DHD_BUS_DEVRESET_OFF:
+                               bcmerror = dhd_bus_devreset(bus->dhd, (uint8)int_val);
+                               break;
+                       case DHD_BUS_DEVRESET_FLR:
+                               bcmerror = dhd_bus_perform_flr(bus, bus->flr_force_fail);
+                               break;
+                       case DHD_BUS_DEVRESET_FLR_FORCE_FAIL:
+                               bus->flr_force_fail = TRUE;
+                               break;
+                       default:
+                               DHD_ERROR(("%s: invalid argument for devreset\n", __FUNCTION__));
+                               break;
+               }
+               break;
+       }
+       case IOV_SVAL(IOV_FORCE_FW_TRAP):
+               if (bus->dhd->busstate == DHD_BUS_DATA)
+                       dhdpcie_fw_trap(bus);
+               else {
+                       DHD_ERROR(("%s: Bus is NOT up\n", __FUNCTION__));
+                       bcmerror = BCME_NOTUP;
+               }
+               break;
+       case IOV_GVAL(IOV_FLOW_PRIO_MAP):
+               int_val = bus->dhd->flow_prio_map_type;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_FLOW_PRIO_MAP):
+               int_val = (int32)dhd_update_flow_prio_map(bus->dhd, (uint8)int_val);
+               bcopy(&int_val, arg, val_size);
+               break;
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       case IOV_GVAL(IOV_IDLETIME):
+               if (!(bus->dhd->op_mode & DHD_FLAG_MFG_MODE)) {
+                       int_val = bus->idletime;
+               } else {
+                       int_val = 0;
+               }
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_IDLETIME):
+               if (int_val < 0) {
+                       bcmerror = BCME_BADARG;
+               } else {
+                       bus->idletime = int_val;
+                       if (bus->idletime) {
+                               DHD_ENABLE_RUNTIME_PM(bus->dhd);
+                       } else {
+                               DHD_DISABLE_RUNTIME_PM(bus->dhd);
+                       }
+               }
+               break;
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       case IOV_GVAL(IOV_TXBOUND):
+               int_val = (int32)dhd_txbound;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_TXBOUND):
+               dhd_txbound = (uint)int_val;
+               break;
+
+       case IOV_SVAL(IOV_H2D_MAILBOXDATA):
+               dhdpcie_send_mb_data(bus, (uint)int_val);
+               break;
+
+       case IOV_SVAL(IOV_INFORINGS):
+               dhd_prot_init_info_rings(bus->dhd);
+               break;
+
+       case IOV_SVAL(IOV_H2D_PHASE):
+               if (bus->dhd->busstate != DHD_BUS_DOWN) {
+                       DHD_ERROR(("%s: Can change only when bus down (before FW download)\n",
+                               __FUNCTION__));
+                       bcmerror = BCME_NOTDOWN;
+                       break;
+               }
+               if (int_val)
+                       bus->dhd->h2d_phase_supported = TRUE;
+               else
+                       bus->dhd->h2d_phase_supported = FALSE;
+               break;
+
+       case IOV_GVAL(IOV_H2D_PHASE):
+               int_val = (int32) bus->dhd->h2d_phase_supported;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_H2D_ENABLE_TRAP_BADPHASE):
+               if (bus->dhd->busstate != DHD_BUS_DOWN) {
+                       DHD_ERROR(("%s: Can change only when bus down (before FW download)\n",
+                               __FUNCTION__));
+                       bcmerror = BCME_NOTDOWN;
+                       break;
+               }
+               if (int_val)
+                       bus->dhd->force_dongletrap_on_bad_h2d_phase = TRUE;
+               else
+                       bus->dhd->force_dongletrap_on_bad_h2d_phase = FALSE;
+               break;
+
+       case IOV_GVAL(IOV_H2D_ENABLE_TRAP_BADPHASE):
+               int_val = (int32) bus->dhd->force_dongletrap_on_bad_h2d_phase;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_H2D_TXPOST_MAX_ITEM):
+               if (bus->dhd->busstate != DHD_BUS_DOWN) {
+                       DHD_ERROR(("%s: Can change only when bus down (before FW download)\n",
+                               __FUNCTION__));
+                       bcmerror = BCME_NOTDOWN;
+                       break;
+               }
+               dhd_prot_set_h2d_max_txpost(bus->dhd, (uint16)int_val);
+               break;
+
+       case IOV_GVAL(IOV_H2D_TXPOST_MAX_ITEM):
+               int_val = dhd_prot_get_h2d_max_txpost(bus->dhd);
+               bcopy(&int_val, arg, val_size);
+               break;
+
+#if defined(DHD_HTPUT_TUNABLES)
+       case IOV_SVAL(IOV_H2D_HTPUT_TXPOST_MAX_ITEM):
+               if (bus->dhd->busstate != DHD_BUS_DOWN) {
+                       DHD_ERROR(("%s: Can change only when bus down (before FW download)\n",
+                               __FUNCTION__));
+                       bcmerror = BCME_NOTDOWN;
+                       break;
+               }
+               dhd_prot_set_h2d_htput_max_txpost(bus->dhd, (uint16)int_val);
+               break;
+
+       case IOV_GVAL(IOV_H2D_HTPUT_TXPOST_MAX_ITEM):
+               int_val = dhd_prot_get_h2d_htput_max_txpost(bus->dhd);
+               bcopy(&int_val, arg, val_size);
+               break;
+#endif /* DHD_HTPUT_TUNABLES */
+
+       case IOV_GVAL(IOV_RXBOUND):
+               int_val = (int32)dhd_rxbound;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_RXBOUND):
+               dhd_rxbound = (uint)int_val;
+               break;
+
+       case IOV_GVAL(IOV_TRAPDATA):
+       {
+               struct bcmstrbuf dump_b;
+               bcm_binit(&dump_b, arg, len);
+               bcmerror = dhd_prot_dump_extended_trap(bus->dhd, &dump_b, FALSE);
+               break;
+       }
+
+       case IOV_GVAL(IOV_TRAPDATA_RAW):
+       {
+               struct bcmstrbuf dump_b;
+               bcm_binit(&dump_b, arg, len);
+               bcmerror = dhd_prot_dump_extended_trap(bus->dhd, &dump_b, TRUE);
+               break;
+       }
+
+       case IOV_SVAL(IOV_HANGREPORT):
+               bus->dhd->hang_report = bool_val;
+               DHD_ERROR(("%s: Set hang_report as %d\n",
+                       __FUNCTION__, bus->dhd->hang_report));
+               break;
+
+       case IOV_GVAL(IOV_HANGREPORT):
+               int_val = (int32)bus->dhd->hang_report;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_CTO_PREVENTION):
+               bcmerror = dhdpcie_cto_init(bus, bool_val);
+               break;
+
+       case IOV_GVAL(IOV_CTO_PREVENTION):
+               if (bus->sih->buscorerev < 19) {
+                       bcmerror = BCME_UNSUPPORTED;
+                       break;
+               }
+               int_val = (int32)bus->cto_enable;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_CTO_THRESHOLD):
+               {
+                       if (bus->sih->buscorerev < 19) {
+                               bcmerror = BCME_UNSUPPORTED;
+                               break;
+                       }
+                       bus->cto_threshold = (uint32)int_val;
+               }
+               break;
+
+       case IOV_GVAL(IOV_CTO_THRESHOLD):
+               if (bus->sih->buscorerev < 19) {
+                       bcmerror = BCME_UNSUPPORTED;
+                       break;
+               }
+               if (bus->cto_threshold) {
+                       int_val = (int32)bus->cto_threshold;
+               } else {
+                       int_val = pcie_cto_to_thresh_default(bus->sih->buscorerev);
+               }
+
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_PCIE_WD_RESET):
+               if (bool_val) {
+                       /* Legacy chipcommon watchdog reset */
+                       dhdpcie_cc_watchdog_reset(bus);
+               }
+               break;
+
+       case IOV_GVAL(IOV_HWA_ENABLE):
+               int_val = bus->hwa_enabled;
+               bcopy(&int_val, arg, val_size);
+               break;
+       case IOV_SVAL(IOV_HWA_ENABLE):
+               bus->hwa_enabled = (bool)int_val;
+               break;
+       case IOV_GVAL(IOV_IDMA_ENABLE):
+               int_val = bus->idma_enabled;
+               bcopy(&int_val, arg, val_size);
+               break;
+       case IOV_SVAL(IOV_IDMA_ENABLE):
+               bus->idma_enabled = (bool)int_val;
+               break;
+       case IOV_GVAL(IOV_IFRM_ENABLE):
+               int_val = bus->ifrm_enabled;
+               bcopy(&int_val, arg, val_size);
+               break;
+       case IOV_SVAL(IOV_IFRM_ENABLE):
+               bus->ifrm_enabled = (bool)int_val;
+               break;
+       case IOV_GVAL(IOV_CLEAR_RING):
+               bcopy(&int_val, arg, val_size);
+               dhd_flow_rings_flush(bus->dhd, 0);
+               break;
+       case IOV_GVAL(IOV_DAR_ENABLE):
+               int_val = bus->dar_enabled;
+               bcopy(&int_val, arg, val_size);
+               break;
+       case IOV_SVAL(IOV_DAR_ENABLE):
+               bus->dar_enabled = (bool)int_val;
+               break;
+       case IOV_GVAL(IOV_HSCBSIZE):
+               bcmerror = dhd_get_hscb_info(bus->dhd, NULL, (uint32 *)arg);
+               break;
+
+       case IOV_SVAL(IOV_EXTDTXS_IN_TXCPL):
+               if (bus->dhd->busstate != DHD_BUS_DOWN) {
+                       return BCME_NOTDOWN;
+               }
+               if (int_val)
+                       bus->dhd->extdtxs_in_txcpl = TRUE;
+               else
+                       bus->dhd->extdtxs_in_txcpl = FALSE;
+               break;
+
+       case IOV_GVAL(IOV_EXTDTXS_IN_TXCPL):
+               int_val = bus->dhd->extdtxs_in_txcpl;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_HOSTRDY_AFTER_INIT):
+               if (bus->dhd->busstate != DHD_BUS_DOWN) {
+                       return BCME_NOTDOWN;
+               }
+               if (int_val)
+                       bus->dhd->hostrdy_after_init = TRUE;
+               else
+                       bus->dhd->hostrdy_after_init = FALSE;
+               break;
+
+       case IOV_GVAL(IOV_HOSTRDY_AFTER_INIT):
+               int_val = bus->dhd->hostrdy_after_init;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       default:
+               bcmerror = BCME_UNSUPPORTED;
+               break;
+       }
+
+exit:
+       return bcmerror;
+} /* dhdpcie_bus_doiovar */
+
+/** Transfers bytes from host to dongle using pio mode */
+static int
+dhdpcie_bus_lpback_req(struct  dhd_bus *bus, uint32 len)
+{
+       if (bus->dhd == NULL) {
+               DHD_ERROR(("%s: bus not inited\n", __FUNCTION__));
+               return 0;
+       }
+       if (bus->dhd->prot == NULL) {
+               DHD_ERROR(("%s: prot is not inited\n", __FUNCTION__));
+               return 0;
+       }
+       if (bus->dhd->busstate != DHD_BUS_DATA) {
+               DHD_ERROR(("%s: not in a readystate to LPBK  is not inited\n", __FUNCTION__));
+               return 0;
+       }
+       dhdmsgbuf_lpbk_req(bus->dhd, len);
+       return 0;
+}
+
+void
+dhd_bus_dump_dar_registers(struct dhd_bus *bus)
+{
+       uint32 dar_clk_ctrl_val, dar_pwr_ctrl_val, dar_intstat_val,
+               dar_errlog_val, dar_erraddr_val, dar_pcie_mbint_val;
+       uint32 dar_clk_ctrl_reg, dar_pwr_ctrl_reg, dar_intstat_reg,
+               dar_errlog_reg, dar_erraddr_reg, dar_pcie_mbint_reg;
+
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: link is down\n", __FUNCTION__));
+               return;
+       }
+
+       if (DAR_PWRREQ(bus)) {
+               dhd_bus_pcie_pwr_req(bus);
+       }
+
+       dar_clk_ctrl_reg = (uint32)DAR_CLK_CTRL(bus->sih->buscorerev);
+       dar_pwr_ctrl_reg = (uint32)DAR_PCIE_PWR_CTRL(bus->sih->buscorerev);
+       dar_intstat_reg = (uint32)DAR_INTSTAT(bus->sih->buscorerev);
+       dar_errlog_reg = (uint32)DAR_ERRLOG(bus->sih->buscorerev);
+       dar_erraddr_reg = (uint32)DAR_ERRADDR(bus->sih->buscorerev);
+       dar_pcie_mbint_reg = (uint32)DAR_PCIMailBoxInt(bus->sih->buscorerev);
+
+       if (bus->sih->buscorerev < 24) {
+               DHD_ERROR(("%s: DAR not supported for corerev(%d) < 24\n",
+                       __FUNCTION__, bus->sih->buscorerev));
+               return;
+       }
+
+       dar_clk_ctrl_val = si_corereg(bus->sih, bus->sih->buscoreidx, dar_clk_ctrl_reg, 0, 0);
+       dar_pwr_ctrl_val = si_corereg(bus->sih, bus->sih->buscoreidx, dar_pwr_ctrl_reg, 0, 0);
+       dar_intstat_val = si_corereg(bus->sih, bus->sih->buscoreidx, dar_intstat_reg, 0, 0);
+       dar_errlog_val = si_corereg(bus->sih, bus->sih->buscoreidx, dar_errlog_reg, 0, 0);
+       dar_erraddr_val = si_corereg(bus->sih, bus->sih->buscoreidx, dar_erraddr_reg, 0, 0);
+       dar_pcie_mbint_val = si_corereg(bus->sih, bus->sih->buscoreidx, dar_pcie_mbint_reg, 0, 0);
+
+       DHD_ERROR(("%s: dar_clk_ctrl(0x%x:0x%x) dar_pwr_ctrl(0x%x:0x%x) dar_intstat(0x%x:0x%x)\n",
+               __FUNCTION__, dar_clk_ctrl_reg, dar_clk_ctrl_val,
+               dar_pwr_ctrl_reg, dar_pwr_ctrl_val, dar_intstat_reg, dar_intstat_val));
+
+       DHD_ERROR(("%s: dar_errlog(0x%x:0x%x) dar_erraddr(0x%x:0x%x) dar_pcie_mbint(0x%x:0x%x)\n",
+               __FUNCTION__, dar_errlog_reg, dar_errlog_val,
+               dar_erraddr_reg, dar_erraddr_val, dar_pcie_mbint_reg, dar_pcie_mbint_val));
+}
+
+/* Ring DoorBell1 to indicate Hostready i.e. D3 Exit */
+void
+dhd_bus_hostready(struct  dhd_bus *bus)
+{
+       if (!bus->dhd->d2h_hostrdy_supported) {
+               return;
+       }
+
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link was down\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_ERROR(("%s : Read PCICMD Reg: 0x%08X\n", __FUNCTION__,
+               dhd_pcie_config_read(bus, PCI_CFG_CMD, sizeof(uint32))));
+
+       dhd_bus_dump_dar_registers(bus);
+
+       si_corereg(bus->sih, bus->sih->buscoreidx, dhd_bus_db1_addr_get(bus), ~0, 0x12345678);
+       bus->hostready_count ++;
+       DHD_ERROR(("%s: Ring Hostready:%d\n", __FUNCTION__, bus->hostready_count));
+}
+
+/* Clear INTSTATUS */
+void
+dhdpcie_bus_clear_intstatus(struct dhd_bus *bus)
+{
+       uint32 intstatus = 0;
+       /* Skip after recieving D3 ACK */
+       if (DHD_CHK_BUS_LPS_D3_ACKED(bus)) {
+               return;
+       }
+       /* XXX: check for PCIE Gen2 also */
+       if ((bus->sih->buscorerev == 6) || (bus->sih->buscorerev == 4) ||
+               (bus->sih->buscorerev == 2)) {
+               intstatus = dhdpcie_bus_cfg_read_dword(bus, PCIIntstatus, 4);
+               dhdpcie_bus_cfg_write_dword(bus, PCIIntstatus, 4, intstatus);
+       } else {
+               /* this is a PCIE core register..not a config register... */
+               intstatus = si_corereg(bus->sih, bus->sih->buscoreidx, bus->pcie_mailbox_int, 0, 0);
+               si_corereg(bus->sih, bus->sih->buscoreidx, bus->pcie_mailbox_int, bus->def_intmask,
+                       intstatus);
+       }
+}
+
+int
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+dhdpcie_bus_suspend(struct dhd_bus *bus, bool state, bool byint)
+#else
+dhdpcie_bus_suspend(struct dhd_bus *bus, bool state)
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+{
+       int timeleft;
+       int rc = 0;
+       unsigned long flags;
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       int d3_read_retry = 0;
+       uint32 d2h_mb_data = 0;
+       uint32 zero = 0;
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+       printf("%s: state=%d\n", __FUNCTION__, state);
+       if (bus->dhd == NULL) {
+               DHD_ERROR(("%s: bus not inited\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+       if (bus->dhd->prot == NULL) {
+               DHD_ERROR(("%s: prot is not inited\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (dhd_query_bus_erros(bus->dhd)) {
+               return BCME_ERROR;
+       }
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       if (!(bus->dhd->busstate == DHD_BUS_DATA || bus->dhd->busstate == DHD_BUS_SUSPEND)) {
+               DHD_ERROR(("%s: not in a readystate\n", __FUNCTION__));
+               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+               return BCME_ERROR;
+       }
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+       if (bus->dhd->dongle_reset) {
+               DHD_ERROR(("Dongle is in reset state.\n"));
+               return -EIO;
+       }
+
+       /* Check whether we are already in the requested state.
+        * state=TRUE means Suspend
+        * state=FALSE meanse Resume
+        */
+       if (state == TRUE && bus->dhd->busstate == DHD_BUS_SUSPEND) {
+               DHD_ERROR(("Bus is already in SUSPEND state.\n"));
+               return BCME_OK;
+       } else if (state == FALSE && bus->dhd->busstate == DHD_BUS_DATA) {
+               DHD_ERROR(("Bus is already in RESUME state.\n"));
+               return BCME_OK;
+       }
+
+       if (state) {
+               int idle_retry = 0;
+               int active;
+
+               if (bus->is_linkdown) {
+                       DHD_ERROR(("%s: PCIe link was down, state=%d\n",
+                               __FUNCTION__, state));
+                       return BCME_ERROR;
+               }
+
+               /* Suspend */
+               DHD_ERROR(("%s: Entering suspend state\n", __FUNCTION__));
+
+               bus->dhd->dhd_watchdog_ms_backup = dhd_watchdog_ms;
+               if (bus->dhd->dhd_watchdog_ms_backup) {
+                       DHD_ERROR(("%s: Disabling wdtick before going to suspend\n",
+                               __FUNCTION__));
+                       dhd_os_wd_timer(bus->dhd, 0);
+               }
+
+               DHD_GENERAL_LOCK(bus->dhd, flags);
+               if (DHD_BUS_BUSY_CHECK_IN_TX(bus->dhd)) {
+                       DHD_ERROR(("Tx Request is not ended\n"));
+                       bus->dhd->busstate = DHD_BUS_DATA;
+                       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+                       return -EBUSY;
+               }
+
+               bus->last_suspend_start_time = OSL_LOCALTIME_NS();
+
+               /* stop all interface network queue. */
+               dhd_bus_stop_queue(bus);
+               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+               if (byint) {
+                       DHD_OS_WAKE_LOCK_WAIVE(bus->dhd);
+                       /* Clear wait_for_d3_ack before sending D3_INFORM */
+                       bus->wait_for_d3_ack = 0;
+                       dhdpcie_send_mb_data(bus, H2D_HOST_D3_INFORM);
+
+                       timeleft = dhd_os_d3ack_wait(bus->dhd, &bus->wait_for_d3_ack);
+                       DHD_OS_WAKE_LOCK_RESTORE(bus->dhd);
+               } else {
+                       /* Clear wait_for_d3_ack before sending D3_INFORM */
+                       bus->wait_for_d3_ack = 0;
+                       dhdpcie_send_mb_data(bus, H2D_HOST_D3_INFORM | H2D_HOST_ACK_NOINT);
+                       while (!bus->wait_for_d3_ack && d3_read_retry < MAX_D3_ACK_TIMEOUT) {
+                               dhdpcie_handle_mb_data(bus);
+                               usleep_range(1000, 1500);
+                               d3_read_retry++;
+                       }
+               }
+#else
+               DHD_OS_WAKE_LOCK_WAIVE(bus->dhd);
+
+#ifdef PCIE_INB_DW
+               /* As D3_INFORM will be sent after De-assert,
+                * skip sending DS-ACK for DS-REQ.
+                */
+               bus->skip_ds_ack = TRUE;
+#endif /* PCIE_INB_DW */
+
+#if defined(PCIE_INB_DW)
+               dhd_bus_set_device_wake(bus, TRUE);
+#endif
+#ifdef PCIE_INB_DW
+               /* De-assert at this point for In-band device_wake */
+               if (INBAND_DW_ENAB(bus)) {
+                       dhd_bus_set_device_wake(bus, FALSE);
+                       DHD_BUS_INB_DW_LOCK(bus->inb_lock, flags);
+                       dhdpcie_bus_set_pcie_inband_dw_state(bus, DW_DEVICE_HOST_SLEEP_WAIT);
+                       DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+               }
+#endif /* PCIE_INB_DW */
+               /* Clear wait_for_d3_ack before sending D3_INFORM */
+               bus->wait_for_d3_ack = 0;
+               /*
+                * Send H2D_HOST_D3_INFORM to dongle and mark bus->bus_low_power_state
+                * to DHD_BUS_D3_INFORM_SENT in dhd_prot_ring_write_complete_mbdata
+                * inside atomic context, so that no more DBs will be
+                * rung after sending D3_INFORM
+                */
+#ifdef PCIE_INB_DW
+               if (INBAND_DW_ENAB(bus)) {
+                       DHD_BUS_INB_DW_LOCK(bus->inb_lock, flags);
+                       dhdpcie_send_mb_data(bus, H2D_HOST_D3_INFORM);
+                       DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+               } else
+#endif /* PCIE_INB_DW */
+               {
+                       dhdpcie_send_mb_data(bus, H2D_HOST_D3_INFORM);
+               }
+
+               /* Wait for D3 ACK for D3_ACK_RESP_TIMEOUT seconds */
+
+               timeleft = dhd_os_d3ack_wait(bus->dhd, &bus->wait_for_d3_ack);
+
+#ifdef DHD_RECOVER_TIMEOUT
+               /* XXX: WAR for missing D3 ACK MB interrupt */
+               if (bus->wait_for_d3_ack == 0) {
+                       /* If wait_for_d3_ack was not updated because D2H MB was not received */
+                       uint32 intstatus = si_corereg(bus->sih, bus->sih->buscoreidx,
+                               bus->pcie_mailbox_int, 0, 0);
+                       int host_irq_disabled = dhdpcie_irq_disabled(bus);
+                       if ((intstatus) && (intstatus != (uint32)-1) &&
+                               (timeleft == 0) && (!dhd_query_bus_erros(bus->dhd))) {
+                               DHD_ERROR(("%s: D3 ACK trying again intstatus=%x"
+                                       " host_irq_disabled=%d\n",
+                                       __FUNCTION__, intstatus, host_irq_disabled));
+                               dhd_pcie_intr_count_dump(bus->dhd);
+                               dhd_print_tasklet_status(bus->dhd);
+                               if (bus->api.fw_rev >= PCIE_SHARED_VERSION_6 &&
+                                       !bus->use_mailbox) {
+                                       dhd_prot_process_ctrlbuf(bus->dhd);
+                               } else {
+                                       dhdpcie_handle_mb_data(bus);
+                               }
+                               timeleft = dhd_os_d3ack_wait(bus->dhd, &bus->wait_for_d3_ack);
+                               /* Clear Interrupts */
+                               dhdpcie_bus_clear_intstatus(bus);
+                       }
+               } /* bus->wait_for_d3_ack was 0 */
+#endif /* DHD_RECOVER_TIMEOUT */
+
+               DHD_OS_WAKE_LOCK_RESTORE(bus->dhd);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+               /* To allow threads that got pre-empted to complete.
+                */
+               while ((active = dhd_os_check_wakelock_all(bus->dhd)) &&
+                       (idle_retry < MAX_WKLK_IDLE_CHECK)) {
+                       OSL_SLEEP(1);
+                       idle_retry++;
+               }
+
+               if (bus->wait_for_d3_ack) {
+                       DHD_ERROR(("%s: Got D3 Ack \n", __FUNCTION__));
+                       /* Got D3 Ack. Suspend the bus */
+                       if (active) {
+                               DHD_ERROR(("%s():Suspend failed because of wakelock"
+                                       "restoring Dongle to D0\n", __FUNCTION__));
+
+                               if (bus->dhd->dhd_watchdog_ms_backup) {
+                                       DHD_ERROR(("%s: Enabling wdtick due to wakelock active\n",
+                                               __FUNCTION__));
+                                       dhd_os_wd_timer(bus->dhd,
+                                               bus->dhd->dhd_watchdog_ms_backup);
+                               }
+
+                               /*
+                                * Dongle still thinks that it has to be in D3 state until
+                                * it gets a D0 Inform, but we are backing off from suspend.
+                                * Ensure that Dongle is brought back to D0.
+                                *
+                                * Bringing back Dongle from D3 Ack state to D0 state is a
+                                * 2 step process. Dongle would want to know that D0 Inform
+                                * would be sent as a MB interrupt to bring it out of D3 Ack
+                                * state to D0 state. So we have to send both this message.
+                                */
+
+                               /* Clear wait_for_d3_ack to send D0_INFORM or host_ready */
+                               bus->wait_for_d3_ack = 0;
+
+                               DHD_SET_BUS_NOT_IN_LPS(bus);
+#ifdef PCIE_INB_DW
+                               if (INBAND_DW_ENAB(bus)) {
+                                       DHD_BUS_INB_DW_LOCK(bus->inb_lock, flags);
+                                       /* Since suspend has failed due to wakelock is held,
+                                        * update the DS state to DW_DEVICE_HOST_WAKE_WAIT.
+                                        * So that host sends the DS-ACK for DS-REQ.
+                                        */
+                                       DHD_ERROR(("Suspend failed due to wakelock is held, "
+                                        "set inband dw state to DW_DEVICE_HOST_WAKE_WAIT\n"));
+                                       dhdpcie_bus_set_pcie_inband_dw_state(bus,
+                                               DW_DEVICE_HOST_WAKE_WAIT);
+                                       dhd_bus_ds_trace(bus, 0, TRUE,
+                                               dhdpcie_bus_get_pcie_inband_dw_state(bus));
+                                       DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+                               }
+                               bus->skip_ds_ack = FALSE;
+#endif /* PCIE_INB_DW */
+                               /* For Linux, Macos etc (otherthan NDIS) enable back the dongle
+                                * interrupts using intmask and host interrupts
+                                * which were disabled in the dhdpcie_bus_isr()->
+                                * dhd_bus_handle_d3_ack().
+                                */
+                               /* Enable back interrupt using Intmask!! */
+                               dhdpcie_bus_intr_enable(bus);
+                               /* Defer enabling host irq after RPM suspend failure */
+                               if (!DHD_BUS_BUSY_CHECK_RPM_SUSPEND_IN_PROGRESS(bus->dhd)) {
+                                       /* Enable back interrupt from Host side!! */
+                                       if (dhdpcie_irq_disabled(bus)) {
+                                               dhdpcie_enable_irq(bus);
+                                               bus->resume_intr_enable_count++;
+                                       }
+                               }
+                               if (bus->use_d0_inform) {
+                                       DHD_OS_WAKE_LOCK_WAIVE(bus->dhd);
+                                       dhdpcie_send_mb_data(bus,
+                                               (H2D_HOST_D0_INFORM_IN_USE | H2D_HOST_D0_INFORM));
+                                       DHD_OS_WAKE_LOCK_RESTORE(bus->dhd);
+                               }
+                               /* ring doorbell 1 (hostready) */
+                               dhd_bus_hostready(bus);
+
+                               DHD_GENERAL_LOCK(bus->dhd, flags);
+                               bus->dhd->busstate = DHD_BUS_DATA;
+                               /* resume all interface network queue. */
+                               dhd_bus_start_queue(bus);
+                               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+                               rc = BCME_ERROR;
+                       } else {
+                               /* Actual Suspend after no wakelock */
+                               /* At this time bus->bus_low_power_state will be
+                                * made to DHD_BUS_D3_ACK_RECIEVED after recieving D3_ACK
+                                * in dhd_bus_handle_d3_ack()
+                                */
+#ifdef PCIE_INB_DW
+                               if (INBAND_DW_ENAB(bus)) {
+                                       DHD_BUS_INB_DW_LOCK(bus->inb_lock, flags);
+                                       if (dhdpcie_bus_get_pcie_inband_dw_state(bus) ==
+                                               DW_DEVICE_HOST_SLEEP_WAIT) {
+                                               dhdpcie_bus_set_pcie_inband_dw_state(bus,
+                                                       DW_DEVICE_HOST_SLEEP);
+#ifdef PCIE_INB_DW
+                                               dhd_bus_ds_trace(bus, 0, TRUE,
+                                                       dhdpcie_bus_get_pcie_inband_dw_state(bus));
+#else
+                                               dhd_bus_ds_trace(bus, 0, TRUE);
+#endif /* PCIE_INB_DW */
+                                       }
+                                       DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+                               }
+#endif /* PCIE_INB_DW */
+                               if (bus->use_d0_inform &&
+                                       (bus->api.fw_rev < PCIE_SHARED_VERSION_6)) {
+                                       DHD_OS_WAKE_LOCK_WAIVE(bus->dhd);
+                                       dhdpcie_send_mb_data(bus, (H2D_HOST_D0_INFORM_IN_USE));
+                                       DHD_OS_WAKE_LOCK_RESTORE(bus->dhd);
+                               }
+
+#if defined(BCMPCIE_OOB_HOST_WAKE)
+                               if (bus->dhd->dhd_induce_error == DHD_INDUCE_DROP_OOB_IRQ) {
+                                       DHD_ERROR(("%s: Inducing DROP OOB IRQ\n", __FUNCTION__));
+                               } else {
+                                       dhdpcie_oob_intr_set(bus, TRUE);
+                               }
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+                               DHD_GENERAL_LOCK(bus->dhd, flags);
+                               /* The Host cannot process interrupts now so disable the same.
+                                * No need to disable the dongle INTR using intmask, as we are
+                                * already calling disabling INTRs from DPC context after
+                                * getting D3_ACK in dhd_bus_handle_d3_ack.
+                                * Code may not look symmetric between Suspend and
+                                * Resume paths but this is done to close down the timing window
+                                * between DPC and suspend context and bus->bus_low_power_state
+                                * will be set to DHD_BUS_D3_ACK_RECIEVED in DPC.
+                                */
+                               bus->dhd->d3ackcnt_timeout = 0;
+                               bus->dhd->busstate = DHD_BUS_SUSPEND;
+                               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+                               dhdpcie_dump_resource(bus);
+                               rc = dhdpcie_pci_suspend_resume(bus, state);
+                               if (!rc) {
+                                       bus->last_suspend_end_time = OSL_LOCALTIME_NS();
+                               }
+                       }
+               } else if (timeleft == 0) { /* D3 ACK Timeout */
+#ifdef DHD_FW_COREDUMP
+                       uint32 cur_memdump_mode = bus->dhd->memdump_enabled;
+#endif /* DHD_FW_COREDUMP */
+
+                       /* check if the D3 ACK timeout due to scheduling issue */
+                       bus->dhd->is_sched_error = !dhd_query_bus_erros(bus->dhd) &&
+                               bus->isr_entry_time > bus->last_d3_inform_time &&
+                               dhd_bus_query_dpc_sched_errors(bus->dhd);
+                       bus->dhd->d3ack_timeout_occured = TRUE;
+                       /* If the D3 Ack has timeout */
+                       bus->dhd->d3ackcnt_timeout++;
+                       DHD_ERROR(("%s: resumed on timeout for D3 ACK%s d3_inform_cnt %d\n",
+                               __FUNCTION__, bus->dhd->is_sched_error ?
+                               " due to scheduling problem" : "", bus->dhd->d3ackcnt_timeout));
+#if defined(DHD_KERNEL_SCHED_DEBUG) && defined(DHD_FW_COREDUMP)
+                       /* XXX DHD triggers Kernel panic if the resumed on timeout occurrs
+                        * due to tasklet or workqueue scheduling problems in the Linux Kernel.
+                        * Customer informs that it is hard to find any clue from the
+                        * host memory dump since the important tasklet or workqueue information
+                        * is already disappered due the latency while printing out the timestamp
+                        * logs for debugging scan timeout issue.
+                        * For this reason, customer requestes us to trigger Kernel Panic rather
+                        * than taking a SOCRAM dump.
+                        */
+                       if (bus->dhd->is_sched_error && cur_memdump_mode == DUMP_MEMFILE_BUGON) {
+                               /* change g_assert_type to trigger Kernel panic */
+                               g_assert_type = 2;
+                               /* use ASSERT() to trigger panic */
+                               ASSERT(0);
+                       }
+#endif /* DHD_KERNEL_SCHED_DEBUG && DHD_FW_COREDUMP */
+                       DHD_SET_BUS_NOT_IN_LPS(bus);
+
+                       DHD_GENERAL_LOCK(bus->dhd, flags);
+                       bus->dhd->busstate = DHD_BUS_DATA;
+                       /* resume all interface network queue. */
+                       dhd_bus_start_queue(bus);
+                       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+                       /* XXX : avoid multiple socram dump from dongle trap and
+                        * invalid PCIe bus assceess due to PCIe link down
+                        */
+                       if (!bus->dhd->dongle_trap_occured &&
+                               !bus->is_linkdown &&
+                               !bus->cto_triggered) {
+                               uint32 intstatus = 0;
+
+                               /* Check if PCIe bus status is valid */
+                               intstatus = si_corereg(bus->sih, bus->sih->buscoreidx,
+                                       bus->pcie_mailbox_int, 0, 0);
+                               if (intstatus == (uint32)-1) {
+                                       /* Invalidate PCIe bus status */
+                                       bus->is_linkdown = 1;
+                               }
+
+                               dhd_bus_dump_console_buffer(bus);
+                               dhd_prot_debug_info_print(bus->dhd);
+#ifdef DHD_FW_COREDUMP
+                               if (cur_memdump_mode) {
+                                       /* write core dump to file */
+                                       bus->dhd->memdump_type = DUMP_TYPE_D3_ACK_TIMEOUT;
+                                       dhdpcie_mem_dump(bus);
+                               }
+#endif /* DHD_FW_COREDUMP */
+
+                               DHD_ERROR(("%s: Event HANG send up due to D3_ACK timeout\n",
+                                       __FUNCTION__));
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+                               bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+                               dhd_os_check_hang(bus->dhd, 0, -ETIMEDOUT);
+                       }
+#if defined(DHD_ERPOM)
+                       dhd_schedule_reset(bus->dhd);
+#endif
+                       rc = -ETIMEDOUT;
+               }
+       } else {
+               /* Resume */
+               DHD_ERROR(("%s: Entering resume state\n", __FUNCTION__));
+               bus->last_resume_start_time = OSL_LOCALTIME_NS();
+
+               /**
+                * PCIE2_BAR0_CORE2_WIN gets reset after D3 cold.
+                * si_backplane_access(function to read/write backplane)
+                * updates the window(PCIE2_BAR0_CORE2_WIN) only if
+                * window being accessed is different form the window
+                * being pointed by second_bar0win.
+                * Since PCIE2_BAR0_CORE2_WIN is already reset because of D3 cold,
+                * invalidating second_bar0win after resume updates
+                * PCIE2_BAR0_CORE2_WIN with right window.
+                */
+               si_invalidate_second_bar0win(bus->sih);
+#if defined(BCMPCIE_OOB_HOST_WAKE)
+               DHD_OS_OOB_IRQ_WAKE_UNLOCK(bus->dhd);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef PCIE_INB_DW
+               if (INBAND_DW_ENAB(bus)) {
+                       DHD_BUS_INB_DW_LOCK(bus->inb_lock, flags);
+                       if (dhdpcie_bus_get_pcie_inband_dw_state(bus) == DW_DEVICE_HOST_SLEEP) {
+                               dhdpcie_bus_set_pcie_inband_dw_state(bus, DW_DEVICE_HOST_WAKE_WAIT);
+#ifdef PCIE_INB_DW
+                               dhd_bus_ds_trace(bus, 0, TRUE,
+                                       dhdpcie_bus_get_pcie_inband_dw_state(bus));
+#else
+                               dhd_bus_ds_trace(bus, 0, TRUE);
+#endif /* PCIE_INB_DW */
+                       }
+                       DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+               }
+               bus->skip_ds_ack = FALSE;
+#endif /* PCIE_INB_DW */
+               rc = dhdpcie_pci_suspend_resume(bus, state);
+               dhdpcie_dump_resource(bus);
+
+               /* set bus_low_power_state to DHD_BUS_NO_LOW_POWER_STATE */
+               DHD_SET_BUS_NOT_IN_LPS(bus);
+
+               if (!rc && bus->dhd->busstate == DHD_BUS_SUSPEND) {
+                       if (bus->use_d0_inform) {
+                               DHD_OS_WAKE_LOCK_WAIVE(bus->dhd);
+                               dhdpcie_send_mb_data(bus, (H2D_HOST_D0_INFORM));
+                               DHD_OS_WAKE_LOCK_RESTORE(bus->dhd);
+                       }
+                       /* ring doorbell 1 (hostready) */
+                       dhd_bus_hostready(bus);
+               }
+               DHD_GENERAL_LOCK(bus->dhd, flags);
+               bus->dhd->busstate = DHD_BUS_DATA;
+#ifdef DHD_PCIE_RUNTIMEPM
+               if (DHD_BUS_BUSY_CHECK_RPM_SUSPEND_DONE(bus->dhd)) {
+                       bus->bus_wake = 1;
+                       OSL_SMP_WMB();
+                       wake_up(&bus->rpm_queue);
+               }
+#endif /* DHD_PCIE_RUNTIMEPM */
+               /* resume all interface network queue. */
+               dhd_bus_start_queue(bus);
+
+               /* For Linux, Macos etc (otherthan NDIS) enable back the dongle interrupts
+                * using intmask and host interrupts
+                * which were disabled in the dhdpcie_bus_isr()->dhd_bus_handle_d3_ack().
+                */
+               dhdpcie_bus_intr_enable(bus); /* Enable back interrupt using Intmask!! */
+               /* Defer enabling host interrupt until RPM resume done */
+               if (!DHD_BUS_BUSY_CHECK_RPM_RESUME_IN_PROGRESS(bus->dhd)) {
+                       if (dhdpcie_irq_disabled(bus)) {
+                               dhdpcie_enable_irq(bus);
+                               bus->resume_intr_enable_count++;
+                       }
+               }
+
+               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+               if (bus->dhd->dhd_watchdog_ms_backup) {
+                       DHD_ERROR(("%s: Enabling wdtick after resume\n",
+                               __FUNCTION__));
+                       dhd_os_wd_timer(bus->dhd, bus->dhd->dhd_watchdog_ms_backup);
+               }
+
+               bus->last_resume_end_time = OSL_LOCALTIME_NS();
+
+               /* Update TCM rd index for EDL ring */
+               DHD_EDL_RING_TCM_RD_UPDATE(bus->dhd);
+
+       }
+       return rc;
+}
+
+#define BUS_SUSPEND    TRUE
+#define BUS_RESUME     FALSE
+int dhd_bus_suspend(dhd_pub_t *dhd)
+{
+       int ret;
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       /* TODO: Check whether the arguments are correct */
+       ret = dhdpcie_bus_suspend(dhd->bus, TRUE, BUS_SUSPEND);
+#else
+       ret = dhdpcie_bus_suspend(dhd->bus, BUS_SUSPEND);
+#endif
+       return ret;
+}
+
+int dhd_bus_resume(dhd_pub_t *dhd, int stage)
+{
+       int ret;
+       BCM_REFERENCE(stage);
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       /* TODO: Check whether the arguments are correct */
+       ret = dhdpcie_bus_suspend(dhd->bus, FALSE, BUS_RESUME);
+#else
+       ret = dhdpcie_bus_suspend(dhd->bus, BUS_RESUME);
+#endif
+       return ret;
+}
+
+uint32
+dhdpcie_force_alp(struct dhd_bus *bus, bool enable)
+{
+       ASSERT(bus && bus->sih);
+       if (enable) {
+       si_corereg(bus->sih, bus->sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, u.pcie2.clk_ctl_st), CCS_FORCEALP, CCS_FORCEALP);
+       } else {
+               si_corereg(bus->sih, bus->sih->buscoreidx,
+                       OFFSETOF(sbpcieregs_t, u.pcie2.clk_ctl_st), CCS_FORCEALP, 0);
+       }
+       return 0;
+}
+
+/* set pcie l1 entry time: dhd pciereg 0x1004[22:16] */
+uint32
+dhdpcie_set_l1_entry_time(struct dhd_bus *bus, int l1_entry_time)
+{
+       uint reg_val;
+
+       ASSERT(bus && bus->sih);
+
+       si_corereg(bus->sih, bus->sih->buscoreidx, OFFSETOF(sbpcieregs_t, configaddr), ~0,
+               0x1004);
+       reg_val = si_corereg(bus->sih, bus->sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, configdata), 0, 0);
+       reg_val = (reg_val & ~(0x7f << 16)) | ((l1_entry_time & 0x7f) << 16);
+       si_corereg(bus->sih, bus->sih->buscoreidx, OFFSETOF(sbpcieregs_t, configdata), ~0,
+               reg_val);
+
+       return 0;
+}
+
+static uint32
+dhd_apply_d11_war_length(struct  dhd_bus *bus, uint32 len, uint32 d11_lpbk)
+{
+       uint16 chipid = si_chipid(bus->sih);
+       /*
+        * XXX: WAR for CRWLDOT11M-3011
+        * program the DMA descriptor Buffer length as the expected frame length
+        *  + 8 bytes extra for corerev 82 when buffer length % 128 is equal to 4
+        */
+       if ((chipid == BCM4375_CHIP_ID ||
+               chipid == BCM4362_CHIP_ID ||
+               chipid == BCM4377_CHIP_ID ||
+               chipid == BCM43751_CHIP_ID ||
+               chipid == BCM43752_CHIP_ID) &&
+               (d11_lpbk != M2M_DMA_LPBK && d11_lpbk != M2M_NON_DMA_LPBK)) {
+                       len += 8;
+       }
+       DHD_ERROR(("%s: len %d\n", __FUNCTION__, len));
+       return len;
+}
+
+/** Transfers bytes from host to dongle and to host again using DMA */
+static int
+dhdpcie_bus_dmaxfer_req(struct  dhd_bus *bus,
+               uint32 len, uint32 srcdelay, uint32 destdelay,
+               uint32 d11_lpbk, uint32 core_num, uint32 wait)
+{
+       int ret = 0;
+
+       if (bus->dhd == NULL) {
+               DHD_ERROR(("%s: bus not inited\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+       if (bus->dhd->prot == NULL) {
+               DHD_ERROR(("%s: prot is not inited\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+       if (bus->dhd->busstate != DHD_BUS_DATA) {
+               DHD_ERROR(("%s: not in a readystate to LPBK  is not inited\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (len < 5 || len > 4194296) {
+               DHD_ERROR(("%s: len is too small or too large\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       len = dhd_apply_d11_war_length(bus, len, d11_lpbk);
+
+       bus->dmaxfer_complete = FALSE;
+       ret = dhdmsgbuf_dmaxfer_req(bus->dhd, len, srcdelay, destdelay,
+               d11_lpbk, core_num);
+       if (ret != BCME_OK || !wait) {
+               DHD_INFO(("%s: dmaxfer req returns status %u; wait = %u\n", __FUNCTION__,
+                               ret, wait));
+       } else {
+               ret = dhd_os_dmaxfer_wait(bus->dhd, &bus->dmaxfer_complete);
+               if (ret < 0)
+                       ret = BCME_NOTREADY;
+       }
+
+       return ret;
+
+}
+
+bool
+dhd_bus_is_multibp_capable(struct dhd_bus *bus)
+{
+       return MULTIBP_CAP(bus->sih);
+}
+
+#define PCIE_REV_FOR_4378A0    66      /* dhd_bus_perform_flr_with_quiesce() causes problems */
+#define PCIE_REV_FOR_4378B0    68
+
+static int
+dhdpcie_bus_download_state(dhd_bus_t *bus, bool enter)
+{
+       int bcmerror = 0;
+       volatile uint32 *cr4_regs;
+       bool do_flr;
+       bool do_wr_flops = TRUE;
+
+       if (!bus->sih) {
+               DHD_ERROR(("%s: NULL sih!!\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       do_flr = ((bus->sih->buscorerev != PCIE_REV_FOR_4378A0) &&
+                       (bus->sih->buscorerev != PCIE_REV_FOR_4378B0));
+
+       /*
+        * Jira SWWLAN-214966: 4378B0 BToverPCIe: fails to download firmware
+        *   with "insmod dhd.ko firmware_path=rtecdc.bin nvram_path=nvram.txt" format
+        *   CTO is seen during autoload case.
+        * Need to assert PD1 power req during ARM out of reset.
+        * And doing FLR after this would conflict as FLR resets PCIe enum space.
+        */
+       if (MULTIBP_ENAB(bus->sih) && !do_flr) {
+               dhd_bus_pcie_pwr_req(bus);
+       }
+
+       /* To enter download state, disable ARM and reset SOCRAM.
+        * To exit download state, simply reset ARM (default is RAM boot).
+        */
+       if (enter) {
+
+               /* Make sure BAR1 maps to backplane address 0 */
+               dhdpcie_setbar1win(bus, 0x00000000);
+               bus->alp_only = TRUE;
+#ifdef GDB_PROXY
+               bus->gdb_proxy_access_enabled = TRUE;
+               bus->gdb_proxy_bootloader_mode = FALSE;
+#endif /* GDB_PROXY */
+
+               /* some chips (e.g. 43602) have two ARM cores, the CR4 is receives the firmware. */
+               cr4_regs = si_setcore(bus->sih, ARMCR4_CORE_ID, 0);
+
+               if (cr4_regs == NULL && !(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
+                   !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0)) &&
+                   !(si_setcore(bus->sih, ARMCA7_CORE_ID, 0))) {
+                       DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
+                       bcmerror = BCME_ERROR;
+                       goto fail;
+               }
+
+               if (si_setcore(bus->sih, ARMCA7_CORE_ID, 0)) {
+                       /* Halt ARM & remove reset */
+                       si_core_reset(bus->sih, SICF_CPUHALT, SICF_CPUHALT);
+                       if (!(si_setcore(bus->sih, SYSMEM_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find SYSMEM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+                       si_core_reset(bus->sih, 0, 0);
+                       /* reset last 4 bytes of RAM address. to be used for shared area */
+                       dhdpcie_init_shared_addr(bus);
+               } else if (cr4_regs == NULL) { /* no CR4 present on chip */
+                       si_core_disable(bus->sih, 0);
+
+                       if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+
+                       si_core_reset(bus->sih, 0, 0);
+
+                       /* Clear the top bit of memory */
+                       if (bus->ramsize) {
+                               uint32 zeros = 0;
+                               if (dhdpcie_bus_membytes(bus, TRUE, bus->ramsize - 4,
+                                                    (uint8*)&zeros, 4) < 0) {
+                                       bcmerror = BCME_ERROR;
+                                       goto fail;
+                               }
+                       }
+               } else {
+                       /* For CR4,
+                        * Halt ARM
+                        * Remove ARM reset
+                        * Read RAM base address [0x18_0000]
+                        * [next] Download firmware
+                        * [done at else] Populate the reset vector
+                        * [done at else] Remove ARM halt
+                       */
+                       /* Halt ARM & remove reset */
+                       si_core_reset(bus->sih, SICF_CPUHALT, SICF_CPUHALT);
+                       if (BCM43602_CHIP(bus->sih->chip)) {
+                               /* XXX CRWLARMCR4-53 43602a0 HW bug when banks are powered down */
+                               W_REG(bus->pcie_mb_intr_osh, cr4_regs + ARMCR4REG_BANKIDX, 5);
+                               W_REG(bus->pcie_mb_intr_osh, cr4_regs + ARMCR4REG_BANKPDA, 0);
+                               W_REG(bus->pcie_mb_intr_osh, cr4_regs + ARMCR4REG_BANKIDX, 7);
+                               W_REG(bus->pcie_mb_intr_osh, cr4_regs + ARMCR4REG_BANKPDA, 0);
+                       }
+                       /* reset last 4 bytes of RAM address. to be used for shared area */
+                       dhdpcie_init_shared_addr(bus);
+               }
+       } else {
+               if (si_setcore(bus->sih, ARMCA7_CORE_ID, 0)) {
+                       /* write vars */
+                       if ((bcmerror = dhdpcie_bus_write_vars(bus))) {
+                               DHD_ERROR(("%s: could not write vars to RAM\n", __FUNCTION__));
+                               goto fail;
+                       }
+                       /* write random numbers to sysmem for the purpose of
+                        * randomizing heap address space.
+                        */
+                       if ((bcmerror = dhdpcie_wrt_rnd(bus)) != BCME_OK) {
+                               DHD_ERROR(("%s: Failed to get random seed to write to TCM !\n",
+                                       __FUNCTION__));
+                               goto fail;
+                       }
+
+#if defined(FW_SIGNATURE)
+                       if ((bcmerror = dhdpcie_bus_download_fw_signature(bus, &do_wr_flops))
+                               != BCME_OK) {
+                               goto fail;
+                       }
+#endif /* FW_SIGNATURE */
+
+                       if (do_wr_flops) {
+                               /* switch back to arm core again */
+                               if (!(si_setcore(bus->sih, ARMCA7_CORE_ID, 0))) {
+                                       DHD_ERROR(("%s: Failed to find ARM CA7 core!\n",
+                                               __FUNCTION__));
+                                       bcmerror = BCME_ERROR;
+                                       goto fail;
+                               }
+                               /* write address 0 with reset instruction */
+                               bcmerror = dhdpcie_bus_membytes(bus, TRUE, 0,
+                                       (uint8 *)&bus->resetinstr, sizeof(bus->resetinstr));
+                               /* now remove reset and halt and continue to run CA7 */
+                       }
+               } else if (!si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+                       if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+
+                       if (!si_iscoreup(bus->sih)) {
+                               DHD_ERROR(("%s: SOCRAM core is down after reset?\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+
+                       /* Enable remap before ARM reset but after vars.
+                        * No backplane access in remap mode
+                        */
+                       if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0) &&
+                           !si_setcore(bus->sih, SDIOD_CORE_ID, 0)) {
+                               DHD_ERROR(("%s: Can't change back to SDIO core?\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+
+                       /* XXX Change standby configuration here if necessary */
+
+                       if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
+                           !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+               } else {
+                       if (BCM43602_CHIP(bus->sih->chip)) {
+                               /* Firmware crashes on SOCSRAM access when core is in reset */
+                               if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+                                       DHD_ERROR(("%s: Failed to find SOCRAM core!\n",
+                                               __FUNCTION__));
+                                       bcmerror = BCME_ERROR;
+                                       goto fail;
+                               }
+                               si_core_reset(bus->sih, 0, 0);
+                               si_setcore(bus->sih, ARMCR4_CORE_ID, 0);
+                       }
+
+                       /* write vars */
+                       if ((bcmerror = dhdpcie_bus_write_vars(bus))) {
+                               DHD_ERROR(("%s: could not write vars to RAM\n", __FUNCTION__));
+                               goto fail;
+                       }
+
+                       /* write a random number rTLV to TCM for the purpose of
+                        * randomizing heap address space.
+                        */
+                       if ((bcmerror = dhdpcie_wrt_rnd(bus)) != BCME_OK) {
+                               DHD_ERROR(("%s: Failed to get random seed to write to TCM !\n",
+                                       __FUNCTION__));
+                               goto fail;
+                       }
+
+#if defined(FW_SIGNATURE)
+                       if ((bcmerror = dhdpcie_bus_download_fw_signature(bus, &do_wr_flops))
+                               != BCME_OK) {
+                               goto fail;
+                       }
+#endif /* FW_SIGNATURE */
+                       if (do_wr_flops) {
+                               /* switch back to arm core again */
+                               if (!(si_setcore(bus->sih, ARMCR4_CORE_ID, 0))) {
+                                       DHD_ERROR(("%s: Failed to find ARM CR4 core!\n",
+                                               __FUNCTION__));
+                                       bcmerror = BCME_ERROR;
+                                       goto fail;
+                               }
+
+                               /* write address 0 with reset instruction */
+                               bcmerror = dhdpcie_bus_membytes(bus, TRUE, 0,
+                                       (uint8 *)&bus->resetinstr, sizeof(bus->resetinstr));
+
+                               if (bcmerror == BCME_OK) {
+                                       uint32 tmp;
+
+                                       bcmerror = dhdpcie_bus_membytes(bus, FALSE, 0,
+                                                                       (uint8 *)&tmp, sizeof(tmp));
+
+                                       if (bcmerror == BCME_OK && tmp != bus->resetinstr) {
+                                               DHD_ERROR(("%s: Failed to write 0x%08x to addr 0\n",
+                                                         __FUNCTION__, bus->resetinstr));
+                                               DHD_ERROR(("%s: contents of addr 0 is 0x%08x\n",
+                                                         __FUNCTION__, tmp));
+                                               bcmerror = BCME_ERROR;
+                                               goto fail;
+                                       }
+                               }
+                               /* now remove reset and halt and continue to run CR4 */
+                       }
+               }
+
+               bus->arm_oor_time = OSL_LOCALTIME_NS();
+               si_core_reset(bus->sih, 0, 0);
+
+               /* Allow HT Clock now that the ARM is running. */
+               bus->alp_only = FALSE;
+
+               bus->dhd->busstate = DHD_BUS_LOAD;
+       }
+
+fail:
+       /* Always return to PCIE core */
+       si_setcore(bus->sih, PCIE2_CORE_ID, 0);
+
+       if (MULTIBP_ENAB(bus->sih) && !do_flr) {
+               dhd_bus_pcie_pwr_req_clear(bus);
+       }
+
+       return bcmerror;
+} /* dhdpcie_bus_download_state */
+
+#if defined(FW_SIGNATURE)
+
+static int
+dhdpcie_bus_download_fw_signature(dhd_bus_t *bus, bool *do_write)
+{
+       int bcmerror = BCME_OK;
+
+       DHD_INFO(("FWSIG: bl=%s,%x fw=%x,%u sig=%s,%x,%u"
+               " stat=%x,%u ram=%x,%x\n",
+               bus->bootloader_filename, bus->bootloader_addr,
+               bus->fw_download_addr, bus->fw_download_len,
+               bus->fwsig_filename, bus->fwsig_download_addr,
+               bus->fwsig_download_len,
+               bus->fwstat_download_addr, bus->fwstat_download_len,
+               bus->dongle_ram_base, bus->ramtop_addr));
+
+       if (bus->fwsig_filename[0] == 0) {
+               DHD_INFO(("%s: missing signature file\n", __FUNCTION__));
+               goto exit;
+       }
+
+       /* Write RAM Bootloader to TCM if requested */
+       if ((bcmerror = dhdpcie_bus_download_ram_bootloader(bus))
+               != BCME_OK) {
+               DHD_ERROR(("%s: could not write RAM BL to TCM, err %d\n",
+                       __FUNCTION__, bcmerror));
+               goto exit;
+       }
+
+       /* Write FW signature rTLV to TCM */
+       if ((bcmerror = dhdpcie_bus_write_fwsig(bus, bus->fwsig_filename,
+               NULL))) {
+               DHD_ERROR(("%s: could not write FWsig to TCM, err %d\n",
+                       __FUNCTION__, bcmerror));
+               goto exit;
+       }
+
+       /* Write FW signature verification status rTLV to TCM */
+       if ((bcmerror = dhdpcie_bus_write_fws_status(bus)) != BCME_OK) {
+               DHD_ERROR(("%s: could not write FWinfo to TCM, err %d\n",
+                       __FUNCTION__, bcmerror));
+               goto exit;
+       }
+
+       /* Write FW memory map rTLV to TCM */
+       if ((bcmerror = dhdpcie_bus_write_fws_mem_info(bus)) != BCME_OK) {
+               DHD_ERROR(("%s: could not write FWinfo to TCM, err %d\n",
+                       __FUNCTION__, bcmerror));
+               goto exit;
+       }
+
+       /* Write a end-of-TLVs marker to TCM */
+       if ((bcmerror = dhdpcie_download_rtlv_end(bus)) != BCME_OK) {
+               DHD_ERROR(("%s: could not write rTLV-end marker to TCM, err %d\n",
+                       __FUNCTION__, bcmerror));
+               goto exit;
+       }
+
+       /* In case of BL RAM, do write flops */
+       if (bus->bootloader_filename[0] != 0) {
+               *do_write = TRUE;
+       } else {
+               *do_write = FALSE;
+       }
+
+exit:
+       return bcmerror;
+}
+
+/* Download a reversed-TLV to the top of dongle RAM without overlapping any existing rTLVs */
+static int
+dhdpcie_download_rtlv(dhd_bus_t *bus, dngl_rtlv_type_t type, dngl_rtlv_len_t len, uint8 *value)
+{
+       int bcmerror = BCME_OK;
+#ifdef DHD_DEBUG
+       uint8 *readback_buf = NULL;
+       uint32 readback_val = 0;
+#endif /* DHD_DEBUG */
+       uint32 dest_addr = 0;           /* dongle RAM dest address */
+       uint32 dest_size = 0;           /* dongle RAM dest size */
+       uint32 dest_raw_size = 0;       /* dest size with added checksum */
+
+       /* Calculate the destination dongle RAM address and size */
+       dest_size = ROUNDUP(len, 4);
+       dest_addr = bus->ramtop_addr - sizeof(dngl_rtlv_type_t) - sizeof(dngl_rtlv_len_t)
+               - dest_size;
+       bus->ramtop_addr = dest_addr;
+
+       /* Create the rTLV size field.  This consists of 2 16-bit fields:
+        * The lower 16 bits is the size.  The higher 16 bits is a checksum
+        * consisting of the size with all bits reversed.
+        *     +-------------+-------------+
+        *     |   checksum  |   size      |
+        *     +-------------+-------------+
+        *      High 16 bits    Low 16 bits
+        */
+       dest_raw_size = (~dest_size << 16) | (dest_size & 0x0000FFFF);
+
+       /* Write the value block */
+       if (dest_size > 0) {
+               bcmerror = dhdpcie_bus_membytes(bus, TRUE, dest_addr, value, dest_size);
+               if (bcmerror) {
+                       DHD_ERROR(("%s: error %d on writing %d membytes to 0x%08x\n",
+                               __FUNCTION__, bcmerror, dest_size, dest_addr));
+                       goto exit;
+               }
+       }
+
+       /* Write the length word */
+       bcmerror = dhdpcie_bus_membytes(bus, TRUE, dest_addr + dest_size,
+               (uint8*)&dest_raw_size, sizeof(dngl_rtlv_len_t));
+
+       /* Write the type word */
+       bcmerror = dhdpcie_bus_membytes(bus, TRUE,
+               dest_addr + dest_size + sizeof(dngl_rtlv_len_t),
+               (uint8*)&type, sizeof(dngl_rtlv_type_t));
+
+#ifdef DHD_DEBUG
+       /* Read back and compare the downloaded data */
+       if (dest_size > 0) {
+               readback_buf = (uint8*)MALLOC(bus->dhd->osh, dest_size);
+               if (!readback_buf) {
+                       bcmerror = BCME_NOMEM;
+                       goto exit;
+               }
+               memset(readback_buf, 0xaa, dest_size);
+               bcmerror = dhdpcie_bus_membytes(bus, FALSE, dest_addr, readback_buf, dest_size);
+               if (bcmerror) {
+                       DHD_ERROR(("%s: readback error %d, %d bytes from 0x%08x\n",
+                               __FUNCTION__, bcmerror, dest_size, dest_addr));
+                       goto exit;
+               }
+               if (memcmp(value, readback_buf, dest_size) != 0) {
+                       DHD_ERROR(("%s: Downloaded data mismatch.\n", __FUNCTION__));
+                       bcmerror = BCME_ERROR;
+                       goto exit;
+               } else {
+                       DHD_ERROR(("Download and compare of TLV 0x%x succeeded"
+                               " (size %u, addr %x).\n", type, dest_size, dest_addr));
+               }
+       }
+
+       /* Read back and compare the downloaded len field */
+       bcmerror = dhdpcie_bus_membytes(bus, FALSE, dest_addr + dest_size,
+               (uint8*)&readback_val, sizeof(dngl_rtlv_len_t));
+       if (!bcmerror) {
+               if (readback_val != dest_raw_size) {
+                       bcmerror = BCME_BADLEN;
+               }
+       }
+       if (bcmerror) {
+               DHD_ERROR(("%s: Downloaded len error %d\n", __FUNCTION__, bcmerror));
+               goto exit;
+       }
+
+       /* Read back and compare the downloaded type field */
+       bcmerror = dhdpcie_bus_membytes(bus, FALSE,
+               dest_addr + dest_size + sizeof(dngl_rtlv_len_t),
+               (uint8*)&readback_val, sizeof(dngl_rtlv_type_t));
+       if (!bcmerror) {
+               if (readback_val != type) {
+                       bcmerror = BCME_BADOPTION;
+               }
+       }
+       if (bcmerror) {
+               DHD_ERROR(("%s: Downloaded type error %d\n", __FUNCTION__, bcmerror));
+               goto exit;
+       }
+#endif /* DHD_DEBUG */
+
+       bus->ramtop_addr = dest_addr;
+
+exit:
+#ifdef DHD_DEBUG
+       if (readback_buf) {
+               MFREE(bus->dhd->osh, readback_buf, dest_size);
+       }
+#endif /* DHD_DEBUG */
+
+       return bcmerror;
+} /* dhdpcie_download_rtlv */
+
+/* Download a reversed-TLV END marker to the top of dongle RAM */
+static int
+dhdpcie_download_rtlv_end(dhd_bus_t *bus)
+{
+       return dhdpcie_download_rtlv(bus, DNGL_RTLV_TYPE_END_MARKER, 0, NULL);
+}
+
+/* Write the FW signature verification status to dongle memory */
+static int
+dhdpcie_bus_write_fws_status(dhd_bus_t *bus)
+{
+       bcm_fwsign_verif_status_t vstatus;
+       int ret;
+
+       bzero(&vstatus, sizeof(vstatus));
+
+       ret = dhdpcie_download_rtlv(bus, DNGL_RTLV_TYPE_FWSIGN_STATUS, sizeof(vstatus),
+               (uint8*)&vstatus);
+       bus->fwstat_download_addr = bus->ramtop_addr;
+       bus->fwstat_download_len = sizeof(vstatus);
+
+       return ret;
+} /* dhdpcie_bus_write_fws_status */
+
+/* Write the FW signature verification memory map to dongle memory */
+static int
+dhdpcie_bus_write_fws_mem_info(dhd_bus_t *bus)
+{
+       bcm_fwsign_mem_info_t memmap;
+       int ret;
+
+       bzero(&memmap, sizeof(memmap));
+       memmap.firmware.start = bus->fw_download_addr;
+       memmap.firmware.end = memmap.firmware.start + bus->fw_download_len;
+       memmap.heap.start = ROUNDUP(memmap.firmware.end + BL_HEAP_START_GAP_SIZE, 4);
+       memmap.heap.end = memmap.heap.start + BL_HEAP_SIZE;
+       memmap.signature.start = bus->fwsig_download_addr;
+       memmap.signature.end = memmap.signature.start + bus->fwsig_download_len;
+       memmap.vstatus.start = bus->fwstat_download_addr;
+       memmap.vstatus.end = memmap.vstatus.start + bus->fwstat_download_len;
+       DHD_INFO(("%s: mem_info: fw=%x-%x heap=%x-%x sig=%x-%x vst=%x-%x res=%x\n",
+               __FUNCTION__,
+               memmap.firmware.start, memmap.firmware.end,
+               memmap.heap.start, memmap.heap.end,
+               memmap.signature.start, memmap.signature.end,
+               memmap.vstatus.start, memmap.vstatus.end,
+               memmap.reset_vec.start));
+
+       ret = dhdpcie_download_rtlv(bus, DNGL_RTLV_TYPE_FWSIGN_MEM_MAP, sizeof(memmap),
+               (uint8*)&memmap);
+       bus->fw_memmap_download_addr = bus->ramtop_addr;
+       bus->fw_memmap_download_len = sizeof(memmap);
+
+       return ret;
+} /* dhdpcie_bus_write_fws_mem_info */
+
+/* Download a bootloader image to dongle RAM */
+static int
+dhdpcie_bus_download_ram_bootloader(dhd_bus_t *bus)
+{
+       int ret = BCME_OK;
+       uint32 dongle_ram_base_save;
+
+       DHD_INFO(("download_bloader: %s,0x%x. ramtop=0x%x\n",
+               bus->bootloader_filename, bus->bootloader_addr, bus->ramtop_addr));
+       if (bus->bootloader_filename[0] == '\0') {
+               return ret;
+       }
+
+       /* Save ram base */
+       dongle_ram_base_save = bus->dongle_ram_base;
+
+       /* Set ram base to bootloader download start address */
+       bus->dongle_ram_base = bus->bootloader_addr;
+
+       /* Download the bootloader image to TCM */
+       ret = dhdpcie_download_code_file(bus, bus->bootloader_filename);
+
+       /* Restore ram base */
+       bus->dongle_ram_base = dongle_ram_base_save;
+
+       return ret;
+} /* dhdpcie_bus_download_ram_bootloader */
+
+/* Save the FW download address and size */
+static int
+dhdpcie_bus_save_download_info(dhd_bus_t *bus, uint32 download_addr,
+       uint32 download_size, const char *signature_fname,
+       const char *bloader_fname, uint32 bloader_download_addr)
+{
+       bus->fw_download_len = download_size;
+       bus->fw_download_addr = download_addr;
+       strlcpy(bus->fwsig_filename, signature_fname, sizeof(bus->fwsig_filename));
+       strlcpy(bus->bootloader_filename, bloader_fname, sizeof(bus->bootloader_filename));
+       bus->bootloader_addr = bloader_download_addr;
+#ifdef GDB_PROXY
+       /* GDB proxy bootloader mode - if signature file specified (i.e.
+        * bootloader is used), but bootloader is not specified (i.e. ROM
+        * bootloader is uses).
+        * Bootloader mode is significant only for for preattachment debugging
+        * of chips, in which debug cell can't be initialized before ARM CPU
+        * start
+        */
+       bus->gdb_proxy_bootloader_mode =
+               (bus->fwsig_filename[0] != 0) && (bus->bootloader_filename[0] == 0);
+#endif /* GDB_PROXY */
+       return BCME_OK;
+} /* dhdpcie_bus_save_download_info */
+
+/* Read a small binary file and write it to the specified socram dest address */
+static int
+dhdpcie_download_sig_file(dhd_bus_t *bus, char *path, uint32 type)
+{
+       int bcmerror = BCME_OK;
+       void *filep = NULL;
+       uint8 *srcbuf = NULL;
+       int srcsize = 0;
+       int len;
+       uint32 dest_size = 0;   /* dongle RAM dest size */
+
+       if (path == NULL || path[0] == '\0') {
+               DHD_ERROR(("%s: no file\n", __FUNCTION__));
+               bcmerror = BCME_NOTFOUND;
+               goto exit;
+       }
+
+       /* Open file, get size */
+       filep = dhd_os_open_image1(bus->dhd, path);
+       if (filep == NULL) {
+               DHD_ERROR(("%s: error opening file %s\n", __FUNCTION__, path));
+               bcmerror = BCME_NOTFOUND;
+               goto exit;
+       }
+       srcsize = dhd_os_get_image_size(filep);
+       if (srcsize <= 0 || srcsize > MEMBLOCK) {
+               DHD_ERROR(("%s: invalid fwsig size %u\n", __FUNCTION__, srcsize));
+               bcmerror = BCME_BUFTOOSHORT;
+               goto exit;
+       }
+       dest_size = ROUNDUP(srcsize, 4);
+
+       /* Allocate src buffer, read in the entire file */
+       srcbuf = (uint8 *)MALLOCZ(bus->dhd->osh, dest_size);
+       if (!srcbuf) {
+               bcmerror = BCME_NOMEM;
+               goto exit;
+       }
+       len = dhd_os_get_image_block(srcbuf, srcsize, filep);
+       if (len != srcsize) {
+               DHD_ERROR(("%s: dhd_os_get_image_block failed (%d)\n", __FUNCTION__, len));
+               bcmerror = BCME_BADLEN;
+               goto exit;
+       }
+
+       /* Write the src buffer as a rTLV to the dongle */
+       bcmerror = dhdpcie_download_rtlv(bus, type, dest_size, srcbuf);
+
+       bus->fwsig_download_addr = bus->ramtop_addr;
+       bus->fwsig_download_len = dest_size;
+
+exit:
+       if (filep) {
+               dhd_os_close_image1(bus->dhd, filep);
+       }
+       if (srcbuf) {
+               MFREE(bus->dhd->osh, srcbuf, dest_size);
+       }
+
+       return bcmerror;
+} /* dhdpcie_download_sig_file */
+
+static int
+dhdpcie_bus_write_fwsig(dhd_bus_t *bus, char *fwsig_path, char *nvsig_path)
+{
+       int bcmerror = BCME_OK;
+
+       /* Download the FW signature file to the chip */
+       bcmerror = dhdpcie_download_sig_file(bus, fwsig_path, DNGL_RTLV_TYPE_FW_SIGNATURE);
+       if (bcmerror) {
+               goto exit;
+       }
+
+exit:
+       if (bcmerror) {
+               DHD_ERROR(("%s: error %d\n", __FUNCTION__, bcmerror));
+       }
+       return bcmerror;
+} /* dhdpcie_bus_write_fwsig */
+
+/* Dump secure firmware status. */
+static int
+dhd_bus_dump_fws(dhd_bus_t *bus, struct bcmstrbuf *strbuf)
+{
+       bcm_fwsign_verif_status_t status;
+       bcm_fwsign_mem_info_t     meminfo;
+       int                       err = BCME_OK;
+
+       bzero(&status, sizeof(status));
+       if (bus->fwstat_download_addr != 0) {
+               err = dhdpcie_bus_membytes(bus, FALSE, bus->fwstat_download_addr,
+                       (uint8 *)&status, sizeof(status));
+               if (err != BCME_OK) {
+                       DHD_ERROR(("%s: error %d on reading %zu membytes at 0x%08x\n",
+                               __FUNCTION__, err, sizeof(status), bus->fwstat_download_addr));
+                       return (err);
+               }
+       }
+
+       bzero(&meminfo, sizeof(meminfo));
+       if (bus->fw_memmap_download_addr != 0) {
+               err = dhdpcie_bus_membytes(bus, FALSE, bus->fw_memmap_download_addr,
+                       (uint8 *)&meminfo, sizeof(meminfo));
+               if (err != BCME_OK) {
+                       DHD_ERROR(("%s: error %d on reading %zu membytes at 0x%08x\n",
+                               __FUNCTION__, err, sizeof(meminfo), bus->fw_memmap_download_addr));
+                       return (err);
+               }
+       }
+
+       bcm_bprintf(strbuf, "Firmware signing\nSignature: (%08x) len (%d)\n",
+               bus->fwsig_download_addr, bus->fwsig_download_len);
+
+       bcm_bprintf(strbuf,
+               "Verification status: (%08x)\n"
+               "\tstatus: %d\n"
+               "\tstate: %u\n"
+               "\talloc_bytes: %u\n"
+               "\tmax_alloc_bytes: %u\n"
+               "\ttotal_alloc_bytes: %u\n"
+               "\ttotal_freed_bytes: %u\n"
+               "\tnum_allocs: %u\n"
+               "\tmax_allocs: %u\n"
+               "\tmax_alloc_size: %u\n"
+               "\talloc_failures: %u\n",
+               bus->fwstat_download_addr,
+               status.status,
+               status.state,
+               status.alloc_bytes,
+               status.max_alloc_bytes,
+               status.total_alloc_bytes,
+               status.total_freed_bytes,
+               status.num_allocs,
+               status.max_allocs,
+               status.max_alloc_size,
+               status.alloc_failures);
+
+       bcm_bprintf(strbuf,
+               "Memory info: (%08x)\n"
+               "\tfw   %08x-%08x\n\theap %08x-%08x\n\tsig  %08x-%08x\n\tvst  %08x-%08x\n",
+               bus->fw_memmap_download_addr,
+               meminfo.firmware.start,  meminfo.firmware.end,
+               meminfo.heap.start,      meminfo.heap.end,
+               meminfo.signature.start, meminfo.signature.end,
+               meminfo.vstatus.start,   meminfo.vstatus.end);
+
+       return (err);
+}
+#endif /* FW_SIGNATURE */
+
+/* Write nvram data to the top of dongle RAM, ending with a size in # of 32-bit words */
+static int
+dhdpcie_bus_write_vars(dhd_bus_t *bus)
+{
+       int bcmerror = 0;
+       uint32 varsize, phys_size;
+       uint32 varaddr;
+       uint8 *vbuffer;
+       uint32 varsizew;
+#ifdef DHD_DEBUG
+       uint8 *nvram_ularray;
+#endif /* DHD_DEBUG */
+
+       /* Even if there are no vars are to be written, we still need to set the ramsize. */
+       varsize = bus->varsz ? ROUNDUP(bus->varsz, 4) : 0;
+       varaddr = (bus->ramsize - 4) - varsize;
+
+       varaddr += bus->dongle_ram_base;
+       bus->ramtop_addr = varaddr;
+
+       if (bus->vars) {
+
+               /* XXX In case the controller has trouble with odd bytes... */
+               vbuffer = (uint8 *)MALLOC(bus->dhd->osh, varsize);
+               if (!vbuffer)
+                       return BCME_NOMEM;
+
+               bzero(vbuffer, varsize);
+               bcopy(bus->vars, vbuffer, bus->varsz);
+               /* Write the vars list */
+               bcmerror = dhdpcie_bus_membytes(bus, TRUE, varaddr, vbuffer, varsize);
+
+               /* Implement read back and verify later */
+#ifdef DHD_DEBUG
+               /* Verify NVRAM bytes */
+               DHD_INFO(("%s: Compare NVRAM dl & ul; varsize=%d\n", __FUNCTION__, varsize));
+               nvram_ularray = (uint8*)MALLOC(bus->dhd->osh, varsize);
+               if (!nvram_ularray) {
+                       MFREE(bus->dhd->osh, vbuffer, varsize);
+                       return BCME_NOMEM;
+               }
+
+               /* Upload image to verify downloaded contents. */
+               memset(nvram_ularray, 0xaa, varsize);
+
+               /* Read the vars list to temp buffer for comparison */
+               bcmerror = dhdpcie_bus_membytes(bus, FALSE, varaddr, nvram_ularray, varsize);
+               if (bcmerror) {
+                               DHD_ERROR(("%s: error %d on reading %d nvram bytes at 0x%08x\n",
+                                       __FUNCTION__, bcmerror, varsize, varaddr));
+               }
+
+               /* Compare the org NVRAM with the one read from RAM */
+               if (memcmp(vbuffer, nvram_ularray, varsize)) {
+                       DHD_ERROR(("%s: Downloaded NVRAM image is corrupted.\n", __FUNCTION__));
+                       prhex("nvram file", vbuffer, varsize);
+                       prhex("downloaded nvram", nvram_ularray, varsize);
+                       MFREE(bus->dhd->osh, nvram_ularray, varsize);
+                       MFREE(bus->dhd->osh, vbuffer, varsize);
+                       return BCME_ERROR;
+               } else
+                       DHD_ERROR(("%s: Download, Upload and compare of NVRAM succeeded.\n",
+                       __FUNCTION__));
+
+               MFREE(bus->dhd->osh, nvram_ularray, varsize);
+#endif /* DHD_DEBUG */
+
+               MFREE(bus->dhd->osh, vbuffer, varsize);
+       }
+
+       phys_size = REMAP_ENAB(bus) ? bus->ramsize : bus->orig_ramsize;
+
+       phys_size += bus->dongle_ram_base;
+
+       /* adjust to the user specified RAM */
+       DHD_INFO(("%s: Physical memory size: %d, usable memory size: %d\n", __FUNCTION__,
+               phys_size, bus->ramsize));
+       DHD_INFO(("%s: Vars are at %d, orig varsize is %d\n", __FUNCTION__,
+               varaddr, varsize));
+       varsize = ((phys_size - 4) - varaddr);
+
+       /*
+        * Determine the length token:
+        * Varsize, converted to words, in lower 16-bits, checksum in upper 16-bits.
+        */
+       if (bcmerror) {
+               varsizew = 0;
+               bus->nvram_csm = varsizew;
+       } else {
+               varsizew = varsize / 4;
+               varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
+               bus->nvram_csm = varsizew;
+               varsizew = htol32(varsizew);
+       }
+
+       DHD_INFO(("%s: New varsize is %d, length token=0x%08x\n", __FUNCTION__, varsize, varsizew));
+
+       /* Write the length token to the last word */
+       bcmerror = dhdpcie_bus_membytes(bus, TRUE, (phys_size - 4),
+               (uint8*)&varsizew, 4);
+
+       return bcmerror;
+} /* dhdpcie_bus_write_vars */
+
+int
+dhdpcie_downloadvars(dhd_bus_t *bus, void *arg, int len)
+{
+       int bcmerror = BCME_OK;
+#ifdef KEEP_JP_REGREV
+       /* XXX Needed by customer's request */
+       char *tmpbuf;
+       uint tmpidx;
+#endif /* KEEP_JP_REGREV */
+#ifdef GDB_PROXY
+       const char nodeadman_record[] = "deadman_to=0";
+#endif /* GDB_PROXY */
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (!len) {
+               bcmerror = BCME_BUFTOOSHORT;
+               goto err;
+       }
+
+       /* Free the old ones and replace with passed variables */
+       if (bus->vars)
+               MFREE(bus->dhd->osh, bus->vars, bus->varsz);
+#ifdef GDB_PROXY
+       if (bus->dhd->gdb_proxy_nodeadman) {
+               len += sizeof(nodeadman_record);
+       }
+#endif /* GDB_PROXY */
+
+       bus->vars = MALLOC(bus->dhd->osh, len);
+       bus->varsz = bus->vars ? len : 0;
+       if (bus->vars == NULL) {
+               bcmerror = BCME_NOMEM;
+               goto err;
+       }
+
+       /* Copy the passed variables, which should include the terminating double-null */
+       bcopy(arg, bus->vars, bus->varsz);
+#ifdef GDB_PROXY
+       if (bus->dhd->gdb_proxy_nodeadman &&
+               !replace_nvram_variable(bus->vars, bus->varsz, nodeadman_record, NULL))
+       {
+               bcmerror = BCME_NOMEM;
+               goto err;
+       }
+#endif /* GDB_PROXY */
+
+       /* Re-Calculate htclkratio only for QT, for FPGA it is fixed at 30 */
+
+#ifdef DHD_USE_SINGLE_NVRAM_FILE
+       /* XXX Change the default country code only for MFG firmware */
+       if (dhd_bus_get_fw_mode(bus->dhd) == DHD_FLAG_MFG_MODE) {
+               char *sp = NULL;
+               char *ep = NULL;
+               int i;
+               char tag[2][8] = {"ccode=", "regrev="};
+
+               /* Find ccode and regrev info */
+               for (i = 0; i < 2; i++) {
+                       sp = strnstr(bus->vars, tag[i], bus->varsz);
+                       if (!sp) {
+                               DHD_ERROR(("%s: Could not find ccode info from the nvram %s\n",
+                                       __FUNCTION__, bus->nv_path));
+                               bcmerror = BCME_ERROR;
+                               goto err;
+                       }
+                       sp = strchr(sp, '=');
+                       ep = strchr(sp, '\0');
+                       /* We assumed that string length of both ccode and
+                        * regrev values should not exceed WLC_CNTRY_BUF_SZ
+                        */
+                       if (ep && ((ep - sp) <= WLC_CNTRY_BUF_SZ)) {
+                               sp++;
+                               while (*sp != '\0') {
+                                       DHD_INFO(("%s: parse '%s', current sp = '%c'\n",
+                                               __FUNCTION__, tag[i], *sp));
+                                       *sp++ = '0';
+                               }
+                       } else {
+                               DHD_ERROR(("%s: Invalid parameter format when parsing for %s\n",
+                                       __FUNCTION__, tag[i]));
+                               bcmerror = BCME_ERROR;
+                               goto err;
+                       }
+               }
+       }
+#endif /* DHD_USE_SINGLE_NVRAM_FILE */
+
+#ifdef KEEP_JP_REGREV
+       /* XXX Needed by customer's request */
+#ifdef DHD_USE_SINGLE_NVRAM_FILE
+       if (dhd_bus_get_fw_mode(bus->dhd) != DHD_FLAG_MFG_MODE)
+#endif /* DHD_USE_SINGLE_NVRAM_FILE */
+       {
+               char *pos = NULL;
+               tmpbuf = MALLOCZ(bus->dhd->osh, bus->varsz + 1);
+               if (tmpbuf == NULL) {
+                       goto err;
+               }
+               memcpy(tmpbuf, bus->vars, bus->varsz);
+               for (tmpidx = 0; tmpidx < bus->varsz; tmpidx++) {
+                       if (tmpbuf[tmpidx] == 0) {
+                               tmpbuf[tmpidx] = '\n';
+                       }
+               }
+               bus->dhd->vars_ccode[0] = 0;
+               bus->dhd->vars_regrev = 0;
+               if ((pos = strstr(tmpbuf, "ccode"))) {
+                       sscanf(pos, "ccode=%3s\n", bus->dhd->vars_ccode);
+               }
+               if ((pos = strstr(tmpbuf, "regrev"))) {
+                       sscanf(pos, "regrev=%u\n", &(bus->dhd->vars_regrev));
+               }
+               MFREE(bus->dhd->osh, tmpbuf, bus->varsz + 1);
+       }
+#endif /* KEEP_JP_REGREV */
+
+err:
+       return bcmerror;
+}
+
+/* loop through the capability list and see if the pcie capabilty exists */
+uint8
+dhdpcie_find_pci_capability(osl_t *osh, uint8 req_cap_id)
+{
+       uint8 cap_id;
+       uint8 cap_ptr = 0;
+       uint8 byte_val;
+
+       /* check for Header type 0 */
+       byte_val = read_pci_cfg_byte(PCI_CFG_HDR);
+       if ((byte_val & 0x7f) != PCI_HEADER_NORMAL) {
+               DHD_ERROR(("%s : PCI config header not normal.\n", __FUNCTION__));
+               goto end;
+       }
+
+       /* check if the capability pointer field exists */
+       byte_val = read_pci_cfg_byte(PCI_CFG_STAT);
+       if (!(byte_val & PCI_CAPPTR_PRESENT)) {
+               DHD_ERROR(("%s : PCI CAP pointer not present.\n", __FUNCTION__));
+               goto end;
+       }
+
+       cap_ptr = read_pci_cfg_byte(PCI_CFG_CAPPTR);
+       /* check if the capability pointer is 0x00 */
+       if (cap_ptr == 0x00) {
+               DHD_ERROR(("%s : PCI CAP pointer is 0x00.\n", __FUNCTION__));
+               goto end;
+       }
+
+       /* loop thr'u the capability list and see if the pcie capabilty exists */
+
+       cap_id = read_pci_cfg_byte(cap_ptr);
+
+       while (cap_id != req_cap_id) {
+               cap_ptr = read_pci_cfg_byte((cap_ptr + 1));
+               if (cap_ptr == 0x00) break;
+               cap_id = read_pci_cfg_byte(cap_ptr);
+       }
+
+end:
+       return cap_ptr;
+}
+
+void
+dhdpcie_pme_active(osl_t *osh, bool enable)
+{
+       uint8 cap_ptr;
+       uint32 pme_csr;
+
+       cap_ptr = dhdpcie_find_pci_capability(osh, PCI_CAP_POWERMGMTCAP_ID);
+
+       if (!cap_ptr) {
+               DHD_ERROR(("%s : Power Management Capability not present\n", __FUNCTION__));
+               return;
+       }
+
+       pme_csr = OSL_PCI_READ_CONFIG(osh, cap_ptr + PME_CSR_OFFSET, sizeof(uint32));
+       DHD_ERROR(("%s : pme_sts_ctrl 0x%x\n", __FUNCTION__, pme_csr));
+
+       pme_csr |= PME_CSR_PME_STAT;
+       if (enable) {
+               pme_csr |= PME_CSR_PME_EN;
+       } else {
+               pme_csr &= ~PME_CSR_PME_EN;
+       }
+
+       OSL_PCI_WRITE_CONFIG(osh, cap_ptr + PME_CSR_OFFSET, sizeof(uint32), pme_csr);
+}
+
+bool
+dhdpcie_pme_cap(osl_t *osh)
+{
+       uint8 cap_ptr;
+       uint32 pme_cap;
+
+       cap_ptr = dhdpcie_find_pci_capability(osh, PCI_CAP_POWERMGMTCAP_ID);
+
+       if (!cap_ptr) {
+               DHD_ERROR(("%s : Power Management Capability not present\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       pme_cap = OSL_PCI_READ_CONFIG(osh, cap_ptr, sizeof(uint32));
+
+       DHD_ERROR(("%s : pme_cap 0x%x\n", __FUNCTION__, pme_cap));
+
+       return ((pme_cap & PME_CAP_PM_STATES) != 0);
+}
+
+static void
+dhdpcie_pme_stat_clear(dhd_bus_t *bus)
+{
+       uint32 pmcsr = dhd_pcie_config_read(bus, PCIE_CFG_PMCSR, sizeof(uint32));
+
+       OSL_PCI_WRITE_CONFIG(bus->osh, PCIE_CFG_PMCSR, sizeof(uint32), pmcsr | PCIE_PMCSR_PMESTAT);
+}
+
+uint32
+dhdpcie_lcreg(osl_t *osh, uint32 mask, uint32 val)
+{
+
+       uint8   pcie_cap;
+       uint8   lcreg_offset;   /* PCIE capability LCreg offset in the config space */
+       uint32  reg_val;
+
+       pcie_cap = dhdpcie_find_pci_capability(osh, PCI_CAP_PCIECAP_ID);
+
+       if (!pcie_cap) {
+               DHD_ERROR(("%s : PCIe Capability not present\n", __FUNCTION__));
+               return 0;
+       }
+
+       lcreg_offset = pcie_cap + PCIE_CAP_LINKCTRL_OFFSET;
+
+       /* set operation */
+       if (mask) {
+               /* read */
+               reg_val = OSL_PCI_READ_CONFIG(osh, lcreg_offset, sizeof(uint32));
+
+               /* modify */
+               reg_val &= ~mask;
+               reg_val |= (mask & val);
+
+               /* write */
+               OSL_PCI_WRITE_CONFIG(osh, lcreg_offset, sizeof(uint32), reg_val);
+       }
+       return OSL_PCI_READ_CONFIG(osh, lcreg_offset, sizeof(uint32));
+}
+
+uint8
+dhdpcie_clkreq(osl_t *osh, uint32 mask, uint32 val)
+{
+       uint8   pcie_cap;
+       uint32  reg_val;
+       uint8   lcreg_offset;   /* PCIE capability LCreg offset in the config space */
+
+       pcie_cap = dhdpcie_find_pci_capability(osh, PCI_CAP_PCIECAP_ID);
+
+       if (!pcie_cap) {
+               DHD_ERROR(("%s : PCIe Capability not present\n", __FUNCTION__));
+               return 0;
+       }
+
+       lcreg_offset = pcie_cap + PCIE_CAP_LINKCTRL_OFFSET;
+
+       reg_val = OSL_PCI_READ_CONFIG(osh, lcreg_offset, sizeof(uint32));
+       /* set operation */
+       if (mask) {
+               if (val)
+                       reg_val |= PCIE_CLKREQ_ENAB;
+               else
+                       reg_val &= ~PCIE_CLKREQ_ENAB;
+               OSL_PCI_WRITE_CONFIG(osh, lcreg_offset, sizeof(uint32), reg_val);
+               reg_val = OSL_PCI_READ_CONFIG(osh, lcreg_offset, sizeof(uint32));
+       }
+       if (reg_val & PCIE_CLKREQ_ENAB)
+               return 1;
+       else
+               return 0;
+}
+
+void dhd_dump_intr_counters(dhd_pub_t *dhd, struct bcmstrbuf *strbuf)
+{
+       dhd_bus_t *bus;
+       uint64 current_time = OSL_LOCALTIME_NS();
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       bus = dhd->bus;
+       if (!bus) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       bcm_bprintf(strbuf, "\n ------- DUMPING INTR enable/disable counters-------\n");
+       bcm_bprintf(strbuf, "resume_intr_enable_count=%lu dpc_intr_enable_count=%lu\n"
+               "isr_intr_disable_count=%lu suspend_intr_disable_count=%lu\n"
+               "dpc_return_busdown_count=%lu non_ours_irq_count=%lu\n",
+               bus->resume_intr_enable_count, bus->dpc_intr_enable_count,
+               bus->isr_intr_disable_count, bus->suspend_intr_disable_count,
+               bus->dpc_return_busdown_count, bus->non_ours_irq_count);
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       bcm_bprintf(strbuf, "oob_intr_count=%lu oob_intr_enable_count=%lu"
+               " oob_intr_disable_count=%lu\noob_irq_num=%d"
+               " last_oob_irq_times="SEC_USEC_FMT":"SEC_USEC_FMT
+               " last_oob_irq_enable_time="SEC_USEC_FMT"\nlast_oob_irq_disable_time="SEC_USEC_FMT
+               " oob_irq_enabled=%d oob_gpio_level=%d\n",
+               bus->oob_intr_count, bus->oob_intr_enable_count,
+               bus->oob_intr_disable_count, dhdpcie_get_oob_irq_num(bus),
+               GET_SEC_USEC(bus->last_oob_irq_isr_time),
+               GET_SEC_USEC(bus->last_oob_irq_thr_time),
+               GET_SEC_USEC(bus->last_oob_irq_enable_time),
+               GET_SEC_USEC(bus->last_oob_irq_disable_time), dhdpcie_get_oob_irq_status(bus),
+               dhdpcie_get_oob_irq_level());
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+       bcm_bprintf(strbuf, "\ncurrent_time="SEC_USEC_FMT" isr_entry_time="SEC_USEC_FMT
+               " isr_exit_time="SEC_USEC_FMT"\n"
+               "isr_sched_dpc_time="SEC_USEC_FMT" rpm_sched_dpc_time="SEC_USEC_FMT"\n"
+               " last_non_ours_irq_time="SEC_USEC_FMT" dpc_entry_time="SEC_USEC_FMT"\n"
+               "last_process_ctrlbuf_time="SEC_USEC_FMT " last_process_flowring_time="SEC_USEC_FMT
+               " last_process_txcpl_time="SEC_USEC_FMT"\nlast_process_rxcpl_time="SEC_USEC_FMT
+               " last_process_infocpl_time="SEC_USEC_FMT" last_process_edl_time="SEC_USEC_FMT
+               "\ndpc_exit_time="SEC_USEC_FMT" resched_dpc_time="SEC_USEC_FMT"\n"
+               "last_d3_inform_time="SEC_USEC_FMT"\n",
+               GET_SEC_USEC(current_time), GET_SEC_USEC(bus->isr_entry_time),
+               GET_SEC_USEC(bus->isr_exit_time), GET_SEC_USEC(bus->isr_sched_dpc_time),
+               GET_SEC_USEC(bus->rpm_sched_dpc_time),
+               GET_SEC_USEC(bus->last_non_ours_irq_time), GET_SEC_USEC(bus->dpc_entry_time),
+               GET_SEC_USEC(bus->last_process_ctrlbuf_time),
+               GET_SEC_USEC(bus->last_process_flowring_time),
+               GET_SEC_USEC(bus->last_process_txcpl_time),
+               GET_SEC_USEC(bus->last_process_rxcpl_time),
+               GET_SEC_USEC(bus->last_process_infocpl_time),
+               GET_SEC_USEC(bus->last_process_edl_time),
+               GET_SEC_USEC(bus->dpc_exit_time), GET_SEC_USEC(bus->resched_dpc_time),
+               GET_SEC_USEC(bus->last_d3_inform_time));
+
+       bcm_bprintf(strbuf, "\nlast_suspend_start_time="SEC_USEC_FMT" last_suspend_end_time="
+               SEC_USEC_FMT" last_resume_start_time="SEC_USEC_FMT" last_resume_end_time="
+               SEC_USEC_FMT"\n", GET_SEC_USEC(bus->last_suspend_start_time),
+               GET_SEC_USEC(bus->last_suspend_end_time),
+               GET_SEC_USEC(bus->last_resume_start_time),
+               GET_SEC_USEC(bus->last_resume_end_time));
+
+#if defined(SHOW_LOGTRACE) && defined(DHD_USE_KTHREAD_FOR_LOGTRACE)
+       bcm_bprintf(strbuf, "logtrace_thread_entry_time="SEC_USEC_FMT
+               " logtrace_thread_sem_down_time="SEC_USEC_FMT
+               "\nlogtrace_thread_flush_time="SEC_USEC_FMT
+               " logtrace_thread_unexpected_break_time="SEC_USEC_FMT
+               "\nlogtrace_thread_complete_time="SEC_USEC_FMT"\n",
+               GET_SEC_USEC(dhd->logtrace_thr_ts.entry_time),
+               GET_SEC_USEC(dhd->logtrace_thr_ts.sem_down_time),
+               GET_SEC_USEC(dhd->logtrace_thr_ts.flush_time),
+               GET_SEC_USEC(dhd->logtrace_thr_ts.unexpected_break_time),
+               GET_SEC_USEC(dhd->logtrace_thr_ts.complete_time));
+#endif /* SHOW_LOGTRACE && DHD_USE_KTHREAD_FOR_LOGTRACE */
+}
+
+void dhd_dump_intr_registers(dhd_pub_t *dhd, struct bcmstrbuf *strbuf)
+{
+       uint32 intstatus = 0;
+       uint32 intmask = 0;
+       uint32 d2h_db0 = 0;
+       uint32 d2h_mb_data = 0;
+
+       intstatus = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+               dhd->bus->pcie_mailbox_int, 0, 0);
+       intmask = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+               dhd->bus->pcie_mailbox_mask, 0, 0);
+       d2h_db0 = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, PCID2H_MailBox, 0, 0);
+       dhd_bus_cmn_readshared(dhd->bus, &d2h_mb_data, D2H_MB_DATA, 0);
+
+       bcm_bprintf(strbuf, "intstatus=0x%x intmask=0x%x d2h_db0=0x%x\n",
+               intstatus, intmask, d2h_db0);
+       bcm_bprintf(strbuf, "d2h_mb_data=0x%x def_intmask=0x%x\n",
+               d2h_mb_data, dhd->bus->def_intmask);
+}
+/** Add bus dump output to a buffer */
+void dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+       uint16 flowid;
+       int ix = 0;
+       flow_ring_node_t *flow_ring_node;
+       flow_info_t *flow_info;
+#ifdef TX_STATUS_LATENCY_STATS
+       uint8 ifindex;
+       if_flow_lkup_t *if_flow_lkup;
+       dhd_if_tx_status_latency_t if_tx_status_latency[DHD_MAX_IFS];
+#endif /* TX_STATUS_LATENCY_STATS */
+
+#if defined(FW_SIGNATURE)
+       /* Dump secure firmware status. */
+       if (dhdp->busstate <= DHD_BUS_LOAD) {
+               dhd_bus_dump_fws(dhdp->bus, strbuf);
+       }
+#endif
+
+       if (dhdp->busstate != DHD_BUS_DATA)
+               return;
+
+#ifdef TX_STATUS_LATENCY_STATS
+       memset(if_tx_status_latency, 0, sizeof(if_tx_status_latency));
+#endif /* TX_STATUS_LATENCY_STATS */
+#ifdef DHD_WAKE_STATUS
+       bcm_bprintf(strbuf, "wake %u rxwake %u readctrlwake %u\n",
+               bcmpcie_get_total_wake(dhdp->bus), dhdp->bus->wake_counts.rxwake,
+               dhdp->bus->wake_counts.rcwake);
+#ifdef DHD_WAKE_RX_STATUS
+       bcm_bprintf(strbuf, " unicast %u muticast %u broadcast %u arp %u\n",
+               dhdp->bus->wake_counts.rx_ucast, dhdp->bus->wake_counts.rx_mcast,
+               dhdp->bus->wake_counts.rx_bcast, dhdp->bus->wake_counts.rx_arp);
+       bcm_bprintf(strbuf, " multi4 %u multi6 %u icmp6 %u multiother %u\n",
+               dhdp->bus->wake_counts.rx_multi_ipv4, dhdp->bus->wake_counts.rx_multi_ipv6,
+               dhdp->bus->wake_counts.rx_icmpv6, dhdp->bus->wake_counts.rx_multi_other);
+       bcm_bprintf(strbuf, " icmp6_ra %u, icmp6_na %u, icmp6_ns %u\n",
+               dhdp->bus->wake_counts.rx_icmpv6_ra, dhdp->bus->wake_counts.rx_icmpv6_na,
+               dhdp->bus->wake_counts.rx_icmpv6_ns);
+#endif /* DHD_WAKE_RX_STATUS */
+#ifdef DHD_WAKE_EVENT_STATUS
+       for (flowid = 0; flowid < WLC_E_LAST; flowid++)
+               if (dhdp->bus->wake_counts.rc_event[flowid] != 0)
+                       bcm_bprintf(strbuf, " %s = %u\n", bcmevent_get_name(flowid),
+                               dhdp->bus->wake_counts.rc_event[flowid]);
+       bcm_bprintf(strbuf, "\n");
+#endif /* DHD_WAKE_EVENT_STATUS */
+#endif /* DHD_WAKE_STATUS */
+
+       dhd_prot_print_info(dhdp, strbuf);
+       dhd_dump_intr_registers(dhdp, strbuf);
+       dhd_dump_intr_counters(dhdp, strbuf);
+       bcm_bprintf(strbuf, "h2d_mb_data_ptr_addr 0x%x, d2h_mb_data_ptr_addr 0x%x\n",
+               dhdp->bus->h2d_mb_data_ptr_addr, dhdp->bus->d2h_mb_data_ptr_addr);
+       bcm_bprintf(strbuf, "dhd cumm_ctr %d\n", DHD_CUMM_CTR_READ(&dhdp->cumm_ctr));
+#ifdef DHD_LIMIT_MULTI_CLIENT_FLOWRINGS
+       bcm_bprintf(strbuf, "multi_client_flow_rings:%d max_multi_client_flow_rings:%d\n",
+               dhdp->multi_client_flow_rings, dhdp->max_multi_client_flow_rings);
+#endif /* DHD_LIMIT_MULTI_CLIENT_FLOWRINGS */
+#if defined(DHD_HTPUT_TUNABLES)
+       bcm_bprintf(strbuf, "htput_flow_ring_start:%d total_htput:%d client_htput=%d\n",
+               dhdp->htput_flow_ring_start, HTPUT_TOTAL_FLOW_RINGS, dhdp->htput_client_flow_rings);
+#endif /* DHD_HTPUT_TUNABLES */
+       bcm_bprintf(strbuf,
+               "%4s %4s %2s %4s %17s %4s %4s %6s %10s %17s %17s %17s %17s %14s %14s %10s ",
+               "Num:", "Flow", "If", "Prio", ":Dest_MacAddress:", "Qlen", "CLen", "L2CLen",
+               " Overflows", "TRD: HLRD: HDRD", "TWR: HLWR: HDWR", "BASE(VA)", "BASE(PA)",
+               "WORK_ITEM_SIZE", "MAX_WORK_ITEMS", "TOTAL_SIZE");
+
+#ifdef TX_STATUS_LATENCY_STATS
+       /* Average Tx status/Completion Latency in micro secs */
+       bcm_bprintf(strbuf, "%16s %16s ", "       NumTxPkts", "    AvgTxCmpL_Us");
+#endif /* TX_STATUS_LATENCY_STATS */
+
+       bcm_bprintf(strbuf, "\n");
+
+       for (flowid = 0; flowid < dhdp->num_h2d_rings; flowid++) {
+               flow_ring_node = DHD_FLOW_RING(dhdp, flowid);
+               if (!flow_ring_node->active)
+                       continue;
+
+               flow_info = &flow_ring_node->flow_info;
+               bcm_bprintf(strbuf,
+                       "%4d %4d %2d %4d "MACDBG" %4d %4d %6d %10u ", ix++,
+                       flow_ring_node->flowid, flow_info->ifindex, flow_info->tid,
+                       MAC2STRDBG(flow_info->da),
+                       DHD_FLOW_QUEUE_LEN(&flow_ring_node->queue),
+                       DHD_CUMM_CTR_READ(DHD_FLOW_QUEUE_CLEN_PTR(&flow_ring_node->queue)),
+                       DHD_CUMM_CTR_READ(DHD_FLOW_QUEUE_L2CLEN_PTR(&flow_ring_node->queue)),
+                       DHD_FLOW_QUEUE_FAILURES(&flow_ring_node->queue));
+               dhd_prot_print_flow_ring(dhdp, flow_ring_node->prot_info, TRUE, strbuf,
+                       "%5d:%5d:%5d %5d:%5d:%5d %17p %8x:%8x %14d %14d %10d");
+
+#ifdef TX_STATUS_LATENCY_STATS
+               bcm_bprintf(strbuf, "%16llu %16llu ",
+                       flow_info->num_tx_pkts,
+                       flow_info->num_tx_status ?
+                       DIV_U64_BY_U64(flow_info->cum_tx_status_latency,
+                       flow_info->num_tx_status) : 0);
+               ifindex = flow_info->ifindex;
+               ASSERT(ifindex < DHD_MAX_IFS);
+               if (ifindex < DHD_MAX_IFS) {
+                       if_tx_status_latency[ifindex].num_tx_status += flow_info->num_tx_status;
+                       if_tx_status_latency[ifindex].cum_tx_status_latency +=
+                               flow_info->cum_tx_status_latency;
+               } else {
+                       DHD_ERROR(("%s: Bad IF index: %d associated with flowid: %d\n",
+                               __FUNCTION__, ifindex, flowid));
+               }
+#endif /* TX_STATUS_LATENCY_STATS */
+               bcm_bprintf(strbuf, "\n");
+       }
+
+#ifdef TX_STATUS_LATENCY_STATS
+       bcm_bprintf(strbuf, "\n%s  %16s  %16s\n", "If", "AvgTxCmpL_Us", "NumTxStatus");
+       if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+       for (ix = 0; ix < DHD_MAX_IFS; ix++) {
+               if (!if_flow_lkup[ix].status) {
+                       continue;
+               }
+               bcm_bprintf(strbuf, "%2d  %16llu  %16llu\n",
+                       ix,
+                       if_tx_status_latency[ix].num_tx_status ?
+                       DIV_U64_BY_U64(if_tx_status_latency[ix].cum_tx_status_latency,
+                       if_tx_status_latency[ix].num_tx_status): 0,
+                       if_tx_status_latency[ix].num_tx_status);
+       }
+#endif /* TX_STATUS_LATENCY_STATS */
+
+       bcm_bprintf(strbuf, "D3 inform cnt %d\n", dhdp->bus->d3_inform_cnt);
+       bcm_bprintf(strbuf, "D0 inform cnt %d\n", dhdp->bus->d0_inform_cnt);
+       bcm_bprintf(strbuf, "D0 inform in use cnt %d\n", dhdp->bus->d0_inform_in_use_cnt);
+       if (dhdp->d2h_hostrdy_supported) {
+               bcm_bprintf(strbuf, "hostready count:%d\n", dhdp->bus->hostready_count);
+       }
+#ifdef PCIE_INB_DW
+       /* Inband device wake counters */
+       if (INBAND_DW_ENAB(dhdp->bus)) {
+               bcm_bprintf(strbuf, "Inband device_wake assert count: %d\n",
+                       dhdp->bus->inband_dw_assert_cnt);
+               bcm_bprintf(strbuf, "Inband device_wake deassert count: %d\n",
+                       dhdp->bus->inband_dw_deassert_cnt);
+               bcm_bprintf(strbuf, "Inband DS-EXIT <host initiated> count: %d\n",
+                       dhdp->bus->inband_ds_exit_host_cnt);
+               bcm_bprintf(strbuf, "Inband DS-EXIT <device initiated> count: %d\n",
+                       dhdp->bus->inband_ds_exit_device_cnt);
+               bcm_bprintf(strbuf, "Inband DS-EXIT Timeout count: %d\n",
+                       dhdp->bus->inband_ds_exit_to_cnt);
+               bcm_bprintf(strbuf, "Inband HOST_SLEEP-EXIT Timeout count: %d\n",
+                       dhdp->bus->inband_host_sleep_exit_to_cnt);
+       }
+#endif /* PCIE_INB_DW */
+       bcm_bprintf(strbuf, "d2h_intr_method -> %s\n",
+               dhdp->bus->d2h_intr_method ? "PCIE_MSI" : "PCIE_INTX");
+
+       bcm_bprintf(strbuf, "\n\nDB7 stats - db7_send_cnt: %d, db7_trap_cnt: %d, "
+               "max duration: %lld (%lld - %lld), db7_timing_error_cnt: %d\n",
+               dhdp->db7_trap.debug_db7_send_cnt,
+               dhdp->db7_trap.debug_db7_trap_cnt,
+               dhdp->db7_trap.debug_max_db7_dur,
+               dhdp->db7_trap.debug_max_db7_trap_time,
+               dhdp->db7_trap.debug_max_db7_send_time,
+               dhdp->db7_trap.debug_db7_timing_error_cnt);
+}
+
+#ifdef DNGL_AXI_ERROR_LOGGING
+bool
+dhd_axi_sig_match(dhd_pub_t *dhdp)
+{
+       uint32 axi_tcm_addr = dhdpcie_bus_rtcm32(dhdp->bus, dhdp->axierror_logbuf_addr);
+
+       if (dhdp->dhd_induce_error == DHD_INDUCE_DROP_AXI_SIG) {
+               DHD_ERROR(("%s: Induce AXI signature drop\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       DHD_ERROR(("%s: axi_tcm_addr: 0x%x, tcm range: 0x%x ~ 0x%x\n",
+               __FUNCTION__, axi_tcm_addr, dhdp->bus->dongle_ram_base,
+               dhdp->bus->dongle_ram_base + dhdp->bus->ramsize));
+       if (axi_tcm_addr >= dhdp->bus->dongle_ram_base &&
+           axi_tcm_addr < dhdp->bus->dongle_ram_base + dhdp->bus->ramsize) {
+               uint32 axi_signature = dhdpcie_bus_rtcm32(dhdp->bus, (axi_tcm_addr +
+                       OFFSETOF(hnd_ext_trap_axi_error_v1_t, signature)));
+               if (axi_signature == HND_EXT_TRAP_AXIERROR_SIGNATURE) {
+                       return TRUE;
+               } else {
+                       DHD_ERROR(("%s: No AXI signature: 0x%x\n",
+                               __FUNCTION__, axi_signature));
+                       return FALSE;
+               }
+       } else {
+               DHD_ERROR(("%s: No AXI shared tcm address debug info.\n", __FUNCTION__));
+               return FALSE;
+       }
+}
+
+void
+dhd_axi_error(dhd_pub_t *dhdp)
+{
+       dhd_axi_error_dump_t *axi_err_dump;
+       uint8 *axi_err_buf = NULL;
+       uint8 *p_axi_err = NULL;
+       uint32 axi_logbuf_addr;
+       uint32 axi_tcm_addr;
+       int err, size;
+
+       /* XXX: On the Dongle side, if an invalid Host Address is generated for a transaction
+        * it results in SMMU Fault. Now the Host won't respond for the invalid transaction.
+        * On the Dongle side, after 50msec this results in AXI Slave Error.
+        * Hence introduce a delay higher than 50msec to ensure AXI Slave error happens and
+        * the Dongle collects the required information.
+        */
+       OSL_DELAY(75000);
+
+       axi_logbuf_addr = dhdp->axierror_logbuf_addr;
+       if (!axi_logbuf_addr) {
+               DHD_ERROR(("%s: No AXI TCM address debug info.\n", __FUNCTION__));
+               goto sched_axi;
+       }
+
+       axi_err_dump = dhdp->axi_err_dump;
+       if (!axi_err_dump) {
+               goto sched_axi;
+       }
+
+       if (!dhd_axi_sig_match(dhdp)) {
+               goto sched_axi;
+       }
+
+       /* Reading AXI error data for SMMU fault */
+       DHD_ERROR(("%s: Read AXI data from TCM address\n", __FUNCTION__));
+       axi_tcm_addr = dhdpcie_bus_rtcm32(dhdp->bus, axi_logbuf_addr);
+       size = sizeof(hnd_ext_trap_axi_error_v1_t);
+       axi_err_buf = MALLOCZ(dhdp->osh, size);
+       if (axi_err_buf == NULL) {
+               DHD_ERROR(("%s: out of memory !\n", __FUNCTION__));
+               goto sched_axi;
+       }
+
+       p_axi_err = axi_err_buf;
+       err = dhdpcie_bus_membytes(dhdp->bus, FALSE, axi_tcm_addr, p_axi_err, size);
+       if (err) {
+               DHD_ERROR(("%s: error %d on reading %d membytes at 0x%08x\n",
+                       __FUNCTION__, err, size, axi_tcm_addr));
+               goto sched_axi;
+       }
+
+       /* Dump data to Dmesg */
+       dhd_log_dump_axi_error(axi_err_buf);
+       err = memcpy_s(&axi_err_dump->etd_axi_error_v1, size, axi_err_buf, size);
+       if (err) {
+               DHD_ERROR(("%s: failed to copy etd axi error info, err=%d\n",
+                       __FUNCTION__, err));
+       }
+
+sched_axi:
+       if (axi_err_buf) {
+               MFREE(dhdp->osh, axi_err_buf, size);
+       }
+       dhd_schedule_axi_error_dump(dhdp, NULL);
+}
+
+static void
+dhd_log_dump_axi_error(uint8 *axi_err)
+{
+       dma_dentry_v1_t dma_dentry;
+       dma_fifo_v1_t dma_fifo;
+       int i = 0, j = 0;
+
+       if (*(uint8 *)axi_err == HND_EXT_TRAP_AXIERROR_VERSION_1) {
+               hnd_ext_trap_axi_error_v1_t *axi_err_v1 = (hnd_ext_trap_axi_error_v1_t *)axi_err;
+               DHD_ERROR(("%s: signature : 0x%x\n", __FUNCTION__, axi_err_v1->signature));
+               DHD_ERROR(("%s: version : 0x%x\n", __FUNCTION__, axi_err_v1->version));
+               DHD_ERROR(("%s: length : 0x%x\n", __FUNCTION__, axi_err_v1->length));
+               DHD_ERROR(("%s: dma_fifo_valid_count : 0x%x\n",
+                       __FUNCTION__, axi_err_v1->dma_fifo_valid_count));
+               DHD_ERROR(("%s: axi_errorlog_status : 0x%x\n",
+                       __FUNCTION__, axi_err_v1->axi_errorlog_status));
+               DHD_ERROR(("%s: axi_errorlog_core : 0x%x\n",
+                       __FUNCTION__, axi_err_v1->axi_errorlog_core));
+               DHD_ERROR(("%s: axi_errorlog_hi : 0x%x\n",
+                       __FUNCTION__, axi_err_v1->axi_errorlog_hi));
+               DHD_ERROR(("%s: axi_errorlog_lo : 0x%x\n",
+                       __FUNCTION__, axi_err_v1->axi_errorlog_lo));
+               DHD_ERROR(("%s: axi_errorlog_id : 0x%x\n",
+                       __FUNCTION__, axi_err_v1->axi_errorlog_id));
+
+               for (i = 0; i < MAX_DMAFIFO_ENTRIES_V1; i++) {
+                       dma_fifo = axi_err_v1->dma_fifo[i];
+                       DHD_ERROR(("%s: valid:%d : 0x%x\n",
+                               __FUNCTION__, i, dma_fifo.valid));
+                       DHD_ERROR(("%s: direction:%d : 0x%x\n",
+                               __FUNCTION__, i, dma_fifo.direction));
+                       DHD_ERROR(("%s: index:%d : 0x%x\n",
+                               __FUNCTION__, i, dma_fifo.index));
+                       DHD_ERROR(("%s: dpa:%d : 0x%x\n",
+                               __FUNCTION__, i, dma_fifo.dpa));
+                       DHD_ERROR(("%s: desc_lo:%d : 0x%x\n",
+                               __FUNCTION__, i, dma_fifo.desc_lo));
+                       DHD_ERROR(("%s: desc_hi:%d : 0x%x\n",
+                               __FUNCTION__, i, dma_fifo.desc_hi));
+                       DHD_ERROR(("%s: din:%d : 0x%x\n",
+                               __FUNCTION__, i, dma_fifo.din));
+                       DHD_ERROR(("%s: dout:%d : 0x%x\n",
+                               __FUNCTION__, i, dma_fifo.dout));
+                       for (j = 0; j < MAX_DMAFIFO_DESC_ENTRIES_V1; j++) {
+                               dma_dentry = axi_err_v1->dma_fifo[i].dentry[j];
+                               DHD_ERROR(("%s: ctrl1:%d : 0x%x\n",
+                                       __FUNCTION__, i, dma_dentry.ctrl1));
+                               DHD_ERROR(("%s: ctrl2:%d : 0x%x\n",
+                                       __FUNCTION__, i, dma_dentry.ctrl2));
+                               DHD_ERROR(("%s: addrlo:%d : 0x%x\n",
+                                       __FUNCTION__, i, dma_dentry.addrlo));
+                               DHD_ERROR(("%s: addrhi:%d : 0x%x\n",
+                                       __FUNCTION__, i, dma_dentry.addrhi));
+                       }
+               }
+       }
+       else {
+               DHD_ERROR(("%s: Invalid AXI version: 0x%x\n", __FUNCTION__, (*(uint8 *)axi_err)));
+       }
+}
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+/**
+ * Brings transmit packets on all flow rings closer to the dongle, by moving (a subset) from their
+ * flow queue to their flow ring.
+ */
+static void
+dhd_update_txflowrings(dhd_pub_t *dhd)
+{
+       unsigned long flags;
+       dll_t *item, *next;
+       flow_ring_node_t *flow_ring_node;
+       struct dhd_bus *bus = dhd->bus;
+       int count = 0;
+
+       if (dhd_query_bus_erros(dhd)) {
+               return;
+       }
+
+       /* Hold flowring_list_lock to ensure no race condition while accessing the List */
+       DHD_FLOWRING_LIST_LOCK(bus->dhd->flowring_list_lock, flags);
+       for (item = dll_head_p(&bus->flowring_active_list);
+               (!dhd_is_device_removed(dhd) && !dll_end(&bus->flowring_active_list, item));
+               item = next, count++) {
+               if (dhd->hang_was_sent) {
+                       break;
+               }
+
+               if (count > bus->max_tx_flowrings) {
+                       DHD_ERROR(("%s : overflow max flowrings\n", __FUNCTION__));
+                       dhd->hang_reason = HANG_REASON_UNKNOWN;
+                       dhd_os_send_hang_message(dhd);
+                       break;
+               }
+
+               next = dll_next_p(item);
+               flow_ring_node = dhd_constlist_to_flowring(item);
+
+               /* Ensure that flow_ring_node in the list is Not Null */
+               ASSERT(flow_ring_node != NULL);
+
+               /* Ensure that the flowring node has valid contents */
+               ASSERT(flow_ring_node->prot_info != NULL);
+
+               dhd_prot_update_txflowring(dhd, flow_ring_node->flowid, flow_ring_node->prot_info);
+       }
+       DHD_FLOWRING_LIST_UNLOCK(bus->dhd->flowring_list_lock, flags);
+}
+
+/** Mailbox ringbell Function */
+static void
+dhd_bus_gen_devmb_intr(struct dhd_bus *bus)
+{
+       if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+               (bus->sih->buscorerev == 4)) {
+               DHD_ERROR(("%s: mailbox communication not supported\n", __FUNCTION__));
+               return;
+       }
+       if (bus->db1_for_mb)  {
+               /* this is a pcie core register, not the config register */
+               /* XXX: make sure we are on PCIE */
+               DHD_INFO(("%s: writing a mail box interrupt to the device, through doorbell 1\n", __FUNCTION__));
+               if (DAR_PWRREQ(bus)) {
+                       dhd_bus_pcie_pwr_req(bus);
+               }
+               si_corereg(bus->sih, bus->sih->buscoreidx, dhd_bus_db1_addr_get(bus),
+                       ~0, 0x12345678);
+       } else {
+               DHD_INFO(("%s: writing a mail box interrupt to the device, through config space\n", __FUNCTION__));
+               dhdpcie_bus_cfg_write_dword(bus, PCISBMbx, 4, (1 << 0));
+               /* XXX CRWLPCIEGEN2-182 requires double write */
+               dhdpcie_bus_cfg_write_dword(bus, PCISBMbx, 4, (1 << 0));
+       }
+}
+
+/* Upon receiving a mailbox interrupt,
+ * if H2D_FW_TRAP bit is set in mailbox location
+ * device traps
+ */
+static void
+dhdpcie_fw_trap(dhd_bus_t *bus)
+{
+       DHD_ERROR(("%s: send trap!!!\n", __FUNCTION__));
+       if (bus->dhd->db7_trap.fw_db7w_trap) {
+               uint32 addr = dhd_bus_db1_addr_3_get(bus);
+               bus->dhd->db7_trap.debug_db7_send_time = OSL_LOCALTIME_NS();
+               bus->dhd->db7_trap.debug_db7_send_cnt++;
+               si_corereg(bus->sih, bus->sih->buscoreidx, addr, ~0,
+                       bus->dhd->db7_trap.db7_magic_number);
+               return;
+       }
+
+       /* Send the mailbox data and generate mailbox intr. */
+       dhdpcie_send_mb_data(bus, H2D_FW_TRAP);
+       /* For FWs that cannot interprete H2D_FW_TRAP */
+       (void)dhd_wl_ioctl_set_intiovar(bus->dhd, "bus:disconnect", 99, WLC_SET_VAR, TRUE, 0);
+}
+
+#ifdef PCIE_INB_DW
+
+void
+dhd_bus_inb_ack_pending_ds_req(dhd_bus_t *bus)
+{
+       /* The DHD_BUS_INB_DW_LOCK must be held before
+       * calling this function !!
+       */
+       if ((dhdpcie_bus_get_pcie_inband_dw_state(bus) ==
+               DW_DEVICE_DS_DEV_SLEEP_PEND) &&
+               (bus->host_active_cnt == 0)) {
+               dhdpcie_bus_set_pcie_inband_dw_state(bus, DW_DEVICE_DS_DEV_SLEEP);
+               dhdpcie_send_mb_data(bus, H2D_HOST_DS_ACK);
+       }
+}
+
+int
+dhd_bus_inb_set_device_wake(struct dhd_bus *bus, bool val)
+{
+       int timeleft;
+       unsigned long flags;
+       int ret;
+
+       if (!INBAND_DW_ENAB(bus)) {
+               return BCME_ERROR;
+       }
+       if (val) {
+               DHD_BUS_INB_DW_LOCK(bus->inb_lock, flags);
+
+               /*
+                * Reset the Door Bell Timeout value. So that the Watchdog
+                * doesn't try to Deassert Device Wake, while we are in
+                * the process of still Asserting the same.
+                */
+               dhd_bus_doorbell_timeout_reset(bus);
+
+               if (dhdpcie_bus_get_pcie_inband_dw_state(bus) ==
+                       DW_DEVICE_DS_DEV_SLEEP) {
+                       /* Clear wait_for_ds_exit */
+                       bus->wait_for_ds_exit = 0;
+                       if (bus->calc_ds_exit_latency) {
+                               bus->ds_exit_latency = 0;
+                               bus->ds_exit_ts2 = 0;
+                               bus->ds_exit_ts1 = OSL_SYSUPTIME_US();
+                       }
+                       ret = dhdpcie_send_mb_data(bus, H2DMB_DS_DEVICE_WAKE_ASSERT);
+                       if (ret != BCME_OK) {
+                               DHD_ERROR(("Failed: assert Inband device_wake\n"));
+                               DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+                               ret = BCME_ERROR;
+                               goto exit;
+                       }
+                       dhdpcie_bus_set_pcie_inband_dw_state(bus,
+                               DW_DEVICE_DS_DISABLED_WAIT);
+                       bus->inband_dw_assert_cnt++;
+               } else if (dhdpcie_bus_get_pcie_inband_dw_state(bus) ==
+                       DW_DEVICE_DS_DISABLED_WAIT) {
+                       DHD_ERROR(("Inband device wake is already asserted, "
+                               "waiting for DS-Exit\n"));
+               }
+               else {
+                       DHD_INFO(("Not in DS SLEEP state \n"));
+                       DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+                       ret = BCME_OK;
+                       goto exit;
+               }
+
+               /*
+                * Since we are going to wait/sleep .. release the lock.
+                * The Device Wake sanity is still valid, because
+                * a) If there is another context that comes in and tries
+                *    to assert DS again and if it gets the lock, since
+                *    ds_state would be now != DW_DEVICE_DS_DEV_SLEEP the
+                *    context would return saying Not in DS Sleep.
+                * b) If ther is another context that comes in and tries
+                *    to de-assert DS and gets the lock,
+                *    since the ds_state is != DW_DEVICE_DS_DEV_WAKE
+                *    that context would return too. This can not happen
+                *    since the watchdog is the only context that can
+                *    De-Assert Device Wake and as the first step of
+                *    Asserting the Device Wake, we have pushed out the
+                *    Door Bell Timeout.
+                *
+                */
+
+               if (!CAN_SLEEP()) {
+                       dhdpcie_bus_set_pcie_inband_dw_state(bus,
+                               DW_DEVICE_DS_DEV_WAKE);
+                       DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+                       /* Called from context that cannot sleep */
+                       OSL_DELAY(1000);
+               } else {
+                       DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+                       /* Wait for DS EXIT for DS_EXIT_TIMEOUT seconds */
+                       timeleft = dhd_os_ds_exit_wait(bus->dhd, &bus->wait_for_ds_exit);
+                       if (!bus->wait_for_ds_exit || timeleft == 0) {
+                               DHD_ERROR(("dhd_bus_inb_set_device_wake:DS-EXIT timeout, "
+                                       "wait_for_ds_exit : %d\n", bus->wait_for_ds_exit));
+                               bus->inband_ds_exit_to_cnt++;
+                               bus->ds_exit_timeout = 0;
+#ifdef DHD_FW_COREDUMP
+                               if (bus->dhd->memdump_enabled) {
+                                       /* collect core dump */
+                                       DHD_GENERAL_LOCK(bus->dhd, flags);
+                                       DHD_BUS_BUSY_CLEAR_RPM_SUSPEND_IN_PROGRESS(bus->dhd);
+                                       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+                                       bus->dhd->memdump_type =
+                                               DUMP_TYPE_INBAND_DEVICE_WAKE_FAILURE;
+                                       dhd_bus_mem_dump(bus->dhd);
+                               }
+#else
+                               ASSERT(0);
+#endif /* DHD_FW_COREDUMP */
+                               ret = BCME_ERROR;
+                               goto exit;
+                       }
+               }
+               ret = BCME_OK;
+       } else {
+               DHD_BUS_INB_DW_LOCK(bus->inb_lock, flags);
+               if ((dhdpcie_bus_get_pcie_inband_dw_state(bus) ==
+                       DW_DEVICE_DS_DEV_WAKE)) {
+                       ret = dhdpcie_send_mb_data(bus, H2DMB_DS_DEVICE_WAKE_DEASSERT);
+                       if (ret != BCME_OK) {
+                               DHD_ERROR(("Failed: deassert Inband device_wake\n"));
+                               DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+                               goto exit;
+                       }
+                       dhdpcie_bus_set_pcie_inband_dw_state(bus,
+                               DW_DEVICE_DS_ACTIVE);
+                       bus->inband_dw_deassert_cnt++;
+               } else if ((dhdpcie_bus_get_pcie_inband_dw_state(bus) ==
+                       DW_DEVICE_DS_DEV_SLEEP_PEND) &&
+                       (bus->host_active_cnt == 0)) {
+                       dhdpcie_bus_set_pcie_inband_dw_state(bus, DW_DEVICE_DS_DEV_SLEEP);
+                       dhdpcie_send_mb_data(bus, H2D_HOST_DS_ACK);
+               }
+
+               ret = BCME_OK;
+               DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+       }
+
+exit:
+       return ret;
+}
+#endif /* PCIE_INB_DW */
+#if defined(PCIE_INB_DW)
+void
+dhd_bus_doorbell_timeout_reset(struct dhd_bus *bus)
+{
+       if (dhd_doorbell_timeout) {
+#ifdef DHD_PCIE_RUNTIMEPM
+               if (dhd_runtimepm_ms) {
+                       dhd_timeout_start(&bus->doorbell_timer,
+                               (dhd_doorbell_timeout * 1000) / dhd_runtimepm_ms);
+               }
+#else
+               uint wd_scale = dhd_watchdog_ms;
+               if (dhd_watchdog_ms) {
+                       dhd_timeout_start(&bus->doorbell_timer,
+                               (dhd_doorbell_timeout * 1000) / wd_scale);
+               }
+#endif /* DHD_PCIE_RUNTIMEPM */
+       }
+       else if (!(bus->dhd->busstate == DHD_BUS_SUSPEND)) {
+               dhd_bus_set_device_wake(bus, FALSE);
+       }
+}
+
+int
+dhd_bus_set_device_wake(struct dhd_bus *bus, bool val)
+{
+       if (bus->ds_enabled && bus->dhd->ring_attached) {
+#ifdef PCIE_INB_DW
+               if (INBAND_DW_ENAB(bus)) {
+                       return dhd_bus_inb_set_device_wake(bus, val);
+               }
+#endif /* PCIE_INB_DW */
+       }
+       return BCME_OK;
+}
+
+void
+dhd_bus_dw_deassert(dhd_pub_t *dhd)
+{
+       dhd_bus_t *bus = dhd->bus;
+       unsigned long flags;
+
+       /* If haven't communicated with device for a while, deassert the Device_Wake GPIO */
+       if (dhd_doorbell_timeout != 0 && bus->dhd->busstate == DHD_BUS_DATA &&
+               dhd_timeout_expired(&bus->doorbell_timer)) {
+               DHD_GENERAL_LOCK(dhd, flags);
+               if (DHD_BUS_BUSY_CHECK_IDLE(dhd) &&
+                       !DHD_CHECK_CFG_IN_PROGRESS(dhd)) {
+                       DHD_BUS_BUSY_SET_IN_DS_DEASSERT(dhd);
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+                       dhd_bus_set_device_wake(bus, FALSE);
+                       DHD_GENERAL_LOCK(dhd, flags);
+                       DHD_BUS_BUSY_CLEAR_IN_DS_DEASSERT(dhd);
+                       dhd_os_busbusy_wake(bus->dhd);
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+               } else {
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+               }
+       }
+
+#ifdef PCIE_INB_DW
+       if (INBAND_DW_ENAB(bus)) {
+               if (bus->ds_exit_timeout) {
+                       bus->ds_exit_timeout --;
+                       if (bus->ds_exit_timeout == 1) {
+                               DHD_ERROR(("DS-EXIT TIMEOUT\n"));
+                               bus->ds_exit_timeout = 0;
+                               bus->inband_ds_exit_to_cnt++;
+                       }
+               }
+               if (bus->host_sleep_exit_timeout) {
+                       bus->host_sleep_exit_timeout --;
+                       if (bus->host_sleep_exit_timeout == 1) {
+                               DHD_ERROR(("HOST_SLEEP-EXIT TIMEOUT\n"));
+                               bus->host_sleep_exit_timeout = 0;
+                               bus->inband_host_sleep_exit_to_cnt++;
+                       }
+               }
+       }
+#endif /* PCIE_INB_DW */
+}
+#endif
+
+/** mailbox doorbell ring function */
+void
+dhd_bus_ringbell(struct dhd_bus *bus, uint32 value)
+{
+       /* Skip once bus enters low power state (D3_INFORM/D3_ACK) */
+       if (__DHD_CHK_BUS_IN_LPS(bus)) {
+               DHD_ERROR(("%s: trying to ring the doorbell after D3 inform %d\n",
+                       __FUNCTION__, bus->bus_low_power_state));
+               return;
+       }
+
+       /* Skip in the case of link down */
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link was down\n", __FUNCTION__));
+               return;
+       }
+
+       if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+               (bus->sih->buscorerev == 4)) {
+               si_corereg(bus->sih, bus->sih->buscoreidx, bus->pcie_mailbox_int,
+                       PCIE_INTB, PCIE_INTB);
+       } else {
+               /* this is a pcie core register, not the config regsiter */
+               /* XXX: makesure we are on PCIE */
+               DHD_INFO(("%s: writing a door bell to the device\n", __FUNCTION__));
+               if (IDMA_ACTIVE(bus->dhd)) {
+                       if (DAR_PWRREQ(bus)) {
+                               dhd_bus_pcie_pwr_req(bus);
+                       }
+                       si_corereg(bus->sih, bus->sih->buscoreidx, dhd_bus_db0_addr_2_get(bus),
+                               ~0, value);
+               } else {
+                       if (DAR_PWRREQ(bus)) {
+                               dhd_bus_pcie_pwr_req(bus);
+                       }
+                       si_corereg(bus->sih, bus->sih->buscoreidx,
+                               dhd_bus_db0_addr_get(bus), ~0, 0x12345678);
+               }
+       }
+}
+
+/** mailbox doorbell ring function for IDMA/IFRM using dma channel2 */
+void
+dhd_bus_ringbell_2(struct dhd_bus *bus, uint32 value, bool devwake)
+{
+       /* this is a pcie core register, not the config regsiter */
+       /* XXX: makesure we are on PCIE */
+       /* Skip once bus enters low power state (D3_INFORM/D3_ACK) */
+       if (__DHD_CHK_BUS_IN_LPS(bus)) {
+               DHD_ERROR(("%s: trying to ring the doorbell after D3 inform %d\n",
+                       __FUNCTION__, bus->bus_low_power_state));
+               return;
+       }
+
+       /* Skip in the case of link down */
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link was down\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_INFO(("writing a door bell 2 to the device\n"));
+       if (DAR_PWRREQ(bus)) {
+               dhd_bus_pcie_pwr_req(bus);
+       }
+       si_corereg(bus->sih, bus->sih->buscoreidx, dhd_bus_db0_addr_2_get(bus),
+               ~0, value);
+}
+
+void
+dhdpcie_bus_ringbell_fast(struct dhd_bus *bus, uint32 value)
+{
+       /* Skip once bus enters low power state (D3_INFORM/D3_ACK) */
+       if (__DHD_CHK_BUS_IN_LPS(bus)) {
+               DHD_ERROR(("%s: trying to ring the doorbell after D3 inform %d\n",
+                       __FUNCTION__, bus->bus_low_power_state));
+               return;
+       }
+
+       /* Skip in the case of link down */
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link was down\n", __FUNCTION__));
+               return;
+       }
+
+#if defined(PCIE_INB_DW)
+       if (OOB_DW_ENAB(bus)) {
+               dhd_bus_set_device_wake(bus, TRUE);
+       }
+       dhd_bus_doorbell_timeout_reset(bus);
+#endif
+       if (DAR_PWRREQ(bus)) {
+               dhd_bus_pcie_pwr_req(bus);
+       }
+
+#ifdef DHD_DB0TS
+       if (bus->dhd->db0ts_capable) {
+               uint64 ts;
+
+               ts = local_clock();
+               do_div(ts, 1000);
+
+               value = htol32(ts & 0xFFFFFFFF);
+               DHD_INFO(("%s: usec timer = 0x%x\n", __FUNCTION__, value));
+       }
+#endif /* DHD_DB0TS */
+       W_REG(bus->pcie_mb_intr_osh, bus->pcie_mb_intr_addr, value);
+}
+
+void
+dhdpcie_bus_ringbell_2_fast(struct dhd_bus *bus, uint32 value, bool devwake)
+{
+       /* Skip once bus enters low power state (D3_INFORM/D3_ACK) */
+       if (__DHD_CHK_BUS_IN_LPS(bus)) {
+               DHD_ERROR(("%s: trying to ring the doorbell after D3 inform %d\n",
+                       __FUNCTION__, bus->bus_low_power_state));
+               return;
+       }
+
+       /* Skip in the case of link down */
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link was down\n", __FUNCTION__));
+               return;
+       }
+
+#if defined(PCIE_INB_DW)
+       if (devwake) {
+               if (OOB_DW_ENAB(bus)) {
+                       dhd_bus_set_device_wake(bus, TRUE);
+               }
+       }
+       dhd_bus_doorbell_timeout_reset(bus);
+#endif
+
+       if (DAR_PWRREQ(bus)) {
+               dhd_bus_pcie_pwr_req(bus);
+       }
+       W_REG(bus->pcie_mb_intr_osh, bus->pcie_mb_intr_2_addr, value);
+}
+
+static void
+dhd_bus_ringbell_oldpcie(struct dhd_bus *bus, uint32 value)
+{
+       uint32 w;
+       /* Skip once bus enters low power state (D3_INFORM/D3_ACK) */
+       if (__DHD_CHK_BUS_IN_LPS(bus)) {
+               DHD_ERROR(("%s: trying to ring the doorbell after D3 inform %d\n",
+                       __FUNCTION__, bus->bus_low_power_state));
+               return;
+       }
+
+       /* Skip in the case of link down */
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link was down\n", __FUNCTION__));
+               return;
+       }
+
+       w = (R_REG(bus->pcie_mb_intr_osh, bus->pcie_mb_intr_addr) & ~PCIE_INTB) | PCIE_INTB;
+       W_REG(bus->pcie_mb_intr_osh, bus->pcie_mb_intr_addr, w);
+}
+
+dhd_mb_ring_t
+dhd_bus_get_mbintr_fn(struct dhd_bus *bus)
+{
+       if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+               (bus->sih->buscorerev == 4)) {
+               bus->pcie_mb_intr_addr = si_corereg_addr(bus->sih, bus->sih->buscoreidx,
+                       bus->pcie_mailbox_int);
+               if (bus->pcie_mb_intr_addr) {
+                       bus->pcie_mb_intr_osh = si_osh(bus->sih);
+                       return dhd_bus_ringbell_oldpcie;
+               }
+       } else {
+               bus->pcie_mb_intr_addr = si_corereg_addr(bus->sih, bus->sih->buscoreidx,
+                       dhd_bus_db0_addr_get(bus));
+               if (bus->pcie_mb_intr_addr) {
+                       bus->pcie_mb_intr_osh = si_osh(bus->sih);
+                       return dhdpcie_bus_ringbell_fast;
+               }
+       }
+       return dhd_bus_ringbell;
+}
+
+dhd_mb_ring_2_t
+dhd_bus_get_mbintr_2_fn(struct dhd_bus *bus)
+{
+       bus->pcie_mb_intr_2_addr = si_corereg_addr(bus->sih, bus->sih->buscoreidx,
+               dhd_bus_db0_addr_2_get(bus));
+       if (bus->pcie_mb_intr_2_addr) {
+               bus->pcie_mb_intr_osh = si_osh(bus->sih);
+               return dhdpcie_bus_ringbell_2_fast;
+       }
+       return dhd_bus_ringbell_2;
+}
+
+bool
+BCMFASTPATH(dhd_bus_dpc)(struct dhd_bus *bus)
+{
+       bool resched = FALSE;     /* Flag indicating resched wanted */
+       unsigned long flags;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       bus->dpc_entry_time = OSL_LOCALTIME_NS();
+
+       /* must be the fisrt activity in this function */
+       if (dhd_query_bus_erros(bus->dhd)) {
+               dhdpcie_disable_irq_nosync(bus);
+               return 0;
+       }
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       /* Check for only DHD_BUS_DOWN and not for DHD_BUS_DOWN_IN_PROGRESS
+        * to avoid IOCTL Resumed On timeout when ioctl is waiting for response
+        * and rmmod is fired in parallel, which will make DHD_BUS_DOWN_IN_PROGRESS
+        * and if we return from here, then IOCTL response will never be handled
+        */
+       if (bus->dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s: Bus down, ret\n", __FUNCTION__));
+               bus->intstatus = 0;
+               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+               bus->dpc_return_busdown_count++;
+               return 0;
+       }
+#ifdef DHD_PCIE_RUNTIMEPM
+       bus->idlecount = 0;
+#endif /* DHD_PCIE_RUNTIMEPM */
+       DHD_BUS_BUSY_SET_IN_DPC(bus->dhd);
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+#ifdef DHD_READ_INTSTATUS_IN_DPC
+       if (bus->ipend) {
+               bus->ipend = FALSE;
+               bus->intstatus = dhdpcie_bus_intstatus(bus);
+               /* Check if the interrupt is ours or not */
+               if (bus->intstatus == 0) {
+                       goto INTR_ON;
+               }
+               bus->intrcount++;
+       }
+#endif /* DHD_READ_INTSTATUS_IN_DPC */
+
+       resched = dhdpcie_bus_process_mailbox_intr(bus, bus->intstatus);
+       if (!resched) {
+               bus->intstatus = 0;
+#ifdef DHD_READ_INTSTATUS_IN_DPC
+INTR_ON:
+#endif /* DHD_READ_INTSTATUS_IN_DPC */
+               bus->dpc_intr_enable_count++;
+               /* For Linux, Macos etc (otherthan NDIS) enable back the host interrupts
+                * which has been disabled in the dhdpcie_bus_isr()
+                */
+               if (dhdpcie_irq_disabled(bus)) {
+                       dhdpcie_enable_irq(bus); /* Enable back interrupt!! */
+                       bus->dpc_intr_enable_count++;
+               }
+               bus->dpc_exit_time = OSL_LOCALTIME_NS();
+       } else {
+               bus->resched_dpc_time = OSL_LOCALTIME_NS();
+       }
+
+       bus->dpc_sched = resched;
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       DHD_BUS_BUSY_CLEAR_IN_DPC(bus->dhd);
+       dhd_os_busbusy_wake(bus->dhd);
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+       return resched;
+
+}
+
+int
+dhdpcie_send_mb_data(dhd_bus_t *bus, uint32 h2d_mb_data)
+{
+       uint32 cur_h2d_mb_data = 0;
+
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link was down\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       DHD_INFO(("%s: H2D_MB_DATA: 0x%08X\n", __FUNCTION__, h2d_mb_data));
+
+#ifdef PCIE_INB_DW
+       dhd_bus_ds_trace(bus, h2d_mb_data, FALSE, dhdpcie_bus_get_pcie_inband_dw_state(bus));
+#else
+       dhd_bus_ds_trace(bus, h2d_mb_data, FALSE);
+#endif /* PCIE_INB_DW */
+       if (bus->api.fw_rev >= PCIE_SHARED_VERSION_6 && !bus->use_mailbox) {
+               DHD_INFO(("API rev is 6, sending mb data as H2D Ctrl message to dongle, 0x%04x\n",
+                       h2d_mb_data));
+               /* Prevent asserting device_wake during doorbell ring for mb data to avoid loop. */
+               /* XXX: check the error return value here... */
+               if (dhd_prot_h2d_mbdata_send_ctrlmsg(bus->dhd, h2d_mb_data)) {
+                       DHD_ERROR(("failure sending the H2D Mailbox message "
+                                       "to firmware\n"));
+                       goto fail;
+               }
+               goto done;
+       }
+
+       dhd_bus_cmn_readshared(bus, &cur_h2d_mb_data, H2D_MB_DATA, 0);
+
+       if (cur_h2d_mb_data != 0) {
+               uint32 i = 0;
+               DHD_INFO(("%s: GRRRRRRR: MB transaction is already pending 0x%04x\n", __FUNCTION__, cur_h2d_mb_data));
+               /* XXX: start a zero length timer to keep checking this to be zero */
+               while ((i++ < 100) && cur_h2d_mb_data) {
+                       OSL_DELAY(10);
+                       dhd_bus_cmn_readshared(bus, &cur_h2d_mb_data, H2D_MB_DATA, 0);
+               }
+               if (i >= 100) {
+                       DHD_ERROR(("%s : waited 1ms for the dngl "
+                               "to ack the previous mb transaction\n", __FUNCTION__));
+                       DHD_ERROR(("%s : MB transaction is still pending 0x%04x\n",
+                               __FUNCTION__, cur_h2d_mb_data));
+               }
+       }
+
+       dhd_bus_cmn_writeshared(bus, &h2d_mb_data, sizeof(uint32), H2D_MB_DATA, 0);
+       dhd_bus_gen_devmb_intr(bus);
+
+done:
+       if (h2d_mb_data == H2D_HOST_D3_INFORM) {
+               DHD_INFO_HW4(("%s: send H2D_HOST_D3_INFORM to dongle\n", __FUNCTION__));
+               bus->last_d3_inform_time = OSL_LOCALTIME_NS();
+               bus->d3_inform_cnt++;
+       }
+       if (h2d_mb_data == H2D_HOST_D0_INFORM_IN_USE) {
+               DHD_INFO_HW4(("%s: send H2D_HOST_D0_INFORM_IN_USE to dongle\n", __FUNCTION__));
+               bus->d0_inform_in_use_cnt++;
+       }
+       if (h2d_mb_data == H2D_HOST_D0_INFORM) {
+               DHD_INFO_HW4(("%s: send H2D_HOST_D0_INFORM to dongle\n", __FUNCTION__));
+               bus->d0_inform_cnt++;
+       }
+       return BCME_OK;
+fail:
+       return BCME_ERROR;
+}
+
+static void
+dhd_bus_handle_d3_ack(dhd_bus_t *bus)
+{
+       bus->suspend_intr_disable_count++;
+       /* Disable dongle Interrupts Immediately after D3 */
+
+       /* For Linux, Macos etc (otherthan NDIS) along with disabling
+        * dongle interrupt by clearing the IntMask, disable directly
+        * interrupt from the host side as well. Also clear the intstatus
+        * if it is set to avoid unnecessary intrrupts after D3 ACK.
+        */
+       dhdpcie_bus_intr_disable(bus); /* Disable interrupt using IntMask!! */
+       dhdpcie_bus_clear_intstatus(bus);
+       dhdpcie_disable_irq_nosync(bus); /* Disable host interrupt!! */
+
+       DHD_SET_BUS_LPS_D3_ACKED(bus);
+       DHD_ERROR(("%s: D3_ACK Recieved\n", __FUNCTION__));
+
+       if (bus->dhd->dhd_induce_error == DHD_INDUCE_D3_ACK_TIMEOUT) {
+               /* Set bus_low_power_state to DHD_BUS_D3_ACK_RECIEVED */
+               DHD_ERROR(("%s: Due to d3ack induce error forcefully set "
+               "bus_low_power_state to DHD_BUS_D3_INFORM_SENT\n", __FUNCTION__));
+               DHD_SET_BUS_LPS_D3_INFORMED(bus);
+       }
+       /* Check for D3 ACK induce flag, which is set by firing dhd iovar to induce D3 Ack timeout.
+        * If flag is set, D3 wake is skipped, which results in to D3 Ack timeout.
+        */
+       if (bus->dhd->dhd_induce_error != DHD_INDUCE_D3_ACK_TIMEOUT) {
+               bus->wait_for_d3_ack = 1;
+               dhd_os_d3ack_wake(bus->dhd);
+       } else {
+               DHD_ERROR(("%s: Inducing D3 ACK timeout\n", __FUNCTION__));
+       }
+}
+void
+dhd_bus_handle_mb_data(dhd_bus_t *bus, uint32 d2h_mb_data)
+{
+#ifdef PCIE_INB_DW
+       unsigned long flags = 0;
+#endif /* PCIE_INB_DW */
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req(bus);
+       }
+
+       DHD_INFO(("D2H_MB_DATA: 0x%04x\n", d2h_mb_data));
+#ifdef PCIE_INB_DW
+       DHD_BUS_INB_DW_LOCK(bus->inb_lock, flags);
+       dhd_bus_ds_trace(bus, d2h_mb_data, TRUE, dhdpcie_bus_get_pcie_inband_dw_state(bus));
+       DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+#else
+       dhd_bus_ds_trace(bus, d2h_mb_data, TRUE);
+#endif /* PCIE_INB_DW */
+
+       if (d2h_mb_data & D2H_DEV_FWHALT) {
+               if (bus->dhd->db7_trap.fw_db7w_trap_inprogress == FALSE) {
+                       DHD_ERROR(("FW trap has happened, dongle_trap_data 0x%8x\n",
+                               bus->dhd->dongle_trap_data));
+               }
+
+               if (bus->dhd->dongle_trap_data & D2H_DEV_TRAP_HOSTDB) {
+                       uint64 db7_dur;
+
+                       bus->dhd->db7_trap.debug_db7_trap_time = OSL_LOCALTIME_NS();
+                       bus->dhd->db7_trap.debug_db7_trap_cnt++;
+                       db7_dur = bus->dhd->db7_trap.debug_db7_trap_time -
+                               bus->dhd->db7_trap.debug_db7_send_time;
+                       if (db7_dur > bus->dhd->db7_trap.debug_max_db7_dur) {
+                               bus->dhd->db7_trap.debug_max_db7_send_time =
+                                       bus->dhd->db7_trap.debug_db7_send_time;
+                               bus->dhd->db7_trap.debug_max_db7_trap_time =
+                                       bus->dhd->db7_trap.debug_db7_trap_time;
+                       }
+                       bus->dhd->db7_trap.debug_max_db7_dur =
+                               MAX(bus->dhd->db7_trap.debug_max_db7_dur, db7_dur);
+                       if (bus->dhd->db7_trap.fw_db7w_trap_inprogress == FALSE) {
+                               bus->dhd->db7_trap.debug_db7_timing_error_cnt++;
+                       }
+               } else {
+                       dhdpcie_checkdied(bus, NULL, 0);
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+                       bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+                       dhd_os_check_hang(bus->dhd, 0, -EREMOTEIO);
+               }
+               if (bus->dhd->db7_trap.fw_db7w_trap_inprogress) {
+                       bus->dhd->db7_trap.fw_db7w_trap_inprogress = FALSE;
+                       bus->dhd->dongle_trap_occured = TRUE;
+               }
+               goto exit;
+       }
+       if (d2h_mb_data & D2H_DEV_DS_ENTER_REQ)  {
+               bool ds_acked = FALSE;
+               BCM_REFERENCE(ds_acked);
+               if (__DHD_CHK_BUS_LPS_D3_ACKED(bus)) {
+                       DHD_ERROR(("DS-ENTRY AFTER D3-ACK!!!!! QUITING\n"));
+                       DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+                       bus->dhd->busstate = DHD_BUS_DOWN;
+                       goto exit;
+               }
+               /* what should we do */
+               DHD_INFO(("D2H_MB_DATA: DEEP SLEEP REQ\n"));
+#ifdef PCIE_INB_DW
+               if (INBAND_DW_ENAB(bus)) {
+                       /* As per inband state machine, host should not send DS-ACK
+                        * during suspend or suspend in progress, instead D3 inform will be sent.
+                        */
+                       if (!bus->skip_ds_ack) {
+                               DHD_BUS_INB_DW_LOCK(bus->inb_lock, flags);
+                               if (dhdpcie_bus_get_pcie_inband_dw_state(bus)
+                                       == DW_DEVICE_DS_ACTIVE) {
+                                       dhdpcie_bus_set_pcie_inband_dw_state(bus,
+                                               DW_DEVICE_DS_DEV_SLEEP_PEND);
+                                        if (bus->host_active_cnt == 0) {
+                                               dhdpcie_bus_set_pcie_inband_dw_state(bus,
+                                                       DW_DEVICE_DS_DEV_SLEEP);
+                                               dhdpcie_send_mb_data(bus, H2D_HOST_DS_ACK);
+                                               ds_acked = TRUE;
+                                               DHD_INFO(("D2H_MB_DATA: sent DEEP SLEEP"
+                                                       "ACK to DNGL\n"));
+                                       } else {
+                                               DHD_ERROR(("%s: Failed to send DS-ACK, "
+                                                       "host_active_cnt is %d\n",
+                                                       __FUNCTION__, bus->host_active_cnt));
+                                       }
+                               }
+                               /* Currently DW_DEVICE_HOST_SLEEP_WAIT is set only
+                                * under dhd_bus_suspend() function.
+                                */
+                               else if (dhdpcie_bus_get_pcie_inband_dw_state(bus)
+                               == DW_DEVICE_HOST_SLEEP_WAIT) {
+                                       DHD_ERROR(("%s: DS-ACK not sent due to suspend "
+                                               "in progress\n", __FUNCTION__));
+                               } else {
+                                       DHD_ERROR(("%s: Failed to send DS-ACK, DS state is %d",
+                                               __FUNCTION__,
+                                               dhdpcie_bus_get_pcie_inband_dw_state(bus)));
+                               }
+                               DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+                               dhd_os_ds_enter_wake(bus->dhd);
+                       } else {
+                               DHD_INFO(("%s: Skip DS-ACK due to "
+                                       "suspend in progress\n", __FUNCTION__));
+                       }
+               } else
+#endif /* PCIE_INB_DW */
+               {
+                       dhdpcie_send_mb_data(bus, H2D_HOST_DS_ACK);
+                       DHD_INFO(("D2H_MB_DATA: sent DEEP SLEEP ACK\n"));
+               }
+       }
+       if (d2h_mb_data & D2H_DEV_DS_EXIT_NOTE)  {
+#ifdef PCIE_INB_DW
+               if (INBAND_DW_ENAB(bus)) {
+                       if (bus->calc_ds_exit_latency) {
+                               bus->ds_exit_ts2 = OSL_SYSUPTIME_US();
+                               if (bus->ds_exit_ts2 > bus->ds_exit_ts1 &&
+                                               bus->ds_exit_ts1 != 0)
+                                       bus->ds_exit_latency = bus->ds_exit_ts2 - bus->ds_exit_ts1;
+                               else
+                                       bus->ds_exit_latency = 0;
+                       }
+               }
+#endif /* PCIE_INB_DW */
+               /* what should we do */
+               DHD_INFO(("D2H_MB_DATA: DEEP SLEEP EXIT\n"));
+#ifdef PCIE_INB_DW
+               if (INBAND_DW_ENAB(bus)) {
+                       DHD_BUS_INB_DW_LOCK(bus->inb_lock, flags);
+                       if (dhdpcie_bus_get_pcie_inband_dw_state(bus) ==
+                                       DW_DEVICE_DS_DISABLED_WAIT) {
+                               /* wake up only if some one is waiting in
+                               * DW_DEVICE_DS_DISABLED_WAIT state
+                               * in this case the waiter will change the state
+                               * to DW_DEVICE_DS_DEV_WAKE
+                               */
+                               bus->inband_ds_exit_host_cnt++;
+                               /* To synchronize with the previous memory operations call wmb() */
+                               OSL_SMP_WMB();
+                               bus->wait_for_ds_exit = 1;
+                               /* Call another wmb() to make sure before waking up the
+                                * other event value gets updated.
+                                */
+                               OSL_SMP_WMB();
+                               dhdpcie_bus_set_pcie_inband_dw_state(bus,
+                                       DW_DEVICE_DS_DEV_WAKE);
+                               DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+                               dhd_os_ds_exit_wake(bus->dhd);
+                       } else if (dhdpcie_bus_get_pcie_inband_dw_state(bus) ==
+                                       DW_DEVICE_DS_DEV_SLEEP) {
+                               DHD_INFO(("recvd unsolicited DS-EXIT from dongle in DEV_SLEEP\n"));
+                               /*
+                               * unsolicited state change to DW_DEVICE_DS_DEV_WAKE if
+                               * D2H_DEV_DS_EXIT_NOTE received in DW_DEVICE_DS_DEV_SLEEP state.
+                               * This is need when dongle is woken by external events like
+                               * WOW, ping ..etc
+                               */
+                               bus->inband_ds_exit_device_cnt++;
+                               dhdpcie_bus_set_pcie_inband_dw_state(bus,
+                                       DW_DEVICE_DS_DEV_WAKE);
+                               DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+                       } else {
+                               DHD_INFO(("D2H_MB_DATA: not in DS_DISABLED_WAIT/DS_DEV_SLEEP\n"));
+                               bus->inband_ds_exit_host_cnt++;
+                               DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+                       }
+                       dhd_bus_set_device_wake(bus, FALSE);
+               }
+#endif /* PCIE_INB_DW */
+       }
+       if (d2h_mb_data & D2HMB_DS_HOST_SLEEP_EXIT_ACK)  {
+               /* what should we do */
+               DHD_INFO(("D2H_MB_DATA: D0 ACK\n"));
+#ifdef PCIE_INB_DW
+               if (INBAND_DW_ENAB(bus)) {
+                       DHD_BUS_INB_DW_LOCK(bus->inb_lock, flags);
+                       if (dhdpcie_bus_get_pcie_inband_dw_state(bus) ==
+                               DW_DEVICE_HOST_WAKE_WAIT) {
+                               dhdpcie_bus_set_pcie_inband_dw_state(bus, DW_DEVICE_DS_ACTIVE);
+                       }
+                       DHD_BUS_INB_DW_UNLOCK(bus->inb_lock, flags);
+               }
+#endif /* PCIE_INB_DW */
+       }
+       if (d2h_mb_data & D2H_DEV_D3_ACK)  {
+               /* what should we do */
+               DHD_INFO_HW4(("D2H_MB_DATA: D3 ACK\n"));
+               if (!bus->wait_for_d3_ack) {
+#if defined(DHD_HANG_SEND_UP_TEST)
+                       if (bus->dhd->req_hang_type == HANG_REASON_D3_ACK_TIMEOUT) {
+                               DHD_ERROR(("TEST HANG: Skip to process D3 ACK\n"));
+                       } else {
+                               dhd_bus_handle_d3_ack(bus);
+                       }
+#else /* DHD_HANG_SEND_UP_TEST */
+                       dhd_bus_handle_d3_ack(bus);
+#endif /* DHD_HANG_SEND_UP_TEST */
+               }
+       }
+
+exit:
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req_clear(bus);
+       }
+}
+
+static void
+dhdpcie_handle_mb_data(dhd_bus_t *bus)
+{
+       uint32 d2h_mb_data = 0;
+       uint32 zero = 0;
+
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req(bus);
+       }
+
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link is down\n", __FUNCTION__));
+               return;
+       }
+
+       dhd_bus_cmn_readshared(bus, &d2h_mb_data, D2H_MB_DATA, 0);
+       if (D2H_DEV_MB_INVALIDATED(d2h_mb_data)) {
+               DHD_ERROR(("%s: Invalid D2H_MB_DATA: 0x%08x\n",
+                       __FUNCTION__, d2h_mb_data));
+               goto exit;
+       }
+
+       dhd_bus_cmn_writeshared(bus, &zero, sizeof(uint32), D2H_MB_DATA, 0);
+
+       DHD_INFO_HW4(("%s: D2H_MB_DATA: 0x%04x\n", __FUNCTION__, d2h_mb_data));
+       if (d2h_mb_data & D2H_DEV_FWHALT)  {
+               DHD_ERROR(("FW trap has happened\n"));
+               dhdpcie_checkdied(bus, NULL, 0);
+               /* not ready yet dhd_os_ind_firmware_stall(bus->dhd); */
+               goto exit;
+       }
+       if (d2h_mb_data & D2H_DEV_DS_ENTER_REQ)  {
+               /* what should we do */
+               DHD_INFO(("%s: D2H_MB_DATA: DEEP SLEEP REQ\n", __FUNCTION__));
+               dhdpcie_send_mb_data(bus, H2D_HOST_DS_ACK);
+               DHD_INFO(("%s: D2H_MB_DATA: sent DEEP SLEEP ACK\n", __FUNCTION__));
+       }
+       if (d2h_mb_data & D2H_DEV_DS_EXIT_NOTE)  {
+               /* what should we do */
+               DHD_INFO(("%s: D2H_MB_DATA: DEEP SLEEP EXIT\n", __FUNCTION__));
+       }
+       if (d2h_mb_data & D2H_DEV_D3_ACK)  {
+               /* what should we do */
+               DHD_INFO_HW4(("%s: D2H_MB_DATA: D3 ACK\n", __FUNCTION__));
+               if (!bus->wait_for_d3_ack) {
+#if defined(DHD_HANG_SEND_UP_TEST)
+                       if (bus->dhd->req_hang_type == HANG_REASON_D3_ACK_TIMEOUT) {
+                               DHD_ERROR(("TEST HANG: Skip to process D3 ACK\n"));
+                       } else {
+                       dhd_bus_handle_d3_ack(bus);
+                       }
+#else /* DHD_HANG_SEND_UP_TEST */
+                       dhd_bus_handle_d3_ack(bus);
+#endif /* DHD_HANG_SEND_UP_TEST */
+               }
+       }
+
+exit:
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req_clear(bus);
+       }
+}
+
+static void
+dhdpcie_read_handle_mb_data(dhd_bus_t *bus)
+{
+       uint32 d2h_mb_data = 0;
+       uint32 zero = 0;
+
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req(bus);
+       }
+
+       dhd_bus_cmn_readshared(bus, &d2h_mb_data, D2H_MB_DATA, 0);
+       if (!d2h_mb_data) {
+               goto exit;
+       }
+
+       dhd_bus_cmn_writeshared(bus, &zero, sizeof(uint32), D2H_MB_DATA, 0);
+
+       dhd_bus_handle_mb_data(bus, d2h_mb_data);
+
+exit:
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req_clear(bus);
+       }
+}
+
+static bool
+dhdpcie_bus_process_mailbox_intr(dhd_bus_t *bus, uint32 intstatus)
+{
+       bool resched = FALSE;
+
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req(bus);
+       }
+       if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+               (bus->sih->buscorerev == 4)) {
+               /* Msg stream interrupt */
+               if (intstatus & I_BIT1) {
+                       resched = dhdpci_bus_read_frames(bus);
+               } else if (intstatus & I_BIT0) {
+                       /* do nothing for Now */
+               }
+       } else {
+               if (intstatus & (PCIE_MB_TOPCIE_FN0_0 | PCIE_MB_TOPCIE_FN0_1))
+                       bus->api.handle_mb_data(bus);
+
+               /* Do no process any rings after recieving D3_ACK */
+               if (DHD_CHK_BUS_LPS_D3_ACKED(bus)) {
+                       DHD_ERROR(("%s: D3 Ack Recieved. "
+                               "Skip processing rest of ring buffers.\n", __FUNCTION__));
+                       goto exit;
+               }
+
+               /* The fact that we are here implies that dhdpcie_bus_intstatus( )
+               * retuned a non-zer0 status after applying the current mask.
+               * No further check required, in fact bus->instatus can be eliminated.
+               * Both bus->instatus, and bud->intdis are shared between isr and dpc.
+               */
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+               if (pm_runtime_get(dhd_bus_to_dev(bus)) >= 0) {
+                       resched = dhdpci_bus_read_frames(bus);
+                       pm_runtime_mark_last_busy(dhd_bus_to_dev(bus));
+                       pm_runtime_put_autosuspend(dhd_bus_to_dev(bus));
+               }
+#else
+               resched = dhdpci_bus_read_frames(bus);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+       }
+
+exit:
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req_clear(bus);
+       }
+       return resched;
+}
+
+#if defined(DHD_H2D_LOG_TIME_SYNC)
+static void
+dhdpci_bus_rte_log_time_sync_poll(dhd_bus_t *bus)
+{
+       unsigned long time_elapsed;
+
+       /* Poll for timeout value periodically */
+       if ((bus->dhd->busstate == DHD_BUS_DATA) &&
+               (bus->dhd->dhd_rte_time_sync_ms != 0) &&
+               DHD_CHK_BUS_NOT_IN_LPS(bus)) {
+               /*
+                * XXX OSL_SYSUPTIME_US() overflow should not happen.
+                * As it is a unsigned 64 bit value 18446744073709551616L,
+                * which needs 213503982334 days to overflow
+                */
+               time_elapsed = OSL_SYSUPTIME_US() - bus->dhd_rte_time_sync_count;
+               /* Compare time is milli seconds */
+               if ((time_elapsed / 1000) >= bus->dhd->dhd_rte_time_sync_ms) {
+                       /*
+                        * Its fine, if it has crossed the timeout value. No need to adjust the
+                        * elapsed time
+                        */
+                       bus->dhd_rte_time_sync_count += time_elapsed;
+
+                       /* Schedule deffered work. Work function will send IOVAR. */
+                       dhd_h2d_log_time_sync_deferred_wq_schedule(bus->dhd);
+               }
+       }
+}
+#endif /* DHD_H2D_LOG_TIME_SYNC */
+
+static bool
+dhdpci_bus_read_frames(dhd_bus_t *bus)
+{
+       bool more = FALSE;
+
+       /* First check if there a FW trap */
+       if ((bus->api.fw_rev >= PCIE_SHARED_VERSION_6) &&
+               (bus->dhd->dongle_trap_data = dhd_prot_process_trapbuf(bus->dhd))) {
+#ifdef DNGL_AXI_ERROR_LOGGING
+               if (bus->dhd->axi_error) {
+                       DHD_ERROR(("AXI Error happened\n"));
+                       return FALSE;
+               }
+#endif /* DNGL_AXI_ERROR_LOGGING */
+               dhd_bus_handle_mb_data(bus, D2H_DEV_FWHALT);
+               return FALSE;
+       }
+
+       /* There may be frames in both ctrl buf and data buf; check ctrl buf first */
+       dhd_prot_process_ctrlbuf(bus->dhd);
+       bus->last_process_ctrlbuf_time = OSL_LOCALTIME_NS();
+
+       /* Do not process rest of ring buf once bus enters low power state (D3_INFORM/D3_ACK) */
+       if (DHD_CHK_BUS_IN_LPS(bus)) {
+               DHD_ERROR(("%s: Bus is in power save state (%d). "
+                       "Skip processing rest of ring buffers.\n",
+                       __FUNCTION__, bus->bus_low_power_state));
+               return FALSE;
+       }
+
+       /* update the flow ring cpls */
+       dhd_update_txflowrings(bus->dhd);
+       bus->last_process_flowring_time = OSL_LOCALTIME_NS();
+
+       /* With heavy TX traffic, we could get a lot of TxStatus
+        * so add bound
+        */
+       more |= dhd_prot_process_msgbuf_txcpl(bus->dhd, dhd_txbound, DHD_REGULAR_RING);
+       bus->last_process_txcpl_time = OSL_LOCALTIME_NS();
+
+       /* With heavy RX traffic, this routine potentially could spend some time
+        * processing RX frames without RX bound
+        */
+       more |= dhd_prot_process_msgbuf_rxcpl(bus->dhd, dhd_rxbound, DHD_REGULAR_RING);
+       bus->last_process_rxcpl_time = OSL_LOCALTIME_NS();
+
+       /* Process info ring completion messages */
+#ifdef EWP_EDL
+       if (!bus->dhd->dongle_edl_support)
+#endif
+       {
+               more |= dhd_prot_process_msgbuf_infocpl(bus->dhd, DHD_INFORING_BOUND);
+               bus->last_process_infocpl_time = OSL_LOCALTIME_NS();
+       }
+#ifdef EWP_EDL
+       else {
+               more |= dhd_prot_process_msgbuf_edl(bus->dhd);
+               bus->last_process_edl_time = OSL_LOCALTIME_NS();
+       }
+#endif /* EWP_EDL */
+
+#ifdef IDLE_TX_FLOW_MGMT
+       if (bus->enable_idle_flowring_mgmt) {
+               /* Look for idle flow rings */
+               dhd_bus_check_idle_scan(bus);
+       }
+#endif /* IDLE_TX_FLOW_MGMT */
+
+       /* don't talk to the dongle if fw is about to be reloaded */
+       if (bus->dhd->hang_was_sent) {
+               more = FALSE;
+       }
+
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+       /* XXX : It seems that linkdown is occurred without notification,
+        *       In case read shared memory failed, recovery hang is needed
+        */
+       if (bus->read_shm_fail) {
+               /* Read interrupt state once again to confirm linkdown */
+               int intstatus = si_corereg(bus->sih, bus->sih->buscoreidx,
+                       bus->pcie_mailbox_int, 0, 0);
+               if (intstatus != (uint32)-1) {
+                       DHD_ERROR(("%s: read SHM failed but intstatus is valid\n", __FUNCTION__));
+#ifdef DHD_FW_COREDUMP
+                       if (bus->dhd->memdump_enabled) {
+                               DHD_OS_WAKE_LOCK(bus->dhd);
+                               bus->dhd->memdump_type = DUMP_TYPE_READ_SHM_FAIL;
+                               dhd_bus_mem_dump(bus->dhd);
+                               DHD_OS_WAKE_UNLOCK(bus->dhd);
+                       }
+#endif /* DHD_FW_COREDUMP */
+               } else {
+                       DHD_ERROR(("%s: Link is Down.\n", __FUNCTION__));
+#ifdef CONFIG_ARCH_MSM
+                       bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+                       bus->is_linkdown = 1;
+               }
+
+               /* XXX The dhd_prot_debug_info_print() function *has* to be
+                * invoked only if the bus->is_linkdown is updated so that
+                * host doesn't need to read any pcie registers if
+                * PCIe link is down.
+                */
+               dhd_prot_debug_info_print(bus->dhd);
+               bus->dhd->hang_reason = HANG_REASON_PCIE_LINK_DOWN_EP_DETECT;
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+               copy_hang_info_linkdown(bus->dhd);
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+               dhd_os_send_hang_message(bus->dhd);
+               more = FALSE;
+       }
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+#if defined(DHD_H2D_LOG_TIME_SYNC)
+       dhdpci_bus_rte_log_time_sync_poll(bus);
+#endif /* DHD_H2D_LOG_TIME_SYNC */
+       return more;
+}
+
+bool
+dhdpcie_tcm_valid(dhd_bus_t *bus)
+{
+       uint32 addr = 0;
+       int rv;
+       uint32 shaddr = 0;
+       pciedev_shared_t sh;
+
+       shaddr = bus->dongle_ram_base + bus->ramsize - 4;
+
+       /* Read last word in memory to determine address of pciedev_shared structure */
+       addr = LTOH32(dhdpcie_bus_rtcm32(bus, shaddr));
+
+       if ((addr == 0) || (addr == bus->nvram_csm) || (addr < bus->dongle_ram_base) ||
+               (addr > shaddr)) {
+               DHD_ERROR(("%s: address (0x%08x) of pciedev_shared invalid addr\n",
+                       __FUNCTION__, addr));
+               return FALSE;
+       }
+
+       /* Read hndrte_shared structure */
+       if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr, (uint8 *)&sh,
+               sizeof(pciedev_shared_t))) < 0) {
+               DHD_ERROR(("Failed to read PCIe shared struct with %d\n", rv));
+               return FALSE;
+       }
+
+       /* Compare any field in pciedev_shared_t */
+       if (sh.console_addr != bus->pcie_sh->console_addr) {
+               DHD_ERROR(("Contents of pciedev_shared_t structure are not matching.\n"));
+               return FALSE;
+       }
+
+       return TRUE;
+}
+
+static void
+dhdpcie_update_bus_api_revisions(uint32 firmware_api_version, uint32 host_api_version)
+{
+       snprintf(bus_api_revision, BUS_API_REV_STR_LEN, "\nBus API revisions:(FW rev%d)(DHD rev%d)",
+                       firmware_api_version, host_api_version);
+       return;
+}
+
+static bool
+dhdpcie_check_firmware_compatible(uint32 firmware_api_version, uint32 host_api_version)
+{
+       bool retcode = FALSE;
+
+       DHD_INFO(("firmware api revision %d, host api revision %d\n",
+               firmware_api_version, host_api_version));
+
+       switch (firmware_api_version) {
+       case PCIE_SHARED_VERSION_7:
+       case PCIE_SHARED_VERSION_6:
+       case PCIE_SHARED_VERSION_5:
+               retcode = TRUE;
+               break;
+       default:
+               if (firmware_api_version <= host_api_version)
+                       retcode = TRUE;
+       }
+       return retcode;
+}
+
+static int
+dhdpcie_readshared(dhd_bus_t *bus)
+{
+       uint32 addr = 0;
+       int rv, dma_indx_wr_buf, dma_indx_rd_buf;
+       uint32 shaddr = 0;
+       pciedev_shared_t *sh = bus->pcie_sh;
+       dhd_timeout_t tmo;
+       bool idma_en = FALSE;
+#if defined(PCIE_INB_DW)
+       bool d2h_inband_dw = FALSE;
+#endif /* defined(PCIE_INB_DW) */
+       uint32 timeout = MAX_READ_TIMEOUT;
+       uint32 elapsed;
+
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req(bus);
+       }
+
+       shaddr = bus->dongle_ram_base + bus->ramsize - 4;
+
+       /* start a timer for 5 seconds */
+       dhd_timeout_start(&tmo, timeout);
+
+       while (((addr == 0) || (addr == bus->nvram_csm)) && !dhd_timeout_expired(&tmo)) {
+               /* Read last word in memory to determine address of pciedev_shared structure */
+               addr = LTOH32(dhdpcie_bus_rtcm32(bus, shaddr));
+       }
+
+       if (addr == (uint32)-1) {
+               DHD_ERROR(("%s: PCIe link might be down\n", __FUNCTION__));
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+               bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+               bus->is_linkdown = 1;
+               return BCME_ERROR;
+       }
+
+       if ((addr == 0) || (addr == bus->nvram_csm) || (addr < bus->dongle_ram_base) ||
+               (addr > shaddr)) {
+               elapsed = tmo.elapsed;
+               DHD_ERROR(("%s: address (0x%08x) of pciedev_shared invalid\n",
+                       __FUNCTION__, addr));
+               DHD_ERROR(("%s: Waited %u usec, dongle is not ready\n", __FUNCTION__, tmo.elapsed));
+#ifdef DEBUG_DNGL_INIT_FAIL
+               if (addr != (uint32)-1) {       /* skip further PCIE reads if read this addr */
+#ifdef DHD_DUMP_FILE_WRITE_FROM_KERNEL
+                       bus->dhd->memdump_enabled = DUMP_MEMFILE;
+#else
+                       /* Force panic as HAL will not be inited yet */
+                       bus->dhd->memdump_enabled = DUMP_MEMONLY;
+#endif /* DHD_DUMP_FILE_WRITE_FROM_KERNEL */
+                       if (bus->dhd->memdump_enabled) {
+                               bus->dhd->memdump_type = DUMP_TYPE_DONGLE_INIT_FAILURE;
+                               dhdpcie_mem_dump(bus);
+                       }
+               }
+#endif /* DEBUG_DNGL_INIT_FAIL */
+               return BCME_ERROR;
+       } else {
+               bus->rd_shared_pass_time = OSL_LOCALTIME_NS();
+               elapsed = tmo.elapsed;
+               bus->shared_addr = (ulong)addr;
+               DHD_ERROR(("### Total time ARM OOR to Readshared pass took %llu usec ###\n",
+                       DIV_U64_BY_U32((bus->rd_shared_pass_time - bus->arm_oor_time),
+                       NSEC_PER_USEC)));
+               DHD_ERROR(("%s: PCIe shared addr (0x%08x) read took %u usec "
+                       "before dongle is ready\n", __FUNCTION__, addr, elapsed));
+       }
+
+       /* Read hndrte_shared structure */
+       if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr, (uint8 *)sh,
+               sizeof(pciedev_shared_t))) < 0) {
+               DHD_ERROR(("%s: Failed to read PCIe shared struct with %d\n", __FUNCTION__, rv));
+               return rv;
+       }
+
+       /* Endianness */
+       sh->flags = ltoh32(sh->flags);
+       sh->trap_addr = ltoh32(sh->trap_addr);
+       sh->assert_exp_addr = ltoh32(sh->assert_exp_addr);
+       sh->assert_file_addr = ltoh32(sh->assert_file_addr);
+       sh->assert_line = ltoh32(sh->assert_line);
+       sh->console_addr = ltoh32(sh->console_addr);
+       sh->msgtrace_addr = ltoh32(sh->msgtrace_addr);
+       sh->dma_rxoffset = ltoh32(sh->dma_rxoffset);
+       sh->rings_info_ptr = ltoh32(sh->rings_info_ptr);
+       sh->flags2 = ltoh32(sh->flags2);
+
+       /* load bus console address */
+       bus->console_addr = sh->console_addr;
+
+       /* Read the dma rx offset */
+       bus->dma_rxoffset = bus->pcie_sh->dma_rxoffset;
+       dhd_prot_rx_dataoffset(bus->dhd, bus->dma_rxoffset);
+
+       DHD_INFO(("%s: DMA RX offset from shared Area %d\n", __FUNCTION__, bus->dma_rxoffset));
+
+       bus->api.fw_rev = sh->flags & PCIE_SHARED_VERSION_MASK;
+       if (!(dhdpcie_check_firmware_compatible(bus->api.fw_rev, PCIE_SHARED_VERSION)))
+       {
+               DHD_ERROR(("%s: pcie_shared version %d in dhd "
+                          "is older than pciedev_shared version %d in dongle\n",
+                          __FUNCTION__, PCIE_SHARED_VERSION,
+                          bus->api.fw_rev));
+               return BCME_ERROR;
+       }
+       dhdpcie_update_bus_api_revisions(bus->api.fw_rev, PCIE_SHARED_VERSION);
+
+       bus->rw_index_sz = (sh->flags & PCIE_SHARED_2BYTE_INDICES) ?
+               sizeof(uint16) : sizeof(uint32);
+       DHD_INFO(("%s: Dongle advertizes %d size indices\n",
+               __FUNCTION__, bus->rw_index_sz));
+
+#ifdef IDLE_TX_FLOW_MGMT
+       if (sh->flags & PCIE_SHARED_IDLE_FLOW_RING) {
+               DHD_ERROR(("%s: FW Supports IdleFlow ring managment!\n",
+                       __FUNCTION__));
+               bus->enable_idle_flowring_mgmt = TRUE;
+       }
+#endif /* IDLE_TX_FLOW_MGMT */
+
+#ifdef PCIE_INB_DW
+       bus->dhd->d2h_inband_dw = (sh->flags & PCIE_SHARED_INBAND_DS) ? TRUE : FALSE;
+       d2h_inband_dw = bus->dhd->d2h_inband_dw;
+#endif /* PCIE_INB_DW */
+
+#if defined(PCIE_INB_DW)
+       DHD_ERROR(("FW supports Inband dw ? %s\n",
+               d2h_inband_dw ? "Y":"N"));
+#endif /* defined(PCIE_INB_DW) */
+
+       if (IDMA_CAPABLE(bus)) {
+               if (bus->sih->buscorerev == 23) {
+#ifdef PCIE_INB_DW
+                       if (bus->dhd->d2h_inband_dw)
+                       {
+                               idma_en = TRUE;
+                       }
+#endif /* PCIE_INB_DW */
+               } else {
+                       idma_en = TRUE;
+               }
+       }
+
+       /* Read flag2 HWA bit */
+       bus->dhd->hwa_capable = (sh->flags2 & PCIE_SHARED2_HWA) ? TRUE : FALSE;
+       DHD_ERROR(("FW supports HWA ? %s\n", bus->dhd->hwa_capable ? "Y":"N"));
+       bus->hwa_db_index_sz = PCIE_HWA_DB_INDEX_SZ;
+
+       if (idma_en) {
+               bus->dhd->idma_enable = (sh->flags & PCIE_SHARED_IDMA) ? TRUE : FALSE;
+               bus->dhd->ifrm_enable = (sh->flags & PCIE_SHARED_IFRM) ? TRUE : FALSE;
+       }
+
+       bus->dhd->d2h_sync_mode = sh->flags & PCIE_SHARED_D2H_SYNC_MODE_MASK;
+
+       bus->dhd->dar_enable = (sh->flags & PCIE_SHARED_DAR) ? TRUE : FALSE;
+
+       /* Does the FW support DMA'ing r/w indices */
+       if (sh->flags & PCIE_SHARED_DMA_INDEX) {
+               if (!bus->dhd->dma_ring_upd_overwrite) {
+                       {
+                               if (!IFRM_ENAB(bus->dhd)) {
+                                       bus->dhd->dma_h2d_ring_upd_support = TRUE;
+                               }
+                               bus->dhd->dma_d2h_ring_upd_support = TRUE;
+                       }
+               }
+
+               if (bus->dhd->dma_d2h_ring_upd_support && bus->dhd->d2h_sync_mode) {
+                       DHD_ERROR(("%s: ERROR COMBO: sync (0x%x) enabled for DMA indices\n",
+                               __FUNCTION__, bus->dhd->d2h_sync_mode));
+               }
+
+               DHD_INFO(("%s: Host support DMAing indices: H2D:%d - D2H:%d. FW supports it\n",
+                       __FUNCTION__,
+                       (bus->dhd->dma_h2d_ring_upd_support ? 1 : 0),
+                       (bus->dhd->dma_d2h_ring_upd_support ? 1 : 0)));
+       } else if (!(sh->flags & PCIE_SHARED_D2H_SYNC_MODE_MASK)) {
+               DHD_ERROR(("%s FW has to support either dma indices or d2h sync\n",
+                       __FUNCTION__));
+               return BCME_UNSUPPORTED;
+       } else {
+               bus->dhd->dma_h2d_ring_upd_support = FALSE;
+               bus->dhd->dma_d2h_ring_upd_support = FALSE;
+       }
+
+       /* Does the firmware support fast delete ring? */
+       if (sh->flags2 & PCIE_SHARED2_FAST_DELETE_RING) {
+               DHD_INFO(("%s: Firmware supports fast delete ring\n",
+                       __FUNCTION__));
+               bus->dhd->fast_delete_ring_support = TRUE;
+       } else {
+               DHD_INFO(("%s: Firmware does not support fast delete ring\n",
+                       __FUNCTION__));
+               bus->dhd->fast_delete_ring_support = FALSE;
+       }
+
+       /* get ring_info, ring_state and mb data ptrs and store the addresses in bus structure */
+       {
+               ring_info_t  ring_info;
+
+               /* boundary check */
+               if ((sh->rings_info_ptr < bus->dongle_ram_base) || (sh->rings_info_ptr > shaddr)) {
+                       DHD_ERROR(("%s: rings_info_ptr is invalid 0x%x, skip reading ring info\n",
+                               __FUNCTION__, sh->rings_info_ptr));
+                       return BCME_ERROR;
+               }
+
+               if ((rv = dhdpcie_bus_membytes(bus, FALSE, sh->rings_info_ptr,
+                       (uint8 *)&ring_info, sizeof(ring_info_t))) < 0)
+                       return rv;
+
+               bus->h2d_mb_data_ptr_addr = ltoh32(sh->h2d_mb_data_ptr);
+               bus->d2h_mb_data_ptr_addr = ltoh32(sh->d2h_mb_data_ptr);
+
+               if (bus->api.fw_rev >= PCIE_SHARED_VERSION_6) {
+                       bus->max_tx_flowrings = ltoh16(ring_info.max_tx_flowrings);
+                       bus->max_submission_rings = ltoh16(ring_info.max_submission_queues);
+                       bus->max_completion_rings = ltoh16(ring_info.max_completion_rings);
+                       bus->max_cmn_rings = bus->max_submission_rings - bus->max_tx_flowrings;
+                       bus->api.handle_mb_data = dhdpcie_read_handle_mb_data;
+                       bus->use_mailbox = sh->flags & PCIE_SHARED_USE_MAILBOX;
+               }
+               else {
+                       bus->max_tx_flowrings = ltoh16(ring_info.max_tx_flowrings);
+                       bus->max_submission_rings = bus->max_tx_flowrings;
+                       bus->max_completion_rings = BCMPCIE_D2H_COMMON_MSGRINGS;
+                       bus->max_cmn_rings = BCMPCIE_H2D_COMMON_MSGRINGS;
+                       bus->api.handle_mb_data = dhdpcie_handle_mb_data;
+                       bus->use_mailbox = TRUE;
+               }
+               if (bus->max_completion_rings == 0) {
+                       DHD_ERROR(("dongle completion rings are invalid %d\n",
+                               bus->max_completion_rings));
+                       return BCME_ERROR;
+               }
+               if (bus->max_submission_rings == 0) {
+                       DHD_ERROR(("dongle submission rings are invalid %d\n",
+                               bus->max_submission_rings));
+                       return BCME_ERROR;
+               }
+               if (bus->max_tx_flowrings == 0) {
+                       DHD_ERROR(("dongle txflow rings are invalid %d\n", bus->max_tx_flowrings));
+                       return BCME_ERROR;
+               }
+
+               /* If both FW and Host support DMA'ing indices, allocate memory and notify FW
+                * The max_sub_queues is read from FW initialized ring_info
+                */
+               if (bus->dhd->dma_h2d_ring_upd_support || IDMA_ENAB(bus->dhd)) {
+                       dma_indx_wr_buf = dhd_prot_dma_indx_init(bus->dhd, bus->rw_index_sz,
+                               H2D_DMA_INDX_WR_BUF, bus->max_submission_rings);
+                       dma_indx_rd_buf = dhd_prot_dma_indx_init(bus->dhd, bus->rw_index_sz,
+                               D2H_DMA_INDX_RD_BUF, bus->max_completion_rings);
+
+                       if ((dma_indx_wr_buf != BCME_OK) || (dma_indx_rd_buf != BCME_OK)) {
+                               DHD_ERROR(("%s: Failed to allocate memory for dma'ing h2d indices"
+                                               "Host will use w/r indices in TCM\n",
+                                               __FUNCTION__));
+                               bus->dhd->dma_h2d_ring_upd_support = FALSE;
+                               bus->dhd->idma_enable = FALSE;
+                       }
+               }
+
+               if (bus->dhd->dma_d2h_ring_upd_support) {
+                       dma_indx_wr_buf = dhd_prot_dma_indx_init(bus->dhd, bus->rw_index_sz,
+                               D2H_DMA_INDX_WR_BUF, bus->max_completion_rings);
+                       dma_indx_rd_buf = dhd_prot_dma_indx_init(bus->dhd, bus->rw_index_sz,
+                               H2D_DMA_INDX_RD_BUF, bus->max_submission_rings);
+
+                       if ((dma_indx_wr_buf != BCME_OK) || (dma_indx_rd_buf != BCME_OK)) {
+                               DHD_ERROR(("%s: Failed to allocate memory for dma'ing d2h indices"
+                                               "Host will use w/r indices in TCM\n",
+                                               __FUNCTION__));
+                               bus->dhd->dma_d2h_ring_upd_support = FALSE;
+                       }
+               }
+
+               if (IFRM_ENAB(bus->dhd)) {
+                       dma_indx_wr_buf = dhd_prot_dma_indx_init(bus->dhd, bus->rw_index_sz,
+                               H2D_IFRM_INDX_WR_BUF, bus->max_tx_flowrings);
+
+                       if (dma_indx_wr_buf != BCME_OK) {
+                               DHD_ERROR(("%s: Failed to alloc memory for Implicit DMA\n",
+                                               __FUNCTION__));
+                               bus->dhd->ifrm_enable = FALSE;
+                       }
+               }
+
+               /* read ringmem and ringstate ptrs from shared area and store in host variables */
+               dhd_fillup_ring_sharedptr_info(bus, &ring_info);
+               if (dhd_msg_level & DHD_INFO_VAL) {
+                       bcm_print_bytes("ring_info_raw", (uchar *)&ring_info, sizeof(ring_info_t));
+               }
+               DHD_INFO(("%s: ring_info\n", __FUNCTION__));
+
+               DHD_ERROR(("%s: max H2D queues %d\n",
+                       __FUNCTION__, ltoh16(ring_info.max_tx_flowrings)));
+
+               DHD_INFO(("mail box address\n"));
+               DHD_INFO(("%s: h2d_mb_data_ptr_addr 0x%04x\n",
+                       __FUNCTION__, bus->h2d_mb_data_ptr_addr));
+               DHD_INFO(("%s: d2h_mb_data_ptr_addr 0x%04x\n",
+                       __FUNCTION__, bus->d2h_mb_data_ptr_addr));
+       }
+
+       DHD_INFO(("%s: d2h_sync_mode 0x%08x\n",
+               __FUNCTION__, bus->dhd->d2h_sync_mode));
+
+       bus->dhd->d2h_hostrdy_supported =
+               ((sh->flags & PCIE_SHARED_HOSTRDY_SUPPORT) == PCIE_SHARED_HOSTRDY_SUPPORT);
+
+       bus->dhd->ext_trap_data_supported =
+               ((sh->flags2 & PCIE_SHARED2_EXTENDED_TRAP_DATA) == PCIE_SHARED2_EXTENDED_TRAP_DATA);
+
+       if ((sh->flags2 & PCIE_SHARED2_TXSTATUS_METADATA) == 0)
+               bus->dhd->pcie_txs_metadata_enable = 0;
+
+       if (sh->flags2 & PCIE_SHARED2_TRAP_ON_HOST_DB7)  {
+               memset(&bus->dhd->db7_trap, 0, sizeof(bus->dhd->db7_trap));
+               bus->dhd->db7_trap.fw_db7w_trap = 1;
+               /* add an option to let the user select ?? */
+               bus->dhd->db7_trap.db7_magic_number = PCIE_DB7_MAGIC_NUMBER_DPC_TRAP;
+       }
+
+       bus->dhd->hscb_enable =
+               (sh->flags2 & PCIE_SHARED2_HSCB) == PCIE_SHARED2_HSCB;
+
+#ifdef EWP_EDL
+       if (host_edl_support) {
+               bus->dhd->dongle_edl_support = (sh->flags2 & PCIE_SHARED2_EDL_RING) ? TRUE : FALSE;
+               DHD_ERROR(("Dongle EDL support: %u\n", bus->dhd->dongle_edl_support));
+       }
+#endif /* EWP_EDL */
+
+       bus->dhd->debug_buf_dest_support =
+               (sh->flags2 & PCIE_SHARED2_DEBUG_BUF_DEST) ? TRUE : FALSE;
+       DHD_ERROR(("FW supports debug buf dest ? %s \n",
+               bus->dhd->debug_buf_dest_support ? "Y" : "N"));
+
+#ifdef DHD_DB0TS
+       bus->dhd->db0ts_capable =
+               (sh->flags & PCIE_SHARED_TIMESTAMP_DB0) == PCIE_SHARED_TIMESTAMP_DB0;
+#endif /* DHD_DB0TS */
+
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req_clear(bus);
+
+               /*
+                * WAR to fix ARM cold boot;
+                * De-assert WL domain in DAR
+                */
+               if (bus->sih->buscorerev >= 68) {
+                       dhd_bus_pcie_pwr_req_wl_domain(bus,
+                               DAR_PCIE_PWR_CTRL((bus->sih)->buscorerev), FALSE);
+               }
+       }
+       return BCME_OK;
+} /* dhdpcie_readshared */
+
+/** Read ring mem and ring state ptr info from shared memory area in device memory */
+static void
+dhd_fillup_ring_sharedptr_info(dhd_bus_t *bus, ring_info_t *ring_info)
+{
+       uint16 i = 0;
+       uint16 j = 0;
+       uint32 tcm_memloc;
+       uint32 d2h_w_idx_ptr, d2h_r_idx_ptr, h2d_w_idx_ptr, h2d_r_idx_ptr;
+       uint32 h2d_hwa_db_idx_ptr = 0, d2h_hwa_db_idx_ptr = 0;
+       uint16 max_tx_flowrings = bus->max_tx_flowrings;
+
+       /* Ring mem ptr info */
+       /* Alloated in the order
+               H2D_MSGRING_CONTROL_SUBMIT              0
+               H2D_MSGRING_RXPOST_SUBMIT               1
+               D2H_MSGRING_CONTROL_COMPLETE            2
+               D2H_MSGRING_TX_COMPLETE                 3
+               D2H_MSGRING_RX_COMPLETE                 4
+       */
+
+       {
+               /* ringmemptr holds start of the mem block address space */
+               tcm_memloc = ltoh32(ring_info->ringmem_ptr);
+
+               /* Find out ringmem ptr for each ring common  ring */
+               for (i = 0; i <= BCMPCIE_COMMON_MSGRING_MAX_ID; i++) {
+                       bus->ring_sh[i].ring_mem_addr = tcm_memloc;
+                       /* Update mem block */
+                       tcm_memloc = tcm_memloc + sizeof(ring_mem_t);
+                       DHD_INFO(("%s: ring id %d ring mem addr 0x%04x \n", __FUNCTION__,
+                               i, bus->ring_sh[i].ring_mem_addr));
+               }
+       }
+
+       /* Ring state mem ptr info */
+       {
+               d2h_w_idx_ptr = ltoh32(ring_info->d2h_w_idx_ptr);
+               d2h_r_idx_ptr = ltoh32(ring_info->d2h_r_idx_ptr);
+               h2d_w_idx_ptr = ltoh32(ring_info->h2d_w_idx_ptr);
+               h2d_r_idx_ptr = ltoh32(ring_info->h2d_r_idx_ptr);
+
+               if (HWA_CAPAB(bus->dhd)) {
+                       h2d_hwa_db_idx_ptr = ltoh32(ring_info->h2d_hwa_db_idx_ptr);
+                       d2h_hwa_db_idx_ptr = ltoh32(ring_info->d2h_hwa_db_idx_ptr);
+               }
+
+               /* Store h2d common ring write/read pointers */
+               for (i = 0; i < BCMPCIE_H2D_COMMON_MSGRINGS; i++) {
+                       bus->ring_sh[i].ring_state_w = h2d_w_idx_ptr;
+                       bus->ring_sh[i].ring_state_r = h2d_r_idx_ptr;
+
+                       /* update mem block */
+                       h2d_w_idx_ptr = h2d_w_idx_ptr + bus->rw_index_sz;
+                       h2d_r_idx_ptr = h2d_r_idx_ptr + bus->rw_index_sz;
+
+                       DHD_INFO(("%s: h2d w/r : idx %d write %x read %x \n", __FUNCTION__, i,
+                               bus->ring_sh[i].ring_state_w, bus->ring_sh[i].ring_state_r));
+
+                       if (HWA_CAPAB(bus->dhd)) {
+                               /* Read HWA DB index value from TCM */
+                               bus->ring_sh[i].ring_hwa_db_idx =
+                                       ltoh16(dhdpcie_bus_rtcm16(bus, h2d_hwa_db_idx_ptr));
+                               /* update mem block */
+                               h2d_hwa_db_idx_ptr += bus->hwa_db_index_sz;
+                               DHD_INFO(("h2d hwa: idx %d hw_db %x \n", i,
+                                       bus->ring_sh[i].ring_hwa_db_idx));
+                       }
+               }
+
+               /* Store d2h common ring write/read pointers */
+               for (j = 0; j < BCMPCIE_D2H_COMMON_MSGRINGS; j++, i++) {
+                       bus->ring_sh[i].ring_state_w = d2h_w_idx_ptr;
+                       bus->ring_sh[i].ring_state_r = d2h_r_idx_ptr;
+
+                       /* update mem block */
+                       d2h_w_idx_ptr = d2h_w_idx_ptr + bus->rw_index_sz;
+                       d2h_r_idx_ptr = d2h_r_idx_ptr + bus->rw_index_sz;
+
+                       DHD_INFO(("%s: d2h w/r : idx %d write %x read %x \n", __FUNCTION__, i,
+                               bus->ring_sh[i].ring_state_w, bus->ring_sh[i].ring_state_r));
+
+                       if (HWA_CAPAB(bus->dhd)) {
+                               /* Read HWA DB index value from TCM */
+                               bus->ring_sh[i].ring_hwa_db_idx =
+                                       ltoh16(dhdpcie_bus_rtcm16(bus, d2h_hwa_db_idx_ptr));
+                               /* update mem block */
+                               d2h_hwa_db_idx_ptr += bus->hwa_db_index_sz;
+                               DHD_INFO(("d2h hwa: idx %d hw_db %x \n", i,
+                                       bus->ring_sh[i].ring_hwa_db_idx));
+                       }
+               }
+
+               /* Store txflow ring write/read pointers */
+               if (bus->api.fw_rev < PCIE_SHARED_VERSION_6) {
+                       max_tx_flowrings -= BCMPCIE_H2D_COMMON_MSGRINGS;
+               } else {
+                       /* Account for Debug info h2d ring located after the last tx flow ring */
+                       max_tx_flowrings = max_tx_flowrings + 1;
+               }
+               for (j = 0; j < max_tx_flowrings; i++, j++)
+               {
+                       bus->ring_sh[i].ring_state_w = h2d_w_idx_ptr;
+                       bus->ring_sh[i].ring_state_r = h2d_r_idx_ptr;
+
+                       /* update mem block */
+                       h2d_w_idx_ptr = h2d_w_idx_ptr + bus->rw_index_sz;
+                       h2d_r_idx_ptr = h2d_r_idx_ptr + bus->rw_index_sz;
+
+                       DHD_INFO(("%s: FLOW Rings h2d w/r : idx %d write %x read %x \n",
+                               __FUNCTION__, i,
+                               bus->ring_sh[i].ring_state_w,
+                               bus->ring_sh[i].ring_state_r));
+
+                       if (HWA_CAPAB(bus->dhd)) {
+                               /* Read HWA DB index value from TCM */
+                               bus->ring_sh[i].ring_hwa_db_idx =
+                                       ltoh16(dhdpcie_bus_rtcm16(bus, h2d_hwa_db_idx_ptr));
+                               /* update mem block */
+                               h2d_hwa_db_idx_ptr += bus->hwa_db_index_sz;
+                               DHD_INFO(("h2d hwa: idx %d hw_db %x \n", i,
+                                       bus->ring_sh[i].ring_hwa_db_idx));
+                       }
+               }
+               /* store wr/rd pointers for debug info completion or EDL ring */
+               bus->ring_sh[i].ring_state_w = d2h_w_idx_ptr;
+               bus->ring_sh[i].ring_state_r = d2h_r_idx_ptr;
+               d2h_w_idx_ptr = d2h_w_idx_ptr + bus->rw_index_sz;
+               d2h_r_idx_ptr = d2h_r_idx_ptr + bus->rw_index_sz;
+               DHD_INFO(("d2h w/r : idx %d write %x read %x \n", i,
+                       bus->ring_sh[i].ring_state_w,
+                       bus->ring_sh[i].ring_state_r));
+
+               if (HWA_CAPAB(bus->dhd)) {
+                       /* Read HWA DB index value from TCM */
+                       bus->ring_sh[i].ring_hwa_db_idx =
+                                       ltoh16(dhdpcie_bus_rtcm16(bus, d2h_hwa_db_idx_ptr));
+                       /* update mem block */
+                       d2h_hwa_db_idx_ptr += bus->hwa_db_index_sz;
+                       DHD_INFO(("d2h hwa: idx %d hw_db %x \n", i,
+                               bus->ring_sh[i].ring_hwa_db_idx));
+               }
+       }
+} /* dhd_fillup_ring_sharedptr_info */
+
+/**
+ * Initialize bus module: prepare for communication with the dongle. Called after downloading
+ * firmware into the dongle.
+ */
+int dhd_bus_init(dhd_pub_t *dhdp, bool enforce_mutex)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       int  ret = 0;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       ASSERT(bus->dhd);
+       if (!bus->dhd)
+               return 0;
+
+       dhd_bus_pcie_pwr_req_clear_reload_war(bus);
+
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req(bus);
+       }
+
+       /* Configure AER registers to log the TLP header */
+       dhd_bus_aer_config(bus);
+
+       /* Make sure we're talking to the core. */
+       bus->reg = si_setcore(bus->sih, PCIE2_CORE_ID, 0);
+       ASSERT(bus->reg != NULL);
+
+       /* before opening up bus for data transfer, check if shared are is intact */
+       ret = dhdpcie_readshared(bus);
+       if (ret < 0) {
+               DHD_ERROR(("%s :Shared area read failed \n", __FUNCTION__));
+               goto exit;
+       }
+
+       /* Make sure we're talking to the core. */
+       bus->reg = si_setcore(bus->sih, PCIE2_CORE_ID, 0);
+       ASSERT(bus->reg != NULL);
+
+       /* Set bus state according to enable result */
+       dhdp->busstate = DHD_BUS_DATA;
+       DHD_SET_BUS_NOT_IN_LPS(bus);
+       dhdp->dhd_bus_busy_state = 0;
+
+       /* D11 status via PCIe completion header */
+       if ((ret = dhdpcie_init_d11status(bus)) < 0) {
+               goto exit;
+       }
+
+       if (!dhd_download_fw_on_driverload)
+               dhd_dpc_enable(bus->dhd);
+       /* Enable the interrupt after device is up */
+       dhdpcie_bus_intr_enable(bus);
+
+       DHD_ERROR(("%s: Enabling bus->intr_enabled\n", __FUNCTION__));
+       bus->intr_enabled = TRUE;
+
+       /* XXX These need to change w/API updates */
+       /* bcmsdh_intr_unmask(bus->sdh); */
+#ifdef DHD_PCIE_RUNTIMEPM
+       bus->idlecount = 0;
+       bus->idletime = (int32)MAX_IDLE_COUNT;
+       init_waitqueue_head(&bus->rpm_queue);
+       mutex_init(&bus->pm_lock);
+#else
+       bus->idletime = 0;
+#endif /* DHD_PCIE_RUNTIMEPM */
+#ifdef PCIE_INB_DW
+       bus->skip_ds_ack = FALSE;
+       /* Initialize the lock to serialize Device Wake Inband activities */
+       if (!bus->inb_lock) {
+               bus->inb_lock = osl_spin_lock_init(bus->dhd->osh);
+       }
+#endif
+
+       /* XXX Temp errnum workaround: return ok, caller checks bus state */
+
+       /* Make use_d0_inform TRUE for Rev 5 for backward compatibility */
+       if (bus->api.fw_rev < PCIE_SHARED_VERSION_6) {
+               bus->use_d0_inform = TRUE;
+       } else {
+               bus->use_d0_inform = FALSE;
+       }
+
+       bus->hostready_count = 0;
+
+exit:
+       if (MULTIBP_ENAB(bus->sih)) {
+               dhd_bus_pcie_pwr_req_clear(bus);
+       }
+       return ret;
+}
+
+static void
+dhdpcie_init_shared_addr(dhd_bus_t *bus)
+{
+       uint32 addr = 0;
+       uint32 val = 0;
+       addr = bus->dongle_ram_base + bus->ramsize - 4;
+#ifdef DHD_PCIE_RUNTIMEPM
+       dhdpcie_runtime_bus_wake(bus->dhd, TRUE, __builtin_return_address(0));
+#endif /* DHD_PCIE_RUNTIMEPM */
+       dhdpcie_bus_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val));
+}
+
+bool
+dhdpcie_chipmatch(uint16 vendor, uint16 device)
+{
+       if (vendor != PCI_VENDOR_ID_BROADCOM) {
+               DHD_ERROR(("%s: Unsupported vendor %x device %x\n", __FUNCTION__,
+                       vendor, device));
+               return (-ENODEV);
+       }
+
+       switch (device) {
+               case BCM4345_CHIP_ID:
+               case BCM43454_CHIP_ID:
+               case BCM43455_CHIP_ID:
+               case BCM43457_CHIP_ID:
+               case BCM43458_CHIP_ID:
+               case BCM4350_D11AC_ID:
+               case BCM4350_D11AC2G_ID:
+               case BCM4350_D11AC5G_ID:
+               case BCM4350_CHIP_ID:
+               case BCM4354_D11AC_ID:
+               case BCM4354_D11AC2G_ID:
+               case BCM4354_D11AC5G_ID:
+               case BCM4354_CHIP_ID:
+               case BCM4356_D11AC_ID:
+               case BCM4356_D11AC2G_ID:
+               case BCM4356_D11AC5G_ID:
+               case BCM4356_CHIP_ID:
+               case BCM4371_D11AC_ID:
+               case BCM4371_D11AC2G_ID:
+               case BCM4371_D11AC5G_ID:
+               case BCM4371_CHIP_ID:
+               case BCM4345_D11AC_ID:
+               case BCM4345_D11AC2G_ID:
+               case BCM4345_D11AC5G_ID:
+               case BCM43452_D11AC_ID:
+               case BCM43452_D11AC2G_ID:
+               case BCM43452_D11AC5G_ID:
+               case BCM4335_D11AC_ID:
+               case BCM4335_D11AC2G_ID:
+               case BCM4335_D11AC5G_ID:
+               case BCM4335_CHIP_ID:
+               case BCM43602_D11AC_ID:
+               case BCM43602_D11AC2G_ID:
+               case BCM43602_D11AC5G_ID:
+               case BCM43602_CHIP_ID:
+               case BCM43569_D11AC_ID:
+               case BCM43569_D11AC2G_ID:
+               case BCM43569_D11AC5G_ID:
+               case BCM43569_CHIP_ID:
+               /* XXX: For 4358, BCM4358_CHIP_ID is not checked intentionally as
+                * this is not a real chip id, but propagated from the OTP.
+                */
+               case BCM4358_D11AC_ID:
+               case BCM4358_D11AC2G_ID:
+               case BCM4358_D11AC5G_ID:
+               case BCM4349_D11AC_ID:
+               case BCM4349_D11AC2G_ID:
+               case BCM4349_D11AC5G_ID:
+               case BCM4355_D11AC_ID:
+               case BCM4355_D11AC2G_ID:
+               case BCM4355_D11AC5G_ID:
+               case BCM4355_CHIP_ID:
+               /* XXX: BCM4359_CHIP_ID is not checked intentionally as this is
+                * not a real chip id, but propogated from the OTP.
+                */
+               case BCM4359_D11AC_ID:
+               case BCM4359_D11AC2G_ID:
+               case BCM4359_D11AC5G_ID:
+               case BCM43596_D11AC_ID:
+               case BCM43596_D11AC2G_ID:
+               case BCM43596_D11AC5G_ID:
+               case BCM43597_D11AC_ID:
+               case BCM43597_D11AC2G_ID:
+               case BCM43597_D11AC5G_ID:
+               case BCM4364_D11AC_ID:
+               case BCM4364_D11AC2G_ID:
+               case BCM4364_D11AC5G_ID:
+               case BCM4364_CHIP_ID:
+               case BCM4361_D11AC_ID:
+               case BCM4361_D11AC2G_ID:
+               case BCM4361_D11AC5G_ID:
+               case BCM4361_CHIP_ID:
+               case BCM4347_D11AC_ID:
+               case BCM4347_D11AC2G_ID:
+               case BCM4347_D11AC5G_ID:
+               case BCM4347_CHIP_ID:
+               case BCM4369_D11AX_ID:
+               case BCM4369_D11AX2G_ID:
+               case BCM4369_D11AX5G_ID:
+               case BCM4369_CHIP_ID:
+               case BCM4376_D11AX_ID:
+               case BCM4376_D11AX2G_ID:
+               case BCM4376_D11AX5G_ID:
+               case BCM4376_CHIP_ID:
+               case BCM4377_M_D11AX_ID:
+               case BCM4377_D11AX_ID:
+               case BCM4377_D11AX2G_ID:
+               case BCM4377_D11AX5G_ID:
+               case BCM4377_CHIP_ID:
+               case BCM4378_D11AX_ID:
+               case BCM4378_D11AX2G_ID:
+               case BCM4378_D11AX5G_ID:
+               case BCM4378_CHIP_ID:
+               case BCM4387_D11AX_ID:
+               case BCM4387_CHIP_ID:
+               case BCM4368_D11AC_ID:
+               case BCM4368_D11AC2G_ID:
+               case BCM4368_D11AC5G_ID:
+               case BCM4368_CHIP_ID:
+               case BCM4362_D11AX_ID:
+               case BCM4362_D11AX2G_ID:
+               case BCM4362_D11AX5G_ID:
+               case BCM4362_CHIP_ID:
+               case BCM4375_D11AX_ID:
+               case BCM4375_D11AX2G_ID:
+               case BCM4375_D11AX5G_ID:
+               case BCM4375_CHIP_ID:
+               case BCM43751_D11AX_ID:
+               case BCM43751_D11AX2G_ID:
+               case BCM43751_D11AX5G_ID:
+               case BCM43751_CHIP_ID:
+               case BCM43752_D11AX_ID:
+               case BCM43752_D11AX2G_ID:
+               case BCM43752_D11AX5G_ID:
+               case BCM43752_CHIP_ID:
+               case BCM4388_CHIP_ID:
+               case BCM4388_D11AX_ID:
+               case BCM4389_CHIP_ID:
+               case BCM4389_D11AX_ID:
+               case BCM4385_D11AX_ID:
+               case BCM4385_CHIP_ID:
+
+                       return 0;
+               default:
+                       DHD_ERROR(("%s: Unsupported vendor %x device %x\n",
+                               __FUNCTION__, vendor, device));
+                       return (-ENODEV);
+       }
+} /* dhdpcie_chipmatch */
+
+/**
+ * Name:  dhdpcie_cc_nvmshadow
+ *
+ * Description:
+ * A shadow of OTP/SPROM exists in ChipCommon Region
+ * betw. 0x800 and 0xBFF (Backplane Addr. 0x1800_0800 and 0x1800_0BFF).
+ * Strapping option (SPROM vs. OTP), presence of OTP/SPROM and its size
+ * can also be read from ChipCommon Registers.
+ */
+/* XXX So far tested with 4345 and 4350 (Hence the checks in the function.) */
+static int
+dhdpcie_cc_nvmshadow(dhd_bus_t *bus, struct bcmstrbuf *b)
+{
+       uint16 dump_offset = 0;
+       uint32 dump_size = 0, otp_size = 0, sprom_size = 0;
+
+       /* Table for 65nm OTP Size (in bits) */
+       int  otp_size_65nm[8] = {0, 2048, 4096, 8192, 4096, 6144, 512, 1024};
+
+       volatile uint16 *nvm_shadow;
+
+       uint cur_coreid;
+       uint chipc_corerev;
+       chipcregs_t *chipcregs;
+
+       /* Save the current core */
+       cur_coreid = si_coreid(bus->sih);
+       /* Switch to ChipC */
+       chipcregs = (chipcregs_t *)si_setcore(bus->sih, CC_CORE_ID, 0);
+       ASSERT(chipcregs != NULL);
+
+       chipc_corerev = si_corerev(bus->sih);
+
+       /* Check ChipcommonCore Rev */
+       if (chipc_corerev < 44) {
+               DHD_ERROR(("%s: ChipcommonCore Rev %d < 44\n", __FUNCTION__, chipc_corerev));
+               return BCME_UNSUPPORTED;
+       }
+
+       /* Check ChipID */
+       if (((uint16)bus->sih->chip != BCM4350_CHIP_ID) && !BCM4345_CHIP((uint16)bus->sih->chip) &&
+               ((uint16)bus->sih->chip != BCM4355_CHIP_ID) &&
+               ((uint16)bus->sih->chip != BCM4364_CHIP_ID)) {
+               DHD_ERROR(("%s: cc_nvmdump cmd. supported for Olympic chips"
+                                       "4350/4345/4355/4364 only\n", __FUNCTION__));
+               return BCME_UNSUPPORTED;
+       }
+
+       /* Check if SRC_PRESENT in SpromCtrl(0x190 in ChipCommon Regs) is set */
+       if (chipcregs->sromcontrol & SRC_PRESENT) {
+               /* SPROM Size: 1Kbits (0x0), 4Kbits (0x1), 16Kbits(0x2) */
+               sprom_size = (1 << (2 * ((chipcregs->sromcontrol & SRC_SIZE_MASK)
+                                       >> SRC_SIZE_SHIFT))) * 1024;
+               bcm_bprintf(b, "\nSPROM Present (Size %d bits)\n", sprom_size);
+       }
+
+       /* XXX Check if OTP exists. 2 possible approaches:
+        * 1) Check if OtpPresent in SpromCtrl (0x190 in ChipCommon Regs) is set OR
+        * 2) Check if OtpSize > 0
+        */
+       if (chipcregs->sromcontrol & SRC_OTPPRESENT) {
+               bcm_bprintf(b, "\nOTP Present");
+
+               if (((chipcregs->otplayout & OTPL_WRAP_TYPE_MASK) >> OTPL_WRAP_TYPE_SHIFT)
+                       == OTPL_WRAP_TYPE_40NM) {
+                       /* 40nm OTP: Size = (OtpSize + 1) * 1024 bits */
+                       /* Chipcommon rev51 is a variation on rev45 and does not support
+                        * the latest OTP configuration.
+                        */
+                       if (chipc_corerev != 51 && chipc_corerev >= 49) {
+                               otp_size = (((chipcregs->otplayout & OTPL_ROW_SIZE_MASK)
+                                       >> OTPL_ROW_SIZE_SHIFT) + 1) * 1024;
+                               bcm_bprintf(b, "(Size %d bits)\n", otp_size);
+                       } else {
+                               otp_size =  (((chipcregs->capabilities & CC_CAP_OTPSIZE)
+                                       >> CC_CAP_OTPSIZE_SHIFT) + 1) * 1024;
+                               bcm_bprintf(b, "(Size %d bits)\n", otp_size);
+                       }
+               } else {
+                       /* This part is untested since newer chips have 40nm OTP */
+                       /* Chipcommon rev51 is a variation on rev45 and does not support
+                        * the latest OTP configuration.
+                        */
+                       if (chipc_corerev != 51 && chipc_corerev >= 49) {
+                               otp_size = otp_size_65nm[(chipcregs->otplayout & OTPL_ROW_SIZE_MASK)
+                                               >> OTPL_ROW_SIZE_SHIFT];
+                               bcm_bprintf(b, "(Size %d bits)\n", otp_size);
+                       } else {
+                               otp_size = otp_size_65nm[(chipcregs->capabilities & CC_CAP_OTPSIZE)
+                                               >> CC_CAP_OTPSIZE_SHIFT];
+                               bcm_bprintf(b, "(Size %d bits)\n", otp_size);
+                               DHD_INFO(("%s: 65nm/130nm OTP Size not tested. \n",
+                                       __FUNCTION__));
+                       }
+               }
+       }
+
+       /* Chipcommon rev51 is a variation on rev45 and does not support
+        * the latest OTP configuration.
+        */
+       if (chipc_corerev != 51 && chipc_corerev >= 49) {
+               if (((chipcregs->sromcontrol & SRC_PRESENT) == 0) &&
+                       ((chipcregs->otplayout & OTPL_ROW_SIZE_MASK) == 0)) {
+                       DHD_ERROR(("%s: SPROM and OTP could not be found "
+                               "sromcontrol = %x, otplayout = %x \n",
+                               __FUNCTION__, chipcregs->sromcontrol, chipcregs->otplayout));
+                       return BCME_NOTFOUND;
+               }
+       } else {
+               if (((chipcregs->sromcontrol & SRC_PRESENT) == 0) &&
+                       ((chipcregs->capabilities & CC_CAP_OTPSIZE) == 0)) {
+                       DHD_ERROR(("%s: SPROM and OTP could not be found "
+                               "sromcontrol = %x, capablities = %x \n",
+                               __FUNCTION__, chipcregs->sromcontrol, chipcregs->capabilities));
+                       return BCME_NOTFOUND;
+               }
+       }
+
+       /* Check the strapping option in SpromCtrl: Set = OTP otherwise SPROM */
+       if ((!(chipcregs->sromcontrol & SRC_PRESENT) || (chipcregs->sromcontrol & SRC_OTPSEL)) &&
+               (chipcregs->sromcontrol & SRC_OTPPRESENT)) {
+
+               bcm_bprintf(b, "OTP Strap selected.\n"
+                              "\nOTP Shadow in ChipCommon:\n");
+
+               dump_size = otp_size / 16 ; /* 16bit words */
+
+       } else if (((chipcregs->sromcontrol & SRC_OTPSEL) == 0) &&
+               (chipcregs->sromcontrol & SRC_PRESENT)) {
+
+               bcm_bprintf(b, "SPROM Strap selected\n"
+                               "\nSPROM Shadow in ChipCommon:\n");
+
+               /* If SPROM > 8K only 8Kbits is mapped to ChipCommon (0x800 - 0xBFF) */
+               /* dump_size in 16bit words */
+               dump_size = sprom_size > 8 ? (8 * 1024) / 16 : sprom_size / 16;
+       } else {
+               DHD_ERROR(("%s: NVM Shadow does not exist in ChipCommon\n",
+                       __FUNCTION__));
+               return BCME_NOTFOUND;
+       }
+
+       if (bus->regs == NULL) {
+               DHD_ERROR(("ChipCommon Regs. not initialized\n"));
+               return BCME_NOTREADY;
+       } else {
+               bcm_bprintf(b, "\n OffSet:");
+
+               /* Chipcommon rev51 is a variation on rev45 and does not support
+                * the latest OTP configuration.
+                */
+               if (chipc_corerev != 51 && chipc_corerev >= 49) {
+                       /* Chip common can read only 8kbits,
+                       * for ccrev >= 49 otp size is around 12 kbits so use GCI core
+                       */
+                       nvm_shadow = (volatile uint16 *)si_setcore(bus->sih, GCI_CORE_ID, 0);
+               } else {
+                       /* Point to the SPROM/OTP shadow in ChipCommon */
+                       nvm_shadow = chipcregs->sromotp;
+               }
+
+               if (nvm_shadow == NULL) {
+                       DHD_ERROR(("%s: NVM Shadow is not intialized\n", __FUNCTION__));
+                       return BCME_NOTFOUND;
+               }
+
+               /*
+               * Read 16 bits / iteration.
+               * dump_size & dump_offset in 16-bit words
+               */
+               while (dump_offset < dump_size) {
+                       if (dump_offset % 2 == 0)
+                               /* Print the offset in the shadow space in Bytes */
+                               bcm_bprintf(b, "\n 0x%04x", dump_offset * 2);
+
+                       bcm_bprintf(b, "\t0x%04x", *(nvm_shadow + dump_offset));
+                       dump_offset += 0x1;
+               }
+       }
+
+       /* Switch back to the original core */
+       si_setcore(bus->sih, cur_coreid, 0);
+
+       return BCME_OK;
+} /* dhdpcie_cc_nvmshadow */
+
+/** Flow rings are dynamically created and destroyed */
+void dhd_bus_clean_flow_ring(dhd_bus_t *bus, void *node)
+{
+       void *pkt;
+       flow_queue_t *queue;
+       flow_ring_node_t *flow_ring_node = (flow_ring_node_t *)node;
+       unsigned long flags;
+
+       queue = &flow_ring_node->queue;
+
+#ifdef DHDTCPACK_SUPPRESS
+       /* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+        * when there is a newly coming packet from network stack.
+        */
+       dhd_tcpack_info_tbl_clean(bus->dhd);
+#endif /* DHDTCPACK_SUPPRESS */
+
+       /* clean up BUS level info */
+       DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+       /* Flush all pending packets in the queue, if any */
+       while ((pkt = dhd_flow_queue_dequeue(bus->dhd, queue)) != NULL) {
+               PKTFREE(bus->dhd->osh, pkt, TRUE);
+       }
+       ASSERT(DHD_FLOW_QUEUE_EMPTY(queue));
+
+       /* Reinitialise flowring's queue */
+       dhd_flow_queue_reinit(bus->dhd, queue, FLOW_RING_QUEUE_THRESHOLD);
+       flow_ring_node->status = FLOW_RING_STATUS_CLOSED;
+       flow_ring_node->active = FALSE;
+
+       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+       /* Hold flowring_list_lock to ensure no race condition while accessing the List */
+       DHD_FLOWRING_LIST_LOCK(bus->dhd->flowring_list_lock, flags);
+       dll_delete(&flow_ring_node->list);
+       DHD_FLOWRING_LIST_UNLOCK(bus->dhd->flowring_list_lock, flags);
+
+       /* Release the flowring object back into the pool */
+       dhd_prot_flowrings_pool_release(bus->dhd,
+               flow_ring_node->flowid, flow_ring_node->prot_info);
+
+       /* Free the flowid back to the flowid allocator */
+       dhd_flowid_free(bus->dhd, flow_ring_node->flow_info.ifindex,
+                       flow_ring_node->flowid);
+}
+
+/**
+ * Allocate a Flow ring buffer,
+ * Init Ring buffer, send Msg to device about flow ring creation
+*/
+int
+dhd_bus_flow_ring_create_request(dhd_bus_t *bus, void *arg)
+{
+       flow_ring_node_t *flow_ring_node = (flow_ring_node_t *)arg;
+
+       DHD_INFO(("%s :Flow create\n", __FUNCTION__));
+
+       /* Send Msg to device about flow ring creation */
+       if (dhd_prot_flow_ring_create(bus->dhd, flow_ring_node) != BCME_OK)
+               return BCME_NOMEM;
+
+       return BCME_OK;
+}
+
+/** Handle response from dongle on a 'flow ring create' request */
+void
+dhd_bus_flow_ring_create_response(dhd_bus_t *bus, uint16 flowid, int32 status)
+{
+       flow_ring_node_t *flow_ring_node;
+       unsigned long flags;
+
+       DHD_INFO(("%s :Flow Response %d \n", __FUNCTION__, flowid));
+
+       /* Boundary check of the flowid */
+       if (flowid > bus->dhd->max_tx_flowid) {
+               DHD_ERROR(("%s: flowid is invalid %d, max id %d\n", __FUNCTION__,
+                       flowid, bus->dhd->max_tx_flowid));
+               return;
+       }
+
+       flow_ring_node = DHD_FLOW_RING(bus->dhd, flowid);
+       if (!flow_ring_node) {
+               DHD_ERROR(("%s: flow_ring_node is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       ASSERT(flow_ring_node->flowid == flowid);
+       if (flow_ring_node->flowid != flowid) {
+               DHD_ERROR(("%s: flowid %d is different from the flowid "
+                       "of the flow_ring_node %d\n", __FUNCTION__, flowid,
+                       flow_ring_node->flowid));
+               return;
+       }
+
+       if (status != BCME_OK) {
+               DHD_ERROR(("%s Flow create Response failure error status = %d \n",
+                    __FUNCTION__, status));
+               /* Call Flow clean up */
+               dhd_bus_clean_flow_ring(bus, flow_ring_node);
+               return;
+       }
+
+       DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+       flow_ring_node->status = FLOW_RING_STATUS_OPEN;
+       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+       /* Now add the Flow ring node into the active list
+        * Note that this code to add the newly created node to the active
+        * list was living in dhd_flowid_lookup. But note that after
+        * adding the node to the active list the contents of node is being
+        * filled in dhd_prot_flow_ring_create.
+        * If there is a D2H interrupt after the node gets added to the
+        * active list and before the node gets populated with values
+        * from the Bottom half dhd_update_txflowrings would be called.
+        * which will then try to walk through the active flow ring list,
+        * pickup the nodes and operate on them. Now note that since
+        * the function dhd_prot_flow_ring_create is not finished yet
+        * the contents of flow_ring_node can still be NULL leading to
+        * crashes. Hence the flow_ring_node should be added to the
+        * active list only after its truely created, which is after
+        * receiving the create response message from the Host.
+        */
+       DHD_FLOWRING_LIST_LOCK(bus->dhd->flowring_list_lock, flags);
+       dll_prepend(&bus->flowring_active_list, &flow_ring_node->list);
+       DHD_FLOWRING_LIST_UNLOCK(bus->dhd->flowring_list_lock, flags);
+
+       dhd_bus_schedule_queue(bus, flowid, FALSE); /* from queue to flowring */
+
+       return;
+}
+
+int
+dhd_bus_flow_ring_delete_request(dhd_bus_t *bus, void *arg)
+{
+       void * pkt;
+       flow_queue_t *queue;
+       flow_ring_node_t *flow_ring_node;
+       unsigned long flags;
+
+       DHD_INFO(("%s :Flow Delete\n", __FUNCTION__));
+
+       flow_ring_node = (flow_ring_node_t *)arg;
+
+#ifdef DHDTCPACK_SUPPRESS
+       /* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+        * when there is a newly coming packet from network stack.
+        */
+       dhd_tcpack_info_tbl_clean(bus->dhd);
+#endif /* DHDTCPACK_SUPPRESS */
+       DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+       if (flow_ring_node->status == FLOW_RING_STATUS_DELETE_PENDING) {
+               DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+               DHD_ERROR(("%s :Delete Pending flowid %u\n", __FUNCTION__, flow_ring_node->flowid));
+               return BCME_ERROR;
+       }
+       flow_ring_node->status = FLOW_RING_STATUS_DELETE_PENDING;
+
+       queue = &flow_ring_node->queue; /* queue associated with flow ring */
+
+       /* Flush all pending packets in the queue, if any */
+       while ((pkt = dhd_flow_queue_dequeue(bus->dhd, queue)) != NULL) {
+               PKTFREE(bus->dhd->osh, pkt, TRUE);
+       }
+       ASSERT(DHD_FLOW_QUEUE_EMPTY(queue));
+
+       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+       /* Send Msg to device about flow ring deletion */
+       dhd_prot_flow_ring_delete(bus->dhd, flow_ring_node);
+
+       return BCME_OK;
+}
+
+void
+dhd_bus_flow_ring_delete_response(dhd_bus_t *bus, uint16 flowid, uint32 status)
+{
+       flow_ring_node_t *flow_ring_node;
+
+       DHD_INFO(("%s :Flow Delete Response %d \n", __FUNCTION__, flowid));
+
+       /* Boundary check of the flowid */
+       if (flowid > bus->dhd->max_tx_flowid) {
+               DHD_ERROR(("%s: flowid is invalid %d, max id %d\n", __FUNCTION__,
+                       flowid, bus->dhd->max_tx_flowid));
+               return;
+       }
+
+       flow_ring_node = DHD_FLOW_RING(bus->dhd, flowid);
+       if (!flow_ring_node) {
+               DHD_ERROR(("%s: flow_ring_node is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       ASSERT(flow_ring_node->flowid == flowid);
+       if (flow_ring_node->flowid != flowid) {
+               DHD_ERROR(("%s: flowid %d is different from the flowid "
+                       "of the flow_ring_node %d\n", __FUNCTION__, flowid,
+                       flow_ring_node->flowid));
+               return;
+       }
+
+       if (status != BCME_OK) {
+               DHD_ERROR(("%s Flow Delete Response failure error status = %d \n",
+                   __FUNCTION__, status));
+               return;
+       }
+       /* Call Flow clean up */
+       dhd_bus_clean_flow_ring(bus, flow_ring_node);
+
+       return;
+
+}
+
+int dhd_bus_flow_ring_flush_request(dhd_bus_t *bus, void *arg)
+{
+       void *pkt;
+       flow_queue_t *queue;
+       flow_ring_node_t *flow_ring_node;
+       unsigned long flags;
+
+       DHD_INFO(("%s :Flow Flush\n", __FUNCTION__));
+
+       flow_ring_node = (flow_ring_node_t *)arg;
+
+       DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+       queue = &flow_ring_node->queue; /* queue associated with flow ring */
+       /* Flow ring status will be set back to FLOW_RING_STATUS_OPEN
+        * once flow ring flush response is received for this flowring node.
+        */
+       flow_ring_node->status = FLOW_RING_STATUS_FLUSH_PENDING;
+
+#ifdef DHDTCPACK_SUPPRESS
+       /* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+        * when there is a newly coming packet from network stack.
+        */
+       dhd_tcpack_info_tbl_clean(bus->dhd);
+#endif /* DHDTCPACK_SUPPRESS */
+
+       /* Flush all pending packets in the queue, if any */
+       while ((pkt = dhd_flow_queue_dequeue(bus->dhd, queue)) != NULL) {
+               PKTFREE(bus->dhd->osh, pkt, TRUE);
+       }
+       ASSERT(DHD_FLOW_QUEUE_EMPTY(queue));
+
+       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+       /* Send Msg to device about flow ring flush */
+       dhd_prot_flow_ring_flush(bus->dhd, flow_ring_node);
+
+       return BCME_OK;
+}
+
+void
+dhd_bus_flow_ring_flush_response(dhd_bus_t *bus, uint16 flowid, uint32 status)
+{
+       flow_ring_node_t *flow_ring_node;
+
+       if (status != BCME_OK) {
+               DHD_ERROR(("%s Flow flush Response failure error status = %d \n",
+                   __FUNCTION__, status));
+               return;
+       }
+
+       /* Boundary check of the flowid */
+       if (flowid > bus->dhd->max_tx_flowid) {
+               DHD_ERROR(("%s: flowid is invalid %d, max id %d\n", __FUNCTION__,
+                       flowid, bus->dhd->max_tx_flowid));
+               return;
+       }
+
+       flow_ring_node = DHD_FLOW_RING(bus->dhd, flowid);
+       if (!flow_ring_node) {
+               DHD_ERROR(("%s: flow_ring_node is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       ASSERT(flow_ring_node->flowid == flowid);
+       if (flow_ring_node->flowid != flowid) {
+               DHD_ERROR(("%s: flowid %d is different from the flowid "
+                       "of the flow_ring_node %d\n", __FUNCTION__, flowid,
+                       flow_ring_node->flowid));
+               return;
+       }
+
+       flow_ring_node->status = FLOW_RING_STATUS_OPEN;
+       return;
+}
+
+uint32
+dhd_bus_max_h2d_queues(struct dhd_bus *bus)
+{
+       return bus->max_submission_rings;
+}
+
+/* To be symmetric with SDIO */
+void
+dhd_bus_pktq_flush(dhd_pub_t *dhdp)
+{
+       return;
+}
+
+void
+dhd_bus_set_linkdown(dhd_pub_t *dhdp, bool val)
+{
+       dhdp->bus->is_linkdown = val;
+}
+
+int
+dhd_bus_get_linkdown(dhd_pub_t *dhdp)
+{
+       return dhdp->bus->is_linkdown;
+}
+
+int
+dhd_bus_get_cto(dhd_pub_t *dhdp)
+{
+       return dhdp->bus->cto_triggered;
+}
+
+#ifdef IDLE_TX_FLOW_MGMT
+/* resume request */
+int
+dhd_bus_flow_ring_resume_request(dhd_bus_t *bus, void *arg)
+{
+       flow_ring_node_t *flow_ring_node = (flow_ring_node_t *)arg;
+
+       DHD_ERROR(("%s :Flow Resume Request flow id %u\n", __FUNCTION__, flow_ring_node->flowid));
+
+       flow_ring_node->status = FLOW_RING_STATUS_RESUME_PENDING;
+
+       /* Send Msg to device about flow ring resume */
+       dhd_prot_flow_ring_resume(bus->dhd, flow_ring_node);
+
+       return BCME_OK;
+}
+
+/* add the node back to active flowring */
+void
+dhd_bus_flow_ring_resume_response(dhd_bus_t *bus, uint16 flowid, int32 status)
+{
+
+       flow_ring_node_t *flow_ring_node;
+
+       DHD_TRACE(("%s :flowid %d \n", __FUNCTION__, flowid));
+
+       flow_ring_node = DHD_FLOW_RING(bus->dhd, flowid);
+       ASSERT(flow_ring_node->flowid == flowid);
+
+       if (status != BCME_OK) {
+               DHD_ERROR(("%s Error Status = %d \n",
+                       __FUNCTION__, status));
+               return;
+       }
+
+       DHD_TRACE(("%s :Number of pkts queued in FlowId:%d is -> %u!!\n",
+               __FUNCTION__, flow_ring_node->flowid,  flow_ring_node->queue.len));
+
+       flow_ring_node->status = FLOW_RING_STATUS_OPEN;
+
+       dhd_bus_schedule_queue(bus, flowid, FALSE);
+       return;
+}
+
+/* scan the flow rings in active list for idle time out */
+void
+dhd_bus_check_idle_scan(dhd_bus_t *bus)
+{
+       uint64 time_stamp; /* in millisec */
+       uint64 diff;
+
+       time_stamp = OSL_SYSUPTIME();
+       diff = time_stamp - bus->active_list_last_process_ts;
+
+       if (diff > IDLE_FLOW_LIST_TIMEOUT) {
+               dhd_bus_idle_scan(bus);
+               bus->active_list_last_process_ts = OSL_SYSUPTIME();
+       }
+
+       return;
+}
+
+/* scan the nodes in active list till it finds a non idle node */
+void
+dhd_bus_idle_scan(dhd_bus_t *bus)
+{
+       dll_t *item, *prev;
+       flow_ring_node_t *flow_ring_node;
+       uint64 time_stamp, diff;
+       unsigned long flags;
+       uint16 ringid[MAX_SUSPEND_REQ];
+       uint16 count = 0;
+
+       time_stamp = OSL_SYSUPTIME();
+       DHD_FLOWRING_LIST_LOCK(bus->dhd->flowring_list_lock, flags);
+
+       for (item = dll_tail_p(&bus->flowring_active_list);
+                !dll_end(&bus->flowring_active_list, item); item = prev) {
+               prev = dll_prev_p(item);
+
+               flow_ring_node = dhd_constlist_to_flowring(item);
+
+               if (flow_ring_node->flowid == (bus->max_submission_rings - 1))
+                       continue;
+
+               if (flow_ring_node->status != FLOW_RING_STATUS_OPEN) {
+                       /* Takes care of deleting zombie rings */
+                       /* delete from the active list */
+                       DHD_INFO(("deleting flow id %u from active list\n",
+                               flow_ring_node->flowid));
+                       __dhd_flow_ring_delete_from_active_list(bus, flow_ring_node);
+                       continue;
+               }
+
+               diff = time_stamp - flow_ring_node->last_active_ts;
+
+               if ((diff > IDLE_FLOW_RING_TIMEOUT) && !(flow_ring_node->queue.len))  {
+                       DHD_ERROR(("\nSuspending flowid %d\n", flow_ring_node->flowid));
+                       /* delete from the active list */
+                       __dhd_flow_ring_delete_from_active_list(bus, flow_ring_node);
+                       flow_ring_node->status = FLOW_RING_STATUS_SUSPENDED;
+                       ringid[count] = flow_ring_node->flowid;
+                       count++;
+                       if (count == MAX_SUSPEND_REQ) {
+                               /* create a batch message now!! */
+                               dhd_prot_flow_ring_batch_suspend_request(bus->dhd, ringid, count);
+                               count = 0;
+                       }
+
+               } else {
+
+                       /* No more scanning, break from here! */
+                       break;
+               }
+       }
+
+       if (count) {
+               dhd_prot_flow_ring_batch_suspend_request(bus->dhd, ringid, count);
+       }
+
+       DHD_FLOWRING_LIST_UNLOCK(bus->dhd->flowring_list_lock, flags);
+
+       return;
+}
+
+void dhd_flow_ring_move_to_active_list_head(struct dhd_bus *bus, flow_ring_node_t *flow_ring_node)
+{
+       unsigned long flags;
+       dll_t* list;
+
+       DHD_FLOWRING_LIST_LOCK(bus->dhd->flowring_list_lock, flags);
+       /* check if the node is already at head, otherwise delete it and prepend */
+       list = dll_head_p(&bus->flowring_active_list);
+       if (&flow_ring_node->list != list) {
+               dll_delete(&flow_ring_node->list);
+               dll_prepend(&bus->flowring_active_list, &flow_ring_node->list);
+       }
+
+       /* update flow ring timestamp */
+       flow_ring_node->last_active_ts = OSL_SYSUPTIME();
+
+       DHD_FLOWRING_LIST_UNLOCK(bus->dhd->flowring_list_lock, flags);
+
+       return;
+}
+
+void dhd_flow_ring_add_to_active_list(struct dhd_bus *bus, flow_ring_node_t *flow_ring_node)
+{
+       unsigned long flags;
+
+       DHD_FLOWRING_LIST_LOCK(bus->dhd->flowring_list_lock, flags);
+
+       dll_prepend(&bus->flowring_active_list, &flow_ring_node->list);
+       /* update flow ring timestamp */
+       flow_ring_node->last_active_ts = OSL_SYSUPTIME();
+
+       DHD_FLOWRING_LIST_UNLOCK(bus->dhd->flowring_list_lock, flags);
+
+       return;
+}
+void __dhd_flow_ring_delete_from_active_list(struct dhd_bus *bus, flow_ring_node_t *flow_ring_node)
+{
+       dll_delete(&flow_ring_node->list);
+}
+
+void dhd_flow_ring_delete_from_active_list(struct dhd_bus *bus, flow_ring_node_t *flow_ring_node)
+{
+       unsigned long flags;
+
+       DHD_FLOWRING_LIST_LOCK(bus->dhd->flowring_list_lock, flags);
+
+       __dhd_flow_ring_delete_from_active_list(bus, flow_ring_node);
+
+       DHD_FLOWRING_LIST_UNLOCK(bus->dhd->flowring_list_lock, flags);
+
+       return;
+}
+#endif /* IDLE_TX_FLOW_MGMT */
+
+int
+dhdpcie_bus_start_host_dev(struct dhd_bus *bus)
+{
+       return dhdpcie_start_host_dev(bus);
+}
+
+int
+dhdpcie_bus_stop_host_dev(struct dhd_bus *bus)
+{
+       return dhdpcie_stop_host_dev(bus);
+}
+
+int
+dhdpcie_bus_disable_device(struct dhd_bus *bus)
+{
+       return dhdpcie_disable_device(bus);
+}
+
+int
+dhdpcie_bus_enable_device(struct dhd_bus *bus)
+{
+       return dhdpcie_enable_device(bus);
+}
+
+int
+dhdpcie_bus_alloc_resource(struct dhd_bus *bus)
+{
+       return dhdpcie_alloc_resource(bus);
+}
+
+void
+dhdpcie_bus_free_resource(struct dhd_bus *bus)
+{
+       dhdpcie_free_resource(bus);
+}
+
+int
+dhd_bus_request_irq(struct dhd_bus *bus)
+{
+       return dhdpcie_bus_request_irq(bus);
+}
+
+bool
+dhdpcie_bus_dongle_attach(struct dhd_bus *bus)
+{
+       return dhdpcie_dongle_attach(bus);
+}
+
+int
+dhd_bus_release_dongle(struct dhd_bus *bus)
+{
+       bool dongle_isolation;
+       osl_t *osh;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus) {
+               osh = bus->osh;
+               ASSERT(osh);
+
+               if (bus->dhd) {
+#if defined(DEBUGGER) || defined(DHD_DSCOPE)
+                       debugger_close();
+#endif /* DEBUGGER || DHD_DSCOPE */
+
+                       dongle_isolation = bus->dhd->dongle_isolation;
+                       dhdpcie_bus_release_dongle(bus, osh, dongle_isolation, TRUE);
+               }
+       }
+
+       return 0;
+}
+
+int
+dhdpcie_cto_cfg_init(struct dhd_bus *bus, bool enable)
+{
+       if (enable) {
+               dhdpcie_bus_cfg_write_dword(bus, PCI_INT_MASK, 4,
+                       PCI_CTO_INT_MASK | PCI_SBIM_MASK_SERR);
+       } else {
+               dhdpcie_bus_cfg_write_dword(bus, PCI_INT_MASK, 4, 0);
+       }
+       return 0;
+}
+
+int
+dhdpcie_cto_init(struct dhd_bus *bus, bool enable)
+{
+       volatile void *regsva = (volatile void *)bus->regs;
+       uint32 val;
+       uint16 chipid = dhd_get_chipid(bus);
+       uint32 ctoctrl;
+
+       bus->cto_enable = enable;
+
+       dhdpcie_cto_cfg_init(bus, enable);
+
+       if (enable) {
+               if (bus->cto_threshold == 0) {
+                       if ((chipid == BCM4387_CHIP_ID) ||
+                           (chipid == BCM4388_CHIP_ID) ||
+                           (chipid == BCM4389_CHIP_ID)) {
+                               bus->cto_threshold = PCIE_CTO_TO_THRESH_DEFAULT_REV69;
+                       } else {
+                               bus->cto_threshold = PCIE_CTO_TO_THRESH_DEFAULT;
+                       }
+               }
+               val = ((bus->cto_threshold << PCIE_CTO_TO_THRESHOLD_SHIFT) &
+                       PCIE_CTO_TO_THRESHHOLD_MASK) |
+                       ((PCIE_CTO_CLKCHKCNT_VAL << PCIE_CTO_CLKCHKCNT_SHIFT) &
+                       PCIE_CTO_CLKCHKCNT_MASK) |
+                       PCIE_CTO_ENAB_MASK;
+
+               pcie_corereg(bus->osh, regsva, OFFSETOF(sbpcieregs_t, ctoctrl), ~0, val);
+       } else {
+               pcie_corereg(bus->osh, regsva, OFFSETOF(sbpcieregs_t, ctoctrl), ~0, 0);
+       }
+
+       ctoctrl = pcie_corereg(bus->osh, regsva, OFFSETOF(sbpcieregs_t, ctoctrl), 0, 0);
+
+       DHD_ERROR(("%s: ctoctrl(0x%x) enable/disable %d for chipid(0x%x)\n",
+               __FUNCTION__, ctoctrl, bus->cto_enable, chipid));
+
+       return 0;
+}
+
+static int
+dhdpcie_cto_error_recovery(struct dhd_bus *bus)
+{
+       uint32 pci_intmask, err_status;
+       uint8 i = 0;
+       uint32 val;
+
+       pci_intmask = dhdpcie_bus_cfg_read_dword(bus, PCI_INT_MASK, 4);
+       dhdpcie_bus_cfg_write_dword(bus, PCI_INT_MASK, 4, pci_intmask & ~PCI_CTO_INT_MASK);
+
+       DHD_OS_WAKE_LOCK(bus->dhd);
+
+       DHD_ERROR(("--- CTO Triggered --- %d\n", bus->pwr_req_ref));
+
+       /*
+        * DAR still accessible
+        */
+       dhd_bus_dump_dar_registers(bus);
+
+       /* reset backplane */
+       val = dhdpcie_bus_cfg_read_dword(bus, PCI_SPROM_CONTROL, 4);
+       dhdpcie_bus_cfg_write_dword(bus, PCI_SPROM_CONTROL, 4, val | SPROM_CFG_TO_SB_RST);
+
+       /* clear timeout error */
+       while (1) {
+               err_status =  si_corereg(bus->sih, bus->sih->buscoreidx,
+                       DAR_ERRLOG(bus->sih->buscorerev),
+                       0, 0);
+               if (err_status & PCIE_CTO_ERR_MASK) {
+                       si_corereg(bus->sih, bus->sih->buscoreidx,
+                                       DAR_ERRLOG(bus->sih->buscorerev),
+                                       ~0, PCIE_CTO_ERR_MASK);
+               } else {
+                       break;
+               }
+               OSL_DELAY(CTO_TO_CLEAR_WAIT_MS * 1000);
+               i++;
+               if (i > CTO_TO_CLEAR_WAIT_MAX_CNT) {
+                       DHD_ERROR(("cto recovery fail\n"));
+
+                       DHD_OS_WAKE_UNLOCK(bus->dhd);
+                       return BCME_ERROR;
+               }
+       }
+
+       /* clear interrupt status */
+       dhdpcie_bus_cfg_write_dword(bus, PCI_INT_STATUS, 4, PCI_CTO_INT_MASK);
+
+       /* Halt ARM & remove reset */
+       /* TBD : we can add ARM Halt here in case */
+
+       /* reset SPROM_CFG_TO_SB_RST */
+       val = dhdpcie_bus_cfg_read_dword(bus, PCI_SPROM_CONTROL, 4);
+
+       DHD_ERROR(("cto recovery reset 0x%x:SPROM_CFG_TO_SB_RST(0x%x) 0x%x\n",
+               PCI_SPROM_CONTROL, SPROM_CFG_TO_SB_RST, val));
+       dhdpcie_bus_cfg_write_dword(bus, PCI_SPROM_CONTROL, 4, val & ~SPROM_CFG_TO_SB_RST);
+
+       val = dhdpcie_bus_cfg_read_dword(bus, PCI_SPROM_CONTROL, 4);
+       DHD_ERROR(("cto recovery success 0x%x:SPROM_CFG_TO_SB_RST(0x%x) 0x%x\n",
+               PCI_SPROM_CONTROL, SPROM_CFG_TO_SB_RST, val));
+
+       DHD_OS_WAKE_UNLOCK(bus->dhd);
+
+       return BCME_OK;
+}
+
+void
+dhdpcie_ssreset_dis_enum_rst(struct dhd_bus *bus)
+{
+       uint32 val;
+
+       val = dhdpcie_bus_cfg_read_dword(bus, PCIE_CFG_SUBSYSTEM_CONTROL, 4);
+       dhdpcie_bus_cfg_write_dword(bus, PCIE_CFG_SUBSYSTEM_CONTROL, 4,
+               val | (0x1 << PCIE_SSRESET_DIS_ENUM_RST_BIT));
+}
+
+#if defined(DBG_PKT_MON) || defined(DHD_PKT_LOGGING)
+/*
+ * XXX: WAR: Update dongle that driver supports sending of d11
+ * tx_status through unused status field of PCIe completion header
+ * if dongle also supports the same WAR.
+ */
+static int
+dhdpcie_init_d11status(struct dhd_bus *bus)
+{
+       uint32 addr;
+       uint32 flags2;
+       int ret = 0;
+
+       if (bus->pcie_sh->flags2 & PCIE_SHARED2_D2H_D11_TX_STATUS) {
+               flags2 = bus->pcie_sh->flags2;
+               addr = bus->shared_addr + OFFSETOF(pciedev_shared_t, flags2);
+               flags2 |= PCIE_SHARED2_H2D_D11_TX_STATUS;
+               ret = dhdpcie_bus_membytes(bus, TRUE, addr,
+                       (uint8 *)&flags2, sizeof(flags2));
+               if (ret < 0) {
+                       DHD_ERROR(("%s: update flag bit (H2D_D11_TX_STATUS) failed\n",
+                               __FUNCTION__));
+                       return ret;
+               }
+               bus->pcie_sh->flags2 = flags2;
+               bus->dhd->d11_tx_status = TRUE;
+       }
+       return ret;
+}
+
+#else
+static int
+dhdpcie_init_d11status(struct dhd_bus *bus)
+{
+       return 0;
+}
+#endif /* DBG_PKT_MON || DHD_PKT_LOGGING */
+
+int
+dhd_bus_oob_intr_register(dhd_pub_t *dhdp)
+{
+       int err = 0;
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       err = dhdpcie_oob_intr_register(dhdp->bus);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+       return err;
+}
+
+void
+dhd_bus_oob_intr_unregister(dhd_pub_t *dhdp)
+{
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       dhdpcie_oob_intr_unregister(dhdp->bus);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+}
+
+void
+dhd_bus_oob_intr_set(dhd_pub_t *dhdp, bool enable)
+{
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       dhdpcie_oob_intr_set(dhdp->bus, enable);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+}
+
+int
+dhd_bus_get_oob_irq_num(dhd_pub_t *dhdp)
+{
+       int irq_num = 0;
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       irq_num = dhdpcie_get_oob_irq_num(dhdp->bus);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+       return irq_num;
+}
+
+bool
+dhdpcie_bus_get_pcie_hostready_supported(dhd_bus_t *bus)
+{
+       return bus->dhd->d2h_hostrdy_supported;
+}
+
+void
+dhd_pcie_dump_core_regs(dhd_pub_t * pub, uint32 index, uint32 first_addr, uint32 last_addr)
+{
+       dhd_bus_t *bus = pub->bus;
+       uint32  coreoffset = index << 12;
+       uint32  core_addr = SI_ENUM_BASE(bus->sih) + coreoffset;
+       uint32 value;
+
+       while (first_addr <= last_addr) {
+               core_addr = SI_ENUM_BASE(bus->sih) + coreoffset + first_addr;
+               if (serialized_backplane_access(bus, core_addr, 4, &value, TRUE) != BCME_OK) {
+                       DHD_ERROR(("Invalid size/addr combination \n"));
+               }
+               DHD_ERROR(("[0x%08x]: 0x%08x\n", core_addr, value));
+               first_addr = first_addr + 4;
+       }
+}
+
+bool
+dhdpcie_bus_get_pcie_hwa_supported(dhd_bus_t *bus)
+{
+       if (!bus->dhd) {
+               return FALSE;
+       } else if (bus->hwa_enabled) {
+               return bus->dhd->hwa_capable;
+       } else {
+               return FALSE;
+       }
+}
+
+bool
+dhdpcie_bus_get_pcie_idma_supported(dhd_bus_t *bus)
+{
+       if (!bus->dhd)
+               return FALSE;
+       else if (bus->idma_enabled) {
+               return bus->dhd->idma_enable;
+       } else {
+               return FALSE;
+       }
+}
+
+bool
+dhdpcie_bus_get_pcie_ifrm_supported(dhd_bus_t *bus)
+{
+       if (!bus->dhd)
+               return FALSE;
+       else if (bus->ifrm_enabled) {
+               return bus->dhd->ifrm_enable;
+       } else {
+               return FALSE;
+       }
+}
+
+bool
+dhdpcie_bus_get_pcie_dar_supported(dhd_bus_t *bus)
+{
+       if (!bus->dhd) {
+               return FALSE;
+       } else if (bus->dar_enabled) {
+               return bus->dhd->dar_enable;
+       } else {
+               return FALSE;
+       }
+}
+
+void
+dhdpcie_bus_enab_pcie_dw(dhd_bus_t *bus, uint8 dw_option)
+{
+       DHD_ERROR(("ENABLING DW:%d\n", dw_option));
+       bus->dw_option = dw_option;
+}
+
+#ifdef PCIE_INB_DW
+bool
+dhdpcie_bus_get_pcie_inband_dw_supported(dhd_bus_t *bus)
+{
+       if (!bus->dhd)
+               return FALSE;
+       if (bus->inb_enabled) {
+               return bus->dhd->d2h_inband_dw;
+       } else {
+               return FALSE;
+       }
+}
+
+void
+dhdpcie_bus_set_pcie_inband_dw_state(dhd_bus_t *bus, enum dhd_bus_ds_state state)
+{
+       if (!INBAND_DW_ENAB(bus))
+               return;
+
+       DHD_INFO(("%s:%d\n", __FUNCTION__, state));
+       bus->dhd->ds_state = state;
+       if (state == DW_DEVICE_DS_DISABLED_WAIT || state == DW_DEVICE_DS_D3_INFORM_WAIT) {
+               bus->ds_exit_timeout = 100;
+       }
+       if (state == DW_DEVICE_HOST_WAKE_WAIT) {
+               bus->host_sleep_exit_timeout = 100;
+       }
+       if (state == DW_DEVICE_DS_DEV_WAKE) {
+               bus->ds_exit_timeout = 0;
+       }
+       if (state == DW_DEVICE_DS_ACTIVE) {
+               bus->host_sleep_exit_timeout = 0;
+       }
+}
+
+enum dhd_bus_ds_state
+dhdpcie_bus_get_pcie_inband_dw_state(dhd_bus_t *bus)
+{
+       if (!INBAND_DW_ENAB(bus))
+               return DW_DEVICE_DS_INVALID;
+       return bus->dhd->ds_state;
+}
+#endif /* PCIE_INB_DW */
+
+static void
+#ifdef PCIE_INB_DW
+dhd_bus_ds_trace(dhd_bus_t *bus, uint32 dsval, bool d2h, enum dhd_bus_ds_state inbstate)
+#else
+dhd_bus_ds_trace(dhd_bus_t *bus, uint32 dsval, bool d2h)
+#endif /* PCIE_INB_DW */
+{
+       uint32 cnt = bus->ds_trace_count % MAX_DS_TRACE_SIZE;
+
+       bus->ds_trace[cnt].timestamp = OSL_LOCALTIME_NS();
+       bus->ds_trace[cnt].d2h = d2h;
+       bus->ds_trace[cnt].dsval = dsval;
+#ifdef PCIE_INB_DW
+       bus->ds_trace[cnt].inbstate = inbstate;
+#endif /* PCIE_INB_DW */
+       bus->ds_trace_count ++;
+}
+
+#ifdef PCIE_INB_DW
+const char *
+dhd_convert_dsval(uint32 val, bool d2h)
+{
+       if (d2h) {
+               switch (val) {
+                       case D2H_DEV_D3_ACK:
+                               return "D2H_DEV_D3_ACK";
+                       case D2H_DEV_DS_ENTER_REQ:
+                               return "D2H_DEV_DS_ENTER_REQ";
+                       case D2H_DEV_DS_EXIT_NOTE:
+                               return "D2H_DEV_DS_EXIT_NOTE";
+                       case D2H_DEV_FWHALT:
+                               return "D2H_DEV_FWHALT";
+                       case D2HMB_DS_HOST_SLEEP_EXIT_ACK:
+                               return "D2HMB_DS_HOST_SLEEP_EXIT_ACK";
+                       default:
+                               return "INVALID";
+               }
+       } else {
+               switch (val) {
+                       case H2DMB_DS_DEVICE_WAKE_DEASSERT:
+                               return "H2DMB_DS_DEVICE_WAKE_DEASSERT";
+                       case H2DMB_DS_DEVICE_WAKE_ASSERT:
+                               return "H2DMB_DS_DEVICE_WAKE_ASSERT";
+                       case H2D_HOST_D3_INFORM:
+                               return "H2D_HOST_D3_INFORM";
+                       case H2D_HOST_DS_ACK:
+                               return "H2D_HOST_DS_ACK";
+                       case H2D_HOST_DS_NAK:
+                               return "H2D_HOST_DS_NAK";
+                       case H2D_HOST_CONS_INT:
+                               return "H2D_HOST_CONS_INT";
+                       case H2D_FW_TRAP:
+                               return "H2D_FW_TRAP";
+                       default:
+                               return "INVALID";
+               }
+       }
+}
+
+const char *
+dhd_convert_inb_state_names(enum dhd_bus_ds_state inbstate)
+{
+       switch (inbstate) {
+               case DW_DEVICE_DS_DEV_SLEEP:
+                       return "DW_DEVICE_DS_DEV_SLEEP";
+               break;
+               case DW_DEVICE_DS_DISABLED_WAIT:
+                       return "DW_DEVICE_DS_DISABLED_WAIT";
+               break;
+               case DW_DEVICE_DS_DEV_WAKE:
+                       return "DW_DEVICE_DS_DEV_WAKE";
+               break;
+               case DW_DEVICE_DS_ACTIVE:
+                       return "DW_DEVICE_DS_ACTIVE";
+               break;
+               case DW_DEVICE_HOST_SLEEP_WAIT:
+                       return "DW_DEVICE_HOST_SLEEP_WAIT";
+               break;
+               case DW_DEVICE_HOST_SLEEP:
+                       return "DW_DEVICE_HOST_SLEEP";
+               break;
+               case DW_DEVICE_HOST_WAKE_WAIT:
+                       return "DW_DEVICE_HOST_WAKE_WAIT";
+               break;
+               case DW_DEVICE_DS_D3_INFORM_WAIT:
+                       return "DW_DEVICE_DS_D3_INFORM_WAIT";
+               break;
+               default:
+                       return "INVALID";
+       }
+}
+#endif /* PCIE_INB_DW */
+
+void
+dhd_dump_bus_ds_trace(dhd_bus_t *bus, struct bcmstrbuf *strbuf)
+{
+       int dumpsz;
+       int i;
+
+       dumpsz = bus->ds_trace_count < MAX_DS_TRACE_SIZE ?
+               bus->ds_trace_count : MAX_DS_TRACE_SIZE;
+       if (dumpsz == 0) {
+               bcm_bprintf(strbuf, "\nEmpty DS TRACE\n");
+               return;
+       }
+       bcm_bprintf(strbuf, "---- DS TRACE ------\n");
+#ifdef PCIE_INB_DW
+       bcm_bprintf(strbuf, "%s\t\t%s\t%-30s\t\t%s\n",
+               "Timestamp us", "Dir", "Value", "Inband-State");
+       for (i = 0; i < dumpsz; i ++) {
+               bcm_bprintf(strbuf, "%llu\t%s\t%-30s\t\t%s\n",
+               bus->ds_trace[i].timestamp,
+               bus->ds_trace[i].d2h ? "D2H":"H2D",
+               dhd_convert_dsval(bus->ds_trace[i].dsval, bus->ds_trace[i].d2h),
+               dhd_convert_inb_state_names(bus->ds_trace[i].inbstate));
+       }
+#else
+       bcm_bprintf(strbuf, "Timestamp us\t\tDir\tValue\n");
+       for (i = 0; i < dumpsz; i ++) {
+               bcm_bprintf(strbuf, "%llu\t%s\t%d\n",
+               bus->ds_trace[i].timestamp,
+               bus->ds_trace[i].d2h ? "D2H":"H2D",
+               bus->ds_trace[i].dsval);
+       }
+#endif /* PCIE_INB_DW */
+       bcm_bprintf(strbuf, "--------------------------\n");
+}
+
+void
+dhd_bus_dump_trap_info(dhd_bus_t *bus, struct bcmstrbuf *strbuf)
+{
+       trap_t *tr = &bus->dhd->last_trap_info;
+       bcm_bprintf(strbuf,
+               "\nTRAP type 0x%x @ epc 0x%x, cpsr 0x%x, spsr 0x%x, sp 0x%x,"
+               " lp 0x%x, rpc 0x%x"
+               "\nTrap offset 0x%x, r0 0x%x, r1 0x%x, r2 0x%x, r3 0x%x, "
+               "r4 0x%x, r5 0x%x, r6 0x%x, r7 0x%x, r8 0x%x, r9 0x%x, "
+               "r10 0x%x, r11 0x%x, r12 0x%x\n\n",
+               ltoh32(tr->type), ltoh32(tr->epc), ltoh32(tr->cpsr), ltoh32(tr->spsr),
+               ltoh32(tr->r13), ltoh32(tr->r14), ltoh32(tr->pc),
+               ltoh32(bus->pcie_sh->trap_addr),
+               ltoh32(tr->r0), ltoh32(tr->r1), ltoh32(tr->r2), ltoh32(tr->r3),
+               ltoh32(tr->r4), ltoh32(tr->r5), ltoh32(tr->r6), ltoh32(tr->r7),
+               ltoh32(tr->r8), ltoh32(tr->r9), ltoh32(tr->r10),
+               ltoh32(tr->r11), ltoh32(tr->r12));
+}
+
+int
+dhd_bus_readwrite_bp_addr(dhd_pub_t *dhdp, uint addr, uint size, uint* data, bool read)
+{
+       int bcmerror = 0;
+       struct dhd_bus *bus = dhdp->bus;
+
+       if (serialized_backplane_access(bus, addr, size, data, read) != BCME_OK) {
+                       DHD_ERROR(("Invalid size/addr combination \n"));
+                       bcmerror = BCME_ERROR;
+       }
+
+       return bcmerror;
+}
+
+int
+dhd_get_idletime(dhd_pub_t *dhd)
+{
+       return dhd->bus->idletime;
+}
+
+bool
+dhd_get_rpm_state(dhd_pub_t *dhd)
+{
+       return dhd->bus->rpm_enabled;
+}
+
+void
+dhd_set_rpm_state(dhd_pub_t *dhd, bool state)
+{
+       DHD_ERROR(("%s: %d\n", __FUNCTION__, state));
+       dhd->bus->rpm_enabled = state;
+}
+
+static INLINE void
+dhd_sbreg_op(dhd_pub_t *dhd, uint addr, uint *val, bool read)
+{
+       OSL_DELAY(1);
+       if (serialized_backplane_access(dhd->bus, addr, sizeof(uint), val, read) != BCME_OK) {
+               DHD_ERROR(("sbreg: Invalid uint addr: 0x%x \n", addr));
+       } else {
+               DHD_ERROR(("sbreg: addr:0x%x val:0x%x read:%d\n", addr, *val, read));
+       }
+       return;
+}
+
+#ifdef DHD_SSSR_DUMP
+static int
+dhdpcie_get_sssr_fifo_dump(dhd_pub_t *dhd, uint *buf, uint fifo_size,
+       uint addr_reg, uint data_reg)
+{
+       uint addr;
+       uint val = 0;
+       int i;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       if (!buf) {
+               DHD_ERROR(("%s: buf is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (!fifo_size) {
+               DHD_ERROR(("%s: fifo_size is 0\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       /* Set the base address offset to 0 */
+       addr = addr_reg;
+       val = 0;
+       dhd_sbreg_op(dhd, addr, &val, FALSE);
+
+       addr = data_reg;
+       /* Read 4 bytes at once and loop for fifo_size / 4 */
+       for (i = 0; i < fifo_size / 4; i++) {
+               if (serialized_backplane_access(dhd->bus, addr,
+                               sizeof(uint), &val, TRUE) != BCME_OK) {
+                       DHD_ERROR(("%s: error in serialized_backplane_access\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+               buf[i] = val;
+               OSL_DELAY(1);
+       }
+       return BCME_OK;
+}
+
+static int
+dhdpcie_get_sssr_dig_dump(dhd_pub_t *dhd, uint *buf, uint fifo_size,
+       uint addr_reg)
+{
+       uint addr;
+       uint val = 0;
+       int i;
+       si_t *sih = dhd->bus->sih;
+       bool vasip_enab, dig_mem_check;
+       uint32 ioctrl_addr = 0;
+
+       DHD_ERROR(("%s addr_reg=0x%x size=0x%x\n", __FUNCTION__, addr_reg, fifo_size));
+
+       if (!buf) {
+               DHD_ERROR(("%s: buf is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (!fifo_size) {
+               DHD_ERROR(("%s: fifo_size is 0\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       vasip_enab = FALSE;
+       dig_mem_check = FALSE;
+       /* SSSR register information structure v0 and v1 shares most except dig_mem */
+       switch (dhd->sssr_reg_info->rev2.version) {
+               case SSSR_REG_INFO_VER_3 :
+                       /* intentional fall through */
+               case SSSR_REG_INFO_VER_2 :
+                       if ((dhd->sssr_reg_info->rev2.length > OFFSETOF(sssr_reg_info_v2_t,
+                       dig_mem_info)) && dhd->sssr_reg_info->rev2.dig_mem_info.dig_sr_size) {
+                               dig_mem_check = TRUE;
+                       }
+                       break;
+               case SSSR_REG_INFO_VER_1 :
+                       if (dhd->sssr_reg_info->rev1.vasip_regs.vasip_sr_size) {
+                               vasip_enab = TRUE;
+                       } else if ((dhd->sssr_reg_info->rev1.length > OFFSETOF(sssr_reg_info_v1_t,
+                               dig_mem_info)) && dhd->sssr_reg_info->rev1.
+                               dig_mem_info.dig_sr_size) {
+                               dig_mem_check = TRUE;
+                       }
+                       ioctrl_addr = dhd->sssr_reg_info->rev1.vasip_regs.wrapper_regs.ioctrl;
+                       break;
+               case SSSR_REG_INFO_VER_0 :
+                       if (dhd->sssr_reg_info->rev0.vasip_regs.vasip_sr_size) {
+                               vasip_enab = TRUE;
+                       }
+                       ioctrl_addr = dhd->sssr_reg_info->rev0.vasip_regs.wrapper_regs.ioctrl;
+                       break;
+               default :
+                       DHD_ERROR(("invalid sssr_reg_ver"));
+                       return BCME_UNSUPPORTED;
+       }
+       if (addr_reg) {
+               DHD_ERROR(("dig_mem_check=%d vasip_enab=%d\n", dig_mem_check, vasip_enab));
+               if (!vasip_enab && dig_mem_check) {
+                       int err = dhdpcie_bus_membytes(dhd->bus, FALSE, addr_reg, (uint8 *)buf,
+                               fifo_size);
+                       if (err != BCME_OK) {
+                               DHD_ERROR(("%s: Error reading dig dump from dongle !\n",
+                                       __FUNCTION__));
+                       }
+               } else {
+                       /* Check if vasip clk is disabled, if yes enable it */
+                       addr = ioctrl_addr;
+                       dhd_sbreg_op(dhd, addr, &val, TRUE);
+                       if (!val) {
+                               val = 1;
+                               dhd_sbreg_op(dhd, addr, &val, FALSE);
+                       }
+
+                       addr = addr_reg;
+                       /* Read 4 bytes at once and loop for fifo_size / 4 */
+                       for (i = 0; i < fifo_size / 4; i++, addr += 4) {
+                               if (serialized_backplane_access(dhd->bus, addr, sizeof(uint),
+                                       &val, TRUE) != BCME_OK) {
+                                       DHD_ERROR(("%s: Invalid uint addr: 0x%x \n", __FUNCTION__,
+                                               addr));
+                                       return BCME_ERROR;
+                               }
+                               buf[i] = val;
+                               OSL_DELAY(1);
+                       }
+               }
+       } else {
+               uint cur_coreid;
+               uint chipc_corerev;
+               chipcregs_t *chipcregs;
+
+               /* Save the current core */
+               cur_coreid = si_coreid(sih);
+
+               /* Switch to ChipC */
+               chipcregs = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+               if (!chipcregs) {
+                       DHD_ERROR(("%s: si_setcore returns NULL for core id %u \n",
+                               __FUNCTION__, CC_CORE_ID));
+                       return BCME_ERROR;
+               }
+
+               chipc_corerev = si_corerev(sih);
+
+               if ((chipc_corerev == 64) || (chipc_corerev == 65)) {
+                       W_REG(si_osh(sih), &chipcregs->sr_memrw_addr, 0);
+
+                       /* Read 4 bytes at once and loop for fifo_size / 4 */
+                       for (i = 0; i < fifo_size / 4; i++) {
+                               buf[i] = R_REG(si_osh(sih), &chipcregs->sr_memrw_data);
+                               OSL_DELAY(1);
+                       }
+               }
+
+               /* Switch back to the original core */
+               si_setcore(sih, cur_coreid, 0);
+       }
+
+       return BCME_OK;
+}
+
+#if defined(BCMPCIE) && defined(EWP_ETD_PRSRV_LOGS)
+void
+dhdpcie_get_etd_preserve_logs(dhd_pub_t *dhd,
+               uint8 *ext_trap_data, void *event_decode_data)
+{
+       hnd_ext_trap_hdr_t *hdr = NULL;
+       bcm_tlv_t *tlv;
+       eventlog_trapdata_info_t *etd_evtlog = NULL;
+       eventlog_trap_buf_info_t *evtlog_buf_arr = NULL;
+       uint arr_size = 0;
+       int i = 0;
+       int err = 0;
+       uint32 seqnum = 0;
+
+       if (!ext_trap_data || !event_decode_data || !dhd)
+               return;
+
+       if (!dhd->concise_dbg_buf)
+               return;
+
+       /* First word is original trap_data, skip */
+       ext_trap_data += sizeof(uint32);
+
+       hdr = (hnd_ext_trap_hdr_t *)ext_trap_data;
+       tlv = bcm_parse_tlvs(hdr->data, hdr->len, TAG_TRAP_LOG_DATA);
+       if (tlv) {
+               uint32 baseaddr = 0;
+               uint32 endaddr = dhd->bus->dongle_ram_base + dhd->bus->ramsize - 4;
+
+               etd_evtlog = (eventlog_trapdata_info_t *)tlv->data;
+               DHD_ERROR(("%s: etd_evtlog tlv found, num_elements=%x; "
+                       "seq_num=%x; log_arr_addr=%x\n", __FUNCTION__,
+                       (etd_evtlog->num_elements),
+                       ntoh32(etd_evtlog->seq_num), (etd_evtlog->log_arr_addr)));
+               if (!etd_evtlog->num_elements ||
+                               etd_evtlog->num_elements > MAX_EVENTLOG_BUFFERS) {
+                       DHD_ERROR(("%s: ETD has bad 'num_elements' !\n", __FUNCTION__));
+                       return;
+               }
+               if (!etd_evtlog->log_arr_addr) {
+                       DHD_ERROR(("%s: ETD has bad 'log_arr_addr' !\n", __FUNCTION__));
+                       return;
+               }
+
+               arr_size = (uint32)sizeof(*evtlog_buf_arr) * (etd_evtlog->num_elements);
+               evtlog_buf_arr = MALLOCZ(dhd->osh, arr_size);
+               if (!evtlog_buf_arr) {
+                       DHD_ERROR(("%s: out of memory !\n",     __FUNCTION__));
+                       return;
+               }
+
+               /* boundary check */
+               baseaddr = etd_evtlog->log_arr_addr;
+               if ((baseaddr < dhd->bus->dongle_ram_base) ||
+                       ((baseaddr + arr_size) > endaddr)) {
+                       DHD_ERROR(("%s: Error reading invalid address\n",
+                               __FUNCTION__));
+                       goto err;
+               }
+
+               /* read the eventlog_trap_buf_info_t array from dongle memory */
+               err = dhdpcie_bus_membytes(dhd->bus, FALSE,
+                               (ulong)(etd_evtlog->log_arr_addr),
+                               (uint8 *)evtlog_buf_arr, arr_size);
+               if (err != BCME_OK) {
+                       DHD_ERROR(("%s: Error reading event log array from dongle !\n",
+                               __FUNCTION__));
+                       goto err;
+               }
+               /* ntoh is required only for seq_num, because in the original
+               * case of event logs from info ring, it is sent from dongle in that way
+               * so for ETD also dongle follows same convention
+               */
+               seqnum = ntoh32(etd_evtlog->seq_num);
+               memset(dhd->concise_dbg_buf, 0, CONCISE_DUMP_BUFLEN);
+               for (i = 0; i < (etd_evtlog->num_elements); ++i) {
+                       /* boundary check */
+                       baseaddr = evtlog_buf_arr[i].buf_addr;
+                       if ((baseaddr < dhd->bus->dongle_ram_base) ||
+                               ((baseaddr + evtlog_buf_arr[i].len) > endaddr)) {
+                               DHD_ERROR(("%s: Error reading invalid address\n",
+                                       __FUNCTION__));
+                               goto err;
+                       }
+                       /* read each individual event log buf from dongle memory */
+                       err = dhdpcie_bus_membytes(dhd->bus, FALSE,
+                                       ((ulong)evtlog_buf_arr[i].buf_addr),
+                                       dhd->concise_dbg_buf, (evtlog_buf_arr[i].len));
+                       if (err != BCME_OK) {
+                               DHD_ERROR(("%s: Error reading event log buffer from dongle !\n",
+                                       __FUNCTION__));
+                               goto err;
+                       }
+                       dhd_dbg_msgtrace_log_parser(dhd, dhd->concise_dbg_buf,
+                               event_decode_data, (evtlog_buf_arr[i].len),
+                               FALSE, hton32(seqnum));
+                       ++seqnum;
+               }
+err:
+               MFREE(dhd->osh, evtlog_buf_arr, arr_size);
+       } else {
+               DHD_ERROR(("%s: Error getting trap log data in ETD !\n", __FUNCTION__));
+       }
+}
+#endif /* BCMPCIE && DHD_LOG_DUMP */
+
+static uint32
+dhdpcie_resume_chipcommon_powerctrl(dhd_pub_t *dhd, uint32 reg_val)
+{
+       uint addr;
+       uint val = 0;
+       uint powerctrl_mask;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       /* SSSR register information structure v0 and v1 shares most except dig_mem */
+       switch (dhd->sssr_reg_info->rev2.version) {
+               case SSSR_REG_INFO_VER_3 :
+                       /* intentional fall through */
+               case SSSR_REG_INFO_VER_2 :
+                       addr = dhd->sssr_reg_info->rev2.chipcommon_regs.base_regs.powerctrl;
+                       powerctrl_mask = dhd->sssr_reg_info->rev2.
+                               chipcommon_regs.base_regs.powerctrl_mask;
+                       break;
+               case SSSR_REG_INFO_VER_1 :
+               case SSSR_REG_INFO_VER_0 :
+                       addr = dhd->sssr_reg_info->rev1.chipcommon_regs.base_regs.powerctrl;
+                       powerctrl_mask = dhd->sssr_reg_info->rev1.
+                               chipcommon_regs.base_regs.powerctrl_mask;
+                       break;
+               default :
+                       DHD_ERROR(("invalid sssr_reg_ver"));
+                       return BCME_UNSUPPORTED;
+       }
+
+       /* conditionally clear bits [11:8] of PowerCtrl */
+       dhd_sbreg_op(dhd, addr, &val, TRUE);
+
+       if (!(val & powerctrl_mask)) {
+               dhd_sbreg_op(dhd, addr, &reg_val, FALSE);
+       }
+       return BCME_OK;
+}
+
+static uint32
+dhdpcie_suspend_chipcommon_powerctrl(dhd_pub_t *dhd)
+{
+       uint addr;
+       uint val = 0, reg_val = 0;
+       uint powerctrl_mask;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       /* SSSR register information structure v0 and v1 shares most except dig_mem */
+       switch (dhd->sssr_reg_info->rev2.version) {
+               case SSSR_REG_INFO_VER_3 :
+                       /* intentional fall through */
+               case SSSR_REG_INFO_VER_2 :
+                       addr = dhd->sssr_reg_info->rev2.chipcommon_regs.base_regs.powerctrl;
+                       powerctrl_mask = dhd->sssr_reg_info->rev2.
+                               chipcommon_regs.base_regs.powerctrl_mask;
+                       break;
+               case SSSR_REG_INFO_VER_1 :
+               case SSSR_REG_INFO_VER_0 :
+                       addr = dhd->sssr_reg_info->rev1.chipcommon_regs.base_regs.powerctrl;
+                       powerctrl_mask = dhd->sssr_reg_info->rev1.
+                               chipcommon_regs.base_regs.powerctrl_mask;
+                       break;
+               default :
+                       DHD_ERROR(("invalid sssr_reg_ver"));
+                       return BCME_UNSUPPORTED;
+       }
+
+       /* conditionally clear bits [11:8] of PowerCtrl */
+       dhd_sbreg_op(dhd, addr, &reg_val, TRUE);
+       if (reg_val & powerctrl_mask) {
+               val = 0;
+               dhd_sbreg_op(dhd, addr, &val, FALSE);
+       }
+       return reg_val;
+}
+
+static int
+dhdpcie_clear_intmask_and_timer(dhd_pub_t *dhd)
+{
+       uint addr;
+       uint val;
+       uint32 cc_intmask, pmuintmask0, pmuintmask1, resreqtimer, macresreqtimer,
+        macresreqtimer1, vasip_sr_size = 0;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       /* SSSR register information structure v0 and v1 shares most except dig_mem */
+       switch (dhd->sssr_reg_info->rev2.version) {
+               case SSSR_REG_INFO_VER_3 :
+                       /* intentional fall through */
+               case SSSR_REG_INFO_VER_2 :
+                       cc_intmask = dhd->sssr_reg_info->rev2.chipcommon_regs.base_regs.intmask;
+                       pmuintmask0 = dhd->sssr_reg_info->rev2.pmu_regs.base_regs.pmuintmask0;
+                       pmuintmask1 = dhd->sssr_reg_info->rev2.pmu_regs.base_regs.pmuintmask1;
+                       resreqtimer = dhd->sssr_reg_info->rev2.pmu_regs.base_regs.resreqtimer;
+                       macresreqtimer = dhd->sssr_reg_info->rev2.pmu_regs.base_regs.macresreqtimer;
+                       macresreqtimer1 = dhd->sssr_reg_info->rev2.
+                               pmu_regs.base_regs.macresreqtimer1;
+                       break;
+               case SSSR_REG_INFO_VER_1 :
+               case SSSR_REG_INFO_VER_0 :
+                       cc_intmask = dhd->sssr_reg_info->rev1.chipcommon_regs.base_regs.intmask;
+                       pmuintmask0 = dhd->sssr_reg_info->rev1.pmu_regs.base_regs.pmuintmask0;
+                       pmuintmask1 = dhd->sssr_reg_info->rev1.pmu_regs.base_regs.pmuintmask1;
+                       resreqtimer = dhd->sssr_reg_info->rev1.pmu_regs.base_regs.resreqtimer;
+                       macresreqtimer = dhd->sssr_reg_info->rev1.pmu_regs.base_regs.macresreqtimer;
+                       macresreqtimer1 = dhd->sssr_reg_info->rev1.
+                               pmu_regs.base_regs.macresreqtimer1;
+                       vasip_sr_size = dhd->sssr_reg_info->rev1.vasip_regs.vasip_sr_size;
+                       break;
+               default :
+                       DHD_ERROR(("invalid sssr_reg_ver"));
+                       return BCME_UNSUPPORTED;
+       }
+
+       /* clear chipcommon intmask */
+       val = 0x0;
+       dhd_sbreg_op(dhd, cc_intmask, &val, FALSE);
+
+       /* clear PMUIntMask0 */
+       val = 0x0;
+       dhd_sbreg_op(dhd, pmuintmask0, &val, FALSE);
+
+       /* clear PMUIntMask1 */
+       val = 0x0;
+       dhd_sbreg_op(dhd, pmuintmask1, &val, FALSE);
+
+       /* clear res_req_timer */
+       val = 0x0;
+       dhd_sbreg_op(dhd, resreqtimer, &val, FALSE);
+
+       /* clear macresreqtimer */
+       val = 0x0;
+       dhd_sbreg_op(dhd, macresreqtimer, &val, FALSE);
+
+       /* clear macresreqtimer1 */
+       val = 0x0;
+       dhd_sbreg_op(dhd, macresreqtimer1, &val, FALSE);
+
+       /* clear VasipClkEn */
+       if (vasip_sr_size) {
+               addr = dhd->sssr_reg_info->rev1.vasip_regs.wrapper_regs.ioctrl;
+               val = 0x0;
+               dhd_sbreg_op(dhd, addr, &val, FALSE);
+       }
+
+       return BCME_OK;
+}
+
+static void
+dhdpcie_update_d11_status_from_trapdata(dhd_pub_t *dhd)
+{
+#define TRAP_DATA_MAIN_CORE_BIT_MASK   (1 << 1)
+#define TRAP_DATA_AUX_CORE_BIT_MASK    (1 << 4)
+       uint trap_data_mask[MAX_NUM_D11CORES] =
+               {TRAP_DATA_MAIN_CORE_BIT_MASK, TRAP_DATA_AUX_CORE_BIT_MASK};
+       int i;
+       /* Apply only for 4375 chip */
+       if (dhd_bus_chip_id(dhd) == BCM4375_CHIP_ID) {
+               for (i = 0; i < MAX_NUM_D11CORES; i++) {
+                       if (dhd->sssr_d11_outofreset[i] &&
+                               (dhd->dongle_trap_data & trap_data_mask[i])) {
+                               dhd->sssr_d11_outofreset[i] = TRUE;
+                       } else {
+                               dhd->sssr_d11_outofreset[i] = FALSE;
+                       }
+                       DHD_ERROR(("%s: sssr_d11_outofreset[%d] : %d after AND with "
+                               "trap_data:0x%x-0x%x\n",
+                               __FUNCTION__, i, dhd->sssr_d11_outofreset[i],
+                               dhd->dongle_trap_data, trap_data_mask[i]));
+               }
+       }
+}
+
+static int
+dhdpcie_d11_check_outofreset(dhd_pub_t *dhd)
+{
+       int i;
+       uint addr = 0;
+       uint val = 0;
+       uint8 num_d11cores;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       num_d11cores = dhd_d11_slices_num_get(dhd);
+
+       for (i = 0; i < num_d11cores; i++) {
+               /* Check if bit 0 of resetctrl is cleared */
+               /* SSSR register information structure v0 and
+                * v1 shares most except dig_mem
+                */
+               switch (dhd->sssr_reg_info->rev2.version) {
+                       case SSSR_REG_INFO_VER_3 :
+                               /* intentional fall through */
+                       case SSSR_REG_INFO_VER_2 :
+                               addr = dhd->sssr_reg_info->rev2.
+                                       mac_regs[i].wrapper_regs.resetctrl;
+                               break;
+                       case SSSR_REG_INFO_VER_1 :
+                       case SSSR_REG_INFO_VER_0 :
+                               addr = dhd->sssr_reg_info->rev1.
+                                       mac_regs[i].wrapper_regs.resetctrl;
+                               break;
+                       default :
+                               DHD_ERROR(("invalid sssr_reg_ver"));
+                               return BCME_UNSUPPORTED;
+               }
+               if (!addr) {
+                       DHD_ERROR(("%s: skipping for core[%d] as 'addr' is NULL\n",
+                               __FUNCTION__, i));
+                       continue;
+               }
+               dhd_sbreg_op(dhd, addr, &val, TRUE);
+               if (!(val & 1)) {
+                       dhd->sssr_d11_outofreset[i] = TRUE;
+               } else {
+                       dhd->sssr_d11_outofreset[i] = FALSE;
+               }
+               DHD_ERROR(("%s: sssr_d11_outofreset[%d] : %d\n",
+                       __FUNCTION__, i, dhd->sssr_d11_outofreset[i]));
+       }
+       /* XXX Temporary WAR for 4375 to handle AXI errors on bad core
+        * to not collect SSSR dump for the core whose bit is not set in trap_data.
+        * It will be reverted once AXI errors are fixed
+        */
+       dhdpcie_update_d11_status_from_trapdata(dhd);
+
+       return BCME_OK;
+}
+
+static int
+dhdpcie_d11_clear_clk_req(dhd_pub_t *dhd)
+{
+       int i;
+       uint val = 0;
+       uint8 num_d11cores;
+       uint32 clockrequeststatus, clockcontrolstatus, clockcontrolstatus_val;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       num_d11cores = dhd_d11_slices_num_get(dhd);
+
+       for (i = 0; i < num_d11cores; i++) {
+               if (dhd->sssr_d11_outofreset[i]) {
+                       /* clear request clk only if itopoobb/extrsrcreqs is non zero */
+                       /* SSSR register information structure v0 and
+                        * v1 shares most except dig_mem
+                        */
+                       switch (dhd->sssr_reg_info->rev2.version) {
+                               case SSSR_REG_INFO_VER_3 :
+                                       /* intentional fall through */
+                               case SSSR_REG_INFO_VER_2 :
+                                       clockrequeststatus = dhd->sssr_reg_info->rev2.
+                                               mac_regs[i].wrapper_regs.extrsrcreq;
+                                       clockcontrolstatus = dhd->sssr_reg_info->rev2.
+                                               mac_regs[i].base_regs.clockcontrolstatus;
+                                       clockcontrolstatus_val = dhd->sssr_reg_info->rev2.
+                                               mac_regs[i].base_regs.clockcontrolstatus_val;
+                                       break;
+                               case SSSR_REG_INFO_VER_1 :
+                               case SSSR_REG_INFO_VER_0 :
+                                       clockrequeststatus = dhd->sssr_reg_info->rev1.
+                                               mac_regs[i].wrapper_regs.itopoobb;
+                                       clockcontrolstatus = dhd->sssr_reg_info->rev1.
+                                               mac_regs[i].base_regs.clockcontrolstatus;
+                                       clockcontrolstatus_val = dhd->sssr_reg_info->rev1.
+                                               mac_regs[i].base_regs.clockcontrolstatus_val;
+                                       break;
+                               default :
+                                       DHD_ERROR(("invalid sssr_reg_ver"));
+                                       return BCME_UNSUPPORTED;
+                       }
+                       dhd_sbreg_op(dhd, clockrequeststatus, &val, TRUE);
+                       if (val != 0) {
+                               /* clear clockcontrolstatus */
+                               dhd_sbreg_op(dhd, clockcontrolstatus,
+                                &clockcontrolstatus_val, FALSE);
+                       }
+               }
+       }
+       return BCME_OK;
+}
+
+static int
+dhdpcie_arm_clear_clk_req(dhd_pub_t *dhd)
+{
+       uint val = 0;
+       uint cfgval = 0;
+       uint32 resetctrl, clockrequeststatus, clockcontrolstatus, clockcontrolstatus_val;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       /* SSSR register information structure v0 and v1 shares most except dig_mem */
+       switch (dhd->sssr_reg_info->rev2.version) {
+               case SSSR_REG_INFO_VER_3 :
+                       /* intentional fall through */
+               case SSSR_REG_INFO_VER_2 :
+                       resetctrl = dhd->sssr_reg_info->rev2.
+                               arm_regs.wrapper_regs.resetctrl;
+                       clockrequeststatus = dhd->sssr_reg_info->rev2.
+                               arm_regs.wrapper_regs.extrsrcreq;
+                       clockcontrolstatus = dhd->sssr_reg_info->rev2.
+                               arm_regs.base_regs.clockcontrolstatus;
+                       clockcontrolstatus_val = dhd->sssr_reg_info->rev2.
+                               arm_regs.base_regs.clockcontrolstatus_val;
+                       break;
+               case SSSR_REG_INFO_VER_1 :
+               case SSSR_REG_INFO_VER_0 :
+                       resetctrl = dhd->sssr_reg_info->rev1.
+                               arm_regs.wrapper_regs.resetctrl;
+                       clockrequeststatus = dhd->sssr_reg_info->rev1.
+                               arm_regs.wrapper_regs.itopoobb;
+                       clockcontrolstatus = dhd->sssr_reg_info->rev1.
+                               arm_regs.base_regs.clockcontrolstatus;
+                       clockcontrolstatus_val = dhd->sssr_reg_info->rev1.
+                               arm_regs.base_regs.clockcontrolstatus_val;
+                       break;
+               default :
+                       DHD_ERROR(("invalid sssr_reg_ver"));
+                       return BCME_UNSUPPORTED;
+       }
+
+       /* Check if bit 0 of resetctrl is cleared */
+       dhd_sbreg_op(dhd, resetctrl, &val, TRUE);
+       if (!(val & 1)) {
+               /* clear request clk only if itopoobb/extrsrcreqs is non zero */
+               dhd_sbreg_op(dhd, clockrequeststatus, &val, TRUE);
+               if (val != 0) {
+                       /* clear clockcontrolstatus */
+                       dhd_sbreg_op(dhd, clockcontrolstatus, &clockcontrolstatus_val, FALSE);
+               }
+
+               if (MULTIBP_ENAB(dhd->bus->sih)) {
+                       /* Clear coherent bits for CA7 because CPU is halted */
+                       if (dhd->bus->coreid == ARMCA7_CORE_ID) {
+                               cfgval = dhdpcie_bus_cfg_read_dword(dhd->bus,
+                                       PCIE_CFG_SUBSYSTEM_CONTROL, 4);
+                               dhdpcie_bus_cfg_write_dword(dhd->bus, PCIE_CFG_SUBSYSTEM_CONTROL, 4,
+                                       (cfgval & ~PCIE_BARCOHERENTACCEN_MASK));
+                       }
+
+                       /* Just halt ARM but do not reset the core */
+                       resetctrl &= ~(SI_CORE_SIZE - 1);
+                       resetctrl += OFFSETOF(aidmp_t, ioctrl);
+
+                       dhd_sbreg_op(dhd, resetctrl, &val, TRUE);
+                       val |= SICF_CPUHALT;
+                       dhd_sbreg_op(dhd, resetctrl, &val, FALSE);
+               }
+       }
+
+       return BCME_OK;
+}
+
+static int
+dhdpcie_arm_resume_clk_req(dhd_pub_t *dhd)
+{
+       uint val = 0;
+       uint32 resetctrl;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       /* SSSR register information structure v0 and v1 shares most except dig_mem */
+       switch (dhd->sssr_reg_info->rev2.version) {
+               case SSSR_REG_INFO_VER_3 :
+                       /* intentional fall through */
+               case SSSR_REG_INFO_VER_2 :
+                       resetctrl = dhd->sssr_reg_info->rev2.
+                               arm_regs.wrapper_regs.resetctrl;
+                       break;
+               case SSSR_REG_INFO_VER_1 :
+               case SSSR_REG_INFO_VER_0 :
+                       resetctrl = dhd->sssr_reg_info->rev1.
+                               arm_regs.wrapper_regs.resetctrl;
+                       break;
+               default :
+                       DHD_ERROR(("invalid sssr_reg_ver"));
+                       return BCME_UNSUPPORTED;
+       }
+
+       /* Check if bit 0 of resetctrl is cleared */
+       dhd_sbreg_op(dhd, resetctrl, &val, TRUE);
+       if (!(val & 1)) {
+               if (MULTIBP_ENAB(dhd->bus->sih) && (dhd->bus->coreid != ARMCA7_CORE_ID)) {
+                       /* Take ARM out of halt but do not reset core */
+                       resetctrl &= ~(SI_CORE_SIZE - 1);
+                       resetctrl += OFFSETOF(aidmp_t, ioctrl);
+
+                       dhd_sbreg_op(dhd, resetctrl, &val, TRUE);
+                       val &= ~SICF_CPUHALT;
+                       dhd_sbreg_op(dhd, resetctrl, &val, FALSE);
+                       dhd_sbreg_op(dhd, resetctrl, &val, TRUE);
+               }
+       }
+
+       return BCME_OK;
+}
+
+static int
+dhdpcie_pcie_clear_clk_req(dhd_pub_t *dhd)
+{
+       uint val = 0;
+       uint32 clockrequeststatus, clockcontrolstatus_addr, clockcontrolstatus_val;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       /* SSSR register information structure v0 and v1 shares most except dig_mem */
+       switch (dhd->sssr_reg_info->rev2.version) {
+               case SSSR_REG_INFO_VER_3 :
+                       /* intentional fall through */
+               case SSSR_REG_INFO_VER_2 :
+                       clockrequeststatus = dhd->sssr_reg_info->rev2.
+                               pcie_regs.wrapper_regs.extrsrcreq;
+                       clockcontrolstatus_addr = dhd->sssr_reg_info->rev2.
+                               pcie_regs.base_regs.clockcontrolstatus;
+                       clockcontrolstatus_val = dhd->sssr_reg_info->rev2.
+                               pcie_regs.base_regs.clockcontrolstatus_val;
+                       break;
+               case SSSR_REG_INFO_VER_1 :
+               case SSSR_REG_INFO_VER_0 :
+                       clockrequeststatus = dhd->sssr_reg_info->rev1.
+                               pcie_regs.wrapper_regs.itopoobb;
+                       clockcontrolstatus_addr = dhd->sssr_reg_info->rev1.
+                               pcie_regs.base_regs.clockcontrolstatus;
+                       clockcontrolstatus_val = dhd->sssr_reg_info->rev1.
+                               pcie_regs.base_regs.clockcontrolstatus_val;
+                       break;
+               default :
+                       DHD_ERROR(("invalid sssr_reg_ver"));
+                       return BCME_UNSUPPORTED;
+       }
+
+       /* clear request clk only if itopoobb/extrsrcreqs is non zero */
+       dhd_sbreg_op(dhd, clockrequeststatus, &val, TRUE);
+       if (val) {
+               /* clear clockcontrolstatus */
+               dhd_sbreg_op(dhd, clockcontrolstatus_addr, &clockcontrolstatus_val, FALSE);
+       }
+       return BCME_OK;
+}
+
+static int
+dhdpcie_pcie_send_ltrsleep(dhd_pub_t *dhd)
+{
+       uint addr;
+       uint val = 0;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       /* SSSR register information structure v0 and v1 shares most except dig_mem */
+       switch (dhd->sssr_reg_info->rev2.version) {
+               case SSSR_REG_INFO_VER_3 :
+                       /* intentional fall through */
+               case SSSR_REG_INFO_VER_2 :
+                       addr = dhd->sssr_reg_info->rev2.pcie_regs.base_regs.ltrstate;
+                       break;
+               case SSSR_REG_INFO_VER_1 :
+               case SSSR_REG_INFO_VER_0 :
+                       addr = dhd->sssr_reg_info->rev1.pcie_regs.base_regs.ltrstate;
+                       break;
+               default :
+                       DHD_ERROR(("invalid sssr_reg_ver"));
+                       return BCME_UNSUPPORTED;
+       }
+
+       val = LTR_ACTIVE;
+       dhd_sbreg_op(dhd, addr, &val, FALSE);
+
+       val = LTR_SLEEP;
+       dhd_sbreg_op(dhd, addr, &val, FALSE);
+
+       return BCME_OK;
+}
+
+static int
+dhdpcie_clear_clk_req(dhd_pub_t *dhd)
+{
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       dhdpcie_arm_clear_clk_req(dhd);
+
+       dhdpcie_d11_clear_clk_req(dhd);
+
+       dhdpcie_pcie_clear_clk_req(dhd);
+
+       return BCME_OK;
+}
+
+static int
+dhdpcie_bring_d11_outofreset(dhd_pub_t *dhd)
+{
+       int i;
+       uint val = 0;
+       uint8 num_d11cores;
+       uint32 resetctrl_addr, ioctrl_addr, ioctrl_resetseq_val0, ioctrl_resetseq_val1,
+        ioctrl_resetseq_val2, ioctrl_resetseq_val3, ioctrl_resetseq_val4;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       num_d11cores = dhd_d11_slices_num_get(dhd);
+
+       for (i = 0; i < num_d11cores; i++) {
+               if (dhd->sssr_d11_outofreset[i]) {
+                       /* SSSR register information structure v0 and v1 shares
+                        * most except dig_mem
+                        */
+                       switch (dhd->sssr_reg_info->rev2.version) {
+                               case SSSR_REG_INFO_VER_3 :
+                                       /* intentional fall through */
+                               case SSSR_REG_INFO_VER_2 :
+                                       resetctrl_addr = dhd->sssr_reg_info->rev2.mac_regs[i].
+                                               wrapper_regs.resetctrl;
+                                       ioctrl_addr = dhd->sssr_reg_info->rev2.mac_regs[i].
+                                               wrapper_regs.ioctrl;
+                                       ioctrl_resetseq_val0 = dhd->sssr_reg_info->rev2.
+                                               mac_regs[0].wrapper_regs.ioctrl_resetseq_val[0];
+                                       ioctrl_resetseq_val1 = dhd->sssr_reg_info->rev2.
+                                               mac_regs[0].wrapper_regs.ioctrl_resetseq_val[1];
+                                       ioctrl_resetseq_val2 = dhd->sssr_reg_info->rev2.
+                                               mac_regs[0].wrapper_regs.ioctrl_resetseq_val[2];
+                                       ioctrl_resetseq_val3 = dhd->sssr_reg_info->rev2.
+                                               mac_regs[0].wrapper_regs.ioctrl_resetseq_val[3];
+                                       ioctrl_resetseq_val4 = dhd->sssr_reg_info->rev2.
+                                               mac_regs[0].wrapper_regs.ioctrl_resetseq_val[4];
+                                       break;
+                               case SSSR_REG_INFO_VER_1 :
+                               case SSSR_REG_INFO_VER_0 :
+                                       resetctrl_addr = dhd->sssr_reg_info->rev1.mac_regs[i].
+                                               wrapper_regs.resetctrl;
+                                       ioctrl_addr = dhd->sssr_reg_info->rev1.mac_regs[i].
+                                               wrapper_regs.ioctrl;
+                                       ioctrl_resetseq_val0 = dhd->sssr_reg_info->rev1.
+                                               mac_regs[0].wrapper_regs.ioctrl_resetseq_val[0];
+                                       ioctrl_resetseq_val1 = dhd->sssr_reg_info->rev1.
+                                               mac_regs[0].wrapper_regs.ioctrl_resetseq_val[1];
+                                       ioctrl_resetseq_val2 = dhd->sssr_reg_info->rev1.
+                                               mac_regs[0].wrapper_regs.ioctrl_resetseq_val[2];
+                                       ioctrl_resetseq_val3 = dhd->sssr_reg_info->rev1.
+                                               mac_regs[0].wrapper_regs.ioctrl_resetseq_val[3];
+                                       ioctrl_resetseq_val4 = dhd->sssr_reg_info->rev1.
+                                               mac_regs[0].wrapper_regs.ioctrl_resetseq_val[4];
+                                       break;
+                               default :
+                                       DHD_ERROR(("invalid sssr_reg_ver"));
+                                       return BCME_UNSUPPORTED;
+                       }
+                       /* disable core by setting bit 0 */
+                       val = 1;
+                       dhd_sbreg_op(dhd, resetctrl_addr, &val, FALSE);
+                       OSL_DELAY(6000);
+
+                       dhd_sbreg_op(dhd, ioctrl_addr, &ioctrl_resetseq_val0, FALSE);
+
+                       dhd_sbreg_op(dhd, ioctrl_addr, &ioctrl_resetseq_val1, FALSE);
+
+                       /* enable core by clearing bit 0 */
+                       val = 0;
+                       dhd_sbreg_op(dhd, resetctrl_addr, &val, FALSE);
+
+                       dhd_sbreg_op(dhd, ioctrl_addr, &ioctrl_resetseq_val2, FALSE);
+
+                       dhd_sbreg_op(dhd, ioctrl_addr, &ioctrl_resetseq_val3, FALSE);
+
+                       dhd_sbreg_op(dhd, ioctrl_addr, &ioctrl_resetseq_val4, FALSE);
+               }
+       }
+       return BCME_OK;
+}
+
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+static int
+dhdpcie_sssr_dump_get_before_sr(dhd_pub_t *dhd)
+{
+       int i;
+       uint32 sr_size, xmtaddress, xmtdata, dig_buf_size, dig_buf_addr;
+       uint8 num_d11cores;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       num_d11cores = dhd_d11_slices_num_get(dhd);
+
+       for (i = 0; i < num_d11cores; i++) {
+               if (dhd->sssr_d11_outofreset[i]) {
+                       sr_size = dhd_sssr_mac_buf_size(dhd, i);
+                       xmtaddress = dhd_sssr_mac_xmtaddress(dhd, i);
+                       xmtdata = dhd_sssr_mac_xmtdata(dhd, i);
+                       dhdpcie_get_sssr_fifo_dump(dhd, dhd->sssr_d11_before[i],
+                               sr_size, xmtaddress, xmtdata);
+               }
+       }
+
+       dig_buf_size = dhd_sssr_dig_buf_size(dhd);
+       dig_buf_addr = dhd_sssr_dig_buf_addr(dhd);
+       if (dig_buf_size) {
+               dhdpcie_get_sssr_dig_dump(dhd, dhd->sssr_dig_buf_before,
+                       dig_buf_size, dig_buf_addr);
+       }
+
+       return BCME_OK;
+}
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+static int
+dhdpcie_sssr_dump_get_after_sr(dhd_pub_t *dhd)
+{
+       int i;
+       uint32 sr_size, xmtaddress, xmtdata, dig_buf_size, dig_buf_addr;
+       uint8 num_d11cores;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       num_d11cores = dhd_d11_slices_num_get(dhd);
+
+       for (i = 0; i < num_d11cores; i++) {
+               if (dhd->sssr_d11_outofreset[i]) {
+                       sr_size = dhd_sssr_mac_buf_size(dhd, i);
+                       xmtaddress = dhd_sssr_mac_xmtaddress(dhd, i);
+                       xmtdata = dhd_sssr_mac_xmtdata(dhd, i);
+                       dhdpcie_get_sssr_fifo_dump(dhd, dhd->sssr_d11_after[i],
+                               sr_size, xmtaddress, xmtdata);
+               }
+       }
+
+       dig_buf_size = dhd_sssr_dig_buf_size(dhd);
+       dig_buf_addr = dhd_sssr_dig_buf_addr(dhd);
+
+       if (dig_buf_size) {
+               dhdpcie_get_sssr_dig_dump(dhd, dhd->sssr_dig_buf_after, dig_buf_size, dig_buf_addr);
+       }
+
+       return BCME_OK;
+}
+
+int
+dhdpcie_sssr_dump(dhd_pub_t *dhd)
+{
+       uint32 powerctrl_val;
+
+       if (!dhd->sssr_inited) {
+               DHD_ERROR(("%s: SSSR not inited\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (dhd->bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link is down\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       DHD_ERROR(("%s: Before WL down (powerctl: pcie:0x%x chipc:0x%x) "
+               "PMU rctl:0x%x res_state:0x%x\n", __FUNCTION__,
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                       OFFSETOF(chipcregs_t, powerctl), 0, 0),
+               si_corereg(dhd->bus->sih, 0, OFFSETOF(chipcregs_t, powerctl), 0, 0),
+               PMU_REG(dhd->bus->sih, retention_ctl, 0, 0),
+               PMU_REG(dhd->bus->sih, res_state, 0, 0)));
+
+       dhdpcie_d11_check_outofreset(dhd);
+
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+       DHD_ERROR(("%s: Collecting Dump before SR\n", __FUNCTION__));
+       if (dhdpcie_sssr_dump_get_before_sr(dhd) != BCME_OK) {
+               DHD_ERROR(("%s: dhdpcie_sssr_dump_get_before_sr failed\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+       dhdpcie_clear_intmask_and_timer(dhd);
+       dhdpcie_clear_clk_req(dhd);
+       powerctrl_val = dhdpcie_suspend_chipcommon_powerctrl(dhd);
+       dhdpcie_pcie_send_ltrsleep(dhd);
+
+       if (MULTIBP_ENAB(dhd->bus->sih)) {
+               dhd_bus_pcie_pwr_req_wl_domain(dhd->bus, OFFSETOF(chipcregs_t, powerctl), FALSE);
+       }
+
+       /* Wait for some time before Restore */
+       OSL_DELAY(6000);
+
+       DHD_ERROR(("%s: After WL down (powerctl: pcie:0x%x chipc:0x%x) "
+               "PMU rctl:0x%x res_state:0x%x\n", __FUNCTION__,
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                       OFFSETOF(chipcregs_t, powerctl), 0, 0),
+               si_corereg(dhd->bus->sih, 0, OFFSETOF(chipcregs_t, powerctl), 0, 0),
+               PMU_REG(dhd->bus->sih, retention_ctl, 0, 0),
+               PMU_REG(dhd->bus->sih, res_state, 0, 0)));
+
+       if (MULTIBP_ENAB(dhd->bus->sih)) {
+               dhd_bus_pcie_pwr_req_wl_domain(dhd->bus, OFFSETOF(chipcregs_t, powerctl), TRUE);
+               /* Add delay for WL domain to power up */
+               OSL_DELAY(15000);
+
+               DHD_ERROR(("%s: After WL up again (powerctl: pcie:0x%x chipc:0x%x) "
+                       "PMU rctl:0x%x res_state:0x%x\n", __FUNCTION__,
+                       si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                               OFFSETOF(chipcregs_t, powerctl), 0, 0),
+                       si_corereg(dhd->bus->sih, 0, OFFSETOF(chipcregs_t, powerctl), 0, 0),
+                       PMU_REG(dhd->bus->sih, retention_ctl, 0, 0),
+                       PMU_REG(dhd->bus->sih, res_state, 0, 0)));
+       }
+
+       dhdpcie_resume_chipcommon_powerctrl(dhd, powerctrl_val);
+       dhdpcie_arm_resume_clk_req(dhd);
+       dhdpcie_bring_d11_outofreset(dhd);
+
+       DHD_ERROR(("%s: Collecting Dump after SR\n", __FUNCTION__));
+       if (dhdpcie_sssr_dump_get_after_sr(dhd) != BCME_OK) {
+               DHD_ERROR(("%s: dhdpcie_sssr_dump_get_after_sr failed\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+       dhd->sssr_dump_collected = TRUE;
+       dhd_write_sssr_dump(dhd, SSSR_DUMP_MODE_SSSR);
+
+       return BCME_OK;
+}
+
+#define PCIE_CFG_DSTATE_MASK   0x11u
+
+static int
+dhdpcie_fis_trigger(dhd_pub_t *dhd)
+{
+       uint32 fis_ctrl_status;
+       uint32 cfg_status_cmd;
+       uint32 cfg_pmcsr;
+
+       if (!dhd->sssr_inited) {
+               DHD_ERROR(("%s: SSSR not inited\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (dhd->bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link is down\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       /* Bring back to D0 */
+       dhdpcie_runtime_bus_wake(dhd, CAN_SLEEP(), __builtin_return_address(0));
+       /* Stop RPM timer so that even INB DW DEASSERT should not happen */
+       DHD_STOP_RPM_TIMER(dhd);
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       /* Set fis_triggered flag to ignore link down callback from RC */
+       dhd->fis_triggered = TRUE;
+
+       /* Set FIS PwrswForceOnAll */
+       PMU_REG(dhd->bus->sih, fis_ctrl_status, PMU_FIS_FORCEON_ALL_MASK, PMU_FIS_FORCEON_ALL_MASK);
+
+       fis_ctrl_status = PMU_REG(dhd->bus->sih, fis_ctrl_status, 0, 0);
+
+       DHD_ERROR(("%s: fis_ctrl_status=0x%x\n", __FUNCTION__, fis_ctrl_status));
+
+       cfg_status_cmd = dhd_pcie_config_read(dhd->bus, PCIECFGREG_STATUS_CMD, sizeof(uint32));
+       cfg_pmcsr = dhd_pcie_config_read(dhd->bus, PCIE_CFG_PMCSR, sizeof(uint32));
+       DHD_ERROR(("before save: Status Command(0x%x)=0x%x PCIE_CFG_PMCSR(0x%x)=0x%x\n",
+               PCIECFGREG_STATUS_CMD, cfg_status_cmd, PCIE_CFG_PMCSR, cfg_pmcsr));
+
+       DHD_PCIE_CONFIG_SAVE(dhd->bus);
+
+       /* Trigger FIS */
+       si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+               DAR_FIS_CTRL(dhd->bus->sih->buscorerev), ~0, DAR_FIS_START_MASK);
+       OSL_DELAY(100 * 1000);
+
+       /*
+        * For android built-in platforms need to perform REG ON/OFF
+        * to restore pcie link.
+        * dhd_download_fw_on_driverload will be FALSE for built-in.
+        */
+       if (!dhd_download_fw_on_driverload) {
+               DHD_ERROR(("%s: Toggle REG_ON and restore config space\n", __FUNCTION__));
+               dhdpcie_bus_stop_host_dev(dhd->bus);
+               dhd_wifi_platform_set_power(dhd, FALSE);
+               dhd_wifi_platform_set_power(dhd, TRUE);
+               dhdpcie_bus_start_host_dev(dhd->bus);
+               /* Restore inited pcie cfg from pci_load_saved_state */
+               dhdpcie_bus_enable_device(dhd->bus);
+       }
+
+       cfg_status_cmd = dhd_pcie_config_read(dhd->bus, PCIECFGREG_STATUS_CMD, sizeof(uint32));
+       cfg_pmcsr = dhd_pcie_config_read(dhd->bus, PCIE_CFG_PMCSR, sizeof(uint32));
+       DHD_ERROR(("after regon-restore: Status Command(0x%x)=0x%x PCIE_CFG_PMCSR(0x%x)=0x%x\n",
+               PCIECFGREG_STATUS_CMD, cfg_status_cmd, PCIE_CFG_PMCSR, cfg_pmcsr));
+
+       /* To-Do: below is debug code, remove this if EP is in D0 after REG-ON restore */
+       DHD_PCIE_CONFIG_RESTORE(dhd->bus);
+
+       cfg_status_cmd = dhd_pcie_config_read(dhd->bus, PCIECFGREG_STATUS_CMD, sizeof(uint32));
+       cfg_pmcsr = dhd_pcie_config_read(dhd->bus, PCIE_CFG_PMCSR, sizeof(uint32));
+       DHD_ERROR(("after normal-restore: Status Command(0x%x)=0x%x PCIE_CFG_PMCSR(0x%x)=0x%x\n",
+               PCIECFGREG_STATUS_CMD, cfg_status_cmd, PCIE_CFG_PMCSR, cfg_pmcsr));
+
+       /*
+        * To-Do: below is debug code, remove this if EP is in D0 after REG-ON restore
+        * in both MSM and LSI RCs
+        */
+       if ((cfg_pmcsr & PCIE_CFG_DSTATE_MASK) != 0) {
+               int ret = dhdpcie_set_master_and_d0_pwrstate(dhd->bus);
+               if (ret != BCME_OK) {
+                       DHD_ERROR(("%s: Setting D0 failed, ABORT FIS collection\n", __FUNCTION__));
+                       return ret;
+               }
+               cfg_status_cmd =
+                       dhd_pcie_config_read(dhd->bus, PCIECFGREG_STATUS_CMD, sizeof(uint32));
+               cfg_pmcsr = dhd_pcie_config_read(dhd->bus, PCIE_CFG_PMCSR, sizeof(uint32));
+               DHD_ERROR(("after force-d0: Status Command(0x%x)=0x%x PCIE_CFG_PMCSR(0x%x)=0x%x\n",
+                       PCIECFGREG_STATUS_CMD, cfg_status_cmd, PCIE_CFG_PMCSR, cfg_pmcsr));
+       }
+
+       /* Clear fis_triggered as REG OFF/ON recovered link */
+       dhd->fis_triggered = FALSE;
+
+       return BCME_OK;
+}
+
+int
+dhd_bus_fis_trigger(dhd_pub_t *dhd)
+{
+       return dhdpcie_fis_trigger(dhd);
+}
+
+static int
+dhdpcie_reset_hwa(dhd_pub_t *dhd)
+{
+       int ret;
+       sssr_reg_info_cmn_t *sssr_reg_info_cmn = dhd->sssr_reg_info;
+       sssr_reg_info_v3_t *sssr_reg_info = (sssr_reg_info_v3_t *)&sssr_reg_info_cmn->rev3;
+
+       /* HWA wrapper registers */
+       uint32 ioctrl, resetctrl;
+       /* HWA base registers */
+       uint32 clkenable, clkgatingenable, clkext, clkctlstatus;
+       uint32 hwa_resetseq_val[SSSR_HWA_RESET_SEQ_STEPS];
+       int i = 0;
+
+       if (sssr_reg_info->version < SSSR_REG_INFO_VER_3) {
+               DHD_ERROR(("%s: not supported for version:%d\n",
+                       __FUNCTION__, sssr_reg_info->version));
+               return BCME_UNSUPPORTED;
+       }
+
+       if (sssr_reg_info->hwa_regs.base_regs.clkenable == 0) {
+               DHD_ERROR(("%s: hwa regs are not set\n", __FUNCTION__));
+               return BCME_UNSUPPORTED;
+       }
+
+       DHD_ERROR(("%s: version:%d\n", __FUNCTION__, sssr_reg_info->version));
+
+       ioctrl = sssr_reg_info->hwa_regs.wrapper_regs.ioctrl;
+       resetctrl = sssr_reg_info->hwa_regs.wrapper_regs.resetctrl;
+
+       clkenable = sssr_reg_info->hwa_regs.base_regs.clkenable;
+       clkgatingenable = sssr_reg_info->hwa_regs.base_regs.clkgatingenable;
+       clkext = sssr_reg_info->hwa_regs.base_regs.clkext;
+       clkctlstatus = sssr_reg_info->hwa_regs.base_regs.clkctlstatus;
+
+       ret = memcpy_s(hwa_resetseq_val, sizeof(hwa_resetseq_val),
+               sssr_reg_info->hwa_regs.hwa_resetseq_val,
+               sizeof(sssr_reg_info->hwa_regs.hwa_resetseq_val));
+       if (ret) {
+               DHD_ERROR(("%s: hwa_resetseq_val memcpy_s failed: %d\n",
+                       __FUNCTION__, ret));
+               return ret;
+       }
+
+       dhd_sbreg_op(dhd, ioctrl, &hwa_resetseq_val[i++], FALSE);
+       dhd_sbreg_op(dhd, resetctrl, &hwa_resetseq_val[i++], FALSE);
+       dhd_sbreg_op(dhd, resetctrl, &hwa_resetseq_val[i++], FALSE);
+       dhd_sbreg_op(dhd, ioctrl, &hwa_resetseq_val[i++], FALSE);
+
+       dhd_sbreg_op(dhd, clkenable, &hwa_resetseq_val[i++], FALSE);
+       dhd_sbreg_op(dhd, clkgatingenable, &hwa_resetseq_val[i++], FALSE);
+       dhd_sbreg_op(dhd, clkext, &hwa_resetseq_val[i++], FALSE);
+       dhd_sbreg_op(dhd, clkctlstatus, &hwa_resetseq_val[i++], FALSE);
+
+       return BCME_OK;
+}
+
+static int
+dhdpcie_fis_dump(dhd_pub_t *dhd)
+{
+       int i;
+       uint8 num_d11cores;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+
+       if (!dhd->sssr_inited) {
+               DHD_ERROR(("%s: SSSR not inited\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (dhd->bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link is down\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       /* bring up all pmu resources */
+       PMU_REG(dhd->bus->sih, min_res_mask, ~0,
+               PMU_REG(dhd->bus->sih, max_res_mask, 0, 0));
+       OSL_DELAY(10 * 1000);
+
+       num_d11cores = dhd_d11_slices_num_get(dhd);
+
+       for (i = 0; i < num_d11cores; i++) {
+               dhd->sssr_d11_outofreset[i] = TRUE;
+       }
+
+       dhdpcie_bring_d11_outofreset(dhd);
+       OSL_DELAY(6000);
+
+       /* clear FIS Done */
+       PMU_REG(dhd->bus->sih, fis_ctrl_status, PMU_CLEAR_FIS_DONE_MASK, PMU_CLEAR_FIS_DONE_MASK);
+
+       if (dhdpcie_reset_hwa(dhd) != BCME_OK) {
+               DHD_ERROR(("%s: dhdpcie_reset_hwa failed\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       dhdpcie_d11_check_outofreset(dhd);
+
+       DHD_ERROR(("%s: Collecting Dump after SR\n", __FUNCTION__));
+       if (dhdpcie_sssr_dump_get_after_sr(dhd) != BCME_OK) {
+               DHD_ERROR(("%s: dhdpcie_sssr_dump_get_after_sr failed\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+       dhd->sssr_dump_collected = TRUE;
+       dhd_write_sssr_dump(dhd, SSSR_DUMP_MODE_FIS);
+
+       return BCME_OK;
+}
+
+int
+dhd_bus_fis_dump(dhd_pub_t *dhd)
+{
+       return dhdpcie_fis_dump(dhd);
+}
+#endif /* DHD_SSSR_DUMP */
+
+#ifdef DHD_SDTC_ETB_DUMP
+int
+dhd_bus_get_etb_info(dhd_pub_t *dhd, uint32 etbinfo_addr, etb_info_t *etb_info)
+{
+
+       int ret = 0;
+
+       if ((ret = dhdpcie_bus_membytes(dhd->bus, FALSE, etbinfo_addr,
+               (unsigned char *)etb_info, sizeof(*etb_info)))) {
+               DHD_ERROR(("%s: Read Error membytes %d\n", __FUNCTION__, ret));
+               return BCME_ERROR;
+       }
+
+       return BCME_OK;
+}
+
+int
+dhd_bus_get_sdtc_etb(dhd_pub_t *dhd, uint8 *sdtc_etb_mempool, uint addr, uint read_bytes)
+{
+       int ret = 0;
+
+       if ((ret = dhdpcie_bus_membytes(dhd->bus, FALSE, addr,
+               (unsigned char *)sdtc_etb_mempool, read_bytes))) {
+               DHD_ERROR(("%s: Read Error membytes %d\n", __FUNCTION__, ret));
+               return BCME_ERROR;
+       }
+       return BCME_OK;
+}
+#endif /* DHD_SDTC_ETB_DUMP */
+
+#ifdef DHD_WAKE_STATUS
+wake_counts_t*
+dhd_bus_get_wakecount(dhd_pub_t *dhd)
+{
+       return &dhd->bus->wake_counts;
+}
+int
+dhd_bus_get_bus_wake(dhd_pub_t *dhd)
+{
+       return bcmpcie_set_get_wake(dhd->bus, 0);
+}
+#endif /* DHD_WAKE_STATUS */
+
+/* Writes random number(s) to the TCM. FW upon initialization reads this register
+ * to fetch the random number, and uses it to randomize heap address space layout.
+ */
+static int
+dhdpcie_wrt_rnd(struct dhd_bus *bus)
+{
+       bcm_rand_metadata_t rnd_data;
+       uint8 rand_buf[BCM_ENTROPY_HOST_NBYTES];
+       uint32 count = BCM_ENTROPY_HOST_NBYTES;
+       int ret = 0;
+       uint32 addr = bus->dongle_ram_base + (bus->ramsize - BCM_NVRAM_OFFSET_TCM) -
+               ((bus->nvram_csm & 0xffff)* BCM_NVRAM_IMG_COMPRS_FACTOR + sizeof(rnd_data));
+
+       memset(rand_buf, 0, BCM_ENTROPY_HOST_NBYTES);
+       rnd_data.signature = htol32(BCM_NVRAM_RNG_SIGNATURE);
+       rnd_data.count = htol32(count);
+       /* write the metadata about random number */
+       dhdpcie_bus_membytes(bus, TRUE, addr, (uint8 *)&rnd_data, sizeof(rnd_data));
+       /* scale back by number of random number counts */
+       addr -= count;
+
+       bus->ramtop_addr = addr;
+
+       /* Now write the random number(s) */
+       ret = dhd_get_random_bytes(rand_buf, count);
+       if (ret != BCME_OK) {
+               return ret;
+       }
+       dhdpcie_bus_membytes(bus, TRUE, addr, rand_buf, count);
+
+       bus->next_tlv = addr;
+
+       return BCME_OK;
+}
+
+void
+dhd_pcie_intr_count_dump(dhd_pub_t *dhd)
+{
+       struct dhd_bus *bus = dhd->bus;
+       uint64 current_time;
+
+       DHD_ERROR(("\n ------- DUMPING INTR enable/disable counters  ------- \r\n"));
+       DHD_ERROR(("resume_intr_enable_count=%lu dpc_intr_enable_count=%lu\n",
+               bus->resume_intr_enable_count, bus->dpc_intr_enable_count));
+       DHD_ERROR(("isr_intr_disable_count=%lu suspend_intr_disable_count=%lu\n",
+               bus->isr_intr_disable_count, bus->suspend_intr_disable_count));
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       DHD_ERROR(("oob_intr_count=%lu oob_intr_enable_count=%lu oob_intr_disable_count=%lu\n",
+               bus->oob_intr_count, bus->oob_intr_enable_count,
+               bus->oob_intr_disable_count));
+       DHD_ERROR(("oob_irq_num=%d last_oob_irq_times="SEC_USEC_FMT":"SEC_USEC_FMT"\n",
+               dhdpcie_get_oob_irq_num(bus),
+               GET_SEC_USEC(bus->last_oob_irq_isr_time),
+               GET_SEC_USEC(bus->last_oob_irq_thr_time)));
+       DHD_ERROR(("last_oob_irq_enable_time="SEC_USEC_FMT
+               " last_oob_irq_disable_time="SEC_USEC_FMT"\n",
+               GET_SEC_USEC(bus->last_oob_irq_enable_time),
+               GET_SEC_USEC(bus->last_oob_irq_disable_time)));
+       DHD_ERROR(("oob_irq_enabled=%d oob_gpio_level=%d\n",
+               dhdpcie_get_oob_irq_status(bus),
+               dhdpcie_get_oob_irq_level()));
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+       DHD_ERROR(("dpc_return_busdown_count=%lu non_ours_irq_count=%lu\n",
+               bus->dpc_return_busdown_count, bus->non_ours_irq_count));
+
+       current_time = OSL_LOCALTIME_NS();
+       DHD_ERROR(("\ncurrent_time="SEC_USEC_FMT"\n",
+               GET_SEC_USEC(current_time)));
+       DHD_ERROR(("isr_entry_time="SEC_USEC_FMT
+               " isr_exit_time="SEC_USEC_FMT"\n",
+               GET_SEC_USEC(bus->isr_entry_time),
+               GET_SEC_USEC(bus->isr_exit_time)));
+       DHD_ERROR(("isr_sched_dpc_time="SEC_USEC_FMT
+               " rpm_sched_dpc_time="SEC_USEC_FMT
+               " last_non_ours_irq_time="SEC_USEC_FMT"\n",
+               GET_SEC_USEC(bus->isr_sched_dpc_time),
+               GET_SEC_USEC(bus->rpm_sched_dpc_time),
+               GET_SEC_USEC(bus->last_non_ours_irq_time)));
+       DHD_ERROR(("dpc_entry_time="SEC_USEC_FMT
+               " last_process_ctrlbuf_time="SEC_USEC_FMT"\n",
+               GET_SEC_USEC(bus->dpc_entry_time),
+               GET_SEC_USEC(bus->last_process_ctrlbuf_time)));
+       DHD_ERROR(("last_process_flowring_time="SEC_USEC_FMT
+               " last_process_txcpl_time="SEC_USEC_FMT"\n",
+               GET_SEC_USEC(bus->last_process_flowring_time),
+               GET_SEC_USEC(bus->last_process_txcpl_time)));
+       DHD_ERROR(("last_process_rxcpl_time="SEC_USEC_FMT
+               " last_process_infocpl_time="SEC_USEC_FMT
+               " last_process_edl_time="SEC_USEC_FMT"\n",
+               GET_SEC_USEC(bus->last_process_rxcpl_time),
+               GET_SEC_USEC(bus->last_process_infocpl_time),
+               GET_SEC_USEC(bus->last_process_edl_time)));
+       DHD_ERROR(("dpc_exit_time="SEC_USEC_FMT
+               " resched_dpc_time="SEC_USEC_FMT"\n",
+               GET_SEC_USEC(bus->dpc_exit_time),
+               GET_SEC_USEC(bus->resched_dpc_time)));
+       DHD_ERROR(("last_d3_inform_time="SEC_USEC_FMT"\n",
+               GET_SEC_USEC(bus->last_d3_inform_time)));
+
+       DHD_ERROR(("\nlast_suspend_start_time="SEC_USEC_FMT
+               " last_suspend_end_time="SEC_USEC_FMT"\n",
+               GET_SEC_USEC(bus->last_suspend_start_time),
+               GET_SEC_USEC(bus->last_suspend_end_time)));
+       DHD_ERROR(("last_resume_start_time="SEC_USEC_FMT
+               " last_resume_end_time="SEC_USEC_FMT"\n",
+               GET_SEC_USEC(bus->last_resume_start_time),
+               GET_SEC_USEC(bus->last_resume_end_time)));
+
+#if defined(SHOW_LOGTRACE) && defined(DHD_USE_KTHREAD_FOR_LOGTRACE)
+       DHD_ERROR(("logtrace_thread_entry_time="SEC_USEC_FMT
+               " logtrace_thread_sem_down_time="SEC_USEC_FMT
+               "\nlogtrace_thread_flush_time="SEC_USEC_FMT
+               " logtrace_thread_unexpected_break_time="SEC_USEC_FMT
+               "\nlogtrace_thread_complete_time="SEC_USEC_FMT"\n",
+               GET_SEC_USEC(dhd->logtrace_thr_ts.entry_time),
+               GET_SEC_USEC(dhd->logtrace_thr_ts.sem_down_time),
+               GET_SEC_USEC(dhd->logtrace_thr_ts.flush_time),
+               GET_SEC_USEC(dhd->logtrace_thr_ts.unexpected_break_time),
+               GET_SEC_USEC(dhd->logtrace_thr_ts.complete_time)));
+#endif /* SHOW_LOGTRACE && DHD_USE_KTHREAD_FOR_LOGTRACE */
+}
+
+void
+dhd_bus_intr_count_dump(dhd_pub_t *dhd)
+{
+       dhd_pcie_intr_count_dump(dhd);
+}
+
+int
+dhd_pcie_dump_wrapper_regs(dhd_pub_t *dhd)
+{
+       uint32 save_idx, val;
+       si_t *sih = dhd->bus->sih;
+       uint32 oob_base, oob_base1;
+       uint32 wrapper_dump_list[] = {
+               AI_OOBSELOUTA30, AI_OOBSELOUTA74, AI_OOBSELOUTB30, AI_OOBSELOUTB74,
+               AI_OOBSELOUTC30, AI_OOBSELOUTC74, AI_OOBSELOUTD30, AI_OOBSELOUTD74,
+               AI_RESETSTATUS, AI_RESETCTRL,
+               AI_ITIPOOBA, AI_ITIPOOBB, AI_ITIPOOBC, AI_ITIPOOBD,
+               AI_ITIPOOBAOUT, AI_ITIPOOBBOUT, AI_ITIPOOBCOUT, AI_ITIPOOBDOUT
+       };
+       uint32 i;
+       hndoobr_reg_t *reg;
+       cr4regs_t *cr4regs;
+       ca7regs_t *ca7regs;
+
+       save_idx = si_coreidx(sih);
+
+       DHD_ERROR(("%s: Master wrapper Reg\n", __FUNCTION__));
+
+       if (si_setcore(sih, PCIE2_CORE_ID, 0) != NULL) {
+               for (i = 0; i < (uint32)sizeof(wrapper_dump_list) / 4; i++) {
+                       val = si_wrapperreg(sih, wrapper_dump_list[i], 0, 0);
+                       DHD_ERROR(("sbreg: addr:0x%x val:0x%x\n", wrapper_dump_list[i], val));
+               }
+       }
+
+       if ((cr4regs = si_setcore(sih, ARMCR4_CORE_ID, 0)) != NULL) {
+               DHD_ERROR(("%s: ARM CR4 wrapper Reg\n", __FUNCTION__));
+               for (i = 0; i < (uint32)sizeof(wrapper_dump_list) / 4; i++) {
+                       val = si_wrapperreg(sih, wrapper_dump_list[i], 0, 0);
+                       DHD_ERROR(("sbreg: addr:0x%x val:0x%x\n", wrapper_dump_list[i], val));
+               }
+               DHD_ERROR(("%s: ARM CR4 core Reg\n", __FUNCTION__));
+               val = R_REG(dhd->osh, ARM_CR4_REG(cr4regs, corecontrol));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(cr4regs_t, corecontrol), val));
+               val = R_REG(dhd->osh, ARM_CR4_REG(cr4regs, corecapabilities));
+               DHD_ERROR(("reg:0x%x val:0x%x\n",
+                       (uint)OFFSETOF(cr4regs_t, corecapabilities), val));
+               val = R_REG(dhd->osh, ARM_CR4_REG(cr4regs, corestatus));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(cr4regs_t, corestatus), val));
+               val = R_REG(dhd->osh, ARM_CR4_REG(cr4regs, nmiisrst));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(cr4regs_t, nmiisrst), val));
+               val = R_REG(dhd->osh, ARM_CR4_REG(cr4regs, nmimask));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(cr4regs_t, nmimask), val));
+               val = R_REG(dhd->osh, ARM_CR4_REG(cr4regs, isrmask));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(cr4regs_t, isrmask), val));
+               val = R_REG(dhd->osh, ARM_CR4_REG(cr4regs, swintreg));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(cr4regs_t, swintreg), val));
+               val = R_REG(dhd->osh, ARM_CR4_REG(cr4regs, intstatus));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(cr4regs_t, intstatus), val));
+               val = R_REG(dhd->osh, ARM_CR4_REG(cr4regs, cyclecnt));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(cr4regs_t, cyclecnt), val));
+               val = R_REG(dhd->osh, ARM_CR4_REG(cr4regs, inttimer));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(cr4regs_t, inttimer), val));
+               val = R_REG(dhd->osh, ARM_CR4_REG(cr4regs, clk_ctl_st));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(cr4regs_t, clk_ctl_st), val));
+               val = R_REG(dhd->osh, ARM_CR4_REG(cr4regs, powerctl));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(cr4regs_t, powerctl), val));
+       }
+       /* XXX: Currently dumping CA7 registers causing CTO, temporarily disabling it */
+       BCM_REFERENCE(ca7regs);
+#ifdef NOT_YET
+       if ((ca7regs = si_setcore(sih, ARMCA7_CORE_ID, 0)) != NULL) {
+               DHD_ERROR(("%s: ARM CA7 core Reg\n", __FUNCTION__));
+               val = R_REG(dhd->osh, ARM_CA7_REG(ca7regs, corecontrol));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(ca7regs_t, corecontrol), val));
+               val = R_REG(dhd->osh, ARM_CA7_REG(ca7regs, corecapabilities));
+               DHD_ERROR(("reg:0x%x val:0x%x\n",
+                       (uint)OFFSETOF(ca7regs_t, corecapabilities), val));
+               val = R_REG(dhd->osh, ARM_CA7_REG(ca7regs, corestatus));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(ca7regs_t, corestatus), val));
+               val = R_REG(dhd->osh, ARM_CA7_REG(ca7regs, tracecontrol));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(ca7regs_t, tracecontrol), val));
+               val = R_REG(dhd->osh, ARM_CA7_REG(ca7regs, clk_ctl_st));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(ca7regs_t, clk_ctl_st), val));
+               val = R_REG(dhd->osh, ARM_CA7_REG(ca7regs, powerctl));
+               DHD_ERROR(("reg:0x%x val:0x%x\n", (uint)OFFSETOF(ca7regs_t, powerctl), val));
+       }
+#endif /* NOT_YET */
+
+       DHD_ERROR(("%s: OOBR Reg\n", __FUNCTION__));
+
+       oob_base = si_oobr_baseaddr(sih, FALSE);
+       oob_base1 = si_oobr_baseaddr(sih, TRUE);
+       if (oob_base) {
+               dhd_sbreg_op(dhd, oob_base + OOB_STATUSA, &val, TRUE);
+               dhd_sbreg_op(dhd, oob_base + OOB_STATUSB, &val, TRUE);
+               dhd_sbreg_op(dhd, oob_base + OOB_STATUSC, &val, TRUE);
+               dhd_sbreg_op(dhd, oob_base + OOB_STATUSD, &val, TRUE);
+       } else if ((reg = si_setcore(sih, HND_OOBR_CORE_ID, 0)) != NULL) {
+               val = R_REG(dhd->osh, &reg->intstatus[0]);
+               DHD_ERROR(("reg: addr:%p val:0x%x\n", reg, val));
+               val = R_REG(dhd->osh, &reg->intstatus[1]);
+               DHD_ERROR(("reg: addr:%p val:0x%x\n", reg, val));
+               val = R_REG(dhd->osh, &reg->intstatus[2]);
+               DHD_ERROR(("reg: addr:%p val:0x%x\n", reg, val));
+               val = R_REG(dhd->osh, &reg->intstatus[3]);
+               DHD_ERROR(("reg: addr:%p val:0x%x\n", reg, val));
+       }
+
+       if (oob_base1) {
+               DHD_ERROR(("%s: Second OOBR Reg\n", __FUNCTION__));
+
+               dhd_sbreg_op(dhd, oob_base1 + OOB_STATUSA, &val, TRUE);
+               dhd_sbreg_op(dhd, oob_base1 + OOB_STATUSB, &val, TRUE);
+               dhd_sbreg_op(dhd, oob_base1 + OOB_STATUSC, &val, TRUE);
+               dhd_sbreg_op(dhd, oob_base1 + OOB_STATUSD, &val, TRUE);
+       }
+
+       si_setcoreidx(dhd->bus->sih, save_idx);
+
+       return 0;
+}
+
+static void
+dhdpcie_hw_war_regdump(dhd_bus_t *bus)
+{
+       uint32 save_idx, val;
+       volatile uint32 *reg;
+
+       save_idx = si_coreidx(bus->sih);
+       if ((reg = si_setcore(bus->sih, CC_CORE_ID, 0)) != NULL) {
+               val = R_REG(bus->osh, reg + REG_WORK_AROUND);
+               DHD_ERROR(("CC HW_WAR :0x%x\n", val));
+       }
+
+       if ((reg = si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) != NULL) {
+               val = R_REG(bus->osh, reg + REG_WORK_AROUND);
+               DHD_ERROR(("ARM HW_WAR:0x%x\n", val));
+       }
+
+       if ((reg = si_setcore(bus->sih, PCIE2_CORE_ID, 0)) != NULL) {
+               val = R_REG(bus->osh, reg + REG_WORK_AROUND);
+               DHD_ERROR(("PCIE HW_WAR :0x%x\n", val));
+       }
+       si_setcoreidx(bus->sih, save_idx);
+
+       val = PMU_REG_NEW(bus->sih, min_res_mask, 0, 0);
+       DHD_ERROR(("MINRESMASK :0x%x\n", val));
+}
+
+int
+dhd_pcie_dma_info_dump(dhd_pub_t *dhd)
+{
+       if (dhd->bus->is_linkdown) {
+               DHD_ERROR(("\n ------- SKIP DUMPING DMA Registers "
+                       "due to PCIe link down ------- \r\n"));
+               return 0;
+       }
+
+       DHD_ERROR(("\n ------- DUMPING DMA Registers ------- \r\n"));
+
+       //HostToDev
+       DHD_ERROR(("HostToDev TX: XmtCtrl=0x%08x XmtPtr=0x%08x\n",
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x200, 0, 0),
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x204, 0, 0)));
+       DHD_ERROR(("            : XmtAddrLow=0x%08x XmtAddrHigh=0x%08x\n",
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x208, 0, 0),
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x20C, 0, 0)));
+       DHD_ERROR(("            : XmtStatus0=0x%08x XmtStatus1=0x%08x\n",
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x210, 0, 0),
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x214, 0, 0)));
+
+       DHD_ERROR(("HostToDev RX: RcvCtrl=0x%08x RcvPtr=0x%08x\n",
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x220, 0, 0),
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x224, 0, 0)));
+       DHD_ERROR(("            : RcvAddrLow=0x%08x RcvAddrHigh=0x%08x\n",
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x228, 0, 0),
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x22C, 0, 0)));
+       DHD_ERROR(("            : RcvStatus0=0x%08x RcvStatus1=0x%08x\n",
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x230, 0, 0),
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x234, 0, 0)));
+
+       //DevToHost
+       DHD_ERROR(("DevToHost TX: XmtCtrl=0x%08x XmtPtr=0x%08x\n",
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x240, 0, 0),
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x244, 0, 0)));
+       DHD_ERROR(("            : XmtAddrLow=0x%08x XmtAddrHigh=0x%08x\n",
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x248, 0, 0),
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x24C, 0, 0)));
+       DHD_ERROR(("            : XmtStatus0=0x%08x XmtStatus1=0x%08x\n",
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x250, 0, 0),
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x254, 0, 0)));
+
+       DHD_ERROR(("DevToHost RX: RcvCtrl=0x%08x RcvPtr=0x%08x\n",
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x260, 0, 0),
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x264, 0, 0)));
+       DHD_ERROR(("            : RcvAddrLow=0x%08x RcvAddrHigh=0x%08x\n",
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x268, 0, 0),
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x26C, 0, 0)));
+       DHD_ERROR(("            : RcvStatus0=0x%08x RcvStatus1=0x%08x\n",
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x270, 0, 0),
+               si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, 0x274, 0, 0)));
+
+       return 0;
+}
+
+bool
+dhd_pcie_dump_int_regs(dhd_pub_t *dhd)
+{
+       uint32 intstatus = 0;
+       uint32 intmask = 0;
+       uint32 d2h_db0 = 0;
+       uint32 d2h_mb_data = 0;
+
+       DHD_ERROR(("\n ------- DUMPING INTR Status and Masks ------- \r\n"));
+       intstatus = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+               dhd->bus->pcie_mailbox_int, 0, 0);
+       if (intstatus == (uint32)-1) {
+               DHD_ERROR(("intstatus=0x%x \n", intstatus));
+               return FALSE;
+       }
+
+       intmask = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+               dhd->bus->pcie_mailbox_mask, 0, 0);
+       if (intmask == (uint32) -1) {
+               DHD_ERROR(("intstatus=0x%x intmask=0x%x \n", intstatus, intmask));
+               return FALSE;
+       }
+
+       d2h_db0 = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+               PCID2H_MailBox, 0, 0);
+       if (d2h_db0 == (uint32)-1) {
+               DHD_ERROR(("intstatus=0x%x intmask=0x%x d2h_db0=0x%x\n",
+               intstatus, intmask, d2h_db0));
+               return FALSE;
+       }
+
+       DHD_ERROR(("intstatus=0x%x intmask=0x%x d2h_db0=0x%x\n",
+               intstatus, intmask, d2h_db0));
+       dhd_bus_cmn_readshared(dhd->bus, &d2h_mb_data, D2H_MB_DATA, 0);
+       DHD_ERROR(("d2h_mb_data=0x%x def_intmask=0x%x \r\n", d2h_mb_data,
+               dhd->bus->def_intmask));
+
+       return TRUE;
+}
+
+void
+dhd_pcie_dump_rc_conf_space_cap(dhd_pub_t *dhd)
+{
+       DHD_ERROR(("\n ------- DUMPING PCIE RC config space Registers ------- \r\n"));
+       DHD_ERROR(("Pcie RC Uncorrectable Error Status Val=0x%x\n",
+               dhdpcie_rc_access_cap(dhd->bus, PCIE_EXTCAP_ID_ERR,
+               PCIE_EXTCAP_AER_UCERR_OFFSET, TRUE, FALSE, 0)));
+#ifdef EXTENDED_PCIE_DEBUG_DUMP
+       DHD_ERROR(("hdrlog0 =0x%08x hdrlog1 =0x%08x hdrlog2 =0x%08x hdrlog3 =0x%08x\n",
+               dhdpcie_rc_access_cap(dhd->bus, PCIE_EXTCAP_ID_ERR,
+               PCIE_EXTCAP_ERR_HEADER_LOG_0, TRUE, FALSE, 0),
+               dhdpcie_rc_access_cap(dhd->bus, PCIE_EXTCAP_ID_ERR,
+               PCIE_EXTCAP_ERR_HEADER_LOG_1, TRUE, FALSE, 0),
+               dhdpcie_rc_access_cap(dhd->bus, PCIE_EXTCAP_ID_ERR,
+               PCIE_EXTCAP_ERR_HEADER_LOG_2, TRUE, FALSE, 0),
+               dhdpcie_rc_access_cap(dhd->bus, PCIE_EXTCAP_ID_ERR,
+               PCIE_EXTCAP_ERR_HEADER_LOG_3, TRUE, FALSE, 0)));
+#endif /* EXTENDED_PCIE_DEBUG_DUMP */
+}
+
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+#define MAX_RC_REG_INFO_VAL 8
+#define PCIE_EXTCAP_ERR_HD_SZ 4
+void
+dhd_dump_pcie_rc_regs_for_linkdown(dhd_pub_t *dhd, int *bytes_written)
+{
+       int i;
+       int remain_len;
+
+       /* dump link control & status */
+       if (dhd->hang_info_cnt < HANG_FIELD_CNT_MAX) {
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               *bytes_written += scnprintf(&dhd->hang_info[*bytes_written], remain_len, "%08x%c",
+                       dhdpcie_rc_access_cap(dhd->bus, PCIE_CAP_ID_EXP,
+                               PCIE_CAP_LINKCTRL_OFFSET, FALSE, FALSE, 0), HANG_KEY_DEL);
+               dhd->hang_info_cnt++;
+       }
+
+       /* dump device control & status */
+       if (dhd->hang_info_cnt < HANG_FIELD_CNT_MAX) {
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               *bytes_written += scnprintf(&dhd->hang_info[*bytes_written], remain_len, "%08x%c",
+                       dhdpcie_rc_access_cap(dhd->bus, PCIE_CAP_ID_EXP,
+                               PCIE_CAP_DEVCTRL_OFFSET, FALSE, FALSE, 0), HANG_KEY_DEL);
+               dhd->hang_info_cnt++;
+       }
+
+       /* dump uncorrectable error */
+       if (dhd->hang_info_cnt < HANG_FIELD_CNT_MAX) {
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               *bytes_written += scnprintf(&dhd->hang_info[*bytes_written], remain_len, "%08x%c",
+                       dhdpcie_rc_access_cap(dhd->bus, PCIE_EXTCAP_ID_ERR,
+                       PCIE_EXTCAP_AER_UCERR_OFFSET, TRUE, FALSE, 0), HANG_KEY_DEL);
+               dhd->hang_info_cnt++;
+       }
+
+       /* dump correctable error */
+       if (dhd->hang_info_cnt < HANG_FIELD_CNT_MAX) {
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               *bytes_written += scnprintf(&dhd->hang_info[*bytes_written], remain_len, "%08x%c",
+                       dhdpcie_rc_access_cap(dhd->bus, PCIE_EXTCAP_ID_ERR,
+                       /* XXX: use definition in linux/pcie_regs.h */
+                       PCI_ERR_COR_STATUS, TRUE, FALSE, 0), HANG_KEY_DEL);
+               dhd->hang_info_cnt++;
+       }
+
+       /* HG05/06 reserved */
+       if (dhd->hang_info_cnt < HANG_FIELD_CNT_MAX) {
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               *bytes_written += scnprintf(&dhd->hang_info[*bytes_written], remain_len, "%08x%c",
+                       0, HANG_KEY_DEL);
+               dhd->hang_info_cnt++;
+       }
+
+       if (dhd->hang_info_cnt < HANG_FIELD_CNT_MAX) {
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               *bytes_written += scnprintf(&dhd->hang_info[*bytes_written], remain_len, "%08x%c",
+                       0, HANG_KEY_DEL);
+               dhd->hang_info_cnt++;
+       }
+
+       /* dump error header log in RAW */
+       for (i = 0; i < PCIE_EXTCAP_ERR_HD_SZ; i++) {
+               remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - *bytes_written;
+               *bytes_written += scnprintf(&dhd->hang_info[*bytes_written], remain_len,
+                       "%c%08x", HANG_RAW_DEL, dhdpcie_rc_access_cap(dhd->bus, PCIE_EXTCAP_ID_ERR,
+                       PCIE_EXTCAP_ERR_HEADER_LOG_0 + i * PCIE_EXTCAP_ERR_HD_SZ,
+                       TRUE, FALSE, 0));
+       }
+       dhd->hang_info_cnt++;
+}
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+
+int
+dhd_pcie_debug_info_dump(dhd_pub_t *dhd)
+{
+       int host_irq_disabled;
+
+       DHD_ERROR(("bus->bus_low_power_state = %d\n", dhd->bus->bus_low_power_state));
+       host_irq_disabled = dhdpcie_irq_disabled(dhd->bus);
+       DHD_ERROR(("host pcie_irq disabled = %d\n", host_irq_disabled));
+       dhd_print_tasklet_status(dhd);
+       dhd_pcie_intr_count_dump(dhd);
+
+       DHD_ERROR(("\n ------- DUMPING PCIE EP Resouce Info ------- \r\n"));
+       dhdpcie_dump_resource(dhd->bus);
+
+       dhd_pcie_dump_rc_conf_space_cap(dhd);
+
+       DHD_ERROR(("RootPort PCIe linkcap=0x%08x\n",
+               dhd_debug_get_rc_linkcap(dhd->bus)));
+#ifdef CUSTOMER_HW4_DEBUG
+       if (dhd->bus->is_linkdown) {
+               DHD_ERROR(("Skip dumping the PCIe Config and Core registers. "
+                       "link may be DOWN\n"));
+               return 0;
+       }
+#endif /* CUSTOMER_HW4_DEBUG */
+       DHD_ERROR(("\n ------- DUMPING PCIE EP config space Registers ------- \r\n"));
+       /* XXX: hwnbu-twiki.sj.broadcom.com/bin/view/Mwgroup/CurrentPcieGen2ProgramGuide */
+       dhd_bus_dump_imp_cfg_registers(dhd->bus);
+#ifdef EXTENDED_PCIE_DEBUG_DUMP
+       DHD_ERROR(("Pcie EP Uncorrectable Error Status Val=0x%x\n",
+               dhdpcie_ep_access_cap(dhd->bus, PCIE_EXTCAP_ID_ERR,
+               PCIE_EXTCAP_AER_UCERR_OFFSET, TRUE, FALSE, 0)));
+       DHD_ERROR(("hdrlog0(0x%x)=0x%08x hdrlog1(0x%x)=0x%08x hdrlog2(0x%x)=0x%08x "
+               "hdrlog3(0x%x)=0x%08x\n", PCI_TLP_HDR_LOG1,
+               dhd_pcie_config_read(dhd->bus, PCI_TLP_HDR_LOG1, sizeof(uint32)),
+               PCI_TLP_HDR_LOG2,
+               dhd_pcie_config_read(dhd->bus, PCI_TLP_HDR_LOG2, sizeof(uint32)),
+               PCI_TLP_HDR_LOG3,
+               dhd_pcie_config_read(dhd->bus, PCI_TLP_HDR_LOG3, sizeof(uint32)),
+               PCI_TLP_HDR_LOG4,
+               dhd_pcie_config_read(dhd->bus, PCI_TLP_HDR_LOG4, sizeof(uint32))));
+       if (dhd->bus->sih->buscorerev >= 24) {
+               DHD_ERROR(("DeviceStatusControl(0x%x)=0x%x SubsystemControl(0x%x)=0x%x "
+                       "L1SSControl2(0x%x)=0x%x\n", PCIECFGREG_DEV_STATUS_CTRL,
+                       dhd_pcie_config_read(dhd->bus, PCIECFGREG_DEV_STATUS_CTRL,
+                       sizeof(uint32)), PCIE_CFG_SUBSYSTEM_CONTROL,
+                       dhd_pcie_config_read(dhd->bus, PCIE_CFG_SUBSYSTEM_CONTROL,
+                       sizeof(uint32)), PCIECFGREG_PML1_SUB_CTRL2,
+                       dhd_pcie_config_read(dhd->bus, PCIECFGREG_PML1_SUB_CTRL2,
+                       sizeof(uint32))));
+               dhd_bus_dump_dar_registers(dhd->bus);
+       }
+#endif /* EXTENDED_PCIE_DEBUG_DUMP */
+
+       if (dhd->bus->is_linkdown) {
+               DHD_ERROR(("Skip dumping the PCIe Core registers. link may be DOWN\n"));
+               return 0;
+       }
+
+       if (MULTIBP_ENAB(dhd->bus->sih)) {
+               dhd_bus_pcie_pwr_req(dhd->bus);
+       }
+
+       DHD_ERROR(("\n ------- DUMPING PCIE core Registers ------- \r\n"));
+       /* XXX: hwnbu-twiki.sj.broadcom.com/twiki/pub/Mwgroup/
+        * CurrentPcieGen2ProgramGuide/pcie_ep.htm
+        */
+
+       DHD_ERROR(("ClkReq0(0x%x)=0x%x ClkReq1(0x%x)=0x%x ClkReq2(0x%x)=0x%x "
+               "ClkReq3(0x%x)=0x%x\n", PCIECFGREG_PHY_DBG_CLKREQ0,
+               dhd_pcie_corereg_read(dhd->bus->sih, PCIECFGREG_PHY_DBG_CLKREQ0),
+               PCIECFGREG_PHY_DBG_CLKREQ1,
+               dhd_pcie_corereg_read(dhd->bus->sih, PCIECFGREG_PHY_DBG_CLKREQ1),
+               PCIECFGREG_PHY_DBG_CLKREQ2,
+               dhd_pcie_corereg_read(dhd->bus->sih, PCIECFGREG_PHY_DBG_CLKREQ2),
+               PCIECFGREG_PHY_DBG_CLKREQ3,
+               dhd_pcie_corereg_read(dhd->bus->sih, PCIECFGREG_PHY_DBG_CLKREQ3)));
+
+#ifdef EXTENDED_PCIE_DEBUG_DUMP
+       if (dhd->bus->sih->buscorerev >= 24) {
+
+               DHD_ERROR(("ltssm_hist_0(0x%x)=0x%x ltssm_hist_1(0x%x)=0x%x "
+                       "ltssm_hist_2(0x%x)=0x%x "
+                       "ltssm_hist_3(0x%x)=0x%x\n", PCIECFGREG_PHY_LTSSM_HIST_0,
+                       dhd_pcie_corereg_read(dhd->bus->sih, PCIECFGREG_PHY_LTSSM_HIST_0),
+                       PCIECFGREG_PHY_LTSSM_HIST_1,
+                       dhd_pcie_corereg_read(dhd->bus->sih, PCIECFGREG_PHY_LTSSM_HIST_1),
+                       PCIECFGREG_PHY_LTSSM_HIST_2,
+                       dhd_pcie_corereg_read(dhd->bus->sih, PCIECFGREG_PHY_LTSSM_HIST_2),
+                       PCIECFGREG_PHY_LTSSM_HIST_3,
+                       dhd_pcie_corereg_read(dhd->bus->sih, PCIECFGREG_PHY_LTSSM_HIST_3)));
+
+               DHD_ERROR(("trefup(0x%x)=0x%x trefup_ext(0x%x)=0x%x\n",
+                       PCIECFGREG_TREFUP,
+                       dhd_pcie_corereg_read(dhd->bus->sih, PCIECFGREG_TREFUP),
+                       PCIECFGREG_TREFUP_EXT,
+                       dhd_pcie_corereg_read(dhd->bus->sih, PCIECFGREG_TREFUP_EXT)));
+               DHD_ERROR(("errlog(0x%x)=0x%x errlog_addr(0x%x)=0x%x "
+                       "Function_Intstatus(0x%x)=0x%x "
+                       "Function_Intmask(0x%x)=0x%x Power_Intstatus(0x%x)=0x%x "
+                       "Power_Intmask(0x%x)=0x%x\n",
+                       PCIE_CORE_REG_ERRLOG,
+                       si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                       PCIE_CORE_REG_ERRLOG, 0, 0),
+                       PCIE_CORE_REG_ERR_ADDR,
+                       si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                               PCIE_CORE_REG_ERR_ADDR, 0, 0),
+                       PCIFunctionIntstatus(dhd->bus->sih->buscorerev),
+                       si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                               PCIFunctionIntstatus(dhd->bus->sih->buscorerev), 0, 0),
+                       PCIFunctionIntmask(dhd->bus->sih->buscorerev),
+                       si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                               PCIFunctionIntmask(dhd->bus->sih->buscorerev), 0, 0),
+                       PCIPowerIntstatus(dhd->bus->sih->buscorerev),
+                       si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                               PCIPowerIntstatus(dhd->bus->sih->buscorerev), 0, 0),
+                       PCIPowerIntmask(dhd->bus->sih->buscorerev),
+                       si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                               PCIPowerIntmask(dhd->bus->sih->buscorerev), 0, 0)));
+               DHD_ERROR(("err_hdrlog1(0x%x)=0x%x err_hdrlog2(0x%x)=0x%x "
+                       "err_hdrlog3(0x%x)=0x%x err_hdrlog4(0x%x)=0x%x\n",
+                       (uint)OFFSETOF(sbpcieregs_t, u.pcie2.err_hdr_logreg1),
+                       si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                               OFFSETOF(sbpcieregs_t, u.pcie2.err_hdr_logreg1), 0, 0),
+                       (uint)OFFSETOF(sbpcieregs_t, u.pcie2.err_hdr_logreg2),
+                       si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                               OFFSETOF(sbpcieregs_t, u.pcie2.err_hdr_logreg2), 0, 0),
+                       (uint)OFFSETOF(sbpcieregs_t, u.pcie2.err_hdr_logreg3),
+                       si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                               OFFSETOF(sbpcieregs_t, u.pcie2.err_hdr_logreg3), 0, 0),
+                       (uint)OFFSETOF(sbpcieregs_t, u.pcie2.err_hdr_logreg4),
+                       si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                               OFFSETOF(sbpcieregs_t, u.pcie2.err_hdr_logreg4), 0, 0)));
+               DHD_ERROR(("err_code(0x%x)=0x%x\n",
+                       (uint)OFFSETOF(sbpcieregs_t, u.pcie2.err_code_logreg),
+                       si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx,
+                               OFFSETOF(sbpcieregs_t, u.pcie2.err_code_logreg), 0, 0)));
+
+               dhd_pcie_dump_wrapper_regs(dhd);
+               dhdpcie_hw_war_regdump(dhd->bus);
+       }
+#endif /* EXTENDED_PCIE_DEBUG_DUMP */
+
+       dhd_pcie_dma_info_dump(dhd);
+
+       if (MULTIBP_ENAB(dhd->bus->sih)) {
+               dhd_bus_pcie_pwr_req_clear(dhd->bus);
+       }
+
+       return 0;
+}
+
+bool
+dhd_bus_force_bt_quiesce_enabled(struct dhd_bus *bus)
+{
+       return bus->force_bt_quiesce;
+}
+
+uint8
+dhd_d11_slices_num_get(dhd_pub_t *dhdp)
+{
+       return si_scan_core_present(dhdp->bus->sih) ?
+               MAX_NUM_D11_CORES_WITH_SCAN : MAX_NUM_D11CORES;
+}
+
+static bool
+dhd_bus_tcm_test(struct dhd_bus *bus)
+{
+       int ret = 0;
+       int size; /* Full mem size */
+       int start; /* Start address */
+       int read_size = 0; /* Read size of each iteration */
+       int num = 0;
+       uint8 *read_buf, *write_buf;
+       uint8 init_val[NUM_PATTERNS] = {
+               0xFFu, /* 11111111 */
+               0x00u, /* 00000000 */
+       };
+
+       if (!bus) {
+               DHD_ERROR(("%s: bus is NULL !\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       read_buf = MALLOCZ(bus->dhd->osh, MEMBLOCK);
+
+       if (!read_buf) {
+               DHD_ERROR(("%s: MALLOC of read_buf failed\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       write_buf = MALLOCZ(bus->dhd->osh, MEMBLOCK);
+
+       if (!write_buf) {
+               MFREE(bus->dhd->osh, read_buf, MEMBLOCK);
+               DHD_ERROR(("%s: MALLOC of write_buf failed\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       DHD_ERROR(("%s: start %x,  size: %x\n", __FUNCTION__, bus->dongle_ram_base, bus->ramsize));
+       DHD_ERROR(("%s: memblock size %d,  #pattern %d\n", __FUNCTION__, MEMBLOCK, NUM_PATTERNS));
+
+       while (num < NUM_PATTERNS) {
+               start = bus->dongle_ram_base;
+               /* Get full mem size */
+               size = bus->ramsize;
+
+               memset(write_buf, init_val[num], MEMBLOCK);
+               while (size > 0) {
+                       read_size = MIN(MEMBLOCK, size);
+                       memset(read_buf, 0, read_size);
+
+                       /* Write */
+                       if ((ret = dhdpcie_bus_membytes(bus, TRUE, start, write_buf, read_size))) {
+                               DHD_ERROR(("%s: Write Error membytes %d\n", __FUNCTION__, ret));
+                               MFREE(bus->dhd->osh, read_buf, MEMBLOCK);
+                               MFREE(bus->dhd->osh, write_buf, MEMBLOCK);
+                               return FALSE;
+                       }
+
+                       /* Read */
+                       if ((ret = dhdpcie_bus_membytes(bus, FALSE, start, read_buf, read_size))) {
+                               DHD_ERROR(("%s: Read Error membytes %d\n", __FUNCTION__, ret));
+                               MFREE(bus->dhd->osh, read_buf, MEMBLOCK);
+                               MFREE(bus->dhd->osh, write_buf, MEMBLOCK);
+                               return FALSE;
+                       }
+
+                       /* Compare */
+                       if (memcmp(read_buf, write_buf, read_size)) {
+                               DHD_ERROR(("%s: Mismatch at %x, iter : %d\n",
+                                       __FUNCTION__, start, num));
+                               prhex("Readbuf", read_buf, read_size);
+                               prhex("Writebuf", write_buf, read_size);
+                               MFREE(bus->dhd->osh, read_buf, MEMBLOCK);
+                               MFREE(bus->dhd->osh, write_buf, MEMBLOCK);
+                               return FALSE;
+                       }
+
+                       /* Decrement size and increment start address */
+                       size -= read_size;
+                       start += read_size;
+               }
+               num++;
+       }
+
+       MFREE(bus->dhd->osh, read_buf, MEMBLOCK);
+       MFREE(bus->dhd->osh, write_buf, MEMBLOCK);
+
+       DHD_ERROR(("%s: Success iter : %d\n", __FUNCTION__, num));
+       return TRUE;
+}
+
+#define PCI_CFG_LINK_SPEED_SHIFT       16
+int
+dhd_get_pcie_linkspeed(dhd_pub_t *dhd)
+{
+       uint32 pcie_lnkst;
+       uint32 pcie_lnkspeed;
+       pcie_lnkst = OSL_PCI_READ_CONFIG(dhd->osh, PCIECFGREG_LINK_STATUS_CTRL,
+               sizeof(pcie_lnkst));
+
+       pcie_lnkspeed = (pcie_lnkst >> PCI_CFG_LINK_SPEED_SHIFT) & PCI_LINK_SPEED_MASK;
+       DHD_INFO(("%s: Link speed: %d\n", __FUNCTION__, pcie_lnkspeed));
+       return pcie_lnkspeed;
+}
diff --git a/bcmdhd.101.10.240.x/dhd_pcie.h b/bcmdhd.101.10.240.x/dhd_pcie.h
new file mode 100644 (file)
index 0000000..ae22c44
--- /dev/null
@@ -0,0 +1,874 @@
+/*
+ * Linux DHD Bus Module for PCIE
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef dhd_pcie_h
+#define dhd_pcie_h
+
+#include <bcmpcie.h>
+#include <hnd_cons.h>
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+#ifdef CONFIG_PCI_MSM
+#include <linux/msm_pcie.h>
+#else
+#include <mach/msm_pcie.h>
+#endif /* CONFIG_PCI_MSM */
+#endif /* CONFIG_ARCH_MSM */
+#ifdef CONFIG_ARCH_EXYNOS
+#ifndef SUPPORT_EXYNOS7420
+#include <linux/exynos-pci-noti.h>
+extern int exynos_pcie_register_event(struct exynos_pcie_register_event *reg);
+extern int exynos_pcie_deregister_event(struct exynos_pcie_register_event *reg);
+#endif /* !SUPPORT_EXYNOS7420 */
+#endif /* CONFIG_ARCH_EXYNOS */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+
+#ifdef DHD_PCIE_RUNTIMEPM
+#include <linux/mutex.h>
+#include <linux/wait.h>
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+/* defines */
+#define PCIE_SHARED_VERSION            PCIE_SHARED_VERSION_7
+
+#define PCMSGBUF_HDRLEN 0
+#define DONGLE_REG_MAP_SIZE (32 * 1024)
+#define DONGLE_TCM_MAP_SIZE (4096 * 1024)
+#define DONGLE_MIN_MEMSIZE (128 *1024)
+#ifdef DHD_DEBUG
+#define DHD_PCIE_SUCCESS 0
+#define DHD_PCIE_FAILURE 1
+#endif /* DHD_DEBUG */
+#define        REMAP_ENAB(bus)                 ((bus)->remap)
+#define        REMAP_ISADDR(bus, a)            (((a) >= ((bus)->orig_ramsize)) && ((a) < ((bus)->ramsize)))
+
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+#define struct_pcie_notify             struct msm_pcie_notify
+#define struct_pcie_register_event     struct msm_pcie_register_event
+#endif /* CONFIG_ARCH_MSM */
+#ifdef CONFIG_ARCH_EXYNOS
+#ifndef SUPPORT_EXYNOS7420
+#define struct_pcie_notify             struct exynos_pcie_notify
+#define struct_pcie_register_event     struct exynos_pcie_register_event
+#endif /* !SUPPORT_EXYNOS7420 */
+#endif /* CONFIG_ARCH_EXYNOS */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+
+#define MAX_DHD_TX_FLOWS       320
+
+/* user defined data structures */
+/* Device console log buffer state */
+#define CONSOLE_LINE_MAX       192u
+#define CONSOLE_BUFFER_MAX     (8 * 1024)
+
+#ifdef IDLE_TX_FLOW_MGMT
+#define IDLE_FLOW_LIST_TIMEOUT 5000
+#define IDLE_FLOW_RING_TIMEOUT 5000
+#endif /* IDLE_TX_FLOW_MGMT */
+
+#define HWA_RING_INDEX_SHIFT(val)      ((uint32)(val) << 16u)
+
+/* HWA enabled and inited */
+#define HWA_CAPAB(dhd)         ((dhd)->hwa_capable)
+#define HWA_ACTIVE(dhd)                ((dhd)->hwa_inited)
+#define RING_HWA_DB_IDX(dhd, ringid) ((dhd)->bus->ring_sh[ringid].ring_hwa_db_idx)
+
+/* implicit DMA for h2d wr and d2h rd indice from Host memory to TCM */
+#define IDMA_ENAB(dhd)         ((dhd)->idma_enable)
+#define IDMA_ACTIVE(dhd)       (((dhd)->idma_enable) && ((dhd)->idma_inited))
+
+#define IDMA_CAPABLE(bus)      (((bus)->sih->buscorerev == 19) || ((bus)->sih->buscorerev >= 23))
+
+/* IFRM (Implicit Flow Ring Manager enable and inited */
+#define IFRM_ENAB(dhd)         ((dhd)->ifrm_enable)
+#define IFRM_ACTIVE(dhd)       (((dhd)->ifrm_enable) && ((dhd)->ifrm_inited))
+
+/* DAR registers use for h2d doorbell */
+#define DAR_ENAB(dhd)          ((dhd)->dar_enable)
+#define DAR_ACTIVE(dhd)                (((dhd)->dar_enable) && ((dhd)->dar_inited))
+
+/* DAR WAR for revs < 64 */
+#define DAR_PWRREQ(bus)                (((bus)->_dar_war) && DAR_ACTIVE((bus)->dhd))
+
+/* PCIE CTO Prevention and Recovery */
+#define PCIECTO_ENAB(bus)      ((bus)->cto_enable)
+
+/* Implicit DMA index usage :
+ * Index 0 for h2d write index transfer
+ * Index 1 for d2h read index transfer
+ */
+#define IDMA_IDX0 0
+#define IDMA_IDX1 1
+#define IDMA_IDX2 2
+#define IDMA_IDX3 3
+#define DMA_TYPE_SHIFT 4
+#define DMA_TYPE_IDMA  1
+
+#define DHDPCIE_CONFIG_HDR_SIZE 16
+#define DHDPCIE_CONFIG_CHECK_DELAY_MS 10 /* 10ms */
+#define DHDPCIE_CONFIG_CHECK_RETRY_COUNT 20
+#define DHDPCIE_DONGLE_PWR_TOGGLE_DELAY 1000 /* 1ms in units of us */
+#define DHDPCIE_PM_D3_DELAY 200000 /* 200ms in units of us */
+#define DHDPCIE_PM_D2_DELAY 200 /* 200us */
+
+typedef struct dhd_console {
+        uint           count;  /* Poll interval msec counter */
+        uint           log_addr;                /* Log struct address (fixed) */
+        hnd_log_t       log;                    /* Log struct (host copy) */
+        uint            bufsize;                /* Size of log buffer */
+        uint8           *buf;                   /* Log buffer (host copy) */
+        uint            last;                   /* Last buffer read index */
+} dhd_console_t;
+
+typedef struct ring_sh_info {
+       uint32 ring_mem_addr;
+       uint32 ring_state_w;
+       uint32 ring_state_r;
+       pcie_hwa_db_index_t ring_hwa_db_idx;            /* HWA DB index value per ring */
+} ring_sh_info_t;
+#define MAX_DS_TRACE_SIZE      50
+typedef struct _dhd_ds_trace_t {
+       uint64  timestamp;
+       bool    d2h;
+       uint32  dsval;
+#ifdef PCIE_INB_DW
+       enum dhd_bus_ds_state inbstate;
+#endif /* PCIE_INB_DW */
+} dhd_ds_trace_t;
+
+#define DEVICE_WAKE_NONE       0
+#define DEVICE_WAKE_OOB                1
+#define DEVICE_WAKE_INB                2
+
+#define INBAND_DW_ENAB(bus)            ((bus)->dw_option == DEVICE_WAKE_INB)
+#define OOB_DW_ENAB(bus)               ((bus)->dw_option == DEVICE_WAKE_OOB)
+#define NO_DW_ENAB(bus)                        ((bus)->dw_option == DEVICE_WAKE_NONE)
+
+#define PCIE_PWR_REQ_RELOAD_WAR_ENAB(buscorerev) \
+       ((buscorerev == 66) || (buscorerev == 67) || (buscorerev == 68) || \
+       (buscorerev == 70) || (buscorerev == 72))
+
+#define PCIE_FASTLPO_ENABLED(buscorerev) \
+       ((buscorerev == 66) || (buscorerev == 67) || (buscorerev == 68) || \
+       (buscorerev == 70) || (buscorerev == 72))
+
+/*
+ * HW JIRA - CRWLPCIEGEN2-672
+ * Producer Index Feature which is used by F1 gets reset on F0 FLR
+ * fixed in REV68
+ */
+#define PCIE_ENUM_RESET_WAR_ENAB(buscorerev) \
+       ((buscorerev == 66) || (buscorerev == 67))
+
+struct dhd_bus;
+
+struct dhd_pcie_rev {
+       uint8   fw_rev;
+       void (*handle_mb_data)(struct dhd_bus *);
+};
+
+typedef struct dhdpcie_config_save
+{
+       uint32 header[DHDPCIE_CONFIG_HDR_SIZE];
+       /* pmcsr save */
+       uint32 pmcsr;
+       /* express save */
+       uint32 exp_dev_ctrl_stat;
+       uint32 exp_link_ctrl_stat;
+       uint32 exp_dev_ctrl_stat2;
+       uint32 exp_link_ctrl_stat2;
+       /* msi save */
+       uint32 msi_cap;
+       uint32 msi_addr0;
+       uint32 msi_addr1;
+       uint32 msi_data;
+       /* l1pm save */
+       uint32 l1pm0;
+       uint32 l1pm1;
+       /* ltr save */
+       uint32 ltr;
+       /* aer save */
+       uint32 aer_caps_ctrl; /* 0x18 */
+       uint32 aer_severity;  /* 0x0C */
+       uint32 aer_umask;     /* 0x08 */
+       uint32 aer_cmask;     /* 0x14 */
+       uint32 aer_root_cmd;  /* 0x2c */
+       /* BAR0 and BAR1 windows */
+       uint32 bar0_win;
+       uint32 bar1_win;
+} dhdpcie_config_save_t;
+
+/* The level of bus communication with the dongle */
+enum dhd_bus_low_power_state {
+       DHD_BUS_NO_LOW_POWER_STATE,     /* Not in low power state */
+       DHD_BUS_D3_INFORM_SENT,         /* D3 INFORM sent */
+       DHD_BUS_D3_ACK_RECIEVED,        /* D3 ACK recieved */
+};
+
+/** Instantiated once for each hardware (dongle) instance that this DHD manages */
+typedef struct dhd_bus {
+       dhd_pub_t       *dhd;   /**< pointer to per hardware (dongle) unique instance */
+       struct pci_dev  *rc_dev;        /* pci RC device handle */
+       struct pci_dev  *dev;           /* pci device handle */
+       dll_t           flowring_active_list; /* constructed list of tx flowring queues */
+#ifdef IDLE_TX_FLOW_MGMT
+       uint64          active_list_last_process_ts;
+                                               /* stores the timestamp of active list processing */
+#endif /* IDLE_TX_FLOW_MGMT */
+
+       si_t            *sih;                   /* Handle for SI calls */
+       char            *vars;                  /* Variables (from CIS and/or other) */
+       uint            varsz;                  /* Size of variables buffer */
+       uint32          sbaddr;                 /* Current SB window pointer (-1, invalid) */
+       sbpcieregs_t    *reg;                   /* Registers for PCIE core */
+
+       uint            armrev;                 /* CPU core revision */
+       uint            coreid;                 /* CPU core id */
+       uint            ramrev;                 /* SOCRAM core revision */
+       uint32          ramsize;                /* Size of RAM in SOCRAM (bytes) */
+       uint32          orig_ramsize;           /* Size of RAM in SOCRAM (bytes) */
+       uint32          srmemsize;              /* Size of SRMEM */
+
+       uint32          bus;                    /* gSPI or SDIO bus */
+       uint32          intstatus;              /* Intstatus bits (events) pending */
+       bool            dpc_sched;              /* Indicates DPC schedule (intrpt rcvd) */
+       bool            fcstate;                /* State of dongle flow-control */
+
+       uint16          cl_devid;               /* cached devid for dhdsdio_probe_attach() */
+       char            *fw_path;               /* module_param: path to firmware image */
+       char            *nv_path;               /* module_param: path to nvram vars file */
+
+       struct pktq     txq;                    /* Queue length used for flow-control */
+
+       bool            intr;                   /* Use interrupts */
+       bool            poll;                   /* Use polling */
+       bool            ipend;                  /* Device interrupt is pending */
+       bool            intdis;                 /* Interrupts disabled by isr */
+       uint            intrcount;              /* Count of device interrupt callbacks */
+       uint            lastintrs;              /* Count as of last watchdog timer */
+
+       dhd_console_t   console;                /* Console output polling support */
+       uint            console_addr;           /* Console address from shared struct */
+
+       bool            alp_only;               /* Don't use HT clock (ALP only) */
+
+       bool            remap;          /* Contiguous 1MB RAM: 512K socram + 512K devram
+                                        * Available with socram rev 16
+                                        * Remap region not DMA-able
+                                        */
+       uint32          resetinstr;
+       uint32          dongle_ram_base;
+       uint32          next_tlv;       /* Holds location of next available TLV */
+       ulong           shared_addr;
+       pciedev_shared_t        *pcie_sh;
+       uint32          dma_rxoffset;
+       volatile char   *regs;          /* pci device memory va */
+       volatile char   *tcm;           /* pci device memory va */
+       uint32          bar1_size;      /* pci device memory size */
+       uint32          curr_bar1_win;  /* current PCIEBar1Window setting */
+       osl_t           *osh;
+       uint32          nvram_csm;      /* Nvram checksum */
+       uint16          pollrate;
+       uint16  polltick;
+
+       volatile uint32  *pcie_mb_intr_addr;
+       volatile uint32  *pcie_mb_intr_2_addr;
+       void    *pcie_mb_intr_osh;
+       bool    sleep_allowed;
+
+       wake_counts_t   wake_counts;
+
+       /* version 3 shared struct related info start */
+       ring_sh_info_t  ring_sh[BCMPCIE_COMMON_MSGRINGS + MAX_DHD_TX_FLOWS];
+
+       uint8   h2d_ring_count;
+       uint8   d2h_ring_count;
+       uint32  ringmem_ptr;
+       uint32  ring_state_ptr;
+
+       uint32 d2h_dma_scratch_buffer_mem_addr;
+
+       uint32 h2d_mb_data_ptr_addr;
+       uint32 d2h_mb_data_ptr_addr;
+       /* version 3 shared struct related info end */
+
+       uint32 def_intmask;
+       uint32 d2h_mb_mask;
+       uint32 pcie_mailbox_mask;
+       uint32 pcie_mailbox_int;
+       bool    ltrsleep_on_unload;
+       uint    wait_for_d3_ack;
+       uint16  max_tx_flowrings;
+       uint16  max_submission_rings;
+       uint16  max_completion_rings;
+       uint16  max_cmn_rings;
+       uint32  rw_index_sz;
+       uint32  hwa_db_index_sz;
+       bool    db1_for_mb;
+
+       dhd_timeout_t doorbell_timer;
+       bool    device_wake_state;
+       bool    irq_registered;
+       bool    d2h_intr_method;
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#if defined(CONFIG_ARCH_MSM) || (defined(CONFIG_ARCH_EXYNOS) && \
+       !defined(SUPPORT_EXYNOS7420))
+#ifdef CONFIG_ARCH_MSM
+       uint8 no_cfg_restore;
+#endif /* CONFIG_ARCH_MSM */
+       struct_pcie_register_event pcie_event;
+#endif /* CONFIG_ARCH_MSM || CONFIG_ARCH_EXYNOS && !SUPPORT_EXYNOS7420  */
+       bool read_shm_fail;
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+       int32 idletime;                 /* Control for activity timeout */
+       bool rpm_enabled;
+#ifdef DHD_PCIE_RUNTIMEPM
+       int32 idlecount;                /* Activity timeout counter */
+       int32 bus_wake;                 /* For wake up the bus */
+       bool runtime_resume_done;       /* For check runtime suspend end */
+       struct mutex pm_lock;            /* Synchronize for system PM & runtime PM */
+       wait_queue_head_t rpm_queue;    /* wait-queue for bus wake up */
+#endif /* DHD_PCIE_RUNTIMEPM */
+       uint32 d3_inform_cnt;
+       uint32 d0_inform_cnt;
+       uint32 d0_inform_in_use_cnt;
+       uint8 force_suspend;
+       uint8 is_linkdown;
+       uint8 no_bus_init;
+#ifdef IDLE_TX_FLOW_MGMT
+       bool enable_idle_flowring_mgmt;
+#endif /* IDLE_TX_FLOW_MGMT */
+       struct  dhd_pcie_rev api;
+       bool use_mailbox;
+       bool    use_d0_inform;
+       void    *bus_lp_state_lock;
+       void    *pwr_req_lock;
+       bool    bar1_switch_enab;
+       void    *bar1_switch_lock;
+       void *backplane_access_lock;
+       enum dhd_bus_low_power_state bus_low_power_state;
+       dhd_ds_trace_t   ds_trace[MAX_DS_TRACE_SIZE];
+       uint32  ds_trace_count;
+       uint32  hostready_count; /* Number of hostready issued */
+#if defined(BCMPCIE_OOB_HOST_WAKE)
+       bool    oob_presuspend;
+#endif
+       dhdpcie_config_save_t saved_config;
+       ulong resume_intr_enable_count;
+       ulong dpc_intr_enable_count;
+       ulong isr_intr_disable_count;
+       ulong suspend_intr_disable_count;
+       ulong dpc_return_busdown_count;
+       ulong non_ours_irq_count;
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       ulong oob_intr_count;
+       ulong oob_intr_enable_count;
+       ulong oob_intr_disable_count;
+       uint64 last_oob_irq_isr_time;
+       uint64 last_oob_irq_thr_time;
+       uint64 last_oob_irq_enable_time;
+       uint64 last_oob_irq_disable_time;
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+       uint64 isr_entry_time;
+       uint64 isr_exit_time;
+       uint64 isr_sched_dpc_time;
+       uint64 rpm_sched_dpc_time;
+       uint64 dpc_entry_time;
+       uint64 dpc_exit_time;
+       uint64 resched_dpc_time;
+       uint64 last_d3_inform_time;
+       uint64 last_process_ctrlbuf_time;
+       uint64 last_process_flowring_time;
+       uint64 last_process_txcpl_time;
+       uint64 last_process_rxcpl_time;
+       uint64 last_process_infocpl_time;
+       uint64 last_process_edl_time;
+       uint64 last_suspend_start_time;
+       uint64 last_suspend_end_time;
+       uint64 last_resume_start_time;
+       uint64 last_resume_end_time;
+       uint64 last_non_ours_irq_time;
+       bool  hwa_enabled;
+       bool  idma_enabled;
+       bool  ifrm_enabled;
+       bool  dar_enabled;
+       uint32 dmaxfer_complete;
+       uint8   dw_option;
+#ifdef PCIE_INB_DW
+       bool    inb_enabled;
+       uint32  ds_exit_timeout;
+       uint32  host_sleep_exit_timeout;
+       uint    wait_for_ds_exit;
+       uint32  inband_dw_assert_cnt; /* # of inband device_wake assert */
+       uint32  inband_dw_deassert_cnt; /* # of inband device_wake deassert */
+       uint32  inband_ds_exit_host_cnt; /* # of DS-EXIT , host initiated */
+       uint32  inband_ds_exit_device_cnt; /* # of DS-EXIT , device initiated */
+       uint32  inband_ds_exit_to_cnt; /* # of DS-EXIT timeout */
+       uint32  inband_host_sleep_exit_to_cnt; /* # of Host_Sleep exit timeout */
+       void    *inb_lock;      /* Lock to serialize in band device wake activity */
+       /* # of contexts in the host which currently want a FW transaction */
+       uint32  host_active_cnt;
+       bool    skip_ds_ack; /* Skip DS-ACK during suspend in progress */
+#endif /* PCIE_INB_DW */
+#if defined(PCIE_INB_DW)
+       bool  ds_enabled;
+#endif
+#ifdef DHD_PCIE_RUNTIMEPM
+       bool chk_pm;    /* To avoid counting of wake up from Runtime PM */
+#endif /* DHD_PCIE_RUNTIMEPM */
+#if defined(PCIE_INB_DW)
+       bool calc_ds_exit_latency;
+       uint64 ds_exit_latency;
+       uint64 ds_exit_ts1;
+       uint64 ds_exit_ts2;
+#endif /* PCIE_INB_DW */
+       bool _dar_war;
+#ifdef GDB_PROXY
+       /* True if firmware loaded and backplane accessible */
+       bool gdb_proxy_access_enabled;
+       /* ID set by last "gdb_proxy_probe" iovar */
+       uint32 gdb_proxy_last_id;
+       /* True if firmware was started in bootloader mode */
+       bool gdb_proxy_bootloader_mode;
+#endif /* GDB_PROXY */
+       uint8  dma_chan;
+
+       bool    cto_enable;     /* enable PCIE CTO Prevention and recovery */
+       uint32  cto_threshold;  /* PCIE CTO timeout threshold */
+       bool    cto_triggered;  /* CTO is triggered */
+       bool intr_enabled; /* ready to receive interrupts from dongle */
+       int     pwr_req_ref;
+       bool flr_force_fail; /* user intends to simulate flr force fail */
+
+       /* Information used to compose the memory map and to write the memory map,
+        * FW, and FW signature to dongle RAM.
+        * This information is used by the bootloader.
+        */
+       uint32 ramtop_addr;             /* Dongle address of unused space at top of RAM */
+       uint32 fw_download_addr;        /* Dongle address of FW download */
+       uint32 fw_download_len;         /* Length in bytes of FW download */
+       uint32 fwsig_download_addr;     /* Dongle address of FW signature download */
+       uint32 fwsig_download_len;      /* Length in bytes of FW signature download */
+       uint32 fwstat_download_addr;    /* Dongle address of FWS status download */
+       uint32 fwstat_download_len;     /* Length in bytes of FWS status download */
+       uint32 fw_memmap_download_addr; /* Dongle address of FWS memory-info download */
+       uint32 fw_memmap_download_len;  /* Length in bytes of FWS memory-info download */
+
+       char fwsig_filename[DHD_FILENAME_MAX];          /* Name of FW signature file */
+       char bootloader_filename[DHD_FILENAME_MAX];     /* Name of bootloader image file */
+       uint32 bootloader_addr;         /* Dongle address of bootloader download */
+       bool force_bt_quiesce; /* send bt_quiesce command to BT driver. */
+       bool rc_ep_aspm_cap; /* RC and EP ASPM capable */
+       bool rc_ep_l1ss_cap; /* EC and EP L1SS capable */
+#if defined(DHD_H2D_LOG_TIME_SYNC)
+       ulong dhd_rte_time_sync_count; /* OSL_SYSUPTIME_US() */
+#endif /* DHD_H2D_LOG_TIME_SYNC */
+       uint16 hp2p_txcpl_max_items;
+       uint16 hp2p_rxcpl_max_items;
+       /* PCIE coherent status */
+       uint32 coherent_state;
+       uint32 inb_dw_deassert_cnt;
+       uint64 arm_oor_time;
+       uint64 rd_shared_pass_time;
+} dhd_bus_t;
+
+#ifdef DHD_MSI_SUPPORT
+extern uint enable_msi;
+#endif /* DHD_MSI_SUPPORT */
+
+enum {
+       PCIE_INTX = 0,
+       PCIE_MSI = 1
+};
+
+static INLINE bool
+__dhd_check_bus_in_lps(dhd_bus_t *bus)
+{
+       bool ret = (bus->bus_low_power_state == DHD_BUS_D3_INFORM_SENT) ||
+               (bus->bus_low_power_state == DHD_BUS_D3_ACK_RECIEVED);
+       return ret;
+}
+
+static INLINE bool
+dhd_check_bus_in_lps(dhd_bus_t *bus)
+{
+       unsigned long flags_bus;
+       bool ret;
+       DHD_BUS_LP_STATE_LOCK(bus->bus_lp_state_lock, flags_bus);
+       ret = __dhd_check_bus_in_lps(bus);
+       DHD_BUS_LP_STATE_UNLOCK(bus->bus_lp_state_lock, flags_bus);
+       return ret;
+}
+
+static INLINE bool
+__dhd_check_bus_lps_d3_acked(dhd_bus_t *bus)
+{
+       bool ret = (bus->bus_low_power_state == DHD_BUS_D3_ACK_RECIEVED);
+       return ret;
+}
+
+static INLINE bool
+dhd_check_bus_lps_d3_acked(dhd_bus_t *bus)
+{
+       unsigned long flags_bus;
+       bool ret;
+       DHD_BUS_LP_STATE_LOCK(bus->bus_lp_state_lock, flags_bus);
+       ret = __dhd_check_bus_lps_d3_acked(bus);
+       DHD_BUS_LP_STATE_UNLOCK(bus->bus_lp_state_lock, flags_bus);
+       return ret;
+}
+
+static INLINE void
+__dhd_set_bus_not_in_lps(dhd_bus_t *bus)
+{
+       bus->bus_low_power_state = DHD_BUS_NO_LOW_POWER_STATE;
+       return;
+}
+
+static INLINE void
+dhd_set_bus_not_in_lps(dhd_bus_t *bus)
+{
+       unsigned long flags_bus;
+       DHD_BUS_LP_STATE_LOCK(bus->bus_lp_state_lock, flags_bus);
+       __dhd_set_bus_not_in_lps(bus);
+       DHD_BUS_LP_STATE_UNLOCK(bus->bus_lp_state_lock, flags_bus);
+       return;
+}
+
+static INLINE void
+__dhd_set_bus_lps_d3_informed(dhd_bus_t *bus)
+{
+       bus->bus_low_power_state = DHD_BUS_D3_INFORM_SENT;
+       return;
+}
+
+static INLINE void
+dhd_set_bus_lps_d3_informed(dhd_bus_t *bus)
+{
+       unsigned long flags_bus;
+       DHD_BUS_LP_STATE_LOCK(bus->bus_lp_state_lock, flags_bus);
+       __dhd_set_bus_lps_d3_informed(bus);
+       DHD_BUS_LP_STATE_UNLOCK(bus->bus_lp_state_lock, flags_bus);
+       return;
+}
+
+static INLINE void
+__dhd_set_bus_lps_d3_acked(dhd_bus_t *bus)
+{
+       bus->bus_low_power_state = DHD_BUS_D3_ACK_RECIEVED;
+       return;
+}
+
+static INLINE void
+dhd_set_bus_lps_d3_acked(dhd_bus_t *bus)
+{
+       unsigned long flags_bus;
+       DHD_BUS_LP_STATE_LOCK(bus->bus_lp_state_lock, flags_bus);
+       __dhd_set_bus_lps_d3_acked(bus);
+       DHD_BUS_LP_STATE_UNLOCK(bus->bus_lp_state_lock, flags_bus);
+       return;
+}
+
+/* check routines */
+#define DHD_CHK_BUS_IN_LPS(bus)                        dhd_check_bus_in_lps(bus)
+#define __DHD_CHK_BUS_IN_LPS(bus)              __dhd_check_bus_in_lps(bus)
+
+#define DHD_CHK_BUS_NOT_IN_LPS(bus)            !(DHD_CHK_BUS_IN_LPS(bus))
+#define __DHD_CHK_BUS_NOT_IN_LPS(bus)          !(__DHD_CHK_BUS_IN_LPS(bus))
+
+#define DHD_CHK_BUS_LPS_D3_INFORMED(bus)       DHD_CHK_BUS_IN_LPS(bus)
+#define __DHD_CHK_BUS_LPS_D3_INFORMED(bus)     __DHD_CHK_BUS_IN_LPS(bus)
+
+#define DHD_CHK_BUS_LPS_D3_ACKED(bus)          dhd_check_bus_lps_d3_acked(bus)
+#define __DHD_CHK_BUS_LPS_D3_ACKED(bus)                __dhd_check_bus_lps_d3_acked(bus)
+
+/* set routines */
+#define DHD_SET_BUS_NOT_IN_LPS(bus)            dhd_set_bus_not_in_lps(bus)
+#define __DHD_SET_BUS_NOT_IN_LPS(bus)          __dhd_set_bus_not_in_lps(bus)
+
+#define DHD_SET_BUS_LPS_D3_INFORMED(bus)       dhd_set_bus_lps_d3_informed(bus)
+#define __DHD_SET_BUS_LPS_D3_INFORMED(bus)     __dhd_set_bus_lps_d3_informed(bus)
+
+#define DHD_SET_BUS_LPS_D3_ACKED(bus)          dhd_set_bus_lps_d3_acked(bus)
+#define __DHD_SET_BUS_LPS_D3_ACKED(bus)                __dhd_set_bus_lps_d3_acked(bus)
+
+/* function declarations */
+
+extern uint32* dhdpcie_bus_reg_map(osl_t *osh, ulong addr, int size);
+extern int dhdpcie_bus_register(void);
+extern void dhdpcie_bus_unregister(void);
+extern bool dhdpcie_chipmatch(uint16 vendor, uint16 device);
+
+extern int dhdpcie_bus_attach(osl_t *osh, dhd_bus_t **bus_ptr,
+       volatile char *regs, volatile char *tcm, void *pci_dev);
+extern uint32 dhdpcie_bus_cfg_read_dword(struct dhd_bus *bus, uint32 addr, uint32 size);
+extern void dhdpcie_bus_cfg_write_dword(struct dhd_bus *bus, uint32 addr, uint32 size, uint32 data);
+extern void dhdpcie_bus_intr_enable(struct dhd_bus *bus);
+extern void dhdpcie_bus_intr_disable(struct dhd_bus *bus);
+extern int dhpcie_bus_mask_interrupt(dhd_bus_t *bus);
+extern void dhdpcie_bus_release(struct dhd_bus *bus);
+extern int32 dhdpcie_bus_isr(struct dhd_bus *bus);
+extern void dhdpcie_free_irq(dhd_bus_t *bus);
+extern void dhdpcie_bus_ringbell_fast(struct dhd_bus *bus, uint32 value);
+extern void dhdpcie_bus_ringbell_2_fast(struct dhd_bus *bus, uint32 value, bool devwake);
+extern void dhdpcie_dongle_reset(dhd_bus_t *bus);
+extern int dhd_bus_cfg_sprom_ctrl_bp_reset(struct dhd_bus *bus);
+extern int dhd_bus_cfg_ss_ctrl_bp_reset(struct dhd_bus *bus);
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+extern int dhdpcie_bus_suspend(struct  dhd_bus *bus, bool state, bool byint);
+#else
+extern int dhdpcie_bus_suspend(struct  dhd_bus *bus, bool state);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+extern int dhdpcie_pci_suspend_resume(struct  dhd_bus *bus, bool state);
+extern uint32 dhdpcie_force_alp(struct dhd_bus *bus, bool enable);
+extern uint32 dhdpcie_set_l1_entry_time(struct dhd_bus *bus, int force_l1_entry_time);
+extern bool dhdpcie_tcm_valid(dhd_bus_t *bus);
+extern void dhdpcie_pme_active(osl_t *osh, bool enable);
+extern bool dhdpcie_pme_cap(osl_t *osh);
+extern uint32 dhdpcie_lcreg(osl_t *osh, uint32 mask, uint32 val);
+extern void dhdpcie_set_pmu_min_res_mask(struct dhd_bus *bus, uint min_res_mask);
+extern uint8 dhdpcie_clkreq(osl_t *osh, uint32 mask, uint32 val);
+extern int dhdpcie_disable_irq(dhd_bus_t *bus);
+extern int dhdpcie_disable_irq_nosync(dhd_bus_t *bus);
+extern int dhdpcie_enable_irq(dhd_bus_t *bus);
+
+extern void dhd_bus_dump_dar_registers(struct dhd_bus *bus);
+
+extern uint32 dhdpcie_rc_config_read(dhd_bus_t *bus, uint offset);
+extern uint32 dhdpcie_rc_access_cap(dhd_bus_t *bus, int cap, uint offset, bool is_ext,
+               bool is_write, uint32 writeval);
+extern uint32 dhdpcie_ep_access_cap(dhd_bus_t *bus, int cap, uint offset, bool is_ext,
+               bool is_write, uint32 writeval);
+extern uint32 dhd_debug_get_rc_linkcap(dhd_bus_t *bus);
+extern int dhdpcie_start_host_dev(dhd_bus_t *bus);
+extern int dhdpcie_stop_host_dev(dhd_bus_t *bus);
+extern int dhdpcie_disable_device(dhd_bus_t *bus);
+extern int dhdpcie_alloc_resource(dhd_bus_t *bus);
+extern void dhdpcie_free_resource(dhd_bus_t *bus);
+extern void dhdpcie_dump_resource(dhd_bus_t *bus);
+extern int dhdpcie_bus_request_irq(struct dhd_bus *bus);
+void dhdpcie_os_setbar1win(dhd_bus_t *bus, uint32 addr);
+void dhdpcie_os_wtcm8(dhd_bus_t *bus, ulong offset, uint8 data);
+uint8 dhdpcie_os_rtcm8(dhd_bus_t *bus, ulong offset);
+void dhdpcie_os_wtcm16(dhd_bus_t *bus, ulong offset, uint16 data);
+uint16 dhdpcie_os_rtcm16(dhd_bus_t *bus, ulong offset);
+void dhdpcie_os_wtcm32(dhd_bus_t *bus, ulong offset, uint32 data);
+uint32 dhdpcie_os_rtcm32(dhd_bus_t *bus, ulong offset);
+#ifdef DHD_SUPPORT_64BIT
+void dhdpcie_os_wtcm64(dhd_bus_t *bus, ulong offset, uint64 data);
+uint64 dhdpcie_os_rtcm64(dhd_bus_t *bus, ulong offset);
+#endif
+
+extern int dhdpcie_enable_device(dhd_bus_t *bus);
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+extern int dhdpcie_oob_intr_register(dhd_bus_t *bus);
+extern void dhdpcie_oob_intr_unregister(dhd_bus_t *bus);
+extern void dhdpcie_oob_intr_set(dhd_bus_t *bus, bool enable);
+extern int dhdpcie_get_oob_irq_num(struct dhd_bus *bus);
+extern int dhdpcie_get_oob_irq_status(struct dhd_bus *bus);
+extern int dhdpcie_get_oob_irq_level(void);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#if defined(PCIE_INB_DW)
+extern void dhd_bus_doorbell_timeout_reset(struct dhd_bus *bus);
+#endif
+
+/* XXX: SWWLAN-82173 Making PCIe RC D3cold by force during system PM
+ * exynos_pcie_pm_suspend : RC goes to suspend status & assert PERST
+ * exynos_pcie_pm_resume : de-assert PERST & RC goes to resume status
+ */
+#if defined(CONFIG_ARCH_EXYNOS)
+#define SAMSUNG_PCIE_VENDOR_ID 0x144d
+#if defined(CONFIG_MACH_UNIVERSAL7420) || defined(CONFIG_SOC_EXYNOS7420)
+#define SAMSUNG_PCIE_DEVICE_ID 0xa575
+#define SAMSUNG_PCIE_CH_NUM 1
+#elif defined(CONFIG_SOC_EXYNOS8890)
+#define SAMSUNG_PCIE_DEVICE_ID 0xa544
+#define SAMSUNG_PCIE_CH_NUM 0
+#elif defined(CONFIG_SOC_EXYNOS8895) || defined(CONFIG_SOC_EXYNOS9810) || \
+       defined(CONFIG_SOC_EXYNOS9820) || defined(CONFIG_SOC_EXYNOS9830)
+#define SAMSUNG_PCIE_DEVICE_ID 0xecec
+#define SAMSUNG_PCIE_CH_NUM 0
+#else
+#error "Not supported platform"
+#endif /* CONFIG_SOC_EXYNOSXXXX & CONFIG_MACH_UNIVERSALXXXX */
+extern void exynos_pcie_pm_suspend(int ch_num);
+extern void exynos_pcie_pm_resume(int ch_num);
+#endif /* CONFIG_ARCH_EXYNOS */
+
+#if defined(CONFIG_ARCH_MSM)
+#define MSM_PCIE_VENDOR_ID 0x17cb
+#if defined(CONFIG_ARCH_APQ8084)
+#define MSM_PCIE_DEVICE_ID 0x0101
+#elif defined(CONFIG_ARCH_MSM8994)
+#define MSM_PCIE_DEVICE_ID 0x0300
+#elif defined(CONFIG_ARCH_MSM8996)
+#define MSM_PCIE_DEVICE_ID 0x0104
+#elif defined(CONFIG_ARCH_MSM8998)
+#define MSM_PCIE_DEVICE_ID 0x0105
+#elif defined(CONFIG_ARCH_SDM845) || defined(CONFIG_ARCH_SM8150) || \
+       defined(CONFIG_ARCH_KONA)
+#define MSM_PCIE_DEVICE_ID 0x0106
+#else
+#error "Not supported platform"
+#endif
+#endif /* CONFIG_ARCH_MSM */
+
+#if defined(CONFIG_X86)
+#define X86_PCIE_VENDOR_ID 0x8086
+#define X86_PCIE_DEVICE_ID 0x9c1a
+#endif /* CONFIG_X86 */
+
+#if defined(CONFIG_ARCH_TEGRA)
+#define TEGRA_PCIE_VENDOR_ID 0x14e4
+#define TEGRA_PCIE_DEVICE_ID 0x4347
+#endif /* CONFIG_ARCH_TEGRA */
+
+#if defined(BOARD_HIKEY)
+#define HIKEY_PCIE_VENDOR_ID 0x19e5
+#define HIKEY_PCIE_DEVICE_ID 0x3660
+#endif /* BOARD_HIKEY */
+
+#define DUMMY_PCIE_VENDOR_ID 0xffff
+#define DUMMY_PCIE_DEVICE_ID 0xffff
+
+#if defined(CONFIG_ARCH_EXYNOS)
+#define PCIE_RC_VENDOR_ID SAMSUNG_PCIE_VENDOR_ID
+#define PCIE_RC_DEVICE_ID SAMSUNG_PCIE_DEVICE_ID
+#elif defined(CONFIG_ARCH_MSM)
+#define PCIE_RC_VENDOR_ID MSM_PCIE_VENDOR_ID
+#define PCIE_RC_DEVICE_ID MSM_PCIE_DEVICE_ID
+#elif defined(CONFIG_X86)
+#define PCIE_RC_VENDOR_ID X86_PCIE_VENDOR_ID
+#define PCIE_RC_DEVICE_ID X86_PCIE_DEVICE_ID
+#elif defined(CONFIG_ARCH_TEGRA)
+#define PCIE_RC_VENDOR_ID TEGRA_PCIE_VENDOR_ID
+#define PCIE_RC_DEVICE_ID TEGRA_PCIE_DEVICE_ID
+#elif defined(BOARD_HIKEY)
+#define PCIE_RC_VENDOR_ID HIKEY_PCIE_VENDOR_ID
+#define PCIE_RC_DEVICE_ID HIKEY_PCIE_DEVICE_ID
+#else
+/* Use dummy vendor and device IDs */
+#define PCIE_RC_VENDOR_ID DUMMY_PCIE_VENDOR_ID
+#define PCIE_RC_DEVICE_ID DUMMY_PCIE_DEVICE_ID
+#endif /* CONFIG_ARCH_EXYNOS */
+
+#define DHD_REGULAR_RING    0
+#define DHD_HP2P_RING    1
+
+#ifdef CONFIG_ARCH_TEGRA
+extern int tegra_pcie_pm_suspend(void);
+extern int tegra_pcie_pm_resume(void);
+#endif /* CONFIG_ARCH_TEGRA */
+
+extern int dhd_buzzz_dump_dngl(dhd_bus_t *bus);
+#ifdef IDLE_TX_FLOW_MGMT
+extern int dhd_bus_flow_ring_resume_request(struct dhd_bus *bus, void *arg);
+extern void dhd_bus_flow_ring_resume_response(struct dhd_bus *bus, uint16 flowid, int32 status);
+extern int dhd_bus_flow_ring_suspend_request(struct dhd_bus *bus, void *arg);
+extern void dhd_bus_flow_ring_suspend_response(struct dhd_bus *bus, uint16 flowid, uint32 status);
+extern void dhd_flow_ring_move_to_active_list_head(struct dhd_bus *bus,
+       flow_ring_node_t *flow_ring_node);
+extern void dhd_flow_ring_add_to_active_list(struct dhd_bus *bus,
+       flow_ring_node_t *flow_ring_node);
+extern void dhd_flow_ring_delete_from_active_list(struct dhd_bus *bus,
+       flow_ring_node_t *flow_ring_node);
+extern void __dhd_flow_ring_delete_from_active_list(struct dhd_bus *bus,
+       flow_ring_node_t *flow_ring_node);
+#endif /* IDLE_TX_FLOW_MGMT */
+
+extern int dhdpcie_send_mb_data(dhd_bus_t *bus, uint32 h2d_mb_data);
+
+#ifdef DHD_WAKE_STATUS
+int bcmpcie_get_total_wake(struct dhd_bus *bus);
+int bcmpcie_set_get_wake(struct dhd_bus *bus, int flag);
+#endif /* DHD_WAKE_STATUS */
+extern void dhd_dump_bus_ds_trace(dhd_bus_t *bus, struct bcmstrbuf *strbuf);
+extern bool dhdpcie_bus_get_pcie_hostready_supported(dhd_bus_t *bus);
+extern void dhd_bus_hostready(struct  dhd_bus *bus);
+#ifdef PCIE_INB_DW
+extern bool dhdpcie_bus_get_pcie_inband_dw_supported(dhd_bus_t *bus);
+extern void dhdpcie_bus_set_pcie_inband_dw_state(dhd_bus_t *bus,
+       enum dhd_bus_ds_state state);
+extern enum dhd_bus_ds_state dhdpcie_bus_get_pcie_inband_dw_state(dhd_bus_t *bus);
+extern const char * dhd_convert_inb_state_names(enum dhd_bus_ds_state inbstate);
+extern const char * dhd_convert_dsval(uint32 val, bool d2h);
+extern int dhd_bus_inb_set_device_wake(struct dhd_bus *bus, bool val);
+extern void dhd_bus_inb_ack_pending_ds_req(dhd_bus_t *bus);
+#endif /* PCIE_INB_DW */
+extern void dhdpcie_bus_enab_pcie_dw(dhd_bus_t *bus, uint8 dw_option);
+extern int dhdpcie_irq_disabled(struct dhd_bus *bus);
+extern int dhdpcie_set_master_and_d0_pwrstate(struct dhd_bus *bus);
+
+static INLINE bool dhdpcie_is_arm_halted(struct dhd_bus *bus) {return TRUE;}
+static INLINE int dhd_os_wifi_platform_set_power(uint32 value) {return BCME_OK; }
+static INLINE void
+dhdpcie_dongle_flr_or_pwr_toggle(dhd_bus_t *bus)
+{ return; }
+
+int dhdpcie_config_check(dhd_bus_t *bus);
+int dhdpcie_config_restore(dhd_bus_t *bus, bool restore_pmcsr);
+int dhdpcie_config_save(dhd_bus_t *bus);
+int dhdpcie_set_pwr_state(dhd_bus_t *bus, uint state);
+
+extern bool dhdpcie_bus_get_pcie_hwa_supported(dhd_bus_t *bus);
+extern bool dhdpcie_bus_get_pcie_idma_supported(dhd_bus_t *bus);
+extern bool dhdpcie_bus_get_pcie_ifrm_supported(dhd_bus_t *bus);
+extern bool dhdpcie_bus_get_pcie_dar_supported(dhd_bus_t *bus);
+extern bool dhdpcie_bus_get_hp2p_supported(dhd_bus_t *bus);
+
+static INLINE uint32
+dhd_pcie_config_read(dhd_bus_t *bus, uint offset, uint size)
+{
+       /* For 4375 or prior chips to 4375 */
+       if (bus->sih->buscorerev <= 64) {
+               OSL_DELAY(100);
+       }
+       return OSL_PCI_READ_CONFIG(bus->osh, offset, size);
+}
+
+static INLINE uint32
+dhd_pcie_corereg_read(si_t *sih, uint val)
+{
+       /* For 4375 or prior chips to 4375 */
+       if (sih->buscorerev <= 64) {
+               OSL_DELAY(100);
+       }
+       si_corereg(sih, sih->buscoreidx, OFFSETOF(sbpcieregs_t, configaddr), ~0, val);
+       return si_corereg(sih, sih->buscoreidx, OFFSETOF(sbpcieregs_t, configdata), 0, 0);
+}
+
+extern int dhdpcie_get_fwpath_otp(dhd_bus_t *bus, char *fw_path, char *nv_path,
+               char *clm_path, char *txcap_path);
+
+extern int dhd_pcie_debug_info_dump(dhd_pub_t *dhd);
+extern void dhd_pcie_intr_count_dump(dhd_pub_t *dhd);
+extern void dhdpcie_bus_clear_intstatus(dhd_bus_t *bus);
+
+extern int dhd_get_pcie_linkspeed(dhd_pub_t *dhd);
+extern void dhdpcie_bar1_window_switch_enab(dhd_bus_t *bus);
+
+#endif /* dhd_pcie_h */
diff --git a/bcmdhd.101.10.240.x/dhd_pcie_linux.c b/bcmdhd.101.10.240.x/dhd_pcie_linux.c
new file mode 100644 (file)
index 0000000..9422b5b
--- /dev/null
@@ -0,0 +1,3023 @@
+/*
+ * Linux DHD Bus Module for PCIE
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+/* include files */
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <bcmdevs.h>
+#include <bcmdevs_legacy.h>    /* need to still support chips no longer in trunk firmware */
+#include <siutils.h>
+#include <hndsoc.h>
+#include <hndpmu.h>
+#include <sbchipc.h>
+#if defined(DHD_DEBUG)
+#include <hnd_armtrap.h>
+#include <hnd_cons.h>
+#endif /* defined(DHD_DEBUG) */
+#include <dngl_stats.h>
+#include <pcie_core.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#include <dhdioctl.h>
+#include <bcmmsgbuf.h>
+#include <pcicfg.h>
+#include <dhd_pcie.h>
+#include <dhd_linux.h>
+#ifdef CONFIG_ARCH_MSM
+#if defined(CONFIG_PCI_MSM) || defined(CONFIG_ARCH_MSM8996)
+#include <linux/msm_pcie.h>
+#else
+#include <mach/msm_pcie.h>
+#endif /* CONFIG_PCI_MSM */
+#endif /* CONFIG_ARCH_MSM */
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+#include <linux/pm_runtime.h>
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#if defined(CONFIG_SOC_EXYNOS9830)
+#include <linux/exynos-pci-ctrl.h>
+#endif /* CONFIG_SOC_EXYNOS9830 */
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+#ifndef AUTO_SUSPEND_TIMEOUT
+#define AUTO_SUSPEND_TIMEOUT 1000
+#endif /* AUTO_SUSPEND_TIMEOUT */
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#ifdef DHD_PCIE_RUNTIMEPM
+#define RPM_WAKE_UP_TIMEOUT 10000 /* ms */
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+#include <linux/irq.h>
+#ifdef USE_SMMU_ARCH_MSM
+#include <asm/dma-iommu.h>
+#include <linux/iommu.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#endif /* USE_SMMU_ARCH_MSM */
+
+#define PCI_CFG_RETRY          10      /* PR15065: retry count for pci cfg accesses */
+#define OS_HANDLE_MAGIC                0x1234abcd      /* Magic # to recognize osh */
+#define BCM_MEM_FILENAME_LEN   24              /* Mem. filename length */
+
+#ifdef FORCE_TPOWERON
+extern uint32 tpoweron_scale;
+#endif /* FORCE_TPOWERON */
+/* user defined data structures  */
+
+typedef bool (*dhdpcie_cb_fn_t)(void *);
+
+typedef struct dhdpcie_info
+{
+       dhd_bus_t       *bus;
+       osl_t           *osh;
+       struct pci_dev  *dev;           /* pci device handle */
+       volatile char   *regs;          /* pci device memory va */
+       volatile char   *tcm;           /* pci device memory va */
+       uint32          bar1_size;      /* pci device memory size */
+       struct pcos_info *pcos_info;
+       uint16          last_intrstatus;        /* to cache intrstatus */
+       int     irq;
+       char pciname[32];
+       struct pci_saved_state* default_state;
+       struct pci_saved_state* state;
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       void *os_cxt;                   /* Pointer to per-OS private data */
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef DHD_WAKE_STATUS
+       spinlock_t      pkt_wake_lock;
+       unsigned int    total_wake_count;
+       int             pkt_wake;
+       int             wake_irq;
+#endif /* DHD_WAKE_STATUS */
+#ifdef USE_SMMU_ARCH_MSM
+       void *smmu_cxt;
+#endif /* USE_SMMU_ARCH_MSM */
+} dhdpcie_info_t;
+
+struct pcos_info {
+       dhdpcie_info_t *pc;
+       spinlock_t lock;
+       wait_queue_head_t intr_wait_queue;
+       timer_list_compat_t tuning_timer;
+       int tuning_timer_exp;
+       atomic_t timer_enab;
+       struct tasklet_struct tuning_tasklet;
+};
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+typedef struct dhdpcie_os_info {
+       int                     oob_irq_num;    /* valid when hardware or software oob in use */
+       unsigned long           oob_irq_flags;  /* valid when hardware or software oob in use */
+       bool                    oob_irq_registered;
+       bool                    oob_irq_enabled;
+       bool                    oob_irq_wake_enabled;
+       spinlock_t              oob_irq_spinlock;
+       void                    *dev;           /* handle to the underlying device */
+} dhdpcie_os_info_t;
+static irqreturn_t wlan_oob_irq(int irq, void *data);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+#ifdef USE_SMMU_ARCH_MSM
+typedef struct dhdpcie_smmu_info {
+       struct dma_iommu_mapping *smmu_mapping;
+       dma_addr_t smmu_iova_start;
+       size_t smmu_iova_len;
+} dhdpcie_smmu_info_t;
+#endif /* USE_SMMU_ARCH_MSM */
+
+/* function declarations */
+static int __devinit
+dhdpcie_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent);
+static void __devexit
+dhdpcie_pci_remove(struct pci_dev *pdev);
+static int dhdpcie_init(struct pci_dev *pdev);
+static irqreturn_t dhdpcie_isr(int irq, void *arg);
+/* OS Routine functions for PCI suspend/resume */
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+static int dhdpcie_set_suspend_resume(struct pci_dev *dev, bool state, bool byint);
+#else
+static int dhdpcie_set_suspend_resume(dhd_bus_t *bus, bool state);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+static int dhdpcie_resume_host_dev(dhd_bus_t *bus);
+static int dhdpcie_suspend_host_dev(dhd_bus_t *bus);
+static int dhdpcie_resume_dev(struct pci_dev *dev);
+static int dhdpcie_suspend_dev(struct pci_dev *dev);
+#ifdef DHD_PCIE_RUNTIMEPM
+static int dhdpcie_pm_suspend(struct device *dev);
+static int dhdpcie_pm_prepare(struct device *dev);
+static int dhdpcie_pm_resume(struct device *dev);
+static void dhdpcie_pm_complete(struct device *dev);
+#else
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+static int dhdpcie_pm_system_suspend_noirq(struct device * dev);
+static int dhdpcie_pm_system_resume_noirq(struct device * dev);
+#else
+static int dhdpcie_pci_suspend(struct pci_dev *dev, pm_message_t state);
+static int dhdpcie_pci_resume(struct pci_dev *dev);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+static int dhdpcie_pm_runtime_suspend(struct device * dev);
+static int dhdpcie_pm_runtime_resume(struct device * dev);
+static int dhdpcie_pm_system_suspend_noirq(struct device * dev);
+static int dhdpcie_pm_system_resume_noirq(struct device * dev);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#ifdef SUPPORT_EXYNOS7420
+void exynos_pcie_pm_suspend(int ch_num) {}
+void exynos_pcie_pm_resume(int ch_num) {}
+#endif /* SUPPORT_EXYNOS7420 */
+
+static void dhdpcie_config_save_restore_coherent(dhd_bus_t *bus, bool state);
+
+uint32
+dhdpcie_access_cap(struct pci_dev *pdev, int cap, uint offset, bool is_ext, bool is_write,
+       uint32 writeval);
+
+static struct pci_device_id dhdpcie_pci_devid[] __devinitdata = {
+       { vendor: 0x14e4,
+       device: PCI_ANY_ID,
+       subvendor: PCI_ANY_ID,
+       subdevice: PCI_ANY_ID,
+       class: PCI_CLASS_NETWORK_OTHER << 8,
+       class_mask: 0xffff00,
+       driver_data: 0,
+       },
+       { 0, 0, 0, 0, 0, 0, 0}
+};
+MODULE_DEVICE_TABLE(pci, dhdpcie_pci_devid);
+
+/* Power Management Hooks */
+#ifdef DHD_PCIE_RUNTIMEPM
+static const struct dev_pm_ops dhd_pcie_pm_ops = {
+       .prepare = dhdpcie_pm_prepare,
+       .suspend = dhdpcie_pm_suspend,
+       .resume = dhdpcie_pm_resume,
+       .complete = dhdpcie_pm_complete,
+};
+#endif /* DHD_PCIE_RUNTIMEPM */
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+static const struct dev_pm_ops dhdpcie_pm_ops = {
+       SET_RUNTIME_PM_OPS(dhdpcie_pm_runtime_suspend, dhdpcie_pm_runtime_resume, NULL)
+       .suspend_noirq = dhdpcie_pm_system_suspend_noirq,
+       .resume_noirq = dhdpcie_pm_system_resume_noirq
+};
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+static struct pci_driver dhdpcie_driver = {
+       node:           {&dhdpcie_driver.node, &dhdpcie_driver.node},
+       name:           "pcieh",
+       id_table:       dhdpcie_pci_devid,
+       probe:          dhdpcie_pci_probe,
+       remove:         dhdpcie_pci_remove,
+#if defined(DHD_PCIE_RUNTIMEPM) || defined(DHD_PCIE_NATIVE_RUNTIMEPM)
+       .driver.pm = &dhd_pcie_pm_ops,
+#else
+       suspend:        dhdpcie_pci_suspend,
+       resume:         dhdpcie_pci_resume,
+#endif /* DHD_PCIE_RUNTIMEPM || DHD_PCIE_NATIVE_RUNTIMEPM */
+};
+
+int dhdpcie_init_succeeded = FALSE;
+
+#ifdef USE_SMMU_ARCH_MSM
+static int dhdpcie_smmu_init(struct pci_dev *pdev, void *smmu_cxt)
+{
+       struct dma_iommu_mapping *mapping;
+       struct device_node *root_node = NULL;
+       dhdpcie_smmu_info_t *smmu_info = (dhdpcie_smmu_info_t *)smmu_cxt;
+       int smmu_iova_address[2];
+       char *wlan_node = "android,bcmdhd_wlan";
+       char *wlan_smmu_node = "wlan-smmu-iova-address";
+       int atomic_ctx = 1;
+       int s1_bypass = 1;
+       int ret = 0;
+
+       DHD_ERROR(("%s: SMMU initialize\n", __FUNCTION__));
+
+       root_node = of_find_compatible_node(NULL, NULL, wlan_node);
+       if (!root_node) {
+               WARN(1, "failed to get device node of BRCM WLAN\n");
+               return -ENODEV;
+       }
+
+       if (of_property_read_u32_array(root_node, wlan_smmu_node,
+               smmu_iova_address, 2) == 0) {
+               DHD_ERROR(("%s : get SMMU start address 0x%x, size 0x%x\n",
+                       __FUNCTION__, smmu_iova_address[0], smmu_iova_address[1]));
+               smmu_info->smmu_iova_start = smmu_iova_address[0];
+               smmu_info->smmu_iova_len = smmu_iova_address[1];
+       } else {
+               printf("%s : can't get smmu iova address property\n",
+                       __FUNCTION__);
+               return -ENODEV;
+       }
+
+       if (smmu_info->smmu_iova_len <= 0) {
+               DHD_ERROR(("%s: Invalid smmu iova len %d\n",
+                       __FUNCTION__, (int)smmu_info->smmu_iova_len));
+               return -EINVAL;
+       }
+
+       DHD_ERROR(("%s : SMMU init start\n", __FUNCTION__));
+
+       if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) ||
+               pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) {
+               DHD_ERROR(("%s: DMA set 64bit mask failed.\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       mapping = arm_iommu_create_mapping(&platform_bus_type,
+               smmu_info->smmu_iova_start, smmu_info->smmu_iova_len);
+       if (IS_ERR(mapping)) {
+               DHD_ERROR(("%s: create mapping failed, err = %d\n",
+                       __FUNCTION__, ret));
+               ret = PTR_ERR(mapping);
+               goto map_fail;
+       }
+
+       ret = iommu_domain_set_attr(mapping->domain,
+               DOMAIN_ATTR_ATOMIC, &atomic_ctx);
+       if (ret) {
+               DHD_ERROR(("%s: set atomic_ctx attribute failed, err = %d\n",
+                       __FUNCTION__, ret));
+               goto set_attr_fail;
+       }
+
+       ret = iommu_domain_set_attr(mapping->domain,
+               DOMAIN_ATTR_S1_BYPASS, &s1_bypass);
+       if (ret < 0) {
+               DHD_ERROR(("%s: set s1_bypass attribute failed, err = %d\n",
+                       __FUNCTION__, ret));
+               goto set_attr_fail;
+       }
+
+       ret = arm_iommu_attach_device(&pdev->dev, mapping);
+       if (ret) {
+               DHD_ERROR(("%s: attach device failed, err = %d\n",
+                       __FUNCTION__, ret));
+               goto attach_fail;
+       }
+
+       smmu_info->smmu_mapping = mapping;
+
+       return ret;
+
+attach_fail:
+set_attr_fail:
+       arm_iommu_release_mapping(mapping);
+map_fail:
+       return ret;
+}
+
+static void dhdpcie_smmu_remove(struct pci_dev *pdev, void *smmu_cxt)
+{
+       dhdpcie_smmu_info_t *smmu_info;
+
+       if (!smmu_cxt) {
+               return;
+       }
+
+       smmu_info = (dhdpcie_smmu_info_t *)smmu_cxt;
+       if (smmu_info->smmu_mapping) {
+               arm_iommu_detach_device(&pdev->dev);
+               arm_iommu_release_mapping(smmu_info->smmu_mapping);
+               smmu_info->smmu_mapping = NULL;
+       }
+}
+#endif /* USE_SMMU_ARCH_MSM */
+
+#ifdef FORCE_TPOWERON
+static void
+dhd_bus_get_tpoweron(dhd_bus_t *bus)
+{
+
+       uint32 tpoweron_rc;
+       uint32 tpoweron_ep;
+
+       tpoweron_rc = dhdpcie_rc_access_cap(bus, PCIE_EXTCAP_ID_L1SS,
+               PCIE_EXTCAP_L1SS_CONTROL2_OFFSET, TRUE, FALSE, 0);
+       tpoweron_ep = dhdpcie_ep_access_cap(bus, PCIE_EXTCAP_ID_L1SS,
+               PCIE_EXTCAP_L1SS_CONTROL2_OFFSET, TRUE, FALSE, 0);
+       DHD_ERROR(("%s: tpoweron_rc:0x%x tpoweron_ep:0x%x\n",
+               __FUNCTION__, tpoweron_rc, tpoweron_ep));
+}
+
+static void
+dhd_bus_set_tpoweron(dhd_bus_t *bus, uint16 tpoweron)
+{
+
+       dhd_bus_get_tpoweron(bus);
+       /* Set the tpoweron */
+       DHD_ERROR(("%s tpoweron: 0x%x\n", __FUNCTION__, tpoweron));
+       dhdpcie_rc_access_cap(bus, PCIE_EXTCAP_ID_L1SS,
+               PCIE_EXTCAP_L1SS_CONTROL2_OFFSET, TRUE, TRUE, tpoweron);
+       dhdpcie_ep_access_cap(bus, PCIE_EXTCAP_ID_L1SS,
+               PCIE_EXTCAP_L1SS_CONTROL2_OFFSET, TRUE, TRUE, tpoweron);
+
+       dhd_bus_get_tpoweron(bus);
+
+}
+
+static bool
+dhdpcie_chip_req_forced_tpoweron(dhd_bus_t *bus)
+{
+       /*
+        * On Fire's reference platform, coming out of L1.2,
+        * there is a constant delay of 45us between CLKREQ# and stable REFCLK
+        * Due to this delay, with tPowerOn < 50
+        * there is a chance of the refclk sense to trigger on noise.
+        *
+        * Which ever chip needs forced tPowerOn of 50us should be listed below.
+        */
+       if (si_chipid(bus->sih) == BCM4377_CHIP_ID) {
+               return TRUE;
+       }
+       return FALSE;
+}
+#endif /* FORCE_TPOWERON */
+
+static bool
+dhd_bus_aspm_enable_dev(dhd_bus_t *bus, struct pci_dev *dev, bool enable)
+{
+       uint32 linkctrl_before;
+       uint32 linkctrl_after = 0;
+       uint8 linkctrl_asm;
+       char *device;
+
+       device = (dev == bus->dev) ? "EP" : "RC";
+
+       linkctrl_before = dhdpcie_access_cap(dev, PCIE_CAP_ID_EXP, PCIE_CAP_LINKCTRL_OFFSET,
+               FALSE, FALSE, 0);
+       linkctrl_asm = (linkctrl_before & PCIE_ASPM_CTRL_MASK);
+
+       if (enable) {
+               if (linkctrl_asm == PCIE_ASPM_L1_ENAB) {
+                       DHD_ERROR(("%s: %s already enabled  linkctrl: 0x%x\n",
+                               __FUNCTION__, device, linkctrl_before));
+                       return FALSE;
+               }
+               /* Enable only L1 ASPM (bit 1) */
+               dhdpcie_access_cap(dev, PCIE_CAP_ID_EXP, PCIE_CAP_LINKCTRL_OFFSET, FALSE,
+                       TRUE, (linkctrl_before | PCIE_ASPM_L1_ENAB));
+       } else {
+               if (linkctrl_asm == 0) {
+                       DHD_ERROR(("%s: %s already disabled linkctrl: 0x%x\n",
+                               __FUNCTION__, device, linkctrl_before));
+                       return FALSE;
+               }
+               /* Disable complete ASPM (bit 1 and bit 0) */
+               dhdpcie_access_cap(dev, PCIE_CAP_ID_EXP, PCIE_CAP_LINKCTRL_OFFSET, FALSE,
+                       TRUE, (linkctrl_before & (~PCIE_ASPM_ENAB)));
+       }
+
+       linkctrl_after = dhdpcie_access_cap(dev, PCIE_CAP_ID_EXP, PCIE_CAP_LINKCTRL_OFFSET,
+               FALSE, FALSE, 0);
+       DHD_ERROR(("%s: %s %s, linkctrl_before: 0x%x linkctrl_after: 0x%x\n",
+               __FUNCTION__, device, (enable ? "ENABLE " : "DISABLE"),
+               linkctrl_before, linkctrl_after));
+
+       return TRUE;
+}
+
+static bool
+dhd_bus_is_rc_ep_aspm_capable(dhd_bus_t *bus)
+{
+       uint32 rc_aspm_cap;
+       uint32 ep_aspm_cap;
+
+       /* RC ASPM capability */
+       rc_aspm_cap = dhdpcie_access_cap(bus->rc_dev, PCIE_CAP_ID_EXP, PCIE_CAP_LINKCTRL_OFFSET,
+               FALSE, FALSE, 0);
+       if (rc_aspm_cap == BCME_ERROR) {
+               DHD_ERROR(("%s RC is not ASPM capable\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       /* EP ASPM capability */
+       ep_aspm_cap = dhdpcie_access_cap(bus->dev, PCIE_CAP_ID_EXP, PCIE_CAP_LINKCTRL_OFFSET,
+               FALSE, FALSE, 0);
+       if (ep_aspm_cap == BCME_ERROR) {
+               DHD_ERROR(("%s EP is not ASPM capable\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       return TRUE;
+}
+
+bool
+dhd_bus_aspm_enable_rc_ep(dhd_bus_t *bus, bool enable)
+{
+       bool ret;
+
+       if (!bus->rc_ep_aspm_cap) {
+               DHD_ERROR(("%s: NOT ASPM  CAPABLE rc_ep_aspm_cap: %d\n",
+                       __FUNCTION__, bus->rc_ep_aspm_cap));
+               return FALSE;
+       }
+
+       if (enable) {
+               /* Enable only L1 ASPM first RC then EP */
+               ret = dhd_bus_aspm_enable_dev(bus, bus->rc_dev, enable);
+               ret = dhd_bus_aspm_enable_dev(bus, bus->dev, enable);
+       } else {
+               /* Disable complete ASPM first EP then RC */
+               ret = dhd_bus_aspm_enable_dev(bus, bus->dev, enable);
+               ret = dhd_bus_aspm_enable_dev(bus, bus->rc_dev, enable);
+       }
+
+       return ret;
+}
+
+static void
+dhd_bus_l1ss_enable_dev(dhd_bus_t *bus, struct pci_dev *dev, bool enable)
+{
+       uint32 l1ssctrl_before;
+       uint32 l1ssctrl_after = 0;
+       uint8 l1ss_ep;
+       char *device;
+
+       device = (dev == bus->dev) ? "EP" : "RC";
+
+       /* Extendend Capacility Reg */
+       l1ssctrl_before = dhdpcie_access_cap(dev, PCIE_EXTCAP_ID_L1SS,
+               PCIE_EXTCAP_L1SS_CONTROL_OFFSET, TRUE, FALSE, 0);
+       l1ss_ep = (l1ssctrl_before & PCIE_EXT_L1SS_MASK);
+
+       if (enable) {
+               if (l1ss_ep == PCIE_EXT_L1SS_ENAB) {
+                       DHD_ERROR(("%s: %s already enabled,  l1ssctrl: 0x%x\n",
+                               __FUNCTION__, device, l1ssctrl_before));
+                       return;
+               }
+               dhdpcie_access_cap(dev, PCIE_EXTCAP_ID_L1SS, PCIE_EXTCAP_L1SS_CONTROL_OFFSET,
+                       TRUE, TRUE, (l1ssctrl_before | PCIE_EXT_L1SS_ENAB));
+       } else {
+               if (l1ss_ep == 0) {
+                       DHD_ERROR(("%s: %s already disabled, l1ssctrl: 0x%x\n",
+                               __FUNCTION__, device, l1ssctrl_before));
+                       return;
+               }
+               dhdpcie_access_cap(dev, PCIE_EXTCAP_ID_L1SS, PCIE_EXTCAP_L1SS_CONTROL_OFFSET,
+                       TRUE, TRUE, (l1ssctrl_before & (~PCIE_EXT_L1SS_ENAB)));
+       }
+       l1ssctrl_after = dhdpcie_access_cap(dev, PCIE_EXTCAP_ID_L1SS,
+               PCIE_EXTCAP_L1SS_CONTROL_OFFSET, TRUE, FALSE, 0);
+       DHD_ERROR(("%s: %s %s, l1ssctrl_before: 0x%x l1ssctrl_after: 0x%x\n",
+               __FUNCTION__, device, (enable ? "ENABLE " : "DISABLE"),
+               l1ssctrl_before, l1ssctrl_after));
+
+}
+
+static bool
+dhd_bus_is_rc_ep_l1ss_capable(dhd_bus_t *bus)
+{
+       uint32 rc_l1ss_cap;
+       uint32 ep_l1ss_cap;
+
+       /* RC Extendend Capacility */
+       rc_l1ss_cap = dhdpcie_access_cap(bus->rc_dev, PCIE_EXTCAP_ID_L1SS,
+               PCIE_EXTCAP_L1SS_CONTROL_OFFSET, TRUE, FALSE, 0);
+       if (rc_l1ss_cap == BCME_ERROR) {
+               DHD_ERROR(("%s RC is not l1ss capable\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       /* EP Extendend Capacility */
+       ep_l1ss_cap = dhdpcie_access_cap(bus->dev, PCIE_EXTCAP_ID_L1SS,
+               PCIE_EXTCAP_L1SS_CONTROL_OFFSET, TRUE, FALSE, 0);
+       if (ep_l1ss_cap == BCME_ERROR) {
+               DHD_ERROR(("%s EP is not l1ss capable\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       return TRUE;
+}
+
+void
+dhd_bus_l1ss_enable_rc_ep(dhd_bus_t *bus, bool enable)
+{
+       bool ret;
+
+       if ((!bus->rc_ep_aspm_cap) || (!bus->rc_ep_l1ss_cap)) {
+               DHD_ERROR(("%s: NOT L1SS CAPABLE rc_ep_aspm_cap: %d rc_ep_l1ss_cap: %d\n",
+                       __FUNCTION__, bus->rc_ep_aspm_cap, bus->rc_ep_l1ss_cap));
+               return;
+       }
+
+       /* Disable ASPM of RC and EP */
+       ret = dhd_bus_aspm_enable_rc_ep(bus, FALSE);
+
+       if (enable) {
+               /* Enable RC then EP */
+               dhd_bus_l1ss_enable_dev(bus, bus->rc_dev, enable);
+               dhd_bus_l1ss_enable_dev(bus, bus->dev, enable);
+       } else {
+               /* Disable EP then RC */
+               dhd_bus_l1ss_enable_dev(bus, bus->dev, enable);
+               dhd_bus_l1ss_enable_dev(bus, bus->rc_dev, enable);
+       }
+
+       /* Enable ASPM of RC and EP only if this API disabled */
+       if (ret == TRUE) {
+               dhd_bus_aspm_enable_rc_ep(bus, TRUE);
+       }
+}
+
+void
+dhd_bus_aer_config(dhd_bus_t *bus)
+{
+       uint32 val;
+
+       DHD_ERROR(("%s: Configure AER registers for EP\n", __FUNCTION__));
+       val = dhdpcie_ep_access_cap(bus, PCIE_ADVERRREP_CAPID,
+               PCIE_ADV_CORR_ERR_MASK_OFFSET, TRUE, FALSE, 0);
+       if (val != (uint32)-1) {
+               val &= ~CORR_ERR_AE;
+               dhdpcie_ep_access_cap(bus, PCIE_ADVERRREP_CAPID,
+                       PCIE_ADV_CORR_ERR_MASK_OFFSET, TRUE, TRUE, val);
+       } else {
+               DHD_ERROR(("%s: Invalid EP's PCIE_ADV_CORR_ERR_MASK: 0x%x\n",
+                       __FUNCTION__, val));
+       }
+
+       DHD_ERROR(("%s: Configure AER registers for RC\n", __FUNCTION__));
+       val = dhdpcie_rc_access_cap(bus, PCIE_ADVERRREP_CAPID,
+               PCIE_ADV_CORR_ERR_MASK_OFFSET, TRUE, FALSE, 0);
+       if (val != (uint32)-1) {
+               val &= ~CORR_ERR_AE;
+               dhdpcie_rc_access_cap(bus, PCIE_ADVERRREP_CAPID,
+                       PCIE_ADV_CORR_ERR_MASK_OFFSET, TRUE, TRUE, val);
+       } else {
+               DHD_ERROR(("%s: Invalid RC's PCIE_ADV_CORR_ERR_MASK: 0x%x\n",
+                       __FUNCTION__, val));
+       }
+}
+
+#ifdef DHD_PCIE_RUNTIMEPM
+static int dhdpcie_pm_suspend(struct device *dev)
+{
+       int ret = 0;
+       struct pci_dev *pdev = to_pci_dev(dev);
+       dhdpcie_info_t *pch = pci_get_drvdata(pdev);
+       dhd_bus_t *bus = NULL;
+       unsigned long flags;
+
+       if (pch) {
+               bus = pch->bus;
+       }
+       if (!bus) {
+               return ret;
+       }
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       if (!DHD_BUS_BUSY_CHECK_IDLE(bus->dhd)) {
+               DHD_ERROR(("%s: Bus not IDLE!! dhd_bus_busy_state = 0x%x\n",
+                       __FUNCTION__, bus->dhd->dhd_bus_busy_state));
+               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+               return -EBUSY;
+       }
+       DHD_BUS_BUSY_SET_SUSPEND_IN_PROGRESS(bus->dhd);
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+       if (!bus->dhd->dongle_reset)
+               ret = dhdpcie_set_suspend_resume(bus, TRUE);
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       DHD_BUS_BUSY_CLEAR_SUSPEND_IN_PROGRESS(bus->dhd);
+       dhd_os_busbusy_wake(bus->dhd);
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+       return ret;
+
+}
+
+static int dhdpcie_pm_prepare(struct device *dev)
+{
+       struct pci_dev *pdev = to_pci_dev(dev);
+       dhdpcie_info_t *pch = pci_get_drvdata(pdev);
+       dhd_bus_t *bus = NULL;
+
+       if (!pch || !pch->bus) {
+               return 0;
+       }
+
+       bus = pch->bus;
+       DHD_DISABLE_RUNTIME_PM(bus->dhd);
+       bus->chk_pm = TRUE;
+
+       return 0;
+}
+
+static int dhdpcie_pm_resume(struct device *dev)
+{
+       int ret = 0;
+       struct pci_dev *pdev = to_pci_dev(dev);
+       dhdpcie_info_t *pch = pci_get_drvdata(pdev);
+       dhd_bus_t *bus = NULL;
+       unsigned long flags;
+
+       if (pch) {
+               bus = pch->bus;
+       }
+       if (!bus) {
+               return ret;
+       }
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       DHD_BUS_BUSY_SET_RESUME_IN_PROGRESS(bus->dhd);
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+       if (!bus->dhd->dongle_reset)
+               ret = dhdpcie_set_suspend_resume(bus, FALSE);
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       DHD_BUS_BUSY_CLEAR_RESUME_IN_PROGRESS(bus->dhd);
+       dhd_os_busbusy_wake(bus->dhd);
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+       return ret;
+}
+
+static void dhdpcie_pm_complete(struct device *dev)
+{
+       struct pci_dev *pdev = to_pci_dev(dev);
+       dhdpcie_info_t *pch = pci_get_drvdata(pdev);
+       dhd_bus_t *bus = NULL;
+
+       if (!pch || !pch->bus) {
+               return;
+       }
+
+       bus = pch->bus;
+       DHD_ENABLE_RUNTIME_PM(bus->dhd);
+       bus->chk_pm = FALSE;
+
+       return;
+}
+#else
+static int dhdpcie_pci_suspend(struct pci_dev * pdev, pm_message_t state)
+{
+       int ret = 0;
+       dhdpcie_info_t *pch = pci_get_drvdata(pdev);
+       dhd_bus_t *bus = NULL;
+       unsigned long flags;
+       uint32 i = 0;
+
+       if (pch) {
+               bus = pch->bus;
+       }
+       if (!bus) {
+               return ret;
+       }
+
+       BCM_REFERENCE(state);
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       if (!DHD_BUS_BUSY_CHECK_IDLE(bus->dhd)) {
+               DHD_ERROR(("%s: Bus not IDLE!! dhd_bus_busy_state = 0x%x\n",
+                       __FUNCTION__, bus->dhd->dhd_bus_busy_state));
+
+               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+               OSL_DELAY(1000);
+               /* retry till the transaction is complete */
+               while (i < 100) {
+                       OSL_DELAY(1000);
+                       i++;
+
+                       DHD_GENERAL_LOCK(bus->dhd, flags);
+                       if (DHD_BUS_BUSY_CHECK_IDLE(bus->dhd)) {
+                               DHD_ERROR(("%s: Bus enter IDLE!! after %d ms\n",
+                                       __FUNCTION__, i));
+                               break;
+                       }
+                       if (i != 100) {
+                               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+                       }
+               }
+               if (!DHD_BUS_BUSY_CHECK_IDLE(bus->dhd)) {
+                       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+                       DHD_ERROR(("%s: Bus not IDLE!! Failed after %d ms, "
+                               "dhd_bus_busy_state = 0x%x\n",
+                               __FUNCTION__, i, bus->dhd->dhd_bus_busy_state));
+                       return -EBUSY;
+               }
+       }
+       DHD_BUS_BUSY_SET_SUSPEND_IN_PROGRESS(bus->dhd);
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+#ifdef DHD_CFG80211_SUSPEND_RESUME
+       dhd_cfg80211_suspend(bus->dhd);
+#endif /* DHD_CFG80211_SUSPEND_RESUME */
+
+       if (!bus->dhd->dongle_reset)
+               ret = dhdpcie_set_suspend_resume(bus, TRUE);
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       DHD_BUS_BUSY_CLEAR_SUSPEND_IN_PROGRESS(bus->dhd);
+       dhd_os_busbusy_wake(bus->dhd);
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+       return ret;
+}
+
+static int dhdpcie_pci_resume(struct pci_dev *pdev)
+{
+       int ret = 0;
+       dhdpcie_info_t *pch = pci_get_drvdata(pdev);
+       dhd_bus_t *bus = NULL;
+       unsigned long flags;
+
+       if (pch) {
+               bus = pch->bus;
+       }
+       if (!bus) {
+               return ret;
+       }
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       DHD_BUS_BUSY_SET_RESUME_IN_PROGRESS(bus->dhd);
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+       if (!bus->dhd->dongle_reset)
+               ret = dhdpcie_set_suspend_resume(bus, FALSE);
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       DHD_BUS_BUSY_CLEAR_RESUME_IN_PROGRESS(bus->dhd);
+       dhd_os_busbusy_wake(bus->dhd);
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+#ifdef DHD_CFG80211_SUSPEND_RESUME
+       dhd_cfg80211_resume(bus->dhd);
+#endif /* DHD_CFG80211_SUSPEND_RESUME */
+       return ret;
+}
+
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+static int
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+dhdpcie_set_suspend_resume(dhd_bus_t *bus, bool state, bool byint)
+#else
+dhdpcie_set_suspend_resume(dhd_bus_t *bus, bool state)
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+{
+       int ret = 0;
+
+       ASSERT(bus && !bus->dhd->dongle_reset);
+
+#ifdef DHD_PCIE_RUNTIMEPM
+               /* if wakelock is held during suspend, return failed */
+               if (state == TRUE && dhd_os_check_wakelock_all(bus->dhd)) {
+                       return -EBUSY;
+               }
+               mutex_lock(&bus->pm_lock);
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       /* When firmware is not loaded do the PCI bus */
+       /* suspend/resume only */
+       if (bus->dhd->busstate == DHD_BUS_DOWN) {
+               ret = dhdpcie_pci_suspend_resume(bus, state);
+#ifdef DHD_PCIE_RUNTIMEPM
+               mutex_unlock(&bus->pm_lock);
+#endif /* DHD_PCIE_RUNTIMEPM */
+               return ret;
+       }
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+               ret = dhdpcie_bus_suspend(bus, state, byint);
+#else
+               ret = dhdpcie_bus_suspend(bus, state);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#ifdef DHD_PCIE_RUNTIMEPM
+               mutex_unlock(&bus->pm_lock);
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       return ret;
+}
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+static int dhdpcie_pm_runtime_suspend(struct device * dev)
+{
+       struct pci_dev *pdev = to_pci_dev(dev);
+       dhdpcie_info_t *pch = pci_get_drvdata(pdev);
+       dhd_bus_t *bus = NULL;
+       int ret = 0;
+
+       if (!pch)
+               return -EBUSY;
+
+       bus = pch->bus;
+
+       DHD_RPM(("%s Enter\n", __FUNCTION__));
+
+       if (atomic_read(&bus->dhd->block_bus))
+               return -EHOSTDOWN;
+
+       dhd_netif_stop_queue(bus);
+       atomic_set(&bus->dhd->block_bus, TRUE);
+
+       if (dhdpcie_set_suspend_resume(pdev, TRUE, TRUE)) {
+               pm_runtime_mark_last_busy(dev);
+               ret = -EAGAIN;
+       }
+
+       atomic_set(&bus->dhd->block_bus, FALSE);
+       dhd_bus_start_queue(bus);
+
+       return ret;
+}
+
+static int dhdpcie_pm_runtime_resume(struct device * dev)
+{
+       struct pci_dev *pdev = to_pci_dev(dev);
+       dhdpcie_info_t *pch = pci_get_drvdata(pdev);
+       dhd_bus_t *bus = pch->bus;
+
+       DHD_RPM(("%s Enter\n", __FUNCTION__));
+
+       if (atomic_read(&bus->dhd->block_bus))
+               return -EHOSTDOWN;
+
+       if (dhdpcie_set_suspend_resume(pdev, FALSE, TRUE))
+               return -EAGAIN;
+
+       return 0;
+}
+
+static int dhdpcie_pm_system_suspend_noirq(struct device * dev)
+{
+       struct pci_dev *pdev = to_pci_dev(dev);
+       dhdpcie_info_t *pch = pci_get_drvdata(pdev);
+       dhd_bus_t *bus = NULL;
+       int ret;
+
+       DHD_RPM(("%s Enter\n", __FUNCTION__));
+
+       if (!pch)
+               return -EBUSY;
+
+       bus = pch->bus;
+
+       if (atomic_read(&bus->dhd->block_bus))
+               return -EHOSTDOWN;
+
+       dhd_netif_stop_queue(bus);
+       atomic_set(&bus->dhd->block_bus, TRUE);
+
+       ret = dhdpcie_set_suspend_resume(pdev, TRUE, FALSE);
+
+       if (ret) {
+               dhd_bus_start_queue(bus);
+               atomic_set(&bus->dhd->block_bus, FALSE);
+       }
+
+       return ret;
+}
+
+static int dhdpcie_pm_system_resume_noirq(struct device * dev)
+{
+       struct pci_dev *pdev = to_pci_dev(dev);
+       dhdpcie_info_t *pch = pci_get_drvdata(pdev);
+       dhd_bus_t *bus = NULL;
+       int ret;
+
+       if (!pch)
+               return -EBUSY;
+
+       bus = pch->bus;
+
+       DHD_RPM(("%s Enter\n", __FUNCTION__));
+
+       ret = dhdpcie_set_suspend_resume(pdev, FALSE, FALSE);
+
+       atomic_set(&bus->dhd->block_bus, FALSE);
+       dhd_bus_start_queue(bus);
+       pm_runtime_mark_last_busy(dhd_bus_to_dev(bus));
+
+       return ret;
+}
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+extern void dhd_dpc_tasklet_kill(dhd_pub_t *dhdp);
+#endif /* OEM_ANDROID && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+
+static void
+dhdpcie_suspend_dump_cfgregs(struct dhd_bus *bus, char *suspend_state)
+{
+       DHD_ERROR(("%s: BaseAddress0(0x%x)=0x%x, "
+               "BaseAddress1(0x%x)=0x%x PCIE_CFG_PMCSR(0x%x)=0x%x "
+               "PCI_BAR1_WIN(0x%x)=(0x%x)\n",
+               suspend_state,
+               PCIECFGREG_BASEADDR0,
+               dhd_pcie_config_read(bus,
+                       PCIECFGREG_BASEADDR0, sizeof(uint32)),
+               PCIECFGREG_BASEADDR1,
+               dhd_pcie_config_read(bus,
+                       PCIECFGREG_BASEADDR1, sizeof(uint32)),
+               PCIE_CFG_PMCSR,
+               dhd_pcie_config_read(bus,
+                       PCIE_CFG_PMCSR, sizeof(uint32)),
+               PCI_BAR1_WIN,
+               dhd_pcie_config_read(bus,
+                       PCI_BAR1_WIN, sizeof(uint32))));
+}
+
+static int dhdpcie_suspend_dev(struct pci_dev *dev)
+{
+       int ret;
+       dhdpcie_info_t *pch = pci_get_drvdata(dev);
+       dhd_bus_t *bus = pch->bus;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link is down\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+#endif /* OEM_ANDROID && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+       DHD_ERROR(("%s: Enter\n", __FUNCTION__));
+#if defined(CONFIG_SOC_EXYNOS9830)
+       DHD_ERROR(("%s: Disable L1ss EP side\n", __FUNCTION__));
+       exynos_pcie_l1ss_ctrl(0, PCIE_L1SS_CTRL_WIFI);
+#endif /* CONFIG_SOC_EXYNOS9830 */
+       dhdpcie_suspend_dump_cfgregs(bus, "BEFORE_EP_SUSPEND");
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       dhd_dpc_tasklet_kill(bus->dhd);
+#endif /* OEM_ANDROID && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+       pci_save_state(dev);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       pch->state = pci_store_saved_state(dev);
+#endif /* OEM_ANDROID && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+       pci_enable_wake(dev, PCI_D0, TRUE);
+       if (pci_is_enabled(dev))
+               pci_disable_device(dev);
+
+       ret = pci_set_power_state(dev, PCI_D3hot);
+       if (ret) {
+               DHD_ERROR(("%s: pci_set_power_state error %d\n",
+                       __FUNCTION__, ret));
+       }
+//     dev->state_saved = FALSE;
+       dhdpcie_suspend_dump_cfgregs(bus, "AFTER_EP_SUSPEND");
+       return ret;
+}
+
+#ifdef DHD_WAKE_STATUS
+int bcmpcie_get_total_wake(struct dhd_bus *bus)
+{
+       dhdpcie_info_t *pch = pci_get_drvdata(bus->dev);
+
+       return pch->total_wake_count;
+}
+
+int bcmpcie_set_get_wake(struct dhd_bus *bus, int flag)
+{
+       dhdpcie_info_t *pch = pci_get_drvdata(bus->dev);
+       unsigned long flags;
+       int ret;
+
+       DHD_PKT_WAKE_LOCK(&pch->pkt_wake_lock, flags);
+
+       ret = pch->pkt_wake;
+       pch->total_wake_count += flag;
+       pch->pkt_wake = flag;
+
+       DHD_PKT_WAKE_UNLOCK(&pch->pkt_wake_lock, flags);
+       return ret;
+}
+#endif /* DHD_WAKE_STATUS */
+
+static int dhdpcie_resume_dev(struct pci_dev *dev)
+{
+       int err = 0;
+       dhdpcie_info_t *pch = pci_get_drvdata(dev);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       pci_load_and_free_saved_state(dev, &pch->state);
+#endif /* OEM_ANDROID && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+       DHD_ERROR(("%s: Enter\n", __FUNCTION__));
+//     dev->state_saved = TRUE;
+       pci_restore_state(dev);
+
+       /* Resture back current bar1 window */
+       OSL_PCI_WRITE_CONFIG(pch->bus->osh, PCI_BAR1_WIN, 4, pch->bus->curr_bar1_win);
+
+#ifdef FORCE_TPOWERON
+       if (dhdpcie_chip_req_forced_tpoweron(pch->bus)) {
+               dhd_bus_set_tpoweron(pch->bus, tpoweron_scale);
+       }
+#endif /* FORCE_TPOWERON */
+       err = pci_enable_device(dev);
+       if (err) {
+               printf("%s:pci_enable_device error %d \n", __FUNCTION__, err);
+               goto out;
+       }
+       pci_set_master(dev);
+       err = pci_set_power_state(dev, PCI_D0);
+       if (err) {
+               printf("%s:pci_set_power_state error %d \n", __FUNCTION__, err);
+               goto out;
+       }
+       BCM_REFERENCE(pch);
+       dhdpcie_suspend_dump_cfgregs(pch->bus, "AFTER_EP_RESUME");
+#if defined(CONFIG_SOC_EXYNOS9830)
+       DHD_ERROR(("%s: Enable L1ss EP side\n", __FUNCTION__));
+       exynos_pcie_l1ss_ctrl(1, PCIE_L1SS_CTRL_WIFI);
+#endif /* CONFIG_SOC_EXYNOS9830 */
+out:
+       return err;
+}
+
+static int dhdpcie_resume_host_dev(dhd_bus_t *bus)
+{
+       int bcmerror = 0;
+
+       bcmerror = dhdpcie_start_host_dev(bus);
+       if (bcmerror < 0) {
+               DHD_ERROR(("%s: PCIe RC resume failed!!! (%d)\n",
+                       __FUNCTION__, bcmerror));
+               bus->is_linkdown = 1;
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+               bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+       }
+
+       return bcmerror;
+}
+
+static int dhdpcie_suspend_host_dev(dhd_bus_t *bus)
+{
+       int bcmerror = 0;
+#ifdef CONFIG_ARCH_EXYNOS
+       /*
+        * XXX : SWWLAN-82173, SWWLAN-82183 WAR for SS PCIe RC
+        * SS PCIe RC/EP is 1 to 1 mapping using different channel
+        * RC0 - LTE, RC1 - WiFi RC0-1 is working independently
+        */
+
+       if (bus->rc_dev) {
+               pci_save_state(bus->rc_dev);
+       } else {
+               DHD_ERROR(("%s: RC %x:%x handle is NULL\n",
+                       __FUNCTION__, PCIE_RC_VENDOR_ID, PCIE_RC_DEVICE_ID));
+       }
+#endif /* CONFIG_ARCH_EXYNOS */
+       bcmerror = dhdpcie_stop_host_dev(bus);
+       return bcmerror;
+}
+
+int
+dhdpcie_set_master_and_d0_pwrstate(dhd_bus_t *bus)
+{
+       int err;
+       pci_set_master(bus->dev);
+       err = pci_set_power_state(bus->dev, PCI_D0);
+       if (err) {
+               DHD_ERROR(("%s: pci_set_power_state error %d \n", __FUNCTION__, err));
+       }
+       return err;
+}
+
+uint32
+dhdpcie_rc_config_read(dhd_bus_t *bus, uint offset)
+{
+       uint val = -1; /* Initialise to 0xfffffff */
+       if (bus->rc_dev) {
+               pci_read_config_dword(bus->rc_dev, offset, &val);
+               OSL_DELAY(100);
+       } else {
+               DHD_ERROR(("%s: RC %x:%x handle is NULL\n",
+                       __FUNCTION__, PCIE_RC_VENDOR_ID, PCIE_RC_DEVICE_ID));
+       }
+       DHD_ERROR(("%s: RC %x:%x offset 0x%x val 0x%x\n",
+               __FUNCTION__, PCIE_RC_VENDOR_ID, PCIE_RC_DEVICE_ID, offset, val));
+       return (val);
+}
+
+/*
+ * Reads/ Writes the value of capability register
+ * from the given CAP_ID section of PCI Root Port
+ *
+ * Arguements
+ * @bus current dhd_bus_t pointer
+ * @cap Capability or Extended Capability ID to get
+ * @offset offset of Register to Read
+ * @is_ext TRUE if @cap is given for Extended Capability
+ * @is_write is set to TRUE to indicate write
+ * @val value to write
+ *
+ * Return Value
+ * Returns 0xffffffff on error
+ * on write success returns BCME_OK (0)
+ * on Read Success returns the value of register requested
+ * Note: caller shoud ensure valid capability ID and Ext. Capability ID.
+ */
+
+uint32
+dhdpcie_access_cap(struct pci_dev *pdev, int cap, uint offset, bool is_ext, bool is_write,
+       uint32 writeval)
+{
+       int cap_ptr = 0;
+       uint32 ret = -1;
+       uint32 readval;
+
+       if (!(pdev)) {
+               DHD_ERROR(("%s: pdev is NULL\n", __FUNCTION__));
+               return ret;
+       }
+
+       /* Find Capability offset */
+       if (is_ext) {
+               /* removing max EXT_CAP_ID check as
+                * linux kernel definition's max value is not upadted yet as per spec
+                */
+               cap_ptr = pci_find_ext_capability(pdev, cap);
+
+       } else {
+               /* removing max PCI_CAP_ID_MAX check as
+                * pervious kernel versions dont have this definition
+                */
+               cap_ptr = pci_find_capability(pdev, cap);
+       }
+
+       /* Return if capability with given ID not found */
+       if (cap_ptr == 0) {
+               DHD_ERROR(("%s: PCI Cap(0x%02x) not supported.\n",
+                       __FUNCTION__, cap));
+               return BCME_ERROR;
+       }
+
+       if (is_write) {
+               pci_write_config_dword(pdev, (cap_ptr + offset), writeval);
+               ret = BCME_OK;
+
+       } else {
+
+               pci_read_config_dword(pdev, (cap_ptr + offset), &readval);
+               ret = readval;
+       }
+
+       return ret;
+}
+
+uint32
+dhdpcie_rc_access_cap(dhd_bus_t *bus, int cap, uint offset, bool is_ext, bool is_write,
+       uint32 writeval)
+{
+       if (!(bus->rc_dev)) {
+               DHD_ERROR(("%s: RC %x:%x handle is NULL\n",
+                       __FUNCTION__, PCIE_RC_VENDOR_ID, PCIE_RC_DEVICE_ID));
+               return BCME_ERROR;
+       }
+
+       return dhdpcie_access_cap(bus->rc_dev, cap, offset, is_ext, is_write, writeval);
+}
+
+uint32
+dhdpcie_ep_access_cap(dhd_bus_t *bus, int cap, uint offset, bool is_ext, bool is_write,
+       uint32 writeval)
+{
+       if (!(bus->dev)) {
+               DHD_ERROR(("%s: EP handle is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       return dhdpcie_access_cap(bus->dev, cap, offset, is_ext, is_write, writeval);
+}
+
+/* API wrapper to read Root Port link capability
+ * Returns 2 = GEN2 1 = GEN1 BCME_ERR on linkcap not found
+ */
+
+uint32 dhd_debug_get_rc_linkcap(dhd_bus_t *bus)
+{
+       uint32 linkcap = -1;
+       linkcap = dhdpcie_rc_access_cap(bus, PCIE_CAP_ID_EXP,
+                       PCIE_CAP_LINKCAP_OFFSET, FALSE, FALSE, 0);
+       linkcap &= PCIE_CAP_LINKCAP_LNKSPEED_MASK;
+       return linkcap;
+}
+
+static void dhdpcie_config_save_restore_coherent(dhd_bus_t *bus, bool state)
+{
+       if (bus->coreid == ARMCA7_CORE_ID) {
+               if (state) {
+                       /* Sleep */
+                       bus->coherent_state = dhdpcie_bus_cfg_read_dword(bus,
+                               PCIE_CFG_SUBSYSTEM_CONTROL, 4) & PCIE_BARCOHERENTACCEN_MASK;
+               } else {
+                       uint32 val = (dhdpcie_bus_cfg_read_dword(bus, PCIE_CFG_SUBSYSTEM_CONTROL,
+                               4) & ~PCIE_BARCOHERENTACCEN_MASK) | bus->coherent_state;
+                       dhdpcie_bus_cfg_write_dword(bus, PCIE_CFG_SUBSYSTEM_CONTROL, 4, val);
+               }
+       }
+}
+
+int dhdpcie_pci_suspend_resume(dhd_bus_t *bus, bool state)
+{
+       int rc;
+
+       struct pci_dev *dev = bus->dev;
+
+       if (state) {
+               dhdpcie_config_save_restore_coherent(bus, state);
+#if !defined(BCMPCIE_OOB_HOST_WAKE)
+               dhdpcie_pme_active(bus->osh, state);
+#endif
+               rc = dhdpcie_suspend_dev(dev);
+               if (!rc) {
+                       dhdpcie_suspend_host_dev(bus);
+               }
+       } else {
+               rc = dhdpcie_resume_host_dev(bus);
+               if (!rc) {
+                       rc = dhdpcie_resume_dev(dev);
+                       if (PCIECTO_ENAB(bus)) {
+                               /* reinit CTO configuration
+                                * because cfg space got reset at D3 (PERST)
+                                */
+                               dhdpcie_cto_cfg_init(bus, TRUE);
+                       }
+                       if (PCIE_ENUM_RESET_WAR_ENAB(bus->sih->buscorerev)) {
+                               dhdpcie_ssreset_dis_enum_rst(bus);
+                       }
+#if !defined(BCMPCIE_OOB_HOST_WAKE)
+                       dhdpcie_pme_active(bus->osh, state);
+#endif
+               }
+               dhdpcie_config_save_restore_coherent(bus, state);
+#if defined(DHD_HANG_SEND_UP_TEST)
+               if (bus->is_linkdown ||
+                       bus->dhd->req_hang_type == HANG_REASON_PCIE_RC_LINK_UP_FAIL)
+#else /* DHD_HANG_SEND_UP_TEST */
+               if (bus->is_linkdown)
+#endif /* DHD_HANG_SEND_UP_TEST */
+               {
+                       bus->dhd->hang_reason = HANG_REASON_PCIE_RC_LINK_UP_FAIL;
+                       dhd_os_send_hang_message(bus->dhd);
+               }
+       }
+       return rc;
+}
+
+static int dhdpcie_device_scan(struct device *dev, void *data)
+{
+       struct pci_dev *pcidev;
+       int *cnt = data;
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       pcidev = container_of(dev, struct pci_dev, dev);
+       GCC_DIAGNOSTIC_POP();
+
+       if (pcidev->vendor != 0x14e4)
+               return 0;
+
+       DHD_INFO(("Found Broadcom PCI device 0x%04x\n", pcidev->device));
+       *cnt += 1;
+       if (pcidev->driver && strcmp(pcidev->driver->name, dhdpcie_driver.name))
+               DHD_ERROR(("Broadcom PCI Device 0x%04x has allocated with driver %s\n",
+                       pcidev->device, pcidev->driver->name));
+
+       return 0;
+}
+
+int
+dhdpcie_bus_register(void)
+{
+       int error = 0;
+
+       if (!(error = pci_register_driver(&dhdpcie_driver))) {
+               bus_for_each_dev(dhdpcie_driver.driver.bus, NULL, &error, dhdpcie_device_scan);
+               if (!error) {
+                       DHD_ERROR(("No Broadcom PCI device enumerated!\n"));
+               } else if (!dhdpcie_init_succeeded) {
+                       DHD_ERROR(("%s: dhdpcie initialize failed.\n", __FUNCTION__));
+               } else {
+                       return 0;
+               }
+
+               pci_unregister_driver(&dhdpcie_driver);
+               error = BCME_ERROR;
+       }
+
+       return error;
+}
+
+void
+dhdpcie_bus_unregister(void)
+{
+       pci_unregister_driver(&dhdpcie_driver);
+}
+
+int __devinit
+dhdpcie_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+{
+       int err = 0;
+       DHD_MUTEX_LOCK();
+
+       if (dhdpcie_chipmatch (pdev->vendor, pdev->device)) {
+               DHD_ERROR(("%s: chipmatch failed!!\n", __FUNCTION__));
+               err = -ENODEV;
+               goto exit;
+       }
+
+       printf("PCI_PROBE:  bus %X, slot %X,vendor %X, device %X"
+               "(good PCI location)\n", pdev->bus->number,
+               PCI_SLOT(pdev->devfn), pdev->vendor, pdev->device);
+
+       if (dhdpcie_init_succeeded == TRUE) {
+               DHD_ERROR(("%s(): === Driver Already attached to a BRCM device === \r\n",
+                       __FUNCTION__));
+               err = -ENODEV;
+               goto exit;
+       }
+
+       if (dhdpcie_init (pdev)) {
+               DHD_ERROR(("%s: PCIe Enumeration failed\n", __FUNCTION__));
+               err = -ENODEV;
+               goto exit;
+       }
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       /*
+       Since MSM PCIe RC dev usage conunt already incremented +2 even
+       before dhdpcie_pci_probe() called, then we inevitably to call
+       pm_runtime_put_noidle() two times to make the count start with zero.
+       */
+
+       pm_runtime_put_noidle(&pdev->dev);
+       pm_runtime_put_noidle(&pdev->dev);
+       pm_runtime_set_suspended(&pdev->dev);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#ifdef BCMPCIE_DISABLE_ASYNC_SUSPEND
+       /* disable async suspend */
+       device_disable_async_suspend(&pdev->dev);
+#endif /* BCMPCIE_DISABLE_ASYNC_SUSPEND */
+
+       DHD_TRACE(("%s: PCIe Enumeration done!!\n", __FUNCTION__));
+exit:
+       DHD_MUTEX_UNLOCK();
+       return err;
+}
+
+int
+dhdpcie_detach(dhdpcie_info_t *pch)
+{
+       if (pch) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+               if (!dhd_download_fw_on_driverload) {
+                       pci_load_and_free_saved_state(pch->dev, &pch->default_state);
+               }
+#endif /* OEM_ANDROID && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+               MFREE(pch->osh, pch, sizeof(dhdpcie_info_t));
+       }
+       return 0;
+}
+
+void __devexit
+dhdpcie_pci_remove(struct pci_dev *pdev)
+{
+       osl_t *osh = NULL;
+       dhdpcie_info_t *pch = NULL;
+       dhd_bus_t *bus = NULL;
+
+       DHD_TRACE(("%s Enter\n", __FUNCTION__));
+
+       DHD_MUTEX_LOCK();
+
+       pch = pci_get_drvdata(pdev);
+       bus = pch->bus;
+       osh = pch->osh;
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       pm_runtime_get_noresume(&pdev->dev);
+       pm_runtime_get_noresume(&pdev->dev);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+       if (bus) {
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+               msm_pcie_deregister_event(&bus->pcie_event);
+#endif /* CONFIG_ARCH_MSM */
+#ifdef CONFIG_ARCH_EXYNOS
+               exynos_pcie_deregister_event(&bus->pcie_event);
+#endif /* CONFIG_ARCH_EXYNOS */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+
+               bus->rc_dev = NULL;
+
+               dhdpcie_bus_release(bus);
+       }
+
+       if (pci_is_enabled(pdev))
+               pci_disable_device(pdev);
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       /* pcie os info detach */
+       MFREE(osh, pch->os_cxt, sizeof(dhdpcie_os_info_t));
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef USE_SMMU_ARCH_MSM
+       /* smmu info detach */
+       dhdpcie_smmu_remove(pdev, pch->smmu_cxt);
+       MFREE(osh, pch->smmu_cxt, sizeof(dhdpcie_smmu_info_t));
+#endif /* USE_SMMU_ARCH_MSM */
+       /* pcie info detach */
+       dhdpcie_detach(pch);
+       /* osl detach */
+       osl_detach(osh);
+
+       dhdpcie_init_succeeded = FALSE;
+
+       DHD_MUTEX_UNLOCK();
+
+       DHD_TRACE(("%s Exit\n", __FUNCTION__));
+
+       return;
+}
+
+/* Enable Linux Msi */
+int
+dhdpcie_enable_msi(struct pci_dev *pdev, unsigned int min_vecs, unsigned int max_vecs)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0))
+       return pci_alloc_irq_vectors(pdev, min_vecs, max_vecs, PCI_IRQ_MSI);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+       return pci_enable_msi_range(pdev, min_vecs, max_vecs);
+#else
+       return pci_enable_msi_block(pdev, max_vecs);
+#endif
+}
+
+/* Disable Linux Msi */
+void
+dhdpcie_disable_msi(struct pci_dev *pdev)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0))
+       pci_free_irq_vectors(pdev);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0))
+       pci_disable_msi(pdev);
+#else
+       pci_disable_msi(pdev);
+#endif
+       return;
+}
+
+/* Request Linux irq */
+int
+dhdpcie_request_irq(dhdpcie_info_t *dhdpcie_info)
+{
+       dhd_bus_t *bus = dhdpcie_info->bus;
+       struct pci_dev *pdev = dhdpcie_info->bus->dev;
+       int host_irq_disabled;
+
+       if (!bus->irq_registered) {
+               snprintf(dhdpcie_info->pciname, sizeof(dhdpcie_info->pciname),
+                       "dhdpcie:%s", pci_name(pdev));
+
+               if (bus->d2h_intr_method == PCIE_MSI) {
+                       if (dhdpcie_enable_msi(pdev, 1, 1) < 0) {
+                               DHD_ERROR(("%s: dhdpcie_enable_msi() failed\n", __FUNCTION__));
+                               dhdpcie_disable_msi(pdev);
+                               bus->d2h_intr_method = PCIE_INTX;
+                       }
+               }
+
+               if (bus->d2h_intr_method == PCIE_MSI)
+                       printf("%s: MSI enabled\n", __FUNCTION__);
+               else
+                       printf("%s: INTx enabled\n", __FUNCTION__);
+
+               if (request_irq(pdev->irq, dhdpcie_isr, IRQF_SHARED,
+                       dhdpcie_info->pciname, bus) < 0) {
+                       DHD_ERROR(("%s: request_irq() failed\n", __FUNCTION__));
+                       if (bus->d2h_intr_method == PCIE_MSI) {
+                               dhdpcie_disable_msi(pdev);
+                       }
+                       return -1;
+               }
+               else {
+                       bus->irq_registered = TRUE;
+               }
+       } else {
+               DHD_ERROR(("%s: PCI IRQ is already registered\n", __FUNCTION__));
+       }
+
+       host_irq_disabled = dhdpcie_irq_disabled(bus);
+       if (host_irq_disabled) {
+               DHD_ERROR(("%s: PCIe IRQ was disabled(%d), so, enabled it again\n",
+                       __FUNCTION__, host_irq_disabled));
+               dhdpcie_enable_irq(bus);
+       }
+
+       DHD_TRACE(("%s %s\n", __FUNCTION__, dhdpcie_info->pciname));
+
+       return 0; /* SUCCESS */
+}
+
+/**
+ *     dhdpcie_get_pcieirq - return pcie irq number to linux-dhd
+ */
+int
+dhdpcie_get_pcieirq(struct dhd_bus *bus, unsigned int *irq)
+{
+       struct pci_dev *pdev = bus->dev;
+
+       if (!pdev) {
+               DHD_ERROR(("%s : bus->dev is NULL\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       *irq  = pdev->irq;
+
+       return 0; /* SUCCESS */
+}
+
+#ifdef CONFIG_PHYS_ADDR_T_64BIT
+#define PRINTF_RESOURCE        "0x%016llx"
+#else
+#define PRINTF_RESOURCE        "0x%08x"
+#endif
+
+#ifdef EXYNOS_PCIE_MODULE_PATCH
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+extern struct pci_saved_state *bcm_pcie_default_state;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+#endif /* EXYNOS_MODULE_PATCH */
+
+/*
+
+Name:  osl_pci_get_resource
+
+Parametrs:
+
+1: struct pci_dev *pdev   -- pci device structure
+2: pci_res                       -- structure containing pci configuration space values
+
+Return value:
+
+int   - Status (TRUE or FALSE)
+
+Description:
+Access PCI configuration space, retrieve  PCI allocated resources , updates in resource structure.
+
+ */
+int dhdpcie_get_resource(dhdpcie_info_t *dhdpcie_info)
+{
+       phys_addr_t  bar0_addr, bar1_addr;
+       ulong bar1_size;
+       struct pci_dev *pdev = NULL;
+       pdev = dhdpcie_info->dev;
+#ifdef EXYNOS_PCIE_MODULE_PATCH
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       if (bcm_pcie_default_state) {
+               pci_load_saved_state(pdev, bcm_pcie_default_state);
+               pci_restore_state(pdev);
+       }
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+#endif /* EXYNOS_MODULE_PATCH */
+       do {
+               if (pci_enable_device(pdev)) {
+                       printf("%s: Cannot enable PCI device\n", __FUNCTION__);
+                       break;
+               }
+               pci_set_master(pdev);
+               bar0_addr = pci_resource_start(pdev, 0);        /* Bar-0 mapped address */
+               bar1_addr = pci_resource_start(pdev, 2);        /* Bar-1 mapped address */
+
+               /* read Bar-1 mapped memory range */
+               bar1_size = pci_resource_len(pdev, 2);
+
+               if ((bar1_size == 0) || (bar1_addr == 0)) {
+                       printf("%s: BAR1 Not enabled for this device  size(%ld),"
+                               " addr(0x"PRINTF_RESOURCE")\n",
+                               __FUNCTION__, bar1_size, bar1_addr);
+                       goto err;
+               }
+
+               dhdpcie_info->regs = (volatile char *) REG_MAP(bar0_addr, DONGLE_REG_MAP_SIZE);
+               dhdpcie_info->bar1_size =
+                       (bar1_size > DONGLE_TCM_MAP_SIZE) ? bar1_size : DONGLE_TCM_MAP_SIZE;
+               dhdpcie_info->tcm = (volatile char *) REG_MAP(bar1_addr, dhdpcie_info->bar1_size);
+
+               if (!dhdpcie_info->regs || !dhdpcie_info->tcm) {
+                       DHD_ERROR(("%s:ioremap() failed\n", __FUNCTION__));
+                       break;
+               }
+#ifdef EXYNOS_PCIE_MODULE_PATCH
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+               if (bcm_pcie_default_state == NULL) {
+                       pci_save_state(pdev);
+                       bcm_pcie_default_state = pci_store_saved_state(pdev);
+               }
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+#endif /* EXYNOS_MODULE_PATCH */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       /* Backup PCIe configuration so as to use Wi-Fi on/off process
+        * in case of built in driver
+        */
+       pci_save_state(pdev);
+       dhdpcie_info->default_state = pci_store_saved_state(pdev);
+
+       if (dhdpcie_info->default_state == NULL) {
+               DHD_ERROR(("%s pci_store_saved_state returns NULL\n",
+                       __FUNCTION__));
+               REG_UNMAP(dhdpcie_info->regs);
+               REG_UNMAP(dhdpcie_info->tcm);
+               pci_disable_device(pdev);
+               break;
+       }
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+
+               DHD_TRACE(("%s:Phys addr : reg space = %p base addr 0x"PRINTF_RESOURCE" \n",
+                       __FUNCTION__, dhdpcie_info->regs, bar0_addr));
+               DHD_TRACE(("%s:Phys addr : tcm_space = %p base addr 0x"PRINTF_RESOURCE" \n",
+                       __FUNCTION__, dhdpcie_info->tcm, bar1_addr));
+
+               return 0; /* SUCCESS  */
+       } while (0);
+err:
+       return -1;  /* FAILURE */
+}
+
+int dhdpcie_scan_resource(dhdpcie_info_t *dhdpcie_info)
+{
+
+       DHD_TRACE(("%s: ENTER\n", __FUNCTION__));
+
+       do {
+               /* define it here only!! */
+               if (dhdpcie_get_resource (dhdpcie_info)) {
+                       DHD_ERROR(("%s: Failed to get PCI resources\n", __FUNCTION__));
+                       break;
+               }
+               DHD_TRACE(("%s:Exit - SUCCESS \n",
+                       __FUNCTION__));
+
+               return 0; /* SUCCESS */
+
+       } while (0);
+
+       DHD_TRACE(("%s:Exit - FAILURE \n", __FUNCTION__));
+
+       return -1; /* FAILURE */
+
+}
+
+void dhdpcie_dump_resource(dhd_bus_t *bus)
+{
+       dhdpcie_info_t *pch;
+
+       if (bus == NULL) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (bus->dev == NULL) {
+               DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       pch = pci_get_drvdata(bus->dev);
+       if (pch == NULL) {
+               DHD_ERROR(("%s: pch is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       /* BAR0 */
+       DHD_ERROR(("%s: BAR0(VA): 0x%pK, BAR0(PA): "PRINTF_RESOURCE", SIZE: %d\n",
+               __FUNCTION__, pch->regs, pci_resource_start(bus->dev, 0),
+               DONGLE_REG_MAP_SIZE));
+
+       /* BAR1 */
+       DHD_ERROR(("%s: BAR1(VA): 0x%pK, BAR1(PA): "PRINTF_RESOURCE", SIZE: %d\n",
+               __FUNCTION__, pch->tcm, pci_resource_start(bus->dev, 2),
+               pch->bar1_size));
+}
+
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#if defined(CONFIG_ARCH_MSM) || defined(CONFIG_ARCH_EXYNOS)
+void dhdpcie_linkdown_cb(struct_pcie_notify *noti)
+{
+       struct pci_dev *pdev = (struct pci_dev *)noti->user;
+       dhdpcie_info_t *pch = NULL;
+
+       if (pdev) {
+               pch = pci_get_drvdata(pdev);
+               if (pch) {
+                       dhd_bus_t *bus = pch->bus;
+                       if (bus) {
+                               dhd_pub_t *dhd = bus->dhd;
+                               if (dhd) {
+#ifdef CONFIG_ARCH_MSM
+                                       DHD_ERROR(("%s: Set no_cfg_restore flag\n",
+                                               __FUNCTION__));
+                                       bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+#ifdef DHD_SSSR_DUMP
+                                       if (dhd->fis_triggered) {
+                                               DHD_ERROR(("%s: PCIe linkdown due to FIS, Ignore\n",
+                                                       __FUNCTION__));
+                                       } else
+#endif /* DHD_SSSR_DUMP */
+                                       {
+                                               DHD_ERROR(("%s: Event HANG send up "
+                                                       "due to PCIe linkdown\n",
+                                                       __FUNCTION__));
+                                               bus->is_linkdown = 1;
+                                               dhd->hang_reason =
+                                                       HANG_REASON_PCIE_LINK_DOWN_RC_DETECT;
+                                               dhd_os_send_hang_message(dhd);
+                                       }
+                               }
+                       }
+               }
+       }
+
+}
+#endif /* CONFIG_ARCH_MSM || CONFIG_ARCH_EXYNOS */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+
+int dhdpcie_init(struct pci_dev *pdev)
+{
+
+       osl_t                           *osh = NULL;
+       dhd_bus_t                       *bus = NULL;
+       dhdpcie_info_t          *dhdpcie_info =  NULL;
+       wifi_adapter_info_t     *adapter = NULL;
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       dhdpcie_os_info_t       *dhdpcie_osinfo = NULL;
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef USE_SMMU_ARCH_MSM
+       dhdpcie_smmu_info_t     *dhdpcie_smmu_info = NULL;
+#endif /* USE_SMMU_ARCH_MSM */
+       int ret = 0;
+
+       do {
+               /* osl attach */
+               if (!(osh = osl_attach(pdev, PCI_BUS, FALSE))) {
+                       DHD_ERROR(("%s: osl_attach failed\n", __FUNCTION__));
+                       break;
+               }
+
+               /* initialize static buffer */
+               adapter = dhd_wifi_platform_get_adapter(PCI_BUS, pdev->bus->number,
+                       PCI_SLOT(pdev->devfn));
+               if (adapter != NULL) {
+                       DHD_ERROR(("%s: found adapter info '%s'\n", __FUNCTION__, adapter->name));
+#ifdef BUS_POWER_RESTORE
+                       adapter->pci_dev = pdev;
+#endif
+               } else
+                       DHD_ERROR(("%s: can't find adapter info for this chip\n", __FUNCTION__));
+               osl_static_mem_init(osh, adapter);
+
+               /*  allocate linux spcific pcie structure here */
+               if (!(dhdpcie_info = MALLOC(osh, sizeof(dhdpcie_info_t)))) {
+                       DHD_ERROR(("%s: MALLOC of dhd_bus_t failed\n", __FUNCTION__));
+                       break;
+               }
+               bzero(dhdpcie_info, sizeof(dhdpcie_info_t));
+               dhdpcie_info->osh = osh;
+               dhdpcie_info->dev = pdev;
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+               /* allocate OS speicific structure */
+               dhdpcie_osinfo = MALLOC(osh, sizeof(dhdpcie_os_info_t));
+               if (dhdpcie_osinfo == NULL) {
+                       DHD_ERROR(("%s: MALLOC of dhdpcie_os_info_t failed\n",
+                               __FUNCTION__));
+                       break;
+               }
+               bzero(dhdpcie_osinfo, sizeof(dhdpcie_os_info_t));
+               dhdpcie_info->os_cxt = (void *)dhdpcie_osinfo;
+
+               /* Initialize host wake IRQ */
+               spin_lock_init(&dhdpcie_osinfo->oob_irq_spinlock);
+               /* Get customer specific host wake IRQ parametres: IRQ number as IRQ type */
+               dhdpcie_osinfo->oob_irq_num = wifi_platform_get_irq_number(adapter,
+                       &dhdpcie_osinfo->oob_irq_flags);
+               if (dhdpcie_osinfo->oob_irq_num < 0) {
+                       DHD_ERROR(("%s: Host OOB irq is not defined\n", __FUNCTION__));
+               }
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+#ifdef USE_SMMU_ARCH_MSM
+               /* allocate private structure for using SMMU */
+               dhdpcie_smmu_info = MALLOC(osh, sizeof(dhdpcie_smmu_info_t));
+               if (dhdpcie_smmu_info == NULL) {
+                       DHD_ERROR(("%s: MALLOC of dhdpcie_smmu_info_t failed\n",
+                               __FUNCTION__));
+                       break;
+               }
+               bzero(dhdpcie_smmu_info, sizeof(dhdpcie_smmu_info_t));
+               dhdpcie_info->smmu_cxt = (void *)dhdpcie_smmu_info;
+
+               /* Initialize smmu structure */
+               if (dhdpcie_smmu_init(pdev, dhdpcie_info->smmu_cxt) < 0) {
+                       DHD_ERROR(("%s: Failed to initialize SMMU\n",
+                               __FUNCTION__));
+                       break;
+               }
+#endif /* USE_SMMU_ARCH_MSM */
+
+#ifdef DHD_WAKE_STATUS
+               /* Initialize pkt_wake_lock */
+               spin_lock_init(&dhdpcie_info->pkt_wake_lock);
+#endif /* DHD_WAKE_STATUS */
+
+               /* Find the PCI resources, verify the  */
+               /* vendor and device ID, map BAR regions and irq,  update in structures */
+               if (dhdpcie_scan_resource(dhdpcie_info)) {
+                       DHD_ERROR(("%s: dhd_Scan_PCI_Res failed\n", __FUNCTION__));
+
+                       break;
+               }
+
+               /* Bus initialization */
+               ret = dhdpcie_bus_attach(osh, &bus, dhdpcie_info->regs, dhdpcie_info->tcm, pdev);
+               if (ret != BCME_OK) {
+                       DHD_ERROR(("%s:dhdpcie_bus_attach() failed\n", __FUNCTION__));
+                       break;
+               }
+
+               dhdpcie_info->bus = bus;
+               bus->bar1_size = dhdpcie_info->bar1_size;
+               bus->is_linkdown = 0;
+               bus->no_bus_init = FALSE;
+               bus->cto_triggered = 0;
+
+               bus->rc_dev = NULL;
+
+               /* Get RC Device Handle */
+               if (bus->dev->bus) {
+                       /* self member of structure pci_bus is bridge device as seen by parent */
+                       bus->rc_dev = bus->dev->bus->self;
+                       if (bus->rc_dev)
+                               DHD_ERROR(("%s: rc_dev from dev->bus->self (%x:%x) is %pK\n", __FUNCTION__,
+                                       bus->rc_dev->vendor, bus->rc_dev->device, bus->rc_dev));
+                       else
+                               DHD_ERROR(("%s: bus->dev->bus->self is NULL\n", __FUNCTION__));
+               } else {
+                       DHD_ERROR(("%s: unable to get rc_dev as dev->bus is NULL\n", __FUNCTION__));
+               }
+
+               /* if rc_dev is still NULL, try to get from vendor/device IDs */
+               if (bus->rc_dev == NULL) {
+                       bus->rc_dev = pci_get_device(PCIE_RC_VENDOR_ID, PCIE_RC_DEVICE_ID, NULL);
+                       DHD_ERROR(("%s: rc_dev from pci_get_device (%x:%x) is %p\n", __FUNCTION__,
+                               PCIE_RC_VENDOR_ID, PCIE_RC_DEVICE_ID, bus->rc_dev));
+               }
+
+               bus->rc_ep_aspm_cap = dhd_bus_is_rc_ep_aspm_capable(bus);
+               bus->rc_ep_l1ss_cap = dhd_bus_is_rc_ep_l1ss_capable(bus);
+               DHD_ERROR(("%s: rc_ep_aspm_cap: %d rc_ep_l1ss_cap: %d\n",
+                       __FUNCTION__, bus->rc_ep_aspm_cap, bus->rc_ep_l1ss_cap));
+
+#ifdef FORCE_TPOWERON
+               if (dhdpcie_chip_req_forced_tpoweron(bus)) {
+                       dhd_bus_set_tpoweron(bus, tpoweron_scale);
+               }
+#endif /* FORCE_TPOWERON */
+
+#ifdef DONGLE_ENABLE_ISOLATION
+               bus->dhd->dongle_isolation = TRUE;
+#endif /* DONGLE_ENABLE_ISOLATION */
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+               bus->pcie_event.events = MSM_PCIE_EVENT_LINKDOWN;
+               bus->pcie_event.user = pdev;
+               bus->pcie_event.mode = MSM_PCIE_TRIGGER_CALLBACK;
+               bus->pcie_event.callback = dhdpcie_linkdown_cb;
+               bus->pcie_event.options = MSM_PCIE_CONFIG_NO_RECOVERY;
+               msm_pcie_register_event(&bus->pcie_event);
+               bus->no_cfg_restore = FALSE;
+#endif /* CONFIG_ARCH_MSM */
+#ifdef CONFIG_ARCH_EXYNOS
+               bus->pcie_event.events = EXYNOS_PCIE_EVENT_LINKDOWN;
+               bus->pcie_event.user = pdev;
+               bus->pcie_event.mode = EXYNOS_PCIE_TRIGGER_CALLBACK;
+               bus->pcie_event.callback = dhdpcie_linkdown_cb;
+               exynos_pcie_register_event(&bus->pcie_event);
+#endif /* CONFIG_ARCH_EXYNOS */
+               bus->read_shm_fail = FALSE;
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+
+               if (bus->intr) {
+                       /* Register interrupt callback, but mask it (not operational yet). */
+                       DHD_INTR(("%s: Registering and masking interrupts\n", __FUNCTION__));
+                       bus->intr_enabled = FALSE;
+                       dhdpcie_bus_intr_disable(bus);
+
+                       if (dhdpcie_request_irq(dhdpcie_info)) {
+                               DHD_ERROR(("%s: request_irq() failed\n", __FUNCTION__));
+                               break;
+                       }
+               } else {
+                       bus->pollrate = 1;
+                       DHD_INFO(("%s: PCIe interrupt function is NOT registered "
+                               "due to polling mode\n", __FUNCTION__));
+               }
+
+#if defined(BCM_REQUEST_FW)
+               if (dhd_bus_download_firmware(bus, osh, NULL, NULL) < 0) {
+               DHD_ERROR(("%s: failed to download firmware\n", __FUNCTION__));
+               }
+               bus->nv_path = NULL;
+               bus->fw_path = NULL;
+#endif /* BCM_REQUEST_FW */
+
+               /* set private data for pci_dev */
+               pci_set_drvdata(pdev, dhdpcie_info);
+
+               /* Ensure BAR1 switch feature enable if needed before FW download */
+               dhdpcie_bar1_window_switch_enab(bus);
+
+               if (dhd_download_fw_on_driverload) {
+                       if (dhd_bus_start(bus->dhd)) {
+                               DHD_ERROR(("%s: dhd_bus_start() failed\n", __FUNCTION__));
+                               if (!allow_delay_fwdl)
+                                       break;
+                       }
+               } else {
+                       /* Set ramdom MAC address during boot time */
+                       get_random_bytes(&bus->dhd->mac.octet[3], 3);
+                       /* Adding BRCM OUI */
+                       bus->dhd->mac.octet[0] = 0;
+                       bus->dhd->mac.octet[1] = 0x90;
+                       bus->dhd->mac.octet[2] = 0x4C;
+               }
+
+               /* Attach to the OS network interface */
+               DHD_TRACE(("%s(): Calling dhd_register_if() \n", __FUNCTION__));
+               if (dhd_attach_net(bus->dhd, TRUE)) {
+                       DHD_ERROR(("%s(): ERROR.. dhd_register_if() failed\n", __FUNCTION__));
+                       break;
+               }
+
+               dhdpcie_init_succeeded = TRUE;
+
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+               pm_runtime_set_autosuspend_delay(&pdev->dev, AUTO_SUSPEND_TIMEOUT);
+               pm_runtime_use_autosuspend(&pdev->dev);
+               atomic_set(&bus->dhd->block_bus, FALSE);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+
+#if defined(MULTIPLE_SUPPLICANT)
+               wl_android_post_init(); // terence 20120530: fix critical section in dhd_open and dhdsdio_probe
+#endif /* MULTIPLE_SUPPLICANT */
+
+               DHD_TRACE(("%s:Exit - SUCCESS \n", __FUNCTION__));
+               return 0;  /* return  SUCCESS  */
+
+       } while (0);
+       /* reverse the initialization in order in case of error */
+
+       if (bus)
+               dhdpcie_bus_release(bus);
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       if (dhdpcie_osinfo) {
+               MFREE(osh, dhdpcie_osinfo, sizeof(dhdpcie_os_info_t));
+       }
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+#ifdef USE_SMMU_ARCH_MSM
+       if (dhdpcie_smmu_info) {
+               MFREE(osh, dhdpcie_smmu_info, sizeof(dhdpcie_smmu_info_t));
+               dhdpcie_info->smmu_cxt = NULL;
+       }
+#endif /* USE_SMMU_ARCH_MSM */
+
+       if (dhdpcie_info)
+               dhdpcie_detach(dhdpcie_info);
+       pci_disable_device(pdev);
+       if (osh)
+               osl_detach(osh);
+
+       dhdpcie_init_succeeded = FALSE;
+
+       DHD_TRACE(("%s:Exit - FAILURE \n", __FUNCTION__));
+
+       return -1; /* return FAILURE  */
+}
+
+/* Free Linux irq */
+void
+dhdpcie_free_irq(dhd_bus_t *bus)
+{
+       struct pci_dev *pdev = NULL;
+
+       DHD_TRACE(("%s: freeing up the IRQ\n", __FUNCTION__));
+       if (bus) {
+               pdev = bus->dev;
+               if (bus->irq_registered) {
+#if defined(SET_PCIE_IRQ_CPU_CORE) && defined(CONFIG_ARCH_SM8150)
+                       /* clean up the affinity_hint before
+                        * the unregistration of PCIe irq
+                        */
+                       (void)irq_set_affinity_hint(pdev->irq, NULL);
+#endif /* SET_PCIE_IRQ_CPU_CORE && CONFIG_ARCH_SM8150 */
+                       free_irq(pdev->irq, bus);
+                       bus->irq_registered = FALSE;
+                       if (bus->d2h_intr_method == PCIE_MSI) {
+                               dhdpcie_disable_msi(pdev);
+                       }
+               } else {
+                       DHD_ERROR(("%s: PCIe IRQ is not registered\n", __FUNCTION__));
+               }
+       }
+       DHD_TRACE(("%s: Exit\n", __FUNCTION__));
+       return;
+}
+
+/*
+
+Name:  dhdpcie_isr
+
+Parametrs:
+
+1: IN int irq   -- interrupt vector
+2: IN void *arg      -- handle to private data structure
+
+Return value:
+
+Status (TRUE or FALSE)
+
+Description:
+Interrupt Service routine checks for the status register,
+disable interrupt and queue DPC if mail box interrupts are raised.
+*/
+
+irqreturn_t
+dhdpcie_isr(int irq, void *arg)
+{
+       dhd_bus_t *bus = (dhd_bus_t*)arg;
+       bus->isr_entry_time = OSL_LOCALTIME_NS();
+       if (!dhdpcie_bus_isr(bus)) {
+               DHD_LOG_MEM(("%s: dhdpcie_bus_isr returns with FALSE\n", __FUNCTION__));
+       }
+       bus->isr_exit_time = OSL_LOCALTIME_NS();
+       return IRQ_HANDLED;
+}
+
+int
+dhdpcie_disable_irq_nosync(dhd_bus_t *bus)
+{
+       struct pci_dev *dev;
+       if ((bus == NULL) || (bus->dev == NULL)) {
+               DHD_ERROR(("%s: bus or bus->dev is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       dev = bus->dev;
+       disable_irq_nosync(dev->irq);
+       return BCME_OK;
+}
+
+int
+dhdpcie_disable_irq(dhd_bus_t *bus)
+{
+       struct pci_dev *dev;
+       if ((bus == NULL) || (bus->dev == NULL)) {
+               DHD_ERROR(("%s: bus or bus->dev is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       dev = bus->dev;
+       disable_irq(dev->irq);
+       return BCME_OK;
+}
+
+int
+dhdpcie_enable_irq(dhd_bus_t *bus)
+{
+       struct pci_dev *dev;
+       if ((bus == NULL) || (bus->dev == NULL)) {
+               DHD_ERROR(("%s: bus or bus->dev is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       dev = bus->dev;
+       enable_irq(dev->irq);
+       return BCME_OK;
+}
+
+int
+dhdpcie_irq_disabled(dhd_bus_t *bus)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
+       struct irq_desc *desc = irq_to_desc(bus->dev->irq);
+       /* depth will be zero, if enabled */
+       return desc->depth;
+#else
+       /* return ERROR by default as there is no support for lower versions */
+       return BCME_ERROR;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+}
+
+int
+dhdpcie_start_host_dev(dhd_bus_t *bus)
+{
+       int ret = 0;
+#ifdef CONFIG_ARCH_MSM
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+       int options = 0;
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+#endif /* CONFIG_ARCH_MSM */
+       DHD_TRACE(("%s Enter:\n", __FUNCTION__));
+
+       if (bus == NULL) {
+               return BCME_ERROR;
+       }
+
+       if (bus->dev == NULL) {
+               return BCME_ERROR;
+       }
+
+#ifdef CONFIG_ARCH_EXYNOS
+       exynos_pcie_pm_resume(SAMSUNG_PCIE_CH_NUM);
+#endif /* CONFIG_ARCH_EXYNOS */
+#ifdef CONFIG_ARCH_MSM
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+       if (bus->no_cfg_restore) {
+               options = MSM_PCIE_CONFIG_NO_CFG_RESTORE;
+       }
+       ret = msm_pcie_pm_control(MSM_PCIE_RESUME, bus->dev->bus->number,
+               bus->dev, NULL, options);
+       if (bus->no_cfg_restore && !ret) {
+               msm_pcie_recover_config(bus->dev);
+               bus->no_cfg_restore = 0;
+       }
+#else
+       ret = msm_pcie_pm_control(MSM_PCIE_RESUME, bus->dev->bus->number,
+               bus->dev, NULL, 0);
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+#endif /* CONFIG_ARCH_MSM */
+#ifdef CONFIG_ARCH_TEGRA
+       ret = tegra_pcie_pm_resume();
+#endif /* CONFIG_ARCH_TEGRA */
+
+       if (ret) {
+               DHD_ERROR(("%s Failed to bring up PCIe link\n", __FUNCTION__));
+               goto done;
+       }
+
+done:
+       DHD_TRACE(("%s Exit:\n", __FUNCTION__));
+       return ret;
+}
+
+int
+dhdpcie_stop_host_dev(dhd_bus_t *bus)
+{
+       int ret = 0;
+#ifdef CONFIG_ARCH_MSM
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+       int options = 0;
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+#endif /* CONFIG_ARCH_MSM */
+
+       DHD_TRACE(("%s Enter:\n", __FUNCTION__));
+
+       if (bus == NULL) {
+               return BCME_ERROR;
+       }
+
+       if (bus->dev == NULL) {
+               return BCME_ERROR;
+       }
+
+#ifdef CONFIG_ARCH_EXYNOS
+       exynos_pcie_pm_suspend(SAMSUNG_PCIE_CH_NUM);
+#endif /* CONFIG_ARCH_EXYNOS */
+#ifdef CONFIG_ARCH_MSM
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+       if (bus->no_cfg_restore) {
+               options = MSM_PCIE_CONFIG_NO_CFG_RESTORE | MSM_PCIE_CONFIG_LINKDOWN;
+       }
+
+       ret = msm_pcie_pm_control(MSM_PCIE_SUSPEND, bus->dev->bus->number,
+               bus->dev, NULL, options);
+#else
+       ret = msm_pcie_pm_control(MSM_PCIE_SUSPEND, bus->dev->bus->number,
+               bus->dev, NULL, 0);
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+#endif /* CONFIG_ARCH_MSM */
+#ifdef CONFIG_ARCH_TEGRA
+       ret = tegra_pcie_pm_suspend();
+#endif /* CONFIG_ARCH_TEGRA */
+       if (ret) {
+               DHD_ERROR(("Failed to stop PCIe link\n"));
+               goto done;
+       }
+done:
+       DHD_TRACE(("%s Exit:\n", __FUNCTION__));
+       return ret;
+}
+
+int
+dhdpcie_disable_device(dhd_bus_t *bus)
+{
+       DHD_TRACE(("%s Enter:\n", __FUNCTION__));
+
+       if (bus == NULL) {
+               return BCME_ERROR;
+       }
+
+       if (bus->dev == NULL) {
+               return BCME_ERROR;
+       }
+
+       if (pci_is_enabled(bus->dev))
+               pci_disable_device(bus->dev);
+
+       return 0;
+}
+
+int
+dhdpcie_enable_device(dhd_bus_t *bus)
+{
+       int ret = BCME_ERROR;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       dhdpcie_info_t *pch;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+
+       DHD_TRACE(("%s Enter:\n", __FUNCTION__));
+
+       if (bus == NULL) {
+               return BCME_ERROR;
+       }
+
+       if (bus->dev == NULL) {
+               return BCME_ERROR;
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       pch = pci_get_drvdata(bus->dev);
+       if (pch == NULL) {
+               return BCME_ERROR;
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)) && (LINUX_VERSION_CODE < \
+       KERNEL_VERSION(3, 19, 0)) && !defined(CONFIG_SOC_EXYNOS8890)
+       /* Updated with pci_load_and_free_saved_state to compatible
+        * with Kernel version 3.14.0 to 3.18.41.
+        */
+       pci_load_and_free_saved_state(bus->dev, &pch->default_state);
+       pch->default_state = pci_store_saved_state(bus->dev);
+#else
+       pci_load_saved_state(bus->dev, pch->default_state);
+#endif /* LINUX_VERSION >= 3.14.0 && LINUX_VERSION < 3.19.0 && !CONFIG_SOC_EXYNOS8890 */
+
+       /* Check if Device ID is valid */
+       if (bus->dev->state_saved) {
+               uint32 vid, saved_vid;
+               pci_read_config_dword(bus->dev, PCI_CFG_VID, &vid);
+               saved_vid = bus->dev->saved_config_space[PCI_CFG_VID];
+               if (vid != saved_vid) {
+                       DHD_ERROR(("%s: VID(0x%x) is different from saved VID(0x%x) "
+                               "Skip the bus init\n", __FUNCTION__, vid, saved_vid));
+                       bus->no_bus_init = TRUE;
+                       /* Check if the PCIe link is down */
+                       if (vid == (uint32)-1) {
+                               bus->is_linkdown = 1;
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+                               bus->no_cfg_restore = TRUE;
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+                       }
+                       return BCME_ERROR;
+               }
+       }
+
+       pci_restore_state(bus->dev);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) */
+
+       ret = pci_enable_device(bus->dev);
+       if (ret) {
+               pci_disable_device(bus->dev);
+       } else {
+               pci_set_master(bus->dev);
+       }
+
+       return ret;
+}
+
+int
+dhdpcie_alloc_resource(dhd_bus_t *bus)
+{
+       dhdpcie_info_t *dhdpcie_info;
+       phys_addr_t bar0_addr, bar1_addr;
+       ulong bar1_size;
+
+       do {
+               if (bus == NULL) {
+                       DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+                       break;
+               }
+
+               if (bus->dev == NULL) {
+                       DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+                       break;
+               }
+
+               dhdpcie_info = pci_get_drvdata(bus->dev);
+               if (dhdpcie_info == NULL) {
+                       DHD_ERROR(("%s: dhdpcie_info is NULL\n", __FUNCTION__));
+                       break;
+               }
+
+               bar0_addr = pci_resource_start(bus->dev, 0);    /* Bar-0 mapped address */
+               bar1_addr = pci_resource_start(bus->dev, 2);    /* Bar-1 mapped address */
+
+               /* read Bar-1 mapped memory range */
+               bar1_size = pci_resource_len(bus->dev, 2);
+
+               if ((bar1_size == 0) || (bar1_addr == 0)) {
+                       printf("%s: BAR1 Not enabled for this device size(%ld),"
+                               " addr(0x"PRINTF_RESOURCE")\n",
+                               __FUNCTION__, bar1_size, bar1_addr);
+                       break;
+               }
+
+               dhdpcie_info->regs = (volatile char *) REG_MAP(bar0_addr, DONGLE_REG_MAP_SIZE);
+               if (!dhdpcie_info->regs) {
+                       DHD_ERROR(("%s: ioremap() for regs is failed\n", __FUNCTION__));
+                       break;
+               }
+
+               bus->regs = dhdpcie_info->regs;
+               dhdpcie_info->bar1_size =
+                       (bar1_size > DONGLE_TCM_MAP_SIZE) ? bar1_size : DONGLE_TCM_MAP_SIZE;
+               dhdpcie_info->tcm = (volatile char *) REG_MAP(bar1_addr, dhdpcie_info->bar1_size);
+               if (!dhdpcie_info->tcm) {
+                       DHD_ERROR(("%s: ioremap() for regs is failed\n", __FUNCTION__));
+                       REG_UNMAP(dhdpcie_info->regs);
+                       bus->regs = NULL;
+                       break;
+               }
+
+               bus->tcm = dhdpcie_info->tcm;
+               bus->bar1_size = dhdpcie_info->bar1_size;
+
+               DHD_TRACE(("%s:Phys addr : reg space = %p base addr 0x"PRINTF_RESOURCE" \n",
+                       __FUNCTION__, dhdpcie_info->regs, bar0_addr));
+               DHD_TRACE(("%s:Phys addr : tcm_space = %p base addr 0x"PRINTF_RESOURCE" \n",
+                       __FUNCTION__, dhdpcie_info->tcm, bar1_addr));
+
+               return 0;
+       } while (0);
+
+       return BCME_ERROR;
+}
+
+void
+dhdpcie_free_resource(dhd_bus_t *bus)
+{
+       dhdpcie_info_t *dhdpcie_info;
+
+       if (bus == NULL) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (bus->dev == NULL) {
+               DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       dhdpcie_info = pci_get_drvdata(bus->dev);
+       if (dhdpcie_info == NULL) {
+               DHD_ERROR(("%s: dhdpcie_info is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (bus->regs) {
+               REG_UNMAP(dhdpcie_info->regs);
+               bus->regs = NULL;
+       }
+
+       if (bus->tcm) {
+               REG_UNMAP(dhdpcie_info->tcm);
+               bus->tcm = NULL;
+       }
+}
+
+int
+dhdpcie_bus_request_irq(struct dhd_bus *bus)
+{
+       dhdpcie_info_t *dhdpcie_info;
+       int ret = 0;
+
+       if (bus == NULL) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (bus->dev == NULL) {
+               DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       dhdpcie_info = pci_get_drvdata(bus->dev);
+       if (dhdpcie_info == NULL) {
+               DHD_ERROR(("%s: dhdpcie_info is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (bus->intr) {
+               /* Register interrupt callback, but mask it (not operational yet). */
+               DHD_INTR(("%s: Registering and masking interrupts\n", __FUNCTION__));
+               bus->intr_enabled = FALSE;
+               dhdpcie_bus_intr_disable(bus);
+               ret = dhdpcie_request_irq(dhdpcie_info);
+               if (ret) {
+                       DHD_ERROR(("%s: request_irq() failed, ret=%d\n",
+                               __FUNCTION__, ret));
+                       return ret;
+               }
+       }
+
+       return ret;
+}
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+#ifdef CONFIG_BCMDHD_GET_OOB_STATE
+extern int dhd_get_wlan_oob_gpio(void);
+#endif /* CONFIG_BCMDHD_GET_OOB_STATE */
+
+int dhdpcie_get_oob_irq_level(void)
+{
+       int gpio_level;
+
+#ifdef CONFIG_BCMDHD_GET_OOB_STATE
+       gpio_level = dhd_get_wlan_oob_gpio();
+#else
+       gpio_level = BCME_UNSUPPORTED;
+#endif /* CONFIG_BCMDHD_GET_OOB_STATE */
+       return gpio_level;
+}
+
+int dhdpcie_get_oob_irq_status(struct dhd_bus *bus)
+{
+       dhdpcie_info_t *pch;
+       dhdpcie_os_info_t *dhdpcie_osinfo;
+
+       if (bus == NULL) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return 0;
+       }
+
+       if (bus->dev == NULL) {
+               DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+               return 0;
+       }
+
+       pch = pci_get_drvdata(bus->dev);
+       if (pch == NULL) {
+               DHD_ERROR(("%s: pch is NULL\n", __FUNCTION__));
+               return 0;
+       }
+
+       dhdpcie_osinfo = (dhdpcie_os_info_t *)pch->os_cxt;
+
+       return dhdpcie_osinfo ? dhdpcie_osinfo->oob_irq_enabled : 0;
+}
+
+int dhdpcie_get_oob_irq_num(struct dhd_bus *bus)
+{
+       dhdpcie_info_t *pch;
+       dhdpcie_os_info_t *dhdpcie_osinfo;
+
+       if (bus == NULL) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return 0;
+       }
+
+       if (bus->dev == NULL) {
+               DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+               return 0;
+       }
+
+       pch = pci_get_drvdata(bus->dev);
+       if (pch == NULL) {
+               DHD_ERROR(("%s: pch is NULL\n", __FUNCTION__));
+               return 0;
+       }
+
+       dhdpcie_osinfo = (dhdpcie_os_info_t *)pch->os_cxt;
+
+       return dhdpcie_osinfo ? dhdpcie_osinfo->oob_irq_num : 0;
+}
+
+void dhdpcie_oob_intr_set(dhd_bus_t *bus, bool enable)
+{
+       unsigned long flags;
+       dhdpcie_info_t *pch;
+       dhdpcie_os_info_t *dhdpcie_osinfo;
+
+       if (bus == NULL) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (bus->dev == NULL) {
+               DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       pch = pci_get_drvdata(bus->dev);
+       if (pch == NULL) {
+               DHD_ERROR(("%s: pch is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       dhdpcie_osinfo = (dhdpcie_os_info_t *)pch->os_cxt;
+       DHD_OOB_IRQ_LOCK(&dhdpcie_osinfo->oob_irq_spinlock, flags);
+       if ((dhdpcie_osinfo->oob_irq_enabled != enable) &&
+               (dhdpcie_osinfo->oob_irq_num > 0)) {
+               if (enable) {
+                       enable_irq(dhdpcie_osinfo->oob_irq_num);
+                       bus->oob_intr_enable_count++;
+                       bus->last_oob_irq_enable_time = OSL_LOCALTIME_NS();
+               } else {
+                       disable_irq_nosync(dhdpcie_osinfo->oob_irq_num);
+                       bus->oob_intr_disable_count++;
+                       bus->last_oob_irq_disable_time = OSL_LOCALTIME_NS();
+               }
+               dhdpcie_osinfo->oob_irq_enabled = enable;
+       }
+       DHD_OOB_IRQ_UNLOCK(&dhdpcie_osinfo->oob_irq_spinlock, flags);
+}
+
+#if defined(DHD_USE_SPIN_LOCK_BH) && !defined(DHD_USE_PCIE_OOB_THREADED_IRQ)
+#error "Cannot enable DHD_USE_SPIN_LOCK_BH without enabling DHD_USE_PCIE_OOB_THREADED_IRQ"
+#endif /* DHD_USE_SPIN_LOCK_BH && !DHD_USE_PCIE_OOB_THREADED_IRQ */
+
+#ifdef DHD_USE_PCIE_OOB_THREADED_IRQ
+static irqreturn_t wlan_oob_irq_isr(int irq, void *data)
+{
+       dhd_bus_t *bus = (dhd_bus_t *)data;
+       DHD_TRACE(("%s: IRQ ISR\n", __FUNCTION__));
+       bus->last_oob_irq_isr_time = OSL_LOCALTIME_NS();
+       return IRQ_WAKE_THREAD;
+}
+#endif /* DHD_USE_PCIE_OOB_THREADED_IRQ */
+
+static irqreturn_t wlan_oob_irq(int irq, void *data)
+{
+       dhd_bus_t *bus;
+       bus = (dhd_bus_t *)data;
+       dhdpcie_oob_intr_set(bus, FALSE);
+#ifdef DHD_USE_PCIE_OOB_THREADED_IRQ
+       DHD_TRACE(("%s: IRQ Thread\n", __FUNCTION__));
+       bus->last_oob_irq_thr_time = OSL_LOCALTIME_NS();
+#else
+       DHD_TRACE(("%s: IRQ ISR\n", __FUNCTION__));
+       bus->last_oob_irq_isr_time = OSL_LOCALTIME_NS();
+#endif /* DHD_USE_PCIE_OOB_THREADED_IRQ */
+       bus->oob_intr_count++;
+#ifdef DHD_WAKE_STATUS
+#ifdef DHD_PCIE_RUNTIMEPM
+       /* This condition is for avoiding counting of wake up from Runtime PM */
+       if (bus->chk_pm)
+#endif /* DHD_PCIE_RUNTIMPM */
+       {
+               bcmpcie_set_get_wake(bus, 1);
+       }
+#endif /* DHD_WAKE_STATUS */
+#ifdef DHD_PCIE_RUNTIMEPM
+       dhdpcie_runtime_bus_wake(bus->dhd, FALSE, wlan_oob_irq);
+#endif /* DHD_PCIE_RUNTIMPM */
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+       dhd_bus_wakeup_work(bus->dhd);
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+       /* Hold wakelock if bus_low_power_state is
+        * DHD_BUS_D3_INFORM_SENT OR DHD_BUS_D3_ACK_RECIEVED
+        */
+       if (bus->dhd->up && DHD_CHK_BUS_IN_LPS(bus)) {
+               DHD_OS_OOB_IRQ_WAKE_LOCK_TIMEOUT(bus->dhd, OOB_WAKE_LOCK_TIMEOUT);
+       }
+       return IRQ_HANDLED;
+}
+
+int dhdpcie_oob_intr_register(dhd_bus_t *bus)
+{
+       int err = 0;
+       dhdpcie_info_t *pch;
+       dhdpcie_os_info_t *dhdpcie_osinfo;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+       if (bus == NULL) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       if (bus->dev == NULL) {
+               DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       pch = pci_get_drvdata(bus->dev);
+       if (pch == NULL) {
+               DHD_ERROR(("%s: pch is NULL\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       dhdpcie_osinfo = (dhdpcie_os_info_t *)pch->os_cxt;
+       if (dhdpcie_osinfo->oob_irq_registered) {
+               DHD_ERROR(("%s: irq is already registered\n", __FUNCTION__));
+               return -EBUSY;
+       }
+
+       if (dhdpcie_osinfo->oob_irq_num > 0) {
+               printf("%s OOB irq=%d flags=0x%X\n", __FUNCTION__,
+                       (int)dhdpcie_osinfo->oob_irq_num,
+                       (int)dhdpcie_osinfo->oob_irq_flags);
+#ifdef DHD_USE_PCIE_OOB_THREADED_IRQ
+               err = request_threaded_irq(dhdpcie_osinfo->oob_irq_num,
+                       wlan_oob_irq_isr, wlan_oob_irq,
+                       dhdpcie_osinfo->oob_irq_flags, "dhdpcie_host_wake",
+                       bus);
+#else
+               err = request_irq(dhdpcie_osinfo->oob_irq_num, wlan_oob_irq,
+                       dhdpcie_osinfo->oob_irq_flags, "dhdpcie_host_wake",
+                       bus);
+#endif /* DHD_USE_THREADED_IRQ_PCIE_OOB */
+               if (err) {
+                       DHD_ERROR(("%s: request_irq failed with %d\n",
+                               __FUNCTION__, err));
+                       return err;
+               }
+#if defined(DISABLE_WOWLAN)
+               printf("%s: disable_irq_wake\n", __FUNCTION__);
+               dhdpcie_osinfo->oob_irq_wake_enabled = FALSE;
+#else
+               printf("%s: enable_irq_wake\n", __FUNCTION__);
+               err = enable_irq_wake(dhdpcie_osinfo->oob_irq_num);
+               if (!err) {
+                       dhdpcie_osinfo->oob_irq_wake_enabled = TRUE;
+               } else
+                       printf("%s: enable_irq_wake failed with %d\n", __FUNCTION__, err);
+#endif
+               dhdpcie_osinfo->oob_irq_enabled = TRUE;
+       }
+
+       dhdpcie_osinfo->oob_irq_registered = TRUE;
+
+       return 0;
+}
+
+void dhdpcie_oob_intr_unregister(dhd_bus_t *bus)
+{
+       int err = 0;
+       dhdpcie_info_t *pch;
+       dhdpcie_os_info_t *dhdpcie_osinfo;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+       if (bus == NULL) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (bus->dev == NULL) {
+               DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       pch = pci_get_drvdata(bus->dev);
+       if (pch == NULL) {
+               DHD_ERROR(("%s: pch is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       dhdpcie_osinfo = (dhdpcie_os_info_t *)pch->os_cxt;
+       if (!dhdpcie_osinfo->oob_irq_registered) {
+               DHD_ERROR(("%s: irq is not registered\n", __FUNCTION__));
+               return;
+       }
+       if (dhdpcie_osinfo->oob_irq_num > 0) {
+               if (dhdpcie_osinfo->oob_irq_wake_enabled) {
+                       err = disable_irq_wake(dhdpcie_osinfo->oob_irq_num);
+                       if (!err) {
+                               dhdpcie_osinfo->oob_irq_wake_enabled = FALSE;
+                       }
+               }
+               if (dhdpcie_osinfo->oob_irq_enabled) {
+                       disable_irq(dhdpcie_osinfo->oob_irq_num);
+                       dhdpcie_osinfo->oob_irq_enabled = FALSE;
+               }
+               free_irq(dhdpcie_osinfo->oob_irq_num, bus);
+       }
+       dhdpcie_osinfo->oob_irq_registered = FALSE;
+}
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+#ifdef DHD_PCIE_RUNTIMEPM
+bool dhd_runtimepm_state(dhd_pub_t *dhd)
+{
+       dhd_bus_t *bus;
+       unsigned long flags;
+       bus = dhd->bus;
+
+       DHD_GENERAL_LOCK(dhd, flags);
+       bus->idlecount++;
+
+       DHD_TRACE(("%s : Enter \n", __FUNCTION__));
+       if ((bus->idletime > 0) && (bus->idlecount >= bus->idletime)) {
+               bus->idlecount = 0;
+               if (DHD_BUS_BUSY_CHECK_IDLE(dhd) && !DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(dhd) &&
+                       !DHD_CHECK_CFG_IN_PROGRESS(dhd)) {
+                       DHD_ERROR(("%s: DHD Idle state!! -  idletime :%d, wdtick :%d \n",
+                                       __FUNCTION__, bus->idletime, dhd_runtimepm_ms));
+                       bus->bus_wake = 0;
+                       DHD_BUS_BUSY_SET_RPM_SUSPEND_IN_PROGRESS(dhd);
+                       bus->runtime_resume_done = FALSE;
+                       /* stop all interface network queue. */
+                       dhd_bus_stop_queue(bus);
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+                       /* RPM suspend is failed, return FALSE then re-trying */
+                       if (dhdpcie_set_suspend_resume(bus, TRUE)) {
+                               DHD_ERROR(("%s: exit with wakelock \n", __FUNCTION__));
+                               DHD_GENERAL_LOCK(dhd, flags);
+                               DHD_BUS_BUSY_CLEAR_RPM_SUSPEND_IN_PROGRESS(dhd);
+                               dhd_os_busbusy_wake(bus->dhd);
+                               bus->runtime_resume_done = TRUE;
+                               /* It can make stuck NET TX Queue without below */
+                               dhd_bus_start_queue(bus);
+                               DHD_GENERAL_UNLOCK(dhd, flags);
+                               if (bus->dhd->rx_pending_due_to_rpm) {
+                                       /* Reschedule tasklet to process Rx frames */
+                                       DHD_ERROR(("%s: Schedule DPC to process pending"
+                                               " Rx packets\n", __FUNCTION__));
+                                       dhd_sched_dpc(bus->dhd);
+                               }
+                               /* enabling host irq deferred from system suspend */
+                               if (dhdpcie_irq_disabled(bus)) {
+                                       dhdpcie_enable_irq(bus);
+                                       /* increasing intrrupt count when it enabled */
+                                       bus->resume_intr_enable_count++;
+                               }
+                               smp_wmb();
+                               wake_up(&bus->rpm_queue);
+                               return FALSE;
+                       }
+
+                       DHD_GENERAL_LOCK(dhd, flags);
+                       DHD_BUS_BUSY_CLEAR_RPM_SUSPEND_IN_PROGRESS(dhd);
+                       DHD_BUS_BUSY_SET_RPM_SUSPEND_DONE(dhd);
+                       /* For making sure NET TX Queue active  */
+                       dhd_bus_start_queue(bus);
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+
+                       wait_event(bus->rpm_queue, bus->bus_wake);
+
+                       DHD_GENERAL_LOCK(dhd, flags);
+                       DHD_BUS_BUSY_CLEAR_RPM_SUSPEND_DONE(dhd);
+                       DHD_BUS_BUSY_SET_RPM_RESUME_IN_PROGRESS(dhd);
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+
+                       dhdpcie_set_suspend_resume(bus, FALSE);
+
+                       DHD_GENERAL_LOCK(dhd, flags);
+                       DHD_BUS_BUSY_CLEAR_RPM_RESUME_IN_PROGRESS(dhd);
+                       dhd_os_busbusy_wake(bus->dhd);
+                       /* Inform the wake up context that Resume is over */
+                       bus->runtime_resume_done = TRUE;
+                       /* For making sure NET TX Queue active  */
+                       dhd_bus_start_queue(bus);
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+
+                       if (bus->dhd->rx_pending_due_to_rpm) {
+                               /* Reschedule tasklet to process Rx frames */
+                               DHD_ERROR(("%s: Schedule DPC to process pending Rx packets\n",
+                                       __FUNCTION__));
+                               bus->rpm_sched_dpc_time = OSL_LOCALTIME_NS();
+                               dhd_sched_dpc(bus->dhd);
+                       }
+
+                       /* enabling host irq deferred from system suspend */
+                       if (dhdpcie_irq_disabled(bus)) {
+                               dhdpcie_enable_irq(bus);
+                               /* increasing intrrupt count when it enabled */
+                               bus->resume_intr_enable_count++;
+                       }
+
+                       smp_wmb();
+                       wake_up(&bus->rpm_queue);
+                       DHD_ERROR(("%s : runtime resume ended \n", __FUNCTION__));
+                       return TRUE;
+               } else {
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+                       /* Since one of the contexts are busy (TX, IOVAR or RX)
+                        * we should not suspend
+                        */
+                       DHD_ERROR(("%s : bus is active with dhd_bus_busy_state = 0x%x\n",
+                               __FUNCTION__, dhd->dhd_bus_busy_state));
+                       return FALSE;
+               }
+       }
+
+       DHD_GENERAL_UNLOCK(dhd, flags);
+       return FALSE;
+} /* dhd_runtimepm_state */
+
+/*
+ * dhd_runtime_bus_wake
+ *  TRUE - related with runtime pm context
+ *  FALSE - It isn't invloved in runtime pm context
+ */
+bool dhd_runtime_bus_wake(dhd_bus_t *bus, bool wait, void *func_addr)
+{
+       unsigned long flags;
+       bus->idlecount = 0;
+       DHD_TRACE(("%s : enter\n", __FUNCTION__));
+       if (bus->dhd->up == FALSE) {
+               DHD_INFO(("%s : dhd is not up\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       if (DHD_BUS_BUSY_CHECK_RPM_ALL(bus->dhd)) {
+               /* Wake up RPM state thread if it is suspend in progress or suspended */
+               if (DHD_BUS_BUSY_CHECK_RPM_SUSPEND_IN_PROGRESS(bus->dhd) ||
+                               DHD_BUS_BUSY_CHECK_RPM_SUSPEND_DONE(bus->dhd)) {
+                       bus->bus_wake = 1;
+
+                       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+                       DHD_ERROR(("Runtime Resume is called in %pf\n", func_addr));
+                       smp_wmb();
+                       wake_up(&bus->rpm_queue);
+               /* No need to wake up the RPM state thread */
+               } else if (DHD_BUS_BUSY_CHECK_RPM_RESUME_IN_PROGRESS(bus->dhd)) {
+                       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+               }
+
+               /* If wait is TRUE, function with wait = TRUE will be wait in here  */
+               if (wait) {
+                       if (!wait_event_timeout(bus->rpm_queue, bus->runtime_resume_done,
+                                       msecs_to_jiffies(RPM_WAKE_UP_TIMEOUT))) {
+                               DHD_ERROR(("%s: RPM_WAKE_UP_TIMEOUT error\n", __FUNCTION__));
+                               return FALSE;
+                       }
+               } else {
+                       DHD_INFO(("%s: bus wakeup but no wait until resume done\n", __FUNCTION__));
+               }
+               /* If it is called from RPM context, it returns TRUE */
+               return TRUE;
+       }
+
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+       return FALSE;
+}
+
+bool dhdpcie_runtime_bus_wake(dhd_pub_t *dhdp, bool wait, void* func_addr)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       return dhd_runtime_bus_wake(bus, wait, func_addr);
+}
+
+void dhdpcie_block_runtime_pm(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       bus->idletime = 0;
+}
+
+bool dhdpcie_is_resume_done(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       return bus->runtime_resume_done;
+}
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+struct device * dhd_bus_to_dev(dhd_bus_t *bus)
+{
+       struct pci_dev *pdev;
+       pdev = bus->dev;
+
+       if (pdev)
+               return &pdev->dev;
+       else
+               return NULL;
+}
+
+#ifdef DHD_FW_COREDUMP
+int
+dhd_dongle_mem_dump(void)
+{
+       if (!g_dhd_bus) {
+               DHD_ERROR(("%s: Bus is NULL\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       dhd_bus_dump_console_buffer(g_dhd_bus);
+       dhd_prot_debug_info_print(g_dhd_bus->dhd);
+
+       g_dhd_bus->dhd->memdump_enabled = DUMP_MEMFILE_BUGON;
+       g_dhd_bus->dhd->memdump_type = DUMP_TYPE_AP_ABNORMAL_ACCESS;
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       dhdpcie_runtime_bus_wake(g_dhd_bus->dhd, TRUE, __builtin_return_address(0));
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       dhd_bus_mem_dump(g_dhd_bus->dhd);
+       return 0;
+}
+EXPORT_SYMBOL(dhd_dongle_mem_dump);
+#endif /* DHD_FW_COREDUMP */
+
+bool
+dhd_bus_check_driver_up(void)
+{
+       dhd_bus_t *bus;
+       dhd_pub_t *dhdp;
+       bool isup = FALSE;
+
+       bus = (dhd_bus_t *)g_dhd_bus;
+       if (!bus) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return isup;
+       }
+
+       dhdp = bus->dhd;
+       if (dhdp) {
+               isup = dhdp->up;
+       }
+
+       return isup;
+}
+EXPORT_SYMBOL(dhd_bus_check_driver_up);
diff --git a/bcmdhd.101.10.240.x/dhd_pktlog.c b/bcmdhd.101.10.240.x/dhd_pktlog.c
new file mode 100644 (file)
index 0000000..3c0b85f
--- /dev/null
@@ -0,0 +1,1674 @@
+/*
+ * DHD debugability packet logging support
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <bcmstdlib_s.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <dhd_pktlog.h>
+
+#ifdef DHD_COMPACT_PKT_LOG
+#include <bcmip.h>
+#include <bcmudp.h>
+#include <bcmdhcp.h>
+#include <bcmarp.h>
+#include <bcmicmp.h>
+#include <bcmtlv.h>
+#include <802.11.h>
+#include <eap.h>
+#include <eapol.h>
+#include <bcmendian.h>
+#include <bcm_l2_filter.h>
+#include <dhd_bitpack.h>
+#include <bcmipv6.h>
+#endif /* DHD_COMPACT_PKT_LOG */
+
+#ifdef DHD_PKT_LOGGING
+#ifndef strtoul
+#define strtoul(nptr, endptr, base) bcm_strtoul((nptr), (endptr), (base))
+#endif /* strtoul */
+extern int wl_pattern_atoh(char *src, char *dst);
+extern int pattern_atoh_len(char *src, char *dst, int len);
+extern wifi_tx_packet_fate __dhd_dbg_map_tx_status_to_pkt_fate(uint16 status);
+
+#ifdef DHD_COMPACT_PKT_LOG
+#define CPKT_LOG_BITS_PER_BYTE         8
+
+#define CPKT_LOG_BIT_LEN_TYPE          4
+
+#define CPKT_LOG_BIT_OFFSET_TS         0
+#define CPKT_LOG_BIT_OFFSET_DIR                5
+#define CPKT_LOG_BIT_OFFSET_TYPE       6
+#define CPKT_LOG_BIT_OFFSET_SUBTYPE    10
+#define CPKT_LOG_BIT_OFFSET_PKT_FATE   18
+
+#define CPKT_LOG_BIT_MASK_TS           0x1f
+#define CPKT_LOG_BIT_MASK_DIR          0x01
+#define CPKT_LOG_BIT_MASK_TYPE         0x0f
+#define CPKT_LOG_BIT_MASK_SUBTYPE      0xff
+#define CPKT_LOG_BIT_MASK_PKT_FATE     0x0f
+
+#define CPKT_LOG_DNS_PORT_CLIENT       53
+#define CPKT_LOG_MDNS_PORT_CLIENT      5353
+
+#define CPKT_LOG_TYPE_DNS              0x0
+#define CPKT_LOG_TYPE_ARP              0x1
+#define CPKT_LOG_TYPE_ICMP_REQ         0x2
+#define CPKT_LOG_TYPE_ICMP_RES         0x3
+#define CPKT_LOG_TYPE_ICMP_UNREACHABLE 0x4
+#define CPKT_LOG_TYPE_DHCP             0x5
+#define CPKT_LOG_TYPE_802_1X           0x6
+#define CPKT_LOG_TYPE_ICMPv6           0x7
+#define CPKT_LOG_TYPE_OTHERS           0xf
+
+#define CPKT_LOG_802_1X_SUBTYPE_IDENTITY       0x0
+#define CPKT_LOG_802_1X_SUBTYPE_TLS            0x1
+#define CPKT_LOG_802_1X_SUBTYPE_TTLS           0x2
+#define CPKT_LOG_802_1X_SUBTYPE_PEAP           0x3
+#define CPKT_LOG_802_1X_SUBTYPE_FAST           0x4
+#define CPKT_LOG_802_1X_SUBTYPE_LEAP           0x5
+#define CPKT_LOG_802_1X_SUBTYPE_PWD            0x6
+#define CPKT_LOG_802_1X_SUBTYPE_SIM            0x7
+#define CPKT_LOG_802_1X_SUBTYPE_AKA            0x8
+#define CPKT_LOG_802_1X_SUBTYPE_AKAP           0x9
+#define CPKT_LOG_802_1X_SUBTYPE_SUCCESS                0xA
+#define CPKT_LOG_802_1X_SUBTYPE_4WAY_M1                0xB
+#define CPKT_LOG_802_1X_SUBTYPE_4WAY_M2                0xC
+#define CPKT_LOG_802_1X_SUBTYPE_4WAY_M3                0xD
+#define CPKT_LOG_802_1X_SUBTYPE_4WAY_M4                0xE
+#define CPKT_LOG_802_1X_SUBTYPE_OTHERS         0xF
+
+#define CPKT_LOG_DHCP_MAGIC_COOKIE_LEN                 4
+
+#define CPKT_LOG_ICMP_TYPE_DEST_UNREACHABLE            3
+#define CPKT_LOG_ICMP_TYPE_DEST_UNREACHABLE_IPV4_OFFSET        4
+
+typedef struct dhd_cpkt_log_ts_node {
+       struct rb_node rb;
+
+       uint64 ts_diff;         /* key, usec */
+       int idx;
+} dhd_cpkt_log_ts_node_t;
+
+/* Compact Packet Log Timestamp values, unit: uSec */
+const uint64 dhd_cpkt_log_tt_idx[] = {
+       10000, 50000, 100000, 150000, 300000, 500000, 750000, 1000000, 3000000, 5000000, 7500000,
+       10000000, 12500000, 15000000, 17500000, 20000000, 22500000, 25000000, 27500000, 30000000,
+       32500000, 35000000, 37500000, 40000000, 50000000, 75000000, 150000000, 300000000, 400000000,
+       500000000, 600000000
+};
+#define CPKT_LOG_TT_IDX_ARR_SZ ARRAYSIZE(dhd_cpkt_log_tt_idx)
+
+static int dhd_cpkt_log_init_tt(dhd_pub_t *dhdp);
+static void dhd_cpkt_log_deinit_tt(dhd_pub_t *dhdp);
+#endif /* DHD_COMPACT_PKT_LOG */
+
+int
+dhd_os_attach_pktlog(dhd_pub_t *dhdp)
+{
+       dhd_pktlog_t *pktlog;
+
+       if (!dhdp) {
+               DHD_ERROR(("%s(): dhdp is NULL\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       pktlog = (dhd_pktlog_t *)MALLOCZ(dhdp->osh, sizeof(dhd_pktlog_t));
+       if (unlikely(!pktlog)) {
+               DHD_ERROR(("%s(): could not allocate memory for - "
+                                       "dhd_pktlog_t\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       dhdp->pktlog = pktlog;
+       pktlog->dhdp = dhdp;
+
+       OSL_ATOMIC_INIT(dhdp->osh, &pktlog->pktlog_status);
+
+       /* pktlog ring */
+       dhdp->pktlog->pktlog_ring = dhd_pktlog_ring_init(dhdp, MIN_PKTLOG_LEN);
+       dhdp->pktlog->pktlog_filter = dhd_pktlog_filter_init(MAX_DHD_PKTLOG_FILTER_LEN);
+#ifdef DHD_COMPACT_PKT_LOG
+       dhd_cpkt_log_init_tt(dhdp);
+#endif
+
+       DHD_ERROR(("%s(): dhd_os_attach_pktlog attach\n", __FUNCTION__));
+
+       return BCME_OK;
+}
+
+int
+dhd_os_detach_pktlog(dhd_pub_t *dhdp)
+{
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       dhd_pktlog_ring_deinit(dhdp, dhdp->pktlog->pktlog_ring);
+       dhd_pktlog_filter_deinit(dhdp->pktlog->pktlog_filter);
+#ifdef DHD_COMPACT_PKT_LOG
+       dhd_cpkt_log_deinit_tt(dhdp);
+#endif /* DHD_COMPACT_PKT_LOG */
+
+       DHD_ERROR(("%s(): dhd_os_attach_pktlog detach\n", __FUNCTION__));
+
+       MFREE(dhdp->osh, dhdp->pktlog, sizeof(dhd_pktlog_t));
+
+       return BCME_OK;
+}
+
+dhd_pktlog_ring_t*
+dhd_pktlog_ring_init(dhd_pub_t *dhdp, int size)
+{
+       dhd_pktlog_ring_t *ring;
+       int i = 0;
+
+       if (!dhdp) {
+               DHD_ERROR(("%s(): dhdp is NULL\n", __FUNCTION__));
+               return NULL;
+       }
+
+       ring = (dhd_pktlog_ring_t *)MALLOCZ(dhdp->osh, sizeof(dhd_pktlog_ring_t));
+       if (unlikely(!ring)) {
+               DHD_ERROR(("%s(): could not allocate memory for - "
+                                       "dhd_pktlog_ring_t\n", __FUNCTION__));
+               goto fail;
+       }
+
+       dll_init(&ring->ring_info_head);
+       dll_init(&ring->ring_info_free);
+
+       ring->ring_info_mem = (dhd_pktlog_ring_info_t *)MALLOCZ(dhdp->osh,
+               sizeof(dhd_pktlog_ring_info_t) * size);
+       if (unlikely(!ring->ring_info_mem)) {
+               DHD_ERROR(("%s(): could not allocate memory for - "
+                                       "dhd_pktlog_ring_info_t\n", __FUNCTION__));
+               goto fail;
+       }
+
+       /* initialize free ring_info linked list */
+       for (i = 0; i < size; i++) {
+           dll_append(&ring->ring_info_free, (dll_t *)&ring->ring_info_mem[i].p_info);
+       }
+
+       OSL_ATOMIC_SET(dhdp->osh, &ring->start, TRUE);
+       ring->pktlog_minmize = FALSE;
+       ring->pktlog_len = size;
+       ring->pktcount = 0;
+       ring->dhdp = dhdp;
+       ring->pktlog_ring_lock = osl_spin_lock_init(dhdp->osh);
+
+       DHD_ERROR(("%s(): pktlog ring init success\n", __FUNCTION__));
+
+       return ring;
+fail:
+       if (ring) {
+               MFREE(dhdp->osh, ring, sizeof(dhd_pktlog_ring_t));
+       }
+
+       return NULL;
+}
+
+/* Maximum wait counts */
+#define DHD_PKTLOG_WAIT_MAXCOUNT 1000
+int
+dhd_pktlog_ring_deinit(dhd_pub_t *dhdp, dhd_pktlog_ring_t *ring)
+{
+       int ret = BCME_OK;
+       dhd_pktlog_ring_info_t *ring_info;
+       dll_t *item, *next_p;
+       int waitcounts = 0;
+
+       if (!ring) {
+               DHD_ERROR(("%s(): ring is NULL\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       if (!ring->dhdp) {
+               DHD_ERROR(("%s(): dhdp is NULL\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       /* stop pkt log */
+       OSL_ATOMIC_SET(dhdp->osh, &ring->start, FALSE);
+
+       /* waiting TX/RX/TXS context is done, max timeout 1 second */
+       while ((waitcounts++ < DHD_PKTLOG_WAIT_MAXCOUNT)) {
+               if (!OSL_ATOMIC_READ(dhdp->osh, &dhdp->pktlog->pktlog_status))
+                       break;
+               OSL_SLEEP(1);
+       }
+
+       if (waitcounts >= DHD_PKTLOG_WAIT_MAXCOUNT) {
+               DHD_ERROR(("%s(): pktlog wait timeout pktlog_status : 0x%x \n",
+                       __FUNCTION__,
+                       OSL_ATOMIC_READ(dhdp->osh, &dhdp->pktlog->pktlog_status)));
+               ASSERT(0);
+               return -EINVAL;
+       }
+
+       /* free ring_info->info.pkt */
+       for (item = dll_head_p(&ring->ring_info_head); !dll_end(&ring->ring_info_head, item);
+               item = next_p) {
+               next_p = dll_next_p(item);
+
+               ring_info = (dhd_pktlog_ring_info_t *)item;
+
+               if (ring_info->info.pkt) {
+                       PKTFREE(ring->dhdp->osh, ring_info->info.pkt, TRUE);
+                       DHD_PKT_LOG(("%s(): pkt free pos %p\n",
+                                       __FUNCTION__, ring_info->info.pkt));
+               }
+       }
+
+       if (ring->ring_info_mem) {
+               MFREE(ring->dhdp->osh, ring->ring_info_mem,
+                       sizeof(dhd_pktlog_ring_info_t) * ring->pktlog_len);
+       }
+
+       if (ring->pktlog_ring_lock) {
+               osl_spin_lock_deinit(ring->dhdp->osh, ring->pktlog_ring_lock);
+       }
+
+       MFREE(dhdp->osh, ring, sizeof(dhd_pktlog_ring_t));
+
+       DHD_ERROR(("%s(): pktlog ring deinit\n", __FUNCTION__));
+
+       return ret;
+}
+
+/*
+ * dhd_pktlog_ring_add_pkts : add filtered packets into pktlog ring
+ * direction :  1 - TX / 0 - RX
+ * pktid : incase of rx, pktid is not used (pass DHD_INVALID_PKID)
+ */
+int
+dhd_pktlog_ring_add_pkts(dhd_pub_t *dhdp, void *pkt, uint32 pktid, bool direction)
+{
+       dhd_pktlog_ring_info_t *pkts;
+       uint8 *pktdata = NULL;
+       dhd_pktlog_ring_t *pktlog_ring;
+       dhd_pktlog_filter_t *pktlog_filter;
+       u64 ts_nsec;
+       uint32 pktlog_case = 0;
+       unsigned long rem_nsec;
+       unsigned long flags = 0;
+
+       /*
+        * dhdp, dhdp->pktlog, dhd->pktlog_ring, pktlog_ring->start
+        * are validated from the DHD_PKTLOG_TX macro
+        */
+
+       pktlog_ring = dhdp->pktlog->pktlog_ring;
+       pktlog_filter = dhdp->pktlog->pktlog_filter;
+
+       pktdata = (uint8 *)PKTDATA(dhdp->osh, pkt);
+       if (direction == PKT_TX) {
+           pktlog_case = PKTLOG_TXPKT_CASE;
+       } else {
+           pktlog_case = PKTLOG_RXPKT_CASE;
+       }
+
+       if (dhd_pktlog_filter_matched(pktlog_filter, pktdata, pktlog_case)
+               == FALSE) {
+           return BCME_OK;
+       }
+
+       if (direction == PKT_TX && pktid == DHD_INVALID_PKTID) {
+           DHD_ERROR(("%s : Invalid PKTID \n", __FUNCTION__));
+           return BCME_ERROR;
+       }
+
+       /* get free ring_info and insert to ring_info_head */
+       DHD_PKT_LOG_LOCK(pktlog_ring->pktlog_ring_lock, flags);
+       /* if free_list is empty, use the oldest ring_info */
+       if (dll_empty(&pktlog_ring->ring_info_free)) {
+           pkts = (dhd_pktlog_ring_info_t *)dll_head_p(&pktlog_ring->ring_info_head);
+           dll_delete((dll_t *)pkts);
+           /* free the oldest packet */
+           PKTFREE(pktlog_ring->dhdp->osh, pkts->info.pkt, TRUE);
+           pktlog_ring->pktcount--;
+       } else {
+           pkts = (dhd_pktlog_ring_info_t *)dll_tail_p(&pktlog_ring->ring_info_free);
+           dll_delete((dll_t *)pkts);
+       }
+
+       /* Update packet information */
+       ts_nsec = local_clock();
+       rem_nsec = do_div(ts_nsec, NSEC_PER_SEC);
+
+       pkts->info.pkt = PKTDUP(dhdp->osh, pkt);
+       pkts->info.pkt_len = PKTLEN(dhdp->osh, pkt);
+       pkts->info.driver_ts_sec = (uint32)ts_nsec;
+       pkts->info.driver_ts_usec = (uint32)(rem_nsec/NSEC_PER_USEC);
+       pkts->info.firmware_ts = 0U;
+       pkts->info.payload_type = FRAME_TYPE_ETHERNET_II;
+       pkts->info.direction = direction;
+
+       if (direction == PKT_TX) {
+           pkts->info.pkt_hash =  __dhd_dbg_pkt_hash((uintptr_t)pkt, pktid);
+           pkts->tx_fate = TX_PKT_FATE_DRV_QUEUED;
+       } else {
+           pkts->info.pkt_hash = 0U;
+           pkts->rx_fate = RX_PKT_FATE_SUCCESS;
+       }
+
+       DHD_PKT_LOG(("%s(): pkt hash %d\n", __FUNCTION__, pkts->info.pkt_hash));
+       DHD_PKT_LOG(("%s(): sec %d usec %d\n", __FUNCTION__,
+                       pkts->info.driver_ts_sec, pkts->info.driver_ts_usec));
+
+       /* insert tx_pkts to the pktlog_ring->ring_info_head */
+       dll_append(&pktlog_ring->ring_info_head, (dll_t *)pkts);
+       pktlog_ring->pktcount++;
+       DHD_PKT_LOG_UNLOCK(pktlog_ring->pktlog_ring_lock, flags);
+       return BCME_OK;
+}
+
+int
+dhd_pktlog_ring_tx_status(dhd_pub_t *dhdp, void *pkt, uint32 pktid,
+               uint16 status)
+{
+       dhd_pktlog_ring_info_t *tx_pkt;
+       wifi_tx_packet_fate pkt_fate;
+       uint32 pkt_hash, temp_hash;
+       uint8 *pktdata = NULL;
+       dhd_pktlog_ring_t *pktlog_ring;
+       dhd_pktlog_filter_t *pktlog_filter;
+       dll_t *item_p, *next_p;
+       unsigned long flags = 0;
+
+       /*
+        * dhdp, dhdp->pktlog, dhd->pktlog_ring, pktlog_ring->start
+        * are validated from the DHD_PKTLOG_TXS macro
+        */
+
+       pktlog_ring = dhdp->pktlog->pktlog_ring;
+       pktlog_filter = dhdp->pktlog->pktlog_filter;
+
+       pktdata = (uint8 *)PKTDATA(dhdp->osh, pkt);
+       if (dhd_pktlog_filter_matched(pktlog_filter, pktdata,
+               PKTLOG_TXSTATUS_CASE) == FALSE) {
+               return BCME_OK;
+       }
+
+       pkt_hash = __dhd_dbg_pkt_hash((uintptr_t)pkt, pktid);
+       pkt_fate = __dhd_dbg_map_tx_status_to_pkt_fate(status);
+
+       /* find the sent tx packet and adding pkt_fate info */
+       DHD_PKT_LOG_LOCK(pktlog_ring->pktlog_ring_lock, flags);
+       /* Inverse traverse from the last packets */
+       for (item_p = dll_tail_p(&pktlog_ring->ring_info_head);
+               !dll_end(&pktlog_ring->ring_info_head, item_p);
+               item_p = next_p)
+       {
+           if (dll_empty(item_p)) {
+               break;
+           }
+           next_p = dll_prev_p(item_p);
+           tx_pkt = (dhd_pktlog_ring_info_t *)item_p;
+           temp_hash = tx_pkt->info.pkt_hash;
+           if (temp_hash == pkt_hash) {
+               tx_pkt->tx_fate = pkt_fate;
+               DHD_PKT_LOG(("%s(): Found pkt hash in prev pos\n", __FUNCTION__));
+               break;
+           }
+       }
+       DHD_PKT_LOG_UNLOCK(pktlog_ring->pktlog_ring_lock, flags);
+       return BCME_OK;
+}
+
+dhd_pktlog_filter_t*
+dhd_pktlog_filter_init(int size)
+{
+       int i;
+       gfp_t kflags;
+       uint32 alloc_len;
+       dhd_pktlog_filter_t *filter;
+       dhd_pktlog_filter_info_t *filter_info = NULL;
+
+       kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+
+       /* allocate and initialze pktmon filter */
+       alloc_len = sizeof(dhd_pktlog_filter_t);
+       filter = (dhd_pktlog_filter_t *)kzalloc(alloc_len, kflags);
+       if (unlikely(!filter)) {
+               DHD_ERROR(("%s(): could not allocate memory for - "
+                                       "dhd_pktlog_filter_t\n", __FUNCTION__));
+               goto fail;
+       }
+
+       alloc_len = (sizeof(dhd_pktlog_filter_info_t) * size);
+       filter_info = (dhd_pktlog_filter_info_t *)kzalloc(alloc_len, kflags);
+       if (unlikely(!filter_info)) {
+               DHD_ERROR(("%s(): could not allocate memory for - "
+                                       "dhd_pktlog_filter_info_t\n", __FUNCTION__));
+               goto fail;
+       }
+
+       filter->info = filter_info;
+       filter->list_cnt = 0;
+
+       for (i = 0; i < MAX_DHD_PKTLOG_FILTER_LEN; i++) {
+               filter->info[i].id = 0;
+       }
+
+       filter->enable = PKTLOG_TXPKT_CASE | PKTLOG_TXSTATUS_CASE | PKTLOG_RXPKT_CASE;
+
+       DHD_ERROR(("%s(): pktlog filter init success\n", __FUNCTION__));
+
+       return filter;
+fail:
+       if (filter) {
+               kfree(filter);
+       }
+
+       return NULL;
+}
+
+int
+dhd_pktlog_filter_deinit(dhd_pktlog_filter_t *filter)
+{
+       int ret = BCME_OK;
+
+       if (!filter) {
+               DHD_ERROR(("%s(): filter is NULL\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       if (filter->info) {
+               kfree(filter->info);
+       }
+       kfree(filter);
+
+       DHD_ERROR(("%s(): pktlog filter deinit\n", __FUNCTION__));
+
+       return ret;
+}
+
+bool
+dhd_pktlog_filter_existed(dhd_pktlog_filter_t *filter, char *arg, uint32 *id)
+{
+       char filter_pattern[MAX_FILTER_PATTERN_LEN];
+       char *p;
+       int i, j;
+       int nchar;
+       int len;
+
+       if  (!filter || !arg) {
+               DHD_ERROR(("%s(): filter=%p arg=%p\n", __FUNCTION__, filter, arg));
+               return TRUE;
+       }
+
+       for (i = 0; i < filter->list_cnt; i++) {
+               p = filter_pattern;
+               len = sizeof(filter_pattern);
+
+               nchar = snprintf(p, len, "%d ", filter->info[i].offset);
+               p += nchar;
+               len -= nchar;
+
+               nchar = snprintf(p, len, "0x");
+               p += nchar;
+               len -= nchar;
+
+               for (j = 0; j < filter->info[i].size_bytes; j++) {
+                       nchar = snprintf(p, len, "%02x", filter->info[i].mask[j]);
+                       p += nchar;
+                       len -= nchar;
+               }
+
+               nchar = snprintf(p, len, " 0x");
+               p += nchar;
+               len -= nchar;
+
+               for (j = 0; j < filter->info[i].size_bytes; j++) {
+                       nchar = snprintf(p, len, "%02x", filter->info[i].pattern[j]);
+                       p += nchar;
+                       len -= nchar;
+               }
+
+               if (strlen(arg) < strlen(filter_pattern)) {
+                       continue;
+               }
+
+               DHD_PKT_LOG(("%s(): Pattern %s\n", __FUNCTION__, filter_pattern));
+
+               if (strncmp(filter_pattern, arg, strlen(filter_pattern)) == 0) {
+                       *id = filter->info[i].id;
+                       DHD_ERROR(("%s(): This pattern is existed\n", __FUNCTION__));
+                       DHD_ERROR(("%s(): arg %s\n", __FUNCTION__, arg));
+                       return TRUE;
+               }
+       }
+
+       return FALSE;
+}
+
+int
+dhd_pktlog_filter_add(dhd_pktlog_filter_t *filter, char *arg)
+{
+       int32 mask_size, pattern_size;
+       char *offset, *bitmask, *pattern;
+       uint32 id = 0;
+
+       if  (!filter || !arg) {
+               DHD_ERROR(("%s(): pktlog_filter =%p arg =%p\n", __FUNCTION__, filter, arg));
+               return BCME_ERROR;
+       }
+
+       DHD_PKT_LOG(("%s(): arg %s\n", __FUNCTION__, arg));
+
+       if (dhd_pktlog_filter_existed(filter, arg, &id) == TRUE) {
+               DHD_PKT_LOG(("%s(): This pattern id %d is existed\n", __FUNCTION__, id));
+               return BCME_OK;
+       }
+
+       if (filter->list_cnt >= MAX_DHD_PKTLOG_FILTER_LEN) {
+               DHD_ERROR(("%s(): pktlog filter full\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if ((offset = bcmstrtok(&arg, " ", 0)) == NULL) {
+               DHD_ERROR(("%s(): offset not found\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if ((bitmask = bcmstrtok(&arg, " ", 0)) == NULL) {
+               DHD_ERROR(("%s(): bitmask not found\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if ((pattern = bcmstrtok(&arg, " ", 0)) == NULL) {
+               DHD_ERROR(("%s(): pattern not found\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       /* parse filter bitmask */
+       mask_size = pattern_atoh_len(bitmask,
+                       (char *) &filter->info[filter->list_cnt].mask[0],
+                       MAX_MASK_PATTERN_FILTER_LEN);
+       if (mask_size == -1) {
+               DHD_ERROR(("Rejecting: %s\n", bitmask));
+               return BCME_ERROR;
+       }
+
+       /* parse filter pattern */
+       pattern_size = pattern_atoh_len(pattern,
+                       (char *) &filter->info[filter->list_cnt].pattern[0],
+                       MAX_MASK_PATTERN_FILTER_LEN);
+       if (pattern_size == -1) {
+               DHD_ERROR(("Rejecting: %s\n", pattern));
+               return BCME_ERROR;
+       }
+
+       prhex("mask", (char *)&filter->info[filter->list_cnt].mask[0],
+                       mask_size);
+       prhex("pattern", (char *)&filter->info[filter->list_cnt].pattern[0],
+                       pattern_size);
+
+       if (mask_size != pattern_size) {
+               DHD_ERROR(("%s(): Mask and pattern not the same size\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       filter->info[filter->list_cnt].offset = strtoul(offset, NULL, 0);
+       filter->info[filter->list_cnt].size_bytes = mask_size;
+       filter->info[filter->list_cnt].id = filter->list_cnt + 1;
+       filter->info[filter->list_cnt].enable = TRUE;
+
+       filter->list_cnt++;
+
+       return BCME_OK;
+}
+
+int
+dhd_pktlog_filter_del(dhd_pktlog_filter_t *filter, char *arg)
+{
+       uint32 id = 0;
+
+       if  (!filter || !arg) {
+               DHD_ERROR(("%s(): pktlog_filter =%p arg =%p\n", __FUNCTION__, filter, arg));
+               return BCME_ERROR;
+       }
+
+       DHD_PKT_LOG(("%s(): arg %s\n", __FUNCTION__, arg));
+
+       if (dhd_pktlog_filter_existed(filter, arg, &id) != TRUE) {
+               DHD_PKT_LOG(("%s(): This pattern id %d doesn't existed\n", __FUNCTION__, id));
+               return BCME_OK;
+       }
+
+       dhd_pktlog_filter_pull_forward(filter, id, filter->list_cnt);
+
+       filter->list_cnt--;
+
+       return BCME_OK;
+}
+
+int
+dhd_pktlog_filter_enable(dhd_pktlog_filter_t *filter, uint32 pktmon_case, uint32 enable)
+{
+       if  (!filter) {
+               DHD_ERROR(("%s(): filter is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       DHD_PKT_LOG(("%s(): pktlog_case %d enable %d\n", __FUNCTION__, pktmon_case, enable));
+
+       if (enable) {
+               filter->enable |=  pktmon_case;
+       } else {
+               filter->enable &= ~pktmon_case;
+       }
+
+       return BCME_OK;
+}
+
+int
+dhd_pktlog_filter_pattern_enable(dhd_pktlog_filter_t *filter, char *arg, uint32 enable)
+{
+       uint32 id = 0;
+
+       if  (!filter || !arg) {
+               DHD_ERROR(("%s(): pktlog_filter =%p arg =%p\n", __FUNCTION__, filter, arg));
+               return BCME_ERROR;
+       }
+
+       if (dhd_pktlog_filter_existed(filter, arg, &id) == TRUE) {
+               if (id > 0) {
+                       filter->info[id-1].enable = enable;
+                       DHD_ERROR(("%s(): This pattern id %d is %s\n",
+                               __FUNCTION__, id, (enable ? "enabled" : "disabled")));
+               }
+       } else {
+               DHD_ERROR(("%s(): This pattern is not existed\n", __FUNCTION__));
+               DHD_ERROR(("%s(): arg %s\n", __FUNCTION__, arg));
+       }
+
+       return BCME_OK;
+}
+
+int
+dhd_pktlog_filter_info(dhd_pktlog_filter_t *filter)
+{
+       char filter_pattern[MAX_FILTER_PATTERN_LEN];
+       char *p;
+       int i, j;
+       int nchar;
+       int len;
+
+       if  (!filter) {
+               DHD_ERROR(("%s(): pktlog_filter is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       DHD_ERROR(("---- PKTLOG FILTER INFO ----\n\n"));
+
+       DHD_ERROR(("Filter list cnt %d Filter is %s\n",
+               filter->list_cnt, (filter->enable ? "enabled" : "disabled")));
+
+       for (i = 0; i < filter->list_cnt; i++) {
+               p = filter_pattern;
+               len = sizeof(filter_pattern);
+
+               nchar = snprintf(p, len, "%d ", filter->info[i].offset);
+               p += nchar;
+               len -= nchar;
+
+               nchar = snprintf(p, len, "0x");
+               p += nchar;
+               len -= nchar;
+
+               for (j = 0; j < filter->info[i].size_bytes; j++) {
+                       nchar = snprintf(p, len, "%02x", filter->info[i].mask[j]);
+                       p += nchar;
+                       len -= nchar;
+               }
+
+               nchar = snprintf(p, len, " 0x");
+               p += nchar;
+               len -= nchar;
+
+               for (j = 0; j < filter->info[i].size_bytes; j++) {
+                       nchar = snprintf(p, len, "%02x", filter->info[i].pattern[j]);
+                       p += nchar;
+                       len -= nchar;
+               }
+
+               DHD_ERROR(("ID:%d is %s\n",
+                       filter->info[i].id, (filter->info[i].enable ? "enabled" : "disabled")));
+               DHD_ERROR(("Pattern %s\n", filter_pattern));
+       }
+
+       DHD_ERROR(("---- PKTLOG FILTER END ----\n"));
+
+       return BCME_OK;
+}
+bool
+dhd_pktlog_filter_matched(dhd_pktlog_filter_t *filter, char *data, uint32 pktlog_case)
+{
+       uint16 szbts;   /* pattern size */
+       uint16 offset;  /* pattern offset */
+       int i, j;
+       uint8 *mask = NULL;             /* bitmask */
+       uint8 *pattern = NULL;
+       uint8 *pkt_offset = NULL;       /* packet offset */
+       bool matched;
+
+       if  (!filter || !data) {
+               DHD_PKT_LOG(("%s(): filter=%p data=%p\n",
+                       __FUNCTION__, filter, data));
+               return TRUE;
+       }
+
+       if (!(pktlog_case & filter->enable)) {
+               DHD_PKT_LOG(("%s(): pktlog_case %d return TRUE filter is disabled\n",
+                       __FUNCTION__, pktlog_case));
+               return TRUE;
+       }
+
+       for (i = 0; i < filter->list_cnt; i++) {
+               if (&filter->info[i] && filter->info[i].id && filter->info[i].enable) {
+                       szbts = filter->info[i].size_bytes;
+                       offset = filter->info[i].offset;
+                       mask = &filter->info[i].mask[0];
+                       pkt_offset = &data[offset];
+                       pattern = &filter->info[i].pattern[0];
+
+                       matched = TRUE;
+                       for (j = 0; j < szbts; j++) {
+                               if ((mask[j] & pkt_offset[j]) != pattern[j]) {
+                                       matched = FALSE;
+                                       break;
+                               }
+                       }
+
+                       if (matched) {
+                               DHD_PKT_LOG(("%s(): pktlog_filter return TRUE id %d\n",
+                                       __FUNCTION__, filter->info[i].id));
+                               return TRUE;
+                       }
+               } else {
+                       DHD_PKT_LOG(("%s(): filter ino is null %p\n",
+                               __FUNCTION__, &filter->info[i]));
+               }
+       }
+
+       return FALSE;
+}
+
+/* Ethernet Type MAC Header 12 bytes + Frame payload 10 bytes */
+#define PKTLOG_MINIMIZE_REPORT_LEN 22
+
+static char pktlog_minmize_mask_table[] = {
+       0xff, 0x00, 0x00, 0x00, 0xff, 0x0f, /* Ethernet Type MAC Header - Destination MAC Address */
+       0xff, 0x00, 0x00, 0x00, 0xff, 0x0f, /* Ethernet Type MAC Header - Source MAC Address */
+       0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* Ethernet Type MAC Header - Ether Type - 2 bytes */
+       0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* Frame payload */
+       0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+       0x00, 0x00, 0x00, 0x00, 0xff, 0xff, /* UDP port number offset - bytes as 0xff */
+       0xff, 0xff,
+};
+
+static inline void
+dhd_pktlog_minimize_report(char *pkt, uint32 frame_len,
+               void *file, const void *user_buf, void *pos)
+{
+       int i;
+       int ret = 0;
+       int table_len;
+       int report_len;
+       char *p_table;
+       char *mem_buf = NULL;
+
+       table_len = sizeof(pktlog_minmize_mask_table);
+       report_len =  table_len;
+       p_table = &pktlog_minmize_mask_table[0];
+
+       if (frame_len < PKTLOG_MINIMIZE_REPORT_LEN) {
+               DHD_ERROR(("%s : frame_len is samller than min\n", __FUNCTION__));
+               return;
+       }
+
+       mem_buf = vmalloc(frame_len);
+       if (!mem_buf) {
+               DHD_ERROR(("%s : failed to alloc membuf\n", __FUNCTION__));
+               return;
+       }
+
+       bzero(mem_buf, frame_len);
+
+       if (frame_len < table_len) {
+               report_len = PKTLOG_MINIMIZE_REPORT_LEN;
+       }
+
+       for (i = 0; i < report_len; i++) {
+               mem_buf[i] = pkt[i] & p_table[i];
+       }
+
+       ret = dhd_export_debug_data(mem_buf,
+                       file, user_buf, frame_len, pos);
+       if (ret < 0) {
+               DHD_ERROR(("%s : Write minimize report\n", __FUNCTION__));
+       }
+       vfree(mem_buf);
+}
+
+dhd_pktlog_ring_t*
+dhd_pktlog_ring_change_size(dhd_pktlog_ring_t *ringbuf, int size)
+{
+       uint32 alloc_len;
+       uint32 pktlog_minmize;
+       dhd_pktlog_ring_t *pktlog_ring = NULL;
+       dhd_pub_t *dhdp;
+
+       if  (!ringbuf) {
+               DHD_ERROR(("%s(): ringbuf is NULL\n", __FUNCTION__));
+               return NULL;
+       }
+
+       alloc_len = size;
+       if (alloc_len < MIN_PKTLOG_LEN) {
+               alloc_len = MIN_PKTLOG_LEN;
+       }
+       if (alloc_len > MAX_PKTLOG_LEN) {
+               alloc_len = MAX_PKTLOG_LEN;
+       }
+       DHD_ERROR(("ring size requested: %d alloc: %d\n", size, alloc_len));
+
+       /* backup variable */
+       pktlog_minmize = ringbuf->pktlog_minmize;
+       dhdp = ringbuf->dhdp;
+
+       /* free ring_info */
+       dhd_pktlog_ring_deinit(dhdp, ringbuf);
+
+       /* alloc ring_info */
+       pktlog_ring = dhd_pktlog_ring_init(dhdp, alloc_len);
+
+       /* restore variable */
+       if (pktlog_ring) {
+               OSL_ATOMIC_SET(dhdp->osh, &pktlog_ring->start, TRUE);
+               pktlog_ring->pktlog_minmize = pktlog_minmize;
+       }
+
+       return pktlog_ring;
+}
+
+void
+dhd_pktlog_filter_pull_forward(dhd_pktlog_filter_t *filter, uint32 del_filter_id, uint32 list_cnt)
+{
+       int ret = 0;
+       int pos = 0;
+       int move_list_cnt = 0;
+       int move_bytes = 0;
+
+       if ((del_filter_id > list_cnt) ||
+               (list_cnt > MAX_DHD_PKTLOG_FILTER_LEN)) {
+               DHD_ERROR(("Wrong id %d cnt %d tried to remove\n", del_filter_id, list_cnt));
+               return;
+       }
+
+       move_list_cnt = list_cnt - del_filter_id;
+
+       pos = del_filter_id -1;
+       move_bytes = sizeof(dhd_pktlog_filter_info_t) * move_list_cnt;
+       if (move_list_cnt) {
+               ret = memmove_s(&filter->info[pos], move_bytes + sizeof(dhd_pktlog_filter_info_t),
+                               &filter->info[pos+1], move_bytes);
+               if (ret) {
+                       DHD_ERROR(("filter moving failed\n"));
+                       return;
+               }
+               for (; pos < list_cnt -1; pos++) {
+                       filter->info[pos].id -= 1;
+               }
+       }
+       bzero(&filter->info[list_cnt-1], sizeof(dhd_pktlog_filter_info_t));
+}
+
+void dhd_pktlog_get_filename(dhd_pub_t *dhdp, char *dump_path, int len)
+{
+       /* Init file name */
+       bzero(dump_path, len);
+       clear_debug_dump_time(dhdp->debug_dump_time_pktlog_str);
+       get_debug_dump_time(dhdp->debug_dump_time_pktlog_str);
+
+       if (dhdp->memdump_type == DUMP_TYPE_BY_SYSDUMP) {
+               if (dhdp->debug_dump_subcmd == CMD_UNWANTED) {
+                       snprintf(dump_path, len, "%s",
+                                       DHD_PKTLOG_DUMP_PATH DHD_PKTLOG_DUMP_TYPE
+                                       DHD_DUMP_SUBSTR_UNWANTED);
+               } else if (dhdp->debug_dump_subcmd == CMD_DISCONNECTED) {
+                       snprintf(dump_path, len, "%s",
+                                       DHD_PKTLOG_DUMP_PATH DHD_PKTLOG_DUMP_TYPE
+                                       DHD_DUMP_SUBSTR_DISCONNECTED);
+               } else {
+                       snprintf(dump_path, len, "%s",
+                                       DHD_PKTLOG_DUMP_PATH DHD_PKTLOG_DUMP_TYPE);
+               }
+       } else {
+               if (dhdp->pktlog_debug) {
+                       snprintf(dump_path, len, "%s",
+                                       DHD_PKTLOG_DUMP_PATH DHD_PKTLOG_DEBUG_DUMP_TYPE);
+               } else {
+                       snprintf(dump_path, len, "%s",
+                                       DHD_PKTLOG_DUMP_PATH DHD_PKTLOG_DUMP_TYPE);
+               }
+
+       }
+
+       snprintf(dump_path, len, "%s_%s.pcap", dump_path,
+                       dhdp->debug_dump_time_pktlog_str);
+       DHD_ERROR(("%s: pktlog path = %s%s\n", __FUNCTION__, dump_path, FILE_NAME_HAL_TAG));
+       clear_debug_dump_time(dhdp->debug_dump_time_pktlog_str);
+}
+
+uint32
+dhd_pktlog_get_item_length(dhd_pktlog_ring_info_t *report_ptr)
+{
+       uint32 len = 0;
+       char buf[DHD_PKTLOG_FATE_INFO_STR_LEN];
+       int bytes_user_data = 0;
+       uint32 write_frame_len;
+       uint32 frame_len;
+
+       len += (uint32)sizeof(report_ptr->info.driver_ts_sec);
+       len += (uint32)sizeof(report_ptr->info.driver_ts_usec);
+
+       if (report_ptr->info.payload_type == FRAME_TYPE_ETHERNET_II) {
+               frame_len = (uint32)min(report_ptr->info.pkt_len, (size_t)MAX_FRAME_LEN_ETHERNET);
+       } else {
+               frame_len = (uint32)min(report_ptr->info.pkt_len, (size_t)MAX_FRAME_LEN_80211_MGMT);
+       }
+
+       bytes_user_data = sprintf(buf, "%s:%s:%02d\n", DHD_PKTLOG_FATE_INFO_FORMAT,
+                       (report_ptr->tx_fate ? "Failure" : "Succeed"), report_ptr->tx_fate);
+       write_frame_len = frame_len + bytes_user_data;
+
+       /* pcap pkt head has incl_len and orig_len */
+       len += (uint32)sizeof(write_frame_len);
+       len += (uint32)sizeof(write_frame_len);
+       len += frame_len;
+       len += bytes_user_data;
+
+       return len;
+}
+
+uint32
+dhd_pktlog_get_dump_length(dhd_pub_t *dhdp)
+{
+       dhd_pktlog_ring_info_t *report_ptr;
+       dhd_pktlog_ring_t *pktlog_ring;
+       uint32 len;
+       dll_t *item_p, *next_p;
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       if (!dhdp->pktlog->pktlog_ring) {
+               DHD_PKT_LOG(("%s(): pktlog_ring =%p\n",
+                       __FUNCTION__, dhdp->pktlog->pktlog_ring));
+               return -EINVAL;
+       }
+
+       pktlog_ring = dhdp->pktlog->pktlog_ring;
+       OSL_ATOMIC_SET(dhdp->osh, &pktlog_ring->start, FALSE);
+
+       len = sizeof(dhd_pktlog_pcap_hdr_t);
+
+       for (item_p = dll_head_p(&pktlog_ring->ring_info_head);
+                       !dll_end(&pktlog_ring->ring_info_head, item_p);
+                       item_p = next_p) {
+               next_p = dll_next_p(item_p);
+               report_ptr = (dhd_pktlog_ring_info_t *)item_p;
+               len += dhd_pktlog_get_item_length(report_ptr);
+       }
+       OSL_ATOMIC_SET(dhdp->osh, &pktlog_ring->start, TRUE);
+       DHD_PKT_LOG(("calcuated pkt log dump len:%d\n", len));
+
+       return len;
+}
+
+int
+dhd_pktlog_dump_write(dhd_pub_t *dhdp, void *file, const void *user_buf, uint32 size)
+{
+       dhd_pktlog_ring_info_t *report_ptr;
+       dhd_pktlog_ring_t *pktlog_ring;
+       char buf[DHD_PKTLOG_FATE_INFO_STR_LEN];
+       dhd_pktlog_pcap_hdr_t pcap_h;
+       uint32 write_frame_len;
+       uint32 frame_len;
+       ulong len;
+       int bytes_user_data = 0;
+       loff_t pos = 0;
+       int ret = BCME_OK;
+       dll_t *item_p, *next_p;
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       if (!dhdp->pktlog->pktlog_ring) {
+               DHD_PKT_LOG(("%s(): pktlog_ring =%p\n",
+                       __FUNCTION__, dhdp->pktlog->pktlog_ring));
+               return -EINVAL;
+       }
+
+       if (file && !user_buf && (size == 0)) {
+               DHD_ERROR(("Local file pktlog dump requested\n"));
+       } else if (!file && user_buf && (size > 0)) {
+               DHD_ERROR(("HAL file pktlog dump %d bytes requested\n", size));
+       } else {
+               DHD_ERROR(("Wrong type pktlog dump requested\n"));
+               return -EINVAL;
+       }
+
+       pktlog_ring = dhdp->pktlog->pktlog_ring;
+       OSL_ATOMIC_SET(dhdp->osh, &pktlog_ring->start, FALSE);
+
+       pcap_h.magic_number = PKTLOG_PCAP_MAGIC_NUM;
+       pcap_h.version_major = PKTLOG_PCAP_MAJOR_VER;
+       pcap_h.version_minor = PKTLOG_PCAP_MINOR_VER;
+       pcap_h.thiszone = 0x0;
+       pcap_h.sigfigs = 0x0;
+       pcap_h.snaplen = PKTLOG_PCAP_SNAP_LEN;
+       pcap_h.network = PKTLOG_PCAP_NETWORK_TYPE;
+
+       ret = dhd_export_debug_data((char *)&pcap_h, file, user_buf, sizeof(pcap_h), &pos);
+       len = sizeof(pcap_h);
+
+       for (item_p = dll_head_p(&pktlog_ring->ring_info_head);
+                       !dll_end(&pktlog_ring->ring_info_head, item_p);
+                       item_p = next_p) {
+
+               next_p = dll_next_p(item_p);
+               report_ptr = (dhd_pktlog_ring_info_t *)item_p;
+
+               if ((file == NULL) &&
+                       (len + dhd_pktlog_get_item_length(report_ptr) > size)) {
+                       DHD_ERROR(("overflowed pkt logs are dropped\n"));
+                       break;
+               }
+
+               ret = dhd_export_debug_data((char*)&report_ptr->info.driver_ts_sec, file,
+                               user_buf, sizeof(report_ptr->info.driver_ts_sec), &pos);
+               len += sizeof(report_ptr->info.driver_ts_sec);
+
+               ret = dhd_export_debug_data((char*)&report_ptr->info.driver_ts_usec, file,
+                               user_buf, sizeof(report_ptr->info.driver_ts_usec), &pos);
+               len += sizeof(report_ptr->info.driver_ts_usec);
+
+               if (report_ptr->info.payload_type == FRAME_TYPE_ETHERNET_II) {
+                       frame_len = (uint32)min(report_ptr->info.pkt_len,
+                                       (size_t)MAX_FRAME_LEN_ETHERNET);
+
+               } else {
+                       frame_len = (uint32)min(report_ptr->info.pkt_len,
+                                       (size_t)MAX_FRAME_LEN_80211_MGMT);
+               }
+
+               bytes_user_data = sprintf(buf, "%s:%s:%02d\n", DHD_PKTLOG_FATE_INFO_FORMAT,
+                               (report_ptr->tx_fate ? "Failure" : "Succeed"), report_ptr->tx_fate);
+               write_frame_len = frame_len + bytes_user_data;
+
+               /* pcap pkt head has incl_len and orig_len */
+               ret = dhd_export_debug_data((char*)&write_frame_len, file, user_buf,
+                               sizeof(write_frame_len), &pos);
+               len += sizeof(write_frame_len);
+
+               ret = dhd_export_debug_data((char*)&write_frame_len, file, user_buf,
+                               sizeof(write_frame_len), &pos);
+               len += sizeof(write_frame_len);
+
+               if (pktlog_ring->pktlog_minmize) {
+                       dhd_pktlog_minimize_report(PKTDATA(pktlog_ring->dhdp->osh,
+                                       report_ptr->info.pkt), frame_len, file, user_buf, &pos);
+               } else {
+                       ret = dhd_export_debug_data(PKTDATA(pktlog_ring->dhdp->osh,
+                                       report_ptr->info.pkt), file, user_buf, frame_len, &pos);
+               }
+               len += frame_len;
+
+               ret = dhd_export_debug_data(buf, file, user_buf, bytes_user_data, &pos);
+               len += bytes_user_data;
+       }
+       OSL_ATOMIC_SET(dhdp->osh, &pktlog_ring->start, TRUE);
+
+       return ret;
+}
+
+int
+dhd_pktlog_dump_write_memory(dhd_pub_t *dhdp, const void *user_buf, uint32 size)
+{
+       int ret = dhd_pktlog_dump_write(dhdp, NULL, user_buf, size);
+       if (ret < 0) {
+               DHD_ERROR(("dhd_pktlog_dump_write_memory error\n"));
+       }
+       return ret;
+}
+
+int
+dhd_pktlog_dump_write_file(dhd_pub_t *dhdp)
+{
+       struct file *w_pcap_fp = NULL;
+       uint32 file_mode;
+       mm_segment_t old_fs;
+       char pktlogdump_path[128];
+       int ret = BCME_OK;
+
+       dhd_pktlog_get_filename(dhdp, pktlogdump_path, 128);
+       old_fs = get_fs();
+       set_fs(KERNEL_DS);
+       file_mode = O_CREAT | O_WRONLY;
+
+       w_pcap_fp = filp_open(pktlogdump_path, file_mode, 0664);
+       if (IS_ERR(w_pcap_fp)) {
+               DHD_ERROR(("%s: Couldn't open file '%s' err %ld\n",
+                       __FUNCTION__, pktlogdump_path, PTR_ERR(w_pcap_fp)));
+               ret = BCME_ERROR;
+               goto fail;
+       }
+
+       dhd_pktlog_dump_write(dhdp, w_pcap_fp, NULL, 0);
+       if (ret < 0) {
+               DHD_ERROR(("dhd_pktlog_dump_write error\n"));
+               goto fail;
+       }
+
+       /* Sync file from filesystem to physical media */
+       ret = vfs_fsync(w_pcap_fp, 0);
+       if (ret < 0) {
+               DHD_ERROR(("%s(): sync pcap file error, err = %d\n", __FUNCTION__, ret));
+               goto fail;
+       }
+fail:
+       if (!IS_ERR(w_pcap_fp)) {
+               filp_close(w_pcap_fp, NULL);
+       }
+
+       set_fs(old_fs);
+
+#ifdef DHD_DUMP_MNGR
+       if (ret >= 0) {
+               dhd_dump_file_manage_enqueue(dhdp, pktlogdump_path, DHD_PKTLOG_DUMP_TYPE);
+       }
+#endif /* DHD_DUMP_MNGR */
+       return ret;
+}
+
+#ifdef DHD_COMPACT_PKT_LOG
+static uint64
+dhd_cpkt_log_calc_time_diff(dhd_pktlog_ring_info_t *pkt_info, uint64 curr_ts_nsec)
+{
+       uint64 pkt_ts_nsec = pkt_info->info.driver_ts_sec * NSEC_PER_SEC +
+               pkt_info->info.driver_ts_usec * NSEC_PER_USEC;
+
+       return (curr_ts_nsec - pkt_ts_nsec) / NSEC_PER_USEC;
+}
+
+static int
+dhd_cpkt_log_get_ts_idx(dhd_pktlog_t *pktlog, dhd_pktlog_ring_info_t *pkt_info, u64 curr_ts_nsec)
+{
+       struct rb_node *n = pktlog->cpkt_log_tt_rbt.rb_node;
+       dhd_cpkt_log_ts_node_t *node = NULL;
+
+       uint64 ts_diff = dhd_cpkt_log_calc_time_diff(pkt_info, curr_ts_nsec);
+
+       if (ts_diff > dhd_cpkt_log_tt_idx[CPKT_LOG_TT_IDX_ARR_SZ - 1])
+               return CPKT_LOG_TT_IDX_ARR_SZ;
+
+       while (n) {
+               node = rb_entry(n, dhd_cpkt_log_ts_node_t, rb);
+
+               if (ts_diff < node->ts_diff)
+                       n = n->rb_left;
+               else if (ts_diff > node->ts_diff)
+                       n = n->rb_right;
+               else
+                       break;
+       }
+
+       if (node != NULL) {
+               if (node->idx && ts_diff < node->ts_diff)
+                       return node->idx - 1;
+               return node->idx;
+       }
+
+       return BCME_NOTFOUND;
+}
+
+static int
+dhd_cpkt_log_get_direction(dhd_pktlog_ring_info_t *pkt_info)
+{
+       return pkt_info->info.direction == PKTLOG_TXPKT_CASE ? PKT_TX : PKT_RX;
+}
+
+static int
+dhd_cpkt_log_get_802_1x_subtype(eapol_header_t *eapol)
+{
+       int subtype;
+       eap_header_t *eap;
+       eapol_wpa_key_header_t *ek;
+
+       uint16 key_info;
+       int pair, ack, mic, kerr, req, sec, install;
+
+       subtype = CPKT_LOG_802_1X_SUBTYPE_OTHERS;
+       if (eapol->type != EAPOL_KEY) {
+               eap = (eap_header_t *)eapol->body;
+
+               switch (eap->type) {
+               case EAP_IDENTITY:
+                       subtype = CPKT_LOG_802_1X_SUBTYPE_IDENTITY;
+                       break;
+               case REALM_EAP_TLS:
+                       subtype = CPKT_LOG_802_1X_SUBTYPE_TLS;
+                       break;
+               case REALM_EAP_TTLS:
+                       subtype = CPKT_LOG_802_1X_SUBTYPE_TTLS;
+                       break;
+               case REALM_EAP_FAST:
+                       subtype = CPKT_LOG_802_1X_SUBTYPE_FAST;
+                       break;
+               case REALM_EAP_LEAP:
+                       subtype = CPKT_LOG_802_1X_SUBTYPE_LEAP;
+                       break;
+               case REALM_EAP_PSK:
+                       subtype = CPKT_LOG_802_1X_SUBTYPE_PWD;
+                       break;
+               case REALM_EAP_SIM:
+                       subtype = CPKT_LOG_802_1X_SUBTYPE_SIM;
+                       break;
+               case REALM_EAP_AKA:
+                       subtype = CPKT_LOG_802_1X_SUBTYPE_AKA;
+                       break;
+               case REALM_EAP_AKAP:
+                       subtype = CPKT_LOG_802_1X_SUBTYPE_AKAP;
+                       break;
+               default:
+                       break;
+               }
+               if (eap->code == EAP_SUCCESS)
+                       subtype = CPKT_LOG_802_1X_SUBTYPE_SUCCESS;
+       } else {
+               /* in case of 4 way handshake */
+               ek = (eapol_wpa_key_header_t *)(eapol->body);
+
+               if (ek->type == EAPOL_WPA2_KEY || ek->type == EAPOL_WPA_KEY) {
+                       key_info = ntoh16_ua(&ek->key_info);
+
+                       pair =  0 != (key_info & WPA_KEY_PAIRWISE);
+                       ack = 0  != (key_info & WPA_KEY_ACK);
+                       mic = 0  != (key_info & WPA_KEY_MIC);
+                       kerr =  0 != (key_info & WPA_KEY_ERROR);
+                       req = 0  != (key_info & WPA_KEY_REQ);
+                       sec = 0  != (key_info & WPA_KEY_SECURE);
+                       install  = 0 != (key_info & WPA_KEY_INSTALL);
+
+                       if (!sec && !mic && ack && !install && pair && !kerr && !req)
+                               subtype = CPKT_LOG_802_1X_SUBTYPE_4WAY_M1;
+                       else if (pair && !install && !ack && mic && !sec && !kerr && !req)
+                               subtype = CPKT_LOG_802_1X_SUBTYPE_4WAY_M2;
+                       else if (pair && ack && mic && sec && !kerr && !req)
+                               subtype = CPKT_LOG_802_1X_SUBTYPE_4WAY_M3;
+                       else if (pair && !install && !ack && mic && sec && !req && !kerr)
+                               subtype = CPKT_LOG_802_1X_SUBTYPE_4WAY_M4;
+               }
+       }
+
+       return subtype;
+}
+
+static int
+dhd_cpkt_log_get_pkt_info(dhd_pktlog_t *pktlog, dhd_pktlog_ring_info_t *pkt_info)
+{
+       int type;
+       int subtype = 0;
+
+       uint8 prot;
+       uint16 src_port, dst_port;
+       int len, offset;
+
+       uint8 *pdata;
+       uint8 *pkt_data;
+
+       uint16 eth_type;
+       struct bcmarp *arp;
+       struct bcmicmp_hdr *icmp;
+       struct ipv4_hdr *ipv4;
+       struct ether_header *eth_hdr;
+       bcm_tlv_t *dhcp_opt;
+
+       struct ipv6_hdr *ipv6;
+       struct icmp6_hdr *icmpv6_hdr;
+
+       pkt_data = (uint8 *)PKTDATA(pktlog->dhdp->osh, pkt_info->info.pkt);
+
+       eth_hdr = (struct ether_header *)pkt_data;
+       eth_type = ntoh16(eth_hdr->ether_type);
+
+       type = CPKT_LOG_TYPE_OTHERS;
+       switch (eth_type) {
+       case ETHER_TYPE_IP:
+               if (get_pkt_ip_type(pktlog->dhdp->osh, pkt_info->info.pkt,
+                       &pdata, &len, &prot) != 0) {
+                       DHD_PKT_LOG(("%s: fail to get pkt ip type\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+
+               if (prot == IP_PROT_ICMP) {
+                       icmp = (struct bcmicmp_hdr *)(pdata);
+                       if (!(icmp->type == ICMP_TYPE_ECHO_REQUEST ||
+                               icmp->type == ICMP_TYPE_ECHO_REPLY ||
+                               icmp->type == CPKT_LOG_ICMP_TYPE_DEST_UNREACHABLE)) {
+                               return BCME_ERROR;
+                       }
+
+                       if (icmp->type == ICMP_TYPE_ECHO_REQUEST) {
+                               type = CPKT_LOG_TYPE_ICMP_REQ;
+                               /* Subtype = Last 8 bits of identifier */
+                               subtype = ntoh16_ua(pdata + sizeof(*icmp)) & 0xFF;
+                       } else if (icmp->type == ICMP_TYPE_ECHO_REPLY) {
+                               type = CPKT_LOG_TYPE_ICMP_RES;
+                               /* Subtype = Last 8 bits of identifier */
+                               subtype = ntoh16_ua(pdata + sizeof(*icmp)) & 0xFF;
+                       } else if (icmp->type == CPKT_LOG_ICMP_TYPE_DEST_UNREACHABLE) {
+                               type = CPKT_LOG_TYPE_ICMP_UNREACHABLE;
+                               /* Subtype = Last 8 bits of identifier */
+                               ipv4 = (struct ipv4_hdr *)(pdata + sizeof(*icmp) +
+                                               CPKT_LOG_ICMP_TYPE_DEST_UNREACHABLE_IPV4_OFFSET);
+                               subtype = ipv4->id & 0xFF;
+                       }
+
+                       DHD_PKT_LOG(("%s: type = ICMP(%d), subtype = %x \n",
+                               __FUNCTION__, type, subtype));
+               } else if (prot == IP_PROT_UDP) {
+                       if (len < UDP_HDR_LEN)
+                               return BCME_ERROR;
+
+                       src_port = ntoh16_ua(pdata);
+                       dst_port = ntoh16_ua(pdata + UDP_DEST_PORT_OFFSET);
+
+                       if (src_port == DHCP_PORT_SERVER || src_port == DHCP_PORT_CLIENT) {
+                               type = CPKT_LOG_TYPE_DHCP;
+                               /* Subtype = DHCP message type */
+                               offset = DHCP_OPT_OFFSET + CPKT_LOG_DHCP_MAGIC_COOKIE_LEN;
+                               if ((UDP_HDR_LEN + offset) >= len)
+                                       return BCME_ERROR;
+                               len -= (UDP_HDR_LEN - offset);
+
+                               dhcp_opt = bcm_parse_tlvs(pdata + UDP_HDR_LEN + offset,
+                                       len, DHCP_OPT_MSGTYPE);
+                               if (dhcp_opt == NULL)
+                                       return BCME_NOTFOUND;
+                               subtype = dhcp_opt->data[0];
+
+                               DHD_PKT_LOG(("%s: type = DHCP(%d), subtype = %x \n",
+                                       __FUNCTION__, type, subtype));
+                       } else if (src_port == CPKT_LOG_DNS_PORT_CLIENT ||
+                               dst_port == CPKT_LOG_DNS_PORT_CLIENT ||
+                               dst_port == CPKT_LOG_MDNS_PORT_CLIENT) {
+                               type = CPKT_LOG_TYPE_DNS;
+                               /* Subtype = Last 8 bits of DNS Transaction ID */
+                               subtype = ntoh16_ua(pdata + UDP_HDR_LEN) & 0xFF;
+
+                               DHD_PKT_LOG(("%s: type = DNS(%d), subtype = %x \n",
+                                       __FUNCTION__, type, subtype));
+                       } else {
+                               DHD_PKT_LOG(("%s: unsupported ports num (src:%d, dst:%d)\n",
+                                       __FUNCTION__, src_port, dst_port));
+                       }
+               } else {
+                       DHD_PKT_LOG(("%s: prot = %x\n", __FUNCTION__, prot));
+               }
+
+               break;
+       case ETHER_TYPE_ARP:
+               type = CPKT_LOG_TYPE_ARP;
+               /* Subtype = Last 8 bits of target IP address */
+               arp = (struct bcmarp *)(pkt_data + ETHER_HDR_LEN);
+               subtype = arp->dst_ip[IPV4_ADDR_LEN - 1];
+
+               DHD_PKT_LOG(("%s: type = ARP(%d), subtype = %x\n",
+                       __FUNCTION__, type, subtype));
+
+               break;
+       case ETHER_TYPE_802_1X:
+               type = CPKT_LOG_TYPE_802_1X;
+               /* EAPOL for 802.3/Ethernet */
+               subtype = dhd_cpkt_log_get_802_1x_subtype((eapol_header_t *)pkt_data);
+
+               DHD_PKT_LOG(("%s: type = 802.1x(%d), subtype = %x\n",
+                       __FUNCTION__, type, subtype));
+
+               break;
+       case ETHER_TYPE_IPV6:
+               ipv6 = (struct ipv6_hdr *)(pkt_data + ETHER_HDR_LEN);
+               if (ipv6->nexthdr == ICMPV6_HEADER_TYPE) {
+                       type = CPKT_LOG_TYPE_ICMPv6;
+                       icmpv6_hdr =
+                              (struct icmp6_hdr *)(pkt_data + ETHER_HDR_LEN + sizeof(*ipv6));
+                       subtype = icmpv6_hdr->icmp6_type;
+
+                       DHD_PKT_LOG(("%s: type = ICMPv6(%x), subtype = %x\n",
+                               __FUNCTION__, type, subtype));
+               } else {
+                       DHD_ERROR(("%s: unsupported ipv6 next header\n", __FUNCTION__));
+               }
+
+               break;
+       default:
+               DHD_ERROR(("%s: Invalid eth type (%x)\n", __FUNCTION__, eth_hdr->ether_type));
+               break;
+       }
+
+       return (subtype << CPKT_LOG_BIT_LEN_TYPE) | type;
+}
+
+static int
+dhd_cpkt_log_get_pkt_fate(dhd_pktlog_ring_info_t *pktlog_info)
+{
+       return pktlog_info->fate;
+}
+
+/*
+ * dhd_cpkt_log_build: prepare 22 bits of data as compact packet log format to report to big data
+ *
+ * pkt_info: one packet data from packet log
+ * curr_ts_nsec: current time (nano seconds)
+ * cpkt: pointer for output(22 bits compact packet log)
+ *
+ */
+static int
+dhd_cpkt_log_build(dhd_pktlog_t *pktlog, dhd_pktlog_ring_info_t *pkt_info,
+       u64 curr_ts_nsec, int *cpkt)
+{
+       int ret;
+       int mask;
+       int temp = 0;
+
+       /* Timestamp index */
+       ret = dhd_cpkt_log_get_ts_idx(pktlog, pkt_info, curr_ts_nsec);
+       if (ret < 0) {
+               DHD_ERROR(("%s: Invalid cpktlog ts, err = %d\n", __FUNCTION__, ret));
+               return ret;
+       }
+       mask = CPKT_LOG_BIT_MASK_TS;
+       temp |= ((ret & mask) << CPKT_LOG_BIT_OFFSET_TS);
+
+       /* Direction: Tx/Rx */
+       ret = dhd_cpkt_log_get_direction(pkt_info);
+       mask = CPKT_LOG_BIT_MASK_DIR;
+       temp |= ((ret & mask) << CPKT_LOG_BIT_OFFSET_DIR);
+
+       /* Info = Packet Type & Packet Subtype */
+       ret = dhd_cpkt_log_get_pkt_info(pktlog, pkt_info);
+       if (ret < 0) {
+               DHD_ERROR(("%s: Invalid cpktlog info, err = %d\n", __FUNCTION__, ret));
+               return ret;
+       }
+       mask = CPKT_LOG_BIT_MASK_SUBTYPE << CPKT_LOG_BIT_LEN_TYPE | CPKT_LOG_BIT_MASK_TYPE;
+       temp |= ((ret & mask) << CPKT_LOG_BIT_OFFSET_TYPE);
+
+       /* Packet Fate */
+       ret = dhd_cpkt_log_get_pkt_fate(pkt_info);
+       mask = CPKT_LOG_BIT_MASK_PKT_FATE;
+       temp |= ((ret & mask) << CPKT_LOG_BIT_OFFSET_PKT_FATE);
+
+       *cpkt = temp;
+
+       return BCME_OK;
+}
+
+int
+dhd_cpkt_log_proc(dhd_pub_t *dhdp, char *buf, int buf_len, int bit_offset, int req_pkt_num)
+{
+       int ret;
+       int cpkt;
+       int offset = bit_offset;
+       dll_t *item_p, *prev_p;
+
+       uint8 pkt_cnt;
+       u64 curr_ts_nsec;
+
+       dhd_pktlog_t *pktlog;
+       dhd_pktlog_ring_t *pktlog_rbuf;
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_ERROR(("%s: dhdp or pktlog is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (!dhdp->pktlog->pktlog_ring) {
+               DHD_ERROR(("%s: pktlog_ring is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       DHD_PKT_LOG(("%s: start cpkt log\n", __FUNCTION__));
+
+       pktlog = dhdp->pktlog;
+       pktlog_rbuf = pktlog->pktlog_ring;
+
+       req_pkt_num = req_pkt_num > CPKT_LOG_MAX_NUM ?
+               CPKT_LOG_MAX_NUM : req_pkt_num;
+
+       pkt_cnt = 0;
+       curr_ts_nsec = local_clock();
+       for (item_p = dll_tail_p(&pktlog_rbuf->ring_info_head);
+               !dll_end(&pktlog_rbuf->ring_info_head, item_p);
+               item_p = prev_p) {
+               prev_p = dll_prev_p(item_p);
+               if (prev_p == NULL)
+                       break;
+
+               ret = dhd_cpkt_log_build(pktlog, (dhd_pktlog_ring_info_t *)item_p,
+                       curr_ts_nsec, &cpkt);
+               if (ret < 0)
+                       continue;
+
+               offset = dhd_bit_pack(buf, buf_len, offset, cpkt, CPKT_LOG_BIT_SIZE);
+
+               pkt_cnt++;
+               if (pkt_cnt >= req_pkt_num)
+                       break;
+       }
+
+       return offset;
+}
+
+static void
+dhd_cpkt_log_insert_ts(dhd_cpkt_log_ts_node_t *node, struct rb_root *root)
+{
+       struct rb_node **new = &root->rb_node, *parent = NULL;
+       u64 ts_diff = node->ts_diff;
+
+       while (*new) {
+               parent = *new;
+               if (ts_diff < rb_entry(parent, dhd_cpkt_log_ts_node_t, rb)->ts_diff)
+                       new = &parent->rb_left;
+               else
+                       new = &parent->rb_right;
+       }
+
+       rb_link_node(&node->rb, parent, new);
+       rb_insert_color(&node->rb, root);
+}
+
+static void
+dhd_cpkt_log_deinit_tt(dhd_pub_t *dhdp)
+{
+       struct rb_node *n;
+       dhd_pktlog_t *pktlog = dhdp->pktlog;
+
+       dhd_cpkt_log_ts_node_t *node;
+
+       while ((n = rb_first(&pktlog->cpkt_log_tt_rbt))) {
+               node = rb_entry(n, dhd_cpkt_log_ts_node_t, rb);
+               rb_erase(&node->rb, &pktlog->cpkt_log_tt_rbt);
+               MFREE(dhdp->osh, node, sizeof(*node));
+       }
+}
+
+static int
+dhd_cpkt_log_init_tt(dhd_pub_t *dhdp)
+{
+       int i;
+       int ret = BCME_OK;
+
+       dhd_pktlog_t *pktlog = dhdp->pktlog;
+
+       dhd_cpkt_log_ts_node_t *node;
+
+       for (i = 0; i < ARRAYSIZE(dhd_cpkt_log_tt_idx); i++) {
+               node = (dhd_cpkt_log_ts_node_t *)MALLOCZ(dhdp->osh, sizeof(*node));
+               if (!node) {
+                       ret = BCME_NOMEM;
+                       goto exit;
+               }
+               node->ts_diff = dhd_cpkt_log_tt_idx[i];
+               node->idx = i;
+
+               dhd_cpkt_log_insert_ts(node, &pktlog->cpkt_log_tt_rbt);
+       }
+
+       return BCME_OK;
+exit:
+       dhd_cpkt_log_deinit_tt(dhdp);
+
+       return ret;
+}
+#endif /* DHD_COMPACT_PKT_LOG */
+#endif /* DHD_PKT_LOGGING */
diff --git a/bcmdhd.101.10.240.x/dhd_pktlog.h b/bcmdhd.101.10.240.x/dhd_pktlog.h
new file mode 100644 (file)
index 0000000..ffe1e06
--- /dev/null
@@ -0,0 +1,287 @@
+/*
+ * DHD debugability packet logging header file
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef __DHD_PKTLOG_H_
+#define __DHD_PKTLOG_H_
+
+#include <dhd_debug.h>
+#include <dhd.h>
+#include <asm/atomic.h>
+#ifdef DHD_COMPACT_PKT_LOG
+#include <linux/rbtree.h>
+#endif /* DHD_COMPACT_PKT_LOG */
+
+#ifdef DHD_PKT_LOGGING
+#define DHD_PKT_LOG(args)      DHD_INFO(args)
+#define MIN_PKTLOG_LEN                 (32 * 10 * 2)
+#define MAX_PKTLOG_LEN                 (32 * 100 * 2)
+#define MAX_DHD_PKTLOG_FILTER_LEN      14
+#define MAX_MASK_PATTERN_FILTER_LEN    64
+#define PKTLOG_TXPKT_CASE                      0x0001
+#define PKTLOG_TXSTATUS_CASE           0x0002
+#define PKTLOG_RXPKT_CASE                      0x0004
+/* MAX_FILTER_PATTERN_LEN is buf len to print bitmask/pattern with string */
+#define MAX_FILTER_PATTERN_LEN \
+       ((MAX_MASK_PATTERN_FILTER_LEN * HD_BYTE_SIZE) + HD_PREFIX_SIZE + 1) * 2
+#define PKTLOG_DUMP_BUF_SIZE           (64 * 1024)
+
+typedef struct dhd_dbg_pktlog_info {
+       frame_type payload_type;
+       size_t pkt_len;
+       uint32 driver_ts_sec;
+       uint32 driver_ts_usec;
+       uint32 firmware_ts;
+       uint32 pkt_hash;
+       bool direction;
+       void *pkt;
+} dhd_dbg_pktlog_info_t;
+
+typedef struct dhd_pktlog_ring_info
+{
+       dll_t p_info;                   /* list pointer */
+       union {
+               wifi_tx_packet_fate tx_fate;
+               wifi_rx_packet_fate rx_fate;
+               uint32 fate;
+       };
+       dhd_dbg_pktlog_info_t info;
+} dhd_pktlog_ring_info_t;
+
+typedef struct dhd_pktlog_ring
+{
+       dll_t ring_info_head;           /* ring_info list */
+       dll_t ring_info_free;           /* ring_info free list */
+       osl_atomic_t start;
+       uint32 pktlog_minmize;
+       uint32 pktlog_len;              /* size of pkts */
+       uint32 pktcount;
+       spinlock_t *pktlog_ring_lock;
+       dhd_pub_t *dhdp;
+       dhd_pktlog_ring_info_t *ring_info_mem; /* ring_info mem pointer */
+} dhd_pktlog_ring_t;
+
+typedef struct dhd_pktlog_filter_info
+{
+       uint32 id;
+       uint32 offset;
+       uint32 size_bytes; /* Size of pattern. */
+       uint32 enable;
+       uint8 mask[MAX_MASK_PATTERN_FILTER_LEN];
+       uint8 pattern[MAX_MASK_PATTERN_FILTER_LEN];
+} dhd_pktlog_filter_info_t;
+
+typedef struct dhd_pktlog_filter
+{
+       dhd_pktlog_filter_info_t *info;
+       uint32 list_cnt;
+       uint32 enable;
+} dhd_pktlog_filter_t;
+
+typedef struct dhd_pktlog
+{
+       struct dhd_pktlog_ring *pktlog_ring;
+       struct dhd_pktlog_filter *pktlog_filter;
+       osl_atomic_t pktlog_status;
+       dhd_pub_t *dhdp;
+#ifdef DHD_COMPACT_PKT_LOG
+       struct rb_root cpkt_log_tt_rbt;
+#endif  /* DHD_COMPACT_PKT_LOG */
+} dhd_pktlog_t;
+
+typedef struct dhd_pktlog_pcap_hdr
+{
+       uint32 magic_number;
+       uint16 version_major;
+       uint16 version_minor;
+       uint16 thiszone;
+       uint32 sigfigs;
+       uint32 snaplen;
+       uint32 network;
+} dhd_pktlog_pcap_hdr_t;
+
+#define PKTLOG_PCAP_MAGIC_NUM 0xa1b2c3d4
+#define PKTLOG_PCAP_MAJOR_VER 0x02
+#define PKTLOG_PCAP_MINOR_VER 0x04
+#define PKTLOG_PCAP_SNAP_LEN 0x40000
+#define PKTLOG_PCAP_NETWORK_TYPE 147
+
+extern int dhd_os_attach_pktlog(dhd_pub_t *dhdp);
+extern int dhd_os_detach_pktlog(dhd_pub_t *dhdp);
+extern dhd_pktlog_ring_t* dhd_pktlog_ring_init(dhd_pub_t *dhdp, int size);
+extern int dhd_pktlog_ring_deinit(dhd_pub_t *dhdp, dhd_pktlog_ring_t *ring);
+extern int dhd_pktlog_ring_set_nextpos(dhd_pktlog_ring_t *ringbuf);
+extern int dhd_pktlog_ring_get_nextbuf(dhd_pktlog_ring_t *ringbuf, void **data);
+extern int dhd_pktlog_ring_set_prevpos(dhd_pktlog_ring_t *ringbuf);
+extern int dhd_pktlog_ring_get_prevbuf(dhd_pktlog_ring_t *ringbuf, void **data);
+extern int dhd_pktlog_ring_get_writebuf(dhd_pktlog_ring_t *ringbuf, void **data);
+extern int dhd_pktlog_ring_add_pkts(dhd_pub_t *dhdp, void *pkt, uint32 pktid, bool direction);
+extern int dhd_pktlog_ring_tx_status(dhd_pub_t *dhdp, void *pkt, uint32 pktid,
+               uint16 status);
+extern dhd_pktlog_ring_t* dhd_pktlog_ring_change_size(dhd_pktlog_ring_t *ringbuf, int size);
+extern void dhd_pktlog_filter_pull_forward(dhd_pktlog_filter_t *filter,
+               uint32 del_filter_id, uint32 list_cnt);
+
+#define PKT_TX 1
+#define PKT_RX 0
+#define DHD_INVALID_PKTID (0U)
+#define PKTLOG_TRANS_TX 0x01
+#define PKTLOG_TRANS_RX 0x02
+#define PKTLOG_TRANS_TXS 0x04
+
+#define PKTLOG_SET_IN_TX(dhdp) \
+{ \
+       do { \
+               OSL_ATOMIC_OR((dhdp)->osh, &(dhdp)->pktlog->pktlog_status, PKTLOG_TRANS_TX); \
+       } while (0); \
+}
+
+#define PKTLOG_SET_IN_RX(dhdp) \
+{ \
+       do { \
+               OSL_ATOMIC_OR((dhdp)->osh, &(dhdp)->pktlog->pktlog_status, PKTLOG_TRANS_RX); \
+       } while (0); \
+}
+
+#define PKTLOG_SET_IN_TXS(dhdp) \
+{ \
+       do { \
+               OSL_ATOMIC_OR((dhdp)->osh, &(dhdp)->pktlog->pktlog_status, PKTLOG_TRANS_TXS); \
+       } while (0); \
+}
+
+#define PKTLOG_CLEAR_IN_TX(dhdp) \
+{ \
+       do { \
+               OSL_ATOMIC_AND((dhdp)->osh, &(dhdp)->pktlog->pktlog_status, ~PKTLOG_TRANS_TX); \
+       } while (0); \
+}
+
+#define PKTLOG_CLEAR_IN_RX(dhdp) \
+{ \
+       do { \
+               OSL_ATOMIC_AND((dhdp)->osh, &(dhdp)->pktlog->pktlog_status, ~PKTLOG_TRANS_RX); \
+       } while (0); \
+}
+
+#define PKTLOG_CLEAR_IN_TXS(dhdp) \
+{ \
+       do { \
+               OSL_ATOMIC_AND((dhdp)->osh, &(dhdp)->pktlog->pktlog_status, ~PKTLOG_TRANS_TXS); \
+       } while (0); \
+}
+
+#define DHD_PKTLOG_TX(dhdp, pkt, pktid) \
+{ \
+       do { \
+               if ((dhdp) && (dhdp)->pktlog && (pkt)) { \
+                       PKTLOG_SET_IN_TX(dhdp); \
+                       if ((dhdp)->pktlog->pktlog_ring && \
+                               OSL_ATOMIC_READ((dhdp)->osh, \
+                                       (&(dhdp)->pktlog->pktlog_ring->start))) { \
+                               dhd_pktlog_ring_add_pkts(dhdp, pkt, pktid, PKT_TX); \
+                       } \
+                       PKTLOG_CLEAR_IN_TX(dhdp); \
+               } \
+       } while (0); \
+}
+
+#define DHD_PKTLOG_TXS(dhdp, pkt, pktid, status) \
+{ \
+       do { \
+               if ((dhdp) && (dhdp)->pktlog && (pkt)) { \
+                       PKTLOG_SET_IN_TXS(dhdp); \
+                       if ((dhdp)->pktlog->pktlog_ring && \
+                               OSL_ATOMIC_READ((dhdp)->osh, \
+                                       (&(dhdp)->pktlog->pktlog_ring->start))) { \
+                               dhd_pktlog_ring_tx_status(dhdp, pkt, pktid, status); \
+                       } \
+                       PKTLOG_CLEAR_IN_TXS(dhdp); \
+               } \
+       } while (0); \
+}
+
+#define DHD_PKTLOG_RX(dhdp, pkt) \
+{ \
+       do { \
+               if ((dhdp) && (dhdp)->pktlog && (pkt)) { \
+                       PKTLOG_SET_IN_RX(dhdp); \
+                       if (ntoh16((pkt)->protocol) != ETHER_TYPE_BRCM) { \
+                               if ((dhdp)->pktlog->pktlog_ring && \
+                                       OSL_ATOMIC_READ((dhdp)->osh, \
+                                               (&(dhdp)->pktlog->pktlog_ring->start))) { \
+                                       dhd_pktlog_ring_add_pkts(dhdp, pkt, \
+                                               DHD_INVALID_PKTID, PKT_RX); \
+                               } \
+                       } \
+                       PKTLOG_CLEAR_IN_RX(dhdp); \
+               } \
+       } while (0); \
+}
+
+extern dhd_pktlog_filter_t* dhd_pktlog_filter_init(int size);
+extern int dhd_pktlog_filter_deinit(dhd_pktlog_filter_t *filter);
+extern int dhd_pktlog_filter_add(dhd_pktlog_filter_t *filter, char *arg);
+extern int dhd_pktlog_filter_del(dhd_pktlog_filter_t *filter, char *arg);
+extern int dhd_pktlog_filter_enable(dhd_pktlog_filter_t *filter, uint32 pktlog_case, uint32 enable);
+extern int dhd_pktlog_filter_pattern_enable(dhd_pktlog_filter_t *filter, char *arg, uint32 enable);
+extern int dhd_pktlog_filter_info(dhd_pktlog_filter_t *filter);
+extern bool dhd_pktlog_filter_matched(dhd_pktlog_filter_t *filter, char *data, uint32 pktlog_case);
+extern bool dhd_pktlog_filter_existed(dhd_pktlog_filter_t *filter, char *arg, uint32 *id);
+
+#define DHD_PKTLOG_FILTER_ADD(pattern, filter_pattern, dhdp)   \
+{      \
+       do {    \
+               if ((strlen(pattern) + 1) < sizeof(filter_pattern)) {   \
+                       strncpy(filter_pattern, pattern, sizeof(filter_pattern));       \
+                       dhd_pktlog_filter_add(dhdp->pktlog->pktlog_filter, filter_pattern);     \
+               }       \
+       } while (0);    \
+}
+
+#define DHD_PKTLOG_DUMP_PATH   DHD_COMMON_DUMP_PATH
+extern int dhd_pktlog_debug_dump(dhd_pub_t *dhdp);
+extern void dhd_pktlog_dump(void *handle, void *event_info, u8 event);
+extern void dhd_schedule_pktlog_dump(dhd_pub_t *dhdp);
+extern int dhd_pktlog_dump_write_memory(dhd_pub_t *dhdp, const void *user_buf, uint32 size);
+extern int dhd_pktlog_dump_write_file(dhd_pub_t *dhdp);
+
+#define DHD_PKTLOG_FATE_INFO_STR_LEN 256
+#define DHD_PKTLOG_FATE_INFO_FORMAT    "BRCM_Packet_Fate"
+#define DHD_PKTLOG_DUMP_TYPE "pktlog_dump"
+#define DHD_PKTLOG_DEBUG_DUMP_TYPE "pktlog_debug_dump"
+
+extern void dhd_pktlog_get_filename(dhd_pub_t *dhdp, char *dump_path, int len);
+extern uint32 dhd_pktlog_get_item_length(dhd_pktlog_ring_info_t *report_ptr);
+extern uint32 dhd_pktlog_get_dump_length(dhd_pub_t *dhdp);
+extern uint32 __dhd_dbg_pkt_hash(uintptr_t pkt, uint32 pktid);
+
+#ifdef DHD_COMPACT_PKT_LOG
+#define CPKT_LOG_BIT_SIZE              22
+#define CPKT_LOG_MAX_NUM               80
+extern int dhd_cpkt_log_proc(dhd_pub_t *dhdp, char *buf, int buf_len,
+        int bit_offset, int req_pkt_num);
+#endif  /* DHD_COMPACT_PKT_LOG */
+#endif /* DHD_PKT_LOGGING */
+#endif /* __DHD_PKTLOG_H_ */
diff --git a/bcmdhd.101.10.240.x/dhd_pno.c b/bcmdhd.101.10.240.x/dhd_pno.c
new file mode 100644 (file)
index 0000000..ee76668
--- /dev/null
@@ -0,0 +1,4433 @@
+/*
+ * Broadcom Dongle Host Driver (DHD)
+ * Prefered Network Offload and Wi-Fi Location Service(WLS) code.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#if defined(GSCAN_SUPPORT) && !defined(PNO_SUPPORT)
+#error "GSCAN needs PNO to be enabled!"
+#endif
+
+#ifdef PNO_SUPPORT
+#include <typedefs.h>
+#include <osl.h>
+
+#include <epivers.h>
+#include <bcmutils.h>
+
+#include <bcmendian.h>
+
+#include <linuxver.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/sort.h>
+
+#include <dngl_stats.h>
+#include <wlioctl.h>
+
+#include <bcmevent.h>
+#include <dhd.h>
+#include <dhd_pno.h>
+#include <dhd_dbg.h>
+#ifdef GSCAN_SUPPORT
+#include <linux/gcd.h>
+#endif /* GSCAN_SUPPORT */
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#endif /* WL_CFG80211 */
+
+#ifdef __BIG_ENDIAN
+#include <bcmendian.h>
+#define htod32(i) (bcmswap32(i))
+#define htod16(i) (bcmswap16(i))
+#define dtoh32(i) (bcmswap32(i))
+#define dtoh16(i) (bcmswap16(i))
+#define htodchanspec(i) htod16(i)
+#define dtohchanspec(i) dtoh16(i)
+#else
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+#endif /* IL_BIGENDINA */
+
+#define NULL_CHECK(p, s, err)  \
+                       do { \
+                               if (!(p)) { \
+                                       printf("NULL POINTER (%s) : %s\n", __FUNCTION__, (s)); \
+                                       err = BCME_ERROR; \
+                                       return err; \
+                               } \
+                       } while (0)
+#define PNO_GET_PNOSTATE(dhd) ((dhd_pno_status_info_t *)dhd->pno_state)
+
+#define PNO_BESTNET_LEN                WLC_IOCTL_MEDLEN
+
+#define PNO_ON 1
+#define PNO_OFF 0
+#define CHANNEL_2G_MIN 1
+#define CHANNEL_2G_MAX 14
+#define CHANNEL_5G_MIN 34
+#define CHANNEL_5G_MAX 165
+#define IS_2G_CHANNEL(ch) ((ch >= CHANNEL_2G_MIN) && \
+       (ch <= CHANNEL_2G_MAX))
+#define IS_5G_CHANNEL(ch) ((ch >= CHANNEL_5G_MIN) && \
+       (ch <= CHANNEL_5G_MAX))
+#define MAX_NODE_CNT 5
+#define WLS_SUPPORTED(pno_state) (pno_state->wls_supported == TRUE)
+#define TIME_DIFF(timestamp1, timestamp2) (abs((uint32)(timestamp1/1000)  \
+                                               - (uint32)(timestamp2/1000)))
+#define TIME_DIFF_MS(timestamp1, timestamp2) (abs((uint32)(timestamp1)  \
+                                               - (uint32)(timestamp2)))
+#define TIMESPEC_TO_US(ts)  (((uint64)(ts).tv_sec * USEC_PER_SEC) + \
+                                                       (ts).tv_nsec / NSEC_PER_USEC)
+
+#define ENTRY_OVERHEAD strlen("bssid=\nssid=\nfreq=\nlevel=\nage=\ndist=\ndistSd=\n====")
+#define TIME_MIN_DIFF 5
+
+#define EVENT_DATABUF_MAXLEN   (512 - sizeof(bcm_event_t))
+#define EVENT_MAX_NETCNT_V1 \
+       ((EVENT_DATABUF_MAXLEN - sizeof(wl_pfn_scanresults_v1_t)) \
+       / sizeof(wl_pfn_net_info_v1_t) + 1)
+#define EVENT_MAX_NETCNT_V2 \
+       ((EVENT_DATABUF_MAXLEN - sizeof(wl_pfn_scanresults_v2_t)) \
+       / sizeof(wl_pfn_net_info_v2_t) + 1)
+
+#ifdef GSCAN_SUPPORT
+static int _dhd_pno_flush_ssid(dhd_pub_t *dhd);
+static wl_pfn_gscan_ch_bucket_cfg_t *
+dhd_pno_gscan_create_channel_list(dhd_pub_t *dhd, dhd_pno_status_info_t *pno_state,
+       uint16 *chan_list, uint32 *num_buckets, uint32 *num_buckets_to_fw);
+#endif /* GSCAN_SUPPORT */
+
+static int dhd_pno_set_legacy_pno(dhd_pub_t *dhd, uint16  scan_fr, int pno_repeat,
+       int pno_freq_expo_max, uint16 *channel_list, int nchan);
+
+static inline bool
+is_dfs(dhd_pub_t *dhd, uint16 channel)
+{
+       u32 ch;
+       s32 err;
+       u8 buf[32];
+
+       ch = wl_ch_host_to_driver(channel);
+       err = dhd_iovar(dhd, 0, "per_chan_info", (char *)&ch,
+               sizeof(u32), buf, sizeof(buf), FALSE);
+       if (unlikely(err)) {
+               DHD_ERROR(("get per chan info failed:%d\n", err));
+               return FALSE;
+       }
+       /* Check the channel flags returned by fw */
+       if (*((u32 *)buf) & WL_CHAN_PASSIVE) {
+               return TRUE;
+       }
+       return FALSE;
+}
+
+int
+dhd_pno_clean(dhd_pub_t *dhd)
+{
+       int pfn = 0;
+       int err;
+       dhd_pno_status_info_t *_pno_state;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       /* Disable PNO */
+       err = dhd_iovar(dhd, 0, "pfn", (char *)&pfn, sizeof(pfn), NULL, 0, TRUE);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfn(error : %d)\n",
+                       __FUNCTION__, err));
+               goto exit;
+       }
+       _pno_state->pno_status = DHD_PNO_DISABLED;
+       err = dhd_iovar(dhd, 0, "pfnclear", NULL, 0, NULL, 0, TRUE);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfnclear(error : %d)\n",
+                       __FUNCTION__, err));
+       }
+exit:
+       return err;
+}
+
+bool
+dhd_is_pno_supported(dhd_pub_t *dhd)
+{
+       dhd_pno_status_info_t *_pno_state;
+
+       if (!dhd || !dhd->pno_state) {
+               DHD_ERROR(("NULL POINTER : %s\n",
+                       __FUNCTION__));
+               return FALSE;
+       }
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       return WLS_SUPPORTED(_pno_state);
+}
+
+bool
+dhd_is_legacy_pno_enabled(dhd_pub_t *dhd)
+{
+       dhd_pno_status_info_t *_pno_state;
+
+       if (!dhd || !dhd->pno_state) {
+               DHD_ERROR(("NULL POINTER : %s\n",
+                       __FUNCTION__));
+               return FALSE;
+       }
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       return ((_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) != 0);
+}
+
+#ifdef GSCAN_SUPPORT
+static uint64
+convert_fw_rel_time_to_systime(struct osl_timespec *ts, uint32 fw_ts_ms)
+{
+       return ((uint64)(TIMESPEC_TO_US(*ts)) - (uint64)(fw_ts_ms * 1000));
+}
+
+static void
+dhd_pno_idx_to_ssid(struct dhd_pno_gscan_params *gscan_params,
+               dhd_epno_results_t *res, uint32 idx)
+{
+       dhd_pno_ssid_t *iter, *next;
+       int i;
+
+       /* If idx doesn't make sense */
+       if (idx >= gscan_params->epno_cfg.num_epno_ssid) {
+               DHD_ERROR(("No match, idx %d num_ssid %d\n", idx,
+                       gscan_params->epno_cfg.num_epno_ssid));
+               goto exit;
+       }
+
+       if (gscan_params->epno_cfg.num_epno_ssid > 0) {
+               i = 0;
+
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               list_for_each_entry_safe(iter, next,
+                       &gscan_params->epno_cfg.epno_ssid_list, list) {
+                       GCC_DIAGNOSTIC_POP();
+                       if (i++ == idx) {
+                               memcpy(res->ssid, iter->SSID, iter->SSID_len);
+                               res->ssid_len = iter->SSID_len;
+                               return;
+                       }
+               }
+       }
+exit:
+       /* If we are here then there was no match */
+       res->ssid[0] = '\0';
+       res->ssid_len = 0;
+       return;
+}
+
+/* Translate HAL flag bitmask to BRCM FW flag bitmask */
+void
+dhd_pno_translate_epno_fw_flags(uint32 *flags)
+{
+       uint32 in_flags, fw_flags = 0;
+       in_flags = *flags;
+
+       if (in_flags & DHD_EPNO_A_BAND_TRIG) {
+               fw_flags |= WL_PFN_SSID_A_BAND_TRIG;
+       }
+
+       if (in_flags & DHD_EPNO_BG_BAND_TRIG) {
+               fw_flags |= WL_PFN_SSID_BG_BAND_TRIG;
+       }
+
+       if (!(in_flags & DHD_EPNO_STRICT_MATCH) &&
+                       !(in_flags & DHD_EPNO_HIDDEN_SSID)) {
+               fw_flags |= WL_PFN_SSID_IMPRECISE_MATCH;
+       }
+
+       if (in_flags & DHD_EPNO_SAME_NETWORK) {
+               fw_flags |= WL_PFN_SSID_SAME_NETWORK;
+       }
+
+       /* Add any hard coded flags needed */
+       fw_flags |= WL_PFN_SUPPRESS_AGING_MASK;
+       *flags = fw_flags;
+
+       return;
+}
+
+/* Translate HAL auth bitmask to BRCM FW bitmask */
+void
+dhd_pno_set_epno_auth_flag(uint32 *wpa_auth)
+{
+       switch (*wpa_auth) {
+               case DHD_PNO_AUTH_CODE_OPEN:
+                       *wpa_auth = WPA_AUTH_DISABLED;
+                       break;
+               case DHD_PNO_AUTH_CODE_PSK:
+                       *wpa_auth = (WPA_AUTH_PSK | WPA2_AUTH_PSK);
+                       break;
+               case DHD_PNO_AUTH_CODE_EAPOL:
+                       *wpa_auth = ~WPA_AUTH_NONE;
+                       break;
+               default:
+                       DHD_ERROR(("%s: Unknown auth %d", __FUNCTION__, *wpa_auth));
+                       *wpa_auth = WPA_AUTH_PFN_ANY;
+                       break;
+       }
+       return;
+}
+
+/* Cleanup all results */
+static void
+dhd_gscan_clear_all_batch_results(dhd_pub_t *dhd)
+{
+       struct dhd_pno_gscan_params *gscan_params;
+       dhd_pno_status_info_t *_pno_state;
+       gscan_results_cache_t *iter;
+
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       gscan_params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS].params_gscan;
+       iter = gscan_params->gscan_batch_cache;
+       /* Mark everything as consumed */
+       while (iter) {
+               iter->tot_consumed = iter->tot_count;
+               iter = iter->next;
+       }
+       dhd_gscan_batch_cache_cleanup(dhd);
+       return;
+}
+
+static int
+_dhd_pno_gscan_cfg(dhd_pub_t *dhd, wl_pfn_gscan_cfg_t *pfncfg_gscan_param, int size)
+{
+       int err = BCME_OK;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       err = dhd_iovar(dhd, 0, "pfn_gscan_cfg", (char *)pfncfg_gscan_param, size, NULL, 0, TRUE);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfncfg_gscan_param\n", __FUNCTION__));
+               goto exit;
+       }
+exit:
+       return err;
+}
+
+static int
+_dhd_pno_flush_ssid(dhd_pub_t *dhd)
+{
+       int err;
+       wl_pfn_t pfn_elem;
+       memset(&pfn_elem, 0, sizeof(wl_pfn_t));
+       pfn_elem.flags = htod32(WL_PFN_FLUSH_ALL_SSIDS);
+
+       err = dhd_iovar(dhd, 0, "pfn_add", (char *)&pfn_elem, sizeof(wl_pfn_t), NULL, 0, TRUE);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfn_add\n", __FUNCTION__));
+       }
+       return err;
+}
+
+static bool
+is_batch_retrieval_complete(struct dhd_pno_gscan_params *gscan_params)
+{
+       smp_rmb();
+       return (gscan_params->get_batch_flag == GSCAN_BATCH_RETRIEVAL_COMPLETE);
+}
+#endif /* GSCAN_SUPPORT */
+
+static int
+_dhd_pno_suspend(dhd_pub_t *dhd)
+{
+       int err;
+       int suspend = 1;
+       dhd_pno_status_info_t *_pno_state;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       err = dhd_iovar(dhd, 0, "pfn_suspend", (char *)&suspend, sizeof(suspend), NULL, 0, TRUE);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to suspend pfn(error :%d)\n", __FUNCTION__, err));
+               goto exit;
+
+       }
+       _pno_state->pno_status = DHD_PNO_SUSPEND;
+exit:
+       return err;
+}
+static int
+_dhd_pno_enable(dhd_pub_t *dhd, int enable)
+{
+       int err = BCME_OK;
+       dhd_pno_status_info_t *_pno_state;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       if (enable & 0xfffe) {
+               DHD_ERROR(("%s invalid value\n", __FUNCTION__));
+               err = BCME_BADARG;
+               goto exit;
+       }
+       if (!dhd_support_sta_mode(dhd)) {
+               DHD_ERROR(("PNO is not allowed for non-STA mode"));
+               err = BCME_BADOPTION;
+               goto exit;
+       }
+       if (enable) {
+               if ((_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) &&
+                       dhd_is_associated(dhd, 0, NULL)) {
+                       DHD_ERROR(("%s Legacy PNO mode cannot be enabled "
+                               "in assoc mode , ignore it\n", __FUNCTION__));
+                       err = BCME_BADOPTION;
+                       goto exit;
+               }
+       }
+       /* Enable/Disable PNO */
+       err = dhd_iovar(dhd, 0, "pfn", (char *)&enable, sizeof(enable), NULL, 0, TRUE);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfn_set - %d\n", __FUNCTION__, err));
+               goto exit;
+       }
+       _pno_state->pno_status = (enable)?
+               DHD_PNO_ENABLED : DHD_PNO_DISABLED;
+       if (!enable)
+               _pno_state->pno_mode = DHD_PNO_NONE_MODE;
+
+       DHD_PNO(("%s set pno as %s\n",
+               __FUNCTION__, enable ? "Enable" : "Disable"));
+exit:
+       return err;
+}
+
+static int
+_dhd_pno_set(dhd_pub_t *dhd, const dhd_pno_params_t *pno_params, dhd_pno_mode_t mode)
+{
+       int err = BCME_OK;
+       wl_pfn_param_t pfn_param;
+       dhd_pno_params_t *_params;
+       dhd_pno_status_info_t *_pno_state;
+       bool combined_scan = FALSE;
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+
+       memset(&pfn_param, 0, sizeof(pfn_param));
+
+       /* set pfn parameters */
+       pfn_param.version = htod32(PFN_VERSION);
+       pfn_param.flags = ((PFN_LIST_ORDER << SORT_CRITERIA_BIT) |
+               (ENABLE << IMMEDIATE_SCAN_BIT) | (ENABLE << REPORT_SEPERATELY_BIT));
+       if (mode == DHD_PNO_LEGACY_MODE) {
+               /* check and set extra pno params */
+               if ((pno_params->params_legacy.pno_repeat != 0) ||
+                       (pno_params->params_legacy.pno_freq_expo_max != 0)) {
+                       pfn_param.flags |= htod16(ENABLE << ENABLE_ADAPTSCAN_BIT);
+                       pfn_param.repeat = (uchar) (pno_params->params_legacy.pno_repeat);
+                       pfn_param.exp = (uchar) (pno_params->params_legacy.pno_freq_expo_max);
+               }
+               /* set up pno scan fr */
+               if (pno_params->params_legacy.scan_fr != 0)
+                       pfn_param.scan_freq = htod32(pno_params->params_legacy.scan_fr);
+               if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+                       DHD_PNO(("will enable combined scan with BATCHIG SCAN MODE\n"));
+                       mode |= DHD_PNO_BATCH_MODE;
+                       combined_scan = TRUE;
+               } else if (_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE) {
+                       DHD_PNO(("will enable combined scan with HOTLIST SCAN MODE\n"));
+                       mode |= DHD_PNO_HOTLIST_MODE;
+                       combined_scan = TRUE;
+               }
+#ifdef GSCAN_SUPPORT
+               else if (_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) {
+                       DHD_PNO(("will enable combined scan with GSCAN SCAN MODE\n"));
+                       mode |= DHD_PNO_GSCAN_MODE;
+               }
+#endif /* GSCAN_SUPPORT */
+       }
+       if (mode & (DHD_PNO_BATCH_MODE | DHD_PNO_HOTLIST_MODE)) {
+               /* Scan frequency of 30 sec */
+               pfn_param.scan_freq = htod32(30);
+               /* slow adapt scan is off by default */
+               pfn_param.slow_freq = htod32(0);
+               /* RSSI margin of 30 dBm */
+               pfn_param.rssi_margin = htod16(PNO_RSSI_MARGIN_DBM);
+               /* Network timeout 60 sec */
+               pfn_param.lost_network_timeout = htod32(60);
+               /* best n = 2 by default */
+               pfn_param.bestn = DEFAULT_BESTN;
+               /* mscan m=0 by default, so not record best networks by default */
+               pfn_param.mscan = DEFAULT_MSCAN;
+               /*  default repeat = 10 */
+               pfn_param.repeat = DEFAULT_REPEAT;
+               /* by default, maximum scan interval = 2^2
+                * scan_freq when adaptive scan is turned on
+                */
+               pfn_param.exp = DEFAULT_EXP;
+               if (mode == DHD_PNO_BATCH_MODE) {
+                       /* In case of BATCH SCAN */
+                       if (pno_params->params_batch.bestn)
+                               pfn_param.bestn = pno_params->params_batch.bestn;
+                       if (pno_params->params_batch.scan_fr)
+                               pfn_param.scan_freq = htod32(pno_params->params_batch.scan_fr);
+                       if (pno_params->params_batch.mscan)
+                               pfn_param.mscan = pno_params->params_batch.mscan;
+                       /* enable broadcast scan */
+                       pfn_param.flags |= (ENABLE << ENABLE_BD_SCAN_BIT);
+               } else if (mode == DHD_PNO_HOTLIST_MODE) {
+                       /* In case of HOTLIST SCAN */
+                       if (pno_params->params_hotlist.scan_fr)
+                               pfn_param.scan_freq = htod32(pno_params->params_hotlist.scan_fr);
+                       pfn_param.bestn = 0;
+                       pfn_param.repeat = 0;
+                       /* enable broadcast scan */
+                       pfn_param.flags |= (ENABLE << ENABLE_BD_SCAN_BIT);
+               }
+               if (combined_scan) {
+                       /* Disable Adaptive Scan */
+                       pfn_param.flags &= ~(htod16(ENABLE << ENABLE_ADAPTSCAN_BIT));
+                       pfn_param.flags |= (ENABLE << ENABLE_BD_SCAN_BIT);
+                       pfn_param.repeat = 0;
+                       pfn_param.exp = 0;
+                       if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+                               /* In case of Legacy PNO + BATCH SCAN */
+                               _params = &(_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS]);
+                               if (_params->params_batch.bestn)
+                                       pfn_param.bestn = _params->params_batch.bestn;
+                               if (_params->params_batch.scan_fr)
+                                       pfn_param.scan_freq = htod32(_params->params_batch.scan_fr);
+                               if (_params->params_batch.mscan)
+                                       pfn_param.mscan = _params->params_batch.mscan;
+                       } else if (_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE) {
+                               /* In case of Legacy PNO + HOTLIST SCAN */
+                               _params = &(_pno_state->pno_params_arr[INDEX_OF_HOTLIST_PARAMS]);
+                               if (_params->params_hotlist.scan_fr)
+                               pfn_param.scan_freq = htod32(_params->params_hotlist.scan_fr);
+                               pfn_param.bestn = 0;
+                               pfn_param.repeat = 0;
+                       }
+               }
+       }
+#ifdef GSCAN_SUPPORT
+       if (mode & DHD_PNO_GSCAN_MODE) {
+               uint32 lost_network_timeout;
+
+               pfn_param.scan_freq = htod32(pno_params->params_gscan.scan_fr);
+               if (pno_params->params_gscan.mscan) {
+                       pfn_param.bestn = pno_params->params_gscan.bestn;
+                       pfn_param.mscan =  pno_params->params_gscan.mscan;
+                       pfn_param.flags |= (ENABLE << ENABLE_BD_SCAN_BIT);
+               }
+               /* RSSI margin of 30 dBm */
+               pfn_param.rssi_margin = htod16(PNO_RSSI_MARGIN_DBM);
+               pfn_param.repeat = 0;
+               pfn_param.exp = 0;
+               pfn_param.slow_freq = 0;
+               pfn_param.flags |= htod16(ENABLE << ENABLE_ADAPTSCAN_BIT);
+
+               if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+                       dhd_pno_params_t *params;
+
+                       params = &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS]);
+
+                       pfn_param.scan_freq = gcd(pno_params->params_gscan.scan_fr,
+                                        params->params_legacy.scan_fr);
+
+                       if ((params->params_legacy.pno_repeat != 0) ||
+                               (params->params_legacy.pno_freq_expo_max != 0)) {
+                               pfn_param.repeat = (uchar) (params->params_legacy.pno_repeat);
+                               pfn_param.exp = (uchar) (params->params_legacy.pno_freq_expo_max);
+                       }
+               }
+
+               lost_network_timeout = (pno_params->params_gscan.max_ch_bucket_freq *
+                                       pfn_param.scan_freq *
+                                       pno_params->params_gscan.lost_ap_window);
+               if (lost_network_timeout) {
+                       pfn_param.lost_network_timeout = htod32(MIN(lost_network_timeout,
+                                                        GSCAN_MIN_BSSID_TIMEOUT));
+               } else {
+                       pfn_param.lost_network_timeout = htod32(GSCAN_MIN_BSSID_TIMEOUT);
+               }
+       } else
+#endif /* GSCAN_SUPPORT */
+       {
+               if (pfn_param.scan_freq < htod32(PNO_SCAN_MIN_FW_SEC) ||
+                       pfn_param.scan_freq > htod32(PNO_SCAN_MAX_FW_SEC)) {
+                       DHD_ERROR(("%s pno freq(%d sec) is not valid \n",
+                               __FUNCTION__, PNO_SCAN_MIN_FW_SEC));
+                       err = BCME_BADARG;
+                       goto exit;
+               }
+       }
+#if !defined(WL_USE_RANDOMIZED_SCAN)
+       err = dhd_set_rand_mac_oui(dhd);
+       /* Ignore if chip doesnt support the feature */
+       if (err < 0 && err != BCME_UNSUPPORTED) {
+               DHD_ERROR(("%s : failed to set random mac for PNO scan, %d\n", __FUNCTION__, err));
+               goto exit;
+       }
+#endif /* !defined(WL_USE_RANDOMIZED_SCAN */
+#ifdef GSCAN_SUPPORT
+       if (mode == DHD_PNO_BATCH_MODE ||
+       ((mode & DHD_PNO_GSCAN_MODE) && pno_params->params_gscan.mscan))
+#else
+       if (mode == DHD_PNO_BATCH_MODE)
+#endif /* GSCAN_SUPPORT */
+       {
+               int _tmp = pfn_param.bestn;
+               /* set bestn to calculate the max mscan which firmware supports */
+               err = dhd_iovar(dhd, 0, "pfnmem", (char *)&_tmp, sizeof(_tmp), NULL, 0, TRUE);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to set pfnmem\n", __FUNCTION__));
+                       goto exit;
+               }
+               /* get max mscan which the firmware supports */
+               err = dhd_iovar(dhd, 0, "pfnmem", NULL, 0, (char *)&_tmp, sizeof(_tmp), FALSE);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to get pfnmem\n", __FUNCTION__));
+                       goto exit;
+               }
+               pfn_param.mscan = MIN(pfn_param.mscan, _tmp);
+               DHD_PNO((" returned mscan : %d, set bestn : %d mscan %d\n", _tmp, pfn_param.bestn,
+                       pfn_param.mscan));
+       }
+       err = dhd_iovar(dhd, 0, "pfn_set", (char *)&pfn_param, sizeof(pfn_param), NULL, 0, TRUE);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfn_set %d\n", __FUNCTION__, err));
+               goto exit;
+       }
+       /* need to return mscan if this is for batch scan instead of err */
+       err = (mode == DHD_PNO_BATCH_MODE)? pfn_param.mscan : err;
+exit:
+       return err;
+}
+
+static int
+_dhd_pno_add_ssid(dhd_pub_t *dhd, struct list_head* ssid_list, int nssid)
+{
+       int err = BCME_OK;
+       int i = 0, mem_needed;
+       wl_pfn_t *pfn_elem_buf;
+       struct dhd_pno_ssid *iter, *next;
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       if (!nssid) {
+               NULL_CHECK(ssid_list, "ssid list is NULL", err);
+               return BCME_ERROR;
+       }
+       mem_needed = (sizeof(wl_pfn_t) * nssid);
+       pfn_elem_buf = (wl_pfn_t *) MALLOCZ(dhd->osh, mem_needed);
+       if (!pfn_elem_buf) {
+               DHD_ERROR(("%s: Can't malloc %d bytes!\n", __FUNCTION__, mem_needed));
+               return BCME_NOMEM;
+       }
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_entry_safe(iter, next, ssid_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               pfn_elem_buf[i].infra = htod32(1);
+               pfn_elem_buf[i].auth = htod32(DOT11_OPEN_SYSTEM);
+               pfn_elem_buf[i].wpa_auth = htod32(iter->wpa_auth);
+               pfn_elem_buf[i].flags = htod32(iter->flags);
+               if (iter->hidden)
+                       pfn_elem_buf[i].flags |= htod32(ENABLE << WL_PFN_HIDDEN_BIT);
+               /* If a single RSSI threshold is defined, use that */
+#ifdef PNO_MIN_RSSI_TRIGGER
+               pfn_elem_buf[i].flags |= ((PNO_MIN_RSSI_TRIGGER & 0xFF) << WL_PFN_RSSI_SHIFT);
+#else
+               pfn_elem_buf[i].flags |= ((iter->rssi_thresh & 0xFF) << WL_PFN_RSSI_SHIFT);
+#endif /* PNO_MIN_RSSI_TRIGGER */
+               memcpy((char *)pfn_elem_buf[i].ssid.SSID, iter->SSID,
+                       iter->SSID_len);
+               pfn_elem_buf[i].ssid.SSID_len = iter->SSID_len;
+               DHD_PNO(("%s size = %d hidden = %d flags = %x rssi_thresh %d\n",
+                       iter->SSID, iter->SSID_len, iter->hidden,
+                       iter->flags, iter->rssi_thresh));
+               if (++i >= nssid) {
+                       /* shouldn't happen */
+                       break;
+               }
+       }
+
+       err = dhd_iovar(dhd, 0, "pfn_add", (char *)pfn_elem_buf, mem_needed, NULL, 0, TRUE);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfn_add\n", __FUNCTION__));
+       }
+       MFREE(dhd->osh, pfn_elem_buf, mem_needed);
+       return err;
+}
+
+/* qsort compare function */
+static int
+_dhd_pno_cmpfunc(const void *a, const void *b)
+{
+       return (*(const uint16*)a - *(const uint16*)b);
+}
+
+static int
+_dhd_pno_chan_merge(uint16 *d_chan_list, int *nchan,
+       uint16 *chan_list1, int nchan1, uint16 *chan_list2, int nchan2)
+{
+       int err = BCME_OK;
+       int i = 0, j = 0, k = 0;
+       uint16 tmp;
+       NULL_CHECK(d_chan_list, "d_chan_list is NULL", err);
+       NULL_CHECK(nchan, "nchan is NULL", err);
+       NULL_CHECK(chan_list1, "chan_list1 is NULL", err);
+       NULL_CHECK(chan_list2, "chan_list2 is NULL", err);
+       /* chan_list1 and chan_list2 should be sorted at first */
+       while (i < nchan1 && j < nchan2) {
+               tmp = chan_list1[i] < chan_list2[j]?
+                       chan_list1[i++] : chan_list2[j++];
+               for (; i < nchan1 && chan_list1[i] == tmp; i++);
+               for (; j < nchan2 && chan_list2[j] == tmp; j++);
+               d_chan_list[k++] = tmp;
+       }
+
+       while (i < nchan1) {
+               tmp = chan_list1[i++];
+               for (; i < nchan1 && chan_list1[i] == tmp; i++);
+               d_chan_list[k++] = tmp;
+       }
+
+       while (j < nchan2) {
+               tmp = chan_list2[j++];
+               for (; j < nchan2 && chan_list2[j] == tmp; j++);
+               d_chan_list[k++] = tmp;
+
+       }
+       *nchan = k;
+       return err;
+}
+
+static int
+_dhd_pno_get_channels(dhd_pub_t *dhd, uint16 *d_chan_list,
+       int *nchan, uint8 band, bool skip_dfs)
+{
+       int err = BCME_OK;
+       int i, j;
+       uint32 chan_buf[WL_NUMCHANNELS + 1];
+       wl_uint32_list_t *list;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       if (*nchan) {
+               NULL_CHECK(d_chan_list, "d_chan_list is NULL", err);
+       }
+       memset(&chan_buf, 0, sizeof(chan_buf));
+       list = (wl_uint32_list_t *) (void *)chan_buf;
+       list->count = htod32(WL_NUMCHANNELS);
+       err = dhd_wl_ioctl_cmd(dhd, WLC_GET_VALID_CHANNELS, chan_buf, sizeof(chan_buf), FALSE, 0);
+       if (err < 0) {
+               DHD_ERROR(("failed to get channel list (err: %d)\n", err));
+               return err;
+       }
+       for (i = 0, j = 0; i < dtoh32(list->count) && i < *nchan; i++) {
+               if (IS_2G_CHANNEL(dtoh32(list->element[i]))) {
+                       if (!(band & WLC_BAND_2G)) {
+                               /* Skip, if not 2g */
+                               continue;
+                       }
+                       /* fall through to include the channel */
+               } else if (IS_5G_CHANNEL(dtoh32(list->element[i]))) {
+                       bool dfs_channel = is_dfs(dhd, dtoh32(list->element[i]));
+                       if ((skip_dfs && dfs_channel) ||
+                               (!(band & WLC_BAND_5G) && !dfs_channel)) {
+                               /* Skip the channel if:
+                               * the DFS bit is NOT set & the channel is a dfs channel
+                               * the band 5G is not set & the channel is a non DFS 5G channel
+                               */
+                               continue;
+                       }
+                       /* fall through to include the channel */
+               } else {
+                       /* Not in range. Bad channel */
+                       DHD_ERROR(("Not in range. bad channel\n"));
+                       *nchan = 0;
+                       return BCME_BADCHAN;
+               }
+
+               /* Include the channel */
+               d_chan_list[j++] = (uint16) dtoh32(list->element[i]);
+       }
+       *nchan = j;
+       return err;
+}
+
+static int
+_dhd_pno_convert_format(dhd_pub_t *dhd, struct dhd_pno_batch_params *params_batch,
+       char *buf, int nbufsize)
+{
+       int err = BCME_OK;
+       int bytes_written = 0, nreadsize = 0;
+       int t_delta = 0;
+       int nleftsize = nbufsize;
+       uint8 cnt = 0;
+       char *bp = buf;
+       char eabuf[ETHER_ADDR_STR_LEN];
+#ifdef PNO_DEBUG
+       char *_base_bp;
+       char msg[150];
+#endif
+       dhd_pno_bestnet_entry_t *iter, *next;
+       dhd_pno_scan_results_t *siter, *snext;
+       dhd_pno_best_header_t *phead, *pprev;
+       NULL_CHECK(params_batch, "params_batch is NULL", err);
+       if (nbufsize > 0)
+               NULL_CHECK(buf, "buf is NULL", err);
+       /* initialize the buffer */
+       memset(buf, 0, nbufsize);
+       DHD_PNO(("%s enter \n", __FUNCTION__));
+       /* # of scans */
+       if (!params_batch->get_batch.batch_started) {
+               bp += nreadsize = snprintf(bp, nleftsize, "scancount=%d\n",
+                       params_batch->get_batch.expired_tot_scan_cnt);
+               nleftsize -= nreadsize;
+               params_batch->get_batch.batch_started = TRUE;
+       }
+       DHD_PNO(("%s scancount %d\n", __FUNCTION__, params_batch->get_batch.expired_tot_scan_cnt));
+       /* preestimate scan count until which scan result this report is going to end */
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_entry_safe(siter, snext,
+               &params_batch->get_batch.expired_scan_results_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               phead = siter->bestnetheader;
+               while (phead != NULL) {
+                       /* if left_size is less than bestheader total size , stop this */
+                       if (nleftsize <=
+                               (phead->tot_size + phead->tot_cnt * ENTRY_OVERHEAD))
+                               goto exit;
+                       /* increase scan count */
+                       cnt++;
+                       /* # best of each scan */
+                       DHD_PNO(("\n<loop : %d, apcount %d>\n", cnt - 1, phead->tot_cnt));
+                       /* attribute of the scan */
+                       if (phead->reason & PNO_STATUS_ABORT_MASK) {
+                               bp += nreadsize = snprintf(bp, nleftsize, "trunc\n");
+                               nleftsize -= nreadsize;
+                       }
+                       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                       list_for_each_entry_safe(iter, next,
+                               &phead->entry_list, list) {
+                               GCC_DIAGNOSTIC_POP();
+                               t_delta = jiffies_to_msecs(jiffies - iter->recorded_time);
+#ifdef PNO_DEBUG
+                               _base_bp = bp;
+                               memset(msg, 0, sizeof(msg));
+#endif
+                               /* BSSID info */
+                               bp += nreadsize = snprintf(bp, nleftsize, "bssid=%s\n",
+                               bcm_ether_ntoa((const struct ether_addr *)&iter->BSSID, eabuf));
+                               nleftsize -= nreadsize;
+                               /* SSID */
+                               bp += nreadsize = snprintf(bp, nleftsize, "ssid=%s\n", iter->SSID);
+                               nleftsize -= nreadsize;
+                               /* channel */
+                               bp += nreadsize = snprintf(bp, nleftsize, "freq=%d\n",
+                               wf_channel2mhz(iter->channel,
+                               iter->channel <= CH_MAX_2G_CHANNEL?
+                               WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G));
+                               nleftsize -= nreadsize;
+                               /* RSSI */
+                               bp += nreadsize = snprintf(bp, nleftsize, "level=%d\n", iter->RSSI);
+                               nleftsize -= nreadsize;
+                               /* add the time consumed in Driver to the timestamp of firmware */
+                               iter->timestamp += t_delta;
+                               bp += nreadsize = snprintf(bp, nleftsize,
+                                       "age=%d\n", iter->timestamp);
+                               nleftsize -= nreadsize;
+                               /* RTT0 */
+                               bp += nreadsize = snprintf(bp, nleftsize, "dist=%d\n",
+                               (iter->rtt0 == 0)? -1 : iter->rtt0);
+                               nleftsize -= nreadsize;
+                               /* RTT1 */
+                               bp += nreadsize = snprintf(bp, nleftsize, "distSd=%d\n",
+                               (iter->rtt0 == 0)? -1 : iter->rtt1);
+                               nleftsize -= nreadsize;
+                               bp += nreadsize = snprintf(bp, nleftsize, "%s", AP_END_MARKER);
+                               nleftsize -= nreadsize;
+                               list_del(&iter->list);
+                               MFREE(dhd->osh, iter, BESTNET_ENTRY_SIZE);
+#ifdef PNO_DEBUG
+                               memcpy(msg, _base_bp, bp - _base_bp);
+                               DHD_PNO(("Entry : \n%s", msg));
+#endif
+                       }
+                       bp += nreadsize = snprintf(bp, nleftsize, "%s", SCAN_END_MARKER);
+                       DHD_PNO(("%s", SCAN_END_MARKER));
+                       nleftsize -= nreadsize;
+                       pprev = phead;
+                       /* reset the header */
+                       siter->bestnetheader = phead = phead->next;
+                       MFREE(dhd->osh, pprev, BEST_HEADER_SIZE);
+
+                       siter->cnt_header--;
+               }
+               if (phead == NULL) {
+                       /* we store all entry in this scan , so it is ok to delete */
+                       list_del(&siter->list);
+                       MFREE(dhd->osh, siter, SCAN_RESULTS_SIZE);
+               }
+       }
+exit:
+       if (cnt < params_batch->get_batch.expired_tot_scan_cnt) {
+               DHD_ERROR(("Buffer size is small to save all batch entry,"
+                       " cnt : %d (remained_scan_cnt): %d\n",
+                       cnt, params_batch->get_batch.expired_tot_scan_cnt - cnt));
+       }
+       params_batch->get_batch.expired_tot_scan_cnt -= cnt;
+       /* set FALSE only if the link list  is empty after returning the data */
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       if (list_empty(&params_batch->get_batch.expired_scan_results_list)) {
+               GCC_DIAGNOSTIC_POP();
+               params_batch->get_batch.batch_started = FALSE;
+               bp += snprintf(bp, nleftsize, "%s", RESULTS_END_MARKER);
+               DHD_PNO(("%s", RESULTS_END_MARKER));
+               DHD_PNO(("%s : Getting the batching data is complete\n", __FUNCTION__));
+       }
+       /* return used memory in buffer */
+       bytes_written = (int32)(bp - buf);
+       return bytes_written;
+}
+
+static int
+_dhd_pno_clear_all_batch_results(dhd_pub_t *dhd, struct list_head *head, bool only_last)
+{
+       int err = BCME_OK;
+       int removed_scan_cnt = 0;
+       dhd_pno_scan_results_t *siter, *snext;
+       dhd_pno_best_header_t *phead, *pprev;
+       dhd_pno_bestnet_entry_t *iter, *next;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(head, "head is NULL", err);
+       NULL_CHECK(head->next, "head->next is NULL", err);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_entry_safe(siter, snext,
+               head, list) {
+               if (only_last) {
+                       /* in case that we need to delete only last one */
+                       if (!list_is_last(&siter->list, head)) {
+                               /* skip if the one is not last */
+                               continue;
+                       }
+               }
+               /* delete all data belong if the one is last */
+               phead = siter->bestnetheader;
+               while (phead != NULL) {
+                       removed_scan_cnt++;
+                       list_for_each_entry_safe(iter, next,
+                       &phead->entry_list, list) {
+                               list_del(&iter->list);
+                               MFREE(dhd->osh, iter, BESTNET_ENTRY_SIZE);
+                       }
+                       pprev = phead;
+                       phead = phead->next;
+                       MFREE(dhd->osh, pprev, BEST_HEADER_SIZE);
+               }
+               if (phead == NULL) {
+                       /* it is ok to delete top node */
+                       list_del(&siter->list);
+                       MFREE(dhd->osh, siter, SCAN_RESULTS_SIZE);
+               }
+       }
+       GCC_DIAGNOSTIC_POP();
+       return removed_scan_cnt;
+}
+
+static int
+_dhd_pno_cfg(dhd_pub_t *dhd, uint16 *channel_list, int nchan)
+{
+       int err = BCME_OK;
+       int i = 0;
+       wl_pfn_cfg_t pfncfg_param;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       if (nchan) {
+               NULL_CHECK(channel_list, "nchan is NULL", err);
+       }
+       if (nchan > WL_NUMCHANNELS) {
+               return BCME_RANGE;
+       }
+       DHD_PNO(("%s enter :  nchan : %d\n", __FUNCTION__, nchan));
+       memset(&pfncfg_param, 0, sizeof(wl_pfn_cfg_t));
+       /* Setup default values */
+       pfncfg_param.reporttype = htod32(WL_PFN_REPORT_ALLNET);
+       pfncfg_param.channel_num = htod32(0);
+
+       for (i = 0; i < nchan; i++)
+               pfncfg_param.channel_list[i] = channel_list[i];
+
+       pfncfg_param.channel_num = htod32(nchan);
+       err = dhd_iovar(dhd, 0, "pfn_cfg", (char *)&pfncfg_param, sizeof(pfncfg_param), NULL, 0,
+                       TRUE);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfn_cfg\n", __FUNCTION__));
+               goto exit;
+       }
+exit:
+       return err;
+}
+
+static int
+_dhd_pno_reinitialize_prof(dhd_pub_t *dhd, dhd_pno_params_t *params, dhd_pno_mode_t mode)
+{
+       int err = BCME_OK;
+       dhd_pno_status_info_t *_pno_state;
+       NULL_CHECK(dhd, "dhd is NULL\n", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL\n", err);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       mutex_lock(&_pno_state->pno_mutex);
+       switch (mode) {
+       case DHD_PNO_LEGACY_MODE: {
+               struct dhd_pno_ssid *iter, *next;
+               if (params->params_legacy.nssid > 0) {
+                       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                       list_for_each_entry_safe(iter, next,
+                               &params->params_legacy.ssid_list, list) {
+                               GCC_DIAGNOSTIC_POP();
+                               list_del(&iter->list);
+                               MFREE(dhd->osh, iter, sizeof(struct dhd_pno_ssid));
+                       }
+               }
+
+               params->params_legacy.nssid = 0;
+               params->params_legacy.scan_fr = 0;
+               params->params_legacy.pno_freq_expo_max = 0;
+               params->params_legacy.pno_repeat = 0;
+               params->params_legacy.nchan = 0;
+               memset(params->params_legacy.chan_list, 0,
+                       sizeof(params->params_legacy.chan_list));
+               break;
+       }
+       case DHD_PNO_BATCH_MODE: {
+               params->params_batch.scan_fr = 0;
+               params->params_batch.mscan = 0;
+               params->params_batch.nchan = 0;
+               params->params_batch.rtt = 0;
+               params->params_batch.bestn = 0;
+               params->params_batch.nchan = 0;
+               params->params_batch.band = WLC_BAND_AUTO;
+               memset(params->params_batch.chan_list, 0,
+                       sizeof(params->params_batch.chan_list));
+               params->params_batch.get_batch.batch_started = FALSE;
+               params->params_batch.get_batch.buf = NULL;
+               params->params_batch.get_batch.bufsize = 0;
+               params->params_batch.get_batch.reason = 0;
+               _dhd_pno_clear_all_batch_results(dhd,
+                       &params->params_batch.get_batch.scan_results_list, FALSE);
+               _dhd_pno_clear_all_batch_results(dhd,
+                       &params->params_batch.get_batch.expired_scan_results_list, FALSE);
+               params->params_batch.get_batch.tot_scan_cnt = 0;
+               params->params_batch.get_batch.expired_tot_scan_cnt = 0;
+               params->params_batch.get_batch.top_node_cnt = 0;
+               INIT_LIST_HEAD(&params->params_batch.get_batch.scan_results_list);
+               INIT_LIST_HEAD(&params->params_batch.get_batch.expired_scan_results_list);
+               break;
+       }
+       case DHD_PNO_HOTLIST_MODE: {
+               struct dhd_pno_bssid *iter, *next;
+               if (params->params_hotlist.nbssid > 0) {
+                       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                       list_for_each_entry_safe(iter, next,
+                               &params->params_hotlist.bssid_list, list) {
+                               GCC_DIAGNOSTIC_POP();
+                               list_del(&iter->list);
+                               MFREE(dhd->osh, iter, sizeof(struct dhd_pno_ssid));
+                       }
+               }
+               params->params_hotlist.scan_fr = 0;
+               params->params_hotlist.nbssid = 0;
+               params->params_hotlist.nchan = 0;
+               params->params_batch.band = WLC_BAND_AUTO;
+               memset(params->params_hotlist.chan_list, 0,
+                       sizeof(params->params_hotlist.chan_list));
+               break;
+       }
+       default:
+               DHD_ERROR(("%s : unknown mode : %d\n", __FUNCTION__, mode));
+               break;
+       }
+       mutex_unlock(&_pno_state->pno_mutex);
+       return err;
+}
+
+static int
+_dhd_pno_add_bssid(dhd_pub_t *dhd, wl_pfn_bssid_t *p_pfn_bssid, int nbssid)
+{
+       int err = BCME_OK;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       if (nbssid) {
+               NULL_CHECK(p_pfn_bssid, "bssid list is NULL", err);
+       }
+       err = dhd_iovar(dhd, 0, "pfn_add_bssid", (char *)p_pfn_bssid,
+                       sizeof(wl_pfn_bssid_t) * nbssid, NULL, 0, TRUE);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfn_cfg\n", __FUNCTION__));
+               goto exit;
+       }
+exit:
+       return err;
+}
+
+int
+dhd_pno_stop_for_ssid(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       uint32 mode = 0, cnt = 0;
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pno_params_t *_params = NULL;
+       wl_pfn_bssid_t *p_pfn_bssid = NULL, *tmp_bssid;
+
+       NULL_CHECK(dhd, "dev is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       if (!(_pno_state->pno_mode & DHD_PNO_LEGACY_MODE)) {
+               DHD_ERROR(("%s : LEGACY PNO MODE is not enabled\n", __FUNCTION__));
+               goto exit;
+       }
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       /* If pno mode is PNO_LEGACY_MODE clear the pno values and unset the DHD_PNO_LEGACY_MODE */
+       _params = &_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS];
+       _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_LEGACY_MODE);
+       _pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+
+#ifdef GSCAN_SUPPORT
+       if (_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) {
+               struct dhd_pno_gscan_params *gscan_params;
+
+               _params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+               gscan_params = &_params->params_gscan;
+               if (gscan_params->mscan) {
+                       /* retrieve the batching data from firmware into host */
+                       err = dhd_wait_batch_results_complete(dhd);
+                       if (err != BCME_OK)
+                               goto exit;
+               }
+               /* save current pno_mode before calling dhd_pno_clean */
+               mutex_lock(&_pno_state->pno_mutex);
+               mode = _pno_state->pno_mode;
+               err = dhd_pno_clean(dhd);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, err));
+                       mutex_unlock(&_pno_state->pno_mutex);
+                       goto exit;
+               }
+               /* restore previous pno_mode */
+               _pno_state->pno_mode = mode;
+               mutex_unlock(&_pno_state->pno_mutex);
+               /* Restart gscan */
+               err = dhd_pno_initiate_gscan_request(dhd, 1, 0);
+               goto exit;
+       }
+#endif /* GSCAN_SUPPORT */
+       /* restart Batch mode  if the batch mode is on */
+       if (_pno_state->pno_mode & (DHD_PNO_BATCH_MODE | DHD_PNO_HOTLIST_MODE)) {
+               /* retrieve the batching data from firmware into host */
+               dhd_pno_get_for_batch(dhd, NULL, 0, PNO_STATUS_DISABLE);
+               /* save current pno_mode before calling dhd_pno_clean */
+               mode = _pno_state->pno_mode;
+               err = dhd_pno_clean(dhd);
+               if (err < 0) {
+                       err = BCME_ERROR;
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+
+               /* restore previous pno_mode */
+               _pno_state->pno_mode = mode;
+               if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+                       _params = &(_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS]);
+                       /* restart BATCH SCAN */
+                       err = dhd_pno_set_for_batch(dhd, &_params->params_batch);
+                       if (err < 0) {
+                               _pno_state->pno_mode &= ~DHD_PNO_BATCH_MODE;
+                               DHD_ERROR(("%s : failed to restart batch scan(err: %d)\n",
+                                       __FUNCTION__, err));
+                               goto exit;
+                       }
+               } else if (_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE) {
+                       /* restart HOTLIST SCAN */
+                       struct dhd_pno_bssid *iter, *next;
+                       _params = &(_pno_state->pno_params_arr[INDEX_OF_HOTLIST_PARAMS]);
+                       p_pfn_bssid = MALLOCZ(dhd->osh, sizeof(wl_pfn_bssid_t) *
+                       _params->params_hotlist.nbssid);
+                       if (p_pfn_bssid == NULL) {
+                               DHD_ERROR(("%s : failed to allocate wl_pfn_bssid_t array"
+                               " (count: %d)",
+                                       __FUNCTION__, _params->params_hotlist.nbssid));
+                               err = BCME_ERROR;
+                               _pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+                               goto exit;
+                       }
+                       /* convert dhd_pno_bssid to wl_pfn_bssid */
+                       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                       cnt = 0;
+                       tmp_bssid = p_pfn_bssid;
+                       list_for_each_entry_safe(iter, next,
+                       &_params->params_hotlist.bssid_list, list) {
+                               GCC_DIAGNOSTIC_POP();
+                               memcpy(&tmp_bssid->macaddr,
+                               &iter->macaddr, ETHER_ADDR_LEN);
+                               tmp_bssid->flags = iter->flags;
+                               if (cnt < _params->params_hotlist.nbssid) {
+                                       tmp_bssid++;
+                                       cnt++;
+                               } else {
+                                       DHD_ERROR(("%s: Allocated insufficient memory\n",
+                                               __FUNCTION__));
+                                       break;
+                               }
+                       }
+                       err = dhd_pno_set_for_hotlist(dhd, p_pfn_bssid, &_params->params_hotlist);
+                       if (err < 0) {
+                               _pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+                               DHD_ERROR(("%s : failed to restart hotlist scan(err: %d)\n",
+                                       __FUNCTION__, err));
+                               goto exit;
+                       }
+               }
+       } else {
+               err = dhd_pno_clean(dhd);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+       }
+exit:
+       if (p_pfn_bssid) {
+               MFREE(dhd->osh, p_pfn_bssid, sizeof(wl_pfn_bssid_t) *
+                       _params->params_hotlist.nbssid);
+       }
+       return err;
+}
+
+int
+dhd_pno_enable(dhd_pub_t *dhd, int enable)
+{
+       int err = BCME_OK;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       return (_dhd_pno_enable(dhd, enable));
+}
+
+static int
+dhd_pno_add_to_ssid_list(dhd_pub_t *dhd, struct list_head *ptr, wlc_ssid_ext_t *ssid_list,
+    int nssid, int *num_ssid_added)
+{
+       int ret = BCME_OK;
+       int i;
+       struct dhd_pno_ssid *_pno_ssid;
+
+       for (i = 0; i < nssid; i++) {
+               if (ssid_list[i].SSID_len > DOT11_MAX_SSID_LEN) {
+                       DHD_ERROR(("%s : Invalid SSID length %d\n",
+                               __FUNCTION__, ssid_list[i].SSID_len));
+                       ret = BCME_ERROR;
+                       goto exit;
+               }
+               /* Check for broadcast ssid */
+               if (!ssid_list[i].SSID_len) {
+                       DHD_ERROR(("%d: Broadcast SSID is illegal for PNO setting\n", i));
+                       ret = BCME_ERROR;
+                       goto exit;
+               }
+               _pno_ssid = (struct dhd_pno_ssid *)MALLOCZ(dhd->osh,
+                       sizeof(struct dhd_pno_ssid));
+               if (_pno_ssid == NULL) {
+                       DHD_ERROR(("%s : failed to allocate struct dhd_pno_ssid\n",
+                               __FUNCTION__));
+                       ret = BCME_ERROR;
+                       goto exit;
+               }
+               _pno_ssid->SSID_len = ssid_list[i].SSID_len;
+               _pno_ssid->hidden = ssid_list[i].hidden;
+               _pno_ssid->rssi_thresh = ssid_list[i].rssi_thresh;
+               _pno_ssid->flags = ssid_list[i].flags;
+               _pno_ssid->wpa_auth = WPA_AUTH_PFN_ANY;
+
+               memcpy(_pno_ssid->SSID, ssid_list[i].SSID, _pno_ssid->SSID_len);
+               list_add_tail(&_pno_ssid->list, ptr);
+       }
+
+exit:
+       *num_ssid_added = i;
+       return ret;
+}
+
+int
+dhd_pno_set_for_ssid(dhd_pub_t *dhd, wlc_ssid_ext_t* ssid_list, int nssid,
+       uint16  scan_fr, int pno_repeat, int pno_freq_expo_max, uint16 *channel_list, int nchan)
+{
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pno_params_t *_params;
+       struct dhd_pno_legacy_params *params_legacy;
+       int err = BCME_OK;
+
+       if (!dhd || !dhd->pno_state) {
+               DHD_ERROR(("%s: PNO Not enabled/Not ready\n", __FUNCTION__));
+               return BCME_NOTREADY;
+       }
+
+       if (!dhd_support_sta_mode(dhd)) {
+               return BCME_BADOPTION;
+       }
+
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       _params = &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS]);
+       params_legacy = &(_params->params_legacy);
+       err = _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_LEGACY_MODE);
+
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to reinitialize profile (err %d)\n",
+                       __FUNCTION__, err));
+               return err;
+       }
+
+       INIT_LIST_HEAD(&params_legacy->ssid_list);
+
+       if (dhd_pno_add_to_ssid_list(dhd, &params_legacy->ssid_list, ssid_list,
+               nssid, &params_legacy->nssid) < 0) {
+               _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_LEGACY_MODE);
+               return BCME_ERROR;
+       }
+
+       DHD_PNO(("%s enter : nssid %d, scan_fr :%d, pno_repeat :%d,"
+               "pno_freq_expo_max: %d, nchan :%d\n", __FUNCTION__,
+               params_legacy->nssid, scan_fr, pno_repeat, pno_freq_expo_max, nchan));
+
+       return dhd_pno_set_legacy_pno(dhd, scan_fr, pno_repeat,
+               pno_freq_expo_max, channel_list, nchan);
+
+}
+
+static int
+dhd_pno_set_legacy_pno(dhd_pub_t *dhd, uint16  scan_fr, int pno_repeat,
+       int pno_freq_expo_max, uint16 *channel_list, int nchan)
+{
+       dhd_pno_params_t *_params;
+       dhd_pno_params_t *_params2;
+       dhd_pno_status_info_t *_pno_state;
+       uint16 _chan_list[WL_NUMCHANNELS];
+       int32 tot_nchan = 0;
+       int err = BCME_OK;
+       int i, nssid;
+       int mode = 0;
+       struct list_head *ssid_list;
+
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+
+       _params = &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS]);
+       /* If GSCAN is also ON will handle this down below */
+#ifdef GSCAN_SUPPORT
+       if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE &&
+               !(_pno_state->pno_mode & DHD_PNO_GSCAN_MODE))
+#else
+       if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE)
+#endif /* GSCAN_SUPPORT */
+       {
+               DHD_ERROR(("%s : Legacy PNO mode was already started, "
+                       "will disable previous one to start new one\n", __FUNCTION__));
+               err = dhd_pno_stop_for_ssid(dhd);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to stop legacy PNO (err %d)\n",
+                               __FUNCTION__, err));
+                       return err;
+               }
+       }
+       _pno_state->pno_mode |= DHD_PNO_LEGACY_MODE;
+       memset(_chan_list, 0, sizeof(_chan_list));
+       tot_nchan = MIN(nchan, WL_NUMCHANNELS);
+       if (tot_nchan > 0 && channel_list) {
+               for (i = 0; i < tot_nchan; i++)
+               _params->params_legacy.chan_list[i] = _chan_list[i] = channel_list[i];
+       }
+#ifdef GSCAN_SUPPORT
+       else {
+               tot_nchan = WL_NUMCHANNELS;
+               err = _dhd_pno_get_channels(dhd, _chan_list, &tot_nchan,
+                       (WLC_BAND_2G | WLC_BAND_5G), FALSE);
+               if (err < 0) {
+                       tot_nchan = 0;
+                       DHD_PNO(("Could not get channel list for PNO SSID\n"));
+               } else {
+                       for (i = 0; i < tot_nchan; i++)
+                               _params->params_legacy.chan_list[i] = _chan_list[i];
+               }
+       }
+#endif /* GSCAN_SUPPORT */
+
+       if (_pno_state->pno_mode & (DHD_PNO_BATCH_MODE | DHD_PNO_HOTLIST_MODE)) {
+               DHD_PNO(("BATCH SCAN is on progress in firmware\n"));
+               /* retrieve the batching data from firmware into host */
+               dhd_pno_get_for_batch(dhd, NULL, 0, PNO_STATUS_DISABLE);
+               /* store current pno_mode before disabling pno */
+               mode = _pno_state->pno_mode;
+               err = _dhd_pno_enable(dhd, PNO_OFF);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to disable PNO\n", __FUNCTION__));
+                       goto exit;
+               }
+               /* restore the previous mode */
+               _pno_state->pno_mode = mode;
+               /* use superset of channel list between two mode */
+               if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+                       _params2 = &(_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS]);
+                       if (_params2->params_batch.nchan > 0 && tot_nchan > 0) {
+                               err = _dhd_pno_chan_merge(_chan_list, &tot_nchan,
+                                       &_params2->params_batch.chan_list[0],
+                                       _params2->params_batch.nchan,
+                                       &channel_list[0], tot_nchan);
+                               if (err < 0) {
+                                       DHD_ERROR(("%s : failed to merge channel list"
+                                       " between legacy and batch\n",
+                                               __FUNCTION__));
+                                       goto exit;
+                               }
+                       }  else {
+                               DHD_PNO(("superset channel will use"
+                               " all channels in firmware\n"));
+                       }
+               } else if (_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE) {
+                       _params2 = &(_pno_state->pno_params_arr[INDEX_OF_HOTLIST_PARAMS]);
+                       if (_params2->params_hotlist.nchan > 0 && tot_nchan > 0) {
+                               err = _dhd_pno_chan_merge(_chan_list, &tot_nchan,
+                                       &_params2->params_hotlist.chan_list[0],
+                                       _params2->params_hotlist.nchan,
+                                       &channel_list[0], tot_nchan);
+                               if (err < 0) {
+                                       DHD_ERROR(("%s : failed to merge channel list"
+                                       " between legacy and hotlist\n",
+                                               __FUNCTION__));
+                                       goto exit;
+                               }
+                       }
+               }
+       }
+       _params->params_legacy.scan_fr = scan_fr;
+       _params->params_legacy.pno_repeat = pno_repeat;
+       _params->params_legacy.pno_freq_expo_max = pno_freq_expo_max;
+       _params->params_legacy.nchan = tot_nchan;
+       ssid_list = &_params->params_legacy.ssid_list;
+       nssid = _params->params_legacy.nssid;
+
+#ifdef GSCAN_SUPPORT
+       /* dhd_pno_initiate_gscan_request will handle simultaneous Legacy PNO and GSCAN */
+       if (_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) {
+               struct dhd_pno_gscan_params *gscan_params;
+               gscan_params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS].params_gscan;
+               /* ePNO and Legacy PNO do not co-exist */
+               if (gscan_params->epno_cfg.num_epno_ssid) {
+                       DHD_PNO(("ePNO and Legacy PNO do not co-exist\n"));
+                       err = BCME_EPERM;
+                       goto exit;
+               }
+               DHD_PNO(("GSCAN mode is ON! Will restart GSCAN+Legacy PNO\n"));
+               err = dhd_pno_initiate_gscan_request(dhd, 1, 0);
+               goto exit;
+       }
+#endif /* GSCAN_SUPPORT */
+       if ((err = _dhd_pno_set(dhd, _params, DHD_PNO_LEGACY_MODE)) < 0) {
+               DHD_ERROR(("failed to set call pno_set (err %d) in firmware\n", err));
+               goto exit;
+       }
+       if ((err = _dhd_pno_add_ssid(dhd, ssid_list, nssid)) < 0) {
+               DHD_ERROR(("failed to add ssid list(err %d), %d in firmware\n", err, nssid));
+               goto exit;
+       }
+       if (tot_nchan > 0) {
+               if ((err = _dhd_pno_cfg(dhd, _chan_list, tot_nchan)) < 0) {
+                       DHD_ERROR(("%s : failed to set call pno_cfg (err %d) in firmware\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+       }
+       if (_pno_state->pno_status == DHD_PNO_DISABLED) {
+               if ((err = _dhd_pno_enable(dhd, PNO_ON)) < 0)
+                       DHD_ERROR(("%s : failed to enable PNO\n", __FUNCTION__));
+       }
+exit:
+       if (err < 0) {
+               _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_LEGACY_MODE);
+       }
+       /* clear mode in case of error */
+       if (err < 0) {
+               int ret = dhd_pno_clean(dhd);
+
+               if (ret < 0) {
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, ret));
+               } else {
+                       _pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+               }
+       }
+       return err;
+}
+
+int
+dhd_pno_set_for_batch(dhd_pub_t *dhd, struct dhd_pno_batch_params *batch_params)
+{
+       int err = BCME_OK;
+       uint16 _chan_list[WL_NUMCHANNELS];
+       int rem_nchan = 0, tot_nchan = 0;
+       int mode = 0, mscan = 0;
+       dhd_pno_params_t *_params;
+       dhd_pno_params_t *_params2;
+       dhd_pno_status_info_t *_pno_state;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       NULL_CHECK(batch_params, "batch_params is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       if (!dhd_support_sta_mode(dhd)) {
+               err = BCME_BADOPTION;
+               goto exit;
+       }
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+       _params = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS];
+       if (!(_pno_state->pno_mode & DHD_PNO_BATCH_MODE)) {
+               _pno_state->pno_mode |= DHD_PNO_BATCH_MODE;
+               err = _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_BATCH_MODE);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call _dhd_pno_reinitialize_prof\n",
+                               __FUNCTION__));
+                       goto exit;
+               }
+       } else {
+               /* batch mode is already started */
+               return -EBUSY;
+       }
+       _params->params_batch.scan_fr = batch_params->scan_fr;
+       _params->params_batch.bestn = batch_params->bestn;
+       _params->params_batch.mscan = (batch_params->mscan)?
+               batch_params->mscan : DEFAULT_BATCH_MSCAN;
+       _params->params_batch.nchan = batch_params->nchan;
+       memcpy(_params->params_batch.chan_list, batch_params->chan_list,
+               sizeof(_params->params_batch.chan_list));
+
+       memset(_chan_list, 0, sizeof(_chan_list));
+
+       rem_nchan = ARRAYSIZE(batch_params->chan_list) - batch_params->nchan;
+       if (batch_params->band == WLC_BAND_2G || batch_params->band == WLC_BAND_5G) {
+               /* get a valid channel list based on band B or A */
+               err = _dhd_pno_get_channels(dhd,
+               &_params->params_batch.chan_list[batch_params->nchan],
+               &rem_nchan, batch_params->band, FALSE);
+               if (err < 0) {
+                       DHD_ERROR(("%s: failed to get valid channel list(band : %d)\n",
+                               __FUNCTION__, batch_params->band));
+                       goto exit;
+               }
+               /* now we need to update nchan because rem_chan has valid channel count */
+               _params->params_batch.nchan += rem_nchan;
+               /* need to sort channel list */
+               sort(_params->params_batch.chan_list, _params->params_batch.nchan,
+                       sizeof(_params->params_batch.chan_list[0]), _dhd_pno_cmpfunc, NULL);
+       }
+#ifdef PNO_DEBUG
+{
+               DHD_PNO(("Channel list : "));
+               for (i = 0; i < _params->params_batch.nchan; i++) {
+                       DHD_PNO(("%d ", _params->params_batch.chan_list[i]));
+               }
+               DHD_PNO(("\n"));
+}
+#endif
+       if (_params->params_batch.nchan) {
+               /* copy the channel list into local array */
+               memcpy(_chan_list, _params->params_batch.chan_list, sizeof(_chan_list));
+               tot_nchan = _params->params_batch.nchan;
+       }
+       if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+               DHD_PNO(("PNO SSID is on progress in firmware\n"));
+               /* store current pno_mode before disabling pno */
+               mode = _pno_state->pno_mode;
+               err = _dhd_pno_enable(dhd, PNO_OFF);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to disable PNO\n", __FUNCTION__));
+                       goto exit;
+               }
+               /* restore the previous mode */
+               _pno_state->pno_mode = mode;
+               /* Use the superset for channelist between two mode */
+               _params2 = &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS]);
+               if (_params2->params_legacy.nchan > 0 && _params->params_batch.nchan > 0) {
+                       err = _dhd_pno_chan_merge(_chan_list, &tot_nchan,
+                               &_params2->params_legacy.chan_list[0],
+                               _params2->params_legacy.nchan,
+                               &_params->params_batch.chan_list[0], _params->params_batch.nchan);
+                       if (err < 0) {
+                               DHD_ERROR(("%s : failed to merge channel list"
+                               " between legacy and batch\n",
+                                       __FUNCTION__));
+                               goto exit;
+                       }
+               } else {
+                       DHD_PNO(("superset channel will use all channels in firmware\n"));
+               }
+               if ((err = _dhd_pno_add_ssid(dhd, &_params2->params_legacy.ssid_list,
+                               _params2->params_legacy.nssid)) < 0) {
+                       DHD_ERROR(("failed to add ssid list (err %d) in firmware\n", err));
+                       goto exit;
+               }
+       }
+       if ((err = _dhd_pno_set(dhd, _params, DHD_PNO_BATCH_MODE)) < 0) {
+               DHD_ERROR(("%s : failed to set call pno_set (err %d) in firmware\n",
+                       __FUNCTION__, err));
+               goto exit;
+       } else {
+               /* we need to return mscan */
+               mscan = err;
+       }
+       if (tot_nchan > 0) {
+               if ((err = _dhd_pno_cfg(dhd, _chan_list, tot_nchan)) < 0) {
+                       DHD_ERROR(("%s : failed to set call pno_cfg (err %d) in firmware\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+       }
+       if (_pno_state->pno_status == DHD_PNO_DISABLED) {
+               if ((err = _dhd_pno_enable(dhd, PNO_ON)) < 0)
+                       DHD_ERROR(("%s : failed to enable PNO\n", __FUNCTION__));
+       }
+exit:
+       /* clear mode in case of error */
+       if (err < 0)
+               _pno_state->pno_mode &= ~DHD_PNO_BATCH_MODE;
+       else {
+               /* return #max scan firmware can do */
+               err = mscan;
+       }
+       return err;
+}
+
+#ifdef GSCAN_SUPPORT
+
+static int
+dhd_set_epno_params(dhd_pub_t *dhd, wl_ssid_ext_params_t *params, bool set)
+{
+       wl_pfn_ssid_cfg_t cfg;
+       int err;
+       NULL_CHECK(dhd, "dhd is NULL\n", err);
+       memset(&cfg, 0, sizeof(wl_pfn_ssid_cfg_t));
+       cfg.version = WL_PFN_SSID_CFG_VERSION;
+
+       /* If asked to clear params (set == FALSE) just set the CLEAR bit */
+       if (!set)
+               cfg.flags |= WL_PFN_SSID_CFG_CLEAR;
+       else if (params)
+               memcpy(&cfg.params, params, sizeof(wl_ssid_ext_params_t));
+       err = dhd_iovar(dhd, 0, "pfn_ssid_cfg", (char *)&cfg,
+                       sizeof(wl_pfn_ssid_cfg_t), NULL, 0, TRUE);
+       if (err != BCME_OK) {
+               DHD_ERROR(("%s : Failed to execute pfn_ssid_cfg %d\n", __FUNCTION__, err));
+       }
+       return err;
+}
+
+int
+dhd_pno_flush_fw_epno(dhd_pub_t *dhd)
+{
+       int err;
+
+       NULL_CHECK(dhd, "dhd is NULL\n", err);
+
+       err = dhd_set_epno_params(dhd, NULL, FALSE);
+       if (err < 0) {
+               DHD_ERROR(("failed to set ePNO params %d\n", err));
+               return err;
+       }
+       err = _dhd_pno_flush_ssid(dhd);
+       return err;
+}
+
+int
+dhd_pno_set_epno(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       dhd_pno_params_t *params;
+       dhd_pno_status_info_t *_pno_state;
+
+       struct dhd_pno_gscan_params *gscan_params;
+
+       NULL_CHECK(dhd, "dhd is NULL\n", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+       gscan_params = &params->params_gscan;
+
+       if (gscan_params->epno_cfg.num_epno_ssid) {
+               DHD_PNO(("num_epno_ssid %d\n", gscan_params->epno_cfg.num_epno_ssid));
+               if ((err = _dhd_pno_add_ssid(dhd, &gscan_params->epno_cfg.epno_ssid_list,
+                               gscan_params->epno_cfg.num_epno_ssid)) < 0) {
+                       DHD_ERROR(("failed to add ssid list (err %d) to firmware\n", err));
+                       return err;
+               }
+               err = dhd_set_epno_params(dhd, &gscan_params->epno_cfg.params, TRUE);
+               if (err < 0) {
+                       DHD_ERROR(("failed to set ePNO params %d\n", err));
+               }
+       }
+       return err;
+}
+
+static void
+dhd_pno_reset_cfg_gscan(dhd_pub_t *dhd, dhd_pno_params_t *_params,
+            dhd_pno_status_info_t *_pno_state, uint8 flags)
+{
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       if (flags & GSCAN_FLUSH_SCAN_CFG) {
+               _params->params_gscan.bestn = 0;
+               _params->params_gscan.mscan = 0;
+               _params->params_gscan.buffer_threshold = GSCAN_BATCH_NO_THR_SET;
+               _params->params_gscan.scan_fr = 0;
+               _params->params_gscan.send_all_results_flag = 0;
+               memset(_params->params_gscan.channel_bucket, 0,
+               _params->params_gscan.nchannel_buckets *
+                sizeof(struct dhd_pno_gscan_channel_bucket));
+               _params->params_gscan.nchannel_buckets = 0;
+               DHD_PNO(("Flush Scan config\n"));
+       }
+       if (flags & GSCAN_FLUSH_HOTLIST_CFG) {
+               struct dhd_pno_bssid *iter, *next;
+               if (_params->params_gscan.nbssid_hotlist > 0) {
+                       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                       list_for_each_entry_safe(iter, next,
+                               &_params->params_gscan.hotlist_bssid_list, list) {
+                               GCC_DIAGNOSTIC_POP();
+                               list_del(&iter->list);
+                               MFREE(dhd->osh, iter, sizeof(struct dhd_pno_bssid));
+                       }
+               }
+               _params->params_gscan.nbssid_hotlist = 0;
+               DHD_PNO(("Flush Hotlist Config\n"));
+       }
+       if (flags & GSCAN_FLUSH_EPNO_CFG) {
+               dhd_pno_ssid_t *iter, *next;
+               dhd_epno_ssid_cfg_t *epno_cfg = &_params->params_gscan.epno_cfg;
+
+               if (epno_cfg->num_epno_ssid > 0) {
+                       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                       list_for_each_entry_safe(iter, next,
+                               &epno_cfg->epno_ssid_list, list) {
+                               GCC_DIAGNOSTIC_POP();
+                               list_del(&iter->list);
+                               MFREE(dhd->osh, iter, sizeof(struct dhd_pno_bssid));
+                       }
+                       epno_cfg->num_epno_ssid = 0;
+               }
+               memset(&epno_cfg->params, 0, sizeof(wl_ssid_ext_params_t));
+               DHD_PNO(("Flushed ePNO Config\n"));
+       }
+
+       return;
+}
+
+int
+dhd_pno_lock_batch_results(dhd_pub_t *dhd)
+{
+       dhd_pno_status_info_t *_pno_state;
+       int err = BCME_OK;
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       mutex_lock(&_pno_state->pno_mutex);
+       return err;
+}
+
+void
+dhd_pno_unlock_batch_results(dhd_pub_t *dhd)
+{
+       dhd_pno_status_info_t *_pno_state;
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       mutex_unlock(&_pno_state->pno_mutex);
+       return;
+}
+
+int
+dhd_wait_batch_results_complete(dhd_pub_t *dhd)
+{
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pno_params_t *_params;
+       int err = BCME_OK;
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       _params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+
+       /* Has the workqueue finished its job already?? */
+       if (_params->params_gscan.get_batch_flag == GSCAN_BATCH_RETRIEVAL_IN_PROGRESS) {
+               DHD_PNO(("%s: Waiting to complete retrieval..\n", __FUNCTION__));
+               wait_event_interruptible_timeout(_pno_state->batch_get_wait,
+                    is_batch_retrieval_complete(&_params->params_gscan),
+                    msecs_to_jiffies(GSCAN_BATCH_GET_MAX_WAIT));
+       } else { /* GSCAN_BATCH_RETRIEVAL_COMPLETE */
+               gscan_results_cache_t *iter;
+               uint16 num_results = 0;
+
+               mutex_lock(&_pno_state->pno_mutex);
+               iter = _params->params_gscan.gscan_batch_cache;
+               while (iter) {
+                       num_results += iter->tot_count - iter->tot_consumed;
+                       iter = iter->next;
+               }
+               mutex_unlock(&_pno_state->pno_mutex);
+
+               /* All results consumed/No results cached??
+                * Get fresh results from FW
+                */
+               if ((_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) && !num_results) {
+                       DHD_PNO(("%s: No results cached, getting from FW..\n", __FUNCTION__));
+                       err = dhd_retreive_batch_scan_results(dhd);
+                       if (err == BCME_OK) {
+                               wait_event_interruptible_timeout(_pno_state->batch_get_wait,
+                                 is_batch_retrieval_complete(&_params->params_gscan),
+                                 msecs_to_jiffies(GSCAN_BATCH_GET_MAX_WAIT));
+                       }
+               }
+       }
+       DHD_PNO(("%s: Wait complete\n", __FUNCTION__));
+       return err;
+}
+
+int
+dhd_pno_set_cfg_gscan(dhd_pub_t *dhd, dhd_pno_gscan_cmd_cfg_t type,
+    void *buf, bool flush)
+{
+       int err = BCME_OK;
+       dhd_pno_params_t *_params;
+       int i;
+       dhd_pno_status_info_t *_pno_state;
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       _params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+       mutex_lock(&_pno_state->pno_mutex);
+
+       switch (type) {
+       case DHD_PNO_BATCH_SCAN_CFG_ID:
+               {
+                       gscan_batch_params_t *ptr = (gscan_batch_params_t *)buf;
+                       _params->params_gscan.bestn = ptr->bestn;
+                       _params->params_gscan.mscan = ptr->mscan;
+                       _params->params_gscan.buffer_threshold = ptr->buffer_threshold;
+               }
+               break;
+               case DHD_PNO_GEOFENCE_SCAN_CFG_ID:
+               {
+                       gscan_hotlist_scan_params_t *ptr = (gscan_hotlist_scan_params_t *)buf;
+                       struct dhd_pno_bssid *_pno_bssid;
+                       struct bssid_t *bssid_ptr;
+                       int8 flags;
+
+                       if (flush) {
+                               dhd_pno_reset_cfg_gscan(dhd, _params, _pno_state,
+                                   GSCAN_FLUSH_HOTLIST_CFG);
+                       }
+
+                       if (!ptr->nbssid) {
+                               break;
+                       }
+                       if (!_params->params_gscan.nbssid_hotlist) {
+                               INIT_LIST_HEAD(&_params->params_gscan.hotlist_bssid_list);
+                       }
+
+                       if ((_params->params_gscan.nbssid_hotlist +
+                                       ptr->nbssid) > PFN_SWC_MAX_NUM_APS) {
+                               DHD_ERROR(("Excessive number of hotlist APs programmed %d\n",
+                                       (_params->params_gscan.nbssid_hotlist +
+                                       ptr->nbssid)));
+                               err = BCME_RANGE;
+                               goto exit;
+                       }
+
+                       for (i = 0, bssid_ptr = ptr->bssid; i < ptr->nbssid; i++, bssid_ptr++) {
+                               _pno_bssid = (struct dhd_pno_bssid *)MALLOCZ(dhd->osh,
+                                       sizeof(struct dhd_pno_bssid));
+                               if (!_pno_bssid) {
+                                       DHD_ERROR(("_pno_bssid is NULL, cannot kalloc %zd bytes",
+                                              sizeof(struct dhd_pno_bssid)));
+                                       err = BCME_NOMEM;
+                                       goto exit;
+                               }
+                               memcpy(&_pno_bssid->macaddr, &bssid_ptr->macaddr, ETHER_ADDR_LEN);
+
+                               flags = (int8) bssid_ptr->rssi_reporting_threshold;
+                               _pno_bssid->flags = flags  << WL_PFN_RSSI_SHIFT;
+                               list_add_tail(&_pno_bssid->list,
+                                  &_params->params_gscan.hotlist_bssid_list);
+                       }
+
+                       _params->params_gscan.nbssid_hotlist += ptr->nbssid;
+                       _params->params_gscan.lost_ap_window = ptr->lost_ap_window;
+               }
+               break;
+       case DHD_PNO_SCAN_CFG_ID:
+               {
+                       int k;
+                       uint16 band;
+                       gscan_scan_params_t *ptr = (gscan_scan_params_t *)buf;
+                       struct dhd_pno_gscan_channel_bucket *ch_bucket;
+
+                       if (ptr->nchannel_buckets <= GSCAN_MAX_CH_BUCKETS) {
+                               _params->params_gscan.nchannel_buckets = ptr->nchannel_buckets;
+
+                               memcpy(_params->params_gscan.channel_bucket, ptr->channel_bucket,
+                                   _params->params_gscan.nchannel_buckets *
+                                   sizeof(struct dhd_pno_gscan_channel_bucket));
+                               ch_bucket = _params->params_gscan.channel_bucket;
+
+                               for (i = 0; i < ptr->nchannel_buckets; i++) {
+                                       band = ch_bucket[i].band;
+                                       for (k = 0; k < ptr->channel_bucket[i].num_channels; k++)  {
+                                               ch_bucket[i].chan_list[k] =
+                                               wf_mhz2channel(ptr->channel_bucket[i].chan_list[k],
+                                                       0);
+                                       }
+                                       ch_bucket[i].band = 0;
+                                       /* HAL and DHD use different bits for 2.4G and
+                                        * 5G in bitmap. Hence translating it here...
+                                        */
+                                       if (band & GSCAN_BG_BAND_MASK) {
+                                               ch_bucket[i].band |= WLC_BAND_2G;
+                                       }
+                                       if (band & GSCAN_A_BAND_MASK) {
+                                               ch_bucket[i].band |= WLC_BAND_5G;
+                                       }
+                                       if (band & GSCAN_DFS_MASK) {
+                                               ch_bucket[i].band |= GSCAN_DFS_MASK;
+                                       }
+                                       DHD_PNO(("band %d report_flag %d\n", ch_bucket[i].band,
+                                                 ch_bucket[i].report_flag));
+                               }
+
+                               for (i = 0; i < ptr->nchannel_buckets; i++) {
+                                       ch_bucket[i].bucket_freq_multiple =
+                                       ch_bucket[i].bucket_freq_multiple/ptr->scan_fr;
+                                       ch_bucket[i].bucket_max_multiple =
+                                       ch_bucket[i].bucket_max_multiple/ptr->scan_fr;
+                                       DHD_PNO(("mult %d max_mult %d\n",
+                                                        ch_bucket[i].bucket_freq_multiple,
+                                                        ch_bucket[i].bucket_max_multiple));
+                               }
+                               _params->params_gscan.scan_fr = ptr->scan_fr;
+
+                               DHD_PNO(("num_buckets %d scan_fr %d\n", ptr->nchannel_buckets,
+                                       _params->params_gscan.scan_fr));
+                       } else {
+                               err = BCME_BADARG;
+                       }
+               }
+               break;
+       case DHD_PNO_EPNO_CFG_ID:
+               if (flush) {
+                       dhd_pno_reset_cfg_gscan(dhd, _params, _pno_state,
+                               GSCAN_FLUSH_EPNO_CFG);
+               }
+               break;
+       case DHD_PNO_EPNO_PARAMS_ID:
+               if (flush) {
+                       memset(&_params->params_gscan.epno_cfg.params, 0,
+                               sizeof(wl_ssid_ext_params_t));
+               }
+               if (buf) {
+                       memcpy(&_params->params_gscan.epno_cfg.params, buf,
+                               sizeof(wl_ssid_ext_params_t));
+               }
+               break;
+       default:
+               err = BCME_BADARG;
+               DHD_ERROR(("%s: Unrecognized cmd type - %d\n", __FUNCTION__, type));
+               break;
+       }
+exit:
+       mutex_unlock(&_pno_state->pno_mutex);
+       return err;
+
+}
+
+static bool
+validate_gscan_params(struct dhd_pno_gscan_params *gscan_params)
+{
+       unsigned int i, k;
+
+       if (!gscan_params->scan_fr || !gscan_params->nchannel_buckets) {
+               DHD_ERROR(("%s : Scan freq - %d or number of channel buckets - %d is empty\n",
+                __FUNCTION__, gscan_params->scan_fr, gscan_params->nchannel_buckets));
+               return false;
+       }
+
+       for (i = 0; i < gscan_params->nchannel_buckets; i++) {
+               if (!gscan_params->channel_bucket[i].band) {
+                       for (k = 0; k < gscan_params->channel_bucket[i].num_channels; k++) {
+                               if (gscan_params->channel_bucket[i].chan_list[k] > CHANNEL_5G_MAX) {
+                                       DHD_ERROR(("%s : Unknown channel %d\n", __FUNCTION__,
+                                        gscan_params->channel_bucket[i].chan_list[k]));
+                                       return false;
+                               }
+                       }
+               }
+       }
+
+       return true;
+}
+
+static int
+dhd_pno_set_for_gscan(dhd_pub_t *dhd, struct dhd_pno_gscan_params *gscan_params)
+{
+       int err = BCME_OK;
+       int mode, i = 0;
+       uint16 _chan_list[WL_NUMCHANNELS];
+       int tot_nchan = 0;
+       int num_buckets_to_fw, tot_num_buckets, gscan_param_size;
+       dhd_pno_status_info_t *_pno_state = PNO_GET_PNOSTATE(dhd);
+       wl_pfn_gscan_ch_bucket_cfg_t *ch_bucket = NULL;
+       wl_pfn_gscan_cfg_t *pfn_gscan_cfg_t = NULL;
+       wl_pfn_bssid_t *p_pfn_bssid = NULL;
+       dhd_pno_params_t        *_params;
+       bool fw_flushed = FALSE;
+
+       _params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       NULL_CHECK(gscan_params, "gscan_params is NULL", err);
+
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       if (!dhd_support_sta_mode(dhd)) {
+               err = BCME_BADOPTION;
+               goto exit;
+       }
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       if (!validate_gscan_params(gscan_params)) {
+               DHD_ERROR(("%s : Cannot start gscan - bad params\n", __FUNCTION__));
+               err = BCME_BADARG;
+               goto exit;
+       }
+
+       if (!(ch_bucket = dhd_pno_gscan_create_channel_list(dhd, _pno_state,
+           _chan_list, &tot_num_buckets, &num_buckets_to_fw))) {
+               goto exit;
+       }
+
+       mutex_lock(&_pno_state->pno_mutex);
+       /* Clear any pre-existing results in our cache
+        * not consumed by framework
+        */
+       dhd_gscan_clear_all_batch_results(dhd);
+       if (_pno_state->pno_mode & (DHD_PNO_GSCAN_MODE | DHD_PNO_LEGACY_MODE)) {
+               /* store current pno_mode before disabling pno */
+               mode = _pno_state->pno_mode;
+               err = dhd_pno_clean(dhd);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to disable PNO\n", __FUNCTION__));
+                       mutex_unlock(&_pno_state->pno_mutex);
+                       goto exit;
+               }
+               fw_flushed = TRUE;
+               /* restore the previous mode */
+               _pno_state->pno_mode = mode;
+       }
+       _pno_state->pno_mode |= DHD_PNO_GSCAN_MODE;
+       mutex_unlock(&_pno_state->pno_mutex);
+
+       if ((_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) &&
+               !gscan_params->epno_cfg.num_epno_ssid) {
+               struct dhd_pno_legacy_params *params_legacy;
+               params_legacy =
+                       &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS].params_legacy);
+
+               if ((err = _dhd_pno_add_ssid(dhd, &params_legacy->ssid_list,
+                       params_legacy->nssid)) < 0) {
+                       DHD_ERROR(("failed to add ssid list (err %d) in firmware\n", err));
+                       goto exit;
+               }
+       }
+
+       if ((err = _dhd_pno_set(dhd, _params, DHD_PNO_GSCAN_MODE)) < 0) {
+               DHD_ERROR(("failed to set call pno_set (err %d) in firmware\n", err));
+               goto exit;
+       }
+
+       gscan_param_size = sizeof(wl_pfn_gscan_cfg_t) +
+                 (num_buckets_to_fw - 1) * sizeof(wl_pfn_gscan_ch_bucket_cfg_t);
+       pfn_gscan_cfg_t = (wl_pfn_gscan_cfg_t *) MALLOCZ(dhd->osh, gscan_param_size);
+
+       if (!pfn_gscan_cfg_t) {
+               DHD_ERROR(("%s: failed to malloc memory of size %d\n",
+                  __FUNCTION__, gscan_param_size));
+               err = BCME_NOMEM;
+               goto exit;
+       }
+
+       pfn_gscan_cfg_t->version = WL_GSCAN_CFG_VERSION;
+       if (gscan_params->mscan)
+               pfn_gscan_cfg_t->buffer_threshold = gscan_params->buffer_threshold;
+       else
+               pfn_gscan_cfg_t->buffer_threshold = GSCAN_BATCH_NO_THR_SET;
+
+       pfn_gscan_cfg_t->flags =
+                (gscan_params->send_all_results_flag & GSCAN_SEND_ALL_RESULTS_MASK);
+       pfn_gscan_cfg_t->flags |= GSCAN_ALL_BUCKETS_IN_FIRST_SCAN_MASK;
+       pfn_gscan_cfg_t->count_of_channel_buckets = num_buckets_to_fw;
+       pfn_gscan_cfg_t->retry_threshold = GSCAN_RETRY_THRESHOLD;
+
+       for (i = 0; i < num_buckets_to_fw; i++) {
+               pfn_gscan_cfg_t->channel_bucket[i].bucket_end_index =
+                          ch_bucket[i].bucket_end_index;
+               pfn_gscan_cfg_t->channel_bucket[i].bucket_freq_multiple =
+                          ch_bucket[i].bucket_freq_multiple;
+               pfn_gscan_cfg_t->channel_bucket[i].max_freq_multiple =
+                          ch_bucket[i].max_freq_multiple;
+               pfn_gscan_cfg_t->channel_bucket[i].repeat =
+                          ch_bucket[i].repeat;
+               pfn_gscan_cfg_t->channel_bucket[i].flag =
+                          ch_bucket[i].flag;
+       }
+
+       tot_nchan = pfn_gscan_cfg_t->channel_bucket[num_buckets_to_fw - 1].bucket_end_index + 1;
+       DHD_PNO(("Total channel num %d total ch_buckets  %d ch_buckets_to_fw %d \n", tot_nchan,
+             tot_num_buckets, num_buckets_to_fw));
+
+       if ((err = _dhd_pno_cfg(dhd, _chan_list, tot_nchan)) < 0) {
+               DHD_ERROR(("%s : failed to set call pno_cfg (err %d) in firmware\n",
+                       __FUNCTION__, err));
+               goto exit;
+       }
+
+       if ((err = _dhd_pno_gscan_cfg(dhd, pfn_gscan_cfg_t, gscan_param_size)) < 0) {
+               DHD_ERROR(("%s : failed to set call pno_gscan_cfg (err %d) in firmware\n",
+                       __FUNCTION__, err));
+               goto exit;
+       }
+       /* Reprogram ePNO cfg from dhd cache if FW has been flushed */
+       if (fw_flushed) {
+               dhd_pno_set_epno(dhd);
+       }
+
+       if (gscan_params->nbssid_hotlist) {
+               struct dhd_pno_bssid *iter, *next;
+               wl_pfn_bssid_t *ptr;
+               p_pfn_bssid = (wl_pfn_bssid_t *)MALLOCZ(dhd->osh,
+                       sizeof(wl_pfn_bssid_t) * gscan_params->nbssid_hotlist);
+               if (p_pfn_bssid == NULL) {
+                       DHD_ERROR(("%s : failed to allocate wl_pfn_bssid_t array"
+                       " (count: %d)",
+                               __FUNCTION__, _params->params_hotlist.nbssid));
+                       err = BCME_NOMEM;
+                       _pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+                       goto exit;
+               }
+               ptr = p_pfn_bssid;
+               /* convert dhd_pno_bssid to wl_pfn_bssid */
+               DHD_PNO(("nhotlist %d\n", gscan_params->nbssid_hotlist));
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               list_for_each_entry_safe(iter, next,
+                         &gscan_params->hotlist_bssid_list, list) {
+                       char buffer_hotlist[64];
+                       GCC_DIAGNOSTIC_POP();
+                       memcpy(&ptr->macaddr,
+                       &iter->macaddr, ETHER_ADDR_LEN);
+                       BCM_REFERENCE(buffer_hotlist);
+                       DHD_PNO(("%s\n", bcm_ether_ntoa(&ptr->macaddr, buffer_hotlist)));
+                       ptr->flags = iter->flags;
+                       ptr++;
+               }
+
+               err = _dhd_pno_add_bssid(dhd, p_pfn_bssid, gscan_params->nbssid_hotlist);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call _dhd_pno_add_bssid(err :%d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+       }
+
+       if ((err = _dhd_pno_enable(dhd, PNO_ON)) < 0) {
+               DHD_ERROR(("%s : failed to enable PNO err %d\n", __FUNCTION__, err));
+       }
+
+exit:
+       /* clear mode in case of error */
+       if (err < 0) {
+               int ret = dhd_pno_clean(dhd);
+
+               if (ret < 0) {
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, ret));
+               } else {
+                       _pno_state->pno_mode &= ~DHD_PNO_GSCAN_MODE;
+               }
+       }
+       MFREE(dhd->osh, p_pfn_bssid,
+               sizeof(wl_pfn_bssid_t) * gscan_params->nbssid_hotlist);
+       if (pfn_gscan_cfg_t) {
+               MFREE(dhd->osh, pfn_gscan_cfg_t, gscan_param_size);
+       }
+       if (ch_bucket) {
+               MFREE(dhd->osh, ch_bucket,
+               (tot_num_buckets * sizeof(wl_pfn_gscan_ch_bucket_cfg_t)));
+       }
+       return err;
+
+}
+
+static wl_pfn_gscan_ch_bucket_cfg_t *
+dhd_pno_gscan_create_channel_list(dhd_pub_t *dhd,
+                                  dhd_pno_status_info_t *_pno_state,
+                                  uint16 *chan_list,
+                                  uint32 *num_buckets,
+                                  uint32 *num_buckets_to_fw)
+{
+       int i, num_channels, err, nchan = WL_NUMCHANNELS, ch_cnt;
+       uint16 *ptr = chan_list, max;
+       wl_pfn_gscan_ch_bucket_cfg_t *ch_bucket;
+       dhd_pno_params_t *_params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+       bool is_pno_legacy_running;
+       dhd_pno_gscan_channel_bucket_t *gscan_buckets = _params->params_gscan.channel_bucket;
+
+       /* ePNO and Legacy PNO do not co-exist */
+       is_pno_legacy_running = ((_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) &&
+               !_params->params_gscan.epno_cfg.num_epno_ssid);
+
+       if (is_pno_legacy_running)
+               *num_buckets = _params->params_gscan.nchannel_buckets + 1;
+       else
+               *num_buckets = _params->params_gscan.nchannel_buckets;
+
+       *num_buckets_to_fw = 0;
+
+       ch_bucket = (wl_pfn_gscan_ch_bucket_cfg_t *) MALLOC(dhd->osh,
+          ((*num_buckets) * sizeof(wl_pfn_gscan_ch_bucket_cfg_t)));
+
+       if (!ch_bucket) {
+               DHD_ERROR(("%s: failed to malloc memory of size %zd\n",
+                       __FUNCTION__, (*num_buckets) * sizeof(wl_pfn_gscan_ch_bucket_cfg_t)));
+               *num_buckets_to_fw = *num_buckets = 0;
+               return NULL;
+       }
+
+       max = gscan_buckets[0].bucket_freq_multiple;
+       num_channels = 0;
+       /* nchan is the remaining space left in chan_list buffer
+        * So any overflow list of channels is ignored
+        */
+       for (i = 0; i < _params->params_gscan.nchannel_buckets && nchan; i++) {
+               if (!gscan_buckets[i].band) {
+                       ch_cnt = MIN(gscan_buckets[i].num_channels, (uint8)nchan);
+                       num_channels += ch_cnt;
+                       memcpy(ptr, gscan_buckets[i].chan_list,
+                           ch_cnt * sizeof(uint16));
+                       ptr = ptr + ch_cnt;
+               } else {
+                       /* get a valid channel list based on band B or A */
+                       err = _dhd_pno_get_channels(dhd, ptr,
+                               &nchan, (gscan_buckets[i].band & GSCAN_ABG_BAND_MASK),
+                               !(gscan_buckets[i].band & GSCAN_DFS_MASK));
+
+                       if (err < 0) {
+                               DHD_ERROR(("%s: failed to get valid channel list(band : %d)\n",
+                                       __FUNCTION__, gscan_buckets[i].band));
+                               MFREE(dhd->osh, ch_bucket,
+                                     ((*num_buckets) * sizeof(wl_pfn_gscan_ch_bucket_cfg_t)));
+                               *num_buckets_to_fw = *num_buckets = 0;
+                               return NULL;
+                       }
+
+                       num_channels += nchan;
+                       ptr = ptr + nchan;
+               }
+
+               ch_bucket[i].bucket_end_index = num_channels - 1;
+               ch_bucket[i].bucket_freq_multiple = gscan_buckets[i].bucket_freq_multiple;
+               ch_bucket[i].repeat = gscan_buckets[i].repeat;
+               ch_bucket[i].max_freq_multiple = gscan_buckets[i].bucket_max_multiple;
+               ch_bucket[i].flag = gscan_buckets[i].report_flag;
+               /* HAL and FW interpretations are opposite for this bit */
+               ch_bucket[i].flag ^= DHD_PNO_REPORT_NO_BATCH;
+               if (max < gscan_buckets[i].bucket_freq_multiple)
+                       max = gscan_buckets[i].bucket_freq_multiple;
+               nchan = WL_NUMCHANNELS - num_channels;
+               *num_buckets_to_fw = *num_buckets_to_fw + 1;
+               DHD_PNO(("end_idx  %d freq_mult - %d\n",
+               ch_bucket[i].bucket_end_index, ch_bucket[i].bucket_freq_multiple));
+       }
+
+       _params->params_gscan.max_ch_bucket_freq = max;
+       /* Legacy PNO maybe running, which means we need to create a legacy PNO bucket
+        * Get GCF of Legacy PNO and Gscan scanfreq
+        */
+       if (is_pno_legacy_running) {
+               dhd_pno_params_t *_params1 = &_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS];
+               uint16 *legacy_chan_list = _params1->params_legacy.chan_list;
+               uint16 common_freq;
+               uint32 legacy_bucket_idx = _params->params_gscan.nchannel_buckets;
+               /* If no space is left then only gscan buckets will be sent to FW */
+               if (nchan) {
+                       common_freq = gcd(_params->params_gscan.scan_fr,
+                                         _params1->params_legacy.scan_fr);
+                       max = gscan_buckets[0].bucket_freq_multiple;
+                       /* GSCAN buckets */
+                       for (i = 0; i < _params->params_gscan.nchannel_buckets; i++) {
+                               ch_bucket[i].bucket_freq_multiple *= _params->params_gscan.scan_fr;
+                               ch_bucket[i].bucket_freq_multiple /= common_freq;
+                               if (max < gscan_buckets[i].bucket_freq_multiple)
+                                       max = gscan_buckets[i].bucket_freq_multiple;
+                       }
+                       /* Legacy PNO bucket */
+                       ch_bucket[legacy_bucket_idx].bucket_freq_multiple =
+                                  _params1->params_legacy.scan_fr;
+                       ch_bucket[legacy_bucket_idx].bucket_freq_multiple /=
+                                  common_freq;
+                       _params->params_gscan.max_ch_bucket_freq = MAX(max,
+                                ch_bucket[legacy_bucket_idx].bucket_freq_multiple);
+                       ch_bucket[legacy_bucket_idx].flag = CH_BUCKET_REPORT_REGULAR;
+                       /* Now add channels to the legacy scan bucket */
+                       for (i = 0; i < _params1->params_legacy.nchan && nchan; i++, nchan--) {
+                               ptr[i] = legacy_chan_list[i];
+                               num_channels++;
+                       }
+                       ch_bucket[legacy_bucket_idx].bucket_end_index = num_channels - 1;
+                       *num_buckets_to_fw = *num_buckets_to_fw + 1;
+                       DHD_PNO(("end_idx  %d freq_mult - %d\n",
+                                   ch_bucket[legacy_bucket_idx].bucket_end_index,
+                                   ch_bucket[legacy_bucket_idx].bucket_freq_multiple));
+               }
+       }
+       return ch_bucket;
+}
+
+static int
+dhd_pno_stop_for_gscan(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       int mode;
+       dhd_pno_status_info_t *_pno_state;
+
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       if (!dhd_support_sta_mode(dhd)) {
+               err = BCME_BADOPTION;
+               goto exit;
+       }
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n",
+                       __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       if (!(_pno_state->pno_mode & DHD_PNO_GSCAN_MODE)) {
+               DHD_ERROR(("%s : GSCAN is not enabled\n", __FUNCTION__));
+               goto exit;
+       }
+       if (_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS].params_gscan.mscan) {
+               /* retrieve the batching data from firmware into host */
+               err = dhd_wait_batch_results_complete(dhd);
+               if (err != BCME_OK)
+                       goto exit;
+       }
+       mutex_lock(&_pno_state->pno_mutex);
+       mode = _pno_state->pno_mode & ~DHD_PNO_GSCAN_MODE;
+       err = dhd_pno_clean(dhd);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                       __FUNCTION__, err));
+               mutex_unlock(&_pno_state->pno_mutex);
+               return err;
+       }
+       _pno_state->pno_mode = mode;
+       mutex_unlock(&_pno_state->pno_mutex);
+
+       /* Reprogram Legacy PNO if it was running */
+       if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+               struct dhd_pno_legacy_params *params_legacy;
+               uint16 chan_list[WL_NUMCHANNELS];
+
+               params_legacy = &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS].params_legacy);
+               _pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+
+               DHD_PNO(("Restarting Legacy PNO SSID scan...\n"));
+               memcpy(chan_list, params_legacy->chan_list,
+                       (params_legacy->nchan * sizeof(uint16)));
+               err = dhd_pno_set_legacy_pno(dhd, params_legacy->scan_fr,
+                       params_legacy->pno_repeat, params_legacy->pno_freq_expo_max,
+                       chan_list, params_legacy->nchan);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to restart legacy PNO scan(err: %d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+
+       }
+
+exit:
+       return err;
+}
+
+int
+dhd_pno_initiate_gscan_request(dhd_pub_t *dhd, bool run, bool flush)
+{
+       int err = BCME_OK;
+       dhd_pno_params_t *params;
+       dhd_pno_status_info_t *_pno_state;
+       struct dhd_pno_gscan_params *gscan_params;
+
+       NULL_CHECK(dhd, "dhd is NULL\n", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+
+       DHD_PNO(("%s enter - run %d flush %d\n", __FUNCTION__, run, flush));
+
+       params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+       gscan_params = &params->params_gscan;
+
+       if (run) {
+               err = dhd_pno_set_for_gscan(dhd, gscan_params);
+       } else {
+               if (flush) {
+                       mutex_lock(&_pno_state->pno_mutex);
+                       dhd_pno_reset_cfg_gscan(dhd, params, _pno_state, GSCAN_FLUSH_ALL_CFG);
+                       mutex_unlock(&_pno_state->pno_mutex);
+               }
+               /* Need to stop all gscan */
+               err = dhd_pno_stop_for_gscan(dhd);
+       }
+
+       return err;
+}
+
+int
+dhd_pno_enable_full_scan_result(dhd_pub_t *dhd, bool real_time_flag)
+{
+       int err = BCME_OK;
+       dhd_pno_params_t *params;
+       dhd_pno_status_info_t *_pno_state;
+       struct dhd_pno_gscan_params *gscan_params;
+       uint8 old_flag;
+
+       NULL_CHECK(dhd, "dhd is NULL\n", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+       gscan_params = &params->params_gscan;
+
+       mutex_lock(&_pno_state->pno_mutex);
+
+       old_flag = gscan_params->send_all_results_flag;
+       gscan_params->send_all_results_flag = (uint8) real_time_flag;
+       if (_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) {
+           if (old_flag != gscan_params->send_all_results_flag) {
+                       wl_pfn_gscan_cfg_t gscan_cfg;
+
+                       gscan_cfg.version = WL_GSCAN_CFG_VERSION;
+                       gscan_cfg.flags = (gscan_params->send_all_results_flag &
+                                                  GSCAN_SEND_ALL_RESULTS_MASK);
+                       gscan_cfg.flags |= GSCAN_CFG_FLAGS_ONLY_MASK;
+
+                       if ((err = _dhd_pno_gscan_cfg(dhd, &gscan_cfg,
+                                   sizeof(wl_pfn_gscan_cfg_t))) < 0) {
+                               DHD_ERROR(("%s : pno_gscan_cfg failed (err %d) in firmware\n",
+                                       __FUNCTION__, err));
+                               goto exit_mutex_unlock;
+                       }
+               } else {
+                       DHD_PNO(("No change in flag - %d\n", old_flag));
+               }
+       } else {
+               DHD_PNO(("Gscan not started\n"));
+       }
+exit_mutex_unlock:
+       mutex_unlock(&_pno_state->pno_mutex);
+exit:
+       return err;
+}
+
+/* Cleanup any consumed results
+ * Return TRUE if all results consumed else FALSE
+ */
+int dhd_gscan_batch_cache_cleanup(dhd_pub_t *dhd)
+{
+       int ret = 0;
+       dhd_pno_params_t *params;
+       struct dhd_pno_gscan_params *gscan_params;
+       dhd_pno_status_info_t *_pno_state;
+       gscan_results_cache_t *iter, *tmp;
+
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+       gscan_params = &params->params_gscan;
+       iter = gscan_params->gscan_batch_cache;
+
+       while (iter) {
+               if (iter->tot_consumed == iter->tot_count) {
+                       tmp = iter->next;
+                       MFREE(dhd->osh, iter,
+                               ((iter->tot_count - 1) * sizeof(wifi_gscan_result_t))
+                               + sizeof(gscan_results_cache_t));
+                       iter = tmp;
+               } else
+                       break;
+       }
+       gscan_params->gscan_batch_cache = iter;
+       ret = (iter == NULL);
+       return ret;
+}
+
+static int
+_dhd_pno_get_gscan_batch_from_fw(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       uint32 timestamp = 0, ts = 0, i, j, timediff;
+       dhd_pno_params_t *params;
+       dhd_pno_status_info_t *_pno_state;
+       wl_pfn_lnet_info_v1_t *plnetinfo;
+       wl_pfn_lnet_info_v2_t *plnetinfo_v2;
+       struct dhd_pno_gscan_params *gscan_params;
+       wl_pfn_lscanresults_v1_t *plbestnet_v1 = NULL;
+       wl_pfn_lscanresults_v2_t *plbestnet_v2 = NULL;
+       gscan_results_cache_t *iter, *tail;
+       wifi_gscan_result_t *result;
+       uint8 *nAPs_per_scan = NULL;
+       uint8 num_scans_in_cur_iter;
+       uint16 count;
+       uint16 fwcount;
+       uint16 fwstatus = PFN_INCOMPLETE;
+       struct osl_timespec tm_spec;
+
+       /* Static asserts in _dhd_pno_get_for_batch() below guarantee the v1 and v2
+        * net_info and subnet_info structures are compatible in size and SSID offset,
+        * allowing v1 to be safely used in the code below except for lscanresults
+        * fields themselves (status, count, offset to netinfo).
+        */
+
+       NULL_CHECK(dhd, "dhd is NULL\n", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+       if (!(_pno_state->pno_mode & DHD_PNO_GSCAN_MODE)) {
+               DHD_ERROR(("%s: GSCAN is not enabled\n", __FUNCTION__));
+               goto exit;
+       }
+       gscan_params = &params->params_gscan;
+       nAPs_per_scan = (uint8 *) MALLOC(dhd->osh, gscan_params->mscan);
+
+       if (!nAPs_per_scan) {
+               DHD_ERROR(("%s :Out of memory!! Cant malloc %d bytes\n", __FUNCTION__,
+               gscan_params->mscan));
+               err = BCME_NOMEM;
+               goto exit;
+       }
+
+       plbestnet_v1 = (wl_pfn_lscanresults_v1_t *)MALLOC(dhd->osh, PNO_BESTNET_LEN);
+       if (!plbestnet_v1) {
+               DHD_ERROR(("%s :Out of memory!! Cant malloc %d bytes\n", __FUNCTION__,
+                     (int)PNO_BESTNET_LEN));
+               err = BCME_NOMEM;
+               goto exit;
+       }
+       plbestnet_v2 = (wl_pfn_lscanresults_v2_t *)plbestnet_v1;
+
+       mutex_lock(&_pno_state->pno_mutex);
+
+       dhd_gscan_clear_all_batch_results(dhd);
+
+       if (!(_pno_state->pno_mode & DHD_PNO_GSCAN_MODE)) {
+               DHD_ERROR(("%s : GSCAN is not enabled\n", __FUNCTION__));
+               goto exit_mutex_unlock;
+       }
+
+       timediff = gscan_params->scan_fr * 1000;
+       timediff = timediff >> 1;
+
+       /* Ok, now lets start getting results from the FW */
+       tail = gscan_params->gscan_batch_cache;
+       do {
+               err = dhd_iovar(dhd, 0, "pfnlbest", NULL, 0, (char *)plbestnet_v1, PNO_BESTNET_LEN,
+                               FALSE);
+               if (err < 0) {
+                       DHD_ERROR(("%s : Cannot get all the batch results, err :%d\n",
+                               __FUNCTION__, err));
+                       goto exit_mutex_unlock;
+               }
+               osl_get_monotonic_boottime(&tm_spec);
+
+               if (plbestnet_v1->version == PFN_LBEST_SCAN_RESULT_VERSION_V1) {
+                       fwstatus = plbestnet_v1->status;
+                       fwcount = plbestnet_v1->count;
+                       plnetinfo = &plbestnet_v1->netinfo[0];
+
+                       DHD_PNO(("ver %d, status : %d, count %d\n",
+                               plbestnet_v1->version, fwstatus, fwcount));
+
+                       if (fwcount == 0) {
+                               DHD_PNO(("No more batch results\n"));
+                               goto exit_mutex_unlock;
+                       }
+                       if (fwcount > BESTN_MAX) {
+                               DHD_ERROR(("%s :fwcount %d is greater than BESTN_MAX %d \n",
+                                       __FUNCTION__, fwcount, (int)BESTN_MAX));
+                               /* Process only BESTN_MAX number of results per batch */
+                               fwcount = BESTN_MAX;
+                       }
+                       num_scans_in_cur_iter = 0;
+
+                       timestamp = plnetinfo->timestamp;
+                       /* find out how many scans' results did we get in
+                        * this batch of FW results
+                        */
+                       for (i = 0, count = 0; i < fwcount; i++, count++, plnetinfo++) {
+                               /* Unlikely to happen, but just in case the results from
+                                * FW doesnt make sense..... Assume its part of one single scan
+                                */
+                               if (num_scans_in_cur_iter >= gscan_params->mscan) {
+                                       num_scans_in_cur_iter = 0;
+                                       count = fwcount;
+                                       break;
+                               }
+                               if (TIME_DIFF_MS(timestamp, plnetinfo->timestamp) > timediff) {
+                                       nAPs_per_scan[num_scans_in_cur_iter] = count;
+                                       count = 0;
+                                       num_scans_in_cur_iter++;
+                               }
+                               timestamp = plnetinfo->timestamp;
+                       }
+                       if (num_scans_in_cur_iter < gscan_params->mscan) {
+                               nAPs_per_scan[num_scans_in_cur_iter] = count;
+                               num_scans_in_cur_iter++;
+                       }
+
+                       DHD_PNO(("num_scans_in_cur_iter %d\n", num_scans_in_cur_iter));
+                       /* reset plnetinfo to the first item for the next loop */
+                       plnetinfo -= i;
+
+                       for (i = 0; i < num_scans_in_cur_iter; i++) {
+                               iter = (gscan_results_cache_t *)
+                                       MALLOCZ(dhd->osh, ((nAPs_per_scan[i] - 1) *
+                                       sizeof(wifi_gscan_result_t)) +
+                                       sizeof(gscan_results_cache_t));
+                               if (!iter) {
+                                       DHD_ERROR(("%s :Out of memory!! Cant malloc %d bytes\n",
+                                               __FUNCTION__, gscan_params->mscan));
+                                       err = BCME_NOMEM;
+                                       goto exit_mutex_unlock;
+                               }
+                               /* Need this check because the new set of results from FW
+                                * maybe a continuation of previous sets' scan results
+                                */
+                               if (TIME_DIFF_MS(ts, plnetinfo->timestamp) > timediff) {
+                                       iter->scan_id = ++gscan_params->scan_id;
+                               } else {
+                                       iter->scan_id = gscan_params->scan_id;
+                               }
+                               DHD_PNO(("scan_id %d tot_count %d \n",
+                                       gscan_params->scan_id, nAPs_per_scan[i]));
+                               iter->tot_count = nAPs_per_scan[i];
+                               iter->tot_consumed = 0;
+                               iter->flag = 0;
+                               if (plnetinfo->flags & PFN_PARTIAL_SCAN_MASK) {
+                                       DHD_PNO(("This scan is aborted\n"));
+                                       iter->flag = (ENABLE << PNO_STATUS_ABORT);
+                               } else if (gscan_params->reason) {
+                                       iter->flag = (ENABLE << gscan_params->reason);
+                               }
+
+                               if (!tail) {
+                                       gscan_params->gscan_batch_cache = iter;
+                               } else {
+                                       tail->next = iter;
+                               }
+                               tail = iter;
+                               iter->next = NULL;
+                               for (j = 0; j < nAPs_per_scan[i]; j++, plnetinfo++) {
+                                       result = &iter->results[j];
+
+                                       result->channel =
+                                               wf_channel2mhz(plnetinfo->pfnsubnet.channel,
+                                               (plnetinfo->pfnsubnet.channel <= CH_MAX_2G_CHANNEL?
+                                               WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G));
+                                       result->rssi = (int32) plnetinfo->RSSI;
+                                       result->beacon_period = 0;
+                                       result->capability = 0;
+                                       result->rtt = (uint64) plnetinfo->rtt0;
+                                       result->rtt_sd = (uint64) plnetinfo->rtt1;
+                                       result->ts = convert_fw_rel_time_to_systime(&tm_spec,
+                                                       plnetinfo->timestamp);
+                                       ts = plnetinfo->timestamp;
+                                       if (plnetinfo->pfnsubnet.SSID_len > DOT11_MAX_SSID_LEN) {
+                                               DHD_ERROR(("%s: Invalid SSID length %d\n",
+                                                       __FUNCTION__,
+                                                       plnetinfo->pfnsubnet.SSID_len));
+                                               plnetinfo->pfnsubnet.SSID_len = DOT11_MAX_SSID_LEN;
+                                       }
+                                       memcpy(result->ssid, plnetinfo->pfnsubnet.SSID,
+                                               plnetinfo->pfnsubnet.SSID_len);
+                                       result->ssid[plnetinfo->pfnsubnet.SSID_len] = '\0';
+                                       memcpy(&result->macaddr, &plnetinfo->pfnsubnet.BSSID,
+                                               ETHER_ADDR_LEN);
+
+                                       DHD_PNO(("\tSSID : "));
+                                       DHD_PNO(("\n"));
+                                       DHD_PNO(("\tBSSID: "MACDBG"\n",
+                                               MAC2STRDBG(result->macaddr.octet)));
+                                       DHD_PNO(("\tchannel: %d, RSSI: %d, timestamp: %d ms\n",
+                                               plnetinfo->pfnsubnet.channel,
+                                               plnetinfo->RSSI, plnetinfo->timestamp));
+                                       DHD_PNO(("\tRTT0 : %d, RTT1: %d\n",
+                                               plnetinfo->rtt0, plnetinfo->rtt1));
+
+                               }
+                       }
+
+               } else if (plbestnet_v2->version == PFN_LBEST_SCAN_RESULT_VERSION_V2) {
+                       fwstatus = plbestnet_v2->status;
+                       fwcount = plbestnet_v2->count;
+                       plnetinfo_v2 = (wl_pfn_lnet_info_v2_t*)&plbestnet_v2->netinfo[0];
+
+                       DHD_PNO(("ver %d, status : %d, count %d\n",
+                               plbestnet_v2->version, fwstatus, fwcount));
+
+                       if (fwcount == 0) {
+                               DHD_PNO(("No more batch results\n"));
+                               goto exit_mutex_unlock;
+                       }
+                       if (fwcount > BESTN_MAX) {
+                               DHD_ERROR(("%s :fwcount %d is greater than BESTN_MAX %d \n",
+                                       __FUNCTION__, fwcount, (int)BESTN_MAX));
+                               /* Process only BESTN_MAX number of results per batch */
+                               fwcount = BESTN_MAX;
+                       }
+                       num_scans_in_cur_iter = 0;
+
+                       timestamp = plnetinfo_v2->timestamp;
+                       /* find out how many scans' results did we get
+                        * in this batch of FW results
+                        */
+                       for (i = 0, count = 0; i < fwcount; i++, count++, plnetinfo_v2++) {
+                               /* Unlikely to happen, but just in case the results from
+                                * FW doesnt make sense..... Assume its part of one single scan
+                                */
+                               if (num_scans_in_cur_iter >= gscan_params->mscan) {
+                                       num_scans_in_cur_iter = 0;
+                                       count = fwcount;
+                                       break;
+                               }
+                               if (TIME_DIFF_MS(timestamp, plnetinfo_v2->timestamp) > timediff) {
+                                       nAPs_per_scan[num_scans_in_cur_iter] = count;
+                                       count = 0;
+                                       num_scans_in_cur_iter++;
+                               }
+                               timestamp = plnetinfo_v2->timestamp;
+                       }
+                       if (num_scans_in_cur_iter < gscan_params->mscan) {
+                               nAPs_per_scan[num_scans_in_cur_iter] = count;
+                               num_scans_in_cur_iter++;
+                       }
+
+                       DHD_PNO(("num_scans_in_cur_iter %d\n", num_scans_in_cur_iter));
+                       /* reset plnetinfo to the first item for the next loop */
+                       plnetinfo_v2 -= i;
+
+                       for (i = 0; i < num_scans_in_cur_iter; i++) {
+                               iter = (gscan_results_cache_t *)
+                                       MALLOCZ(dhd->osh, ((nAPs_per_scan[i] - 1) *
+                                       sizeof(wifi_gscan_result_t)) +
+                                       sizeof(gscan_results_cache_t));
+                               if (!iter) {
+                                       DHD_ERROR(("%s :Out of memory!! Cant malloc %d bytes\n",
+                                               __FUNCTION__, gscan_params->mscan));
+                                       err = BCME_NOMEM;
+                                       goto exit_mutex_unlock;
+                               }
+                               /* Need this check because the new set of results from FW
+                                * maybe a continuation of previous sets' scan results
+                                */
+                               if (TIME_DIFF_MS(ts, plnetinfo_v2->timestamp) > timediff) {
+                                       iter->scan_id = ++gscan_params->scan_id;
+                               } else {
+                                       iter->scan_id = gscan_params->scan_id;
+                               }
+                               DHD_PNO(("scan_id %d tot_count %d ch_bucket %x\n",
+                                       gscan_params->scan_id, nAPs_per_scan[i],
+                                       plbestnet_v2->scan_ch_buckets[i]));
+                               iter->tot_count = nAPs_per_scan[i];
+                               iter->scan_ch_bucket = plbestnet_v2->scan_ch_buckets[i];
+                               iter->tot_consumed = 0;
+                               iter->flag = 0;
+                               if (plnetinfo_v2->flags & PFN_PARTIAL_SCAN_MASK) {
+                                       DHD_PNO(("This scan is aborted\n"));
+                                       iter->flag = (ENABLE << PNO_STATUS_ABORT);
+                               } else if (gscan_params->reason) {
+                                       iter->flag = (ENABLE << gscan_params->reason);
+                               }
+
+                               if (!tail) {
+                                       gscan_params->gscan_batch_cache = iter;
+                               } else {
+                                       tail->next = iter;
+                               }
+                               tail = iter;
+                               iter->next = NULL;
+                               for (j = 0; j < nAPs_per_scan[i]; j++, plnetinfo_v2++) {
+                                       result = &iter->results[j];
+
+                                       result->channel =
+                                               wf_channel2mhz(plnetinfo_v2->pfnsubnet.channel,
+                                               (plnetinfo_v2->pfnsubnet.channel <=
+                                               CH_MAX_2G_CHANNEL?
+                                               WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G));
+                                       result->rssi = (int32) plnetinfo_v2->RSSI;
+                                       /* Info not available & not expected */
+                                       result->beacon_period = 0;
+                                       result->capability = 0;
+                                       result->rtt = (uint64) plnetinfo_v2->rtt0;
+                                       result->rtt_sd = (uint64) plnetinfo_v2->rtt1;
+                                       result->ts = convert_fw_rel_time_to_systime(&tm_spec,
+                                               plnetinfo_v2->timestamp);
+                                       ts = plnetinfo_v2->timestamp;
+                                       if (plnetinfo_v2->pfnsubnet.SSID_len > DOT11_MAX_SSID_LEN) {
+                                               DHD_ERROR(("%s: Invalid SSID length %d\n",
+                                                       __FUNCTION__,
+                                                       plnetinfo_v2->pfnsubnet.SSID_len));
+                                               plnetinfo_v2->pfnsubnet.SSID_len =
+                                                       DOT11_MAX_SSID_LEN;
+                                       }
+                                       memcpy(result->ssid, plnetinfo_v2->pfnsubnet.u.SSID,
+                                               plnetinfo_v2->pfnsubnet.SSID_len);
+                                       result->ssid[plnetinfo_v2->pfnsubnet.SSID_len] = '\0';
+                                       memcpy(&result->macaddr, &plnetinfo_v2->pfnsubnet.BSSID,
+                                               ETHER_ADDR_LEN);
+
+                                       DHD_PNO(("\tSSID : "));
+                                       DHD_PNO(("\n"));
+                                       DHD_PNO(("\tBSSID: "MACDBG"\n",
+                                               MAC2STRDBG(result->macaddr.octet)));
+                                       DHD_PNO(("\tchannel: %d, RSSI: %d, timestamp: %d ms\n",
+                                               plnetinfo_v2->pfnsubnet.channel,
+                                               plnetinfo_v2->RSSI, plnetinfo_v2->timestamp));
+                                       DHD_PNO(("\tRTT0 : %d, RTT1: %d\n",
+                                               plnetinfo_v2->rtt0, plnetinfo_v2->rtt1));
+
+                               }
+                       }
+
+               } else {
+                       err = BCME_VERSION;
+                       DHD_ERROR(("bestnet fw version %d not supported\n",
+                               plbestnet_v1->version));
+                       goto exit_mutex_unlock;
+               }
+       } while (fwstatus == PFN_INCOMPLETE);
+
+exit_mutex_unlock:
+       mutex_unlock(&_pno_state->pno_mutex);
+exit:
+       params->params_gscan.get_batch_flag = GSCAN_BATCH_RETRIEVAL_COMPLETE;
+       smp_wmb();
+       wake_up_interruptible(&_pno_state->batch_get_wait);
+       if (nAPs_per_scan) {
+               MFREE(dhd->osh, nAPs_per_scan, gscan_params->mscan * sizeof(uint8));
+       }
+       if (plbestnet_v1) {
+               MFREE(dhd->osh, plbestnet_v1, PNO_BESTNET_LEN);
+       }
+       DHD_PNO(("Batch retrieval done!\n"));
+       return err;
+}
+#endif /* GSCAN_SUPPORT */
+
+#if defined(GSCAN_SUPPORT) || defined(DHD_GET_VALID_CHANNELS)
+static void *
+dhd_get_gscan_batch_results(dhd_pub_t *dhd, uint32 *len)
+{
+       gscan_results_cache_t *iter, *results;
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pno_params_t *_params;
+       uint16 num_scan_ids = 0, num_results = 0;
+
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       _params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+
+       iter = results = _params->params_gscan.gscan_batch_cache;
+       while (iter) {
+               num_results += iter->tot_count - iter->tot_consumed;
+               num_scan_ids++;
+               iter = iter->next;
+       }
+
+       *len = ((num_results << 16) | (num_scan_ids));
+       return results;
+}
+
+void *
+dhd_pno_get_gscan(dhd_pub_t *dhd, dhd_pno_gscan_cmd_cfg_t type,
+         void *info, uint32 *len)
+{
+       void *ret = NULL;
+       dhd_pno_gscan_capabilities_t *ptr;
+       dhd_pno_ssid_t *ssid_elem;
+       dhd_pno_params_t *_params;
+       dhd_epno_ssid_cfg_t *epno_cfg;
+       dhd_pno_status_info_t *_pno_state;
+
+       if (!dhd || !dhd->pno_state) {
+               DHD_ERROR(("NULL POINTER : %s\n", __FUNCTION__));
+               return NULL;
+       }
+
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       _params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+
+       if (!len) {
+               DHD_ERROR(("%s: len is NULL\n", __FUNCTION__));
+               return NULL;
+       }
+
+       switch (type) {
+               case DHD_PNO_GET_CAPABILITIES:
+                       ptr = (dhd_pno_gscan_capabilities_t *)
+                       MALLOCZ(dhd->osh, sizeof(dhd_pno_gscan_capabilities_t));
+                       if (!ptr)
+                               break;
+                       /* Hardcoding these values for now, need to get
+                        * these values from FW, will change in a later check-in
+                        */
+                       ptr->max_scan_cache_size = GSCAN_MAX_AP_CACHE;
+                       ptr->max_scan_buckets = GSCAN_MAX_CH_BUCKETS;
+                       ptr->max_ap_cache_per_scan = GSCAN_MAX_AP_CACHE_PER_SCAN;
+                       ptr->max_rssi_sample_size = PFN_SWC_RSSI_WINDOW_MAX;
+                       ptr->max_scan_reporting_threshold = 100;
+                       ptr->max_hotlist_bssids = PFN_HOTLIST_MAX_NUM_APS;
+                       ptr->max_hotlist_ssids = 0;
+                       ptr->max_significant_wifi_change_aps = 0;
+                       ptr->max_bssid_history_entries = 0;
+                       ptr->max_epno_ssid_crc32 = MAX_EPNO_SSID_NUM;
+                       ptr->max_epno_hidden_ssid = MAX_EPNO_HIDDEN_SSID;
+                       ptr->max_white_list_ssid = MAX_WHITELIST_SSID;
+                       ret = (void *)ptr;
+                       *len = sizeof(dhd_pno_gscan_capabilities_t);
+                       break;
+
+               case DHD_PNO_GET_BATCH_RESULTS:
+                       ret = dhd_get_gscan_batch_results(dhd, len);
+                       break;
+               case DHD_PNO_GET_CHANNEL_LIST:
+                       if (info) {
+                               uint16 ch_list[WL_NUMCHANNELS];
+                               uint32 *p, mem_needed, i;
+                               int32 err, nchan = WL_NUMCHANNELS;
+                               uint32 *gscan_band = (uint32 *) info;
+                               uint8 band = 0;
+
+                               /* No band specified?, nothing to do */
+                               if ((*gscan_band & GSCAN_BAND_MASK) == 0) {
+                                       DHD_PNO(("No band specified\n"));
+                                       *len = 0;
+                                       break;
+                               }
+
+                               /* HAL and DHD use different bits for 2.4G and
+                                * 5G in bitmap. Hence translating it here...
+                                */
+                               if (*gscan_band & GSCAN_BG_BAND_MASK) {
+                                       band |= WLC_BAND_2G;
+                               }
+                               if (*gscan_band & GSCAN_A_BAND_MASK) {
+                                       band |= WLC_BAND_5G;
+                               }
+
+                               err = _dhd_pno_get_channels(dhd, ch_list, &nchan,
+                                                         (band & GSCAN_ABG_BAND_MASK),
+                                                         !(*gscan_band & GSCAN_DFS_MASK));
+
+                               if (err < 0) {
+                                       DHD_ERROR(("%s: failed to get valid channel list\n",
+                                               __FUNCTION__));
+                                       *len = 0;
+                               } else {
+                                       mem_needed = sizeof(uint32) * nchan;
+                                       p = (uint32 *)MALLOC(dhd->osh, mem_needed);
+                                       if (!p) {
+                                               DHD_ERROR(("%s: Unable to malloc %d bytes\n",
+                                                       __FUNCTION__, mem_needed));
+                                               break;
+                                       }
+                                       for (i = 0; i < nchan; i++) {
+                                               p[i] = wf_channel2mhz(ch_list[i],
+                                                       (ch_list[i] <= CH_MAX_2G_CHANNEL?
+                                                       WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G));
+                                       }
+                                       ret = p;
+                                       *len = mem_needed;
+                               }
+                       } else {
+                               *len = 0;
+                               DHD_ERROR(("%s: info buffer is NULL\n", __FUNCTION__));
+                       }
+                       break;
+               case DHD_PNO_GET_NEW_EPNO_SSID_ELEM:
+                       epno_cfg = &_params->params_gscan.epno_cfg;
+                       if (epno_cfg->num_epno_ssid >=
+                                       MAX_EPNO_SSID_NUM) {
+                               DHD_ERROR(("Excessive number of ePNO SSIDs programmed %d\n",
+                                       epno_cfg->num_epno_ssid));
+                               return NULL;
+                       }
+                       if (!epno_cfg->num_epno_ssid) {
+                               INIT_LIST_HEAD(&epno_cfg->epno_ssid_list);
+                       }
+                       ssid_elem = MALLOCZ(dhd->osh, sizeof(dhd_pno_ssid_t));
+                       if (!ssid_elem) {
+                               DHD_ERROR(("EPNO ssid: cannot alloc %zd bytes",
+                                       sizeof(dhd_pno_ssid_t)));
+                               return NULL;
+                       }
+                       epno_cfg->num_epno_ssid++;
+                       list_add_tail(&ssid_elem->list, &epno_cfg->epno_ssid_list);
+                       ret = ssid_elem;
+                       break;
+               default:
+                       DHD_ERROR(("%s: Unrecognized cmd type - %d\n", __FUNCTION__, type));
+                       break;
+       }
+
+       return ret;
+
+}
+#endif /* GSCAN_SUPPORT || DHD_GET_VALID_CHANNELS */
+
+static int
+_dhd_pno_get_for_batch(dhd_pub_t *dhd, char *buf, int bufsize, int reason)
+{
+       int err = BCME_OK;
+       int i, j;
+       uint32 timestamp = 0;
+       dhd_pno_params_t *_params = NULL;
+       dhd_pno_status_info_t *_pno_state = NULL;
+       wl_pfn_lscanresults_v1_t *plbestnet_v1 = NULL;
+       wl_pfn_lscanresults_v2_t *plbestnet_v2 = NULL;
+       wl_pfn_lnet_info_v1_t *plnetinfo;
+       wl_pfn_lnet_info_v2_t *plnetinfo_v2;
+       dhd_pno_bestnet_entry_t *pbestnet_entry;
+       dhd_pno_best_header_t *pbestnetheader = NULL;
+       dhd_pno_scan_results_t *pscan_results = NULL, *siter, *snext;
+       bool allocate_header = FALSE;
+       uint16 fwstatus = PFN_INCOMPLETE;
+       uint16 fwcount;
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+
+       /* The static asserts below guarantee the v1 and v2 net_info and subnet_info
+        * structures are compatible in size and SSID offset, allowing v1 to be safely
+        * used in the code below except for lscanresults fields themselves
+        * (status, count, offset to netinfo).
+        */
+       STATIC_ASSERT(sizeof(wl_pfn_net_info_v1_t) == sizeof(wl_pfn_net_info_v2_t));
+       STATIC_ASSERT(sizeof(wl_pfn_lnet_info_v1_t) == sizeof(wl_pfn_lnet_info_v2_t));
+       STATIC_ASSERT(sizeof(wl_pfn_subnet_info_v1_t) == sizeof(wl_pfn_subnet_info_v2_t));
+       ASSERT(OFFSETOF(wl_pfn_subnet_info_v1_t, SSID) ==
+                     OFFSETOF(wl_pfn_subnet_info_v2_t, u.SSID));
+
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+
+       if (!dhd_support_sta_mode(dhd)) {
+               err = BCME_BADOPTION;
+               goto exit_no_unlock;
+       }
+
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit_no_unlock;
+       }
+
+       if (!(_pno_state->pno_mode & DHD_PNO_BATCH_MODE)) {
+               DHD_ERROR(("%s: Batching SCAN mode is not enabled\n", __FUNCTION__));
+               goto exit_no_unlock;
+       }
+       mutex_lock(&_pno_state->pno_mutex);
+       _params = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS];
+       if (buf && bufsize) {
+               if (!list_empty(&_params->params_batch.get_batch.expired_scan_results_list)) {
+                       /* need to check whether we have cashed data or not */
+                       DHD_PNO(("%s: have cashed batching data in Driver\n",
+                               __FUNCTION__));
+                       /* convert to results format */
+                       goto convert_format;
+               } else {
+                       /* this is a first try to get batching results */
+                       if (!list_empty(&_params->params_batch.get_batch.scan_results_list)) {
+                               /* move the scan_results_list to expired_scan_results_lists */
+                               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                               list_for_each_entry_safe(siter, snext,
+                                       &_params->params_batch.get_batch.scan_results_list, list) {
+                                       GCC_DIAGNOSTIC_POP();
+                                       list_move_tail(&siter->list,
+                                       &_params->params_batch.get_batch.expired_scan_results_list);
+                               }
+                               _params->params_batch.get_batch.top_node_cnt = 0;
+                               _params->params_batch.get_batch.expired_tot_scan_cnt =
+                                       _params->params_batch.get_batch.tot_scan_cnt;
+                               _params->params_batch.get_batch.tot_scan_cnt = 0;
+                               goto convert_format;
+                       }
+               }
+       }
+       /* create dhd_pno_scan_results_t whenever we got event WLC_E_PFN_BEST_BATCHING */
+       pscan_results = (dhd_pno_scan_results_t *)MALLOC(dhd->osh, SCAN_RESULTS_SIZE);
+       if (pscan_results == NULL) {
+               err = BCME_NOMEM;
+               DHD_ERROR(("failed to allocate dhd_pno_scan_results_t\n"));
+               goto exit;
+       }
+       pscan_results->bestnetheader = NULL;
+       pscan_results->cnt_header = 0;
+       /* add the element into list unless total node cnt is less than MAX_NODE_ CNT */
+       if (_params->params_batch.get_batch.top_node_cnt < MAX_NODE_CNT) {
+               list_add(&pscan_results->list, &_params->params_batch.get_batch.scan_results_list);
+               _params->params_batch.get_batch.top_node_cnt++;
+       } else {
+               int _removed_scan_cnt;
+               /* remove oldest one and add new one */
+               DHD_PNO(("%s : Remove oldest node and add new one\n", __FUNCTION__));
+               _removed_scan_cnt = _dhd_pno_clear_all_batch_results(dhd,
+                       &_params->params_batch.get_batch.scan_results_list, TRUE);
+               _params->params_batch.get_batch.tot_scan_cnt -= _removed_scan_cnt;
+               list_add(&pscan_results->list, &_params->params_batch.get_batch.scan_results_list);
+
+       }
+
+       plbestnet_v1 = (wl_pfn_lscanresults_v1_t *)MALLOC(dhd->osh, PNO_BESTNET_LEN);
+       NULL_CHECK(plbestnet_v1, "failed to allocate buffer for bestnet", err);
+       plbestnet_v2 = (wl_pfn_lscanresults_v2_t*)plbestnet_v1;
+
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       do {
+               err = dhd_iovar(dhd, 0, "pfnlbest", NULL, 0, (char *)plbestnet_v1, PNO_BESTNET_LEN,
+                               FALSE);
+               if (err < 0) {
+                       if (err == BCME_EPERM) {
+                               DHD_ERROR(("we cannot get the batching data "
+                                       "during scanning in firmware, try again\n,"));
+                               msleep(500);
+                               continue;
+                       } else {
+                               DHD_ERROR(("%s : failed to execute pfnlbest (err :%d)\n",
+                                       __FUNCTION__, err));
+                               goto exit;
+                       }
+               }
+
+               if (plbestnet_v1->version == PFN_LBEST_SCAN_RESULT_VERSION_V1) {
+                       fwstatus = plbestnet_v1->status;
+                       fwcount = plbestnet_v1->count;
+                       plnetinfo = &plbestnet_v1->netinfo[0];
+                       if (fwcount == 0) {
+                               DHD_PNO(("No more batch results\n"));
+                               goto exit;
+                       }
+                       if (fwcount > BESTN_MAX) {
+                               DHD_ERROR(("%s :fwcount %d is greater than BESTN_MAX %d \n",
+                                       __FUNCTION__, fwcount, (int)BESTN_MAX));
+                               /* Process only BESTN_MAX number of results per batch */
+                               fwcount = BESTN_MAX;
+                       }
+                       for (i = 0; i < fwcount; i++) {
+                               pbestnet_entry = (dhd_pno_bestnet_entry_t *)
+                                       MALLOC(dhd->osh, BESTNET_ENTRY_SIZE);
+                               if (pbestnet_entry == NULL) {
+                                       err = BCME_NOMEM;
+                                       DHD_ERROR(("failed to allocate dhd_pno_bestnet_entry\n"));
+                                       goto exit;
+                               }
+                               memset(pbestnet_entry, 0, BESTNET_ENTRY_SIZE);
+                               /* record the current time */
+                               pbestnet_entry->recorded_time = jiffies;
+                               /* create header for the first entry */
+                               allocate_header = (i == 0)? TRUE : FALSE;
+                               /* check whether the new generation is started or not */
+                               if (timestamp && (TIME_DIFF(timestamp, plnetinfo->timestamp)
+                                       > TIME_MIN_DIFF))
+                                       allocate_header = TRUE;
+                               timestamp = plnetinfo->timestamp;
+                               if (allocate_header) {
+                                       pbestnetheader = (dhd_pno_best_header_t *)
+                                               MALLOC(dhd->osh, BEST_HEADER_SIZE);
+                                       if (pbestnetheader == NULL) {
+                                               err = BCME_NOMEM;
+                                               if (pbestnet_entry)
+                                                       MFREE(dhd->osh, pbestnet_entry,
+                                                               BESTNET_ENTRY_SIZE);
+                                               DHD_ERROR(("failed to allocate"
+                                                       " dhd_pno_bestnet_entry\n"));
+                                               goto exit;
+                                       }
+                                       /* increase total cnt of bestnet header */
+                                       pscan_results->cnt_header++;
+                                       /* need to record the reason to call dhd_pno_get_for_bach */
+                                       if (reason)
+                                               pbestnetheader->reason = (ENABLE << reason);
+                                       memset(pbestnetheader, 0, BEST_HEADER_SIZE);
+                                       /* initialize the head of linked list */
+                                       INIT_LIST_HEAD(&(pbestnetheader->entry_list));
+                                       /* link the pbestnet heaer into existed list */
+                                       if (pscan_results->bestnetheader == NULL)
+                                               /* In case of header */
+                                               pscan_results->bestnetheader = pbestnetheader;
+                                       else {
+                                               dhd_pno_best_header_t *head =
+                                                       pscan_results->bestnetheader;
+                                               pscan_results->bestnetheader = pbestnetheader;
+                                               pbestnetheader->next = head;
+                                       }
+                               }
+                               pbestnet_entry->channel = plnetinfo->pfnsubnet.channel;
+                               pbestnet_entry->RSSI = plnetinfo->RSSI;
+                               if (plnetinfo->flags & PFN_PARTIAL_SCAN_MASK) {
+                                       /* if RSSI is positive value, we assume that
+                                        * this scan is aborted by other scan
+                                        */
+                                       DHD_PNO(("This scan is aborted\n"));
+                                       pbestnetheader->reason = (ENABLE << PNO_STATUS_ABORT);
+                               }
+                               pbestnet_entry->rtt0 = plnetinfo->rtt0;
+                               pbestnet_entry->rtt1 = plnetinfo->rtt1;
+                               pbestnet_entry->timestamp = plnetinfo->timestamp;
+                               if (plnetinfo->pfnsubnet.SSID_len > DOT11_MAX_SSID_LEN) {
+                                       DHD_ERROR(("%s: Invalid SSID length"
+                                               " %d: trimming it to max\n",
+                                               __FUNCTION__, plnetinfo->pfnsubnet.SSID_len));
+                                       plnetinfo->pfnsubnet.SSID_len = DOT11_MAX_SSID_LEN;
+                               }
+                               pbestnet_entry->SSID_len = plnetinfo->pfnsubnet.SSID_len;
+                               memcpy(pbestnet_entry->SSID, plnetinfo->pfnsubnet.SSID,
+                                               pbestnet_entry->SSID_len);
+                               memcpy(&pbestnet_entry->BSSID, &plnetinfo->pfnsubnet.BSSID,
+                                               ETHER_ADDR_LEN);
+                               /* add the element into list */
+                               list_add_tail(&pbestnet_entry->list, &pbestnetheader->entry_list);
+                               /* increase best entry count */
+                               pbestnetheader->tot_cnt++;
+                               pbestnetheader->tot_size += BESTNET_ENTRY_SIZE;
+                               DHD_PNO(("Header %d\n", pscan_results->cnt_header - 1));
+                               DHD_PNO(("\tSSID : "));
+                               for (j = 0; j < plnetinfo->pfnsubnet.SSID_len; j++)
+                                       DHD_PNO(("%c", plnetinfo->pfnsubnet.SSID[j]));
+                               DHD_PNO(("\n"));
+                               DHD_PNO(("\tBSSID: "MACDBG"\n",
+                                       MAC2STRDBG(plnetinfo->pfnsubnet.BSSID.octet)));
+                               DHD_PNO(("\tchannel: %d, RSSI: %d, timestamp: %d ms\n",
+                                       plnetinfo->pfnsubnet.channel,
+                                       plnetinfo->RSSI, plnetinfo->timestamp));
+                               DHD_PNO(("\tRTT0 : %d, RTT1: %d\n", plnetinfo->rtt0,
+                                       plnetinfo->rtt1));
+                               plnetinfo++;
+                       }
+               } else if (plbestnet_v2->version == PFN_LBEST_SCAN_RESULT_VERSION_V2) {
+                       fwstatus = plbestnet_v2->status;
+                       fwcount = plbestnet_v2->count;
+                       plnetinfo_v2 = (wl_pfn_lnet_info_v2_t*)&plbestnet_v2->netinfo[0];
+                       if (fwcount == 0) {
+                               DHD_PNO(("No more batch results\n"));
+                               goto exit;
+                       }
+                       if (fwcount > BESTN_MAX) {
+                               DHD_ERROR(("%s :fwcount %d is greater than BESTN_MAX %d \n",
+                                       __FUNCTION__, fwcount, (int)BESTN_MAX));
+                               /* Process only BESTN_MAX number of results per batch */
+                               fwcount = BESTN_MAX;
+                       }
+                       DHD_PNO(("ver %d, status : %d, count %d\n",
+                               plbestnet_v2->version, fwstatus, fwcount));
+
+                       for (i = 0; i < fwcount; i++) {
+                               pbestnet_entry = (dhd_pno_bestnet_entry_t *)
+                                       MALLOC(dhd->osh, BESTNET_ENTRY_SIZE);
+                               if (pbestnet_entry == NULL) {
+                                       err = BCME_NOMEM;
+                                       DHD_ERROR(("failed to allocate dhd_pno_bestnet_entry\n"));
+                                       goto exit;
+                               }
+                               memset(pbestnet_entry, 0, BESTNET_ENTRY_SIZE);
+                               /* record the current time */
+                               pbestnet_entry->recorded_time = jiffies;
+                               /* create header for the first entry */
+                               allocate_header = (i == 0)? TRUE : FALSE;
+                               /* check whether the new generation is started or not */
+                               if (timestamp && (TIME_DIFF(timestamp, plnetinfo_v2->timestamp)
+                                       > TIME_MIN_DIFF))
+                                       allocate_header = TRUE;
+                               timestamp = plnetinfo_v2->timestamp;
+                               if (allocate_header) {
+                                       pbestnetheader = (dhd_pno_best_header_t *)
+                                               MALLOC(dhd->osh, BEST_HEADER_SIZE);
+                                       if (pbestnetheader == NULL) {
+                                               err = BCME_NOMEM;
+                                               if (pbestnet_entry)
+                                                       MFREE(dhd->osh, pbestnet_entry,
+                                                               BESTNET_ENTRY_SIZE);
+                                               DHD_ERROR(("failed to allocate"
+                                                       " dhd_pno_bestnet_entry\n"));
+                                               goto exit;
+                                       }
+                                       /* increase total cnt of bestnet header */
+                                       pscan_results->cnt_header++;
+                                       /* need to record the reason to call dhd_pno_get_for_bach */
+                                       if (reason)
+                                               pbestnetheader->reason = (ENABLE << reason);
+                                       memset(pbestnetheader, 0, BEST_HEADER_SIZE);
+                                       /* initialize the head of linked list */
+                                       INIT_LIST_HEAD(&(pbestnetheader->entry_list));
+                                       /* link the pbestnet heaer into existed list */
+                                       if (pscan_results->bestnetheader == NULL)
+                                               /* In case of header */
+                                               pscan_results->bestnetheader = pbestnetheader;
+                                       else {
+                                               dhd_pno_best_header_t *head =
+                                                       pscan_results->bestnetheader;
+                                               pscan_results->bestnetheader = pbestnetheader;
+                                               pbestnetheader->next = head;
+                                       }
+                               }
+                               /* fills the best network info */
+                               pbestnet_entry->channel = plnetinfo_v2->pfnsubnet.channel;
+                               pbestnet_entry->RSSI = plnetinfo_v2->RSSI;
+                               if (plnetinfo_v2->flags & PFN_PARTIAL_SCAN_MASK) {
+                                       /* if RSSI is positive value, we assume that
+                                        * this scan is aborted by other scan
+                                        */
+                                       DHD_PNO(("This scan is aborted\n"));
+                                       pbestnetheader->reason = (ENABLE << PNO_STATUS_ABORT);
+                               }
+                               pbestnet_entry->rtt0 = plnetinfo_v2->rtt0;
+                               pbestnet_entry->rtt1 = plnetinfo_v2->rtt1;
+                               pbestnet_entry->timestamp = plnetinfo_v2->timestamp;
+                               if (plnetinfo_v2->pfnsubnet.SSID_len > DOT11_MAX_SSID_LEN) {
+                                       DHD_ERROR(("%s: Invalid SSID length"
+                                               " %d: trimming it to max\n",
+                                               __FUNCTION__, plnetinfo_v2->pfnsubnet.SSID_len));
+                                       plnetinfo_v2->pfnsubnet.SSID_len = DOT11_MAX_SSID_LEN;
+                               }
+                               pbestnet_entry->SSID_len = plnetinfo_v2->pfnsubnet.SSID_len;
+                               memcpy(pbestnet_entry->SSID, plnetinfo_v2->pfnsubnet.u.SSID,
+                                       pbestnet_entry->SSID_len);
+                               memcpy(&pbestnet_entry->BSSID, &plnetinfo_v2->pfnsubnet.BSSID,
+                                       ETHER_ADDR_LEN);
+                               /* add the element into list */
+                               list_add_tail(&pbestnet_entry->list, &pbestnetheader->entry_list);
+                               /* increase best entry count */
+                               pbestnetheader->tot_cnt++;
+                               pbestnetheader->tot_size += BESTNET_ENTRY_SIZE;
+                               DHD_PNO(("Header %d\n", pscan_results->cnt_header - 1));
+                               DHD_PNO(("\tSSID : "));
+                               for (j = 0; j < plnetinfo_v2->pfnsubnet.SSID_len; j++)
+                                       DHD_PNO(("%c", plnetinfo_v2->pfnsubnet.u.SSID[j]));
+                               DHD_PNO(("\n"));
+                               DHD_PNO(("\tBSSID: "MACDBG"\n",
+                                       MAC2STRDBG(plnetinfo_v2->pfnsubnet.BSSID.octet)));
+                               DHD_PNO(("\tchannel: %d, RSSI: %d, timestamp: %d ms\n",
+                                       plnetinfo_v2->pfnsubnet.channel,
+                                       plnetinfo_v2->RSSI, plnetinfo_v2->timestamp));
+                               DHD_PNO(("\tRTT0 : %d, RTT1: %d\n", plnetinfo_v2->rtt0,
+                                       plnetinfo_v2->rtt1));
+                               plnetinfo_v2++;
+                       }
+               } else {
+                       err = BCME_VERSION;
+                       DHD_ERROR(("bestnet fw version %d not supported\n",
+                               plbestnet_v1->version));
+                       goto exit;
+               }
+       } while (fwstatus != PFN_COMPLETE);
+
+       if (pscan_results->cnt_header == 0) {
+               /* In case that we didn't get any data from the firmware
+                * Remove the current scan_result list from get_bach.scan_results_list.
+                */
+               DHD_PNO(("NO BATCH DATA from Firmware, Delete current SCAN RESULT LIST\n"));
+               list_del(&pscan_results->list);
+               MFREE(dhd->osh, pscan_results, SCAN_RESULTS_SIZE);
+               _params->params_batch.get_batch.top_node_cnt--;
+       } else {
+               /* increase total scan count using current scan count */
+               _params->params_batch.get_batch.tot_scan_cnt += pscan_results->cnt_header;
+       }
+
+       if (buf && bufsize) {
+               /* This is a first try to get batching results */
+               if (!list_empty(&_params->params_batch.get_batch.scan_results_list)) {
+                       /* move the scan_results_list to expired_scan_results_lists */
+                       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                       list_for_each_entry_safe(siter, snext,
+                               &_params->params_batch.get_batch.scan_results_list, list) {
+                               GCC_DIAGNOSTIC_POP();
+                               list_move_tail(&siter->list,
+                                       &_params->params_batch.get_batch.expired_scan_results_list);
+                       }
+                       /* reset gloval values after  moving to expired list */
+                       _params->params_batch.get_batch.top_node_cnt = 0;
+                       _params->params_batch.get_batch.expired_tot_scan_cnt =
+                               _params->params_batch.get_batch.tot_scan_cnt;
+                       _params->params_batch.get_batch.tot_scan_cnt = 0;
+               }
+convert_format:
+               err = _dhd_pno_convert_format(dhd, &_params->params_batch, buf, bufsize);
+               if (err < 0) {
+                       DHD_ERROR(("failed to convert the data into upper layer format\n"));
+                       goto exit;
+               }
+       }
+exit:
+       if (plbestnet_v1)
+               MFREE(dhd->osh, plbestnet_v1, PNO_BESTNET_LEN);
+       if (_params) {
+               _params->params_batch.get_batch.buf = NULL;
+               _params->params_batch.get_batch.bufsize = 0;
+               _params->params_batch.get_batch.bytes_written = err;
+       }
+       mutex_unlock(&_pno_state->pno_mutex);
+exit_no_unlock:
+       if (waitqueue_active(&_pno_state->get_batch_done.wait))
+               complete(&_pno_state->get_batch_done);
+       return err;
+}
+
+static void
+_dhd_pno_get_batch_handler(struct work_struct *work)
+{
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pub_t *dhd;
+       struct dhd_pno_batch_params *params_batch;
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       _pno_state = container_of(work, struct dhd_pno_status_info, work);
+       GCC_DIAGNOSTIC_POP();
+
+       dhd = _pno_state->dhd;
+       if (dhd == NULL) {
+               DHD_ERROR(("%s : dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+#ifdef GSCAN_SUPPORT
+       _dhd_pno_get_gscan_batch_from_fw(dhd);
+#endif /* GSCAN_SUPPORT */
+       if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+               params_batch = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS].params_batch;
+
+               _dhd_pno_get_for_batch(dhd, params_batch->get_batch.buf,
+                       params_batch->get_batch.bufsize, params_batch->get_batch.reason);
+       }
+}
+
+int
+dhd_pno_get_for_batch(dhd_pub_t *dhd, char *buf, int bufsize, int reason)
+{
+       int err = BCME_OK;
+       char *pbuf = buf;
+       dhd_pno_status_info_t *_pno_state;
+       struct dhd_pno_batch_params *params_batch;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       if (!dhd_support_sta_mode(dhd)) {
+               err = BCME_BADOPTION;
+               goto exit;
+       }
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+       params_batch = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS].params_batch;
+#ifdef GSCAN_SUPPORT
+       if (_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) {
+               struct dhd_pno_gscan_params *gscan_params;
+               gscan_params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS].params_gscan;
+               gscan_params->reason = reason;
+               err = dhd_retreive_batch_scan_results(dhd);
+               if (err == BCME_OK) {
+                       wait_event_interruptible_timeout(_pno_state->batch_get_wait,
+                            is_batch_retrieval_complete(gscan_params),
+                            msecs_to_jiffies(GSCAN_BATCH_GET_MAX_WAIT));
+               }
+       } else
+#endif
+       {
+               if (!(_pno_state->pno_mode & DHD_PNO_BATCH_MODE)) {
+                       DHD_ERROR(("%s: Batching SCAN mode is not enabled\n", __FUNCTION__));
+                       memset(pbuf, 0, bufsize);
+                       pbuf += snprintf(pbuf, bufsize, "scancount=%d\n", 0);
+                       snprintf(pbuf, bufsize, "%s", RESULTS_END_MARKER);
+                       err = strlen(buf);
+                       goto exit;
+               }
+               params_batch->get_batch.buf = buf;
+               params_batch->get_batch.bufsize = bufsize;
+               params_batch->get_batch.reason = reason;
+               params_batch->get_batch.bytes_written = 0;
+               schedule_work(&_pno_state->work);
+               wait_for_completion(&_pno_state->get_batch_done);
+       }
+
+#ifdef GSCAN_SUPPORT
+       if (!(_pno_state->pno_mode & DHD_PNO_GSCAN_MODE))
+#endif
+       err = params_batch->get_batch.bytes_written;
+exit:
+       return err;
+}
+
+int
+dhd_pno_stop_for_batch(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       int mode = 0;
+       int i = 0;
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pno_params_t *_params;
+       wl_pfn_bssid_t *p_pfn_bssid = NULL;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       if (!dhd_support_sta_mode(dhd)) {
+               err = BCME_BADOPTION;
+               goto exit;
+       }
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n",
+                       __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+#ifdef GSCAN_SUPPORT
+       if (_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) {
+               DHD_PNO(("Gscan is ongoing, nothing to stop here\n"));
+               return err;
+       }
+#endif
+
+       if (!(_pno_state->pno_mode & DHD_PNO_BATCH_MODE)) {
+               DHD_ERROR(("%s : PNO BATCH MODE is not enabled\n", __FUNCTION__));
+               goto exit;
+       }
+       _pno_state->pno_mode &= ~DHD_PNO_BATCH_MODE;
+       if (_pno_state->pno_mode & (DHD_PNO_LEGACY_MODE | DHD_PNO_HOTLIST_MODE)) {
+               mode = _pno_state->pno_mode;
+               err = dhd_pno_clean(dhd);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+
+               _pno_state->pno_mode = mode;
+               /* restart Legacy PNO if the Legacy PNO is on */
+               if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+                       struct dhd_pno_legacy_params *_params_legacy;
+                       _params_legacy =
+                               &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS].params_legacy);
+                       err = dhd_pno_set_legacy_pno(dhd, _params_legacy->scan_fr,
+                               _params_legacy->pno_repeat,
+                               _params_legacy->pno_freq_expo_max,
+                               _params_legacy->chan_list, _params_legacy->nchan);
+                       if (err < 0) {
+                               DHD_ERROR(("%s : failed to restart legacy PNO scan(err: %d)\n",
+                                       __FUNCTION__, err));
+                               goto exit;
+                       }
+               } else if (_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE) {
+                       struct dhd_pno_bssid *iter, *next;
+                       _params = &(_pno_state->pno_params_arr[INDEX_OF_HOTLIST_PARAMS]);
+                       p_pfn_bssid = (wl_pfn_bssid_t *)MALLOCZ(dhd->osh,
+                               sizeof(wl_pfn_bssid_t) * _params->params_hotlist.nbssid);
+                       if (p_pfn_bssid == NULL) {
+                               DHD_ERROR(("%s : failed to allocate wl_pfn_bssid_t array"
+                                       " (count: %d)",
+                                       __FUNCTION__, _params->params_hotlist.nbssid));
+                               err = BCME_ERROR;
+                               _pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+                               goto exit;
+                       }
+                       i = 0;
+                       /* convert dhd_pno_bssid to wl_pfn_bssid */
+                       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                       list_for_each_entry_safe(iter, next,
+                               &_params->params_hotlist.bssid_list, list) {
+                               GCC_DIAGNOSTIC_POP();
+                               memcpy(&p_pfn_bssid[i].macaddr, &iter->macaddr, ETHER_ADDR_LEN);
+                               p_pfn_bssid[i].flags = iter->flags;
+                               i++;
+                       }
+                       err = dhd_pno_set_for_hotlist(dhd, p_pfn_bssid, &_params->params_hotlist);
+                       if (err < 0) {
+                               _pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+                               DHD_ERROR(("%s : failed to restart hotlist scan(err: %d)\n",
+                                       __FUNCTION__, err));
+                               goto exit;
+                       }
+               }
+       } else {
+               err = dhd_pno_clean(dhd);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+       }
+exit:
+       _params = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS];
+       _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_BATCH_MODE);
+       MFREE(dhd->osh, p_pfn_bssid,
+               sizeof(wl_pfn_bssid_t) * _params->params_hotlist.nbssid);
+       return err;
+}
+
+int
+dhd_pno_set_for_hotlist(dhd_pub_t *dhd, wl_pfn_bssid_t *p_pfn_bssid,
+       struct dhd_pno_hotlist_params *hotlist_params)
+{
+       int err = BCME_OK;
+       int i;
+       uint16 _chan_list[WL_NUMCHANNELS];
+       int rem_nchan = 0;
+       int tot_nchan = 0;
+       int mode = 0;
+       dhd_pno_params_t *_params;
+       dhd_pno_params_t *_params2;
+       struct dhd_pno_bssid *_pno_bssid;
+       dhd_pno_status_info_t *_pno_state;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       NULL_CHECK(hotlist_params, "hotlist_params is NULL", err);
+       NULL_CHECK(p_pfn_bssid, "p_pfn_bssid is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       if (!dhd_support_sta_mode(dhd)) {
+               err = BCME_BADOPTION;
+               goto exit;
+       }
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+       _params = &_pno_state->pno_params_arr[INDEX_OF_HOTLIST_PARAMS];
+       if (!(_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE)) {
+               _pno_state->pno_mode |= DHD_PNO_HOTLIST_MODE;
+               err = _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_HOTLIST_MODE);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call _dhd_pno_reinitialize_prof\n",
+                               __FUNCTION__));
+                       goto exit;
+               }
+       }
+       _params->params_batch.nchan = hotlist_params->nchan;
+       _params->params_batch.scan_fr = hotlist_params->scan_fr;
+       if (hotlist_params->nchan)
+               memcpy(_params->params_hotlist.chan_list, hotlist_params->chan_list,
+                       sizeof(_params->params_hotlist.chan_list));
+       memset(_chan_list, 0, sizeof(_chan_list));
+
+       rem_nchan = ARRAYSIZE(hotlist_params->chan_list) - hotlist_params->nchan;
+       if (hotlist_params->band == WLC_BAND_2G || hotlist_params->band == WLC_BAND_5G) {
+               /* get a valid channel list based on band B or A */
+               err = _dhd_pno_get_channels(dhd,
+               &_params->params_hotlist.chan_list[hotlist_params->nchan],
+               &rem_nchan, hotlist_params->band, FALSE);
+               if (err < 0) {
+                       DHD_ERROR(("%s: failed to get valid channel list(band : %d)\n",
+                               __FUNCTION__, hotlist_params->band));
+                       goto exit;
+               }
+               /* now we need to update nchan because rem_chan has valid channel count */
+               _params->params_hotlist.nchan += rem_nchan;
+               /* need to sort channel list */
+               sort(_params->params_hotlist.chan_list, _params->params_hotlist.nchan,
+                       sizeof(_params->params_hotlist.chan_list[0]), _dhd_pno_cmpfunc, NULL);
+       }
+#ifdef PNO_DEBUG
+{
+               int i;
+               DHD_PNO(("Channel list : "));
+               for (i = 0; i < _params->params_batch.nchan; i++) {
+                       DHD_PNO(("%d ", _params->params_batch.chan_list[i]));
+               }
+               DHD_PNO(("\n"));
+}
+#endif
+       if (_params->params_hotlist.nchan) {
+               /* copy the channel list into local array */
+               memcpy(_chan_list, _params->params_hotlist.chan_list,
+                       sizeof(_chan_list));
+               tot_nchan = _params->params_hotlist.nchan;
+       }
+       if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+                       DHD_PNO(("PNO SSID is on progress in firmware\n"));
+                       /* store current pno_mode before disabling pno */
+                       mode = _pno_state->pno_mode;
+                       err = _dhd_pno_enable(dhd, PNO_OFF);
+                       if (err < 0) {
+                               DHD_ERROR(("%s : failed to disable PNO\n", __FUNCTION__));
+                               goto exit;
+                       }
+                       /* restore the previous mode */
+                       _pno_state->pno_mode = mode;
+                       /* Use the superset for channelist between two mode */
+                       _params2 = &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS]);
+                       if (_params2->params_legacy.nchan > 0 &&
+                               _params->params_hotlist.nchan > 0) {
+                               err = _dhd_pno_chan_merge(_chan_list, &tot_nchan,
+                                       &_params2->params_legacy.chan_list[0],
+                                       _params2->params_legacy.nchan,
+                                       &_params->params_hotlist.chan_list[0],
+                                       _params->params_hotlist.nchan);
+                               if (err < 0) {
+                                       DHD_ERROR(("%s : failed to merge channel list"
+                                               "between legacy and hotlist\n",
+                                               __FUNCTION__));
+                                       goto exit;
+                               }
+                       }
+
+       }
+
+       INIT_LIST_HEAD(&(_params->params_hotlist.bssid_list));
+
+       err = _dhd_pno_add_bssid(dhd, p_pfn_bssid, hotlist_params->nbssid);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to call _dhd_pno_add_bssid(err :%d)\n",
+                       __FUNCTION__, err));
+               goto exit;
+       }
+       if ((err = _dhd_pno_set(dhd, _params, DHD_PNO_HOTLIST_MODE)) < 0) {
+               DHD_ERROR(("%s : failed to set call pno_set (err %d) in firmware\n",
+                       __FUNCTION__, err));
+               goto exit;
+       }
+       if (tot_nchan > 0) {
+               if ((err = _dhd_pno_cfg(dhd, _chan_list, tot_nchan)) < 0) {
+                       DHD_ERROR(("%s : failed to set call pno_cfg (err %d) in firmware\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+       }
+       for (i = 0; i < hotlist_params->nbssid; i++) {
+               _pno_bssid = (struct dhd_pno_bssid *)MALLOCZ(dhd->osh,
+                       sizeof(struct dhd_pno_bssid));
+               NULL_CHECK(_pno_bssid, "_pfn_bssid is NULL", err);
+               memcpy(&_pno_bssid->macaddr, &p_pfn_bssid[i].macaddr, ETHER_ADDR_LEN);
+               _pno_bssid->flags = p_pfn_bssid[i].flags;
+               list_add_tail(&_pno_bssid->list, &_params->params_hotlist.bssid_list);
+       }
+       _params->params_hotlist.nbssid = hotlist_params->nbssid;
+       if (_pno_state->pno_status == DHD_PNO_DISABLED) {
+               if ((err = _dhd_pno_enable(dhd, PNO_ON)) < 0)
+                       DHD_ERROR(("%s : failed to enable PNO\n", __FUNCTION__));
+       }
+exit:
+       /* clear mode in case of error */
+       if (err < 0)
+               _pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+       return err;
+}
+
+int
+dhd_pno_stop_for_hotlist(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       uint32 mode = 0;
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pno_params_t *_params;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n",
+                       __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       if (!(_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE)) {
+               DHD_ERROR(("%s : Hotlist MODE is not enabled\n",
+                       __FUNCTION__));
+               goto exit;
+       }
+       _pno_state->pno_mode &= ~DHD_PNO_BATCH_MODE;
+
+       if (_pno_state->pno_mode & (DHD_PNO_LEGACY_MODE | DHD_PNO_BATCH_MODE)) {
+               /* retrieve the batching data from firmware into host */
+               dhd_pno_get_for_batch(dhd, NULL, 0, PNO_STATUS_DISABLE);
+               /* save current pno_mode before calling dhd_pno_clean */
+               mode = _pno_state->pno_mode;
+               err = dhd_pno_clean(dhd);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+               /* restore previos pno mode */
+               _pno_state->pno_mode = mode;
+               if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+                       /* restart Legacy PNO Scan */
+                       struct dhd_pno_legacy_params *_params_legacy;
+                       _params_legacy =
+                       &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS].params_legacy);
+                       err = dhd_pno_set_legacy_pno(dhd, _params_legacy->scan_fr,
+                               _params_legacy->pno_repeat, _params_legacy->pno_freq_expo_max,
+                               _params_legacy->chan_list, _params_legacy->nchan);
+                       if (err < 0) {
+                               DHD_ERROR(("%s : failed to restart legacy PNO scan(err: %d)\n",
+                                       __FUNCTION__, err));
+                               goto exit;
+                       }
+               } else if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+                       /* restart Batching Scan */
+                       _params = &(_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS]);
+                       /* restart BATCH SCAN */
+                       err = dhd_pno_set_for_batch(dhd, &_params->params_batch);
+                       if (err < 0) {
+                               _pno_state->pno_mode &= ~DHD_PNO_BATCH_MODE;
+                               DHD_ERROR(("%s : failed to restart batch scan(err: %d)\n",
+                                       __FUNCTION__,  err));
+                               goto exit;
+                       }
+               }
+       } else {
+               err = dhd_pno_clean(dhd);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+       }
+exit:
+       return err;
+}
+
+#ifdef GSCAN_SUPPORT
+int
+dhd_retreive_batch_scan_results(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pno_params_t *_params;
+       struct dhd_pno_batch_params *params_batch;
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       _params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+
+       params_batch = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS].params_batch;
+       if (_params->params_gscan.get_batch_flag == GSCAN_BATCH_RETRIEVAL_COMPLETE) {
+               DHD_PNO(("Retreive batch results\n"));
+               params_batch->get_batch.buf = NULL;
+               params_batch->get_batch.bufsize = 0;
+               params_batch->get_batch.reason = PNO_STATUS_EVENT;
+               _params->params_gscan.get_batch_flag = GSCAN_BATCH_RETRIEVAL_IN_PROGRESS;
+               smp_wmb();
+               schedule_work(&_pno_state->work);
+       } else {
+               DHD_PNO(("%s : WLC_E_PFN_BEST_BATCHING retrieval"
+                       "already in progress, will skip\n", __FUNCTION__));
+               err = BCME_ERROR;
+       }
+
+       return err;
+}
+
+void
+dhd_gscan_hotlist_cache_cleanup(dhd_pub_t *dhd, hotlist_type_t type)
+{
+       dhd_pno_status_info_t *_pno_state = PNO_GET_PNOSTATE(dhd);
+       struct dhd_pno_gscan_params *gscan_params;
+       gscan_results_cache_t *iter, *tmp;
+
+       if (!_pno_state) {
+               return;
+       }
+       gscan_params = &(_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS].params_gscan);
+
+       if (type == HOTLIST_FOUND) {
+               iter = gscan_params->gscan_hotlist_found;
+               gscan_params->gscan_hotlist_found = NULL;
+       } else {
+               iter = gscan_params->gscan_hotlist_lost;
+               gscan_params->gscan_hotlist_lost = NULL;
+       }
+
+       while (iter) {
+               tmp = iter->next;
+               MFREE(dhd->osh, iter,
+                               ((iter->tot_count - 1) * sizeof(wifi_gscan_result_t))
+                               + sizeof(gscan_results_cache_t));
+               iter = tmp;
+       }
+
+       return;
+}
+
+void *
+dhd_process_full_gscan_result(dhd_pub_t *dhd, const void *data, uint32 len, int *size)
+{
+       wl_bss_info_t *bi = NULL;
+       wl_gscan_result_t *gscan_result;
+       wifi_gscan_full_result_t *result = NULL;
+       u32 bi_length = 0;
+       uint8 channel;
+       uint32 mem_needed;
+       struct osl_timespec ts;
+       u32 bi_ie_length = 0;
+       u32 bi_ie_offset = 0;
+
+       *size = 0;
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       gscan_result = (wl_gscan_result_t *)data;
+       GCC_DIAGNOSTIC_POP();
+       if (!gscan_result) {
+               DHD_ERROR(("Invalid gscan result (NULL pointer)\n"));
+               goto exit;
+       }
+
+       if ((len < sizeof(*gscan_result)) ||
+           (len < dtoh32(gscan_result->buflen)) ||
+           (dtoh32(gscan_result->buflen) >
+           (sizeof(*gscan_result) + WL_SCAN_IE_LEN_MAX))) {
+               DHD_ERROR(("%s: invalid gscan buflen:%u\n", __FUNCTION__,
+                       dtoh32(gscan_result->buflen)));
+               goto exit;
+       }
+
+       bi = &gscan_result->bss_info[0].info;
+       bi_length = dtoh32(bi->length);
+       if (bi_length != (dtoh32(gscan_result->buflen) -
+              WL_GSCAN_RESULTS_FIXED_SIZE - WL_GSCAN_INFO_FIXED_FIELD_SIZE)) {
+               DHD_ERROR(("Invalid bss_info length %d: ignoring\n", bi_length));
+               goto exit;
+       }
+       bi_ie_offset = dtoh32(bi->ie_offset);
+       bi_ie_length = dtoh32(bi->ie_length);
+       if ((bi_ie_offset + bi_ie_length) > bi_length) {
+               DHD_ERROR(("%s: Invalid ie_length:%u or ie_offset:%u\n",
+                       __FUNCTION__, bi_ie_length, bi_ie_offset));
+               goto exit;
+       }
+       if (bi->SSID_len > DOT11_MAX_SSID_LEN) {
+               DHD_ERROR(("%s: Invalid SSID length:%u\n", __FUNCTION__, bi->SSID_len));
+               goto exit;
+       }
+
+       mem_needed = OFFSETOF(wifi_gscan_full_result_t, ie_data) + bi->ie_length;
+       result = (wifi_gscan_full_result_t *)MALLOC(dhd->osh, mem_needed);
+       if (!result) {
+               DHD_ERROR(("%s Cannot malloc scan result buffer %d bytes\n",
+                 __FUNCTION__, mem_needed));
+               goto exit;
+       }
+
+       result->scan_ch_bucket = gscan_result->scan_ch_bucket;
+       memcpy(result->fixed.ssid, bi->SSID, bi->SSID_len);
+       result->fixed.ssid[bi->SSID_len] = '\0';
+       channel = wf_chspec_ctlchan(bi->chanspec);
+       result->fixed.channel = wf_channel2mhz(channel,
+               (channel <= CH_MAX_2G_CHANNEL?
+               WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G));
+       result->fixed.rssi = (int32) bi->RSSI;
+       result->fixed.rtt = 0;
+       result->fixed.rtt_sd = 0;
+       osl_get_monotonic_boottime(&ts);
+       result->fixed.ts = (uint64) TIMESPEC_TO_US(ts);
+       result->fixed.beacon_period = dtoh16(bi->beacon_period);
+       result->fixed.capability = dtoh16(bi->capability);
+       result->ie_length = bi_ie_length;
+       memcpy(&result->fixed.macaddr, &bi->BSSID, ETHER_ADDR_LEN);
+       memcpy(result->ie_data, ((uint8 *)bi + bi_ie_offset), bi_ie_length);
+       *size = mem_needed;
+exit:
+       return result;
+}
+
+void *
+dhd_pno_process_epno_result(dhd_pub_t *dhd, const void *data, uint32 event, int *size)
+{
+       dhd_epno_results_t *results = NULL;
+       dhd_pno_status_info_t *_pno_state = PNO_GET_PNOSTATE(dhd);
+       struct dhd_pno_gscan_params *gscan_params;
+       uint32 count, mem_needed = 0, i;
+       uint8 ssid[DOT11_MAX_SSID_LEN + 1];
+       struct ether_addr *bssid;
+
+       *size = 0;
+       if (!_pno_state)
+               return NULL;
+       gscan_params = &(_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS].params_gscan);
+
+       if (event == WLC_E_PFN_NET_FOUND || event == WLC_E_PFN_NET_LOST) {
+               wl_pfn_scanresults_v1_t *pfn_result = (wl_pfn_scanresults_v1_t *)data;
+               wl_pfn_scanresults_v2_t *pfn_result_v2 = (wl_pfn_scanresults_v2_t *)data;
+               wl_pfn_net_info_v1_t *net;
+               wl_pfn_net_info_v2_t *net_v2;
+
+               if (pfn_result->version == PFN_SCANRESULT_VERSION_V1) {
+                       if ((pfn_result->count == 0) || (pfn_result->count > EVENT_MAX_NETCNT_V1)) {
+                               DHD_ERROR(("%s event %d: wrong pfn v1 results count %d\n",
+                                               __FUNCTION__, event, pfn_result->count));
+                               return NULL;
+                       }
+                       count = pfn_result->count;
+                       mem_needed = sizeof(dhd_epno_results_t) * count;
+                       results = (dhd_epno_results_t *)MALLOC(dhd->osh, mem_needed);
+                       if (!results) {
+                               DHD_ERROR(("%s: Can't malloc %d bytes for results\n", __FUNCTION__,
+                                       mem_needed));
+                               return NULL;
+                       }
+                       for (i = 0; i < count; i++) {
+                               net = &pfn_result->netinfo[i];
+                               results[i].rssi = net->RSSI;
+                               results[i].channel =  wf_channel2mhz(net->pfnsubnet.channel,
+                                       (net->pfnsubnet.channel <= CH_MAX_2G_CHANNEL ?
+                                       WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G));
+                               results[i].flags = (event == WLC_E_PFN_NET_FOUND) ?
+                                       WL_PFN_SSID_EXT_FOUND: WL_PFN_SSID_EXT_LOST;
+                               results[i].ssid_len = min(net->pfnsubnet.SSID_len,
+                                       (uint8)DOT11_MAX_SSID_LEN);
+                               bssid = &results[i].bssid;
+                               memcpy(bssid, &net->pfnsubnet.BSSID, ETHER_ADDR_LEN);
+                               if (!net->pfnsubnet.SSID_len) {
+                                       DHD_ERROR(("%s: Gscan results indexing is not"
+                                               " supported in version 1 \n", __FUNCTION__));
+                                       MFREE(dhd->osh, results, mem_needed);
+                                       return NULL;
+                               } else {
+                                       memcpy(results[i].ssid, net->pfnsubnet.SSID,
+                                               results[i].ssid_len);
+                               }
+                               memcpy(ssid, results[i].ssid, results[i].ssid_len);
+                               ssid[results[i].ssid_len] = '\0';
+                               DHD_PNO(("ssid - %s bssid "MACDBG" ch %d rssi %d flags %d\n",
+                                       ssid, MAC2STRDBG(bssid->octet), results[i].channel,
+                                       results[i].rssi, results[i].flags));
+                       }
+               } else if (pfn_result_v2->version == PFN_SCANRESULT_VERSION_V2) {
+                       if ((pfn_result->count == 0) || (pfn_result->count > EVENT_MAX_NETCNT_V2)) {
+                               DHD_ERROR(("%s event %d: wrong pfn v2 results count %d\n",
+                                               __FUNCTION__, event, pfn_result->count));
+                               return NULL;
+                       }
+                       count = pfn_result_v2->count;
+                       mem_needed = sizeof(dhd_epno_results_t) * count;
+                       results = (dhd_epno_results_t *)MALLOC(dhd->osh, mem_needed);
+                       if (!results) {
+                               DHD_ERROR(("%s: Can't malloc %d bytes for results\n", __FUNCTION__,
+                                       mem_needed));
+                               return NULL;
+                       }
+                       for (i = 0; i < count; i++) {
+                               net_v2 = &pfn_result_v2->netinfo[i];
+                               results[i].rssi = net_v2->RSSI;
+                               results[i].channel =  wf_channel2mhz(net_v2->pfnsubnet.channel,
+                                       (net_v2->pfnsubnet.channel <= CH_MAX_2G_CHANNEL ?
+                                       WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G));
+                               results[i].flags = (event == WLC_E_PFN_NET_FOUND) ?
+                                       WL_PFN_SSID_EXT_FOUND: WL_PFN_SSID_EXT_LOST;
+                               results[i].ssid_len = min(net_v2->pfnsubnet.SSID_len,
+                                       (uint8)DOT11_MAX_SSID_LEN);
+                               bssid = &results[i].bssid;
+                               memcpy(bssid, &net_v2->pfnsubnet.BSSID, ETHER_ADDR_LEN);
+                               if (!net_v2->pfnsubnet.SSID_len) {
+                                       dhd_pno_idx_to_ssid(gscan_params, &results[i],
+                                               net_v2->pfnsubnet.u.index);
+                               } else {
+                                       memcpy(results[i].ssid, net_v2->pfnsubnet.u.SSID,
+                                               results[i].ssid_len);
+                               }
+                               memcpy(ssid, results[i].ssid, results[i].ssid_len);
+                               ssid[results[i].ssid_len] = '\0';
+                               DHD_PNO(("ssid - %s bssid "MACDBG" ch %d rssi %d flags %d\n",
+                                       ssid, MAC2STRDBG(bssid->octet), results[i].channel,
+                                       results[i].rssi, results[i].flags));
+                       }
+               } else {
+                       DHD_ERROR(("%s event %d: Incorrect version %d , not supported\n",
+                               __FUNCTION__, event, pfn_result->version));
+                       return NULL;
+               }
+       }
+       *size = mem_needed;
+       return results;
+}
+
+void *
+dhd_handle_hotlist_scan_evt(dhd_pub_t *dhd, const void *event_data,
+        int *send_evt_bytes, hotlist_type_t type, u32 *buf_len)
+{
+       void *ptr = NULL;
+       dhd_pno_status_info_t *_pno_state = PNO_GET_PNOSTATE(dhd);
+       struct dhd_pno_gscan_params *gscan_params;
+       wl_pfn_scanresults_v1_t *results_v1 = (wl_pfn_scanresults_v1_t *)event_data;
+       wl_pfn_scanresults_v2_t *results_v2 = (wl_pfn_scanresults_v2_t *)event_data;
+       wifi_gscan_result_t *hotlist_found_array;
+       wl_pfn_net_info_v1_t *pnetinfo;
+       wl_pfn_net_info_v2_t *pnetinfo_v2;
+       gscan_results_cache_t *gscan_hotlist_cache;
+       u32 malloc_size = 0, i, total = 0;
+       struct osl_timespec tm_spec;
+       uint16 fwstatus;
+       uint16 fwcount;
+
+       /* Static asserts in _dhd_pno_get_for_batch() above guarantee the v1 and v2
+        * net_info and subnet_info structures are compatible in size and SSID offset,
+        * allowing v1 to be safely used in the code below except for lscanresults
+        * fields themselves (status, count, offset to netinfo).
+        */
+
+       *buf_len = 0;
+       if (results_v1->version == PFN_SCANRESULTS_VERSION_V1) {
+               fwstatus = results_v1->status;
+               fwcount = results_v1->count;
+               pnetinfo = &results_v1->netinfo[0];
+
+               gscan_params = &(_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS].params_gscan);
+
+               if (!fwcount || (fwcount > EVENT_MAX_NETCNT_V1)) {
+                       DHD_ERROR(("%s: wrong v1 fwcount:%d\n", __FUNCTION__, fwcount));
+                       *send_evt_bytes = 0;
+                       return ptr;
+               }
+
+               osl_get_monotonic_boottime(&tm_spec);
+               malloc_size = sizeof(gscan_results_cache_t) +
+                       ((fwcount - 1) * sizeof(wifi_gscan_result_t));
+               gscan_hotlist_cache = (gscan_results_cache_t *)MALLOC(dhd->osh, malloc_size);
+               if (!gscan_hotlist_cache) {
+                       DHD_ERROR(("%s Cannot Malloc %d bytes!!\n", __FUNCTION__, malloc_size));
+                       *send_evt_bytes = 0;
+                       return ptr;
+               }
+
+               *buf_len = malloc_size;
+               if (type == HOTLIST_FOUND) {
+                       gscan_hotlist_cache->next = gscan_params->gscan_hotlist_found;
+                       gscan_params->gscan_hotlist_found = gscan_hotlist_cache;
+                       DHD_PNO(("%s enter, FOUND results count %d\n", __FUNCTION__, fwcount));
+               } else {
+                       gscan_hotlist_cache->next = gscan_params->gscan_hotlist_lost;
+                       gscan_params->gscan_hotlist_lost = gscan_hotlist_cache;
+                       DHD_PNO(("%s enter, LOST results count %d\n", __FUNCTION__, fwcount));
+               }
+
+               gscan_hotlist_cache->tot_count = fwcount;
+               gscan_hotlist_cache->tot_consumed = 0;
+
+               for (i = 0; i < fwcount; i++, pnetinfo++) {
+                       hotlist_found_array = &gscan_hotlist_cache->results[i];
+                       memset(hotlist_found_array, 0, sizeof(wifi_gscan_result_t));
+                       hotlist_found_array->channel = wf_channel2mhz(pnetinfo->pfnsubnet.channel,
+                               (pnetinfo->pfnsubnet.channel <= CH_MAX_2G_CHANNEL?
+                               WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G));
+                       hotlist_found_array->rssi = (int32) pnetinfo->RSSI;
+
+                       hotlist_found_array->ts =
+                               convert_fw_rel_time_to_systime(&tm_spec,
+                                       (pnetinfo->timestamp * 1000));
+                       if (pnetinfo->pfnsubnet.SSID_len > DOT11_MAX_SSID_LEN) {
+                               DHD_ERROR(("Invalid SSID length %d: trimming it to max\n",
+                                       pnetinfo->pfnsubnet.SSID_len));
+                               pnetinfo->pfnsubnet.SSID_len = DOT11_MAX_SSID_LEN;
+                       }
+                       memcpy(hotlist_found_array->ssid, pnetinfo->pfnsubnet.SSID,
+                               pnetinfo->pfnsubnet.SSID_len);
+                       hotlist_found_array->ssid[pnetinfo->pfnsubnet.SSID_len] = '\0';
+
+                       memcpy(&hotlist_found_array->macaddr, &pnetinfo->pfnsubnet.BSSID,
+                               ETHER_ADDR_LEN);
+                       DHD_PNO(("\t%s "MACDBG" rssi %d\n",
+                               hotlist_found_array->ssid,
+                               MAC2STRDBG(hotlist_found_array->macaddr.octet),
+                               hotlist_found_array->rssi));
+               }
+       } else if (results_v2->version == PFN_SCANRESULTS_VERSION_V2) {
+               fwstatus = results_v2->status;
+               fwcount = results_v2->count;
+               pnetinfo_v2 = (wl_pfn_net_info_v2_t*)&results_v2->netinfo[0];
+
+               gscan_params = &(_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS].params_gscan);
+
+               if (!fwcount || (fwcount > EVENT_MAX_NETCNT_V2)) {
+                       DHD_ERROR(("%s: wrong v2 fwcount:%d\n", __FUNCTION__, fwcount));
+                       *send_evt_bytes = 0;
+                       return ptr;
+               }
+
+               osl_get_monotonic_boottime(&tm_spec);
+               malloc_size = sizeof(gscan_results_cache_t) +
+                       ((fwcount - 1) * sizeof(wifi_gscan_result_t));
+               gscan_hotlist_cache =
+                       (gscan_results_cache_t *)MALLOC(dhd->osh, malloc_size);
+               if (!gscan_hotlist_cache) {
+                       DHD_ERROR(("%s Cannot Malloc %d bytes!!\n", __FUNCTION__, malloc_size));
+                       *send_evt_bytes = 0;
+                       return ptr;
+               }
+               *buf_len = malloc_size;
+               if (type == HOTLIST_FOUND) {
+                       gscan_hotlist_cache->next = gscan_params->gscan_hotlist_found;
+                       gscan_params->gscan_hotlist_found = gscan_hotlist_cache;
+                       DHD_PNO(("%s enter, FOUND results count %d\n", __FUNCTION__, fwcount));
+               } else {
+                       gscan_hotlist_cache->next = gscan_params->gscan_hotlist_lost;
+                       gscan_params->gscan_hotlist_lost = gscan_hotlist_cache;
+                       DHD_PNO(("%s enter, LOST results count %d\n", __FUNCTION__, fwcount));
+               }
+
+               gscan_hotlist_cache->tot_count = fwcount;
+               gscan_hotlist_cache->tot_consumed = 0;
+               gscan_hotlist_cache->scan_ch_bucket = results_v2->scan_ch_bucket;
+
+               for (i = 0; i < fwcount; i++, pnetinfo_v2++) {
+                       hotlist_found_array = &gscan_hotlist_cache->results[i];
+                       memset(hotlist_found_array, 0, sizeof(wifi_gscan_result_t));
+                       hotlist_found_array->channel =
+                               wf_channel2mhz(pnetinfo_v2->pfnsubnet.channel,
+                               (pnetinfo_v2->pfnsubnet.channel <= CH_MAX_2G_CHANNEL?
+                               WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G));
+                       hotlist_found_array->rssi = (int32) pnetinfo_v2->RSSI;
+
+                       hotlist_found_array->ts =
+                               convert_fw_rel_time_to_systime(&tm_spec,
+                               (pnetinfo_v2->timestamp * 1000));
+                       if (pnetinfo_v2->pfnsubnet.SSID_len > DOT11_MAX_SSID_LEN) {
+                               DHD_ERROR(("Invalid SSID length %d: trimming it to max\n",
+                                       pnetinfo_v2->pfnsubnet.SSID_len));
+                               pnetinfo_v2->pfnsubnet.SSID_len = DOT11_MAX_SSID_LEN;
+                       }
+                       memcpy(hotlist_found_array->ssid, pnetinfo_v2->pfnsubnet.u.SSID,
+                               pnetinfo_v2->pfnsubnet.SSID_len);
+                       hotlist_found_array->ssid[pnetinfo_v2->pfnsubnet.SSID_len] = '\0';
+
+                       memcpy(&hotlist_found_array->macaddr, &pnetinfo_v2->pfnsubnet.BSSID,
+                               ETHER_ADDR_LEN);
+                       DHD_PNO(("\t%s "MACDBG" rssi %d\n",
+                               hotlist_found_array->ssid,
+                               MAC2STRDBG(hotlist_found_array->macaddr.octet),
+                               hotlist_found_array->rssi));
+               }
+       } else {
+               DHD_ERROR(("%s: event version %d not supported\n",
+                       __FUNCTION__, results_v1->version));
+               *send_evt_bytes = 0;
+               return ptr;
+       }
+       if (fwstatus == PFN_COMPLETE) {
+               ptr = (void *) gscan_hotlist_cache;
+               while (gscan_hotlist_cache) {
+                       total += gscan_hotlist_cache->tot_count;
+                       gscan_hotlist_cache = gscan_hotlist_cache->next;
+               }
+               *send_evt_bytes =  total * sizeof(wifi_gscan_result_t);
+       }
+
+       return ptr;
+}
+#endif /* GSCAN_SUPPORT */
+
+int
+dhd_pno_event_handler(dhd_pub_t *dhd, wl_event_msg_t *event, void *event_data)
+{
+       int err = BCME_OK;
+       uint event_type;
+       dhd_pno_status_info_t *_pno_state;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+       event_type = ntoh32(event->event_type);
+       DHD_PNO(("%s enter : event_type :%d\n", __FUNCTION__, event_type));
+       switch (event_type) {
+       case WLC_E_PFN_BSSID_NET_FOUND:
+       case WLC_E_PFN_BSSID_NET_LOST:
+               /* how can we inform this to framework ? */
+               /* TODO : need to implement event logic using generic netlink */
+               break;
+       case WLC_E_PFN_BEST_BATCHING:
+#ifndef GSCAN_SUPPORT
+       {
+               struct dhd_pno_batch_params *params_batch;
+               params_batch = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS].params_batch;
+               if (!waitqueue_active(&_pno_state->get_batch_done.wait)) {
+                       DHD_PNO(("%s : WLC_E_PFN_BEST_BATCHING\n", __FUNCTION__));
+                       params_batch->get_batch.buf = NULL;
+                       params_batch->get_batch.bufsize = 0;
+                       params_batch->get_batch.reason = PNO_STATUS_EVENT;
+                       schedule_work(&_pno_state->work);
+               } else
+                       DHD_PNO(("%s : WLC_E_PFN_BEST_BATCHING"
+                               "will skip this event\n", __FUNCTION__));
+               break;
+       }
+#else
+               break;
+#endif /* !GSCAN_SUPPORT */
+       default:
+               DHD_ERROR(("unknown event : %d\n", event_type));
+       }
+exit:
+       return err;
+}
+
+int dhd_pno_init(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       dhd_pno_status_info_t *_pno_state;
+       char *buf = NULL;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       UNUSED_PARAMETER(_dhd_pno_suspend);
+       if (dhd->pno_state)
+               goto exit;
+       dhd->pno_state = MALLOC(dhd->osh, sizeof(dhd_pno_status_info_t));
+       NULL_CHECK(dhd->pno_state, "failed to create dhd_pno_state", err);
+       memset(dhd->pno_state, 0, sizeof(dhd_pno_status_info_t));
+       /* need to check whether current firmware support batching and hotlist scan */
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       _pno_state->wls_supported = TRUE;
+       _pno_state->dhd = dhd;
+       mutex_init(&_pno_state->pno_mutex);
+       INIT_WORK(&_pno_state->work, _dhd_pno_get_batch_handler);
+       init_completion(&_pno_state->get_batch_done);
+#ifdef GSCAN_SUPPORT
+       init_waitqueue_head(&_pno_state->batch_get_wait);
+#endif /* GSCAN_SUPPORT */
+       buf = MALLOC(dhd->osh, WLC_IOCTL_SMLEN);
+       if (!buf) {
+               DHD_ERROR((":%s buf alloc err.\n", __FUNCTION__));
+               return BCME_NOMEM;
+       }
+       err = dhd_iovar(dhd, 0, "pfnlbest", NULL, 0, buf, WLC_IOCTL_SMLEN,
+                       FALSE);
+       if (err == BCME_UNSUPPORTED) {
+               _pno_state->wls_supported = FALSE;
+               DHD_ERROR(("Android Location Service, UNSUPPORTED\n"));
+               DHD_INFO(("Current firmware doesn't support"
+                       " Android Location Service\n"));
+       } else {
+               DHD_ERROR(("%s: Support Android Location Service\n",
+                       __FUNCTION__));
+       }
+exit:
+       MFREE(dhd->osh, buf, WLC_IOCTL_SMLEN);
+       return err;
+}
+
+int dhd_pno_deinit(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pno_params_t *_params;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       NULL_CHECK(_pno_state, "pno_state is NULL", err);
+       /* may need to free legacy ssid_list */
+       if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+               _params = &_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS];
+               _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_LEGACY_MODE);
+       }
+
+#ifdef GSCAN_SUPPORT
+       if (_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) {
+               _params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+               mutex_lock(&_pno_state->pno_mutex);
+               dhd_pno_reset_cfg_gscan(dhd, _params, _pno_state, GSCAN_FLUSH_ALL_CFG);
+               mutex_unlock(&_pno_state->pno_mutex);
+       }
+#endif /* GSCAN_SUPPORT */
+
+       if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+               _params = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS];
+               /* clear resource if the BATCH MODE is on */
+               _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_BATCH_MODE);
+       }
+       cancel_work_sync(&_pno_state->work);
+       MFREE(dhd->osh, _pno_state, sizeof(dhd_pno_status_info_t));
+       dhd->pno_state = NULL;
+       return err;
+}
+
+#endif /* PNO_SUPPORT */
diff --git a/bcmdhd.101.10.240.x/dhd_pno.h b/bcmdhd.101.10.240.x/dhd_pno.h
new file mode 100644 (file)
index 0000000..dfeffab
--- /dev/null
@@ -0,0 +1,578 @@
+/*
+ * Header file of Broadcom Dongle Host Driver (DHD)
+ * Prefered Network Offload code and Wi-Fi Location Service(WLS) code.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef __DHD_PNO_H__
+#define __DHD_PNO_H__
+
+#if defined(PNO_SUPPORT)
+#define PNO_TLV_PREFIX                 'S'
+#define PNO_TLV_VERSION                        '1'
+#define PNO_TLV_SUBTYPE_LEGACY_PNO '2'
+#define PNO_TLV_RESERVED               '0'
+
+#define PNO_BATCHING_SET "SET"
+#define PNO_BATCHING_GET "GET"
+#define PNO_BATCHING_STOP "STOP"
+
+#define PNO_PARAMS_DELIMETER " "
+#define PNO_PARAM_CHANNEL_DELIMETER ","
+#define PNO_PARAM_VALUE_DELLIMETER '='
+#define PNO_PARAM_SCANFREQ "SCANFREQ"
+#define PNO_PARAM_BESTN        "BESTN"
+#define PNO_PARAM_MSCAN "MSCAN"
+#define PNO_PARAM_CHANNEL "CHANNEL"
+#define PNO_PARAM_RTT "RTT"
+
+#define PNO_TLV_TYPE_SSID_IE           'S'
+#define PNO_TLV_TYPE_TIME              'T'
+#define PNO_TLV_FREQ_REPEAT            'R'
+#define PNO_TLV_FREQ_EXPO_MAX          'M'
+
+#define MAXNUM_SSID_PER_ADD    16
+#define MAXNUM_PNO_PARAMS 2
+#define PNO_TLV_COMMON_LENGTH  1
+#define DEFAULT_BATCH_MSCAN 16
+
+#define RESULTS_END_MARKER "----\n"
+#define SCAN_END_MARKER "####\n"
+#define AP_END_MARKER "====\n"
+#define PNO_RSSI_MARGIN_DBM          30
+
+#define CSCAN_COMMAND                  "CSCAN "
+#define CSCAN_TLV_PREFIX               'S'
+#define CSCAN_TLV_VERSION              1
+#define CSCAN_TLV_SUBVERSION           0
+#define CSCAN_TLV_TYPE_SSID_IE         'S'
+#define CSCAN_TLV_TYPE_CHANNEL_IE      'C'
+#define CSCAN_TLV_TYPE_NPROBE_IE       'N'
+#define CSCAN_TLV_TYPE_ACTIVE_IE       'A'
+#define CSCAN_TLV_TYPE_PASSIVE_IE      'P'
+#define CSCAN_TLV_TYPE_HOME_IE         'H'
+#define CSCAN_TLV_TYPE_STYPE_IE                'T'
+
+#define WL_SCAN_PARAMS_SSID_MAX         10
+#define GET_SSID                        "SSID="
+#define GET_CHANNEL                     "CH="
+#define GET_NPROBE                      "NPROBE="
+#define GET_ACTIVE_ASSOC_DWELL          "ACTIVE="
+#define GET_PASSIVE_ASSOC_DWELL         "PASSIVE="
+#define GET_HOME_DWELL                  "HOME="
+#define GET_SCAN_TYPE                   "TYPE="
+
+#if defined(GSCAN_SUPPORT) || defined(DHD_GET_VALID_CHANNELS)
+#define GSCAN_MAX_CH_BUCKETS             8
+#define GSCAN_MAX_CHANNELS_IN_BUCKET     32
+#define GSCAN_MAX_AP_CACHE_PER_SCAN      32
+#define GSCAN_MAX_AP_CACHE               320
+#define GSCAN_BG_BAND_MASK             (1 << 0)
+#define GSCAN_A_BAND_MASK              (1 << 1)
+#define GSCAN_DFS_MASK                 (1 << 2)
+#define GSCAN_ABG_BAND_MASK            (GSCAN_A_BAND_MASK | GSCAN_BG_BAND_MASK)
+#define GSCAN_BAND_MASK                (GSCAN_ABG_BAND_MASK | GSCAN_DFS_MASK)
+
+#define GSCAN_FLUSH_HOTLIST_CFG      (1 << 0)
+#define GSCAN_FLUSH_SIGNIFICANT_CFG  (1 << 1)
+#define GSCAN_FLUSH_SCAN_CFG         (1 << 2)
+#define GSCAN_FLUSH_EPNO_CFG         (1 << 3)
+#define GSCAN_FLUSH_ALL_CFG     (GSCAN_FLUSH_SCAN_CFG | \
+                                                               GSCAN_FLUSH_SIGNIFICANT_CFG | \
+                                                               GSCAN_FLUSH_HOTLIST_CFG  | \
+                                                               GSCAN_FLUSH_EPNO_CFG)
+#define DHD_EPNO_HIDDEN_SSID          (1 << 0)
+#define DHD_EPNO_A_BAND_TRIG          (1 << 1)
+#define DHD_EPNO_BG_BAND_TRIG         (1 << 2)
+#define DHD_EPNO_STRICT_MATCH         (1 << 3)
+#define DHD_EPNO_SAME_NETWORK         (1 << 4)
+#define DHD_PNO_USE_SSID              (DHD_EPNO_HIDDEN_SSID | DHD_EPNO_STRICT_MATCH)
+
+/* Do not change GSCAN_BATCH_RETRIEVAL_COMPLETE */
+#define GSCAN_BATCH_RETRIEVAL_COMPLETE      0
+#define GSCAN_BATCH_RETRIEVAL_IN_PROGRESS   1
+#define GSCAN_BATCH_NO_THR_SET              101
+#define GSCAN_LOST_AP_WINDOW_DEFAULT        4
+#define GSCAN_MIN_BSSID_TIMEOUT             90
+#define GSCAN_BATCH_GET_MAX_WAIT            500
+#define CHANNEL_BUCKET_EMPTY_INDEX                      0xFFFF
+#define GSCAN_RETRY_THRESHOLD              3
+
+#define MAX_EPNO_SSID_NUM                   64
+#endif /* GSCAN_SUPPORT || DHD_GET_VALID_CHANNELS */
+
+enum scan_status {
+       /* SCAN ABORT by other scan */
+       PNO_STATUS_ABORT,
+       /* RTT is presence or not */
+       PNO_STATUS_RTT_PRESENCE,
+       /* Disable PNO by Driver */
+       PNO_STATUS_DISABLE,
+       /* NORMAL BATCHING GET */
+       PNO_STATUS_NORMAL,
+       /* WLC_E_PFN_BEST_BATCHING */
+       PNO_STATUS_EVENT,
+       PNO_STATUS_MAX
+};
+#define PNO_STATUS_ABORT_MASK 0x0001
+#define PNO_STATUS_RTT_MASK 0x0002
+#define PNO_STATUS_DISABLE_MASK 0x0004
+#define PNO_STATUS_OOM_MASK 0x0010
+
+enum index_mode {
+       INDEX_OF_LEGACY_PARAMS,
+       INDEX_OF_BATCH_PARAMS,
+       INDEX_OF_HOTLIST_PARAMS,
+       /* GSCAN includes hotlist scan and they do not run
+        * independent of each other
+        */
+       INDEX_OF_GSCAN_PARAMS = INDEX_OF_HOTLIST_PARAMS,
+       INDEX_MODE_MAX
+};
+enum dhd_pno_status {
+       DHD_PNO_DISABLED,
+       DHD_PNO_ENABLED,
+       DHD_PNO_SUSPEND
+};
+typedef struct cmd_tlv {
+       char prefix;
+       char version;
+       char subtype;
+       char reserved;
+} cmd_tlv_t;
+#if defined(GSCAN_SUPPORT) || defined(DHD_GET_VALID_CHANNELS)
+typedef enum {
+    WIFI_BAND_UNSPECIFIED,
+    WIFI_BAND_BG = 1,                       /* 2.4 GHz                   */
+    WIFI_BAND_A = 2,                        /* 5 GHz without DFS         */
+    WIFI_BAND_A_DFS = 4,                    /* 5 GHz DFS only            */
+    WIFI_BAND_A_WITH_DFS = 6,               /* 5 GHz with DFS            */
+    WIFI_BAND_ABG = 3,                      /* 2.4 GHz + 5 GHz; no DFS   */
+    WIFI_BAND_ABG_WITH_DFS = 7,             /* 2.4 GHz + 5 GHz with DFS  */
+} gscan_wifi_band_t;
+
+typedef enum {
+       HOTLIST_LOST,
+       HOTLIST_FOUND
+} hotlist_type_t;
+
+typedef enum dhd_pno_gscan_cmd_cfg {
+       DHD_PNO_BATCH_SCAN_CFG_ID = 0,
+       DHD_PNO_GEOFENCE_SCAN_CFG_ID,
+       DHD_PNO_SIGNIFICANT_SCAN_CFG_ID,
+       DHD_PNO_SCAN_CFG_ID,
+       DHD_PNO_GET_CAPABILITIES,
+       DHD_PNO_GET_BATCH_RESULTS,
+       DHD_PNO_GET_CHANNEL_LIST,
+       DHD_PNO_GET_NEW_EPNO_SSID_ELEM,
+       DHD_PNO_EPNO_CFG_ID,
+       DHD_PNO_GET_AUTOJOIN_CAPABILITIES,
+       DHD_PNO_EPNO_PARAMS_ID
+} dhd_pno_gscan_cmd_cfg_t;
+
+typedef enum dhd_pno_mode {
+       /* Wi-Fi Legacy PNO Mode */
+       DHD_PNO_NONE_MODE   = 0,
+       DHD_PNO_LEGACY_MODE = (1 << (0)),
+       /* Wi-Fi Android BATCH SCAN Mode */
+       DHD_PNO_BATCH_MODE = (1 << (1)),
+       /* Wi-Fi Android Hotlist SCAN Mode */
+       DHD_PNO_HOTLIST_MODE = (1 << (2)),
+       /* Wi-Fi Google Android SCAN Mode */
+       DHD_PNO_GSCAN_MODE = (1 << (3))
+} dhd_pno_mode_t;
+#else
+typedef enum dhd_pno_mode {
+       /* Wi-Fi Legacy PNO Mode */
+       DHD_PNO_NONE_MODE   = 0,
+       DHD_PNO_LEGACY_MODE = (1 << (0)),
+       /* Wi-Fi Android BATCH SCAN Mode */
+       DHD_PNO_BATCH_MODE = (1 << (1)),
+       /* Wi-Fi Android Hotlist SCAN Mode */
+       DHD_PNO_HOTLIST_MODE = (1 << (2))
+} dhd_pno_mode_t;
+#endif /* GSCAN_SUPPORT || DHD_GET_VALID_CHANNELS */
+
+typedef struct dhd_pno_ssid {
+       bool            hidden;
+       int8            rssi_thresh;
+       uint8           dummy;
+       uint16          SSID_len;
+       uint32          flags;
+       int32           wpa_auth;
+       uchar           SSID[DOT11_MAX_SSID_LEN];
+       struct list_head list;
+} dhd_pno_ssid_t;
+
+struct dhd_pno_bssid {
+       struct ether_addr       macaddr;
+       /* Bit4: suppress_lost, Bit3: suppress_found */
+       uint16                  flags;
+       struct list_head list;
+};
+
+typedef struct dhd_pno_bestnet_entry {
+       struct ether_addr BSSID;
+       uint8   SSID_len;
+       uint8   SSID[DOT11_MAX_SSID_LEN];
+       int8    RSSI;
+       uint8   channel;
+       uint32  timestamp;
+       uint16  rtt0; /* distance_cm based on RTT */
+       uint16  rtt1; /* distance_cm based on sample standard deviation */
+       unsigned long recorded_time;
+       struct list_head list;
+} dhd_pno_bestnet_entry_t;
+#define BESTNET_ENTRY_SIZE (sizeof(dhd_pno_bestnet_entry_t))
+
+typedef struct dhd_pno_bestnet_header {
+       struct dhd_pno_bestnet_header *next;
+       uint8 reason;
+       uint32 tot_cnt;
+       uint32 tot_size;
+       struct list_head entry_list;
+} dhd_pno_best_header_t;
+#define BEST_HEADER_SIZE (sizeof(dhd_pno_best_header_t))
+
+typedef struct dhd_pno_scan_results {
+       dhd_pno_best_header_t *bestnetheader;
+       uint8 cnt_header;
+       struct list_head list;
+} dhd_pno_scan_results_t;
+#define SCAN_RESULTS_SIZE (sizeof(dhd_pno_scan_results_t))
+
+struct dhd_pno_get_batch_info {
+       /* info related to get batch */
+       char *buf;
+       bool batch_started;
+       uint32 tot_scan_cnt;
+       uint32 expired_tot_scan_cnt;
+       uint32 top_node_cnt;
+       uint32 bufsize;
+       uint32 bytes_written;
+       int reason;
+       struct list_head scan_results_list;
+       struct list_head expired_scan_results_list;
+};
+struct dhd_pno_legacy_params {
+       uint16 scan_fr;
+       uint16 chan_list[WL_NUMCHANNELS];
+       uint16 nchan;
+       int pno_repeat;
+       int pno_freq_expo_max;
+       int nssid;
+       struct list_head ssid_list;
+};
+struct dhd_pno_batch_params {
+       int32 scan_fr;
+       uint8 bestn;
+       uint8 mscan;
+       uint8 band;
+       uint16 chan_list[WL_NUMCHANNELS];
+       uint16 nchan;
+       uint16 rtt;
+       struct dhd_pno_get_batch_info get_batch;
+};
+struct dhd_pno_hotlist_params {
+       uint8 band;
+       int32 scan_fr;
+       uint16 chan_list[WL_NUMCHANNELS];
+       uint16 nchan;
+       uint16 nbssid;
+       struct list_head bssid_list;
+};
+#if defined(GSCAN_SUPPORT) || defined(DHD_GET_VALID_CHANNELS)
+#define DHD_PNO_REPORT_NO_BATCH      (1 << 2)
+
+typedef struct dhd_pno_gscan_channel_bucket {
+       uint16 bucket_freq_multiple;
+       /* band = 1 All bg band channels,
+        * band = 2 All a band channels,
+        * band = 0 chan_list channels
+        */
+       uint16 band;
+       uint8 report_flag;
+       uint8 num_channels;
+       uint16 repeat;
+       uint16 bucket_max_multiple;
+       uint16 chan_list[GSCAN_MAX_CHANNELS_IN_BUCKET];
+} dhd_pno_gscan_channel_bucket_t;
+
+#define DHD_PNO_AUTH_CODE_OPEN  1 /*  Open   */
+#define DHD_PNO_AUTH_CODE_PSK   2 /* WPA_PSK or WPA2PSK */
+#define DHD_PNO_AUTH_CODE_EAPOL 4 /* any EAPOL    */
+
+#define DHD_EPNO_DEFAULT_INDEX     0xFFFFFFFF
+
+typedef struct dhd_epno_params {
+       uint8 ssid[DOT11_MAX_SSID_LEN];
+       uint8 ssid_len;
+       int8 rssi_thresh;
+       uint8 flags;
+       uint8 auth;
+       /* index required only for visble ssid */
+       uint32 index;
+       struct list_head list;
+} dhd_epno_params_t;
+
+typedef struct dhd_epno_results {
+       uint8 ssid[DOT11_MAX_SSID_LEN];
+       uint8 ssid_len;
+       int8 rssi;
+       uint16 channel;
+       uint16 flags;
+       struct ether_addr bssid;
+} dhd_epno_results_t;
+
+typedef struct dhd_pno_swc_evt_param {
+       uint16 results_rxed_so_far;
+       wl_pfn_significant_net_t *change_array;
+} dhd_pno_swc_evt_param_t;
+
+typedef struct wifi_gscan_result {
+       uint64 ts;                      /* Time of discovery           */
+       char ssid[DOT11_MAX_SSID_LEN+1]; /* null terminated             */
+       struct ether_addr macaddr;      /* BSSID                      */
+       uint32 channel;                 /* channel frequency in MHz    */
+       int32 rssi;                     /* in db                       */
+       uint64 rtt;                     /* in nanoseconds              */
+       uint64 rtt_sd;                  /* standard deviation in rtt   */
+       uint16 beacon_period;           /* units are Kusec             */
+       uint16 capability;              /* Capability information       */
+       uint32 pad;
+} wifi_gscan_result_t;
+
+typedef struct wifi_gscan_full_result {
+    wifi_gscan_result_t fixed;
+    uint32 scan_ch_bucket;
+    uint32 ie_length;          /* byte length of Information Elements */
+    char  ie_data[1];          /* IE  data to follow       */
+} wifi_gscan_full_result_t;
+
+typedef struct gscan_results_cache {
+       struct gscan_results_cache *next;
+       uint8  scan_id;
+       uint8  flag;
+       uint8  tot_count;
+       uint8  tot_consumed;
+       uint32 scan_ch_bucket;
+       wifi_gscan_result_t results[1];
+} gscan_results_cache_t;
+
+typedef struct dhd_pno_gscan_capabilities {
+       int max_scan_cache_size;
+       int max_scan_buckets;
+       int max_ap_cache_per_scan;
+       int max_rssi_sample_size;
+       int max_scan_reporting_threshold;
+       int max_hotlist_bssids;
+       int max_hotlist_ssids;
+       int max_significant_wifi_change_aps;
+       int max_bssid_history_entries;
+       int max_epno_ssid_crc32;
+       int max_epno_hidden_ssid;
+       int max_white_list_ssid;
+} dhd_pno_gscan_capabilities_t;
+
+typedef struct dhd_epno_ssid_cfg {
+       wl_ssid_ext_params_t params;
+       uint32 num_epno_ssid;
+       struct list_head epno_ssid_list;
+} dhd_epno_ssid_cfg_t;
+
+struct dhd_pno_gscan_params {
+       int32 scan_fr;
+       uint8 bestn;
+       uint8 mscan;
+       uint8 buffer_threshold;
+       uint8 swc_nbssid_threshold;
+       uint8 swc_rssi_window_size;
+       uint8 lost_ap_window;
+       uint8 nchannel_buckets;
+       uint8 reason;
+       uint8 get_batch_flag;
+       uint8 send_all_results_flag;
+       uint16 max_ch_bucket_freq;
+       gscan_results_cache_t *gscan_batch_cache;
+       gscan_results_cache_t *gscan_hotlist_found;
+       gscan_results_cache_t*gscan_hotlist_lost;
+       uint16 nbssid_significant_change;
+       uint16 nbssid_hotlist;
+       struct dhd_pno_swc_evt_param param_significant;
+       struct dhd_pno_gscan_channel_bucket channel_bucket[GSCAN_MAX_CH_BUCKETS];
+       struct list_head hotlist_bssid_list;
+       struct list_head significant_bssid_list;
+       dhd_epno_ssid_cfg_t epno_cfg;
+       uint32 scan_id;
+};
+
+typedef struct gscan_scan_params {
+       int32 scan_fr;
+       uint16 nchannel_buckets;
+       struct dhd_pno_gscan_channel_bucket channel_bucket[GSCAN_MAX_CH_BUCKETS];
+} gscan_scan_params_t;
+
+typedef struct gscan_batch_params {
+       uint8 bestn;
+       uint8 mscan;
+       uint8 buffer_threshold;
+} gscan_batch_params_t;
+
+struct bssid_t {
+       struct ether_addr       macaddr;
+       int16 rssi_reporting_threshold;  /* 0 -> no reporting threshold */
+};
+
+typedef struct gscan_hotlist_scan_params {
+       uint16 lost_ap_window; /* number of scans to declare LOST */
+       uint16 nbssid;   /* number of bssids  */
+       struct bssid_t bssid[1];  /* n bssids to follow */
+} gscan_hotlist_scan_params_t;
+
+#endif /* GSCAN_SUPPORT || DHD_GET_VALID_CHANNELS */
+
+typedef union dhd_pno_params {
+       struct dhd_pno_legacy_params params_legacy;
+       struct dhd_pno_batch_params params_batch;
+       struct dhd_pno_hotlist_params params_hotlist;
+#if defined(GSCAN_SUPPORT) || defined(DHD_GET_VALID_CHANNELS)
+       struct dhd_pno_gscan_params params_gscan;
+#endif /* GSCAN_SUPPORT || DHD_GET_VALID_CHANNELS */
+} dhd_pno_params_t;
+
+typedef struct dhd_pno_status_info {
+       dhd_pub_t *dhd;
+       struct work_struct work;
+       struct mutex pno_mutex;
+#ifdef GSCAN_SUPPORT
+       wait_queue_head_t batch_get_wait;
+#endif /* GSCAN_SUPPORT */
+       struct completion get_batch_done;
+       bool wls_supported; /* wifi location service supported or not */
+       enum dhd_pno_status pno_status;
+       enum dhd_pno_mode pno_mode;
+       dhd_pno_params_t pno_params_arr[INDEX_MODE_MAX];
+       struct list_head head_list;
+} dhd_pno_status_info_t;
+
+/* wrapper functions */
+extern int
+dhd_dev_pno_enable(struct net_device *dev, int enable);
+
+extern int
+dhd_dev_pno_stop_for_ssid(struct net_device *dev);
+
+extern int
+dhd_dev_pno_set_for_ssid(struct net_device *dev, wlc_ssid_ext_t* ssids_local, int nssid,
+       uint16 scan_fr, int pno_repeat, int pno_freq_expo_max, uint16 *channel_list, int nchan);
+
+extern int
+dhd_dev_pno_set_for_batch(struct net_device *dev,
+       struct dhd_pno_batch_params *batch_params);
+
+extern int
+dhd_dev_pno_get_for_batch(struct net_device *dev, char *buf, int bufsize);
+
+extern int
+dhd_dev_pno_stop_for_batch(struct net_device *dev);
+
+extern int
+dhd_dev_pno_set_for_hotlist(struct net_device *dev, wl_pfn_bssid_t *p_pfn_bssid,
+       struct dhd_pno_hotlist_params *hotlist_params);
+extern bool dhd_dev_is_legacy_pno_enabled(struct net_device *dev);
+#if defined(GSCAN_SUPPORT) || defined(DHD_GET_VALID_CHANNELS)
+extern void *
+dhd_dev_pno_get_gscan(struct net_device *dev, dhd_pno_gscan_cmd_cfg_t type, void *info,
+        uint32 *len);
+#endif /* GSCAN_SUPPORT || DHD_GET_VALID_CHANNELS */
+#ifdef GSCAN_SUPPORT
+extern int
+dhd_dev_pno_set_cfg_gscan(struct net_device *dev, dhd_pno_gscan_cmd_cfg_t type,
+              void *buf, bool flush);
+int dhd_dev_pno_lock_access_batch_results(struct net_device *dev);
+void dhd_dev_pno_unlock_access_batch_results(struct net_device *dev);
+extern int dhd_dev_pno_run_gscan(struct net_device *dev, bool run, bool flush);
+extern int dhd_dev_pno_enable_full_scan_result(struct net_device *dev, bool real_time);
+int dhd_retreive_batch_scan_results(dhd_pub_t *dhd);
+extern void * dhd_dev_hotlist_scan_event(struct net_device *dev,
+            const void  *data, int *send_evt_bytes, hotlist_type_t type, u32 *buf_len);
+void * dhd_dev_process_full_gscan_result(struct net_device *dev,
+            const void  *data, uint32 len, int *send_evt_bytes);
+extern int dhd_dev_gscan_batch_cache_cleanup(struct net_device *dev);
+extern void dhd_dev_gscan_hotlist_cache_cleanup(struct net_device *dev, hotlist_type_t type);
+extern int dhd_dev_wait_batch_results_complete(struct net_device *dev);
+extern void * dhd_dev_process_epno_result(struct net_device *dev,
+               const void  *data, uint32 event, int *send_evt_bytes);
+extern int dhd_dev_set_epno(struct net_device *dev);
+extern int dhd_dev_flush_fw_epno(struct net_device *dev);
+#endif /* GSCAN_SUPPORT */
+/* dhd pno fuctions */
+extern int dhd_pno_stop_for_ssid(dhd_pub_t *dhd);
+extern int dhd_pno_enable(dhd_pub_t *dhd, int enable);
+extern int dhd_pno_set_for_ssid(dhd_pub_t *dhd, wlc_ssid_ext_t* ssid_list, int nssid,
+       uint16  scan_fr, int pno_repeat, int pno_freq_expo_max, uint16 *channel_list, int nchan);
+
+extern int dhd_pno_set_for_batch(dhd_pub_t *dhd, struct dhd_pno_batch_params *batch_params);
+
+extern int dhd_pno_get_for_batch(dhd_pub_t *dhd, char *buf, int bufsize, int reason);
+
+extern int dhd_pno_stop_for_batch(dhd_pub_t *dhd);
+
+extern int dhd_pno_set_for_hotlist(dhd_pub_t *dhd, wl_pfn_bssid_t *p_pfn_bssid,
+       struct dhd_pno_hotlist_params *hotlist_params);
+
+extern int dhd_pno_stop_for_hotlist(dhd_pub_t *dhd);
+
+extern int dhd_pno_event_handler(dhd_pub_t *dhd, wl_event_msg_t *event, void *event_data);
+extern int dhd_pno_init(dhd_pub_t *dhd);
+extern int dhd_pno_deinit(dhd_pub_t *dhd);
+extern bool dhd_is_pno_supported(dhd_pub_t *dhd);
+extern bool dhd_is_legacy_pno_enabled(dhd_pub_t *dhd);
+#if defined(GSCAN_SUPPORT) || defined(DHD_GET_VALID_CHANNELS)
+extern void * dhd_pno_get_gscan(dhd_pub_t *dhd, dhd_pno_gscan_cmd_cfg_t type, void *info,
+                       uint32 *len);
+#endif /* GSCAN_SUPPORT || DHD_GET_VALID_CHANNELS */
+#ifdef GSCAN_SUPPORT
+extern int dhd_pno_set_cfg_gscan(dhd_pub_t *dhd, dhd_pno_gscan_cmd_cfg_t type,
+                       void *buf, bool flush);
+extern int dhd_pno_lock_batch_results(dhd_pub_t *dhd);
+extern void dhd_pno_unlock_batch_results(dhd_pub_t *dhd);
+extern int dhd_pno_initiate_gscan_request(dhd_pub_t *dhd, bool run, bool flush);
+extern int dhd_pno_enable_full_scan_result(dhd_pub_t *dhd, bool real_time_flag);
+extern int dhd_pno_cfg_gscan(dhd_pub_t *dhd, dhd_pno_gscan_cmd_cfg_t type, void *buf);
+extern int dhd_dev_retrieve_batch_scan(struct net_device *dev);
+extern void *dhd_handle_hotlist_scan_evt(dhd_pub_t *dhd, const void *event_data,
+                       int *send_evt_bytes, hotlist_type_t type, u32 *buf_len);
+extern void *dhd_process_full_gscan_result(dhd_pub_t *dhd, const void *event_data,
+                       uint32 len, int *send_evt_bytes);
+extern int dhd_gscan_batch_cache_cleanup(dhd_pub_t *dhd);
+extern void dhd_gscan_hotlist_cache_cleanup(dhd_pub_t *dhd, hotlist_type_t type);
+extern int dhd_wait_batch_results_complete(dhd_pub_t *dhd);
+extern void * dhd_pno_process_epno_result(dhd_pub_t *dhd, const void *data,
+         uint32 event, int *size);
+extern void dhd_pno_translate_epno_fw_flags(uint32 *flags);
+extern int dhd_pno_set_epno(dhd_pub_t *dhd);
+extern int dhd_pno_flush_fw_epno(dhd_pub_t *dhd);
+extern void dhd_pno_set_epno_auth_flag(uint32 *wpa_auth);
+#endif /* GSCAN_SUPPORT */
+#endif
+
+#endif /* __DHD_PNO_H__ */
diff --git a/bcmdhd.101.10.240.x/dhd_proto.h b/bcmdhd.101.10.240.x/dhd_proto.h
new file mode 100644 (file)
index 0000000..109ae02
--- /dev/null
@@ -0,0 +1,230 @@
+/*
+ * Header file describing the internal (inter-module) DHD interfaces.
+ *
+ * Provides type definitions and function prototypes used to link the
+ * DHD OS, bus, and protocol modules.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef _dhd_proto_h_
+#define _dhd_proto_h_
+
+#include <dhdioctl.h>
+#include <wlioctl.h>
+#ifdef BCMPCIE
+#include <dhd_flowring.h>
+#endif
+
+#define DEFAULT_IOCTL_RESP_TIMEOUT     (5 * 1000) /* 5 seconds */
+#ifndef IOCTL_RESP_TIMEOUT
+/* In milli second default value for Production FW */
+#define IOCTL_RESP_TIMEOUT  DEFAULT_IOCTL_RESP_TIMEOUT
+#endif /* IOCTL_RESP_TIMEOUT */
+
+/* In milli second default value for Production FW */
+#define IOCTL_DMAXFER_TIMEOUT  (15 * 1000) /* 15 seconds for Production FW */
+
+#ifndef MFG_IOCTL_RESP_TIMEOUT
+#define MFG_IOCTL_RESP_TIMEOUT  20000  /* In milli second default value for MFG FW */
+#endif /* MFG_IOCTL_RESP_TIMEOUT */
+
+#define DEFAULT_D3_ACK_RESP_TIMEOUT    2000
+#ifndef D3_ACK_RESP_TIMEOUT
+#define D3_ACK_RESP_TIMEOUT            DEFAULT_D3_ACK_RESP_TIMEOUT
+#endif /* D3_ACK_RESP_TIMEOUT */
+
+#define DEFAULT_DHD_BUS_BUSY_TIMEOUT   (IOCTL_RESP_TIMEOUT + 1000)
+#ifndef DHD_BUS_BUSY_TIMEOUT
+#define DHD_BUS_BUSY_TIMEOUT   DEFAULT_DHD_BUS_BUSY_TIMEOUT
+#endif /* DEFAULT_DHD_BUS_BUSY_TIMEOUT */
+
+#define DS_EXIT_TIMEOUT        1000 /* In ms */
+#define DS_ENTER_TIMEOUT 1000 /* In ms */
+
+#define IOCTL_DISABLE_TIMEOUT 0
+
+/*
+ * Exported from the dhd protocol module (dhd_cdc, dhd_rndis)
+ */
+
+/* Linkage, sets prot link and updates hdrlen in pub */
+extern int dhd_prot_attach(dhd_pub_t *dhdp);
+
+/* Initilizes the index block for dma'ing indices */
+extern int dhd_prot_dma_indx_init(dhd_pub_t *dhdp, uint32 rw_index_sz,
+       uint8 type, uint32 length);
+
+/* Unlink, frees allocated protocol memory (including dhd_prot) */
+extern void dhd_prot_detach(dhd_pub_t *dhdp);
+
+/* Initialize protocol: sync w/dongle state.
+ * Sets dongle media info (iswl, drv_version, mac address).
+ */
+extern int dhd_sync_with_dongle(dhd_pub_t *dhdp);
+
+/* Protocol initialization needed for IOCTL/IOVAR path */
+extern int dhd_prot_init(dhd_pub_t *dhd);
+
+/* Stop protocol: sync w/dongle state. */
+extern void dhd_prot_stop(dhd_pub_t *dhdp);
+
+/* Add any protocol-specific data header.
+ * Caller must reserve prot_hdrlen prepend space.
+ */
+extern void dhd_prot_hdrpush(dhd_pub_t *, int ifidx, void *txp);
+extern uint dhd_prot_hdrlen(dhd_pub_t *, void *txp);
+
+/* Remove any protocol-specific data header. */
+extern int dhd_prot_hdrpull(dhd_pub_t *, int *ifidx, void *rxp, uchar *buf, uint *len);
+
+/* Use protocol to issue ioctl to dongle */
+extern int dhd_prot_ioctl(dhd_pub_t *dhd, int ifidx, wl_ioctl_t * ioc, void * buf, int len);
+
+/* Handles a protocol control response asynchronously */
+extern int dhd_prot_ctl_complete(dhd_pub_t *dhd);
+
+/* Check for and handle local prot-specific iovar commands */
+extern int dhd_prot_iovar_op(dhd_pub_t *dhdp, const char *name,
+                             void *params, int plen, void *arg, int len, bool set);
+
+/* Add prot dump output to a buffer */
+extern void dhd_prot_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf);
+
+/* Dump extended trap data */
+extern int dhd_prot_dump_extended_trap(dhd_pub_t *dhdp, struct bcmstrbuf *b, bool raw);
+
+/* Update local copy of dongle statistics */
+extern void dhd_prot_dstats(dhd_pub_t *dhdp);
+
+extern int dhd_ioctl(dhd_pub_t * dhd_pub, dhd_ioctl_t *ioc, void * buf, uint buflen);
+
+extern int dhd_preinit_ioctls(dhd_pub_t *dhd);
+
+extern int dhd_process_pkt_reorder_info(dhd_pub_t *dhd, uchar *reorder_info_buf,
+       uint reorder_info_len, void **pkt, uint32 *free_buf_count);
+
+#ifdef BCMPCIE
+extern bool dhd_prot_process_msgbuf_txcpl(dhd_pub_t *dhd, uint bound, int ringtype);
+extern bool dhd_prot_process_msgbuf_rxcpl(dhd_pub_t *dhd, uint bound, int ringtype);
+extern bool dhd_prot_process_msgbuf_infocpl(dhd_pub_t *dhd, uint bound);
+extern int dhd_prot_process_ctrlbuf(dhd_pub_t * dhd);
+extern int dhd_prot_process_trapbuf(dhd_pub_t * dhd);
+extern bool dhd_prot_dtohsplit(dhd_pub_t * dhd);
+extern int dhd_post_dummy_msg(dhd_pub_t *dhd);
+extern int dhdmsgbuf_lpbk_req(dhd_pub_t *dhd, uint len);
+extern void dhd_prot_rx_dataoffset(dhd_pub_t *dhd, uint32 offset);
+extern int dhd_prot_txdata(dhd_pub_t *dhd, void *p, uint8 ifidx);
+extern int dhdmsgbuf_dmaxfer_req(dhd_pub_t *dhd,
+       uint len, uint srcdelay, uint destdelay, uint d11_lpbk, uint core_num);
+extern int dhdmsgbuf_dmaxfer_status(dhd_pub_t *dhd, dma_xfer_info_t *result);
+
+extern void dhd_dma_buf_init(dhd_pub_t *dhd, void *dma_buf,
+       void *va, uint32 len, dmaaddr_t pa, void *dmah, void *secdma);
+extern void dhd_prot_flowrings_pool_release(dhd_pub_t *dhd,
+       uint16 flowid, void *msgbuf_ring);
+extern int dhd_prot_flow_ring_create(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node);
+extern int dhd_post_tx_ring_item(dhd_pub_t *dhd, void *PKTBUF, uint8 ifindex);
+extern int dhd_prot_flow_ring_delete(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node);
+extern int dhd_prot_flow_ring_flush(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node);
+extern int dhd_prot_ringupd_dump(dhd_pub_t *dhd, struct bcmstrbuf *b);
+extern uint32 dhd_prot_metadata_dbg_set(dhd_pub_t *dhd, bool val);
+extern uint32 dhd_prot_metadata_dbg_get(dhd_pub_t *dhd);
+extern uint32 dhd_prot_metadatalen_set(dhd_pub_t *dhd, uint32 val, bool rx);
+extern uint32 dhd_prot_metadatalen_get(dhd_pub_t *dhd, bool rx);
+extern void dhd_prot_print_flow_ring(dhd_pub_t *dhd, void *msgbuf_flow_info, bool h2d,
+       struct bcmstrbuf *strbuf, const char * fmt);
+extern void dhd_prot_print_info(dhd_pub_t *dhd, struct bcmstrbuf *strbuf);
+extern void dhd_prot_update_txflowring(dhd_pub_t *dhdp, uint16 flow_id, void *msgring_info);
+extern void dhd_prot_txdata_write_flush(dhd_pub_t *dhd, uint16 flow_id);
+extern uint32 dhd_prot_txp_threshold(dhd_pub_t *dhd, bool set, uint32 val);
+extern void dhd_prot_reset(dhd_pub_t *dhd);
+extern uint16 dhd_get_max_flow_rings(dhd_pub_t *dhd);
+
+#ifdef IDLE_TX_FLOW_MGMT
+extern int dhd_prot_flow_ring_batch_suspend_request(dhd_pub_t *dhd, uint16 *ringid, uint16 count);
+extern int dhd_prot_flow_ring_resume(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node);
+#endif /* IDLE_TX_FLOW_MGMT */
+extern int dhd_prot_init_info_rings(dhd_pub_t *dhd);
+extern int dhd_prot_check_tx_resource(dhd_pub_t *dhd);
+#endif /* BCMPCIE */
+
+#ifdef DHD_LB
+extern void dhd_lb_tx_compl_handler(unsigned long data);
+extern void dhd_lb_rx_compl_handler(unsigned long data);
+extern void dhd_lb_rx_process_handler(unsigned long data);
+#endif /* DHD_LB */
+extern int dhd_prot_h2d_mbdata_send_ctrlmsg(dhd_pub_t *dhd, uint32 mb_data);
+
+#ifdef BCMPCIE
+extern int dhd_prot_send_host_timestamp(dhd_pub_t *dhdp, uchar *tlv, uint16 tlv_len,
+       uint16 seq, uint16 xt_id);
+extern bool dhd_prot_data_path_tx_timestamp_logging(dhd_pub_t *dhd,  bool enable, bool set);
+extern bool dhd_prot_data_path_rx_timestamp_logging(dhd_pub_t *dhd,  bool enable, bool set);
+extern bool dhd_prot_pkt_noretry(dhd_pub_t *dhd, bool enable, bool set);
+extern bool dhd_prot_pkt_noaggr(dhd_pub_t *dhd, bool enable, bool set);
+extern bool dhd_prot_pkt_fixed_rate(dhd_pub_t *dhd, bool enable, bool set);
+#else /* BCMPCIE */
+#define dhd_prot_send_host_timestamp(a, b, c, d, e)            0
+#define dhd_prot_data_path_tx_timestamp_logging(a, b, c)       0
+#define dhd_prot_data_path_rx_timestamp_logging(a, b, c)       0
+#endif /* BCMPCIE */
+
+extern void dhd_prot_dma_indx_free(dhd_pub_t *dhd);
+
+#ifdef EWP_EDL
+int dhd_prot_init_edl_rings(dhd_pub_t *dhd);
+bool dhd_prot_process_msgbuf_edl(dhd_pub_t *dhd);
+int dhd_prot_process_edl_complete(dhd_pub_t *dhd, void *evt_decode_data);
+#endif /* EWP_EDL  */
+
+/* APIs for managing a DMA-able buffer */
+int  dhd_dma_buf_alloc(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf, uint32 buf_len);
+void dhd_dma_buf_free(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf);
+
+/********************************
+ * For version-string expansion *
+ */
+#if defined(BDC)
+#define DHD_PROTOCOL "bdc"
+#elif defined(CDC)
+#define DHD_PROTOCOL "cdc"
+#else
+#define DHD_PROTOCOL "unknown"
+#endif /* proto */
+
+int dhd_get_hscb_info(dhd_pub_t *dhd, void ** va, uint32 *len);
+int dhd_get_hscb_buff(dhd_pub_t *dhd, uint32 offset, uint32 length, void * buff);
+
+#ifdef DHD_MAP_LOGGING
+extern void dhd_prot_smmu_fault_dump(dhd_pub_t *dhdp);
+#endif /* DHD_MAP_LOGGING */
+
+extern uint16 dhd_prot_get_h2d_max_txpost(dhd_pub_t *dhd);
+extern void dhd_prot_set_h2d_max_txpost(dhd_pub_t *dhd, uint16 max_txpost);
+
+#if defined(DHD_HTPUT_TUNABLES)
+extern uint16 dhd_prot_get_h2d_htput_max_txpost(dhd_pub_t *dhd);
+extern void dhd_prot_set_h2d_htput_max_txpost(dhd_pub_t *dhd, uint16 max_txpost);
+#endif /* DHD_HTPUT_TUNABLES */
+
+#endif /* _dhd_proto_h_ */
diff --git a/bcmdhd.101.10.240.x/dhd_qos_algo.h b/bcmdhd.101.10.240.x/dhd_qos_algo.h
new file mode 100644 (file)
index 0000000..368d120
--- /dev/null
@@ -0,0 +1,90 @@
+/*
+ * Header file for QOS Algorithm on DHD
+ *
+ * Provides type definitions and function prototypes for the QOS Algorithm
+ * Note that this algorithm is a platform independent layer
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef _DHD_QOS_ALGO_H_
+#define _DHD_QOS_ALGO_H_
+
+#define LOWLAT_AVG_PKT_SIZE_LOW 50u
+#define LOWLAT_AVG_PKT_SIZE_HIGH 200u
+#define LOWLAT_NUM_PKTS_LOW 1u
+#define LOWLAT_NUM_PKTS_HIGH 8u
+#define LOWLAT_DETECT_CNT_INC_THRESH 10u
+#define LOWLAT_DETECT_CNT_DEC_THRESH 0u
+#define LOWLAT_DETECT_CNT_UPGRADE_THRESH 4u
+
+typedef struct qos_stat
+{
+       /* Statistics */
+       unsigned long tx_pkts_prev;
+       unsigned long tx_bytes_prev;
+       unsigned long tx_pkts;
+       unsigned long tx_bytes;
+
+       /* low latency flow detection algorithm counts */
+       unsigned char lowlat_detect_count;
+       bool lowlat_flow;
+} qos_stat_t;
+
+/* QoS alogrithm parameter, controllable at runtime */
+typedef struct _qos_algo_params
+{
+       /* The avg Tx packet size in the sampling interval must be between
+        * these two thresholds for QoS upgrade to take place.
+        * default values = LOWLAT_AVG_PKT_SIZE_LOW, LOWLAT_AVG_PKT_SIZE_HIGH
+        */
+       unsigned long avg_pkt_size_low_thresh;
+       unsigned long avg_pkt_size_high_thresh;
+       /* The number of Tx packets in the sampling interval must be
+        * between these two thresholds for QoS upgrade to happen.
+        * default values = LOWLAT_NUM_PKTS_LOW, LOWLAT_NUM_PKTS_HIGH
+        */
+       unsigned long num_pkts_low_thresh;
+       unsigned long num_pkts_high_thresh;
+       /* If low latency traffic is detected, then the low latency count
+        * is incremented till the first threshold is hit.
+        * If traffic ceases to be low latency, then the count is
+        * decremented till the second threshold is hit.
+        * default values = LOWLAT_DETECT_CNT_INC_THRESH, LOWLAT_DETECT_CNT_DEC_THRESH
+        */
+       unsigned char detect_cnt_inc_thresh;
+       unsigned char detect_cnt_dec_thresh;
+       /* If the low latency count crosses this threshold, the flow will be upgraded.
+        * Default value =  LOWLAT_DETECT_CNT_UPGRADE_THRESH
+        */
+       unsigned char detect_cnt_upgrade_thresh;
+} qos_algo_params_t;
+
+#define QOS_PARAMS(x) (&x->psk_qos->qos_params);
+
+/*
+ * Operates on a flow and returns 1 for upgrade and 0 for
+ * no up-grade
+ */
+int dhd_qos_algo(dhd_info_t *dhd, qos_stat_t *qos, qos_algo_params_t *qos_params);
+int qos_algo_params_init(qos_algo_params_t *qos_params);
+#endif /* _DHD_QOS_ALGO_H_ */
diff --git a/bcmdhd.101.10.240.x/dhd_rtt.c b/bcmdhd.101.10.240.x/dhd_rtt.c
new file mode 100644 (file)
index 0000000..e4d9530
--- /dev/null
@@ -0,0 +1,4465 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), RTT
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+#include <typedefs.h>
+#include <osl.h>
+
+#include <epivers.h>
+#include <bcmutils.h>
+
+#include <bcmendian.h>
+#include <linuxver.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/sort.h>
+#include <dngl_stats.h>
+#include <wlioctl.h>
+#include <bcmwifi_rspec.h>
+
+#include <bcmevent.h>
+#include <dhd.h>
+#include <dhd_rtt.h>
+#include <dhd_dbg.h>
+#include <dhd_bus.h>
+#include <wldev_common.h>
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#endif /* WL_CFG80211 */
+#ifdef WL_NAN
+#include <wl_cfgnan.h>
+#endif /* WL_NAN */
+
+static DEFINE_SPINLOCK(noti_list_lock);
+#define NULL_CHECK(p, s, err)  \
+       do { \
+               if (!(p)) { \
+                       printf("NULL POINTER (%s) : %s\n", __FUNCTION__, (s)); \
+                       err = BCME_ERROR; \
+                       return err; \
+               } \
+       } while (0)
+#define DHD_RTT_CHK_SET_PARAM(param, param_cnt, targets, tlvid)  \
+       do { \
+               if ((param_cnt) >= FTM_MAX_PARAMS) { \
+                       DHD_RTT_ERR(("Param cnt exceeded for FTM cfg iovar\n")); \
+                       err = BCME_ERROR; \
+                       goto exit; \
+               } else { \
+                       dhd_rtt_set_ftm_config_param((param), &(param_cnt), \
+                               (targets), (tlvid)); \
+               }\
+       } while (0)
+
+#define TIMESPEC_TO_US(ts)  (((uint64)(ts).tv_sec * USEC_PER_SEC) + \
+                                                       (ts).tv_nsec / NSEC_PER_USEC)
+
+#undef DHD_RTT_MEM
+#undef DHD_RTT_ERR
+#define DHD_RTT_MEM DHD_LOG_MEM
+#define DHD_RTT_ERR DHD_ERROR
+
+#define FTM_IOC_BUFSZ  2048    /* ioc buffsize for our module (> BCM_XTLV_HDR_SIZE) */
+#define FTM_AVAIL_MAX_SLOTS            32
+#define FTM_MAX_CONFIGS 10
+#define FTM_MAX_PARAMS 20
+#define FTM_DEFAULT_SESSION 1
+#define FTM_BURST_TIMEOUT_UNIT 250 /* 250 ns */
+#define FTM_INVALID -1
+#define        FTM_DEFAULT_CNT_20M             24u
+#define FTM_DEFAULT_CNT_40M            16u
+#define FTM_DEFAULT_CNT_80M            11u
+/* To handle congestion env, set max dur/timeout */
+#define FTM_MAX_BURST_DUR_TMO_MS       128u
+
+/* convenience macros */
+#define FTM_TU2MICRO(_tu) ((uint64)(_tu) << 10)
+#define FTM_MICRO2TU(_tu) ((uint64)(_tu) >> 10)
+#define FTM_TU2MILLI(_tu) ((uint32)FTM_TU2MICRO(_tu) / 1000)
+#define FTM_MICRO2MILLI(_x) ((uint32)(_x) / 1000)
+#define FTM_MICRO2SEC(_x) ((uint32)(_x) / 1000000)
+#define FTM_INTVL2NSEC(_intvl) ((uint32)ftm_intvl2nsec(_intvl))
+#define FTM_INTVL2USEC(_intvl) ((uint32)ftm_intvl2usec(_intvl))
+#define FTM_INTVL2MSEC(_intvl) (FTM_INTVL2USEC(_intvl) / 1000)
+#define FTM_INTVL2SEC(_intvl) (FTM_INTVL2USEC(_intvl) / 1000000)
+#define FTM_USECIN100MILLI(_usec) ((_usec) / 100000)
+
+/* broadcom specific set to have more accurate data */
+#define ENABLE_VHT_ACK
+#define CH_MIN_5G_CHANNEL 34
+
+/* CUR ETH became obsolete with this major version onwards */
+#define RTT_IOV_CUR_ETH_OBSOLETE 12
+
+/* PROXD TIMEOUT */
+#define DHD_RTT_TIMER_INTERVAL_MS      5000u
+#define DHD_NAN_RTT_TIMER_INTERVAL_MS  20000u
+
+#define DHD_NAN_RTT_MAX_GEOF_SESSIONS  5u
+
+struct rtt_noti_callback {
+       struct list_head list;
+       void *ctx;
+       dhd_rtt_compl_noti_fn noti_fn;
+};
+
+/* bitmask indicating which command groups; */
+typedef enum {
+       FTM_SUBCMD_FLAG_METHOD  = 0x01, /* FTM method command */
+       FTM_SUBCMD_FLAG_SESSION = 0x02, /* FTM session command */
+       FTM_SUBCMD_FLAG_ALL = FTM_SUBCMD_FLAG_METHOD | FTM_SUBCMD_FLAG_SESSION
+} ftm_subcmd_flag_t;
+
+/* proxd ftm config-category definition */
+typedef enum {
+       FTM_CONFIG_CAT_GENERAL = 1,     /* generial configuration */
+       FTM_CONFIG_CAT_OPTIONS = 2,     /* 'config options' */
+       FTM_CONFIG_CAT_AVAIL = 3,       /* 'config avail' */
+} ftm_config_category_t;
+
+typedef struct ftm_subcmd_info {
+       int16                           version;    /* FTM version (optional) */
+       char                            *name;          /* cmd-name string as cmdline input */
+       wl_proxd_cmd_t          cmdid;          /* cmd-id */
+       bcm_xtlv_unpack_cbfn_t *handler;  /* cmd response handler (optional) */
+       ftm_subcmd_flag_t       cmdflag; /* CMD flag (optional)  */
+} ftm_subcmd_info_t;
+
+typedef struct ftm_config_options_info {
+       uint32 flags;                           /* wl_proxd_flags_t/wl_proxd_session_flags_t */
+       bool enable;
+} ftm_config_options_info_t;
+
+typedef struct ftm_config_param_info {
+       uint16          tlvid;  /* mapping TLV id for the item */
+       union {
+               uint32  chanspec;
+               struct ether_addr mac_addr;
+               wl_proxd_intvl_t data_intvl;
+               uint32 data32;
+               uint16 data16;
+               uint8 data8;
+               uint32 event_mask;
+       };
+} ftm_config_param_info_t;
+
+/*
+* definition for id-string mapping.
+*   This is used to map an id (can be cmd-id, tlv-id, ....) to a text-string
+*   for debug-display or cmd-log-display
+*/
+typedef struct ftm_strmap_entry {
+       int32           id;
+       char            *text;
+} ftm_strmap_entry_t;
+
+typedef struct ftm_status_map_host_entry {
+       wl_proxd_status_t proxd_status;
+       rtt_reason_t rtt_reason;
+} ftm_status_map_host_entry_t;
+
+static uint16
+rtt_result_ver(uint16 tlvid, const uint8 *p_data);
+
+static int
+dhd_rtt_convert_results_to_host_v1(rtt_result_t *rtt_result, const uint8 *p_data,
+       uint16 tlvid, uint16 len);
+
+static int
+dhd_rtt_convert_results_to_host_v2(rtt_result_t *rtt_result, const uint8 *p_data,
+       uint16 tlvid, uint16 len);
+
+static wifi_rate_v1
+dhd_rtt_convert_rate_to_host(uint32 ratespec);
+
+#if defined(WL_CFG80211) && defined(RTT_DEBUG)
+const char *
+ftm_cmdid_to_str(uint16 cmdid);
+#endif /* WL_CFG80211 && RTT_DEBUG */
+
+#ifdef WL_CFG80211
+static int
+dhd_rtt_start(dhd_pub_t *dhd);
+static int dhd_rtt_create_failure_result(rtt_status_info_t *rtt_status,
+       struct ether_addr *addr);
+static void dhd_rtt_handle_rtt_session_end(dhd_pub_t *dhd);
+static void dhd_rtt_timeout_work(struct work_struct *work);
+#endif /* WL_CFG80211 */
+static const int burst_duration_idx[]  = {0, 0, 1, 2, 4, 8, 16, 32, 64, 128, 0, 0};
+
+/* ftm status mapping to host status */
+static const ftm_status_map_host_entry_t ftm_status_map_info[] = {
+       {WL_PROXD_E_INCOMPLETE, RTT_STATUS_FAILURE},
+       {WL_PROXD_E_OVERRIDDEN, RTT_STATUS_FAILURE},
+       {WL_PROXD_E_ASAP_FAILED, RTT_STATUS_FAILURE},
+       {WL_PROXD_E_NOTSTARTED, RTT_STATUS_FAIL_NOT_SCHEDULED_YET},
+       {WL_PROXD_E_INVALIDMEAS, RTT_STATUS_FAIL_INVALID_TS},
+       {WL_PROXD_E_INCAPABLE, RTT_STATUS_FAIL_NO_CAPABILITY},
+       {WL_PROXD_E_MISMATCH, RTT_STATUS_FAILURE},
+       {WL_PROXD_E_DUP_SESSION, RTT_STATUS_FAILURE},
+       {WL_PROXD_E_REMOTE_FAIL, RTT_STATUS_FAILURE},
+       {WL_PROXD_E_REMOTE_INCAPABLE, RTT_STATUS_FAILURE},
+       {WL_PROXD_E_SCHED_FAIL, RTT_STATUS_FAIL_SCHEDULE},
+       {WL_PROXD_E_PROTO, RTT_STATUS_FAIL_PROTOCOL},
+       {WL_PROXD_E_EXPIRED, RTT_STATUS_FAILURE},
+       {WL_PROXD_E_TIMEOUT, RTT_STATUS_FAIL_TM_TIMEOUT},
+       {WL_PROXD_E_NOACK, RTT_STATUS_FAIL_NO_RSP},
+       {WL_PROXD_E_DEFERRED, RTT_STATUS_FAILURE},
+       {WL_PROXD_E_INVALID_SID, RTT_STATUS_FAILURE},
+       {WL_PROXD_E_REMOTE_CANCEL, RTT_STATUS_FAILURE},
+       {WL_PROXD_E_CANCELED, RTT_STATUS_ABORTED},
+       {WL_PROXD_E_INVALID_SESSION, RTT_STATUS_FAILURE},
+       {WL_PROXD_E_BAD_STATE, RTT_STATUS_FAILURE},
+       {WL_PROXD_E_ERROR, RTT_STATUS_FAILURE},
+       {WL_PROXD_E_OK, RTT_STATUS_SUCCESS}
+};
+
+static const ftm_strmap_entry_t ftm_event_type_loginfo[] = {
+       /* wl_proxd_event_type_t,               text-string */
+       { WL_PROXD_EVENT_NONE,                  "none" },
+       { WL_PROXD_EVENT_SESSION_CREATE,        "session create" },
+       { WL_PROXD_EVENT_SESSION_START,         "session start" },
+       { WL_PROXD_EVENT_FTM_REQ,               "FTM req" },
+       { WL_PROXD_EVENT_BURST_START,           "burst start" },
+       { WL_PROXD_EVENT_BURST_END,             "burst end" },
+       { WL_PROXD_EVENT_SESSION_END,           "session end" },
+       { WL_PROXD_EVENT_SESSION_RESTART,       "session restart" },
+       { WL_PROXD_EVENT_BURST_RESCHED,         "burst rescheduled" },
+       { WL_PROXD_EVENT_SESSION_DESTROY,       "session destroy" },
+       { WL_PROXD_EVENT_RANGE_REQ,             "range request" },
+       { WL_PROXD_EVENT_FTM_FRAME,             "FTM frame" },
+       { WL_PROXD_EVENT_DELAY,                 "delay" },
+       { WL_PROXD_EVENT_VS_INITIATOR_RPT,      "initiator-report " }, /* rx initiator-rpt */
+       { WL_PROXD_EVENT_RANGING,               "ranging " },
+       { WL_PROXD_EVENT_COLLECT,               "collect" },
+       { WL_PROXD_EVENT_MF_STATS,              "mf_stats" },
+       { WL_PROXD_EVENT_START_WAIT,            "start-wait"}
+};
+
+/*
+* session-state --> text string mapping
+*/
+static const ftm_strmap_entry_t ftm_session_state_value_loginfo[] = {
+       /* wl_proxd_session_state_t,            text string */
+       { WL_PROXD_SESSION_STATE_CREATED,       "created" },
+       { WL_PROXD_SESSION_STATE_CONFIGURED,    "configured" },
+       { WL_PROXD_SESSION_STATE_STARTED,       "started" },
+       { WL_PROXD_SESSION_STATE_DELAY,         "delay" },
+       { WL_PROXD_SESSION_STATE_USER_WAIT,     "user-wait" },
+       { WL_PROXD_SESSION_STATE_SCHED_WAIT,    "sched-wait" },
+       { WL_PROXD_SESSION_STATE_BURST,         "burst" },
+       { WL_PROXD_SESSION_STATE_STOPPING,      "stopping" },
+       { WL_PROXD_SESSION_STATE_ENDED,         "ended" },
+       { WL_PROXD_SESSION_STATE_DESTROYING,    "destroying" },
+       { WL_PROXD_SESSION_STATE_NONE,          "none" }
+};
+
+/*
+* status --> text string mapping
+*/
+static const ftm_strmap_entry_t ftm_status_value_loginfo[] = {
+       /* wl_proxd_status_t,                   text-string */
+       { WL_PROXD_E_OVERRIDDEN,                "overridden" },
+       { WL_PROXD_E_ASAP_FAILED,               "ASAP failed" },
+       { WL_PROXD_E_NOTSTARTED,                "not started" },
+       { WL_PROXD_E_INVALIDMEAS,               "invalid measurement" },
+       { WL_PROXD_E_INCAPABLE,                 "incapable" },
+       { WL_PROXD_E_MISMATCH,                  "mismatch"},
+       { WL_PROXD_E_DUP_SESSION,               "dup session" },
+       { WL_PROXD_E_REMOTE_FAIL,               "remote fail" },
+       { WL_PROXD_E_REMOTE_INCAPABLE,          "remote incapable" },
+       { WL_PROXD_E_SCHED_FAIL,                "sched failure" },
+       { WL_PROXD_E_PROTO,                     "protocol error" },
+       { WL_PROXD_E_EXPIRED,                   "expired" },
+       { WL_PROXD_E_TIMEOUT,                   "timeout" },
+       { WL_PROXD_E_NOACK,                     "no ack" },
+       { WL_PROXD_E_DEFERRED,                  "deferred" },
+       { WL_PROXD_E_INVALID_SID,               "invalid session id" },
+       { WL_PROXD_E_REMOTE_CANCEL,             "remote cancel" },
+       { WL_PROXD_E_CANCELED,                  "canceled" },
+       { WL_PROXD_E_INVALID_SESSION,           "invalid session" },
+       { WL_PROXD_E_BAD_STATE,                 "bad state" },
+       { WL_PROXD_E_ERROR,                     "error" },
+       { WL_PROXD_E_OK,                        "OK" }
+};
+
+/*
+* time interval unit --> text string mapping
+*/
+static const ftm_strmap_entry_t ftm_tmu_value_loginfo[] = {
+       /* wl_proxd_tmu_t,              text-string */
+       { WL_PROXD_TMU_TU,              "TU" },
+       { WL_PROXD_TMU_SEC,             "sec" },
+       { WL_PROXD_TMU_MILLI_SEC,       "ms" },
+       { WL_PROXD_TMU_MICRO_SEC,       "us" },
+       { WL_PROXD_TMU_NANO_SEC,        "ns" },
+       { WL_PROXD_TMU_PICO_SEC,        "ps" }
+};
+
+struct ieee_80211_mcs_rate_info {
+       uint8 constellation_bits;
+       uint8 coding_q;
+       uint8 coding_d;
+};
+
+static const struct ieee_80211_mcs_rate_info wl_mcs_info[] = {
+       { 1, 1, 2 }, /* MCS  0: MOD: BPSK,   CR 1/2 */
+       { 2, 1, 2 }, /* MCS  1: MOD: QPSK,   CR 1/2 */
+       { 2, 3, 4 }, /* MCS  2: MOD: QPSK,   CR 3/4 */
+       { 4, 1, 2 }, /* MCS  3: MOD: 16QAM,  CR 1/2 */
+       { 4, 3, 4 }, /* MCS  4: MOD: 16QAM,  CR 3/4 */
+       { 6, 2, 3 }, /* MCS  5: MOD: 64QAM,  CR 2/3 */
+       { 6, 3, 4 }, /* MCS  6: MOD: 64QAM,  CR 3/4 */
+       { 6, 5, 6 }, /* MCS  7: MOD: 64QAM,  CR 5/6 */
+       { 8, 3, 4 }, /* MCS  8: MOD: 256QAM, CR 3/4 */
+       { 8, 5, 6 }  /* MCS  9: MOD: 256QAM, CR 5/6 */
+};
+
+/**
+ * Returns the rate in [Kbps] units for a caller supplied MCS/bandwidth/Nss/Sgi combination.
+ *     'mcs' : a *single* spatial stream MCS (11n or 11ac)
+ */
+uint
+rate_mcs2rate(uint mcs, uint nss, uint bw, int sgi)
+{
+       const int ksps = 250; /* kilo symbols per sec, 4 us sym */
+       const int Nsd_20MHz = 52;
+       const int Nsd_40MHz = 108;
+       const int Nsd_80MHz = 234;
+       const int Nsd_160MHz = 468;
+       uint rate;
+
+       if (mcs == 32) {
+               /* just return fixed values for mcs32 instead of trying to parametrize */
+               rate = (sgi == 0) ? 6000 : 6778;
+       } else if (mcs <= 9) {
+               /* This calculation works for 11n HT and 11ac VHT if the HT mcs values
+                * are decomposed into a base MCS = MCS % 8, and Nss = 1 + MCS / 8.
+                * That is, HT MCS 23 is a base MCS = 7, Nss = 3
+                */
+
+               /* find the number of complex numbers per symbol */
+               if (RSPEC_IS20MHZ(bw)) {
+                       /* 4360 TODO: eliminate Phy const in rspec bw, then just compare
+                        * as in 80 and 160 case below instead of RSPEC_IS20MHZ(bw)
+                        */
+                       rate = Nsd_20MHz;
+               } else if (RSPEC_IS40MHZ(bw)) {
+                       /* 4360 TODO: eliminate Phy const in rspec bw, then just compare
+                        * as in 80 and 160 case below instead of RSPEC_IS40MHZ(bw)
+                        */
+                       rate = Nsd_40MHz;
+               } else if (bw == WL_RSPEC_BW_80MHZ) {
+                       rate = Nsd_80MHz;
+               } else if (bw == WL_RSPEC_BW_160MHZ) {
+                       rate = Nsd_160MHz;
+               } else {
+                       rate = 0;
+               }
+
+               /* multiply by bits per number from the constellation in use */
+               rate = rate * wl_mcs_info[mcs].constellation_bits;
+
+               /* adjust for the number of spatial streams */
+               rate = rate * nss;
+
+               /* adjust for the coding rate given as a quotient and divisor */
+               rate = (rate * wl_mcs_info[mcs].coding_q) / wl_mcs_info[mcs].coding_d;
+
+               /* multiply by Kilo symbols per sec to get Kbps */
+               rate = rate * ksps;
+
+               /* adjust the symbols per sec for SGI
+                * symbol duration is 4 us without SGI, and 3.6 us with SGI,
+                * so ratio is 10 / 9
+                */
+               if (sgi) {
+                       /* add 4 for rounding of division by 9 */
+                       rate = ((rate * 10) + 4) / 9;
+               }
+       } else {
+               rate = 0;
+       }
+
+       return rate;
+} /* wlc_rate_mcs2rate */
+
+/** take a well formed ratespec_t arg and return phy rate in [Kbps] units */
+static uint32
+rate_rspec2rate(uint32 rspec)
+{
+       int rate = 0;
+
+       if (RSPEC_ISLEGACY(rspec)) {
+               rate = 500 * (rspec & WL_RSPEC_RATE_MASK);
+       } else if (RSPEC_ISHT(rspec)) {
+               uint mcs = (rspec & WL_RSPEC_RATE_MASK);
+
+               if (mcs == 32) {
+                       rate = rate_mcs2rate(mcs, 1, WL_RSPEC_BW_40MHZ, RSPEC_ISSGI(rspec));
+               } else {
+                       uint nss = 1 + (mcs / 8);
+                       mcs = mcs % 8;
+                       rate = rate_mcs2rate(mcs, nss, RSPEC_BW(rspec), RSPEC_ISSGI(rspec));
+               }
+       } else if (RSPEC_ISVHT(rspec)) {
+               uint mcs = (rspec & WL_RSPEC_VHT_MCS_MASK);
+               uint nss = (rspec & WL_RSPEC_VHT_NSS_MASK) >> WL_RSPEC_VHT_NSS_SHIFT;
+               if (mcs > 9 || nss > 8) {
+                       DHD_RTT(("%s: Invalid mcs %d or nss %d\n", __FUNCTION__, mcs, nss));
+                       goto exit;
+               }
+
+               rate = rate_mcs2rate(mcs, nss, RSPEC_BW(rspec), RSPEC_ISSGI(rspec));
+       } else {
+               DHD_RTT(("%s: wrong rspec:%d\n", __FUNCTION__, rspec));
+       }
+exit:
+       return rate;
+}
+
+char resp_buf[WLC_IOCTL_SMLEN];
+
+static uint64
+ftm_intvl2nsec(const wl_proxd_intvl_t *intvl)
+{
+       uint64 ret;
+       ret = intvl->intvl;
+       switch (intvl->tmu) {
+       case WL_PROXD_TMU_TU:                   ret = FTM_TU2MICRO(ret) * 1000; break;
+       case WL_PROXD_TMU_SEC:                  ret *= 1000000000; break;
+       case WL_PROXD_TMU_MILLI_SEC:    ret *= 1000000; break;
+       case WL_PROXD_TMU_MICRO_SEC:    ret *= 1000; break;
+       case WL_PROXD_TMU_PICO_SEC:             ret = intvl->intvl / 1000; break;
+       case WL_PROXD_TMU_NANO_SEC:             /* fall through */
+       default:                                                break;
+       }
+       return ret;
+}
+uint64
+ftm_intvl2usec(const wl_proxd_intvl_t *intvl)
+{
+       uint64 ret;
+       ret = intvl->intvl;
+       switch (intvl->tmu) {
+       case WL_PROXD_TMU_TU:                   ret = FTM_TU2MICRO(ret); break;
+       case WL_PROXD_TMU_SEC:                  ret *= 1000000; break;
+       case WL_PROXD_TMU_NANO_SEC:             ret = intvl->intvl / 1000; break;
+       case WL_PROXD_TMU_PICO_SEC:             ret = intvl->intvl / 1000000; break;
+       case WL_PROXD_TMU_MILLI_SEC:    ret *= 1000; break;
+       case WL_PROXD_TMU_MICRO_SEC:    /* fall through */
+       default:                                                break;
+       }
+       return ret;
+}
+
+/*
+* lookup 'id' (as a key) from a fw status to host map table
+* if found, return the corresponding reason code
+*/
+
+static rtt_reason_t
+ftm_get_statusmap_info(wl_proxd_status_t id, const ftm_status_map_host_entry_t *p_table,
+       uint32 num_entries)
+{
+       int i;
+       const ftm_status_map_host_entry_t *p_entry;
+       /* scan thru the table till end */
+       p_entry = p_table;
+       for (i = 0; i < (int) num_entries; i++)
+       {
+               if (p_entry->proxd_status == id) {
+                       return p_entry->rtt_reason;
+               }
+               p_entry++;              /* next entry */
+       }
+       return RTT_STATUS_FAILURE; /* not found */
+}
+/*
+* lookup 'id' (as a key) from a table
+* if found, return the entry pointer, otherwise return NULL
+*/
+static const ftm_strmap_entry_t*
+ftm_get_strmap_info(int32 id, const ftm_strmap_entry_t *p_table, uint32 num_entries)
+{
+       int i;
+       const ftm_strmap_entry_t *p_entry;
+
+       /* scan thru the table till end */
+       p_entry = p_table;
+       for (i = 0; i < (int) num_entries; i++)
+       {
+               if (p_entry->id == id)
+                       return p_entry;
+               p_entry++;              /* next entry */
+       }
+       return NULL;                    /* not found */
+}
+
+/*
+* map enum to a text-string for display, this function is called by the following:
+* For debug/trace:
+*     ftm_[cmdid|tlvid]_to_str()
+* For TLV-output log for 'get' commands
+*     ftm_[method|tmu|caps|status|state]_value_to_logstr()
+* Input:
+*     pTable -- point to a 'enum to string' table.
+*/
+static const char *
+ftm_map_id_to_str(int32 id, const ftm_strmap_entry_t *p_table, uint32 num_entries)
+{
+       const ftm_strmap_entry_t*p_entry = ftm_get_strmap_info(id, p_table, num_entries);
+       if (p_entry)
+               return (p_entry->text);
+
+       return "invalid";
+}
+
+#if defined(WL_CFG80211) && defined(RTT_DEBUG)
+/* define entry, e.g. { WL_PROXD_CMD_xxx, "WL_PROXD_CMD_xxx" } */
+#define DEF_STRMAP_ENTRY(id) { (id), #id }
+
+/* ftm cmd-id mapping */
+static const ftm_strmap_entry_t ftm_cmdid_map[] = {
+       /* {wl_proxd_cmd_t(WL_PROXD_CMD_xxx), "WL_PROXD_CMD_xxx" }, */
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_NONE),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_GET_VERSION),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_ENABLE),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_DISABLE),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_CONFIG),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_START_SESSION),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_BURST_REQUEST),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_STOP_SESSION),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_DELETE_SESSION),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_GET_RESULT),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_GET_INFO),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_GET_STATUS),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_GET_SESSIONS),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_GET_COUNTERS),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_CLEAR_COUNTERS),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_COLLECT),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_TUNE),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_DUMP),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_START_RANGING),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_STOP_RANGING),
+       DEF_STRMAP_ENTRY(WL_PROXD_CMD_GET_RANGING_INFO),
+};
+
+/*
+* map a ftm cmd-id to a text-string for display
+*/
+const char *
+ftm_cmdid_to_str(uint16 cmdid)
+{
+       return ftm_map_id_to_str((int32) cmdid, &ftm_cmdid_map[0], ARRAYSIZE(ftm_cmdid_map));
+}
+#endif /* WL_CFG80211 && RTT_DEBUG */
+
+/*
+* convert BCME_xxx error codes into related error strings
+* note, bcmerrorstr() defined in bcmutils is for BCMDRIVER only,
+*       this duplicate copy is for WL access and may need to clean up later
+*/
+static const char *ftm_bcmerrorstrtable[] = BCMERRSTRINGTABLE;
+static const char *
+ftm_status_value_to_logstr(wl_proxd_status_t status)
+{
+       static char ftm_msgbuf_status_undef[32];
+       const ftm_strmap_entry_t *p_loginfo;
+       int bcmerror;
+
+       /* check if within BCME_xxx error range */
+       bcmerror = (int) status;
+       if (VALID_BCMERROR(bcmerror))
+               return ftm_bcmerrorstrtable[-bcmerror];
+
+       /* otherwise, look for 'proxd ftm status' range */
+       p_loginfo = ftm_get_strmap_info((int32) status,
+               &ftm_status_value_loginfo[0], ARRAYSIZE(ftm_status_value_loginfo));
+       if (p_loginfo)
+               return p_loginfo->text;
+
+       /* report for 'out of range' FTM-status error code */
+       memset(ftm_msgbuf_status_undef, 0, sizeof(ftm_msgbuf_status_undef));
+       snprintf(ftm_msgbuf_status_undef, sizeof(ftm_msgbuf_status_undef),
+               "Undefined status %d", status);
+       return &ftm_msgbuf_status_undef[0];
+}
+
+static const char *
+ftm_tmu_value_to_logstr(wl_proxd_tmu_t tmu)
+{
+       return ftm_map_id_to_str((int32)tmu,
+               &ftm_tmu_value_loginfo[0], ARRAYSIZE(ftm_tmu_value_loginfo));
+}
+
+static const ftm_strmap_entry_t*
+ftm_get_event_type_loginfo(wl_proxd_event_type_t       event_type)
+{
+       /* look up 'event-type' from a predefined table  */
+       return ftm_get_strmap_info((int32) event_type,
+               ftm_event_type_loginfo, ARRAYSIZE(ftm_event_type_loginfo));
+}
+
+static const char *
+ftm_session_state_value_to_logstr(wl_proxd_session_state_t state)
+{
+       return ftm_map_id_to_str((int32)state, &ftm_session_state_value_loginfo[0],
+               ARRAYSIZE(ftm_session_state_value_loginfo));
+}
+
+#ifdef WL_CFG80211
+/*
+* send 'proxd' iovar for all ftm get-related commands
+*/
+static int
+rtt_do_get_ioctl(dhd_pub_t *dhd, wl_proxd_iov_t *p_proxd_iov, uint16 proxd_iovsize,
+               ftm_subcmd_info_t *p_subcmd_info)
+{
+
+       wl_proxd_iov_t *p_iovresp = (wl_proxd_iov_t *)resp_buf;
+       int status;
+       int tlvs_len;
+       /*  send getbuf proxd iovar */
+       status = dhd_getiovar(dhd, 0, "proxd", (char *)p_proxd_iov,
+                       proxd_iovsize, (char **)&p_iovresp, WLC_IOCTL_SMLEN);
+       if (status != BCME_OK) {
+               DHD_RTT_ERR(("%s: failed to send getbuf proxd iovar (CMD ID : %d), status=%d\n",
+                       __FUNCTION__, p_subcmd_info->cmdid, status));
+               return status;
+       }
+       if (p_subcmd_info->cmdid == WL_PROXD_CMD_GET_VERSION) {
+               p_subcmd_info->version = ltoh16(p_iovresp->version);
+               DHD_RTT(("ftm version: 0x%x\n", ltoh16(p_iovresp->version)));
+               goto exit;
+       }
+
+       tlvs_len = ltoh16(p_iovresp->len) - WL_PROXD_IOV_HDR_SIZE;
+       if (tlvs_len < 0) {
+               DHD_RTT_ERR(("%s: alert, p_iovresp->len(%d) should not be smaller than %d\n",
+                       __FUNCTION__, ltoh16(p_iovresp->len), (int) WL_PROXD_IOV_HDR_SIZE));
+               tlvs_len = 0;
+       }
+
+       if (tlvs_len > 0 && p_subcmd_info->handler) {
+               /* unpack TLVs and invokes the cbfn for processing */
+               status = bcm_unpack_xtlv_buf(p_proxd_iov, (uint8 *)p_iovresp->tlvs,
+                               tlvs_len, BCM_XTLV_OPTION_ALIGN32, p_subcmd_info->handler);
+       }
+exit:
+       return status;
+}
+
+static wl_proxd_iov_t *
+rtt_alloc_getset_buf(dhd_pub_t *dhd, wl_proxd_method_t method, wl_proxd_session_id_t session_id,
+       wl_proxd_cmd_t cmdid, uint16 tlvs_bufsize, uint16 *p_out_bufsize)
+{
+       uint16 proxd_iovsize;
+       wl_proxd_tlv_t *p_tlv;
+       wl_proxd_iov_t *p_proxd_iov = (wl_proxd_iov_t *) NULL;
+
+       *p_out_bufsize = 0;     /* init */
+       /* calculate the whole buffer size, including one reserve-tlv entry in the header */
+       proxd_iovsize = sizeof(wl_proxd_iov_t) + tlvs_bufsize;
+
+       p_proxd_iov = (wl_proxd_iov_t *)MALLOCZ(dhd->osh, proxd_iovsize);
+       if (p_proxd_iov == NULL) {
+               DHD_RTT_ERR(("error: failed to allocate %d bytes of memory\n", proxd_iovsize));
+               return NULL;
+       }
+
+       /* setup proxd-FTM-method iovar header */
+       p_proxd_iov->version = htol16(WL_PROXD_API_VERSION);
+       p_proxd_iov->len = htol16(proxd_iovsize); /* caller may adjust it based on #of TLVs */
+       p_proxd_iov->cmd = htol16(cmdid);
+       p_proxd_iov->method = htol16(method);
+       p_proxd_iov->sid = htol16(session_id);
+
+       /* initialize the reserved/dummy-TLV in iovar header */
+       p_tlv = p_proxd_iov->tlvs;
+       p_tlv->id = htol16(WL_PROXD_TLV_ID_NONE);
+       p_tlv->len = htol16(0);
+
+       *p_out_bufsize = proxd_iovsize; /* for caller's reference */
+
+       return p_proxd_iov;
+}
+
+static int
+dhd_rtt_common_get_handler(dhd_pub_t *dhd, ftm_subcmd_info_t *p_subcmd_info,
+               wl_proxd_method_t method,
+               wl_proxd_session_id_t session_id)
+{
+       int status = BCME_OK;
+       uint16 proxd_iovsize = 0;
+       wl_proxd_iov_t *p_proxd_iov;
+#ifdef RTT_DEBUG
+       DHD_RTT(("enter %s: method=%d, session_id=%d, cmdid=%d(%s)\n",
+               __FUNCTION__, method, session_id, p_subcmd_info->cmdid,
+               ftm_cmdid_to_str(p_subcmd_info->cmdid)));
+#endif
+       /* alloc mem for ioctl headr + reserved 0 bufsize for tlvs (initialize to zero) */
+       p_proxd_iov = rtt_alloc_getset_buf(dhd, method, session_id, p_subcmd_info->cmdid,
+               0, &proxd_iovsize);
+
+       if (p_proxd_iov == NULL)
+               return BCME_NOMEM;
+
+       status = rtt_do_get_ioctl(dhd, p_proxd_iov, proxd_iovsize, p_subcmd_info);
+
+       if (status != BCME_OK) {
+               DHD_RTT(("%s failed: status=%d\n", __FUNCTION__, status));
+       }
+       MFREE(dhd->osh, p_proxd_iov, proxd_iovsize);
+       return status;
+}
+
+/*
+* common handler for set-related proxd method commands which require no TLV as input
+*   wl proxd ftm [session-id] <set-subcmd>
+* e.g.
+*   wl proxd ftm enable -- to enable ftm
+*   wl proxd ftm disable -- to disable ftm
+*   wl proxd ftm <session-id> start -- to start a specified session
+*   wl proxd ftm <session-id> stop  -- to cancel a specified session;
+*                                    state is maintained till session is delete.
+*   wl proxd ftm <session-id> delete -- to delete a specified session
+*   wl proxd ftm [<session-id>] clear-counters -- to clear counters
+*   wl proxd ftm <session-id> burst-request -- on initiator: to send burst request;
+*                                              on target: send FTM frame
+*   wl proxd ftm <session-id> collect
+*   wl proxd ftm tune     (TBD)
+*/
+static int
+dhd_rtt_common_set_handler(dhd_pub_t *dhd, const ftm_subcmd_info_t *p_subcmd_info,
+       wl_proxd_method_t method, wl_proxd_session_id_t session_id)
+{
+       uint16 proxd_iovsize;
+       wl_proxd_iov_t *p_proxd_iov;
+       int ret;
+
+#ifdef RTT_DEBUG
+       DHD_RTT(("enter %s: method=%d, session_id=%d, cmdid=%d(%s)\n",
+               __FUNCTION__, method, session_id, p_subcmd_info->cmdid,
+               ftm_cmdid_to_str(p_subcmd_info->cmdid)));
+#endif
+
+       /* allocate and initialize a temp buffer for 'set proxd' iovar */
+       proxd_iovsize = 0;
+       p_proxd_iov = rtt_alloc_getset_buf(dhd, method, session_id, p_subcmd_info->cmdid,
+                       0, &proxd_iovsize);             /* no TLV */
+       if (p_proxd_iov == NULL)
+               return BCME_NOMEM;
+
+       /* no TLV to pack, simply issue a set-proxd iovar */
+       ret = dhd_iovar(dhd, 0, "proxd", (char *)p_proxd_iov, proxd_iovsize, NULL, 0, TRUE);
+#ifdef RTT_DEBUG
+       if (ret != BCME_OK) {
+               DHD_RTT(("error: IOVAR failed, status=%d\n", ret));
+       }
+#endif
+       /* clean up */
+       MFREE(dhd->osh, p_proxd_iov, proxd_iovsize);
+
+       return ret;
+}
+#endif /* WL_CFG80211 */
+
+/* gets the length and returns the version
+ * of the wl_proxd_collect_event_t version
+ */
+static uint
+rtt_collect_data_event_ver(uint16 len)
+{
+       if (len > sizeof(wl_proxd_collect_event_data_v3_t)) {
+               return WL_PROXD_COLLECT_EVENT_DATA_VERSION_MAX;
+       } else if (len == sizeof(wl_proxd_collect_event_data_v4_t)) {
+               return WL_PROXD_COLLECT_EVENT_DATA_VERSION_4;
+       } else if (len == sizeof(wl_proxd_collect_event_data_v3_t)) {
+               return WL_PROXD_COLLECT_EVENT_DATA_VERSION_3;
+       } else if (len == sizeof(wl_proxd_collect_event_data_v2_t)) {
+               return WL_PROXD_COLLECT_EVENT_DATA_VERSION_2;
+       } else {
+               return WL_PROXD_COLLECT_EVENT_DATA_VERSION_1;
+       }
+}
+
+static void
+rtt_collect_event_data_display(uint8 ver, void *ctx, const uint8 *p_data, uint16 len)
+{
+       int i;
+       wl_proxd_collect_event_data_v1_t *p_collect_data_v1 = NULL;
+       wl_proxd_collect_event_data_v2_t *p_collect_data_v2 = NULL;
+       wl_proxd_collect_event_data_v3_t *p_collect_data_v3 = NULL;
+       wl_proxd_collect_event_data_v4_t *p_collect_data_v4 = NULL;
+
+       if (!ctx || !p_data) {
+               return;
+       }
+
+       switch (ver) {
+       case WL_PROXD_COLLECT_EVENT_DATA_VERSION_1:
+               DHD_RTT(("\tVERSION_1\n"));
+               memcpy(ctx, p_data, sizeof(wl_proxd_collect_event_data_v1_t));
+               p_collect_data_v1 = (wl_proxd_collect_event_data_v1_t *)ctx;
+               DHD_RTT(("\tH_RX\n"));
+               for (i = 0; i < K_TOF_COLLECT_H_SIZE_20MHZ; i++) {
+                       p_collect_data_v1->H_RX[i] = ltoh32_ua(&p_collect_data_v1->H_RX[i]);
+                       DHD_RTT(("\t%u\n", p_collect_data_v1->H_RX[i]));
+               }
+               DHD_RTT(("\n"));
+               DHD_RTT(("\tH_LB\n"));
+               for (i = 0; i < K_TOF_COLLECT_H_SIZE_20MHZ; i++) {
+                       p_collect_data_v1->H_LB[i] = ltoh32_ua(&p_collect_data_v1->H_LB[i]);
+                       DHD_RTT(("\t%u\n", p_collect_data_v1->H_LB[i]));
+               }
+               DHD_RTT(("\n"));
+               DHD_RTT(("\tri_rr\n"));
+               for (i = 0; i < FTM_TPK_RI_RR_LEN; i++) {
+                       DHD_RTT(("\t%u\n", p_collect_data_v1->ri_rr[i]));
+               }
+               p_collect_data_v1->phy_err_mask = ltoh32_ua(&p_collect_data_v1->phy_err_mask);
+               DHD_RTT(("\tphy_err_mask=0x%x\n", p_collect_data_v1->phy_err_mask));
+               break;
+       case WL_PROXD_COLLECT_EVENT_DATA_VERSION_2:
+               memcpy(ctx, p_data, sizeof(wl_proxd_collect_event_data_v2_t));
+               p_collect_data_v2 = (wl_proxd_collect_event_data_v2_t *)ctx;
+               DHD_RTT(("\tH_RX\n"));
+               for (i = 0; i < K_TOF_COLLECT_H_SIZE_20MHZ; i++) {
+                       p_collect_data_v2->H_RX[i] = ltoh32_ua(&p_collect_data_v2->H_RX[i]);
+                       DHD_RTT(("\t%u\n", p_collect_data_v2->H_RX[i]));
+               }
+               DHD_RTT(("\n"));
+               DHD_RTT(("\tH_LB\n"));
+               for (i = 0; i < K_TOF_COLLECT_H_SIZE_20MHZ; i++) {
+                       p_collect_data_v2->H_LB[i] = ltoh32_ua(&p_collect_data_v2->H_LB[i]);
+                       DHD_RTT(("\t%u\n", p_collect_data_v2->H_LB[i]));
+               }
+               DHD_RTT(("\n"));
+               DHD_RTT(("\tri_rr\n"));
+               for (i = 0; i < FTM_TPK_RI_RR_LEN_SECURE_2_0; i++) {
+                       DHD_RTT(("\t%u\n", p_collect_data_v2->ri_rr[i]));
+               }
+               p_collect_data_v2->phy_err_mask = ltoh32_ua(&p_collect_data_v2->phy_err_mask);
+               DHD_RTT(("\tphy_err_mask=0x%x\n", p_collect_data_v2->phy_err_mask));
+               break;
+       case WL_PROXD_COLLECT_EVENT_DATA_VERSION_3:
+               memcpy(ctx, p_data, sizeof(wl_proxd_collect_event_data_v3_t));
+               p_collect_data_v3 = (wl_proxd_collect_event_data_v3_t *)ctx;
+               switch (p_collect_data_v3->version) {
+               case WL_PROXD_COLLECT_EVENT_DATA_VERSION_3:
+                       if (p_collect_data_v3->length !=
+                               (len - OFFSETOF(wl_proxd_collect_event_data_v3_t, H_LB))) {
+                               DHD_RTT(("\tversion/length mismatch\n"));
+                               break;
+                       }
+                       DHD_RTT(("\tH_RX\n"));
+                       for (i = 0; i < K_TOF_COLLECT_H_SIZE_20MHZ; i++) {
+                               p_collect_data_v3->H_RX[i] =
+                                       ltoh32_ua(&p_collect_data_v3->H_RX[i]);
+                               DHD_RTT(("\t%u\n", p_collect_data_v3->H_RX[i]));
+                       }
+                       DHD_RTT(("\n"));
+                       DHD_RTT(("\tH_LB\n"));
+                       for (i = 0; i < K_TOF_COLLECT_H_SIZE_20MHZ; i++) {
+                               p_collect_data_v3->H_LB[i] =
+                                       ltoh32_ua(&p_collect_data_v3->H_LB[i]);
+                               DHD_RTT(("\t%u\n", p_collect_data_v3->H_LB[i]));
+                       }
+                       DHD_RTT(("\n"));
+                       DHD_RTT(("\tri_rr\n"));
+                       for (i = 0; i < FTM_TPK_RI_RR_LEN_SECURE_2_0; i++) {
+                               DHD_RTT(("\t%u\n", p_collect_data_v3->ri_rr[i]));
+                       }
+                       p_collect_data_v3->phy_err_mask =
+                               ltoh32_ua(&p_collect_data_v3->phy_err_mask);
+                       DHD_RTT(("\tphy_err_mask=0x%x\n", p_collect_data_v3->phy_err_mask));
+                       break;
+               /* future case */
+               }
+               break;
+       case WL_PROXD_COLLECT_EVENT_DATA_VERSION_4:
+               memcpy(ctx, p_data, sizeof(wl_proxd_collect_event_data_v4_t));
+               p_collect_data_v4 = (wl_proxd_collect_event_data_v4_t *)ctx;
+               switch (p_collect_data_v4->version) {
+               case WL_PROXD_COLLECT_EVENT_DATA_VERSION_4:
+                       if (p_collect_data_v4->length !=
+                               (len - OFFSETOF(wl_proxd_collect_event_data_v4_t, H_LB))) {
+                               DHD_RTT(("\tversion/length mismatch\n"));
+                               break;
+                       }
+                       DHD_RTT(("\tH_RX\n"));
+                       for (i = 0; i < K_TOF_COLLECT_H_SIZE_20MHZ; i++) {
+                               p_collect_data_v4->H_RX[i] =
+                                       ltoh32_ua(&p_collect_data_v4->H_RX[i]);
+                               DHD_RTT(("\t%u\n", p_collect_data_v4->H_RX[i]));
+                       }
+                       DHD_RTT(("\n"));
+                       DHD_RTT(("\tH_LB\n"));
+                       for (i = 0; i < K_TOF_COLLECT_H_SIZE_20MHZ; i++) {
+                               p_collect_data_v4->H_LB[i] =
+                                       ltoh32_ua(&p_collect_data_v4->H_LB[i]);
+                               DHD_RTT(("\t%u\n", p_collect_data_v4->H_LB[i]));
+                       }
+                       DHD_RTT(("\n"));
+                       DHD_RTT(("\tri_rr\n"));
+                       for (i = 0; i < FTM_TPK_RI_RR_LEN_SECURE_2_0_5G; i++) {
+                               DHD_RTT(("\t%u\n", p_collect_data_v4->ri_rr[i]));
+                       }
+                       p_collect_data_v4->phy_err_mask =
+                               ltoh32_ua(&p_collect_data_v4->phy_err_mask);
+                       DHD_RTT(("\tphy_err_mask=0x%x\n", p_collect_data_v4->phy_err_mask));
+                       break;
+               /* future case */
+               }
+               break;
+       }
+}
+
+static uint16
+rtt_result_ver(uint16 tlvid, const uint8 *p_data)
+{
+       uint16 ret = BCME_OK;
+       const wl_proxd_rtt_result_v2_t *r_v2 = NULL;
+
+       switch (tlvid) {
+       case WL_PROXD_TLV_ID_RTT_RESULT:
+               BCM_REFERENCE(p_data);
+               ret = WL_PROXD_RTT_RESULT_VERSION_1;
+               break;
+       case WL_PROXD_TLV_ID_RTT_RESULT_V2:
+               if (p_data) {
+                       r_v2 = (const wl_proxd_rtt_result_v2_t *)p_data;
+                       if (r_v2->version == WL_PROXD_RTT_RESULT_VERSION_2) {
+                               ret = WL_PROXD_RTT_RESULT_VERSION_2;
+                       }
+               }
+               break;
+       default:
+               DHD_RTT_ERR(("%s: > Unsupported TLV ID %d\n",
+                       __FUNCTION__, tlvid));
+               break;
+       }
+       return ret;
+}
+
+/* pretty hex print a contiguous buffer */
+static void
+rtt_prhex(const char *msg, const uint8 *buf, uint nbytes)
+{
+       char line[128], *p;
+       int len = sizeof(line);
+       int nchar;
+       uint i;
+
+       if (msg && (msg[0] != '\0'))
+               DHD_RTT(("%s:\n", msg));
+
+       p = line;
+       for (i = 0; i < nbytes; i++) {
+               if (i % 16 == 0) {
+                       nchar = snprintf(p, len, "  %04d: ", i);        /* line prefix */
+                       p += nchar;
+                       len -= nchar;
+               }
+               if (len > 0) {
+                       nchar = snprintf(p, len, "%02x ", buf[i]);
+                       p += nchar;
+                       len -= nchar;
+               }
+
+               if (i % 16 == 15) {
+                       DHD_RTT(("%s\n", line));        /* flush line */
+                       p = line;
+                       len = sizeof(line);
+               }
+       }
+
+       /* flush last partial line */
+       if (p != line)
+               DHD_RTT(("%s\n", line));
+}
+
+static int
+rtt_unpack_xtlv_cbfn(void *ctx, const uint8 *p_data, uint16 tlvid, uint16 len)
+{
+       int ret = BCME_OK;
+       int i;
+       wl_proxd_ftm_session_status_t *p_data_info = NULL;
+       uint32 chan_data_entry = 0;
+       uint16 expected_rtt_result_ver = 0;
+
+       BCM_REFERENCE(p_data_info);
+
+       switch (tlvid) {
+       case WL_PROXD_TLV_ID_RTT_RESULT:
+       case WL_PROXD_TLV_ID_RTT_RESULT_V2:
+               DHD_RTT(("WL_PROXD_TLV_ID_RTT_RESULT\n"));
+               expected_rtt_result_ver = rtt_result_ver(tlvid, p_data);
+               switch (expected_rtt_result_ver) {
+               case WL_PROXD_RTT_RESULT_VERSION_1:
+                       ret = dhd_rtt_convert_results_to_host_v1((rtt_result_t *)ctx,
+                                       p_data, tlvid, len);
+                       break;
+               case WL_PROXD_RTT_RESULT_VERSION_2:
+                       ret = dhd_rtt_convert_results_to_host_v2((rtt_result_t *)ctx,
+                                       p_data, tlvid, len);
+                       break;
+               default:
+                       DHD_RTT_ERR((" > Unsupported RTT_RESULT version\n"));
+                       ret = BCME_UNSUPPORTED;
+                       break;
+               }
+               break;
+       case WL_PROXD_TLV_ID_SESSION_STATUS:
+               DHD_RTT(("WL_PROXD_TLV_ID_SESSION_STATUS\n"));
+               memcpy(ctx, p_data, sizeof(wl_proxd_ftm_session_status_t));
+               p_data_info = (wl_proxd_ftm_session_status_t *)ctx;
+               p_data_info->sid = ltoh16_ua(&p_data_info->sid);
+               p_data_info->state = ltoh16_ua(&p_data_info->state);
+               p_data_info->status = ltoh32_ua(&p_data_info->status);
+               p_data_info->burst_num = ltoh16_ua(&p_data_info->burst_num);
+               DHD_RTT(("\tsid=%u, state=%d, status=%d, burst_num=%u\n",
+                       p_data_info->sid, p_data_info->state,
+                       p_data_info->status, p_data_info->burst_num));
+
+               break;
+       case WL_PROXD_TLV_ID_COLLECT_DATA:
+               DHD_RTT(("WL_PROXD_TLV_ID_COLLECT_DATA\n"));
+               /* we do not have handle to wl in the context of
+                * xtlv callback without changing the xtlv API.
+                */
+               rtt_collect_event_data_display(
+                       rtt_collect_data_event_ver(len),
+                       ctx, p_data, len);
+               break;
+       case WL_PROXD_TLV_ID_COLLECT_CHAN_DATA:
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               DHD_RTT(("WL_PROXD_TLV_ID_COLLECT_CHAN_DATA\n"));
+               DHD_RTT(("\tchan est %u\n", (uint32) (len / sizeof(uint32))));
+               for (i = 0; (uint16)i < (uint16)(len/sizeof(chan_data_entry)); i++) {
+                       uint32 *p = (uint32*)p_data;
+                       chan_data_entry = ltoh32_ua(p + i);
+                       DHD_RTT(("\t%u\n", chan_data_entry));
+               }
+               GCC_DIAGNOSTIC_POP();
+               break;
+       case WL_PROXD_TLV_ID_MF_STATS_DATA:
+               DHD_RTT(("WL_PROXD_TLV_ID_MF_STATS_DATA\n"));
+               DHD_RTT(("\tmf stats len=%u\n", len));
+               rtt_prhex("", p_data, len);
+               break;
+       default:
+               DHD_RTT_ERR(("> Unsupported TLV ID %d\n", tlvid));
+               ret = BCME_ERROR;
+               break;
+       }
+
+       return ret;
+}
+
+#ifdef WL_CFG80211
+static int
+rtt_handle_config_options(wl_proxd_session_id_t session_id, wl_proxd_tlv_t **p_tlv,
+       uint16 *p_buf_space_left, ftm_config_options_info_t *ftm_configs, int ftm_cfg_cnt)
+{
+       int ret = BCME_OK;
+       int cfg_idx = 0;
+       uint32 flags = WL_PROXD_FLAG_NONE;
+       uint32 flags_mask = WL_PROXD_FLAG_NONE;
+       uint32 new_mask;                /* cmdline input */
+       ftm_config_options_info_t *p_option_info;
+       uint16 type = (session_id == WL_PROXD_SESSION_ID_GLOBAL) ?
+                       WL_PROXD_TLV_ID_FLAGS_MASK : WL_PROXD_TLV_ID_SESSION_FLAGS_MASK;
+       for (cfg_idx = 0; cfg_idx < ftm_cfg_cnt; cfg_idx++) {
+               p_option_info = (ftm_configs + cfg_idx);
+               if (p_option_info != NULL) {
+                       new_mask = p_option_info->flags;
+                       /* update flags mask */
+                       flags_mask |= new_mask;
+                       if (p_option_info->enable) {
+                               flags |= new_mask;      /* set the bit on */
+                       } else {
+                               flags &= ~new_mask;     /* set the bit off */
+                       }
+               }
+       }
+       flags = htol32(flags);
+       flags_mask = htol32(flags_mask);
+       /* setup flags_mask TLV */
+       ret = bcm_pack_xtlv_entry((uint8 **)p_tlv, p_buf_space_left,
+               type, sizeof(uint32), (uint8 *)&flags_mask, BCM_XTLV_OPTION_ALIGN32);
+       if (ret != BCME_OK) {
+               DHD_RTT_ERR(("%s : bcm_pack_xltv_entry() for mask flags failed, status=%d\n",
+                       __FUNCTION__, ret));
+               goto exit;
+       }
+
+       type = (session_id == WL_PROXD_SESSION_ID_GLOBAL)?
+               WL_PROXD_TLV_ID_FLAGS : WL_PROXD_TLV_ID_SESSION_FLAGS;
+       /* setup flags TLV */
+       ret = bcm_pack_xtlv_entry((uint8 **)p_tlv, p_buf_space_left,
+                       type, sizeof(uint32), (uint8 *)&flags, BCM_XTLV_OPTION_ALIGN32);
+               if (ret != BCME_OK) {
+#ifdef RTT_DEBUG
+                       DHD_RTT(("%s: bcm_pack_xltv_entry() for flags failed, status=%d\n",
+                               __FUNCTION__, ret));
+#endif
+               }
+exit:
+       return ret;
+}
+
+static int
+rtt_handle_config_general(wl_proxd_session_id_t session_id, wl_proxd_tlv_t **p_tlv,
+       uint16 *p_buf_space_left, ftm_config_param_info_t *ftm_configs, int ftm_cfg_cnt)
+{
+       int ret = BCME_OK;
+       int cfg_idx = 0;
+       uint32 chanspec;
+       ftm_config_param_info_t *p_config_param_info;
+       void            *p_src_data;
+       uint16  src_data_size;  /* size of data pointed by p_src_data as 'source' */
+       for (cfg_idx = 0; cfg_idx < ftm_cfg_cnt; cfg_idx++) {
+               p_config_param_info = (ftm_configs + cfg_idx);
+               if (p_config_param_info != NULL) {
+                       switch (p_config_param_info->tlvid)     {
+                       case WL_PROXD_TLV_ID_BSS_INDEX:
+                       case WL_PROXD_TLV_ID_FTM_RETRIES:
+                       case WL_PROXD_TLV_ID_FTM_REQ_RETRIES:
+                               p_src_data = &p_config_param_info->data8;
+                               src_data_size = sizeof(uint8);
+                               break;
+                       case WL_PROXD_TLV_ID_BURST_NUM_FTM: /* uint16 */
+                       case WL_PROXD_TLV_ID_NUM_BURST:
+                       case WL_PROXD_TLV_ID_RX_MAX_BURST:
+                               p_src_data = &p_config_param_info->data16;
+                               src_data_size = sizeof(uint16);
+                               break;
+                       case WL_PROXD_TLV_ID_TX_POWER:          /* uint32 */
+                       case WL_PROXD_TLV_ID_RATESPEC:
+                       case WL_PROXD_TLV_ID_EVENT_MASK: /* wl_proxd_event_mask_t/uint32 */
+                       case WL_PROXD_TLV_ID_DEBUG_MASK:
+                               p_src_data = &p_config_param_info->data32;
+                               src_data_size = sizeof(uint32);
+                               break;
+                       case WL_PROXD_TLV_ID_CHANSPEC:          /* chanspec_t --> 32bit */
+                               chanspec = p_config_param_info->chanspec;
+                               p_src_data = (void *) &chanspec;
+                               src_data_size = sizeof(uint32);
+                               break;
+                       case WL_PROXD_TLV_ID_BSSID: /* mac address */
+                       case WL_PROXD_TLV_ID_PEER_MAC:
+                       case WL_PROXD_TLV_ID_CUR_ETHER_ADDR:
+                               p_src_data = &p_config_param_info->mac_addr;
+                               src_data_size = sizeof(struct ether_addr);
+                               break;
+                       case WL_PROXD_TLV_ID_BURST_DURATION:    /* wl_proxd_intvl_t */
+                       case WL_PROXD_TLV_ID_BURST_PERIOD:
+                       case WL_PROXD_TLV_ID_BURST_FTM_SEP:
+                       case WL_PROXD_TLV_ID_BURST_TIMEOUT:
+                       case WL_PROXD_TLV_ID_INIT_DELAY:
+                               p_src_data = &p_config_param_info->data_intvl;
+                               src_data_size = sizeof(wl_proxd_intvl_t);
+                               break;
+                       default:
+                               ret = BCME_BADARG;
+                               break;
+                       }
+                       if (ret != BCME_OK) {
+                               DHD_RTT_ERR(("%s bad TLV ID : %d\n",
+                                       __FUNCTION__, p_config_param_info->tlvid));
+                               break;
+                       }
+
+                       ret = bcm_pack_xtlv_entry((uint8 **) p_tlv, p_buf_space_left,
+                               p_config_param_info->tlvid, src_data_size, (uint8 *)p_src_data,
+                               BCM_XTLV_OPTION_ALIGN32);
+                       if (ret != BCME_OK) {
+                               DHD_RTT_ERR(("%s: bcm_pack_xltv_entry() failed,"
+                                       " status=%d\n", __FUNCTION__, ret));
+                               break;
+                       }
+
+               }
+       }
+       return ret;
+}
+
+static int
+dhd_rtt_ftm_enable(dhd_pub_t *dhd, bool enable)
+{
+       ftm_subcmd_info_t subcmd_info;
+       subcmd_info.name = (enable)? "enable" : "disable";
+       subcmd_info.cmdid = (enable)? WL_PROXD_CMD_ENABLE: WL_PROXD_CMD_DISABLE;
+       subcmd_info.handler = NULL;
+       return dhd_rtt_common_set_handler(dhd, &subcmd_info,
+                       WL_PROXD_METHOD_FTM, WL_PROXD_SESSION_ID_GLOBAL);
+}
+
+static int
+dhd_rtt_start_session(dhd_pub_t *dhd, wl_proxd_session_id_t session_id, bool start)
+{
+       ftm_subcmd_info_t subcmd_info;
+       subcmd_info.name = (start)? "start session" : "stop session";
+       subcmd_info.cmdid = (start)? WL_PROXD_CMD_START_SESSION: WL_PROXD_CMD_STOP_SESSION;
+       subcmd_info.handler = NULL;
+       return dhd_rtt_common_set_handler(dhd, &subcmd_info,
+                       WL_PROXD_METHOD_FTM, session_id);
+}
+
+static int
+dhd_rtt_delete_session(dhd_pub_t *dhd, wl_proxd_session_id_t session_id)
+{
+       ftm_subcmd_info_t subcmd_info;
+       subcmd_info.name = "delete session";
+       subcmd_info.cmdid = WL_PROXD_CMD_DELETE_SESSION;
+       subcmd_info.handler = NULL;
+       return dhd_rtt_common_set_handler(dhd, &subcmd_info,
+                       WL_PROXD_METHOD_FTM, session_id);
+}
+#ifdef WL_NAN
+int
+dhd_rtt_delete_nan_session(dhd_pub_t *dhd)
+{
+       struct net_device *dev = dhd_linux_get_primary_netdev(dhd);
+       struct wireless_dev *wdev = ndev_to_wdev(dev);
+       struct wiphy *wiphy = wdev->wiphy;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       wl_cfgnan_terminate_directed_rtt_sessions(dev, cfg);
+       return BCME_OK;
+}
+/* API to find out if the given Peer Mac from FTM events
+* is nan-peer. Based on this we will handle the SESSION_END
+* event. For nan-peer FTM_SESSION_END event is ignored and handled in
+* nan-ranging-cancel or nan-ranging-end event.
+*/
+static bool
+dhd_rtt_is_nan_peer(dhd_pub_t *dhd, struct ether_addr *peer_mac)
+{
+       struct net_device *dev = dhd_linux_get_primary_netdev(dhd);
+       struct wireless_dev *wdev = ndev_to_wdev(dev);
+       struct wiphy *wiphy = wdev->wiphy;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_ranging_inst_t *ranging_inst = NULL;
+       bool ret = FALSE;
+
+       if ((wl_cfgnan_is_enabled(cfg) == FALSE) || ETHER_ISNULLADDR(peer_mac)) {
+               goto exit;
+       }
+
+       ranging_inst = wl_cfgnan_check_for_ranging(cfg, peer_mac);
+       if (ranging_inst) {
+               DHD_RTT((" RTT peer is of type NAN\n"));
+               ret = TRUE;
+               goto exit;
+       }
+exit:
+       return ret;
+}
+
+static int
+dhd_rtt_nan_start_session(dhd_pub_t *dhd, rtt_target_info_t *rtt_target)
+{
+       s32 err = BCME_OK;
+       struct net_device *dev = dhd_linux_get_primary_netdev(dhd);
+       struct wireless_dev *wdev = ndev_to_wdev(dev);
+       struct wiphy *wiphy = wdev->wiphy;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_ranging_inst_t *ranging_inst = NULL;
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+
+       NAN_MUTEX_LOCK();
+
+       if (!rtt_status) {
+               err = BCME_NOTENABLED;
+               goto done;
+       }
+
+       if (!wl_cfgnan_is_enabled(cfg)) { /* If nan is not enabled report error */
+               err = BCME_NOTENABLED;
+               goto done;
+       }
+
+       ranging_inst = wl_cfgnan_get_ranging_inst(cfg,
+                       &rtt_target->addr, NAN_RANGING_ROLE_INITIATOR);
+       if (!ranging_inst) {
+               err = BCME_NORESOURCE;
+               goto done;
+       }
+
+       DHD_RTT(("Trigger nan based range request\n"));
+       err = wl_cfgnan_trigger_ranging(bcmcfg_to_prmry_ndev(cfg),
+                       cfg, ranging_inst, NULL, NAN_RANGE_REQ_CMD, TRUE);
+       if (unlikely(err)) {
+               goto done;
+       }
+       ranging_inst->range_type = RTT_TYPE_NAN_DIRECTED;
+       ranging_inst->range_role = NAN_RANGING_ROLE_INITIATOR;
+
+       /* schedule proxd timeout */
+       schedule_delayed_work(&rtt_status->proxd_timeout,
+               msecs_to_jiffies(DHD_NAN_RTT_TIMER_INTERVAL_MS));
+
+done:
+       if (err) { /* notify failure RTT event to host */
+               DHD_RTT_ERR(("Failed to issue Nan Ranging Request err %d\n", err));
+               dhd_rtt_handle_nan_rtt_session_end(dhd, &rtt_target->addr);
+               /* try to reset geofence */
+               if (ranging_inst) {
+                       wl_cfgnan_reset_geofence_ranging(cfg, ranging_inst,
+                               RTT_SCHED_DIR_TRIGGER_FAIL);
+               }
+       }
+       NAN_MUTEX_UNLOCK();
+       return err;
+}
+#endif /* WL_NAN */
+
+static int
+dhd_rtt_ftm_config(dhd_pub_t *dhd, wl_proxd_session_id_t session_id,
+       ftm_config_category_t catagory, void *ftm_configs, int ftm_cfg_cnt)
+{
+       ftm_subcmd_info_t subcmd_info;
+       wl_proxd_tlv_t *p_tlv;
+       /* alloc mem for ioctl headr + reserved 0 bufsize for tlvs (initialize to zero) */
+       wl_proxd_iov_t *p_proxd_iov;
+       uint16 proxd_iovsize = 0;
+       uint16 bufsize;
+       uint16 buf_space_left;
+       uint16 all_tlvsize;
+       int ret = BCME_OK;
+
+       subcmd_info.name = "config";
+       subcmd_info.cmdid = WL_PROXD_CMD_CONFIG;
+
+       p_proxd_iov = rtt_alloc_getset_buf(dhd, WL_PROXD_METHOD_FTM, session_id, subcmd_info.cmdid,
+                       FTM_IOC_BUFSZ, &proxd_iovsize);
+
+       if (p_proxd_iov == NULL) {
+               DHD_RTT_ERR(("%s : failed to allocate the iovar (size :%d)\n",
+                       __FUNCTION__, FTM_IOC_BUFSZ));
+               return BCME_NOMEM;
+       }
+       /* setup TLVs */
+       bufsize = proxd_iovsize - WL_PROXD_IOV_HDR_SIZE; /* adjust available size for TLVs */
+       p_tlv = &p_proxd_iov->tlvs[0];
+       /* TLV buffer starts with a full size, will decrement for each packed TLV */
+       buf_space_left = bufsize;
+       if (catagory == FTM_CONFIG_CAT_OPTIONS) {
+               ret = rtt_handle_config_options(session_id, &p_tlv, &buf_space_left,
+                               (ftm_config_options_info_t *)ftm_configs, ftm_cfg_cnt);
+       } else if (catagory == FTM_CONFIG_CAT_GENERAL) {
+               ret = rtt_handle_config_general(session_id, &p_tlv, &buf_space_left,
+                               (ftm_config_param_info_t *)ftm_configs, ftm_cfg_cnt);
+       }
+       if (ret == BCME_OK) {
+               /* update the iov header, set len to include all TLVs + header */
+               all_tlvsize = (bufsize - buf_space_left);
+               p_proxd_iov->len = htol16(all_tlvsize + WL_PROXD_IOV_HDR_SIZE);
+               ret = dhd_iovar(dhd, 0, "proxd", (char *)p_proxd_iov,
+                               all_tlvsize + WL_PROXD_IOV_HDR_SIZE, NULL, 0, TRUE);
+               if (ret != BCME_OK) {
+                       DHD_RTT_ERR(("%s : failed to set config err %d\n", __FUNCTION__, ret));
+               }
+       }
+       /* clean up */
+       MFREE(dhd->osh, p_proxd_iov, proxd_iovsize);
+       return ret;
+}
+
+static int
+dhd_rtt_get_version(dhd_pub_t *dhd, int *out_version)
+{
+       int ret;
+       ftm_subcmd_info_t subcmd_info;
+       subcmd_info.name = "ver";
+       subcmd_info.cmdid = WL_PROXD_CMD_GET_VERSION;
+       subcmd_info.handler = NULL;
+       ret = dhd_rtt_common_get_handler(dhd, &subcmd_info,
+                       WL_PROXD_METHOD_FTM, WL_PROXD_SESSION_ID_GLOBAL);
+       *out_version = (ret == BCME_OK) ? subcmd_info.version : 0;
+       return ret;
+}
+#endif /* WL_CFG80211 */
+
+chanspec_t
+dhd_rtt_convert_to_chspec(wifi_channel_info channel)
+{
+       int bw;
+       chanspec_t chanspec = 0;
+       uint8 center_chan;
+       uint8 primary_chan;
+       /* set witdh to 20MHZ for 2.4G HZ */
+       if (channel.center_freq >= 2400 && channel.center_freq <= 2500) {
+               channel.width = WIFI_CHAN_WIDTH_20;
+       }
+       switch (channel.width) {
+       case WIFI_CHAN_WIDTH_20:
+               bw = WL_CHANSPEC_BW_20;
+               primary_chan = wf_mhz2channel(channel.center_freq, 0);
+               chanspec = wf_channel2chspec(primary_chan, bw);
+               break;
+       case WIFI_CHAN_WIDTH_40:
+               bw = WL_CHANSPEC_BW_40;
+               primary_chan = wf_mhz2channel(channel.center_freq, 0);
+               chanspec = wf_channel2chspec(primary_chan, bw);
+               break;
+       case WIFI_CHAN_WIDTH_80:
+               bw = WL_CHANSPEC_BW_80;
+               primary_chan = wf_mhz2channel(channel.center_freq, 0);
+               center_chan = wf_mhz2channel(channel.center_freq0, 0);
+               chanspec = wf_chspec_80(center_chan, primary_chan);
+               break;
+       default:
+               DHD_RTT_ERR(("doesn't support this bandwith : %d", channel.width));
+               bw = -1;
+               break;
+       }
+       return chanspec;
+}
+
+int
+dhd_rtt_idx_to_burst_duration(uint idx)
+{
+       if (idx >= ARRAY_SIZE(burst_duration_idx)) {
+               return -1;
+       }
+       return burst_duration_idx[idx];
+}
+
+int
+dhd_rtt_set_cfg(dhd_pub_t *dhd, rtt_config_params_t *params)
+{
+       int err = BCME_OK;
+       int idx;
+       rtt_status_info_t *rtt_status = NULL;
+       struct net_device *dev = NULL;
+
+       NULL_CHECK(params, "params is NULL", err);
+       NULL_CHECK(dhd, "dhd is NULL", err);
+
+       dev = dhd_linux_get_primary_netdev(dhd);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       NULL_CHECK(dev, "dev is NULL", err);
+
+       mutex_lock(&rtt_status->rtt_work_mutex);
+       if (!HAS_11MC_CAP(rtt_status->rtt_capa.proto)) {
+               DHD_RTT_ERR(("doesn't support RTT \n"));
+               err = BCME_ERROR;
+               goto exit;
+       }
+
+       DHD_RTT(("%s enter\n", __FUNCTION__));
+
+       if (params->rtt_target_cnt > 0) {
+#ifdef WL_NAN
+               /* cancel ongoing geofence RTT both initiators and responders */
+               wl_cfgnan_suspend_all_geofence_rng_sessions(dev,
+                       RTT_GEO_SUSPN_HOST_DIR_RTT_TRIG, 0);
+#endif /* WL_NAN */
+       } else {
+               err = BCME_BADARG;
+               goto exit;
+       }
+
+       mutex_lock(&rtt_status->rtt_mutex);
+       if (rtt_status->status != RTT_STOPPED) {
+               DHD_RTT_ERR(("rtt is already started\n"));
+               err = BCME_BUSY;
+               goto exit;
+       }
+       memset(rtt_status->rtt_config.target_info, 0, TARGET_INFO_SIZE(RTT_MAX_TARGET_CNT));
+       rtt_status->rtt_config.rtt_target_cnt = params->rtt_target_cnt;
+       memcpy(rtt_status->rtt_config.target_info,
+               params->target_info, TARGET_INFO_SIZE(params->rtt_target_cnt));
+       rtt_status->status = RTT_STARTED;
+       DHD_RTT_MEM(("dhd_rtt_set_cfg: RTT Started, target_cnt = %d\n", params->rtt_target_cnt));
+       /* start to measure RTT from first device */
+       /* find next target to trigger RTT */
+       for (idx = rtt_status->cur_idx; idx < rtt_status->rtt_config.rtt_target_cnt; idx++) {
+               /* skip the disabled device */
+               if (rtt_status->rtt_config.target_info[idx].disable) {
+                       continue;
+               } else {
+                       /* set the idx to cur_idx */
+                       rtt_status->cur_idx = idx;
+                       break;
+               }
+       }
+       if (idx < rtt_status->rtt_config.rtt_target_cnt) {
+               DHD_RTT(("rtt_status->cur_idx : %d\n", rtt_status->cur_idx));
+               rtt_status->rtt_sched_reason = RTT_SCHED_HOST_TRIGGER;
+#ifdef WL_NAN
+               /* Cancel pending retry timer if any */
+               if (delayed_work_pending(&rtt_status->rtt_retry_timer)) {
+                       cancel_delayed_work(&rtt_status->rtt_retry_timer);
+               }
+#endif /* WL_NAN */
+               rtt_status->rtt_sched = TRUE;
+               schedule_work(&rtt_status->work);
+       }
+exit:
+       mutex_unlock(&rtt_status->rtt_mutex);
+       mutex_unlock(&rtt_status->rtt_work_mutex);
+       return err;
+}
+
+#ifdef WL_NAN
+void
+dhd_rtt_initialize_geofence_cfg(dhd_pub_t *dhd)
+{
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       if (!rtt_status) {
+               return;
+       }
+
+       GEOFENCE_RTT_LOCK(rtt_status);
+       memset_s(&rtt_status->geofence_cfg, sizeof(rtt_status->geofence_cfg),
+               0, sizeof(rtt_status->geofence_cfg));
+
+       /* initialize non zero params of geofence cfg */
+       rtt_status->geofence_cfg.cur_target_idx = DHD_RTT_INVALID_TARGET_INDEX;
+       rtt_status->geofence_cfg.geofence_rtt_interval = DHD_RTT_RETRY_TIMER_INTERVAL_MS;
+       rtt_status->geofence_cfg.geofence_sessions_cnt = 0;
+
+       /* This should be polled from device at run time */
+       rtt_status->geofence_cfg.max_geofence_sessions = DHD_NAN_RTT_MAX_GEOF_SESSIONS;
+       GEOFENCE_RTT_UNLOCK(rtt_status);
+       return;
+}
+
+#ifdef RTT_GEOFENCE_CONT
+void
+dhd_rtt_get_geofence_cont_ind(dhd_pub_t *dhd, bool* geofence_cont)
+{
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       if (!rtt_status) {
+               return;
+       }
+       GEOFENCE_RTT_LOCK(rtt_status);
+       *geofence_cont = rtt_status->geofence_cfg.geofence_cont;
+       GEOFENCE_RTT_UNLOCK(rtt_status);
+}
+
+void
+dhd_rtt_set_geofence_cont_ind(dhd_pub_t *dhd, bool geofence_cont)
+{
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       if (!rtt_status) {
+               return;
+       }
+       GEOFENCE_RTT_LOCK(rtt_status);
+       rtt_status->geofence_cfg.geofence_cont = geofence_cont;
+       DHD_RTT(("dhd_rtt_set_geofence_cont_override, geofence_cont = %d\n",
+               rtt_status->geofence_cfg.geofence_cont));
+       GEOFENCE_RTT_UNLOCK(rtt_status);
+}
+#endif /* RTT_GEOFENCE_CONT */
+
+#ifdef RTT_GEOFENCE_INTERVAL
+void
+dhd_rtt_set_geofence_rtt_interval(dhd_pub_t *dhd, int interval)
+{
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       if (!rtt_status) {
+               return;
+       }
+       GEOFENCE_RTT_LOCK(rtt_status);
+       rtt_status->geofence_cfg.geofence_rtt_interval = interval;
+       DHD_RTT(("dhd_rtt_set_geofence_rtt_interval: geofence interval = %d\n",
+               rtt_status->geofence_cfg.geofence_rtt_interval));
+       GEOFENCE_RTT_UNLOCK(rtt_status);
+}
+#endif /* RTT_GEOFENCE_INTERVAL */
+
+int
+dhd_rtt_get_geofence_max_sessions(dhd_pub_t *dhd)
+{
+       int max_sessions;
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       rtt_geofence_cfg_t* geofence_cfg = &rtt_status->geofence_cfg;
+
+       max_sessions = geofence_cfg->max_geofence_sessions;
+       if (dhd_rtt_is_geofence_setup_inprog(dhd)) {
+               /* One slot busy with setup in prog */
+               max_sessions -= 1;
+       }
+
+       return max_sessions;
+}
+
+/*
+ * Return True, if geofence
+ * session count maxed out
+ */
+bool
+dhd_rtt_geofence_sessions_maxed_out(dhd_pub_t *dhd)
+{
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       rtt_geofence_cfg_t* geofence_cfg = &rtt_status->geofence_cfg;
+       bool ret = TRUE;
+
+       if (geofence_cfg->geofence_sessions_cnt <
+               dhd_rtt_get_geofence_max_sessions(dhd)) {
+               ret = FALSE;
+       }
+
+       return ret;
+}
+
+int
+dhd_rtt_get_geofence_sessions_cnt(dhd_pub_t *dhd)
+{
+
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       rtt_geofence_cfg_t* geofence_cfg = &rtt_status->geofence_cfg;
+
+       return geofence_cfg->geofence_sessions_cnt;
+}
+
+int
+dhd_rtt_update_geofence_sessions_cnt(dhd_pub_t *dhd, bool incr,
+       struct ether_addr *peer_addr)
+{
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       rtt_geofence_cfg_t* geofence_cfg = &rtt_status->geofence_cfg;
+       int ret = BCME_OK;
+
+       if (incr) {
+               //ASSERT(!dhd_rtt_geofence_sessions_maxed_out(dhd));
+               if (dhd_rtt_geofence_sessions_maxed_out(dhd)) {
+                       ret = BCME_ERROR;
+                       goto exit;
+               }
+               geofence_cfg->geofence_sessions_cnt++;
+       } else {
+               if (peer_addr && dhd_rtt_is_geofence_setup_inprog_with_peer(dhd,
+                               peer_addr)) {
+                       /* Set geofence RTT in progress state to false */
+                       dhd_rtt_set_geofence_setup_status(dhd, FALSE, NULL);
+               } else {
+                       //ASSERT(geofence_cfg->geofence_sessions_cnt > 0);
+                       if (geofence_cfg->geofence_sessions_cnt <= 0) {
+                               ret = BCME_ERROR;
+                               goto exit;
+                       }
+                       /* Decrement session count */
+                       geofence_cfg->geofence_sessions_cnt--;
+               }
+       }
+       if (peer_addr) {
+               WL_INFORM_MEM(("session cnt update, upd = %d, cnt = %d, peer : "MACDBG", "
+                       " ret = %d\n", incr, geofence_cfg->geofence_sessions_cnt,
+                       MAC2STRDBG(peer_addr), ret));
+       } else {
+               WL_INFORM_MEM(("session cnt update, upd = %d, cnt = %d, ret = %d\n",
+                       incr, geofence_cfg->geofence_sessions_cnt, ret));
+       }
+
+exit:
+       return ret;
+}
+
+int8
+dhd_rtt_get_geofence_target_cnt(dhd_pub_t *dhd)
+{
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       if (!rtt_status) {
+               return 0;
+       }
+       return rtt_status->geofence_cfg.geofence_target_cnt;
+}
+
+/* returns geofence RTT target list Head */
+rtt_geofence_target_info_t*
+dhd_rtt_get_geofence_target_head(dhd_pub_t *dhd)
+{
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       rtt_geofence_target_info_t* head = NULL;
+
+       if (!rtt_status) {
+               return NULL;
+       }
+
+       if (rtt_status->geofence_cfg.geofence_target_cnt) {
+               head = &rtt_status->geofence_cfg.geofence_target_info[0];
+       }
+
+       return head;
+}
+
+int8
+dhd_rtt_get_geofence_cur_target_idx(dhd_pub_t *dhd)
+{
+       int8 target_cnt = 0, cur_idx = DHD_RTT_INVALID_TARGET_INDEX;
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+
+       if (!rtt_status) {
+               goto exit;
+       }
+
+       target_cnt = rtt_status->geofence_cfg.geofence_target_cnt;
+       if (target_cnt == 0) {
+               goto exit;
+       }
+
+       cur_idx = rtt_status->geofence_cfg.cur_target_idx;
+       ASSERT(cur_idx <= target_cnt);
+
+exit:
+       return cur_idx;
+}
+
+void
+dhd_rtt_set_geofence_cur_target_idx(dhd_pub_t *dhd, int8 idx)
+{
+       int8 target_cnt = 0;
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+
+       ASSERT(idx >= 0);
+       target_cnt = rtt_status->geofence_cfg.geofence_target_cnt;
+       ASSERT(idx < target_cnt);
+       rtt_status->geofence_cfg.cur_target_idx = idx;
+       return;
+}
+
+void
+dhd_rtt_move_geofence_cur_target_idx_to_next(dhd_pub_t *dhd)
+{
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+
+       if (!rtt_status) {
+               return;
+       }
+
+       if (rtt_status->geofence_cfg.geofence_target_cnt == 0) {
+               /* Invalidate current idx if no targets */
+               rtt_status->geofence_cfg.cur_target_idx =
+                       DHD_RTT_INVALID_TARGET_INDEX;
+               /* Cancel pending retry timer if any */
+               if (delayed_work_pending(&rtt_status->rtt_retry_timer)) {
+                       cancel_delayed_work(&rtt_status->rtt_retry_timer);
+               }
+               return;
+       }
+       rtt_status->geofence_cfg.cur_target_idx++;
+
+       if (rtt_status->geofence_cfg.cur_target_idx >=
+               rtt_status->geofence_cfg.geofence_target_cnt) {
+               /* Reset once all targets done */
+               rtt_status->geofence_cfg.cur_target_idx = 0;
+       }
+}
+
+/* returns geofence current RTT target */
+rtt_geofence_target_info_t*
+dhd_rtt_get_geofence_current_target(dhd_pub_t *dhd)
+{
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       rtt_geofence_target_info_t* cur_target = NULL;
+       int cur_idx = 0;
+
+       if (!rtt_status) {
+               return NULL;
+       }
+
+       cur_idx = dhd_rtt_get_geofence_cur_target_idx(dhd);
+       if (cur_idx >= 0) {
+               cur_target = &rtt_status->geofence_cfg.geofence_target_info[cur_idx];
+       }
+
+       return cur_target;
+}
+
+/* returns geofence target from list for the peer */
+rtt_geofence_target_info_t*
+dhd_rtt_get_geofence_target(dhd_pub_t *dhd, struct ether_addr* peer_addr, int8 *index)
+{
+       int8 i;
+       rtt_status_info_t *rtt_status;
+       int target_cnt;
+       rtt_geofence_target_info_t *geofence_target_info, *tgt = NULL;
+
+       rtt_status = GET_RTTSTATE(dhd);
+
+       if (!rtt_status) {
+               return NULL;
+       }
+
+       target_cnt = rtt_status->geofence_cfg.geofence_target_cnt;
+       geofence_target_info = rtt_status->geofence_cfg.geofence_target_info;
+
+       /* Loop through to find target */
+       for (i = 0; i < target_cnt; i++) {
+               if (geofence_target_info[i].valid == FALSE) {
+                       break;
+               }
+               if (!memcmp(peer_addr, &geofence_target_info[i].peer_addr,
+                               ETHER_ADDR_LEN)) {
+                       *index = i;
+                       tgt = &geofence_target_info[i];
+               }
+       }
+       if (!tgt) {
+               DHD_RTT(("dhd_rtt_get_geofence_target: Target not found in list,"
+                       " MAC ADDR: "MACDBG" \n", MAC2STRDBG(peer_addr)));
+       }
+       return tgt;
+}
+
+/* add geofence target to the target list */
+int
+dhd_rtt_add_geofence_target(dhd_pub_t *dhd, rtt_geofence_target_info_t *target)
+{
+       int err = BCME_OK;
+       rtt_status_info_t *rtt_status;
+       rtt_geofence_target_info_t  *geofence_target_info;
+       int8 geofence_target_cnt, index;
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+
+       GEOFENCE_RTT_LOCK(rtt_status);
+
+       /* Get the geofence_target via peer addr, index param is dumm here */
+       geofence_target_info = dhd_rtt_get_geofence_target(dhd, &target->peer_addr, &index);
+       if (geofence_target_info) {
+               DHD_RTT(("Duplicate geofencing RTT add request dropped\n"));
+               err = BCME_OK;
+               goto exit;
+       }
+
+       geofence_target_cnt = rtt_status->geofence_cfg.geofence_target_cnt;
+       if (geofence_target_cnt >= RTT_MAX_GEOFENCE_TARGET_CNT) {
+               DHD_RTT(("Queue full, Geofencing RTT add request dropped\n"));
+               err = BCME_NORESOURCE;
+               goto exit;
+       }
+
+       /* Add Geofence RTT request and increment target count */
+       geofence_target_info = rtt_status->geofence_cfg.geofence_target_info;
+       /* src and dest buffer len same, pointers of same DS statically allocated */
+       (void)memcpy_s(&geofence_target_info[geofence_target_cnt],
+               sizeof(geofence_target_info[geofence_target_cnt]), target,
+               sizeof(*target));
+       geofence_target_info[geofence_target_cnt].valid = TRUE;
+       rtt_status->geofence_cfg.geofence_target_cnt++;
+       if (rtt_status->geofence_cfg.geofence_target_cnt == 1) {
+               /* Adding first target */
+               rtt_status->geofence_cfg.cur_target_idx = 0;
+       }
+
+exit:
+       GEOFENCE_RTT_UNLOCK(rtt_status);
+       return err;
+}
+
+/* removes geofence target from the target list */
+int
+dhd_rtt_remove_geofence_target(dhd_pub_t *dhd, struct ether_addr *peer_addr)
+{
+       int err = BCME_OK;
+       rtt_status_info_t *rtt_status;
+       rtt_geofence_target_info_t  *geofence_target_info;
+       int8 geofence_target_cnt, j, index = 0;
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+
+       GEOFENCE_RTT_LOCK(rtt_status);
+
+       geofence_target_cnt = dhd_rtt_get_geofence_target_cnt(dhd);
+       if (geofence_target_cnt == 0) {
+               DHD_RTT(("Queue Empty, Geofencing RTT remove request dropped\n"));
+               ASSERT(0);
+               goto exit;
+       }
+
+       /* Get the geofence_target via peer addr */
+       geofence_target_info = dhd_rtt_get_geofence_target(dhd, peer_addr, &index);
+       if (geofence_target_info == NULL) {
+               DHD_RTT(("Geofencing RTT target not found, remove request dropped\n"));
+               err = BCME_NOTFOUND;
+               goto exit;
+       }
+
+       /* left shift all the valid entries, as we dont keep holes in list */
+       for (j = index; j < geofence_target_cnt; j++) {
+               /*
+                * src and dest buffer len same, pointers of same DS
+                * statically allocated
+                */
+               if ((j + 1) < geofence_target_cnt) {
+                       (void)memcpy_s(&geofence_target_info[j], sizeof(geofence_target_info[j]),
+                               &geofence_target_info[j + 1], sizeof(geofence_target_info[j + 1]));
+               } else {
+                       /* reset the last target info */
+                       bzero(&geofence_target_info[j], sizeof(rtt_geofence_target_info_t));
+               }
+       }
+
+       rtt_status->geofence_cfg.geofence_target_cnt--;
+       if ((rtt_status->geofence_cfg.geofence_target_cnt == 0) ||
+               (index == rtt_status->geofence_cfg.cur_target_idx)) {
+               /* Move cur_idx to next target */
+               dhd_rtt_move_geofence_cur_target_idx_to_next(dhd);
+       } else if (index < rtt_status->geofence_cfg.cur_target_idx) {
+               /* Decrement cur index if cur target position changed */
+               rtt_status->geofence_cfg.cur_target_idx--;
+       }
+
+exit:
+       GEOFENCE_RTT_UNLOCK(rtt_status);
+       return err;
+}
+
+/* deletes/empty geofence target list */
+int
+dhd_rtt_delete_geofence_target_list(dhd_pub_t *dhd)
+{
+       rtt_status_info_t *rtt_status;
+
+       int err = BCME_OK;
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       GEOFENCE_RTT_LOCK(rtt_status);
+       memset_s(&rtt_status->geofence_cfg, sizeof(rtt_geofence_cfg_t),
+               0, sizeof(rtt_geofence_cfg_t));
+       GEOFENCE_RTT_UNLOCK(rtt_status);
+       return err;
+}
+
+rtt_geofence_setup_status_t*
+dhd_rtt_get_geofence_setup_status(dhd_pub_t *dhd)
+{
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       rtt_geofence_cfg_t* geofence_cfg = &rtt_status->geofence_cfg;
+       rtt_geofence_setup_status_t* rng_setup_status;
+
+       rng_setup_status = &geofence_cfg->geofence_setup_status;
+       return rng_setup_status;
+}
+
+bool
+dhd_rtt_is_geofence_setup_inprog(dhd_pub_t *dhd)
+{
+       rtt_geofence_setup_status_t* rng_setup_status;
+
+       rng_setup_status = dhd_rtt_get_geofence_setup_status(dhd);
+
+       return rng_setup_status->geofence_setup_inprog;
+}
+
+bool
+dhd_rtt_is_geofence_setup_inprog_with_peer(dhd_pub_t *dhd,
+               struct ether_addr *peer_addr)
+{
+       rtt_geofence_setup_status_t* rng_setup_status;
+       struct nan_ranging_inst *rng_inst = NULL;
+       struct net_device *dev = dhd_linux_get_primary_netdev(dhd);
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       bool ret = FALSE;
+
+       rng_setup_status = dhd_rtt_get_geofence_setup_status(dhd);
+       if (rng_setup_status->geofence_setup_inprog == FALSE) {
+               goto exit;
+       }
+       rng_inst = wl_cfgnan_check_for_ranging(cfg, peer_addr);
+       if (rng_inst && (rng_inst == rng_setup_status->rng_inst)) {
+               ret = TRUE;
+       }
+
+exit:
+       return ret;
+}
+
+/*
+ * Call with inprog as true and corresponding
+ * rng_inst, to take setup lock,
+ * call with inprog as False and rng_inst as NULL
+ * to unlock setup lock
+ */
+void
+dhd_rtt_set_geofence_setup_status(dhd_pub_t *dhd, bool inprog,
+               struct ether_addr *peer_addr)
+{
+       struct nan_ranging_inst *rng_inst = NULL;
+       struct net_device *dev = dhd_linux_get_primary_netdev(dhd);
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       rtt_geofence_setup_status_t* rng_setup_status;
+
+       rng_setup_status = dhd_rtt_get_geofence_setup_status(dhd);
+       rng_setup_status->geofence_setup_inprog = inprog;
+       if (inprog) {
+               ASSERT(peer_addr);
+               rng_inst = wl_cfgnan_check_for_ranging(cfg, peer_addr);
+               ASSERT(rng_inst);
+               if (rng_inst) {
+                       rng_setup_status->rng_inst = rng_inst;
+               }
+       } else {
+               rng_setup_status->rng_inst = NULL;
+       }
+}
+
+int
+dhd_rtt_sched_geofencing_target(dhd_pub_t *dhd)
+{
+       rtt_geofence_target_info_t  *geofence_target_info;
+       struct net_device *dev = dhd_linux_get_primary_netdev(dhd);
+       int ret = BCME_OK;
+       u8 rtt_invalid_reason = RTT_STATE_VALID;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       rtt_geofence_cfg_t* geofence_cfg = &rtt_status->geofence_cfg;
+       int8 target_cnt = 0;
+
+       NAN_MUTEX_LOCK();
+
+       if (wl_cfgnan_is_enabled(cfg) == FALSE) {
+               ret = BCME_NOTENABLED;
+               goto done;
+       }
+
+       DHD_RTT_ERR(("dhd_rtt_sched_geofencing_target: "
+               " sched_reason = %d, sessions cnt = %d, cur target idx = %d\n",
+               rtt_status->rtt_sched_reason, geofence_cfg->geofence_sessions_cnt,
+               rtt_status->geofence_cfg.cur_target_idx));
+
+       //ASSERT(!dhd_rtt_geofence_sessions_maxed_out(dhd));
+       if (dhd_rtt_geofence_sessions_maxed_out(dhd)) {
+               ret = BCME_NORESOURCE;
+               goto done;
+       }
+
+       target_cnt = dhd_rtt_get_geofence_target_cnt(dhd);
+
+       if (target_cnt == 0) {
+               DHD_RTT_MEM(("dhd_rtt_sched_geofencing_target: "
+                       "No geofence targets to schedule\n"));
+               goto done;
+       }
+
+       /* Get current geofencing target */
+       geofence_target_info = dhd_rtt_get_geofence_current_target(dhd);
+       //ASSERT(geofence_target_info);
+
+       /* call cfg API for trigerring geofencing RTT */
+       if (geofence_target_info) {
+               /* check for dp/others concurrency */
+               rtt_invalid_reason = dhd_rtt_invalid_states(dev,
+                               &geofence_target_info->peer_addr);
+               if (rtt_invalid_reason != RTT_STATE_VALID) {
+                       /* TODO: see if we can move to next target..
+                       * i.e, if invalid state is due to DP with same peer
+                       */
+                       ret = BCME_BUSY;
+                       DHD_RTT_ERR(("DRV State is not valid for RTT, "
+                               "invalid_state = %d\n", rtt_invalid_reason));
+                       goto done;
+               }
+
+               ret = wl_cfgnan_trigger_geofencing_ranging(dev,
+                               &geofence_target_info->peer_addr);
+               if (ret == BCME_OK) {
+                       dhd_rtt_set_geofence_setup_status(dhd, TRUE,
+                               &geofence_target_info->peer_addr);
+               }
+       } else {
+               DHD_RTT(("No RTT target to schedule\n"));
+               ret = BCME_NOTFOUND;
+       }
+
+done:
+       NAN_MUTEX_UNLOCK();
+       return ret;
+}
+#endif /* WL_NAN */
+
+#ifdef WL_CFG80211
+#ifdef WL_NAN
+static void
+dhd_rtt_retry(dhd_pub_t *dhd)
+{
+
+       /* Attempt RTT for current geofence target */
+       wl_cfgnan_reset_geofence_ranging_for_cur_target(dhd,
+               RTT_SCHED_RTT_RETRY_GEOFENCE);
+
+}
+static void
+dhd_rtt_retry_work(struct work_struct *work)
+{
+       rtt_status_info_t *rtt_status = NULL;
+       dhd_pub_t *dhd = NULL;
+       struct net_device *dev = NULL;
+       struct bcm_cfg80211 *cfg = NULL;
+
+       if (!work) {
+               goto exit;
+       }
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wcast-qual"
+#endif
+       rtt_status = container_of(work, rtt_status_info_t, rtt_retry_timer.work);
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+
+       dhd = rtt_status->dhd;
+       if (dhd == NULL) {
+               DHD_RTT_ERR(("%s : dhd is NULL\n", __FUNCTION__));
+               goto exit;
+       }
+       dev = dhd_linux_get_primary_netdev(dhd);
+       cfg = wl_get_cfg(dev);
+
+       NAN_MUTEX_LOCK();
+       mutex_lock(&rtt_status->rtt_mutex);
+       (void) dhd_rtt_retry(dhd);
+       mutex_unlock(&rtt_status->rtt_mutex);
+       NAN_MUTEX_UNLOCK();
+
+exit:
+       return;
+}
+#endif /* WL_NAN */
+
+/*
+ * Return zero (0)
+ * for valid RTT state
+ * means if RTT is applicable
+ */
+uint8
+dhd_rtt_invalid_states(struct net_device *ndev, struct ether_addr *peer_addr)
+{
+       uint8 invalid_reason = RTT_STATE_VALID;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+
+       UNUSED_PARAMETER(cfg);
+       UNUSED_PARAMETER(invalid_reason);
+
+       /* Make sure peer addr is not NULL in caller */
+       ASSERT(peer_addr);
+       /*
+        * Keep adding prohibited drv states here
+        * Only generic conditions which block
+        * All RTTs like NDP connection
+        */
+
+#ifdef WL_NAN
+       if (wl_cfgnan_data_dp_exists_with_peer(cfg, peer_addr)) {
+               invalid_reason = RTT_STATE_INV_REASON_NDP_EXIST;
+               DHD_RTT(("NDP in progress/connected, RTT prohibited\n"));
+               goto exit;
+       }
+#endif /* WL_NAN */
+
+       /* Remove below #defines once more exit calls come */
+#ifdef WL_NAN
+exit:
+#endif /* WL_NAN */
+       return invalid_reason;
+}
+#endif /* WL_CFG80211 */
+
+void
+dhd_rtt_schedule_rtt_work_thread(dhd_pub_t *dhd, int sched_reason)
+{
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       if (rtt_status == NULL) {
+               ASSERT(0);
+       } else {
+#ifdef WL_NAN
+               /* Cancel pending retry timer if any */
+               if (delayed_work_pending(&rtt_status->rtt_retry_timer)) {
+                       cancel_delayed_work(&rtt_status->rtt_retry_timer);
+               }
+#endif /* WL_NAN */
+               rtt_status->rtt_sched_reason = sched_reason;
+               rtt_status->rtt_sched = TRUE;
+               schedule_work(&rtt_status->work);
+       }
+       return;
+}
+
+int
+dhd_rtt_stop(dhd_pub_t *dhd, struct ether_addr *mac_list, int mac_cnt)
+{
+       int err = BCME_OK;
+#ifdef WL_CFG80211
+       int i = 0, j = 0;
+       rtt_status_info_t *rtt_status;
+       rtt_results_header_t *entry, *next;
+       rtt_result_t *rtt_result, *next2;
+       struct rtt_noti_callback *iter;
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       if (rtt_status->status == RTT_STOPPED) {
+               DHD_RTT_ERR(("rtt is not started\n"));
+               return BCME_OK;
+       }
+       DHD_RTT(("%s enter\n", __FUNCTION__));
+       mutex_lock(&rtt_status->rtt_mutex);
+       for (i = 0; i < mac_cnt; i++) {
+               for (j = 0; j < rtt_status->rtt_config.rtt_target_cnt; j++) {
+                       if (!bcmp(&mac_list[i], &rtt_status->rtt_config.target_info[j].addr,
+                               ETHER_ADDR_LEN)) {
+                               rtt_status->rtt_config.target_info[j].disable = TRUE;
+                       }
+               }
+       }
+       if (rtt_status->all_cancel) {
+               /* cancel all of request */
+               rtt_status->status = RTT_STOPPED;
+               DHD_RTT(("current RTT process is cancelled\n"));
+               /* remove the rtt results in cache */
+               if (!list_empty(&rtt_status->rtt_results_cache)) {
+                       /* Iterate rtt_results_header list */
+                       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                       list_for_each_entry_safe(entry, next,
+                               &rtt_status->rtt_results_cache, list) {
+                               list_del(&entry->list);
+                               /* Iterate rtt_result list */
+                               list_for_each_entry_safe(rtt_result, next2,
+                                       &entry->result_list, list) {
+                                       list_del(&rtt_result->list);
+                                       MFREE(dhd->osh, rtt_result,
+                                               sizeof(rtt_result_t));
+                               }
+                               MFREE(dhd->osh, entry, sizeof(rtt_results_header_t));
+                       }
+                       GCC_DIAGNOSTIC_POP();
+               }
+               /* send the rtt complete event to wake up the user process */
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               list_for_each_entry(iter, &rtt_status->noti_fn_list, list) {
+                       GCC_DIAGNOSTIC_POP();
+                       iter->noti_fn(iter->ctx, &rtt_status->rtt_results_cache);
+               }
+               /* reinitialize the HEAD */
+               INIT_LIST_HEAD(&rtt_status->rtt_results_cache);
+               /* clear information for rtt_config */
+               rtt_status->rtt_config.rtt_target_cnt = 0;
+               memset(rtt_status->rtt_config.target_info, 0,
+                       TARGET_INFO_SIZE(RTT_MAX_TARGET_CNT));
+               rtt_status->cur_idx = 0;
+               /* Cancel pending proxd timeout work if any */
+               if (delayed_work_pending(&rtt_status->proxd_timeout)) {
+                       cancel_delayed_work(&rtt_status->proxd_timeout);
+               }
+               dhd_rtt_delete_session(dhd, FTM_DEFAULT_SESSION);
+#ifdef WL_NAN
+               dhd_rtt_delete_nan_session(dhd);
+#endif /* WL_NAN */
+               dhd_rtt_ftm_enable(dhd, FALSE);
+       }
+       mutex_unlock(&rtt_status->rtt_mutex);
+#endif /* WL_CFG80211 */
+       return err;
+}
+
+#ifdef WL_CFG80211
+static void
+dhd_rtt_timeout(dhd_pub_t *dhd)
+{
+       rtt_status_info_t *rtt_status;
+#ifndef DHD_DUMP_ON_RTT_TIMEOUT
+       rtt_target_info_t *rtt_target = NULL;
+       rtt_target_info_t *rtt_target_info = NULL;
+#ifdef WL_NAN
+       nan_ranging_inst_t *ranging_inst = NULL;
+       int ret = BCME_OK;
+       uint32 status;
+       struct net_device *ndev = dhd_linux_get_primary_netdev(dhd);
+       struct bcm_cfg80211 *cfg =  wiphy_priv(ndev->ieee80211_ptr->wiphy);
+#endif /* WL_NAN */
+#endif /* !DHD_DUMP_ON_RTT_TIMEOUT */
+
+       rtt_status = GET_RTTSTATE(dhd);
+       if (!rtt_status) {
+               DHD_RTT_ERR(("Proxd timer expired but no RTT status\n"));
+               goto exit;
+       }
+
+       if (RTT_IS_STOPPED(rtt_status)) {
+               DHD_RTT_ERR(("Proxd timer expired but no RTT Request\n"));
+               goto exit;
+       }
+
+#ifdef DHD_DUMP_ON_RTT_TIMEOUT
+       /* Dump, and Panic depending on memdump.info */
+       if (dhd_query_bus_erros(dhd)) {
+               goto exit;
+       }
+#ifdef DHD_FW_COREDUMP
+       if (dhd->memdump_enabled) {
+               /* Behave based on user memdump info */
+               dhd->memdump_type = DUMP_TYPE_PROXD_TIMEOUT;
+               dhd_bus_mem_dump(dhd);
+       }
+#endif /* DHD_FW_COREDUMP */
+#else /* DHD_DUMP_ON_RTT_TIMEOUT */
+       /* Cancel RTT for target and proceed to next target */
+       rtt_target_info = rtt_status->rtt_config.target_info;
+       if ((!rtt_target_info) ||
+               (rtt_status->cur_idx >= rtt_status->rtt_config.rtt_target_cnt)) {
+               goto exit;
+       }
+       rtt_target = &rtt_target_info[rtt_status->cur_idx];
+       WL_ERR(("Proxd timer expired for Target: "MACDBG" \n", MAC2STRDBG(&rtt_target->addr)));
+#ifdef WL_NAN
+       if (rtt_target->peer == RTT_PEER_NAN) {
+               ranging_inst = wl_cfgnan_check_for_ranging(cfg, &rtt_target->addr);
+               if (!ranging_inst) {
+                       goto exit;
+               }
+               ret =  wl_cfgnan_cancel_ranging(ndev, cfg, &ranging_inst->range_id,
+                               NAN_RNG_TERM_FLAG_IMMEDIATE, &status);
+               if (unlikely(ret) || unlikely(status)) {
+                       WL_ERR(("%s:nan range cancel failed ret = %d status = %d\n",
+                               __FUNCTION__, ret, status));
+               }
+       } else
+#endif /* WL_NAN */
+       {
+               /* For Legacy RTT */
+               dhd_rtt_delete_session(dhd, FTM_DEFAULT_SESSION);
+       }
+       dhd_rtt_create_failure_result(rtt_status, &rtt_target->addr);
+       dhd_rtt_handle_rtt_session_end(dhd);
+#endif /* DHD_DUMP_ON_RTT_TIMEOUT */
+exit:
+       return;
+}
+
+static void
+dhd_rtt_timeout_work(struct work_struct *work)
+{
+       rtt_status_info_t *rtt_status = NULL;
+       dhd_pub_t *dhd = NULL;
+
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wcast-qual"
+#endif
+       rtt_status = container_of(work, rtt_status_info_t, proxd_timeout.work);
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+
+       dhd = rtt_status->dhd;
+       if (dhd == NULL) {
+               DHD_RTT_ERR(("%s : dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+       mutex_lock(&rtt_status->rtt_mutex);
+       (void) dhd_rtt_timeout(dhd);
+       mutex_unlock(&rtt_status->rtt_mutex);
+}
+
+static void
+dhd_rtt_set_ftm_config_ratespec(ftm_config_param_info_t *ftm_params,
+               int *ftm_param_cnt, rtt_target_info_t *rtt_target)
+{
+       bool use_default = FALSE;
+       int nss;
+       int mcs;
+       uint32 rspec = 0;
+
+       if (!(rtt_target->bw && rtt_target->preamble)) {
+               goto exit;
+       }
+       switch (rtt_target->preamble) {
+               case RTT_PREAMBLE_LEGACY:
+                       rspec |= WL_RSPEC_ENCODE_RATE; /* 11abg */
+                       rspec |= WL_RATE_6M;
+                       break;
+               case RTT_PREAMBLE_HT:
+                       rspec |= WL_RSPEC_ENCODE_HT; /* 11n HT */
+                       mcs = 0; /* default MCS 0 */
+                       rspec |= mcs;
+                       break;
+               case RTT_PREAMBLE_VHT:
+                       rspec |= WL_RSPEC_ENCODE_VHT; /* 11ac VHT */
+                       mcs = 0; /* default MCS 0 */
+                       nss = 1; /* default Nss = 1  */
+                       rspec |= (nss << WL_RSPEC_VHT_NSS_SHIFT) | mcs;
+                       break;
+               default:
+                       DHD_RTT(("doesn't support this preamble : %d\n",
+                               rtt_target->preamble));
+                       use_default = TRUE;
+                       break;
+       }
+       switch (rtt_target->bw) {
+               case RTT_BW_20:
+                       rspec |= WL_RSPEC_BW_20MHZ;
+                       break;
+               case RTT_BW_40:
+                       rspec |= WL_RSPEC_BW_40MHZ;
+                       break;
+               case RTT_BW_80:
+                       rspec |= WL_RSPEC_BW_80MHZ;
+                       break;
+               default:
+                       DHD_RTT(("doesn't support this BW : %d\n",
+                               rtt_target->bw));
+                       use_default = TRUE;
+                       break;
+       }
+       if (!use_default) {
+               ftm_params[*ftm_param_cnt].data32 = htol32(rspec);
+               ftm_params[*ftm_param_cnt].tlvid =
+                       WL_PROXD_TLV_ID_RATESPEC;
+               *ftm_param_cnt = *ftm_param_cnt + 1;
+               DHD_RTT((">\t ratespec : %d\n", rspec));
+       }
+
+exit:
+       return;
+
+}
+
+static void
+dhd_rtt_set_ftm_config_param(ftm_config_param_info_t *ftm_params,
+       int *ftm_param_cnt, rtt_target_info_t *rtt_target, uint16 tlvid)
+{
+       char eabuf[ETHER_ADDR_STR_LEN];
+       char chanbuf[CHANSPEC_STR_LEN];
+
+       switch (tlvid) {
+               case WL_PROXD_TLV_ID_CUR_ETHER_ADDR:
+                       /* local mac address */
+                       if (!ETHER_ISNULLADDR(rtt_target->local_addr.octet)) {
+                               ftm_params[*ftm_param_cnt].mac_addr = rtt_target->local_addr;
+                               ftm_params[*ftm_param_cnt].tlvid = WL_PROXD_TLV_ID_CUR_ETHER_ADDR;
+                               *ftm_param_cnt = *ftm_param_cnt + 1;
+                               bcm_ether_ntoa(&rtt_target->local_addr, eabuf);
+                               DHD_RTT((">\t local %s\n", eabuf));
+                       }
+                       break;
+               case WL_PROXD_TLV_ID_PEER_MAC:
+                       /* target's mac address */
+                       if (!ETHER_ISNULLADDR(rtt_target->addr.octet)) {
+                               ftm_params[*ftm_param_cnt].mac_addr = rtt_target->addr;
+                               ftm_params[*ftm_param_cnt].tlvid = WL_PROXD_TLV_ID_PEER_MAC;
+                               *ftm_param_cnt = *ftm_param_cnt + 1;
+                               bcm_ether_ntoa(&rtt_target->addr, eabuf);
+                               DHD_RTT((">\t target %s\n", eabuf));
+                       }
+                       break;
+               case WL_PROXD_TLV_ID_CHANSPEC:
+                       /* target's chanspec */
+                       if (rtt_target->chanspec) {
+                               ftm_params[*ftm_param_cnt].chanspec =
+                                       htol32((uint32)rtt_target->chanspec);
+                               ftm_params[*ftm_param_cnt].tlvid = WL_PROXD_TLV_ID_CHANSPEC;
+                               *ftm_param_cnt = *ftm_param_cnt + 1;
+                               wf_chspec_ntoa(rtt_target->chanspec, chanbuf);
+                               DHD_RTT((">\t chanspec : %s\n", chanbuf));
+                       }
+                       break;
+               case WL_PROXD_TLV_ID_NUM_BURST:
+                       /* num-burst */
+                       if (rtt_target->num_burst) {
+                               ftm_params[*ftm_param_cnt].data16 = htol16(rtt_target->num_burst);
+                               ftm_params[*ftm_param_cnt].tlvid = WL_PROXD_TLV_ID_NUM_BURST;
+                               *ftm_param_cnt = *ftm_param_cnt + 1;
+                               DHD_RTT((">\t num of burst : %d\n", rtt_target->num_burst));
+                       }
+                       break;
+               case WL_PROXD_TLV_ID_BURST_NUM_FTM:
+                       /* number of frame per burst */
+                       rtt_target->num_frames_per_burst = FTM_DEFAULT_CNT_80M;
+                       if (CHSPEC_IS80(rtt_target->chanspec)) {
+                               rtt_target->num_frames_per_burst = FTM_DEFAULT_CNT_80M;
+                       } else if (CHSPEC_IS40(rtt_target->chanspec)) {
+                               rtt_target->num_frames_per_burst = FTM_DEFAULT_CNT_40M;
+                       } else if (CHSPEC_IS20(rtt_target->chanspec)) {
+                               rtt_target->num_frames_per_burst = FTM_DEFAULT_CNT_20M;
+                       }
+                       ftm_params[*ftm_param_cnt].data16 =
+                               htol16(rtt_target->num_frames_per_burst);
+                       ftm_params[*ftm_param_cnt].tlvid =
+                               WL_PROXD_TLV_ID_BURST_NUM_FTM;
+                       *ftm_param_cnt = *ftm_param_cnt + 1;
+                       DHD_RTT((">\t number of frame per burst : %d\n",
+                               rtt_target->num_frames_per_burst));
+                       break;
+               case WL_PROXD_TLV_ID_FTM_RETRIES:
+                       /* FTM retry count */
+                       if (rtt_target->num_retries_per_ftm) {
+                               ftm_params[*ftm_param_cnt].data8 = rtt_target->num_retries_per_ftm;
+                               ftm_params[*ftm_param_cnt].tlvid = WL_PROXD_TLV_ID_FTM_RETRIES;
+                               *ftm_param_cnt = *ftm_param_cnt + 1;
+                               DHD_RTT((">\t retry count of FTM  : %d\n",
+                                       rtt_target->num_retries_per_ftm));
+                       }
+                       break;
+               case WL_PROXD_TLV_ID_FTM_REQ_RETRIES:
+                       /* FTM Request retry count */
+                       if (rtt_target->num_retries_per_ftmr) {
+                               ftm_params[*ftm_param_cnt].data8 = rtt_target->num_retries_per_ftmr;
+                               ftm_params[*ftm_param_cnt].tlvid =
+                                       WL_PROXD_TLV_ID_FTM_REQ_RETRIES;
+                               *ftm_param_cnt = *ftm_param_cnt + 1;
+                               DHD_RTT((">\t retry count of FTM Req : %d\n",
+                                       rtt_target->num_retries_per_ftmr));
+                       }
+                       break;
+               case WL_PROXD_TLV_ID_BURST_PERIOD:
+                       /* burst-period */
+                       if (rtt_target->burst_period) {
+                               ftm_params[*ftm_param_cnt].data_intvl.intvl =
+                                       htol32(rtt_target->burst_period); /* ms */
+                               ftm_params[*ftm_param_cnt].data_intvl.tmu = WL_PROXD_TMU_MILLI_SEC;
+                               ftm_params[*ftm_param_cnt].tlvid = WL_PROXD_TLV_ID_BURST_PERIOD;
+                               *ftm_param_cnt = *ftm_param_cnt + 1;
+                               DHD_RTT((">\t burst period : %d ms\n", rtt_target->burst_period));
+                       }
+                       break;
+               case WL_PROXD_TLV_ID_BURST_DURATION:
+                       /* burst-duration */
+                       rtt_target->burst_duration = FTM_MAX_BURST_DUR_TMO_MS;
+                       if (rtt_target->burst_duration) {
+                               ftm_params[*ftm_param_cnt].data_intvl.intvl =
+                                       htol32(rtt_target->burst_duration); /* ms */
+                               ftm_params[*ftm_param_cnt].data_intvl.tmu = WL_PROXD_TMU_MILLI_SEC;
+                               ftm_params[*ftm_param_cnt].tlvid = WL_PROXD_TLV_ID_BURST_DURATION;
+                               *ftm_param_cnt = *ftm_param_cnt + 1;
+                               DHD_RTT((">\t burst duration : %d ms\n",
+                                       rtt_target->burst_duration));
+                       }
+                       break;
+               case WL_PROXD_TLV_ID_BURST_TIMEOUT:
+                       /* burst-timeout */
+                       rtt_target->burst_timeout = FTM_MAX_BURST_DUR_TMO_MS;
+                       if (rtt_target->burst_timeout) {
+                               ftm_params[*ftm_param_cnt].data_intvl.intvl =
+                                       htol32(rtt_target->burst_timeout); /* ms */
+                               ftm_params[*ftm_param_cnt].data_intvl.tmu = WL_PROXD_TMU_MILLI_SEC;
+                               ftm_params[*ftm_param_cnt].tlvid = WL_PROXD_TLV_ID_BURST_TIMEOUT;
+                               *ftm_param_cnt = *ftm_param_cnt + 1;
+                               DHD_RTT((">\t burst timeout : %d ms\n",
+                                       rtt_target->burst_timeout));
+                       }
+                       break;
+               case WL_PROXD_TLV_ID_RATESPEC:
+                       dhd_rtt_set_ftm_config_ratespec(ftm_params,
+                               ftm_param_cnt, rtt_target);
+                       break;
+               case WL_PROXD_TLV_ID_EVENT_MASK:
+                       {
+                               /* set burst end and session end in ev mask by def */
+                               uint32 event_mask = ((1 << WL_PROXD_EVENT_BURST_END) |
+                                               (1 << WL_PROXD_EVENT_SESSION_END));
+                               /* only burst end for directed nan-rtt target */
+                               if (rtt_target && (rtt_target->peer == RTT_PEER_NAN)) {
+                                       event_mask = (1 << WL_PROXD_EVENT_BURST_END);
+                               }
+                               ftm_params[*ftm_param_cnt].event_mask = event_mask;
+                               ftm_params[*ftm_param_cnt].tlvid = WL_PROXD_TLV_ID_EVENT_MASK;
+                               *ftm_param_cnt = *ftm_param_cnt + 1;
+                       }
+                       break;
+               default:
+                       DHD_RTT_ERR(("Invalid FTM Param Config, tlvid = %d\n", tlvid));
+                       break;
+       }
+
+       return;
+}
+
+static int
+dhd_rtt_start(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       int err_at = 0;
+       int ftm_cfg_cnt = 0;
+       int ftm_param_cnt = 0;
+       ftm_config_options_info_t ftm_configs[FTM_MAX_CONFIGS];
+       ftm_config_param_info_t ftm_params[FTM_MAX_PARAMS];
+       rtt_target_info_t *rtt_target;
+       rtt_status_info_t *rtt_status;
+       struct net_device *dev = dhd_linux_get_primary_netdev(dhd);
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+       u8 rtt_invalid_reason = RTT_STATE_VALID;
+       int rtt_sched_type = RTT_TYPE_INVALID;
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+
+       mutex_lock(&rtt_status->rtt_work_mutex);
+
+       DHD_RTT(("Enter %s\n", __FUNCTION__));
+
+       if (RTT_IS_STOPPED(rtt_status)) {
+               DHD_RTT(("No Directed RTT target to process, check for geofence\n"));
+               goto geofence;
+       }
+
+       if (rtt_status->cur_idx >= rtt_status->rtt_config.rtt_target_cnt) {
+               err = BCME_RANGE;
+               err_at = 1;
+               DHD_RTT(("%s : idx %d is out of range\n", __FUNCTION__, rtt_status->cur_idx));
+               if (rtt_status->flags == WL_PROXD_SESSION_FLAG_TARGET) {
+                       DHD_RTT_ERR(("STA is set as Target/Responder \n"));
+                       err = BCME_ERROR;
+               }
+               goto exit;
+       }
+
+       mutex_lock(&rtt_status->rtt_mutex);
+       /* Get a target information */
+       rtt_target = &rtt_status->rtt_config.target_info[rtt_status->cur_idx];
+       mutex_unlock(&rtt_status->rtt_mutex);
+       DHD_RTT(("%s enter\n", __FUNCTION__));
+
+       if (ETHER_ISNULLADDR(rtt_target->addr.octet)) {
+               err = BCME_BADADDR;
+               err_at = 2;
+               DHD_RTT(("RTT Target addr is NULL\n"));
+               goto exit;
+       }
+
+       /* check for dp/others concurrency */
+       rtt_invalid_reason = dhd_rtt_invalid_states(dev, &rtt_target->addr);
+       if (rtt_invalid_reason != RTT_STATE_VALID) {
+               err = BCME_BUSY;
+               err_at = 3;
+               DHD_RTT(("DRV State is not valid for RTT\n"));
+               goto exit;
+       }
+
+       /* enable ftm */
+       err = dhd_rtt_ftm_enable(dhd, TRUE);
+       if (err) {
+               DHD_RTT_ERR(("failed to enable FTM (%d)\n", err));
+               err_at = 4;
+               goto exit;
+       }
+       rtt_status->status = RTT_ENABLED;
+
+#ifdef WL_NAN
+       if (rtt_target->peer == RTT_PEER_NAN) {
+               rtt_sched_type = RTT_TYPE_NAN_DIRECTED;
+               /* apply event mask */
+               DHD_RTT_CHK_SET_PARAM(ftm_params, ftm_param_cnt,
+                       rtt_target, WL_PROXD_TLV_ID_EVENT_MASK);
+               dhd_rtt_ftm_config(dhd, 0, FTM_CONFIG_CAT_GENERAL,
+                       ftm_params, ftm_param_cnt);
+               /* Ignore return value..failure taken care inside the API */
+               dhd_rtt_nan_start_session(dhd, rtt_target);
+               goto exit;
+       }
+#endif /* WL_NAN */
+
+       /* delete session of index default sesession  */
+       err = dhd_rtt_delete_session(dhd, FTM_DEFAULT_SESSION);
+       if (err < 0 && err != BCME_NOTFOUND) {
+               DHD_RTT_ERR(("failed to delete session of FTM (%d)\n", err));
+               err_at = 5;
+               goto exit;
+       }
+
+       memset(ftm_configs, 0, sizeof(ftm_configs));
+       memset(ftm_params, 0, sizeof(ftm_params));
+
+       /* configure the session 1 as initiator */
+       if  (ftm_cfg_cnt < FTM_MAX_CONFIGS) {
+               ftm_configs[ftm_cfg_cnt].enable = TRUE;
+               ftm_configs[ftm_cfg_cnt++].flags =
+                       WL_PROXD_SESSION_FLAG_INITIATOR | WL_PROXD_SESSION_FLAG_RANDMAC;
+               dhd_rtt_ftm_config(dhd, FTM_DEFAULT_SESSION, FTM_CONFIG_CAT_OPTIONS,
+                               ftm_configs, ftm_cfg_cnt);
+       } else {
+               DHD_RTT_ERR(("Max FTM Config Options exceeded\n"));
+               err = BCME_ERROR;
+               err_at = 6;
+               goto exit;
+       }
+
+       memset(ioctl_buf, 0, WLC_IOCTL_SMLEN);
+       /* Rand Mac for newer version in place of cur_eth */
+       if (dhd->wlc_ver_major < RTT_IOV_CUR_ETH_OBSOLETE) {
+               err = wldev_iovar_getbuf(dev, "cur_etheraddr", NULL, 0,
+                               ioctl_buf, WLC_IOCTL_SMLEN, NULL);
+               if (err) {
+                       DHD_RTT_ERR(("WLC_GET_CUR_ETHERADDR failed, error %d\n", err));
+                       err_at = 7;
+                       goto exit;
+               }
+               memcpy(rtt_target->local_addr.octet, ioctl_buf, ETHER_ADDR_LEN);
+
+               /* local mac address */
+               DHD_RTT_CHK_SET_PARAM(ftm_params, ftm_param_cnt,
+                       rtt_target, WL_PROXD_TLV_ID_CUR_ETHER_ADDR);
+       }
+       /* target's mac address */
+       DHD_RTT_CHK_SET_PARAM(ftm_params, ftm_param_cnt,
+               rtt_target, WL_PROXD_TLV_ID_PEER_MAC);
+
+       /* target's chanspec */
+       DHD_RTT_CHK_SET_PARAM(ftm_params, ftm_param_cnt,
+               rtt_target, WL_PROXD_TLV_ID_CHANSPEC);
+
+       /* num-burst */
+       DHD_RTT_CHK_SET_PARAM(ftm_params, ftm_param_cnt,
+               rtt_target, WL_PROXD_TLV_ID_NUM_BURST);
+
+       /* number of frame per burst */
+       DHD_RTT_CHK_SET_PARAM(ftm_params, ftm_param_cnt,
+               rtt_target, WL_PROXD_TLV_ID_BURST_NUM_FTM);
+
+       /* FTM retry count */
+       DHD_RTT_CHK_SET_PARAM(ftm_params, ftm_param_cnt,
+               rtt_target, WL_PROXD_TLV_ID_FTM_RETRIES);
+
+       /* FTM Request retry count */
+       DHD_RTT_CHK_SET_PARAM(ftm_params, ftm_param_cnt,
+               rtt_target, WL_PROXD_TLV_ID_FTM_REQ_RETRIES);
+
+       /* burst-period */
+       DHD_RTT_CHK_SET_PARAM(ftm_params, ftm_param_cnt,
+               rtt_target, WL_PROXD_TLV_ID_BURST_PERIOD);
+
+       /* Setting both duration and timeout to MAX duration
+        * to handle the congestion environments.
+        * Hence ignoring the user config.
+        */
+       /* burst-duration */
+       DHD_RTT_CHK_SET_PARAM(ftm_params, ftm_param_cnt,
+               rtt_target, WL_PROXD_TLV_ID_BURST_DURATION);
+
+       /* burst-timeout */
+       DHD_RTT_CHK_SET_PARAM(ftm_params, ftm_param_cnt,
+               rtt_target, WL_PROXD_TLV_ID_BURST_TIMEOUT);
+
+       DHD_RTT_CHK_SET_PARAM(ftm_params, ftm_param_cnt,
+               rtt_target, WL_PROXD_TLV_ID_RATESPEC);
+
+       /* event_mask..applicable for only Legacy RTT.
+        * For nan-rtt config happens from firmware
+        */
+       DHD_RTT_CHK_SET_PARAM(ftm_params, ftm_param_cnt,
+               rtt_target, WL_PROXD_TLV_ID_EVENT_MASK);
+
+#if !defined(WL_USE_RANDOMIZED_SCAN)
+       /* legacy rtt randmac */
+       dhd_set_rand_mac_oui(dhd);
+#endif /* !defined(WL_USE_RANDOMIZED_SCAN */
+       dhd_rtt_ftm_config(dhd, FTM_DEFAULT_SESSION, FTM_CONFIG_CAT_GENERAL,
+                       ftm_params, ftm_param_cnt);
+
+       rtt_sched_type = RTT_TYPE_LEGACY;
+       err = dhd_rtt_start_session(dhd, FTM_DEFAULT_SESSION, TRUE);
+       if (err) {
+               DHD_RTT_ERR(("failed to start session of FTM : error %d\n", err));
+               err_at = 8;
+       } else {
+               /* schedule proxd timeout */
+               schedule_delayed_work(&rtt_status->proxd_timeout,
+                       msecs_to_jiffies(DHD_NAN_RTT_TIMER_INTERVAL_MS));
+
+       }
+
+       goto exit;
+geofence:
+#ifdef WL_NAN
+       /* sched geofencing rtt */
+       rtt_sched_type = RTT_TYPE_NAN_GEOFENCE;
+       if ((err = dhd_rtt_sched_geofencing_target(dhd)) != BCME_OK) {
+               DHD_RTT_ERR(("geofencing sched failed, err = %d\n", err));
+               err_at = 9;
+       }
+#endif /* WL_NAN */
+
+exit:
+       if (err) {
+               /* RTT Failed */
+               DHD_RTT_ERR(("dhd_rtt_start: Failed & RTT_STOPPED, err = %d,"
+                       " err_at = %d, rtt_sched_type = %d, rtt_invalid_reason = %d\n"
+                       " sched_reason = %d",
+                       err, err_at, rtt_sched_type, rtt_invalid_reason,
+                       rtt_status->rtt_sched_reason));
+               rtt_status->status = RTT_STOPPED;
+               /* disable FTM */
+               dhd_rtt_ftm_enable(dhd, FALSE);
+       }
+       rtt_status->rtt_sched = FALSE;
+       mutex_unlock(&rtt_status->rtt_work_mutex);
+       return err;
+}
+#endif /* WL_CFG80211 */
+
+int
+dhd_rtt_register_noti_callback(dhd_pub_t *dhd, void *ctx, dhd_rtt_compl_noti_fn noti_fn)
+{
+       int err = BCME_OK;
+       struct rtt_noti_callback *cb = NULL, *iter;
+       rtt_status_info_t *rtt_status;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(noti_fn, "noti_fn is NULL", err);
+
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       spin_lock_bh(&noti_list_lock);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_entry(iter, &rtt_status->noti_fn_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (iter->noti_fn == noti_fn) {
+                       goto exit;
+               }
+       }
+       cb = (struct rtt_noti_callback *)MALLOCZ(dhd->osh, sizeof(struct rtt_noti_callback));
+       if (!cb) {
+               err = -ENOMEM;
+               goto exit;
+       }
+       cb->noti_fn = noti_fn;
+       cb->ctx = ctx;
+       list_add(&cb->list, &rtt_status->noti_fn_list);
+exit:
+       spin_unlock_bh(&noti_list_lock);
+       return err;
+}
+
+int
+dhd_rtt_unregister_noti_callback(dhd_pub_t *dhd, dhd_rtt_compl_noti_fn noti_fn)
+{
+       int err = BCME_OK;
+       struct rtt_noti_callback *cb = NULL, *iter;
+       rtt_status_info_t *rtt_status;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(noti_fn, "noti_fn is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       spin_lock_bh(&noti_list_lock);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_entry(iter, &rtt_status->noti_fn_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (iter->noti_fn == noti_fn) {
+                       cb = iter;
+                       list_del(&cb->list);
+                       break;
+               }
+       }
+
+       spin_unlock_bh(&noti_list_lock);
+       if (cb) {
+               MFREE(dhd->osh, cb, sizeof(struct rtt_noti_callback));
+       }
+       return err;
+}
+
+static wifi_rate_v1
+dhd_rtt_convert_rate_to_host(uint32 rspec)
+{
+       wifi_rate_v1 host_rate;
+       uint32 bandwidth;
+       memset(&host_rate, 0, sizeof(wifi_rate_v1));
+       if (RSPEC_ISLEGACY(rspec)) {
+               host_rate.preamble = 0;
+       } else if (RSPEC_ISHT(rspec)) {
+               host_rate.preamble = 2;
+               host_rate.rateMcsIdx = rspec & WL_RSPEC_RATE_MASK;
+       } else if (RSPEC_ISVHT(rspec)) {
+               host_rate.preamble = 3;
+               host_rate.rateMcsIdx = rspec & WL_RSPEC_VHT_MCS_MASK;
+               host_rate.nss = (rspec & WL_RSPEC_VHT_NSS_MASK) >> WL_RSPEC_VHT_NSS_SHIFT;
+       }
+
+       bandwidth = RSPEC_BW(rspec);
+       switch (bandwidth) {
+       case WL_RSPEC_BW_20MHZ:
+               host_rate.bw = RTT_RATE_20M;
+               break;
+       case WL_RSPEC_BW_40MHZ:
+               host_rate.bw = RTT_RATE_40M;
+               break;
+       case WL_RSPEC_BW_80MHZ:
+               host_rate.bw = RTT_RATE_80M;
+               break;
+       case WL_RSPEC_BW_160MHZ:
+               host_rate.bw = RTT_RATE_160M;
+               break;
+       default:
+               host_rate.bw = RTT_RATE_20M;
+               break;
+       }
+
+       host_rate.bitrate = rate_rspec2rate(rspec) / 100; /* 100kbps */
+       DHD_RTT(("bit rate : %d\n", host_rate.bitrate));
+       return host_rate;
+}
+
+#define FTM_FRAME_TYPES        {"SETUP", "TRIGGER", "TIMESTAMP"}
+static int
+dhd_rtt_convert_results_to_host_v1(rtt_result_t *rtt_result, const uint8 *p_data,
+       uint16 tlvid, uint16 len)
+{
+       int i;
+       int err = BCME_OK;
+       char eabuf[ETHER_ADDR_STR_LEN];
+       wl_proxd_result_flags_t flags;
+       wl_proxd_session_state_t session_state;
+       wl_proxd_status_t proxd_status;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
+       struct osl_timespec ts;
+#endif /* LINUX_VER >= 2.6.39 */
+       uint32 ratespec;
+       uint32 avg_dist;
+       const wl_proxd_rtt_result_v1_t *p_data_info = NULL;
+       const wl_proxd_rtt_sample_v1_t *p_sample_avg = NULL;
+       const wl_proxd_rtt_sample_v1_t *p_sample = NULL;
+       wl_proxd_intvl_t rtt;
+       wl_proxd_intvl_t p_time;
+       uint16 num_rtt = 0, snr = 0, bitflips = 0;
+       wl_proxd_phy_error_t tof_phy_error = 0;
+       wl_proxd_phy_error_t tof_phy_tgt_error = 0;
+       wl_proxd_snr_t tof_target_snr = 0;
+       wl_proxd_bitflips_t tof_target_bitflips = 0;
+       int16 rssi = 0;
+       int32 dist = 0;
+       uint8 num_ftm = 0;
+       char *ftm_frame_types[] = FTM_FRAME_TYPES;
+       rtt_report_t *rtt_report = &(rtt_result->report);
+
+       BCM_REFERENCE(ftm_frame_types);
+       BCM_REFERENCE(dist);
+       BCM_REFERENCE(rssi);
+       BCM_REFERENCE(tof_target_bitflips);
+       BCM_REFERENCE(tof_target_snr);
+       BCM_REFERENCE(tof_phy_tgt_error);
+       BCM_REFERENCE(tof_phy_error);
+       BCM_REFERENCE(bitflips);
+       BCM_REFERENCE(snr);
+       BCM_REFERENCE(session_state);
+       BCM_REFERENCE(ftm_session_state_value_to_logstr);
+
+       NULL_CHECK(rtt_report, "rtt_report is NULL", err);
+       NULL_CHECK(p_data, "p_data is NULL", err);
+       DHD_RTT(("%s enter\n", __FUNCTION__));
+       p_data_info = (const wl_proxd_rtt_result_v1_t *) p_data;
+       /* unpack and format 'flags' for display */
+       flags = ltoh16_ua(&p_data_info->flags);
+
+       /* session state and status */
+       session_state = ltoh16_ua(&p_data_info->state);
+       proxd_status = ltoh32_ua(&p_data_info->status);
+       bcm_ether_ntoa((&(p_data_info->peer)), eabuf);
+       DHD_RTT((">\tTarget(%s) session state=%d(%s), status=%d(%s)\n",
+               eabuf,
+               session_state,
+               ftm_session_state_value_to_logstr(session_state),
+               proxd_status,
+               ftm_status_value_to_logstr(proxd_status)));
+
+       /* show avg_dist (1/256m units), burst_num */
+       avg_dist = ltoh32_ua(&p_data_info->avg_dist);
+       if (avg_dist == 0xffffffff) {   /* report 'failure' case */
+               DHD_RTT((">\tavg_dist=-1m, burst_num=%d, valid_measure_cnt=%d\n",
+               ltoh16_ua(&p_data_info->burst_num),
+               p_data_info->num_valid_rtt)); /* in a session */
+               avg_dist = FTM_INVALID;
+       }
+       else {
+               DHD_RTT((">\tavg_dist=%d.%04dm, burst_num=%d, valid_measure_cnt=%d num_ftm=%d\n",
+                       avg_dist >> 8, /* 1/256m units */
+                       ((avg_dist & 0xff) * 625) >> 4,
+                       ltoh16_ua(&p_data_info->burst_num),
+                       p_data_info->num_valid_rtt,
+                       p_data_info->num_ftm)); /* in a session */
+       }
+       /* show 'avg_rtt' sample */
+       p_sample_avg = &p_data_info->avg_rtt;
+       ftm_tmu_value_to_logstr(ltoh16_ua(&p_sample_avg->rtt.tmu));
+       DHD_RTT((">\tavg_rtt sample: rssi=%d rtt=%d%s std_deviation =%d.%d ratespec=0x%08x\n",
+               (int16) ltoh16_ua(&p_sample_avg->rssi),
+               ltoh32_ua(&p_sample_avg->rtt.intvl),
+               ftm_tmu_value_to_logstr(ltoh16_ua(&p_sample_avg->rtt.tmu)),
+               ltoh16_ua(&p_data_info->sd_rtt)/10, ltoh16_ua(&p_data_info->sd_rtt)%10,
+               ltoh32_ua(&p_sample_avg->ratespec)));
+
+       /* set peer address */
+       rtt_report->addr = p_data_info->peer;
+       /* burst num */
+       rtt_report->burst_num = ltoh16_ua(&p_data_info->burst_num);
+       /* success num */
+       rtt_report->success_num = p_data_info->num_valid_rtt;
+       /* actual number of FTM supported by peer */
+       rtt_report->num_per_burst_peer = p_data_info->num_ftm;
+       rtt_report->negotiated_burst_num = p_data_info->num_ftm;
+       /* status */
+       rtt_report->status = ftm_get_statusmap_info(proxd_status,
+                       &ftm_status_map_info[0], ARRAYSIZE(ftm_status_map_info));
+
+       /* rssi (0.5db) */
+       rtt_report->rssi = ABS((wl_proxd_rssi_t)ltoh16_ua(&p_data_info->avg_rtt.rssi)) * 2;
+
+       /* rx rate */
+       ratespec = ltoh32_ua(&p_data_info->avg_rtt.ratespec);
+       rtt_report->rx_rate = dhd_rtt_convert_rate_to_host(ratespec);
+       /* tx rate */
+       if (flags & WL_PROXD_RESULT_FLAG_VHTACK) {
+               rtt_report->tx_rate = dhd_rtt_convert_rate_to_host(0x2010010);
+       } else {
+               rtt_report->tx_rate = dhd_rtt_convert_rate_to_host(0xc);
+       }
+       /* rtt_sd */
+       rtt.tmu = ltoh16_ua(&p_data_info->avg_rtt.rtt.tmu);
+       rtt.intvl = ltoh32_ua(&p_data_info->avg_rtt.rtt.intvl);
+       rtt_report->rtt = (wifi_timespan)FTM_INTVL2NSEC(&rtt) * 1000; /* nano -> pico seconds */
+       rtt_report->rtt_sd = ltoh16_ua(&p_data_info->sd_rtt); /* nano -> 0.1 nano */
+       DHD_RTT(("rtt_report->rtt : %llu\n", rtt_report->rtt));
+       DHD_RTT(("rtt_report->rssi : %d (0.5db)\n", rtt_report->rssi));
+
+       /* average distance */
+       if (avg_dist != FTM_INVALID) {
+               rtt_report->distance = (avg_dist >> 8) * 1000; /* meter -> mm */
+               rtt_report->distance += (avg_dist & 0xff) * 1000 / 256;
+       } else {
+               rtt_report->distance = FTM_INVALID;
+       }
+       /* time stamp */
+       /* get the time elapsed from boot time */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
+       osl_get_monotonic_boottime(&ts);
+       rtt_report->ts = (uint64)TIMESPEC_TO_US(ts);
+#endif /* LINUX_VER >= 2.6.39 */
+
+       if (proxd_status == WL_PROXD_E_REMOTE_FAIL) {
+               /* retry time  after failure */
+               p_time.intvl = ltoh32_ua(&p_data_info->u.retry_after.intvl);
+               p_time.tmu = ltoh16_ua(&p_data_info->u.retry_after.tmu);
+               rtt_report->retry_after_duration = FTM_INTVL2SEC(&p_time); /* s -> s */
+               DHD_RTT((">\tretry_after: %d%s\n",
+                       ltoh32_ua(&p_data_info->u.retry_after.intvl),
+                       ftm_tmu_value_to_logstr(ltoh16_ua(&p_data_info->u.retry_after.tmu))));
+       } else {
+               /* burst duration */
+               p_time.intvl = ltoh32_ua(&p_data_info->u.retry_after.intvl);
+               p_time.tmu = ltoh16_ua(&p_data_info->u.retry_after.tmu);
+               rtt_report->burst_duration =  FTM_INTVL2MSEC(&p_time); /* s -> ms */
+               DHD_RTT((">\tburst_duration: %d%s\n",
+                       ltoh32_ua(&p_data_info->u.burst_duration.intvl),
+                       ftm_tmu_value_to_logstr(ltoh16_ua(&p_data_info->u.burst_duration.tmu))));
+               DHD_RTT(("rtt_report->burst_duration : %d\n", rtt_report->burst_duration));
+       }
+
+       /* display detail if available */
+       num_rtt = ltoh16_ua(&p_data_info->num_rtt);
+       if (num_rtt > 0) {
+               DHD_RTT((">\tnum rtt: %d samples\n", num_rtt));
+               p_sample = &p_data_info->rtt[0];
+               for (i = 0; i < num_rtt; i++) {
+                       snr = 0;
+                       bitflips = 0;
+                       tof_phy_error = 0;
+                       tof_phy_tgt_error = 0;
+                       tof_target_snr = 0;
+                       tof_target_bitflips = 0;
+                       rssi = 0;
+                       dist = 0;
+                       num_ftm = p_data_info->num_ftm;
+                       /* FTM frames 1,4,7,11 have valid snr, rssi and bitflips */
+                       if ((i % num_ftm) == 1) {
+                               rssi = (wl_proxd_rssi_t) ltoh16_ua(&p_sample->rssi);
+                               snr = (wl_proxd_snr_t) ltoh16_ua(&p_sample->snr);
+                               bitflips = (wl_proxd_bitflips_t) ltoh16_ua(&p_sample->bitflips);
+                               tof_phy_error =
+                                       (wl_proxd_phy_error_t)
+                                       ltoh32_ua(&p_sample->tof_phy_error);
+                               tof_phy_tgt_error =
+                                       (wl_proxd_phy_error_t)
+                                       ltoh32_ua(&p_sample->tof_tgt_phy_error);
+                               tof_target_snr =
+                                       (wl_proxd_snr_t)
+                                       ltoh16_ua(&p_sample->tof_tgt_snr);
+                               tof_target_bitflips =
+                                       (wl_proxd_bitflips_t)
+                                       ltoh16_ua(&p_sample->tof_tgt_bitflips);
+                               dist = ltoh32_ua(&p_sample->distance);
+                       } else {
+                               rssi = -1;
+                               snr = 0;
+                               bitflips = 0;
+                               dist = 0;
+                               tof_target_bitflips = 0;
+                               tof_target_snr = 0;
+                               tof_phy_tgt_error = 0;
+                       }
+                       DHD_RTT((">\t sample[%d]: id=%d rssi=%d snr=0x%x bitflips=%d"
+                               " tof_phy_error %x tof_phy_tgt_error %x target_snr=0x%x"
+                               " target_bitflips=%d dist=%d rtt=%d%s status %s"
+                               " Type %s coreid=%d\n",
+                               i, p_sample->id, rssi, snr,
+                               bitflips, tof_phy_error, tof_phy_tgt_error,
+                               tof_target_snr,
+                               tof_target_bitflips, dist,
+                               ltoh32_ua(&p_sample->rtt.intvl),
+                               ftm_tmu_value_to_logstr(ltoh16_ua(&p_sample->rtt.tmu)),
+                               ftm_status_value_to_logstr(ltoh32_ua(&p_sample->status)),
+                               ftm_frame_types[i % num_ftm], p_sample->coreid));
+                       p_sample++;
+               }
+       }
+       return err;
+}
+
+static int
+dhd_rtt_convert_results_to_host_v2(rtt_result_t *rtt_result, const uint8 *p_data,
+       uint16 tlvid, uint16 len)
+{
+       int i;
+       int err = BCME_OK;
+       char eabuf[ETHER_ADDR_STR_LEN];
+       wl_proxd_result_flags_t flags;
+       wl_proxd_session_state_t session_state;
+       wl_proxd_status_t proxd_status;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
+       struct osl_timespec ts;
+#endif /* LINUX_VER >= 2.6.39 */
+       uint32 ratespec;
+       uint32 avg_dist;
+       const wl_proxd_rtt_result_v2_t *p_data_info = NULL;
+       const wl_proxd_rtt_sample_v2_t *p_sample_avg = NULL;
+       const wl_proxd_rtt_sample_v2_t *p_sample = NULL;
+       uint16 num_rtt = 0;
+       wl_proxd_intvl_t rtt;
+       wl_proxd_intvl_t p_time;
+       uint16 snr = 0, bitflips = 0;
+       wl_proxd_phy_error_t tof_phy_error = 0;
+       wl_proxd_phy_error_t tof_phy_tgt_error = 0;
+       wl_proxd_snr_t tof_target_snr = 0;
+       wl_proxd_bitflips_t tof_target_bitflips = 0;
+       int16 rssi = 0;
+       int32 dist = 0;
+       uint32 chanspec = 0;
+       uint8 num_ftm = 0;
+       char *ftm_frame_types[] =  FTM_FRAME_TYPES;
+       rtt_report_t *rtt_report = &(rtt_result->report);
+
+       BCM_REFERENCE(ftm_frame_types);
+       BCM_REFERENCE(dist);
+       BCM_REFERENCE(rssi);
+       BCM_REFERENCE(tof_target_bitflips);
+       BCM_REFERENCE(tof_target_snr);
+       BCM_REFERENCE(tof_phy_tgt_error);
+       BCM_REFERENCE(tof_phy_error);
+       BCM_REFERENCE(bitflips);
+       BCM_REFERENCE(snr);
+       BCM_REFERENCE(chanspec);
+       BCM_REFERENCE(session_state);
+       BCM_REFERENCE(ftm_session_state_value_to_logstr);
+
+       NULL_CHECK(rtt_report, "rtt_report is NULL", err);
+       NULL_CHECK(p_data, "p_data is NULL", err);
+       DHD_RTT(("%s enter\n", __FUNCTION__));
+       p_data_info = (const wl_proxd_rtt_result_v2_t *) p_data;
+       /* unpack and format 'flags' for display */
+       flags = ltoh16_ua(&p_data_info->flags);
+       /* session state and status */
+       session_state = ltoh16_ua(&p_data_info->state);
+       proxd_status = ltoh32_ua(&p_data_info->status);
+       bcm_ether_ntoa((&(p_data_info->peer)), eabuf);
+
+       if ((proxd_status != BCME_OK) || (p_data_info->num_meas == 0)) {
+               DHD_RTT_ERR((">\tTarget(%s) session state=%d(%s), status=%d(%s) "
+                       "num_meas_ota %d num_valid_rtt %d result_flags %x\n",
+                       eabuf, session_state,
+                       ftm_session_state_value_to_logstr(session_state),
+                       proxd_status, ftm_status_value_to_logstr(proxd_status),
+                       p_data_info->num_meas, p_data_info->num_valid_rtt,
+                       p_data_info->flags));
+       } else {
+               DHD_RTT((">\tTarget(%s) session state=%d(%s), status=%d(%s)\n",
+               eabuf, session_state,
+               ftm_session_state_value_to_logstr(session_state),
+               proxd_status, ftm_status_value_to_logstr(proxd_status)));
+       }
+       /* show avg_dist (1/256m units), burst_num */
+       avg_dist = ltoh32_ua(&p_data_info->avg_dist);
+       if (avg_dist == 0xffffffff) {   /* report 'failure' case */
+               DHD_RTT((">\tavg_dist=-1m, burst_num=%d, valid_measure_cnt=%d\n",
+               ltoh16_ua(&p_data_info->burst_num),
+               p_data_info->num_valid_rtt)); /* in a session */
+               avg_dist = FTM_INVALID;
+       } else {
+               DHD_RTT((">\tavg_dist=%d.%04dm, burst_num=%d, valid_measure_cnt=%d num_ftm=%d "
+                       "num_meas_ota=%d, result_flags=%x\n", avg_dist >> 8, /* 1/256m units */
+                       ((avg_dist & 0xff) * 625) >> 4,
+                       ltoh16_ua(&p_data_info->burst_num),
+                       p_data_info->num_valid_rtt,
+                       p_data_info->num_ftm, p_data_info->num_meas,
+                       p_data_info->flags)); /* in a session */
+       }
+       rtt_result->rtt_detail.num_ota_meas = p_data_info->num_meas;
+       rtt_result->rtt_detail.result_flags = p_data_info->flags;
+       /* show 'avg_rtt' sample */
+       /* in v2, avg_rtt is the first element of the variable rtt[] */
+       p_sample_avg = &p_data_info->rtt[0];
+       ftm_tmu_value_to_logstr(ltoh16_ua(&p_sample_avg->rtt.tmu));
+       DHD_RTT((">\tavg_rtt sample: rssi=%d rtt=%d%s std_deviation =%d.%d"
+               "ratespec=0x%08x chanspec=0x%08x\n",
+               (int16) ltoh16_ua(&p_sample_avg->rssi),
+               ltoh32_ua(&p_sample_avg->rtt.intvl),
+               ftm_tmu_value_to_logstr(ltoh16_ua(&p_sample_avg->rtt.tmu)),
+               ltoh16_ua(&p_data_info->sd_rtt)/10, ltoh16_ua(&p_data_info->sd_rtt)%10,
+               ltoh32_ua(&p_sample_avg->ratespec),
+               ltoh32_ua(&p_sample_avg->chanspec)));
+
+       /* set peer address */
+       rtt_report->addr = p_data_info->peer;
+
+       /* burst num */
+       rtt_report->burst_num = ltoh16_ua(&p_data_info->burst_num);
+
+       /* success num */
+       rtt_report->success_num = p_data_info->num_valid_rtt;
+
+       /* num-ftm configured */
+       rtt_report->ftm_num = p_data_info->num_ftm;
+
+       /* actual number of FTM supported by peer */
+       rtt_report->num_per_burst_peer = p_data_info->num_ftm;
+       rtt_report->negotiated_burst_num = p_data_info->num_ftm;
+
+       /* status */
+       rtt_report->status = ftm_get_statusmap_info(proxd_status,
+                       &ftm_status_map_info[0], ARRAYSIZE(ftm_status_map_info));
+
+       /* Framework expects status as SUCCESS else all results will be
+       * set to zero even if we have partial valid result.
+       * So setting status as SUCCESS if we have a valid_rtt
+       * On burst timeout we stop burst with "timeout" reason and
+       * on msch end we set status as "cancel"
+       */
+       if ((proxd_status == WL_PROXD_E_TIMEOUT ||
+               proxd_status == WL_PROXD_E_CANCELED) &&
+               rtt_report->success_num) {
+               rtt_report->status = RTT_STATUS_SUCCESS;
+       }
+
+       /* rssi (0.5db) */
+       rtt_report->rssi = ABS((wl_proxd_rssi_t)ltoh16_ua(&p_sample_avg->rssi)) * 2;
+
+       /* rx rate */
+       ratespec = ltoh32_ua(&p_sample_avg->ratespec);
+       rtt_report->rx_rate = dhd_rtt_convert_rate_to_host(ratespec);
+
+       /* tx rate */
+       if (flags & WL_PROXD_RESULT_FLAG_VHTACK) {
+               rtt_report->tx_rate = dhd_rtt_convert_rate_to_host(0x2010010);
+       } else {
+               rtt_report->tx_rate = dhd_rtt_convert_rate_to_host(0xc);
+       }
+
+       /* rtt_sd */
+       rtt.tmu = ltoh16_ua(&p_sample_avg->rtt.tmu);
+       rtt.intvl = ltoh32_ua(&p_sample_avg->rtt.intvl);
+       rtt_report->rtt = (wifi_timespan)FTM_INTVL2NSEC(&rtt) * 1000; /* nano -> pico seconds */
+       rtt_report->rtt_sd = ltoh16_ua(&p_data_info->sd_rtt); /* nano -> 0.1 nano */
+       DHD_RTT(("rtt_report->rtt : %llu\n", rtt_report->rtt));
+       DHD_RTT(("rtt_report->rssi : %d (0.5db)\n", rtt_report->rssi));
+
+       /* average distance */
+       if (avg_dist != FTM_INVALID) {
+               rtt_report->distance = (avg_dist >> 8) * 1000; /* meter -> mm */
+               rtt_report->distance += (avg_dist & 0xff) * 1000 / 256;
+               /* rtt_sd is in 0.1 ns.
+               * host needs distance_sd in milli mtrs
+               * (0.1 * rtt_sd/2 * 10^-9) * C * 1000
+               */
+               rtt_report->distance_sd = rtt_report->rtt_sd * 15; /* mm */
+       } else {
+               rtt_report->distance = FTM_INVALID;
+       }
+       /* time stamp */
+       /* get the time elapsed from boot time */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
+       osl_get_monotonic_boottime(&ts);
+       rtt_report->ts = (uint64)TIMESPEC_TO_US(ts);
+#endif /* LINUX_VER >= 2.6.39 */
+
+       if (proxd_status == WL_PROXD_E_REMOTE_FAIL) {
+               /* retry time  after failure */
+               p_time.intvl = ltoh32_ua(&p_data_info->u.retry_after.intvl);
+               p_time.tmu = ltoh16_ua(&p_data_info->u.retry_after.tmu);
+               rtt_report->retry_after_duration = FTM_INTVL2SEC(&p_time); /* s -> s */
+               DHD_RTT((">\tretry_after: %d%s\n",
+                       ltoh32_ua(&p_data_info->u.retry_after.intvl),
+                       ftm_tmu_value_to_logstr(ltoh16_ua(&p_data_info->u.retry_after.tmu))));
+       } else {
+               /* burst duration */
+               p_time.intvl = ltoh32_ua(&p_data_info->u.retry_after.intvl);
+               p_time.tmu = ltoh16_ua(&p_data_info->u.retry_after.tmu);
+               rtt_report->burst_duration =  FTM_INTVL2MSEC(&p_time); /* s -> ms */
+               DHD_RTT((">\tburst_duration: %d%s\n",
+                       ltoh32_ua(&p_data_info->u.burst_duration.intvl),
+                       ftm_tmu_value_to_logstr(ltoh16_ua(&p_data_info->u.burst_duration.tmu))));
+               DHD_RTT(("rtt_report->burst_duration : %d\n", rtt_report->burst_duration));
+       }
+       /* display detail if available */
+       num_rtt = ltoh16_ua(&p_data_info->num_rtt);
+       if (num_rtt > 0) {
+               DHD_RTT((">\tnum rtt: %d samples\n", num_rtt));
+               p_sample = &p_data_info->rtt[1];
+               for (i = 0; i < num_rtt; i++) {
+                       snr = 0;
+                       bitflips = 0;
+                       tof_phy_error = 0;
+                       tof_phy_tgt_error = 0;
+                       tof_target_snr = 0;
+                       tof_target_bitflips = 0;
+                       rssi = 0;
+                       dist = 0;
+                       num_ftm = p_data_info->num_ftm;
+                       /* FTM frames 1,4,7,11 have valid snr, rssi and bitflips */
+                       if ((i % num_ftm) == 1) {
+                               rssi = (wl_proxd_rssi_t) ltoh16_ua(&p_sample->rssi);
+                               snr = (wl_proxd_snr_t) ltoh16_ua(&p_sample->snr);
+                               bitflips = (wl_proxd_bitflips_t) ltoh16_ua(&p_sample->bitflips);
+                               tof_phy_error =
+                                       (wl_proxd_phy_error_t)
+                                       ltoh32_ua(&p_sample->tof_phy_error);
+                               tof_phy_tgt_error =
+                                       (wl_proxd_phy_error_t)
+                                       ltoh32_ua(&p_sample->tof_tgt_phy_error);
+                               tof_target_snr =
+                                       (wl_proxd_snr_t)
+                                       ltoh16_ua(&p_sample->tof_tgt_snr);
+                               tof_target_bitflips =
+                                       (wl_proxd_bitflips_t)
+                                       ltoh16_ua(&p_sample->tof_tgt_bitflips);
+                               dist = ltoh32_ua(&p_sample->distance);
+                               chanspec = ltoh32_ua(&p_sample->chanspec);
+                       } else {
+                               rssi = -1;
+                               snr = 0;
+                               bitflips = 0;
+                               dist = 0;
+                               tof_target_bitflips = 0;
+                               tof_target_snr = 0;
+                               tof_phy_tgt_error = 0;
+                       }
+                       DHD_RTT((">\t sample[%d]: id=%d rssi=%d snr=0x%x bitflips=%d"
+                               " tof_phy_error %x tof_phy_tgt_error %x target_snr=0x%x"
+                               " target_bitflips=%d dist=%d rtt=%d%s status %s Type %s"
+                               " coreid=%d chanspec=0x%08x\n",
+                               i, p_sample->id, rssi, snr,
+                               bitflips, tof_phy_error, tof_phy_tgt_error,
+                               tof_target_snr,
+                               tof_target_bitflips, dist,
+                               ltoh32_ua(&p_sample->rtt.intvl),
+                               ftm_tmu_value_to_logstr(ltoh16_ua(&p_sample->rtt.tmu)),
+                               ftm_status_value_to_logstr(ltoh32_ua(&p_sample->status)),
+                               ftm_frame_types[i % num_ftm], p_sample->coreid,
+                               chanspec));
+                       p_sample++;
+               }
+       }
+       return err;
+}
+#ifdef WL_CFG80211
+/* Common API for handling Session End.
+* This API will flush out the results for a peer MAC.
+*
+* @For legacy FTM session, this API will be called
+* when legacy FTM_SESSION_END event is received.
+* @For legacy Nan-RTT , this API will be called when
+* we are cancelling the nan-ranging session or on
+* nan-ranging-end event.
+*/
+static void
+dhd_rtt_handle_rtt_session_end(dhd_pub_t *dhd)
+{
+
+       int idx;
+       struct rtt_noti_callback *iter;
+       rtt_results_header_t *entry, *next;
+       rtt_result_t *next2;
+       rtt_result_t *rtt_result;
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+
+       /* Cancel pending proxd timeout work if any */
+       if (delayed_work_pending(&rtt_status->proxd_timeout)) {
+               cancel_delayed_work(&rtt_status->proxd_timeout);
+       }
+
+       /* find next target to trigger RTT */
+       for (idx = (rtt_status->cur_idx + 1);
+               idx < rtt_status->rtt_config.rtt_target_cnt; idx++) {
+               /* skip the disabled device */
+               if (rtt_status->rtt_config.target_info[idx].disable) {
+                       continue;
+               } else {
+                       /* set the idx to cur_idx */
+                       rtt_status->cur_idx = idx;
+                       break;
+               }
+       }
+       if (idx < rtt_status->rtt_config.rtt_target_cnt) {
+               /* restart to measure RTT from next device */
+               DHD_INFO(("restart to measure rtt\n"));
+               rtt_status->rtt_sched = TRUE;
+               schedule_work(&rtt_status->work);
+       } else {
+               DHD_RTT_MEM(("RTT_STOPPED\n"));
+               rtt_status->status = RTT_STOPPED;
+               /* notify the completed information to others */
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               list_for_each_entry(iter, &rtt_status->noti_fn_list, list) {
+                       iter->noti_fn(iter->ctx, &rtt_status->rtt_results_cache);
+               }
+               /* remove the rtt results in cache */
+               if (!list_empty(&rtt_status->rtt_results_cache)) {
+                       /* Iterate rtt_results_header list */
+                       list_for_each_entry_safe(entry, next,
+                               &rtt_status->rtt_results_cache, list) {
+                               list_del(&entry->list);
+                               /* Iterate rtt_result list */
+                               list_for_each_entry_safe(rtt_result, next2,
+                                       &entry->result_list, list) {
+                                       list_del(&rtt_result->list);
+                                       MFREE(dhd->osh, rtt_result,
+                                               sizeof(rtt_result_t));
+                               }
+                               MFREE(dhd->osh, entry, sizeof(rtt_results_header_t));
+                       }
+               }
+               GCC_DIAGNOSTIC_POP();
+               /* reinitialize the HEAD */
+               INIT_LIST_HEAD(&rtt_status->rtt_results_cache);
+               /* clear information for rtt_config */
+               rtt_status->rtt_config.rtt_target_cnt = 0;
+               memset_s(rtt_status->rtt_config.target_info, TARGET_INFO_SIZE(RTT_MAX_TARGET_CNT),
+                       0, TARGET_INFO_SIZE(RTT_MAX_TARGET_CNT));
+               rtt_status->cur_idx = 0;
+       }
+}
+#endif /* WL_CFG80211 */
+
+#ifdef WL_CFG80211
+static int
+dhd_rtt_create_failure_result(rtt_status_info_t *rtt_status,
+       struct ether_addr *addr)
+{
+       rtt_results_header_t *rtt_results_header = NULL;
+       rtt_target_info_t *rtt_target_info;
+       int ret = BCME_OK;
+       rtt_result_t *rtt_result;
+
+       /* allocate new header for rtt_results */
+       rtt_results_header = (rtt_results_header_t *)MALLOCZ(rtt_status->dhd->osh,
+               sizeof(rtt_results_header_t));
+       if (!rtt_results_header) {
+               ret = -ENOMEM;
+               goto exit;
+       }
+       rtt_target_info = &rtt_status->rtt_config.target_info[rtt_status->cur_idx];
+       /* Initialize the head of list for rtt result */
+       INIT_LIST_HEAD(&rtt_results_header->result_list);
+       /* same src and dest len */
+       (void)memcpy_s(&rtt_results_header->peer_mac,
+               ETHER_ADDR_LEN, addr, ETHER_ADDR_LEN);
+       list_add_tail(&rtt_results_header->list, &rtt_status->rtt_results_cache);
+
+       /* allocate rtt_results for new results */
+       rtt_result = (rtt_result_t *)MALLOCZ(rtt_status->dhd->osh,
+               sizeof(rtt_result_t));
+       if (!rtt_result) {
+               ret = -ENOMEM;
+               /* Free rtt result header */
+               MFREE(rtt_status->dhd->osh, rtt_results_header, sizeof(rtt_results_header_t));
+               goto exit;
+       }
+       /* fill out the results from the configuration param */
+       rtt_result->report.ftm_num = rtt_target_info->num_frames_per_burst;
+       rtt_result->report.type = RTT_TWO_WAY;
+       DHD_RTT(("report->ftm_num : %d\n", rtt_result->report.ftm_num));
+       rtt_result->report_len = RTT_REPORT_SIZE;
+       rtt_result->report.status = RTT_STATUS_FAIL_NO_RSP;
+       /* same src and dest len */
+       (void)memcpy_s(&rtt_result->report.addr, ETHER_ADDR_LEN,
+               &rtt_target_info->addr, ETHER_ADDR_LEN);
+       rtt_result->report.distance = FTM_INVALID;
+       list_add_tail(&rtt_result->list, &rtt_results_header->result_list);
+       rtt_results_header->result_cnt++;
+       rtt_results_header->result_tot_len += rtt_result->report_len;
+exit:
+       return ret;
+}
+
+static bool
+dhd_rtt_get_report_header(rtt_status_info_t *rtt_status,
+       rtt_results_header_t **rtt_results_header, struct ether_addr *addr)
+{
+       rtt_results_header_t *entry;
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       /* find a rtt_report_header for this mac address */
+       list_for_each_entry(entry, &rtt_status->rtt_results_cache, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (!memcmp(&entry->peer_mac, addr, ETHER_ADDR_LEN))  {
+                       /* found a rtt_report_header for peer_mac in the list */
+                       if (rtt_results_header) {
+                               *rtt_results_header = entry;
+                       }
+                       return TRUE;
+               }
+       }
+       return FALSE;
+}
+
+#ifdef WL_NAN
+int
+dhd_rtt_handle_nan_rtt_session_end(dhd_pub_t *dhd, struct ether_addr *peer)
+{
+       bool is_new = TRUE;
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       mutex_lock(&rtt_status->rtt_mutex);
+       is_new = !dhd_rtt_get_report_header(rtt_status, NULL, peer);
+
+       if (is_new) { /* no FTM result..create failure result */
+               dhd_rtt_create_failure_result(rtt_status, peer);
+       }
+       DHD_RTT_MEM(("RTT Session End for NAN peer "MACDBG"\n", MAC2STRDBG(peer)));
+       dhd_rtt_handle_rtt_session_end(dhd);
+       mutex_unlock(&rtt_status->rtt_mutex);
+       return BCME_OK;
+}
+
+static bool
+dhd_rtt_is_valid_measurement(rtt_result_t *rtt_result)
+{
+       bool ret = FALSE;
+
+       if (rtt_result && (rtt_result->report.success_num != 0)) {
+               ret = TRUE;
+       }
+       return ret;
+}
+#endif /* WL_NAN */
+#endif /* WL_CFG80211 */
+
+static int
+dhd_rtt_parse_result_event(wl_proxd_event_t *proxd_ev_data,
+       int tlvs_len, rtt_result_t *rtt_result)
+{
+       int ret = BCME_OK;
+
+       /* unpack TLVs and invokes the cbfn to print the event content TLVs */
+       ret = bcm_unpack_xtlv_buf((void *) rtt_result,
+                       (uint8 *)&proxd_ev_data->tlvs[0], tlvs_len,
+                       BCM_XTLV_OPTION_ALIGN32, rtt_unpack_xtlv_cbfn);
+       if (ret != BCME_OK) {
+               DHD_RTT_ERR(("%s : Failed to unpack xtlv for an event\n",
+                       __FUNCTION__));
+               goto exit;
+       }
+       /* fill out the results from the configuration param */
+       rtt_result->report.type = RTT_TWO_WAY;
+       DHD_RTT(("report->ftm_num : %d\n", rtt_result->report.ftm_num));
+       rtt_result->report_len = RTT_REPORT_SIZE;
+       rtt_result->detail_len = sizeof(rtt_result->rtt_detail);
+
+exit:
+       return ret;
+
+}
+
+static int
+dhd_rtt_handle_directed_rtt_burst_end(dhd_pub_t *dhd, struct ether_addr *peer_addr,
+        wl_proxd_event_t *proxd_ev_data, int tlvs_len, rtt_result_t *rtt_result, bool is_nan)
+{
+       int ret = BCME_OK;
+
+#ifdef WL_CFG80211
+       int err_at = 0;
+       rtt_status_info_t *rtt_status;
+       bool is_new = TRUE;
+       rtt_results_header_t *rtt_results_header = NULL;
+#endif /* WL_CFG80211 */
+
+#ifdef WL_CFG80211
+       rtt_status = GET_RTTSTATE(dhd);
+       is_new = !dhd_rtt_get_report_header(rtt_status,
+               &rtt_results_header, peer_addr);
+
+       if (tlvs_len > 0) {
+               if (is_new) {
+                       /* allocate new header for rtt_results */
+                       rtt_results_header = (rtt_results_header_t *)MALLOCZ(rtt_status->dhd->osh,
+                               sizeof(rtt_results_header_t));
+                       if (!rtt_results_header) {
+                               ret = BCME_NORESOURCE;
+                               err_at = 1;
+                               goto exit;
+                       }
+                       /* Initialize the head of list for rtt result */
+                       INIT_LIST_HEAD(&rtt_results_header->result_list);
+                       /* same src and header len */
+                       (void)memcpy_s(&rtt_results_header->peer_mac, ETHER_ADDR_LEN,
+                               peer_addr, ETHER_ADDR_LEN);
+                       list_add_tail(&rtt_results_header->list, &rtt_status->rtt_results_cache);
+               }
+#endif /* WL_CFG80211 */
+
+               ret = dhd_rtt_parse_result_event(proxd_ev_data, tlvs_len, rtt_result);
+#ifdef WL_CFG80211
+               if (ret == BCME_OK) {
+                       list_add_tail(&rtt_result->list, &rtt_results_header->result_list);
+                       rtt_results_header->result_cnt++;
+                       rtt_results_header->result_tot_len += rtt_result->report_len +
+                               rtt_result->detail_len;
+               } else {
+                       err_at = 2;
+                       goto exit;
+               }
+       } else {
+               ret = BCME_ERROR;
+               err_at = 4;
+               goto exit;
+       }
+
+exit:
+       if (ret != BCME_OK) {
+               DHD_RTT_ERR(("dhd_rtt_handle_directed_rtt_burst_end: failed, "
+                       " ret = %d, err_at = %d\n", ret, err_at));
+               if (rtt_results_header) {
+                       list_del(&rtt_results_header->list);
+                       MFREE(dhd->osh, rtt_results_header,
+                               sizeof(rtt_results_header_t));
+               }
+       }
+#endif /* WL_CFG80211 */
+       return ret;
+}
+
+#ifdef WL_NAN
+static void
+dhd_rtt_nan_range_report(struct bcm_cfg80211 *cfg,
+               rtt_result_t *rtt_result, bool is_geofence)
+{
+       wl_nan_ev_rng_rpt_ind_t range_res;
+       int rtt_status = rtt_result->report.status;
+
+       UNUSED_PARAMETER(range_res);
+       bzero(&range_res, sizeof(range_res));
+       range_res.dist_mm = rtt_result->report.distance;
+       /* same src and header len, ignoring ret val here */
+       (void)memcpy_s(&range_res.peer_m_addr, ETHER_ADDR_LEN,
+               &rtt_result->report.addr, ETHER_ADDR_LEN);
+       wl_cfgnan_process_range_report(cfg, &range_res, rtt_status);
+
+       return;
+}
+
+static int
+dhd_rtt_handle_nan_burst_end(dhd_pub_t *dhd, struct ether_addr *peer_addr,
+       wl_proxd_event_t *proxd_ev_data, int tlvs_len)
+{
+       struct net_device *ndev = NULL;
+       struct bcm_cfg80211 *cfg = NULL;
+       nan_ranging_inst_t *rng_inst = NULL;
+       rtt_status_info_t *rtt_status = NULL;
+       rtt_result_t *rtt_result = NULL;
+       bool geofence_rtt = FALSE;
+       int ret = BCME_OK;
+       rtt_result_t nan_rtt_res;
+       uint8 ftm_retry_cnt = 0;
+       int burst_status = -1;
+
+       ndev = dhd_linux_get_primary_netdev(dhd);
+       cfg =  wiphy_priv(ndev->ieee80211_ptr->wiphy);
+
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", ret);
+       NAN_MUTEX_LOCK();
+       mutex_lock(&rtt_status->rtt_mutex);
+
+       if ((wl_cfgnan_is_enabled(cfg) == FALSE) ||
+               ETHER_ISNULLADDR(peer_addr)) {
+               DHD_RTT_ERR(("Received Burst End with NULL ether addr, "
+                       "or nan disable, nan_enable = %d\n", wl_cfgnan_is_enabled(cfg)));
+               ret = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       rng_inst = wl_cfgnan_check_for_ranging(cfg, peer_addr);
+       if (rng_inst) {
+               geofence_rtt = (rng_inst->range_type
+                       == RTT_TYPE_NAN_GEOFENCE);
+       } else {
+               DHD_RTT_ERR(("Received Burst End without Ranging Instance\n"));
+               ret = BCME_ERROR;
+               goto exit;
+       }
+
+       if (rng_inst->range_role == NAN_RANGING_ROLE_RESPONDER) {
+               ret = BCME_OK;
+               goto exit;
+       }
+
+       bzero(&nan_rtt_res, sizeof(nan_rtt_res));
+       ret = dhd_rtt_parse_result_event(proxd_ev_data, tlvs_len, &nan_rtt_res);
+       if (ret != BCME_OK) {
+               DHD_RTT_ERR(("Failed to parse RTT result %d\n", ret));
+               goto exit;
+       }
+
+       burst_status = nan_rtt_res.report.status;
+       if (nan_rtt_res.rtt_detail.num_ota_meas <= 1) {
+               /* Wait for some time(CRBs) for ftm protocol to go through */
+               if (rng_inst->ftm_ssn_retry_count < NAN_RTT_FTM_SSN_RETRIES) {
+                       rng_inst->ftm_ssn_retry_count++;
+                       ftm_retry_cnt = rng_inst->ftm_ssn_retry_count;
+                       ret = BCME_ERROR;
+                       goto exit;
+               }
+               /* retries over...report the result as is to host */
+       }
+
+       BCM_REFERENCE(dhd_rtt_is_valid_measurement);
+
+       if (geofence_rtt) {
+               rtt_result = &nan_rtt_res;
+       } else {
+               if (RTT_IS_STOPPED(rtt_status)) {
+                       /* Ignore the Proxd event */
+                       DHD_RTT((" event handler rtt is stopped \n"));
+                       if (rtt_status->flags == WL_PROXD_SESSION_FLAG_TARGET) {
+                               DHD_RTT(("Device is target/Responder. Recv the event. \n"));
+                       } else {
+                               ret = BCME_UNSUPPORTED;
+                               goto exit;
+                       }
+               }
+               /* allocate rtt_results for new results */
+               rtt_result = (rtt_result_t *)MALLOCZ(dhd->osh, sizeof(rtt_result_t));
+               if (!rtt_result) {
+                       ret = BCME_NORESOURCE;
+                       goto exit;
+               }
+               ret = dhd_rtt_handle_directed_rtt_burst_end(dhd, peer_addr,
+                       proxd_ev_data, tlvs_len, rtt_result, TRUE);
+               if (ret != BCME_OK) {
+                       goto exit;
+               }
+
+       }
+
+exit:
+       mutex_unlock(&rtt_status->rtt_mutex);
+       if (ret == BCME_OK) {
+               /* Nothing to do for Responder */
+               if (rng_inst->range_role == NAN_RANGING_ROLE_INITIATOR) {
+                       dhd_rtt_nan_range_report(cfg, rtt_result, geofence_rtt);
+               }
+       } else {
+               DHD_RTT_ERR(("nan-rtt: Burst End handling failed err %d is_geofence %d "
+                       "retry cnt %d burst status %d", ret, geofence_rtt,
+                       ftm_retry_cnt, burst_status));
+               if (rtt_result && !geofence_rtt) {
+                       MFREE(dhd->osh, rtt_result,
+                               sizeof(rtt_result_t));
+               }
+       }
+       NAN_MUTEX_UNLOCK();
+       return ret;
+}
+#endif /* WL_NAN */
+
+int
+dhd_rtt_event_handler(dhd_pub_t *dhd, wl_event_msg_t *event, void *event_data)
+{
+       int ret = BCME_OK;
+       int tlvs_len;
+       uint16 version;
+       wl_proxd_event_t *p_event;
+       wl_proxd_event_type_t event_type;
+       wl_proxd_ftm_session_status_t session_status;
+       const ftm_strmap_entry_t *p_loginfo;
+       rtt_result_t *rtt_result;
+#ifdef WL_CFG80211
+       rtt_status_info_t *rtt_status;
+       rtt_results_header_t *rtt_results_header = NULL;
+       bool is_new = TRUE;
+       rtt_target_info_t *target = NULL;
+#endif /* WL_CFG80211 */
+
+       DHD_RTT(("Enter %s \n", __FUNCTION__));
+       NULL_CHECK(dhd, "dhd is NULL", ret);
+
+       if (ntoh32_ua((void *)&event->datalen) < OFFSETOF(wl_proxd_event_t, tlvs)) {
+               DHD_RTT(("%s: wrong datalen:%d\n", __FUNCTION__,
+                       ntoh32_ua((void *)&event->datalen)));
+               return -EINVAL;
+       }
+       event_type = ntoh32_ua((void *)&event->event_type);
+       if (event_type != WLC_E_PROXD) {
+               DHD_RTT_ERR((" failed event \n"));
+               return -EINVAL;
+       }
+
+       if (!event_data) {
+               DHD_RTT_ERR(("%s: event_data:NULL\n", __FUNCTION__));
+               return -EINVAL;
+       }
+       p_event = (wl_proxd_event_t *) event_data;
+       version = ltoh16(p_event->version);
+       if (version < WL_PROXD_API_VERSION) {
+               DHD_RTT_ERR(("ignore non-ftm event version = 0x%0x < WL_PROXD_API_VERSION (0x%x)\n",
+                       version, WL_PROXD_API_VERSION));
+               return ret;
+       }
+
+       event_type = (wl_proxd_event_type_t) ltoh16(p_event->type);
+
+       DHD_RTT(("event_type=0x%x, ntoh16()=0x%x, ltoh16()=0x%x\n",
+               p_event->type, ntoh16(p_event->type), ltoh16(p_event->type)));
+       p_loginfo = ftm_get_event_type_loginfo(event_type);
+       if (p_loginfo == NULL) {
+               DHD_RTT_ERR(("receive an invalid FTM event %d\n", event_type));
+               ret = -EINVAL;
+               return ret;     /* ignore this event */
+       }
+       /* get TLVs len, skip over event header */
+       if (ltoh16(p_event->len) < OFFSETOF(wl_proxd_event_t, tlvs)) {
+               DHD_RTT_ERR(("invalid FTM event length:%d\n", ltoh16(p_event->len)));
+               ret = -EINVAL;
+               return ret;
+       }
+       tlvs_len = ltoh16(p_event->len) - OFFSETOF(wl_proxd_event_t, tlvs);
+       DHD_RTT(("receive '%s' event: version=0x%x len=%d method=%d sid=%d tlvs_len=%d\n",
+               p_loginfo->text,
+               version,
+               ltoh16(p_event->len),
+               ltoh16(p_event->method),
+               ltoh16(p_event->sid),
+               tlvs_len));
+#ifdef WL_CFG80211
+#ifdef WL_NAN
+       if ((event_type == WL_PROXD_EVENT_BURST_END) &&
+                       dhd_rtt_is_nan_peer(dhd, &event->addr)) {
+               DHD_RTT(("WL_PROXD_EVENT_BURST_END for NAN RTT\n"));
+               ret = dhd_rtt_handle_nan_burst_end(dhd, &event->addr, p_event, tlvs_len);
+               return ret;
+       }
+#endif /* WL_NAN */
+
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", ret);
+       mutex_lock(&rtt_status->rtt_mutex);
+
+       if (RTT_IS_STOPPED(rtt_status)) {
+               /* Ignore the Proxd event */
+               DHD_RTT((" event handler rtt is stopped \n"));
+               if (rtt_status->flags == WL_PROXD_SESSION_FLAG_TARGET) {
+                       DHD_RTT(("Device is target/Responder. Recv the event. \n"));
+               } else {
+                       ret = BCME_NOTREADY;
+                       goto exit;
+               }
+       }
+
+       /* check current target_mac and event_mac are matching */
+       target = &rtt_status->rtt_config.target_info[rtt_status->cur_idx];
+       if (memcmp(&target->addr, &event->addr, ETHER_ADDR_LEN)) {
+               DHD_RTT(("Ignore Proxd event for the unexpected peer "MACDBG
+                       " expected peer "MACDBG"\n", MAC2STRDBG(&event->addr),
+                       MAC2STRDBG(&target->addr)));
+               goto exit;
+       }
+
+#endif /* WL_CFG80211 */
+
+#ifdef WL_CFG80211
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       is_new = !dhd_rtt_get_report_header(rtt_status,
+               &rtt_results_header, &event->addr);
+       GCC_DIAGNOSTIC_POP();
+#endif /* WL_CFG80211 */
+       switch (event_type) {
+       case WL_PROXD_EVENT_SESSION_CREATE:
+               DHD_RTT(("WL_PROXD_EVENT_SESSION_CREATE\n"));
+               break;
+       case WL_PROXD_EVENT_SESSION_START:
+               DHD_RTT(("WL_PROXD_EVENT_SESSION_START\n"));
+               break;
+       case WL_PROXD_EVENT_BURST_START:
+               DHD_RTT(("WL_PROXD_EVENT_BURST_START\n"));
+               break;
+       case WL_PROXD_EVENT_BURST_END:
+               DHD_RTT(("WL_PROXD_EVENT_BURST_END for Legacy RTT\n"));
+               /* allocate rtt_results for new legacy rtt results */
+               rtt_result = (rtt_result_t *)MALLOCZ(dhd->osh, sizeof(rtt_result_t));
+               if (!rtt_result) {
+                       ret = -ENOMEM;
+                       goto exit;
+               }
+               ret = dhd_rtt_handle_directed_rtt_burst_end(dhd, &event->addr,
+                       p_event, tlvs_len, rtt_result, FALSE);
+               if (rtt_result && (ret != BCME_OK)) {
+                       MFREE(dhd->osh, rtt_result,
+                               sizeof(rtt_result_t));
+                       goto exit;
+               }
+               break;
+       case WL_PROXD_EVENT_SESSION_END:
+               DHD_RTT(("WL_PROXD_EVENT_SESSION_END\n"));
+#ifdef WL_CFG80211
+               if (!RTT_IS_ENABLED(rtt_status)) {
+                       DHD_RTT(("Ignore the session end evt\n"));
+                       goto exit;
+               }
+#endif /* WL_CFG80211 */
+               if (tlvs_len > 0) {
+                       /* unpack TLVs and invokes the cbfn to print the event content TLVs */
+                       ret = bcm_unpack_xtlv_buf((void *) &session_status,
+                               (uint8 *)&p_event->tlvs[0], tlvs_len,
+                               BCM_XTLV_OPTION_ALIGN32, rtt_unpack_xtlv_cbfn);
+                       if (ret != BCME_OK) {
+                               DHD_RTT_ERR(("%s : Failed to unpack xtlv for an event\n",
+                                       __FUNCTION__));
+                               goto exit;
+                       }
+               }
+#ifdef WL_CFG80211
+               /* In case of no result for the peer device, make fake result for error case */
+               if (is_new) {
+                       dhd_rtt_create_failure_result(rtt_status, &event->addr);
+               }
+               DHD_RTT_MEM(("RTT Session End for Legacy peer "MACDBG"\n",
+                       MAC2STRDBG(&event->addr)));
+               dhd_rtt_handle_rtt_session_end(dhd);
+#endif /* WL_CFG80211 */
+               break;
+       case WL_PROXD_EVENT_SESSION_RESTART:
+               DHD_RTT(("WL_PROXD_EVENT_SESSION_RESTART\n"));
+               break;
+       case WL_PROXD_EVENT_BURST_RESCHED:
+               DHD_RTT(("WL_PROXD_EVENT_BURST_RESCHED\n"));
+               break;
+       case WL_PROXD_EVENT_SESSION_DESTROY:
+               DHD_RTT(("WL_PROXD_EVENT_SESSION_DESTROY\n"));
+               break;
+       case WL_PROXD_EVENT_FTM_FRAME:
+               DHD_RTT(("WL_PROXD_EVENT_FTM_FRAME\n"));
+               break;
+       case WL_PROXD_EVENT_DELAY:
+               DHD_RTT(("WL_PROXD_EVENT_DELAY\n"));
+               break;
+       case WL_PROXD_EVENT_VS_INITIATOR_RPT:
+               DHD_RTT(("WL_PROXD_EVENT_VS_INITIATOR_RPT\n "));
+               break;
+       case WL_PROXD_EVENT_RANGING:
+               DHD_RTT(("WL_PROXD_EVENT_RANGING\n"));
+               break;
+       case WL_PROXD_EVENT_COLLECT:
+               DHD_RTT(("WL_PROXD_EVENT_COLLECT\n"));
+               if (tlvs_len > 0) {
+                       void *buffer = NULL;
+                       if (!(buffer = (void *)MALLOCZ(dhd->osh, tlvs_len))) {
+                               ret = -ENOMEM;
+                               goto exit;
+                       }
+                       /* unpack TLVs and invokes the cbfn to print the event content TLVs */
+                       ret = bcm_unpack_xtlv_buf(buffer,
+                               (uint8 *)&p_event->tlvs[0], tlvs_len,
+                               BCM_XTLV_OPTION_NONE, rtt_unpack_xtlv_cbfn);
+                       MFREE(dhd->osh, buffer, tlvs_len);
+                       if (ret != BCME_OK) {
+                               DHD_RTT_ERR(("%s : Failed to unpack xtlv for event %d\n",
+                                       __FUNCTION__, event_type));
+                               goto exit;
+                       }
+               }
+               break;
+       case WL_PROXD_EVENT_MF_STATS:
+               DHD_RTT(("WL_PROXD_EVENT_MF_STATS\n"));
+               if (tlvs_len > 0) {
+                       void *buffer = NULL;
+                       if (!(buffer = (void *)MALLOCZ(dhd->osh, tlvs_len))) {
+                               ret = -ENOMEM;
+                               goto exit;
+                       }
+                       /* unpack TLVs and invokes the cbfn to print the event content TLVs */
+                       ret = bcm_unpack_xtlv_buf(buffer,
+                               (uint8 *)&p_event->tlvs[0], tlvs_len,
+                               BCM_XTLV_OPTION_NONE, rtt_unpack_xtlv_cbfn);
+                       MFREE(dhd->osh, buffer, tlvs_len);
+                       if (ret != BCME_OK) {
+                               DHD_RTT_ERR(("%s : Failed to unpack xtlv for event %d\n",
+                                       __FUNCTION__, event_type));
+                               goto exit;
+                       }
+               }
+               break;
+
+       default:
+               DHD_RTT_ERR(("WLC_E_PROXD: not supported EVENT Type:%d\n", event_type));
+               break;
+       }
+exit:
+#ifdef WL_CFG80211
+       mutex_unlock(&rtt_status->rtt_mutex);
+#endif /* WL_CFG80211 */
+
+       return ret;
+}
+
+#ifdef WL_CFG80211
+static void
+dhd_rtt_work(struct work_struct *work)
+{
+       rtt_status_info_t *rtt_status;
+       dhd_pub_t *dhd;
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       rtt_status = container_of(work, rtt_status_info_t, work);
+       GCC_DIAGNOSTIC_POP();
+
+       dhd = rtt_status->dhd;
+       if (dhd == NULL) {
+               DHD_RTT_ERR(("%s : dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+       (void) dhd_rtt_start(dhd);
+}
+#endif /* WL_CFG80211 */
+
+int
+dhd_rtt_capability(dhd_pub_t *dhd, rtt_capabilities_t *capa)
+{
+       rtt_status_info_t *rtt_status;
+       int err = BCME_OK;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       NULL_CHECK(capa, "capa is NULL", err);
+       bzero(capa, sizeof(rtt_capabilities_t));
+
+       /* set rtt capabilities */
+       if (rtt_status->rtt_capa.proto & RTT_CAP_ONE_WAY)
+               capa->rtt_one_sided_supported = 1;
+       if (rtt_status->rtt_capa.proto & RTT_CAP_FTM_WAY)
+               capa->rtt_ftm_supported = 1;
+
+       if (rtt_status->rtt_capa.feature & RTT_FEATURE_LCI)
+               capa->lci_support = 1;
+       if (rtt_status->rtt_capa.feature & RTT_FEATURE_LCR)
+               capa->lcr_support = 1;
+       if (rtt_status->rtt_capa.feature & RTT_FEATURE_PREAMBLE)
+               capa->preamble_support = 1;
+       if (rtt_status->rtt_capa.feature & RTT_FEATURE_BW)
+               capa->bw_support = 1;
+
+       /* bit mask */
+       capa->preamble_support = rtt_status->rtt_capa.preamble;
+       capa->bw_support = rtt_status->rtt_capa.bw;
+
+       return err;
+}
+
+#ifdef WL_CFG80211
+int
+dhd_rtt_avail_channel(dhd_pub_t *dhd, wifi_channel_info *channel_info)
+{
+       u32 chanspec = 0;
+       int err = BCME_OK;
+       chanspec_t c = 0;
+       u32 channel;
+       struct net_device *dev = dhd_linux_get_primary_netdev(dhd);
+
+       if ((err = wldev_iovar_getint(dev, "chanspec",
+               (s32 *)&chanspec)) == BCME_OK) {
+               c = (chanspec_t)dtoh32(chanspec);
+               c = wl_chspec_driver_to_host(c);
+               channel  = wf_chspec_ctlchan(c);
+               DHD_RTT((" control channel is %d \n", channel));
+               if (CHSPEC_IS20(c)) {
+                       channel_info->width = WIFI_CHAN_WIDTH_20;
+                       DHD_RTT((" band is 20 \n"));
+               } else if (CHSPEC_IS40(c)) {
+                       channel_info->width = WIFI_CHAN_WIDTH_40;
+                       DHD_RTT(("band is 40 \n"));
+               } else {
+                       channel_info->width = WIFI_CHAN_WIDTH_80;
+                       DHD_RTT(("band is 80 \n"));
+               }
+               if (CHSPEC_IS2G(c) && (channel >= CH_MIN_2G_CHANNEL) &&
+                       (channel <= CH_MAX_2G_CHANNEL)) {
+                       channel_info->center_freq =
+                               ieee80211_channel_to_frequency(channel, IEEE80211_BAND_2GHZ);
+               } else if (CHSPEC_IS5G(c) && channel >= CH_MIN_5G_CHANNEL) {
+                       channel_info->center_freq =
+                               ieee80211_channel_to_frequency(channel, IEEE80211_BAND_5GHZ);
+               }
+               if ((channel_info->width == WIFI_CHAN_WIDTH_80) ||
+                       (channel_info->width == WIFI_CHAN_WIDTH_40)) {
+                       channel = CHSPEC_CHANNEL(c);
+                       channel_info->center_freq0 =
+                               ieee80211_channel_to_frequency(channel, IEEE80211_BAND_5GHZ);
+               }
+       } else {
+               DHD_RTT_ERR(("Failed to get the chanspec \n"));
+       }
+       return err;
+}
+
+int
+dhd_rtt_enable_responder(dhd_pub_t *dhd, wifi_channel_info *channel_info)
+{
+       int err = BCME_OK;
+       char chanbuf[CHANSPEC_STR_LEN];
+       int pm = PM_OFF;
+       int ftm_cfg_cnt = 0;
+       chanspec_t chanspec;
+       wifi_channel_info channel;
+       struct net_device *dev = dhd_linux_get_primary_netdev(dhd);
+       ftm_config_options_info_t ftm_configs[FTM_MAX_CONFIGS];
+       ftm_config_param_info_t ftm_params[FTM_MAX_PARAMS];
+       rtt_status_info_t *rtt_status;
+
+       memset(&channel, 0, sizeof(channel));
+       BCM_REFERENCE(chanbuf);
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       if (RTT_IS_STOPPED(rtt_status)) {
+               DHD_RTT(("STA responder/Target. \n"));
+       }
+       DHD_RTT(("Enter %s \n", __FUNCTION__));
+       if (!dhd_is_associated(dhd, 0, NULL)) {
+               if (channel_info) {
+                       channel.width = channel_info->width;
+                       channel.center_freq = channel_info->center_freq;
+                       channel.center_freq0 = channel_info->center_freq;
+               }
+               else {
+                       channel.width = WIFI_CHAN_WIDTH_80;
+                       channel.center_freq = DEFAULT_FTM_FREQ;
+                       channel.center_freq0 = DEFAULT_FTM_CNTR_FREQ0;
+               }
+               chanspec =  dhd_rtt_convert_to_chspec(channel);
+               DHD_RTT(("chanspec/channel set as %s for rtt.\n",
+                       wf_chspec_ntoa(chanspec, chanbuf)));
+               err = wldev_iovar_setint(dev, "chanspec", chanspec);
+               if (err) {
+                       DHD_RTT_ERR(("Failed to set the chanspec \n"));
+               }
+       }
+       rtt_status->pm = PM_OFF;
+       err = wldev_ioctl_get(dev, WLC_GET_PM, &rtt_status->pm, sizeof(rtt_status->pm));
+       DHD_RTT(("Current PM value read %d\n", rtt_status->pm));
+       if (err) {
+               DHD_RTT_ERR(("Failed to get the PM value \n"));
+       } else {
+               err = wldev_ioctl_set(dev, WLC_SET_PM, &pm, sizeof(pm));
+               if (err) {
+                       DHD_RTT_ERR(("Failed to set the PM \n"));
+                       rtt_status->pm_restore = FALSE;
+               } else {
+                       rtt_status->pm_restore = TRUE;
+               }
+       }
+       if (!RTT_IS_ENABLED(rtt_status)) {
+               err = dhd_rtt_ftm_enable(dhd, TRUE);
+               if (err) {
+                       DHD_RTT_ERR(("Failed to enable FTM (%d)\n", err));
+                       goto exit;
+               }
+               DHD_RTT(("FTM enabled \n"));
+       }
+       rtt_status->status = RTT_ENABLED;
+       DHD_RTT(("Responder enabled \n"));
+       memset(ftm_configs, 0, sizeof(ftm_configs));
+       memset(ftm_params, 0, sizeof(ftm_params));
+       ftm_configs[ftm_cfg_cnt].enable = TRUE;
+       ftm_configs[ftm_cfg_cnt++].flags = WL_PROXD_SESSION_FLAG_TARGET;
+       rtt_status->flags = WL_PROXD_SESSION_FLAG_TARGET;
+       DHD_RTT(("Set the device as responder \n"));
+       err = dhd_rtt_ftm_config(dhd, FTM_DEFAULT_SESSION, FTM_CONFIG_CAT_OPTIONS,
+               ftm_configs, ftm_cfg_cnt);
+exit:
+       if (err) {
+               rtt_status->status = RTT_STOPPED;
+               DHD_RTT_ERR(("rtt is stopped  %s \n", __FUNCTION__));
+               dhd_rtt_ftm_enable(dhd, FALSE);
+               DHD_RTT(("restoring the PM value \n"));
+               if (rtt_status->pm_restore) {
+                       pm = PM_FAST;
+                       err = wldev_ioctl_set(dev, WLC_SET_PM, &pm, sizeof(pm));
+                       if (err) {
+                               DHD_RTT_ERR(("Failed to restore PM \n"));
+                       } else {
+                               rtt_status->pm_restore = FALSE;
+                       }
+               }
+       }
+       return err;
+}
+
+int
+dhd_rtt_cancel_responder(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       rtt_status_info_t *rtt_status;
+       int pm = 0;
+       struct net_device *dev = dhd_linux_get_primary_netdev(dhd);
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       DHD_RTT(("Enter %s \n", __FUNCTION__));
+       err = dhd_rtt_ftm_enable(dhd, FALSE);
+       if (err) {
+               DHD_RTT_ERR(("failed to disable FTM (%d)\n", err));
+       }
+       rtt_status->status = RTT_STOPPED;
+       if (rtt_status->pm_restore) {
+               pm = PM_FAST;
+               DHD_RTT(("pm_restore =%d \n", rtt_status->pm_restore));
+               err = wldev_ioctl_set(dev, WLC_SET_PM, &pm, sizeof(pm));
+               if (err) {
+                       DHD_RTT_ERR(("Failed to restore PM \n"));
+               } else {
+                       rtt_status->pm_restore = FALSE;
+               }
+       }
+       return err;
+}
+#endif /* WL_CFG80211 */
+
+/*
+ * DHD Attach Context
+ */
+int
+dhd_rtt_attach(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+#ifdef WL_CFG80211
+       rtt_status_info_t *rtt_status = NULL;
+
+       dhd->rtt_supported = FALSE;
+       if (dhd->rtt_state) {
+               return err;
+       }
+
+       dhd->rtt_state = (rtt_status_info_t *)MALLOCZ(dhd->osh,
+               sizeof(rtt_status_info_t));
+       if (dhd->rtt_state == NULL) {
+               err = BCME_NOMEM;
+               DHD_RTT_ERR(("%s : failed to create rtt_state\n", __FUNCTION__));
+               return err;
+       }
+       bzero(dhd->rtt_state, sizeof(rtt_status_info_t));
+       rtt_status = GET_RTTSTATE(dhd);
+       rtt_status->rtt_config.target_info =
+               (rtt_target_info_t *)MALLOCZ(dhd->osh,
+               TARGET_INFO_SIZE(RTT_MAX_TARGET_CNT));
+       if (rtt_status->rtt_config.target_info == NULL) {
+               DHD_RTT_ERR(("%s failed to allocate the target info for %d\n",
+                       __FUNCTION__, RTT_MAX_TARGET_CNT));
+               err = BCME_NOMEM;
+               goto exit;
+       }
+       rtt_status->dhd = dhd;
+       mutex_init(&rtt_status->rtt_mutex);
+       mutex_init(&rtt_status->rtt_work_mutex);
+       mutex_init(&rtt_status->geofence_mutex);
+       INIT_LIST_HEAD(&rtt_status->noti_fn_list);
+       INIT_LIST_HEAD(&rtt_status->rtt_results_cache);
+       INIT_WORK(&rtt_status->work, dhd_rtt_work);
+       /* initialize proxd timer */
+       INIT_DELAYED_WORK(&rtt_status->proxd_timeout, dhd_rtt_timeout_work);
+#ifdef WL_NAN
+       /* initialize proxd retry timer */
+       INIT_DELAYED_WORK(&rtt_status->rtt_retry_timer, dhd_rtt_retry_work);
+#endif /* WL_NAN */
+exit:
+       if (err < 0) {
+               MFREE(dhd->osh, rtt_status->rtt_config.target_info,
+                       TARGET_INFO_SIZE(RTT_MAX_TARGET_CNT));
+               MFREE(dhd->osh, dhd->rtt_state, sizeof(rtt_status_info_t));
+       }
+#endif /* WL_CFG80211 */
+       return err;
+
+}
+
+/*
+ * DHD Detach Context
+ */
+int
+dhd_rtt_detach(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+
+#ifdef WL_CFG80211
+       rtt_status_info_t *rtt_status;
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+
+       err = dhd_rtt_deinit(dhd);
+       if (err != BCME_OK) {
+               DHD_RTT_ERR(("dhd_rtt_deinit failed while detaching"
+                       " err = %d\n", err));
+               goto exit;
+       }
+
+exit:
+       MFREE(dhd->osh, rtt_status->rtt_config.target_info,
+               TARGET_INFO_SIZE(RTT_MAX_TARGET_CNT));
+       MFREE(dhd->osh, dhd->rtt_state, sizeof(rtt_status_info_t));
+
+#endif /* WL_CFG80211 */
+
+       return err;
+}
+
+/*
+ * If Up context
+ */
+int
+dhd_rtt_init(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+#ifdef WL_CFG80211
+       int ret;
+       int32 version;
+       rtt_status_info_t *rtt_status;
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+
+       ret = dhd_rtt_get_version(dhd, &version);
+       if (ret == BCME_OK && (version == WL_PROXD_API_VERSION)) {
+               DHD_RTT_ERR(("%s : FTM is supported\n", __FUNCTION__));
+               dhd->rtt_supported = TRUE;
+               /* TODO :  need to find a way to check rtt capability */
+               /* rtt_status->rtt_capa.proto |= RTT_CAP_ONE_WAY; */
+               rtt_status->rtt_capa.proto |= RTT_CAP_FTM_WAY;
+
+               /* indicate to set tx rate */
+               rtt_status->rtt_capa.feature |= RTT_FEATURE_LCI;
+               rtt_status->rtt_capa.feature |= RTT_FEATURE_LCR;
+               rtt_status->rtt_capa.feature |= RTT_FEATURE_PREAMBLE;
+               rtt_status->rtt_capa.preamble |= RTT_PREAMBLE_VHT;
+               rtt_status->rtt_capa.preamble |= RTT_PREAMBLE_HT;
+
+               /* indicate to set bandwith */
+               rtt_status->rtt_capa.feature |= RTT_FEATURE_BW;
+               rtt_status->rtt_capa.bw |= RTT_BW_20;
+               rtt_status->rtt_capa.bw |= RTT_BW_40;
+               rtt_status->rtt_capa.bw |= RTT_BW_80;
+       } else {
+               if ((ret != BCME_OK) || (version == 0)) {
+                       DHD_RTT_ERR(("%s : FTM is not supported\n", __FUNCTION__));
+               } else {
+                       DHD_RTT_ERR(("%s : FTM version mismatch between HOST (%d) and FW (%d)\n",
+                               __FUNCTION__, WL_PROXD_API_VERSION, version));
+               }
+               goto exit;
+       }
+       /* cancel all of RTT request once we got the cancel request */
+       rtt_status->all_cancel = TRUE;
+
+exit:
+#endif /* WL_CFG80211 */
+
+       return err;
+}
+
+/*
+ * If Down context
+ */
+int
+dhd_rtt_deinit(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+#ifdef WL_CFG80211
+       rtt_status_info_t *rtt_status;
+       rtt_results_header_t *rtt_header, *next;
+       rtt_result_t *rtt_result, *next2;
+       struct rtt_noti_callback *iter, *iter2;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+
+#ifdef WL_NAN
+       if (delayed_work_pending(&rtt_status->rtt_retry_timer)) {
+               cancel_delayed_work_sync(&rtt_status->rtt_retry_timer);
+       }
+#endif /* WL_NAN */
+
+       if (work_pending(&rtt_status->work)) {
+               cancel_work_sync(&rtt_status->work);
+               rtt_status->rtt_sched = FALSE;
+       }
+
+       if (delayed_work_pending(&rtt_status->proxd_timeout)) {
+               cancel_delayed_work_sync(&rtt_status->proxd_timeout);
+       }
+
+       rtt_status->status = RTT_STOPPED;
+       DHD_RTT(("rtt is stopped %s \n", __FUNCTION__));
+       /* clear evt callback list */
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       if (!list_empty(&rtt_status->noti_fn_list)) {
+               list_for_each_entry_safe(iter, iter2, &rtt_status->noti_fn_list, list) {
+                       list_del(&iter->list);
+                       MFREE(dhd->osh, iter, sizeof(struct rtt_noti_callback));
+               }
+       }
+       /* remove the rtt results */
+       if (!list_empty(&rtt_status->rtt_results_cache)) {
+               list_for_each_entry_safe(rtt_header, next, &rtt_status->rtt_results_cache, list) {
+                       list_del(&rtt_header->list);
+                       list_for_each_entry_safe(rtt_result, next2,
+                                       &rtt_header->result_list, list) {
+                               list_del(&rtt_result->list);
+                               MFREE(dhd->osh, rtt_result, sizeof(rtt_result_t));
+                       }
+                       MFREE(dhd->osh, rtt_header, sizeof(rtt_results_header_t));
+               }
+       }
+       GCC_DIAGNOSTIC_POP();
+#endif /* WL_CFG80211 */
+       return err;
+}
diff --git a/bcmdhd.101.10.240.x/dhd_rtt.h b/bcmdhd.101.10.240.x/dhd_rtt.h
new file mode 100644 (file)
index 0000000..7ab4d06
--- /dev/null
@@ -0,0 +1,514 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), RTT
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+#ifndef __DHD_RTT_H__
+#define __DHD_RTT_H__
+
+#include <dngl_stats.h>
+#include "wifi_stats.h"
+
+#define RTT_MAX_TARGET_CNT 50
+#define RTT_MAX_FRAME_CNT 25
+#define RTT_MAX_RETRY_CNT 10
+#define DEFAULT_FTM_CNT 6
+#define DEFAULT_RETRY_CNT 6
+#define DEFAULT_FTM_FREQ 5180
+#define DEFAULT_FTM_CNTR_FREQ0 5210
+#define RTT_MAX_GEOFENCE_TARGET_CNT 8
+
+#define TARGET_INFO_SIZE(count) (sizeof(rtt_target_info_t) * count)
+
+#define TARGET_TYPE(target) (target->type)
+
+#define RTT_IS_ENABLED(rtt_status) (rtt_status->status == RTT_ENABLED)
+#define RTT_IS_STOPPED(rtt_status) (rtt_status->status == RTT_STOPPED)
+
+#define GEOFENCE_RTT_LOCK(rtt_status) mutex_lock(&(rtt_status)->geofence_mutex)
+#define GEOFENCE_RTT_UNLOCK(rtt_status) mutex_unlock(&(rtt_status)->geofence_mutex)
+
+#ifndef BIT
+#define BIT(x) (1 << (x))
+#endif
+
+/* DSSS, CCK and 802.11n rates in [500kbps] units */
+#define WL_MAXRATE     108     /* in 500kbps units */
+#define WL_RATE_1M     2       /* in 500kbps units */
+#define WL_RATE_2M     4       /* in 500kbps units */
+#define WL_RATE_5M5    11      /* in 500kbps units */
+#define WL_RATE_11M    22      /* in 500kbps units */
+#define WL_RATE_6M     12      /* in 500kbps units */
+#define WL_RATE_9M     18      /* in 500kbps units */
+#define WL_RATE_12M    24      /* in 500kbps units */
+#define WL_RATE_18M    36      /* in 500kbps units */
+#define WL_RATE_24M    48      /* in 500kbps units */
+#define WL_RATE_36M    72      /* in 500kbps units */
+#define WL_RATE_48M    96      /* in 500kbps units */
+#define WL_RATE_54M    108     /* in 500kbps units */
+#define GET_RTTSTATE(dhd) ((rtt_status_info_t *)dhd->rtt_state)
+
+#ifdef WL_NAN
+/* RTT Retry Timer Interval */
+/* Fix Me: Revert back once retry logic is back in place */
+#define DHD_RTT_RETRY_TIMER_INTERVAL_MS                        -1
+#endif /* WL_NAN */
+
+#define DHD_RTT_INVALID_TARGET_INDEX           -1
+
+enum rtt_role {
+       RTT_INITIATOR = 0,
+       RTT_TARGET = 1
+};
+enum rtt_status {
+       RTT_STOPPED = 0,
+       RTT_STARTED = 1,
+       RTT_ENABLED = 2
+};
+typedef int64_t wifi_timestamp; /* In microseconds (us) */
+typedef int64_t wifi_timespan;
+typedef int32 wifi_rssi_rtt;
+
+typedef enum {
+       RTT_INVALID,
+       RTT_ONE_WAY,
+       RTT_TWO_WAY,
+       RTT_AUTO
+} rtt_type_t;
+
+/* RTT peer type */
+typedef enum {
+       RTT_PEER_AP         = 0x1,
+       RTT_PEER_STA        = 0x2,
+       RTT_PEER_P2P_GO     = 0x3,
+       RTT_PEER_P2P_CLIENT = 0x4,
+       RTT_PEER_NAN        = 0x5,
+       RTT_PEER_INVALID    = 0x6
+} rtt_peer_type_t;
+
+/* Ranging status */
+typedef enum rtt_reason {
+       RTT_STATUS_SUCCESS       = 0,
+       RTT_STATUS_FAILURE       = 1,           // general failure status
+       RTT_STATUS_FAIL_NO_RSP   = 2,           // target STA does not respond to request
+       RTT_STATUS_FAIL_REJECTED = 3,           // request rejected. Applies to 2-sided RTT only
+       RTT_STATUS_FAIL_NOT_SCHEDULED_YET  = 4,
+       RTT_STATUS_FAIL_TM_TIMEOUT         = 5, // timing measurement times out
+       RTT_STATUS_FAIL_AP_ON_DIFF_CHANNEL = 6, // Target on different channel, cannot range
+       RTT_STATUS_FAIL_NO_CAPABILITY  = 7,     // ranging not supported
+       RTT_STATUS_ABORTED             = 8,     // request aborted for unknown reason
+       RTT_STATUS_FAIL_INVALID_TS     = 9,     // Invalid T1-T4 timestamp
+       RTT_STATUS_FAIL_PROTOCOL       = 10,    // 11mc protocol failed
+       RTT_STATUS_FAIL_SCHEDULE       = 11,    // request could not be scheduled
+       RTT_STATUS_FAIL_BUSY_TRY_LATER = 12,    // responder cannot collaborate at time of request
+       RTT_STATUS_INVALID_REQ         = 13,    // bad request args
+       RTT_STATUS_NO_WIFI             = 14,    // WiFi not enabled Responder overrides param info
+                                               // cannot range with new params
+       RTT_STATUS_FAIL_FTM_PARAM_OVERRIDE = 15
+} rtt_reason_t;
+
+enum {
+       RTT_CAP_ONE_WAY  = BIT(0),
+       /* IEEE802.11mc */
+       RTT_CAP_FTM_WAY  = BIT(1)
+};
+
+enum {
+       RTT_FEATURE_LCI = BIT(0),
+       RTT_FEATURE_LCR = BIT(1),
+       RTT_FEATURE_PREAMBLE = BIT(2),
+       RTT_FEATURE_BW = BIT(3)
+};
+
+enum {
+       RTT_PREAMBLE_LEGACY = BIT(0),
+       RTT_PREAMBLE_HT = BIT(1),
+       RTT_PREAMBLE_VHT = BIT(2)
+};
+
+enum {
+       RTT_BW_5 = BIT(0),
+       RTT_BW_10 = BIT(1),
+       RTT_BW_20 = BIT(2),
+       RTT_BW_40 = BIT(3),
+       RTT_BW_80 = BIT(4),
+       RTT_BW_160 = BIT(5)
+};
+
+enum rtt_rate_bw {
+       RTT_RATE_20M,
+       RTT_RATE_40M,
+       RTT_RATE_80M,
+       RTT_RATE_160M
+};
+
+typedef enum ranging_type {
+       RTT_TYPE_INVALID        =       0,
+       RTT_TYPE_LEGACY         =       1,
+       RTT_TYPE_NAN_DIRECTED   =       2,
+       RTT_TYPE_NAN_GEOFENCE   =       3
+} ranging_type_t;
+
+#define FTM_MAX_NUM_BURST_EXP  14
+#define HAS_11MC_CAP(cap) (cap & RTT_CAP_FTM_WAY)
+#define HAS_ONEWAY_CAP(cap) (cap & RTT_CAP_ONE_WAY)
+#define HAS_RTT_CAP(cap) (HAS_ONEWAY_CAP(cap) || HAS_11MC_CAP(cap))
+
+typedef struct rtt_target_info {
+       struct ether_addr addr;
+       struct ether_addr local_addr;
+       rtt_type_t type; /* rtt_type */
+       rtt_peer_type_t peer; /* peer type */
+       wifi_channel_info channel; /* channel information */
+       chanspec_t chanspec; /* chanspec for channel */
+       bool    disable; /* disable for RTT measurement */
+       /*
+       * Time interval between bursts (units: 100 ms).
+       * Applies to 1-sided and 2-sided RTT multi-burst requests.
+       * Range: 0-31, 0: no preference by initiator (2-sided RTT)
+       */
+       uint32  burst_period;
+       /*
+       * Total number of RTT bursts to be executed. It will be
+       * specified in the same way as the parameter "Number of
+       * Burst Exponent" found in the FTM frame format. It
+       * applies to both: 1-sided RTT and 2-sided RTT. Valid
+       * values are 0 to 15 as defined in 802.11mc std.
+       * 0 means single shot
+       * The implication of this parameter on the maximum
+       * number of RTT results is the following:
+       * for 1-sided RTT: max num of RTT results = (2^num_burst)*(num_frames_per_burst)
+       * for 2-sided RTT: max num of RTT results = (2^num_burst)*(num_frames_per_burst - 1)
+       */
+       uint16 num_burst;
+       /*
+       * num of frames per burst.
+       * Minimum value = 1, Maximum value = 31
+       * For 2-sided this equals the number of FTM frames
+       * to be attempted in a single burst. This also
+       * equals the number of FTM frames that the
+       * initiator will request that the responder send
+       * in a single frame
+       */
+       uint32 num_frames_per_burst;
+       /*
+        * num of frames in each RTT burst
+        * for single side, measurement result num = frame number
+        * for 2 side RTT, measurement result num  = frame number - 1
+        */
+       uint32 num_retries_per_ftm; /* retry time for RTT measurment frame */
+       /* following fields are only valid for 2 side RTT */
+       uint32 num_retries_per_ftmr;
+       uint8  LCI_request;
+       uint8  LCR_request;
+       /*
+       * Applies to 1-sided and 2-sided RTT. Valid values will
+       * be 2-11 and 15 as specified by the 802.11mc std for
+       * the FTM parameter burst duration. In a multi-burst
+       * request, if responder overrides with larger value,
+       * the initiator will return failure. In a single-burst
+       * request if responder overrides with larger value,
+       * the initiator will sent TMR_STOP to terminate RTT
+       * at the end of the burst_duration it requested.
+       */
+       uint32 burst_duration;
+       uint32 burst_timeout;
+       uint8  preamble; /* 1 - Legacy, 2 - HT, 4 - VHT */
+       uint8  bw;  /* 5, 10, 20, 40, 80, 160 */
+} rtt_target_info_t;
+
+typedef struct rtt_goefence_target_info {
+       bool valid;
+       struct ether_addr peer_addr;
+} rtt_geofence_target_info_t;
+
+typedef struct rtt_config_params {
+       int8 rtt_target_cnt;
+       rtt_target_info_t *target_info;
+} rtt_config_params_t;
+
+typedef struct rtt_geofence_setup_status {
+       bool geofence_setup_inprog; /* Lock to serialize geofence setup */
+       struct nan_ranging_inst *rng_inst; /* Locked for this ranging instance */
+} rtt_geofence_setup_status_t;
+
+typedef struct rtt_geofence_cfg {
+       int8 geofence_target_cnt;
+       int8 cur_target_idx;
+       rtt_geofence_target_info_t geofence_target_info[RTT_MAX_GEOFENCE_TARGET_CNT];
+       int geofence_rtt_interval;
+       int max_geofence_sessions; /* Polled from FW via IOVAR Query */
+       int geofence_sessions_cnt; /* No. of Geofence/Resp Sessions running currently */
+       rtt_geofence_setup_status_t geofence_setup_status;
+#ifdef RTT_GEOFENCE_CONT
+       bool geofence_cont;
+#endif /* RTT_GEOFENCE_CONT */
+} rtt_geofence_cfg_t;
+
+/*
+ * Keep Adding more reasons
+ * going forward if needed
+ */
+enum rtt_schedule_reason {
+       RTT_SCHED_HOST_TRIGGER                  = 1, /* On host command for directed RTT */
+       RTT_SCHED_SUB_MATCH                     = 2, /* on Sub Match for svc with range req */
+       RTT_SCHED_DIR_TRIGGER_FAIL              = 3, /* On failure of Directed RTT Trigger */
+       RTT_SCHED_DP_END                        = 4, /* ON NDP End event from fw */
+       RTT_SCHED_DP_REJECTED                   = 5, /* On receving reject dp event from fw */
+       RTT_SCHED_RNG_RPT_DIRECTED              = 6, /* On Ranging report for directed RTT */
+       RTT_SCHED_RNG_TERM                      = 7, /* On Range Term Indicator */
+       RTT_SHCED_HOST_DIRECTED_TERM            = 8, /* On host terminating directed RTT sessions */
+       RTT_SCHED_RNG_RPT_GEOFENCE              = 9, /* On Ranging report for geofence RTT */
+       RTT_SCHED_RTT_RETRY_GEOFENCE            = 10, /* On Geofence Retry */
+       RTT_SCHED_RNG_TERM_PEND_ROLE_CHANGE     = 11, /* On Rng Term, while pending role change */
+       RTT_SCHED_RNG_TERM_SUB_SVC_CANCEL       = 12, /* Due rng canc attempt, on sub cancel */
+       RTT_SCHED_RNG_TERM_SUB_SVC_UPD          = 13, /* Due rng canc attempt, on sub update */
+       RTT_SCHED_RNG_TERM_PUB_RNG_CLEAR        = 14, /* Due rng canc attempt, on pub upd/timeout */
+       RTT_SCHED_RNG_RESP_IND                  = 15  /* Due to rng resp ind */
+};
+
+/*
+ * Keep Adding more invalid RTT states
+ * going forward if needed
+ */
+enum rtt_invalid_state {
+       RTT_STATE_VALID                 = 0, /* RTT state is valid */
+       RTT_STATE_INV_REASON_NDP_EXIST  = 1 /* RTT state invalid as ndp exists */
+};
+
+typedef struct rtt_status_info {
+       dhd_pub_t       *dhd;
+       int8            status;   /* current status for the current entry */
+       int8            txchain; /* current device tx chain */
+       int             pm; /* to save current value of pm */
+       int8            pm_restore; /* flag to reset the old value of pm */
+       int8            cur_idx; /* current entry to do RTT */
+       bool            all_cancel; /* cancel all request once we got the cancel requet */
+       uint32          flags; /* indicate whether device is configured as initiator or target */
+       struct capability {
+               int32 proto     :8;
+               int32 feature   :8;
+               int32 preamble  :8;
+               int32 bw        :8;
+       } rtt_capa; /* rtt capability */
+       struct                  mutex rtt_mutex;
+       struct                  mutex rtt_work_mutex;
+       struct                  mutex geofence_mutex;
+       rtt_config_params_t     rtt_config;
+       rtt_geofence_cfg_t      geofence_cfg;
+       struct work_struct      work;
+       struct list_head        noti_fn_list;
+       struct list_head        rtt_results_cache; /* store results for RTT */
+       int                     rtt_sched_reason; /* rtt_schedule_reason: what scheduled RTT */
+       struct delayed_work     proxd_timeout; /* Proxd Timeout work */
+       struct delayed_work     rtt_retry_timer;   /* Timer for retry RTT after all targets done */
+       bool                    rtt_sched; /* TO serialize rtt thread */
+} rtt_status_info_t;
+
+typedef struct rtt_report {
+       struct ether_addr addr;
+       unsigned int burst_num; /* # of burst inside a multi-burst request */
+       unsigned int ftm_num; /* total RTT measurement frames attempted */
+       unsigned int success_num; /* total successful RTT measurement frames */
+       uint8  num_per_burst_peer; /* max number of FTM number per burst the peer support */
+       rtt_reason_t status; /* raging status */
+       /* in s, 11mc only, only for RTT_REASON_FAIL_BUSY_TRY_LATER, 1- 31s */
+       uint8 retry_after_duration;
+       rtt_type_t type; /* rtt type */
+       wifi_rssi_rtt  rssi; /* average rssi in 0.5 dB steps e.g. 143 implies -71.5 dB */
+       wifi_rssi_rtt  rssi_spread; /* rssi spread in 0.5 db steps e.g. 5 implies 2.5 spread */
+       /*
+       * 1-sided RTT: TX rate of RTT frame.
+       * 2-sided RTT: TX rate of initiator's Ack in response to FTM frame.
+       */
+       wifi_rate_v1 tx_rate;
+       /*
+       * 1-sided RTT: TX rate of Ack from other side.
+       * 2-sided RTT: TX rate of FTM frame coming from responder.
+       */
+       wifi_rate_v1 rx_rate;
+       wifi_timespan rtt;      /*  round trip time in 0.1 nanoseconds */
+       wifi_timespan rtt_sd;   /* rtt standard deviation in 0.1 nanoseconds */
+       wifi_timespan rtt_spread; /* difference between max and min rtt times recorded */
+       int distance; /* distance in cm (optional) */
+       int distance_sd; /* standard deviation in cm (optional) */
+       int distance_spread; /* difference between max and min distance recorded (optional) */
+       wifi_timestamp ts; /* time of the measurement (in microseconds since boot) */
+       int burst_duration; /* in ms, how long the FW time is to fininish one burst measurement */
+       int negotiated_burst_num; /* Number of bursts allowed by the responder */
+       bcm_tlv_t *LCI; /* LCI Report */
+       bcm_tlv_t *LCR; /* Location Civic Report */
+} rtt_report_t;
+#define RTT_REPORT_SIZE (sizeof(rtt_report_t))
+
+/* rtt_results_header to maintain rtt result list per mac address */
+typedef struct rtt_results_header {
+       struct ether_addr peer_mac;
+       uint32 result_cnt;
+       uint32 result_tot_len; /* sum of report_len of rtt_result */
+       struct list_head list;
+       struct list_head result_list;
+} rtt_results_header_t;
+struct rtt_result_detail {
+       uint8 num_ota_meas;
+       uint32 result_flags;
+};
+/* rtt_result to link all of rtt_report */
+typedef struct rtt_result {
+       struct list_head list;
+       struct rtt_report report;
+       int32 report_len; /* total length of rtt_report */
+       struct rtt_result_detail rtt_detail;
+       int32 detail_len;
+} rtt_result_t;
+
+/* RTT Capabilities */
+typedef struct rtt_capabilities {
+       uint8 rtt_one_sided_supported;  /* if 1-sided rtt data collection is supported */
+       uint8 rtt_ftm_supported;        /* if ftm rtt data collection is supported */
+       uint8 lci_support;              /* location configuration information */
+       uint8 lcr_support;              /* Civic Location */
+       uint8 preamble_support;         /* bit mask indicate what preamble is supported */
+       uint8 bw_support;               /* bit mask indicate what BW is supported */
+} rtt_capabilities_t;
+
+/* RTT responder information */
+typedef struct wifi_rtt_responder {
+       wifi_channel_info channel;   /* channel of responder */
+       uint8 preamble;             /* preamble supported by responder */
+} wifi_rtt_responder_t;
+
+typedef void (*dhd_rtt_compl_noti_fn)(void *ctx, void *rtt_data);
+/* Linux wrapper to call common dhd_rtt_set_cfg */
+int dhd_dev_rtt_set_cfg(struct net_device *dev, void *buf);
+
+int dhd_dev_rtt_cancel_cfg(struct net_device *dev, struct ether_addr *mac_list, int mac_cnt);
+
+int dhd_dev_rtt_register_noti_callback(struct net_device *dev, void *ctx,
+       dhd_rtt_compl_noti_fn noti_fn);
+
+int dhd_dev_rtt_unregister_noti_callback(struct net_device *dev, dhd_rtt_compl_noti_fn noti_fn);
+
+int dhd_dev_rtt_capability(struct net_device *dev, rtt_capabilities_t *capa);
+
+int dhd_dev_rtt_avail_channel(struct net_device *dev, wifi_channel_info *channel_info);
+
+int dhd_dev_rtt_enable_responder(struct net_device *dev, wifi_channel_info *channel_info);
+
+int dhd_dev_rtt_cancel_responder(struct net_device *dev);
+/* export to upper layer */
+chanspec_t dhd_rtt_convert_to_chspec(wifi_channel_info channel);
+
+int dhd_rtt_idx_to_burst_duration(uint idx);
+
+int dhd_rtt_set_cfg(dhd_pub_t *dhd, rtt_config_params_t *params);
+
+#ifdef WL_NAN
+void dhd_rtt_initialize_geofence_cfg(dhd_pub_t *dhd);
+#ifdef RTT_GEOFENCE_CONT
+void dhd_rtt_set_geofence_cont_ind(dhd_pub_t *dhd, bool geofence_cont);
+
+void dhd_rtt_get_geofence_cont_ind(dhd_pub_t *dhd, bool* geofence_cont);
+#endif /* RTT_GEOFENCE_CONT */
+
+#ifdef RTT_GEOFENCE_INTERVAL
+void dhd_rtt_set_geofence_rtt_interval(dhd_pub_t *dhd, int interval);
+#endif /* RTT_GEOFENCE_INTERVAL */
+
+int dhd_rtt_get_geofence_max_sessions(dhd_pub_t *dhd);
+
+bool dhd_rtt_geofence_sessions_maxed_out(dhd_pub_t *dhd);
+
+int dhd_rtt_get_geofence_sessions_cnt(dhd_pub_t *dhd);
+
+int dhd_rtt_update_geofence_sessions_cnt(dhd_pub_t *dhd, bool incr,
+       struct ether_addr *peer_addr);
+
+int8 dhd_rtt_get_geofence_target_cnt(dhd_pub_t *dhd);
+
+rtt_geofence_target_info_t* dhd_rtt_get_geofence_target_head(dhd_pub_t *dhd);
+
+rtt_geofence_target_info_t* dhd_rtt_get_geofence_current_target(dhd_pub_t *dhd);
+
+rtt_geofence_target_info_t*
+dhd_rtt_get_geofence_target(dhd_pub_t *dhd, struct ether_addr* peer_addr,
+       int8 *index);
+
+int dhd_rtt_add_geofence_target(dhd_pub_t *dhd, rtt_geofence_target_info_t  *target);
+
+int dhd_rtt_remove_geofence_target(dhd_pub_t *dhd, struct ether_addr *peer_addr);
+
+int dhd_rtt_delete_geofence_target_list(dhd_pub_t *dhd);
+
+int dhd_rtt_delete_nan_session(dhd_pub_t *dhd);
+#endif /* WL_NAN */
+
+uint8 dhd_rtt_invalid_states(struct net_device *ndev, struct ether_addr *peer_addr);
+
+void dhd_rtt_schedule_rtt_work_thread(dhd_pub_t *dhd, int sched_reason);
+
+int dhd_rtt_stop(dhd_pub_t *dhd, struct ether_addr *mac_list, int mac_cnt);
+
+int dhd_rtt_register_noti_callback(dhd_pub_t *dhd, void *ctx, dhd_rtt_compl_noti_fn noti_fn);
+
+int dhd_rtt_unregister_noti_callback(dhd_pub_t *dhd, dhd_rtt_compl_noti_fn noti_fn);
+
+int dhd_rtt_event_handler(dhd_pub_t *dhd, wl_event_msg_t *event, void *event_data);
+
+int dhd_rtt_capability(dhd_pub_t *dhd, rtt_capabilities_t *capa);
+
+int dhd_rtt_avail_channel(dhd_pub_t *dhd, wifi_channel_info *channel_info);
+
+int dhd_rtt_enable_responder(dhd_pub_t *dhd, wifi_channel_info *channel_info);
+
+int dhd_rtt_cancel_responder(dhd_pub_t *dhd);
+
+int dhd_rtt_attach(dhd_pub_t *dhd);
+
+int dhd_rtt_detach(dhd_pub_t *dhd);
+
+int dhd_rtt_init(dhd_pub_t *dhd);
+
+int dhd_rtt_deinit(dhd_pub_t *dhd);
+
+#ifdef WL_CFG80211
+#ifdef WL_NAN
+int dhd_rtt_handle_nan_rtt_session_end(dhd_pub_t *dhd,
+       struct ether_addr *peer);
+
+void dhd_rtt_move_geofence_cur_target_idx_to_next(dhd_pub_t *dhd);
+
+int8 dhd_rtt_get_geofence_cur_target_idx(dhd_pub_t *dhd);
+
+void dhd_rtt_set_geofence_cur_target_idx(dhd_pub_t *dhd, int8 idx);
+
+rtt_geofence_setup_status_t* dhd_rtt_get_geofence_setup_status(dhd_pub_t *dhd);
+
+bool dhd_rtt_is_geofence_setup_inprog(dhd_pub_t *dhd);
+
+bool dhd_rtt_is_geofence_setup_inprog_with_peer(dhd_pub_t *dhd,
+       struct ether_addr *peer_addr);
+
+void dhd_rtt_set_geofence_setup_status(dhd_pub_t *dhd, bool inprog,
+       struct ether_addr *peer_addr);
+#endif /* WL_NAN */
+#endif /* WL_CFG80211 */
+
+#endif /* __DHD_RTT_H__ */
diff --git a/bcmdhd.101.10.240.x/dhd_sdio.c b/bcmdhd.101.10.240.x/dhd_sdio.c
new file mode 100644 (file)
index 0000000..291748b
--- /dev/null
@@ -0,0 +1,10713 @@
+/*
+ * DHD Bus Module for SDIO
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmsdh.h>
+
+#include <bcmdefs.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmdevs.h>
+#include <bcmdevs_legacy.h>    /* need to still support chips no longer in trunk firmware */
+
+#include <siutils.h>
+#include <hndpmu.h>
+#include <hndsoc.h>
+#include <bcmsdpcm.h>
+#include <hnd_armtrap.h>
+#include <hnd_cons.h>
+#include <sbchipc.h>
+#include <sbhnddma.h>
+
+#include <sdio.h>
+#ifdef BCMSPI
+#include <spid.h>
+#endif /* BCMSPI */
+#include <sbsdio.h>
+#include <sbsdpcmdev.h>
+#include <bcmsdpcm.h>
+#include <bcmsdbus.h>
+
+#include <ethernet.h>
+#include <802.1d.h>
+#include <802.11.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#include <dhdioctl.h>
+#include <sdiovar.h>
+#include <dhd_config.h>
+
+#ifdef PROP_TXSTATUS
+#include <dhd_wlfc.h>
+#endif
+#ifdef DHDTCPACK_SUPPRESS
+#include <dhd_ip.h>
+#endif /* DHDTCPACK_SUPPRESS */
+
+#ifdef BT_OVER_SDIO
+#include <dhd_bt_interface.h>
+#endif /* BT_OVER_SDIO */
+
+#if defined(DEBUGGER) || defined(DHD_DSCOPE)
+#include <debugger.h>
+#endif /* DEBUGGER || DHD_DSCOPE */
+
+bool dhd_mp_halting(dhd_pub_t *dhdp);
+extern void bcmsdh_waitfor_iodrain(void *sdh);
+extern void bcmsdh_reject_ioreqs(void *sdh, bool reject);
+extern bool  bcmsdh_fatal_error(void *sdh);
+static int dhdsdio_suspend(void *context);
+static int dhdsdio_resume(void *context);
+
+#ifndef DHDSDIO_MEM_DUMP_FNAME
+#define DHDSDIO_MEM_DUMP_FNAME         "mem_dump"
+#endif
+
+#define QLEN           (1024) /* bulk rx and tx queue lengths */
+#define FCHI           (QLEN - 10)
+#define FCLOW          (FCHI / 2)
+#define PRIOMASK       7       /* XXX FixMe: should come from elsewhere...
+                                * MAXPRIO?  PKTQ_MAX_PREC? WLC? Other?
+                                */
+
+#define TXRETRIES      2       /* # of retries for tx frames */
+#define READ_FRM_CNT_RETRIES   3
+#ifndef DHD_RXBOUND
+#define DHD_RXBOUND    50      /* Default for max rx frames in one scheduling */
+#endif
+
+#ifndef DHD_TXBOUND
+#define DHD_TXBOUND    20      /* Default for max tx frames in one scheduling */
+#endif
+
+#define DHD_TXMINMAX   1       /* Max tx frames if rx still pending */
+
+#define MEMBLOCK       2048            /* Block size used for downloading of dongle image */
+#define MAX_MEMBLOCK  (32 * 1024)      /* Block size used for downloading of dongle image */
+
+#define MAX_DATA_BUF   (64 * 1024)     /* Must be large enough to hold biggest possible glom */
+#define MAX_MEM_BUF    4096
+
+#ifndef DHD_FIRSTREAD
+#define DHD_FIRSTREAD   32
+#endif
+#if !ISPOWEROF2(DHD_FIRSTREAD)
+#error DHD_FIRSTREAD is not a power of 2!
+#endif
+
+/* Total length of frame header for dongle protocol */
+#define SDPCM_HDRLEN   (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
+#define SDPCM_HDRLEN_TXGLOM    (SDPCM_HDRLEN + SDPCM_HWEXT_LEN)
+#define MAX_TX_PKTCHAIN_CNT    SDPCM_MAXGLOM_SIZE
+
+#ifdef SDTEST
+#define SDPCM_RESERVE  (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN)
+#else
+#define SDPCM_RESERVE  (SDPCM_HDRLEN + DHD_SDALIGN)
+#endif
+
+/* Space for header read, limit for data packets */
+#ifndef MAX_HDR_READ
+#define MAX_HDR_READ   32
+#endif
+#if !ISPOWEROF2(MAX_HDR_READ)
+#error MAX_HDR_READ is not a power of 2!
+#endif
+
+#define MAX_RX_DATASZ  2048    /* XXX Should be based on PKTGET limits? */
+
+/* Maximum milliseconds to wait for F2 to come up */
+#define DHD_WAIT_F2RDY 3000
+
+/* Maximum usec to wait for HTAVAIL to come up */
+#define DHD_WAIT_HTAVAIL       10000
+
+/* Bump up limit on waiting for HT to account for first startup;
+ * if the image is doing a CRC calculation before programming the PMU
+ * for HT availability, it could take a couple hundred ms more, so
+ * max out at a 1 second (1000000us).
+ */
+#if (PMU_MAX_TRANSITION_DLY <= 1000000)
+#undef PMU_MAX_TRANSITION_DLY
+#define PMU_MAX_TRANSITION_DLY 1000000
+#endif
+
+/* hooks for limiting threshold custom tx num in rx processing */
+#define DEFAULT_TXINRX_THRES    0
+#ifndef CUSTOM_TXINRX_THRES
+#define CUSTOM_TXINRX_THRES     DEFAULT_TXINRX_THRES
+#endif
+
+/* Value for ChipClockCSR during initial setup */
+#define DHD_INIT_CLKCTL1       (SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ)
+#define DHD_INIT_CLKCTL2       (SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP)
+
+/* Flags for SDH calls */
+#define F2SYNC (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
+/* XXX #define F2ASYNC (SDIO_REQ_4BYTE | SDIO_REQ_FIXED | SDIO_REQ_ASYNC) */
+
+/* Packet free applicable unconditionally for sdio and sdspi.  Conditional if
+ * bufpool was present for gspi bus.
+ */
+#define PKTFREE2()             if ((bus->bus != SPI_BUS) || bus->usebufpool) \
+                                       PKTFREE(bus->dhd->osh, pkt, FALSE);
+DHD_SPINWAIT_SLEEP_INIT(sdioh_spinwait_sleep);
+
+#ifdef SUPPORT_MULTIPLE_BOARD_REV_FROM_HW
+extern unsigned int system_hw_rev;
+#endif /* SUPPORT_MULTIPLE_BOARD_REV_FROM_HW */
+
+/* Device console log buffer state */
+#define CONSOLE_LINE_MAX       192
+#define CONSOLE_BUFFER_MAX     8192
+typedef struct dhd_console {
+       uint            count;                  /* Poll interval msec counter */
+       uint            log_addr;               /* Log struct address (fixed) */
+       hnd_log_t       log;                    /* Log struct (host copy) */
+       uint            bufsize;                /* Size of log buffer */
+       uint8           *buf;                   /* Log buffer (host copy) */
+       uint            last;                   /* Last buffer read index */
+} dhd_console_t;
+
+#define        REMAP_ENAB(bus)                 ((bus)->remap)
+#define        REMAP_ISADDR(bus, a)            (((a) >= ((bus)->orig_ramsize)) && ((a) < ((bus)->ramsize)))
+#define        KSO_ENAB(bus)                   ((bus)->kso)
+#define        SR_ENAB(bus)                    ((bus)->_srenab)
+#define        SLPAUTO_ENAB(bus)               ((SR_ENAB(bus)) && ((bus)->_slpauto))
+
+#define        MIN_RSRC_SR                     0x3
+#define        CORE_CAPEXT_ADDR_OFFSET         (0x64c)
+#define        CORE_CAPEXT_SR_SUPPORTED_MASK   (1 << 1)
+#define RCTL_MACPHY_DISABLE_MASK       (1 << 26)
+#define RCTL_LOGIC_DISABLE_MASK                (1 << 27)
+
+#define        OOB_WAKEUP_ENAB(bus)            ((bus)->_oobwakeup)
+#define        GPIO_DEV_SRSTATE                16      /* Host gpio17 mapped to device gpio0 SR state */
+#define        GPIO_DEV_SRSTATE_TIMEOUT        320000  /* 320ms */
+#define        GPIO_DEV_WAKEUP                 17      /* Host gpio17 mapped to device gpio1 wakeup */
+#define        CC_CHIPCTRL2_GPIO1_WAKEUP       (1  << 0)
+#define        CC_CHIPCTRL3_SR_ENG_ENABLE      (1  << 2)
+#define OVERFLOW_BLKSZ512_WM           96
+#define OVERFLOW_BLKSZ512_MES          80
+
+#define CC_PMUCC3      (0x3)
+
+#ifdef DHD_UCODE_DOWNLOAD
+/* Ucode host download related macros */
+#define UCODE_DOWNLOAD_REQUEST  0xCAFECAFE
+#define UCODE_DOWNLOAD_COMPLETE 0xABCDABCD
+#endif /* DHD_UCODE_DOWNLOAD */
+
+#if defined(BT_OVER_SDIO)
+#define BTMEM_OFFSET                   0x19000000
+/* BIT0 => WLAN Power UP and BIT1=> WLAN Wake */
+#define BT2WLAN_PWRUP_WAKE             0x03
+#define BT2WLAN_PWRUP_ADDR             0x640894        /* This address is specific to 43012B0 */
+
+#define BTFW_MAX_STR_LEN               600
+#define BTFW_DOWNLOAD_BLK_SIZE         (BTFW_MAX_STR_LEN/2 + 8)
+
+#define BTFW_ADDR_MODE_UNKNOWN         0
+#define BTFW_ADDR_MODE_EXTENDED                1
+#define BTFW_ADDR_MODE_SEGMENT         2
+#define BTFW_ADDR_MODE_LINEAR32                3
+
+#define BTFW_HEX_LINE_TYPE_DATA                                0
+#define BTFW_HEX_LINE_TYPE_END_OF_DATA                 1
+#define BTFW_HEX_LINE_TYPE_EXTENDED_SEGMENT_ADDRESS    2
+#define BTFW_HEX_LINE_TYPE_EXTENDED_ADDRESS            4
+#define BTFW_HEX_LINE_TYPE_ABSOLUTE_32BIT_ADDRESS      5
+
+#endif /* defined (BT_OVER_SDIO) */
+
+/* Private data for SDIO bus interaction */
+typedef struct dhd_bus {
+       dhd_pub_t       *dhd;
+
+       bcmsdh_info_t   *sdh;                   /* Handle for BCMSDH calls */
+       si_t            *sih;                   /* Handle for SI calls */
+       char            *vars;                  /* Variables (from CIS and/or other) */
+       uint            varsz;                  /* Size of variables buffer */
+       uint32          sbaddr;                 /* Current SB window pointer (-1, invalid) */
+
+       sdpcmd_regs_t   *regs;                  /* Registers for SDIO core */
+       uint            sdpcmrev;               /* SDIO core revision */
+       uint            armrev;                 /* CPU core revision */
+       uint            ramrev;                 /* SOCRAM core revision */
+       uint32          ramsize;                /* Size of RAM in SOCRAM (bytes) */
+       uint32          orig_ramsize;           /* Size of RAM in SOCRAM (bytes) */
+       uint32          srmemsize;              /* Size of SRMEM */
+
+       uint32          bus;                    /* gSPI or SDIO bus */
+       uint32          bus_num;                /* bus number */
+       uint32          slot_num;               /* slot ID */
+       uint32          hostintmask;    /* Copy of Host Interrupt Mask */
+       uint32          intstatus;              /* Intstatus bits (events) pending */
+       bool            dpc_sched;              /* Indicates DPC schedule (intrpt rcvd) */
+       bool            fcstate;                /* State of dongle flow-control */
+
+       uint16          cl_devid;               /* cached devid for dhdsdio_probe_attach() */
+       char            *fw_path;               /* module_param: path to firmware image */
+       char            *nv_path;               /* module_param: path to nvram vars file */
+
+       uint            blocksize;              /* Block size of SDIO transfers */
+       uint            roundup;                /* Max roundup limit */
+
+       struct pktq     txq;                    /* Queue length used for flow-control */
+       uint8           flowcontrol;            /* per prio flow control bitmask */
+       uint8           tx_seq;                 /* Transmit sequence number (next) */
+       uint8           tx_max;                 /* Maximum transmit sequence allowed */
+
+       uint8           hdrbuf[MAX_HDR_READ + DHD_SDALIGN];
+       uint8           *rxhdr;                 /* Header of current rx frame (in hdrbuf) */
+       uint16          nextlen;                /* Next Read Len from last header */
+       uint8           rx_seq;                 /* Receive sequence number (expected) */
+       bool            rxskip;                 /* Skip receive (awaiting NAK ACK) */
+
+       void            *glomd;                 /* Packet containing glomming descriptor */
+       void            *glom;                  /* Packet chain for glommed superframe */
+       uint            glomerr;                /* Glom packet read errors */
+
+       uint8           *rxbuf;                 /* Buffer for receiving control packets */
+       uint            rxblen;                 /* Allocated length of rxbuf */
+       uint8           *rxctl;                 /* Aligned pointer into rxbuf */
+       uint8           *databuf;               /* Buffer for receiving big glom packet */
+       uint8           *dataptr;               /* Aligned pointer into databuf */
+       uint            rxlen;                  /* Length of valid data in buffer */
+
+       uint8           sdpcm_ver;              /* Bus protocol reported by dongle */
+
+       bool            intr;                   /* Use interrupts */
+       bool            poll;                   /* Use polling */
+       bool            ipend;                  /* Device interrupt is pending */
+       bool            intdis;                 /* Interrupts disabled by isr */
+       uint            intrcount;              /* Count of device interrupt callbacks */
+       uint            lastintrs;              /* Count as of last watchdog timer */
+       uint            spurious;               /* Count of spurious interrupts */
+       uint            pollrate;               /* Ticks between device polls */
+       uint            polltick;               /* Tick counter */
+       uint            pollcnt;                /* Count of active polls */
+
+       dhd_console_t   console;                /* Console output polling support */
+       uint            console_addr;           /* Console address from shared struct */
+
+       uint            regfails;               /* Count of R_REG/W_REG failures */
+
+       uint            clkstate;               /* State of sd and backplane clock(s) */
+       bool            activity;               /* Activity flag for clock down */
+       int32           idletime;               /* Control for activity timeout */
+       int32           idlecount;              /* Activity timeout counter */
+       int32           idleclock;              /* How to set bus driver when idle */
+       int32           sd_divisor;             /* Speed control to bus driver */
+       int32           sd_mode;                /* Mode control to bus driver */
+       int32           sd_rxchain;             /* If bcmsdh api accepts PKT chains */
+       bool            use_rxchain;            /* If dhd should use PKT chains */
+       bool            sleeping;               /* Is SDIO bus sleeping? */
+#if defined(SUPPORT_P2P_GO_PS)
+       wait_queue_head_t bus_sleep;
+#endif /* LINUX && SUPPORT_P2P_GO_PS */
+       bool            ctrl_wait;
+       wait_queue_head_t ctrl_tx_wait;
+       uint            rxflow_mode;            /* Rx flow control mode */
+       bool            rxflow;                 /* Is rx flow control on */
+       uint            prev_rxlim_hit;         /* Is prev rx limit exceeded (per dpc schedule) */
+       bool            alp_only;               /* Don't use HT clock (ALP only) */
+       /* Field to decide if rx of control frames happen in rxbuf or lb-pool */
+       bool            usebufpool;
+       int32           txinrx_thres;   /* num of in-queued pkts */
+       int32           dotxinrx;       /* tx first in dhdsdio_readframes */
+#ifdef BCMSDIO_RXLIM_POST
+       bool            rxlim_en;
+       uint32          rxlim_addr;
+#endif /* BCMSDIO_RXLIM_POST */
+#ifdef SDTEST
+       /* external loopback */
+       bool            ext_loop;
+       uint8           loopid;
+
+       /* pktgen configuration */
+       uint            pktgen_freq;            /* Ticks between bursts */
+       uint            pktgen_count;           /* Packets to send each burst */
+       uint            pktgen_print;           /* Bursts between count displays */
+       uint            pktgen_total;           /* Stop after this many */
+       uint            pktgen_minlen;          /* Minimum packet data len */
+       uint            pktgen_maxlen;          /* Maximum packet data len */
+       uint            pktgen_mode;            /* Configured mode: tx, rx, or echo */
+       uint            pktgen_stop;            /* Number of tx failures causing stop */
+
+       /* active pktgen fields */
+       uint            pktgen_tick;            /* Tick counter for bursts */
+       uint            pktgen_ptick;           /* Burst counter for printing */
+       uint            pktgen_sent;            /* Number of test packets generated */
+       uint            pktgen_rcvd;            /* Number of test packets received */
+       uint            pktgen_prev_time;       /* Time at which previous stats where printed */
+       uint            pktgen_prev_sent;       /* Number of test packets generated when
+                                                * previous stats were printed
+                                                */
+       uint            pktgen_prev_rcvd;       /* Number of test packets received when
+                                                * previous stats were printed
+                                                */
+       uint            pktgen_fail;            /* Number of failed send attempts */
+       uint16          pktgen_len;             /* Length of next packet to send */
+#define PKTGEN_RCV_IDLE     (0)
+#define PKTGEN_RCV_ONGOING  (1)
+       uint16          pktgen_rcv_state;               /* receive state */
+       uint            pktgen_rcvd_rcvsession; /* test pkts rcvd per rcv session. */
+#endif /* SDTEST */
+
+       /* Some additional counters */
+       uint            tx_sderrs;              /* Count of tx attempts with sd errors */
+       uint            fcqueued;               /* Tx packets that got queued */
+       uint            rxrtx;                  /* Count of rtx requests (NAK to dongle) */
+       uint            rx_toolong;             /* Receive frames too long to receive */
+       uint            rxc_errors;             /* SDIO errors when reading control frames */
+       uint            rx_hdrfail;             /* SDIO errors on header reads */
+       uint            rx_badhdr;              /* Bad received headers (roosync?) */
+       uint            rx_badseq;              /* Mismatched rx sequence number */
+       uint            fc_rcvd;                /* Number of flow-control events received */
+       uint            fc_xoff;                /* Number which turned on flow-control */
+       uint            fc_xon;                 /* Number which turned off flow-control */
+       uint            rxglomfail;             /* Failed deglom attempts */
+       uint            rxglomframes;           /* Number of glom frames (superframes) */
+       uint            rxglompkts;             /* Number of packets from glom frames */
+       uint            f2rxhdrs;               /* Number of header reads */
+       uint            f2rxdata;               /* Number of frame data reads */
+       uint            f2txdata;               /* Number of f2 frame writes */
+       uint            f1regdata;              /* Number of f1 register accesses */
+       wake_counts_t   wake_counts;            /* Wake up counter */
+#ifdef BCMSPI
+       bool            dwordmode;
+#endif /* BCMSPI */
+#ifdef DHDENABLE_TAILPAD
+       uint            tx_tailpad_chain;       /* Number of tail padding by chaining pad_pkt */
+       uint            tx_tailpad_pktget;      /* Number of tail padding by new PKTGET */
+#endif /* DHDENABLE_TAILPAD */
+       uint8           *ctrl_frame_buf;
+       uint32          ctrl_frame_len;
+       bool            ctrl_frame_stat;
+#ifndef BCMSPI
+       uint32          rxint_mode;     /* rx interrupt mode */
+#endif /* BCMSPI */
+       bool            remap;          /* Contiguous 1MB RAM: 512K socram + 512K devram
+                                        * Available with socram rev 16
+                                        * Remap region not DMA-able
+                                        */
+       bool            kso;
+       bool            _slpauto;
+       bool            _oobwakeup;
+       bool            _srenab;
+       bool        readframes;
+       bool        reqbussleep;
+       uint32          resetinstr;
+       uint32          dongle_ram_base;
+
+       void            *glom_pkt_arr[SDPCM_MAXGLOM_SIZE];      /* Array of pkts for glomming */
+       uint32          txglom_cnt;     /* Number of pkts in the glom array */
+       uint32          txglom_total_len;       /* Total length of pkts in glom array */
+       bool            txglom_enable;  /* Flag to indicate whether tx glom is enabled/disabled */
+       uint32          txglomsize;     /* Glom size limitation */
+#ifdef DHDENABLE_TAILPAD
+       void            *pad_pkt;
+#endif /* DHDENABLE_TAILPAD */
+       uint32          dongle_trap_addr; /* device trap addr location in device memory */
+#if defined(BT_OVER_SDIO)
+       char            *btfw_path;     /* module_param: path to BT firmware image */
+       uint32          bt_use_count; /* Counter that tracks whether BT is using the bus */
+#endif /* defined (BT_OVER_SDIO) */
+       uint            txglomframes;   /* Number of tx glom frames (superframes) */
+       uint            txglompkts;             /* Number of packets from tx glom frames */
+#ifdef PKT_STATICS
+       struct pkt_statics tx_statics;
+#endif
+       uint8           *membuf;                /* Buffer for dhdsdio_membytes */
+#ifdef CONSOLE_DPC
+       char            cons_cmd[16];
+#endif
+} dhd_bus_t;
+
+/*
+ * Whenever DHD_IDLE_IMMEDIATE condition is handled, we have to now check if
+ * BT is active too. Instead of adding #ifdef code in all the places, we thought
+ * of adding one macro check as part of the if condition that checks for DHD_IDLE_IMMEDIATE
+ * In case of non BT over SDIO builds, this macro will always return TRUE. In case
+ * of the builds where BT_OVER_SDIO is enabled, it will expand to a condition check
+ * that checks if bt_use_count is zero. So this macro will return equate to 1 if
+ * bt_use_count is 0, indicating that there are no active users and if bt_use_count
+ * is non zero it would return 0 there by preventing the caller from executing the
+ * sleep calls.
+ */
+#ifdef BT_OVER_SDIO
+#define NO_OTHER_ACTIVE_BUS_USER(bus)          (bus->bt_use_count == 0)
+#else
+#define NO_OTHER_ACTIVE_BUS_USER(bus)          (1)
+#endif /* BT_OVER_SDIO */
+
+/* clkstate */
+#define CLK_NONE       0
+#define CLK_SDONLY     1
+#define CLK_PENDING    2       /* Not used yet */
+#define CLK_AVAIL      3
+
+#define DHD_NOPMU(dhd) (FALSE)
+
+#if defined(BCMSDIOH_STD)
+#define BLK_64_MAXTXGLOM 20
+#endif /* BCMSDIOH_STD */
+
+#ifdef DHD_DEBUG
+static int qcount[NUMPRIO];
+static int tx_packets[NUMPRIO];
+#endif /* DHD_DEBUG */
+
+/* Deferred transmit */
+const uint dhd_deferred_tx = 1;
+
+extern uint dhd_watchdog_ms;
+extern uint sd_f1_blocksize;
+
+#ifdef BCMSPI_ANDROID
+extern uint *dhd_spi_lockcount;
+#endif /* BCMSPI_ANDROID */
+
+extern void dhd_os_wd_timer(void *bus, uint wdtick);
+int dhd_enableOOB(dhd_pub_t *dhd, bool sleep);
+
+#ifdef DHD_PM_CONTROL_FROM_FILE
+extern bool g_pm_control;
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+
+/* Tx/Rx bounds */
+uint dhd_txbound;
+uint dhd_rxbound;
+uint dhd_txminmax = DHD_TXMINMAX;
+
+/* override the RAM size if possible */
+#define DONGLE_MIN_RAMSIZE (128 *1024)
+int dhd_dongle_ramsize;
+
+uint dhd_doflow = TRUE;
+uint dhd_dpcpoll = FALSE;
+
+module_param(dhd_doflow, uint, 0644);
+module_param(dhd_dpcpoll, uint, 0644);
+
+static bool dhd_alignctl;
+
+static bool sd1idle;
+
+static bool retrydata;
+#define RETRYCHAN(chan) (((chan) == SDPCM_EVENT_CHANNEL) || retrydata)
+
+#ifdef BCMSPI
+/* At a watermark around 8 the spid hits underflow error. */
+static uint watermark = 32;
+static uint mesbusyctrl = 0;
+#else
+static uint watermark = 8;
+static uint mesbusyctrl = 0;
+#endif /* BCMSPI */
+static const uint firstread = DHD_FIRSTREAD;
+
+/* Retry count for register access failures */
+static const uint retry_limit = 2;
+
+/* Force even SD lengths (some host controllers mess up on odd bytes) */
+static bool forcealign;
+
+#if defined(DEBUGGER)
+static uint32 dhd_sdio_reg_read(struct dhd_bus *bus, ulong addr);
+static void dhd_sdio_reg_write(struct dhd_bus *bus, ulong addr, uint32 val);
+
+/** the debugger layer will call back into this (bus) layer to read/write dongle memory */
+static struct dhd_dbg_bus_ops_s  bus_ops = {
+       .read_u16 = NULL,
+       .read_u32 = dhd_sdio_reg_read,
+       .write_u32 = dhd_sdio_reg_write,
+};
+#endif /* DEBUGGER */
+
+#define ALIGNMENT  4
+
+#if (defined(OOB_INTR_ONLY) && defined(HW_OOB)) || defined(FORCE_WOWLAN)
+extern void bcmsdh_enable_hw_oob_intr(void *sdh, bool enable);
+#endif
+
+#if defined(OOB_INTR_ONLY) && defined(SDIO_ISR_THREAD)
+#error OOB_INTR_ONLY is NOT working with SDIO_ISR_THREAD
+#endif /* defined(OOB_INTR_ONLY) && defined(SDIO_ISR_THREAD) */
+#define PKTALIGN(osh, p, len, align)                                   \
+       do {                                                            \
+               uintptr datalign;                                               \
+               datalign = (uintptr)PKTDATA((osh), (p));                \
+               datalign = ROUNDUP(datalign, (align)) - datalign;       \
+               ASSERT(datalign < (align));                             \
+               ASSERT(PKTLEN((osh), (p)) >= ((len) + datalign));       \
+               if (datalign)                                           \
+                       PKTPULL((osh), (p), (uint)datalign);                    \
+               PKTSETLEN((osh), (p), (len));                           \
+       } while (0)
+
+/* Limit on rounding up frames */
+static const uint max_roundup = 512;
+
+/* Try doing readahead */
+static bool dhd_readahead;
+
+#if defined(BCMSDIOH_TXGLOM_EXT)
+bool
+dhdsdio_is_dataok(dhd_bus_t *bus) {
+       return (((uint8)(bus->tx_max - bus->tx_seq) - bus->dhd->conf->tx_max_offset > 1) && \
+       (((uint8)(bus->tx_max - bus->tx_seq) & 0x80) == 0));
+}
+
+uint8
+dhdsdio_get_databufcnt(dhd_bus_t *bus) {
+       return ((uint8)(bus->tx_max - bus->tx_seq) - 1 - bus->dhd->conf->tx_max_offset);
+}
+#endif
+
+/* To check if there's window offered */
+#if defined(BCMSDIOH_TXGLOM_EXT)
+#define DATAOK(bus) dhdsdio_is_dataok(bus)
+#else
+#define DATAOK(bus) \
+       (((uint8)(bus->tx_max - bus->tx_seq) > 1) && \
+       (((uint8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
+#endif
+
+/* To check if there's window offered for ctrl frame */
+#define TXCTLOK(bus) \
+       (((uint8)(bus->tx_max - bus->tx_seq) != 0) && \
+       (((uint8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
+
+/* Number of pkts available in dongle for data RX */
+#if defined(BCMSDIOH_TXGLOM_EXT)
+#define DATABUFCNT(bus) dhdsdio_get_databufcnt(bus)
+#else
+#define DATABUFCNT(bus) \
+       ((uint8)(bus->tx_max - bus->tx_seq) - 1)
+#endif
+
+/* Macros to get register read/write status */
+/* NOTE: these assume a local dhdsdio_bus_t *bus! */
+/* XXX Need to replace these with something better. */
+#define R_SDREG(regvar, regaddr, retryvar) \
+do { \
+       retryvar = 0; \
+       do { \
+               regvar = R_REG(bus->dhd->osh, regaddr); \
+       } while (bcmsdh_regfail(bus->sdh) && (++retryvar <= retry_limit)); \
+       if (retryvar) { \
+               bus->regfails += (retryvar-1); \
+               if (retryvar > retry_limit) { \
+                       DHD_ERROR(("%s: FAILED" #regvar "READ, LINE %d\n", \
+                                  __FUNCTION__, __LINE__)); \
+                       regvar = 0; \
+               } \
+       } \
+} while (0)
+
+#define W_SDREG(regval, regaddr, retryvar) \
+do { \
+       retryvar = 0; \
+       do { \
+               W_REG(bus->dhd->osh, regaddr, regval); \
+       } while (bcmsdh_regfail(bus->sdh) && (++retryvar <= retry_limit)); \
+       if (retryvar) { \
+               bus->regfails += (retryvar-1); \
+               if (retryvar > retry_limit) \
+                       DHD_ERROR(("%s: FAILED REGISTER WRITE, LINE %d\n", \
+                                  __FUNCTION__, __LINE__)); \
+       } \
+} while (0)
+
+#define BUS_WAKE(bus) \
+       do { \
+               bus->idlecount = 0; \
+               if ((bus)->sleeping) \
+                       dhdsdio_bussleep((bus), FALSE); \
+       } while (0);
+
+/*
+ * pktavail interrupts from dongle to host can be managed in 3 different ways
+ * whenever there is a packet available in dongle to transmit to host.
+ *
+ * Mode 0:     Dongle writes the software host mailbox and host is interrupted.
+ * Mode 1:     (sdiod core rev >= 4)
+ *             Device sets a new bit in the intstatus whenever there is a packet
+ *             available in fifo.  Host can't clear this specific status bit until all the
+ *             packets are read from the FIFO.  No need to ack dongle intstatus.
+ * Mode 2:     (sdiod core rev >= 4)
+ *             Device sets a bit in the intstatus, and host acks this by writing
+ *             one to this bit.  Dongle won't generate anymore packet interrupts
+ *             until host reads all the packets from the dongle and reads a zero to
+ *             figure that there are no more packets.  No need to disable host ints.
+ *             Need to ack the intstatus.
+ */
+
+#define SDIO_DEVICE_HMB_RXINT          0       /* default old way */
+#define SDIO_DEVICE_RXDATAINT_MODE_0   1       /* from sdiod rev 4 */
+#define SDIO_DEVICE_RXDATAINT_MODE_1   2       /* from sdiod rev 4 */
+
+#ifdef BCMSPI
+
+#define FRAME_AVAIL_MASK(bus) I_HMB_FRAME_IND
+
+#define DHD_BUS                        SPI_BUS
+
+/* check packet-available-interrupt in piggybacked dstatus */
+#define PKT_AVAILABLE(bus, intstatus)  (bcmsdh_get_dstatus(bus->sdh) & STATUS_F2_PKT_AVAILABLE)
+
+#define HOSTINTMASK            (I_HMB_FC_CHANGE | I_HMB_HOST_INT)
+
+#define GSPI_PR55150_BAILOUT                                                                   \
+do {                                                                                           \
+       uint32 dstatussw = bcmsdh_get_dstatus((void *)bus->sdh);                                \
+       uint32 dstatushw = bcmsdh_cfg_read_word(bus->sdh, SDIO_FUNC_0, SPID_STATUS_REG, NULL);  \
+       uint32 intstatuserr = 0;                                                                \
+       uint retries = 0;                                                                       \
+                                                                                               \
+       R_SDREG(intstatuserr, &bus->regs->intstatus, retries);                                  \
+       printf("dstatussw = 0x%x, dstatushw = 0x%x, intstatus = 0x%x\n",                        \
+               dstatussw, dstatushw, intstatuserr);                                            \
+                                                                                               \
+       bus->nextlen = 0;                                                                       \
+       *finished = TRUE;                                                                       \
+} while (0)
+
+#else /* BCMSDIO */
+
+#define FRAME_AVAIL_MASK(bus)  \
+       ((bus->rxint_mode == SDIO_DEVICE_HMB_RXINT) ? I_HMB_FRAME_IND : I_XMTDATA_AVAIL)
+
+#define DHD_BUS                        SDIO_BUS
+
+#define PKT_AVAILABLE(bus, intstatus)  ((intstatus) & (FRAME_AVAIL_MASK(bus)))
+
+#define HOSTINTMASK            (I_HMB_SW_MASK | I_CHIPACTIVE)
+
+#define GSPI_PR55150_BAILOUT
+
+#endif /* BCMSPI */
+
+#ifdef SDTEST
+static void dhdsdio_testrcv(dhd_bus_t *bus, void *pkt, uint seq);
+static void dhdsdio_sdtest_set(dhd_bus_t *bus, uint count);
+#endif
+
+static int dhdsdio_checkdied(dhd_bus_t *bus, char *data, uint size);
+#ifdef DHD_DEBUG
+static int dhd_serialconsole(dhd_bus_t *bus, bool get, bool enable, int *bcmerror);
+#endif /* DHD_DEBUG */
+
+#if defined(DHD_FW_COREDUMP)
+static int dhdsdio_mem_dump(dhd_bus_t *bus);
+static int dhdsdio_get_mem_dump(dhd_bus_t *bus);
+#endif /* DHD_FW_COREDUMP */
+static int dhdsdio_devcap_set(dhd_bus_t *bus, uint8 cap);
+static int dhdsdio_download_state(dhd_bus_t *bus, bool enter);
+
+static void dhdsdio_release(dhd_bus_t *bus, osl_t *osh);
+static void dhdsdio_release_malloc(dhd_bus_t *bus, osl_t *osh);
+static void dhdsdio_disconnect(void *ptr);
+static bool dhdsdio_chipmatch(uint16 chipid);
+static bool dhdsdio_probe_attach(dhd_bus_t *bus, osl_t *osh, void *sdh,
+                                 void * regsva, uint16  devid);
+static bool dhdsdio_probe_malloc(dhd_bus_t *bus, osl_t *osh, void *sdh);
+static bool dhdsdio_probe_init(dhd_bus_t *bus, osl_t *osh, void *sdh);
+static void dhdsdio_release_dongle(dhd_bus_t *bus, osl_t *osh, bool dongle_isolation,
+       bool reset_flag);
+
+static void dhd_dongle_setramsize(struct dhd_bus *bus, int mem_size);
+static int dhd_bcmsdh_recv_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags,
+       uint8 *buf, uint nbytes,
+       void *pkt, bcmsdh_cmplt_fn_t complete, void *handle);
+static int dhd_bcmsdh_send_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags,
+       uint8 *buf, uint nbytes,
+       void *pkt, bcmsdh_cmplt_fn_t complete, void *handle, int max_retry);
+static int dhdsdio_txpkt(dhd_bus_t *bus, uint chan, void** pkts, int num_pkt, bool free_pkt);
+static int dhdsdio_txpkt_preprocess(dhd_bus_t *bus, void *pkt, int chan, int txseq,
+       int prev_chain_total_len, bool last_chained_pkt,
+       int *pad_pkt_len, void **new_pkt
+#if defined(BCMSDIOH_TXGLOM_EXT)
+       , int first_frame
+#endif
+);
+static int dhdsdio_txpkt_postprocess(dhd_bus_t *bus, void *pkt);
+
+static int dhdsdio_download_firmware(dhd_bus_t *bus, osl_t *osh, void *sdh);
+static int _dhdsdio_download_firmware(dhd_bus_t *bus);
+
+#ifdef DHD_UCODE_DOWNLOAD
+static int dhdsdio_download_ucode_file(struct dhd_bus *bus, char *ucode_path);
+#endif /* DHD_UCODE_DOWNLOAD */
+static int dhdsdio_download_code_file(dhd_bus_t *bus, char *image_path);
+static int dhdsdio_download_nvram(dhd_bus_t *bus);
+static int dhdsdio_bussleep(dhd_bus_t *bus, bool sleep);
+static int dhdsdio_clkctl(dhd_bus_t *bus, uint target, bool pendok);
+static uint8 dhdsdio_sleepcsr_get(dhd_bus_t *bus);
+static bool dhdsdio_dpc(dhd_bus_t *bus);
+static int dhd_bcmsdh_send_buffer(void *bus, uint8 *frame, uint16 len);
+static int dhdsdio_set_sdmode(dhd_bus_t *bus, int32 sd_mode);
+static int dhdsdio_sdclk(dhd_bus_t *bus, bool on);
+static void dhdsdio_advertise_bus_cleanup(dhd_pub_t *dhdp);
+static void dhdsdio_advertise_bus_remove(dhd_pub_t *dhdp);
+
+#if defined(BT_OVER_SDIO)
+static int extract_hex_field(char * line, uint16 start_pos, uint16 num_chars, uint16 * value);
+static int read_more_btbytes(struct dhd_bus *bus, void * file, char *line, int * addr_mode,
+       uint16 * hi_addr, uint32 * dest_addr, uint8 *data_bytes, uint32 * num_bytes);
+static int dhdsdio_download_btfw(struct dhd_bus *bus, osl_t *osh, void *sdh);
+static int _dhdsdio_download_btfw(struct dhd_bus *bus);
+#endif /* defined (BT_OVER_SDIO) */
+
+#ifdef DHD_WAKE_STATUS
+int bcmsdh_get_total_wake(bcmsdh_info_t *bcmsdh);
+int bcmsdh_set_get_wake(bcmsdh_info_t *bcmsdh, int flag);
+#endif /* DHD_WAKE_STATUS */
+
+/*
+ * PR 114233: [4335] Sdio 3.0 overflow due to spur mode PLL change
+ */
+static void
+dhdsdio_tune_fifoparam(struct dhd_bus *bus)
+{
+       int err;
+       uint8 devctl, wm, mes;
+
+       if (bus->sih->buscorerev >= 15) {
+               /* See .ppt in PR for these recommended values */
+               if (bus->blocksize == 512) {
+                       wm = OVERFLOW_BLKSZ512_WM;
+                       mes = OVERFLOW_BLKSZ512_MES;
+               } else {
+                       mes = bus->blocksize/4;
+                       wm = bus->blocksize/4;
+               }
+
+               /* XXX: Need to set watermark since SBSDIO_WATERMARK could be overwritten
+                based on watermark value in other place. Refer to SWDHD-17.
+               */
+               watermark = wm;
+               mesbusyctrl = mes;
+       } else {
+               DHD_INFO(("skip fifotune: SdioRev(%d) is lower than minimal requested ver\n",
+                       bus->sih->buscorerev));
+               return;
+       }
+
+       /* Update watermark */
+       if (wm > 0) {
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK, wm, &err);
+
+               devctl = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+               devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+       }
+
+       /* Update MES */
+       if (mes > 0) {
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_MESBUSYCTRL,
+                       (mes | SBSDIO_MESBUSYCTRL_ENAB), &err);
+       }
+
+       DHD_INFO(("Apply overflow WAR: 0x%02x 0x%02x 0x%02x\n",
+               bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err),
+               bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK, &err),
+               bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_MESBUSYCTRL, &err)));
+}
+
+static void
+dhd_dongle_setramsize(struct dhd_bus *bus, int mem_size)
+{
+       int32 min_size =  DONGLE_MIN_RAMSIZE;
+       /* Restrict the ramsize to user specified limit */
+       DHD_ERROR(("user: Restrict the dongle ram size to %d, min accepted %d\n",
+               dhd_dongle_ramsize, min_size));
+       if ((dhd_dongle_ramsize > min_size) &&
+               (dhd_dongle_ramsize < (int32)bus->orig_ramsize))
+               bus->ramsize = dhd_dongle_ramsize;
+}
+
+static int
+dhdsdio_set_siaddr_window(dhd_bus_t *bus, uint32 address)
+{
+       int err = 0;
+       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW,
+                        (address >> 8) & SBSDIO_SBADDRLOW_MASK, &err);
+       if (!err)
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRMID,
+                                (address >> 16) & SBSDIO_SBADDRMID_MASK, &err);
+       if (!err)
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRHIGH,
+                                (address >> 24) & SBSDIO_SBADDRHIGH_MASK, &err);
+       return err;
+}
+
+#ifdef BCMSPI
+static void
+dhdsdio_wkwlan(dhd_bus_t *bus, bool on)
+{
+       int err;
+       uint32 regdata;
+       bcmsdh_info_t *sdh = bus->sdh;
+
+       /* XXX: sdiod cores have SPI as a block, PCMCIA doesn't have the gspi core */
+       /* XXX: may be we don't even need this check at all */
+       if (bus->sih->buscoretype == SDIOD_CORE_ID) {
+               /* wake up wlan function :WAKE_UP goes as ht_avail_request and alp_avail_request */
+               regdata = bcmsdh_cfg_read_word(sdh, SDIO_FUNC_0, SPID_CONFIG, NULL);
+               DHD_INFO(("F0 REG0 rd = 0x%x\n", regdata));
+
+               if (on == TRUE)
+                       regdata |= WAKE_UP;
+               else
+                       regdata &= ~WAKE_UP;
+
+               bcmsdh_cfg_write_word(sdh, SDIO_FUNC_0, SPID_CONFIG, regdata, &err);
+       }
+}
+#endif /* BCMSPI */
+
+#ifdef USE_OOB_GPIO1
+static int
+dhdsdio_oobwakeup_init(dhd_bus_t *bus)
+{
+       uint32 val, addr, data;
+
+       bcmsdh_gpioouten(bus->sdh, GPIO_DEV_WAKEUP);
+
+       addr = SI_ENUM_BASE(bus->sih) + OFFSETOF(chipcregs_t, chipcontrol_addr);
+       data = SI_ENUM_BASE(bus->sih) + OFFSETOF(chipcregs_t, chipcontrol_data);
+
+       /* Set device for gpio1 wakeup */
+       bcmsdh_reg_write(bus->sdh, addr, 4, 2);
+       val = bcmsdh_reg_read(bus->sdh, data, 4);
+       val |= CC_CHIPCTRL2_GPIO1_WAKEUP;
+       bcmsdh_reg_write(bus->sdh, data, 4, val);
+
+       bus->_oobwakeup = TRUE;
+
+       return 0;
+}
+#endif /* USE_OOB_GPIO1 */
+
+#ifndef BCMSPI
+/*
+ * Query if FW is in SR mode
+ */
+static bool
+dhdsdio_sr_cap(dhd_bus_t *bus)
+{
+       bool cap = FALSE;
+       uint32  core_capext, addr, data;
+
+       if (bus->sih->chip == BCM43430_CHIP_ID ||
+               bus->sih->chip == BCM43018_CHIP_ID) {
+               /* check if fw initialized sr engine */
+               addr = SI_ENUM_BASE(bus->sih) + OFFSETOF(chipcregs_t, sr_control1);
+               if (bcmsdh_reg_read(bus->sdh, addr, 4) != 0)
+                       cap = TRUE;
+
+               return cap;
+       }
+       if (
+               0) {
+                       core_capext = FALSE;
+       } else if ((bus->sih->chip == BCM4335_CHIP_ID) ||
+               (bus->sih->chip == BCM4339_CHIP_ID) ||
+               BCM4345_CHIP(bus->sih->chip) ||
+               (bus->sih->chip == BCM4354_CHIP_ID) ||
+               (bus->sih->chip == BCM4358_CHIP_ID) ||
+               (bus->sih->chip == BCM43569_CHIP_ID) ||
+               (bus->sih->chip == BCM4371_CHIP_ID) ||
+               (BCM4349_CHIP(bus->sih->chip))          ||
+               (bus->sih->chip == BCM4350_CHIP_ID) ||
+               (bus->sih->chip == BCM4362_CHIP_ID) ||
+               (bus->sih->chip == BCM43012_CHIP_ID) ||
+               (bus->sih->chip == BCM43013_CHIP_ID) ||
+               (bus->sih->chip == BCM43014_CHIP_ID) ||
+               (bus->sih->chip == BCM43751_CHIP_ID) ||
+               (bus->sih->chip == BCM43752_CHIP_ID)) {
+               core_capext = TRUE;
+       } else {
+               /* XXX: For AOB, CORE_CAPEXT_ADDR is moved to PMU core */
+               core_capext = bcmsdh_reg_read(bus->sdh,
+                       si_get_pmu_reg_addr(bus->sih, OFFSETOF(chipcregs_t, core_cap_ext)),
+                       4);
+
+               core_capext = (core_capext & CORE_CAPEXT_SR_SUPPORTED_MASK);
+       }
+       if (!(core_capext))
+               return FALSE;
+
+       if ((bus->sih->chip == BCM4335_CHIP_ID) ||
+               (bus->sih->chip == BCM4339_CHIP_ID) ||
+               BCM4345_CHIP(bus->sih->chip) ||
+               (bus->sih->chip == BCM4354_CHIP_ID) ||
+               (bus->sih->chip == BCM4358_CHIP_ID) ||
+               (bus->sih->chip == BCM43569_CHIP_ID) ||
+               (bus->sih->chip == BCM4371_CHIP_ID) ||
+               (bus->sih->chip == BCM4350_CHIP_ID)) {
+               uint32 enabval = 0;
+               addr = SI_ENUM_BASE(bus->sih) + OFFSETOF(chipcregs_t, chipcontrol_addr);
+               data = SI_ENUM_BASE(bus->sih) + OFFSETOF(chipcregs_t, chipcontrol_data);
+               /* XXX: assuming the dongle doesn't change chipcontrol_addr, because
+               * if that happens, the chipcontrol_data read will be wrong. So we need
+               * to make sure the dongle and host will not access chipcontrol_addr
+               * simultaneously at this point.
+               */
+               bcmsdh_reg_write(bus->sdh, addr, 4, CC_PMUCC3);
+               enabval = bcmsdh_reg_read(bus->sdh, data, 4);
+
+               if ((bus->sih->chip == BCM4350_CHIP_ID) ||
+                       BCM4345_CHIP(bus->sih->chip) ||
+                       (bus->sih->chip == BCM4354_CHIP_ID) ||
+                       (bus->sih->chip == BCM4358_CHIP_ID) ||
+                       (bus->sih->chip == BCM43569_CHIP_ID) ||
+                       (bus->sih->chip == BCM4371_CHIP_ID))
+                       enabval &= CC_CHIPCTRL3_SR_ENG_ENABLE;
+
+               /* XXX: not checking the CC_PMUCC3_SRCC_SR_ENG_ENAB bit [val 4], but
+               * will check the whole register to be non-zero so that, sleep sequence
+               * can be also checked without enabling SR.
+               */
+               if (enabval)
+                       cap = TRUE;
+       } else {
+               data = bcmsdh_reg_read(bus->sdh,
+                       si_get_pmu_reg_addr(bus->sih, OFFSETOF(chipcregs_t, retention_ctl)),
+                       4);
+               if ((data & (RCTL_MACPHY_DISABLE_MASK | RCTL_LOGIC_DISABLE_MASK)) == 0)
+                       cap = TRUE;
+       }
+
+       return cap;
+}
+
+static int
+dhdsdio_sr_init(dhd_bus_t *bus)
+{
+       uint8 val;
+       int err = 0;
+
+       if (bus->sih->chip == BCM43012_CHIP_ID ||
+               bus->sih->chip == BCM43013_CHIP_ID ||
+               bus->sih->chip == BCM43014_CHIP_ID) {
+               val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WAKEUPCTRL, NULL);
+               val |= 1 << SBSDIO_FUNC1_WCTRL_ALPWAIT_SHIFT;
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WAKEUPCTRL,
+                       1 << SBSDIO_FUNC1_WCTRL_ALPWAIT_SHIFT, &err);
+               val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WAKEUPCTRL, NULL);
+       } else {
+               val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WAKEUPCTRL, NULL);
+               val |= 1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WAKEUPCTRL,
+                       1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT, &err);
+               val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WAKEUPCTRL, NULL);
+       }
+
+#ifdef USE_CMD14
+       /* Add CMD14 Support */
+       dhdsdio_devcap_set(bus,
+               (SDIOD_CCCR_BRCM_CARDCAP_CMD14_SUPPORT | SDIOD_CCCR_BRCM_CARDCAP_CMD14_EXT));
+#endif /* USE_CMD14 */
+
+       if (CHIPID(bus->sih->chip) == BCM43430_CHIP_ID ||
+               CHIPID(bus->sih->chip) == BCM43018_CHIP_ID ||
+               CHIPID(bus->sih->chip) == BCM4339_CHIP_ID ||
+               CHIPID(bus->sih->chip) == BCM4362_CHIP_ID ||
+               CHIPID(bus->sih->chip) == BCM43012_CHIP_ID ||
+               CHIPID(bus->sih->chip) == BCM43013_CHIP_ID ||
+               CHIPID(bus->sih->chip) == BCM43014_CHIP_ID ||
+               CHIPID(bus->sih->chip) == BCM43751_CHIP_ID ||
+               CHIPID(bus->sih->chip) == BCM43752_CHIP_ID)
+                       dhdsdio_devcap_set(bus, SDIOD_CCCR_BRCM_CARDCAP_CMD_NODEC);
+
+       if (bus->sih->chip == BCM43012_CHIP_ID ||
+               bus->sih->chip == BCM43013_CHIP_ID ||
+               bus->sih->chip == BCM43014_CHIP_ID) {
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1,
+                       SBSDIO_FUNC1_CHIPCLKCSR, SBSDIO_HT_AVAIL_REQ, &err);
+       } else {
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1,
+                       SBSDIO_FUNC1_CHIPCLKCSR, SBSDIO_FORCE_HT, &err);
+       }
+       bus->_slpauto = dhd_slpauto ? TRUE : FALSE;
+
+       bus->_srenab = TRUE;
+
+       return 0;
+}
+#endif /* BCMSPI */
+
+/*
+ * FIX: Be sure KSO bit is enabled
+ * Currently, it's defaulting to 0 which should be 1.
+ */
+static int
+dhdsdio_clk_kso_init(dhd_bus_t *bus)
+{
+       uint8 val;
+       int err = 0;
+
+       /* set flag */
+       bus->kso = TRUE;
+
+       /*
+        * Enable KeepSdioOn (KSO) bit for normal operation
+        * Default is 0 (4334A0) so set it. Fixed in B0.
+        */
+       val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, NULL);
+       if (!(val & SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
+               val |= (SBSDIO_FUNC1_SLEEPCSR_KSO_EN << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, val, &err);
+               if (err)
+                       DHD_ERROR(("%s: SBSDIO_FUNC1_SLEEPCSR err: 0x%x\n", __FUNCTION__, err));
+       }
+
+       return 0;
+}
+
+#define KSO_DBG(x)
+/* XXX KSO set typically takes depending on resource up & number of
+* resources which were down. Max value is PMU_MAX_TRANSITION_DLY usec.
+* Currently the KSO attempt loop is such that, it waits
+* (KSO_WAIT_US [50usec] time + 2 SDIO operations) * MAX_KSO_ATTEMPTS.
+* So setting a value of maximum PMU_MAX_TRANSITION_DLY as wait time.,
+* to calculate MAX_KSO_ATTEMPTS.
+*/
+#define KSO_WAIT_US 50
+#define KSO_WAIT_MS 1
+#define KSO_SLEEP_RETRY_COUNT 20
+#define KSO_WAKE_RETRY_COUNT 100
+#define ERROR_BCME_NODEVICE_MAX 1
+
+#define DEFAULT_MAX_KSO_ATTEMPTS (PMU_MAX_TRANSITION_DLY/KSO_WAIT_US)
+#ifndef CUSTOM_MAX_KSO_ATTEMPTS
+#define CUSTOM_MAX_KSO_ATTEMPTS DEFAULT_MAX_KSO_ATTEMPTS
+#endif
+
+static int
+dhdsdio_clk_kso_enab(dhd_bus_t *bus, bool on)
+{
+       uint8 wr_val = 0, rd_val, cmp_val, bmask;
+       int err = 0;
+       int try_cnt = 0;
+
+       KSO_DBG(("%s> op:%s\n", __FUNCTION__, (on ? "KSO_SET" : "KSO_CLR")));
+
+       wr_val |= (on << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
+
+       /* XXX 1st KSO write goes to AOS wake up core if device is asleep  */
+       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
+
+       /* In case of 43012 chip, the chip could go down immediately after KSO bit is cleared.
+        * So the further reads of KSO register could fail. Thereby just bailing out immediately
+        * after clearing KSO bit, to avoid polling of KSO bit.
+        */
+       if ((!on) && (bus->sih->chip == BCM43012_CHIP_ID ||
+               bus->sih->chip == BCM43013_CHIP_ID ||
+               bus->sih->chip == BCM43014_CHIP_ID)) {
+               return err;
+       }
+
+       if (on) {
+               /* XXX
+                *  device WAKEUP through KSO:
+                *  write bit 0 & read back until
+                *  both bits 0(kso bit) & 1 (dev on status) are set
+                */
+               cmp_val = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK |  SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK;
+               bmask = cmp_val;
+
+               OSL_SLEEP(3);
+
+       } else {
+               /* Put device to sleep, turn off  KSO  */
+               cmp_val = 0;
+               /* XXX only check for bit0, bit1(devon status) may not get cleared right away */
+               bmask = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK;
+       }
+       /* XXX We can't use polling in Windows since Windows Host controller
+        * hangs if chip is a sleep during read or write.
+        */
+
+       do {
+               /*
+                *  XXX reliable KSO bit set/clr:
+                *  the sdiod sleep write access appears to be is synced to PMU 32khz clk
+                *  just one write attempt may fail,(same is with read ?)
+                *  in any case, read it back until it matches written value
+                */
+               rd_val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, &err);
+               if (((rd_val & bmask) == cmp_val) && !err)
+                       break;
+
+               KSO_DBG(("%s> KSO wr/rd retry:%d, ERR:%x \n", __FUNCTION__, try_cnt, err));
+
+               if (((try_cnt + 1) % KSO_SLEEP_RETRY_COUNT) == 0) {
+                       OSL_SLEEP(KSO_WAIT_MS);
+               } else
+                       OSL_DELAY(KSO_WAIT_US);
+
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
+       } while (try_cnt++ < CUSTOM_MAX_KSO_ATTEMPTS);
+
+       if (try_cnt > 2)
+               KSO_DBG(("%s> op:%s, try_cnt:%d, rd_val:%x, ERR:%x \n",
+                       __FUNCTION__, (on ? "KSO_SET" : "KSO_CLR"), try_cnt, rd_val, err));
+
+       if (try_cnt > CUSTOM_MAX_KSO_ATTEMPTS)  {
+               DHD_ERROR(("%s> op:%s, ERROR: try_cnt:%d, rd_val:%x, ERR:%x \n",
+                       __FUNCTION__, (on ? "KSO_SET" : "KSO_CLR"), try_cnt, rd_val, err));
+       }
+
+       return err;
+}
+
+static int
+dhdsdio_clk_kso_iovar(dhd_bus_t *bus, bool on)
+{
+       int err = 0;
+
+       if (on == FALSE) {
+
+               BUS_WAKE(bus);
+               dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+               DHD_ERROR(("%s: KSO disable clk: 0x%x\n", __FUNCTION__,
+                       bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1,
+                       SBSDIO_FUNC1_CHIPCLKCSR, &err)));
+               dhdsdio_clk_kso_enab(bus, FALSE);
+       } else {
+               DHD_ERROR(("%s: KSO enable\n", __FUNCTION__));
+
+               /* Make sure we have SD bus access */
+               if (bus->clkstate == CLK_NONE) {
+                       DHD_ERROR(("%s: Request SD clk\n", __FUNCTION__));
+                       dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+               }
+
+               dhdsdio_clk_kso_enab(bus, TRUE);
+
+               DHD_ERROR(("%s: sleepcsr: 0x%x\n", __FUNCTION__,
+                       dhdsdio_sleepcsr_get(bus)));
+       }
+
+       bus->kso = on;
+       BCM_REFERENCE(err);
+
+       return 0;
+}
+
+static uint8
+dhdsdio_sleepcsr_get(dhd_bus_t *bus)
+{
+       int err = 0;
+       uint8 val = 0;
+
+       val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, &err);
+       /* XXX: Propagate error */
+       if (err)
+               DHD_TRACE(("Failed to read SLEEPCSR: %d\n", err));
+
+       return val;
+}
+
+uint8
+dhdsdio_devcap_get(dhd_bus_t *bus)
+{
+       return bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_BRCM_CARDCAP, NULL);
+}
+
+static int
+dhdsdio_devcap_set(dhd_bus_t *bus, uint8 cap)
+{
+       int err = 0;
+
+       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_BRCM_CARDCAP, cap, &err);
+       if (err)
+               DHD_ERROR(("%s: devcap set err: 0x%x\n", __FUNCTION__, err));
+
+       return 0;
+}
+
+static int
+dhdsdio_clk_devsleep_iovar(dhd_bus_t *bus, bool on)
+{
+       int err = 0, retry;
+       uint8 val;
+
+       retry = 0;
+       if (on == TRUE) {
+               /* Enter Sleep */
+
+               /* Be sure we request clk before going to sleep
+                * so we can wake-up with clk request already set
+                * else device can go back to sleep immediately
+                */
+               if (!SLPAUTO_ENAB(bus))
+                       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+               else {
+                       /* XXX: Check if Host cleared clock request
+                        * XXX: With CMD14, Host does not need to explicitly toggle clock requests
+                        * XXX: Just keep clock request active and use CMD14 to enter/exit sleep
+                        */
+                       val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+                       if ((val & SBSDIO_CSR_MASK) == 0) {
+                               DHD_ERROR(("%s: No clock before enter sleep:0x%x\n",
+                                       __FUNCTION__, val));
+
+                               /* Reset clock request */
+                               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                                       SBSDIO_ALP_AVAIL_REQ, &err);
+                               DHD_ERROR(("%s: clock before sleep:0x%x\n", __FUNCTION__,
+                                       bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1,
+                                       SBSDIO_FUNC1_CHIPCLKCSR, &err)));
+                       }
+               }
+
+               DHD_TRACE(("%s: clk before sleep: 0x%x\n", __FUNCTION__,
+                       bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1,
+                       SBSDIO_FUNC1_CHIPCLKCSR, &err)));
+#ifdef USE_CMD14
+               err = bcmsdh_sleep(bus->sdh, TRUE);
+#else
+               if ((SLPAUTO_ENAB(bus)) && (bus->idleclock == DHD_IDLE_STOP)) {
+                       if (sd1idle) {
+                               /* Change to SD1 mode */
+                               dhdsdio_set_sdmode(bus, 1);
+                       }
+               }
+
+               err = dhdsdio_clk_kso_enab(bus, FALSE);
+               if (OOB_WAKEUP_ENAB(bus))
+               {
+                       err = bcmsdh_gpioout(bus->sdh, GPIO_DEV_WAKEUP, FALSE);  /* GPIO_1 is off */
+               }
+#endif /* USE_CMD14 */
+
+               if ((SLPAUTO_ENAB(bus)) && (bus->idleclock != DHD_IDLE_ACTIVE)) {
+                       DHD_TRACE(("%s: Turnoff SD clk\n", __FUNCTION__));
+                       /* Now remove the SD clock */
+                       err = dhdsdio_sdclk(bus, FALSE);
+               }
+       } else {
+               /* Exit Sleep */
+               /* Make sure we have SD bus access */
+               if (bus->clkstate == CLK_NONE) {
+                       DHD_TRACE(("%s: Request SD clk\n", __FUNCTION__));
+                       dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+               }
+#ifdef USE_CMD14
+               err = bcmsdh_sleep(bus->sdh, FALSE);
+               if (SLPAUTO_ENAB(bus) && (err != 0)) {
+                       /* XXX: CMD14 exit sleep is failing somehow
+                        * XXX: Is Host out of sync with device?
+                        * XXX: Try toggling the reverse
+                        */
+                       OSL_DELAY(10000);
+                       DHD_TRACE(("%s: Resync device sleep\n", __FUNCTION__));
+
+                       /* Toggle sleep to resync with host and device */
+                       err = bcmsdh_sleep(bus->sdh, TRUE);
+                       OSL_DELAY(10000);
+                       err = bcmsdh_sleep(bus->sdh, FALSE);
+
+                       /* XXX: Ugly hack for host-device out-of-sync while testing
+                        * XXX: Need to root-cause
+                        */
+                       if (err) {
+                               /* XXX: Host and device out-of-sync */
+                               OSL_DELAY(10000);
+                               DHD_ERROR(("%s: CMD14 exit failed again!\n", __FUNCTION__));
+
+                               /* Toggle sleep to resync with host and device */
+                               err = bcmsdh_sleep(bus->sdh, TRUE);
+                               OSL_DELAY(10000);
+                               err = bcmsdh_sleep(bus->sdh, FALSE);
+                               if (err) {
+                                       /* XXX: Give up and assumed it has exited sleep
+                                        * XXX: Device probably dead at this point
+                                        * XXX: So far only happens with SR
+                                        */
+                                       DHD_ERROR(("%s: CMD14 exit failed twice!\n", __FUNCTION__));
+                                       DHD_ERROR(("%s: FATAL: Device non-response!\n",
+                                               __FUNCTION__));
+                                       err = 0;
+                               }
+                       }
+               }
+#else
+               if (OOB_WAKEUP_ENAB(bus))
+               {
+                       err = bcmsdh_gpioout(bus->sdh, GPIO_DEV_WAKEUP, TRUE);  /* GPIO_1 is on */
+               }
+               /* PR 101351: sdiod_aos sleep followed by immediate wakeup
+                *    before sdiod_aos takes over has a problem.
+                * Set KSO after ExitSleep.
+                */
+               do {
+                       err = dhdsdio_clk_kso_enab(bus, TRUE);
+                       if (err)
+                               OSL_SLEEP(10);
+               } while ((err != 0) && (++retry < 3));
+
+               if (err != 0) {
+                       DHD_ERROR(("ERROR: kso set failed retry: %d\n", retry));
+#ifndef BT_OVER_SDIO
+                       err = 0; /* continue anyway */
+#endif /* BT_OVER_SDIO */
+               }
+
+               if ((SLPAUTO_ENAB(bus)) && (bus->idleclock == DHD_IDLE_STOP)) {
+                       dhdsdio_set_sdmode(bus, bus->sd_mode);
+               }
+#endif /* !USE_CMD14 */
+
+               if (err == 0) {
+                       uint8 csr;
+
+                       /* Wait for device ready during transition to wake-up */
+                       SPINWAIT_SLEEP(sdioh_spinwait_sleep,
+                               (((csr = dhdsdio_sleepcsr_get(bus)) &
+                               SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK) !=
+                               (SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK)), (20000));
+
+                       DHD_TRACE(("%s: ExitSleep sleepcsr: 0x%x\n", __FUNCTION__, csr));
+
+                       if (!(csr & SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK)) {
+                               DHD_ERROR(("%s:ERROR: ExitSleep device NOT Ready! 0x%x\n",
+                                       __FUNCTION__, csr));
+                               err = BCME_NODEVICE;
+                       }
+
+                       /* PR 101351: sdiod_aos sleep followed by immediate wakeup
+                        *    before sdiod_aos takes over has a problem.
+                        */
+                       SPINWAIT_SLEEP(sdioh_spinwait_sleep,
+                               (((csr = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1,
+                               SBSDIO_FUNC1_CHIPCLKCSR, &err)) & SBSDIO_HT_AVAIL) !=
+                               (SBSDIO_HT_AVAIL)), (DHD_WAIT_HTAVAIL));
+
+                       DHD_TRACE(("%s: SBSDIO_FUNC1_CHIPCLKCSR : 0x%x\n", __FUNCTION__, csr));
+                       if (!err && ((csr & SBSDIO_HT_AVAIL) != SBSDIO_HT_AVAIL)) {
+                               DHD_ERROR(("%s:ERROR: device NOT Ready! 0x%x\n",
+                                       __FUNCTION__, csr));
+                               err = BCME_NODEVICE;
+                       }
+               }
+       }
+
+       /* Update if successful */
+       if (err == 0)
+               bus->kso = on ? FALSE : TRUE;
+       else {
+               DHD_ERROR(("%s: Sleep request failed: kso:%d on:%d err:%d\n",
+                       __FUNCTION__, bus->kso, on, err));
+               if (!on && retry > 2)
+                       bus->kso = FALSE;
+       }
+
+       return err;
+}
+
+/* Turn backplane clock on or off */
+static int
+dhdsdio_htclk(dhd_bus_t *bus, bool on, bool pendok)
+{
+#define HT_AVAIL_ERROR_MAX 10
+       static int ht_avail_error = 0;
+       int err;
+       uint8 clkctl, clkreq, devctl;
+       bcmsdh_info_t *sdh;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       clkctl = 0;
+       sdh = bus->sdh;
+
+       if (!KSO_ENAB(bus))
+               return BCME_OK;
+
+       if (SLPAUTO_ENAB(bus)) {
+               bus->clkstate = (on ? CLK_AVAIL : CLK_SDONLY);
+               return BCME_OK;
+       }
+
+       if (on) {
+               /* Request HT Avail */
+               clkreq = bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
+
+#ifdef BCMSPI
+               dhdsdio_wkwlan(bus, TRUE);
+#endif /* BCMSPI */
+
+               /* XXX Should be able to early-exit if pendok && PENDING */
+
+               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
+               if (err) {
+                       ht_avail_error++;
+                       if (ht_avail_error < HT_AVAIL_ERROR_MAX) {
+                               DHD_ERROR(("%s: HT Avail request error: %d\n", __FUNCTION__, err));
+                       }
+
+                       else if (ht_avail_error == HT_AVAIL_ERROR_MAX) {
+                               bus->dhd->hang_reason = HANG_REASON_HT_AVAIL_ERROR;
+                               dhd_os_send_hang_message(bus->dhd);
+                       }
+                       return BCME_ERROR;
+               } else {
+                       ht_avail_error = 0;
+               }
+
+               /* Check current status */
+               clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+               if (err) {
+                       DHD_ERROR(("%s: HT Avail read error: %d\n", __FUNCTION__, err));
+                       return BCME_ERROR;
+               }
+
+#if !defined(OOB_INTR_ONLY)
+               /* Go to pending and await interrupt if appropriate */
+               if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
+                       /* Allow only clock-available interrupt */
+                       devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+                       if (err) {
+                               DHD_ERROR(("%s: Devctl access error setting CA: %d\n",
+                                          __FUNCTION__, err));
+                               return BCME_ERROR;
+                       }
+
+                       devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+                       DHD_INFO(("CLKCTL: set PENDING\n"));
+                       bus->clkstate = CLK_PENDING;
+                       return BCME_OK;
+               } else
+#endif /* !defined (OOB_INTR_ONLY) */
+               {
+                       if (bus->clkstate == CLK_PENDING) {
+                               /* Cancel CA-only interrupt filter */
+                               devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+                               devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+                               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+                       }
+               }
+#ifndef BCMSDIOLITE
+               /* Otherwise, wait here (polling) for HT Avail */
+               if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
+                       SPINWAIT_SLEEP(sdioh_spinwait_sleep,
+                               ((clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+                                                           SBSDIO_FUNC1_CHIPCLKCSR, &err)),
+                                 !SBSDIO_CLKAV(clkctl, bus->alp_only)), PMU_MAX_TRANSITION_DLY);
+               }
+               if (err) {
+                       DHD_ERROR(("%s: HT Avail request error: %d\n", __FUNCTION__, err));
+                       return BCME_ERROR;
+               }
+               if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
+                       DHD_ERROR(("%s: HT Avail timeout (%d): clkctl 0x%02x\n",
+                                  __FUNCTION__, PMU_MAX_TRANSITION_DLY, clkctl));
+                       return BCME_ERROR;
+               }
+#endif /* BCMSDIOLITE */
+               /* Mark clock available */
+               bus->clkstate = CLK_AVAIL;
+               DHD_INFO(("CLKCTL: turned ON\n"));
+
+#if defined(DHD_DEBUG)
+               if (bus->alp_only == TRUE) {
+#if !defined(BCMLXSDMMC)
+                       /* XXX For the SDMMC Driver stack, if DHD was unloaded,
+                        * the chip is not completely reset, so in this case,
+                        * the PMU may already be programmed to allow HT clock.
+                        */
+                       if (!SBSDIO_ALPONLY(clkctl)) {
+                               DHD_ERROR(("%s: HT Clock, when ALP Only\n", __FUNCTION__));
+                       }
+#endif /* !defined(BCMLXSDMMC) */
+               } else {
+                       if (SBSDIO_ALPONLY(clkctl)) {
+                               DHD_ERROR(("%s: HT Clock should be on.\n", __FUNCTION__));
+                       }
+               }
+#endif /* defined (DHD_DEBUG) */
+
+               bus->activity = TRUE;
+#ifdef DHD_USE_IDLECOUNT
+               bus->idlecount = 0;
+#endif /* DHD_USE_IDLECOUNT */
+       } else {
+               clkreq = 0;
+
+               if (bus->clkstate == CLK_PENDING) {
+                       /* Cancel CA-only interrupt filter */
+                       devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+                       devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+               }
+
+               bus->clkstate = CLK_SDONLY;
+               if (!SR_ENAB(bus)) {
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
+                       DHD_INFO(("CLKCTL: turned OFF\n"));
+                       if (err) {
+                               DHD_ERROR(("%s: Failed access turning clock off: %d\n",
+                                          __FUNCTION__, err));
+                               return BCME_ERROR;
+                       }
+               }
+#ifdef BCMSPI
+                       dhdsdio_wkwlan(bus, FALSE);
+#endif /* BCMSPI */
+       }
+       return BCME_OK;
+}
+
+/* Change SD1/SD4 bus mode */
+static int
+dhdsdio_set_sdmode(dhd_bus_t *bus, int32 sd_mode)
+{
+       int err;
+
+       err = bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
+               &sd_mode, sizeof(sd_mode), TRUE);
+       if (err) {
+               DHD_ERROR(("%s: error changing sd_mode: %d\n",
+                       __FUNCTION__, err));
+               return BCME_ERROR;
+       }
+       return BCME_OK;
+}
+
+/* Change idle/active SD state */
+static int
+dhdsdio_sdclk(dhd_bus_t *bus, bool on)
+{
+#ifndef BCMSPI
+       int err;
+       int32 iovalue;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (on) {
+               if (bus->idleclock == DHD_IDLE_STOP) {
+                       /* Turn on clock and restore mode */
+                       iovalue = 1;
+                       err = bcmsdh_iovar_op(bus->sdh, "sd_clock", NULL, 0,
+                                             &iovalue, sizeof(iovalue), TRUE);
+                       if (err) {
+                               DHD_ERROR(("%s: error enabling sd_clock: %d\n",
+                                          __FUNCTION__, err));
+                               return BCME_ERROR;
+                       }
+
+               } else if (bus->idleclock != DHD_IDLE_ACTIVE) {
+                       /* Restore clock speed */
+                       iovalue = bus->sd_divisor;
+                       err = bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
+                                             &iovalue, sizeof(iovalue), TRUE);
+                       if (err) {
+                               DHD_ERROR(("%s: error restoring sd_divisor: %d\n",
+                                          __FUNCTION__, err));
+                               return BCME_ERROR;
+                       }
+               }
+               bus->clkstate = CLK_SDONLY;
+       } else {
+               /* Stop or slow the SD clock itself */
+               if ((bus->sd_divisor == -1) || (bus->sd_mode == -1)) {
+                       DHD_TRACE(("%s: can't idle clock, divisor %d mode %d\n",
+                                  __FUNCTION__, bus->sd_divisor, bus->sd_mode));
+                       return BCME_ERROR;
+               }
+               if (bus->idleclock == DHD_IDLE_STOP) {
+                       iovalue = 0;
+                       err = bcmsdh_iovar_op(bus->sdh, "sd_clock", NULL, 0,
+                                             &iovalue, sizeof(iovalue), TRUE);
+                       if (err) {
+                               DHD_ERROR(("%s: error disabling sd_clock: %d\n",
+                                          __FUNCTION__, err));
+                               return BCME_ERROR;
+                       }
+               } else if (bus->idleclock != DHD_IDLE_ACTIVE) {
+                       /* Set divisor to idle value */
+                       iovalue = bus->idleclock;
+                       err = bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
+                                             &iovalue, sizeof(iovalue), TRUE);
+                       if (err) {
+                               DHD_ERROR(("%s: error changing sd_divisor: %d\n",
+                                          __FUNCTION__, err));
+                               return BCME_ERROR;
+                       }
+               }
+               bus->clkstate = CLK_NONE;
+       }
+#endif /* BCMSPI */
+
+       return BCME_OK;
+}
+
+/* Transition SD and backplane clock readiness */
+static int
+dhdsdio_clkctl(dhd_bus_t *bus, uint target, bool pendok)
+{
+       int ret = BCME_OK;
+#ifdef DHD_DEBUG
+       uint oldstate = bus->clkstate;
+#endif /* DHD_DEBUG */
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       /* Early exit if we're already there */
+       if (bus->clkstate == target) {
+               if (target == CLK_AVAIL) {
+                       dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
+                       bus->activity = TRUE;
+#ifdef DHD_USE_IDLECOUNT
+                       bus->idlecount = 0;
+#endif /* DHD_USE_IDLECOUNT */
+               }
+               return ret;
+       }
+
+       switch (target) {
+       case CLK_AVAIL:
+               /* Make sure SD clock is available */
+               if (bus->clkstate == CLK_NONE)
+                       dhdsdio_sdclk(bus, TRUE);
+               /* Now request HT Avail on the backplane */
+               ret = dhdsdio_htclk(bus, TRUE, pendok);
+               if (ret == BCME_OK) {
+                       dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
+               bus->activity = TRUE;
+#ifdef DHD_USE_IDLECOUNT
+                       bus->idlecount = 0;
+#endif /* DHD_USE_IDLECOUNT */
+               }
+               break;
+
+       case CLK_SDONLY:
+
+#ifdef BT_OVER_SDIO
+               /*
+                * If the request is to switch off Back plane clock,
+                * confirm that BT is inactive before doing so.
+                * If this call had come from Non Watchdog context any way
+                * the Watchdog would switch off the clock again when
+                * nothing is to be done & Bt has finished using the bus.
+                */
+               if (bus->bt_use_count != 0) {
+                       DHD_INFO(("%s(): Req CLK_SDONLY, BT is active %d not switching off \r\n",
+                               __FUNCTION__, bus->bt_use_count));
+                       ret = BCME_OK;
+                       dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
+                       break;
+               }
+
+               DHD_INFO(("%s(): Request CLK_NONE BT is NOT active switching off \r\n",
+                       __FUNCTION__));
+#endif /* BT_OVER_SDIO */
+
+               /* Remove HT request, or bring up SD clock */
+               if (bus->clkstate == CLK_NONE)
+                       ret = dhdsdio_sdclk(bus, TRUE);
+               else if (bus->clkstate == CLK_AVAIL)
+                       ret = dhdsdio_htclk(bus, FALSE, FALSE);
+               else
+                       DHD_ERROR(("dhdsdio_clkctl: request for %d -> %d\n",
+                                  bus->clkstate, target));
+               if (ret == BCME_OK) {
+                       dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
+               }
+               break;
+
+       case CLK_NONE:
+
+#ifdef BT_OVER_SDIO
+               /*
+                * If the request is to switch off Back plane clock,
+                * confirm that BT is inactive before doing so.
+                * If this call had come from Non Watchdog context any way
+                * the Watchdog would switch off the clock again when
+                * nothing is to be done & Bt has finished using the bus.
+                */
+               if (bus->bt_use_count != 0) {
+                       DHD_INFO(("%s(): Request CLK_NONE BT is active %d not switching off \r\n",
+                               __FUNCTION__, bus->bt_use_count));
+                       ret = BCME_OK;
+                       break;
+               }
+
+               DHD_INFO(("%s(): Request CLK_NONE BT is NOT active switching off \r\n",
+                       __FUNCTION__));
+#endif /* BT_OVER_SDIO */
+
+               /* Make sure to remove HT request */
+               if (bus->clkstate == CLK_AVAIL)
+                       ret = dhdsdio_htclk(bus, FALSE, FALSE);
+               /* Now remove the SD clock */
+               ret = dhdsdio_sdclk(bus, FALSE);
+#ifdef DHD_DEBUG
+               if (bus->dhd->dhd_console_ms == 0)
+#endif /* DHD_DEBUG */
+               if (bus->poll == 0)
+                       dhd_os_wd_timer(bus->dhd, 0);
+               break;
+       }
+#ifdef DHD_DEBUG
+       DHD_INFO(("dhdsdio_clkctl: %d -> %d\n", oldstate, bus->clkstate));
+#endif /* DHD_DEBUG */
+
+       return ret;
+}
+
+static int
+dhdsdio_bussleep(dhd_bus_t *bus, bool sleep)
+{
+       int err = 0;
+       bcmsdh_info_t *sdh = bus->sdh;
+       sdpcmd_regs_t *regs = bus->regs;
+       uint retries = 0;
+#if defined(BCMSDIOH_STD)
+       uint32 sd3_tuning_disable = FALSE;
+#endif /* BCMSDIOH_STD */
+
+       DHD_INFO(("dhdsdio_bussleep: request %s (currently %s)\n",
+                (sleep ? "SLEEP" : "WAKE"),
+                 (bus->sleeping ? "SLEEP" : "WAKE")));
+
+       if (bus->dhd->hang_was_sent)
+               return BCME_ERROR;
+
+       /* Done if we're already in the requested state */
+       if (sleep == bus->sleeping)
+               return BCME_OK;
+
+       /* Going to sleep: set the alarm and turn off the lights... */
+       if (sleep) {
+               /* Don't sleep if something is pending */
+#ifdef DHD_USE_IDLECOUNT
+               if (bus->dpc_sched || bus->rxskip || pktq_n_pkts_tot(&bus->txq) ||
+                       bus->readframes || bus->ctrl_frame_stat)
+#else
+               if (bus->dpc_sched || bus->rxskip || pktq_n_pkts_tot(&bus->txq))
+#endif /* DHD_USE_IDLECOUNT */
+                       return BCME_BUSY;
+
+#ifdef BT_OVER_SDIO
+               /*
+                * The following is the assumption based on which the hook is placed.
+                * From WLAN driver, either from the active contexts OR from the Watchdog contexts
+                * we will be attempting to Go to Sleep. AT that moment if we see that BT is still
+                * actively using the bus, we will return BCME_BUSY from here, but the bus->sleeping
+                * state would not have changed. So the caller can then schedule the Watchdog again
+                * which will come and attempt to sleep at a later point.
+                *
+                * In case if BT is the only one and is the last user, we don't switch off the clock
+                * immediately, we allow the WLAN to decide when to sleep i.e from the watchdog.
+                * Now if the watchdog becomes active and attempts to switch off the clock and if
+                * another WLAN context is active they are any way serialized with sdlock.
+                */
+               if (bus->bt_use_count != 0) {
+                       DHD_INFO(("%s(): Cannot sleep BT is active \r\n", __FUNCTION__));
+                       return BCME_BUSY;
+               }
+#endif /* !BT_OVER_SDIO */
+
+               /* XXX Is it an error to sleep when not in data state? */
+
+               if (!SLPAUTO_ENAB(bus)) {
+                       /* Disable SDIO interrupts (no longer interested) */
+                       bcmsdh_intr_disable(bus->sdh);
+
+                       /* Make sure the controller has the bus up */
+                       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+                       /* Tell device to start using OOB wakeup */
+                       W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
+                       if (retries > retry_limit)
+                               DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
+
+                       /* Turn off our contribution to the HT clock request */
+                       dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                               SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
+
+                       /* Isolate the bus */
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL,
+                                       SBSDIO_DEVCTL_PADS_ISO, NULL);
+               } else {
+                       /* Leave interrupts enabled since device can exit sleep and
+                        * interrupt host
+                        */
+                       err = dhdsdio_clk_devsleep_iovar(bus, TRUE /* sleep */);
+               }
+
+               /* Change state */
+               bus->sleeping = TRUE;
+#if defined(BCMSDIOH_STD)
+               sd3_tuning_disable = TRUE;
+               err = bcmsdh_iovar_op(bus->sdh, "sd3_tuning_disable", NULL, 0,
+                       &sd3_tuning_disable, sizeof(sd3_tuning_disable), TRUE);
+#endif /* BCMSDIOH_STD */
+#if defined(SUPPORT_P2P_GO_PS)
+               wake_up(&bus->bus_sleep);
+#endif /* LINUX && SUPPORT_P2P_GO_PS */
+               /* XXX Should be able to turn off clock and power */
+               /* XXX Make sure GPIO interrupt input is enabled */
+       } else {
+               /* Waking up: bus power up is ok, set local state */
+
+               if (!SLPAUTO_ENAB(bus)) {
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, 0, &err);
+
+                       /* Force pad isolation off if possible (in case power never toggled) */
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, 0, NULL);
+
+                       /* XXX Make sure GPIO interrupt input is disabled */
+                       /* XXX Should be able to turn on power and clock */
+
+                       /* Make sure the controller has the bus up */
+                       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+                       /* Send misc interrupt to indicate OOB not needed */
+                       W_SDREG(0, &regs->tosbmailboxdata, retries);
+                       if (retries <= retry_limit)
+                               W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
+
+                       if (retries > retry_limit)
+                               DHD_ERROR(("CANNOT SIGNAL CHIP TO CLEAR OOB!!\n"));
+
+                       /* Make sure we have SD bus access */
+                       dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+
+                       /* Enable interrupts again */
+                       if (bus->intr && (bus->dhd->busstate == DHD_BUS_DATA)) {
+                               bus->intdis = FALSE;
+                               bcmsdh_intr_enable(bus->sdh);
+                       }
+               } else {
+                       err = dhdsdio_clk_devsleep_iovar(bus, FALSE /* wake */);
+#ifdef BT_OVER_SDIO
+                       if (err < 0) {
+                               struct net_device *net = NULL;
+                               dhd_pub_t *dhd = bus->dhd;
+                               net = dhd_idx2net(dhd, 0);
+                               if (net != NULL) {
+                                       DHD_ERROR(("<< WIFI HANG by KSO Enabled failure\n"));
+                                       dhd_os_sdunlock(dhd);
+                                       net_os_send_hang_message(net);
+                                       dhd_os_sdlock(dhd);
+                               } else {
+                                       DHD_ERROR(("<< WIFI HANG Fail because net is NULL\n"));
+                               }
+                       }
+#endif /* BT_OVER_SDIO */
+               }
+
+               if (err == 0) {
+                       /* Change state */
+                       bus->sleeping = FALSE;
+#if defined(BCMSDIOH_STD)
+                       sd3_tuning_disable = FALSE;
+                       err = bcmsdh_iovar_op(bus->sdh, "sd3_tuning_disable", NULL, 0,
+                               &sd3_tuning_disable, sizeof(sd3_tuning_disable), TRUE);
+#endif /* BCMSDIOH_STD */
+               }
+       }
+
+       return err;
+}
+
+#ifdef BT_OVER_SDIO
+/*
+ * Call this function to Get the Clock running.
+ * Assumes that the caller holds the sdlock.
+ * bus - Pointer to the dhd_bus handle
+ * can_wait - TRUE if the caller can wait until the clock becomes ready
+ *            FALSE if the caller cannot wait
+ */
+int __dhdsdio_clk_enable(struct dhd_bus *bus, bus_owner_t owner, int can_wait)
+{
+       int ret = BCME_ERROR;
+
+       BCM_REFERENCE(owner);
+
+       bus->bt_use_count++;
+
+       /*
+        * We can call BUS_WAKE, clkctl multiple times, both of the items
+        * have states and if its already ON, no new configuration is done
+        */
+
+       /* Wake up the Dongle FW from SR */
+       BUS_WAKE(bus);
+
+       /*
+        * Make sure back plane ht clk is on
+        * CLK_AVAIL - Turn On both SD & HT clock
+        */
+       ret = dhdsdio_clkctl(bus, CLK_AVAIL, can_wait);
+
+       DHD_INFO(("%s():bt_use_count %d \r\n", __FUNCTION__,
+               bus->bt_use_count));
+       return ret;
+}
+
+/*
+ * Call this function to relinquish the Clock.
+ * Assumes that the caller holds the sdlock.
+ * bus - Pointer to the dhd_bus handle
+ * can_wait - TRUE if the caller can wait until the clock becomes ready
+ *            FALSE if the caller cannot wait
+ */
+int __dhdsdio_clk_disable(struct dhd_bus *bus, bus_owner_t owner, int can_wait)
+{
+       int ret = BCME_ERROR;
+
+       BCM_REFERENCE(owner);
+       BCM_REFERENCE(can_wait);
+
+       if (bus->bt_use_count == 0) {
+               DHD_ERROR(("%s(): Clocks are already turned off \r\n",
+                       __FUNCTION__));
+               return ret;
+       }
+
+       bus->bt_use_count--;
+
+       /*
+        * When the SDIO Bus is shared between BT & WLAN, we turn Off the clock
+        * once the last user has relinqushed the same. But there are two schemes
+        * in that too. We consider WLAN as the  bus master (even if its not
+        * active). Even when the WLAN is OFF the DHD Watchdog is active.
+        * So this Bus Watchdog is the context whill put the Bus to sleep.
+        * Refer dhd_bus_watchdog function
+        */
+
+       ret = BCME_OK;
+       DHD_INFO(("%s():bt_use_count %d \r\n", __FUNCTION__,
+               bus->bt_use_count));
+       return ret;
+}
+
+void dhdsdio_reset_bt_use_count(struct dhd_bus *bus)
+{
+       /* reset bt use count */
+       bus->bt_use_count = 0;
+}
+#endif /* BT_OVER_SDIO */
+
+#ifdef USE_DYNAMIC_F2_BLKSIZE
+int dhdsdio_func_blocksize(dhd_pub_t *dhd, int function_num, int block_size)
+{
+       int func_blk_size = function_num;
+       int bcmerr = 0;
+       int result;
+
+       bcmerr = dhd_bus_iovar_op(dhd, "sd_blocksize", &func_blk_size,
+               sizeof(int), &result, sizeof(int), IOV_GET);
+
+       if (bcmerr != BCME_OK) {
+               DHD_ERROR(("%s: Get F%d Block size error\n", __FUNCTION__, function_num));
+               return BCME_ERROR;
+       }
+
+       if (result != block_size) {
+               DHD_TRACE_HW4(("%s: F%d Block size set from %d to %d\n",
+                       __FUNCTION__, function_num, result, block_size));
+               func_blk_size = function_num << 16 | block_size;
+               bcmerr = dhd_bus_iovar_op(dhd, "sd_blocksize", NULL,
+                       0, &func_blk_size, sizeof(int32), IOV_SET);
+               if (bcmerr != BCME_OK) {
+                       DHD_ERROR(("%s: Set F2 Block size error\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+       }
+
+       return BCME_OK;
+}
+#endif /* USE_DYNAMIC_F2_BLKSIZE */
+
+#if defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID) || defined(FORCE_WOWLAN)
+void
+dhd_enable_oob_intr(struct dhd_bus *bus, bool enable)
+{
+#if defined(BCMSPI_ANDROID)
+       bcmsdh_intr_enable(bus->sdh);
+#elif defined(HW_OOB) || defined(FORCE_WOWLAN)
+       bcmsdh_enable_hw_oob_intr(bus->sdh, enable);
+#else
+       sdpcmd_regs_t *regs = bus->regs;
+       uint retries = 0;
+
+       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+       if (enable == TRUE) {
+
+               /* Tell device to start using OOB wakeup */
+               W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
+               if (retries > retry_limit)
+                       DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
+
+       } else {
+               /* Send misc interrupt to indicate OOB not needed */
+               W_SDREG(0, &regs->tosbmailboxdata, retries);
+               if (retries <= retry_limit)
+                       W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
+       }
+
+       /* Turn off our contribution to the HT clock request */
+       dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+#endif /* !defined(HW_OOB) */
+}
+#endif /* defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID) */
+
+int
+dhd_bus_txdata(struct dhd_bus *bus, void *pkt)
+{
+       int ret = BCME_ERROR;
+       osl_t *osh;
+       uint datalen, prec;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       osh = bus->dhd->osh;
+       datalen = PKTLEN(osh, pkt);
+
+#ifdef SDTEST
+       /* Push the test header if doing loopback */
+       if (bus->ext_loop) {
+               uint8* data;
+               PKTPUSH(osh, pkt, SDPCM_TEST_HDRLEN);
+               data = PKTDATA(osh, pkt);
+               *data++ = SDPCM_TEST_ECHOREQ;
+               *data++ = (uint8)bus->loopid++;
+               *data++ = (datalen >> 0);
+               *data++ = (datalen >> 8);
+               datalen += SDPCM_TEST_HDRLEN;
+       }
+#else /* SDTEST */
+       BCM_REFERENCE(datalen);
+#endif /* SDTEST */
+
+       prec = PRIO2PREC((PKTPRIO(pkt) & PRIOMASK));
+
+       /* move from dhdsdio_sendfromq(), try to orphan skb early */
+       if (bus->dhd->conf->orphan_move == 1)
+               PKTORPHAN(pkt, bus->dhd->conf->tsq);
+
+       /* Check for existing queue, current flow-control, pending event, or pending clock */
+       if (dhd_deferred_tx || bus->fcstate || pktq_n_pkts_tot(&bus->txq) || bus->dpc_sched ||
+           (!DATAOK(bus)) || (bus->flowcontrol & NBITVAL(prec)) ||
+           (bus->clkstate != CLK_AVAIL)) {
+               bool deq_ret;
+               int pkq_len = 0;
+
+               DHD_TRACE(("%s: deferring pktq len %d\n", __FUNCTION__,
+                       pktq_n_pkts_tot(&bus->txq)));
+               bus->fcqueued++;
+
+               /* Priority based enq */
+               dhd_os_sdlock_txq(bus->dhd);
+               deq_ret = dhd_prec_enq(bus->dhd, &bus->txq, pkt, prec);
+               dhd_os_sdunlock_txq(bus->dhd);
+
+               if (!deq_ret) {
+#ifdef PROP_TXSTATUS
+                       if (DHD_PKTTAG_WLFCPKT(PKTTAG(pkt)) == 0)
+#endif /* PROP_TXSTATUS */
+                       {
+#ifdef DHDTCPACK_SUPPRESS
+                               if (dhd_tcpack_check_xmit(bus->dhd, pkt) == BCME_ERROR) {
+                                       DHD_ERROR(("%s %d: tcpack_suppress ERROR!!! Stop using\n",
+                                               __FUNCTION__, __LINE__));
+                                       dhd_tcpack_suppress_set(bus->dhd, TCPACK_SUP_OFF);
+                               }
+#endif /* DHDTCPACK_SUPPRESS */
+                               dhd_txcomplete(bus->dhd, pkt, FALSE);
+                               PKTFREE(osh, pkt, TRUE);        /* XXX update counter */
+                       }
+                       ret = BCME_NORESOURCE;
+               } else
+                       ret = BCME_OK;
+
+               /* XXX Possible race since check and action are not locked? */
+               if (dhd_doflow) {
+                       dhd_os_sdlock_txq(bus->dhd);
+                       pkq_len = pktq_n_pkts_tot(&bus->txq);
+                       dhd_os_sdunlock_txq(bus->dhd);
+               }
+               if (dhd_doflow && pkq_len >= FCHI) {
+                       bool wlfc_enabled = FALSE;
+#ifdef PROP_TXSTATUS
+                       wlfc_enabled = (dhd_wlfc_flowcontrol(bus->dhd, ON, FALSE) !=
+                               WLFC_UNSUPPORTED);
+#endif
+                       if (!wlfc_enabled && dhd_doflow) {
+                               dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, ON);
+                       }
+               }
+
+#ifdef DHD_DEBUG
+               dhd_os_sdlock_txq(bus->dhd);
+               if (pktqprec_n_pkts(&bus->txq, prec) > qcount[prec])
+                       qcount[prec] = pktqprec_n_pkts(&bus->txq, prec);
+               dhd_os_sdunlock_txq(bus->dhd);
+#endif
+
+               /* Schedule DPC if needed to send queued packet(s) */
+               /* XXX Also here, since other deferral conditions may no longer hold? */
+               if (dhd_deferred_tx && !bus->dpc_sched) {
+                       if (bus->dhd->conf->deferred_tx_len) {
+                               if(dhd_os_wd_timer_enabled(bus->dhd) == FALSE) {
+                                       bus->dpc_sched = TRUE;
+                                       dhd_sched_dpc(bus->dhd);
+                               }
+                               if(pktq_n_pkts_tot(&bus->txq) >= bus->dhd->conf->deferred_tx_len &&
+                                               dhd_os_wd_timer_enabled(bus->dhd) == FALSE) {
+                                       bus->dpc_sched = TRUE;
+                                       dhd_sched_dpc(bus->dhd);
+                               }
+                       } else {
+                               bus->dpc_sched = TRUE;
+                               dhd_sched_dpc(bus->dhd);
+                       }
+               }
+       } else {
+               int chan = SDPCM_DATA_CHANNEL;
+
+#ifdef SDTEST
+               chan = (bus->ext_loop ? SDPCM_TEST_CHANNEL : SDPCM_DATA_CHANNEL);
+#endif
+               /* Lock: we're about to use shared data/code (and SDIO) */
+               dhd_os_sdlock(bus->dhd);
+
+               /* Otherwise, send it now */
+               BUS_WAKE(bus);
+               /* Make sure back plane ht clk is on, no pending allowed */
+               dhdsdio_clkctl(bus, CLK_AVAIL, TRUE);
+
+               ret = dhdsdio_txpkt(bus, chan, &pkt, 1, TRUE);
+
+               if (ret != BCME_OK)
+                       bus->dhd->tx_errors++;
+               else
+                       bus->dhd->dstats.tx_bytes += datalen;
+
+               if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched &&
+                               NO_OTHER_ACTIVE_BUS_USER(bus)) {
+                       bus->activity = FALSE;
+                       dhdsdio_bussleep(bus, TRUE);
+                       dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+               }
+
+               dhd_os_sdunlock(bus->dhd);
+       }
+
+       return ret;
+}
+
+/* align packet data pointer and packet length to n-byte boundary, process packet headers,
+ * a new packet may be allocated if there is not enough head and/or tail from for padding.
+ * the caller is responsible for updating the glom size in the head packet (when glom is
+ * used)
+ *
+ * pad_pkt_len: returns the length of extra padding needed from the padding packet, this parameter
+ * is taken in tx glom mode only
+ *
+ * new_pkt: out, pointer of the new packet allocated due to insufficient head room for alignment
+ * padding, NULL if not needed, the caller is responsible for freeing the new packet
+ *
+ * return: positive value - length of the packet, including head and tail padding
+ *                negative value - errors
+ */
+static int dhdsdio_txpkt_preprocess(dhd_bus_t *bus, void *pkt, int chan, int txseq,
+       int prev_chain_total_len, bool last_chained_pkt,
+       int *pad_pkt_len, void **new_pkt
+#if defined(BCMSDIOH_TXGLOM_EXT)
+       , int first_frame
+#endif
+)
+{
+       osl_t *osh;
+       uint8 *frame;
+       int pkt_len;
+       int modulo;
+       int head_padding;
+       int tail_padding = 0;
+       uint32 swheader;
+       uint32 swhdr_offset;
+       bool alloc_new_pkt = FALSE;
+       uint8 sdpcm_hdrlen = bus->txglom_enable ? SDPCM_HDRLEN_TXGLOM : SDPCM_HDRLEN;
+#ifdef PKT_STATICS
+       uint16 len;
+#endif
+
+       *new_pkt = NULL;
+       osh = bus->dhd->osh;
+
+#ifdef DHDTCPACK_SUPPRESS
+       if (dhd_tcpack_check_xmit(bus->dhd, pkt) == BCME_ERROR) {
+               DHD_ERROR(("%s %d: tcpack_suppress ERROR!!! Stop using it\n",
+                       __FUNCTION__, __LINE__));
+               dhd_tcpack_suppress_set(bus->dhd, TCPACK_SUP_OFF);
+       }
+#endif /* DHDTCPACK_SUPPRESS */
+
+       /* Add space for the SDPCM hardware/software headers */
+       PKTPUSH(osh, pkt, sdpcm_hdrlen);
+       ASSERT(ISALIGNED((uintptr)PKTDATA(osh, pkt), 2));
+
+       frame = (uint8*)PKTDATA(osh, pkt);
+       pkt_len = (uint16)PKTLEN(osh, pkt);
+
+#ifdef PKT_STATICS
+       len = (uint16)PKTLEN(osh, pkt);
+       switch(chan) {
+               case SDPCM_CONTROL_CHANNEL:
+                       bus->tx_statics.ctrl_count++;
+                       bus->tx_statics.ctrl_size += len;
+                       break;
+               case SDPCM_DATA_CHANNEL:
+                       bus->tx_statics.data_count++;
+                       bus->tx_statics.data_size += len;
+                       break;
+               case SDPCM_GLOM_CHANNEL:
+                       bus->tx_statics.glom_count++;
+                       bus->tx_statics.glom_size += len;
+                       break;
+               case SDPCM_EVENT_CHANNEL:
+                       bus->tx_statics.event_count++;
+                       bus->tx_statics.event_size += len;
+                       break;
+               case SDPCM_TEST_CHANNEL:
+                       bus->tx_statics.test_count++;
+                       bus->tx_statics.test_size += len;
+                       break;
+
+               default:
+                       break;
+       }
+#endif /* PKT_STATICS */
+#ifdef DHD_DEBUG
+       if (PKTPRIO(pkt) < ARRAYSIZE(tx_packets))
+               tx_packets[PKTPRIO(pkt)]++;
+#endif /* DHD_DEBUG */
+
+       /* align the data pointer, allocate a new packet if there is not enough space (new
+        * packet data pointer will be aligned thus no padding will be needed)
+        */
+       head_padding = (uintptr)frame % DHD_SDALIGN;
+       if (PKTHEADROOM(osh, pkt) < head_padding) {
+               head_padding = 0;
+               alloc_new_pkt = TRUE;
+       } else {
+               uint cur_chain_total_len;
+               int chain_tail_padding = 0;
+
+               /* All packets need to be aligned by DHD_SDALIGN */
+               modulo = (pkt_len + head_padding) % DHD_SDALIGN;
+               tail_padding = modulo > 0 ? (DHD_SDALIGN - modulo) : 0;
+
+               /* Total pkt chain length needs to be aligned by block size,
+                * unless it is a single pkt chain with total length less than one block size,
+                * which we prefer sending by byte mode.
+                *
+                * Do the chain alignment here if
+                * 1. This is the last pkt of the chain of multiple pkts or a single pkt.
+                * 2-1. This chain is of multiple pkts, or
+                * 2-2. This is a single pkt whose size is longer than one block size.
+                */
+               cur_chain_total_len = prev_chain_total_len +
+                       (head_padding + pkt_len + tail_padding);
+               if (last_chained_pkt && bus->blocksize != 0 &&
+                       (cur_chain_total_len > (int)bus->blocksize || prev_chain_total_len > 0)) {
+                       modulo = cur_chain_total_len % bus->blocksize;
+                       chain_tail_padding = modulo > 0 ? (bus->blocksize - modulo) : 0;
+               }
+
+#ifdef DHDENABLE_TAILPAD
+               if (PKTTAILROOM(osh, pkt) < tail_padding) {
+                       /* We don't have tail room to align by DHD_SDALIGN */
+                       alloc_new_pkt = TRUE;
+                       bus->tx_tailpad_pktget++;
+               } else if (PKTTAILROOM(osh, pkt) < tail_padding + chain_tail_padding) {
+                       /* We have tail room for tail_padding of this pkt itself, but not for
+                        * total pkt chain alignment by block size.
+                        * Use the padding packet to avoid memory copy if applicable,
+                        * otherwise, just allocate a new pkt.
+                        */
+                       if (bus->pad_pkt) {
+                               *pad_pkt_len = chain_tail_padding;
+                               bus->tx_tailpad_chain++;
+                       } else {
+                               alloc_new_pkt = TRUE;
+                               bus->tx_tailpad_pktget++;
+                       }
+               } else
+               /* This last pkt's tailroom is sufficient to hold both tail_padding
+                * of the pkt itself and chain_tail_padding of total pkt chain
+                */
+#endif /* DHDENABLE_TAILPAD */
+               tail_padding += chain_tail_padding;
+       }
+
+       DHD_INFO(("%s sdhdr len + orig_pkt_len %d h_pad %d t_pad %d pad_pkt_len %d\n",
+               __FUNCTION__, pkt_len, head_padding, tail_padding, *pad_pkt_len));
+
+       if (alloc_new_pkt) {
+               void *tmp_pkt;
+               int newpkt_size;
+               int cur_total_len;
+
+               ASSERT(*pad_pkt_len == 0);
+
+               DHD_INFO(("%s allocating new packet for padding\n", __FUNCTION__));
+
+               /* head pointer is aligned now, no padding needed */
+               head_padding = 0;
+
+               /* update the tail padding as it depends on the head padding, since a new packet is
+                * allocated, the head padding is non longer needed and packet length is chagned
+                */
+
+               cur_total_len = prev_chain_total_len + pkt_len;
+               if (last_chained_pkt && bus->blocksize != 0 &&
+                       (cur_total_len > (int)bus->blocksize || prev_chain_total_len > 0)) {
+                       modulo = cur_total_len % bus->blocksize;
+                       tail_padding = modulo > 0 ? (bus->blocksize - modulo) : 0;
+               } else {
+                       modulo = pkt_len % DHD_SDALIGN;
+                       tail_padding = modulo > 0 ? (DHD_SDALIGN - modulo) : 0;
+               }
+
+               newpkt_size = PKTLEN(osh, pkt) + bus->blocksize + DHD_SDALIGN;
+               bus->dhd->tx_realloc++;
+               tmp_pkt = PKTGET(osh, newpkt_size, TRUE);
+               if (tmp_pkt == NULL) {
+                       DHD_ERROR(("failed to alloc new %d byte packet\n", newpkt_size));
+                       return BCME_NOMEM;
+               }
+               PKTALIGN(osh, tmp_pkt, PKTLEN(osh, pkt), DHD_SDALIGN);
+               bcopy(PKTDATA(osh, pkt), PKTDATA(osh, tmp_pkt), PKTLEN(osh, pkt));
+               *new_pkt = tmp_pkt;
+               pkt = tmp_pkt;
+       }
+
+       if (head_padding)
+               PKTPUSH(osh, pkt, head_padding);
+
+       frame = (uint8*)PKTDATA(osh, pkt);
+       bzero(frame, head_padding + sdpcm_hdrlen);
+       pkt_len = (uint16)PKTLEN(osh, pkt);
+
+       /* the header has the followming format
+        * 4-byte HW frame tag: length, ~length (for glom this is the total length)
+        *
+        * 8-byte HW extesion flags (glom mode only) as the following:
+        *                      2-byte packet length, excluding HW tag and padding
+        *                      2-byte frame channel and frame flags (e.g. next frame following)
+        *                      2-byte header length
+        *                      2-byte tail padding size
+        *
+        * 8-byte SW frame tags as the following
+        *                      4-byte flags: host tx seq, channel, data offset
+        *                      4-byte flags: TBD
+        */
+
+       swhdr_offset = SDPCM_FRAMETAG_LEN;
+
+       /* hardware frame tag:
+        *
+        * in tx-glom mode, dongle only checks the hardware frame tag in the first
+        * packet and sees it as the total lenght of the glom (including tail padding),
+        * for each packet in the glom, the packet length needs to be updated, (see
+        * below PKTSETLEN)
+        *
+        * in non tx-glom mode, PKTLEN still need to include tail padding as to be
+        * referred to in sdioh_request_buffer(). The tail length will be excluded in
+        * dhdsdio_txpkt_postprocess().
+        */
+#if defined(BCMSDIOH_TXGLOM_EXT)
+       if (bus->dhd->conf->txglom_bucket_size)
+               tail_padding = 0;
+#endif
+       *(uint16*)frame = (uint16)htol16(pkt_len);
+       *(((uint16*)frame) + 1) = (uint16)htol16(~pkt_len);
+       pkt_len += tail_padding;
+
+       /* hardware extesion flags */
+       if (bus->txglom_enable) {
+               uint32 hwheader1;
+               uint32 hwheader2;
+#ifdef BCMSDIOH_TXGLOM_EXT
+               uint32 act_len = pkt_len - tail_padding;
+               uint32 real_pad = 0;
+               if(bus->dhd->conf->txglom_ext && !last_chained_pkt) {
+                       tail_padding = 0;
+                       if(first_frame == 0) {
+                               // first pkt, add pad to bucket size - recv offset
+                               pkt_len = bus->dhd->conf->txglom_bucket_size - TXGLOM_RECV_OFFSET;
+                       } else {
+                               // add pad to bucket size
+                               pkt_len = bus->dhd->conf->txglom_bucket_size;
+                       }
+                       swhdr_offset += SDPCM_HWEXT_LEN;
+                       hwheader1 = (act_len - SDPCM_FRAMETAG_LEN) | (last_chained_pkt << 24);
+                       hwheader2 = (pkt_len - act_len) << 16;
+                       htol32_ua_store(hwheader1, frame + SDPCM_FRAMETAG_LEN);
+                       htol32_ua_store(hwheader2, frame + SDPCM_FRAMETAG_LEN + 4);
+                       real_pad = pkt_len - act_len;
+
+                       if (PKTTAILROOM(osh, pkt) < real_pad) {
+                               DHD_INFO(("%s : insufficient tailroom %d for %d real_pad\n", 
+                                       __func__, (int)PKTTAILROOM(osh, pkt), real_pad));
+                               if (PKTPADTAILROOM(osh, pkt, real_pad)) {
+                                       DHD_ERROR(("CHK1: padding error size %d\n", real_pad));
+                               } else
+                                       frame = (uint8 *)PKTDATA(osh, pkt);
+                       }
+               } else 
+#endif
+               {
+                       swhdr_offset += SDPCM_HWEXT_LEN;
+                       hwheader1 = (pkt_len - SDPCM_FRAMETAG_LEN - tail_padding) |
+                               (last_chained_pkt << 24);
+                       hwheader2 = (tail_padding) << 16;
+                       htol32_ua_store(hwheader1, frame + SDPCM_FRAMETAG_LEN);
+                       htol32_ua_store(hwheader2, frame + SDPCM_FRAMETAG_LEN + 4);
+               }
+       }
+       PKTSETLEN((osh), (pkt), (pkt_len));
+
+       /* software frame tags */
+       swheader = ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK)
+               | (txseq % SDPCM_SEQUENCE_WRAP) |
+               (((head_padding + sdpcm_hdrlen) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
+       htol32_ua_store(swheader, frame + swhdr_offset);
+       htol32_ua_store(0, frame + swhdr_offset + sizeof(swheader));
+
+       return pkt_len;
+}
+
+static int dhdsdio_txpkt_postprocess(dhd_bus_t *bus, void *pkt)
+{
+       osl_t *osh;
+       uint8 *frame;
+       int data_offset;
+       int tail_padding;
+       int swhdr_offset = SDPCM_FRAMETAG_LEN + (bus->txglom_enable ? SDPCM_HWEXT_LEN : 0);
+
+       (void)osh;
+       osh = bus->dhd->osh;
+
+       /* restore pkt buffer pointer, but keeps the header pushed by dhd_prot_hdrpush */
+       frame = (uint8*)PKTDATA(osh, pkt);
+
+       DHD_INFO(("%s PKTLEN before postprocess %d",
+               __FUNCTION__, PKTLEN(osh, pkt)));
+
+       /* PKTLEN still includes tail_padding, so exclude it.
+        * We shall have head_padding + original pkt_len for PKTLEN afterwards.
+        */
+       if (bus->txglom_enable) {
+               /* txglom pkts have tail_padding length in HW ext header */
+               tail_padding = ltoh32_ua(frame + SDPCM_FRAMETAG_LEN + 4) >> 16;
+               PKTSETLEN(osh, pkt, PKTLEN(osh, pkt) - tail_padding);
+               DHD_INFO((" txglom pkt: tail_padding %d PKTLEN %d\n",
+                       tail_padding, PKTLEN(osh, pkt)));
+       } else {
+               /* non-txglom pkts have head_padding + original pkt length in HW frame tag.
+                * We cannot refer to this field for txglom pkts as the first pkt of the chain will
+                * have the field for the total length of the chain.
+                */
+               PKTSETLEN(osh, pkt, *(uint16*)frame);
+               DHD_INFO((" non-txglom pkt: HW frame tag len %d after PKTLEN %d\n",
+                       *(uint16*)frame, PKTLEN(osh, pkt)));
+       }
+
+       data_offset = ltoh32_ua(frame + swhdr_offset);
+       data_offset = (data_offset & SDPCM_DOFFSET_MASK) >> SDPCM_DOFFSET_SHIFT;
+       /* Get rid of sdpcm header + head_padding */
+       PKTPULL(osh, pkt, data_offset);
+
+       DHD_INFO(("%s data_offset %d, PKTLEN %d\n",
+               __FUNCTION__, data_offset, PKTLEN(osh, pkt)));
+
+       return BCME_OK;
+}
+
+static int dhdsdio_txpkt(dhd_bus_t *bus, uint chan, void** pkts, int num_pkt, bool free_pkt)
+{
+       int i;
+       int ret = 0;
+       osl_t *osh;
+       bcmsdh_info_t *sdh;
+       void *pkt = NULL;
+       void *pkt_chain;
+       int total_len = 0;
+       void *head_pkt = NULL;
+       void *prev_pkt = NULL;
+       int pad_pkt_len = 0;
+       int new_pkt_num = 0;
+       void *new_pkts[MAX_TX_PKTCHAIN_CNT];
+       bool wlfc_enabled = FALSE;
+
+       if (bus->dhd->dongle_reset)
+               return BCME_NOTREADY;
+
+       if (num_pkt <= 0)
+               return BCME_BADARG;
+
+       sdh = bus->sdh;
+       osh = bus->dhd->osh;
+       /* init new_pkts[0] to make some compiler happy, not necessary as we check new_pkt_num */
+       new_pkts[0] = NULL;
+
+       for (i = 0; i < num_pkt; i++) {
+               int pkt_len;
+               bool last_pkt;
+               void *new_pkt = NULL;
+
+               pkt = pkts[i];
+               ASSERT(pkt);
+               last_pkt = (i == num_pkt - 1);
+               pkt_len = dhdsdio_txpkt_preprocess(bus, pkt, chan, bus->tx_seq + i,
+                       total_len, last_pkt, &pad_pkt_len, &new_pkt
+#if defined(BCMSDIOH_TXGLOM_EXT)
+                       , i
+#endif
+               );
+               if (pkt_len <= 0)
+                       goto done;
+               if (new_pkt) {
+                       pkt = new_pkt;
+                       new_pkts[new_pkt_num++] = new_pkt;
+               }
+               total_len += pkt_len;
+
+               PKTSETNEXT(osh, pkt, NULL);
+               /* insert the packet into the list */
+               head_pkt ? PKTSETNEXT(osh, prev_pkt, pkt) : (head_pkt = pkt);
+               prev_pkt = pkt;
+
+       }
+
+       /* Update the HW frame tag (total length) in the first pkt of the glom */
+       if (bus->txglom_enable) {
+               uint8 *frame;
+
+               total_len += pad_pkt_len;
+               frame = (uint8*)PKTDATA(osh, head_pkt);
+               *(uint16*)frame = (uint16)htol16(total_len);
+               *(((uint16*)frame) + 1) = (uint16)htol16(~total_len);
+
+       }
+
+#ifdef DHDENABLE_TAILPAD
+       /* if a padding packet if needed, insert it to the end of the link list */
+       if (pad_pkt_len) {
+               PKTSETLEN(osh, bus->pad_pkt, pad_pkt_len);
+               PKTSETNEXT(osh, pkt, bus->pad_pkt);
+       }
+#endif /* DHDENABLE_TAILPAD */
+
+       /* dhd_bcmsdh_send_buf ignores the buffer pointer if he packet
+        * parameter is not NULL, for non packet chian we pass NULL pkt pointer
+        * so it will take the aligned length and buffer pointer.
+        */
+       pkt_chain = PKTNEXT(osh, head_pkt) ? head_pkt : NULL;
+#ifdef HOST_TPUT_TEST
+       if ((bus->dhd->conf->data_drop_mode == TXPKT_DROP) && (total_len > 500)) {
+               ret = BCME_OK;
+       } else {
+               ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+                       PKTDATA(osh, head_pkt), total_len, pkt_chain, NULL, NULL, TXRETRIES);
+               if (ret == BCME_OK)
+                       bus->tx_seq = (bus->tx_seq + num_pkt) % SDPCM_SEQUENCE_WRAP;
+       }
+#else
+       ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+               PKTDATA(osh, head_pkt), total_len, pkt_chain, NULL, NULL, TXRETRIES);
+       if (ret == BCME_OK)
+               bus->tx_seq = (bus->tx_seq + num_pkt) % SDPCM_SEQUENCE_WRAP;
+#endif
+
+       /* if a padding packet was needed, remove it from the link list as it not a data pkt */
+       if (pad_pkt_len && pkt)
+               PKTSETNEXT(osh, pkt, NULL);
+
+done:
+       pkt = head_pkt;
+       while (pkt) {
+               void *pkt_next = PKTNEXT(osh, pkt);
+               PKTSETNEXT(osh, pkt, NULL);
+               dhdsdio_txpkt_postprocess(bus, pkt);
+               pkt = pkt_next;
+       }
+
+       /* new packets might be allocated due to insufficient room for padding, but we
+        * still have to indicate the original packets to upper layer
+        */
+       for (i = 0; i < num_pkt; i++) {
+               pkt = pkts[i];
+               wlfc_enabled = FALSE;
+#ifdef PROP_TXSTATUS
+               if (DHD_PKTTAG_WLFCPKT(PKTTAG(pkt))) {
+                       wlfc_enabled = (dhd_wlfc_txcomplete(bus->dhd, pkt, ret == 0) !=
+                               WLFC_UNSUPPORTED);
+               }
+#endif /* PROP_TXSTATUS */
+               if (!wlfc_enabled) {
+                       PKTSETNEXT(osh, pkt, NULL);
+                       dhd_txcomplete(bus->dhd, pkt, ret != 0);
+                       if (free_pkt)
+                               PKTFREE(osh, pkt, TRUE);
+               }
+       }
+
+       for (i = 0; i < new_pkt_num; i++)
+               PKTFREE(osh, new_pkts[i], TRUE);
+
+       return ret;
+}
+
+static uint
+dhdsdio_sendfromq(dhd_bus_t *bus, uint maxframes)
+{
+       uint cnt = 0;
+       uint8 tx_prec_map;
+       uint16 txpktqlen = 0;
+       uint32 intstatus = 0;
+       uint retries = 0;
+       osl_t *osh;
+       dhd_pub_t *dhd = bus->dhd;
+       sdpcmd_regs_t *regs = bus->regs;
+#ifdef DHD_LOSSLESS_ROAMING
+       uint8 *pktdata;
+       struct ether_header *eh;
+#ifdef BDC
+       struct bdc_header *bdc_header;
+       uint8 data_offset;
+#endif
+#endif /* DHD_LOSSLESS_ROAMING */
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (!KSO_ENAB(bus)) {
+               DHD_ERROR(("%s: Device asleep\n", __FUNCTION__));
+               return BCME_NODEVICE;
+       }
+
+       osh = dhd->osh;
+       tx_prec_map = ~bus->flowcontrol;
+#ifdef DHD_LOSSLESS_ROAMING
+       tx_prec_map &= dhd->dequeue_prec_map;
+#endif /* DHD_LOSSLESS_ROAMING */
+       for (cnt = 0; (cnt < maxframes) && DATAOK(bus);) {
+               int i;
+               int num_pkt = 1;
+               void *pkts[MAX_TX_PKTCHAIN_CNT];
+               int prec_out;
+               uint datalen = 0;
+
+               dhd_os_sdlock_txq(bus->dhd);
+               if (bus->txglom_enable) {
+                       uint32 glomlimit = (uint32)bus->txglomsize;
+#if defined(BCMSDIOH_STD)
+                       if (bus->blocksize == 64) {
+                               glomlimit = MIN((uint32)bus->txglomsize, BLK_64_MAXTXGLOM);
+                       }
+#endif /* BCMSDIOH_STD */
+                       num_pkt = MIN((uint32)DATABUFCNT(bus), glomlimit);
+                       num_pkt = MIN(num_pkt, ARRAYSIZE(pkts));
+               }
+               num_pkt = MIN(num_pkt, pktq_mlen(&bus->txq, tx_prec_map));
+               for (i = 0; i < num_pkt; i++) {
+                       pkts[i] = pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
+                       if (!pkts[i]) {
+                               DHD_ERROR(("%s: pktq_mlen non-zero when no pkt\n",
+                                       __FUNCTION__));
+                               ASSERT(0);
+                               break;
+                       }
+#ifdef DHD_LOSSLESS_ROAMING
+                       pktdata = (uint8 *)PKTDATA(osh, pkts[i]);
+#ifdef BDC
+                       /* Skip BDC header */
+                       bdc_header = (struct bdc_header *)pktdata;
+                       data_offset = bdc_header->dataOffset;
+                       pktdata += BDC_HEADER_LEN + (data_offset << 2);
+#endif
+                       eh = (struct ether_header *)pktdata;
+                       if (eh->ether_type == hton16(ETHER_TYPE_802_1X)) {
+                               uint8 prio = (uint8)PKTPRIO(pkts[i]);
+
+                               /* Restore to original priority for 802.1X packet */
+                               if (prio == PRIO_8021D_NC) {
+                                       PKTSETPRIO(pkts[i], dhd->prio_8021x);
+#ifdef BDC
+                                       /* Restore to original priority in BDC header */
+                                       bdc_header->priority =
+                                               (dhd->prio_8021x & BDC_PRIORITY_MASK);
+#endif
+                               }
+                       }
+#endif /* DHD_LOSSLESS_ROAMING */
+                       if (!bus->dhd->conf->orphan_move)
+                               PKTORPHAN(pkts[i], bus->dhd->conf->tsq);
+                       datalen += PKTLEN(osh, pkts[i]);
+               }
+               dhd_os_sdunlock_txq(bus->dhd);
+
+               if (i == 0)
+                       break;
+               if (dhdsdio_txpkt(bus, SDPCM_DATA_CHANNEL, pkts, i, TRUE) != BCME_OK)
+                       dhd->tx_errors++;
+               else {
+                       dhd->dstats.tx_bytes += datalen;
+                       bus->txglomframes++;
+                       bus->txglompkts += num_pkt;
+#ifdef PKT_STATICS
+                       bus->tx_statics.glom_cnt_us[num_pkt-1] =
+                               (bus->tx_statics.glom_cnt[num_pkt-1]*bus->tx_statics.glom_cnt_us[num_pkt-1]
+                               + bcmsdh_get_spend_time(bus->sdh))/(bus->tx_statics.glom_cnt[num_pkt-1] + 1);
+#endif
+               }
+               cnt += i;
+#ifdef PKT_STATICS
+               if (num_pkt) {
+                       bus->tx_statics.glom_cnt[num_pkt-1]++;
+                       if (num_pkt > bus->tx_statics.glom_max)
+                               bus->tx_statics.glom_max = num_pkt;
+               }
+#endif
+
+               /* In poll mode, need to check for other events */
+               if (!bus->intr && cnt)
+               {
+                       /* Check device status, signal pending interrupt */
+                       R_SDREG(intstatus, &regs->intstatus, retries);
+                       bus->f2txdata++;
+                       if (bcmsdh_regfail(bus->sdh))
+                               break;
+                       if (intstatus & bus->hostintmask)
+                               bus->ipend = TRUE;
+               }
+
+       }
+
+       if (dhd_doflow) {
+               dhd_os_sdlock_txq(bus->dhd);
+               txpktqlen = pktq_n_pkts_tot(&bus->txq);
+               dhd_os_sdunlock_txq(bus->dhd);
+       }
+
+       /* Do flow-control if needed */
+       if (dhd->up && (dhd->busstate == DHD_BUS_DATA) && (txpktqlen < FCLOW)) {
+               bool wlfc_enabled = FALSE;
+#ifdef PROP_TXSTATUS
+               wlfc_enabled = (dhd_wlfc_flowcontrol(dhd, OFF, TRUE) != WLFC_UNSUPPORTED);
+#endif
+               if (!wlfc_enabled && dhd_doflow && dhd->txoff) {
+                       dhd_txflowcontrol(dhd, ALL_INTERFACES, OFF);
+               }
+       }
+
+       return cnt;
+}
+
+static void
+dhdsdio_sendpendctl(dhd_bus_t *bus)
+{
+       bcmsdh_info_t *sdh = bus->sdh;
+       int ret;
+       uint8* frame_seq = bus->ctrl_frame_buf + SDPCM_FRAMETAG_LEN;
+
+       if (bus->txglom_enable)
+               frame_seq += SDPCM_HWEXT_LEN;
+
+       if (*frame_seq != bus->tx_seq) {
+               DHD_INFO(("%s IOCTL frame seq lag detected!"
+                       " frm_seq:%d != bus->tx_seq:%d, corrected\n",
+                       __FUNCTION__, *frame_seq, bus->tx_seq));
+               *frame_seq = bus->tx_seq;
+       }
+
+       ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+               (uint8 *)bus->ctrl_frame_buf, (uint32)bus->ctrl_frame_len,
+               NULL, NULL, NULL, 1);
+       if (ret == BCME_OK)
+               bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
+
+       bus->ctrl_frame_stat = FALSE;
+       dhd_wait_event_wakeup(bus->dhd);
+}
+
+int
+dhd_bus_txctl(struct dhd_bus *bus, uchar *msg, uint msglen)
+{
+       static int err_nodevice = 0;
+       uint8 *frame;
+       uint16 len;
+       uint32 swheader;
+       uint8 doff = 0;
+       int ret = -1;
+       uint8 sdpcm_hdrlen = bus->txglom_enable ? SDPCM_HDRLEN_TXGLOM : SDPCM_HDRLEN;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus->dhd->dongle_reset)
+               return -EIO;
+
+       /* Back the pointer to make a room for bus header */
+       frame = msg - sdpcm_hdrlen;
+       len = (msglen += sdpcm_hdrlen);
+
+       /* Add alignment padding (optional for ctl frames) */
+       if (dhd_alignctl) {
+               if ((doff = ((uintptr)frame % DHD_SDALIGN))) {
+                       frame -= doff;
+                       len += doff;
+                       msglen += doff;
+                       bzero(frame, doff + sdpcm_hdrlen);
+               }
+               ASSERT(doff < DHD_SDALIGN);
+       }
+       doff += sdpcm_hdrlen;
+
+#ifndef BCMSPI
+       /* Round send length to next SDIO block */
+       if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
+               uint16 pad = bus->blocksize - (len % bus->blocksize);
+               if ((pad <= bus->roundup) && (pad < bus->blocksize))
+                       len += pad;
+       } else if (len % DHD_SDALIGN) {
+               len += DHD_SDALIGN - (len % DHD_SDALIGN);
+       }
+#endif /* BCMSPI */
+
+       /* Satisfy length-alignment requirements */
+       if (forcealign && (len & (ALIGNMENT - 1)))
+               len = ROUNDUP(len, ALIGNMENT);
+
+       ASSERT(ISALIGNED((uintptr)frame, 2));
+
+       /* Need to lock here to protect txseq and SDIO tx calls */
+       dhd_os_sdlock(bus->dhd);
+       if (bus->dhd->conf->txctl_tmo_fix > 0 && !TXCTLOK(bus)) {
+               bus->ctrl_wait = TRUE;
+               dhd_os_sdunlock(bus->dhd);
+               wait_event_interruptible_timeout(bus->ctrl_tx_wait, TXCTLOK(bus),
+                       msecs_to_jiffies(bus->dhd->conf->txctl_tmo_fix));
+               dhd_os_sdlock(bus->dhd);
+               bus->ctrl_wait = FALSE;
+       }
+
+       BUS_WAKE(bus);
+
+       /* Make sure backplane clock is on */
+       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+       /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
+       *(uint16*)frame = htol16((uint16)msglen);
+       *(((uint16*)frame) + 1) = htol16(~msglen);
+
+       if (bus->txglom_enable) {
+               uint32 hwheader1, hwheader2;
+               /* Software tag: channel, sequence number, data offset */
+               swheader = ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK)
+                               | bus->tx_seq
+                               | ((doff << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
+               htol32_ua_store(swheader, frame + SDPCM_FRAMETAG_LEN + SDPCM_HWEXT_LEN);
+               htol32_ua_store(0, frame + SDPCM_FRAMETAG_LEN
+                       + SDPCM_HWEXT_LEN + sizeof(swheader));
+
+               hwheader1 = (msglen - SDPCM_FRAMETAG_LEN) | (1 << 24);
+               hwheader2 = (len - (msglen)) << 16;
+               htol32_ua_store(hwheader1, frame + SDPCM_FRAMETAG_LEN);
+               htol32_ua_store(hwheader2, frame + SDPCM_FRAMETAG_LEN + 4);
+
+               *(uint16*)frame = htol16(len);
+               *(((uint16*)frame) + 1) = htol16(~(len));
+       } else {
+               /* Software tag: channel, sequence number, data offset */
+               swheader = ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK)
+                       | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
+               htol32_ua_store(swheader, frame + SDPCM_FRAMETAG_LEN);
+               htol32_ua_store(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
+       }
+
+       if (!TXCTLOK(bus))
+       {
+               DHD_INFO(("%s: No bus credit bus->tx_max %d, bus->tx_seq %d\n",
+                       __FUNCTION__, bus->tx_max, bus->tx_seq));
+               bus->ctrl_frame_stat = TRUE;
+               /* Send from dpc */
+               bus->ctrl_frame_buf = frame;
+               bus->ctrl_frame_len = len;
+
+               if (!bus->dpc_sched) {
+                       bus->dpc_sched = TRUE;
+                       dhd_sched_dpc(bus->dhd);
+               }
+               if (bus->ctrl_frame_stat) {
+                       dhd_wait_for_event(bus->dhd, &bus->ctrl_frame_stat);
+               }
+
+               if (bus->ctrl_frame_stat == FALSE) {
+                       DHD_INFO(("%s: ctrl_frame_stat == FALSE\n", __FUNCTION__));
+                       ret = 0;
+               } else {
+                       bus->dhd->txcnt_timeout++;
+                       if (!bus->dhd->hang_was_sent) {
+#ifdef CUSTOMER_HW4_DEBUG
+                               /* XXX Add Debug code for find root cause from CSP:565333 */
+                               uint32 status, retry = 0;
+                               R_SDREG(status, &bus->regs->intstatus, retry);
+                               DHD_TRACE_HW4(("%s: txcnt_timeout, INT status=0x%08X\n",
+                                       __FUNCTION__, status));
+                               DHD_TRACE_HW4(("%s : tx_max : %d, tx_seq : %d, clkstate : %d \n",
+                                       __FUNCTION__, bus->tx_max, bus->tx_seq, bus->clkstate));
+#endif /* CUSTOMER_HW4_DEBUG */
+                               DHD_ERROR(("%s: ctrl_frame_stat == TRUE txcnt_timeout=%d\n",
+                                       __FUNCTION__, bus->dhd->txcnt_timeout));
+#ifdef BCMSDIO_RXLIM_POST
+                               DHD_ERROR(("%s: rxlim_en=%d, rxlim enable=%d, rxlim_addr=%d\n",
+                                       __FUNCTION__,
+                                       bus->dhd->conf->rxlim_en, bus->rxlim_en, bus->rxlim_addr));
+#endif /* BCMSDIO_RXLIM_POST */
+                       }
+#ifdef DHD_FW_COREDUMP
+                       /* Collect socram dump */
+                       if ((bus->dhd->memdump_enabled) &&
+                               (bus->dhd->txcnt_timeout >= MAX_CNTL_TX_TIMEOUT)) {
+                               /* collect core dump */
+                               bus->dhd->memdump_type = DUMP_TYPE_RESUMED_ON_TIMEOUT_TX;
+                               dhd_os_sdunlock(bus->dhd);
+                               dhd_bus_mem_dump(bus->dhd);
+                               dhd_os_sdlock(bus->dhd);
+                       }
+#endif /* DHD_FW_COREDUMP */
+                       ret = -1;
+                       bus->ctrl_frame_stat = FALSE;
+                       goto done;
+               }
+       }
+
+       bus->dhd->txcnt_timeout = 0;
+       bus->ctrl_frame_stat = TRUE;
+
+       if (ret == -1) {
+#ifdef DHD_DEBUG
+               if (DHD_BYTES_ON() && DHD_CTL_ON()) {
+                       prhex("Tx Frame", frame, len);
+               } else if (DHD_HDRS_ON()) {
+                       prhex("TxHdr", frame, MIN(len, 16));
+               }
+#endif
+#ifdef PKT_STATICS
+               bus->tx_statics.ctrl_count++;
+               bus->tx_statics.ctrl_size += len;
+#endif
+               ret = dhd_bcmsdh_send_buffer(bus, frame, len);
+       }
+       bus->ctrl_frame_stat = FALSE;
+
+done:
+       if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched &&
+               NO_OTHER_ACTIVE_BUS_USER(bus)) {
+               bus->activity = FALSE;
+               dhdsdio_bussleep(bus, TRUE);
+               dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+       }
+
+       dhd_os_sdunlock(bus->dhd);
+
+       /* XXX Need to validate return code (ranges) */
+       if (ret)
+               bus->dhd->tx_ctlerrs++;
+       else
+               bus->dhd->tx_ctlpkts++;
+
+       if (bus->dhd->txcnt_timeout >= MAX_CNTL_TX_TIMEOUT) {
+#ifdef DHD_PM_CONTROL_FROM_FILE
+               if (g_pm_control == TRUE) {
+                       return -BCME_ERROR;
+               } else {
+               return -ETIMEDOUT;
+               }
+#else
+               return -ETIMEDOUT;
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+       }
+       if (ret == BCME_NODEVICE)
+               err_nodevice++;
+       else
+               err_nodevice = 0;
+
+       return ret ? err_nodevice >= ERROR_BCME_NODEVICE_MAX ? -ETIMEDOUT : -EIO : 0;
+}
+
+int
+dhd_bus_rxctl(struct dhd_bus *bus, uchar *msg, uint msglen)
+{
+       int timeleft;
+       uint rxlen = 0;
+       static uint cnt = 0;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus->dhd->dongle_reset)
+               return -EIO;
+
+       /* Wait until control frame is available */
+       timeleft = dhd_os_ioctl_resp_wait(bus->dhd, &bus->rxlen);
+
+       dhd_os_sdlock(bus->dhd);
+       rxlen = bus->rxlen;
+       bcopy(bus->rxctl, msg, MIN(msglen, rxlen));
+       bus->rxlen = 0;
+       dhd_os_sdunlock(bus->dhd);
+
+       if (bus->dhd->conf->ctrl_resched > 0 && !rxlen && timeleft == 0) {
+               cnt++;
+               if (cnt <= bus->dhd->conf->ctrl_resched) {
+                       uint32 status, retry = 0;
+                       R_SDREG(status, &bus->regs->intstatus, retry);
+                       if ((status & I_HMB_HOST_INT) || PKT_AVAILABLE(bus, status)) {
+                               DHD_ERROR(("%s: reschedule dhd_dpc, cnt=%d, status=0x%x\n",
+                                       __FUNCTION__, cnt, status));
+                               bus->ipend = TRUE;
+                               bus->dpc_sched = TRUE;
+                               dhd_sched_dpc(bus->dhd);
+
+                               /* Wait until control frame is available */
+                               timeleft = dhd_os_ioctl_resp_wait(bus->dhd, &bus->rxlen);
+
+                               dhd_os_sdlock(bus->dhd);
+                               rxlen = bus->rxlen;
+                               bcopy(bus->rxctl, msg, MIN(msglen, rxlen));
+                               bus->rxlen = 0;
+                               dhd_os_sdunlock(bus->dhd);
+                       }
+               }
+       } else {
+               cnt = 0;
+       }
+
+       if (rxlen) {
+               DHD_CTL(("%s: resumed on rxctl frame, got %d expected %d\n",
+                       __FUNCTION__, rxlen, msglen));
+       } else {
+               if (timeleft == 0) {
+#ifdef DHD_DEBUG
+                       uint32 status, retry = 0;
+                       R_SDREG(status, &bus->regs->intstatus, retry);
+                       DHD_ERROR(("%s: resumed on timeout, INT status=0x%08X\n",
+                               __FUNCTION__, status));
+#else
+                       DHD_ERROR(("%s: resumed on timeout\n", __FUNCTION__));
+#endif /* DHD_DEBUG */
+                       if (!bus->dhd->dongle_trap_occured) {
+#ifdef DHD_FW_COREDUMP
+                               bus->dhd->memdump_type = DUMP_TYPE_RESUMED_ON_TIMEOUT;
+#endif /* DHD_FW_COREDUMP */
+                               dhd_os_sdlock(bus->dhd);
+                               dhdsdio_checkdied(bus, NULL, 0);
+                               dhd_os_sdunlock(bus->dhd);
+                       }
+               } else {
+                       DHD_CTL(("%s: resumed for unknown reason?\n", __FUNCTION__));
+                       if (!bus->dhd->dongle_trap_occured) {
+#ifdef DHD_FW_COREDUMP
+                               bus->dhd->memdump_type = DUMP_TYPE_RESUMED_UNKNOWN;
+#endif /* DHD_FW_COREDUMP */
+                               dhd_os_sdlock(bus->dhd);
+                               dhdsdio_checkdied(bus, NULL, 0);
+                               dhd_os_sdunlock(bus->dhd);
+                       }
+               }
+#ifdef DHD_FW_COREDUMP
+               /* Dump the ram image */
+               if (bus->dhd->memdump_enabled && !bus->dhd->dongle_trap_occured)
+                       dhdsdio_mem_dump(bus);
+#endif /* DHD_FW_COREDUMP */
+       }
+       if (timeleft == 0) {
+               if (rxlen == 0)
+                       bus->dhd->rxcnt_timeout++;
+               DHD_ERROR(("%s: rxcnt_timeout=%d, rxlen=%d\n", __FUNCTION__,
+                       bus->dhd->rxcnt_timeout, rxlen));
+#ifdef DHD_FW_COREDUMP
+               /* collect socram dump */
+               if (bus->dhd->memdump_enabled) {
+                       bus->dhd->memdump_type = DUMP_TYPE_RESUMED_ON_TIMEOUT_RX;
+                       dhd_bus_mem_dump(bus->dhd);
+               }
+#endif /* DHD_FW_COREDUMP */
+       } else {
+               bus->dhd->rxcnt_timeout = 0;
+       }
+
+       if (rxlen)
+               bus->dhd->rx_ctlpkts++;
+       else
+               bus->dhd->rx_ctlerrs++;
+
+       if (bus->dhd->rxcnt_timeout >= MAX_CNTL_RX_TIMEOUT) {
+#ifdef DHD_PM_CONTROL_FROM_FILE
+               if (g_pm_control == TRUE) {
+                       return -BCME_ERROR;
+               } else {
+                       return -ETIMEDOUT;
+               }
+#else
+               return -ETIMEDOUT;
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+       }
+       if (bus->dhd->dongle_trap_occured)
+               return -EREMOTEIO;
+
+       return rxlen ? (int)rxlen : -EIO; /* XXX Returns EIO error  */
+}
+
+/* IOVar table */
+enum {
+       IOV_INTR = 1,
+       IOV_POLLRATE,
+       IOV_SDREG,
+       IOV_SBREG,
+       IOV_SDCIS,
+       IOV_RAMSIZE,
+       IOV_RAMSTART,
+#ifdef DHD_DEBUG
+       IOV_CHECKDIED,
+       IOV_SERIALCONS,
+#endif /* DHD_DEBUG */
+       IOV_SET_DOWNLOAD_STATE,
+       IOV_SOCRAM_STATE,
+       IOV_FORCEEVEN,
+       IOV_SDIOD_DRIVE,
+       IOV_READAHEAD,
+       IOV_SDRXCHAIN,
+       IOV_ALIGNCTL,
+       IOV_SDALIGN,
+       IOV_DEVRESET,
+       IOV_CPU,
+#if defined(USE_SDIOFIFO_IOVAR)
+       IOV_WATERMARK,
+       IOV_MESBUSYCTRL,
+#endif /* USE_SDIOFIFO_IOVAR */
+#ifdef SDTEST
+       IOV_PKTGEN,
+       IOV_EXTLOOP,
+#endif /* SDTEST */
+       IOV_SPROM,
+       IOV_TXBOUND,
+       IOV_RXBOUND,
+       IOV_TXMINMAX,
+       IOV_IDLETIME,
+       IOV_IDLECLOCK,
+       IOV_SD1IDLE,
+       IOV_SLEEP,
+       IOV_DONGLEISOLATION,
+       IOV_KSO,
+       IOV_DEVSLEEP,
+       IOV_DEVCAP,
+       IOV_VARS,
+#ifdef SOFTAP
+       IOV_FWPATH,
+#endif
+       IOV_TXGLOMSIZE,
+       IOV_TXGLOMMODE,
+       IOV_HANGREPORT,
+       IOV_TXINRX_THRES,
+       IOV_SDIO_SUSPEND
+#if defined(DEBUGGER) || defined(DHD_DSCOPE)
+       IOV_GDB_SERVER,  /**< starts gdb server on given interface */
+#endif /* DEBUGGER || DHD_DSCOPE */
+};
+
+const bcm_iovar_t dhdsdio_iovars[] = {
+       {"intr",        IOV_INTR,       0, 0,   IOVT_BOOL,      0 },
+       {"sleep",       IOV_SLEEP,      0, 0,   IOVT_BOOL,      0 },
+       {"pollrate",    IOV_POLLRATE,   0, 0,   IOVT_UINT32,    0 },
+       {"idletime",    IOV_IDLETIME,   0, 0,   IOVT_INT32,     0 },
+       {"idleclock",   IOV_IDLECLOCK,  0, 0,   IOVT_INT32,     0 },
+       {"sd1idle",     IOV_SD1IDLE,    0, 0,   IOVT_BOOL,      0 },
+       {"ramsize",     IOV_RAMSIZE,    0, 0,   IOVT_UINT32,    0 },
+       {"ramstart",    IOV_RAMSTART,   0, 0,   IOVT_UINT32,    0 },
+       {"dwnldstate",  IOV_SET_DOWNLOAD_STATE, 0, 0,   IOVT_BOOL,      0 },
+       {"socram_state",        IOV_SOCRAM_STATE,       0, 0,   IOVT_BOOL,      0 },
+       {"vars",        IOV_VARS,       0, 0,   IOVT_BUFFER,    0 },
+       {"sdiod_drive", IOV_SDIOD_DRIVE, 0, 0,  IOVT_UINT32,    0 },
+       {"readahead",   IOV_READAHEAD,  0, 0,   IOVT_BOOL,      0 },
+       {"sdrxchain",   IOV_SDRXCHAIN,  0, 0,   IOVT_BOOL,      0 },
+       {"alignctl",    IOV_ALIGNCTL,   0, 0,   IOVT_BOOL,      0 },
+       {"sdalign",     IOV_SDALIGN,    0, 0,   IOVT_BOOL,      0 },
+       {"devreset",    IOV_DEVRESET,   0, 0,   IOVT_BOOL,      0 },
+#ifdef DHD_DEBUG
+       {"sdreg",       IOV_SDREG,      0, 0,   IOVT_BUFFER,    sizeof(sdreg_t) },
+       {"sbreg",       IOV_SBREG,      0, 0,   IOVT_BUFFER,    sizeof(sdreg_t) },
+       {"sd_cis",      IOV_SDCIS,      0, 0,   IOVT_BUFFER,    DHD_IOCTL_MAXLEN },
+       {"forcealign",  IOV_FORCEEVEN,  0, 0,   IOVT_BOOL,      0 },
+       {"txbound",     IOV_TXBOUND,    0, 0,   IOVT_UINT32,    0 },
+       {"rxbound",     IOV_RXBOUND,    0, 0,   IOVT_UINT32,    0 },
+       {"txminmax",    IOV_TXMINMAX,   0, 0,   IOVT_UINT32,    0 },
+       {"cpu",         IOV_CPU,        0, 0,   IOVT_BOOL,      0 },
+#ifdef DHD_DEBUG
+       {"checkdied",   IOV_CHECKDIED,  0, 0,   IOVT_BUFFER,    0 },
+       {"serial",      IOV_SERIALCONS, 0, 0,   IOVT_UINT32,    0 },
+#endif /* DHD_DEBUG  */
+#endif /* DHD_DEBUG */
+#ifdef SDTEST
+       {"extloop",     IOV_EXTLOOP,    0, 0,   IOVT_BOOL,      0 },
+       {"pktgen",      IOV_PKTGEN,     0, 0,   IOVT_BUFFER,    sizeof(dhd_pktgen_t) },
+#endif /* SDTEST */
+#if defined(USE_SDIOFIFO_IOVAR)
+       {"watermark",   IOV_WATERMARK,  0, 0,   IOVT_UINT32,    0 },
+       {"mesbusyctrl", IOV_MESBUSYCTRL,        0, 0,   IOVT_UINT32,    0 },
+#endif /* USE_SDIOFIFO_IOVAR */
+       {"devcap", IOV_DEVCAP,  0, 0,   IOVT_UINT32,    0 },
+       {"dngl_isolation", IOV_DONGLEISOLATION, 0, 0,   IOVT_UINT32,    0 },
+       {"kso", IOV_KSO,        0, 0,   IOVT_UINT32,    0 },
+       {"devsleep", IOV_DEVSLEEP,      0, 0,   IOVT_UINT32,    0 },
+#ifdef SOFTAP
+       {"fwpath", IOV_FWPATH, 0, 0, IOVT_BUFFER, 0 },
+#endif
+       {"txglomsize", IOV_TXGLOMSIZE, 0, 0, IOVT_UINT32, 0 },
+       {"fw_hang_report", IOV_HANGREPORT, 0, 0, IOVT_BOOL, 0 },
+       {"txinrx_thres", IOV_TXINRX_THRES, 0, 0, IOVT_INT32, 0 },
+       {"sdio_suspend", IOV_SDIO_SUSPEND, 0, 0, IOVT_UINT32, 0 },
+#if defined(DEBUGGER) || defined(DHD_DSCOPE)
+       {"gdb_server", IOV_GDB_SERVER,    0, 0,      IOVT_UINT32,    0 },
+#endif /* DEBUGGER || DHD_DSCOPE */
+       {NULL, 0, 0, 0, 0, 0 }
+};
+
+static void
+dhd_dump_pct(struct bcmstrbuf *strbuf, char *desc, uint num, uint div)
+{
+       uint q1, q2;
+
+       if (!div) {
+               bcm_bprintf(strbuf, "%s N/A", desc);
+       } else {
+               q1 = num / div;
+               q2 = (100 * (num - (q1 * div))) / div;
+               bcm_bprintf(strbuf, "%s %d.%02d", desc, q1, q2);
+       }
+}
+
+void
+dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+       dhd_bus_t *bus = dhdp->bus;
+#if defined(DHD_WAKE_STATUS) && defined(DHD_WAKE_EVENT_STATUS)
+       int i;
+#endif
+
+       bcm_bprintf(strbuf, "Bus SDIO structure:\n");
+       bcm_bprintf(strbuf, "hostintmask 0x%08x intstatus 0x%08x sdpcm_ver %d\n",
+                   bus->hostintmask, bus->intstatus, bus->sdpcm_ver);
+       bcm_bprintf(strbuf, "fcstate %d qlen %u tx_seq %d, max %d, rxskip %d rxlen %u rx_seq %d\n",
+                   bus->fcstate, pktq_n_pkts_tot(&bus->txq), bus->tx_seq, bus->tx_max, bus->rxskip,
+                   bus->rxlen, bus->rx_seq);
+       bcm_bprintf(strbuf, "intr %d intrcount %u lastintrs %u spurious %u\n",
+                   bus->intr, bus->intrcount, bus->lastintrs, bus->spurious);
+
+#ifdef DHD_WAKE_STATUS
+       bcm_bprintf(strbuf, "wake %u rxwake %u readctrlwake %u\n",
+               bcmsdh_get_total_wake(bus->sdh), bus->wake_counts.rxwake,
+               bus->wake_counts.rcwake);
+#ifdef DHD_WAKE_RX_STATUS
+       bcm_bprintf(strbuf, " unicast %u multicast %u broadcast %u arp %u\n",
+               bus->wake_counts.rx_ucast, bus->wake_counts.rx_mcast,
+               bus->wake_counts.rx_bcast, bus->wake_counts.rx_arp);
+       bcm_bprintf(strbuf, " multi4 %u multi6 %u icmp6 %u multiother %u\n",
+               bus->wake_counts.rx_multi_ipv4, bus->wake_counts.rx_multi_ipv6,
+               bus->wake_counts.rx_icmpv6, bus->wake_counts.rx_multi_other);
+       bcm_bprintf(strbuf, " icmp6_ra %u, icmp6_na %u, icmp6_ns %u\n",
+               bus->wake_counts.rx_icmpv6_ra, bus->wake_counts.rx_icmpv6_na,
+               bus->wake_counts.rx_icmpv6_ns);
+#endif /* DHD_WAKE_RX_STATUS */
+#ifdef DHD_WAKE_EVENT_STATUS
+       for (i = 0; i < WLC_E_LAST; i++)
+               if (bus->wake_counts.rc_event[i] != 0)
+                       bcm_bprintf(strbuf, " %s = %u\n", bcmevent_get_name(i),
+                               bus->wake_counts.rc_event[i]);
+       bcm_bprintf(strbuf, "\n");
+#endif /* DHD_WAKE_EVENT_STATUS */
+#endif /* DHD_WAKE_STATUS */
+
+       bcm_bprintf(strbuf, "pollrate %u pollcnt %u regfails %u\n",
+                   bus->pollrate, bus->pollcnt, bus->regfails);
+
+       bcm_bprintf(strbuf, "\nAdditional counters:\n");
+#ifdef DHDENABLE_TAILPAD
+       bcm_bprintf(strbuf, "tx_tailpad_chain %u tx_tailpad_pktget %u\n",
+                   bus->tx_tailpad_chain, bus->tx_tailpad_pktget);
+#endif /* DHDENABLE_TAILPAD */
+       bcm_bprintf(strbuf, "tx_sderrs %u fcqueued %u rxrtx %u rx_toolong %u rxc_errors %u\n",
+                   bus->tx_sderrs, bus->fcqueued, bus->rxrtx, bus->rx_toolong,
+                   bus->rxc_errors);
+       bcm_bprintf(strbuf, "rx_hdrfail %u badhdr %u badseq %u\n",
+                   bus->rx_hdrfail, bus->rx_badhdr, bus->rx_badseq);
+       bcm_bprintf(strbuf, "fc_rcvd %u, fc_xoff %u, fc_xon %u\n",
+                   bus->fc_rcvd, bus->fc_xoff, bus->fc_xon);
+       bcm_bprintf(strbuf, "rxglomfail %u, rxglomframes %u, rxglompkts %u\n",
+                   bus->rxglomfail, bus->rxglomframes, bus->rxglompkts);
+       bcm_bprintf(strbuf, "f2rx (hdrs/data) %u (%u/%u), f2tx %u f1regs %u\n",
+                   (bus->f2rxhdrs + bus->f2rxdata), bus->f2rxhdrs, bus->f2rxdata,
+                   bus->f2txdata, bus->f1regdata);
+       {
+               dhd_dump_pct(strbuf, "\nRx: pkts/f2rd", bus->dhd->rx_packets,
+                            (bus->f2rxhdrs + bus->f2rxdata));
+               dhd_dump_pct(strbuf, ", pkts/f1sd", bus->dhd->rx_packets, bus->f1regdata);
+               dhd_dump_pct(strbuf, ", pkts/sd", bus->dhd->rx_packets,
+                            (bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
+               dhd_dump_pct(strbuf, ", pkts/int", bus->dhd->rx_packets, bus->intrcount);
+               bcm_bprintf(strbuf, "\n");
+
+               dhd_dump_pct(strbuf, "Rx: glom pct", (100 * bus->rxglompkts),
+                            bus->dhd->rx_packets);
+               dhd_dump_pct(strbuf, ", pkts/glom", bus->rxglompkts, bus->rxglomframes);
+               bcm_bprintf(strbuf, "\n");
+
+               dhd_dump_pct(strbuf, "Tx: pkts/f2wr", bus->dhd->tx_packets, bus->f2txdata);
+               dhd_dump_pct(strbuf, ", pkts/f1sd", bus->dhd->tx_packets, bus->f1regdata);
+               dhd_dump_pct(strbuf, ", pkts/sd", bus->dhd->tx_packets,
+                            (bus->f2txdata + bus->f1regdata));
+               dhd_dump_pct(strbuf, ", pkts/int", bus->dhd->tx_packets, bus->intrcount);
+               bcm_bprintf(strbuf, "\n");
+
+               dhd_dump_pct(strbuf, "Total: pkts/f2rw",
+                            (bus->dhd->tx_packets + bus->dhd->rx_packets),
+                            (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata));
+               dhd_dump_pct(strbuf, ", pkts/f1sd",
+                            (bus->dhd->tx_packets + bus->dhd->rx_packets), bus->f1regdata);
+               dhd_dump_pct(strbuf, ", pkts/sd",
+                            (bus->dhd->tx_packets + bus->dhd->rx_packets),
+                            (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
+               dhd_dump_pct(strbuf, ", pkts/int",
+                            (bus->dhd->tx_packets + bus->dhd->rx_packets), bus->intrcount);
+               bcm_bprintf(strbuf, "\n\n");
+       }
+
+#ifdef SDTEST
+       /* XXX Add new stats, include pktq len */
+       if (bus->pktgen_count) {
+               bcm_bprintf(strbuf, "pktgen config and count:\n");
+               bcm_bprintf(strbuf, "freq %u count %u print %u total %u min %u len %u\n",
+                           bus->pktgen_freq, bus->pktgen_count, bus->pktgen_print,
+                           bus->pktgen_total, bus->pktgen_minlen, bus->pktgen_maxlen);
+               bcm_bprintf(strbuf, "send attempts %u rcvd %u fail %u\n",
+                           bus->pktgen_sent, bus->pktgen_rcvd, bus->pktgen_fail);
+       }
+#endif /* SDTEST */
+#ifdef DHD_DEBUG
+       bcm_bprintf(strbuf, "dpc_sched %d host interrupt%spending\n",
+                   bus->dpc_sched, (bcmsdh_intr_pending(bus->sdh) ? " " : " not "));
+       bcm_bprintf(strbuf, "blocksize %u roundup %u\n", bus->blocksize, bus->roundup);
+#endif /* DHD_DEBUG */
+       bcm_bprintf(strbuf, "clkstate %d activity %d idletime %d idlecount %d sleeping %d\n",
+                   bus->clkstate, bus->activity, bus->idletime, bus->idlecount, bus->sleeping);
+       dhd_dump_pct(strbuf, "Tx: glom pct", (100 * bus->txglompkts), bus->dhd->tx_packets);
+       dhd_dump_pct(strbuf, ", pkts/glom", bus->txglompkts, bus->txglomframes);
+       bcm_bprintf(strbuf, "\n");
+       bcm_bprintf(strbuf, "txglomframes %u, txglompkts %u\n", bus->txglomframes, bus->txglompkts);
+       bcm_bprintf(strbuf, "\n");
+}
+
+void
+dhd_bus_clearcounts(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = (dhd_bus_t *)dhdp->bus;
+
+       bus->intrcount = bus->lastintrs = bus->spurious = bus->regfails = 0;
+       bus->rxrtx = bus->rx_toolong = bus->rxc_errors = 0;
+       bus->rx_hdrfail = bus->rx_badhdr = bus->rx_badseq = 0;
+#ifdef DHDENABLE_TAILPAD
+       bus->tx_tailpad_chain = bus->tx_tailpad_pktget = 0;
+#endif /* DHDENABLE_TAILPAD */
+       bus->tx_sderrs = bus->fc_rcvd = bus->fc_xoff = bus->fc_xon = 0;
+       bus->rxglomfail = bus->rxglomframes = bus->rxglompkts = 0;
+       bus->f2rxhdrs = bus->f2rxdata = bus->f2txdata = bus->f1regdata = 0;
+       bus->txglomframes = bus->txglompkts = 0;
+}
+
+#ifdef SDTEST
+static int
+dhdsdio_pktgen_get(dhd_bus_t *bus, uint8 *arg)
+{
+       dhd_pktgen_t pktgen;
+
+       pktgen.version = DHD_PKTGEN_VERSION;
+       pktgen.freq = bus->pktgen_freq;
+       pktgen.count = bus->pktgen_count;
+       pktgen.print = bus->pktgen_print;
+       pktgen.total = bus->pktgen_total;
+       pktgen.minlen = bus->pktgen_minlen;
+       pktgen.maxlen = bus->pktgen_maxlen;
+       pktgen.numsent = bus->pktgen_sent;
+       pktgen.numrcvd = bus->pktgen_rcvd;
+       pktgen.numfail = bus->pktgen_fail;
+       pktgen.mode = bus->pktgen_mode;
+       pktgen.stop = bus->pktgen_stop;
+
+       bcopy(&pktgen, arg, sizeof(pktgen));
+
+       return 0;
+}
+
+static int
+dhdsdio_pktgen_set(dhd_bus_t *bus, uint8 *arg)
+{
+       dhd_pktgen_t pktgen;
+       uint oldcnt, oldmode;
+
+       bcopy(arg, &pktgen, sizeof(pktgen));
+       if (pktgen.version != DHD_PKTGEN_VERSION)
+               return BCME_BADARG;
+
+       oldcnt = bus->pktgen_count;
+       oldmode = bus->pktgen_mode;
+
+       bus->pktgen_freq = pktgen.freq;
+       bus->pktgen_count = pktgen.count;
+       bus->pktgen_print = pktgen.print;
+       bus->pktgen_total = pktgen.total;
+       bus->pktgen_minlen = pktgen.minlen;
+       bus->pktgen_maxlen = pktgen.maxlen;
+       bus->pktgen_mode = pktgen.mode;
+       bus->pktgen_stop = pktgen.stop;
+
+       bus->pktgen_tick = bus->pktgen_ptick = 0;
+       bus->pktgen_prev_time = jiffies;
+       bus->pktgen_len = MAX(bus->pktgen_len, bus->pktgen_minlen);
+       bus->pktgen_len = MIN(bus->pktgen_len, bus->pktgen_maxlen);
+
+       /* Clear counts for a new pktgen (mode change, or was stopped) */
+       if (bus->pktgen_count && (!oldcnt || oldmode != bus->pktgen_mode)) {
+               bus->pktgen_sent = bus->pktgen_prev_sent = bus->pktgen_rcvd = 0;
+               bus->pktgen_prev_rcvd = bus->pktgen_fail = 0;
+       }
+
+       return 0;
+}
+#endif /* SDTEST */
+
+static int
+dhdsdio_membytes(dhd_bus_t *bus, bool write, uint32 address, uint8 *data, uint size)
+{
+       int bcmerror = 0;
+       uint32 sdaddr;
+       uint dsize;
+       uint8 *pdata;
+
+       /* In remap mode, adjust address beyond socram and redirect
+        * to devram at SOCDEVRAM_BP_ADDR since remap address > orig_ramsize
+        * is not backplane accessible
+        */
+       if (REMAP_ENAB(bus) && REMAP_ISADDR(bus, address)) {
+               address -= bus->orig_ramsize;
+               address += SOCDEVRAM_BP_ADDR;
+       }
+
+       /* Determine initial transfer parameters */
+       sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
+       if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
+               dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
+       else
+               dsize = size;
+
+       /* Set the backplane window to include the start address */
+       if ((bcmerror = dhdsdio_set_siaddr_window(bus, address))) {
+               DHD_ERROR(("%s: window change failed\n", __FUNCTION__));
+               goto xfer_done;
+       }
+
+       /* Do the transfer(s) */
+       while (size) {
+               DHD_INFO(("%s: %s %d bytes at offset 0x%08x in window 0x%08x\n",
+                         __FUNCTION__, (write ? "write" : "read"), dsize, sdaddr,
+                         (address & SBSDIO_SBWINDOW_MASK)));
+               if (dsize <= MAX_MEM_BUF) {
+                       pdata = bus->membuf;
+                       if (write)
+                               memcpy(bus->membuf, data, dsize);
+               } else {
+                       pdata = data;
+               }
+               if ((bcmerror = bcmsdh_rwdata(bus->sdh, write, sdaddr, pdata, dsize))) {
+                       DHD_ERROR(("%s: membytes transfer failed\n", __FUNCTION__));
+                       break;
+               }
+               if (dsize <= MAX_MEM_BUF && !write)
+                       memcpy(data, bus->membuf, dsize);
+
+               /* Adjust for next transfer (if any) */
+               if ((size -= dsize)) {
+                       data += dsize;
+                       address += dsize;
+                       if ((bcmerror = dhdsdio_set_siaddr_window(bus, address))) {
+                               DHD_ERROR(("%s: window change failed\n", __FUNCTION__));
+                               break;
+                       }
+                       sdaddr = 0;
+                       dsize = MIN(SBSDIO_SB_OFT_ADDR_LIMIT, size);
+               }
+
+       }
+
+xfer_done:
+       /* Return the window to backplane enumeration space for core access */
+       if (dhdsdio_set_siaddr_window(bus, bcmsdh_cur_sbwad(bus->sdh))) {
+               DHD_ERROR(("%s: FAILED to set window back to 0x%x\n", __FUNCTION__,
+                       bcmsdh_cur_sbwad(bus->sdh)));
+       }
+
+       return bcmerror;
+}
+
+static int
+dhdsdio_readshared(dhd_bus_t *bus, sdpcm_shared_t *sh)
+{
+       uint32 addr;
+       int rv, i;
+       uint32 shaddr = 0;
+
+       if (bus->sih == NULL) {
+               if (bus->dhd && bus->dhd->dongle_reset) {
+                       DHD_ERROR(("%s: Dongle is in reset state\n", __FUNCTION__));
+                       return BCME_NOTREADY;
+               } else {
+                       ASSERT(bus->dhd);
+                       ASSERT(bus->sih);
+                       DHD_ERROR(("%s: The address of sih is invalid\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+       }
+       /*
+        * If SR is not implemented in 43430 FW we should not adjust shaddr
+        * XXX Should be REMOVED after SR will be implemented in 43430 FW
+        */
+       if ((CHIPID(bus->sih->chip) == BCM43430_CHIP_ID ||
+               CHIPID(bus->sih->chip) == BCM43018_CHIP_ID) && !dhdsdio_sr_cap(bus))
+               bus->srmemsize = 0;
+
+       shaddr = bus->dongle_ram_base + bus->ramsize - 4;
+       i = 0;
+       do {
+               /* Read last word in memory to determine address of sdpcm_shared structure */
+               if ((rv = dhdsdio_membytes(bus, FALSE, shaddr, (uint8 *)&addr, 4)) < 0)
+                       return rv;
+
+               addr = ltoh32(addr);
+
+               DHD_INFO(("sdpcm_shared address 0x%08X\n", addr));
+
+               /*
+                * Check if addr is valid.
+                * NVRAM length at the end of memory should have been overwritten.
+                */
+               if (addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff)) {
+                       if ((bus->srmemsize > 0) && (i++ == 0)) {
+                               shaddr -= bus->srmemsize;
+                       } else {
+                               DHD_ERROR(("%s: address (0x%08x) of sdpcm_shared invalid\n",
+                                       __FUNCTION__, addr));
+                               return BCME_ERROR;
+                       }
+               } else
+                       break;
+       } while (i < 2);
+
+       /* Read hndrte_shared structure */
+       if ((rv = dhdsdio_membytes(bus, FALSE, addr, (uint8 *)sh, sizeof(sdpcm_shared_t))) < 0)
+               return rv;
+
+       /* Endianness */
+       sh->flags = ltoh32(sh->flags);
+       sh->trap_addr = ltoh32(sh->trap_addr);
+       sh->assert_exp_addr = ltoh32(sh->assert_exp_addr);
+       sh->assert_file_addr = ltoh32(sh->assert_file_addr);
+       sh->assert_line = ltoh32(sh->assert_line);
+       sh->console_addr = ltoh32(sh->console_addr);
+       sh->msgtrace_addr = ltoh32(sh->msgtrace_addr);
+
+#ifdef BCMSDIO_RXLIM_POST
+       if (sh->flags & SDPCM_SHARED_RXLIM_POST) {
+               if (bus->dhd->conf->rxlim_en)
+                       bus->rxlim_en = !!sh->msgtrace_addr;
+               bus->rxlim_addr = sh->msgtrace_addr;
+               DHD_INFO(("%s: rxlim_en=%d, rxlim enable=%d, rxlim_addr=%d\n",
+                       __FUNCTION__,
+                       bus->dhd->conf->rxlim_en, bus->rxlim_en, bus->rxlim_addr));
+               sh->flags &= ~SDPCM_SHARED_RXLIM_POST;
+       } else {
+               bus->rxlim_en = 0;
+               DHD_INFO(("%s: FW has no rx limit post support\n", __FUNCTION__));
+       }
+#endif /* BCMSDIO_RXLIM_POST */
+
+       /*
+        * XXX - Allow a sdpcm_shared_t version mismatch between dhd structure
+        * version 1 and firmware structure version 3.
+        * The sdpcm_shared_t stucture fields used in this function are in the
+        * same positions in these two structure versions.
+        * For some chips in the FALCON release, the dhd driver is from the
+        * FALCON branch (sdpcm_shared_t structure version 1) and the firmware
+        * comes from the ROMTERM3 branch (sdpcm_shared_t structure version 1).
+       */
+       if ((sh->flags & SDPCM_SHARED_VERSION_MASK) == 3 && SDPCM_SHARED_VERSION == 1)
+               return BCME_OK;
+
+       if ((sh->flags & SDPCM_SHARED_VERSION_MASK) != SDPCM_SHARED_VERSION) {
+               DHD_ERROR(("%s: sdpcm_shared version %d in dhd "
+                          "is different than sdpcm_shared version %d in dongle\n",
+                          __FUNCTION__, SDPCM_SHARED_VERSION,
+                          sh->flags & SDPCM_SHARED_VERSION_MASK));
+               return BCME_ERROR;
+       }
+
+       return BCME_OK;
+}
+
+#define CONSOLE_LINE_MAX       192
+
+#ifdef DHD_DEBUG
+static int
+dhdsdio_readconsole(dhd_bus_t *bus)
+{
+       dhd_console_t *c = &bus->console;
+       uint8 line[CONSOLE_LINE_MAX], ch;
+       uint32 n, idx, addr;
+       int rv;
+
+       /* Don't do anything until FWREADY updates console address */
+       if (bus->console_addr == 0)
+               return 0;
+
+       if (!KSO_ENAB(bus))
+               return 0;
+
+       /* Read console log struct */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, log);
+       if ((rv = dhdsdio_membytes(bus, FALSE, addr, (uint8 *)&c->log, sizeof(c->log))) < 0)
+               return rv;
+
+       /* Allocate console buffer (one time only) */
+       if (c->buf == NULL) {
+               c->bufsize = ltoh32(c->log.buf_size);
+               if ((c->buf = MALLOC(bus->dhd->osh, c->bufsize)) == NULL)
+                       return BCME_NOMEM;
+       }
+
+       idx = ltoh32(c->log.idx);
+
+       /* Protect against corrupt value */
+       if (idx > c->bufsize)
+               return BCME_ERROR;
+
+       /* Skip reading the console buffer if the index pointer has not moved */
+       if (idx == c->last)
+               return BCME_OK;
+
+       /* Read the console buffer */
+       /* xxx this could optimize and read only the portion of the buffer needed, but
+        * it would also have to handle wrap-around.
+        */
+       addr = ltoh32(c->log.buf);
+       if ((rv = dhdsdio_membytes(bus, FALSE, addr, c->buf, c->bufsize)) < 0)
+               return rv;
+
+       while (c->last != idx) {
+               for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
+                       if (c->last == idx) {
+                               /* This would output a partial line.  Instead, back up
+                                * the buffer pointer and output this line next time around.
+                                */
+                               if (c->last >= n)
+                                       c->last -= n;
+                               else
+                                       c->last = c->bufsize - n;
+                               goto break2;
+                       }
+                       ch = c->buf[c->last];
+                       c->last = (c->last + 1) % c->bufsize;
+                       if (ch == '\n')
+                               break;
+                       line[n] = ch;
+               }
+
+               if (n > 0) {
+                       if (line[n - 1] == '\r')
+                               n--;
+                       line[n] = 0;
+                       printf("CONSOLE: %s\n", line);
+#ifdef LOG_INTO_TCPDUMP
+                       dhd_sendup_log(bus->dhd, line, n);
+#endif /* LOG_INTO_TCPDUMP */
+               }
+       }
+break2:
+
+       return BCME_OK;
+}
+#endif /* DHD_DEBUG */
+
+static int
+dhdsdio_checkdied(dhd_bus_t *bus, char *data, uint size)
+{
+       int bcmerror = 0;
+       uint msize = 512;
+       char *mbuffer = NULL;
+       char *console_buffer = NULL;
+       uint maxstrlen = 256;
+       char *str = NULL;
+       sdpcm_shared_t l_sdpcm_shared;
+       struct bcmstrbuf strbuf;
+       uint32 console_ptr, console_size, console_index;
+       uint8 line[CONSOLE_LINE_MAX], ch;
+       uint32 n, i, addr;
+       int rv;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (DHD_NOCHECKDIED_ON())
+               return 0;
+
+       if (data == NULL) {
+               /*
+                * Called after a rx ctrl timeout. "data" is NULL.
+                * allocate memory to trace the trap or assert.
+                */
+               size = msize;
+               mbuffer = data = MALLOC(bus->dhd->osh, msize);
+               if (mbuffer == NULL) {
+                       DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, msize));
+                       bcmerror = BCME_NOMEM;
+                       goto done;
+               }
+       }
+
+       if ((str = MALLOC(bus->dhd->osh, maxstrlen)) == NULL) {
+               DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, maxstrlen));
+               bcmerror = BCME_NOMEM;
+               goto done;
+       }
+
+       if ((bcmerror = dhdsdio_readshared(bus, &l_sdpcm_shared)) < 0)
+               goto done;
+
+       bcm_binit(&strbuf, data, size);
+
+       bcm_bprintf(&strbuf, "msgtrace address : 0x%08X\nconsole address  : 0x%08X\n",
+                   l_sdpcm_shared.msgtrace_addr, l_sdpcm_shared.console_addr);
+
+       if ((l_sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
+               /* NOTE: Misspelled assert is intentional - DO NOT FIX.
+                * (Avoids conflict with real asserts for programmatic parsing of output.)
+                */
+               bcm_bprintf(&strbuf, "Assrt not built in dongle\n");
+       }
+
+       if ((l_sdpcm_shared.flags & (SDPCM_SHARED_ASSERT|SDPCM_SHARED_TRAP)) == 0) {
+               /* NOTE: Misspelled assert is intentional - DO NOT FIX.
+                * (Avoids conflict with real asserts for programmatic parsing of output.)
+                */
+               bcm_bprintf(&strbuf, "No trap%s in dongle",
+                         (l_sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT)
+                         ?"/assrt" :"");
+       } else {
+               if (l_sdpcm_shared.flags & SDPCM_SHARED_ASSERT) {
+                       /* Download assert */
+                       bcm_bprintf(&strbuf, "Dongle assert");
+                       if (l_sdpcm_shared.assert_exp_addr != 0) {
+                               str[0] = '\0';
+                               if ((bcmerror = dhdsdio_membytes(bus, FALSE,
+                                                                l_sdpcm_shared.assert_exp_addr,
+                                                                (uint8 *)str, maxstrlen)) < 0)
+                                       goto done;
+
+                               str[maxstrlen - 1] = '\0';
+                               bcm_bprintf(&strbuf, " expr \"%s\"", str);
+                       }
+
+                       if (l_sdpcm_shared.assert_file_addr != 0) {
+                               str[0] = '\0';
+                               if ((bcmerror = dhdsdio_membytes(bus, FALSE,
+                                                  l_sdpcm_shared.assert_file_addr,
+                                                                (uint8 *)str, maxstrlen)) < 0)
+                                       goto done;
+
+                               str[maxstrlen - 1] = '\0';
+                               bcm_bprintf(&strbuf, " file \"%s\"", str);
+                       }
+
+                       bcm_bprintf(&strbuf, " line %d ", l_sdpcm_shared.assert_line);
+               }
+
+               if (l_sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
+                       trap_t *tr = &bus->dhd->last_trap_info;
+                       bus->dhd->dongle_trap_occured = TRUE;
+                       if ((bcmerror = dhdsdio_membytes(bus, FALSE,
+                                                        l_sdpcm_shared.trap_addr,
+                                                        (uint8*)tr, sizeof(trap_t))) < 0)
+                               goto done;
+
+                       bus->dongle_trap_addr = ltoh32(l_sdpcm_shared.trap_addr);
+
+                       dhd_bus_dump_trap_info(bus, &strbuf);
+
+                       addr = l_sdpcm_shared.console_addr + OFFSETOF(hnd_cons_t, log);
+                       if ((rv = dhdsdio_membytes(bus, FALSE, addr,
+                               (uint8 *)&console_ptr, sizeof(console_ptr))) < 0)
+                               goto printbuf;
+
+                       addr = l_sdpcm_shared.console_addr + OFFSETOF(hnd_cons_t, log.buf_size);
+                       if ((rv = dhdsdio_membytes(bus, FALSE, addr,
+                               (uint8 *)&console_size, sizeof(console_size))) < 0)
+                               goto printbuf;
+
+                       addr = l_sdpcm_shared.console_addr + OFFSETOF(hnd_cons_t, log.idx);
+                       if ((rv = dhdsdio_membytes(bus, FALSE, addr,
+                               (uint8 *)&console_index, sizeof(console_index))) < 0)
+                               goto printbuf;
+
+                       console_ptr = ltoh32(console_ptr);
+                       console_size = ltoh32(console_size);
+                       console_index = ltoh32(console_index);
+
+                       if (console_size > CONSOLE_BUFFER_MAX ||
+                               !(console_buffer = MALLOC(bus->dhd->osh, console_size)))
+                               goto printbuf;
+
+                       if ((rv = dhdsdio_membytes(bus, FALSE, console_ptr,
+                               (uint8 *)console_buffer, console_size)) < 0)
+                               goto printbuf;
+
+                       for (i = 0, n = 0; i < console_size; i += n + 1) {
+                               for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
+                                       ch = console_buffer[(console_index + i + n) % console_size];
+                                       if (ch == '\n')
+                                               break;
+                                       line[n] = ch;
+                               }
+
+                               if (n > 0) {
+                                       if (line[n - 1] == '\r')
+                                               n--;
+                                       line[n] = 0;
+                                       /* Don't use DHD_ERROR macro since we print
+                                        * a lot of information quickly. The macro
+                                        * will truncate a lot of the printfs
+                                        */
+
+                                       if (dhd_msg_level & DHD_ERROR_VAL)
+                                               printf("CONSOLE: %s\n", line);
+                               }
+                       }
+               }
+       }
+
+printbuf:
+       if (l_sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP)) {
+               DHD_ERROR(("%s: %s\n", __FUNCTION__, strbuf.origbuf));
+       }
+
+#if defined(DHD_FW_COREDUMP)
+       if (bus->dhd->memdump_enabled && (l_sdpcm_shared.flags & SDPCM_SHARED_TRAP)) {
+               /* Mem dump to a file on device */
+               bus->dhd->memdump_type = DUMP_TYPE_DONGLE_TRAP;
+               /* xxx this sdunlock has been put as a WAR here. We tried to come up
+                 * with a better solution but with the current structure of sdlocks it is very
+                 * unlikely to have a better fix for now. The better Rearch of sdio bus
+                 * locking has been put up as a cleanup activity and a thorough
+                 * code walkthrough is needed.
+                 */
+               dhd_os_sdunlock(bus->dhd);
+               dhdsdio_mem_dump(bus);
+               dhd_os_sdlock(bus->dhd);
+       }
+#endif /* #if defined(DHD_FW_COREDUMP) */
+
+done:
+       if (mbuffer)
+               MFREE(bus->dhd->osh, mbuffer, msize);
+       if (str)
+               MFREE(bus->dhd->osh, str, maxstrlen);
+       if (console_buffer)
+               MFREE(bus->dhd->osh, console_buffer, console_size);
+
+       return bcmerror;
+}
+
+#if defined(DHD_FW_COREDUMP)
+int
+dhd_bus_mem_dump(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       if (dhdp->busstate == DHD_BUS_SUSPEND) {
+               DHD_ERROR(("%s: Bus is suspend so skip\n", __FUNCTION__));
+               return 0;
+       }
+       return dhdsdio_mem_dump(bus);
+}
+
+int
+dhd_bus_get_mem_dump(dhd_pub_t *dhdp)
+{
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       return dhdsdio_get_mem_dump(dhdp->bus);
+}
+
+static int
+dhdsdio_get_mem_dump(dhd_bus_t *bus)
+{
+       int ret = BCME_ERROR;
+       int size = bus->ramsize;                /* Full mem size */
+       uint32 start = bus->dongle_ram_base;    /* Start address */
+       uint read_size = 0;                     /* Read size of each iteration */
+       uint8 *p_buf = NULL, *databuf = NULL;
+
+       /* Get full mem size */
+       p_buf = dhd_get_fwdump_buf(bus->dhd, size);
+       if (!p_buf) {
+               DHD_ERROR(("%s: Out of memory (%d bytes)\n",
+                       __FUNCTION__, size));
+               return BCME_ERROR;
+       }
+
+       dhd_os_sdlock(bus->dhd);
+       BUS_WAKE(bus);
+       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+       /* Read mem content */
+       DHD_ERROR(("Dump dongle memory\n"));
+       databuf = p_buf;
+       while (size) {
+               read_size = MIN(MEMBLOCK, size);
+               ret = dhdsdio_membytes(bus, FALSE, start, databuf, read_size);
+               if (ret) {
+                       DHD_ERROR(("%s: Error membytes %d\n", __FUNCTION__, ret));
+                       ret = BCME_ERROR;
+                       break;
+               }
+               /* Decrement size and increment start address */
+               size -= read_size;
+               start += read_size;
+               databuf += read_size;
+       }
+
+       if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched &&
+               NO_OTHER_ACTIVE_BUS_USER(bus)) {
+               bus->activity = FALSE;
+               dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+       }
+
+       dhd_os_sdunlock(bus->dhd);
+
+       return ret;
+}
+
+static int
+dhdsdio_mem_dump(dhd_bus_t *bus)
+{
+       dhd_pub_t *dhdp;
+       int ret = BCME_ERROR;
+
+       dhdp = bus->dhd;
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return ret;
+       }
+
+       ret = dhdsdio_get_mem_dump(bus);
+       if (ret) {
+               DHD_ERROR(("%s: failed to get mem dump, err=%d\n",
+                       __FUNCTION__, ret));
+       } else {
+               /* schedule a work queue to perform actual memdump.
+                * dhd_mem_dump() performs the job
+                */
+               dhd_schedule_memdump(dhdp, dhdp->soc_ram, dhdp->soc_ram_length);
+               /* soc_ram free handled in dhd_{free,clear} */
+       }
+
+       return ret;
+}
+#endif /* DHD_FW_COREDUMP */
+
+int
+dhd_socram_dump(dhd_bus_t * bus)
+{
+#if defined(DHD_FW_COREDUMP)
+       return (dhdsdio_mem_dump(bus));
+#else
+       return -1;
+#endif
+}
+
+int
+dhdsdio_downloadvars(dhd_bus_t *bus, void *arg, int len)
+{
+       int bcmerror = BCME_OK;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus->dhd->up &&
+               1) {
+               bcmerror = BCME_NOTDOWN;
+               goto err;
+       }
+       if (!len) {
+               bcmerror = BCME_BUFTOOSHORT;
+               goto err;
+       }
+
+       /* Free the old ones and replace with passed variables */
+       if (bus->vars)
+               MFREE(bus->dhd->osh, bus->vars, bus->varsz);
+
+       bus->vars = MALLOC(bus->dhd->osh, len);
+       bus->varsz = bus->vars ? len : 0;
+       if (bus->vars == NULL) {
+               bcmerror = BCME_NOMEM;
+               goto err;
+       }
+
+       /* Copy the passed variables, which should include the terminating double-null */
+       bcopy(arg, bus->vars, bus->varsz);
+err:
+       return bcmerror;
+}
+
+#ifdef DHD_DEBUG
+static int
+dhd_serialconsole(dhd_bus_t *bus, bool set, bool enable, int *bcmerror)
+{
+       int int_val;
+       uint32 addr, data, uart_enab = 0;
+
+       addr = SI_ENUM_BASE(bus->sih) + OFFSETOF(chipcregs_t, chipcontrol_addr);
+       data = SI_ENUM_BASE(bus->sih) + OFFSETOF(chipcregs_t, chipcontrol_data);
+       *bcmerror = 0;
+
+       bcmsdh_reg_write(bus->sdh, addr, 4, 1);
+       if (bcmsdh_regfail(bus->sdh)) {
+               *bcmerror = BCME_SDIO_ERROR;
+               return -1;
+       }
+       int_val = bcmsdh_reg_read(bus->sdh, data, 4);
+       if (bcmsdh_regfail(bus->sdh)) {
+               *bcmerror = BCME_SDIO_ERROR;
+               return -1;
+       }
+
+       if (!set)
+               return (int_val & uart_enab);
+       if (enable)
+               int_val |= uart_enab;
+       else
+               int_val &= ~uart_enab;
+       bcmsdh_reg_write(bus->sdh, data, 4, int_val);
+       if (bcmsdh_regfail(bus->sdh)) {
+               *bcmerror = BCME_SDIO_ERROR;
+               return -1;
+       }
+
+       return (int_val & uart_enab);
+}
+#endif
+
+static int
+dhdsdio_doiovar(dhd_bus_t *bus, const bcm_iovar_t *vi, uint32 actionid, const char *name,
+                void *params, uint plen, void *arg, uint len, uint val_size)
+{
+       int bcmerror = 0;
+       int32 int_val = 0;
+       bool bool_val = 0;
+
+       DHD_TRACE(("%s: Enter, action %d name %s params %p plen %d arg %p len %d val_size %d\n",
+                  __FUNCTION__, actionid, name, params, plen, arg, len, val_size));
+
+       if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid))) != 0)
+               goto exit;
+
+       if (plen >= sizeof(int_val))
+               bcopy(params, &int_val, sizeof(int_val));
+
+       bool_val = (int_val != 0) ? TRUE : FALSE;
+
+       /* Some ioctls use the bus */
+       dhd_os_sdlock(bus->dhd);
+
+       /* Check if dongle is in reset. If so, only allow DEVRESET iovars */
+       if (bus->dhd->dongle_reset && !(actionid == IOV_SVAL(IOV_DEVRESET) ||
+                                       actionid == IOV_GVAL(IOV_DEVRESET))) {
+               bcmerror = BCME_NOTREADY;
+               goto exit;
+       }
+
+       /*
+        * Special handling for keepSdioOn: New SDIO Wake-up Mechanism
+        */
+       if ((vi->varid == IOV_KSO) && (IOV_ISSET(actionid))) {
+               dhdsdio_clk_kso_iovar(bus, bool_val);
+               goto exit;
+       } else if ((vi->varid == IOV_DEVSLEEP) && (IOV_ISSET(actionid))) {
+               {
+                       dhdsdio_clk_devsleep_iovar(bus, bool_val);
+                       if (!SLPAUTO_ENAB(bus) && (bool_val == FALSE) && (bus->ipend)) {
+                               DHD_ERROR(("INT pending in devsleep 1, dpc_sched: %d\n",
+                                       bus->dpc_sched));
+                               if (!bus->dpc_sched) {
+                                       bus->dpc_sched = TRUE;
+                                       dhd_sched_dpc(bus->dhd);
+                               }
+                       }
+               }
+               goto exit;
+       }
+
+       /* Handle sleep stuff before any clock mucking */
+       if (vi->varid == IOV_SLEEP) {
+               if (IOV_ISSET(actionid)) {
+                       bcmerror = dhdsdio_bussleep(bus, bool_val);
+               } else {
+                       int_val = (int32)bus->sleeping;
+                       bcopy(&int_val, arg, val_size);
+               }
+               goto exit;
+       }
+
+       /* Request clock to allow SDIO accesses */
+       if (!bus->dhd->dongle_reset) {
+               BUS_WAKE(bus);
+               dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+       }
+
+       switch (actionid) {
+       case IOV_GVAL(IOV_INTR):
+               int_val = (int32)bus->intr;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_INTR):
+               bus->intr = bool_val;
+               bus->intdis = FALSE;
+               if (bus->dhd->up) {
+                       if (bus->intr) {
+                               DHD_INTR(("%s: enable SDIO device interrupts\n", __FUNCTION__));
+                               // terence 20141207: enbale intdis
+                               bus->intdis = TRUE;
+                               bcmsdh_intr_enable(bus->sdh);
+                       } else {
+                               DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+                               bcmsdh_intr_disable(bus->sdh);
+                       }
+               }
+               break;
+
+       case IOV_GVAL(IOV_POLLRATE):
+               int_val = (int32)bus->pollrate;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_POLLRATE):
+               bus->pollrate = (uint)int_val;
+               bus->poll = (bus->pollrate != 0);
+               break;
+
+       case IOV_GVAL(IOV_IDLETIME):
+               int_val = bus->idletime;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_IDLETIME):
+               if ((int_val < 0) && (int_val != DHD_IDLE_IMMEDIATE)) {
+                       bcmerror = BCME_BADARG;
+               } else {
+                       bus->idletime = int_val;
+               }
+               break;
+
+       case IOV_GVAL(IOV_IDLECLOCK):
+               int_val = (int32)bus->idleclock;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_IDLECLOCK):
+               bus->idleclock = int_val;
+               break;
+
+       case IOV_GVAL(IOV_SD1IDLE):
+               int_val = (int32)sd1idle;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_SD1IDLE):
+               sd1idle = bool_val;
+               break;
+
+#ifdef DHD_DEBUG
+       case IOV_GVAL(IOV_CHECKDIED):
+               bcmerror = dhdsdio_checkdied(bus, arg, len);
+               break;
+#endif /* DHD_DEBUG */
+
+       case IOV_GVAL(IOV_RAMSIZE):
+               int_val = (int32)bus->ramsize;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_RAMSTART):
+               int_val = (int32)bus->dongle_ram_base;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_SDIOD_DRIVE):
+               int_val = (int32)dhd_sdiod_drive_strength;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_SDIOD_DRIVE):
+               dhd_sdiod_drive_strength = int_val;
+               si_sdiod_drive_strength_init(bus->sih, bus->dhd->osh, dhd_sdiod_drive_strength);
+               break;
+
+       case IOV_SVAL(IOV_SET_DOWNLOAD_STATE):
+               bcmerror = dhdsdio_download_state(bus, bool_val);
+               break;
+
+       case IOV_SVAL(IOV_SOCRAM_STATE):
+               bcmerror = dhdsdio_download_state(bus, bool_val);
+               break;
+
+       case IOV_SVAL(IOV_VARS):
+               bcmerror = dhdsdio_downloadvars(bus, arg, len);
+               break;
+
+       case IOV_GVAL(IOV_READAHEAD):
+               int_val = (int32)dhd_readahead;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_READAHEAD):
+               if (bool_val && !dhd_readahead)
+                       bus->nextlen = 0;
+               dhd_readahead = bool_val;
+               break;
+
+       case IOV_GVAL(IOV_SDRXCHAIN):
+               int_val = (int32)bus->use_rxchain;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_SDRXCHAIN):
+               if (bool_val && !bus->sd_rxchain)
+                       bcmerror = BCME_UNSUPPORTED;
+               else
+                       bus->use_rxchain = bool_val;
+               break;
+#ifndef BCMSPI
+       case IOV_GVAL(IOV_ALIGNCTL):
+               int_val = (int32)dhd_alignctl;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_ALIGNCTL):
+               dhd_alignctl = bool_val;
+               break;
+#endif /* BCMSPI */
+
+       case IOV_GVAL(IOV_SDALIGN):
+               int_val = DHD_SDALIGN;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+#ifdef DHD_DEBUG
+       case IOV_GVAL(IOV_VARS):
+               if (bus->varsz < (uint)len)
+                       bcopy(bus->vars, arg, bus->varsz);
+               else
+                       bcmerror = BCME_BUFTOOSHORT;
+               break;
+#endif /* DHD_DEBUG */
+
+#ifdef DHD_DEBUG
+       /* XXX Until these return BCME ranges, make assumptions here */
+       case IOV_GVAL(IOV_SDREG):
+       {
+               sdreg_t *sd_ptr;
+               uintptr addr;
+               uint size;
+
+               sd_ptr = (sdreg_t *)params;
+
+               addr = ((uintptr)bus->regs + sd_ptr->offset);
+               size = sd_ptr->func;
+               int_val = (int32)bcmsdh_reg_read(bus->sdh, addr, size);
+               if (bcmsdh_regfail(bus->sdh))
+                       bcmerror = BCME_SDIO_ERROR;
+               bcopy(&int_val, arg, sizeof(int32));
+               break;
+       }
+
+       case IOV_SVAL(IOV_SDREG):
+       {
+               sdreg_t *sd_ptr;
+               uintptr addr;
+               uint size;
+
+               sd_ptr = (sdreg_t *)params;
+
+               addr = ((uintptr)bus->regs + sd_ptr->offset);
+               size = sd_ptr->func;
+               bcmsdh_reg_write(bus->sdh, addr, size, sd_ptr->value);
+               if (bcmsdh_regfail(bus->sdh))
+                       bcmerror = BCME_SDIO_ERROR;
+               break;
+       }
+
+       /* XXX Same as above */
+       /* Same as above, but offset is not backplane (not SDIO core) */
+       case IOV_GVAL(IOV_SBREG):
+       {
+               sdreg_t sdreg;
+               uint32 addr, size;
+
+               bcopy(params, &sdreg, sizeof(sdreg));
+
+               addr = SI_ENUM_BASE(bus->sih) + sdreg.offset;
+               size = sdreg.func;
+               int_val = (int32)bcmsdh_reg_read(bus->sdh, addr, size);
+               if (bcmsdh_regfail(bus->sdh))
+                       bcmerror = BCME_SDIO_ERROR;
+               bcopy(&int_val, arg, sizeof(int32));
+               break;
+       }
+
+       case IOV_SVAL(IOV_SBREG):
+       {
+               sdreg_t sdreg;
+               uint32 addr, size;
+
+               bcopy(params, &sdreg, sizeof(sdreg));
+
+               addr = SI_ENUM_BASE(bus->sih) + sdreg.offset;
+               size = sdreg.func;
+               bcmsdh_reg_write(bus->sdh, addr, size, sdreg.value);
+               if (bcmsdh_regfail(bus->sdh))
+                       bcmerror = BCME_SDIO_ERROR;
+               break;
+       }
+
+       case IOV_GVAL(IOV_SDCIS):
+       {
+               *(char *)arg = 0;
+
+               /* XXX Ignoring return codes, should be evident from printed results */
+               bcmstrcat(arg, "\nFunc 0\n");
+               bcmsdh_cis_read(bus->sdh, 0x10, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
+               bcmstrcat(arg, "\nFunc 1\n");
+               bcmsdh_cis_read(bus->sdh, 0x11, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
+               bcmstrcat(arg, "\nFunc 2\n");
+               bcmsdh_cis_read(bus->sdh, 0x12, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
+               break;
+       }
+
+       case IOV_GVAL(IOV_FORCEEVEN):
+               int_val = (int32)forcealign;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_FORCEEVEN):
+               forcealign = bool_val;
+               break;
+
+       case IOV_GVAL(IOV_TXBOUND):
+               int_val = (int32)dhd_txbound;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_TXBOUND):
+               dhd_txbound = (uint)int_val;
+               break;
+
+       case IOV_GVAL(IOV_RXBOUND):
+               int_val = (int32)dhd_rxbound;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_RXBOUND):
+               dhd_rxbound = (uint)int_val;
+               break;
+
+       case IOV_GVAL(IOV_TXMINMAX):
+               int_val = (int32)dhd_txminmax;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_TXMINMAX):
+               dhd_txminmax = (uint)int_val;
+               break;
+
+#ifdef DHD_DEBUG
+       case IOV_GVAL(IOV_SERIALCONS):
+               int_val = dhd_serialconsole(bus, FALSE, 0, &bcmerror);
+               if (bcmerror != 0)
+                       break;
+
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_SERIALCONS):
+               dhd_serialconsole(bus, TRUE, bool_val, &bcmerror);
+               break;
+#endif /* DHD_DEBUG */
+
+#endif /* DHD_DEBUG */
+
+#ifdef SDTEST
+       case IOV_GVAL(IOV_EXTLOOP):
+               int_val = (int32)bus->ext_loop;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_EXTLOOP):
+               bus->ext_loop = bool_val;
+               break;
+
+       case IOV_GVAL(IOV_PKTGEN):
+               bcmerror = dhdsdio_pktgen_get(bus, arg);
+               break;
+
+       case IOV_SVAL(IOV_PKTGEN):
+               bcmerror = dhdsdio_pktgen_set(bus, arg);
+               break;
+#endif /* SDTEST */
+
+#if defined(USE_SDIOFIFO_IOVAR)
+       case IOV_GVAL(IOV_WATERMARK):
+               int_val = (int32)watermark;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_WATERMARK):
+               watermark = (uint)int_val;
+               watermark = (watermark > SBSDIO_WATERMARK_MASK) ? SBSDIO_WATERMARK_MASK : watermark;
+               DHD_ERROR(("Setting watermark as 0x%x.\n", watermark));
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK, (uint8)watermark, NULL);
+               break;
+
+       case IOV_GVAL(IOV_MESBUSYCTRL):
+               int_val = (int32)mesbusyctrl;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_MESBUSYCTRL):
+               mesbusyctrl = (uint)int_val;
+               mesbusyctrl = (mesbusyctrl > SBSDIO_MESBUSYCTRL_MASK)
+                       ? SBSDIO_MESBUSYCTRL_MASK : mesbusyctrl;
+               DHD_ERROR(("Setting mesbusyctrl as 0x%x.\n", mesbusyctrl));
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_MESBUSYCTRL,
+                       ((uint8)mesbusyctrl | 0x80), NULL);
+               break;
+#endif
+
+       case IOV_GVAL(IOV_DONGLEISOLATION):
+               int_val = bus->dhd->dongle_isolation;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DONGLEISOLATION):
+               bus->dhd->dongle_isolation = bool_val;
+               break;
+
+       case IOV_SVAL(IOV_DEVRESET):
+               DHD_TRACE(("%s: Called set IOV_DEVRESET=%d dongle_reset=%d busstate=%d\n",
+                          __FUNCTION__, bool_val, bus->dhd->dongle_reset,
+                          bus->dhd->busstate));
+
+               ASSERT(bus->dhd->osh);
+               /* ASSERT(bus->cl_devid); */
+
+               /* must release sdlock, since devreset also acquires it */
+               dhd_os_sdunlock(bus->dhd);
+               dhd_bus_devreset(bus->dhd, (uint8)bool_val);
+               dhd_os_sdlock(bus->dhd);
+               break;
+       /*
+        * softap firmware is updated through module parameter or android private command
+        */
+
+       case IOV_GVAL(IOV_DEVRESET):
+               DHD_TRACE(("%s: Called get IOV_DEVRESET\n", __FUNCTION__));
+
+               /* Get its status */
+               int_val = (bool) bus->dhd->dongle_reset;
+               bcopy(&int_val, arg, val_size);
+
+               break;
+
+       case IOV_GVAL(IOV_KSO):
+               int_val = dhdsdio_sleepcsr_get(bus);
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_DEVCAP):
+               int_val = dhdsdio_devcap_get(bus);
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DEVCAP):
+               dhdsdio_devcap_set(bus, (uint8) int_val);
+               break;
+       case IOV_GVAL(IOV_TXGLOMSIZE):
+               int_val = (int32)bus->txglomsize;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_TXGLOMSIZE):
+               if (int_val > SDPCM_MAXGLOM_SIZE) {
+                       bcmerror = BCME_ERROR;
+               } else {
+                       bus->txglomsize = (uint)int_val;
+               }
+               break;
+       case IOV_SVAL(IOV_HANGREPORT):
+               bus->dhd->hang_report = bool_val;
+               DHD_ERROR(("%s: Set hang_report as %d\n", __FUNCTION__, bus->dhd->hang_report));
+               break;
+
+       case IOV_GVAL(IOV_HANGREPORT):
+               int_val = (int32)bus->dhd->hang_report;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_TXINRX_THRES):
+               int_val = bus->txinrx_thres;
+               bcopy(&int_val, arg, val_size);
+               break;
+       case IOV_SVAL(IOV_TXINRX_THRES):
+               if (int_val < 0) {
+                       bcmerror = BCME_BADARG;
+               } else {
+                       bus->txinrx_thres = int_val;
+               }
+               break;
+
+       case IOV_GVAL(IOV_SDIO_SUSPEND):
+               int_val = (bus->dhd->busstate == DHD_BUS_SUSPEND) ? 1 : 0;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_SDIO_SUSPEND):
+               if (bool_val) { /* Suspend */
+                       dhdsdio_suspend(bus);
+               }
+               else { /* Resume */
+                       dhdsdio_resume(bus);
+               }
+               break;
+
+#if defined(DEBUGGER) || defined(DHD_DSCOPE)
+       case IOV_SVAL(IOV_GDB_SERVER):
+               if (bool_val == TRUE) {
+                       debugger_init((void *) bus, &bus_ops, int_val, SI_ENUM_BASE(bus->sih));
+               } else {
+                       debugger_close();
+               }
+               break;
+#endif /* DEBUGGER || DHD_DSCOPE */
+
+       default:
+               bcmerror = BCME_UNSUPPORTED;
+               break;
+       }
+
+exit:
+       if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched &&
+               NO_OTHER_ACTIVE_BUS_USER(bus)) {
+               bus->activity = FALSE;
+               dhdsdio_bussleep(bus, TRUE);
+               dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+       }
+
+       dhd_os_sdunlock(bus->dhd);
+
+       return bcmerror;
+}
+
+static int
+dhdsdio_write_vars(dhd_bus_t *bus)
+{
+       int bcmerror = 0;
+       uint32 varsize, phys_size;
+       uint32 varaddr;
+       uint8 *vbuffer;
+       uint32 varsizew;
+#ifdef DHD_DEBUG
+       uint8 *nvram_ularray;
+#endif /* DHD_DEBUG */
+
+       /* Even if there are no vars are to be written, we still need to set the ramsize. */
+       varsize = bus->varsz ? ROUNDUP(bus->varsz, 4) : 0;
+       varaddr = (bus->ramsize - 4) - varsize;
+
+       // terence 20150412: fix for nvram failed to download
+       if (bus->dhd->conf->chip == BCM43340_CHIP_ID ||
+                       bus->dhd->conf->chip == BCM43341_CHIP_ID) {
+               varsize = varsize ? ROUNDUP(varsize, 64) : 0;
+               varaddr = (bus->ramsize - 64) - varsize;
+       }
+
+       varaddr += bus->dongle_ram_base;
+
+       if (bus->vars) {
+               /* XXX: WAR for PR85623 */
+               if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev == 7)) {
+                       if (((varaddr & 0x3C) == 0x3C) && (varsize > 4)) {
+                               DHD_ERROR(("PR85623WAR in place\n"));
+                               varsize += 4;
+                               varaddr -= 4;
+                       }
+               }
+
+               /* XXX In case the controller has trouble with odd bytes... */
+               vbuffer = (uint8 *)MALLOC(bus->dhd->osh, varsize);
+               if (!vbuffer)
+                       return BCME_NOMEM;
+
+               bzero(vbuffer, varsize);
+               bcopy(bus->vars, vbuffer, bus->varsz);
+
+               /* Write the vars list */
+               bcmerror = dhdsdio_membytes(bus, TRUE, varaddr, vbuffer, varsize);
+               if (bcmerror) {
+                       DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                               __FUNCTION__, bcmerror, varsize, varaddr));
+                       return bcmerror;
+               }
+
+#ifdef DHD_DEBUG
+               /* Verify NVRAM bytes */
+               DHD_INFO(("Compare NVRAM dl & ul; varsize=%d\n", varsize));
+               nvram_ularray = (uint8*)MALLOC(bus->dhd->osh, varsize);
+               if (!nvram_ularray) {
+                       MFREE(bus->dhd->osh, vbuffer, varsize);
+                       return BCME_NOMEM;
+               }
+
+               /* Upload image to verify downloaded contents. */
+               memset(nvram_ularray, 0xaa, varsize);
+
+               /* Read the vars list to temp buffer for comparison */
+               bcmerror = dhdsdio_membytes(bus, FALSE, varaddr, nvram_ularray, varsize);
+               if (bcmerror) {
+                               DHD_ERROR(("%s: error %d on reading %d nvram bytes at 0x%08x\n",
+                                       __FUNCTION__, bcmerror, varsize, varaddr));
+               }
+               /* Compare the org NVRAM with the one read from RAM */
+               if (memcmp(vbuffer, nvram_ularray, varsize)) {
+                       DHD_ERROR(("%s: Downloaded NVRAM image is corrupted.\n", __FUNCTION__));
+               } else
+                       DHD_ERROR(("%s: Download, Upload and compare of NVRAM succeeded.\n",
+                       __FUNCTION__));
+
+               MFREE(bus->dhd->osh, nvram_ularray, varsize);
+#endif /* DHD_DEBUG */
+
+               MFREE(bus->dhd->osh, vbuffer, varsize);
+       }
+
+#ifdef MINIME
+       phys_size = bus->ramsize;
+#else
+       phys_size = REMAP_ENAB(bus) ? bus->ramsize : bus->orig_ramsize;
+#endif
+
+       phys_size += bus->dongle_ram_base;
+
+       /* adjust to the user specified RAM */
+       DHD_INFO(("Physical memory size: %d, usable memory size: %d\n",
+               phys_size, bus->ramsize));
+       DHD_INFO(("Vars are at %d, orig varsize is %d\n",
+               varaddr, varsize));
+       varsize = ((phys_size - 4) - varaddr);
+
+       /*
+        * Determine the length token:
+        * Varsize, converted to words, in lower 16-bits, checksum in upper 16-bits.
+        */
+#ifdef DHD_DEBUG
+       if (bcmerror) {
+               varsizew = 0;
+       } else
+#endif /* DHD_DEBUG */
+       {
+               varsizew = varsize / 4;
+               varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
+               varsizew = htol32(varsizew);
+       }
+
+       DHD_INFO(("New varsize is %d, length token=0x%08x\n", varsize, varsizew));
+
+       /* Write the length token to the last word */
+       bcmerror = dhdsdio_membytes(bus, TRUE, (phys_size - 4),
+               (uint8*)&varsizew, 4);
+
+       return bcmerror;
+}
+
+bool
+dhd_bus_is_multibp_capable(struct dhd_bus *bus)
+{
+       return MULTIBP_CAP(bus->sih);
+}
+
+static int
+dhdsdio_download_state(dhd_bus_t *bus, bool enter)
+{
+       uint retries;
+       int bcmerror = 0;
+       int foundcr4 = 0;
+
+       if (!bus->sih)
+               return BCME_ERROR;
+       /* To enter download state, disable ARM and reset SOCRAM.
+        * To exit download state, simply reset ARM (default is RAM boot).
+        */
+       if (enter) {
+               bus->alp_only = TRUE;
+
+               if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
+                   !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
+                       if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+                               foundcr4 = 1;
+                       } else {
+                               DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+               }
+
+               if (!foundcr4) {
+                       si_core_disable(bus->sih, 0);
+                       if (bcmsdh_regfail(bus->sdh)) {
+                               bcmerror = BCME_SDIO_ERROR;
+                               goto fail;
+                       }
+
+                       if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+
+                       si_core_reset(bus->sih, 0, 0);
+                       if (bcmsdh_regfail(bus->sdh)) {
+                               DHD_ERROR(("%s: Failure trying reset SOCRAM core?\n",
+                                          __FUNCTION__));
+                               bcmerror = BCME_SDIO_ERROR;
+                               goto fail;
+                       }
+
+                       if (CHIPID(bus->sih->chip) == BCM43430_CHIP_ID ||
+                               CHIPID(bus->sih->chip) == BCM43018_CHIP_ID) {
+                               /* Disabling Remap for SRAM_3 */
+                               si_socram_set_bankpda(bus->sih, 0x3, 0x0);
+                       }
+
+                       /* Clear the top bit of memory */
+                       if (bus->ramsize) {
+                               uint32 zeros = 0;
+                               if (dhdsdio_membytes(bus, TRUE, bus->ramsize - 4,
+                                                    (uint8*)&zeros, 4) < 0) {
+                                       bcmerror = BCME_SDIO_ERROR;
+                                       goto fail;
+                               }
+                       }
+               } else {
+                       /* For CR4,
+                        * Halt ARM
+                        * Remove ARM reset
+                        * Read RAM base address [0x18_0000]
+                        * [next] Download firmware
+                        * [done at else] Populate the reset vector
+                        * [done at else] Remove ARM halt
+                       */
+                       /* Halt ARM & remove reset */
+                       si_core_reset(bus->sih, SICF_CPUHALT, SICF_CPUHALT);
+               }
+       } else {
+               if (!si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+                       if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+
+                       if (!si_iscoreup(bus->sih)) {
+                               DHD_ERROR(("%s: SOCRAM core is down after reset?\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+
+                       if ((bcmerror = dhdsdio_write_vars(bus))) {
+                               DHD_ERROR(("%s: could not write vars to RAM\n", __FUNCTION__));
+                               goto fail;
+                       }
+
+#ifdef BCMSDIOLITE
+                       if (!si_setcore(bus->sih, CC_CORE_ID, 0)) {
+                               DHD_ERROR(("%s: Can't set to Chip Common core?\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+#else
+                       if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0) &&
+                           !si_setcore(bus->sih, SDIOD_CORE_ID, 0)) {
+                               DHD_ERROR(("%s: Can't change back to SDIO core?\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+#endif
+                       W_SDREG(0xFFFFFFFF, &bus->regs->intstatus, retries);
+
+                       /* XXX Change standby configuration here if necessary */
+
+                       if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
+                           !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+               } else {
+                       /* cr4 has no socram, but tcm's */
+                       /* write vars */
+                       if ((bcmerror = dhdsdio_write_vars(bus))) {
+                               DHD_ERROR(("%s: could not write vars to RAM\n", __FUNCTION__));
+                               goto fail;
+                       }
+#ifdef BCMSDIOLITE
+                       if (!si_setcore(bus->sih, CC_CORE_ID, 0)) {
+                               DHD_ERROR(("%s: Can't set to Chip Common core?\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+#else
+                       if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0) &&
+                           !si_setcore(bus->sih, SDIOD_CORE_ID, 0)) {
+                               DHD_ERROR(("%s: Can't change back to SDIO core?\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+#endif
+                       W_SDREG(0xFFFFFFFF, &bus->regs->intstatus, retries);
+
+                       /* switch back to arm core again */
+                       if (!(si_setcore(bus->sih, ARMCR4_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find ARM CR4 core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+                       /* write address 0 with reset instruction */
+                       bcmerror = dhdsdio_membytes(bus, TRUE, 0,
+                               (uint8 *)&bus->resetinstr, sizeof(bus->resetinstr));
+
+                       if (bcmerror == BCME_OK) {
+                               uint32 tmp;
+
+                               /* verify write */
+                               bcmerror = dhdsdio_membytes(bus, FALSE, 0,
+                                                           (uint8 *)&tmp, sizeof(tmp));
+
+                               if (bcmerror == BCME_OK && tmp != bus->resetinstr) {
+                                       DHD_ERROR(("%s: Failed to write 0x%08x to addr 0\n",
+                                                 __FUNCTION__, bus->resetinstr));
+                                       DHD_ERROR(("%s: contents of addr 0 is 0x%08x\n",
+                                                 __FUNCTION__, tmp));
+                                       bcmerror = BCME_SDIO_ERROR;
+                                       goto fail;
+                               }
+                       }
+
+                       /* now remove reset and halt and continue to run CR4 */
+               }
+
+               si_core_reset(bus->sih, 0, 0);
+               if (bcmsdh_regfail(bus->sdh)) {
+                       DHD_ERROR(("%s: Failure trying to reset ARM core?\n", __FUNCTION__));
+                       bcmerror = BCME_SDIO_ERROR;
+                       goto fail;
+               }
+
+               /* Allow HT Clock now that the ARM is running. */
+               bus->alp_only = FALSE;
+
+               bus->dhd->busstate = DHD_BUS_LOAD;
+       }
+
+fail:
+       /* Always return to SDIOD core */
+       if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0))
+               si_setcore(bus->sih, SDIOD_CORE_ID, 0);
+
+       return bcmerror;
+}
+
+int
+dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
+                 void *params, uint plen, void *arg, uint len, bool set)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       const bcm_iovar_t *vi = NULL;
+       int bcmerror = 0;
+       uint val_size;
+       uint32 actionid;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       ASSERT(name);
+
+       /* Get MUST have return space */
+       ASSERT(set || (arg && len));
+
+       /* Set does NOT take qualifiers */
+       ASSERT(!set || (!params && !plen));
+
+       /* Look up var locally; if not found pass to host driver */
+       if ((vi = bcm_iovar_lookup(dhdsdio_iovars, name)) == NULL) {
+               dhd_os_sdlock(bus->dhd);
+
+               BUS_WAKE(bus);
+
+               /* Turn on clock in case SD command needs backplane */
+               dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+               bcmerror = bcmsdh_iovar_op(bus->sdh, name, params, plen, arg, len, set);
+
+               /* Check for bus configuration changes of interest */
+
+               /* If it was divisor change, read the new one */
+               if (set && strcmp(name, "sd_divisor") == 0) {
+                       if (bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
+                                           &bus->sd_divisor, sizeof(int32), FALSE) != BCME_OK) {
+                               bus->sd_divisor = -1;
+                               DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, name));
+                       } else {
+                               DHD_INFO(("%s: noted %s update, value now %d\n",
+                                         __FUNCTION__, name, bus->sd_divisor));
+                       }
+               }
+               /* If it was a mode change, read the new one */
+               if (set && strcmp(name, "sd_mode") == 0) {
+                       if (bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
+                                           &bus->sd_mode, sizeof(int32), FALSE) != BCME_OK) {
+                               bus->sd_mode = -1;
+                               DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, name));
+                       } else {
+                               DHD_INFO(("%s: noted %s update, value now %d\n",
+                                         __FUNCTION__, name, bus->sd_mode));
+                       }
+               }
+               /* Similar check for blocksize change */
+               if (set && strcmp(name, "sd_blocksize") == 0) {
+                       int32 fnum = 2;
+                       if (bcmsdh_iovar_op(bus->sdh, "sd_blocksize", &fnum, sizeof(int32),
+                                           &bus->blocksize, sizeof(int32), FALSE) != BCME_OK) {
+                               bus->blocksize = 0;
+                               DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_blocksize"));
+                       } else {
+                               DHD_INFO(("%s: noted %s update, value now %d\n",
+                                         __FUNCTION__, "sd_blocksize", bus->blocksize));
+
+                               dhdsdio_tune_fifoparam(bus);
+                       }
+               }
+               bus->roundup = MIN(max_roundup, bus->blocksize);
+
+               if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched &&
+                       NO_OTHER_ACTIVE_BUS_USER(bus)) {
+                       bus->activity = FALSE;
+                       dhdsdio_bussleep(bus, TRUE);
+                       dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+               }
+
+               dhd_os_sdunlock(bus->dhd);
+               goto exit;
+       }
+
+       DHD_CTL(("%s: %s %s, len %d plen %d\n", __FUNCTION__,
+                name, (set ? "set" : "get"), len, plen));
+
+       /* set up 'params' pointer in case this is a set command so that
+        * the convenience int and bool code can be common to set and get
+        */
+       if (params == NULL) {
+               params = arg;
+               plen = len;
+       }
+
+       if (vi->type == IOVT_VOID)
+               val_size = 0;
+       else if (vi->type == IOVT_BUFFER)
+               val_size = len;
+       else
+               /* all other types are integer sized */
+               val_size = sizeof(int);
+
+       actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+       bcmerror = dhdsdio_doiovar(bus, vi, actionid, name, params, plen, arg, len, val_size);
+
+exit:
+       return bcmerror;
+}
+
+void
+dhd_bus_stop(struct dhd_bus *bus, bool enforce_mutex)
+{
+       osl_t *osh;
+       uint32 local_hostintmask;
+       uint8 saveclk;
+       uint retries;
+       int err;
+       bool wlfc_enabled = FALSE;
+       unsigned long flags;
+
+       if (!bus->dhd)
+               return;
+
+       osh = bus->dhd->osh;
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       bcmsdh_waitlockfree(bus->sdh);
+
+       if (enforce_mutex)
+               dhd_os_sdlock(bus->dhd);
+
+       if ((bus->dhd->busstate == DHD_BUS_DOWN) || bus->dhd->hang_was_sent) {
+               /* if Firmware already hangs disbale any interrupt */
+               DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+               bus->dhd->busstate = DHD_BUS_DOWN;
+               bus->hostintmask = 0;
+               bcmsdh_intr_disable(bus->sdh);
+       } else {
+
+               BUS_WAKE(bus);
+
+               if (KSO_ENAB(bus)) {
+
+               /* Enable clock for device interrupts */
+               dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+               /* Disable and clear interrupts at the chip level also */
+               W_SDREG(0, &bus->regs->hostintmask, retries);
+               local_hostintmask = bus->hostintmask;
+               bus->hostintmask = 0;
+
+               /* Force clocks on backplane to be sure F2 interrupt propagates */
+               saveclk = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+               if (!err) {
+                       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                                        (saveclk | SBSDIO_FORCE_HT), &err);
+               }
+               if (err) {
+                       DHD_ERROR(("%s: Failed to force clock for F2: err %d\n",
+                                   __FUNCTION__, err));
+               }
+
+               /* Turn off the bus (F2), free any pending packets */
+               /* XXX How to wake up any waiting processes? */
+               /* XXX New API: bcmsdh_fn_set(bus->sdh, SDIO_FUNC_2, FALSE); */
+               DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+               bcmsdh_intr_disable(bus->sdh); /* XXX bcmsdh_intr_mask(bus->sdh); */
+#ifndef BCMSPI
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, SDIO_FUNC_ENABLE_1, NULL);
+#endif /* !BCMSPI */
+
+               /* Clear any pending interrupts now that F2 is disabled */
+               W_SDREG(local_hostintmask, &bus->regs->intstatus, retries);
+               }
+
+               /* Turn off the backplane clock (only) */
+               dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+
+               /* Change our idea of bus state */
+               DHD_LINUX_GENERAL_LOCK(bus->dhd, flags);
+               DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+               bus->dhd->busstate = DHD_BUS_DOWN;
+               DHD_LINUX_GENERAL_UNLOCK(bus->dhd, flags);
+       }
+
+#ifdef PROP_TXSTATUS
+       wlfc_enabled = (dhd_wlfc_cleanup_txq(bus->dhd, NULL, 0) != WLFC_UNSUPPORTED);
+#endif
+       if (!wlfc_enabled) {
+#ifdef DHDTCPACK_SUPPRESS
+               /* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+                * when there is a newly coming packet from network stack.
+                */
+               dhd_tcpack_info_tbl_clean(bus->dhd);
+#endif /* DHDTCPACK_SUPPRESS */
+               dhd_os_sdlock_txq(bus->dhd);
+               /* Clear the data packet queues */
+               pktq_flush(osh, &bus->txq, TRUE);
+               dhd_os_sdunlock_txq(bus->dhd);
+       }
+
+       /* Clear any held glomming stuff */
+       if (bus->glomd)
+               PKTFREE(osh, bus->glomd, FALSE);
+
+       if (bus->glom)
+               PKTFREE(osh, bus->glom, FALSE);
+
+       bus->glom = bus->glomd = NULL;
+
+       /* Clear rx control and wake any waiters */
+       /* XXX More important in disconnect, but no context? */
+       bus->rxlen = 0;
+       dhd_os_ioctl_resp_wake(bus->dhd);
+
+       /* Reset some F2 state stuff */
+       bus->rxskip = FALSE;
+       bus->tx_seq = bus->rx_seq = 0;
+
+       /* Initializing tx_max to a reasonable value to start xfer
+        * Gets updated to correct value after receving the first
+        * packet from firmware
+        * XXX - Need to find a right mechanism to querry from
+        * firmware when the device is coming up
+        */
+       bus->tx_max = 4;
+
+       if (enforce_mutex)
+               dhd_os_sdunlock(bus->dhd);
+}
+
+#if defined(BCMSDIOH_TXGLOM) && defined(BCMSDIOH_STD)
+extern uint sd_txglom;
+#endif
+void
+dhd_txglom_enable(dhd_pub_t *dhdp, bool enable)
+{
+       /* can't enable host txglom by default, some platforms have no
+        * (or crappy) ADMA support and txglom will cause kernel assertions (e.g.
+        * panda board)
+        */
+       dhd_bus_t *bus = dhdp->bus;
+#ifdef BCMSDIOH_TXGLOM
+       uint32 rxglom;
+       int32 ret;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef BCMSDIOH_STD
+       if (enable)
+               enable = sd_txglom;
+#endif /* BCMSDIOH_STD */
+
+       if (enable) {
+               rxglom = 1;
+               ret = dhd_iovar(dhdp, 0, "bus:rxglom", (char *)&rxglom, sizeof(rxglom), NULL, 0,
+                               TRUE);
+               if (ret >= 0)
+                       bus->txglom_enable = TRUE;
+               else {
+#ifdef BCMSDIOH_STD
+                       sd_txglom = 0;
+#endif /* BCMSDIOH_STD */
+                       bus->txglom_enable = FALSE;
+               }
+       } else
+#endif /* BCMSDIOH_TXGLOM */
+               bus->txglom_enable = FALSE;
+       printf("%s: enable %d\n",  __FUNCTION__, bus->txglom_enable);
+       dhd_conf_set_txglom_params(bus->dhd, bus->txglom_enable);
+       bcmsdh_set_mode(bus->sdh, bus->dhd->conf->txglom_mode);
+}
+
+int
+dhd_bus_init(dhd_pub_t *dhdp, bool enforce_mutex)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       dhd_timeout_t tmo;
+       uint retries = 0;
+       uint8 ready, enable;
+       int err, ret = 0;
+#ifdef BCMSPI
+       uint32 dstatus = 0;     /* gSPI device-status bits */
+#else /* BCMSPI */
+       uint8 saveclk;
+#endif /* BCMSPI */
+#if defined(SDIO_ISR_THREAD)
+       int intr_extn;
+#endif
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       ASSERT(bus->dhd);
+       if (!bus->dhd)
+               return 0;
+
+       if (enforce_mutex)
+               dhd_os_sdlock(bus->dhd);
+
+       if (bus->sih->chip == BCM43362_CHIP_ID) {
+               printf("%s: delay 100ms for BCM43362\n", __FUNCTION__);
+               OSL_DELAY(100000); // terence 20131209: delay for 43362
+       }
+
+       /* Make sure backplane clock is on, needed to generate F2 interrupt */
+       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+       if (bus->clkstate != CLK_AVAIL) {
+               DHD_ERROR(("%s: clock state is wrong. state = %d\n", __FUNCTION__, bus->clkstate));
+               ret = -1;
+               goto exit;
+       }
+
+#ifdef BCMSPI
+       /* fake "ready" for spi, wake-wlan would have already enabled F1 and F2 */
+       ready = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
+       enable = 0;
+
+       /* Give the dongle some time to do its thing and set IOR2 */
+       dhd_timeout_start(&tmo, WAIT_F2RXFIFORDY * WAIT_F2RXFIFORDY_DELAY * 1000);
+       while (!enable && !dhd_timeout_expired(&tmo)) {
+               dstatus = bcmsdh_cfg_read_word(bus->sdh, SDIO_FUNC_0, SPID_STATUS_REG, NULL);
+               if (dstatus & STATUS_F2_RX_READY)
+                       enable = TRUE;
+       }
+
+       if (enable) {
+               DHD_ERROR(("Took %u usec before dongle is ready\n", tmo.elapsed));
+               enable = ready;
+       } else {
+               DHD_ERROR(("dstatus when timed out on f2-fifo not ready = 0x%x\n", dstatus));
+               DHD_ERROR(("Waited %u usec, dongle is not ready\n", tmo.elapsed));
+               ret = -1;
+               goto exit;
+       }
+
+#else /* !BCMSPI */
+       /* Force clocks on backplane to be sure F2 interrupt propagates */
+       saveclk = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+
+       if (!err) {
+               /* QT requires HT clock */
+               if (bus->sih->chip == BCM43012_CHIP_ID ||
+                       bus->sih->chip == BCM43013_CHIP_ID ||
+                       bus->sih->chip == BCM43014_CHIP_ID) {
+                       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                               (saveclk | SBSDIO_HT_AVAIL_REQ), &err);
+               } else
+               {
+                       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                               (saveclk | SBSDIO_FORCE_HT), &err);
+               }
+       }
+
+       if (err) {
+               DHD_ERROR(("%s: Failed to force clock for F2: err %d\n", __FUNCTION__, err));
+               ret = -1;
+               goto exit;
+       }
+
+       /* Enable function 2 (frame transfers) */
+       /* XXX New API: change to bcmsdh_fn_set(sdh, SDIO_FUNC_2, TRUE); */
+       W_SDREG((SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT),
+               &bus->regs->tosbmailboxdata, retries);
+       enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
+
+       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, enable, NULL);
+
+       /* Give the dongle some time to do its thing and set IOR2 */
+       dhd_timeout_start(&tmo, DHD_WAIT_F2RDY * 1000);
+
+       ready = 0;
+       while (ready != enable && !dhd_timeout_expired(&tmo))
+               ready = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IORDY, NULL);
+
+#endif /* !BCMSPI */
+
+       DHD_ERROR(("%s: enable 0x%02x, ready 0x%02x (waited %uus)\n",
+                 __FUNCTION__, enable, ready, tmo.elapsed));
+
+#if defined(SDIO_ISR_THREAD)
+       if (dhdp->conf->intr_extn) {
+               intr_extn = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_INTR_EXTN, NULL);
+               if (intr_extn & 0x1) {
+                       intr_extn |= 0x2;
+                       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_INTR_EXTN, intr_extn, NULL);
+               }
+       }
+#endif
+
+       /* XXX For simplicity, fail and await next call if F2 not ready.
+        * XXX Should really set timer to poll, and/or enable interrupt;
+        * XXX then put this process in wait until a result...
+        */
+
+       /* If F2 successfully enabled, set core and enable interrupts */
+       if (ready == enable) {
+               /* Make sure we're talking to the core. */
+#ifdef BCMSDIOLITE
+               bus->regs = si_setcore(bus->sih, CC_CORE_ID, 0);
+               ASSERT(bus->regs != NULL);
+#else
+               if (!(bus->regs = si_setcore(bus->sih, PCMCIA_CORE_ID, 0)))
+                       bus->regs = si_setcore(bus->sih, SDIOD_CORE_ID, 0);
+               ASSERT(bus->regs != NULL);
+#endif
+               /* Set up the interrupt mask and enable interrupts */
+               bus->hostintmask = HOSTINTMASK;
+               /* corerev 4 could use the newer interrupt logic to detect the frames */
+#ifndef BCMSPI
+               if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev == 4) &&
+                       (bus->rxint_mode != SDIO_DEVICE_HMB_RXINT)) {
+                       bus->hostintmask &= ~I_HMB_FRAME_IND;
+                       bus->hostintmask |= I_XMTDATA_AVAIL;
+               }
+#endif /* BCMSPI */
+               W_SDREG(bus->hostintmask, &bus->regs->hostintmask, retries);
+
+               /* PR47410 - Lower F2 Watermark to avoid DMA Hang
+                * in F2 when SD Clock is stopped.
+                */
+               if (bus->sih->buscorerev < 15) {
+                       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK,
+                               (uint8)watermark, &err);
+               }
+
+               /* Set bus state according to enable result */
+               dhdp->busstate = DHD_BUS_DATA;
+
+               /* Need to set fn2 block size to match fn1 block size.
+                * Requests to fn2 go thru fn1. *
+                * faltwig has this code contitioned with #if !BCMSPI_ANDROID.
+                * It would be cleaner to use the ->sdh->block_sz[fno] instead of
+                * 64, but this layer has no access to sdh types.
+                */
+
+               /* XXX These need to change w/API updates */
+               /* bcmsdh_intr_unmask(bus->sdh); */
+
+               bus->intdis = FALSE;
+               if (bus->intr) {
+                       DHD_INTR(("%s: enable SDIO device interrupts\n", __FUNCTION__));
+#ifndef BCMSPI_ANDROID
+                       bcmsdh_intr_enable(bus->sdh);
+#endif /* !BCMSPI_ANDROID */
+               } else {
+                       DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+                       bcmsdh_intr_disable(bus->sdh);
+               }
+
+       }
+
+#ifndef BCMSPI
+
+       else {
+               /* Disable F2 again */
+               enable = SDIO_FUNC_ENABLE_1;
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, enable, NULL);
+       }
+
+       if (dhdsdio_sr_cap(bus)) {
+               dhdsdio_sr_init(bus);
+               /* Masking the chip active interrupt  permanantly */
+               bus->hostintmask &= ~I_CHIPACTIVE;
+               W_SDREG(bus->hostintmask, &bus->regs->hostintmask, retries);
+               DHD_INFO(("%s: disable I_CHIPACTIVE in hostintmask[0x%08x]\n",
+               __FUNCTION__, bus->hostintmask));
+       } else {
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1,
+                       SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
+       }
+#endif /* !BCMSPI */
+
+       /* If we didn't come up, turn off backplane clock */
+       if (dhdp->busstate != DHD_BUS_DATA)
+               dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+
+exit:
+       if (enforce_mutex)
+               dhd_os_sdunlock(bus->dhd);
+
+       /* XXX Temp errnum workaround: return ok, caller checks bus state */
+       return ret;
+}
+
+static void
+dhdsdio_rxfail(dhd_bus_t *bus, bool abort, bool rtx)
+{
+       bcmsdh_info_t *sdh = bus->sdh;
+       sdpcmd_regs_t *regs = bus->regs;
+       uint retries = 0;
+       uint16 lastrbc;
+       uint8 hi, lo;
+       int err;
+
+       DHD_ERROR(("%s: %sterminate frame%s\n", __FUNCTION__,
+                  (abort ? "abort command, " : ""), (rtx ? ", send NAK" : "")));
+
+       if (!KSO_ENAB(bus)) {
+               DHD_ERROR(("%s: Device asleep\n", __FUNCTION__));
+               return;
+       }
+
+       if (abort) {
+               bcmsdh_abort(sdh, SDIO_FUNC_2);
+       }
+
+       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM, &err);
+       if (err) {
+               DHD_ERROR(("%s: SBSDIO_FUNC1_FRAMECTRL cmd err\n", __FUNCTION__));
+               goto fail;
+       }
+       bus->f1regdata++;
+
+       /* Wait until the packet has been flushed (device/FIFO stable) */
+       for (lastrbc = retries = 0xffff; retries > 0; retries--) {
+               hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_RFRAMEBCHI, NULL);
+               lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_RFRAMEBCLO, &err);
+               if (err) {
+                       DHD_ERROR(("%s: SBSDIO_FUNC1_RFAMEBCLO cmd err\n", __FUNCTION__));
+                       goto fail;
+               }
+
+               bus->f1regdata += 2;
+
+               if ((hi == 0) && (lo == 0))
+                       break;
+
+               if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
+                       DHD_ERROR(("%s: count growing: last 0x%04x now 0x%04x\n",
+                                  __FUNCTION__, lastrbc, ((hi << 8) + lo)));
+               }
+               lastrbc = (hi << 8) + lo;
+       }
+
+       if (!retries) {
+               DHD_ERROR(("%s: count never zeroed: last 0x%04x\n", __FUNCTION__, lastrbc));
+       } else {
+               DHD_INFO(("%s: flush took %d iterations\n", __FUNCTION__, (0xffff - retries)));
+       }
+
+       if (rtx) {
+               bus->rxrtx++;
+               W_SDREG(SMB_NAK, &regs->tosbmailbox, retries);
+               bus->f1regdata++;
+               if (retries <= retry_limit) {
+                       bus->rxskip = TRUE;
+               }
+       }
+
+       /* Clear partial in any case */
+       bus->nextlen = 0;
+
+fail:
+       /* If we can't reach the device, signal failure */
+       if (err || bcmsdh_regfail(sdh)) {
+               DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+               bus->dhd->busstate = DHD_BUS_DOWN;
+       }
+}
+
+static void
+dhdsdio_read_control(dhd_bus_t *bus, uint8 *hdr, uint len, uint doff)
+{
+       bcmsdh_info_t *sdh = bus->sdh;
+       uint rdlen, pad;
+
+       int sdret;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       /* Control data already received in aligned rxctl */
+       if ((bus->bus == SPI_BUS) && (!bus->usebufpool))
+               goto gotpkt;
+
+       ASSERT(bus->rxbuf);
+       /* Set rxctl for frame (w/optional alignment) */
+       bus->rxctl = bus->rxbuf;
+       if (dhd_alignctl) {
+               bus->rxctl += firstread;
+               if ((pad = ((uintptr)bus->rxctl % DHD_SDALIGN)))
+                       bus->rxctl += (DHD_SDALIGN - pad);
+               bus->rxctl -= firstread;
+       }
+       ASSERT(bus->rxctl >= bus->rxbuf);
+
+       /* Copy the already-read portion over */
+       bcopy(hdr, bus->rxctl, firstread);
+       if (len <= firstread)
+               goto gotpkt;
+
+       /* Copy the full data pkt in gSPI case and process ioctl. */
+       if (bus->bus == SPI_BUS) {
+               bcopy(hdr, bus->rxctl, len);
+               goto gotpkt;
+       }
+
+       /* Raise rdlen to next SDIO block to avoid tail command */
+       rdlen = len - firstread;
+       if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
+               pad = bus->blocksize - (rdlen % bus->blocksize);
+               if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
+                   ((len + pad) < bus->dhd->maxctl))
+                       rdlen += pad;
+       } else if (rdlen % DHD_SDALIGN) {
+               rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
+       }
+
+       /* Satisfy length-alignment requirements */
+       if (forcealign && (rdlen & (ALIGNMENT - 1)))
+               rdlen = ROUNDUP(rdlen, ALIGNMENT);
+
+       /* Drop if the read is too big or it exceeds our maximum */
+       if ((rdlen + firstread) > bus->dhd->maxctl) {
+               DHD_ERROR(("%s: %d-byte control read exceeds %d-byte buffer\n",
+                          __FUNCTION__, rdlen, bus->dhd->maxctl));
+               bus->dhd->rx_errors++;
+               dhdsdio_rxfail(bus, FALSE, FALSE);
+               goto done;
+       }
+
+       if ((len - doff) > bus->dhd->maxctl) {
+               DHD_ERROR(("%s: %d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
+                          __FUNCTION__, len, (len - doff), bus->dhd->maxctl));
+               bus->dhd->rx_errors++; bus->rx_toolong++;
+               dhdsdio_rxfail(bus, FALSE, FALSE);
+               goto done;
+       }
+
+       /* XXX Could block readers with rxlen=0? */
+
+       /* Read remainder of frame body into the rxctl buffer */
+       sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+                                   (bus->rxctl + firstread), rdlen, NULL, NULL, NULL);
+       bus->f2rxdata++;
+       ASSERT(sdret != BCME_PENDING);
+
+       /* Control frame failures need retransmission */
+       if (sdret < 0) {
+               DHD_ERROR(("%s: read %d control bytes failed: %d\n", __FUNCTION__, rdlen, sdret));
+               bus->rxc_errors++; /* dhd.rx_ctlerrs is higher level */
+               dhdsdio_rxfail(bus, TRUE, TRUE);
+               goto done;
+       }
+
+gotpkt:
+
+#ifdef DHD_DEBUG
+       if (DHD_BYTES_ON() && DHD_CTL_ON()) {
+               prhex("RxCtrl", bus->rxctl, len);
+       }
+#endif
+
+       /* Point to valid data and indicate its length */
+       bus->rxctl += doff;
+       bus->rxlen = len - doff;
+
+done:
+       /* Awake any waiters */
+       dhd_os_ioctl_resp_wake(bus->dhd);
+}
+int
+dhd_process_pkt_reorder_info(dhd_pub_t *dhd, uchar *reorder_info_buf, uint reorder_info_len,
+       void **pkt, uint32 *pkt_count);
+
+static uint8
+dhdsdio_rxglom(dhd_bus_t *bus, uint8 rxseq)
+{
+       uint16 dlen, totlen;
+       uint8 *dptr, num = 0;
+
+       uint16 sublen, check;
+       void *pfirst, *plast, *pnext;
+       void * list_tail[DHD_MAX_IFS] = { NULL };
+       void * list_head[DHD_MAX_IFS] = { NULL };
+       uint8 idx;
+       osl_t *osh = bus->dhd->osh;
+
+       int errcode;
+       uint8 chan, seq, doff, sfdoff;
+       uint8 txmax;
+       uchar reorder_info_buf[WLHOST_REORDERDATA_TOTLEN];
+       uint reorder_info_len;
+
+       int ifidx = 0;
+       bool usechain = bus->use_rxchain;
+
+       /* If packets, issue read(s) and send up packet chain */
+       /* Return sequence numbers consumed? */
+
+       DHD_TRACE(("dhdsdio_rxglom: start: glomd %p glom %p\n", bus->glomd, bus->glom));
+
+       /* If there's a descriptor, generate the packet chain */
+       if (bus->glomd) {
+               dhd_os_sdlock_rxq(bus->dhd);
+
+               pfirst = plast = pnext = NULL;
+               dlen = (uint16)PKTLEN(osh, bus->glomd);
+               dptr = PKTDATA(osh, bus->glomd);
+               if (!dlen || (dlen & 1)) {
+                       DHD_ERROR(("%s: bad glomd len (%d), ignore descriptor\n",
+                                  __FUNCTION__, dlen));
+                       dlen = 0;
+               }
+
+               for (totlen = num = 0; dlen; num++) {
+                       /* Get (and move past) next length */
+                       sublen = ltoh16_ua(dptr);
+                       dlen -= sizeof(uint16);
+                       dptr += sizeof(uint16);
+                       if ((sublen < SDPCM_HDRLEN) ||
+                           ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
+                               DHD_ERROR(("%s: descriptor len %d bad: %d\n",
+                                          __FUNCTION__, num, sublen));
+                               pnext = NULL;
+                               break;
+                       }
+                       if (sublen % DHD_SDALIGN) {
+                               DHD_ERROR(("%s: sublen %d not a multiple of %d\n",
+                                          __FUNCTION__, sublen, DHD_SDALIGN));
+                               usechain = FALSE;
+                       }
+                       totlen += sublen;
+
+                       /* For last frame, adjust read len so total is a block multiple */
+                       if (!dlen) {
+                               sublen += (ROUNDUP(totlen, bus->blocksize) - totlen);
+                               totlen = ROUNDUP(totlen, bus->blocksize);
+                       }
+
+                       /* Allocate/chain packet for next subframe */
+                       if ((pnext = PKTGET(osh, sublen + DHD_SDALIGN, FALSE)) == NULL) {
+                               DHD_ERROR(("%s: PKTGET failed, num %d len %d\n",
+                                          __FUNCTION__, num, sublen));
+                               break;
+                       }
+                       ASSERT(!PKTLINK(pnext));
+                       if (!pfirst) {
+                               ASSERT(!plast);
+                               pfirst = plast = pnext;
+                       } else {
+                               ASSERT(plast);
+                               PKTSETNEXT(osh, plast, pnext);
+                               plast = pnext;
+                       }
+
+                       /* Adhere to start alignment requirements */
+                       PKTALIGN(osh, pnext, sublen, DHD_SDALIGN);
+               }
+
+               /* If all allocations succeeded, save packet chain in bus structure */
+               if (pnext) {
+                       DHD_GLOM(("%s: allocated %d-byte packet chain for %d subframes\n",
+                                 __FUNCTION__, totlen, num));
+                       if (DHD_GLOM_ON() && bus->nextlen) {
+                               if (totlen != bus->nextlen) {
+                                       DHD_GLOM(("%s: glomdesc mismatch: nextlen %d glomdesc %d "
+                                                 "rxseq %d\n", __FUNCTION__, bus->nextlen,
+                                                 totlen, rxseq));
+                               }
+                       }
+                       bus->glom = pfirst;
+                       pfirst = pnext = NULL;
+               } else {
+                       if (pfirst)
+                               PKTFREE(osh, pfirst, FALSE);
+                       bus->glom = NULL;
+                       num = 0;
+               }
+
+               /* Done with descriptor packet */
+               PKTFREE(osh, bus->glomd, FALSE);
+               bus->glomd = NULL;
+               bus->nextlen = 0;
+
+               dhd_os_sdunlock_rxq(bus->dhd);
+       }
+
+       /* Ok -- either we just generated a packet chain, or had one from before */
+       if (bus->glom) {
+               if (DHD_GLOM_ON()) {
+                       DHD_GLOM(("%s: attempt superframe read, packet chain:\n", __FUNCTION__));
+                       for (pnext = bus->glom; pnext; pnext = PKTNEXT(osh, pnext)) {
+                               DHD_GLOM(("    %p: %p len 0x%04x (%d)\n",
+                                         pnext, (uint8*)PKTDATA(osh, pnext),
+                                         PKTLEN(osh, pnext), PKTLEN(osh, pnext)));
+                       }
+               }
+
+               pfirst = bus->glom;
+               dlen = (uint16)pkttotlen(osh, pfirst);
+
+               /* Do an SDIO read for the superframe.  Configurable iovar to
+                * read directly into the chained packet, or allocate a large
+                * packet and and copy into the chain.
+                */
+               if (usechain) {
+                       errcode = dhd_bcmsdh_recv_buf(bus,
+                                                     bcmsdh_cur_sbwad(bus->sdh), SDIO_FUNC_2,
+                                                     F2SYNC, (uint8*)PKTDATA(osh, pfirst),
+                                                     dlen, pfirst, NULL, NULL);
+               } else if (bus->dataptr) {
+                       errcode = dhd_bcmsdh_recv_buf(bus,
+                                                     bcmsdh_cur_sbwad(bus->sdh), SDIO_FUNC_2,
+                                                     F2SYNC, bus->dataptr,
+                                                     dlen, NULL, NULL, NULL);
+                       sublen = (uint16)pktfrombuf(osh, pfirst, 0, dlen, bus->dataptr);
+                       if (sublen != dlen) {
+                               DHD_ERROR(("%s: FAILED TO COPY, dlen %d sublen %d\n",
+                                          __FUNCTION__, dlen, sublen));
+                               errcode = -1;
+                       }
+                       pnext = NULL;
+                       BCM_REFERENCE(pnext);
+               } else {
+                       DHD_ERROR(("COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n", dlen));
+                       errcode = -1;
+               }
+               bus->f2rxdata++;
+               ASSERT(errcode != BCME_PENDING);
+
+               /* On failure, kill the superframe, allow a couple retries */
+               if (errcode < 0) {
+                       DHD_ERROR(("%s: glom read of %d bytes failed: %d\n",
+                                  __FUNCTION__, dlen, errcode));
+                       bus->dhd->rx_errors++; /* XXX Account for rtx?? */
+
+                       if (bus->glomerr++ < 3) {
+                               dhdsdio_rxfail(bus, TRUE, TRUE);
+                       } else {
+                               bus->glomerr = 0;
+                               dhdsdio_rxfail(bus, TRUE, FALSE);
+                               dhd_os_sdlock_rxq(bus->dhd);
+                               PKTFREE(osh, bus->glom, FALSE);
+                               dhd_os_sdunlock_rxq(bus->dhd);
+                               bus->rxglomfail++;
+                               bus->glom = NULL;
+                       }
+                       return 0;
+               }
+
+#ifdef DHD_DEBUG
+               if (DHD_GLOM_ON()) {
+                       prhex("SUPERFRAME", PKTDATA(osh, pfirst),
+                             MIN(PKTLEN(osh, pfirst), 48));
+               }
+#endif
+
+               /* Validate the superframe header */
+               dptr = (uint8 *)PKTDATA(osh, pfirst);
+               sublen = ltoh16_ua(dptr);
+               check = ltoh16_ua(dptr + sizeof(uint16));
+
+               chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
+               seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
+               bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
+               if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
+                       DHD_INFO(("%s: got frame w/nextlen too large (%d) seq %d\n",
+                                 __FUNCTION__, bus->nextlen, seq));
+                       bus->nextlen = 0;
+               }
+               doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+               txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+
+               errcode = 0;
+               if ((uint16)~(sublen^check)) {
+                       DHD_ERROR(("%s (superframe): HW hdr error: len/check 0x%04x/0x%04x\n",
+                                  __FUNCTION__, sublen, check));
+                       errcode = -1;
+               } else if (ROUNDUP(sublen, bus->blocksize) != dlen) {
+                       DHD_ERROR(("%s (superframe): len 0x%04x, rounded 0x%04x, expect 0x%04x\n",
+                                  __FUNCTION__, sublen, ROUNDUP(sublen, bus->blocksize), dlen));
+                       errcode = -1;
+               } else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) != SDPCM_GLOM_CHANNEL) {
+                       DHD_ERROR(("%s (superframe): bad channel %d\n", __FUNCTION__,
+                                  SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN])));
+                       errcode = -1;
+               } else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
+                       DHD_ERROR(("%s (superframe): got second descriptor?\n", __FUNCTION__));
+                       errcode = -1;
+               } else if ((doff < SDPCM_HDRLEN) ||
+                          (doff > (PKTLEN(osh, pfirst) - SDPCM_HDRLEN))) {
+                       DHD_ERROR(("%s (superframe): Bad data offset %d: HW %d pkt %d min %d\n",
+                               __FUNCTION__, doff, sublen, PKTLEN(osh, pfirst),
+                               SDPCM_HDRLEN));
+                       errcode = -1;
+               }
+
+               /* Check sequence number of superframe SW header */
+               if (rxseq != seq) {
+                       DHD_INFO(("%s: (superframe) rx_seq %d, expected %d\n",
+                                 __FUNCTION__, seq, rxseq));
+                       bus->rx_badseq++;
+                       rxseq = seq;
+               }
+
+               /* Check window for sanity */
+               if ((uint8)(txmax - bus->tx_seq) > 0x70) {
+                       DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
+                                  __FUNCTION__, txmax, bus->tx_seq));
+                       txmax = bus->tx_max;
+               }
+               bus->tx_max = txmax;
+
+               /* Remove superframe header, remember offset */
+               PKTPULL(osh, pfirst, doff);
+               sfdoff = doff;
+
+               /* Validate all the subframe headers */
+               for (num = 0, pnext = pfirst; pnext && !errcode;
+                    num++, pnext = PKTNEXT(osh, pnext)) {
+                       dptr = (uint8 *)PKTDATA(osh, pnext);
+                       dlen = (uint16)PKTLEN(osh, pnext);
+                       sublen = ltoh16_ua(dptr);
+                       check = ltoh16_ua(dptr + sizeof(uint16));
+                       chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
+                       doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+#ifdef DHD_DEBUG
+                       if (DHD_GLOM_ON()) {
+                               prhex("subframe", dptr, 32);
+                       }
+#endif
+
+                       if ((uint16)~(sublen^check)) {
+                               DHD_ERROR(("%s (subframe %d): HW hdr error: "
+                                          "len/check 0x%04x/0x%04x\n",
+                                          __FUNCTION__, num, sublen, check));
+                               errcode = -1;
+                       } else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
+                               DHD_ERROR(("%s (subframe %d): length mismatch: "
+                                          "len 0x%04x, expect 0x%04x\n",
+                                          __FUNCTION__, num, sublen, dlen));
+                               errcode = -1;
+                       } else if ((chan != SDPCM_DATA_CHANNEL) &&
+                                  (chan != SDPCM_EVENT_CHANNEL)) {
+                               DHD_ERROR(("%s (subframe %d): bad channel %d\n",
+                                          __FUNCTION__, num, chan));
+                               errcode = -1;
+                       } else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
+                               DHD_ERROR(("%s (subframe %d): Bad data offset %d: HW %d min %d\n",
+                                          __FUNCTION__, num, doff, sublen, SDPCM_HDRLEN));
+                               errcode = -1;
+                       }
+               }
+
+               if (errcode) {
+                       /* Terminate frame on error, request a couple retries */
+                       if (bus->glomerr++ < 3) {
+                               /* Restore superframe header space */
+                               PKTPUSH(osh, pfirst, sfdoff);
+                               dhdsdio_rxfail(bus, TRUE, TRUE);
+                       } else {
+                               bus->glomerr = 0;
+                               dhdsdio_rxfail(bus, TRUE, FALSE);
+                               dhd_os_sdlock_rxq(bus->dhd);
+                               PKTFREE(osh, bus->glom, FALSE);
+                               dhd_os_sdunlock_rxq(bus->dhd);
+                               bus->rxglomfail++;
+                               bus->glom = NULL;
+                       }
+                       bus->nextlen = 0;
+                       return 0;
+               }
+
+               /* Basic SD framing looks ok - process each packet (header) */
+               bus->glom = NULL;
+               plast = NULL;
+
+               dhd_os_sdlock_rxq(bus->dhd);
+               for (num = 0; pfirst; rxseq++, pfirst = pnext) {
+                       pnext = PKTNEXT(osh, pfirst);
+                       PKTSETNEXT(osh, pfirst, NULL);
+
+                       dptr = (uint8 *)PKTDATA(osh, pfirst);
+                       sublen = ltoh16_ua(dptr);
+                       chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
+                       seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
+                       doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+
+                       DHD_GLOM(("%s: Get subframe %d, %p(%p/%d), sublen %d chan %d seq %d\n",
+                                 __FUNCTION__, num, pfirst, PKTDATA(osh, pfirst),
+                                 PKTLEN(osh, pfirst), sublen, chan, seq));
+
+                       ASSERT((chan == SDPCM_DATA_CHANNEL) || (chan == SDPCM_EVENT_CHANNEL));
+
+                       if (rxseq != seq) {
+                               DHD_GLOM(("%s: rx_seq %d, expected %d\n",
+                                         __FUNCTION__, seq, rxseq));
+                               bus->rx_badseq++;
+                               rxseq = seq;
+                       }
+
+#ifdef DHD_DEBUG
+                       if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+                               prhex("Rx Subframe Data", dptr, dlen);
+                       }
+#endif
+
+                       PKTSETLEN(osh, pfirst, sublen);
+                       PKTPULL(osh, pfirst, doff);
+
+                       reorder_info_len = sizeof(reorder_info_buf);
+
+                       if (PKTLEN(osh, pfirst) == 0) {
+                               PKTFREE(bus->dhd->osh, pfirst, FALSE);
+                               continue;
+                       } else if (dhd_prot_hdrpull(bus->dhd, &ifidx, pfirst, reorder_info_buf,
+                               &reorder_info_len) != 0) {
+                               DHD_ERROR(("%s: rx protocol error\n", __FUNCTION__));
+                               bus->dhd->rx_errors++;
+                               PKTFREE(osh, pfirst, FALSE);
+                               continue;
+                       }
+                       if (reorder_info_len) {
+                               uint32 free_buf_count;
+                               void *ppfirst;
+
+                               ppfirst = pfirst;
+                               /* Reordering info from the firmware */
+                               dhd_process_pkt_reorder_info(bus->dhd, reorder_info_buf,
+                                       reorder_info_len, &ppfirst, &free_buf_count);
+
+                               if (free_buf_count == 0) {
+                                       continue;
+                               } else {
+                                       void *temp;
+
+                                       /*  go to the end of the chain and attach the pnext there */
+                                       temp = ppfirst;
+                                       while (PKTNEXT(osh, temp) != NULL) {
+                                               temp = PKTNEXT(osh, temp);
+                                       }
+                                       pfirst = temp;
+                                       if (list_tail[ifidx] == NULL)
+                                               list_head[ifidx] = ppfirst;
+                                       else
+                                               PKTSETNEXT(osh, list_tail[ifidx], ppfirst);
+                                       list_tail[ifidx] = pfirst;
+                               }
+
+                               num += (uint8)free_buf_count;
+                       } else {
+                               /* this packet will go up, link back into chain and count it */
+
+                               if (list_tail[ifidx] == NULL) {
+                                       list_head[ifidx] = list_tail[ifidx] = pfirst;
+                               } else {
+                                       PKTSETNEXT(osh, list_tail[ifidx], pfirst);
+                                       list_tail[ifidx] = pfirst;
+                               }
+                               num++;
+                       }
+#ifdef DHD_DEBUG
+                       if (DHD_GLOM_ON()) {
+                               DHD_GLOM(("%s subframe %d to stack, %p(%p/%d) nxt/lnk %p/%p\n",
+                                         __FUNCTION__, num, pfirst,
+                                         PKTDATA(osh, pfirst), PKTLEN(osh, pfirst),
+                                         PKTNEXT(osh, pfirst), PKTLINK(pfirst)));
+                               prhex("", (uint8 *)PKTDATA(osh, pfirst),
+                                     MIN(PKTLEN(osh, pfirst), 32));
+                       }
+#endif /* DHD_DEBUG */
+               }
+               dhd_os_sdunlock_rxq(bus->dhd);
+
+               for (idx = 0; idx < DHD_MAX_IFS; idx++) {
+                       if (list_head[idx]) {
+                               void *temp;
+                               uint8 cnt = 0;
+                               temp = list_head[idx];
+                               do {
+                                       temp = PKTNEXT(osh, temp);
+                                       cnt++;
+                               } while (temp);
+                               if (cnt) {
+                                       dhd_os_sdunlock(bus->dhd);
+                                       dhd_rx_frame(bus->dhd, idx, list_head[idx], cnt, 0);
+                                       dhd_os_sdlock(bus->dhd);
+                               }
+                       }
+               }
+               bus->rxglomframes++;
+               bus->rxglompkts += num;
+       }
+       return num;
+}
+
+/* Return TRUE if there may be more frames to read */
+static uint
+dhdsdio_readframes(dhd_bus_t *bus, uint maxframes, bool *finished)
+{
+       osl_t *osh = bus->dhd->osh;
+       bcmsdh_info_t *sdh = bus->sdh;
+
+       uint16 len, check;      /* Extracted hardware header fields */
+       uint8 chan, seq, doff;  /* Extracted software header fields */
+       uint8 fcbits;           /* Extracted fcbits from software header */
+       uint8 delta;
+
+       void *pkt;      /* Packet for event or data frames */
+       uint16 pad;     /* Number of pad bytes to read */
+       uint16 rdlen;   /* Total number of bytes to read */
+       uint8 rxseq;    /* Next sequence number to expect */
+       uint rxleft = 0;        /* Remaining number of frames allowed */
+       int sdret;      /* Return code from bcmsdh calls */
+       uint8 txmax;    /* Maximum tx sequence offered */
+#ifdef BCMSPI
+       uint32 dstatus = 0;     /* gSPI device status bits of */
+#endif /* BCMSPI */
+       bool len_consistent; /* Result of comparing readahead len and len from hw-hdr */
+       uint8 *rxbuf;
+       int ifidx = 0;
+       uint rxcount = 0; /* Total frames read */
+       uchar reorder_info_buf[WLHOST_REORDERDATA_TOTLEN];
+       uint reorder_info_len;
+       uint pkt_count;
+
+#if defined(DHD_DEBUG) || defined(SDTEST)
+       bool sdtest = FALSE;    /* To limit message spew from test mode */
+#endif
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+       bus->readframes = TRUE;
+
+       if (!KSO_ENAB(bus)) {
+               DHD_ERROR(("%s: KSO off\n", __FUNCTION__));
+               bus->readframes = FALSE;
+               return 0;
+       }
+
+       ASSERT(maxframes);
+
+#ifdef SDTEST
+       /* Allow pktgen to override maxframes */
+       if (bus->pktgen_count && (bus->pktgen_mode == DHD_PKTGEN_RECV)) {
+               maxframes = bus->pktgen_count;
+               sdtest = TRUE;
+       }
+#endif
+
+       /* Not finished unless we encounter no more frames indication */
+       *finished = FALSE;
+
+#ifdef BCMSPI
+       /* Get pktlen from gSPI device F0 reg. */
+       if (bus->bus == SPI_BUS) {
+               /* Peek in dstatus bits and find out size to do rx-read. */
+               dstatus = bcmsdh_get_dstatus(bus->sdh);
+               if (dstatus == 0)
+                       DHD_ERROR(("%s:ZERO spi dstatus, a case observed in PR61352 hit !!!\n",
+                                  __FUNCTION__));
+
+               DHD_TRACE(("Device status from regread = 0x%x\n", dstatus));
+               DHD_TRACE(("Device status from bit-reconstruction = 0x%x\n",
+                         bcmsdh_get_dstatus((void *)bus->sdh)));
+
+               /* Check underflow also, WAR for PR55150 */
+               if ((dstatus & STATUS_F2_PKT_AVAILABLE) && (((dstatus & STATUS_UNDERFLOW)) == 0)) {
+                       bus->nextlen = ((dstatus & STATUS_F2_PKT_LEN_MASK) >>
+                                       STATUS_F2_PKT_LEN_SHIFT);
+                       /* '0' size with pkt-available interrupt is eqvt to 2048 bytes */
+                       bus->nextlen = (bus->nextlen == 0) ? SPI_MAX_PKT_LEN : bus->nextlen;
+                       if (bus->dwordmode)
+                               bus->nextlen = bus->nextlen << 2;
+                       DHD_TRACE(("Entering %s: length to be read from gSPI = %d\n",
+                                 __FUNCTION__, bus->nextlen));
+               } else {
+                       if (dstatus & STATUS_F2_PKT_AVAILABLE)
+                               DHD_ERROR(("Underflow during %s.\n", __FUNCTION__));
+                       else
+                               DHD_ERROR(("False pkt-available intr.\n"));
+                       *finished = TRUE;
+                       return (maxframes - rxleft);
+               }
+       }
+#endif /* BCMSPI */
+
+       for (rxseq = bus->rx_seq, rxleft = maxframes;
+            !bus->rxskip && rxleft && bus->dhd->busstate != DHD_BUS_DOWN;
+            rxseq++, rxleft--) {
+#ifdef DHDTCPACK_SUP_DBG
+               if (bus->dhd->tcpack_sup_mode != TCPACK_SUP_DELAYTX) {
+                       if (bus->dotxinrx == FALSE)
+                               DHD_ERROR(("%s %d: dotxinrx FALSE with tcpack_sub_mode %d\n",
+                                       __FUNCTION__, __LINE__, bus->dhd->tcpack_sup_mode));
+               }
+#ifdef DEBUG_COUNTER
+               else if (pktq_mlen(&bus->txq, ~bus->flowcontrol) > 0) {
+                       tack_tbl.cnt[bus->dotxinrx ? 6 : 7]++;
+               }
+#endif /* DEBUG_COUNTER */
+#endif /* DHDTCPACK_SUP_DBG */
+               /* tx more to improve rx performance */
+               if (TXCTLOK(bus) && bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL)) {
+                       dhdsdio_sendpendctl(bus);
+               } else if (bus->dotxinrx && (bus->clkstate == CLK_AVAIL) &&
+                       !bus->fcstate && DATAOK(bus) &&
+                       (pktq_mlen(&bus->txq, ~bus->flowcontrol) > bus->txinrx_thres)) {
+                       dhdsdio_sendfromq(bus, dhd_txbound);
+#ifdef DHDTCPACK_SUPPRESS
+                       /* In TCPACK_SUP_DELAYTX mode, do txinrx only if
+                        * 1. Any DATA packet to TX
+                        * 2. TCPACK to TCPDATA PSH packets.
+                        * in bus txq.
+                        */
+                       bus->dotxinrx = (bus->dhd->tcpack_sup_mode == TCPACK_SUP_DELAYTX) ?
+                               FALSE : TRUE;
+#endif
+               }
+
+               /* Handle glomming separately */
+               if (bus->glom || bus->glomd) {
+                       uint8 cnt;
+                       DHD_GLOM(("%s: calling rxglom: glomd %p, glom %p\n",
+                                 __FUNCTION__, bus->glomd, bus->glom));
+                       cnt = dhdsdio_rxglom(bus, rxseq);
+                       DHD_GLOM(("%s: rxglom returned %d\n", __FUNCTION__, cnt));
+                       rxseq += cnt - 1;
+                       rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
+                       continue;
+               }
+
+               /* Try doing single read if we can */
+               if (dhd_readahead && bus->nextlen) {
+                       uint16 nextlen = bus->nextlen;
+                       bus->nextlen = 0;
+
+                       if (bus->bus == SPI_BUS) {
+                               rdlen = len = nextlen;
+                       } else {
+                               rdlen = len = nextlen << 4;
+
+                               /* Pad read to blocksize for efficiency */
+                               if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
+                                       pad = bus->blocksize - (rdlen % bus->blocksize);
+                                       if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
+                                               ((rdlen + pad + firstread) < MAX_RX_DATASZ))
+                                               rdlen += pad;
+                               } else if (rdlen % DHD_SDALIGN) {
+                                       rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
+                               }
+                       }
+
+                       /* We use bus->rxctl buffer in WinXP for initial control pkt receives.
+                        * Later we use buffer-poll for data as well as control packets.
+                        * This is required because dhd receives full frame in gSPI unlike SDIO.
+                        * After the frame is received we have to distinguish whether it is data
+                        * or non-data frame.
+                        */
+                       /* Allocate a packet buffer */
+                       dhd_os_sdlock_rxq(bus->dhd);
+                       if (!(pkt = PKTGET(osh, rdlen + DHD_SDALIGN, FALSE))) {
+                               if (bus->bus == SPI_BUS) {
+                                       bus->usebufpool = FALSE;
+                                       bus->rxctl = bus->rxbuf;
+                                       if (dhd_alignctl) {
+                                               bus->rxctl += firstread;
+                                               if ((pad = ((uintptr)bus->rxctl % DHD_SDALIGN)))
+                                                       bus->rxctl += (DHD_SDALIGN - pad);
+                                               bus->rxctl -= firstread;
+                                       }
+                                       ASSERT(bus->rxctl >= bus->rxbuf);
+                                       rxbuf = bus->rxctl;
+                                       /* Read the entire frame */
+                                       sdret = dhd_bcmsdh_recv_buf(bus,
+                                                                   bcmsdh_cur_sbwad(sdh),
+                                                                   SDIO_FUNC_2,
+                                                                   F2SYNC, rxbuf, rdlen,
+                                                                   NULL, NULL, NULL);
+                                       bus->f2rxdata++;
+                                       ASSERT(sdret != BCME_PENDING);
+
+#ifdef BCMSPI
+                                       /* PR55150 WAR: Wait for next pkt-available interrupt for
+                                        * further processing
+                                        */
+                                       if (bcmsdh_get_dstatus((void *)bus->sdh) &
+                                                       STATUS_UNDERFLOW) {
+                                               bus->nextlen = 0;
+                                               *finished = TRUE;
+                                               DHD_ERROR(("%s: read %d control bytes failed "
+                                                          "due to spi underflow\n",
+                                                          __FUNCTION__, rdlen));
+                                               /* dhd.rx_ctlerrs is higher level */
+                                               bus->rxc_errors++;
+                                               dhd_os_sdunlock_rxq(bus->dhd);
+                                               continue;
+                                       }
+#endif /* BCMSPI */
+
+                                       /* Control frame failures need retransmission */
+                                       if (sdret < 0) {
+                                               DHD_ERROR(("%s: read %d control bytes failed: %d\n",
+                                                  __FUNCTION__, rdlen, sdret));
+                                               /* dhd.rx_ctlerrs is higher level */
+                                               bus->rxc_errors++;
+                                               dhd_os_sdunlock_rxq(bus->dhd);
+                                               dhdsdio_rxfail(bus, TRUE,
+                                                   (bus->bus == SPI_BUS) ? FALSE : TRUE);
+                                               continue;
+                                       }
+                               } else {
+                                       /* Give up on data, request rtx of events */
+                                       DHD_ERROR(("%s (nextlen): PKTGET failed: len %d rdlen %d "
+                                                  "expected rxseq %d\n",
+                                                  __FUNCTION__, len, rdlen, rxseq));
+                                       /* XXX Can't issue retry (NAK), frame not started. */
+                                       /* Just go try again w/normal header read */
+                                       dhd_os_sdunlock_rxq(bus->dhd);
+                                       continue;
+                               }
+                       } else {
+                               if (bus->bus == SPI_BUS)
+                                       bus->usebufpool = TRUE;
+
+                               ASSERT(!PKTLINK(pkt));
+                               PKTALIGN(osh, pkt, rdlen, DHD_SDALIGN);
+                               rxbuf = (uint8 *)PKTDATA(osh, pkt);
+                               /* Read the entire frame */
+                               sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh),
+                                                           SDIO_FUNC_2,
+                                                           F2SYNC, rxbuf, rdlen,
+                                                           pkt, NULL, NULL);
+                               bus->f2rxdata++;
+                               ASSERT(sdret != BCME_PENDING);
+#ifdef BCMSPI
+                               /* PR55150 WAR: Wait for next pkt-available interrupt for further
+                                * processing
+                                */
+                               if (bcmsdh_get_dstatus((void *)bus->sdh) & STATUS_UNDERFLOW) {
+                                       bus->nextlen = 0;
+                                       *finished = TRUE;
+                                       DHD_ERROR(("%s (nextlen): read %d bytes failed due "
+                                                  "to spi underflow\n",
+                                                  __FUNCTION__, rdlen));
+                                       PKTFREE(bus->dhd->osh, pkt, FALSE);
+                                       bus->dhd->rx_errors++;
+                                       dhd_os_sdunlock_rxq(bus->dhd);
+                                       continue;
+                               }
+#endif /* BCMSPI */
+
+                               if (sdret < 0) {
+                                       DHD_ERROR(("%s (nextlen): read %d bytes failed: %d\n",
+                                          __FUNCTION__, rdlen, sdret));
+                                       PKTFREE(bus->dhd->osh, pkt, FALSE);
+                                       bus->dhd->rx_errors++; /* XXX Account for rtx?? */
+                                       dhd_os_sdunlock_rxq(bus->dhd);
+                                       /* Force retry w/normal header read.  Don't attempt NAK for
+                                        * gSPI
+                                        */
+                                       dhdsdio_rxfail(bus, TRUE,
+                                             (bus->bus == SPI_BUS) ? FALSE : TRUE);
+                                       continue;
+                               }
+                       }
+                       dhd_os_sdunlock_rxq(bus->dhd);
+
+                       /* Now check the header */
+                       bcopy(rxbuf, bus->rxhdr, SDPCM_HDRLEN);
+
+                       /* Extract hardware header fields */
+                       len = ltoh16_ua(bus->rxhdr);
+                       check = ltoh16_ua(bus->rxhdr + sizeof(uint16));
+
+                       /* All zeros means readahead info was bad */
+                       if (!(len|check)) {
+                               DHD_INFO(("%s (nextlen): read zeros in HW header???\n",
+                                          __FUNCTION__));
+                               dhd_os_sdlock_rxq(bus->dhd);
+                               PKTFREE2();
+                               dhd_os_sdunlock_rxq(bus->dhd);
+                               GSPI_PR55150_BAILOUT;
+                               continue;
+                       }
+
+                       /* Validate check bytes */
+                       if ((uint16)~(len^check)) {
+                               DHD_ERROR(("%s (nextlen): HW hdr error: nextlen/len/check"
+                                          " 0x%04x/0x%04x/0x%04x\n", __FUNCTION__, nextlen,
+                                          len, check));
+                               dhd_os_sdlock_rxq(bus->dhd);
+                               PKTFREE2();
+                               dhd_os_sdunlock_rxq(bus->dhd);
+                               bus->rx_badhdr++;
+                               dhdsdio_rxfail(bus, FALSE, FALSE);
+                               GSPI_PR55150_BAILOUT;
+                               continue;
+                       }
+
+                       /* Validate frame length */
+                       if (len < SDPCM_HDRLEN) {
+                               /* XXX Might choose to allow length 4 for signaling */
+                               DHD_ERROR(("%s (nextlen): HW hdr length invalid: %d\n",
+                                          __FUNCTION__, len));
+                               dhd_os_sdlock_rxq(bus->dhd);
+                               PKTFREE2();
+                               dhd_os_sdunlock_rxq(bus->dhd);
+                               GSPI_PR55150_BAILOUT;
+                               continue;
+                       }
+
+                       /* Check for consistency with readahead info */
+#ifdef BCMSPI
+                       if (bus->bus == SPI_BUS) {
+                               if (bus->dwordmode) {
+                                       uint16 spilen;
+                                       spilen = ROUNDUP(len, 4);
+                                       len_consistent = (nextlen != spilen);
+                               } else
+                                       len_consistent = (nextlen != len);
+                       } else
+#endif  /* BCMSPI */
+                               len_consistent = (nextlen != (ROUNDUP(len, 16) >> 4));
+                       if (len_consistent) {
+                               /* Mismatch, force retry w/normal header (may be >4K) */
+                               DHD_ERROR(("%s (nextlen): mismatch, nextlen %d len %d rnd %d; "
+                                          "expected rxseq %d\n",
+                                          __FUNCTION__, nextlen, len, ROUNDUP(len, 16), rxseq));
+                               dhd_os_sdlock_rxq(bus->dhd);
+                               PKTFREE2();
+                               dhd_os_sdunlock_rxq(bus->dhd);
+                               dhdsdio_rxfail(bus, TRUE, (bus->bus == SPI_BUS) ? FALSE : TRUE);
+                               GSPI_PR55150_BAILOUT;
+                               continue;
+                       }
+
+                       /* Extract software header fields */
+                       chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                       seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                       doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                       txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+#ifdef BCMSPI
+                       /* Save the readahead length if there is one */
+                       if (bus->bus == SPI_BUS) {
+                               /* Use reconstructed dstatus bits and find out readahead size */
+                               dstatus = bcmsdh_get_dstatus((void *)bus->sdh);
+                               DHD_INFO(("Device status from bit-reconstruction = 0x%x\n",
+                               bcmsdh_get_dstatus((void *)bus->sdh)));
+                               if (dstatus & STATUS_F2_PKT_AVAILABLE) {
+                                       bus->nextlen = ((dstatus & STATUS_F2_PKT_LEN_MASK) >>
+                                                       STATUS_F2_PKT_LEN_SHIFT);
+                                       bus->nextlen = (bus->nextlen == 0) ?
+                                                  SPI_MAX_PKT_LEN : bus->nextlen;
+                                       if (bus->dwordmode)
+                                               bus->nextlen = bus->nextlen << 2;
+                                       DHD_INFO(("readahead len from gSPI = %d \n",
+                                                  bus->nextlen));
+                                       bus->dhd->rx_readahead_cnt ++;
+                               } else {
+                                       bus->nextlen = 0;
+                                       *finished = TRUE;
+                               }
+                       } else {
+#endif /* BCMSPI */
+                               bus->nextlen =
+                                        bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
+                               if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
+                                       DHD_INFO(("%s (nextlen): got frame w/nextlen too large"
+                                                 " (%d), seq %d\n", __FUNCTION__, bus->nextlen,
+                                                 seq));
+                                       bus->nextlen = 0;
+                               }
+
+                               bus->dhd->rx_readahead_cnt ++;
+#ifdef BCMSPI
+                       }
+#endif /* BCMSPI */
+                       /* Handle Flow Control */
+                       fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+                       delta = 0;
+                       if (~bus->flowcontrol & fcbits) {
+                               bus->fc_xoff++;
+                               delta = 1;
+                       }
+                       if (bus->flowcontrol & ~fcbits) {
+                               bus->fc_xon++;
+                               delta = 1;
+                       }
+
+                       if (delta) {
+                               bus->fc_rcvd++;
+                               bus->flowcontrol = fcbits;
+                       }
+
+                       /* Check and update sequence number */
+                       if (rxseq != seq) {
+                               DHD_INFO(("%s (nextlen): rx_seq %d, expected %d\n",
+                                         __FUNCTION__, seq, rxseq));
+                               bus->rx_badseq++;
+                               rxseq = seq;
+                       }
+
+                       /* Check window for sanity */
+                       if ((uint8)(txmax - bus->tx_seq) > 0x70) {
+#ifdef BCMSPI
+                               if ((bus->bus == SPI_BUS) && !(dstatus & STATUS_F2_RX_READY)) {
+                                       DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
+                                               __FUNCTION__, txmax, bus->tx_seq));
+                                       txmax = bus->tx_seq + 2;
+                               } else {
+#endif /* BCMSPI */
+                                       DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
+                                               __FUNCTION__, txmax, bus->tx_seq));
+                                       txmax = bus->tx_max;
+#ifdef BCMSPI
+                               }
+#endif /* BCMSPI */
+                       }
+                       bus->tx_max = txmax;
+
+#ifdef DHD_DEBUG
+                       if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+                               prhex("Rx Data", rxbuf, len);
+                       } else if (DHD_HDRS_ON()) {
+                               prhex("RxHdr", bus->rxhdr, SDPCM_HDRLEN);
+                       }
+#endif
+
+                       if (chan == SDPCM_CONTROL_CHANNEL) {
+                               if (bus->bus == SPI_BUS) {
+                                       dhdsdio_read_control(bus, rxbuf, len, doff);
+                                       if (bus->usebufpool) {
+                                               dhd_os_sdlock_rxq(bus->dhd);
+                                               PKTFREE(bus->dhd->osh, pkt, FALSE);
+                                               dhd_os_sdunlock_rxq(bus->dhd);
+                                       }
+                                       continue;
+                               } else {
+                                       DHD_ERROR(("%s (nextlen): readahead on control"
+                                                  " packet %d?\n", __FUNCTION__, seq));
+                                       /* Force retry w/normal header read */
+                                       bus->nextlen = 0;
+                                       dhdsdio_rxfail(bus, FALSE, TRUE);
+                                       dhd_os_sdlock_rxq(bus->dhd);
+                                       PKTFREE2();
+                                       dhd_os_sdunlock_rxq(bus->dhd);
+                                       continue;
+                               }
+                       }
+
+                       if ((bus->bus == SPI_BUS) && !bus->usebufpool) {
+                               DHD_ERROR(("Received %d bytes on %d channel. Running out of "
+                                          "rx pktbuf's or not yet malloced.\n", len, chan));
+                               continue;
+                       }
+
+                       /* Validate data offset */
+                       if ((doff < SDPCM_HDRLEN) || (doff > len)) {
+                               DHD_ERROR(("%s (nextlen): bad data offset %d: HW len %d min %d\n",
+                                          __FUNCTION__, doff, len, SDPCM_HDRLEN));
+                               dhd_os_sdlock_rxq(bus->dhd);
+                               PKTFREE2();
+                               dhd_os_sdunlock_rxq(bus->dhd);
+                               ASSERT(0);
+                               dhdsdio_rxfail(bus, FALSE, FALSE);
+                               continue;
+                       }
+
+                       /* All done with this one -- now deliver the packet */
+                       goto deliver;
+               }
+               /* gSPI frames should not be handled in fractions */
+               if (bus->bus == SPI_BUS) {
+                       break;
+               }
+
+               /* Read frame header (hardware and software) */
+               sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+                                           bus->rxhdr, firstread, NULL, NULL, NULL);
+               bus->f2rxhdrs++;
+               ASSERT(sdret != BCME_PENDING);
+
+               if (sdret < 0) {
+                       DHD_ERROR(("%s: RXHEADER FAILED: %d\n", __FUNCTION__, sdret));
+                       bus->rx_hdrfail++;
+                       dhdsdio_rxfail(bus, TRUE, TRUE);
+                       continue;
+               }
+
+#ifdef DHD_DEBUG
+               if (DHD_BYTES_ON() || DHD_HDRS_ON()) {
+                       prhex("RxHdr", bus->rxhdr, SDPCM_HDRLEN);
+               }
+#endif
+
+               /* Extract hardware header fields */
+               len = ltoh16_ua(bus->rxhdr);
+               check = ltoh16_ua(bus->rxhdr + sizeof(uint16));
+
+               /* All zeros means no more frames */
+               if (!(len|check)) {
+                       *finished = TRUE;
+                       break;
+               }
+
+               /* Validate check bytes */
+               if ((uint16)~(len^check)) {
+                       DHD_ERROR(("%s: HW hdr error: len/check 0x%04x/0x%04x\n",
+                                  __FUNCTION__, len, check));
+                       bus->rx_badhdr++;
+                       dhdsdio_rxfail(bus, FALSE, FALSE);
+                       continue;
+               }
+
+               /* Validate frame length */
+               if (len < SDPCM_HDRLEN) {
+                       /* XXX Might choose to allow length 4 for signaling */
+                       DHD_ERROR(("%s: HW hdr length invalid: %d\n", __FUNCTION__, len));
+                       continue;
+               }
+
+               /* Extract software header fields */
+               chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+               seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+               doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+               txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+               /* Validate data offset */
+               if ((doff < SDPCM_HDRLEN) || (doff > len)) {
+                       DHD_ERROR(("%s: Bad data offset %d: HW len %d, min %d seq %d\n",
+                                  __FUNCTION__, doff, len, SDPCM_HDRLEN, seq));
+                       bus->rx_badhdr++;
+                       ASSERT(0);
+                       dhdsdio_rxfail(bus, FALSE, FALSE);
+                       continue;
+               }
+
+               /* Save the readahead length if there is one */
+               bus->nextlen = bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
+               if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
+                       DHD_INFO(("%s (nextlen): got frame w/nextlen too large (%d), seq %d\n",
+                                 __FUNCTION__, bus->nextlen, seq));
+                       bus->nextlen = 0;
+               }
+
+               /* Handle Flow Control */
+               fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+               delta = 0;
+               if (~bus->flowcontrol & fcbits) {
+                       bus->fc_xoff++;
+                       delta = 1;
+               }
+               if (bus->flowcontrol & ~fcbits) {
+                       bus->fc_xon++;
+                       delta = 1;
+               }
+
+               if (delta) {
+                       bus->fc_rcvd++;
+                       bus->flowcontrol = fcbits;
+               }
+
+               /* Check and update sequence number */
+               if (rxseq != seq) {
+                       DHD_INFO(("%s: rx_seq %d, expected %d\n", __FUNCTION__, seq, rxseq));
+                       bus->rx_badseq++;
+                       rxseq = seq;
+               }
+
+               /* Check window for sanity */
+               if ((uint8)(txmax - bus->tx_seq) > 0x70) {
+                       DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
+                                  __FUNCTION__, txmax, bus->tx_seq));
+                       txmax = bus->tx_max;
+               }
+               bus->tx_max = txmax;
+
+               /* Call a separate function for control frames */
+               if (chan == SDPCM_CONTROL_CHANNEL) {
+                       dhdsdio_read_control(bus, bus->rxhdr, len, doff);
+                       continue;
+               }
+
+               ASSERT((chan == SDPCM_DATA_CHANNEL) || (chan == SDPCM_EVENT_CHANNEL) ||
+                      (chan == SDPCM_TEST_CHANNEL) || (chan == SDPCM_GLOM_CHANNEL));
+
+               /* Length to read */
+               rdlen = (len > firstread) ? (len - firstread) : 0;
+
+               /* May pad read to blocksize for efficiency */
+               if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
+                       pad = bus->blocksize - (rdlen % bus->blocksize);
+                       if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
+                           ((rdlen + pad + firstread) < MAX_RX_DATASZ))
+                               rdlen += pad;
+               } else if (rdlen % DHD_SDALIGN) {
+                       rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
+               }
+
+               /* Satisfy length-alignment requirements */
+               if (forcealign && (rdlen & (ALIGNMENT - 1)))
+                       rdlen = ROUNDUP(rdlen, ALIGNMENT);
+
+               if ((rdlen + firstread) > MAX_RX_DATASZ) {
+                       /* Too long -- skip this frame */
+                       DHD_ERROR(("%s: too long: len %d rdlen %d\n", __FUNCTION__, len, rdlen));
+                       bus->dhd->rx_errors++; bus->rx_toolong++;
+                       dhdsdio_rxfail(bus, FALSE, FALSE);
+                       continue;
+               }
+
+               dhd_os_sdlock_rxq(bus->dhd);
+               if (!(pkt = PKTGET(osh, (rdlen + firstread + DHD_SDALIGN), FALSE))) {
+                       /* Give up on data, request rtx of events */
+                       DHD_ERROR(("%s: PKTGET failed: rdlen %d chan %d\n",
+                                  __FUNCTION__, rdlen, chan));
+                       bus->dhd->rx_dropped++;
+                       dhd_os_sdunlock_rxq(bus->dhd);
+                       dhdsdio_rxfail(bus, FALSE, RETRYCHAN(chan));
+                       continue;
+               }
+               dhd_os_sdunlock_rxq(bus->dhd);
+
+               ASSERT(!PKTLINK(pkt));
+
+               /* XXX Should check len for small packets in case we're done? */
+               /* Leave room for what we already read, and align remainder */
+               ASSERT(firstread < (PKTLEN(osh, pkt)));
+               PKTPULL(osh, pkt, firstread);
+               PKTALIGN(osh, pkt, rdlen, DHD_SDALIGN);
+
+               /* Read the remaining frame data */
+               sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+                                           ((uint8 *)PKTDATA(osh, pkt)), rdlen, pkt, NULL, NULL);
+               bus->f2rxdata++;
+               ASSERT(sdret != BCME_PENDING);
+
+               if (sdret < 0) {
+                       DHD_ERROR(("%s: read %d %s bytes failed: %d\n", __FUNCTION__, rdlen,
+                                  ((chan == SDPCM_EVENT_CHANNEL) ? "event" :
+                                   ((chan == SDPCM_DATA_CHANNEL) ? "data" : "test")), sdret));
+                       dhd_os_sdlock_rxq(bus->dhd);
+                       PKTFREE(bus->dhd->osh, pkt, FALSE);
+                       dhd_os_sdunlock_rxq(bus->dhd);
+                       bus->dhd->rx_errors++; /* XXX Account for rtx?? */
+                       dhdsdio_rxfail(bus, TRUE, RETRYCHAN(chan));
+                       continue;
+               }
+
+               /* Copy the already-read portion */
+               PKTPUSH(osh, pkt, firstread);
+               bcopy(bus->rxhdr, PKTDATA(osh, pkt), firstread);
+
+#ifdef DHD_DEBUG
+               if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+                       prhex("Rx Data", PKTDATA(osh, pkt), len);
+               }
+#endif
+
+deliver:
+               /* Save superframe descriptor and allocate packet frame */
+               if (chan == SDPCM_GLOM_CHANNEL) {
+                       if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
+                               DHD_GLOM(("%s: got glom descriptor, %d bytes:\n",
+                                         __FUNCTION__, len));
+#ifdef DHD_DEBUG
+                               if (DHD_GLOM_ON()) {
+                                       prhex("Glom Data", PKTDATA(osh, pkt), len);
+                               }
+#endif
+                               PKTSETLEN(osh, pkt, len);
+                               ASSERT(doff == SDPCM_HDRLEN);
+                               PKTPULL(osh, pkt, SDPCM_HDRLEN);
+                               bus->glomd = pkt;
+                       } else {
+                               DHD_ERROR(("%s: glom superframe w/o descriptor!\n", __FUNCTION__));
+                               dhdsdio_rxfail(bus, FALSE, FALSE);
+                       }
+                       continue;
+               }
+
+               /* Fill in packet len and prio, deliver upward */
+               PKTSETLEN(osh, pkt, len);
+               PKTPULL(osh, pkt, doff);
+
+#ifdef SDTEST
+               /* Test channel packets are processed separately */
+               if (chan == SDPCM_TEST_CHANNEL) {
+                       dhdsdio_testrcv(bus, pkt, seq);
+                       continue;
+               }
+#endif /* SDTEST */
+
+               if (PKTLEN(osh, pkt) == 0) {
+                       dhd_os_sdlock_rxq(bus->dhd);
+                       PKTFREE(bus->dhd->osh, pkt, FALSE);
+                       dhd_os_sdunlock_rxq(bus->dhd);
+                       continue;
+               } else if (dhd_prot_hdrpull(bus->dhd, &ifidx, pkt, reorder_info_buf,
+                       &reorder_info_len) != 0) {
+                       DHD_ERROR(("%s: rx protocol error\n", __FUNCTION__));
+                       dhd_os_sdlock_rxq(bus->dhd);
+                       PKTFREE(bus->dhd->osh, pkt, FALSE);
+                       dhd_os_sdunlock_rxq(bus->dhd);
+                       bus->dhd->rx_errors++;
+                       continue;
+               }
+
+               if (reorder_info_len) {
+                       /* Reordering info from the firmware */
+                       dhd_process_pkt_reorder_info(bus->dhd, reorder_info_buf, reorder_info_len,
+                               &pkt, &pkt_count);
+                       if (pkt_count == 0)
+                               continue;
+               } else {
+                       pkt_count = 1;
+               }
+
+               /* XXX Release the lock around the rx delivery: an OS (like Windows)
+                * might call tx in the same thread context, resulting in deadlock.
+                */
+               /* Unlock during rx call */
+               dhd_os_sdunlock(bus->dhd);
+               dhd_rx_frame(bus->dhd, ifidx, pkt, pkt_count, chan);
+               dhd_os_sdlock(bus->dhd);
+#if defined(SDIO_ISR_THREAD)
+               /* terence 20150615: fix for below error due to bussleep in watchdog after dhd_os_sdunlock here,
+                 * so call BUS_WAKE to wake up bus again
+                 * dhd_bcmsdh_recv_buf: Device asleep
+                 * dhdsdio_readframes: RXHEADER FAILED: -40
+                 * dhdsdio_rxfail: abort command, terminate frame, send NAK
+               */
+               BUS_WAKE(bus);
+#endif
+       }
+       rxcount = maxframes - rxleft;
+#ifdef DHD_DEBUG
+       /* Message if we hit the limit */
+       if (!rxleft && !sdtest)
+               DHD_DATA(("%s: hit rx limit of %d frames\n", __FUNCTION__, maxframes));
+       else
+#endif /* DHD_DEBUG */
+       DHD_DATA(("%s: processed %d frames\n", __FUNCTION__, rxcount));
+       /* Back off rxseq if awaiting rtx, update rx_seq */
+       if (bus->rxskip)
+               rxseq--;
+       bus->rx_seq = rxseq;
+
+       if (bus->reqbussleep)
+       {
+               dhdsdio_bussleep(bus, TRUE);
+               bus->reqbussleep = FALSE;
+       }
+       bus->readframes = FALSE;
+
+       return rxcount;
+}
+
+static uint32
+dhdsdio_hostmail(dhd_bus_t *bus, uint32 *hmbd)
+{
+       sdpcmd_regs_t *regs = bus->regs;
+       uint32 intstatus = 0;
+       uint32 hmb_data;
+       uint8 fcbits;
+       uint retries = 0;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       /* Read mailbox data and ack that we did so */
+       R_SDREG(hmb_data, &regs->tohostmailboxdata, retries);
+       if (retries <= retry_limit)
+               W_SDREG(SMB_INT_ACK, &regs->tosbmailbox, retries);
+       bus->f1regdata += 2;
+
+       /* Dongle recomposed rx frames, accept them again */
+       if (hmb_data & HMB_DATA_NAKHANDLED) {
+               DHD_INFO(("Dongle reports NAK handled, expect rtx of %d\n", bus->rx_seq));
+               /* XXX ASSERT(bus->rxskip); */
+               if (!bus->rxskip) {
+                       DHD_ERROR(("%s: unexpected NAKHANDLED!\n", __FUNCTION__));
+               }
+               bus->rxskip = FALSE;
+               intstatus |= FRAME_AVAIL_MASK(bus);
+       }
+
+       /*
+        * DEVREADY does not occur with gSPI.
+        */
+       if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
+               bus->sdpcm_ver = (hmb_data & HMB_DATA_VERSION_MASK) >> HMB_DATA_VERSION_SHIFT;
+               if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
+                       DHD_ERROR(("Version mismatch, dongle reports %d, expecting %d\n",
+                                  bus->sdpcm_ver, SDPCM_PROT_VERSION));
+               else
+                       DHD_INFO(("Dongle ready, protocol version %d\n", bus->sdpcm_ver));
+#ifndef BCMSPI
+               /* make sure for the SDIO_DEVICE_RXDATAINT_MODE_1 corecontrol is proper */
+               if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev >= 4) &&
+                   (bus->rxint_mode  == SDIO_DEVICE_RXDATAINT_MODE_1)) {
+                       uint32 val;
+
+                       val = R_REG(bus->dhd->osh, &bus->regs->corecontrol);
+                       val &= ~CC_XMTDATAAVAIL_MODE;
+                       val |= CC_XMTDATAAVAIL_CTRL;
+                       W_REG(bus->dhd->osh, &bus->regs->corecontrol, val);
+
+                       val = R_REG(bus->dhd->osh, &bus->regs->corecontrol);
+               }
+#endif /* BCMSPI */
+
+#ifdef DHD_DEBUG
+               /* Retrieve console state address now that firmware should have updated it */
+               {
+                       sdpcm_shared_t shared;
+                       if (dhdsdio_readshared(bus, &shared) == 0)
+                               bus->console_addr = shared.console_addr;
+               }
+#endif /* DHD_DEBUG */
+       }
+
+       /*
+        * Flow Control has been moved into the RX headers and this out of band
+        * method isn't used any more.  Leave this here for possibly remaining backward
+        * compatible with older dongles
+        */
+       if (hmb_data & HMB_DATA_FC) {
+               fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >> HMB_DATA_FCDATA_SHIFT;
+
+               if (fcbits & ~bus->flowcontrol)
+                       bus->fc_xoff++;
+               if (bus->flowcontrol & ~fcbits)
+                       bus->fc_xon++;
+
+               bus->fc_rcvd++;
+               bus->flowcontrol = fcbits;
+       }
+
+       /* At least print a message if FW halted */
+       if (hmb_data & HMB_DATA_FWHALT) {
+               DHD_ERROR(("FIRMWARE HALTED\n"));
+               dhdsdio_checkdied(bus, NULL, 0);
+       }
+
+       /* Shouldn't be any others */
+       if (hmb_data & ~(HMB_DATA_DEVREADY |
+                        HMB_DATA_FWHALT |
+                        HMB_DATA_NAKHANDLED |
+                        HMB_DATA_FC |
+                        HMB_DATA_FWREADY |
+                        HMB_DATA_FCDATA_MASK |
+                        HMB_DATA_VERSION_MASK)) {
+               DHD_ERROR(("Unknown mailbox data content: 0x%02x\n", hmb_data));
+       }
+
+       if (hmbd) {
+               *hmbd = hmb_data;
+       }
+
+       return intstatus;
+}
+
+static bool
+dhdsdio_dpc(dhd_bus_t *bus)
+{
+       bcmsdh_info_t *sdh = bus->sdh;
+       sdpcmd_regs_t *regs = bus->regs;
+       uint32 intstatus, newstatus = 0;
+       uint retries = 0;
+       uint rxlimit = dhd_rxbound; /* Rx frames to read before resched */
+       uint txlimit = dhd_txbound; /* Tx frames to send before resched */
+       uint framecnt = 0;                /* Temporary counter of tx/rx frames */
+       bool rxdone = TRUE;               /* Flag for no more read data */
+       bool resched = FALSE;     /* Flag indicating resched wanted */
+       unsigned long flags;
+#ifdef DEBUG_DPC_THREAD_WATCHDOG
+       bool is_resched_by_readframe = FALSE;
+#endif /* DEBUG_DPC_THREAD_WATCHDOG */
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       dhd_os_sdlock(bus->dhd);
+       DHD_LINUX_GENERAL_LOCK(bus->dhd, flags);
+       if (bus->dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s: Bus down, ret\n", __FUNCTION__));
+               bus->intstatus = 0;
+               DHD_LINUX_GENERAL_UNLOCK(bus->dhd, flags);
+               dhd_os_sdunlock(bus->dhd);
+               return 0;
+       }
+
+       DHD_BUS_BUSY_SET_IN_DPC(bus->dhd);
+       DHD_LINUX_GENERAL_UNLOCK(bus->dhd, flags);
+
+       /* Start with leftover status bits */
+       intstatus = bus->intstatus;
+
+       if (!SLPAUTO_ENAB(bus) && !KSO_ENAB(bus)) {
+               DHD_ERROR(("%s: Device asleep\n", __FUNCTION__));
+               goto exit;
+       }
+
+       /* If waiting for HTAVAIL, check status */
+       if (!SLPAUTO_ENAB(bus) && (bus->clkstate == CLK_PENDING)) {
+               int err;
+               uint8 clkctl, devctl = 0;
+
+#ifdef DHD_DEBUG
+               /* Check for inconsistent device control */
+               devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+               if (err) {
+                       DHD_ERROR(("%s: error reading DEVCTL: %d\n", __FUNCTION__, err));
+                       DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+                       bus->dhd->busstate = DHD_BUS_DOWN;
+               } else {
+                       ASSERT(devctl & SBSDIO_DEVCTL_CA_INT_ONLY);
+               }
+#endif /* DHD_DEBUG */
+
+               /* Read CSR, if clock on switch to AVAIL, else ignore */
+               clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+               if (err) {
+                       DHD_ERROR(("%s: error reading CSR: %d\n", __FUNCTION__, err));
+                       DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+                       bus->dhd->busstate = DHD_BUS_DOWN;
+               }
+
+               DHD_INFO(("DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n", devctl, clkctl));
+
+               if (SBSDIO_HTAV(clkctl)) {
+                       devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+                       if (err) {
+                               DHD_ERROR(("%s: error reading DEVCTL: %d\n",
+                                          __FUNCTION__, err));
+                               DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+                               bus->dhd->busstate = DHD_BUS_DOWN;
+                       }
+                       devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+                       if (err) {
+                               DHD_ERROR(("%s: error writing DEVCTL: %d\n",
+                                          __FUNCTION__, err));
+                               DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+                               bus->dhd->busstate = DHD_BUS_DOWN;
+                       }
+                       bus->clkstate = CLK_AVAIL;
+               } else {
+                       goto clkwait;
+               }
+       }
+
+       BUS_WAKE(bus);
+
+       /* Make sure backplane clock is on */
+       dhdsdio_clkctl(bus, CLK_AVAIL, TRUE);
+       if (bus->clkstate != CLK_AVAIL)
+               goto clkwait;
+
+       /* Pending interrupt indicates new device status */
+       if (bus->ipend) {
+               bus->ipend = FALSE;
+#if defined(BT_OVER_SDIO)
+       bcmsdh_btsdio_process_f3_intr();
+#endif /* defined (BT_OVER_SDIO) */
+
+               R_SDREG(newstatus, &regs->intstatus, retries);
+               bus->f1regdata++;
+               if (bcmsdh_regfail(bus->sdh))
+                       newstatus = 0;
+               newstatus &= bus->hostintmask;
+               bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
+               if (newstatus) {
+                       bus->f1regdata++;
+#ifndef BCMSPI
+                       if ((bus->rxint_mode == SDIO_DEVICE_RXDATAINT_MODE_0) &&
+                               (newstatus == I_XMTDATA_AVAIL)) {
+                       } else
+#endif /* BCMSPI */
+                               W_SDREG(newstatus, &regs->intstatus, retries);
+               }
+       }
+
+       /* Merge new bits with previous */
+       intstatus |= newstatus;
+       bus->intstatus = 0;
+
+       /* Handle flow-control change: read new state in case our ack
+        * crossed another change interrupt.  If change still set, assume
+        * FC ON for safety, let next loop through do the debounce.
+        */
+       if (intstatus & I_HMB_FC_CHANGE) {
+               intstatus &= ~I_HMB_FC_CHANGE;
+               W_SDREG(I_HMB_FC_CHANGE, &regs->intstatus, retries);
+               R_SDREG(newstatus, &regs->intstatus, retries);
+               bus->f1regdata += 2;
+               bus->fcstate = !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
+               intstatus |= (newstatus & bus->hostintmask);
+       }
+
+       /* Handle host mailbox indication */
+       if (intstatus & I_HMB_HOST_INT) {
+               uint32 hmbdata = 0;
+
+               intstatus &= ~I_HMB_HOST_INT;
+               intstatus |= dhdsdio_hostmail(bus, &hmbdata);
+
+       }
+
+#ifdef DHD_UCODE_DOWNLOAD
+exit_ucode:
+#endif /* DHD_UCODE_DOWNLOAD */
+
+       /* Just being here means nothing more to do for chipactive */
+       if (intstatus & I_CHIPACTIVE) {
+               /* ASSERT(bus->clkstate == CLK_AVAIL); */
+               intstatus &= ~I_CHIPACTIVE;
+       }
+
+       /* Handle host mailbox indication */
+       if (intstatus & I_HMB_HOST_INT) {
+               intstatus &= ~I_HMB_HOST_INT;
+               intstatus |= dhdsdio_hostmail(bus, NULL);
+       }
+
+       /* Generally don't ask for these, can get CRC errors... */
+       /* XXX Besides noting the error, should we ABORT/TERM? */
+       if (intstatus & I_WR_OOSYNC) {
+               DHD_ERROR(("Dongle reports WR_OOSYNC\n"));
+               intstatus &= ~I_WR_OOSYNC;
+       }
+
+       if (intstatus & I_RD_OOSYNC) {
+               DHD_ERROR(("Dongle reports RD_OOSYNC\n"));
+               intstatus &= ~I_RD_OOSYNC;
+       }
+
+       /* XXX Should reset or something here... */
+       if (intstatus & I_SBINT) {
+               DHD_ERROR(("Dongle reports SBINT\n"));
+               intstatus &= ~I_SBINT;
+       }
+
+       /* Would be active due to wake-wlan in gSPI */
+       if (intstatus & I_CHIPACTIVE) {
+               DHD_INFO(("Dongle reports CHIPACTIVE\n"));
+               intstatus &= ~I_CHIPACTIVE;
+       }
+
+       if (intstatus & I_HMB_FC_STATE) {
+               DHD_INFO(("Dongle reports HMB_FC_STATE\n"));
+               intstatus &= ~I_HMB_FC_STATE;
+       }
+
+       /* Ignore frame indications if rxskip is set */
+       if (bus->rxskip) {
+               intstatus &= ~FRAME_AVAIL_MASK(bus);
+       }
+
+       /* On frame indication, read available frames */
+       if (PKT_AVAILABLE(bus, intstatus)) {
+
+               framecnt = dhdsdio_readframes(bus, rxlimit, &rxdone);
+               if (rxdone || bus->rxskip)
+                       intstatus  &= ~FRAME_AVAIL_MASK(bus);
+               rxlimit -= MIN(framecnt, rxlimit);
+       }
+
+       /* Keep still-pending events for next scheduling */
+       bus->intstatus = intstatus;
+
+clkwait:
+       /* Re-enable interrupts to detect new device events (mailbox, rx frame)
+        * or clock availability.  (Allows tx loop to check ipend if desired.)
+        * (Unless register access seems hosed, as we may not be able to ACK...)
+        */
+       if (bus->intr && bus->intdis && !bcmsdh_regfail(sdh) &&
+                       !(bus->dhd->conf->oob_enabled_later && !bus->ctrl_frame_stat)) {
+               DHD_INTR(("%s: enable SDIO interrupts, rxdone %d framecnt %d\n",
+                         __FUNCTION__, rxdone, framecnt));
+               bus->intdis = FALSE;
+#if defined(OOB_INTR_ONLY)
+               bcmsdh_oob_intr_set(bus->sdh, TRUE);
+#endif /* defined(OOB_INTR_ONLY) */
+               bcmsdh_intr_enable(sdh);
+#ifdef BCMSPI_ANDROID
+               if (*dhd_spi_lockcount == 0)
+                       bcmsdh_oob_intr_set(bus->sdh, TRUE);
+#endif /* BCMSPI_ANDROID */
+       }
+
+#if defined(OOB_INTR_ONLY) && !defined(HW_OOB)
+       /* In case of SW-OOB(using edge trigger),
+        * Check interrupt status in the dongle again after enable irq on the host.
+        * and rechedule dpc if interrupt is pended in the dongle.
+        * There is a chance to miss OOB interrupt while irq is disabled on the host.
+        * No need to do this with HW-OOB(level trigger)
+        */
+       R_SDREG(newstatus, &regs->intstatus, retries);
+       if (bcmsdh_regfail(bus->sdh))
+               newstatus = 0;
+       if (newstatus & bus->hostintmask) {
+               bus->ipend = TRUE;
+               resched = TRUE;
+       }
+#endif /* defined(OOB_INTR_ONLY) && !defined(HW_OOB) */
+
+#ifdef BCMSDIO_RXLIM_POST
+       if (!DATAOK(bus) && bus->rxlim_en) {
+               uint8 rxlim = 0;
+               if (0 == dhdsdio_membytes(bus, FALSE, bus->rxlim_addr, (uint8 *)&rxlim, 1)) {
+                       if (bus->tx_max != rxlim) {
+                               DHD_INFO(("%s: bus->tx_max/rxlim=%d/%d\n", __FUNCTION__,
+                                       bus->tx_max, rxlim));
+                               bus->tx_max = rxlim;
+                       }
+               }
+       }
+#endif /* BCMSDIO_RXLIM_POST */
+
+#ifdef PROP_TXSTATUS
+       dhd_wlfc_commit_packets(bus->dhd, (f_commitpkt_t)dhd_bus_txdata, (void *)bus, NULL, FALSE);
+#endif
+
+       if (TXCTLOK(bus) && bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL))
+               dhdsdio_sendpendctl(bus);
+#ifdef CONSOLE_DPC
+       else if (DATAOK(bus) && strlen(bus->cons_cmd) && (bus->clkstate == CLK_AVAIL) &&
+                       !bus->fcstate) {
+               dhd_bus_console_in(bus->dhd, bus->cons_cmd, strlen(bus->cons_cmd));
+       }
+#endif
+
+       /* Send queued frames (limit 1 if rx may still be pending) */
+       else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
+           pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit && DATAOK(bus)) {
+
+                       if (bus->dhd->conf->dhd_txminmax < 0)
+                               framecnt = rxdone ? txlimit : MIN(txlimit, DATABUFCNT(bus));
+                       else
+                               framecnt = rxdone ? txlimit : MIN(txlimit, bus->dhd->conf->dhd_txminmax);
+                       framecnt = dhdsdio_sendfromq(bus, framecnt);
+                       txlimit -= framecnt;
+       }
+       /* Resched the DPC if ctrl cmd is pending on bus credit */
+       if (bus->ctrl_frame_stat) {
+               if (bus->dhd->conf->txctl_tmo_fix) {
+                       set_current_state(TASK_INTERRUPTIBLE);
+                       if (!kthread_should_stop())
+                               schedule_timeout(1);
+                       set_current_state(TASK_RUNNING);
+               }
+               resched = TRUE;
+       }
+
+       /* Resched if events or tx frames are pending, else await next interrupt */
+       /* On failed register access, all bets are off: no resched or interrupts */
+       if ((bus->dhd->busstate == DHD_BUS_DOWN) || bcmsdh_regfail(sdh)) {
+               if ((bus->sih && bus->sih->buscorerev >= 12) && !(dhdsdio_sleepcsr_get(bus) &
+                       SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
+                       /* Bus failed because of KSO */
+                       DHD_ERROR(("%s: Bus failed due to KSO\n", __FUNCTION__));
+                       bus->kso = FALSE;
+               } else {
+                       DHD_ERROR(("%s: failed backplane access over SDIO, halting operation\n",
+                               __FUNCTION__));
+                       DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+                       bus->dhd->busstate = DHD_BUS_DOWN;
+                       bus->intstatus = 0;
+                       /* XXX Under certain conditions it may be reasonable to enable interrupts.
+                        * E.g. if we get occasional 'bcmsdh_regfail' we should be able to continue
+                        * operation. May want to make the decision to enable or not based on count
+                        * of failures, so in case of bus lock up we avoid continuous interrupt.
+                        */
+               }
+       } else if (bus->clkstate == CLK_PENDING) {
+               /* Awaiting I_CHIPACTIVE; don't resched */
+       } else if (bus->intstatus || bus->ipend ||
+                       (!bus->fcstate && pktq_mlen(&bus->txq, ~bus->flowcontrol) && DATAOK(bus)) ||
+                       PKT_AVAILABLE(bus, bus->intstatus)) {  /* Read multiple frames */
+               resched = TRUE;
+       }
+
+       bus->dpc_sched = resched;
+
+       /* If we're done for now, turn off clock request. */
+       /* XXX Leave request on if just waiting for new credit? */
+       if ((bus->idletime == DHD_IDLE_IMMEDIATE) && (bus->clkstate != CLK_PENDING) &&
+               NO_OTHER_ACTIVE_BUS_USER(bus)) {
+               bus->activity = FALSE;
+               dhdsdio_bussleep(bus, TRUE);
+               dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+       }
+
+exit:
+
+       if (!resched) {
+               /* Re-enable interrupts to detect new device events (mailbox, rx frame)
+                * or clock availability.  (Allows tx loop to check ipend if desired.)
+                * (Unless register access seems hosed, as we may not be able to ACK...)
+                */
+               if (bus->intr && bus->intdis && !bcmsdh_regfail(sdh) &&
+                               (bus->dhd->conf->oob_enabled_later && !bus->ctrl_frame_stat)) {
+                       DHD_INTR(("%s: enable SDIO interrupts, rxdone %d framecnt %d\n",
+                                         __FUNCTION__, rxdone, framecnt));
+                       bus->intdis = FALSE;
+#if defined(OOB_INTR_ONLY)
+                       bcmsdh_oob_intr_set(bus->sdh, TRUE);
+#endif /* defined(OOB_INTR_ONLY) */
+                       bcmsdh_intr_enable(sdh);
+               }
+               if (dhd_dpcpoll) {
+                       if (dhdsdio_readframes(bus, dhd_rxbound, &rxdone) != 0) {
+                               resched = TRUE;
+#ifdef DEBUG_DPC_THREAD_WATCHDOG
+                               is_resched_by_readframe = TRUE;
+#endif /* DEBUG_DPC_THREAD_WATCHDOG */
+                       }
+               }
+       }
+
+       if (bus->ctrl_wait && TXCTLOK(bus))
+               wake_up_interruptible(&bus->ctrl_tx_wait);
+       dhd_os_sdunlock(bus->dhd);
+#ifdef DEBUG_DPC_THREAD_WATCHDOG
+       if (bus->dhd->dhd_bug_on) {
+               DHD_INFO(("%s: resched = %d ctrl_frame_stat = %d intstatus 0x%08x"
+                       " ipend = %d pktq_mlen = %d is_resched_by_readframe = %d \n",
+                       __FUNCTION__, resched, bus->ctrl_frame_stat,
+                       bus->intstatus, bus->ipend,
+                       pktq_mlen(&bus->txq, ~bus->flowcontrol), is_resched_by_readframe));
+
+                       bus->dhd->dhd_bug_on = FALSE;
+       }
+#endif /* DEBUG_DPC_THREAD_WATCHDOG */
+
+       DHD_LINUX_GENERAL_LOCK(bus->dhd, flags);
+       DHD_BUS_BUSY_CLEAR_IN_DPC(bus->dhd);
+       dhd_os_busbusy_wake(bus->dhd);
+       DHD_LINUX_GENERAL_UNLOCK(bus->dhd, flags);
+
+       return resched;
+}
+
+bool
+dhd_bus_dpc(struct dhd_bus *bus)
+{
+       bool resched;
+
+       /* Call the DPC directly. */
+       DHD_TRACE(("Calling dhdsdio_dpc() from %s\n", __FUNCTION__));
+       resched = dhdsdio_dpc(bus);
+
+       return resched;
+}
+
+void
+dhdsdio_isr(void *arg)
+{
+       dhd_bus_t *bus = (dhd_bus_t*)arg;
+       bcmsdh_info_t *sdh;
+
+       if (!bus) {
+               DHD_ERROR(("%s : bus is null pointer , exit \n", __FUNCTION__));
+               return;
+       }
+       sdh = bus->sdh;
+
+       if (bus->dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+               return;
+       }
+       /* XXX Overall operation:
+        * XXX   - Mask further interrupts
+        * XXX   - Read/ack intstatus
+        * XXX   - Take action based on bits and state
+        * XXX   - Reenable interrupts (as per state)
+        */
+
+       DHD_INTR(("%s: Enter\n", __FUNCTION__));
+
+       /* Count the interrupt call */
+       bus->intrcount++;
+       bus->ipend = TRUE;
+
+       /* Shouldn't get this interrupt if we're sleeping? */
+       if (!SLPAUTO_ENAB(bus)) {
+               if (bus->sleeping) {
+                       DHD_ERROR(("INTERRUPT WHILE SLEEPING??\n"));
+                       return;
+               } else if (!KSO_ENAB(bus)) {
+                       DHD_ERROR(("ISR in devsleep 1\n"));
+               }
+       }
+
+       /* Disable additional interrupts (is this needed now)? */
+       if (bus->intr) {
+               DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+       } else {
+               DHD_ERROR(("dhdsdio_isr() w/o interrupt configured!\n"));
+       }
+
+#ifdef BCMSPI_ANDROID
+       bcmsdh_oob_intr_set(bus->sdh, FALSE);
+#endif /* BCMSPI_ANDROID */
+       bcmsdh_intr_disable(sdh); /* XXX New API: bcmsdh_intr_mask()? */
+       bus->intdis = TRUE;
+
+#if defined(SDIO_ISR_THREAD)
+       DHD_TRACE(("Calling dhdsdio_dpc() from %s\n", __FUNCTION__));
+       DHD_OS_WAKE_LOCK(bus->dhd);
+       /* terence 20150209: dpc should be scheded again if dpc_sched is TRUE or dhd_bus_txdata can
+           not schedule anymore because dpc_sched is TRUE now.
+        */
+       if (dhdsdio_dpc(bus)) {
+               bus->dpc_sched = TRUE;
+               dhd_sched_dpc(bus->dhd);
+       }
+       DHD_OS_WAKE_UNLOCK(bus->dhd);
+#else
+       bus->dpc_sched = TRUE;
+       dhd_sched_dpc(bus->dhd);
+#endif /* defined(SDIO_ISR_THREAD) */
+
+}
+
+#ifdef PKT_STATICS
+void dhd_bus_dump_txpktstatics(struct dhd_bus *bus)
+{
+       uint i;
+       uint32 total = 0;
+
+       printf("%s: TYPE EVENT: %d pkts (size=%d) transfered\n",
+               __FUNCTION__, bus->tx_statics.event_count, bus->tx_statics.event_size);
+       printf("%s: TYPE CTRL:  %d pkts (size=%d) transfered\n",
+               __FUNCTION__, bus->tx_statics.ctrl_count, bus->tx_statics.ctrl_size);
+       printf("%s: TYPE DATA:  %d pkts (size=%d) transfered\n",
+               __FUNCTION__, bus->tx_statics.data_count, bus->tx_statics.data_size);
+       printf("%s: Glom size distribution:\n", __FUNCTION__);
+       for (i=0;i<bus->tx_statics.glom_max;i++) {
+               total += bus->tx_statics.glom_cnt[i];
+       }
+       printk(KERN_CONT "[dhd] ");
+       for (i=0;i<bus->tx_statics.glom_max;i++) {
+               printk(KERN_CONT "%02d: %5d", i+1, bus->tx_statics.glom_cnt[i]);
+               if ((i+1)%8)
+                       printk(KERN_CONT ", ");
+               else {
+                       printk("\n");
+                       printk(KERN_CONT "[dhd] ");
+               }
+       }
+       printk("\n");
+       printk(KERN_CONT "[dhd] ");
+       for (i=0;i<bus->tx_statics.glom_max;i++) {
+               printk(KERN_CONT "%02d:%5d%%", i+1, (bus->tx_statics.glom_cnt[i]*100)/total);
+               if ((i+1)%8)
+                       printk(KERN_CONT ", ");
+               else {
+                       printk("\n");
+                       printk(KERN_CONT "[dhd] ");
+               }
+       }
+       printk("\n");
+       printf("%s: Glom spend time distribution(us):\n", __FUNCTION__);
+       printk(KERN_CONT "[dhd] ");
+       for (i=0;i<bus->tx_statics.glom_max;i++) {
+               printk(KERN_CONT "%02d: %5u", i+1, bus->tx_statics.glom_cnt_us[i]);
+               if ((i+1)%8)
+                       printk(KERN_CONT ", ");
+               else {
+                       printk("\n");
+                       printk(KERN_CONT "[dhd] ");
+               }
+       }
+       printk("\n");
+       if (total) {
+               printf("%s: data(%d)/glom(%d)=%d, glom_max=%d\n",
+                       __FUNCTION__, bus->tx_statics.data_count, total,
+                       bus->tx_statics.data_count/total, bus->tx_statics.glom_max);
+       }
+       printf("%s: TYPE RX GLOM: %d pkts (size=%d) transfered\n",
+               __FUNCTION__, bus->tx_statics.glom_count, bus->tx_statics.glom_size);
+       printf("%s: TYPE TEST: %d pkts (size=%d) transfered\n",
+               __FUNCTION__, bus->tx_statics.test_count, bus->tx_statics.test_size);
+}
+
+void dhd_bus_clear_txpktstatics(struct dhd_bus *bus)
+{
+       memset((uint8*) &bus->tx_statics, 0, sizeof(pkt_statics_t));
+}
+#endif
+
+#ifdef SDTEST
+static void
+dhdsdio_pktgen_init(dhd_bus_t *bus)
+{
+       /* Default to specified length, or full range */
+       if (dhd_pktgen_len) {
+               bus->pktgen_maxlen = MIN(dhd_pktgen_len, MAX_PKTGEN_LEN);
+               bus->pktgen_minlen = bus->pktgen_maxlen;
+       } else {
+               bus->pktgen_maxlen = MAX_PKTGEN_LEN;
+               bus->pktgen_minlen = 0;
+       }
+       bus->pktgen_len = (uint16)bus->pktgen_minlen;
+
+       /* Default to per-watchdog burst with 10s print time */
+       bus->pktgen_freq = 1;
+       bus->pktgen_print = dhd_watchdog_ms ? (10000 / dhd_watchdog_ms) : 0;
+       bus->pktgen_count = (dhd_pktgen * dhd_watchdog_ms + 999) / 1000;
+
+       /* Default to echo mode */
+       bus->pktgen_mode = DHD_PKTGEN_ECHO;
+       bus->pktgen_stop = 1;
+}
+
+static void
+dhdsdio_pktgen(dhd_bus_t *bus)
+{
+       void *pkt;
+       uint8 *data;
+       uint pktcount;
+       uint fillbyte;
+       osl_t *osh = bus->dhd->osh;
+       uint16 len;
+       ulong time_lapse;
+       uint sent_pkts;
+       uint rcvd_pkts;
+
+       /* Display current count if appropriate */
+       if (bus->pktgen_print && (++bus->pktgen_ptick >= bus->pktgen_print)) {
+               bus->pktgen_ptick = 0;
+               printf("%s: send attempts %d, rcvd %d, errors %d\n",
+                      __FUNCTION__, bus->pktgen_sent, bus->pktgen_rcvd, bus->pktgen_fail);
+
+               /* Print throughput stats only for constant length packet runs */
+               if (bus->pktgen_minlen == bus->pktgen_maxlen) {
+                       time_lapse = jiffies - bus->pktgen_prev_time;
+                       bus->pktgen_prev_time = jiffies;
+                       sent_pkts = bus->pktgen_sent - bus->pktgen_prev_sent;
+                       bus->pktgen_prev_sent = bus->pktgen_sent;
+                       rcvd_pkts = bus->pktgen_rcvd - bus->pktgen_prev_rcvd;
+                       bus->pktgen_prev_rcvd = bus->pktgen_rcvd;
+
+                       printf("%s: Tx Throughput %d kbps, Rx Throughput %d kbps\n",
+                         __FUNCTION__,
+                         (sent_pkts * bus->pktgen_len / jiffies_to_msecs(time_lapse)) * 8,
+                         (rcvd_pkts * bus->pktgen_len  / jiffies_to_msecs(time_lapse)) * 8);
+               }
+       }
+
+       /* For recv mode, just make sure dongle has started sending */
+       if (bus->pktgen_mode == DHD_PKTGEN_RECV) {
+               if (bus->pktgen_rcv_state == PKTGEN_RCV_IDLE) {
+                       bus->pktgen_rcv_state = PKTGEN_RCV_ONGOING;
+                       dhdsdio_sdtest_set(bus, bus->pktgen_total);
+               }
+               return;
+       }
+
+       /* Otherwise, generate or request the specified number of packets */
+       for (pktcount = 0; pktcount < bus->pktgen_count; pktcount++) {
+               /* Stop if total has been reached */
+               if (bus->pktgen_total && (bus->pktgen_sent >= bus->pktgen_total)) {
+                       bus->pktgen_count = 0;
+                       break;
+               }
+
+               /* Allocate an appropriate-sized packet */
+               if (bus->pktgen_mode == DHD_PKTGEN_RXBURST) {
+                       len = SDPCM_TEST_PKT_CNT_FLD_LEN;
+               } else {
+                       len = bus->pktgen_len;
+               }
+               if (!(pkt = PKTGET(osh, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN),
+                                  TRUE))) {;
+                       DHD_ERROR(("%s: PKTGET failed!\n", __FUNCTION__));
+                       break;
+               }
+               PKTALIGN(osh, pkt, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN), DHD_SDALIGN);
+               data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
+
+               /* Write test header cmd and extra based on mode */
+               switch (bus->pktgen_mode) {
+               case DHD_PKTGEN_ECHO:
+                       *data++ = SDPCM_TEST_ECHOREQ;
+                       *data++ = (uint8)bus->pktgen_sent;
+                       break;
+
+               case DHD_PKTGEN_SEND:
+                       *data++ = SDPCM_TEST_DISCARD;
+                       *data++ = (uint8)bus->pktgen_sent;
+                       break;
+
+               case DHD_PKTGEN_RXBURST:
+                       *data++ = SDPCM_TEST_BURST;
+                       *data++ = (uint8)bus->pktgen_count; /* Just for backward compatability */
+                       break;
+
+               default:
+                       DHD_ERROR(("Unrecognized pktgen mode %d\n", bus->pktgen_mode));
+                       PKTFREE(osh, pkt, TRUE);
+                       bus->pktgen_count = 0;
+                       return;
+               }
+
+               /* Write test header length field */
+               *data++ = (bus->pktgen_len >> 0);
+               *data++ = (bus->pktgen_len >> 8);
+
+               /* Write frame count in a 4 byte field adjucent to SDPCM test header for
+                * burst mode
+                */
+               if (bus->pktgen_mode == DHD_PKTGEN_RXBURST) {
+                       *data++ = (uint8)(bus->pktgen_count >> 0);
+                       *data++ = (uint8)(bus->pktgen_count >> 8);
+                       *data++ = (uint8)(bus->pktgen_count >> 16);
+                       *data++ = (uint8)(bus->pktgen_count >> 24);
+               } else {
+
+                       /* Then fill in the remainder -- N/A for burst */
+                       for (fillbyte = 0; fillbyte < len; fillbyte++)
+                               *data++ = SDPCM_TEST_FILL(fillbyte, (uint8)bus->pktgen_sent);
+               }
+
+#ifdef DHD_DEBUG
+               if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+                       data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
+                       prhex("dhdsdio_pktgen: Tx Data", data, PKTLEN(osh, pkt) - SDPCM_HDRLEN);
+               }
+#endif
+
+               /* Send it */
+               if (dhdsdio_txpkt(bus, SDPCM_TEST_CHANNEL, &pkt, 1, TRUE) != BCME_OK) {
+                       bus->pktgen_fail++;
+                       if (bus->pktgen_stop && bus->pktgen_stop == bus->pktgen_fail)
+                               bus->pktgen_count = 0;
+               }
+               bus->pktgen_sent++;
+
+               /* Bump length if not fixed, wrap at max */
+               if (++bus->pktgen_len > bus->pktgen_maxlen)
+                       bus->pktgen_len = (uint16)bus->pktgen_minlen;
+
+               /* Special case for burst mode: just send one request! */
+               if (bus->pktgen_mode == DHD_PKTGEN_RXBURST)
+                       break;
+       }
+}
+
+static void
+dhdsdio_sdtest_set(dhd_bus_t *bus, uint count)
+{
+       void *pkt;
+       uint8 *data;
+       osl_t *osh = bus->dhd->osh;
+
+       /* Allocate the packet */
+       if (!(pkt = PKTGET(osh, SDPCM_HDRLEN + SDPCM_TEST_HDRLEN +
+               SDPCM_TEST_PKT_CNT_FLD_LEN + DHD_SDALIGN, TRUE))) {
+               DHD_ERROR(("%s: PKTGET failed!\n", __FUNCTION__));
+               return;
+       }
+       PKTALIGN(osh, pkt, (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN +
+               SDPCM_TEST_PKT_CNT_FLD_LEN), DHD_SDALIGN);
+       data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
+
+       /* Fill in the test header */
+       *data++ = SDPCM_TEST_SEND;
+       *data++ = (count > 0)?TRUE:FALSE;
+       *data++ = (bus->pktgen_maxlen >> 0);
+       *data++ = (bus->pktgen_maxlen >> 8);
+       *data++ = (uint8)(count >> 0);
+       *data++ = (uint8)(count >> 8);
+       *data++ = (uint8)(count >> 16);
+       *data++ = (uint8)(count >> 24);
+
+       /* Send it */
+       if (dhdsdio_txpkt(bus, SDPCM_TEST_CHANNEL, &pkt, 1, TRUE) != BCME_OK)
+               bus->pktgen_fail++;
+}
+
+static void
+dhdsdio_testrcv(dhd_bus_t *bus, void *pkt, uint seq)
+{
+       osl_t *osh = bus->dhd->osh;
+       uint8 *data;
+       uint pktlen;
+
+       uint8 cmd;
+       uint8 extra;
+       uint16 len;
+       uint16 offset;
+
+       /* Check for min length */
+       if ((pktlen = PKTLEN(osh, pkt)) < SDPCM_TEST_HDRLEN) {
+               DHD_ERROR(("dhdsdio_restrcv: toss runt frame, pktlen %d\n", pktlen));
+               PKTFREE(osh, pkt, FALSE);
+               return;
+       }
+
+       /* Extract header fields */
+       data = PKTDATA(osh, pkt);
+       cmd = *data++;
+       extra = *data++;
+       len = *data++; len += *data++ << 8;
+       DHD_TRACE(("%s:cmd:%d, xtra:%d,len:%d\n", __FUNCTION__, cmd, extra, len));
+       /* Check length for relevant commands */
+       if (cmd == SDPCM_TEST_DISCARD || cmd == SDPCM_TEST_ECHOREQ || cmd == SDPCM_TEST_ECHORSP) {
+               if (pktlen != len + SDPCM_TEST_HDRLEN) {
+                       DHD_ERROR(("dhdsdio_testrcv: frame length mismatch, pktlen %d seq %d"
+                                  " cmd %d extra %d len %d\n", pktlen, seq, cmd, extra, len));
+                       PKTFREE(osh, pkt, FALSE);
+                       return;
+               }
+       }
+
+       /* Process as per command */
+       switch (cmd) {
+       case SDPCM_TEST_ECHOREQ:
+               /* Rx->Tx turnaround ok (even on NDIS w/current implementation) */
+               *(uint8 *)(PKTDATA(osh, pkt)) = SDPCM_TEST_ECHORSP;
+               if (dhdsdio_txpkt(bus, SDPCM_TEST_CHANNEL, &pkt, 1, TRUE) == BCME_OK) {
+                       bus->pktgen_sent++;
+               } else {
+                       bus->pktgen_fail++;
+                       PKTFREE(osh, pkt, FALSE);
+               }
+               bus->pktgen_rcvd++;
+               break;
+
+       case SDPCM_TEST_ECHORSP:
+               if (bus->ext_loop) {
+                       PKTFREE(osh, pkt, FALSE);
+                       bus->pktgen_rcvd++;
+                       break;
+               }
+
+               for (offset = 0; offset < len; offset++, data++) {
+                       if (*data != SDPCM_TEST_FILL(offset, extra)) {
+                               DHD_ERROR(("dhdsdio_testrcv: echo data mismatch: "
+                                          "offset %d (len %d) expect 0x%02x rcvd 0x%02x\n",
+                                          offset, len, SDPCM_TEST_FILL(offset, extra), *data));
+                               break;
+                       }
+               }
+               PKTFREE(osh, pkt, FALSE);
+               bus->pktgen_rcvd++;
+               break;
+
+       case SDPCM_TEST_DISCARD:
+               {
+                       int i = 0;
+                       uint8 *prn = data;
+                       uint8 testval = extra;
+                       for (i = 0; i < len; i++) {
+                               if (*prn != testval) {
+                                       DHD_ERROR(("DIErr@Pkt#:%d,Ix:%d, expected:0x%x, got:0x%x\n",
+                                               i, bus->pktgen_rcvd_rcvsession, testval, *prn));
+                                       prn++; testval++;
+                               }
+                       }
+               }
+               PKTFREE(osh, pkt, FALSE);
+               bus->pktgen_rcvd++;
+               break;
+
+       case SDPCM_TEST_BURST:
+       case SDPCM_TEST_SEND:
+       default:
+               DHD_INFO(("dhdsdio_testrcv: unsupported or unknown command, pktlen %d seq %d"
+                         " cmd %d extra %d len %d\n", pktlen, seq, cmd, extra, len));
+               PKTFREE(osh, pkt, FALSE);
+               break;
+       }
+
+       /* For recv mode, stop at limit (and tell dongle to stop sending) */
+       if (bus->pktgen_mode == DHD_PKTGEN_RECV) {
+               if (bus->pktgen_rcv_state != PKTGEN_RCV_IDLE) {
+                       bus->pktgen_rcvd_rcvsession++;
+
+                       if (bus->pktgen_total &&
+                               (bus->pktgen_rcvd_rcvsession >= bus->pktgen_total)) {
+                       bus->pktgen_count = 0;
+                       DHD_ERROR(("Pktgen:rcv test complete!\n"));
+                       bus->pktgen_rcv_state = PKTGEN_RCV_IDLE;
+                       dhdsdio_sdtest_set(bus, FALSE);
+                               bus->pktgen_rcvd_rcvsession = 0;
+                       }
+               }
+       }
+}
+#endif /* SDTEST */
+
+int dhd_bus_oob_intr_register(dhd_pub_t *dhdp)
+{
+       int err = 0;
+
+#if defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID)
+       err = bcmsdh_oob_intr_register(dhdp->bus->sdh, dhdsdio_isr, dhdp->bus);
+#endif
+       return err;
+}
+
+void dhd_bus_oob_intr_unregister(dhd_pub_t *dhdp)
+{
+#if defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID)
+       bcmsdh_oob_intr_unregister(dhdp->bus->sdh);
+#endif
+}
+
+void dhd_bus_oob_intr_set(dhd_pub_t *dhdp, bool enable)
+{
+#if defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID)
+       bcmsdh_oob_intr_set(dhdp->bus->sdh, enable);
+#endif
+}
+
+int dhd_bus_get_oob_irq_num(dhd_pub_t *dhdp)
+{
+       int irq_num = 0;
+#if defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID)
+       irq_num = bcmsdh_get_oob_intr_num(dhdp->bus->sdh);
+#endif /* OOB_INTR_ONLY || BCMSPI_ANDROID */
+       return irq_num;
+}
+
+void dhd_bus_dev_pm_stay_awake(dhd_pub_t *dhdpub)
+{
+       bcmsdh_dev_pm_stay_awake(dhdpub->bus->sdh);
+}
+
+void dhd_bus_dev_pm_relax(dhd_pub_t *dhdpub)
+{
+       bcmsdh_dev_relax(dhdpub->bus->sdh);
+}
+
+bool dhd_bus_dev_pm_enabled(dhd_pub_t *dhdpub)
+{
+       bool enabled = FALSE;
+
+       enabled = bcmsdh_dev_pm_enabled(dhdpub->bus->sdh);
+       return enabled;
+}
+
+extern bool
+dhd_bus_watchdog(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus;
+       unsigned long flags;
+
+       DHD_TIMER(("%s: Enter\n", __FUNCTION__));
+
+       bus = dhdp->bus;
+
+       if (bus->dhd->dongle_reset)
+               return FALSE;
+
+       if (bus->dhd->hang_was_sent) {
+               dhd_os_wd_timer(bus->dhd, 0);
+               return FALSE;
+       }
+
+       /* Ignore the timer if simulating bus down */
+       if (!SLPAUTO_ENAB(bus) && bus->sleeping)
+               return FALSE;
+
+       DHD_LINUX_GENERAL_LOCK(dhdp, flags);
+       if (DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(dhdp) ||
+                       DHD_BUS_CHECK_SUSPEND_OR_SUSPEND_IN_PROGRESS(dhdp)) {
+               DHD_LINUX_GENERAL_UNLOCK(dhdp, flags);
+               return FALSE;
+       }
+       DHD_BUS_BUSY_SET_IN_WD(dhdp);
+       DHD_LINUX_GENERAL_UNLOCK(dhdp, flags);
+
+       dhd_os_sdlock(bus->dhd);
+
+       /* Poll period: check device if appropriate. */
+       // terence 20160615: remove !SLPAUTO_ENAB(bus) to fix not able to polling if sr supported
+       if (1 && (bus->poll && (++bus->polltick >= bus->pollrate))) {
+               uint32 intstatus = 0;
+
+               /* Reset poll tick */
+               bus->polltick = 0;
+
+               /* Check device if no interrupts */
+               if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
+
+#ifndef BCMSPI
+                       /* XXX Needs to be fixed for polling operation (in CE) */
+                       if (!bus->dpc_sched) {
+                               uint8 devpend;
+                               devpend = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0,
+                                                         SDIOD_CCCR_INTPEND, NULL);
+                               intstatus = devpend & (INTR_STATUS_FUNC1 | INTR_STATUS_FUNC2);
+                       }
+#else
+                       if (!bus->dpc_sched) {
+                               uint32 devpend;
+                               devpend = bcmsdh_cfg_read_word(bus->sdh, SDIO_FUNC_0,
+                                       SPID_STATUS_REG, NULL);
+                               intstatus = devpend & STATUS_F2_PKT_AVAILABLE;
+                       }
+#endif /* !BCMSPI */
+
+                       /* If there is something, make like the ISR and schedule the DPC */
+                       if (intstatus) {
+                               bus->pollcnt++;
+                               bus->ipend = TRUE;
+                               if (bus->intr) {
+                                       bcmsdh_intr_disable(bus->sdh);
+                               }
+                               bus->dpc_sched = TRUE;
+                               dhd_sched_dpc(bus->dhd);
+                       }
+               }
+
+               /* Update interrupt tracking */
+               bus->lastintrs = bus->intrcount;
+       }
+
+       if ((!bus->dpc_sched) && pktq_n_pkts_tot(&bus->txq)) {
+               bus->dpc_sched = TRUE;
+               dhd_sched_dpc(bus->dhd);
+       }
+
+#ifdef DHD_DEBUG
+       /* Poll for console output periodically */
+       if (dhdp->busstate == DHD_BUS_DATA && dhdp->dhd_console_ms != 0) {
+               bus->console.count += dhd_watchdog_ms;
+               if (bus->console.count >= dhdp->dhd_console_ms) {
+                       bus->console.count -= dhdp->dhd_console_ms;
+                       /* Make sure backplane clock is on */
+                       if (SLPAUTO_ENAB(bus))
+                               dhdsdio_bussleep(bus, FALSE);
+                       else
+                       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+                       if (dhdsdio_readconsole(bus) < 0)
+                               dhdp->dhd_console_ms = 0;       /* On error, stop trying */
+               }
+       }
+#endif /* DHD_DEBUG */
+
+#ifdef SDTEST
+       /* Generate packets if configured */
+       if (bus->pktgen_count && (++bus->pktgen_tick >= bus->pktgen_freq)) {
+               /* Make sure backplane clock is on */
+               if (SLPAUTO_ENAB(bus))
+                       dhdsdio_bussleep(bus, FALSE);
+               else
+                       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+               bus->pktgen_tick = 0;
+               dhdsdio_pktgen(bus);
+       }
+#endif
+
+       /* On idle timeout clear activity flag and/or turn off clock */
+#ifdef DHD_USE_IDLECOUNT
+       if (bus->activity)
+               bus->activity = FALSE;
+       else {
+               bus->idlecount++;
+
+               /*
+                * If the condition to switch off the clock is reached And if
+                * BT is inactive (in case of BT_OVER_SDIO build) turn off clk.
+                *
+                * Consider the following case, DHD is configured with
+                * 1) idletime == DHD_IDLE_IMMEDIATE
+                * 2) BT is the last user of the clock
+                * We cannot disable the clock from __dhdsdio_clk_disable
+                * since WLAN might be using it. If WLAN is active then
+                * from the respective function/context after doing the job
+                * the clk is turned off.
+                * But if WLAN is actually inactive then the watchdog should
+                * disable the clock. So the condition check below should be
+                * bus->idletime != 0 instead of idletime == 0
+                */
+               if ((bus->idletime != 0) && (bus->idlecount >= bus->idletime) &&
+                       NO_OTHER_ACTIVE_BUS_USER(bus)) {
+                       DHD_TIMER(("%s: DHD Idle state!!\n", __FUNCTION__));
+                       if (!bus->poll && SLPAUTO_ENAB(bus)) {
+                               if (dhdsdio_bussleep(bus, TRUE) != BCME_BUSY)
+                                       dhd_os_wd_timer(bus->dhd, 0);
+                       } else
+                               dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+
+                       bus->idlecount = 0;
+               }
+       }
+#else
+       if ((bus->idletime != 0) && (bus->clkstate == CLK_AVAIL) &&
+               NO_OTHER_ACTIVE_BUS_USER(bus)) {
+               if (++bus->idlecount >= bus->idletime) {
+                       bus->idlecount = 0;
+                       if (bus->activity) {
+                               bus->activity = FALSE;
+                               if (!bus->poll && SLPAUTO_ENAB(bus)) {
+                                       if (!bus->readframes)
+                                               dhdsdio_bussleep(bus, TRUE);
+                                       else
+                                               bus->reqbussleep = TRUE;
+                               } else {
+                                       dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+                               }
+                       }
+               }
+       }
+#endif /* DHD_USE_IDLECOUNT */
+
+       dhd_os_sdunlock(bus->dhd);
+
+       DHD_LINUX_GENERAL_LOCK(dhdp, flags);
+       DHD_BUS_BUSY_CLEAR_IN_WD(dhdp);
+       dhd_os_busbusy_wake(dhdp);
+       DHD_LINUX_GENERAL_UNLOCK(dhdp, flags);
+
+       return bus->ipend;
+}
+
+extern int
+dhd_bus_console_in(dhd_pub_t *dhdp, uchar *msg, uint msglen)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       uint32 addr, val;
+       int rv;
+       void *pkt;
+
+#ifndef CONSOLE_DPC
+       /* Exclusive bus access */
+       dhd_os_sdlock(bus->dhd);
+#endif
+
+       /* Address could be zero if CONSOLE := 0 in dongle Makefile */
+       if (bus->console_addr == 0) {
+               rv = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       /* Don't allow input if dongle is in reset */
+       if (bus->dhd->dongle_reset) {
+               rv = BCME_NOTREADY;
+               goto exit;
+       }
+
+#ifndef CONSOLE_DPC
+       if (!DATAOK(bus)) {
+               DHD_CTL(("%s: No bus credit bus->tx_max %d, bus->tx_seq %d, pktq_len %d\n",
+                       __FUNCTION__, bus->tx_max, bus->tx_seq, pktq_n_pkts_tot(&bus->txq)));
+               rv = BCME_NOTREADY;
+               goto exit;
+       }
+
+       /* Request clock to allow SDIO accesses */
+       BUS_WAKE(bus);
+       /* No pend allowed since txpkt is called later, ht clk has to be on */
+       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+#endif
+
+       /* Zero cbuf_index */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, cbuf_idx);
+       /* handle difference in definition of hnd_log_t in certain branches */
+       if (dhdp->wlc_ver_major < 14) {
+               addr -= sizeof(uint32);
+       }
+       val = htol32(0);
+       if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
+               goto done;
+
+       /* Write message into cbuf */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, cbuf);
+       /* handle difference in definition of hnd_log_t in certain branches */
+       if (dhdp->wlc_ver_major < 14) {
+               addr -= sizeof(uint32);
+       }
+       if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)msg, msglen)) < 0)
+               goto done;
+
+       /* Write length into vcons_in */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, vcons_in);
+       val = htol32(msglen);
+       if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
+               goto done;
+
+       /* Bump dongle by sending an empty packet on the event channel.
+        * sdpcm_sendup (RX) checks for virtual console input.
+        */
+       if ((pkt = PKTGET(bus->dhd->osh, 4 + SDPCM_RESERVE, TRUE)) != NULL)
+               rv = dhdsdio_txpkt(bus, SDPCM_EVENT_CHANNEL, &pkt, 1, TRUE);
+
+done:
+#ifndef CONSOLE_DPC
+       if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched &&
+               NO_OTHER_ACTIVE_BUS_USER(bus)) {
+               bus->activity = FALSE;
+               dhdsdio_bussleep(bus, TRUE);
+               dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+       }
+#endif
+
+exit:
+#ifdef CONSOLE_DPC
+       memset(bus->cons_cmd, 0, sizeof(bus->cons_cmd));
+#else
+       dhd_os_sdunlock(bus->dhd);
+#endif
+       return rv;
+}
+
+#ifdef CONSOLE_DPC
+extern int
+dhd_bus_txcons(dhd_pub_t *dhdp, uchar *msg, uint msglen)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       int ret = BCME_OK;
+
+       dhd_os_sdlock(bus->dhd);
+
+       /* Address could be zero if CONSOLE := 0 in dongle Makefile */
+       if (bus->console_addr == 0) {
+               ret = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       /* Don't allow input if dongle is in reset */
+       if (bus->dhd->dongle_reset) {
+               ret = BCME_NOTREADY;
+               goto exit;
+       }
+
+       if (msglen >= sizeof(bus->cons_cmd)) {
+               DHD_ERROR(("%s: \"%s\"(%d) too long\n", __FUNCTION__, msg, msglen));
+               ret = BCME_BADARG;
+               goto exit;
+       }
+
+       if (!strlen(bus->cons_cmd)) {
+               strncpy(bus->cons_cmd, msg, sizeof(bus->cons_cmd));
+               DHD_CTL(("%s: \"%s\" delay send, tx_max %d, tx_seq %d, pktq_len %d\n",
+                       __FUNCTION__, bus->cons_cmd, bus->tx_max, bus->tx_seq, pktq_n_pkts_tot(&bus->txq)));
+               if (!bus->dpc_sched) {
+                       bus->dpc_sched = TRUE;
+                       dhd_sched_dpc(bus->dhd);
+               }
+       } else {
+               DHD_CTL(("%s: \"%s\" is pending, tx_max %d, tx_seq %d, pktq_len %d\n",
+                       __FUNCTION__, bus->cons_cmd, bus->tx_max, bus->tx_seq, pktq_n_pkts_tot(&bus->txq)));
+               ret = BCME_NOTREADY;
+       }
+
+exit:
+       dhd_os_sdunlock(bus->dhd);
+
+       return ret;
+}
+#endif
+
+#if defined(DHD_DEBUG) && !defined(BCMSDIOLITE)
+static void
+dhd_dump_cis(uint fn, uint8 *cis)
+{
+       uint byte, tag, tdata;
+       DHD_INFO(("Function %d CIS:\n", fn));
+
+       for (tdata = byte = 0; byte < SBSDIO_CIS_SIZE_LIMIT; byte++) {
+               if ((byte % 16) == 0)
+                       DHD_INFO(("    "));
+               DHD_INFO(("%02x ", cis[byte]));
+               if ((byte % 16) == 15)
+                       DHD_INFO(("\n"));
+               if (!tdata--) {
+                       tag = cis[byte];
+                       if (tag == 0xff)
+                               break;
+                       else if (!tag)
+                               tdata = 0;
+                       else if ((byte + 1) < SBSDIO_CIS_SIZE_LIMIT)
+                               tdata = cis[byte + 1] + 1;
+                       else
+                               DHD_INFO(("]"));
+               }
+       }
+       if ((byte % 16) != 15)
+               DHD_INFO(("\n"));
+}
+#endif /* DHD_DEBUG */
+
+static bool
+dhdsdio_chipmatch(uint16 chipid)
+{
+       if (chipid == BCM4330_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43362_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43340_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43341_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4334_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4324_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4335_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4339_CHIP_ID)
+               return TRUE;
+       if (BCM4345_CHIP(chipid))
+               return TRUE;
+       if (chipid == BCM4350_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4354_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4358_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43569_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4371_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43430_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43018_CHIP_ID)
+               return TRUE;
+       if (BCM4349_CHIP(chipid))
+               return TRUE;
+       if (chipid == BCM4364_CHIP_ID)
+                       return TRUE;
+
+       if (chipid == BCM43012_CHIP_ID)
+               return TRUE;
+
+       if (chipid == BCM43014_CHIP_ID)
+               return TRUE;
+
+       if (chipid == BCM43013_CHIP_ID)
+               return TRUE;
+
+       if (chipid == BCM4369_CHIP_ID)
+               return TRUE;
+
+       if (BCM4378_CHIP(chipid)) {
+               return TRUE;
+       }
+
+       if (chipid == BCM4362_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43751_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43752_CHIP_ID)
+               return TRUE;
+
+       return FALSE;
+}
+
+static void *
+dhdsdio_probe(uint16 venid, uint16 devid, uint16 bus_no, uint16 slot,
+       uint16 func, uint bustype, void *regsva, osl_t * osh, void *sdh)
+{
+       int ret;
+       dhd_bus_t *bus;
+
+       DHD_MUTEX_LOCK();
+
+       /* Init global variables at run-time, not as part of the declaration.
+        * This is required to support init/de-init of the driver. Initialization
+        * of globals as part of the declaration results in non-deterministic
+        * behavior since the value of the globals may be different on the
+        * first time that the driver is initialized vs subsequent initializations.
+        */
+       dhd_txbound = DHD_TXBOUND;
+       dhd_rxbound = DHD_RXBOUND;
+#ifdef BCMSPI
+       dhd_alignctl = FALSE;
+#else
+       dhd_alignctl = TRUE;
+#endif /* BCMSPI */
+       sd1idle = TRUE;
+       dhd_readahead = TRUE;
+       retrydata = FALSE;
+
+#ifdef DISABLE_FLOW_CONTROL
+       dhd_doflow = FALSE;
+#endif /* DISABLE_FLOW_CONTROL */
+       dhd_dongle_ramsize = 0;
+       dhd_txminmax = DHD_TXMINMAX;
+
+#ifdef BCMSPI
+       forcealign = FALSE;
+#else
+       forcealign = TRUE;
+#endif /* !BCMSPI */
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+       DHD_INFO(("%s: venid 0x%04x devid 0x%04x\n", __FUNCTION__, venid, devid));
+
+       /* We make assumptions about address window mappings */
+       ASSERT((uintptr)regsva == si_enum_base(devid));
+
+       /* BCMSDH passes venid and devid based on CIS parsing -- but low-power start
+        * means early parse could fail, so here we should get either an ID
+        * we recognize OR (-1) indicating we must request power first.
+        */
+       /* Check the Vendor ID */
+       switch (venid) {
+               case 0x0000:
+               case VENDOR_BROADCOM:
+                       break;
+               default:
+                       DHD_ERROR(("%s: unknown vendor: 0x%04x\n",
+                                  __FUNCTION__, venid));
+                       goto forcereturn;
+       }
+
+       /* Check the Device ID and make sure it's one that we support */
+       switch (devid) {
+               case 0:
+                       DHD_INFO(("%s: allow device id 0, will check chip internals\n",
+                                 __FUNCTION__));
+                       break;
+
+               default:
+                       DHD_ERROR(("%s: skipping 0x%04x/0x%04x, not a dongle\n",
+                                  __FUNCTION__, venid, devid));
+                       goto forcereturn;
+       }
+
+       if (osh == NULL) {
+               DHD_ERROR(("%s: osh is NULL!\n", __FUNCTION__));
+               goto forcereturn;
+       }
+
+       /* Allocate private bus interface state */
+       if (!(bus = MALLOC(osh, sizeof(dhd_bus_t)))) {
+               DHD_ERROR(("%s: MALLOC of dhd_bus_t failed\n", __FUNCTION__));
+               goto fail;
+       }
+       bzero(bus, sizeof(dhd_bus_t));
+       bus->sdh = sdh;
+       bus->cl_devid = (uint16)devid;
+       bus->bus = DHD_BUS;
+       bus->bus_num = bus_no;
+       bus->slot_num = slot;
+       bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
+       bus->usebufpool = FALSE; /* Use bufpool if allocated, else use locally malloced rxbuf */
+#ifdef BT_OVER_SDIO
+       bus->bt_use_count = 0;
+#endif
+
+#if defined(SUPPORT_P2P_GO_PS)
+       init_waitqueue_head(&bus->bus_sleep);
+#endif /* LINUX && SUPPORT_P2P_GO_PS */
+       init_waitqueue_head(&bus->ctrl_tx_wait);
+
+       /* attempt to attach to the dongle */
+       if (!(dhdsdio_probe_attach(bus, osh, sdh, regsva, devid))) {
+               DHD_ERROR(("%s: dhdsdio_probe_attach failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+       /* Attach to the dhd/OS/network interface */
+       if (!(bus->dhd = dhd_attach(osh, bus, SDPCM_RESERVE))) {
+               DHD_ERROR(("%s: dhd_attach failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+#if defined(GET_OTP_MAC_ENABLE) || defined(GET_OTP_MODULE_NAME)
+       dhd_conf_get_otp(bus->dhd, sdh, bus->sih);
+#endif
+
+       /* Allocate buffers */
+       if (!(dhdsdio_probe_malloc(bus, osh, sdh))) {
+               DHD_ERROR(("%s: dhdsdio_probe_malloc failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+       if (!(dhdsdio_probe_init(bus, osh, sdh))) {
+               DHD_ERROR(("%s: dhdsdio_probe_init failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+       if (bus->intr) {
+               /* Register interrupt callback, but mask it (not operational yet). */
+               DHD_INTR(("%s: disable SDIO interrupts (not interested yet)\n", __FUNCTION__));
+               bcmsdh_intr_disable(sdh); /* XXX New API: bcmsdh_intr_mask()? */
+               if ((ret = bcmsdh_intr_reg(sdh, dhdsdio_isr, bus)) != 0) {
+                       DHD_ERROR(("%s: FAILED: bcmsdh_intr_reg returned %d\n",
+                                  __FUNCTION__, ret));
+                       goto fail;
+               }
+               DHD_INTR(("%s: registered SDIO interrupt function ok\n", __FUNCTION__));
+       } else {
+               DHD_INFO(("%s: SDIO interrupt function is NOT registered due to polling mode\n",
+                          __FUNCTION__));
+       }
+
+       DHD_INFO(("%s: completed!!\n", __FUNCTION__));
+
+       /* if firmware path present try to download and bring up bus */
+       bus->dhd->hang_report  = TRUE;
+#if 0 // terence 20150325: fix for WPA/WPA2 4-way handshake fail in hostapd
+       if (dhd_download_fw_on_driverload) {
+               if ((ret = dhd_bus_start(bus->dhd)) != 0) {
+                       DHD_ERROR(("%s: dhd_bus_start failed\n", __FUNCTION__));
+                               goto fail;
+               }
+       }
+       else {
+               /* Set random MAC address during boot time */
+               get_random_bytes(&bus->dhd->mac.octet[3], 3);
+               /* Adding BRCM OUI */
+               bus->dhd->mac.octet[0] = 0;
+               bus->dhd->mac.octet[1] = 0x90;
+               bus->dhd->mac.octet[2] = 0x4C;
+       }
+#endif
+#if defined(BT_OVER_SDIO)
+       /* At this point Regulators are turned on and iconditionaly sdio bus is started
+        * based upon dhd_download_fw_on_driverload check, so
+        * increase the bus user count, this count will only be disabled inside
+        * dhd_register_if() function if flag dhd_download_fw_on_driverload is set to false,
+        * i.e FW download during insmod is not needed, otherwise it will not be decremented
+        * so that WALN will always hold the bus untill rmmod is done.
+        */
+       dhdsdio_bus_usr_cnt_inc(bus->dhd);
+#endif /* BT_OVER_SDIO */
+
+#ifdef GET_OTP_MAC_ENABLE
+       if (memcmp(&ether_null, &bus->dhd->conf->otp_mac, ETHER_ADDR_LEN))
+               memcpy(bus->dhd->mac.octet, (void *)&bus->dhd->conf->otp_mac, ETHER_ADDR_LEN);
+#endif /* GET_CUSTOM_MAC_ENABLE */
+
+       /* Ok, have the per-port tell the stack we're open for business */
+       if (dhd_attach_net(bus->dhd, TRUE) != 0) {
+               DHD_ERROR(("%s: Net attach failed!!\n", __FUNCTION__));
+               goto fail;
+       }
+
+#ifdef BCMHOST_XTAL_PU_TIME_MOD
+       bcmsdh_reg_write(bus->sdh, 0x18000620, 2, 11);
+       bcmsdh_reg_write(bus->sdh, 0x18000628, 4, 0x00F80001);
+#endif /* BCMHOST_XTAL_PU_TIME_MOD */
+
+#if defined(MULTIPLE_SUPPLICANT)
+       wl_android_post_init(); // terence 20120530: fix critical section in dhd_open and dhdsdio_probe
+#endif /* MULTIPLE_SUPPLICANT */
+       DHD_MUTEX_UNLOCK();
+
+       return bus;
+
+fail:
+       dhdsdio_release(bus, osh);
+
+forcereturn:
+       DHD_MUTEX_UNLOCK();
+
+       return NULL;
+}
+
+static bool
+dhdsdio_probe_attach(struct dhd_bus *bus, osl_t *osh, void *sdh, void *regsva,
+                     uint16 devid)
+{
+#ifndef BCMSPI
+       int err = 0;
+       uint8 clkctl = 0;
+#endif /* !BCMSPI */
+
+       bus->alp_only = TRUE;
+       bus->sih = NULL;
+
+       /* Return the window to backplane enumeration space for core access */
+       if (dhdsdio_set_siaddr_window(bus, si_enum_base(devid))) {
+               DHD_ERROR(("%s: FAILED to return to SI_ENUM_BASE\n", __FUNCTION__));
+       }
+
+#if defined(DHD_DEBUG) && !defined(CUSTOMER_HW4_DEBUG)
+       DHD_ERROR(("F1 signature read @0x18000000=0x%4x\n",
+               bcmsdh_reg_read(bus->sdh, si_enum_base(devid), 4)));
+#endif /* DHD_DEBUG && !CUSTOMER_HW4_DEBUG */
+
+#ifndef BCMSPI /* wake-wlan in gSPI will bring up the htavail/alpavail clocks. */
+
+       /* Force PLL off until si_attach() programs PLL control regs */
+
+       /* XXX Ideally should not access F1 power control regs before
+        * reading CIS and confirming device.  But strapping option for
+        * low-power start requires turning on ALP before reading CIS,
+        * and at some point bcmsdh should read the CIS for the ID and
+        * not even tell us if it's some other device.  At this point
+        * (see above) we should know it's us (powered on) or can't read
+        * CIS so we need to power on and try.
+        */
+
+       /* WAR for PR 39902: must force HT off until PLL programmed. */
+       /* WAR for PR43618, PR44891: don't do ALPReq until ALPAvail set */
+
+       /* XXX Replace write/read sequence with single bcmsdh_cfg_raw() call */
+       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, DHD_INIT_CLKCTL1, &err);
+       if (!err)
+               clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+
+       if (err || ((clkctl & ~SBSDIO_AVBITS) != DHD_INIT_CLKCTL1)) {
+               DHD_ERROR(("dhdsdio_probe: ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
+                          err, DHD_INIT_CLKCTL1, clkctl));
+               goto fail;
+       }
+
+#endif /* !BCMSPI */
+
+#ifdef DHD_DEBUG
+       if (DHD_INFO_ON()) {
+               uint fn, numfn;
+               uint8 *cis = NULL;
+               int local_err = 0;
+
+#ifndef BCMSPI
+               numfn = bcmsdh_query_iofnum(sdh);
+               ASSERT(numfn <= SDIOD_MAX_IOFUNCS);
+
+               /* Make sure ALP is available before trying to read CIS */
+               SPINWAIT(((clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+                                                   SBSDIO_FUNC1_CHIPCLKCSR, NULL)),
+                         !SBSDIO_ALPAV(clkctl)), PMU_MAX_TRANSITION_DLY);
+
+               /* Now request ALP be put on the bus */
+               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                                DHD_INIT_CLKCTL2, &local_err);
+               /* XXX Account for possible delay between ALP available and on active */
+               OSL_DELAY(65);
+#else
+               numfn = 0; /* internally func is hardcoded to 1 as gSPI has cis on F1 only */
+#endif /* !BCMSPI */
+#ifndef BCMSDIOLITE
+               if (!(cis = MALLOC(osh, SBSDIO_CIS_SIZE_LIMIT))) {
+                       DHD_INFO(("dhdsdio_probe: cis malloc failed\n"));
+                       goto fail;
+               }
+
+               for (fn = 0; fn <= numfn; fn++) {
+                       bzero(cis, SBSDIO_CIS_SIZE_LIMIT);
+                       if ((err = bcmsdh_cis_read(sdh, fn, cis,
+                               SBSDIO_CIS_SIZE_LIMIT))) {
+                               DHD_INFO(("dhdsdio_probe: fn %d cis read err %d\n",
+                                       fn, err));
+                               break;
+                       }
+                       dhd_dump_cis(fn, cis);
+               }
+               MFREE(osh, cis, SBSDIO_CIS_SIZE_LIMIT);
+#else
+       BCM_REFERENCE(cis);
+       BCM_REFERENCE(fn);
+#endif /* DHD_DEBUG */
+               if (local_err) {
+                       DHD_ERROR(("dhdsdio_probe: failure reading or parsing CIS\n"));
+                       goto fail;
+               }
+       }
+#endif /* DHD_DEBUG */
+
+       /* si_attach() will provide an SI handle and scan the backplane */
+       if (!(bus->sih = si_attach((uint)devid, osh, regsva, DHD_BUS, sdh,
+                                  &bus->vars, &bus->varsz))) {
+               DHD_ERROR(("%s: si_attach failed!\n", __FUNCTION__));
+               goto fail;
+       }
+
+#ifdef DHD_DEBUG
+       DHD_ERROR(("F1 signature OK, socitype:0x%x chip:0x%4x rev:0x%x pkg:0x%x\n",
+               bus->sih->socitype, bus->sih->chip, bus->sih->chiprev, bus->sih->chippkg));
+#endif /* DHD_DEBUG */
+
+       /* XXX Let the layers below dhd know the chipid and chiprev for
+        * controlling sw WARs for hw PRs
+        */
+       bcmsdh_chipinfo(sdh, bus->sih->chip, bus->sih->chiprev);
+
+       if (!dhdsdio_chipmatch((uint16)bus->sih->chip)) {
+               DHD_ERROR(("%s: unsupported chip: 0x%04x\n",
+                          __FUNCTION__, bus->sih->chip));
+               goto fail;
+       }
+
+       if (bus->sih->buscorerev >= 12)
+               dhdsdio_clk_kso_init(bus);
+       else
+               bus->kso = TRUE;
+
+       si_sdiod_drive_strength_init(bus->sih, osh, dhd_sdiod_drive_strength);
+
+       /* Get info on the ARM and SOCRAM cores... */
+       /* XXX Should really be qualified by device id */
+       if (!DHD_NOPMU(bus)) {
+               if ((si_setcore(bus->sih, ARM7S_CORE_ID, 0)) ||
+                   (si_setcore(bus->sih, ARMCM3_CORE_ID, 0)) ||
+                   (si_setcore(bus->sih, ARMCR4_CORE_ID, 0))) {
+                       bus->armrev = si_corerev(bus->sih);
+               } else {
+                       DHD_ERROR(("%s: failed to find ARM core!\n", __FUNCTION__));
+                       goto fail;
+               }
+
+               if (!si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+                       if (!(bus->orig_ramsize = si_socram_size(bus->sih))) {
+                               DHD_ERROR(("%s: failed to find SOCRAM memory!\n", __FUNCTION__));
+                               goto fail;
+                       }
+               } else {
+                       /* cr4 has a different way to find the RAM size from TCM's */
+                       if (!(bus->orig_ramsize = si_tcm_size(bus->sih))) {
+                               DHD_ERROR(("%s: failed to find CR4-TCM memory!\n", __FUNCTION__));
+                               goto fail;
+                       }
+                       /* also populate base address */
+                       switch ((uint16)bus->sih->chip) {
+                       case BCM4335_CHIP_ID:
+                       case BCM4339_CHIP_ID:
+                               bus->dongle_ram_base = CR4_4335_RAM_BASE;
+                               break;
+                       case BCM4350_CHIP_ID:
+                       case BCM4354_CHIP_ID:
+                       case BCM4358_CHIP_ID:
+                       case BCM43569_CHIP_ID:
+                       case BCM4371_CHIP_ID:
+                               bus->dongle_ram_base = CR4_4350_RAM_BASE;
+                               break;
+                       case BCM4360_CHIP_ID:
+                               bus->dongle_ram_base = CR4_4360_RAM_BASE;
+                               break;
+                       CASE_BCM4345_CHIP:
+                               bus->dongle_ram_base = (bus->sih->chiprev < 6)  /* from 4345C0 */
+                                       ? CR4_4345_LT_C0_RAM_BASE : CR4_4345_GE_C0_RAM_BASE;
+                               break;
+                       case BCM4349_CHIP_GRPID:
+                               /* RAM based changed from 4349c0(revid=9) onwards */
+                               bus->dongle_ram_base = ((bus->sih->chiprev < 9) ?
+                                       CR4_4349_RAM_BASE: CR4_4349_RAM_BASE_FROM_REV_9);
+                               break;
+                       case BCM4364_CHIP_ID:
+                               bus->dongle_ram_base = CR4_4364_RAM_BASE;
+                               break;
+                       case BCM4362_CHIP_ID:
+                               bus->dongle_ram_base = CR4_4362_RAM_BASE;
+                               break;
+                       case BCM43751_CHIP_ID:
+                               bus->dongle_ram_base = CR4_43751_RAM_BASE;
+                               break;
+                       case BCM43752_CHIP_ID:
+                               bus->dongle_ram_base = CR4_43752_RAM_BASE;
+                               break;
+                       case BCM4369_CHIP_ID:
+                               bus->dongle_ram_base = CR4_4369_RAM_BASE;
+                               break;
+                       case BCM4378_CHIP_GRPID:
+                               bus->dongle_ram_base = CR4_4378_RAM_BASE;
+                               break;
+                       default:
+                               bus->dongle_ram_base = 0;
+                               DHD_ERROR(("%s: WARNING: Using default ram base at 0x%x\n",
+                                          __FUNCTION__, bus->dongle_ram_base));
+                       }
+               }
+               bus->ramsize = bus->orig_ramsize;
+               if (dhd_dongle_ramsize)
+                       dhd_dongle_setramsize(bus, dhd_dongle_ramsize);
+
+               DHD_ERROR(("DHD: dongle ram size is set to %d(orig %d) at 0x%x\n",
+                          bus->ramsize, bus->orig_ramsize, bus->dongle_ram_base));
+
+               bus->srmemsize = si_socram_srmem_size(bus->sih);
+       }
+
+       /* ...but normally deal with the SDPCMDEV core */
+#ifdef BCMSDIOLITE
+       if (!(bus->regs = si_setcore(bus->sih, CC_CORE_ID, 0))) {
+               DHD_ERROR(("%s: failed to find Chip Common core!\n", __FUNCTION__));
+               goto fail;
+       }
+#else
+       if (!(bus->regs = si_setcore(bus->sih, PCMCIA_CORE_ID, 0)) &&
+           !(bus->regs = si_setcore(bus->sih, SDIOD_CORE_ID, 0))) {
+               DHD_ERROR(("%s: failed to find SDIODEV core!\n", __FUNCTION__));
+               goto fail;
+       }
+#endif
+       bus->sdpcmrev = si_corerev(bus->sih);
+
+       /* Set core control so an SDIO reset does a backplane reset */
+       OR_REG(osh, &bus->regs->corecontrol, CC_BPRESEN);
+#ifndef BCMSPI
+       bus->rxint_mode = SDIO_DEVICE_HMB_RXINT;
+
+       if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev >= 4) &&
+               (bus->rxint_mode  == SDIO_DEVICE_RXDATAINT_MODE_1))
+       {
+               uint32 val;
+
+               val = R_REG(osh, &bus->regs->corecontrol);
+               val &= ~CC_XMTDATAAVAIL_MODE;
+               val |= CC_XMTDATAAVAIL_CTRL;
+               W_REG(osh, &bus->regs->corecontrol, val);
+       }
+#endif /* BCMSPI */
+
+       /* XXX Tx needs priority queue, where to determine levels? */
+       /* XXX Should it try to do WLC mapping, or just pass through? */
+       pktq_init(&bus->txq, (PRIOMASK + 1), QLEN);
+
+       /* Locate an appropriately-aligned portion of hdrbuf */
+       bus->rxhdr = (uint8 *)ROUNDUP((uintptr)&bus->hdrbuf[0], DHD_SDALIGN);
+
+       /* Set the poll and/or interrupt flags */
+       bus->intr = (bool)dhd_intr;
+       if ((bus->poll = (bool)dhd_poll))
+               bus->pollrate = 1;
+
+       /* Setting default Glom size */
+       bus->txglomsize = SDPCM_DEFGLOM_SIZE;
+
+       return TRUE;
+
+fail:
+       if (bus->sih != NULL) {
+               si_detach(bus->sih);
+               bus->sih = NULL;
+       }
+       return FALSE;
+}
+
+static bool
+dhdsdio_probe_malloc(dhd_bus_t *bus, osl_t *osh, void *sdh)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus->dhd->maxctl) {
+               bus->rxblen = ROUNDUP((bus->dhd->maxctl+SDPCM_HDRLEN), ALIGNMENT) + DHD_SDALIGN;
+               if (!(bus->rxbuf = DHD_OS_PREALLOC(bus->dhd, DHD_PREALLOC_RXBUF, bus->rxblen))) {
+                       DHD_ERROR(("%s: MALLOC of %d-byte rxbuf failed\n",
+                                  __FUNCTION__, bus->rxblen));
+                       goto fail;
+               }
+       }
+       /* Allocate buffer to receive glomed packet */
+       if (!(bus->databuf = DHD_OS_PREALLOC(bus->dhd, DHD_PREALLOC_DATABUF, MAX_DATA_BUF))) {
+               DHD_ERROR(("%s: MALLOC of %d-byte databuf failed\n",
+                       __FUNCTION__, MAX_DATA_BUF));
+               /* release rxbuf which was already located as above */
+               if (!bus->rxblen)
+                       DHD_OS_PREFREE(bus->dhd, bus->rxbuf, bus->rxblen);
+               goto fail;
+       }
+       /* Allocate buffer to membuf */
+       bus->membuf = MALLOC(osh, MAX_MEM_BUF);
+       if (bus->membuf == NULL) {
+               DHD_ERROR(("%s: MALLOC of %d-byte membuf failed\n",
+                       __FUNCTION__, MAX_MEM_BUF));
+               if (bus->databuf) {
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+                       MFREE(osh, bus->databuf, MAX_DATA_BUF);
+#endif
+                       bus->databuf = NULL;
+               }
+               /* release rxbuf which was already located as above */
+               if (!bus->rxblen)
+                       DHD_OS_PREFREE(bus->dhd, bus->rxbuf, bus->rxblen);
+               goto fail;
+       }
+       memset(bus->membuf, 0, MAX_MEM_BUF);
+
+       /* Align the buffer */
+       if ((uintptr)bus->databuf % DHD_SDALIGN)
+               bus->dataptr = bus->databuf + (DHD_SDALIGN - ((uintptr)bus->databuf % DHD_SDALIGN));
+       else
+               bus->dataptr = bus->databuf;
+
+       return TRUE;
+
+fail:
+       return FALSE;
+}
+
+static bool
+dhdsdio_probe_init(dhd_bus_t *bus, osl_t *osh, void *sdh)
+{
+       int32 fnum;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       bus->_srenab = FALSE;
+
+#ifdef SDTEST
+       dhdsdio_pktgen_init(bus);
+#endif /* SDTEST */
+
+#ifndef BCMSPI
+       /* Disable F2 to clear any intermediate frame state on the dongle */
+       /* XXX New API: change to bcmsdh_fn_set(sdh, SDIO_FUNC_2, FALSE); */
+       /* XXX Might write SRES instead, or reset ARM (download prep)? */
+       bcmsdh_cfg_write(sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, SDIO_FUNC_ENABLE_1, NULL);
+#endif /* !BCMSPI */
+
+       DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+       bus->dhd->busstate = DHD_BUS_DOWN;
+       bus->sleeping = FALSE;
+       bus->rxflow = FALSE;
+       bus->prev_rxlim_hit = 0;
+
+#ifndef BCMSPI
+       /* Done with backplane-dependent accesses, can drop clock... */
+       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
+#endif /* !BCMSPI */
+
+       /* ...and initialize clock/power states */
+       bus->clkstate = CLK_SDONLY;
+       bus->idletime = (int32)dhd_idletime;
+       bus->idleclock = DHD_IDLE_ACTIVE;
+
+       /* Query the SD clock speed */
+       if (bcmsdh_iovar_op(sdh, "sd_divisor", NULL, 0,
+                           &bus->sd_divisor, sizeof(int32), FALSE) != BCME_OK) {
+               DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_divisor"));
+               bus->sd_divisor = -1;
+       } else {
+               DHD_INFO(("%s: Initial value for %s is %d\n",
+                         __FUNCTION__, "sd_divisor", bus->sd_divisor));
+       }
+
+       /* Query the SD bus mode */
+       if (bcmsdh_iovar_op(sdh, "sd_mode", NULL, 0,
+                           &bus->sd_mode, sizeof(int32), FALSE) != BCME_OK) {
+               DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_mode"));
+               bus->sd_mode = -1;
+       } else {
+               DHD_INFO(("%s: Initial value for %s is %d\n",
+                         __FUNCTION__, "sd_mode", bus->sd_mode));
+       }
+
+       /* Query the F2 block size, set roundup accordingly */
+       fnum = 2;
+       if (bcmsdh_iovar_op(sdh, "sd_blocksize", &fnum, sizeof(int32),
+                           &bus->blocksize, sizeof(int32), FALSE) != BCME_OK) {
+               bus->blocksize = 0;
+               DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_blocksize"));
+       } else {
+               DHD_INFO(("%s: Initial value for %s is %d\n",
+                         __FUNCTION__, "sd_blocksize", bus->blocksize));
+
+               dhdsdio_tune_fifoparam(bus);
+       }
+       bus->roundup = MIN(max_roundup, bus->blocksize);
+
+#ifdef DHDENABLE_TAILPAD
+       if (bus->pad_pkt)
+               PKTFREE(osh, bus->pad_pkt, FALSE);
+       bus->pad_pkt = PKTGET(osh, SDIO_MAX_BLOCK_SIZE, FALSE);
+       if (bus->pad_pkt == NULL)
+               DHD_ERROR(("failed to allocate padding packet\n"));
+       else {
+               int alignment_offset = 0;
+               uintptr pktprt = (uintptr)PKTDATA(osh, bus->pad_pkt);
+               if (!(pktprt&1) && (pktprt = (pktprt % DHD_SDALIGN)))
+                       PKTPUSH(osh, bus->pad_pkt, alignment_offset);
+               PKTSETNEXT(osh, bus->pad_pkt, NULL);
+       }
+#endif /* DHDENABLE_TAILPAD */
+
+       /* Query if bus module supports packet chaining, default to use if supported */
+       if (bcmsdh_iovar_op(sdh, "sd_rxchain", NULL, 0,
+                           &bus->sd_rxchain, sizeof(int32), FALSE) != BCME_OK) {
+               bus->sd_rxchain = FALSE;
+       } else {
+               DHD_INFO(("%s: bus module (through bcmsdh API) %s chaining\n",
+                         __FUNCTION__, (bus->sd_rxchain ? "supports" : "does not support")));
+       }
+       bus->use_rxchain = (bool)bus->sd_rxchain;
+       bus->txinrx_thres = CUSTOM_TXINRX_THRES;
+       /* TX first in dhdsdio_readframes() */
+       bus->dotxinrx = TRUE;
+
+#ifdef PKT_STATICS
+       dhd_bus_clear_txpktstatics(bus);
+#endif
+
+       return TRUE;
+}
+
+int
+dhd_bus_download_firmware(struct dhd_bus *bus, osl_t *osh,
+                          char *pfw_path, char *pnv_path,
+                          char *pclm_path, char *pconf_path)
+{
+       int ret;
+
+       bus->fw_path = pfw_path;
+       bus->nv_path = pnv_path;
+       bus->dhd->clm_path = pclm_path;
+       bus->dhd->conf_path = pconf_path;
+
+       ret = dhdsdio_download_firmware(bus, osh, bus->sdh);
+
+       return ret;
+}
+
+void
+dhd_set_bus_params(struct dhd_bus *bus)
+{
+       if (bus->dhd->conf->dhd_poll >= 0) {
+               bus->poll = bus->dhd->conf->dhd_poll;
+               if (!bus->pollrate)
+                       bus->pollrate = 1;
+               printf("%s: set polling mode %d\n", __FUNCTION__, bus->dhd->conf->dhd_poll);
+       }
+       if (bus->dhd->conf->use_rxchain >= 0) {
+               bus->use_rxchain = (bool)bus->dhd->conf->use_rxchain;
+       }
+       if (bus->dhd->conf->txinrx_thres >= 0) {
+               bus->txinrx_thres = bus->dhd->conf->txinrx_thres;
+       }
+       if (bus->dhd->conf->txglomsize >= 0) {
+               bus->txglomsize = bus->dhd->conf->txglomsize;
+       }
+#ifdef MINIME
+       if (bus->dhd->conf->fw_type == FW_TYPE_MINIME) {
+               bus->ramsize = bus->dhd->conf->ramsize;
+               printf("%s: set ramsize 0x%x\n", __FUNCTION__, bus->ramsize);
+       }
+#endif
+}
+
+static int
+dhdsdio_download_firmware(struct dhd_bus *bus, osl_t *osh, void *sdh)
+{
+       int ret;
+
+#if defined(SUPPORT_MULTIPLE_REVISION)
+       if (concate_revision(bus, bus->fw_path, bus->nv_path) != 0) {
+               DHD_ERROR(("%s: fail to concatnate revison \n",
+                       __FUNCTION__));
+               return BCME_BADARG;
+       }
+#endif /* SUPPORT_MULTIPLE_REVISION */
+
+#if defined(DHD_BLOB_EXISTENCE_CHECK)
+       dhd_set_blob_support(bus->dhd, bus->fw_path);
+#endif /* DHD_BLOB_EXISTENCE_CHECK */
+
+       DHD_TRACE_HW4(("%s: firmware path=%s, nvram path=%s\n",
+               __FUNCTION__, bus->fw_path, bus->nv_path));
+       DHD_OS_WAKE_LOCK(bus->dhd);
+
+       dhd_conf_set_path_params(bus->dhd, bus->fw_path, bus->nv_path);
+       dhd_set_bus_params(bus);
+
+       /* Download the firmware */
+       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+       ret = _dhdsdio_download_firmware(bus);
+
+       dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+
+       DHD_OS_WAKE_UNLOCK(bus->dhd);
+       return ret;
+}
+
+/* Detach and free everything */
+static void
+dhdsdio_release(dhd_bus_t *bus, osl_t *osh)
+{
+       bool dongle_isolation = FALSE;
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus) {
+               ASSERT(osh);
+
+               if (bus->dhd) {
+#if defined(DEBUGGER) || defined(DHD_DSCOPE)
+                       debugger_close();
+#endif /* DEBUGGER || DHD_DSCOPE */
+                       dongle_isolation = bus->dhd->dongle_isolation;
+                       dhd_detach(bus->dhd);
+               }
+
+               /* De-register interrupt handler */
+               bcmsdh_intr_disable(bus->sdh);
+               bcmsdh_intr_dereg(bus->sdh);
+
+               if (bus->dhd) {
+                       dhdsdio_release_dongle(bus, osh, dongle_isolation, TRUE);
+                       dhd_free(bus->dhd);
+                       bus->dhd = NULL;
+               }
+
+               dhdsdio_release_malloc(bus, osh);
+
+#ifdef DHD_DEBUG
+               if (bus->console.buf != NULL)
+                       MFREE(osh, bus->console.buf, bus->console.bufsize);
+#endif
+
+#ifdef DHDENABLE_TAILPAD
+               if (bus->pad_pkt)
+                       PKTFREE(osh, bus->pad_pkt, FALSE);
+#endif /* DHDENABLE_TAILPAD */
+
+               MFREE(osh, bus, sizeof(dhd_bus_t));
+       }
+
+       DHD_TRACE(("%s: Disconnected\n", __FUNCTION__));
+}
+
+static void
+dhdsdio_release_malloc(dhd_bus_t *bus, osl_t *osh)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus->dhd && bus->dhd->dongle_reset)
+               return;
+
+       if (bus->rxbuf) {
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+               MFREE(osh, bus->rxbuf, bus->rxblen);
+#endif
+               bus->rxctl = NULL;
+               bus->rxlen = 0;
+       }
+
+       if (bus->databuf) {
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+               MFREE(osh, bus->databuf, MAX_DATA_BUF);
+#endif
+       }
+
+       if (bus->membuf) {
+               MFREE(osh, bus->membuf, MAX_DATA_BUF);
+               bus->membuf = NULL;
+       }
+
+       if (bus->vars && bus->varsz) {
+               MFREE(osh, bus->vars, bus->varsz);
+       }
+
+}
+
+static void
+dhdsdio_release_dongle(dhd_bus_t *bus, osl_t *osh, bool dongle_isolation, bool reset_flag)
+{
+       DHD_TRACE(("%s: Enter bus->dhd %p bus->dhd->dongle_reset %d \n", __FUNCTION__,
+               bus->dhd, bus->dhd->dongle_reset));
+
+       if ((bus->dhd && bus->dhd->dongle_reset) && reset_flag)
+               return;
+
+       if (bus->sih) {
+               /* In Win10, system will be BSOD if using "sysprep" to do OS image */
+               /* Skip this will not cause the BSOD. */
+#if !defined(BCMLXSDMMC)
+               /* XXX - Using the watchdog to reset the chip does not allow
+                * further SDIO communication.  For the SDMMC Driver, this
+                * causes interrupt to not be de-registered properly.
+                */
+               /* XXX: dongle isolation mode is on don't reset the chip */
+               if (bus->dhd) {
+                       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+               }
+               if (KSO_ENAB(bus) && (dongle_isolation == FALSE))
+                       si_watchdog(bus->sih, 4);
+#endif /* !defined(BCMLXSDMMC) */
+               if (bus->dhd) {
+                       dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+               }
+               si_detach(bus->sih);
+               bus->sih = NULL;
+               if (bus->vars && bus->varsz)
+                       MFREE(osh, bus->vars, bus->varsz);
+               bus->vars = NULL;
+       }
+
+       DHD_TRACE(("%s: Disconnected\n", __FUNCTION__));
+}
+
+static void
+dhdsdio_disconnect(void *ptr)
+{
+       dhd_bus_t *bus = (dhd_bus_t *)ptr;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       DHD_MUTEX_LOCK();
+       if (bus) {
+               ASSERT(bus->dhd);
+               /* Advertise bus remove during rmmod */
+               dhdsdio_advertise_bus_remove(bus->dhd);
+               dhdsdio_release(bus, bus->dhd->osh);
+       }
+       DHD_MUTEX_UNLOCK();
+
+       DHD_TRACE(("%s: Disconnected\n", __FUNCTION__));
+}
+
+static int
+dhdsdio_suspend(void *context)
+{
+       int ret = 0;
+#ifdef SUPPORT_P2P_GO_PS
+       int wait_time = 0;
+#endif /* SUPPORT_P2P_GO_PS */
+
+       dhd_bus_t *bus = (dhd_bus_t*)context;
+       unsigned long flags;
+
+       DHD_ERROR(("%s Enter\n", __FUNCTION__));
+       if (bus->dhd == NULL) {
+               DHD_ERROR(("bus not inited\n"));
+               return BCME_ERROR;
+       }
+       if (bus->dhd->prot == NULL) {
+               DHD_ERROR(("prot is not inited\n"));
+               return BCME_ERROR;
+       }
+
+       if (bus->dhd->up == FALSE) {
+               return BCME_OK;
+       }
+
+       DHD_LINUX_GENERAL_LOCK(bus->dhd, flags);
+       if (bus->dhd->busstate != DHD_BUS_DATA && bus->dhd->busstate != DHD_BUS_SUSPEND) {
+               DHD_ERROR(("not in a readystate to LPBK  is not inited\n"));
+               DHD_LINUX_GENERAL_UNLOCK(bus->dhd, flags);
+               return BCME_ERROR;
+       }
+       DHD_LINUX_GENERAL_UNLOCK(bus->dhd, flags);
+       if (bus->dhd->dongle_reset) {
+               DHD_ERROR(("Dongle is in reset state.\n"));
+               return -EIO;
+       }
+
+       DHD_LINUX_GENERAL_LOCK(bus->dhd, flags);
+       /* stop all interface network queue. */
+       dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, ON);
+       bus->dhd->busstate = DHD_BUS_SUSPEND;
+       if (DHD_BUS_BUSY_CHECK_IN_TX(bus->dhd)) {
+               DHD_ERROR(("Tx Request is not ended\n"));
+               bus->dhd->busstate = DHD_BUS_DATA;
+               /* resume all interface network queue. */
+               dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, OFF);
+               DHD_LINUX_GENERAL_UNLOCK(bus->dhd, flags);
+               return -EBUSY;
+       }
+       DHD_BUS_BUSY_SET_SUSPEND_IN_PROGRESS(bus->dhd);
+       DHD_LINUX_GENERAL_UNLOCK(bus->dhd, flags);
+
+#ifdef SUPPORT_P2P_GO_PS
+       if (bus->idletime > 0) {
+               wait_time = msecs_to_jiffies(bus->idletime * dhd_watchdog_ms);
+       }
+#endif /* SUPPORT_P2P_GO_PS */
+       ret = dhd_os_check_wakelock(bus->dhd);
+#ifdef SUPPORT_P2P_GO_PS
+       // terence 20141124: fix for suspend issue
+       if (SLPAUTO_ENAB(bus) && (!ret) && (bus->dhd->up) && (bus->dhd->op_mode != DHD_FLAG_HOSTAP_MODE)) {
+               if (wait_event_timeout(bus->bus_sleep, bus->sleeping, wait_time) == 0) {
+                       if (!bus->sleeping) {
+                               ret = 1;
+                       }
+               }
+       }
+#endif /* SUPPORT_P2P_GO_PS */
+
+       DHD_LINUX_GENERAL_LOCK(bus->dhd, flags);
+       if (ret) {
+               bus->dhd->busstate = DHD_BUS_DATA;
+               /* resume all interface network queue. */
+               dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, OFF);
+       }
+       DHD_BUS_BUSY_CLEAR_SUSPEND_IN_PROGRESS(bus->dhd);
+       dhd_os_busbusy_wake(bus->dhd);
+       DHD_LINUX_GENERAL_UNLOCK(bus->dhd, flags);
+       return ret;
+}
+
+static int
+dhdsdio_resume(void *context)
+{
+       dhd_bus_t *bus = (dhd_bus_t*)context;
+       ulong flags;
+
+       DHD_ERROR(("%s Enter\n", __FUNCTION__));
+
+       if (bus->dhd->up == FALSE) {
+               return BCME_OK;
+       }
+
+       DHD_LINUX_GENERAL_LOCK(bus->dhd, flags);
+       DHD_BUS_BUSY_SET_RESUME_IN_PROGRESS(bus->dhd);
+       DHD_LINUX_GENERAL_UNLOCK(bus->dhd, flags);
+
+#if defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID)
+       if (dhd_os_check_if_up(bus->dhd))
+               bcmsdh_oob_intr_set(bus->sdh, TRUE);
+#endif /* defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID) */
+
+       DHD_LINUX_GENERAL_LOCK(bus->dhd, flags);
+       DHD_BUS_BUSY_CLEAR_RESUME_IN_PROGRESS(bus->dhd);
+       bus->dhd->busstate = DHD_BUS_DATA;
+       dhd_os_busbusy_wake(bus->dhd);
+       /* resume all interface network queue. */
+       dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, OFF);
+       DHD_LINUX_GENERAL_UNLOCK(bus->dhd, flags);
+
+       return 0;
+}
+
+/* Register/Unregister functions are called by the main DHD entry
+ * point (e.g. module insertion) to link with the bus driver, in
+ * order to look for or await the device.
+ */
+
+static bcmsdh_driver_t dhd_sdio = {
+       dhdsdio_probe,
+       dhdsdio_disconnect,
+       dhdsdio_suspend,
+       dhdsdio_resume
+};
+
+int
+dhd_bus_register(void)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       return bcmsdh_register(&dhd_sdio);
+}
+
+void
+dhd_bus_unregister(void)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       bcmsdh_unregister();
+}
+
+#if defined(BCMLXSDMMC)
+/* Register a dummy SDIO client driver in order to be notified of new SDIO device */
+int dhd_bus_reg_sdio_notify(void* semaphore)
+{
+       return bcmsdh_reg_sdio_notify(semaphore);
+}
+
+void dhd_bus_unreg_sdio_notify(void)
+{
+       bcmsdh_unreg_sdio_notify();
+}
+#endif /* defined(BCMLXSDMMC) */
+
+static int
+dhdsdio_download_code_file(struct dhd_bus *bus, char *pfw_path)
+{
+       int bcmerror = -1;
+       int offset = 0;
+       int len;
+       void *image = NULL;
+       uint8 *memblock = NULL, *memptr;
+       uint8 *memptr_tmp = NULL; // terence: check downloaded firmware is correct
+       uint memblock_size = MEMBLOCK;
+#ifdef DHD_DEBUG_DOWNLOADTIME
+       unsigned long initial_jiffies = 0;
+       uint firmware_sz = 0;
+#endif
+
+       DHD_INFO(("%s: download firmware %s\n", __FUNCTION__, pfw_path));
+
+       /* XXX: Should succeed in opening image if it is actually given through registry
+        * entry or in module param.
+        */
+       image = dhd_os_open_image1(bus->dhd, pfw_path);
+       if (image == NULL) {
+               printf("%s: Open firmware file failed %s\n", __FUNCTION__, pfw_path);
+               goto err;
+       }
+
+       /* Update the dongle image download block size depending on the F1 block size */
+       if (sd_f1_blocksize == 512)
+               memblock_size = MAX_MEMBLOCK;
+
+       memptr = memblock = MALLOC(bus->dhd->osh, memblock_size + DHD_SDALIGN);
+       if (memblock == NULL) {
+               DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__,
+                       memblock_size));
+               goto err;
+       }
+       if (dhd_msg_level & DHD_TRACE_VAL) {
+               memptr_tmp = MALLOC(bus->dhd->osh, MEMBLOCK + DHD_SDALIGN);
+               if (memptr_tmp == NULL) {
+                       DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__, MEMBLOCK));
+                       goto err;
+               }
+       }
+       if ((uint32)(uintptr)memblock % DHD_SDALIGN)
+               memptr += (DHD_SDALIGN - ((uint32)(uintptr)memblock % DHD_SDALIGN));
+
+#ifdef DHD_DEBUG_DOWNLOADTIME
+       initial_jiffies = jiffies;
+#endif
+
+       /* Download image */
+       while ((len = dhd_os_get_image_block((char*)memptr, memblock_size, image))) {
+               // terence 20150412: fix for firmware failed to download
+               if (bus->dhd->conf->chip == BCM43340_CHIP_ID ||
+                               bus->dhd->conf->chip == BCM43341_CHIP_ID) {
+                       if (len % 64 != 0) {
+                               memset(memptr+len, 0, len%64);
+                               len += (64 - len%64);
+                       }
+               }
+               if (len < 0) {
+                       DHD_ERROR(("%s: dhd_os_get_image_block failed (%d)\n", __FUNCTION__, len));
+                       bcmerror = BCME_ERROR;
+                       goto err;
+               }
+               /* check if CR4 */
+               if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+                       /* if address is 0, store the reset instruction to be written in 0 */
+
+                       if (offset == 0) {
+                               bus->resetinstr = *(((uint32*)memptr));
+                               /* Add start of RAM address to the address given by user */
+                               offset += bus->dongle_ram_base;
+                       }
+               }
+
+               bcmerror = dhdsdio_membytes(bus, TRUE, offset, memptr, len);
+               if (bcmerror) {
+                       DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                               __FUNCTION__, bcmerror, memblock_size, offset));
+                       goto err;
+               }
+
+               if (dhd_msg_level & DHD_TRACE_VAL) {
+                       bcmerror = dhdsdio_membytes(bus, FALSE, offset, memptr_tmp, len);
+                       if (bcmerror) {
+                               DHD_ERROR(("%s: error %d on reading %d membytes at 0x%08x\n",
+                                       __FUNCTION__, bcmerror, MEMBLOCK, offset));
+                               goto err;
+                       }
+                       if (memcmp(memptr_tmp, memptr, len)) {
+                               DHD_ERROR(("%s: Downloaded image is corrupted.\n", __FUNCTION__));
+                               goto err;
+                       } else
+                               DHD_INFO(("%s: Download, Upload and compare succeeded.\n", __FUNCTION__));
+               }
+
+               offset += memblock_size;
+#ifdef DHD_DEBUG_DOWNLOADTIME
+               firmware_sz += len;
+#endif
+       }
+
+#ifdef DHD_DEBUG_DOWNLOADTIME
+       DHD_ERROR(("Firmware download time for %u bytes: %u ms\n",
+                       firmware_sz, jiffies_to_msecs(jiffies - initial_jiffies)));
+#endif
+
+err:
+       if (memblock)
+               MFREE(bus->dhd->osh, memblock, memblock_size + DHD_SDALIGN);
+       if (dhd_msg_level & DHD_TRACE_VAL) {
+               if (memptr_tmp)
+                       MFREE(bus->dhd->osh, memptr_tmp, MEMBLOCK + DHD_SDALIGN);
+       }
+
+       if (image)
+               dhd_os_close_image1(bus->dhd, image);
+
+       return bcmerror;
+}
+
+#ifdef DHD_UCODE_DOWNLOAD
+/* Currently supported only for the chips in which ucode RAM is AXI addressable */
+static uint32
+dhdsdio_ucode_base(struct dhd_bus *bus)
+{
+       uint32 ucode_base = 0;
+
+       switch ((uint16)bus->sih->chip) {
+       case BCM43012_CHIP_ID:
+       case BCM43013_CHIP_ID:
+       case BCM43014_CHIP_ID:
+               ucode_base = 0xE8020000;
+               break;
+       default:
+               DHD_ERROR(("%s: Unsupported!\n", __func__));
+               break;
+       }
+
+       return ucode_base;
+}
+
+static int
+dhdsdio_download_ucode_file(struct dhd_bus *bus, char *ucode_path)
+{
+       int bcmerror = -1;
+       int offset = 0;
+       int len;
+       uint32 ucode_base;
+       void *image = NULL;
+       uint8 *memblock = NULL, *memptr;
+       uint memblock_size = MEMBLOCK;
+#ifdef DHD_DEBUG_DOWNLOADTIME
+       unsigned long initial_jiffies = 0;
+       uint firmware_sz = 0;
+#endif
+
+       DHD_INFO(("%s: download firmware %s\n", __FUNCTION__, ucode_path));
+
+       ucode_base = dhdsdio_ucode_base(bus);
+
+       /* XXX: Should succeed in opening image if it is actually given through registry
+        * entry or in module param.
+        */
+       image = dhd_os_open_image1(bus->dhd, ucode_path);
+       if (image == NULL)
+               goto err;
+
+       /* Update the dongle image download block size depending on the F1 block size */
+       if (sd_f1_blocksize == 512)
+               memblock_size = MAX_MEMBLOCK;
+
+       memptr = memblock = MALLOC(bus->dhd->osh, memblock_size + DHD_SDALIGN);
+       if (memblock == NULL) {
+               DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__,
+                       memblock_size));
+               goto err;
+       }
+       if ((uint32)(uintptr)memblock % DHD_SDALIGN)
+               memptr += (DHD_SDALIGN - ((uint32)(uintptr)memblock % DHD_SDALIGN));
+
+#ifdef DHD_DEBUG_DOWNLOADTIME
+       initial_jiffies = jiffies;
+#endif
+
+       /* Download image */
+       while ((len = dhd_os_get_image_block((char*)memptr, memblock_size, image))) {
+               if (len < 0) {
+                       DHD_ERROR(("%s: dhd_os_get_image_block failed (%d)\n", __FUNCTION__, len));
+                       bcmerror = BCME_ERROR;
+                       goto err;
+               }
+
+               bcmerror = dhdsdio_membytes(bus, TRUE, (ucode_base + offset), memptr, len);
+               if (bcmerror) {
+                       DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                               __FUNCTION__, bcmerror, memblock_size, offset));
+                       goto err;
+               }
+
+               offset += memblock_size;
+#ifdef DHD_DEBUG_DOWNLOADTIME
+               firmware_sz += len;
+#endif
+       }
+
+#ifdef DHD_DEBUG_DOWNLOADTIME
+       DHD_ERROR(("ucode download time for %u bytes: %u ms\n",
+                       firmware_sz, jiffies_to_msecs(jiffies - initial_jiffies)));
+#endif
+
+err:
+       if (memblock)
+               MFREE(bus->dhd->osh, memblock, memblock_size + DHD_SDALIGN);
+
+       if (image)
+               dhd_os_close_image1(bus->dhd, image);
+
+       return bcmerror;
+} /* dhdsdio_download_ucode_file */
+
+void
+dhd_bus_ucode_download(struct dhd_bus *bus)
+{
+       uint32 shaddr = 0, shdata = 0;
+
+       shaddr = bus->dongle_ram_base + bus->ramsize - 4;
+       dhdsdio_membytes(bus, FALSE, shaddr, (uint8 *)&shdata, 4);
+
+       DHD_TRACE(("%s: shdata:[0x%08x :0x%08x]\n", __func__, shaddr, shdata));
+
+       if (shdata == UCODE_DOWNLOAD_REQUEST)
+       {
+               DHD_ERROR(("%s: Received ucode download request!\n", __func__));
+
+               /* Download the ucode */
+               if (!dhd_get_ucode_path(bus->dhd)) {
+                       DHD_ERROR(("%s: bus->uc_path not set!\n", __func__));
+                       return;
+               }
+               dhdsdio_download_ucode_file(bus, dhd_get_ucode_path(bus->dhd));
+
+               DHD_ERROR(("%s: Ucode downloaded successfully!\n", __func__));
+
+               shdata = UCODE_DOWNLOAD_COMPLETE;
+               dhdsdio_membytes(bus, TRUE, shaddr, (uint8 *)&shdata, 4);
+       }
+}
+
+#endif /* DHD_UCODE_DOWNLOAD */
+
+static int
+dhdsdio_download_nvram(struct dhd_bus *bus)
+{
+       int bcmerror = -1;
+       uint len;
+       void * image = NULL;
+       char * memblock = NULL;
+       char *bufp;
+       char *pnv_path;
+       bool nvram_file_exists;
+
+       pnv_path = bus->nv_path;
+
+       nvram_file_exists = ((pnv_path != NULL) && (pnv_path[0] != '\0'));
+
+       /* For Get nvram from UEFI */
+       if (nvram_file_exists) {
+               image = dhd_os_open_image1(bus->dhd, pnv_path);
+               if (image == NULL) {
+                       printf("%s: Open nvram file failed %s\n", __FUNCTION__, pnv_path);
+                       goto err;
+               }
+       }
+
+       memblock = MALLOC(bus->dhd->osh, MAX_NVRAMBUF_SIZE);
+       if (memblock == NULL) {
+               DHD_ERROR(("%s: Failed to allocate memory %d bytes\n",
+                          __FUNCTION__, MAX_NVRAMBUF_SIZE));
+               goto err;
+       }
+
+       /* For Get nvram from image or UEFI (when image == NULL ) */
+       len = dhd_os_get_image_block(memblock, MAX_NVRAMBUF_SIZE, image);
+
+       if (len > 0 && len < MAX_NVRAMBUF_SIZE) {
+               bufp = (char *)memblock;
+               bufp[len] = 0;
+               len = process_nvram_vars(bufp, len);
+               if (len % 4) {
+                       len += 4 - (len % 4);
+               }
+               bufp += len;
+               *bufp++ = 0;
+               if (len)
+                       bcmerror = dhdsdio_downloadvars(bus, memblock, len + 1);
+               if (bcmerror) {
+                       DHD_ERROR(("%s: error downloading vars: %d\n",
+                                  __FUNCTION__, bcmerror));
+               }
+       } else {
+               DHD_ERROR(("%s: error reading nvram file: %d\n",
+                          __FUNCTION__, len));
+               bcmerror = BCME_SDIO_ERROR;
+       }
+
+err:
+       if (memblock)
+               MFREE(bus->dhd->osh, memblock, MAX_NVRAMBUF_SIZE);
+
+       if (image)
+               dhd_os_close_image1(bus->dhd, image);
+
+       return bcmerror;
+}
+
+static int
+_dhdsdio_download_firmware(struct dhd_bus *bus)
+{
+       int bcmerror = -1;
+
+       bool embed = FALSE;     /* download embedded firmware */
+       bool dlok = FALSE;      /* download firmware succeeded */
+
+       /* Out immediately if no image to download */
+       if ((bus->fw_path == NULL) || (bus->fw_path[0] == '\0')) {
+               return bcmerror;
+       }
+
+       /* Keep arm in reset */
+       if (dhdsdio_download_state(bus, TRUE)) {
+               DHD_ERROR(("%s: error placing ARM core in reset\n", __FUNCTION__));
+               goto err;
+       }
+
+       /* External image takes precedence if specified */
+       if ((bus->fw_path != NULL) && (bus->fw_path[0] != '\0')) {
+               if (dhdsdio_download_code_file(bus, bus->fw_path)) {
+                       DHD_ERROR(("%s: dongle image file download failed\n", __FUNCTION__));
+                       goto err;
+               } else {
+                       embed = FALSE;
+                       dlok = TRUE;
+               }
+       }
+
+       BCM_REFERENCE(embed);
+       if (!dlok) {
+               DHD_ERROR(("%s: dongle image download failed\n", __FUNCTION__));
+               goto err;
+       }
+
+       /* External nvram takes precedence if specified */
+       if (dhdsdio_download_nvram(bus)) {
+               DHD_ERROR(("%s: dongle nvram file download failed\n", __FUNCTION__));
+               goto err;
+       }
+
+       /* Take arm out of reset */
+       if (dhdsdio_download_state(bus, FALSE)) {
+               DHD_ERROR(("%s: error getting out of ARM core reset\n", __FUNCTION__));
+               goto err;
+       }
+
+       bcmerror = 0;
+
+err:
+       return bcmerror;
+}
+
+static int
+dhd_bcmsdh_recv_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags, uint8 *buf, uint nbytes,
+       void *pkt, bcmsdh_cmplt_fn_t complete_fn, void *handle)
+{
+       int status;
+
+       if (!KSO_ENAB(bus)) {
+               DHD_ERROR(("%s: Device asleep\n", __FUNCTION__));
+               return BCME_NODEVICE;
+       }
+
+       status = bcmsdh_recv_buf(bus->sdh, addr, fn, flags, buf, nbytes, pkt, complete_fn, handle);
+
+       return status;
+}
+
+static int
+dhd_bcmsdh_send_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags, uint8 *buf, uint nbytes,
+       void *pkt, bcmsdh_cmplt_fn_t complete_fn, void *handle, int max_retry)
+{
+       int ret;
+       int i = 0;
+       int retries = 0;
+       bcmsdh_info_t *sdh;
+
+       if (!KSO_ENAB(bus)) {
+               DHD_ERROR(("%s: Device asleep\n", __FUNCTION__));
+               return BCME_NODEVICE;
+       }
+
+       sdh = bus->sdh;
+       do {
+               ret = bcmsdh_send_buf(bus->sdh, addr, fn, flags, buf, nbytes,
+                       pkt, complete_fn, handle);
+
+               bus->f2txdata++;
+               ASSERT(ret != BCME_PENDING);
+
+               if (ret == BCME_NODEVICE) {
+                       DHD_ERROR(("%s: Device asleep already\n", __FUNCTION__));
+               } else if (ret < 0) {
+                       /* On failure, abort the command and terminate the frame */
+                       DHD_ERROR(("%s: sdio error %d, abort command and terminate frame.\n",
+                               __FUNCTION__, ret));
+                       bus->tx_sderrs++;
+                       bus->f1regdata++;
+                       bus->dhd->tx_errors++;
+                       bcmsdh_abort(sdh, SDIO_FUNC_2);
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
+                               SFC_WF_TERM, NULL);
+                       for (i = 0; i < READ_FRM_CNT_RETRIES; i++) {
+                               uint8 hi, lo;
+                               hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WFRAMEBCHI,
+                                       NULL);
+                               lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WFRAMEBCLO,
+                                       NULL);
+                               bus->f1regdata += 2;
+                               if ((hi == 0) && (lo == 0))
+                                       break;
+                       }
+               }
+       } while ((ret < 0) && retrydata && ++retries < max_retry);
+
+       return ret;
+}
+
+uint8
+dhd_bus_is_ioready(struct dhd_bus *bus)
+{
+       uint8 enable;
+       bcmsdh_info_t *sdh;
+       ASSERT(bus);
+       ASSERT(bus->sih != NULL);
+       enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
+       sdh = bus->sdh;
+       return (enable == bcmsdh_cfg_read(sdh, SDIO_FUNC_0, SDIOD_CCCR_IORDY, NULL));
+}
+
+uint
+dhd_bus_chip(struct dhd_bus *bus)
+{
+       ASSERT(bus->sih != NULL);
+       return bus->sih->chip;
+}
+
+uint
+dhd_bus_chiprev(struct dhd_bus *bus)
+{
+       ASSERT(bus);
+       ASSERT(bus->sih != NULL);
+       return bus->sih->chiprev;
+}
+
+void *
+dhd_bus_pub(struct dhd_bus *bus)
+{
+       return bus->dhd;
+}
+
+void *
+dhd_bus_sih(struct dhd_bus *bus)
+{
+       return (void *)bus->sih;
+}
+
+void *
+dhd_bus_txq(struct dhd_bus *bus)
+{
+       return &bus->txq;
+}
+
+uint
+dhd_bus_hdrlen(struct dhd_bus *bus)
+{
+       return (bus->txglom_enable) ? SDPCM_HDRLEN_TXGLOM : SDPCM_HDRLEN;
+}
+
+void
+dhd_bus_set_dotxinrx(struct dhd_bus *bus, bool val)
+{
+       bus->dotxinrx = val;
+}
+
+/*
+ *  dhdsdio_advertise_bus_cleanup advertises that clean up is under progress
+ * to other bus user contexts like Tx, Rx, IOVAR, WD etc and it waits for other contexts
+ * to gracefully exit. All the bus usage contexts before marking busstate as busy, will check for
+ * whether the busstate is DHD_BUS_DOWN or DHD_BUS_DOWN_IN_PROGRESS, if so
+ * they will exit from there itself without marking dhd_bus_busy_state as BUSY.
+ */
+static void
+dhdsdio_advertise_bus_cleanup(dhd_pub_t         *dhdp)
+{
+       unsigned long flags;
+       int timeleft;
+
+       DHD_LINUX_GENERAL_LOCK(dhdp, flags);
+       dhdp->busstate = DHD_BUS_DOWN_IN_PROGRESS;
+       DHD_LINUX_GENERAL_UNLOCK(dhdp, flags);
+
+       timeleft = dhd_os_busbusy_wait_negation(dhdp, &dhdp->dhd_bus_busy_state);
+       if ((timeleft == 0) || (timeleft == 1)) {
+               /* XXX This condition ideally should not occur, this means some
+                * bus usage context is not clearing the respective usage bit, print
+                * dhd_bus_busy_state and crash the host for further debugging.
+                */
+               DHD_ERROR(("%s : Timeout due to dhd_bus_busy_state=0x%x\n",
+                               __FUNCTION__, dhdp->dhd_bus_busy_state));
+               ASSERT(0);
+       }
+
+       return;
+}
+
+static void
+dhdsdio_advertise_bus_remove(dhd_pub_t  *dhdp)
+{
+       unsigned long flags;
+       int timeleft;
+
+       DHD_LINUX_GENERAL_LOCK(dhdp, flags);
+       dhdp->busstate = DHD_BUS_REMOVE;
+       DHD_LINUX_GENERAL_UNLOCK(dhdp, flags);
+
+       timeleft = dhd_os_busbusy_wait_negation(dhdp, &dhdp->dhd_bus_busy_state);
+       if ((timeleft == 0) || (timeleft == 1)) {
+               DHD_ERROR(("%s : Timeout due to dhd_bus_busy_state=0x%x\n",
+                               __FUNCTION__, dhdp->dhd_bus_busy_state));
+               ASSERT(0);
+       }
+
+       return;
+}
+
+int
+dhd_bus_devreset(dhd_pub_t *dhdp, uint8 flag)
+{
+       int bcmerror = 0;
+       dhd_bus_t *bus;
+       unsigned long flags;
+
+       bus = dhdp->bus;
+
+       if (flag == TRUE) {
+               if (!bus->dhd->dongle_reset) {
+                       DHD_ERROR(("%s: == Power OFF ==\n", __FUNCTION__));
+                       dhdsdio_advertise_bus_cleanup(bus->dhd);
+                       dhd_os_sdlock(dhdp);
+                       dhd_os_wd_timer(dhdp, 0);
+#if !defined(IGNORE_ETH0_DOWN)
+                       /* Force flow control as protection when stop come before ifconfig_down */
+                       dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, ON);
+#endif /* !defined(IGNORE_ETH0_DOWN) */
+                       /* Expect app to have torn down any connection before calling */
+                       /* Stop the bus, disable F2 */
+                       dhd_bus_stop(bus, FALSE);
+
+#if defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID)
+                       /* Clean up any pending IRQ */
+                       dhd_enable_oob_intr(bus, FALSE);
+                       bcmsdh_oob_intr_set(bus->sdh, FALSE);
+                       bcmsdh_oob_intr_unregister(bus->sdh);
+#endif /* defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID) */
+
+                       /* Clean tx/rx buffer pointers, detach from the dongle */
+                       dhdsdio_release_dongle(bus, bus->dhd->osh, TRUE, TRUE);
+
+                       bus->dhd->dongle_reset = TRUE;
+                       DHD_ERROR(("%s: making dhdpub up FALSE\n", __FUNCTION__));
+                       bus->dhd->up = FALSE;
+                       dhd_txglom_enable(dhdp, FALSE);
+                       dhd_os_sdunlock(dhdp);
+
+                       DHD_LINUX_GENERAL_LOCK(bus->dhd, flags);
+                       DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+                       bus->dhd->busstate = DHD_BUS_DOWN;
+                       DHD_LINUX_GENERAL_UNLOCK(bus->dhd, flags);
+
+                       DHD_TRACE(("%s:  WLAN OFF DONE\n", __FUNCTION__));
+                       /* App can now remove power from device */
+               } else
+                       bcmerror = BCME_SDIO_ERROR;
+       } else {
+               /* App must have restored power to device before calling */
+
+               printf("\n\n%s: == Power ON ==\n", __FUNCTION__);
+
+               if (bus->dhd->dongle_reset) {
+                       /* Turn on WLAN */
+                       dhd_os_sdlock(dhdp);
+                       /* Reset SD client */
+                       bcmsdh_reset(bus->sdh);
+
+                       /* Attempt to re-attach & download */
+                       if (dhdsdio_probe_attach(bus, bus->dhd->osh, bus->sdh,
+                               (uint32 *)(uintptr)si_enum_base(bus->cl_devid),
+                               bus->cl_devid)) {
+
+                               DHD_LINUX_GENERAL_LOCK(bus->dhd, flags);
+                               DHD_ERROR(("%s: making DHD_BUS_DOWN\n", __FUNCTION__));
+                               bus->dhd->busstate = DHD_BUS_DOWN;
+                               DHD_LINUX_GENERAL_UNLOCK(bus->dhd, flags);
+                               /* Attempt to download binary to the dongle */
+                               if (dhdsdio_probe_init(bus, bus->dhd->osh, bus->sdh) &&
+                                   dhdsdio_download_firmware(bus, bus->dhd->osh, bus->sdh) >= 0) {
+
+                                       /* Re-init bus, enable F2 transfer */
+                                       bcmerror = dhd_bus_init((dhd_pub_t *) bus->dhd, FALSE);
+                                       if (bcmerror == BCME_OK) {
+#if defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID)
+                                               dhd_enable_oob_intr(bus, TRUE);
+                                               bcmsdh_oob_intr_register(bus->sdh,
+                                                       dhdsdio_isr, bus);
+                                               bcmsdh_oob_intr_set(bus->sdh, TRUE);
+#elif defined(FORCE_WOWLAN)
+                                               dhd_enable_oob_intr(bus, TRUE);
+#endif /* defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID) */
+
+                                               bus->dhd->dongle_reset = FALSE;
+                                               bus->dhd->up = TRUE;
+
+#if !defined(IGNORE_ETH0_DOWN)
+                                               /* Restore flow control  */
+                                               dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, OFF);
+#endif
+                                               dhd_os_wd_timer(dhdp, dhd_watchdog_ms);
+
+                                               DHD_TRACE(("%s: WLAN ON DONE\n", __FUNCTION__));
+                                       } else {
+                                               dhd_bus_stop(bus, FALSE);
+                                               dhdsdio_release_dongle(bus, bus->dhd->osh,
+                                                       TRUE, FALSE);
+                                       }
+                               } else {
+                                       DHD_ERROR(("%s Failed to download binary to the dongle\n",
+                                               __FUNCTION__));
+                                       if (bus->sih != NULL) {
+                                               si_detach(bus->sih);
+                                               bus->sih = NULL;
+                                       }
+                                       bcmerror = BCME_SDIO_ERROR;
+                               }
+                       } else
+                               bcmerror = BCME_SDIO_ERROR;
+
+                       dhd_os_sdunlock(dhdp);
+               } else {
+                       DHD_INFO(("%s called when dongle is not in reset\n",
+                               __FUNCTION__));
+                       DHD_INFO(("Will call dhd_bus_start instead\n"));
+                       dhd_bus_resume(dhdp, 1);
+#if defined(HW_OOB) || defined(FORCE_WOWLAN)
+                       dhd_conf_set_hw_oob_intr(bus->sdh, bus->sih); // terence 20120615: fix for OOB initial issue
+#endif
+                       if ((bcmerror = dhd_bus_start(dhdp)) != 0)
+                               DHD_ERROR(("%s: dhd_bus_start fail with %d\n",
+                                       __FUNCTION__, bcmerror));
+               }
+       }
+
+#ifdef PKT_STATICS
+       dhd_bus_clear_txpktstatics(bus);
+#endif
+       return bcmerror;
+}
+
+int dhd_bus_suspend(dhd_pub_t *dhdpub)
+{
+       return bcmsdh_stop(dhdpub->bus->sdh);
+}
+
+int dhd_bus_resume(dhd_pub_t *dhdpub, int stage)
+{
+       return bcmsdh_start(dhdpub->bus->sdh, stage);
+}
+
+/* Get Chip ID version */
+uint dhd_bus_chip_id(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+
+       if (bus && bus->sih)
+               return bus->sih->chip;
+       else
+               return 0;
+}
+
+/* Get Chip Rev ID version */
+uint dhd_bus_chiprev_id(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+
+       if (bus && bus->sih)
+               return bus->sih->chiprev;
+       else
+               return 0;
+}
+
+/* Get Chip Pkg ID version */
+uint dhd_bus_chippkg_id(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+
+       return bus->sih->chippkg;
+}
+
+int dhd_bus_get_ids(struct dhd_bus *bus, uint32 *bus_type, uint32 *bus_num, uint32 *slot_num)
+{
+       *bus_type = bus->bus;
+       *bus_num = bus->bus_num;
+       *slot_num = bus->slot_num;
+       return 0;
+}
+
+int
+dhd_bus_membytes(dhd_pub_t *dhdp, bool set, uint32 address, uint8 *data, uint size)
+{
+       dhd_bus_t *bus;
+
+       bus = dhdp->bus;
+       return dhdsdio_membytes(bus, set, address, data, size);
+}
+
+#if defined(SUPPORT_MULTIPLE_REVISION)
+static int
+concate_revision_bcm4335(dhd_bus_t *bus, char *fw_path, char *nv_path)
+{
+
+       uint chipver;
+#if defined(SUPPORT_MULTIPLE_CHIPS)
+       char chipver_tag[10] = "_4335";
+#else
+       char chipver_tag[4] = {0, };
+#endif /* defined(SUPPORT_MULTIPLE_CHIPS) */
+
+       DHD_TRACE(("%s: BCM4335 Multiple Revision Check\n", __FUNCTION__));
+       if (bus->sih->chip != BCM4335_CHIP_ID) {
+               DHD_ERROR(("%s:Chip is not BCM4335\n", __FUNCTION__));
+               return -1;
+       }
+       chipver = bus->sih->chiprev;
+       DHD_ERROR(("CHIP VER = [0x%x]\n", chipver));
+       if (chipver == 0x0) {
+               DHD_ERROR(("----- CHIP bcm4335_A0 -----\n"));
+               strcat(chipver_tag, "_a0");
+       } else if (chipver == 0x1) {
+               DHD_ERROR(("----- CHIP bcm4335_B0 -----\n"));
+#if defined(SUPPORT_MULTIPLE_CHIPS)
+               strcat(chipver_tag, "_b0");
+#endif /* defined(SUPPORT_MULTIPLE_CHIPS) */
+       }
+
+       strcat(fw_path, chipver_tag);
+       strcat(nv_path, chipver_tag);
+       return 0;
+}
+
+static int
+concate_revision_bcm4339(dhd_bus_t *bus, char *fw_path, char *nv_path)
+{
+
+       uint chipver;
+#if defined(SUPPORT_MULTIPLE_CHIPS)
+       char chipver_tag[10] = "_4339";
+#else
+       char chipver_tag[4] = {0, };
+#endif /* defined(SUPPORT_MULTIPLE_CHIPS) */
+
+       DHD_TRACE(("%s: BCM4339 Multiple Revision Check\n", __FUNCTION__));
+       if (bus->sih->chip != BCM4339_CHIP_ID) {
+               DHD_ERROR(("%s:Chip is not BCM4339\n", __FUNCTION__));
+               return -1;
+       }
+       chipver = bus->sih->chiprev;
+       DHD_ERROR(("CHIP VER = [0x%x]\n", chipver));
+       if (chipver == 0x1) {
+               DHD_ERROR(("----- CHIP bcm4339_A0 -----\n"));
+               strcat(chipver_tag, "_a0");
+       } else {
+               DHD_ERROR(("----- CHIP bcm4339 unknown revision %d -----\n",
+                       chipver));
+       }
+
+       strcat(fw_path, chipver_tag);
+       strcat(nv_path, chipver_tag);
+       return 0;
+}
+
+static int concate_revision_bcm4350(dhd_bus_t *bus, char *fw_path, char *nv_path)
+{
+       uint32 chip_ver;
+#if defined(SUPPORT_MULTIPLE_CHIPS)
+       char chipver_tag[10] = {0, };
+#else
+       char chipver_tag[4] = {0, };
+#endif /* defined(SUPPORT_MULTIPLE_CHIPS) */
+       chip_ver = bus->sih->chiprev;
+
+#if defined(SUPPORT_MULTIPLE_CHIPS)
+       if (chip_ver == 3)
+               strcat(chipver_tag, "_4354");
+       else
+               strcat(chipver_tag, "_4350");
+#endif
+
+       if (chip_ver == 3) {
+               DHD_ERROR(("----- CHIP 4354 A0 -----\n"));
+               strcat(chipver_tag, "_a0");
+       } else {
+               DHD_ERROR(("----- Unknown chip version, ver=%x -----\n", chip_ver));
+       }
+
+       strcat(fw_path, chipver_tag);
+       strcat(nv_path, chipver_tag);
+       return 0;
+}
+
+static int concate_revision_bcm4354(dhd_bus_t *bus, char *fw_path, char *nv_path)
+{
+       uint32 chip_ver;
+#if defined(SUPPORT_MULTIPLE_CHIPS)
+       char chipver_tag[10] = "_4354";
+#else
+#if !defined(CUSTOMER_HW4)
+       char chipver_tag[4] = {0, };
+#endif /* !CUSTOMER_HW4 */
+#endif /* SUPPORT_MULTIPLE_CHIPS */
+
+       chip_ver = bus->sih->chiprev;
+#if !defined(SUPPORT_MULTIPLE_CHIPS) && defined(CUSTOMER_HW4)
+       DHD_INFO(("----- CHIP 4354, ver=%x -----\n", chip_ver));
+#else
+       if (chip_ver == 1) {
+               DHD_ERROR(("----- CHIP 4354 A1 -----\n"));
+               strcat(chipver_tag, "_a1");
+       } else {
+               DHD_ERROR(("----- Unknown chip version, ver=%x -----\n", chip_ver));
+       }
+
+       strcat(fw_path, chipver_tag);
+       strcat(nv_path, chipver_tag);
+#endif /* !SUPPORT_MULTIPLE_CHIPS && CUSTOMER_HW4 */
+
+       return 0;
+}
+
+static int
+concate_revision_bcm43454(dhd_bus_t *bus, char *fw_path, char *nv_path)
+{
+       char chipver_tag[10] = {0, };
+#ifdef SUPPORT_MULTIPLE_BOARD_REV_FROM_DT
+       int base_system_rev_for_nv = 0;
+#endif /* SUPPORT_MULTIPLE_BOARD_REV_FROM_DT */
+
+       DHD_TRACE(("%s: BCM43454 Multiple Revision Check\n", __FUNCTION__));
+       if (bus->sih->chip != BCM43454_CHIP_ID) {
+               DHD_ERROR(("%s:Chip is not BCM43454!\n", __FUNCTION__));
+               return -1;
+       }
+#ifdef SUPPORT_MULTIPLE_BOARD_REV_FROM_DT
+       base_system_rev_for_nv = dhd_get_system_rev();
+       if (base_system_rev_for_nv > 0) {
+               DHD_ERROR(("----- Board Rev  [%d] -----\n", base_system_rev_for_nv));
+               sprintf(chipver_tag, "_r%02d", base_system_rev_for_nv);
+       }
+#endif /* SUPPORT_MULTIPLE_BOARD_REV_FROM_DT */
+#ifdef SUPPORT_MULTIPLE_BOARD_REV_FROM_HW
+       DHD_ERROR(("----- Rev [%d] Fot MULTIPLE Board. -----\n", system_hw_rev));
+       if ((system_hw_rev >= 8) && (system_hw_rev <= 11)) {
+               DHD_ERROR(("This HW is Rev 08 ~ 11. this is For FD-HW\n"));
+               strcat(chipver_tag, "_FD");
+       }
+#endif /* SUPPORT_MULTIPLE_BOARD_REV_FROM_HW */
+
+       strcat(nv_path, chipver_tag);
+       return 0;
+}
+
+int
+concate_revision(dhd_bus_t *bus, char *fw_path, char *nv_path)
+{
+       int res = 0;
+
+       if (!bus || !bus->sih) {
+               DHD_ERROR(("%s:Bus is Invalid\n", __FUNCTION__));
+               return -1;
+       }
+
+       switch (bus->sih->chip) {
+       case BCM4335_CHIP_ID:
+               res = concate_revision_bcm4335(bus, fw_path, nv_path);
+
+               break;
+       case BCM4339_CHIP_ID:
+               res = concate_revision_bcm4339(bus, fw_path, nv_path);
+               break;
+       case BCM4350_CHIP_ID:
+               res = concate_revision_bcm4350(bus, fw_path, nv_path);
+               break;
+       case BCM4354_CHIP_ID:
+               res = concate_revision_bcm4354(bus, fw_path, nv_path);
+               break;
+       case BCM43454_CHIP_ID:
+               res = concate_revision_bcm43454(bus, fw_path, nv_path);
+               break;
+
+               /* XXX: Add New Multiple CHIP ID */
+       default:
+               DHD_ERROR(("REVISION SPECIFIC feature is not required\n"));
+               /* XXX: if revision specific feature is not required then return true always */
+               return res;
+       }
+
+       if (res == 0) {
+       }
+       return res;
+}
+#endif /* SUPPORT_MULTIPLE_REVISION */
+
+void
+dhd_bus_update_fw_nv_path(struct dhd_bus *bus, char *pfw_path, char *pnv_path,
+                                                                       char *pclm_path, char *pconf_path)
+{
+       bus->fw_path = pfw_path;
+       bus->nv_path = pnv_path;
+       bus->dhd->clm_path = pclm_path;
+       bus->dhd->conf_path = pconf_path;
+}
+
+int
+dhd_enableOOB(dhd_pub_t *dhd, bool sleep)
+{
+       dhd_bus_t *bus = dhd->bus;
+       sdpcmd_regs_t *regs = bus->regs;
+       uint retries = 0;
+
+       if (sleep) {
+               dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+               /* Tell device to start using OOB wakeup */
+               W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
+               if (retries > retry_limit) {
+                       DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
+                       return BCME_BUSY;
+               }
+               /* Turn off our contribution to the HT clock request */
+               dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+       } else {
+               /* Make sure the controller has the bus up */
+               dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+               /* Send misc interrupt to indicate OOB not needed */
+               W_SDREG(0, &regs->tosbmailboxdata, retries);
+               if (retries <= retry_limit)
+                       W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
+
+               if (retries > retry_limit)
+                       DHD_ERROR(("CANNOT SIGNAL CHIP TO CLEAR OOB!!\n"));
+
+               /* Make sure we have SD bus access */
+               dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+       }
+       return BCME_OK;
+}
+
+void
+dhd_bus_pktq_flush(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       bool wlfc_enabled = FALSE;
+
+#ifdef PROP_TXSTATUS
+       wlfc_enabled = (dhd_wlfc_cleanup_txq(dhdp, NULL, 0) != WLFC_UNSUPPORTED);
+#endif
+       if (!wlfc_enabled) {
+#ifdef DHDTCPACK_SUPPRESS
+               /* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+                * when there is a newly coming packet from network stack.
+                */
+               dhd_tcpack_info_tbl_clean(bus->dhd);
+#endif /* DHDTCPACK_SUPPRESS */
+               /* Clear the data packet queues */
+               pktq_flush(dhdp->osh, &bus->txq, TRUE);
+       }
+}
+
+#ifdef BCMSDIO
+int
+dhd_sr_config(dhd_pub_t *dhd, bool on)
+{
+       dhd_bus_t *bus = dhd->bus;
+
+       if (!bus->_srenab)
+               return -1;
+
+       return dhdsdio_clk_devsleep_iovar(bus, on);
+}
+
+uint16
+dhd_get_chipid(struct dhd_bus *bus)
+{
+       if (bus && bus->sih)
+               return (uint16)bus->sih->chip;
+       else
+               return 0;
+}
+#endif /* BCMSDIO */
+
+#ifdef DEBUGGER
+static uint32
+dhd_sdio_reg_read(struct dhd_bus *bus, ulong addr)
+{
+       uint32 rval;
+
+       dhd_os_sdlock(bus->dhd);
+
+       BUS_WAKE(bus);
+
+       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+       rval = bcmsdh_reg_read(bus->sdh, addr, 4);
+
+       dhd_os_sdunlock(bus->dhd);
+
+       return rval;
+}
+
+static void
+dhd_sdio_reg_write(struct dhd_bus *bus, ulong addr, uint32 val)
+{
+       dhd_os_sdlock(bus->dhd);
+
+       BUS_WAKE(bus);
+
+       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+       bcmsdh_reg_write(bus->sdh, addr, 4, val);
+
+       dhd_os_sdunlock(bus->dhd);
+}
+
+#endif /* DEBUGGER */
+
+#if defined(BT_OVER_SDIO)
+uint8 dhd_bus_cfg_read(void *h, uint fun_num, uint32 addr, int *err)
+{
+       uint8 intrd;
+       dhd_pub_t *dhdp = (dhd_pub_t *)h;
+       dhd_bus_t *bus = (dhd_bus_t *)dhdp->bus;
+
+       dhd_os_sdlock(bus->dhd);
+
+       intrd = bcmsdh_cfg_read(bus->sdh, fun_num, addr, err);
+
+       dhd_os_sdunlock(bus->dhd);
+
+       return intrd;
+} EXPORT_SYMBOL(dhd_bus_cfg_read);
+
+void dhd_bus_cfg_write(void *h, uint fun_num, uint32 addr, uint8 val, int *err)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)h;
+       dhd_bus_t *bus = (dhd_bus_t *)dhdp->bus;
+
+       dhd_os_sdlock(bus->dhd);
+
+       bcmsdh_cfg_write(bus->sdh, fun_num, addr, val, err);
+
+       dhd_os_sdunlock(bus->dhd);
+
+} EXPORT_SYMBOL(dhd_bus_cfg_write);
+
+static int
+extract_hex_field(char * line, uint16 start_pos, uint16 num_chars, uint16 * value)
+{
+       char field [8];
+
+       strlcpy(field, line + start_pos, sizeof(field));
+
+       return (sscanf (field, "%hX", value) == 1);
+}
+
+static int
+read_more_btbytes(struct dhd_bus *bus, void * file, char *line, int * addr_mode, uint16 * hi_addr,
+       uint32 * dest_addr, uint8 *data_bytes, uint32 * num_bytes)
+{
+       int             str_len;
+       uint16  num_data_bytes, addr, data_pos, type, w, i;
+       uint32  abs_base_addr32 = 0;
+       *num_bytes = 0;
+
+       while (!*num_bytes)
+       {
+               str_len = dhd_os_gets_image(bus->dhd, line, BTFW_MAX_STR_LEN, file);
+
+               DHD_TRACE(("%s: Len :0x%x  %s\n", __FUNCTION__, str_len, line));
+
+               if (str_len == 0) {
+                       break;
+               } else if (str_len > 9) {
+                       extract_hex_field(line, 1, 2, &num_data_bytes);
+                       extract_hex_field(line, 3, 4, &addr);
+                       extract_hex_field(line, 7, 2, &type);
+
+                       data_pos = 9;
+                       for (i = 0; i < num_data_bytes; i++) {
+                               extract_hex_field(line, data_pos, 2, &w);
+                               data_bytes [i] = (uint8)(w & 0x00FF);
+                               data_pos += 2;
+                       }
+
+                       if (type == BTFW_HEX_LINE_TYPE_EXTENDED_ADDRESS) {
+                               *hi_addr = (data_bytes [0] << 8) | data_bytes [1];
+                               *addr_mode = BTFW_ADDR_MODE_EXTENDED;
+                       } else if (type == BTFW_HEX_LINE_TYPE_EXTENDED_SEGMENT_ADDRESS) {
+                               *hi_addr = (data_bytes [0] << 8) | data_bytes [1];
+                               *addr_mode = BTFW_ADDR_MODE_SEGMENT;
+                       } else if (type == BTFW_HEX_LINE_TYPE_ABSOLUTE_32BIT_ADDRESS) {
+                               abs_base_addr32 = (data_bytes [0] << 24) | (data_bytes [1] << 16) |
+                                       (data_bytes [2] << 8) | data_bytes [3];
+                               *addr_mode = BTFW_ADDR_MODE_LINEAR32;
+                       } else if (type == BTFW_HEX_LINE_TYPE_DATA) {
+                               *dest_addr = addr;
+                               if (*addr_mode == BTFW_ADDR_MODE_EXTENDED)
+                                       *dest_addr += (*hi_addr << 16);
+                               else if (*addr_mode == BTFW_ADDR_MODE_SEGMENT)
+                                       *dest_addr += (*hi_addr << 4);
+                               else if (*addr_mode == BTFW_ADDR_MODE_LINEAR32)
+                                       *dest_addr += abs_base_addr32;
+                               *num_bytes = num_data_bytes;
+                       }
+               }
+       }
+       return (*num_bytes > 0);
+}
+
+static int
+_dhdsdio_download_btfw(struct dhd_bus *bus)
+{
+       int     bcm_error = -1;
+       void    *image = NULL;
+       uint8   *mem_blk = NULL, *mem_ptr = NULL, *data_ptr = NULL;
+
+       uint32 offset_addr = 0, offset_len = 0, bytes_to_write = 0;
+
+       char    *line = NULL;
+       uint32  dest_addr = 0, num_bytes;
+       uint16  hiAddress = 0;
+       uint32  start_addr, start_data, end_addr, end_data, i, index, pad,
+       bt2wlan_pwrup_adr;
+
+       int     addr_mode               = BTFW_ADDR_MODE_EXTENDED;
+
+       /* Out immediately if no image to download */
+       if ((bus->btfw_path == NULL) || (bus->btfw_path[0] == '\0')) {
+               return 0;
+       }
+
+       /* XXX: Should succeed in opening image if it is actually given through registry
+        * entry or in module param.
+        */
+       image = dhd_os_open_image1(bus->dhd, bus->btfw_path);
+       if (image == NULL)
+               goto err;
+
+       mem_ptr = mem_blk = MALLOC(bus->dhd->osh, BTFW_DOWNLOAD_BLK_SIZE + DHD_SDALIGN);
+       if (mem_blk == NULL) {
+               DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__,
+                       BTFW_DOWNLOAD_BLK_SIZE + DHD_SDALIGN));
+               goto err;
+       }
+       if ((uint32)(uintptr)mem_blk % DHD_SDALIGN)
+               mem_ptr += (DHD_SDALIGN - ((uint32)(uintptr)mem_blk % DHD_SDALIGN));
+
+       data_ptr = MALLOC(bus->dhd->osh, BTFW_DOWNLOAD_BLK_SIZE - 8);
+       if (data_ptr == NULL) {
+               DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__,
+                       BTFW_DOWNLOAD_BLK_SIZE - 8));
+               goto err;
+       }
+       /* Write to BT register to hold WLAN wake high during BT FW download */
+       bt2wlan_pwrup_adr = BTMEM_OFFSET + BT2WLAN_PWRUP_ADDR;
+       bcmsdh_reg_write(bus->sdh, bt2wlan_pwrup_adr, 4, BT2WLAN_PWRUP_WAKE);
+       /*
+         * Wait for at least 2msec for the clock to be ready/Available.
+         */
+       OSL_DELAY(2000);
+
+       line = MALLOC(bus->dhd->osh, BTFW_MAX_STR_LEN);
+       if (line == NULL) {
+               DHD_ERROR(("%s: Failed to allocate memory %d bytes\n",
+                       __FUNCTION__, BTFW_MAX_STR_LEN));
+               goto err;
+       }
+       memset(line, 0, BTFW_MAX_STR_LEN);
+
+       while (read_more_btbytes (bus, image, line, &addr_mode, &hiAddress, &dest_addr,
+               data_ptr, &num_bytes)) {
+
+               DHD_TRACE(("read %d bytes at address %08X\n", num_bytes, dest_addr));
+
+               start_addr = BTMEM_OFFSET + dest_addr;
+               index = 0;
+
+               /* Make sure the start address is 4 byte aligned to avoid alignment issues
+                * with SD host controllers
+                */
+               if (!ISALIGNED(start_addr, 4)) {
+                       pad = start_addr % 4;
+                       start_addr = ROUNDDN(start_addr, 4);
+                       start_data = bcmsdh_reg_read(bus->sdh, start_addr, 4);
+                       for (i = 0; i < pad; i++, index++) {
+                           mem_ptr[index] = (uint8)((uint8 *)&start_data)[i];
+                       }
+               }
+               bcopy(data_ptr, &(mem_ptr[index]), num_bytes);
+               index += num_bytes;
+
+               /* Make sure the length is multiple of 4bytes to avoid alignment issues
+                * with SD host controllers
+                */
+               end_addr = start_addr + index;
+               if (!ISALIGNED(end_addr, 4)) {
+                       end_addr = ROUNDDN(end_addr, 4);
+                       end_data = bcmsdh_reg_read(bus->sdh, end_addr, 4);
+                       for (i = (index % 4); i < 4; i++, index++) {
+                               mem_ptr[index] = (uint8)((uint8 *)&end_data)[i];
+                       }
+               }
+
+               offset_addr = start_addr & 0xFFF;
+               offset_len =  offset_addr + index;
+               if (offset_len <= 0x1000) {
+                       bcm_error = dhdsdio_membytes(bus, TRUE, start_addr, mem_ptr, index);
+                       if (bcm_error) {
+                               DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                               __FUNCTION__, bcm_error, num_bytes, start_addr));
+                               goto err;
+                       }
+               }
+               else {
+                       bytes_to_write = 0x1000 - offset_addr;
+                       bcm_error = dhdsdio_membytes(bus, TRUE, start_addr, mem_ptr,
+                               bytes_to_write);
+                       if (bcm_error) {
+                               DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                               __FUNCTION__, bcm_error, num_bytes, start_addr));
+                               goto err;
+                       }
+
+                       OSL_DELAY(10000);
+
+                       bcm_error = dhdsdio_membytes(bus, TRUE, (start_addr + bytes_to_write),
+                               (mem_ptr + bytes_to_write), (index - bytes_to_write));
+                       if (bcm_error) {
+                               DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                                       __FUNCTION__, bcm_error, num_bytes, start_addr));
+                               goto err;
+                       }
+               }
+               memset(line, 0, BTFW_MAX_STR_LEN);
+       }
+
+       bcm_error = 0;
+err:
+       if (mem_blk)
+               MFREE(bus->dhd->osh, mem_blk, BTFW_DOWNLOAD_BLK_SIZE + DHD_SDALIGN);
+
+       if (data_ptr)
+               MFREE(bus->dhd->osh, data_ptr, BTFW_DOWNLOAD_BLK_SIZE - 8);
+
+       if (line)
+               MFREE(bus->dhd->osh, line, BTFW_MAX_STR_LEN);
+
+       if (image)
+               dhd_os_close_image1(bus->dhd, image);
+
+       return bcm_error;
+}
+
+static int
+dhdsdio_download_btfw(struct dhd_bus *bus, osl_t *osh, void *sdh)
+{
+       int ret;
+
+       DHD_TRACE(("%s: btfw path=%s\n",
+               __FUNCTION__, bus->btfw_path));
+       DHD_OS_WAKE_LOCK(bus->dhd);
+       dhd_os_sdlock(bus->dhd);
+
+       /* Download the firmware */
+       ret = _dhdsdio_download_btfw(bus);
+
+       dhd_os_sdunlock(bus->dhd);
+       DHD_OS_WAKE_UNLOCK(bus->dhd);
+
+       return ret;
+}
+
+int
+dhd_bus_download_btfw(struct dhd_bus *bus, osl_t *osh,
+                          char *pbtfw_path)
+{
+       int ret;
+
+       bus->btfw_path = pbtfw_path;
+
+       ret = dhdsdio_download_btfw(bus, osh, bus->sdh);
+
+       return ret;
+}
+#endif /* defined (BT_OVER_SDIO) */
+
+void
+dhd_bus_dump_trap_info(dhd_bus_t *bus, struct bcmstrbuf *strbuf)
+{
+       trap_t *tr = &bus->dhd->last_trap_info;
+
+       bcm_bprintf(strbuf,
+               "Dongle trap type 0x%x @ epc 0x%x, cpsr 0x%x, spsr 0x%x, sp 0x%x,"
+               "lp 0x%x, rpc 0x%x Trap offset 0x%x, "
+               "r0 0x%x, r1 0x%x, r2 0x%x, r3 0x%x, "
+               "r4 0x%x, r5 0x%x, r6 0x%x, r7 0x%x\n\n",
+               ltoh32(tr->type), ltoh32(tr->epc), ltoh32(tr->cpsr), ltoh32(tr->spsr),
+               ltoh32(tr->r13), ltoh32(tr->r14), ltoh32(tr->pc),
+               ltoh32(bus->dongle_trap_addr),
+               ltoh32(tr->r0), ltoh32(tr->r1), ltoh32(tr->r2), ltoh32(tr->r3),
+               ltoh32(tr->r4), ltoh32(tr->r5), ltoh32(tr->r6), ltoh32(tr->r7));
+
+}
+
+static int
+dhd_bcmsdh_send_buffer(void *bus, uint8 *frame, uint16 len)
+{
+       int ret = -1;
+
+       ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(((dhd_bus_t*)bus)->sdh),
+               SDIO_FUNC_2, F2SYNC, frame, len, NULL, NULL, NULL, TXRETRIES);
+
+       if (ret == BCME_OK)
+               ((dhd_bus_t*)bus)->tx_seq = (((dhd_bus_t*)bus)->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
+
+       return ret;
+}
+
+/* Function to set the min res mask depending on the chip ID used */
+bool
+dhd_bus_set_default_min_res_mask(struct dhd_bus *bus)
+{
+       if ((bus == NULL) || (bus->sih == NULL)) {
+               DHD_ERROR(("%s(): Invalid Arguments \r\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       switch (bus->sih->chip) {
+       case BCM4339_CHIP_ID:
+               bcmsdh_reg_write(bus->sdh, SI_ENUM_BASE(bus->sih) + 0x618, 4, 0x3fcaf377);
+               if (bcmsdh_regfail(bus->sdh)) {
+                       DHD_ERROR(("%s:%d Setting min_res_mask failed\n", __FUNCTION__, __LINE__));
+                       return FALSE;
+               }
+               break;
+
+       case BCM43012_CHIP_ID:
+       case BCM43013_CHIP_ID:
+       case BCM43014_CHIP_ID:
+               bcmsdh_reg_write(bus->sdh,
+                       si_get_pmu_reg_addr(bus->sih, OFFSETOF(pmuregs_t, min_res_mask)),
+                       4, DEFAULT_43012_MIN_RES_MASK);
+               if (bcmsdh_regfail(bus->sdh)) {
+                       DHD_ERROR(("%s:%d Setting min_res_mask failed\n", __FUNCTION__, __LINE__));
+                       return FALSE;
+               }
+               break;
+
+       default:
+               DHD_ERROR(("%s: Unhandled chip id\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       return TRUE;
+}
+
+/* Function to reset PMU registers */
+void
+dhd_bus_pmu_reg_reset(dhd_pub_t *dhdp)
+{
+       struct dhd_bus *bus = dhdp->bus;
+       bcmsdh_reg_write(bus->sdh, si_get_pmu_reg_addr(bus->sih,
+               OFFSETOF(pmuregs_t, swscratch)), 4, 0x0);
+       if (bcmsdh_regfail(bus->sdh)) {
+               DHD_ERROR(("%s:%d Setting min_res_mask failed\n", __FUNCTION__, __LINE__));
+       }
+}
+
+int
+dhd_bus_readwrite_bp_addr(dhd_pub_t *dhdp, uint addr, uint size, uint* data, bool read)
+{
+       int bcmerror = 0;
+       struct dhd_bus *bus = dhdp->bus;
+
+       if (read) {
+               *data = (int32)bcmsdh_reg_read(bus->sdh, addr, size);
+       } else {
+               bcmsdh_reg_write(bus->sdh, addr, size, *data);
+       }
+
+       if (bcmsdh_regfail(bus->sdh))
+               bcmerror = BCME_SDIO_ERROR;
+
+       return bcmerror;
+}
+
+int dhd_get_idletime(dhd_pub_t *dhd)
+{
+       return dhd->bus->idletime;
+}
+
+#ifdef DHD_WAKE_STATUS
+wake_counts_t*
+dhd_bus_get_wakecount(dhd_pub_t *dhd)
+{
+       if (!dhd->bus) {
+               return NULL;
+       }
+       return &dhd->bus->wake_counts;
+}
+int
+dhd_bus_get_bus_wake(dhd_pub_t *dhd)
+{
+       return bcmsdh_set_get_wake(dhd->bus->sdh, 0);
+}
+#endif /* DHD_WAKE_STATUS */
+
+int
+dhd_bus_sleep(dhd_pub_t *dhdp, bool sleep, uint32 *intstatus)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       uint32 retry = 0;
+       int ret = 0;
+
+       if (bus) {
+               dhd_os_sdlock(dhdp);
+               BUS_WAKE(bus);
+               R_SDREG(*intstatus, &bus->regs->intstatus, retry);
+               if (sleep) {
+                       if (SLPAUTO_ENAB(bus)) {
+                               ret = dhdsdio_bussleep(bus, sleep);
+                               if (ret != BCME_BUSY)
+                                       dhd_os_wd_timer(bus->dhd, 0);
+                       } else
+                               dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+               }
+               dhd_os_sdunlock(dhdp);
+       } else {
+               DHD_ERROR(("bus is NULL\n"));
+               ret = -1;
+       }
+
+       return ret;
+}
\ No newline at end of file
diff --git a/bcmdhd.101.10.240.x/dhd_sec_feature.h b/bcmdhd.101.10.240.x/dhd_sec_feature.h
new file mode 100644 (file)
index 0000000..e896c58
--- /dev/null
@@ -0,0 +1,229 @@
+/*
+ * Customer HW 4 dependant file
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_sec_feature.h$
+ */
+
+/* XXX This File managed by Samsung */
+
+/*
+ * ** Desciption ***
+ * 1. Module vs COB
+ *    If your model's WIFI HW chip is COB type, you must add below feature
+ *    - #undef USE_CID_CHECK
+ *    - #define READ_MACADDR
+ *    Because COB type chip have not CID and Mac address.
+ *    So, you must add below feature to defconfig file.
+ *    - CONFIG_WIFI_BROADCOM_COB
+ *
+ * 2. PROJECTS
+ *    If you want add some feature only own Project, you can add it in 'PROJECTS' part.
+ *
+ * 3. Region code
+ *    If you want add some feature only own region model, you can use below code.
+ *    - 100 : EUR OPEN
+ *    - 101 : EUR ORG
+ *    - 200 : KOR OPEN
+ *    - 201 : KOR SKT
+ *    - 202 : KOR KTT
+ *    - 203 : KOR LGT
+ *    - 300 : CHN OPEN
+ *    - 400 : USA OPEN
+ *    - 401 : USA ATT
+ *    - 402 : USA TMO
+ *    - 403 : USA VZW
+ *    - 404 : USA SPR
+ *    - 405 : USA USC
+ *    You can refer how to using it below this file.
+ *    And, you can add more region code, too.
+ */
+
+#ifndef _dhd_sec_feature_h_
+#define _dhd_sec_feature_h_
+
+#include <linuxver.h>
+
+#if defined(ANDROID_PLATFORM_VERSION)
+#if (ANDROID_PLATFORM_VERSION >= 10)
+#define RANDOM_MAC_CONTROL
+#endif
+#endif /* ANDROID_PLATFORM_VERSION */
+
+/* For COB type feature */
+#ifdef CONFIG_WIFI_BROADCOM_COB
+#undef USE_CID_CHECK
+#define READ_MACADDR
+#endif  /* CONFIG_WIFI_BROADCOM_COB */
+
+#if defined(CONFIG_MACH_UNIVERSAL7420) || defined(CONFIG_ARCH_MSM8994) || \
+       defined(CONFIG_ARCH_MSM8996) || defined(CONFIG_SOC_EXYNOS8890)
+#define SUPPORT_MULTIPLE_MODULE_CIS
+#endif /* CONFIG_MACH_UNIVERSAL7420 || CONFIG_ARCH_MSM8994 ||
+       * CONFIG_ARCH_MSM8996 || CONFIG_SOC_EXYNOS8890
+       */
+
+#if defined(CONFIG_ARCH_MSM8996) || defined(CONFIG_SOC_EXYNOS8890)
+#define SUPPORT_BCM4359_MIXED_MODULES
+#endif /* CONFIG_ARCH_MSM8996 || CONFIG_SOC_EXYNOS8890 */
+
+#if defined(CONFIG_ARGOS)
+#if defined(CONFIG_SPLIT_ARGOS_SET)
+#define ARGOS_IRQ_WIFI_TABLE_LABEL "WIFI TX"
+#define ARGOS_WIFI_TABLE_LABEL "WIFI RX"
+#else /* CONFIG_SPLIT_ARGOS_SET */
+#define ARGOS_IRQ_WIFI_TABLE_LABEL "WIFI"
+#define ARGOS_WIFI_TABLE_LABEL "WIFI"
+#endif /* CONFIG_SPLIT_ARGOS_SET */
+#define ARGOS_P2P_TABLE_LABEL "P2P"
+#endif /* CONFIG_ARGOS */
+
+/* PROJECTS START */
+
+#if defined(CONFIG_MACH_UNIVERSAL7420) || defined(CONFIG_SOC_EXYNOS8890) || \
+       defined(CONFIG_SOC_EXYNOS8895)
+#undef CUSTOM_SET_CPUCORE
+#define PRIMARY_CPUCORE 0
+#define DPC_CPUCORE 4
+#define RXF_CPUCORE 5
+#define TASKLET_CPUCORE 5
+#define ARGOS_CPU_SCHEDULER
+#define ARGOS_RPS_CPU_CTL
+
+#ifdef CONFIG_SOC_EXYNOS8895
+#define ARGOS_DPC_TASKLET_CTL
+#endif /* CONFIG_SOC_EXYNOS8895 */
+
+#ifdef CONFIG_MACH_UNIVERSAL7420
+#define EXYNOS_PCIE_DEBUG
+#endif /* CONFIG_MACH_UNIVERSAL7420 */
+#endif /* CONFIG_MACH_UNIVERSAL7420  || CONFIG_SOC_EXYNOS8890 || CONFIG_SOC_EXYNOS8895 */
+
+#if defined(CONFIG_SOC_EXYNOS9810) || defined(CONFIG_SOC_EXYNOS9820) || \
+       defined(CONFIG_SOC_EXYNOS9830)
+#define PCIE_IRQ_CPU_CORE 5
+#endif /* CONFIG_SOC_EXYNOS9810 || CONFIG_SOC_EXYNOS9820 || defined(CONFIG_SOC_EXYNOS9830 */
+
+#if defined(DHD_LB)
+#if defined(CONFIG_ARCH_SM8150) || defined(CONFIG_ARCH_KONA)
+#define DHD_LB_PRIMARY_CPUS     (0x70)
+#define DHD_LB_SECONDARY_CPUS   (0x0E)
+#elif defined(CONFIG_SOC_EXYNOS9810) || defined(CONFIG_SOC_EXYNOS9820) || \
+       defined(CONFIG_SOC_EXYNOS9830)
+#define DHD_LB_PRIMARY_CPUS     (0x10)
+#define DHD_LB_SECONDARY_CPUS   (0x0E)
+#elif defined(CONFIG_SOC_EXYNOS8890)
+/*
+ * Removed core 6~7 from NAPI CPU mask.
+ * Exynos 8890 disabled core 6~7 by default.
+ */
+#define DHD_LB_PRIMARY_CPUS     (0x30)
+#define DHD_LB_SECONDARY_CPUS   (0x0E)
+#elif defined(CONFIG_SOC_EXYNOS8895)
+/* using whole big core with NAPI mask */
+#define DHD_LB_PRIMARY_CPUS     (0xF0)
+#define DHD_LB_SECONDARY_CPUS   (0x0E)
+#elif defined(CONFIG_ARCH_MSM8998)
+#define DHD_LB_PRIMARY_CPUS     (0x20)
+#define DHD_LB_SECONDARY_CPUS   (0x0E)
+#elif defined(CONFIG_ARCH_MSM8996)
+#define DHD_LB_PRIMARY_CPUS     (0x0C)
+#define DHD_LB_SECONDARY_CPUS   (0x03)
+#else /* Default LB masks */
+/* using whole big core with NAPI mask */
+#define DHD_LB_PRIMARY_CPUS     (0xF0)
+#define DHD_LB_SECONDARY_CPUS   (0x0E)
+#endif /* CONFIG_SOC_EXYNOS8890 */
+#else /* !DHD_LB */
+#define ARGOS_DPC_TASKLET_CTL
+#endif /* !DHD_LB */
+
+#if defined(CONFIG_ARCH_MSM) || defined(CONFIG_SOC_EXYNOS8895) || \
+       defined(CONFIG_SOC_EXYNOS9810) || defined(CONFIG_SOC_EXYNOS9820) || \
+       defined(CONFIG_SOC_EXYNOS9830)
+#if defined(CONFIG_BCMDHD_PCIE)
+#define BCMPCIE_DISABLE_ASYNC_SUSPEND
+#endif /* CONFIG_BCMDHD_PCIE */
+#endif /* CONFIG_ARCH_MSM */
+/* PROJECTS END */
+
+/* REGION CODE START */
+
+#ifndef CONFIG_WLAN_REGION_CODE
+#define CONFIG_WLAN_REGION_CODE 100
+#endif /* CONFIG_WLAN_REGION_CODE */
+
+#if (CONFIG_WLAN_REGION_CODE >= 100) && (CONFIG_WLAN_REGION_CODE < 200) /* EUR */
+#if (CONFIG_WLAN_REGION_CODE == 101) /* EUR ORG */
+/* GAN LITE NAT KEEPALIVE FILTER */
+#define GAN_LITE_NAT_KEEPALIVE_FILTER
+#endif /* CONFIG_WLAN_REGION_CODE == 101 */
+#if (CONFIG_WLAN_REGION_CODE == 150) /* EUR FD(DualSIM) */
+#define SUPPORT_MULTIPLE_BOARD_REV_FROM_HW
+#endif /* CONFIG_WLAN_REGION_CODE == 150 */
+#endif /* CONFIG_WLAN_REGION_CODE >= 100 && CONFIG_WLAN_REGION_CODE < 200 */
+
+#if (CONFIG_WLAN_REGION_CODE >= 200) && (CONFIG_WLAN_REGION_CODE < 300) /* KOR */
+#undef USE_INITIAL_2G_SCAN
+#ifndef ROAM_ENABLE
+#define ROAM_ENABLE
+#endif /* ROAM_ENABLE */
+#ifndef ROAM_API
+#define ROAM_API
+#endif /* ROAM_API */
+#ifndef ROAM_CHANNEL_CACHE
+#define ROAM_CHANNEL_CACHE
+#endif /* ROAM_CHANNEL_CACHE */
+#ifndef OKC_SUPPORT
+#define OKC_SUPPORT
+#endif /* OKC_SUPPORT */
+
+#ifndef ROAM_AP_ENV_DETECTION
+#define ROAM_AP_ENV_DETECTION
+#endif /* ROAM_AP_ENV_DETECTION */
+
+#undef WRITE_MACADDR
+#ifndef READ_MACADDR
+#define READ_MACADDR
+#endif /* READ_MACADDR */
+#endif /* CONFIG_WLAN_REGION_CODE >= 200 && CONFIG_WLAN_REGION_CODE < 300 */
+
+#if (CONFIG_WLAN_REGION_CODE >= 300) && (CONFIG_WLAN_REGION_CODE < 400) /* CHN */
+#define BCMWAPI_WPI
+#define BCMWAPI_WAI
+#endif /* CONFIG_WLAN_REGION_CODE >= 300 && CONFIG_WLAN_REGION_CODE < 400 */
+
+#if (CONFIG_WLAN_REGION_CODE == 500) /* JP */
+#if defined(BCM4375_CHIP)
+#define DISABLE_HE_ENAB
+#endif /* BCM4375_CHIP */
+#endif /* CONFIG_WLAN_REGION_CODE == 500 */
+
+/* REGION CODE END */
+
+#if !defined(READ_MACADDR) && !defined(WRITE_MACADDR)
+#define GET_MAC_FROM_OTP
+#define SHOW_NVRAM_TYPE
+#endif /* !READ_MACADDR && !WRITE_MACADDR */
+
+#define WRITE_WLANINFO
+
+#endif /* _dhd_sec_feature_h_ */
diff --git a/bcmdhd.101.10.240.x/dhd_static_buf.c b/bcmdhd.101.10.240.x/dhd_static_buf.c
new file mode 100644 (file)
index 0000000..fb68b01
--- /dev/null
@@ -0,0 +1,585 @@
+#include <linux/module.h>\r
+#include <linux/kernel.h>\r
+#include <linux/init.h>\r
+#include <linux/platform_device.h>\r
+#include <linux/delay.h>\r
+#include <linux/err.h>\r
+#include <linux/skbuff.h>\r
+\r
+#define        DHD_STATIC_VERSION_STR          "100.10.545.7 (r826445-20200110-2)"\r
+\r
+#define BCMDHD_SDIO\r
+#define BCMDHD_PCIE\r
+\r
+enum dhd_prealloc_index {\r
+       DHD_PREALLOC_PROT = 0,\r
+#if defined(BCMDHD_SDIO)\r
+       DHD_PREALLOC_RXBUF = 1,\r
+       DHD_PREALLOC_DATABUF = 2,\r
+#endif\r
+       DHD_PREALLOC_OSL_BUF = 3,\r
+       DHD_PREALLOC_SKB_BUF = 4,\r
+       DHD_PREALLOC_WIPHY_ESCAN0 = 5,\r
+       DHD_PREALLOC_WIPHY_ESCAN1 = 6,\r
+       DHD_PREALLOC_DHD_INFO = 7,\r
+       DHD_PREALLOC_DHD_WLFC_INFO = 8,\r
+#ifdef BCMDHD_PCIE\r
+       DHD_PREALLOC_IF_FLOW_LKUP = 9,\r
+#endif\r
+       DHD_PREALLOC_MEMDUMP_BUF = 10,\r
+       DHD_PREALLOC_MEMDUMP_RAM = 11,\r
+       DHD_PREALLOC_DHD_WLFC_HANGER = 12,\r
+       DHD_PREALLOC_PKTID_MAP = 13,\r
+       DHD_PREALLOC_PKTID_MAP_IOCTL = 14,\r
+       DHD_PREALLOC_DHD_LOG_DUMP_BUF = 15,\r
+       DHD_PREALLOC_DHD_LOG_DUMP_BUF_EX = 16,\r
+       DHD_PREALLOC_DHD_PKTLOG_DUMP_BUF = 17,\r
+       DHD_PREALLOC_STAT_REPORT_BUF = 18,\r
+       DHD_PREALLOC_WL_ESCAN = 19,\r
+       DHD_PREALLOC_FW_VERBOSE_RING = 20,\r
+       DHD_PREALLOC_FW_EVENT_RING = 21,\r
+       DHD_PREALLOC_DHD_EVENT_RING = 22,\r
+       DHD_PREALLOC_NAN_EVENT_RING = 23,\r
+       DHD_PREALLOC_MAX\r
+};\r
+\r
+#define STATIC_BUF_MAX_NUM     20\r
+#define STATIC_BUF_SIZE        (PAGE_SIZE*2)\r
+\r
+#ifndef CUSTOM_LOG_DUMP_BUFSIZE_MB\r
+#define CUSTOM_LOG_DUMP_BUFSIZE_MB     4 /* DHD_LOG_DUMP_BUF_SIZE 4 MB static memory in kernel */\r
+#endif /* CUSTOM_LOG_DUMP_BUFSIZE_MB */\r
+\r
+#define DHD_PREALLOC_PROT_SIZE (16 * 1024)\r
+#define DHD_PREALLOC_RXBUF_SIZE        (24 * 1024)\r
+#define DHD_PREALLOC_DATABUF_SIZE      (64 * 1024)\r
+#define DHD_PREALLOC_OSL_BUF_SIZE      (STATIC_BUF_MAX_NUM * STATIC_BUF_SIZE)\r
+#define DHD_PREALLOC_WIPHY_ESCAN0_SIZE (64 * 1024)\r
+#define DHD_PREALLOC_DHD_INFO_SIZE     (32 * 1024)\r
+#define DHD_PREALLOC_MEMDUMP_RAM_SIZE  (1290 * 1024)\r
+#define DHD_PREALLOC_DHD_WLFC_HANGER_SIZE      (73 * 1024)\r
+#define DHD_PREALLOC_DHD_LOG_DUMP_BUF_SIZE (1024 * 1024 * CUSTOM_LOG_DUMP_BUFSIZE_MB)\r
+#define DHD_PREALLOC_DHD_LOG_DUMP_BUF_EX_SIZE (8 * 1024)\r
+#define DHD_PREALLOC_WL_ESCAN_SIZE     (70 * 1024)\r
+#ifdef CONFIG_64BIT\r
+#define DHD_PREALLOC_IF_FLOW_LKUP_SIZE (20 * 1024 * 2)\r
+#else\r
+#define DHD_PREALLOC_IF_FLOW_LKUP_SIZE (20 * 1024)\r
+#endif\r
+#define FW_VERBOSE_RING_SIZE           (256 * 1024)\r
+#define FW_EVENT_RING_SIZE             (64 * 1024)\r
+#define DHD_EVENT_RING_SIZE            (64 * 1024)\r
+#define NAN_EVENT_RING_SIZE            (64 * 1024)\r
+\r
+#if defined(CONFIG_64BIT)\r
+#define WLAN_DHD_INFO_BUF_SIZE (24 * 1024)\r
+#define WLAN_DHD_WLFC_BUF_SIZE (64 * 1024)\r
+#define WLAN_DHD_IF_FLOW_LKUP_SIZE     (64 * 1024)\r
+#else\r
+#define WLAN_DHD_INFO_BUF_SIZE (16 * 1024)\r
+#define WLAN_DHD_WLFC_BUF_SIZE (64 * 1024)\r
+#define WLAN_DHD_IF_FLOW_LKUP_SIZE     (20 * 1024)\r
+#endif /* CONFIG_64BIT */\r
+#define WLAN_DHD_MEMDUMP_SIZE  (800 * 1024)\r
+\r
+#define DHD_SKB_1PAGE_BUFSIZE  (PAGE_SIZE*1)\r
+#define DHD_SKB_2PAGE_BUFSIZE  (PAGE_SIZE*2)\r
+#define DHD_SKB_4PAGE_BUFSIZE  (PAGE_SIZE*4)\r
+\r
+#define DHD_SKB_1PAGE_BUF_NUM  8\r
+#ifdef BCMDHD_PCIE\r
+#define DHD_SKB_2PAGE_BUF_NUM  64\r
+#elif defined(BCMDHD_SDIO)\r
+#define DHD_SKB_2PAGE_BUF_NUM  8\r
+#endif\r
+#define DHD_SKB_4PAGE_BUF_NUM  1\r
+\r
+/* The number is defined in linux_osl.c\r
+ * WLAN_SKB_1_2PAGE_BUF_NUM => STATIC_PKT_1_2PAGE_NUM\r
+ * WLAN_SKB_BUF_NUM => STATIC_PKT_MAX_NUM\r
+ */\r
+#define WLAN_SKB_1_2PAGE_BUF_NUM ((DHD_SKB_1PAGE_BUF_NUM) + \\r
+               (DHD_SKB_2PAGE_BUF_NUM))\r
+#define WLAN_SKB_BUF_NUM ((WLAN_SKB_1_2PAGE_BUF_NUM) + (DHD_SKB_4PAGE_BUF_NUM))\r
+\r
+void *wlan_static_prot = NULL;\r
+void *wlan_static_rxbuf = NULL;\r
+void *wlan_static_databuf = NULL;\r
+void *wlan_static_osl_buf = NULL;\r
+void *wlan_static_scan_buf0 = NULL;\r
+void *wlan_static_scan_buf1 = NULL;\r
+void *wlan_static_dhd_info_buf = NULL;\r
+void *wlan_static_dhd_wlfc_info_buf = NULL;\r
+void *wlan_static_if_flow_lkup = NULL;\r
+void *wlan_static_dhd_memdump_ram_buf = NULL;\r
+void *wlan_static_dhd_wlfc_hanger_buf = NULL;\r
+void *wlan_static_dhd_log_dump_buf = NULL;\r
+void *wlan_static_dhd_log_dump_buf_ex = NULL;\r
+void *wlan_static_wl_escan_info_buf = NULL;\r
+void *wlan_static_fw_verbose_ring_buf = NULL;\r
+void *wlan_static_fw_event_ring_buf = NULL;\r
+void *wlan_static_dhd_event_ring_buf = NULL;\r
+void *wlan_static_nan_event_ring_buf = NULL;\r
+\r
+static struct sk_buff *wlan_static_skb[WLAN_SKB_BUF_NUM];\r
+\r
+void *dhd_wlan_mem_prealloc(int section, unsigned long size)\r
+{\r
+       pr_err("%s: sectoin %d, %ld\n", __func__, section, size);\r
+       if (section == DHD_PREALLOC_PROT)\r
+               return wlan_static_prot;\r
+\r
+#if defined(BCMDHD_SDIO)\r
+       if (section == DHD_PREALLOC_RXBUF)\r
+               return wlan_static_rxbuf;\r
+\r
+       if (section == DHD_PREALLOC_DATABUF)\r
+               return wlan_static_databuf;\r
+#endif /* BCMDHD_SDIO */\r
+\r
+       if (section == DHD_PREALLOC_SKB_BUF)\r
+               return wlan_static_skb;\r
+\r
+       if (section == DHD_PREALLOC_WIPHY_ESCAN0)\r
+               return wlan_static_scan_buf0;\r
+\r
+       if (section == DHD_PREALLOC_WIPHY_ESCAN1)\r
+               return wlan_static_scan_buf1;\r
+\r
+       if (section == DHD_PREALLOC_OSL_BUF) {\r
+               if (size > DHD_PREALLOC_OSL_BUF_SIZE) {\r
+                       pr_err("request OSL_BUF(%lu) > %ld\n",\r
+                               size, DHD_PREALLOC_OSL_BUF_SIZE);\r
+                       return NULL;\r
+               }\r
+               return wlan_static_osl_buf;\r
+       }\r
+\r
+       if (section == DHD_PREALLOC_DHD_INFO) {\r
+               if (size > DHD_PREALLOC_DHD_INFO_SIZE) {\r
+                       pr_err("request DHD_INFO size(%lu) > %d\n",\r
+                               size, DHD_PREALLOC_DHD_INFO_SIZE);\r
+                       return NULL;\r
+               }\r
+               return wlan_static_dhd_info_buf;\r
+       }\r
+       if (section == DHD_PREALLOC_DHD_WLFC_INFO) {\r
+               if (size > WLAN_DHD_WLFC_BUF_SIZE) {\r
+                       pr_err("request DHD_WLFC_INFO size(%lu) > %d\n",\r
+                               size, WLAN_DHD_WLFC_BUF_SIZE);\r
+                       return NULL;\r
+               }\r
+               return wlan_static_dhd_wlfc_info_buf;\r
+       }\r
+#ifdef BCMDHD_PCIE\r
+       if (section == DHD_PREALLOC_IF_FLOW_LKUP)  {\r
+               if (size > DHD_PREALLOC_IF_FLOW_LKUP_SIZE) {\r
+                       pr_err("request DHD_IF_FLOW_LKUP size(%lu) > %d\n",\r
+                               size, DHD_PREALLOC_IF_FLOW_LKUP_SIZE);\r
+                       return NULL;\r
+               }\r
+\r
+               return wlan_static_if_flow_lkup;\r
+       }\r
+#endif /* BCMDHD_PCIE */\r
+       if (section == DHD_PREALLOC_MEMDUMP_RAM) {\r
+               if (size > DHD_PREALLOC_MEMDUMP_RAM_SIZE) {\r
+                       pr_err("request DHD_PREALLOC_MEMDUMP_RAM_SIZE(%lu) > %d\n",\r
+                               size, DHD_PREALLOC_MEMDUMP_RAM_SIZE);\r
+                       return NULL;\r
+               }\r
+\r
+               return wlan_static_dhd_memdump_ram_buf;\r
+       }\r
+       if (section == DHD_PREALLOC_DHD_WLFC_HANGER) {\r
+               if (size > DHD_PREALLOC_DHD_WLFC_HANGER_SIZE) {\r
+                       pr_err("request DHD_WLFC_HANGER size(%lu) > %d\n",\r
+                               size, DHD_PREALLOC_DHD_WLFC_HANGER_SIZE);\r
+                       return NULL;\r
+               }\r
+               return wlan_static_dhd_wlfc_hanger_buf;\r
+       }\r
+       if (section == DHD_PREALLOC_DHD_LOG_DUMP_BUF) {\r
+               if (size > DHD_PREALLOC_DHD_LOG_DUMP_BUF_SIZE) {\r
+                       pr_err("request DHD_PREALLOC_DHD_LOG_DUMP_BUF_SIZE(%lu) > %d\n",\r
+                               size, DHD_PREALLOC_DHD_LOG_DUMP_BUF_SIZE);\r
+                       return NULL;\r
+               }\r
+\r
+               return wlan_static_dhd_log_dump_buf;\r
+       }\r
+       if (section == DHD_PREALLOC_DHD_LOG_DUMP_BUF_EX) {\r
+               if (size > DHD_PREALLOC_DHD_LOG_DUMP_BUF_EX_SIZE) {\r
+                       pr_err("request DHD_PREALLOC_DHD_LOG_DUMP_BUF_EX_SIZE(%lu) > %d\n",\r
+                               size, DHD_PREALLOC_DHD_LOG_DUMP_BUF_EX_SIZE);\r
+                       return NULL;\r
+               }\r
+\r
+               return wlan_static_dhd_log_dump_buf_ex;\r
+       }\r
+       if (section == DHD_PREALLOC_WL_ESCAN) {\r
+               if (size > DHD_PREALLOC_WL_ESCAN_SIZE) {\r
+                       pr_err("request DHD_PREALLOC_WL_ESCAN_SIZE(%lu) > %d\n",\r
+                               size, DHD_PREALLOC_WL_ESCAN_SIZE);\r
+                       return NULL;\r
+               }\r
+\r
+               return wlan_static_wl_escan_info_buf;\r
+       }\r
+       if (section == DHD_PREALLOC_FW_VERBOSE_RING) {\r
+               if (size > FW_VERBOSE_RING_SIZE) {\r
+                       pr_err("request DHD_PREALLOC_FW_VERBOSE_RING(%lu) > %d\n",\r
+                               size, FW_VERBOSE_RING_SIZE);\r
+                       return NULL;\r
+               }\r
+\r
+               return wlan_static_fw_verbose_ring_buf;\r
+       }\r
+       if (section == DHD_PREALLOC_FW_EVENT_RING) {\r
+               if (size > FW_EVENT_RING_SIZE) {\r
+                       pr_err("request DHD_PREALLOC_FW_EVENT_RING(%lu) > %d\n",\r
+                               size, FW_EVENT_RING_SIZE);\r
+                       return NULL;\r
+               }\r
+\r
+               return wlan_static_fw_event_ring_buf;\r
+       }\r
+       if (section == DHD_PREALLOC_DHD_EVENT_RING) {\r
+               if (size > DHD_EVENT_RING_SIZE) {\r
+                       pr_err("request DHD_PREALLOC_DHD_EVENT_RING(%lu) > %d\n",\r
+                               size, DHD_EVENT_RING_SIZE);\r
+                       return NULL;\r
+               }\r
+\r
+               return wlan_static_dhd_event_ring_buf;\r
+       }\r
+       if (section == DHD_PREALLOC_NAN_EVENT_RING) {\r
+               if (size > NAN_EVENT_RING_SIZE) {\r
+                       pr_err("request DHD_PREALLOC_NAN_EVENT_RING(%lu) > %d\n",\r
+                               size, NAN_EVENT_RING_SIZE);\r
+                       return NULL;\r
+               }\r
+\r
+               return wlan_static_nan_event_ring_buf;\r
+       }\r
+       if ((section < 0) || (section > DHD_PREALLOC_MAX))\r
+               pr_err("request section id(%d) is out of max index %d\n",\r
+                               section, DHD_PREALLOC_MAX);\r
+\r
+       pr_err("%s: failed to alloc section %d, size=%ld\n",\r
+               __func__, section, size);\r
+\r
+       return NULL;\r
+}\r
+EXPORT_SYMBOL(dhd_wlan_mem_prealloc);\r
+\r
+static int dhd_init_wlan_mem(void)\r
+{\r
+       int i;\r
+       int j;\r
+       printk(KERN_ERR "%s(): %s\n", __func__, DHD_STATIC_VERSION_STR);\r
+\r
+       for (i = 0; i < DHD_SKB_1PAGE_BUF_NUM; i++) {\r
+               wlan_static_skb[i] = dev_alloc_skb(DHD_SKB_1PAGE_BUFSIZE);\r
+               if (!wlan_static_skb[i]) {\r
+                       goto err_skb_alloc;\r
+               }\r
+               pr_err("%s: sectoin %d skb[%d], size=%ld\n", __func__,\r
+                       DHD_PREALLOC_SKB_BUF, i, DHD_SKB_1PAGE_BUFSIZE);\r
+       }\r
+\r
+       for (i = DHD_SKB_1PAGE_BUF_NUM; i < WLAN_SKB_1_2PAGE_BUF_NUM; i++) {\r
+               wlan_static_skb[i] = dev_alloc_skb(DHD_SKB_2PAGE_BUFSIZE);\r
+               if (!wlan_static_skb[i]) {\r
+                       goto err_skb_alloc;\r
+               }\r
+               pr_err("%s: sectoin %d skb[%d], size=%ld\n", __func__,\r
+                       DHD_PREALLOC_SKB_BUF, i, DHD_SKB_2PAGE_BUFSIZE);\r
+       }\r
+\r
+#if defined(BCMDHD_SDIO)\r
+       wlan_static_skb[i] = dev_alloc_skb(DHD_SKB_4PAGE_BUFSIZE);\r
+       if (!wlan_static_skb[i])\r
+               goto err_skb_alloc;\r
+       pr_err("%s: sectoin %d skb[%d], size=%ld\n", __func__,\r
+               DHD_PREALLOC_SKB_BUF, i, DHD_SKB_4PAGE_BUFSIZE);\r
+#endif /* BCMDHD_SDIO */\r
+\r
+       wlan_static_prot = kmalloc(DHD_PREALLOC_PROT_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_prot)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_PROT, DHD_PREALLOC_PROT_SIZE);\r
+\r
+#if defined(BCMDHD_SDIO)\r
+       wlan_static_rxbuf = kmalloc(DHD_PREALLOC_RXBUF_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_rxbuf)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_RXBUF, DHD_PREALLOC_RXBUF_SIZE);\r
+\r
+       wlan_static_databuf = kmalloc(DHD_PREALLOC_DATABUF_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_databuf)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_DATABUF, DHD_PREALLOC_DATABUF_SIZE);\r
+#endif /* BCMDHD_SDIO */\r
+\r
+       wlan_static_osl_buf = kmalloc(DHD_PREALLOC_OSL_BUF_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_osl_buf)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%ld\n", __func__,\r
+               DHD_PREALLOC_OSL_BUF, DHD_PREALLOC_OSL_BUF_SIZE);\r
+\r
+       wlan_static_scan_buf0 = kmalloc(DHD_PREALLOC_WIPHY_ESCAN0_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_scan_buf0)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_WIPHY_ESCAN0, DHD_PREALLOC_WIPHY_ESCAN0_SIZE);\r
+\r
+       wlan_static_dhd_info_buf = kmalloc(DHD_PREALLOC_DHD_INFO_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_dhd_info_buf)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_DHD_INFO, DHD_PREALLOC_DHD_INFO_SIZE);\r
+\r
+       wlan_static_dhd_wlfc_info_buf = kmalloc(WLAN_DHD_WLFC_BUF_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_dhd_wlfc_info_buf)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_DHD_WLFC_INFO, WLAN_DHD_WLFC_BUF_SIZE);\r
+\r
+#ifdef BCMDHD_PCIE\r
+       wlan_static_if_flow_lkup = kmalloc(DHD_PREALLOC_IF_FLOW_LKUP_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_if_flow_lkup)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_IF_FLOW_LKUP, DHD_PREALLOC_IF_FLOW_LKUP_SIZE);\r
+#endif /* BCMDHD_PCIE */\r
+\r
+       wlan_static_dhd_memdump_ram_buf = kmalloc(DHD_PREALLOC_MEMDUMP_RAM_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_dhd_memdump_ram_buf)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_MEMDUMP_RAM, DHD_PREALLOC_MEMDUMP_RAM_SIZE);\r
+\r
+       wlan_static_dhd_wlfc_hanger_buf = kmalloc(DHD_PREALLOC_DHD_WLFC_HANGER_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_dhd_wlfc_hanger_buf)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_DHD_WLFC_HANGER, DHD_PREALLOC_DHD_WLFC_HANGER_SIZE);\r
+\r
+       wlan_static_dhd_log_dump_buf = kmalloc(DHD_PREALLOC_DHD_LOG_DUMP_BUF_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_dhd_log_dump_buf)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_DHD_LOG_DUMP_BUF, DHD_PREALLOC_DHD_LOG_DUMP_BUF_SIZE);\r
+\r
+       wlan_static_dhd_log_dump_buf_ex = kmalloc(DHD_PREALLOC_DHD_LOG_DUMP_BUF_EX_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_dhd_log_dump_buf_ex)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_DHD_LOG_DUMP_BUF_EX, DHD_PREALLOC_DHD_LOG_DUMP_BUF_EX_SIZE);\r
+\r
+       wlan_static_wl_escan_info_buf = kmalloc(DHD_PREALLOC_WL_ESCAN_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_wl_escan_info_buf)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_WL_ESCAN, DHD_PREALLOC_WL_ESCAN_SIZE);\r
+\r
+       wlan_static_fw_verbose_ring_buf = kmalloc(FW_VERBOSE_RING_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_fw_verbose_ring_buf)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_FW_VERBOSE_RING, FW_VERBOSE_RING_SIZE);\r
+\r
+       wlan_static_fw_event_ring_buf = kmalloc(FW_EVENT_RING_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_fw_event_ring_buf)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_FW_EVENT_RING, FW_EVENT_RING_SIZE);\r
+\r
+       wlan_static_dhd_event_ring_buf = kmalloc(DHD_EVENT_RING_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_dhd_event_ring_buf)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_DHD_EVENT_RING, DHD_EVENT_RING_SIZE);\r
+\r
+       wlan_static_nan_event_ring_buf = kmalloc(NAN_EVENT_RING_SIZE, GFP_KERNEL);\r
+       if (!wlan_static_nan_event_ring_buf)\r
+               goto err_mem_alloc;\r
+       pr_err("%s: sectoin %d, size=%d\n", __func__,\r
+               DHD_PREALLOC_NAN_EVENT_RING, NAN_EVENT_RING_SIZE);\r
+\r
+       return 0;\r
+\r
+err_mem_alloc:\r
+\r
+       if (wlan_static_prot)\r
+               kfree(wlan_static_prot);\r
+\r
+#if defined(BCMDHD_SDIO)\r
+       if (wlan_static_rxbuf)\r
+               kfree(wlan_static_rxbuf);\r
+\r
+       if (wlan_static_databuf)\r
+               kfree(wlan_static_databuf);\r
+#endif /* BCMDHD_SDIO */\r
+\r
+       if (wlan_static_osl_buf)\r
+               kfree(wlan_static_osl_buf);\r
+\r
+       if (wlan_static_scan_buf0)\r
+               kfree(wlan_static_scan_buf0);\r
+\r
+       if (wlan_static_scan_buf1)\r
+               kfree(wlan_static_scan_buf1);\r
+\r
+       if (wlan_static_dhd_info_buf)\r
+               kfree(wlan_static_dhd_info_buf);\r
+\r
+       if (wlan_static_dhd_wlfc_info_buf)\r
+               kfree(wlan_static_dhd_wlfc_info_buf);\r
+\r
+#ifdef BCMDHD_PCIE\r
+       if (wlan_static_if_flow_lkup)\r
+               kfree(wlan_static_if_flow_lkup);\r
+#endif /* BCMDHD_PCIE */\r
+\r
+       if (wlan_static_dhd_memdump_ram_buf)\r
+               kfree(wlan_static_dhd_memdump_ram_buf);\r
+\r
+       if (wlan_static_dhd_wlfc_hanger_buf)\r
+               kfree(wlan_static_dhd_wlfc_hanger_buf);\r
+\r
+       if (wlan_static_dhd_log_dump_buf)\r
+               kfree(wlan_static_dhd_log_dump_buf);\r
+\r
+       if (wlan_static_dhd_log_dump_buf_ex)\r
+               kfree(wlan_static_dhd_log_dump_buf_ex);\r
+\r
+       if (wlan_static_wl_escan_info_buf)\r
+               kfree(wlan_static_wl_escan_info_buf);\r
+\r
+#ifdef BCMDHD_PCIE\r
+       if (wlan_static_fw_verbose_ring_buf)\r
+               kfree(wlan_static_fw_verbose_ring_buf);\r
+\r
+       if (wlan_static_fw_event_ring_buf)\r
+               kfree(wlan_static_fw_event_ring_buf);\r
+\r
+       if (wlan_static_dhd_event_ring_buf)\r
+               kfree(wlan_static_dhd_event_ring_buf);\r
+\r
+       if (wlan_static_nan_event_ring_buf)\r
+               kfree(wlan_static_nan_event_ring_buf);\r
+#endif /* BCMDHD_PCIE */\r
+\r
+       pr_err("%s: Failed to mem_alloc for WLAN\n", __func__);\r
+\r
+       i = WLAN_SKB_BUF_NUM;\r
+\r
+err_skb_alloc:\r
+       pr_err("%s: Failed to skb_alloc for WLAN\n", __func__);\r
+       for (j = 0; j < i; j++)\r
+               dev_kfree_skb(wlan_static_skb[j]);\r
+\r
+       return -ENOMEM;\r
+}\r
+\r
+static int __init\r
+dhd_static_buf_init(void)\r
+{\r
+       dhd_init_wlan_mem();\r
+\r
+       return 0;\r
+}\r
+\r
+static void __exit\r
+dhd_static_buf_exit(void)\r
+{\r
+       int i;\r
+\r
+       pr_err("%s()\n", __FUNCTION__);\r
+\r
+       for (i = 0; i < DHD_SKB_1PAGE_BUF_NUM; i++) {\r
+               if (wlan_static_skb[i])\r
+                       dev_kfree_skb(wlan_static_skb[i]);\r
+       }\r
+\r
+       for (i = DHD_SKB_1PAGE_BUF_NUM; i < WLAN_SKB_1_2PAGE_BUF_NUM; i++) {\r
+               if (wlan_static_skb[i])\r
+                       dev_kfree_skb(wlan_static_skb[i]);\r
+       }\r
+\r
+#if defined(BCMDHD_SDIO)\r
+       if (wlan_static_skb[i])\r
+               dev_kfree_skb(wlan_static_skb[i]);\r
+#endif /* BCMDHD_SDIO */\r
+\r
+       if (wlan_static_prot)\r
+               kfree(wlan_static_prot);\r
+\r
+#if defined(BCMDHD_SDIO)\r
+       if (wlan_static_rxbuf)\r
+               kfree(wlan_static_rxbuf);\r
+\r
+       if (wlan_static_databuf)\r
+               kfree(wlan_static_databuf);\r
+#endif /* BCMDHD_SDIO */\r
+\r
+       if (wlan_static_osl_buf)\r
+               kfree(wlan_static_osl_buf);\r
+\r
+       if (wlan_static_scan_buf0)\r
+               kfree(wlan_static_scan_buf0);\r
+\r
+       if (wlan_static_scan_buf1)\r
+               kfree(wlan_static_scan_buf1);\r
+\r
+       if (wlan_static_dhd_info_buf)\r
+               kfree(wlan_static_dhd_info_buf);\r
+\r
+       if (wlan_static_dhd_wlfc_info_buf)\r
+               kfree(wlan_static_dhd_wlfc_info_buf);\r
+\r
+#ifdef BCMDHD_PCIE\r
+       if (wlan_static_if_flow_lkup)\r
+               kfree(wlan_static_if_flow_lkup);\r
+#endif /* BCMDHD_PCIE */\r
+\r
+       if (wlan_static_dhd_memdump_ram_buf)\r
+               kfree(wlan_static_dhd_memdump_ram_buf);\r
+\r
+       if (wlan_static_dhd_wlfc_hanger_buf)\r
+               kfree(wlan_static_dhd_wlfc_hanger_buf);\r
+\r
+       if (wlan_static_dhd_log_dump_buf)\r
+               kfree(wlan_static_dhd_log_dump_buf);\r
+\r
+       if (wlan_static_dhd_log_dump_buf_ex)\r
+               kfree(wlan_static_dhd_log_dump_buf_ex);\r
+\r
+       if (wlan_static_wl_escan_info_buf)\r
+               kfree(wlan_static_wl_escan_info_buf);\r
+\r
+#ifdef BCMDHD_PCIE\r
+       if (wlan_static_fw_verbose_ring_buf)\r
+               kfree(wlan_static_fw_verbose_ring_buf);\r
+\r
+       if (wlan_static_fw_event_ring_buf)\r
+               kfree(wlan_static_fw_event_ring_buf);\r
+\r
+       if (wlan_static_dhd_event_ring_buf)\r
+               kfree(wlan_static_dhd_event_ring_buf);\r
+\r
+       if (wlan_static_nan_event_ring_buf)\r
+               kfree(wlan_static_nan_event_ring_buf);\r
+#endif\r
+\r
+       return;\r
+}\r
+\r
+module_init(dhd_static_buf_init);\r
+\r
+module_exit(dhd_static_buf_exit);\r
diff --git a/bcmdhd.101.10.240.x/dhd_statlog.c b/bcmdhd.101.10.240.x/dhd_statlog.c
new file mode 100644 (file)
index 0000000..67546fe
--- /dev/null
@@ -0,0 +1,1079 @@
+/*
+ * DHD debugability: Status Information Logging support
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <ethernet.h>
+#include <bcmevent.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <linux/rtc.h>
+
+#ifdef DHD_STATUS_LOGGING
+
+#define DHD_STATLOG_ERR_INTERNAL(fmt, ...)     DHD_ERROR(("STATLOG-" fmt, ##__VA_ARGS__))
+#define DHD_STATLOG_INFO_INTERNAL(fmt, ...)    DHD_INFO(("STATLOG-" fmt, ##__VA_ARGS__))
+
+#define DHD_STATLOG_PRINT(x)                   DHD_ERROR(x)
+#define DHD_STATLOG_ERR(x)                     DHD_STATLOG_ERR_INTERNAL x
+#define DHD_STATLOG_INFO(x)                    DHD_STATLOG_INFO_INTERNAL x
+#define DHD_STATLOG_VALID(stat)                        (((stat) > (ST(INVALID))) && ((stat) < (ST(MAX))))
+
+dhd_statlog_handle_t *
+dhd_attach_statlog(dhd_pub_t *dhdp, uint32 num_items, uint32 bdlog_num_items, uint32 logbuf_len)
+{
+       dhd_statlog_t *statlog = NULL;
+       void *buf = NULL;
+
+       if (!dhdp) {
+               DHD_STATLOG_ERR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return NULL;
+       }
+
+       statlog = (dhd_statlog_t *)VMALLOCZ(dhdp->osh, sizeof(dhd_statlog_t));
+       if (!statlog) {
+               DHD_STATLOG_ERR(("%s: failed to allocate memory for dhd_statlog_t\n",
+                       __FUNCTION__));
+               return NULL;
+       }
+
+       /* allocate log buffer */
+       statlog->logbuf = (uint8 *)VMALLOCZ(dhdp->osh, logbuf_len);
+       if (!statlog->logbuf) {
+               DHD_STATLOG_ERR(("%s: failed to alloc log buffer\n", __FUNCTION__));
+               goto error;
+       }
+       statlog->logbuf_len = logbuf_len;
+
+       /* alloc ring buffer */
+       statlog->bufsize = (uint32)(dhd_ring_get_hdr_size() +
+               DHD_STATLOG_RING_SIZE(num_items));
+       buf = VMALLOCZ(dhdp->osh, statlog->bufsize);
+       if (!buf) {
+               DHD_STATLOG_ERR(("%s: failed to allocate memory for ring buffer\n",
+                       __FUNCTION__));
+               goto error;
+       }
+
+       statlog->ringbuf = dhd_ring_init(dhdp, buf, statlog->bufsize,
+               DHD_STATLOG_ITEM_SIZE, num_items, DHD_RING_TYPE_SINGLE_IDX);
+       if (!statlog->ringbuf) {
+               DHD_STATLOG_ERR(("%s: failed to init ring buffer\n", __FUNCTION__));
+               VMFREE(dhdp->osh, buf, statlog->bufsize);
+               goto error;
+       }
+
+       /* alloc ring buffer for bigdata logging */
+       statlog->bdlog_bufsize = (uint32)(dhd_ring_get_hdr_size() +
+               DHD_STATLOG_RING_SIZE(bdlog_num_items));
+       buf = VMALLOCZ(dhdp->osh, statlog->bdlog_bufsize);
+       if (!buf) {
+               DHD_STATLOG_ERR(("%s: failed to allocate memory for bigdata logging buffer\n",
+                       __FUNCTION__));
+               goto error;
+       }
+
+       statlog->bdlog_ringbuf = dhd_ring_init(dhdp, buf, statlog->bdlog_bufsize,
+               DHD_STATLOG_ITEM_SIZE, bdlog_num_items, DHD_RING_TYPE_SINGLE_IDX);
+       if (!statlog->bdlog_ringbuf) {
+               DHD_STATLOG_ERR(("%s: failed to init ring buffer for bigdata logging\n",
+                       __FUNCTION__));
+               VMFREE(dhdp->osh, buf, statlog->bdlog_bufsize);
+               goto error;
+       }
+
+       return (dhd_statlog_handle_t *)statlog;
+
+error:
+       if (statlog->logbuf) {
+               VMFREE(dhdp->osh, statlog->logbuf, logbuf_len);
+       }
+
+       if (statlog->ringbuf) {
+               dhd_ring_deinit(dhdp, statlog->ringbuf);
+               VMFREE(dhdp->osh, statlog->ringbuf, statlog->bufsize);
+       }
+
+       if (statlog->bdlog_ringbuf) {
+               dhd_ring_deinit(dhdp, statlog->bdlog_ringbuf);
+               VMFREE(dhdp->osh, statlog->bdlog_ringbuf, statlog->bdlog_bufsize);
+       }
+
+       if (statlog) {
+               VMFREE(dhdp->osh, statlog, sizeof(dhd_statlog_t));
+       }
+
+       return NULL;
+}
+
+void
+dhd_detach_statlog(dhd_pub_t *dhdp)
+{
+       dhd_statlog_t *statlog;
+
+       if (!dhdp) {
+               DHD_STATLOG_ERR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (!dhdp->statlog) {
+               DHD_STATLOG_ERR(("%s: statlog is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       statlog = (dhd_statlog_t *)(dhdp->statlog);
+
+       if (statlog->bdlog_ringbuf) {
+               dhd_ring_deinit(dhdp, statlog->bdlog_ringbuf);
+               VMFREE(dhdp->osh, statlog->bdlog_ringbuf, statlog->bdlog_bufsize);
+       }
+
+       if (statlog->ringbuf) {
+               dhd_ring_deinit(dhdp, statlog->ringbuf);
+               VMFREE(dhdp->osh, statlog->ringbuf, statlog->bufsize);
+       }
+
+       if (statlog->logbuf) {
+               VMFREE(dhdp->osh, statlog->logbuf, statlog->logbuf_len);
+       }
+
+       VMFREE(dhdp->osh, statlog, sizeof(dhd_statlog_t));
+       dhdp->statlog = NULL;
+}
+
+static int
+dhd_statlog_ring_log(dhd_pub_t *dhdp, uint16 stat, uint8 ifidx, uint8 dir,
+       uint16 status, uint16 reason)
+{
+       dhd_statlog_t *statlog;
+       stat_elem_t *elem;
+
+       if (!dhdp || !dhdp->statlog) {
+               DHD_STATLOG_ERR(("%s: dhdp or dhdp->statlog is NULL\n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (ifidx >= DHD_MAX_IFS) {
+               DHD_STATLOG_ERR(("%s: invalid ifidx %d\n", __FUNCTION__, ifidx));
+               return BCME_ERROR;
+       }
+
+       if (!DHD_STATLOG_VALID(stat)) {
+               DHD_STATLOG_ERR(("%s: invalid stat %d\n", __FUNCTION__, stat));
+               return BCME_ERROR;
+       }
+
+       statlog = (dhd_statlog_t *)(dhdp->statlog);
+       elem = (stat_elem_t *)dhd_ring_get_empty(statlog->ringbuf);
+       if (!elem) {
+               /* no available slot */
+               DHD_STATLOG_ERR(("%s: cannot allocate a new element\n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       elem->ts_tz = OSL_SYSTZTIME_US();
+       elem->ts = OSL_LOCALTIME_NS();
+       elem->stat = stat;
+       elem->ifidx = ifidx;
+       elem->dir = dir;
+       elem->reason = reason;
+       elem->status = status;
+
+       /* Logging for the bigdata */
+       if (isset(statlog->bdmask, stat)) {
+               stat_elem_t *elem_bd;
+               elem_bd = (stat_elem_t *)dhd_ring_get_empty(statlog->bdlog_ringbuf);
+               if (!elem_bd) {
+                       /* no available slot */
+                       DHD_STATLOG_ERR(("%s: cannot allocate a new element for bigdata\n",
+                               __FUNCTION__));
+                       return BCME_ERROR;
+               }
+               bcopy(elem, elem_bd, sizeof(stat_elem_t));
+       }
+
+       return BCME_OK;
+}
+
+int
+dhd_statlog_ring_log_data(dhd_pub_t *dhdp, uint16 stat, uint8 ifidx,
+       uint8 dir, bool cond)
+{
+       return cond ? dhd_statlog_ring_log(dhdp, stat, ifidx,
+               dir ? STDIR(TX) : STDIR(RX), 0, 0) : BCME_OK;
+}
+
+int
+dhd_statlog_ring_log_data_reason(dhd_pub_t *dhdp, uint16 stat,
+       uint8 ifidx, uint8 dir, uint16 reason)
+{
+       return dhd_statlog_ring_log(dhdp, stat, ifidx,
+               dir ? STDIR(TX) : STDIR(RX), 0, reason);
+}
+
+int
+dhd_statlog_ring_log_ctrl(dhd_pub_t *dhdp, uint16 stat, uint8 ifidx, uint16 reason)
+{
+       return dhd_statlog_ring_log(dhdp, stat, ifidx, ST(DIR_TX), 0, reason);
+}
+
+int
+dhd_statlog_process_event(dhd_pub_t *dhdp, int type, uint8 ifidx,
+       uint16 status, uint16 reason, uint16 flags)
+{
+       int stat = ST(INVALID);
+       uint8 dir = STDIR(RX);
+
+       if (!dhdp || !dhdp->statlog) {
+               DHD_STATLOG_ERR(("%s: dhdp or dhdp->statlog is NULL\n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       switch (type) {
+       case WLC_E_SET_SSID:
+               if (status == WLC_E_STATUS_SUCCESS) {
+                       stat = ST(ASSOC_DONE);
+               } else if (status == WLC_E_STATUS_TIMEOUT) {
+                       stat = ST(ASSOC_TIMEOUT);
+               } else if (status == WLC_E_STATUS_FAIL) {
+                       stat = ST(ASSOC_FAIL);
+               } else if (status == WLC_E_STATUS_NO_ACK) {
+                       stat = ST(ASSOC_NO_ACK);
+               } else if (status == WLC_E_STATUS_ABORT) {
+                       stat = ST(ASSOC_ABORT);
+               } else if (status == WLC_E_STATUS_UNSOLICITED) {
+                       stat = ST(ASSOC_UNSOLICITED);
+               } else if (status == WLC_E_STATUS_NO_NETWORKS) {
+                       stat = ST(ASSOC_NO_NETWORKS);
+               } else {
+                       stat = ST(ASSOC_OTHERS);
+               }
+               break;
+       case WLC_E_AUTH:
+               if (status == WLC_E_STATUS_SUCCESS) {
+                       stat = ST(AUTH_DONE);
+               } else if (status == WLC_E_STATUS_TIMEOUT) {
+                       stat = ST(AUTH_TIMEOUT);
+               } else if (status == WLC_E_STATUS_FAIL) {
+                       stat = ST(AUTH_FAIL);
+               } else if (status == WLC_E_STATUS_NO_ACK) {
+                       stat = ST(AUTH_NO_ACK);
+               } else {
+                       stat = ST(AUTH_OTHERS);
+               }
+               dir = STDIR(TX);
+               break;
+       case WLC_E_AUTH_IND:
+               stat = ST(AUTH_DONE);
+               break;
+       case WLC_E_DEAUTH:
+               stat = ST(DEAUTH);
+               dir = STDIR(TX);
+               break;
+       case WLC_E_DEAUTH_IND:
+               stat = ST(DEAUTH);
+               break;
+       case WLC_E_DISASSOC:
+               stat = ST(DISASSOC);
+               dir = STDIR(TX);
+               break;
+       case WLC_E_LINK:
+               if (!(flags & WLC_EVENT_MSG_LINK)) {
+                       stat = ST(LINKDOWN);
+               }
+               break;
+       case WLC_E_ROAM_PREP:
+               stat = ST(REASSOC_START);
+               break;
+       case WLC_E_ASSOC_REQ_IE:
+               stat = ST(ASSOC_REQ);
+               dir = STDIR(TX);
+               break;
+       case WLC_E_ASSOC_RESP_IE:
+               stat = ST(ASSOC_RESP);
+               break;
+       case WLC_E_BSSID:
+               if (status == WLC_E_STATUS_SUCCESS) {
+                       stat = ST(REASSOC_DONE);
+               } else {
+                       stat = ST(REASSOC_DONE_OTHERS);
+               }
+               break;
+       case WLC_E_REASSOC:
+               if (status == WLC_E_STATUS_SUCCESS) {
+                       stat = ST(REASSOC_SUCCESS);
+               } else {
+                       stat = ST(REASSOC_FAILURE);
+               }
+               dir = STDIR(TX);
+               break;
+       case WLC_E_ASSOC_IND:
+               stat = ST(ASSOC_REQ);
+               break;
+       default:
+               break;
+       }
+
+       /* logging interested events */
+       if (DHD_STATLOG_VALID(stat)) {
+               dhd_statlog_ring_log(dhdp, stat, ifidx, dir, status, reason);
+       }
+
+       return BCME_OK;
+}
+
+uint32
+dhd_statlog_get_logbuf_len(dhd_pub_t *dhdp)
+{
+       uint32 length = 0;
+       dhd_statlog_t *statlog;
+
+       if (dhdp && dhdp->statlog) {
+               statlog = (dhd_statlog_t *)(dhdp->statlog);
+               length = statlog->logbuf_len;
+       }
+
+       return length;
+}
+
+void *
+dhd_statlog_get_logbuf(dhd_pub_t *dhdp)
+{
+       dhd_statlog_t *statlog;
+       void *ret_addr = NULL;
+
+       if (dhdp && dhdp->statlog) {
+               statlog = (dhd_statlog_t *)(dhdp->statlog);
+               ret_addr = (void *)(statlog->logbuf);
+       }
+
+       return ret_addr;
+}
+
+/*
+ * called function uses buflen as the DHD_STATLOG_STATSTR_BUF_LEN max.
+ * So when adding a case, make sure the string is less than
+ * the DHD_STATLOG_STATSTR_BUF_LEN bytes
+ */
+static void
+dhd_statlog_stat_name(char *buf, uint32 buflen, uint32 state, uint8 dir)
+{
+       char *stat_str = NULL;
+       bool tx = (dir == STDIR(TX));
+       uint32 max_buf_len = MIN(buflen, DHD_STATLOG_STATSTR_BUF_LEN);
+
+       switch (state) {
+       case ST(INVALID):
+               stat_str = "INVALID_STATE";
+               break;
+       case ST(WLAN_POWER_ON):
+               stat_str = "WLAN_POWER_ON";
+               break;
+       case ST(WLAN_POWER_OFF):
+               stat_str = "WLAN_POWER_OFF";
+               break;
+       case ST(ASSOC_START):
+               stat_str = "ASSOC_START";
+               break;
+       case ST(AUTH_DONE):
+               stat_str = "AUTH_DONE";
+               break;
+       case ST(ASSOC_REQ):
+               stat_str = tx ? "ASSOC_REQ" : "RX_ASSOC_REQ";
+               break;
+       case ST(ASSOC_RESP):
+               stat_str = "ASSOC_RESP";
+               break;
+       case ST(ASSOC_DONE):
+               stat_str = "ASSOC_DONE";
+               break;
+       case ST(DISASSOC_START):
+               stat_str = "DISASSOC_START";
+               break;
+       case ST(DISASSOC_INT_START):
+               stat_str = "DISASSOC_INTERNAL_START";
+               break;
+       case ST(DISASSOC_DONE):
+               stat_str = "DISASSOC_DONE";
+               break;
+       case ST(DISASSOC):
+               stat_str = tx ? "DISASSOC_EVENT" : "DISASSOC_IND_EVENT";
+               break;
+       case ST(DEAUTH):
+               stat_str = tx ? "DEAUTH_EVENT" : "DEAUTH_IND_EVENT";
+               break;
+       case ST(LINKDOWN):
+               stat_str = "LINKDOWN_EVENT";
+               break;
+       case ST(REASSOC_START):
+               stat_str = "REASSOC_START";
+               break;
+       case ST(REASSOC_INFORM):
+               stat_str = "REASSOC_INFORM";
+               break;
+       case ST(REASSOC_DONE):
+               stat_str = "REASSOC_DONE_SUCCESS";
+               break;
+       case ST(EAPOL_M1):
+               stat_str = tx ? "TX_EAPOL_M1" : "RX_EAPOL_M1";
+               break;
+       case ST(EAPOL_M2):
+               stat_str = tx ? "TX_EAPOL_M2" : "RX_EAPOL_M2";
+               break;
+       case ST(EAPOL_M3):
+               stat_str = tx ? "TX_EAPOL_M3" : "RX_EAPOL_M3";
+               break;
+       case ST(EAPOL_M4):
+               stat_str = tx ? "TX_EAPOL_M4" : "RX_EAPOL_M4";
+               break;
+       case ST(EAPOL_GROUPKEY_M1):
+               stat_str = tx ? "TX_EAPOL_GROUPKEY_M1" : "RX_EAPOL_GROUPKEY_M1";
+               break;
+       case ST(EAPOL_GROUPKEY_M2):
+               stat_str = tx ? "TX_EAPOL_GROUPKEY_M2" : "RX_EAPOL_GROUPKEY_M2";
+               break;
+       case ST(EAP_REQ_IDENTITY):
+               stat_str = tx ? "TX_EAP_REQ_IDENTITY" : "RX_EAP_REQ_IDENTITY";
+               break;
+       case ST(EAP_RESP_IDENTITY):
+               stat_str = tx ? "TX_EAP_RESP_IDENTITY" : "RX_EAP_RESP_IDENTITY";
+               break;
+       case ST(EAP_REQ_TLS):
+               stat_str = tx ? "TX_EAP_REQ_TLS" : "RX_EAP_REQ_TLS";
+               break;
+       case ST(EAP_RESP_TLS):
+               stat_str = tx ? "TX_EAP_RESP_TLS" : "RX_EAP_RESP_TLS";
+               break;
+       case ST(EAP_REQ_LEAP):
+               stat_str = tx ? "TX_EAP_REQ_LEAP" : "RX_EAP_REQ_LEAP";
+               break;
+       case ST(EAP_RESP_LEAP):
+               stat_str = tx ? "TX_EAP_RESP_LEAP" : "RX_EAP_RESP_LEAP";
+               break;
+       case ST(EAP_REQ_TTLS):
+               stat_str = tx ? "TX_EAP_REQ_TTLS" : "RX_EAP_REQ_TTLS";
+               break;
+       case ST(EAP_RESP_TTLS):
+               stat_str = tx ? "TX_EAP_RESP_TTLS" : "RX_EAP_RESP_TTLS";
+               break;
+       case ST(EAP_REQ_AKA):
+               stat_str = tx ? "TX_EAP_REQ_AKA" : "RX_EAP_REQ_AKA";
+               break;
+       case ST(EAP_RESP_AKA):
+               stat_str = tx ? "TX_EAP_RESP_AKA" : "RX_EAP_RESP_AKA";
+               break;
+       case ST(EAP_REQ_PEAP):
+               stat_str = tx ? "TX_EAP_REQ_PEAP" : "RX_EAP_REQ_PEAP";
+               break;
+       case ST(EAP_RESP_PEAP):
+               stat_str = tx ? "TX_EAP_RESP_PEAP" : "RX_EAP_RESP_PEAP";
+               break;
+       case ST(EAP_REQ_FAST):
+               stat_str = tx ? "TX_EAP_REQ_FAST" : "RX_EAP_REQ_FAST";
+               break;
+       case ST(EAP_RESP_FAST):
+               stat_str = tx ? "TX_EAP_RESP_FAST" : "RX_EAP_RESP_FAST";
+               break;
+       case ST(EAP_REQ_PSK):
+               stat_str = tx ? "TX_EAP_REQ_PSK" : "RX_EAP_REQ_PSK";
+               break;
+       case ST(EAP_RESP_PSK):
+               stat_str = tx ? "TX_EAP_RESP_PSK" : "RX_EAP_RESP_PSK";
+               break;
+       case ST(EAP_REQ_AKAP):
+               stat_str = tx ? "TX_EAP_REQ_AKAP" : "RX_EAP_REQ_AKAP";
+               break;
+       case ST(EAP_RESP_AKAP):
+               stat_str = tx ? "TX_EAP_RESP_AKAP" : "RX_EAP_RESP_AKAP";
+               break;
+       case ST(EAP_SUCCESS):
+               stat_str = tx ? "TX_EAP_SUCCESS" : "RX_EAP_SUCCESS";
+               break;
+       case ST(EAP_FAILURE):
+               stat_str = tx ? "TX_EAP_FAILURE" : "RX_EAP_FAILURE";
+               break;
+       case ST(EAPOL_START):
+               stat_str = tx ? "TX_EAPOL_START" : "RX_EAPOL_START";
+               break;
+       case ST(WSC_START):
+               stat_str = tx ? "TX_WSC_START" : "RX_WSC_START";
+               break;
+       case ST(WSC_DONE):
+               stat_str = tx ? "TX_WSC_DONE" : "RX_WSC_DONE";
+               break;
+       case ST(WPS_M1):
+               stat_str = tx ? "TX_WPS_M1" : "RX_WPS_M1";
+               break;
+       case ST(WPS_M2):
+               stat_str = tx ? "TX_WPS_M2" : "RX_WPS_M2";
+               break;
+       case ST(WPS_M3):
+               stat_str = tx ? "TX_WPS_M3" : "RX_WPS_M3";
+               break;
+       case ST(WPS_M4):
+               stat_str = tx ? "TX_WPS_M4" : "RX_WPS_M4";
+               break;
+       case ST(WPS_M5):
+               stat_str = tx ? "TX_WPS_M5" : "RX_WPS_M5";
+               break;
+       case ST(WPS_M6):
+               stat_str = tx ? "TX_WPS_M6" : "RX_WPS_M6";
+               break;
+       case ST(WPS_M7):
+               stat_str = tx ? "TX_WPS_M7" : "RX_WPS_M7";
+               break;
+       case ST(WPS_M8):
+               stat_str = tx ? "TX_WPS_M8" : "RX_WPS_M8";
+               break;
+       case ST(8021X_OTHER):
+               stat_str = tx ? "TX_OTHER_8021X" : "RX_OTHER_8021X";
+               break;
+       case ST(INSTALL_KEY):
+               stat_str = "INSTALL_KEY";
+               break;
+       case ST(DELETE_KEY):
+               stat_str = "DELETE_KEY";
+               break;
+       case ST(INSTALL_PMKSA):
+               stat_str = "INSTALL_PMKSA";
+               break;
+       case ST(INSTALL_OKC_PMK):
+               stat_str = "INSTALL_OKC_PMK";
+               break;
+       case ST(DHCP_DISCOVER):
+               stat_str = tx ? "TX_DHCP_DISCOVER" : "RX_DHCP_DISCOVER";
+               break;
+       case ST(DHCP_OFFER):
+               stat_str = tx ? "TX_DHCP_OFFER" : "RX_DHCP_OFFER";
+               break;
+       case ST(DHCP_REQUEST):
+               stat_str = tx ? "TX_DHCP_REQUEST" : "RX_DHCP_REQUEST";
+               break;
+       case ST(DHCP_DECLINE):
+               stat_str = tx ? "TX_DHCP_DECLINE" : "RX_DHCP_DECLINE";
+               break;
+       case ST(DHCP_ACK):
+               stat_str = tx ? "TX_DHCP_ACK" : "RX_DHCP_ACK";
+               break;
+       case ST(DHCP_NAK):
+               stat_str = tx ? "TX_DHCP_NAK" : "RX_DHCP_NAK";
+               break;
+       case ST(DHCP_RELEASE):
+               stat_str = tx ? "TX_DHCP_RELEASE" : "RX_DHCP_RELEASE";
+               break;
+       case ST(DHCP_INFORM):
+               stat_str = tx ? "TX_DHCP_INFORM" : "RX_DHCP_INFORM";
+               break;
+       case ST(ICMP_PING_REQ):
+               stat_str = tx ? "TX_ICMP_PING_REQ" : "RX_ICMP_PING_REQ";
+               break;
+       case ST(ICMP_PING_RESP):
+               stat_str = tx ? "TX_ICMP_PING_RESP" : "RX_ICMP_PING_RESP";
+               break;
+       case ST(ICMP_DEST_UNREACH):
+               stat_str = tx ? "TX_ICMP_DEST_UNREACH" : "RX_ICMP_DEST_UNREACH";
+               break;
+       case ST(ICMP_OTHER):
+               stat_str = tx ? "TX_ICMP_OTHER" : "RX_ICMP_OTHER";
+               break;
+       case ST(ARP_REQ):
+               stat_str = tx ? "TX_ARP_REQ" : "RX_ARP_REQ";
+               break;
+       case ST(ARP_RESP):
+               stat_str = tx ? "TX_ARP_RESP" : "RX_ARP_RESP";
+               break;
+       case ST(DNS_QUERY):
+               stat_str = tx ? "TX_DNS_QUERY" : "RX_DNS_QUERY";
+               break;
+       case ST(DNS_RESP):
+               stat_str = tx ? "TX_DNS_RESP" : "RX_DNS_RESP";
+               break;
+       case ST(REASSOC_SUCCESS):
+               stat_str = "REASSOC_SUCCESS";
+               break;
+       case ST(REASSOC_FAILURE):
+               stat_str = "REASSOC_FAILURE";
+               break;
+       case ST(AUTH_TIMEOUT):
+               stat_str = "AUTH_TIMEOUT";
+               break;
+       case ST(AUTH_FAIL):
+               stat_str = "AUTH_FAIL";
+               break;
+       case ST(AUTH_NO_ACK):
+               stat_str = "AUTH_NO_ACK";
+               break;
+       case ST(AUTH_OTHERS):
+               stat_str = "AUTH_FAIL_OTHER_STATUS";
+               break;
+       case ST(ASSOC_TIMEOUT):
+               stat_str = "ASSOC_TIMEOUT";
+               break;
+       case ST(ASSOC_FAIL):
+               stat_str = "ASSOC_FAIL";
+               break;
+       case ST(ASSOC_NO_ACK):
+               stat_str = "ASSOC_NO_ACK";
+               break;
+       case ST(ASSOC_ABORT):
+               stat_str = "ASSOC_ABORT";
+               break;
+       case ST(ASSOC_UNSOLICITED):
+               stat_str = "ASSOC_UNSOLICITED";
+               break;
+       case ST(ASSOC_NO_NETWORKS):
+               stat_str = "ASSOC_NO_NETWORKS";
+               break;
+       case ST(ASSOC_OTHERS):
+               stat_str = "ASSOC_FAIL_OTHER_STATUS";
+               break;
+       case ST(REASSOC_DONE_OTHERS):
+               stat_str = "REASSOC_DONE_OTHER_STATUS";
+               break;
+       default:
+               stat_str = "UNKNOWN_STATUS";
+               break;
+       }
+
+       strncpy(buf, stat_str, max_buf_len);
+       buf[max_buf_len - 1] = '\0';
+}
+
+static void
+dhd_statlog_get_timestamp(stat_elem_t *elem, uint64 *sec, uint64 *usec)
+{
+       uint64 ts_nsec, rem_nsec;
+
+       ts_nsec = elem->ts;
+       rem_nsec = DIV_AND_MOD_U64_BY_U32(ts_nsec, NSEC_PER_SEC);
+       *sec = ts_nsec;
+       *usec = (uint64)(rem_nsec / NSEC_PER_USEC);
+}
+
+static void
+dhd_statlog_convert_time(stat_elem_t *elem, uint8 *buf, uint32 buflen)
+{
+       struct rtc_time tm;
+       uint64 ts_sec, rem_usec;
+
+       if (!buf) {
+               DHD_STATLOG_ERR(("%s: buf is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       bzero(buf, buflen);
+       ts_sec = elem->ts_tz;
+       rem_usec = DIV_AND_MOD_U64_BY_U32(ts_sec, USEC_PER_SEC);
+
+       rtc_time_to_tm((unsigned long)ts_sec, &tm);
+       snprintf(buf, buflen, DHD_STATLOG_TZFMT_YYMMDDHHMMSSMS,
+               tm.tm_year - 100, tm.tm_mon + 1, tm.tm_mday,
+               tm.tm_hour, tm.tm_min, tm.tm_sec,
+               (uint32)(rem_usec / USEC_PER_MSEC));
+}
+
+#ifdef DHD_LOG_DUMP
+static int
+dhd_statlog_dump(dhd_statlog_t *statlog, char *buf, uint32 buflen)
+{
+       stat_elem_t *elem;
+       struct bcmstrbuf b;
+       struct bcmstrbuf *strbuf = &b;
+       char stat_str[DHD_STATLOG_STATSTR_BUF_LEN];
+       char ts_str[DHD_STATLOG_TZFMT_BUF_LEN];
+       uint64 sec = 0, usec = 0;
+
+       if (!statlog) {
+               DHD_STATLOG_ERR(("%s: statlog is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       bcm_binit(strbuf, buf, buflen);
+       bzero(stat_str, sizeof(stat_str));
+       bzero(ts_str, sizeof(ts_str));
+       dhd_ring_whole_lock(statlog->ringbuf);
+       elem = (stat_elem_t *)dhd_ring_get_first(statlog->ringbuf);
+       while (elem) {
+               if (DHD_STATLOG_VALID(elem->stat)) {
+                       dhd_statlog_stat_name(stat_str, sizeof(stat_str),
+                               elem->stat, elem->dir);
+                       dhd_statlog_get_timestamp(elem, &sec, &usec);
+                       dhd_statlog_convert_time(elem, ts_str, sizeof(ts_str));
+                       bcm_bprintf(strbuf, "[%s][%5lu.%06lu] status=%s, ifidx=%d, "
+                               "reason=%d, status=%d\n", ts_str, (unsigned long)sec,
+                               (unsigned long)usec, stat_str, elem->ifidx,
+                               elem->reason, elem->status);
+               }
+               elem = (stat_elem_t *)dhd_ring_get_next(statlog->ringbuf, (void *)elem);
+       }
+       dhd_ring_whole_unlock(statlog->ringbuf);
+
+       return (!strbuf->size ? BCME_BUFTOOSHORT : strbuf->size);
+}
+
+int
+dhd_statlog_write_logdump(dhd_pub_t *dhdp, const void *user_buf,
+       void *fp, uint32 len, unsigned long *pos)
+{
+       dhd_statlog_t *statlog;
+       log_dump_section_hdr_t sec_hdr;
+       char *buf;
+       uint32 buflen;
+       int remain_len = 0;
+       int ret = BCME_OK;
+
+       if (!dhdp || !dhdp->statlog) {
+               DHD_STATLOG_ERR(("%s: dhdp or dhdp->statlog is NULL\n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       statlog = (dhd_statlog_t *)(dhdp->statlog);
+       if (!statlog->logbuf) {
+               DHD_STATLOG_ERR(("%s: logbuf is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       buf = statlog->logbuf;
+       buflen = statlog->logbuf_len;
+       bzero(buf, buflen);
+
+       remain_len = dhd_statlog_dump(statlog, buf, buflen);
+       if (remain_len < 0) {
+               DHD_STATLOG_ERR(("%s: failed to write stat info to buffer\n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       DHD_STATLOG_INFO(("%s: Start to write statlog\n", __FUNCTION__));
+
+       /* write the section header first */
+       ret = dhd_export_debug_data(STATUS_LOG_HDR, fp, user_buf,
+               strlen(STATUS_LOG_HDR), pos);
+       if (ret < 0) {
+               goto exit;
+       }
+
+       dhd_init_sec_hdr(&sec_hdr);
+       sec_hdr.type = LOG_DUMP_SECTION_STATUS;
+       sec_hdr.length = buflen - remain_len;
+       ret = dhd_export_debug_data((char *)&sec_hdr, fp, user_buf,
+               sizeof(sec_hdr), pos);
+       if (ret < 0) {
+               goto exit;
+       }
+
+       /* write status log info */
+       ret = dhd_export_debug_data(buf, fp, user_buf, buflen - remain_len, pos);
+       if (ret < 0) {
+               DHD_STATLOG_ERR(("%s: failed to write stat info, err=%d\n",
+                       __FUNCTION__, ret));
+       }
+
+       DHD_STATLOG_INFO(("%s: Complete to write statlog file, err=%d\n",
+               __FUNCTION__, ret));
+
+exit:
+       return ret;
+}
+#endif /* DHD_LOG_DUMP */
+
+int
+dhd_statlog_generate_bdmask(dhd_pub_t *dhdp, void *reqbuf)
+{
+       dhd_statlog_t *statlog;
+       stat_bdmask_req_t *query;
+       uint8 *req_buf;
+       uint32 req_buf_len;
+       int cnt;
+
+       if (!dhdp || !dhdp->statlog) {
+               DHD_STATLOG_ERR(("%s: dhdp or statlog is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (!reqbuf) {
+               DHD_STATLOG_ERR(("%s: invalid query\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       statlog = dhdp->statlog;
+       query = (stat_bdmask_req_t *)reqbuf;
+       req_buf = query->req_buf;
+       req_buf_len = query->req_buf_len;
+       if (!req_buf) {
+               DHD_STATLOG_ERR(("%s: invalid query\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       bzero(statlog->bdmask, DHD_STAT_BDMASK_SIZE);
+       for (cnt = 0; cnt < req_buf_len; cnt++) {
+               if (DHD_STATLOG_VALID(req_buf[cnt])) {
+                       setbit(statlog->bdmask, req_buf[cnt]);
+               }
+       }
+
+       return BCME_OK;
+}
+
+int
+dhd_statlog_get_latest_info(dhd_pub_t *dhdp, void *reqbuf)
+{
+       dhd_statlog_t *statlog;
+       stat_query_t *query;
+       stat_elem_t *elem;
+       uint8 *req_buf, *resp_buf, *sp;
+       uint32 req_buf_len, resp_buf_len, req_num;
+       int i, remain_len, cpcnt = 0;
+       uint8 filter[DHD_STAT_BDMASK_SIZE];
+       bool query_bigdata = FALSE;
+       void *ringbuf;
+
+       if (!dhdp || !dhdp->statlog) {
+               DHD_STATLOG_ERR(("%s: dhdp or statlog is NULL\n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       query = (stat_query_t *)reqbuf;
+       if (!query) {
+               DHD_STATLOG_ERR(("%s: invalid query\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       statlog = (dhd_statlog_t *)(dhdp->statlog);
+       req_buf = query->req_buf;
+       req_buf_len = query->req_buf_len;
+       resp_buf = query->resp_buf;
+       resp_buf_len = query->resp_buf_len;
+       req_num = MIN(query->req_num, MAX_STATLOG_REQ_ITEM);
+       if (!resp_buf) {
+               DHD_STATLOG_ERR(("%s: invalid query\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       bzero(filter, sizeof(filter));
+       if (!req_buf || !req_buf_len) {
+               query_bigdata = TRUE;
+               ringbuf = statlog->bdlog_ringbuf;
+       } else {
+               ringbuf = statlog->ringbuf;
+               /* build a filter from req_buf */
+               for (i = 0; i < req_buf_len; i++) {
+                       if (DHD_STATLOG_VALID(req_buf[i])) {
+                               setbit(filter, req_buf[i]);
+                       }
+               }
+       }
+
+       sp = resp_buf;
+       remain_len = resp_buf_len;
+       dhd_ring_whole_lock(ringbuf);
+       elem = (stat_elem_t *)dhd_ring_get_last(ringbuf);
+       while (elem) {
+               if (query_bigdata || isset(filter, elem->stat)) {
+                       /* found the status from the list of interests */
+                       if (remain_len < sizeof(stat_elem_t)) {
+                               dhd_ring_whole_unlock(ringbuf);
+                               return BCME_BUFTOOSHORT;
+                       }
+                       bcopy((char *)elem, sp, sizeof(stat_elem_t));
+                       sp += sizeof(stat_elem_t);
+                       remain_len -= sizeof(stat_elem_t);
+                       cpcnt++;
+               }
+
+               if (cpcnt >= req_num) {
+                       break;
+               }
+
+               /* Proceed to next item */
+               elem = (stat_elem_t *)dhd_ring_get_prev(ringbuf, (void *)elem);
+       }
+       dhd_ring_whole_unlock(ringbuf);
+
+       return cpcnt;
+}
+
+int
+dhd_statlog_query(dhd_pub_t *dhdp, char *cmd, int total_len)
+{
+       stat_elem_t *elem = NULL;
+       stat_query_t query;
+       char *pos, *token;
+       uint8 *req_buf = NULL, *resp_buf = NULL;
+       uint32 req_buf_len = 0, resp_buf_len = 0;
+       ulong req_num, stat_num, stat;
+       char stat_str[DHD_STATLOG_STATSTR_BUF_LEN];
+       uint64 sec = 0, usec = 0;
+       int i, resp_num, err = BCME_OK;
+       char ts_str[DHD_STATLOG_TZFMT_BUF_LEN];
+
+       /*
+        * DRIVER QUERY_STAT_LOG <total req num> <stat list num> <stat list>
+        * Note: use the defult status list if the 'stat list num' is zero
+        */
+       pos = cmd;
+       /* drop command */
+       token = bcmstrtok(&pos, " ", NULL);
+       /* total number of request */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               err = BCME_BADARG;
+               goto exit;
+       }
+
+       req_num = bcm_strtoul(token, NULL, 0);
+
+       /* total number of status list */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               err = BCME_BADARG;
+               goto exit;
+       }
+
+       stat_num = bcm_strtoul(token, NULL, 0);
+       if (stat_num) {
+               /* create a status list */
+               req_buf_len = (uint32)(stat_num * sizeof(uint8));
+               req_buf = (uint8 *)MALLOCZ(dhdp->osh, req_buf_len);
+               if (!req_buf) {
+                       DHD_STATLOG_ERR(("%s: failed to allocate request buf\n",
+                               __FUNCTION__));
+                       err = BCME_NOMEM;
+                       goto exit;
+               }
+
+               /* parse the status list and update to the request buffer */
+               for (i = 0; i < (uint32)stat_num; i++) {
+                       token = bcmstrtok(&pos, " ", NULL);
+                       if (!token) {
+                               err = BCME_BADARG;
+                               goto exit;
+                       }
+                       stat = bcm_strtoul(token, NULL, 0);
+                       req_buf[i] = (uint8)stat;
+               }
+       }
+
+       /* creat a response list */
+       resp_buf_len = (uint32)DHD_STATLOG_RING_SIZE(req_num);
+       resp_buf = (uint8 *)MALLOCZ(dhdp->osh, resp_buf_len);
+       if (!resp_buf) {
+               DHD_STATLOG_ERR(("%s: failed to allocate response buf\n",
+                       __FUNCTION__));
+               err = BCME_NOMEM;
+               goto exit;
+       }
+
+       /* create query format and query the status */
+       query.req_buf = req_buf;
+       query.req_buf_len = req_buf_len;
+       query.resp_buf = resp_buf;
+       query.resp_buf_len = resp_buf_len;
+       query.req_num = (uint32)req_num;
+       resp_num = dhd_statlog_get_latest_info(dhdp, (void *)&query);
+       if (resp_num < 0) {
+               DHD_STATLOG_ERR(("%s: failed to query the status\n", __FUNCTION__));
+               err = BCME_ERROR;
+               goto exit;
+       }
+
+       /* print out the results */
+       DHD_STATLOG_PRINT(("=============== QUERY RESULT ===============\n"));
+       if (resp_num > 0) {
+               elem = (stat_elem_t *)resp_buf;
+               for (i = 0; i < resp_num; i++) {
+                       if (DHD_STATLOG_VALID(elem->stat)) {
+                               dhd_statlog_stat_name(stat_str, sizeof(stat_str),
+                                       elem->stat, elem->dir);
+                               dhd_statlog_get_timestamp(elem, &sec, &usec);
+                               dhd_statlog_convert_time(elem, ts_str, sizeof(ts_str));
+                               DHD_STATLOG_PRINT(("[RAWTS:%llu][%s][%5lu.%06lu] status=%s,"
+                                       " ifidx=%d, reason=%d, status=%d\n", elem->ts_tz,
+                                       ts_str, (unsigned long)sec, (unsigned long)usec,
+                                       stat_str, elem->ifidx, elem->reason, elem->status));
+                       }
+                       elem++;
+               }
+       } else {
+               DHD_STATLOG_PRINT(("No data found\n"));
+       }
+
+exit:
+       if (resp_buf) {
+               MFREE(dhdp->osh, resp_buf, resp_buf_len);
+       }
+
+       if (req_buf) {
+               MFREE(dhdp->osh, req_buf, req_buf_len);
+       }
+
+       return err;
+}
+
+void
+dhd_statlog_dump_scr(dhd_pub_t *dhdp)
+{
+       dhd_statlog_t *statlog;
+       stat_elem_t *elem;
+       char stat_str[DHD_STATLOG_STATSTR_BUF_LEN];
+       char ts_str[DHD_STATLOG_TZFMT_BUF_LEN];
+       uint64 sec = 0, usec = 0;
+
+       if (!dhdp || !dhdp->statlog) {
+               DHD_STATLOG_ERR(("%s: dhdp or statlog is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       statlog = (dhd_statlog_t *)(dhdp->statlog);
+       bzero(stat_str, sizeof(stat_str));
+       bzero(ts_str, sizeof(ts_str));
+
+       DHD_STATLOG_PRINT(("=============== START OF CURRENT STATUS INFO ===============\n"));
+       dhd_ring_whole_lock(statlog->ringbuf);
+       elem = (stat_elem_t *)dhd_ring_get_first(statlog->ringbuf);
+       while (elem) {
+               if (DHD_STATLOG_VALID(elem->stat)) {
+                       dhd_statlog_stat_name(stat_str, sizeof(stat_str),
+                               elem->stat, elem->dir);
+                       dhd_statlog_get_timestamp(elem, &sec, &usec);
+                       dhd_statlog_convert_time(elem, ts_str, sizeof(ts_str));
+                       DHD_STATLOG_PRINT(("[RAWTS:%llu][%s][%5lu.%06lu] status=%s,"
+                               " ifidx=%d, reason=%d, status=%d\n", elem->ts_tz, ts_str,
+                               (unsigned long)sec, (unsigned long)usec, stat_str,
+                               elem->ifidx, elem->reason, elem->status));
+               }
+               elem = (stat_elem_t *)dhd_ring_get_next(statlog->ringbuf, (void *)elem);
+       }
+       dhd_ring_whole_unlock(statlog->ringbuf);
+       DHD_STATLOG_PRINT(("=============== END OF CURRENT STATUS INFO ===============\n"));
+}
+#endif /* DHD_STATUS_LOGGING */
diff --git a/bcmdhd.101.10.240.x/dhd_statlog.h b/bcmdhd.101.10.240.x/dhd_statlog.h
new file mode 100644 (file)
index 0000000..c6dc5cf
--- /dev/null
@@ -0,0 +1,221 @@
+/*
+ * DHD debugability: Header file for the Status Information Logging
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef __DHD_STATLOG_H_
+#define __DHD_STATLOG_H_
+
+#ifdef DHD_STATUS_LOGGING
+
+/* status element */
+typedef struct stat_elem {
+       uint16 stat;            /* store status */
+       uint64 ts;              /* local timestamp(ns) */
+       uint64 ts_tz;           /* timestamp applied timezone(us) */
+       uint8 ifidx;            /* ifidx */
+       uint8 dir;              /* direction (TX/RX) */
+       uint8 reason;           /* reason code from dongle */
+       uint8 status;           /* status code from dongle */
+       uint8 resv[2];          /* reserved for future use */
+} stat_elem_t;
+
+/* status logging info */
+#define DHD_STAT_BDMASK_SIZE   16
+typedef struct dhd_statlog {
+       uint8 *logbuf;          /* log buffer */
+       uint32 logbuf_len;      /* length of the log buffer */
+       void *ringbuf;          /* fixed ring buffer */
+       uint32 bufsize;         /* size of ring buffer */
+       void *bdlog_ringbuf;    /* fixed ring buffer for bigdata logging */
+       uint32 bdlog_bufsize;   /* size of ring buffer for bigdata logging */
+       uint8 bdmask[DHD_STAT_BDMASK_SIZE];     /* bitmask for bigdata */
+} dhd_statlog_t;
+
+/* status query format */
+typedef struct stat_query {
+       uint8 *req_buf;         /* request buffer to interested status */
+       uint32 req_buf_len;     /* length of the request buffer */
+       uint8 *resp_buf;        /* response buffer */
+       uint32 resp_buf_len;    /* length of the response buffer */
+       uint32 req_num;         /* total number of items to query */
+} stat_query_t;
+
+/* bitmask generation request format */
+typedef struct stat_bdmask_req {
+       uint8 *req_buf;         /* request buffer to gernerate bitmask */
+       uint32 req_buf_len;     /* length of the request buffer */
+} stat_bdmask_req_t;
+
+typedef void * dhd_statlog_handle_t; /* opaque handle to status log */
+
+/* enums */
+#define ST(x)                  STATE_## x
+#define STDIR(x)               STATE_DIR_## x
+
+/* status direction */
+typedef enum stat_log_dir {
+       STDIR(TX)               = 1,
+       STDIR(RX)               = 2,
+       STDIR(MAX)              = 3
+} stat_dir_t;
+
+/* status definition */
+typedef enum stat_log_stat {
+       ST(INVALID)             = 0,    /* invalid status */
+       ST(WLAN_POWER_ON)       = 1,    /* Wi-Fi Power on */
+       ST(WLAN_POWER_OFF)      = 2,    /* Wi-Fi Power off */
+       ST(ASSOC_START)         = 3,    /* connect to the AP triggered by upper layer */
+       ST(AUTH_DONE)           = 4,    /* complete to authenticate with the AP */
+       ST(ASSOC_REQ)           = 5,    /* send or receive Assoc Req */
+       ST(ASSOC_RESP)          = 6,    /* send or receive Assoc Resp */
+       ST(ASSOC_DONE)          = 7,    /* complete to disconnect to the associated AP */
+       ST(DISASSOC_START)      = 8,    /* disconnect to the associated AP by upper layer */
+       ST(DISASSOC_INT_START)  = 9,    /* initiate the disassoc by DHD */
+       ST(DISASSOC_DONE)       = 10,   /* complete to disconnect to the associated AP */
+       ST(DISASSOC)            = 11,   /* send or receive Disassoc */
+       ST(DEAUTH)              = 12,   /* send or receive Deauth */
+       ST(LINKDOWN)            = 13,   /* receive the link down event */
+       ST(REASSOC_START)       = 14,   /* reassoc the candidate AP */
+       ST(REASSOC_INFORM)      = 15,   /* inform reassoc completion to upper layer */
+       ST(REASSOC_DONE)        = 16,   /* complete to reassoc */
+       ST(EAPOL_M1)            = 17,   /* send or receive the EAPOL M1 */
+       ST(EAPOL_M2)            = 18,   /* send or receive the EAPOL M2 */
+       ST(EAPOL_M3)            = 19,   /* send or receive the EAPOL M3 */
+       ST(EAPOL_M4)            = 20,   /* send or receive the EAPOL M4 */
+       ST(EAPOL_GROUPKEY_M1)   = 21,   /* send or receive the EAPOL Group key handshake M1 */
+       ST(EAPOL_GROUPKEY_M2)   = 22,   /* send or receive the EAPOL Group key handshake M2 */
+       ST(EAP_REQ_IDENTITY)    = 23,   /* send or receive the EAP REQ IDENTITY */
+       ST(EAP_RESP_IDENTITY)   = 24,   /* send or receive the EAP RESP IDENTITY */
+       ST(EAP_REQ_TLS)         = 25,   /* send or receive the EAP REQ TLS */
+       ST(EAP_RESP_TLS)        = 26,   /* send or receive the EAP RESP TLS */
+       ST(EAP_REQ_LEAP)        = 27,   /* send or receive the EAP REQ LEAP */
+       ST(EAP_RESP_LEAP)       = 28,   /* send or receive the EAP RESP LEAP */
+       ST(EAP_REQ_TTLS)        = 29,   /* send or receive the EAP REQ TTLS */
+       ST(EAP_RESP_TTLS)       = 30,   /* send or receive the EAP RESP TTLS */
+       ST(EAP_REQ_AKA)         = 31,   /* send or receive the EAP REQ AKA */
+       ST(EAP_RESP_AKA)        = 32,   /* send or receive the EAP RESP AKA */
+       ST(EAP_REQ_PEAP)        = 33,   /* send or receive the EAP REQ PEAP */
+       ST(EAP_RESP_PEAP)       = 34,   /* send or receive the EAP RESP PEAP */
+       ST(EAP_REQ_FAST)        = 35,   /* send or receive the EAP REQ FAST */
+       ST(EAP_RESP_FAST)       = 36,   /* send or receive the EAP RESP FAST */
+       ST(EAP_REQ_PSK)         = 37,   /* send or receive the EAP REQ PSK */
+       ST(EAP_RESP_PSK)        = 38,   /* send or receive the EAP RESP PSK */
+       ST(EAP_REQ_AKAP)        = 39,   /* send or receive the EAP REQ AKAP */
+       ST(EAP_RESP_AKAP)       = 40,   /* send or receive the EAP RESP AKAP */
+       ST(EAP_SUCCESS)         = 41,   /* send or receive the EAP SUCCESS */
+       ST(EAP_FAILURE)         = 42,   /* send or receive the EAP FAILURE */
+       ST(EAPOL_START)         = 43,   /* send or receive the EAPOL-START */
+       ST(WSC_START)           = 44,   /* send or receive the WSC START */
+       ST(WSC_DONE)            = 45,   /* send or receive the WSC DONE */
+       ST(WPS_M1)              = 46,   /* send or receive the WPS M1 */
+       ST(WPS_M2)              = 47,   /* send or receive the WPS M2 */
+       ST(WPS_M3)              = 48,   /* send or receive the WPS M3 */
+       ST(WPS_M4)              = 49,   /* send or receive the WPS M4 */
+       ST(WPS_M5)              = 50,   /* send or receive the WPS M5 */
+       ST(WPS_M6)              = 51,   /* send or receive the WPS M6 */
+       ST(WPS_M7)              = 52,   /* send or receive the WPS M7 */
+       ST(WPS_M8)              = 53,   /* send or receive the WPS M8 */
+       ST(8021X_OTHER)         = 54,   /* send or receive the other 8021X frames */
+       ST(INSTALL_KEY)         = 55,   /* install the key */
+       ST(DELETE_KEY)          = 56,   /* remove the key */
+       ST(INSTALL_PMKSA)       = 57,   /* install PMKID information */
+       ST(INSTALL_OKC_PMK)     = 58,   /* install PMKID information for OKC */
+       ST(DHCP_DISCOVER)       = 59,   /* send or recv DHCP Discover */
+       ST(DHCP_OFFER)          = 60,   /* send or recv DHCP Offer */
+       ST(DHCP_REQUEST)        = 61,   /* send or recv DHCP Request */
+       ST(DHCP_DECLINE)        = 62,   /* send or recv DHCP Decline */
+       ST(DHCP_ACK)            = 63,   /* send or recv DHCP ACK */
+       ST(DHCP_NAK)            = 64,   /* send or recv DHCP NACK */
+       ST(DHCP_RELEASE)        = 65,   /* send or recv DHCP Release */
+       ST(DHCP_INFORM)         = 66,   /* send or recv DHCP Inform */
+       ST(ICMP_PING_REQ)       = 67,   /* send or recv ICMP PING Req */
+       ST(ICMP_PING_RESP)      = 68,   /* send or recv ICMP PING Resp */
+       ST(ICMP_DEST_UNREACH)   = 69,   /* send or recv ICMP DEST UNREACH message */
+       ST(ICMP_OTHER)          = 70,   /* send or recv other ICMP */
+       ST(ARP_REQ)             = 71,   /* send or recv ARP Req */
+       ST(ARP_RESP)            = 72,   /* send or recv ARP Resp */
+       ST(DNS_QUERY)           = 73,   /* send or recv DNS Query */
+       ST(DNS_RESP)            = 74,   /* send or recv DNS Resp */
+       ST(REASSOC_SUCCESS)     = 75,   /* reassociation success */
+       ST(REASSOC_FAILURE)     = 76,   /* reassociation failure */
+       ST(AUTH_TIMEOUT)        = 77,   /* authentication timeout */
+       ST(AUTH_FAIL)           = 78,   /* authentication failure */
+       ST(AUTH_NO_ACK)         = 79,   /* authentication failure due to no ACK */
+       ST(AUTH_OTHERS)         = 80,   /* authentication failure with other status */
+       ST(ASSOC_TIMEOUT)       = 81,   /* association timeout */
+       ST(ASSOC_FAIL)          = 82,   /* association failure */
+       ST(ASSOC_NO_ACK)        = 83,   /* association failure due to no ACK */
+       ST(ASSOC_ABORT)         = 84,   /* association abort */
+       ST(ASSOC_UNSOLICITED)   = 85,   /* association unsolicited */
+       ST(ASSOC_NO_NETWORKS)   = 86,   /* association failure due to no networks */
+       ST(ASSOC_OTHERS)        = 87,   /* association failure due to no networks */
+       ST(REASSOC_DONE_OTHERS) = 88,   /* complete to reassoc with other reason */
+       ST(MAX)                 = 89    /* Max Status */
+} stat_log_stat_t;
+
+/* functions */
+extern dhd_statlog_handle_t *dhd_attach_statlog(dhd_pub_t *dhdp, uint32 num_items,
+       uint32 bdlog_num_items, uint32 logbuf_len);
+extern void dhd_detach_statlog(dhd_pub_t *dhdp);
+extern int dhd_statlog_ring_log_data(dhd_pub_t *dhdp, uint16 stat, uint8 ifidx,
+       uint8 dir, bool cond);
+extern int dhd_statlog_ring_log_data_reason(dhd_pub_t *dhdp, uint16 stat,
+       uint8 ifidx, uint8 dir, uint16 reason);
+extern int dhd_statlog_ring_log_ctrl(dhd_pub_t *dhdp, uint16 stat, uint8 ifidx,
+       uint16 reason);
+extern int dhd_statlog_process_event(dhd_pub_t *dhdp, int type, uint8 ifidx,
+       uint16 status, uint16 reason, uint16 flags);
+extern int dhd_statlog_get_latest_info(dhd_pub_t *dhdp, void *reqbuf);
+extern void dhd_statlog_dump_scr(dhd_pub_t *dhdp);
+extern int dhd_statlog_query(dhd_pub_t *dhdp, char *cmd, int total_len);
+extern uint32 dhd_statlog_get_logbuf_len(dhd_pub_t *dhdp);
+extern void *dhd_statlog_get_logbuf(dhd_pub_t *dhdp);
+extern int dhd_statlog_generate_bdmask(dhd_pub_t *dhdp, void *reqbuf);
+#ifdef DHD_LOG_DUMP
+extern int dhd_statlog_write_logdump(dhd_pub_t *dhdp, const void *user_buf,
+       void *fp, uint32 len, unsigned long *pos);
+#endif /* DHD_LOG_DUMP */
+
+/* macros */
+#define MAX_STATLOG_ITEM               512
+#define MAX_STATLOG_REQ_ITEM           32
+#define STATLOG_LOGBUF_LEN             (64 * 1024)
+#define DHD_STATLOG_VERSION_V1         0x1
+#define DHD_STATLOG_VERSION            DHD_STATLOG_VERSION_V1
+#define        DHD_STATLOG_ITEM_SIZE           (sizeof(stat_elem_t))
+#define DHD_STATLOG_RING_SIZE(items)   ((items) * (DHD_STATLOG_ITEM_SIZE))
+#define DHD_STATLOG_STATSTR_BUF_LEN    32
+#define DHD_STATLOG_TZFMT_BUF_LEN      20
+#define DHD_STATLOG_TZFMT_YYMMDDHHMMSSMS       "%02d%02d%02d%02d%02d%02d%04d"
+
+#define DHD_STATLOG_CTRL(dhdp, stat, ifidx, reason)    \
+       dhd_statlog_ring_log_ctrl((dhdp), (stat), (ifidx), (reason))
+#define DHD_STATLOG_DATA(dhdp, stat, ifidx, dir, cond) \
+       dhd_statlog_ring_log_data((dhdp), (stat), (ifidx), (dir), (cond))
+#define DHD_STATLOG_DATA_RSN(dhdp, stat, ifidx, dir, reason) \
+       dhd_statlog_ring_log_data_reason((dhdp), (stat), (ifidx), \
+               (dir), (reason))
+
+#endif /* DHD_STATUS_LOGGING */
+#endif /* __DHD_STATLOG_H_ */
diff --git a/bcmdhd.101.10.240.x/dhd_wlfc.c b/bcmdhd.101.10.240.x/dhd_wlfc.c
new file mode 100644 (file)
index 0000000..ab87935
--- /dev/null
@@ -0,0 +1,4626 @@
+/*
+ * DHD PROP_TXSTATUS Module.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ *
+ */
+
+/** XXX Twiki [PropTxStatus] */
+
+#include <typedefs.h>
+#include <osl.h>
+
+#include <bcmutils.h>
+#include <bcmendian.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+
+#include <dhd_bus.h>
+
+#include <dhd_dbg.h>
+#include <dhd_config.h>
+#include <wl_android.h>
+
+#ifdef PROP_TXSTATUS /* a form of flow control between host and dongle */
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+
+#ifdef DHDTCPACK_SUPPRESS
+#include <dhd_ip.h>
+#endif /* DHDTCPACK_SUPPRESS */
+
+/*
+ * wlfc naming and lock rules:
+ *
+ * 1. Private functions name like _dhd_wlfc_XXX, declared as static and avoid wlfc lock operation.
+ * 2. Public functions name like dhd_wlfc_XXX, use wlfc lock if needed.
+ * 3. Non-Proptxstatus module call public functions only and avoid wlfc lock operation.
+ *
+ */
+
+#if defined(DHD_WLFC_THREAD)
+#define WLFC_THREAD_QUICK_RETRY_WAIT_MS    10      /* 10 msec */
+#define WLFC_THREAD_RETRY_WAIT_MS          10000   /* 10 sec */
+#endif /* defined (DHD_WLFC_THREAD) */
+
+#ifdef PROP_TXSTATUS
+
+#define DHD_WLFC_QMON_COMPLETE(entry)
+
+/** reordering related */
+
+#if defined(DHD_WLFC_THREAD)
+static void
+_dhd_wlfc_thread_wakeup(dhd_pub_t *dhdp)
+{
+       dhdp->wlfc_thread_go = TRUE;
+       wake_up_interruptible(&dhdp->wlfc_wqhead);
+}
+#endif /* DHD_WLFC_THREAD */
+
+static uint16
+_dhd_wlfc_adjusted_seq(void* p, uint8 current_seq)
+{
+       uint16 seq;
+
+       if (!p) {
+               return 0xffff;
+       }
+
+       seq = WL_TXSTATUS_GET_FREERUNCTR(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+       if (seq < current_seq) {
+               /* wrap around */
+               seq += 256;
+       }
+
+       return seq;
+}
+
+/**
+ * Enqueue a caller supplied packet on a caller supplied precedence queue, optionally reorder
+ * suppressed packets.
+ *    @param[in] pq       caller supplied packet queue to enqueue the packet on
+ *    @param[in] prec     precedence of the to-be-queued packet
+ *    @param[in] p        transmit packet to enqueue
+ *    @param[in] qHead    if TRUE, enqueue to head instead of tail. Used to maintain d11 seq order.
+ *    @param[in] current_seq
+ *    @param[in] reOrder  reOrder on odd precedence (=suppress queue)
+ */
+static void
+_dhd_wlfc_prec_enque(struct pktq *pq, int prec, void* p, bool qHead,
+       uint8 current_seq, bool reOrder)
+{
+       struct pktq_prec *q;
+       uint16 seq, seq2;
+       void *p2, *p2_prev;
+
+       if (!p)
+               return;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+       ASSERT(PKTLINK(p) == NULL);             /* queueing chains not allowed */
+
+       ASSERT(!pktq_full(pq));
+       ASSERT(!pktqprec_full(pq, prec));
+
+       q = &pq->q[prec];
+
+       if (q->head == NULL) {
+               /* empty queue */
+               q->head = p;
+               q->tail = p;
+       } else {
+               if (reOrder && (prec & 1)) {
+                       seq = _dhd_wlfc_adjusted_seq(p, current_seq);
+                       p2 = qHead ? q->head : q->tail;
+                       seq2 = _dhd_wlfc_adjusted_seq(p2, current_seq);
+
+                       if ((qHead &&((seq+1) > seq2)) || (!qHead && ((seq2+1) > seq))) {
+                               /* need reorder */
+                               p2 = q->head;
+                               p2_prev = NULL;
+                               seq2 = _dhd_wlfc_adjusted_seq(p2, current_seq);
+
+                               while (seq > seq2) {
+                                       p2_prev = p2;
+                                       p2 = PKTLINK(p2);
+                                       if (!p2) {
+                                               break;
+                                       }
+                                       seq2 = _dhd_wlfc_adjusted_seq(p2, current_seq);
+                               }
+
+                               if (p2_prev == NULL) {
+                                       /* insert head */
+                                       PKTSETLINK(p, q->head);
+                                       q->head = p;
+                               } else if (p2 == NULL) {
+                                       /* insert tail */
+                                       PKTSETLINK(p2_prev, p);
+                                       q->tail = p;
+                               } else {
+                                       /* insert after p2_prev */
+                                       PKTSETLINK(p, PKTLINK(p2_prev));
+                                       PKTSETLINK(p2_prev, p);
+                               }
+                               goto exit;
+                       }
+               }
+
+               if (qHead) {
+                       PKTSETLINK(p, q->head);
+                       q->head = p;
+               } else {
+                       PKTSETLINK(q->tail, p);
+                       q->tail = p;
+               }
+       }
+
+exit:
+
+       q->n_pkts++;
+       pq->n_pkts_tot++;
+
+       if (pq->hi_prec < prec)
+               pq->hi_prec = (uint8)prec;
+} /* _dhd_wlfc_prec_enque */
+
+/**
+ * Create a place to store all packet pointers submitted to the firmware until a status comes back,
+ * suppress or otherwise.
+ *
+ * hang-er: noun, a contrivance on which things are hung, as a hook.
+ */
+/** @deprecated soon */
+static void*
+_dhd_wlfc_hanger_create(dhd_pub_t *dhd, int max_items)
+{
+       int i;
+       wlfc_hanger_t* hanger;
+
+       /* allow only up to a specific size for now */
+       ASSERT(max_items == WLFC_HANGER_MAXITEMS);
+
+       if ((hanger = (wlfc_hanger_t*)DHD_OS_PREALLOC(dhd, DHD_PREALLOC_DHD_WLFC_HANGER,
+               WLFC_HANGER_SIZE(max_items))) == NULL) {
+               return NULL;
+       }
+       memset(hanger, 0, WLFC_HANGER_SIZE(max_items));
+       hanger->max_items = max_items;
+
+       for (i = 0; i < hanger->max_items; i++) {
+               hanger->items[i].state = WLFC_HANGER_ITEM_STATE_FREE;
+       }
+       return hanger;
+}
+
+/** @deprecated soon */
+static int
+_dhd_wlfc_hanger_delete(dhd_pub_t *dhd, void* hanger)
+{
+       wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+       if (h) {
+               DHD_OS_PREFREE(dhd, h, WLFC_HANGER_SIZE(h->max_items));
+               return BCME_OK;
+       }
+       return BCME_BADARG;
+}
+
+/** @deprecated soon */
+static uint16
+_dhd_wlfc_hanger_get_free_slot(void* hanger)
+{
+       uint32 i;
+       wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+       if (h) {
+               i = h->slot_pos + 1;
+               if (i == h->max_items) {
+                       i = 0;
+               }
+               while (i != h->slot_pos) {
+                       if (h->items[i].state == WLFC_HANGER_ITEM_STATE_FREE) {
+                               h->slot_pos = i;
+                               return (uint16)i;
+                       }
+                       i++;
+                       if (i == h->max_items)
+                               i = 0;
+               }
+               h->failed_slotfind++;
+       }
+       return WLFC_HANGER_MAXITEMS;
+}
+
+/** @deprecated soon */
+static int
+_dhd_wlfc_hanger_get_genbit(void* hanger, void* pkt, uint32 slot_id, int* gen)
+{
+       int rc = BCME_OK;
+       wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+       *gen = 0xff;
+
+       /* this packet was not pushed at the time it went to the firmware */
+       if (slot_id == WLFC_HANGER_MAXITEMS)
+               return BCME_NOTFOUND;
+
+       if (h) {
+               if (h->items[slot_id].state != WLFC_HANGER_ITEM_STATE_FREE) {
+                       *gen = h->items[slot_id].gen;
+               }
+               else {
+                       DHD_ERROR(("Error: %s():%d item not used\n",
+                               __FUNCTION__, __LINE__));
+                       rc = BCME_NOTFOUND;
+               }
+
+       } else {
+               rc = BCME_BADARG;
+       }
+
+       return rc;
+}
+
+/** @deprecated soon */
+static int
+_dhd_wlfc_hanger_pushpkt(void* hanger, void* pkt, uint32 slot_id)
+{
+       int rc = BCME_OK;
+       wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+       if (h && (slot_id < WLFC_HANGER_MAXITEMS)) {
+               if (h->items[slot_id].state == WLFC_HANGER_ITEM_STATE_FREE) {
+                       h->items[slot_id].state = WLFC_HANGER_ITEM_STATE_INUSE;
+                       h->items[slot_id].pkt = pkt;
+                       h->items[slot_id].pkt_state = 0;
+                       h->items[slot_id].pkt_txstatus = 0;
+                       h->pushed++;
+               } else {
+                       h->failed_to_push++;
+                       rc = BCME_NOTFOUND;
+               }
+       } else {
+               rc = BCME_BADARG;
+       }
+
+       return rc;
+}
+
+/** @deprecated soon */
+static int
+_dhd_wlfc_hanger_poppkt(void* hanger, uint32 slot_id, void** pktout, bool remove_from_hanger)
+{
+       int rc = BCME_OK;
+       wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+       *pktout = NULL;
+
+       /* this packet was not pushed at the time it went to the firmware */
+       if (slot_id == WLFC_HANGER_MAXITEMS)
+               return BCME_NOTFOUND;
+
+       if (h) {
+               if (h->items[slot_id].state != WLFC_HANGER_ITEM_STATE_FREE) {
+                       *pktout = h->items[slot_id].pkt;
+                       if (remove_from_hanger) {
+                               h->items[slot_id].state =
+                                       WLFC_HANGER_ITEM_STATE_FREE;
+                               h->items[slot_id].pkt = NULL;
+                               h->items[slot_id].gen = 0xff;
+                               h->items[slot_id].identifier = 0;
+                               h->popped++;
+                       }
+               } else {
+                       h->failed_to_pop++;
+                       rc = BCME_NOTFOUND;
+               }
+       } else {
+               rc = BCME_BADARG;
+       }
+
+       return rc;
+}
+
+/** @deprecated soon */
+static int
+_dhd_wlfc_hanger_mark_suppressed(void* hanger, uint32 slot_id, uint8 gen)
+{
+       int rc = BCME_OK;
+       wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+       /* this packet was not pushed at the time it went to the firmware */
+       if (slot_id == WLFC_HANGER_MAXITEMS)
+               return BCME_NOTFOUND;
+       if (h) {
+               h->items[slot_id].gen = gen;
+               if (h->items[slot_id].state == WLFC_HANGER_ITEM_STATE_INUSE) {
+                       h->items[slot_id].state = WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED;
+               } else {
+                       rc = BCME_BADARG;
+               }
+       } else {
+               rc = BCME_BADARG;
+       }
+
+       return rc;
+}
+
+/** remove reference of specific packet in hanger */
+/** @deprecated soon */
+static bool
+_dhd_wlfc_hanger_remove_reference(wlfc_hanger_t* h, void* pkt)
+{
+       int i;
+
+       if (!h || !pkt) {
+               return FALSE;
+       }
+
+       i = WL_TXSTATUS_GET_HSLOT(DHD_PKTTAG_H2DTAG(PKTTAG(pkt)));
+
+       if ((i < h->max_items) && (pkt == h->items[i].pkt)) {
+               if (h->items[i].state == WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED) {
+                       h->items[i].state = WLFC_HANGER_ITEM_STATE_FREE;
+                       h->items[i].pkt = NULL;
+                       h->items[i].gen = 0xff;
+                       h->items[i].identifier = 0;
+                       return TRUE;
+               } else {
+                       DHD_ERROR(("Error: %s():%d item not suppressed\n",
+                               __FUNCTION__, __LINE__));
+               }
+       }
+
+       return FALSE;
+}
+
+/** afq = At Firmware Queue, queue containing packets pending in the dongle */
+static int
+_dhd_wlfc_enque_afq(athost_wl_status_info_t* ctx, void *p)
+{
+       wlfc_mac_descriptor_t* entry;
+       uint16 entry_idx = WL_TXSTATUS_GET_HSLOT(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+       uint8 prec = DHD_PKTTAG_FIFO(PKTTAG(p));
+
+       if (entry_idx < WLFC_MAC_DESC_TABLE_SIZE)
+               entry  = &ctx->destination_entries.nodes[entry_idx];
+       else if (entry_idx < (WLFC_MAC_DESC_TABLE_SIZE + WLFC_MAX_IFNUM))
+               entry = &ctx->destination_entries.interfaces[entry_idx - WLFC_MAC_DESC_TABLE_SIZE];
+       else
+               entry = &ctx->destination_entries.other;
+
+       pktq_penq(&entry->afq, prec, p);
+
+       return BCME_OK;
+}
+
+/** afq = At Firmware Queue, queue containing packets pending in the dongle */
+static int
+_dhd_wlfc_deque_afq(athost_wl_status_info_t* ctx, uint16 hslot, uint8 hcnt, uint8 prec,
+       void **pktout)
+{
+       wlfc_mac_descriptor_t *entry;
+       struct pktq *pq;
+       struct pktq_prec *q;
+       void *p, *b;
+
+       if (!ctx) {
+               DHD_ERROR(("%s: ctx(%p), pktout(%p)\n", __FUNCTION__, ctx, pktout));
+               return BCME_BADARG;
+       }
+
+       if (pktout) {
+               *pktout = NULL;
+       }
+
+       ASSERT(hslot < (WLFC_MAC_DESC_TABLE_SIZE + WLFC_MAX_IFNUM + 1));
+
+       if (hslot < WLFC_MAC_DESC_TABLE_SIZE)
+               entry  = &ctx->destination_entries.nodes[hslot];
+       else if (hslot < (WLFC_MAC_DESC_TABLE_SIZE + WLFC_MAX_IFNUM))
+               entry = &ctx->destination_entries.interfaces[hslot - WLFC_MAC_DESC_TABLE_SIZE];
+       else
+               entry = &ctx->destination_entries.other;
+
+       pq = &entry->afq;
+
+       ASSERT(prec < pq->num_prec);
+
+       q = &pq->q[prec];
+
+       b = NULL;
+       p = q->head;
+
+       while (p && (hcnt != WL_TXSTATUS_GET_FREERUNCTR(DHD_PKTTAG_H2DTAG(PKTTAG(p)))))
+       {
+               b = p;
+               p = PKTLINK(p);
+       }
+
+       if (p == NULL) {
+               /* none is matched */
+               if (b) {
+                       DHD_ERROR(("%s: can't find matching seq(%d)\n", __FUNCTION__, hcnt));
+               } else {
+                       DHD_ERROR(("%s: queue is empty\n", __FUNCTION__));
+               }
+
+               return BCME_ERROR;
+       }
+
+       bcm_pkt_validate_chk(p, "_dhd_wlfc_deque_afq");
+
+       if (!b) {
+               /* head packet is matched */
+               if ((q->head = PKTLINK(p)) == NULL) {
+                       q->tail = NULL;
+               }
+       } else {
+               /* middle packet is matched */
+               DHD_INFO(("%s: out of order, seq(%d), head_seq(%d)\n", __FUNCTION__, hcnt,
+                       WL_TXSTATUS_GET_FREERUNCTR(DHD_PKTTAG_H2DTAG(PKTTAG(q->head)))));
+               ctx->stats.ooo_pkts[prec]++;
+               PKTSETLINK(b, PKTLINK(p));
+               if (PKTLINK(p) == NULL) {
+                       q->tail = b;
+               }
+       }
+
+       q->n_pkts--;
+       pq->n_pkts_tot--;
+
+#ifdef WL_TXQ_STALL
+       q->dequeue_count++;
+#endif
+
+       PKTSETLINK(p, NULL);
+
+       if (pktout) {
+               *pktout = p;
+       }
+
+       return BCME_OK;
+} /* _dhd_wlfc_deque_afq */
+
+/**
+ * Flow control information piggy backs on packets, in the form of one or more TLVs. This function
+ * pushes one or more TLVs onto a packet that is going to be sent towards the dongle.
+ *
+ *     @param[in]     ctx
+ *     @param[in/out] packet
+ *     @param[in]     tim_signal TRUE if parameter 'tim_bmp' is valid
+ *     @param[in]     tim_bmp
+ *     @param[in]     mac_handle
+ *     @param[in]     htodtag
+ *     @param[in]     htodseq d11 seqno for seqno reuse, only used if 'seq reuse' was agreed upon
+ *                    earlier between host and firmware.
+ *     @param[in]     skip_wlfc_hdr
+ */
+static int
+_dhd_wlfc_pushheader(athost_wl_status_info_t* ctx, void** packet, bool tim_signal,
+       uint8 tim_bmp, uint8 mac_handle, uint32 htodtag, uint16 htodseq, bool skip_wlfc_hdr)
+{
+       uint32 wl_pktinfo = 0;
+       uint8* wlh;
+       uint8 dataOffset = 0;
+       uint8 fillers;
+       uint8 tim_signal_len = 0;
+       dhd_pub_t *dhdp = (dhd_pub_t *)ctx->dhdp;
+
+       struct bdc_header *h;
+       void *p = *packet;
+
+       if (skip_wlfc_hdr)
+               goto push_bdc_hdr;
+
+       if (tim_signal) {
+               tim_signal_len = TLV_HDR_LEN + WLFC_CTL_VALUE_LEN_PENDING_TRAFFIC_BMP;
+       }
+
+       /* +2 is for Type[1] and Len[1] in TLV, plus TIM signal */
+       dataOffset = WLFC_CTL_VALUE_LEN_PKTTAG + TLV_HDR_LEN + tim_signal_len;
+       if (WLFC_GET_REUSESEQ(dhdp->wlfc_mode)) {
+               dataOffset += WLFC_CTL_VALUE_LEN_SEQ;
+       }
+
+       fillers = ROUNDUP(dataOffset, 4) - dataOffset;
+       dataOffset += fillers;
+
+       PKTPUSH(ctx->osh, p, dataOffset);
+       wlh = (uint8*) PKTDATA(ctx->osh, p);
+
+       wl_pktinfo = htol32(htodtag);
+
+       wlh[TLV_TAG_OFF] = WLFC_CTL_TYPE_PKTTAG;
+       wlh[TLV_LEN_OFF] = WLFC_CTL_VALUE_LEN_PKTTAG;
+       memcpy(&wlh[TLV_HDR_LEN] /* dst */, &wl_pktinfo, sizeof(uint32));
+
+       if (WLFC_GET_REUSESEQ(dhdp->wlfc_mode)) {
+               uint16 wl_seqinfo = htol16(htodseq);
+               wlh[TLV_LEN_OFF] += WLFC_CTL_VALUE_LEN_SEQ;
+               memcpy(&wlh[TLV_HDR_LEN + WLFC_CTL_VALUE_LEN_PKTTAG], &wl_seqinfo,
+                       WLFC_CTL_VALUE_LEN_SEQ);
+       }
+
+       if (tim_signal_len) {
+               wlh[dataOffset - fillers - tim_signal_len ] =
+                       WLFC_CTL_TYPE_PENDING_TRAFFIC_BMP;
+               wlh[dataOffset - fillers - tim_signal_len + 1] =
+                       WLFC_CTL_VALUE_LEN_PENDING_TRAFFIC_BMP;
+               wlh[dataOffset - fillers - tim_signal_len + 2] = mac_handle;
+               wlh[dataOffset - fillers - tim_signal_len + 3] = tim_bmp;
+       }
+       if (fillers)
+               memset(&wlh[dataOffset - fillers], WLFC_CTL_TYPE_FILLER, fillers);
+
+push_bdc_hdr:
+       PKTPUSH(ctx->osh, p, BDC_HEADER_LEN);
+       h = (struct bdc_header *)PKTDATA(ctx->osh, p);
+       h->flags = (BDC_PROTO_VER << BDC_FLAG_VER_SHIFT);
+       if (PKTSUMNEEDED(p))
+               h->flags |= BDC_FLAG_SUM_NEEDED;
+
+       h->priority = (PKTPRIO(p) & BDC_PRIORITY_MASK);
+       h->flags2 = 0;
+       h->dataOffset = dataOffset >> 2;
+       BDC_SET_IF_IDX(h, DHD_PKTTAG_IF(PKTTAG(p)));
+       *packet = p;
+       return BCME_OK;
+} /* _dhd_wlfc_pushheader */
+
+/**
+ * Removes (PULLs) flow control related headers from the caller supplied packet, is invoked eg
+ * when a packet is about to be freed.
+ */
+static int
+_dhd_wlfc_pullheader(athost_wl_status_info_t* ctx, void* pktbuf)
+{
+       struct bdc_header *h;
+
+       if (PKTLEN(ctx->osh, pktbuf) < BDC_HEADER_LEN) {
+               DHD_ERROR(("%s: rx data too short (%d < %d)\n", __FUNCTION__,
+                          PKTLEN(ctx->osh, pktbuf), BDC_HEADER_LEN));
+               return BCME_ERROR;
+       }
+       h = (struct bdc_header *)PKTDATA(ctx->osh, pktbuf);
+
+       /* pull BDC header */
+       PKTPULL(ctx->osh, pktbuf, BDC_HEADER_LEN);
+
+       if (PKTLEN(ctx->osh, pktbuf) < (uint)(h->dataOffset << 2)) {
+               DHD_ERROR(("%s: rx data too short (%d < %d)\n", __FUNCTION__,
+                          PKTLEN(ctx->osh, pktbuf), (h->dataOffset << 2)));
+               return BCME_ERROR;
+       }
+
+       /* pull wl-header */
+       PKTPULL(ctx->osh, pktbuf, (h->dataOffset << 2));
+       return BCME_OK;
+}
+
+/**
+ * @param[in/out] p packet
+ */
+static wlfc_mac_descriptor_t*
+_dhd_wlfc_find_table_entry(athost_wl_status_info_t* ctx, void* p)
+{
+       int i;
+       wlfc_mac_descriptor_t* table = ctx->destination_entries.nodes;
+       uint8 ifid = DHD_PKTTAG_IF(PKTTAG(p));
+       uint8* dstn = DHD_PKTTAG_DSTN(PKTTAG(p));
+       wlfc_mac_descriptor_t* entry = DHD_PKTTAG_ENTRY(PKTTAG(p));
+       int iftype = ctx->destination_entries.interfaces[ifid].iftype;
+
+       /* saved one exists, return it */
+       if (entry)
+               return entry;
+
+       /* Multicast destination, STA and P2P clients get the interface entry.
+        * STA/GC gets the Mac Entry for TDLS destinations, TDLS destinations
+        * have their own entry.
+        */
+       if ((iftype == WLC_E_IF_ROLE_STA || ETHER_ISMULTI(dstn) ||
+               iftype == WLC_E_IF_ROLE_P2P_CLIENT) &&
+               (ctx->destination_entries.interfaces[ifid].occupied)) {
+                       entry = &ctx->destination_entries.interfaces[ifid];
+       }
+
+       if (entry && ETHER_ISMULTI(dstn)) {
+               DHD_PKTTAG_SET_ENTRY(PKTTAG(p), entry);
+               return entry;
+       }
+
+       for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+               if (table[i].occupied) {
+                       if (table[i].interface_id == ifid) {
+                               if (!memcmp(table[i].ea, dstn, ETHER_ADDR_LEN)) {
+                                       entry = &table[i];
+                                       break;
+                               }
+                       }
+               }
+       }
+
+       if (entry == NULL)
+               entry = &ctx->destination_entries.other;
+
+       DHD_PKTTAG_SET_ENTRY(PKTTAG(p), entry);
+
+       return entry;
+} /* _dhd_wlfc_find_table_entry */
+
+/**
+ * In case a packet must be dropped (because eg the queues are full), various tallies have to be
+ * be updated. Called from several other functions.
+ *     @param[in] dhdp pointer to public DHD structure
+ *     @param[in] prec precedence of the packet
+ *     @param[in] p    the packet to be dropped
+ *     @param[in] bPktInQ TRUE if packet is part of a queue
+ */
+static int
+_dhd_wlfc_prec_drop(dhd_pub_t *dhdp, int prec, void* p, bool bPktInQ)
+{
+       athost_wl_status_info_t* ctx;
+       void *pout = NULL;
+
+       ASSERT(dhdp && p);
+       if (prec < 0 || prec >= WLFC_PSQ_PREC_COUNT) {
+               ASSERT(0);
+               return BCME_BADARG;
+       }
+
+       ctx = (athost_wl_status_info_t*)dhdp->wlfc_state;
+
+       if (!WLFC_GET_AFQ(dhdp->wlfc_mode) && (prec & 1)) {
+               /* suppressed queue, need pop from hanger */
+               _dhd_wlfc_hanger_poppkt(ctx->hanger, WL_TXSTATUS_GET_HSLOT(DHD_PKTTAG_H2DTAG
+                                       (PKTTAG(p))), &pout, TRUE);
+               ASSERT(p == pout);
+       }
+
+       if (!(prec & 1)) {
+#ifdef DHDTCPACK_SUPPRESS
+               /* pkt in delayed q, so fake push BDC header for
+                * dhd_tcpack_check_xmit() and dhd_txcomplete().
+                */
+               _dhd_wlfc_pushheader(ctx, &p, FALSE, 0, 0, 0, 0, TRUE);
+
+               /* This packet is about to be freed, so remove it from tcp_ack_info_tbl
+                * This must be one of...
+                * 1. A pkt already in delayQ is evicted by another pkt with higher precedence
+                * in _dhd_wlfc_prec_enq_with_drop()
+                * 2. A pkt could not be enqueued to delayQ because it is full,
+                * in _dhd_wlfc_enque_delayq().
+                * 3. A pkt could not be enqueued to delayQ because it is full,
+                * in _dhd_wlfc_rollback_packet_toq().
+                */
+               if (dhd_tcpack_check_xmit(dhdp, p) == BCME_ERROR) {
+                       DHD_ERROR(("%s %d: tcpack_suppress ERROR!!!"
+                               " Stop using it\n",
+                               __FUNCTION__, __LINE__));
+                       dhd_tcpack_suppress_set(dhdp, TCPACK_SUP_OFF);
+               }
+#endif /* DHDTCPACK_SUPPRESS */
+       }
+
+       if (bPktInQ) {
+               ctx->pkt_cnt_in_q[DHD_PKTTAG_IF(PKTTAG(p))][prec>>1]--;
+               ctx->pkt_cnt_per_ac[prec>>1]--;
+               ctx->pkt_cnt_in_psq--;
+       }
+
+       ctx->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(p))][DHD_PKTTAG_FIFO(PKTTAG(p))]--;
+       ctx->stats.pktout++;
+       ctx->stats.drop_pkts[prec]++;
+
+       dhd_txcomplete(dhdp, p, FALSE);
+       PKTFREE(ctx->osh, p, TRUE);
+
+       return 0;
+} /* _dhd_wlfc_prec_drop */
+
+/**
+ * Called when eg the host handed a new packet over to the driver, or when the dongle reported
+ * that a packet could currently not be transmitted (=suppressed). This function enqueues a transmit
+ * packet in the host driver to be (re)transmitted at a later opportunity.
+ *     @param[in] dhdp pointer to public DHD structure
+ *     @param[in] qHead When TRUE, queue packet at head instead of tail, to preserve d11 sequence
+ */
+static bool
+_dhd_wlfc_prec_enq_with_drop(dhd_pub_t *dhdp, struct pktq *pq, void *pkt, int prec, bool qHead,
+       uint8 current_seq)
+{
+       void *p = NULL;
+       int eprec = -1;         /* precedence to evict from */
+       athost_wl_status_info_t* ctx;
+
+       ASSERT(dhdp && pq && pkt);
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       ctx = (athost_wl_status_info_t*)dhdp->wlfc_state;
+
+       /* Fast case, precedence queue is not full and we are also not
+        * exceeding total queue length
+        */
+       if (!pktqprec_full(pq, prec) && !pktq_full(pq)) {
+               goto exit;
+       }
+
+       /* Determine precedence from which to evict packet, if any */
+       if (pktqprec_full(pq, prec)) {
+               eprec = prec;
+       } else if (pktq_full(pq)) {
+               p = pktq_peek_tail(pq, &eprec);
+               if (!p) {
+                       DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                       return FALSE;
+               }
+               if ((eprec > prec) || (eprec < 0)) {
+                       if (!pktqprec_empty(pq, prec)) {
+                               eprec = prec;
+                       } else {
+                               return FALSE;
+                       }
+               }
+       }
+
+       /* Evict if needed */
+       if (eprec >= 0) {
+               /* Detect queueing to unconfigured precedence */
+               ASSERT(!pktqprec_empty(pq, eprec));
+               /* Evict all fragmented frames */
+               dhd_prec_drop_pkts(dhdp, pq, eprec, _dhd_wlfc_prec_drop);
+       }
+
+exit:
+       /* Enqueue */
+       _dhd_wlfc_prec_enque(pq, prec, pkt, qHead, current_seq,
+               WLFC_GET_REORDERSUPP(dhdp->wlfc_mode));
+       ctx->pkt_cnt_in_q[DHD_PKTTAG_IF(PKTTAG(pkt))][prec>>1]++;
+       ctx->pkt_cnt_per_ac[prec>>1]++;
+       ctx->pkt_cnt_in_psq++;
+
+       return TRUE;
+} /* _dhd_wlfc_prec_enq_with_drop */
+
+/**
+ * Called during eg the 'committing' of a transmit packet from the OS layer to a lower layer, in
+ * the event that this 'commit' failed.
+ */
+static int
+_dhd_wlfc_rollback_packet_toq(athost_wl_status_info_t* ctx,
+       void* p, ewlfc_packet_state_t pkt_type, uint32 hslot)
+{
+       /*
+        * put the packet back to the head of queue
+        * - suppressed packet goes back to suppress sub-queue
+        * - pull out the header, if new or delayed packet
+        *
+        * Note: hslot is used only when header removal is done.
+        */
+       wlfc_mac_descriptor_t* entry;
+       int rc = BCME_OK;
+       int prec, fifo_id;
+
+       entry = _dhd_wlfc_find_table_entry(ctx, p);
+       prec = DHD_PKTTAG_FIFO(PKTTAG(p));
+       fifo_id = prec << 1;
+       if (pkt_type == eWLFC_PKTTYPE_SUPPRESSED)
+               fifo_id += 1;
+       if (entry != NULL) {
+               /*
+               if this packet did not count against FIFO credit, it must have
+               taken a requested_credit from the firmware (for pspoll etc.)
+               */
+               if ((prec != AC_COUNT) && !DHD_PKTTAG_CREDITCHECK(PKTTAG(p)))
+                       entry->requested_credit++;
+
+               if (pkt_type == eWLFC_PKTTYPE_DELAYED) {
+                       /* decrement sequence count */
+                       WLFC_DECR_SEQCOUNT(entry, prec);
+                       /* remove header first */
+                       rc = _dhd_wlfc_pullheader(ctx, p);
+                       if (rc != BCME_OK) {
+                               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                               goto exit;
+                       }
+               }
+
+               if (_dhd_wlfc_prec_enq_with_drop(ctx->dhdp, &entry->psq, p, fifo_id, TRUE,
+                       WLFC_SEQCOUNT(entry, fifo_id>>1))
+                       == FALSE) {
+                       /* enque failed */
+                       DHD_ERROR(("Error: %s():%d, fifo_id(%d)\n",
+                               __FUNCTION__, __LINE__, fifo_id));
+                       rc = BCME_ERROR;
+               }
+       } else {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               rc = BCME_ERROR;
+       }
+
+exit:
+       if (rc != BCME_OK) {
+               ctx->stats.rollback_failed++;
+               _dhd_wlfc_prec_drop(ctx->dhdp, fifo_id, p, FALSE);
+       } else {
+               ctx->stats.rollback++;
+       }
+
+       return rc;
+} /* _dhd_wlfc_rollback_packet_toq */
+
+/** Returns TRUE if host OS -> DHD flow control is allowed on the caller supplied interface */
+static bool
+_dhd_wlfc_allow_fc(athost_wl_status_info_t* ctx, uint8 ifid)
+{
+       int prec, ac_traffic = WLFC_NO_TRAFFIC;
+
+       for (prec = 0; prec < AC_COUNT; prec++) {
+               if (ctx->pkt_cnt_in_drv[ifid][prec] > 0) {
+                       if (ac_traffic == WLFC_NO_TRAFFIC)
+                               ac_traffic = prec + 1;
+                       else if (ac_traffic != (prec + 1))
+                               ac_traffic = WLFC_MULTI_TRAFFIC;
+               }
+       }
+
+       if (ac_traffic >= 1 && ac_traffic <= AC_COUNT) {
+               /* single AC (BE/BK/VI/VO) in queue */
+               if (ctx->allow_fc) {
+                       return TRUE;
+               } else {
+                       uint32 delta;
+                       uint32 curr_t = OSL_SYSUPTIME();
+
+                       if (ctx->fc_defer_timestamp == 0) {
+                               /* first single ac scenario */
+                               ctx->fc_defer_timestamp = curr_t;
+                               return FALSE;
+                       }
+
+                       /* single AC duration, this handles wrap around, e.g. 1 - ~0 = 2. */
+                       delta = curr_t - ctx->fc_defer_timestamp;
+                       if (delta >= WLFC_FC_DEFER_PERIOD_MS) {
+                               ctx->allow_fc = TRUE;
+                       }
+               }
+       } else {
+               /* multiple ACs or BCMC in queue */
+               ctx->allow_fc = FALSE;
+               ctx->fc_defer_timestamp = 0;
+       }
+
+       return ctx->allow_fc;
+} /* _dhd_wlfc_allow_fc */
+
+/**
+ * Starts or stops the flow of transmit packets from the host OS towards the DHD, depending on
+ * low/high watermarks.
+ */
+static void
+_dhd_wlfc_flow_control_check(athost_wl_status_info_t* ctx, struct pktq* pq, uint8 if_id)
+{
+       dhd_pub_t *dhdp;
+
+       ASSERT(ctx);
+
+       dhdp = (dhd_pub_t *)ctx->dhdp;
+       ASSERT(dhdp);
+
+       if (dhdp->skip_fc && dhdp->skip_fc((void *)dhdp, if_id))
+               return;
+
+       if ((ctx->hostif_flow_state[if_id] == OFF) && !_dhd_wlfc_allow_fc(ctx, if_id))
+               return;
+
+       if ((pq->n_pkts_tot <= WLFC_FLOWCONTROL_LOWATER) && (ctx->hostif_flow_state[if_id] == ON)) {
+               /* start traffic */
+               ctx->hostif_flow_state[if_id] = OFF;
+               /*
+               WLFC_DBGMESG(("qlen:%02d, if:%02d, ->OFF, start traffic %s()\n",
+               pq->n_pkts_tot, if_id, __FUNCTION__));
+               */
+               WLFC_DBGMESG(("F"));
+
+               dhd_txflowcontrol(dhdp, if_id, OFF);
+
+               ctx->toggle_host_if = 0;
+       }
+
+       if (pq->n_pkts_tot >= WLFC_FLOWCONTROL_HIWATER && ctx->hostif_flow_state[if_id] == OFF) {
+               /* stop traffic */
+               ctx->hostif_flow_state[if_id] = ON;
+               /*
+               WLFC_DBGMESG(("qlen:%02d, if:%02d, ->ON, stop traffic   %s()\n",
+               pq->n_pkts_tot, if_id, __FUNCTION__));
+               */
+               WLFC_DBGMESG(("N"));
+
+               dhd_txflowcontrol(dhdp, if_id, ON);
+
+               ctx->host_ifidx = if_id;
+               ctx->toggle_host_if = 1;
+       }
+
+       return;
+} /* _dhd_wlfc_flow_control_check */
+
+/** XXX: Warning: this function directly accesses bus-transmit function */
+static int
+_dhd_wlfc_send_signalonly_packet(athost_wl_status_info_t* ctx, wlfc_mac_descriptor_t* entry,
+       uint8 ta_bmp)
+{
+       int rc = BCME_OK;
+       void* p = NULL;
+       int dummylen = ((dhd_pub_t *)ctx->dhdp)->hdrlen+ 16;
+       dhd_pub_t *dhdp = (dhd_pub_t *)ctx->dhdp;
+
+       if (dhdp->proptxstatus_txoff) {
+               rc = BCME_NORESOURCE;
+               return rc;
+       }
+
+       /* allocate a dummy packet */
+       p = PKTGET(ctx->osh, dummylen, TRUE);
+       if (p) {
+               PKTPULL(ctx->osh, p, dummylen);
+               DHD_PKTTAG_SET_H2DTAG(PKTTAG(p), 0);
+               _dhd_wlfc_pushheader(ctx, &p, TRUE, ta_bmp, entry->mac_handle, 0, 0, FALSE);
+               DHD_PKTTAG_SETSIGNALONLY(PKTTAG(p), 1);
+               DHD_PKTTAG_WLFCPKT_SET(PKTTAG(p), 1);
+#ifdef PROP_TXSTATUS_DEBUG
+               ctx->stats.signal_only_pkts_sent++;
+#endif
+
+#if defined(BCMPCIE)
+               /* XXX : RAHUL : Verify the ifidx */
+               rc = dhd_bus_txdata(dhdp->bus, p, ctx->host_ifidx);
+#else
+               rc = dhd_bus_txdata(dhdp->bus, p);
+#endif
+               if (rc != BCME_OK) {
+                       _dhd_wlfc_pullheader(ctx, p);
+                       PKTFREE(ctx->osh, p, TRUE);
+               }
+       } else {
+               DHD_ERROR(("%s: couldn't allocate new %d-byte packet\n",
+                          __FUNCTION__, dummylen));
+               rc = BCME_NOMEM;
+               dhdp->tx_pktgetfail++;
+       }
+
+       return rc;
+} /* _dhd_wlfc_send_signalonly_packet */
+
+/**
+ * Called on eg receiving 'mac close' indication from dongle. Updates the per-MAC administration
+ * maintained in caller supplied parameter 'entry'.
+ *
+ *    @param[in/out] entry  administration about a remote MAC entity
+ *    @param[in]     prec   precedence queue for this remote MAC entitity
+ *
+ * Return value: TRUE if traffic availability changed
+ */
+static bool
+_dhd_wlfc_traffic_pending_check(athost_wl_status_info_t* ctx, wlfc_mac_descriptor_t* entry,
+       int prec)
+{
+       bool rc = FALSE;
+
+       if (entry->state == WLFC_STATE_CLOSE) {
+               if ((pktqprec_n_pkts(&entry->psq, (prec << 1)) == 0) &&
+                       (pktqprec_n_pkts(&entry->psq, ((prec << 1) + 1)) == 0)) {
+                       /* no packets in both 'normal' and 'suspended' queues */
+                       if (entry->traffic_pending_bmp & NBITVAL(prec)) {
+                               rc = TRUE;
+                               entry->traffic_pending_bmp =
+                                       entry->traffic_pending_bmp & ~ NBITVAL(prec);
+                       }
+               } else {
+                       /* packets are queued in host for transmission to dongle */
+                       if (!(entry->traffic_pending_bmp & NBITVAL(prec))) {
+                               rc = TRUE;
+                               entry->traffic_pending_bmp =
+                                       entry->traffic_pending_bmp | NBITVAL(prec);
+                       }
+               }
+       }
+
+       if (rc) {
+               /* request a TIM update to firmware at the next piggyback opportunity */
+               if (entry->traffic_lastreported_bmp != entry->traffic_pending_bmp) {
+                       entry->send_tim_signal = 1;
+                       /*
+                       XXX: send a header only packet from the same context.
+                       --this should change to sending from a timeout or similar.
+                       */
+                       _dhd_wlfc_send_signalonly_packet(ctx, entry, entry->traffic_pending_bmp);
+                       entry->traffic_lastreported_bmp = entry->traffic_pending_bmp;
+                       entry->send_tim_signal = 0;
+               } else {
+                       rc = FALSE;
+               }
+       }
+
+       return rc;
+} /* _dhd_wlfc_traffic_pending_check */
+
+/**
+ * Called on receiving a 'd11 suppressed' or 'wl suppressed' tx status from the firmware. Enqueues
+ * the packet to transmit to firmware again at a later opportunity.
+ */
+static int
+_dhd_wlfc_enque_suppressed(athost_wl_status_info_t* ctx, int prec, void* p)
+{
+       wlfc_mac_descriptor_t* entry;
+
+       entry = _dhd_wlfc_find_table_entry(ctx, p);
+       if (entry == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_NOTFOUND;
+       }
+       /*
+       - suppressed packets go to sub_queue[2*prec + 1] AND
+       - delayed packets go to sub_queue[2*prec + 0] to ensure
+       order of delivery.
+       */
+       if (_dhd_wlfc_prec_enq_with_drop(ctx->dhdp, &entry->psq, p, ((prec << 1) + 1), FALSE,
+               WLFC_SEQCOUNT(entry, prec))
+               == FALSE) {
+               ctx->stats.delayq_full_error++;
+               /* WLFC_DBGMESG(("Error: %s():%d\n", __FUNCTION__, __LINE__)); */
+               WLFC_DBGMESG(("s"));
+               return BCME_ERROR;
+       }
+
+       /* A packet has been pushed, update traffic availability bitmap, if applicable */
+       _dhd_wlfc_traffic_pending_check(ctx, entry, prec);
+       _dhd_wlfc_flow_control_check(ctx, &entry->psq, DHD_PKTTAG_IF(PKTTAG(p)));
+       return BCME_OK;
+}
+
+/**
+ * Called when a transmit packet is about to be 'committed' from the OS layer to a lower layer
+ * towards the dongle (eg the DBUS layer). Updates wlfc administration. May modify packet.
+ *
+ *     @param[in/out] ctx    driver specific flow control administration
+ *     @param[in/out] entry  The remote MAC entity for which the packet is destined.
+ *     @param[in/out] packet Packet to send. This function optionally adds TLVs to the packet.
+ *     @param[in] header_needed True if packet is 'new' to flow control
+ *     @param[out] slot Handle to container in which the packet was 'parked'
+ */
+static int
+_dhd_wlfc_pretx_pktprocess(athost_wl_status_info_t* ctx,
+       wlfc_mac_descriptor_t* entry, void** packet, int header_needed, uint32* slot)
+{
+       int rc = BCME_OK;
+       int hslot = WLFC_HANGER_MAXITEMS;
+       bool send_tim_update = FALSE;
+       uint32 htod = 0;
+       uint16 htodseq = 0;
+       uint8 free_ctr;
+       int gen = 0xff;
+       dhd_pub_t *dhdp = (dhd_pub_t *)ctx->dhdp;
+       void * p = *packet;
+
+       *slot = hslot;
+
+       if (entry == NULL) {
+               entry = _dhd_wlfc_find_table_entry(ctx, p);
+       }
+
+       if (entry == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_ERROR;
+       }
+
+       if (entry->send_tim_signal) {
+               /* sends a traffic indication bitmap to the dongle */
+               send_tim_update = TRUE;
+               entry->send_tim_signal = 0;
+               entry->traffic_lastreported_bmp = entry->traffic_pending_bmp;
+       }
+
+       if (header_needed) {
+               if (WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+                       hslot = (uint)(entry - &ctx->destination_entries.nodes[0]);
+               } else {
+                       hslot = _dhd_wlfc_hanger_get_free_slot(ctx->hanger);
+               }
+               gen = entry->generation;
+               free_ctr = WLFC_SEQCOUNT(entry, DHD_PKTTAG_FIFO(PKTTAG(p)));
+       } else {
+               if (WLFC_GET_REUSESEQ(dhdp->wlfc_mode)) {
+                       htodseq = DHD_PKTTAG_H2DSEQ(PKTTAG(p));
+               }
+
+               hslot = WL_TXSTATUS_GET_HSLOT(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+
+               if (WLFC_GET_REORDERSUPP(dhdp->wlfc_mode)) {
+                       gen = entry->generation;
+               } else if (WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+                       gen = WL_TXSTATUS_GET_GENERATION(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+               } else {
+                       _dhd_wlfc_hanger_get_genbit(ctx->hanger, p, hslot, &gen);
+               }
+
+               free_ctr = WL_TXSTATUS_GET_FREERUNCTR(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+               /* remove old header */
+               _dhd_wlfc_pullheader(ctx, p);
+       }
+
+       if (hslot >= WLFC_HANGER_MAXITEMS) {
+               DHD_ERROR(("Error: %s():no hanger slot available\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       WL_TXSTATUS_SET_FREERUNCTR(htod, free_ctr);
+       WL_TXSTATUS_SET_HSLOT(htod, hslot);
+       WL_TXSTATUS_SET_FIFO(htod, DHD_PKTTAG_FIFO(PKTTAG(p)));
+       WL_TXSTATUS_SET_FLAGS(htod, WLFC_PKTFLAG_PKTFROMHOST);
+       WL_TXSTATUS_SET_GENERATION(htod, gen);
+       DHD_PKTTAG_SETPKTDIR(PKTTAG(p), 1);
+
+       if (!DHD_PKTTAG_CREDITCHECK(PKTTAG(p))) {
+               /*
+               Indicate that this packet is being sent in response to an
+               explicit request from the firmware side.
+               */
+               WLFC_PKTFLAG_SET_PKTREQUESTED(htod);
+       } else {
+               WLFC_PKTFLAG_CLR_PKTREQUESTED(htod);
+       }
+
+       rc = _dhd_wlfc_pushheader(ctx, &p, send_tim_update,
+               entry->traffic_lastreported_bmp, entry->mac_handle, htod, htodseq, FALSE);
+       if (rc == BCME_OK) {
+               DHD_PKTTAG_SET_H2DTAG(PKTTAG(p), htod);
+
+               if (!WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+                       wlfc_hanger_t *h = (wlfc_hanger_t*)(ctx->hanger);
+                       if (header_needed) {
+                               /*
+                               a new header was created for this packet.
+                               push to hanger slot and scrub q. Since bus
+                               send succeeded, increment seq number as well.
+                               */
+                               rc = _dhd_wlfc_hanger_pushpkt(ctx->hanger, p, hslot);
+                               if (rc == BCME_OK) {
+#ifdef PROP_TXSTATUS_DEBUG
+                                       h->items[hslot].push_time =
+                                               OSL_SYSUPTIME();
+#endif
+                               } else {
+                                       DHD_ERROR(("%s() hanger_pushpkt() failed, rc: %d\n",
+                                               __FUNCTION__, rc));
+                               }
+                       } else {
+                               /* clear hanger state */
+                               if (((wlfc_hanger_t*)(ctx->hanger))->items[hslot].pkt != p)
+                                       DHD_ERROR(("%s() pkt not match: cur %p, hanger pkt %p\n",
+                                               __FUNCTION__, p, h->items[hslot].pkt));
+                               ASSERT(h->items[hslot].pkt == p);
+                               bcm_object_feature_set(h->items[hslot].pkt,
+                                       BCM_OBJECT_FEATURE_PKT_STATE, 0);
+                               h->items[hslot].pkt_state = 0;
+                               h->items[hslot].pkt_txstatus = 0;
+                               h->items[hslot].state = WLFC_HANGER_ITEM_STATE_INUSE;
+                       }
+               }
+
+               if ((rc == BCME_OK) && header_needed) {
+                       /* increment free running sequence count */
+                       WLFC_INCR_SEQCOUNT(entry, DHD_PKTTAG_FIFO(PKTTAG(p)));
+               }
+       }
+       *slot = hslot;
+       *packet = p;
+       return rc;
+} /* _dhd_wlfc_pretx_pktprocess */
+
+/**
+ * A remote wireless mac may be temporarily 'closed' due to power management. Returns '1' if remote
+ * mac is in the 'open' state, otherwise '0'.
+ */
+static int
+_dhd_wlfc_is_destination_open(athost_wl_status_info_t* ctx,
+       wlfc_mac_descriptor_t* entry, int prec)
+{
+       wlfc_mac_descriptor_t* interfaces = ctx->destination_entries.interfaces;
+
+       if (entry->interface_id >= WLFC_MAX_IFNUM) {
+               ASSERT(&ctx->destination_entries.other == entry);
+               return 1;
+       }
+
+       if (interfaces[entry->interface_id].iftype ==
+               WLC_E_IF_ROLE_P2P_GO) {
+               /* - destination interface is of type p2p GO.
+               For a p2pGO interface, if the destination is OPEN but the interface is
+               CLOSEd, do not send traffic. But if the dstn is CLOSEd while there is
+               destination-specific-credit left send packets. This is because the
+               firmware storing the destination-specific-requested packet in queue.
+               */
+               /* XXX: This behavior will change one PM1 protocol mod is complete */
+               if ((entry->state == WLFC_STATE_CLOSE) && (entry->requested_credit == 0) &&
+                       (entry->requested_packet == 0)) {
+                       return 0;
+               }
+       }
+
+       /* AP, p2p_go -> unicast desc entry, STA/p2p_cl -> interface desc. entry */
+       if ((((entry->state == WLFC_STATE_CLOSE) ||
+               (interfaces[entry->interface_id].state == WLFC_STATE_CLOSE)) &&
+               (entry->requested_credit == 0) &&
+               (entry->requested_packet == 0)) ||
+               (!(entry->ac_bitmap & (1 << prec)))) {
+               return 0;
+       }
+
+       return 1;
+} /* _dhd_wlfc_is_destination_open */
+
+/**
+ * Dequeues a suppressed or delayed packet from a queue
+ *    @param[in/out] ctx          Driver specific flow control administration
+ *    @param[in]  prec            Precedence of queue to dequeue from
+ *    @param[out] ac_credit_spent Boolean, returns 0 or 1
+ *    @param[out] needs_hdr       Boolean, returns 0 or 1
+ *    @param[out] entry_out       The remote MAC for which the packet is destined
+ *    @param[in]  only_no_credit  If TRUE, searches all entries instead of just the active ones
+ *
+ * Return value: the dequeued packet
+ */
+static void*
+_dhd_wlfc_deque_delayedq(athost_wl_status_info_t* ctx, int prec,
+       uint8* ac_credit_spent, uint8* needs_hdr, wlfc_mac_descriptor_t** entry_out,
+       bool only_no_credit)
+{
+       wlfc_mac_descriptor_t* entry;
+       int total_entries;
+       void* p = NULL;
+       int i;
+       uint8 credit_spent = ((prec == AC_COUNT) && !ctx->bcmc_credit_supported) ? 0 : 1;
+
+       *entry_out = NULL;
+       /* most cases a packet will count against FIFO credit */
+       *ac_credit_spent = credit_spent;
+
+       /* search all entries, include nodes as well as interfaces */
+       if (only_no_credit) {
+               total_entries = ctx->requested_entry_count;
+       } else {
+               total_entries = ctx->active_entry_count;
+       }
+
+       for (i = 0; i < total_entries; i++) {
+               if (only_no_credit) {
+                       entry = ctx->requested_entry[i];
+               } else {
+                       entry = ctx->active_entry_head;
+                       /* move head to ensure fair round-robin */
+                       ctx->active_entry_head = ctx->active_entry_head->next;
+               }
+               ASSERT(entry);
+
+               if (entry->occupied && _dhd_wlfc_is_destination_open(ctx, entry, prec) &&
+#ifdef PROPTX_MAXCOUNT
+                       (entry->transit_count < entry->transit_maxcount) &&
+#endif /* PROPTX_MAXCOUNT */
+                       (entry->transit_count < WL_TXSTATUS_FREERUNCTR_MASK) &&
+                       (!entry->suppressed)) {
+                       *ac_credit_spent = credit_spent;
+                       if (entry->state == WLFC_STATE_CLOSE) {
+                               *ac_credit_spent = 0;
+                       }
+
+                       /* higher precedence will be picked up first,
+                        * i.e. suppressed packets before delayed ones
+                        */
+                       p = pktq_pdeq(&entry->psq, PSQ_SUP_IDX(prec));
+                       *needs_hdr = 0;
+                       if (p == NULL) {
+                               /* De-Q from delay Q */
+                               p = pktq_pdeq(&entry->psq, PSQ_DLY_IDX(prec));
+                               *needs_hdr = 1;
+                       }
+
+                       if (p != NULL) {
+                               bcm_pkt_validate_chk(p, "_dhd_wlfc_deque_afq");
+                               /* did the packet come from suppress sub-queue? */
+                               if (entry->requested_credit > 0) {
+                                       entry->requested_credit--;
+#ifdef PROP_TXSTATUS_DEBUG
+                                       entry->dstncredit_sent_packets++;
+#endif
+                               } else if (entry->requested_packet > 0) {
+                                       entry->requested_packet--;
+                                       DHD_PKTTAG_SETONETIMEPKTRQST(PKTTAG(p));
+                               }
+
+                               *entry_out = entry;
+                               ctx->pkt_cnt_in_q[DHD_PKTTAG_IF(PKTTAG(p))][prec]--;
+                               ctx->pkt_cnt_per_ac[prec]--;
+                               ctx->pkt_cnt_in_psq--;
+                               _dhd_wlfc_flow_control_check(ctx, &entry->psq,
+                                       DHD_PKTTAG_IF(PKTTAG(p)));
+                               /*
+                                * A packet has been picked up, update traffic availability bitmap,
+                                * if applicable.
+                                */
+                               _dhd_wlfc_traffic_pending_check(ctx, entry, prec);
+                               return p;
+                       }
+               }
+       }
+       return NULL;
+} /* _dhd_wlfc_deque_delayedq */
+
+/** Enqueues caller supplied packet on either a 'suppressed' or 'delayed' queue */
+static int
+_dhd_wlfc_enque_delayq(athost_wl_status_info_t* ctx, void* pktbuf, int prec)
+{
+       wlfc_mac_descriptor_t* entry;
+
+       if (pktbuf != NULL) {
+               entry = _dhd_wlfc_find_table_entry(ctx, pktbuf);
+               if (entry == NULL) {
+                       DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                       return BCME_ERROR;
+               }
+
+               /*
+               - suppressed packets go to sub_queue[2*prec + 1] AND
+               - delayed packets go to sub_queue[2*prec + 0] to ensure
+               order of delivery.
+               */
+               if (_dhd_wlfc_prec_enq_with_drop(ctx->dhdp, &entry->psq, pktbuf, (prec << 1),
+                       FALSE, WLFC_SEQCOUNT(entry, prec))
+                       == FALSE) {
+                       WLFC_DBGMESG(("D"));
+                       ctx->stats.delayq_full_error++;
+                       return BCME_ERROR;
+               }
+
+               /* A packet has been pushed, update traffic availability bitmap, if applicable */
+               _dhd_wlfc_traffic_pending_check(ctx, entry, prec);
+       }
+
+       return BCME_OK;
+} /* _dhd_wlfc_enque_delayq */
+
+/** Returns TRUE if caller supplied packet is destined for caller supplied interface */
+static bool _dhd_wlfc_ifpkt_fn(void* p, void *p_ifid)
+{
+       if (!p || !p_ifid)
+               return FALSE;
+
+       return (DHD_PKTTAG_WLFCPKT(PKTTAG(p))&& (*((uint8 *)p_ifid) == DHD_PKTTAG_IF(PKTTAG(p))));
+}
+
+/** Returns TRUE if caller supplied packet is destined for caller supplied remote MAC */
+static bool _dhd_wlfc_entrypkt_fn(void* p, void *entry)
+{
+       if (!p || !entry)
+               return FALSE;
+
+       return (DHD_PKTTAG_WLFCPKT(PKTTAG(p))&& (entry == DHD_PKTTAG_ENTRY(PKTTAG(p))));
+}
+
+static void
+_dhd_wlfc_return_implied_credit(athost_wl_status_info_t* wlfc, void* pkt)
+{
+       dhd_pub_t *dhdp;
+       bool credit_return = FALSE;
+
+       if (!wlfc || !pkt) {
+               return;
+       }
+
+       dhdp = (dhd_pub_t *)(wlfc->dhdp);
+       if (dhdp && (dhdp->proptxstatus_mode == WLFC_FCMODE_IMPLIED_CREDIT) &&
+               DHD_PKTTAG_CREDITCHECK(PKTTAG(pkt))) {
+               int lender, credit_returned = 0;
+               uint8 fifo_id = DHD_PKTTAG_FIFO(PKTTAG(pkt));
+
+               credit_return = TRUE;
+
+               /* Note that borrower is fifo_id */
+               /* Return credits to highest priority lender first */
+               for (lender = AC_COUNT; lender >= 0; lender--) {
+                       if (wlfc->credits_borrowed[fifo_id][lender] > 0) {
+                               wlfc->FIFO_credit[lender]++;
+                               wlfc->credits_borrowed[fifo_id][lender]--;
+                               credit_returned = 1;
+                               break;
+                       }
+               }
+
+               if (!credit_returned) {
+                       wlfc->FIFO_credit[fifo_id]++;
+               }
+       }
+
+       BCM_REFERENCE(credit_return);
+#if defined(DHD_WLFC_THREAD)
+       if (credit_return) {
+               _dhd_wlfc_thread_wakeup(dhdp);
+       }
+#endif /* defined(DHD_WLFC_THREAD) */
+}
+
+/** Removes and frees a packet from the hanger. Called during eg tx complete. */
+static void
+_dhd_wlfc_hanger_free_pkt(athost_wl_status_info_t* wlfc, uint32 slot_id, uint8 pkt_state,
+       int pkt_txstatus)
+{
+       wlfc_hanger_t* hanger;
+       wlfc_hanger_item_t* item;
+
+       if (!wlfc)
+               return;
+
+       hanger = (wlfc_hanger_t*)wlfc->hanger;
+       if (!hanger)
+               return;
+
+       if (slot_id == WLFC_HANGER_MAXITEMS)
+               return;
+
+       item = &hanger->items[slot_id];
+
+       if (item->pkt) {
+               item->pkt_state |= pkt_state;
+               if (pkt_txstatus != -1)
+                       item->pkt_txstatus = (uint8)pkt_txstatus;
+               bcm_object_feature_set(item->pkt, BCM_OBJECT_FEATURE_PKT_STATE, item->pkt_state);
+               if (item->pkt_state == WLFC_HANGER_PKT_STATE_COMPLETE) {
+                       void *p = NULL;
+                       void *pkt = item->pkt;
+                       uint8 old_state = item->state;
+                       int ret = _dhd_wlfc_hanger_poppkt(wlfc->hanger, slot_id, &p, TRUE);
+                       BCM_REFERENCE(ret);
+                       BCM_REFERENCE(pkt);
+                       ASSERT((ret == BCME_OK) && p && (pkt == p));
+                       if (old_state == WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED) {
+                               printf("ERROR: free a suppressed pkt %p state %d pkt_state %d\n",
+                                       pkt, old_state, item->pkt_state);
+                       }
+                       ASSERT(old_state != WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED);
+
+                       /* free packet */
+                       wlfc->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(p))]
+                               [DHD_PKTTAG_FIFO(PKTTAG(p))]--;
+                       wlfc->stats.pktout++;
+                       dhd_txcomplete((dhd_pub_t *)wlfc->dhdp, p, item->pkt_txstatus);
+                       PKTFREE(wlfc->osh, p, TRUE);
+               }
+       } else {
+               /* free slot */
+               if (item->state == WLFC_HANGER_ITEM_STATE_FREE)
+                       DHD_ERROR(("Error: %s():%d Multiple TXSTATUS or BUSRETURNED: %d (%d)\n",
+                           __FUNCTION__, __LINE__, item->pkt_state, pkt_state));
+               item->state = WLFC_HANGER_ITEM_STATE_FREE;
+       }
+} /* _dhd_wlfc_hanger_free_pkt */
+
+/** Called during eg detach() */
+static void
+_dhd_wlfc_pktq_flush(athost_wl_status_info_t* ctx, struct pktq *pq,
+       bool dir, f_processpkt_t fn, void *arg, q_type_t q_type)
+{
+       int prec;
+       dhd_pub_t *dhdp = (dhd_pub_t *)ctx->dhdp;
+
+       ASSERT(dhdp);
+
+       /* Optimize flush, if pktq len = 0, just return.
+        * pktq len of 0 means pktq's prec q's are all empty.
+        */
+       if (pq->n_pkts_tot == 0) {
+               return;
+       }
+
+       for (prec = 0; prec < pq->num_prec; prec++) {
+               struct pktq_prec *q;
+               void *p, *prev = NULL;
+
+               q = &pq->q[prec];
+               p = q->head;
+               while (p) {
+                       bcm_pkt_validate_chk(p, "_dhd_wlfc_pktq_flush");
+                       if (fn == NULL || (*fn)(p, arg)) {
+                               bool head = (p == q->head);
+                               if (head)
+                                       q->head = PKTLINK(p);
+                               else
+                                       PKTSETLINK(prev, PKTLINK(p));
+                               if (q_type == Q_TYPE_PSQ) {
+                                       if (!WLFC_GET_AFQ(dhdp->wlfc_mode) && (prec & 1)) {
+                                               _dhd_wlfc_hanger_remove_reference(ctx->hanger, p);
+                                       }
+                                       ctx->pkt_cnt_in_q[DHD_PKTTAG_IF(PKTTAG(p))][prec>>1]--;
+                                       ctx->pkt_cnt_per_ac[prec>>1]--;
+                                       ctx->pkt_cnt_in_psq--;
+                                       ctx->stats.cleanup_psq_cnt++;
+                                       if (!(prec & 1)) {
+                                               /* pkt in delayed q, so fake push BDC header for
+                                                * dhd_tcpack_check_xmit() and dhd_txcomplete().
+                                                */
+                                               _dhd_wlfc_pushheader(ctx, &p, FALSE, 0, 0,
+                                                       0, 0, TRUE);
+#ifdef DHDTCPACK_SUPPRESS
+                                               if (dhd_tcpack_check_xmit(dhdp, p) == BCME_ERROR) {
+                                                       DHD_ERROR(("%s %d: tcpack_suppress ERROR!!!"
+                                                               " Stop using it\n",
+                                                               __FUNCTION__, __LINE__));
+                                                       dhd_tcpack_suppress_set(dhdp,
+                                                               TCPACK_SUP_OFF);
+                                               }
+#endif /* DHDTCPACK_SUPPRESS */
+                                       }
+                               } else if (q_type == Q_TYPE_AFQ) {
+                                       wlfc_mac_descriptor_t* entry =
+                                               _dhd_wlfc_find_table_entry(ctx, p);
+                                       if (entry->transit_count)
+                                               entry->transit_count--;
+                                       if (entry->suppr_transit_count) {
+                                               entry->suppr_transit_count--;
+                                               if (entry->suppressed &&
+                                                       (!entry->onbus_pkts_count) &&
+                                                       (!entry->suppr_transit_count))
+                                                       entry->suppressed = FALSE;
+                                       }
+                                       _dhd_wlfc_return_implied_credit(ctx, p);
+                                       ctx->stats.cleanup_fw_cnt++;
+                               }
+                               PKTSETLINK(p, NULL);
+                               if (dir) {
+                                       ctx->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(p))][prec>>1]--;
+                                       ctx->stats.pktout++;
+                                       dhd_txcomplete(dhdp, p, FALSE);
+                               }
+                               PKTFREE(ctx->osh, p, dir);
+
+                               q->n_pkts--;
+                               pq->n_pkts_tot--;
+#ifdef WL_TXQ_STALL
+                               q->dequeue_count++;
+#endif
+
+                               p = (head ? q->head : PKTLINK(prev));
+                       } else {
+                               prev = p;
+                               p = PKTLINK(p);
+                       }
+               }
+
+               if (q->head == NULL) {
+                       ASSERT(q->n_pkts == 0);
+                       q->tail = NULL;
+               }
+
+       }
+
+       if (fn == NULL)
+               ASSERT(pq->n_pkts_tot == 0);
+} /* _dhd_wlfc_pktq_flush */
+
+#ifndef BCMDBUS
+/** !BCMDBUS specific function. Dequeues a packet from the caller supplied queue. */
+static void*
+_dhd_wlfc_pktq_pdeq_with_fn(struct pktq *pq, int prec, f_processpkt_t fn, void *arg)
+{
+       struct pktq_prec *q;
+       void *p, *prev = NULL;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       q = &pq->q[prec];
+       p = q->head;
+
+       while (p) {
+               if (fn == NULL || (*fn)(p, arg)) {
+                       break;
+               } else {
+                       prev = p;
+                       p = PKTLINK(p);
+               }
+       }
+       if (p == NULL)
+               return NULL;
+
+       bcm_pkt_validate_chk(p, "_dhd_wlfc_pktq_flush");
+
+       if (prev == NULL) {
+               if ((q->head = PKTLINK(p)) == NULL) {
+                       q->tail = NULL;
+               }
+       } else {
+               PKTSETLINK(prev, PKTLINK(p));
+               if (q->tail == p) {
+                       q->tail = prev;
+               }
+       }
+
+       q->n_pkts--;
+
+       pq->n_pkts_tot--;
+
+#ifdef WL_TXQ_STALL
+       q->dequeue_count++;
+#endif
+
+       PKTSETLINK(p, NULL);
+
+       return p;
+}
+
+/** !BCMDBUS specific function */
+static void
+_dhd_wlfc_cleanup_txq(dhd_pub_t *dhd, f_processpkt_t fn, void *arg)
+{
+       int prec;
+       void *pkt = NULL, *head = NULL, *tail = NULL;
+       struct pktq *txq = (struct pktq *)dhd_bus_txq(dhd->bus);
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_hanger_t* h = (wlfc_hanger_t*)wlfc->hanger;
+       wlfc_mac_descriptor_t* entry;
+
+       dhd_os_sdlock_txq(dhd);
+       for (prec = 0; prec < txq->num_prec; prec++) {
+               while ((pkt = _dhd_wlfc_pktq_pdeq_with_fn(txq, prec, fn, arg))) {
+#ifdef DHDTCPACK_SUPPRESS
+                       if (dhd_tcpack_check_xmit(dhd, pkt) == BCME_ERROR) {
+                               DHD_ERROR(("%s %d: tcpack_suppress ERROR!!! Stop using it\n",
+                                       __FUNCTION__, __LINE__));
+                               dhd_tcpack_suppress_set(dhd, TCPACK_SUP_OFF);
+                       }
+#endif /* DHDTCPACK_SUPPRESS */
+                       if (!head) {
+                               head = pkt;
+                       }
+                       if (tail) {
+                               PKTSETLINK(tail, pkt);
+                       }
+                       tail = pkt;
+               }
+       }
+       dhd_os_sdunlock_txq(dhd);
+
+       while ((pkt = head)) {
+               head = PKTLINK(pkt);
+               PKTSETLINK(pkt, NULL);
+               entry = _dhd_wlfc_find_table_entry(wlfc, pkt);
+
+               if (!WLFC_GET_AFQ(dhd->wlfc_mode) &&
+                       !_dhd_wlfc_hanger_remove_reference(h, pkt)) {
+                       DHD_ERROR(("%s: can't find pkt(%p) in hanger, free it anyway\n",
+                               __FUNCTION__, pkt));
+               }
+               if (entry->transit_count)
+                       entry->transit_count--;
+               if (entry->suppr_transit_count) {
+                       entry->suppr_transit_count--;
+                       if (entry->suppressed &&
+                               (!entry->onbus_pkts_count) &&
+                               (!entry->suppr_transit_count))
+                               entry->suppressed = FALSE;
+               }
+               _dhd_wlfc_return_implied_credit(wlfc, pkt);
+               wlfc->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(pkt))][DHD_PKTTAG_FIFO(PKTTAG(pkt))]--;
+               wlfc->stats.pktout++;
+               wlfc->stats.cleanup_txq_cnt++;
+               dhd_txcomplete(dhd, pkt, FALSE);
+               PKTFREE(wlfc->osh, pkt, TRUE);
+       }
+} /* _dhd_wlfc_cleanup_txq */
+#endif /* !BCMDBUS */
+
+/** called during eg detach */
+void
+_dhd_wlfc_cleanup(dhd_pub_t *dhd, f_processpkt_t fn, void *arg)
+{
+       int i;
+       int total_entries;
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_mac_descriptor_t* table;
+       wlfc_hanger_t* h = (wlfc_hanger_t*)wlfc->hanger;
+
+       wlfc->stats.cleanup_txq_cnt = 0;
+       wlfc->stats.cleanup_psq_cnt = 0;
+       wlfc->stats.cleanup_fw_cnt = 0;
+
+       /*
+       *  flush sequence should be txq -> psq -> hanger/afq, hanger has to be last one
+       */
+#ifndef BCMDBUS
+       /* flush bus->txq */
+       _dhd_wlfc_cleanup_txq(dhd, fn, arg);
+#endif /* !BCMDBUS */
+
+       /* flush psq, search all entries, include nodes as well as interfaces */
+       total_entries = sizeof(wlfc->destination_entries)/sizeof(wlfc_mac_descriptor_t);
+       table = (wlfc_mac_descriptor_t*)&wlfc->destination_entries;
+
+       for (i = 0; i < total_entries; i++) {
+               if (table[i].occupied) {
+                       /* release packets held in PSQ (both delayed and suppressed) */
+                       if (table[i].psq.n_pkts_tot) {
+                               WLFC_DBGMESG(("%s(): PSQ[%d].len = %d\n",
+                                       __FUNCTION__, i, table[i].psq.n_pkts_tot));
+                               _dhd_wlfc_pktq_flush(wlfc, &table[i].psq, TRUE,
+                                       fn, arg, Q_TYPE_PSQ);
+                       }
+
+                       /* free packets held in AFQ */
+                       if (WLFC_GET_AFQ(dhd->wlfc_mode) && (table[i].afq.n_pkts_tot)) {
+                               _dhd_wlfc_pktq_flush(wlfc, &table[i].afq, TRUE,
+                                       fn, arg, Q_TYPE_AFQ);
+                       }
+
+                       if ((fn == NULL) && (&table[i] != &wlfc->destination_entries.other)) {
+                               table[i].occupied = 0;
+                               if (table[i].transit_count || table[i].suppr_transit_count) {
+                                       DHD_ERROR(("%s: table[%d] transit(%d), suppr_tansit(%d)\n",
+                                               __FUNCTION__, i,
+                                               table[i].transit_count,
+                                               table[i].suppr_transit_count));
+                               }
+                       }
+               }
+       }
+
+       /*
+               . flush remained pkt in hanger queue, not in bus->txq nor psq.
+               . the remained pkt was successfully downloaded to dongle already.
+               . hanger slot state cannot be set to free until receive txstatus update.
+       */
+       if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+               for (i = 0; i < h->max_items; i++) {
+                       if ((h->items[i].state == WLFC_HANGER_ITEM_STATE_INUSE) ||
+                               (h->items[i].state == WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED)) {
+                               if (fn == NULL || (*fn)(h->items[i].pkt, arg)) {
+                                       h->items[i].state = WLFC_HANGER_ITEM_STATE_FLUSHED;
+                               }
+                       }
+               }
+       }
+
+       return;
+} /* _dhd_wlfc_cleanup */
+
+/** Called after eg the dongle signalled a new remote MAC that it connected with to the DHD */
+static int
+_dhd_wlfc_mac_entry_update(athost_wl_status_info_t* ctx, wlfc_mac_descriptor_t* entry,
+       uint8 action, uint8 ifid, uint8 iftype, uint8* ea,
+       f_processpkt_t fn, void *arg)
+{
+       int rc = BCME_OK;
+
+       if ((action == eWLFC_MAC_ENTRY_ACTION_ADD) || (action == eWLFC_MAC_ENTRY_ACTION_UPDATE)) {
+               entry->occupied = 1;
+               entry->state = WLFC_STATE_OPEN;
+               entry->requested_credit = 0;
+               entry->interface_id = ifid;
+               entry->iftype = iftype;
+               entry->ac_bitmap = 0xff; /* update this when handling APSD */
+
+               /* for an interface entry we may not care about the MAC address */
+               if (ea != NULL)
+                       memcpy(&entry->ea[0], ea, ETHER_ADDR_LEN);
+
+               if (action == eWLFC_MAC_ENTRY_ACTION_ADD) {
+                       entry->suppressed = FALSE;
+                       entry->transit_count = 0;
+#ifdef PROPTX_MAXCOUNT
+                       entry->transit_maxcount = wl_ext_get_wlfc_maxcount(ctx->dhdp, ifid);
+#endif /* PROPTX_MAXCOUNT */
+                       entry->suppr_transit_count = 0;
+                       entry->onbus_pkts_count = 0;
+               }
+
+               if (action == eWLFC_MAC_ENTRY_ACTION_ADD) {
+                       dhd_pub_t *dhdp = (dhd_pub_t *)(ctx->dhdp);
+
+                       pktq_init(&entry->psq, WLFC_PSQ_PREC_COUNT, WLFC_PSQ_LEN);
+                       _dhd_wlfc_flow_control_check(ctx, &entry->psq, ifid);
+
+                       if (WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+                               pktq_init(&entry->afq, WLFC_AFQ_PREC_COUNT, WLFC_PSQ_LEN);
+                       }
+
+                       if (entry->next == NULL) {
+                               /* not linked to anywhere, add to tail */
+                               if (ctx->active_entry_head) {
+                                       entry->prev = ctx->active_entry_head->prev;
+                                       ctx->active_entry_head->prev->next = entry;
+                                       ctx->active_entry_head->prev = entry;
+                                       entry->next = ctx->active_entry_head;
+                               } else {
+                                       ASSERT(ctx->active_entry_count == 0);
+                                       entry->prev = entry->next = entry;
+                                       ctx->active_entry_head = entry;
+                               }
+                               ctx->active_entry_count++;
+                       } else {
+                               DHD_ERROR(("%s():%d, entry(%d)\n", __FUNCTION__, __LINE__,
+                                       (int)(entry - &ctx->destination_entries.nodes[0])));
+                       }
+               }
+       } else if (action == eWLFC_MAC_ENTRY_ACTION_DEL) {
+               /* When the entry is deleted, the packets that are queued in the entry must be
+                  cleanup. The cleanup action should be before the occupied is set as 0.
+               */
+               _dhd_wlfc_cleanup(ctx->dhdp, fn, arg);
+               _dhd_wlfc_flow_control_check(ctx, &entry->psq, ifid);
+
+               entry->occupied = 0;
+               entry->state = WLFC_STATE_CLOSE;
+               memset(&entry->ea[0], 0, ETHER_ADDR_LEN);
+
+               if (entry->next) {
+                       /* not floating, remove from Q */
+                       if (ctx->active_entry_count <= 1) {
+                               /* last item */
+                               ctx->active_entry_head = NULL;
+                               ctx->active_entry_count = 0;
+                       } else {
+                               entry->prev->next = entry->next;
+                               entry->next->prev = entry->prev;
+                               if (entry == ctx->active_entry_head) {
+                                       ctx->active_entry_head = entry->next;
+                               }
+                               ctx->active_entry_count--;
+                       }
+                       entry->next = entry->prev = NULL;
+               } else {
+                       DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               }
+       }
+       return rc;
+} /* _dhd_wlfc_mac_entry_update */
+
+#ifdef LIMIT_BORROW
+
+/** LIMIT_BORROW specific function */
+static int
+_dhd_wlfc_borrow_credit(athost_wl_status_info_t* ctx, int highest_lender_ac, int borrower_ac,
+       bool bBorrowAll)
+{
+       int lender_ac, borrow_limit = 0;
+       int rc = -1;
+
+       if (ctx == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return -1;
+       }
+
+       /* Borrow from lowest priority available AC (including BC/MC credits) */
+       for (lender_ac = 0; lender_ac <= highest_lender_ac; lender_ac++) {
+               if (!bBorrowAll) {
+                       borrow_limit = ctx->Init_FIFO_credit[lender_ac]/WLFC_BORROW_LIMIT_RATIO;
+               } else {
+                       borrow_limit = 0;
+               }
+
+               if (ctx->FIFO_credit[lender_ac] > borrow_limit) {
+                       ctx->credits_borrowed[borrower_ac][lender_ac]++;
+                       ctx->FIFO_credit[lender_ac]--;
+                       rc = lender_ac;
+                       break;
+               }
+       }
+
+       return rc;
+}
+
+/** LIMIT_BORROW specific function */
+static int _dhd_wlfc_return_credit(athost_wl_status_info_t* ctx, int lender_ac, int borrower_ac)
+{
+       if ((ctx == NULL) || (lender_ac < 0) || (lender_ac > AC_COUNT) ||
+               (borrower_ac < 0) || (borrower_ac > AC_COUNT)) {
+               DHD_ERROR(("Error: %s():%d, ctx(%p), lender_ac(%d), borrower_ac(%d)\n",
+                       __FUNCTION__, __LINE__, ctx, lender_ac, borrower_ac));
+
+               return BCME_BADARG;
+       }
+
+       ctx->credits_borrowed[borrower_ac][lender_ac]--;
+       ctx->FIFO_credit[lender_ac]++;
+
+       return BCME_OK;
+}
+
+#endif /* LIMIT_BORROW */
+
+/**
+ * Called on an interface event (WLC_E_IF) indicated by firmware.
+ *     @param action : eg eWLFC_MAC_ENTRY_ACTION_UPDATE or eWLFC_MAC_ENTRY_ACTION_ADD
+ */
+static int
+_dhd_wlfc_interface_entry_update(void* state,
+       uint8 action, uint8 ifid, uint8 iftype, uint8* ea)
+{
+       athost_wl_status_info_t* ctx = (athost_wl_status_info_t*)state;
+       wlfc_mac_descriptor_t* entry;
+
+       if (ifid >= WLFC_MAX_IFNUM)
+               return BCME_BADARG;
+
+       entry = &ctx->destination_entries.interfaces[ifid];
+
+       return _dhd_wlfc_mac_entry_update(ctx, entry, action, ifid, iftype, ea,
+               _dhd_wlfc_ifpkt_fn, &ifid);
+}
+
+/**
+ * Called eg on receiving a WLC_E_BCMC_CREDIT_SUPPORT event from the dongle (broadcast/multicast
+ * specific)
+ */
+static int
+_dhd_wlfc_BCMCCredit_support_update(void* state)
+{
+       athost_wl_status_info_t* ctx = (athost_wl_status_info_t*)state;
+
+       ctx->bcmc_credit_supported = TRUE;
+       return BCME_OK;
+}
+
+/** Called eg on receiving a WLC_E_FIFO_CREDIT_MAP event from the dongle */
+static int
+_dhd_wlfc_FIFOcreditmap_update(void* state, uint8* credits)
+{
+       athost_wl_status_info_t* ctx = (athost_wl_status_info_t*)state;
+       int i;
+
+       for (i = 0; i <= 4; i++) {
+               if (ctx->Init_FIFO_credit[i] != ctx->FIFO_credit[i]) {
+                       DHD_ERROR(("%s: credit[i] is not returned, (%d %d)\n",
+                               __FUNCTION__, ctx->Init_FIFO_credit[i], ctx->FIFO_credit[i]));
+               }
+       }
+
+       /* update the AC FIFO credit map */
+       ctx->FIFO_credit[0] += (credits[0] - ctx->Init_FIFO_credit[0]);
+       ctx->FIFO_credit[1] += (credits[1] - ctx->Init_FIFO_credit[1]);
+       ctx->FIFO_credit[2] += (credits[2] - ctx->Init_FIFO_credit[2]);
+       ctx->FIFO_credit[3] += (credits[3] - ctx->Init_FIFO_credit[3]);
+       ctx->FIFO_credit[4] += (credits[4] - ctx->Init_FIFO_credit[4]);
+
+       ctx->Init_FIFO_credit[0] = credits[0];
+       ctx->Init_FIFO_credit[1] = credits[1];
+       ctx->Init_FIFO_credit[2] = credits[2];
+       ctx->Init_FIFO_credit[3] = credits[3];
+       ctx->Init_FIFO_credit[4] = credits[4];
+
+       /* credit for ATIM FIFO is not used yet. */
+       ctx->Init_FIFO_credit[5] = ctx->FIFO_credit[5] = 0;
+
+       return BCME_OK;
+}
+
+/**
+ * Called during committing of a transmit packet from the OS DHD layer to the next layer towards
+ * the dongle (eg the DBUS layer). All transmit packets flow via this function to the next layer.
+ *
+ *     @param[in/out] ctx      Driver specific flow control administration
+ *     @param[in] ac           Access Category (QoS) of called supplied packet
+ *     @param[in] commit_info  Contains eg the packet to send
+ *     @param[in] fcommit      Function pointer to transmit function of next software layer
+ *     @param[in] commit_ctx   Opaque context used when calling next layer
+ */
+static int
+_dhd_wlfc_handle_packet_commit(athost_wl_status_info_t* ctx, int ac,
+    dhd_wlfc_commit_info_t *commit_info, f_commitpkt_t fcommit, void* commit_ctx)
+{
+       uint32 hslot;
+       int     rc;
+       dhd_pub_t *dhdp = (dhd_pub_t *)(ctx->dhdp);
+
+       /*
+               if ac_fifo_credit_spent = 0
+
+               This packet will not count against the FIFO credit.
+               To ensure the txstatus corresponding to this packet
+               does not provide an implied credit (default behavior)
+               mark the packet accordingly.
+
+               if ac_fifo_credit_spent = 1
+
+               This is a normal packet and it counts against the FIFO
+               credit count.
+       */
+       DHD_PKTTAG_SETCREDITCHECK(PKTTAG(commit_info->p), commit_info->ac_fifo_credit_spent);
+       rc = _dhd_wlfc_pretx_pktprocess(ctx, commit_info->mac_entry, &commit_info->p,
+            commit_info->needs_hdr, &hslot);
+
+       if (rc == BCME_OK) {
+               rc = fcommit(commit_ctx, commit_info->p);
+               if (rc == BCME_OK) {
+                       uint8 gen = WL_TXSTATUS_GET_GENERATION(
+                               DHD_PKTTAG_H2DTAG(PKTTAG(commit_info->p)));
+                       ctx->stats.pkt2bus++;
+                       if (commit_info->ac_fifo_credit_spent || (ac == AC_COUNT)) {
+                               ctx->stats.send_pkts[ac]++;
+                               WLFC_HOST_FIFO_CREDIT_INC_SENTCTRS(ctx, ac);
+                       }
+
+                       if (gen != commit_info->mac_entry->generation) {
+                               /* will be suppressed back by design */
+                               if (!commit_info->mac_entry->suppressed) {
+                                       commit_info->mac_entry->suppressed = TRUE;
+                               }
+                               commit_info->mac_entry->suppr_transit_count++;
+                       }
+                       commit_info->mac_entry->transit_count++;
+                       commit_info->mac_entry->onbus_pkts_count++;
+               } else if (commit_info->needs_hdr) {
+                       if (!WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+                               void *pout = NULL;
+                               /* pop hanger for delayed packet */
+                               _dhd_wlfc_hanger_poppkt(ctx->hanger, WL_TXSTATUS_GET_HSLOT(
+                                       DHD_PKTTAG_H2DTAG(PKTTAG(commit_info->p))), &pout, TRUE);
+                               ASSERT(commit_info->p == pout);
+                       }
+               }
+       } else {
+               ctx->stats.generic_error++;
+       }
+
+       if (rc != BCME_OK) {
+               /*
+                  pretx pkt process or bus commit has failed, rollback.
+                  - remove wl-header for a delayed packet
+                  - save wl-header header for suppressed packets
+                  - reset credit check flag
+               */
+               _dhd_wlfc_rollback_packet_toq(ctx, commit_info->p, commit_info->pkt_type, hslot);
+               DHD_PKTTAG_SETCREDITCHECK(PKTTAG(commit_info->p), 0);
+       }
+
+       return rc;
+} /* _dhd_wlfc_handle_packet_commit */
+
+/** Returns remote MAC descriptor for caller supplied MAC address */
+static uint8
+_dhd_wlfc_find_mac_desc_id_from_mac(dhd_pub_t *dhdp, uint8 *ea)
+{
+       wlfc_mac_descriptor_t* table =
+               ((athost_wl_status_info_t*)dhdp->wlfc_state)->destination_entries.nodes;
+       uint8 table_index;
+
+       if (ea != NULL) {
+               for (table_index = 0; table_index < WLFC_MAC_DESC_TABLE_SIZE; table_index++) {
+                       if ((memcmp(ea, &table[table_index].ea[0], ETHER_ADDR_LEN) == 0) &&
+                               table[table_index].occupied)
+                               return table_index;
+               }
+       }
+       return WLFC_MAC_DESC_ID_INVALID;
+}
+
+/**
+ * Called when the host receives a WLFC_CTL_TYPE_TXSTATUS event from the dongle, indicating the
+ * status of a frame that the dongle attempted to transmit over the wireless medium.
+ */
+static int
+dhd_wlfc_suppressed_acked_update(dhd_pub_t *dhd, uint16 hslot, uint8 prec, uint8 hcnt)
+{
+       athost_wl_status_info_t* ctx;
+       wlfc_mac_descriptor_t* entry = NULL;
+       struct pktq *pq;
+       struct pktq_prec *q;
+       void *p, *b;
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd(%p)\n", __FUNCTION__, dhd));
+               return BCME_BADARG;
+       }
+       ctx = (athost_wl_status_info_t*)dhd->wlfc_state;
+       if (!ctx) {
+               DHD_ERROR(("%s: ctx(%p)\n", __FUNCTION__, ctx));
+               return BCME_ERROR;
+       }
+
+       ASSERT(hslot < (WLFC_MAC_DESC_TABLE_SIZE + WLFC_MAX_IFNUM + 1));
+
+       if (hslot < WLFC_MAC_DESC_TABLE_SIZE)
+               entry  = &ctx->destination_entries.nodes[hslot];
+       else if (hslot < (WLFC_MAC_DESC_TABLE_SIZE + WLFC_MAX_IFNUM))
+               entry = &ctx->destination_entries.interfaces[hslot - WLFC_MAC_DESC_TABLE_SIZE];
+       else
+               entry = &ctx->destination_entries.other;
+
+       pq = &entry->psq;
+
+       ASSERT(((prec << 1) + 1) < pq->num_prec);
+
+       q = &pq->q[((prec << 1) + 1)];
+
+       b = NULL;
+       p = q->head;
+
+       while (p && (hcnt != WL_TXSTATUS_GET_FREERUNCTR(DHD_PKTTAG_H2DTAG(PKTTAG(p))))) {
+               b = p;
+               p = PKTLINK(p);
+       }
+
+       if (p == NULL) {
+               /* none is matched */
+               if (b) {
+                       DHD_ERROR(("%s: can't find matching seq(%d)\n", __FUNCTION__, hcnt));
+               } else {
+                       DHD_ERROR(("%s: queue is empty\n", __FUNCTION__));
+               }
+
+               return BCME_ERROR;
+       }
+
+       if (!b) {
+               /* head packet is matched */
+               if ((q->head = PKTLINK(p)) == NULL) {
+                       q->tail = NULL;
+               }
+       } else {
+               /* middle packet is matched */
+               PKTSETLINK(b, PKTLINK(p));
+               if (PKTLINK(p) == NULL) {
+                       q->tail = b;
+               }
+       }
+
+       q->n_pkts--;
+       pq->n_pkts_tot--;
+
+#ifdef WL_TXQ_STALL
+       q->dequeue_count++;
+#endif
+
+       ctx->pkt_cnt_in_q[DHD_PKTTAG_IF(PKTTAG(p))][prec]--;
+       ctx->pkt_cnt_per_ac[prec]--;
+
+       PKTSETLINK(p, NULL);
+
+       if (WLFC_GET_AFQ(dhd->wlfc_mode)) {
+               _dhd_wlfc_enque_afq(ctx, p);
+       } else {
+               _dhd_wlfc_hanger_pushpkt(ctx->hanger, p, hslot);
+       }
+
+       entry->transit_count++;
+
+       return BCME_OK;
+}
+
+static int
+_dhd_wlfc_compressed_txstatus_update(dhd_pub_t *dhd, uint8* pkt_info, uint8 len, void** p_mac)
+{
+       uint8 status_flag_ori, status_flag;
+       uint32 status;
+       int ret = BCME_OK;
+       int remove_from_hanger_ori, remove_from_hanger = 1;
+       void* pktbuf = NULL;
+       uint8 fifo_id = 0, gen = 0, count = 0, hcnt;
+       uint16 hslot;
+       wlfc_mac_descriptor_t* entry = NULL;
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       uint16 seq = 0, seq_fromfw = 0, seq_num = 0;
+
+       memcpy(&status, pkt_info, sizeof(uint32));
+       status = ltoh32(status);
+       status_flag = WL_TXSTATUS_GET_FLAGS(status);
+       hcnt = WL_TXSTATUS_GET_FREERUNCTR(status);
+       hslot = WL_TXSTATUS_GET_HSLOT(status);
+       fifo_id = WL_TXSTATUS_GET_FIFO(status);
+       gen = WL_TXSTATUS_GET_GENERATION(status);
+
+       if (WLFC_GET_REUSESEQ(dhd->wlfc_mode)) {
+               memcpy(&seq, pkt_info + WLFC_CTL_VALUE_LEN_TXSTATUS, WLFC_CTL_VALUE_LEN_SEQ);
+               seq = ltoh16(seq);
+               seq_fromfw = GET_WL_HAS_ASSIGNED_SEQ(seq);
+               seq_num = WL_SEQ_GET_NUM(seq);
+       }
+
+       wlfc->stats.txstatus_in += len;
+
+       if (status_flag == WLFC_CTL_PKTFLAG_DISCARD) {
+               wlfc->stats.pkt_freed += len;
+       } else if (status_flag == WLFC_CTL_PKTFLAG_DISCARD_NOACK) {
+               wlfc->stats.pkt_freed += len;
+       } else if (status_flag == WLFC_CTL_PKTFLAG_D11SUPPRESS) {
+               wlfc->stats.d11_suppress += len;
+               remove_from_hanger = 0;
+       } else if (status_flag == WLFC_CTL_PKTFLAG_WLSUPPRESS) {
+               wlfc->stats.wl_suppress += len;
+               remove_from_hanger = 0;
+       } else if (status_flag == WLFC_CTL_PKTFLAG_TOSSED_BYWLC) {
+               wlfc->stats.wlc_tossed_pkts += len;
+       } else if (status_flag == WLFC_CTL_PKTFLAG_SUPPRESS_ACKED) {
+               wlfc->stats.pkt_freed += len;
+       } else if (status_flag == WLFC_CTL_PKTFLAG_EXPIRED) {
+               wlfc->stats.pkt_exptime += len;
+       } else if (status_flag == WLFC_CTL_PKTFLAG_DROPPED) {
+               wlfc->stats.pkt_dropped += len;
+       }
+
+       if (dhd->proptxstatus_txstatus_ignore) {
+               if (!remove_from_hanger) {
+                       DHD_ERROR(("suppress txstatus: %d\n", status_flag));
+               }
+               return BCME_OK;
+       }
+
+       status_flag_ori = status_flag;
+       remove_from_hanger_ori = remove_from_hanger;
+
+       while (count < len) {
+               if (status_flag == WLFC_CTL_PKTFLAG_SUPPRESS_ACKED) {
+                       dhd_wlfc_suppressed_acked_update(dhd, hslot, fifo_id, hcnt);
+               }
+               if (WLFC_GET_AFQ(dhd->wlfc_mode)) {
+                       ret = _dhd_wlfc_deque_afq(wlfc, hslot, hcnt, fifo_id, &pktbuf);
+               } else {
+                       status_flag = status_flag_ori;
+                       remove_from_hanger = remove_from_hanger_ori;
+                       ret = _dhd_wlfc_hanger_poppkt(wlfc->hanger, hslot, &pktbuf, FALSE);
+                       if (!pktbuf) {
+                               _dhd_wlfc_hanger_free_pkt(wlfc, hslot,
+                                       WLFC_HANGER_PKT_STATE_TXSTATUS, -1);
+                               goto cont;
+                       } else {
+                               wlfc_hanger_t* h = (wlfc_hanger_t*)wlfc->hanger;
+                               if (h->items[hslot].state == WLFC_HANGER_ITEM_STATE_FLUSHED) {
+                                       status_flag = WLFC_CTL_PKTFLAG_DISCARD;
+                                       remove_from_hanger = 1;
+                               }
+                       }
+               }
+
+               if ((ret != BCME_OK) || !pktbuf) {
+                       goto cont;
+               }
+
+               bcm_pkt_validate_chk(pktbuf, "_dhd_wlfc_compressed_txstatus_update");
+
+               /* set fifo_id to correct value because not all FW does that */
+               fifo_id = DHD_PKTTAG_FIFO(PKTTAG(pktbuf));
+
+               entry = _dhd_wlfc_find_table_entry(wlfc, pktbuf);
+
+               if (!remove_from_hanger) {
+                       /* this packet was suppressed */
+                       if (!entry->suppressed || (entry->generation != gen)) {
+                               if (!entry->suppressed) {
+                                       entry->suppr_transit_count = entry->transit_count;
+                                       if (p_mac) {
+                                               *p_mac = entry;
+                                       }
+                               } else {
+                                       DHD_ERROR(("gen(%d), entry->generation(%d)\n",
+                                               gen, entry->generation));
+                               }
+                               entry->suppressed = TRUE;
+
+                       }
+                       entry->generation = gen;
+               }
+
+#ifdef PROP_TXSTATUS_DEBUG
+               if (!WLFC_GET_AFQ(dhd->wlfc_mode))
+               {
+                       uint32 new_t = OSL_SYSUPTIME();
+                       uint32 old_t;
+                       uint32 delta;
+                       old_t = ((wlfc_hanger_t*)(wlfc->hanger))->items[hslot].push_time;
+
+                       wlfc->stats.latency_sample_count++;
+                       if (new_t > old_t)
+                               delta = new_t - old_t;
+                       else
+                               delta = 0xffffffff + new_t - old_t;
+                       wlfc->stats.total_status_latency += delta;
+                       wlfc->stats.latency_most_recent = delta;
+
+                       wlfc->stats.deltas[wlfc->stats.idx_delta++] = delta;
+                       if (wlfc->stats.idx_delta == sizeof(wlfc->stats.deltas)/sizeof(uint32))
+                               wlfc->stats.idx_delta = 0;
+               }
+#endif /* PROP_TXSTATUS_DEBUG */
+
+               /* pick up the implicit credit from this packet */
+               if (DHD_PKTTAG_CREDITCHECK(PKTTAG(pktbuf))) {
+                       _dhd_wlfc_return_implied_credit(wlfc, pktbuf);
+               } else {
+                       /*
+                       if this packet did not count against FIFO credit, it must have
+                       taken a requested_credit from the destination entry (for pspoll etc.)
+                       */
+                       if (!DHD_PKTTAG_ONETIMEPKTRQST(PKTTAG(pktbuf))) {
+                               entry->requested_credit++;
+#if defined(DHD_WLFC_THREAD)
+                               _dhd_wlfc_thread_wakeup(dhd);
+#endif /* DHD_WLFC_THREAD */
+                       }
+#ifdef PROP_TXSTATUS_DEBUG
+                       entry->dstncredit_acks++;
+#endif
+               }
+
+               if ((status_flag == WLFC_CTL_PKTFLAG_D11SUPPRESS) ||
+                       (status_flag == WLFC_CTL_PKTFLAG_WLSUPPRESS)) {
+                       /* save generation bit inside packet */
+                       WL_TXSTATUS_SET_GENERATION(DHD_PKTTAG_H2DTAG(PKTTAG(pktbuf)), gen);
+
+                       if (WLFC_GET_REUSESEQ(dhd->wlfc_mode)) {
+                               WL_SEQ_SET_REUSE(DHD_PKTTAG_H2DSEQ(PKTTAG(pktbuf)), seq_fromfw);
+                               WL_SEQ_SET_NUM(DHD_PKTTAG_H2DSEQ(PKTTAG(pktbuf)), seq_num);
+                       }
+
+                       ret = _dhd_wlfc_enque_suppressed(wlfc, fifo_id, pktbuf);
+                       if (ret != BCME_OK) {
+                               /* delay q is full, drop this packet */
+                               DHD_WLFC_QMON_COMPLETE(entry);
+                               _dhd_wlfc_prec_drop(dhd, (fifo_id << 1) + 1, pktbuf, FALSE);
+                       } else {
+                               if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+                                       /* Mark suppressed to avoid a double free
+                                       during wlfc cleanup
+                                       */
+                                       _dhd_wlfc_hanger_mark_suppressed(wlfc->hanger, hslot, gen);
+                               }
+                       }
+               } else {
+
+                       DHD_WLFC_QMON_COMPLETE(entry);
+
+                       if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+                               _dhd_wlfc_hanger_free_pkt(wlfc, hslot,
+                                       WLFC_HANGER_PKT_STATE_TXSTATUS, TRUE);
+                       } else {
+                               dhd_txcomplete(dhd, pktbuf, TRUE);
+                               wlfc->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(pktbuf))]
+                                       [DHD_PKTTAG_FIFO(PKTTAG(pktbuf))]--;
+                               wlfc->stats.pktout++;
+                               /* free the packet */
+                               PKTFREE(wlfc->osh, pktbuf, TRUE);
+                       }
+               }
+               /* pkt back from firmware side */
+               if (entry->transit_count)
+                       entry->transit_count--;
+               if (entry->suppr_transit_count) {
+                       entry->suppr_transit_count--;
+                       if (entry->suppressed &&
+                               (!entry->onbus_pkts_count) &&
+                               (!entry->suppr_transit_count))
+                               entry->suppressed = FALSE;
+               }
+
+cont:
+               hcnt = (hcnt + 1) & WL_TXSTATUS_FREERUNCTR_MASK;
+               if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+                       hslot = (hslot + 1) & WL_TXSTATUS_HSLOT_MASK;
+               }
+
+               if (WLFC_GET_REUSESEQ(dhd->wlfc_mode) && seq_fromfw) {
+                       seq_num = (seq_num + 1) & WL_SEQ_NUM_MASK;
+               }
+
+               count++;
+       }
+
+       return BCME_OK;
+} /* _dhd_wlfc_compressed_txstatus_update */
+
+/**
+ * Called when eg host receives a 'WLFC_CTL_TYPE_FIFO_CREDITBACK' event from the dongle.
+ *    @param[in] credits caller supplied credit that will be added to the host credit.
+ */
+static int
+_dhd_wlfc_fifocreditback_indicate(dhd_pub_t *dhd, uint8* credits)
+{
+       int i;
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       for (i = 0; i < WLFC_CTL_VALUE_LEN_FIFO_CREDITBACK; i++) {
+#ifdef PROP_TXSTATUS_DEBUG
+               wlfc->stats.fifo_credits_back[i] += credits[i];
+#endif
+
+               /* update FIFO credits */
+               if (dhd->proptxstatus_mode == WLFC_FCMODE_EXPLICIT_CREDIT)
+               {
+                       int lender; /* Note that borrower is i */
+
+                       /* Return credits to highest priority lender first */
+                       for (lender = AC_COUNT; (lender >= 0) && (credits[i] > 0); lender--) {
+                               if (wlfc->credits_borrowed[i][lender] > 0) {
+                                       if (credits[i] >= wlfc->credits_borrowed[i][lender]) {
+                                               credits[i] -=
+                                                       (uint8)wlfc->credits_borrowed[i][lender];
+                                               wlfc->FIFO_credit[lender] +=
+                                                   wlfc->credits_borrowed[i][lender];
+                                               wlfc->credits_borrowed[i][lender] = 0;
+                                       } else {
+                                               wlfc->credits_borrowed[i][lender] -= credits[i];
+                                               wlfc->FIFO_credit[lender] += credits[i];
+                                               credits[i] = 0;
+                                       }
+                               }
+                       }
+
+                       /* If we have more credits left over, these must belong to the AC */
+                       if (credits[i] > 0) {
+                               wlfc->FIFO_credit[i] += credits[i];
+                       }
+
+                       if (wlfc->FIFO_credit[i] > wlfc->Init_FIFO_credit[i]) {
+                               wlfc->FIFO_credit[i] = wlfc->Init_FIFO_credit[i];
+                       }
+               }
+       }
+
+#if defined(DHD_WLFC_THREAD)
+       _dhd_wlfc_thread_wakeup(dhd);
+#endif /* defined(DHD_WLFC_THREAD) */
+
+       return BCME_OK;
+} /* _dhd_wlfc_fifocreditback_indicate */
+
+#ifndef BCMDBUS
+/** !BCMDBUS specific function */
+static void
+_dhd_wlfc_suppress_txq(dhd_pub_t *dhd, f_processpkt_t fn, void *arg)
+{
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_mac_descriptor_t* entry;
+       int prec;
+       void *pkt = NULL, *head = NULL, *tail = NULL;
+       struct pktq *txq = (struct pktq *)dhd_bus_txq(dhd->bus);
+       uint8   results[WLFC_CTL_VALUE_LEN_TXSTATUS+WLFC_CTL_VALUE_LEN_SEQ];
+       uint8 credits[WLFC_CTL_VALUE_LEN_FIFO_CREDITBACK] = {0};
+       uint32 htod = 0;
+       uint16 htodseq = 0;
+       bool bCreditUpdate = FALSE;
+
+       dhd_os_sdlock_txq(dhd);
+       for (prec = 0; prec < txq->num_prec; prec++) {
+               while ((pkt = _dhd_wlfc_pktq_pdeq_with_fn(txq, prec, fn, arg))) {
+                       if (!head) {
+                               head = pkt;
+                       }
+                       if (tail) {
+                               PKTSETLINK(tail, pkt);
+                       }
+                       tail = pkt;
+               }
+       }
+       dhd_os_sdunlock_txq(dhd);
+
+       while ((pkt = head)) {
+               head = PKTLINK(pkt);
+               PKTSETLINK(pkt, NULL);
+
+               entry = _dhd_wlfc_find_table_entry(wlfc, pkt);
+               if (!entry) {
+                       PKTFREE(dhd->osh, pkt, TRUE);
+                       continue;
+               }
+               if (entry->onbus_pkts_count > 0) {
+                       entry->onbus_pkts_count--;
+               }
+               if (entry->suppressed &&
+                               (!entry->onbus_pkts_count) &&
+                               (!entry->suppr_transit_count)) {
+                       entry->suppressed = FALSE;
+               }
+               /* fake a suppression txstatus */
+               htod = DHD_PKTTAG_H2DTAG(PKTTAG(pkt));
+               WL_TXSTATUS_SET_FLAGS(htod, WLFC_CTL_PKTFLAG_WLSUPPRESS);
+               WL_TXSTATUS_SET_GENERATION(htod, entry->generation);
+               htod = htol32(htod);
+               memcpy(results, &htod, WLFC_CTL_VALUE_LEN_TXSTATUS);
+               if (WLFC_GET_REUSESEQ(dhd->wlfc_mode)) {
+                       htodseq = DHD_PKTTAG_H2DSEQ(PKTTAG(pkt));
+                       if (IS_WL_TO_REUSE_SEQ(htodseq)) {
+                               SET_WL_HAS_ASSIGNED_SEQ(htodseq);
+                               RESET_WL_TO_REUSE_SEQ(htodseq);
+                       }
+                       htodseq = htol16(htodseq);
+                       memcpy(results + WLFC_CTL_VALUE_LEN_TXSTATUS, &htodseq,
+                               WLFC_CTL_VALUE_LEN_SEQ);
+               }
+               if (WLFC_GET_AFQ(dhd->wlfc_mode)) {
+                       _dhd_wlfc_enque_afq(wlfc, pkt);
+               }
+               _dhd_wlfc_compressed_txstatus_update(dhd, results, 1, NULL);
+
+               /* fake a fifo credit back */
+               if (DHD_PKTTAG_CREDITCHECK(PKTTAG(pkt))) {
+                       credits[DHD_PKTTAG_FIFO(PKTTAG(pkt))]++;
+                       bCreditUpdate = TRUE;
+               }
+       }
+
+       if (bCreditUpdate) {
+               _dhd_wlfc_fifocreditback_indicate(dhd, credits);
+       }
+} /* _dhd_wlfc_suppress_txq */
+#endif /* !BCMDBUS */
+
+static int
+_dhd_wlfc_dbg_senum_check(dhd_pub_t *dhd, uint8 *value)
+{
+       uint32 timestamp;
+
+       (void)dhd;
+
+       bcopy(&value[2], &timestamp, sizeof(uint32));
+       timestamp = ltoh32(timestamp);
+       DHD_INFO(("RXPKT: SEQ: %d, timestamp %d\n", value[1], timestamp));
+       return BCME_OK;
+}
+
+static int
+_dhd_wlfc_rssi_indicate(dhd_pub_t *dhd, uint8* rssi)
+{
+       (void)dhd;
+       (void)rssi;
+       return BCME_OK;
+}
+
+static void
+_dhd_wlfc_add_requested_entry(athost_wl_status_info_t* wlfc, wlfc_mac_descriptor_t* entry)
+{
+       int i;
+
+       if (!wlfc || !entry) {
+               return;
+       }
+
+       for (i = 0; i < wlfc->requested_entry_count; i++) {
+               if (entry == wlfc->requested_entry[i]) {
+                       break;
+               }
+       }
+
+       if (i == wlfc->requested_entry_count) {
+               /* no match entry found */
+               ASSERT(wlfc->requested_entry_count <= (WLFC_MAC_DESC_TABLE_SIZE-1));
+               wlfc->requested_entry[wlfc->requested_entry_count++] = entry;
+       }
+}
+
+/** called on eg receiving 'mac open' event from the dongle. */
+static void
+_dhd_wlfc_remove_requested_entry(athost_wl_status_info_t* wlfc, wlfc_mac_descriptor_t* entry)
+{
+       int i;
+
+       if (!wlfc || !entry) {
+               return;
+       }
+
+       for (i = 0; i < wlfc->requested_entry_count; i++) {
+               if (entry == wlfc->requested_entry[i]) {
+                       break;
+               }
+       }
+
+       if (i < wlfc->requested_entry_count) {
+               /* found */
+               ASSERT(wlfc->requested_entry_count > 0);
+               wlfc->requested_entry_count--;
+               if (i != wlfc->requested_entry_count) {
+                       wlfc->requested_entry[i] =
+                               wlfc->requested_entry[wlfc->requested_entry_count];
+               }
+               wlfc->requested_entry[wlfc->requested_entry_count] = NULL;
+       }
+}
+
+/** called on eg receiving a WLFC_CTL_TYPE_MACDESC_ADD TLV from the dongle */
+static int
+_dhd_wlfc_mac_table_update(dhd_pub_t *dhd, uint8* value, uint8 type)
+{
+       int rc;
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_mac_descriptor_t* table;
+       uint8 existing_index;
+       uint8 table_index;
+       uint8 ifid;
+       uint8* ea;
+
+       WLFC_DBGMESG(("%s(), mac ["MACDBG"],%s,idx:%d,id:0x%02x\n",
+               __FUNCTION__, MAC2STRDBG(&value[2]),
+               ((type == WLFC_CTL_TYPE_MACDESC_ADD) ? "ADD":"DEL"),
+               WLFC_MAC_DESC_GET_LOOKUP_INDEX(value[0]), value[0]));
+
+       table = wlfc->destination_entries.nodes;
+       table_index = WLFC_MAC_DESC_GET_LOOKUP_INDEX(value[0]);
+       ifid = value[1];
+       ea = &value[2];
+
+       _dhd_wlfc_remove_requested_entry(wlfc, &table[table_index]);
+       if (type == WLFC_CTL_TYPE_MACDESC_ADD) {
+               existing_index = _dhd_wlfc_find_mac_desc_id_from_mac(dhd, &value[2]);
+               if ((existing_index != WLFC_MAC_DESC_ID_INVALID) &&
+                       (existing_index != table_index) && table[existing_index].occupied) {
+                       /*
+                       there is an existing different entry, free the old one
+                       and move it to new index if necessary.
+                       */
+                       rc = _dhd_wlfc_mac_entry_update(wlfc, &table[existing_index],
+                               eWLFC_MAC_ENTRY_ACTION_DEL, table[existing_index].interface_id,
+                               table[existing_index].iftype, NULL, _dhd_wlfc_entrypkt_fn,
+                               &table[existing_index]);
+               }
+
+               if (!table[table_index].occupied) {
+                       /* this new MAC entry does not exist, create one */
+                       table[table_index].mac_handle = value[0];
+                       rc = _dhd_wlfc_mac_entry_update(wlfc, &table[table_index],
+                               eWLFC_MAC_ENTRY_ACTION_ADD, ifid,
+                               wlfc->destination_entries.interfaces[ifid].iftype,
+                               ea, NULL, NULL);
+               } else {
+                       /* the space should have been empty, but it's not */
+                       wlfc->stats.mac_update_failed++;
+               }
+       }
+
+       if (type == WLFC_CTL_TYPE_MACDESC_DEL) {
+               if (table[table_index].occupied) {
+                               rc = _dhd_wlfc_mac_entry_update(wlfc, &table[table_index],
+                                       eWLFC_MAC_ENTRY_ACTION_DEL, ifid,
+                                       wlfc->destination_entries.interfaces[ifid].iftype,
+                                       ea, _dhd_wlfc_entrypkt_fn, &table[table_index]);
+               } else {
+                       /* the space should have been occupied, but it's not */
+                       wlfc->stats.mac_update_failed++;
+               }
+       }
+       BCM_REFERENCE(rc);
+       return BCME_OK;
+} /* _dhd_wlfc_mac_table_update */
+
+/** Called on a 'mac open' or 'mac close' event indicated by the dongle */
+static int
+_dhd_wlfc_psmode_update(dhd_pub_t *dhd, uint8* value, uint8 type)
+{
+       /* Handle PS on/off indication */
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_mac_descriptor_t* table;
+       wlfc_mac_descriptor_t* desc; /* a table maps from mac handle to mac descriptor */
+       uint8 mac_handle = value[0];
+       int i;
+
+       table = wlfc->destination_entries.nodes;
+       desc = &table[WLFC_MAC_DESC_GET_LOOKUP_INDEX(mac_handle)];
+       if (desc->occupied) {
+               if (type == WLFC_CTL_TYPE_MAC_OPEN) {
+                       desc->state = WLFC_STATE_OPEN;
+                       desc->ac_bitmap = 0xff;
+                       DHD_WLFC_CTRINC_MAC_OPEN(desc);
+                       desc->requested_credit = 0;
+                       desc->requested_packet = 0;
+                       _dhd_wlfc_remove_requested_entry(wlfc, desc);
+               } else {
+                       desc->state = WLFC_STATE_CLOSE;
+                       DHD_WLFC_CTRINC_MAC_CLOSE(desc);
+                       /* Indicate to firmware if there is any traffic pending. */
+                       for (i = 0; i < AC_COUNT; i++) {
+                               _dhd_wlfc_traffic_pending_check(wlfc, desc, i);
+                       }
+               }
+       } else {
+               wlfc->stats.psmode_update_failed++;
+       }
+
+       return BCME_OK;
+} /* _dhd_wlfc_psmode_update */
+
+/** called upon receiving 'interface open' or 'interface close' event from the dongle */
+static int
+_dhd_wlfc_interface_update(dhd_pub_t *dhd, uint8* value, uint8 type)
+{
+       /* Handle PS on/off indication */
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_mac_descriptor_t* table;
+       uint8 if_id = value[0];
+
+       if (if_id < WLFC_MAX_IFNUM) {
+               table = wlfc->destination_entries.interfaces;
+               if (table[if_id].occupied) {
+                       if (type == WLFC_CTL_TYPE_INTERFACE_OPEN) {
+                               table[if_id].state = WLFC_STATE_OPEN;
+                               /* WLFC_DBGMESG(("INTERFACE[%d] OPEN\n", if_id)); */
+                       } else {
+                               table[if_id].state = WLFC_STATE_CLOSE;
+                               /* WLFC_DBGMESG(("INTERFACE[%d] CLOSE\n", if_id)); */
+                       }
+                       return BCME_OK;
+               }
+       }
+       wlfc->stats.interface_update_failed++;
+
+       /* XXX: what is an appropriate error? */
+       return BCME_OK;
+}
+
+/** Called on receiving a WLFC_CTL_TYPE_MAC_REQUEST_CREDIT TLV from the dongle */
+static int
+_dhd_wlfc_credit_request(dhd_pub_t *dhd, uint8* value)
+{
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_mac_descriptor_t* table;
+       wlfc_mac_descriptor_t* desc;
+       uint8 mac_handle;
+       uint8 credit;
+
+       table = wlfc->destination_entries.nodes;
+       mac_handle = value[1];
+       credit = value[0];
+
+       desc = &table[WLFC_MAC_DESC_GET_LOOKUP_INDEX(mac_handle)];
+       if (desc->occupied) {
+               desc->requested_credit = credit;
+
+               /* XXX: toggle AC prec bitmap based on received bmp, exclude ac/bc pkt */
+               desc->ac_bitmap = value[2] & (~(1<<AC_COUNT));
+               _dhd_wlfc_add_requested_entry(wlfc, desc);
+#if defined(DHD_WLFC_THREAD)
+               if (credit) {
+                       _dhd_wlfc_thread_wakeup(dhd);
+               }
+#endif /* DHD_WLFC_THREAD */
+       } else {
+               wlfc->stats.credit_request_failed++;
+       }
+
+       return BCME_OK;
+}
+
+/** Called on receiving a WLFC_CTL_TYPE_MAC_REQUEST_PACKET TLV from the dongle */
+static int
+_dhd_wlfc_packet_request(dhd_pub_t *dhd, uint8* value)
+{
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_mac_descriptor_t* table;
+       wlfc_mac_descriptor_t* desc;
+       uint8 mac_handle;
+       uint8 packet_count;
+
+       table = wlfc->destination_entries.nodes;
+       mac_handle = value[1];
+       packet_count = value[0];
+
+       desc = &table[WLFC_MAC_DESC_GET_LOOKUP_INDEX(mac_handle)];
+       if (desc->occupied) {
+               desc->requested_packet = packet_count;
+
+               /* XXX: toggle AC prec bitmap based on received bmp, exclude ac/bc pkt */
+               desc->ac_bitmap = value[2] & (~(1<<AC_COUNT));
+               _dhd_wlfc_add_requested_entry(wlfc, desc);
+#if defined(DHD_WLFC_THREAD)
+               if (packet_count) {
+                       _dhd_wlfc_thread_wakeup(dhd);
+               }
+#endif /* DHD_WLFC_THREAD */
+       } else {
+               wlfc->stats.packet_request_failed++;
+       }
+
+       return BCME_OK;
+}
+
+/** Called when host receives a WLFC_CTL_TYPE_HOST_REORDER_RXPKTS TLV from the dongle */
+static void
+_dhd_wlfc_reorderinfo_indicate(uint8 *val, uint8 len, uchar *info_buf, uint *info_len)
+{
+       if (info_len) {
+               /* Check copy length to avoid buffer overrun. In case of length exceeding
+               *  WLHOST_REORDERDATA_TOTLEN, return failure instead sending incomplete result
+               *  of length WLHOST_REORDERDATA_TOTLEN
+               */
+               if ((info_buf) && (len <= WLHOST_REORDERDATA_TOTLEN)) {
+                       bcopy(val, info_buf, len);
+                       *info_len = len;
+               } else {
+                       *info_len = 0;
+               }
+       }
+}
+
+/*
+ * public functions
+ */
+
+bool dhd_wlfc_is_supported(dhd_pub_t *dhd)
+{
+       bool rc = TRUE;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return FALSE;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               rc =  FALSE;
+       }
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return rc;
+}
+
+int dhd_wlfc_enable(dhd_pub_t *dhd)
+{
+       int i, rc = BCME_OK;
+       athost_wl_status_info_t* wlfc;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_enabled || dhd->wlfc_state) {
+               rc = BCME_OK;
+               goto exit;
+       }
+
+       /* allocate space to track txstatus propagated from firmware */
+       dhd->wlfc_state = DHD_OS_PREALLOC(dhd, DHD_PREALLOC_DHD_WLFC_INFO,
+               sizeof(athost_wl_status_info_t));
+       if (dhd->wlfc_state == NULL) {
+               rc = BCME_NOMEM;
+               goto exit;
+       }
+
+       /* initialize state space */
+       wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       memset(wlfc, 0, sizeof(athost_wl_status_info_t));
+
+       /* remember osh & dhdp */
+       wlfc->osh = dhd->osh;
+       wlfc->dhdp = dhd;
+
+       if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+               wlfc->hanger = _dhd_wlfc_hanger_create(dhd, WLFC_HANGER_MAXITEMS);
+               if (wlfc->hanger == NULL) {
+                       DHD_OS_PREFREE(dhd, dhd->wlfc_state,
+                               sizeof(athost_wl_status_info_t));
+                       dhd->wlfc_state = NULL;
+                       rc = BCME_NOMEM;
+                       goto exit;
+               }
+       }
+
+       dhd->proptxstatus_mode = WLFC_FCMODE_EXPLICIT_CREDIT;
+       /* default to check rx pkt */
+       dhd->wlfc_rxpkt_chk = TRUE;
+       if (dhd->op_mode & DHD_FLAG_IBSS_MODE) {
+               dhd->wlfc_rxpkt_chk = FALSE;
+       }
+
+       /* initialize all interfaces to accept traffic */
+       for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+               wlfc->hostif_flow_state[i] = OFF;
+       }
+
+       _dhd_wlfc_mac_entry_update(wlfc, &wlfc->destination_entries.other,
+               eWLFC_MAC_ENTRY_ACTION_ADD, 0xff, 0, NULL, NULL, NULL);
+
+       wlfc->allow_credit_borrow = 0;
+       wlfc->single_ac = 0;
+       wlfc->single_ac_timestamp = 0;
+
+exit:
+       DHD_ERROR(("%s: ret=%d\n", __FUNCTION__, rc));
+       dhd_os_wlfc_unblock(dhd);
+
+       return rc;
+} /* dhd_wlfc_enable */
+
+#ifdef SUPPORT_P2P_GO_PS
+
+/**
+ * Called when the host platform enters a lower power mode, eg right before a system hibernate.
+ * SUPPORT_P2P_GO_PS specific function.
+ */
+int
+dhd_wlfc_suspend(dhd_pub_t *dhd)
+{
+       uint32 tlv = 0;
+
+       DHD_TRACE(("%s: masking wlfc events\n", __FUNCTION__));
+       if (!dhd->wlfc_enabled)
+               return -1;
+
+       if (!dhd_wl_ioctl_get_intiovar(dhd, "tlv", &tlv, WLC_GET_VAR, FALSE, 0))
+               return -1;
+       if ((tlv & (WLFC_FLAGS_RSSI_SIGNALS | WLFC_FLAGS_XONXOFF_SIGNALS)) == 0)
+               return 0;
+       tlv &= ~(WLFC_FLAGS_RSSI_SIGNALS | WLFC_FLAGS_XONXOFF_SIGNALS);
+       if (!dhd_wl_ioctl_set_intiovar(dhd, "tlv", tlv, WLC_SET_VAR, TRUE, 0))
+               return -1;
+
+       return 0;
+}
+
+/**
+ * Called when the host platform resumes from a power management operation, eg resume after a
+ * system hibernate. SUPPORT_P2P_GO_PS specific function.
+ */
+int
+dhd_wlfc_resume(dhd_pub_t *dhd)
+{
+       uint32 tlv = 0;
+
+       DHD_TRACE(("%s: unmasking wlfc events\n", __FUNCTION__));
+       if (!dhd->wlfc_enabled)
+               return -1;
+
+       if (!dhd_wl_ioctl_get_intiovar(dhd, "tlv", &tlv, WLC_GET_VAR, FALSE, 0))
+               return -1;
+       if ((tlv & (WLFC_FLAGS_RSSI_SIGNALS | WLFC_FLAGS_XONXOFF_SIGNALS)) ==
+               (WLFC_FLAGS_RSSI_SIGNALS | WLFC_FLAGS_XONXOFF_SIGNALS))
+               return 0;
+       tlv |= (WLFC_FLAGS_RSSI_SIGNALS | WLFC_FLAGS_XONXOFF_SIGNALS);
+       if (!dhd_wl_ioctl_set_intiovar(dhd, "tlv", tlv, WLC_SET_VAR, TRUE, 0))
+               return -1;
+
+       return 0;
+}
+
+#endif /* SUPPORT_P2P_GO_PS */
+
+/** A flow control header was received from firmware, containing one or more TLVs */
+int
+dhd_wlfc_parse_header_info(dhd_pub_t *dhd, void* pktbuf, int tlv_hdr_len, uchar *reorder_info_buf,
+       uint *reorder_info_len)
+{
+       uint8 type, len;
+       uint8* value;
+       uint8* tmpbuf;
+       uint16 remainder = (uint16)tlv_hdr_len;
+       uint16 processed = 0;
+       athost_wl_status_info_t* wlfc = NULL;
+       void* entry;
+
+       if ((dhd == NULL) || (pktbuf == NULL)) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (dhd->proptxstatus_mode != WLFC_ONLY_AMPDU_HOSTREORDER) {
+               if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+                       dhd_os_wlfc_unblock(dhd);
+                       return WLFC_UNSUPPORTED;
+               }
+               wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       }
+
+       tmpbuf = (uint8*)PKTDATA(dhd->osh, pktbuf);
+
+       if (remainder) {
+               while ((processed < (WLFC_MAX_PENDING_DATALEN * 2)) && (remainder > 0)) {
+                       type = tmpbuf[processed];
+                       if (type == WLFC_CTL_TYPE_FILLER) {
+                               remainder -= 1;
+                               processed += 1;
+                               continue;
+                       }
+
+                       len  = tmpbuf[processed + 1];
+                       value = &tmpbuf[processed + 2];
+
+                       if (remainder < (2 + len))
+                               break;
+
+                       remainder -= 2 + len;
+                       processed += 2 + len;
+                       entry = NULL;
+
+                       DHD_INFO(("%s():%d type %d remainder %d processed %d\n",
+                               __FUNCTION__, __LINE__, type, remainder, processed));
+
+                       if (type == WLFC_CTL_TYPE_HOST_REORDER_RXPKTS)
+                               _dhd_wlfc_reorderinfo_indicate(value, len, reorder_info_buf,
+                                       reorder_info_len);
+
+                       if (wlfc == NULL) {
+                               ASSERT(dhd->proptxstatus_mode == WLFC_ONLY_AMPDU_HOSTREORDER);
+
+                               if (type != WLFC_CTL_TYPE_HOST_REORDER_RXPKTS &&
+                                       type != WLFC_CTL_TYPE_TRANS_ID)
+                                       DHD_INFO(("%s():%d dhd->wlfc_state is NULL yet!"
+                                       " type %d remainder %d processed %d\n",
+                                       __FUNCTION__, __LINE__, type, remainder, processed));
+                               continue;
+                       }
+
+                       if (type == WLFC_CTL_TYPE_TXSTATUS) {
+                               _dhd_wlfc_compressed_txstatus_update(dhd, value, 1, &entry);
+                       } else if (type == WLFC_CTL_TYPE_COMP_TXSTATUS) {
+                               uint8 compcnt_offset = WLFC_CTL_VALUE_LEN_TXSTATUS;
+
+                               if (WLFC_GET_REUSESEQ(dhd->wlfc_mode)) {
+                                       compcnt_offset += WLFC_CTL_VALUE_LEN_SEQ;
+                               }
+                               _dhd_wlfc_compressed_txstatus_update(dhd, value,
+                                       value[compcnt_offset], &entry);
+                       } else if (type == WLFC_CTL_TYPE_FIFO_CREDITBACK) {
+                               _dhd_wlfc_fifocreditback_indicate(dhd, value);
+                       } else if (type == WLFC_CTL_TYPE_RSSI) {
+                               _dhd_wlfc_rssi_indicate(dhd, value);
+                       } else if (type == WLFC_CTL_TYPE_MAC_REQUEST_CREDIT) {
+                               _dhd_wlfc_credit_request(dhd, value);
+                       } else if (type == WLFC_CTL_TYPE_MAC_REQUEST_PACKET) {
+                               _dhd_wlfc_packet_request(dhd, value);
+                       } else if ((type == WLFC_CTL_TYPE_MAC_OPEN) ||
+                               (type == WLFC_CTL_TYPE_MAC_CLOSE)) {
+                               _dhd_wlfc_psmode_update(dhd, value, type);
+                       } else if ((type == WLFC_CTL_TYPE_MACDESC_ADD) ||
+                               (type == WLFC_CTL_TYPE_MACDESC_DEL)) {
+                               _dhd_wlfc_mac_table_update(dhd, value, type);
+                       } else if (type == WLFC_CTL_TYPE_TRANS_ID) {
+                               _dhd_wlfc_dbg_senum_check(dhd, value);
+                       } else if ((type == WLFC_CTL_TYPE_INTERFACE_OPEN) ||
+                               (type == WLFC_CTL_TYPE_INTERFACE_CLOSE)) {
+                               _dhd_wlfc_interface_update(dhd, value, type);
+                       }
+
+#ifndef BCMDBUS
+                       if (entry && WLFC_GET_REORDERSUPP(dhd->wlfc_mode)) {
+                               /* suppress all packets for this mac entry from bus->txq */
+                               _dhd_wlfc_suppress_txq(dhd, _dhd_wlfc_entrypkt_fn, entry);
+                       }
+#endif /* !BCMDBUS */
+               } /* while */
+
+               if (remainder != 0 && wlfc) {
+                       /* trouble..., something is not right */
+                       wlfc->stats.tlv_parse_failed++;
+               }
+       } /* if */
+
+       if (wlfc)
+               wlfc->stats.dhd_hdrpulls++;
+
+       dhd_os_wlfc_unblock(dhd);
+       return BCME_OK;
+}
+
+KERNEL_THREAD_RETURN_TYPE
+dhd_wlfc_transfer_packets(void *data)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)data;
+       int ac, single_ac = 0, rc = BCME_OK;
+       dhd_wlfc_commit_info_t  commit_info;
+       athost_wl_status_info_t* ctx;
+       int bus_retry_count = 0;
+       int pkt_send = 0;
+       int pkt_send_per_ac = 0;
+
+       uint8 tx_map = 0; /* packets (send + in queue), Bitmask for 4 ACs + BC/MC */
+       uint8 rx_map = 0; /* received packets, Bitmask for 4 ACs + BC/MC */
+       uint8 packets_map = 0; /* packets in queue, Bitmask for 4 ACs + BC/MC */
+       bool no_credit = FALSE;
+
+       int lender;
+
+#if defined(DHD_WLFC_THREAD)
+       /* wait till someone wakeup me up, will change it at running time */
+       int wait_msec = msecs_to_jiffies(0xFFFFFFFF);
+#endif /* defined(DHD_WLFC_THREAD) */
+
+#if defined(DHD_WLFC_THREAD)
+       while (1) {
+               bus_retry_count = 0;
+               pkt_send = 0;
+               tx_map = 0;
+               rx_map = 0;
+               packets_map = 0;
+               wait_msec = wait_event_interruptible_timeout(dhdp->wlfc_wqhead,
+                       dhdp->wlfc_thread_go, wait_msec);
+               if (kthread_should_stop()) {
+                       break;
+               }
+               dhdp->wlfc_thread_go = FALSE;
+
+               dhd_os_wlfc_block(dhdp);
+#endif /* defined(DHD_WLFC_THREAD) */
+               ctx = (athost_wl_status_info_t*)dhdp->wlfc_state;
+#if defined(DHD_WLFC_THREAD)
+               if (!ctx)
+                       goto exit;
+#endif /* defined(DHD_WLFC_THREAD) */
+
+       memset(&commit_info, 0, sizeof(commit_info));
+
+       /*
+       Commit packets for regular AC traffic. Higher priority first.
+       First, use up FIFO credits available to each AC. Based on distribution
+       and credits left, borrow from other ACs as applicable
+
+       -NOTE:
+       If the bus between the host and firmware is overwhelmed by the
+       traffic from host, it is possible that higher priority traffic
+       starves the lower priority queue. If that occurs often, we may
+       have to employ weighted round-robin or ucode scheme to avoid
+       low priority packet starvation.
+       */
+
+       for (ac = AC_COUNT; ac >= 0; ac--) {
+               if (dhdp->wlfc_rxpkt_chk) {
+                       /* check rx packet */
+                       uint32 curr_t = OSL_SYSUPTIME(), delta;
+
+                       delta = curr_t - ctx->rx_timestamp[ac];
+                       if (delta < WLFC_RX_DETECTION_THRESHOLD_MS) {
+                               rx_map |= (1 << ac);
+                       }
+               }
+
+               if (ctx->pkt_cnt_per_ac[ac] == 0) {
+                       continue;
+               }
+
+               tx_map |= (1 << ac);
+               single_ac = ac + 1;
+               pkt_send_per_ac = 0;
+               while ((FALSE == dhdp->proptxstatus_txoff) &&
+                               (pkt_send_per_ac < WLFC_PACKET_BOUND)) {
+                       /* packets from delayQ with less priority are fresh and
+                        * they'd need header and have no MAC entry
+                        */
+                       no_credit = (ctx->FIFO_credit[ac] < 1);
+                       if (dhdp->proptxstatus_credit_ignore ||
+                               ((ac == AC_COUNT) && !ctx->bcmc_credit_supported)) {
+                               no_credit = FALSE;
+                       }
+
+                       lender = -1;
+#ifdef LIMIT_BORROW
+                       if (no_credit && (ac < AC_COUNT) && (tx_map >= rx_map) &&
+                               dhdp->wlfc_borrow_allowed) {
+                               /* try borrow from lower priority */
+                               lender = _dhd_wlfc_borrow_credit(ctx, ac - 1, ac, FALSE);
+                               if (lender != -1) {
+                                       no_credit = FALSE;
+                               }
+                       }
+#endif
+                       commit_info.needs_hdr = 1;
+                       commit_info.mac_entry = NULL;
+                       commit_info.p = _dhd_wlfc_deque_delayedq(ctx, ac,
+                               &(commit_info.ac_fifo_credit_spent),
+                               &(commit_info.needs_hdr),
+                               &(commit_info.mac_entry),
+                               no_credit);
+                       commit_info.pkt_type = (commit_info.needs_hdr) ? eWLFC_PKTTYPE_DELAYED :
+                               eWLFC_PKTTYPE_SUPPRESSED;
+
+                       if (commit_info.p == NULL) {
+#ifdef LIMIT_BORROW
+                               if (lender != -1 && dhdp->wlfc_borrow_allowed) {
+                                       _dhd_wlfc_return_credit(ctx, lender, ac);
+                               }
+#endif
+                               break;
+                       }
+
+                       if (!dhdp->proptxstatus_credit_ignore && (lender == -1)) {
+                               ASSERT(ctx->FIFO_credit[ac] >= commit_info.ac_fifo_credit_spent);
+                       }
+                       /* here we can ensure have credit or no credit needed */
+                       rc = _dhd_wlfc_handle_packet_commit(ctx, ac, &commit_info,
+                               ctx->fcommit, ctx->commit_ctx);
+
+                       /* Bus commits may fail (e.g. flow control); abort after retries */
+                       if (rc == BCME_OK) {
+                               pkt_send++;
+                               pkt_send_per_ac++;
+                               if (commit_info.ac_fifo_credit_spent && (lender == -1)) {
+                                       ctx->FIFO_credit[ac]--;
+                               }
+#ifdef LIMIT_BORROW
+                               else if (!commit_info.ac_fifo_credit_spent && (lender != -1) &&
+                                       dhdp->wlfc_borrow_allowed) {
+                                       _dhd_wlfc_return_credit(ctx, lender, ac);
+                               }
+#endif
+                       } else {
+#ifdef LIMIT_BORROW
+                               if (lender != -1 && dhdp->wlfc_borrow_allowed) {
+                                       _dhd_wlfc_return_credit(ctx, lender, ac);
+                               }
+#endif
+                               bus_retry_count++;
+                               if (bus_retry_count >= BUS_RETRIES) {
+                                       DHD_ERROR(("%s: bus error %d\n", __FUNCTION__, rc));
+                                       goto exit;
+                               }
+                       }
+               }
+
+               if (ctx->pkt_cnt_per_ac[ac]) {
+                       packets_map |= (1 << ac);
+               }
+       }
+
+       if ((tx_map == 0) || dhdp->proptxstatus_credit_ignore) {
+               /* nothing send out or remain in queue */
+               rc = BCME_OK;
+               goto exit;
+       }
+
+       if (((tx_map & (tx_map - 1)) == 0) && (tx_map >= rx_map)) {
+               /* only one tx ac exist and no higher rx ac */
+               if ((single_ac == ctx->single_ac) && ctx->allow_credit_borrow) {
+                       ac = single_ac - 1;
+               } else {
+                       uint32 delta;
+                       uint32 curr_t = OSL_SYSUPTIME();
+
+                       if (single_ac != ctx->single_ac) {
+                               /* new single ac traffic (first single ac or different single ac) */
+                               ctx->allow_credit_borrow = 0;
+                               ctx->single_ac_timestamp = curr_t;
+                               ctx->single_ac = (uint8)single_ac;
+                               rc = BCME_OK;
+                               goto exit;
+                       }
+                       /* same ac traffic, check if it lasts enough time */
+                       delta = curr_t - ctx->single_ac_timestamp;
+
+                       if (delta >= WLFC_BORROW_DEFER_PERIOD_MS) {
+                               /* wait enough time, can borrow now */
+                               ctx->allow_credit_borrow = 1;
+                               ac = single_ac - 1;
+                       } else {
+                               rc = BCME_OK;
+                               goto exit;
+                       }
+               }
+       } else {
+               /* If we have multiple AC traffic, turn off borrowing, mark time and bail out */
+               ctx->allow_credit_borrow = 0;
+               ctx->single_ac_timestamp = 0;
+               ctx->single_ac = 0;
+               rc = BCME_OK;
+               goto exit;
+       }
+
+       if (packets_map == 0) {
+               /* nothing to send, skip borrow */
+               rc = BCME_OK;
+               goto exit;
+       }
+
+       /* At this point, borrow all credits only for ac */
+       while (FALSE == dhdp->proptxstatus_txoff) {
+#ifdef LIMIT_BORROW
+               if (dhdp->wlfc_borrow_allowed) {
+                       if ((lender = _dhd_wlfc_borrow_credit(ctx, AC_COUNT, ac, TRUE)) == -1) {
+                               break;
+                       }
+               }
+               else
+                       break;
+#endif
+               commit_info.p = _dhd_wlfc_deque_delayedq(ctx, ac,
+                       &(commit_info.ac_fifo_credit_spent),
+                       &(commit_info.needs_hdr),
+                       &(commit_info.mac_entry),
+                       FALSE);
+               if (commit_info.p == NULL) {
+                       /* before borrow only one ac exists and now this only ac is empty */
+#ifdef LIMIT_BORROW
+                       _dhd_wlfc_return_credit(ctx, lender, ac);
+#endif
+                       break;
+               }
+
+               commit_info.pkt_type = (commit_info.needs_hdr) ? eWLFC_PKTTYPE_DELAYED :
+                       eWLFC_PKTTYPE_SUPPRESSED;
+
+               rc = _dhd_wlfc_handle_packet_commit(ctx, ac, &commit_info,
+                    ctx->fcommit, ctx->commit_ctx);
+
+               /* Bus commits may fail (e.g. flow control); abort after retries */
+               if (rc == BCME_OK) {
+                       pkt_send++;
+                       if (commit_info.ac_fifo_credit_spent) {
+#ifndef LIMIT_BORROW
+                               ctx->FIFO_credit[ac]--;
+#endif
+                       } else {
+#ifdef LIMIT_BORROW
+                               _dhd_wlfc_return_credit(ctx, lender, ac);
+#endif
+                       }
+               } else {
+#ifdef LIMIT_BORROW
+                       _dhd_wlfc_return_credit(ctx, lender, ac);
+#endif
+                       bus_retry_count++;
+                       if (bus_retry_count >= BUS_RETRIES) {
+                               DHD_ERROR(("%s: bus error %d\n", __FUNCTION__, rc));
+                               goto exit;
+                       }
+               }
+       }
+
+       BCM_REFERENCE(pkt_send);
+
+exit:
+#if defined(DHD_WLFC_THREAD)
+               dhd_os_wlfc_unblock(dhdp);
+               if (ctx && ctx->pkt_cnt_in_psq && pkt_send) {
+                       wait_msec = msecs_to_jiffies(WLFC_THREAD_QUICK_RETRY_WAIT_MS);
+               } else {
+                       wait_msec = msecs_to_jiffies(WLFC_THREAD_RETRY_WAIT_MS);
+               }
+       }
+       return 0;
+#else
+       return rc;
+#endif /* defined(DHD_WLFC_THREAD) */
+}
+
+/**
+ * Enqueues a transmit packet in the next layer towards the dongle, eg the DBUS layer. Called by
+ * eg dhd_sendpkt().
+ *     @param[in] dhdp                  Pointer to public DHD structure
+ *     @param[in] fcommit               Pointer to transmit function of next layer
+ *     @param[in] commit_ctx            Opaque context used when calling next layer
+ *     @param[in] pktbuf                Packet to send
+ *     @param[in] need_toggle_host_if   If TRUE, resets flag ctx->toggle_host_if
+ */
+int
+dhd_wlfc_commit_packets(dhd_pub_t *dhdp, f_commitpkt_t fcommit, void* commit_ctx, void *pktbuf,
+       bool need_toggle_host_if)
+{
+       int rc = BCME_OK;
+       athost_wl_status_info_t* ctx;
+
+#if defined(DHD_WLFC_THREAD)
+       if (!pktbuf)
+               return BCME_OK;
+#endif /* defined(DHD_WLFC_THREAD) */
+
+       if ((dhdp == NULL) || (fcommit == NULL)) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhdp);
+
+       if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               if (pktbuf) {
+                       DHD_PKTTAG_WLFCPKT_SET(PKTTAG(pktbuf), 0);
+               }
+               rc =  WLFC_UNSUPPORTED;
+               goto exit;
+       }
+
+       ctx = (athost_wl_status_info_t*)dhdp->wlfc_state;
+
+#ifdef BCMDBUS
+       if (!dhdp->up || (dhdp->busstate == DHD_BUS_DOWN)) {
+               if (pktbuf) {
+                       PKTFREE(ctx->osh, pktbuf, TRUE);
+                       rc = BCME_OK;
+               }
+               goto exit;
+       }
+#endif /* BCMDBUS */
+
+       if (dhdp->proptxstatus_module_ignore) {
+               if (pktbuf) {
+                       uint32 htod = 0;
+                       WL_TXSTATUS_SET_FLAGS(htod, WLFC_PKTFLAG_PKTFROMHOST);
+                       _dhd_wlfc_pushheader(ctx, &pktbuf, FALSE, 0, 0, htod, 0, FALSE);
+                       if (fcommit(commit_ctx, pktbuf)) {
+                               /* free it if failed, otherwise do it in tx complete cb */
+                               PKTFREE(ctx->osh, pktbuf, TRUE);
+                       }
+                       rc = BCME_OK;
+               }
+               goto exit;
+       }
+
+       if (pktbuf) {
+               int ac = DHD_PKTTAG_FIFO(PKTTAG(pktbuf));
+               ASSERT(ac <= AC_COUNT);
+               DHD_PKTTAG_WLFCPKT_SET(PKTTAG(pktbuf), 1);
+               /* en-queue the packets to respective queue. */
+               rc = _dhd_wlfc_enque_delayq(ctx, pktbuf, ac);
+               if (rc) {
+                       _dhd_wlfc_prec_drop(ctx->dhdp, (ac << 1), pktbuf, FALSE);
+               } else {
+                       ctx->stats.pktin++;
+                       ctx->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(pktbuf))][ac]++;
+               }
+       }
+
+       if (!ctx->fcommit) {
+               ctx->fcommit = fcommit;
+       } else {
+               ASSERT(ctx->fcommit == fcommit);
+       }
+       if (!ctx->commit_ctx) {
+               ctx->commit_ctx = commit_ctx;
+       } else {
+               ASSERT(ctx->commit_ctx == commit_ctx);
+       }
+
+#if defined(DHD_WLFC_THREAD)
+       _dhd_wlfc_thread_wakeup(dhdp);
+#else
+       dhd_wlfc_transfer_packets(dhdp);
+#endif /* defined(DHD_WLFC_THREAD) */
+
+exit:
+       dhd_os_wlfc_unblock(dhdp);
+       return rc;
+} /* dhd_wlfc_commit_packets */
+
+/**
+ * Called when the (lower) DBUS layer indicates completion (succesfull or not) of a transmit packet
+ */
+int
+dhd_wlfc_txcomplete(dhd_pub_t *dhd, void *txp, bool success)
+{
+       athost_wl_status_info_t* wlfc;
+       wlfc_mac_descriptor_t *entry;
+       void* pout = NULL;
+       int rtn = BCME_OK;
+       if ((dhd == NULL) || (txp == NULL)) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       bcm_pkt_validate_chk(txp, "_dhd_wlfc_compressed_txstatus_update");
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               rtn = WLFC_UNSUPPORTED;
+               goto EXIT;
+       }
+
+       wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       if (DHD_PKTTAG_SIGNALONLY(PKTTAG(txp))) {
+#ifdef PROP_TXSTATUS_DEBUG
+               wlfc->stats.signal_only_pkts_freed++;
+#endif
+               /* is this a signal-only packet? */
+               _dhd_wlfc_pullheader(wlfc, txp);
+               PKTFREE(wlfc->osh, txp, TRUE);
+               goto EXIT;
+       }
+
+       entry = _dhd_wlfc_find_table_entry(wlfc, txp);
+       ASSERT(entry);
+
+       if (!success || dhd->proptxstatus_txstatus_ignore) {
+               WLFC_DBGMESG(("At: %s():%d, bus_complete() failure for %p, htod_tag:0x%08x\n",
+                       __FUNCTION__, __LINE__, txp, DHD_PKTTAG_H2DTAG(PKTTAG(txp))));
+               if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+                       _dhd_wlfc_hanger_poppkt(wlfc->hanger, WL_TXSTATUS_GET_HSLOT(
+                               DHD_PKTTAG_H2DTAG(PKTTAG(txp))), &pout, TRUE);
+                       ASSERT(txp == pout);
+               }
+
+               /* indicate failure and free the packet */
+               dhd_txcomplete(dhd, txp, success);
+
+               /* return the credit, if necessary */
+               _dhd_wlfc_return_implied_credit(wlfc, txp);
+
+               if (entry->transit_count)
+                       entry->transit_count--;
+               if (entry->suppr_transit_count)
+                       entry->suppr_transit_count--;
+               wlfc->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(txp))][DHD_PKTTAG_FIFO(PKTTAG(txp))]--;
+               wlfc->stats.pktout++;
+               PKTFREE(wlfc->osh, txp, TRUE);
+       } else {
+               /* bus confirmed pkt went to firmware side */
+               if (WLFC_GET_AFQ(dhd->wlfc_mode)) {
+                       _dhd_wlfc_enque_afq(wlfc, txp);
+               } else {
+                       int hslot = WL_TXSTATUS_GET_HSLOT(DHD_PKTTAG_H2DTAG(PKTTAG(txp)));
+                       _dhd_wlfc_hanger_free_pkt(wlfc, hslot,
+                               WLFC_HANGER_PKT_STATE_BUSRETURNED, -1);
+               }
+       }
+
+       ASSERT(entry->onbus_pkts_count > 0);
+       if (entry->onbus_pkts_count > 0)
+               entry->onbus_pkts_count--;
+       if (entry->suppressed &&
+               (!entry->onbus_pkts_count) &&
+               (!entry->suppr_transit_count))
+               entry->suppressed = FALSE;
+EXIT:
+       dhd_os_wlfc_unblock(dhd);
+       return rtn;
+} /* dhd_wlfc_txcomplete */
+
+int
+dhd_wlfc_init(dhd_pub_t *dhd)
+{
+       /* enable all signals & indicate host proptxstatus logic is active */
+       uint32 tlv, mode, fw_caps;
+       int ret = 0;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+       if (dhd->wlfc_enabled) {
+               DHD_INFO(("%s():%d, Already enabled!\n", __FUNCTION__, __LINE__));
+               dhd_os_wlfc_unblock(dhd);
+               return BCME_OK;
+       }
+       dhd->wlfc_enabled = TRUE;
+       dhd_os_wlfc_unblock(dhd);
+
+       tlv = WLFC_FLAGS_RSSI_SIGNALS |
+               WLFC_FLAGS_XONXOFF_SIGNALS |
+               WLFC_FLAGS_CREDIT_STATUS_SIGNALS |
+               WLFC_FLAGS_HOST_PROPTXSTATUS_ACTIVE |
+               WLFC_FLAGS_HOST_RXRERODER_ACTIVE;
+
+       /* XXX dhd->wlfc_state = NULL; */
+       /* XXX ANDREY:may erase pointer to already created wlfc_state, PR#97824  */
+
+       /*
+       try to enable/disable signaling by sending "tlv" iovar. if that fails,
+       fallback to no flow control? Print a message for now.
+       */
+
+       /* enable proptxtstatus signaling by default */
+       if (!dhd_wl_ioctl_set_intiovar(dhd, "tlv", tlv, WLC_SET_VAR, TRUE, 0)) {
+               /*
+               Leaving the message for now, it should be removed after a while; once
+               the tlv situation is stable.
+               */
+               DHD_INFO(("dhd_wlfc_init(): successfully %s bdcv2 tlv signaling, %d\n",
+                       dhd->wlfc_enabled?"enabled":"disabled", tlv));
+       }
+
+       mode = 0;
+
+       /* query caps */
+       ret = dhd_wl_ioctl_get_intiovar(dhd, "wlfc_mode", &fw_caps, WLC_GET_VAR, FALSE, 0);
+
+       if (!ret) {
+               DHD_INFO(("%s: query wlfc_mode succeed, fw_caps=0x%x\n", __FUNCTION__, fw_caps));
+
+               if (WLFC_IS_OLD_DEF(fw_caps)) {
+#ifdef BCMDBUS
+                       mode = WLFC_MODE_HANGER;
+#else
+                       /* enable proptxtstatus v2 by default */
+                       mode = WLFC_MODE_AFQ;
+#endif /* BCMDBUS */
+               } else {
+                       WLFC_SET_AFQ(mode, WLFC_GET_AFQ(fw_caps));
+#ifdef BCMDBUS
+                       WLFC_SET_AFQ(mode, 0);
+#endif /* BCMDBUS */
+                       WLFC_SET_REUSESEQ(mode, WLFC_GET_REUSESEQ(fw_caps));
+                       WLFC_SET_REORDERSUPP(mode, WLFC_GET_REORDERSUPP(fw_caps));
+               }
+               ret = dhd_wl_ioctl_set_intiovar(dhd, "wlfc_mode", mode, WLC_SET_VAR, TRUE, 0);
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       dhd->wlfc_mode = 0;
+       if (ret >= 0) {
+               if (WLFC_IS_OLD_DEF(mode)) {
+                       WLFC_SET_AFQ(dhd->wlfc_mode, (mode == WLFC_MODE_AFQ));
+               } else {
+                       dhd->wlfc_mode = mode;
+               }
+       }
+
+       DHD_INFO(("dhd_wlfc_init(): wlfc_mode=0x%x, ret=%d\n", dhd->wlfc_mode, ret));
+#ifdef LIMIT_BORROW
+       dhd->wlfc_borrow_allowed = TRUE;
+#endif
+       dhd_os_wlfc_unblock(dhd);
+
+       if (dhd->plat_init)
+               dhd->plat_init((void *)dhd);
+
+       return BCME_OK;
+} /* dhd_wlfc_init */
+
+/** AMPDU host reorder specific function */
+int
+dhd_wlfc_hostreorder_init(dhd_pub_t *dhd)
+{
+       /* enable only ampdu hostreorder here */
+       uint32 tlv;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       DHD_TRACE(("%s():%d Enter\n", __FUNCTION__, __LINE__));
+
+       tlv = WLFC_FLAGS_HOST_RXRERODER_ACTIVE;
+
+       /* enable proptxtstatus signaling by default */
+       if (dhd_wl_ioctl_set_intiovar(dhd, "tlv", tlv, WLC_SET_VAR, TRUE, 0)) {
+               DHD_ERROR(("%s(): failed to enable/disable bdcv2 tlv signaling\n",
+                       __FUNCTION__));
+       } else {
+               /*
+               Leaving the message for now, it should be removed after a while; once
+               the tlv situation is stable.
+               */
+               DHD_ERROR(("%s(): successful bdcv2 tlv signaling, %d\n",
+                       __FUNCTION__, tlv));
+       }
+
+       dhd_os_wlfc_block(dhd);
+       dhd->proptxstatus_mode = WLFC_ONLY_AMPDU_HOSTREORDER;
+       dhd_os_wlfc_unblock(dhd);
+       /* terence 20161229: enable ampdu_hostreorder if tlv enable hostreorder */
+       dhd_conf_set_intiovar(dhd, WLC_SET_VAR, "ampdu_hostreorder", 1, 0, TRUE);
+
+       return BCME_OK;
+}
+
+int
+dhd_wlfc_cleanup_txq(dhd_pub_t *dhd, f_processpkt_t fn, void *arg)
+{
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhd);
+               return WLFC_UNSUPPORTED;
+       }
+
+#ifndef BCMDBUS
+       _dhd_wlfc_cleanup_txq(dhd, fn, arg);
+#endif /* !BCMDBUS */
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** release all packet resources */
+int
+dhd_wlfc_cleanup(dhd_pub_t *dhd, f_processpkt_t fn, void *arg)
+{
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhd);
+               return WLFC_UNSUPPORTED;
+       }
+
+       _dhd_wlfc_cleanup(dhd, fn, arg);
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+int
+dhd_wlfc_deinit(dhd_pub_t *dhd)
+{
+       /* cleanup all psq related resources */
+       athost_wl_status_info_t* wlfc;
+       uint32 tlv = 0;
+       uint32 hostreorder = 0;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+       if (!dhd->wlfc_enabled) {
+               DHD_ERROR(("%s():%d, Already disabled!\n", __FUNCTION__, __LINE__));
+               dhd_os_wlfc_unblock(dhd);
+               return BCME_OK;
+       }
+
+       dhd->wlfc_enabled = FALSE;
+       dhd_os_wlfc_unblock(dhd);
+
+       /* query ampdu hostreorder */
+       (void) dhd_wl_ioctl_get_intiovar(dhd, "ampdu_hostreorder",
+               &hostreorder, WLC_GET_VAR, FALSE, 0);
+
+       if (hostreorder) {
+               tlv = WLFC_FLAGS_HOST_RXRERODER_ACTIVE;
+               DHD_ERROR(("%s():%d, maintain HOST RXRERODER flag in tvl\n",
+                       __FUNCTION__, __LINE__));
+       }
+
+       /* Disable proptxtstatus signaling for deinit */
+       (void) dhd_wl_ioctl_set_intiovar(dhd, "tlv", tlv, WLC_SET_VAR, TRUE, 0);
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhd);
+               return WLFC_UNSUPPORTED;
+       }
+
+       wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+
+       _dhd_wlfc_cleanup(dhd, NULL, NULL);
+
+       if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+               int i;
+               wlfc_hanger_t* h = (wlfc_hanger_t*)wlfc->hanger;
+               for (i = 0; i < h->max_items; i++) {
+                       if (h->items[i].state != WLFC_HANGER_ITEM_STATE_FREE) {
+                               _dhd_wlfc_hanger_free_pkt(wlfc, i,
+                                       WLFC_HANGER_PKT_STATE_COMPLETE, TRUE);
+                       }
+               }
+
+               /* delete hanger */
+               _dhd_wlfc_hanger_delete(dhd, h);
+       }
+
+       /* free top structure */
+       DHD_OS_PREFREE(dhd, dhd->wlfc_state,
+               sizeof(athost_wl_status_info_t));
+       dhd->wlfc_state = NULL;
+       dhd->proptxstatus_mode = hostreorder ?
+               WLFC_ONLY_AMPDU_HOSTREORDER : WLFC_FCMODE_NONE;
+
+       dhd_os_wlfc_unblock(dhd);
+
+       if (dhd->plat_deinit)
+               dhd->plat_deinit((void *)dhd);
+       return BCME_OK;
+} /* dhd_wlfc_init */
+
+/**
+ * Called on an interface event (WLC_E_IF) indicated by firmware
+ *     @param[in] dhdp   Pointer to public DHD structure
+ *     @param[in] action eg eWLFC_MAC_ENTRY_ACTION_UPDATE or eWLFC_MAC_ENTRY_ACTION_ADD
+ */
+int dhd_wlfc_interface_event(dhd_pub_t *dhdp, uint8 action, uint8 ifid, uint8 iftype, uint8* ea)
+{
+       int rc;
+
+       if (dhdp == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhdp);
+
+       if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhdp);
+               return WLFC_UNSUPPORTED;
+       }
+
+       rc = _dhd_wlfc_interface_entry_update(dhdp->wlfc_state, action, ifid, iftype, ea);
+
+       dhd_os_wlfc_unblock(dhdp);
+       return rc;
+}
+
+/** Called eg on receiving a WLC_E_FIFO_CREDIT_MAP event from the dongle */
+int dhd_wlfc_FIFOcreditmap_event(dhd_pub_t *dhdp, uint8* event_data)
+{
+       int rc;
+
+       if (dhdp == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhdp);
+
+       if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhdp);
+               return WLFC_UNSUPPORTED;
+       }
+
+       rc = _dhd_wlfc_FIFOcreditmap_update(dhdp->wlfc_state, event_data);
+
+       dhd_os_wlfc_unblock(dhdp);
+
+       return rc;
+}
+#ifdef LIMIT_BORROW
+int dhd_wlfc_disable_credit_borrow_event(dhd_pub_t *dhdp, uint8* event_data)
+{
+       if (dhdp == NULL || event_data == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+       dhd_os_wlfc_block(dhdp);
+       dhdp->wlfc_borrow_allowed = (bool)(*(uint32 *)event_data);
+       dhd_os_wlfc_unblock(dhdp);
+
+       return BCME_OK;
+}
+#endif /* LIMIT_BORROW */
+
+/**
+ * Called eg on receiving a WLC_E_BCMC_CREDIT_SUPPORT event from the dongle (broadcast/multicast
+ * specific)
+ */
+int dhd_wlfc_BCMCCredit_support_event(dhd_pub_t *dhdp)
+{
+       int rc;
+
+       if (dhdp == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhdp);
+
+       if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhdp);
+               return WLFC_UNSUPPORTED;
+       }
+
+       rc = _dhd_wlfc_BCMCCredit_support_update(dhdp->wlfc_state);
+
+       dhd_os_wlfc_unblock(dhdp);
+       return rc;
+}
+
+/** debug specific function */
+int
+dhd_wlfc_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+       int i;
+       uint8* ea;
+       athost_wl_status_info_t* wlfc;
+       wlfc_hanger_t* h;
+       wlfc_mac_descriptor_t* mac_table;
+       wlfc_mac_descriptor_t* interfaces;
+       char* iftypes[] = {"STA", "AP", "WDS", "p2pGO", "p2pCL"};
+
+       if (!dhdp || !strbuf) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhdp);
+
+       if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhdp);
+               return WLFC_UNSUPPORTED;
+       }
+
+       wlfc = (athost_wl_status_info_t*)dhdp->wlfc_state;
+
+       h = (wlfc_hanger_t*)wlfc->hanger;
+       if (h == NULL) {
+               bcm_bprintf(strbuf, "wlfc-hanger not initialized yet\n");
+       }
+
+       mac_table = wlfc->destination_entries.nodes;
+       interfaces = wlfc->destination_entries.interfaces;
+       bcm_bprintf(strbuf, "---- wlfc stats ----\n");
+
+       if (!WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+               h = (wlfc_hanger_t*)wlfc->hanger;
+               if (h == NULL) {
+                       bcm_bprintf(strbuf, "wlfc-hanger not initialized yet\n");
+               } else {
+                       bcm_bprintf(strbuf, "wlfc hanger (pushed,popped,f_push,"
+                               "f_pop,f_slot, pending) = (%d,%d,%d,%d,%d,%d)\n",
+                               h->pushed,
+                               h->popped,
+                               h->failed_to_push,
+                               h->failed_to_pop,
+                               h->failed_slotfind,
+                               (h->pushed - h->popped));
+               }
+       }
+
+       bcm_bprintf(strbuf, "wlfc fail(tlv,credit_rqst,mac_update,psmode_update), "
+               "(dq_full,rollback_fail) = (%d,%d,%d,%d), (%d,%d)\n",
+               wlfc->stats.tlv_parse_failed,
+               wlfc->stats.credit_request_failed,
+               wlfc->stats.mac_update_failed,
+               wlfc->stats.psmode_update_failed,
+               wlfc->stats.delayq_full_error,
+               wlfc->stats.rollback_failed);
+
+       bcm_bprintf(strbuf, "PKTS (init_credit,credit,sent,drop_d,drop_s,outoforder) "
+               "(AC0[%d,%d,%d,%d,%d,%d],AC1[%d,%d,%d,%d,%d,%d],AC2[%d,%d,%d,%d,%d,%d],"
+               "AC3[%d,%d,%d,%d,%d,%d],BC_MC[%d,%d,%d,%d,%d,%d])\n",
+               wlfc->Init_FIFO_credit[0], wlfc->FIFO_credit[0], wlfc->stats.send_pkts[0],
+               wlfc->stats.drop_pkts[0], wlfc->stats.drop_pkts[1], wlfc->stats.ooo_pkts[0],
+               wlfc->Init_FIFO_credit[1], wlfc->FIFO_credit[1], wlfc->stats.send_pkts[1],
+               wlfc->stats.drop_pkts[2], wlfc->stats.drop_pkts[3], wlfc->stats.ooo_pkts[1],
+               wlfc->Init_FIFO_credit[2], wlfc->FIFO_credit[2], wlfc->stats.send_pkts[2],
+               wlfc->stats.drop_pkts[4], wlfc->stats.drop_pkts[5], wlfc->stats.ooo_pkts[2],
+               wlfc->Init_FIFO_credit[3], wlfc->FIFO_credit[3], wlfc->stats.send_pkts[3],
+               wlfc->stats.drop_pkts[6], wlfc->stats.drop_pkts[7], wlfc->stats.ooo_pkts[3],
+               wlfc->Init_FIFO_credit[4], wlfc->FIFO_credit[4], wlfc->stats.send_pkts[4],
+               wlfc->stats.drop_pkts[8], wlfc->stats.drop_pkts[9], wlfc->stats.ooo_pkts[4]);
+
+       bcm_bprintf(strbuf, "\n");
+       for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+               if (interfaces[i].occupied) {
+                       char* iftype_desc;
+
+                       if (interfaces[i].iftype > WLC_E_IF_ROLE_P2P_CLIENT)
+                               iftype_desc = "<Unknown";
+                       else
+                               iftype_desc = iftypes[interfaces[i].iftype];
+
+                       ea = interfaces[i].ea;
+                       bcm_bprintf(strbuf, "INTERFACE[%d].ea = "
+                               "["MACDBG"], if:%d, type: %s "
+                               "netif_flow_control:%s\n", i,
+                               MAC2STRDBG(ea), interfaces[i].interface_id,
+                               iftype_desc, ((wlfc->hostif_flow_state[i] == OFF)
+                               ? " OFF":" ON"));
+
+                       bcm_bprintf(strbuf, "INTERFACE[%d].PSQ(len,state,credit),"
+                               "(trans,supp_trans,onbus)"
+                               "= (%d,%s,%d),(%d,%d,%d)\n",
+                               i,
+                               interfaces[i].psq.n_pkts_tot,
+                               ((interfaces[i].state ==
+                               WLFC_STATE_OPEN) ? "OPEN":"CLOSE"),
+                               interfaces[i].requested_credit,
+                               interfaces[i].transit_count,
+                               interfaces[i].suppr_transit_count,
+                               interfaces[i].onbus_pkts_count);
+
+                       bcm_bprintf(strbuf, "INTERFACE[%d].PSQ"
+                               "(delay0,sup0,afq0),(delay1,sup1,afq1),(delay2,sup2,afq2),"
+                               "(delay3,sup3,afq3),(delay4,sup4,afq4) = (%d,%d,%d),"
+                               "(%d,%d,%d),(%d,%d,%d),(%d,%d,%d),(%d,%d,%d)\n",
+                               i,
+                               interfaces[i].psq.q[0].n_pkts,
+                               interfaces[i].psq.q[1].n_pkts,
+                               interfaces[i].afq.q[0].n_pkts,
+                               interfaces[i].psq.q[2].n_pkts,
+                               interfaces[i].psq.q[3].n_pkts,
+                               interfaces[i].afq.q[1].n_pkts,
+                               interfaces[i].psq.q[4].n_pkts,
+                               interfaces[i].psq.q[5].n_pkts,
+                               interfaces[i].afq.q[2].n_pkts,
+                               interfaces[i].psq.q[6].n_pkts,
+                               interfaces[i].psq.q[7].n_pkts,
+                               interfaces[i].afq.q[3].n_pkts,
+                               interfaces[i].psq.q[8].n_pkts,
+                               interfaces[i].psq.q[9].n_pkts,
+                               interfaces[i].afq.q[4].n_pkts);
+               }
+       }
+
+       bcm_bprintf(strbuf, "\n");
+       for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+               if (mac_table[i].occupied) {
+                       ea = mac_table[i].ea;
+                       bcm_bprintf(strbuf, "MAC_table[%d].ea = "
+                               "["MACDBG"], if:%d \n", i,
+                               MAC2STRDBG(ea), mac_table[i].interface_id);
+
+                       bcm_bprintf(strbuf, "MAC_table[%d].PSQ(len,state,credit),"
+                               "(trans,supp_trans,onbus)"
+                               "= (%d,%s,%d),(%d,%d,%d)\n",
+                               i,
+                               mac_table[i].psq.n_pkts_tot,
+                               ((mac_table[i].state ==
+                               WLFC_STATE_OPEN) ? " OPEN":"CLOSE"),
+                               mac_table[i].requested_credit,
+                               mac_table[i].transit_count,
+                               mac_table[i].suppr_transit_count,
+                               mac_table[i].onbus_pkts_count);
+#ifdef PROP_TXSTATUS_DEBUG
+                       bcm_bprintf(strbuf, "MAC_table[%d]: (opened, closed) = (%d, %d)\n",
+                               i, mac_table[i].opened_ct, mac_table[i].closed_ct);
+#endif
+                       bcm_bprintf(strbuf, "MAC_table[%d].PSQ"
+                               "(delay0,sup0,afq0),(delay1,sup1,afq1),(delay2,sup2,afq2),"
+                               "(delay3,sup3,afq3),(delay4,sup4,afq4) =(%d,%d,%d),"
+                               "(%d,%d,%d),(%d,%d,%d),(%d,%d,%d),(%d,%d,%d)\n",
+                               i,
+                               mac_table[i].psq.q[0].n_pkts,
+                               mac_table[i].psq.q[1].n_pkts,
+                               mac_table[i].afq.q[0].n_pkts,
+                               mac_table[i].psq.q[2].n_pkts,
+                               mac_table[i].psq.q[3].n_pkts,
+                               mac_table[i].afq.q[1].n_pkts,
+                               mac_table[i].psq.q[4].n_pkts,
+                               mac_table[i].psq.q[5].n_pkts,
+                               mac_table[i].afq.q[2].n_pkts,
+                               mac_table[i].psq.q[6].n_pkts,
+                               mac_table[i].psq.q[7].n_pkts,
+                               mac_table[i].afq.q[3].n_pkts,
+                               mac_table[i].psq.q[8].n_pkts,
+                               mac_table[i].psq.q[9].n_pkts,
+                               mac_table[i].afq.q[4].n_pkts);
+
+               }
+       }
+
+#ifdef PROP_TXSTATUS_DEBUG
+       {
+               int avg;
+               int moving_avg = 0;
+               int moving_samples;
+
+               if (wlfc->stats.latency_sample_count) {
+                       moving_samples = sizeof(wlfc->stats.deltas)/sizeof(uint32);
+
+                       for (i = 0; i < moving_samples; i++)
+                               moving_avg += wlfc->stats.deltas[i];
+                       moving_avg /= moving_samples;
+
+                       avg = (100 * wlfc->stats.total_status_latency) /
+                               wlfc->stats.latency_sample_count;
+                       bcm_bprintf(strbuf, "txstatus latency (average, last, moving[%d]) = "
+                               "(%d.%d, %03d, %03d)\n",
+                               moving_samples, avg/100, (avg - (avg/100)*100),
+                               wlfc->stats.latency_most_recent,
+                               moving_avg);
+               }
+       }
+
+       bcm_bprintf(strbuf, "wlfc- fifo[0-5] credit stats: sent = (%d,%d,%d,%d,%d,%d), "
+               "back = (%d,%d,%d,%d,%d,%d)\n",
+               wlfc->stats.fifo_credits_sent[0],
+               wlfc->stats.fifo_credits_sent[1],
+               wlfc->stats.fifo_credits_sent[2],
+               wlfc->stats.fifo_credits_sent[3],
+               wlfc->stats.fifo_credits_sent[4],
+               wlfc->stats.fifo_credits_sent[5],
+
+               wlfc->stats.fifo_credits_back[0],
+               wlfc->stats.fifo_credits_back[1],
+               wlfc->stats.fifo_credits_back[2],
+               wlfc->stats.fifo_credits_back[3],
+               wlfc->stats.fifo_credits_back[4],
+               wlfc->stats.fifo_credits_back[5]);
+       {
+               uint32 fifo_cr_sent = 0;
+               uint32 fifo_cr_acked = 0;
+               uint32 request_cr_sent = 0;
+               uint32 request_cr_ack = 0;
+               uint32 bc_mc_cr_ack = 0;
+
+               for (i = 0; i < sizeof(wlfc->stats.fifo_credits_sent)/sizeof(uint32); i++) {
+                       fifo_cr_sent += wlfc->stats.fifo_credits_sent[i];
+               }
+
+               for (i = 0; i < sizeof(wlfc->stats.fifo_credits_back)/sizeof(uint32); i++) {
+                       fifo_cr_acked += wlfc->stats.fifo_credits_back[i];
+               }
+
+               for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+                       if (wlfc->destination_entries.nodes[i].occupied) {
+                               request_cr_sent +=
+                                       wlfc->destination_entries.nodes[i].dstncredit_sent_packets;
+                       }
+               }
+               for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+                       if (wlfc->destination_entries.interfaces[i].occupied) {
+                               request_cr_sent +=
+                               wlfc->destination_entries.interfaces[i].dstncredit_sent_packets;
+                       }
+               }
+               for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+                       if (wlfc->destination_entries.nodes[i].occupied) {
+                               request_cr_ack +=
+                                       wlfc->destination_entries.nodes[i].dstncredit_acks;
+                       }
+               }
+               for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+                       if (wlfc->destination_entries.interfaces[i].occupied) {
+                               request_cr_ack +=
+                                       wlfc->destination_entries.interfaces[i].dstncredit_acks;
+                       }
+               }
+               bcm_bprintf(strbuf, "wlfc- (sent, status) => pq(%d,%d), vq(%d,%d),"
+                       "other:%d, bc_mc:%d, signal-only, (sent,freed): (%d,%d)",
+                       fifo_cr_sent, fifo_cr_acked,
+                       request_cr_sent, request_cr_ack,
+                       wlfc->destination_entries.other.dstncredit_acks,
+                       bc_mc_cr_ack,
+                       wlfc->stats.signal_only_pkts_sent, wlfc->stats.signal_only_pkts_freed);
+       }
+#endif /* PROP_TXSTATUS_DEBUG */
+       bcm_bprintf(strbuf, "\n");
+       bcm_bprintf(strbuf, "wlfc- pkt((in,2bus,txstats,hdrpull,out),"
+               "(dropped,hdr_only,wlc_tossed,wlc_dropped,wlc_exptime)"
+               "(freed,free_err,rollback)) = "
+               "((%d,%d,%d,%d,%d),(%d,%d,%d,%d,%d),(%d,%d,%d))\n",
+               wlfc->stats.pktin,
+               wlfc->stats.pkt2bus,
+               wlfc->stats.txstatus_in,
+               wlfc->stats.dhd_hdrpulls,
+               wlfc->stats.pktout,
+
+               wlfc->stats.pktdropped,
+               wlfc->stats.wlfc_header_only_pkt,
+               wlfc->stats.wlc_tossed_pkts,
+               wlfc->stats.pkt_dropped,
+               wlfc->stats.pkt_exptime,
+
+               wlfc->stats.pkt_freed,
+               wlfc->stats.pkt_free_err, wlfc->stats.rollback);
+
+       bcm_bprintf(strbuf, "wlfc- suppress((d11,wlc,err),enq(d11,wl,hq,mac?),retx(d11,wlc,hq)) = "
+               "((%d,%d,%d),(%d,%d,%d,%d),(%d,%d,%d))\n",
+               wlfc->stats.d11_suppress,
+               wlfc->stats.wl_suppress,
+               wlfc->stats.bad_suppress,
+
+               wlfc->stats.psq_d11sup_enq,
+               wlfc->stats.psq_wlsup_enq,
+               wlfc->stats.psq_hostq_enq,
+               wlfc->stats.mac_handle_notfound,
+
+               wlfc->stats.psq_d11sup_retx,
+               wlfc->stats.psq_wlsup_retx,
+               wlfc->stats.psq_hostq_retx);
+
+       bcm_bprintf(strbuf, "wlfc- cleanup(txq,psq,fw) = (%d,%d,%d)\n",
+               wlfc->stats.cleanup_txq_cnt,
+               wlfc->stats.cleanup_psq_cnt,
+               wlfc->stats.cleanup_fw_cnt);
+
+       bcm_bprintf(strbuf, "wlfc- generic error: %d\n", wlfc->stats.generic_error);
+
+       for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+               bcm_bprintf(strbuf, "wlfc- if[%d], pkt_cnt_in_q/AC[0-4] = (%d,%d,%d,%d,%d)\n", i,
+                       wlfc->pkt_cnt_in_q[i][0],
+                       wlfc->pkt_cnt_in_q[i][1],
+                       wlfc->pkt_cnt_in_q[i][2],
+                       wlfc->pkt_cnt_in_q[i][3],
+                       wlfc->pkt_cnt_in_q[i][4]);
+       }
+       bcm_bprintf(strbuf, "\n");
+
+       dhd_os_wlfc_unblock(dhdp);
+       return BCME_OK;
+} /* dhd_wlfc_dump */
+
+int dhd_wlfc_clear_counts(dhd_pub_t *dhd)
+{
+       athost_wl_status_info_t* wlfc;
+       wlfc_hanger_t* hanger;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhd);
+               return WLFC_UNSUPPORTED;
+       }
+
+       wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+
+       memset(&wlfc->stats, 0, sizeof(athost_wl_stat_counters_t));
+
+       if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+               hanger = (wlfc_hanger_t*)wlfc->hanger;
+
+               hanger->pushed = 0;
+               hanger->popped = 0;
+               hanger->failed_slotfind = 0;
+               hanger->failed_to_pop = 0;
+               hanger->failed_to_push = 0;
+       }
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** returns TRUE if flow control is enabled */
+int dhd_wlfc_get_enable(dhd_pub_t *dhd, bool *val)
+{
+       if (!dhd || !val) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       *val = dhd->wlfc_enabled;
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** Called via an IOVAR */
+int dhd_wlfc_get_mode(dhd_pub_t *dhd, int *val)
+{
+       if (!dhd || !val) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       *val = dhd->wlfc_state ? dhd->proptxstatus_mode : 0;
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** Called via an IOVAR */
+int dhd_wlfc_set_mode(dhd_pub_t *dhd, int val)
+{
+       if (!dhd) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (dhd->wlfc_state) {
+               dhd->proptxstatus_mode = val & 0xff;
+       }
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** Called when rx frame is received from the dongle */
+bool dhd_wlfc_is_header_only_pkt(dhd_pub_t * dhd, void *pktbuf)
+{
+       athost_wl_status_info_t* wlfc;
+       bool rc = FALSE;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return FALSE;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhd);
+               return FALSE;
+       }
+
+       wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+
+       if (PKTLEN(wlfc->osh, pktbuf) == 0) {
+               wlfc->stats.wlfc_header_only_pkt++;
+               rc = TRUE;
+       }
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return rc;
+}
+
+int dhd_wlfc_flowcontrol(dhd_pub_t *dhdp, bool state, bool bAcquireLock)
+{
+       if (dhdp == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       if (bAcquireLock) {
+               dhd_os_wlfc_block(dhdp);
+       }
+
+       if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE) ||
+               dhdp->proptxstatus_module_ignore) {
+               if (bAcquireLock) {
+                       dhd_os_wlfc_unblock(dhdp);
+               }
+               return WLFC_UNSUPPORTED;
+       }
+
+       if (state != dhdp->proptxstatus_txoff) {
+               dhdp->proptxstatus_txoff = state;
+       }
+
+       if (bAcquireLock) {
+               dhd_os_wlfc_unblock(dhdp);
+       }
+
+       return BCME_OK;
+}
+
+/** Called when eg an rx frame is received from the dongle */
+int dhd_wlfc_save_rxpath_ac_time(dhd_pub_t * dhd, uint8 prio)
+{
+       athost_wl_status_info_t* wlfc;
+       int rx_path_ac = -1;
+
+       if ((dhd == NULL) || (prio >= NUMPRIO)) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_rxpkt_chk) {
+               dhd_os_wlfc_unblock(dhd);
+               return BCME_OK;
+       }
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhd);
+               return WLFC_UNSUPPORTED;
+       }
+
+       wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+
+       rx_path_ac = prio2fifo[prio];
+       wlfc->rx_timestamp[rx_path_ac] = OSL_SYSUPTIME();
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_get_module_ignore(dhd_pub_t *dhd, int *val)
+{
+       if (!dhd || !val) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       *val = dhd->proptxstatus_module_ignore;
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_set_module_ignore(dhd_pub_t *dhd, int val)
+{
+       uint32 tlv = 0;
+       bool bChanged = FALSE;
+
+       if (!dhd) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if ((bool)val != dhd->proptxstatus_module_ignore) {
+               dhd->proptxstatus_module_ignore = (val != 0);
+               /* force txstatus_ignore sync with proptxstatus_module_ignore */
+               dhd->proptxstatus_txstatus_ignore = dhd->proptxstatus_module_ignore;
+               if (FALSE == dhd->proptxstatus_module_ignore) {
+                       tlv = WLFC_FLAGS_RSSI_SIGNALS |
+                               WLFC_FLAGS_XONXOFF_SIGNALS |
+                               WLFC_FLAGS_CREDIT_STATUS_SIGNALS |
+                               WLFC_FLAGS_HOST_PROPTXSTATUS_ACTIVE;
+               }
+               /* always enable host reorder */
+               tlv |= WLFC_FLAGS_HOST_RXRERODER_ACTIVE;
+               bChanged = TRUE;
+       }
+
+       dhd_os_wlfc_unblock(dhd);
+
+       if (bChanged) {
+               /* select enable proptxtstatus signaling */
+               if (dhd_wl_ioctl_set_intiovar(dhd, "tlv", tlv, WLC_SET_VAR, TRUE, 0)) {
+                       DHD_ERROR(("%s: failed to set bdcv2 tlv signaling to 0x%x\n",
+                               __FUNCTION__, tlv));
+               } else {
+                       DHD_ERROR(("%s: successfully set bdcv2 tlv signaling to 0x%x\n",
+                               __FUNCTION__, tlv));
+               }
+       }
+
+#if defined(DHD_WLFC_THREAD)
+       _dhd_wlfc_thread_wakeup(dhd);
+#endif /* defined(DHD_WLFC_THREAD) */
+
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_get_credit_ignore(dhd_pub_t *dhd, int *val)
+{
+       if (!dhd || !val) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       *val = dhd->proptxstatus_credit_ignore;
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_set_credit_ignore(dhd_pub_t *dhd, int val)
+{
+       if (!dhd) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       dhd->proptxstatus_credit_ignore = (val != 0);
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_get_txstatus_ignore(dhd_pub_t *dhd, int *val)
+{
+       if (!dhd || !val) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       *val = dhd->proptxstatus_txstatus_ignore;
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_set_txstatus_ignore(dhd_pub_t *dhd, int val)
+{
+       if (!dhd) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       dhd->proptxstatus_txstatus_ignore = (val != 0);
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_get_rxpkt_chk(dhd_pub_t *dhd, int *val)
+{
+       if (!dhd || !val) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       *val = dhd->wlfc_rxpkt_chk;
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_set_rxpkt_chk(dhd_pub_t *dhd, int val)
+{
+       if (!dhd) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       dhd->wlfc_rxpkt_chk = (val != 0);
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+#ifdef PROPTX_MAXCOUNT
+int dhd_wlfc_update_maxcount(dhd_pub_t *dhdp, uint8 ifid, int maxcount)
+{
+       athost_wl_status_info_t* ctx;
+       int rc = 0;
+
+       if (dhdp == NULL) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhdp);
+
+       if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               rc = WLFC_UNSUPPORTED;
+               goto exit;
+       }
+
+       if (ifid >= WLFC_MAX_IFNUM) {
+               DHD_ERROR(("%s: bad ifid\n", __FUNCTION__));
+               rc = BCME_BADARG;
+               goto exit;
+       }
+
+       ctx = (athost_wl_status_info_t*)dhdp->wlfc_state;
+       ctx->destination_entries.interfaces[ifid].transit_maxcount = maxcount;
+exit:
+       dhd_os_wlfc_unblock(dhdp);
+       return rc;
+}
+#endif /* PROPTX_MAXCOUNT */
+
+#endif /* PROP_TXSTATUS */
diff --git a/bcmdhd.101.10.240.x/dhd_wlfc.h b/bcmdhd.101.10.240.x/dhd_wlfc.h
new file mode 100644 (file)
index 0000000..9e9be41
--- /dev/null
@@ -0,0 +1,567 @@
+/*
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ *
+ */
+#ifndef __wlfc_host_driver_definitions_h__
+#define __wlfc_host_driver_definitions_h__
+
+/* #define OOO_DEBUG */
+
+#define KERNEL_THREAD_RETURN_TYPE int
+
+typedef int (*f_commitpkt_t)(void* ctx, void* p);
+typedef bool (*f_processpkt_t)(void* p, void* arg);
+
+#define WLFC_UNSUPPORTED -9999
+
+#define WLFC_NO_TRAFFIC        -1
+#define WLFC_MULTI_TRAFFIC 0
+
+#define BUS_RETRIES 1  /* # of retries before aborting a bus tx operation */
+
+/** 16 bits will provide an absolute max of 65536 slots */
+#define WLFC_HANGER_MAXITEMS 3072
+
+#define WLFC_HANGER_ITEM_STATE_FREE                    1
+#define WLFC_HANGER_ITEM_STATE_INUSE                   2
+#define WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED                3
+#define WLFC_HANGER_ITEM_STATE_FLUSHED                 4
+
+#define WLFC_HANGER_PKT_STATE_TXSTATUS                 1
+#define WLFC_HANGER_PKT_STATE_BUSRETURNED              2
+#define WLFC_HANGER_PKT_STATE_COMPLETE                 \
+       (WLFC_HANGER_PKT_STATE_TXSTATUS | WLFC_HANGER_PKT_STATE_BUSRETURNED)
+
+typedef enum {
+       Q_TYPE_PSQ, /**< Power Save Queue, contains both delayed and suppressed packets */
+       Q_TYPE_AFQ  /**< At Firmware Queue */
+} q_type_t;
+
+typedef enum ewlfc_packet_state {
+       eWLFC_PKTTYPE_NEW,        /**< unused in the code (Jan 2015) */
+       eWLFC_PKTTYPE_DELAYED,    /**< packet did not enter wlfc yet */
+       eWLFC_PKTTYPE_SUPPRESSED, /**< packet entered wlfc and was suppressed by the dongle */
+       eWLFC_PKTTYPE_MAX
+} ewlfc_packet_state_t;
+
+typedef enum ewlfc_mac_entry_action {
+       eWLFC_MAC_ENTRY_ACTION_ADD,
+       eWLFC_MAC_ENTRY_ACTION_DEL,
+       eWLFC_MAC_ENTRY_ACTION_UPDATE,
+       eWLFC_MAC_ENTRY_ACTION_MAX
+} ewlfc_mac_entry_action_t;
+
+typedef struct wlfc_hanger_item {
+       uint8   state;
+       uint8   gen;
+       uint8   pkt_state;     /**< bitmask containing eg WLFC_HANGER_PKT_STATE_TXCOMPLETE */
+       uint8   pkt_txstatus;
+       uint32  identifier;
+       void*   pkt;
+#ifdef PROP_TXSTATUS_DEBUG
+       uint32  push_time;
+#endif
+       struct wlfc_hanger_item *next;
+} wlfc_hanger_item_t;
+
+/** hanger contains packets that have been posted by the dhd to the dongle and are expected back */
+typedef struct wlfc_hanger {
+       int max_items;
+       uint32 pushed;
+       uint32 popped;
+       uint32 failed_to_push;
+       uint32 failed_to_pop;
+       uint32 failed_slotfind;
+       uint32 slot_pos;
+       /** XXX: items[1] should be the last element here. Do not add new elements below it. */
+       wlfc_hanger_item_t items[1];
+} wlfc_hanger_t;
+
+#define WLFC_HANGER_SIZE(n)    ((sizeof(wlfc_hanger_t) - \
+       sizeof(wlfc_hanger_item_t)) + ((n)*sizeof(wlfc_hanger_item_t)))
+
+#define WLFC_STATE_OPEN                1       /**< remote MAC is able to receive packets */
+#define WLFC_STATE_CLOSE       2       /**< remote MAC is in power save mode */
+
+#define WLFC_PSQ_PREC_COUNT            ((AC_COUNT + 1) * 2) /**< 2 for each AC traffic and bc/mc */
+#define WLFC_AFQ_PREC_COUNT            (AC_COUNT + 1)
+
+#define WLFC_PSQ_LEN                   (4096 * 8)
+
+#ifdef BCMDBUS
+#define WLFC_FLOWCONTROL_HIWATER       512
+#define WLFC_FLOWCONTROL_LOWATER       (WLFC_FLOWCONTROL_HIWATER / 4)
+#else
+#define WLFC_FLOWCONTROL_HIWATER       ((4096 * 8) - 256)
+#define WLFC_FLOWCONTROL_LOWATER       256
+#endif
+
+#if (WLFC_FLOWCONTROL_HIWATER >= (WLFC_PSQ_LEN - 256))
+#undef WLFC_FLOWCONTROL_HIWATER
+#define WLFC_FLOWCONTROL_HIWATER       (WLFC_PSQ_LEN - 256)
+#undef WLFC_FLOWCONTROL_LOWATER
+#define WLFC_FLOWCONTROL_LOWATER       (WLFC_FLOWCONTROL_HIWATER / 4)
+#endif
+
+#define WLFC_LOG_BUF_SIZE              (1024*1024)
+
+/** Properties related to a remote MAC entity */
+typedef struct wlfc_mac_descriptor {
+       uint8 occupied;         /**< if 0, this descriptor is unused and thus can be (re)used */
+       uint8 interface_id;
+       uint8 iftype;           /**< eg WLC_E_IF_ROLE_STA */
+       uint8 state;            /**< eg WLFC_STATE_OPEN */
+       uint8 ac_bitmap;        /**< automatic power save delivery (APSD) */
+       uint8 requested_credit;
+       uint8 requested_packet; /**< unit: [number of packets] */
+       uint8 ea[ETHER_ADDR_LEN];
+
+       /** maintain (MAC,AC) based seq count for packets going to the device. As well as bc/mc. */
+       uint8 seq[AC_COUNT + 1];
+       uint8 generation;       /**< toggles between 0 and 1 */
+       struct pktq     psq;    /**< contains both 'delayed' and 'suppressed' packets */
+       /** packets at firmware queue */
+       struct pktq     afq;
+       /** The AC pending bitmap that was reported to the fw at last change */
+       uint8 traffic_lastreported_bmp;
+       /** The new AC pending bitmap */
+       uint8 traffic_pending_bmp;
+       /** 1= send on next opportunity */
+       uint8 send_tim_signal;
+       uint8 mac_handle;          /**< mac handles are assigned by the dongle */
+       /** Number of packets at dongle for this entry. */
+       int transit_count;
+       /** Number of suppression to wait before evict from delayQ */
+       int suppr_transit_count;
+       /** pkt sent to bus but no bus TX complete yet */
+       int onbus_pkts_count;
+       /** flag. TRUE when remote MAC is in suppressed state */
+       uint8 suppressed;
+
+#ifdef PROP_TXSTATUS_DEBUG
+       uint32 dstncredit_sent_packets;
+       uint32 dstncredit_acks;
+       uint32 opened_ct;
+       uint32 closed_ct;
+#endif
+#ifdef PROPTX_MAXCOUNT
+       /** Max Number of packets at dongle for this entry. */
+       int transit_maxcount;
+#endif /* PROPTX_MAXCOUNT */
+       struct wlfc_mac_descriptor* prev;
+       struct wlfc_mac_descriptor* next;
+} wlfc_mac_descriptor_t;
+
+/** A 'commit' is the hand over of a packet from the host OS layer to the layer below (eg DBUS) */
+typedef struct dhd_wlfc_commit_info {
+       uint8                                   needs_hdr;
+       uint8                                   ac_fifo_credit_spent;
+       ewlfc_packet_state_t    pkt_type;
+       wlfc_mac_descriptor_t*  mac_entry;
+       void*                                   p;
+} dhd_wlfc_commit_info_t;
+
+#define WLFC_DECR_SEQCOUNT(entry, prec) do { if (entry->seq[(prec)] == 0) {\
+       entry->seq[prec] = 0xff; } else entry->seq[prec]--;} while (0)
+
+#define WLFC_INCR_SEQCOUNT(entry, prec) entry->seq[(prec)]++
+#define WLFC_SEQCOUNT(entry, prec) entry->seq[(prec)]
+
+typedef struct athost_wl_stat_counters {
+       uint32  pktin;
+       uint32  pktout;
+       uint32  pkt2bus;
+       uint32  pktdropped;
+       uint32  tlv_parse_failed;
+       uint32  rollback;
+       uint32  rollback_failed;
+       uint32  delayq_full_error;
+       uint32  credit_request_failed;
+       uint32  packet_request_failed;
+       uint32  mac_update_failed;
+       uint32  psmode_update_failed;
+       uint32  interface_update_failed;
+       uint32  wlfc_header_only_pkt;
+       uint32  txstatus_in;
+       uint32  d11_suppress;
+       uint32  wl_suppress;
+       uint32  bad_suppress;
+       uint32  pkt_dropped;
+       uint32  pkt_exptime;
+       uint32  pkt_freed;
+       uint32  pkt_free_err;
+       uint32  psq_wlsup_retx;
+       uint32  psq_wlsup_enq;
+       uint32  psq_d11sup_retx;
+       uint32  psq_d11sup_enq;
+       uint32  psq_hostq_retx;
+       uint32  psq_hostq_enq;
+       uint32  mac_handle_notfound;
+       uint32  wlc_tossed_pkts;
+       uint32  dhd_hdrpulls;
+       uint32  generic_error;
+       /* an extra one for bc/mc traffic */
+       uint32  send_pkts[AC_COUNT + 1];
+       uint32  drop_pkts[WLFC_PSQ_PREC_COUNT];
+       uint32  ooo_pkts[AC_COUNT + 1];
+#ifdef PROP_TXSTATUS_DEBUG
+       /** all pkt2bus -> txstatus latency accumulated */
+       uint32  latency_sample_count;
+       uint32  total_status_latency;
+       uint32  latency_most_recent;
+       int     idx_delta;
+       uint32  deltas[10];
+       uint32  fifo_credits_sent[6];
+       uint32  fifo_credits_back[6];
+       uint32  dropped_qfull[6];
+       uint32  signal_only_pkts_sent;
+       uint32  signal_only_pkts_freed;
+#endif
+       uint32  cleanup_txq_cnt;
+       uint32  cleanup_psq_cnt;
+       uint32  cleanup_fw_cnt;
+} athost_wl_stat_counters_t;
+
+#ifdef PROP_TXSTATUS_DEBUG
+#define WLFC_HOST_FIFO_CREDIT_INC_SENTCTRS(ctx, ac) do { \
+       (ctx)->stats.fifo_credits_sent[(ac)]++;} while (0)
+#define WLFC_HOST_FIFO_CREDIT_INC_BACKCTRS(ctx, ac) do { \
+       (ctx)->stats.fifo_credits_back[(ac)]++;} while (0)
+#define WLFC_HOST_FIFO_DROPPEDCTR_INC(ctx, ac) do { \
+       (ctx)->stats.dropped_qfull[(ac)]++;} while (0)
+#else
+#define WLFC_HOST_FIFO_CREDIT_INC_SENTCTRS(ctx, ac) do {} while (0)
+#define WLFC_HOST_FIFO_CREDIT_INC_BACKCTRS(ctx, ac) do {} while (0)
+#define WLFC_HOST_FIFO_DROPPEDCTR_INC(ctx, ac) do {} while (0)
+#endif
+#define WLFC_PACKET_BOUND              10
+#define WLFC_FCMODE_NONE                               0
+#define WLFC_FCMODE_IMPLIED_CREDIT             1
+#define WLFC_FCMODE_EXPLICIT_CREDIT            2
+#define WLFC_ONLY_AMPDU_HOSTREORDER            3
+
+/** Reserved credits ratio when borrowed by hihger priority */
+#define WLFC_BORROW_LIMIT_RATIO                4
+
+/** How long to defer borrowing in milliseconds */
+#define WLFC_BORROW_DEFER_PERIOD_MS 100
+
+/** How long to defer flow control in milliseconds */
+#define WLFC_FC_DEFER_PERIOD_MS 200
+
+/** How long to detect occurance per AC in miliseconds */
+#define WLFC_RX_DETECTION_THRESHOLD_MS 100
+
+/** Mask to represent available ACs (note: BC/MC is ignored) */
+#define WLFC_AC_MASK 0xF
+
+/** flow control specific information, only 1 instance during driver lifetime */
+typedef struct athost_wl_status_info {
+       uint8   last_seqid_to_wlc;
+
+       /** OSL handle */
+       osl_t *osh;
+       /** dhd public struct pointer */
+       void *dhdp;
+
+       f_commitpkt_t fcommit;
+       void* commit_ctx;
+
+       /** statistics */
+       athost_wl_stat_counters_t stats;
+
+       /** incremented on eg receiving a credit map event from the dongle */
+       int             Init_FIFO_credit[AC_COUNT + 2];
+       /** the additional ones are for bc/mc and ATIM FIFO */
+       int             FIFO_credit[AC_COUNT + 2];
+       /** Credit borrow counts for each FIFO from each of the other FIFOs */
+       int             credits_borrowed[AC_COUNT + 2][AC_COUNT + 2];
+
+       /** packet hanger and MAC->handle lookup table */
+       void *hanger;
+
+       struct {
+               /** table for individual nodes */
+               wlfc_mac_descriptor_t   nodes[WLFC_MAC_DESC_TABLE_SIZE];
+               /** table for interfaces */
+               wlfc_mac_descriptor_t   interfaces[WLFC_MAX_IFNUM];
+               /* OS may send packets to unknown (unassociated) destinations */
+               /** A place holder for bc/mc and packets to unknown destinations */
+               wlfc_mac_descriptor_t   other;
+       } destination_entries;
+
+       wlfc_mac_descriptor_t *active_entry_head; /**< a chain of MAC descriptors */
+       int active_entry_count;
+
+       wlfc_mac_descriptor_t *requested_entry[WLFC_MAC_DESC_TABLE_SIZE];
+       int requested_entry_count;
+
+       /* pkt counts for each interface and ac */
+       int     pkt_cnt_in_q[WLFC_MAX_IFNUM][AC_COUNT+1];
+       int     pkt_cnt_per_ac[AC_COUNT+1];
+       int     pkt_cnt_in_drv[WLFC_MAX_IFNUM][AC_COUNT+1];
+       int     pkt_cnt_in_psq;
+       uint8   allow_fc;              /**< Boolean */
+       uint32  fc_defer_timestamp;
+       uint32  rx_timestamp[AC_COUNT+1];
+
+       /** ON/OFF state for flow control to the host network interface */
+       uint8   hostif_flow_state[WLFC_MAX_IFNUM];
+       uint8   host_ifidx;
+
+       /** to flow control an OS interface */
+       uint8   toggle_host_if;
+
+       /** To borrow credits */
+       uint8   allow_credit_borrow;
+
+       /** ac number for the first single ac traffic */
+       uint8   single_ac;
+
+       /** Timestamp for the first single ac traffic */
+       uint32  single_ac_timestamp;
+
+       bool    bcmc_credit_supported;
+
+} athost_wl_status_info_t;
+
+/** Please be mindful that total pkttag space is 32 octets only */
+typedef struct dhd_pkttag {
+
+#ifdef BCM_OBJECT_TRACE
+       /* if use this field, keep it at the first 4 bytes */
+       uint32 sn;
+#endif /* BCM_OBJECT_TRACE */
+
+       /**
+       b[15]  - 1 = wlfc packet
+       b[14:13]  - encryption exemption
+       b[12 ] - 1 = event channel
+       b[11 ] - 1 = this packet was sent in response to one time packet request,
+       do not increment credit on status for this one. [WLFC_CTL_TYPE_MAC_REQUEST_PACKET].
+       b[10 ] - 1 = signal-only-packet to firmware [i.e. nothing to piggyback on]
+       b[9  ] - 1 = packet is host->firmware (transmit direction)
+              - 0 = packet received from firmware (firmware->host)
+       b[8  ] - 1 = packet was sent due to credit_request (pspoll),
+                    packet does not count against FIFO credit.
+              - 0 = normal transaction, packet counts against FIFO credit
+       b[7  ] - 1 = AP, 0 = STA
+       b[6:4] - AC FIFO number
+       b[3:0] - interface index
+       */
+       uint16  if_flags;
+
+       /**
+        * destination MAC address for this packet so that not every module needs to open the packet
+        * to find this
+        */
+       uint8   dstn_ether[ETHER_ADDR_LEN];
+
+       /** This 32-bit goes from host to device for every packet. */
+       uint32  htod_tag;
+
+       /** This 16-bit is original d11seq number for every suppressed packet. */
+       uint16  htod_seq;
+
+       /** This address is mac entry for every packet. */
+       void *entry;
+
+       /** bus specific stuff */
+       union {
+               struct {
+                       void *stuff;
+                       uint32 thing1;
+                       uint32 thing2;
+               } sd;
+
+               /* XXX: using the USB typedef here will complicate life for anybody using dhd.h */
+               struct {
+                       void *bus;
+                       void *urb;
+               } usb;
+       } bus_specific;
+} dhd_pkttag_t;
+
+#define DHD_PKTTAG_WLFCPKT_MASK                        0x1
+#define DHD_PKTTAG_WLFCPKT_SHIFT               15
+#define DHD_PKTTAG_WLFCPKT_SET(tag, value)     ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_WLFCPKT_MASK << DHD_PKTTAG_WLFCPKT_SHIFT)) | \
+       (((value) & DHD_PKTTAG_WLFCPKT_MASK) << DHD_PKTTAG_WLFCPKT_SHIFT)
+#define DHD_PKTTAG_WLFCPKT(tag)        ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_WLFCPKT_SHIFT) & DHD_PKTTAG_WLFCPKT_MASK)
+
+#define DHD_PKTTAG_EXEMPT_MASK                 0x3
+#define DHD_PKTTAG_EXEMPT_SHIFT                        13
+#define DHD_PKTTAG_EXEMPT_SET(tag, value)      ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_EXEMPT_MASK << DHD_PKTTAG_EXEMPT_SHIFT)) | \
+       (((value) & DHD_PKTTAG_EXEMPT_MASK) << DHD_PKTTAG_EXEMPT_SHIFT)
+#define DHD_PKTTAG_EXEMPT(tag) ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_EXEMPT_SHIFT) & DHD_PKTTAG_EXEMPT_MASK)
+
+#define DHD_PKTTAG_EVENT_MASK                  0x1
+#define DHD_PKTTAG_EVENT_SHIFT                 12
+#define DHD_PKTTAG_SETEVENT(tag, event)        ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_EVENT_MASK << DHD_PKTTAG_EVENT_SHIFT)) | \
+       (((event) & DHD_PKTTAG_EVENT_MASK) << DHD_PKTTAG_EVENT_SHIFT)
+#define DHD_PKTTAG_EVENT(tag)  ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_EVENT_SHIFT) & DHD_PKTTAG_EVENT_MASK)
+
+#define DHD_PKTTAG_ONETIMEPKTRQST_MASK         0x1
+#define DHD_PKTTAG_ONETIMEPKTRQST_SHIFT                11
+#define DHD_PKTTAG_SETONETIMEPKTRQST(tag)      ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_ONETIMEPKTRQST_MASK << DHD_PKTTAG_ONETIMEPKTRQST_SHIFT)) | \
+       (1 << DHD_PKTTAG_ONETIMEPKTRQST_SHIFT)
+#define DHD_PKTTAG_ONETIMEPKTRQST(tag) ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_ONETIMEPKTRQST_SHIFT) & DHD_PKTTAG_ONETIMEPKTRQST_MASK)
+
+#define DHD_PKTTAG_SIGNALONLY_MASK             0x1
+#define DHD_PKTTAG_SIGNALONLY_SHIFT            10
+#define DHD_PKTTAG_SETSIGNALONLY(tag, signalonly)      ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_SIGNALONLY_MASK << DHD_PKTTAG_SIGNALONLY_SHIFT)) | \
+       (((signalonly) & DHD_PKTTAG_SIGNALONLY_MASK) << DHD_PKTTAG_SIGNALONLY_SHIFT)
+#define DHD_PKTTAG_SIGNALONLY(tag)     ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_SIGNALONLY_SHIFT) & DHD_PKTTAG_SIGNALONLY_MASK)
+
+#define DHD_PKTTAG_PKTDIR_MASK                 0x1
+#define DHD_PKTTAG_PKTDIR_SHIFT                        9
+#define DHD_PKTTAG_SETPKTDIR(tag, dir) ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_PKTDIR_MASK << DHD_PKTTAG_PKTDIR_SHIFT)) | \
+       (((dir) & DHD_PKTTAG_PKTDIR_MASK) << DHD_PKTTAG_PKTDIR_SHIFT)
+#define DHD_PKTTAG_PKTDIR(tag) ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_PKTDIR_SHIFT) & DHD_PKTTAG_PKTDIR_MASK)
+
+#define DHD_PKTTAG_CREDITCHECK_MASK            0x1
+#define DHD_PKTTAG_CREDITCHECK_SHIFT           8
+#define DHD_PKTTAG_SETCREDITCHECK(tag, check)  ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_CREDITCHECK_MASK << DHD_PKTTAG_CREDITCHECK_SHIFT)) | \
+       (((check) & DHD_PKTTAG_CREDITCHECK_MASK) << DHD_PKTTAG_CREDITCHECK_SHIFT)
+#define DHD_PKTTAG_CREDITCHECK(tag)    ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_CREDITCHECK_SHIFT) & DHD_PKTTAG_CREDITCHECK_MASK)
+
+#define DHD_PKTTAG_IFTYPE_MASK                 0x1
+#define DHD_PKTTAG_IFTYPE_SHIFT                        7
+#define DHD_PKTTAG_SETIFTYPE(tag, isAP)        ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_IFTYPE_MASK << DHD_PKTTAG_IFTYPE_SHIFT)) | \
+       (((isAP) & DHD_PKTTAG_IFTYPE_MASK) << DHD_PKTTAG_IFTYPE_SHIFT)
+#define DHD_PKTTAG_IFTYPE(tag) ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_IFTYPE_SHIFT) & DHD_PKTTAG_IFTYPE_MASK)
+
+#define DHD_PKTTAG_FIFO_MASK                   0x7
+#define DHD_PKTTAG_FIFO_SHIFT                  4
+#define DHD_PKTTAG_SETFIFO(tag, fifo)  ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & ~(DHD_PKTTAG_FIFO_MASK << DHD_PKTTAG_FIFO_SHIFT)) | \
+       (((fifo) & DHD_PKTTAG_FIFO_MASK) << DHD_PKTTAG_FIFO_SHIFT)
+#define DHD_PKTTAG_FIFO(tag)           ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_FIFO_SHIFT) & DHD_PKTTAG_FIFO_MASK)
+
+#define DHD_PKTTAG_IF_MASK                     0xf
+#define DHD_PKTTAG_IF_SHIFT                    0
+#define DHD_PKTTAG_SETIF(tag, if)      ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & ~(DHD_PKTTAG_IF_MASK << DHD_PKTTAG_IF_SHIFT)) | \
+       (((if) & DHD_PKTTAG_IF_MASK) << DHD_PKTTAG_IF_SHIFT)
+#define DHD_PKTTAG_IF(tag)             ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_IF_SHIFT) & DHD_PKTTAG_IF_MASK)
+
+#define DHD_PKTTAG_SETDSTN(tag, dstn_MAC_ea)   memcpy(((dhd_pkttag_t*)((tag)))->dstn_ether, \
+       (dstn_MAC_ea), ETHER_ADDR_LEN)
+#define DHD_PKTTAG_DSTN(tag)   ((dhd_pkttag_t*)(tag))->dstn_ether
+
+#define DHD_PKTTAG_SET_H2DTAG(tag, h2dvalue)   ((dhd_pkttag_t*)(tag))->htod_tag = (h2dvalue)
+#define DHD_PKTTAG_H2DTAG(tag)                 (((dhd_pkttag_t*)(tag))->htod_tag)
+
+#define DHD_PKTTAG_SET_H2DSEQ(tag, seq)                ((dhd_pkttag_t*)(tag))->htod_seq = (seq)
+#define DHD_PKTTAG_H2DSEQ(tag)                 (((dhd_pkttag_t*)(tag))->htod_seq)
+
+#define DHD_PKTTAG_SET_ENTRY(tag, entry)       ((dhd_pkttag_t*)(tag))->entry = (entry)
+#define DHD_PKTTAG_ENTRY(tag)                  (((dhd_pkttag_t*)(tag))->entry)
+
+#define PSQ_SUP_IDX(x) (x * 2 + 1)
+#define PSQ_DLY_IDX(x) (x * 2)
+
+#ifdef PROP_TXSTATUS_DEBUG
+#define DHD_WLFC_CTRINC_MAC_CLOSE(entry)       do { (entry)->closed_ct++; } while (0)
+#define DHD_WLFC_CTRINC_MAC_OPEN(entry)                do { (entry)->opened_ct++; } while (0)
+#else
+#define DHD_WLFC_CTRINC_MAC_CLOSE(entry)       do {} while (0)
+#define DHD_WLFC_CTRINC_MAC_OPEN(entry)                do {} while (0)
+#endif
+
+#ifdef BCM_OBJECT_TRACE
+#define DHD_PKTTAG_SET_SN(tag, val)            ((dhd_pkttag_t*)(tag))->sn = (val)
+#define DHD_PKTTAG_SN(tag)                     (((dhd_pkttag_t*)(tag))->sn)
+#endif /* BCM_OBJECT_TRACE */
+
+/* public functions */
+int dhd_wlfc_parse_header_info(dhd_pub_t *dhd, void* pktbuf, int tlv_hdr_len,
+       uchar *reorder_info_buf, uint *reorder_info_len);
+KERNEL_THREAD_RETURN_TYPE dhd_wlfc_transfer_packets(void *data);
+int dhd_wlfc_commit_packets(dhd_pub_t *dhdp, f_commitpkt_t fcommit,
+       void* commit_ctx, void *pktbuf, bool need_toggle_host_if);
+int dhd_wlfc_txcomplete(dhd_pub_t *dhd, void *txp, bool success);
+int dhd_wlfc_init(dhd_pub_t *dhd);
+#ifdef SUPPORT_P2P_GO_PS
+int dhd_wlfc_suspend(dhd_pub_t *dhd);
+int dhd_wlfc_resume(dhd_pub_t *dhd);
+#endif /* SUPPORT_P2P_GO_PS */
+int dhd_wlfc_hostreorder_init(dhd_pub_t *dhd);
+int dhd_wlfc_cleanup_txq(dhd_pub_t *dhd, f_processpkt_t fn, void *arg);
+int dhd_wlfc_cleanup(dhd_pub_t *dhd, f_processpkt_t fn, void* arg);
+int dhd_wlfc_deinit(dhd_pub_t *dhd);
+int dhd_wlfc_interface_event(dhd_pub_t *dhdp, uint8 action, uint8 ifid, uint8 iftype, uint8* ea);
+int dhd_wlfc_FIFOcreditmap_event(dhd_pub_t *dhdp, uint8* event_data);
+#ifdef LIMIT_BORROW
+int dhd_wlfc_disable_credit_borrow_event(dhd_pub_t *dhdp, uint8* event_data);
+#endif /* LIMIT_BORROW */
+int dhd_wlfc_BCMCCredit_support_event(dhd_pub_t *dhdp);
+int dhd_wlfc_enable(dhd_pub_t *dhdp);
+int dhd_wlfc_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf);
+int dhd_wlfc_clear_counts(dhd_pub_t *dhd);
+int dhd_wlfc_get_enable(dhd_pub_t *dhd, bool *val);
+int dhd_wlfc_get_mode(dhd_pub_t *dhd, int *val);
+int dhd_wlfc_set_mode(dhd_pub_t *dhd, int val);
+bool dhd_wlfc_is_supported(dhd_pub_t *dhd);
+bool dhd_wlfc_is_header_only_pkt(dhd_pub_t * dhd, void *pktbuf);
+int dhd_wlfc_flowcontrol(dhd_pub_t *dhdp, bool state, bool bAcquireLock);
+int dhd_wlfc_save_rxpath_ac_time(dhd_pub_t * dhd, uint8 prio);
+
+int dhd_wlfc_get_module_ignore(dhd_pub_t *dhd, int *val);
+int dhd_wlfc_set_module_ignore(dhd_pub_t *dhd, int val);
+int dhd_wlfc_get_credit_ignore(dhd_pub_t *dhd, int *val);
+int dhd_wlfc_set_credit_ignore(dhd_pub_t *dhd, int val);
+int dhd_wlfc_get_txstatus_ignore(dhd_pub_t *dhd, int *val);
+int dhd_wlfc_set_txstatus_ignore(dhd_pub_t *dhd, int val);
+
+int dhd_wlfc_get_rxpkt_chk(dhd_pub_t *dhd, int *val);
+int dhd_wlfc_set_rxpkt_chk(dhd_pub_t *dhd, int val);
+#ifdef PROPTX_MAXCOUNT
+int dhd_wlfc_update_maxcount(dhd_pub_t *dhdp, uint8 ifid, int maxcount);
+#endif /* PROPTX_MAXCOUNT */
+
+#endif /* __wlfc_host_driver_definitions_h__ */
diff --git a/bcmdhd.101.10.240.x/frag.c b/bcmdhd.101.10.240.x/frag.c
new file mode 100644 (file)
index 0000000..e49c335
--- /dev/null
@@ -0,0 +1,108 @@
+/*
+ * IE/TLV fragmentation/defragmentation support for
+ * Broadcom 802.11bang Networking Device Driver
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <bcmutils.h>
+#include <frag.h>
+#include <802.11.h>
+
+/* defrag a fragmented dot11 ie/tlv. if space does not permit, return the needed
+ * ie length to contain all the fragments with status BCME_BUFTOOSHORT.
+ * out_len is in/out parameter, max length on input, used/required length on output
+ */
+int
+bcm_tlv_dot11_defrag(const void *buf, uint buf_len, uint8 id, bool id_ext,
+       uint8 *out, uint *out_len)
+{
+       int err = BCME_OK;
+       const bcm_tlv_t *ie;
+       uint tot_len = 0;
+       uint out_left;
+
+       /* find the ie; includes validation */
+       ie = bcm_parse_tlvs_dot11(buf, buf_len, id, id_ext);
+       if (!ie) {
+               err = BCME_IE_NOTFOUND;
+               goto done;
+       }
+
+       out_left =  (out && out_len) ? *out_len : 0;
+
+       /* first fragment */
+       tot_len = id_ext ? ie->len - 1 : ie->len;
+
+       /* copy out if output space permits */
+       if (out_left < tot_len) {
+               err = BCME_BUFTOOSHORT;
+               out_left = 0; /* prevent further copy */
+       } else {
+               memcpy(out, &ie->data[id_ext ? 1 : 0], tot_len);
+               out += tot_len;
+               out_left -= tot_len;
+       }
+
+       /* if not fragmened or not fragmentable per 802.11 table  9-77 11md0.1 bail
+        * we can introduce the latter check later
+        */
+       if (ie->len != BCM_TLV_MAX_DATA_SIZE) {
+               goto done;
+       }
+
+       /* adjust buf_len to length after ie including it */
+       buf_len -= (uint)(((const uint8 *)ie - (const uint8 *)buf));
+
+       /* update length from fragments, okay if no next ie */
+       while ((ie = bcm_next_tlv(ie, &buf_len)) &&
+                       (ie->id == DOT11_MNG_FRAGMENT_ID)) {
+               /* note: buf_len starts at next ie and last frag may be partial */
+               if (out_left < ie->len) {
+                       err = BCME_BUFTOOSHORT;
+                       out_left = 0;
+               } else {
+                       memcpy(out, &ie->data[0], ie->len);
+                       out += ie->len;
+                       out_left -= ie->len;
+               }
+
+               tot_len += ie->len + BCM_TLV_HDR_SIZE;
+
+               /* all but last should be of max size */
+               if (ie->len < BCM_TLV_MAX_DATA_SIZE) {
+                       break;
+               }
+       }
+
+done:
+       if (out_len) {
+               *out_len = tot_len;
+       }
+
+       return err;
+}
+
+int
+bcm_tlv_dot11_frag_tot_len(const void *buf, uint buf_len,
+       uint8 id, bool id_ext, uint *ie_len)
+{
+       return  bcm_tlv_dot11_defrag(buf, buf_len, id, id_ext, NULL, ie_len);
+}
diff --git a/bcmdhd.101.10.240.x/frag.h b/bcmdhd.101.10.240.x/frag.h
new file mode 100644 (file)
index 0000000..e14edd9
--- /dev/null
@@ -0,0 +1,32 @@
+/*
+ * IE/TLV (de)fragmentation declarations/definitions for
+ * Broadcom 802.11abgn Networking Device Driver
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ *
+ */
+
+#ifndef __FRAG_H__
+#define __FRAG_H__
+
+int bcm_tlv_dot11_frag_tot_len(const void *buf, uint buf_len,
+       uint8 id, bool id_ext, uint *ie_len);
+
+#endif /* __FRAG_H__ */
diff --git a/bcmdhd.101.10.240.x/hnd_pktpool.c b/bcmdhd.101.10.240.x/hnd_pktpool.c
new file mode 100644 (file)
index 0000000..32eb6ff
--- /dev/null
@@ -0,0 +1,2142 @@
+/*
+ * HND generic packet pool operation primitives
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <osl_ext.h>
+#include <bcmutils.h>
+#include <wlioctl.h>
+#include <hnd_pktpool.h>
+#ifdef HWA
+#include <hwa_pub_shared.h>
+#endif /* HWA */
+#ifdef BCMRESVFRAGPOOL
+#include <hnd_resvpool.h>
+#endif /* BCMRESVFRAGPOOL */
+#ifdef BCMFRWDPOOLREORG
+#include <hnd_poolreorg.h>
+#endif /* BCMFRWDPOOLREORG */
+
+/* mutex macros for thread safe */
+#ifdef HND_PKTPOOL_THREAD_SAFE
+#define HND_PKTPOOL_MUTEX_CREATE(name, mutex)  osl_ext_mutex_create(name, mutex)
+#define HND_PKTPOOL_MUTEX_DELETE(mutex)                osl_ext_mutex_delete(mutex)
+#define HND_PKTPOOL_MUTEX_ACQUIRE(mutex, msec) osl_ext_mutex_acquire(mutex, msec)
+#define HND_PKTPOOL_MUTEX_RELEASE(mutex)       osl_ext_mutex_release(mutex)
+#else
+#define HND_PKTPOOL_MUTEX_CREATE(name, mutex)  OSL_EXT_SUCCESS
+#define HND_PKTPOOL_MUTEX_DELETE(mutex)                OSL_EXT_SUCCESS
+#define HND_PKTPOOL_MUTEX_ACQUIRE(mutex, msec) OSL_EXT_SUCCESS
+#define HND_PKTPOOL_MUTEX_RELEASE(mutex)       OSL_EXT_SUCCESS
+#endif
+
+/* Registry size is one larger than max pools, as slot #0 is reserved */
+#define PKTPOOLREG_RSVD_ID                             (0U)
+#define PKTPOOLREG_RSVD_PTR                            (POOLPTR(0xdeaddead))
+#define PKTPOOLREG_FREE_PTR                            (POOLPTR(NULL))
+
+#define PKTPOOL_REGISTRY_SET(id, pp)   (pktpool_registry_set((id), (pp)))
+#define PKTPOOL_REGISTRY_CMP(id, pp)   (pktpool_registry_cmp((id), (pp)))
+
+/* Tag a registry entry as free for use */
+#define PKTPOOL_REGISTRY_CLR(id)               \
+               PKTPOOL_REGISTRY_SET((id), PKTPOOLREG_FREE_PTR)
+#define PKTPOOL_REGISTRY_ISCLR(id)             \
+               (PKTPOOL_REGISTRY_CMP((id), PKTPOOLREG_FREE_PTR))
+
+/* Tag registry entry 0 as reserved */
+#define PKTPOOL_REGISTRY_RSV()                 \
+               PKTPOOL_REGISTRY_SET(PKTPOOLREG_RSVD_ID, PKTPOOLREG_RSVD_PTR)
+#define PKTPOOL_REGISTRY_ISRSVD()              \
+               (PKTPOOL_REGISTRY_CMP(PKTPOOLREG_RSVD_ID, PKTPOOLREG_RSVD_PTR))
+
+/* Walk all un-reserved entries in registry */
+#define PKTPOOL_REGISTRY_FOREACH(id)   \
+               for ((id) = 1U; (id) <= pktpools_max; (id)++)
+
+enum pktpool_empty_cb_state {
+       EMPTYCB_ENABLED = 0,    /* Enable callback when new packets are added to pool */
+       EMPTYCB_DISABLED,       /* Disable callback when new packets are added to pool */
+       EMPTYCB_SKIPPED         /* Packet was added to pool when callback was disabled */
+};
+
+uint32 pktpools_max = 0U; /* maximum number of pools that may be initialized */
+pktpool_t *pktpools_registry[PKTPOOL_MAXIMUM_ID + 1]; /* Pktpool registry */
+
+#ifdef POOL_HEAP_RECONFIG
+typedef struct pktpool_heap_cb_reg {
+       pktpool_heap_cb_t fn;
+       void *ctxt;
+       uint32 flag;
+} pktpool_heap_cb_reg_t;
+#define PKTPOOL_MAX_HEAP_CB    2
+pktpool_heap_cb_reg_t  pktpool_heap_cb_reg[PKTPOOL_MAX_HEAP_CB];
+uint32 pktpool_heap_rel_active = 0U;
+
+typedef struct d11hdr_buf_list {
+       struct d11hdr_buf_list *next;
+       uint8 data[];
+} d11hdr_buf_list_t;
+#ifndef HWA
+static void hnd_pktpool_heap_pkt_release(osl_t *osh, pktpool_t *pktp, uint32 flag);
+static void hnd_pktpool_heap_pkt_retrieve(pktpool_t *pktp, uint32 flag);
+#endif /* !HWA */
+static int hnd_pktpool_heap_get_cb(uint8 handle, void *ctxt, void *pkt, uint pktsize);
+static void hnd_pktpool_lbuf_free_cb(uint8 poolid);
+static pktpool_heap_cb_reg_t *BCMRAMFN(hnd_pool_get_cb_registry)(void);
+#endif /* POOL_HEAP_RECONFIG */
+
+/* Register/Deregister a pktpool with registry during pktpool_init/deinit */
+static int pktpool_register(pktpool_t * poolptr);
+static int pktpool_deregister(pktpool_t * poolptr);
+
+/** add declaration */
+static void pktpool_avail_notify(pktpool_t *pktp);
+
+/** accessor functions required when ROMming this file, forced into RAM */
+
+pktpool_t *
+BCMRAMFN(get_pktpools_registry)(int id)
+{
+       return pktpools_registry[id];
+}
+
+static void
+BCMRAMFN(pktpool_registry_set)(int id, pktpool_t *pp)
+{
+       pktpools_registry[id] = pp;
+}
+
+static bool
+BCMRAMFN(pktpool_registry_cmp)(int id, pktpool_t *pp)
+{
+       return pktpools_registry[id] == pp;
+}
+
+/** Constructs a pool registry to serve a maximum of total_pools */
+int
+pktpool_attach(osl_t *osh, uint32 total_pools)
+{
+       uint32 poolid;
+       BCM_REFERENCE(osh);
+
+       if (pktpools_max != 0U) {
+               return BCME_ERROR;
+       }
+
+       ASSERT(total_pools <= PKTPOOL_MAXIMUM_ID);
+
+       /* Initialize registry: reserve slot#0 and tag others as free */
+       PKTPOOL_REGISTRY_RSV();         /* reserve slot#0 */
+
+       PKTPOOL_REGISTRY_FOREACH(poolid) {      /* tag all unreserved entries as free */
+               PKTPOOL_REGISTRY_CLR(poolid);
+       }
+
+       pktpools_max = total_pools;
+
+       return (int)pktpools_max;
+}
+
+/** Destructs the pool registry. Ascertain all pools were first de-inited */
+int
+pktpool_dettach(osl_t *osh)
+{
+       uint32 poolid;
+       BCM_REFERENCE(osh);
+
+       if (pktpools_max == 0U) {
+               return BCME_OK;
+       }
+
+       /* Ascertain that no pools are still registered */
+       ASSERT(PKTPOOL_REGISTRY_ISRSVD()); /* assert reserved slot */
+
+       PKTPOOL_REGISTRY_FOREACH(poolid) {      /* ascertain all others are free */
+               ASSERT(PKTPOOL_REGISTRY_ISCLR(poolid));
+       }
+
+       pktpools_max = 0U; /* restore boot state */
+
+       return BCME_OK;
+}
+
+/** Registers a pool in a free slot; returns the registry slot index */
+static int
+pktpool_register(pktpool_t * poolptr)
+{
+       uint32 poolid;
+
+       if (pktpools_max == 0U) {
+               return PKTPOOL_INVALID_ID; /* registry has not yet been constructed */
+       }
+
+       ASSERT(pktpools_max != 0U);
+
+       /* find an empty slot in pktpools_registry */
+       PKTPOOL_REGISTRY_FOREACH(poolid) {
+               if (PKTPOOL_REGISTRY_ISCLR(poolid)) {
+                       PKTPOOL_REGISTRY_SET(poolid, POOLPTR(poolptr)); /* register pool */
+                       return (int)poolid; /* return pool ID */
+               }
+       } /* FOREACH */
+
+       return PKTPOOL_INVALID_ID;      /* error: registry is full */
+}
+
+/** Deregisters a pktpool, given the pool pointer; tag slot as free */
+static int
+pktpool_deregister(pktpool_t * poolptr)
+{
+       uint32 poolid;
+
+       ASSERT(POOLPTR(poolptr) != POOLPTR(NULL));
+
+       poolid = POOLID(poolptr);
+       ASSERT(poolid <= pktpools_max);
+
+       /* Asertain that a previously registered poolptr is being de-registered */
+       if (PKTPOOL_REGISTRY_CMP(poolid, POOLPTR(poolptr))) {
+               PKTPOOL_REGISTRY_CLR(poolid); /* mark as free */
+       } else {
+               ASSERT(0);
+               return BCME_ERROR; /* mismatch in registry */
+       }
+
+       return BCME_OK;
+}
+
+/**
+ * pktpool_init:
+ * User provides a pktpool_t structure and specifies the number of packets to
+ * be pre-filled into the pool (n_pkts).
+ * pktpool_init first attempts to register the pool and fetch a unique poolid.
+ * If registration fails, it is considered an BCME_ERR, caused by either the
+ * registry was not pre-created (pktpool_attach) or the registry is full.
+ * If registration succeeds, then the requested number of packets will be filled
+ * into the pool as part of initialization. In the event that there is no
+ * available memory to service the request, then BCME_NOMEM will be returned
+ * along with the count of how many packets were successfully allocated.
+ * In dongle builds, prior to memory reclaimation, one should limit the number
+ * of packets to be allocated during pktpool_init and fill the pool up after
+ * reclaim stage.
+ *
+ * @param n_pkts           Number of packets to be pre-filled into the pool
+ * @param max_pkt_bytes   The size of all packets in a pool must be the same. E.g. PKTBUFSZ.
+ * @param type            e.g. 'lbuf_frag'
+ */
+int
+pktpool_init(osl_t *osh,
+       pktpool_t *pktp,
+       int *n_pkts,
+       int max_pkt_bytes,
+       bool istx,
+       uint8 type,
+       bool is_heap_pool,
+       uint32 heap_pool_flag,
+       uint16 min_backup_buf)
+{
+       int i, err = BCME_OK;
+       int pktplen;
+       uint8 pktp_id;
+
+       ASSERT(pktp != NULL);
+       ASSERT(osh != NULL);
+       ASSERT(n_pkts != NULL);
+
+       pktplen = *n_pkts;
+
+       bzero(pktp, sizeof(pktpool_t));
+
+       /* assign a unique pktpool id */
+       if ((pktp_id = (uint8) pktpool_register(pktp)) == PKTPOOL_INVALID_ID) {
+               return BCME_ERROR;
+       }
+       POOLSETID(pktp, pktp_id);
+
+       pktp->inited = TRUE;
+       pktp->istx = istx ? TRUE : FALSE;
+       pktp->max_pkt_bytes = (uint16)max_pkt_bytes;
+       pktp->type = type;
+
+#ifdef POOL_HEAP_RECONFIG
+       pktp->poolheap_flag = heap_pool_flag;
+       pktp->poolheap_count = 0;
+       pktp->min_backup_buf = min_backup_buf;
+       if (is_heap_pool) {
+               if (rte_freelist_mgr_register(&pktp->mem_handle,
+                       hnd_pktpool_heap_get_cb,
+                       lb_get_pktalloclen(type, max_pkt_bytes),
+                       pktp) != BCME_OK) {
+                       return BCME_ERROR;
+               }
+       }
+       pktp->is_heap_pool = is_heap_pool;
+#endif
+       if (HND_PKTPOOL_MUTEX_CREATE("pktpool", &pktp->mutex) != OSL_EXT_SUCCESS) {
+               return BCME_ERROR;
+       }
+
+       pktp->maxlen = PKTPOOL_LEN_MAX;
+       pktplen = LIMIT_TO_MAX(pktplen, pktp->maxlen);
+
+       for (i = 0; i < pktplen; i++) {
+               void *p;
+               p = PKTGET(osh, max_pkt_bytes, TRUE);
+
+               if (p == NULL) {
+                       /* Not able to allocate all requested pkts
+                        * so just return what was actually allocated
+                        * We can add to the pool later
+                        */
+                       if (pktp->freelist == NULL) /* pktpool free list is empty */
+                               err = BCME_NOMEM;
+
+                       goto exit;
+               }
+
+               PKTSETPOOL(osh, p, TRUE, pktp); /* Tag packet with pool ID */
+
+               PKTSETFREELIST(p, pktp->freelist); /* insert p at head of free list */
+               pktp->freelist = p;
+
+               pktp->avail++;
+
+#ifdef BCMDBG_POOL
+               pktp->dbg_q[pktp->dbg_qlen++].p = p;
+#endif
+       }
+
+exit:
+       pktp->n_pkts = pktp->avail;
+
+       *n_pkts = pktp->n_pkts; /* number of packets managed by pool */
+       return err;
+} /* pktpool_init */
+
+/**
+ * pktpool_deinit:
+ * Prior to freeing a pktpool, all packets must be first freed into the pktpool.
+ * Upon pktpool_deinit, all packets in the free pool will be freed to the heap.
+ * An assert is in place to ensure that there are no packets still lingering
+ * around. Packets freed to a pool after the deinit will cause a memory
+ * corruption as the pktpool_t structure no longer exists.
+ */
+int
+pktpool_deinit(osl_t *osh, pktpool_t *pktp)
+{
+       uint16 freed = 0;
+
+       ASSERT(osh != NULL);
+       ASSERT(pktp != NULL);
+
+#ifdef BCMDBG_POOL
+       {
+               int i;
+               for (i = 0; i <= pktp->n_pkts; i++) {
+                       pktp->dbg_q[i].p = NULL;
+               }
+       }
+#endif
+
+       while (pktp->freelist != NULL) {
+               void * p = pktp->freelist;
+
+               pktp->freelist = PKTFREELIST(p); /* unlink head packet from free list */
+               PKTSETFREELIST(p, NULL);
+
+               PKTSETPOOL(osh, p, FALSE, NULL); /* clear pool ID tag in pkt */
+
+               PKTFREE(osh, p, pktp->istx); /* free the packet */
+
+               freed++;
+               ASSERT(freed <= pktp->n_pkts);
+       }
+
+       pktp->avail -= freed;
+       ASSERT(pktp->avail == 0);
+
+       pktp->n_pkts -= freed;
+
+       pktpool_deregister(pktp); /* release previously acquired unique pool id */
+       POOLSETID(pktp, PKTPOOL_INVALID_ID);
+
+       if (HND_PKTPOOL_MUTEX_DELETE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       pktp->inited = FALSE;
+
+       /* Are there still pending pkts? */
+       ASSERT(pktp->n_pkts == 0);
+
+       return 0;
+}
+
+int
+pktpool_fill(osl_t *osh, pktpool_t *pktp, bool minimal)
+{
+       void *p;
+       int err = 0;
+       int n_pkts, psize, maxlen;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       ASSERT(pktp->max_pkt_bytes != 0);
+
+       maxlen = pktp->maxlen;
+       psize = minimal ? (maxlen >> 2) : maxlen;
+       n_pkts = (int)pktp->n_pkts;
+#ifdef POOL_HEAP_RECONFIG
+       /*
+        * Consider the packets released to freelist mgr also
+        * as part of pool size
+        */
+       n_pkts += pktp->is_heap_pool ?
+               pktp->poolheap_count : 0;
+#endif
+       for (; n_pkts < psize; n_pkts++) {
+
+               p = PKTGET(osh, pktp->n_pkts, TRUE);
+
+               if (p == NULL) {
+                       err = BCME_NOMEM;
+                       break;
+               }
+
+               if (pktpool_add(pktp, p) != BCME_OK) {
+                       PKTFREE(osh, p, FALSE);
+                       err = BCME_ERROR;
+                       break;
+               }
+       }
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       if (pktp->cbcnt) {
+               if (pktp->empty == FALSE)
+                       pktpool_avail_notify(pktp);
+       }
+
+       return err;
+}
+
+#ifdef BCMD11HDRPOOL
+
+/**
+ * d11hdr_pool_init:
+ * User provides a pktpool_t structure and specifies the number of packets to
+ * be pre-filled into the pool (n_pkts).
+ * pktpool_init first attempts to register the pool and fetch a unique poolid.
+ * If registration fails, it is considered an BCME_ERR, caused by either the
+ * registry was not pre-created (pktpool_attach) or the registry is full.
+ * If registration succeeds, then the requested number of packets will be filled
+ * into the pool as part of initialization. In the event that there is no
+ * available memory to service the request, then BCME_NOMEM will be returned
+ * along with the count of how many packets were successfully allocated.
+ * In dongle builds, prior to memory reclaimation, one should limit the number
+ * of packets to be allocated during pktpool_init and fill the pool up after
+ * reclaim stage.
+ *
+ * @param n_pkts           Number of packets to be pre-filled into the pool
+ * @param max_pkt_bytes   The size of all packets in a pool must be the same. E.g. PKTBUFSZ.
+ * @param type            e.g. 'lbuf_frag'
+ */
+int
+d11hdr_pool_init(osl_t *osh,
+       pktpool_t *pktp,
+       uint *n_pkts,
+       uint max_pkt_bytes,
+       bool istx,
+       uint8 type,
+       bool is_heap_pool,
+       uint32 heap_pool_flag,
+       uint16 min_backup_buf)
+{
+       int err = BCME_OK;
+       uint i, pktplen;
+       uint8 pktp_id;
+
+       ASSERT(pktp != NULL);
+       ASSERT(osh != NULL);
+       ASSERT(n_pkts != NULL);
+
+       pktplen = *n_pkts;
+
+       bzero(pktp, sizeof(pktpool_t));
+
+       /* assign a unique pktpool id */
+       if ((pktp_id = (uint8) pktpool_register(pktp)) == PKTPOOL_INVALID_ID) {
+               return BCME_ERROR;
+       }
+       POOLSETID(pktp, pktp_id);
+
+       pktp->inited = TRUE;
+       pktp->istx = istx ? TRUE : FALSE;
+       pktp->max_pkt_bytes = (uint16)max_pkt_bytes;
+       pktp->type = type;
+
+#ifdef POOL_HEAP_RECONFIG
+       pktp->poolheap_flag = heap_pool_flag;
+       pktp->poolheap_count = 0;
+       pktp->min_backup_buf = min_backup_buf;
+       if (is_heap_pool) {
+               uint32 buf_size = ROUNDUP(max_pkt_bytes, sizeof(int));
+               err = rte_freelist_mgr_register(&pktp->mem_handle,
+                               hnd_pktpool_heap_get_cb, buf_size, pktp);
+               if (err != BCME_OK) {
+                       return err;
+               }
+       }
+       pktp->is_heap_pool = is_heap_pool;
+#endif
+       if (HND_PKTPOOL_MUTEX_CREATE("pktpool", &pktp->mutex) != OSL_EXT_SUCCESS) {
+               return BCME_ERROR;
+       }
+
+       pktp->maxlen = PKTPOOL_LEN_MAX;
+       pktplen = LIMIT_TO_MAX(pktplen, pktp->maxlen);
+
+       for (i = 0; i < pktplen; i++) {
+               void *p;
+               p = MALLOC_ALIGN_CALLSITE(osh, max_pkt_bytes, 0, CALL_SITE);
+
+               if (p == NULL) {
+                       if (pktp->freelist == NULL) /* pktpool free list is empty */
+                               err = BCME_NOMEM;
+
+                       /* Not able to allocate all requested pkts
+                        * so just return what was actually allocated
+                        * We can add to the pool later
+                        */
+                       goto exit;
+               }
+               pktp->n_pkts++;
+               d11hdr_pool_enq(pktp, p);
+       }
+
+exit:
+       *n_pkts = pktp->n_pkts; /* number of packets managed by pool */
+       return err;
+} /* pktpool_init */
+
+/**
+ * pktpool_deinit:
+ * Prior to freeing a pktpool, all packets must be first freed into the pktpool.
+ * Upon pktpool_deinit, all packets in the free pool will be freed to the heap.
+ * An assert is in place to ensure that there are no packets still lingering
+ * around. Packets freed to a pool after the deinit will cause a memory
+ * corruption as the pktpool_t structure no longer exists.
+ */
+int
+d11hdr_pool_deinit(osl_t *osh, pktpool_t *pktp)
+{
+       uint16 freed = 0;
+
+       ASSERT(osh != NULL);
+       ASSERT(pktp != NULL);
+
+       while (pktp->freelist != NULL) {
+               d11hdr_buf_list_t *p;
+
+               p = pktp->freelist;
+               pktp->freelist = p->next; /* unlink head packet from free list */
+               MFREE(osh, p, pktp->max_pkt_bytes);
+               freed++;
+               ASSERT(freed <= pktp->n_pkts);
+       }
+
+       pktp->avail -= freed;
+       ASSERT(pktp->avail == 0);
+
+       pktp->n_pkts -= freed;
+
+       pktpool_deregister(pktp); /* release previously acquired unique pool id */
+       POOLSETID(pktp, PKTPOOL_INVALID_ID);
+
+       if (HND_PKTPOOL_MUTEX_DELETE(&pktp->mutex) != OSL_EXT_SUCCESS) {
+               return BCME_ERROR;
+       }
+
+       pktp->inited = FALSE;
+
+       /* Are there still pending pkts? */
+       ASSERT(pktp->n_pkts == 0);
+
+       return 0;
+}
+
+int
+d11hdr_pool_fill(osl_t *osh, pktpool_t *pktp, bool minimal)
+{
+       void *p;
+       int err = 0;
+       uint n_pkts, psize, maxlen;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS) {
+               return BCME_ERROR;
+       }
+
+       ASSERT(pktp->max_pkt_bytes != 0);
+
+       maxlen = pktp->maxlen;
+       psize = minimal ? (maxlen >> 2) : maxlen;
+       n_pkts = pktp->n_pkts;
+#ifdef POOL_HEAP_RECONFIG
+       /*
+        * Consider the packets released to freelist mgr also
+        * as part of pool size
+        */
+       n_pkts += pktp->is_heap_pool ? pktp->poolheap_count : 0;
+#endif
+       for (; n_pkts < psize; n_pkts++) {
+               p = MALLOC_ALIGN_CALLSITE(osh, pktp->max_pkt_bytes, 0, CALL_SITE);
+               if (p == NULL) {
+                       err = BCME_NOMEM;
+                       break;
+               }
+               pktp->n_pkts++;
+               d11hdr_pool_enq(pktp, p);
+       }
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS) {
+               OSL_SYS_HALT();
+               return BCME_ERROR;
+       }
+
+       return err;
+}
+
+void *
+BCMFASTPATH(d11hdr_pool_deq)(pktpool_t *pktp)
+{
+       d11hdr_buf_list_t *p = NULL;
+
+       if (pktp->avail == 0) {
+               return NULL;
+       }
+       ASSERT_FP(pktp->freelist != NULL);
+
+       p = pktp->freelist;  /* dequeue packet from head of pktpool free list */
+       pktp->freelist = p->next; /* free list points to next packet */
+       pktp->avail--;
+       return p;
+}
+
+void
+BCMFASTPATH(d11hdr_pool_enq)(pktpool_t *pktp, void *p)
+{
+       ASSERT_FP(p != NULL);
+       d11hdr_buf_list_t *pn = p;
+
+       pn->next = pktp->freelist;
+       pktp->freelist = pn; /* free list points to newly inserted packet */
+       pktp->avail++;
+       ASSERT_FP(pktp->avail <= pktp->n_pkts);
+}
+#endif /* BCMD11HDRPOOL */
+
+#ifdef BCMPOOLRECLAIM
+/* New API to decrease the pkts from pool, but not deinit
+*/
+uint16
+pktpool_reclaim(osl_t *osh, pktpool_t *pktp, uint16 free_cnt, uint8 action)
+{
+       uint16 freed = 0;
+
+       pktpool_cb_extn_t cb = NULL;
+       void *arg = NULL;
+       void *rem_list_head = NULL;
+       void *rem_list_tail = NULL;
+       bool dont_free = FALSE;
+
+       ASSERT(osh != NULL);
+       ASSERT(pktp != NULL);
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS) {
+               return freed;
+       }
+
+       if (pktp->avail < free_cnt) {
+               free_cnt = pktp->avail;
+       }
+
+       if (BCMSPLITRX_ENAB() && (pktp->type == lbuf_rxfrag)) {
+               /* If pool is shared rx frag pool, use call back fn to reclaim host address
+                * and Rx cpl ID associated with the pkt.
+                */
+               ASSERT(pktp->cbext.cb != NULL);
+
+               cb = pktp->cbext.cb;
+               arg = pktp->cbext.arg;
+
+       } else if ((pktp->type == lbuf_basic) && (pktp->rxcplidfn.cb != NULL)) {
+               /* If pool is shared rx pool, use call back fn to freeup Rx cpl ID
+                * associated with the pkt.
+                */
+               cb = pktp->rxcplidfn.cb;
+               arg = pktp->rxcplidfn.arg;
+       }
+
+       while ((pktp->freelist != NULL) && (free_cnt)) {
+               void * p = pktp->freelist;
+
+               pktp->freelist = PKTFREELIST(p); /* unlink head packet from free list */
+               PKTSETFREELIST(p, NULL);
+
+               dont_free = FALSE;
+
+               if (action == FREE_ALL_FRAG_PKTS) {
+                       /* Free lbufs which are marked as frag_free_mem */
+                       if (!PKTISFRMFRAG(p)) {
+                               dont_free = TRUE;
+                       }
+               }
+
+               if (dont_free) {
+                       if (rem_list_head == NULL) {
+                               rem_list_head = p;
+                       } else {
+                               PKTSETFREELIST(rem_list_tail, p);
+                       }
+                       rem_list_tail = p;
+                       continue;
+               }
+               if (cb != NULL) {
+                       if (cb(pktp, arg, p, REMOVE_RXCPLID)) {
+                               PKTSETFREELIST(p, pktp->freelist);
+                               pktp->freelist = p;
+                               break;
+                       }
+               }
+
+               PKTSETPOOL(osh, p, FALSE, NULL); /* clear pool ID tag in pkt */
+
+               pktp->avail--;
+               pktp->n_pkts--;
+
+               PKTFREE(osh, p, pktp->istx); /* free the packet */
+
+               freed++;
+               free_cnt--;
+       }
+
+       if (rem_list_head) {
+               PKTSETFREELIST(rem_list_tail, pktp->freelist);
+               pktp->freelist = rem_list_head;
+       }
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS) {
+               return freed;
+       }
+
+       return freed;
+}
+#endif /* #ifdef BCMPOOLRECLAIM */
+
+/* New API to empty the pkts from pool, but not deinit
+* NOTE: caller is responsible to ensure,
+*      all pkts are available in pool for free; else LEAK !
+*/
+int
+pktpool_empty(osl_t *osh, pktpool_t *pktp)
+{
+       uint16 freed = 0;
+
+       ASSERT(osh != NULL);
+       ASSERT(pktp != NULL);
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+#ifdef BCMDBG_POOL
+       {
+               int i;
+               for (i = 0; i <= pktp->n_pkts; i++) {
+                       pktp->dbg_q[i].p = NULL;
+               }
+       }
+#endif
+
+       while (pktp->freelist != NULL) {
+               void * p = pktp->freelist;
+
+               pktp->freelist = PKTFREELIST(p); /* unlink head packet from free list */
+               PKTSETFREELIST(p, NULL);
+
+               PKTSETPOOL(osh, p, FALSE, NULL); /* clear pool ID tag in pkt */
+
+               PKTFREE(osh, p, pktp->istx); /* free the packet */
+
+               freed++;
+               ASSERT(freed <= pktp->n_pkts);
+       }
+
+       pktp->avail -= freed;
+       ASSERT(pktp->avail == 0);
+
+       pktp->n_pkts -= freed;
+
+       ASSERT(pktp->n_pkts == 0);
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return 0;
+}
+
+int
+pktpool_avail(pktpool_t *pktpool)
+{
+       int avail = pktpool->avail;
+
+       if (avail == 0) {
+               pktpool_emptycb_disable(pktpool, FALSE);
+       }
+
+       return avail;
+}
+
+static void *
+BCMFASTPATH(pktpool_deq)(pktpool_t *pktp)
+{
+       void *p = NULL;
+
+       if (pktp->avail == 0)
+               return NULL;
+
+       ASSERT_FP(pktp->freelist != NULL);
+
+       p = pktp->freelist;  /* dequeue packet from head of pktpool free list */
+       pktp->freelist = PKTFREELIST(p); /* free list points to next packet */
+
+       PKTSETFREELIST(p, NULL);
+
+       pktp->avail--;
+
+       return p;
+}
+
+static void
+BCMFASTPATH(pktpool_enq)(pktpool_t *pktp, void *p)
+{
+       ASSERT_FP(p != NULL);
+
+       PKTSETFREELIST(p, pktp->freelist); /* insert at head of pktpool free list */
+       pktp->freelist = p; /* free list points to newly inserted packet */
+
+       pktp->avail++;
+       ASSERT_FP(pktp->avail <= pktp->n_pkts);
+}
+
+/** utility for registering host addr fill function called from pciedev */
+int
+pktpool_hostaddr_fill_register(pktpool_t *pktp, pktpool_cb_extn_t cb, void *arg)
+{
+
+       ASSERT(cb != NULL);
+
+       ASSERT(pktp->cbext.cb == NULL);
+       pktp->cbext.cb = cb;
+       pktp->cbext.arg = arg;
+       return 0;
+}
+
+int
+pktpool_rxcplid_fill_register(pktpool_t *pktp, pktpool_cb_extn_t cb, void *arg)
+{
+
+       ASSERT(cb != NULL);
+
+       if (pktp == NULL)
+               return BCME_ERROR;
+       ASSERT(pktp->rxcplidfn.cb == NULL);
+       pktp->rxcplidfn.cb = cb;
+       pktp->rxcplidfn.arg = arg;
+       return 0;
+}
+
+/** whenever host posts rxbuffer, invoke dma_rxfill from pciedev layer */
+void
+pktpool_invoke_dmarxfill(pktpool_t *pktp)
+{
+       ASSERT(pktp->dmarxfill.cb);
+       ASSERT(pktp->dmarxfill.arg);
+
+       if (pktp->dmarxfill.cb)
+               pktp->dmarxfill.cb(pktp, pktp->dmarxfill.arg);
+}
+
+/** Registers callback functions for split rx mode */
+int
+pkpool_haddr_avail_register_cb(pktpool_t *pktp, pktpool_cb_t cb, void *arg)
+{
+
+       ASSERT(cb != NULL);
+
+       pktp->dmarxfill.cb = cb;
+       pktp->dmarxfill.arg = arg;
+
+       return 0;
+}
+
+/**
+ * Registers callback functions.
+ * No BCMATTACHFN as it is used in xdc_enable_ep which is not an attach function
+ */
+int
+pktpool_avail_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg)
+{
+       int err = 0;
+       int i;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       ASSERT(cb != NULL);
+
+       for (i = 0; i < pktp->cbcnt; i++) {
+               ASSERT(pktp->cbs[i].cb != NULL);
+               if ((cb == pktp->cbs[i].cb) && (arg == pktp->cbs[i].arg)) {
+                       pktp->cbs[i].refcnt++;
+                       goto done;
+               }
+       }
+
+       i = pktp->cbcnt;
+       if (i == PKTPOOL_CB_MAX_AVL) {
+               err = BCME_ERROR;
+               goto done;
+       }
+
+       ASSERT(pktp->cbs[i].cb == NULL);
+       pktp->cbs[i].cb = cb;
+       pktp->cbs[i].arg = arg;
+       pktp->cbs[i].refcnt++;
+       pktp->cbcnt++;
+
+       /* force enable empty callback */
+       pktpool_emptycb_disable(pktp, FALSE);
+done:
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return err;
+}
+
+/* No BCMATTACHFN as it is used in a non-attach function */
+int
+pktpool_avail_deregister(pktpool_t *pktp, pktpool_cb_t cb, void *arg)
+{
+       int err = 0;
+       int i, k;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS) {
+               return BCME_ERROR;
+       }
+
+       ASSERT(cb != NULL);
+
+       for (i = 0; i < pktp->cbcnt; i++) {
+               ASSERT(pktp->cbs[i].cb != NULL);
+               if ((cb == pktp->cbs[i].cb) && (arg == pktp->cbs[i].arg)) {
+                       pktp->cbs[i].refcnt--;
+                       if (pktp->cbs[i].refcnt) {
+                               /* Still there are references to this callback */
+                               goto done;
+                       }
+                       /* Moving any more callbacks to fill the hole */
+                       for (k = i+1; k < pktp->cbcnt; i++, k++) {
+                               pktp->cbs[i].cb = pktp->cbs[k].cb;
+                               pktp->cbs[i].arg = pktp->cbs[k].arg;
+                               pktp->cbs[i].refcnt = pktp->cbs[k].refcnt;
+                       }
+
+                       /* reset the last callback */
+                       pktp->cbs[i].cb = NULL;
+                       pktp->cbs[i].arg = NULL;
+                       pktp->cbs[i].refcnt = 0;
+
+                       pktp->cbcnt--;
+                       goto done;
+               }
+       }
+
+done:
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS) {
+               return BCME_ERROR;
+       }
+
+       return err;
+}
+
+/** Registers callback functions */
+int
+pktpool_empty_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg)
+{
+       int err = 0;
+       int i;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       ASSERT(cb != NULL);
+
+       i = pktp->ecbcnt;
+       if (i == PKTPOOL_CB_MAX) {
+               err = BCME_ERROR;
+               goto done;
+       }
+
+       ASSERT(pktp->ecbs[i].cb == NULL);
+       pktp->ecbs[i].cb = cb;
+       pktp->ecbs[i].arg = arg;
+       pktp->ecbcnt++;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return err;
+}
+
+/** Calls registered callback functions */
+static int
+pktpool_empty_notify(pktpool_t *pktp)
+{
+       int i;
+
+       pktp->empty = TRUE;
+       for (i = 0; i < pktp->ecbcnt; i++) {
+               ASSERT(pktp->ecbs[i].cb != NULL);
+               pktp->ecbs[i].cb(pktp, pktp->ecbs[i].arg);
+       }
+       pktp->empty = FALSE;
+
+       return 0;
+}
+
+#ifdef BCMDBG_POOL
+int
+pktpool_dbg_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg)
+{
+       int err = 0;
+       int i;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       ASSERT(cb);
+
+       i = pktp->dbg_cbcnt;
+       if (i == PKTPOOL_CB_MAX) {
+               err = BCME_ERROR;
+               goto done;
+       }
+
+       ASSERT(pktp->dbg_cbs[i].cb == NULL);
+       pktp->dbg_cbs[i].cb = cb;
+       pktp->dbg_cbs[i].arg = arg;
+       pktp->dbg_cbcnt++;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return err;
+}
+
+int pktpool_dbg_notify(pktpool_t *pktp);
+
+int
+pktpool_dbg_notify(pktpool_t *pktp)
+{
+       int i;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       for (i = 0; i < pktp->dbg_cbcnt; i++) {
+               ASSERT(pktp->dbg_cbs[i].cb);
+               pktp->dbg_cbs[i].cb(pktp, pktp->dbg_cbs[i].arg);
+       }
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return 0;
+}
+
+int
+pktpool_dbg_dump(pktpool_t *pktp)
+{
+       int i;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       printf("pool len=%d maxlen=%d\n",  pktp->dbg_qlen, pktp->maxlen);
+       for (i = 0; i < pktp->dbg_qlen; i++) {
+               ASSERT(pktp->dbg_q[i].p);
+               printf("%d, p: 0x%x dur:%lu us state:%d\n", i,
+                       pktp->dbg_q[i].p, pktp->dbg_q[i].dur/100, PKTPOOLSTATE(pktp->dbg_q[i].p));
+       }
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return 0;
+}
+
+int
+pktpool_stats_dump(pktpool_t *pktp, pktpool_stats_t *stats)
+{
+       int i;
+       int state;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       bzero(stats, sizeof(pktpool_stats_t));
+       for (i = 0; i < pktp->dbg_qlen; i++) {
+               ASSERT(pktp->dbg_q[i].p != NULL);
+
+               state = PKTPOOLSTATE(pktp->dbg_q[i].p);
+               switch (state) {
+                       case POOL_TXENQ:
+                               stats->enq++; break;
+                       case POOL_TXDH:
+                               stats->txdh++; break;
+                       case POOL_TXD11:
+                               stats->txd11++; break;
+                       case POOL_RXDH:
+                               stats->rxdh++; break;
+                       case POOL_RXD11:
+                               stats->rxd11++; break;
+                       case POOL_RXFILL:
+                               stats->rxfill++; break;
+                       case POOL_IDLE:
+                               stats->idle++; break;
+               }
+       }
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return 0;
+}
+
+int
+pktpool_start_trigger(pktpool_t *pktp, void *p)
+{
+       uint32 cycles, i;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       if (!PKTPOOL(OSH_NULL, p))
+               goto done;
+
+       OSL_GETCYCLES(cycles);
+
+       for (i = 0; i < pktp->dbg_qlen; i++) {
+               ASSERT(pktp->dbg_q[i].p != NULL);
+
+               if (pktp->dbg_q[i].p == p) {
+                       pktp->dbg_q[i].cycles = cycles;
+                       break;
+               }
+       }
+
+done:
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return 0;
+}
+
+int pktpool_stop_trigger(pktpool_t *pktp, void *p);
+
+int
+pktpool_stop_trigger(pktpool_t *pktp, void *p)
+{
+       uint32 cycles, i;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       if (!PKTPOOL(OSH_NULL, p))
+               goto done;
+
+       OSL_GETCYCLES(cycles);
+
+       for (i = 0; i < pktp->dbg_qlen; i++) {
+               ASSERT(pktp->dbg_q[i].p != NULL);
+
+               if (pktp->dbg_q[i].p == p) {
+                       if (pktp->dbg_q[i].cycles == 0)
+                               break;
+
+                       if (cycles >= pktp->dbg_q[i].cycles)
+                               pktp->dbg_q[i].dur = cycles - pktp->dbg_q[i].cycles;
+                       else
+                               pktp->dbg_q[i].dur =
+                                       (((uint32)-1) - pktp->dbg_q[i].cycles) + cycles + 1;
+
+                       pktp->dbg_q[i].cycles = 0;
+                       break;
+               }
+       }
+
+done:
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return 0;
+}
+#endif /* BCMDBG_POOL */
+
+int
+pktpool_avail_notify_normal(osl_t *osh, pktpool_t *pktp)
+{
+       BCM_REFERENCE(osh);
+       ASSERT(pktp);
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       pktp->availcb_excl = NULL;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return 0;
+}
+
+int
+pktpool_avail_notify_exclusive(osl_t *osh, pktpool_t *pktp, pktpool_cb_t cb)
+{
+       int i;
+       int err;
+       BCM_REFERENCE(osh);
+
+       ASSERT(pktp);
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       ASSERT(pktp->availcb_excl == NULL);
+       for (i = 0; i < pktp->cbcnt; i++) {
+               if (cb == pktp->cbs[i].cb) {
+                       pktp->availcb_excl = &pktp->cbs[i];
+                       break;
+               }
+       }
+
+       if (pktp->availcb_excl == NULL)
+               err = BCME_ERROR;
+       else
+               err = 0;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return err;
+}
+
+static void
+pktpool_avail_notify(pktpool_t *pktp)
+{
+       int i, k, idx;
+
+       ASSERT(pktp);
+       pktpool_emptycb_disable(pktp, TRUE);
+
+       if (pktp->availcb_excl != NULL) {
+               pktp->availcb_excl->cb(pktp, pktp->availcb_excl->arg);
+               return;
+       }
+
+       k = pktp->cbcnt - 1;
+       for (i = 0; i < pktp->cbcnt; i++) {
+               /* callbacks are getting disabled at this func entry.
+                * For the case of avail is say 5, and first callback
+                * consumes exactly 5 due to dma rxpost setting, then
+                * further callbacks will not getting notified if avail check
+                * is present.
+                * so calling all cbs even if pktp->avail is zero, so that
+                * cbs get oppurtunity to enable callbacks if their
+                * operation is in progress / not completed.
+                */
+               if (pktp->cbtoggle)
+                       idx = i;
+               else
+                       idx = k--;
+
+               ASSERT(pktp->cbs[idx].cb != NULL);
+               pktp->cbs[idx].cb(pktp, pktp->cbs[idx].arg);
+       }
+
+       /* Alternate between filling from head or tail
+        */
+       pktp->cbtoggle ^= 1;
+
+       return;
+}
+
+/** Gets an empty packet from the caller provided pool */
+void *
+BCMFASTPATH(pktpool_get_ext)(pktpool_t *pktp, uint8 type)
+{
+       void *p;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       p = pktpool_deq(pktp);
+
+       if (p == NULL) {
+               /* Notify and try to reclaim tx pkts */
+               if (pktp->ecbcnt)
+                       pktpool_empty_notify(pktp);
+
+               p = pktpool_deq(pktp);
+               if (p == NULL) {
+                       pktpool_emptycb_disable(pktp, FALSE);
+                       goto done;
+               }
+       }
+
+done:
+       if ((pktp->avail == 0) && (pktp->emptycb_disable == EMPTYCB_SKIPPED)) {
+               pktp->emptycb_disable = EMPTYCB_DISABLED;
+       }
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void
+BCMFASTPATH(pktpool_free)(pktpool_t *pktp, void *p)
+{
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       ASSERT_FP(p != NULL);
+#ifdef BCMDBG_POOL
+       /* pktpool_stop_trigger(pktp, p); */
+#endif
+
+       pktpool_enq(pktp, p);
+
+       /**
+        * Feed critical DMA with freshly freed packets, to avoid DMA starvation.
+        * If any avail callback functions are registered, send a notification
+        * that a new packet is available in the pool.
+        */
+       if (pktp->cbcnt) {
+               /* To more efficiently use the cpu cycles, callbacks can be temporarily disabled.
+                * This allows to feed on burst basis as opposed to inefficient per-packet basis.
+                */
+               if (pktp->emptycb_disable == EMPTYCB_ENABLED) {
+                       /**
+                        * If the call originated from pktpool_empty_notify, the just freed packet
+                        * is needed in pktpool_get.
+                        * Therefore don't call pktpool_avail_notify.
+                        */
+                       if (pktp->empty == FALSE)
+                               pktpool_avail_notify(pktp);
+               } else {
+                       /**
+                        * The callback is temporarily disabled, log that a packet has been freed.
+                        */
+                       pktp->emptycb_disable = EMPTYCB_SKIPPED;
+               }
+       }
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return;
+}
+
+/** Adds a caller provided (empty) packet to the caller provided pool */
+int
+pktpool_add(pktpool_t *pktp, void *p)
+{
+       int err = 0;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       ASSERT(p != NULL);
+
+       if (pktp->n_pkts == pktp->maxlen) {
+               err = BCME_RANGE;
+               goto done;
+       }
+
+       /* pkts in pool have same length */
+       ASSERT(pktp->max_pkt_bytes == PKTLEN(OSH_NULL, p));
+       PKTSETPOOL(OSH_NULL, p, TRUE, pktp);
+
+       pktp->n_pkts++;
+       pktpool_enq(pktp, p);
+
+#ifdef BCMDBG_POOL
+       pktp->dbg_q[pktp->dbg_qlen++].p = p;
+#endif
+
+done:
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return err;
+}
+
+/**
+ * Force pktpool_setmaxlen () into RAM as it uses a constant
+ * (PKTPOOL_LEN_MAX) that may be changed post tapeout for ROM-based chips.
+ */
+int
+BCMRAMFN(pktpool_setmaxlen)(pktpool_t *pktp, uint16 maxlen)
+{
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       if (maxlen > PKTPOOL_LEN_MAX)
+               maxlen = PKTPOOL_LEN_MAX;
+
+       /* if pool is already beyond maxlen, then just cap it
+        * since we currently do not reduce the pool len
+        * already allocated
+        */
+       pktp->maxlen = (pktp->n_pkts > maxlen) ? pktp->n_pkts : maxlen;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return pktp->maxlen;
+}
+
+void
+pktpool_emptycb_disable(pktpool_t *pktp, bool disable)
+{
+       bool notify = FALSE;
+       ASSERT(pktp);
+
+       /**
+        * To more efficiently use the cpu cycles, callbacks can be temporarily disabled.
+        * If callback is going to be re-enabled, check if any packet got
+        * freed and added back to the pool while callback was disabled.
+        * When this is the case do the callback now, provided that callback functions
+        * are registered and this call did not originate from pktpool_empty_notify.
+        */
+       if ((!disable) && (pktp->cbcnt) && (pktp->empty == FALSE) &&
+               (pktp->emptycb_disable == EMPTYCB_SKIPPED)) {
+               notify = TRUE;
+       }
+
+       /* Enable or temporarily disable callback when packet becomes available. */
+       if (disable) {
+               if (pktp->emptycb_disable == EMPTYCB_ENABLED) {
+                       /* mark disabled only if enabled.
+                        * if state is EMPTYCB_SKIPPED, it means already
+                        * disabled and some pkts are freed. So don't lose the state
+                        * of skipped to ensure calling pktpool_avail_notify().
+                        */
+                       pktp->emptycb_disable = EMPTYCB_DISABLED;
+               }
+       } else {
+               pktp->emptycb_disable = EMPTYCB_ENABLED;
+       }
+       if (notify) {
+               /* pktpool_emptycb_disable() is called from pktpool_avail_notify() and
+                * pktp->cbs. To have the result of most recent call, notify after
+                * emptycb_disable is modified.
+                * This change also prevents any recursive calls of pktpool_avail_notify()
+                * from pktp->cbs if pktpool_emptycb_disable() is called from them.
+                */
+               pktpool_avail_notify(pktp);
+       }
+}
+
+bool
+pktpool_emptycb_disabled(pktpool_t *pktp)
+{
+       ASSERT(pktp);
+       return pktp->emptycb_disable != EMPTYCB_ENABLED;
+}
+
+#ifdef BCMPKTPOOL
+#include <hnd_lbuf.h>
+
+pktpool_t *pktpool_shared = NULL;
+
+#ifdef BCMFRAGPOOL
+pktpool_t *pktpool_shared_lfrag = NULL;
+#ifdef BCMRESVFRAGPOOL
+pktpool_t *pktpool_resv_lfrag = NULL;
+struct resv_info *resv_pool_info = NULL;
+#endif /* BCMRESVFRAGPOOL */
+#endif /* BCMFRAGPOOL */
+
+pktpool_t *pktpool_shared_rxlfrag = NULL;
+
+#if defined(BCMD11HDRPOOL)
+pktpool_t *pktpool_d11hdr = NULL;
+#endif /* defined(BCMRXFRAGPOOL) */
+
+static osl_t *pktpool_osh = NULL;
+static uint32 total_poolheap_count = 0U;
+
+/**
+ * Initializes several packet pools and allocates packets within those pools.
+ */
+int
+hnd_pktpool_init(osl_t *osh)
+{
+       int err = BCME_OK;
+       int n, pktsz;
+       bool is_heap_pool;
+
+       BCM_REFERENCE(pktsz);
+       BCM_REFERENCE(is_heap_pool);
+
+       /* Construct a packet pool registry before initializing packet pools */
+       n = pktpool_attach(osh, PKTPOOL_MAXIMUM_ID);
+       if (n != PKTPOOL_MAXIMUM_ID) {
+               ASSERT(0);
+               err = BCME_ERROR;
+               goto error;
+       }
+
+       pktpool_shared = MALLOCZ(osh, sizeof(pktpool_t));
+       if (pktpool_shared == NULL) {
+               ASSERT(0);
+               err = BCME_NOMEM;
+               goto error;
+       }
+
+#if defined(BCMFRAGPOOL) && !defined(BCMFRAGPOOL_DISABLED)
+       pktpool_shared_lfrag = MALLOCZ(osh, sizeof(pktpool_t));
+       if (pktpool_shared_lfrag == NULL) {
+               ASSERT(0);
+               err = BCME_NOMEM;
+               goto error;
+       }
+
+#if defined(BCMRESVFRAGPOOL) && !defined(BCMRESVFRAGPOOL_DISABLED)
+       resv_pool_info = hnd_resv_pool_alloc(osh);
+       if (resv_pool_info == NULL) {
+               err = BCME_NOMEM;
+               ASSERT(0);
+               goto error;
+       }
+       pktpool_resv_lfrag = resv_pool_info->pktp;
+       if (pktpool_resv_lfrag == NULL) {
+               err = BCME_ERROR;
+               ASSERT(0);
+               goto error;
+       }
+#endif /* RESVFRAGPOOL */
+#endif /* FRAGPOOL */
+
+#if defined(BCMRXFRAGPOOL) && !defined(BCMRXFRAGPOOL_DISABLED)
+       pktpool_shared_rxlfrag = MALLOCZ(osh, sizeof(pktpool_t));
+       if (pktpool_shared_rxlfrag == NULL) {
+               ASSERT(0);
+               err = BCME_NOMEM;
+               goto error;
+       }
+#endif
+
+#if defined(BCMD11HDRPOOL) && !defined(BCMD11HDRPOOL_DISABLED)
+       pktpool_d11hdr = MALLOCZ(osh, sizeof(pktpool_t));
+       if (pktpool_d11hdr == NULL) {
+               ASSERT(0);
+               err = BCME_NOMEM;
+               goto error;
+       }
+#endif /* BCMD11HDRPOOL && !BCMD11HDRPOOL_DISABLED */
+
+       /*
+        * At this early stage, there's not enough memory to allocate all
+        * requested pkts in the shared pool.  Need to add to the pool
+        * after reclaim
+        *
+        * n = NRXBUFPOST + SDPCMD_RXBUFS;
+        *
+        * Initialization of packet pools may fail (BCME_ERROR), if the packet pool
+        * registry is not initialized or the registry is depleted.
+        *
+        * A BCME_NOMEM error only indicates that the requested number of packets
+        * were not filled into the pool.
+        */
+       n = 1;
+       MALLOC_SET_NOPERSIST(osh); /* Ensure subsequent allocations are non-persist */
+#ifdef HWA
+       if ((err = pktpool_init(osh, pktpool_shared,
+                       &n, PKTBUFSZ, FALSE, lbuf_hwa_basic, FALSE, 0, 0)) != BCME_OK) {
+#else
+       if ((err = pktpool_init(osh, pktpool_shared,
+                       &n, PKTBUFSZ, FALSE, lbuf_basic, FALSE, 0, 0)) != BCME_OK) {
+#endif
+               ASSERT(0);
+               goto error;
+       }
+       pktpool_setmaxlen(pktpool_shared, SHARED_POOL_LEN);
+
+#if defined(BCMFRAGPOOL) && !defined(BCMFRAGPOOL_DISABLED)
+       n = 1;
+#if (!defined(HWA) && ((defined(EVENTLOG_D3_PRESERVE) && \
+       !defined(EVENTLOG_D3_PRESERVE_DISABLED)) || defined(BCMPOOLRECLAIM)))
+       is_heap_pool = TRUE;
+#else
+       is_heap_pool = FALSE;
+#endif /* !HWA && (( EVENTLOG_D3_PRESERVE && !EVENTLOG_D3_PRESERVE_DISABLED) || BCMPOOLRECLAIM)  */
+
+       if (HWA_SUBMODULES_TXPOST_ENAB()) {
+               pktpool_shared_lfrag->type = lbuf_frag;
+       } else {
+               if ((err = pktpool_init(osh, pktpool_shared_lfrag, &n, PKTFRAGSZ, TRUE, lbuf_frag,
+                               is_heap_pool, POOL_HEAP_FLAG_D3, SHARED_FRAG_POOL_LEN >> 3)) !=
+                               BCME_OK) {
+                       ASSERT(0);
+                       goto error;
+               }
+               pktpool_setmaxlen(pktpool_shared_lfrag, SHARED_FRAG_POOL_LEN);
+       }
+
+#if defined(BCMRESVFRAGPOOL) && !defined(BCMRESVFRAGPOOL_DISABLED) && !defined(HWA)
+       n = 0; /* IMPORTANT: DO NOT allocate any packets in resv pool */
+#ifdef RESV_POOL_HEAP
+       is_heap_pool = TRUE;
+#endif /* RESV_POOL_HEAP */
+
+       if ((err = pktpool_init(osh, pktpool_resv_lfrag, &n, PKTFRAGSZ, TRUE, lbuf_frag,
+               is_heap_pool, POOL_HEAP_FLAG_RSRVPOOL, 0)) != BCME_OK) {
+               ASSERT(0);
+               goto error;
+       }
+       pktpool_setmaxlen(pktpool_resv_lfrag, RESV_FRAG_POOL_LEN);
+#endif /* RESVFRAGPOOL */
+#endif /* BCMFRAGPOOL */
+
+#if defined(BCMRXFRAGPOOL) && !defined(BCMRXFRAGPOOL_DISABLED)
+       n = 1;
+       if (HWA_SUBMODULES_RXPOSTFILL_ENAB()) {
+               pktsz = 1;
+       } else {
+               pktsz = RXPKTFRAGDATASZ;
+       }
+#ifdef RESV_POOL_HEAP
+       is_heap_pool = BCMPOOLRECLAIM_ENAB() ? TRUE : FALSE;
+#else
+       is_heap_pool = FALSE;
+#endif /* RESV_POOL_HEAP */
+
+       if ((err = pktpool_init(osh, pktpool_shared_rxlfrag, &n, pktsz, TRUE, lbuf_rxfrag,
+                       is_heap_pool, POOL_HEAP_FLAG_D3, 0)) != BCME_OK) {
+               ASSERT(0);
+               goto error;
+       }
+
+       if (HWA_SUBMODULES_RXPOSTFILL_ENAB()) {
+               pktpool_setmaxlen(pktpool_shared_rxlfrag, 1);
+       } else {
+               pktpool_setmaxlen(pktpool_shared_rxlfrag, SHARED_RXFRAG_POOL_LEN);
+       }
+#endif /* defined(BCMRXFRAGPOOL) && !defined(BCMRXFRAGPOOL_DISABLED) */
+
+#if defined(BCMD11HDRPOOL) && !defined(BCMD11HDRPOOL_DISABLED)
+       {
+               uint n_pkts = 1;
+               uint buf_size = (TXD11HDRSPACESZ + sizeof(lbuf_d11hdr_t));
+               err = d11hdr_pool_init(osh, pktpool_d11hdr,
+                               &n_pkts, buf_size, FALSE, 0, FALSE, 0, 0);
+               if (err != BCME_OK) {
+                       ASSERT(0);
+                       goto error;
+               }
+               pktpool_setmaxlen(pktpool_d11hdr, D11HDR_POOL_LEN);
+       }
+#endif /* defined(BCMD11HDRPOOL) && !defined(BCMD11HDRPOOL_DISABLED) */
+
+#if defined(BCMFRWDPOOLREORG) && !defined(BCMFRWDPOOLREORG_DISABLED)
+       /* Attach poolreorg module */
+       if ((frwd_poolreorg_info = poolreorg_attach(osh,
+#if defined(BCMFRAGPOOL) && !defined(BCMFRAGPOOL_DISABLED)
+                       pktpool_shared_lfrag,
+#else
+                       NULL,
+#endif /* defined(BCMFRAGPOOL) && !defined(BCMFRAGPOOL_DISABLED) */
+#if defined(BCMRXFRAGPOOL) && !defined(BCMRXFRAGPOOL_DISABLED)
+                       pktpool_shared_rxlfrag,
+#else
+                       NULL,
+#endif /* BCMRXFRAGPOOL */
+                       pktpool_shared)) == NULL) {
+               ASSERT(0);
+               err = BCME_NOMEM;
+               goto error;
+       }
+#endif /* defined(BCMFRWDPOOLREORG) && !defined(BCMFRWDPOOLREORG_DISABLED) */
+
+       pktpool_osh = osh;
+       MALLOC_CLEAR_NOPERSIST(osh);
+
+#ifdef POOL_HEAP_RECONFIG
+       lbuf_free_cb_set(hnd_pktpool_lbuf_free_cb);
+#endif
+
+       return BCME_OK;
+
+error:
+       hnd_pktpool_deinit(osh);
+
+       return err;
+} /* hnd_pktpool_init */
+
+void
+hnd_pktpool_deinit(osl_t *osh)
+{
+#if defined(BCMFRWDPOOLREORG) && !defined(BCMFRWDPOOLREORG_DISABLED)
+       if (frwd_poolreorg_info != NULL) {
+               poolreorg_detach(frwd_poolreorg_info);
+       }
+#endif /* defined(BCMFRWDPOOLREORG) && !defined(BCMFRWDPOOLREORG_DISABLED) */
+
+#if defined(BCMRXFRAGPOOL) && !defined(BCMRXFRAGPOOL_DISABLED)
+       if (pktpool_shared_rxlfrag != NULL) {
+               if (pktpool_shared_rxlfrag->inited) {
+                       pktpool_deinit(osh, pktpool_shared_rxlfrag);
+               }
+
+               hnd_free(pktpool_shared_rxlfrag);
+               pktpool_shared_rxlfrag = (pktpool_t *)NULL;
+       }
+#endif
+
+#if defined(BCMFRAGPOOL) && !defined(BCMFRAGPOOL_DISABLED)
+       if (pktpool_shared_lfrag != NULL) {
+               if (!HWA_SUBMODULES_TXPOST_ENAB() && pktpool_shared_lfrag->inited) {
+                       pktpool_deinit(osh, pktpool_shared_lfrag);
+               }
+               hnd_free(pktpool_shared_lfrag);
+               pktpool_shared_lfrag = (pktpool_t *)NULL;
+       }
+#endif /* BCMFRAGPOOL */
+
+#if defined(BCMD11HDRPOOL) && !defined(BCMD11HDRPOOL_DISABLED)
+       if (pktpool_d11hdr != NULL) {
+               if (pktpool_d11hdr->inited) {
+                       pktpool_deinit(osh, pktpool_d11hdr);
+               }
+
+               hnd_free(pktpool_d11hdr);
+               pktpool_d11hdr = (pktpool_t *)NULL;
+       }
+#endif /* BCMD11HDRPOOL */
+
+#if defined(BCMRESVFRAGPOOL) && !defined(BCMRESVFRAGPOOL_DISABLED)
+       if (resv_pool_info != NULL) {
+               if (pktpool_resv_lfrag != NULL) {
+                       pktpool_resv_lfrag = NULL;
+               }
+               hnd_free(resv_pool_info);
+       }
+#endif /* RESVFRAGPOOL */
+
+       if (pktpool_shared != NULL) {
+               if (pktpool_shared->inited) {
+                       pktpool_deinit(osh, pktpool_shared);
+               }
+
+               hnd_free(pktpool_shared);
+               pktpool_shared = (pktpool_t *)NULL;
+       }
+
+       pktpool_dettach(osh);
+
+       MALLOC_CLEAR_NOPERSIST(osh);
+}
+
+/** is called at each 'wl up' */
+int
+hnd_pktpool_fill(pktpool_t *pktpool, bool minimal)
+{
+       return (pktpool_fill(pktpool_osh, pktpool, minimal));
+}
+
+/** refills pktpools after reclaim, is called once */
+void
+hnd_pktpool_refill(bool minimal)
+{
+       if (POOL_ENAB(pktpool_shared)) {
+#if defined(SRMEM)
+               if (SRMEM_ENAB()) {
+                       int maxlen = pktpool_max_pkts(pktpool_shared);
+                       int n_pkts = pktpool_tot_pkts(pktpool_shared);
+
+                       for (; n_pkts < maxlen; n_pkts++) {
+                               void *p;
+                               if ((p = PKTSRGET(pktpool_max_pkt_bytes(pktpool_shared))) == NULL)
+                                       break;
+                               pktpool_add(pktpool_shared, p);
+                       }
+               }
+#endif /* SRMEM */
+               pktpool_fill(pktpool_osh, pktpool_shared, minimal);
+       }
+/* fragpool reclaim */
+#ifdef BCMFRAGPOOL
+       if (POOL_ENAB(pktpool_shared_lfrag)) {
+               pktpool_fill(pktpool_osh, pktpool_shared_lfrag, minimal);
+       }
+#endif /* BCMFRAGPOOL */
+
+/* rx fragpool reclaim */
+#ifdef BCMRXFRAGPOOL
+       if (POOL_ENAB(pktpool_shared_rxlfrag)) {
+               pktpool_fill(pktpool_osh, pktpool_shared_rxlfrag, minimal);
+       }
+#endif
+#if defined(BCMFRAGPOOL) && defined(BCMRESVFRAGPOOL)
+       if (POOL_ENAB(pktpool_resv_lfrag)) {
+               int resv_size = (pktpool_resv_lfrag->max_pkt_bytes + LBUFFRAGSZ) *
+                       pktpool_resv_lfrag->maxlen;
+               hnd_resv_pool_init(resv_pool_info, resv_size);
+               hnd_resv_pool_enable(resv_pool_info);
+       }
+#endif /* BCMRESVFRAGPOOL */
+}
+
+#ifdef POOL_HEAP_RECONFIG
+#define hnd_pktpool_release_active_set(pktp)   (pktpool_heap_rel_active |= (1 << pktp->id))
+#define hnd_pktpool_release_active_reset(pktp) (pktpool_heap_rel_active &= ~(1 << pktp->id))
+/* Function enable/disable heap pool usage */
+
+#ifdef HWA
+void
+hnd_pktpool_heap_handle(osl_t *osh, uint32 flag, bool enable)
+{
+       hwa_info_t *hwa_dev = hwa_info_get();
+       hwa_bufpool_heap_handle(hwa_dev, flag, enable);
+       return;
+}
+
+/* Do memory allocation from pool heap memory */
+void *
+hnd_pktpool_freelist_alloc(uint size, uint alignbits, uint32 flag)
+{
+       void *p = NULL;
+       hwa_info_t *hwa_dev = hwa_info_get();
+       p = hwa_bufpool_freelist_alloc(hwa_dev, size, alignbits, flag);
+       return p;
+}
+#else
+void
+hnd_pktpool_heap_handle(osl_t *osh, uint32 flag, bool enable)
+{
+       int i = 0;
+       pktpool_t *pktp;
+       /*
+        * Loop through all the registerd pktpools.
+        * Trigger retreave of pkts from the heap back to pool if no
+        * flags are active.
+        */
+       for (i = 1; i < PKTPOOL_MAXIMUM_ID; i++) {
+               if ((pktp = get_pktpools_registry(i)) != NULL) {
+                       if ((flag == pktp->poolheap_flag) && pktp->is_heap_pool) {
+                               if (enable) {
+                                       hnd_pktpool_heap_pkt_release(pktpool_osh, pktp, flag);
+                               } else {
+                                       hnd_pktpool_heap_pkt_retrieve(pktp, flag);
+                               }
+                       }
+               }
+       }
+}
+
+/* Do memory allocation from pool heap memory */
+void *
+hnd_pktpool_freelist_alloc(uint size, uint alignbits, uint32 flag)
+{
+       int i = 0;
+       pktpool_t *pktp;
+       void *p = NULL;
+       for (i = 1; i < PKTPOOL_MAXIMUM_ID; i++) {
+               if ((pktp = get_pktpools_registry(i)) != NULL) {
+                       if ((flag == pktp->poolheap_flag) && pktp->is_heap_pool) {
+                               p = rte_freelist_mgr_alloc(size, alignbits, pktp->mem_handle);
+                               if (p)
+                                       break;
+                       }
+               }
+       }
+       return p;
+}
+#endif /* HWA */
+
+#ifndef HWA
+/* Release pkts from pool to free heap */
+static void
+hnd_pktpool_heap_pkt_release(osl_t *osh, pktpool_t *pktp, uint32 flag)
+{
+       pktpool_cb_extn_t cb = NULL;
+       void *arg = NULL;
+       int i = 0;
+       pktpool_heap_cb_reg_t *pktp_heap_cb = hnd_pool_get_cb_registry();
+
+       pktp->release_active = FALSE;
+       hnd_pktpool_release_active_reset(pktp);
+
+       if (pktp->n_pkts <= pktp->min_backup_buf)
+               return;
+       /* call module specific callbacks */
+       if (BCMSPLITRX_ENAB() && (pktp->type == lbuf_rxfrag)) {
+               /* If pool is shared rx frag pool, use call back fn to reclaim host address
+                * and Rx cpl ID associated with the pkt.
+                */
+               ASSERT(pktp->cbext.cb != NULL);
+               cb = pktp->cbext.cb;
+               arg = pktp->cbext.arg;
+       } else if ((pktp->type == lbuf_basic) && (pktp->rxcplidfn.cb != NULL)) {
+               /* If pool is shared rx pool, use call back fn to freeup Rx cpl ID
+                * associated with the pkt.
+                */
+               cb = pktp->rxcplidfn.cb;
+               arg = pktp->rxcplidfn.arg;
+       }
+
+       while (pktp->avail > pktp->min_backup_buf) {
+               void * p = pktp->freelist;
+
+               pktp->freelist = PKTFREELIST(p); /* unlink head packet from free list */
+               PKTSETFREELIST(p, NULL);
+
+               if (cb != NULL) {
+                       if (cb(pktp, arg, p, REMOVE_RXCPLID)) {
+                               PKTSETFREELIST(p, pktp->freelist);
+                               pktp->freelist = p;
+                               break;
+                       }
+               }
+
+               PKTSETPOOL(osh, p, FALSE, NULL); /* clear pool ID tag in pkt */
+
+               lb_set_nofree(p);
+               PKTFREE(osh, p, pktp->istx); /* free the packet */
+
+               rte_freelist_mgr_add(p, pktp->mem_handle);
+               pktp->avail--;
+               pktp->n_pkts--;
+               pktp->poolheap_count++;
+               total_poolheap_count++;
+       }
+
+       /* Execute call back for upper layer which used pkt from heap */
+       for (i = 0; i < PKTPOOL_MAX_HEAP_CB; i++) {
+               if ((pktp_heap_cb[i].fn != NULL) &&
+                       (flag == pktp_heap_cb[i].flag))
+                       (pktp_heap_cb[i].fn)(pktp_heap_cb[i].ctxt, TRUE);
+       }
+
+}
+#endif /* !HWA */
+
+static pktpool_heap_cb_reg_t *
+BCMRAMFN(hnd_pool_get_cb_registry)(void)
+{
+       return pktpool_heap_cb_reg;
+}
+
+static void
+BCMFASTPATH(hnd_pktpool_lbuf_free_cb)(uint8 poolid)
+{
+       int i = 0;
+       pktpool_t *pktp;
+
+       if (poolid == PKTPOOL_INVALID_ID && pktpool_heap_rel_active) {
+               for (i = 1; i < PKTPOOL_MAXIMUM_ID; i++) {
+                       if ((pktp = get_pktpools_registry(i)) != NULL) {
+                               if (pktp->is_heap_pool && (pktp->release_active)) {
+                                       rte_freelist_mgr_release(pktp->mem_handle);
+                               }
+                       }
+               }
+       }
+}
+
+#ifndef HWA
+/* Take back pkts from free mem and refill pool */
+static void
+hnd_pktpool_heap_pkt_retrieve(pktpool_t *pktp, uint32 flag)
+{
+       int i = 0;
+       pktpool_heap_cb_reg_t *pktp_heap_cb = hnd_pool_get_cb_registry();
+       pktp->release_active = TRUE;
+       hnd_pktpool_release_active_set(pktp);
+
+       /* Execute call back for upper layer which used pkt from heap */
+       for (i = 0; i < PKTPOOL_MAX_HEAP_CB; i++) {
+               if ((pktp_heap_cb[i].fn != NULL) &&
+                       (flag == pktp_heap_cb[i].flag))
+                       (pktp_heap_cb[i].fn)(pktp_heap_cb[i].ctxt, FALSE);
+       }
+
+       rte_freelist_mgr_release(pktp->mem_handle);
+}
+#endif /* !HWA */
+
+/* Function to add back the pkt to pktpool */
+static int
+hnd_pktpool_heap_get_cb(uint8 handle, void *ctxt, void *pkt, uint pktsize)
+{
+       pktpool_t *pktp = (pktpool_t *)ctxt;
+       struct lbuf *lb;
+       int ret = BCME_ERROR;
+       if (pktp != NULL) {
+               if ((lb = PKTALLOC_ON_LOC(pktpool_osh, pktp->max_pkt_bytes,
+                       pktp->type, pkt, pktsize)) != NULL) {
+                       if ((ret = pktpool_add(pktp, lb)) == BCME_OK) {
+                               pktp->poolheap_count--;
+#ifndef HWA
+                               total_poolheap_count--;
+#endif /* HWA */
+                               if (pktp->poolheap_count == 0) {
+                                       pktp->release_active = FALSE;
+                                       hnd_pktpool_release_active_reset(pktp);
+                               }
+                               if (pktp->cbcnt) {
+                                       if (pktp->empty == FALSE)
+                                               pktpool_avail_notify(pktp);
+                               }
+                       } else {
+                               /*
+                                * pktpool_add failed indicate already max
+                                * number of pkts are available in pool. So
+                                * free this buffer to heap
+                                */
+                               PKTFREE(pktpool_osh, lb, pktsize);
+                       }
+                       ret = BCME_OK;
+               }
+       }
+       return ret;
+}
+
+int
+hnd_pktpool_heap_register_cb(pktpool_heap_cb_t fn, void *ctxt, uint32 flag)
+{
+       int i = 0;
+       int err = BCME_ERROR;
+       pktpool_heap_cb_reg_t *pktp_heap_cb = hnd_pool_get_cb_registry();
+
+       /* Search for free entry */
+       for (i = 0; i < PKTPOOL_MAX_HEAP_CB; i++) {
+               if (pktp_heap_cb[i].fn == NULL)
+                       break;
+       }
+
+       if (i < PKTPOOL_MAX_HEAP_CB) {
+               pktp_heap_cb[i].fn = fn;
+               pktp_heap_cb[i].ctxt = ctxt;
+               pktp_heap_cb[i].flag = flag;
+               err = BCME_OK;
+       }
+       return err;
+}
+
+int
+hnd_pktpool_heap_deregister_cb(pktpool_heap_cb_t fn)
+{
+       int i = 0;
+       int err = BCME_ERROR;
+       pktpool_heap_cb_reg_t *pktp_heap_cb = hnd_pool_get_cb_registry();
+
+       /* Search for matching entry */
+       for (i = 0; i < PKTPOOL_MAX_HEAP_CB; i++) {
+               if (pktp_heap_cb[i].fn == fn)
+                       break;
+       }
+
+       if (i < PKTPOOL_MAX_HEAP_CB) {
+               pktp_heap_cb[i].fn = NULL;
+               err = BCME_OK;
+       }
+       return err;
+}
+
+uint16
+hnd_pktpool_get_min_bkup_buf(pktpool_t *pktp)
+{
+       return pktp->min_backup_buf;
+}
+#endif /* POOL_HEAP_RECONFIG */
+
+uint32
+hnd_pktpool_get_total_poolheap_count(void)
+{
+       return total_poolheap_count;
+}
+#endif /* BCMPKTPOOL */
diff --git a/bcmdhd.101.10.240.x/hnd_pktq.c b/bcmdhd.101.10.240.x/hnd_pktq.c
new file mode 100644 (file)
index 0000000..fa6e339
--- /dev/null
@@ -0,0 +1,1512 @@
+/*
+ * HND generic pktq operation primitives
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <osl_ext.h>
+#include <bcmutils.h>
+#include <hnd_pktq.h>
+
+/* mutex macros for thread safe */
+#ifdef HND_PKTQ_THREAD_SAFE
+#define HND_PKTQ_MUTEX_CREATE(name, mutex)     osl_ext_mutex_create(name, mutex)
+#define HND_PKTQ_MUTEX_DELETE(mutex)           osl_ext_mutex_delete(mutex)
+#define HND_PKTQ_MUTEX_ACQUIRE(mutex, msec)    osl_ext_mutex_acquire(mutex, msec)
+#define HND_PKTQ_MUTEX_RELEASE(mutex)          osl_ext_mutex_release(mutex)
+#else
+#define HND_PKTQ_MUTEX_CREATE(name, mutex)     OSL_EXT_SUCCESS
+#define HND_PKTQ_MUTEX_DELETE(mutex)           OSL_EXT_SUCCESS
+#define HND_PKTQ_MUTEX_ACQUIRE(mutex, msec)    OSL_EXT_SUCCESS
+#define HND_PKTQ_MUTEX_RELEASE(mutex)          OSL_EXT_SUCCESS
+#endif /* HND_PKTQ_THREAD_SAFE */
+
+/* status during txfifo sync */
+#if defined(PROP_TXSTATUS)
+#define TXQ_PKT_DEL            0x01
+#define HEAD_PKT_FLUSHED       0xFF
+#endif /* defined(PROP_TXSTATUS) */
+/*
+ * osl multiple-precedence packet queue
+ * hi_prec is always >= the number of the highest non-empty precedence
+ */
+void *
+BCMFASTPATH(pktq_penq)(struct pktq *pq, int prec, void *p)
+{
+       struct pktq_prec *q;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       ASSERT_FP(prec >= 0 && prec < pq->num_prec);
+       ASSERT_FP(PKTLINK(p) == NULL);          /* queueing chains not allowed */
+
+       ASSERT_FP(!pktq_full(pq));
+       ASSERT_FP(!pktqprec_full(pq, prec));
+
+       q = &pq->q[prec];
+
+       if (q->head)
+               PKTSETLINK(q->tail, p);
+       else
+               q->head = p;
+
+       q->tail = p;
+       q->n_pkts++;
+
+       pq->n_pkts_tot++;
+
+       if (pq->hi_prec < prec)
+               pq->hi_prec = (uint8)prec;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void *
+BCMFASTPATH(spktq_enq_chain)(struct spktq *dspq, struct spktq *sspq)
+{
+       struct pktq_prec *dq;
+       struct pktq_prec *sq;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&dspq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&sspq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       dq = &dspq->q;
+       sq = &sspq->q;
+
+       if (dq->head) {
+               PKTSETLINK(dq->tail, sq->head);
+       }
+       else {
+               dq->head = sq->head;
+       }
+
+       dq->tail = sq->tail;
+       dq->n_pkts += sq->n_pkts;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&dspq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&sspq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return dspq;
+}
+
+/*
+ * osl simple, non-priority packet queue
+ */
+void *
+BCMFASTPATH(spktq_enq)(struct spktq *spq, void *p)
+{
+       struct pktq_prec *q;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&spq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       ASSERT_FP(!spktq_full(spq));
+
+       PKTSETLINK(p, NULL);
+
+       q = &spq->q;
+
+       if (q->head)
+               PKTSETLINK(q->tail, p);
+       else
+               q->head = p;
+
+       q->tail = p;
+       q->n_pkts++;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&spq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void *
+BCMFASTPATH(pktq_penq_head)(struct pktq *pq, int prec, void *p)
+{
+       struct pktq_prec *q;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       ASSERT_FP(prec >= 0 && prec < pq->num_prec);
+       ASSERT_FP(PKTLINK(p) == NULL);          /* queueing chains not allowed */
+
+       ASSERT_FP(!pktq_full(pq));
+       ASSERT_FP(!pktqprec_full(pq, prec));
+
+       q = &pq->q[prec];
+
+       if (q->head == NULL)
+               q->tail = p;
+
+       PKTSETLINK(p, q->head);
+       q->head = p;
+       q->n_pkts++;
+
+       pq->n_pkts_tot++;
+
+       if (pq->hi_prec < prec)
+               pq->hi_prec = (uint8)prec;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void *
+BCMFASTPATH(spktq_enq_head)(struct spktq *spq, void *p)
+{
+       struct pktq_prec *q;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&spq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       ASSERT_FP(!spktq_full(spq));
+
+       PKTSETLINK(p, NULL);
+
+       q = &spq->q;
+
+       if (q->head == NULL)
+               q->tail = p;
+
+       PKTSETLINK(p, q->head);
+       q->head = p;
+       q->n_pkts++;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&spq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void *
+BCMFASTPATH(pktq_pdeq)(struct pktq *pq, int prec)
+{
+       struct pktq_prec *q;
+       void *p;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       ASSERT_FP(prec >= 0 && prec < pq->num_prec);
+
+       q = &pq->q[prec];
+
+       if ((p = q->head) == NULL)
+               goto done;
+
+       if ((q->head = PKTLINK(p)) == NULL)
+               q->tail = NULL;
+
+       q->n_pkts--;
+
+       pq->n_pkts_tot--;
+
+#ifdef WL_TXQ_STALL
+       q->dequeue_count++;
+#endif
+
+       PKTSETLINK(p, NULL);
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void *
+BCMFASTPATH(spktq_deq)(struct spktq *spq)
+{
+       struct pktq_prec *q;
+       void *p;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&spq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       q = &spq->q;
+
+       if ((p = q->head) == NULL)
+               goto done;
+
+       if ((q->head = PKTLINK(p)) == NULL)
+               q->tail = NULL;
+
+       q->n_pkts--;
+
+#ifdef WL_TXQ_STALL
+       q->dequeue_count++;
+#endif
+
+       PKTSETLINK(p, NULL);
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&spq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void *
+BCMFASTPATH(pktq_pdeq_tail)(struct pktq *pq, int prec)
+{
+       struct pktq_prec *q;
+       void *p, *prev;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       ASSERT_FP(prec >= 0 && prec < pq->num_prec);
+
+       q = &pq->q[prec];
+
+       if ((p = q->head) == NULL)
+               goto done;
+
+       for (prev = NULL; p != q->tail; p = PKTLINK(p))
+               prev = p;
+
+       if (prev)
+               PKTSETLINK(prev, NULL);
+       else
+               q->head = NULL;
+
+       q->tail = prev;
+       q->n_pkts--;
+
+       pq->n_pkts_tot--;
+
+#ifdef WL_TXQ_STALL
+       q->dequeue_count++;
+#endif
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void *
+BCMFASTPATH(spktq_deq_tail)(struct spktq *spq)
+{
+       struct pktq_prec *q;
+       void *p, *prev;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&spq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       q = &spq->q;
+
+       if ((p = q->head) == NULL)
+               goto done;
+
+       for (prev = NULL; p != q->tail; p = PKTLINK(p))
+               prev = p;
+
+       if (prev)
+               PKTSETLINK(prev, NULL);
+       else
+               q->head = NULL;
+
+       q->tail = prev;
+       q->n_pkts--;
+
+#ifdef WL_TXQ_STALL
+       q->dequeue_count++;
+#endif
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&spq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void *
+pktq_peek_tail(struct pktq *pq, int *prec_out)
+{
+       int prec;
+       void *p = NULL;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       if (pq->n_pkts_tot == 0)
+               goto done;
+
+       for (prec = 0; prec < pq->hi_prec; prec++)
+               if (pq->q[prec].head)
+                       break;
+
+       if (prec_out)
+               *prec_out = prec;
+
+       p = pq->q[prec].tail;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+/*
+ * Append spktq 'list' to the tail of pktq 'pq'
+ */
+void
+BCMFASTPATH(pktq_append)(struct pktq *pq, int prec, struct spktq *list)
+{
+       struct pktq_prec *q;
+       struct pktq_prec *list_q;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       list_q = &list->q;
+
+       /* empty list check */
+       if (list_q->head == NULL)
+               goto done;
+
+       ASSERT_FP(prec >= 0 && prec < pq->num_prec);
+       ASSERT_FP(PKTLINK(list_q->tail) == NULL);         /* terminated list */
+
+       ASSERT_FP(!pktq_full(pq));
+       ASSERT_FP(!pktqprec_full(pq, prec));
+
+       q = &pq->q[prec];
+
+       if (q->head)
+               PKTSETLINK(q->tail, list_q->head);
+       else
+               q->head = list_q->head;
+
+       q->tail = list_q->tail;
+       q->n_pkts += list_q->n_pkts;
+       pq->n_pkts_tot += list_q->n_pkts;
+
+       if (pq->hi_prec < prec)
+               pq->hi_prec = (uint8)prec;
+
+#ifdef WL_TXQ_STALL
+       list_q->dequeue_count += list_q->n_pkts;
+#endif
+
+       list_q->head = NULL;
+       list_q->tail = NULL;
+       list_q->n_pkts = 0;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return;
+}
+
+/*
+ * Append spktq 'list' to the tail of spktq 'spq'
+ */
+void
+BCMFASTPATH(spktq_append)(struct spktq *spq, struct spktq *list)
+{
+       struct pktq_prec *q;
+       struct pktq_prec *list_q;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&spq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       list_q = &list->q;
+
+       /* empty list check */
+       if (list_q->head == NULL)
+               goto done;
+
+       ASSERT_FP(PKTLINK(list_q->tail) == NULL);         /* terminated list */
+
+       ASSERT_FP(!spktq_full(spq));
+
+       q = &spq->q;
+
+       if (q->head)
+               PKTSETLINK(q->tail, list_q->head);
+       else
+               q->head = list_q->head;
+
+       q->tail = list_q->tail;
+       q->n_pkts += list_q->n_pkts;
+
+#ifdef WL_TXQ_STALL
+       list_q->dequeue_count += list_q->n_pkts;
+#endif
+
+       list_q->head = NULL;
+       list_q->tail = NULL;
+       list_q->n_pkts = 0;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&spq->mutex) != OSL_EXT_SUCCESS)
+               return;
+}
+
+/*
+ * Prepend spktq 'list' to the head of pktq 'pq'
+ */
+void
+BCMFASTPATH(pktq_prepend)(struct pktq *pq, int prec, struct spktq *list)
+{
+       struct pktq_prec *q;
+       struct pktq_prec *list_q;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       list_q = &list->q;
+
+       /* empty list check */
+       if (list_q->head == NULL)
+               goto done;
+
+       ASSERT_FP(prec >= 0 && prec < pq->num_prec);
+       ASSERT_FP(PKTLINK(list_q->tail) == NULL);         /* terminated list */
+
+       ASSERT_FP(!pktq_full(pq));
+       ASSERT_FP(!pktqprec_full(pq, prec));
+
+       q = &pq->q[prec];
+
+       /* set the tail packet of list to point at the former pq head */
+       PKTSETLINK(list_q->tail, q->head);
+       /* the new q head is the head of list */
+       q->head = list_q->head;
+
+       /* If the q tail was non-null, then it stays as is.
+        * If the q tail was null, it is now the tail of list
+        */
+       if (q->tail == NULL) {
+               q->tail = list_q->tail;
+       }
+
+       q->n_pkts += list_q->n_pkts;
+       pq->n_pkts_tot += list_q->n_pkts;
+
+       if (pq->hi_prec < prec)
+               pq->hi_prec = (uint8)prec;
+
+#ifdef WL_TXQ_STALL
+       list_q->dequeue_count += list_q->n_pkts;
+#endif
+
+       list_q->head = NULL;
+       list_q->tail = NULL;
+       list_q->n_pkts = 0;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return;
+}
+
+/*
+ * Prepend spktq 'list' to the head of spktq 'spq'
+ */
+void
+BCMFASTPATH(spktq_prepend)(struct spktq *spq, struct spktq *list)
+{
+       struct pktq_prec *q;
+       struct pktq_prec *list_q;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&spq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       list_q = &list->q;
+
+       /* empty list check */
+       if (list_q->head == NULL)
+               goto done;
+
+       ASSERT_FP(PKTLINK(list_q->tail) == NULL);         /* terminated list */
+
+       ASSERT_FP(!spktq_full(spq));
+
+       q = &spq->q;
+
+       /* set the tail packet of list to point at the former pq head */
+       PKTSETLINK(list_q->tail, q->head);
+       /* the new q head is the head of list */
+       q->head = list_q->head;
+
+       /* If the q tail was non-null, then it stays as is.
+        * If the q tail was null, it is now the tail of list
+        */
+       if (q->tail == NULL) {
+               q->tail = list_q->tail;
+       }
+
+       q->n_pkts += list_q->n_pkts;
+
+#ifdef WL_TXQ_STALL
+       list_q->dequeue_count += list_q->n_pkts;
+#endif
+
+       list_q->head = NULL;
+       list_q->tail = NULL;
+       list_q->n_pkts = 0;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&spq->mutex) != OSL_EXT_SUCCESS)
+               return;
+}
+
+void *
+BCMFASTPATH(pktq_pdeq_prev)(struct pktq *pq, int prec, void *prev_p)
+{
+       struct pktq_prec *q;
+       void *p = NULL;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       ASSERT_FP(prec >= 0 && prec < pq->num_prec);
+
+       q = &pq->q[prec];
+
+       if (prev_p == NULL)
+               goto done;
+
+       if ((p = PKTLINK(prev_p)) == NULL)
+               goto done;
+
+       q->n_pkts--;
+
+       pq->n_pkts_tot--;
+
+#ifdef WL_TXQ_STALL
+       q->dequeue_count++;
+#endif
+       PKTSETLINK(prev_p, PKTLINK(p));
+       PKTSETLINK(p, NULL);
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void *
+BCMFASTPATH(pktq_pdeq_with_fn)(struct pktq *pq, int prec, ifpkt_cb_t fn, int arg)
+{
+       struct pktq_prec *q;
+       void *p, *prev = NULL;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       ASSERT_FP(prec >= 0 && prec < pq->num_prec);
+
+       q = &pq->q[prec];
+       p = q->head;
+
+       while (p) {
+               if (fn == NULL || (*fn)(p, arg)) {
+                       break;
+               } else {
+                       prev = p;
+                       p = PKTLINK(p);
+               }
+       }
+       if (p == NULL)
+               goto done;
+
+       if (prev == NULL) {
+               if ((q->head = PKTLINK(p)) == NULL) {
+                       q->tail = NULL;
+               }
+       } else {
+               PKTSETLINK(prev, PKTLINK(p));
+               if (q->tail == p) {
+                       q->tail = prev;
+               }
+       }
+
+       q->n_pkts--;
+
+       pq->n_pkts_tot--;
+
+#ifdef WL_TXQ_STALL
+       q->dequeue_count++;
+#endif
+       PKTSETLINK(p, NULL);
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+bool
+BCMFASTPATH(pktq_pdel)(struct pktq *pq, void *pktbuf, int prec)
+{
+       bool ret = FALSE;
+       struct pktq_prec *q;
+       void *p = NULL;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       ASSERT_FP(prec >= 0 && prec < pq->num_prec);
+
+       /* Should this just assert pktbuf? */
+       if (!pktbuf)
+               goto done;
+
+       q = &pq->q[prec];
+
+       if (q->head == pktbuf) {
+               if ((q->head = PKTLINK(pktbuf)) == NULL)
+                       q->tail = NULL;
+       } else {
+               for (p = q->head; p && PKTLINK(p) != pktbuf; p = PKTLINK(p))
+                       ;
+               if (p == NULL)
+                       goto done;
+
+               PKTSETLINK(p, PKTLINK(pktbuf));
+               if (q->tail == pktbuf)
+                       q->tail = p;
+       }
+
+       q->n_pkts--;
+       pq->n_pkts_tot--;
+
+#ifdef WL_TXQ_STALL
+       q->dequeue_count++;
+#endif
+
+       PKTSETLINK(pktbuf, NULL);
+       ret = TRUE;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       return ret;
+}
+
+static void
+_pktq_pfilter(struct pktq *pq, int prec, pktq_filter_t fltr, void* fltr_ctx,
+              defer_free_pkt_fn_t defer, void *defer_ctx)
+{
+       struct pktq_prec wq;
+       struct pktq_prec *q;
+       void *p;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       /* move the prec queue aside to a work queue */
+       q = &pq->q[prec];
+
+       wq = *q;
+
+       q->head = NULL;
+       q->tail = NULL;
+       q->n_pkts = 0;
+
+#ifdef WL_TXQ_STALL
+       q->dequeue_count += wq.n_pkts;
+#endif
+
+       pq->n_pkts_tot -= wq.n_pkts;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return;
+
+       /* start with the head of the work queue */
+       while ((p = wq.head) != NULL) {
+               /* unlink the current packet from the list */
+               wq.head = PKTLINK(p);
+               PKTSETLINK(p, NULL);
+               wq.n_pkts--;
+
+#ifdef WL_TXQ_STALL
+               wq.dequeue_count++;
+#endif
+
+               /* call the filter function on current packet */
+               ASSERT(fltr != NULL);
+               switch ((*fltr)(fltr_ctx, p)) {
+               case PKT_FILTER_NOACTION:
+                       /* put this packet back */
+                       pktq_penq(pq, prec, p);
+                       break;
+
+               case PKT_FILTER_DELETE:
+                       /* delete this packet */
+                       ASSERT(defer != NULL);
+                       (*defer)(defer_ctx, p);
+                       break;
+
+               case PKT_FILTER_REMOVE:
+                       /* pkt already removed from list */
+                       break;
+
+               default:
+                       ASSERT(0);
+                       break;
+               }
+       }
+
+       ASSERT(wq.n_pkts == 0);
+}
+
+void
+pktq_pfilter(struct pktq *pq, int prec, pktq_filter_t fltr, void* fltr_ctx,
+       defer_free_pkt_fn_t defer, void *defer_ctx, flush_free_pkt_fn_t flush, void *flush_ctx)
+{
+       _pktq_pfilter(pq, prec, fltr, fltr_ctx, defer, defer_ctx);
+
+       ASSERT(flush != NULL);
+       (*flush)(flush_ctx);
+}
+
+void
+pktq_filter(struct pktq *pq, pktq_filter_t fltr, void* fltr_ctx,
+       defer_free_pkt_fn_t defer, void *defer_ctx, flush_free_pkt_fn_t flush, void *flush_ctx)
+{
+       bool filter = FALSE;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       /* Optimize if pktq n_pkts = 0, just return.
+        * pktq len of 0 means pktq's prec q's are all empty.
+        */
+       if (pq->n_pkts_tot > 0) {
+               filter = TRUE;
+       }
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return;
+
+       if (filter) {
+               int prec;
+
+               PKTQ_PREC_ITER(pq, prec) {
+                       _pktq_pfilter(pq, prec, fltr, fltr_ctx, defer, defer_ctx);
+               }
+
+               ASSERT(flush != NULL);
+               (*flush)(flush_ctx);
+       }
+}
+
+void
+spktq_filter(struct spktq *spq, pktq_filter_t fltr, void* fltr_ctx,
+       defer_free_pkt_fn_t defer, void *defer_ctx, flush_free_pkt_fn_t flush, void *flush_ctx)
+{
+       struct pktq_prec wq;
+       struct pktq_prec *q;
+       void *p = NULL;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&spq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       q = &spq->q;
+
+       /* Optimize if pktq_prec n_pkts = 0, just return. */
+       if (q->n_pkts == 0) {
+               (void)HND_PKTQ_MUTEX_RELEASE(&spq->mutex);
+               return;
+       }
+
+       wq = *q;
+
+       q->head = NULL;
+       q->tail = NULL;
+       q->n_pkts = 0;
+
+#ifdef WL_TXQ_STALL
+       q->dequeue_count += wq.n_pkts;
+#endif
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&spq->mutex) != OSL_EXT_SUCCESS)
+               return;
+
+       /* start with the head of the work queue */
+
+       while ((p = wq.head) != NULL) {
+               /* unlink the current packet from the list */
+               wq.head = PKTLINK(p);
+               PKTSETLINK(p, NULL);
+               wq.n_pkts--;
+
+#ifdef WL_TXQ_STALL
+               wq.dequeue_count++;
+#endif
+
+               /* call the filter function on current packet */
+               ASSERT(fltr != NULL);
+               switch ((*fltr)(fltr_ctx, p)) {
+               case PKT_FILTER_NOACTION:
+                       /* put this packet back */
+                       spktq_enq(spq, p);
+                       break;
+
+               case PKT_FILTER_DELETE:
+                       /* delete this packet */
+                       ASSERT(defer != NULL);
+                       (*defer)(defer_ctx, p);
+                       break;
+
+               case PKT_FILTER_REMOVE:
+                       /* pkt already removed from list */
+                       break;
+
+               default:
+                       ASSERT(0);
+                       break;
+               }
+       }
+
+       ASSERT(wq.n_pkts == 0);
+
+       ASSERT(flush != NULL);
+       (*flush)(flush_ctx);
+}
+
+bool
+pktq_init(struct pktq *pq, int num_prec, uint max_pkts)
+{
+       int prec;
+
+       ASSERT(num_prec > 0 && num_prec <= PKTQ_MAX_PREC);
+
+       /* pq is variable size; only zero out what's requested */
+       bzero(pq, OFFSETOF(struct pktq, q) + (sizeof(struct pktq_prec) * num_prec));
+
+       if (HND_PKTQ_MUTEX_CREATE("pktq", &pq->mutex) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       pq->num_prec = (uint16)num_prec;
+
+       pq->max_pkts = (uint16)max_pkts;
+
+       for (prec = 0; prec < num_prec; prec++)
+               pq->q[prec].max_pkts = pq->max_pkts;
+
+       return TRUE;
+}
+
+bool
+spktq_init(struct spktq *spq, uint max_pkts)
+{
+       bzero(spq, sizeof(struct spktq));
+
+       if (HND_PKTQ_MUTEX_CREATE("spktq", &spq->mutex) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       spq->q.max_pkts = (uint16)max_pkts;
+
+       return TRUE;
+}
+
+bool
+spktq_init_list(struct spktq *spq, uint max_pkts, void *head, void *tail, uint16 n_pkts)
+{
+       if (HND_PKTQ_MUTEX_CREATE("spktq", &spq->mutex) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       ASSERT(PKTLINK(tail) == NULL);
+       PKTSETLINK(tail, NULL);
+       spq->q.head = head;
+       spq->q.tail = tail;
+       spq->q.max_pkts = (uint16)max_pkts;
+       spq->q.n_pkts = n_pkts;
+       spq->q.stall_count = 0;
+       spq->q.dequeue_count = 0;
+
+       return TRUE;
+}
+
+bool
+pktq_deinit(struct pktq *pq)
+{
+       BCM_REFERENCE(pq);
+       if (HND_PKTQ_MUTEX_DELETE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       return TRUE;
+}
+
+bool
+spktq_deinit(struct spktq *spq)
+{
+       BCM_REFERENCE(spq);
+       if (HND_PKTQ_MUTEX_DELETE(&spq->mutex) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       return TRUE;
+}
+
+void
+pktq_set_max_plen(struct pktq *pq, int prec, uint max_pkts)
+{
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       if (prec < pq->num_prec)
+               pq->q[prec].max_pkts = (uint16)max_pkts;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return;
+}
+
+void *
+BCMFASTPATH(pktq_deq)(struct pktq *pq, int *prec_out)
+{
+       struct pktq_prec *q;
+       void *p = NULL;
+       int prec;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       if (pq->n_pkts_tot == 0)
+               goto done;
+
+       while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+               pq->hi_prec--;
+
+       q = &pq->q[prec];
+
+       if ((p = q->head) == NULL)
+               goto done;
+
+       if ((q->head = PKTLINK(p)) == NULL)
+               q->tail = NULL;
+
+       q->n_pkts--;
+
+       pq->n_pkts_tot--;
+
+#ifdef WL_TXQ_STALL
+       q->dequeue_count++;
+#endif
+
+       if (prec_out)
+               *prec_out = prec;
+
+       PKTSETLINK(p, NULL);
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void *
+BCMFASTPATH(pktq_deq_tail)(struct pktq *pq, int *prec_out)
+{
+       struct pktq_prec *q;
+       void *p = NULL, *prev;
+       int prec;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       if (pq->n_pkts_tot == 0)
+               goto done;
+
+       for (prec = 0; prec < pq->hi_prec; prec++)
+               if (pq->q[prec].head)
+                       break;
+
+       q = &pq->q[prec];
+
+       if ((p = q->head) == NULL)
+               goto done;
+
+       for (prev = NULL; p != q->tail; p = PKTLINK(p))
+               prev = p;
+
+       if (prev)
+               PKTSETLINK(prev, NULL);
+       else
+               q->head = NULL;
+
+       q->tail = prev;
+       q->n_pkts--;
+
+       pq->n_pkts_tot--;
+
+#ifdef WL_TXQ_STALL
+       q->dequeue_count++;
+#endif
+
+       if (prec_out)
+               *prec_out = prec;
+
+       PKTSETLINK(p, NULL);
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void *
+pktq_peek(struct pktq *pq, int *prec_out)
+{
+       int prec;
+       void *p = NULL;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       if (pq->n_pkts_tot == 0)
+               goto done;
+
+       while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+               pq->hi_prec--;
+
+       if (prec_out)
+               *prec_out = prec;
+
+       p = pq->q[prec].head;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void *
+spktq_peek(struct spktq *spq)
+{
+       void *p = NULL;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&spq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       if (spq->q.n_pkts == 0)
+               goto done;
+
+       p = spq->q.head;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&spq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void
+pktq_pflush(osl_t *osh, struct pktq *pq, int prec, bool dir)
+{
+       void *p;
+
+       /* no need for a mutex protection! */
+
+       /* start with the head of the list */
+       while ((p = pktq_pdeq(pq, prec)) != NULL) {
+
+               /* delete this packet */
+               PKTFREE(osh, p, dir);
+       }
+}
+
+void
+spktq_flush_ext(osl_t *osh, struct spktq *spq, bool dir,
+       void (*pktq_flush_cb)(void *ctx, void *pkt), void *pktq_flush_ctx)
+{
+       void *pkt;
+
+       /* no need for a mutex protection! */
+
+       /* start with the head of the list */
+       while ((pkt = spktq_deq(spq)) != NULL) {
+               if (pktq_flush_cb != NULL) {
+                       pktq_flush_cb(pktq_flush_ctx, pkt);
+               }
+               /* delete this packet */
+               PKTFREE(osh, pkt, dir);
+       }
+}
+
+typedef struct {
+       spktq_cb_t cb;
+       void *arg;
+} spktq_cbinfo_t;
+static spktq_cbinfo_t spktq_cbinfo = {NULL, NULL};
+static spktq_cbinfo_t *spktq_cbinfo_get(void);
+
+/* Accessor function forced into RAM to keep spktq_cbinfo out of shdat */
+static spktq_cbinfo_t*
+BCMRAMFN(spktq_cbinfo_get)(void)
+{
+       return (&spktq_cbinfo);
+}
+
+void
+spktq_free_register(spktq_cb_t cb, void *arg)
+{
+       spktq_cbinfo_t *cbinfop = spktq_cbinfo_get();
+       cbinfop->cb = cb;
+       cbinfop->arg = arg;
+}
+
+void
+spktq_cb(void *spq)
+{
+       spktq_cbinfo_t *cbinfop = spktq_cbinfo_get();
+       if (cbinfop->cb) {
+               cbinfop->cb(cbinfop->arg, spq);
+       }
+}
+
+void
+pktq_flush(osl_t *osh, struct pktq *pq, bool dir)
+{
+       bool flush = FALSE;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       /* Optimize flush, if pktq n_pkts_tot = 0, just return.
+        * pktq len of 0 means pktq's prec q's are all empty.
+        */
+       if (pq->n_pkts_tot > 0) {
+               flush = TRUE;
+       }
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return;
+
+       if (flush) {
+               int prec;
+
+               PKTQ_PREC_ITER(pq, prec) {
+                       pktq_pflush(osh, pq, prec, dir);
+               }
+       }
+}
+
+/* Return sum of lengths of a specific set of precedences */
+int
+pktq_mlen(struct pktq *pq, uint prec_bmp)
+{
+       int prec, len;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return 0;
+
+       len = 0;
+
+       for (prec = 0; prec <= pq->hi_prec; prec++)
+               if (prec_bmp & (1 << prec))
+                       len += pq->q[prec].n_pkts;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return 0;
+
+       return len;
+}
+
+/* Priority peek from a specific set of precedences */
+void *
+BCMFASTPATH(pktq_mpeek)(struct pktq *pq, uint prec_bmp, int *prec_out)
+{
+       struct pktq_prec *q;
+       void *p = NULL;
+       int prec;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       if (pq->n_pkts_tot == 0)
+               goto done;
+
+       while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+               pq->hi_prec--;
+
+       while ((prec_bmp & (1 << prec)) == 0 || pq->q[prec].head == NULL)
+               if (prec-- == 0)
+                       goto done;
+
+       q = &pq->q[prec];
+
+       if ((p = q->head) == NULL)
+               goto done;
+
+       if (prec_out)
+               *prec_out = prec;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+/* Priority dequeue from a specific set of precedences */
+void *
+BCMFASTPATH(pktq_mdeq)(struct pktq *pq, uint prec_bmp, int *prec_out)
+{
+       struct pktq_prec *q;
+       void *p = NULL;
+       int prec;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       if (pq->n_pkts_tot == 0)
+               goto done;
+
+       while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+               pq->hi_prec--;
+
+       while ((pq->q[prec].head == NULL) || ((prec_bmp & (1 << prec)) == 0))
+               if (prec-- == 0)
+                       goto done;
+
+       q = &pq->q[prec];
+
+       if ((p = q->head) == NULL)
+               goto done;
+
+       if ((q->head = PKTLINK(p)) == NULL)
+               q->tail = NULL;
+
+       q->n_pkts--;
+
+       // terence 20150308: fix for non-null pointer of skb->prev sent from ndo_start_xmit
+       if (q->n_pkts == 0) {
+               q->head = NULL;
+               q->tail = NULL;
+       }
+
+#ifdef WL_TXQ_STALL
+       q->dequeue_count++;
+#endif
+
+       if (prec_out)
+               *prec_out = prec;
+
+       pq->n_pkts_tot--;
+
+       PKTSETLINK(p, NULL);
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+#ifdef HND_PKTQ_THREAD_SAFE
+int
+pktqprec_avail_pkts(struct pktq *pq, int prec)
+{
+       int ret;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return 0;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       ret = pq->q[prec].max_pkts - pq->q[prec].n_pkts;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return 0;
+
+       return ret;
+}
+
+bool
+BCMFASTPATH(pktqprec_full)(struct pktq *pq, int prec)
+{
+       bool ret;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       ASSERT_FP(prec >= 0 && prec < pq->num_prec);
+
+       ret = pq->q[prec].n_pkts >= pq->q[prec].max_pkts;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       return ret;
+}
+
+int
+pktq_avail(struct pktq *pq)
+{
+       int ret;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return 0;
+
+       ret = pq->max_pkts - pq->n_pkts_tot;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return 0;
+
+       return ret;
+}
+
+int
+spktq_avail(struct spktq *spq)
+{
+       int ret;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&spq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return 0;
+
+       ret = spq->q.max_pkts - spq->q.n_pkts;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&spq->mutex) != OSL_EXT_SUCCESS)
+               return 0;
+
+       return ret;
+}
+
+bool
+pktq_full(struct pktq *pq)
+{
+       bool ret;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       ret = pq->n_pkts_tot >= pq->max_pkts;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       return ret;
+}
+
+bool
+spktq_full(struct spktq *spq)
+{
+       bool ret;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&spq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       ret = spq->q.n_pkts >= spq->q.max_pkts;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&spq->mutex) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       return ret;
+}
+
+#endif /* HND_PKTQ_THREAD_SAFE */
diff --git a/bcmdhd.101.10.240.x/hndpmu.c b/bcmdhd.101.10.240.x/hndpmu.c
new file mode 100644 (file)
index 0000000..bd18d10
--- /dev/null
@@ -0,0 +1,721 @@
+/*
+ * Misc utility routines for accessing PMU corerev specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+/**
+ * @file
+ * Note: this file contains PLL/FLL related functions. A chip can contain multiple PLLs/FLLs.
+ * However, in the context of this file the baseband ('BB') PLL/FLL is referred to.
+ *
+ * Throughout this code, the prefixes 'pmu1_' and 'pmu2_' are used.
+ * They refer to different revisions of the PMU (which is at revision 18 @ Apr 25, 2012)
+ * pmu1_ marks the transition from PLL to ADFLL (Digital Frequency Locked Loop). It supports
+ * fractional frequency generation. pmu2_ does not support fractional frequency generation.
+ */
+
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <bcmdevs.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <hndchipc.h>
+#include <hndpmu.h>
+#include <hndlhl.h>
+#include <sbgci.h>
+#ifdef EVENT_LOG_COMPILE
+#include <event_log.h>
+#endif
+#include <sbgci.h>
+#include <lpflags.h>
+
+#include "siutils_priv.h"
+
+#ifdef BCM_AVS
+#include <bcm_avs.h>
+#endif
+
+#define        PMU_ERROR(args)
+
+#ifdef BCMDBG_PMU
+#define        PMU_MSG(args)   printf args
+#else
+#define        PMU_MSG(args)
+#endif /* BCMDBG_MPU */
+
+/* To check in verbose debugging messages not intended
+ * to be on except on private builds.
+ */
+#define        PMU_NONE(args)
+#define flags_shift    14
+
+/** contains resource bit positions for a specific chip */
+struct rsc_per_chip {
+       uint8 ht_avail;
+       uint8 macphy_clkavail;
+       uint8 ht_start;
+       uint8 otp_pu;
+       uint8 macphy_aux_clkavail;
+       uint8 macphy_scan_clkavail;
+       uint8 cb_ready;
+       uint8 dig_ready;
+};
+
+typedef struct rsc_per_chip rsc_per_chip_t;
+
+#if defined(BCMPMU_STATS) && !defined(BCMPMU_STATS_DISABLED)
+bool   _pmustatsenab = TRUE;
+#else
+bool   _pmustatsenab = FALSE;
+#endif /* BCMPMU_STATS */
+
+/* 1MHz lpo enable */
+/* PLEASE USE THIS MACRO IN ATTACH PATH ONLY! */
+#if defined(BCM_FASTLPO) && !defined(BCM_FASTLPO_DISABLED)
+       #define FASTLPO_ENAB()  (TRUE)
+#else
+       #define FASTLPO_ENAB()  (FALSE)
+#endif
+
+/* Disable the power optimization feature */
+bool   _bcm_pwr_opt_dis = FALSE;
+
+/**
+ * Reads/writes a chipcontrol reg. Performes core switching if required, at function exit the
+ * original core is restored. Depending on chip type, read/writes to chipcontrol regs in CC core
+ * (older chips) or to chipcontrol regs in PMU core (later chips).
+ */
+uint32
+si_pmu_chipcontrol(si_t *sih, uint reg, uint32 mask, uint32 val)
+{
+       pmu_corereg(sih, SI_CC_IDX, chipcontrol_addr, ~0, reg);
+       return pmu_corereg(sih, SI_CC_IDX, chipcontrol_data, mask, val);
+}
+
+/**
+ * Reads/writes a voltage regulator (vreg) register. Performes core switching if required, at
+ * function exit the original core is restored. Depending on chip type, writes to regulator regs
+ * in CC core (older chips) or to regulator regs in PMU core (later chips).
+ */
+uint32
+si_pmu_vreg_control(si_t *sih, uint reg, uint32 mask, uint32 val)
+{
+       pmu_corereg(sih, SI_CC_IDX, regcontrol_addr, ~0, reg);
+       return pmu_corereg(sih, SI_CC_IDX, regcontrol_data, mask, val);
+}
+
+/**
+ * Reads/writes a PLL control register. Performes core switching if required, at function exit the
+ * original core is restored. Depending on chip type, writes to PLL control regs in CC core (older
+ * chips) or to PLL control regs in PMU core (later chips).
+ */
+uint32
+si_pmu_pllcontrol(si_t *sih, uint reg, uint32 mask, uint32 val)
+{
+       pmu_corereg(sih, SI_CC_IDX, pllcontrol_addr, ~0, reg);
+       return pmu_corereg(sih, SI_CC_IDX, pllcontrol_data, mask, val);
+}
+
+/**
+ * Balance between stable SDIO operation and power consumption is achieved using this function.
+ * Note that each drive strength table is for a specific VDDIO of the SDIO pads, ideally this
+ * function should read the VDDIO itself to select the correct table. For now it has been solved
+ * with the 'BCM_SDIO_VDDIO' preprocessor constant.
+ *
+ * 'drivestrength': desired pad drive strength in mA. Drive strength of 0 requests tri-state (if
+ *                 hardware supports this), if no hw support drive strength is not programmed.
+ */
+void
+si_sdiod_drive_strength_init(si_t *sih, osl_t *osh, uint32 drivestrength)
+{
+       /*
+        * Note:
+        * This function used to set the SDIO drive strength via PMU_CHIPCTL1 for the
+        * 43143, 4330, 4334, 4336, 43362 chips.  These chips are now no longer supported, so
+        * the code has been deleted.
+        * Newer chips have the SDIO drive strength setting via a GCI Chip Control register,
+        * but the bit definitions are chip-specific.  We are keeping this function available
+        * (accessed via DHD 'sdiod_drive' IOVar) in case these newer chips need to provide access.
+        */
+       UNUSED_PARAMETER(sih);
+       UNUSED_PARAMETER(osh);
+       UNUSED_PARAMETER(drivestrength);
+}
+
+uint32
+si_pmu_wake_bit_offset(si_t *sih)
+{
+       uint32 wakebit;
+
+       switch (CHIPID(sih->chip)) {
+       case BCM4369_CHIP_GRPID:
+               wakebit = PMU_CC2_GCI2_WAKE;
+               break;
+       case BCM4368_CHIP_GRPID:
+       case BCM4376_CHIP_GRPID:
+       case BCM4378_CHIP_GRPID:
+               wakebit = CC2_4378_GCI2WAKE_MASK;
+               break;
+       case BCM4385_CHIP_GRPID:
+       case BCM4387_CHIP_GRPID:
+               wakebit = CC2_4387_GCI2WAKE_MASK;
+               break;
+       case BCM4388_CHIP_GRPID:
+       case BCM4389_CHIP_GRPID:
+       case BCM4397_CHIP_GRPID:
+               wakebit = CC2_4389_GCI2WAKE_MASK;
+               break;
+       default:
+               wakebit = 0;
+               ASSERT(0);
+               break;
+       }
+
+       return wakebit;
+}
+
+void si_pmu_set_min_res_mask(si_t *sih, osl_t *osh, uint min_res_mask)
+{
+       pmuregs_t *pmu;
+       uint origidx;
+
+       /* Remember original core before switch to chipc/pmu */
+       origidx = si_coreidx(sih);
+       if (AOB_ENAB(sih)) {
+               pmu = si_setcore(sih, PMU_CORE_ID, 0);
+       }
+       else {
+               pmu = si_setcoreidx(sih, SI_CC_IDX);
+       }
+       ASSERT(pmu != NULL);
+
+       W_REG(osh, &pmu->min_res_mask, min_res_mask);
+       OSL_DELAY(100);
+
+       /* Return to original core */
+       si_setcoreidx(sih, origidx);
+}
+
+bool
+si_pmu_cap_fast_lpo(si_t *sih)
+{
+       return (PMU_REG(sih, core_cap_ext, 0, 0) & PCAP_EXT_USE_MUXED_ILP_CLK_MASK) ? TRUE : FALSE;
+}
+
+int
+si_pmu_fast_lpo_disable(si_t *sih)
+{
+       if (!si_pmu_cap_fast_lpo(sih)) {
+               PMU_ERROR(("si_pmu_fast_lpo_disable: No Fast LPO capability\n"));
+               return BCME_ERROR;
+       }
+
+       PMU_REG(sih, pmucontrol_ext,
+               PCTL_EXT_FASTLPO_ENAB |
+               PCTL_EXT_FASTLPO_SWENAB |
+               PCTL_EXT_FASTLPO_PCIE_SWENAB,
+               0);
+       OSL_DELAY(1000);
+       return BCME_OK;
+}
+
+/*
+* 4389B0/C0 - WL and BT turn on WAR,
+* set below bits in PMU chip control 6
+* - global bit[195] / bit[3] - enable legacy pmu_wakeup to make
+* domain 1 (WL) power request
+* - global bit[206] / bit[14] - perst_wake_en
+*/
+void
+si_pmu_dmn1_perst_wakeup(si_t *sih, bool set)
+{
+       if (PMUREV(sih->pmurev) == 40) {
+               if (set) {
+                       si_pmu_chipcontrol(sih, PMU_CHIPCTL6,
+                               (PMU_CC6_ENABLE_DMN1_WAKEUP |
+                               PMU_CC6_ENABLE_PMU_WAKEUP_PERST),
+                               (PMU_CC6_ENABLE_DMN1_WAKEUP |
+                               PMU_CC6_ENABLE_PMU_WAKEUP_PERST));
+               } else {
+                       si_pmu_chipcontrol(sih, PMU_CHIPCTL6,
+                               (PMU_CC6_ENABLE_DMN1_WAKEUP |
+                               PMU_CC6_ENABLE_PMU_WAKEUP_PERST),
+                               0);
+               }
+       }
+}
+
+#ifdef BCMPMU_STATS
+/*
+ * 8 pmu statistics timer default map
+ *
+ * for CORE_RDY_AUX measure, set as below for timer 6 and 7 instead of CORE_RDY_MAIN.
+ *     //core-n active duration : pmu_rsrc_state(CORE_RDY_AUX)
+ *     { SRC_CORE_RDY_AUX, FALSE, TRUE, LEVEL_HIGH},
+ *     //core-n active duration : pmu_rsrc_state(CORE_RDY_AUX)
+ *     { SRC_CORE_RDY_AUX, FALSE, TRUE, EDGE_RISE}
+ */
+static pmu_stats_timer_t pmustatstimer[] = {
+       { SRC_LINK_IN_L12, FALSE, TRUE, PMU_STATS_LEVEL_HIGH},  //link_in_l12
+       { SRC_LINK_IN_L23, FALSE, TRUE, PMU_STATS_LEVEL_HIGH},  //link_in_l23
+       { SRC_PM_ST_IN_D0, FALSE, TRUE, PMU_STATS_LEVEL_HIGH},  //pm_st_in_d0
+       { SRC_PM_ST_IN_D3, FALSE, TRUE, PMU_STATS_LEVEL_HIGH},  //pm_st_in_d3
+       //deep-sleep duration : pmu_rsrc_state(XTAL_PU)
+       { SRC_XTAL_PU, FALSE, TRUE, PMU_STATS_LEVEL_LOW},
+       //deep-sleep entry count : pmu_rsrc_state(XTAL_PU)
+       { SRC_XTAL_PU, FALSE, TRUE, PMU_STATS_EDGE_FALL},
+       //core-n active duration : pmu_rsrc_state(CORE_RDY_MAIN)
+       { SRC_CORE_RDY_MAIN, FALSE, TRUE, PMU_STATS_LEVEL_HIGH},
+       //core-n active duration : pmu_rsrc_state(CORE_RDY_MAIN)
+       { SRC_CORE_RDY_MAIN, FALSE, TRUE, PMU_STATS_EDGE_RISE}
+};
+
+static void
+si_pmustatstimer_update(osl_t *osh, pmuregs_t *pmu, uint8 timerid)
+{
+       uint32 stats_timer_ctrl;
+
+       W_REG(osh, &pmu->pmu_statstimer_addr, timerid);
+       stats_timer_ctrl =
+               ((pmustatstimer[timerid].src_num << PMU_ST_SRC_SHIFT) &
+                       PMU_ST_SRC_MASK) |
+               ((pmustatstimer[timerid].cnt_mode << PMU_ST_CNT_MODE_SHIFT) &
+                       PMU_ST_CNT_MODE_MASK) |
+               ((pmustatstimer[timerid].enable << PMU_ST_EN_SHIFT) & PMU_ST_EN_MASK) |
+               ((pmustatstimer[timerid].int_enable << PMU_ST_INT_EN_SHIFT) & PMU_ST_INT_EN_MASK);
+       W_REG(osh, &pmu->pmu_statstimer_ctrl, stats_timer_ctrl);
+       W_REG(osh, &pmu->pmu_statstimer_N, 0);
+}
+
+void
+si_pmustatstimer_int_enable(si_t *sih)
+{
+       pmuregs_t *pmu;
+       uint origidx;
+       osl_t *osh = si_osh(sih);
+
+       /* Remember original core before switch to chipc/pmu */
+       origidx = si_coreidx(sih);
+       if (AOB_ENAB(sih)) {
+               pmu = si_setcore(sih, PMU_CORE_ID, 0);
+       } else {
+               pmu = si_setcoreidx(sih, SI_CC_IDX);
+       }
+       ASSERT(pmu != NULL);
+
+       OR_REG(osh, &pmu->pmuintmask0, PMU_INT_STAT_TIMER_INT_MASK);
+
+       /* Return to original core */
+       si_setcoreidx(sih, origidx);
+}
+
+void
+si_pmustatstimer_int_disable(si_t *sih)
+{
+       pmuregs_t *pmu;
+       uint origidx;
+       osl_t *osh = si_osh(sih);
+
+       /* Remember original core before switch to chipc/pmu */
+       origidx = si_coreidx(sih);
+       if (AOB_ENAB(sih)) {
+               pmu = si_setcore(sih, PMU_CORE_ID, 0);
+       } else {
+               pmu = si_setcoreidx(sih, SI_CC_IDX);
+       }
+       ASSERT(pmu != NULL);
+
+       AND_REG(osh, &pmu->pmuintmask0, ~PMU_INT_STAT_TIMER_INT_MASK);
+
+       /* Return to original core */
+       si_setcoreidx(sih, origidx);
+}
+
+void
+si_pmustatstimer_init(si_t *sih)
+{
+       pmuregs_t *pmu;
+       uint origidx;
+       osl_t *osh = si_osh(sih);
+       uint32 core_cap_ext;
+       uint8 max_stats_timer_num;
+       int8 i;
+
+       /* Remember original core before switch to chipc/pmu */
+       origidx = si_coreidx(sih);
+       if (AOB_ENAB(sih)) {
+               pmu = si_setcore(sih, PMU_CORE_ID, 0);
+       } else {
+               pmu = si_setcoreidx(sih, SI_CC_IDX);
+       }
+       ASSERT(pmu != NULL);
+
+       core_cap_ext = R_REG(osh, &pmu->core_cap_ext);
+
+       max_stats_timer_num = ((core_cap_ext & PCAP_EXT_ST_NUM_MASK) >> PCAP_EXT_ST_NUM_SHIFT) + 1;
+
+       for (i = 0; i < max_stats_timer_num; i++) {
+               si_pmustatstimer_update(osh, pmu, i);
+       }
+
+       OR_REG(osh, &pmu->pmuintmask0, PMU_INT_STAT_TIMER_INT_MASK);
+
+       /* Return to original core */
+       si_setcoreidx(sih, origidx);
+}
+
+void
+si_pmustatstimer_dump(si_t *sih)
+{
+       pmuregs_t *pmu;
+       uint origidx;
+       osl_t *osh = si_osh(sih);
+       uint32 core_cap_ext, pmucapabilities, AlpPeriod, ILPPeriod, pmuintmask0, pmuintstatus;
+       uint8 max_stats_timer_num, max_stats_timer_src_num;
+       uint32 stat_timer_ctrl, stat_timer_N;
+       uint8 i;
+       uint32 current_time_ms = OSL_SYSUPTIME();
+
+       /* Remember original core before switch to chipc/pmu */
+       origidx = si_coreidx(sih);
+       if (AOB_ENAB(sih)) {
+               pmu = si_setcore(sih, PMU_CORE_ID, 0);
+       } else {
+               pmu = si_setcoreidx(sih, SI_CC_IDX);
+       }
+       ASSERT(pmu != NULL);
+
+       pmucapabilities = R_REG(osh, &pmu->pmucapabilities);
+       core_cap_ext = R_REG(osh, &pmu->core_cap_ext);
+       AlpPeriod = R_REG(osh, &pmu->slowclkperiod);
+       ILPPeriod = R_REG(osh, &pmu->ILPPeriod);
+
+       max_stats_timer_num = ((core_cap_ext & PCAP_EXT_ST_NUM_MASK) >>
+               PCAP_EXT_ST_NUM_SHIFT) + 1;
+       max_stats_timer_src_num = ((core_cap_ext & PCAP_EXT_ST_SRC_NUM_MASK) >>
+               PCAP_EXT_ST_SRC_NUM_SHIFT) + 1;
+
+       pmuintstatus = R_REG(osh, &pmu->pmuintstatus);
+       pmuintmask0 = R_REG(osh, &pmu->pmuintmask0);
+
+       PMU_ERROR(("si_pmustatstimer_dump : TIME %d\n", current_time_ms));
+
+       PMU_ERROR(("\tMAX Timer Num %d, MAX Source Num %d\n",
+               max_stats_timer_num, max_stats_timer_src_num));
+       PMU_ERROR(("\tpmucapabilities 0x%8x, core_cap_ext 0x%8x, AlpPeriod 0x%8x, ILPPeriod 0x%8x, "
+               "pmuintmask0 0x%8x, pmuintstatus 0x%8x, pmurev %d\n",
+               pmucapabilities, core_cap_ext, AlpPeriod, ILPPeriod,
+               pmuintmask0, pmuintstatus, PMUREV(sih->pmurev)));
+
+       for (i = 0; i < max_stats_timer_num; i++) {
+               W_REG(osh, &pmu->pmu_statstimer_addr, i);
+               stat_timer_ctrl = R_REG(osh, &pmu->pmu_statstimer_ctrl);
+               stat_timer_N = R_REG(osh, &pmu->pmu_statstimer_N);
+               PMU_ERROR(("\t Timer %d : control 0x%8x, %d\n",
+                       i, stat_timer_ctrl, stat_timer_N));
+       }
+
+       /* Return to original core */
+       si_setcoreidx(sih, origidx);
+}
+
+void
+si_pmustatstimer_start(si_t *sih, uint8 timerid)
+{
+       pmuregs_t *pmu;
+       uint origidx;
+       osl_t *osh = si_osh(sih);
+
+       /* Remember original core before switch to chipc/pmu */
+       origidx = si_coreidx(sih);
+       if (AOB_ENAB(sih)) {
+               pmu = si_setcore(sih, PMU_CORE_ID, 0);
+       } else {
+               pmu = si_setcoreidx(sih, SI_CC_IDX);
+       }
+       ASSERT(pmu != NULL);
+
+       pmustatstimer[timerid].enable = TRUE;
+
+       W_REG(osh, &pmu->pmu_statstimer_addr, timerid);
+       OR_REG(osh, &pmu->pmu_statstimer_ctrl, PMU_ST_ENAB << PMU_ST_EN_SHIFT);
+
+       /* Return to original core */
+       si_setcoreidx(sih, origidx);
+}
+
+void
+si_pmustatstimer_stop(si_t *sih, uint8 timerid)
+{
+       pmuregs_t *pmu;
+       uint origidx;
+       osl_t *osh = si_osh(sih);
+
+       /* Remember original core before switch to chipc/pmu */
+       origidx = si_coreidx(sih);
+       if (AOB_ENAB(sih)) {
+               pmu = si_setcore(sih, PMU_CORE_ID, 0);
+       } else {
+               pmu = si_setcoreidx(sih, SI_CC_IDX);
+       }
+       ASSERT(pmu != NULL);
+
+       pmustatstimer[timerid].enable = FALSE;
+
+       W_REG(osh, &pmu->pmu_statstimer_addr, timerid);
+       AND_REG(osh, &pmu->pmu_statstimer_ctrl, ~(PMU_ST_ENAB << PMU_ST_EN_SHIFT));
+
+       /* Return to original core */
+       si_setcoreidx(sih, origidx);
+}
+
+void
+si_pmustatstimer_clear(si_t *sih, uint8 timerid)
+{
+       pmuregs_t *pmu;
+       uint origidx;
+       osl_t *osh = si_osh(sih);
+
+       /* Remember original core before switch to chipc/pmu */
+       origidx = si_coreidx(sih);
+       if (AOB_ENAB(sih)) {
+               pmu = si_setcore(sih, PMU_CORE_ID, 0);
+       } else {
+               pmu = si_setcoreidx(sih, SI_CC_IDX);
+       }
+       ASSERT(pmu != NULL);
+
+       W_REG(osh, &pmu->pmu_statstimer_addr, timerid);
+       W_REG(osh, &pmu->pmu_statstimer_N, 0);
+
+       /* Return to original core */
+       si_setcoreidx(sih, origidx);
+}
+
+void
+si_pmustatstimer_clear_overflow(si_t *sih)
+{
+       uint8 i;
+       uint32 core_cap_ext;
+       uint8 max_stats_timer_num;
+       uint32 timerN;
+       pmuregs_t *pmu;
+       uint origidx;
+       osl_t *osh = si_osh(sih);
+
+       /* Remember original core before switch to chipc/pmu */
+       origidx = si_coreidx(sih);
+       if (AOB_ENAB(sih)) {
+               pmu = si_setcore(sih, PMU_CORE_ID, 0);
+       } else {
+               pmu = si_setcoreidx(sih, SI_CC_IDX);
+       }
+       ASSERT(pmu != NULL);
+
+       core_cap_ext = R_REG(osh, &pmu->core_cap_ext);
+       max_stats_timer_num = ((core_cap_ext & PCAP_EXT_ST_NUM_MASK) >> PCAP_EXT_ST_NUM_SHIFT) + 1;
+
+       for (i = 0; i < max_stats_timer_num; i++) {
+               W_REG(osh, &pmu->pmu_statstimer_addr, i);
+               timerN = R_REG(osh, &pmu->pmu_statstimer_N);
+               if (timerN == 0xFFFFFFFF) {
+                       PMU_ERROR(("pmustatstimer overflow clear - timerid : %d\n", i));
+                       si_pmustatstimer_clear(sih, i);
+               }
+       }
+
+       /* Return to original core */
+       si_setcoreidx(sih, origidx);
+}
+
+uint32
+si_pmustatstimer_read(si_t *sih, uint8 timerid)
+{
+       pmuregs_t *pmu;
+       uint origidx;
+       osl_t *osh = si_osh(sih);
+       uint32 stats_timer_N;
+
+       /* Remember original core before switch to chipc/pmu */
+       origidx = si_coreidx(sih);
+       if (AOB_ENAB(sih)) {
+               pmu = si_setcore(sih, PMU_CORE_ID, 0);
+       } else {
+               pmu = si_setcoreidx(sih, SI_CC_IDX);
+       }
+       ASSERT(pmu != NULL);
+
+       W_REG(osh, &pmu->pmu_statstimer_addr, timerid);
+       stats_timer_N = R_REG(osh, &pmu->pmu_statstimer_N);
+
+       /* Return to original core */
+       si_setcoreidx(sih, origidx);
+
+       return stats_timer_N;
+}
+
+void
+si_pmustatstimer_cfg_src_num(si_t *sih, uint8 src_num, uint8 timerid)
+{
+       pmuregs_t *pmu;
+       uint origidx;
+       osl_t *osh = si_osh(sih);
+
+       /* Remember original core before switch to chipc/pmu */
+       origidx = si_coreidx(sih);
+       if (AOB_ENAB(sih)) {
+               pmu = si_setcore(sih, PMU_CORE_ID, 0);
+       } else {
+               pmu = si_setcoreidx(sih, SI_CC_IDX);
+       }
+       ASSERT(pmu != NULL);
+
+       pmustatstimer[timerid].src_num = src_num;
+       si_pmustatstimer_update(osh, pmu, timerid);
+
+       /* Return to original core */
+       si_setcoreidx(sih, origidx);
+}
+
+void
+si_pmustatstimer_cfg_cnt_mode(si_t *sih, uint8 cnt_mode, uint8 timerid)
+{
+       pmuregs_t *pmu;
+       uint origidx;
+       osl_t *osh = si_osh(sih);
+
+       /* Remember original core before switch to chipc/pmu */
+       origidx = si_coreidx(sih);
+       if (AOB_ENAB(sih)) {
+               pmu = si_setcore(sih, PMU_CORE_ID, 0);
+       } else {
+               pmu = si_setcoreidx(sih, SI_CC_IDX);
+       }
+       ASSERT(pmu != NULL);
+
+       pmustatstimer[timerid].cnt_mode = cnt_mode;
+       si_pmustatstimer_update(osh, pmu, timerid);
+
+       /* Return to original core */
+       si_setcoreidx(sih, origidx);
+}
+#endif /* BCMPMU_STATS */
+
+/* query the # of mac resource request timers */
+uint
+si_pmu_get_mac_rsrc_req_tmr_cnt(si_t *sih)
+{
+       if (PMUREV(sih->pmurev) >= 26) {
+               uint32 core_cap_ext = PMU_REG(sih, core_cap_ext, 0, 0);
+               uint mac_rsrc_cnt =
+                       ((core_cap_ext & PCAP_EXT_MAC_RSRC_REQ_TMR_CNT_MASK) >>
+                        PCAP_EXT_MAC_RSRC_REQ_TMR_CNT_SHIFT) + 1;
+               return mac_rsrc_cnt;
+       }
+
+       return si_numd11coreunits(sih);
+}
+
+/* query the # of pmu interrupt recevier */
+uint
+si_pmu_get_pmu_interrupt_rcv_cnt(si_t *sih)
+{
+       if (PMUREV(sih->pmurev) >= 26) {
+               uint32 core_cap_ext = PMU_REG(sih, core_cap_ext, 0, 0);
+               uint pmu_intr_rcvr_cnt =
+                       ((core_cap_ext & PCAP_EXT_PMU_INTR_RCVR_CNT_MASK) >>
+                        PCAP_EXT_PMU_INTR_RCVR_CNT_SHIFT) + 1;
+               return pmu_intr_rcvr_cnt;
+       }
+
+       return si_numd11coreunits(sih);
+}
+
+int
+si_pmu_res_state_pwrsw_main_wait(si_t *sih)
+{
+       int ret = BCME_OK;
+
+       switch (CHIPID(sih->chip)) {
+       case BCM4387_CHIP_GRPID:
+               if (PMU_REG(sih, res_state, 0, 0) & PMURES_BIT(RES4387_PWRSW_MAIN)) {
+                       SPINWAIT((PMU_REG(sih, res_state, 0, 0) &
+                               PMURES_BIT(RES4387_PWRSW_MAIN)), 10000);
+                       OSL_DELAY(1000);
+               }
+               ret = (PMU_REG(sih, res_state, 0, 0) & PMURES_BIT(RES4387_PWRSW_MAIN)) ?
+                       BCME_ERROR : BCME_OK;
+               break;
+       default:
+               PMU_ERROR(("si_pmu_res_state_pwrsw_main_wait: add support for this chip!\n"));
+               OSL_SYS_HALT();
+               break;
+       }
+
+       return ret;
+}
+
+#if defined(BT_WLAN_REG_ON_WAR)
+void
+si_pmu_reg_on_war_ext_wake_perst_set(si_t *sih)
+{
+       uint origidx = si_coreidx(sih);
+       pmuregs_t *pmu = si_setcore(sih, PMU_CORE_ID, 0);
+       osl_t *osh = si_osh(sih);
+
+       if (PMUREV(sih->pmurev) == 40) {
+               /*
+                * set PCIEPerstReq (bit-5) as a wake-up source in
+                * ExtWakeMask0 (0x760) register
+                */
+               W_REG(osh, &pmu->extwakemask0, PMU_EXT_WAKE_MASK_0_PCIE_PERST);
+
+               /*
+                * configure the wakemask as "common backplane" resources to
+                * be up during wake-up in ExtWakeReqMask0 (0x770) register
+                */
+               W_REG(osh, &pmu->extwakereqmask[0], REG_ON_WAR_PMU_EXT_WAKE_REQ_MASK0_VAL);
+       }
+
+       si_setcoreidx(sih, origidx);
+}
+
+void
+si_pmu_reg_on_war_ext_wake_perst_clear(si_t *sih)
+{
+       uint32 val = 0;
+       uint origidx = si_coreidx(sih);
+       pmuregs_t *pmu = si_setcore(sih, PMU_CORE_ID, 0);
+       osl_t *osh = si_osh(sih);
+
+       if (PMUREV(sih->pmurev) == 40) {
+               /* clear all set bits in ExtWakeupStatus (0x744) register */
+               val = R_REG(osh, &pmu->extwakeupstatus);
+               W_REG(osh, &pmu->extwakeupstatus, val);
+       }
+
+       si_setcoreidx(sih, origidx);
+}
+#endif /* BT_WLAN_REG_ON_WAR */
diff --git a/bcmdhd.101.10.240.x/include/802.11.h b/bcmdhd.101.10.240.x/include/802.11.h
new file mode 100644 (file)
index 0000000..ece3e8e
--- /dev/null
@@ -0,0 +1,5526 @@
+/*
+ * Fundamental types and constants relating to 802.11
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _802_11_H_
+#define _802_11_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+#ifndef _NET_ETHERNET_H_
+#include <ethernet.h>
+#endif
+
+/* Include WPA definitions here for compatibility */
+#include <wpa.h>
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#define DOT11_TU_TO_US                 1024    /* 802.11 Time Unit is 1024 microseconds */
+#define DOT11_SEC_TO_TU                        977u    /* 1000000 / DOT11_TU_TO_US = ~977 TU */
+
+/* Generic 802.11 frame constants */
+#define DOT11_A3_HDR_LEN               24      /* d11 header length with A3 */
+#define DOT11_A4_HDR_LEN               30      /* d11 header length with A4 */
+#define DOT11_MAC_HDR_LEN              DOT11_A3_HDR_LEN        /* MAC header length */
+#define DOT11_FCS_LEN                  4u      /* d11 FCS length */
+#define DOT11_ICV_LEN                  4       /* d11 ICV length */
+#define DOT11_ICV_AES_LEN              8       /* d11 ICV/AES length */
+#define DOT11_MAX_ICV_AES_LEN          16      /* d11 MAX ICV/AES length */
+#define DOT11_QOS_LEN                  2       /* d11 QoS length */
+#define DOT11_HTC_LEN                  4       /* d11 HT Control field length */
+
+#define DOT11_KEY_INDEX_SHIFT          6       /* d11 key index shift */
+#define DOT11_IV_LEN                   4       /* d11 IV length */
+#define DOT11_IV_TKIP_LEN              8       /* d11 IV TKIP length */
+#define DOT11_IV_AES_OCB_LEN           4       /* d11 IV/AES/OCB length */
+#define DOT11_IV_AES_CCM_LEN           8       /* d11 IV/AES/CCM length */
+#define DOT11_IV_WAPI_LEN              18      /* d11 IV WAPI length */
+/* TODO: Need to change DOT11_IV_MAX_LEN to 18, but currently unable to change as the old
+ * branches are still referencing to this component.
+ */
+#define DOT11_IV_MAX_LEN               8       /* maximum iv len for any encryption */
+
+/* Includes MIC */
+#define DOT11_MAX_MPDU_BODY_LEN                2304    /* max MPDU body length */
+/* A4 header + QoS + CCMP + PDU + ICV + FCS = 2352 */
+#define DOT11_MAX_MPDU_LEN             (DOT11_A4_HDR_LEN + \
+                                        DOT11_QOS_LEN + \
+                                        DOT11_IV_AES_CCM_LEN + \
+                                        DOT11_MAX_MPDU_BODY_LEN + \
+                                        DOT11_ICV_LEN + \
+                                        DOT11_FCS_LEN) /* d11 max MPDU length */
+
+#define DOT11_MAX_SSID_LEN             32      /* d11 max ssid length */
+
+/* dot11RTSThreshold */
+#define DOT11_DEFAULT_RTS_LEN          2347    /* d11 default RTS length */
+#define DOT11_MAX_RTS_LEN              2347    /* d11 max RTS length */
+
+/* dot11FragmentationThreshold */
+#define DOT11_MIN_FRAG_LEN             256     /* d11 min fragmentation length */
+#define DOT11_MAX_FRAG_LEN             2346    /* Max frag is also limited by aMPDUMaxLength
+                                               * of the attached PHY
+                                               */
+#define DOT11_DEFAULT_FRAG_LEN         2346    /* d11 default fragmentation length */
+
+/* dot11BeaconPeriod */
+#define DOT11_MIN_BEACON_PERIOD                1       /* d11 min beacon period */
+#define DOT11_MAX_BEACON_PERIOD                0xFFFF  /* d11 max beacon period */
+
+/* dot11DTIMPeriod */
+#define DOT11_MIN_DTIM_PERIOD          1       /* d11 min DTIM period */
+#define DOT11_MAX_DTIM_PERIOD          0xFF    /* d11 max DTIM period */
+
+/** 802.2 LLC/SNAP header used by 802.11 per 802.1H */
+#define DOT11_LLC_SNAP_HDR_LEN         8       /* d11 LLC/SNAP header length */
+/* minimum LLC header length; DSAP, SSAP, 8 bit Control (unnumbered) */
+#define DOT11_LLC_HDR_LEN_MIN          3
+#define DOT11_OUI_LEN                  3       /* d11 OUI length */
+BWL_PRE_PACKED_STRUCT struct dot11_llc_snap_header {
+       uint8   dsap;                           /* always 0xAA */
+       uint8   ssap;                           /* always 0xAA */
+       uint8   ctl;                            /* always 0x03 */
+       uint8   oui[DOT11_OUI_LEN];             /* RFC1042: 0x00 0x00 0x00
+                                                * Bridge-Tunnel: 0x00 0x00 0xF8
+                                                */
+       uint16  type;                           /* ethertype */
+} BWL_POST_PACKED_STRUCT;
+
+/* RFC1042 header used by 802.11 per 802.1H */
+#define RFC1042_HDR_LEN        (ETHER_HDR_LEN + DOT11_LLC_SNAP_HDR_LEN)        /* RCF1042 header length */
+
+/* Generic 802.11 MAC header */
+/**
+ * N.B.: This struct reflects the full 4 address 802.11 MAC header.
+ *              The fields are defined such that the shorter 1, 2, and 3
+ *              address headers just use the first k fields.
+ */
+BWL_PRE_PACKED_STRUCT struct dot11_header {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* duration/ID */
+       struct ether_addr       a1;             /* address 1 */
+       struct ether_addr       a2;             /* address 2 */
+       struct ether_addr       a3;             /* address 3 */
+       uint16                  seq;            /* sequence control */
+       struct ether_addr       a4;             /* address 4 */
+} BWL_POST_PACKED_STRUCT;
+
+/* Control frames */
+
+BWL_PRE_PACKED_STRUCT struct dot11_rts_frame {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* duration/ID */
+       struct ether_addr       ra;             /* receiver address */
+       struct ether_addr       ta;             /* transmitter address */
+} BWL_POST_PACKED_STRUCT;
+#define        DOT11_RTS_LEN           16              /* d11 RTS frame length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_cts_frame {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* duration/ID */
+       struct ether_addr       ra;             /* receiver address */
+} BWL_POST_PACKED_STRUCT;
+#define        DOT11_CTS_LEN           10u             /* d11 CTS frame length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_ack_frame {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* duration/ID */
+       struct ether_addr       ra;             /* receiver address */
+} BWL_POST_PACKED_STRUCT;
+#define        DOT11_ACK_LEN           10              /* d11 ACK frame length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_ps_poll_frame {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* AID */
+       struct ether_addr       bssid;          /* receiver address, STA in AP */
+       struct ether_addr       ta;             /* transmitter address */
+} BWL_POST_PACKED_STRUCT;
+#define        DOT11_PS_POLL_LEN       16              /* d11 PS poll frame length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_cf_end_frame {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* duration/ID */
+       struct ether_addr       ra;             /* receiver address */
+       struct ether_addr       bssid;          /* transmitter address, STA in AP */
+} BWL_POST_PACKED_STRUCT;
+#define        DOT11_CS_END_LEN        16              /* d11 CF-END frame length */
+
+/**
+ * RWL wifi protocol: The Vendor Specific Action frame is defined for vendor-specific signaling
+ *  category+OUI+vendor specific content ( this can be variable)
+ */
+BWL_PRE_PACKED_STRUCT struct dot11_action_wifi_vendor_specific {
+       uint8   category;
+       uint8   OUI[3];
+       uint8   type;
+       uint8   subtype;
+       uint8   data[1040];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_action_wifi_vendor_specific dot11_action_wifi_vendor_specific_t;
+
+/** generic vendor specific action frame with variable length */
+BWL_PRE_PACKED_STRUCT struct dot11_action_vs_frmhdr {
+       uint8   category;
+       uint8   OUI[3];
+       uint8   type;
+       uint8   subtype;
+       uint8   data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_action_vs_frmhdr dot11_action_vs_frmhdr_t;
+
+#define DOT11_ACTION_VS_HDR_LEN        6
+
+#define BCM_ACTION_OUI_BYTE0   0x00
+#define BCM_ACTION_OUI_BYTE1   0x90
+#define BCM_ACTION_OUI_BYTE2   0x4c
+
+/* BA/BAR Control parameters */
+#define DOT11_BA_CTL_POLICY_NORMAL     0x0000  /* normal ack */
+#define DOT11_BA_CTL_POLICY_NOACK      0x0001  /* no ack */
+#define DOT11_BA_CTL_POLICY_MASK       0x0001  /* ack policy mask */
+
+#define DOT11_BA_CTL_MTID              0x0002  /* multi tid BA */
+#define DOT11_BA_CTL_COMPRESSED                0x0004  /* compressed bitmap */
+
+#define DOT11_BA_CTL_NUMMSDU_MASK      0x0FC0  /* num msdu in bitmap mask */
+#define DOT11_BA_CTL_NUMMSDU_SHIFT     6       /* num msdu in bitmap shift */
+
+#define DOT11_BA_CTL_TID_MASK          0xF000  /* tid mask */
+#define DOT11_BA_CTL_TID_SHIFT         12      /* tid shift */
+
+/** control frame header (BA/BAR) */
+BWL_PRE_PACKED_STRUCT struct dot11_ctl_header {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* duration/ID */
+       struct ether_addr       ra;             /* receiver address */
+       struct ether_addr       ta;             /* transmitter address */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_CTL_HDR_LEN      16              /* control frame hdr len */
+
+/** BAR frame payload */
+BWL_PRE_PACKED_STRUCT struct dot11_bar {
+       uint16                  bar_control;    /* BAR Control */
+       uint16                  seqnum;         /* Starting Sequence control */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_BAR_LEN          4               /* BAR frame payload length */
+
+#define DOT11_BA_BITMAP_LEN    128             /* bitmap length */
+#define DOT11_BA_CMP_BITMAP_LEN        8               /* compressed bitmap length */
+/** BA frame payload */
+BWL_PRE_PACKED_STRUCT struct dot11_ba {
+       uint16                  ba_control;     /* BA Control */
+       uint16                  seqnum;         /* Starting Sequence control */
+       uint8                   bitmap[DOT11_BA_BITMAP_LEN];    /* Block Ack Bitmap */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_BA_LEN           4               /* BA frame payload len (wo bitmap) */
+
+/** Management frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_management_header {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* duration/ID */
+       struct ether_addr       da;             /* receiver address */
+       struct ether_addr       sa;             /* transmitter address */
+       struct ether_addr       bssid;          /* BSS ID */
+       uint16                  seq;            /* sequence control */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_management_header dot11_management_header_t;
+#define        DOT11_MGMT_HDR_LEN      24u             /* d11 management header length */
+
+/* Management frame payloads */
+
+BWL_PRE_PACKED_STRUCT struct dot11_bcn_prb {
+       uint32                  timestamp[2];
+       uint16                  beacon_interval;
+       uint16                  capability;
+} BWL_POST_PACKED_STRUCT;
+#define        DOT11_BCN_PRB_LEN       12              /* 802.11 beacon/probe frame fixed length */
+#define        DOT11_BCN_PRB_FIXED_LEN 12u             /* 802.11 beacon/probe frame fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_auth {
+       uint16                  alg;            /* algorithm */
+       uint16                  seq;            /* sequence control */
+       uint16                  status;         /* status code */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_AUTH_FIXED_LEN           6       /* length of auth frame without challenge IE */
+#define DOT11_AUTH_SEQ_STATUS_LEN      4       /* length of auth frame without challenge IE and
+                                                * without algorithm
+                                                */
+
+BWL_PRE_PACKED_STRUCT struct dot11_assoc_req {
+       uint16                  capability;     /* capability information */
+       uint16                  listen;         /* listen interval */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_ASSOC_REQ_FIXED_LEN      4       /* length of assoc frame without info elts */
+
+BWL_PRE_PACKED_STRUCT struct dot11_reassoc_req {
+       uint16                  capability;     /* capability information */
+       uint16                  listen;         /* listen interval */
+       struct ether_addr       ap;             /* Current AP address */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_REASSOC_REQ_FIXED_LEN    10      /* length of assoc frame without info elts */
+
+BWL_PRE_PACKED_STRUCT struct dot11_assoc_resp {
+       uint16                  capability;     /* capability information */
+       uint16                  status;         /* status code */
+       uint16                  aid;            /* association ID */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_ASSOC_RESP_FIXED_LEN     6       /* length of assoc resp frame without info elts */
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_measure {
+       uint8   category;
+       uint8   action;
+       uint8   token;
+       uint8   data[1];
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_ACTION_MEASURE_LEN       3       /* d11 action measurement header length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_ht_ch_width {
+       uint8   category;
+       uint8   action;
+       uint8   ch_width;
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_ht_mimops {
+       uint8   category;
+       uint8   action;
+       uint8   control;
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_sa_query {
+       uint8   category;
+       uint8   action;
+       uint16  id;
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_vht_oper_mode {
+       uint8   category;
+       uint8   action;
+       uint8   mode;
+} BWL_POST_PACKED_STRUCT;
+
+/* These lengths assume 64 MU groups, as specified in 802.11ac-2013 */
+#define DOT11_ACTION_GID_MEMBERSHIP_LEN  8    /* bytes */
+#define DOT11_ACTION_GID_USER_POS_LEN   16    /* bytes */
+BWL_PRE_PACKED_STRUCT struct dot11_action_group_id {
+       uint8   category;
+       uint8   action;
+       uint8   membership_status[DOT11_ACTION_GID_MEMBERSHIP_LEN];
+       uint8   user_position[DOT11_ACTION_GID_USER_POS_LEN];
+} BWL_POST_PACKED_STRUCT;
+
+#define SM_PWRSAVE_ENABLE      1
+#define SM_PWRSAVE_MODE                2
+
+/* ************* 802.11h related definitions. ************* */
+BWL_PRE_PACKED_STRUCT struct dot11_power_cnst {
+       uint8 id;
+       uint8 len;
+       uint8 power;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_power_cnst dot11_power_cnst_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_power_cap {
+       int8 min;
+       int8 max;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_power_cap dot11_power_cap_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_tpc_rep {
+       uint8 id;
+       uint8 len;
+       uint8 tx_pwr;
+       uint8 margin;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tpc_rep dot11_tpc_rep_t;
+#define DOT11_MNG_IE_TPC_REPORT_SIZE   (sizeof(dot11_tpc_rep_t))
+#define DOT11_MNG_IE_TPC_REPORT_LEN    2       /* length of IE data, not including 2 byte header */
+
+BWL_PRE_PACKED_STRUCT struct dot11_supp_channels {
+       uint8 id;
+       uint8 len;
+       uint8 first_channel;
+       uint8 num_channels;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_supp_channels dot11_supp_channels_t;
+
+/**
+ * Extension Channel Offset IE: 802.11n-D1.0 spec. added sideband
+ * offset for 40MHz operation.  The possible 3 values are:
+ * 1 = above control channel
+ * 3 = below control channel
+ * 0 = no extension channel
+ */
+BWL_PRE_PACKED_STRUCT struct dot11_extch {
+       uint8   id;             /* IE ID, 62, DOT11_MNG_EXT_CHANNEL_OFFSET */
+       uint8   len;            /* IE length */
+       uint8   extch;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_extch dot11_extch_ie_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_brcm_extch {
+       uint8   id;             /* IE ID, 221, DOT11_MNG_PROPR_ID */
+       uint8   len;            /* IE length */
+       uint8   oui[3];         /* Proprietary OUI, BRCM_PROP_OUI */
+       uint8   type;           /* type indicates what follows */
+       uint8   extch;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_brcm_extch dot11_brcm_extch_ie_t;
+
+#define BRCM_EXTCH_IE_LEN      5
+#define BRCM_EXTCH_IE_TYPE     53      /* 802.11n ID not yet assigned */
+#define DOT11_EXTCH_IE_LEN     1
+#define DOT11_EXT_CH_MASK      0x03    /* extension channel mask */
+#define DOT11_EXT_CH_UPPER     0x01    /* ext. ch. on upper sb */
+#define DOT11_EXT_CH_LOWER     0x03    /* ext. ch. on lower sb */
+#define DOT11_EXT_CH_NONE      0x00    /* no extension ch.  */
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_frmhdr {
+       uint8   category;
+       uint8   action;
+       uint8   data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_action_frmhdr dot11_action_frmhdr_t;
+
+/* Action Field length */
+#define DOT11_ACTION_CATEGORY_LEN      1u
+#define DOT11_ACTION_ACTION_LEN                1u
+#define DOT11_ACTION_DIALOG_TOKEN_LEN  1u
+#define DOT11_ACTION_CAPABILITY_LEN    2u
+#define DOT11_ACTION_STATUS_CODE_LEN   2u
+#define DOT11_ACTION_REASON_CODE_LEN   2u
+#define DOT11_ACTION_TARGET_CH_LEN     1u
+#define DOT11_ACTION_OPER_CLASS_LEN    1u
+
+#define DOT11_ACTION_FRMHDR_LEN        2
+
+/** CSA IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_channel_switch {
+       uint8 id;       /* id DOT11_MNG_CHANNEL_SWITCH_ID */
+       uint8 len;      /* length of IE */
+       uint8 mode;     /* mode 0 or 1 */
+       uint8 channel;  /* channel switch to */
+       uint8 count;    /* number of beacons before switching */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_channel_switch dot11_chan_switch_ie_t;
+
+#define DOT11_SWITCH_IE_LEN    3       /* length of IE data, not including 2 byte header */
+/* CSA mode - 802.11h-2003 $7.3.2.20 */
+#define DOT11_CSA_MODE_ADVISORY                0       /* no DOT11_CSA_MODE_NO_TX restriction imposed */
+#define DOT11_CSA_MODE_NO_TX           1       /* no transmission upon receiving CSA frame. */
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_switch_channel {
+       uint8   category;
+       uint8   action;
+       dot11_chan_switch_ie_t chan_switch_ie;  /* for switch IE */
+       dot11_brcm_extch_ie_t extch_ie;         /* extension channel offset */
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11_csa_body {
+       uint8 mode;     /* mode 0 or 1 */
+       uint8 reg;      /* regulatory class */
+       uint8 channel;  /* channel switch to */
+       uint8 count;    /* number of beacons before switching */
+} BWL_POST_PACKED_STRUCT;
+
+/** 11n Extended Channel Switch IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_ext_csa {
+       uint8 id;       /* id DOT11_MNG_EXT_CSA_ID */
+       uint8 len;      /* length of IE */
+       struct dot11_csa_body b;        /* body of the ie */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ext_csa dot11_ext_csa_ie_t;
+#define DOT11_EXT_CSA_IE_LEN   4       /* length of extended channel switch IE body */
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_ext_csa {
+       uint8   category;
+       uint8   action;
+       dot11_ext_csa_ie_t chan_switch_ie;      /* for switch IE */
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11y_action_ext_csa {
+       uint8   category;
+       uint8   action;
+       struct dot11_csa_body b;        /* body of the ie */
+} BWL_POST_PACKED_STRUCT;
+
+/**  Wide Bandwidth Channel Switch IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_wide_bw_channel_switch {
+       uint8 id;                               /* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
+       uint8 len;                              /* length of IE */
+       uint8 channel_width;                    /* new channel width */
+       uint8 center_frequency_segment_0;       /* center frequency segment 0 */
+       uint8 center_frequency_segment_1;       /* center frequency segment 1 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wide_bw_channel_switch dot11_wide_bw_chan_switch_ie_t;
+
+#define DOT11_WIDE_BW_SWITCH_IE_LEN     3       /* length of IE data, not including 2 byte header */
+
+/** Channel Switch Wrapper IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_channel_switch_wrapper {
+       uint8 id;                               /* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
+       uint8 len;                              /* length of IE */
+       dot11_wide_bw_chan_switch_ie_t wb_chan_switch_ie;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_channel_switch_wrapper dot11_chan_switch_wrapper_ie_t;
+
+/* Proposed wide bandwidth channel IE */
+typedef enum wide_bw_chan_width {
+       WIDE_BW_CHAN_WIDTH_20   = 0,
+       WIDE_BW_CHAN_WIDTH_40   = 1,
+       WIDE_BW_CHAN_WIDTH_80   = 2,
+       WIDE_BW_CHAN_WIDTH_160  = 3,
+       WIDE_BW_CHAN_WIDTH_80_80        = 4
+} wide_bw_chan_width_t;
+
+/**  Wide Bandwidth Channel IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_wide_bw_channel {
+       uint8 id;                               /* id DOT11_MNG_WIDE_BW_CHANNEL_ID */
+       uint8 len;                              /* length of IE */
+       uint8 channel_width;                    /* channel width */
+       uint8 center_frequency_segment_0;       /* center frequency segment 0 */
+       uint8 center_frequency_segment_1;       /* center frequency segment 1 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wide_bw_channel dot11_wide_bw_chan_ie_t;
+
+#define DOT11_WIDE_BW_IE_LEN     3       /* length of IE data, not including 2 byte header */
+/** VHT Transmit Power Envelope IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_vht_transmit_power_envelope {
+       uint8 id;                               /* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
+       uint8 len;                              /* length of IE */
+       uint8 transmit_power_info;
+       uint8 local_max_transmit_power_20;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_vht_transmit_power_envelope dot11_vht_transmit_power_envelope_ie_t;
+
+/* vht transmit power envelope IE length depends on channel width */
+#define DOT11_VHT_TRANSMIT_PWR_ENVELOPE_IE_LEN_40MHZ   1
+#define DOT11_VHT_TRANSMIT_PWR_ENVELOPE_IE_LEN_80MHZ   2
+#define DOT11_VHT_TRANSMIT_PWR_ENVELOPE_IE_LEN_160MHZ  3
+
+BWL_PRE_PACKED_STRUCT struct dot11_obss_coex {
+       uint8   id;
+       uint8   len;
+       uint8   info;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_obss_coex dot11_obss_coex_t;
+#define DOT11_OBSS_COEXINFO_LEN        1       /* length of OBSS Coexistence INFO IE */
+
+#define        DOT11_OBSS_COEX_INFO_REQ                0x01
+#define        DOT11_OBSS_COEX_40MHZ_INTOLERANT        0x02
+#define        DOT11_OBSS_COEX_20MHZ_WIDTH_REQ 0x04
+
+BWL_PRE_PACKED_STRUCT struct dot11_obss_chanlist {
+       uint8   id;
+       uint8   len;
+       uint8   regclass;
+       uint8   chanlist[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_obss_chanlist dot11_obss_chanlist_t;
+#define DOT11_OBSS_CHANLIST_FIXED_LEN  1       /* fixed length of regclass */
+
+BWL_PRE_PACKED_STRUCT struct dot11_extcap_ie {
+       uint8 id;
+       uint8 len;
+       uint8 cap[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_extcap_ie dot11_extcap_ie_t;
+
+#define DOT11_EXTCAP_LEN_COEX  1
+#define DOT11_EXTCAP_LEN_BT    3
+#define DOT11_EXTCAP_LEN_IW    4
+#define DOT11_EXTCAP_LEN_SI    6
+
+#define DOT11_EXTCAP_LEN_TDLS  5
+#define DOT11_11AC_EXTCAP_LEN_TDLS     8
+
+#define DOT11_EXTCAP_LEN_FMS                   2
+#define DOT11_EXTCAP_LEN_PROXY_ARP             2
+#define DOT11_EXTCAP_LEN_TFS                   3
+#define DOT11_EXTCAP_LEN_WNM_SLEEP             3
+#define DOT11_EXTCAP_LEN_TIMBC                 3
+#define DOT11_EXTCAP_LEN_BSSTRANS              3
+#define DOT11_EXTCAP_LEN_DMS                   4
+#define DOT11_EXTCAP_LEN_WNM_NOTIFICATION      6
+#define DOT11_EXTCAP_LEN_TDLS_WBW              8
+#define DOT11_EXTCAP_LEN_OPMODE_NOTIFICATION   8
+#define DOT11_EXTCAP_LEN_TWT                   10u
+
+/* TDLS Capabilities */
+#define DOT11_TDLS_CAP_TDLS                    37      /* TDLS support */
+#define DOT11_TDLS_CAP_PU_BUFFER_STA           28      /* TDLS Peer U-APSD buffer STA support */
+#define DOT11_TDLS_CAP_PEER_PSM                        20      /* TDLS Peer PSM support */
+#define DOT11_TDLS_CAP_CH_SW                   30      /* TDLS Channel switch */
+#define DOT11_TDLS_CAP_PROH                    38      /* TDLS prohibited */
+#define DOT11_TDLS_CAP_CH_SW_PROH              39      /* TDLS Channel switch prohibited */
+#define DOT11_TDLS_CAP_TDLS_WIDER_BW           61      /* TDLS Wider Band-Width */
+
+#define TDLS_CAP_MAX_BIT                       39      /* TDLS max bit defined in ext cap */
+
+/* FIXME: remove redundant DOT11_CAP_SAE_HASH_TO_ELEMENT */
+#define DOT11_CAP_SAE_HASH_TO_ELEMENT          5u      /* SAE Hash-to-element support */
+#define DOT11_EXT_RSN_CAP_SAE_H2E              5u      /* SAE Hash-to-element support */
+/* FIXME: Use these temporary IDs until ANA assigns IDs */
+#define DOT11_EXT_RSN_CAP_SAE_PK               6u      /* SAE-PK support */
+/* Last bit in extended rsn capabilities (RSNXE) */
+#define DOT11_EXT_RSN_CAP_MAX_BIT              DOT11_EXT_RSN_CAP_SAE_PK
+
+BWL_PRE_PACKED_STRUCT struct dot11_rsnxe {
+       uint8 id;       /* id DOT11_MNG_RSNXE_ID */
+       uint8 len;
+       uint8 cap[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rsnxe dot11_rsnxe_t;
+
+#define RSNXE_CAP_LENGTH_MASK          (0x0f)
+#define RSNXE_CAP_LENGTH(cap)          ((uint8)(cap) & RSNXE_CAP_LENGTH_MASK)
+#define RSNXE_SET_CAP_LENGTH(cap, len)\
+               (cap = (cap & ~RSNXE_CAP_LENGTH_MASK) | ((uint8)(len) & RSNXE_CAP_LENGTH_MASK))
+
+BWL_PRE_PACKED_STRUCT struct dot11_rejected_groups_ie {
+       uint8 id;       /* DOT11_MNG_EXT_ID */
+       uint8 len;
+       uint8 id_ext; /* DOT11_MNG_REJECTED_GROUPS_ID */
+       uint16 groups[];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rejected_groups_ie dot11_rejected_groups_ie_t;
+
+/* 802.11h/802.11k Measurement Request/Report IEs */
+/* Measurement Type field */
+#define DOT11_MEASURE_TYPE_BASIC       0   /* d11 measurement basic type */
+#define DOT11_MEASURE_TYPE_CCA         1   /* d11 measurement CCA type */
+#define DOT11_MEASURE_TYPE_RPI         2   /* d11 measurement RPI type */
+#define DOT11_MEASURE_TYPE_CHLOAD      3   /* d11 measurement Channel Load type */
+#define DOT11_MEASURE_TYPE_NOISE       4   /* d11 measurement Noise Histogram type */
+#define DOT11_MEASURE_TYPE_BEACON      5   /* d11 measurement Beacon type */
+#define DOT11_MEASURE_TYPE_FRAME       6   /* d11 measurement Frame type */
+#define DOT11_MEASURE_TYPE_STAT                7   /* d11 measurement STA Statistics type */
+#define DOT11_MEASURE_TYPE_LCI         8   /* d11 measurement LCI type */
+#define DOT11_MEASURE_TYPE_TXSTREAM    9   /* d11 measurement TX Stream type */
+#define DOT11_MEASURE_TYPE_MCDIAGS     10  /* d11 measurement multicast diagnostics */
+#define DOT11_MEASURE_TYPE_CIVICLOC    11  /* d11 measurement location civic */
+#define DOT11_MEASURE_TYPE_LOC_ID      12  /* d11 measurement location identifier */
+#define DOT11_MEASURE_TYPE_DIRCHANQ    13  /* d11 measurement dir channel quality */
+#define DOT11_MEASURE_TYPE_DIRMEAS     14  /* d11 measurement directional */
+#define DOT11_MEASURE_TYPE_DIRSTATS    15  /* d11 measurement directional stats */
+#define DOT11_MEASURE_TYPE_FTMRANGE    16  /* d11 measurement Fine Timing */
+#define DOT11_MEASURE_TYPE_PAUSE       255     /* d11 measurement pause type */
+
+/* Measurement Request Modes */
+#define DOT11_MEASURE_MODE_PARALLEL    (1<<0)  /* d11 measurement parallel */
+#define DOT11_MEASURE_MODE_ENABLE      (1<<1)  /* d11 measurement enable */
+#define DOT11_MEASURE_MODE_REQUEST     (1<<2)  /* d11 measurement request */
+#define DOT11_MEASURE_MODE_REPORT      (1<<3)  /* d11 measurement report */
+#define DOT11_MEASURE_MODE_DUR         (1<<4)  /* d11 measurement dur mandatory */
+/* Measurement Report Modes */
+#define DOT11_MEASURE_MODE_LATE                (1<<0)  /* d11 measurement late */
+#define DOT11_MEASURE_MODE_INCAPABLE   (1<<1)  /* d11 measurement incapable */
+#define DOT11_MEASURE_MODE_REFUSED     (1<<2)  /* d11 measurement refuse */
+/* Basic Measurement Map bits */
+#define DOT11_MEASURE_BASIC_MAP_BSS    ((uint8)(1<<0)) /* d11 measurement basic map BSS */
+#define DOT11_MEASURE_BASIC_MAP_OFDM   ((uint8)(1<<1)) /* d11 measurement map OFDM */
+#define DOT11_MEASURE_BASIC_MAP_UKNOWN ((uint8)(1<<2)) /* d11 measurement map unknown */
+#define DOT11_MEASURE_BASIC_MAP_RADAR  ((uint8)(1<<3)) /* d11 measurement map radar */
+#define DOT11_MEASURE_BASIC_MAP_UNMEAS ((uint8)(1<<4)) /* d11 measurement map unmeasuremnt */
+
+BWL_PRE_PACKED_STRUCT struct dot11_meas_req {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 channel;
+       uint8 start_time[8];
+       uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_meas_req dot11_meas_req_t;
+#define DOT11_MNG_IE_MREQ_LEN 14       /* d11 measurement request IE length */
+/* length of Measure Request IE data not including variable len */
+#define DOT11_MNG_IE_MREQ_FIXED_LEN 3  /* d11 measurement request IE fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_meas_req_loc {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       BWL_PRE_PACKED_STRUCT union
+       {
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 subject;
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT lci;
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 subject;
+                       uint8 type;  /* type of civic location */
+                       uint8 siu;   /* service interval units */
+                       uint16 si; /* service interval */
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT civic;
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 subject;
+                       uint8 siu;   /* service interval units */
+                       uint16 si; /* service interval */
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT locid;
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint16 max_init_delay;          /* maximum random initial delay */
+                       uint8 min_ap_count;
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT ftm_range;
+       } BWL_POST_PACKED_STRUCT req;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_meas_req_loc dot11_meas_req_loc_t;
+#define DOT11_MNG_IE_MREQ_MIN_LEN           4  /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREQ_LCI_FIXED_LEN     4  /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREQ_CIVIC_FIXED_LEN   8  /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREQ_FRNG_FIXED_LEN    6  /* d11 measurement report IE length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_lci_subelement {
+       uint8 subelement;
+       uint8 length;
+       uint8 lci_data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_lci_subelement dot11_lci_subelement_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_colocated_bssid_list_se {
+       uint8 sub_id;
+       uint8 length;
+       uint8 max_bssid_ind; /* MaxBSSID Indicator */
+       struct ether_addr bssid[1]; /* variable */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_colocated_bssid_list_se dot11_colocated_bssid_list_se_t;
+#define DOT11_LCI_COLOCATED_BSSID_LIST_FIXED_LEN     3
+#define DOT11_LCI_COLOCATED_BSSID_SUBELEM_ID         7
+
+BWL_PRE_PACKED_STRUCT struct dot11_civic_subelement {
+       uint8 type;  /* type of civic location */
+       uint8 subelement;
+       uint8 length;
+       uint8 civic_data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_civic_subelement dot11_civic_subelement_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_meas_rep {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       BWL_PRE_PACKED_STRUCT union
+       {
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 channel;
+                       uint8 start_time[8];
+                       uint16 duration;
+                       uint8 map;
+               } BWL_POST_PACKED_STRUCT basic;
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 subelement;
+                       uint8 length;
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT lci;
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 type;  /* type of civic location */
+                       uint8 subelement;
+                       uint8 length;
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT civic;
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 exp_tsf[8];
+                       uint8 subelement;
+                       uint8 length;
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT locid;
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 entry_count;
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT ftm_range;
+               uint8 data[1];
+       } BWL_POST_PACKED_STRUCT rep;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_meas_rep dot11_meas_rep_t;
+#define DOT11_MNG_IE_MREP_MIN_LEN           5  /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREP_LCI_FIXED_LEN     5  /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREP_CIVIC_FIXED_LEN   6  /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREP_LOCID_FIXED_LEN   13 /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREP_BASIC_FIXED_LEN   15 /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREP_FRNG_FIXED_LEN    4
+
+/* length of Measure Report IE data not including variable len */
+#define DOT11_MNG_IE_MREP_FIXED_LEN    3       /* d11 measurement response IE fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_meas_rep_basic {
+       uint8 channel;
+       uint8 start_time[8];
+       uint16 duration;
+       uint8 map;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_meas_rep_basic dot11_meas_rep_basic_t;
+#define DOT11_MEASURE_BASIC_REP_LEN    12      /* d11 measurement basic report length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_quiet {
+       uint8 id;
+       uint8 len;
+       uint8 count;    /* TBTTs until beacon interval in quiet starts */
+       uint8 period;   /* Beacon intervals between periodic quiet periods ? */
+       uint16 duration;        /* Length of quiet period, in TU's */
+       uint16 offset;  /* TU's offset from TBTT in Count field */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_quiet dot11_quiet_t;
+
+BWL_PRE_PACKED_STRUCT struct chan_map_tuple {
+       uint8 channel;
+       uint8 map;
+} BWL_POST_PACKED_STRUCT;
+typedef struct chan_map_tuple chan_map_tuple_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_ibss_dfs {
+       uint8 id;
+       uint8 len;
+       uint8 eaddr[ETHER_ADDR_LEN];
+       uint8 interval;
+       chan_map_tuple_t map[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ibss_dfs dot11_ibss_dfs_t;
+
+/* WME Elements */
+#define WME_OUI                        "\x00\x50\xf2"  /* WME OUI */
+#define WME_OUI_LEN            3
+#define WME_OUI_TYPE           2       /* WME type */
+#define WME_TYPE               2       /* WME type, deprecated */
+#define WME_SUBTYPE_IE         0       /* Information Element */
+#define WME_SUBTYPE_PARAM_IE   1       /* Parameter Element */
+#define WME_SUBTYPE_TSPEC      2       /* Traffic Specification */
+#define WME_VER                        1       /* WME version */
+
+/* WME Access Category Indices (ACIs) */
+#define AC_BE                  0       /* Best Effort */
+#define AC_BK                  1       /* Background */
+#define AC_VI                  2       /* Video */
+#define AC_VO                  3       /* Voice */
+#define AC_COUNT               4       /* number of ACs */
+
+typedef uint8 ac_bitmap_t;     /* AC bitmap of (1 << AC_xx) */
+
+#define AC_BITMAP_NONE         0x0     /* No ACs */
+#define AC_BITMAP_ALL          0xf     /* All ACs */
+#define AC_BITMAP_TST(ab, ac)  (((ab) & (1 << (ac))) != 0)
+#define AC_BITMAP_SET(ab, ac)  (((ab) |= (1 << (ac))))
+#define AC_BITMAP_RESET(ab, ac) (((ab) &= ~(1 << (ac))))
+
+/* Management PKT Lifetime indices */
+/* Removing flag checks 'BCMINTERNAL || WLTEST'
+ * while merging MERGE BIS120RC4 to DINGO2
+ */
+#define MGMT_ALL               0xffff
+#define MGMT_AUTH_LT   FC_SUBTYPE_AUTH
+#define MGMT_ASSOC_LT  FC_SUBTYPE_ASSOC_REQ
+
+/** WME Information Element (IE) */
+BWL_PRE_PACKED_STRUCT struct wme_ie {
+       uint8 oui[3];
+       uint8 type;
+       uint8 subtype;
+       uint8 version;
+       uint8 qosinfo;
+} BWL_POST_PACKED_STRUCT;
+typedef struct wme_ie wme_ie_t;
+#define WME_IE_LEN 7   /* WME IE length */
+
+BWL_PRE_PACKED_STRUCT struct edcf_acparam {
+       uint8   ACI;
+       uint8   ECW;
+       uint16  TXOP;           /* stored in network order (ls octet first) */
+} BWL_POST_PACKED_STRUCT;
+typedef struct edcf_acparam edcf_acparam_t;
+
+/** WME Parameter Element (PE) */
+BWL_PRE_PACKED_STRUCT struct wme_param_ie {
+       uint8 oui[3];
+       uint8 type;
+       uint8 subtype;
+       uint8 version;
+       uint8 qosinfo;
+       uint8 rsvd;
+       edcf_acparam_t acparam[AC_COUNT];
+} BWL_POST_PACKED_STRUCT;
+typedef struct wme_param_ie wme_param_ie_t;
+#define WME_PARAM_IE_LEN            24          /* WME Parameter IE length */
+
+/* QoS Info field for IE as sent from AP */
+#define WME_QI_AP_APSD_MASK         0x80        /* U-APSD Supported mask */
+#define WME_QI_AP_APSD_SHIFT        7           /* U-APSD Supported shift */
+#define WME_QI_AP_COUNT_MASK        0x0f        /* Parameter set count mask */
+#define WME_QI_AP_COUNT_SHIFT       0           /* Parameter set count shift */
+
+/* QoS Info field for IE as sent from STA */
+#define WME_QI_STA_MAXSPLEN_MASK    0x60        /* Max Service Period Length mask */
+#define WME_QI_STA_MAXSPLEN_SHIFT   5           /* Max Service Period Length shift */
+#define WME_QI_STA_APSD_ALL_MASK    0xf         /* APSD all AC bits mask */
+#define WME_QI_STA_APSD_ALL_SHIFT   0           /* APSD all AC bits shift */
+#define WME_QI_STA_APSD_BE_MASK     0x8         /* APSD AC_BE mask */
+#define WME_QI_STA_APSD_BE_SHIFT    3           /* APSD AC_BE shift */
+#define WME_QI_STA_APSD_BK_MASK     0x4         /* APSD AC_BK mask */
+#define WME_QI_STA_APSD_BK_SHIFT    2           /* APSD AC_BK shift */
+#define WME_QI_STA_APSD_VI_MASK     0x2         /* APSD AC_VI mask */
+#define WME_QI_STA_APSD_VI_SHIFT    1           /* APSD AC_VI shift */
+#define WME_QI_STA_APSD_VO_MASK     0x1         /* APSD AC_VO mask */
+#define WME_QI_STA_APSD_VO_SHIFT    0           /* APSD AC_VO shift */
+
+/* ACI */
+#define EDCF_AIFSN_MIN               1           /* AIFSN minimum value */
+#define EDCF_AIFSN_MAX               15          /* AIFSN maximum value */
+#define EDCF_AIFSN_MASK              0x0f        /* AIFSN mask */
+#define EDCF_ACM_MASK                0x10        /* ACM mask */
+#define EDCF_ACI_MASK                0x60        /* ACI mask */
+#define EDCF_ACI_SHIFT               5           /* ACI shift */
+#define EDCF_AIFSN_SHIFT             12          /* 4 MSB(0xFFF) in ifs_ctl for AC idx */
+
+/* ECW */
+#define EDCF_ECW_MIN                 0           /* cwmin/cwmax exponent minimum value */
+#define EDCF_ECW_MAX                 15          /* cwmin/cwmax exponent maximum value */
+#define EDCF_ECW2CW(exp)             ((1 << (exp)) - 1)
+#define EDCF_ECWMIN_MASK             0x0f        /* cwmin exponent form mask */
+#define EDCF_ECWMAX_MASK             0xf0        /* cwmax exponent form mask */
+#define EDCF_ECWMAX_SHIFT            4           /* cwmax exponent form shift */
+
+/* TXOP */
+#define EDCF_TXOP_MIN                0           /* TXOP minimum value */
+#define EDCF_TXOP_MAX                65535       /* TXOP maximum value */
+#define EDCF_TXOP2USEC(txop)         ((txop) << 5)
+
+/* Default BE ACI value for non-WME connection STA */
+#define NON_EDCF_AC_BE_ACI_STA          0x02
+
+/* Default EDCF parameters that AP advertises for STA to use; WMM draft Table 12 */
+#define EDCF_AC_BE_ACI_STA           0x03      /* STA ACI value for best effort AC */
+#define EDCF_AC_BE_ECW_STA           0xA4      /* STA ECW value for best effort AC */
+#define EDCF_AC_BE_TXOP_STA          0x0000    /* STA TXOP value for best effort AC */
+#define EDCF_AC_BK_ACI_STA           0x27      /* STA ACI value for background AC */
+#define EDCF_AC_BK_ECW_STA           0xA4      /* STA ECW value for background AC */
+#define EDCF_AC_BK_TXOP_STA          0x0000    /* STA TXOP value for background AC */
+#define EDCF_AC_VI_ACI_STA           0x42      /* STA ACI value for video AC */
+#define EDCF_AC_VI_ECW_STA           0x43      /* STA ECW value for video AC */
+#define EDCF_AC_VI_TXOP_STA          0x005e    /* STA TXOP value for video AC */
+#define EDCF_AC_VO_ACI_STA           0x62      /* STA ACI value for audio AC */
+#define EDCF_AC_VO_ECW_STA           0x32      /* STA ECW value for audio AC */
+#define EDCF_AC_VO_TXOP_STA          0x002f    /* STA TXOP value for audio AC */
+
+/* Default EDCF parameters that AP uses; WMM draft Table 14 */
+#define EDCF_AC_BE_ACI_AP            0x03      /* AP ACI value for best effort AC */
+#define EDCF_AC_BE_ECW_AP            0x64      /* AP ECW value for best effort AC */
+#define EDCF_AC_BE_TXOP_AP           0x0000    /* AP TXOP value for best effort AC */
+#define EDCF_AC_BK_ACI_AP            0x27      /* AP ACI value for background AC */
+#define EDCF_AC_BK_ECW_AP            0xA4      /* AP ECW value for background AC */
+#define EDCF_AC_BK_TXOP_AP           0x0000    /* AP TXOP value for background AC */
+#define EDCF_AC_VI_ACI_AP            0x41      /* AP ACI value for video AC */
+#define EDCF_AC_VI_ECW_AP            0x43      /* AP ECW value for video AC */
+#define EDCF_AC_VI_TXOP_AP           0x005e    /* AP TXOP value for video AC */
+#define EDCF_AC_VO_ACI_AP            0x61      /* AP ACI value for audio AC */
+#define EDCF_AC_VO_ECW_AP            0x32      /* AP ECW value for audio AC */
+#define EDCF_AC_VO_TXOP_AP           0x002f    /* AP TXOP value for audio AC */
+
+/** EDCA Parameter IE */
+BWL_PRE_PACKED_STRUCT struct edca_param_ie {
+       uint8 qosinfo;
+       uint8 rsvd;
+       edcf_acparam_t acparam[AC_COUNT];
+} BWL_POST_PACKED_STRUCT;
+typedef struct edca_param_ie edca_param_ie_t;
+#define EDCA_PARAM_IE_LEN            18          /* EDCA Parameter IE length */
+
+/** QoS Capability IE */
+BWL_PRE_PACKED_STRUCT struct qos_cap_ie {
+       uint8 qosinfo;
+} BWL_POST_PACKED_STRUCT;
+typedef struct qos_cap_ie qos_cap_ie_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_qbss_load_ie {
+       uint8 id;                       /* 11, DOT11_MNG_QBSS_LOAD_ID */
+       uint8 length;
+       uint16 station_count;           /* total number of STAs associated */
+       uint8 channel_utilization;      /* % of time, normalized to 255, QAP sensed medium busy */
+       uint16 aac;                     /* available admission capacity */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_qbss_load_ie dot11_qbss_load_ie_t;
+#define BSS_LOAD_IE_SIZE       7       /* BSS load IE size */
+
+#define WLC_QBSS_LOAD_CHAN_FREE_MAX    0xff    /* max for channel free score */
+
+/* Estimated Service Parameters (ESP) IE - 802.11-2016 9.4.2.174 */
+typedef BWL_PRE_PACKED_STRUCT struct dot11_esp_ie {
+       uint8           id;
+       uint8           length;
+       uint8           id_ext;
+       /* variable len info */
+       uint8           esp_info_lists[];
+} BWL_POST_PACKED_STRUCT dot11_esp_ie_t;
+
+#define DOT11_ESP_IE_HDR_SIZE  (OFFSETOF(dot11_esp_ie_t, esp_info_lists))
+
+/* ESP Information list - 802.11-2016 9.4.2.174 */
+typedef BWL_PRE_PACKED_STRUCT struct dot11_esp_ie_info_list {
+       /* acess category, data format, ba win size */
+       uint8           ac_df_baws;
+       /* estimated air time fraction */
+       uint8           eat_frac;
+       /* data PPDU duration target (50us units) */
+       uint8           ppdu_dur;
+} BWL_POST_PACKED_STRUCT dot11_esp_ie_info_list_t;
+
+#define DOT11_ESP_IE_INFO_LIST_SIZE    (sizeof(dot11_esp_ie_info_list_t))
+
+#define DOT11_ESP_NBR_INFO_LISTS       4u      /* max nbr of esp information lists */
+#define DOT11_ESP_INFO_LIST_AC_BK      0u      /* access category of esp information list AC_BK */
+#define DOT11_ESP_INFO_LIST_AC_BE      1u      /* access category of esp information list AC_BE */
+#define DOT11_ESP_INFO_LIST_AC_VI      2u      /* access category of esp information list AC_VI */
+#define DOT11_ESP_INFO_LIST_AC_VO      3u      /* access category of esp information list AC_VO */
+
+#define DOT11_ESP_INFO_LIST_DF_MASK    0x18            /* Data Format Mask */
+#define DOT11_ESP_INFO_LIST_BAWS_MASK  0xE0            /* BA window size mask */
+
+/* nom_msdu_size */
+#define FIXED_MSDU_SIZE 0x8000         /* MSDU size is fixed */
+#define MSDU_SIZE_MASK 0x7fff          /* (Nominal or fixed) MSDU size */
+
+/* surplus_bandwidth */
+/* Represented as 3 bits of integer, binary point, 13 bits fraction */
+#define        INTEGER_SHIFT   13      /* integer shift */
+#define FRACTION_MASK  0x1FFF  /* fraction mask */
+
+/** Management Notification Frame */
+BWL_PRE_PACKED_STRUCT struct dot11_management_notification {
+       uint8 category;                 /* DOT11_ACTION_NOTIFICATION */
+       uint8 action;
+       uint8 token;
+       uint8 status;
+       uint8 data[1];                  /* Elements */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_MGMT_NOTIFICATION_LEN 4  /* Fixed length */
+
+/** Timeout Interval IE */
+BWL_PRE_PACKED_STRUCT struct ti_ie {
+       uint8 ti_type;
+       uint32 ti_val;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ti_ie ti_ie_t;
+#define TI_TYPE_REASSOC_DEADLINE       1
+#define TI_TYPE_KEY_LIFETIME           2
+
+#ifndef CISCO_AIRONET_OUI
+#define CISCO_AIRONET_OUI      "\x00\x40\x96"  /* Cisco AIRONET OUI */
+#endif
+/* QoS FastLane IE. */
+BWL_PRE_PACKED_STRUCT struct ccx_qfl_ie {
+       uint8   id;             /* 221, DOT11_MNG_VS_ID */
+       uint8   length;         /* 5 */
+       uint8   oui[3];         /* 00:40:96 */
+       uint8   type;           /* 11 */
+       uint8   data;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ccx_qfl_ie ccx_qfl_ie_t;
+#define CCX_QFL_IE_TYPE        11
+#define CCX_QFL_ENABLE_SHIFT   5
+#define CCX_QFL_ENALBE (1 << CCX_QFL_ENABLE_SHIFT)
+
+/* WME Action Codes */
+#define WME_ADDTS_REQUEST      0       /* WME ADDTS request */
+#define WME_ADDTS_RESPONSE     1       /* WME ADDTS response */
+#define WME_DELTS_REQUEST      2       /* WME DELTS request */
+
+/* WME Setup Response Status Codes */
+#define WME_ADMISSION_ACCEPTED         0       /* WME admission accepted */
+#define WME_INVALID_PARAMETERS         1       /* WME invalide parameters */
+#define WME_ADMISSION_REFUSED          3       /* WME admission refused */
+
+/* Macro to take a pointer to a beacon or probe response
+ * body and return the char* pointer to the SSID info element
+ */
+#define BCN_PRB_SSID(body) ((char*)(body) + DOT11_BCN_PRB_LEN)
+
+/* Authentication frame payload constants */
+#define DOT11_OPEN_SYSTEM      0       /* d11 open authentication */
+#define DOT11_SHARED_KEY       1       /* d11 shared authentication */
+#define DOT11_FAST_BSS         2       /* d11 fast bss authentication */
+#define DOT11_SAE              3       /* d11 simultaneous authentication of equals */
+#define DOT11_FILS_SKEY                4       /* d11 fils shared key authentication w/o pfs */
+#define DOT11_FILS_SKEY_PFS    5       /* d11 fils shared key authentication w/ pfs */
+#define DOT11_FILS_PKEY                6       /* d11 fils public key authentication */
+#define DOT11_MAX_AUTH_ALG  DOT11_FILS_PKEY /* maximum value of an auth alg */
+#define DOT11_CHALLENGE_LEN    128     /* d11 challenge text length */
+
+/* Frame control macros */
+#define FC_PVER_MASK           0x3     /* PVER mask */
+#define FC_PVER_SHIFT          0       /* PVER shift */
+#define FC_TYPE_MASK           0xC     /* type mask */
+#define FC_TYPE_SHIFT          2       /* type shift */
+#define FC_SUBTYPE_MASK                0xF0    /* subtype mask */
+#define FC_SUBTYPE_SHIFT       4       /* subtype shift */
+#define FC_TODS                        0x100   /* to DS */
+#define FC_TODS_SHIFT          8       /* to DS shift */
+#define FC_FROMDS              0x200   /* from DS */
+#define FC_FROMDS_SHIFT                9       /* from DS shift */
+#define FC_MOREFRAG            0x400   /* more frag. */
+#define FC_MOREFRAG_SHIFT      10      /* more frag. shift */
+#define FC_RETRY               0x800   /* retry */
+#define FC_RETRY_SHIFT         11      /* retry shift */
+#define FC_PM                  0x1000  /* PM */
+#define FC_PM_SHIFT            12      /* PM shift */
+#define FC_MOREDATA            0x2000  /* more data */
+#define FC_MOREDATA_SHIFT      13      /* more data shift */
+#define FC_WEP                 0x4000  /* WEP */
+#define FC_WEP_SHIFT           14      /* WEP shift */
+#define FC_ORDER               0x8000  /* order */
+#define FC_ORDER_SHIFT         15      /* order shift */
+
+/* sequence control macros */
+#define SEQNUM_SHIFT           4       /* seq. number shift */
+#define SEQNUM_MAX             0x1000  /* max seqnum + 1 */
+#define FRAGNUM_MASK           0xF     /* frag. number mask */
+
+/* Frame Control type/subtype defs */
+
+/* FC Types */
+#define FC_TYPE_MNG            0       /* management type */
+#define FC_TYPE_CTL            1       /* control type */
+#define FC_TYPE_DATA           2       /* data type */
+
+/* Management Subtypes */
+#define FC_SUBTYPE_ASSOC_REQ           0       /* assoc. request */
+#define FC_SUBTYPE_ASSOC_RESP          1       /* assoc. response */
+#define FC_SUBTYPE_REASSOC_REQ         2       /* reassoc. request */
+#define FC_SUBTYPE_REASSOC_RESP                3       /* reassoc. response */
+#define FC_SUBTYPE_PROBE_REQ           4       /* probe request */
+#define FC_SUBTYPE_PROBE_RESP          5       /* probe response */
+#define FC_SUBTYPE_BEACON              8       /* beacon */
+#define FC_SUBTYPE_ATIM                        9       /* ATIM */
+#define FC_SUBTYPE_DISASSOC            10      /* disassoc. */
+#define FC_SUBTYPE_AUTH                        11      /* authentication */
+#define FC_SUBTYPE_DEAUTH              12      /* de-authentication */
+#define FC_SUBTYPE_ACTION              13      /* action */
+#define FC_SUBTYPE_ACTION_NOACK                14      /* action no-ack */
+
+/* Control Subtypes */
+#define FC_SUBTYPE_TRIGGER             2       /* Trigger frame */
+#define FC_SUBTYPE_CTL_WRAPPER         7       /* Control Wrapper */
+#define FC_SUBTYPE_BLOCKACK_REQ                8       /* Block Ack Req */
+#define FC_SUBTYPE_BLOCKACK            9       /* Block Ack */
+#define FC_SUBTYPE_PS_POLL             10      /* PS poll */
+#define FC_SUBTYPE_RTS                 11      /* RTS */
+#define FC_SUBTYPE_CTS                 12      /* CTS */
+#define FC_SUBTYPE_ACK                 13      /* ACK */
+#define FC_SUBTYPE_CF_END              14      /* CF-END */
+#define FC_SUBTYPE_CF_END_ACK          15      /* CF-END ACK */
+
+/* Data Subtypes */
+#define FC_SUBTYPE_DATA                        0       /* Data */
+#define FC_SUBTYPE_DATA_CF_ACK         1       /* Data + CF-ACK */
+#define FC_SUBTYPE_DATA_CF_POLL                2       /* Data + CF-Poll */
+#define FC_SUBTYPE_DATA_CF_ACK_POLL    3       /* Data + CF-Ack + CF-Poll */
+#define FC_SUBTYPE_NULL                        4       /* Null */
+#define FC_SUBTYPE_CF_ACK              5       /* CF-Ack */
+#define FC_SUBTYPE_CF_POLL             6       /* CF-Poll */
+#define FC_SUBTYPE_CF_ACK_POLL         7       /* CF-Ack + CF-Poll */
+#define FC_SUBTYPE_QOS_DATA            8       /* QoS Data */
+#define FC_SUBTYPE_QOS_DATA_CF_ACK     9       /* QoS Data + CF-Ack */
+#define FC_SUBTYPE_QOS_DATA_CF_POLL    10      /* QoS Data + CF-Poll */
+#define FC_SUBTYPE_QOS_DATA_CF_ACK_POLL        11      /* QoS Data + CF-Ack + CF-Poll */
+#define FC_SUBTYPE_QOS_NULL            12      /* QoS Null */
+#define FC_SUBTYPE_QOS_CF_POLL         14      /* QoS CF-Poll */
+#define FC_SUBTYPE_QOS_CF_ACK_POLL     15      /* QoS CF-Ack + CF-Poll */
+
+/* Data Subtype Groups */
+#define FC_SUBTYPE_ANY_QOS(s)          (((s) & 8) != 0)
+#define FC_SUBTYPE_ANY_NULL(s)         (((s) & 4) != 0)
+#define FC_SUBTYPE_ANY_CF_POLL(s)      (((s) & 2) != 0)
+#define FC_SUBTYPE_ANY_CF_ACK(s)       (((s) & 1) != 0)
+#define FC_SUBTYPE_ANY_PSPOLL(s)       (((s) & 10) != 0)
+
+/* Type/Subtype Combos */
+#define FC_KIND_MASK           (FC_TYPE_MASK | FC_SUBTYPE_MASK)        /* FC kind mask */
+
+#define FC_KIND(t, s)  (((t) << FC_TYPE_SHIFT) | ((s) << FC_SUBTYPE_SHIFT))    /* FC kind */
+
+#define FC_SUBTYPE(fc) (((fc) & FC_SUBTYPE_MASK) >> FC_SUBTYPE_SHIFT)  /* Subtype from FC */
+#define FC_TYPE(fc)    (((fc) & FC_TYPE_MASK) >> FC_TYPE_SHIFT)        /* Type from FC */
+
+#define FC_ASSOC_REQ   FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_REQ)      /* assoc. request */
+#define FC_ASSOC_RESP  FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_RESP)     /* assoc. response */
+#define FC_REASSOC_REQ FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_REQ)    /* reassoc. request */
+#define FC_REASSOC_RESP        FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_RESP)   /* reassoc. response */
+#define FC_PROBE_REQ   FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_REQ)      /* probe request */
+#define FC_PROBE_RESP  FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_RESP)     /* probe response */
+#define FC_BEACON      FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_BEACON)         /* beacon */
+#define FC_ATIM                FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ATIM)           /* ATIM */
+#define FC_DISASSOC    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DISASSOC)       /* disassoc */
+#define FC_AUTH                FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_AUTH)           /* authentication */
+#define FC_DEAUTH      FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DEAUTH)         /* deauthentication */
+#define FC_ACTION      FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION)         /* action */
+#define FC_ACTION_NOACK        FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION_NOACK)   /* action no-ack */
+
+#define FC_CTL_TRIGGER FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_TRIGGER)        /* Trigger frame */
+#define FC_CTL_WRAPPER FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTL_WRAPPER)    /* Control Wrapper */
+#define FC_BLOCKACK_REQ        FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK_REQ)   /* Block Ack Req */
+#define FC_BLOCKACK    FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK)       /* Block Ack */
+#define FC_PS_POLL     FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_PS_POLL)        /* PS poll */
+#define FC_RTS         FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_RTS)            /* RTS */
+#define FC_CTS         FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTS)            /* CTS */
+#define FC_ACK         FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_ACK)            /* ACK */
+#define FC_CF_END      FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END)         /* CF-END */
+#define FC_CF_END_ACK  FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END_ACK)     /* CF-END ACK */
+
+#define FC_DATA                FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA)          /* data */
+#define FC_NULL_DATA   FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_NULL)          /* null data */
+#define FC_DATA_CF_ACK FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA_CF_ACK)   /* data CF ACK */
+#define FC_QOS_DATA    FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_DATA)      /* QoS data */
+#define FC_QOS_NULL    FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_NULL)      /* QoS null */
+
+/* QoS Control Field */
+
+/* 802.1D Priority */
+#define QOS_PRIO_SHIFT         0       /* QoS priority shift */
+#define QOS_PRIO_MASK          0x0007  /* QoS priority mask */
+#define QOS_PRIO(qos)          (((qos) & QOS_PRIO_MASK) >> QOS_PRIO_SHIFT)     /* QoS priority */
+
+/* Traffic Identifier */
+#define QOS_TID_SHIFT          0       /* QoS TID shift */
+#define QOS_TID_MASK           0x000f  /* QoS TID mask */
+#define QOS_TID(qos)           (((qos) & QOS_TID_MASK) >> QOS_TID_SHIFT)       /* QoS TID */
+
+/* End of Service Period (U-APSD) */
+#define QOS_EOSP_SHIFT         4       /* QoS End of Service Period shift */
+#define QOS_EOSP_MASK          0x0010  /* QoS End of Service Period mask */
+#define QOS_EOSP(qos)          (((qos) & QOS_EOSP_MASK) >> QOS_EOSP_SHIFT)     /* Qos EOSP */
+
+/* Ack Policy */
+#define QOS_ACK_NORMAL_ACK     0       /* Normal Ack */
+#define QOS_ACK_NO_ACK         1       /* No Ack (eg mcast) */
+#define QOS_ACK_NO_EXP_ACK     2       /* No Explicit Ack */
+#define QOS_ACK_BLOCK_ACK      3       /* Block Ack */
+#define QOS_ACK_SHIFT          5       /* QoS ACK shift */
+#define QOS_ACK_MASK           0x0060  /* QoS ACK mask */
+#define QOS_ACK(qos)           (((qos) & QOS_ACK_MASK) >> QOS_ACK_SHIFT)       /* QoS ACK */
+
+/* A-MSDU flag */
+#define QOS_AMSDU_SHIFT                7       /* AMSDU shift */
+#define QOS_AMSDU_MASK         0x0080  /* AMSDU mask */
+
+/* Management Frames */
+
+/* Management Frame Constants */
+
+/* Fixed fields */
+#define DOT11_MNG_AUTH_ALGO_LEN                2       /* d11 management auth. algo. length */
+#define DOT11_MNG_AUTH_SEQ_LEN         2       /* d11 management auth. seq. length */
+#define DOT11_MNG_BEACON_INT_LEN       2       /* d11 management beacon interval length */
+#define DOT11_MNG_CAP_LEN              2       /* d11 management cap. length */
+#define DOT11_MNG_AP_ADDR_LEN          6       /* d11 management AP address length */
+#define DOT11_MNG_LISTEN_INT_LEN       2       /* d11 management listen interval length */
+#define DOT11_MNG_REASON_LEN           2       /* d11 management reason length */
+#define DOT11_MNG_AID_LEN              2       /* d11 management AID length */
+#define DOT11_MNG_STATUS_LEN           2       /* d11 management status length */
+#define DOT11_MNG_TIMESTAMP_LEN                8       /* d11 management timestamp length */
+
+/* DUR/ID field in assoc resp is 0xc000 | AID */
+#define DOT11_AID_MASK                         0x3fff  /* d11 AID mask */
+#define DOT11_AID_OCTET_VAL_SHIFT              3u      /* AID octet value shift */
+#define DOT11_AID_BIT_POS_IN_OCTET             0x07    /* AID bit position in octet */
+
+/* Reason Codes */
+#define DOT11_RC_RESERVED              0       /* d11 RC reserved */
+#define DOT11_RC_UNSPECIFIED           1       /* Unspecified reason */
+#define DOT11_RC_AUTH_INVAL            2       /* Previous authentication no longer valid */
+#define DOT11_RC_DEAUTH_LEAVING                3       /* Deauthenticated because sending station
+                                                * is leaving (or has left) IBSS or ESS
+                                                */
+#define DOT11_RC_INACTIVITY            4       /* Disassociated due to inactivity */
+#define DOT11_RC_BUSY                  5       /* Disassociated because AP is unable to handle
+                                                * all currently associated stations
+                                                */
+#define DOT11_RC_INVAL_CLASS_2         6       /* Class 2 frame received from
+                                                * nonauthenticated station
+                                                */
+#define DOT11_RC_INVAL_CLASS_3         7       /* Class 3 frame received from
+                                                *  nonassociated station
+                                                */
+#define DOT11_RC_DISASSOC_LEAVING      8       /* Disassociated because sending station is
+                                                * leaving (or has left) BSS
+                                                */
+#define DOT11_RC_NOT_AUTH              9       /* Station requesting (re)association is not
+                                                * authenticated with responding station
+                                                */
+#define DOT11_RC_BAD_PC                        10      /* Unacceptable power capability element */
+#define DOT11_RC_BAD_CHANNELS          11      /* Unacceptable supported channels element */
+
+/* 12 is unused by STA but could be used by AP/GO */
+#define DOT11_RC_DISASSOC_BTM          12      /* Disassociated due to BSS Transition Magmt */
+
+/* 13-23 are WPA/802.11i reason codes defined in wpa.h */
+
+/* 32-39 are QSTA specific reasons added in 11e */
+#define DOT11_RC_UNSPECIFIED_QOS       32      /* unspecified QoS-related reason */
+#define DOT11_RC_INSUFFCIENT_BW                33      /* QAP lacks sufficient bandwidth */
+#define DOT11_RC_EXCESSIVE_FRAMES      34      /* excessive number of frames need ack */
+#define DOT11_RC_TX_OUTSIDE_TXOP       35      /* transmitting outside the limits of txop */
+#define DOT11_RC_LEAVING_QBSS          36      /* QSTA is leaving the QBSS (or restting) */
+#define DOT11_RC_BAD_MECHANISM         37      /* does not want to use the mechanism */
+#define DOT11_RC_SETUP_NEEDED          38      /* mechanism needs a setup */
+#define DOT11_RC_TIMEOUT               39      /* timeout */
+
+#define DOT11_RC_MESH_PEERING_CANCELLED                52
+#define DOT11_RC_MESH_MAX_PEERS                        53
+#define DOT11_RC_MESH_CONFIG_POLICY_VIOLN      54
+#define DOT11_RC_MESH_CLOSE_RECVD              55
+#define DOT11_RC_MESH_MAX_RETRIES              56
+#define DOT11_RC_MESH_CONFIRM_TIMEOUT          57
+#define DOT11_RC_MESH_INVALID_GTK              58
+#define DOT11_RC_MESH_INCONSISTENT_PARAMS      59
+
+#define DOT11_RC_MESH_INVALID_SEC_CAP          60
+#define DOT11_RC_MESH_PATHERR_NOPROXYINFO      61
+#define DOT11_RC_MESH_PATHERR_NOFWINFO         62
+#define DOT11_RC_MESH_PATHERR_DSTUNREACH       63
+#define DOT11_RC_MESH_MBSSMAC_EXISTS           64
+#define DOT11_RC_MESH_CHANSWITCH_REGREQ                65
+#define DOT11_RC_MESH_CHANSWITCH_UNSPEC                66
+
+#define DOT11_RC_MAX                   66      /* Reason codes > 66 are reserved */
+
+#define DOT11_RC_TDLS_PEER_UNREACH     25
+#define DOT11_RC_TDLS_DOWN_UNSPECIFIED 26
+
+/* Status Codes */
+#define DOT11_SC_SUCCESS               0       /* Successful */
+#define DOT11_SC_FAILURE               1       /* Unspecified failure */
+#define DOT11_SC_TDLS_WAKEUP_SCH_ALT 2 /* TDLS wakeup schedule rejected but alternative  */
+                                       /* schedule provided */
+#define DOT11_SC_TDLS_WAKEUP_SCH_REJ 3 /* TDLS wakeup schedule rejected */
+#define DOT11_SC_TDLS_SEC_DISABLED     5       /* TDLS Security disabled */
+#define DOT11_SC_LIFETIME_REJ          6       /* Unacceptable lifetime */
+#define DOT11_SC_NOT_SAME_BSS          7       /* Not in same BSS */
+#define DOT11_SC_CAP_MISMATCH          10      /* Cannot support all requested
+                                                * capabilities in the Capability
+                                                * Information field
+                                                */
+#define DOT11_SC_REASSOC_FAIL          11      /* Reassociation denied due to inability
+                                                * to confirm that association exists
+                                                */
+#define DOT11_SC_ASSOC_FAIL            12      /* Association denied due to reason
+                                                * outside the scope of this standard
+                                                */
+#define DOT11_SC_AUTH_MISMATCH         13      /* Responding station does not support
+                                                * the specified authentication
+                                                * algorithm
+                                                */
+#define DOT11_SC_AUTH_SEQ              14      /* Received an Authentication frame
+                                                * with authentication transaction
+                                                * sequence number out of expected
+                                                * sequence
+                                                */
+#define DOT11_SC_AUTH_CHALLENGE_FAIL   15      /* Authentication rejected because of
+                                                * challenge failure
+                                                */
+#define DOT11_SC_AUTH_TIMEOUT          16      /* Authentication rejected due to timeout
+                                                * waiting for next frame in sequence
+                                                */
+#define DOT11_SC_ASSOC_BUSY_FAIL       17      /* Association denied because AP is
+                                                * unable to handle additional
+                                                * associated stations
+                                                */
+#define DOT11_SC_ASSOC_RATE_MISMATCH   18      /* Association denied due to requesting
+                                                * station not supporting all of the
+                                                * data rates in the BSSBasicRateSet
+                                                * parameter
+                                                */
+#define DOT11_SC_ASSOC_SHORT_REQUIRED  19      /* Association denied due to requesting
+                                                * station not supporting the Short
+                                                * Preamble option
+                                                */
+#define DOT11_SC_ASSOC_PBCC_REQUIRED   20      /* Association denied due to requesting
+                                                * station not supporting the PBCC
+                                                * Modulation option
+                                                */
+#define DOT11_SC_ASSOC_AGILITY_REQUIRED        21      /* Association denied due to requesting
+                                                * station not supporting the Channel
+                                                * Agility option
+                                                */
+#define DOT11_SC_ASSOC_SPECTRUM_REQUIRED       22      /* Association denied because Spectrum
+                                                        * Management capability is required.
+                                                        */
+#define DOT11_SC_ASSOC_BAD_POWER_CAP   23      /* Association denied because the info
+                                                * in the Power Cap element is
+                                                * unacceptable.
+                                                */
+#define DOT11_SC_ASSOC_BAD_SUP_CHANNELS        24      /* Association denied because the info
+                                                * in the Supported Channel element is
+                                                * unacceptable
+                                                */
+#define DOT11_SC_ASSOC_SHORTSLOT_REQUIRED      25      /* Association denied due to requesting
+                                                        * station not supporting the Short Slot
+                                                        * Time option
+                                                        */
+#define DOT11_SC_ASSOC_DSSSOFDM_REQUIRED 26    /* Association denied because requesting station
+                                                * does not support the DSSS-OFDM option
+                                                */
+#define DOT11_SC_ASSOC_HT_REQUIRED     27      /* Association denied because the requesting
+                                                * station does not support HT features
+                                                */
+#define DOT11_SC_ASSOC_R0KH_UNREACHABLE        28      /* Association denied due to AP
+                                                * being unable to reach the R0 Key Holder
+                                                */
+#define DOT11_SC_ASSOC_TRY_LATER       30      /* Association denied temporarily, try again later
+                                                */
+#define DOT11_SC_ASSOC_MFP_VIOLATION   31      /* Association denied due to Robust Management
+                                                * frame policy violation
+                                                */
+
+#define        DOT11_SC_DECLINED               37      /* request declined */
+#define        DOT11_SC_INVALID_PARAMS         38      /* One or more params have invalid values */
+#define DOT11_SC_INVALID_PAIRWISE_CIPHER       42 /* invalid pairwise cipher */
+#define        DOT11_SC_INVALID_AKMP           43      /* Association denied due to invalid AKMP */
+#define DOT11_SC_INVALID_RSNIE_CAP     45      /* invalid RSN IE capabilities */
+#define DOT11_SC_DLS_NOT_ALLOWED       48      /* DLS is not allowed in the BSS by policy */
+#define        DOT11_SC_INVALID_PMKID          53      /* Association denied due to invalid PMKID */
+#define        DOT11_SC_INVALID_MDID           54      /* Association denied due to invalid MDID */
+#define        DOT11_SC_INVALID_FTIE           55      /* Association denied due to invalid FTIE */
+
+#define DOT11_SC_ADV_PROTO_NOT_SUPPORTED       59      /* ad proto not supported */
+#define DOT11_SC_NO_OUTSTAND_REQ                       60      /* no outstanding req */
+#define DOT11_SC_RSP_NOT_RX_FROM_SERVER                61      /* no response from server */
+#define DOT11_SC_TIMEOUT                                       62      /* timeout */
+#define DOT11_SC_QUERY_RSP_TOO_LARGE           63      /* query rsp too large */
+#define DOT11_SC_SERVER_UNREACHABLE                    65      /* server unreachable */
+
+#define DOT11_SC_UNEXP_MSG                     70      /* Unexpected message */
+#define DOT11_SC_INVALID_SNONCE                71      /* Invalid SNonce */
+#define DOT11_SC_INVALID_RSNIE         72      /* Invalid contents of RSNIE */
+
+#define DOT11_SC_ANTICLOG_TOCKEN_REQUIRED      76      /* Anti-clogging tocken required */
+#define DOT11_SC_INVALID_FINITE_CYCLIC_GRP     77      /* Invalid contents of RSNIE */
+#define DOT11_SC_TRANSMIT_FAILURE      79      /* transmission failure */
+#define DOT11_SC_ASSOC_VHT_REQUIRED    104     /* Association denied because the requesting
+                                                * station does not support VHT features.
+                                                */
+#define DOT11_SC_UNKNOWN_PASSWORD_IDENTIFIER   123u /* mismatch of password id */
+#define DOT11_SC_SAE_HASH_TO_ELEMENT           126u    /* SAE Hash-to-element PWE required */
+#define DOT11_SC_SAE_PK                                127u    /* SAE PK required */
+
+/* Info Elts, length of INFORMATION portion of Info Elts */
+#define DOT11_MNG_DS_PARAM_LEN                 1       /* d11 management DS parameter length */
+#define DOT11_MNG_IBSS_PARAM_LEN               2       /* d11 management IBSS parameter length */
+
+/* TIM Info element has 3 bytes fixed info in INFORMATION field,
+ * followed by 1 to 251 bytes of Partial Virtual Bitmap
+ */
+#define DOT11_MNG_TIM_FIXED_LEN                        3       /* d11 management TIM fixed length */
+#define DOT11_MNG_TIM_DTIM_COUNT               0       /* d11 management DTIM count */
+#define DOT11_MNG_TIM_DTIM_PERIOD              1       /* d11 management DTIM period */
+#define DOT11_MNG_TIM_BITMAP_CTL               2       /* d11 management TIM BITMAP control  */
+#define DOT11_MNG_TIM_PVB                      3       /* d11 management TIM PVB */
+
+#define DOT11_MNG_TIM_BITMAP_CTL_BCMC_MASK     0x01    /* Mask for bcmc bit in tim bitmap ctrl */
+#define DOT11_MNG_TIM_BITMAP_CTL_PVBOFF_MASK   0xFE    /* Mask for partial virtual bitmap */
+
+/* TLV defines */
+#define TLV_TAG_OFF            0       /* tag offset */
+#define TLV_LEN_OFF            1       /* length offset */
+#define TLV_HDR_LEN            2       /* header length */
+#define TLV_BODY_OFF           2       /* body offset */
+#define TLV_BODY_LEN_MAX       255     /* max body length */
+
+/* Management Frame Information Element IDs */
+enum dot11_tag_ids {
+       DOT11_MNG_SSID_ID                       = 0,    /* d11 management SSID id */
+       DOT11_MNG_RATES_ID                      = 1,    /* d11 management rates id */
+       DOT11_MNG_FH_PARMS_ID                   = 2,    /* d11 management FH parameter id */
+       DOT11_MNG_DS_PARMS_ID                   = 3,    /* d11 management DS parameter id */
+       DOT11_MNG_CF_PARMS_ID                   = 4,    /* d11 management CF parameter id */
+       DOT11_MNG_TIM_ID                        = 5,    /* d11 management TIM id */
+       DOT11_MNG_IBSS_PARMS_ID                 = 6,    /* d11 management IBSS parameter id */
+       DOT11_MNG_COUNTRY_ID                    = 7,    /* d11 management country id */
+       DOT11_MNG_HOPPING_PARMS_ID              = 8,    /* d11 management hopping parameter id */
+       DOT11_MNG_HOPPING_TABLE_ID              = 9,    /* d11 management hopping table id */
+       DOT11_MNG_FTM_SYNC_INFO_ID              = 9,    /* 11mc D4.3 */
+       DOT11_MNG_REQUEST_ID                    = 10,   /* d11 management request id */
+       DOT11_MNG_QBSS_LOAD_ID                  = 11,   /* d11 management QBSS Load id */
+       DOT11_MNG_EDCA_PARAM_ID                 = 12,   /* 11E EDCA Parameter id */
+       DOT11_MNG_TSPEC_ID                      = 13,   /* d11 management TSPEC id */
+       DOT11_MNG_TCLAS_ID                      = 14,   /* d11 management TCLAS id */
+       DOT11_MNG_CHALLENGE_ID                  = 16,   /* d11 management chanllenge id */
+       DOT11_MNG_PWR_CONSTRAINT_ID             = 32,   /* 11H PowerConstraint */
+       DOT11_MNG_PWR_CAP_ID                    = 33,   /* 11H PowerCapability */
+       DOT11_MNG_TPC_REQUEST_ID                = 34,   /* 11H TPC Request */
+       DOT11_MNG_TPC_REPORT_ID                 = 35,   /* 11H TPC Report */
+       DOT11_MNG_SUPP_CHANNELS_ID              = 36,   /* 11H Supported Channels */
+       DOT11_MNG_CHANNEL_SWITCH_ID             = 37,   /* 11H ChannelSwitch Announcement */
+       DOT11_MNG_MEASURE_REQUEST_ID            = 38,   /* 11H MeasurementRequest */
+       DOT11_MNG_MEASURE_REPORT_ID             = 39,   /* 11H MeasurementReport */
+       DOT11_MNG_QUIET_ID                      = 40,   /* 11H Quiet */
+       DOT11_MNG_IBSS_DFS_ID                   = 41,   /* 11H IBSS_DFS */
+       DOT11_MNG_ERP_ID                        = 42,   /* d11 management ERP id */
+       DOT11_MNG_TS_DELAY_ID                   = 43,   /* d11 management TS Delay id */
+       DOT11_MNG_TCLAS_PROC_ID                 = 44,   /* d11 management TCLAS processing id */
+       DOT11_MNG_HT_CAP                        = 45,   /* d11 mgmt HT cap id */
+       DOT11_MNG_QOS_CAP_ID                    = 46,   /* 11E QoS Capability id */
+       DOT11_MNG_NONERP_ID                     = 47,   /* d11 management NON-ERP id */
+       DOT11_MNG_RSN_ID                        = 48,   /* d11 management RSN id */
+       DOT11_MNG_EXT_RATES_ID                  = 50,   /* d11 management ext. rates id */
+       DOT11_MNG_AP_CHREP_ID                   = 51,   /* 11k AP Channel report id */
+       DOT11_MNG_NEIGHBOR_REP_ID               = 52,   /* 11k & 11v Neighbor report id */
+       DOT11_MNG_RCPI_ID                       = 53,   /* 11k RCPI */
+       DOT11_MNG_MDIE_ID                       = 54,   /* 11r Mobility domain id */
+       DOT11_MNG_FTIE_ID                       = 55,   /* 11r Fast Bss Transition id */
+       DOT11_MNG_FT_TI_ID                      = 56,   /* 11r Timeout Interval id */
+       DOT11_MNG_RDE_ID                        = 57,   /* 11r RIC Data Element id */
+       DOT11_MNG_REGCLASS_ID                   = 59,   /* d11 management regulatory class id */
+       DOT11_MNG_EXT_CSA_ID                    = 60,   /* d11 Extended CSA */
+       DOT11_MNG_HT_ADD                        = 61,   /* d11 mgmt additional HT info */
+       DOT11_MNG_EXT_CHANNEL_OFFSET            = 62,   /* d11 mgmt ext channel offset */
+       DOT11_MNG_BSS_AVR_ACCESS_DELAY_ID       = 63,   /* 11k bss average access delay */
+       DOT11_MNG_ANTENNA_ID                    = 64,   /* 11k antenna id */
+       DOT11_MNG_RSNI_ID                       = 65,   /* 11k RSNI id */
+       DOT11_MNG_MEASUREMENT_PILOT_TX_ID       = 66,   /* 11k measurement pilot tx info id */
+       DOT11_MNG_BSS_AVAL_ADMISSION_CAP_ID     = 67,   /* 11k bss aval admission cap id */
+       DOT11_MNG_BSS_AC_ACCESS_DELAY_ID        = 68,   /* 11k bss AC access delay id */
+       DOT11_MNG_WAPI_ID                       = 68,   /* d11 management WAPI id */
+       DOT11_MNG_TIME_ADVERTISE_ID             = 69,   /* 11p time advertisement */
+       DOT11_MNG_RRM_CAP_ID                    = 70,   /* 11k radio measurement capability */
+       DOT11_MNG_MULTIPLE_BSSID_ID             = 71,   /* 11k multiple BSSID id */
+       DOT11_MNG_HT_BSS_COEXINFO_ID            = 72,   /* d11 mgmt OBSS Coexistence INFO */
+       DOT11_MNG_HT_BSS_CHANNEL_REPORT_ID      = 73,   /* d11 mgmt OBSS Intolerant Channel list */
+       DOT11_MNG_HT_OBSS_ID                    = 74,   /* d11 mgmt OBSS HT info */
+       DOT11_MNG_MMIE_ID                       = 76,   /* d11 mgmt MIC IE */
+       DOT11_MNG_NONTRANS_BSSID_CAP_ID         = 83,   /* 11k nontransmitted BSSID capability */
+       DOT11_MNG_MULTIPLE_BSSIDINDEX_ID        = 85,   /* 11k multiple BSSID index */
+       DOT11_MNG_FMS_DESCR_ID                  = 86,   /* 11v FMS descriptor */
+       DOT11_MNG_FMS_REQ_ID                    = 87,   /* 11v FMS request id */
+       DOT11_MNG_FMS_RESP_ID                   = 88,   /* 11v FMS response id */
+       DOT11_MNG_BSS_MAX_IDLE_PERIOD_ID        = 90,   /* 11v bss max idle id */
+       DOT11_MNG_TFS_REQUEST_ID                = 91,   /* 11v tfs request id */
+       DOT11_MNG_TFS_RESPONSE_ID               = 92,   /* 11v tfs response id */
+       DOT11_MNG_WNM_SLEEP_MODE_ID             = 93,   /* 11v wnm-sleep mode id */
+       DOT11_MNG_TIMBC_REQ_ID                  = 94,   /* 11v TIM broadcast request id */
+       DOT11_MNG_TIMBC_RESP_ID                 = 95,   /* 11v TIM broadcast response id */
+       DOT11_MNG_CHANNEL_USAGE                 = 97,   /* 11v channel usage */
+       DOT11_MNG_TIME_ZONE_ID                  = 98,   /* 11v time zone */
+       DOT11_MNG_DMS_REQUEST_ID                = 99,   /* 11v dms request id */
+       DOT11_MNG_DMS_RESPONSE_ID               = 100,  /* 11v dms response id */
+       DOT11_MNG_LINK_IDENTIFIER_ID            = 101,  /* 11z TDLS Link Identifier IE */
+       DOT11_MNG_WAKEUP_SCHEDULE_ID            = 102,  /* 11z TDLS Wakeup Schedule IE */
+       DOT11_MNG_CHANNEL_SWITCH_TIMING_ID      = 104,  /* 11z TDLS Channel Switch Timing IE */
+       DOT11_MNG_PTI_CONTROL_ID                = 105,  /* 11z TDLS PTI Control IE */
+       DOT11_MNG_PU_BUFFER_STATUS_ID           = 106,  /* 11z TDLS PU Buffer Status IE */
+       DOT11_MNG_INTERWORKING_ID               = 107,  /* 11u interworking */
+       DOT11_MNG_ADVERTISEMENT_ID              = 108,  /* 11u advertisement protocol */
+       DOT11_MNG_EXP_BW_REQ_ID                 = 109,  /* 11u expedited bandwith request */
+       DOT11_MNG_QOS_MAP_ID                    = 110,  /* 11u QoS map set */
+       DOT11_MNG_ROAM_CONSORT_ID               = 111,  /* 11u roaming consortium */
+       DOT11_MNG_EMERGCY_ALERT_ID              = 112,  /* 11u emergency alert identifier */
+       DOT11_MNG_MESH_CONFIG                   = 113,  /* Mesh Configuration */
+       DOT11_MNG_MESH_ID                       = 114,  /* Mesh ID */
+       DOT11_MNG_MESH_PEER_MGMT_ID             = 117,  /* Mesh PEER MGMT IE */
+       DOT11_MNG_EXT_CAP_ID                    = 127,  /* d11 mgmt ext capability */
+       DOT11_MNG_EXT_PREQ_ID                   = 130,  /* Mesh PREQ IE */
+       DOT11_MNG_EXT_PREP_ID                   = 131,  /* Mesh PREP IE */
+       DOT11_MNG_EXT_PERR_ID                   = 132,  /* Mesh PERR IE */
+       DOT11_MNG_VHT_CAP_ID                    = 191,  /* d11 mgmt VHT cap id */
+       DOT11_MNG_VHT_OPERATION_ID              = 192,  /* d11 mgmt VHT op id */
+       DOT11_MNG_EXT_BSSLOAD_ID                = 193,  /* d11 mgmt VHT extended bss load id */
+       DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID     = 194,  /* Wide BW Channel Switch IE */
+       DOT11_MNG_VHT_TRANSMIT_POWER_ENVELOPE_ID= 195,  /* VHT transmit Power Envelope IE */
+       DOT11_MNG_CHANNEL_SWITCH_WRAPPER_ID     = 196,  /* Channel Switch Wrapper IE */
+       DOT11_MNG_AID_ID                        = 197,  /* Association ID  IE */
+       DOT11_MNG_OPER_MODE_NOTIF_ID            = 199,  /* d11 mgmt VHT oper mode notif */
+       DOT11_MNG_RNR_ID                        = 201,
+       /* FIXME: Use these temp. IDs until ANA assigns IDs */
+       DOT11_MNG_FTM_PARAMS_ID                 = 206,  /* mcd3.2/2014 this is not final yet */
+       DOT11_MNG_TWT_ID                        = 216,  /* 11ah D5.0 */
+       DOT11_MNG_WPA_ID                        = 221,  /* d11 management WPA id */
+       DOT11_MNG_PROPR_ID                      = 221,  /* d11 management proprietary id */
+       /* should start using this one instead of above two */
+       DOT11_MNG_VS_ID                         = 221,  /* d11 management Vendor Specific IE */
+       DOT11_MNG_MESH_CSP_ID                   = 222,  /* d11 Mesh Channel Switch Parameter */
+       DOT11_MNG_FILS_IND_ID                   = 240,  /* 11ai FILS Indication element */
+       DOT11_MNG_FRAGMENT_ID                   = 242, /* IE's fragment ID */
+       DOT11_MNG_RSNXE_ID                      = 244, /* RSN Extension Element (RSNXE) ID */
+
+       /* The follwing ID extensions should be defined >= 255
+        * i.e. the values should include 255 (DOT11_MNG_ID_EXT_ID + ID Extension).
+        */
+       DOT11_MNG_ID_EXT_ID                     = 255   /* Element ID Extension 11mc D4.3 */
+};
+#define EXT_MNG_OWE_DH_PARAM_ID                        32u     /* OWE DH Param ID - RFC 8110 */
+#define DOT11_MNG_OWE_DH_PARAM_ID              (DOT11_MNG_ID_EXT_ID + EXT_MNG_OWE_DH_PARAM_ID)
+#define EXT_MSG_PASSWORD_IDENTIFIER_ID         33u     /* Password ID EID */
+#define DOT11_MSG_PASSWORD_IDENTIFIER_ID \
+       (DOT11_MNG_ID_EXT_ID + EXT_MSG_PASSWORD_IDENTIFIER_ID)
+#define EXT_MNG_HE_CAP_ID                      35u     /* HE Capabilities, 11ax */
+#define DOT11_MNG_HE_CAP_ID                    (DOT11_MNG_ID_EXT_ID + EXT_MNG_HE_CAP_ID)
+#define EXT_MNG_HE_OP_ID                       36u     /* HE Operation IE, 11ax */
+#define DOT11_MNG_HE_OP_ID                     (DOT11_MNG_ID_EXT_ID + EXT_MNG_HE_OP_ID)
+#define EXT_MNG_UORA_ID                                37u     /* UORA Parameter Set */
+#define DOT11_MNG_UORA_ID                      (DOT11_MNG_ID_EXT_ID + EXT_MNG_UORA_ID)
+#define EXT_MNG_MU_EDCA_ID                     38u     /* MU EDCA Parameter Set */
+#define DOT11_MNG_MU_EDCA_ID                   (DOT11_MNG_ID_EXT_ID + EXT_MNG_MU_EDCA_ID)
+#define EXT_MNG_SRPS_ID                                39u     /* Spatial Reuse Parameter Set */
+#define DOT11_MNG_SRPS_ID                      (DOT11_MNG_ID_EXT_ID + EXT_MNG_SRPS_ID)
+#define EXT_MNG_BSSCOLOR_CHANGE_ID             42u     /* BSS Color Change Announcement */
+#define DOT11_MNG_BSSCOLOR_CHANGE_ID           (DOT11_MNG_ID_EXT_ID + EXT_MNG_BSSCOLOR_CHANGE_ID)
+#define EXT_MNG_SHORT_SSID_ID                  58u     /* SHORT SSID ELEMENT */
+#define DOT11_MNG_SHORT_SSID_LIST_ID           (DOT11_MNG_ID_EXT_ID + EXT_MNG_SHORT_SSID_ID)
+#define EXT_MNG_HE_6G_CAP_ID                   59u     /* HE Extended Capabilities, 11ax */
+#define DOT11_MNG_HE_6G_CAP_ID                 (DOT11_MNG_ID_EXT_ID + EXT_MNG_HE_6G_CAP_ID)
+/* FILS and OCE ext ids */
+#define FILS_EXTID_MNG_REQ_PARAMS              2u      /* FILS Request Parameters element */
+#define DOT11_MNG_FILS_REQ_PARAMS              (DOT11_MNG_ID_EXT_ID + FILS_EXTID_MNG_REQ_PARAMS)
+#define FILS_EXTID_MNG_KEY_CONFIRMATION_ID     3u      /* FILS Key Confirmation element */
+#define DOT11_MNG_FILS_KEY_CONFIRMATION                (DOT11_MNG_ID_EXT_ID +\
+                                                       FILS_EXTID_MNG_KEY_CONFIRMATION_ID)
+#define FILS_EXTID_MNG_SESSION_ID              4u      /* FILS Session element */
+#define DOT11_MNG_FILS_SESSION                 (DOT11_MNG_ID_EXT_ID + FILS_EXTID_MNG_SESSION_ID)
+#define FILS_EXTID_MNG_HLP_CONTAINER_ID                5u      /* FILS HLP Container element */
+#define DOT11_MNG_FILS_HLP_CONTAINER           (DOT11_MNG_ID_EXT_ID +\
+                                                       FILS_EXTID_MNG_HLP_CONTAINER_ID)
+#define FILS_EXTID_MNG_KEY_DELIVERY_ID         7u      /* FILS Key Delivery element */
+#define DOT11_MNG_FILS_KEY_DELIVERY            (DOT11_MNG_ID_EXT_ID +\
+                                                               FILS_EXTID_MNG_KEY_DELIVERY_ID)
+#define FILS_EXTID_MNG_WRAPPED_DATA_ID         8u      /* FILS Wrapped Data element */
+#define DOT11_MNG_FILS_WRAPPED_DATA            (DOT11_MNG_ID_EXT_ID +\
+                                                       FILS_EXTID_MNG_WRAPPED_DATA_ID)
+
+#define OCE_EXTID_MNG_ESP_ID                   11u     /* Estimated Service Parameters element */
+#define DOT11_MNG_ESP                          (DOT11_MNG_ID_EXT_ID + OCE_EXTID_MNG_ESP_ID)
+#define FILS_EXTID_MNG_PUBLIC_KEY_ID           12u     /* FILS Public Key element */
+#define DOT11_MNG_FILS_PUBLIC_KEY              (DOT11_MNG_ID_EXT_ID +\
+                                                       FILS_EXTID_MNG_PUBLIC_KEY_ID)
+#define FILS_EXTID_MNG_NONCE_ID                        13u     /* FILS Nonce element */
+#define DOT11_MNG_FILS_NONCE                   (DOT11_MNG_ID_EXT_ID + FILS_EXTID_MNG_NONCE_ID)
+#define SAE_EXT_REJECTED_GROUPS_ID             92u     /* SAE Rejected Groups element */
+#define DOT11_MNG_REJECTED_GROUPS_ID           (DOT11_MNG_ID_EXT_ID + SAE_EXT_REJECTED_GROUPS_ID)
+#define SAE_EXT_ANTICLOG_TOKEN_CONTAINER_ID    93u     /* SAE Anti-clogging token container */
+#define DOT11_MNG_ANTICLOG_TOKEN_CONTAINER_ID  (DOT11_MNG_ID_EXT_ID +\
+               SAE_EXT_ANTICLOG_TOKEN_CONTAINER_ID)
+
+/* deprecated definitions, do not use, to be deleted later */
+#define FILS_HLP_CONTAINER_EXT_ID      FILS_EXTID_MNG_HLP_CONTAINER_ID
+#define DOT11_ESP_EXT_ID               OCE_EXTID_MNG_ESP_ID
+#define FILS_REQ_PARAMS_EXT_ID         FILS_EXTID_MNG_REQ_PARAMS
+#define EXT_MNG_RAPS_ID                                37u     /* OFDMA Random Access Parameter Set */
+#define DOT11_MNG_RAPS_ID                      (DOT11_MNG_ID_EXT_ID + EXT_MNG_RAPS_ID)
+/* End of deprecated definitions */
+
+#define DOT11_MNG_IE_ID_EXT_MATCH(_ie, _id) (\
+       ((_ie)->id == DOT11_MNG_ID_EXT_ID) && \
+       ((_ie)->len > 0) && \
+       ((_id) == ((uint8 *)(_ie) + TLV_HDR_LEN)[0]))
+
+#define DOT11_MNG_IE_ID_EXT_INIT(_ie, _id, _len) do {\
+               (_ie)->id = DOT11_MNG_ID_EXT_ID; \
+               (_ie)->len = _len; \
+               (_ie)->id_ext = _id; \
+       } while (0)
+
+/* Rate Defines */
+
+/* Valid rates for the Supported Rates and Extended Supported Rates IEs.
+ * Encoding is the rate in 500kbps units, rouding up for fractional values.
+ * 802.11-2012, section 6.5.5.2, DATA_RATE parameter enumerates all the values.
+ * The rate values cover DSSS, HR/DSSS, ERP, and OFDM phy rates.
+ * The defines below do not cover the rates specific to 10MHz, {3, 4.5, 27},
+ * and 5MHz, {1.5, 2.25, 3, 4.5, 13.5}, which are not supported by Broadcom devices.
+ */
+
+#define DOT11_RATE_1M   2       /* 1  Mbps in 500kbps units */
+#define DOT11_RATE_2M   4       /* 2  Mbps in 500kbps units */
+#define DOT11_RATE_5M5  11      /* 5.5 Mbps in 500kbps units */
+#define DOT11_RATE_11M  22      /* 11 Mbps in 500kbps units */
+#define DOT11_RATE_6M   12      /* 6  Mbps in 500kbps units */
+#define DOT11_RATE_9M   18      /* 9  Mbps in 500kbps units */
+#define DOT11_RATE_12M  24      /* 12 Mbps in 500kbps units */
+#define DOT11_RATE_18M  36      /* 18 Mbps in 500kbps units */
+#define DOT11_RATE_24M  48      /* 24 Mbps in 500kbps units */
+#define DOT11_RATE_36M  72      /* 36 Mbps in 500kbps units */
+#define DOT11_RATE_48M  96      /* 48 Mbps in 500kbps units */
+#define DOT11_RATE_54M  108     /* 54 Mbps in 500kbps units */
+#define DOT11_RATE_MAX  108     /* highest rate (54 Mbps) in 500kbps units */
+
+/* Supported Rates and Extended Supported Rates IEs
+ * The supported rates octets are defined a the MSB indicatin a Basic Rate
+ * and bits 0-6 as the rate value
+ */
+#define DOT11_RATE_BASIC                0x80 /* flag for a Basic Rate */
+#define DOT11_RATE_MASK                 0x7F /* mask for numeric part of rate */
+
+/* BSS Membership Selector parameters
+ * 802.11-2016 (and 802.11ax-D1.1), Sec 9.4.2.3
+ * These selector values are advertised in Supported Rates and Extended Supported Rates IEs
+ * in the supported rates list with the Basic rate bit set.
+ * Constants below include the basic bit.
+ */
+#define DOT11_BSS_MEMBERSHIP_HT         0xFF  /* Basic 0x80 + 127, HT Required to join */
+#define DOT11_BSS_MEMBERSHIP_VHT        0xFE  /* Basic 0x80 + 126, VHT Required to join */
+#define DOT11_BSS_MEMBERSHIP_HE         0xFD  /* Basic 0x80 + 125, HE Required to join */
+#define DOT11_BSS_SAE_HASH_TO_ELEMENT  123u    /* SAE Hash-to-element Required to join */
+
+/* ERP info element bit values */
+#define DOT11_MNG_ERP_LEN                      1       /* ERP is currently 1 byte long */
+#define DOT11_MNG_NONERP_PRESENT               0x01    /* NonERP (802.11b) STAs are present
+                                                        *in the BSS
+                                                        */
+#define DOT11_MNG_USE_PROTECTION               0x02    /* Use protection mechanisms for
+                                                        *ERP-OFDM frames
+                                                        */
+#define DOT11_MNG_BARKER_PREAMBLE              0x04    /* Short Preambles: 0 == allowed,
+                                                        * 1 == not allowed
+                                                        */
+/* TS Delay element offset & size */
+#define DOT11_MGN_TS_DELAY_LEN         4       /* length of TS DELAY IE */
+#define TS_DELAY_FIELD_SIZE                    4       /* TS DELAY field size */
+
+/* Capability Information Field */
+#define DOT11_CAP_ESS                          0x0001  /* d11 cap. ESS */
+#define DOT11_CAP_IBSS                         0x0002  /* d11 cap. IBSS */
+#define DOT11_CAP_POLLABLE                     0x0004  /* d11 cap. pollable */
+#define DOT11_CAP_POLL_RQ                      0x0008  /* d11 cap. poll request */
+#define DOT11_CAP_PRIVACY                      0x0010  /* d11 cap. privacy */
+#define DOT11_CAP_SHORT                                0x0020  /* d11 cap. short */
+#define DOT11_CAP_PBCC                         0x0040  /* d11 cap. PBCC */
+#define DOT11_CAP_AGILITY                      0x0080  /* d11 cap. agility */
+#define DOT11_CAP_SPECTRUM                     0x0100  /* d11 cap. spectrum */
+#define DOT11_CAP_QOS                          0x0200  /* d11 cap. qos */
+#define DOT11_CAP_SHORTSLOT                    0x0400  /* d11 cap. shortslot */
+#define DOT11_CAP_APSD                         0x0800  /* d11 cap. apsd */
+#define DOT11_CAP_RRM                          0x1000  /* d11 cap. 11k radio measurement */
+#define DOT11_CAP_CCK_OFDM                     0x2000  /* d11 cap. CCK/OFDM */
+#define DOT11_CAP_DELAY_BA                     0x4000  /* d11 cap. delayed block ack */
+#define DOT11_CAP_IMMEDIATE_BA                 0x8000  /* d11 cap. immediate block ack */
+
+/* Extended capabilities IE bitfields */
+/* 20/40 BSS Coexistence Management support bit position */
+#define DOT11_EXT_CAP_OBSS_COEX_MGMT           0u
+/* Extended Channel Switching support bit position */
+#define DOT11_EXT_CAP_EXT_CHAN_SWITCHING       2u
+/* scheduled PSMP support bit position */
+#define DOT11_EXT_CAP_SPSMP                    6u
+/*  Flexible Multicast Service */
+#define DOT11_EXT_CAP_FMS                      11u
+/* proxy ARP service support bit position */
+#define DOT11_EXT_CAP_PROXY_ARP                        12u
+/* Civic Location */
+#define DOT11_EXT_CAP_CIVIC_LOC                        14u
+/* Geospatial Location */
+#define DOT11_EXT_CAP_LCI                      15u
+/* Traffic Filter Service */
+#define DOT11_EXT_CAP_TFS                      16u
+/* WNM-Sleep Mode */
+#define DOT11_EXT_CAP_WNM_SLEEP                        17u
+/* TIM Broadcast service */
+#define DOT11_EXT_CAP_TIMBC                    18u
+/* BSS Transition Management support bit position */
+#define DOT11_EXT_CAP_BSSTRANS_MGMT            19u
+/* Multiple BSSID support position */
+#define DOT11_EXT_CAP_MULTIBSSID               22u
+/* Direct Multicast Service */
+#define DOT11_EXT_CAP_DMS                      26u
+/* Interworking support bit position */
+#define DOT11_EXT_CAP_IW                       31u
+/* QoS map support bit position */
+#define DOT11_EXT_CAP_QOS_MAP                  32u
+/* service Interval granularity bit position and mask */
+#define DOT11_EXT_CAP_SI                       41u
+#define DOT11_EXT_CAP_SI_MASK                  0x0E
+/* Location Identifier service */
+#define DOT11_EXT_CAP_IDENT_LOC                        44u
+/* WNM notification */
+#define DOT11_EXT_CAP_WNM_NOTIF                        46u
+/* Operating mode notification - VHT (11ac D3.0 - 8.4.2.29) */
+#define DOT11_EXT_CAP_OPER_MODE_NOTIF          62u
+/* Fine timing measurement - D3.0 */
+#define DOT11_EXT_CAP_FTM_RESPONDER            70u
+#define DOT11_EXT_CAP_FTM_INITIATOR            71u /* tentative 11mcd3.0 */
+#define DOT11_EXT_CAP_FILS                     72u /* FILS Capability */
+/* TWT support */
+#define DOT11_EXT_CAP_TWT_REQUESTER            77u
+#define DOT11_EXT_CAP_TWT_RESPONDER            78u
+#define DOT11_EXT_CAP_OBSS_NB_RU_OFDMA         79u
+/* FIXME: Use these temp. IDs until ANA assigns IDs */
+#define DOT11_EXT_CAP_EMBSS_ADVERTISE          80u
+/* SAE password ID */
+#define DOT11_EXT_CAP_SAE_PWD_ID_INUSE         81u
+#define DOT11_EXT_CAP_SAE_PWD_ID_USED_EXCLUSIVE        82u
+/* TODO: Update DOT11_EXT_CAP_MAX_IDX to reflect the highest offset.
+ * Note: DOT11_EXT_CAP_MAX_IDX must only be used in attach path.
+ *       It will cause ROM invalidation otherwise.
+ */
+#define DOT11_EXT_CAP_MAX_IDX                  82u
+
+/* Remove this hack (DOT11_EXT_CAP_MAX_BIT_IDX) when no one
+ * references DOT11_EXTCAP_LEN_MAX
+ */
+#define DOT11_EXT_CAP_MAX_BIT_IDX              95u     /* !!!update this please!!! */
+
+/* Remove DOT11_EXTCAP_LEN_MAX when no one references it */
+/* extended capability */
+#ifndef DOT11_EXTCAP_LEN_MAX
+#define DOT11_EXTCAP_LEN_MAX ((DOT11_EXT_CAP_MAX_BIT_IDX + 8) >> 3)
+#endif
+/* Remove dot11_extcap when no one references it */
+BWL_PRE_PACKED_STRUCT struct dot11_extcap {
+       uint8 extcap[DOT11_EXTCAP_LEN_MAX];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_extcap dot11_extcap_t;
+
+/* VHT Operating mode bit fields -  (11ac D8.0/802.11-2016 - 9.4.1.53) */
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT 0
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_MASK 0x3
+#define DOT11_OPER_MODE_160_8080_BW_SHIFT 2
+#define DOT11_OPER_MODE_160_8080_BW_MASK 0x04
+#define DOT11_OPER_MODE_NOLDPC_SHIFT 3
+#define DOT11_OPER_MODE_NOLDPC_MASK 0x08
+#define DOT11_OPER_MODE_RXNSS_SHIFT 4
+#define DOT11_OPER_MODE_RXNSS_MASK 0x70
+#define DOT11_OPER_MODE_RXNSS_TYPE_SHIFT 7
+#define DOT11_OPER_MODE_RXNSS_TYPE_MASK 0x80
+
+#define DOT11_OPER_MODE(type, nss, chanw) (\
+       ((type) << DOT11_OPER_MODE_RXNSS_TYPE_SHIFT &\
+                DOT11_OPER_MODE_RXNSS_TYPE_MASK) |\
+       (((nss) - 1) << DOT11_OPER_MODE_RXNSS_SHIFT & DOT11_OPER_MODE_RXNSS_MASK) |\
+       ((chanw) << DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT &\
+                DOT11_OPER_MODE_CHANNEL_WIDTH_MASK))
+
+#define DOT11_D8_OPER_MODE(type, nss, ldpc, bw160_8080, chanw) (\
+       ((type) << DOT11_OPER_MODE_RXNSS_TYPE_SHIFT &\
+                DOT11_OPER_MODE_RXNSS_TYPE_MASK) |\
+       (((nss) - 1) << DOT11_OPER_MODE_RXNSS_SHIFT & DOT11_OPER_MODE_RXNSS_MASK) |\
+       ((ldpc) << DOT11_OPER_MODE_NOLDPC_SHIFT & DOT11_OPER_MODE_NOLDPC_MASK) |\
+       ((bw160_8080) << DOT11_OPER_MODE_160_8080_BW_SHIFT &\
+                DOT11_OPER_MODE_160_8080_BW_MASK) |\
+       ((chanw) << DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT &\
+                DOT11_OPER_MODE_CHANNEL_WIDTH_MASK))
+
+#define DOT11_OPER_MODE_CHANNEL_WIDTH(mode) \
+       (((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK)\
+               >> DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT)
+#define DOT11_OPER_MODE_160_8080(mode) \
+       (((mode) & DOT11_OPER_MODE_160_8080_BW_MASK)\
+               >> DOT11_OPER_MODE_160_8080_BW_SHIFT)
+#define DOT11_OPER_MODE_NOLDPC(mode) \
+               (((mode) & DOT11_OPER_MODE_NOLDPC_MASK)\
+                       >> DOT11_OPER_MODE_NOLDPC_SHIFT)
+#define DOT11_OPER_MODE_RXNSS(mode) \
+       ((((mode) & DOT11_OPER_MODE_RXNSS_MASK)         \
+               >> DOT11_OPER_MODE_RXNSS_SHIFT) + 1)
+#define DOT11_OPER_MODE_RXNSS_TYPE(mode) \
+       (((mode) & DOT11_OPER_MODE_RXNSS_TYPE_MASK)\
+               >> DOT11_OPER_MODE_RXNSS_TYPE_SHIFT)
+
+#define DOT11_OPER_MODE_20MHZ 0
+#define DOT11_OPER_MODE_40MHZ 1
+#define DOT11_OPER_MODE_80MHZ 2
+#define DOT11_OPER_MODE_160MHZ 3
+#define DOT11_OPER_MODE_8080MHZ 3
+#define DOT11_OPER_MODE_1608080MHZ 1
+
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_20MHZ(mode) (\
+       ((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_20MHZ)
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_40MHZ(mode) (\
+       ((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_40MHZ)
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_80MHZ(mode) (\
+       ((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_80MHZ)
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_160MHZ(mode) (\
+       ((mode) & DOT11_OPER_MODE_160_8080_BW_MASK))
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_8080MHZ(mode) (\
+       ((mode) & DOT11_OPER_MODE_160_8080_BW_MASK))
+
+/* Operating mode information element 802.11ac D3.0 - 8.4.2.168 */
+BWL_PRE_PACKED_STRUCT struct dot11_oper_mode_notif_ie {
+       uint8 mode;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_oper_mode_notif_ie dot11_oper_mode_notif_ie_t;
+
+#define DOT11_OPER_MODE_NOTIF_IE_LEN 1
+
+/* Extended Capability Information Field */
+#define DOT11_OBSS_COEX_MNG_SUPPORT    0x01    /* 20/40 BSS Coexistence Management support */
+
+/*
+ * Action Frame Constants
+ */
+#define DOT11_ACTION_HDR_LEN           2       /* action frame category + action field */
+#define DOT11_ACTION_CAT_OFF           0       /* category offset */
+#define DOT11_ACTION_ACT_OFF           1       /* action offset */
+
+/* Action Category field (sec 8.4.1.11) */
+#define DOT11_ACTION_CAT_ERR_MASK      0x80    /* category error mask */
+#define DOT11_ACTION_CAT_MASK          0x7F    /* category mask */
+#define DOT11_ACTION_CAT_SPECT_MNG     0       /* category spectrum management */
+#define DOT11_ACTION_CAT_QOS           1       /* category QoS */
+#define DOT11_ACTION_CAT_DLS           2       /* category DLS */
+#define DOT11_ACTION_CAT_BLOCKACK      3       /* category block ack */
+#define DOT11_ACTION_CAT_PUBLIC                4       /* category public */
+#define DOT11_ACTION_CAT_RRM           5       /* category radio measurements */
+#define DOT11_ACTION_CAT_FBT   6       /* category fast bss transition */
+#define DOT11_ACTION_CAT_HT            7       /* category for HT */
+#define        DOT11_ACTION_CAT_SA_QUERY       8       /* security association query */
+#define        DOT11_ACTION_CAT_PDPA           9       /* protected dual of public action */
+#define DOT11_ACTION_CAT_WNM           10      /* category for WNM */
+#define DOT11_ACTION_CAT_UWNM          11      /* category for Unprotected WNM */
+#define DOT11_ACTION_CAT_MESH          13      /* category for Mesh */
+#define DOT11_ACTION_CAT_SELFPROT      15      /* category for Mesh, self protected */
+#define DOT11_ACTION_NOTIFICATION      17
+#define DOT11_ACTION_CAT_VHT           21      /* VHT action */
+#define DOT11_ACTION_CAT_S1G           22      /* S1G action */
+/* FIXME: Use temp. ID until ANA assigns one */
+#define DOT11_ACTION_CAT_HE            27      /* HE action frame */
+#define DOT11_ACTION_CAT_FILS          26      /* FILS action frame */
+#define DOT11_ACTION_CAT_VSP           126     /* protected vendor specific */
+#define DOT11_ACTION_CAT_VS            127     /* category Vendor Specific */
+
+/* Spectrum Management Action IDs (sec 7.4.1) */
+#define DOT11_SM_ACTION_M_REQ          0       /* d11 action measurement request */
+#define DOT11_SM_ACTION_M_REP          1       /* d11 action measurement response */
+#define DOT11_SM_ACTION_TPC_REQ                2       /* d11 action TPC request */
+#define DOT11_SM_ACTION_TPC_REP                3       /* d11 action TPC response */
+#define DOT11_SM_ACTION_CHANNEL_SWITCH 4       /* d11 action channel switch */
+#define DOT11_SM_ACTION_EXT_CSA                5       /* d11 extened CSA for 11n */
+
+/* QoS action ids */
+#define DOT11_QOS_ACTION_ADDTS_REQ     0       /* d11 action ADDTS request */
+#define DOT11_QOS_ACTION_ADDTS_RESP    1       /* d11 action ADDTS response */
+#define DOT11_QOS_ACTION_DELTS         2       /* d11 action DELTS */
+#define DOT11_QOS_ACTION_SCHEDULE      3       /* d11 action schedule */
+#define DOT11_QOS_ACTION_QOS_MAP       4       /* d11 action QOS map */
+
+/* HT action ids */
+#define DOT11_ACTION_ID_HT_CH_WIDTH    0       /* notify channel width action id */
+#define DOT11_ACTION_ID_HT_MIMO_PS     1       /* mimo ps action id */
+
+/* Public action ids */
+#define DOT11_PUB_ACTION_BSS_COEX_MNG  0       /* 20/40 Coexistence Management action id */
+#define DOT11_PUB_ACTION_CHANNEL_SWITCH        4       /* d11 action channel switch */
+#define DOT11_PUB_ACTION_VENDOR_SPEC   9       /* Vendor specific */
+#define DOT11_PUB_ACTION_GAS_CB_REQ    12      /* GAS Comeback Request */
+#define DOT11_PUB_ACTION_FTM_REQ       32              /* FTM request */
+#define DOT11_PUB_ACTION_FTM           33              /* FTM measurement */
+#define DOT11_PUB_ACTION_FTM_REQ_TRIGGER_START 1u      /* FTM request start trigger */
+#define DOT11_PUB_ACTION_FTM_REQ_TRIGGER_STOP  0u      /* FTM request stop trigger */
+
+/* Block Ack action types */
+#define DOT11_BA_ACTION_ADDBA_REQ      0       /* ADDBA Req action frame type */
+#define DOT11_BA_ACTION_ADDBA_RESP     1       /* ADDBA Resp action frame type */
+#define DOT11_BA_ACTION_DELBA          2       /* DELBA action frame type */
+
+/* ADDBA action parameters */
+#define DOT11_ADDBA_PARAM_AMSDU_SUP    0x0001  /* AMSDU supported under BA */
+#define DOT11_ADDBA_PARAM_POLICY_MASK  0x0002  /* policy mask(ack vs delayed) */
+#define DOT11_ADDBA_PARAM_POLICY_SHIFT 1       /* policy shift */
+#define DOT11_ADDBA_PARAM_TID_MASK     0x003c  /* tid mask */
+#define DOT11_ADDBA_PARAM_TID_SHIFT    2       /* tid shift */
+#define DOT11_ADDBA_PARAM_BSIZE_MASK   0xffc0  /* buffer size mask */
+#define DOT11_ADDBA_PARAM_BSIZE_SHIFT  6       /* buffer size shift */
+
+#define DOT11_ADDBA_POLICY_DELAYED     0       /* delayed BA policy */
+#define DOT11_ADDBA_POLICY_IMMEDIATE   1       /* immediate BA policy */
+
+/* Fast Transition action types */
+#define DOT11_FT_ACTION_FT_RESERVED            0
+#define DOT11_FT_ACTION_FT_REQ                 1       /* FBT request - for over-the-DS FBT */
+#define DOT11_FT_ACTION_FT_RES                 2       /* FBT response - for over-the-DS FBT */
+#define DOT11_FT_ACTION_FT_CON                 3       /* FBT confirm - for OTDS with RRP */
+#define DOT11_FT_ACTION_FT_ACK                 4       /* FBT ack */
+
+/* DLS action types */
+#define DOT11_DLS_ACTION_REQ                   0       /* DLS Request */
+#define DOT11_DLS_ACTION_RESP                  1       /* DLS Response */
+#define DOT11_DLS_ACTION_TD                    2       /* DLS Teardown */
+
+/* Wireless Network Management (WNM) action types */
+#define DOT11_WNM_ACTION_EVENT_REQ             0
+#define DOT11_WNM_ACTION_EVENT_REP             1
+#define DOT11_WNM_ACTION_DIAG_REQ              2
+#define DOT11_WNM_ACTION_DIAG_REP              3
+#define DOT11_WNM_ACTION_LOC_CFG_REQ           4
+#define DOT11_WNM_ACTION_LOC_RFG_RESP          5
+#define DOT11_WNM_ACTION_BSSTRANS_QUERY                6
+#define DOT11_WNM_ACTION_BSSTRANS_REQ          7
+#define DOT11_WNM_ACTION_BSSTRANS_RESP         8
+#define DOT11_WNM_ACTION_FMS_REQ               9
+#define DOT11_WNM_ACTION_FMS_RESP              10
+#define DOT11_WNM_ACTION_COL_INTRFRNCE_REQ     11
+#define DOT11_WNM_ACTION_COL_INTRFRNCE_REP     12
+#define DOT11_WNM_ACTION_TFS_REQ               13
+#define DOT11_WNM_ACTION_TFS_RESP              14
+#define DOT11_WNM_ACTION_TFS_NOTIFY_REQ                15
+#define DOT11_WNM_ACTION_WNM_SLEEP_REQ         16
+#define DOT11_WNM_ACTION_WNM_SLEEP_RESP                17
+#define DOT11_WNM_ACTION_TIMBC_REQ             18
+#define DOT11_WNM_ACTION_TIMBC_RESP            19
+#define DOT11_WNM_ACTION_QOS_TRFC_CAP_UPD      20
+#define DOT11_WNM_ACTION_CHAN_USAGE_REQ                21
+#define DOT11_WNM_ACTION_CHAN_USAGE_RESP       22
+#define DOT11_WNM_ACTION_DMS_REQ               23
+#define DOT11_WNM_ACTION_DMS_RESP              24
+#define DOT11_WNM_ACTION_TMNG_MEASUR_REQ       25
+#define DOT11_WNM_ACTION_NOTFCTN_REQ           26
+#define DOT11_WNM_ACTION_NOTFCTN_RESP          27
+#define DOT11_WNM_ACTION_TFS_NOTIFY_RESP       28
+
+/* Unprotected Wireless Network Management (WNM) action types */
+#define DOT11_UWNM_ACTION_TIM                  0
+#define DOT11_UWNM_ACTION_TIMING_MEASUREMENT   1
+
+#define DOT11_MNG_COUNTRY_ID_LEN 3
+
+/* VHT category action types - 802.11ac D3.0 - 8.5.23.1 */
+#define DOT11_VHT_ACTION_CBF                           0       /* Compressed Beamforming */
+#define DOT11_VHT_ACTION_GID_MGMT                      1       /* Group ID Management */
+#define DOT11_VHT_ACTION_OPER_MODE_NOTIF       2       /* Operating mode notif'n */
+
+/* FILS category action types - 802.11ai D11.0 - 9.6.8.1 */
+#define DOT11_FILS_ACTION_DISCOVERY            34      /* FILS Discovery */
+
+/** DLS Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dls_req {
+       uint8 category;                 /* category of action frame (2) */
+       uint8 action;                           /* DLS action: req (0) */
+       struct ether_addr       da;             /* destination address */
+       struct ether_addr       sa;             /* source address */
+       uint16 cap;                             /* capability */
+       uint16 timeout;                 /* timeout value */
+       uint8 data[1];                          /* IE:support rate, extend support rate, HT cap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dls_req dot11_dls_req_t;
+#define DOT11_DLS_REQ_LEN 18   /* Fixed length */
+
+/** DLS response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dls_resp {
+       uint8 category;                 /* category of action frame (2) */
+       uint8 action;                           /* DLS action: req (0) */
+       uint16 status;                          /* status code field */
+       struct ether_addr       da;             /* destination address */
+       struct ether_addr       sa;             /* source address */
+       uint8 data[1];                          /* optional: capability, rate ... */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dls_resp dot11_dls_resp_t;
+#define DOT11_DLS_RESP_LEN 16  /* Fixed length */
+
+/* ************* 802.11v related definitions. ************* */
+
+/** BSS Management Transition Query frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_query {
+       uint8 category;                 /* category of action frame (10) */
+       uint8 action;                   /* WNM action: trans_query (6) */
+       uint8 token;                    /* dialog token */
+       uint8 reason;                   /* transition query reason */
+       uint8 data[1];                  /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bsstrans_query dot11_bsstrans_query_t;
+#define DOT11_BSSTRANS_QUERY_LEN 4     /* Fixed length */
+
+/* BTM transition reason */
+#define DOT11_BSSTRANS_REASON_UNSPECIFIED              0
+#define DOT11_BSSTRANS_REASON_EXC_FRAME_LOSS           1
+#define DOT11_BSSTRANS_REASON_EXC_TRAFFIC_DELAY                2
+#define DOT11_BSSTRANS_REASON_INSUFF_QOS_CAPACITY      3
+#define DOT11_BSSTRANS_REASON_FIRST_ASSOC              4
+#define DOT11_BSSTRANS_REASON_LOAD_BALANCING           5
+#define DOT11_BSSTRANS_REASON_BETTER_AP_FOUND          6
+#define DOT11_BSSTRANS_REASON_DEAUTH_RX                        7
+#define DOT11_BSSTRANS_REASON_8021X_EAP_AUTH_FAIL      8
+#define DOT11_BSSTRANS_REASON_4WAY_HANDSHK_FAIL                9
+#define DOT11_BSSTRANS_REASON_MANY_REPLAYCNT_FAIL      10
+#define DOT11_BSSTRANS_REASON_MANY_DATAMIC_FAIL                11
+#define DOT11_BSSTRANS_REASON_EXCEED_MAX_RETRANS       12
+#define DOT11_BSSTRANS_REASON_MANY_BCAST_DISASSOC_RX   13
+#define DOT11_BSSTRANS_REASON_MANY_BCAST_DEAUTH_RX     14
+#define DOT11_BSSTRANS_REASON_PREV_TRANSITION_FAIL     15
+#define DOT11_BSSTRANS_REASON_LOW_RSSI                 16
+#define DOT11_BSSTRANS_REASON_ROAM_FROM_NON_80211      17
+#define DOT11_BSSTRANS_REASON_RX_BTM_REQ               18
+#define DOT11_BSSTRANS_REASON_PREF_LIST_INCLUDED       19
+#define DOT11_BSSTRANS_REASON_LEAVING_ESS              20
+
+/** BSS Management Transition Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_req {
+       uint8 category;                 /* category of action frame (10) */
+       uint8 action;                   /* WNM action: trans_req (7) */
+       uint8 token;                    /* dialog token */
+       uint8 reqmode;                  /* transition request mode */
+       uint16 disassoc_tmr;            /* disassociation timer */
+       uint8 validity_intrvl;          /* validity interval */
+       uint8 data[1];                  /* optional: BSS term duration, ... */
+                                               /* ...session info URL, candidate list */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bsstrans_req dot11_bsstrans_req_t;
+#define DOT11_BSSTRANS_REQ_LEN 7       /* Fixed length */
+#define DOT11_BSSTRANS_REQ_FIXED_LEN 7u        /* Fixed length */
+
+/* BSS Mgmt Transition Request Mode Field - 802.11v */
+#define DOT11_BSSTRANS_REQMODE_PREF_LIST_INCL          0x01
+#define DOT11_BSSTRANS_REQMODE_ABRIDGED                        0x02
+#define DOT11_BSSTRANS_REQMODE_DISASSOC_IMMINENT       0x04
+#define DOT11_BSSTRANS_REQMODE_BSS_TERM_INCL           0x08
+#define DOT11_BSSTRANS_REQMODE_ESS_DISASSOC_IMNT       0x10
+
+/** BSS Management transition response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_resp {
+       uint8 category;                 /* category of action frame (10) */
+       uint8 action;                   /* WNM action: trans_resp (8) */
+       uint8 token;                    /* dialog token */
+       uint8 status;                   /* transition status */
+       uint8 term_delay;               /* validity interval */
+       uint8 data[1];                  /* optional: BSSID target, candidate list */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bsstrans_resp dot11_bsstrans_resp_t;
+#define DOT11_BSSTRANS_RESP_LEN 5      /* Fixed length */
+
+/* BSS Mgmt Transition Response Status Field */
+#define DOT11_BSSTRANS_RESP_STATUS_ACCEPT                      0
+#define DOT11_BSSTRANS_RESP_STATUS_REJECT                      1
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_INSUFF_BCN              2
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_INSUFF_CAP              3
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_TERM_UNDESIRED          4
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_TERM_DELAY_REQ          5
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_BSS_LIST_PROVIDED       6
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_NO_SUITABLE_BSS         7
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_LEAVING_ESS             8
+
+/** BSS Max Idle Period element */
+BWL_PRE_PACKED_STRUCT struct dot11_bss_max_idle_period_ie {
+       uint8 id;                               /* 90, DOT11_MNG_BSS_MAX_IDLE_PERIOD_ID */
+       uint8 len;
+       uint16 max_idle_period;                 /* in unit of 1000 TUs */
+       uint8 idle_opt;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bss_max_idle_period_ie dot11_bss_max_idle_period_ie_t;
+#define DOT11_BSS_MAX_IDLE_PERIOD_IE_LEN       3       /* bss max idle period IE size */
+#define DOT11_BSS_MAX_IDLE_PERIOD_OPT_PROTECTED        1       /* BSS max idle option */
+
+/** TIM Broadcast request element */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_req_ie {
+       uint8 id;                               /* 94, DOT11_MNG_TIMBC_REQ_ID */
+       uint8 len;
+       uint8 interval;                         /* in unit of beacon interval */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_req_ie dot11_timbc_req_ie_t;
+#define DOT11_TIMBC_REQ_IE_LEN         1       /* Fixed length */
+
+/** TIM Broadcast request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_req {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: DOT11_WNM_ACTION_TIMBC_REQ(18) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* TIM broadcast request element */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_req dot11_timbc_req_t;
+#define DOT11_TIMBC_REQ_LEN            3       /* Fixed length */
+
+/** TIM Broadcast response element */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_resp_ie {
+       uint8 id;                               /* 95, DOT11_MNG_TIM_BROADCAST_RESP_ID */
+       uint8 len;
+       uint8 status;                           /* status of add request */
+       uint8 interval;                         /* in unit of beacon interval */
+       int32 offset;                           /* in unit of ms */
+       uint16 high_rate;                       /* in unit of 0.5 Mb/s */
+       uint16 low_rate;                        /* in unit of 0.5 Mb/s */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_resp_ie dot11_timbc_resp_ie_t;
+#define DOT11_TIMBC_DENY_RESP_IE_LEN   1       /* Deny. Fixed length */
+#define DOT11_TIMBC_ACCEPT_RESP_IE_LEN 10      /* Accept. Fixed length */
+
+#define DOT11_TIMBC_STATUS_ACCEPT              0
+#define DOT11_TIMBC_STATUS_ACCEPT_TSTAMP       1
+#define DOT11_TIMBC_STATUS_DENY                        2
+#define DOT11_TIMBC_STATUS_OVERRIDDEN          3
+#define DOT11_TIMBC_STATUS_RESERVED            4
+
+/** TIM Broadcast request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_resp {
+       uint8 category;                 /* category of action frame (10) */
+       uint8 action;                   /* action: DOT11_WNM_ACTION_TIMBC_RESP(19) */
+       uint8 token;                    /* dialog token */
+       uint8 data[1];                  /* TIM broadcast response element */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_resp dot11_timbc_resp_t;
+#define DOT11_TIMBC_RESP_LEN   3       /* Fixed length */
+
+/** TIM element */
+BWL_PRE_PACKED_STRUCT struct dot11_tim_ie {
+       uint8 id;                       /* 5, DOT11_MNG_TIM_ID   */
+       uint8 len;                      /* 4 - 255 */
+       uint8 dtim_count;               /* DTIM decrementing counter */
+       uint8 dtim_period;              /* DTIM period */
+       uint8 bitmap_control;           /* AID 0 + bitmap offset */
+       uint8 pvb[1];                   /* Partial Virtual Bitmap, variable length */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tim_ie dot11_tim_ie_t;
+#define DOT11_TIM_IE_FIXED_LEN 3       /* Fixed length, without id and len */
+#define DOT11_TIM_IE_FIXED_TOTAL_LEN   5       /* Fixed length, with id and len */
+
+/** TIM Broadcast frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc {
+       uint8 category;                 /* category of action frame (11) */
+       uint8 action;                   /* action: TIM (0) */
+       uint8 check_beacon;             /* need to check-beacon */
+       uint8 tsf[8];                   /* Time Synchronization Function */
+       dot11_tim_ie_t tim_ie;          /* TIM element */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc dot11_timbc_t;
+#define DOT11_TIMBC_HDR_LEN    (sizeof(dot11_timbc_t) - sizeof(dot11_tim_ie_t))
+#define DOT11_TIMBC_FIXED_LEN  (sizeof(dot11_timbc_t) - 1)     /* Fixed length */
+#define DOT11_TIMBC_LEN                        11      /* Fixed length */
+
+/** TCLAS frame classifier type */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_hdr {
+       uint8 type;
+       uint8 mask;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_hdr dot11_tclas_fc_hdr_t;
+#define DOT11_TCLAS_FC_HDR_LEN         2       /* Fixed length */
+
+#define DOT11_TCLAS_MASK_0             0x1
+#define DOT11_TCLAS_MASK_1             0x2
+#define DOT11_TCLAS_MASK_2             0x4
+#define DOT11_TCLAS_MASK_3             0x8
+#define DOT11_TCLAS_MASK_4             0x10
+#define DOT11_TCLAS_MASK_5             0x20
+#define DOT11_TCLAS_MASK_6             0x40
+#define DOT11_TCLAS_MASK_7             0x80
+
+#define DOT11_TCLAS_FC_0_ETH           0
+#define DOT11_TCLAS_FC_1_IP            1
+#define DOT11_TCLAS_FC_2_8021Q         2
+#define DOT11_TCLAS_FC_3_OFFSET                3
+#define DOT11_TCLAS_FC_4_IP_HIGHER     4
+#define DOT11_TCLAS_FC_5_8021D         5
+
+/** TCLAS frame classifier type 0 parameters for Ethernet */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_0_eth {
+       uint8 type;
+       uint8 mask;
+       uint8 sa[ETHER_ADDR_LEN];
+       uint8 da[ETHER_ADDR_LEN];
+       uint16 eth_type;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_0_eth dot11_tclas_fc_0_eth_t;
+#define DOT11_TCLAS_FC_0_ETH_LEN       16
+
+/** TCLAS frame classifier type 1 parameters for IPV4 */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_1_ipv4 {
+       uint8 type;
+       uint8 mask;
+       uint8 version;
+       uint32 src_ip;
+       uint32 dst_ip;
+       uint16 src_port;
+       uint16 dst_port;
+       uint8 dscp;
+       uint8 protocol;
+       uint8 reserved;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_1_ipv4 dot11_tclas_fc_1_ipv4_t;
+#define DOT11_TCLAS_FC_1_IPV4_LEN      18
+
+/** TCLAS frame classifier type 2 parameters for 802.1Q */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_2_8021q {
+       uint8 type;
+       uint8 mask;
+       uint16 tci;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_2_8021q dot11_tclas_fc_2_8021q_t;
+#define DOT11_TCLAS_FC_2_8021Q_LEN     4
+
+/** TCLAS frame classifier type 3 parameters for filter offset */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_3_filter {
+       uint8 type;
+       uint8 mask;
+       uint16 offset;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_3_filter dot11_tclas_fc_3_filter_t;
+#define DOT11_TCLAS_FC_3_FILTER_LEN    4
+
+/** TCLAS frame classifier type 4 parameters for IPV4 is the same as TCLAS type 1 */
+typedef struct dot11_tclas_fc_1_ipv4 dot11_tclas_fc_4_ipv4_t;
+#define DOT11_TCLAS_FC_4_IPV4_LEN      DOT11_TCLAS_FC_1_IPV4_LEN
+
+/** TCLAS frame classifier type 4 parameters for IPV6 */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_4_ipv6 {
+       uint8 type;
+       uint8 mask;
+       uint8 version;
+       uint8 saddr[16];
+       uint8 daddr[16];
+       uint16 src_port;
+       uint16 dst_port;
+       uint8 dscp;
+       uint8 nexthdr;
+       uint8 flow_lbl[3];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_4_ipv6 dot11_tclas_fc_4_ipv6_t;
+#define DOT11_TCLAS_FC_4_IPV6_LEN      44
+
+/** TCLAS frame classifier type 5 parameters for 802.1D */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_5_8021d {
+       uint8 type;
+       uint8 mask;
+       uint8 pcp;
+       uint8 cfi;
+       uint16 vid;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_5_8021d dot11_tclas_fc_5_8021d_t;
+#define DOT11_TCLAS_FC_5_8021D_LEN     6
+
+/** TCLAS frame classifier type parameters */
+BWL_PRE_PACKED_STRUCT union dot11_tclas_fc {
+       uint8 data[1];
+       dot11_tclas_fc_hdr_t hdr;
+       dot11_tclas_fc_0_eth_t t0_eth;
+       dot11_tclas_fc_1_ipv4_t t1_ipv4;
+       dot11_tclas_fc_2_8021q_t t2_8021q;
+       dot11_tclas_fc_3_filter_t t3_filter;
+       dot11_tclas_fc_4_ipv4_t t4_ipv4;
+       dot11_tclas_fc_4_ipv6_t t4_ipv6;
+       dot11_tclas_fc_5_8021d_t t5_8021d;
+} BWL_POST_PACKED_STRUCT;
+typedef union dot11_tclas_fc dot11_tclas_fc_t;
+
+#define DOT11_TCLAS_FC_MIN_LEN         4       /* Classifier Type 2 has the min size */
+#define DOT11_TCLAS_FC_MAX_LEN         254
+
+/** TCLAS element */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_ie {
+       uint8 id;                               /* 14, DOT11_MNG_TCLAS_ID */
+       uint8 len;
+       uint8 user_priority;
+       dot11_tclas_fc_t fc;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_ie dot11_tclas_ie_t;
+#define DOT11_TCLAS_IE_LEN             3u      /* Fixed length, include id and len */
+
+/** TCLAS processing element */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_proc_ie {
+       uint8 id;                               /* 44, DOT11_MNG_TCLAS_PROC_ID */
+       uint8 len;
+       uint8 process;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_proc_ie dot11_tclas_proc_ie_t;
+#define DOT11_TCLAS_PROC_IE_LEN                3       /* Fixed length, include id and len */
+
+#define DOT11_TCLAS_PROC_LEN           1u      /* Proc ie length is always 1 byte */
+
+#define DOT11_TCLAS_PROC_MATCHALL      0       /* All high level element need to match */
+#define DOT11_TCLAS_PROC_MATCHONE      1       /* One high level element need to match */
+#define DOT11_TCLAS_PROC_NONMATCH      2       /* Non match to any high level element */
+
+/* TSPEC element defined in 802.11 std section 8.4.2.32 - Not supported */
+#define DOT11_TSPEC_IE_LEN             57      /* Fixed length */
+
+/** TFS request element */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_req_ie {
+       uint8 id;                               /* 91, DOT11_MNG_TFS_REQUEST_ID */
+       uint8 len;
+       uint8 tfs_id;
+       uint8 actcode;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_req_ie dot11_tfs_req_ie_t;
+#define DOT11_TFS_REQ_IE_LEN           2       /* Fixed length, without id and len */
+
+/** TFS request action codes (bitfield) */
+#define DOT11_TFS_ACTCODE_DELETE       1
+#define DOT11_TFS_ACTCODE_NOTIFY       2
+
+/** TFS request subelement IDs */
+#define DOT11_TFS_REQ_TFS_SE_ID                1
+#define DOT11_TFS_REQ_VENDOR_SE_ID     221
+
+/** TFS subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_se {
+       uint8 sub_id;
+       uint8 len;
+       uint8 data[1];                          /* TCLAS element(s) + optional TCLAS proc */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_se dot11_tfs_se_t;
+
+/** TFS response element */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_resp_ie {
+       uint8 id;                               /* 92, DOT11_MNG_TFS_RESPONSE_ID */
+       uint8 len;
+       uint8 tfs_id;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_resp_ie dot11_tfs_resp_ie_t;
+#define DOT11_TFS_RESP_IE_LEN          1u      /* Fixed length, without id and len */
+
+/** TFS response subelement IDs (same subelments, but different IDs than in TFS request */
+#define DOT11_TFS_RESP_TFS_STATUS_SE_ID                1
+#define DOT11_TFS_RESP_TFS_SE_ID               2
+#define DOT11_TFS_RESP_VENDOR_SE_ID            221
+
+/** TFS status subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_status_se {
+       uint8 sub_id;                           /* 92, DOT11_MNG_TFS_RESPONSE_ID */
+       uint8 len;
+       uint8 resp_st;
+       uint8 data[1];                          /* Potential dot11_tfs_se_t included */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_status_se dot11_tfs_status_se_t;
+#define DOT11_TFS_STATUS_SE_LEN                        1       /* Fixed length, without id and len */
+
+/* Following Definition should be merged to FMS_TFS macro below */
+/* TFS Response status code. Identical to FMS Element status, without N/A  */
+#define DOT11_TFS_STATUS_ACCEPT                        0
+#define DOT11_TFS_STATUS_DENY_FORMAT           1
+#define DOT11_TFS_STATUS_DENY_RESOURCE         2
+#define DOT11_TFS_STATUS_DENY_POLICY           4
+#define DOT11_TFS_STATUS_DENY_UNSPECIFIED      5
+#define DOT11_TFS_STATUS_ALTPREF_POLICY                7
+#define DOT11_TFS_STATUS_ALTPREF_TCLAS_UNSUPP  14
+
+/* FMS Element Status and TFS Response Status Definition */
+#define DOT11_FMS_TFS_STATUS_ACCEPT            0
+#define DOT11_FMS_TFS_STATUS_DENY_FORMAT       1
+#define DOT11_FMS_TFS_STATUS_DENY_RESOURCE     2
+#define DOT11_FMS_TFS_STATUS_DENY_MULTIPLE_DI  3
+#define DOT11_FMS_TFS_STATUS_DENY_POLICY       4
+#define DOT11_FMS_TFS_STATUS_DENY_UNSPECIFIED  5
+#define DOT11_FMS_TFS_STATUS_ALT_DIFF_DI       6
+#define DOT11_FMS_TFS_STATUS_ALT_POLICY                7
+#define DOT11_FMS_TFS_STATUS_ALT_CHANGE_DI     8
+#define DOT11_FMS_TFS_STATUS_ALT_MCRATE                9
+#define DOT11_FMS_TFS_STATUS_TERM_POLICY       10
+#define DOT11_FMS_TFS_STATUS_TERM_RESOURCE     11
+#define DOT11_FMS_TFS_STATUS_TERM_HIGHER_PRIO  12
+#define DOT11_FMS_TFS_STATUS_ALT_CHANGE_MDI    13
+#define DOT11_FMS_TFS_STATUS_ALT_TCLAS_UNSUPP  14
+
+/** TFS Management Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_req {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: TFS request (13) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_req dot11_tfs_req_t;
+#define DOT11_TFS_REQ_LEN              3       /* Fixed length */
+
+/** TFS Management Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_resp {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: TFS request (14) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_resp dot11_tfs_resp_t;
+#define DOT11_TFS_RESP_LEN             3       /* Fixed length */
+
+/** TFS Management Notify frame request header */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_notify_req {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: TFS notify request (15) */
+       uint8 tfs_id_cnt;                       /* TFS IDs count */
+       uint8 tfs_id[1];                        /* Array of TFS IDs */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_notify_req dot11_tfs_notify_req_t;
+#define DOT11_TFS_NOTIFY_REQ_LEN       3       /* Fixed length */
+
+/** TFS Management Notify frame response header */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_notify_resp {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: TFS notify response (28) */
+       uint8 tfs_id_cnt;                       /* TFS IDs count */
+       uint8 tfs_id[1];                        /* Array of TFS IDs */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_notify_resp dot11_tfs_notify_resp_t;
+#define DOT11_TFS_NOTIFY_RESP_LEN      3       /* Fixed length */
+
+/** WNM-Sleep Management Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_req {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: wnm-sleep request (16) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_req dot11_wnm_sleep_req_t;
+#define DOT11_WNM_SLEEP_REQ_LEN                3       /* Fixed length */
+
+/** WNM-Sleep Management Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_resp {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: wnm-sleep request (17) */
+       uint8 token;                            /* dialog token */
+       uint16 key_len;                         /* key data length */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_resp dot11_wnm_sleep_resp_t;
+#define DOT11_WNM_SLEEP_RESP_LEN       5       /* Fixed length */
+
+#define DOT11_WNM_SLEEP_SUBELEM_ID_GTK 0
+#define DOT11_WNM_SLEEP_SUBELEM_ID_IGTK        1
+
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_subelem_gtk {
+       uint8 sub_id;
+       uint8 len;
+       uint16 key_info;
+       uint8 key_length;
+       uint8 rsc[8];
+       uint8 key[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_subelem_gtk dot11_wnm_sleep_subelem_gtk_t;
+#define DOT11_WNM_SLEEP_SUBELEM_GTK_FIXED_LEN  11      /* without sub_id, len, and key */
+#define DOT11_WNM_SLEEP_SUBELEM_GTK_MAX_LEN    43      /* without sub_id and len */
+
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_subelem_igtk {
+       uint8 sub_id;
+       uint8 len;
+       uint16 key_id;
+       uint8 pn[6];
+       uint8 key[16];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_subelem_igtk dot11_wnm_sleep_subelem_igtk_t;
+#define DOT11_WNM_SLEEP_SUBELEM_IGTK_LEN 24    /* Fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_ie {
+       uint8 id;                               /* 93, DOT11_MNG_WNM_SLEEP_MODE_ID */
+       uint8 len;
+       uint8 act_type;
+       uint8 resp_status;
+       uint16 interval;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_ie dot11_wnm_sleep_ie_t;
+#define DOT11_WNM_SLEEP_IE_LEN         4       /* Fixed length */
+
+#define DOT11_WNM_SLEEP_ACT_TYPE_ENTER 0
+#define DOT11_WNM_SLEEP_ACT_TYPE_EXIT  1
+
+#define DOT11_WNM_SLEEP_RESP_ACCEPT    0
+#define DOT11_WNM_SLEEP_RESP_UPDATE    1
+#define DOT11_WNM_SLEEP_RESP_DENY      2
+#define DOT11_WNM_SLEEP_RESP_DENY_TEMP 3
+#define DOT11_WNM_SLEEP_RESP_DENY_KEY  4
+#define DOT11_WNM_SLEEP_RESP_DENY_INUSE        5
+#define DOT11_WNM_SLEEP_RESP_LAST      6
+
+/** DMS Management Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_req {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: dms request (23) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_req dot11_dms_req_t;
+#define DOT11_DMS_REQ_LEN              3       /* Fixed length */
+
+/** DMS Management Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_resp {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: dms request (24) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_resp dot11_dms_resp_t;
+#define DOT11_DMS_RESP_LEN             3       /* Fixed length */
+
+/** DMS request element */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_req_ie {
+       uint8 id;                               /* 99, DOT11_MNG_DMS_REQUEST_ID */
+       uint8 len;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_req_ie dot11_dms_req_ie_t;
+#define DOT11_DMS_REQ_IE_LEN           2       /* Fixed length */
+
+/** DMS response element */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_resp_ie {
+       uint8 id;                               /* 100, DOT11_MNG_DMS_RESPONSE_ID */
+       uint8 len;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_resp_ie dot11_dms_resp_ie_t;
+#define DOT11_DMS_RESP_IE_LEN          2       /* Fixed length */
+
+/** DMS request descriptor */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_req_desc {
+       uint8 dms_id;
+       uint8 len;
+       uint8 type;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_req_desc dot11_dms_req_desc_t;
+#define DOT11_DMS_REQ_DESC_LEN         3       /* Fixed length */
+
+#define DOT11_DMS_REQ_TYPE_ADD         0
+#define DOT11_DMS_REQ_TYPE_REMOVE      1
+#define DOT11_DMS_REQ_TYPE_CHANGE      2
+
+/** DMS response status */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_resp_st {
+       uint8 dms_id;
+       uint8 len;
+       uint8 type;
+       uint16 lsc;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_resp_st dot11_dms_resp_st_t;
+#define DOT11_DMS_RESP_STATUS_LEN      5       /* Fixed length */
+
+#define DOT11_DMS_RESP_TYPE_ACCEPT     0
+#define DOT11_DMS_RESP_TYPE_DENY       1
+#define DOT11_DMS_RESP_TYPE_TERM       2
+
+#define DOT11_DMS_RESP_LSC_UNSUPPORTED 0xFFFF
+
+/** WNM-Notification Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_notif_req {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: Notification request (26) */
+       uint8 token;                            /* dialog token */
+       uint8 type;                                /* type */
+       uint8 data[1];                          /* Sub-elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_notif_req dot11_wnm_notif_req_t;
+#define DOT11_WNM_NOTIF_REQ_LEN                4       /* Fixed length */
+
+/** FMS Management Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_req {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: fms request (9) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_req dot11_fms_req_t;
+#define DOT11_FMS_REQ_LEN              3       /* Fixed length */
+
+/** FMS Management Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_resp {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: fms request (10) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_resp dot11_fms_resp_t;
+#define DOT11_FMS_RESP_LEN             3       /* Fixed length */
+
+/** FMS Descriptor element */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_desc {
+       uint8 id;
+       uint8 len;
+       uint8 num_fms_cnt;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_desc dot11_fms_desc_t;
+#define DOT11_FMS_DESC_LEN             1       /* Fixed length */
+
+#define DOT11_FMS_CNTR_MAX             0x8
+#define DOT11_FMS_CNTR_ID_MASK         0x7
+#define DOT11_FMS_CNTR_ID_SHIFT                0x0
+#define DOT11_FMS_CNTR_COUNT_MASK      0xf1
+#define DOT11_FMS_CNTR_SHIFT           0x3
+
+/** FMS request element */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_req_ie {
+       uint8 id;
+       uint8 len;
+       uint8 fms_token;                        /* token used to identify fms stream set */
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_req_ie dot11_fms_req_ie_t;
+#define DOT11_FMS_REQ_IE_FIX_LEN               1       /* Fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_rate_id_field {
+       uint8 mask;
+       uint8 mcs_idx;
+       uint16 rate;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rate_id_field dot11_rate_id_field_t;
+#define DOT11_RATE_ID_FIELD_MCS_SEL_MASK       0x7
+#define DOT11_RATE_ID_FIELD_MCS_SEL_OFFSET     0
+#define DOT11_RATE_ID_FIELD_RATETYPE_MASK      0x18
+#define DOT11_RATE_ID_FIELD_RATETYPE_OFFSET    3
+#define DOT11_RATE_ID_FIELD_LEN                sizeof(dot11_rate_id_field_t)
+
+/** FMS request subelements */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_se {
+       uint8 sub_id;
+       uint8 len;
+       uint8 interval;
+       uint8 max_interval;
+       dot11_rate_id_field_t rate;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_se dot11_fms_se_t;
+#define DOT11_FMS_REQ_SE_LEN           6       /* Fixed length */
+
+#define DOT11_FMS_REQ_SE_ID_FMS                1       /* FMS subelement */
+#define DOT11_FMS_REQ_SE_ID_VS         221     /* Vendor Specific subelement */
+
+/** FMS response element */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_resp_ie {
+       uint8 id;
+       uint8 len;
+       uint8 fms_token;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_resp_ie dot11_fms_resp_ie_t;
+#define DOT11_FMS_RESP_IE_FIX_LEN              1       /* Fixed length */
+
+/* FMS status subelements */
+#define DOT11_FMS_STATUS_SE_ID_FMS     1       /* FMS Status */
+#define DOT11_FMS_STATUS_SE_ID_TCLAS   2       /* TCLAS Status */
+#define DOT11_FMS_STATUS_SE_ID_VS      221     /* Vendor Specific subelement */
+
+/** FMS status subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_status_se {
+       uint8 sub_id;
+       uint8 len;
+       uint8 status;
+       uint8 interval;
+       uint8 max_interval;
+       uint8 fmsid;
+       uint8 counter;
+       dot11_rate_id_field_t rate;
+       uint8 mcast_addr[ETHER_ADDR_LEN];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_status_se dot11_fms_status_se_t;
+#define DOT11_FMS_STATUS_SE_LEN                15      /* Fixed length */
+
+/** TCLAS status subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_status_se {
+       uint8 sub_id;
+       uint8 len;
+       uint8 fmsid;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_status_se dot11_tclas_status_se_t;
+#define DOT11_TCLAS_STATUS_SE_LEN              1       /* Fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_addba_req {
+       uint8 category;                         /* category of action frame (3) */
+       uint8 action;                           /* action: addba req */
+       uint8 token;                            /* identifier */
+       uint16 addba_param_set;         /* parameter set */
+       uint16 timeout;                         /* timeout in seconds */
+       uint16 start_seqnum;            /* starting sequence number */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_addba_req dot11_addba_req_t;
+#define DOT11_ADDBA_REQ_LEN            9       /* length of addba req frame */
+
+BWL_PRE_PACKED_STRUCT struct dot11_addba_resp {
+       uint8 category;                         /* category of action frame (3) */
+       uint8 action;                           /* action: addba resp */
+       uint8 token;                            /* identifier */
+       uint16 status;                          /* status of add request */
+       uint16 addba_param_set;                 /* negotiated parameter set */
+       uint16 timeout;                         /* negotiated timeout in seconds */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_addba_resp dot11_addba_resp_t;
+#define DOT11_ADDBA_RESP_LEN           9       /* length of addba resp frame */
+
+/* DELBA action parameters */
+#define DOT11_DELBA_PARAM_INIT_MASK    0x0800  /* initiator mask */
+#define DOT11_DELBA_PARAM_INIT_SHIFT   11      /* initiator shift */
+#define DOT11_DELBA_PARAM_TID_MASK     0xf000  /* tid mask */
+#define DOT11_DELBA_PARAM_TID_SHIFT    12      /* tid shift */
+
+BWL_PRE_PACKED_STRUCT struct dot11_delba {
+       uint8 category;                         /* category of action frame (3) */
+       uint8 action;                           /* action: addba req */
+       uint16 delba_param_set;                 /* paarmeter set */
+       uint16 reason;                          /* reason for dellba */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_delba dot11_delba_t;
+#define DOT11_DELBA_LEN                        6       /* length of delba frame */
+
+/* SA Query action field value */
+#define SA_QUERY_REQUEST               0
+#define SA_QUERY_RESPONSE              1
+
+/* ************* 802.11r related definitions. ************* */
+
+/** Over-the-DS Fast Transition Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_ft_req {
+       uint8 category;                 /* category of action frame (6) */
+       uint8 action;                   /* action: ft req */
+       uint8 sta_addr[ETHER_ADDR_LEN];
+       uint8 tgt_ap_addr[ETHER_ADDR_LEN];
+       uint8 data[1];                  /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ft_req dot11_ft_req_t;
+#define DOT11_FT_REQ_FIXED_LEN 14
+
+/** Over-the-DS Fast Transition Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_ft_res {
+       uint8 category;                 /* category of action frame (6) */
+       uint8 action;                   /* action: ft resp */
+       uint8 sta_addr[ETHER_ADDR_LEN];
+       uint8 tgt_ap_addr[ETHER_ADDR_LEN];
+       uint16 status;                  /* status code */
+       uint8 data[1];                  /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ft_res dot11_ft_res_t;
+#define DOT11_FT_RES_FIXED_LEN 16
+
+/** RDE RIC Data Element. */
+BWL_PRE_PACKED_STRUCT struct dot11_rde_ie {
+       uint8 id;                       /* 11r, DOT11_MNG_RDE_ID */
+       uint8 length;
+       uint8 rde_id;                   /* RDE identifier. */
+       uint8 rd_count;                 /* Resource Descriptor Count. */
+       uint16 status;                  /* Status Code. */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rde_ie dot11_rde_ie_t;
+
+/* 11r - Size of the RDE (RIC Data Element) IE, including TLV header. */
+#define DOT11_MNG_RDE_IE_LEN sizeof(dot11_rde_ie_t)
+
+/* ************* 802.11k related definitions. ************* */
+
+/* Radio measurements enabled capability ie */
+#define DOT11_RRM_CAP_LEN              5       /* length of rrm cap bitmap */
+#define RCPI_IE_LEN 1
+#define RSNI_IE_LEN 1
+BWL_PRE_PACKED_STRUCT struct dot11_rrm_cap_ie {
+       uint8 cap[DOT11_RRM_CAP_LEN];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rrm_cap_ie dot11_rrm_cap_ie_t;
+
+/* Bitmap definitions for cap ie */
+#define DOT11_RRM_CAP_LINK             0
+#define DOT11_RRM_CAP_NEIGHBOR_REPORT  1
+#define DOT11_RRM_CAP_PARALLEL         2
+#define DOT11_RRM_CAP_REPEATED         3
+#define DOT11_RRM_CAP_BCN_PASSIVE      4
+#define DOT11_RRM_CAP_BCN_ACTIVE       5
+#define DOT11_RRM_CAP_BCN_TABLE                6
+#define DOT11_RRM_CAP_BCN_REP_COND     7
+#define DOT11_RRM_CAP_FM               8
+#define DOT11_RRM_CAP_CLM              9
+#define DOT11_RRM_CAP_NHM              10
+#define DOT11_RRM_CAP_SM               11
+#define DOT11_RRM_CAP_LCIM             12
+#define DOT11_RRM_CAP_LCIA             13
+#define DOT11_RRM_CAP_TSCM             14
+#define DOT11_RRM_CAP_TTSCM            15
+#define DOT11_RRM_CAP_AP_CHANREP       16
+#define DOT11_RRM_CAP_RMMIB            17
+/* bit18-bit23, not used for RRM_IOVAR */
+#define DOT11_RRM_CAP_MPC0             24
+#define DOT11_RRM_CAP_MPC1             25
+#define DOT11_RRM_CAP_MPC2             26
+#define DOT11_RRM_CAP_MPTI             27
+#define DOT11_RRM_CAP_NBRTSFO          28
+#define DOT11_RRM_CAP_RCPI             29
+#define DOT11_RRM_CAP_RSNI             30
+#define DOT11_RRM_CAP_BSSAAD           31
+#define DOT11_RRM_CAP_BSSAAC           32
+#define DOT11_RRM_CAP_AI               33
+#define DOT11_RRM_CAP_FTM_RANGE                34
+#define DOT11_RRM_CAP_CIVIC_LOC                35
+#define DOT11_RRM_CAP_IDENT_LOC                36
+#define DOT11_RRM_CAP_LAST             36
+
+#ifdef WL11K_ALL_MEAS
+#define DOT11_RRM_CAP_LINK_ENAB                        (1 << DOT11_RRM_CAP_LINK)
+#define DOT11_RRM_CAP_FM_ENAB                  (1 << (DOT11_RRM_CAP_FM - 8))
+#define DOT11_RRM_CAP_CLM_ENAB                 (1 << (DOT11_RRM_CAP_CLM - 8))
+#define DOT11_RRM_CAP_NHM_ENAB                 (1 << (DOT11_RRM_CAP_NHM - 8))
+#define DOT11_RRM_CAP_SM_ENAB                  (1 << (DOT11_RRM_CAP_SM - 8))
+#define DOT11_RRM_CAP_LCIM_ENAB                        (1 << (DOT11_RRM_CAP_LCIM - 8))
+#define DOT11_RRM_CAP_TSCM_ENAB                        (1 << (DOT11_RRM_CAP_TSCM - 8))
+#ifdef WL11K_AP
+#define DOT11_RRM_CAP_MPC0_ENAB                        (1 << (DOT11_RRM_CAP_MPC0 - 24))
+#define DOT11_RRM_CAP_MPC1_ENAB                        (1 << (DOT11_RRM_CAP_MPC1 - 24))
+#define DOT11_RRM_CAP_MPC2_ENAB                        (1 << (DOT11_RRM_CAP_MPC2 - 24))
+#define DOT11_RRM_CAP_MPTI_ENAB                        (1 << (DOT11_RRM_CAP_MPTI - 24))
+#else
+#define DOT11_RRM_CAP_MPC0_ENAB                        0
+#define DOT11_RRM_CAP_MPC1_ENAB                        0
+#define DOT11_RRM_CAP_MPC2_ENAB                        0
+#define DOT11_RRM_CAP_MPTI_ENAB                        0
+#endif /* WL11K_AP */
+#define DOT11_RRM_CAP_CIVIC_LOC_ENAB           (1 << (DOT11_RRM_CAP_CIVIC_LOC - 32))
+#define DOT11_RRM_CAP_IDENT_LOC_ENAB           (1 << (DOT11_RRM_CAP_IDENT_LOC - 32))
+#else
+#define DOT11_RRM_CAP_LINK_ENAB                        0
+#define DOT11_RRM_CAP_FM_ENAB                  0
+#define DOT11_RRM_CAP_CLM_ENAB                 0
+#define DOT11_RRM_CAP_NHM_ENAB                 0
+#define DOT11_RRM_CAP_SM_ENAB                  0
+#define DOT11_RRM_CAP_LCIM_ENAB                        0
+#define DOT11_RRM_CAP_TSCM_ENAB                        0
+#define DOT11_RRM_CAP_MPC0_ENAB                        0
+#define DOT11_RRM_CAP_MPC1_ENAB                        0
+#define DOT11_RRM_CAP_MPC2_ENAB                        0
+#define DOT11_RRM_CAP_MPTI_ENAB                        0
+#define DOT11_RRM_CAP_CIVIC_LOC_ENAB           0
+#define DOT11_RRM_CAP_IDENT_LOC_ENAB           0
+#endif /* WL11K_ALL_MEAS */
+#ifdef WL11K_NBR_MEAS
+#define DOT11_RRM_CAP_NEIGHBOR_REPORT_ENAB     (1 << DOT11_RRM_CAP_NEIGHBOR_REPORT)
+#else
+#define DOT11_RRM_CAP_NEIGHBOR_REPORT_ENAB     0
+#endif /* WL11K_NBR_MEAS */
+#ifdef WL11K_BCN_MEAS
+#define DOT11_RRM_CAP_BCN_PASSIVE_ENAB         (1 << DOT11_RRM_CAP_BCN_PASSIVE)
+#define DOT11_RRM_CAP_BCN_ACTIVE_ENAB          (1 << DOT11_RRM_CAP_BCN_ACTIVE)
+#else
+#define DOT11_RRM_CAP_BCN_PASSIVE_ENAB         0
+#define DOT11_RRM_CAP_BCN_ACTIVE_ENAB          0
+#endif /* WL11K_BCN_MEAS */
+#define DOT11_RRM_CAP_MPA_MASK         0x7
+/* Operating Class (formerly "Regulatory Class") definitions */
+#define DOT11_OP_CLASS_NONE                    255
+
+BWL_PRE_PACKED_STRUCT struct do11_ap_chrep {
+       uint8 id;
+       uint8 len;
+       uint8 reg;
+       uint8 chanlist[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct do11_ap_chrep dot11_ap_chrep_t;
+
+/* Radio Measurements action ids */
+#define DOT11_RM_ACTION_RM_REQ         0       /* Radio measurement request */
+#define DOT11_RM_ACTION_RM_REP         1       /* Radio measurement report */
+#define DOT11_RM_ACTION_LM_REQ         2       /* Link measurement request */
+#define DOT11_RM_ACTION_LM_REP         3       /* Link measurement report */
+#define DOT11_RM_ACTION_NR_REQ         4       /* Neighbor report request */
+#define DOT11_RM_ACTION_NR_REP         5       /* Neighbor report response */
+#define DOT11_PUB_ACTION_MP            7       /* Measurement Pilot public action id */
+
+/** Generic radio measurement action frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_rm_action {
+       uint8 category;                         /* category of action frame (5) */
+       uint8 action;                           /* radio measurement action */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rm_action dot11_rm_action_t;
+#define DOT11_RM_ACTION_LEN 3
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq {
+       uint8 category;                         /* category of action frame (5) */
+       uint8 action;                           /* radio measurement action */
+       uint8 token;                            /* dialog token */
+       uint16 reps;                            /* no. of repetitions */
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq dot11_rmreq_t;
+#define DOT11_RMREQ_LEN        5
+
+BWL_PRE_PACKED_STRUCT struct dot11_rm_ie {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rm_ie dot11_rm_ie_t;
+#define DOT11_RM_IE_LEN        5
+
+/* Definitions for "mode" bits in rm req */
+#define DOT11_RMREQ_MODE_PARALLEL      1
+#define DOT11_RMREQ_MODE_ENABLE                2
+#define DOT11_RMREQ_MODE_REQUEST       4
+#define DOT11_RMREQ_MODE_REPORT                8
+#define DOT11_RMREQ_MODE_DURMAND       0x10    /* Duration Mandatory */
+
+/* Definitions for "mode" bits in rm rep */
+#define DOT11_RMREP_MODE_LATE          1
+#define DOT11_RMREP_MODE_INCAPABLE     2
+#define DOT11_RMREP_MODE_REFUSED       4
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_bcn {
+       uint8 id;               /* use dot11_rm_ie_t ? */
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 reg;
+       uint8 channel;
+       uint16 interval;
+       uint16 duration;
+       uint8 bcn_mode;
+       struct ether_addr       bssid;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_bcn dot11_rmreq_bcn_t;
+#define DOT11_RMREQ_BCN_LEN    18u
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_bcn {
+       uint8 reg;
+       uint8 channel;
+       uint32 starttime[2];
+       uint16 duration;
+       uint8 frame_info;
+       uint8 rcpi;
+       uint8 rsni;
+       struct ether_addr       bssid;
+       uint8 antenna_id;
+       uint32 parent_tsf;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_bcn dot11_rmrep_bcn_t;
+#define DOT11_RMREP_BCN_LEN    26
+
+/* Beacon request measurement mode */
+#define DOT11_RMREQ_BCN_PASSIVE        0
+#define DOT11_RMREQ_BCN_ACTIVE 1
+#define DOT11_RMREQ_BCN_TABLE  2
+
+/* Sub-element IDs for Beacon Request */
+#define DOT11_RMREQ_BCN_SSID_ID 0
+#define DOT11_RMREQ_BCN_REPINFO_ID  1
+#define DOT11_RMREQ_BCN_REPDET_ID   2
+#define DOT11_RMREQ_BCN_REQUEST_ID  10
+#define DOT11_RMREQ_BCN_APCHREP_ID  DOT11_MNG_AP_CHREP_ID
+#define DOT11_RMREQ_BCN_LAST_RPT_IND_REQ_ID 164
+
+/* Reporting Detail element definition */
+#define DOT11_RMREQ_BCN_REPDET_FIXED   0       /* Fixed length fields only */
+#define DOT11_RMREQ_BCN_REPDET_REQUEST 1       /* + requested information elems */
+#define DOT11_RMREQ_BCN_REPDET_ALL     2       /* All fields */
+
+/* Reporting Information (reporting condition) element definition */
+#define DOT11_RMREQ_BCN_REPINFO_LEN    2       /* Beacon Reporting Information length */
+#define DOT11_RMREQ_BCN_REPCOND_DEFAULT        0       /* Report to be issued after each measurement */
+
+/* Last Beacon Report Indication Request definition */
+#define DOT11_RMREQ_BCN_LAST_RPT_IND_REQ_ENAB  1
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_last_bcn_rpt_ind_req {
+       uint8 id;                       /* DOT11_RMREQ_BCN_LAST_RPT_IND_REQ_ID */
+       uint8 len;                      /* length of remaining fields */
+       uint8 data;                     /* data = 1 means last bcn rpt ind requested */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_last_bcn_rpt_ind_req dot11_rmrep_last_bcn_rpt_ind_req_t;
+
+/* Sub-element IDs for Beacon Report */
+#define DOT11_RMREP_BCN_FRM_BODY       1
+#define DOT11_RMREP_BCN_FRM_BODY_FRAG_ID       2
+#define DOT11_RMREP_BCN_LAST_RPT_IND 164
+#define DOT11_RMREP_BCN_FRM_BODY_LEN_MAX       224 /* 802.11k-2008 7.3.2.22.6 */
+
+/* Refer IEEE P802.11-REVmd/D1.0 9.4.2.21.7 Beacon report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_bcn_frm_body_fragmt_id {
+       uint8 id;                       /* DOT11_RMREP_BCN_FRM_BODY_FRAG_ID */
+       uint8 len;                      /* length of remaining fields */
+       /* More fragments(B15), fragment Id(B8-B14), Bcn rpt instance ID (B0 - B7) */
+       uint16 frag_info_rpt_id;
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct dot11_rmrep_bcn_frm_body_fragmt_id dot11_rmrep_bcn_frm_body_fragmt_id_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_bcn_frm_body_frag_id {
+       uint8 id;                       /* DOT11_RMREP_BCN_FRM_BODY_FRAG_ID */
+       uint8 len;                      /* length of remaining fields */
+       uint8 bcn_rpt_id;               /* Bcn rpt instance ID */
+       uint8 frag_info;                /* fragment Id(7 bits) | More fragments(1 bit) */
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct dot11_rmrep_bcn_frm_body_frag_id dot11_rmrep_bcn_frm_body_frag_id_t;
+#define DOT11_RMREP_BCNRPT_FRAG_ID_DATA_LEN  2u
+#define DOT11_RMREP_BCNRPT_FRAG_ID_SE_LEN sizeof(dot11_rmrep_bcn_frm_body_frag_id_t)
+#define DOT11_RMREP_BCNRPT_FRAG_ID_NUM_SHIFT  1u
+#define DOT11_RMREP_BCNRPT_FRAGMT_ID_SE_LEN sizeof(dot11_rmrep_bcn_frm_body_fragmt_id_t)
+#define DOT11_RMREP_BCNRPT_BCN_RPT_ID_MASK  0x00FFu
+#define DOT11_RMREP_BCNRPT_FRAGMT_ID_NUM_SHIFT  8u
+#define DOT11_RMREP_BCNRPT_FRAGMT_ID_NUM_MASK  0x7F00u
+#define DOT11_RMREP_BCNRPT_MORE_FRAG_SHIFT  15u
+#define DOT11_RMREP_BCNRPT_MORE_FRAG_MASK  0x8000u
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_last_bcn_rpt_ind {
+       uint8 id;                       /* DOT11_RMREP_BCN_LAST_RPT_IND */
+       uint8 len;                      /* length of remaining fields */
+       uint8 data;                     /* data = 1 is last bcn rpt */
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct dot11_rmrep_last_bcn_rpt_ind dot11_rmrep_last_bcn_rpt_ind_t;
+#define DOT11_RMREP_LAST_BCN_RPT_IND_DATA_LEN 1
+#define DOT11_RMREP_LAST_BCN_RPT_IND_SE_LEN sizeof(dot11_rmrep_last_bcn_rpt_ind_t)
+
+/* Sub-element IDs for Frame Report */
+#define DOT11_RMREP_FRAME_COUNT_REPORT 1
+
+/* Channel load request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_chanload {
+       uint8 id;               /* use dot11_rm_ie_t ? */
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 reg;
+       uint8 channel;
+       uint16 interval;
+       uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_chanload dot11_rmreq_chanload_t;
+#define DOT11_RMREQ_CHANLOAD_LEN       11
+
+/** Channel load report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_chanload {
+       uint8 reg;
+       uint8 channel;
+       uint32 starttime[2];
+       uint16 duration;
+       uint8 channel_load;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_chanload dot11_rmrep_chanload_t;
+#define DOT11_RMREP_CHANLOAD_LEN       13
+
+/** Noise histogram request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_noise {
+       uint8 id;               /* use dot11_rm_ie_t ? */
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 reg;
+       uint8 channel;
+       uint16 interval;
+       uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_noise dot11_rmreq_noise_t;
+#define DOT11_RMREQ_NOISE_LEN 11
+
+/** Noise histogram report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_noise {
+       uint8 reg;
+       uint8 channel;
+       uint32 starttime[2];
+       uint16 duration;
+       uint8 antid;
+       uint8 anpi;
+       uint8 ipi0_dens;
+       uint8 ipi1_dens;
+       uint8 ipi2_dens;
+       uint8 ipi3_dens;
+       uint8 ipi4_dens;
+       uint8 ipi5_dens;
+       uint8 ipi6_dens;
+       uint8 ipi7_dens;
+       uint8 ipi8_dens;
+       uint8 ipi9_dens;
+       uint8 ipi10_dens;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_noise dot11_rmrep_noise_t;
+#define DOT11_RMREP_NOISE_LEN 25
+
+/** Frame request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_frame {
+       uint8 id;               /* use dot11_rm_ie_t ? */
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 reg;
+       uint8 channel;
+       uint16 interval;
+       uint16 duration;
+       uint8 req_type;
+       struct ether_addr       ta;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_frame dot11_rmreq_frame_t;
+#define DOT11_RMREQ_FRAME_LEN 18
+
+/** Frame report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_frame {
+       uint8 reg;
+       uint8 channel;
+       uint32 starttime[2];
+       uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_frame dot11_rmrep_frame_t;
+#define DOT11_RMREP_FRAME_LEN 12
+
+/** Frame report entry */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_frmentry {
+       struct ether_addr       ta;
+       struct ether_addr       bssid;
+       uint8 phy_type;
+       uint8 avg_rcpi;
+       uint8 last_rsni;
+       uint8 last_rcpi;
+       uint8 ant_id;
+       uint16 frame_cnt;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_frmentry dot11_rmrep_frmentry_t;
+#define DOT11_RMREP_FRMENTRY_LEN 19
+
+/** STA statistics request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_stat {
+       uint8 id;               /* use dot11_rm_ie_t ? */
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       struct ether_addr       peer;
+       uint16 interval;
+       uint16 duration;
+       uint8 group_id;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_stat dot11_rmreq_stat_t;
+#define DOT11_RMREQ_STAT_LEN 16
+
+/** STA statistics report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_stat {
+       uint16 duration;
+       uint8 group_id;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_stat dot11_rmrep_stat_t;
+
+/* Statistics Group Report: Group IDs */
+enum {
+       DOT11_RRM_STATS_GRP_ID_0 = 0,
+       DOT11_RRM_STATS_GRP_ID_1,
+       DOT11_RRM_STATS_GRP_ID_2,
+       DOT11_RRM_STATS_GRP_ID_3,
+       DOT11_RRM_STATS_GRP_ID_4,
+       DOT11_RRM_STATS_GRP_ID_5,
+       DOT11_RRM_STATS_GRP_ID_6,
+       DOT11_RRM_STATS_GRP_ID_7,
+       DOT11_RRM_STATS_GRP_ID_8,
+       DOT11_RRM_STATS_GRP_ID_9,
+       DOT11_RRM_STATS_GRP_ID_10,
+       DOT11_RRM_STATS_GRP_ID_11,
+       DOT11_RRM_STATS_GRP_ID_12,
+       DOT11_RRM_STATS_GRP_ID_13,
+       DOT11_RRM_STATS_GRP_ID_14,
+       DOT11_RRM_STATS_GRP_ID_15,
+       DOT11_RRM_STATS_GRP_ID_16
+};
+
+/* Statistics Group Report: Group Data length  */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_0       28
+typedef struct rrm_stat_group_0 {
+       uint32  txfrag;
+       uint32  txmulti;
+       uint32  txfail;
+       uint32  rxframe;
+       uint32  rxmulti;
+       uint32  rxbadfcs;
+       uint32  txframe;
+} rrm_stat_group_0_t;
+
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_1       24
+typedef struct rrm_stat_group_1 {
+       uint32  txretry;
+       uint32  txretries;
+       uint32  rxdup;
+       uint32  txrts;
+       uint32  rtsfail;
+       uint32  ackfail;
+} rrm_stat_group_1_t;
+
+/* group 2-9 use same qos data structure (tid 0-7), total 52 bytes */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_2_9     52
+typedef struct rrm_stat_group_qos {
+       uint32  txfrag;
+       uint32  txfail;
+       uint32  txretry;
+       uint32  txretries;
+       uint32  rxdup;
+       uint32  txrts;
+       uint32  rtsfail;
+       uint32  ackfail;
+       uint32  rxfrag;
+       uint32  txframe;
+       uint32  txdrop;
+       uint32  rxmpdu;
+       uint32  rxretries;
+} rrm_stat_group_qos_t;
+
+/* dot11BSSAverageAccessDelay Group (only available at an AP): 8 byte */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_10      8
+typedef BWL_PRE_PACKED_STRUCT struct rrm_stat_group_10 {
+       uint8   apavgdelay;
+       uint8   avgdelaybe;
+       uint8   avgdelaybg;
+       uint8   avgdelayvi;
+       uint8   avgdelayvo;
+       uint16  stacount;
+       uint8   chanutil;
+} BWL_POST_PACKED_STRUCT rrm_stat_group_10_t;
+
+/* AMSDU, 40 bytes */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_11      40
+typedef struct rrm_stat_group_11 {
+       uint32  txamsdu;
+       uint32  amsdufail;
+       uint32  amsduretry;
+       uint32  amsduretries;
+       uint32  txamsdubyte_h;
+       uint32  txamsdubyte_l;
+       uint32  amsduackfail;
+       uint32  rxamsdu;
+       uint32  rxamsdubyte_h;
+       uint32  rxamsdubyte_l;
+} rrm_stat_group_11_t;
+
+/* AMPDU, 36 bytes */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_12      36
+typedef struct rrm_stat_group_12 {
+       uint32  txampdu;
+       uint32  txmpdu;
+       uint32  txampdubyte_h;
+       uint32  txampdubyte_l;
+       uint32  rxampdu;
+       uint32  rxmpdu;
+       uint32  rxampdubyte_h;
+       uint32  rxampdubyte_l;
+       uint32  ampducrcfail;
+} rrm_stat_group_12_t;
+
+/* BACK etc, 36 bytes */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_13      36
+typedef struct rrm_stat_group_13 {
+       uint32  rximpbarfail;
+       uint32  rxexpbarfail;
+       uint32  chanwidthsw;
+       uint32  txframe20mhz;
+       uint32  txframe40mhz;
+       uint32  rxframe20mhz;
+       uint32  rxframe40mhz;
+       uint32  psmpgrantdur;
+       uint32  psmpuseddur;
+} rrm_stat_group_13_t;
+
+/* RD Dual CTS etc, 36 bytes */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_14      36
+typedef struct rrm_stat_group_14 {
+       uint32  grantrdgused;
+       uint32  grantrdgunused;
+       uint32  txframeingrantrdg;
+       uint32  txbyteingrantrdg_h;
+       uint32  txbyteingrantrdg_l;
+       uint32  dualcts;
+       uint32  dualctsfail;
+       uint32  rtslsi;
+       uint32  rtslsifail;
+} rrm_stat_group_14_t;
+
+/* bf and STBC etc, 20 bytes */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_15      20
+typedef struct rrm_stat_group_15 {
+       uint32  bfframe;
+       uint32  stbccts;
+       uint32  stbcctsfail;
+       uint32  nonstbccts;
+       uint32  nonstbcctsfail;
+} rrm_stat_group_15_t;
+
+/* RSNA, 28 bytes */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_16      28
+typedef struct rrm_stat_group_16 {
+       uint32  rsnacmacicverr;
+       uint32  rsnacmacreplay;
+       uint32  rsnarobustmgmtccmpreplay;
+       uint32  rsnatkipicverr;
+       uint32  rsnatkipicvreplay;
+       uint32  rsnaccmpdecrypterr;
+       uint32  rsnaccmpreplay;
+} rrm_stat_group_16_t;
+
+/* Transmit stream/category measurement request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_tx_stream {
+       uint8 id;               /* use dot11_rm_ie_t ? */
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint16 interval;
+       uint16 duration;
+       struct ether_addr       peer;
+       uint8 traffic_id;
+       uint8 bin0_range;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_tx_stream dot11_rmreq_tx_stream_t;
+#define DOT11_RMREQ_TXSTREAM_LEN       17
+
+/** Transmit stream/category measurement report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_tx_stream {
+       uint32 starttime[2];
+       uint16 duration;
+       struct ether_addr       peer;
+       uint8 traffic_id;
+       uint8 reason;
+       uint32 txmsdu_cnt;
+       uint32 msdu_discarded_cnt;
+       uint32 msdufailed_cnt;
+       uint32 msduretry_cnt;
+       uint32 cfpolls_lost_cnt;
+       uint32 avrqueue_delay;
+       uint32 avrtx_delay;
+       uint8 bin0_range;
+       uint32 bin0;
+       uint32 bin1;
+       uint32 bin2;
+       uint32 bin3;
+       uint32 bin4;
+       uint32 bin5;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_tx_stream dot11_rmrep_tx_stream_t;
+#define DOT11_RMREP_TXSTREAM_LEN       71
+
+typedef struct rrm_tscm {
+       uint32 msdu_tx;
+       uint32 msdu_exp;
+       uint32 msdu_fail;
+       uint32 msdu_retries;
+       uint32 cfpolls_lost;
+       uint32 queue_delay;
+       uint32 tx_delay_sum;
+       uint32 tx_delay_cnt;
+       uint32 bin0_range_us;
+       uint32 bin0;
+       uint32 bin1;
+       uint32 bin2;
+       uint32 bin3;
+       uint32 bin4;
+       uint32 bin5;
+} rrm_tscm_t;
+enum {
+       DOT11_FTM_LOCATION_SUBJ_LOCAL = 0,              /* Where am I? */
+       DOT11_FTM_LOCATION_SUBJ_REMOTE = 1,             /* Where are you? */
+       DOT11_FTM_LOCATION_SUBJ_THIRDPARTY = 2   /* Where is he/she? */
+};
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_ftm_lci {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 subj;
+
+       /* Following 3 fields are unused. Keep for ROM compatibility. */
+       uint8 lat_res;
+       uint8 lon_res;
+       uint8 alt_res;
+
+       /* optional sub-elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_ftm_lci dot11_rmreq_ftm_lci_t;
+#define DOT11_RMREQ_LCI_LEN    9
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_ftm_lci {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 lci_sub_id;
+       uint8 lci_sub_len;
+       /* optional LCI field */
+       /* optional sub-elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_ftm_lci dot11_rmrep_ftm_lci_t;
+
+#define DOT11_FTM_LCI_SUBELEM_ID               0
+#define DOT11_FTM_LCI_SUBELEM_LEN              2
+#define DOT11_FTM_LCI_FIELD_LEN                        16
+#define DOT11_FTM_LCI_UNKNOWN_LEN              2
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_ftm_civic {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 subj;
+       uint8 civloc_type;
+       uint8 siu;      /* service interval units */
+       uint16 si;  /* service interval */
+       /* optional sub-elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_ftm_civic dot11_rmreq_ftm_civic_t;
+#define DOT11_RMREQ_CIVIC_LEN  10
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_ftm_civic {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 civloc_type;
+       uint8 civloc_sub_id;
+       uint8 civloc_sub_len;
+       /* optional location civic field */
+       /* optional sub-elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_ftm_civic dot11_rmrep_ftm_civic_t;
+
+#define DOT11_FTM_CIVIC_LOC_TYPE_RFC4776       0
+#define DOT11_FTM_CIVIC_SUBELEM_ID             0
+#define DOT11_FTM_CIVIC_SUBELEM_LEN            2
+#define DOT11_FTM_CIVIC_LOC_SI_NONE            0
+#define DOT11_FTM_CIVIC_TYPE_LEN               1
+#define DOT11_FTM_CIVIC_UNKNOWN_LEN            3
+
+/* Location Identifier measurement request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_locid {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 subj;
+       uint8 siu;
+       uint16 si;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_locid dot11_rmreq_locid_t;
+#define DOT11_RMREQ_LOCID_LEN  9
+
+/* Location Identifier measurement report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_locid {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 exp_tsf[8];
+       uint8 locid_sub_id;
+       uint8 locid_sub_len;
+       /* optional location identifier field */
+       /* optional sub-elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_locid dot11_rmrep_locid_t;
+#define DOT11_LOCID_UNKNOWN_LEN                10
+#define DOT11_LOCID_SUBELEM_ID         0
+
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_range_subel {
+       uint8 id;
+       uint8 len;
+       uint16 max_age;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_range_subel dot11_ftm_range_subel_t;
+#define DOT11_FTM_RANGE_SUBELEM_ID      4
+#define DOT11_FTM_RANGE_SUBELEM_LEN     2
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_ftm_range {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint16 max_init_delay;          /* maximum random initial delay */
+       uint8 min_ap_count;
+       uint8 data[1];
+       /* neighbor report sub-elements */
+       /* optional sub-elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_ftm_range dot11_rmreq_ftm_range_t;
+#define DOT11_RMREQ_FTM_RANGE_LEN 8
+
+#define DOT11_FTM_RANGE_LEN            3
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_range_entry {
+       uint32 start_tsf;               /* 4 lsb of tsf */
+       struct ether_addr bssid;
+       uint8 range[DOT11_FTM_RANGE_LEN];
+       uint8 max_err[DOT11_FTM_RANGE_LEN];
+       uint8  rsvd;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_range_entry dot11_ftm_range_entry_t;
+#define DOT11_FTM_RANGE_ENTRY_MAX_COUNT   15
+
+enum {
+       DOT11_FTM_RANGE_ERROR_AP_INCAPABLE = 2,
+       DOT11_FTM_RANGE_ERROR_AP_FAILED = 3,
+       DOT11_FTM_RANGE_ERROR_TX_FAILED = 8,
+       DOT11_FTM_RANGE_ERROR_MAX
+};
+
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_range_error_entry {
+       uint32 start_tsf;               /* 4 lsb of tsf */
+       struct ether_addr bssid;
+       uint8  code;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_range_error_entry dot11_ftm_range_error_entry_t;
+#define DOT11_FTM_RANGE_ERROR_ENTRY_MAX_COUNT   11
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_ftm_range {
+    uint8 id;
+    uint8 len;
+    uint8 token;
+    uint8 mode;
+    uint8 type;
+    uint8 entry_count;
+    uint8 data[2]; /* includes pad */
+       /*
+       dot11_ftm_range_entry_t entries[entry_count];
+       uint8 error_count;
+       dot11_ftm_error_entry_t errors[error_count];
+        */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_ftm_range dot11_rmrep_ftm_range_t;
+
+#define DOT11_FTM_RANGE_REP_MIN_LEN     6       /* No extra byte for error_count */
+#define DOT11_FTM_RANGE_ENTRY_CNT_MAX   15
+#define DOT11_FTM_RANGE_ERROR_CNT_MAX   11
+#define DOT11_FTM_RANGE_REP_FIXED_LEN   1       /* No extra byte for error_count */
+/** Measurement pause request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_pause_time {
+       uint8 id;               /* use dot11_rm_ie_t ? */
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint16 pause_time;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_pause_time dot11_rmreq_pause_time_t;
+#define DOT11_RMREQ_PAUSE_LEN  7
+
+/* Neighbor Report subelements ID (11k & 11v) */
+#define DOT11_NGBR_TSF_INFO_SE_ID      1
+#define DOT11_NGBR_CCS_SE_ID           2
+#define DOT11_NGBR_BSSTRANS_PREF_SE_ID 3
+#define DOT11_NGBR_BSS_TERM_DUR_SE_ID  4
+#define DOT11_NGBR_BEARING_SE_ID       5
+#define DOT11_NGBR_WIDE_BW_CHAN_SE_ID  6 /* proposed */
+
+/** Neighbor Report, BSS Transition Candidate Preference subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_ngbr_bsstrans_pref_se {
+       uint8 sub_id;
+       uint8 len;
+       uint8 preference;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ngbr_bsstrans_pref_se dot11_ngbr_bsstrans_pref_se_t;
+#define DOT11_NGBR_BSSTRANS_PREF_SE_LEN                1
+#define DOT11_NGBR_BSSTRANS_PREF_SE_IE_LEN     3
+#define DOT11_NGBR_BSSTRANS_PREF_SE_HIGHEST    0xff
+
+/** Neighbor Report, BSS Termination Duration subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_ngbr_bss_term_dur_se {
+       uint8 sub_id;
+       uint8 len;
+       uint8 tsf[8];
+       uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ngbr_bss_term_dur_se dot11_ngbr_bss_term_dur_se_t;
+#define DOT11_NGBR_BSS_TERM_DUR_SE_LEN 10
+
+/* Neighbor Report BSSID Information Field */
+#define DOT11_NGBR_BI_REACHABILTY_UNKN 0x0002
+#define DOT11_NGBR_BI_REACHABILTY      0x0003
+#define DOT11_NGBR_BI_SEC              0x0004
+#define DOT11_NGBR_BI_KEY_SCOPE                0x0008
+#define DOT11_NGBR_BI_CAP              0x03f0
+#define DOT11_NGBR_BI_CAP_SPEC_MGMT    0x0010
+#define DOT11_NGBR_BI_CAP_QOS          0x0020
+#define DOT11_NGBR_BI_CAP_APSD         0x0040
+#define DOT11_NGBR_BI_CAP_RDIO_MSMT    0x0080
+#define DOT11_NGBR_BI_CAP_DEL_BA       0x0100
+#define DOT11_NGBR_BI_CAP_IMM_BA       0x0200
+#define DOT11_NGBR_BI_MOBILITY         0x0400
+#define DOT11_NGBR_BI_HT               0x0800
+#define DOT11_NGBR_BI_VHT              0x1000
+#define DOT11_NGBR_BI_FTM              0x2000
+
+/** Neighbor Report element (11k & 11v) */
+BWL_PRE_PACKED_STRUCT struct dot11_neighbor_rep_ie {
+       uint8 id;
+       uint8 len;
+       struct ether_addr bssid;
+       uint32 bssid_info;
+       uint8 reg;              /* Operating class */
+       uint8 channel;
+       uint8 phytype;
+       uint8 data[1];          /* Variable size subelements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_neighbor_rep_ie dot11_neighbor_rep_ie_t;
+#define DOT11_NEIGHBOR_REP_IE_FIXED_LEN        13u
+
+/* MLME Enumerations */
+#define DOT11_BSSTYPE_INFRASTRUCTURE           0       /* d11 infrastructure */
+#define DOT11_BSSTYPE_INDEPENDENT              1       /* d11 independent */
+#define DOT11_BSSTYPE_ANY                      2       /* d11 any BSS type */
+#define DOT11_BSSTYPE_MESH                     3       /* d11 Mesh */
+#define DOT11_SCANTYPE_ACTIVE                  0       /* d11 scan active */
+#define DOT11_SCANTYPE_PASSIVE                 1       /* d11 scan passive */
+
+/** Link Measurement */
+BWL_PRE_PACKED_STRUCT struct dot11_lmreq {
+       uint8 category;                         /* category of action frame (5) */
+       uint8 action;                           /* radio measurement action */
+       uint8 token;                            /* dialog token */
+       uint8 txpwr;                            /* Transmit Power Used */
+       uint8 maxtxpwr;                         /* Max Transmit Power */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_lmreq dot11_lmreq_t;
+#define DOT11_LMREQ_LEN        5
+
+BWL_PRE_PACKED_STRUCT struct dot11_lmrep {
+       uint8 category;                         /* category of action frame (5) */
+       uint8 action;                           /* radio measurement action */
+       uint8 token;                            /* dialog token */
+       dot11_tpc_rep_t tpc;                    /* TPC element */
+       uint8 rxant;                            /* Receive Antenna ID */
+       uint8 txant;                            /* Transmit Antenna ID */
+       uint8 rcpi;                             /* RCPI */
+       uint8 rsni;                             /* RSNI */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_lmrep dot11_lmrep_t;
+#define DOT11_LMREP_LEN        11
+
+#define DOT11_MP_CAP_SPECTRUM                  0x01    /* d11 cap. spectrum */
+#define DOT11_MP_CAP_SHORTSLOT                 0x02    /* d11 cap. shortslot */
+/* Measurement Pilot */
+BWL_PRE_PACKED_STRUCT struct dot11_mprep {
+       uint8 cap_info;                         /* Condensed capability Info. */
+       uint8 country[2];                               /* Condensed country string */
+       uint8 opclass;                          /* Op. Class */
+       uint8 channel;                          /* Channel */
+       uint8 mp_interval;                      /* Measurement Pilot Interval */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_mprep dot11_mprep_t;
+#define DOT11_MPREP_LEN        6
+
+/* 802.11 BRCM "Compromise" Pre N constants */
+#define PREN_PREAMBLE          24      /* green field preamble time */
+#define PREN_MM_EXT            12      /* extra mixed mode preamble time */
+#define PREN_PREAMBLE_EXT      4       /* extra preamble (multiply by unique_streams-1) */
+
+/* 802.11N PHY constants */
+#define RIFS_11N_TIME          2       /* NPHY RIFS time */
+
+/* 802.11 HT PLCP format 802.11n-2009, sec 20.3.9.4.3
+ * HT-SIG is composed of two 24 bit parts, HT-SIG1 and HT-SIG2
+ */
+/* HT-SIG1 */
+#define HT_SIG1_MCS_MASK        0x00007F
+#define HT_SIG1_CBW             0x000080
+#define HT_SIG1_HT_LENGTH       0xFFFF00
+
+/* HT-SIG2 */
+#define HT_SIG2_SMOOTHING       0x000001
+#define HT_SIG2_NOT_SOUNDING    0x000002
+#define HT_SIG2_RESERVED        0x000004
+#define HT_SIG2_AGGREGATION     0x000008
+#define HT_SIG2_STBC_MASK       0x000030
+#define HT_SIG2_STBC_SHIFT      4
+#define HT_SIG2_FEC_CODING      0x000040
+#define HT_SIG2_SHORT_GI        0x000080
+#define HT_SIG2_ESS_MASK        0x000300
+#define HT_SIG2_ESS_SHIFT       8
+#define HT_SIG2_CRC             0x03FC00
+#define HT_SIG2_TAIL            0x1C0000
+
+/* HT Timing-related parameters (802.11-2012, sec 20.3.6) */
+#define HT_T_LEG_PREAMBLE      16
+#define HT_T_L_SIG              4
+#define HT_T_SIG                8
+#define HT_T_LTF1               4
+#define HT_T_GF_LTF1            8
+#define HT_T_LTFs               4
+#define HT_T_STF                4
+#define HT_T_GF_STF             8
+#define HT_T_SYML               4
+
+#define HT_N_SERVICE           16       /* bits in SERVICE field */
+#define HT_N_TAIL               6       /* tail bits per BCC encoder */
+
+/* 802.11 A PHY constants */
+#define APHY_SLOT_TIME          9       /* APHY slot time */
+#define APHY_SIFS_TIME          16      /* APHY SIFS time */
+#define APHY_DIFS_TIME          (APHY_SIFS_TIME + (2 * APHY_SLOT_TIME))  /* APHY DIFS time */
+#define APHY_PREAMBLE_TIME      16      /* APHY preamble time */
+#define APHY_SIGNAL_TIME        4       /* APHY signal time */
+#define APHY_SYMBOL_TIME        4       /* APHY symbol time */
+#define APHY_SERVICE_NBITS      16      /* APHY service nbits */
+#define APHY_TAIL_NBITS         6       /* APHY tail nbits */
+#define APHY_CWMIN              15      /* APHY cwmin */
+#define APHY_PHYHDR_DUR                20      /* APHY PHY Header Duration */
+
+/* 802.11 B PHY constants */
+#define BPHY_SLOT_TIME          20      /* BPHY slot time */
+#define BPHY_SIFS_TIME          10      /* BPHY SIFS time */
+#define BPHY_DIFS_TIME          50      /* BPHY DIFS time */
+#define BPHY_PLCP_TIME          192     /* BPHY PLCP time */
+#define BPHY_PLCP_SHORT_TIME    96      /* BPHY PLCP short time */
+#define BPHY_CWMIN              31      /* BPHY cwmin */
+#define BPHY_SHORT_PHYHDR_DUR  96      /* BPHY Short PHY Header Duration */
+#define BPHY_LONG_PHYHDR_DUR   192     /* BPHY Long PHY Header Duration */
+
+/* 802.11 G constants */
+#define DOT11_OFDM_SIGNAL_EXTENSION    6       /* d11 OFDM signal extension */
+
+#define PHY_CWMAX              1023    /* PHY cwmax */
+
+#define        DOT11_MAXNUMFRAGS       16      /* max # fragments per MSDU */
+
+/* 802.11 VHT constants */
+
+typedef int vht_group_id_t;
+
+/* for VHT-A1 */
+/* SIG-A1 reserved bits */
+#define VHT_SIGA1_CONST_MASK            0x800004
+
+#define VHT_SIGA1_BW_MASK               0x000003
+#define VHT_SIGA1_20MHZ_VAL             0x000000
+#define VHT_SIGA1_40MHZ_VAL             0x000001
+#define VHT_SIGA1_80MHZ_VAL             0x000002
+#define VHT_SIGA1_160MHZ_VAL            0x000003
+
+#define VHT_SIGA1_STBC                  0x000008
+
+#define VHT_SIGA1_GID_MASK              0x0003f0
+#define VHT_SIGA1_GID_SHIFT             4
+#define VHT_SIGA1_GID_TO_AP             0x00
+#define VHT_SIGA1_GID_NOT_TO_AP         0x3f
+#define VHT_SIGA1_GID_MAX_GID           0x3f
+
+#define VHT_SIGA1_NSTS_SHIFT_MASK_USER0 0x001C00
+#define VHT_SIGA1_NSTS_SHIFT            10
+#define VHT_SIGA1_MAX_USERPOS           3
+
+#define VHT_SIGA1_PARTIAL_AID_MASK      0x3fe000
+#define VHT_SIGA1_PARTIAL_AID_SHIFT     13
+
+#define VHT_SIGA1_TXOP_PS_NOT_ALLOWED   0x400000
+
+/* for VHT-A2 */
+#define VHT_SIGA2_GI_NONE               0x000000
+#define VHT_SIGA2_GI_SHORT              0x000001
+#define VHT_SIGA2_GI_W_MOD10            0x000002
+#define VHT_SIGA2_CODING_LDPC           0x000004
+#define VHT_SIGA2_LDPC_EXTRA_OFDM_SYM   0x000008
+#define VHT_SIGA2_BEAMFORM_ENABLE       0x000100
+#define VHT_SIGA2_MCS_SHIFT             4
+
+#define VHT_SIGA2_B9_RESERVED           0x000200
+#define VHT_SIGA2_TAIL_MASK             0xfc0000
+#define VHT_SIGA2_TAIL_VALUE            0x000000
+
+/* VHT Timing-related parameters (802.11ac D4.0, sec 22.3.6) */
+#define VHT_T_LEG_PREAMBLE      16
+#define VHT_T_L_SIG              4
+#define VHT_T_SIG_A              8
+#define VHT_T_LTF                4
+#define VHT_T_STF                4
+#define VHT_T_SIG_B              4
+#define VHT_T_SYML               4
+
+#define VHT_N_SERVICE           16     /* bits in SERVICE field */
+#define VHT_N_TAIL               6     /* tail bits per BCC encoder */
+
+/** dot11Counters Table - 802.11 spec., Annex D */
+typedef struct d11cnt {
+       uint32          txfrag;         /* dot11TransmittedFragmentCount */
+       uint32          txmulti;        /* dot11MulticastTransmittedFrameCount */
+       uint32          txfail;         /* dot11FailedCount */
+       uint32          txretry;        /* dot11RetryCount */
+       uint32          txretrie;       /* dot11MultipleRetryCount */
+       uint32          rxdup;          /* dot11FrameduplicateCount */
+       uint32          txrts;          /* dot11RTSSuccessCount */
+       uint32          txnocts;        /* dot11RTSFailureCount */
+       uint32          txnoack;        /* dot11ACKFailureCount */
+       uint32          rxfrag;         /* dot11ReceivedFragmentCount */
+       uint32          rxmulti;        /* dot11MulticastReceivedFrameCount */
+       uint32          rxcrc;          /* dot11FCSErrorCount */
+       uint32          txfrmsnt;       /* dot11TransmittedFrameCount */
+       uint32          rxundec;        /* dot11WEPUndecryptableCount */
+} d11cnt_t;
+
+/* OUI for BRCM proprietary IE */
+#define BRCM_PROP_OUI          "\x00\x90\x4C"  /* Broadcom proprietary OUI */
+
+/* Broadcom Proprietary OUI type list. Please update below page when adding a new type.
+ * Twiki http://hwnbu-twiki.sj.broadcom.com/bin/view/Mwgroup/WlBrcmPropIE
+ */
+/* The following BRCM_PROP_OUI types are currently in use (defined in
+ * relevant subsections). Each of them will be in a separate proprietary(221) IE
+ * #define RWL_WIFI_DEFAULT            0
+ * #define SES_VNDR_IE_TYPE            1   (defined in src/ses/shared/ses.h)
+ * #define VHT_FEATURES_IE_TYPE                4
+ * #define RWL_WIFI_FIND_MY_PEER       9
+ * #define RWL_WIFI_FOUND_PEER         10
+ * #define PROXD_IE_TYPE               11
+ */
+
+#define BRCM_FTM_IE_TYPE               14
+
+/* #define HT_CAP_IE_TYPE              51
+ * #define HT_ADD_IE_TYPE              52
+ * #define BRCM_EXTCH_IE_TYPE          53
+ * #define MEMBER_OF_BRCM_PROP_IE_TYPE 54
+ * #define BRCM_RELMACST_IE_TYPE       55
+ * #define BRCM_EVT_WL_BSS_INFO                64
+ * #define RWL_ACTION_WIFI_FRAG_TYPE   85
+ * #define BTC_INFO_BRCM_PROP_IE_TYPE  90
+ * #define ULB_BRCM_PROP_IE_TYPE       91
+ * #define SDB_BRCM_PROP_IE_TYPE       92
+ */
+
+/* Action frame type for RWL */
+#define RWL_WIFI_DEFAULT               0
+#define RWL_WIFI_FIND_MY_PEER          9 /* Used while finding server */
+#define RWL_WIFI_FOUND_PEER            10 /* Server response to the client  */
+#define RWL_ACTION_WIFI_FRAG_TYPE      85 /* Fragment indicator for receiver */
+
+#define PROXD_AF_TYPE                  11 /* Wifi proximity action frame type */
+#define BRCM_RELMACST_AF_TYPE          12 /* RMC action frame type */
+
+/* Action frame type for FTM Initiator Report */
+#define BRCM_FTM_VS_AF_TYPE    14
+enum {
+       BRCM_FTM_VS_INITIATOR_RPT_SUBTYPE = 1,  /* FTM Initiator Report */
+       BRCM_FTM_VS_COLLECT_SUBTYPE = 2,        /* FTM Collect debug protocol */
+};
+
+/* Action frame type for vendor specific action frames */
+#define        VS_AF_TYPE      221
+
+/*
+ * This BRCM_PROP_OUI types is intended for use in events to embed additional
+ * data, and would not be expected to appear on the air -- but having an IE
+ * format allows IE frame data with extra data in events in that allows for
+ * more flexible parsing.
+ */
+#define BRCM_EVT_WL_BSS_INFO   64
+
+/**
+ * Following is the generic structure for brcm_prop_ie (uses BRCM_PROP_OUI).
+ * DPT uses this format with type set to DPT_IE_TYPE
+ */
+BWL_PRE_PACKED_STRUCT struct brcm_prop_ie_s {
+       uint8 id;               /* IE ID, 221, DOT11_MNG_PROPR_ID */
+       uint8 len;              /* IE length */
+       uint8 oui[3];           /* Proprietary OUI, BRCM_PROP_OUI */
+       uint8 type;             /* type of this IE */
+       uint16 cap;             /* DPT capabilities */
+} BWL_POST_PACKED_STRUCT;
+typedef struct brcm_prop_ie_s brcm_prop_ie_t;
+
+#define BRCM_PROP_IE_LEN       6       /* len of fixed part of brcm_prop ie */
+
+#define DPT_IE_TYPE             2
+
+#define BRCM_SYSCAP_IE_TYPE    3
+#define WET_TUNNEL_IE_TYPE     3
+
+/* brcm syscap_ie cap */
+#define BRCM_SYSCAP_WET_TUNNEL 0x0100  /* Device with WET_TUNNEL support */
+
+/* BRCM OUI: Used in the proprietary(221) IE in all broadcom devices */
+#define BRCM_OUI               "\x00\x10\x18"  /* Broadcom OUI */
+
+/** BRCM info element */
+BWL_PRE_PACKED_STRUCT struct brcm_ie {
+       uint8   id;             /* IE ID, 221, DOT11_MNG_PROPR_ID */
+       uint8   len;            /* IE length */
+       uint8   oui[3];         /* Proprietary OUI, BRCM_OUI */
+       uint8   ver;            /* type/ver of this IE */
+       uint8   assoc;          /* # of assoc STAs */
+       uint8   flags;          /* misc flags */
+       uint8   flags1;         /* misc flags */
+       uint16  amsdu_mtu_pref; /* preferred A-MSDU MTU */
+       uint8   flags2;         /* Bit 0: DTPC TX cap, Bit 1: DTPC Recv Cap */
+} BWL_POST_PACKED_STRUCT;
+typedef        struct brcm_ie brcm_ie_t;
+#define BRCM_IE_LEN            12u     /* BRCM IE length */
+#define BRCM_IE_VER            2u      /* BRCM IE version */
+#define BRCM_IE_LEGACY_AES_VER 1u      /* BRCM IE legacy AES version */
+
+/* brcm_ie flags */
+#define        BRF_ABCAP               0x1     /* afterburner is obsolete,  defined for backward compat */
+#define        BRF_ABRQRD              0x2     /* afterburner is obsolete,  defined for backward compat */
+#define        BRF_LZWDS               0x4     /* lazy wds enabled */
+#define        BRF_BLOCKACK            0x8     /* BlockACK capable */
+#define BRF_ABCOUNTER_MASK     0xf0    /* afterburner is obsolete,  defined for backward compat */
+#define BRF_PROP_11N_MCS       0x10    /* re-use afterburner bit */
+#define BRF_MEDIA_CLIENT       0x20    /* re-use afterburner bit to indicate media client device */
+
+/**
+ * Support for Broadcom proprietary HT MCS rates. Re-uses afterburner bits since
+ * afterburner is not used anymore. Checks for BRF_ABCAP to stay compliant with 'old'
+ * images in the field.
+ */
+#define GET_BRF_PROP_11N_MCS(brcm_ie) \
+       (!((brcm_ie)->flags & BRF_ABCAP) && ((brcm_ie)->flags & BRF_PROP_11N_MCS))
+
+/* brcm_ie flags1 */
+#define        BRF1_AMSDU              0x1     /* A-MSDU capable */
+#define        BRF1_WNM                0x2     /* WNM capable */
+#define BRF1_WMEPS             0x4     /* AP is capable of handling WME + PS w/o APSD */
+#define BRF1_PSOFIX            0x8     /* AP has fixed PS mode out-of-order packets */
+#define        BRF1_RX_LARGE_AGG       0x10    /* device can rx large aggregates */
+#define BRF1_RFAWARE_DCS       0x20    /* RFAWARE dynamic channel selection (DCS) */
+#define BRF1_SOFTAP            0x40    /* Configure as Broadcom SOFTAP */
+#define BRF1_DWDS              0x80    /* DWDS capable */
+
+/* brcm_ie flags2 */
+#define BRF2_DTPC_TX           0x1u    /* DTPC: DTPC TX Cap */
+#define BRF2_DTPC_RX           0x2u    /* DTPC: DTPC RX Cap */
+#define BRF2_DTPC_TX_RX                0x3u    /* DTPC: Enable Both DTPC TX and RX Cap */
+
+/** Vendor IE structure */
+BWL_PRE_PACKED_STRUCT struct vndr_ie {
+       uchar id;
+       uchar len;
+       uchar oui [3];
+       uchar data [1];   /* Variable size data */
+} BWL_POST_PACKED_STRUCT;
+typedef struct vndr_ie vndr_ie_t;
+
+#define VNDR_IE_HDR_LEN                2u      /* id + len field */
+#define VNDR_IE_MIN_LEN                3u      /* size of the oui field */
+#define VNDR_IE_FIXED_LEN      (VNDR_IE_HDR_LEN + VNDR_IE_MIN_LEN)
+
+#define VNDR_IE_MAX_LEN                255u    /* vendor IE max length, without ID and len */
+
+/** BRCM PROP DEVICE PRIMARY MAC ADDRESS IE */
+BWL_PRE_PACKED_STRUCT struct member_of_brcm_prop_ie {
+       uchar id;
+       uchar len;
+       uchar oui[3];
+       uint8   type;           /* type indicates what follows */
+       struct ether_addr ea;   /* Device Primary MAC Adrress */
+} BWL_POST_PACKED_STRUCT;
+typedef struct member_of_brcm_prop_ie member_of_brcm_prop_ie_t;
+
+#define MEMBER_OF_BRCM_PROP_IE_LEN             10      /* IE max length */
+#define MEMBER_OF_BRCM_PROP_IE_HDRLEN          (sizeof(member_of_brcm_prop_ie_t))
+#define MEMBER_OF_BRCM_PROP_IE_TYPE            54      /* used in prop IE 221 only */
+
+/** BRCM Reliable Multicast IE */
+BWL_PRE_PACKED_STRUCT struct relmcast_brcm_prop_ie {
+       uint8 id;
+       uint8 len;
+       uint8 oui[3];
+       uint8 type;           /* type indicates what follows */
+       struct ether_addr ea;   /* The ack sender's MAC Adrress */
+       struct ether_addr mcast_ea;  /* The multicast MAC address */
+       uint8 updtmo; /* time interval(second) for client to send null packet to report its rssi */
+} BWL_POST_PACKED_STRUCT;
+typedef struct relmcast_brcm_prop_ie relmcast_brcm_prop_ie_t;
+
+/* IE length */
+/* BRCM_PROP_IE_LEN = sizeof(relmcast_brcm_prop_ie_t)-((sizeof (id) + sizeof (len)))? */
+#define RELMCAST_BRCM_PROP_IE_LEN      (sizeof(relmcast_brcm_prop_ie_t)-(2*sizeof(uint8)))
+
+#define RELMCAST_BRCM_PROP_IE_TYPE     55      /* used in prop IE 221 only */
+
+/* BRCM BTC IE */
+BWL_PRE_PACKED_STRUCT struct btc_brcm_prop_ie {
+       uint8 id;
+       uint8 len;
+       uint8 oui[3];
+       uint8 type;           /* type inidicates what follows */
+       uint32 info;
+} BWL_POST_PACKED_STRUCT;
+typedef struct btc_brcm_prop_ie btc_brcm_prop_ie_t;
+
+#define BTC_INFO_BRCM_PROP_IE_TYPE     90
+#define BRCM_BTC_INFO_TYPE_LEN (sizeof(btc_brcm_prop_ie_t) - (2 * sizeof(uint8)))
+
+/* ************* HT definitions. ************* */
+#define MCSSET_LEN     16      /* 16-bits per 8-bit set to give 128-bits bitmap of MCS Index */
+#define MAX_MCS_NUM    (128)   /* max mcs number = 128 */
+#define BASIC_HT_MCS   0xFFu   /* HT MCS supported rates */
+
+BWL_PRE_PACKED_STRUCT struct ht_cap_ie {
+       uint16  cap;
+       uint8   params;
+       uint8   supp_mcs[MCSSET_LEN];
+       uint16  ext_htcap;
+       uint32  txbf_cap;
+       uint8   as_cap;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_cap_ie ht_cap_ie_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_ht_cap_ie {
+       uint8   id;
+       uint8   len;
+       ht_cap_ie_t ht_cap;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ht_cap_ie dot11_ht_cap_ie_t;
+
+/* CAP IE: HT 1.0 spec. simply stole a 802.11 IE, we use our prop. IE until this is resolved */
+/* the capability IE is primarily used to convey this nodes abilities */
+BWL_PRE_PACKED_STRUCT struct ht_prop_cap_ie {
+       uint8   id;             /* IE ID, 221, DOT11_MNG_PROPR_ID */
+       uint8   len;            /* IE length */
+       uint8   oui[3];         /* Proprietary OUI, BRCM_PROP_OUI */
+       uint8   type;           /* type indicates what follows */
+       ht_cap_ie_t cap_ie;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_prop_cap_ie ht_prop_cap_ie_t;
+
+#define HT_PROP_IE_OVERHEAD    4       /* overhead bytes for prop oui ie */
+#define HT_CAP_IE_LEN          26      /* HT capability len (based on .11n d2.0) */
+#define HT_CAP_IE_TYPE         51      /* used in prop IE 221 only */
+
+#define HT_CAP_LDPC_CODING     0x0001  /* Support for rx of LDPC coded pkts */
+#define HT_CAP_40MHZ           0x0002  /* FALSE:20Mhz, TRUE:20/40MHZ supported */
+#define HT_CAP_MIMO_PS_MASK    0x000C  /* Mimo PS mask */
+#define HT_CAP_MIMO_PS_SHIFT   0x0002  /* Mimo PS shift */
+#define HT_CAP_MIMO_PS_OFF     0x0003  /* Mimo PS, no restriction */
+#define HT_CAP_MIMO_PS_RTS     0x0001  /* Mimo PS, send RTS/CTS around MIMO frames */
+#define HT_CAP_MIMO_PS_ON      0x0000  /* Mimo PS, MIMO disallowed */
+#define HT_CAP_GF              0x0010  /* Greenfield preamble support */
+#define HT_CAP_SHORT_GI_20     0x0020  /* 20MHZ short guard interval support */
+#define HT_CAP_SHORT_GI_40     0x0040  /* 40Mhz short guard interval support */
+#define HT_CAP_TX_STBC         0x0080  /* Tx STBC support */
+#define HT_CAP_RX_STBC_MASK    0x0300  /* Rx STBC mask */
+#define HT_CAP_RX_STBC_SHIFT   8       /* Rx STBC shift */
+#define HT_CAP_DELAYED_BA      0x0400  /* delayed BA support */
+#define HT_CAP_MAX_AMSDU       0x0800  /* Max AMSDU size in bytes , 0=3839, 1=7935 */
+
+#define HT_CAP_DSSS_CCK        0x1000  /* DSSS/CCK supported by the BSS */
+#define HT_CAP_PSMP            0x2000  /* Power Save Multi Poll support */
+#define HT_CAP_40MHZ_INTOLERANT 0x4000 /* 40MHz Intolerant */
+#define HT_CAP_LSIG_TXOP       0x8000  /* L-SIG TXOP protection support */
+
+#define HT_CAP_RX_STBC_NO              0x0     /* no rx STBC support */
+#define HT_CAP_RX_STBC_ONE_STREAM      0x1     /* rx STBC support of 1 spatial stream */
+#define HT_CAP_RX_STBC_TWO_STREAM      0x2     /* rx STBC support of 1-2 spatial streams */
+#define HT_CAP_RX_STBC_THREE_STREAM    0x3     /* rx STBC support of 1-3 spatial streams */
+
+#define HT_CAP_TXBF_CAP_IMPLICIT_TXBF_RX       0x1
+#define HT_CAP_TXBF_CAP_NDP_RX                 0x8
+#define HT_CAP_TXBF_CAP_NDP_TX                 0x10
+#define HT_CAP_TXBF_CAP_EXPLICIT_CSI           0x100
+#define HT_CAP_TXBF_CAP_EXPLICIT_NC_STEERING   0x200
+#define HT_CAP_TXBF_CAP_EXPLICIT_C_STEERING    0x400
+#define HT_CAP_TXBF_CAP_EXPLICIT_CSI_FB_MASK   0x1800
+#define HT_CAP_TXBF_CAP_EXPLICIT_CSI_FB_SHIFT  11
+#define HT_CAP_TXBF_CAP_EXPLICIT_NC_FB_MASK    0x6000
+#define HT_CAP_TXBF_CAP_EXPLICIT_NC_FB_SHIFT   13
+#define HT_CAP_TXBF_CAP_EXPLICIT_C_FB_MASK     0x18000
+#define HT_CAP_TXBF_CAP_EXPLICIT_C_FB_SHIFT    15
+#define HT_CAP_TXBF_CAP_CSI_BFR_ANT_SHIFT      19
+#define HT_CAP_TXBF_CAP_NC_BFR_ANT_SHIFT       21
+#define HT_CAP_TXBF_CAP_C_BFR_ANT_SHIFT                23
+#define HT_CAP_TXBF_CAP_C_BFR_ANT_MASK         0x1800000
+
+#define HT_CAP_TXBF_CAP_CHAN_ESTIM_SHIFT       27
+#define HT_CAP_TXBF_CAP_CHAN_ESTIM_MASK                0x18000000
+
+#define HT_CAP_TXBF_FB_TYPE_NONE       0
+#define HT_CAP_TXBF_FB_TYPE_DELAYED    1
+#define HT_CAP_TXBF_FB_TYPE_IMMEDIATE  2
+#define HT_CAP_TXBF_FB_TYPE_BOTH       3
+
+#define HT_CAP_TX_BF_CAP_EXPLICIT_CSI_FB_MASK  0x400
+#define HT_CAP_TX_BF_CAP_EXPLICIT_CSI_FB_SHIFT 10
+#define HT_CAP_TX_BF_CAP_EXPLICIT_COMPRESSED_FB_MASK 0x18000
+#define HT_CAP_TX_BF_CAP_EXPLICIT_COMPRESSED_FB_SHIFT 15
+
+#define HT_CAP_MCS_FLAGS_SUPP_BYTE 12 /* byte offset in HT Cap Supported MCS for various flags */
+#define HT_CAP_MCS_RX_8TO15_BYTE_OFFSET                1
+#define HT_CAP_MCS_FLAGS_TX_RX_UNEQUAL              0x02
+#define HT_CAP_MCS_FLAGS_MAX_SPATIAL_STREAM_MASK    0x0C
+
+#define VHT_MAX_MPDU           11454   /* max mpdu size for now (bytes) */
+#define VHT_MPDU_MSDU_DELTA    56              /* Difference in spec - vht mpdu, amsdu len */
+/* Max AMSDU len - per spec */
+#define VHT_MAX_AMSDU          (VHT_MAX_MPDU - VHT_MPDU_MSDU_DELTA)
+
+#define HT_MAX_AMSDU           7935    /* max amsdu size (bytes) per the HT spec */
+#define HT_MIN_AMSDU           3835    /* min amsdu size (bytes) per the HT spec */
+
+#define HT_PARAMS_RX_FACTOR_MASK       0x03    /* ampdu rcv factor mask */
+#define HT_PARAMS_DENSITY_MASK         0x1C    /* ampdu density mask */
+#define HT_PARAMS_DENSITY_SHIFT        2       /* ampdu density shift */
+
+/* HT/AMPDU specific define */
+#define AMPDU_MAX_MPDU_DENSITY  7       /* max mpdu density; in 1/4 usec units */
+#define AMPDU_DENSITY_NONE      0       /* No density requirement */
+#define AMPDU_DENSITY_1over4_US 1       /* 1/4 us density */
+#define AMPDU_DENSITY_1over2_US 2       /* 1/2 us density */
+#define AMPDU_DENSITY_1_US      3       /*   1 us density */
+#define AMPDU_DENSITY_2_US      4       /*   2 us density */
+#define AMPDU_DENSITY_4_US      5       /*   4 us density */
+#define AMPDU_DENSITY_8_US      6       /*   8 us density */
+#define AMPDU_DENSITY_16_US     7       /*  16 us density */
+#define AMPDU_RX_FACTOR_8K      0       /* max rcv ampdu len (8kb) */
+#define AMPDU_RX_FACTOR_16K     1       /* max rcv ampdu len (16kb) */
+#define AMPDU_RX_FACTOR_32K     2       /* max rcv ampdu len (32kb) */
+#define AMPDU_RX_FACTOR_64K     3       /* max rcv ampdu len (64kb) */
+
+/* AMPDU RX factors for VHT rates */
+#define AMPDU_RX_FACTOR_128K    4       /* max rcv ampdu len (128kb) */
+#define AMPDU_RX_FACTOR_256K    5       /* max rcv ampdu len (256kb) */
+#define AMPDU_RX_FACTOR_512K    6       /* max rcv ampdu len (512kb) */
+#define AMPDU_RX_FACTOR_1024K   7       /* max rcv ampdu len (1024kb) */
+
+#define AMPDU_RX_FACTOR_BASE    8*1024  /* ampdu factor base for rx len */
+#define AMPDU_RX_FACTOR_BASE_PWR       13      /* ampdu factor base for rx len in power of 2 */
+
+#define AMPDU_DELIMITER_LEN    4u      /* length of ampdu delimiter */
+#define AMPDU_DELIMITER_LEN_MAX        63      /* max length of ampdu delimiter(enforced in HW) */
+
+#define HT_CAP_EXT_PCO                 0x0001
+#define HT_CAP_EXT_PCO_TTIME_MASK      0x0006
+#define HT_CAP_EXT_PCO_TTIME_SHIFT     1
+#define HT_CAP_EXT_MCS_FEEDBACK_MASK   0x0300
+#define HT_CAP_EXT_MCS_FEEDBACK_SHIFT  8
+#define HT_CAP_EXT_HTC                 0x0400
+#define HT_CAP_EXT_RD_RESP             0x0800
+
+/** 'ht_add' is called 'HT Operation' information element in the 802.11 standard */
+BWL_PRE_PACKED_STRUCT struct ht_add_ie {
+       uint8   ctl_ch;                 /* control channel number */
+       uint8   byte1;                  /* ext ch,rec. ch. width, RIFS support */
+       uint16  opmode;                 /* operation mode */
+       uint16  misc_bits;              /* misc bits */
+       uint8   basic_mcs[MCSSET_LEN];  /* required MCS set */
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_add_ie ht_add_ie_t;
+
+/* ADD IE: HT 1.0 spec. simply stole a 802.11 IE, we use our prop. IE until this is resolved */
+/* the additional IE is primarily used to convey the current BSS configuration */
+BWL_PRE_PACKED_STRUCT struct ht_prop_add_ie {
+       uint8   id;             /* IE ID, 221, DOT11_MNG_PROPR_ID */
+       uint8   len;            /* IE length */
+       uint8   oui[3];         /* Proprietary OUI, BRCM_PROP_OUI */
+       uint8   type;           /* indicates what follows */
+       ht_add_ie_t add_ie;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_prop_add_ie ht_prop_add_ie_t;
+
+#define HT_ADD_IE_LEN  22      /* HT capability len (based on .11n d1.0) */
+#define HT_ADD_IE_TYPE 52      /* faked out as current spec is illegal */
+
+/* byte1 defn's */
+#define HT_BW_ANY              0x04    /* set, STA can use 20 or 40MHz */
+#define HT_RIFS_PERMITTED      0x08    /* RIFS allowed */
+
+/* opmode defn's */
+#define HT_OPMODE_MASK         0x0003  /* protection mode mask */
+#define HT_OPMODE_SHIFT                0       /* protection mode shift */
+#define HT_OPMODE_PURE         0x0000  /* protection mode PURE */
+#define HT_OPMODE_OPTIONAL     0x0001  /* protection mode optional */
+#define HT_OPMODE_HT20IN40     0x0002  /* protection mode 20MHz HT in 40MHz BSS */
+#define HT_OPMODE_MIXED        0x0003  /* protection mode Mixed Mode */
+#define HT_OPMODE_NONGF        0x0004  /* protection mode non-GF */
+#define DOT11N_TXBURST         0x0008  /* Tx burst limit */
+#define DOT11N_OBSS_NONHT      0x0010  /* OBSS Non-HT STA present */
+#define HT_OPMODE_CCFS2_MASK   0x1fe0  /* Channel Center Frequency Segment 2 mask */
+#define HT_OPMODE_CCFS2_SHIFT  5       /* Channel Center Frequency Segment 2 shift */
+
+/* misc_bites defn's */
+#define HT_BASIC_STBC_MCS      0x007f  /* basic STBC MCS */
+#define HT_DUAL_STBC_PROT      0x0080  /* Dual STBC Protection */
+#define HT_SECOND_BCN          0x0100  /* Secondary beacon support */
+#define HT_LSIG_TXOP           0x0200  /* L-SIG TXOP Protection full support */
+#define HT_PCO_ACTIVE          0x0400  /* PCO active */
+#define HT_PCO_PHASE           0x0800  /* PCO phase */
+#define HT_DUALCTS_PROTECTION  0x0080  /* DUAL CTS protection needed */
+
+/* Tx Burst Limits */
+#define DOT11N_2G_TXBURST_LIMIT        6160    /* 2G band Tx burst limit per 802.11n Draft 1.10 (usec) */
+#define DOT11N_5G_TXBURST_LIMIT        3080    /* 5G band Tx burst limit per 802.11n Draft 1.10 (usec) */
+
+/* Macros for opmode */
+#define GET_HT_OPMODE(add_ie)          ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+                                       >> HT_OPMODE_SHIFT)
+#define HT_MIXEDMODE_PRESENT(add_ie)   ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+                                       == HT_OPMODE_MIXED)     /* mixed mode present */
+#define HT_HT20_PRESENT(add_ie)        ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+                                       == HT_OPMODE_HT20IN40)  /* 20MHz HT present */
+#define HT_OPTIONAL_PRESENT(add_ie)    ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+                                       == HT_OPMODE_OPTIONAL)  /* Optional protection present */
+#define HT_USE_PROTECTION(add_ie)      (HT_HT20_PRESENT((add_ie)) || \
+                                       HT_MIXEDMODE_PRESENT((add_ie))) /* use protection */
+#define HT_NONGF_PRESENT(add_ie)       ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_NONGF) \
+                                       == HT_OPMODE_NONGF)     /* non-GF present */
+#define DOT11N_TXBURST_PRESENT(add_ie) ((ltoh16_ua(&add_ie->opmode) & DOT11N_TXBURST) \
+                                       == DOT11N_TXBURST)      /* Tx Burst present */
+#define DOT11N_OBSS_NONHT_PRESENT(add_ie)      ((ltoh16_ua(&add_ie->opmode) & DOT11N_OBSS_NONHT) \
+                                       == DOT11N_OBSS_NONHT)   /* OBSS Non-HT present */
+#define HT_OPMODE_CCFS2_GET(add_ie)    ((ltoh16_ua(&(add_ie)->opmode) & HT_OPMODE_CCFS2_MASK) \
+                                       >> HT_OPMODE_CCFS2_SHIFT)       /* get CCFS2 */
+#define HT_OPMODE_CCFS2_SET(add_ie, ccfs2)     do { /* set CCFS2 */ \
+       (add_ie)->opmode &= htol16(~HT_OPMODE_CCFS2_MASK); \
+       (add_ie)->opmode |= htol16(((ccfs2) << HT_OPMODE_CCFS2_SHIFT) & HT_OPMODE_CCFS2_MASK); \
+} while (0)
+
+/* Macros for HT MCS field access */
+#define HT_CAP_MCS_BITMASK(supp_mcs)                 \
+       ((supp_mcs)[HT_CAP_MCS_RX_8TO15_BYTE_OFFSET])
+#define HT_CAP_MCS_TX_RX_UNEQUAL(supp_mcs)          \
+       ((supp_mcs)[HT_CAP_MCS_FLAGS_SUPP_BYTE] & HT_CAP_MCS_FLAGS_TX_RX_UNEQUAL)
+#define HT_CAP_MCS_TX_STREAM_SUPPORT(supp_mcs)          \
+               ((supp_mcs)[HT_CAP_MCS_FLAGS_SUPP_BYTE] & HT_CAP_MCS_FLAGS_MAX_SPATIAL_STREAM_MASK)
+
+BWL_PRE_PACKED_STRUCT struct obss_params {
+       uint16  passive_dwell;
+       uint16  active_dwell;
+       uint16  bss_widthscan_interval;
+       uint16  passive_total;
+       uint16  active_total;
+       uint16  chanwidth_transition_dly;
+       uint16  activity_threshold;
+} BWL_POST_PACKED_STRUCT;
+typedef struct obss_params obss_params_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_obss_ie {
+       uint8   id;
+       uint8   len;
+       obss_params_t obss_params;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_obss_ie dot11_obss_ie_t;
+#define DOT11_OBSS_SCAN_IE_LEN sizeof(obss_params_t)   /* HT OBSS len (based on 802.11n d3.0) */
+
+/* HT control field */
+#define HT_CTRL_LA_TRQ         0x00000002      /* sounding request */
+#define HT_CTRL_LA_MAI         0x0000003C      /* MCS request or antenna selection indication */
+#define HT_CTRL_LA_MAI_SHIFT   2
+#define HT_CTRL_LA_MAI_MRQ     0x00000004      /* MCS request */
+#define HT_CTRL_LA_MAI_MSI     0x00000038      /* MCS request sequence identifier */
+#define HT_CTRL_LA_MFSI                0x000001C0      /* MFB sequence identifier */
+#define HT_CTRL_LA_MFSI_SHIFT  6
+#define HT_CTRL_LA_MFB_ASELC   0x0000FE00      /* MCS feedback, antenna selection command/data */
+#define HT_CTRL_LA_MFB_ASELC_SH        9
+#define HT_CTRL_LA_ASELC_CMD   0x00000C00      /* ASEL command */
+#define HT_CTRL_LA_ASELC_DATA  0x0000F000      /* ASEL data */
+#define HT_CTRL_CAL_POS                0x00030000      /* Calibration position */
+#define HT_CTRL_CAL_SEQ                0x000C0000      /* Calibration sequence */
+#define HT_CTRL_CSI_STEERING   0x00C00000      /* CSI/Steering */
+#define HT_CTRL_CSI_STEER_SHIFT        22
+#define HT_CTRL_CSI_STEER_NFB  0               /* no fedback required */
+#define HT_CTRL_CSI_STEER_CSI  1               /* CSI, H matrix */
+#define HT_CTRL_CSI_STEER_NCOM 2               /* non-compressed beamforming */
+#define HT_CTRL_CSI_STEER_COM  3               /* compressed beamforming */
+#define HT_CTRL_NDP_ANNOUNCE   0x01000000      /* NDP announcement */
+#define HT_CTRL_AC_CONSTRAINT  0x40000000      /* AC Constraint */
+#define HT_CTRL_RDG_MOREPPDU   0x80000000      /* RDG/More PPDU */
+
+/* ************* VHT definitions. ************* */
+
+/**
+ * VHT Capabilites IE (sec 8.4.2.160)
+ */
+
+BWL_PRE_PACKED_STRUCT struct vht_cap_ie {
+       uint32  vht_cap_info;
+       /* supported MCS set - 64 bit field */
+       uint16  rx_mcs_map;
+       uint16  rx_max_rate;
+       uint16  tx_mcs_map;
+       uint16  tx_max_rate;
+} BWL_POST_PACKED_STRUCT;
+typedef struct vht_cap_ie vht_cap_ie_t;
+
+/* 4B cap_info + 8B supp_mcs */
+#define VHT_CAP_IE_LEN 12
+
+/* VHT Capabilities Info field - 32bit - in VHT Cap IE */
+#define VHT_CAP_INFO_MAX_MPDU_LEN_MASK          0x00000003
+#define VHT_CAP_INFO_SUPP_CHAN_WIDTH_MASK       0x0000000c
+#define VHT_CAP_INFO_LDPC                       0x00000010
+#define VHT_CAP_INFO_SGI_80MHZ                  0x00000020
+#define VHT_CAP_INFO_SGI_160MHZ                 0x00000040
+#define VHT_CAP_INFO_TX_STBC                    0x00000080
+#define VHT_CAP_INFO_RX_STBC_MASK               0x00000700
+#define VHT_CAP_INFO_RX_STBC_SHIFT              8u
+#define VHT_CAP_INFO_SU_BEAMFMR                 0x00000800
+#define VHT_CAP_INFO_SU_BEAMFMEE                0x00001000
+#define VHT_CAP_INFO_NUM_BMFMR_ANT_MASK         0x0000e000
+#define VHT_CAP_INFO_NUM_BMFMR_ANT_SHIFT        13u
+#define VHT_CAP_INFO_NUM_SOUNDING_DIM_MASK      0x00070000
+#define VHT_CAP_INFO_NUM_SOUNDING_DIM_SHIFT     16u
+#define VHT_CAP_INFO_MU_BEAMFMR                 0x00080000
+#define VHT_CAP_INFO_MU_BEAMFMEE                0x00100000
+#define VHT_CAP_INFO_TXOPPS                     0x00200000
+#define VHT_CAP_INFO_HTCVHT                     0x00400000
+#define VHT_CAP_INFO_AMPDU_MAXLEN_EXP_MASK      0x03800000
+#define VHT_CAP_INFO_AMPDU_MAXLEN_EXP_SHIFT     23u
+#define VHT_CAP_INFO_LINK_ADAPT_CAP_MASK        0x0c000000
+#define VHT_CAP_INFO_LINK_ADAPT_CAP_SHIFT       26u
+#define VHT_CAP_INFO_EXT_NSS_BW_SUP_MASK        0xc0000000
+#define VHT_CAP_INFO_EXT_NSS_BW_SUP_SHIFT       30u
+
+/* get Extended NSS BW Support passing vht cap info */
+#define VHT_CAP_EXT_NSS_BW_SUP(cap_info) \
+       (((cap_info) & VHT_CAP_INFO_EXT_NSS_BW_SUP_MASK) >> VHT_CAP_INFO_EXT_NSS_BW_SUP_SHIFT)
+
+/* VHT CAP INFO extended NSS BW support - refer to IEEE 802.11 REVmc D8.0 Figure 9-559 */
+#define VHT_CAP_INFO_EXT_NSS_BW_HALF_160       1 /* 160MHz at half NSS CAP */
+#define VHT_CAP_INFO_EXT_NSS_BW_HALF_160_80P80 2 /* 160 & 80p80 MHz at half NSS CAP */
+
+/* VHT Supported MCS Set - 64-bit - in VHT Cap IE */
+#define VHT_CAP_SUPP_MCS_RX_HIGHEST_RATE_MASK   0x1fff
+#define VHT_CAP_SUPP_MCS_RX_HIGHEST_RATE_SHIFT  0
+
+#define VHT_CAP_SUPP_MCS_TX_HIGHEST_RATE_MASK   0x1fff
+#define VHT_CAP_SUPP_MCS_TX_HIGHEST_RATE_SHIFT  0
+
+/* defines for field(s) in vht_cap_ie->rx_max_rate */
+#define VHT_CAP_MAX_NSTS_MASK                  0xe000
+#define VHT_CAP_MAX_NSTS_SHIFT                 13
+
+/* defines for field(s) in vht_cap_ie->tx_max_rate */
+#define VHT_CAP_EXT_NSS_BW_CAP                 0x2000
+
+#define VHT_CAP_MCS_MAP_0_7                     0
+#define VHT_CAP_MCS_MAP_0_8                     1
+#define VHT_CAP_MCS_MAP_0_9                     2
+#define VHT_CAP_MCS_MAP_NONE                    3
+#define VHT_CAP_MCS_MAP_S                       2 /* num bits for 1-stream */
+#define VHT_CAP_MCS_MAP_M                       0x3 /* mask for 1-stream */
+/* assumes VHT_CAP_MCS_MAP_NONE is 3 and 2 bits are used for encoding */
+#define VHT_CAP_MCS_MAP_NONE_ALL                0xffff
+
+/* VHT rates bitmap */
+#define VHT_CAP_MCS_0_7_RATEMAP                0x00ff
+#define VHT_CAP_MCS_0_8_RATEMAP                0x01ff
+#define VHT_CAP_MCS_0_9_RATEMAP                0x03ff
+#define VHT_CAP_MCS_FULL_RATEMAP       VHT_CAP_MCS_0_9_RATEMAP
+
+#define VHT_PROP_MCS_MAP_10_11                   0
+#define VHT_PROP_MCS_MAP_UNUSED1                 1
+#define VHT_PROP_MCS_MAP_UNUSED2                 2
+#define VHT_PROP_MCS_MAP_NONE                    3
+#define VHT_PROP_MCS_MAP_NONE_ALL                0xffff
+
+/* VHT prop rates bitmap */
+#define VHT_PROP_MCS_10_11_RATEMAP     0x0c00
+#define VHT_PROP_MCS_FULL_RATEMAP      VHT_PROP_MCS_10_11_RATEMAP
+
+#if !defined(VHT_CAP_MCS_MAP_0_9_NSS3)
+/* remove after moving define to wlc_rate.h */
+/* mcsmap with MCS0-9 for Nss = 3 */
+#define VHT_CAP_MCS_MAP_0_9_NSS3 \
+               ((VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(1)) | \
+                (VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(2)) | \
+                (VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(3)))
+#endif /* !VHT_CAP_MCS_MAP_0_9_NSS3 */
+
+#define VHT_CAP_MCS_MAP_NSS_MAX                 8
+
+/* get mcsmap with given mcs for given nss streams */
+#define VHT_CAP_MCS_MAP_CREATE(mcsmap, nss, mcs) \
+       do { \
+               int i; \
+               for (i = 1; i <= nss; i++) { \
+                       VHT_MCS_MAP_SET_MCS_PER_SS(i, mcs, mcsmap); \
+               } \
+       } while (0)
+
+/* Map the mcs code to mcs bit map */
+#define VHT_MCS_CODE_TO_MCS_MAP(mcs_code) \
+       ((mcs_code == VHT_CAP_MCS_MAP_0_7) ? VHT_CAP_MCS_0_7_RATEMAP : \
+        (mcs_code == VHT_CAP_MCS_MAP_0_8) ? VHT_CAP_MCS_0_8_RATEMAP : \
+        (mcs_code == VHT_CAP_MCS_MAP_0_9) ? VHT_CAP_MCS_0_9_RATEMAP : 0)
+
+/* Map the proprietary mcs code to proprietary mcs bitmap */
+#define VHT_PROP_MCS_CODE_TO_PROP_MCS_MAP(mcs_code) \
+       ((mcs_code == VHT_PROP_MCS_MAP_10_11) ? VHT_PROP_MCS_10_11_RATEMAP : 0)
+
+/* Map the mcs bit map to mcs code */
+#define VHT_MCS_MAP_TO_MCS_CODE(mcs_map) \
+       ((mcs_map == VHT_CAP_MCS_0_7_RATEMAP) ? VHT_CAP_MCS_MAP_0_7 : \
+        (mcs_map == VHT_CAP_MCS_0_8_RATEMAP) ? VHT_CAP_MCS_MAP_0_8 : \
+        (mcs_map == VHT_CAP_MCS_0_9_RATEMAP) ? VHT_CAP_MCS_MAP_0_9 : VHT_CAP_MCS_MAP_NONE)
+
+/* Map the proprietary mcs map to proprietary mcs code */
+#define VHT_PROP_MCS_MAP_TO_PROP_MCS_CODE(mcs_map) \
+       (((mcs_map & 0xc00) == 0xc00)  ? VHT_PROP_MCS_MAP_10_11 : VHT_PROP_MCS_MAP_NONE)
+
+/** VHT Capabilities Supported Channel Width */
+typedef enum vht_cap_chan_width {
+       VHT_CAP_CHAN_WIDTH_SUPPORT_MANDATORY = 0x00,
+       VHT_CAP_CHAN_WIDTH_SUPPORT_160       = 0x04,
+       VHT_CAP_CHAN_WIDTH_SUPPORT_160_8080  = 0x08
+} vht_cap_chan_width_t;
+
+/** VHT Capabilities Supported max MPDU LEN (sec 8.4.2.160.2) */
+typedef enum vht_cap_max_mpdu_len {
+       VHT_CAP_MPDU_MAX_4K     = 0x00,
+       VHT_CAP_MPDU_MAX_8K     = 0x01,
+       VHT_CAP_MPDU_MAX_11K    = 0x02
+} vht_cap_max_mpdu_len_t;
+
+/* Maximum MPDU Length byte counts for the VHT Capabilities advertised limits */
+#define VHT_MPDU_LIMIT_4K        3895
+#define VHT_MPDU_LIMIT_8K        7991
+#define VHT_MPDU_LIMIT_11K      11454
+
+/**
+ * VHT Operation IE (sec 8.4.2.161)
+ */
+
+BWL_PRE_PACKED_STRUCT struct vht_op_ie {
+       uint8   chan_width;
+       uint8   chan1;
+       uint8   chan2;
+       uint16  supp_mcs;  /*  same def as above in vht cap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct vht_op_ie vht_op_ie_t;
+
+/* 3B VHT Op info + 2B Basic MCS */
+#define VHT_OP_IE_LEN 5
+
+typedef enum vht_op_chan_width {
+       VHT_OP_CHAN_WIDTH_20_40 = 0,
+       VHT_OP_CHAN_WIDTH_80    = 1,
+       VHT_OP_CHAN_WIDTH_160   = 2, /* deprecated - IEEE 802.11 REVmc D8.0 Table 11-25 */
+       VHT_OP_CHAN_WIDTH_80_80 = 3  /* deprecated - IEEE 802.11 REVmc D8.0 Table 11-25 */
+} vht_op_chan_width_t;
+
+#define VHT_OP_INFO_LEN                3
+
+/* AID length */
+#define AID_IE_LEN             2
+/**
+ * BRCM vht features IE header
+ * The header if the fixed part of the IE
+ * On the 5GHz band this is the entire IE,
+ * on 2.4GHz the VHT IEs as defined in the 802.11ac
+ * specification follows
+ *
+ *
+ * VHT features rates  bitmap.
+ * Bit0:               5G MCS 0-9 BW 160MHz
+ * Bit1:               5G MCS 0-9 support BW 80MHz
+ * Bit2:               5G MCS 0-9 support BW 20MHz
+ * Bit3:               2.4G MCS 0-9 support BW 20MHz
+ * Bits:4-7    Reserved for future use
+ *
+ */
+#define VHT_FEATURES_IE_TYPE   0x4
+BWL_PRE_PACKED_STRUCT struct vht_features_ie_hdr {
+       uint8 oui[3];           /* Proprietary OUI, BRCM_PROP_OUI */
+       uint8 type;             /* type of this IE = 4 */
+       uint8 rate_mask;        /* VHT rate mask */
+} BWL_POST_PACKED_STRUCT;
+typedef struct vht_features_ie_hdr vht_features_ie_hdr_t;
+
+/* Def for rx & tx basic mcs maps - ea ss num has 2 bits of info */
+#define VHT_MCS_MAP_GET_SS_IDX(nss) (((nss)-1) * VHT_CAP_MCS_MAP_S)
+#define VHT_MCS_MAP_GET_MCS_PER_SS(nss, mcsMap) \
+       (((mcsMap) >> VHT_MCS_MAP_GET_SS_IDX(nss)) & VHT_CAP_MCS_MAP_M)
+#define VHT_MCS_MAP_SET_MCS_PER_SS(nss, numMcs, mcsMap) \
+       do { \
+        (mcsMap) &= (~(VHT_CAP_MCS_MAP_M << VHT_MCS_MAP_GET_SS_IDX(nss))); \
+        (mcsMap) |= (((numMcs) & VHT_CAP_MCS_MAP_M) << VHT_MCS_MAP_GET_SS_IDX(nss)); \
+       } while (0)
+#define VHT_MCS_SS_SUPPORTED(nss, mcsMap) \
+                (VHT_MCS_MAP_GET_MCS_PER_SS((nss), (mcsMap)) != VHT_CAP_MCS_MAP_NONE)
+
+/* Get the max ss supported from the mcs map */
+#define VHT_MAX_SS_SUPPORTED(mcsMap) \
+       VHT_MCS_SS_SUPPORTED(8, mcsMap) ? 8 : \
+       VHT_MCS_SS_SUPPORTED(7, mcsMap) ? 7 : \
+       VHT_MCS_SS_SUPPORTED(6, mcsMap) ? 6 : \
+       VHT_MCS_SS_SUPPORTED(5, mcsMap) ? 5 : \
+       VHT_MCS_SS_SUPPORTED(4, mcsMap) ? 4 : \
+       VHT_MCS_SS_SUPPORTED(3, mcsMap) ? 3 : \
+       VHT_MCS_SS_SUPPORTED(2, mcsMap) ? 2 : \
+       VHT_MCS_SS_SUPPORTED(1, mcsMap) ? 1 : 0
+
+#ifdef IBSS_RMC
+/* customer's OUI */
+#define RMC_PROP_OUI           "\x00\x16\x32"
+#endif
+
+/* ************* WPA definitions. ************* */
+#define WPA_OUI                        "\x00\x50\xF2"  /* WPA OUI */
+#define WPA_OUI_LEN            3               /* WPA OUI length */
+#define WPA_OUI_TYPE           1
+#define WPA_VERSION            1               /* WPA version */
+#define WPA_VERSION_LEN 2 /* WPA version length */
+
+/* ************* WPA2 definitions. ************* */
+#define WPA2_OUI               "\x00\x0F\xAC"  /* WPA2 OUI */
+#define WPA2_OUI_LEN           3               /* WPA2 OUI length */
+#define WPA2_VERSION           1               /* WPA2 version */
+#define WPA2_VERSION_LEN       2               /* WAP2 version length */
+#define MAX_RSNE_SUPPORTED_VERSION  WPA2_VERSION /* Max supported version */
+
+/* ************* WPS definitions. ************* */
+#define WPS_OUI                        "\x00\x50\xF2"  /* WPS OUI */
+#define WPS_OUI_LEN            3               /* WPS OUI length */
+#define WPS_OUI_TYPE           4
+
+/* ************* TPC definitions. ************* */
+#define TPC_OUI                        "\x00\x50\xF2"  /* TPC OUI */
+#define TPC_OUI_LEN            3               /* TPC OUI length */
+#define TPC_OUI_TYPE           8
+#define WFA_OUI_TYPE_TPC       8               /* deprecated */
+
+/* ************* WFA definitions. ************* */
+#define WFA_OUI                        "\x50\x6F\x9A"  /* WFA OUI */
+#define WFA_OUI_LEN            3               /* WFA OUI length */
+#define WFA_OUI_TYPE_P2P       9
+
+/* WFA definitions for LEGACY P2P */
+
+#define P2P_OUI         WFA_OUI
+#define P2P_OUI_LEN     WFA_OUI_LEN
+#define P2P_OUI_TYPE    WFA_OUI_TYPE_P2P
+
+#ifdef WLTDLS
+#define WFA_OUI_TYPE_TPQ       4       /* WFD Tunneled Probe ReQuest */
+#define WFA_OUI_TYPE_TPS       5       /* WFD Tunneled Probe ReSponse */
+#define WFA_OUI_TYPE_WFD       10
+#endif /* WTDLS */
+#define WFA_OUI_TYPE_HS20      0x10
+#define WFA_OUI_TYPE_OSEN      0x12
+#define WFA_OUI_TYPE_NAN       0x13
+#define WFA_OUI_TYPE_MBO       0x16
+#define WFA_OUI_TYPE_MBO_OCE   0x16
+#define WFA_OUI_TYPE_OWE       0x1C
+#define WFA_OUI_TYPE_SAE_PK    0x64
+
+BWL_PRE_PACKED_STRUCT struct dot11_sae_pk_element {
+       uint8 id;               /* IE ID, 221, DOT11_MNG_PROPR_ID */
+       uint8 len;              /* IE length */
+       uint8 oui[3];           /* WFA_OUI */
+       uint8 type;             /* SAE-PK */
+       uint8 modifier_len;     /* Modifier length */
+       uint8 data[];           /* Modifier and FILS elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_sae_pk_element dot11_sae_pk_element_t;
+
+/* RSN authenticated key managment suite */
+#define RSN_AKM_NONE                   0       /* None (IBSS) */
+#define RSN_AKM_UNSPECIFIED            1       /* Over 802.1x */
+#define RSN_AKM_PSK                    2       /* Pre-shared Key */
+#define RSN_AKM_FBT_1X                 3       /* Fast Bss transition using 802.1X */
+#define RSN_AKM_FBT_PSK                        4       /* Fast Bss transition using Pre-shared Key */
+/* RSN_AKM_MFP_1X and RSN_AKM_MFP_PSK are not used any more
+ * Just kept here to avoid build issue in BISON/CARIBOU branch
+ */
+#define RSN_AKM_MFP_1X                 5       /* SHA256 key derivation, using 802.1X */
+#define RSN_AKM_MFP_PSK                        6       /* SHA256 key derivation, using Pre-shared Key */
+#define RSN_AKM_SHA256_1X              5       /* SHA256 key derivation, using 802.1X */
+#define RSN_AKM_SHA256_PSK             6       /* SHA256 key derivation, using Pre-shared Key */
+#define RSN_AKM_TPK                    7       /* TPK(TDLS Peer Key) handshake */
+#define RSN_AKM_SAE_PSK                        8       /* AKM for SAE with 4-way handshake */
+#define RSN_AKM_SAE_FBT                        9       /* AKM for SAE with FBT */
+#define RSN_AKM_SUITEB_SHA256_1X       11      /* Suite B SHA256 */
+#define RSN_AKM_SUITEB_SHA384_1X       12      /* Suite B-192 SHA384 */
+#define RSN_AKM_FBT_SHA384_1X          13      /* FBT SHA384 */
+#define RSN_AKM_FILS_SHA256            14      /* SHA256 key derivation, using FILS */
+#define RSN_AKM_FILS_SHA384            15      /* SHA384 key derivation, using FILS */
+#define RSN_AKM_FBT_SHA256_FILS                16
+#define RSN_AKM_FBT_SHA384_FILS                17
+#define RSN_AKM_OWE                    18      /* RFC 8110  OWE */
+#define RSN_AKM_FBT_SHA384_PSK         19
+#define RSN_AKM_PSK_SHA384             20
+/* OSEN authenticated key managment suite */
+#define OSEN_AKM_UNSPECIFIED   RSN_AKM_UNSPECIFIED     /* Over 802.1x */
+/* WFA DPP RSN authenticated key managment */
+#define RSN_AKM_DPP                    02u     /* DPP RSN */
+
+/* Key related defines */
+#define DOT11_MAX_DEFAULT_KEYS 4       /* number of default keys */
+#define DOT11_MAX_IGTK_KEYS            2
+#define DOT11_MAX_KEY_SIZE     32      /* max size of any key */
+#define DOT11_MAX_IV_SIZE      16      /* max size of any IV */
+#define DOT11_EXT_IV_FLAG      (1<<5)  /* flag to indicate IV is > 4 bytes */
+#define DOT11_WPA_KEY_RSC_LEN   8       /* WPA RSC key len */
+
+#define WEP1_KEY_SIZE          5       /* max size of any WEP key */
+#define WEP1_KEY_HEX_SIZE      10      /* size of WEP key in hex. */
+#define WEP128_KEY_SIZE                13      /* max size of any WEP key */
+#define WEP128_KEY_HEX_SIZE    26      /* size of WEP key in hex. */
+#define TKIP_MIC_SIZE          8       /* size of TKIP MIC */
+#define TKIP_EOM_SIZE          7       /* max size of TKIP EOM */
+#define TKIP_EOM_FLAG          0x5a    /* TKIP EOM flag byte */
+#define TKIP_KEY_SIZE          32      /* size of any TKIP key, includs MIC keys */
+#define TKIP_TK_SIZE           16
+#define TKIP_MIC_KEY_SIZE      8
+#define TKIP_MIC_AUTH_TX       16      /* offset to Authenticator MIC TX key */
+#define TKIP_MIC_AUTH_RX       24      /* offset to Authenticator MIC RX key */
+#define TKIP_MIC_SUP_RX                TKIP_MIC_AUTH_TX        /* offset to Supplicant MIC RX key */
+#define TKIP_MIC_SUP_TX                TKIP_MIC_AUTH_RX        /* offset to Supplicant MIC TX key */
+#define AES_KEY_SIZE           16      /* size of AES key */
+#define AES_MIC_SIZE           8       /* size of AES MIC */
+#define BIP_KEY_SIZE           16      /* size of BIP key */
+#define BIP_MIC_SIZE           8   /* sizeof BIP MIC */
+
+#define AES_GCM_MIC_SIZE       16      /* size of MIC for 128-bit GCM - .11adD9 */
+
+#define AES256_KEY_SIZE                32      /* size of AES 256 key - .11acD5 */
+#define AES256_MIC_SIZE                16      /* size of MIC for 256 bit keys, incl BIP */
+
+/* WCN */
+#define WCN_OUI                        "\x00\x50\xf2"  /* WCN OUI */
+#define WCN_TYPE               4       /* WCN type */
+
+#ifdef BCMWAPI_WPI
+#define SMS4_KEY_LEN           16
+#define SMS4_WPI_CBC_MAC_LEN   16
+#endif
+
+/* 802.11r protocol definitions */
+
+/** Mobility Domain IE */
+BWL_PRE_PACKED_STRUCT struct dot11_mdid_ie {
+       uint8 id;
+       uint8 len;              /* DOT11_MDID_IE_DATA_LEN (3) */
+       uint16 mdid;            /* Mobility Domain Id */
+       uint8 cap;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_mdid_ie dot11_mdid_ie_t;
+
+/* length of data portion of Mobility Domain IE */
+#define DOT11_MDID_IE_DATA_LEN 3
+#define DOT11_MDID_LEN         2
+#define FBT_MDID_CAP_OVERDS    0x01    /* Fast Bss transition over the DS support */
+#define FBT_MDID_CAP_RRP       0x02    /* Resource request protocol support */
+
+/* Fast Bss Transition IE */
+#ifdef FT_IE_VER_V2
+typedef BWL_PRE_PACKED_STRUCT struct dot11_ft_ie_v2 {
+       uint8 id;
+       uint8 len;
+       uint16 mic_control;
+       /* dynamic offset to following mic[], anonce[], snonce[] */
+} BWL_POST_PACKED_STRUCT dot11_ft_ie_v2;
+typedef struct dot11_ft_ie_v2 dot11_ft_ie_t;
+#else
+BWL_PRE_PACKED_STRUCT struct dot11_ft_ie {
+       uint8 id;
+       uint8 len;                      /* At least equal to DOT11_FT_IE_FIXED_LEN (82) */
+       uint16 mic_control;             /* Mic Control */
+       uint8 mic[16];
+       uint8 anonce[32];
+       uint8 snonce[32];
+       /* Optional sub-elements follow */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ft_ie dot11_ft_ie_t;
+
+/* Fixed length of data portion of Fast BSS Transition IE. There could be
+ * optional parameters, which if present, could raise the FT IE length to 255.
+ */
+#define DOT11_FT_IE_FIXED_LEN  82
+#endif /* FT_IE_VER_V2 */
+
+#ifdef FT_IE_VER_V2
+#define DOT11_FT_IE_LEN(mic_len) (sizeof(dot11_ft_ie_v2) + mic_len + EAPOL_WPA_KEY_NONCE_LEN *2)
+#define FT_IE_MIC(pos) ((uint8 *)pos + sizeof(dot11_ft_ie_v2))
+#define FT_IE_ANONCE(pos, mic_len) ((uint8 *)pos + sizeof(dot11_ft_ie_v2) + mic_len)
+#define FT_IE_SNONCE(pos, mic_len) ((uint8 *)pos + sizeof(dot11_ft_ie_v2) + mic_len + \
+       EAPOL_WPA_KEY_NONCE_LEN)
+#else
+#define DOT11_FT_IE_LEN(mic_len) sizeof(dot11_ft_ie)
+#define FT_IE_MIC(pos) ((uint8 *)&pos->mic)
+#define FT_IE_ANONCE(pos, mic_len) ((uint8 *)&pos->anonce)
+#define FT_IE_SNONCE(pos, mic_len) ((uint8 *)&pos->snonce)
+#endif /* FT_IE_VER_V2 */
+#define TIE_TYPE_RESERVED              0
+#define TIE_TYPE_REASSOC_DEADLINE      1
+#define TIE_TYPE_KEY_LIEFTIME          2
+#define TIE_TYPE_ASSOC_COMEBACK                3
+BWL_PRE_PACKED_STRUCT struct dot11_timeout_ie {
+       uint8 id;
+       uint8 len;
+       uint8 type;             /* timeout interval type */
+       uint32 value;           /* timeout interval value */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timeout_ie dot11_timeout_ie_t;
+
+/** GTK ie */
+BWL_PRE_PACKED_STRUCT struct dot11_gtk_ie {
+       uint8 id;
+       uint8 len;
+       uint16 key_info;
+       uint8 key_len;
+       uint8 rsc[8];
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_gtk_ie dot11_gtk_ie_t;
+
+/** Management MIC ie */
+BWL_PRE_PACKED_STRUCT struct mmic_ie {
+       uint8   id;                                     /* IE ID: DOT11_MNG_MMIE_ID */
+       uint8   len;                            /* IE length */
+       uint16  key_id;                         /* key id */
+       uint8   ipn[6];                         /* ipn */
+       uint8   mic[16];                        /* mic */
+} BWL_POST_PACKED_STRUCT;
+typedef struct mmic_ie mmic_ie_t;
+
+/* 802.11r-2008, 11A.10.3 - RRB frame format */
+BWL_PRE_PACKED_STRUCT struct dot11_ft_rrb_frame {
+       uint8  frame_type; /* 1 for RRB */
+       uint8  packet_type; /* 0 for Request 1 for Response */
+       uint16 len;
+       uint8  cur_ap_addr[ETHER_ADDR_LEN];
+       uint8  data[1]; /* IEs Received/Sent in FT Action Req/Resp Frame */
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct dot11_ft_rrb_frame dot11_ft_rrb_frame_t;
+
+#define DOT11_FT_RRB_FIXED_LEN 10
+#define DOT11_FT_REMOTE_FRAME_TYPE 1
+#define DOT11_FT_PACKET_REQ 0
+#define DOT11_FT_PACKET_RESP 1
+
+#define BSSID_INVALID           "\x00\x00\x00\x00\x00\x00"
+#define BSSID_BROADCAST         "\xFF\xFF\xFF\xFF\xFF\xFF"
+
+#ifdef BCMWAPI_WAI
+#define WAPI_IE_MIN_LEN                20      /* WAPI IE min length */
+#define WAPI_VERSION           1       /* WAPI version */
+#define WAPI_VERSION_LEN       2       /* WAPI version length */
+#define WAPI_OUI               "\x00\x14\x72"  /* WAPI OUI */
+#define WAPI_OUI_LEN           DOT11_OUI_LEN   /* WAPI OUI length */
+#endif /* BCMWAPI_WAI */
+
+/* ************* WMM Parameter definitions. ************* */
+#define WMM_OUI                        "\x00\x50\xF2"  /* WNN OUI */
+#define WMM_OUI_LEN            3               /* WMM OUI length */
+#define WMM_OUI_TYPE   2               /* WMM OUT type */
+#define WMM_VERSION            1
+#define WMM_VERSION_LEN        1
+
+/* WMM OUI subtype */
+#define WMM_OUI_SUBTYPE_PARAMETER      1
+#define WMM_PARAMETER_IE_LEN           24
+
+/** Link Identifier Element */
+BWL_PRE_PACKED_STRUCT struct link_id_ie {
+       uint8 id;
+       uint8 len;
+       struct ether_addr       bssid;
+       struct ether_addr       tdls_init_mac;
+       struct ether_addr       tdls_resp_mac;
+} BWL_POST_PACKED_STRUCT;
+typedef struct link_id_ie link_id_ie_t;
+#define TDLS_LINK_ID_IE_LEN            18u
+
+/** Link Wakeup Schedule Element */
+BWL_PRE_PACKED_STRUCT struct wakeup_sch_ie {
+       uint8 id;
+       uint8 len;
+       uint32 offset;                  /* in ms between TSF0 and start of 1st Awake Window */
+       uint32 interval;                /* in ms bwtween the start of 2 Awake Windows */
+       uint32 awake_win_slots; /* in backof slots, duration of Awake Window */
+       uint32 max_wake_win;    /* in ms, max duration of Awake Window */
+       uint16 idle_cnt;                /* number of consecutive Awake Windows */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wakeup_sch_ie wakeup_sch_ie_t;
+#define TDLS_WAKEUP_SCH_IE_LEN         18
+
+/** Channel Switch Timing Element */
+BWL_PRE_PACKED_STRUCT struct channel_switch_timing_ie {
+       uint8 id;
+       uint8 len;
+       uint16 switch_time;             /* in ms, time to switch channels */
+       uint16 switch_timeout;  /* in ms */
+} BWL_POST_PACKED_STRUCT;
+typedef struct channel_switch_timing_ie channel_switch_timing_ie_t;
+#define TDLS_CHANNEL_SWITCH_TIMING_IE_LEN              4
+
+/** PTI Control Element */
+BWL_PRE_PACKED_STRUCT struct pti_control_ie {
+       uint8 id;
+       uint8 len;
+       uint8 tid;
+       uint16 seq_control;
+} BWL_POST_PACKED_STRUCT;
+typedef struct pti_control_ie pti_control_ie_t;
+#define TDLS_PTI_CONTROL_IE_LEN                3
+
+/** PU Buffer Status Element */
+BWL_PRE_PACKED_STRUCT struct pu_buffer_status_ie {
+       uint8 id;
+       uint8 len;
+       uint8 status;
+} BWL_POST_PACKED_STRUCT;
+typedef struct pu_buffer_status_ie pu_buffer_status_ie_t;
+#define TDLS_PU_BUFFER_STATUS_IE_LEN   1
+#define TDLS_PU_BUFFER_STATUS_AC_BK            1
+#define TDLS_PU_BUFFER_STATUS_AC_BE            2
+#define TDLS_PU_BUFFER_STATUS_AC_VI            4
+#define TDLS_PU_BUFFER_STATUS_AC_VO            8
+
+/* TDLS Action Field Values */
+#define TDLS_SETUP_REQ                         0
+#define TDLS_SETUP_RESP                                1
+#define TDLS_SETUP_CONFIRM                     2
+#define TDLS_TEARDOWN                          3
+#define TDLS_PEER_TRAFFIC_IND                  4
+#define TDLS_CHANNEL_SWITCH_REQ                        5
+#define TDLS_CHANNEL_SWITCH_RESP               6
+#define TDLS_PEER_PSM_REQ                      7
+#define TDLS_PEER_PSM_RESP                     8
+#define TDLS_PEER_TRAFFIC_RESP                 9
+#define TDLS_DISCOVERY_REQ                     10
+
+/* 802.11z TDLS Public Action Frame action field */
+#define TDLS_DISCOVERY_RESP                    14
+
+/* 802.11u GAS action frames */
+#define GAS_REQUEST_ACTION_FRAME                               10
+#define GAS_RESPONSE_ACTION_FRAME                              11
+#define GAS_COMEBACK_REQUEST_ACTION_FRAME              12
+#define GAS_COMEBACK_RESPONSE_ACTION_FRAME             13
+
+/* FTM - fine timing measurement public action frames */
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_req {
+       uint8 category;                         /* category of action frame (4) */
+       uint8 action;                           /* public action (32) */
+       uint8 trigger;                          /* trigger/continue? */
+       /* optional lci, civic loc, ftm params */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_req dot11_ftm_req_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_ftm {
+       uint8 category;                         /* category of action frame (4) */
+       uint8 action;                           /* public action (33) */
+       uint8 dialog;                           /* dialog token */
+       uint8 follow_up;                        /* follow up dialog token */
+       uint8 tod[6];                           /* t1 - last depart timestamp */
+       uint8 toa[6];                           /* t4 - last ack arrival timestamp */
+       uint8 tod_err[2];                       /* t1 error */
+       uint8 toa_err[2];                       /* t4 error */
+       /* optional lci report, civic loc report, ftm params */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm dot11_ftm_t;
+
+#define DOT11_FTM_ERR_NOT_CONT_OFFSET 1
+#define DOT11_FTM_ERR_NOT_CONT_MASK 0x80
+#define DOT11_FTM_ERR_NOT_CONT_SHIFT 7
+#define DOT11_FTM_ERR_NOT_CONT(_err) (((_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] & \
+       DOT11_FTM_ERR_NOT_CONT_MASK) >> DOT11_FTM_ERR_NOT_CONT_SHIFT)
+#define DOT11_FTM_ERR_SET_NOT_CONT(_err, _val) do {\
+       uint8 _err2 = (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET]; \
+       _err2 &= ~DOT11_FTM_ERR_NOT_CONT_MASK; \
+       _err2 |= ((_val) << DOT11_FTM_ERR_NOT_CONT_SHIFT) & DOT11_FTM_ERR_NOT_CONT_MASK; \
+       (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] = _err2; \
+} while (0)
+
+#define DOT11_FTM_ERR_MAX_ERR_OFFSET 0
+#define DOT11_FTM_ERR_MAX_ERR_MASK 0x7fff
+#define DOT11_FTM_ERR_MAX_ERR_SHIFT 0
+#define DOT11_FTM_ERR_MAX_ERR(_err) (((((_err)[1] & 0x7f) << 8) | (_err)[0]))
+#define DOT11_FTM_ERR_SET_MAX_ERR(_err, _val) do {\
+       uint16 _val2; \
+       uint16 _not_cont; \
+       _val2 =  (((_val) & DOT11_FTM_ERR_MAX_ERR_MASK) << DOT11_FTM_ERR_MAX_ERR_SHIFT); \
+       _val2 = (_val2 > 0x3fff) ? 0 : _val2; /* not expecting > 16ns error */ \
+       _not_cont = DOT11_FTM_ERR_NOT_CONT(_err); \
+       (_err)[0] = _val2 & 0xff; \
+       (_err)[1] = (_val2 >> 8) & 0xff; \
+       DOT11_FTM_ERR_SET_NOT_CONT(_err, _not_cont); \
+} while (0)
+
+#if defined(DOT11_FTM_ERR_ROM_COMPAT)
+/* incorrect defs - here for ROM compatibiity */
+#undef DOT11_FTM_ERR_NOT_CONT_OFFSET
+#undef DOT11_FTM_ERR_NOT_CONT_MASK
+#undef DOT11_FTM_ERR_NOT_CONT_SHIFT
+#undef DOT11_FTM_ERR_NOT_CONT
+#undef DOT11_FTM_ERR_SET_NOT_CONT
+
+#define DOT11_FTM_ERR_NOT_CONT_OFFSET 0
+#define DOT11_FTM_ERR_NOT_CONT_MASK 0x0001
+#define DOT11_FTM_ERR_NOT_CONT_SHIFT 0
+#define DOT11_FTM_ERR_NOT_CONT(_err) (((_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] & \
+       DOT11_FTM_ERR_NOT_CONT_MASK) >> DOT11_FTM_ERR_NOT_CONT_SHIFT)
+#define DOT11_FTM_ERR_SET_NOT_CONT(_err, _val) do {\
+       uint8 _err2 = (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET]; \
+       _err2 &= ~DOT11_FTM_ERR_NOT_CONT_MASK; \
+       _err2 |= ((_val) << DOT11_FTM_ERR_NOT_CONT_SHIFT) & DOT11_FTM_ERR_NOT_CONT_MASK; \
+       (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] = _err2; \
+} while (0)
+
+#undef DOT11_FTM_ERR_MAX_ERR_OFFSET
+#undef DOT11_FTM_ERR_MAX_ERR_MASK
+#undef DOT11_FTM_ERR_MAX_ERR_SHIFT
+#undef DOT11_FTM_ERR_MAX_ERR
+#undef DOT11_FTM_ERR_SET_MAX_ERR
+
+#define DOT11_FTM_ERR_MAX_ERR_OFFSET 0
+#define DOT11_FTM_ERR_MAX_ERR_MASK 0xfff7
+#define DOT11_FTM_ERR_MAX_ERR_SHIFT 1
+#define DOT11_FTM_ERR_MAX_ERR(_err) ((((_err)[1] << 7) | (_err)[0]) >> 1)
+#define DOT11_FTM_ERR_SET_MAX_ERR(_err, _val) do {\
+       uint16 _val2; \
+       _val2 =  (((_val) << DOT11_FTM_ERR_MAX_ERR_SHIFT) |\
+                ((_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] & DOT11_FTM_ERR_NOT_CONT_MASK)); \
+       (_err)[0] = _val2 & 0xff; \
+       (_err)[1] = _val2 >> 8 & 0xff; \
+} while (0)
+#endif /* DOT11_FTM_ERR_ROM_COMPAT */
+
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_params {
+       uint8 id;               /* DOT11_MNG_FTM_PARAM_ID 8.4.2.166 11mcd2.6/2014 - revisit */
+       uint8 len;
+       uint8 info[9];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_params dot11_ftm_params_t;
+#define DOT11_FTM_PARAMS_IE_LEN (sizeof(dot11_ftm_params_t) - 2)
+
+#define FTM_PARAMS_FIELD(_p, _off, _mask, _shift) (((_p)->info[(_off)] & (_mask)) >> (_shift))
+#define FTM_PARAMS_SET_FIELD(_p, _off, _mask, _shift, _val) do {\
+       uint8 _ptmp = (_p)->info[_off] & ~(_mask); \
+       (_p)->info[(_off)] = _ptmp | (((_val) << (_shift)) & (_mask)); \
+} while (0)
+
+#define FTM_PARAMS_STATUS_OFFSET 0
+#define FTM_PARAMS_STATUS_MASK 0x03
+#define FTM_PARAMS_STATUS_SHIFT 0
+#define FTM_PARAMS_STATUS(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_STATUS_OFFSET, \
+       FTM_PARAMS_STATUS_MASK, FTM_PARAMS_STATUS_SHIFT)
+#define FTM_PARAMS_SET_STATUS(_p, _status) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_STATUS_OFFSET, FTM_PARAMS_STATUS_MASK, FTM_PARAMS_STATUS_SHIFT, _status)
+
+#define FTM_PARAMS_VALUE_OFFSET 0
+#define FTM_PARAMS_VALUE_MASK 0x7c
+#define FTM_PARAMS_VALUE_SHIFT 2
+#define FTM_PARAMS_VALUE(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_VALUE_OFFSET, \
+       FTM_PARAMS_VALUE_MASK, FTM_PARAMS_VALUE_SHIFT)
+#define FTM_PARAMS_SET_VALUE(_p, _value) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_VALUE_OFFSET, FTM_PARAMS_VALUE_MASK, FTM_PARAMS_VALUE_SHIFT, _value)
+#define FTM_PARAMS_MAX_VALUE 32
+
+#define FTM_PARAMS_NBURSTEXP_OFFSET 1
+#define FTM_PARAMS_NBURSTEXP_MASK 0x0f
+#define FTM_PARAMS_NBURSTEXP_SHIFT 0
+#define FTM_PARAMS_NBURSTEXP(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_NBURSTEXP_OFFSET, \
+       FTM_PARAMS_NBURSTEXP_MASK, FTM_PARAMS_NBURSTEXP_SHIFT)
+#define FTM_PARAMS_SET_NBURSTEXP(_p, _bexp) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_NBURSTEXP_OFFSET, FTM_PARAMS_NBURSTEXP_MASK, FTM_PARAMS_NBURSTEXP_SHIFT, \
+       _bexp)
+
+#define FTM_PARAMS_NBURST(_p) (1 << FTM_PARAMS_NBURSTEXP(_p))
+
+enum {
+       FTM_PARAMS_NBURSTEXP_NOPREF = 15
+};
+
+enum {
+       FTM_PARAMS_BURSTTMO_NOPREF = 15
+};
+
+#define FTM_PARAMS_BURSTTMO_OFFSET 1
+#define FTM_PARAMS_BURSTTMO_MASK 0xf0
+#define FTM_PARAMS_BURSTTMO_SHIFT 4
+#define FTM_PARAMS_BURSTTMO(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_BURSTTMO_OFFSET, \
+       FTM_PARAMS_BURSTTMO_MASK, FTM_PARAMS_BURSTTMO_SHIFT)
+/* set timeout in params using _tmo where timeout = 2^(_tmo) * 250us */
+#define FTM_PARAMS_SET_BURSTTMO(_p, _tmo) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_BURSTTMO_OFFSET, FTM_PARAMS_BURSTTMO_MASK, FTM_PARAMS_BURSTTMO_SHIFT, (_tmo)+2)
+
+#define FTM_PARAMS_BURSTTMO_USEC(_val) ((1 << ((_val)-2)) * 250)
+#define FTM_PARAMS_BURSTTMO_VALID(_val) ((((_val) < 12 && (_val) > 1)) || \
+       (_val) == FTM_PARAMS_BURSTTMO_NOPREF)
+#define FTM_PARAMS_BURSTTMO_MAX_MSEC 128 /* 2^9 * 250us */
+#define FTM_PARAMS_BURSTTMO_MAX_USEC 128000 /* 2^9 * 250us */
+
+#define FTM_PARAMS_MINDELTA_OFFSET 2
+#define FTM_PARAMS_MINDELTA_USEC(_p) ((_p)->info[FTM_PARAMS_MINDELTA_OFFSET] * 100)
+#define FTM_PARAMS_SET_MINDELTA_USEC(_p, _delta) do { \
+       (_p)->info[FTM_PARAMS_MINDELTA_OFFSET] = (_delta) / 100; \
+} while (0)
+
+enum {
+       FTM_PARAMS_MINDELTA_NOPREF = 0
+};
+
+#define FTM_PARAMS_PARTIAL_TSF(_p) ((_p)->info[4] << 8 | (_p)->info[3])
+#define FTM_PARAMS_SET_PARTIAL_TSF(_p, _partial_tsf) do { \
+       (_p)->info[3] = (_partial_tsf) & 0xff; \
+       (_p)->info[4] = ((_partial_tsf) >> 8) & 0xff; \
+} while (0)
+
+#define FTM_PARAMS_PARTIAL_TSF_MASK 0x0000000003fffc00ULL
+#define FTM_PARAMS_PARTIAL_TSF_SHIFT 10
+#define FTM_PARAMS_PARTIAL_TSF_BIT_LEN 16
+#define FTM_PARAMS_PARTIAL_TSF_MAX 0xffff
+
+/* FTM can indicate upto 62k TUs forward and 1k TU backward */
+#define FTM_PARAMS_TSF_FW_HI (63487 << 10)     /* in micro sec */
+#define FTM_PARAMS_TSF_BW_LOW (64512 << 10)    /* in micro sec */
+#define FTM_PARAMS_TSF_BW_HI (65535 << 10)     /* in micro sec */
+#define FTM_PARAMS_TSF_FW_MAX FTM_PARAMS_TSF_FW_HI
+#define FTM_PARAMS_TSF_BW_MAX (FTM_PARAMS_TSF_BW_HI - FTM_PARAMS_TSF_BW_LOW)
+
+#define FTM_PARAMS_PTSFNOPREF_OFFSET 5
+#define FTM_PARAMS_PTSFNOPREF_MASK 0x1
+#define FTM_PARAMS_PTSFNOPREF_SHIFT 0
+#define FTM_PARAMS_PTSFNOPREF(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_PTSFNOPREF_OFFSET, \
+       FTM_PARAMS_PTSFNOPREF_MASK, FTM_PARAMS_PTSFNOPREF_SHIFT)
+#define FTM_PARAMS_SET_PTSFNOPREF(_p, _nopref) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_PTSFNOPREF_OFFSET, FTM_PARAMS_PTSFNOPREF_MASK, \
+       FTM_PARAMS_PTSFNOPREF_SHIFT, _nopref)
+
+#define FTM_PARAMS_ASAP_OFFSET 5
+#define FTM_PARAMS_ASAP_MASK 0x4
+#define FTM_PARAMS_ASAP_SHIFT 2
+#define FTM_PARAMS_ASAP(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_ASAP_OFFSET, \
+       FTM_PARAMS_ASAP_MASK, FTM_PARAMS_ASAP_SHIFT)
+#define FTM_PARAMS_SET_ASAP(_p, _asap) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_ASAP_OFFSET, FTM_PARAMS_ASAP_MASK, FTM_PARAMS_ASAP_SHIFT, _asap)
+
+/* FTM1 - AKA ASAP Capable */
+#define FTM_PARAMS_FTM1_OFFSET 5
+#define FTM_PARAMS_FTM1_MASK 0x02
+#define FTM_PARAMS_FTM1_SHIFT 1
+#define FTM_PARAMS_FTM1(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_FTM1_OFFSET, \
+       FTM_PARAMS_FTM1_MASK, FTM_PARAMS_FTM1_SHIFT)
+#define FTM_PARAMS_SET_FTM1(_p, _ftm1) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_FTM1_OFFSET, FTM_PARAMS_FTM1_MASK, FTM_PARAMS_FTM1_SHIFT, _ftm1)
+
+#define FTM_PARAMS_FTMS_PER_BURST_OFFSET 5
+#define FTM_PARAMS_FTMS_PER_BURST_MASK 0xf8
+#define FTM_PARAMS_FTMS_PER_BURST_SHIFT 3
+#define FTM_PARAMS_FTMS_PER_BURST(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_FTMS_PER_BURST_OFFSET, \
+       FTM_PARAMS_FTMS_PER_BURST_MASK, FTM_PARAMS_FTMS_PER_BURST_SHIFT)
+#define FTM_PARAMS_SET_FTMS_PER_BURST(_p, _nftms) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_FTMS_PER_BURST_OFFSET, FTM_PARAMS_FTMS_PER_BURST_MASK, \
+       FTM_PARAMS_FTMS_PER_BURST_SHIFT, _nftms)
+
+enum {
+       FTM_PARAMS_FTMS_PER_BURST_NOPREF = 0
+};
+
+#define FTM_PARAMS_CHAN_INFO_OFFSET 6
+#define FTM_PARAMS_CHAN_INFO_MASK 0xfc
+#define FTM_PARAMS_CHAN_INFO_SHIFT 2
+#define FTM_PARAMS_CHAN_INFO(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_CHAN_INFO_OFFSET, \
+       FTM_PARAMS_CHAN_INFO_MASK, FTM_PARAMS_CHAN_INFO_SHIFT)
+#define FTM_PARAMS_SET_CHAN_INFO(_p, _ci) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_CHAN_INFO_OFFSET, FTM_PARAMS_CHAN_INFO_MASK, FTM_PARAMS_CHAN_INFO_SHIFT, _ci)
+
+/* burst period - units of 100ms */
+#define FTM_PARAMS_BURST_PERIOD(_p) (((_p)->info[8] << 8) | (_p)->info[7])
+#define FTM_PARAMS_SET_BURST_PERIOD(_p, _bp) do {\
+       (_p)->info[7] = (_bp) & 0xff; \
+       (_p)->info[8] = ((_bp) >> 8) & 0xff; \
+} while (0)
+
+#define FTM_PARAMS_BURST_PERIOD_MS(_p) (FTM_PARAMS_BURST_PERIOD(_p) * 100)
+
+enum {
+       FTM_PARAMS_BURST_PERIOD_NOPREF = 0
+};
+
+/* FTM status values - last updated from 11mcD4.0 */
+enum {
+       FTM_PARAMS_STATUS_RESERVED      = 0,
+       FTM_PARAMS_STATUS_SUCCESSFUL = 1,
+       FTM_PARAMS_STATUS_INCAPABLE = 2,
+       FTM_PARAMS_STATUS_FAILED = 3,
+       /* Below are obsolte */
+       FTM_PARAMS_STATUS_OVERRIDDEN = 4,
+       FTM_PARAMS_STATUS_ASAP_INCAPABLE = 5,
+       FTM_PARAMS_STATUS_ASAP_FAILED = 6,
+       /* rest are reserved */
+};
+
+enum {
+       FTM_PARAMS_CHAN_INFO_NO_PREF            = 0,
+       FTM_PARAMS_CHAN_INFO_RESERVE1           = 1,
+       FTM_PARAMS_CHAN_INFO_RESERVE2           = 2,
+       FTM_PARAMS_CHAN_INFO_RESERVE3           = 3,
+       FTM_PARAMS_CHAN_INFO_NON_HT_5           = 4,
+       FTM_PARAMS_CHAN_INFO_RESERVE5           = 5,
+       FTM_PARAMS_CHAN_INFO_NON_HT_10          = 6,
+       FTM_PARAMS_CHAN_INFO_RESERVE7           = 7,
+       FTM_PARAMS_CHAN_INFO_NON_HT_20          = 8, /* excludes 2.4G, and High rate DSSS */
+       FTM_PARAMS_CHAN_INFO_HT_MF_20           = 9,
+       FTM_PARAMS_CHAN_INFO_VHT_20             = 10,
+       FTM_PARAMS_CHAN_INFO_HT_MF_40           = 11,
+       FTM_PARAMS_CHAN_INFO_VHT_40             = 12,
+       FTM_PARAMS_CHAN_INFO_VHT_80             = 13,
+       FTM_PARAMS_CHAN_INFO_VHT_80_80          = 14,
+       FTM_PARAMS_CHAN_INFO_VHT_160_2_RFLOS    = 15,
+       FTM_PARAMS_CHAN_INFO_VHT_160            = 16,
+       /* Reserved from 17 - 30 */
+       FTM_PARAMS_CHAN_INFO_DMG_2160           = 31,
+       /* Reserved from 32 - 63 */
+       FTM_PARAMS_CHAN_INFO_MAX                = 63
+};
+
+/* tag_ID/length/value_buffer tuple */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint8   id;
+       uint8   len;
+       uint8   data[1];
+} BWL_POST_PACKED_STRUCT ftm_vs_tlv_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_vs_ie {
+       uint8 id;                                               /* DOT11_MNG_VS_ID */
+       uint8 len;                                              /* length following */
+       uint8 oui[3];                                   /* BRCM_PROP_OUI (or Customer) */
+       uint8 sub_type;                                 /* BRCM_FTM_IE_TYPE (or Customer) */
+       uint8 version;
+       ftm_vs_tlv_t    tlvs[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_vs_ie dot11_ftm_vs_ie_t;
+
+/* same as payload of dot11_ftm_vs_ie.
+* This definition helps in having struct access
+* of pay load while building FTM VS IE from other modules(NAN)
+*/
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_vs_ie_pyld {
+       uint8 sub_type;                                 /* BRCM_FTM_IE_TYPE (or Customer) */
+       uint8 version;
+       ftm_vs_tlv_t    tlvs[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_vs_ie_pyld dot11_ftm_vs_ie_pyld_t;
+
+/* ftm vs api version */
+#define BCM_FTM_VS_PARAMS_VERSION 0x01
+
+/* ftm vendor specific information tlv types */
+enum {
+       FTM_VS_TLV_NONE = 0,
+       FTM_VS_TLV_REQ_PARAMS = 1,              /* additional request params (in FTM_REQ) */
+       FTM_VS_TLV_MEAS_INFO = 2,               /* measurement information (in FTM_MEAS) */
+       FTM_VS_TLV_SEC_PARAMS = 3,              /* security parameters (in either) */
+       FTM_VS_TLV_SEQ_PARAMS = 4,              /* toast parameters (FTM_REQ, BRCM proprietary) */
+       FTM_VS_TLV_MF_BUF = 5,                  /* multi frame buffer - may span ftm vs ie's */
+       FTM_VS_TLV_TIMING_PARAMS = 6,            /* timing adjustments */
+       FTM_VS_TLV_MF_STATS_BUF = 7             /* multi frame statistics buffer */
+       /* add additional types above */
+};
+
+/* the following definitions are *DEPRECATED* and moved to implementation files. They
+ * are retained here because previous (May 2016) some branches use them
+ */
+#define FTM_TPK_LEN                            16u
+#define FTM_RI_RR_BUF_LEN                      32u
+#define FTM_TPK_RI_RR_LEN                      13
+#define FTM_TPK_RI_RR_LEN_SECURE_2_0           28
+#define FTM_TPK_RI_PHY_LEN                     7u
+#define FTM_TPK_RR_PHY_LEN                     7u
+#define FTM_TPK_DATA_BUFFER_LEN                        88u
+#define FTM_TPK_LEN_SECURE_2_0                 64u
+#define FTM_TPK_RI_PHY_LEN_SECURE_2_0          14u
+#define FTM_TPK_RR_PHY_LEN_SECURE_2_0          14u
+
+#define FTM_RI_RR_BUF_LEN_20MHZ                        32u
+#define FTM_RI_RR_BUF_LEN_80MHZ                        64u
+
+#define FTM_RI_RR_BUF_LEN_FROM_CHANSPEC(chanspec) \
+       (CHSPEC_IS20((chanspec)) ? \
+       FTM_RI_RR_BUF_LEN_20MHZ : FTM_RI_RR_BUF_LEN_80MHZ)
+
+#define FTM_TPK_RI_RR_LEN_SECURE_2_0_20MHZ      28u
+#define FTM_TPK_RI_RR_LEN_SECURE_2_0_80MHZ      62u
+#define FTM_TPK_RI_RR_LEN_SECURE_2_0_2G                FTM_TPK_RI_RR_LEN_SECURE_2_0
+#define FTM_TPK_RI_RR_LEN_SECURE_2_0_5G                FTM_TPK_RI_RR_LEN_SECURE_2_0_80MHZ
+
+#define FTM_TPK_RI_RR_LEN_FROM_CHANSPEC(chanspec) \
+       (CHSPEC_IS20((chanspec)) ? FTM_TPK_RI_RR_LEN_SECURE_2_0_20MHZ : \
+       FTM_TPK_RI_RR_LEN_SECURE_2_0_80MHZ)
+
+#define FTM_TPK_RI_PHY_LEN_SECURE_2_0_20MHZ     14u
+#define FTM_TPK_RI_PHY_LEN_SECURE_2_0_80MHZ    31u
+#define FTM_TPK_RR_PHY_LEN_SECURE_2_0_80MHZ    31u
+
+#define FTM_TPK_RI_PHY_LEN_FROM_CHANSPEC(chanspec) \
+       (CHSPEC_IS20((chanspec)) ? FTM_TPK_RI_PHY_LEN_SECURE_2_0_20MHZ : \
+       FTM_TPK_RI_PHY_LEN_SECURE_2_0_80MHZ)
+
+#define FTM_TPK_RR_PHY_LEN_SECURE_2_0_20MHZ     14u
+
+#define FTM_TPK_RR_PHY_LEN_FROM_CHANSPEC(chanspec) \
+       (CHSPEC_IS20((chanspec)) ? FTM_TPK_RR_PHY_LEN_SECURE_2_0_20MHZ : \
+       FTM_TPK_RR_PHY_LEN_SECURE_2_0_80MHZ)
+
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_vs_params {
+       uint8 id;                       /* DOT11_MNG_VS_ID */
+       uint8 len;
+       uint8 oui[3];                   /* Proprietary OUI, BRCM_PROP_OUI */
+       uint8 bcm_vs_id;
+       ftm_vs_tlv_t ftm_tpk_ri_rr[1];          /* ftm_TPK_ri_rr place holder */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_vs_params dot11_ftm_vs_tpk_ri_rr_params_t;
+#define DOT11_FTM_VS_LEN  (sizeof(dot11_ftm_vs_tpk_ri_rr_params_t) - TLV_HDR_LEN)
+/* end *DEPRECATED* ftm definitions */
+
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_sync_info {
+       uint8 id;               /* Extended - 255 11mc D4.3  */
+       uint8 len;
+       uint8 id_ext;
+       uint8 tsf_sync_info[4];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_sync_info dot11_ftm_sync_info_t;
+
+/* ftm tsf sync info ie len - includes id ext */
+#define DOT11_FTM_SYNC_INFO_IE_LEN (sizeof(dot11_ftm_sync_info_t) - TLV_HDR_LEN)
+
+#define DOT11_FTM_IS_SYNC_INFO_IE(_ie) (\
+       DOT11_MNG_IE_ID_EXT_MATCH(_ie, DOT11_MNG_FTM_SYNC_INFO) && \
+       (_ie)->len == DOT11_FTM_SYNC_INFO_IE_LEN)
+
+BWL_PRE_PACKED_STRUCT struct dot11_dh_param_ie {
+       uint8   id;     /* OWE */
+       uint8   len;
+       uint8   ext_id; /* EXT_MNG_OWE_DH_PARAM_ID */
+       uint16  group;
+       uint8   pub_key[0];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dh_param_ie dot11_dh_param_ie_t;
+
+#define DOT11_DH_EXTID_OFFSET   (OFFSETOF(dot11_dh_param_ie_t, ext_id))
+
+#define DOT11_OWE_DH_PARAM_IE(_ie) (\
+       DOT11_MNG_IE_ID_EXT_MATCH(_ie, EXT_MNG_OWE_DH_PARAM_ID))
+
+#define DOT11_MNG_OWE_IE_ID_EXT_INIT(_ie, _id, _len) do {\
+       (_ie)->id = DOT11_MNG_ID_EXT_ID; \
+       (_ie)->len = _len; \
+       (_ie)->ext_id = _id; \
+} while (0)
+
+/* 802.11u interworking access network options */
+#define IW_ANT_MASK                                    0x0f
+#define IW_INTERNET_MASK                               0x10
+#define IW_ASRA_MASK                                   0x20
+#define IW_ESR_MASK                                    0x40
+#define IW_UESA_MASK                                   0x80
+
+/* 802.11u interworking access network type */
+#define IW_ANT_PRIVATE_NETWORK                         0
+#define IW_ANT_PRIVATE_NETWORK_WITH_GUEST              1
+#define IW_ANT_CHARGEABLE_PUBLIC_NETWORK               2
+#define IW_ANT_FREE_PUBLIC_NETWORK                     3
+#define IW_ANT_PERSONAL_DEVICE_NETWORK                 4
+#define IW_ANT_EMERGENCY_SERVICES_NETWORK              5
+#define IW_ANT_TEST_NETWORK                            14
+#define IW_ANT_WILDCARD_NETWORK                                15
+
+#define IW_ANT_LEN                     1
+#define IW_VENUE_LEN                   2
+#define IW_HESSID_LEN                  6
+#define IW_HESSID_OFF                  (IW_ANT_LEN + IW_VENUE_LEN)
+#define IW_MAX_LEN                     (IW_ANT_LEN + IW_VENUE_LEN + IW_HESSID_LEN)
+
+/* 802.11u advertisement protocol */
+#define ADVP_ANQP_PROTOCOL_ID                          0
+#define ADVP_MIH_PROTOCOL_ID                           1
+
+/* 802.11u advertisement protocol masks */
+#define ADVP_QRL_MASK                                  0x7f
+#define ADVP_PAME_BI_MASK                              0x80
+
+/* 802.11u advertisement protocol values */
+#define ADVP_QRL_REQUEST                               0x00
+#define ADVP_QRL_RESPONSE                              0x7f
+#define ADVP_PAME_BI_DEPENDENT                         0x00
+#define ADVP_PAME_BI_INDEPENDENT                       ADVP_PAME_BI_MASK
+
+/* 802.11u ANQP information ID */
+#define ANQP_ID_QUERY_LIST                             256
+#define ANQP_ID_CAPABILITY_LIST                                257
+#define ANQP_ID_VENUE_NAME_INFO                                258
+#define ANQP_ID_EMERGENCY_CALL_NUMBER_INFO             259
+#define ANQP_ID_NETWORK_AUTHENTICATION_TYPE_INFO       260
+#define ANQP_ID_ROAMING_CONSORTIUM_LIST                        261
+#define ANQP_ID_IP_ADDRESS_TYPE_AVAILABILITY_INFO      262
+#define ANQP_ID_NAI_REALM_LIST                         263
+#define ANQP_ID_G3PP_CELLULAR_NETWORK_INFO             264
+#define ANQP_ID_AP_GEOSPATIAL_LOCATION                 265
+#define ANQP_ID_AP_CIVIC_LOCATION                      266
+#define ANQP_ID_AP_LOCATION_PUBLIC_ID_URI              267
+#define ANQP_ID_DOMAIN_NAME_LIST                       268
+#define ANQP_ID_EMERGENCY_ALERT_ID_URI                 269
+#define ANQP_ID_EMERGENCY_NAI                          271
+#define ANQP_ID_NEIGHBOR_REPORT                                272
+#define ANQP_ID_VENDOR_SPECIFIC_LIST                   56797
+
+/* 802.11u ANQP ID len */
+#define ANQP_INFORMATION_ID_LEN                                2
+
+/* 802.11u ANQP OUI */
+#define ANQP_OUI_SUBTYPE                               9
+
+/* 802.11u venue name */
+#define VENUE_LANGUAGE_CODE_SIZE                       3
+#define VENUE_NAME_SIZE                                        255
+
+/* 802.11u venue groups */
+#define VENUE_UNSPECIFIED                              0
+#define VENUE_ASSEMBLY                                 1
+#define VENUE_BUSINESS                                 2
+#define VENUE_EDUCATIONAL                              3
+#define VENUE_FACTORY                                  4
+#define VENUE_INSTITUTIONAL                            5
+#define VENUE_MERCANTILE                               6
+#define VENUE_RESIDENTIAL                              7
+#define VENUE_STORAGE                                  8
+#define VENUE_UTILITY                                  9
+#define VENUE_VEHICULAR                                        10
+#define VENUE_OUTDOOR                                  11
+
+/* 802.11u network authentication type indicator */
+#define NATI_UNSPECIFIED                               -1
+#define NATI_ACCEPTANCE_OF_TERMS_CONDITIONS            0
+#define NATI_ONLINE_ENROLLMENT_SUPPORTED               1
+#define NATI_HTTP_HTTPS_REDIRECTION                    2
+#define NATI_DNS_REDIRECTION                           3
+
+/* 802.11u IP address type availability - IPv6 */
+#define IPA_IPV6_SHIFT                                 0
+#define IPA_IPV6_MASK                                  (0x03 << IPA_IPV6_SHIFT)
+#define        IPA_IPV6_NOT_AVAILABLE                          0x00
+#define IPA_IPV6_AVAILABLE                             0x01
+#define IPA_IPV6_UNKNOWN_AVAILABILITY                  0x02
+
+/* 802.11u IP address type availability - IPv4 */
+#define IPA_IPV4_SHIFT                                 2
+#define IPA_IPV4_MASK                                  (0x3f << IPA_IPV4_SHIFT)
+#define        IPA_IPV4_NOT_AVAILABLE                          0x00
+#define IPA_IPV4_PUBLIC                                        0x01
+#define IPA_IPV4_PORT_RESTRICT                         0x02
+#define IPA_IPV4_SINGLE_NAT                            0x03
+#define IPA_IPV4_DOUBLE_NAT                            0x04
+#define IPA_IPV4_PORT_RESTRICT_SINGLE_NAT              0x05
+#define IPA_IPV4_PORT_RESTRICT_DOUBLE_NAT              0x06
+#define IPA_IPV4_UNKNOWN_AVAILABILITY                  0x07
+
+/* 802.11u NAI realm encoding */
+#define REALM_ENCODING_RFC4282                         0
+#define REALM_ENCODING_UTF8                            1
+
+/* 802.11u IANA EAP method type numbers */
+#define REALM_EAP_TLS                                  13
+#define REALM_EAP_LEAP                                 17
+#define REALM_EAP_SIM                                  18
+#define REALM_EAP_TTLS                                 21
+#define REALM_EAP_AKA                                  23
+#define REALM_EAP_PEAP                                 25
+#define REALM_EAP_FAST                                 43
+#define REALM_EAP_PSK                                  47
+#define REALM_EAP_AKAP                                 50
+#define REALM_EAP_EXPANDED                             254
+
+/* 802.11u authentication ID */
+#define REALM_EXPANDED_EAP                             1
+#define REALM_NON_EAP_INNER_AUTHENTICATION             2
+#define REALM_INNER_AUTHENTICATION_EAP                 3
+#define REALM_EXPANDED_INNER_EAP                       4
+#define REALM_CREDENTIAL                               5
+#define REALM_TUNNELED_EAP_CREDENTIAL                  6
+#define REALM_VENDOR_SPECIFIC_EAP                      221
+
+/* 802.11u non-EAP inner authentication type */
+#define REALM_RESERVED_AUTH                            0
+#define REALM_PAP                                      1
+#define REALM_CHAP                                     2
+#define REALM_MSCHAP                                   3
+#define REALM_MSCHAPV2                                 4
+
+/* 802.11u credential type */
+#define REALM_SIM                                      1
+#define REALM_USIM                                     2
+#define REALM_NFC                                      3
+#define REALM_HARDWARE_TOKEN                           4
+#define REALM_SOFTOKEN                                 5
+#define REALM_CERTIFICATE                              6
+#define REALM_USERNAME_PASSWORD                                7
+#define REALM_SERVER_SIDE                              8
+#define REALM_RESERVED_CRED                            9
+#define REALM_VENDOR_SPECIFIC_CRED                     10
+
+/* 802.11u 3GPP PLMN */
+#define G3PP_GUD_VERSION                               0
+#define G3PP_PLMN_LIST_IE                              0
+
+/* AP Location Public ID Info encoding */
+#define PUBLIC_ID_URI_FQDN_SE_ID               0
+/* URI/FQDN Descriptor field values */
+#define LOCATION_ENCODING_HELD                 1
+#define LOCATION_ENCODING_SUPL                 2
+#define URI_FQDN_SIZE                                  255
+
+/** hotspot2.0 indication element (vendor specific) */
+BWL_PRE_PACKED_STRUCT struct hs20_ie {
+       uint8 oui[3];
+       uint8 type;
+       uint8 config;
+} BWL_POST_PACKED_STRUCT;
+typedef struct hs20_ie hs20_ie_t;
+#define HS20_IE_LEN 5  /* HS20 IE length */
+
+/* Short SSID list Extended Capabilities element */
+BWL_PRE_PACKED_STRUCT struct short_ssid_list_ie {
+       uint8 id;
+       uint8 len;
+       uint8 id_ext;
+       uint8 data[1];    /* Capabilities Information */
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct short_ssid_list_ie short_ssid_list_ie_t;
+#define SHORT_SSID_LIST_IE_FIXED_LEN   3       /* SHORT SSID LIST IE LENGTH */
+
+/** IEEE 802.11 Annex E */
+typedef enum {
+       DOT11_2GHZ_20MHZ_CLASS_12       = 81,   /* Ch 1-11 */
+       DOT11_5GHZ_20MHZ_CLASS_1        = 115,  /* Ch 36-48 */
+       DOT11_5GHZ_20MHZ_CLASS_2_DFS    = 118,  /* Ch 52-64 */
+       DOT11_5GHZ_20MHZ_CLASS_3        = 124,  /* Ch 149-161 */
+       DOT11_5GHZ_20MHZ_CLASS_4_DFS    = 121,  /* Ch 100-140 */
+       DOT11_5GHZ_20MHZ_CLASS_5        = 125,  /* Ch 149-165 */
+       DOT11_5GHZ_40MHZ_CLASS_22       = 116,  /* Ch 36-44,   lower */
+       DOT11_5GHZ_40MHZ_CLASS_23_DFS   = 119,  /* Ch 52-60,   lower */
+       DOT11_5GHZ_40MHZ_CLASS_24_DFS   = 122,  /* Ch 100-132, lower */
+       DOT11_5GHZ_40MHZ_CLASS_25       = 126,  /* Ch 149-157, lower */
+       DOT11_5GHZ_40MHZ_CLASS_27       = 117,  /* Ch 40-48,   upper */
+       DOT11_5GHZ_40MHZ_CLASS_28_DFS   = 120,  /* Ch 56-64,   upper */
+       DOT11_5GHZ_40MHZ_CLASS_29_DFS   = 123,  /* Ch 104-136, upper */
+       DOT11_5GHZ_40MHZ_CLASS_30       = 127,  /* Ch 153-161, upper */
+       DOT11_2GHZ_40MHZ_CLASS_32       = 83,   /* Ch 1-7,     lower */
+       DOT11_2GHZ_40MHZ_CLASS_33       = 84,   /* Ch 5-11,    upper */
+} dot11_op_class_t;
+
+/* QoS map */
+#define QOS_MAP_FIXED_LENGTH   (8 * 2) /* DSCP ranges fixed with 8 entries */
+
+/* BCM proprietary IE type for AIBSS */
+#define BCM_AIBSS_IE_TYPE 56
+
+/* BCM proprietary flag type for WL_DISCO_VSIE */
+#define SSE_OUI                                  "\x00\x00\xF0"
+#define VENDOR_ENTERPRISE_STA_OUI_TYPE           0x22
+#define MAX_VSIE_DISASSOC                        (1)
+#define DISCO_VSIE_LEN                           0x09u
+
+/* Single PMK IE */
+#define CCX_SPMK_TYPE  3       /* CCX Extended Cap IE type for SPMK */
+/* CCX Extended Capability IE */
+BWL_PRE_PACKED_STRUCT struct ccx_spmk_cap_ie {
+       uint8 id;               /* 221, DOT11_MNG_PROPR_ID */
+       uint8 len;
+       uint8 oui[DOT11_OUI_LEN];       /* 00:40:96, CISCO_AIRONET_OUI */
+       uint8 type;             /* 11 */
+       uint8 cap;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ccx_spmk_cap_ie ccx_spmk_cap_ie_t;
+
+/* OWE definitions */
+/* ID + len + OUI + OI type + BSSID + SSID_len */
+#define OWE_TRANS_MODE_IE_FIXED_LEN  13u
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _802_11_H_ */
diff --git a/bcmdhd.101.10.240.x/include/802.11ax.h b/bcmdhd.101.10.240.x/include/802.11ax.h
new file mode 100644 (file)
index 0000000..fc6b76e
--- /dev/null
@@ -0,0 +1,1169 @@
+/*
+ * Basic types and constants relating to 802.11ax/HE STA
+ * This is a portion of 802.11ax definition. The rest are in 802.11.h.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _802_11ax_h_
+#define _802_11ax_h_
+
+#include <typedefs.h>
+#include <bcmtlv.h>
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* HT Control Field: (Table 9-9a) */
+#define HTC_HE_VARIANT         0x03u
+#define HTC_HEVAR_SHIFT                0       /* HE VARIANT shift */
+#define HTC_HEVAR(htc)         (((htc) & HTC_HE_VARIANT) >> HTC_HEVAR_SHIFT)
+
+/* HT Control IDs: (Table 9-18a & Table 9-9a) */
+#define HTC_HE_CTLID_SHIFT     0x02u   /* HTC HE CTLID shift */
+#define HTC_HE_CTLID_MASK      0x0Fu   /* HTC HE CTLID mask  */
+#define HTC_HE_CTLID(htc)      (((htc) >> HTC_HE_CTLID_SHIFT) & HTC_HE_CTLID_MASK)
+
+#define HTC_HE_CTLID_TRS       0x0u    /* Triggered response scheduling */
+#define HTC_HE_CTLID_OMI       0x1u    /* Operating mode */
+#define HTC_HE_CTLID_HLA       0x2u    /* HE link adaptation */
+#define HTC_HE_CTLID_BSR       0x3u    /* Buffer status report */
+#define HTC_HE_CTLID_UPH       0x4u    /* UL power headroom */
+#define HTC_HE_CTLID_BQR       0x5u    /* Bandwidth query report */
+#define HTC_HE_CTLID_CAS       0x6u    /* Command and status */
+
+/* HTC-Control field definitions: (Table 9.9a HTC Control field) */
+#define HTC_HE_CTL_SIZE                30u     /* HTC Control field size */
+#define HTC_HE_CTL_DEFAULT     0xFFFFFFFC
+
+/* A-Control offset definitions: (Figure 9.18a Control ID subfield values) */
+#define HE_ACTRL_TRS_FSZ       26u
+#define HE_ACTRL_OMI_FSZ       12u
+#define HE_ACTRL_HLA_FSZ       26u
+#define HE_ACTRL_BSR_FSZ       26u
+#define HE_ACTRL_UPH_FSZ       8u
+#define HE_ACTRL_BQR_FSZ       10u
+#define HE_ACTRL_CAS_FSZ       8u
+
+/* OM-Control Field definitions: (Figure 9.15d Control Information subfield for OM Control) */
+#define HE_OMI_RXNSS_FSZ               3
+#define HE_OMI_RXNSS_IDX               0
+#define HE_OMI_RXNSS_MASK              0x07u
+#define HE_OMI_CHW_FSZ                 2
+#define HE_OMI_CHW_IDX                 3
+#define HE_OMI_CHW_MASK                        0x18u
+#define HE_OMI_ULMU_DIS_FSZ            1
+#define HE_OMI_ULMU_DIS_IDX            5
+#define HE_OMI_ULMU_DIS_MASK           0x20u
+#define HE_OMI_TXNSTS_FSZ              3
+#define HE_OMI_TXNSTS_IDX              6
+#define HE_OMI_TXNSTS_MASK             0x1c0u
+#define HE_OMI_ERSU_DIS_FSZ            1
+#define HE_OMI_ERSU_DIS_IDX            9
+#define HE_OMI_ERSU_DIS_MASK           0x200u
+#define HE_OMI_DLMU_RSD_RCM_FSZ                1
+#define HE_OMI_DLMU_RSD_RCM_IDX                10
+#define HE_OMI_DLMU_RSD_RCM_MASK       0x400u
+#define HE_OMI_ULMU_DATA_DIS_FSZ       1
+#define HE_OMI_ULMU_DATA_DIS_IDX       11
+#define HE_OMI_ULMU_DATA_DIS_MASK      0x800u
+
+/* OM-Control Channel Width Subfield definition, as per 9.2.4.6a.2 OM Control */
+#define OMI_CHW_20MHZ                  0
+#define OMI_CHW_40MHZ                  1
+#define OMI_CHW_80MHZ                  2
+#define OMI_CHW_160MHZ_80P80MHZ                3
+
+/* Table 9-18d ACI Bitmap subfield encoding */
+#define HE_BSR_ACI_MAP_BE              0u
+#define HE_BSR_ACI_MAP_BK              1u
+#define HE_BSR_ACI_MAP_VI              2u
+#define HE_BSR_ACI_MAP_VO              3u
+
+/* GI And LTF Type subfield encoding (Table 9-31d) */
+#define HE_LTF_1_GI_1_6us      (0u)
+#define HE_LTF_2_GI_1_6us      (1u)
+#define HE_LTF_4_GI_3_2us      (2u)
+
+/* special STA-IDs (Section 27.11.1) */
+#define HE_STAID_BSS_BCAST             0
+#define HE_STAID_UNASSOCIATED_STA      2045u
+#define HE_STAID_NO_USER               2046u
+#define HE_STAID_MBSS_BCAST            2047u
+#define HE_STAID_MASK                  0x07FFu
+#define HE_AID12_MASK                  0x0FFFu
+
+/**
+ * HE Capabilites element (sec 9.4.2.218)
+ */
+
+/* HE MAC Capabilities Information field (figure 9-589ck) */
+#define HE_MAC_CAP_INFO_SIZE   6u
+typedef uint8 he_mac_cap_t[HE_MAC_CAP_INFO_SIZE];
+
+/* bit position and field width */
+#define HE_MAC_HTC_HE_SUPPORT_IDX              0       /* HTC HE Support */
+#define HE_MAC_HTC_HE_SUPPORT_FSZ              1
+#define HE_MAC_TWT_REQ_SUPPORT_IDX             1       /* TWT Requestor Support */
+#define HE_MAC_TWT_REQ_SUPPORT_FSZ             1
+#define HE_MAC_TWT_RESP_SUPPORT_IDX            2       /* TWT Responder Support */
+#define HE_MAC_TWT_RESP_SUPPORT_FSZ            1
+#define HE_MAC_FRAG_SUPPORT_IDX                        3       /* Fragmentation Support */
+#define HE_MAC_FRAG_SUPPORT_FSZ                        2
+#define HE_MAC_MAX_MSDU_FRAGS_IDX              5       /* Max. Fragmented MSDUs */
+#define HE_MAC_MAX_MSDU_FRAGS_FSZ              3
+#define HE_MAC_MIN_FRAG_SIZE_IDX               8       /* Min. Fragment Size */
+#define HE_MAC_MIN_FRAG_SIZE_FSZ               2
+#define HE_MAC_TRIG_MAC_PAD_DUR_IDX            10      /* Trigger Frame MAC Pad Dur */
+#define HE_MAC_TRIG_MAC_PAD_DUR_FSZ            2
+#define HE_MAC_MULTI_TID_AGG_RX_IDX            12      /* Multi TID Agg. Rx support */
+#define HE_MAC_MULTI_TID_AGG_RX_FSZ            3
+#define HE_MAC_LINK_ADAPT_IDX                  15      /* HE Link Adaptation Support */
+#define HE_MAC_LINK_ADAPT_FSZ                  2
+#define HE_MAC_ALL_ACK_SUPPORT_IDX             17      /* All Ack Support */
+#define HE_MAC_ALL_ACK_SUPPORT_FSZ             1
+#define HE_MAC_TRS_SUPPORT_IDX                 18      /* TRS Support */
+#define HE_MAC_TRS_SUPPORT_FSZ                 1
+#define HE_MAC_BSR_SUPPORT_IDX                 19      /* BSR Support */
+#define HE_MAC_BSR_SUPPORT_FSZ                 1
+#define HE_MAC_BCAST_TWT_SUPPORT_IDX           20      /* Broadcast TWT Support */
+#define HE_MAC_BCAST_TWT_SUPPORT_FSZ           1
+#define HE_MAC_32BA_BITMAP_SUPPORT_IDX         21      /* 32-bit BA Bitmap Support */
+#define HE_MAC_32BA_BITMAP_SUPPORT_FSZ         1
+#define HE_MAC_MU_CASCADE_SUPPORT_IDX          22      /* MU Cascade Support */
+#define HE_MAC_MU_CASCADE_SUPPORT_FSZ          1
+#define HE_MAC_ACK_ENAB_AGG_SUPPORT_IDX                23      /* Ack Enabled Agg. Support */
+#define HE_MAC_ACK_ENAB_AGG_SUPPORT_FSZ                1
+/* bit 24 - Reserved */
+#define HE_MAC_OMI_CONTROL_SUPPORT_IDX         25      /* OMI Control Support */
+#define HE_MAC_OMI_CONTROL_SUPPORT_FSZ         1
+#define HE_MAC_OFDMA_RA_SUPPORT_IDX            26      /* OFDMA RA Support */
+#define HE_MAC_OFDMA_RA_SUPPORT_FSZ            1
+#define HE_MAC_MAX_AMPDU_LEN_EXP_IDX           27      /* Max AMPDU Length Exponent */
+#define HE_MAC_MAX_AMPDU_LEN_EXP_FSZ           2
+#define HE_MAC_AMSDU_FRAG_SUPPORT_IDX          29      /* AMSDU Fragementation Support */
+#define HE_MAC_AMSDU_FRAG_SUPPORT_FSZ          1
+#define HE_MAC_FLEX_TWT_SCHEDULE_IDX           30      /* Flexible TWT Schedule Support */
+#define HE_MAC_FLEX_TWT_SCHEDULE_FSZ           1
+#define HE_MAC_RX_MBSS_CTL_FRAME_IDX           31      /* Rx control frames to Multi BSS */
+#define HE_MAC_RX_MBSS_CTL_FRAME_FSZ           1
+#define HE_MAC_RX_AGG_BSRP_BQRP_IDX            32      /* Aggregated BSRP BQRP Rx */
+#define HE_MAC_RX_AGG_BSRP_BQRP_FSZ            1
+#define HE_MAC_QTP_SUPPORT_IDX                 33      /* Support Quiet time period */
+#define HE_MAC_QTP_SUPPORT_FSZ                 1
+#define HE_MAC_BQR_SUPPORT_IDX                 34      /* Support BQR */
+#define HE_MAC_BQR_SUPPORT_FSZ                 1
+#define HE_MAC_SRP_RESPONDER_IDX               35      /* SRP responder Support */
+#define HE_MAC_SRP_RESPONDER_FSZ               1
+#define HE_MAC_NDP_FDBK_SUPPORT_IDX            36      /* NDP feedback report Support */
+#define HE_MAC_NDP_FDBK_SUPPORT_FSZ            1
+#define HE_MAC_OPS_SUPPORT_IDX                 37      /* OPS support */
+#define HE_MAC_OPS_SUPPORT_FSZ                 1
+#define HE_MAC_AMSDU_IN_AMPDU_IDX              38      /* AMSDU in AMPDU support */
+#define HE_MAC_AMSDU_IN_AMPDU_FSZ              1
+#define HE_MAC_MULTI_TID_AGG_TX_IDX            39      /* Multi TID Agg. Tx support */
+#define HE_MAC_MULTI_TID_AGG_TX_FSZ            3
+#define HE_MAC_SST_SUPPORT_IDX                 42      /* Sub-channel Selective channel */
+#define HE_MAC_SST_SUPPORT_FSZ                 1
+#define HE_MAC_UL_2X_996_TONE_RU_SUPP_IDX      43      /* UL 2X 996 tone RU Support */
+#define HE_MAC_UL_2X_996_TONE_RU_SUPP_FSZ      1
+#define HE_MAC_UL_MU_DATA_DISABLE_RX_IDX       44      /* OM - UL MU Data Disable RX */
+#define HE_MAC_UL_MU_DATA_DISABLE_RX_FSZ       1
+#define HE_MAC_DYNAMIC_SM_PWR_SAVE_IDX         45      /* HE Dynamic SM Power Save */
+#define HE_MAC_DYNAMIC_SM_PWR_SAVE_FSZ         1
+#define HE_MAC_PUNCT_SOUNDING_SUPP_IDX         46      /* Punctured Sounding Support */
+#define HE_MAC_PUNCT_SOUNDING_SUPP_FSZ         1
+#define HE_MAC_HT_VHT_TRIG_FRAME_RX_IDX                47      /* HT And VHT Trigger Frame RX Support */
+#define HE_MAC_HT_VHT_TRIG_FRAME_RX_FSZ                1
+
+/* HE PHY Capabilities Information field (figure 9-589cl) */
+#define HE_PHY_CAP_INFO_SIZE                   11u
+typedef uint8 he_phy_cap_t[HE_PHY_CAP_INFO_SIZE];
+
+/* bit position and field width */
+/* bit 0 - Reserved */
+#define HE_PHY_CH_WIDTH_SET_IDX                        1       /* Channel Width Set */
+#define HE_PHY_CH_WIDTH_SET_FSZ                        7
+#define HE_PHY_PUNCT_PREAMBLE_RX_IDX           8       /* Punctured Preamble Rx */
+#define HE_PHY_PUNCT_PREAMBLE_RX_FSZ           4
+#define HE_PHY_DEVICE_CLASS_IDX                        12      /* Device Class */
+#define HE_PHY_DEVICE_CLASS_FSZ                        1
+#define HE_PHY_LDPC_PYLD_IDX                   13      /* LDPC Coding In Payload */
+#define HE_PHY_LDPC_PYLD_FSZ                   1
+#define HE_PHY_SU_PPDU_1x_LTF_0_8_GI_IDX       14      /* SU PPDU 1x LTF GI 0.8 us */
+#define HE_PHY_SU_PPDU_1x_LTF_0_8_GI_FSZ       1
+#define HE_PHY_MIDAMBLE_MAX_NSTS_IDX           15      /* Midamble Tx/Rx Max NSTS */
+#define HE_PHY_MIDAMBLE_MAX_NSTS_FSZ           2
+#define HE_PHY_NDP_4x_LTF_3_2_GI_IDX           17      /* NDP with 4xLTF 3.2us GI */
+#define HE_PHY_NDP_4x_LTF_3_2_GI_FSZ           1
+#define HE_PHY_STBC_TX_IDX                     18      /* STBC Tx for <= 80 MHz */
+#define HE_PHY_STBC_TX_FSZ                     1
+#define HE_PHY_STBC_RX_IDX                     19      /* STBC Rx for <= 80 MHz */
+#define HE_PHY_STBC_RX_FSZ                     1
+#define HE_PHY_DOPPLER_TX_IDX                  20      /* Doppler Tx */
+#define HE_PHY_DOPPLER_TX_FSZ                  1
+#define HE_PHY_DOPPLER_RX_IDX                  21      /* Doppler Rx */
+#define HE_PHY_DOPPLER_RX_FSZ                  1
+#define HE_PHY_FULL_BW_UL_MU_MIMO_IDX          22      /* Full bandwidth UL MU MIMO */
+#define HE_PHY_FULL_BW_UL_MU_MIMO_FSZ          1
+#define HE_PHY_PART_BW_UL_MU_MIMO_IDX          23      /* Partial bandwidth UL MU MIMO */
+#define HE_PHY_PART_BW_UL_MU_MIMO_FSZ          1
+#define HE_PHY_DCM_MAX_CONST_TX_IDX            24      /* DCM Max Constellation Tx */
+#define HE_PHY_DCM_MAX_CONST_TX_FSZ            2
+#define HE_PHY_DCM_MAX_NSS_TX_IDX              26      /* DCM Max NSS Tx */
+#define HE_PHY_DCM_MAX_NSS_TX_FSZ              1
+#define HE_PHY_DCM_MAX_CONST_RX_IDX            27      /* DCM Max Constellation Rx */
+#define HE_PHY_DCM_MAX_CONST_RX_FSZ            2
+#define HE_PHY_DCM_MAX_NSS_RX_IDX              29      /* DCM Max NSS Rx */
+#define HE_PHY_DCM_MAX_NSS_RX_FSZ              1
+#define HE_PHY_RX_MU_PPDU_IDX                  30      /* Rx HE MU PPDU From nonAP STA */
+#define HE_PHY_RX_MU_PPDU_FSZ                  1
+#define HE_PHY_SU_BEAMFORMER_IDX               31      /* SU Beamformer */
+#define HE_PHY_SU_BEAMFORMER_FSZ               1
+#define HE_PHY_SU_BEAMFORMEE_IDX               32      /* SU Beamformee */
+#define HE_PHY_SU_BEAMFORMEE_FSZ               1
+#define HE_PHY_MU_BEAMFORMER_IDX               33      /* MU Beamformer */
+#define HE_PHY_MU_BEAMFORMER_FSZ               1
+#define HE_PHY_BEAMFORMEE_STS_BELOW80MHZ_IDX   34      /* Beamformee STS For <= 80MHz */
+#define HE_PHY_BEAMFORMEE_STS_BELOW80MHZ_FSZ   3
+#define HE_PHY_BEAMFORMEE_STS_ABOVE80MHZ_IDX   37      /* Beamformee STS For >80 MHz */
+#define HE_PHY_BEAMFORMEE_STS_ABOVE80MHZ_FSZ   3
+#define HE_PHY_SOUND_DIM_BELOW80MHZ_IDX                40      /* Num. Sounding Dim.<= 80 MHz */
+#define HE_PHY_SOUND_DIM_BELOW80MHZ_FSZ                3
+#define HE_PHY_SOUND_DIM_ABOVE80MHZ_IDX                43      /* Num. Sounding Dim.> 80 MHz */
+#define HE_PHY_SOUND_DIM_ABOVE80MHZ_FSZ                3
+#define HE_PHY_SU_FEEDBACK_NG16_SUPPORT_IDX    46      /* Ng=16 For SU Feedback */
+#define HE_PHY_SU_FEEDBACK_NG16_SUPPORT_FSZ    1
+#define HE_PHY_MU_FEEDBACK_NG16_SUPPORT_IDX    47      /* Ng=16 For MU Feedback */
+#define HE_PHY_MU_FEEDBACK_NG16_SUPPORT_FSZ    1
+#define HE_PHY_SU_CODEBOOK_SUPPORT_IDX         48      /* Codebook Sz {4, 2} For SU */
+#define HE_PHY_SU_CODEBOOK_SUPPORT_FSZ         1
+#define HE_PHY_MU_CODEBOOK_SUPPORT_IDX         49      /* Codebook Size {7, 5} For MU */
+#define HE_PHY_MU_CODEBOOK_SUPPORT_FSZ         1
+#define HE_PHY_TRG_SU_BFM_FEEDBACK_IDX         50      /* Triggered SU TXBF Feedback */
+#define HE_PHY_TRG_SU_BFM_FEEDBACK_FSZ         1
+#define HE_PHY_TRG_MU_BFM_FEEDBACK_IDX         51      /* Triggered MU TXBF partial BW Feedback */
+#define HE_PHY_TRG_MU_BFM_FEEDBACK_FSZ         1
+#define HE_PHY_TRG_CQI_FEEDBACK_IDX            52      /* Triggered CQI Feedback */
+#define HE_PHY_TRG_CQI_FEEDBACK_FSZ            1
+#define HE_PHY_PART_BW_EXT_RANGE_IDX           53      /* Partial BW Extended Range */
+#define HE_PHY_PART_BW_EXT_RANGE_FSZ           1
+#define HE_PHY_DL_MU_MIMO_PART_BW_IDX          54      /* Partial Bandwidth DL MU MIMO */
+#define HE_PHY_DL_MU_MIMO_PART_BW_FSZ          1
+#define HE_PHY_PPE_THRESH_PRESENT_IDX          55      /* PPE Threshold Present */
+#define HE_PHY_PPE_THRESH_PRESENT_FSZ          1
+#define HE_PHY_SRP_SR_SUPPORT_IDX              56      /* SRP based SR Support */
+#define HE_PHY_SRP_SR_SUPPORT_FSZ              1
+#define HE_PHY_POWER_BOOST_FACTOR_IDX          57      /* Power Boost Factor Support */
+#define HE_PHY_POWER_BOOST_FACTOR_FSZ          1
+#define HE_PHY_4X_LTF_0_8_GI_SUPPORT_IDX       58      /* HE SU PPDU And HE MU PPDU with
+                                                       * 4x HE-LTF And 0.8 us GI
+                                                       */
+#define HE_PHY_4X_LTF_0_8_GI_SUPPORT_FSZ       1
+#define HE_PHY_MAX_NC_IDX                      59      /* Maximum NC */
+#define HE_PHY_MAX_NC_FSZ                      3
+#define HE_PHY_STBC_TX_ABOVE_80_IDX            62      /* STBC Tx above 80 MHz */
+#define HE_PHY_STBC_TX_ABOVE_80_FSZ            1
+#define HE_PHY_STBC_RX_ABOVE_80_IDX            63      /* STBC Rx above 80 MHz */
+#define HE_PHY_STBC_RX_ABOVE_80_FSZ            1
+#define HE_PHY_ER_SU_4X_LTF_0_8_GI_IDX         64      /* ER SU PPDU 4x HE-LTF 0.8 GI */
+#define HE_PHY_ER_SU_4X_LTF_0_8_GI_FSZ         1
+#define HE_PHY_20_IN_40_2G_IDX                 65      /* 20 in 40 MHz HE PPDU in 2G */
+#define HE_PHY_20_IN_40_2G_FSZ                 1
+#define HE_PHY_20_IN_160_80P80_IDX             66      /* 20 in 160/80+80 MHz HE PPDU */
+#define HE_PHY_20_IN_160_80P80_FSZ             1
+#define HE_PHY_80_IN_160_80P80_IDX             67      /* 80 in 160/80+80 MHz HE PPDU */
+#define HE_PHY_80_IN_160_80P80_FSZ             1
+#define HE_PHY_ER_SU_1X_LTF_0_8_GI_IDX         68      /* HE ER SU 1x HE-LTF 0.8 GI */
+#define HE_PHY_ER_SU_1X_LTF_0_8_GI_FSZ         1
+#define HE_PHY_MIDAMBLE_2X_1X_LTF_IDX          69      /* Midamble TX/RX 2x & 1x HE LTF */
+#define HE_PHY_MIDAMBLE_2X_1X_LTF_FSZ          1
+#define HE_PHY_DCM_MAX_BW_IDX                  70      /* DCM Max BW */
+#define HE_PHY_DCM_MAX_BW_FSZ                  2
+#define HE_PHY_ABOVE16_OFDM_SYM_IDX            72      /* Longer than 16 HE-SIGB OFDM
+                                                        * Symbol support
+                                                        */
+#define HE_PHY_ABOVE16_OFDM_SYM_FSZ            1
+#define HE_PHY_NON_TRIG_CQI_FDBK_IDX           73      /* Non-triggered CQI feedback Support */
+#define HE_PHY_NON_TRIG_CQI_FDBK_FSZ           1
+#define HE_PHY_1024_QAM_TX_BELOW_242_RU_IDX    74      /* Tx 1024 QAM in < 242 RU Tone Support */
+#define HE_PHY_1024_QAM_TX_BELOW_242_RU_FSZ    1
+#define HE_PHY_1024_QAM_RX_BELOW_242_RU_IDX    75      /* Rx 1024 QAM in < 242 RU Tone Support */
+#define HE_PHY_1024_QAM_RX_BELOW_242_RU_FSZ    1
+#define HE_PHY_RX_FULL_BW_MU_COMP_SIGB_IDX     76      /* Rx Full BW MU PPDU with Comp. SIGB */
+#define HE_PHY_RX_FULL_BW_MU_COMP_SIGB_FSZ     1
+#define HE_PHY_RX_FULL_BW_MU_NON_COMP_SIGB_IDX 77      /* Rx Full BW MU PPDU Non-Comp SIGB */
+#define HE_PHY_RX_FULL_BW_MU_NON_COMP_SIGB_FSZ 1
+
+/* HE Mac Capabilities values */
+/* b3-b4: Fragmentation Support field (table 9-262z) */
+#define HE_MAC_FRAG_NOSUPPORT          0       /* dynamic fragmentation not supported */
+#define HE_MAC_FRAG_PER_MPDU           1       /* dynamic fragmentation of MPDU/SMPDU */
+#define HE_MAC_FRAG_ONE_PER_AMPDU      2       /* upto 1 fragment per AMPDU/MMPDU */
+#define HE_MAC_FRAG_MULTI_PER_AMPDU    3       /* multiple fragment per AMPDU */
+
+/* b5-b7 : Maximum Number Of Fragmented MSDUs/AMSDUs Exponent */
+#define HE_MAC_MAXFRAG_NUM_NO_RESTRICT 7
+
+/* b8-b9: Minimum payload size of first fragment */
+#define HE_MAC_MINFRAG_NO_RESTRICT     0       /* no restriction on min. payload size */
+#define HE_MAC_MINFRAG_SIZE_128                1       /* minimum payload size of 128 Bytes */
+#define HE_MAC_MINFRAG_SIZE_256                2       /* minimum payload size of 256 Bytes */
+#define HE_MAC_MINFRAG_SIZE_512                3       /* minimum payload size of 512 Bytes */
+
+/* b10-b11: Trigger Frame MAC Padding Duration */
+#define HE_MAC_TRIG_MAC_PAD_0          0
+#define HE_MAC_TRIG_MAC_PAD_8us                1
+#define HE_MAC_TRIG_MAC_PAD_16us       2
+
+/* b15-b16: HE Link Adaptation */
+#define HE_MAC_SEND_NO_MFB             0       /* if STA does not provide HE MFB */
+#define HE_MAC_SEND_UNSOLICATED_MFB    2       /* if STA provides unsolicited HE MFB */
+#define HE_MAC_SEND_MFB_IN_RESPONSE    3       /* if STA can provide HE MFB in response to
+                                               * HE MRQ and if the STA provides unsolicited HE MFB.
+                                               */
+
+/* b27-b28: Max. AMPDU Length HE Exponent */
+/* Use Max AMPDU length exponent from VHT or HT */
+#define HE_MAC_MAX_AMPDU_EXP_ADOPT_VHT (0)
+/* Max. AMPDU length =
+ * 2^(20 + MAX_AMPDU_LEN_HE_EXPO_1) -1 (if this value in VHT CAP is 7) or
+ * 2^(16 + MAX_AMPDU_LEN_HE_EXPO_1) -1 (if this value in HT CAP is 3).
+ */
+#define HE_MAC_MAX_AMPDU_EXP_HE_1      (1)
+/* Max. AMPDU length =
+ * 2^(20 + MAX_AMPDU_LEN_HE_EXPO_2) -1 (if this value in VHT CAP is 7) or
+ * 2^(16 + MAX_AMPDU_LEN_HE_EXPO_2) -1 (if this value in HT CAP is 3).
+ */
+#define HE_MAC_MAX_AMPDU_EXP_HE_2      (2)
+/* Max. AMPDU length =
+ * 2^(20 + MAX_AMPDU_LEN_HE_EXPO_3) -1 (if this value in VHT CAP is 7) or
+ * 2^(16 + MAX_AMPDU_LEN_HE_EXPO_3) -1 (if this value in HT CAP is 3).
+ */
+#define HE_MAC_MAX_AMPDU_EXP_HE_3      (3)
+
+/* HE PHY Capabilities values */
+/* b1-b7: Channel Width Support field */
+#define HE_PHY_CH_WIDTH_2G_40          0x01
+#define HE_PHY_CH_WIDTH_5G_80          0x02
+#define HE_PHY_CH_WIDTH_5G_160         0x04
+#define HE_PHY_CH_WIDTH_5G_80P80       0x08
+#define HE_PHY_CH_WIDTH_2G_242RU       0x10
+#define HE_PHY_CH_WIDTH_5G_242RU       0x20
+
+/* b8-b11: Preamble puncturing Rx */
+/* Rx of 80 MHz preamble where secondary 20 MHz subchannel is punctured */
+#define HE_PHY_PREAMBLE_PUNC_RX_0      0x1
+/* Rx of 80 MHz preamble where one of two 20 MHz subchannels in secondary 40 MHz is punctured */
+#define HE_PHY_PREAMBLE_PUNC_RX_1      0x2
+/* Rx of 160 MHz or 80+80 MHz preamble where primary 80 MHz of
+ * preamble only the secondary 20 MHz is punctured
+ */
+#define HE_PHY_PREAMBLE_PUNC_RX_2      0x4
+/* Rx of 160 MHz or 80+80 MHz preamble where primary 80 MHz of
+ * the preamble, the primary 40 MHz is present
+ */
+#define HE_PHY_PREAMBLE_PUNC_RX_3      0x8
+
+/* b24-b26: DCM Encoding Tx */
+#define HE_PHY_TX_DCM_ENC_NOSUPPORT    0x00
+#define HE_PHY_TX_DCM_ENC_BPSK         0x01
+#define HE_PHY_TX_DCM_ENC_QPSK         0x02
+#define HE_PHY_TX_DCM_ENC_QAM          0x03
+
+#define HE_PHY_TX_DCM_1_SS             0x00
+#define HE_PHY_TX_DCM_2_SS             0x01
+
+/* b27-b29: DCM Encoding Rx */
+#define HE_PHY_RX_DCM_ENC_NOSUPPORT    0x00
+#define HE_PHY_RX_DCM_ENC_BPSK         0x01
+#define HE_PHY_RX_DCM_ENC_QPSK         0x02
+#define HE_PHY_RX_DCM_ENC_QAM          0x03
+
+#define HE_PHY_RX_DCM_1_SS             0x00
+#define HE_PHY_RX_DCM_2_SS             0x01
+
+/* b70-b71: DCM Max BW */
+#define HE_PHY_DCM_MAX_BW_20           0
+#define HE_PHY_DCM_MAX_BW_40           1
+#define HE_PHY_DCM_MAX_BW_80           2
+#define HE_PHY_DCM_MAX_BW_160          3
+
+/* HE Duration based RTS Threshold Figure 9-589cr */
+#define HE_RTS_THRES_DISABLED          1023
+#define HE_RTS_THRES_ALL_FRAMES                0
+#define HE_RTS_THRES_MASK              0x03ff
+
+/* Tx Rx HE MCS Support field format : Table 9-589cm */
+#define HE_TX_RX_MCS_NSS_SUP_FIELD_MIN_SIZE    4u
+
+/**
+* Bandwidth configuration indices used in the HE TX-RX MCS support field
+* Section 9.4.2.218.4
+*/
+#define HE_BW20_CFG_IDX                0
+#define HE_BW40_CFG_IDX                1
+#define HE_BW80_CFG_IDX                2
+#define HE_BW80P80_CFG_IDX     3
+#define HE_BW160_CFG_IDX       4
+#define HE_MAX_BW_CFG          5
+
+#define HE_MCS_CODE_0_7                0u
+#define HE_MCS_CODE_0_9                1u
+#define HE_MCS_CODE_0_11       2u
+#define HE_MCS_CODE_NONE       3u
+#define HE_MCS_CODE_SIZE       2u      /* num bits */
+#define HE_MCS_CODE_MASK       0x3u    /* mask for 1-stream */
+
+/* Defines for The Max HE MCS For n SS subfield (where n = 1, ..., 8) */
+#define HE_MCS_MAP_NSS_MAX     8u      /* Max number of streams possible */
+#define HE_MCS_NSS_SET_MASK    0xffffu /* Field is to be 16 bits long */
+#define HE_MCS_NSS_GET_SS_IDX(nss) (((nss)-1u) * HE_MCS_CODE_SIZE)
+#define HE_MCS_NSS_GET_MCS(nss, mcs_nss_map) \
+       (((mcs_nss_map) >> HE_MCS_NSS_GET_SS_IDX(nss)) & HE_MCS_CODE_MASK)
+#define HE_MCS_NSS_SET_MCS(nss, mcs_code, mcs_nss_map) \
+       do { \
+       (mcs_nss_map) &= (~(HE_MCS_CODE_MASK << HE_MCS_NSS_GET_SS_IDX(nss))); \
+       (mcs_nss_map) |= (((mcs_code) & HE_MCS_CODE_MASK) << HE_MCS_NSS_GET_SS_IDX(nss)); \
+       (mcs_nss_map) &= (HE_MCS_NSS_SET_MASK); \
+       } while (0)
+
+#define HE_BW80_ORDR_IDX       0u
+#define HE_BW160_ORDR_IDX      1u
+#define HE_BW80P80_ORDR_IDX    2u
+
+#define HE_MCS_NSS_SUP_FLD_UNIT_MAP_LEN        2u      /* 2 bytes */
+#define HE_MCS_NSS_SUP_FLD_UNIT_MAP_SZ (HE_MCS_NSS_SUP_FLD_UNIT_MAP_LEN * 8u) /* 16 bits */
+
+/* Two unit-maps (TX+RX) */
+#define HE_MCS_NSS_SUP_FLD_TXRX_MAP_LEN        (HE_MCS_NSS_SUP_FLD_UNIT_MAP_LEN * 2u)
+#define HE_MCS_NSS_SUP_FLD_TXRX_MAP_SZ (HE_MCS_NSS_SUP_FLD_TXRX_MAP_LEN * 8u) /* 32 bits */
+
+/* One TX-RX unit-map (80 MHz) */
+#define HE_MCS_NSS_SUP_FLD_MIN_LEN     (HE_MCS_NSS_SUP_FLD_TXRX_MAP_LEN)
+/* Three TX-RX unit-maps (80 MHz, 160MHz, 80+80MHz) */
+#define HE_MCS_NSS_SUP_FLD_MAX_LEN     (HE_MCS_NSS_SUP_FLD_TXRX_MAP_LEN * 3u)
+
+/* HE Capabilities element */
+BWL_PRE_PACKED_STRUCT struct he_cap_ie {
+       uint8 id;
+       uint8 len;
+       uint8 id_ext;
+       he_mac_cap_t mac_cap;           /* MAC Capabilities Information */
+       he_phy_cap_t phy_cap;           /* PHY Capabilities Information */
+       /* he_tx_rx_mcs_nss_sup_t txx_rx_mcs_nss_sup; */ /* Tx Rx HE MCS NSS Support (variable) */
+       /* he_ppe_ths_t ppe_ths; */     /* PPE Thresholds (optional) */
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct he_cap_ie he_cap_ie_t;
+
+/* Multiple BSSID element */
+BWL_PRE_PACKED_STRUCT struct nontrans_BSSID_cap {
+       uint8 id; /* 83 */
+       uint8 len;
+       uint16 capability;
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct nontrans_BSSID_cap nontrans_BSSID_cap_t;
+
+BWL_PRE_PACKED_STRUCT struct multi_BSSID_index {
+       uint8 id; /* 85 */
+       uint8 len; /* 3 in beacon, 1 in probe response */
+       uint8 bssid_index; /* between 1 and 2^n - 1 */
+       uint8 dtim_period; /* only valid in beacon */
+       uint8 dtim_count; /* only valid in beacon */
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct multi_BSSID_index multi_BSSID_index_t;
+
+BWL_PRE_PACKED_STRUCT struct fms_descriptor {
+       uint8 id; /* 86 */
+       uint8 len;
+       uint8 num_FMS_counters;
+       uint8 *FMS_counters;
+       uint8 *FMSID;
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct fms_descriptor fms_descriptor_t;
+
+BWL_PRE_PACKED_STRUCT struct nontrans_BSSID_profile_subie {
+       uint8 subie_id; /* 0 */
+       uint8 subie_len;
+       uint8 moreie[1];
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct nontrans_BSSID_profile_subie nontrans_BSSID_profile_subie_t;
+
+BWL_PRE_PACKED_STRUCT struct multi_BSSID_ie {
+       uint8 id;
+       uint8 len;
+       uint8 maxBSSID_indicator;
+       nontrans_BSSID_profile_subie_t profile[1];
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct multi_BSSID_ie multi_BSSID_ie_t;
+#define DOT11_MULTIPLE_BSSID_PROFILE_SUBID 0
+
+/* Table 9-262ab, Highest MCS Supported subfield encoding */
+#define HE_CAP_MCS_CODE_0_7            0
+#define HE_CAP_MCS_CODE_0_8            1
+#define HE_CAP_MCS_CODE_0_9            2
+#define HE_CAP_MCS_CODE_0_10           3
+#define HE_CAP_MCS_CODE_0_11           4
+#define HE_CAP_MCS_CODE_SIZE           3       /* num bits for 1-stream */
+#define HE_CAP_MCS_CODE_MASK           0x7     /* mask for 1-stream */
+
+#define HE_CAP_MCS_MAP_NSS_MAX 8u      /* Max number of streams possible */
+
+#define HE_MAX_RU_COUNT                4u      /* Max number of RU allocation possible */
+
+#define HE_NSSM1_IDX           0       /* Offset of NSSM1 field */
+#define HE_NSSM1_LEN           3       /* length of NSSM1 field in bits */
+
+#define HE_RU_INDEX_MASK_IDX   3       /* Offset of RU index mask field */
+#define HE_RU_INDEX_MASK_LEN   4u      /* length of RU Index mask field in bits */
+
+/* PPE Threshold field (figure 9-589co) */
+#define HE_PPE_THRESH_NSS_RU_FSZ       3u
+
+/* PPE Threshold Info field (figure 9-589cp) */
+/* ruc: RU Count; NSSnM1: NSSn - 1; RUmM1: RUm - 1 */
+/* bit offset in PPE Threshold field */
+#define HE_PPET16_BIT_OFFSET(ruc, NSSnM1, RUmM1) \
+       (HE_NSSM1_LEN + HE_RU_INDEX_MASK_LEN + ((NSSnM1) * (ruc) + (RUmM1)) * 6)
+
+#define HE_PPET8_BIT_OFFSET(ruc, NSSnM1, RUmM1) \
+       (HE_NSSM1_LEN + HE_RU_INDEX_MASK_LEN + ((NSSnM1) * (ruc) + (RUmM1)) * 6 + 3)
+
+/* Total PPE Threshold field byte length (Figure 9-589cq) */
+#define HE_PPE_THRESH_LEN(nss, ruc) \
+       (CEIL((HE_NSSM1_LEN + HE_RU_INDEX_MASK_LEN + ((nss) * (ruc) * 6)), 8))
+
+/* RU Allocation Index encoding (table 9-262ae) */
+#define HE_RU_ALLOC_IDX_242            0       /* RU alloc: 282 tones */
+#define HE_RU_ALLOC_IDX_484            1       /* RU alloc: 484 tones - 40Mhz */
+#define HE_RU_ALLOC_IDX_996            2       /* RU alloc: 996 tones - 80Mhz */
+#define HE_RU_ALLOC_IDX_2x996          3       /* RU alloc: 2x996 tones - 80p80/160Mhz */
+
+/* Constellation Index encoding (table 9-262ac) */
+#define HE_CONST_IDX_BPSK              0
+#define HE_CONST_IDX_QPSK              1
+#define HE_CONST_IDX_16QAM             2
+#define HE_CONST_IDX_64QAM             3
+#define HE_CONST_IDX_256QAM            4
+#define HE_CONST_IDX_1024QAM           5
+#define HE_CONST_IDX_RSVD              6
+#define HE_CONST_IDX_NONE              7
+
+/* Min HE cap ie length when only 80Mhz is supported */
+#define HE_CAP_IE_MIN_LEN      (sizeof(he_cap_ie_t) - TLV_HDR_LEN + HE_MCS_NSS_SUP_FLD_MIN_LEN)
+
+/* Max HE cap ie length considering MAX NSS and RU */
+#define HE_CAP_IE_MAX_LEN      (sizeof(he_cap_ie_t) - TLV_HDR_LEN + HE_MCS_NSS_SUP_FLD_MAX_LEN + \
+                               HE_PPE_THRESH_LEN(HE_CAP_MCS_MAP_NSS_MAX, HE_MAX_RU_COUNT))
+/**
+ * HE Operation IE (Section 9.4.2.238)
+ */
+/* HE Operation Parameters field (figure 9-589cr) */
+#define HE_OP_PARAMS_SIZE              3u
+typedef uint8 he_op_parms_t[HE_OP_PARAMS_SIZE];
+
+/* bit position and field width */
+#define HE_OP_DEF_PE_DUR_IDX           0u      /* Default PE Duration */
+#define HE_OP_DEF_PE_DUR_FSZ           3u
+#define HE_OP_TWT_REQD_IDX             3u      /* TWT Required */
+#define HE_OP_TWT_REQD_FSZ             1u
+#define HE_OP_TXOP_DUR_RTS_THRESH_IDX  4u      /* TXOP Duration Based RTS Threshold */
+#define HE_OP_TXOP_DUR_RTS_THRESH_FSZ  10u
+#define HE_OP_VHT_OP_PRESENT_IDX       14u     /* VHT Oper Info Present */
+#define HE_OP_VHT_OP_PRESENT_FSZ       1u
+#define HE_OP_COL_LOC_BSS_IDX          15u
+#define HE_OP_COL_LOC_BSS_FSZ          1u
+#define HE_OP_ER_SU_DISABLE_IDX                16u
+#define HE_OP_ER_SU_DISABLE_FSZ                1u
+#define HE_OP_6G_OP_INFO_PRESENT_IDX  17u
+#define HE_OP_6G_OP_INFO_PRESENT_FSZ  1u
+
+/* BSS Color Information field (figure 9-589cs) */
+#define HE_OP_BSS_COLOR_IDX            0       /* BSS Color */
+#define HE_OP_BSS_COLOR_FSZ            6
+#define HE_OP_PART_BSS_COLOR_IDX       6       /* Partial BSS Color */
+#define HE_OP_PART_BSS_COLOR_FSZ       1
+#define HE_OP_DISABLE_BSSCOLOR_IDX     7       /* BSS Color Disable */
+#define HE_OP_DISABLE_BSSCOLOR_FSZ     1
+
+/* b4-b13: TXOP Duration RTS threshold */
+#define HE_OP_TXOP_RTS_THRESH_DISABLED 1023u
+
+#define HE_BASIC_MCS_NSS_SIZE          2u
+typedef uint8 he_basic_mcs_nss_set_t[HE_BASIC_MCS_NSS_SIZE];
+
+#define HE_OP_MAX_BSSID_IND_LEN                1u
+#define HE_OP_6G_OPER_INFO_LEN         5u
+/* HE Operation element */
+BWL_PRE_PACKED_STRUCT struct he_op_ie {
+       uint8 id;
+       uint8 len;
+       uint8 id_ext;
+       he_op_parms_t parms;
+       uint8 bsscolor_info;
+       he_basic_mcs_nss_set_t mcs_nss_op;      /* Basic HE MCS & NSS Set */
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct he_op_ie he_op_ie_t;
+
+#define HE_OP_IE_MIN_LEN       (sizeof(he_op_ie_t) - TLV_HDR_LEN)
+#define HE_OP_IE_MAX_LEN (sizeof(he_op_ie_t) - TLV_HDR_LEN + VHT_OP_INFO_LEN +\
+       HE_OP_MAX_BSSID_IND_LEN + HE_OP_6G_OPER_INFO_LEN)
+
+#define HE_6G_OP_BW_20              0u
+#define HE_6G_OP_BW_40              1u
+#define HE_6G_OP_BW_80              2u
+#define HE_6G_OP_BW_160_80P80       3u
+
+/* Figure 9-787l Control field format in Draft P802.11ax_D5.0 */
+#define HE_6G_CTL_CHBW_MASK         0x03u
+#define HE_6G_OP_CTL_CHBW(ctl) (ctl & HE_6G_CTL_CHBW_MASK)
+#define HE_6G_CTL_DUP_BCN_MASK      0x04u
+
+/* HE 6G Operation info */
+BWL_PRE_PACKED_STRUCT struct he_6g_op_info {
+       uint8 pri_chan;
+       uint8 control;
+       uint8 seg0;
+       uint8 seg1;
+       uint8 min_rate;
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct he_6g_op_info he_6g_op_info_t;
+
+/* HE Extended Capabilities element */
+BWL_PRE_PACKED_STRUCT struct he_6g_cap_ie {
+       uint8 id;
+       uint8 len;
+       uint8 id_ext;
+       uint16 cap_info;    /* Capabilities Information */
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct he_6g_cap_ie he_6g_cap_ie_t;
+#define HE_6G_CAP_IE_LEN  sizeof(he_6g_cap_ie_t)
+
+/* HE Capabilities Information bit position and fieldwidth.
+ * Figure 9-787ai Capabilities Information field format in
+ * Draft P802.11ax_D5.0.
+ */
+#define HE_6G_CAP_MIN_MPDU_START_MASK          0x0007u
+#define HE_6G_CAP_MAX_AMPDU_LEN_EXP_MASK       0x0038u
+#define HE_6G_CAP_MAX_AMPDU_LEN_EXP_SHIFT           3u
+#define HE_6G_CAP_MAX_MPDU_LEN_MASK            0x00C0u
+#define HE_6G_CAP_MAX_MPDU_LEN_SHIFT                6u
+#define HE_6G_CAP_SM_PW_SAVE_MASK              0x0600u
+#define HE_6G_CAP_SM_PW_SAVE_SHIFT                  9u
+#define HE_6G_CAP_RD_RESPONDER_MASK            0x0800u
+#define HE_6G_CAP_RD_RESPONDER_SHIFT               11u
+#define HE_6G_CAP_RX_ANT_PATN_CONST_MASK       0x1000u
+#define HE_6G_CAP_RX_ANT_PATN_CONST_SHIFT          12u
+#define HE_6G_CAP_TX_ANT_PATN_CONST_MASK       0x2000u
+#define HE_6G_CAP_TX_ANT_PATN_CONST_SHIFT          13u
+
+#define HE_6G_CAP_MIN_MPDU_START(cap)    ((cap) & HE_6G_CAP_MIN_MPDU_START_MASK)
+#define HE_6G_CAP_MAX_AMPDU_LEN_EXP(cap) (((cap) & HE_6G_CAP_MAX_AMPDU_LEN_EXP_MASK) >> \
+       HE_6G_CAP_MAX_AMPDU_LEN_EXP_SHIFT)
+#define HE_6G_CAP_MAX_MPDU_LEN(cap)      (((cap) & HE_6G_CAP_MAX_MPDU_LEN_MASK) >> \
+       HE_6G_CAP_MAX_MPDU_LEN_SHIFT)
+#define HE_6G_CAP_SM_PW_SAVE(cap)        (((cap) & HE_6G_CAP_SM_PW_SAVE_MASK) >> \
+       HE_6G_CAP_SM_PW_SAVE_SHIFT)
+#define HE_6G_CAP_RD_RESPONDER(cap)      (((cap) & HE_6G_CAP_RD_RESPONDER_MASK) != 0)
+#define HE_6G_CAP_RX_ANT_PATN_CONST(cap) (((cap) & HE_6G_CAP_RX_ANT_PATN_CONST_MASK) != 0)
+#define HE_6G_CAP_TX_ANT_PATN_CONST(cap) (((cap) & HE_6G_CAP_TX_ANT_PATN_CONST_MASK) != 0)
+
+/**
+ * UORA parameter set element (sec 9.4.2.244)
+ */
+BWL_PRE_PACKED_STRUCT struct he_uora_ie {
+       uint8 id;
+       uint8 len;
+       uint8 id_ext;
+       uint8 ocw_range;
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct he_uora_ie he_uora_ie_t;
+
+/* Bit field Masks */
+#define HE_UORA_EOCW_MIN_IDX           0u
+#define HE_UORA_EOCW_MIN_FSZ           3u
+#define HE_UORA_EOCW_MAX_IDX           3u
+#define HE_UORA_EOCW_MAX_FSZ           3u
+/* Reserved -bit6 -7 */
+
+/**
+ * MU EDCA parameter set element (sec 9.4.2.245)
+ */
+BWL_PRE_PACKED_STRUCT struct he_mu_ac_param_record {
+       uint8 aci_aifsn;
+       uint8 ecw_min_max;
+       uint8 muedca_timer;
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct he_mu_ac_param_record he_mu_ac_param_record_t;
+
+BWL_PRE_PACKED_STRUCT struct he_muedca_ie {
+       uint8 id;
+       uint8 len;
+       uint8 id_ext;
+       uint8 mu_qos_info;
+       he_mu_ac_param_record_t param_ac[AC_COUNT];
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct he_muedca_ie he_muedca_ie_t;
+
+#define HE_MU_EDCA_PARAM_UPD_CNT_IDX   0u      /* EDCA Parameter Set Update Count */
+#define HE_MU_EDCA_PARAM_UPD_CNT_LEN   4u
+
+#define HE_MU_SIGA_SIGB_MCS_DPCU       0
+#define HE_MU_SIGA_SIGB_SYMS_DPCU      3u
+#define HE_MU_SIGA_GI_LTF_DPCU         3u
+
+/**
+ * Spatial Reuse Parameter Set element (sec 9.4.2.241)
+ */
+/* bit position and field width */
+#define HE_SRP_CTRL_SRP_DISALLOW_IDX                   0       /* SRP Disallowed */
+#define HE_SRP_CTRL_SRP_DISALLOW_FSZ                   1
+#define HE_SRP_CTRL_NON_SRG_OBSS_PD_SR_DISALLOW_IDX    1       /* NonSRG OBSS PD SR Disallowed */
+#define HE_SRP_CTRL_NON_SRG_OBSS_PD_SR_DISALLOW_FSZ    1
+#define HE_SRP_CTRL_NON_SRG_OFFSET_PRESENT_IDX         2       /* NonSRG Offset Present */
+#define HE_SRP_CTRL_NON_SRG_OFFSET_PRESENT_FSZ         1
+#define HE_SRP_CTRL_SRG_INFO_PRESENT_IDX               3       /* SRG Information Present */
+#define HE_SRP_CTRL_SRG_INFO_PRESENT_FSZ               1
+#define HE_SRP_CTRL_HESIGA_SR_VALUE15_ALLOWED_IDX      4       /* HESIGA_SRP_value15_allowed */
+#define HE_SRP_CTRL_HESIGA_SR_VALUE15_ALLOWED_FSZ      1
+/* Reserved b5-b7 */
+
+/* Spatial reuse element element */
+BWL_PRE_PACKED_STRUCT struct he_srp_ie {
+       uint8 id;
+       uint8 len;
+       uint8 id_ext;
+       uint8 sr_control;
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct he_srp_ie he_srp_ie_t;
+
+#define HE_SRP_NON_SRG_OBSS_PD_MAX_OFFSET_LEN  1u
+#define HE_SRP_SRG_OBSS_PD_MIN_OFFSET_LEN      1u
+#define HE_SRP_SRG_OBSS_PD_MAX_OFFSET_LEN      1u
+#define HE_SRP_SRG_BSSCOLOR_BITMAP_LEN         8u
+#define HE_SRP_SRG_PARTIAL_BSSID_BITMAP_LEN    8u
+
+#define HE_SRP_IE_MIN_LEN      (sizeof(he_srp_ie_t) - TLV_HDR_LEN)
+#define HE_SRP_IE_MAX_LEN (sizeof(he_srp_ie_t) - TLV_HDR_LEN +\
+       HE_SRP_NON_SRG_OBSS_PD_MAX_OFFSET_LEN + HE_SRP_SRG_OBSS_PD_MIN_OFFSET_LEN\
+       HE_SRP_SRG_OBSS_PD_MAX_OFFSET_LEN + HE_SRP_SRG_BSSCOLOR_BITMAP_LEN\
+       HE_SRP_SRG_PARTIAL_BSSID_BITMAP_LEN)
+
+/* Bit field Masks */
+#define HE_SRP_CTRL_SRP_DISALLOW               (1 << HE_SRP_CTRL_SRP_DISALLOW_IDX)
+#define HE_SRP_CTRL_NON_SRG_OBSS_PD_SR_DISALLOW (1 << HE_SRP_CTRL_NON_SRG_OBSS_PD_SR_DISALLOW_IDX)
+#define HE_SRP_CTRL_NON_SRG_OFFSET_PRESENT     (1 << HE_SRP_CTRL_NON_SRG_OFFSET_PRESENT_IDX)
+#define HE_SRP_CTRL_SRG_INFO_PRESENT           (1 << HE_SRP_CTRL_SRG_INFO_PRESENT_IDX)
+#define HE_SRP_CTRL_HESIGA_SR_VALUE15_ALLOWED  (1 << HE_SRP_CTRL_HESIGA_SR_VALUE15_ALLOWED_IDX)
+
+/**
+ * ref: (Table 28-21 Page 473 D3.0)
+ *
+ * -Spatial Reuse field encoding for an HE SU PPDU, HE ER SU PPDU, and HE MU PPDU
+ */
+#define HE_SRP_DISALLOW        0u      /* SRP_DISALLOW */
+/* Values 1 to 12 are reserved */
+#define HE_SR_RESTRICTED       13u     /* SR Restricted */
+#define HE_SR_DELAY            14u     /* SR Delay */
+#define HE_SRP_AND_NON_SRG_OBSS_PD_PROHIBITED  15u     /* SRP_AND_NON_SRG_OBSS_PD_PROHIBITED */
+#define HE_SRP_MASK            0x0Fu
+
+/**
+ * BSS Color Change Announcement element (sec 9.4.2.243)
+ */
+/* bit position and field width */
+#define HE_BSSCOLOR_CHANGE_NEWCOLOR_IDX                0       /* New BSSColor info */
+#define HE_BSSCOLOR_CHANGE_NEWCOLOR_FSZ                6u
+
+/* HE Bsscolor change element */
+BWL_PRE_PACKED_STRUCT struct he_bsscolor_change_ie {
+       uint8 id;
+       uint8 len;
+       uint8 id_ext;
+       uint8 color_switch_cntdwn;
+       uint8 new_bsscolor_info;
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct he_bsscolor_change_ie he_bsscolor_change_ie_t;
+
+/* HE SU bit position and field width */
+#define HE_SU_PPDU_FORMAT_IDX                  0u
+#define HE_SU_PPDU_FORMAT_FSZ                  1u
+#define HE_SU_PPDU_BEAM_CHANGE_IDX             1u
+#define HE_SU_PPDU_BEAM_CHANGE_FSZ             1u
+#define HE_SU_PPDU_DL_UL_IDX                   2u
+#define HE_SU_PPDU_DL_UL_FSZ                   1u
+#define HE_SU_PPDU_MCS_IDX                     3u
+#define HE_SU_PPDU_MCS_FSZ                     4u
+#define HE_SU_PPDU_DCM_IDX                     7u
+#define HE_SU_PPDU_DCM_FSZ                     1u
+#define HE_SU_PPDU_BSS_COLOR_IDX               8u
+#define HE_SU_PPDU_BSS_COLOR_FSZ               6u
+#define HE_SU_PPDU_SR_IDX                      15
+#define HE_SU_PPDU_SR_FSZ                      4u
+#define HE_SU_PPDU_BW_IDX                      19u
+#define HE_SU_PPDU_BW_FSZ                      2u
+#define HE_SU_PPDU_GI_IDX                      21u
+#define HE_SU_PPDU_GI_FSZ                      2u
+#define HE_SU_PPDU_LTF_SIZE_IDX                        21u
+#define HE_SU_PPDU_LTF_SIZE_FSZ                        2u
+#define HE_SU_PPDU_NUM_LTF_IDX                 21u
+#define HE_SU_PPDU_NUM_LTF_FSZ                 2u
+#define HE_SU_PPDU_NSTS_IDX                    23u
+#define HE_SU_PPDU_NSTS_FSZ                    3u
+#define HE_SU_PPDU_DOPPLER_NOTSET_NSTS_IDX      23u
+#define HE_SU_PPDU_DOPPLER_NOTSET_NSTS_FSZ      3u
+#define HE_SU_PPDU_DOPPLER_SET_NSTS_IDX         23u
+#define HE_SU_PPDU_DOPPLER_SET_NSTS_FSZ         2u
+#define HE_SU_PPDU_MIDAMBLE_IDX                 25u
+#define HE_SU_PPDU_MIDAMBLE_FSZ                 1u
+#define HE_SU_PPDU_TXOP_IDX                    26u
+#define HE_SU_PPDU_TXOP_FSZ                    7u
+#define HE_SU_PPDU_CODING_IDX                  33u
+#define HE_SU_PPDU_CODING_FSZ                  1u
+#define HE_SU_PPDU_LDPC_IDX                    34u
+#define HE_SU_PPDU_LDPC_FSZ                    1u
+#define HE_SU_PPDU_STBC_IDX                    35u
+#define HE_SU_PPDU_STBC_FSZ                    1u
+#define HE_SU_PPDU_TXBF_IDX                    36u
+#define HE_SU_PPDU_TXBF_FSZ                    1u
+#define HE_SU_PPDU_PADDING_IDX                 37u
+#define HE_SU_PPDU_PADDING_FSZ                 2u
+#define HE_SU_PPDU_PE_IDX                      39u
+#define HE_SU_PPDU_PE_FSZ                      1u
+#define HE_SU_PPDU_DOPPLER_IDX                 41u
+#define HE_SU_PPDU_DOPPLER_FSZ                 1u
+
+/* For HE SU/RE SIG A : PLCP0 bit fields [32bit] */
+#define HE_SU_RE_SIGA_FORMAT_MASK              0x00000001u
+#define HE_SU_RE_SIGA_RE_VAL                   0x00000000u
+#define HE_SU_RE_SIGA_SU_VAL                   0x00000001u
+#define HE_SU_RE_SIGA_FORMAT_SHIFT             0u
+#define HE_SU_RE_SIGA_BEAM_CHANGE_SHIFT        1u
+#define HE_SU_RE_SIGA_UL_DL_SHIFT              2u
+#define HE_SU_RE_SIGA_MCS_MASK                 0x00000078u
+#define HE_SU_RE_SIGA_MCS_SHIFT                        3u
+#define HE_SU_RE_SIGA_DCM_MASK                 0x00000080u
+#define HE_SU_RE_SIGA_DCM_SHIFT                        7u
+#define HE_SU_RE_SIGA_BSS_COLOR_SHIFT          8u      /* Bits 13:8 */
+#define HE_SU_RE_SIGA_BSS_COLOR_MASK           0x00003F00u
+#define HE_SU_RE_SIGA_RSVD_PLCP0_VAL           0x00004000u
+#define HE_SU_RE_SIGA_SRP_VAL_SHIFT            15u     /* Bits 18:15 */
+#define HE_SU_RE_SIGA_SRP_VAL_MASK             0x00078000u
+#define HE_SU_SIGA_BW_MASK                     0x00180000u
+#define HE_SU_SIGA_BW_SHIFT                    19u
+#define HE_RE_SIGA_TONE_MASK                   0x00180000u
+#define HE_RE_SIGA_TONE_SHIFT                  19u
+#define HE_SU_RE_SIGA_20MHZ_VAL                        0x00000000u
+#define HE_SU_RE_SIGA_40MHZ_VAL                        0x00080000u
+#define HE_SU_RE_SIGA_80MHZ_VAL                        0x00100000u
+#define HE_SU_RE_SIGA_160MHZ_VAL               0x00180000u
+#define HE_SU_RE_SIGA_GI_LTF_MASK              0x00600000u
+#define HE_SU_RE_SIGA_1xLTF_GI8us_VAL          0x00000000u
+#define HE_SU_RE_SIGA_2xLTF_GI8us_VAL          0x00200000u
+#define HE_SU_RE_SIGA_2xLTF_GI16us_VAL         0x00400000u
+#define HE_SU_RE_SIGA_4xLTF_GI32us_VAL         0x00600000u
+#define HE_SU_RE_SIGA_GI_LTF_SHIFT             21u
+#define HE_SU_RE_SIGA_NSTS_MASK                        0x03800000u
+#define HE_SU_RE_SIGA_NSTS_SHIFT               23u
+#define HE_SU_RE_SIGA_TXOP_PLCP0_MASK          0xFC000000u
+#define HE_SU_RE_SIGA_TXOP_PLCP0_SHIFT         26u
+
+/* For HE SU SIG EXT : PLCP0 bit fields [32bit] */
+#define HE_SU_SIG_EXT_GI_LTF_MASK         0x00000003u
+#define HE_SU_SIG_EXT_1xLTF_GI8us_VAL     0x00000000u
+#define HE_SU_SIG_EXT_2xLTF_GI8us_VAL     0x00000001u
+#define HE_SU_SIG_EXT_2xLTF_GI16us_VAL    0x00000002u
+#define HE_SU_SIG_EXT_4xLTF_GI32us_VAL    0x00000003u
+#define HE_SU_SIG_EXT_STBC_MASK           0x00000040u
+#define HE_SU_SIG_EXT_STBC_SHIFT          6u
+#define HE_SU_SIG_EXT_LDPC_MASK           0x00000080u
+#define HE_SU_SIG_EXT_LDPC_SHIFT          7u
+#define HE_SU_SIG_EXT_MCS_MASK            0x0000f000u
+#define HE_SU_SIG_EXT_MCS_SHIFT           12u
+#define HE_SU_SIG_EXT_DCM_MASK            0x00010000u
+#define HE_SU_SIG_EXT_DCM_SHIFT           16u
+#define HE_SU_SIG_EXT_NSTS_MASK           0x000e0000u
+#define HE_SU_SIG_EXT_NSTS_SHIFT          17u
+#define HE_SU_SIG_EXT_CODING_MASK         0x00800000u
+#define HE_SU_SIG_EXT_CODING_SHIFT        23u
+
+/* HE mu ppdu - bit position and field width */
+#define HE_MU_PPDU_DL_UL_IDX                    0u
+#define HE_MU_PPDU_DL_UL_FSZ                    1u
+#define HE_MU_PPDU_SIGB_MCS_IDX                 1u
+#define HE_MU_PPDU_SIGB_MCS_FSZ                 3u
+#define HE_MU_PPDU_SIGB_DCM_IDX                 4u
+#define HE_MU_PPDU_SIGB_DCM_FSZ                 1u
+#define HE_MU_PPDU_BSS_COLOR_IDX                5u
+#define HE_MU_PPDU_BSS_COLOR_FSZ                6u
+#define HE_MU_PPDU_SR_IDX                       11u
+#define HE_MU_PPDU_SR_FSZ                       4u
+
+#define HE_MU_PPDU_SIGB_SYM_MU_MIMO_USER_IDX    18u
+#define HE_MU_PPDU_SIGB_SYM_MU_MIMO_USER_FSZ    3u
+
+#define HE_MU_PPDU_PRE_PUNCR_SIGA_IDX           15u
+#define HE_MU_PPDU_PRE_PUNCR_SIGA_FSZ           2u
+
+#define HE_MU_PPDU_BW_SIGA_IDX                  15u
+#define HE_MU_PPDU_BW_SIGA_FSZ                  2u
+#define HE_MU_PPDU_BW_SIGA_KNOWN_IDX            17u
+#define HE_MU_PPDU_BW_SIGA_KNOWN_FSZ            1u
+
+#define HE_MU_PPDU_SIGB_SYMB_IDX                18u
+#define HE_MU_PPDU_SIGB_SYMB_FSZ                4u
+
+#define HE_MU_PPDU_SIGB_COMP_IDX                22u
+#define HE_MU_PPDU_SIGB_COMP_FSZ                1u
+#define HE_MU_PPDU_GI_IDX                       23u
+#define HE_MU_PPDU_GI_FSZ                       2u
+#define HE_MU_PPDU_LTF_SIZE_IDX                 23u
+#define HE_MU_PPDU_LTF_SIZE_FSZ                 2u
+#define HE_MU_PPDU_NUM_LTF_IDX                 23u
+#define HE_MU_PPDU_NUM_LTF_FSZ                 2u
+#define HE_MU_PPDU_DOPPLER_IDX                  25u
+#define HE_MU_PPDU_DOPPLER_FSZ                  1u
+#define HE_MU_PPDU_TXOP_IDX                     26u
+#define HE_MU_PPDU_TXOP_FSZ                     7u
+#define HE_MU_PPDU_MIDAMBLE_IDX                 34u
+#define HE_MU_PPDU_MIDAMBLE_FSZ                 3u
+#define HE_MU_PPDU_LDPC_IDX                     37u
+#define HE_MU_PPDU_LDPC_FSZ                     1u
+#define HE_MU_PPDU_STBC_IDX                     38u
+#define HE_MU_PPDU_STBC_FSZ                     1u
+#define HE_MU_PPDU_PADDING_IDX                  39u
+#define HE_MU_PPDU_PADDING_FSZ                  2u
+#define HE_MU_PPDU_PE_IDX                       41u
+#define HE_MU_PPDU_PE_FSZ                       1u
+
+/* he trigger ppdu - bit position and field width */
+#define HE_TRIG_PPDU_BSS_COLOR_IDX                1u
+#define HE_TRIG_PPDU_BSS_COLOR_FSZ                6u
+
+/* full spatial reuse field */
+#define HE_TRIG_PPDU_SR_IDX                       7u
+#define HE_TRIG_PPDU_SR_FSZ                       16u
+
+#define HE_TRIG_PPDU_SR1_IDX                      7u
+#define HE_TRIG_PPDU_SR1_FSZ                      4u
+#define HE_TRIG_PPDU_SR2_IDX                      11u
+#define HE_TRIG_PPDU_SR2_FSZ                      4u
+#define HE_TRIG_PPDU_SR3_IDX                      15u
+#define HE_TRIG_PPDU_SR3_FSZ                      4u
+#define HE_TRIG_PPDU_SR4_IDX                      19u
+#define HE_TRIG_PPDU_SR4_FSZ                      4u
+#define HE_TRIG_PPDU_TXOP_IDX                     26u
+#define HE_TRIG_PPDU_TXOP_FSZ                     7u
+
+/* For HE MU SIG A : PLCP0 bit fields [32bit] */
+#define HE_MU_SIGA_UL_DL_SHIFT                 0
+#define HE_MU_SIGA_UL_TB_PPDU                  0
+#define HE_MU_SIGA_SIGB_MCS_MASK               0x000000E
+#define HE_MU_SIGA_SIGB_MCS_SHIFT              1
+#define HE_MU_SIGA_SIGB_DCM_SHIFT              4
+#define HE_MU_SIGA_SIGB_DCM_DISABLED           0
+#define HE_MU_SIGA_BW_SHIFT                    15
+#define HE_MU_SIGA_BW_80_UNPUNCTURED           2
+#define HE_MU_SIGA_BW_SEC_20_PUNCTURED         4
+#define HE_MU_SIGA_BW_SEC_40_PUNCTURED         5
+#define HE_MU_SIGA_SIGB_SYMS_SHIFT             18
+#define HE_MU_SIGA_GI_LTF_MASK                 0x01800000
+#define HE_MU_SIGA_GI_LTF_SHIFT                        23
+
+/* For HE MU SIG A : PLCP1 bit fields [32bit] */
+#define HE_MU_SIGA_STBC_MASK           0x00000040
+#define HE_MU_SIGA_STBC_SHIFT          6
+
+/* For HE SU/RE SIG A : PLCP1 bit fields [16bit] */
+#define HE_SU_RE_SIGA_TXOP_PLCP1_MASK  0x0001
+#define HE_SU_RE_SIGA_TXOP_PLCP1_SHIFT 0
+#define HE_SU_RE_SIGA_CODING_MASK      0x0002
+#define HE_SU_RE_SIGA_CODING_SHIFT     1
+#define HE_SU_RE_SIGA_LDPC_EXTRA_MASK  0x0004
+#define HE_SU_RE_SIGA_LDPC_EXTRA_SHIFT 2
+#define HE_SU_RE_SIGA_STBC_MASK                0x0008
+#define HE_SU_RE_SIGA_STBC_SHIFT       3
+#define HE_SU_RE_SIGA_BEAMFORM_MASK    0x0010
+#define HE_SU_RE_SIGA_BEAMFORM_SHIFT   4
+#define HE_SU_RE_SIGA_RSVD_PLCP1_VAL   0x0100
+
+/* For HE MU SIG A : PLCP1 bit fields [16bit] */
+#define HE_MU_SIGA_RSVD_SHIFT          1
+#define HE_MU_SIGA_LTF_SYMS_SHIFT      2
+
+/* For HE SU SIG A : RX PLCP4 bit fields [8bit] */
+#define HE_SU_SIGA2_STBC_RX_MASK       0x08u
+
+/* For HE ER SIG A : RX PLCP4 bit fields [8bit] */
+#define HE_ER_SIGA2_STBC_RX_MASK       0x08u
+
+/* For HE MU SIG A : RX PLCP4 bit fields [8bit] */
+#define HE_MU_SIGA2_STBC_RX_MASK       0x40u
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+/* HE Action Frame */
+/* FIXME: use temporary Offsets until the spec assigns them */
+#define HE_AF_CAT_OFF  0
+#define HE_AF_ACT_OFF  1
+
+/* TWT Setup */
+#define HE_AF_TWT_SETUP_TOKEN_OFF      2
+#define HE_AF_TWT_SETUP_TWT_IE_OFF     3
+
+/* TWT Teardown */
+#define HE_AF_TWT_TEARDOWN_FLOW_OFF    2
+
+/* TWT Information */
+#define HE_AF_TWT_INFO_OFF     2
+
+/* HE Action ID */
+/* FIXME: use temporary IDs until ANA assigns them */
+#define HE_ACTION_TWT_SETUP    1
+#define HE_ACTION_TWT_TEARDOWN 2
+#define HE_ACTION_TWT_INFO     3
+
+/* HE Basic trigger frame common info fields */
+#define HE_TRIG_CMNINFO_SZ     8
+typedef uint8 he_trig_cmninfo_set_t[HE_TRIG_CMNINFO_SZ];
+
+/* bit position and field width */
+#define HE_TRIG_CMNINFO_FRMTYPE_INDX           0       /* Trigger frame type */
+#define HE_TRIG_CMNINFO_FRMTYPE_FSZ            4
+#define HE_TRIG_CMNINFO_LSIGLEN_INDX           4       /* L-sig length */
+#define HE_TRIG_CMNINFO_LSIGLEN_FSZ            12
+#define HE_TRIG_CMNINFO_CASCADEIND_INDX                16      /* Cascade indication */
+#define HE_TRIG_CMNINFO_CASCADEIND_FSZ         1
+#define HE_TRIG_CMNINFO_CSREQ_INDX             17      /* Carrier sense indication */
+#define HE_TRIG_CMNINFO_CSREQ_FSZ              1
+#define HE_TRIG_CMNINFO_BWINFO_INDX            18      /* Bw info */
+#define HE_TRIG_CMNINFO_BWINFO_FSZ             2
+#define HE_TRIG_CMNINFO_GI_LTF_INDX            20      /* Cp-LTF size */
+#define HE_TRIG_CMNINFO_GI_LTF_FSZ             2
+#define HE_TRIG_CMNINFO_MUMIMO_LTF_INDX                22      /* HE-LTF mask enable */
+#define HE_TRIG_CMNINFO_MUMIMO_LTF_FSZ         1
+#define HE_TRIG_CMNINFO_HELTF_SYM_INDX         23      /* He-LTF sumbols */
+#define HE_TRIG_CMNINFO_HELTF_SYM_FSZ          3
+#define HE_TRIG_CMNINFO_STBC_INDX              26      /* STBC support */
+#define HE_TRIG_CMNINFO_STBC_FSZ               1
+#define HE_TRIG_CMNINFO_LDPC_EXTSYM_INDX       27      /* LDPC extra symbol */
+#define HE_TRIG_CMNINFO_LDPC_EXTSYM_FSZ                1
+#define HE_TRIG_CMNINFO_AP_TXPWR_INDX          28      /* AP TX power */
+#define HE_TRIG_CMNINFO_AP_TXPWR_FSZ           6
+#define HE_TRIG_CMNINFO_AFACT_INDX             34      /* a-factor */
+#define HE_TRIG_CMNINFO_AFACT_FSZ              2
+#define HE_TRIG_CMNINFO_PEDISAMBIG_INDX                36      /* PE disambiguity */
+#define HE_TRIG_CMNINFO_PEDISAMBIG_FSZ         1
+#define HE_TRIG_CMNINFO_SPTIAL_REUSE_INDX      37      /* spatial re-use */
+#define HE_TRIG_CMNINFO_SPTIAL_REUSE_FSZ       16
+#define HE_TRIG_CMNINFO_DOPPLER_INDX           53      /* doppler supoort */
+#define HE_TRIG_CMNINFO_DOPPLER_FSZ            1
+#define HE_TRIG_CMNINFO_HESIGA_RSVD_INDX       54      /* rsvd bits from HE-SIGA */
+#define HE_TRIG_CMNINFO_HESIGA_RSVD_FSZ                9
+#define HE_TRIG_CMNINFO_RSVD_INDX              63      /* reseved bit from HE-SIGA  */
+#define HE_TRIG_CMNINFO_RSVD_FSZ               1
+
+/* HE Basic trigger frame user info fields */
+#define HE_TRIG_USRINFO_SZ     5
+typedef uint8 he_trig_usrinfo_set_t[HE_TRIG_USRINFO_SZ];
+
+/* bit position and field width */
+#define HE_TRIG_USRINFO_AID_INDX               0       /* AID */
+#define HE_TRIG_USRINFO_AID_FSZ                        12
+#define HE_TRIG_USRINFO_RU_ALLOC_INDX          12      /* RU allocation index */
+#define HE_TRIG_USRINFO_RU_ALLOC_FSZ           8
+#define HE_TRIG_USRINFO_CODING_INDX            20      /* coding type (BCC/LDPC) */
+#define HE_TRIG_USRINFO_CODING_FSZ             1
+#define HE_TRIG_USRINFO_MCS_INDX               21      /* MCS index value */
+#define HE_TRIG_USRINFO_MCS_FSZ                        4
+#define HE_TRIG_USRINFO_DCM_INDX               25      /* Dual carrier modulation */
+#define HE_TRIG_USRINFO_DCM_FSZ                        1
+#define HE_TRIG_USRINFO_SSALLOC_STRMOFFSET_INDX                26      /* stream offset */
+#define HE_TRIG_USRINFO_SSALLOC_STRMOFFSET_FSZ         3
+#define HE_TRIG_USRINFO_SSALLOC_NSS_INDX               29      /* number of spatial streams */
+#define HE_TRIG_USRINFO_SSALLOC_NSS_FSZ                3
+#define HE_TRIG_USRINFO_TARGET_RSSI_INDX       32      /* Target RSSI */
+#define HE_TRIG_USRINFO_TARGET_RSSI_FSZ                7
+#define HE_TRIG_USRINFO_RSVD_INDX              39      /* Reserved bit */
+#define HE_TRIG_USRINFO_RSVD_FSZ               1
+
+/* Different types of trigger frame */
+#define HE_TRIG_TYPE_BASIC_FRM                 0       /* basic trigger frame */
+#define HE_TRIG_TYPE_BEAM_RPT_POLL_FRM         1       /* beamforming report poll frame */
+#define HE_TRIG_TYPE_MU_BAR_FRM                        2       /* MU-BAR frame */
+#define HE_TRIG_TYPE_MU_RTS__FRM               3       /* MU-RTS frame */
+#define HE_TRIG_TYPE_BSR_FRM                   4       /* Buffer status report poll */
+
+/* HE Timing related parameters (Table 28-9) */
+#define HE_T_LEG_STF                   8
+#define HE_T_LEG_LTF                   8
+#define HE_T_LEG_LSIG                  4
+#define HE_T_RL_SIG                    4
+#define HE_T_SIGA                      8
+#define HE_T_STF                       4       /* STF for SU / MU HE PPDUs */
+#define HE_T_TB_PPDU_STF               8       /* STF for HE trigger based PPDUs */
+#define HE_T_LEG_PREAMBLE              (HE_T_LEG_STF + HE_T_LEG_LTF + HE_T_LEG_LSIG)
+#define HE_T_LEG_SYMB                  4
+#define HE_RU_26_TONE                  26
+#define HE_RU_52_TONE                  52
+#define HE_RU_106_TONE                 106
+#define HE_RU_242_TONE                 242
+#define HE_RU_484_TONE                 484
+#define HE_RU_996_TONE                 996
+#define HE_MAX_26_TONE_RU_INDX         36
+#define HE_MAX_52_TONE_RU_INDX         52
+#define HE_MAX_106_TONE_RU_INDX                60
+#define HE_MAX_242_TONE_RU_INDX                64
+#define HE_MAX_484_TONE_RU_INDX                66
+#define HE_MAX_996_TONE_RU_INDX                67
+
+/**
+ * ref: (Table 28-9 Page 285)
+ *
+ * - for calculation purpose - in multiples of 10 (*10)
+ */
+#define HE_T_LTF_1X                    32
+#define HE_T_LTF_2X                    64
+#define HE_T_LTF_4X                    128
+#define HE_T_SYM1                      136     /* OFDM symbol duration with base GI */
+#define HE_T_SYM2                      144     /* OFDM symbol duration with double GI */
+#define HE_T_SYM4                      160     /* OFDM symbol duration with quad GI */
+
+#define HE_N_LEG_SYM                   3       /* bytes per legacy symbol */
+#define HE_N_TAIL                      6       /* tail field bits for BCC */
+#define HE_N_SERVICE                   16      /* bits in service field */
+#define HE_T_MAX_PE                    16      /* max Packet extension duration */
+
+#endif /* _802_11ax_h_ */
diff --git a/bcmdhd.101.10.240.x/include/802.11s.h b/bcmdhd.101.10.240.x/include/802.11s.h
new file mode 100644 (file)
index 0000000..43e763d
--- /dev/null
@@ -0,0 +1,328 @@
+/*
+ * Fundamental types and constants relating to 802.11s Mesh
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _802_11s_h_
+#define _802_11s_h_
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#define DOT11_MESH_FLAGS_AE_MASK       0x3
+#define DOT11_MESH_FLAGS_AE_SHIFT      0
+
+#define DOT11_MESH_CONNECTED_AS_SET         7
+#define DOT11_MESH_NUMBER_PEERING_SET       1
+#define DOT11_MESH_MESH_GWSET               0
+
+#define DOT11_MESH_ACTION_LINK_MET_REP      0
+#define DOT11_MESH_ACTION_PATH_SEL          1
+#define DOT11_MESH_ACTION_GATE_ANN          2
+#define DOT11_MESH_ACTION_CONG_CONT_NOTIF   3
+#define DOT11_MESH_ACTION_MCCA_SETUP_REQ    4
+#define DOT11_MESH_ACTION_MCCA_SETUP_REP    5
+#define DOT11_MESH_ACTION_MCCA_ADVT_REQ     6
+#define DOT11_MESH_ACTION_MCCA_ADVT         7
+#define DOT11_MESH_ACTION_MCCA_TEARDOWN     8
+#define DOT11_MESH_ACTION_TBTT_ADJ_REQ      9
+#define DOT11_MESH_ACTION_TBTT_ADJ_RESP     10
+
+/* self-protected action field values: 7-57v24 */
+#define DOT11_SELFPROT_ACTION_MESH_PEER_OPEN    1
+#define DOT11_SELFPROT_ACTION_MESH_PEER_CONFM   2
+#define DOT11_SELFPROT_ACTION_MESH_PEER_CLOSE   3
+#define DOT11_SELFPROT_ACTION_MESH_PEER_GK_INF  4
+#define DOT11_SELFPROT_ACTION_MESH_PEER_GK_ACK  5
+
+#define DOT11_MESH_AUTH_PROTO_NONE        0
+#define DOT11_MESH_AUTH_PROTO_SAE         1
+#define DOT11_MESH_AUTH_PROTO_8021X       2
+#define DOT11_MESH_AUTH_PROTO_VS        255
+
+#define DOT11_MESH_PATHSEL_LEN   2
+#define DOT11_MESH_PERR_LEN1     2   /* Least PERR length fixed */
+#define DOT11_MESH_PERR_LEN2     13  /* Least PERR length variable */
+#define DOT11_MESH_PREP_LEN      31  /* Least PREP length */
+#define DOT11_MESH_PREQ_LEN      37  /* Least PREQ length */
+
+#define DOT11_MESH_PATHSEL_PROTID_HWMP    1
+#define DOT11_MESH_PATHSEL_METRICID_ALM   1 /* Air link metric */
+#define DOT11_MESH_CONGESTCTRL_NONE       0
+#define DOT11_MESH_CONGESTCTRL_SP         1
+#define DOT11_MESH_SYNCMETHOD_NOFFSET     1
+
+BWL_PRE_PACKED_STRUCT struct dot11_meshctrl_hdr {
+       uint8               flags;      /* flag bits such as ae etc */
+       uint8               ttl;        /* time to live */
+       uint32              seq;        /* sequence control */
+       struct ether_addr   a5;         /* optional address 5 */
+       struct ether_addr   a6;         /* optional address 6 */
+} BWL_POST_PACKED_STRUCT;
+
+/* Mesh Path Selection Action Frame */
+BWL_PRE_PACKED_STRUCT struct dot11_mesh_pathsel {
+       uint8   category;
+       uint8   meshaction;
+       uint8   data[];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_mesh_pathsel dot11_mesh_pathsel_t;
+
+/*  Mesh PREQ IE */
+BWL_PRE_PACKED_STRUCT struct mesh_preq_ie {
+       uint8   id;
+       uint8   len;
+       uint8   flags;
+       uint8   hop_count;
+       uint8   ttl;
+       uint32  pathdis_id;
+       struct  ether_addr  originator_addr;
+       uint32  originator_seq;
+       union {
+               BWL_PRE_PACKED_STRUCT struct {
+                       struct ether_addr target_ext_add;
+                       uint32  lifetime;
+                       uint32  metric;
+                       uint8   target_count;
+                       uint8   data[];
+               } BWL_POST_PACKED_STRUCT oea;
+
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint32  lifetime;
+                       uint32  metric;
+                       uint8   target_count;
+                       uint8   data[];
+               } BWL_POST_PACKED_STRUCT noea;
+       } u;
+} BWL_POST_PACKED_STRUCT;
+typedef struct mesh_preq_ie mesh_preq_ie_t;
+
+/* Target info (part of Mesh PREQ IE) */
+BWL_PRE_PACKED_STRUCT struct mesh_targetinfo {
+       uint8   target_flag;
+       struct  ether_addr      target_addr;
+       uint32  target_seq;
+} BWL_POST_PACKED_STRUCT;
+typedef struct mesh_targetinfo mesh_targetinfo_t;
+
+/* Mesh PREP IE */
+BWL_PRE_PACKED_STRUCT struct mesh_prep_ie {
+       uint8   id;
+       uint8   len;
+       uint8   flags;
+       uint8   hop_count;
+       uint8   ttl;
+       struct  ether_addr      target_addr;
+       uint32  target_seq;
+       union {
+               BWL_PRE_PACKED_STRUCT struct {
+                       struct ether_addr target_ext_add;
+                       uint32  lifetime;
+                       uint32  metric;
+                       uint8   target_count;
+                       struct  ether_addr      originator_addr;
+                       uint32  originator_seq;
+               } BWL_POST_PACKED_STRUCT oea;
+
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint32  lifetime;
+                       uint32  metric;
+                       uint8   target_count;
+                       struct  ether_addr      originator_addr;
+                       uint32  originator_seq;
+               } BWL_POST_PACKED_STRUCT noea;
+       } u;
+} BWL_POST_PACKED_STRUCT;
+typedef struct mesh_prep_ie mesh_prep_ie_t;
+
+/* Mesh PERR IE */
+struct mesh_perr_ie {
+       uint8   id;
+       uint8   len;
+       uint8   ttl;
+       uint8   num_dest;
+       uint8   data[];
+};
+typedef struct mesh_perr_ie mesh_perr_ie_t;
+
+/* Destination info is part of PERR IE */
+BWL_PRE_PACKED_STRUCT struct mesh_perr_destinfo {
+       uint8   flags;
+       struct  ether_addr      destination_addr;
+       uint32  dest_seq;
+       union {
+               BWL_PRE_PACKED_STRUCT struct {
+                       struct  ether_addr      dest_ext_addr;
+               } BWL_POST_PACKED_STRUCT dea;
+
+               BWL_PRE_PACKED_STRUCT struct {
+               /* 1 byte reason code to be populated manually in software */
+                       uint16  reason_code;
+               } BWL_POST_PACKED_STRUCT nodea;
+       } u;
+} BWL_POST_PACKED_STRUCT;
+typedef struct mesh_perr_destinfo mesh_perr_destinfo_t;
+
+/* Mesh peering action frame hdr */
+BWL_PRE_PACKED_STRUCT struct mesh_peering_frmhdr {
+       uint8   category;
+       uint8   action;
+       union   {
+               struct {
+                       uint16  capability;
+               } open;
+               struct {
+                       uint16  capability;
+                       uint16  AID;
+               } confirm;
+               uint8 data[1];
+       } u;
+} BWL_POST_PACKED_STRUCT;
+typedef struct mesh_peering_frmhdr mesh_peering_frmhdr_t;
+
+/* Mesh peering mgmt IE */
+BWL_PRE_PACKED_STRUCT struct mesh_peer_mgmt_ie_common {
+       uint16  mesh_peer_prot_id;
+       uint16  local_link_id;
+} BWL_POST_PACKED_STRUCT;
+typedef struct mesh_peer_mgmt_ie_common mesh_peer_mgmt_ie_common_t;
+#define MESH_PEER_MGMT_IE_OPEN_LEN     (4)
+
+BWL_PRE_PACKED_STRUCT struct mesh_peer_mgmt_ie_cfm {
+       mesh_peer_mgmt_ie_common_t      common;
+       uint16  peer_link_id;
+} BWL_POST_PACKED_STRUCT;
+typedef struct mesh_peer_mgmt_ie_cfm mesh_peer_mgmt_ie_cfm_t;
+#define MESH_PEER_MGMT_IE_CONF_LEN     (6)
+
+BWL_PRE_PACKED_STRUCT struct mesh_peer_mgmt_ie_close {
+       mesh_peer_mgmt_ie_common_t      common;
+       /* uint16       peer_link_id;
+       * simplicity: not supported, TODO for future
+       */
+       uint16  reason_code;
+} BWL_POST_PACKED_STRUCT;
+typedef struct mesh_peer_mgmt_ie_close mesh_peer_mgmt_ie_close_t;
+#define MESH_PEER_MGMT_IE_CLOSE_LEN    (6)
+
+struct mesh_config_ie {
+       uint8   activ_path_sel_prot_id;
+       uint8   activ_path_sel_metric_id;
+       uint8   cong_ctl_mode_id;
+       uint8   sync_method_id;
+       uint8   auth_prot_id;
+       uint8   mesh_formation_info;
+       uint8   mesh_cap;
+};
+typedef struct mesh_config_ie mesh_config_ie_t;
+#define MESH_CONFIG_IE_LEN     (7)
+
+/* Mesh peering states */
+#define MESH_PEERING_IDLE               0
+#define MESH_PEERING_OPEN_SNT           1
+#define MESH_PEERING_CNF_RCVD           2
+#define MESH_PEERING_OPEN_RCVD          3
+#define MESH_PEERING_ESTAB              4
+#define MESH_PEERING_HOLDING            5
+#define MESH_PEERING_LAST_STATE         6
+/* for debugging: mapping strings */
+#define MESH_PEERING_STATE_STRINGS \
+       {"IDLE  ", "OPNSNT", "CNFRCV", "OPNRCV", "ESTAB ", "HOLDNG"}
+
+#ifdef WLMESH
+typedef BWL_PRE_PACKED_STRUCT struct mesh_peer_info {
+       /* mesh_peer_instance as given in the spec. Note that, peer address
+        * is stored in scb
+        */
+       uint16  mesh_peer_prot_id;
+       uint16  local_link_id;
+       uint16  peer_link_id;
+       /* AID generated by *peer* to self & received in peer_confirm */
+       uint16  peer_aid;
+
+       /* TODO: no mention in spec? possibly used in PS case. Note that aid generated
+       * from self to peer is stored in scb.
+       */
+       uint8   state;
+       /* TODO: struct mesh_peer_info *next; this field is required
+        * if multiple peerings per same src is allowed, which is
+        * true as per spec.
+        */
+} BWL_POST_PACKED_STRUCT mesh_peer_info_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct mesh_peer_info_ext {
+       mesh_peer_info_t        peer_info;
+       uint16  local_aid;      /* AID generated by *local* to peer */
+       struct ether_addr ea; /* peer ea */
+       uint32  entry_state;    /* see MESH_PEER_ENTRY_STATE_ACTIVE etc; valid
+               * ONLY for internal peering requests
+               */
+       int rssi;
+} BWL_POST_PACKED_STRUCT mesh_peer_info_ext_t;
+
+/* #ifdef WLMESH */
+typedef BWL_PRE_PACKED_STRUCT struct mesh_peer_info_dump {
+       uint32 buflen;
+       uint32 version;
+       uint32 count;   /* number of results */
+       mesh_peer_info_ext_t    mpi_ext[1];
+} BWL_POST_PACKED_STRUCT mesh_peer_info_dump_t;
+#define WL_MESH_PEER_RES_FIXED_SIZE (sizeof(mesh_peer_info_dump_t) - sizeof(mesh_peer_info_ext_t))
+
+#endif /* WLMESH */
+
+/* once an entry is added into mesh_peer_list, if peering is lost, it will
+* get retried for peering, MAX_MESH_PEER_ENTRY_RETRIES times. after wards, it
+* wont get retried and will be moved to MESH_PEER_ENTRY_STATE_TIMEDOUT state,
+* until user adds it again explicitely, when its entry_state is changed
+* to MESH_PEER_ENTRY_STATE_ACTIVE and tried again.
+*/
+#define MAX_MESH_SELF_PEER_ENTRY_RETRIES       3
+#define MESH_SELF_PEER_ENTRY_STATE_ACTIVE      1
+#define MESH_SELF_PEER_ENTRY_STATE_TIMEDOUT    2
+
+/** Mesh Channel Switch Parameter IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_mcsp_body {
+       uint8 ttl;           /* remaining number of hops allowed for this element. */
+       uint8 flags;         /* attributes of this channel switch attempt */
+       uint8 reason;        /* reason for the mesh channel switch */
+       uint16 precedence;    /* random value in the range 0 to 65535 */
+} BWL_POST_PACKED_STRUCT;
+
+#define DOT11_MCSP_TTL_DEFAULT          1
+#define DOT11_MCSP_FLAG_TRANS_RESTRICT 0x1     /* no transmit except frames with mcsp */
+#define DOT11_MCSP_FLAG_INIT           0x2     /* initiates the channel switch attempt */
+#define DOT11_MCSP_FLAG_REASON         0x4     /* validity of reason code field */
+#define DOT11_MCSP_REASON_REGULATORY   0       /* meet regulatory requirements */
+#define DOT11_MCSP_REASON_UNSPECIFIED  1       /* unspecified reason */
+
+BWL_PRE_PACKED_STRUCT struct dot11_mesh_csp {
+       uint8 id; /* id DOT11_MNG_MESH_CSP_ID */
+       uint8 len; /* length of IE */
+       struct dot11_mcsp_body body; /* body of the ie */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_mesh_csp dot11_mesh_csp_ie_t;
+#define DOT11_MESH_CSP_IE_LEN    5       /* length of mesh channel switch parameter IE body */
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif  /* #ifndef _802_11s_H_ */
diff --git a/bcmdhd.101.10.240.x/include/802.1d.h b/bcmdhd.101.10.240.x/include/802.1d.h
new file mode 100644 (file)
index 0000000..a05bb28
--- /dev/null
@@ -0,0 +1,47 @@
+/*
+ * Fundamental types and constants relating to 802.1D
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _802_1_D_
+#define _802_1_D_
+
+/* 802.1D priority defines */
+#define        PRIO_8021D_NONE         2       /* None = - */
+#define        PRIO_8021D_BK           1       /* BK - Background */
+#define        PRIO_8021D_BE           0       /* BE - Best-effort */
+#define        PRIO_8021D_EE           3       /* EE - Excellent-effort */
+#define        PRIO_8021D_CL           4       /* CL - Controlled Load */
+#define        PRIO_8021D_VI           5       /* Vi - Video */
+#define        PRIO_8021D_VO           6       /* Vo - Voice */
+#define        PRIO_8021D_NC           7       /* NC - Network Control */
+#define        MAXPRIO                 7       /* 0-7 */
+#define NUMPRIO                        (MAXPRIO + 1)
+
+#define ALLPRIO                -1      /* All prioirty */
+
+/* Converts prio to precedence since the numerical value of
+ * PRIO_8021D_BE and PRIO_8021D_NONE are swapped.
+ */
+#define PRIO2PREC(prio) \
+       (((prio) == PRIO_8021D_NONE || (prio) == PRIO_8021D_BE) ? ((prio^2)) : (prio))
+
+#endif /* _802_1_D__ */
diff --git a/bcmdhd.101.10.240.x/include/802.3.h b/bcmdhd.101.10.240.x/include/802.3.h
new file mode 100644 (file)
index 0000000..af9de38
--- /dev/null
@@ -0,0 +1,49 @@
+/*
+ * Fundamental constants relating to 802.3
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _802_3_h_
+#define _802_3_h_
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#define SNAP_HDR_LEN   6       /* 802.3 SNAP header length */
+#define DOT3_OUI_LEN   3       /* 802.3 oui length */
+
+BWL_PRE_PACKED_STRUCT struct dot3_mac_llc_snap_header {
+       uint8   ether_dhost[ETHER_ADDR_LEN];    /* dest mac */
+       uint8   ether_shost[ETHER_ADDR_LEN];    /* src mac */
+       uint16  length;                         /* frame length incl header */
+       uint8   dsap;                           /* always 0xAA */
+       uint8   ssap;                           /* always 0xAA */
+       uint8   ctl;                            /* always 0x03 */
+       uint8   oui[DOT3_OUI_LEN];              /* RFC1042: 0x00 0x00 0x00
+                                                * Bridge-Tunnel: 0x00 0x00 0xF8
+                                                */
+       uint16  type;                           /* ethertype */
+} BWL_POST_PACKED_STRUCT;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* #ifndef _802_3_h_ */
diff --git a/bcmdhd.101.10.240.x/include/aidmp.h b/bcmdhd.101.10.240.x/include/aidmp.h
new file mode 100644 (file)
index 0000000..d1cd543
--- /dev/null
@@ -0,0 +1,436 @@
+/*
+ * Broadcom AMBA Interconnect definitions.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _AIDMP_H
+#define        _AIDMP_H
+
+/* Manufacturer Ids */
+#define        MFGID_ARM               0x43b
+#define        MFGID_BRCM              0x4bf
+#define        MFGID_MIPS              0x4a7
+
+/* Component Classes */
+#define        CC_SIM                  0
+#define        CC_EROM                 1
+#define        CC_CORESIGHT            9
+#define        CC_VERIF                0xb
+#define        CC_OPTIMO               0xd
+#define        CC_GEN                  0xe
+#define        CC_PRIMECELL            0xf
+
+/* Enumeration ROM registers */
+#define        ER_EROMENTRY            0x000
+#define        ER_REMAPCONTROL         0xe00
+#define        ER_REMAPSELECT          0xe04
+#define        ER_MASTERSELECT         0xe10
+#define        ER_ITCR                 0xf00
+#define        ER_ITIP                 0xf04
+
+/* Erom entries */
+#define        ER_TAG                  0xe
+#define        ER_TAG1                 0x6
+#define        ER_VALID                1
+#define        ER_CI                   0
+#define        ER_MP                   2
+#define        ER_ADD                  4
+#define        ER_END                  0xe
+#define        ER_BAD                  0xffffffff
+#define        ER_SZ_MAX               4096 /* 4KB */
+
+/* EROM CompIdentA */
+#define        CIA_MFG_MASK            0xfff00000
+#define        CIA_MFG_SHIFT           20
+#define        CIA_CID_MASK            0x000fff00
+#define        CIA_CID_SHIFT           8
+#define        CIA_CCL_MASK            0x000000f0
+#define        CIA_CCL_SHIFT           4
+
+/* EROM CompIdentB */
+#define        CIB_REV_MASK            0xff000000
+#define        CIB_REV_SHIFT           24
+#define        CIB_NSW_MASK            0x00f80000
+#define        CIB_NSW_SHIFT           19
+#define        CIB_NMW_MASK            0x0007c000
+#define        CIB_NMW_SHIFT           14
+#define        CIB_NSP_MASK            0x00003e00
+#define        CIB_NSP_SHIFT           9
+#define        CIB_NMP_MASK            0x000001f0
+#define        CIB_NMP_SHIFT           4
+
+/* EROM MasterPortDesc */
+#define        MPD_MUI_MASK            0x0000ff00
+#define        MPD_MUI_SHIFT           8
+#define        MPD_MP_MASK             0x000000f0
+#define        MPD_MP_SHIFT            4
+
+/* EROM AddrDesc */
+#define        AD_ADDR_MASK            0xfffff000
+#define        AD_SP_MASK              0x00000f00
+#define        AD_SP_SHIFT             8
+#define        AD_ST_MASK              0x000000c0
+#define        AD_ST_SHIFT             6
+#define        AD_ST_SLAVE             0x00000000
+#define        AD_ST_BRIDGE            0x00000040
+#define        AD_ST_SWRAP             0x00000080
+#define        AD_ST_MWRAP             0x000000c0
+#define        AD_SZ_MASK              0x00000030
+#define        AD_SZ_SHIFT             4
+#define        AD_SZ_4K                0x00000000
+#define        AD_SZ_8K                0x00000010
+#define        AD_SZ_16K               0x00000020
+#define        AD_SZ_SZD               0x00000030
+#define        AD_AG32                 0x00000008
+#define        AD_ADDR_ALIGN           0x00000fff
+#define        AD_SZ_BASE              0x00001000      /* 4KB */
+
+/* EROM SizeDesc */
+#define        SD_SZ_MASK              0xfffff000
+#define        SD_SG32                 0x00000008
+#define        SD_SZ_ALIGN             0x00000fff
+
+#define WRAPPER_TIMEOUT_CONFIG 0x4u
+
+#if !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__)
+
+typedef volatile struct _aidmp {
+       uint32  oobselina30;    /* 0x000 */
+       uint32  oobselina74;    /* 0x004 */
+       uint32  PAD[6];
+       uint32  oobselinb30;    /* 0x020 */
+       uint32  oobselinb74;    /* 0x024 */
+       uint32  PAD[6];
+       uint32  oobselinc30;    /* 0x040 */
+       uint32  oobselinc74;    /* 0x044 */
+       uint32  PAD[6];
+       uint32  oobselind30;    /* 0x060 */
+       uint32  oobselind74;    /* 0x064 */
+       uint32  PAD[38];
+       uint32  oobselouta30;   /* 0x100 */
+       uint32  oobselouta74;   /* 0x104 */
+       uint32  PAD[6];
+       uint32  oobseloutb30;   /* 0x120 */
+       uint32  oobseloutb74;   /* 0x124 */
+       uint32  PAD[6];
+       uint32  oobseloutc30;   /* 0x140 */
+       uint32  oobseloutc74;   /* 0x144 */
+       uint32  PAD[6];
+       uint32  oobseloutd30;   /* 0x160 */
+       uint32  oobseloutd74;   /* 0x164 */
+       uint32  PAD[38];
+       uint32  oobsynca;       /* 0x200 */
+       uint32  oobseloutaen;   /* 0x204 */
+       uint32  PAD[6];
+       uint32  oobsyncb;       /* 0x220 */
+       uint32  oobseloutben;   /* 0x224 */
+       uint32  PAD[6];
+       uint32  oobsyncc;       /* 0x240 */
+       uint32  oobseloutcen;   /* 0x244 */
+       uint32  PAD[6];
+       uint32  oobsyncd;       /* 0x260 */
+       uint32  oobseloutden;   /* 0x264 */
+       uint32  PAD[38];
+       uint32  oobaextwidth;   /* 0x300 */
+       uint32  oobainwidth;    /* 0x304 */
+       uint32  oobaoutwidth;   /* 0x308 */
+       uint32  PAD[5];
+       uint32  oobbextwidth;   /* 0x320 */
+       uint32  oobbinwidth;    /* 0x324 */
+       uint32  oobboutwidth;   /* 0x328 */
+       uint32  PAD[5];
+       uint32  oobcextwidth;   /* 0x340 */
+       uint32  oobcinwidth;    /* 0x344 */
+       uint32  oobcoutwidth;   /* 0x348 */
+       uint32  PAD[5];
+       uint32  oobdextwidth;   /* 0x360 */
+       uint32  oobdinwidth;    /* 0x364 */
+       uint32  oobdoutwidth;   /* 0x368 */
+       uint32  PAD[37];
+       uint32  ioctrlset;      /* 0x400 */
+       uint32  ioctrlclear;    /* 0x404 */
+       uint32  ioctrl;         /* 0x408 */
+       uint32  PAD[61];
+       uint32  iostatus;       /* 0x500 */
+       uint32  PAD[127];
+       uint32  ioctrlwidth;    /* 0x700 */
+       uint32  iostatuswidth;  /* 0x704 */
+       uint32  PAD[62];
+       uint32  resetctrl;      /* 0x800 */
+       uint32  resetstatus;    /* 0x804 */
+       uint32  resetreadid;    /* 0x808 */
+       uint32  resetwriteid;   /* 0x80c */
+       uint32  PAD[60];
+       uint32  errlogctrl;     /* 0x900 */
+       uint32  errlogdone;     /* 0x904 */
+       uint32  errlogstatus;   /* 0x908 */
+       uint32  errlogaddrlo;   /* 0x90c */
+       uint32  errlogaddrhi;   /* 0x910 */
+       uint32  errlogid;       /* 0x914 */
+       uint32  errloguser;     /* 0x918 */
+       uint32  errlogflags;    /* 0x91c */
+       uint32  PAD[56];
+       uint32  intstatus;      /* 0xa00 */
+       uint32  PAD[255];
+       uint32  config;         /* 0xe00 */
+       uint32  PAD[63];
+       uint32  itcr;           /* 0xf00 */
+       uint32  PAD[3];
+       uint32  itipooba;       /* 0xf10 */
+       uint32  itipoobb;       /* 0xf14 */
+       uint32  itipoobc;       /* 0xf18 */
+       uint32  itipoobd;       /* 0xf1c */
+       uint32  PAD[4];
+       uint32  itipoobaout;    /* 0xf30 */
+       uint32  itipoobbout;    /* 0xf34 */
+       uint32  itipoobcout;    /* 0xf38 */
+       uint32  itipoobdout;    /* 0xf3c */
+       uint32  PAD[4];
+       uint32  itopooba;       /* 0xf50 */
+       uint32  itopoobb;       /* 0xf54 */
+       uint32  itopoobc;       /* 0xf58 */
+       uint32  itopoobd;       /* 0xf5c */
+       uint32  PAD[4];
+       uint32  itopoobain;     /* 0xf70 */
+       uint32  itopoobbin;     /* 0xf74 */
+       uint32  itopoobcin;     /* 0xf78 */
+       uint32  itopoobdin;     /* 0xf7c */
+       uint32  PAD[4];
+       uint32  itopreset;      /* 0xf90 */
+       uint32  PAD[15];
+       uint32  peripherialid4; /* 0xfd0 */
+       uint32  peripherialid5; /* 0xfd4 */
+       uint32  peripherialid6; /* 0xfd8 */
+       uint32  peripherialid7; /* 0xfdc */
+       uint32  peripherialid0; /* 0xfe0 */
+       uint32  peripherialid1; /* 0xfe4 */
+       uint32  peripherialid2; /* 0xfe8 */
+       uint32  peripherialid3; /* 0xfec */
+       uint32  componentid0;   /* 0xff0 */
+       uint32  componentid1;   /* 0xff4 */
+       uint32  componentid2;   /* 0xff8 */
+       uint32  componentid3;   /* 0xffc */
+} aidmp_t;
+
+#endif /* !_LANGUAGE_ASSEMBLY && !__ASSEMBLY__ */
+
+/* Out-of-band Router registers */
+#define        OOB_BUSCONFIG           0x020
+#define        OOB_STATUSA             0x100
+#define        OOB_STATUSB             0x104
+#define        OOB_STATUSC             0x108
+#define        OOB_STATUSD             0x10c
+#define        OOB_ENABLEA0            0x200
+#define        OOB_ENABLEA1            0x204
+#define        OOB_ENABLEA2            0x208
+#define        OOB_ENABLEA3            0x20c
+#define        OOB_ENABLEB0            0x280
+#define        OOB_ENABLEB1            0x284
+#define        OOB_ENABLEB2            0x288
+#define        OOB_ENABLEB3            0x28c
+#define        OOB_ENABLEC0            0x300
+#define        OOB_ENABLEC1            0x304
+#define        OOB_ENABLEC2            0x308
+#define        OOB_ENABLEC3            0x30c
+#define        OOB_ENABLED0            0x380
+#define        OOB_ENABLED1            0x384
+#define        OOB_ENABLED2            0x388
+#define        OOB_ENABLED3            0x38c
+#define        OOB_ITCR                0xf00
+#define        OOB_ITIPOOBA            0xf10
+#define        OOB_ITIPOOBB            0xf14
+#define        OOB_ITIPOOBC            0xf18
+#define        OOB_ITIPOOBD            0xf1c
+#define        OOB_ITOPOOBA            0xf30
+#define        OOB_ITOPOOBB            0xf34
+#define        OOB_ITOPOOBC            0xf38
+#define        OOB_ITOPOOBD            0xf3c
+
+/* DMP wrapper registers */
+#define        AI_OOBSELINA30          0x000
+#define        AI_OOBSELINA74          0x004
+#define        AI_OOBSELINB30          0x020
+#define        AI_OOBSELINB74          0x024
+#define        AI_OOBSELINC30          0x040
+#define        AI_OOBSELINC74          0x044
+#define        AI_OOBSELIND30          0x060
+#define        AI_OOBSELIND74          0x064
+#define        AI_OOBSELOUTA30         0x100
+#define        AI_OOBSELOUTA74         0x104
+#define        AI_OOBSELOUTB30         0x120
+#define        AI_OOBSELOUTB74         0x124
+#define        AI_OOBSELOUTC30         0x140
+#define        AI_OOBSELOUTC74         0x144
+#define        AI_OOBSELOUTD30         0x160
+#define        AI_OOBSELOUTD74         0x164
+#define        AI_OOBSYNCA             0x200
+#define        AI_OOBSELOUTAEN         0x204
+#define        AI_OOBSYNCB             0x220
+#define        AI_OOBSELOUTBEN         0x224
+#define        AI_OOBSYNCC             0x240
+#define        AI_OOBSELOUTCEN         0x244
+#define        AI_OOBSYNCD             0x260
+#define        AI_OOBSELOUTDEN         0x264
+#define        AI_OOBAEXTWIDTH         0x300
+#define        AI_OOBAINWIDTH          0x304
+#define        AI_OOBAOUTWIDTH         0x308
+#define        AI_OOBBEXTWIDTH         0x320
+#define        AI_OOBBINWIDTH          0x324
+#define        AI_OOBBOUTWIDTH         0x328
+#define        AI_OOBCEXTWIDTH         0x340
+#define        AI_OOBCINWIDTH          0x344
+#define        AI_OOBCOUTWIDTH         0x348
+#define        AI_OOBDEXTWIDTH         0x360
+#define        AI_OOBDINWIDTH          0x364
+#define        AI_OOBDOUTWIDTH         0x368
+
+#define        AI_IOCTRLSET            0x400
+#define        AI_IOCTRLCLEAR          0x404
+#define        AI_IOCTRL               0x408
+#define AI_IOCTRL_BOOKER        0x248 /* Starting from OOBR base - 0x18006000 */
+#define        AI_IOSTATUS             0x500
+#define        AI_RESETCTRL            0x800
+#define        AI_RESETSTATUS          0x804
+
+#define        AI_IOCTRLWIDTH          0x700
+#define        AI_IOSTATUSWIDTH        0x704
+
+#define        AI_RESETREADID          0x808
+#define        AI_RESETWRITEID         0x80c
+#define        AI_ERRLOGCTRL           0x900
+#define        AI_ERRLOGDONE           0x904
+#define        AI_ERRLOGSTATUS         0x908
+#define        AI_ERRLOGADDRLO         0x90c
+#define        AI_ERRLOGADDRHI         0x910
+#define        AI_ERRLOGID             0x914
+#define        AI_ERRLOGUSER           0x918
+#define        AI_ERRLOGFLAGS          0x91c
+#define        AI_INTSTATUS            0xa00
+#define        AI_CONFIG               0xe00
+#define        AI_ITCR                 0xf00
+#define        AI_ITIPOOBA             0xf10
+#define        AI_ITIPOOBB             0xf14
+#define        AI_ITIPOOBC             0xf18
+#define        AI_ITIPOOBD             0xf1c
+#define        AI_ITIPOOBAOUT          0xf30
+#define        AI_ITIPOOBBOUT          0xf34
+#define        AI_ITIPOOBCOUT          0xf38
+#define        AI_ITIPOOBDOUT          0xf3c
+#define        AI_ITOPOOBA             0xf50
+#define        AI_ITOPOOBB             0xf54
+#define        AI_ITOPOOBC             0xf58
+#define        AI_ITOPOOBD             0xf5c
+#define        AI_ITOPOOBAIN           0xf70
+#define        AI_ITOPOOBBIN           0xf74
+#define        AI_ITOPOOBCIN           0xf78
+#define        AI_ITOPOOBDIN           0xf7c
+#define        AI_ITOPRESET            0xf90
+#define        AI_PERIPHERIALID4       0xfd0
+#define        AI_PERIPHERIALID5       0xfd4
+#define        AI_PERIPHERIALID6       0xfd8
+#define        AI_PERIPHERIALID7       0xfdc
+#define        AI_PERIPHERIALID0       0xfe0
+#define        AI_PERIPHERIALID1       0xfe4
+#define        AI_PERIPHERIALID2       0xfe8
+#define        AI_PERIPHERIALID3       0xfec
+#define        AI_COMPONENTID0         0xff0
+#define        AI_COMPONENTID1         0xff4
+#define        AI_COMPONENTID2         0xff8
+#define        AI_COMPONENTID3         0xffc
+
+/* resetctrl */
+#define        AIRC_RESET              1
+
+/* errlogctrl */
+#define AIELC_TO_EXP_MASK      0x0000001f0             /* backplane timeout exponent */
+#define AIELC_TO_EXP_SHIFT     4
+#define AIELC_TO_ENAB_SHIFT    9                       /* backplane timeout enable */
+
+/* errlogdone */
+#define AIELD_ERRDONE_MASK     0x3
+
+/* errlogstatus */
+#define AIELS_SLAVE_ERR         0x1
+#define AIELS_TIMEOUT           0x2
+#define AIELS_DECODE            0x3
+#define AIELS_ERROR_MASK       0x3
+#define AIELS_MULTIPLE_ERRORS  0x4
+#define ERRLOGID_AXIID_MASK    0xF
+
+/* errorlog status bit map, for SW use */
+#define AXI_WRAP_STS_NONE              (0)
+#define AXI_WRAP_STS_TIMEOUT           (1<<0)
+#define AXI_WRAP_STS_SLAVE_ERR         (1<<1)
+#define AXI_WRAP_STS_DECODE_ERR                (1<<2)
+#define AXI_WRAP_STS_PCI_RD_ERR                (1<<3)
+#define AXI_WRAP_STS_WRAP_RD_ERR       (1<<4)
+#define AXI_WRAP_STS_SET_CORE_FAIL     (1<<5)
+#define AXI_WRAP_STS_MULTIPLE_ERRORS   (1<<6)
+
+/* errlogFrags */
+#define AXI_ERRLOG_FLAGS_WRITE_REQ     (1<<24)
+
+/* config */
+#define        AICFG_OOB               0x00000020
+#define        AICFG_IOS               0x00000010
+#define        AICFG_IOC               0x00000008
+#define        AICFG_TO                0x00000004
+#define        AICFG_ERRL              0x00000002
+#define        AICFG_RST               0x00000001
+
+/* bit defines for AI_OOBSELOUTB74 reg */
+#define OOB_SEL_OUTEN_B_5      15
+#define OOB_SEL_OUTEN_B_6      23
+
+/* AI_OOBSEL for A/B/C/D, 0-7 */
+#define AI_OOBSEL_MASK         0x1F
+#define AI_OOBSEL_0_SHIFT      0
+#define AI_OOBSEL_1_SHIFT      8
+#define AI_OOBSEL_2_SHIFT      16
+#define AI_OOBSEL_3_SHIFT      24
+#define AI_OOBSEL_4_SHIFT      0
+#define AI_OOBSEL_5_SHIFT      8
+#define AI_OOBSEL_6_SHIFT      16
+#define AI_OOBSEL_7_SHIFT      24
+#define AI_IOCTRL_ENABLE_D11_PME       (1 << 14)
+
+/* bit Specific for AI_OOBSELOUTB30 */
+#define OOB_B_ALP_REQUEST 0
+#define OOB_B_HT_REQUEST 1
+#define OOB_B_ILP_REQUEST 2
+#define OOB_B_ALP_AVAIL_REQUEST 3
+#define OOB_B_HT_AVAIL_REQUEST 4
+
+/* mask for interrupts from each core to wrapper */
+#define AI_OOBSELINA74_CORE_MASK       0x80808080
+#define AI_OOBSELINA30_CORE_MASK       0x80808080
+
+#define AI_OOBSEL_30_0_INTR_MASK       0x00000080
+#define AI_OOBSEL_30_3_INTR_MASK       0x80000000
+
+#define AI_OOBSEL_74_4_INTR_MASK       0x00000080
+#define AI_OOBSEL_74_7_INTR_MASK       0x80000000
+
+/* axi id mask in the error log id */
+#define AI_ERRLOGID_AXI_ID_MASK 0x07
+#define AI_ERRLOGID_AXI_ID_MASK_EXTD 0x1F
+
+#endif /* _AIDMP_H */
diff --git a/bcmdhd.101.10.240.x/include/bcm_l2_filter.h b/bcmdhd.101.10.240.x/include/bcm_l2_filter.h
new file mode 100644 (file)
index 0000000..d594285
--- /dev/null
@@ -0,0 +1,99 @@
+/*
+ * L2 Filter handling functions
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ *
+ */
+#ifndef _l2_filter_h_
+#define _l2_filter_h_
+
+/* Proxy ARP processing return values */
+#define PARP_DROP                      0
+#define PARP_NOP                       1
+#define PARP_TAKEN                     2
+/* Adjust for ETHER_HDR_LEN pull in linux
+ * which makes pkt nonaligned
+ */
+#define ALIGN_ADJ_BUFLEN               2
+
+#define        BCM_PARP_TABLE_SIZE             32              /* proxyarp hash table bucket size */
+#define        BCM_PARP_TABLE_MASK             0x1f    /* proxyarp hash table index mask */
+#define        BCM_PARP_TABLE_INDEX(val)       (val & BCM_PARP_TABLE_MASK)
+#define        BCM_PARP_TIMEOUT                600     /* proxyarp cache entry timerout duration(10 min) */
+
+#define BCM_PARP_IS_TIMEOUT(pub_tick, entry)   \
+                       (pub_tick - entry->used > BCM_PARP_TIMEOUT)
+
+#define        BCM_PARP_ANNOUNCE_WAIT          2       /* proxyarp announce wait duration(2 sec) */
+
+#define BCM_PARP_ANNOUNCE_WAIT_REACH(pub_tick, entry) \
+       (pub_tick - entry->used > BCM_PARP_ANNOUNCE_WAIT)
+
+#define BCM_ARP_TABLE_UPDATE_TIMEOUT   100
+
+/* Taken from wlc_tdls.h for block_tdls iovar */
+#define TDLS_PAYLOAD_TYPE              2
+#define TDLS_PAYLOAD_TYPE_LEN          1
+
+/* TDLS Action Category code */
+#define TDLS_ACTION_CATEGORY_CODE      12
+
+typedef struct parp_entry {
+       struct parp_entry       *next;
+       uint32                  used;           /* time stamp */
+       struct ether_addr       ea;
+       bcm_tlv_t               ip;
+} parp_entry_t;
+
+typedef struct arp_table arp_table_t;
+
+extern int bcm_l2_filter_gratuitous_arp(osl_t *osh, void *pktbuf);
+extern int bcm_l2_filter_block_ping(osl_t *osh, void *pktbuf);
+extern int bcm_l2_filter_get_mac_addr_dhcp_pkt(osl_t *osh, void *pktbuf,
+       int ifidx, uint8** addr);
+
+arp_table_t* init_l2_filter_arp_table(osl_t* osh);
+void deinit_l2_filter_arp_table(osl_t* osh, arp_table_t* ptable);
+int get_pkt_ether_type(osl_t *osh, void *skb, uint8 **data_ptr,
+       int *len_ptr, uint16 *et_ptr, bool *snap_ptr);
+int get_pkt_ip_type(osl_t *osh, void *pktbuf,
+       uint8 **data_ptr, int *len_ptr, uint8 *prot_ptr);
+int bcm_l2_filter_parp_addentry(osl_t *osh, arp_table_t* arp_tbl, struct ether_addr *ea,
+       uint8 *ip, uint8 ip_ver, bool cached, unsigned int entry_tickcnt);
+int bcm_l2_filter_parp_delentry(osl_t *osh, arp_table_t* arp_tbl, struct ether_addr *ea,
+       uint8 *ip, uint8 ip_ver, bool cached);
+parp_entry_t *bcm_l2_filter_parp_findentry(arp_table_t* arp_tbl, uint8 *ip,
+       uint8 ip_ver, bool cached, unsigned int entry_tickcnt);
+
+int bcm_l2_filter_parp_modifyentry(arp_table_t* arp_tbl, struct ether_addr *ea,
+       uint8 *ip, uint8 ip_ver, bool cached, unsigned int entry_tickcnt);
+extern void bcm_l2_filter_arp_table_update(osl_t *osh, arp_table_t* arp_tbl, bool all,
+       uint8 *del_ea, bool periodic, unsigned int tickcnt);
+
+void *bcm_l2_filter_proxyarp_alloc_reply(osl_t* osh, uint16 pktlen, struct ether_addr *src_ea,
+       struct ether_addr *dst_ea, uint16 ea_type, bool snap, void **p);
+void bcm_l2_filter_parp_get_smac(arp_table_t* ptable, void* smac);
+void bcm_l2_filter_parp_get_cmac(arp_table_t* ptable, void* cmac);
+void bcm_l2_filter_parp_set_smac(arp_table_t* ptable, void* smac);
+void bcm_l2_filter_parp_set_cmac(arp_table_t* ptable, void* cmac);
+bcm_tlv_t* parse_nd_options(void *buf, int buflen, uint key);
+uint16 calc_checksum(uint8 *src_ipa, uint8 *dst_ipa, uint32 ul_len, uint8 prot, uint8 *ul_data);
+extern int bcm_l2_filter_block_tdls(osl_t *osh, void *pktbuf);
+#endif /* _l2_filter_h */
diff --git a/bcmdhd.101.10.240.x/include/bcm_mpool_pub.h b/bcmdhd.101.10.240.x/include/bcm_mpool_pub.h
new file mode 100644 (file)
index 0000000..76c4ce8
--- /dev/null
@@ -0,0 +1,344 @@
+/*
+ * Memory pools library, Public interface
+ *
+ * API Overview
+ *
+ * This package provides a memory allocation subsystem based on pools of
+ * homogenous objects.
+ *
+ * Instrumentation is available for reporting memory utilization both
+ * on a per-data-structure basis and system wide.
+ *
+ * There are two main types defined in this API.
+ *
+ *    pool manager: A singleton object that acts as a factory for
+ *                  pool allocators. It also is used for global
+ *                  instrumentation, such as reporting all blocks
+ *                  in use across all data structures. The pool manager
+ *                  creates and provides individual memory pools
+ *                  upon request to application code.
+ *
+ *    memory pool:  An object for allocating homogenous memory blocks.
+ *
+ * Global identifiers in this module use the following prefixes:
+ *    bcm_mpm_*     Memory pool manager
+ *    bcm_mp_*      Memory pool
+ *
+ * There are two main types of memory pools:
+ *
+ *    prealloc: The contiguous memory block of objects can either be supplied
+ *              by the client or malloc'ed by the memory manager. The objects are
+ *              allocated out of a block of memory and freed back to the block.
+ *
+ *    heap:     The memory pool allocator uses the heap (malloc/free) for memory.
+ *              In this case, the pool allocator is just providing statistics
+ *              and instrumentation on top of the heap, without modifying the heap
+ *              allocation implementation.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _BCM_MPOOL_PUB_H
+#define _BCM_MPOOL_PUB_H 1
+
+#include <typedefs.h> /* needed for uint16 */
+
+/*
+**************************************************************************
+*
+* Type definitions, handles
+*
+**************************************************************************
+*/
+
+/* Forward declaration of OSL handle. */
+struct osl_info;
+
+/* Forward declaration of string buffer. */
+struct bcmstrbuf;
+
+/*
+ * Opaque type definition for the pool manager handle. This object is used for global
+ * memory pool operations such as obtaining a new pool, deleting a pool, iterating and
+ * instrumentation/debugging.
+ */
+struct bcm_mpm_mgr;
+typedef struct bcm_mpm_mgr *bcm_mpm_mgr_h;
+
+/*
+ * Opaque type definition for an instance of a pool. This handle is used for allocating
+ * and freeing memory through the pool, as well as management/instrumentation on this
+ * specific pool.
+ */
+struct bcm_mp_pool;
+typedef struct bcm_mp_pool *bcm_mp_pool_h;
+
+/*
+ * To make instrumentation more readable, every memory
+ * pool must have a readable name. Pool names are up to
+ * 8 bytes including '\0' termination. (7 printable characters.)
+ */
+#define BCM_MP_NAMELEN 8
+
+/*
+ * Type definition for pool statistics.
+ */
+typedef struct bcm_mp_stats {
+       char name[BCM_MP_NAMELEN];  /* Name of this pool. */
+       unsigned int objsz;         /* Object size allocated in this pool */
+       uint16 nobj;                /* Total number of objects in this pool */
+       uint16 num_alloc;           /* Number of objects currently allocated */
+       uint16 high_water;          /* Max number of allocated objects. */
+       uint16 failed_alloc;        /* Failed allocations. */
+} bcm_mp_stats_t;
+
+/*
+**************************************************************************
+*
+* API Routines on the pool manager.
+*
+**************************************************************************
+*/
+
+/*
+ * bcm_mpm_init() - initialize the whole memory pool system.
+ *
+ * Parameters:
+ *    osh:       INPUT  Operating system handle. Needed for heap memory allocation.
+ *    max_pools: INPUT Maximum number of mempools supported.
+ *    mgr:       OUTPUT The handle is written with the new pools manager object/handle.
+ *
+ * Returns:
+ *    BCME_OK     Object initialized successfully. May be used.
+ *    BCME_NOMEM  Initialization failed due to no memory. Object must not be used.
+ */
+int bcm_mpm_init(struct osl_info *osh, int max_pools, bcm_mpm_mgr_h *mgrp);
+
+/*
+ * bcm_mpm_deinit() - de-initialize the whole memory pool system.
+ *
+ * Parameters:
+ *    mgr:     INPUT  Pointer to pool manager handle.
+ *
+ * Returns:
+ *    BCME_OK  Memory pool manager successfully de-initialized.
+ *    other    Indicated error occured during de-initialization.
+ */
+int bcm_mpm_deinit(bcm_mpm_mgr_h *mgrp);
+
+/*
+ * bcm_mpm_create_prealloc_pool() - Create a new pool for fixed size objects. The
+ *                                  pool uses a contiguous block of pre-alloced
+ *                                  memory. The memory block may either be provided
+ *                                  by the client or dynamically allocated by the
+ *                                  pool manager.
+ *
+ * Parameters:
+ *    mgr:      INPUT  The handle to the pool manager
+ *    obj_sz:   INPUT  Size of objects that will be allocated by the new pool
+ *                     Must be >= sizeof(void *).
+ *    nobj:     INPUT  Maximum number of concurrently existing objects to support
+ *    memstart  INPUT  Pointer to the memory to use, or NULL to malloc()
+ *    memsize   INPUT  Number of bytes referenced from memstart (for error checking).
+ *                     Must be 0 if 'memstart' is NULL.
+ *    poolname  INPUT  For instrumentation, the name of the pool
+ *    newp:     OUTPUT The handle for the new pool, if creation is successful
+ *
+ * Returns:
+ *    BCME_OK   Pool created ok.
+ *    other     Pool not created due to indicated error. newpoolp set to NULL.
+ *
+ *
+ */
+int bcm_mpm_create_prealloc_pool(bcm_mpm_mgr_h mgr,
+                                 unsigned int obj_sz,
+                                 int nobj,
+                                 void *memstart,
+                                 unsigned int memsize,
+                                 const char poolname[BCM_MP_NAMELEN],
+                                 bcm_mp_pool_h *newp);
+
+/*
+ * bcm_mpm_delete_prealloc_pool() - Delete a memory pool. This should only be called after
+ *                                  all memory objects have been freed back to the pool.
+ *
+ * Parameters:
+ *    mgr:     INPUT The handle to the pools manager
+ *    pool:    INPUT The handle of the  pool to delete
+ *
+ * Returns:
+ *    BCME_OK   Pool deleted ok.
+ *    other     Pool not deleted due to indicated error.
+ *
+ */
+int bcm_mpm_delete_prealloc_pool(bcm_mpm_mgr_h mgr, bcm_mp_pool_h *poolp);
+
+/*
+ * bcm_mpm_create_heap_pool() - Create a new pool for fixed size objects. The memory
+ *                              pool allocator uses the heap (malloc/free) for memory.
+ *                              In this case, the pool allocator is just providing
+ *                              statistics and instrumentation on top of the heap,
+ *                              without modifying the heap allocation implementation.
+ *
+ * Parameters:
+ *    mgr:      INPUT  The handle to the pool manager
+ *    obj_sz:   INPUT  Size of objects that will be allocated by the new pool
+ *    poolname  INPUT  For instrumentation, the name of the pool
+ *    newp:     OUTPUT The handle for the new pool, if creation is successful
+ *
+ * Returns:
+ *    BCME_OK   Pool created ok.
+ *    other     Pool not created due to indicated error. newpoolp set to NULL.
+ *
+ *
+ */
+int bcm_mpm_create_heap_pool(bcm_mpm_mgr_h mgr, unsigned int obj_sz,
+                             const char poolname[BCM_MP_NAMELEN],
+                             bcm_mp_pool_h *newp);
+
+/*
+ * bcm_mpm_delete_heap_pool() - Delete a memory pool. This should only be called after
+ *                              all memory objects have been freed back to the pool.
+ *
+ * Parameters:
+ *    mgr:     INPUT The handle to the pools manager
+ *    pool:    INPUT The handle of the  pool to delete
+ *
+ * Returns:
+ *    BCME_OK   Pool deleted ok.
+ *    other     Pool not deleted due to indicated error.
+ *
+ */
+int bcm_mpm_delete_heap_pool(bcm_mpm_mgr_h mgr, bcm_mp_pool_h *poolp);
+
+/*
+ * bcm_mpm_stats() - Return stats for all pools
+ *
+ * Parameters:
+ *    mgr:         INPUT   The handle to the pools manager
+ *    stats:       OUTPUT  Array of pool statistics.
+ *    nentries:    MOD     Max elements in 'stats' array on INPUT. Actual number
+ *                         of array elements copied to 'stats' on OUTPUT.
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error getting stats.
+ *
+ */
+int bcm_mpm_stats(bcm_mpm_mgr_h mgr, bcm_mp_stats_t *stats, int *nentries);
+
+/*
+ * bcm_mpm_dump() - Display statistics on all pools
+ *
+ * Parameters:
+ *    mgr:     INPUT  The handle to the pools manager
+ *    b:       OUTPUT Output buffer.
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error during dump.
+ *
+ */
+int bcm_mpm_dump(bcm_mpm_mgr_h mgr, struct bcmstrbuf *b);
+
+/*
+ * bcm_mpm_get_obj_size() - The size of memory objects may need to be padded to
+ *                          compensate for alignment requirements of the objects.
+ *                          This function provides the padded object size. If clients
+ *                          pre-allocate a memory slab for a memory pool, the
+ *                          padded object size should be used by the client to allocate
+ *                          the memory slab (in order to provide sufficent space for
+ *                          the maximum number of objects).
+ *
+ * Parameters:
+ *    mgr:            INPUT   The handle to the pools manager.
+ *    obj_sz:         INPUT   Input object size.
+ *    padded_obj_sz:  OUTPUT  Padded object size.
+ *
+ * Returns:
+ *    BCME_OK      Ok
+ *    BCME_BADARG  Bad arguments.
+ *
+ */
+int bcm_mpm_get_obj_size(bcm_mpm_mgr_h mgr, unsigned int obj_sz, unsigned int *padded_obj_sz);
+
+/*
+***************************************************************************
+*
+* API Routines on a specific pool.
+*
+***************************************************************************
+*/
+
+/*
+ * bcm_mp_alloc() - Allocate a memory pool object.
+ *
+ * Parameters:
+ *    pool:    INPUT    The handle to the pool.
+ *
+ * Returns:
+ *    A pointer to the new object. NULL on error.
+ *
+ */
+void* bcm_mp_alloc(bcm_mp_pool_h pool);
+
+/*
+ * bcm_mp_free() - Free a memory pool object.
+ *
+ * Parameters:
+ *    pool:  INPUT   The handle to the pool.
+ *    objp:  INPUT   A pointer to the object to free.
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error during free.
+ *
+ */
+int bcm_mp_free(bcm_mp_pool_h pool, void *objp);
+
+/*
+ * bcm_mp_stats() - Return stats for this pool
+ *
+ * Parameters:
+ *    pool:     INPUT    The handle to the pool
+ *    stats:    OUTPUT   Pool statistics
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error getting statistics.
+ *
+ */
+void bcm_mp_stats(bcm_mp_pool_h pool, bcm_mp_stats_t *stats);
+
+/*
+ * bcm_mp_dump() - Dump a pool
+ *
+ * Parameters:
+ *    pool:    INPUT    The handle to the pool
+ *    b        OUTPUT   Output buffer
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error during dump.
+ *
+ */
+int bcm_mp_dump(bcm_mp_pool_h pool, struct bcmstrbuf *b);
+
+#endif /* _BCM_MPOOL_PUB_H */
diff --git a/bcmdhd.101.10.240.x/include/bcm_ring.h b/bcmdhd.101.10.240.x/include/bcm_ring.h
new file mode 100644 (file)
index 0000000..0a45432
--- /dev/null
@@ -0,0 +1,585 @@
+/*
+ * bcm_ring.h : Ring context abstraction
+ * The ring context tracks the WRITE and READ indices where elements may be
+ * produced and consumed respectively. All elements in the ring need to be
+ * fixed size.
+ *
+ * NOTE: A ring of size N, may only hold N-1 elements.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+#ifndef __bcm_ring_included__
+#define __bcm_ring_included__
+/*
+ * API Notes:
+ *
+ * Ring manipulation API allows for:
+ *  Pending operations: Often before some work can be completed, it may be
+ *  desired that several resources are available, e.g. space for production in
+ *  a ring. Approaches such as, #1) reserve resources one by one and return them
+ *  if another required resource is not available, or #2) employ a two pass
+ *  algorithm of first testing whether all resources are available, have a
+ *  an impact on performance critical code. The approach taken here is more akin
+ *  to approach #2, where a test for resource availability essentially also
+ *  provides the index for production in an un-committed state.
+ *  The same approach is taken for the consumer side.
+ *
+ *  - Pending production: Fetch the next index where a ring element may be
+ *    produced. The caller may not commit the WRITE of the element.
+ *  - Pending consumption: Fetch the next index where a ring element may be
+ *    consumed. The caller may not commut the READ of the element.
+ *
+ *  Producer side API:
+ *  - bcm_ring_is_full  : Test whether ring is full
+ *  - bcm_ring_prod     : Fetch index where an element may be produced (commit)
+ *  - bcm_ring_prod_pend: Fetch index where an element may be produced (pending)
+ *  - bcm_ring_prod_done: Commit a previous pending produce fetch
+ *  - bcm_ring_prod_avail: Fetch total number free slots eligible for production
+ *
+ * Consumer side API:
+ *  - bcm_ring_is_empty : Test whether ring is empty
+ *  - bcm_ring_cons     : Fetch index where an element may be consumed (commit)
+ *  - bcm_ring_cons_pend: Fetch index where an element may be consumed (pending)
+ *  - bcm_ring_cons_done: Commit a previous pending consume fetch
+ *  - bcm_ring_cons_avail: Fetch total number elements eligible for consumption
+ *
+ *  - bcm_ring_sync_read: Sync read offset in peer ring, from local ring
+ *  - bcm_ring_sync_write: Sync write offset in peer ring, from local ring
+ *
+ * +----------------------------------------------------------------------------
+ *
+ * Design Notes:
+ * Following items are not tracked in a ring context (design decision)
+ *  - width of a ring element.
+ *  - depth of the ring.
+ *  - base of the buffer, where the elements are stored.
+ *  - count of number of free slots in the ring
+ *
+ * Implementation Notes:
+ *  - When BCM_RING_DEBUG is enabled, need explicit bcm_ring_init().
+ *  - BCM_RING_EMPTY and BCM_RING_FULL are (-1)
+ *
+ * +----------------------------------------------------------------------------
+ *
+ * Usage Notes:
+ * An application may incarnate a ring of some fixed sized elements, by defining
+ *  - a ring data buffer to store the ring elements.
+ *  - depth of the ring (max number of elements managed by ring context).
+ *    Preferrably, depth may be represented as a constant.
+ *  - width of a ring element: to be used in pointer arithmetic with the ring's
+ *    data buffer base and an index to fetch the ring element.
+ *
+ * Use bcm_workq_t to instantiate a pair of workq constructs, one for the
+ * producer and the other for the consumer, both pointing to the same circular
+ * buffer. The producer may operate on it's own local workq and flush the write
+ * index to the consumer. Likewise the consumer may use its local workq and
+ * flush the read index to the producer. This way we do not repeatedly access
+ * the peer's context. The two peers may reside on different CPU cores with a
+ * private L1 data cache.
+ * +----------------------------------------------------------------------------
+ *
+ * -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*-
+ * vim: set ts=4 noet sw=4 tw=80:
+ *
+ * +----------------------------------------------------------------------------
+ */
+
+#ifdef ____cacheline_aligned
+#define __ring_aligned                      ____cacheline_aligned
+#else
+#define __ring_aligned
+#endif
+
+/* Conditional compile for debug */
+/* #define BCM_RING_DEBUG */
+
+#define BCM_RING_EMPTY                      (-1)
+#define BCM_RING_FULL                       (-1)
+#define BCM_RING_NULL                       ((bcm_ring_t *)NULL)
+
+#if defined(BCM_RING_DEBUG)
+#define RING_ASSERT(exp)                    ASSERT(exp)
+#define BCM_RING_IS_VALID(ring)             (((ring) != BCM_RING_NULL) && \
+                                                ((ring)->self == (ring)))
+#else  /* ! BCM_RING_DEBUG */
+#define RING_ASSERT(exp)                    do {} while (0)
+#define BCM_RING_IS_VALID(ring)             ((ring) != BCM_RING_NULL)
+#endif /* ! BCM_RING_DEBUG */
+
+#define BCM_RING_SIZE_IS_VALID(ring_size)   ((ring_size) > 0)
+
+/*
+ * +----------------------------------------------------------------------------
+ * Ring Context
+ * +----------------------------------------------------------------------------
+ */
+typedef struct bcm_ring {     /* Ring context */
+#if defined(BCM_RING_DEBUG)
+       struct bcm_ring *self;    /* ptr to self for IS VALID test */
+#endif /* BCM_RING_DEBUG */
+       int write __ring_aligned; /* WRITE index in a circular ring */
+       int read  __ring_aligned; /* READ index in a circular ring */
+} bcm_ring_t;
+
+static INLINE void bcm_ring_init(bcm_ring_t *ring);
+static INLINE void bcm_ring_copy(bcm_ring_t *to, bcm_ring_t *from);
+static INLINE bool bcm_ring_is_empty(const bcm_ring_t *ring);
+
+static INLINE int  __bcm_ring_next_write(const bcm_ring_t *ring, const int ring_size);
+
+static INLINE bool __bcm_ring_full(const bcm_ring_t *ring, int next_write);
+static INLINE bool bcm_ring_is_full(bcm_ring_t *ring, const int ring_size);
+
+static INLINE void bcm_ring_prod_done(bcm_ring_t *ring, int write);
+static INLINE int  bcm_ring_prod_pend(const bcm_ring_t *ring, int *pend_write,
+                                      const int ring_size);
+static INLINE int  bcm_ring_prod(bcm_ring_t *ring, const int ring_size);
+
+static INLINE void bcm_ring_cons_done(bcm_ring_t *ring, int read);
+static INLINE int  bcm_ring_cons_pend(const bcm_ring_t *ring, int *pend_read,
+                                      const int ring_size);
+static INLINE int  bcm_ring_cons(bcm_ring_t *ring, const int ring_size);
+
+static INLINE void bcm_ring_sync_read(bcm_ring_t *peer, const bcm_ring_t *self);
+static INLINE void bcm_ring_sync_write(bcm_ring_t *peer, const bcm_ring_t *self);
+
+static INLINE int  bcm_ring_prod_avail(const bcm_ring_t *ring,
+                                       const int ring_size);
+static INLINE int  bcm_ring_cons_avail(const bcm_ring_t *ring,
+                                       const int ring_size);
+static INLINE void bcm_ring_cons_all(bcm_ring_t *ring);
+
+/**
+ * bcm_ring_init - initialize a ring context.
+ * @ring: pointer to a ring context
+ */
+static INLINE void
+bcm_ring_init(bcm_ring_t *ring)
+{
+       ASSERT(ring != (bcm_ring_t *)NULL);
+#if defined(BCM_RING_DEBUG)
+       ring->self = ring;
+#endif /* BCM_RING_DEBUG */
+       ring->write = 0;
+       ring->read = 0;
+}
+
+/**
+ * bcm_ring_copy - copy construct a ring
+ * @to: pointer to the new ring context
+ * @from: pointer to orig ring context
+ */
+static INLINE void
+bcm_ring_copy(bcm_ring_t *to, bcm_ring_t *from)
+{
+       bcm_ring_init(to);
+
+       to->write = from->write;
+       to->read  = from->read;
+}
+
+/**
+ * bcm_ring_is_empty - "Boolean" test whether ring is empty.
+ * @ring: pointer to a ring context
+ *
+ * PS. does not return BCM_RING_EMPTY value.
+ */
+static INLINE bool
+bcm_ring_is_empty(const bcm_ring_t *ring)
+{
+       RING_ASSERT(BCM_RING_IS_VALID(ring));
+       return (ring->read == ring->write);
+}
+
+/**
+ * __bcm_ring_next_write - determine the index where the next write may occur
+ *                         (with wrap-around).
+ * @ring: pointer to a ring context
+ * @ring_size: size of the ring
+ *
+ * PRIVATE INTERNAL USE ONLY.
+ */
+static INLINE int
+__bcm_ring_next_write(const bcm_ring_t *ring, const int ring_size)
+{
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+       return ((ring->write + 1) % ring_size);
+}
+
+/**
+ * __bcm_ring_full - support function for ring full test.
+ * @ring: pointer to a ring context
+ * @next_write: next location in ring where an element is to be produced
+ *
+ * PRIVATE INTERNAL USE ONLY.
+ */
+static INLINE bool
+__bcm_ring_full(const bcm_ring_t *ring, int next_write)
+{
+       return (next_write == ring->read);
+}
+
+/**
+ * bcm_ring_is_full - "Boolean" test whether a ring is full.
+ * @ring: pointer to a ring context
+ * @ring_size: size of the ring
+ *
+ * PS. does not return BCM_RING_FULL value.
+ */
+static INLINE bool
+bcm_ring_is_full(bcm_ring_t *ring, const int ring_size)
+{
+       int next_write;
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+       next_write = __bcm_ring_next_write(ring, ring_size);
+       return __bcm_ring_full(ring, next_write);
+}
+
+/**
+ * bcm_ring_prod_done - commit a previously pending index where production
+ * was requested.
+ * @ring: pointer to a ring context
+ * @write: index into ring upto where production was done.
+ * +----------------------------------------------------------------------------
+ */
+static INLINE void
+bcm_ring_prod_done(bcm_ring_t *ring, int write)
+{
+       RING_ASSERT(BCM_RING_IS_VALID(ring));
+       ring->write = write;
+}
+
+/**
+ * bcm_ring_prod_pend - Fetch in "pend" mode, the index where an element may be
+ * produced.
+ * @ring: pointer to a ring context
+ * @pend_write: next index, after the returned index
+ * @ring_size: size of the ring
+ */
+static INLINE int
+bcm_ring_prod_pend(const bcm_ring_t *ring, int *pend_write, const int ring_size)
+{
+       int rtn;
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+       *pend_write = __bcm_ring_next_write(ring, ring_size);
+       if (__bcm_ring_full(ring, *pend_write)) {
+               *pend_write = BCM_RING_FULL;
+               rtn = BCM_RING_FULL;
+       } else {
+               /* production is not committed, caller needs to explicitly commit */
+               rtn = ring->write;
+       }
+       return rtn;
+}
+
+/**
+ * bcm_ring_prod - Fetch and "commit" the next index where a ring element may
+ * be produced.
+ * @ring: pointer to a ring context
+ * @ring_size: size of the ring
+ */
+static INLINE int
+bcm_ring_prod(bcm_ring_t *ring, const int ring_size)
+{
+       int next_write, prod_write;
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+
+       next_write = __bcm_ring_next_write(ring, ring_size);
+       if (__bcm_ring_full(ring, next_write)) {
+               prod_write = BCM_RING_FULL;
+       } else {
+               prod_write = ring->write;
+               bcm_ring_prod_done(ring, next_write); /* "commit" production */
+       }
+       return prod_write;
+}
+
+/**
+ * bcm_ring_cons_done - commit a previously pending read
+ * @ring: pointer to a ring context
+ * @read: index upto which elements have been consumed.
+ */
+static INLINE void
+bcm_ring_cons_done(bcm_ring_t *ring, int read)
+{
+       RING_ASSERT(BCM_RING_IS_VALID(ring));
+       ring->read = read;
+}
+
+/**
+ * bcm_ring_cons_pend - fetch in "pend" mode, the next index where a ring
+ * element may be consumed.
+ * @ring: pointer to a ring context
+ * @pend_read: index into ring upto which elements may be consumed.
+ * @ring_size: size of the ring
+ */
+static INLINE int
+bcm_ring_cons_pend(const bcm_ring_t *ring, int *pend_read, const int ring_size)
+{
+       int rtn;
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+       if (bcm_ring_is_empty(ring)) {
+               *pend_read = BCM_RING_EMPTY;
+               rtn = BCM_RING_EMPTY;
+       } else {
+               *pend_read = (ring->read + 1) % ring_size;
+               /* production is not committed, caller needs to explicitly commit */
+               rtn = ring->read;
+       }
+       return rtn;
+}
+
+/**
+ * bcm_ring_cons - fetch and "commit" the next index where a ring element may
+ * be consumed.
+ * @ring: pointer to a ring context
+ * @ring_size: size of the ring
+ */
+static INLINE int
+bcm_ring_cons(bcm_ring_t *ring, const int ring_size)
+{
+       int cons_read;
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+       if (bcm_ring_is_empty(ring)) {
+               cons_read = BCM_RING_EMPTY;
+       } else {
+               cons_read = ring->read;
+               ring->read = (ring->read + 1) % ring_size; /* read is committed */
+       }
+       return cons_read;
+}
+
+/**
+ * bcm_ring_sync_read - on consumption, update peer's read index.
+ * @peer: pointer to peer's producer ring context
+ * @self: pointer to consumer's ring context
+ */
+static INLINE void
+bcm_ring_sync_read(bcm_ring_t *peer, const bcm_ring_t *self)
+{
+       RING_ASSERT(BCM_RING_IS_VALID(peer));
+       RING_ASSERT(BCM_RING_IS_VALID(self));
+       peer->read = self->read; /* flush read update to peer producer */
+}
+
+/**
+ * bcm_ring_sync_write - on consumption, update peer's write index.
+ * @peer: pointer to peer's consumer ring context
+ * @self: pointer to producer's ring context
+ */
+static INLINE void
+bcm_ring_sync_write(bcm_ring_t *peer, const bcm_ring_t *self)
+{
+       RING_ASSERT(BCM_RING_IS_VALID(peer));
+       RING_ASSERT(BCM_RING_IS_VALID(self));
+       peer->write = self->write; /* flush write update to peer consumer */
+}
+
+/**
+ * bcm_ring_prod_avail - fetch total number of available empty slots in the
+ * ring for production.
+ * @ring: pointer to a ring context
+ * @ring_size: size of the ring
+ */
+static INLINE int
+bcm_ring_prod_avail(const bcm_ring_t *ring, const int ring_size)
+{
+       int prod_avail;
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+       if (ring->write >= ring->read) {
+               prod_avail = (ring_size - (ring->write - ring->read) - 1);
+       } else {
+               prod_avail = (ring->read - (ring->write + 1));
+       }
+       ASSERT(prod_avail < ring_size);
+       return prod_avail;
+}
+
+/**
+ * bcm_ring_cons_avail - fetch total number of available elements for consumption.
+ * @ring: pointer to a ring context
+ * @ring_size: size of the ring
+ */
+static INLINE int
+bcm_ring_cons_avail(const bcm_ring_t *ring, const int ring_size)
+{
+       int cons_avail;
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+       if (ring->read == ring->write) {
+               cons_avail = 0;
+       } else if (ring->read > ring->write) {
+               cons_avail = ((ring_size - ring->read) + ring->write);
+       } else {
+               cons_avail = ring->write - ring->read;
+       }
+       ASSERT(cons_avail < ring_size);
+       return cons_avail;
+}
+
+/**
+ * bcm_ring_cons_all - set ring in state where all elements are consumed.
+ * @ring: pointer to a ring context
+ */
+static INLINE void
+bcm_ring_cons_all(bcm_ring_t *ring)
+{
+       ring->read = ring->write;
+}
+
+/**
+ * Work Queue
+ * A work Queue is composed of a ring of work items, of a specified depth.
+ * It HAS-A bcm_ring object, comprising of a RD and WR offset, to implement a
+ * producer/consumer circular ring.
+ */
+
+struct bcm_workq {
+       bcm_ring_t ring;        /* Ring context abstraction */
+       struct bcm_workq *peer; /* Peer workq context */
+       void       *buffer;     /* Buffer storage for work items in workQ */
+       int        ring_size;   /* Depth of workQ */
+} __ring_aligned;
+
+typedef struct bcm_workq bcm_workq_t;
+
+/* #define BCM_WORKQ_DEBUG */
+#if defined(BCM_WORKQ_DEBUG)
+#define WORKQ_ASSERT(exp)               ASSERT(exp)
+#else  /* ! BCM_WORKQ_DEBUG */
+#define WORKQ_ASSERT(exp)               do {} while (0)
+#endif /* ! BCM_WORKQ_DEBUG */
+
+#define WORKQ_AUDIT(workq) \
+       WORKQ_ASSERT((workq) != BCM_WORKQ_NULL); \
+       WORKQ_ASSERT(WORKQ_PEER(workq) != BCM_WORKQ_NULL); \
+       WORKQ_ASSERT((workq)->buffer == WORKQ_PEER(workq)->buffer); \
+       WORKQ_ASSERT((workq)->ring_size == WORKQ_PEER(workq)->ring_size);
+
+#define BCM_WORKQ_NULL                  ((bcm_workq_t *)NULL)
+
+#define WORKQ_PEER(workq)               ((workq)->peer)
+#define WORKQ_RING(workq)               (&((workq)->ring))
+#define WORKQ_PEER_RING(workq)          (&((workq)->peer->ring))
+
+#define WORKQ_ELEMENT(__elem_type, __workq, __index) ({ \
+       WORKQ_ASSERT((__workq) != BCM_WORKQ_NULL); \
+       WORKQ_ASSERT((__index) < ((__workq)->ring_size)); \
+       ((__elem_type *)((__workq)->buffer)) + (__index); \
+})
+
+static INLINE void bcm_workq_init(bcm_workq_t *workq, bcm_workq_t *workq_peer,
+                                  void *buffer, int ring_size);
+
+static INLINE bool bcm_workq_is_empty(const bcm_workq_t *workq_prod);
+
+static INLINE void bcm_workq_prod_sync(bcm_workq_t *workq_prod);
+static INLINE void bcm_workq_cons_sync(bcm_workq_t *workq_cons);
+
+static INLINE void bcm_workq_prod_refresh(bcm_workq_t *workq_prod);
+static INLINE void bcm_workq_cons_refresh(bcm_workq_t *workq_cons);
+
+/**
+ * bcm_workq_init - initialize a workq
+ * @workq: pointer to a workq context
+ * @buffer: pointer to a pre-allocated circular buffer to serve as a ring
+ * @ring_size: size of the ring in terms of max number of elements.
+ */
+static INLINE void
+bcm_workq_init(bcm_workq_t *workq, bcm_workq_t *workq_peer,
+               void *buffer, int ring_size)
+{
+       ASSERT(workq != BCM_WORKQ_NULL);
+       ASSERT(workq_peer != BCM_WORKQ_NULL);
+       ASSERT(buffer != NULL);
+       ASSERT(ring_size > 0);
+
+       WORKQ_PEER(workq) = workq_peer;
+       WORKQ_PEER(workq_peer) = workq;
+
+       bcm_ring_init(WORKQ_RING(workq));
+       bcm_ring_init(WORKQ_RING(workq_peer));
+
+       workq->buffer = workq_peer->buffer = buffer;
+       workq->ring_size = workq_peer->ring_size = ring_size;
+}
+
+/**
+ * bcm_workq_empty - test whether there is work
+ * @workq_prod: producer's workq
+ */
+static INLINE bool
+bcm_workq_is_empty(const bcm_workq_t *workq_prod)
+{
+       return bcm_ring_is_empty(WORKQ_RING(workq_prod));
+}
+
+/**
+ * bcm_workq_prod_sync - Commit the producer write index to peer workq's ring
+ * @workq_prod: producer's workq whose write index must be synced to peer
+ */
+static INLINE void
+bcm_workq_prod_sync(bcm_workq_t *workq_prod)
+{
+       WORKQ_AUDIT(workq_prod);
+
+       /* cons::write <--- prod::write */
+       bcm_ring_sync_write(WORKQ_PEER_RING(workq_prod), WORKQ_RING(workq_prod));
+}
+
+/**
+ * bcm_workq_cons_sync - Commit the consumer read index to the peer workq's ring
+ * @workq_cons: consumer's workq whose read index must be synced to peer
+ */
+static INLINE void
+bcm_workq_cons_sync(bcm_workq_t *workq_cons)
+{
+       WORKQ_AUDIT(workq_cons);
+
+       /* prod::read <--- cons::read */
+       bcm_ring_sync_read(WORKQ_PEER_RING(workq_cons), WORKQ_RING(workq_cons));
+}
+
+/**
+ * bcm_workq_prod_refresh - Fetch the updated consumer's read index
+ * @workq_prod: producer's workq whose read index must be refreshed from peer
+ */
+static INLINE void
+bcm_workq_prod_refresh(bcm_workq_t *workq_prod)
+{
+       WORKQ_AUDIT(workq_prod);
+
+       /* prod::read <--- cons::read */
+       bcm_ring_sync_read(WORKQ_RING(workq_prod), WORKQ_PEER_RING(workq_prod));
+}
+
+/**
+ * bcm_workq_cons_refresh - Fetch the updated producer's write index
+ * @workq_cons: consumer's workq whose write index must be refreshed from peer
+ */
+static INLINE void
+bcm_workq_cons_refresh(bcm_workq_t *workq_cons)
+{
+       WORKQ_AUDIT(workq_cons);
+
+       /* cons::write <--- prod::write */
+       bcm_ring_sync_write(WORKQ_RING(workq_cons), WORKQ_PEER_RING(workq_cons));
+}
+
+#endif /* ! __bcm_ring_h_included__ */
diff --git a/bcmdhd.101.10.240.x/include/bcmarp.h b/bcmdhd.101.10.240.x/include/bcmarp.h
new file mode 100644 (file)
index 0000000..2e6d92d
--- /dev/null
@@ -0,0 +1,84 @@
+/*
+ * Fundamental constants relating to ARP Protocol
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _bcmarp_h_
+#define _bcmarp_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+#include <bcmip.h>
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#define ARP_OPC_OFFSET         6               /* option code offset */
+#define ARP_SRC_ETH_OFFSET     8               /* src h/w address offset */
+#define ARP_SRC_IP_OFFSET      14              /* src IP address offset */
+#define ARP_TGT_ETH_OFFSET     18              /* target h/w address offset */
+#define ARP_TGT_IP_OFFSET      24              /* target IP address offset */
+
+#define ARP_OPC_REQUEST                1               /* ARP request */
+#define ARP_OPC_REPLY          2               /* ARP reply */
+
+#define ARP_DATA_LEN           28              /* ARP data length */
+
+#define HTYPE_ETHERNET         1               /* htype for ethernet */
+BWL_PRE_PACKED_STRUCT struct bcmarp {
+       uint16  htype;                          /* Header type (1 = ethernet) */
+       uint16  ptype;                          /* Protocol type (0x800 = IP) */
+       uint8   hlen;                           /* Hardware address length (Eth = 6) */
+       uint8   plen;                           /* Protocol address length (IP = 4) */
+       uint16  oper;                           /* ARP_OPC_... */
+       uint8   src_eth[ETHER_ADDR_LEN];        /* Source hardware address */
+       uint8   src_ip[IPV4_ADDR_LEN];          /* Source protocol address (not aligned) */
+       uint8   dst_eth[ETHER_ADDR_LEN];        /* Destination hardware address */
+       uint8   dst_ip[IPV4_ADDR_LEN];          /* Destination protocol address */
+} BWL_POST_PACKED_STRUCT;
+
+/* Ethernet header + Arp message */
+BWL_PRE_PACKED_STRUCT struct bcmetharp {
+       struct ether_header     eh;
+       struct bcmarp   arp;
+} BWL_POST_PACKED_STRUCT;
+
+/* IPv6 Neighbor Advertisement */
+#define NEIGHBOR_ADVERTISE_SRC_IPV6_OFFSET     8               /* src IPv6 address offset */
+#define NEIGHBOR_ADVERTISE_TYPE_OFFSET         40              /* type offset */
+#define NEIGHBOR_ADVERTISE_CHECKSUM_OFFSET     42              /* check sum offset */
+#define NEIGHBOR_ADVERTISE_FLAGS_OFFSET                44              /* R,S and O flags offset */
+#define NEIGHBOR_ADVERTISE_TGT_IPV6_OFFSET     48              /* target IPv6 address offset */
+#define NEIGHBOR_ADVERTISE_OPTION_OFFSET       64              /* options offset */
+#define NEIGHBOR_ADVERTISE_TYPE                136
+#define NEIGHBOR_SOLICITATION_TYPE     135
+
+#define OPT_TYPE_SRC_LINK_ADDR         1
+#define OPT_TYPE_TGT_LINK_ADDR         2
+
+#define NEIGHBOR_ADVERTISE_DATA_LEN    72      /* neighbor advertisement data length */
+#define NEIGHBOR_ADVERTISE_FLAGS_VALUE 0x60    /* R=0, S=1 and O=1 */
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* !defined(_bcmarp_h_) */
diff --git a/bcmdhd.101.10.240.x/include/bcmbloom.h b/bcmdhd.101.10.240.x/include/bcmbloom.h
new file mode 100644 (file)
index 0000000..dabfb26
--- /dev/null
@@ -0,0 +1,73 @@
+/*
+ * Bloom filter support
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _bcmbloom_h_
+#define _bcmbloom_h_
+
+#include <typedefs.h>
+#ifdef BCMDRIVER
+#include <osl.h>
+#else
+#include <stddef.h>  /* For size_t */
+#endif
+
+struct bcm_bloom_filter;
+typedef struct bcm_bloom_filter bcm_bloom_filter_t;
+
+typedef void* (*bcm_bloom_alloc_t)(void *ctx, uint size);
+typedef void (*bcm_bloom_free_t)(void *ctx, void *buf, uint size);
+typedef uint (*bcm_bloom_hash_t)(void* ctx, uint idx, const uint8 *tag, uint len);
+
+/* create/allocate a bloom filter. filter size can be 0 for validate only filters */
+int bcm_bloom_create(bcm_bloom_alloc_t alloc_cb,
+       bcm_bloom_free_t free_cb, void *callback_ctx, uint max_hash,
+       uint filter_size /* bytes */, bcm_bloom_filter_t **bloom);
+
+/* destroy bloom filter */
+int bcm_bloom_destroy(bcm_bloom_filter_t **bloom, bcm_bloom_free_t free_cb);
+
+/* add a hash function to filter, return an index */
+int bcm_bloom_add_hash(bcm_bloom_filter_t *filter, bcm_bloom_hash_t hash, uint *idx);
+
+/* remove the hash function at index from filter */
+int bcm_bloom_remove_hash(bcm_bloom_filter_t *filter, uint idx);
+
+/* check if given tag is member of the filter. If buf is NULL and/or buf_len is 0
+ * then use the internal state. BCME_OK if member, BCME_NOTFOUND if not,
+ * or other error (e.g. BADARG)
+ */
+bool bcm_bloom_is_member(bcm_bloom_filter_t *filter,
+       const uint8 *tag, uint tag_len, const uint8 *buf, uint buf_len);
+
+/* add a member to the filter. invalid for validate_only filters */
+int bcm_bloom_add_member(bcm_bloom_filter_t *filter, const uint8 *tag, uint tag_len);
+
+/* no support for remove member */
+
+/* get the filter data from state. BCME_BUFTOOSHORT w/ required length in buf_len
+ * if supplied size is insufficient
+ */
+int bcm_bloom_get_filter_data(bcm_bloom_filter_t *filter,
+       uint buf_size, uint8 *buf, uint *buf_len);
+
+#endif /* _bcmbloom_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmcdc.h b/bcmdhd.101.10.240.x/include/bcmcdc.h
new file mode 100644 (file)
index 0000000..cc03c7a
--- /dev/null
@@ -0,0 +1,115 @@
+/*
+ * CDC network driver ioctl/indication encoding
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+#ifndef _bcmcdc_h_
+#define        _bcmcdc_h_
+#include <ethernet.h>
+
+typedef struct cdc_ioctl {
+       uint32 cmd;      /* ioctl command value */
+       uint32 len;      /* lower 16: output buflen; upper 16: input buflen (excludes header) */
+       uint32 flags;    /* flag defns given below */
+       uint32 status;   /* status code returned from the device */
+} cdc_ioctl_t;
+
+/* Max valid buffer size that can be sent to the dongle */
+#define CDC_MAX_MSG_SIZE   ETHER_MAX_LEN
+
+/* len field is divided into input and output buffer lengths */
+#define CDCL_IOC_OUTLEN_MASK   0x0000FFFF  /* maximum or expected response length, */
+                                          /* excluding IOCTL header */
+#define CDCL_IOC_OUTLEN_SHIFT  0
+#define CDCL_IOC_INLEN_MASK    0xFFFF0000   /* input buffer length, excluding IOCTL header */
+#define CDCL_IOC_INLEN_SHIFT   16
+
+/* CDC flag definitions */
+#define CDCF_IOC_ERROR         0x01    /* 0=success, 1=ioctl cmd failed */
+#define CDCF_IOC_SET           0x02    /* 0=get, 1=set cmd */
+#define CDCF_IOC_OVL_IDX_MASK  0x3c    /* overlay region index mask */
+#define CDCF_IOC_OVL_RSV       0x40    /* 1=reserve this overlay region */
+#define CDCF_IOC_OVL           0x80    /* 1=this ioctl corresponds to an overlay */
+#define CDCF_IOC_ACTION_MASK   0xfe    /* SET/GET, OVL_IDX, OVL_RSV, OVL mask */
+#define CDCF_IOC_ACTION_SHIFT  1       /* SET/GET, OVL_IDX, OVL_RSV, OVL shift */
+#define CDCF_IOC_IF_MASK       0xF000  /* I/F index */
+#define CDCF_IOC_IF_SHIFT      12
+#define CDCF_IOC_ID_MASK       0xFFFF0000      /* used to uniquely id an ioctl req/resp pairing */
+#define CDCF_IOC_ID_SHIFT      16              /* # of bits of shift for ID Mask */
+
+#define CDC_IOC_IF_IDX(flags)  (((flags) & CDCF_IOC_IF_MASK) >> CDCF_IOC_IF_SHIFT)
+#define CDC_IOC_ID(flags)      (((flags) & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT)
+
+#define CDC_GET_IF_IDX(hdr) \
+       ((int)((((hdr)->flags) & CDCF_IOC_IF_MASK) >> CDCF_IOC_IF_SHIFT))
+#define CDC_SET_IF_IDX(hdr, idx) \
+       ((hdr)->flags = (((hdr)->flags & ~CDCF_IOC_IF_MASK) | ((idx) << CDCF_IOC_IF_SHIFT)))
+
+/*
+ * BDC header
+ *
+ *   The BDC header is used on data packets to convey priority across USB.
+ */
+
+struct bdc_header {
+       uint8   flags;                  /* Flags */
+       uint8   priority;               /* 802.1d Priority 0:2 bits, 4:7 USB flow control info */
+       uint8   flags2;
+       uint8   dataOffset;             /* Offset from end of BDC header to packet data, in
+                                        * 4-byte words.  Leaves room for optional headers.
+                                        */
+};
+
+#define        BDC_HEADER_LEN          4
+
+/* flags field bitmap */
+#define BDC_FLAG_EXEMPT                0x03    /* EXT_STA: encryption exemption (host -> dongle?) */
+#define BDC_FLAG_80211_PKT     0x01    /* Packet is in 802.11 format (dongle -> host) */
+#define BDC_FLAG_SUM_GOOD      0x04    /* Dongle has verified good RX checksums */
+#define BDC_FLAG_SUM_NEEDED    0x08    /* Dongle needs to do TX checksums: host->device */
+#define BDC_FLAG_EVENT_MSG     0x08    /* Payload contains an event msg: device->host */
+#define BDC_FLAG_VER_MASK      0xf0    /* Protocol version mask */
+#define BDC_FLAG_VER_SHIFT     4       /* Protocol version shift */
+
+/* priority field bitmap */
+#define BDC_PRIORITY_MASK      0x07
+#define BDC_PRIORITY_FC_MASK   0xf0    /* flow control info mask */
+#define BDC_PRIORITY_FC_SHIFT  4       /* flow control info shift */
+
+/* flags2 field bitmap */
+#define BDC_FLAG2_IF_MASK      0x0f    /* interface index (host <-> dongle) */
+#define BDC_FLAG2_IF_SHIFT     0
+#define BDC_FLAG2_FC_FLAG      0x10    /* flag to indicate if pkt contains */
+                                       /* FLOW CONTROL info only */
+
+/* version numbers */
+#define BDC_PROTO_VER_1                1       /* Old Protocol version */
+#define BDC_PROTO_VER          2       /* Protocol version */
+
+/* flags2.if field access macros */
+#define BDC_GET_IF_IDX(hdr) \
+       ((int)((((hdr)->flags2) & BDC_FLAG2_IF_MASK) >> BDC_FLAG2_IF_SHIFT))
+#define BDC_SET_IF_IDX(hdr, idx) \
+       ((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_IF_MASK) | ((idx) << BDC_FLAG2_IF_SHIFT)))
+
+#endif /* _bcmcdc_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmdefs.h b/bcmdhd.101.10.240.x/include/bcmdefs.h
new file mode 100644 (file)
index 0000000..f09f1ae
--- /dev/null
@@ -0,0 +1,716 @@
+/*
+ * Misc system wide definitions
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _bcmdefs_h_
+#define        _bcmdefs_h_
+
+/*
+ * One doesn't need to include this file explicitly, gets included automatically if
+ * typedefs.h is included.
+ */
+
+/* Use BCM_REFERENCE to suppress warnings about intentionally-unused function
+ * arguments or local variables.
+ */
+#define BCM_REFERENCE(data)    ((void)(data))
+
+/* Allow for suppressing unused variable warnings. */
+#ifdef __GNUC__
+#define UNUSED_VAR     __attribute__ ((unused))
+#else
+#define UNUSED_VAR
+#endif
+
+/* GNU GCC 4.6+ supports selectively turning off a warning.
+ * Define these diagnostic macros to help suppress cast-qual warning
+ * until all the work can be done to fix the casting issues.
+ */
+#if (defined(__GNUC__) && defined(STRICT_GCC_WARNINGS) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6)) || defined(__clang__))
+#define GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST()              \
+       _Pragma("GCC diagnostic push")                   \
+       _Pragma("GCC diagnostic ignored \"-Wcast-qual\"")
+#define GCC_DIAGNOSTIC_PUSH_SUPPRESS_NULL_DEREF()       \
+       _Pragma("GCC diagnostic push")                   \
+       _Pragma("GCC diagnostic ignored \"-Wnull-dereference\"")
+#define GCC_DIAGNOSTIC_POP()                             \
+       _Pragma("GCC diagnostic pop")
+#else
+#define GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST()
+#define GCC_DIAGNOSTIC_PUSH_SUPPRESS_NULL_DEREF()
+#define GCC_DIAGNOSTIC_POP()
+#endif   /* Diagnostic macros not defined */
+
+/* Macros to allow Coverity modeling contructs in source code */
+#if defined(__COVERITY__)
+
+/* Coverity Doc:
+ * Indicates to the TAINTED_SCALAR checker and the INTEGER_OVERFLOW checker
+ * that a function taints its argument
+ */
+#define COV_TAINTED_DATA_ARG(arg)  __coverity_tainted_data_argument__(arg)
+
+/* Coverity Doc:
+ * Indicates to the TAINTED_SCALAR checker and the INTEGER_OVERFLOW checker
+ * that a function is a tainted data sink for an argument.
+ */
+#define COV_TAINTED_DATA_SINK(arg) __coverity_tainted_data_sink__(arg)
+
+/* Coverity Doc:
+ * Models a function that cannot take a negative number as an argument. Used in
+ * conjunction with other models to indicate that negative arguments are invalid.
+ */
+#define COV_NEG_SINK(arg)          __coverity_negative_sink__(arg)
+
+#else
+
+#define COV_TAINTED_DATA_ARG(arg)  do { } while (0)
+#define COV_TAINTED_DATA_SINK(arg) do { } while (0)
+#define COV_NEG_SINK(arg)          do { } while (0)
+
+#endif /* __COVERITY__ */
+
+/* Compile-time assert can be used in place of ASSERT if the expression evaluates
+ * to a constant at compile time.
+ */
+#define STATIC_ASSERT(expr) { \
+       /* Make sure the expression is constant. */ \
+       typedef enum { _STATIC_ASSERT_NOT_CONSTANT = (expr) } _static_assert_e UNUSED_VAR; \
+       /* Make sure the expression is true. */ \
+       typedef char STATIC_ASSERT_FAIL[(expr) ? 1 : -1] UNUSED_VAR; \
+}
+
+/* Reclaiming text and data :
+ * The following macros specify special linker sections that can be reclaimed
+ * after a system is considered 'up'.
+ * BCMATTACHFN is also used for detach functions (it's not worth having a BCMDETACHFN,
+ * as in most cases, the attach function calls the detach function to clean up on error).
+ */
+#if defined(BCM_RECLAIM)
+
+extern bool bcm_reclaimed;
+extern bool bcm_attach_part_reclaimed;
+extern bool bcm_preattach_part_reclaimed;
+extern bool bcm_postattach_part_reclaimed;
+
+#define RECLAIMED()                    (bcm_reclaimed)
+#define ATTACH_PART_RECLAIMED()                (bcm_attach_part_reclaimed)
+#define PREATTACH_PART_RECLAIMED()     (bcm_preattach_part_reclaimed)
+#define POSTATTACH_PART_RECLAIMED()    (bcm_postattach_part_reclaimed)
+
+/* Place _fn/_data symbols in various reclaimed output sections */
+#define _data  __attribute__ ((__section__ (".dataini2." #_data))) _data
+#define _fn    __attribute__ ((__section__ (".textini2." #_fn), noinline)) _fn
+#define BCMPREATTACHDATA(_data)        __attribute__ ((__section__ (".dataini3." #_data))) _data
+#define BCMPREATTACHFN(_fn)    __attribute__ ((__section__ (".textini3." #_fn), noinline)) _fn
+#define BCMPOSTATTACHDATA(_data)       __attribute__ ((__section__ (".dataini5." #_data))) _data
+#define BCMPOSTATTACHFN(_fn)   __attribute__ ((__section__ (".textini5." #_fn), noinline)) _fn
+
+/* Relocate attach symbols to save-restore region to increase pre-reclaim heap size. */
+#define BCM_SRM_ATTACH_DATA(_data)    __attribute__ ((__section__ (".datasrm." #_data))) _data
+#define BCM_SRM_ATTACH_FN(_fn)        __attribute__ ((__section__ (".textsrm." #_fn), noinline)) _fn
+
+/* Explicitly place data in .rodata section so it can be write-protected after attach */
+#define BCMRODATA(_data)       __attribute__ ((__section__ (".shrodata." #_data))) _data
+
+#ifdef BCMDBG_SR
+/*
+ * Don't reclaim so we can compare SR ASM
+ */
+#define BCMPREATTACHDATASR(_data)      _data
+#define BCMPREATTACHFNSR(_fn)          _fn
+#define BCMATTACHDATASR(_data)         _data
+#define BCMATTACHFNSR(_fn)             _fn
+#else
+#define BCMPREATTACHDATASR(_data)      BCMPREATTACHDATA(_data)
+#define BCMPREATTACHFNSR(_fn)          BCMPREATTACHFN(_fn)
+#define BCMATTACHDATASR(_data)         _data
+#define BCMATTACHFNSR(_fn)             _fn
+#endif
+
+#define _data  _data
+#define _fn            _fn
+#ifndef CONST
+#define CONST  const
+#endif
+
+/* Non-manufacture or internal attach function/dat */
+#define        BCMNMIATTACHFN(_fn)     _fn
+#define        BCMNMIATTACHDATA(_data) _data
+
+#if defined(BCM_CISDUMP_NO_RECLAIM)
+#define        BCMCISDUMPATTACHFN(_fn)         _fn
+#define        BCMCISDUMPATTACHDATA(_data)     _data
+#else
+#define        BCMCISDUMPATTACHFN(_fn)         BCMNMIATTACHFN(_fn)
+#define        BCMCISDUMPATTACHDATA(_data)     BCMNMIATTACHDATA(_data)
+#endif
+
+/* SROM with OTP support */
+#if defined(BCMOTPSROM)
+#define        BCMSROMATTACHFN(_fn)            _fn
+#define        BCMSROMATTACHDATA(_data)        _data
+#else
+#define        BCMSROMATTACHFN(_fn)            BCMNMIATTACHFN(_fn)
+#define        BCMSROMATTACHDATA(_data)        BCMNMIATTACHFN(_data)
+#endif /* BCMOTPSROM */
+
+#if defined(BCM_CISDUMP_NO_RECLAIM)
+#define        BCMSROMCISDUMPATTACHFN(_fn)     _fn
+#define        BCMSROMCISDUMPATTACHDATA(_data) _data
+#else
+#define        BCMSROMCISDUMPATTACHFN(_fn)     BCMSROMATTACHFN(_fn)
+#define        BCMSROMCISDUMPATTACHDATA(_data) BCMSROMATTACHDATA(_data)
+#endif /* BCM_CISDUMP_NO_RECLAIM */
+
+#define _fn    _fn
+
+#else /* BCM_RECLAIM */
+
+#define bcm_reclaimed                  (1)
+#define bcm_attach_part_reclaimed      (1)
+#define bcm_preattach_part_reclaimed   (1)
+#define bcm_postattach_part_reclaimed  (1)
+#define _data          _data
+#define _fn            _fn
+#define BCM_SRM_ATTACH_DATA(_data)     _data
+#define BCM_SRM_ATTACH_FN(_fn)         _fn
+/* BCMRODATA data is written into at attach time so it cannot be in .rodata */
+#define BCMRODATA(_data)       __attribute__ ((__section__ (".data." #_data))) _data
+#define BCMPREATTACHDATA(_data)                _data
+#define BCMPREATTACHFN(_fn)            _fn
+#define BCMPOSTATTACHDATA(_data)       _data
+#define BCMPOSTATTACHFN(_fn)           _fn
+#define _data          _data
+#define _fn                    _fn
+#define _fn            _fn
+#define        BCMNMIATTACHFN(_fn)             _fn
+#define        BCMNMIATTACHDATA(_data)         _data
+#define        BCMSROMATTACHFN(_fn)            _fn
+#define        BCMSROMATTACHDATA(_data)        _data
+#define BCMPREATTACHFNSR(_fn)          _fn
+#define BCMPREATTACHDATASR(_data)      _data
+#define BCMATTACHFNSR(_fn)             _fn
+#define BCMATTACHDATASR(_data)         _data
+#define        BCMSROMATTACHFN(_fn)            _fn
+#define        BCMSROMATTACHDATA(_data)        _data
+#define        BCMCISDUMPATTACHFN(_fn)         _fn
+#define        BCMCISDUMPATTACHDATA(_data)     _data
+#define        BCMSROMCISDUMPATTACHFN(_fn)     _fn
+#define        BCMSROMCISDUMPATTACHDATA(_data) _data
+#define CONST                          const
+
+#define RECLAIMED()                    (bcm_reclaimed)
+#define ATTACH_PART_RECLAIMED()                (bcm_attach_part_reclaimed)
+#define PREATTACH_PART_RECLAIMED()     (bcm_preattach_part_reclaimed)
+#define POSTATTACH_PART_RECLAIMED()    (bcm_postattach_part_reclaimed)
+
+#endif /* BCM_RECLAIM */
+
+#define BCMUCODEDATA(_data)            _data
+
+#if defined(BCM_AQM_DMA_DESC) && !defined(BCM_AQM_DMA_DESC_DISABLED)
+#define BCMUCODEFN(_fn)                        _fn
+#else
+#define BCMUCODEFN(_fn)                        _fn
+#endif /* BCM_AQM_DMA_DESC */
+
+/* This feature is for dongle builds only.
+ * In Rom build use BCMFASTPATH() to mark functions that will excluded from ROM bits if
+ * BCMFASTPATH_EXCLUDE_FROM_ROM flag is defined (defined by default).
+ * In romoffload or ram builds all functions that marked by BCMFASTPATH() will be placed
+ * in "text_fastpath" section and will be used by trap handler.
+ */
+#ifndef BCMFASTPATH
+       #define BCMFASTPATH(_fn)        _fn
+#endif /* BCMFASTPATH */
+
+/* Use the BCMRAMFN/BCMRAMDATA() macros to tag functions/data in source that must be included in RAM
+ * (excluded from ROM). This should eliminate the need to manually specify these functions/data in
+ * the ROM config file. It should only be used in special cases where the function must be in RAM
+ * for *all* ROM-based chips.
+ */
+       #define BCMRAMFN(_fn)           _fn
+       #define BCMRAMDATA(_data)       _data
+
+/* Use BCMSPECSYM() macro to tag symbols going to a special output section in the binary. */
+#define BCMSPECSYM(_sym)       __attribute__ ((__section__ (".special." #_sym))) _sym
+
+#define STATIC static
+
+/* functions that do not examine any values except their arguments, and have no effects except
+ * the return value should use this keyword. Note that a function that has pointer arguments
+ * and examines the data pointed to must not be declared as BCMCONSTFN.
+ */
+#ifdef __GNUC__
+#define BCMCONSTFN(_fn)        __attribute__ ((const)) _fn
+#else
+#define BCMCONSTFN(_fn)        _fn
+#endif /* __GNUC__ */
+
+/* Bus types */
+#define        SI_BUS                  0       /* SOC Interconnect */
+#define        PCI_BUS                 1       /* PCI target */
+#define        PCMCIA_BUS              2       /* PCMCIA target */
+#define SDIO_BUS               3       /* SDIO target */
+#define JTAG_BUS               4       /* JTAG */
+#define USB_BUS                        5       /* USB (does not support R/W REG) */
+#define SPI_BUS                        6       /* gSPI target */
+#define RPC_BUS                        7       /* RPC target */
+
+/* Allows size optimization for single-bus image */
+#ifdef BCMBUSTYPE
+#define BUSTYPE(bus)   (BCMBUSTYPE)
+#else
+#define BUSTYPE(bus)   (bus)
+#endif
+
+#ifdef BCMBUSCORETYPE
+#define BUSCORETYPE(ct)                (BCMBUSCORETYPE)
+#else
+#define BUSCORETYPE(ct)                (ct)
+#endif
+
+/* Allows size optimization for single-backplane image */
+#ifdef BCMCHIPTYPE
+#define CHIPTYPE(bus)  (BCMCHIPTYPE)
+#else
+#define CHIPTYPE(bus)  (bus)
+#endif
+
+/* Allows size optimization for SPROM support */
+#if defined(BCMSPROMBUS)
+#define SPROMBUS       (BCMSPROMBUS)
+#else
+#define SPROMBUS       (PCI_BUS)
+#endif
+
+/* Allows size optimization for single-chip image */
+/* These macros are NOT meant to encourage writing chip-specific code.
+ * Use them only when it is appropriate for example in PMU PLL/CHIP/SWREG
+ * controls and in chip-specific workarounds.
+ */
+#ifdef BCMCHIPID
+#define CHIPID(chip)   (BCMCHIPID)
+#else
+#define CHIPID(chip)   (chip)
+#endif
+
+#ifdef BCMCHIPREV
+#define CHIPREV(rev)   (BCMCHIPREV)
+#else
+#define CHIPREV(rev)   (rev)
+#endif
+
+#ifdef BCMPCIEREV
+#define PCIECOREREV(rev)       (BCMPCIEREV)
+#else
+#define PCIECOREREV(rev)       (rev)
+#endif
+
+#ifdef HWA
+#ifdef BCMHWAREV
+#define HWACOREREV(rev)                (BCMHWAREV)
+#else
+#define HWACOREREV(rev)                (rev)
+#endif /* BCMHWAREV */
+#else /* !HWA */
+#define HWA_ENAB(submodule)            (0)
+#define HWA_MANAGED_FIFO(fifo)         (0)
+#define HWA_NEXTPACKET(p)              (NULL)
+#define HWACOREREV(rev)                        (0)
+
+/* HWA sub-module enab checks */
+#define HWA_SUBMODULES_TXPOST_ENAB()           (0)
+#define HWA_SUBMODULES_RXPOSTFILL_ENAB()       (0)
+#define HWA_SUBMODULES_TXDMA_ENAB()            (0)
+#define HWA_SUBMODULES_TXS_ENAB()              (0)
+#define HWA_SUBMODULES_CPL_ENAB()              (0)
+#define HWA_SUBMODULES_RXS_ENAB()              (0)
+
+#endif /* HWA */
+
+#ifdef BCMPMUREV
+#define PMUREV(rev)    (BCMPMUREV)
+#else
+#define PMUREV(rev)    (rev)
+#endif
+
+#ifdef BCMCCREV
+#define CCREV(rev)     (BCMCCREV)
+#else
+#define CCREV(rev)     (rev)
+#endif
+
+#ifdef BCMGCIREV
+#define GCIREV(rev)    (BCMGCIREV)
+#else
+#define GCIREV(rev)    (rev)
+#endif
+
+#ifdef BCMCR4REV
+#define CR4REV(rev)    (BCMCR4REV)
+#define CR4REV_GE(rev, val)    ((BCMCR4REV) >= (val))
+#else
+#define CR4REV(rev)    (rev)
+#define CR4REV_GE(rev, val)    ((rev) >= (val))
+#endif
+
+#ifdef BCMLHLREV
+#define LHLREV(rev)    (BCMLHLREV)
+#else
+#define LHLREV(rev)    (rev)
+#endif
+
+#ifdef BCMSPMISREV
+#define SPMISREV(rev)  (BCMSPMISREV)
+#else
+#define        SPMISREV(rev)   (rev)
+#endif
+
+/* Defines for DMA Address Width - Shared between OSL and HNDDMA */
+#define DMADDR_MASK_32 0x0             /* Address mask for 32-bits */
+#define DMADDR_MASK_30 0xc0000000      /* Address mask for 30-bits */
+#define DMADDR_MASK_26 0xFC000000      /* Address maks for 26-bits */
+#define DMADDR_MASK_0  0xffffffff      /* Address mask for 0-bits (hi-part) */
+
+#define        DMADDRWIDTH_26  26 /* 26-bit addressing capability */
+#define        DMADDRWIDTH_30  30 /* 30-bit addressing capability */
+#define        DMADDRWIDTH_32  32 /* 32-bit addressing capability */
+#define        DMADDRWIDTH_63  63 /* 64-bit addressing capability */
+#define        DMADDRWIDTH_64  64 /* 64-bit addressing capability */
+
+typedef struct {
+       uint32 loaddr;
+       uint32 hiaddr;
+} dma64addr_t;
+
+#define PHYSADDR64HI(_pa) ((_pa).hiaddr)
+#define PHYSADDR64HISET(_pa, _val) \
+       do { \
+               (_pa).hiaddr = (_val);          \
+       } while (0)
+#define PHYSADDR64LO(_pa) ((_pa).loaddr)
+#define PHYSADDR64LOSET(_pa, _val) \
+       do { \
+               (_pa).loaddr = (_val);          \
+       } while (0)
+
+#ifdef BCMDMA64OSL
+typedef dma64addr_t dmaaddr_t;
+#define PHYSADDRHI(_pa) PHYSADDR64HI(_pa)
+#define PHYSADDRHISET(_pa, _val) PHYSADDR64HISET(_pa, _val)
+#define PHYSADDRLO(_pa)  PHYSADDR64LO(_pa)
+#define PHYSADDRLOSET(_pa, _val) PHYSADDR64LOSET(_pa, _val)
+#define PHYSADDRTOULONG(_pa, _ulong) \
+       do { \
+               _ulong = ((unsigned long long)(_pa).hiaddr << 32) | ((_pa).loaddr); \
+       } while (0)
+
+#else
+typedef uint32 dmaaddr_t;
+#define PHYSADDRHI(_pa) (0u)
+#define PHYSADDRHISET(_pa, _val)
+#define PHYSADDRLO(_pa) ((_pa))
+#define PHYSADDRLOSET(_pa, _val) \
+       do { \
+               (_pa) = (_val);                 \
+       } while (0)
+#endif /* BCMDMA64OSL */
+
+#define PHYSADDRISZERO(_pa) (PHYSADDRLO(_pa) == 0 && PHYSADDRHI(_pa) == 0)
+
+/* One physical DMA segment */
+typedef struct  {
+       dmaaddr_t addr;
+       uint32    length;
+} hnddma_seg_t;
+
+#if defined(__linux__)
+#define MAX_DMA_SEGS 8
+#else
+#define MAX_DMA_SEGS 4
+#endif
+
+typedef struct {
+       void *oshdmah; /* Opaque handle for OSL to store its information */
+       uint origsize; /* Size of the virtual packet */
+       uint nsegs;
+       hnddma_seg_t segs[MAX_DMA_SEGS];
+} hnddma_seg_map_t;
+
+/* packet headroom necessary to accommodate the largest header in the system, (i.e TXOFF).
+ * By doing, we avoid the need  to allocate an extra buffer for the header when bridging to WL.
+ * There is a compile time check in wlc.c which ensure that this value is at least as big
+ * as TXOFF. This value is used in dma_rxfill (hnddma.c).
+ */
+
+#ifndef BCMEXTRAHDROOM
+#define BCMEXTRAHDROOM 204
+#endif
+
+/* Packet alignment for most efficient SDIO (can change based on platform) */
+#ifndef SDALIGN
+#define SDALIGN        32
+#endif
+
+/* Headroom required for dongle-to-host communication.  Packets allocated
+ * locally in the dongle (e.g. for CDC ioctls or RNDIS messages) should
+ * leave this much room in front for low-level message headers which may
+ * be needed to get across the dongle bus to the host.  (These messages
+ * don't go over the network, so room for the full WL header above would
+ * be a waste.).
+*/
+/*
+ * set the numbers to be MAX of all the devices, to avoid problems with ROM builds
+ * USB BCMDONGLEHDRSZ and BCMDONGLEPADSZ is 0
+ * SDIO BCMDONGLEHDRSZ 12 and BCMDONGLEPADSZ 16
+*/
+#define BCMDONGLEHDRSZ 12
+#define BCMDONGLEPADSZ 16
+
+#define BCMDONGLEOVERHEAD      (BCMDONGLEHDRSZ + BCMDONGLEPADSZ)
+
+#if defined(NO_BCMDBG_ASSERT)
+       #undef BCMDBG_ASSERT
+       #undef BCMASSERT_LOG
+#endif
+
+#if defined(BCMASSERT_LOG)
+#define BCMASSERT_SUPPORT
+#endif
+
+/* Macros for doing definition and get/set of bitfields
+ * Usage example, e.g. a three-bit field (bits 4-6):
+ *    #define <NAME>_M BITFIELD_MASK(3)
+ *    #define <NAME>_S 4
+ * ...
+ *    regval = R_REG(osh, &regs->regfoo);
+ *    field = GFIELD(regval, <NAME>);
+ *    regval = SFIELD(regval, <NAME>, 1);
+ *    W_REG(osh, &regs->regfoo, regval);
+ */
+#define BITFIELD_MASK(width) \
+               (((unsigned)1 << (width)) - 1)
+#define GFIELD(val, field) \
+               (((val) >> field ## _S) & field ## _M)
+#define SFIELD(val, field, bits) \
+               (((val) & (~(field ## _M << field ## _S))) | \
+                ((unsigned)(bits) << field ## _S))
+
+/* define BCMSMALL to remove misc features for memory-constrained environments */
+#ifdef BCMSMALL
+#undef BCMSPACE
+#define bcmspace       FALSE   /* if (bcmspace) code is discarded */
+#else
+#define        BCMSPACE
+#define bcmspace       TRUE    /* if (bcmspace) code is retained */
+#endif
+
+/* ROM_ENAB_RUNTIME_CHECK may be set based upon the #define below (for ROM builds). It may also
+ * be defined via makefiles (e.g. ROM auto abandon unoptimized compiles).
+ */
+
+#ifdef BCM_SH_SFLASH
+       extern bool _bcm_sh_sflash;
+       #define BCM_SH_SFLASH_ENAB() (_bcm_sh_sflash)
+#else
+       #define BCM_SH_SFLASH_ENAB()   (0)
+#endif /* BCM_SH_SFLASH */
+
+#ifdef BCM_DELAY_ON_LTR
+       extern bool _bcm_delay_on_ltr;
+       #define BCM_DELAY_ON_LTR_ENAB() (_bcm_delay_on_ltr)
+#else
+       #define BCM_DELAY_ON_LTR_ENAB()         (0)
+#endif /* BCM_DELAY_ON_LTR */
+
+/* Max. nvram variable table size */
+#ifndef MAXSZ_NVRAM_VARS
+#ifdef LARGE_NVRAM_MAXSZ
+#define MAXSZ_NVRAM_VARS       (LARGE_NVRAM_MAXSZ * 2)
+#else
+#define LARGE_NVRAM_MAXSZ      8192
+#define MAXSZ_NVRAM_VARS       (LARGE_NVRAM_MAXSZ * 2)
+#endif /* LARGE_NVRAM_MAXSZ */
+#endif /* !MAXSZ_NVRAM_VARS */
+
+#ifdef BCMLFRAG /* BCMLFRAG support enab macros  */
+       extern bool _bcmlfrag;
+       #define BCMLFRAG_ENAB() (_bcmlfrag)
+#else
+       #define BCMLFRAG_ENAB()         (0)
+#endif /* BCMLFRAG_ENAB */
+
+#ifdef BCMPCIEDEV /* BCMPCIEDEV support enab macros */
+extern bool _pciedevenab;
+#if defined(ROM_ENAB_RUNTIME_CHECK)
+       #define BCMPCIEDEV_ENAB() (_pciedevenab)
+#elif defined(BCMPCIEDEV_ENABLED)
+       #define BCMPCIEDEV_ENAB()       1
+#else
+       #define BCMPCIEDEV_ENAB()       0
+#endif
+#else
+       #define BCMPCIEDEV_ENAB()       0
+#endif /* BCMPCIEDEV */
+
+#ifdef BCMRESVFRAGPOOL /* BCMRESVFRAGPOOL support enab macros */
+extern bool _resvfragpool_enab;
+       #define  BCMRESVFRAGPOOL_ENAB() (_resvfragpool_enab)
+#else
+       #define BCMRESVFRAGPOOL_ENAB()  0
+#endif /* BCMPCIEDEV */
+
+#ifdef BCMD11HDRPOOL /* BCMD11HDRPOOL support enab macros */
+extern bool _d11hdrpool_enab;
+       #define  D11HDRPOOL_ENAB()      (_d11hdrpool_enab)
+#else
+       #define D11HDRPOOL_ENAB()       0
+#endif /* BCMD11HDRPOOL */
+
+       #define BCMSDIODEV_ENAB()       0
+
+#ifdef BCMSPMIS
+extern bool _bcmspmi_enab;
+       #define BCMSPMIS_ENAB()         (_bcmspmi_enab)
+#else
+       #define BCMSPMIS_ENAB()         0
+#endif /* BCMSPMIS */
+
+/* Max size for reclaimable NVRAM array */
+#ifdef DL_NVRAM
+#define NVRAM_ARRAY_MAXSIZE    DL_NVRAM
+#else
+#define NVRAM_ARRAY_MAXSIZE    MAXSZ_NVRAM_VARS
+#endif /* DL_NVRAM */
+
+extern uint32 gFWID;
+
+#ifdef BCMFRWDPKT /* BCMFRWDPKT support enab macros  */
+       extern bool _bcmfrwdpkt;
+       #define BCMFRWDPKT_ENAB() (_bcmfrwdpkt)
+#else
+       #define BCMFRWDPKT_ENAB()               (0)
+#endif /* BCMFRWDPKT */
+
+#ifdef BCMFRWDPOOLREORG /* BCMFRWDPOOLREORG support enab macros  */
+       extern bool _bcmfrwdpoolreorg;
+       #define BCMFRWDPOOLREORG_ENAB() (_bcmfrwdpoolreorg)
+#else
+       #define BCMFRWDPOOLREORG_ENAB()         (0)
+#endif /* BCMFRWDPOOLREORG */
+
+#ifdef BCMPOOLRECLAIM /* BCMPOOLRECLAIM support enab macros  */
+       extern bool _bcmpoolreclaim;
+       #define BCMPOOLRECLAIM_ENAB() (_bcmpoolreclaim)
+#else
+       #define BCMPOOLRECLAIM_ENAB()           (0)
+#endif /* BCMPOOLRECLAIM */
+
+/* Chip related low power flags (lpflags) */
+
+#ifndef PAD
+#define _PADLINE(line)  pad ## line
+#define _XSTR(line)     _PADLINE(line)
+#define PAD             _XSTR(__LINE__)
+#endif
+
+#define MODULE_DETACH(var, detach_func)\
+       if (var) { \
+               detach_func(var); \
+               (var) = NULL; \
+       }
+#define MODULE_DETACH_2(var1, var2, detach_func) detach_func(var1, var2)
+#define MODULE_DETACH_TYPECASTED(var, detach_func) detach_func(var)
+
+/* When building ROML image use runtime conditional to cause the compiler
+ * to compile everything but not to complain "defined but not used"
+ * as #ifdef would cause at the callsites.
+ * In the end functions called under if (0) {} will not be linked
+ * into the final binary if they're not called from other places either.
+ */
+#define BCM_ATTACH_REF_DECL()
+#define BCM_ATTACH_REF()       (1)
+
+/* For ROM builds, keep it in const section so that it gets ROMmed. If abandoned, move it to
+ * RO section but before ro region start so that FATAL log buf doesn't use this.
+ */
+       #define BCMRODATA_ONTRAP(_data) _data
+
+typedef struct bcm_rng * bcm_rng_handle_t;
+
+/* Use BCM_FUNC_PTR() to tag function pointers for ASLR code implementation. It will perform
+ * run-time relocation of a function pointer by translating it from a physical to virtual address.
+ *
+ * BCM_FUNC_PTR() should only be used where the function name is referenced (corresponding to the
+ * relocation entry for that symbol). It should not be used when the function pointer is invoked.
+ */
+void* BCM_ASLR_CODE_FNPTR_RELOCATOR(void *func_ptr);
+#if defined(BCM_ASLR_CODE_FNPTR_RELOC)
+       /* 'func_ptr_err_chk' performs a compile time error check to ensure that only a constant
+        * function name is passed as an argument to BCM_FUNC_PTR(). This ensures that the macro is
+        * only used for function pointer references, and not for function pointer invocations.
+        */
+       #define BCM_FUNC_PTR(func) \
+               ({ static void *func_ptr_err_chk __attribute__ ((unused)) = (func); \
+               BCM_ASLR_CODE_FNPTR_RELOCATOR(func); })
+#else
+       #define BCM_FUNC_PTR(func)         (func)
+#endif /* BCM_ASLR_CODE_FNPTR_RELOC */
+
+/*
+ * Timestamps have this tag appended following a null byte which
+ * helps comparison/hashing scripts find and ignore them.
+ */
+#define TIMESTAMP_SUFFIX "<TIMESTAMP>"
+
+#ifdef STK_PRT_MMU
+/* MMU main thread stack data */
+#define BCM_MMU_MTH_STK_DATA(_data) __attribute__ ((__section__ (".mmu_mth_stack." #_data))) _data
+#endif /* STK_PRT_MMU */
+
+/* Special section for MMU page-tables. */
+#define BCM_MMU_PAGE_TABLE_DATA(_data) \
+       __attribute__ ((__section__ (".mmu_pagetable." #_data))) _data
+
+/* Some phy initialization code/data can't be reclaimed in dualband mode */
+#if defined(DBAND)
+#define WLBANDINITDATA(_data)  _data
+#define WLBANDINITFN(_fn)      _fn
+#else
+#define WLBANDINITDATA(_data)  _data
+#define WLBANDINITFN(_fn)      _fn
+#endif
+
+/* Tag struct members to make it explicitly clear that they are physical addresses. These are
+ * typically used in data structs shared by the firmware and host code (or off-line utilities). The
+ * use of the macro avoids customer visible API/name changes.
+ */
+#if defined(BCM_PHYS_ADDR_NAME_CONVERSION)
+       #define PHYS_ADDR_N(name) name ## _phys
+#else
+       #define PHYS_ADDR_N(name) name
+#endif
+
+#endif /* _bcmdefs_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmdevs.h b/bcmdhd.101.10.240.x/include/bcmdevs.h
new file mode 100644 (file)
index 0000000..517f801
--- /dev/null
@@ -0,0 +1,629 @@
+/*
+ * Broadcom device-specific manifest constants.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _BCMDEVS_H
+#define        _BCMDEVS_H
+
+/* PCI vendor IDs */
+#define        VENDOR_EPIGRAM          0xfeda
+#define        VENDOR_BROADCOM         0x14e4
+#define        VENDOR_3COM             0x10b7
+#define        VENDOR_NETGEAR          0x1385
+#define        VENDOR_DIAMOND          0x1092
+#define        VENDOR_INTEL            0x8086
+#define        VENDOR_DELL             0x1028
+#define        VENDOR_HP               0x103c
+#define        VENDOR_HP_COMPAQ        0x0e11
+#define        VENDOR_APPLE            0x106b
+#define VENDOR_SI_IMAGE                0x1095          /* Silicon Image, used by Arasan SDIO Host */
+#define VENDOR_BUFFALO         0x1154          /* Buffalo vendor id */
+#define VENDOR_TI              0x104c          /* Texas Instruments */
+#define VENDOR_RICOH           0x1180          /* Ricoh */
+#define VENDOR_JMICRON         0x197b
+
+/* PCMCIA vendor IDs */
+#define        VENDOR_BROADCOM_PCMCIA  0x02d0
+
+/* SDIO vendor IDs */
+#define        VENDOR_BROADCOM_SDIO    0x00BF
+
+/* DONGLE VID/PIDs */
+#define BCM_DNGL_VID           0x0a5c
+#define BCM_DNGL_BL_PID_4328   0xbd12
+#define BCM_DNGL_BL_PID_4332   0xbd18
+#define BCM_DNGL_BL_PID_4360   0xbd1d
+
+#define BCM_DNGL_BDC_PID       0x0bdc
+#define BCM_DNGL_JTAG_PID      0x4a44
+
+/* Pseudo IDs */
+#define FPGA_JTAGM_ID          0x43f0          /* FPGA jtagm device id */
+#define BCM_JTAGM_ID           0x43f1          /* BCM jtagm device id */
+#define SDIOH_FPGA_ID          0x43f2          /* sdio host fpga */
+#define BCM_SDIOH_ID           0x43f3          /* BCM sdio host id */
+#define SDIOD_FPGA_ID          0x43f4          /* sdio device fpga */
+#define SPIH_FPGA_ID           0x43f5          /* PCI SPI Host Controller FPGA */
+#define BCM_SPIH_ID            0x43f6          /* Synopsis SPI Host Controller */
+#define MIMO_FPGA_ID           0x43f8          /* FPGA mimo minimacphy device id */
+#define BCM_JTAGM2_ID          0x43f9          /* BCM alternate jtagm device id */
+#define SDHCI_FPGA_ID          0x43fa          /* Standard SDIO Host Controller FPGA */
+#define        BCM4710_DEVICE_ID       0x4710          /* 4710 primary function 0 */
+#define        BCM47XX_AUDIO_ID        0x4711          /* 47xx audio codec */
+#define        BCM47XX_V90_ID          0x4712          /* 47xx v90 codec */
+#define        BCM47XX_ENET_ID         0x4713          /* 47xx enet */
+#define        BCM47XX_EXT_ID          0x4714          /* 47xx external i/f */
+#define        BCM47XX_GMAC_ID         0x4715          /* 47xx Unimac based GbE */
+#define        BCM47XX_USBH_ID         0x4716          /* 47xx usb host */
+#define        BCM47XX_USBD_ID         0x4717          /* 47xx usb device */
+#define        BCM47XX_IPSEC_ID        0x4718          /* 47xx ipsec */
+#define        BCM47XX_ROBO_ID         0x4719          /* 47xx/53xx roboswitch core */
+#define        BCM47XX_USB20H_ID       0x471a          /* 47xx usb 2.0 host */
+#define        BCM47XX_USB20D_ID       0x471b          /* 47xx usb 2.0 device */
+#define        BCM47XX_ATA100_ID       0x471d          /* 47xx parallel ATA */
+#define        BCM47XX_SATAXOR_ID      0x471e          /* 47xx serial ATA & XOR DMA */
+#define        BCM47XX_GIGETH_ID       0x471f          /* 47xx GbE (5700) */
+#define        BCM47XX_USB30H_ID       0x472a          /* 47xx usb 3.0 host */
+#define        BCM47XX_USB30D_ID       0x472b          /* 47xx usb 3.0 device */
+#define        BCM47XX_USBHUB_ID       0x472c          /* 47xx usb hub */
+#define BCM47XX_SMBUS_EMU_ID   0x47fe          /* 47xx emulated SMBus device */
+#define        BCM47XX_XOR_EMU_ID      0x47ff          /* 47xx emulated XOR engine */
+#define JINVANI_SDIOH_ID       0x4743          /* Jinvani SDIO Gold Host */
+#define BCM27XX_SDIOH_ID       0x2702          /* BCM27xx Standard SDIO Host */
+#define PCIXX21_FLASHMEDIA_ID  0x803b          /* TI PCI xx21 Standard Host Controller */
+#define PCIXX21_SDIOH_ID       0x803c          /* TI PCI xx21 Standard Host Controller */
+#define R5C822_SDIOH_ID                0x0822          /* Ricoh Co Ltd R5C822 SD/SDIO/MMC/MS/MSPro Host */
+#define JMICRON_SDIOH_ID       0x2381          /* JMicron Standard SDIO Host Controller */
+
+/* PCI Device IDs */
+/* DEPRECATED but used */
+#define        BCM4318_D11G_ID         0x4318          /* 4318 802.11b/g id */
+/* DEPRECATED */
+
+#define BCM4360_D11AC_ID       0x43a0
+#define BCM4360_D11AC2G_ID     0x43a1
+#define BCM4360_D11AC5G_ID     0x43a2
+#define BCM4352_D11AC_ID       0x43b1          /* 4352 802.11ac dualband device */
+#define BCM4352_D11AC2G_ID     0x43b2          /* 4352 802.11ac 2.4G device */
+#define BCM4352_D11AC5G_ID     0x43b3          /* 4352 802.11ac 5G device */
+#define BCM43602_D11AC_ID      0x43ba          /* ac dualband PCI devid SPROM programmed */
+#define BCM43602_D11AC2G_ID    0x43bb          /* 43602 802.11ac 2.4G device */
+#define BCM43602_D11AC5G_ID    0x43bc          /* 43602 802.11ac 5G device */
+
+#define BCM43012_D11N_ID       0xA804          /* 43012 802.11n dualband device */
+#define BCM43012_D11N2G_ID     0xA805          /* 43012 802.11n 2.4G device */
+#define BCM43012_D11N5G_ID     0xA806          /* 43012 802.11n 5G device */
+#define BCM43014_D11N_ID       0x4495          /* 43014 802.11n dualband device */
+#define BCM43014_D11N2G_ID     0x4496          /* 43014 802.11n 2.4G device */
+#define BCM43014_D11N5G_ID     0x4497          /* 43014 802.11n 5G device */
+#define BCM43013_D11N_ID       0x4498          /* 43013 802.11n dualband device */
+#define BCM43013_D11N2G_ID     0x4499          /* 43013 802.11n 2.4G device */
+#define BCM43013_D11N5G_ID     0x449a          /* 43013 802.11n 5G device */
+
+/* PCI Subsystem ID */
+#define BCM4376_D11AX_ID       0x4445          /* 4376 802.11ax dualband device */
+#define BCM4376_D11AX2G_ID     0x4436          /* 4376 802.11ax 2.4G device */
+#define BCM4376_D11AX5G_ID     0x4437          /* 4376 802.11ax 5G device */
+
+#define BCM4378_D11AX_ID       0x4425          /* 4378 802.11ax dualband device */
+#define BCM4378_D11AX2G_ID     0x4426          /* 4378 802.11ax 2.4G device */
+#define BCM4378_D11AX5G_ID     0x4427          /* 4378 802.11ax 5G device */
+
+#define BCM4387_D11AX_ID       0x4433          /* 4387 802.11ax dualband device */
+#define BCM4388_D11AX_ID       0x4434          /* 4388 802.11ax dualband device */
+#define BCM4385_D11AX_ID       0x4442          /* 4385 802.11ax dualband device */
+#define BCM4389_D11AX_ID       0x4441          /* 4389 802.11ax dualband device */
+#define BCM4397_D11AX_ID       0x4443          /* 4397 802.11ax dualband device */
+
+#define BCM4362_D11AX_ID       0x4490          /* 4362 802.11ax dualband device */
+#define BCM4362_D11AX2G_ID     0x4491          /* 4362 802.11ax 2.4G device */
+#define BCM4362_D11AX5G_ID     0x4492          /* 4362 802.11ax 5G device */
+#define BCM43751_D11AX_ID      0x449a          /* 43751 802.11ac dualband device */
+#define BCM43751_D11AX2G_ID    0x449b          /* 43751 802.11ac 2.4G device */
+#define BCM43751_D11AX5G_ID    0x449c          /* 43751 802.11ac 5G device */
+#define BCM43752_D11AX_ID      0x449d          /* 43752 802.11ax dualband device */
+#define BCM43752_D11AX2G_ID    0x449e          /* 43752 802.11ax 2.4G device */
+#define BCM43752_D11AX5G_ID    0x449f          /* 43752 802.11ax 5G device */
+
+/* TBD change below values */
+#define BCM4369_D11AX_ID       0x4470          /* 4369 802.11ax dualband device */
+#define BCM4369_D11AX2G_ID     0x4471          /* 4369 802.11ax 2.4G device */
+#define BCM4369_D11AX5G_ID     0x4472          /* 4369 802.11ax 5G device */
+
+#define BCM4375_D11AX_ID       0x4475          /* 4375 802.11ax dualband device */
+#define BCM4375_D11AX2G_ID     0x4476          /* 4375 802.11ax 2.4G device */
+#define BCM4375_D11AX5G_ID     0x4477          /* 4375 802.11ax 5G device */
+
+#define BCM4377_D11AX_ID       0x4480          /* 4377 802.11ax dualband device */
+#define BCM4377_D11AX2G_ID     0x4481          /* 4377 802.11ax 2.4G device */
+#define BCM4377_D11AX5G_ID     0x4482          /* 4377 802.11ax 5G device */
+
+/* 4377 802.11ax dualband device with multifunction */
+#define BCM4377_M_D11AX_ID     0x4488
+
+#define BCM4368_D11AC_ID       0x442f
+#define BCM4368_D11AC2G_ID     0x4430
+#define BCM4368_D11AC5G_ID     0x4431
+#define BCM4368_D11ACBT_ID     0x5f30
+
+/* Chip IDs */
+
+#define BCM43143_CHIP_ID       43143           /* 43143 chipcommon chipid */
+#define        BCM43242_CHIP_ID        43242           /* 43242 chipcommon chipid */
+#define        BCM43460_CHIP_ID        43460           /* 4360  chipcommon chipid (OTP, RBBU) */
+#define BCM4360_CHIP_ID                0x4360          /* 4360 chipcommon chipid */
+#define BCM43362_CHIP_ID       43362           /* 43362 chipcommon chipid */
+#define BCM4330_CHIP_ID                0x4330          /* 4330 chipcommon chipid */
+#define        BCM4324_CHIP_ID         0x4324          /* 4324 chipcommon chipid */
+#define BCM4334_CHIP_ID                0x4334          /* 4334 chipcommon chipid */
+#define BCM4335_CHIP_ID                0x4335          /* 4335 chipcommon chipid */
+#define BCM4339_CHIP_ID                0x4339          /* 4339 chipcommon chipid */
+#define BCM4352_CHIP_ID                0x4352          /* 4352 chipcommon chipid */
+#define BCM43526_CHIP_ID       0xAA06
+#define BCM43340_CHIP_ID       43340           /* 43340 chipcommon chipid */
+#define BCM43341_CHIP_ID       43341           /* 43341 chipcommon chipid */
+#define BCM43562_CHIP_ID       0xAA2A          /* 43562 chipcommon chipid */
+#define        BCM43012_CHIP_ID        0xA804          /* 43012 chipcommon chipid */
+#define        BCM43013_CHIP_ID        0xA805          /* 43013 chipcommon chipid */
+#define        BCM43014_CHIP_ID        0xA806          /* 43014 chipcommon chipid */
+#define        BCM4369_CHIP_ID         0x4369          /* 4369 chipcommon chipid */
+#define BCM4375_CHIP_ID                0x4375          /* 4375 chipcommon chipid */
+#define BCM4376_CHIP_ID                0x4376          /* 4376 chipcommon chipid */
+#define BCM4354_CHIP_ID                0x4354          /* 4354 chipcommon chipid */
+#define BCM4356_CHIP_ID                0x4356          /* 4356 chipcommon chipid */
+#define BCM4371_CHIP_ID                0x4371          /* 4371 chipcommon chipid */
+#define BCM43569_CHIP_ID       0xAA31          /* 43569 chipcommon chipid */
+
+#define BCM4368_CHIP_ID                0x4368          /* 4368 chipcommon chipid */
+#define BCM4368_CHIP(chipid)   (CHIPID(chipid) == BCM4368_CHIP_ID)
+
+#define BCM4368_CHIP_GRPID             BCM4368_CHIP_ID
+
+#define BCM4345_CHIP_ID                0x4345          /* 4345 chipcommon chipid */
+#define BCM43454_CHIP_ID       43454           /* 43454 chipcommon chipid */
+#define BCM43430_CHIP_ID       43430           /* 43430 chipcommon chipid */
+#define BCM4359_CHIP_ID                0x4359          /* 4359 chipcommon chipid */
+#define BCM4362_CHIP_ID                0x4362          /* 4362 chipcommon chipid */
+#define BCM43751_CHIP_ID       0xAAE7          /* 43751 chipcommon chipid */
+#define BCM43752_CHIP_ID       0xAAE8          /* 43752 chipcommon chipid */
+#define BCM4369_CHIP_ID                0x4369          /* 4369 chipcommon chipid */
+#define BCM4377_CHIP_ID                0x4377          /* 4377 chipcommon chipid */
+#define BCM4378_CHIP_ID                0x4378          /* 4378 chipcommon chipid */
+#define BCM4385_CHIP_ID                0x4385          /* 4385 chipcommon chipid */
+#define BCM4387_CHIP_ID                0x4387          /* 4387 chipcommon chipid */
+#define BCM4388_CHIP_ID                0x4388          /* 4388 chipcommon chipid */
+#define BCM4389_CHIP_ID                0x4389          /* 4389 chipcommon chipid */
+#define BCM4397_CHIP_ID                0x4397          /* 4397 chipcommon chipid */
+
+#define BCM4362_CHIP(chipid)   (CHIPID(chipid) == BCM4362_CHIP_ID)
+#define BCM4362_CHIP_GRPID     BCM4362_CHIP_ID
+
+#define BCM4369_CHIP(chipid)   ((CHIPID(chipid) == BCM4369_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM4377_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM4375_CHIP_ID))
+#define BCM4369_CHIP_GRPID             BCM4369_CHIP_ID: \
+                                       case BCM4377_CHIP_ID: \
+                                       case BCM4375_CHIP_ID
+
+#define BCM4385_CHIP(chipid)   (CHIPID(chipid) == BCM4385_CHIP_ID)
+#define BCM4385_CHIP_GRPID     BCM4385_CHIP_ID
+
+#define BCM4378_CHIP(chipid)    (CHIPID(chipid) == BCM4378_CHIP_ID)
+#define BCM4378_CHIP_GRPID     BCM4378_CHIP_ID
+
+#define BCM4376_CHIP_GRPID     BCM4376_CHIP_ID
+#define BCM4376_CHIP(chipid)    (CHIPID(chipid) == BCM4376_CHIP_ID)
+
+#define BCM4387_CHIP(chipid)    (CHIPID(chipid) == BCM4387_CHIP_ID)
+#define BCM4387_CHIP_GRPID     BCM4387_CHIP_ID
+
+#define BCM4388_CHIP(chipid)   (CHIPID(chipid) == BCM4388_CHIP_ID)
+#define BCM4388_CHIP_GRPID     BCM4388_CHIP_ID
+
+#define BCM4389_CHIP(chipid)   (CHIPID(chipid) == BCM4389_CHIP_ID)
+#define BCM4389_CHIP_GRPID     BCM4389_CHIP_ID
+
+#define BCM4397_CHIP(chipid)   (CHIPID(chipid) == BCM4397_CHIP_ID)
+#define BCM4397_CHIP_GRPID     BCM4397_CHIP_ID
+
+#define BCM43602_CHIP_ID       0xaa52          /* 43602 chipcommon chipid */
+#define BCM43462_CHIP_ID       0xa9c6          /* 43462 chipcommon chipid */
+#define BCM43522_CHIP_ID       0xaa02          /* 43522 chipcommon chipid */
+#define BCM43602_CHIP(chipid)  ((CHIPID(chipid) == BCM43602_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43462_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43522_CHIP_ID)) /* 43602 variations */
+#define BCM43012_CHIP(chipid)  ((CHIPID(chipid) == BCM43012_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43013_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43014_CHIP_ID))
+#define CASE_BCM43602_CHIP             case BCM43602_CHIP_ID: /* fallthrough */ \
+                               case BCM43462_CHIP_ID: /* fallthrough */ \
+                               case BCM43522_CHIP_ID
+
+/* Package IDs */
+
+#define HDLSIM_PKG_ID          14              /* HDL simulator package id */
+#define HWSIM_PKG_ID           15              /* Hardware simulator package id */
+
+#define PCIXX21_FLASHMEDIA0_ID 0x8033          /* TI PCI xx21 Standard Host Controller */
+#define PCIXX21_SDIOH0_ID      0x8034          /* TI PCI xx21 Standard Host Controller */
+
+#define BCM43602_12x12_PKG_ID  (0x1)   /* 12x12 pins package, used for e.g. router designs */
+
+/* 43012 package ID's
+    http://confluence.broadcom.com/display/WLAN/BCM43012+Variants%2Cpackage%2Cballmap%2Cfloorplan#
+    BCM43012Variants,package,ballmap,floorplan-PackageOptions
+*/
+#define BCM943012_WLCSPOLY_PKG_ID      0x0     /* WLCSP Oly package */
+#define BCM943012_FCBGA_PKG_ID         0x3     /* FCBGA debug package */
+#define BCM943012_WLCSPWE_PKG_ID       0x1     /* WLCSP WE package */
+#define BCM943012_FCBGAWE_PKG_ID       0x5     /* FCBGA WE package */
+#define BCM943012_WLBGA_PKG_ID         0x2     /* WLBGA package */
+
+/* boardflags */
+#define        BFL_BTC2WIRE            0x00000001  /* old 2wire Bluetooth coexistence, OBSOLETE */
+#define BFL_BTCOEX      0x00000001      /* Board supports BTCOEX */
+#define        BFL_PACTRL              0x00000002  /* Board has gpio 9 controlling the PA */
+#define BFL_AIRLINEMODE        0x00000004  /* Board implements gpio radio disable indication */
+#define        BFL_ADCDIV              0x00000008  /* Board has the rssi ADC divider */
+#define BFL_DIS_256QAM         0x00000008
+                                       /* for 4360, this bit is to disable 256QAM support */
+#define        BFL_ENETROBO            0x00000010  /* Board has robo switch or core */
+#define        BFL_TSSIAVG             0x00000010  /* TSSI averaging for ACPHY chips */
+#define        BFL_NOPLLDOWN           0x00000020  /* Not ok to power down the chip pll and oscillator */
+#define        BFL_CCKHIPWR            0x00000040  /* Can do high-power CCK transmission */
+#define        BFL_ENETADM             0x00000080  /* Board has ADMtek switch */
+#define        BFL_ENETVLAN            0x00000100  /* Board has VLAN capability */
+#define        BFL_LTECOEX             0x00000200  /* LTE Coex enabled */
+#define BFL_NOPCI              0x00000400  /* Board leaves PCI floating */
+#define BFL_FEM                        0x00000800  /* Board supports the Front End Module */
+#define BFL_EXTLNA             0x00001000  /* Board has an external LNA in 2.4GHz band */
+#define BFL_HGPA               0x00002000  /* Board has a high gain PA */
+#define        BFL_BTC2WIRE_ALTGPIO    0x00004000  /* Board's BTC 2wire is in the alternate gpios */
+#define        BFL_ALTIQ               0x00008000  /* Alternate I/Q settings */
+#define BFL_NOPA               0x00010000  /* Board has no PA */
+#define BFL_RSSIINV            0x00020000  /* Board's RSSI uses positive slope(not TSSI) */
+#define BFL_PAREF              0x00040000  /* Board uses the PARef LDO */
+#define BFL_3TSWITCH           0x00080000  /* Board uses a triple throw switch shared with BT */
+#define BFL_PHASESHIFT         0x00100000  /* Board can support phase shifter */
+#define BFL_BUCKBOOST          0x00200000  /* Power topology uses BUCKBOOST */
+#define BFL_FEM_BT             0x00400000  /* Board has FEM and switch to share antenna w/ BT */
+#define BFL_NOCBUCK            0x00800000  /* Power topology doesn't use CBUCK */
+#define BFL_CCKFAVOREVM                0x01000000  /* Favor CCK EVM over spectral mask */
+#define BFL_PALDO              0x02000000  /* Power topology uses PALDO */
+#define BFL_LNLDO2_2P5         0x04000000  /* Select 2.5V as LNLDO2 output voltage */
+/* BFL_FASTPWR and BFL_UCPWRCTL_MININDX are non-overlaping features and use the same bit */
+#define BFL_FASTPWR            0x08000000  /* Fast switch/antenna powerup (no POR WAR) */
+#define BFL_UCPWRCTL_MININDX   0x08000000  /* Enforce min power index to avoid FEM damage */
+#define BFL_EXTLNA_5GHz                0x10000000  /* Board has an external LNA in 5GHz band */
+#define BFL_TRSW_1by2          0x20000000  /* Board has 2 TRSW's in 1by2 designs */
+#define BFL_GAINBOOSTA01        0x20000000  /* 5g Gainboost for core0 and core1 */
+#define BFL_LO_TRSW_R_5GHz     0x40000000  /* In 5G do not throw TRSW to T for clipLO gain */
+#define BFL_ELNA_GAINDEF       0x80000000  /* Backoff InitGain based on elna_2g/5g field
+                                            * when this flag is set
+                                            */
+#define BFL_EXTLNA_TX  0x20000000      /* Temp boardflag to indicate to */
+
+/* boardflags2 */
+#define BFL2_RXBB_INT_REG_DIS  0x00000001  /* Board has an external rxbb regulator */
+#define BFL2_APLL_WAR          0x00000002  /* Flag to implement alternative A-band PLL settings */
+#define BFL2_TXPWRCTRL_EN      0x00000004  /* Board permits enabling TX Power Control */
+#define BFL2_2X4_DIV           0x00000008  /* Board supports the 2X4 diversity switch */
+#define BFL2_5G_PWRGAIN                0x00000010  /* Board supports 5G band power gain */
+#define BFL2_PCIEWAR_OVR       0x00000020  /* Board overrides ASPM and Clkreq settings */
+#define BFL2_CAESERS_BRD       0x00000040  /* Board is Caesers brd (unused by sw) */
+#define BFL2_WLCX_ATLAS                0x00000040  /* Board flag to initialize ECI for WLCX on FL-ATLAS */
+#define BFL2_BTC3WIRE          0x00000080  /* Board support legacy 3 wire or 4 wire */
+#define BFL2_BTCLEGACY          0x00000080  /* Board support legacy 3/4 wire, to replace
+                                            * BFL2_BTC3WIRE
+                                            */
+#define BFL2_SKWRKFEM_BRD      0x00000100  /* 4321mcm93 board uses Skyworks FEM */
+#define BFL2_SPUR_WAR          0x00000200  /* Board has a WAR for clock-harmonic spurs */
+#define BFL2_GPLL_WAR          0x00000400  /* Flag to narrow G-band PLL loop b/w */
+#define BFL2_TRISTATE_LED      0x00000800  /* Tri-state the LED */
+#define BFL2_SINGLEANT_CCK     0x00001000  /* Tx CCK pkts on Ant 0 only */
+#define BFL2_2G_SPUR_WAR       0x00002000  /* WAR to reduce and avoid clock-harmonic spurs in 2G */
+#define BFL2_BPHY_ALL_TXCORES  0x00004000  /* Transmit bphy frames using all tx cores */
+#define BFL2_FCC_BANDEDGE_WAR  0x00008000  /* Activates WAR to improve FCC bandedge performance */
+#define BFL2_DAC_SPUR_IMPROVEMENT 0x00008000       /* Reducing DAC Spurs */
+#define BFL2_GPLL_WAR2         0x00010000  /* Flag to widen G-band PLL loop b/w */
+#define BFL2_REDUCED_PA_TURNONTIME 0x00010000  /* Flag to reduce PA turn on Time */
+#define BFL2_IPALVLSHIFT_3P3    0x00020000  /* Flag to Activate the PR 74115 PA Level Shift
+                                            * Workaround where the gpaio pin is connected to 3.3V
+                                            */
+#define BFL2_INTERNDET_TXIQCAL  0x00040000  /* Use internal envelope detector for TX IQCAL */
+#define BFL2_XTALBUFOUTEN       0x00080000  /* Keep the buffered Xtal output from radio on */
+                               /* Most drivers will turn it off without this flag */
+                               /* to save power. */
+
+#define BFL2_ANAPACTRL_2G      0x00100000  /* 2G ext PAs are controlled by analog PA ctrl lines */
+#define BFL2_ANAPACTRL_5G      0x00200000  /* 5G ext PAs are controlled by analog PA ctrl lines */
+#define BFL2_ELNACTRL_TRSW_2G  0x00400000  /* AZW4329: 2G gmode_elna_gain controls TR Switch */
+#define BFL2_BT_SHARE_ANT0     0x00800000  /* share core0 antenna with BT */
+#define BFL2_TEMPSENSE_HIGHER  0x01000000  /* The tempsense threshold can sustain higher value
+                                            * than programmed. The exact delta is decided by
+                                            * driver per chip/boardtype. This can be used
+                                            * when tempsense qualification happens after shipment
+                                            */
+#define BFL2_BTC3WIREONLY       0x02000000  /* standard 3 wire btc only.  4 wire not supported */
+#define BFL2_PWR_NOMINAL       0x04000000  /* 0: power reduction on, 1: no power reduction */
+#define BFL2_EXTLNA_PWRSAVE    0x08000000  /* boardflag to enable ucode to apply power save */
+                                               /* ucode control of eLNA during Tx */
+#define BFL2_SDR_EN            0x20000000  /* SDR enabled or disabled */
+#define BFL2_DYNAMIC_VMID      0x10000000  /* boardflag to enable dynamic Vmid idle TSSI CAL */
+#define BFL2_LNA1BYPFORTR2G    0x40000000  /* acphy, enable lna1 bypass for clip gain, 2g */
+#define BFL2_LNA1BYPFORTR5G    0x80000000  /* acphy, enable lna1 bypass for clip gain, 5g */
+
+/* SROM 11 - 11ac boardflag definitions */
+#define BFL_SROM11_BTCOEX  0x00000001  /* Board supports BTCOEX */
+#define BFL_SROM11_WLAN_BT_SH_XTL  0x00000002  /* bluetooth and wlan share same crystal */
+#define BFL_SROM11_EXTLNA      0x00001000  /* Board has an external LNA in 2.4GHz band */
+#define BFL_SROM11_EPA_TURNON_TIME     0x00018000  /* 2 bits for different PA turn on times */
+#define BFL_SROM11_EPA_TURNON_TIME_SHIFT  15
+#define BFL_SROM11_PRECAL_TX_IDX       0x00040000  /* Dedicated TX IQLOCAL IDX values */
+                               /* per subband, as derived from 43602A1 MCH5 */
+#define BFL_SROM11_EXTLNA_5GHz 0x10000000  /* Board has an external LNA in 5GHz band */
+#define BFL_SROM11_GAINBOOSTA01        0x20000000  /* 5g Gainboost for core0 and core1 */
+#define BFL2_SROM11_APLL_WAR   0x00000002  /* Flag to implement alternative A-band PLL settings */
+#define BFL2_SROM11_ANAPACTRL_2G  0x00100000  /* 2G ext PAs are ctrl-ed by analog PA ctrl lines */
+#define BFL2_SROM11_ANAPACTRL_5G  0x00200000  /* 5G ext PAs are ctrl-ed by analog PA ctrl lines */
+#define BFL2_SROM11_SINGLEANT_CCK      0x00001000  /* Tx CCK pkts on Ant 0 only */
+#define BFL2_SROM11_EPA_ON_DURING_TXIQLOCAL    0x00020000  /* Keep ext. PA's on in TX IQLO CAL */
+
+/* boardflags3 */
+#define BFL3_FEMCTRL_SUB         0x00000007  /* acphy, subrevs of femctrl on top of srom_femctrl */
+#define BFL3_RCAL_WAR            0x00000008  /* acphy, rcal war active on this board (4335a0) */
+#define BFL3_TXGAINTBLID         0x00000070  /* acphy, txgain table id */
+#define BFL3_TXGAINTBLID_SHIFT   0x4         /* acphy, txgain table id shift bit */
+#define BFL3_TSSI_DIV_WAR        0x00000080  /* acphy, Seperate paparam for 20/40/80 */
+#define BFL3_TSSI_DIV_WAR_SHIFT          0x7         /* acphy, Seperate paparam for 20/40/80 shift bit */
+#define BFL3_FEMTBL_FROM_NVRAM    0x00000100  /* acphy, femctrl table is read from nvram */
+#define BFL3_FEMTBL_FROM_NVRAM_SHIFT 0x8         /* acphy, femctrl table is read from nvram */
+#define BFL3_AGC_CFG_2G           0x00000200  /* acphy, gain control configuration for 2G */
+#define BFL3_AGC_CFG_5G           0x00000400  /* acphy, gain control configuration for 5G */
+#define BFL3_PPR_BIT_EXT          0x00000800  /* acphy, bit position for 1bit extension for ppr */
+#define BFL3_PPR_BIT_EXT_SHIFT    11          /* acphy, bit shift for 1bit extension for ppr */
+#define BFL3_BBPLL_SPR_MODE_DIS          0x00001000  /* acphy, disables bbpll spur modes */
+#define BFL3_RCAL_OTP_VAL_EN      0x00002000  /* acphy, to read rcal_trim value from otp */
+#define BFL3_2GTXGAINTBL_BLANK   0x00004000  /* acphy, blank the first X ticks of 2g gaintbl */
+#define BFL3_2GTXGAINTBL_BLANK_SHIFT 14       /* acphy, blank the first X ticks of 2g gaintbl */
+#define BFL3_5GTXGAINTBL_BLANK   0x00008000  /* acphy, blank the first X ticks of 5g gaintbl */
+#define BFL3_5GTXGAINTBL_BLANK_SHIFT 15       /* acphy, blank the first X ticks of 5g gaintbl */
+#define BFL3_PHASETRACK_MAX_ALPHABETA    0x00010000  /* acphy, to max out alpha,beta to 511 */
+#define BFL3_PHASETRACK_MAX_ALPHABETA_SHIFT 16       /* acphy, to max out alpha,beta to 511 */
+/* acphy, to use backed off gaintbl for lte-coex */
+#define BFL3_LTECOEX_GAINTBL_EN           0x00060000
+/* acphy, to use backed off gaintbl for lte-coex */
+#define BFL3_LTECOEX_GAINTBL_EN_SHIFT 17
+#define BFL3_5G_SPUR_WAR          0x00080000  /* acphy, enable spur WAR in 5G band */
+
+/* acphy: lpmode2g and lpmode_5g related boardflags */
+#define BFL3_ACPHY_LPMODE_2G     0x00300000  /* bits 20:21 for lpmode_2g choice */
+#define BFL3_ACPHY_LPMODE_2G_SHIFT       20
+
+#define BFL3_ACPHY_LPMODE_5G     0x00C00000  /* bits 22:23 for lpmode_5g choice */
+#define BFL3_ACPHY_LPMODE_5G_SHIFT       22
+
+#define BFL3_1X1_RSDB_ANT        0x01000000  /* to find if 2-ant RSDB board or 1-ant RSDB board */
+#define BFL3_1X1_RSDB_ANT_SHIFT           24
+
+#define BFL3_EXT_LPO_ISCLOCK      0x02000000  /* External LPO is clock, not x-tal */
+#define BFL3_FORCE_INT_LPO_SEL    0x04000000  /* Force internal lpo */
+#define BFL3_FORCE_EXT_LPO_SEL    0x08000000  /* Force external lpo */
+
+#define BFL3_EN_BRCM_IMPBF        0x10000000  /* acphy, Allow BRCM Implicit TxBF */
+
+#define BFL3_PADCAL_OTP_VAL_EN    0x20000000  /* acphy, to read pad cal values from otp */
+
+#define BFL3_AVVMID_FROM_NVRAM    0x40000000  /* Read Av Vmid from NVRAM  */
+#define BFL3_VLIN_EN_FROM_NVRAM    0x80000000  /* Read Vlin En from NVRAM  */
+
+#define BFL3_AVVMID_FROM_NVRAM_SHIFT   30   /* Read Av Vmid from NVRAM  */
+#define BFL3_VLIN_EN_FROM_NVRAM_SHIFT   31   /* Enable Vlin  from NVRAM  */
+
+/* boardflags4 for SROM12/SROM13 */
+
+/* To distinguigh between normal and 4dB pad board */
+#define BFL4_SROM12_4dBPAD                     (1u << 0)
+
+/* Determine power detector type for 2G */
+#define BFL4_SROM12_2G_DETTYPE                 (1u << 1u)
+
+/* Determine power detector type for 5G */
+#define BFL4_SROM12_5G_DETTYPE                 (1u << 2u)
+
+/* using pa_dettype from SROM13 flags */
+#define BFL4_SROM13_DETTYPE_EN                 (1u << 3u)
+
+/* using cck spur reduction setting */
+#define BFL4_SROM13_CCK_SPUR_EN                        (1u << 4u)
+
+/* using 1.5V cbuck board */
+#define BFL4_SROM13_1P5V_CBUCK                 (1u << 7u)
+
+/* Enable/disable bit for sw chain mask */
+#define BFL4_SROM13_EN_SW_TXRXCHAIN_MASK       (1u << 8u)
+
+#define BFL4_BTCOEX_OVER_SECI  0x00000400u     /* Enable btcoex over gci seci */
+
+/* RFFE rFEM 5G and 2G present bit */
+#define BFL4_FEM_RFFE          (1u << 21u)
+
+/* papd params */
+#define PAPD_TX_ATTN_2G 0xFF
+#define PAPD_TX_ATTN_5G 0xFF00
+#define PAPD_TX_ATTN_5G_SHIFT 8
+#define PAPD_RX_ATTN_2G 0xFF
+#define PAPD_RX_ATTN_5G 0xFF00
+#define PAPD_RX_ATTN_5G_SHIFT 8
+#define PAPD_CAL_IDX_2G 0xFF
+#define PAPD_CAL_IDX_5G 0xFF00
+#define PAPD_CAL_IDX_5G_SHIFT 8
+#define PAPD_BBMULT_2G 0xFF
+#define PAPD_BBMULT_5G 0xFF00
+#define PAPD_BBMULT_5G_SHIFT 8
+#define TIA_GAIN_MODE_2G 0xFF
+#define TIA_GAIN_MODE_5G 0xFF00
+#define TIA_GAIN_MODE_5G_SHIFT 8
+#define PAPD_EPS_OFFSET_2G 0xFFFF
+#define PAPD_EPS_OFFSET_5G 0xFFFF0000
+#define PAPD_EPS_OFFSET_5G_SHIFT 16
+#define PAPD_CALREF_DB_2G 0xFF
+#define PAPD_CALREF_DB_5G 0xFF00
+#define PAPD_CALREF_DB_5G_SHIFT 8
+
+/* board specific GPIO assignment, gpio 0-3 are also customer-configurable led */
+#define        BOARD_GPIO_BTC3W_IN     0x850   /* bit 4 is RF_ACTIVE, bit 6 is STATUS, bit 11 is PRI */
+#define        BOARD_GPIO_BTC3W_OUT    0x020   /* bit 5 is TX_CONF */
+#define        BOARD_GPIO_BTCMOD_IN    0x010   /* bit 4 is the alternate BT Coexistence Input */
+#define        BOARD_GPIO_BTCMOD_OUT   0x020   /* bit 5 is the alternate BT Coexistence Out */
+#define        BOARD_GPIO_BTC_IN       0x080   /* bit 7 is BT Coexistence Input */
+#define        BOARD_GPIO_BTC_OUT      0x100   /* bit 8 is BT Coexistence Out */
+#define        BOARD_GPIO_PACTRL       0x200   /* bit 9 controls the PA on new 4306 boards */
+#define BOARD_GPIO_12          0x1000  /* gpio 12 */
+#define BOARD_GPIO_13          0x2000  /* gpio 13 */
+#define BOARD_GPIO_BTC4_IN     0x0800  /* gpio 11, coex4, in */
+#define BOARD_GPIO_BTC4_BT     0x2000  /* gpio 12, coex4, bt active */
+#define BOARD_GPIO_BTC4_STAT   0x4000  /* gpio 14, coex4, status */
+#define BOARD_GPIO_BTC4_WLAN   0x8000  /* gpio 15, coex4, wlan active */
+#define        BOARD_GPIO_1_WLAN_PWR   0x02    /* throttle WLAN power on X21 board */
+#define        BOARD_GPIO_2_WLAN_PWR   0x04    /* throttle WLAN power on X29C board */
+#define        BOARD_GPIO_3_WLAN_PWR   0x08    /* throttle WLAN power on X28 board */
+#define        BOARD_GPIO_4_WLAN_PWR   0x10    /* throttle WLAN power on X19 board */
+#define        BOARD_GPIO_13_WLAN_PWR  0x2000  /* throttle WLAN power on X14 board */
+
+#define GPIO_BTC4W_OUT_4312  0x010  /* bit 4 is BT_IODISABLE */
+
+#define        PCI_CFG_GPIO_SCS        0x10    /* PCI config space bit 4 for 4306c0 slow clock source */
+#define PCI_CFG_GPIO_HWRAD     0x20    /* PCI config space GPIO 13 for hw radio disable */
+#define PCI_CFG_GPIO_XTAL      0x40    /* PCI config space GPIO 14 for Xtal power-up */
+#define PCI_CFG_GPIO_PLL       0x80    /* PCI config space GPIO 15 for PLL power-down */
+
+/* need to be moved to a chip specific header file */
+/* power control defines */
+#define PLL_DELAY              150             /* us pll on delay */
+#define FREF_DELAY             200             /* us fref change delay */
+#define MIN_SLOW_CLK           32              /* us Slow clock period */
+#define        XTAL_ON_DELAY           1000            /* us crystal power-on delay */
+
+/* Board IDs */
+
+/* Reference Board Types */
+#define        BU4710_BOARD            0x0400
+#define        VSIM4710_BOARD          0x0401
+#define        QT4710_BOARD            0x0402
+
+#define        BCM94710D_BOARD         0x041a
+#define        BCM94710R1_BOARD        0x041b
+#define        BCM94710R4_BOARD        0x041c
+#define        BCM94710AP_BOARD        0x041d
+
+#define        BU2050_BOARD            0x041f
+
+/* BCM4318 boards */
+#define BU4318_BOARD           0x0447
+#define CB4318_BOARD           0x0448
+#define MPG4318_BOARD          0x0449
+#define MP4318_BOARD           0x044a
+#define SD4318_BOARD           0x044b
+#define        BCM94318MPGH_BOARD      0x0463
+
+/* 4321 boards */
+#define BU4321_BOARD           0x046b
+#define BU4321E_BOARD          0x047c
+#define MP4321_BOARD           0x046c
+#define CB2_4321_BOARD         0x046d
+#define CB2_4321_AG_BOARD      0x0066
+#define MC4321_BOARD           0x046e
+
+/* 4360 Boards */
+#define BCM94360X52C            0X0117
+#define BCM94360X52D            0X0137
+#define BCM94360X29C            0X0112
+#define BCM94360X29CP2          0X0134
+#define BCM94360X29CP3          0X013B
+#define BCM94360X51             0x0111
+#define BCM94360X51P2           0x0129
+#define BCM94360X51P3           0x0142
+#define BCM94360X51A            0x0135
+#define BCM94360X51B            0x0136
+#define BCM94360CS              0x061B
+#define BCM94360J28_D11AC2G     0x0c00
+#define BCM94360J28_D11AC5G     0x0c01
+#define BCM94360USBH5_D11AC5G   0x06aa
+#define BCM94360MCM5            0x06d8
+
+/* need to update si_fixup_vid_overrides() for additional platforms */
+
+/* 43012 wlbga Board */
+#define BCM943012WLREF_SSID    0x07d7
+
+/* 43012 fcbga Board */
+#define BCM943012FCREF_SSID    0x07d4
+
+/* 43602 Boards, unclear yet what boards will be created. */
+#define BCM943602RSVD1_SSID    0x06a5
+#define BCM943602RSVD2_SSID    0x06a6
+#define BCM943602X87            0X0133
+#define BCM943602X87P2          0X0152
+#define BCM943602X87P3          0X0153 /* need to update si_fixup_vid_overrides() */
+#define BCM943602X238           0X0132
+#define BCM943602X238D          0X014A
+#define BCM943602X238DP2        0X0155 /* J117 */
+#define BCM943602X238DP3        0X0156 /* J94 */
+#define BCM943602X100           0x0761 /* Dev only */
+#define BCM943602X100GS         0x0157 /* Woody */
+#define BCM943602X100P2         0x015A /* Buzz, Zurg */
+
+/* 4375B0 WLCSP SEMCO Board */
+#define BCM94375B0_WLCSP_SSID  0x086b
+
+/* # of GPIO pins */
+#define GPIO_NUMPINS           32
+
+/* chip RAM specifications */
+#define RDL_RAM_SIZE_4360  0xA0000
+#define RDL_RAM_BASE_4360  0x60000000
+
+/* generic defs for nvram "muxenab" bits
+* Note: these differ for 4335a0. refer bcmchipc.h for specific mux options.
+*/
+#define MUXENAB_UART           0x00000001
+#define MUXENAB_GPIO           0x00000002
+#define MUXENAB_ERCX           0x00000004      /* External Radio BT coex */
+#define MUXENAB_JTAG           0x00000008
+#define MUXENAB_HOST_WAKE      0x00000010      /* configure GPIO for SDIO host_wake */
+#define MUXENAB_I2S_EN         0x00000020
+#define MUXENAB_I2S_MASTER     0x00000040
+#define MUXENAB_I2S_FULL       0x00000080
+#define MUXENAB_SFLASH         0x00000100
+#define MUXENAB_RFSWCTRL0      0x00000200
+#define MUXENAB_RFSWCTRL1      0x00000400
+#define MUXENAB_RFSWCTRL2      0x00000800
+#define MUXENAB_SECI           0x00001000
+#define MUXENAB_BT_LEGACY      0x00002000
+#define MUXENAB_HOST_WAKE1     0x00004000      /* configure alternative GPIO for SDIO host_wake */
+
+/* Boot flags */
+#define FLASH_KERNEL_NFLASH    0x00000001
+#define FLASH_BOOT_NFLASH      0x00000002
+
+#endif /* _BCMDEVS_H */
diff --git a/bcmdhd.101.10.240.x/include/bcmdevs_legacy.h b/bcmdhd.101.10.240.x/include/bcmdevs_legacy.h
new file mode 100644 (file)
index 0000000..dda37c5
--- /dev/null
@@ -0,0 +1,153 @@
+/*
+ * Broadcom device-specific manifest constants used by DHD, but deprecated in firmware.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _bcmdevs_legacy_h_
+#define        _bcmdevs_legacy_h_
+
+/* DONGLE VID/PIDs */
+
+/* PCI Device IDs */
+#define BCM4335_D11AC_ID       0x43ae
+#define BCM4335_D11AC2G_ID     0x43af
+#define BCM4335_D11AC5G_ID     0x43b0
+#define BCM4345_D11AC_ID       0x43ab          /* 4345 802.11ac dualband device */
+#define BCM4345_D11AC2G_ID     0x43ac          /* 4345 802.11ac 2.4G device */
+#define BCM4345_D11AC5G_ID     0x43ad          /* 4345 802.11ac 5G device */
+#define BCM43452_D11AC_ID      0x47ab          /* 43452 802.11ac dualband device */
+#define BCM43452_D11AC2G_ID    0x47ac          /* 43452 802.11ac 2.4G device */
+#define BCM43452_D11AC5G_ID    0x47ad          /* 43452 802.11ac 5G device */
+#define BCM4347_D11AC_ID       0x440a          /* 4347 802.11ac dualband device */
+#define BCM4347_D11AC2G_ID     0x440b          /* 4347 802.11ac 2.4G device */
+#define BCM4347_D11AC5G_ID     0x440c          /* 4347 802.11ac 5G device */
+#define BCM4349_D11AC_ID       0x4349          /* 4349 802.11ac dualband device */
+#define BCM4349_D11AC2G_ID     0x43dd          /* 4349 802.11ac 2.4G device */
+#define BCM4349_D11AC5G_ID     0x43de          /* 4349 802.11ac 5G device */
+
+#define BCM4350_D11AC_ID       0x43a3
+#define BCM4350_D11AC2G_ID     0x43a4
+#define BCM4350_D11AC5G_ID     0x43a5
+#define BCM4354_D11AC_ID       0x43df          /* 4354 802.11ac dualband device */
+#define BCM4354_D11AC2G_ID     0x43e0          /* 4354 802.11ac 2.4G device */
+#define BCM4354_D11AC5G_ID     0x43e1          /* 4354 802.11ac 5G device */
+#define BCM4355_D11AC_ID       0x43dc          /* 4355 802.11ac dualband device */
+#define BCM4355_D11AC2G_ID     0x43fc          /* 4355 802.11ac 2.4G device */
+#define BCM4355_D11AC5G_ID     0x43fd          /* 4355 802.11ac 5G device */
+#define BCM4356_D11AC_ID       0x43ec          /* 4356 802.11ac dualband device */
+#define BCM4356_D11AC2G_ID     0x43ed          /* 4356 802.11ac 2.4G device */
+#define BCM4356_D11AC5G_ID     0x43ee          /* 4356 802.11ac 5G device */
+#define BCM43569_D11AC_ID      0x43d9
+#define BCM43569_D11AC2G_ID    0x43da
+#define BCM43569_D11AC5G_ID    0x43db
+#define BCM4358_D11AC_ID        0x43e9          /* 4358 802.11ac dualband device */
+#define BCM4358_D11AC2G_ID      0x43ea          /* 4358 802.11ac 2.4G device */
+#define BCM4358_D11AC5G_ID      0x43eb          /* 4358 802.11ac 5G device */
+
+#define BCM4359_D11AC_ID       0x43ef          /* 4359 802.11ac dualband device */
+#define BCM4359_D11AC2G_ID     0x43fe          /* 4359 802.11ac 2.4G device */
+#define BCM4359_D11AC5G_ID     0x43ff          /* 4359 802.11ac 5G device */
+#define BCM43596_D11AC_ID      0x4415          /* 43596 802.11ac dualband device */
+#define BCM43596_D11AC2G_ID    0x4416          /* 43596 802.11ac 2.4G device */
+#define BCM43596_D11AC5G_ID    0x4417          /* 43596 802.11ac 5G device */
+#define BCM43597_D11AC_ID      0x441c          /* 43597 802.11ac dualband device */
+#define BCM43597_D11AC2G_ID    0x441d          /* 43597 802.11ac 2.4G device */
+#define BCM43597_D11AC5G_ID    0x441e          /* 43597 802.11ac 5G device */
+#define BCM4361_D11AC_ID       0x441f          /* 4361 802.11ac dualband device */
+#define BCM4361_D11AC2G_ID     0x4420          /* 4361 802.11ac 2.4G device */
+#define BCM4361_D11AC5G_ID     0x4421          /* 4361 802.11ac 5G device */
+#define BCM4364_D11AC_ID       0x4464          /* 4364 802.11ac dualband device */
+#define BCM4364_D11AC2G_ID     0x446a          /* 4364 802.11ac 2.4G device */
+#define BCM4364_D11AC5G_ID     0x446b          /* 4364 802.11ac 5G device */
+#define BCM4371_D11AC_ID       0x440d          /* 4371 802.11ac dualband device */
+#define BCM4371_D11AC2G_ID     0x440e          /* 4371 802.11ac 2.4G device */
+#define BCM4371_D11AC5G_ID     0x440f          /* 4371 802.11ac 5G device */
+
+/* Chip IDs */
+#define BCM43018_CHIP_ID       43018           /* 43018 chipcommon chipid */
+#define BCM4335_CHIP_ID                0x4335          /* 4335 chipcommon chipid */
+#define BCM4339_CHIP_ID                0x4339          /* 4339 chipcommon chipid */
+#define BCM43430_CHIP_ID       43430           /* 43430 chipcommon chipid */
+#define BCM4345_CHIP_ID                0x4345          /* 4345 chipcommon chipid */
+#define BCM43452_CHIP_ID       43452           /* 43454 chipcommon chipid */
+#define BCM43454_CHIP_ID       43454           /* 43454 chipcommon chipid */
+#define BCM43455_CHIP_ID       43455           /* 43455 chipcommon chipid */
+#define BCM43457_CHIP_ID       43457           /* 43457 chipcommon chipid */
+#define BCM43458_CHIP_ID       43458           /* 43458 chipcommon chipid */
+
+#define BCM4345_CHIP(chipid)   (CHIPID(chipid) == BCM4345_CHIP_ID || \
+                                CHIPID(chipid) == BCM43452_CHIP_ID || \
+                                CHIPID(chipid) == BCM43454_CHIP_ID || \
+                                CHIPID(chipid) == BCM43455_CHIP_ID || \
+                                CHIPID(chipid) == BCM43457_CHIP_ID || \
+                                CHIPID(chipid) == BCM43458_CHIP_ID)
+
+#define CASE_BCM4345_CHIP      case BCM4345_CHIP_ID: /* fallthrough */ \
+                               case BCM43454_CHIP_ID: /* fallthrough */ \
+                               case BCM43455_CHIP_ID: /* fallthrough */ \
+                               case BCM43457_CHIP_ID: /* fallthrough */ \
+                               case BCM43458_CHIP_ID
+
+#define BCM4347_CHIP_ID                0x4347          /* 4347 chipcommon chipid */
+#define BCM4347_CHIP(chipid)   ((CHIPID(chipid) == BCM4347_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM4357_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM4361_CHIP_ID))
+#define BCM4347_CHIP_GRPID     BCM4347_CHIP_ID: \
+                               case BCM4357_CHIP_ID: \
+                               case BCM4361_CHIP_ID
+
+#define BCM4350_CHIP_ID                0x4350          /* 4350 chipcommon chipid */
+#define BCM4354_CHIP_ID                0x4354          /* 4354 chipcommon chipid */
+#define BCM4356_CHIP_ID                0x4356          /* 4356 chipcommon chipid */
+#define BCM43567_CHIP_ID       0xAA2F          /* 43567 chipcommon chipid */
+#define BCM43569_CHIP_ID       0xAA31          /* 43569 chipcommon chipid */
+#define BCM4357_CHIP_ID                0x4357          /* 4357 chipcommon chipid */
+#define BCM43570_CHIP_ID       0xAA32          /* 43570 chipcommon chipid */
+#define BCM4358_CHIP_ID                0x4358          /* 4358 chipcommon chipid */
+#define BCM43596_CHIP_ID       43596           /* 43596 chipcommon chipid */
+#define BCM4361_CHIP_ID                0x4361          /* 4361 chipcommon chipid */
+#define BCM4364_CHIP_ID                0x4364          /* 4364 chipcommon chipid */
+#define BCM4371_CHIP_ID                0x4371          /* 4371 chipcommon chipid */
+
+#define BCM4349_CHIP_ID                0x4349          /* 4349 chipcommon chipid */
+#define BCM4355_CHIP_ID                0x4355          /* 4355 chipcommon chipid */
+#define BCM4359_CHIP_ID                0x4359          /* 4359 chipcommon chipid */
+#define BCM4355_CHIP(chipid)   (CHIPID(chipid) == BCM4355_CHIP_ID)
+#define BCM4349_CHIP(chipid)   ((CHIPID(chipid) == BCM4349_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM4355_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM4359_CHIP_ID))
+#define BCM4349_CHIP_GRPID             BCM4349_CHIP_ID: \
+                                       case BCM4355_CHIP_ID: \
+                                       case BCM4359_CHIP_ID
+#define BCM4350_CHIP(chipid)   ((CHIPID(chipid) == BCM4350_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM4354_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43567_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43569_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43570_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM4358_CHIP_ID)) /* 4350 variations */
+
+/* Board Flags */
+
+/* Package IDs */
+
+/* Board IDs */
+
+#endif /* _bcmdevs_legacy_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmdhcp.h b/bcmdhd.101.10.240.x/include/bcmdhcp.h
new file mode 100644 (file)
index 0000000..0051ebf
--- /dev/null
@@ -0,0 +1,86 @@
+/*
+ * Fundamental constants relating to DHCP Protocol
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _bcmdhcp_h_
+#define _bcmdhcp_h_
+
+/* DHCP params */
+#define DHCP_TYPE_OFFSET       0       /* DHCP type (request|reply) offset */
+#define DHCP_TID_OFFSET                4       /* DHCP transition id offset */
+#define DHCP_FLAGS_OFFSET      10      /* DHCP flags offset */
+#define DHCP_CIADDR_OFFSET     12      /* DHCP client IP address offset */
+#define DHCP_YIADDR_OFFSET     16      /* DHCP your IP address offset */
+#define DHCP_GIADDR_OFFSET     24      /* DHCP relay agent IP address offset */
+#define DHCP_CHADDR_OFFSET     28      /* DHCP client h/w address offset */
+#define DHCP_OPT_OFFSET                236     /* DHCP options offset */
+
+#define DHCP_OPT_MSGTYPE       53      /* DHCP message type */
+#define DHCP_OPT_MSGTYPE_REQ   3
+#define DHCP_OPT_MSGTYPE_ACK   5       /* DHCP message type - ACK */
+
+#define DHCP_OPT_CODE_OFFSET   0       /* Option identifier */
+#define DHCP_OPT_LEN_OFFSET    1       /* Option data length */
+#define DHCP_OPT_DATA_OFFSET   2       /* Option data */
+
+#define DHCP_OPT_CODE_CLIENTID 61      /* Option identifier */
+
+#define DHCP_TYPE_REQUEST      1       /* DHCP request (discover|request) */
+#define DHCP_TYPE_REPLY                2       /* DHCP reply (offset|ack) */
+
+#define DHCP_PORT_SERVER       67      /* DHCP server UDP port */
+#define DHCP_PORT_CLIENT       68      /* DHCP client UDP port */
+
+#define DHCP_FLAG_BCAST        0x8000  /* DHCP broadcast flag */
+
+#define DHCP_FLAGS_LEN 2       /* DHCP flags field length */
+
+#define DHCP6_TYPE_SOLICIT     1       /* DHCP6 solicit */
+#define DHCP6_TYPE_ADVERTISE   2       /* DHCP6 advertise */
+#define DHCP6_TYPE_REQUEST     3       /* DHCP6 request */
+#define DHCP6_TYPE_CONFIRM     4       /* DHCP6 confirm */
+#define DHCP6_TYPE_RENEW       5       /* DHCP6 renew */
+#define DHCP6_TYPE_REBIND      6       /* DHCP6 rebind */
+#define DHCP6_TYPE_REPLY       7       /* DHCP6 reply */
+#define DHCP6_TYPE_RELEASE     8       /* DHCP6 release */
+#define DHCP6_TYPE_DECLINE     9       /* DHCP6 decline */
+#define DHCP6_TYPE_RECONFIGURE 10      /* DHCP6 reconfigure */
+#define DHCP6_TYPE_INFOREQ     11      /* DHCP6 information request */
+#define DHCP6_TYPE_RELAYFWD    12      /* DHCP6 relay forward */
+#define DHCP6_TYPE_RELAYREPLY  13      /* DHCP6 relay reply */
+
+#define DHCP6_TYPE_OFFSET      0       /* DHCP6 type offset */
+
+#define        DHCP6_MSG_OPT_OFFSET    4       /* Offset of options in client server messages */
+#define        DHCP6_RELAY_OPT_OFFSET  34      /* Offset of options in relay messages */
+
+#define        DHCP6_OPT_CODE_OFFSET   0       /* Option identifier */
+#define        DHCP6_OPT_LEN_OFFSET    2       /* Option data length */
+#define        DHCP6_OPT_DATA_OFFSET   4       /* Option data */
+
+#define        DHCP6_OPT_CODE_CLIENTID 1       /* DHCP6 CLIENTID option */
+#define        DHCP6_OPT_CODE_SERVERID 2       /* DHCP6 SERVERID option */
+
+#define DHCP6_PORT_SERVER      547     /* DHCP6 server UDP port */
+#define DHCP6_PORT_CLIENT      546     /* DHCP6 client UDP port */
+
+#endif /* #ifndef _bcmdhcp_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmendian.h b/bcmdhd.101.10.240.x/include/bcmendian.h
new file mode 100644 (file)
index 0000000..5985cd3
--- /dev/null
@@ -0,0 +1,412 @@
+/*
+ * Byte order utilities
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ *
+ * This file by default provides proper behavior on little-endian architectures.
+ * On big-endian architectures, IL_BIGENDIAN should be defined.
+ */
+
+#ifndef _BCMENDIAN_H_
+#define _BCMENDIAN_H_
+
+#include <typedefs.h>
+
+/* Reverse the bytes in a 16-bit value */
+#define BCMSWAP16(val) \
+       ((uint16)((((uint16)(val) & (uint16)0x00ffU) << 8) | \
+                 (((uint16)(val) & (uint16)0xff00U) >> 8)))
+
+/* Reverse the bytes in a 32-bit value */
+#define BCMSWAP32(val) \
+       ((uint32)((((uint32)(val) & (uint32)0x000000ffU) << 24) | \
+                 (((uint32)(val) & (uint32)0x0000ff00U) <<  8) | \
+                 (((uint32)(val) & (uint32)0x00ff0000U) >>  8) | \
+                 (((uint32)(val) & (uint32)0xff000000U) >> 24)))
+
+/* Reverse the two 16-bit halves of a 32-bit value */
+#define BCMSWAP32BY16(val) \
+       ((uint32)((((uint32)(val) & (uint32)0x0000ffffU) << 16) | \
+                 (((uint32)(val) & (uint32)0xffff0000U) >> 16)))
+
+/* Reverse the bytes in a 64-bit value */
+#define BCMSWAP64(val) \
+       ((uint64)((((uint64)(val) & 0x00000000000000ffULL) << 56) | \
+                 (((uint64)(val) & 0x000000000000ff00ULL) << 40) | \
+                 (((uint64)(val) & 0x0000000000ff0000ULL) << 24) | \
+                 (((uint64)(val) & 0x00000000ff000000ULL) <<  8) | \
+                 (((uint64)(val) & 0x000000ff00000000ULL) >>  8) | \
+                 (((uint64)(val) & 0x0000ff0000000000ULL) >> 24) | \
+                 (((uint64)(val) & 0x00ff000000000000ULL) >> 40) | \
+                 (((uint64)(val) & 0xff00000000000000ULL) >> 56)))
+
+/* Reverse the two 32-bit halves of a 64-bit value */
+#define BCMSWAP64BY32(val) \
+       ((uint64)((((uint64)(val) & 0x00000000ffffffffULL) << 32) | \
+                 (((uint64)(val) & 0xffffffff00000000ULL) >> 32)))
+
+/* Byte swapping macros
+ *    Host <=> Network (Big Endian) for 16- and 32-bit values
+ *    Host <=> Little-Endian for 16- and 32-bit values
+ */
+#ifndef hton16
+#define HTON16(i) BCMSWAP16(i)
+#define        hton16(i) bcmswap16(i)
+#define        HTON32(i) BCMSWAP32(i)
+#define        hton32(i) bcmswap32(i)
+#define        NTOH16(i) BCMSWAP16(i)
+#define        ntoh16(i) bcmswap16(i)
+#define        NTOH32(i) BCMSWAP32(i)
+#define        ntoh32(i) bcmswap32(i)
+#define LTOH16(i) (i)
+#define ltoh16(i) (i)
+#define LTOH32(i) (i)
+#define ltoh32(i) (i)
+#define HTOL16(i) (i)
+#define htol16(i) (i)
+#define HTOL32(i) (i)
+#define htol32(i) (i)
+#define HTOL64(i) (i)
+#define htol64(i) (i)
+#endif /* hton16 */
+
+#define ltoh16_buf(buf, i)
+#define htol16_buf(buf, i)
+#define ltoh32_buf(buf, i)
+#define htol32_buf(buf, i)
+#define ltoh64_buf(buf, i)
+#define htol64_buf(buf, i)
+
+/* Unaligned loads and stores in host byte order */
+#define load32_ua(a)           ltoh32_ua(a)
+#define store32_ua(a, v)       htol32_ua_store(v, a)
+#define load16_ua(a)           ltoh16_ua(a)
+#define store16_ua(a, v)       htol16_ua_store(v, a)
+#define load64_ua(a)           ltoh64_ua(a)
+#define store64_ua(a, v)       htol64_ua_store(v, a)
+
+#define _LTOH16_UA(cp) ((uint16)(cp)[0] | ((uint16)(cp)[1] << 8))
+#define _LTOH32_UA(cp) ((uint32)(cp)[0] | ((uint32)(cp)[1] << 8) | \
+       ((uint32)(cp)[2] << 16) | ((uint32)(cp)[3] << 24))
+#define _NTOH16_UA(cp) (((uint16)(cp)[0] << 8) | (uint16)(cp)[1])
+#define _NTOH32_UA(cp) (((uint32)(cp)[0] << 24) | ((uint32)(cp)[1] << 16) | \
+       ((uint32)(cp)[2] << 8) | (uint32)(cp)[3])
+
+#define _LTOH64_UA(cp) ((uint64)(cp)[0] | ((uint64)(cp)[1] << 8) | \
+       ((uint64)(cp)[2] << 16) | ((uint64)(cp)[3] << 24) | \
+       ((uint64)(cp)[4] << 32) | ((uint64)(cp)[5] << 40) | \
+       ((uint64)(cp)[6] << 48) | ((uint64)(cp)[7] << 56))
+
+#define _NTOH64_UA(cp) ((uint64)(cp)[7] | ((uint64)(cp)[6] << 8) | \
+       ((uint64)(cp)[5] << 16) | ((uint64)(cp)[4] << 24) | \
+       ((uint64)(cp)[3] << 32) | ((uint64)(cp)[2] << 40) | \
+       ((uint64)(cp)[1] << 48) | ((uint64)(cp)[0] << 56))
+
+#define ltoh_ua(ptr) \
+       (sizeof(*(ptr)) == sizeof(uint8) ? *(const uint8 *)(ptr) : \
+        sizeof(*(ptr)) == sizeof(uint16) ? (uint16)_LTOH16_UA((const uint8 *)(ptr)) : \
+        sizeof(*(ptr)) == sizeof(uint32) ? (uint32)_LTOH32_UA((const uint8 *)(ptr)) : \
+        *(uint8 *)0)
+
+#define ntoh_ua(ptr) \
+       (sizeof(*(ptr)) == sizeof(uint8) ? *(const uint8 *)(ptr) : \
+        sizeof(*(ptr)) == sizeof(uint16) ? (uint16)_NTOH16_UA((const uint8 *)(ptr)) : \
+        sizeof(*(ptr)) == sizeof(uint32) ? (uint32)_NTOH32_UA((const uint8 *)(ptr)) : \
+        *(uint8 *)0)
+
+#ifdef __GNUC__
+
+/* GNU macro versions avoid referencing the argument multiple times, while also
+ * avoiding the -fno-inline used in ROM builds.
+ */
+
+#define bcmswap16(val) ({ \
+       uint16 _val = (val); \
+       BCMSWAP16(_val); \
+})
+
+#define bcmswap32(val) ({ \
+       uint32 _val = (val); \
+       BCMSWAP32(_val); \
+})
+
+#define bcmswap64(val) ({ \
+       uint64 _val = (val); \
+       BCMSWAP64(_val); \
+})
+
+#define bcmswap32by16(val) ({ \
+       uint32 _val = (val); \
+       BCMSWAP32BY16(_val); \
+})
+
+#define bcmswap16_buf(buf, len) ({ \
+       uint16 *_buf = (uint16 *)(buf); \
+       uint _wds = (len) / 2; \
+       while (_wds--) { \
+               *_buf = bcmswap16(*_buf); \
+               _buf++; \
+       } \
+})
+
+#define bcmswap32_buf(buf, len) ({ \
+       uint32 *_buf = (uint32 *)(buf); \
+       uint _wds = (len) / 4; \
+       while (_wds--) { \
+               *_buf = bcmswap32(*_buf); \
+               _buf++; \
+       } \
+})
+
+#define bcmswap64_buf(buf, len) ({ \
+       uint64 *_buf = (uint64 *)(buf); \
+       uint _wds = (len) / 8; \
+       while (_wds--) { \
+               *_buf = bcmswap64(*_buf); \
+               _buf++; \
+       } \
+})
+
+#define htol16_ua_store(val, bytes) ({ \
+       uint16 _val = (val); \
+       uint8 *_bytes = (uint8 *)(bytes); \
+       _bytes[0] = _val & 0xff; \
+       _bytes[1] = _val >> 8; \
+})
+
+#define htol32_ua_store(val, bytes) ({ \
+       uint32 _val = (val); \
+       uint8 *_bytes = (uint8 *)(bytes); \
+       _bytes[0] = _val & 0xff; \
+       _bytes[1] = (_val >> 8) & 0xff; \
+       _bytes[2] = (_val >> 16) & 0xff; \
+       _bytes[3] = _val >> 24; \
+})
+
+#define htol64_ua_store(val, bytes) ({ \
+       uint64 _val = (val); \
+       uint8 *_bytes = (uint8 *)(bytes); \
+       int _ii; \
+       for (_ii = 0; _ii < (int)sizeof(_val); ++_ii) { \
+               *_bytes++ = _val & 0xff; \
+               _val >>= 8; \
+       } \
+})
+
+#define hton16_ua_store(val, bytes) ({ \
+       uint16 _val = (val); \
+       uint8 *_bytes = (uint8 *)(bytes); \
+       _bytes[0] = _val >> 8; \
+       _bytes[1] = _val & 0xff; \
+})
+
+#define hton32_ua_store(val, bytes) ({ \
+       uint32 _val = (val); \
+       uint8 *_bytes = (uint8 *)(bytes); \
+       _bytes[0] = _val >> 24; \
+       _bytes[1] = (_val >> 16) & 0xff; \
+       _bytes[2] = (_val >> 8) & 0xff; \
+       _bytes[3] = _val & 0xff; \
+})
+
+#define ltoh16_ua(bytes) ({ \
+       const uint8 *_bytes = (const uint8 *)(bytes); \
+       _LTOH16_UA(_bytes); \
+})
+
+#define ltoh32_ua(bytes) ({ \
+       const uint8 *_bytes = (const uint8 *)(bytes); \
+       _LTOH32_UA(_bytes); \
+})
+
+#define ltoh64_ua(bytes) ({ \
+       const uint8 *_bytes = (const uint8 *)(bytes); \
+       _LTOH64_UA(_bytes); \
+})
+
+#define ntoh16_ua(bytes) ({ \
+       const uint8 *_bytes = (const uint8 *)(bytes); \
+       _NTOH16_UA(_bytes); \
+})
+
+#define ntoh32_ua(bytes) ({ \
+       const uint8 *_bytes = (const uint8 *)(bytes); \
+       _NTOH32_UA(_bytes); \
+})
+
+#define ntoh64_ua(bytes) ({ \
+       const uint8 *_bytes = (const uint8 *)(bytes); \
+       _NTOH64_UA(_bytes); \
+})
+
+#else /* !__GNUC__ */
+
+/* Inline versions avoid referencing the argument multiple times */
+static INLINE uint16
+bcmswap16(uint16 val)
+{
+       return BCMSWAP16(val);
+}
+
+static INLINE uint32
+bcmswap32(uint32 val)
+{
+       return BCMSWAP32(val);
+}
+
+static INLINE uint64
+bcmswap64(uint64 val)
+{
+       return BCMSWAP64(val);
+}
+
+static INLINE uint32
+bcmswap32by16(uint32 val)
+{
+       return BCMSWAP32BY16(val);
+}
+
+/* Reverse pairs of bytes in a buffer (not for high-performance use) */
+/* buf - start of buffer of shorts to swap */
+/* len  - byte length of buffer */
+static INLINE void
+bcmswap16_buf(uint16 *buf, uint len)
+{
+       len = len / 2;
+
+       while (len--) {
+               *buf = bcmswap16(*buf);
+               buf++;
+       }
+}
+
+/*
+ * Store 16-bit value to unaligned little-endian byte array.
+ */
+static INLINE void
+htol16_ua_store(uint16 val, uint8 *bytes)
+{
+       bytes[0] = val & 0xff;
+       bytes[1] = val >> 8;
+}
+
+/*
+ * Store 32-bit value to unaligned little-endian byte array.
+ */
+static INLINE void
+htol32_ua_store(uint32 val, uint8 *bytes)
+{
+       bytes[0] = val & 0xff;
+       bytes[1] = (val >> 8) & 0xff;
+       bytes[2] = (val >> 16) & 0xff;
+       bytes[3] = val >> 24;
+}
+
+/*
+ * Store 64-bit value to unaligned little-endian byte array.
+ */
+static INLINE void
+htol64_ua_store(uint64 val, uint8 *bytes)
+{
+       int i;
+       for (i = 0; i < sizeof(val); ++i) {
+               *bytes++ = (uint8)(val & 0xff);
+               val >>= 8;
+       }
+}
+
+/*
+ * Store 16-bit value to unaligned network-(big-)endian byte array.
+ */
+static INLINE void
+hton16_ua_store(uint16 val, uint8 *bytes)
+{
+       bytes[0] = val >> 8;
+       bytes[1] = val & 0xff;
+}
+
+/*
+ * Store 32-bit value to unaligned network-(big-)endian byte array.
+ */
+static INLINE void
+hton32_ua_store(uint32 val, uint8 *bytes)
+{
+       bytes[0] = val >> 24;
+       bytes[1] = (val >> 16) & 0xff;
+       bytes[2] = (val >> 8) & 0xff;
+       bytes[3] = val & 0xff;
+}
+
+/*
+ * Load 16-bit value from unaligned little-endian byte array.
+ */
+static INLINE uint16
+ltoh16_ua(const void *bytes)
+{
+       return _LTOH16_UA((const uint8 *)bytes);
+}
+
+/*
+ * Load 32-bit value from unaligned little-endian byte array.
+ */
+static INLINE uint32
+ltoh32_ua(const void *bytes)
+{
+       return _LTOH32_UA((const uint8 *)bytes);
+}
+
+/*
+ * Load 64-bit value from unaligned little-endian byte array.
+ */
+static INLINE uint64
+ltoh64_ua(const void *bytes)
+{
+       return _LTOH64_UA((const uint8 *)bytes);
+}
+
+/*
+ * Load 16-bit value from unaligned big-(network-)endian byte array.
+ */
+static INLINE uint16
+ntoh16_ua(const void *bytes)
+{
+       return _NTOH16_UA((const uint8 *)bytes);
+}
+
+/*
+ * Load 32-bit value from unaligned big-(network-)endian byte array.
+ */
+static INLINE uint32
+ntoh32_ua(const void *bytes)
+{
+       return _NTOH32_UA((const uint8 *)bytes);
+}
+
+/*
+ * Load 64-bit value from unaligned big-(network-)endian byte array.
+ */
+static INLINE uint64
+ntoh64_ua(const void *bytes)
+{
+       return _NTOH64_UA((const uint8 *)bytes);
+}
+
+#endif /* !__GNUC__ */
+#endif /* !_BCMENDIAN_H_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmerror.h b/bcmdhd.101.10.240.x/include/bcmerror.h
new file mode 100644 (file)
index 0000000..953c4fd
--- /dev/null
@@ -0,0 +1,521 @@
+/*
+ * Common header file for all error codes.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ *
+ *
+ *
+ */
+
+#ifndef        _bcmerror_h_
+#define        _bcmerror_h_
+
+#include <typedefs.h>
+
+/* Use error codes from this file only if BCMUTILS_ERR_CODES is defined. */
+#ifdef BCMUTILS_ERR_CODES
+
+/* NOTE re: Module specific error codes.
+ *
+ * BCME_.. error codes are extended by various features - e.g. FTM, NAN, SAE etc.
+ * The current process is to allocate a range of 1024 negative 32 bit integers to
+ * each module that extends the error codes to indicate a module specific status.
+ *
+ * The next range to use is below. If that range is used for a new feature, please
+ * update the range to be used by the next feature.
+ *
+ * Next available (inclusive) range: [-8*1024 + 1, -7*1024]
+ *
+ * Common error codes use BCME_ prefix. Firmware (wl) components should use the
+ * convention to prefix the error code name with WL_<Component>_E_ (e.g. WL_NAN_E_?).
+ * Non-wl components, other than common error codes use BCM_<Componennt>_E_
+ * prefix(e.g. BCM_FWSIGN_E_).
+ *
+ * End Note
+ */
+
+typedef int bcmerror_t;
+
+/*
+ * error codes could be added but the defined ones shouldn't be changed/deleted
+ * these error codes are exposed to the user code
+ * when ever a new error code is added to this list
+ * please update errorstring table with the related error string and
+ * update osl files with os specific errorcode map
+*/
+
+#define BCME_OK                                0       /* Success */
+#define BCME_ERROR                     -1      /* Error generic */
+#define BCME_BADARG                    -2      /* Bad Argument */
+#define BCME_BADOPTION                 -3      /* Bad option */
+#define BCME_NOTUP                     -4      /* Not up */
+#define BCME_NOTDOWN                   -5      /* Not down */
+#define BCME_NOTAP                     -6      /* Not AP */
+#define BCME_NOTSTA                    -7      /* Not STA  */
+#define BCME_BADKEYIDX                 -8      /* BAD Key Index */
+#define BCME_RADIOOFF                  -9      /* Radio Off */
+#define BCME_NOTBANDLOCKED             -10     /* Not  band locked */
+#define BCME_NOCLK                     -11     /* No Clock */
+#define BCME_BADRATESET                        -12     /* BAD Rate valueset */
+#define BCME_BADBAND                   -13     /* BAD Band */
+#define BCME_BUFTOOSHORT               -14     /* Buffer too short */
+#define BCME_BUFTOOLONG                        -15     /* Buffer too long */
+#define BCME_BUSY                      -16     /* Busy */
+#define BCME_NOTASSOCIATED             -17     /* Not Associated */
+#define BCME_BADSSIDLEN                        -18     /* Bad SSID len */
+#define BCME_OUTOFRANGECHAN            -19     /* Out of Range Channel */
+#define BCME_BADCHAN                   -20     /* Bad Channel */
+#define BCME_BADADDR                   -21     /* Bad Address */
+#define BCME_NORESOURCE                        -22     /* Not Enough Resources */
+#define BCME_UNSUPPORTED               -23     /* Unsupported */
+#define BCME_BADLEN                    -24     /* Bad length */
+#define BCME_NOTREADY                  -25     /* Not Ready */
+#define BCME_EPERM                     -26     /* Not Permitted */
+#define BCME_NOMEM                     -27     /* No Memory */
+#define BCME_ASSOCIATED                        -28     /* Associated */
+#define BCME_RANGE                     -29     /* Not In Range */
+#define BCME_NOTFOUND                  -30     /* Not Found */
+#define BCME_WME_NOT_ENABLED           -31     /* WME Not Enabled */
+#define BCME_TSPEC_NOTFOUND            -32     /* TSPEC Not Found */
+#define BCME_ACM_NOTSUPPORTED          -33     /* ACM Not Supported */
+#define BCME_NOT_WME_ASSOCIATION       -34     /* Not WME Association */
+#define BCME_SDIO_ERROR                        -35     /* SDIO Bus Error */
+#define BCME_DONGLE_DOWN               -36     /* Dongle Not Accessible */
+#define BCME_VERSION                   -37     /* Incorrect version */
+#define BCME_TXFAIL                    -38     /* TX failure */
+#define BCME_RXFAIL                    -39     /* RX failure */
+#define BCME_NODEVICE                  -40     /* Device not present */
+#define BCME_NMODE_DISABLED            -41     /* NMODE disabled */
+#define BCME_MSCH_DUP_REG              -42     /* Duplicate slot registration */
+#define BCME_SCANREJECT                        -43     /* reject scan request */
+#define BCME_USAGE_ERROR               -44     /* WLCMD usage error */
+#define BCME_IOCTL_ERROR               -45     /* WLCMD ioctl error */
+#define BCME_SERIAL_PORT_ERR           -46     /* RWL serial port error */
+#define BCME_DISABLED                  -47     /* Disabled in this build */
+#define BCME_DECERR                    -48     /* Decrypt error */
+#define BCME_ENCERR                    -49     /* Encrypt error */
+#define BCME_MICERR                    -50     /* Integrity/MIC error */
+#define BCME_REPLAY                    -51     /* Replay */
+#define BCME_IE_NOTFOUND               -52     /* IE not found */
+#define BCME_DATA_NOTFOUND             -53     /* Complete data not found in buffer */
+#define BCME_NOT_GC                    -54     /* expecting a group client */
+#define BCME_PRS_REQ_FAILED            -55     /* GC presence req failed to sent */
+#define BCME_NO_P2P_SE                 -56     /* Could not find P2P-Subelement */
+#define BCME_NOA_PND                   -57     /* NoA pending, CB shuld be NULL */
+#define BCME_FRAG_Q_FAILED             -58     /* queueing 80211 frag failedi */
+#define BCME_GET_AF_FAILED             -59     /* Get p2p AF pkt failed */
+#define BCME_MSCH_NOTREADY             -60     /* scheduler not ready */
+#define BCME_IOV_LAST_CMD              -61     /* last batched iov sub-command */
+#define BCME_MINIPMU_CAL_FAIL          -62     /* MiniPMU cal failed */
+#define BCME_RCAL_FAIL                 -63     /* Rcal failed */
+#define BCME_LPF_RCCAL_FAIL            -64     /* RCCAL failed */
+#define BCME_DACBUF_RCCAL_FAIL         -65     /* RCCAL failed */
+#define BCME_VCOCAL_FAIL               -66     /* VCOCAL failed */
+#define BCME_BANDLOCKED                        -67     /* interface is restricted to a band */
+#define BCME_BAD_IE_DATA               -68     /* Recieved ie with invalid/bad data */
+#define BCME_REG_FAILED                        -69     /* Generic registration failed */
+#define BCME_NOCHAN                    -70     /* Registration with 0 chans in list */
+#define BCME_PKTTOSS                   -71     /* Pkt tossed */
+#define BCME_DNGL_DEVRESET             -72     /* dongle re-attach during DEVRESET */
+#define BCME_ROAM                      -73     /* Roam related failures */
+
+#define BCME_LAST                      BCME_ROAM
+
+#define BCME_NOTENABLED BCME_DISABLED
+
+/* This error code is *internal* to the driver, and is not propogated to users. It should
+ * only be used by IOCTL patch handlers as an indication that it did not handle the IOCTL.
+ * (Since the error code is internal, an entry in 'BCMERRSTRINGTABLE' is not required,
+ * nor does it need to be part of any OSL driver-to-OS error code mapping).
+ */
+#define BCME_IOCTL_PATCH_UNSUPPORTED   -9999
+#if (BCME_LAST <= BCME_IOCTL_PATCH_UNSUPPORTED)
+       #error "BCME_LAST <= BCME_IOCTL_PATCH_UNSUPPORTED"
+#endif
+
+/* These are collection of BCME Error strings */
+#define BCMERRSTRINGTABLE {            \
+       "OK",                           \
+       "Undefined error",              \
+       "Bad Argument",                 \
+       "Bad Option",                   \
+       "Not up",                       \
+       "Not down",                     \
+       "Not AP",                       \
+       "Not STA",                      \
+       "Bad Key Index",                \
+       "Radio Off",                    \
+       "Not band locked",              \
+       "No clock",                     \
+       "Bad Rate valueset",            \
+       "Bad Band",                     \
+       "Buffer too short",             \
+       "Buffer too long",              \
+       "Busy",                         \
+       "Not Associated",               \
+       "Bad SSID len",                 \
+       "Out of Range Channel",         \
+       "Bad Channel",                  \
+       "Bad Address",                  \
+       "Not Enough Resources",         \
+       "Unsupported",                  \
+       "Bad length",                   \
+       "Not Ready",                    \
+       "Not Permitted",                \
+       "No Memory",                    \
+       "Associated",                   \
+       "Not In Range",                 \
+       "Not Found",                    \
+       "WME Not Enabled",              \
+       "TSPEC Not Found",              \
+       "ACM Not Supported",            \
+       "Not WME Association",          \
+       "SDIO Bus Error",               \
+       "Dongle Not Accessible",        \
+       "Incorrect version",            \
+       "TX Failure",                   \
+       "RX Failure",                   \
+       "Device Not Present",           \
+       "NMODE Disabled",               \
+       "Host Offload in device",       \
+       "Scan Rejected",                \
+       "WLCMD usage error",            \
+       "WLCMD ioctl error",            \
+       "RWL serial port error",        \
+       "Disabled",                     \
+       "Decrypt error", \
+       "Encrypt error", \
+       "MIC error", \
+       "Replay", \
+       "IE not found", \
+       "Data not found", \
+       "NOT GC", \
+       "PRS REQ FAILED", \
+       "NO P2P SubElement", \
+       "NOA Pending", \
+       "FRAG Q FAILED", \
+       "GET ActionFrame failed", \
+       "scheduler not ready", \
+       "Last IOV batched sub-cmd", \
+       "Mini PMU Cal failed", \
+       "R-cal failed", \
+       "LPF RC Cal failed", \
+       "DAC buf RC Cal failed", \
+       "VCO Cal failed", \
+       "band locked", \
+       "Recieved ie with invalid data", \
+       "registration failed", \
+       "Registration with zero channels", \
+       "pkt toss", \
+       "Dongle Devreset", \
+       "Roam specific errors", \
+}
+
+/** status - TBD BCME_ vs proxd status - range reserved for BCME_ */
+enum {
+       WL_PROXD_E_LAST                 = -1056,
+       WL_PROXD_E_NOAVAIL              = -1056,
+       WL_PROXD_E_EXT_SCHED            = -1055,
+       WL_PROXD_E_NOT_BCM              = -1054,
+       WL_PROXD_E_FRAME_TYPE           = -1053,
+       WL_PROXD_E_VERNOSUPPORT         = -1052,
+       WL_PROXD_E_SEC_NOKEY            = -1051,
+       WL_PROXD_E_SEC_POLICY           = -1050,
+       WL_PROXD_E_SCAN_INPROCESS       = -1049,
+       WL_PROXD_E_BAD_PARTIAL_TSF      = -1048,
+       WL_PROXD_E_SCANFAIL             = -1047,
+       WL_PROXD_E_NOTSF                = -1046,
+       WL_PROXD_E_POLICY               = -1045,
+       WL_PROXD_E_INCOMPLETE           = -1044,
+       WL_PROXD_E_OVERRIDDEN           = -1043,
+       WL_PROXD_E_ASAP_FAILED          = -1042,
+       WL_PROXD_E_NOTSTARTED           = -1041,
+       WL_PROXD_E_INVALIDMEAS          = -1040,
+       WL_PROXD_E_INCAPABLE            = -1039,
+       WL_PROXD_E_MISMATCH             = -1038,
+       WL_PROXD_E_DUP_SESSION          = -1037,
+       WL_PROXD_E_REMOTE_FAIL          = -1036,
+       WL_PROXD_E_REMOTE_INCAPABLE     = -1035,
+       WL_PROXD_E_SCHED_FAIL           = -1034,
+       WL_PROXD_E_PROTO                = -1033,
+       WL_PROXD_E_EXPIRED              = -1032,
+       WL_PROXD_E_TIMEOUT              = -1031,
+       WL_PROXD_E_NOACK                = -1030,
+       WL_PROXD_E_DEFERRED             = -1029,
+       WL_PROXD_E_INVALID_SID          = -1028,
+       WL_PROXD_E_REMOTE_CANCEL        = -1027,
+       WL_PROXD_E_CANCELED             = -1026,        /**< local */
+       WL_PROXD_E_INVALID_SESSION      = -1025,
+       WL_PROXD_E_BAD_STATE            = -1024,
+       WL_PROXD_E_START                = -1024,
+       WL_PROXD_E_ERROR                = -1,
+       WL_PROXD_E_OK                   = 0
+};
+typedef int32 wl_proxd_status_t;
+
+/** status - TBD BCME_ vs NAN status - range reserved for BCME_ */
+enum {
+       /* add new status here... */
+       WL_NAN_E_NO_ACTION              = -2136,        /* status for no action */
+       WL_NAN_E_INVALID_TOKEN          = -2135,        /* invalid token or mismatch */
+       WL_NAN_E_INVALID_ATTR           = -2134,        /* generic invalid attr error */
+       WL_NAN_E_INVALID_NDL_ATTR       = -2133,        /* invalid NDL attribute */
+       WL_NAN_E_SCB_NORESOURCE         = -2132,        /* no more peer scb available */
+       WL_NAN_E_PEER_NOTAVAIL          = -2131,
+       WL_NAN_E_SCB_EXISTS             = -2130,
+       WL_NAN_E_INVALID_PEER_NDI       = -2129,
+       WL_NAN_E_INVALID_LOCAL_NDI      = -2128,
+       WL_NAN_E_ALREADY_EXISTS         = -2127,        /* generic NAN error for duplication */
+       WL_NAN_E_EXCEED_MAX_NUM_MAPS    = -2126,
+       WL_NAN_E_INVALID_DEV_CHAN_SCHED = -2125,
+       WL_NAN_E_INVALID_PEER_BLOB_TYPE = -2124,
+       WL_NAN_E_INVALID_LCL_BLOB_TYPE  = -2123,
+       WL_NAN_E_BCMC_PDPA              = -2122,        /* BCMC NAF PDPA */
+       WL_NAN_E_TIMEOUT                = -2121,
+       WL_NAN_E_HOST_CFG               = -2120,
+       WL_NAN_E_NO_ACK                 = -2119,
+       WL_NAN_E_SECINST_FAIL           = -2118,
+       WL_NAN_E_REJECT_NDL             = -2117,        /* generic NDL rejection error */
+       WL_NAN_E_INVALID_NDP_ATTR       = -2116,
+       WL_NAN_E_HOST_REJECTED          = -2115,
+       WL_NAN_E_PCB_NORESOURCE         = -2114,
+       WL_NAN_E_NDC_EXISTS             = -2113,
+       WL_NAN_E_NO_NDC_ENTRY_AVAIL     = -2112,
+       WL_NAN_E_INVALID_NDC_ENTRY      = -2111,
+       WL_NAN_E_SD_TX_LIST_FULL        = -2110,
+       WL_NAN_E_SVC_SUB_LIST_FULL      = -2109,
+       WL_NAN_E_SVC_PUB_LIST_FULL      = -2108,
+       WL_NAN_E_SDF_MAX_LEN_EXCEEDED   = -2107,
+       WL_NAN_E_ZERO_CRB               = -2106,        /* no CRB between local and peer */
+       WL_NAN_E_PEER_NDC_NOT_SELECTED  = -2105,        /* peer ndc not selected */
+       WL_NAN_E_DAM_CHAN_CONFLICT      = -2104,        /* dam schedule channel conflict */
+       WL_NAN_E_DAM_SCHED_PERIOD       = -2103,        /* dam schedule period mismatch */
+       WL_NAN_E_LCL_NDC_NOT_SELECTED   = -2102,        /* local selected ndc not configured */
+       WL_NAN_E_NDL_QOS_INVALID_NA     = -2101,        /* na doesn't comply with ndl qos */
+       WL_NAN_E_CLEAR_NAF_WITH_SA_AS_RNDI = -2100,     /* rx clear naf with peer rndi */
+       WL_NAN_E_SEC_CLEAR_PKT          = -2099,        /* rx clear pkt from a peer with sec_sa */
+       WL_NAN_E_PROT_NON_PDPA_NAF      = -2098,        /* rx protected non PDPA frame */
+       WL_NAN_E_DAM_DOUBLE_REMOVE      = -2097,        /* remove peer schedule already removed */
+       WL_NAN_E_DAM_DOUBLE_MERGE       = -2096,        /* merge peer schedule already merged */
+       WL_NAN_E_DAM_REJECT_INVALID     = -2095,        /* reject for invalid schedule */
+       WL_NAN_E_DAM_REJECT_RANGE       = -2094,
+       WL_NAN_E_DAM_REJECT_QOS         = -2093,
+       WL_NAN_E_DAM_REJECT_NDC         = -2092,
+       WL_NAN_E_DAM_REJECT_PEER_IMMUT  = -2091,
+       WL_NAN_E_DAM_REJECT_LCL_IMMUT   = -2090,
+       WL_NAN_E_DAM_EXCEED_NUM_SCHED   = -2089,
+       WL_NAN_E_DAM_INVALID_SCHED_MAP  = -2088,        /* invalid schedule map list */
+       WL_NAN_E_DAM_INVALID_LCL_SCHED  = -2087,
+       WL_NAN_E_INVALID_MAP_ID         = -2086,
+       WL_NAN_E_CHAN_OVERLAP_ACROSS_MAP = -2085,
+       WL_NAN_E_INVALID_CHAN_LIST      = -2084,
+       WL_NAN_E_INVALID_RANGE_TBMP     = -2083,
+       WL_NAN_E_INVALID_IMMUT_SCHED    = -2082,
+       WL_NAN_E_INVALID_NDC_ATTR       = -2081,
+       WL_NAN_E_INVALID_TIME_BITMAP    = -2080,
+       WL_NAN_E_INVALID_NA_ATTR        = -2079,
+       WL_NAN_E_NO_NA_ATTR_IN_AVAIL_MAP = -2078,       /* no na attr saved in avail map */
+       WL_NAN_E_INVALID_MAP_IDX        = -2077,
+       WL_NAN_E_SEC_SA_NOTFOUND        = -2076,
+       WL_NAN_E_BSSCFG_NOTFOUND        = -2075,
+       WL_NAN_E_SCB_NOTFOUND           = -2074,
+       WL_NAN_E_NCS_SK_KDESC_TYPE      = -2073,
+       WL_NAN_E_NCS_SK_KEY_DESC_VER    = -2072,        /* key descr ver */
+       WL_NAN_E_NCS_SK_KEY_TYPE        = -2071,        /* key descr type */
+       WL_NAN_E_NCS_SK_KEYINFO_FAIL    = -2070,        /* key info (generic) */
+       WL_NAN_E_NCS_SK_KEY_LEN         = -2069,        /* key len */
+       WL_NAN_E_NCS_SK_KDESC_NOT_FOUND = -2068,        /* key desc not found */
+       WL_NAN_E_NCS_SK_INVALID_PARAMS  = -2067,        /* invalid args */
+       WL_NAN_E_NCS_SK_KDESC_INVALID   = -2066,        /* key descr is not valid */
+       WL_NAN_E_NCS_SK_NONCE_MISMATCH  = -2065,
+       WL_NAN_E_NCS_SK_KDATA_SAVE_FAIL = -2064,        /* not able to save key data */
+       WL_NAN_E_NCS_SK_AUTH_TOKEN_CALC_FAIL = -2063,
+       WL_NAN_E_NCS_SK_PTK_CALC_FAIL   = -2062,
+       WL_NAN_E_INVALID_STARTOFFSET    = -2061,
+       WL_NAN_E_BAD_NA_ENTRY_TYPE      = -2060,
+       WL_NAN_E_INVALID_CHANBMP        = -2059,
+       WL_NAN_E_INVALID_OP_CLASS       = -2058,
+       WL_NAN_E_NO_IES                 = -2057,
+       WL_NAN_E_NO_PEER_ENTRY_AVAIL    = -2056,
+       WL_NAN_E_INVALID_PEER           = -2055,
+       WL_NAN_E_PEER_EXISTS            = -2054,
+       WL_NAN_E_PEER_NOTFOUND          = -2053,
+       WL_NAN_E_NO_MEM                 = -2052,
+       WL_NAN_E_INVALID_OPTION         = -2051,
+       WL_NAN_E_INVALID_BAND           = -2050,
+       WL_NAN_E_INVALID_MAC            = -2049,
+       WL_NAN_E_BAD_INSTANCE           = -2048,
+       /* NAN status code reserved from -2048 to -3071 */
+       /* Do NOT add new status below -2048 */
+       WL_NAN_E_ERROR                  = -1,
+       WL_NAN_E_OK                     = 0
+};
+
+/* SAE (Simultaneous Authentication of Equals) status codes.
+ * SAE status codes are reserved from -3072 to -4095 (1K)
+ */
+enum {
+       WL_SAE_E_AUTH_FAILURE                   = -3072,
+       /* Discard silently */
+       WL_SAE_E_AUTH_DISCARD                   = -3073,
+       /* Authentication in progress */
+       WL_SAE_E_AUTH_CONTINUE                  = -3074,
+       /* Invalid scalar/elt */
+       WL_SAE_E_AUTH_COMMIT_INVALID            = -3075,
+       /* Invalid confirm token */
+       WL_SAE_E_AUTH_CONFIRM_INVALID           = -3076,
+       /* Peer scalar validation failure */
+       WL_SAE_E_CRYPTO_SCALAR_VALIDATION       = -3077,
+       /* Peer element prime validation failure */
+       WL_SAE_E_CRYPTO_ELE_PRIME_VALIDATION    = -3078,
+       /* Peer element is not on the curve */
+       WL_SAE_E_CRYPTO_ELE_NOT_ON_CURVE        = -3079,
+       /* Generic EC error (eliptic curve related) */
+       WL_SAE_E_CRYPTO_EC_ERROR                = -3080,
+       /* Both local and peer mac addrs are same */
+       WL_SAE_E_CRYPTO_EQUAL_MACADDRS          = -3081,
+       /* Loop exceeded in deriving the scalar */
+       WL_SAE_E_CRYPTO_SCALAR_ITER_EXCEEDED    = -3082,
+       /* ECC group is unsupported */
+       WL_SAE_E_CRYPTO_UNSUPPORTED_GROUP       = -3083,
+       /* Exceeded the hunting-and-pecking counter */
+       WL_SAE_E_CRYPTO_PWE_COUNTER_EXCEEDED    = -3084,
+       /* SAE crypto component is not initialized */
+       WL_SAE_E_CRYPTO_NOT_INITED              = -3085,
+       /* bn_get has failed */
+       WL_SAE_E_CRYPTO_BN_GET_ERROR            = -3086,
+       /* bn_set has failed */
+       WL_SAE_E_CRYPTO_BN_SET_ERROR            = -3087,
+       /* PMK is not computed yet */
+       WL_SAE_E_CRYPTO_PMK_UNAVAILABLE         = -3088,
+       /* Peer confirm did not match */
+       WL_SAE_E_CRYPTO_CONFIRM_MISMATCH        = -3089,
+       /* Element K is at infinity no the curve */
+       WL_SAE_E_CRYPTO_KEY_AT_INFINITY         = -3090,
+       /* SAE Crypto private data magic number mismatch */
+       WL_SAE_E_CRYPTO_PRIV_MAGIC_MISMATCH     = -3091,
+       /* Max retry exhausted */
+       WL_SAE_E_MAX_RETRY_LIMIT_REACHED        = -3092,
+       /* peer sent password ID mismatch to local */
+       WL_SAE_E_AUTH_PEER_PWDID_MISMATCH       = -3093,
+       /* user not configured password */
+       WL_SAE_E_AUTH_PASSWORD_NOT_CONFIGURED   = -3094,
+       /* user not configured password ID */
+       WL_SAE_E_AUTH_PWDID_NOT_CONFIGURED      = -3095,
+       /* Anti-clogging token mismatch */
+       WL_SAE_E_AUTH_ANTI_CLOG_MISMATCH        = -3096,
+       /* SAE PWE method mismatch */
+       WL_SAE_E_AUTH_PWE_MISMATCH              = -3097
+};
+
+/*
+ * Firmware signing error code range: -4096...-5119
+ */
+enum {
+       /* okay */
+       BCM_FWSIGN_E_OK                         = 0,
+
+       /* Operation is in progress */
+       BCM_FWSIGN_E_INPROGRESS                 = -4096,
+
+       /* version mismatch */
+       BCM_FWSIGN_E_VERSION                    = -4097,
+
+       /* key not found */
+       BCM_FWSIGN_E_KEY_NOT_FOUND              = -4098,
+
+       /* key found, but is not valid (revoked) */
+       BCM_FWSIGN_E_KEY_NOT_VALID              = -4099,
+
+       /* Cipher suite id mismatch for the key */
+       BCM_FWSIGN_E_CS_ID_MISMATCH             = -4100,
+
+       /* Signature does not match */
+       BCM_FWSIGN_E_SIGNATURE                  = -4101,
+
+       /* Continue */
+       BCM_FWSIGN_E_CONTINUE                   = -4102,
+
+       /* Heap is too small */
+       BCM_FWSIGN_E_HEAP_TOO_SMALL             = -4103,
+
+       /* Allocation of bn ctx failed */
+       BCM_FWSIGN_E_BN_CTX_ALLOC_FAILED        = -4104,
+
+       /* possible bug */
+       BCM_FWSIGN_E_BUGCHECK                   = -4105,
+
+       /* chosen key is invalid */
+       BCM_FWSIGN_E_INVALID_KEY                = -4106,
+
+       /* signature is invalid */
+       BCM_FWSIGN_E_INVALID_SIGNATURE          = -4107,
+
+       /* signature tlv missing */
+       BCM_FWSIGN_E_NO_CSID_SIG                = -4108,
+
+       /* chosen key is invalid */
+       BCM_FWSIGN_E_REVOKED_KEY                = -4109,
+
+       /* signature has no matching valid key in ROM */
+       BCM_FWSIGN_E_NO_OTP_FOR_ROM_KEY         = -4110,
+
+       /* Compression not supported */
+       BCM_FWSIGN_E_COMPNOTSUP                 = -4111,
+
+       /* OTP read error */
+       BCM_FWSIGN_E_OTP_READ                   = -4112,
+
+       /* last error */
+       BCM_FWSIGN_E_LAST                       = -5119
+};
+typedef int32 bcm_fwsign_status_t;
+
+/* PMK manager block. Event codes from -5120 to -6143 */
+/* PSK hashing event codes */
+enum {
+       WL_PMK_E_PSK_HASH_FAILED                = -5120,
+       WL_PMK_E_PSK_HASH_DONE                  = -5121,
+       WL_PMK_E_PSK_HASH_RUNNING               = -5122,
+       WL_PMK_E_PSK_INVALID                    = -5123,
+       WL_PMK_E_PSK_NOMEM                      = -5124
+};
+
+/*
+ * SOE (Security Offload Engine) status codes.
+ * SOE status codes are reserved from -6144 to -7167 (1K)
+ */
+enum {
+       /* Invalid operational context */
+       WL_SOE_E_BAD_OP_CONTEXT                 = -6144,
+
+       /* Invalid operational type */
+       WL_SOE_E_BAD_OP_TYPE                    = -6145,
+
+       /* Failure to get NAF3 encoded scalar */
+       WL_SOE_E_BN_NAF3_GET_ERROR              = -6146,
+
+       /* Failure to get NAF3 params */
+       WL_SOE_E_NAF3_PARAMS_GET_ERROR          = -6147
+};
+
+#endif /* BCMUTILS_ERR_CODES */
+
+#endif /* _bcmerror_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmeth.h b/bcmdhd.101.10.240.x/include/bcmeth.h
new file mode 100644 (file)
index 0000000..f433437
--- /dev/null
@@ -0,0 +1,109 @@
+/*
+ * Broadcom Ethernettype  protocol definitions
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+/*
+ * Broadcom Ethernet protocol defines
+ */
+
+#ifndef _BCMETH_H_
+#define _BCMETH_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* ETHER_TYPE_BRCM is defined in ethernet.h */
+
+/*
+ * Following the 2byte BRCM ether_type is a 16bit BRCM subtype field
+ * in one of two formats: (only subtypes 32768-65535 are in use now)
+ *
+ * subtypes 0-32767:
+ *     8 bit subtype (0-127)
+ *     8 bit length in bytes (0-255)
+ *
+ * subtypes 32768-65535:
+ *     16 bit big-endian subtype
+ *     16 bit big-endian length in bytes (0-65535)
+ *
+ * length is the number of additional bytes beyond the 4 or 6 byte header
+ *
+ * Reserved values:
+ * 0 reserved
+ * 5-15 reserved for iLine protocol assignments
+ * 17-126 reserved, assignable
+ * 127 reserved
+ * 32768 reserved
+ * 32769-65534 reserved, assignable
+ * 65535 reserved
+ */
+
+/*
+ * While adding the subtypes and their specific processing code make sure
+ * bcmeth_bcm_hdr_t is the first data structure in the user specific data structure definition
+ */
+
+#define        BCMILCP_SUBTYPE_RATE            1
+#define        BCMILCP_SUBTYPE_LINK            2
+#define        BCMILCP_SUBTYPE_CSA             3
+#define        BCMILCP_SUBTYPE_LARQ            4
+#define BCMILCP_SUBTYPE_VENDOR         5
+#define        BCMILCP_SUBTYPE_FLH             17
+
+#define BCMILCP_SUBTYPE_VENDOR_LONG    32769
+#define BCMILCP_SUBTYPE_CERT           32770
+#define BCMILCP_SUBTYPE_SES            32771
+
+#define BCMILCP_BCM_SUBTYPE_RESERVED           0
+#define BCMILCP_BCM_SUBTYPE_EVENT              1
+#define BCMILCP_BCM_SUBTYPE_SES                        2
+/*
+ * The EAPOL type is not used anymore. Instead EAPOL messages are now embedded
+ * within BCMILCP_BCM_SUBTYPE_EVENT type messages
+ */
+/* #define BCMILCP_BCM_SUBTYPE_EAPOL           3 */
+#define BCMILCP_BCM_SUBTYPE_DPT                 4
+#define BCMILCP_BCM_SUBTYPE_DNGLEVENT       5
+
+#define BCMILCP_BCM_SUBTYPEHDR_MINLENGTH       8
+#define BCMILCP_BCM_SUBTYPEHDR_VERSION         0
+#define BCMILCP_BCM_SUBTYPE_EVENT_DATA_PAD     2
+
+/* These fields are stored in network order */
+typedef BWL_PRE_PACKED_STRUCT struct bcmeth_hdr
+{
+       uint16  subtype;        /* Vendor specific..32769 */
+       uint16  length;
+       uint8   version;        /* Version is 0 */
+       uint8   oui[3];         /* Broadcom OUI */
+       /* user specific Data */
+       uint16  usr_subtype;
+} BWL_POST_PACKED_STRUCT bcmeth_hdr_t;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /*  _BCMETH_H_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmevent.h b/bcmdhd.101.10.240.x/include/bcmevent.h
new file mode 100644 (file)
index 0000000..cee9a56
--- /dev/null
@@ -0,0 +1,1441 @@
+/*
+ * Broadcom Event  protocol definitions
+ *
+ * Dependencies: bcmeth.h
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ *
+ */
+
+/*
+ * Broadcom Ethernet Events protocol defines
+ *
+ */
+
+#ifndef _BCMEVENT_H_
+#define _BCMEVENT_H_
+
+#include <typedefs.h>
+/* #include <ethernet.h> -- TODO: req., excluded to overwhelming coupling (break up ethernet.h) */
+#include <bcmeth.h>
+#if defined(DNGL_EVENT_SUPPORT)
+#include <dnglevent.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#define BCM_EVENT_MSG_VERSION          2       /* wl_event_msg_t struct version */
+#define BCM_MSG_IFNAME_MAX             16      /* max length of interface name */
+
+/* flags */
+#define WLC_EVENT_MSG_LINK             0x01    /* link is up */
+#define WLC_EVENT_MSG_FLUSHTXQ         0x02    /* flush tx queue on MIC error */
+#define WLC_EVENT_MSG_GROUP            0x04    /* group MIC error */
+#define WLC_EVENT_MSG_UNKBSS           0x08    /* unknown source bsscfg */
+#define WLC_EVENT_MSG_UNKIF            0x10    /* unknown source OS i/f */
+
+/* these fields are stored in network order */
+
+/* version 1 */
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+       uint16  version;
+       uint16  flags;                  /* see flags below */
+       uint32  event_type;             /* Message (see below) */
+       uint32  status;                 /* Status code (see below) */
+       uint32  reason;                 /* Reason code (if applicable) */
+       uint32  auth_type;              /* WLC_E_AUTH */
+       uint32  datalen;                /* data buf */
+       struct ether_addr       addr;   /* Station address (if applicable) */
+       char    ifname[BCM_MSG_IFNAME_MAX]; /* name of the packet incoming interface */
+} BWL_POST_PACKED_STRUCT wl_event_msg_v1_t;
+
+/* the current version */
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+       uint16  version;
+       uint16  flags;                  /* see flags below */
+       uint32  event_type;             /* Message (see below) */
+       uint32  status;                 /* Status code (see below) */
+       uint32  reason;                 /* Reason code (if applicable) */
+       uint32  auth_type;              /* WLC_E_AUTH */
+       uint32  datalen;                /* data buf */
+       struct ether_addr       addr;   /* Station address (if applicable) */
+       char    ifname[BCM_MSG_IFNAME_MAX]; /* name of the packet incoming interface */
+       uint8   ifidx;                  /* destination OS i/f index */
+       uint8   bsscfgidx;              /* source bsscfg index */
+} BWL_POST_PACKED_STRUCT wl_event_msg_t;
+
+/* used by driver msgs */
+typedef BWL_PRE_PACKED_STRUCT struct bcm_event {
+       struct ether_header eth;
+       bcmeth_hdr_t            bcm_hdr;
+       wl_event_msg_t          event;
+       /* data portion follows */
+} BWL_POST_PACKED_STRUCT bcm_event_t;
+
+/*
+ * used by host event
+ * note: if additional event types are added, it should go with is_wlc_event_frame() as well.
+ */
+typedef union bcm_event_msg_u {
+       wl_event_msg_t          event;
+#if defined(DNGL_EVENT_SUPPORT)
+       bcm_dngl_event_msg_t    dngl_event;
+#endif
+
+       /* add new event here */
+} bcm_event_msg_u_t;
+
+#define BCM_MSG_LEN    (sizeof(bcm_event_t) - sizeof(bcmeth_hdr_t) - sizeof(struct ether_header))
+
+/* Event messages */
+#define WLC_E_SET_SSID         0       /* indicates status of set SSID */
+#define WLC_E_JOIN             1       /* differentiates join IBSS from found (WLC_E_START) IBSS */
+#define WLC_E_START            2       /* STA founded an IBSS or AP started a BSS */
+#define WLC_E_AUTH             3       /* 802.11 AUTH request */
+#define WLC_E_AUTH_IND         4       /* 802.11 AUTH indication */
+#define WLC_E_DEAUTH           5       /* 802.11 DEAUTH request */
+#define WLC_E_DEAUTH_IND       6       /* 802.11 DEAUTH indication */
+#define WLC_E_ASSOC            7       /* 802.11 ASSOC request */
+#define WLC_E_ASSOC_IND                8       /* 802.11 ASSOC indication */
+#define WLC_E_REASSOC          9       /* 802.11 REASSOC request */
+#define WLC_E_REASSOC_IND      10      /* 802.11 REASSOC indication */
+#define WLC_E_DISASSOC         11      /* 802.11 DISASSOC request */
+#define WLC_E_DISASSOC_IND     12      /* 802.11 DISASSOC indication */
+#define WLC_E_QUIET_START      13      /* 802.11h Quiet period started */
+#define WLC_E_QUIET_END                14      /* 802.11h Quiet period ended */
+#define WLC_E_BEACON_RX                15      /* BEACONS received/lost indication */
+#define WLC_E_LINK             16      /* generic link indication */
+#define WLC_E_MIC_ERROR                17      /* TKIP MIC error occurred */
+#define WLC_E_NDIS_LINK                18      /* NDIS style link indication */
+#define WLC_E_ROAM             19      /* roam complete: indicate status & reason */
+#define WLC_E_TXFAIL           20      /* change in dot11FailedCount (txfail) */
+#define WLC_E_PMKID_CACHE      21      /* WPA2 pmkid cache indication */
+#define WLC_E_RETROGRADE_TSF   22      /* current AP's TSF value went backward */
+#define WLC_E_PRUNE            23      /* AP was pruned from join list for reason */
+#define WLC_E_AUTOAUTH         24      /* report AutoAuth table entry match for join attempt */
+#define WLC_E_EAPOL_MSG                25      /* Event encapsulating an EAPOL message */
+#define WLC_E_SCAN_COMPLETE    26      /* Scan results are ready or scan was aborted */
+#define WLC_E_ADDTS_IND                27      /* indicate to host addts fail/success */
+#define WLC_E_DELTS_IND                28      /* indicate to host delts fail/success */
+#define WLC_E_BCNSENT_IND      29      /* indicate to host of beacon transmit */
+#define WLC_E_BCNRX_MSG                30      /* Send the received beacon up to the host */
+#define WLC_E_BCNLOST_MSG      31      /* indicate to host loss of beacon */
+#define WLC_E_ROAM_PREP                32      /* before attempting to roam association */
+#define WLC_E_PFN_NET_FOUND    33      /* PFN network found event */
+#define WLC_E_PFN_NET_LOST     34      /* PFN network lost event */
+#define WLC_E_RESET_COMPLETE   35
+#define WLC_E_JOIN_START       36
+#define WLC_E_ROAM_START       37      /* roam attempt started: indicate reason */
+#define WLC_E_ASSOC_START      38
+#define WLC_E_IBSS_ASSOC       39
+#define WLC_E_RADIO            40
+#define WLC_E_PSM_WATCHDOG     41      /* PSM microcode watchdog fired */
+
+#define WLC_E_PROBREQ_MSG       44      /* probe request received */
+#define WLC_E_SCAN_CONFIRM_IND  45
+#define WLC_E_PSK_SUP          46      /* WPA Handshake fail */
+#define WLC_E_COUNTRY_CODE_CHANGED     47
+#define        WLC_E_EXCEEDED_MEDIUM_TIME      48      /* WMMAC excedded medium time */
+#define WLC_E_ICV_ERROR                49      /* WEP ICV error occurred */
+#define WLC_E_UNICAST_DECODE_ERROR     50      /* Unsupported unicast encrypted frame */
+#define WLC_E_MULTICAST_DECODE_ERROR   51      /* Unsupported multicast encrypted frame */
+#define WLC_E_TRACE            52
+#define WLC_E_IF               54      /* I/F change (for dongle host notification) */
+#define WLC_E_P2P_DISC_LISTEN_COMPLETE 55      /* listen state expires */
+#define WLC_E_RSSI             56      /* indicate RSSI change based on configured levels */
+#define WLC_E_PFN_BEST_BATCHING        57      /* PFN best network batching event */
+#define WLC_E_EXTLOG_MSG       58
+#define WLC_E_ACTION_FRAME      59     /* Action frame Rx */
+#define WLC_E_ACTION_FRAME_COMPLETE    60      /* Action frame Tx complete */
+#define WLC_E_PRE_ASSOC_IND    61      /* assoc request received */
+#define WLC_E_PRE_REASSOC_IND  62      /* re-assoc request received */
+#ifdef CSI_SUPPORT
+#define WLC_E_CSI              63
+#else
+#define WLC_E_CHANNEL_ADOPTED  63      /* channel adopted (obsoleted) */
+#endif /* CSI_SUPPORT */
+#define WLC_E_AP_STARTED       64      /* AP started */
+#define WLC_E_DFS_AP_STOP      65      /* AP stopped due to DFS */
+#define WLC_E_DFS_AP_RESUME    66      /* AP resumed due to DFS */
+#define WLC_E_WAI_STA_EVENT    67      /* WAI stations event */
+#define WLC_E_WAI_MSG          68      /* event encapsulating an WAI message */
+#define WLC_E_ESCAN_RESULT     69      /* escan result event */
+#define WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE   70      /* action frame off channel complete */
+#define WLC_E_PROBRESP_MSG     71      /* probe response received */
+#define WLC_E_P2P_PROBREQ_MSG  72      /* P2P Probe request received */
+#define WLC_E_DCS_REQUEST      73
+/* will enable this after proptxstatus code is merged back to ToT */
+#define WLC_E_FIFO_CREDIT_MAP  74      /* credits for D11 FIFOs. [AC0,AC1,AC2,AC3,BC_MC,ATIM] */
+#define WLC_E_ACTION_FRAME_RX  75      /* Received action frame event WITH
+                                        * wl_event_rx_frame_data_t header
+                                        */
+#define WLC_E_WAKE_EVENT       76      /* Wake Event timer fired, used for wake WLAN test mode */
+#define WLC_E_RM_COMPLETE      77      /* Radio measurement complete */
+#define WLC_E_HTSFSYNC         78      /* Synchronize TSF with the host */
+#define WLC_E_OVERLAY_REQ      79      /* request an overlay IOCTL/iovar from the host */
+#define WLC_E_CSA_COMPLETE_IND         80      /* 802.11 CHANNEL SWITCH ACTION completed */
+#define WLC_E_EXCESS_PM_WAKE_EVENT     81      /* excess PM Wake Event to inform host  */
+#define WLC_E_PFN_SCAN_NONE            82      /* no PFN networks around */
+/* PFN BSSID network found event, conflict/share with  WLC_E_PFN_SCAN_NONE */
+#define WLC_E_PFN_BSSID_NET_FOUND      82
+#define WLC_E_PFN_SCAN_ALLGONE         83      /* last found PFN network gets lost */
+/* PFN BSSID network lost event, conflict/share with WLC_E_PFN_SCAN_ALLGONE */
+#define WLC_E_PFN_BSSID_NET_LOST       83
+#define WLC_E_GTK_PLUMBED              84
+#define WLC_E_ASSOC_IND_NDIS           85      /* 802.11 ASSOC indication for NDIS only */
+#define WLC_E_REASSOC_IND_NDIS         86      /* 802.11 REASSOC indication for NDIS only */
+#define WLC_E_ASSOC_REQ_IE             87
+#define WLC_E_ASSOC_RESP_IE            88
+#define WLC_E_ASSOC_RECREATED          89      /* association recreated on resume */
+#define WLC_E_ACTION_FRAME_RX_NDIS     90      /* rx action frame event for NDIS only */
+#define WLC_E_AUTH_REQ                 91      /* authentication request received */
+#define WLC_E_TDLS_PEER_EVENT          92      /* discovered peer, connected/disconnected peer */
+#define WLC_E_SPEEDY_RECREATE_FAIL     93      /* fast assoc recreation failed */
+#define WLC_E_NATIVE                   94      /* port-specific event and payload (e.g. NDIS) */
+#define WLC_E_PKTDELAY_IND             95      /* event for tx pkt delay suddently jump */
+
+#define WLC_E_PSTA_PRIMARY_INTF_IND    99      /* psta primary interface indication */
+#define WLC_E_NAN                      100     /* NAN event - Reserved for future */
+#define WLC_E_BEACON_FRAME_RX          101
+#define WLC_E_SERVICE_FOUND            102     /* desired service found */
+#define WLC_E_GAS_FRAGMENT_RX          103     /* GAS fragment received */
+#define WLC_E_GAS_COMPLETE             104     /* GAS sessions all complete */
+#define WLC_E_P2PO_ADD_DEVICE          105     /* New device found by p2p offload */
+#define WLC_E_P2PO_DEL_DEVICE          106     /* device has been removed by p2p offload */
+#define WLC_E_WNM_STA_SLEEP            107     /* WNM event to notify STA enter sleep mode */
+#define WLC_E_TXFAIL_THRESH            108     /* Indication of MAC tx failures (exhaustion of
+                                                * 802.11 retries) exceeding threshold(s)
+                                                */
+#define WLC_E_PROXD                    109     /* Proximity Detection event */
+#define WLC_E_IBSS_COALESCE            110     /* IBSS Coalescing */
+#define WLC_E_AIBSS_TXFAIL             110     /* TXFAIL event for AIBSS, re using event 110 */
+#define WLC_E_BSS_LOAD                 114     /* Inform host of beacon bss load */
+#define WLC_E_MIMO_PWR_SAVE            115     /* Inform host MIMO PWR SAVE learning events */
+#define WLC_E_LEAKY_AP_STATS   116 /* Inform host leaky Ap stats events */
+#define WLC_E_ALLOW_CREDIT_BORROW 117  /* Allow or disallow wlfc credit borrowing in DHD */
+#define WLC_E_MSCH                     120     /* Multiple channel scheduler event */
+#define WLC_E_CSA_START_IND            121
+#define WLC_E_CSA_DONE_IND             122
+#define WLC_E_CSA_FAILURE_IND          123
+#define WLC_E_CCA_CHAN_QUAL            124     /* CCA based channel quality report */
+#define WLC_E_BSSID            125     /* to report change in BSSID while roaming */
+#define WLC_E_TX_STAT_ERROR            126     /* tx error indication */
+#define WLC_E_BCMC_CREDIT_SUPPORT      127     /* credit check for BCMC supported */
+#define WLC_E_PEER_TIMEOUT     128 /* silently drop a STA because of inactivity */
+#define WLC_E_BT_WIFI_HANDOVER_REQ     130     /* Handover Request Initiated */
+#define WLC_E_SPW_TXINHIBIT            131     /* Southpaw TxInhibit notification */
+#define WLC_E_FBT_AUTH_REQ_IND         132     /* FBT Authentication Request Indication */
+#define WLC_E_RSSI_LQM                 133     /* Enhancement addition for WLC_E_RSSI */
+#define WLC_E_PFN_GSCAN_FULL_RESULT            134 /* Full probe/beacon (IEs etc) results */
+#define WLC_E_PFN_SWC          135 /* Significant change in rssi of bssids being tracked */
+#define WLC_E_AUTHORIZED       136     /* a STA been authroized for traffic */
+#define WLC_E_PROBREQ_MSG_RX   137 /* probe req with wl_event_rx_frame_data_t header */
+#define WLC_E_PFN_SCAN_COMPLETE        138     /* PFN completed scan of network list */
+#define WLC_E_RMC_EVENT                139     /* RMC Event */
+#define WLC_E_DPSTA_INTF_IND   140     /* DPSTA interface indication */
+#define WLC_E_RRM              141     /* RRM Event */
+#define WLC_E_PFN_SSID_EXT     142     /* SSID EXT event */
+#define WLC_E_ROAM_EXP_EVENT   143     /* Expanded roam event */
+#define WLC_E_ULP                      146     /* ULP entered indication */
+#define WLC_E_MACDBG                   147     /* Ucode debugging event */
+#define WLC_E_RESERVED                 148     /* reserved */
+#define WLC_E_PRE_ASSOC_RSEP_IND       149     /* assoc resp received */
+#define WLC_E_PSK_AUTH                 150     /* PSK AUTH WPA2-PSK 4 WAY Handshake failure */
+#define WLC_E_TKO                      151     /* TCP keepalive offload */
+#define WLC_E_SDB_TRANSITION            152     /* SDB mode-switch event */
+#define WLC_E_NATOE_NFCT               153     /* natoe event */
+#define WLC_E_TEMP_THROTTLE            154     /* Temperature throttling control event */
+#define WLC_E_LINK_QUALITY             155     /* Link quality measurement complete */
+#define WLC_E_BSSTRANS_RESP            156     /* BSS Transition Response received */
+#define WLC_E_TWT_SETUP                        157     /* TWT Setup Complete event */
+#define WLC_E_HE_TWT_SETUP             157     /* TODO:Remove after merging TWT changes to trunk */
+#define WLC_E_NAN_CRITICAL             158     /* NAN Critical Event */
+#define WLC_E_NAN_NON_CRITICAL         159     /* NAN Non-Critical Event */
+#define WLC_E_RADAR_DETECTED           160     /* Radar Detected event */
+#define WLC_E_RANGING_EVENT            161     /* Ranging event */
+#define WLC_E_INVALID_IE               162     /* Received invalid IE */
+#define WLC_E_MODE_SWITCH              163     /* Mode switch event */
+#define WLC_E_PKT_FILTER               164     /* Packet filter event */
+#define WLC_E_DMA_TXFLUSH_COMPLETE     165     /* TxFlush done before changing tx/rxchain */
+#define WLC_E_FBT                      166     /* FBT event */
+#define WLC_E_PFN_SCAN_BACKOFF         167     /* PFN SCAN Backoff event */
+#define WLC_E_PFN_BSSID_SCAN_BACKOFF   168     /* PFN BSSID SCAN BAckoff event */
+#define WLC_E_AGGR_EVENT               169     /* Aggregated event */
+#define WLC_E_TVPM_MITIGATION          171     /* Change in mitigation applied by TVPM */
+#define WLC_E_SCAN_START               172     /* Deprecated */
+#define WLC_E_SCAN                     172     /* Scan event */
+#define WLC_E_MBO                      173     /* MBO event */
+#define WLC_E_PHY_CAL                  174     /* Phy calibration start indication to host */
+#define WLC_E_RPSNOA                   175     /* Radio power save start/end indication to host */
+#define WLC_E_ADPS                     176     /* ADPS event */
+#define WLC_E_SLOTTED_BSS_PEER_OP      177     /* Per peer SCB delete */
+#define WLC_E_HWA                      178     /* HWA events */
+#define WLC_E_GTK_KEYROT_NO_CHANSW     179     /* Avoid Chanswitch while GTK key rotation */
+#define WLC_E_ONBODY_STATUS_CHANGE     180     /* Indication of onbody status change */
+#define WLC_E_BCNRECV_ABORTED          181     /* Fake AP bcnrecv aborted roam event */
+#define WLC_E_PMK_INFO                 182     /* PMK,PMKID information event */
+#define WLC_E_BSSTRANS                 183     /* BSS Transition request / Response */
+#define WLC_E_WA_LQM                   184     /* link quality monitoring */
+#define WLC_E_ACTION_FRAME_OFF_CHAN_DWELL_COMPLETE  185 /* action frame off channel
+                                                *  dwell time complete
+                                                */
+#define WLC_E_WSEC                     186     /* wsec keymgmt event */
+#define WLC_E_OBSS_DETECTION           187     /* OBSS HW event */
+#define WLC_E_AP_BCN_MUTE              188     /* Beacon mute mitigation event */
+#define WLC_E_SC_CHAN_QUAL             189     /* Event to indicate the SC chanel quality */
+#define WLC_E_DYNSAR                   190     /* Dynamic SAR indicate optimize on/off */
+#define WLC_E_ROAM_CACHE_UPDATE                191     /* Roam cache update indication */
+#define WLC_E_AP_BCN_DRIFT             192     /* Beacon Drift event */
+#define WLC_E_LAST                     193     /* highest val + 1 for range checking */
+#if (WLC_E_LAST > 193)
+#error "WLC_E_LAST: Invalid value for last event; must be <= 193."
+#endif /* WLC_E_LAST */
+
+/* define an API for getting the string name of an event */
+extern const char *bcmevent_get_name(uint event_type);
+extern void wl_event_to_host_order(wl_event_msg_t * evt);
+extern void wl_event_to_network_order(wl_event_msg_t * evt);
+
+/* validate if the event is proper and if valid copy event header to event */
+extern int is_wlc_event_frame(void *pktdata, uint pktlen, uint16 exp_usr_subtype,
+       bcm_event_msg_u_t *out_event);
+
+/* conversion between host and network order for events */
+void wl_event_to_host_order(wl_event_msg_t * evt);
+void wl_event_to_network_order(wl_event_msg_t * evt);
+
+#define WLC_ROAM_EVENT_V1 0x1u
+
+/* tlv ids for roam event */
+#define WLC_ROAM_NO_NETWORKS_TLV_ID 1
+
+/* No Networks reasons */
+#define WLC_E_REASON_NO_NETWORKS               0x0u /* value 0 means no networks found */
+#define WLC_E_REASON_NO_NETWORKS_BY_SCORE      0x01u /* bit 1 indicates filtered by score */
+
+/* bit mask field indicating fail reason */
+typedef uint32 wlc_roam_fail_reason_t;
+
+typedef struct wlc_roam_event_header {
+       uint16 version;         /* version */
+       uint16 length;          /* total length */
+} wlc_roam_event_header_t;
+
+typedef struct wlc_roam_event {
+       wlc_roam_event_header_t header;
+       uint8 xtlvs[];          /* data */
+} wl_roam_event_t;
+
+#define WLC_ROAM_PREP_EVENT_V1 0x1u
+#define WLC_ROAM_START_EVENT_V1 0x1u
+
+typedef struct wlc_roam_start_event {
+       uint16 version;         /* version */
+       uint16 length;          /* total length */
+       int16 rssi;             /* current bss rssi */
+       int8 pad[2];            /* padding */
+       uint8 xtlvs[];          /* optional xtlvs */
+} wlc_roam_start_event_t;
+
+typedef struct wlc_roam_prep_event {
+       uint16 version;         /* version */
+       uint16 length;          /* total length */
+       int16 rssi;             /* target bss rssi */
+       int8 pad[2];            /* padding */
+       uint8 xtlvs[];          /* optional xtlvs */
+} wlc_roam_prep_event_t;
+
+#define WLC_ROAM_CACHE_UPDATE_EVENT_V1 0x1u
+
+/* WLC_E_ROAM_CACHE_UPDATE event data prototype */
+typedef struct wlc_roam_cache_update_event {
+       uint16 version;         /* version */
+       uint16 length;          /* total length */
+       uint8 xtlvs[];          /* optional xtlvs */
+} wlc_roam_cache_update_event_t;
+
+typedef enum wlc_roam_cache_update_reason {
+       WLC_ROAM_CACHE_UPDATE_NEW_ROAM_CACHE = 1,       /* new roam cache */
+       WLC_ROAM_CACHE_UPDATE_JOIN = 2,                 /* join bss */
+       WLC_ROAM_CACHE_UPDATE_RSSI_DELTA = 3,           /* rssi delta */
+       WLC_ROAM_CACHE_UPDATE_MOTION_RSSI_DELTA = 4,    /* motion rssi delta */
+       WLC_ROAM_CACHE_UPDATE_CHANNEL_MISS = 5,         /* channel missed */
+       WLC_ROAM_CACHE_UPDATE_START_SPLIT_SCAN = 6,     /* start split scan */
+       WLC_ROAM_CACHE_UPDATE_START_FULL_SCAN = 7,      /* start full scan */
+       WLC_ROAM_CACHE_UPDATE_INIT_ASSOC = 8,           /* init before assoc */
+       WLC_ROAM_CACHE_UPDATE_FULL_SCAN_FAILED = 9,     /* full scan failed */
+       WLC_ROAM_CACHE_UPDATE_NO_AP_FOUND = 10,         /* no ap found */
+       WLC_ROAM_CACHE_UPDATE_MISSING_AP = 11,          /* cached ap not found */
+       WLC_ROAM_CACHE_UPDATE_START_PART_SCAN = 12,     /* RCC */
+       WLC_ROAM_CACHE_UPDATE_RCC_MODE = 13,            /* RCC */
+       WLC_ROAM_CACHE_UPDATE_RCC_CHANNELS = 14         /* RCC */
+} wlc_roam_cache_update_reason_t;
+
+/*
+ * Please do not insert/delete events in the middle causing renumbering.
+ * It is a problem for host-device compatibility, especially with ROMmed chips.
+ */
+
+/* Translate between internal and exported status codes */
+/* Event status codes */
+#define WLC_E_STATUS_SUCCESS           0       /* operation was successful */
+#define WLC_E_STATUS_FAIL              1       /* operation failed */
+#define WLC_E_STATUS_TIMEOUT           2       /* operation timed out */
+#define WLC_E_STATUS_NO_NETWORKS       3       /* failed due to no matching network found */
+#define WLC_E_STATUS_ABORT             4       /* operation was aborted */
+#define WLC_E_STATUS_NO_ACK            5       /* protocol failure: packet not ack'd */
+#define WLC_E_STATUS_UNSOLICITED       6       /* AUTH or ASSOC packet was unsolicited */
+#define WLC_E_STATUS_ATTEMPT           7       /* attempt to assoc to an auto auth configuration */
+#define WLC_E_STATUS_PARTIAL           8       /* scan results are incomplete */
+#define WLC_E_STATUS_NEWSCAN           9       /* scan aborted by another scan */
+#define WLC_E_STATUS_NEWASSOC          10      /* scan aborted due to assoc in progress */
+#define WLC_E_STATUS_11HQUIET          11      /* 802.11h quiet period started */
+#define WLC_E_STATUS_SUPPRESS          12      /* user disabled scanning (WLC_SET_SCANSUPPRESS) */
+#define WLC_E_STATUS_NOCHANS           13      /* no allowable channels to scan */
+#ifdef BCMCCX // MOG-NO
+#define WLC_E_STATUS_CCXFASTRM         14      /* scan aborted due to CCX fast roam */
+#endif /* BCMCCX */
+#define WLC_E_STATUS_CS_ABORT          15      /* abort channel select */
+#define WLC_E_STATUS_ERROR             16      /* request failed due to error */
+#define WLC_E_STATUS_SLOTTED_PEER_ADD  17      /* Slotted scb for peer addition status */
+#define WLC_E_STATUS_SLOTTED_PEER_DEL  18      /* Slotted scb for peer deletion status */
+#define WLC_E_STATUS_RXBCN             19      /* Rx Beacon event for FAKEAP feature   */
+#define WLC_E_STATUS_RXBCN_ABORT       20      /* Rx Beacon abort event for FAKEAP feature */
+#define WLC_E_STATUS_LOWPOWER_ON_LOWSPAN       21      /* LOWPOWER scan request during LOWSPAN */
+#define WLC_E_STATUS_INVALID 0xff  /* Invalid status code to init variables. */
+
+/* 4-way handshake event type */
+#define WLC_E_PSK_AUTH_SUB_EAPOL_START         1       /* EAPOL start */
+#define WLC_E_PSK_AUTH_SUB_EAPOL_DONE          2       /* EAPOL end */
+/* GTK event type */
+#define        WLC_E_PSK_AUTH_SUB_GTK_DONE             3       /* GTK end */
+
+/* 4-way handshake event status code */
+#define WLC_E_STATUS_PSK_AUTH_WPA_TIMOUT       1       /* operation timed out */
+#define WLC_E_STATUS_PSK_AUTH_MIC_WPA_ERR              2       /* MIC error */
+#define WLC_E_STATUS_PSK_AUTH_IE_MISMATCH_ERR          3       /* IE Missmatch error */
+#define WLC_E_STATUS_PSK_AUTH_REPLAY_COUNT_ERR         4
+#define WLC_E_STATUS_PSK_AUTH_PEER_BLACKISTED  5       /* Blaclisted peer */
+#define WLC_E_STATUS_PSK_AUTH_GTK_REKEY_FAIL   6       /* GTK event status code */
+
+/* SDB transition status code */
+#define WLC_E_STATUS_SDB_START                 1
+#define WLC_E_STATUS_SDB_COMPLETE              2
+/* Slice-swap status code */
+#define WLC_E_STATUS_SLICE_SWAP_START          3
+#define WLC_E_STATUS_SLICE_SWAP_COMPLETE       4
+
+/* SDB transition reason code */
+#define WLC_E_REASON_HOST_DIRECT       0
+#define WLC_E_REASON_INFRA_ASSOC       1
+#define WLC_E_REASON_INFRA_ROAM                2
+#define WLC_E_REASON_INFRA_DISASSOC    3
+#define WLC_E_REASON_NO_MODE_CHANGE_NEEDED     4
+
+/* TX STAT ERROR REASON CODE */
+#define WLC_E_REASON_TXBACKOFF_NOT_DECREMENTED 0x1
+
+/* WLC_E_SDB_TRANSITION event data */
+#define WL_MAX_BSSCFG     4
+#define WL_EVENT_SDB_TRANSITION_VER     1
+typedef struct wl_event_sdb_data {
+       uint8 wlunit;           /* Core index */
+       uint8 is_iftype;        /* Interface Type(Station, SoftAP, P2P_GO, P2P_GC */
+       uint16 chanspec;        /* Interface Channel/Chanspec */
+       char ssidbuf[(4 * 32) + 1];     /* SSID_FMT_BUF_LEN: ((4 * DOT11_MAX_SSID_LEN) + 1) */
+} wl_event_sdb_data_t;
+
+typedef struct wl_event_sdb_trans {
+       uint8 version;          /* Event Data Version */
+       uint8 rsdb_mode;
+       uint8 enable_bsscfg;
+       uint8 reserved;
+       struct wl_event_sdb_data values[WL_MAX_BSSCFG];
+} wl_event_sdb_trans_t;
+
+/* reason codes for WLC_E_GTK_KEYROT_NO_CHANSW event */
+#define WLC_E_GTKKEYROT_SCANDELAY       0       /* Delay scan while gtk in progress */
+
+#define WLC_E_GTKKEYROT_SKIPCHANSW_P2P  2       /* Avoid chansw by p2p while gtk in progress */
+
+/* roam reason codes */
+#define WLC_E_REASON_INITIAL_ASSOC     0       /* initial assoc */
+#define WLC_E_REASON_LOW_RSSI          1       /* roamed due to low RSSI */
+#define WLC_E_REASON_DEAUTH            2       /* roamed due to DEAUTH indication */
+#define WLC_E_REASON_DISASSOC          3       /* roamed due to DISASSOC indication */
+#define WLC_E_REASON_BCNS_LOST         4       /* roamed due to lost beacons */
+
+/* Roam codes (5-7) used primarily by CCX */
+#define WLC_E_REASON_FAST_ROAM_FAILED  5       /* roamed due to fast roam failure */
+#define WLC_E_REASON_DIRECTED_ROAM     6       /* roamed due to request by AP */
+#define WLC_E_REASON_TSPEC_REJECTED    7       /* roamed due to TSPEC rejection */
+#define WLC_E_REASON_BETTER_AP         8       /* roamed due to finding better AP */
+#define WLC_E_REASON_MINTXRATE         9       /* roamed because at mintxrate for too long */
+#define WLC_E_REASON_TXFAIL            10      /* We can hear AP, but AP can't hear us */
+#define WLC_E_REASON_BSSTRANS_REQ      11      /* roamed due to BSS Transition request by AP */
+#define WLC_E_REASON_LOW_RSSI_CU       12      /* roamed due to low RSSI and Channel Usage */
+#define WLC_E_REASON_RADAR_DETECTED    13      /* roamed due to radar detection by STA */
+#define WLC_E_REASON_CSA               14      /* roamed due to CSA from AP */
+#define WLC_E_REASON_ESTM_LOW          15      /* roamed due to ESTM low tput */
+#define WLC_E_REASON_SILENT_ROAM       16      /* roamed due to Silent roam */
+#define WLC_E_REASON_INACTIVITY                17      /* full roam scan due to inactivity */
+#define WLC_E_REASON_ROAM_SCAN_TIMEOUT         18      /* roam scan timer timeout */
+#define WLC_E_REASON_REASSOC           19      /* roamed due to reassoc iovar */
+#define WLC_E_REASON_LAST              20      /* NOTE: increment this as you add reasons above */
+
+/* prune reason codes */
+#define WLC_E_PRUNE_ENCR_MISMATCH      1       /* encryption mismatch */
+#define WLC_E_PRUNE_BCAST_BSSID                2       /* AP uses a broadcast BSSID */
+#define WLC_E_PRUNE_MAC_DENY           3       /* STA's MAC addr is in AP's MAC deny list */
+#define WLC_E_PRUNE_MAC_NA             4       /* STA's MAC addr is not in AP's MAC allow list */
+#define WLC_E_PRUNE_REG_PASSV          5       /* AP not allowed due to regulatory restriction */
+#define WLC_E_PRUNE_SPCT_MGMT          6       /* AP does not support STA locale spectrum mgmt */
+#define WLC_E_PRUNE_RADAR              7       /* AP is on a radar channel of STA locale */
+#define WLC_E_RSN_MISMATCH             8       /* STA does not support AP's RSN */
+#define WLC_E_PRUNE_NO_COMMON_RATES    9       /* No rates in common with AP */
+#define WLC_E_PRUNE_BASIC_RATES                10      /* STA does not support all basic rates of BSS */
+#ifdef BCMCCX // MOG-NO
+#define WLC_E_PRUNE_CCXFAST_PREVAP     11      /* CCX FAST ROAM: prune previous AP */
+#endif /* def BCMCCX */
+#define WLC_E_PRUNE_CIPHER_NA          12      /* BSS's cipher not supported */
+#define WLC_E_PRUNE_KNOWN_STA          13      /* AP is already known to us as a STA */
+#ifdef BCMCCX // MOG-NO
+#define WLC_E_PRUNE_CCXFAST_DROAM      14      /* CCX FAST ROAM: prune unqualified AP */
+#endif /* def BCMCCX */
+#define WLC_E_PRUNE_WDS_PEER           15      /* AP is already known to us as a WDS peer */
+#define WLC_E_PRUNE_QBSS_LOAD          16      /* QBSS LOAD - AAC is too low */
+#define WLC_E_PRUNE_HOME_AP            17      /* prune home AP */
+#ifdef BCMCCX // MOG-NO
+#define WLC_E_PRUNE_AP_BLOCKED         18      /* prune blocked AP */
+#define WLC_E_PRUNE_NO_DIAG_SUPPORT    19      /* prune due to diagnostic mode not supported */
+#endif /* BCMCCX */
+#define WLC_E_PRUNE_AUTH_RESP_MAC      20      /* suppress auth resp by MAC filter */
+#define WLC_E_PRUNE_ASSOC_RETRY_DELAY  21      /* MBO assoc retry delay */
+#define WLC_E_PRUNE_RSSI_ASSOC_REJ     22      /* OCE RSSI-based assoc rejection */
+#define WLC_E_PRUNE_MAC_AVOID          23      /* AP's MAC addr is in STA's MAC avoid list */
+
+/* WPA failure reason codes carried in the WLC_E_PSK_SUP event */
+#define WLC_E_SUP_OTHER                        0       /* Other reason */
+#define WLC_E_SUP_DECRYPT_KEY_DATA     1       /* Decryption of key data failed */
+#define WLC_E_SUP_BAD_UCAST_WEP128     2       /* Illegal use of ucast WEP128 */
+#define WLC_E_SUP_BAD_UCAST_WEP40      3       /* Illegal use of ucast WEP40 */
+#define WLC_E_SUP_UNSUP_KEY_LEN                4       /* Unsupported key length */
+#define WLC_E_SUP_PW_KEY_CIPHER                5       /* Unicast cipher mismatch in pairwise key */
+#define WLC_E_SUP_MSG3_TOO_MANY_IE     6       /* WPA IE contains > 1 RSN IE in key msg 3 */
+#define WLC_E_SUP_MSG3_IE_MISMATCH     7       /* WPA IE mismatch in key message 3 */
+#define WLC_E_SUP_NO_INSTALL_FLAG      8       /* INSTALL flag unset in 4-way msg */
+#define WLC_E_SUP_MSG3_NO_GTK          9       /* encapsulated GTK missing from msg 3 */
+#define WLC_E_SUP_GRP_KEY_CIPHER       10      /* Multicast cipher mismatch in group key */
+#define WLC_E_SUP_GRP_MSG1_NO_GTK      11      /* encapsulated GTK missing from group msg 1 */
+#define WLC_E_SUP_GTK_DECRYPT_FAIL     12      /* GTK decrypt failure */
+#define WLC_E_SUP_SEND_FAIL            13      /* message send failure */
+#define WLC_E_SUP_DEAUTH               14      /* received FC_DEAUTH */
+#define WLC_E_SUP_WPA_PSK_TMO          15      /* WPA PSK 4-way handshake timeout */
+#define WLC_E_SUP_WPA_PSK_M1_TMO       16      /* WPA PSK 4-way handshake M1 timeout */
+#define WLC_E_SUP_WPA_PSK_M3_TMO       17      /* WPA PSK 4-way handshake M3 timeout */
+#define WLC_E_SUP_GTK_UPDATE_FAIL      18  /* GTK update failure */
+#define WLC_E_SUP_TK_UPDATE_FAIL       19  /* TK update failure */
+#define WLC_E_SUP_KEY_INSTALL_FAIL     20  /* Buffered key install failure */
+#define WLC_E_SUP_PTK_UPDATE           21      /* PTK update */
+#define WLC_E_SUP_MSG1_PMKID_MISMATCH  22      /* MSG1 PMKID not matched to PMKSA cache list */
+
+/* event msg for WLC_E_SUP_PTK_UPDATE */
+typedef struct wlc_sup_ptk_update {
+       uint16 version;         /* 0x0001 */
+       uint16 length;          /* length of data that follows */
+       uint32 tsf_low;         /* tsf at which ptk updated by internal supplicant */
+       uint32 tsf_high;
+       uint8 key_id;           /* always 0 for PTK update */
+       uint8 tid;              /* tid for the PN below - PTK refresh is per key */
+       uint16 pn_low;
+       uint32 pn_high;         /* local highest PN of any tid of the key when M4 was sent */
+} wlc_sup_ptk_update_t;
+
+/* sub event of WLC_E_WSEC */
+typedef enum {
+       WLC_WSEC_EVENT_PTK_PN_SYNC_ERROR = 0x01
+} wl_wsec_event_type_t;
+
+/* sub event msg - WLC_WSEC_EVENT_PTK_PN_SYNC_ERROR */
+struct wlc_wsec_ptk_pn_sync_error_v1 {
+       uint32 tsf_low;         /* tsf at which PN sync error happened */
+       uint32 tsf_high;
+       uint8 key_id;           /* always 0 for PTK update */
+       uint8 tid;              /* tid for the PN below - PTK refresh is per key */
+       uint16 PAD1;
+       uint16 rx_seqn;         /* d11 seq number */
+       uint16 pn_low;
+       uint32 pn_high;         /* local PN window start for the tid */
+       uint16 key_idx;         /* key idx in the keymgmt */
+       uint16 rx_pn_low;
+       uint32 rx_pn_high;      /* Rx PN window start for the tid */
+       uint32 span_time;       /* time elapsed since replay */
+       uint32 span_pkts;       /* pkt count since replay */
+};
+
+typedef struct wlc_wsec_ptk_pn_sync_error_v1 wlc_wsec_ptk_pn_sync_error_t;
+
+/* WLC_E_WSEC event msg */
+typedef struct wlc_wsec_event {
+       uint16 version;         /* 0x0001 */
+       uint16 length;          /* length of data that follows */
+       uint16 type;            /* wsec_event_type_t */
+       uint16 PAD1;
+       union {
+               wlc_wsec_ptk_pn_sync_error_t pn_sync_err;
+       } data;
+} wlc_wsec_event_t;
+
+/* Ucode reason codes carried in the WLC_E_MACDBG event */
+#define WLC_E_MACDBG_LIST_PSM          0       /* Dump list update for PSM registers */
+#define WLC_E_MACDBG_LIST_PSMX         1       /* Dump list update for PSMx registers */
+#define WLC_E_MACDBG_REGALL            2       /* Dump all registers */
+
+/* Event data for events that include frames received over the air */
+/* WLC_E_PROBRESP_MSG
+ * WLC_E_P2P_PROBREQ_MSG
+ * WLC_E_ACTION_FRAME_RX
+ */
+
+#define MAX_PHY_CORE_NUM 4u
+
+#define BCM_RX_FRAME_DATA_VERSION_2    2u
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_event_rx_frame_data_v2 {
+       uint16  version;
+       uint16  len;
+       uint16  channel;        /* Matches chanspec_t format from bcmwifi_channels.h */
+       uint16  pad;
+       int32   rssi;
+       uint32  mactime;
+       uint32  rate;
+       int8    per_core_rssi[MAX_PHY_CORE_NUM];
+} BWL_POST_PACKED_STRUCT wl_event_rx_frame_data_v2_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_event_rx_frame_data_v1 {
+       uint16  version;
+       uint16  channel;        /* Matches chanspec_t format from bcmwifi_channels.h */
+       int32   rssi;
+       uint32  mactime;
+       uint32  rate;
+} BWL_POST_PACKED_STRUCT wl_event_rx_frame_data_v1_t;
+
+#define BCM_RX_FRAME_DATA_VERSION_1 1u
+
+#ifndef WL_EVENT_RX_FRAME_DATA_ALIAS
+#define BCM_RX_FRAME_DATA_VERSION BCM_RX_FRAME_DATA_VERSION_1
+typedef wl_event_rx_frame_data_v1_t wl_event_rx_frame_data_t;
+#endif
+
+/* WLC_E_IF event data */
+typedef struct wl_event_data_if {
+       uint8 ifidx;            /* RTE virtual device index (for dongle) */
+       uint8 opcode;           /* see I/F opcode */
+       uint8 reserved;         /* bit mask (WLC_E_IF_FLAGS_XXX ) */
+       uint8 bssidx;           /* bsscfg index */
+       uint8 role;             /* see I/F role */
+} wl_event_data_if_t;
+
+/* WLC_E_NATOE event data */
+typedef struct wl_event_data_natoe {
+       uint32 natoe_active;
+       uint32 sta_ip;
+       uint16 start_port;
+       uint16 end_port;
+} wl_event_data_natoe_t;
+
+/* opcode in WLC_E_IF event */
+#define WLC_E_IF_ADD           1       /* bsscfg add */
+#define WLC_E_IF_DEL           2       /* bsscfg delete */
+#define WLC_E_IF_CHANGE                3       /* bsscfg role change */
+
+/* I/F role code in WLC_E_IF event */
+#define WLC_E_IF_ROLE_STA              0       /* Infra STA */
+#define WLC_E_IF_ROLE_AP               1       /* Access Point */
+#define WLC_E_IF_ROLE_WDS              2       /* WDS link */
+#define WLC_E_IF_ROLE_P2P_GO           3       /* P2P Group Owner */
+#define WLC_E_IF_ROLE_P2P_CLIENT       4       /* P2P Client */
+#ifdef WLMESH_CFG80211
+#define WLC_E_IF_ROLE_MESH             5       /* MESH */
+#endif /* WLMESH_CFG80211 */
+#define WLC_E_IF_ROLE_IBSS             8       /* IBSS */
+#define WLC_E_IF_ROLE_NAN              9       /* NAN */
+
+/* WLC_E_RSSI event data */
+typedef struct wl_event_data_rssi {
+       int32 rssi;
+       int32 snr;
+       int32 noise;
+} wl_event_data_rssi_t;
+
+#define WL_EVENT_WA_LQM_VER    0       /* initial version */
+
+#define WL_EVENT_WA_LQM_BASIC  0       /* event sub-types */
+typedef struct {                       /* payload of subevent in xtlv */
+       int32 rssi;
+       int32 snr;
+       uint32 tx_rate;
+       uint32 rx_rate;
+} wl_event_wa_lqm_basic_t;
+
+typedef struct wl_event_wa_lqm {
+       uint16 ver;                     /* version */
+       uint16 len;                     /* total length structure */
+       uint8 subevent[];               /* sub-event data in bcm_xtlv_t format */
+} wl_event_wa_lqm_t;
+
+/* WLC_E_IF flag */
+#define WLC_E_IF_FLAGS_BSSCFG_NOIF     0x1     /* no host I/F creation needed */
+
+/* Reason codes for LINK */
+#define WLC_E_LINK_BCN_LOSS    1       /* Link down because of beacon loss */
+#define WLC_E_LINK_DISASSOC    2       /* Link down because of disassoc */
+#define WLC_E_LINK_ASSOC_REC   3       /* Link down because assoc recreate failed */
+#define WLC_E_LINK_BSSCFG_DIS  4       /* Link down due to bsscfg down */
+#define WLC_E_LINK_ASSOC_FAIL  5       /* Link down due to assoc to new AP during roaming failed */
+#define WLC_E_LINK_REASSOC_ROAM_FAIL   6       /* Link down due to reassoc roaming failed */
+#define WLC_E_LINK_LOWRSSI_ROAM_FAIL   7       /* Link down due to Low rssi roaming failed */
+
+/* WLC_E_NDIS_LINK event data */
+typedef BWL_PRE_PACKED_STRUCT struct ndis_link_parms {
+       struct ether_addr peer_mac; /* 6 bytes */
+       uint16 chanspec;            /* 2 bytes */
+       uint32 link_speed;          /* current datarate in units of 500 Kbit/s */
+       uint32 max_link_speed;      /* max possible datarate for link in units of 500 Kbit/s  */
+       int32  rssi;                /* average rssi */
+} BWL_POST_PACKED_STRUCT ndis_link_parms_t;
+
+/* reason codes for WLC_E_OVERLAY_REQ event */
+#define WLC_E_OVL_DOWNLOAD             0       /* overlay download request */
+#define WLC_E_OVL_UPDATE_IND   1       /* device indication of host overlay update */
+
+/* reason codes for WLC_E_TDLS_PEER_EVENT event */
+#define WLC_E_TDLS_PEER_DISCOVERED             0       /* peer is ready to establish TDLS */
+#define WLC_E_TDLS_PEER_CONNECTED              1
+#define WLC_E_TDLS_PEER_DISCONNECTED   2
+
+/* reason codes for WLC_E_RMC_EVENT event */
+#define WLC_E_REASON_RMC_NONE          0
+#define WLC_E_REASON_RMC_AR_LOST               1
+#define WLC_E_REASON_RMC_AR_NO_ACK             2
+
+#ifdef WLTDLS
+/* TDLS Action Category code */
+#define TDLS_AF_CATEGORY               12
+/* Wi-Fi Display (WFD) Vendor Specific Category */
+/* used for WFD Tunneled Probe Request and Response */
+#define TDLS_VENDOR_SPECIFIC           127
+/* TDLS Action Field Values */
+#define TDLS_ACTION_SETUP_REQ          0
+#define TDLS_ACTION_SETUP_RESP         1
+#define TDLS_ACTION_SETUP_CONFIRM      2
+#define TDLS_ACTION_TEARDOWN           3
+#define WLAN_TDLS_SET_PROBE_WFD_IE     11
+#define WLAN_TDLS_SET_SETUP_WFD_IE     12
+#define WLAN_TDLS_SET_WFD_ENABLED      13
+#define WLAN_TDLS_SET_WFD_DISABLED     14
+#endif
+
+/* WLC_E_RANGING_EVENT subtypes */
+#define WLC_E_RANGING_RESULTS  0
+
+#define PHY_CAL_EVT_VERSION 1
+typedef struct wlc_phy_cal_info {
+       uint16 version; /* structure version */
+       uint16 length; /* length of the rest of the structure */
+       uint16 chanspec;
+       uint8 start;
+       uint8 phase;
+       int16 temp;
+       uint8 reason;
+       uint8 slice;
+} wlc_phy_cal_info_t;
+
+/* GAS event data */
+typedef BWL_PRE_PACKED_STRUCT struct wl_event_gas {
+       uint16  channel;        /* channel of GAS protocol */
+       uint8   dialog_token;   /* GAS dialog token */
+       uint8   fragment_id;    /* fragment id */
+       uint16  status_code;    /* status code on GAS completion */
+       uint16  data_len;       /* length of data to follow */
+       uint8   data[1];        /* variable length specified by data_len */
+} BWL_POST_PACKED_STRUCT wl_event_gas_t;
+
+/* service discovery TLV */
+typedef BWL_PRE_PACKED_STRUCT struct wl_sd_tlv {
+       uint16  length;                 /* length of response_data */
+       uint8   protocol;               /* service protocol type */
+       uint8   transaction_id;         /* service transaction id */
+       uint8   status_code;            /* status code */
+       uint8   data[1];                /* response data */
+} BWL_POST_PACKED_STRUCT wl_sd_tlv_t;
+
+/* service discovery event data */
+typedef BWL_PRE_PACKED_STRUCT struct wl_event_sd {
+       uint16  channel;                /* channel */
+       uint8   count;                  /* number of tlvs */
+       wl_sd_tlv_t     tlv[1];         /* service discovery TLV */
+} BWL_POST_PACKED_STRUCT wl_event_sd_t;
+
+/* WLC_E_PKT_FILTER event sub-classification codes */
+#define WLC_E_PKT_FILTER_TIMEOUT       1 /* Matching packet not received in last timeout seconds */
+
+/* Note: proxd has a new API (ver 3.0) deprecates the following */
+
+/* Reason codes for WLC_E_PROXD */
+#define WLC_E_PROXD_FOUND              1       /* Found a proximity device */
+#define WLC_E_PROXD_GONE               2       /* Lost a proximity device */
+#define WLC_E_PROXD_START              3       /* used by: target  */
+#define WLC_E_PROXD_STOP               4       /* used by: target   */
+#define WLC_E_PROXD_COMPLETED          5       /* used by: initiator completed */
+#define WLC_E_PROXD_ERROR              6       /* used by both initiator and target */
+#define WLC_E_PROXD_COLLECT_START      7       /* used by: target & initiator */
+#define WLC_E_PROXD_COLLECT_STOP       8       /* used by: target */
+#define WLC_E_PROXD_COLLECT_COMPLETED  9       /* used by: initiator completed */
+#define WLC_E_PROXD_COLLECT_ERROR      10      /* used by both initiator and target */
+#define WLC_E_PROXD_NAN_EVENT          11      /* used by both initiator and target */
+#define WLC_E_PROXD_TS_RESULTS          12      /* used by: initiator completed */
+
+/*  proxd_event data */
+typedef struct ftm_sample {
+       uint32 value;   /* RTT in ns */
+       int8 rssi;      /* RSSI */
+} ftm_sample_t;
+
+typedef struct ts_sample {
+       uint32 t1;
+       uint32 t2;
+       uint32 t3;
+       uint32 t4;
+} ts_sample_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct proxd_event_data {
+       uint16 ver;                     /* version */
+       uint16 mode;                    /* mode: target/initiator */
+       uint16 method;                  /* method: rssi/TOF/AOA */
+       uint8  err_code;                /* error classification */
+       uint8  TOF_type;                /* one way or two way TOF */
+       uint8  OFDM_frame_type;         /* legacy or VHT */
+       uint8  bandwidth;               /* Bandwidth is 20, 40,80, MHZ */
+       struct ether_addr peer_mac;     /* (e.g for tgt:initiator's */
+       uint32 distance;                /* dst to tgt, units meter */
+       uint32 meanrtt;                 /* mean delta */
+       uint32 modertt;                 /* Mode delta */
+       uint32 medianrtt;               /* median RTT */
+       uint32 sdrtt;                   /* Standard deviation of RTT */
+       int32  gdcalcresult;            /* Software or Hardware Kind of redundant, but if */
+                                       /* frame type is VHT, then we should do it by hardware */
+       int16  avg_rssi;                /* avg rssi accroos the ftm frames */
+       int16  validfrmcnt;             /* Firmware's valid frame counts */
+       int32  peer_router_info;        /* Peer router information if available in TLV, */
+                                       /* We will add this field later  */
+       int32 var1;                     /* average of group delay */
+       int32 var2;                     /* average of threshold crossing */
+       int32 var3;                     /* difference between group delay and threshold crossing */
+                                       /* raw Fine Time Measurements (ftm) data */
+       uint16 ftm_unit;                /* ftm cnt resolution in picoseconds , 6250ps - default */
+       uint16 ftm_cnt;                 /*  num of rtd measurments/length in the ftm buffer  */
+       ftm_sample_t ftm_buff[1];       /* 1 ... ftm_cnt  */
+} BWL_POST_PACKED_STRUCT wl_proxd_event_data_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct proxd_event_ts_results {
+       uint16 ver;                     /* version */
+       uint16 mode;                    /* mode: target/initiator */
+       uint16 method;                  /* method: rssi/TOF/AOA */
+       uint8  err_code;                /* error classification */
+       uint8  TOF_type;                /* one way or two way TOF */
+       uint16  ts_cnt;                 /* number of timestamp measurements */
+       ts_sample_t ts_buff[1];         /* Timestamps */
+} BWL_POST_PACKED_STRUCT wl_proxd_event_ts_results_t;
+
+/* Video Traffic Interference Monitor Event */
+#define INTFER_EVENT_VERSION           1
+#define INTFER_STREAM_TYPE_NONTCP      1
+#define INTFER_STREAM_TYPE_TCP         2
+#define WLINTFER_STATS_NSMPLS          4
+typedef struct wl_intfer_event {
+       uint16 version;                 /* version */
+       uint16 status;                  /* status */
+       uint8 txfail_histo[WLINTFER_STATS_NSMPLS]; /* txfail histo */
+} wl_intfer_event_t;
+
+#define RRM_EVENT_VERSION              0
+typedef struct wl_rrm_event {
+       int16 version;
+       int16 len;
+       int16 cat;              /* Category */
+       int16 subevent;
+       char payload[1]; /* Measurement payload */
+} wl_rrm_event_t;
+
+/* WLC_E_PSTA_PRIMARY_INTF_IND event data */
+typedef struct wl_psta_primary_intf_event {
+       struct ether_addr prim_ea;      /* primary intf ether addr */
+} wl_psta_primary_intf_event_t;
+
+/* WLC_E_DPSTA_INTF_IND event data */
+typedef enum {
+       WL_INTF_PSTA = 1,
+       WL_INTF_DWDS = 2
+} wl_dpsta_intf_type;
+
+typedef struct wl_dpsta_intf_event {
+       wl_dpsta_intf_type intf_type;    /* dwds/psta intf register */
+} wl_dpsta_intf_event_t;
+
+/*  **********  NAN protocol events/subevents  ********** */
+#ifndef NAN_EVENT_BUFFER_SIZE
+#define NAN_EVENT_BUFFER_SIZE 512 /* max size */
+#endif /* NAN_EVENT_BUFFER_SIZE */
+/* NAN Events sent by firmware */
+
+/*
+ * If you make changes to this enum, dont forget to update the mask (if need be).
+ */
+typedef enum wl_nan_events {
+       WL_NAN_EVENT_START                      = 1,    /* NAN cluster started */
+       WL_NAN_EVENT_JOIN                       = 2,    /* To be deprecated */
+       WL_NAN_EVENT_ROLE                       = 3,    /* Role changed */
+       WL_NAN_EVENT_SCAN_COMPLETE              = 4,    /* To be deprecated */
+       WL_NAN_EVENT_DISCOVERY_RESULT           = 5,    /* Subscribe Received */
+       WL_NAN_EVENT_REPLIED                    = 6,    /* Publish Sent */
+       WL_NAN_EVENT_TERMINATED                 = 7,    /* sub / pub is terminated */
+       WL_NAN_EVENT_RECEIVE                    = 8,    /* Follow up Received */
+       WL_NAN_EVENT_STATUS_CHG                 = 9,    /* change in nan_mac status */
+       WL_NAN_EVENT_MERGE                      = 10,   /* Merged to a NAN cluster */
+       WL_NAN_EVENT_STOP                       = 11,   /* To be deprecated */
+       WL_NAN_EVENT_P2P                        = 12,   /* Unused */
+       WL_NAN_EVENT_WINDOW_BEGIN_P2P           = 13,   /* Unused */
+       WL_NAN_EVENT_WINDOW_BEGIN_MESH          = 14,   /* Unused */
+       WL_NAN_EVENT_WINDOW_BEGIN_IBSS          = 15,   /* Unused */
+       WL_NAN_EVENT_WINDOW_BEGIN_RANGING       = 16,   /* Unused */
+       WL_NAN_EVENT_POST_DISC                  = 17,   /* Event for post discovery data */
+       WL_NAN_EVENT_DATA_IF_ADD                = 18,   /* Unused */
+       WL_NAN_EVENT_DATA_PEER_ADD              = 19,   /* Event for peer add */
+       /* nan 2.0 */
+       WL_NAN_EVENT_PEER_DATAPATH_IND          = 20,   /* Incoming DP req */
+       WL_NAN_EVENT_DATAPATH_ESTB              = 21,   /* DP Established */
+       WL_NAN_EVENT_SDF_RX                     = 22,   /* SDF payload */
+       WL_NAN_EVENT_DATAPATH_END               = 23,   /* DP Terminate recvd */
+       WL_NAN_EVENT_BCN_RX                     = 24,   /* received beacon payload */
+       WL_NAN_EVENT_PEER_DATAPATH_RESP         = 25,   /* Peer's DP response */
+       WL_NAN_EVENT_PEER_DATAPATH_CONF         = 26,   /* Peer's DP confirm */
+       WL_NAN_EVENT_RNG_REQ_IND                = 27,   /* Range Request */
+       WL_NAN_EVENT_RNG_RPT_IND                = 28,   /* Range Report */
+       WL_NAN_EVENT_RNG_TERM_IND               = 29,   /* Range Termination */
+       WL_NAN_EVENT_PEER_DATAPATH_SEC_INST     = 30,   /* Peer's DP sec install */
+       WL_NAN_EVENT_TXS                        = 31,   /* for tx status of follow-up and SDFs */
+       WL_NAN_EVENT_DW_START                   = 32,   /* dw start */
+       WL_NAN_EVENT_DW_END                     = 33,   /* dw end */
+       WL_NAN_EVENT_CHAN_BOUNDARY              = 34,   /* channel switch event */
+       WL_NAN_EVENT_MR_CHANGED                 = 35,   /* AMR or IMR changed event during DW */
+       WL_NAN_EVENT_RNG_RESP_IND               = 36,   /* Range Response Rx */
+       WL_NAN_EVENT_PEER_SCHED_UPD_NOTIF       = 37,   /* Peer's schedule update notification */
+       WL_NAN_EVENT_PEER_SCHED_REQ             = 38,   /* Peer's schedule request */
+       WL_NAN_EVENT_PEER_SCHED_RESP            = 39,   /* Peer's schedule response */
+       WL_NAN_EVENT_PEER_SCHED_CONF            = 40,   /* Peer's schedule confirm */
+       WL_NAN_EVENT_SENT_DATAPATH_END          = 41,   /* Sent DP terminate frame */
+       WL_NAN_EVENT_SLOT_START                 = 42,   /* SLOT_START event */
+       WL_NAN_EVENT_SLOT_END                   = 43,   /* SLOT_END event */
+       WL_NAN_EVENT_HOST_ASSIST_REQ            = 44,   /* Requesting host assist */
+       WL_NAN_EVENT_RX_MGMT_FRM                = 45,   /* NAN management frame received */
+       WL_NAN_EVENT_DISC_CACHE_TIMEOUT         = 46,   /* Disc cache timeout */
+       WL_NAN_EVENT_OOB_AF_TXS                 = 47,   /* OOB AF transmit status */
+       WL_NAN_EVENT_OOB_AF_RX                  = 48,   /* OOB AF receive event */
+
+       /* keep WL_NAN_EVENT_INVALID as the last element */
+       WL_NAN_EVENT_INVALID                            /* delimiter for max value */
+} nan_app_events_e;
+
+/* remove after precommit */
+#define NAN_EV_MASK(ev)        (1 << (ev - 1))
+#define IS_NAN_EVT_ON(var, evt) ((var & (1 << (evt-1))) != 0)
+
+#define NAN_EV_MASK_SET(var, evt)      \
+       (((uint32)evt < WL_NAN_EVMASK_EXTN_LEN * 8) ? \
+       ((*((uint8 *)var + ((evt - 1)/8))) |= (1 << ((evt - 1) %8))) : 0)
+#define IS_NAN_EVENT_ON(var, evt)      \
+       (((uint32)evt < WL_NAN_EVMASK_EXTN_LEN * 8) && \
+       (((*((uint8 *)var + ((evt - 1)/8))) & (1 << ((evt - 1) %8))) != 0))
+
+/*  ******************* end of NAN section *************** */
+
+typedef enum wl_scan_events {
+       WL_SCAN_START = 1,
+       WL_SCAN_END = 2
+} wl_scan_events;
+
+/* WLC_E_ULP event data */
+#define WL_ULP_EVENT_VERSION           1
+#define WL_ULP_DISABLE_CONSOLE         1       /* Disable console message on ULP entry */
+#define WL_ULP_UCODE_DOWNLOAD          2       /* Download ULP ucode file */
+
+typedef struct wl_ulp_event {
+       uint16 version;
+       uint16 ulp_dongle_action;
+} wl_ulp_event_t;
+
+/* TCP keepalive event data */
+typedef BWL_PRE_PACKED_STRUCT struct wl_event_tko {
+       uint8 index;            /* TCP connection index, 0 to max-1 */
+       uint8 pad[3];           /* 4-byte struct alignment */
+} BWL_POST_PACKED_STRUCT wl_event_tko_t;
+
+typedef struct {
+       uint8 radar_type;       /* one of RADAR_TYPE_XXX */
+       uint16 min_pw;          /* minimum pulse-width (usec * 20) */
+       uint16 max_pw;          /* maximum pulse-width (usec * 20) */
+       uint16 min_pri;         /* minimum pulse repetition interval (usec) */
+       uint16 max_pri;         /* maximum pulse repetition interval (usec) */
+       uint16 subband;         /* subband/frequency */
+} radar_detected_event_info_t;
+typedef struct wl_event_radar_detect_data {
+
+       uint32 version;
+       uint16 current_chanspec; /* chanspec on which the radar is recieved */
+       uint16 target_chanspec; /*  Target chanspec after detection of radar on current_chanspec */
+       radar_detected_event_info_t radar_info[2];
+} wl_event_radar_detect_data_t;
+
+#define WL_EVENT_MODESW_VER_1                  1
+#define WL_EVENT_MODESW_VER_CURRENT            WL_EVENT_MODESW_VER_1
+
+#define WL_E_MODESW_FLAG_MASK_DEVICE           0x01u /* mask of device: belongs to local or peer */
+#define WL_E_MODESW_FLAG_MASK_FROM             0x02u /* mask of origin: firmware or user */
+#define WL_E_MODESW_FLAG_MASK_STATE            0x0Cu /* mask of state: modesw progress state */
+
+#define WL_E_MODESW_FLAG_DEVICE_LOCAL          0x00u /* flag - device: info is about self/local */
+#define WL_E_MODESW_FLAG_DEVICE_PEER           0x01u /* flag - device: info is about peer */
+
+#define WL_E_MODESW_FLAG_FROM_FIRMWARE         0x00u /* flag - from: request is from firmware */
+#define WL_E_MODESW_FLAG_FROM_USER             0x02u /* flag - from: request is from user/iov */
+
+#define WL_E_MODESW_FLAG_STATE_REQUESTED       0x00u /* flag - state: mode switch request */
+#define WL_E_MODESW_FLAG_STATE_INITIATED       0x04u /* flag - state: switch initiated */
+#define WL_E_MODESW_FLAG_STATE_COMPLETE                0x08u /* flag - state: switch completed/success */
+#define WL_E_MODESW_FLAG_STATE_FAILURE         0x0Cu /* flag - state: failed to switch */
+
+/* Get sizeof *X including variable data's length where X is pointer to wl_event_mode_switch_t */
+#define WL_E_MODESW_SIZE(X) (sizeof(*(X)) + (X)->length)
+
+/* Get variable data's length where X is pointer to wl_event_mode_switch_t */
+#define WL_E_MODESW_DATA_SIZE(X) (((X)->length > sizeof(*(X))) ? ((X)->length - sizeof(*(X))) : 0)
+
+#define WL_E_MODESW_REASON_UNKNOWN             0u /* reason: UNKNOWN */
+#define WL_E_MODESW_REASON_ACSD                        1u /* reason: ACSD (based on events from FW */
+#define WL_E_MODESW_REASON_OBSS_DBS            2u /* reason: OBSS DBS (eg. on interference) */
+#define WL_E_MODESW_REASON_DFS                 3u /* reason: DFS (eg. on subband radar) */
+#define WL_E_MODESW_REASON_DYN160              4u /* reason: DYN160 (160/2x2 - 80/4x4) */
+
+/* event structure for WLC_E_MODE_SWITCH */
+typedef struct {
+       uint16 version;
+       uint16 length;  /* size including 'data' field */
+       uint16 opmode_from;
+       uint16 opmode_to;
+       uint32 flags;   /* bit 0: peer(/local==0);
+                        * bit 1: user(/firmware==0);
+                        * bits 3,2: 00==requested, 01==initiated,
+                        *           10==complete, 11==failure;
+                        * rest: reserved
+                        */
+       uint16 reason;  /* value 0: unknown, 1: ACSD, 2: OBSS_DBS,
+                        *       3: DFS, 4: DYN160, rest: reserved
+                        */
+       uint16 data_offset;     /* offset to 'data' from beginning of this struct.
+                                * fields may be added between data_offset and data
+                                */
+       /* ADD NEW FIELDS HERE */
+       uint8 data[];   /* reason specific data; could be empty */
+} wl_event_mode_switch_t;
+
+/* when reason in WLC_E_MODE_SWITCH is DYN160, data will carry the following structure */
+typedef struct {
+       uint16 trigger;         /* value 0: MU to SU, 1: SU to MU, 2: metric_dyn160, 3:re-/assoc,
+                                *       4: disassoc, 5: rssi, 6: traffic, 7: interference,
+                                *       8: chanim_stats
+                                */
+       struct ether_addr sta_addr;     /* causal STA's MAC address when known */
+       uint16 metric_160_80;           /* latest dyn160 metric */
+       uint8 nss;              /* NSS of the STA */
+       uint8 bw;               /* BW of the STA */
+       int8 rssi;              /* RSSI of the STA */
+       uint8 traffic;          /* internal metric of traffic */
+} wl_event_mode_switch_dyn160;
+
+#define WL_EVENT_FBT_VER_1             1
+
+#define WL_E_FBT_TYPE_FBT_OTD_AUTH     1
+#define WL_E_FBT_TYPE_FBT_OTA_AUTH     2
+
+/* event structure for WLC_E_FBT */
+typedef struct {
+       uint16 version;
+       uint16 length;  /* size including 'data' field */
+       uint16 type; /* value 0: unknown, 1: FBT OTD Auth Req */
+       uint16 data_offset;     /* offset to 'data' from beginning of this struct.
+                                * fields may be added between data_offset and data
+                                */
+       /* ADD NEW FIELDS HERE */
+       uint8 data[];   /* type specific data; could be empty */
+} wl_event_fbt_t;
+
+/* TWT Setup Completion is designed to notify the user of TWT Setup process
+ * status. When 'status' field is value of BCME_OK, the user must check the
+ * 'setup_cmd' field value in 'wl_twt_sdesc_t' structure that at the end of
+ * the event data to see the response from the TWT Responding STA; when
+ * 'status' field is value of BCME_ERROR or non BCME_OK, user must not use
+ * anything from 'wl_twt_sdesc_t' structure as it is the TWT Requesting STA's
+ * own TWT parameter.
+ */
+
+#define WL_TWT_SETUP_CPLT_VER  0
+
+/* TWT Setup Completion event data */
+typedef struct wl_twt_setup_cplt {
+       uint16 version;
+       uint16 length;  /* the byte count of fields from 'dialog' onwards */
+       uint8 dialog;   /* the dialog token user supplied to the TWT setup API */
+       uint8 pad[3];
+       int32 status;
+       /* wl_twt_sdesc_t desc; - defined in wlioctl.h */
+} wl_twt_setup_cplt_t;
+
+#define WL_INVALID_IE_EVENT_VERSION    0
+
+/* Invalid IE Event data */
+typedef struct wl_invalid_ie_event {
+       uint16 version;
+       uint16 len;      /* Length of the invalid IE copy */
+       uint16 type;     /* Type/subtype of the frame which contains the invalid IE */
+       uint16 error;    /* error code of the wrong IE, defined in ie_error_code_t */
+       uint8  ie[];     /* Variable length buffer for the invalid IE copy */
+} wl_invalid_ie_event_t;
+
+/* Fixed header portion of Invalid IE Event */
+typedef struct wl_invalid_ie_event_hdr {
+       uint16 version;
+       uint16 len;      /* Length of the invalid IE copy */
+       uint16 type;     /* Type/subtype of the frame which contains the invalid IE */
+       uint16 error;    /* error code of the wrong IE, defined in ie_error_code_t */
+       /* var length IE data follows */
+} wl_invalid_ie_event_hdr_t;
+
+typedef enum ie_error_code {
+       IE_ERROR_OUT_OF_RANGE = 0x01
+} ie_error_code_t;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+/* reason of channel switch */
+typedef enum {
+       CHANSW_DFS = 10,        /* channel switch due to DFS module */
+       CHANSW_HOMECH_REQ = 14, /* channel switch due to HOME Channel Request */
+       CHANSW_STA = 15,        /* channel switch due to STA */
+       CHANSW_SOFTAP = 16,     /* channel switch due to SodtAP */
+       CHANSW_AIBSS = 17,      /* channel switch due to AIBSS */
+       CHANSW_NAN = 18,        /* channel switch due to NAN */
+       CHANSW_NAN_DISC = 19,   /* channel switch due to NAN Disc */
+       CHANSW_NAN_SCHED = 20,  /* channel switch due to NAN Sched */
+
+       CHANSW_TDLS = 26,       /* channel switch due to TDLS */
+       CHANSW_PROXD = 27,      /* channel switch due to PROXD */
+       CHANSW_SLOTTED_BSS = 28, /* channel switch due to slotted bss */
+       CHANSW_SLOTTED_CMN_SYNC = 29, /* channel switch due to Common Sync Layer */
+       CHANSW_SLOTTED_BSS_CAL = 30,    /* channel switch due to Cal request from slotted bss */
+       CHANSW_MAX_NUMBER = 31  /* max channel switch reason */
+} wl_chansw_reason_t;
+
+#define CHANSW_REASON(reason)  (1 << reason)
+
+#define EVENT_AGGR_DATA_HDR_LEN        8
+
+typedef struct event_aggr_data {
+       uint16  num_events; /* No of events aggregated */
+       uint16  len;    /* length of the aggregated events, excludes padding */
+       uint8   pad[4]; /* Padding to make aggr event packet header aligned
+                                        * on 64-bit boundary, for a 64-bit host system.
+                                        */
+       uint8   data[]; /* Aggregate buffer containing Events */
+} event_aggr_data_t;
+
+/* WLC_E_TVPM_MITIGATION event structure version */
+#define WL_TVPM_MITIGATION_VERSION 1
+
+/* TVPM mitigation on/off status bits */
+#define WL_TVPM_MITIGATION_TXDC                0x1
+#define WL_TVPM_MITIGATION_TXPOWER     0x2
+#define WL_TVPM_MITIGATION_TXCHAINS    0x4
+
+/* Event structure for WLC_E_TVPM_MITIGATION */
+typedef struct wl_event_tvpm_mitigation {
+       uint16 version;         /* structure version */
+       uint16 length;          /* length of this structure */
+       uint32 timestamp_ms;    /* millisecond timestamp */
+       uint8 slice;            /* slice number */
+       uint8 pad;
+       uint16 on_off;          /* mitigation status bits */
+} wl_event_tvpm_mitigation_t;
+
+/* Event structures for sub health checks of PHY */
+
+#define WL_PHY_HC_DESENSE_STATS_VER (1)
+typedef struct wl_hc_desense_stats {
+       uint16 version;
+       uint16 chanspec;
+       int8 allowed_weakest_rssi; /* based on weakest link RSSI */
+       uint8 ofdm_desense; /* Desense requested for OFDM */
+       uint8 bphy_desense; /* Desense requested for bphy */
+       int8 glitch_upd_wait; /* wait post ACI mitigation */
+} wl_hc_desense_stats_v1_t;
+
+#define WL_PHY_HC_TEMP_STATS_VER (1)
+typedef struct wl_hc_temp_stats {
+       uint16 version;
+       uint16 chanspec;
+       int16 curtemp; /* Temperature */
+       uint8 temp_disthresh; /* Threshold to reduce tx chain */
+       uint8 temp_enthresh; /* Threshold to increase tx chains */
+       uint tempsense_period; /* Temperature check period */
+       bool heatedup; /* 1: temp throttling on */
+       uint8 bitmap; /* Indicating rx and tx chains */
+       uint8 pad[2];
+} wl_hc_temp_stats_v1_t;
+
+#define WL_PHY_HC_TEMP_STATS_VER_2 (2)
+typedef struct {
+       uint16 version;
+       uint16 chanspec;
+       int16 curtemp; /* Temperature */
+       uint8 pad[2];
+} wl_hc_temp_stats_v2_t;
+
+#define WL_PHY_HC_VCOCAL_STATS_VER (1)
+typedef struct wl_hc_vcocal_stats {
+       uint16 version;
+       uint16 chanspec;
+       int16 curtemp;  /* Temperature */
+       /* Ring buffer - Maintains history of previous 16 wake/sleep cycles */
+       uint16 vcocal_status_wake;
+       uint16 vcocal_status_sleep;
+       uint16 plllock_status_wake;
+       uint16 plllock_status_sleep;
+       /* Cal Codes */
+       uint16 cc_maincap;
+       uint16 cc_secondcap;
+       uint16 cc_auxcap;
+} wl_hc_vcocal_stats_v1_t;
+
+#define WL_PHY_HC_TXPWR_STATS_VER (1)
+typedef struct wl_hc_tx_stats {
+       uint16 version;
+       uint16 chanspec;
+       int8 tgt_pwr[MAX_PHY_CORE_NUM]; /* Target pwr (qdBm) */
+       int8 estPwr[MAX_PHY_CORE_NUM]; /* Rate corrected (qdBm) */
+       int8 estPwr_adj[MAX_PHY_CORE_NUM]; /* Max power (qdBm) */
+       uint8 baseindex[MAX_PHY_CORE_NUM]; /* Tx base index */
+       int16 temp;     /* Temperature */
+       uint16 TxCtrlWrd[3]; /* 6 PHY ctrl bytes */
+       int8 min_txpower; /* min tx power per ant */
+       uint8 pad[3];
+} wl_hc_txpwr_stats_v1_t;
+
+#define WL_PHY_HC_TXPWR_STATS_VER_2 (2)
+typedef struct {
+       uint16 version;
+       uint16 chanspec;
+       int8 tgt_pwr[MAX_PHY_CORE_NUM]; /* Target pwr (qdBm) */
+       uint8 estPwr[MAX_PHY_CORE_NUM]; /* Rate corrected (qdBm) */
+       uint8 estPwr_adj[MAX_PHY_CORE_NUM]; /* Max power (qdBm) */
+       uint8 baseindex[MAX_PHY_CORE_NUM]; /* Tx base index */
+       int16 temp;     /* Temperature */
+       uint16 TxCtrlWrd[3]; /* 6 PHY ctrl bytes */
+       int8 min_txpower; /* min tx power per ant */
+       uint8 pad[3];
+} wl_hc_txpwr_stats_v2_t;
+
+typedef enum wl_mbo_event_type {
+       WL_MBO_E_CELLULAR_NW_SWITCH = 1,
+       WL_MBO_E_BTM_RCVD = 2,
+       /* ADD before this */
+       WL_MBO_E_LAST = 3  /* highest val + 1 for range checking */
+} wl_mbo_event_type_t;
+
+/* WLC_E_MBO event structure version */
+#define WL_MBO_EVT_VER 1
+
+struct wl_event_mbo {
+       uint16 version; /* structure version */
+       uint16 length;          /* length of the rest of the structure from type */
+       wl_mbo_event_type_t  type;              /* Event type */
+       uint8  data[];    /* Variable length data */
+};
+
+/* WLC_E_MBO_CELLULAR_NW_SWITCH event structure version */
+#define WL_MBO_CELLULAR_NW_SWITCH_VER 1
+
+/* WLC_E_MBO_CELLULAR_NW_SWITCH event data */
+struct wl_event_mbo_cell_nw_switch {
+       uint16 version;         /* structure version */
+       uint16 length;          /* length of the rest of the structure from reason */
+       /* Reason of switch as per MBO Tech spec */
+       uint8 reason;
+       /* pad */
+       uint8 pad;
+       /* delay after which re-association can be tried to current BSS (seconds) */
+       uint16 reassoc_delay;
+       /* How long current association will be there (milli seconds).
+       * This is zero if not known or value is overflowing.
+       */
+       uint32 assoc_time_remain;
+};
+
+/* WLC_E_MBO_BTM_RCVD event structure version */
+#define WL_BTM_EVENT_DATA_VER_1       1
+/* Specific btm event type data */
+struct wl_btm_event_type_data {
+       uint16  version;
+       uint16  len;
+       uint8   transition_reason;      /* transition reason code */
+       uint8   pad[3];                 /* pad */
+};
+
+/* WLC_E_PRUNE event structure version */
+#define WL_BSSID_PRUNE_EVT_VER_1       1
+/* MBO-OCE params */
+struct wl_bssid_prune_evt_info {
+       uint16 version;
+       uint16 len;
+       uint8   SSID[32];
+       uint32  time_remaining;         /* Time remaining */
+       struct ether_addr BSSID;
+       uint8   SSID_len;
+       uint8   reason;                 /* Reason code */
+       int8    rssi_threshold;         /* RSSI threshold */
+       uint8   pad[3];                 /* pad */
+};
+
+/* WLC_E_HWA Event structure */
+typedef struct wl_event_hwa {
+       uint16 version; /* structure version */
+       uint16 length; /* length of structure */
+       uint32 sub_type; /* Sub event type */
+       uint8 data[0]; /* variable length data */
+} wl_event_hwa_t;
+
+#define WL_HWA_EVENT_VER       1
+
+typedef enum wl_event_hwa_subtype {
+       WL_HWA_EVENT_SUBTYPE_ERROR = 1,
+       WL_HWA_EVENT_SUBTYPE_LAST = 2
+} wl_event_hwa_subtype_t;
+
+/* WLC_E_ADPS status */
+enum {
+       WL_E_STATUS_ADPS_DEAUTH = 0,
+       WL_E_STATUS_ADPS_MAX
+};
+
+/* WLC_E_ADPS event data */
+#define WL_EVENT_ADPS_VER_1            1
+
+/* WLC_E_ADPS event type */
+#define WL_E_TYPE_ADPS_BAD_AP          1
+
+typedef struct wl_event_adps_bad_ap {
+       uint32 status;
+       uint32 reason;
+       struct ether_addr ea;   /* bssid */
+} wl_event_adps_bad_ap_t;
+
+typedef struct wl_event_adps {
+       uint16  version;        /* structure version */
+       uint16  length;         /* length of structure */
+       uint32  type;           /* event type */
+       uint8   data[];         /* variable length data */
+} wl_event_adps_v1_t;
+
+typedef wl_event_adps_v1_t wl_event_adps_t;
+
+#define WLC_USER_E_KEY_UPDATE  1 /* Key add/remove */
+#define WLC_USER_E_FORCE_FLUSH 2 /* SDC force flush */
+
+/* OBSS HW event data */
+typedef struct wlc_obss_hw_event_data {
+       uint16 available_chanspec;      /* Contains band, channel and BW info */
+} wlc_obss_hw_event_data_t;
+
+/* status when WLC_E_OBSS_DETECTION */
+#define WLC_OBSS_BW_UPDATED    1 /* Sent when BW is update at SW */
+#define WLC_OBSS_BW_AVAILABLE  2 /* Sent When a change in BW is detected / noticed */
+
+/* WLC_E_DYNSAR event structure version */
+#define WL_DYNSAR_VERSION 1
+
+/* bits used in status field */
+#define WL_STATUS_DYNSAR_PWR_OPT       (1 << 0)        /* power optimized */
+#define WL_STATUS_DYNSAR_FAILSAFE      (1 << 1)        /* radio is using failsafe cap values */
+#define WL_STATUS_DYNSAR_NOMUTE_OPT    (1 << 2)        /* ack mute */
+/* temporary to update other components */
+#define WL_STATUS_DYNSAR_ACK_MUTE      WL_STATUS_DYNSAR_NOMUTE_OPT
+
+/* Event structure for WLC_E_DYNSAR */
+typedef struct wl_event_dynsar {
+       uint16 version;         /* structure version */
+       uint16 length;          /* length of this structure */
+       uint32 timestamp_ms;    /* millisecond timestamp */
+       uint8  opt;             /* optimization power offset */
+       uint8  slice;           /* slice number */
+       uint8  status;          /* WL_STATUS_DYNSAR_XXX, to indicate which optimization
+                               * is being applied
+                               */
+       uint8  pad;
+} wl_event_dynsar_t;
+
+/* status when WLC_E_AP_BCN_MUTE event is sent */
+#define BCN_MUTE_MITI_ACTIVE   1u      /* Mitigation is activated when probe response received
+                                        * but Beacon is not received
+                                        */
+#define BCN_MUTE_MITI_END      2u      /* Sent when beacon is received */
+#define BCN_MUTE_MITI_TIMEOUT  3u      /* Mitigation period is reached */
+
+/* bcn_mute_miti event data */
+#define WLC_BCN_MUTE_MITI_EVENT_DATA_VER_1     1u
+typedef struct wlc_bcn_mute_miti_event_data_v1 {
+       uint16  version;        /* Structure version number */
+       uint16  length;         /* Length of the whole struct */
+       uint16  uatbtt_count;   /* Number of UATBTT during mitigation */
+       uint8   PAD[2];         /* Pad to fit to 32 bit alignment */
+} wlc_bcn_mute_miti_event_data_v1_t;
+
+/* bcn_drift event data */
+#define WLC_BCN_DRIFT_EVENT_DATA_VER_1 (1u)
+typedef struct wlc_bcn_drift_event_data_v1 {
+       uint16  version;        /* Structure version number */
+       uint16  length;         /* Length of the whole struct */
+       int16   drift;          /* in ms */
+       int16   jitter;         /* in ms */
+} wlc_bcn_drift_event_data_v1_t;
+
+#endif /* _BCMEVENT_H_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmicmp.h b/bcmdhd.101.10.240.x/include/bcmicmp.h
new file mode 100644 (file)
index 0000000..31e809a
--- /dev/null
@@ -0,0 +1,83 @@
+/*
+ * Fundamental constants relating to ICMP Protocol
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _bcmicmp_h_
+#define _bcmicmp_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#define ICMP_TYPE_ECHO_REQUEST 8       /* ICMP type echo request */
+#define ICMP_TYPE_ECHO_REPLY           0       /* ICMP type echo reply */
+
+#define ICMP_CHKSUM_OFFSET     2       /* ICMP body checksum offset */
+
+/* ICMP6 error and control message types */
+#define ICMP6_DEST_UNREACHABLE         1
+#define ICMP6_PKT_TOO_BIG              2
+#define ICMP6_TIME_EXCEEDED            3
+#define ICMP6_PARAM_PROBLEM            4
+#define ICMP6_ECHO_REQUEST             128
+#define ICMP6_ECHO_REPLY               129
+#define ICMP_MCAST_LISTENER_QUERY      130
+#define ICMP_MCAST_LISTENER_REPORT     131
+#define ICMP_MCAST_LISTENER_DONE       132
+#define ICMP6_RTR_SOLICITATION         133
+#define ICMP6_RTR_ADVERTISEMENT                134
+#define ICMP6_NEIGH_SOLICITATION       135
+#define ICMP6_NEIGH_ADVERTISEMENT      136
+#define ICMP6_REDIRECT                 137
+
+#define ICMP6_RTRSOL_OPT_OFFSET                8
+#define ICMP6_RTRADV_OPT_OFFSET                16
+#define ICMP6_NEIGHSOL_OPT_OFFSET      24
+#define ICMP6_NEIGHADV_OPT_OFFSET      24
+#define ICMP6_REDIRECT_OPT_OFFSET      40
+
+BWL_PRE_PACKED_STRUCT struct icmp6_opt {
+       uint8   type;           /* Option identifier */
+       uint8   length;         /* Lenth including type and length */
+       uint8   data[0];        /* Variable length data */
+} BWL_POST_PACKED_STRUCT;
+
+#define        ICMP6_OPT_TYPE_SRC_LINK_LAYER   1
+#define        ICMP6_OPT_TYPE_TGT_LINK_LAYER   2
+#define        ICMP6_OPT_TYPE_PREFIX_INFO      3
+#define        ICMP6_OPT_TYPE_REDIR_HDR        4
+#define        ICMP6_OPT_TYPE_MTU              5
+
+/* These fields are stored in network order */
+BWL_PRE_PACKED_STRUCT struct bcmicmp_hdr {
+       uint8   type;           /* Echo or Echo-reply */
+       uint8   code;           /* Always 0 */
+       uint16  chksum;         /* Icmp packet checksum */
+} BWL_POST_PACKED_STRUCT;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* #ifndef _bcmicmp_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmiov.h b/bcmdhd.101.10.240.x/include/bcmiov.h
new file mode 100644 (file)
index 0000000..05a9f58
--- /dev/null
@@ -0,0 +1,353 @@
+/*
+ * bcmiov.h
+ * Common iovar handling/parsing support - batching, parsing, sub-cmd dispatch etc.
+ * To be used in firmware and host apps or dhd - reducing code size,
+ * duplication, and maintenance overhead.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _bcmiov_h_
+#define _bcmiov_h_
+
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <wlioctl.h>
+#ifdef BCMDRIVER
+#include <osl.h>
+#else
+#include <stddef.h>  /* For size_t */
+#endif /* BCMDRIVER */
+
+/* Forward declarations */
+typedef uint16 bcm_iov_cmd_id_t;
+typedef uint16 bcm_iov_cmd_flags_t;
+typedef uint16 bcm_iov_cmd_mflags_t;
+typedef struct bcm_iov_cmd_info bcm_iov_cmd_info_t;
+typedef struct bcm_iov_cmd_digest bcm_iov_cmd_digest_t;
+typedef struct bcm_iov_cmd_tlv_info bcm_iov_cmd_tlv_info_t;
+typedef struct bcm_iov_buf bcm_iov_buf_t;
+typedef struct bcm_iov_batch_buf bcm_iov_batch_buf_t;
+typedef struct bcm_iov_parse_context bcm_iov_parse_context_t;
+typedef struct bcm_iov_sub_cmd_context bcm_iov_sub_cmd_context_t;
+
+typedef void* (*bcm_iov_malloc_t)(void* alloc_ctx, size_t len);
+typedef void (*bcm_iov_free_t)(void* alloc_ctx, void *buf, size_t len);
+
+typedef uint8 bcm_iov_tlp_data_type_t;
+typedef struct bcm_iov_tlp bcm_iov_tlp_t;
+typedef struct bcm_iov_tlp_node bcm_iov_tlp_node_t;
+typedef struct bcm_iov_batch_subcmd bcm_iov_batch_subcmd_t;
+
+/*
+ * iov validation handler - All the common checks that are required
+ * for processing of iovars for any given command.
+ */
+typedef int (*bcm_iov_cmd_validate_t)(const bcm_iov_cmd_digest_t *dig,
+       uint32 actionid, const uint8* ibuf, size_t ilen, uint8 *obuf, size_t *olen);
+
+/* iov get handler - process subcommand specific input and return output.
+ * input and output may overlap, so the callee needs to check if
+ * that is supported. For xtlv data a tlv digest is provided to make
+ * parsing simpler. Output tlvs may be packed into output buffer using
+ * bcm xtlv support. olen is input/output parameter. On input contains
+ * max available obuf length and callee must fill the correct length
+ * to represent the length of output returned.
+ */
+typedef int (*bcm_iov_cmd_get_t)(const bcm_iov_cmd_digest_t *dig,
+       const uint8* ibuf, size_t ilen, uint8 *obuf, size_t *olen);
+
+/* iov set handler - process subcommand specific input and return output
+ * input and output may overlap, so the callee needs to check if
+ * that is supported. olen is input/output parameter. On input contains
+ * max available obuf length and callee must fill the correct length
+ * to represent the length of output returned.
+ */
+typedef int (*bcm_iov_cmd_set_t)(const bcm_iov_cmd_digest_t *dig,
+       const uint8* ibuf, size_t ilen, uint8 *obuf, size_t *olen);
+
+/* iov (sub-cmd) batch - a vector of commands. count can be zero
+ * to support a version query. Each command is a tlv - whose data
+ * portion may have an optional return status, followed by a fixed
+ * length data header, optionally followed by tlvs.
+ *    cmd = type|length|<status|options>[header][tlvs]
+ */
+
+/*
+ * Batch sub-commands have status length included in the
+ * response length packed in TLV.
+ */
+#define BCM_IOV_STATUS_LEN sizeof(uint32)
+
+/* batch version is indicated by setting high bit. */
+#define BCM_IOV_BATCH_MASK     0x8000
+
+/*
+ * Batched commands will have the following memory layout
+ * +--------+---------+--------+-------+
+ * |version |count    | is_set |sub-cmd|
+ * +--------+---------+--------+-------+
+ * version >= 0x8000
+ * count = number of sub-commands encoded in the iov buf
+ * sub-cmd one or more sub-commands for processing
+ * Where sub-cmd is padded byte buffer with memory layout as follows
+ * +--------+---------+-----------------------+-------------+------
+ * |cmd-id  |length   |IN(options) OUT(status)|command data |......
+ * +--------+---------+-----------------------+-------------+------
+ * cmd-id =sub-command ID
+ * length = length of this sub-command
+ * IN(options) = On input processing options/flags for this command
+ * OUT(status) on output processing status for this command
+ * command data = encapsulated IOVAR data as a single structure or packed TLVs for each
+ * individual sub-command.
+ */
+struct bcm_iov_batch_subcmd {
+       uint16 id;
+       uint16 len;
+       union {
+               uint32 options;
+               uint32 status;
+       } u;
+       uint8 data[1];
+};
+
+struct bcm_iov_batch_buf {
+       uint16 version;
+       uint8 count;
+       uint8 is_set; /* to differentiate set or get */
+       struct bcm_iov_batch_subcmd cmds[0];
+};
+
+/* non-batched command version = major|minor w/ major <= 127 */
+struct bcm_iov_buf {
+       uint16 version;
+       uint16 len;
+       bcm_iov_cmd_id_t id;
+       uint16 data[1]; /* 32 bit alignment may be repurposed by the command */
+       /* command specific data follows */
+};
+
+/* iov options flags */
+enum {
+       BCM_IOV_CMD_OPT_ALIGN_NONE = 0x0000,
+       BCM_IOV_CMD_OPT_ALIGN32 = 0x0001,
+       BCM_IOV_CMD_OPT_TERMINATE_SUB_CMDS = 0x0002
+};
+
+/* iov command flags */
+enum {
+       BCM_IOV_CMD_FLAG_NONE = 0,
+       BCM_IOV_CMD_FLAG_STATUS_PRESENT = (1 << 0), /* status present at data start - output only */
+       BCM_IOV_CMD_FLAG_XTLV_DATA = (1 << 1),  /* data is a set of xtlvs */
+       BCM_IOV_CMD_FLAG_HDR_IN_LEN = (1 << 2), /* length starts at version - non-bacthed only */
+       BCM_IOV_CMD_FLAG_NOPAD = (1 << 3) /* No padding needed after iov_buf */
+};
+
+/* information about the command, xtlv options and xtlvs_off are meaningful
+ * only if XTLV_DATA cmd flag is selected
+ */
+struct bcm_iov_cmd_info {
+       bcm_iov_cmd_id_t        cmd;            /* the (sub)command - module specific */
+       bcm_iov_cmd_flags_t     flags;          /* checked by bcmiov but set by module */
+       bcm_iov_cmd_mflags_t    mflags;         /* owned and checked by module */
+       bcm_xtlv_opts_t         xtlv_opts;
+       bcm_iov_cmd_validate_t  validate_h;     /* command validation handler */
+       bcm_iov_cmd_get_t       get_h;
+       bcm_iov_cmd_set_t       set_h;
+       uint16                  xtlvs_off;      /* offset to beginning of xtlvs in cmd data */
+       uint16                  min_len_set;
+       uint16                  max_len_set;
+       uint16                  min_len_get;
+       uint16                  max_len_get;
+};
+
+/* tlv digest to support parsing of xtlvs for commands w/ tlv data; the tlv
+ * digest is available in the handler for the command. The count and order in
+ * which tlvs appear in the digest are exactly the same as the order of tlvs
+ * passed in the registration for the command. Unknown tlvs are ignored.
+ * If registered tlvs are missing datap will be NULL. common iov rocessing
+ * acquires an input digest to process input buffer. The handler is responsible
+ * for constructing an output digest and use packing functions to generate
+ * the output buffer. The handler may use the input digest as output digest once
+ * the tlv data is extracted and used. Multiple tlv support involves allocation of
+ * tlp nodes, except the first, as required,
+ */
+
+/* tlp data type indicates if the data is not used/invalid, input or output */
+enum {
+       BCM_IOV_TLP_NODE_INVALID = 0,
+       BCM_IOV_TLP_NODE_IN = 1,
+       BCM_IOV_TLP_NODE_OUT = 2
+};
+
+struct bcm_iov_tlp {
+       uint16 type;
+       uint16 len;
+       uint16 nodeix;  /* node index */
+};
+
+/* tlp data for a given tlv - multiple tlvs of same type chained */
+struct bcm_iov_tlp_node {
+       uint8 *next;    /* multiple tlv support */
+       bcm_iov_tlp_data_type_t type;
+       uint8 *data;    /* pointer to data in buffer or state */
+};
+
+struct bcm_iov_cmd_digest {
+       uint32 version;         /* Version */
+       void *cmd_ctx;
+       struct wlc_bsscfg *bsscfg;
+       const bcm_iov_cmd_info_t *cmd_info;
+       uint16 max_tlps;        /* number of tlps allocated */
+       uint16 max_nodes;       /* number of nods allocated */
+       uint16 num_tlps;        /* number of tlps valid */
+       uint16 num_nodes;       /* number of nods valid */
+       uint16 tlps_off;        /* offset to tlps */
+       uint16 nodes_off;       /* offset to nodes */
+       /*
+        * bcm_iov_tlp_t tlps[max_tlps];
+        * bcm_iov_tlp_node_t nodes[max_nodes]
+       */
+};
+
+/* get length callback - default length is min_len taken from digest */
+typedef size_t (*bcm_iov_xtlv_get_len_t)(const bcm_iov_cmd_digest_t *dig,
+       const bcm_iov_cmd_tlv_info_t *tlv_info);
+
+/* pack to buffer data callback. under some conditions it might
+ * not be a straight copy and can refer to context(ual) information and
+ * endian conversions...
+ */
+typedef void (*bcm_iov_xtlv_pack_t)(const bcm_iov_cmd_digest_t *dig,
+       const bcm_iov_cmd_tlv_info_t *tlv_info,
+       uint8 *out_buf, const uint8 *in_data, size_t len);
+
+struct bcm_iov_cmd_tlv_info {
+       uint16 id;
+       uint16 min_len; /* inclusive */
+       uint16 max_len; /* inclusive */
+       bcm_iov_xtlv_get_len_t get_len;
+       bcm_iov_xtlv_pack_t pack;
+};
+
+/*
+ * module private parse context. Default version type len is uint16
+ */
+
+/* Command parsing options with respect to validation */
+/* Possible values for parse context options */
+/* Bit 0 - Validate only */
+#define BCM_IOV_PARSE_OPT_BATCH_VALIDATE 0x00000001
+
+typedef uint32 bcm_iov_parse_opts_t;
+
+/* get digest callback */
+typedef int (*bcm_iov_get_digest_t)(void *cmd_ctx, bcm_iov_cmd_digest_t **dig);
+
+typedef struct bcm_iov_parse_config {
+       bcm_iov_parse_opts_t options; /* to handle different ver lengths */
+       bcm_iov_malloc_t alloc_fn;
+       bcm_iov_free_t free_fn;
+       bcm_iov_get_digest_t dig_fn;
+       int max_regs;
+       void *alloc_ctx;
+} bcm_iov_parse_config_t;
+
+/* API */
+
+/* All calls return an integer status code BCME_* unless otherwise indicated */
+
+/* return length of allocation for 'num_cmds' commands. data_len
+ * includes length of data for all the commands excluding the headers
+ */
+size_t bcm_iov_get_alloc_len(int num_cmds, size_t data_len);
+
+/* create parsing context using allocator provided; max_regs provides
+ * the number of allowed registrations for commands using the context
+ * sub-components of a module may register their own commands indepdently
+ * using the parsing context. If digest callback is NULL or returns NULL,
+ * the (input) digest is allocated using the provided allocators and released on
+ * completion of processing.
+ */
+int bcm_iov_create_parse_context(const bcm_iov_parse_config_t *parse_cfg,
+       bcm_iov_parse_context_t **parse_ctx);
+
+/* free the parsing context; ctx is set to NULL on exit */
+int bcm_iov_free_parse_context(bcm_iov_parse_context_t **ctx, bcm_iov_free_t free_fn);
+
+/* Return the command context for the module */
+void *bcm_iov_get_cmd_ctx_info(bcm_iov_parse_context_t *parse_ctx);
+
+/* register a command info vector along with supported tlvs. Each command
+ * may support a subset of tlvs
+ */
+int bcm_iov_register_commands(bcm_iov_parse_context_t *parse_ctx, void *cmd_ctx,
+       const bcm_iov_cmd_info_t *info, size_t num_cmds,
+       const bcm_iov_cmd_tlv_info_t *tlv_info, size_t num_tlvs);
+
+/* pack the xtlvs provided in the digest. may returns BCME_BUFTOOSHORT, but the
+ * out_len is set to required length in that case.
+ */
+int bcm_iov_pack_xtlvs(const bcm_iov_cmd_digest_t *dig,  bcm_xtlv_opts_t xtlv_opts,
+       uint8 *out_buf, size_t out_size, size_t *out_len);
+
+#ifdef BCMDRIVER
+/* wlc modules register their iovar(s) using the parsing context w/ wlc layer
+ * during attach.
+ */
+struct wlc_if;
+struct wlc_info;
+extern struct wlc_bsscfg *bcm_iov_bsscfg_find_from_wlcif(struct wlc_info *wlc,
+       struct wlc_if *wlcif);
+int bcm_iov_doiovar(void *parse_ctx, uint32 id, void *params, uint params_len,
+    void *arg, uint arg_len, uint vsize, struct wlc_if *intf);
+#endif /* BCMDRIVER */
+
+/* parsing context helpers */
+
+/* get the maximum number of tlvs - can be used to allocate digest for all
+ * commands. the digest can be shared. Negative values are BCM_*, >=0, the
+ * number of tlvs
+ */
+int  bcm_iov_parse_get_max_tlvs(const bcm_iov_parse_context_t *ctx);
+
+/* common packing support */
+
+/* pack a buffer of uint8s - memcpy wrapper */
+int bcm_iov_pack_buf(const bcm_iov_cmd_digest_t *dig, uint8 *buf,
+       const uint8 *data, size_t len);
+
+#define bcm_iov_packv_u8 bcm_iov_pack_buf
+
+/*
+ * pack a buffer with uint16s - serialized in LE order, data points to uint16
+ * length is not checked.
+ */
+int bcm_iov_packv_u16(const bcm_iov_cmd_digest_t *dig, uint8 *buf,
+       const uint16 *data, int n);
+
+/*
+ * pack a buffer with uint32s - serialized in LE order - data points to uint32
+ * length is not checked.
+ */
+int bcm_iov_packv_u32(const bcm_iov_cmd_digest_t *dig, uint8 *buf,
+       const uint32 *data, int n);
+
+#endif /* _bcmiov_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmip.h b/bcmdhd.101.10.240.x/include/bcmip.h
new file mode 100644 (file)
index 0000000..494632d
--- /dev/null
@@ -0,0 +1,244 @@
+/*
+ * Fundamental constants relating to IP Protocol
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _bcmip_h_
+#define _bcmip_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* IPV4 and IPV6 common */
+#define IP_VER_OFFSET          0x0     /* offset to version field */
+#define IP_VER_MASK            0xf0    /* version mask */
+#define IP_VER_SHIFT           4       /* version shift */
+#define IP_VER_4               4       /* version number for IPV4 */
+#define IP_VER_6               6       /* version number for IPV6 */
+
+#define IP_VER(ip_body) \
+       ((((uint8 *)(ip_body))[IP_VER_OFFSET] & IP_VER_MASK) >> IP_VER_SHIFT)
+
+#define IP_PROT_ICMP           0x1     /* ICMP protocol */
+#define IP_PROT_IGMP           0x2     /* IGMP protocol */
+#define IP_PROT_TCP            0x6     /* TCP protocol */
+#define IP_PROT_UDP            0x11    /* UDP protocol type */
+#define IP_PROT_GRE            0x2f    /* GRE protocol type */
+#define IP_PROT_ICMP6           0x3a    /* ICMPv6 protocol type */
+
+/* IPV4 field offsets */
+#define IPV4_VER_HL_OFFSET      0       /* version and ihl byte offset */
+#define IPV4_TOS_OFFSET         1       /* type of service offset */
+#define IPV4_PKTLEN_OFFSET      2       /* packet length offset */
+#define IPV4_PKTFLAG_OFFSET     6       /* more-frag,dont-frag flag offset */
+#define IPV4_PROT_OFFSET        9       /* protocol type offset */
+#define IPV4_CHKSUM_OFFSET      10      /* IP header checksum offset */
+#define IPV4_SRC_IP_OFFSET      12      /* src IP addr offset */
+#define IPV4_DEST_IP_OFFSET     16      /* dest IP addr offset */
+#define IPV4_OPTIONS_OFFSET     20      /* IP options offset */
+#define IPV4_MIN_HEADER_LEN     20      /* Minimum size for an IP header (no options) */
+
+/* IPV4 field decodes */
+#define IPV4_VER_MASK          0xf0    /* IPV4 version mask */
+#define IPV4_VER_SHIFT         4       /* IPV4 version shift */
+
+#define IPV4_HLEN_MASK         0x0f    /* IPV4 header length mask */
+#define IPV4_HLEN(ipv4_body)   (4 * (((uint8 *)(ipv4_body))[IPV4_VER_HL_OFFSET] & IPV4_HLEN_MASK))
+
+#define IPV4_HLEN_MIN          (4 * 5) /* IPV4 header minimum length */
+
+#define IPV4_ADDR_LEN          4       /* IPV4 address length */
+
+#define IPV4_ADDR_NULL(a)      ((((uint8 *)(a))[0] | ((uint8 *)(a))[1] | \
+                                 ((uint8 *)(a))[2] | ((uint8 *)(a))[3]) == 0)
+
+#define IPV4_ADDR_BCAST(a)     ((((uint8 *)(a))[0] & ((uint8 *)(a))[1] & \
+                                 ((uint8 *)(a))[2] & ((uint8 *)(a))[3]) == 0xff)
+
+#define        IPV4_TOS_DSCP_MASK      0xfc    /* DiffServ codepoint mask */
+#define        IPV4_TOS_DSCP_SHIFT     2       /* DiffServ codepoint shift */
+
+#define        IPV4_TOS(ipv4_body)     (((uint8 *)(ipv4_body))[IPV4_TOS_OFFSET])
+
+#define        IPV4_TOS_PREC_MASK      0xe0    /* Historical precedence mask */
+#define        IPV4_TOS_PREC_SHIFT     5       /* Historical precedence shift */
+
+#define IPV4_TOS_LOWDELAY      0x10    /* Lowest delay requested */
+#define IPV4_TOS_THROUGHPUT    0x8     /* Best throughput requested */
+#define IPV4_TOS_RELIABILITY   0x4     /* Most reliable delivery requested */
+
+#define IPV4_TOS_ROUTINE        0
+#define IPV4_TOS_PRIORITY       1
+#define IPV4_TOS_IMMEDIATE      2
+#define IPV4_TOS_FLASH          3
+#define IPV4_TOS_FLASHOVERRIDE  4
+#define IPV4_TOS_CRITICAL       5
+#define IPV4_TOS_INETWORK_CTRL  6
+#define IPV4_TOS_NETWORK_CTRL   7
+
+#define IPV4_PROT(ipv4_body)   (((uint8 *)(ipv4_body))[IPV4_PROT_OFFSET])
+
+#define IPV4_FRAG_RESV         0x8000  /* Reserved */
+#define IPV4_FRAG_DONT         0x4000  /* Don't fragment */
+#define IPV4_FRAG_MORE         0x2000  /* More fragments */
+#define IPV4_FRAG_OFFSET_MASK  0x1fff  /* Fragment offset */
+
+#define IPV4_ADDR_STR_LEN      16      /* Max IP address length in string format */
+
+/* IPV4 packet formats */
+BWL_PRE_PACKED_STRUCT struct ipv4_addr {
+       uint8   addr[IPV4_ADDR_LEN];
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct ipv4_hdr {
+       uint8   version_ihl;            /* Version and Internet Header Length */
+       uint8   tos;                    /* Type Of Service */
+       uint16  tot_len;                /* Number of bytes in packet (max 65535) */
+       uint16  id;
+       uint16  frag;                   /* 3 flag bits and fragment offset */
+       uint8   ttl;                    /* Time To Live */
+       uint8   prot;                   /* Protocol */
+       uint16  hdr_chksum;             /* IP header checksum */
+       uint8   src_ip[IPV4_ADDR_LEN];  /* Source IP Address */
+       uint8   dst_ip[IPV4_ADDR_LEN];  /* Destination IP Address */
+} BWL_POST_PACKED_STRUCT;
+
+/* IPV6 field offsets */
+#define IPV6_PAYLOAD_LEN_OFFSET        4       /* payload length offset */
+#define IPV6_NEXT_HDR_OFFSET   6       /* next header/protocol offset */
+#define IPV6_HOP_LIMIT_OFFSET  7       /* hop limit offset */
+#define IPV6_SRC_IP_OFFSET     8       /* src IP addr offset */
+#define IPV6_DEST_IP_OFFSET    24      /* dst IP addr offset */
+
+/* IPV6 field decodes */
+#define IPV6_TRAFFIC_CLASS(ipv6_body) \
+       (((((uint8 *)(ipv6_body))[0] & 0x0f) << 4) | \
+        ((((uint8 *)(ipv6_body))[1] & 0xf0) >> 4))
+
+#define IPV6_FLOW_LABEL(ipv6_body) \
+       (((((uint8 *)(ipv6_body))[1] & 0x0f) << 16) | \
+        (((uint8 *)(ipv6_body))[2] << 8) | \
+        (((uint8 *)(ipv6_body))[3]))
+
+#define IPV6_PAYLOAD_LEN(ipv6_body) \
+       ((((uint8 *)(ipv6_body))[IPV6_PAYLOAD_LEN_OFFSET + 0] << 8) | \
+        ((uint8 *)(ipv6_body))[IPV6_PAYLOAD_LEN_OFFSET + 1])
+
+#define IPV6_NEXT_HDR(ipv6_body) \
+       (((uint8 *)(ipv6_body))[IPV6_NEXT_HDR_OFFSET])
+
+#define IPV6_PROT(ipv6_body)   IPV6_NEXT_HDR(ipv6_body)
+
+#define IPV6_ADDR_LEN          16      /* IPV6 address length */
+
+/* IPV4 TOS or IPV6 Traffic Classifier or 0 */
+#define IP_TOS46(ip_body) \
+       (IP_VER(ip_body) == IP_VER_4 ? IPV4_TOS(ip_body) : \
+        IP_VER(ip_body) == IP_VER_6 ? IPV6_TRAFFIC_CLASS(ip_body) : 0)
+
+#define IP_DSCP46(ip_body) (IP_TOS46(ip_body) >> IPV4_TOS_DSCP_SHIFT);
+
+/* IPV4 or IPV6 Protocol Classifier or 0 */
+#define IP_PROT46(ip_body) \
+       (IP_VER(ip_body) == IP_VER_4 ? IPV4_PROT(ip_body) : \
+        IP_VER(ip_body) == IP_VER_6 ? IPV6_PROT(ip_body) : 0)
+
+/* IPV6 extension headers (options) */
+#define IPV6_EXTHDR_HOP                0
+#define IPV6_EXTHDR_ROUTING    43
+#define IPV6_EXTHDR_FRAGMENT   44
+#define IPV6_EXTHDR_AUTH       51
+#define IPV6_EXTHDR_NONE       59
+#define IPV6_EXTHDR_DEST       60
+
+#define IPV6_EXTHDR(prot)      (((prot) == IPV6_EXTHDR_HOP) || \
+                                ((prot) == IPV6_EXTHDR_ROUTING) || \
+                                ((prot) == IPV6_EXTHDR_FRAGMENT) || \
+                                ((prot) == IPV6_EXTHDR_AUTH) || \
+                                ((prot) == IPV6_EXTHDR_NONE) || \
+                                ((prot) == IPV6_EXTHDR_DEST))
+
+#define IPV6_MIN_HLEN          40
+
+#define IPV6_EXTHDR_LEN(eh)    ((((struct ipv6_exthdr *)(eh))->hdrlen + 1) << 3)
+
+BWL_PRE_PACKED_STRUCT struct ipv6_exthdr {
+       uint8   nexthdr;
+       uint8   hdrlen;
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct ipv6_exthdr_frag {
+       uint8   nexthdr;
+       uint8   rsvd;
+       uint16  frag_off;
+       uint32  ident;
+} BWL_POST_PACKED_STRUCT;
+
+static INLINE int32
+ipv6_exthdr_len(uint8 *h, uint8 *proto)
+{
+       uint16 len = 0, hlen;
+       struct ipv6_exthdr *eh = (struct ipv6_exthdr *)h;
+
+       while (IPV6_EXTHDR(eh->nexthdr)) {
+               if (eh->nexthdr == IPV6_EXTHDR_NONE)
+                       return -1;
+               else if (eh->nexthdr == IPV6_EXTHDR_FRAGMENT)
+                       hlen = 8U;
+               else if (eh->nexthdr == IPV6_EXTHDR_AUTH)
+                       hlen = (uint16)((eh->hdrlen + 2U) << 2U);
+               else
+                       hlen = (uint16)IPV6_EXTHDR_LEN(eh);
+
+               len += hlen;
+               eh = (struct ipv6_exthdr *)(h + len);
+       }
+
+       *proto = eh->nexthdr;
+       return len;
+}
+
+#define IPV4_ISMULTI(a) (((a) & 0xf0000000) == 0xe0000000)
+
+#define IPV4_MCAST_TO_ETHER_MCAST(ipv4, ether) \
+{ \
+       ether[0] = 0x01; \
+       ether[1] = 0x00; \
+       ether[2] = 0x5E; \
+       ether[3] = (ipv4 & 0x7f0000) >> 16; \
+       ether[4] = (ipv4 & 0xff00) >> 8; \
+       ether[5] = (ipv4 & 0xff); \
+}
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#define IPV4_ADDR_STR "%d.%d.%d.%d"
+#define IPV4_ADDR_TO_STR(addr) ((uint32)addr & 0xff000000) >> 24, \
+                                                               ((uint32)addr & 0x00ff0000) >> 16, \
+                                                               ((uint32)addr & 0x0000ff00) >> 8, \
+                                                               ((uint32)addr & 0x000000ff)
+
+#endif /* _bcmip_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmipv6.h b/bcmdhd.101.10.240.x/include/bcmipv6.h
new file mode 100644 (file)
index 0000000..df5ecd2
--- /dev/null
@@ -0,0 +1,157 @@
+/*
+ * Fundamental constants relating to Neighbor Discovery Protocol
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _bcmipv6_h_
+#define _bcmipv6_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* Extension headers */
+#define IPV6_EXT_HOP   0
+#define IPV6_EXT_ROUTE 43
+#define IPV6_EXT_FRAG  44
+#define IPV6_EXT_DEST  60
+#define IPV6_EXT_ESEC  50
+#define IPV6_EXT_AUTH  51
+
+/* Minimum size (extension header "word" length) */
+#define IPV6_EXT_WORD  8
+
+/* Offsets for most extension headers */
+#define IPV6_EXT_NEXTHDR       0
+#define IPV6_EXT_HDRLEN                1
+
+/* Constants specific to fragmentation header */
+#define IPV6_FRAG_MORE_MASK    0x0001
+#define IPV6_FRAG_MORE_SHIFT   0
+#define IPV6_FRAG_OFFS_MASK    0xfff8
+#define IPV6_FRAG_OFFS_SHIFT   3
+
+/* For icmpv6 */
+#define ICMPV6_HEADER_TYPE     0x3A
+#define ICMPV6_PKT_TYPE_RA     134
+#define ICMPV6_PKT_TYPE_NS     135
+#define ICMPV6_PKT_TYPE_NA     136
+
+#define ICMPV6_ND_OPT_TYPE_TARGET_MAC  2
+#define ICMPV6_ND_OPT_TYPE_SRC_MAC             1
+
+#define ICMPV6_ND_OPT_LEN_LINKADDR             1
+
+#define ICMPV6_ND_OPT_LEN_LINKADDR             1
+
+#define IPV6_VERSION   6
+#define IPV6_HOP_LIMIT         255
+
+#define IPV6_ADDR_NULL(a)      ((a[0] | a[1] | a[2] | a[3] | a[4] | \
+                                                        a[5] | a[6] | a[7] | a[8] | a[9] | \
+                                                        a[10] | a[11] | a[12] | a[13] | \
+                                                        a[14] | a[15]) == 0)
+
+#define IPV6_ADDR_LOCAL(a)     (((a[0] == 0xfe) && (a[1] & 0x80))? TRUE: FALSE)
+
+/* IPV6 address */
+BWL_PRE_PACKED_STRUCT struct ipv6_addr {
+               uint8           addr[16];
+} BWL_POST_PACKED_STRUCT;
+
+/* use masks, htonl instead of bit fileds */
+
+/* ICMPV6 Header */
+BWL_PRE_PACKED_STRUCT struct icmp6_hdr {
+       uint8   icmp6_type;
+       uint8   icmp6_code;
+       uint16  icmp6_cksum;
+       BWL_PRE_PACKED_STRUCT union {
+               uint32 reserved;
+               BWL_PRE_PACKED_STRUCT struct nd_advt {
+                       uint32  reserved1:5,
+                               override:1,
+                               solicited:1,
+                               router:1,
+                               reserved2:24;
+               } BWL_POST_PACKED_STRUCT nd_advt;
+       } BWL_POST_PACKED_STRUCT opt;
+} BWL_POST_PACKED_STRUCT;
+
+/* Ipv6 Header Format */
+BWL_PRE_PACKED_STRUCT struct ipv6_hdr {
+       uint8   priority:4,
+               version:4;
+       uint8   flow_lbl[3];
+       uint16  payload_len;
+       uint8   nexthdr;
+       uint8   hop_limit;
+       struct  ipv6_addr       saddr;
+       struct  ipv6_addr       daddr;
+} BWL_POST_PACKED_STRUCT;
+
+/* Neighbor Advertisement/Solicitation Packet Structure */
+BWL_PRE_PACKED_STRUCT struct bcm_nd_msg {
+       struct  icmp6_hdr       icmph;
+       struct  ipv6_addr       target;
+} BWL_POST_PACKED_STRUCT;
+
+/* Neighibor Solicitation/Advertisement Optional Structure */
+BWL_PRE_PACKED_STRUCT struct nd_msg_opt {
+       uint8 type;
+       uint8 len;
+       uint8 mac_addr[ETHER_ADDR_LEN];
+} BWL_POST_PACKED_STRUCT;
+
+/* Ipv6 Fragmentation Header */
+BWL_PRE_PACKED_STRUCT struct ipv6_frag {
+       uint8   nexthdr;
+       uint8   reserved;
+       uint16  frag_offset;
+       uint32  ident;
+} BWL_POST_PACKED_STRUCT;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+static const struct ipv6_addr all_node_ipv6_maddr = {
+                                                                       { 0xff, 0x2, 0, 0,
+                                                                       0, 0, 0, 0,
+                                                                       0, 0, 0, 0,
+                                                                       0, 0, 0, 1
+                                                                       }};
+
+#define IPV6_ISMULTI(a) (a[0] == 0xff)
+
+#define IPV6_MCAST_TO_ETHER_MCAST(ipv6, ether) \
+{ \
+       ether[0] = 0x33; \
+       ether[1] = 0x33; \
+       ether[2] = ipv6[12]; \
+       ether[3] = ipv6[13]; \
+       ether[4] = ipv6[14]; \
+       ether[5] = ipv6[15]; \
+}
+
+#endif /* !defined(_bcmipv6_h_) */
diff --git a/bcmdhd.101.10.240.x/include/bcmmsgbuf.h b/bcmdhd.101.10.240.x/include/bcmmsgbuf.h
new file mode 100644 (file)
index 0000000..a997a04
--- /dev/null
@@ -0,0 +1,1410 @@
+/*
+ * MSGBUF network driver ioctl/indication encoding
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+#ifndef _bcmmsgbuf_h_
+#define        _bcmmsgbuf_h_
+
+#include <ethernet.h>
+#include <wlioctl.h>
+#include <bcmpcie.h>
+
+#define MSGBUF_MAX_MSG_SIZE   ETHER_MAX_LEN
+
+#define D2H_EPOCH_MODULO               253 /* sequence number wrap */
+#define D2H_EPOCH_INIT_VAL             (D2H_EPOCH_MODULO + 1)
+
+#define H2D_EPOCH_MODULO               253 /* sequence number wrap */
+#define H2D_EPOCH_INIT_VAL             (H2D_EPOCH_MODULO + 1)
+
+#define H2DRING_TXPOST_ITEMSIZE                48
+#define H2DRING_RXPOST_ITEMSIZE                32
+#define H2DRING_CTRL_SUB_ITEMSIZE      40
+
+#define D2HRING_TXCMPLT_ITEMSIZE       24
+#define D2HRING_RXCMPLT_ITEMSIZE       40
+
+#define D2HRING_TXCMPLT_ITEMSIZE_PREREV7       16
+#define D2HRING_RXCMPLT_ITEMSIZE_PREREV7       32
+
+#define D2HRING_CTRL_CMPLT_ITEMSIZE    24
+#define H2DRING_INFO_BUFPOST_ITEMSIZE  H2DRING_CTRL_SUB_ITEMSIZE
+#define D2HRING_INFO_BUFCMPLT_ITEMSIZE D2HRING_CTRL_CMPLT_ITEMSIZE
+
+#define D2HRING_SNAPSHOT_CMPLT_ITEMSIZE                20
+
+#define H2DRING_CTRL_SUB_MAX_ITEM              64
+#define H2DRING_DYNAMIC_INFO_MAX_ITEM          32
+#define D2HRING_DYNAMIC_INFO_MAX_ITEM          32
+
+#define H2DRING_TXPOST_MAX_ITEM                        512
+
+#if defined(DHD_HTPUT_TUNABLES)
+#define H2DRING_RXPOST_MAX_ITEM                        1024
+#define D2HRING_RXCMPLT_MAX_ITEM               1024
+#define D2HRING_TXCMPLT_MAX_ITEM               2048
+/* Only few htput flowrings use htput max items, other use normal max items */
+#define H2DRING_HTPUT_TXPOST_MAX_ITEM          2048
+#else
+#define H2DRING_RXPOST_MAX_ITEM                        512
+#define D2HRING_TXCMPLT_MAX_ITEM               1024
+#define D2HRING_RXCMPLT_MAX_ITEM               512
+#endif /* DHD_HTPUT_TUNABLES */
+
+#define D2HRING_EDL_HDR_SIZE                   48u
+#define D2HRING_EDL_ITEMSIZE                   2048u
+#define D2HRING_EDL_MAX_ITEM                   256u
+#define D2HRING_EDL_WATERMARK                  (D2HRING_EDL_MAX_ITEM >> 5u)
+
+#define D2HRING_CTRL_CMPLT_MAX_ITEM            64
+
+enum {
+       DNGL_TO_HOST_MSGBUF,
+       HOST_TO_DNGL_MSGBUF
+};
+
+enum {
+       HOST_TO_DNGL_TXP_DATA,
+       HOST_TO_DNGL_RXP_DATA,
+       HOST_TO_DNGL_CTRL,
+       DNGL_TO_HOST_DATA,
+       DNGL_TO_HOST_CTRL
+};
+
+#define MESSAGE_PAYLOAD(a) (a & MSG_TYPE_INTERNAL_USE_START) ? TRUE : FALSE
+#define PCIEDEV_FIRMWARE_TSINFO 0x1
+#define PCIEDEV_FIRMWARE_TSINFO_FIRST  0x1
+#define PCIEDEV_FIRMWARE_TSINFO_MIDDLE 0x2
+#define PCIEDEV_BTLOG_POST             0x3
+#define PCIEDEV_BT_SNAPSHOT_POST       0x4
+
+#ifdef PCIE_API_REV1
+
+#define BCMMSGBUF_DUMMY_REF(a, b)      do {BCM_REFERENCE((a));BCM_REFERENCE((b));}  while (0)
+
+#define BCMMSGBUF_API_IFIDX(a)         0
+#define BCMMSGBUF_API_SEQNUM(a)                0
+#define BCMMSGBUF_IOCTL_XTID(a)                0
+#define BCMMSGBUF_IOCTL_PKTID(a)       ((a)->cmd_id)
+
+#define BCMMSGBUF_SET_API_IFIDX(a, b)  BCMMSGBUF_DUMMY_REF(a, b)
+#define BCMMSGBUF_SET_API_SEQNUM(a, b) BCMMSGBUF_DUMMY_REF(a, b)
+#define BCMMSGBUF_IOCTL_SET_PKTID(a, b)        (BCMMSGBUF_IOCTL_PKTID(a) = (b))
+#define BCMMSGBUF_IOCTL_SET_XTID(a, b) BCMMSGBUF_DUMMY_REF(a, b)
+
+#else /* PCIE_API_REV1 */
+
+#define BCMMSGBUF_API_IFIDX(a)         ((a)->if_id)
+#define BCMMSGBUF_IOCTL_PKTID(a)       ((a)->pkt_id)
+#define BCMMSGBUF_API_SEQNUM(a)                ((a)->u.seq.seq_no)
+#define BCMMSGBUF_IOCTL_XTID(a)                ((a)->xt_id)
+
+#define BCMMSGBUF_SET_API_IFIDX(a, b)  (BCMMSGBUF_API_IFIDX((a)) = (b))
+#define BCMMSGBUF_SET_API_SEQNUM(a, b) (BCMMSGBUF_API_SEQNUM((a)) = (b))
+#define BCMMSGBUF_IOCTL_SET_PKTID(a, b)        (BCMMSGBUF_IOCTL_PKTID((a)) = (b))
+#define BCMMSGBUF_IOCTL_SET_XTID(a, b) (BCMMSGBUF_IOCTL_XTID((a)) = (b))
+
+#endif /* PCIE_API_REV1 */
+
+/* utility data structures */
+
+union addr64 {
+       struct {
+               uint32 low;
+               uint32 high;
+       };
+       struct {
+               uint32 low_addr;
+               uint32 high_addr;
+       };
+       uint64 u64;
+} DECLSPEC_ALIGN(8);
+
+typedef union addr64 bcm_addr64_t;
+
+/* IOCTL req Hdr */
+/* cmn Msg Hdr */
+typedef struct cmn_msg_hdr {
+       /** message type */
+       uint8 msg_type;
+       /** interface index this is valid for */
+       uint8 if_id;
+       /* flags */
+       uint8 flags;
+       /** sequence number */
+       uint8 epoch;
+       /** packet Identifier for the associated host buffer */
+       uint32 request_id;
+} cmn_msg_hdr_t;
+
+/** message type */
+typedef enum bcmpcie_msgtype {
+       MSG_TYPE_GEN_STATUS             = 0x1,
+       MSG_TYPE_RING_STATUS            = 0x2,
+       MSG_TYPE_FLOW_RING_CREATE       = 0x3,
+       MSG_TYPE_FLOW_RING_CREATE_CMPLT = 0x4,
+       /* Enum value as copied from BISON 7.15: new generic message */
+       MSG_TYPE_RING_CREATE_CMPLT      = 0x4,
+       MSG_TYPE_FLOW_RING_DELETE       = 0x5,
+       MSG_TYPE_FLOW_RING_DELETE_CMPLT = 0x6,
+       /* Enum value as copied from BISON 7.15: new generic message */
+       MSG_TYPE_RING_DELETE_CMPLT      = 0x6,
+       MSG_TYPE_FLOW_RING_FLUSH        = 0x7,
+       MSG_TYPE_FLOW_RING_FLUSH_CMPLT  = 0x8,
+       MSG_TYPE_IOCTLPTR_REQ           = 0x9,
+       MSG_TYPE_IOCTLPTR_REQ_ACK       = 0xA,
+       MSG_TYPE_IOCTLRESP_BUF_POST     = 0xB,
+       MSG_TYPE_IOCTL_CMPLT            = 0xC,
+       MSG_TYPE_EVENT_BUF_POST         = 0xD,
+       MSG_TYPE_WL_EVENT               = 0xE,
+       MSG_TYPE_TX_POST                = 0xF,
+       MSG_TYPE_TX_STATUS              = 0x10,
+       MSG_TYPE_RXBUF_POST             = 0x11,
+       MSG_TYPE_RX_CMPLT               = 0x12,
+       MSG_TYPE_LPBK_DMAXFER           = 0x13,
+       MSG_TYPE_LPBK_DMAXFER_CMPLT     = 0x14,
+       MSG_TYPE_FLOW_RING_RESUME        = 0x15,
+       MSG_TYPE_FLOW_RING_RESUME_CMPLT = 0x16,
+       MSG_TYPE_FLOW_RING_SUSPEND      = 0x17,
+       MSG_TYPE_FLOW_RING_SUSPEND_CMPLT        = 0x18,
+       MSG_TYPE_INFO_BUF_POST          = 0x19,
+       MSG_TYPE_INFO_BUF_CMPLT         = 0x1A,
+       MSG_TYPE_H2D_RING_CREATE        = 0x1B,
+       MSG_TYPE_D2H_RING_CREATE        = 0x1C,
+       MSG_TYPE_H2D_RING_CREATE_CMPLT  = 0x1D,
+       MSG_TYPE_D2H_RING_CREATE_CMPLT  = 0x1E,
+       MSG_TYPE_H2D_RING_CONFIG        = 0x1F,
+       MSG_TYPE_D2H_RING_CONFIG        = 0x20,
+       MSG_TYPE_H2D_RING_CONFIG_CMPLT  = 0x21,
+       MSG_TYPE_D2H_RING_CONFIG_CMPLT  = 0x22,
+       MSG_TYPE_H2D_MAILBOX_DATA       = 0x23,
+       MSG_TYPE_D2H_MAILBOX_DATA       = 0x24,
+       MSG_TYPE_TIMSTAMP_BUFPOST       = 0x25,
+       MSG_TYPE_HOSTTIMSTAMP           = 0x26,
+       MSG_TYPE_HOSTTIMSTAMP_CMPLT     = 0x27,
+       MSG_TYPE_FIRMWARE_TIMESTAMP     = 0x28,
+       MSG_TYPE_SNAPSHOT_UPLOAD        = 0x29,
+       MSG_TYPE_SNAPSHOT_CMPLT         = 0x2A,
+       MSG_TYPE_H2D_RING_DELETE        = 0x2B,
+       MSG_TYPE_D2H_RING_DELETE        = 0x2C,
+       MSG_TYPE_H2D_RING_DELETE_CMPLT  = 0x2D,
+       MSG_TYPE_D2H_RING_DELETE_CMPLT  = 0x2E,
+       MSG_TYPE_API_MAX_RSVD           = 0x3F
+} bcmpcie_msg_type_t;
+
+/* message type used in internal queue */
+typedef enum bcmpcie_msgtype_int {
+       MSG_TYPE_INTERNAL_USE_START     = 0x40, /* internal pkt */
+       MSG_TYPE_EVENT_PYLD             = 0x41, /* wl event pkt */
+       MSG_TYPE_IOCT_PYLD              = 0x42, /* ioctl compl pkt */
+       MSG_TYPE_RX_PYLD                = 0x43,
+       MSG_TYPE_HOST_FETCH             = 0x44,
+       MSG_TYPE_LPBK_DMAXFER_PYLD      = 0x45, /* loopback pkt */
+       MSG_TYPE_TXMETADATA_PYLD        = 0x46, /* transmit status pkt */
+       MSG_TYPE_INDX_UPDATE            = 0x47, /* write indx updated */
+       MSG_TYPE_INFO_PYLD              = 0x48,
+       MSG_TYPE_TS_EVENT_PYLD          = 0x49,
+       MSG_TYPE_PVT_BTLOG_CMPLT        = 0x4A,
+       MSG_TYPE_BTLOG_PYLD             = 0x4B,
+       MSG_TYPE_HMAPTEST_PYLD          = 0x4C,
+       MSG_TYPE_PVT_BT_SNAPSHOT_CMPLT  = 0x4D,
+       MSG_TYPE_BT_SNAPSHOT_PYLD       = 0x4E,
+       MSG_TYPE_LPBK_DMAXFER_PYLD_ADDR = 0x4F  /* loopback from addr pkt */
+} bcmpcie_msgtype_int_t;
+
+typedef enum bcmpcie_msgtype_u {
+       MSG_TYPE_TX_BATCH_POST          = 0x80,
+       MSG_TYPE_IOCTL_REQ              = 0x81,
+       MSG_TYPE_HOST_EVNT              = 0x82, /* console related */
+       MSG_TYPE_LOOPBACK               = 0x83
+} bcmpcie_msgtype_u_t;
+
+/**
+ * D2H ring host wakeup soft doorbell, override the PCIE doorbell.
+ * Host configures an <32bit address,value> tuple, and dongle uses SBTOPCIE
+ * Transl0 to write specified value to host address.
+ *
+ * Use case: 32bit Address mapped to HW Accelerator Core/Thread Wakeup Register
+ * and value is Core/Thread context. Host will ensure routing the 32bit address
+ * offerred to PCIE to the mapped register.
+ *
+ * D2H_RING_CONFIG_SUBTYPE_SOFT_DOORBELL
+ */
+typedef struct bcmpcie_soft_doorbell {
+       uint32  value;  /* host defined value to be written, eg HW threadid */
+       bcm_addr64_t haddr; /* host address, eg thread wakeup register address */
+       uint16  items;  /* interrupt coalescing: item count before wakeup */
+       uint16  msecs;  /* interrupt coalescing: timeout in millisecs */
+} bcmpcie_soft_doorbell_t;
+
+/**
+ * D2H interrupt using MSI instead of INTX
+ * Host configures MSI vector offset for each D2H interrupt
+ *
+ * D2H_RING_CONFIG_SUBTYPE_MSI_DOORBELL
+ */
+typedef enum bcmpcie_msi_intr_idx {
+       MSI_INTR_IDX_CTRL_CMPL_RING     = 0,
+       MSI_INTR_IDX_TXP_CMPL_RING      = 1,
+       MSI_INTR_IDX_RXP_CMPL_RING      = 2,
+       MSI_INTR_IDX_INFO_CMPL_RING     = 3,
+       MSI_INTR_IDX_MAILBOX            = 4,
+       MSI_INTR_IDX_MAX                = 5
+} bcmpcie_msi_intr_idx_t;
+
+#define BCMPCIE_D2H_MSI_OFFSET_SINGLE  0
+typedef enum bcmpcie_msi_offset_type {
+       BCMPCIE_D2H_MSI_OFFSET_MB0      = 2,
+       BCMPCIE_D2H_MSI_OFFSET_MB1      = 3,
+       BCMPCIE_D2H_MSI_OFFSET_DB0      = 4,
+       BCMPCIE_D2H_MSI_OFFSET_DB1      = 5,
+       BCMPCIE_D2H_MSI_OFFSET_H1_DB0   = 6,
+       BCMPCIE_D2H_MSI_OFFSET_MAX      = 7
+} bcmpcie_msi_offset_type_t;
+
+typedef struct bcmpcie_msi_offset {
+       uint16  intr_idx;    /* interrupt index */
+       uint16  msi_offset;  /* msi vector offset */
+} bcmpcie_msi_offset_t;
+
+typedef struct bcmpcie_msi_offset_config {
+       uint32  len;
+       bcmpcie_msi_offset_t    bcmpcie_msi_offset[MSI_INTR_IDX_MAX];
+} bcmpcie_msi_offset_config_t;
+
+#define BCMPCIE_D2H_MSI_OFFSET_DEFAULT BCMPCIE_D2H_MSI_OFFSET_DB1
+
+#define BCMPCIE_D2H_MSI_SINGLE         0xFFFE
+
+/* if_id */
+#define BCMPCIE_CMNHDR_IFIDX_PHYINTF_SHFT      5
+#define BCMPCIE_CMNHDR_IFIDX_PHYINTF_MAX       0x7
+#define BCMPCIE_CMNHDR_IFIDX_PHYINTF_MASK      \
+       (BCMPCIE_CMNHDR_IFIDX_PHYINTF_MAX << BCMPCIE_CMNHDR_IFIDX_PHYINTF_SHFT)
+#define BCMPCIE_CMNHDR_IFIDX_VIRTINTF_SHFT     0
+#define BCMPCIE_CMNHDR_IFIDX_VIRTINTF_MAX      0x1F
+#define BCMPCIE_CMNHDR_IFIDX_VIRTINTF_MASK     \
+       (BCMPCIE_CMNHDR_IFIDX_PHYINTF_MAX << BCMPCIE_CMNHDR_IFIDX_PHYINTF_SHFT)
+
+/* flags */
+#define BCMPCIE_CMNHDR_FLAGS_DMA_R_IDX         0x1
+#define BCMPCIE_CMNHDR_FLAGS_DMA_R_IDX_INTR    0x2
+#define BCMPCIE_CMNHDR_FLAGS_TS_SEQNUM_INIT    0x4
+#define BCMPCIE_CMNHDR_FLAGS_PHASE_BIT         0x80
+#define BCMPCIE_CMNHDR_PHASE_BIT_INIT          0x80
+
+/* IOCTL request message */
+typedef struct ioctl_req_msg {
+       /** common message header */
+       cmn_msg_hdr_t   cmn_hdr;
+       /** ioctl command type */
+       uint32          cmd;
+       /** ioctl transaction ID, to pair with a ioctl response */
+       uint16          trans_id;
+       /** input arguments buffer len */
+       uint16          input_buf_len;
+       /** expected output len */
+       uint16          output_buf_len;
+       /** to align the host address on 8 byte boundary */
+       uint16          rsvd[3];
+       /** always align on 8 byte boundary */
+       bcm_addr64_t    host_input_buf_addr;
+       /* rsvd */
+       uint32          rsvd1[2];
+} ioctl_req_msg_t;
+
+/** buffer post messages for device to use to return IOCTL responses, Events */
+typedef struct ioctl_resp_evt_buf_post_msg {
+       /** common message header */
+       cmn_msg_hdr_t   cmn_hdr;
+       /** length of the host buffer supplied */
+       uint16          host_buf_len;
+       /** to align the host address on 8 byte boundary */
+       uint16          reserved[3];
+       /** always align on 8 byte boundary */
+       bcm_addr64_t    host_buf_addr;
+       uint32          rsvd[4];
+} ioctl_resp_evt_buf_post_msg_t;
+
+/* buffer post messages for device to use to return dbg buffers */
+typedef ioctl_resp_evt_buf_post_msg_t info_buf_post_msg_t;
+
+#define DHD_INFOBUF_RX_BUFPOST_PKTSZ   (2 * 1024)
+
+#define DHD_BTLOG_RX_BUFPOST_PKTSZ     (2 * 1024)
+
+/* An infobuf host buffer starts with a 32 bit (LE) version. */
+#define PCIE_INFOBUF_V1                1
+/* Infobuf v1 type MSGTRACE's data is exactly the same as the MSGTRACE data that
+ * is wrapped previously/also in a WLC_E_TRACE event.  See structure
+ * msgrace_hdr_t in msgtrace.h.
+*/
+#define PCIE_INFOBUF_V1_TYPE_MSGTRACE  1
+
+/* Infobuf v1 type LOGTRACE data is exactly the same as the LOGTRACE data that
+ * is wrapped previously/also in a WLC_E_TRACE event.  See structure
+ * msgrace_hdr_t in msgtrace.h.  (The only difference between a MSGTRACE
+ * and a LOGTRACE is the "trace type" field.)
+*/
+#define PCIE_INFOBUF_V1_TYPE_LOGTRACE  2
+
+/* An infobuf version 1 host buffer has a single TLV.  The information on the
+ * version 1 types follow this structure definition. (int's LE)
+*/
+typedef struct info_buf_payload_hdr_s {
+       uint16 type;
+       uint16 length;
+} info_buf_payload_hdr_t;
+
+/* BT logs/memory to DMA directly from BT memory to host */
+typedef struct info_buf_btlog_s {
+       void (*status_cb)(void *ctx, void *p, int error);       /* obsolete - to be removed */
+       void *ctx;
+       dma64addr_t src_addr;
+       uint32 length;
+       bool (*pcie_status_cb)(osl_t *osh, void *p, int error);
+       uint32 bt_intstatus;
+       int error;
+} info_buf_btlog_t;
+
+/** snapshot upload request message  */
+typedef struct snapshot_upload_request_msg {
+       /** common message header */
+       cmn_msg_hdr_t   cmn_hdr;
+       /** length of the snaphost buffer supplied */
+       uint32          snapshot_buf_len;
+       /** type of snapshot */
+       uint8           snapshot_type;
+       /** snapshot param    */
+       uint8           snapshot_param;
+       /** to align the host address on 8 byte boundary */
+       uint8           reserved[2];
+       /** always align on 8 byte boundary */
+       bcm_addr64_t    host_buf_addr;
+       uint32          rsvd[4];
+} snapshot_upload_request_msg_t;
+
+/** snapshot types  */
+typedef enum bcmpcie_snapshot_type {
+       SNAPSHOT_TYPE_BT                = 0,    /* Bluetooth SRAM and patch RAM */
+       SNAPSHOT_TYPE_WLAN_SOCRAM       = 1,    /* WLAN SOCRAM */
+       SNAPSHOT_TYPE_WLAN_HEAP         = 2,    /* WLAN HEAP */
+       SNAPSHOT_TYPE_WLAN_REGISTER     = 3     /* WLAN registers */
+} bcmpcie_snapshot_type_t;
+
+#define PCIE_DMA_XFER_FLG_D11_LPBK_MASK                0xF
+#define PCIE_DMA_XFER_FLG_D11_LPBK_SHIFT       2
+#define PCIE_DMA_XFER_FLG_CORE_NUMBER_MASK     3
+#define PCIE_DMA_XFER_FLG_CORE_NUMBER_SHIFT    0
+
+typedef struct pcie_dma_xfer_params {
+       /** common message header */
+       cmn_msg_hdr_t   cmn_hdr;
+
+       /** always align on 8 byte boundary */
+       bcm_addr64_t    host_input_buf_addr;
+
+       /** always align on 8 byte boundary */
+       bcm_addr64_t    host_ouput_buf_addr;
+
+       /** length of transfer */
+       uint32          xfer_len;
+       /** delay before doing the src txfer */
+       uint32          srcdelay;
+       /** delay before doing the dest txfer */
+       uint32          destdelay;
+       uint8           rsvd[3];
+       /* bit0: D11 DMA loopback flag */
+       uint8           flags;
+} pcie_dma_xfer_params_t;
+
+#define BCMPCIE_FLOW_RING_INTF_HP2P            0x1
+#define BCMPCIE_FLOW_RING_OPT_EXT_TXSTATUS     0x2
+
+/** Complete msgbuf hdr for flow ring update from host to dongle */
+typedef struct tx_flowring_create_request {
+       cmn_msg_hdr_t   msg;
+       uint8   da[ETHER_ADDR_LEN];
+       uint8   sa[ETHER_ADDR_LEN];
+       uint8   tid;
+       uint8   if_flags;
+       uint16  flow_ring_id;
+       uint8   tc;
+       /* priority_ifrmmask is to define core mask in ifrm mode.
+        * currently it is not used for priority. so uses solely for ifrm mask
+        */
+       uint8   priority_ifrmmask;
+       uint16  int_vector;
+       uint16  max_items;
+       uint16  len_item;
+       bcm_addr64_t flow_ring_ptr;
+} tx_flowring_create_request_t;
+
+typedef struct tx_flowring_delete_request {
+       cmn_msg_hdr_t   msg;
+       uint16  flow_ring_id;
+       uint16  reason;
+       uint32  rsvd[7];
+} tx_flowring_delete_request_t;
+
+typedef tx_flowring_delete_request_t d2h_ring_delete_req_t;
+typedef tx_flowring_delete_request_t h2d_ring_delete_req_t;
+
+typedef struct tx_flowring_flush_request {
+       cmn_msg_hdr_t   msg;
+       uint16  flow_ring_id;
+       uint16  reason;
+       uint32  rsvd[7];
+} tx_flowring_flush_request_t;
+
+/** Subtypes for ring_config_req control message */
+typedef enum ring_config_subtype {
+       /** Default D2H PCIE doorbell override using ring_config_req msg */
+       D2H_RING_CONFIG_SUBTYPE_SOFT_DOORBELL = 1, /* Software doorbell */
+       D2H_RING_CONFIG_SUBTYPE_MSI_DOORBELL = 2   /* MSI configuration */
+} ring_config_subtype_t;
+
+typedef struct ring_config_req { /* pulled from upcoming rev6 ... */
+       cmn_msg_hdr_t   msg;
+       uint16  subtype;
+       uint16  ring_id;
+       uint32  rsvd;
+       union {
+               uint32  data[6];
+               /** D2H_RING_CONFIG_SUBTYPE_SOFT_DOORBELL */
+               bcmpcie_soft_doorbell_t soft_doorbell;
+               /** D2H_RING_CONFIG_SUBTYPE_MSI_DOORBELL */
+               bcmpcie_msi_offset_config_t msi_offset;
+       };
+} ring_config_req_t;
+
+/* data structure to use to create on the fly d2h rings */
+typedef struct d2h_ring_create_req {
+       cmn_msg_hdr_t   msg;
+       uint16  ring_id;
+       uint16  ring_type;
+       uint32  flags;
+       bcm_addr64_t    ring_ptr;
+       uint16  max_items;
+       uint16  len_item;
+       uint32  rsvd[3];
+} d2h_ring_create_req_t;
+
+/* data structure to use to create on the fly h2d rings */
+#define MAX_COMPLETION_RING_IDS_ASSOCIATED     4
+typedef struct h2d_ring_create_req {
+       cmn_msg_hdr_t   msg;
+       uint16  ring_id;
+       uint8   ring_type;
+       uint8   n_completion_ids;
+       uint32  flags;
+       bcm_addr64_t    ring_ptr;
+       uint16  max_items;
+       uint16  len_item;
+       uint16  completion_ring_ids[MAX_COMPLETION_RING_IDS_ASSOCIATED];
+       uint32  rsvd;
+} h2d_ring_create_req_t;
+
+typedef struct d2h_ring_config_req {
+       cmn_msg_hdr_t   msg;
+       uint16  d2h_ring_config_subtype;
+       uint16  d2h_ring_id;
+       uint32  d2h_ring_config_data[4];
+       uint32  rsvd[3];
+} d2h_ring_config_req_t;
+
+typedef struct h2d_ring_config_req {
+       cmn_msg_hdr_t   msg;
+       uint16  h2d_ring_config_subtype;
+       uint16  h2d_ring_id;
+       uint32  h2d_ring_config_data;
+       uint32  rsvd[6];
+} h2d_ring_config_req_t;
+
+typedef struct h2d_mailbox_data {
+       cmn_msg_hdr_t   msg;
+       uint32  mail_box_data;
+       uint32  rsvd[7];
+} h2d_mailbox_data_t;
+typedef struct host_timestamp_msg {
+       cmn_msg_hdr_t   msg;
+       uint16          xt_id; /* transaction ID */
+       uint16          input_data_len; /* data len at the host_buf_addr, data in TLVs */
+       uint16          seqnum; /* number of times host captured the timestamp */
+       uint16          rsvd;
+       /* always align on 8 byte boundary */
+       bcm_addr64_t    host_buf_addr;
+       /* rsvd */
+       uint32      rsvd1[4];
+} host_timestamp_msg_t;
+
+/* buffer post message for timestamp events MSG_TYPE_TIMSTAMP_BUFPOST */
+typedef ioctl_resp_evt_buf_post_msg_t ts_buf_post_msg_t;
+
+typedef union ctrl_submit_item {
+       ioctl_req_msg_t                 ioctl_req;
+       ioctl_resp_evt_buf_post_msg_t   resp_buf_post;
+       pcie_dma_xfer_params_t          dma_xfer;
+       tx_flowring_create_request_t    flow_create;
+       tx_flowring_delete_request_t    flow_delete;
+       tx_flowring_flush_request_t     flow_flush;
+       ring_config_req_t               ring_config_req;
+       d2h_ring_create_req_t           d2h_create;
+       h2d_ring_create_req_t           h2d_create;
+       d2h_ring_config_req_t           d2h_config;
+       h2d_ring_config_req_t           h2d_config;
+       h2d_mailbox_data_t              h2d_mailbox_data;
+       host_timestamp_msg_t            host_ts;
+       ts_buf_post_msg_t               ts_buf_post;
+       d2h_ring_delete_req_t           d2h_delete;
+       h2d_ring_delete_req_t           h2d_delete;
+       unsigned char                   check[H2DRING_CTRL_SUB_ITEMSIZE];
+} ctrl_submit_item_t;
+
+typedef struct info_ring_submit_item {
+       info_buf_post_msg_t             info_buf_post;
+       unsigned char                   check[H2DRING_INFO_BUFPOST_ITEMSIZE];
+} info_sumbit_item_t;
+
+/** Control Completion messages (20 bytes) */
+typedef struct compl_msg_hdr {
+       union {
+               /** status for the completion */
+               int16   status;
+
+               /* mutually exclusive with pkt fate debug feature */
+               struct pktts_compl_hdr {
+                       uint16 d_t4; /* Delta TimeStamp 3: T4-tref */
+               } tx_pktts;
+       };
+       /** submisison flow ring id which generated this status */
+       union {
+           uint16      ring_id;
+           uint16      flow_ring_id;
+       };
+} compl_msg_hdr_t;
+
+/** XOR checksum or a magic number to audit DMA done */
+typedef uint32 dma_done_t;
+
+#define MAX_CLKSRC_ID  0xF
+#define TX_PKT_RETRY_CNT_0_MASK                0x000000FF
+#define TX_PKT_RETRY_CNT_0_SHIFT       0
+#define TX_PKT_RETRY_CNT_1_MASK                0x0000FF00
+#define TX_PKT_RETRY_CNT_1_SHIFT       8
+#define TX_PKT_RETRY_CNT_2_MASK                0x00FF0000
+#define TX_PKT_RETRY_CNT_2_SHIFT       16
+#define TX_PKT_BAND_INFO               0x0F000000
+#define TX_PKT_BAND_INFO_SHIFT         24
+#define TX_PKT_VALID_INFO              0xF0000000
+#define TX_PKT_VALID_INFO_SHIFT                28
+
+typedef struct ts_timestamp_srcid {
+       union {
+               uint32  ts_low; /* time stamp low 32 bits */
+               uint32  rate_spec; /* use ratespec */
+       };
+       union {
+               uint32  ts_high; /* time stamp high 28 bits */
+               union {
+                       uint32  ts_high_ext :28; /* time stamp high 28 bits */
+                       uint32  clk_id_ext :3; /* clock ID source  */
+                       uint32  phase :1; /* Phase bit */
+                       dma_done_t      marker_ext;
+               };
+               uint32 tx_pkt_band_retry_info;
+       };
+} ts_timestamp_srcid_t;
+
+typedef ts_timestamp_srcid_t ipc_timestamp_t;
+
+typedef struct ts_timestamp {
+       uint32  low;
+       uint32  high;
+} ts_timestamp_t;
+
+typedef ts_timestamp_t tick_count_64_t;
+typedef ts_timestamp_t ts_timestamp_ns_64_t;
+typedef ts_timestamp_t ts_correction_m_t;
+typedef ts_timestamp_t ts_correction_b_t;
+
+typedef struct _pktts {
+       uint32 tref; /* Ref Clk in uSec (currently, tsf) */
+       uint16 d_t2; /* Delta TimeStamp 1: T2-tref */
+       uint16 d_t3; /* Delta TimeStamp 2: T3-tref */
+} pktts_t;
+
+/* completion header status codes */
+#define        BCMPCIE_SUCCESS                 0
+#define BCMPCIE_NOTFOUND               1
+#define BCMPCIE_NOMEM                  2
+#define BCMPCIE_BADOPTION              3
+#define BCMPCIE_RING_IN_USE            4
+#define BCMPCIE_RING_ID_INVALID                5
+#define BCMPCIE_PKT_FLUSH              6
+#define BCMPCIE_NO_EVENT_BUF           7
+#define BCMPCIE_NO_RX_BUF              8
+#define BCMPCIE_NO_IOCTLRESP_BUF       9
+#define BCMPCIE_MAX_IOCTLRESP_BUF      10
+#define BCMPCIE_MAX_EVENT_BUF          11
+#define BCMPCIE_BAD_PHASE              12
+#define BCMPCIE_INVALID_CPL_RINGID     13
+#define BCMPCIE_RING_TYPE_INVALID      14
+#define BCMPCIE_NO_TS_EVENT_BUF                15
+#define BCMPCIE_MAX_TS_EVENT_BUF       16
+#define BCMPCIE_PCIE_NO_BTLOG_BUF      17
+#define BCMPCIE_BT_DMA_ERR             18
+#define BCMPCIE_BT_DMA_DESCR_FETCH_ERR 19
+#define BCMPCIE_SNAPSHOT_ERR           20
+#define BCMPCIE_NOT_READY              21
+#define BCMPCIE_INVALID_DATA           22
+#define BCMPCIE_NO_RESPONSE            23
+#define BCMPCIE_NO_CLOCK               24
+
+/** IOCTL completion response */
+typedef struct ioctl_compl_resp_msg {
+       /** common message header */
+       cmn_msg_hdr_t           cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t         compl_hdr;
+       /** response buffer len where a host buffer is involved */
+       uint16                  resp_len;
+       /** transaction id to pair with a request */
+       uint16                  trans_id;
+       /** cmd id */
+       uint32                  cmd;
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} ioctl_comp_resp_msg_t;
+
+/** IOCTL request acknowledgement */
+typedef struct ioctl_req_ack_msg {
+       /** common message header */
+       cmn_msg_hdr_t           cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t         compl_hdr;
+       /** cmd id */
+       uint32                  cmd;
+       uint32                  rsvd;
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} ioctl_req_ack_msg_t;
+
+/** WL event message: send from device to host */
+typedef struct wlevent_req_msg {
+       /** common message header */
+       cmn_msg_hdr_t           cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t         compl_hdr;
+       /** event data len valid with the event buffer */
+       uint16                  event_data_len;
+       /** sequence number */
+       uint16                  seqnum;
+       /** rsvd        */
+       uint32                  rsvd;
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} wlevent_req_msg_t;
+
+/** dma xfer complete message */
+typedef struct pcie_dmaxfer_cmplt {
+       /** common message header */
+       cmn_msg_hdr_t           cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t         compl_hdr;
+       uint32                  rsvd[2];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} pcie_dmaxfer_cmplt_t;
+
+/** general status message */
+typedef struct pcie_gen_status {
+       /** common message header */
+       cmn_msg_hdr_t           cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t         compl_hdr;
+       uint32                  rsvd[2];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} pcie_gen_status_t;
+
+/** ring status message */
+typedef struct pcie_ring_status {
+       /** common message header */
+       cmn_msg_hdr_t           cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t         compl_hdr;
+       /** message which firmware couldn't decode */
+       uint16                  write_idx;
+       uint16                  rsvd[3];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} pcie_ring_status_t;
+
+typedef struct ring_create_response {
+       cmn_msg_hdr_t           cmn_hdr;
+       compl_msg_hdr_t         cmplt;
+       uint32                  rsvd[2];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} ring_create_response_t;
+
+typedef ring_create_response_t tx_flowring_create_response_t;
+typedef ring_create_response_t h2d_ring_create_response_t;
+typedef ring_create_response_t d2h_ring_create_response_t;
+
+typedef struct tx_flowring_delete_response {
+       cmn_msg_hdr_t           msg;
+       compl_msg_hdr_t         cmplt;
+       uint16                  read_idx;
+       uint16                  rsvd[3];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} tx_flowring_delete_response_t;
+
+typedef tx_flowring_delete_response_t  h2d_ring_delete_response_t;
+typedef tx_flowring_delete_response_t  d2h_ring_delete_response_t;
+
+typedef struct tx_flowring_flush_response {
+       cmn_msg_hdr_t           msg;
+       compl_msg_hdr_t         cmplt;
+       uint32                  rsvd[2];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} tx_flowring_flush_response_t;
+
+/** Common layout of all d2h control messages */
+typedef struct ctrl_compl_msg {
+       /** common message header */
+       cmn_msg_hdr_t       cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t     compl_hdr;
+       uint32          rsvd[2];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t      marker;
+} ctrl_compl_msg_t;
+
+typedef struct ring_config_resp {
+       /** common message header */
+       cmn_msg_hdr_t       cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t     compl_hdr;
+       uint16          subtype;
+       uint16          rsvd[3];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t      marker;
+} ring_config_resp_t;
+
+typedef struct d2h_mailbox_data {
+       cmn_msg_hdr_t           msg;
+       compl_msg_hdr_t         cmplt;
+       uint32                  d2h_mailbox_data;
+       uint32                  rsvd[1];
+       /* XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} d2h_mailbox_data_t;
+
+/* dbg buf completion msg: send from device to host */
+typedef struct info_buf_resp {
+       /* common message header */
+       cmn_msg_hdr_t           cmn_hdr;
+       /* completion message header */
+       compl_msg_hdr_t         compl_hdr;
+       /* event data len valid with the event buffer */
+       uint16                  info_data_len;
+       /* sequence number */
+       uint16                  seqnum;
+       /* destination */
+       uint8                   dest;
+       /* rsvd */
+       uint8                   rsvd[3];
+       /* XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} info_buf_resp_t;
+
+/* snapshot completion msg: send from device to host */
+typedef struct snapshot_resp {
+       /* common message header */
+       cmn_msg_hdr_t           cmn_hdr;
+       /* completion message header */
+       compl_msg_hdr_t         compl_hdr;
+       /* snapshot length uploaded */
+       uint32                  resp_len;
+       /* snapshot type */
+       uint8                   type;
+       /* rsvd */
+       uint8                   rsvd[3];
+       /* XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} snapshot_resp_t;
+
+typedef struct info_ring_cpl_item {
+       info_buf_resp_t         info_buf_post;
+       unsigned char           check[D2HRING_INFO_BUFCMPLT_ITEMSIZE];
+} info_cpl_item_t;
+
+typedef struct host_timestamp_msg_cpl {
+       cmn_msg_hdr_t           msg;
+       compl_msg_hdr_t cmplt;
+       uint16                  xt_id; /* transaction ID */
+       uint16                  rsvd;
+       uint32                  rsvd1;
+       /* XOR checksum or a magic number to audit DMA done */
+       dma_done_t      marker;
+} host_timestamp_msg_cpl_t;
+
+typedef struct fw_timestamp_event_msg {
+       cmn_msg_hdr_t           msg;
+       compl_msg_hdr_t cmplt;
+       /* fw captures time stamp info and passed that to host in TLVs */
+       uint16                  buf_len; /* length of the time stamp data copied in host buf */
+       uint16                  seqnum; /* number of times fw captured time stamp */
+       uint32                  rsvd;
+       /* XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} fw_timestamp_event_msg_t;
+
+typedef union ctrl_completion_item {
+       ioctl_comp_resp_msg_t           ioctl_resp;
+       wlevent_req_msg_t               event;
+       ioctl_req_ack_msg_t             ioct_ack;
+       pcie_dmaxfer_cmplt_t            pcie_xfer_cmplt;
+       pcie_gen_status_t               pcie_gen_status;
+       pcie_ring_status_t              pcie_ring_status;
+       tx_flowring_create_response_t   txfl_create_resp;
+       tx_flowring_delete_response_t   txfl_delete_resp;
+       tx_flowring_flush_response_t    txfl_flush_resp;
+       ctrl_compl_msg_t                ctrl_compl;
+       ring_config_resp_t              ring_config_resp;
+       d2h_mailbox_data_t              d2h_mailbox_data;
+       info_buf_resp_t                 dbg_resp;
+       h2d_ring_create_response_t      h2d_ring_create_resp;
+       d2h_ring_create_response_t      d2h_ring_create_resp;
+       host_timestamp_msg_cpl_t        host_ts_cpl;
+       fw_timestamp_event_msg_t        fw_ts_event;
+       h2d_ring_delete_response_t      h2d_ring_delete_resp;
+       d2h_ring_delete_response_t      d2h_ring_delete_resp;
+       unsigned char                   ctrl_response[D2HRING_CTRL_CMPLT_ITEMSIZE];
+} ctrl_completion_item_t;
+
+/** H2D Rxpost ring work items */
+typedef struct host_rxbuf_post {
+       /** common message header */
+       cmn_msg_hdr_t   cmn_hdr;
+       /** provided meta data buffer len */
+       uint16          metadata_buf_len;
+       /** provided data buffer len to receive data */
+       uint16          data_buf_len;
+       /** alignment to make the host buffers start on 8 byte boundary */
+       uint32          rsvd;
+       /** provided meta data buffer */
+       bcm_addr64_t    metadata_buf_addr;
+       /** provided data buffer to receive data */
+       bcm_addr64_t    data_buf_addr;
+} host_rxbuf_post_t;
+
+typedef union rxbuf_submit_item {
+       host_rxbuf_post_t       rxpost;
+       unsigned char           check[H2DRING_RXPOST_ITEMSIZE];
+} rxbuf_submit_item_t;
+
+/* D2H Rxcompletion ring work items for IPC rev7 */
+typedef struct host_rxbuf_cmpl {
+       /** common message header */
+       cmn_msg_hdr_t   cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t compl_hdr;
+       /**  filled up meta data len */
+       uint16          metadata_len;
+       /** filled up buffer len to receive data */
+       uint16          data_len;
+       /** offset in the host rx buffer where the data starts */
+       uint16          data_offset;
+       /** offset in the host rx buffer where the data starts */
+       uint16          flags;
+       /** rx status */
+       uint32          rx_status_0;
+       uint32          rx_status_1;
+
+       union { /* size per IPC = (3 x uint32) bytes */
+               struct {
+                       /* used by Monitor mode */
+                       uint32 marker;
+                       /* timestamp */
+                       ipc_timestamp_t ts;
+               };
+
+               /* LatTS_With_XORCSUM */
+               struct {
+                       /* latency timestamp */
+                       pktts_t rx_pktts;
+                       /* XOR checksum or a magic number to audit DMA done */
+                       dma_done_t marker_ext;
+               };
+       };
+} host_rxbuf_cmpl_t;
+
+typedef union rxbuf_complete_item {
+       host_rxbuf_cmpl_t       rxcmpl;
+       unsigned char           check[D2HRING_RXCMPLT_ITEMSIZE];
+} rxbuf_complete_item_t;
+
+typedef struct host_txbuf_post {
+       /** common message header */
+       cmn_msg_hdr_t   cmn_hdr;
+       /** eth header */
+       uint8           txhdr[ETHER_HDR_LEN];
+       /** flags */
+       uint8           flags;
+       /** number of segments */
+       uint8           seg_cnt;
+
+       /** provided meta data buffer for txstatus */
+       bcm_addr64_t    metadata_buf_addr;
+       /** provided data buffer to receive data */
+       bcm_addr64_t    data_buf_addr;
+       /** provided meta data buffer len */
+       uint16          metadata_buf_len;
+       /** provided data buffer len to receive data */
+       uint16          data_len;
+       union {
+               struct {
+                       /** extended transmit flags */
+                       uint8 ext_flags;
+                       uint8 scale_factor;
+
+                       /** user defined rate */
+                       uint8 rate;
+                       uint8 exp_time;
+               };
+               /** XOR checksum or a magic number to audit DMA done */
+               dma_done_t      marker;
+       };
+} host_txbuf_post_t;
+
+#define BCMPCIE_PKT_FLAGS_FRAME_802_3  0x01
+#define BCMPCIE_PKT_FLAGS_FRAME_802_11 0x02
+
+#define BCMPCIE_PKT_FLAGS_FRAME_NORETRY                0x01    /* Disable retry on this frame */
+#define BCMPCIE_PKT_FLAGS_FRAME_NOAGGR         0x02    /* Disable aggregation for this frame */
+#define BCMPCIE_PKT_FLAGS_FRAME_UDR            0x04    /* User defined rate for this frame */
+#define BCMPCIE_PKT_FLAGS_FRAME_ATTR_MASK      0x07    /* Attribute mask */
+
+#define BCMPCIE_PKT_FLAGS_FRAME_EXEMPT_MASK    0x03    /* Exempt uses 2 bits */
+#define BCMPCIE_PKT_FLAGS_FRAME_EXEMPT_SHIFT   0x02    /* needs to be shifted past other bits */
+
+#define BCMPCIE_PKT_FLAGS_EPOCH_SHIFT           3u
+#define BCMPCIE_PKT_FLAGS_EPOCH_MASK            (1u << BCMPCIE_PKT_FLAGS_EPOCH_SHIFT)
+
+#define BCMPCIE_PKT_FLAGS_PRIO_SHIFT           5
+#define BCMPCIE_PKT_FLAGS_PRIO_MASK            (7 << BCMPCIE_PKT_FLAGS_PRIO_SHIFT)
+#define BCMPCIE_PKT_FLAGS_MONITOR_NO_AMSDU     0x00
+#define BCMPCIE_PKT_FLAGS_MONITOR_FIRST_PKT    0x01
+#define BCMPCIE_PKT_FLAGS_MONITOR_INTER_PKT    0x02
+#define BCMPCIE_PKT_FLAGS_MONITOR_LAST_PKT     0x03
+#define BCMPCIE_PKT_FLAGS_MONITOR_SHIFT                8
+#define BCMPCIE_PKT_FLAGS_MONITOR_MASK         (3 << BCMPCIE_PKT_FLAGS_MONITOR_SHIFT)
+
+/* These are added to fix up compile issues */
+#define BCMPCIE_TXPOST_FLAGS_FRAME_802_3       BCMPCIE_PKT_FLAGS_FRAME_802_3
+#define BCMPCIE_TXPOST_FLAGS_FRAME_802_11      BCMPCIE_PKT_FLAGS_FRAME_802_11
+#define BCMPCIE_TXPOST_FLAGS_PRIO_SHIFT                BCMPCIE_PKT_FLAGS_PRIO_SHIFT
+#define BCMPCIE_TXPOST_FLAGS_PRIO_MASK         BCMPCIE_PKT_FLAGS_PRIO_MASK
+
+#define BCMPCIE_TXPOST_RATE_EXT_USAGE          0x80 /* The rate field has extended usage */
+#define BCMPCIE_TXPOST_RATE_PROFILE_IDX_MASK   0x07 /* The Tx profile index in the rate field */
+
+/* H2D Txpost ring work items */
+typedef union txbuf_submit_item {
+       host_txbuf_post_t       txpost;
+       unsigned char           check[H2DRING_TXPOST_ITEMSIZE];
+} txbuf_submit_item_t;
+
+/* D2H Txcompletion ring work items - extended for IOC rev7 */
+typedef struct host_txbuf_cmpl {
+       /** common message header */
+       cmn_msg_hdr_t   cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t compl_hdr;
+
+       union { /* size per IPC = (3 x uint32) bytes */
+               /* Usage 1: TxS_With_TimeSync */
+               struct {
+                        struct {
+                               union {
+                                       /** provided meta data len */
+                                       uint16  metadata_len;
+                                       /** provided extended TX status */
+                                       uint16  tx_status_ext;
+                               }; /*Ext_TxStatus */
+
+                               /** WLAN side txstatus */
+                               uint16  tx_status;
+                       }; /* TxS */
+                       /* timestamp */
+                       ipc_timestamp_t ts;
+               }; /* TxS_with_TS */
+
+               /* Usage 2: LatTS_With_XORCSUM */
+               struct {
+                       /* latency timestamp */
+                       pktts_t tx_pktts;
+                       /* XOR checksum or a magic number to audit DMA done */
+                       dma_done_t marker_ext;
+               };
+       };
+
+} host_txbuf_cmpl_t;
+
+typedef union txbuf_complete_item {
+       host_txbuf_cmpl_t       txcmpl;
+       unsigned char           check[D2HRING_TXCMPLT_ITEMSIZE];
+} txbuf_complete_item_t;
+
+#define PCIE_METADATA_VER 1u
+
+/* version and length are not part of this structure.
+ * dhd queries version and length through bus iovar "bus:metadata_info".
+ */
+struct metadata_txcmpl_v1 {
+       uint32 tref; /* TSF or Ref Clock in uSecs */
+       uint16 d_t2; /* T2-fwt1 delta */
+       uint16 d_t3; /* T3-fwt1 delta */
+       uint16 d_t4; /* T4-fwt1 delta */
+       uint16 rsvd; /* reserved */
+};
+typedef struct metadata_txcmpl_v1 metadata_txcmpl_t;
+
+#define BCMPCIE_D2H_METADATA_HDRLEN    4
+#define BCMPCIE_D2H_METADATA_MINLEN    (BCMPCIE_D2H_METADATA_HDRLEN + 4)
+
+/** ret buf struct */
+typedef struct ret_buf_ptr {
+       uint32 low_addr;
+       uint32 high_addr;
+} ret_buf_t;
+
+#ifdef PCIE_API_REV1
+
+/* ioctl specific hdr */
+typedef struct ioctl_hdr {
+       uint16          cmd;
+       uint16          retbuf_len;
+       uint32          cmd_id;
+} ioctl_hdr_t;
+
+typedef struct ioctlptr_hdr {
+       uint16          cmd;
+       uint16          retbuf_len;
+       uint16          buflen;
+       uint16          rsvd;
+       uint32          cmd_id;
+} ioctlptr_hdr_t;
+
+#else /* PCIE_API_REV1 */
+
+typedef struct ioctl_req_hdr {
+       uint32          pkt_id; /**< Packet ID */
+       uint32          cmd;    /**< IOCTL ID */
+       uint16          retbuf_len;
+       uint16          buflen;
+       uint16          xt_id;  /**< transaction ID */
+       uint16          rsvd[1];
+} ioctl_req_hdr_t;
+
+#endif /* PCIE_API_REV1 */
+
+/** Complete msgbuf hdr for ioctl from host to dongle */
+typedef struct ioct_reqst_hdr {
+       cmn_msg_hdr_t msg;
+#ifdef PCIE_API_REV1
+       ioctl_hdr_t ioct_hdr;
+#else
+       ioctl_req_hdr_t ioct_hdr;
+#endif
+       ret_buf_t ret_buf;
+} ioct_reqst_hdr_t;
+
+typedef struct ioctptr_reqst_hdr {
+       cmn_msg_hdr_t msg;
+#ifdef PCIE_API_REV1
+       ioctlptr_hdr_t ioct_hdr;
+#else
+       ioctl_req_hdr_t ioct_hdr;
+#endif
+       ret_buf_t ret_buf;
+       ret_buf_t ioct_buf;
+} ioctptr_reqst_hdr_t;
+
+/** ioctl response header */
+typedef struct ioct_resp_hdr {
+       cmn_msg_hdr_t   msg;
+#ifdef PCIE_API_REV1
+       uint32  cmd_id;
+#else
+       uint32  pkt_id;
+#endif
+       uint32  status;
+       uint32  ret_len;
+       uint32  inline_data;
+#ifdef PCIE_API_REV1
+#else
+       uint16  xt_id;  /**< transaction ID */
+       uint16  rsvd[1];
+#endif
+} ioct_resp_hdr_t;
+
+/* ioct resp header used in dongle */
+/* ret buf hdr will be stripped off inside dongle itself */
+typedef struct msgbuf_ioctl_resp {
+       ioct_resp_hdr_t ioct_hdr;
+       ret_buf_t       ret_buf;        /**< ret buf pointers */
+} msgbuf_ioct_resp_t;
+
+/** WL event hdr info */
+typedef struct wl_event_hdr {
+       cmn_msg_hdr_t   msg;
+       uint16 event;
+       uint8 flags;
+       uint8 rsvd;
+       uint16 retbuf_len;
+       uint16 rsvd1;
+       uint32 rxbufid;
+} wl_event_hdr_t;
+
+#define TXDESCR_FLOWID_PCIELPBK_1      0xFF
+#define TXDESCR_FLOWID_PCIELPBK_2      0xFE
+
+typedef struct txbatch_lenptr_tup {
+       uint32 pktid;
+       uint16 pktlen;
+       uint16 rsvd;
+       ret_buf_t       ret_buf;        /**< ret buf pointers */
+} txbatch_lenptr_tup_t;
+
+typedef struct txbatch_cmn_msghdr {
+       cmn_msg_hdr_t   msg;
+       uint8 priority;
+       uint8 hdrlen;
+       uint8 pktcnt;
+       uint8 flowid;
+       uint8 txhdr[ETHER_HDR_LEN];
+       uint16 rsvd;
+} txbatch_cmn_msghdr_t;
+
+typedef struct txbatch_msghdr {
+       txbatch_cmn_msghdr_t txcmn;
+       txbatch_lenptr_tup_t tx_tup[0]; /**< Based on packet count */
+} txbatch_msghdr_t;
+
+/* TX desc posting header */
+typedef struct tx_lenptr_tup {
+       uint16 pktlen;
+       uint16 rsvd;
+       ret_buf_t       ret_buf;        /**< ret buf pointers */
+} tx_lenptr_tup_t;
+
+typedef struct txdescr_cmn_msghdr {
+       cmn_msg_hdr_t   msg;
+       uint8 priority;
+       uint8 hdrlen;
+       uint8 descrcnt;
+       uint8 flowid;
+       uint32 pktid;
+} txdescr_cmn_msghdr_t;
+
+typedef struct txdescr_msghdr {
+       txdescr_cmn_msghdr_t txcmn;
+       uint8 txhdr[ETHER_HDR_LEN];
+       uint16 rsvd;
+       tx_lenptr_tup_t tx_tup[0];      /**< Based on descriptor count */
+} txdescr_msghdr_t;
+
+/** Tx status header info */
+typedef struct txstatus_hdr {
+       cmn_msg_hdr_t   msg;
+       uint32 pktid;
+} txstatus_hdr_t;
+
+/** RX bufid-len-ptr tuple */
+typedef struct rx_lenptr_tup {
+       uint32 rxbufid;
+       uint16 len;
+       uint16 rsvd2;
+       ret_buf_t       ret_buf;        /**< ret buf pointers */
+} rx_lenptr_tup_t;
+
+/** Rx descr Post hdr info */
+typedef struct rxdesc_msghdr {
+       cmn_msg_hdr_t   msg;
+       uint16 rsvd0;
+       uint8 rsvd1;
+       uint8 descnt;
+       rx_lenptr_tup_t rx_tup[0];
+} rxdesc_msghdr_t;
+
+/** RX complete tuples */
+typedef struct rxcmplt_tup {
+       uint16 retbuf_len;
+       uint16 data_offset;
+       uint32 rxstatus0;
+       uint32 rxstatus1;
+       uint32 rxbufid;
+} rxcmplt_tup_t;
+
+/** RX complete messge hdr */
+typedef struct rxcmplt_hdr {
+       cmn_msg_hdr_t   msg;
+       uint16 rsvd0;
+       uint16 rxcmpltcnt;
+       rxcmplt_tup_t rx_tup[0];
+} rxcmplt_hdr_t;
+
+typedef struct hostevent_hdr {
+       cmn_msg_hdr_t   msg;
+       uint32 evnt_pyld;
+} hostevent_hdr_t;
+
+typedef struct dma_xfer_params {
+       uint32 src_physaddr_hi;
+       uint32 src_physaddr_lo;
+       uint32 dest_physaddr_hi;
+       uint32 dest_physaddr_lo;
+       uint32 len;
+       uint32 srcdelay;
+       uint32 destdelay;
+} dma_xfer_params_t;
+
+enum {
+       HOST_EVENT_CONS_CMD = 1
+};
+
+/* defines for flags */
+#define MSGBUF_IOC_ACTION_MASK 0x1
+
+#define MAX_SUSPEND_REQ 15
+
+typedef struct tx_idle_flowring_suspend_request {
+       cmn_msg_hdr_t   msg;
+       uint16  ring_id[MAX_SUSPEND_REQ];      /* ring Id's */
+       uint16  num;    /* number of flowid's to suspend */
+} tx_idle_flowring_suspend_request_t;
+
+typedef struct tx_idle_flowring_suspend_response {
+       cmn_msg_hdr_t           msg;
+       compl_msg_hdr_t         cmplt;
+       uint32                  rsvd[2];
+       dma_done_t              marker;
+} tx_idle_flowring_suspend_response_t;
+
+typedef struct tx_idle_flowring_resume_request {
+       cmn_msg_hdr_t   msg;
+       uint16  flow_ring_id;
+       uint16  reason;
+       uint32  rsvd[7];
+} tx_idle_flowring_resume_request_t;
+
+typedef struct tx_idle_flowring_resume_response {
+       cmn_msg_hdr_t           msg;
+       compl_msg_hdr_t         cmplt;
+       uint32                  rsvd[2];
+       dma_done_t              marker;
+} tx_idle_flowring_resume_response_t;
+
+/* timesync related additions */
+
+/* defined similar to bcm_xtlv_t */
+typedef struct _bcm_xtlv {
+       uint16          id; /* TLV idenitifier */
+       uint16          len; /* TLV length in bytes */
+} _bcm_xtlv_t;
+
+#define BCMMSGBUF_FW_CLOCK_INFO_TAG            0
+#define BCMMSGBUF_HOST_CLOCK_INFO_TAG          1
+#define BCMMSGBUF_HOST_CLOCK_SELECT_TAG                2
+#define BCMMSGBUF_D2H_CLOCK_CORRECTION_TAG     3
+#define BCMMSGBUF_HOST_TIMESTAMPING_CONFIG_TAG 4
+#define BCMMSGBUF_MAX_TSYNC_TAG                        5
+
+/* Flags in fw clock info TLV */
+#define CAP_DEVICE_TS          (1 << 0)
+#define CAP_CORRECTED_TS       (1 << 1)
+#define TS_CLK_ACTIVE          (1 << 2)
+
+typedef struct ts_fw_clock_info {
+       _bcm_xtlv_t  xtlv; /* BCMMSGBUF_FW_CLOCK_INFO_TAG */
+       ts_timestamp_srcid_t  ts; /* tick count */
+       uchar           clk_src[4]; /* clock source acronym ILP/AVB/TSF */
+       uint32          nominal_clock_freq;
+       uint32          reset_cnt;
+       uint8           flags;
+       uint8           rsvd[3];
+} ts_fw_clock_info_t;
+
+typedef struct ts_host_clock_info {
+       _bcm_xtlv_t  xtlv; /* BCMMSGBUF_HOST_CLOCK_INFO_TAG */
+       tick_count_64_t ticks; /* 64 bit host tick counter */
+       ts_timestamp_ns_64_t ns; /* 64 bit host time in nano seconds */
+} ts_host_clock_info_t;
+
+typedef struct ts_host_clock_sel {
+       _bcm_xtlv_t     xtlv; /* BCMMSGBUF_HOST_CLOCK_SELECT_TAG */
+       uint32          seqnum; /* number of times GPIO time sync toggled */
+       uint8           min_clk_idx; /* clock idenitifer configured for packet tiem stamping */
+       uint8           max_clk_idx; /* clock idenitifer configured for packet tiem stamping */
+       uint16          rsvd[1];
+} ts_host_clock_sel_t;
+
+typedef struct ts_d2h_clock_correction {
+       _bcm_xtlv_t             xtlv; /* BCMMSGBUF_HOST_CLOCK_INFO_TAG */
+       uint8                   clk_id; /* clock source in the device */
+       uint8                   rsvd[3];
+       ts_correction_m_t       m;      /* y  = 'm' x + b */
+       ts_correction_b_t       b;      /* y  = 'm' x + 'c' */
+} ts_d2h_clock_correction_t;
+
+typedef struct ts_host_timestamping_config {
+       _bcm_xtlv_t             xtlv; /* BCMMSGBUF_HOST_TIMESTAMPING_CONFIG_TAG */
+       /* time period to capture the device time stamp and toggle WLAN_TIME_SYNC_GPIO */
+       uint16                  period_ms;
+       uint8                   flags;
+       uint8                   post_delay;
+       uint32                  reset_cnt;
+} ts_host_timestamping_config_t;
+
+/* Flags in host timestamping config TLV */
+#define FLAG_HOST_RESET                (1 << 0)
+#define IS_HOST_RESET(x)       ((x) & FLAG_HOST_RESET)
+#define CLEAR_HOST_RESET(x)    ((x) & ~FLAG_HOST_RESET)
+
+#define FLAG_CONFIG_NODROP     (1 << 1)
+#define IS_CONFIG_NODROP(x)    ((x) & FLAG_CONFIG_NODROP)
+#define CLEAR_CONFIG_NODROP(x) ((x) & ~FLAG_CONFIG_NODROP)
+
+/* HP2P RLLW Extended TxStatus info when host enables the same */
+#define D2H_TXSTATUS_EXT_PKT_WITH_OVRRD        0x8000 /**< set when pkt had override bit on */
+#define D2H_TXSTATUS_EXT_PKT_XMIT_ON5G 0x4000 /**< set when pkt xmitted on 5G */
+#define D2H_TXSTATUS_EXT_PKT_BT_DENY   0x2000 /**< set when WLAN is given prio over BT */
+
+#endif /* _bcmmsgbuf_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmpcie.h b/bcmdhd.101.10.240.x/include/bcmpcie.h
new file mode 100644 (file)
index 0000000..cef3837
--- /dev/null
@@ -0,0 +1,537 @@
+/*
+ * Broadcom PCIE
+ * Software-specific definitions shared between device and host side
+ * Explains the shared area between host and dongle
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _bcmpcie_h_
+#define        _bcmpcie_h_
+
+#include <typedefs.h>
+
+#define ADDR_64(x)                     (x.addr)
+#define HIGH_ADDR_32(x)     ((uint32) (((sh_addr_t) x).high_addr))
+#define LOW_ADDR_32(x)      ((uint32) (((sh_addr_t) x).low_addr))
+
+typedef struct {
+       uint32 low_addr;
+       uint32 high_addr;
+} sh_addr_t;
+
+/* May be overridden by 43xxxxx-roml.mk */
+#if !defined(BCMPCIE_MAX_TX_FLOWS)
+#define BCMPCIE_MAX_TX_FLOWS   40
+#endif /* ! BCMPCIE_MAX_TX_FLOWS */
+
+#define PCIE_SHARED_VERSION_7          0x00007
+#define PCIE_SHARED_VERSION_6          0x00006 /* rev6 is compatible with rev 5 */
+#define PCIE_SHARED_VERSION_5          0x00005 /* rev6 is compatible with rev 5 */
+/**
+ * Feature flags enabled in dongle. Advertised by dongle to DHD via the PCIe Shared structure that
+ * is located in device memory.
+ */
+#define PCIE_SHARED_VERSION_MASK       0x000FF
+#define PCIE_SHARED_ASSERT_BUILT       0x00100
+#define PCIE_SHARED_ASSERT             0x00200
+#define PCIE_SHARED_TRAP               0x00400
+#define PCIE_SHARED_IN_BRPT            0x00800
+#define PCIE_SHARED_SET_BRPT           0x01000
+#define PCIE_SHARED_PENDING_BRPT       0x02000
+/* BCMPCIE_SUPPORT_TX_PUSH_RING                0x04000 obsolete */
+#define PCIE_SHARED_EVT_SEQNUM         0x08000
+#define PCIE_SHARED_DMA_INDEX          0x10000
+
+/**
+ * There are host types where a device interrupt can 'race ahead' of data written by the device into
+ * host memory. The dongle can avoid this condition using a variety of techniques (read barrier,
+ * using PCIe Message Signalled Interrupts, or by using the PCIE_DMA_INDEX feature). Unfortunately
+ * these techniques have drawbacks on router platforms. For these platforms, it was decided to not
+ * avoid the condition, but to detect the condition instead and act on it.
+ * D2H M2M DMA Complete Sync mechanism: Modulo-253-SeqNum or XORCSUM
+ */
+#define PCIE_SHARED_D2H_SYNC_SEQNUM     0x20000
+#define PCIE_SHARED_D2H_SYNC_XORCSUM    0x40000
+#define PCIE_SHARED_D2H_SYNC_MODE_MASK \
+       (PCIE_SHARED_D2H_SYNC_SEQNUM | PCIE_SHARED_D2H_SYNC_XORCSUM)
+#define PCIE_SHARED_IDLE_FLOW_RING             0x80000
+#define PCIE_SHARED_2BYTE_INDICES       0x100000
+
+#define PCIE_SHARED_FAST_DELETE_RING   0x00000020      /* Fast Delete Ring */
+#define PCIE_SHARED_EVENT_BUF_POOL_MAX 0x000000c0      /* event buffer pool max bits */
+#define PCIE_SHARED_EVENT_BUF_POOL_MAX_POS     6       /* event buffer pool max bit position */
+
+/* dongle supports fatal buf log collection */
+#define PCIE_SHARED_FATAL_LOGBUG_VALID 0x200000
+
+/* Implicit DMA with corerev 19 and after */
+#define PCIE_SHARED_IDMA               0x400000
+
+/* MSI support */
+#define PCIE_SHARED_D2H_MSI_MULTI_MSG   0x800000
+
+/* IFRM with corerev 19 and after */
+#define PCIE_SHARED_IFRM               0x1000000
+
+/**
+ * From Rev6 and above, suspend/resume can be done using two handshake methods.
+ * 1. Using ctrl post/ctrl cmpl messages (Default rev6)
+ * 2. Using Mailbox data (old method as used in rev5)
+ * This shared flag indicates whether to overide rev6 default method and use mailbox for
+ * suspend/resume.
+ */
+#define PCIE_SHARED_USE_MAILBOX                0x2000000
+
+/* Firmware compiled for mfgbuild purposes */
+#define PCIE_SHARED_MFGBUILD_FW                0x4000000
+
+/* Firmware could use DB0 value as host timestamp */
+#define PCIE_SHARED_TIMESTAMP_DB0      0x8000000
+/* Firmware could use Hostready (IPC rev7) */
+#define PCIE_SHARED_HOSTRDY_SUPPORT    0x10000000
+
+/* When set, Firmwar does not support OOB Device Wake based DS protocol */
+#define PCIE_SHARED_NO_OOB_DW          0x20000000
+
+/* When set, Firmwar supports Inband DS protocol */
+#define PCIE_SHARED_INBAND_DS          0x40000000
+
+/* use DAR registers */
+#define PCIE_SHARED_DAR                        0x80000000
+
+/**
+ * Following are the shared2 flags. All bits in flags have been used. A flags2
+ * field got added and the definition for these flags come here:
+ */
+/* WAR: D11 txstatus through unused status field of PCIe completion header */
+#define PCIE_SHARED2_EXTENDED_TRAP_DATA        0x00000001      /* using flags2 in shared area */
+#define PCIE_SHARED2_TXSTATUS_METADATA 0x00000002
+#define PCIE_SHARED2_BT_LOGGING                0x00000004      /* BT logging support */
+#define PCIE_SHARED2_SNAPSHOT_UPLOAD   0x00000008      /* BT/WLAN snapshot upload support */
+#define PCIE_SHARED2_SUBMIT_COUNT_WAR  0x00000010      /* submission count WAR */
+#define PCIE_SHARED2_FAST_DELETE_RING  0x00000020      /* Fast Delete ring support */
+#define PCIE_SHARED2_EVTBUF_MAX_MASK   0x000000C0      /* 0:32, 1:64, 2:128, 3: 256 */
+
+/* using flags2 to indicate firmware support added to reuse timesync to update PKT txstatus */
+#define PCIE_SHARED2_PKT_TX_STATUS     0x00000100
+#define PCIE_SHARED2_FW_SMALL_MEMDUMP  0x00000200      /* FW small memdump */
+#define PCIE_SHARED2_FW_HC_ON_TRAP     0x00000400
+#define PCIE_SHARED2_HSCB              0x00000800      /* Host SCB support */
+
+#define PCIE_SHARED2_EDL_RING                  0x00001000      /* Support Enhanced Debug Lane */
+#define PCIE_SHARED2_DEBUG_BUF_DEST            0x00002000      /* debug buf dest support */
+#define PCIE_SHARED2_PCIE_ENUM_RESET_FLR       0x00004000      /* BT producer index reset WAR */
+#define PCIE_SHARED2_PKT_TIMESTAMP             0x00008000      /* Timestamp in packet */
+
+#define PCIE_SHARED2_HP2P              0x00010000u     /* HP2P feature */
+#define PCIE_SHARED2_HWA               0x00020000u     /* HWA feature */
+#define PCIE_SHARED2_TRAP_ON_HOST_DB7  0x00040000u     /* can take a trap on DB7 from host */
+
+#define PCIE_SHARED2_DURATION_SCALE    0x00100000u
+
+#define PCIE_SHARED2_D2H_D11_TX_STATUS 0x40000000
+#define PCIE_SHARED2_H2D_D11_TX_STATUS 0x80000000
+
+#define PCIE_SHARED_D2H_MAGIC          0xFEDCBA09
+#define PCIE_SHARED_H2D_MAGIC          0x12345678
+
+typedef uint16                 pcie_hwa_db_index_t;    /* 16 bit HWA index (IPC Rev 7) */
+#define PCIE_HWA_DB_INDEX_SZ   (2u)                    /* 2 bytes  sizeof(pcie_hwa_db_index_t) */
+
+/**
+ * Message rings convey messages between host and device. They are unidirectional, and are located
+ * in host memory.
+ *
+ * This is the minimal set of message rings, known as 'common message rings':
+ */
+#define BCMPCIE_H2D_MSGRING_CONTROL_SUBMIT             0
+#define BCMPCIE_H2D_MSGRING_RXPOST_SUBMIT              1
+#define BCMPCIE_D2H_MSGRING_CONTROL_COMPLETE           2
+#define BCMPCIE_D2H_MSGRING_TX_COMPLETE                        3
+#define BCMPCIE_D2H_MSGRING_RX_COMPLETE                        4
+#define BCMPCIE_COMMON_MSGRING_MAX_ID                  4
+
+#define BCMPCIE_H2D_COMMON_MSGRINGS                    2
+#define BCMPCIE_D2H_COMMON_MSGRINGS                    3
+#define BCMPCIE_COMMON_MSGRINGS                                5
+
+#define BCMPCIE_H2D_MSGRINGS(max_tx_flows) \
+       (BCMPCIE_H2D_COMMON_MSGRINGS + (max_tx_flows))
+
+/* different ring types */
+#define BCMPCIE_H2D_RING_TYPE_CTRL_SUBMIT              0x1
+#define BCMPCIE_H2D_RING_TYPE_TXFLOW_RING              0x2
+#define BCMPCIE_H2D_RING_TYPE_RXBUFPOST                        0x3
+#define BCMPCIE_H2D_RING_TYPE_TXSUBMIT                 0x4
+#define BCMPCIE_H2D_RING_TYPE_DBGBUF_SUBMIT            0x5
+#define BCMPCIE_H2D_RING_TYPE_BTLOG_SUBMIT             0x6
+
+#define BCMPCIE_D2H_RING_TYPE_CTRL_CPL                 0x1
+#define BCMPCIE_D2H_RING_TYPE_TX_CPL                   0x2
+#define BCMPCIE_D2H_RING_TYPE_RX_CPL                   0x3
+#define BCMPCIE_D2H_RING_TYPE_DBGBUF_CPL               0x4
+#define BCMPCIE_D2H_RING_TYPE_AC_RX_COMPLETE           0x5
+#define BCMPCIE_D2H_RING_TYPE_BTLOG_CPL                        0x6
+#define BCMPCIE_D2H_RING_TYPE_EDL                       0x7
+#define BCMPCIE_D2H_RING_TYPE_HPP_TX_CPL               0x8
+#define BCMPCIE_D2H_RING_TYPE_HPP_RX_CPL               0x9
+
+/**
+ * H2D and D2H, WR and RD index, are maintained in the following arrays:
+ * - Array of all H2D WR Indices
+ * - Array of all H2D RD Indices
+ * - Array of all D2H WR Indices
+ * - Array of all D2H RD Indices
+ *
+ * The offset of the WR or RD indexes (for common rings) in these arrays are
+ * listed below. Arrays ARE NOT indexed by a ring's id.
+ *
+ * D2H common rings WR and RD index start from 0, even though their ringids
+ * start from BCMPCIE_H2D_COMMON_MSGRINGS
+ */
+
+#define BCMPCIE_H2D_RING_IDX(h2d_ring_id) (h2d_ring_id)
+
+enum h2dring_idx {
+       /* H2D common rings */
+       BCMPCIE_H2D_MSGRING_CONTROL_SUBMIT_IDX =
+               BCMPCIE_H2D_RING_IDX(BCMPCIE_H2D_MSGRING_CONTROL_SUBMIT),
+       BCMPCIE_H2D_MSGRING_RXPOST_SUBMIT_IDX =
+               BCMPCIE_H2D_RING_IDX(BCMPCIE_H2D_MSGRING_RXPOST_SUBMIT),
+
+       /* First TxPost's WR or RD index starts after all H2D common rings */
+       BCMPCIE_H2D_MSGRING_TXFLOW_IDX_START =
+               BCMPCIE_H2D_RING_IDX(BCMPCIE_H2D_COMMON_MSGRINGS)
+};
+
+#define BCMPCIE_D2H_RING_IDX(d2h_ring_id) \
+       ((d2h_ring_id) - BCMPCIE_H2D_COMMON_MSGRINGS)
+
+enum d2hring_idx {
+       /* D2H Common Rings */
+       BCMPCIE_D2H_MSGRING_CONTROL_COMPLETE_IDX =
+               BCMPCIE_D2H_RING_IDX(BCMPCIE_D2H_MSGRING_CONTROL_COMPLETE),
+       BCMPCIE_D2H_MSGRING_TX_COMPLETE_IDX =
+               BCMPCIE_D2H_RING_IDX(BCMPCIE_D2H_MSGRING_TX_COMPLETE),
+       BCMPCIE_D2H_MSGRING_RX_COMPLETE_IDX =
+               BCMPCIE_D2H_RING_IDX(BCMPCIE_D2H_MSGRING_RX_COMPLETE)
+};
+
+/**
+ * Macros for managing arrays of RD WR indices:
+ * rw_index_sz:
+ *    - in dongle, rw_index_sz is known at compile time
+ *    - in host/DHD, rw_index_sz is derived from advertized pci_shared flags
+ *
+ *  ring_idx: See h2dring_idx and d2hring_idx
+ */
+
+/** Offset of a RD or WR index in H2D or D2H indices array */
+#define BCMPCIE_RW_INDEX_OFFSET(rw_index_sz, ring_idx) \
+       ((rw_index_sz) * (ring_idx))
+
+/** Fetch the address of RD or WR index in H2D or D2H indices array */
+#define BCMPCIE_RW_INDEX_ADDR(indices_array_base, rw_index_sz, ring_idx) \
+       (void *)((uint32)(indices_array_base) + \
+       BCMPCIE_RW_INDEX_OFFSET((rw_index_sz), (ring_idx)))
+
+/** H2D DMA Indices array size: given max flow rings */
+#define BCMPCIE_H2D_RW_INDEX_ARRAY_SZ(rw_index_sz, max_tx_flows) \
+       ((rw_index_sz) * BCMPCIE_H2D_MSGRINGS(max_tx_flows))
+
+/** D2H DMA Indices array size */
+#define BCMPCIE_D2H_RW_INDEX_ARRAY_SZ(rw_index_sz) \
+       ((rw_index_sz) * BCMPCIE_D2H_COMMON_MSGRINGS)
+
+/* Backwards compatibility for legacy branches. */
+#if !defined(PHYS_ADDR_N)
+       #define PHYS_ADDR_N(name) name
+#endif
+
+/**
+ * This type is used by a 'message buffer' (which is a FIFO for messages). Message buffers are used
+ * for host<->device communication and are instantiated on both sides. ring_mem_t is instantiated
+ * both in host as well as device memory.
+ */
+typedef struct ring_mem {
+       uint16          idx;       /* ring id */
+       uint8           type;
+       uint8           rsvd;
+       uint16          max_item;  /* Max number of items in flow ring */
+       uint16          len_items; /* Items are fixed size. Length in bytes of one item */
+       sh_addr_t       base_addr; /* 64 bits address, either in host or device memory */
+} ring_mem_t;
+
+/**
+ * Per flow ring, information is maintained in device memory, eg at what address the ringmem and
+ * ringstate are located. The flow ring itself can be instantiated in either host or device memory.
+ *
+ * Perhaps this type should be renamed to make clear that it resides in device memory only.
+ */
+typedef struct ring_info {
+       uint32          PHYS_ADDR_N(ringmem_ptr); /* ring mem location in dongle memory */
+
+       /* Following arrays are indexed using h2dring_idx and d2hring_idx, and not
+        * by a ringid.
+        */
+
+       /* 32bit ptr to arrays of WR or RD indices for all rings in dongle memory */
+       uint32          PHYS_ADDR_N(h2d_w_idx_ptr); /* Array of all H2D ring's WR indices */
+       uint32          PHYS_ADDR_N(h2d_r_idx_ptr); /* Array of all H2D ring's RD indices */
+       uint32          PHYS_ADDR_N(d2h_w_idx_ptr); /* Array of all D2H ring's WR indices */
+       uint32          PHYS_ADDR_N(d2h_r_idx_ptr); /* Array of all D2H ring's RD indices */
+
+       /* PCIE_DMA_INDEX feature: Dongle uses mem2mem DMA to sync arrays in host.
+        * Host may directly fetch WR and RD indices from these host-side arrays.
+        *
+        * 64bit ptr to arrays of WR or RD indices for all rings in host memory.
+        */
+       sh_addr_t       h2d_w_idx_hostaddr; /* Array of all H2D ring's WR indices */
+       sh_addr_t       h2d_r_idx_hostaddr; /* Array of all H2D ring's RD indices */
+       sh_addr_t       d2h_w_idx_hostaddr; /* Array of all D2H ring's WR indices */
+       sh_addr_t       d2h_r_idx_hostaddr; /* Array of all D2H ring's RD indices */
+
+       uint16          max_tx_flowrings; /* maximum number of H2D rings: common + flow */
+       uint16          max_submission_queues; /* maximum number of H2D rings: common + flow */
+       uint16          max_completion_rings; /* maximum number of H2D rings: common + flow */
+       uint16          max_vdevs; /* max number of virtual interfaces supported */
+
+       sh_addr_t       ifrm_w_idx_hostaddr; /* Array of all H2D ring's WR indices for IFRM */
+
+       /* 32bit ptr to arrays of HWA DB indices for all rings in dongle memory */
+       uint32          PHYS_ADDR_N(h2d_hwa_db_idx_ptr); /* Array of all H2D rings HWA DB indices */
+       uint32          PHYS_ADDR_N(d2h_hwa_db_idx_ptr); /* Array of all D2H rings HWA DB indices */
+
+} ring_info_t;
+
+/**
+ * A structure located in TCM that is shared between host and device, primarily used during
+ * initialization.
+ */
+typedef struct {
+       /** shared area version captured at flags 7:0 */
+       uint32  flags;
+
+       uint32 PHYS_ADDR_N(trap_addr);
+       uint32 PHYS_ADDR_N(assert_exp_addr);
+       uint32 PHYS_ADDR_N(assert_file_addr);
+       uint32  assert_line;
+       uint32 PHYS_ADDR_N(console_addr);       /**< Address of hnd_cons_t */
+
+       uint32 PHYS_ADDR_N(msgtrace_addr);
+
+       uint32  fwid;
+
+       /* Used for debug/flow control */
+       uint16  total_lfrag_pkt_cnt;
+       uint16  max_host_rxbufs; /* rsvd in spec */
+
+       uint32 dma_rxoffset; /* rsvd in spec */
+
+       /** these will be used for sleep request/ack, d3 req/ack */
+       uint32  PHYS_ADDR_N(h2d_mb_data_ptr);
+       uint32  PHYS_ADDR_N(d2h_mb_data_ptr);
+
+       /* information pertinent to host IPC/msgbuf channels */
+       /** location in the TCM memory which has the ring_info */
+       uint32  PHYS_ADDR_N(rings_info_ptr);
+
+       /** block of host memory for the scratch buffer */
+       uint32          host_dma_scratch_buffer_len;
+       sh_addr_t       host_dma_scratch_buffer;
+
+       /* location in host memory for scb host offload structures */
+       sh_addr_t       host_scb_addr;
+       uint32          host_scb_size;
+
+       /* anonymous union for overloading fields in structure */
+       union {
+               uint32  buzz_dbg_ptr;   /* BUZZZ state format strings and trace buffer */
+               struct {
+                       /* Host provided trap buffer length in words */
+                       uint16  device_trap_debug_buffer_len;
+                       uint16  rsvd2;
+               };
+       };
+
+       /* rev6 compatible changes */
+       uint32          flags2;
+       uint32          host_cap;
+
+       /* location in the host address space to write trap indication.
+       * At this point for the current rev of the spec, firmware will
+       * support only indications to 32 bit host addresses.
+       * This essentially is device_trap_debug_buffer_addr
+       */
+       sh_addr_t       host_trap_addr;
+
+       /* location for host fatal error log buffer start address */
+       uint32 PHYS_ADDR_N(device_fatal_logbuf_start);
+
+       /* location in host memory for offloaded modules */
+       sh_addr_t       hoffload_addr;
+       uint32          flags3;
+       uint32          host_cap2;
+       uint32          host_cap3;
+} pciedev_shared_t;
+
+/* Device F/W provides the following access function:
+ * pciedev_shared_t *hnd_get_pciedev_shared(void);
+ */
+
+/* host capabilities */
+#define HOSTCAP_PCIEAPI_VERSION_MASK           0x000000FF
+#define HOSTCAP_H2D_VALID_PHASE                        0x00000100
+#define HOSTCAP_H2D_ENABLE_TRAP_ON_BADPHASE    0x00000200
+#define HOSTCAP_H2D_ENABLE_HOSTRDY             0x00000400
+#define HOSTCAP_DB0_TIMESTAMP                  0x00000800
+#define HOSTCAP_DS_NO_OOB_DW                   0x00001000
+#define HOSTCAP_DS_INBAND_DW                   0x00002000
+#define HOSTCAP_H2D_IDMA                       0x00004000
+#define HOSTCAP_H2D_IFRM                       0x00008000
+#define HOSTCAP_H2D_DAR                                0x00010000
+#define HOSTCAP_EXTENDED_TRAP_DATA             0x00020000
+#define HOSTCAP_TXSTATUS_METADATA              0x00040000
+#define HOSTCAP_BT_LOGGING                     0x00080000
+#define HOSTCAP_SNAPSHOT_UPLOAD                        0x00100000
+#define HOSTCAP_FAST_DELETE_RING               0x00200000
+#define HOSTCAP_PKT_TXSTATUS                   0x00400000
+#define HOSTCAP_UR_FW_NO_TRAP                  0x00800000 /* Don't trap on UR */
+#define HOSTCAP_HSCB                           0x02000000
+/* Host support for extended device trap debug buffer */
+#define HOSTCAP_EXT_TRAP_DBGBUF                        0x04000000
+/* Host support for enhanced debug lane */
+#define HOSTCAP_EDL_RING                       0x10000000
+#define HOSTCAP_PKT_TIMESTAMP                  0x20000000
+#define HOSTCAP_PKT_HP2P                       0x40000000
+#define HOSTCAP_HWA                            0x80000000
+#define HOSTCAP2_DURATION_SCALE_MASK            0x0000003Fu
+
+/* extended trap debug buffer allocation sizes. Note that this buffer can be used for
+ * other trap related purposes also.
+ */
+#define BCMPCIE_HOST_EXT_TRAP_DBGBUF_LEN_MIN   (64u * 1024u)
+#define BCMPCIE_HOST_EXT_TRAP_DBGBUF_LEN       (96u * 1024u)
+#define BCMPCIE_HOST_EXT_TRAP_DBGBUF_LEN_MAX   (256u * 1024u)
+
+/**
+ * Mailboxes notify a remote party that an event took place, using interrupts. They use hardware
+ * support.
+ */
+
+/* H2D mail box Data */
+#define H2D_HOST_D3_INFORM             0x00000001
+#define H2D_HOST_DS_ACK                0x00000002
+#define H2D_HOST_DS_NAK                0x00000004
+#define H2D_HOST_D0_INFORM_IN_USE      0x00000008
+#define H2D_HOST_D0_INFORM             0x00000010
+#define H2DMB_DS_ACTIVE                        0x00000020
+#define H2DMB_DS_DEVICE_WAKE   0x00000040
+#define H2D_HOST_IDMA_INITED   0x00000080
+#define H2D_HOST_ACK_NOINT             0x00010000 /* d2h_ack interrupt ignore */
+#define H2D_HOST_CONS_INT      0x80000000      /**< h2d int for console cmds  */
+#define H2D_FW_TRAP            0x20000000      /**< h2d force TRAP */
+#define H2DMB_DS_HOST_SLEEP_INFORM H2D_HOST_D3_INFORM
+#define H2DMB_DS_DEVICE_SLEEP_ACK  H2D_HOST_DS_ACK
+#define H2DMB_DS_DEVICE_SLEEP_NAK  H2D_HOST_DS_NAK
+#define H2DMB_D0_INFORM_IN_USE     H2D_HOST_D0_INFORM_IN_USE
+#define H2DMB_D0_INFORM            H2D_HOST_D0_INFORM
+#define H2DMB_FW_TRAP              H2D_FW_TRAP
+#define H2DMB_HOST_CONS_INT        H2D_HOST_CONS_INT
+#define H2DMB_DS_DEVICE_WAKE_ASSERT            H2DMB_DS_DEVICE_WAKE
+#define H2DMB_DS_DEVICE_WAKE_DEASSERT  H2DMB_DS_ACTIVE
+
+/* D2H mail box Data */
+#define D2H_DEV_D3_ACK                                 0x00000001
+#define D2H_DEV_DS_ENTER_REQ                           0x00000002
+#define D2H_DEV_DS_EXIT_NOTE                           0x00000004
+#define D2HMB_DS_HOST_SLEEP_EXIT_ACK                   0x00000008
+#define D2H_DEV_IDMA_INITED                            0x00000010
+#define D2HMB_DS_HOST_SLEEP_ACK         D2H_DEV_D3_ACK
+#define D2HMB_DS_DEVICE_SLEEP_ENTER_REQ D2H_DEV_DS_ENTER_REQ
+#define D2HMB_DS_DEVICE_SLEEP_EXIT      D2H_DEV_DS_EXIT_NOTE
+
+#define D2H_DEV_MB_MASK                (D2H_DEV_D3_ACK | D2H_DEV_DS_ENTER_REQ | \
+                               D2H_DEV_DS_EXIT_NOTE | D2H_DEV_IDMA_INITED)
+#define D2H_DEV_MB_INVALIDATED(x)      ((!x) || (x & ~D2H_DEV_MB_MASK))
+
+/* trap data codes */
+#define D2H_DEV_FWHALT                                 0x10000000
+#define D2H_DEV_EXT_TRAP_DATA                          0x20000000
+#define D2H_DEV_TRAP_IN_TRAP                           0x40000000
+#define D2H_DEV_TRAP_HOSTDB                            0x80000000 /* trap as set by host DB */
+#define D2H_DEV_TRAP_DUE_TO_BT                         0x01000000
+/* Indicates trap due to HMAP violation */
+#define D2H_DEV_TRAP_DUE_TO_HMAP                       0x02000000
+/* Indicates whether HMAP violation was Write */
+#define D2H_DEV_TRAP_HMAP_WRITE                                0x04000000
+#define D2H_DEV_TRAP_PING_HOST_FAILURE                 0x08000000
+#define D2H_FWTRAP_MASK                0x0000001F      /* Adding maskbits for TRAP information */
+
+#define D2HMB_FWHALT                    D2H_DEV_FWHALT
+#define D2HMB_TRAP_IN_TRAP              D2H_DEV_TRAP_IN_TRAP
+#define D2HMB_EXT_TRAP_DATA             D2H_DEV_EXT_TRAP_DATA
+
+/* Size of Extended Trap data Buffer */
+#define BCMPCIE_EXT_TRAP_DATA_MAXLEN  4096
+
+/** These macro's operate on type 'inuse_lclbuf_pool_t' and are used by firmware only */
+#define PREVTXP(i, d)           (((i) == 0) ? ((d) - 1) : ((i) - 1))
+#define NEXTTXP(i, d)           ((((i)+1) >= (d)) ? 0 : ((i)+1))
+#define NEXTNTXP(i, n, d)       ((((i)+(n)) >= (d)) ? 0 : ((i)+(n)))
+#define NTXPACTIVE(r, w, d)     (((r) <= (w)) ? ((w)-(r)) : ((d)-(r)+(w)))
+#define NTXPAVAIL(r, w, d)      (((d) - NTXPACTIVE((r), (w), (d))) > 1)
+
+/* Function can be used to notify host of FW halt */
+#define READ_AVAIL_SPACE(w, r, d) ((w >= r) ? (uint32)(w - r) : (uint32)(d - r))
+#define WRITE_SPACE_AVAIL_CONTINUOUS(r, w, d) ((w >= r) ? (d - w) : (r - w))
+#define WRITE_SPACE_AVAIL(r, w, d) (d - (NTXPACTIVE(r, w, d)) - 1)
+#define CHECK_WRITE_SPACE(r, w, d) ((r) > (w)) ? \
+       (uint32)((r) - (w) - 1) : ((r) == 0 || (w) == 0) ? \
+       (uint32)((d) - (w) - 1) : (uint32)((d) - (w))
+
+#define CHECK_NOWRITE_SPACE(r, w, d) \
+       (((uint32)(r) == (uint32)((w) + 1)) || (((r) == 0) && ((w) == ((d) - 1))))
+
+/* These should be moved into pciedev.h --- */
+#define WRT_PEND(x)    ((x)->wr_pending)
+#define DNGL_RING_WPTR(msgbuf)         (*((msgbuf)->tcm_rs_w_ptr)) /**< advanced by producer */
+#define BCMMSGBUF_RING_SET_W_PTR(msgbuf, a)    (DNGL_RING_WPTR(msgbuf) = (a))
+
+#define DNGL_RING_RPTR(msgbuf)         (*((msgbuf)->tcm_rs_r_ptr)) /**< advanced by consumer */
+#define BCMMSGBUF_RING_SET_R_PTR(msgbuf, a)    (DNGL_RING_RPTR(msgbuf) = (a))
+
+#define MODULO_RING_IDX(x, y)  ((x) % (y)->bitmap_size)
+
+#define  RING_READ_PTR(x)      ((x)->ringstate->r_offset)
+#define  RING_WRITE_PTR(x)     ((x)->ringstate->w_offset)
+#define  RING_START_PTR(x)     ((x)->ringmem->base_addr.low_addr)
+#define  RING_MAX_ITEM(x)      ((x)->ringmem->max_item)
+#define  RING_LEN_ITEMS(x)     ((x)->ringmem->len_items)
+#define         HOST_RING_BASE(x)      ((x)->dma_buf.va)
+#define         HOST_RING_END(x)       ((uint8 *)HOST_RING_BASE((x)) + \
+                                       ((RING_MAX_ITEM((x))-1)*RING_LEN_ITEMS((x))))
+
+/* Trap types copied in the pciedev_shared.trap_addr */
+#define        FW_INITIATED_TRAP_TYPE  (0x1 << 7)
+#define        HEALTHCHECK_NODS_TRAP_TYPE      (0x1 << 6)
+
+#endif /* _bcmpcie_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmproto.h b/bcmdhd.101.10.240.x/include/bcmproto.h
new file mode 100644 (file)
index 0000000..c1a33ba
--- /dev/null
@@ -0,0 +1,248 @@
+/*
+ * Fundamental constants relating to IP Protocol
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _bcmproto_h_
+#define _bcmproto_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+#include "eapol.h"
+#include "802.3.h"
+#include "vlan.h"
+#include "bcmtcp.h"
+/* copy from igsc.h */
+#define IGMP_HLEN                      8
+
+enum frame_l2_hdr {
+FRAME_L2_SNAP_H = 1,
+FRAME_L2_SNAPVLAN_H,
+FRAME_L2_ETH_H,
+FRAME_L2_ETHVLAN_H,
+FRAME_L2_ERROR,
+};
+
+enum frame_l3_hdr {
+FRAME_L3_IP_H = 4,
+FRAME_L3_IP6_H = 6,
+FRAME_L3_ARP_H,
+FRAME_L3_8021X_EAPOLKEY_H,
+FRAME_L3_ERROR,
+};
+
+enum frame_l4_hdr {
+FRAME_L4_ICMP_H = 1,
+FRAME_L4_IGMP_H = 2,
+FRAME_L4_TCP_H = 6,
+FRAME_L4_UDP_H = 17,
+FRAME_L4_ICMP6_H = 58,
+FRAME_L4_ERROR,
+};
+
+typedef struct {
+       uint8 *l2;
+       uint8 l2_t;
+       uint16 l2_len;
+       uint8 *l3;
+       uint8 l3_t;
+       uint16 l3_len;
+       uint8 *l4;
+       uint8 l4_t;
+       uint16 l4_len;
+} frame_proto_t;
+
+static const uint8 llc_snap_hdr[SNAP_HDR_LEN] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
+
+/* Generic header parser function */
+static INLINE int
+hnd_frame_proto(uint8 *p, int plen, frame_proto_t *fp)
+{
+       struct dot3_mac_llc_snap_header *sh = (struct dot3_mac_llc_snap_header *)p;
+       struct dot3_mac_llc_snapvlan_header *svh = (struct dot3_mac_llc_snapvlan_header *)p;
+       struct ether_header *eh = (struct ether_header *)p;
+       struct ethervlan_header *evh = (struct ethervlan_header *)p;
+       uint16 type;
+       uint16 len;
+
+       if (p == NULL || plen <= 0)
+               return BCME_ERROR;
+
+       type  = ntoh16(eh->ether_type);
+
+       bzero(fp, sizeof(frame_proto_t));
+
+       /* L2 header/pointer check */
+       fp->l2 = p;
+       fp->l2_len = (uint16)plen;
+       if (type < ETHER_TYPE_MIN) {
+               if (bcmp(&sh->dsap, llc_snap_hdr, SNAP_HDR_LEN) == 0) {
+                       type = ntoh16(sh->type);
+                       if (type == ETHER_TYPE_8021Q) {
+                               fp->l2_t = FRAME_L2_SNAPVLAN_H;
+                               p += sizeof(struct dot3_mac_llc_snap_header);
+                               if ((plen -= sizeof(struct dot3_mac_llc_snap_header)) <= 0)
+                                       return BCME_ERROR;
+                       }
+                       else {
+                               fp->l2_t = FRAME_L2_SNAP_H;
+                               type = ntoh16(svh->ether_type);
+                               p += sizeof(struct dot3_mac_llc_snapvlan_header);
+                               if ((plen -= sizeof(struct dot3_mac_llc_snapvlan_header)) <= 0)
+                                       return BCME_ERROR;
+                       }
+               }
+               else
+                       return BCME_ERROR;
+       }
+       else {
+               if (type == ETHER_TYPE_8021Q) {
+                       fp->l2_t = FRAME_L2_ETHVLAN_H;
+                       type = ntoh16(evh->ether_type);
+                       p += ETHERVLAN_HDR_LEN;
+                       if ((plen -= ETHERVLAN_HDR_LEN) <= 0)
+                               return BCME_ERROR;
+               }
+               else {
+                       fp->l2_t = FRAME_L2_ETH_H;
+                       p += ETHER_HDR_LEN;
+                       if ((plen -= ETHER_HDR_LEN) <= 0)
+                               return BCME_ERROR;
+               }
+       }
+       /* L3 header/pointer check */
+       fp->l3 = p;
+       fp->l3_len = (uint16)plen;
+       switch (type) {
+       case ETHER_TYPE_ARP: {
+               if ((plen -= ARP_DATA_LEN) < 0)
+                       return BCME_ERROR;
+
+               fp->l3_t = FRAME_L3_ARP_H;
+               /* no layer 4 protocol, return */
+               return BCME_OK;
+               break;
+       }
+       case ETHER_TYPE_IP: {
+               struct ipv4_hdr *iph = (struct ipv4_hdr *)p;
+               len = IPV4_HLEN(iph);
+
+               if ((plen -= len) <= 0)
+                       return BCME_ERROR;
+
+               if (IP_VER(iph) == IP_VER_4 && len >= IPV4_MIN_HEADER_LEN) {
+                       fp->l3_t = FRAME_L3_IP_H;
+                       type = IPV4_PROT(iph);
+                       p += len;
+               }
+               else /* not a valid ipv4 packet */
+                       return BCME_ERROR;
+               break;
+       }
+       case ETHER_TYPE_IPV6: {
+               struct ipv6_hdr *ip6h = (struct ipv6_hdr *)p;
+
+               if ((plen -= IPV6_MIN_HLEN) <= 0)
+                       return BCME_ERROR;
+
+               if (IP_VER(ip6h) == IP_VER_6) {
+                       fp->l3_t = FRAME_L3_IP6_H;
+                       type = IPV6_PROT(ip6h);
+                       p += IPV6_MIN_HLEN;
+                       if (IPV6_EXTHDR(type)) {
+                               uint8 proto = 0;
+                               int32 exth_len = ipv6_exthdr_len(p, &proto);
+                               if (exth_len < 0 || ((plen -= exth_len) <= 0))
+                                       return BCME_ERROR;
+                               type = proto;
+                               p += exth_len;
+                       }
+               }
+               else /* not a valid ipv6 packet */
+                       return BCME_ERROR;
+               break;
+       }
+       case ETHER_TYPE_802_1X: {
+               eapol_hdr_t *eapolh = (eapol_hdr_t *)p;
+
+               if ((plen -= EAPOL_HDR_LEN) <= 0)
+                       return BCME_ERROR;
+
+               if (eapolh->type == EAPOL_KEY) {
+                       fp->l3_t = FRAME_L3_8021X_EAPOLKEY_H;
+                       return BCME_OK;
+               }
+               else /* not a valid ipv6 packet */
+                       return BCME_ERROR;
+
+               break;
+       }
+       default:
+               /* not interesting case */
+               return BCME_ERROR;
+               break;
+       }
+
+       /* L4 header/pointer check */
+       fp->l4 = p;
+       fp->l4_len = (uint16)plen;
+       switch (type) {
+       case IP_PROT_ICMP:
+               fp->l4_t = FRAME_L4_ICMP_H;
+               if ((plen -= sizeof(struct bcmicmp_hdr)) < 0)
+                       return BCME_ERROR;
+               break;
+       case IP_PROT_IGMP:
+               fp->l4_t = FRAME_L4_IGMP_H;
+               if ((plen -= IGMP_HLEN) < 0)
+                       return BCME_ERROR;
+               break;
+       case IP_PROT_TCP:
+               fp->l4_t = FRAME_L4_TCP_H;
+               if ((plen -= sizeof(struct bcmtcp_hdr)) < 0)
+                       return BCME_ERROR;
+               break;
+       case IP_PROT_UDP:
+               fp->l4_t = FRAME_L4_UDP_H;
+               if ((plen -= sizeof(struct bcmudp_hdr)) < 0)
+                       return BCME_ERROR;
+               break;
+       case IP_PROT_ICMP6:
+               fp->l4_t = FRAME_L4_ICMP6_H;
+               if ((plen -= sizeof(struct icmp6_hdr)) < 0)
+                       return BCME_ERROR;
+               break;
+       default:
+               break;
+       }
+
+       return BCME_OK;
+}
+
+#define SNAP_HDR_LEN   6       /* 802.3 LLC/SNAP header length */
+
+#define FRAME_DROP 0
+#define FRAME_NOP 1
+#define FRAME_TAKEN 2
+
+#endif /* _bcmproto_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmrand.h b/bcmdhd.101.10.240.x/include/bcmrand.h
new file mode 100644 (file)
index 0000000..544e66e
--- /dev/null
@@ -0,0 +1,59 @@
+/*
+ * bcmrand.h.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _bcmrand_h_
+#define        _bcmrand_h_
+
+/* When HOST driver is for PCIE dongle image, we suppose the HOST must provide the entropy
+ * input if it does not define the macro BCM_RNG_NO_HOST_ENTROPY
+ */
+
+/* the format of current TCM layout during boot
+ *
+ *    Code Unused memory   Random numbers   Random number    Magic number    NVRAM      NVRAM
+ *                                          byte Count       0xFEEDC0DE                 Size
+ *   |<-----Variable---->|<---Variable--->|<-----4 bytes-->|<---4 bytes---->|<---V--->|<--4B--->|
+ *                       |<------------- BCM_ENTROPY_HOST_MAXSIZE --------->|
+ */
+
+/* The HOST need to provided 64 bytes (512 bits) entropy for the bcm SW RNG */
+#define BCM_ENTROPY_MAGIC_SIZE         4u
+#define BCM_ENTROPY_COUNT_SIZE         4u
+#define BCM_ENTROPY_SEED_NBYTES                64u
+#define BCM_ENTROPY_NONCE_NBYTES       16u
+#define BCM_ENTROPY_HOST_NBYTES                128u
+
+#ifdef DBG_RNG_SEC_TEST
+#define BCM_ENTROPY_MAX_NBYTES         128u
+#else
+#define BCM_ENTROPY_MAX_NBYTES         512u
+#endif /* DBG_RNG_SEC_TEST */
+#define BCM_ENTROPY_HOST_MAXSIZE       \
+       (BCM_ENTROPY_MAGIC_SIZE + BCM_ENTROPY_COUNT_SIZE + BCM_ENTROPY_MAX_NBYTES)
+
+/* Constant for calculate the location of host entropy input */
+#define BCM_NVRAM_OFFSET_TCM           4u
+#define BCM_NVRAM_IMG_COMPRS_FACTOR    4u
+#define BCM_NVRAM_RNG_SIGNATURE                0xFEEDC0DEu
+
+#endif /* _bcmrand_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmsdbus.h b/bcmdhd.101.10.240.x/include/bcmsdbus.h
new file mode 100644 (file)
index 0000000..939b75d
--- /dev/null
@@ -0,0 +1,187 @@
+/*
+ * Definitions for API from sdio common code (bcmsdh) to individual
+ * host controller drivers.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _sdio_api_h_
+#define        _sdio_api_h_
+
+#if defined(BT_OVER_SDIO)
+#include <linux/mmc/sdio_func.h>
+#endif /* defined (BT_OVER_SDIO) */
+
+/*
+ * The following were:
+ *     incorrectly in bcmsdio.h
+ *     incorrectly named using SDIOH which indicates BRCM SDIO FPGA host controller
+ */
+
+#define SDIOH_API_RC_SUCCESS                          (0x00)
+#define SDIOH_API_RC_FAIL                            (0x01)
+#define SDIOH_API_SUCCESS(status) (status == 0)
+
+#define SDIOH_READ              0      /* Read request */
+#define SDIOH_WRITE             1      /* Write request */
+
+#define SDIOH_DATA_FIX          0      /* Fixed addressing */
+#define SDIOH_DATA_INC          1      /* Incremental addressing */
+
+#define SDIOH_CMD_TYPE_NORMAL   0       /* Normal command */
+#define SDIOH_CMD_TYPE_APPEND   1       /* Append command */
+#define SDIOH_CMD_TYPE_CUTTHRU  2       /* Cut-through command */
+
+#define SDIOH_DATA_PIO          0       /* PIO mode */
+#define SDIOH_DATA_DMA          1       /* DMA mode */
+
+/* Max number of glommed pkts */
+#ifdef CUSTOM_MAX_TXGLOM_SIZE
+#define SDPCM_MAXGLOM_SIZE  CUSTOM_MAX_TXGLOM_SIZE
+#else
+#define SDPCM_MAXGLOM_SIZE     36
+#endif /* CUSTOM_MAX_TXGLOM_SIZE */
+
+#define SDPCM_TXGLOM_CPY 0                     /* SDIO 2.0 should use copy mode */
+#define SDPCM_TXGLOM_MDESC     1               /* SDIO 3.0 should use multi-desc mode */
+
+#ifdef CUSTOM_DEF_TXGLOM_SIZE
+#define SDPCM_DEFGLOM_SIZE  CUSTOM_DEF_TXGLOM_SIZE
+#else
+#define SDPCM_DEFGLOM_SIZE SDPCM_MAXGLOM_SIZE
+#endif /* CUSTOM_DEF_TXGLOM_SIZE */
+
+#if SDPCM_DEFGLOM_SIZE > SDPCM_MAXGLOM_SIZE
+#warning "SDPCM_DEFGLOM_SIZE cannot be higher than SDPCM_MAXGLOM_SIZE!!"
+#undef SDPCM_DEFGLOM_SIZE
+#define SDPCM_DEFGLOM_SIZE SDPCM_MAXGLOM_SIZE
+#endif
+
+#ifdef PKT_STATICS
+typedef struct pkt_statics {
+       uint16  event_count;
+       uint32  event_size;
+       uint16  ctrl_count;
+       uint32  ctrl_size;
+       uint32  data_count;
+       uint32  data_size;
+       uint32  glom_cnt[SDPCM_MAXGLOM_SIZE];
+       uint16  glom_max;
+       uint16  glom_count;
+       uint32  glom_size;
+       uint16  test_count;
+       uint32  test_size;
+       uint32  glom_cnt_us[SDPCM_MAXGLOM_SIZE];
+} pkt_statics_t;
+#endif
+
+typedef int SDIOH_API_RC;
+
+/* SDio Host structure */
+typedef struct sdioh_info sdioh_info_t;
+
+/* callback function, taking one arg */
+typedef void (*sdioh_cb_fn_t)(void *);
+#if defined(BT_OVER_SDIO)
+extern
+void sdioh_sdmmc_card_enable_func_f3(sdioh_info_t *sd, struct sdio_func *func);
+#endif /* defined (BT_OVER_SDIO) */
+
+extern SDIOH_API_RC sdioh_interrupt_register(sdioh_info_t *si, sdioh_cb_fn_t fn, void *argh);
+extern SDIOH_API_RC sdioh_interrupt_deregister(sdioh_info_t *si);
+
+/* query whether SD interrupt is enabled or not */
+extern SDIOH_API_RC sdioh_interrupt_query(sdioh_info_t *si, bool *onoff);
+
+/* enable or disable SD interrupt */
+extern SDIOH_API_RC sdioh_interrupt_set(sdioh_info_t *si, bool enable_disable);
+
+#if defined(DHD_DEBUG)
+extern bool sdioh_interrupt_pending(sdioh_info_t *si);
+#endif
+
+/* read or write one byte using cmd52 */
+extern SDIOH_API_RC sdioh_request_byte(sdioh_info_t *si, uint rw, uint fnc, uint addr, uint8 *byte);
+
+/* read or write 2/4 bytes using cmd53 */
+extern SDIOH_API_RC sdioh_request_word(sdioh_info_t *si, uint cmd_type, uint rw, uint fnc,
+       uint addr, uint32 *word, uint nbyte);
+
+/* read or write any buffer using cmd53 */
+extern SDIOH_API_RC sdioh_request_buffer(sdioh_info_t *si, uint pio_dma, uint fix_inc,
+       uint rw, uint fnc_num, uint32 addr, uint regwidth, uint32 buflen, uint8 *buffer,
+       void *pkt);
+
+/* get cis data */
+extern SDIOH_API_RC sdioh_cis_read(sdioh_info_t *si, uint fuc, uint8 *cis, uint32 length);
+extern SDIOH_API_RC sdioh_cisaddr_read(sdioh_info_t *sd, uint func, uint8 *cisd, uint32 offset);
+
+extern SDIOH_API_RC sdioh_cfg_read(sdioh_info_t *si, uint fuc, uint32 addr, uint8 *data);
+extern SDIOH_API_RC sdioh_cfg_write(sdioh_info_t *si, uint fuc, uint32 addr, uint8 *data);
+
+/* query number of io functions */
+extern uint sdioh_query_iofnum(sdioh_info_t *si);
+
+/* handle iovars */
+extern int sdioh_iovar_op(sdioh_info_t *si, const char *name,
+                          void *params, int plen, void *arg, uint len, bool set);
+
+/* Issue abort to the specified function and clear controller as needed */
+extern int sdioh_abort(sdioh_info_t *si, uint fnc);
+
+/* Start and Stop SDIO without re-enumerating the SD card. */
+extern int sdioh_start(sdioh_info_t *si, int stage);
+extern int sdioh_stop(sdioh_info_t *si);
+
+/* Wait system lock free */
+extern int sdioh_waitlockfree(sdioh_info_t *si);
+
+/* Reset and re-initialize the device */
+extern int sdioh_sdio_reset(sdioh_info_t *si);
+
+#ifdef BCMSPI
+/* Function to pass gSPI specific device-status bits to dhd. */
+extern uint32 sdioh_get_dstatus(sdioh_info_t *si);
+
+/* chipid and chiprev info for lower layers to control sw WAR's for hw bugs. */
+extern void sdioh_chipinfo(sdioh_info_t *si, uint32 chip, uint32 chiprev);
+extern void sdioh_dwordmode(sdioh_info_t *si, bool set);
+#endif /* BCMSPI */
+
+#if defined(BCMSDIOH_STD)
+       /*
+        * Only STD host supports cmd14 sleep.
+        * Using define instead of empty stubs for other hosts for now.
+        */
+       #define SDIOH_SLEEP_ENABLED
+#endif
+extern SDIOH_API_RC sdioh_sleep(sdioh_info_t *si, bool enab);
+
+/* GPIO support */
+extern SDIOH_API_RC sdioh_gpio_init(sdioh_info_t *sd);
+extern bool sdioh_gpioin(sdioh_info_t *sd, uint32 gpio);
+extern SDIOH_API_RC sdioh_gpioouten(sdioh_info_t *sd, uint32 gpio);
+extern SDIOH_API_RC sdioh_gpioout(sdioh_info_t *sd, uint32 gpio, bool enab);
+extern uint sdioh_set_mode(sdioh_info_t *sd, uint mode);
+#ifdef PKT_STATICS
+extern uint32 sdioh_get_spend_time(sdioh_info_t *sd);
+#endif
+
+#endif /* _sdio_api_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmsdh.h b/bcmdhd.101.10.240.x/include/bcmsdh.h
new file mode 100644 (file)
index 0000000..c63e521
--- /dev/null
@@ -0,0 +1,280 @@
+/*
+ * SDIO host client driver interface of Broadcom HNBU
+ *     export functions to client drivers
+ *     abstract OS and BUS specific details of SDIO
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+/**
+ * @file bcmsdh.h
+ */
+
+#ifndef        _bcmsdh_h_
+#define        _bcmsdh_h_
+
+#define BCMSDH_ERROR_VAL       0x0001 /* Error */
+#define BCMSDH_INFO_VAL                0x0002 /* Info */
+extern const uint bcmsdh_msglevel;
+
+#define BCMSDH_ERROR(x) printf x
+#define BCMSDH_INFO(x)
+
+#if defined(BCMSDIO) && (defined(BCMSDIOH_STD) || defined(BCMSDIOH_BCM) || \
+       defined(BCMSDIOH_SPI))
+#define BCMSDH_ADAPTER
+#endif /* BCMSDIO && (BCMSDIOH_STD || BCMSDIOH_BCM || BCMSDIOH_SPI) */
+
+/* forward declarations */
+typedef struct bcmsdh_info bcmsdh_info_t;
+typedef void (*bcmsdh_cb_fn_t)(void *);
+
+#if defined(BT_OVER_SDIO)
+typedef enum {
+       NO_HANG_STATE           = 0,
+       HANG_START_STATE                = 1,
+       HANG_RECOVERY_STATE     = 2
+} dhd_hang_state_t;
+#endif
+
+extern bcmsdh_info_t *bcmsdh_attach(osl_t *osh, void *sdioh, ulong *regsva);
+/**
+ * BCMSDH API context
+ */
+struct bcmsdh_info
+{
+       bool    init_success;   /* underlying driver successfully attached */
+       void    *sdioh;         /* handler for sdioh */
+       uint32  vendevid;       /* Target Vendor and Device ID on SD bus */
+       osl_t   *osh;
+       bool    regfail;        /* Save status of last reg_read/reg_write call */
+       uint32  sbwad;          /* Save backplane window address */
+       void    *os_cxt;        /* Pointer to per-OS private data */
+       bool    force_sbwad_calc; /* forces calculation of sbwad instead of using cached value */
+#ifdef DHD_WAKE_STATUS
+       unsigned int    total_wake_count;
+       int             pkt_wake;
+#endif /* DHD_WAKE_STATUS */
+};
+
+/* Detach - freeup resources allocated in attach */
+extern int bcmsdh_detach(osl_t *osh, void *sdh);
+
+/* Query if SD device interrupts are enabled */
+extern bool bcmsdh_intr_query(void *sdh);
+
+/* Enable/disable SD interrupt */
+extern int bcmsdh_intr_enable(void *sdh);
+extern int bcmsdh_intr_disable(void *sdh);
+
+/* Register/deregister device interrupt handler. */
+extern int bcmsdh_intr_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh);
+extern int bcmsdh_intr_dereg(void *sdh);
+/* Enable/disable SD card interrupt forward */
+extern void bcmsdh_intr_forward(void *sdh, bool pass);
+
+#if defined(DHD_DEBUG)
+/* Query pending interrupt status from the host controller */
+extern bool bcmsdh_intr_pending(void *sdh);
+#endif
+
+/* Register a callback to be called if and when bcmsdh detects
+ * device removal. No-op in the case of non-removable/hardwired devices.
+ */
+extern int bcmsdh_devremove_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh);
+
+/* Access SDIO address space (e.g. CCCR) using CMD52 (single-byte interface).
+ *   fn:   function number
+ *   addr: unmodified SDIO-space address
+ *   data: data byte to write
+ *   err:  pointer to error code (or NULL)
+ */
+extern uint8 bcmsdh_cfg_read(void *sdh, uint func, uint32 addr, int *err);
+extern void bcmsdh_cfg_write(void *sdh, uint func, uint32 addr, uint8 data, int *err);
+
+/* Read/Write 4bytes from/to cfg space */
+extern uint32 bcmsdh_cfg_read_word(void *sdh, uint fnc_num, uint32 addr, int *err);
+extern void bcmsdh_cfg_write_word(void *sdh, uint fnc_num, uint32 addr, uint32 data, int *err);
+
+/* Read CIS content for specified function.
+ *   fn:     function whose CIS is being requested (0 is common CIS)
+ *   cis:    pointer to memory location to place results
+ *   length: number of bytes to read
+ * Internally, this routine uses the values from the cis base regs (0x9-0xB)
+ * to form an SDIO-space address to read the data from.
+ */
+extern int bcmsdh_cis_read(void *sdh, uint func, uint8 *cis, uint length);
+extern int bcmsdh_cisaddr_read(void *sdh, uint func, uint8 *cisd, uint offset);
+
+/* Synchronous access to device (client) core registers via CMD53 to F1.
+ *   addr: backplane address (i.e. >= regsva from attach)
+ *   size: register width in bytes (2 or 4)
+ *   data: data for register write
+ */
+extern uint32 bcmsdh_reg_read(void *sdh, uintptr addr, uint size);
+extern uint32 bcmsdh_reg_write(void *sdh, uintptr addr, uint size, uint32 data);
+
+/* set sb address window */
+extern int bcmsdhsdio_set_sbaddr_window(void *sdh, uint32 address, bool force_set);
+
+/* Indicate if last reg read/write failed */
+/* Replace this with status pointers in reg_read/write */
+extern bool bcmsdh_regfail(void *sdh);
+
+/* Buffer transfer to/from device (client) core via cmd53.
+ *   fn:       function number
+ *   addr:     backplane address (i.e. >= regsva from attach)
+ *   flags:    backplane width, address increment, sync/async
+ *   buf:      pointer to memory data buffer
+ *   nbytes:   number of bytes to transfer to/from buf
+ *   pkt:      pointer to packet associated with buf (if any)
+ *   complete: callback function for command completion (async only)
+ *   handle:   handle for completion callback (first arg in callback)
+ * Returns 0 or error code.
+ * NOTE: Async operation is not currently supported.
+ */
+
+typedef void (*bcmsdh_cmplt_fn_t)(void *handle, int status, bool sync_waiting);
+extern int bcmsdh_send_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                           uint8 *buf, uint nbytes, void *pkt,
+                           bcmsdh_cmplt_fn_t complete_fn, void *handle);
+extern int bcmsdh_recv_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                           uint8 *buf, uint nbytes, void *pkt,
+                           bcmsdh_cmplt_fn_t complete_fn, void *handle);
+
+extern void bcmsdh_glom_post(void *sdh, uint8 *frame, void *pkt, uint len);
+extern void bcmsdh_glom_clear(void *sdh);
+extern uint bcmsdh_set_mode(void *sdh, uint mode);
+extern bool bcmsdh_glom_enabled(void);
+#ifdef PKT_STATICS
+extern uint32 bcmsdh_get_spend_time(void *sdh) ;
+#endif
+/* Flags bits */
+#define SDIO_REQ_4BYTE 0x1     /* Four-byte target (backplane) width (vs. two-byte) */
+#define SDIO_REQ_FIXED 0x2     /* Fixed address (FIFO) (vs. incrementing address) */
+#define SDIO_REQ_ASYNC 0x4     /* Async request (vs. sync request) */
+#define SDIO_BYTE_MODE 0x8     /* Byte mode request(non-block mode) */
+
+/* Pending (non-error) return code */
+#define BCME_PENDING   1
+
+/* Read/write to memory block (F1, no FIFO) via CMD53 (sync only).
+ *   rw:       read or write (0/1)
+ *   addr:     direct SDIO address
+ *   buf:      pointer to memory data buffer
+ *   nbytes:   number of bytes to transfer to/from buf
+ * Returns 0 or error code.
+ */
+extern int bcmsdh_rwdata(void *sdh, uint rw, uint32 addr, uint8 *buf, uint nbytes);
+
+/* Issue an abort to the specified function */
+extern int bcmsdh_abort(void *sdh, uint fn);
+
+/* Start SDIO Host Controller communication */
+extern int bcmsdh_start(void *sdh, int stage);
+
+/* Stop SDIO Host Controller communication */
+extern int bcmsdh_stop(void *sdh);
+
+/* Wait system lock free */
+extern int bcmsdh_waitlockfree(void *sdh);
+
+/* Bogosity alert. This should only know about devids gleaned through
+ * the standard CIS (versus some client dependent method), and we already
+ * have an interface for the CIS.
+ * Remove me.
+ */
+/* Returns the "Device ID" of target device on the SDIO bus. */
+extern int bcmsdh_query_device(void *sdh);
+
+/* Returns the number of IO functions reported by the device */
+extern uint bcmsdh_query_iofnum(void *sdh);
+
+/* Miscellaneous knob tweaker. */
+extern int bcmsdh_iovar_op(void *sdh, const char *name,
+                           void *params, uint plen, void *arg, uint len, bool set);
+
+/* Reset and reinitialize the device */
+extern int bcmsdh_reset(bcmsdh_info_t *sdh);
+
+/* helper functions */
+
+/* callback functions */
+typedef struct {
+       /* probe the device */
+       void *(*probe)(uint16 vend_id, uint16 dev_id, uint16 bus, uint16 slot,
+                       uint16 func, uint bustype, void * regsva, osl_t * osh,
+                       void * param);
+       /* remove the device */
+       void (*remove)(void *context);
+       /* can we suspend now */
+       int (*suspend)(void *context);
+       /* resume from suspend */
+       int (*resume)(void *context);
+} bcmsdh_driver_t;
+
+/* platform specific/high level functions */
+extern int bcmsdh_register(bcmsdh_driver_t *driver);
+extern void bcmsdh_unregister(void);
+extern bool bcmsdh_chipmatch(uint16 vendor, uint16 device);
+extern void bcmsdh_device_remove(void * sdh);
+
+extern int bcmsdh_reg_sdio_notify(void* semaphore);
+extern void bcmsdh_unreg_sdio_notify(void);
+
+#if defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID)
+extern int bcmsdh_oob_intr_register(bcmsdh_info_t *bcmsdh, bcmsdh_cb_fn_t oob_irq_handler,
+       void* oob_irq_handler_context);
+extern void bcmsdh_oob_intr_unregister(bcmsdh_info_t *sdh);
+extern void bcmsdh_oob_intr_set(bcmsdh_info_t *sdh, bool enable);
+extern int bcmsdh_get_oob_intr_num(bcmsdh_info_t *bcmsdh);
+#endif /* defined(OOB_INTR_ONLY) || defined(BCMSPI_ANDROID) */
+extern void bcmsdh_dev_pm_stay_awake(bcmsdh_info_t *sdh);
+extern void bcmsdh_dev_relax(bcmsdh_info_t *sdh);
+extern bool bcmsdh_dev_pm_enabled(bcmsdh_info_t *sdh);
+
+int bcmsdh_suspend(bcmsdh_info_t *bcmsdh);
+int bcmsdh_resume(bcmsdh_info_t *bcmsdh);
+
+/* Function to pass device-status bits to DHD. */
+extern uint32 bcmsdh_get_dstatus(void *sdh);
+
+/* Function to return current window addr */
+extern uint32 bcmsdh_cur_sbwad(void *sdh);
+
+/* function to force sbwad calculation instead of using cached value */
+extern void bcmsdh_force_sbwad_calc(void *sdh, bool force);
+
+/* Function to pass chipid and rev to lower layers for controlling pr's */
+extern void bcmsdh_chipinfo(void *sdh, uint32 chip, uint32 chiprev);
+
+#ifdef BCMSPI
+extern void bcmsdh_dwordmode(void *sdh, bool set);
+#endif /* BCMSPI */
+
+extern int bcmsdh_sleep(void *sdh, bool enab);
+
+/* GPIO support */
+extern int bcmsdh_gpio_init(void *sd);
+extern bool bcmsdh_gpioin(void *sd, uint32 gpio);
+extern int bcmsdh_gpioouten(void *sd, uint32 gpio);
+extern int bcmsdh_gpioout(void *sd, uint32 gpio, bool enab);
+
+#endif /* _bcmsdh_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmsdh_sdmmc.h b/bcmdhd.101.10.240.x/include/bcmsdh_sdmmc.h
new file mode 100644 (file)
index 0000000..cdb94af
--- /dev/null
@@ -0,0 +1,123 @@
+/*
+ * BCMSDH Function Driver for the native SDIO/MMC driver in the Linux Kernel
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef __BCMSDH_SDMMC_H__
+#define __BCMSDH_SDMMC_H__
+
+#define sd_err(x)      do { if (sd_msglevel & SDH_ERROR_VAL) printf x; } while (0)
+#define sd_trace(x)    do { if (sd_msglevel & SDH_TRACE_VAL) printf x; } while (0)
+#define sd_info(x)     do { if (sd_msglevel & SDH_INFO_VAL) printf x; } while (0)
+#define sd_debug(x)    do { if (sd_msglevel & SDH_DEBUG_VAL) printf x; } while (0)
+#define sd_data(x)     do { if (sd_msglevel & SDH_DATA_VAL) printf x; } while (0)
+#define sd_ctrl(x)     do { if (sd_msglevel & SDH_CTRL_VAL) printf x; } while (0)
+#define sd_cost(x)     do { if (sd_msglevel & SDH_COST_VAL) printf x; } while (0)
+
+#define sd_sync_dma(sd, read, nbytes)
+#define sd_init_dma(sd)
+#define sd_ack_intr(sd)
+#define sd_wakeup(sd);
+
+#define sd_log(x)
+
+#define SDIOH_ASSERT(exp) \
+       do { if (!(exp)) \
+               printf("!!!ASSERT fail: file %s lines %d", __FILE__, __LINE__); \
+       } while (0)
+
+#define BLOCK_SIZE_4318 64
+#define BLOCK_SIZE_4328 512
+
+/* internal return code */
+#define SUCCESS        0
+#define ERROR  1
+
+/* private bus modes */
+#define SDIOH_MODE_SD4         2
+#define CLIENT_INTR                    0x100   /* Get rid of this! */
+#define SDIOH_SDMMC_MAX_SG_ENTRIES     64
+
+struct sdioh_info {
+       osl_t           *osh;                   /* osh handler */
+       void            *bcmsdh;                /* upper layer handle */
+       bool            client_intr_enabled;    /* interrupt connnected flag */
+       bool            intr_handler_valid;     /* client driver interrupt handler valid */
+       sdioh_cb_fn_t   intr_handler;           /* registered interrupt handler */
+       void            *intr_handler_arg;      /* argument to call interrupt handler */
+       uint16          intmask;                /* Current active interrupts */
+
+       int             intrcount;              /* Client interrupts */
+       bool            sd_use_dma;             /* DMA on CMD53 */
+       bool            sd_blockmode;           /* sd_blockmode == FALSE => 64 Byte Cmd 53s. */
+                                               /*  Must be on for sd_multiblock to be effective */
+       bool            use_client_ints;        /* If this is false, make sure to restore */
+       int             sd_mode;                /* SD1/SD4/SPI */
+       int             client_block_size[SDIOD_MAX_IOFUNCS];           /* Blocksize */
+       uint8           num_funcs;              /* Supported funcs on client */
+       uint32          com_cis_ptr;
+       uint32          func_cis_ptr[SDIOD_MAX_IOFUNCS];
+       bool            use_rxchain;
+       struct scatterlist      sg_list[SDIOH_SDMMC_MAX_SG_ENTRIES];
+       struct sdio_func        fake_func0;
+       struct sdio_func        *func[SDIOD_MAX_IOFUNCS];
+       uint            sd_clk_rate;
+       uint    txglom_mode;            /* Txglom mode: 0 - copy, 1 - multi-descriptor */
+       uint32  sdio_spent_time_us;
+};
+
+/************************************************************
+ * Internal interfaces: per-port references into bcmsdh_sdmmc.c
+ */
+
+/* Global message bits */
+extern uint sd_msglevel;
+
+/* OS-independent interrupt handler */
+extern bool check_client_intr(sdioh_info_t *sd);
+
+/* Core interrupt enable/disable of device interrupts */
+extern void sdioh_sdmmc_devintr_on(sdioh_info_t *sd);
+extern void sdioh_sdmmc_devintr_off(sdioh_info_t *sd);
+
+/**************************************************************
+ * Internal interfaces: bcmsdh_sdmmc.c references to per-port code
+ */
+
+/* Register mapping routines */
+extern uint32 *sdioh_sdmmc_reg_map(osl_t *osh, int32 addr, int size);
+extern void sdioh_sdmmc_reg_unmap(osl_t *osh, int32 addr, int size);
+
+/* Interrupt (de)registration routines */
+extern int sdioh_sdmmc_register_irq(sdioh_info_t *sd, uint irq);
+extern void sdioh_sdmmc_free_irq(uint irq, sdioh_info_t *sd);
+
+extern sdioh_info_t *sdioh_attach(osl_t *osh, struct sdio_func *func);
+extern SDIOH_API_RC sdioh_detach(osl_t *osh, sdioh_info_t *sd);
+
+#ifdef GLOBAL_SDMMC_INSTANCE
+typedef struct _BCMSDH_SDMMC_INSTANCE {
+       sdioh_info_t    *sd;
+       struct sdio_func *func[SDIOD_MAX_IOFUNCS];
+} BCMSDH_SDMMC_INSTANCE, *PBCMSDH_SDMMC_INSTANCE;
+#endif
+
+#endif /* __BCMSDH_SDMMC_H__ */
diff --git a/bcmdhd.101.10.240.x/include/bcmsdpcm.h b/bcmdhd.101.10.240.x/include/bcmsdpcm.h
new file mode 100644 (file)
index 0000000..b798b1e
--- /dev/null
@@ -0,0 +1,300 @@
+/*
+ * Broadcom SDIO/PCMCIA
+ * Software-specific definitions shared between device and host side
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _bcmsdpcm_h_
+#define        _bcmsdpcm_h_
+
+/*
+ * Software allocation of To SB Mailbox resources
+ */
+
+/* intstatus bits */
+#define I_SMB_NAK      I_SMB_SW0       /* To SB Mailbox Frame NAK */
+#define I_SMB_INT_ACK  I_SMB_SW1       /* To SB Mailbox Host Interrupt ACK */
+#define I_SMB_USE_OOB  I_SMB_SW2       /* To SB Mailbox Use OOB Wakeup */
+#define I_SMB_DEV_INT  I_SMB_SW3       /* To SB Mailbox Miscellaneous Interrupt */
+
+#define I_TOSBMAIL      (I_SMB_NAK | I_SMB_INT_ACK | I_SMB_USE_OOB | I_SMB_DEV_INT)
+
+/* tosbmailbox bits corresponding to intstatus bits */
+#define SMB_NAK                (1 << 0)        /* To SB Mailbox Frame NAK */
+#define SMB_INT_ACK    (1 << 1)        /* To SB Mailbox Host Interrupt ACK */
+#define SMB_USE_OOB    (1 << 2)        /* To SB Mailbox Use OOB Wakeup */
+#define SMB_DEV_INT    (1 << 3)        /* To SB Mailbox Miscellaneous Interrupt */
+#define SMB_MASK       0x0000000f      /* To SB Mailbox Mask */
+
+/* tosbmailboxdata */
+
+#ifdef DS_PROT
+/* Bit msgs for custom deep sleep protocol */
+#define SMB_DATA_D3INFORM      0x100   /* host announcing D3 entry */
+#define SMB_DATA_DSACK         0x200   /* host acking a deepsleep request */
+#define SMB_DATA_DSNACK                0x400   /* host nacking a deepsleep request */
+#endif /* DS_PROT */
+/* force a trap */
+#define SMB_DATA_TRAP          0x800   /* host forcing trap */
+
+#define SMB_DATA_VERSION_MASK  0x00ff0000      /* host protocol version (sent with F2 enable) */
+#define SMB_DATA_VERSION_SHIFT 16              /* host protocol version (sent with F2 enable) */
+
+/*
+ * Software allocation of To Host Mailbox resources
+ */
+
+/* intstatus bits */
+#define I_HMB_INT_ACK  I_HMB_SW0       /* To Host Mailbox Dev Interrupt ACK */
+#define I_HMB_FC_STATE I_HMB_SW0       /* To Host Mailbox Flow Control State */
+#define I_HMB_FC_CHANGE        I_HMB_SW1       /* To Host Mailbox Flow Control State Changed */
+#define I_HMB_FRAME_IND        I_HMB_SW2       /* To Host Mailbox Frame Indication */
+#define I_HMB_HOST_INT I_HMB_SW3       /* To Host Mailbox Miscellaneous Interrupt */
+
+#define I_TOHOSTMAIL    (I_HMB_INT_ACK | I_HMB_FRAME_IND | I_HMB_HOST_INT)
+
+/* tohostmailbox bits corresponding to intstatus bits */
+#define HMB_INT_ACK    (1 << 0)        /* To Host Mailbox Dev Interrupt ACK */
+#define HMB_FRAME_IND  (1 << 2)        /* To Host Mailbox Frame Indication */
+#define HMB_HOST_INT   (1 << 3)        /* To Host Mailbox Miscellaneous Interrupt */
+#define HMB_MASK       0x0000000f      /* To Host Mailbox Mask */
+
+/* tohostmailboxdata */
+#define HMB_DATA_NAKHANDLED    0x01    /* we're ready to retransmit NAK'd frame to host */
+#define HMB_DATA_DEVREADY      0x02    /* we're ready to to talk to host after enable */
+#define HMB_DATA_FC            0x04    /* per prio flowcontrol update flag to host */
+#define HMB_DATA_FWREADY       0x08    /* firmware is ready for protocol activity */
+#define HMB_DATA_FWHALT                0x10    /* firmware has halted operation */
+
+#ifdef DS_PROT
+/* Bit msgs for custom deep sleep protocol */
+#define HMB_DATA_DSREQ         0x100   /* firmware requesting deepsleep entry */
+#define HMB_DATA_DSEXIT                0x200   /* firmware announcing deepsleep exit */
+#define HMB_DATA_D3ACK         0x400   /* firmware acking a D3 notice from host */
+#define HMB_DATA_D3EXIT                0x800   /* firmware announcing D3 exit */
+#define HMB_DATA_DSPROT_MASK   0xf00
+#endif /* DS_PROT */
+
+#define HMB_DATA_FCDATA_MASK   0xff000000      /* per prio flowcontrol data */
+#define HMB_DATA_FCDATA_SHIFT  24              /* per prio flowcontrol data */
+
+#define HMB_DATA_VERSION_MASK  0x00ff0000      /* device protocol version (with devready) */
+#define HMB_DATA_VERSION_SHIFT 16              /* device protocol version (with devready) */
+
+/*
+ * Software-defined protocol header
+ */
+/* Replace all this with packed struct */
+
+/* Current protocol version */
+#define SDPCM_PROT_VERSION     4
+
+/* SW frame header */
+#define SDPCM_SEQUENCE_MASK            0x000000ff      /* Sequence Number Mask */
+#define SDPCM_PACKET_SEQUENCE(p) (((uint8 *)p)[0] & 0xff) /* p starts w/SW Header */
+
+#define SDPCM_CHANNEL_MASK             0x00000f00      /* Channel Number Mask */
+#define SDPCM_CHANNEL_SHIFT            8               /* Channel Number Shift */
+#define SDPCM_PACKET_CHANNEL(p) (((uint8 *)p)[1] & 0x0f) /* p starts w/SW Header */
+
+#define SDPCM_FLAGS_MASK               0x0000f000      /* Mask of flag bits */
+#define SDPCM_FLAGS_SHIFT              12              /* Flag bits shift */
+#define SDPCM_PACKET_FLAGS(p) ((((uint8 *)p)[1] & 0xf0) >> 4) /* p starts w/SW Header */
+
+/* Next Read Len: lookahead length of next frame, in 16-byte units (rounded up) */
+#define SDPCM_NEXTLEN_MASK             0x00ff0000      /* Next Read Len Mask */
+#define SDPCM_NEXTLEN_SHIFT            16              /* Next Read Len Shift */
+#define SDPCM_NEXTLEN_VALUE(p) ((((uint8 *)p)[2] & 0xff) << 4) /* p starts w/SW Header */
+#define SDPCM_NEXTLEN_OFFSET           2
+
+/* Data Offset from SOF (HW Tag, SW Tag, Pad) */
+#define SDPCM_DOFFSET_OFFSET           3               /* Data Offset */
+#define SDPCM_DOFFSET_VALUE(p)         (((uint8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
+#define SDPCM_DOFFSET_MASK             0xff000000
+#define SDPCM_DOFFSET_SHIFT            24
+
+#define SDPCM_FCMASK_OFFSET            4               /* Flow control */
+#define SDPCM_FCMASK_VALUE(p)          (((uint8 *)p)[SDPCM_FCMASK_OFFSET ] & 0xff)
+#define SDPCM_WINDOW_OFFSET            5               /* Credit based fc */
+#define SDPCM_WINDOW_VALUE(p)          (((uint8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
+#define SDPCM_VERSION_OFFSET           6               /* Version # */
+#define SDPCM_VERSION_VALUE(p)         (((uint8 *)p)[SDPCM_VERSION_OFFSET] & 0xff)
+#define SDPCM_UNUSED_OFFSET            7               /* Spare */
+#define SDPCM_UNUSED_VALUE(p)          (((uint8 *)p)[SDPCM_UNUSED_OFFSET] & 0xff)
+
+#define SDPCM_SWHEADER_LEN     8       /* SW header is 64 bits */
+
+/* logical channel numbers */
+#define SDPCM_CONTROL_CHANNEL  0       /* Control Request/Response Channel Id */
+#define SDPCM_EVENT_CHANNEL    1       /* Asyc Event Indication Channel Id */
+#define SDPCM_DATA_CHANNEL     2       /* Data Xmit/Recv Channel Id */
+#define SDPCM_GLOM_CHANNEL     3       /* For coalesced packets (superframes) */
+#define SDPCM_TEST_CHANNEL     15      /* Reserved for test/debug packets */
+#define SDPCM_MAX_CHANNEL      15
+
+#define SDPCM_SEQUENCE_WRAP    256     /* wrap-around val for eight-bit frame seq number */
+
+#define SDPCM_FLAG_RESVD0      0x01
+#define SDPCM_FLAG_RESVD1      0x02
+#define SDPCM_FLAG_GSPI_TXENAB 0x04    /* GSPI Tx enable (PR55150 only) */
+#define SDPCM_FLAG_GLOMDESC    0x08    /* Superframe descriptor mask */
+
+/* For GLOM_CHANNEL frames, use a flag to indicate descriptor frame */
+#define SDPCM_GLOMDESC_FLAG    (SDPCM_FLAG_GLOMDESC << SDPCM_FLAGS_SHIFT)
+
+#define SDPCM_GLOMDESC(p)      (((uint8 *)p)[1] & 0x80)
+
+/* For TEST_CHANNEL packets, define another 4-byte header */
+#define SDPCM_TEST_HDRLEN              4       /* Generally: Cmd(1), Ext(1), Len(2);
+                                                * Semantics of Ext byte depend on command.
+                                                * Len is current or requested frame length, not
+                                                * including test header; sent little-endian.
+                                                */
+#define SDPCM_TEST_PKT_CNT_FLD_LEN     4       /* Packet count filed legth */
+#define SDPCM_TEST_DISCARD             0x01    /* Receiver discards. Ext is a pattern id. */
+#define SDPCM_TEST_ECHOREQ             0x02    /* Echo request. Ext is a pattern id. */
+#define SDPCM_TEST_ECHORSP             0x03    /* Echo response. Ext is a pattern id. */
+#define SDPCM_TEST_BURST               0x04    /* Receiver to send a burst. Ext is a frame count
+                                                * (Backward compatabilty) Set frame count in a
+                                                * 4 byte filed adjacent to the HDR
+                                                */
+#define SDPCM_TEST_SEND                        0x05    /* Receiver sets send mode. Ext is boolean on/off
+                                                * Set frame count in a 4 byte filed adjacent to
+                                                * the HDR
+                                                */
+
+/* Handy macro for filling in datagen packets with a pattern */
+#define SDPCM_TEST_FILL(byteno, id)    ((uint8)(id + byteno))
+
+/*
+ * Software counters (first part matches hardware counters)
+ */
+
+typedef volatile struct {
+       uint32 cmd52rd;         /* Cmd52RdCount, SDIO: cmd52 reads */
+       uint32 cmd52wr;         /* Cmd52WrCount, SDIO: cmd52 writes */
+       uint32 cmd53rd;         /* Cmd53RdCount, SDIO: cmd53 reads */
+       uint32 cmd53wr;         /* Cmd53WrCount, SDIO: cmd53 writes */
+       uint32 abort;           /* AbortCount, SDIO: aborts */
+       uint32 datacrcerror;    /* DataCrcErrorCount, SDIO: frames w/CRC error */
+       uint32 rdoutofsync;     /* RdOutOfSyncCount, SDIO/PCMCIA: Rd Frm out of sync */
+       uint32 wroutofsync;     /* RdOutOfSyncCount, SDIO/PCMCIA: Wr Frm out of sync */
+       uint32 writebusy;       /* WriteBusyCount, SDIO: device asserted "busy" */
+       uint32 readwait;        /* ReadWaitCount, SDIO: no data ready for a read cmd */
+       uint32 readterm;        /* ReadTermCount, SDIO: read frame termination cmds */
+       uint32 writeterm;       /* WriteTermCount, SDIO: write frames termination cmds */
+       uint32 rxdescuflo;      /* receive descriptor underflows */
+       uint32 rxfifooflo;      /* receive fifo overflows */
+       uint32 txfifouflo;      /* transmit fifo underflows */
+       uint32 runt;            /* runt (too short) frames recv'd from bus */
+       uint32 badlen;          /* frame's rxh len does not match its hw tag len */
+       uint32 badcksum;        /* frame's hw tag chksum doesn't agree with len value */
+       uint32 seqbreak;        /* break in sequence # space from one rx frame to the next */
+       uint32 rxfcrc;          /* frame rx header indicates crc error */
+       uint32 rxfwoos;         /* frame rx header indicates write out of sync */
+       uint32 rxfwft;          /* frame rx header indicates write frame termination */
+       uint32 rxfabort;        /* frame rx header indicates frame aborted */
+       uint32 woosint;         /* write out of sync interrupt */
+       uint32 roosint;         /* read out of sync interrupt */
+       uint32 rftermint;       /* read frame terminate interrupt */
+       uint32 wftermint;       /* write frame terminate interrupt */
+} sdpcmd_cnt_t;
+
+/*
+ * Register Access Macros
+ */
+
+#define SDIODREV_IS(var, val)  ((var) == (val))
+#define SDIODREV_GE(var, val)  ((var) >= (val))
+#define SDIODREV_GT(var, val)  ((var) > (val))
+#define SDIODREV_LT(var, val)  ((var) < (val))
+#define SDIODREV_LE(var, val)  ((var) <= (val))
+
+#define SDIODDMAREG32(h, dir, chnl) \
+       ((dir) == DMA_TX ? \
+        (void *)(uintptr)&((h)->regs->dma.sdiod32.dma32regs[chnl].xmt) : \
+        (void *)(uintptr)&((h)->regs->dma.sdiod32.dma32regs[chnl].rcv))
+
+#define SDIODDMAREG64(h, dir, chnl) \
+       ((dir) == DMA_TX ? \
+        (void *)(uintptr)&((h)->regs->dma.sdiod64.dma64regs[chnl].xmt) : \
+        (void *)(uintptr)&((h)->regs->dma.sdiod64.dma64regs[chnl].rcv))
+
+#define SDIODDMAREG(h, dir, chnl) \
+       (SDIODREV_LT((h)->corerev, 1) ? \
+        SDIODDMAREG32((h), (dir), (chnl)) : \
+        SDIODDMAREG64((h), (dir), (chnl)))
+
+#define PCMDDMAREG(h, dir, chnl) \
+       ((dir) == DMA_TX ? \
+        (void *)(uintptr)&((h)->regs->dma.pcm32.dmaregs.xmt) : \
+        (void *)(uintptr)&((h)->regs->dma.pcm32.dmaregs.rcv))
+
+#define SDPCMDMAREG(h, dir, chnl, coreid) \
+       ((coreid) == SDIOD_CORE_ID ? \
+        SDIODDMAREG(h, dir, chnl) : \
+        PCMDDMAREG(h, dir, chnl))
+
+#define SDIODFIFOREG(h, corerev) \
+       (SDIODREV_LT((corerev), 1) ? \
+        ((dma32diag_t *)(uintptr)&((h)->regs->dma.sdiod32.dmafifo)) : \
+        ((dma32diag_t *)(uintptr)&((h)->regs->dma.sdiod64.dmafifo)))
+
+#define PCMDFIFOREG(h) \
+       ((dma32diag_t *)(uintptr)&((h)->regs->dma.pcm32.dmafifo))
+
+#define SDPCMFIFOREG(h, coreid, corerev) \
+       ((coreid) == SDIOD_CORE_ID ? \
+        SDIODFIFOREG(h, corerev) : \
+        PCMDFIFOREG(h))
+
+/*
+ * Shared structure between dongle and the host.
+ * The structure contains pointers to trap or assert information.
+ */
+#define SDPCM_SHARED_VERSION       0x0001
+#define SDPCM_SHARED_VERSION_MASK  0x00FF
+#define SDPCM_SHARED_ASSERT_BUILT  0x0100
+#define SDPCM_SHARED_ASSERT        0x0200
+#define SDPCM_SHARED_TRAP          0x0400
+#define SDPCM_SHARED_IN_BRPT       0x0800
+#define SDPCM_SHARED_SET_BRPT      0x1000
+#define SDPCM_SHARED_PENDING_BRPT  0x2000
+#define SDPCM_SHARED_FATAL_LOGBUF_VALID        0x100000
+#define SDPCM_SHARED_RXLIM_POST    0x4000
+
+typedef struct {
+       uint32  flags;
+       uint32  trap_addr;
+       uint32  assert_exp_addr;
+       uint32  assert_file_addr;
+       uint32  assert_line;
+       uint32  console_addr;           /* Address of hnd_cons_t */
+       uint32  msgtrace_addr;
+       uint32  fwid;
+       uint32  device_fatal_logbuf_start;
+} sdpcm_shared_t;
+
+/* Device F/W provides the following access function:
+ * sdpcm_shared_t *hnd_get_sdpcm_shared(void);
+ */
+
+#endif /* _bcmsdpcm_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmstdlib_s.h b/bcmdhd.101.10.240.x/include/bcmstdlib_s.h
new file mode 100644 (file)
index 0000000..933f983
--- /dev/null
@@ -0,0 +1,39 @@
+/*
+ * Broadcom Secure Standard Library.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _bcmstdlib_s_h_
+#define        _bcmstdlib_s_h_
+
+#ifndef BWL_NO_INTERNAL_STDLIB_S_SUPPORT
+#if !defined(__STDC_WANT_SECURE_LIB__) && !(defined(__STDC_LIB_EXT1__) && \
+       defined(__STDC_WANT_LIB_EXT1__))
+extern int memmove_s(void *dest, size_t destsz, const void *src, size_t n);
+extern int memcpy_s(void *dest, size_t destsz, const void *src, size_t n);
+extern int memset_s(void *dest, size_t destsz, int c, size_t n);
+#endif /* !__STDC_WANT_SECURE_LIB__ && !(__STDC_LIB_EXT1__ && __STDC_WANT_LIB_EXT1__) */
+#if !defined(FREEBSD) && !defined(MACOSX) && !defined(BCM_USE_PLATFORM_STRLCPY)
+extern size_t strlcpy(char *dest, const char *src, size_t size);
+#endif /* !defined(FREEBSD) && !defined(MACOSX) && !defined(BCM_USE_PLATFORM_STRLCPY) */
+extern size_t strlcat_s(char *dest, const char *src, size_t size);
+#endif /* !BWL_NO_INTERNAL_STDLIB_S_SUPPORT */
+#endif /* _bcmstdlib_s_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmtcp.h b/bcmdhd.101.10.240.x/include/bcmtcp.h
new file mode 100644 (file)
index 0000000..3e580a2
--- /dev/null
@@ -0,0 +1,86 @@
+/*
+ * Fundamental constants relating to TCP Protocol
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _bcmtcp_h_
+#define _bcmtcp_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#define TCP_SRC_PORT_OFFSET    0       /* TCP source port offset */
+#define TCP_DEST_PORT_OFFSET   2       /* TCP dest port offset */
+#define TCP_SEQ_NUM_OFFSET     4       /* TCP sequence number offset */
+#define TCP_ACK_NUM_OFFSET     8       /* TCP acknowledgement number offset */
+#define TCP_HLEN_OFFSET                12      /* HLEN and reserved bits offset */
+#define TCP_FLAGS_OFFSET       13      /* FLAGS and reserved bits offset */
+#define TCP_CHKSUM_OFFSET      16      /* TCP body checksum offset */
+
+#define TCP_PORT_LEN           2       /* TCP port field length */
+
+/* 8bit TCP flag field */
+#define TCP_FLAG_URG            0x20
+#define TCP_FLAG_ACK            0x10
+#define TCP_FLAG_PSH            0x08
+#define TCP_FLAG_RST            0x04
+#define TCP_FLAG_SYN            0x02
+#define TCP_FLAG_FIN            0x01
+
+#define TCP_HLEN_MASK           0xf000
+#define TCP_HLEN_SHIFT          12
+
+/* These fields are stored in network order */
+BWL_PRE_PACKED_STRUCT struct bcmtcp_hdr
+{
+       uint16  src_port;       /* Source Port Address */
+       uint16  dst_port;       /* Destination Port Address */
+       uint32  seq_num;        /* TCP Sequence Number */
+       uint32  ack_num;        /* TCP Sequence Number */
+       uint16  hdrlen_rsvd_flags;      /* Header length, reserved bits and flags */
+       uint16  tcpwin;         /* TCP window */
+       uint16  chksum;         /* Segment checksum with pseudoheader */
+       uint16  urg_ptr;        /* Points to seq-num of byte following urg data */
+} BWL_POST_PACKED_STRUCT;
+
+#define TCP_MIN_HEADER_LEN 20
+
+#define TCP_HDRLEN_MASK 0xf0
+#define TCP_HDRLEN_SHIFT 4
+#define TCP_HDRLEN(hdrlen) (((hdrlen) & TCP_HDRLEN_MASK) >> TCP_HDRLEN_SHIFT)
+
+#define TCP_FLAGS_MASK  0x1f
+#define TCP_FLAGS(hdrlen) ((hdrlen) & TCP_FLAGS_MASK)
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+/* To address round up by 32bit. */
+#define IS_TCPSEQ_GE(a, b) ((a - b) < NBITVAL(31))             /* a >= b */
+#define IS_TCPSEQ_LE(a, b) ((b - a) < NBITVAL(31))             /* a =< b */
+#define IS_TCPSEQ_GT(a, b) !IS_TCPSEQ_LE(a, b)         /* a > b */
+#define IS_TCPSEQ_LT(a, b) !IS_TCPSEQ_GE(a, b)         /* a < b */
+
+#endif /* #ifndef _bcmtcp_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmtlv.h b/bcmdhd.101.10.240.x/include/bcmtlv.h
new file mode 100644 (file)
index 0000000..78710b6
--- /dev/null
@@ -0,0 +1,375 @@
+/*
+ * TLV and XTLV support
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _bcmtlv_h_
+#define        _bcmtlv_h_
+
+#include <typedefs.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+/* begin tlvs - used in 802.11 IEs etc. */
+
+/* type(aka id)/length/value buffer triple */
+typedef struct bcm_tlv {
+       uint8   id;
+       uint8   len;
+       uint8   data[1];
+} bcm_tlv_t;
+
+/* size of tlv including data */
+#define BCM_TLV_SIZE(_tlv) ((_tlv) ? (OFFSETOF(bcm_tlv_t, data) + (_tlv)->len) : 0u)
+
+/* get next tlv - no length checks */
+#define BCM_TLV_NEXT(_tlv) (bcm_tlv_t *)((uint8 *)(_tlv)+ BCM_TLV_SIZE(_tlv))
+
+/* tlv length is restricted to 1 byte */
+#define BCM_TLV_MAX_DATA_SIZE (255)
+
+/* tlv header - two bytes */
+#define BCM_TLV_HDR_SIZE (OFFSETOF(bcm_tlv_t, data))
+
+/* Check that bcm_tlv_t fits into the given buffer len */
+#define bcm_valid_tlv(elt, buflen)                                     \
+       ((elt != NULL) &&                                               \
+        ((buflen) >= (uint)BCM_TLV_HDR_SIZE) &&                        \
+        ((buflen) >= (uint)(BCM_TLV_HDR_SIZE + (elt)->len)))
+
+/* type(aka id)/length/ext/value buffer */
+typedef struct bcm_tlv_ext {
+       uint8   id;
+       uint8   len;
+       uint8   ext;
+       uint8   data[1];
+} bcm_tlv_ext_t;
+
+/* get next tlv_ext - no length checks */
+#define BCM_TLV_EXT_NEXT(_tlv_ext) \
+       (bcm_tlv_ext_t *)((uint8 *)(_tlv_ext)+ BCM_TLV_EXT_SIZE(_tlv_ext))
+
+/* tlv_ext length is restricted to 1 byte */
+#define BCM_TLV_EXT_MAX_DATA_SIZE (254u)
+
+/* tlv_ext header - three bytes */
+#define BCM_TLV_EXT_HDR_SIZE (OFFSETOF(bcm_tlv_ext_t, data))
+
+/* size of tlv_ext including data */
+#define BCM_TLV_EXT_SIZE(_tlv_ext) (BCM_TLV_EXT_HDR_SIZE + (_tlv_ext)->len)
+
+/* find the next tlv */
+bcm_tlv_t *bcm_next_tlv(const  bcm_tlv_t *elt, uint *buflen);
+
+/* move buffer/buflen up to the given tlv, or set to NULL/0 on error */
+void bcm_tlv_buffer_advance_to(const bcm_tlv_t *elt, const uint8 **buffer, uint *buflen);
+
+/* move buffer/buflen past the given tlv, or set to NULL/0 on error */
+void bcm_tlv_buffer_advance_past(const bcm_tlv_t *elt, const uint8 **buffer, uint *buflen);
+
+/* find the tlv for a given id */
+bcm_tlv_t *bcm_parse_tlvs(const  void *buf, uint buflen, uint key);
+
+/* advancement modes for bcm_parse_tlvs_advance() */
+typedef enum {
+       BCM_TLV_ADVANCE_NONE = 0,  // do not adjust the buffer/buflen
+       BCM_TLV_ADVANCE_TO = 1,    // advance to the found tlv
+       BCM_TLV_ADVANCE_PAST = 2   // advance past the found tlv
+} bcm_tlv_advance_mode_t;
+
+/* Find an IE of a specific type from a buffer.
+ * tlvs: buffer to search for IE
+ * tlvs_len: buffer length
+ * tag: IE tag
+ * oui_len: length of the OUI
+ * oui: Specific OUI to match
+ * type: OUI type
+ * Return the matched IE, else return null.
+*/
+extern bcm_tlv_t *bcm_find_ie(const uint8 *tlvs, uint tlvs_len, uint8 tag,
+       uint8 oui_len, const char *oui, uint8 type);
+
+/* search for a matching tlv id, and adjust the parse buffer pointer/length */
+const bcm_tlv_t *bcm_parse_tlvs_advance(const uint8 **buf, uint *buflen, uint key,
+       bcm_tlv_advance_mode_t advance);
+
+/*
+ * Traverse tlvs and return pointer to the first tlv that
+ * matches the key. Return NULL if not found or tlv len < min_bodylen
+ */
+bcm_tlv_t *bcm_parse_tlvs_min_bodylen(const  void *buf, uint buflen, uint key, uint min_bodylen);
+
+/*
+ * Traverse tlvs and return pointer to the first tlv that
+ * matches the key. Return NULL if not found or tlv size > max_len or < min_len
+ */
+bcm_tlv_t *bcm_parse_tlvs_minmax_len(const  void *buf, uint buflen, uint key,
+       uint min_len, uint max_len);
+
+/* parse tlvs for dot11 - same as parse_tlvs but supports 802.11 id extension */
+bcm_tlv_t *bcm_parse_tlvs_dot11(const  void *buf, uint buflen, uint key, bool id_ext);
+
+/* same as parse_tlvs, but stops when found id > key */
+const  bcm_tlv_t *bcm_parse_ordered_tlvs(const  void *buf, uint buflen, uint key);
+
+/* find a tlv with DOT11_MNG_PROPR_ID as id, and the given oui and type */
+       bcm_tlv_t *bcm_find_vendor_ie(const  void *tlvs, uint tlvs_len, const char *voui,
+                                     uint8 *type, uint type_len);
+
+/* write tlv at dst and return next tlv ptr */
+uint8 *bcm_write_tlv(int type, const void *data, uint datalen, uint8 *dst);
+
+/* write tlv_ext at dst and return next tlv ptr */
+uint8 *bcm_write_tlv_ext(uint8 type, uint8 ext, const void *data, uint8 datalen, uint8 *dst);
+
+/* write tlv at dst if space permits and return next tlv ptr */
+uint8 *bcm_write_tlv_safe(int type, const void *data, uint datalen, uint8 *dst,
+       uint dst_maxlen);
+
+/* copy a tlv  and return next tlv ptr */
+uint8 *bcm_copy_tlv(const void *src, uint8 *dst);
+
+/* copy a tlv if space permits and return next tlv ptr */
+uint8 *bcm_copy_tlv_safe(const void *src, uint8 *dst, uint dst_maxlen);
+
+/* end tlvs */
+
+/* begin xtlv - used for iovars, nan attributes etc. */
+
+/* bcm type(id), length, value with w/16 bit id/len. The structure below
+ * is nominal, and is used to support variable length id and type. See
+ * xtlv options below.
+ */
+typedef struct bcm_xtlv {
+       uint16  id;
+       uint16  len;
+       uint8   data[1];
+} bcm_xtlv_t;
+
+/* xtlv options */
+#define BCM_XTLV_OPTION_NONE   0x0000u
+#define BCM_XTLV_OPTION_ALIGN32        0x0001u /* 32bit alignment of type.len.data */
+#define BCM_XTLV_OPTION_IDU8   0x0002u /* shorter id */
+#define BCM_XTLV_OPTION_LENU8  0x0004u /* shorted length */
+#define BCM_XTLV_OPTION_IDBE   0x0008u /* big endian format id */
+#define BCM_XTLV_OPTION_LENBE  0x0010u /* big endian format length */
+typedef uint16 bcm_xtlv_opts_t;
+
+/* header size. depends on options. Macros names ending w/ _EX are where
+ * options are explcitly specified that may be less common. The ones
+ * without use default values that correspond to ...OPTION_NONE
+ */
+
+/* xtlv header size depends on options */
+#define BCM_XTLV_HDR_SIZE 4u
+#define BCM_XTLV_HDR_SIZE_EX(_opts) bcm_xtlv_hdr_size(_opts)
+
+/* note: xtlv len only stores the value's length without padding */
+#define BCM_XTLV_LEN(_elt) ltoh16_ua(&(_elt)->len)
+#define BCM_XTLV_LEN_EX(_elt, _opts) bcm_xtlv_len(_elt, _opts)
+
+#define BCM_XTLV_ID(_elt) ltoh16_ua(&(_elt)->id)
+#define BCM_XTLV_ID_EX(_elt, _opts) bcm_xtlv_id(_elt, _opts)
+
+/* entire size of the XTLV including header, data, and optional padding */
+#define BCM_XTLV_SIZE(elt, opts) bcm_xtlv_size(elt, opts)
+#define BCM_XTLV_SIZE_EX(_elt, _opts) bcm_xtlv_size(_elt, _opts)
+
+/* max xtlv data size */
+#define BCM_XTLV_MAX_DATA_SIZE 65535u
+#define BCM_XTLV_MAX_DATA_SIZE_EX(_opts) ((_opts & BCM_XTLV_OPTION_LENU8) ? \
+       255u : 65535u)
+
+/* descriptor of xtlv data, packing(src) and unpacking(dst) support  */
+typedef struct {
+       uint16  type;
+       uint16  len;
+       void    *ptr; /* ptr to memory location */
+} xtlv_desc_t;
+
+/* xtlv buffer - packing/unpacking support */
+struct bcm_xtlvbuf {
+       bcm_xtlv_opts_t opts;
+       uint16 size;
+       uint8 *head; /* point to head of buffer */
+       uint8 *buf; /* current position of buffer */
+       /* allocated buffer may follow, but not necessarily */
+};
+typedef struct bcm_xtlvbuf bcm_xtlvbuf_t;
+
+/* valid xtlv ? */
+bool bcm_valid_xtlv(const bcm_xtlv_t *elt, int buf_len, bcm_xtlv_opts_t opts);
+
+/* return the next xtlv element, and update buffer len (remaining). Buffer length
+ * updated includes padding as specified by options
+ */
+bcm_xtlv_t *bcm_next_xtlv(const bcm_xtlv_t *elt, int *buf_len, bcm_xtlv_opts_t opts);
+
+/* initialize an xtlv buffer. Use options specified for packing/unpacking using
+ * the buffer. Caller is responsible for allocating both buffers.
+ */
+int bcm_xtlv_buf_init(bcm_xtlvbuf_t *tlv_buf, uint8 *buf, uint16 len,
+       bcm_xtlv_opts_t opts);
+
+/* length of data in the xtlv buffer */
+uint16 bcm_xtlv_buf_len(struct bcm_xtlvbuf *tbuf);
+
+/* remaining space in the xtlv buffer */
+uint16 bcm_xtlv_buf_rlen(struct bcm_xtlvbuf *tbuf);
+
+/* write ptr */
+uint8 *bcm_xtlv_buf(struct bcm_xtlvbuf *tbuf);
+
+/* head */
+uint8 *bcm_xtlv_head(struct bcm_xtlvbuf *tbuf);
+
+/* put a data buffer into xtlv */
+int bcm_xtlv_put_data(bcm_xtlvbuf_t *tbuf, uint16 type, const uint8 *data, int n);
+
+/* put one or more u16 elts into xtlv */
+int bcm_xtlv_put16(bcm_xtlvbuf_t *tbuf, uint16 type, const uint16 *data, int n);
+
+/* put one or more u32 elts into xtlv */
+int bcm_xtlv_put32(bcm_xtlvbuf_t *tbuf, uint16 type, const uint32 *data, int n);
+
+/* put one or more u64 elts into xtlv */
+int bcm_xtlv_put64(bcm_xtlvbuf_t *tbuf, uint16 type, const uint64 *data, int n);
+
+/* note: there are no get equivalent of integer unpacking, becasuse bcmendian.h
+ * can be used directly using pointers returned in the buffer being processed.
+ */
+
+/* unpack a single xtlv entry, advances buffer and copies data to dst_data on match
+ * type and length match must be exact
+ */
+int bcm_unpack_xtlv_entry(const uint8 **buf, uint16 expected_type, uint16 expected_len,
+       uint8 *dst_data, bcm_xtlv_opts_t opts);
+
+/* packs an xtlv into buffer, and advances buffer, decreements buffer length.
+ * buffer length is checked and must be >= size of xtlv - otherwise BCME_BADLEN
+ */
+int bcm_pack_xtlv_entry(uint8 **buf, uint16 *buflen, uint16 type, uint16 len,
+       const uint8 *src_data, bcm_xtlv_opts_t opts);
+
+/* accessors and lengths for element given options */
+int bcm_xtlv_size(const bcm_xtlv_t *elt, bcm_xtlv_opts_t opts);
+int bcm_xtlv_hdr_size(bcm_xtlv_opts_t opts);
+int bcm_xtlv_len(const bcm_xtlv_t *elt, bcm_xtlv_opts_t opts);
+int bcm_xtlv_id(const bcm_xtlv_t *elt, bcm_xtlv_opts_t opts);
+int bcm_xtlv_size_for_data(int dlen, bcm_xtlv_opts_t opts);
+
+/* compute size needed for number of tlvs whose total data len is given */
+#define BCM_XTLV_SIZE_FOR_TLVS(_data_len, _num_tlvs, _opts) (\
+       bcm_xtlv_size_for_data(_data_len, _opts) + (\
+       (_num_tlvs) * BCM_XTLV_HDR_SIZE_EX(_opts)))
+
+/* unsafe copy xtlv */
+#define BCM_XTLV_BCOPY(_src, _dst, _opts) \
+       bcm_xtlv_bcopy(_src, _dst, BCM_XTLV_MAX_DATA_SIZE_EX(_opts), \
+               BCM_XTLV_MAX_DATA_SIZE_EX(_opts), _opts)
+
+/* copy xtlv - note: src->dst bcopy order - to be compatible w/ tlv version */
+bcm_xtlv_t* bcm_xtlv_bcopy(const bcm_xtlv_t *src, bcm_xtlv_t *dst,
+       int src_buf_len, int dst_buf_len, bcm_xtlv_opts_t opts);
+
+/* callback for unpacking xtlv from a buffer into context. */
+typedef int (bcm_xtlv_unpack_cbfn_t)(void *ctx, const uint8 *buf,
+       uint16 type, uint16 len);
+
+/* unpack a tlv buffer using buffer, options, and callback */
+int bcm_unpack_xtlv_buf(void *ctx, const uint8 *buf, uint16 buflen,
+       bcm_xtlv_opts_t opts, bcm_xtlv_unpack_cbfn_t *cbfn);
+
+/* unpack a set of tlvs from the buffer using provided xtlv descriptors */
+int bcm_unpack_xtlv_buf_to_mem(const uint8 *buf, int *buflen, xtlv_desc_t *items,
+       bcm_xtlv_opts_t opts);
+
+/* pack a set of tlvs into buffer using provided xtlv descriptors */
+int bcm_pack_xtlv_buf_from_mem(uint8 **buf, uint16 *buflen,
+       const xtlv_desc_t *items, bcm_xtlv_opts_t opts);
+
+/* return data pointer and data length of a given id from xtlv buffer
+ * data_len may be NULL
+ */
+const uint8* bcm_get_data_from_xtlv_buf(const uint8 *tlv_buf, uint16 buflen,
+       uint16 id, uint16 *datalen, bcm_xtlv_opts_t opts);
+
+/* callback to return next tlv id and len to pack, if there is more tlvs to come and
+ * options e.g. alignment
+ */
+typedef bool (*bcm_pack_xtlv_next_info_cbfn_t)(void *ctx, uint16 *tlv_id, uint16 *tlv_len);
+
+/* callback to pack the tlv into length validated buffer */
+typedef void (*bcm_pack_xtlv_pack_next_cbfn_t)(void *ctx,
+       uint16 tlv_id, uint16 tlv_len, uint8* buf);
+
+/* pack a set of tlvs into buffer using get_next to interate */
+int bcm_pack_xtlv_buf(void *ctx, uint8 *tlv_buf, uint16 buflen,
+       bcm_xtlv_opts_t opts, bcm_pack_xtlv_next_info_cbfn_t get_next,
+       bcm_pack_xtlv_pack_next_cbfn_t pack_next, int *outlen);
+
+/* pack an xtlv. does not do any error checking. if data is not NULL
+ * data of given length is copied  to buffer (xtlv)
+ */
+void bcm_xtlv_pack_xtlv(bcm_xtlv_t *xtlv, uint16 type, uint16 len,
+       const uint8 *data, bcm_xtlv_opts_t opts);
+
+/* unpack an xtlv and return ptr to data, and data length */
+void bcm_xtlv_unpack_xtlv(const bcm_xtlv_t *xtlv, uint16 *type, uint16 *len,
+       const uint8 **data, bcm_xtlv_opts_t opts);
+
+/* end xtlvs */
+
+/* length value pairs */
+struct bcm_xlv {
+       uint16 len;
+       uint8 data[1];
+};
+typedef struct bcm_xlv bcm_xlv_t;
+
+struct bcm_xlvp {
+       uint16 len;
+       uint8 *data;
+};
+typedef struct bcm_xlvp bcm_xlvp_t;
+
+struct bcm_const_xlvp {
+       uint16 len;
+       const uint8 *data;
+};
+
+typedef struct bcm_const_xlvp bcm_const_xlvp_t;
+
+struct bcm_const_ulvp {
+       uint32 len;
+       const uint8 *data;
+};
+
+typedef struct bcm_const_ulvp bcm_const_ulvp_t;
+
+/* end length value pairs */
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif /* _bcmtlv_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmudp.h b/bcmdhd.101.10.240.x/include/bcmudp.h
new file mode 100644 (file)
index 0000000..5a5113d
--- /dev/null
@@ -0,0 +1,54 @@
+/*
+ * Fundamental constants relating to UDP Protocol
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _bcmudp_h_
+#define _bcmudp_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* UDP header */
+#define UDP_DEST_PORT_OFFSET   2       /* UDP dest port offset */
+#define UDP_LEN_OFFSET         4       /* UDP length offset */
+#define UDP_CHKSUM_OFFSET      6       /* UDP body checksum offset */
+
+#define UDP_HDR_LEN    8       /* UDP header length */
+#define UDP_PORT_LEN   2       /* UDP port length */
+
+/* These fields are stored in network order */
+BWL_PRE_PACKED_STRUCT struct bcmudp_hdr
+{
+       uint16  src_port;       /* Source Port Address */
+       uint16  dst_port;       /* Destination Port Address */
+       uint16  len;            /* Number of bytes in datagram including header */
+       uint16  chksum;         /* entire datagram checksum with pseudoheader */
+} BWL_POST_PACKED_STRUCT;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* #ifndef _bcmudp_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmutils.h b/bcmdhd.101.10.240.x/include/bcmutils.h
new file mode 100644 (file)
index 0000000..6ccf01c
--- /dev/null
@@ -0,0 +1,1503 @@
+/*
+ * Misc useful os-independent macros and functions.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _bcmutils_h_
+#define        _bcmutils_h_
+
+#include <bcmtlv.h>
+
+/* For now, protect the bcmerror.h */
+#ifdef BCMUTILS_ERR_CODES
+#include <bcmerror.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define bcm_strncpy_s(dst, noOfElements, src, count)    strncpy((dst), (src), (count))
+#ifdef FREEBSD
+#define bcm_strncat_s(dst, noOfElements, src, count)    strcat((dst), (src))
+#else
+#define bcm_strncat_s(dst, noOfElements, src, count)    strncat((dst), (src), (count))
+#endif /* FREEBSD */
+#define bcm_snprintf_s snprintf
+#define bcm_sprintf_s snprintf
+
+/*
+ * #define bcm_strcpy_s(dst, count, src)            strncpy((dst), (src), (count))
+ * Use bcm_strcpy_s instead as it is a safer option
+ * bcm_strcat_s: Use bcm_strncat_s as a safer option
+ *
+ */
+
+#define BCM_BIT(x)             (1u << (x))
+/* useful to count number of set bit in x */
+#define BCM_CLR_FISRT_BIT(x) ((x - 1) & x)
+/* first bit set in x. Useful to iterate through a mask */
+#define BCM_FIRST_BIT(x) (BCM_CLR_FISRT_BIT(x)^(x))
+
+/* Macro to iterate through the set bits in mask.
+ * NOTE: the argument "mask" will be cleared after
+ * the iteration.
+ */
+
+#define FOREACH_BIT(c, mask)\
+       for (c = BCM_FIRST_BIT(mask); mask != 0; \
+                mask = BCM_CLR_FISRT_BIT(mask), c = BCM_FIRST_BIT(mask))
+
+/* ctype replacement */
+#define _BCM_U 0x01    /* upper */
+#define _BCM_L 0x02    /* lower */
+#define _BCM_D 0x04    /* digit */
+#define _BCM_C 0x08    /* cntrl */
+#define _BCM_P 0x10    /* punct */
+#define _BCM_S 0x20    /* white space (space/lf/tab) */
+#define _BCM_X 0x40    /* hex digit */
+#define _BCM_SP        0x80    /* hard space (0x20) */
+
+extern const unsigned char bcm_ctype[256];
+#define bcm_ismask(x)  (bcm_ctype[(unsigned char)(x)])
+
+#define bcm_isalnum(c) ((bcm_ismask(c)&(_BCM_U|_BCM_L|_BCM_D)) != 0)
+#define bcm_isalpha(c) ((bcm_ismask(c)&(_BCM_U|_BCM_L)) != 0)
+#define bcm_iscntrl(c) ((bcm_ismask(c)&(_BCM_C)) != 0)
+#define bcm_isdigit(c) ((bcm_ismask(c)&(_BCM_D)) != 0)
+#define bcm_isgraph(c) ((bcm_ismask(c)&(_BCM_P|_BCM_U|_BCM_L|_BCM_D)) != 0)
+#define bcm_islower(c) ((bcm_ismask(c)&(_BCM_L)) != 0)
+#define bcm_isprint(c) ((bcm_ismask(c)&(_BCM_P|_BCM_U|_BCM_L|_BCM_D|_BCM_SP)) != 0)
+#define bcm_ispunct(c) ((bcm_ismask(c)&(_BCM_P)) != 0)
+#define bcm_isspace(c) ((bcm_ismask(c)&(_BCM_S)) != 0)
+#define bcm_isupper(c) ((bcm_ismask(c)&(_BCM_U)) != 0)
+#define bcm_isxdigit(c)        ((bcm_ismask(c)&(_BCM_D|_BCM_X)) != 0)
+#define bcm_tolower(c) (bcm_isupper((c)) ? ((c) + 'a' - 'A') : (c))
+#define bcm_toupper(c) (bcm_islower((c)) ? ((c) + 'A' - 'a') : (c))
+
+#define CIRCULAR_ARRAY_FULL(rd_idx, wr_idx, max) ((wr_idx + 1)%max == rd_idx)
+
+#define KB(bytes)      (((bytes) + 1023) / 1024)
+
+/* Buffer structure for collecting string-formatted data
+* using bcm_bprintf() API.
+* Use bcm_binit() to initialize before use
+*/
+
+struct bcmstrbuf {
+       char *buf;      /* pointer to current position in origbuf */
+       unsigned int size;      /* current (residual) size in bytes */
+       char *origbuf;  /* unmodified pointer to orignal buffer */
+       unsigned int origsize;  /* unmodified orignal buffer size in bytes */
+};
+
+#define BCMSTRBUF_LEN(b)       (b->size)
+#define BCMSTRBUF_BUF(b)       (b->buf)
+
+/* ** driver-only section ** */
+#ifdef BCMDRIVER
+
+#include <osl.h>
+#include <hnd_pktq.h>
+#include <hnd_pktpool.h>
+
+#define GPIO_PIN_NOTDEFINED    0x20    /* Pin not defined */
+
+/*
+ * Spin at most 'us' microseconds while 'exp' is true.
+ * Caller should explicitly test 'exp' when this completes
+ * and take appropriate error action if 'exp' is still true.
+ */
+#ifndef SPINWAIT_POLL_PERIOD
+#define SPINWAIT_POLL_PERIOD   10U
+#endif
+
+#ifdef BCMFUZZ
+/* fake spinwait for fuzzing */
+#define SPINWAIT(exp, us) { \
+       uint countdown = (exp) != 0 ? 1 : 0; \
+       while (countdown > 0) { \
+               countdown--; \
+       } \
+}
+#elif defined(PHY_REG_TRACE_FRAMEWORK)
+extern void phy_utils_log_spinwait(int us, int countdown);
+extern bool phy_utils_reg_trace_spinwait_logging;
+extern bool phy_utils_reg_trace_skip_log;
+extern uint64 phy_utils_reg_trace_start_time;
+#define SPINWAIT(exp, us) { \
+       uint countdown = (us) + (SPINWAIT_POLL_PERIOD - 1U); \
+       if (!phy_utils_reg_trace_skip_log) { \
+               phy_utils_reg_trace_spinwait_logging = TRUE; \
+               phy_utils_reg_trace_start_time = 0; \
+       } \
+       while (((exp) != 0) && (uint)(countdown >= SPINWAIT_POLL_PERIOD)) { \
+               OSL_DELAY(SPINWAIT_POLL_PERIOD); \
+               countdown -= SPINWAIT_POLL_PERIOD; \
+       } \
+       if (!phy_utils_reg_trace_skip_log) { \
+               phy_utils_reg_trace_spinwait_logging = FALSE; \
+               phy_utils_log_spinwait(us, countdown); \
+       } \
+}
+#else
+#define SPINWAIT(exp, us) { \
+       uint countdown = (us) + (SPINWAIT_POLL_PERIOD - 1U); \
+       while (((exp) != 0) && (uint)(countdown >= SPINWAIT_POLL_PERIOD)) { \
+               OSL_DELAY(SPINWAIT_POLL_PERIOD); \
+               countdown -= SPINWAIT_POLL_PERIOD; \
+       } \
+}
+#endif /* BCMFUZZ */
+
+/* forward definition of ether_addr structure used by some function prototypes */
+
+struct ether_addr;
+
+extern int ether_isbcast(const void *ea);
+extern int ether_isnulladdr(const void *ea);
+
+#define UP_TABLE_MAX   ((IPV4_TOS_DSCP_MASK >> IPV4_TOS_DSCP_SHIFT) + 1)       /* 64 max */
+#define CORE_SLAVE_PORT_0      0
+#define CORE_SLAVE_PORT_1      1
+#define CORE_BASE_ADDR_0       0
+#define CORE_BASE_ADDR_1       1
+
+#define PKTFRAG_TRIM_TAILBYTES(osh, p, len, type)      PKTSETLEN(osh, p, PKTLEN(osh, p) - len)
+
+/* externs */
+/* packet */
+extern uint pktcopy(osl_t *osh, void *p, uint offset, uint len, uchar *buf);
+extern uint pktfrombuf(osl_t *osh, void *p, uint offset, uint len, uchar *buf);
+extern uint pkttotlen(osl_t *osh, void *p);
+extern uint pkttotcnt(osl_t *osh, void *p);
+extern void *pktlast(osl_t *osh, void *p);
+extern uint pktsegcnt(osl_t *osh, void *p);
+extern uint8 *pktdataoffset(osl_t *osh, void *p,  uint offset);
+extern void *pktoffset(osl_t *osh, void *p,  uint offset);
+/* Add to adjust 802.1x priority */
+extern void pktset8021xprio(void *pkt, int prio);
+
+/* Get priority from a packet and pass it back in scb (or equiv) */
+#define        PKTPRIO_VDSCP   0x100           /* DSCP prio found after VLAN tag */
+#define        PKTPRIO_VLAN    0x200           /* VLAN prio found */
+#define        PKTPRIO_UPD     0x400           /* DSCP used to update VLAN prio */
+#define        PKTPRIO_DSCP    0x800           /* DSCP prio found */
+
+/* DSCP type definitions (RFC4594) */
+/* AF1x: High-Throughput Data (RFC2597) */
+#define DSCP_AF11      0x0A
+#define DSCP_AF12      0x0C
+#define DSCP_AF13      0x0E
+/* AF2x: Low-Latency Data (RFC2597) */
+#define DSCP_AF21      0x12
+#define DSCP_AF22      0x14
+#define DSCP_AF23      0x16
+/* CS2: OAM (RFC2474) */
+#define DSCP_CS2       0x10
+/* AF3x: Multimedia Streaming (RFC2597) */
+#define DSCP_AF31      0x1A
+#define DSCP_AF32      0x1C
+#define DSCP_AF33      0x1E
+/* CS3: Broadcast Video (RFC2474) */
+#define DSCP_CS3       0x18
+/* VA: VOCIE-ADMIT (RFC5865) */
+#define DSCP_VA                0x2C
+/* EF: Telephony (RFC3246) */
+#define DSCP_EF                0x2E
+/* CS6: Network Control (RFC2474) */
+#define DSCP_CS6       0x30
+/* CS7: Network Control (RFC2474) */
+#define DSCP_CS7       0x38
+
+extern uint pktsetprio(void *pkt, bool update_vtag);
+extern uint pktsetprio_qms(void *pkt, uint8* up_table, bool update_vtag);
+extern bool pktgetdscp(uint8 *pktdata, uint pktlen, uint8 *dscp);
+
+/* ethernet address */
+extern char *bcm_ether_ntoa(const struct ether_addr *ea, char *buf);
+extern int bcm_ether_atoe(const char *p, struct ether_addr *ea);
+extern int BCMRAMFN(bcm_addrmask_set)(int enable);
+extern int bcm_addrmask_get(int *val);
+
+/* ip address */
+struct ipv4_addr;
+extern char *bcm_ip_ntoa(struct ipv4_addr *ia, char *buf);
+extern char *bcm_ipv6_ntoa(void *ipv6, char *buf);
+extern int bcm_atoipv4(const char *p, struct ipv4_addr *ip);
+
+/* delay */
+extern void bcm_mdelay(uint ms);
+/* variable access */
+#if defined(BCM_RECLAIM)
+extern bool _nvram_reclaim_enb;
+#define NVRAM_RECLAIM_ENAB() (_nvram_reclaim_enb)
+#define NVRAM_RECLAIM_CHECK(name)                                                      \
+       if (NVRAM_RECLAIM_ENAB() && (bcm_attach_part_reclaimed == TRUE)) {              \
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_NULL_DEREF();                              \
+               *(char*) 0 = 0; /* TRAP */                                              \
+               GCC_DIAGNOSTIC_POP();                                                   \
+               return NULL;                                                            \
+       }
+#else /* BCM_RECLAIM */
+#define NVRAM_RECLAIM_CHECK(name)
+#endif /* BCM_RECLAIM */
+
+#ifdef WL_FWSIGN
+#define getvar(vars, name)                     (NULL)
+#define getintvar(vars, name)                  (0)
+#define getintvararray(vars, name, index)      (0)
+#define getintvararraysize(vars, name)         (0)
+#else /* WL_FWSIGN */
+extern char *getvar(char *vars, const char *name);
+extern int getintvar(char *vars, const char *name);
+extern int getintvararray(char *vars, const char *name, int index);
+extern int getintvararraysize(char *vars, const char *name);
+#endif /* WL_FWSIGN */
+
+/* Read an array of values from a possibly slice-specific nvram string */
+extern int get_uint8_vararray_slicespecific(osl_t *osh, char *vars, char *vars_table_accessor,
+       const char* name, uint8* dest_array, uint dest_size);
+extern int get_int16_vararray_slicespecific(osl_t *osh, char *vars, char *vars_table_accessor,
+       const char* name, int16* dest_array, uint dest_size);
+/* Prepend a slice-specific accessor to an nvram string name */
+extern uint get_slicespecific_var_name(osl_t *osh, char *vars_table_accessor,
+       const char *name, char **name_out);
+
+extern uint getgpiopin(char *vars, char *pin_name, uint def_pin);
+#define bcm_perf_enable()
+#define bcmstats(fmt)
+#define        bcmlog(fmt, a1, a2)
+#define        bcmdumplog(buf, size)   *buf = '\0'
+#define        bcmdumplogent(buf, idx) -1
+
+#define TSF_TICKS_PER_MS       1000
+#define TS_ENTER               0xdeadbeef      /* Timestamp profiling enter */
+#define TS_EXIT                        0xbeefcafe      /* Timestamp profiling exit */
+
+#define bcmtslog(tstamp, fmt, a1, a2)
+#define bcmprinttslogs()
+#define bcmprinttstamp(us)
+#define bcmdumptslog(b)
+
+bool bcm_match_buffers(const uint8 *b1, uint b1_len, const uint8 *b2, uint b2_len);
+
+/* Support for sharing code across in-driver iovar implementations.
+ * The intent is that a driver use this structure to map iovar names
+ * to its (private) iovar identifiers, and the lookup function to
+ * find the entry.  Macros are provided to map ids and get/set actions
+ * into a single number space for a switch statement.
+ */
+
+/* iovar structure */
+typedef struct bcm_iovar {
+       const char *name;       /* name for lookup and display */
+       uint16 varid;           /* id for switch */
+       uint16 flags;           /* driver-specific flag bits */
+       uint8 flags2;            /* driver-specific flag bits */
+       uint8 type;             /* base type of argument */
+       uint16 minlen;          /* min length for buffer vars */
+} bcm_iovar_t;
+
+/* varid definitions are per-driver, may use these get/set bits */
+
+/* IOVar action bits for id mapping */
+#define IOV_GET 0 /* Get an iovar */
+#define IOV_SET 1 /* Set an iovar */
+
+/* Varid to actionid mapping */
+#define IOV_GVAL(id)           ((id) * 2)
+#define IOV_SVAL(id)           ((id) * 2 + IOV_SET)
+#define IOV_ISSET(actionid)    ((actionid & IOV_SET) == IOV_SET)
+#define IOV_ID(actionid)       (actionid >> 1)
+
+/* flags are per-driver based on driver attributes */
+
+extern const bcm_iovar_t *bcm_iovar_lookup(const bcm_iovar_t *table, const char *name);
+extern int bcm_iovar_lencheck(const bcm_iovar_t *table, void *arg, uint len, bool set);
+
+/* ioctl structure */
+typedef struct wlc_ioctl_cmd {
+       uint16 cmd;                     /**< IOCTL command */
+       uint16 flags;                   /**< IOCTL command flags */
+       uint16 min_len;                 /**< IOCTL command minimum argument len (in bytes) */
+} wlc_ioctl_cmd_t;
+
+#if defined(WLTINYDUMP) || defined(WLMSG_INFORM) || defined(WLMSG_ASSOC) || \
+       defined(WLMSG_PRPKT) || defined(WLMSG_WSEC)
+extern int bcm_format_ssid(char* buf, const uchar ssid[], uint ssid_len);
+#endif
+#endif /* BCMDRIVER */
+
+/* string */
+extern int bcm_atoi(const char *s);
+extern ulong bcm_strtoul(const char *cp, char **endp, uint base);
+extern uint64 bcm_strtoull(const char *cp, char **endp, uint base);
+extern char *bcmstrstr(const char *haystack, const char *needle);
+extern char *bcmstrnstr(const char *s, uint s_len, const char *substr, uint substr_len);
+extern char *bcmstrcat(char *dest, const char *src);
+extern char *bcmstrncat(char *dest, const char *src, uint size);
+extern ulong wchar2ascii(char *abuf, ushort *wbuf, ushort wbuflen, ulong abuflen);
+char* bcmstrtok(char **string, const char *delimiters, char *tokdelim);
+int bcmstricmp(const char *s1, const char *s2);
+int bcmstrnicmp(const char* s1, const char* s2, int cnt);
+uint16 bcmhex2bin(const uint8* hex, uint hex_len, uint8 *buf, uint buf_len);
+
+/* Base type definitions */
+#define IOVT_VOID      0       /* no value (implictly set only) */
+#define IOVT_BOOL      1       /* any value ok (zero/nonzero) */
+#define IOVT_INT8      2       /* integer values are range-checked */
+#define IOVT_UINT8     3       /* unsigned int 8 bits */
+#define IOVT_INT16     4       /* int 16 bits */
+#define IOVT_UINT16    5       /* unsigned int 16 bits */
+#define IOVT_INT32     6       /* int 32 bits */
+#define IOVT_UINT32    7       /* unsigned int 32 bits */
+#define IOVT_BUFFER    8       /* buffer is size-checked as per minlen */
+#define BCM_IOVT_VALID(type) (((unsigned int)(type)) <= IOVT_BUFFER)
+
+/* Initializer for IOV type strings */
+#define BCM_IOV_TYPE_INIT { \
+       "void", \
+       "bool", \
+       "int8", \
+       "uint8", \
+       "int16", \
+       "uint16", \
+       "int32", \
+       "uint32", \
+       "buffer", \
+       "" }
+
+#define BCM_IOVT_IS_INT(type) (\
+       (type == IOVT_BOOL) || \
+       (type == IOVT_INT8) || \
+       (type == IOVT_UINT8) || \
+       (type == IOVT_INT16) || \
+       (type == IOVT_UINT16) || \
+       (type == IOVT_INT32) || \
+       (type == IOVT_UINT32))
+
+/* ** driver/apps-shared section ** */
+
+#define BCME_STRLEN             64      /* Max string length for BCM errors */
+#define VALID_BCMERROR(e)       valid_bcmerror(e)
+
+#ifdef DBG_BUS
+/** tracks non typical execution paths, use gdb with arm sim + firmware dump to read counters */
+#define DBG_BUS_INC(s, cnt) ((s)->dbg_bus->cnt++)
+#else
+#define DBG_BUS_INC(s, cnt)
+#endif /* DBG_BUS */
+
+/* BCMUTILS_ERR_CODES is defined to use the error codes from bcmerror.h
+ * otherwise use from this file.
+ */
+#ifndef BCMUTILS_ERR_CODES
+
+/*
+ * error codes could be added but the defined ones shouldn't be changed/deleted
+ * these error codes are exposed to the user code
+ * when ever a new error code is added to this list
+ * please update errorstring table with the related error string and
+ * update osl files with os specific errorcode map
+*/
+
+#define BCME_OK                                0       /* Success */
+#define BCME_ERROR                     -1      /* Error generic */
+#define BCME_BADARG                    -2      /* Bad Argument */
+#define BCME_BADOPTION                 -3      /* Bad option */
+#define BCME_NOTUP                     -4      /* Not up */
+#define BCME_NOTDOWN                   -5      /* Not down */
+#define BCME_NOTAP                     -6      /* Not AP */
+#define BCME_NOTSTA                    -7      /* Not STA  */
+#define BCME_BADKEYIDX                 -8      /* BAD Key Index */
+#define BCME_RADIOOFF                  -9      /* Radio Off */
+#define BCME_NOTBANDLOCKED             -10     /* Not  band locked */
+#define BCME_NOCLK                     -11     /* No Clock */
+#define BCME_BADRATESET                        -12     /* BAD Rate valueset */
+#define BCME_BADBAND                   -13     /* BAD Band */
+#define BCME_BUFTOOSHORT               -14     /* Buffer too short */
+#define BCME_BUFTOOLONG                        -15     /* Buffer too long */
+#define BCME_BUSY                      -16     /* Busy */
+#define BCME_NOTASSOCIATED             -17     /* Not Associated */
+#define BCME_BADSSIDLEN                        -18     /* Bad SSID len */
+#define BCME_OUTOFRANGECHAN            -19     /* Out of Range Channel */
+#define BCME_BADCHAN                   -20     /* Bad Channel */
+#define BCME_BADADDR                   -21     /* Bad Address */
+#define BCME_NORESOURCE                        -22     /* Not Enough Resources */
+#define BCME_UNSUPPORTED               -23     /* Unsupported */
+#define BCME_BADLEN                    -24     /* Bad length */
+#define BCME_NOTREADY                  -25     /* Not Ready */
+#define BCME_EPERM                     -26     /* Not Permitted */
+#define BCME_NOMEM                     -27     /* No Memory */
+#define BCME_ASSOCIATED                        -28     /* Associated */
+#define BCME_RANGE                     -29     /* Not In Range */
+#define BCME_NOTFOUND                  -30     /* Not Found */
+#define BCME_WME_NOT_ENABLED           -31     /* WME Not Enabled */
+#define BCME_TSPEC_NOTFOUND            -32     /* TSPEC Not Found */
+#define BCME_ACM_NOTSUPPORTED          -33     /* ACM Not Supported */
+#define BCME_NOT_WME_ASSOCIATION       -34     /* Not WME Association */
+#define BCME_SDIO_ERROR                        -35     /* SDIO Bus Error */
+#define BCME_DONGLE_DOWN               -36     /* Dongle Not Accessible */
+#define BCME_VERSION                   -37     /* Incorrect version */
+#define BCME_TXFAIL                    -38     /* TX failure */
+#define BCME_RXFAIL                    -39     /* RX failure */
+#define BCME_NODEVICE                  -40     /* Device not present */
+#define BCME_NMODE_DISABLED            -41     /* NMODE disabled */
+#define BCME_MSCH_DUP_REG              -42     /* Duplicate slot registration */
+#define BCME_SCANREJECT                        -43     /* reject scan request */
+#define BCME_USAGE_ERROR               -44     /* WLCMD usage error */
+#define BCME_IOCTL_ERROR               -45     /* WLCMD ioctl error */
+#define BCME_SERIAL_PORT_ERR           -46     /* RWL serial port error */
+#define BCME_DISABLED                  -47     /* Disabled in this build */
+#define BCME_DECERR                    -48     /* Decrypt error */
+#define BCME_ENCERR                    -49     /* Encrypt error */
+#define BCME_MICERR                    -50     /* Integrity/MIC error */
+#define BCME_REPLAY                    -51     /* Replay */
+#define BCME_IE_NOTFOUND               -52     /* IE not found */
+#define BCME_DATA_NOTFOUND             -53     /* Complete data not found in buffer */
+#define BCME_NOT_GC                    -54     /* expecting a group client */
+#define BCME_PRS_REQ_FAILED            -55     /* GC presence req failed to sent */
+#define BCME_NO_P2P_SE                 -56     /* Could not find P2P-Subelement */
+#define BCME_NOA_PND                   -57     /* NoA pending, CB shuld be NULL */
+#define BCME_FRAG_Q_FAILED             -58     /* queueing 80211 frag failedi */
+#define BCME_GET_AF_FAILED             -59     /* Get p2p AF pkt failed */
+#define BCME_MSCH_NOTREADY             -60     /* scheduler not ready */
+#define BCME_IOV_LAST_CMD              -61     /* last batched iov sub-command */
+#define BCME_MINIPMU_CAL_FAIL          -62     /* MiniPMU cal failed */
+#define BCME_RCAL_FAIL                 -63     /* Rcal failed */
+#define BCME_LPF_RCCAL_FAIL            -64     /* RCCAL failed */
+#define BCME_DACBUF_RCCAL_FAIL         -65     /* RCCAL failed */
+#define BCME_VCOCAL_FAIL               -66     /* VCOCAL failed */
+#define BCME_BANDLOCKED                        -67     /* interface is restricted to a band */
+#define BCME_BAD_IE_DATA               -68     /* Recieved ie with invalid/bad data */
+#define BCME_REG_FAILED                        -69     /* Generic registration failed */
+#define BCME_NOCHAN                    -70     /* Registration with 0 chans in list */
+#define BCME_PKTTOSS                   -71     /* Pkt tossed */
+#define BCME_DNGL_DEVRESET             -72     /* dongle re-attach during DEVRESET */
+#define BCME_ROAM                      -73     /* Roam related failures */
+
+#define BCME_LAST                      BCME_ROAM
+
+#define BCME_NOTENABLED BCME_DISABLED
+
+/* This error code is *internal* to the driver, and is not propogated to users. It should
+ * only be used by IOCTL patch handlers as an indication that it did not handle the IOCTL.
+ * (Since the error code is internal, an entry in 'BCMERRSTRINGTABLE' is not required,
+ * nor does it need to be part of any OSL driver-to-OS error code mapping).
+ */
+#define BCME_IOCTL_PATCH_UNSUPPORTED   -9999
+#if (BCME_LAST <= BCME_IOCTL_PATCH_UNSUPPORTED)
+       #error "BCME_LAST <= BCME_IOCTL_PATCH_UNSUPPORTED"
+#endif
+
+/* These are collection of BCME Error strings */
+#define BCMERRSTRINGTABLE {            \
+       "OK",                           \
+       "Undefined error",              \
+       "Bad Argument",                 \
+       "Bad Option",                   \
+       "Not up",                       \
+       "Not down",                     \
+       "Not AP",                       \
+       "Not STA",                      \
+       "Bad Key Index",                \
+       "Radio Off",                    \
+       "Not band locked",              \
+       "No clock",                     \
+       "Bad Rate valueset",            \
+       "Bad Band",                     \
+       "Buffer too short",             \
+       "Buffer too long",              \
+       "Busy",                         \
+       "Not Associated",               \
+       "Bad SSID len",                 \
+       "Out of Range Channel",         \
+       "Bad Channel",                  \
+       "Bad Address",                  \
+       "Not Enough Resources",         \
+       "Unsupported",                  \
+       "Bad length",                   \
+       "Not Ready",                    \
+       "Not Permitted",                \
+       "No Memory",                    \
+       "Associated",                   \
+       "Not In Range",                 \
+       "Not Found",                    \
+       "WME Not Enabled",              \
+       "TSPEC Not Found",              \
+       "ACM Not Supported",            \
+       "Not WME Association",          \
+       "SDIO Bus Error",               \
+       "Dongle Not Accessible",        \
+       "Incorrect version",            \
+       "TX Failure",                   \
+       "RX Failure",                   \
+       "Device Not Present",           \
+       "NMODE Disabled",               \
+       "Host Offload in device",       \
+       "Scan Rejected",                \
+       "WLCMD usage error",            \
+       "WLCMD ioctl error",            \
+       "RWL serial port error",        \
+       "Disabled",                     \
+       "Decrypt error", \
+       "Encrypt error", \
+       "MIC error", \
+       "Replay", \
+       "IE not found", \
+       "Data not found", \
+       "NOT GC", \
+       "PRS REQ FAILED", \
+       "NO P2P SubElement", \
+       "NOA Pending", \
+       "FRAG Q FAILED", \
+       "GET ActionFrame failed", \
+       "scheduler not ready", \
+       "Last IOV batched sub-cmd", \
+       "Mini PMU Cal failed", \
+       "R-cal failed", \
+       "LPF RC Cal failed", \
+       "DAC buf RC Cal failed", \
+       "VCO Cal failed", \
+       "band locked", \
+       "Recieved ie with invalid data", \
+       "registration failed", \
+       "Registration with zero channels", \
+       "pkt toss", \
+       "Dongle Devreset", \
+       "Critical roam in progress", \
+}
+#endif /* BCMUTILS_ERR_CODES */
+
+#ifndef ABS
+#define        ABS(a)                  (((a) < 0) ? -(a) : (a))
+#endif /* ABS */
+
+#ifndef MIN
+#define        MIN(a, b)               (((a) < (b)) ? (a) : (b))
+#endif /* MIN */
+
+#ifndef MAX
+#define        MAX(a, b)               (((a) > (b)) ? (a) : (b))
+#endif /* MAX */
+
+/* limit to [min, max] */
+#ifndef LIMIT_TO_RANGE
+#define LIMIT_TO_RANGE(x, min, max) \
+       ((x) < (min) ? (min) : ((x) > (max) ? (max) : (x)))
+#endif /* LIMIT_TO_RANGE */
+
+/* limit to  max */
+#ifndef LIMIT_TO_MAX
+#define LIMIT_TO_MAX(x, max) \
+       (((x) > (max) ? (max) : (x)))
+#endif /* LIMIT_TO_MAX */
+
+/* limit to min */
+#ifndef LIMIT_TO_MIN
+#define LIMIT_TO_MIN(x, min) \
+       (((x) < (min) ? (min) : (x)))
+#endif /* LIMIT_TO_MIN */
+
+#define SIZE_BITS(x) (sizeof(x) * NBBY)
+
+#define DELTA(curr, prev) ((curr) > (prev) ? ((curr) - (prev)) : \
+       (0xffffffff - (prev) + (curr) + 1))
+#define CEIL(x, y)             (((x) + ((y) - 1)) / (y))
+#define ROUNDUP(x, y)          ((((x) + ((y) - 1)) / (y)) * (y))
+#define ROUNDDN(p, align)      ((p) & ~((align) - 1))
+#define        ISALIGNED(a, x)         (((uintptr)(a) & ((x) - 1)) == 0)
+#define ALIGN_ADDR(addr, boundary) (void *)(((uintptr)(addr) + (boundary) - 1) \
+                                                & ~((uintptr)(boundary) - 1))
+#define ALIGN_SIZE(size, boundary) (((size) + (boundary) - 1) \
+                                                & ~((boundary) - 1))
+#define        ISPOWEROF2(x)           ((((x) - 1) & (x)) == 0)
+#define VALID_MASK(mask)       !((mask) & ((mask) + 1))
+
+#ifndef OFFSETOF
+#if ((__GNUC__ >= 4) && (__GNUC_MINOR__ >= 8))
+       /* GCC 4.8+ complains when using our OFFSETOF macro in array length declarations. */
+       #define OFFSETOF(type, member)  __builtin_offsetof(type, member)
+#else
+#ifdef BCMFUZZ
+       /* use 0x10 offset to avoid undefined behavior error due to NULL access */
+       #define OFFSETOF(type, member)  (((uint)(uintptr)&((type *)0x10)->member) - 0x10)
+#else
+       #define OFFSETOF(type, member)  ((uint)(uintptr)&((type *)0)->member)
+#endif /* BCMFUZZ */
+#endif /* GCC 4.8 or newer */
+#endif /* OFFSETOF */
+
+#ifndef CONTAINEROF
+#define CONTAINEROF(ptr, type, member) ((type *)((char *)(ptr) - OFFSETOF(type, member)))
+#endif /* CONTAINEROF */
+
+/* substruct size up to and including a member of the struct */
+#ifndef STRUCT_SIZE_THROUGH
+#define STRUCT_SIZE_THROUGH(sptr, fname) \
+       (((uint8*)&((sptr)->fname) - (uint8*)(sptr)) + sizeof((sptr)->fname))
+#endif
+
+/* Extracting the size of element in a structure */
+#define SIZE_OF(type, field) sizeof(((type *)0)->field)
+
+/* Extracting the size of pointer element in a structure */
+#define SIZE_OF_PV(type, pfield) sizeof(*((type *)0)->pfield)
+
+#ifndef ARRAYSIZE
+#define ARRAYSIZE(a)           (uint32)(sizeof(a) / sizeof(a[0]))
+#endif
+
+#ifndef ARRAYLAST /* returns pointer to last array element */
+#define ARRAYLAST(a)           (&a[ARRAYSIZE(a)-1])
+#endif
+
+/* Calculates the required pad size. This is mainly used in register structures */
+#define PADSZ(start, end)       ((((end) - (start)) / 4) + 1)
+
+/* Reference a function; used to prevent a static function from being optimized out */
+extern void *_bcmutils_dummy_fn;
+#define REFERENCE_FUNCTION(f)  (_bcmutils_dummy_fn = (void *)(f))
+
+/* bit map related macros */
+#ifndef setbit
+#ifndef NBBY           /* the BSD family defines NBBY */
+#define        NBBY    8       /* 8 bits per byte */
+#endif /* #ifndef NBBY */
+#ifdef BCMUTILS_BIT_MACROS_USE_FUNCS
+extern void setbit(void *array, uint bit);
+extern void clrbit(void *array, uint bit);
+extern bool isset(const void *array, uint bit);
+extern bool isclr(const void *array, uint bit);
+#else
+#define        setbit(a, i)    (((uint8 *)a)[(i) / NBBY] |= 1 << ((i) % NBBY))
+#define        clrbit(a, i)    (((uint8 *)a)[(i) / NBBY] &= ~(1 << ((i) % NBBY)))
+#define        isset(a, i)     (((const uint8 *)a)[(i) / NBBY] & (1 << ((i) % NBBY)))
+#define        isclr(a, i)     ((((const uint8 *)a)[(i) / NBBY] & (1 << ((i) % NBBY))) == 0)
+#endif
+#endif /* setbit */
+
+/* read/write/clear field in a consecutive bits in an octet array.
+ * 'addr' is the octet array's start byte address
+ * 'size' is the octet array's byte size
+ * 'stbit' is the value's start bit offset
+ * 'nbits' is the value's bit size
+ * This set of utilities are for convenience. Don't use them
+ * in time critical/data path as there's a great overhead in them.
+ */
+void setbits(uint8 *addr, uint size, uint stbit, uint nbits, uint32 val);
+uint32 getbits(const uint8 *addr, uint size, uint stbit, uint nbits);
+#define clrbits(addr, size, stbit, nbits) setbits(addr, size, stbit, nbits, 0)
+
+extern void set_bitrange(void *array, uint start, uint end, uint maxbit);
+extern void clr_bitrange(void *array, uint start, uint end, uint maxbit);
+extern void set_bitrange_u32(void *array, uint start, uint end, uint maxbit);
+extern void clr_bitrange_u32(void *array, uint start, uint end, uint maxbit);
+
+extern int bcm_find_fsb(uint32 num);
+
+#define        isbitset(a, i)  (((a) & (1 << (i))) != 0)
+
+#define        NBITS(type)     ((uint32)(sizeof(type) * 8))
+#define NBITVAL(nbits) (1 << (nbits))
+#define MAXBITVAL(nbits)       ((1 << (nbits)) - 1)
+#define        NBITMASK(nbits) MAXBITVAL(nbits)
+#define MAXNBVAL(nbyte)        MAXBITVAL((nbyte) * 8)
+
+extern void bcm_bitprint32(const uint32 u32);
+
+/*
+ * ----------------------------------------------------------------------------
+ * Multiword map of 2bits, nibbles
+ * setbit2 setbit4 (void *ptr, uint32 ix, uint32 val)
+ * getbit2 getbit4 (void *ptr, uint32 ix)
+ * ----------------------------------------------------------------------------
+ */
+
+#define DECLARE_MAP_API(NB, RSH, LSH, OFF, MSK)                     \
+static INLINE void setbit##NB(void *ptr, uint32 ix, uint32 val)     \
+{                                                                   \
+       uint32 *addr = (uint32 *)ptr;                                   \
+       uint32 *a = addr + (ix >> RSH); /* (ix / 2^RSH) */              \
+       uint32 pos = (ix & OFF) << LSH; /* (ix % 2^RSH) * 2^LSH */      \
+       uint32 mask = (MSK << pos);                                     \
+       uint32 tmp = *a & ~mask;                                        \
+       *a = tmp | (val << pos);                                        \
+}                                                                   \
+static INLINE uint32 getbit##NB(void *ptr, uint32 ix)               \
+{                                                                   \
+       uint32 *addr = (uint32 *)ptr;                                   \
+       uint32 *a = addr + (ix >> RSH);                                 \
+       uint32 pos = (ix & OFF) << LSH;                                 \
+       return ((*a >> pos) & MSK);                                     \
+}
+
+DECLARE_MAP_API(2, 4, 1, 15u, 0x0003u) /* setbit2() and getbit2() */
+DECLARE_MAP_API(4, 3, 2, 7u, 0x000Fu) /* setbit4() and getbit4() */
+DECLARE_MAP_API(8, 2, 3, 3u, 0x00FFu) /* setbit8() and getbit8() */
+
+/* basic mux operation - can be optimized on several architectures */
+#define MUX(pred, true, false) ((pred) ? (true) : (false))
+
+/* modulo inc/dec - assumes x E [0, bound - 1] */
+#define MODDEC(x, bound) MUX((x) == 0, (bound) - 1, (x) - 1)
+#define MODINC(x, bound) MUX((x) == (bound) - 1, 0, (x) + 1)
+
+/* modulo inc/dec, bound = 2^k */
+#define MODDEC_POW2(x, bound) (((x) - 1) & ((bound) - 1))
+#define MODINC_POW2(x, bound) (((x) + 1) & ((bound) - 1))
+
+/* modulo add/sub - assumes x, y E [0, bound - 1] */
+#define MODADD(x, y, bound) \
+    MUX((x) + (y) >= (bound), (x) + (y) - (bound), (x) + (y))
+#define MODSUB(x, y, bound) \
+    MUX(((int)(x)) - ((int)(y)) < 0, (x) - (y) + (bound), (x) - (y))
+
+/* module add/sub, bound = 2^k */
+#define MODADD_POW2(x, y, bound) (((x) + (y)) & ((bound) - 1))
+#define MODSUB_POW2(x, y, bound) (((x) - (y)) & ((bound) - 1))
+
+/* crc defines */
+#define CRC8_INIT_VALUE  0xff          /* Initial CRC8 checksum value */
+#define CRC8_GOOD_VALUE  0x9f          /* Good final CRC8 checksum value */
+#define CRC16_INIT_VALUE 0xffff                /* Initial CRC16 checksum value */
+#define CRC16_GOOD_VALUE 0xf0b8                /* Good final CRC16 checksum value */
+#define CRC32_INIT_VALUE 0xffffffff    /* Initial CRC32 checksum value */
+#define CRC32_GOOD_VALUE 0xdebb20e3    /* Good final CRC32 checksum value */
+
+/* use for direct output of MAC address in printf etc */
+#define MACF                           "%02x:%02x:%02x:%02x:%02x:%02x"
+#define ETHERP_TO_MACF(ea)     ((const struct ether_addr *) (ea))->octet[0], \
+                               ((const struct ether_addr *) (ea))->octet[1], \
+                               ((const struct ether_addr *) (ea))->octet[2], \
+                               ((const struct ether_addr *) (ea))->octet[3], \
+                               ((const struct ether_addr *) (ea))->octet[4], \
+                               ((const struct ether_addr *) (ea))->octet[5]
+
+#define CONST_ETHERP_TO_MACF(ea)       ETHERP_TO_MACF(ea)
+
+#define ETHER_TO_MACF(ea)      (ea).octet[0], \
+                               (ea).octet[1], \
+                               (ea).octet[2], \
+                               (ea).octet[3], \
+                               (ea).octet[4], \
+                               (ea).octet[5]
+/* use only for debug, the string length can be changed
+ * If you want to use this macro to the logic,
+ * USE MACF instead
+ */
+#if !defined(SIMPLE_MAC_PRINT)
+#define MACDBG "%02x:%02x:%02x:%02x:%02x:%02x"
+#define MAC2STRDBG(ea) ((const uint8*)(ea))[0], \
+                       ((const uint8*)(ea))[1], \
+                       ((const uint8*)(ea))[2], \
+                       ((const uint8*)(ea))[3], \
+                       ((const uint8*)(ea))[4], \
+                       ((const uint8*)(ea))[5]
+#else
+#define MACDBG                         "%02x:xx:xx:xx:x%x:%02x"
+#define MAC2STRDBG(ea) ((const uint8*)(ea))[0], \
+                       (((const uint8*)(ea))[4] & 0xf), \
+                       ((const uint8*)(ea))[5]
+#endif /* SIMPLE_MAC_PRINT */
+
+#define MACOUIDBG "%02x:%x:%02x"
+#define MACOUI2STRDBG(ea)      ((const uint8*)(ea))[0], \
+                               ((const uint8*)(ea))[1] & 0xf, \
+                               ((const uint8*)(ea))[2]
+
+#define MACOUI "%02x:%02x:%02x"
+#define MACOUI2STR(ea) (ea)[0], (ea)[1], (ea)[2]
+
+/* bcm_format_flags() bit description structure */
+typedef struct bcm_bit_desc {
+       uint32  bit;
+       const char* name;
+} bcm_bit_desc_t;
+
+/* bcm_format_field */
+typedef struct bcm_bit_desc_ex {
+       uint32 mask;
+       const bcm_bit_desc_t *bitfield;
+} bcm_bit_desc_ex_t;
+
+/* buffer length for ethernet address from bcm_ether_ntoa() */
+#define ETHER_ADDR_STR_LEN     18u     /* 18-bytes of Ethernet address buffer length */
+
+static INLINE uint32 /* 32bit word aligned xor-32 */
+bcm_compute_xor32(volatile uint32 *u32_val, int num_u32)
+{
+       int idx;
+       uint32 xor32 = 0;
+       for (idx = 0; idx < num_u32; idx++)
+               xor32 ^= *(u32_val + idx);
+       return xor32;
+}
+
+/* crypto utility function */
+/* 128-bit xor: *dst = *src1 xor *src2. dst1, src1 and src2 may have any alignment */
+static INLINE void
+xor_128bit_block(const uint8 *src1, const uint8 *src2, uint8 *dst)
+{
+       if (
+#ifdef __i386__
+           1 ||
+#endif
+           (((uintptr)src1 | (uintptr)src2 | (uintptr)dst) & 3) == 0) {
+               /* ARM CM3 rel time: 1229 (727 if alignment check could be omitted) */
+               /* x86 supports unaligned.  This version runs 6x-9x faster on x86. */
+               ((uint32 *)dst)[0] = ((const uint32 *)src1)[0] ^ ((const uint32 *)src2)[0];
+               ((uint32 *)dst)[1] = ((const uint32 *)src1)[1] ^ ((const uint32 *)src2)[1];
+               ((uint32 *)dst)[2] = ((const uint32 *)src1)[2] ^ ((const uint32 *)src2)[2];
+               ((uint32 *)dst)[3] = ((const uint32 *)src1)[3] ^ ((const uint32 *)src2)[3];
+       } else {
+               /* ARM CM3 rel time: 4668 (4191 if alignment check could be omitted) */
+               int k;
+               for (k = 0; k < 16; k++)
+                       dst[k] = src1[k] ^ src2[k];
+       }
+}
+
+/* externs */
+/* crc */
+uint8 hndcrc8(const uint8 *p, uint nbytes, uint8 crc);
+uint16 hndcrc16(const uint8 *p, uint nbytes, uint16 crc);
+uint32 hndcrc32(const uint8 *p, uint nbytes, uint32 crc);
+
+/* format/print */
+/* print out the value a field has: fields may have 1-32 bits and may hold any value */
+extern uint bcm_format_field(const bcm_bit_desc_ex_t *bd, uint32 field, char* buf, uint len);
+/* print out which bits in flags are set */
+extern int bcm_format_flags(const bcm_bit_desc_t *bd, uint32 flags, char* buf, uint len);
+/* print out whcih bits in octet array 'addr' are set. bcm_bit_desc_t:bit is a bit offset. */
+int bcm_format_octets(const bcm_bit_desc_t *bd, uint bdsz,
+       const uint8 *addr, uint size, char *buf, uint len);
+
+extern int bcm_format_hex(char *str, const void *bytes, uint len);
+
+extern const char *bcm_crypto_algo_name(uint algo);
+extern char *bcm_chipname(uint chipid, char *buf, uint len);
+extern char *bcm_brev_str(uint32 brev, char *buf);
+extern void printbig(char *buf);
+extern void prhex(const char *msg, const uchar *buf, uint len);
+
+/* bcmerror */
+extern const char *bcmerrorstr(int bcmerror);
+
+#if defined(WLMSG_ASSOC)
+/* get 802.11 frame name based on frame kind - see frame types FC_.. in 802.11.h */
+const char *bcm_80211_fk_name(uint fk);
+#else
+#define bcm_80211_fk_names(_x) ""
+#endif
+
+extern int wl_set_up_table(uint8 *up_table, bcm_tlv_t *qos_map_ie);
+
+/* multi-bool data type: set of bools, mbool is true if any is set */
+typedef uint32 mbool;
+#define mboolset(mb, bit)              ((mb) |= (bit))         /* set one bool */
+#define mboolclr(mb, bit)              ((mb) &= ~(bit))        /* clear one bool */
+#define mboolisset(mb, bit)            (((mb) & (bit)) != 0)   /* TRUE if one bool is set */
+#define        mboolmaskset(mb, mask, val)     ((mb) = (((mb) & ~(mask)) | (val)))
+
+/* generic datastruct to help dump routines */
+struct fielddesc {
+       const char *nameandfmt;
+       uint32 offset;
+       uint32 len;
+};
+
+extern void bcm_binit(struct bcmstrbuf *b, char *buf, uint size);
+#define bcm_bsize(b) ((b)->size)
+#define bcm_breset(b) do {bcm_binit(b, (b)->origbuf, (b)->origsize);} while (0)
+extern void bcm_bprhex(struct bcmstrbuf *b, const char *msg, bool newline,
+       const uint8 *buf, uint len);
+
+extern void bcm_inc_bytes(uchar *num, int num_bytes, uint8 amount);
+extern int bcm_cmp_bytes(const uchar *arg1, const uchar *arg2, uint8 nbytes);
+extern void bcm_print_bytes(const char *name, const uchar *cdata, uint len);
+
+typedef  uint32 (*bcmutl_rdreg_rtn)(void *arg0, uint arg1, uint32 offset);
+extern uint bcmdumpfields(bcmutl_rdreg_rtn func_ptr, void *arg0, uint arg1, struct fielddesc *str,
+                          char *buf, uint32 bufsize);
+extern uint bcm_bitcount(const uint8 *bitmap, uint bytelength);
+
+extern int bcm_bprintf(struct bcmstrbuf *b, const char *fmt, ...);
+
+/* power conversion */
+extern uint16 bcm_qdbm_to_mw(uint8 qdbm);
+extern uint8 bcm_mw_to_qdbm(uint16 mw);
+extern uint bcm_mkiovar(const char *name, const char *data, uint datalen, char *buf, uint len);
+
+unsigned int process_nvram_vars(char *varbuf, unsigned int len);
+bool replace_nvram_variable(char *varbuf, unsigned int buflen, const char *variable,
+       unsigned int *datalen);
+
+/* trace any object allocation / free, with / without features (flags) set to the object */
+
+#define BCM_OBJDBG_ADD           1
+#define BCM_OBJDBG_REMOVE        2
+#define BCM_OBJDBG_ADD_PKT       3
+
+/* object feature: set or clear flags */
+#define BCM_OBJECT_FEATURE_FLAG       1
+#define BCM_OBJECT_FEATURE_PKT_STATE  2
+/* object feature: flag bits */
+#define BCM_OBJECT_FEATURE_0     (1 << 0)
+#define BCM_OBJECT_FEATURE_1     (1 << 1)
+#define BCM_OBJECT_FEATURE_2     (1 << 2)
+/* object feature: clear flag bits field set with this flag */
+#define BCM_OBJECT_FEATURE_CLEAR (1 << 31)
+#if defined(BCM_OBJECT_TRACE) && !defined(BINCMP)
+#define bcm_pkt_validate_chk(obj, func)        do { \
+       void * pkttag; \
+       bcm_object_trace_chk(obj, 0, 0, \
+               func, __LINE__); \
+       if ((pkttag = PKTTAG(obj))) { \
+               bcm_object_trace_chk(obj, 1, DHD_PKTTAG_SN(pkttag), \
+                       func, __LINE__); \
+       } \
+} while (0)
+extern void bcm_object_trace_opr(void *obj, uint32 opt, const char *caller, int line);
+extern void bcm_object_trace_upd(void *obj, void *obj_new);
+extern void bcm_object_trace_chk(void *obj, uint32 chksn, uint32 sn,
+       const char *caller, int line);
+extern void bcm_object_feature_set(void *obj, uint32 type, uint32 value);
+extern int  bcm_object_feature_get(void *obj, uint32 type, uint32 value);
+extern void bcm_object_trace_init(void);
+extern void bcm_object_trace_deinit(void);
+#else
+#define bcm_pkt_validate_chk(obj, func)
+#define bcm_object_trace_opr(a, b, c, d)
+#define bcm_object_trace_upd(a, b)
+#define bcm_object_trace_chk(a, b, c, d, e)
+#define bcm_object_feature_set(a, b, c)
+#define bcm_object_feature_get(a, b, c)
+#define bcm_object_trace_init()
+#define bcm_object_trace_deinit()
+#endif /* BCM_OBJECT_TRACE && !BINCMP */
+
+/* Public domain bit twiddling hacks/utilities: Sean Eron Anderson */
+
+/* Table driven count set bits. */
+static const uint8 /* Table only for use by bcm_cntsetbits */
+_CSBTBL[256] =
+{
+       #define B2(n)    n,     n + 1,     n + 1,     n + 2
+       #define B4(n) B2(n), B2(n + 1), B2(n + 1), B2(n + 2)
+       #define B6(n) B4(n), B4(n + 1), B4(n + 1), B4(n + 2)
+               B6(0), B6(0 + 1), B6(0 + 1), B6(0 + 2)
+};
+
+static INLINE uint32 /* Uses table _CSBTBL for fast counting of 1's in a u32 */
+bcm_cntsetbits(const uint32 u32arg)
+{
+       /* function local scope declaration of const _CSBTBL[] */
+       const uint8 * p = (const uint8 *)&u32arg;
+       /* uint32 cast to avoid uint8 being promoted to int for arithmetic operation */
+       return ((uint32)_CSBTBL[p[0]] + _CSBTBL[p[1]] + _CSBTBL[p[2]] + _CSBTBL[p[3]]);
+}
+
+static INLINE int /* C equivalent count of leading 0's in a u32 */
+C_bcm_count_leading_zeros(uint32 u32arg)
+{
+       int shifts = 0;
+       while (u32arg) {
+               shifts++; u32arg >>= 1;
+       }
+       return (32 - shifts);
+}
+
+typedef struct bcm_rand_metadata {
+       uint32 count;           /* number of random numbers in bytes */
+       uint32 signature;       /* host fills it in, FW verfies before reading rand */
+} bcm_rand_metadata_t;
+
+#ifdef BCMDRIVER
+/*
+ * Assembly instructions: Count Leading Zeros
+ * "clz"       : MIPS, ARM
+ * "cntlzw"    : PowerPC
+ * "BSF"       : x86
+ * "lzcnt"     : AMD, SPARC
+ */
+
+#if defined(__arm__)
+#if defined(__ARM_ARCH_7M__) /* Cortex M3 */
+#define __USE_ASM_CLZ__
+#endif /* __ARM_ARCH_7M__ */
+#if defined(__ARM_ARCH_7R__) /* Cortex R4 */
+#define __USE_ASM_CLZ__
+#endif /* __ARM_ARCH_7R__ */
+#endif /* __arm__ */
+
+static INLINE int
+bcm_count_leading_zeros(uint32 u32arg)
+{
+#if defined(__USE_ASM_CLZ__)
+       int zeros;
+       __asm__ volatile("clz    %0, %1 \n" : "=r" (zeros) : "r"  (u32arg));
+       return zeros;
+#else  /* C equivalent */
+       return C_bcm_count_leading_zeros(u32arg);
+#endif  /* C equivalent */
+}
+
+/*
+ * Macro to count leading zeroes
+ *
+ */
+#if defined(__GNUC__)
+#define CLZ(x) __builtin_clzl(x)
+#elif defined(__arm__)
+#define CLZ(x) __clz(x)
+#else
+#define CLZ(x) bcm_count_leading_zeros(x)
+#endif /* __GNUC__ */
+
+/* INTERFACE: Multiword bitmap based small id allocator. */
+struct bcm_mwbmap;     /* forward declaration for use as an opaque mwbmap handle */
+
+#define BCM_MWBMAP_INVALID_HDL ((struct bcm_mwbmap *)NULL)
+#define BCM_MWBMAP_INVALID_IDX ((uint32)(~0U))
+
+/* Incarnate a multiword bitmap based small index allocator */
+extern struct bcm_mwbmap * bcm_mwbmap_init(osl_t * osh, uint32 items_max);
+
+/* Free up the multiword bitmap index allocator */
+extern void bcm_mwbmap_fini(osl_t * osh, struct bcm_mwbmap * mwbmap_hdl);
+
+/* Allocate a unique small index using a multiword bitmap index allocator */
+extern uint32 bcm_mwbmap_alloc(struct bcm_mwbmap * mwbmap_hdl);
+
+/* Force an index at a specified position to be in use */
+extern void bcm_mwbmap_force(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix);
+
+/* Free a previously allocated index back into the multiword bitmap allocator */
+extern void bcm_mwbmap_free(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix);
+
+/* Fetch the toal number of free indices in the multiword bitmap allocator */
+extern uint32 bcm_mwbmap_free_cnt(struct bcm_mwbmap * mwbmap_hdl);
+
+/* Determine whether an index is inuse or free */
+extern bool bcm_mwbmap_isfree(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix);
+
+/* Debug dump a multiword bitmap allocator */
+extern void bcm_mwbmap_show(struct bcm_mwbmap * mwbmap_hdl);
+
+extern void bcm_mwbmap_audit(struct bcm_mwbmap * mwbmap_hdl);
+/* End - Multiword bitmap based small Id allocator. */
+
+/* INTERFACE: Simple unique 16bit Id Allocator using a stack implementation. */
+
+#define ID8_INVALID     0xFFu
+#define ID16_INVALID    0xFFFFu
+#define ID32_INVALID    0xFFFFFFFFu
+#define ID16_UNDEFINED              ID16_INVALID
+
+/*
+ * Construct a 16bit id allocator, managing 16bit ids in the range:
+ *    [start_val16 .. start_val16+total_ids)
+ * Note: start_val16 is inclusive.
+ * Returns an opaque handle to the 16bit id allocator.
+ */
+extern void * id16_map_init(osl_t *osh, uint16 total_ids, uint16 start_val16);
+extern void * id16_map_fini(osl_t *osh, void * id16_map_hndl);
+extern void id16_map_clear(void * id16_map_hndl, uint16 total_ids, uint16 start_val16);
+
+/* Allocate a unique 16bit id */
+extern uint16 id16_map_alloc(void * id16_map_hndl);
+
+/* Free a 16bit id value into the id16 allocator */
+extern void id16_map_free(void * id16_map_hndl, uint16 val16);
+
+/* Get the number of failures encountered during id allocation. */
+extern uint32 id16_map_failures(void * id16_map_hndl);
+
+/* Audit the 16bit id allocator state. */
+extern bool id16_map_audit(void * id16_map_hndl);
+/* End - Simple 16bit Id Allocator. */
+#endif /* BCMDRIVER */
+
+void bcm_add_64(uint32* r_hi, uint32* r_lo, uint32 offset);
+void bcm_sub_64(uint32* r_hi, uint32* r_lo, uint32 offset);
+
+#define MASK_32_BITS   (~0)
+#define MASK_8_BITS    ((1 << 8) - 1)
+
+#define EXTRACT_LOW32(num)     (uint32)(num & MASK_32_BITS)
+#define EXTRACT_HIGH32(num)    (uint32)(((uint64)num >> 32) & MASK_32_BITS)
+
+#define MAXIMUM(a, b) ((a > b) ? a : b)
+#define MINIMUM(a, b) ((a < b) ? a : b)
+#define LIMIT(x, min, max) ((x) < (min) ? (min) : ((x) > (max) ? (max) : (x)))
+
+/* calculate checksum for ip header, tcp / udp header / data */
+uint16 bcm_ip_cksum(uint8 *buf, uint32 len, uint32 sum);
+
+#ifndef _dll_t_
+#define _dll_t_
+/*
+ * -----------------------------------------------------------------------------
+ *                      Double Linked List Macros
+ * -----------------------------------------------------------------------------
+ *
+ * All dll operations must be performed on a pre-initialized node.
+ * Inserting an uninitialized node into a list effectively initialized it.
+ *
+ * When a node is deleted from a list, you may initialize it to avoid corruption
+ * incurred by double deletion. You may skip initialization if the node is
+ * immediately inserted into another list.
+ *
+ * By placing a dll_t element at the start of a struct, you may cast a dll_t *
+ * to the struct or vice versa.
+ *
+ * Example of declaring an initializing someList and inserting nodeA, nodeB
+ *
+ *     typedef struct item {
+ *         dll_t node;
+ *         int someData;
+ *     } Item_t;
+ *     Item_t nodeA, nodeB, nodeC;
+ *     nodeA.someData = 11111, nodeB.someData = 22222, nodeC.someData = 33333;
+ *
+ *     dll_t someList;
+ *     dll_init(&someList);
+ *
+ *     dll_append(&someList, (dll_t *) &nodeA);
+ *     dll_prepend(&someList, &nodeB.node);
+ *     dll_insert((dll_t *)&nodeC, &nodeA.node);
+ *
+ *     dll_delete((dll_t *) &nodeB);
+ *
+ * Example of a for loop to walk someList of node_p
+ *
+ *   extern void mydisplay(Item_t * item_p);
+ *
+ *   dll_t * item_p, * next_p;
+ *   for (item_p = dll_head_p(&someList); ! dll_end(&someList, item_p);
+ *        item_p = next_p)
+ *   {
+ *       next_p = dll_next_p(item_p);
+ *       ... use item_p at will, including removing it from list ...
+ *       mydisplay((PItem_t)item_p);
+ *   }
+ *
+ * -----------------------------------------------------------------------------
+ */
+typedef struct dll {
+       struct dll * next_p;
+       struct dll * prev_p;
+} dll_t;
+
+static INLINE void
+dll_init(dll_t *node_p)
+{
+       node_p->next_p = node_p;
+       node_p->prev_p = node_p;
+}
+/* dll macros returing a pointer to dll_t */
+
+static INLINE dll_t *
+dll_head_p(dll_t *list_p)
+{
+       return list_p->next_p;
+}
+
+static INLINE dll_t *
+dll_tail_p(dll_t *list_p)
+{
+       return (list_p)->prev_p;
+}
+
+static INLINE dll_t *
+dll_next_p(dll_t *node_p)
+{
+       return (node_p)->next_p;
+}
+
+static INLINE dll_t *
+dll_prev_p(dll_t *node_p)
+{
+       return (node_p)->prev_p;
+}
+
+static INLINE bool
+dll_empty(dll_t *list_p)
+{
+       return ((list_p)->next_p == (list_p));
+}
+
+static INLINE bool
+dll_end(dll_t *list_p, dll_t * node_p)
+{
+       return (list_p == node_p);
+}
+
+/* inserts the node new_p "after" the node at_p */
+static INLINE void
+dll_insert(dll_t *new_p, dll_t * at_p)
+{
+       new_p->next_p = at_p->next_p;
+       new_p->prev_p = at_p;
+       at_p->next_p = new_p;
+       (new_p->next_p)->prev_p = new_p;
+}
+
+static INLINE void
+dll_append(dll_t *list_p, dll_t *node_p)
+{
+       dll_insert(node_p, dll_tail_p(list_p));
+}
+
+static INLINE void
+dll_prepend(dll_t *list_p, dll_t *node_p)
+{
+       dll_insert(node_p, list_p);
+}
+
+/* deletes a node from any list that it "may" be in, if at all. */
+static INLINE void
+dll_delete(dll_t *node_p)
+{
+       node_p->prev_p->next_p = node_p->next_p;
+       node_p->next_p->prev_p = node_p->prev_p;
+}
+#endif  /* ! defined(_dll_t_) */
+
+/* Elements managed in a double linked list */
+
+typedef struct dll_pool {
+       dll_t       free_list;
+       uint16      free_count;
+       uint16      elems_max;
+       uint16      elem_size;
+       dll_t       elements[1];
+} dll_pool_t;
+
+dll_pool_t * dll_pool_init(void * osh, uint16 elems_max, uint16 elem_size);
+void * dll_pool_alloc(dll_pool_t * dll_pool_p);
+void dll_pool_free(dll_pool_t * dll_pool_p, void * elem_p);
+void dll_pool_free_tail(dll_pool_t * dll_pool_p, void * elem_p);
+typedef void (* dll_elem_dump)(void * elem_p);
+void dll_pool_detach(void * osh, dll_pool_t * pool, uint16 elems_max, uint16 elem_size);
+
+int valid_bcmerror(int e);
+/* Stringify macro definition */
+#define BCM_STRINGIFY(s) #s
+/* Used to pass in a macro variable that gets expanded and then stringified */
+#define BCM_EXTENDED_STRINGIFY(s) BCM_STRINGIFY(s)
+
+/* calculate IPv4 header checksum
+ * - input ip points to IP header in network order
+ * - output cksum is in network order
+ */
+uint16 ipv4_hdr_cksum(uint8 *ip, uint ip_len);
+
+/* calculate IPv4 TCP header checksum
+ * - input ip and tcp points to IP and TCP header in network order
+ * - output cksum is in network order
+ */
+uint16 ipv4_tcp_hdr_cksum(uint8 *ip, uint8 *tcp, uint16 tcp_len);
+
+/* calculate IPv6 TCP header checksum
+ * - input ipv6 and tcp points to IPv6 and TCP header in network order
+ * - output cksum is in network order
+ */
+uint16 ipv6_tcp_hdr_cksum(uint8 *ipv6, uint8 *tcp, uint16 tcp_len);
+
+#ifdef __cplusplus
+       }
+#endif
+
+/* #define DEBUG_COUNTER */
+#ifdef DEBUG_COUNTER
+#define CNTR_TBL_MAX 10
+typedef struct _counter_tbl_t {
+       char name[16];                          /* name of this counter table */
+       uint32 prev_log_print;          /* Internal use. Timestamp of the previous log print */
+       uint log_print_interval;        /* Desired interval to print logs in ms */
+       uint needed_cnt;                        /* How many counters need to be used */
+       uint32 cnt[CNTR_TBL_MAX];               /* Counting entries to increase at desired places */
+       bool enabled;                           /* Whether to enable printing log */
+} counter_tbl_t;
+
+/*     How to use
+       Eg.: In dhd_linux.c
+       cnt[0]: How many times dhd_start_xmit() was called in every 1sec.
+       cnt[1]: How many bytes were requested to be sent in every 1sec.
+
+++     static counter_tbl_t xmit_tbl = {"xmit", 0, 1000, 2, {0,}, 1};
+
+       int
+       dhd_start_xmit(struct sk_buff *skb, struct net_device *net)
+       {
+               ..........
+++             counter_printlog(&xmit_tbl);
+++             xmit_tbl.cnt[0]++;
+
+               ifp = dhd->iflist[ifidx];
+               datalen  = PKTLEN(dhdp->osh, skb);
+
+++             xmit_tbl.cnt[1] += datalen;
+               ............
+
+               ret = dhd_sendpkt(&dhd->pub, ifidx, pktbuf);
+               ...........
+       }
+*/
+
+void counter_printlog(counter_tbl_t *ctr_tbl);
+#endif /* DEBUG_COUNTER */
+
+#if defined(__GNUC__)
+#define CALL_SITE __builtin_return_address(0)
+#else
+#define CALL_SITE ((void*) 0)
+#endif
+#ifdef SHOW_LOGTRACE
+#define TRACE_LOG_BUF_MAX_SIZE 1700
+#define RTT_LOG_BUF_MAX_SIZE 1700
+#define BUF_NOT_AVAILABLE      0
+#define NEXT_BUF_NOT_AVAIL     1
+#define NEXT_BUF_AVAIL         2
+
+typedef struct trace_buf_info {
+       int availability;
+       int size;
+       char buf[TRACE_LOG_BUF_MAX_SIZE];
+} trace_buf_info_t;
+#endif /* SHOW_LOGTRACE */
+
+enum dump_dongle_e {
+       DUMP_DONGLE_COREREG = 0,
+       DUMP_DONGLE_D11MEM
+};
+
+typedef struct {
+       uint32 type;     /**< specifies e.g dump of d11 memory, use enum dump_dongle_e  */
+       uint32 index;    /**< iterator1, specifies core index or d11 memory index */
+       uint32 offset;   /**< iterator2, byte offset within register set or memory */
+} dump_dongle_in_t;
+
+typedef struct {
+       uint32 address;  /**< e.g. backplane address of register */
+       uint32 id;       /**< id, e.g. core id */
+       uint32 rev;      /**< rev, e.g. core rev */
+       uint32 n_bytes;  /**< nbytes in array val[] */
+       uint32 val[1];   /**< out: values that were read out of registers or memory */
+} dump_dongle_out_t;
+
+extern uint32 sqrt_int(uint32 value);
+
+#ifdef BCMDRIVER
+/* structures and routines to process variable sized data */
+typedef struct var_len_data {
+       uint32  vlen;
+       uint8   *vdata;
+} var_len_data_t;
+
+int bcm_vdata_alloc(osl_t *osh, var_len_data_t *vld, uint32 size);
+int bcm_vdata_free(osl_t *osh, var_len_data_t *vld);
+#if defined(PRIVACY_MASK)
+void bcm_ether_privacy_mask(struct ether_addr *addr);
+#else
+#define bcm_ether_privacy_mask(addr)
+#endif /* PRIVACY_MASK */
+#endif /* BCMDRIVER */
+
+/* Count the number of elements in an array that do not match the given value */
+extern int array_value_mismatch_count(uint8 value, uint8 *array, int array_size);
+/* Count the number of non-zero elements in an uint8 array */
+extern int array_nonzero_count(uint8 *array, int array_size);
+/* Count the number of non-zero elements in an int16 array */
+extern int array_nonzero_count_int16(int16 *array, int array_size);
+/* Count the number of zero elements in an uint8 array */
+extern int array_zero_count(uint8 *array, int array_size);
+/* Validate a uint8 ordered array.  Assert if invalid. */
+extern int verify_ordered_array_uint8(uint8 *array, int array_size, uint8 range_lo, uint8 range_hi);
+/* Validate a int16 configuration array that need not be zero-terminated.  Assert if invalid. */
+extern int verify_ordered_array_int16(int16 *array, int array_size, int16 range_lo, int16 range_hi);
+/* Validate all values in an array are in range */
+extern int verify_array_values(uint8 *array, int array_size,
+       int range_lo, int range_hi, bool zero_terminated);
+
+/*  To unwind from the trap_handler. */
+extern void (*const print_btrace_int_fn)(int depth, uint32 pc, uint32 lr, uint32 sp);
+extern void (*const print_btrace_fn)(int depth);
+#define PRINT_BACKTRACE(depth) if (print_btrace_fn) print_btrace_fn(depth)
+#define PRINT_BACKTRACE_INT(depth, pc, lr, sp) \
+       if (print_btrace_int_fn) print_btrace_int_fn(depth, pc, lr, sp)
+
+/* FW Signing - only in bootloader builds, never in dongle FW builds */
+#ifdef WL_FWSIGN
+       #define FWSIGN_ENAB()           (1)
+#else
+       #define FWSIGN_ENAB()           (0)
+#endif /* WL_FWSIGN */
+
+/* Utilities for reading SROM/SFlash vars */
+
+typedef struct varbuf {
+       char *base;             /* pointer to buffer base */
+       char *buf;              /* pointer to current position */
+       unsigned int size;      /* current (residual) size in bytes */
+} varbuf_t;
+
+/** Initialization of varbuf structure */
+void varbuf_init(varbuf_t *b, char *buf, uint size);
+/** append a null terminated var=value string */
+int varbuf_append(varbuf_t *b, const char *fmt, ...);
+#if defined(BCMDRIVER)
+int initvars_table(osl_t *osh, char *start, char *end, char **vars, uint *count);
+#endif
+
+/* Count the number of trailing zeros in uint32 val
+ * Applying unary minus to unsigned value is intentional,
+ * and doesn't influence counting of trailing zeros
+ */
+static INLINE uint32
+count_trailing_zeros(uint32 val)
+{
+#ifdef BCMDRIVER
+       uint32 c = (uint32)CLZ(val & ((uint32)(-(int)val)));
+#else
+       uint32 c = (uint32)C_bcm_count_leading_zeros(val & ((uint32)(-(int)val)));
+#endif /* BCMDRIVER */
+       return val ? 31u - c : c;
+}
+
+/** Size in bytes of data block, defined by struct with last field, declared as
+ * one/zero element vector - such as wl_uint32_list_t or bcm_xtlv_cbuf_s.
+ * Arguments:
+ * list - address of data block (value is ignored, only type is important)
+ * last_var_len_field - name of last field (usually declared as ...[] or ...[1])
+ * num_elems - number of elements in data block
+ * Example:
+ * wl_uint32_list_t *list;
+ * WL_VAR_LEN_STRUCT_SIZE(list, element, 10);  // Size in bytes of 10-element list
+ */
+#define WL_VAR_LEN_STRUCT_SIZE(list, last_var_len_field, num_elems) \
+       ((size_t)((const char *)&((list)->last_var_len_field) - (const char *)(list)) + \
+       (sizeof((list)->last_var_len_field[0]) * (size_t)(num_elems)))
+
+#endif /* _bcmutils_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmwifi_channels.h b/bcmdhd.101.10.240.x/include/bcmwifi_channels.h
new file mode 100644 (file)
index 0000000..b5243b3
--- /dev/null
@@ -0,0 +1,945 @@
+/*
+ * Misc utility routines for WL and Apps
+ * This header file housing the define and function prototype use by
+ * both the wl driver, tools & Apps.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _bcmwifi_channels_h_
+#define        _bcmwifi_channels_h_
+
+/* A chanspec holds the channel number, band, bandwidth and primary 20MHz sub-band */
+typedef uint16 chanspec_t;
+typedef uint16 chanspec_band_t;
+typedef uint16 chanspec_bw_t;
+typedef uint16 chanspec_subband_t;
+
+/* channel defines */
+#define CH_80MHZ_APART                   16u
+#define CH_40MHZ_APART                    8u
+#define CH_20MHZ_APART                    4u
+#define CH_10MHZ_APART                    2u
+#define CH_5MHZ_APART                     1u    /* 2G band channels are 5 Mhz apart */
+#define CH_160MHZ_APART                  (32u * CH_5MHZ_APART) /* 32 5Mhz-spaces */
+
+#define CH_MIN_2G_CHANNEL                 1u    /* Min channel in 2G band */
+#define CH_MAX_2G_CHANNEL                14u    /* Max channel in 2G band */
+#define CH_MIN_2G_40M_CHANNEL             3u    /* Min 40MHz center channel in 2G band */
+#define CH_MAX_2G_40M_CHANNEL            11u    /* Max 40MHz center channel in 2G band */
+
+#define CH_MIN_6G_CHANNEL                 1u    /* Min 20MHz channel in 6G band */
+#define CH_MAX_6G_CHANNEL               253u    /* Max 20MHz channel in 6G band */
+#define CH_MIN_6G_40M_CHANNEL             3u    /* Min 40MHz center channel in 6G band */
+#define CH_MAX_6G_40M_CHANNEL           227u    /* Max 40MHz center channel in 6G band */
+#define CH_MIN_6G_80M_CHANNEL             7u    /* Min 80MHz center channel in 6G band */
+#define CH_MAX_6G_80M_CHANNEL           215u    /* Max 80MHz center channel in 6G band */
+#define CH_MIN_6G_160M_CHANNEL           15u    /* Min 160MHz center channel in 6G band */
+#define CH_MAX_6G_160M_CHANNEL          207u    /* Max 160MHz center channel in 6G band */
+#define CH_MIN_6G_320M_CHANNEL           31u    /* Min 320MHz center channel in 6G band */
+#define CH_MAX_6G_320M_CHANNEL          199u    /* Max 320MHz center channel in 6G band */
+
+/* maximum # channels the s/w supports */
+#define MAXCHANNEL                      254u    /* max # supported channels.
+                                                * DO NOT MAKE > 255: channels are uint8's all over
+                                                */
+#define MAXCHANNEL_NUM (MAXCHANNEL - 1)        /* max channel number */
+
+#define INVCHANNEL                      255u    /* error value for a bad channel */
+
+/* length of channel vector bitmap is the MAXCHANNEL we want to handle rounded up to a byte */
+/* The actual CHANVEC_LEN fix is leading to high static memory impact
+* in all projects wherein the previous CHANVEC_LEN definition is used.
+*
+* Retaining the previous definition under MAXCHNL_ROM_COMPAT flag.
+* All those chip porgrams where memory impact is observed need to define the same.
+*/
+#ifdef MAXCHNL_ROM_COMPAT
+#define CHANVEC_LEN (MAXCHANNEL + (8 - 1) / 8)
+#else
+#define CHANVEC_LEN ((MAXCHANNEL + (8 - 1)) / 8)
+#endif
+
+/* channel bitvec */
+typedef struct {
+       uint8   vec[CHANVEC_LEN];   /* bitvec of channels */
+} chanvec_t;
+
+/* make sure channel num is within valid range */
+#define CH_NUM_VALID_RANGE(ch_num) ((ch_num) > 0 && (ch_num) <= MAXCHANNEL_NUM)
+
+#define CHSPEC_CTLOVLP(sp1, sp2, sep)  \
+       ((uint)ABS(wf_chspec_ctlchan(sp1) - wf_chspec_ctlchan(sp2)) < (uint)(sep))
+
+/* All builds use the new 11ac ratespec/chanspec */
+#undef  D11AC_IOTYPES
+#define D11AC_IOTYPES
+
+/* For contiguous channel bandwidth other than 320Mhz */
+#define WL_CHANSPEC_CHAN_MASK          0x00ffu
+#define WL_CHANSPEC_CHAN_SHIFT         0u
+
+/* For contiguous channel bandwidth 320Mhz */
+#define WL_CHANSPEC_320_CHAN_MASK      0x0003u
+#define WL_CHANSPEC_320_CHAN_SHIFT     0u
+
+/* For discontiguous channel bandwidth */
+#define WL_CHANSPEC_CHAN0_MASK         0x000fu
+#define WL_CHANSPEC_CHAN0_SHIFT                0u
+#define WL_CHANSPEC_CHAN1_MASK         0x00f0u
+#define WL_CHANSPEC_CHAN1_SHIFT                4u
+
+/* Non-320Mhz channel sideband indication */
+#define WL_CHANSPEC_CTL_SB_MASK                0x0700u
+#define WL_CHANSPEC_CTL_SB_SHIFT       8u
+#define WL_CHANSPEC_CTL_SB_LLL         0x0000u
+#define WL_CHANSPEC_CTL_SB_LLU         0x0100u
+#define WL_CHANSPEC_CTL_SB_LUL         0x0200u
+#define WL_CHANSPEC_CTL_SB_LUU         0x0300u
+#define WL_CHANSPEC_CTL_SB_ULL         0x0400u
+#define WL_CHANSPEC_CTL_SB_ULU         0x0500u
+#define WL_CHANSPEC_CTL_SB_UUL         0x0600u
+#define WL_CHANSPEC_CTL_SB_UUU         0x0700u
+#define WL_CHANSPEC_CTL_SB_LL          WL_CHANSPEC_CTL_SB_LLL
+#define WL_CHANSPEC_CTL_SB_LU          WL_CHANSPEC_CTL_SB_LLU
+#define WL_CHANSPEC_CTL_SB_UL          WL_CHANSPEC_CTL_SB_LUL
+#define WL_CHANSPEC_CTL_SB_UU          WL_CHANSPEC_CTL_SB_LUU
+#define WL_CHANSPEC_CTL_SB_L           WL_CHANSPEC_CTL_SB_LLL
+#define WL_CHANSPEC_CTL_SB_U           WL_CHANSPEC_CTL_SB_LLU
+#define WL_CHANSPEC_CTL_SB_LOWER       WL_CHANSPEC_CTL_SB_LLL
+#define WL_CHANSPEC_CTL_SB_UPPER       WL_CHANSPEC_CTL_SB_LLU
+#define WL_CHANSPEC_CTL_SB_NONE                WL_CHANSPEC_CTL_SB_LLL
+
+/* 320Mhz channel sideband indication */
+#define WL_CHANSPEC_320_SB_MASK                0x0780u
+#define WL_CHANSPEC_320_SB_SHIFT       7u
+
+/* Bandwidth field */
+#define WL_CHANSPEC_BW_MASK            0x3800u
+#define WL_CHANSPEC_BW_SHIFT           11u
+#define WL_CHANSPEC_BW_320             0x0000u
+#define WL_CHANSPEC_BW_160160          0x0800u
+#define WL_CHANSPEC_BW_20              0x1000u
+#define WL_CHANSPEC_BW_40              0x1800u
+#define WL_CHANSPEC_BW_80              0x2000u
+#define WL_CHANSPEC_BW_160             0x2800u
+#define WL_CHANSPEC_BW_8080            0x3000u
+
+/* Band field */
+#define WL_CHANSPEC_BAND_MASK          0xc000u
+#define WL_CHANSPEC_BAND_SHIFT         14u
+#define WL_CHANSPEC_BAND_2G            0x0000u
+#define WL_CHANSPEC_BAND_6G            0x4000u
+#define WL_CHANSPEC_BAND_4G            0x8000u
+#define WL_CHANSPEC_BAND_5G            0xc000u
+
+#define INVCHANSPEC                    255u
+#define MAX_CHANSPEC                   0xFFFFu
+
+#define WL_CHSPEC_BW(chspec)   ((chspec & WL_CHANSPEC_BW_MASK) >> WL_CHANSPEC_BW_SHIFT)
+#define MAX_BW_NUM             (uint8)(((WL_CHANSPEC_BW_MASK) >> WL_CHANSPEC_BW_SHIFT))
+
+#define WL_CHANNEL_BAND(ch)    (((uint)(ch) <= CH_MAX_2G_CHANNEL) ? \
+                                WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G)
+
+/* channel defines */
+#define LOWER_20_SB(channel)           (((channel) > CH_10MHZ_APART) ? \
+                                       ((channel) - CH_10MHZ_APART) : 0)
+#define UPPER_20_SB(channel)           (((channel) < (MAXCHANNEL - CH_10MHZ_APART)) ? \
+                                       ((channel) + CH_10MHZ_APART) : 0)
+
+/* pass a 80MHz channel number (uint8) to get respective LL, UU, LU, UL */
+#define LL_20_SB(channel) (((channel) > 3 * CH_10MHZ_APART) ? ((channel) - 3 * CH_10MHZ_APART) : 0)
+#define UU_20_SB(channel) (((channel) < (MAXCHANNEL - 3 * CH_10MHZ_APART)) ? \
+                          ((channel) + 3 * CH_10MHZ_APART) : 0)
+#define LU_20_SB(channel) LOWER_20_SB(channel)
+#define UL_20_SB(channel) UPPER_20_SB(channel)
+
+#define LOWER_40_SB(channel)           ((channel) - CH_20MHZ_APART)
+#define UPPER_40_SB(channel)           ((channel) + CH_20MHZ_APART)
+
+#ifndef CHSPEC_WLCBANDUNIT
+#define CHSPEC_WLCBANDUNIT(chspec) \
+       ((CHSPEC_IS5G(chspec) || CHSPEC_IS6G(chspec)) ? BAND_5G_INDEX : BAND_2G_INDEX)
+#endif
+#define CH20MHZ_CHSPEC(channel)                (chanspec_t)((chanspec_t)(channel) | WL_CHANSPEC_BW_20 | \
+                                                    WL_CHANNEL_BAND(channel))
+#define NEXT_20MHZ_CHAN(channel)       (((channel) < (MAXCHANNEL - CH_20MHZ_APART)) ? \
+                                       ((channel) + CH_20MHZ_APART) : 0)
+#define CH40MHZ_CHSPEC(channel, ctlsb) (chanspec_t) \
+                                       ((channel) | (ctlsb) | WL_CHANSPEC_BW_40 | \
+                                        WL_CHANNEL_BAND(channel))
+#define CH80MHZ_CHSPEC(channel, ctlsb) (chanspec_t) \
+                                       ((channel) | (ctlsb) | \
+                                        WL_CHANSPEC_BW_80 | WL_CHANSPEC_BAND_5G)
+#define CH160MHZ_CHSPEC(channel, ctlsb)        (chanspec_t) \
+                                       ((channel) | (ctlsb) | \
+                                        WL_CHANSPEC_BW_160 | WL_CHANSPEC_BAND_5G)
+
+/* simple MACROs to get different fields of chanspec */
+#define CHSPEC_CHANNEL(chspec) ((uint8)((chspec) & WL_CHANSPEC_CHAN_MASK))
+#define CHSPEC_CHAN0(chspec)   (((chspec) & WL_CHANSPEC_CHAN0_MASK) >> WL_CHANSPEC_CHAN0_SHIFT)
+#define CHSPEC_CHAN1(chspec)   (((chspec) & WL_CHANSPEC_CHAN1_MASK) >> WL_CHANSPEC_CHAN1_SHIFT)
+#define CHSPEC_BAND(chspec)    ((chspec) & WL_CHANSPEC_BAND_MASK)
+#define CHSPEC_CTL_SB(chspec)  ((chspec) & WL_CHANSPEC_CTL_SB_MASK)
+#define CHSPEC_BW(chspec)      ((chspec) & WL_CHANSPEC_BW_MASK)
+#define CHSPEC_320_CHAN(chspec)        (((chspec) & WL_CHANSPEC_320_CHAN_MASK)>>WL_CHANSPEC_320_CHAN_SHIFT)
+#define CHSPEC_320_SB(chspec)  ((chspec) & WL_CHANSPEC_320_SB_MASK)
+
+#ifdef WL11N_20MHZONLY
+#define CHSPEC_IS20(chspec)    1
+#define CHSPEC_IS20_2G(chspec) ((((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20) && \
+                                CHSPEC_IS2G(chspec))
+#ifndef CHSPEC_IS40
+#define CHSPEC_IS40(chspec)    0
+#endif
+#ifndef CHSPEC_IS80
+#define CHSPEC_IS80(chspec)    0
+#endif
+#ifndef CHSPEC_IS160
+#define CHSPEC_IS160(chspec)   0
+#endif
+#ifndef CHSPEC_IS8080
+#define CHSPEC_IS8080(chspec)  0
+#endif
+#ifndef CHSPEC_IS320
+#define CHSPEC_IS320(chspec)   0
+#endif
+#ifndef CHSPEC_IS160160
+#define CHSPEC_IS160160(chspec)        0
+#endif
+
+/* see FOREACH_20_SB in !WL11N_20MHZONLY section */
+#define FOREACH_20_SB(chspec, channel) \
+               for (channel = CHSPEC_CHANNEL(chspec); channel; channel = 0)
+
+/* see GET_ALL_SB in !WL11N_20MHZONLY section */
+#define GET_ALL_SB(chspec, psb) do { \
+       psb[0] = CHSPEC_CHANNEL(chspec); \
+} while (0)
+
+#else /* !WL11N_20MHZONLY */
+
+#define CHSPEC_IS20(chspec)    (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20)
+#define CHSPEC_IS20_5G(chspec) ((((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20) && \
+                                CHSPEC_IS5G(chspec))
+#ifndef CHSPEC_IS40
+#define CHSPEC_IS40(chspec)    (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40)
+#endif
+#ifndef CHSPEC_IS80
+#define CHSPEC_IS80(chspec)    (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_80)
+#endif
+#ifndef CHSPEC_IS160
+#define CHSPEC_IS160(chspec)   (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_160)
+#endif
+#ifndef CHSPEC_IS8080
+#ifdef WFC_NON_CONT_CHAN
+#define CHSPEC_IS8080(chspec)  (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_8080)
+#else
+#define CHSPEC_IS8080(chspec)  (FALSE)
+#endif
+#endif /* CHSPEC_IS8080 */
+#ifndef CHSPEC_IS320
+#ifdef WL11BE
+#define CHSPEC_IS320(chspec)   (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_320)
+#else
+#define CHSPEC_IS320(chspec)   (FALSE)
+#endif
+#endif /* CHSPEC_IS320 */
+#ifndef CHSPEC_IS160160
+#ifdef WFC_NON_CONT_CHAN
+#define CHSPEC_IS160160(chspec)        (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_160160)
+#else
+#define CHSPEC_IS160160(chspec)        (FALSE)
+#endif
+#endif /* CHSPEC_IS160160 */
+
+/* pass a center channel and get channel offset from it by 10MHz */
+#define CH_OFF_10MHZ_MULTIPLES(channel, offset)                                \
+((uint8) (((offset) < 0) ?                                             \
+         (((channel) > (WL_CHANSPEC_CHAN_MASK & ((uint16)((-(offset)) * CH_10MHZ_APART)))) ? \
+          ((channel) + (offset) * CH_10MHZ_APART) : 0) :               \
+         ((((uint16)(channel) + (uint16)(offset) * CH_10MHZ_APART) < (uint16)MAXCHANNEL) ? \
+          ((channel) + (offset) * CH_10MHZ_APART) : 0)))
+
+uint wf_chspec_first_20_sb(chanspec_t chspec);
+
+#if defined(WL_BW160MHZ)
+/* pass a 160MHz center channel to get 20MHz subband channel numbers */
+#define LLL_20_SB_160(channel)  CH_OFF_10MHZ_MULTIPLES(channel, -7)
+#define LLU_20_SB_160(channel)  CH_OFF_10MHZ_MULTIPLES(channel, -5)
+#define LUL_20_SB_160(channel)  CH_OFF_10MHZ_MULTIPLES(channel, -3)
+#define LUU_20_SB_160(channel)  CH_OFF_10MHZ_MULTIPLES(channel, -1)
+#define ULL_20_SB_160(channel)  CH_OFF_10MHZ_MULTIPLES(channel,  1)
+#define ULU_20_SB_160(channel)  CH_OFF_10MHZ_MULTIPLES(channel,  3)
+#define UUL_20_SB_160(channel)  CH_OFF_10MHZ_MULTIPLES(channel,  5)
+#define UUU_20_SB_160(channel)  CH_OFF_10MHZ_MULTIPLES(channel,  7)
+
+/* given an 80p80 channel, return the lower 80MHz sideband */
+#define LOWER_80_SB(chspec)  (wf_chspec_primary80_channel(chspec) < \
+               wf_chspec_secondary80_channel(chspec) ? \
+               wf_chspec_primary80_channel(chspec) : wf_chspec_secondary80_channel(chspec))
+
+/* given an 80p80 channel, return the upper 80MHz sideband */
+#define UPPER_80_SB(chspec)  (wf_chspec_primary80_channel(chspec) > \
+               wf_chspec_secondary80_channel(chspec) ? \
+               wf_chspec_primary80_channel(chspec) : wf_chspec_secondary80_channel(chspec))
+
+/* pass an 80P80 chanspec (not channel) to get 20MHz subnand channel numbers */
+#define LLL_20_SB_8080(chspec)  CH_OFF_10MHZ_MULTIPLES(LOWER_80_SB(chspec), -3)
+#define LLU_20_SB_8080(chspec)  CH_OFF_10MHZ_MULTIPLES(LOWER_80_SB(chspec), -1)
+#define LUL_20_SB_8080(chspec)  CH_OFF_10MHZ_MULTIPLES(LOWER_80_SB(chspec),  1)
+#define LUU_20_SB_8080(chspec)  CH_OFF_10MHZ_MULTIPLES(LOWER_80_SB(chspec),  3)
+#define ULL_20_SB_8080(chspec)  CH_OFF_10MHZ_MULTIPLES(UPPER_80_SB(chspec), -3)
+#define ULU_20_SB_8080(chspec)  CH_OFF_10MHZ_MULTIPLES(UPPER_80_SB(chspec), -1)
+#define UUL_20_SB_8080(chspec)  CH_OFF_10MHZ_MULTIPLES(UPPER_80_SB(chspec),  1)
+#define UUU_20_SB_8080(chspec)  CH_OFF_10MHZ_MULTIPLES(UPPER_80_SB(chspec),  3)
+
+/* get lowest 20MHz sideband of a given chspec
+ * (works with 20, 40, 80, 160)
+ */
+#define CH_FIRST_20_SB(chspec)  ((uint8) (\
+               CHSPEC_IS160(chspec) ? LLL_20_SB_160(CHSPEC_CHANNEL(chspec)) : (\
+                       CHSPEC_IS80(chspec) ? LL_20_SB(CHSPEC_CHANNEL(chspec)) : (\
+                               CHSPEC_IS40(chspec) ? LOWER_20_SB(CHSPEC_CHANNEL(chspec)) : \
+                                       CHSPEC_CHANNEL(chspec)))))
+
+/* get upper most 20MHz sideband of a given chspec
+ * (works with 20, 40, 80, 160)
+ */
+#define CH_LAST_20_SB(chspec)  ((uint8) (\
+               CHSPEC_IS160(chspec) ? UUU_20_SB_160(CHSPEC_CHANNEL(chspec)) : (\
+                       CHSPEC_IS80(chspec) ? UU_20_SB(CHSPEC_CHANNEL(chspec)) : (\
+                               CHSPEC_IS40(chspec) ? UPPER_20_SB(CHSPEC_CHANNEL(chspec)) : \
+                                       CHSPEC_CHANNEL(chspec)))))
+
+/* call this with chspec and a valid 20MHz sideband of this channel to get the next 20MHz sideband
+ * (works with 20, 40, 80, 160)
+ * resolves to 0 if called with upper most channel
+ */
+#define CH_NEXT_20_SB(chspec, channel)  ((uint8) (\
+                       ((uint8) ((channel) + CH_20MHZ_APART) > CH_LAST_20_SB(chspec) ? 0 : \
+                               ((channel) + CH_20MHZ_APART))))
+
+#else /* WL_BW160MHZ */
+
+#define LLL_20_SB_160(channel)  0
+#define LLU_20_SB_160(channel)  0
+#define LUL_20_SB_160(channel)  0
+#define LUU_20_SB_160(channel)  0
+#define ULL_20_SB_160(channel)  0
+#define ULU_20_SB_160(channel)  0
+#define UUL_20_SB_160(channel)  0
+#define UUU_20_SB_160(channel)  0
+
+#define LOWER_80_SB(chspec)    0
+
+#define UPPER_80_SB(chspec)    0
+
+/* get lowest 20MHz sideband of a given chspec
+ * (works with 20, 40, 80)
+ */
+#define CH_FIRST_20_SB(chspec)  ((uint8) (\
+                       CHSPEC_IS80(chspec) ? LL_20_SB(CHSPEC_CHANNEL(chspec)) : (\
+                               CHSPEC_IS40(chspec) ? LOWER_20_SB(CHSPEC_CHANNEL(chspec)) : \
+                                       CHSPEC_CHANNEL(chspec))))
+/* get upper most 20MHz sideband of a given chspec
+ * (works with 20, 40, 80, 160)
+ */
+#define CH_LAST_20_SB(chspec)  ((uint8) (\
+                       CHSPEC_IS80(chspec) ? UU_20_SB(CHSPEC_CHANNEL(chspec)) : (\
+                               CHSPEC_IS40(chspec) ? UPPER_20_SB(CHSPEC_CHANNEL(chspec)) : \
+                                       CHSPEC_CHANNEL(chspec))))
+
+/* call this with chspec and a valid 20MHz sideband of this channel to get the next 20MHz sideband
+ * (works with 20, 40, 80, 160)
+ * resolves to 0 if called with upper most channel
+ */
+#define CH_NEXT_20_SB(chspec, channel)  ((uint8) (\
+                       ((uint8) ((channel) + CH_20MHZ_APART) > CH_LAST_20_SB(chspec) ? 0 : \
+                               ((channel) + CH_20MHZ_APART))))
+
+#endif /* WL_BW160MHZ */
+
+/* Iterator for 20MHz side bands of a chanspec: (chanspec_t chspec, uint8 channel)
+ * 'chspec' chanspec_t of interest (used in loop, better to pass a resolved value than a macro)
+ * 'channel' must be a variable (not an expression).
+ */
+#define FOREACH_20_SB(chspec, channel) \
+       for (channel = (uint8)wf_chspec_first_20_sb(chspec); channel;   \
+                       channel = CH_NEXT_20_SB((chspec), channel))
+
+/* Uses iterator to populate array with all side bands involved (sorted lower to upper).
+ *     'chspec' chanspec_t of interest
+ *     'psb' pointer to uint8 array of enough size to hold all side bands for the given chspec
+ */
+#define GET_ALL_SB(chspec, psb) do { \
+               uint8 channel, idx = 0; \
+               chanspec_t chspec_local = chspec; \
+               FOREACH_20_SB(chspec_local, channel) \
+                       (psb)[idx++] = channel; \
+} while (0)
+
+/* given a chanspec of any bw, tests if primary20 SB is in lower 20, 40, 80 respectively */
+#define IS_CTL_IN_L20(chspec) !((chspec) & WL_CHANSPEC_CTL_SB_U) /* CTL SB is in low 20 of any 40 */
+#define IS_CTL_IN_L40(chspec) !((chspec) & WL_CHANSPEC_CTL_SB_UL)      /* in low 40 of any 80 */
+#define IS_CTL_IN_L80(chspec) !((chspec) & WL_CHANSPEC_CTL_SB_ULL)     /* in low 80 of 160 */
+
+#endif /* !WL11N_20MHZONLY */
+
+#define BW_LE40(bw)            ((bw) == WL_CHANSPEC_BW_20 || ((bw) == WL_CHANSPEC_BW_40))
+#define BW_LE80(bw)            (BW_LE40(bw) || ((bw) == WL_CHANSPEC_BW_80))
+#define BW_LE160(bw)           (BW_LE80(bw) || ((bw) == WL_CHANSPEC_BW_160))
+
+#define CHSPEC_IS6G(chspec)    (((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_6G)
+#define CHSPEC_IS5G(chspec)    (((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_5G)
+#define CHSPEC_IS2G(chspec)    (((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_2G)
+#define CHSPEC_SB_UPPER(chspec)        \
+       ((((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_UPPER) && \
+       (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40))
+#define CHSPEC_SB_LOWER(chspec)        \
+       ((((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_LOWER) && \
+       (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40))
+
+#ifdef WL_BAND6G
+#define CHSPEC2WLC_BAND(chspec) (CHSPEC_IS2G(chspec) ? WLC_BAND_2G : CHSPEC_IS5G(chspec) ? \
+       WLC_BAND_5G : WLC_BAND_6G)
+#else
+#define CHSPEC2WLC_BAND(chspec) (CHSPEC_IS2G(chspec) ? WLC_BAND_2G : WLC_BAND_5G)
+#endif
+
+#define CHSPEC_BW_CHANGED(prev_chspec, curr_chspec) \
+       (((prev_chspec) & WL_CHANSPEC_BW_MASK) != ((curr_chspec) & WL_CHANSPEC_BW_MASK))
+
+#if (defined(WL_BAND6G) && !defined(WL_BAND6G_DISABLED))
+#define CHSPEC_IS_5G_6G(chspec)                (CHSPEC_IS5G(chspec) || CHSPEC_IS6G(chspec))
+#define CHSPEC_IS20_5G_6G(chspec)      ((((chspec) & \
+                                       WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20) && \
+                                       (CHSPEC_IS5G(chspec) || CHSPEC_IS6G(chspec)))
+#else
+#define CHSPEC_IS_5G_6G(chspec)                (CHSPEC_IS5G(chspec))
+#define CHSPEC_IS20_5G_6G(chspec)      (CHSPEC_IS20_5G(chspec))
+#endif
+
+/**
+ * Number of chars needed for wf_chspec_ntoa() destination character buffer.
+ */
+#ifdef WL11BE
+#define CHANSPEC_STR_LEN    22
+#else
+#define CHANSPEC_STR_LEN    20
+#endif
+
+/*
+ * This function returns TRUE if both the chanspec can co-exist in PHY.
+ * Addition to primary20 channel, the function checks for side band for 2g 40 channels
+ */
+extern bool wf_chspec_coexist(chanspec_t chspec1, chanspec_t chspec2);
+
+#define CHSPEC_IS_BW_160_WIDE(chspec) (CHSPEC_BW(chspec) == WL_CHANSPEC_BW_160 ||\
+       CHSPEC_BW(chspec) == WL_CHANSPEC_BW_8080)
+
+/* BW inequality comparisons, LE (<=), GE (>=), LT (<), GT (>), comparisons can be made
+* as simple numeric comparisons, with the exception that 160 is the same BW as 80+80,
+* but have different numeric values; (WL_CHANSPEC_BW_160 < WL_CHANSPEC_BW_8080).
+*
+* The LT/LE/GT/GE macros check first checks whether both chspec bandwidth and bw are 160 wide.
+* If both chspec bandwidth and bw is not 160 wide, then the comparison is made.
+*/
+#define CHSPEC_BW_GE(chspec, bw) \
+               ((CHSPEC_IS_BW_160_WIDE(chspec) &&\
+               ((bw) == WL_CHANSPEC_BW_160 || (bw) == WL_CHANSPEC_BW_8080)) ||\
+               (CHSPEC_BW(chspec) >= (bw)))
+
+#define CHSPEC_BW_LE(chspec, bw) \
+               ((CHSPEC_IS_BW_160_WIDE(chspec) &&\
+               ((bw) == WL_CHANSPEC_BW_160 || (bw) == WL_CHANSPEC_BW_8080)) ||\
+               (CHSPEC_BW(chspec) <= (bw)))
+
+#define CHSPEC_BW_GT(chspec, bw) \
+               (!(CHSPEC_IS_BW_160_WIDE(chspec) &&\
+               ((bw) == WL_CHANSPEC_BW_160 || (bw) == WL_CHANSPEC_BW_8080)) &&\
+               (CHSPEC_BW(chspec) > (bw)))
+
+#define CHSPEC_BW_LT(chspec, bw) \
+               (!(CHSPEC_IS_BW_160_WIDE(chspec) &&\
+               ((bw) == WL_CHANSPEC_BW_160 || (bw) == WL_CHANSPEC_BW_8080)) &&\
+               (CHSPEC_BW(chspec) < (bw)))
+
+/* Legacy Chanspec defines
+ * These are the defines for the previous format of the chanspec_t
+ */
+#define WL_LCHANSPEC_CHAN_MASK         0x00ff
+#define WL_LCHANSPEC_CHAN_SHIFT                     0
+
+#define WL_LCHANSPEC_CTL_SB_MASK       0x0300
+#define WL_LCHANSPEC_CTL_SB_SHIFT           8
+#define WL_LCHANSPEC_CTL_SB_LOWER      0x0100
+#define WL_LCHANSPEC_CTL_SB_UPPER      0x0200
+#define WL_LCHANSPEC_CTL_SB_NONE       0x0300
+
+#define WL_LCHANSPEC_BW_MASK           0x0C00
+#define WL_LCHANSPEC_BW_SHIFT              10
+#define WL_LCHANSPEC_BW_10             0x0400
+#define WL_LCHANSPEC_BW_20             0x0800
+#define WL_LCHANSPEC_BW_40             0x0C00
+
+#define WL_LCHANSPEC_BAND_MASK         0xf000
+#define WL_LCHANSPEC_BAND_SHIFT                    12
+#define WL_LCHANSPEC_BAND_5G           0x1000
+#define WL_LCHANSPEC_BAND_2G           0x2000
+
+#define LCHSPEC_CHANNEL(chspec)        ((uint8)((chspec) & WL_LCHANSPEC_CHAN_MASK))
+#define LCHSPEC_BAND(chspec)   ((chspec) & WL_LCHANSPEC_BAND_MASK)
+#define LCHSPEC_CTL_SB(chspec) ((chspec) & WL_LCHANSPEC_CTL_SB_MASK)
+#define LCHSPEC_BW(chspec)     ((chspec) & WL_LCHANSPEC_BW_MASK)
+#define LCHSPEC_IS20(chspec)   (((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_20)
+#define LCHSPEC_IS40(chspec)   (((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_40)
+#define LCHSPEC_IS5G(chspec)   (((chspec) & WL_LCHANSPEC_BAND_MASK) == WL_LCHANSPEC_BAND_5G)
+#define LCHSPEC_IS2G(chspec)   (((chspec) & WL_LCHANSPEC_BAND_MASK) == WL_LCHANSPEC_BAND_2G)
+
+#define LCHSPEC_SB_UPPER(chspec)       \
+       ((((chspec) & WL_LCHANSPEC_CTL_SB_MASK) == WL_LCHANSPEC_CTL_SB_UPPER) && \
+       (((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_40))
+#define LCHSPEC_SB_LOWER(chspec)       \
+       ((((chspec) & WL_LCHANSPEC_CTL_SB_MASK) == WL_LCHANSPEC_CTL_SB_LOWER) && \
+       (((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_40))
+
+#define LCHSPEC_CREATE(chan, band, bw, sb)  ((uint16)((chan) | (sb) | (bw) | (band)))
+
+#define CH20MHZ_LCHSPEC(channel) \
+       (chanspec_t)((chanspec_t)(channel) | WL_LCHANSPEC_BW_20 | \
+       WL_LCHANSPEC_CTL_SB_NONE | (((channel) <= CH_MAX_2G_CHANNEL) ? \
+       WL_LCHANSPEC_BAND_2G : WL_LCHANSPEC_BAND_5G))
+
+#define GET_ALL_EXT wf_get_all_ext
+
+/*
+ * WF_CHAN_FACTOR_* constants are used to calculate channel frequency
+ * given a channel number.
+ * chan_freq = chan_factor * 500Mhz + chan_number * 5
+ */
+
+/**
+ * Channel Factor for the starting frequence of 2.4 GHz channels.
+ * The value corresponds to 2407 MHz.
+ */
+#define WF_CHAN_FACTOR_2_4_G           4814u   /* 2.4 GHz band, 2407 MHz */
+
+/**
+ * Channel Factor for the starting frequence of 4.9 GHz channels.
+ * The value corresponds to 4000 MHz.
+ */
+#define WF_CHAN_FACTOR_4_G             8000u   /* 4.9 GHz band for Japan */
+
+/**
+ * Channel Factor for the starting frequence of 5 GHz channels.
+ * The value corresponds to 5000 MHz.
+ */
+#define WF_CHAN_FACTOR_5_G             10000u  /* 5   GHz band, 5000 MHz */
+
+/**
+ * Channel Factor for the starting frequence of 6 GHz channels.
+ * The value corresponds to 5940 MHz.
+ */
+#define WF_CHAN_FACTOR_6_G             11880u  /* 6   GHz band, 5940 MHz */
+
+#define WLC_2G_25MHZ_OFFSET            5       /* 2.4GHz band channel offset */
+
+/**
+ *  No of sub-band value of the specified Mhz chanspec
+ */
+#define WF_NUM_SIDEBANDS_40MHZ   2u
+#define WF_NUM_SIDEBANDS_80MHZ   4u
+#define WF_NUM_SIDEBANDS_160MHZ  8u
+
+/**
+ * Return the chanspec bandwidth in MHz
+ */
+uint wf_bw_chspec_to_mhz(chanspec_t chspec);
+
+/**
+ * Return the bandwidth string for a given chanspec
+ */
+const char *wf_chspec_to_bw_str(chanspec_t chspec);
+
+/**
+ * Convert chanspec to ascii string, or formats hex of an invalid chanspec.
+ */
+char * wf_chspec_ntoa_ex(chanspec_t chspec, char *buf);
+
+/**
+ * Convert chanspec to ascii string, or returns NULL on error.
+ */
+char * wf_chspec_ntoa(chanspec_t chspec, char *buf);
+
+/**
+ * Convert ascii string to chanspec
+ */
+chanspec_t wf_chspec_aton(const char *a);
+
+/**
+ * Verify the chanspec fields are valid for a chanspec_t
+ */
+bool wf_chspec_malformed(chanspec_t chanspec);
+
+/**
+ * Verify the chanspec specifies a valid channel according to 802.11.
+ */
+bool wf_chspec_valid(chanspec_t chanspec);
+
+/**
+ * Verify that the channel is a valid 20MHz channel according to 802.11.
+ */
+bool wf_valid_20MHz_chan(uint channel, chanspec_band_t band);
+
+/**
+ * Verify that the center channel is a valid 40MHz center channel according to 802.11.
+ */
+bool wf_valid_40MHz_center_chan(uint center_channel, chanspec_band_t band);
+
+/**
+ * Verify that the center channel is a valid 80MHz center channel according to 802.11.
+ */
+bool wf_valid_80MHz_center_chan(uint center_channel, chanspec_band_t band);
+
+/**
+ * Verify that the center channel is a valid 160MHz center channel according to 802.11.
+ */
+bool wf_valid_160MHz_center_chan(uint center_channel, chanspec_band_t band);
+
+/**
+ * Verify that the center channel is a valid 320MHz center channel according to 802.11.
+ */
+bool wf_valid_320MHz_center_chan(uint center_channel, chanspec_band_t band);
+
+/**
+ * Create a 20MHz chanspec for the given band.
+ */
+chanspec_t wf_create_20MHz_chspec(uint channel, chanspec_band_t band);
+
+/**
+ * Returns the chanspec for a 40MHz channel given the primary 20MHz channel number,
+ * the center channel number, and the band.
+ */
+chanspec_t wf_create_40MHz_chspec(uint primary_channel, uint center_channel,
+                                  chanspec_band_t band);
+
+/**
+ * Returns the chanspec for a 40MHz channel given the primary 20MHz channel number,
+ * the sub-band for the primary 20MHz channel, and the band.
+ */
+chanspec_t wf_create_40MHz_chspec_primary_sb(uint primary_channel,
+                                             chanspec_subband_t primary_subband,
+                                             chanspec_band_t band);
+/**
+ * Returns the chanspec for an 80MHz channel given the primary 20MHz channel number,
+ * the center channel number, and the band.
+ */
+chanspec_t wf_create_80MHz_chspec(uint primary_channel, uint center_channel,
+                                  chanspec_band_t band);
+
+/**
+ * Returns the chanspec for an 160MHz channel given the primary 20MHz channel number,
+ * the center channel number, and the band.
+ */
+chanspec_t wf_create_160MHz_chspec(uint primary_channel, uint center_channel,
+                                   chanspec_band_t band);
+
+/**
+ * Returns the chanspec for an 320MHz channel given the primary 20MHz channel number,
+ * the center channel number, and the band.
+ */
+chanspec_t wf_create_320MHz_chspec(uint primary_channel, uint center_channel,
+                                   chanspec_band_t band);
+
+/**
+ * Returns the chanspec for an 80+80MHz channel given the primary 20MHz channel number,
+ * the center channel numbers for each frequency segment, and the band.
+ */
+chanspec_t wf_create_8080MHz_chspec(uint primary_channel, uint chan0, uint chan1,
+                                    chanspec_band_t band);
+
+/**
+ * Returns the chanspec for an 160+160MHz channel given the primary 20MHz channel number,
+ * the center channel numbers for each frequency segment, and the band.
+ */
+chanspec_t wf_create_160160MHz_chspec(uint primary_channel, uint chan0, uint chan1,
+                                      chanspec_band_t band);
+/**
+ * Returns the chanspec given the primary 20MHz channel number,
+ * the center channel number, channel width, and the band.
+ *
+ * The channel width must be 20, 40, 80, or 160 MHz. 80+80 MHz chanspec creation
+ * is not handled by this function, use  wf_create_8080MHz_chspec() instead.
+ */
+chanspec_t wf_create_chspec(uint primary_channel, uint center_channel,
+                            chanspec_bw_t bw, chanspec_band_t band);
+
+/**
+ * Returns the chanspec given the primary 20MHz channel number,
+ * channel width, and the band.
+ */
+chanspec_t wf_create_chspec_from_primary(uint primary_channel, chanspec_bw_t bw,
+                                         chanspec_band_t band);
+
+/**
+ * Returns the chanspec given the index of primary 20MHz channel within whole
+ * channel, the center channel number, channel width, and the band.
+ *
+ * The channel width must be 20, 40, 80, or 160 MHz. 80+80 MHz chanspec creation
+ * is not handled by this function, use  wf_create_8080MHz_chspec_prim_idx() instead.
+ */
+chanspec_t wf_create_chspec_sb(uint sb, uint center_channel, chanspec_bw_t bw,
+                               chanspec_band_t band);
+
+/**
+ * Returns the chanspec for an 80+80MHz channel given the index of primary 20MHz
+ * channel within whole channel pair (0-3 if within chan0, 4-7 if within chan1),
+ * the center channel numbers for each frequency segment, and the band.
+ */
+chanspec_t wf_create_8080MHz_chspec_sb(uint sb, uint chan0, uint chan1,
+                                       chanspec_band_t band);
+
+/**
+ * Returns the chanspec for an 160+160MHz channel given the index of primary 20MHz
+ * channel within whole channel pair (0-3 if within chan0, 4-7 if within chan1),
+ * the center channel numbers for each frequency segment, and the band.
+ */
+chanspec_t wf_create_160160MHz_chspec_sb(uint sb, uint chan0, uint chan1,
+                                         chanspec_band_t band);
+
+/**
+ * Return the primary 20MHz channel.
+ */
+uint8 wf_chspec_primary20_chan(chanspec_t chspec);
+
+/* alias for old function name */
+#define wf_chspec_ctlchan(c) wf_chspec_primary20_chan(c)
+
+/**
+ * Return the primary 20MHz chanspec of a given chanspec
+ */
+chanspec_t wf_chspec_primary20_chspec(chanspec_t chspec);
+
+/* alias for old function name */
+#define wf_chspec_ctlchspec(c) wf_chspec_primary20_chspec(c)
+
+/**
+ * Return the primary 40MHz chanspec for a 40MHz or wider channel
+ */
+chanspec_t wf_chspec_primary40_chspec(chanspec_t chspec);
+
+/**
+ * Return the channel number for a given frequency and base frequency
+ */
+int wf_mhz2channel(uint freq, uint start_factor);
+
+/**
+ * Return the center frequency in MHz of the given channel and base frequency.
+ */
+int wf_channel2mhz(uint channel, uint start_factor);
+
+/**
+ * Returns the chanspec 80Mhz channel corresponding to the following input
+ * parameters
+ *
+ *     primary_channel - primary 20Mhz channel
+ *     center_channel   - center frequecny of the 80Mhz channel
+ *
+ * The center_channel can be one of {42, 58, 106, 122, 138, 155}
+ *
+ * returns INVCHANSPEC in case of error
+ */
+extern chanspec_t wf_chspec_80(uint8 center_channel, uint8 primary_channel);
+
+/**
+ * Convert ctl chan and bw to chanspec
+ *
+ * @param      ctl_ch          channel
+ * @param      bw              bandwidth
+ *
+ * @return     > 0 if successful or 0 otherwise
+ *
+ */
+extern uint16 wf_channel2chspec(uint ctl_ch, uint bw);
+
+/*
+ * Returns the 80+80 MHz chanspec corresponding to the following input parameters
+ *
+ *    primary_20mhz - Primary 20 MHz channel
+ *    chan0_80MHz - center channel number of one frequency segment
+ *    chan1_80MHz - center channel number of the other frequency segment
+ *
+ * Parameters chan0_80MHz and chan1_80MHz are channel numbers in {42, 58, 106, 122, 138, 155}.
+ * The primary channel must be contained in one of the 80MHz channels. This routine
+ * will determine which frequency segment is the primary 80 MHz segment.
+ *
+ * Returns INVCHANSPEC in case of error.
+ *
+ * Refer to 802.11-2016 section 22.3.14 "Channelization".
+ */
+extern chanspec_t wf_chspec_get8080_chspec(uint8 primary_20mhz,
+       uint8 chan0_80Mhz, uint8 chan1_80Mhz);
+
+/**
+ * Returns the center channel of the primary 80 MHz sub-band of the provided chanspec
+ *
+ * @param      chspec    input chanspec
+ *
+ * @return     center channel number of the primary 80MHz sub-band of the input.
+ *             Will return the center channel of an input 80MHz chspec.
+ *             Will return INVCHANNEL if the chspec is malformed or less than 80MHz bw.
+ */
+extern uint8 wf_chspec_primary80_channel(chanspec_t chanspec);
+
+/**
+ * Returns the center channel of the secondary 80 MHz sub-band of the provided chanspec
+ *
+ * @param      chspec    input chanspec
+ *
+ * @return     center channel number of the secondary 80MHz sub-band of the input.
+ *             Will return INVCHANNEL if the chspec is malformed or bw is not greater than 80MHz.
+ */
+extern uint8 wf_chspec_secondary80_channel(chanspec_t chanspec);
+
+/**
+ * Returns the chanspec for the primary 80MHz sub-band of an 160MHz or 80+80 channel
+ *
+ * @param      chspec    input chanspec
+ *
+ * @return     An 80MHz chanspec describing the primary 80MHz sub-band of the input.
+ *             Will return an input 80MHz chspec as is.
+ *             Will return INVCHANSPEC if the chspec is malformed or less than 80MHz bw.
+ */
+extern chanspec_t wf_chspec_primary80_chspec(chanspec_t chspec);
+
+/**
+ * Returns the chanspec for the secondary 80MHz sub-band of an 160MHz or 80+80 channel
+ * The sideband in the chanspec is always set to WL_CHANSPEC_CTL_SB_LL since this sub-band
+ * does not contain the primary 20MHz channel.
+ *
+ * @param      chspec    input chanspec
+ *
+ * @return     An 80MHz chanspec describing the secondary 80MHz sub-band of the input.
+ *             Will return INVCHANSPEC if the chspec is malformed or bw is not greater than 80MHz.
+ */
+extern chanspec_t wf_chspec_secondary80_chspec(chanspec_t chspec);
+
+/*
+ * For 160MHz or 80P80 chanspec, set ch[0]/ch[1] to be the low/high 80 Mhz channels
+ *
+ * For 20/40/80MHz chanspec, set ch[0] to be the center freq, and chan[1]=-1
+ */
+extern void wf_chspec_get_80p80_channels(chanspec_t chspec, uint8 *ch);
+
+/* wf_chanspec_iter_... iterator API is deprecated. Use wlc_clm_chanspec_iter_... API instead */
+
+struct wf_iter_range {
+       uint8 start;
+       uint8 end;
+};
+
+/* Internal structure for wf_chanspec_iter_* functions.
+ * Do not directly access the members. Only use the related
+ * functions to query and manipulate the structure.
+ */
+typedef struct chanspec_iter {
+       uint8 state;
+       chanspec_t chanspec;
+       chanspec_band_t band;
+       chanspec_bw_t bw;
+       struct wf_iter_range range;
+       union {
+               uint8 range_id;
+               struct {
+                       uint8 ch0;
+                       uint8 ch1;
+               };
+       };
+} wf_chanspec_iter_t;
+
+/**
+ * Initialize a chanspec iteration structure.
+ * The parameters define the set of chanspecs to generate in the iteration.
+ * After initialization wf_chanspec_iter_current() will return the first chanspec
+ * in the set. A call to wf_chanspec_iter_next() will advance the interation
+ * to the next chanspec in the set.
+ *
+ * Example use:
+ *      wf_chanspec_iter_t iter;
+ *      chanspec_t chanspec;
+ *
+ *      wf_chanspec_iter_init(&iter, band, bw);
+ *
+ *      while (wf_chanspec_iter_next(&iter, &chanspec)) {
+ *              ... do some work ...
+ *      }
+ *
+ * @param iter  pointer to a wf_chanspec_iter_t structure to initialize
+ * @param band  chanspec_band_t value specifying the band of interest
+ * @param bw    chanspec_bw_t value specifying the bandwidth of interest,
+ *              or INVCHANSPEC to specify all bandwidths
+ *
+ * @return a success value, FALSE on error, or TRUE if OK
+ */
+bool wf_chanspec_iter_init(wf_chanspec_iter_t *iter, chanspec_band_t band, chanspec_bw_t bw);
+
+/**
+ * Advance the iteration to the next chanspec in the set.
+ *
+ * @param iter    pointer to a wf_chanspec_iter_t structure
+ * @param chspec  pointer to storage for the next chanspec. Return value will be INVCHANSPEC
+ *                if the iteration ended. Pass in NULL if return value is not desired.
+ *
+ * @return a success value, TRUE if there was another chanspec in the iteration, FALSE if not
+ */
+bool wf_chanspec_iter_next(wf_chanspec_iter_t *iter, chanspec_t *chspec);
+
+/**
+ * Return the current chanspec of the iteration.
+ *
+ * @param iter  pointer to a wf_chanspec_iter_t structure
+ *
+ * @return the current chanspec_t
+ */
+chanspec_t wf_chanspec_iter_current(wf_chanspec_iter_t *iter);
+
+/* Populates array with all 20MHz side bands of a given chanspec_t in the following order:
+ *             primary20, ext20, two ext40s, four ext80s.
+ *     'chspec' is the chanspec of interest
+ *     'pext' must point to an uint8 array of long enough to hold all side bands of the given chspec
+ *
+ * Works with 20, 40, 80 and 160MHz chspec
+ */
+
+extern void wf_get_all_ext(chanspec_t chspec, uint8 *chan_ptr);
+
+/*
+ * Given two chanspecs, returns true if they overlap.
+ * (Overlap: At least one 20MHz subband is common between the two chanspecs provided)
+ */
+extern bool wf_chspec_overlap(chanspec_t chspec0, chanspec_t chspec1);
+
+extern uint8 channel_bw_to_width(chanspec_t chspec);
+
+uint8 wf_chspec_320_id2cch(chanspec_t chanspec);
+
+#endif /* _bcmwifi_channels_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmwifi_rates.h b/bcmdhd.101.10.240.x/include/bcmwifi_rates.h
new file mode 100644 (file)
index 0000000..d712469
--- /dev/null
@@ -0,0 +1,1274 @@
+/*
+ * Indices for 802.11 a/b/g/n/ac 1-3 chain symmetric transmit rates
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _bcmwifi_rates_h_
+#define _bcmwifi_rates_h_
+
+#include <typedefs.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+#define WL_RATESET_SZ_DSSS             4
+#define WL_RATESET_SZ_OFDM             8
+#define WL_RATESET_SZ_VHT_MCS          10
+#define WL_RATESET_SZ_VHT_MCS_P                12      /* 10 VHT rates + 2 proprietary rates */
+#define WL_RATESET_SZ_HE_MCS           12      /* 12 HE rates (mcs 0-11) */
+
+typedef enum wl_he_rates {
+       HE_RATE_MCS0 = 0,
+       HE_RATE_MCS1,
+       HE_RATE_MCS2,
+       HE_RATE_MCS3,
+       HE_RATE_MCS4,
+       HE_RATE_MCS5,
+       HE_RATE_MCS6,
+       HE_RATE_MCS7,
+       HE_RATE_MCS8,
+       HE_RATE_MCS9,
+       HE_RATE_MCS10,
+       HE_RATE_MCS11
+} wl_he_rates_t;
+
+#define WL_RATESET_SZ_HT_MCS   8
+
+#define WL_RATESET_SZ_HT_IOCTL 8       /* MAC histogram, compatibility with wl utility */
+
+#define WL_TX_CHAINS_MAX               4
+
+#define WL_RATE_DISABLED               (-128) /* Power value corresponding to unsupported rate */
+
+/* Transmit channel bandwidths */
+typedef enum wl_tx_bw {
+       WL_TX_BW_20,
+       WL_TX_BW_40,
+       WL_TX_BW_80,
+       WL_TX_BW_20IN40,
+       WL_TX_BW_20IN80,
+       WL_TX_BW_40IN80,
+       WL_TX_BW_160,
+       WL_TX_BW_20IN160,
+       WL_TX_BW_40IN160,
+       WL_TX_BW_80IN160,
+       WL_TX_BW_ALL
+} wl_tx_bw_t;
+
+/*
+ * Transmit modes.
+ * Not all modes are listed here, only those required for disambiguation. e.g. SPEXP is not listed
+ */
+typedef enum wl_tx_mode {
+       WL_TX_MODE_NONE,
+       WL_TX_MODE_STBC,
+       WL_TX_MODE_CDD,
+       WL_TX_MODE_TXBF,
+       WL_NUM_TX_MODES
+} wl_tx_mode_t;
+
+/* Number of transmit chains */
+typedef enum wl_tx_chains {
+       WL_TX_CHAINS_1 = 1,
+       WL_TX_CHAINS_2,
+       WL_TX_CHAINS_3,
+       WL_TX_CHAINS_4
+} wl_tx_chains_t;
+
+/* Number of transmit streams */
+typedef enum wl_tx_nss {
+       WL_TX_NSS_1 = 1,
+       WL_TX_NSS_2,
+       WL_TX_NSS_3,
+       WL_TX_NSS_4
+} wl_tx_nss_t;
+
+/* 802.11ax rate types */
+typedef enum wl_he_rate_type {
+       WL_HE_RT_SU = 0,
+       WL_HE_RT_RU26 = 1,
+       WL_HE_RT_RU52 = 2,
+       WL_HE_RT_RU106 = 3,
+       WL_HE_RT_UB = 4,
+       WL_HE_RT_LUB = 5,
+       WL_HE_RT_RU242 = 6,
+       WL_HE_RT_RU484 = 7,
+       WL_HE_RT_RU996 = 8
+} wl_he_rate_type_t;
+
+#define WL_NUM_HE_RT 9u
+
+/* This enum maps each rate to a CLM index
+ * 802.11ax OFDMA (RU) rates are in separate enum
+ */
+
+typedef enum clm_rates {
+       /************
+       * 1 chain  *
+       ************
+       */
+
+       /* 1 Stream */
+       WL_RATE_1X1_DSSS_1            = 0,
+       WL_RATE_1X1_DSSS_2            = 1,
+       WL_RATE_1X1_DSSS_5_5          = 2,
+       WL_RATE_1X1_DSSS_11           = 3,
+
+       WL_RATE_1X1_OFDM_6            = 4,
+       WL_RATE_1X1_OFDM_9            = 5,
+       WL_RATE_1X1_OFDM_12           = 6,
+       WL_RATE_1X1_OFDM_18           = 7,
+       WL_RATE_1X1_OFDM_24           = 8,
+       WL_RATE_1X1_OFDM_36           = 9,
+       WL_RATE_1X1_OFDM_48           = 10,
+       WL_RATE_1X1_OFDM_54           = 11,
+
+       WL_RATE_1X1_MCS0              = 12,
+       WL_RATE_1X1_MCS1              = 13,
+       WL_RATE_1X1_MCS2              = 14,
+       WL_RATE_1X1_MCS3              = 15,
+       WL_RATE_1X1_MCS4              = 16,
+       WL_RATE_1X1_MCS5              = 17,
+       WL_RATE_1X1_MCS6              = 18,
+       WL_RATE_1X1_MCS7              = 19,
+       WL_RATE_P_1X1_MCS87           = 20,
+       WL_RATE_P_1X1_MCS88           = 21,
+
+       WL_RATE_1X1_VHT0SS1           = 12,
+       WL_RATE_1X1_VHT1SS1           = 13,
+       WL_RATE_1X1_VHT2SS1           = 14,
+       WL_RATE_1X1_VHT3SS1           = 15,
+       WL_RATE_1X1_VHT4SS1           = 16,
+       WL_RATE_1X1_VHT5SS1           = 17,
+       WL_RATE_1X1_VHT6SS1           = 18,
+       WL_RATE_1X1_VHT7SS1           = 19,
+       WL_RATE_1X1_VHT8SS1           = 20,
+       WL_RATE_1X1_VHT9SS1           = 21,
+       WL_RATE_P_1X1_VHT10SS1        = 22,
+       WL_RATE_P_1X1_VHT11SS1        = 23,
+
+       WL_RATE_1X1_HE0SS1            = 24,
+       WL_RATE_1X1_HE1SS1            = 25,
+       WL_RATE_1X1_HE2SS1            = 26,
+       WL_RATE_1X1_HE3SS1            = 27,
+       WL_RATE_1X1_HE4SS1            = 28,
+       WL_RATE_1X1_HE5SS1            = 29,
+       WL_RATE_1X1_HE6SS1            = 30,
+       WL_RATE_1X1_HE7SS1            = 31,
+       WL_RATE_1X1_HE8SS1            = 32,
+       WL_RATE_1X1_HE9SS1            = 33,
+       WL_RATE_1X1_HE10SS1           = 34,
+       WL_RATE_1X1_HE11SS1           = 35,
+
+       /************
+       * 2 chains *
+       ************
+       */
+
+       /* 1 Stream expanded + 1 */
+       WL_RATE_1X2_DSSS_1            = 36,
+       WL_RATE_1X2_DSSS_2            = 37,
+       WL_RATE_1X2_DSSS_5_5          = 38,
+       WL_RATE_1X2_DSSS_11           = 39,
+
+       WL_RATE_1X2_CDD_OFDM_6        = 40,
+       WL_RATE_1X2_CDD_OFDM_9        = 41,
+       WL_RATE_1X2_CDD_OFDM_12       = 42,
+       WL_RATE_1X2_CDD_OFDM_18       = 43,
+       WL_RATE_1X2_CDD_OFDM_24       = 44,
+       WL_RATE_1X2_CDD_OFDM_36       = 45,
+       WL_RATE_1X2_CDD_OFDM_48       = 46,
+       WL_RATE_1X2_CDD_OFDM_54       = 47,
+
+       WL_RATE_1X2_CDD_MCS0          = 48,
+       WL_RATE_1X2_CDD_MCS1          = 49,
+       WL_RATE_1X2_CDD_MCS2          = 50,
+       WL_RATE_1X2_CDD_MCS3          = 51,
+       WL_RATE_1X2_CDD_MCS4          = 52,
+       WL_RATE_1X2_CDD_MCS5          = 53,
+       WL_RATE_1X2_CDD_MCS6          = 54,
+       WL_RATE_1X2_CDD_MCS7          = 55,
+       WL_RATE_P_1X2_CDD_MCS87       = 56,
+       WL_RATE_P_1X2_CDD_MCS88       = 57,
+
+       WL_RATE_1X2_VHT0SS1           = 48,
+       WL_RATE_1X2_VHT1SS1           = 49,
+       WL_RATE_1X2_VHT2SS1           = 50,
+       WL_RATE_1X2_VHT3SS1           = 51,
+       WL_RATE_1X2_VHT4SS1           = 52,
+       WL_RATE_1X2_VHT5SS1           = 53,
+       WL_RATE_1X2_VHT6SS1           = 54,
+       WL_RATE_1X2_VHT7SS1           = 55,
+       WL_RATE_1X2_VHT8SS1           = 56,
+       WL_RATE_1X2_VHT9SS1           = 57,
+       WL_RATE_P_1X2_VHT10SS1        = 58,
+       WL_RATE_P_1X2_VHT11SS1        = 59,
+
+       WL_RATE_1X2_HE0SS1            = 60,
+       WL_RATE_1X2_HE1SS1            = 61,
+       WL_RATE_1X2_HE2SS1            = 62,
+       WL_RATE_1X2_HE3SS1            = 63,
+       WL_RATE_1X2_HE4SS1            = 64,
+       WL_RATE_1X2_HE5SS1            = 65,
+       WL_RATE_1X2_HE6SS1            = 66,
+       WL_RATE_1X2_HE7SS1            = 67,
+       WL_RATE_1X2_HE8SS1            = 68,
+       WL_RATE_1X2_HE9SS1            = 69,
+       WL_RATE_1X2_HE10SS1           = 70,
+       WL_RATE_1X2_HE11SS1           = 71,
+
+       /* 2 Streams */
+       WL_RATE_2X2_STBC_MCS0         = 72,
+       WL_RATE_2X2_STBC_MCS1         = 73,
+       WL_RATE_2X2_STBC_MCS2         = 74,
+       WL_RATE_2X2_STBC_MCS3         = 75,
+       WL_RATE_2X2_STBC_MCS4         = 76,
+       WL_RATE_2X2_STBC_MCS5         = 77,
+       WL_RATE_2X2_STBC_MCS6         = 78,
+       WL_RATE_2X2_STBC_MCS7         = 79,
+       WL_RATE_P_2X2_STBC_MCS87      = 80,
+       WL_RATE_P_2X2_STBC_MCS88      = 81,
+
+       WL_RATE_2X2_STBC_VHT0SS1      = 72,
+       WL_RATE_2X2_STBC_VHT1SS1      = 73,
+       WL_RATE_2X2_STBC_VHT2SS1      = 74,
+       WL_RATE_2X2_STBC_VHT3SS1      = 75,
+       WL_RATE_2X2_STBC_VHT4SS1      = 76,
+       WL_RATE_2X2_STBC_VHT5SS1      = 77,
+       WL_RATE_2X2_STBC_VHT6SS1      = 78,
+       WL_RATE_2X2_STBC_VHT7SS1      = 79,
+       WL_RATE_2X2_STBC_VHT8SS1      = 80,
+       WL_RATE_2X2_STBC_VHT9SS1      = 81,
+       WL_RATE_P_2X2_STBC_VHT10SS1   = 82,
+       WL_RATE_P_2X2_STBC_VHT11SS1   = 83,
+
+       WL_RATE_2X2_SDM_MCS8          = 84,
+       WL_RATE_2X2_SDM_MCS9          = 85,
+       WL_RATE_2X2_SDM_MCS10         = 86,
+       WL_RATE_2X2_SDM_MCS11         = 87,
+       WL_RATE_2X2_SDM_MCS12         = 88,
+       WL_RATE_2X2_SDM_MCS13         = 89,
+       WL_RATE_2X2_SDM_MCS14         = 90,
+       WL_RATE_2X2_SDM_MCS15         = 91,
+       WL_RATE_P_2X2_SDM_MCS99       = 92,
+       WL_RATE_P_2X2_SDM_MCS100      = 93,
+
+       WL_RATE_2X2_VHT0SS2           = 84,
+       WL_RATE_2X2_VHT1SS2           = 85,
+       WL_RATE_2X2_VHT2SS2           = 86,
+       WL_RATE_2X2_VHT3SS2           = 87,
+       WL_RATE_2X2_VHT4SS2           = 88,
+       WL_RATE_2X2_VHT5SS2           = 89,
+       WL_RATE_2X2_VHT6SS2           = 90,
+       WL_RATE_2X2_VHT7SS2           = 91,
+       WL_RATE_2X2_VHT8SS2           = 92,
+       WL_RATE_2X2_VHT9SS2           = 93,
+       WL_RATE_P_2X2_VHT10SS2        = 94,
+       WL_RATE_P_2X2_VHT11SS2        = 95,
+
+       WL_RATE_2X2_HE0SS2            = 96,
+       WL_RATE_2X2_HE1SS2            = 97,
+       WL_RATE_2X2_HE2SS2            = 98,
+       WL_RATE_2X2_HE3SS2            = 99,
+       WL_RATE_2X2_HE4SS2            = 100,
+       WL_RATE_2X2_HE5SS2            = 101,
+       WL_RATE_2X2_HE6SS2            = 102,
+       WL_RATE_2X2_HE7SS2            = 103,
+       WL_RATE_2X2_HE8SS2            = 104,
+       WL_RATE_2X2_HE9SS2            = 105,
+       WL_RATE_2X2_HE10SS2           = 106,
+       WL_RATE_2X2_HE11SS2           = 107,
+
+       /****************************
+        * TX Beamforming, 2 chains *
+        ****************************
+        */
+
+       /* 1 Stream expanded + 1 */
+       WL_RATE_1X2_TXBF_OFDM_6       = 108,
+       WL_RATE_1X2_TXBF_OFDM_9       = 109,
+       WL_RATE_1X2_TXBF_OFDM_12      = 110,
+       WL_RATE_1X2_TXBF_OFDM_18      = 111,
+       WL_RATE_1X2_TXBF_OFDM_24      = 112,
+       WL_RATE_1X2_TXBF_OFDM_36      = 113,
+       WL_RATE_1X2_TXBF_OFDM_48      = 114,
+       WL_RATE_1X2_TXBF_OFDM_54      = 115,
+
+       WL_RATE_1X2_TXBF_MCS0         = 116,
+       WL_RATE_1X2_TXBF_MCS1         = 117,
+       WL_RATE_1X2_TXBF_MCS2         = 118,
+       WL_RATE_1X2_TXBF_MCS3         = 119,
+       WL_RATE_1X2_TXBF_MCS4         = 120,
+       WL_RATE_1X2_TXBF_MCS5         = 121,
+       WL_RATE_1X2_TXBF_MCS6         = 122,
+       WL_RATE_1X2_TXBF_MCS7         = 123,
+       WL_RATE_P_1X2_TXBF_MCS87      = 124,
+       WL_RATE_P_1X2_TXBF_MCS88      = 125,
+
+       WL_RATE_1X2_TXBF_VHT0SS1      = 116,
+       WL_RATE_1X2_TXBF_VHT1SS1      = 117,
+       WL_RATE_1X2_TXBF_VHT2SS1      = 118,
+       WL_RATE_1X2_TXBF_VHT3SS1      = 119,
+       WL_RATE_1X2_TXBF_VHT4SS1      = 120,
+       WL_RATE_1X2_TXBF_VHT5SS1      = 121,
+       WL_RATE_1X2_TXBF_VHT6SS1      = 122,
+       WL_RATE_1X2_TXBF_VHT7SS1      = 123,
+       WL_RATE_1X2_TXBF_VHT8SS1      = 124,
+       WL_RATE_1X2_TXBF_VHT9SS1      = 125,
+       WL_RATE_P_1X2_TXBF_VHT10SS1   = 126,
+       WL_RATE_P_1X2_TXBF_VHT11SS1   = 127,
+
+       WL_RATE_1X2_TXBF_HE0SS1       = 128,
+       WL_RATE_1X2_TXBF_HE1SS1       = 129,
+       WL_RATE_1X2_TXBF_HE2SS1       = 130,
+       WL_RATE_1X2_TXBF_HE3SS1       = 131,
+       WL_RATE_1X2_TXBF_HE4SS1       = 132,
+       WL_RATE_1X2_TXBF_HE5SS1       = 133,
+       WL_RATE_1X2_TXBF_HE6SS1       = 134,
+       WL_RATE_1X2_TXBF_HE7SS1       = 135,
+       WL_RATE_1X2_TXBF_HE8SS1       = 136,
+       WL_RATE_1X2_TXBF_HE9SS1       = 137,
+       WL_RATE_1X2_TXBF_HE10SS1      = 138,
+       WL_RATE_1X2_TXBF_HE11SS1      = 139,
+
+       /* 2 Streams */
+       WL_RATE_2X2_TXBF_SDM_MCS8     = 140,
+       WL_RATE_2X2_TXBF_SDM_MCS9     = 141,
+       WL_RATE_2X2_TXBF_SDM_MCS10    = 142,
+       WL_RATE_2X2_TXBF_SDM_MCS11    = 143,
+       WL_RATE_2X2_TXBF_SDM_MCS12    = 144,
+       WL_RATE_2X2_TXBF_SDM_MCS13    = 145,
+       WL_RATE_2X2_TXBF_SDM_MCS14    = 146,
+       WL_RATE_2X2_TXBF_SDM_MCS15    = 147,
+       WL_RATE_P_2X2_TXBF_SDM_MCS99  = 148,
+       WL_RATE_P_2X2_TXBF_SDM_MCS100 = 149,
+
+       WL_RATE_2X2_TXBF_VHT0SS2      = 140,
+       WL_RATE_2X2_TXBF_VHT1SS2      = 141,
+       WL_RATE_2X2_TXBF_VHT2SS2      = 142,
+       WL_RATE_2X2_TXBF_VHT3SS2      = 143,
+       WL_RATE_2X2_TXBF_VHT4SS2      = 144,
+       WL_RATE_2X2_TXBF_VHT5SS2      = 145,
+       WL_RATE_2X2_TXBF_VHT6SS2      = 146,
+       WL_RATE_2X2_TXBF_VHT7SS2      = 147,
+       WL_RATE_2X2_TXBF_VHT8SS2      = 148,
+       WL_RATE_2X2_TXBF_VHT9SS2      = 149,
+       WL_RATE_P_2X2_TXBF_VHT10SS2   = 150,
+       WL_RATE_P_2X2_TXBF_VHT11SS2   = 151,
+
+       WL_RATE_2X2_TXBF_HE0SS2       = 152,
+       WL_RATE_2X2_TXBF_HE1SS2       = 153,
+       WL_RATE_2X2_TXBF_HE2SS2       = 154,
+       WL_RATE_2X2_TXBF_HE3SS2       = 155,
+       WL_RATE_2X2_TXBF_HE4SS2       = 156,
+       WL_RATE_2X2_TXBF_HE5SS2       = 157,
+       WL_RATE_2X2_TXBF_HE6SS2       = 158,
+       WL_RATE_2X2_TXBF_HE7SS2       = 159,
+       WL_RATE_2X2_TXBF_HE8SS2       = 160,
+       WL_RATE_2X2_TXBF_HE9SS2       = 161,
+       WL_RATE_2X2_TXBF_HE10SS2      = 162,
+       WL_RATE_2X2_TXBF_HE11SS2      = 163,
+
+       /************
+       * 3 chains *
+       ************
+       */
+
+       /* 1 Stream expanded + 2 */
+       WL_RATE_1X3_DSSS_1            = 164,
+       WL_RATE_1X3_DSSS_2            = 165,
+       WL_RATE_1X3_DSSS_5_5          = 166,
+       WL_RATE_1X3_DSSS_11           = 167,
+
+       WL_RATE_1X3_CDD_OFDM_6        = 168,
+       WL_RATE_1X3_CDD_OFDM_9        = 169,
+       WL_RATE_1X3_CDD_OFDM_12       = 170,
+       WL_RATE_1X3_CDD_OFDM_18       = 171,
+       WL_RATE_1X3_CDD_OFDM_24       = 172,
+       WL_RATE_1X3_CDD_OFDM_36       = 173,
+       WL_RATE_1X3_CDD_OFDM_48       = 174,
+       WL_RATE_1X3_CDD_OFDM_54       = 175,
+
+       WL_RATE_1X3_CDD_MCS0          = 176,
+       WL_RATE_1X3_CDD_MCS1          = 177,
+       WL_RATE_1X3_CDD_MCS2          = 178,
+       WL_RATE_1X3_CDD_MCS3          = 179,
+       WL_RATE_1X3_CDD_MCS4          = 180,
+       WL_RATE_1X3_CDD_MCS5          = 181,
+       WL_RATE_1X3_CDD_MCS6          = 182,
+       WL_RATE_1X3_CDD_MCS7          = 183,
+       WL_RATE_P_1X3_CDD_MCS87       = 184,
+       WL_RATE_P_1X3_CDD_MCS88       = 185,
+
+       WL_RATE_1X3_VHT0SS1           = 176,
+       WL_RATE_1X3_VHT1SS1           = 177,
+       WL_RATE_1X3_VHT2SS1           = 178,
+       WL_RATE_1X3_VHT3SS1           = 179,
+       WL_RATE_1X3_VHT4SS1           = 180,
+       WL_RATE_1X3_VHT5SS1           = 181,
+       WL_RATE_1X3_VHT6SS1           = 182,
+       WL_RATE_1X3_VHT7SS1           = 183,
+       WL_RATE_1X3_VHT8SS1           = 184,
+       WL_RATE_1X3_VHT9SS1           = 185,
+       WL_RATE_P_1X3_VHT10SS1        = 186,
+       WL_RATE_P_1X3_VHT11SS1        = 187,
+
+       WL_RATE_1X3_HE0SS1            = 188,
+       WL_RATE_1X3_HE1SS1            = 189,
+       WL_RATE_1X3_HE2SS1            = 190,
+       WL_RATE_1X3_HE3SS1            = 191,
+       WL_RATE_1X3_HE4SS1            = 192,
+       WL_RATE_1X3_HE5SS1            = 193,
+       WL_RATE_1X3_HE6SS1            = 194,
+       WL_RATE_1X3_HE7SS1            = 195,
+       WL_RATE_1X3_HE8SS1            = 196,
+       WL_RATE_1X3_HE9SS1            = 197,
+       WL_RATE_1X3_HE10SS1           = 198,
+       WL_RATE_1X3_HE11SS1           = 199,
+
+       /* 2 Streams expanded + 1 */
+       WL_RATE_2X3_STBC_MCS0         = 200,
+       WL_RATE_2X3_STBC_MCS1         = 201,
+       WL_RATE_2X3_STBC_MCS2         = 202,
+       WL_RATE_2X3_STBC_MCS3         = 203,
+       WL_RATE_2X3_STBC_MCS4         = 204,
+       WL_RATE_2X3_STBC_MCS5         = 205,
+       WL_RATE_2X3_STBC_MCS6         = 206,
+       WL_RATE_2X3_STBC_MCS7         = 207,
+       WL_RATE_P_2X3_STBC_MCS87      = 208,
+       WL_RATE_P_2X3_STBC_MCS88      = 209,
+
+       WL_RATE_2X3_STBC_VHT0SS1      = 200,
+       WL_RATE_2X3_STBC_VHT1SS1      = 201,
+       WL_RATE_2X3_STBC_VHT2SS1      = 202,
+       WL_RATE_2X3_STBC_VHT3SS1      = 203,
+       WL_RATE_2X3_STBC_VHT4SS1      = 204,
+       WL_RATE_2X3_STBC_VHT5SS1      = 205,
+       WL_RATE_2X3_STBC_VHT6SS1      = 206,
+       WL_RATE_2X3_STBC_VHT7SS1      = 207,
+       WL_RATE_2X3_STBC_VHT8SS1      = 208,
+       WL_RATE_2X3_STBC_VHT9SS1      = 209,
+       WL_RATE_P_2X3_STBC_VHT10SS1   = 210,
+       WL_RATE_P_2X3_STBC_VHT11SS1   = 211,
+
+       WL_RATE_2X3_SDM_MCS8          = 212,
+       WL_RATE_2X3_SDM_MCS9          = 213,
+       WL_RATE_2X3_SDM_MCS10         = 214,
+       WL_RATE_2X3_SDM_MCS11         = 215,
+       WL_RATE_2X3_SDM_MCS12         = 216,
+       WL_RATE_2X3_SDM_MCS13         = 217,
+       WL_RATE_2X3_SDM_MCS14         = 218,
+       WL_RATE_2X3_SDM_MCS15         = 219,
+       WL_RATE_P_2X3_SDM_MCS99       = 220,
+       WL_RATE_P_2X3_SDM_MCS100      = 221,
+
+       WL_RATE_2X3_VHT0SS2           = 212,
+       WL_RATE_2X3_VHT1SS2           = 213,
+       WL_RATE_2X3_VHT2SS2           = 214,
+       WL_RATE_2X3_VHT3SS2           = 215,
+       WL_RATE_2X3_VHT4SS2           = 216,
+       WL_RATE_2X3_VHT5SS2           = 217,
+       WL_RATE_2X3_VHT6SS2           = 218,
+       WL_RATE_2X3_VHT7SS2           = 219,
+       WL_RATE_2X3_VHT8SS2           = 220,
+       WL_RATE_2X3_VHT9SS2           = 221,
+       WL_RATE_P_2X3_VHT10SS2        = 222,
+       WL_RATE_P_2X3_VHT11SS2        = 223,
+
+       WL_RATE_2X3_HE0SS2            = 224,
+       WL_RATE_2X3_HE1SS2            = 225,
+       WL_RATE_2X3_HE2SS2            = 226,
+       WL_RATE_2X3_HE3SS2            = 227,
+       WL_RATE_2X3_HE4SS2            = 228,
+       WL_RATE_2X3_HE5SS2            = 229,
+       WL_RATE_2X3_HE6SS2            = 230,
+       WL_RATE_2X3_HE7SS2            = 231,
+       WL_RATE_2X3_HE8SS2            = 232,
+       WL_RATE_2X3_HE9SS2            = 233,
+       WL_RATE_2X3_HE10SS2           = 234,
+       WL_RATE_2X3_HE11SS2           = 235,
+
+       /* 3 Streams */
+       WL_RATE_3X3_SDM_MCS16         = 236,
+       WL_RATE_3X3_SDM_MCS17         = 237,
+       WL_RATE_3X3_SDM_MCS18         = 238,
+       WL_RATE_3X3_SDM_MCS19         = 239,
+       WL_RATE_3X3_SDM_MCS20         = 240,
+       WL_RATE_3X3_SDM_MCS21         = 241,
+       WL_RATE_3X3_SDM_MCS22         = 242,
+       WL_RATE_3X3_SDM_MCS23         = 243,
+       WL_RATE_P_3X3_SDM_MCS101      = 244,
+       WL_RATE_P_3X3_SDM_MCS102      = 245,
+
+       WL_RATE_3X3_VHT0SS3           = 236,
+       WL_RATE_3X3_VHT1SS3           = 237,
+       WL_RATE_3X3_VHT2SS3           = 238,
+       WL_RATE_3X3_VHT3SS3           = 239,
+       WL_RATE_3X3_VHT4SS3           = 240,
+       WL_RATE_3X3_VHT5SS3           = 241,
+       WL_RATE_3X3_VHT6SS3           = 242,
+       WL_RATE_3X3_VHT7SS3           = 243,
+       WL_RATE_3X3_VHT8SS3           = 244,
+       WL_RATE_3X3_VHT9SS3           = 245,
+       WL_RATE_P_3X3_VHT10SS3        = 246,
+       WL_RATE_P_3X3_VHT11SS3        = 247,
+
+       WL_RATE_3X3_HE0SS3            = 248,
+       WL_RATE_3X3_HE1SS3            = 249,
+       WL_RATE_3X3_HE2SS3            = 250,
+       WL_RATE_3X3_HE3SS3            = 251,
+       WL_RATE_3X3_HE4SS3            = 252,
+       WL_RATE_3X3_HE5SS3            = 253,
+       WL_RATE_3X3_HE6SS3            = 254,
+       WL_RATE_3X3_HE7SS3            = 255,
+       WL_RATE_3X3_HE8SS3            = 256,
+       WL_RATE_3X3_HE9SS3            = 257,
+       WL_RATE_3X3_HE10SS3           = 258,
+       WL_RATE_3X3_HE11SS3           = 259,
+
+       /****************************
+        * TX Beamforming, 3 chains *
+        ****************************
+        */
+
+       /* 1 Stream expanded + 2 */
+       WL_RATE_1X3_TXBF_OFDM_6       = 260,
+       WL_RATE_1X3_TXBF_OFDM_9       = 261,
+       WL_RATE_1X3_TXBF_OFDM_12      = 262,
+       WL_RATE_1X3_TXBF_OFDM_18      = 263,
+       WL_RATE_1X3_TXBF_OFDM_24      = 264,
+       WL_RATE_1X3_TXBF_OFDM_36      = 265,
+       WL_RATE_1X3_TXBF_OFDM_48      = 266,
+       WL_RATE_1X3_TXBF_OFDM_54      = 267,
+
+       WL_RATE_1X3_TXBF_MCS0         = 268,
+       WL_RATE_1X3_TXBF_MCS1         = 269,
+       WL_RATE_1X3_TXBF_MCS2         = 270,
+       WL_RATE_1X3_TXBF_MCS3         = 271,
+       WL_RATE_1X3_TXBF_MCS4         = 272,
+       WL_RATE_1X3_TXBF_MCS5         = 273,
+       WL_RATE_1X3_TXBF_MCS6         = 274,
+       WL_RATE_1X3_TXBF_MCS7         = 275,
+       WL_RATE_P_1X3_TXBF_MCS87      = 276,
+       WL_RATE_P_1X3_TXBF_MCS88      = 277,
+
+       WL_RATE_1X3_TXBF_VHT0SS1      = 268,
+       WL_RATE_1X3_TXBF_VHT1SS1      = 269,
+       WL_RATE_1X3_TXBF_VHT2SS1      = 270,
+       WL_RATE_1X3_TXBF_VHT3SS1      = 271,
+       WL_RATE_1X3_TXBF_VHT4SS1      = 272,
+       WL_RATE_1X3_TXBF_VHT5SS1      = 273,
+       WL_RATE_1X3_TXBF_VHT6SS1      = 274,
+       WL_RATE_1X3_TXBF_VHT7SS1      = 275,
+       WL_RATE_1X3_TXBF_VHT8SS1      = 276,
+       WL_RATE_1X3_TXBF_VHT9SS1      = 277,
+       WL_RATE_P_1X3_TXBF_VHT10SS1   = 278,
+       WL_RATE_P_1X3_TXBF_VHT11SS1   = 279,
+
+       WL_RATE_1X3_TXBF_HE0SS1       = 280,
+       WL_RATE_1X3_TXBF_HE1SS1       = 281,
+       WL_RATE_1X3_TXBF_HE2SS1       = 282,
+       WL_RATE_1X3_TXBF_HE3SS1       = 283,
+       WL_RATE_1X3_TXBF_HE4SS1       = 284,
+       WL_RATE_1X3_TXBF_HE5SS1       = 285,
+       WL_RATE_1X3_TXBF_HE6SS1       = 286,
+       WL_RATE_1X3_TXBF_HE7SS1       = 287,
+       WL_RATE_1X3_TXBF_HE8SS1       = 288,
+       WL_RATE_1X3_TXBF_HE9SS1       = 289,
+       WL_RATE_1X3_TXBF_HE10SS1      = 290,
+       WL_RATE_1X3_TXBF_HE11SS1      = 291,
+
+       /* 2 Streams expanded + 1 */
+       WL_RATE_2X3_TXBF_SDM_MCS8     = 292,
+       WL_RATE_2X3_TXBF_SDM_MCS9     = 293,
+       WL_RATE_2X3_TXBF_SDM_MCS10    = 294,
+       WL_RATE_2X3_TXBF_SDM_MCS11    = 295,
+       WL_RATE_2X3_TXBF_SDM_MCS12    = 296,
+       WL_RATE_2X3_TXBF_SDM_MCS13    = 297,
+       WL_RATE_2X3_TXBF_SDM_MCS14    = 298,
+       WL_RATE_2X3_TXBF_SDM_MCS15    = 299,
+       WL_RATE_P_2X3_TXBF_SDM_MCS99  = 300,
+       WL_RATE_P_2X3_TXBF_SDM_MCS100 = 301,
+
+       WL_RATE_2X3_TXBF_VHT0SS2      = 292,
+       WL_RATE_2X3_TXBF_VHT1SS2      = 293,
+       WL_RATE_2X3_TXBF_VHT2SS2      = 294,
+       WL_RATE_2X3_TXBF_VHT3SS2      = 295,
+       WL_RATE_2X3_TXBF_VHT4SS2      = 296,
+       WL_RATE_2X3_TXBF_VHT5SS2      = 297,
+       WL_RATE_2X3_TXBF_VHT6SS2      = 298,
+       WL_RATE_2X3_TXBF_VHT7SS2      = 299,
+       WL_RATE_2X3_TXBF_VHT8SS2      = 300,
+       WL_RATE_2X3_TXBF_VHT9SS2      = 301,
+       WL_RATE_P_2X3_TXBF_VHT10SS2   = 302,
+       WL_RATE_P_2X3_TXBF_VHT11SS2   = 303,
+
+       WL_RATE_2X3_TXBF_HE0SS2       = 304,
+       WL_RATE_2X3_TXBF_HE1SS2       = 305,
+       WL_RATE_2X3_TXBF_HE2SS2       = 306,
+       WL_RATE_2X3_TXBF_HE3SS2       = 307,
+       WL_RATE_2X3_TXBF_HE4SS2       = 308,
+       WL_RATE_2X3_TXBF_HE5SS2       = 309,
+       WL_RATE_2X3_TXBF_HE6SS2       = 310,
+       WL_RATE_2X3_TXBF_HE7SS2       = 311,
+       WL_RATE_2X3_TXBF_HE8SS2       = 312,
+       WL_RATE_2X3_TXBF_HE9SS2       = 313,
+       WL_RATE_2X3_TXBF_HE10SS2      = 314,
+       WL_RATE_2X3_TXBF_HE11SS2      = 315,
+
+       /* 3 Streams */
+       WL_RATE_3X3_TXBF_SDM_MCS16    = 316,
+       WL_RATE_3X3_TXBF_SDM_MCS17    = 317,
+       WL_RATE_3X3_TXBF_SDM_MCS18    = 318,
+       WL_RATE_3X3_TXBF_SDM_MCS19    = 319,
+       WL_RATE_3X3_TXBF_SDM_MCS20    = 320,
+       WL_RATE_3X3_TXBF_SDM_MCS21    = 321,
+       WL_RATE_3X3_TXBF_SDM_MCS22    = 322,
+       WL_RATE_3X3_TXBF_SDM_MCS23    = 323,
+       WL_RATE_P_3X3_TXBF_SDM_MCS101 = 324,
+       WL_RATE_P_3X3_TXBF_SDM_MCS102 = 325,
+
+       WL_RATE_3X3_TXBF_VHT0SS3      = 316,
+       WL_RATE_3X3_TXBF_VHT1SS3      = 317,
+       WL_RATE_3X3_TXBF_VHT2SS3      = 318,
+       WL_RATE_3X3_TXBF_VHT3SS3      = 319,
+       WL_RATE_3X3_TXBF_VHT4SS3      = 320,
+       WL_RATE_3X3_TXBF_VHT5SS3      = 321,
+       WL_RATE_3X3_TXBF_VHT6SS3      = 322,
+       WL_RATE_3X3_TXBF_VHT7SS3      = 323,
+       WL_RATE_3X3_TXBF_VHT8SS3      = 324,
+       WL_RATE_3X3_TXBF_VHT9SS3      = 325,
+       WL_RATE_P_3X3_TXBF_VHT10SS3   = 326,
+       WL_RATE_P_3X3_TXBF_VHT11SS3   = 327,
+
+       WL_RATE_3X3_TXBF_HE0SS3       = 328,
+       WL_RATE_3X3_TXBF_HE1SS3       = 329,
+       WL_RATE_3X3_TXBF_HE2SS3       = 330,
+       WL_RATE_3X3_TXBF_HE3SS3       = 331,
+       WL_RATE_3X3_TXBF_HE4SS3       = 332,
+       WL_RATE_3X3_TXBF_HE5SS3       = 333,
+       WL_RATE_3X3_TXBF_HE6SS3       = 334,
+       WL_RATE_3X3_TXBF_HE7SS3       = 335,
+       WL_RATE_3X3_TXBF_HE8SS3       = 336,
+       WL_RATE_3X3_TXBF_HE9SS3       = 337,
+       WL_RATE_3X3_TXBF_HE10SS3      = 338,
+       WL_RATE_3X3_TXBF_HE11SS3      = 339,
+
+       /************
+       * 4 chains *
+       ************
+       */
+
+       /* 1 Stream expanded + 3 */
+       WL_RATE_1X4_DSSS_1            = 340,
+       WL_RATE_1X4_DSSS_2            = 341,
+       WL_RATE_1X4_DSSS_5_5          = 342,
+       WL_RATE_1X4_DSSS_11           = 343,
+
+       WL_RATE_1X4_CDD_OFDM_6        = 344,
+       WL_RATE_1X4_CDD_OFDM_9        = 345,
+       WL_RATE_1X4_CDD_OFDM_12       = 346,
+       WL_RATE_1X4_CDD_OFDM_18       = 347,
+       WL_RATE_1X4_CDD_OFDM_24       = 348,
+       WL_RATE_1X4_CDD_OFDM_36       = 349,
+       WL_RATE_1X4_CDD_OFDM_48       = 350,
+       WL_RATE_1X4_CDD_OFDM_54       = 351,
+
+       WL_RATE_1X4_CDD_MCS0          = 352,
+       WL_RATE_1X4_CDD_MCS1          = 353,
+       WL_RATE_1X4_CDD_MCS2          = 354,
+       WL_RATE_1X4_CDD_MCS3          = 355,
+       WL_RATE_1X4_CDD_MCS4          = 356,
+       WL_RATE_1X4_CDD_MCS5          = 357,
+       WL_RATE_1X4_CDD_MCS6          = 358,
+       WL_RATE_1X4_CDD_MCS7          = 359,
+       WL_RATE_P_1X4_CDD_MCS87       = 360,
+       WL_RATE_P_1X4_CDD_MCS88       = 361,
+
+       WL_RATE_1X4_VHT0SS1           = 352,
+       WL_RATE_1X4_VHT1SS1           = 353,
+       WL_RATE_1X4_VHT2SS1           = 354,
+       WL_RATE_1X4_VHT3SS1           = 355,
+       WL_RATE_1X4_VHT4SS1           = 356,
+       WL_RATE_1X4_VHT5SS1           = 357,
+       WL_RATE_1X4_VHT6SS1           = 358,
+       WL_RATE_1X4_VHT7SS1           = 359,
+       WL_RATE_1X4_VHT8SS1           = 360,
+       WL_RATE_1X4_VHT9SS1           = 361,
+       WL_RATE_P_1X4_VHT10SS1        = 362,
+       WL_RATE_P_1X4_VHT11SS1        = 363,
+
+       WL_RATE_1X4_HE0SS1            = 364,
+       WL_RATE_1X4_HE1SS1            = 365,
+       WL_RATE_1X4_HE2SS1            = 366,
+       WL_RATE_1X4_HE3SS1            = 367,
+       WL_RATE_1X4_HE4SS1            = 368,
+       WL_RATE_1X4_HE5SS1            = 369,
+       WL_RATE_1X4_HE6SS1            = 370,
+       WL_RATE_1X4_HE7SS1            = 371,
+       WL_RATE_1X4_HE8SS1            = 372,
+       WL_RATE_1X4_HE9SS1            = 373,
+       WL_RATE_1X4_HE10SS1           = 374,
+       WL_RATE_1X4_HE11SS1           = 375,
+
+       /* 2 Streams expanded + 2 */
+       WL_RATE_2X4_STBC_MCS0         = 376,
+       WL_RATE_2X4_STBC_MCS1         = 377,
+       WL_RATE_2X4_STBC_MCS2         = 378,
+       WL_RATE_2X4_STBC_MCS3         = 379,
+       WL_RATE_2X4_STBC_MCS4         = 380,
+       WL_RATE_2X4_STBC_MCS5         = 381,
+       WL_RATE_2X4_STBC_MCS6         = 382,
+       WL_RATE_2X4_STBC_MCS7         = 383,
+       WL_RATE_P_2X4_STBC_MCS87      = 384,
+       WL_RATE_P_2X4_STBC_MCS88      = 385,
+
+       WL_RATE_2X4_STBC_VHT0SS1      = 376,
+       WL_RATE_2X4_STBC_VHT1SS1      = 377,
+       WL_RATE_2X4_STBC_VHT2SS1      = 378,
+       WL_RATE_2X4_STBC_VHT3SS1      = 379,
+       WL_RATE_2X4_STBC_VHT4SS1      = 380,
+       WL_RATE_2X4_STBC_VHT5SS1      = 381,
+       WL_RATE_2X4_STBC_VHT6SS1      = 382,
+       WL_RATE_2X4_STBC_VHT7SS1      = 383,
+       WL_RATE_2X4_STBC_VHT8SS1      = 384,
+       WL_RATE_2X4_STBC_VHT9SS1      = 385,
+       WL_RATE_P_2X4_STBC_VHT10SS1   = 386,
+       WL_RATE_P_2X4_STBC_VHT11SS1   = 387,
+
+       WL_RATE_2X4_SDM_MCS8          = 388,
+       WL_RATE_2X4_SDM_MCS9          = 389,
+       WL_RATE_2X4_SDM_MCS10         = 390,
+       WL_RATE_2X4_SDM_MCS11         = 391,
+       WL_RATE_2X4_SDM_MCS12         = 392,
+       WL_RATE_2X4_SDM_MCS13         = 393,
+       WL_RATE_2X4_SDM_MCS14         = 394,
+       WL_RATE_2X4_SDM_MCS15         = 395,
+       WL_RATE_P_2X4_SDM_MCS99       = 396,
+       WL_RATE_P_2X4_SDM_MCS100      = 397,
+
+       WL_RATE_2X4_VHT0SS2           = 388,
+       WL_RATE_2X4_VHT1SS2           = 389,
+       WL_RATE_2X4_VHT2SS2           = 390,
+       WL_RATE_2X4_VHT3SS2           = 391,
+       WL_RATE_2X4_VHT4SS2           = 392,
+       WL_RATE_2X4_VHT5SS2           = 393,
+       WL_RATE_2X4_VHT6SS2           = 394,
+       WL_RATE_2X4_VHT7SS2           = 395,
+       WL_RATE_2X4_VHT8SS2           = 396,
+       WL_RATE_2X4_VHT9SS2           = 397,
+       WL_RATE_P_2X4_VHT10SS2        = 398,
+       WL_RATE_P_2X4_VHT11SS2        = 399,
+
+       WL_RATE_2X4_HE0SS2            = 400,
+       WL_RATE_2X4_HE1SS2            = 401,
+       WL_RATE_2X4_HE2SS2            = 402,
+       WL_RATE_2X4_HE3SS2            = 403,
+       WL_RATE_2X4_HE4SS2            = 404,
+       WL_RATE_2X4_HE5SS2            = 405,
+       WL_RATE_2X4_HE6SS2            = 406,
+       WL_RATE_2X4_HE7SS2            = 407,
+       WL_RATE_2X4_HE8SS2            = 408,
+       WL_RATE_2X4_HE9SS2            = 409,
+       WL_RATE_2X4_HE10SS2           = 410,
+       WL_RATE_2X4_HE11SS2           = 411,
+
+       /* 3 Streams expanded + 1 */
+       WL_RATE_3X4_SDM_MCS16         = 412,
+       WL_RATE_3X4_SDM_MCS17         = 413,
+       WL_RATE_3X4_SDM_MCS18         = 414,
+       WL_RATE_3X4_SDM_MCS19         = 415,
+       WL_RATE_3X4_SDM_MCS20         = 416,
+       WL_RATE_3X4_SDM_MCS21         = 417,
+       WL_RATE_3X4_SDM_MCS22         = 418,
+       WL_RATE_3X4_SDM_MCS23         = 419,
+       WL_RATE_P_3X4_SDM_MCS101      = 420,
+       WL_RATE_P_3X4_SDM_MCS102      = 421,
+
+       WL_RATE_3X4_VHT0SS3           = 412,
+       WL_RATE_3X4_VHT1SS3           = 413,
+       WL_RATE_3X4_VHT2SS3           = 414,
+       WL_RATE_3X4_VHT3SS3           = 415,
+       WL_RATE_3X4_VHT4SS3           = 416,
+       WL_RATE_3X4_VHT5SS3           = 417,
+       WL_RATE_3X4_VHT6SS3           = 418,
+       WL_RATE_3X4_VHT7SS3           = 419,
+       WL_RATE_3X4_VHT8SS3           = 420,
+       WL_RATE_3X4_VHT9SS3           = 421,
+       WL_RATE_P_3X4_VHT10SS3        = 422,
+       WL_RATE_P_3X4_VHT11SS3        = 423,
+
+       WL_RATE_3X4_HE0SS3            = 424,
+       WL_RATE_3X4_HE1SS3            = 425,
+       WL_RATE_3X4_HE2SS3            = 426,
+       WL_RATE_3X4_HE3SS3            = 427,
+       WL_RATE_3X4_HE4SS3            = 428,
+       WL_RATE_3X4_HE5SS3            = 429,
+       WL_RATE_3X4_HE6SS3            = 430,
+       WL_RATE_3X4_HE7SS3            = 431,
+       WL_RATE_3X4_HE8SS3            = 432,
+       WL_RATE_3X4_HE9SS3            = 433,
+       WL_RATE_3X4_HE10SS3           = 434,
+       WL_RATE_3X4_HE11SS3           = 435,
+
+       /* 4 Streams */
+       WL_RATE_4X4_SDM_MCS24         = 436,
+       WL_RATE_4X4_SDM_MCS25         = 437,
+       WL_RATE_4X4_SDM_MCS26         = 438,
+       WL_RATE_4X4_SDM_MCS27         = 439,
+       WL_RATE_4X4_SDM_MCS28         = 440,
+       WL_RATE_4X4_SDM_MCS29         = 441,
+       WL_RATE_4X4_SDM_MCS30         = 442,
+       WL_RATE_4X4_SDM_MCS31         = 443,
+       WL_RATE_P_4X4_SDM_MCS103      = 444,
+       WL_RATE_P_4X4_SDM_MCS104      = 445,
+
+       WL_RATE_4X4_VHT0SS4           = 436,
+       WL_RATE_4X4_VHT1SS4           = 437,
+       WL_RATE_4X4_VHT2SS4           = 438,
+       WL_RATE_4X4_VHT3SS4           = 439,
+       WL_RATE_4X4_VHT4SS4           = 440,
+       WL_RATE_4X4_VHT5SS4           = 441,
+       WL_RATE_4X4_VHT6SS4           = 442,
+       WL_RATE_4X4_VHT7SS4           = 443,
+       WL_RATE_4X4_VHT8SS4           = 444,
+       WL_RATE_4X4_VHT9SS4           = 445,
+       WL_RATE_P_4X4_VHT10SS4        = 446,
+       WL_RATE_P_4X4_VHT11SS4        = 447,
+
+       WL_RATE_4X4_HE0SS4            = 448,
+       WL_RATE_4X4_HE1SS4            = 449,
+       WL_RATE_4X4_HE2SS4            = 450,
+       WL_RATE_4X4_HE3SS4            = 451,
+       WL_RATE_4X4_HE4SS4            = 452,
+       WL_RATE_4X4_HE5SS4            = 453,
+       WL_RATE_4X4_HE6SS4            = 454,
+       WL_RATE_4X4_HE7SS4            = 455,
+       WL_RATE_4X4_HE8SS4            = 456,
+       WL_RATE_4X4_HE9SS4            = 457,
+       WL_RATE_4X4_HE10SS4           = 458,
+       WL_RATE_4X4_HE11SS4           = 459,
+
+       /****************************
+        * TX Beamforming, 4 chains *
+        ****************************
+        */
+
+       /* 1 Stream expanded + 3 */
+       WL_RATE_1X4_TXBF_OFDM_6       = 460,
+       WL_RATE_1X4_TXBF_OFDM_9       = 461,
+       WL_RATE_1X4_TXBF_OFDM_12      = 462,
+       WL_RATE_1X4_TXBF_OFDM_18      = 463,
+       WL_RATE_1X4_TXBF_OFDM_24      = 464,
+       WL_RATE_1X4_TXBF_OFDM_36      = 465,
+       WL_RATE_1X4_TXBF_OFDM_48      = 466,
+       WL_RATE_1X4_TXBF_OFDM_54      = 467,
+
+       WL_RATE_1X4_TXBF_MCS0         = 468,
+       WL_RATE_1X4_TXBF_MCS1         = 469,
+       WL_RATE_1X4_TXBF_MCS2         = 470,
+       WL_RATE_1X4_TXBF_MCS3         = 471,
+       WL_RATE_1X4_TXBF_MCS4         = 472,
+       WL_RATE_1X4_TXBF_MCS5         = 473,
+       WL_RATE_1X4_TXBF_MCS6         = 474,
+       WL_RATE_1X4_TXBF_MCS7         = 475,
+       WL_RATE_P_1X4_TXBF_MCS87      = 476,
+       WL_RATE_P_1X4_TXBF_MCS88      = 477,
+
+       WL_RATE_1X4_TXBF_VHT0SS1      = 468,
+       WL_RATE_1X4_TXBF_VHT1SS1      = 469,
+       WL_RATE_1X4_TXBF_VHT2SS1      = 470,
+       WL_RATE_1X4_TXBF_VHT3SS1      = 471,
+       WL_RATE_1X4_TXBF_VHT4SS1      = 472,
+       WL_RATE_1X4_TXBF_VHT5SS1      = 473,
+       WL_RATE_1X4_TXBF_VHT6SS1      = 474,
+       WL_RATE_1X4_TXBF_VHT7SS1      = 475,
+       WL_RATE_1X4_TXBF_VHT8SS1      = 476,
+       WL_RATE_1X4_TXBF_VHT9SS1      = 477,
+       WL_RATE_P_1X4_TXBF_VHT10SS1   = 478,
+       WL_RATE_P_1X4_TXBF_VHT11SS1   = 479,
+
+       WL_RATE_1X4_TXBF_HE0SS1       = 480,
+       WL_RATE_1X4_TXBF_HE1SS1       = 481,
+       WL_RATE_1X4_TXBF_HE2SS1       = 482,
+       WL_RATE_1X4_TXBF_HE3SS1       = 483,
+       WL_RATE_1X4_TXBF_HE4SS1       = 484,
+       WL_RATE_1X4_TXBF_HE5SS1       = 485,
+       WL_RATE_1X4_TXBF_HE6SS1       = 486,
+       WL_RATE_1X4_TXBF_HE7SS1       = 487,
+       WL_RATE_1X4_TXBF_HE8SS1       = 488,
+       WL_RATE_1X4_TXBF_HE9SS1       = 489,
+       WL_RATE_1X4_TXBF_HE10SS1      = 490,
+       WL_RATE_1X4_TXBF_HE11SS1      = 491,
+
+       /* 2 Streams expanded + 2 */
+       WL_RATE_2X4_TXBF_SDM_MCS8     = 492,
+       WL_RATE_2X4_TXBF_SDM_MCS9     = 493,
+       WL_RATE_2X4_TXBF_SDM_MCS10    = 494,
+       WL_RATE_2X4_TXBF_SDM_MCS11    = 495,
+       WL_RATE_2X4_TXBF_SDM_MCS12    = 496,
+       WL_RATE_2X4_TXBF_SDM_MCS13    = 497,
+       WL_RATE_2X4_TXBF_SDM_MCS14    = 498,
+       WL_RATE_2X4_TXBF_SDM_MCS15    = 499,
+       WL_RATE_P_2X4_TXBF_SDM_MCS99  = 500,
+       WL_RATE_P_2X4_TXBF_SDM_MCS100 = 501,
+
+       WL_RATE_2X4_TXBF_VHT0SS2      = 492,
+       WL_RATE_2X4_TXBF_VHT1SS2      = 493,
+       WL_RATE_2X4_TXBF_VHT2SS2      = 494,
+       WL_RATE_2X4_TXBF_VHT3SS2      = 495,
+       WL_RATE_2X4_TXBF_VHT4SS2      = 496,
+       WL_RATE_2X4_TXBF_VHT5SS2      = 497,
+       WL_RATE_2X4_TXBF_VHT6SS2      = 498,
+       WL_RATE_2X4_TXBF_VHT7SS2      = 499,
+       WL_RATE_2X4_TXBF_VHT8SS2      = 500,
+       WL_RATE_2X4_TXBF_VHT9SS2      = 501,
+       WL_RATE_P_2X4_TXBF_VHT10SS2   = 502,
+       WL_RATE_P_2X4_TXBF_VHT11SS2   = 503,
+
+       WL_RATE_2X4_TXBF_HE0SS2       = 504,
+       WL_RATE_2X4_TXBF_HE1SS2       = 505,
+       WL_RATE_2X4_TXBF_HE2SS2       = 506,
+       WL_RATE_2X4_TXBF_HE3SS2       = 507,
+       WL_RATE_2X4_TXBF_HE4SS2       = 508,
+       WL_RATE_2X4_TXBF_HE5SS2       = 509,
+       WL_RATE_2X4_TXBF_HE6SS2       = 510,
+       WL_RATE_2X4_TXBF_HE7SS2       = 511,
+       WL_RATE_2X4_TXBF_HE8SS2       = 512,
+       WL_RATE_2X4_TXBF_HE9SS2       = 513,
+       WL_RATE_2X4_TXBF_HE10SS2      = 514,
+       WL_RATE_2X4_TXBF_HE11SS2      = 515,
+
+       /* 3 Streams expanded + 1 */
+       WL_RATE_3X4_TXBF_SDM_MCS16    = 516,
+       WL_RATE_3X4_TXBF_SDM_MCS17    = 517,
+       WL_RATE_3X4_TXBF_SDM_MCS18    = 518,
+       WL_RATE_3X4_TXBF_SDM_MCS19    = 519,
+       WL_RATE_3X4_TXBF_SDM_MCS20    = 520,
+       WL_RATE_3X4_TXBF_SDM_MCS21    = 521,
+       WL_RATE_3X4_TXBF_SDM_MCS22    = 522,
+       WL_RATE_3X4_TXBF_SDM_MCS23    = 523,
+       WL_RATE_P_3X4_TXBF_SDM_MCS101 = 524,
+       WL_RATE_P_3X4_TXBF_SDM_MCS102 = 525,
+
+       WL_RATE_3X4_TXBF_VHT0SS3      = 516,
+       WL_RATE_3X4_TXBF_VHT1SS3      = 517,
+       WL_RATE_3X4_TXBF_VHT2SS3      = 518,
+       WL_RATE_3X4_TXBF_VHT3SS3      = 519,
+       WL_RATE_3X4_TXBF_VHT4SS3      = 520,
+       WL_RATE_3X4_TXBF_VHT5SS3      = 521,
+       WL_RATE_3X4_TXBF_VHT6SS3      = 522,
+       WL_RATE_3X4_TXBF_VHT7SS3      = 523,
+       WL_RATE_P_3X4_TXBF_VHT8SS3    = 524,
+       WL_RATE_P_3X4_TXBF_VHT9SS3    = 525,
+       WL_RATE_P_3X4_TXBF_VHT10SS3   = 526,
+       WL_RATE_P_3X4_TXBF_VHT11SS3   = 527,
+
+       WL_RATE_3X4_TXBF_HE0SS3       = 528,
+       WL_RATE_3X4_TXBF_HE1SS3       = 529,
+       WL_RATE_3X4_TXBF_HE2SS3       = 530,
+       WL_RATE_3X4_TXBF_HE3SS3       = 531,
+       WL_RATE_3X4_TXBF_HE4SS3       = 532,
+       WL_RATE_3X4_TXBF_HE5SS3       = 533,
+       WL_RATE_3X4_TXBF_HE6SS3       = 534,
+       WL_RATE_3X4_TXBF_HE7SS3       = 535,
+       WL_RATE_3X4_TXBF_HE8SS3       = 536,
+       WL_RATE_3X4_TXBF_HE9SS3       = 537,
+       WL_RATE_3X4_TXBF_HE10SS3      = 538,
+       WL_RATE_3X4_TXBF_HE11SS3      = 539,
+
+       /* 4 Streams */
+       WL_RATE_4X4_TXBF_SDM_MCS24    = 540,
+       WL_RATE_4X4_TXBF_SDM_MCS25    = 541,
+       WL_RATE_4X4_TXBF_SDM_MCS26    = 542,
+       WL_RATE_4X4_TXBF_SDM_MCS27    = 543,
+       WL_RATE_4X4_TXBF_SDM_MCS28    = 544,
+       WL_RATE_4X4_TXBF_SDM_MCS29    = 545,
+       WL_RATE_4X4_TXBF_SDM_MCS30    = 546,
+       WL_RATE_4X4_TXBF_SDM_MCS31    = 547,
+       WL_RATE_P_4X4_TXBF_SDM_MCS103 = 548,
+       WL_RATE_P_4X4_TXBF_SDM_MCS104 = 549,
+
+       WL_RATE_4X4_TXBF_VHT0SS4      = 540,
+       WL_RATE_4X4_TXBF_VHT1SS4      = 541,
+       WL_RATE_4X4_TXBF_VHT2SS4      = 542,
+       WL_RATE_4X4_TXBF_VHT3SS4      = 543,
+       WL_RATE_4X4_TXBF_VHT4SS4      = 544,
+       WL_RATE_4X4_TXBF_VHT5SS4      = 545,
+       WL_RATE_4X4_TXBF_VHT6SS4      = 546,
+       WL_RATE_4X4_TXBF_VHT7SS4      = 547,
+       WL_RATE_P_4X4_TXBF_VHT8SS4    = 548,
+       WL_RATE_P_4X4_TXBF_VHT9SS4    = 549,
+       WL_RATE_P_4X4_TXBF_VHT10SS4   = 550,
+       WL_RATE_P_4X4_TXBF_VHT11SS4   = 551,
+
+       WL_RATE_4X4_TXBF_HE0SS4       = 552,
+       WL_RATE_4X4_TXBF_HE1SS4       = 553,
+       WL_RATE_4X4_TXBF_HE2SS4       = 554,
+       WL_RATE_4X4_TXBF_HE3SS4       = 555,
+       WL_RATE_4X4_TXBF_HE4SS4       = 556,
+       WL_RATE_4X4_TXBF_HE5SS4       = 557,
+       WL_RATE_4X4_TXBF_HE6SS4       = 558,
+       WL_RATE_4X4_TXBF_HE7SS4       = 559,
+       WL_RATE_4X4_TXBF_HE8SS4       = 560,
+       WL_RATE_4X4_TXBF_HE9SS4       = 561,
+       WL_RATE_4X4_TXBF_HE10SS4      = 562,
+       WL_RATE_4X4_TXBF_HE11SS4      = 563
+} clm_rates_t;
+
+/* Number of rate codes */
+#define WL_NUMRATES 564
+
+/* This enum maps 802.11ax OFDMA (RU) 'rates' to a CLM index */
+
+typedef enum clm_ru_rates {
+       /* RU26 OFDMA UL rates */
+       WL_RU_RATE_1X1_26SS1             = 0,
+       WL_RU_RATE_1X2_26SS1             = 1,
+       WL_RU_RATE_2X2_26SS2             = 2,
+       WL_RU_RATE_1X2_TXBF_26SS1        = 3,
+       WL_RU_RATE_2X2_TXBF_26SS2        = 4,
+       WL_RU_RATE_1X3_26SS1             = 5,
+       WL_RU_RATE_2X3_26SS2             = 6,
+       WL_RU_RATE_3X3_26SS3             = 7,
+       WL_RU_RATE_1X3_TXBF_26SS1        = 8,
+       WL_RU_RATE_2X3_TXBF_26SS2        = 9,
+       WL_RU_RATE_3X3_TXBF_26SS3        = 10,
+       WL_RU_RATE_1X4_26SS1             = 11,
+       WL_RU_RATE_2X4_26SS2             = 12,
+       WL_RU_RATE_3X4_26SS3             = 13,
+       WL_RU_RATE_4X4_26SS4             = 14,
+       WL_RU_RATE_1X4_TXBF_26SS1        = 15,
+       WL_RU_RATE_2X4_TXBF_26SS2        = 16,
+       WL_RU_RATE_3X4_TXBF_26SS3        = 17,
+       WL_RU_RATE_4X4_TXBF_26SS4        = 18,
+
+       /* RU52 OFDMA UL rates */
+       WL_RU_RATE_1X1_52SS1             = 19,
+       WL_RU_RATE_1X2_52SS1             = 20,
+       WL_RU_RATE_2X2_52SS2             = 21,
+       WL_RU_RATE_1X2_TXBF_52SS1        = 22,
+       WL_RU_RATE_2X2_TXBF_52SS2        = 23,
+       WL_RU_RATE_1X3_52SS1             = 24,
+       WL_RU_RATE_2X3_52SS2             = 25,
+       WL_RU_RATE_3X3_52SS3             = 26,
+       WL_RU_RATE_1X3_TXBF_52SS1        = 27,
+       WL_RU_RATE_2X3_TXBF_52SS2        = 28,
+       WL_RU_RATE_3X3_TXBF_52SS3        = 29,
+       WL_RU_RATE_1X4_52SS1             = 30,
+       WL_RU_RATE_2X4_52SS2             = 31,
+       WL_RU_RATE_3X4_52SS3             = 32,
+       WL_RU_RATE_4X4_52SS4             = 33,
+       WL_RU_RATE_1X4_TXBF_52SS1        = 34,
+       WL_RU_RATE_2X4_TXBF_52SS2        = 35,
+       WL_RU_RATE_3X4_TXBF_52SS3        = 36,
+       WL_RU_RATE_4X4_TXBF_52SS4        = 37,
+
+       /* RU106 OFDMA UL rates */
+       WL_RU_RATE_1X1_106SS1            = 38,
+       WL_RU_RATE_1X2_106SS1            = 39,
+       WL_RU_RATE_2X2_106SS2            = 40,
+       WL_RU_RATE_1X2_TXBF_106SS1       = 41,
+       WL_RU_RATE_2X2_TXBF_106SS2       = 42,
+       WL_RU_RATE_1X3_106SS1            = 43,
+       WL_RU_RATE_2X3_106SS2            = 44,
+       WL_RU_RATE_3X3_106SS3            = 45,
+       WL_RU_RATE_1X3_TXBF_106SS1       = 46,
+       WL_RU_RATE_2X3_TXBF_106SS2       = 47,
+       WL_RU_RATE_3X3_TXBF_106SS3       = 48,
+       WL_RU_RATE_1X4_106SS1            = 49,
+       WL_RU_RATE_2X4_106SS2            = 50,
+       WL_RU_RATE_3X4_106SS3            = 51,
+       WL_RU_RATE_4X4_106SS4            = 52,
+       WL_RU_RATE_1X4_TXBF_106SS1       = 53,
+       WL_RU_RATE_2X4_TXBF_106SS2       = 54,
+       WL_RU_RATE_3X4_TXBF_106SS3       = 55,
+       WL_RU_RATE_4X4_TXBF_106SS4       = 56,
+
+       /* Upper Bound OFDMA DL 'rates' */
+       WL_RU_RATE_1X1_UBSS1             = 57,
+       WL_RU_RATE_1X2_UBSS1             = 58,
+       WL_RU_RATE_2X2_UBSS2             = 59,
+       WL_RU_RATE_1X2_TXBF_UBSS1        = 60,
+       WL_RU_RATE_2X2_TXBF_UBSS2        = 61,
+       WL_RU_RATE_1X3_UBSS1             = 62,
+       WL_RU_RATE_2X3_UBSS2             = 63,
+       WL_RU_RATE_3X3_UBSS3             = 64,
+       WL_RU_RATE_1X3_TXBF_UBSS1        = 65,
+       WL_RU_RATE_2X3_TXBF_UBSS2        = 66,
+       WL_RU_RATE_3X3_TXBF_UBSS3        = 67,
+       WL_RU_RATE_1X4_UBSS1             = 68,
+       WL_RU_RATE_2X4_UBSS2             = 69,
+       WL_RU_RATE_3X4_UBSS3             = 70,
+       WL_RU_RATE_4X4_UBSS4             = 71,
+       WL_RU_RATE_1X4_TXBF_UBSS1        = 72,
+       WL_RU_RATE_2X4_TXBF_UBSS2        = 73,
+       WL_RU_RATE_3X4_TXBF_UBSS3        = 74,
+       WL_RU_RATE_4X4_TXBF_UBSS4        = 75,
+
+       /* Less Upper Bound OFDMA DL 'rates' */
+       WL_RU_RATE_1X1_LUBSS1            = 76,
+       WL_RU_RATE_1X2_LUBSS1            = 77,
+       WL_RU_RATE_2X2_LUBSS2            = 78,
+       WL_RU_RATE_1X2_TXBF_LUBSS1       = 79,
+       WL_RU_RATE_2X2_TXBF_LUBSS2       = 80,
+       WL_RU_RATE_1X3_LUBSS1            = 81,
+       WL_RU_RATE_2X3_LUBSS2            = 82,
+       WL_RU_RATE_3X3_LUBSS3            = 83,
+       WL_RU_RATE_1X3_TXBF_LUBSS1       = 84,
+       WL_RU_RATE_2X3_TXBF_LUBSS2       = 85,
+       WL_RU_RATE_3X3_TXBF_LUBSS3       = 86,
+       WL_RU_RATE_1X4_LUBSS1            = 87,
+       WL_RU_RATE_2X4_LUBSS2            = 88,
+       WL_RU_RATE_3X4_LUBSS3            = 89,
+       WL_RU_RATE_4X4_LUBSS4            = 90,
+       WL_RU_RATE_1X4_TXBF_LUBSS1       = 91,
+       WL_RU_RATE_2X4_TXBF_LUBSS2       = 92,
+       WL_RU_RATE_3X4_TXBF_LUBSS3       = 93,
+       WL_RU_RATE_4X4_TXBF_LUBSS4       = 94,
+
+       /* RU242 OFDMA UL rates */
+       WL_RU_RATE_1X1_242SS1            = 95,
+       WL_RU_RATE_1X2_242SS1            = 96,
+       WL_RU_RATE_2X2_242SS2            = 97,
+       WL_RU_RATE_1X2_TXBF_242SS1       = 98,
+       WL_RU_RATE_2X2_TXBF_242SS2       = 99,
+       WL_RU_RATE_1X3_242SS1            = 100,
+       WL_RU_RATE_2X3_242SS2            = 101,
+       WL_RU_RATE_3X3_242SS3            = 102,
+       WL_RU_RATE_1X3_TXBF_242SS1       = 103,
+       WL_RU_RATE_2X3_TXBF_242SS2       = 104,
+       WL_RU_RATE_3X3_TXBF_242SS3       = 105,
+       WL_RU_RATE_1X4_242SS1            = 106,
+       WL_RU_RATE_2X4_242SS2            = 107,
+       WL_RU_RATE_3X4_242SS3            = 108,
+       WL_RU_RATE_4X4_242SS4            = 109,
+       WL_RU_RATE_1X4_TXBF_242SS1       = 110,
+       WL_RU_RATE_2X4_TXBF_242SS2       = 111,
+       WL_RU_RATE_3X4_TXBF_242SS3       = 112,
+       WL_RU_RATE_4X4_TXBF_242SS4       = 113,
+
+       /* RU484 OFDMA UL rates */
+       WL_RU_RATE_1X1_484SS1            = 114,
+       WL_RU_RATE_1X2_484SS1            = 115,
+       WL_RU_RATE_2X2_484SS2            = 116,
+       WL_RU_RATE_1X2_TXBF_484SS1       = 117,
+       WL_RU_RATE_2X2_TXBF_484SS2       = 118,
+       WL_RU_RATE_1X3_484SS1            = 119,
+       WL_RU_RATE_2X3_484SS2            = 120,
+       WL_RU_RATE_3X3_484SS3            = 121,
+       WL_RU_RATE_1X3_TXBF_484SS1       = 122,
+       WL_RU_RATE_2X3_TXBF_484SS2       = 123,
+       WL_RU_RATE_3X3_TXBF_484SS3       = 124,
+       WL_RU_RATE_1X4_484SS1            = 125,
+       WL_RU_RATE_2X4_484SS2            = 126,
+       WL_RU_RATE_3X4_484SS3            = 127,
+       WL_RU_RATE_4X4_484SS4            = 128,
+       WL_RU_RATE_1X4_TXBF_484SS1       = 129,
+       WL_RU_RATE_2X4_TXBF_484SS2       = 130,
+       WL_RU_RATE_3X4_TXBF_484SS3       = 131,
+       WL_RU_RATE_4X4_TXBF_484SS4       = 132,
+
+       /* RU996 OFDMA UL rates */
+       WL_RU_RATE_1X1_996SS1            = 133,
+       WL_RU_RATE_1X2_996SS1            = 134,
+       WL_RU_RATE_2X2_996SS2            = 135,
+       WL_RU_RATE_1X2_TXBF_996SS1       = 136,
+       WL_RU_RATE_2X2_TXBF_996SS2       = 137,
+       WL_RU_RATE_1X3_996SS1            = 138,
+       WL_RU_RATE_2X3_996SS2            = 139,
+       WL_RU_RATE_3X3_996SS3            = 140,
+       WL_RU_RATE_1X3_TXBF_996SS1       = 141,
+       WL_RU_RATE_2X3_TXBF_996SS2       = 142,
+       WL_RU_RATE_3X3_TXBF_996SS3       = 143,
+       WL_RU_RATE_1X4_996SS1            = 144,
+       WL_RU_RATE_2X4_996SS2            = 145,
+       WL_RU_RATE_3X4_996SS3            = 146,
+       WL_RU_RATE_4X4_996SS4            = 147,
+       WL_RU_RATE_1X4_TXBF_996SS1       = 148,
+       WL_RU_RATE_2X4_TXBF_996SS2       = 149,
+       WL_RU_RATE_3X4_TXBF_996SS3       = 150,
+       WL_RU_RATE_4X4_TXBF_996SS4       = 151
+} clm_ru_rates_t;
+
+/* Number of OFDMA rate codes */
+#define WL_RU_NUMRATES 152
+
+/* MCS rates */
+#define WLC_MAX_VHT_MCS        11      /**< Std VHT MCS 0-9 plus prop VHT MCS 10-11 */
+#define WLC_MAX_HE_MCS 11      /**< Std HE MCS 0-11 */
+
+/* Convert encoded rate value in plcp header to numerical rates in 500 KHz increments */
+#define OFDM_PHY2MAC_RATE(rlpt)         plcp_ofdm_rate_tbl[(rlpt) & 0x7]
+#define CCK_PHY2MAC_RATE(signal)       ((signal)/5)
+
+/* 'proprietary' string should not exist in open source(OEM_ANDROID) */
+/* given a proprietary MCS, get number of spatial streams */
+#define GET_PROPRIETARY_11N_MCS_NSS(mcs) (1 + ((mcs) - 85) / 8)
+
+#define GET_11N_MCS_NSS(mcs) ((mcs) < 32 ? (1 + ((mcs) / 8)) : \
+                             ((mcs) == 32 ? 1 : GET_PROPRIETARY_11N_MCS_NSS(mcs)))
+
+#define IS_PROPRIETARY_11N_MCS(mcs)    FALSE
+#define IS_PROPRIETARY_11N_SS_MCS(mcs) FALSE /**< is proprietary HT single stream MCS */
+
+/* Macros to be used for calculating rate from PLCP (wf_he_plcp_to_rate) */
+#define HE_SU_PLCP2RATE_MCS_MASK       0x0F
+#define HE_SU_PLCP2RATE_MCS_SHIFT      0
+#define HE_SU_PLCP2RATE_NSS_MASK       0x70
+#define HE_SU_PLCP2RATE_NSS_SHIFT      4
+#define HE_MU_PLCP2RATE_LTF_GI_MASK    0x30
+#define HE_MU_PLCP2RATE_LTF_GI_SHIFT   4
+#define HE_MU_PLCP2RATE_STBC_MASK      0x40
+#define HE_MU_PLCP2RATE_STBC_SHIFT     6
+
+/* Macros for HE LTF and GI */
+#define HE_IS_1X_LTF(gi)       ((gi) == WL_RSPEC_HE_1x_LTF_GI_0_8us)
+#define HE_IS_2X_LTF(gi)       (((gi) == WL_RSPEC_HE_2x_LTF_GI_0_8us) || \
+                               ((gi) == WL_RSPEC_HE_2x_LTF_GI_1_6us))
+#define HE_IS_4X_LTF(gi)       ((gi) == WL_RSPEC_HE_4x_LTF_GI_3_2us)
+
+#define HE_IS_GI_0_8us(gi)     (((gi) == WL_RSPEC_HE_1x_LTF_GI_0_8us) || \
+                               ((gi) == WL_RSPEC_HE_2x_LTF_GI_0_8us))
+#define HE_IS_GI_1_6us(gi)     ((gi) == WL_RSPEC_HE_2x_LTF_GI_1_6us)
+#define HE_IS_GI_3_2us(gi)     ((gi) == WL_RSPEC_HE_4x_LTF_GI_3_2us)
+
+extern const uint8 plcp_ofdm_rate_tbl[];
+
+uint8 wf_get_single_stream_mcs(uint mcs);
+
+/* extract NSS:MCS portions of the rspec */
+#define WF_NON_HT_MCS 0x80
+uint8 wf_vht_plcp_to_rate(uint8 *plcp);
+uint8 wf_he_plcp_to_rate(uint8 *plcp, bool is_mu);
+
+/* convert rate from mcs to Kbps */
+uint wf_mcs_to_rate(uint mcs, uint nss, uint bw, int sgi);
+uint wf_he_mcs_to_rate(uint mcs, uint nss, uint bw, uint gi, bool dcm);
+
+uint wf_mcs_to_Ndbps(uint mcs, uint nss, uint bw);
+uint wf_he_mcs_to_Ndbps(uint mcs, uint nss, uint bw, bool dcm);
+uint32 wf_he_mcs_ru_to_ndbps(uint8 mcs, uint8 nss, bool dcm, uint8 ru_index);
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+#endif /* _bcmwifi_rates_h_ */
diff --git a/bcmdhd.101.10.240.x/include/bcmwifi_rspec.h b/bcmdhd.101.10.240.x/include/bcmwifi_rspec.h
new file mode 100644 (file)
index 0000000..e8e13cf
--- /dev/null
@@ -0,0 +1,228 @@
+/*
+ * Common OS-independent driver header for rate management.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _bcmwifi_rspec_h_
+#define _bcmwifi_rspec_h_
+
+#include <typedefs.h>
+
+/**
+ * ===================================================================================
+ * rate spec : holds rate and mode specific information required to generate a tx frame.
+ * Legacy CCK and OFDM information is held in the same manner as was done in the past.
+ * (in the lower byte) the upper 3 bytes primarily hold MIMO specific information
+ * ===================================================================================
+ */
+typedef uint32 ratespec_t;
+
+/* Rate spec. definitions */
+#define WL_RSPEC_RATE_MASK     0x000000FF      /**< Legacy rate or MCS or MCS + NSS */
+#define WL_RSPEC_TXEXP_MASK    0x00000300      /**< Tx chain expansion beyond Nsts */
+#define WL_RSPEC_TXEXP_SHIFT   8
+#define WL_RSPEC_HE_GI_MASK    0x00000C00      /* HE GI indices */
+#define WL_RSPEC_HE_GI_SHIFT   10
+#define WL_RSPEC_BW_MASK       0x00070000      /**< Band width */
+#define WL_RSPEC_BW_SHIFT      16
+#define WL_RSPEC_ER_MASK       0x0000C000      /**< Range extension mask */
+#define WL_RSPEC_ER_SHIFT      14
+#define WL_RSPEC_ER_ENAB_MASK  0x00008000      /**< Range extension enable */
+#define WL_RSPEC_ER_ENAB_SHIFT 15
+#define WL_RSPEC_ER_TONE_MASK  0x00004000      /**< Range extension tone config */
+#define WL_RSPEC_ER_TONE_SHIFT 14
+
+#define WL_RSPEC_DCM           0x00080000      /**< Dual Carrier Modulation */
+#define WL_RSPEC_DCM_SHIFT     19
+#define WL_RSPEC_STBC          0x00100000      /**< STBC expansion, Nsts = 2 * Nss */
+#define WL_RSPEC_TXBF          0x00200000
+#define WL_RSPEC_LDPC          0x00400000
+#define WL_RSPEC_SGI           0x00800000
+#define WL_RSPEC_SHORT_PREAMBLE        0x00800000      /**< DSSS short preable - Encoding 0 */
+#define WL_RSPEC_ENCODING_MASK 0x03000000      /**< Encoding of RSPEC_RATE field */
+#define WL_RSPEC_ENCODING_SHIFT        24
+
+#define WL_RSPEC_OVERRIDE_RATE 0x40000000      /**< override rate only */
+#define WL_RSPEC_OVERRIDE_MODE 0x80000000      /**< override both rate & mode */
+
+/* ======== RSPEC_HE_GI|RSPEC_SGI fields for HE ======== */
+
+/* GI for HE */
+#define RSPEC_HE_LTF_GI(rspec) (((rspec) & WL_RSPEC_HE_GI_MASK) >> WL_RSPEC_HE_GI_SHIFT)
+#define WL_RSPEC_HE_1x_LTF_GI_0_8us    (0x0)
+#define WL_RSPEC_HE_2x_LTF_GI_0_8us    (0x1)
+#define WL_RSPEC_HE_2x_LTF_GI_1_6us    (0x2)
+#define WL_RSPEC_HE_4x_LTF_GI_3_2us    (0x3)
+#define RSPEC_ISHEGI(rspec)    (RSPEC_HE_LTF_GI(rspec) > WL_RSPEC_HE_1x_LTF_GI_0_8us)
+#define HE_GI_TO_RSPEC(gi)     (((gi) << WL_RSPEC_HE_GI_SHIFT) & WL_RSPEC_HE_GI_MASK)
+#define HE_GI_TO_RSPEC_SET(rspec, gi)  (((~WL_RSPEC_HE_GI_MASK) & rspec) | \
+                                       HE_GI_TO_RSPEC(gi))
+
+/* RSPEC Macros for extracting and using HE-ER and DCM */
+#define RSPEC_HE_DCM(rspec)            (((rspec) & WL_RSPEC_DCM) >> WL_RSPEC_DCM_SHIFT)
+#define RSPEC_HE_ER(rspec)             (((rspec) & WL_RSPEC_ER_MASK) >> WL_RSPEC_ER_SHIFT)
+#ifdef WL11AX
+#define RSPEC_HE_ER_ENAB(rspec)                (((rspec) & WL_RSPEC_ER_ENAB_MASK) >> \
+                                       WL_RSPEC_ER_ENAB_SHIFT)
+#else
+#define RSPEC_HE_ER_ENAB(rspec)                FALSE
+#endif
+#define RSPEC_HE_ER_TONE(rspec)                (((rspec) & WL_RSPEC_ER_TONE_MASK) >> \
+                                       WL_RSPEC_ER_TONE_SHIFT)
+/* ======== RSPEC_RATE field ======== */
+
+/* Encoding 0 - legacy rate */
+/* DSSS, CCK, and OFDM rates in [500kbps] units */
+#define WL_RSPEC_LEGACY_RATE_MASK      0x0000007F
+#define WLC_RATE_1M    2
+#define WLC_RATE_2M    4
+#define WLC_RATE_5M5   11
+#define WLC_RATE_11M   22
+#define WLC_RATE_6M    12
+#define WLC_RATE_9M    18
+#define WLC_RATE_12M   24
+#define WLC_RATE_18M   36
+#define WLC_RATE_24M   48
+#define WLC_RATE_36M   72
+#define WLC_RATE_48M   96
+#define WLC_RATE_54M   108
+
+/* Encoding 1 - HT MCS */
+#define WL_RSPEC_HT_MCS_MASK           0x0000007F      /**< HT MCS value mask in rspec */
+
+/* Encoding 2 - VHT MCS + NSS */
+#define WL_RSPEC_VHT_MCS_MASK          0x0000000F      /**< VHT MCS value mask in rspec */
+#define WL_RSPEC_VHT_NSS_MASK          0x000000F0      /**< VHT Nss value mask in rspec */
+#define WL_RSPEC_VHT_NSS_SHIFT         4               /**< VHT Nss value shift in rspec */
+
+/* Encoding 3 - HE MCS + NSS */
+#define WL_RSPEC_HE_MCS_MASK           0x0000000F      /**< HE MCS value mask in rspec */
+#define WL_RSPEC_HE_NSS_MASK           0x000000F0      /**< HE Nss value mask in rspec */
+#define WL_RSPEC_HE_NSS_SHIFT          4               /**< HE Nss value shift in rpsec */
+
+/* ======== RSPEC_BW field ======== */
+
+#define WL_RSPEC_BW_UNSPECIFIED        0
+#define WL_RSPEC_BW_20MHZ      0x00010000
+#define WL_RSPEC_BW_40MHZ      0x00020000
+#define WL_RSPEC_BW_80MHZ      0x00030000
+#define WL_RSPEC_BW_160MHZ     0x00040000
+
+/* ======== RSPEC_ENCODING field ======== */
+
+#define WL_RSPEC_ENCODE_RATE   0x00000000      /**< Legacy rate is stored in RSPEC_RATE */
+#define WL_RSPEC_ENCODE_HT     0x01000000      /**< HT MCS is stored in RSPEC_RATE */
+#define WL_RSPEC_ENCODE_VHT    0x02000000      /**< VHT MCS and NSS are stored in RSPEC_RATE */
+#define WL_RSPEC_ENCODE_HE     0x03000000      /**< HE MCS and NSS are stored in RSPEC_RATE */
+
+/**
+ * ===============================
+ * Handy macros to parse rate spec
+ * ===============================
+ */
+#define RSPEC_BW(rspec)                ((rspec) & WL_RSPEC_BW_MASK)
+#define RSPEC_IS20MHZ(rspec)   (RSPEC_BW(rspec) == WL_RSPEC_BW_20MHZ)
+#define RSPEC_IS40MHZ(rspec)   (RSPEC_BW(rspec) == WL_RSPEC_BW_40MHZ)
+#define RSPEC_IS80MHZ(rspec)   (RSPEC_BW(rspec) == WL_RSPEC_BW_80MHZ)
+#define RSPEC_IS160MHZ(rspec)  (RSPEC_BW(rspec) == WL_RSPEC_BW_160MHZ)
+
+#define RSPEC_ISSGI(rspec)     (((rspec) & WL_RSPEC_SGI) != 0)
+#define RSPEC_ISLDPC(rspec)    (((rspec) & WL_RSPEC_LDPC) != 0)
+#define RSPEC_ISSTBC(rspec)    (((rspec) & WL_RSPEC_STBC) != 0)
+#define RSPEC_ISTXBF(rspec)    (((rspec) & WL_RSPEC_TXBF) != 0)
+
+#define RSPEC_TXEXP(rspec)     (((rspec) & WL_RSPEC_TXEXP_MASK) >> WL_RSPEC_TXEXP_SHIFT)
+
+#define RSPEC_ENCODE(rspec)    (((rspec) & WL_RSPEC_ENCODING_MASK) >> WL_RSPEC_ENCODING_SHIFT)
+#define RSPEC_ISLEGACY(rspec)  (((rspec) & WL_RSPEC_ENCODING_MASK) == WL_RSPEC_ENCODE_RATE)
+
+#define        RSPEC_ISCCK(rspec)      (RSPEC_ISLEGACY(rspec) && \
+                                (int8)rate_info[(rspec) & WL_RSPEC_LEGACY_RATE_MASK] > 0)
+#define        RSPEC_ISOFDM(rspec)     (RSPEC_ISLEGACY(rspec) && \
+                                (int8)rate_info[(rspec) & WL_RSPEC_LEGACY_RATE_MASK] < 0)
+
+#define RSPEC_ISHT(rspec)      (((rspec) & WL_RSPEC_ENCODING_MASK) == WL_RSPEC_ENCODE_HT)
+#define RSPEC_ISVHT(rspec)     (((rspec) & WL_RSPEC_ENCODING_MASK) == WL_RSPEC_ENCODE_VHT)
+#ifdef WL11AX
+#define RSPEC_ISHE(rspec)      (((rspec) & WL_RSPEC_ENCODING_MASK) == WL_RSPEC_ENCODE_HE)
+#else /* WL11AX */
+#define RSPEC_ISHE(rspec)      0
+#endif /* WL11AX */
+
+/**
+ * ================================
+ * Handy macros to create rate spec
+ * ================================
+ */
+/* create ratespecs */
+#define LEGACY_RSPEC(rate)     (WL_RSPEC_ENCODE_RATE | WL_RSPEC_BW_20MHZ | \
+                                ((rate) & WL_RSPEC_LEGACY_RATE_MASK))
+#define CCK_RSPEC(cck)         LEGACY_RSPEC(cck)
+#define OFDM_RSPEC(ofdm)       LEGACY_RSPEC(ofdm)
+#define HT_RSPEC(mcs)          (WL_RSPEC_ENCODE_HT | ((mcs) & WL_RSPEC_HT_MCS_MASK))
+#define VHT_RSPEC(mcs, nss)    (WL_RSPEC_ENCODE_VHT | \
+                                (((nss) << WL_RSPEC_VHT_NSS_SHIFT) & WL_RSPEC_VHT_NSS_MASK) | \
+                                ((mcs) & WL_RSPEC_VHT_MCS_MASK))
+#define HE_RSPEC(mcs, nss)     (WL_RSPEC_ENCODE_HE | \
+                                (((nss) << WL_RSPEC_HE_NSS_SHIFT) & WL_RSPEC_HE_NSS_MASK) | \
+                                ((mcs) & WL_RSPEC_HE_MCS_MASK))
+
+/**
+ * ==================
+ * Other handy macros
+ * ==================
+ */
+/* return rate in unit of Kbps */
+#define RSPEC2KBPS(rspec)      wf_rspec_to_rate(rspec)
+
+/* return rate in unit of 500Kbps */
+/* works only for legacy rate */
+#define RSPEC2RATE(rspec)      ((rspec) & WL_RSPEC_LEGACY_RATE_MASK)
+
+/**
+ * =================================
+ * Macros to use the rate_info table
+ * =================================
+ */
+/* phy_rate table index is in [500kbps] units */
+#define WLC_MAXRATE    108     /**< in 500kbps units */
+extern const uint8 rate_info[];
+/* phy_rate table value is encoded */
+#define        RATE_INFO_OFDM_MASK     0x80    /* ofdm mask */
+#define        RATE_INFO_RATE_MASK     0x7f    /* rate signal index mask */
+#define        RATE_INFO_M_RATE_MASK   0x0f    /* M_RATE_TABLE index mask */
+#define        RATE_INFO_RATE_ISCCK(r) ((r) <= WLC_MAXRATE && (int8)rate_info[r] > 0)
+#define        RATE_INFO_RATE_ISOFDM(r) ((r) <= WLC_MAXRATE && (int8)rate_info[r] < 0)
+
+/**
+ * ===================
+ * function prototypes
+ * ===================
+ */
+ratespec_t wf_vht_plcp_to_rspec(uint8 *plcp);
+#ifdef WL11AX
+ratespec_t wf_he_plcp_to_rspec(uint8 *plcp);
+#endif /* WL11AX */
+ratespec_t wf_ht_plcp_to_rspec(uint8 *plcp);
+
+uint wf_rspec_to_rate(ratespec_t rspec);
+
+#endif /* _bcmwifi_rspec_h_ */
diff --git a/bcmdhd.101.10.240.x/include/brcm_nl80211.h b/bcmdhd.101.10.240.x/include/brcm_nl80211.h
new file mode 100644 (file)
index 0000000..29a4281
--- /dev/null
@@ -0,0 +1,77 @@
+/*
+ * Definitions for nl80211 vendor command/event access to host driver
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ *
+ */
+
+#ifndef _brcm_nl80211_h_
+#define _brcm_nl80211_h_
+
+//#ifdef OEM_ANDROID Need proper #ifdef in the referencing code as well
+#define OUI_BRCM  0x001018
+#define OUI_GOOGLE  0x001A11
+
+enum wl_vendor_subcmd {
+       BRCM_VENDOR_SCMD_UNSPEC                 = 0,
+       BRCM_VENDOR_SCMD_PRIV_STR               = 1,
+       BRCM_VENDOR_SCMD_BCM_STR                = 2,
+       BRCM_VENDOR_SCMD_BCM_PSK                = 3,
+       BRCM_VENDOR_SCMD_SET_PMK                = 4,
+       BRCM_VENDOR_SCMD_GET_FEATURES           = 5,
+       BRCM_VENDOR_SCMD_SET_MAC                = 6,
+       BRCM_VENDOR_SCMD_SET_CONNECT_PARAMS     = 7,
+       BRCM_VENDOR_SCMD_SET_START_AP_PARAMS    = 8,
+       BRCM_VENDOR_SCMD_MAX                    = 9
+};
+
+struct bcm_nlmsg_hdr {
+       uint cmd;       /* common ioctl definition */
+       int len;        /* expected return buffer length */
+       uint offset;    /* user buffer offset */
+       uint set;       /* get or set request optional */
+       uint magic;     /* magic number for verification */
+};
+
+enum bcmnl_attrs {
+       BCM_NLATTR_UNSPEC,
+
+       BCM_NLATTR_LEN,
+       BCM_NLATTR_DATA,
+
+       __BCM_NLATTR_AFTER_LAST,
+       BCM_NLATTR_MAX = __BCM_NLATTR_AFTER_LAST - 1
+};
+
+struct nl_prv_data {
+       int err;                        /* return result */
+       void *data;                     /* ioctl return buffer pointer */
+       uint len;                       /* ioctl return buffer length */
+       struct bcm_nlmsg_hdr *nlioc;    /* bcm_nlmsg_hdr header pointer */
+};
+//#endif /* OEM_ANDROID */
+
+/* Keep common BCM netlink macros here */
+#define BCM_NL_USER    31
+#define BCM_NL_OXYGEN  30
+#define BCM_NL_TS      29
+/* ====== !! ADD NEW NL socket related defines here !! ====== */
+
+#endif /* _brcm_nl80211_h_ */
diff --git a/bcmdhd.101.10.240.x/include/dbus.h b/bcmdhd.101.10.240.x/include/dbus.h
new file mode 100644 (file)
index 0000000..ff629ef
--- /dev/null
@@ -0,0 +1,598 @@
+/*
+ * Dongle BUS interface Abstraction layer
+ *   target serial buses like USB, SDIO, SPI, etc.
+ *
+ * Copyright (C) 1999-2019, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dbus.h 686618 2017-02-23 07:20:43Z $
+ */
+
+#ifndef __DBUS_H__
+#define __DBUS_H__
+
+#include "typedefs.h"
+#include <dhd_linux.h>
+
+extern uint dbus_msglevel;
+#define DBUS_ERROR_VAL 0x0001
+#define DBUS_TRACE_VAL 0x0002
+#define DBUS_INFO_VAL  0x0004
+
+#if defined(DHD_DEBUG)
+#define DBUSERR(args)          do {if (dbus_msglevel & DBUS_ERROR_VAL) printf args;} while (0)
+#define DBUSTRACE(args)                do {if (dbus_msglevel & DBUS_TRACE_VAL) printf args;} while (0)
+#define DBUSINFO(args)         do {if (dbus_msglevel & DBUS_INFO_VAL) printf args;} while (0)
+#else /* defined(DHD_DEBUG) */
+#define DBUSERR(args)
+#define DBUSTRACE(args)
+#define DBUSINFO(args)
+#endif
+
+enum {
+       DBUS_OK = 0,
+       DBUS_ERR = -200,
+       DBUS_ERR_TIMEOUT,
+       DBUS_ERR_DISCONNECT,
+       DBUS_ERR_NODEVICE,
+       DBUS_ERR_UNSUPPORTED,
+       DBUS_ERR_PENDING,
+       DBUS_ERR_NOMEM,
+       DBUS_ERR_TXFAIL,
+       DBUS_ERR_TXTIMEOUT,
+       DBUS_ERR_TXDROP,
+       DBUS_ERR_RXFAIL,
+       DBUS_ERR_RXDROP,
+       DBUS_ERR_TXCTLFAIL,
+       DBUS_ERR_RXCTLFAIL,
+       DBUS_ERR_REG_PARAM,
+       DBUS_STATUS_CANCELLED,
+       DBUS_ERR_NVRAM,
+       DBUS_JUMBO_NOMATCH,
+       DBUS_JUMBO_BAD_FORMAT,
+       DBUS_NVRAM_NONTXT,
+       DBUS_ERR_RXZLP
+};
+
+#define BCM_OTP_SIZE_43236  84 /* number of 16 bit values */
+#define BCM_OTP_SW_RGN_43236   24  /* start offset of SW config region */
+#define BCM_OTP_ADDR_43236 0x18000800 /* address of otp base */
+
+#define ERR_CBMASK_TXFAIL              0x00000001
+#define ERR_CBMASK_RXFAIL              0x00000002
+#define ERR_CBMASK_ALL                 0xFFFFFFFF
+
+#define DBUS_CBCTL_WRITE                       0
+#define DBUS_CBCTL_READ                                1
+#if defined(INTR_EP_ENABLE)
+#define DBUS_CBINTR_POLL                       2
+#endif /* defined(INTR_EP_ENABLE) */
+
+#define DBUS_TX_RETRY_LIMIT            3               /* retries for failed txirb */
+#define DBUS_TX_TIMEOUT_INTERVAL       250             /* timeout for txirb complete, in ms */
+
+#define DBUS_BUFFER_SIZE_TX    32000
+#define DBUS_BUFFER_SIZE_RX    24000
+
+#define DBUS_BUFFER_SIZE_TX_NOAGG      2048
+#define DBUS_BUFFER_SIZE_RX_NOAGG      2048
+
+/** DBUS types */
+enum {
+       DBUS_USB,
+       DBUS_SDIO,
+       DBUS_SPI,
+       DBUS_UNKNOWN
+};
+
+enum dbus_state {
+       DBUS_STATE_DL_PENDING,
+       DBUS_STATE_DL_DONE,
+       DBUS_STATE_UP,
+       DBUS_STATE_DOWN,
+       DBUS_STATE_PNP_FWDL,
+       DBUS_STATE_DISCONNECT,
+       DBUS_STATE_SLEEP,
+       DBUS_STATE_DL_NEEDED
+};
+
+enum dbus_pnp_state {
+       DBUS_PNP_DISCONNECT,
+       DBUS_PNP_SLEEP,
+       DBUS_PNP_RESUME
+};
+
+enum dbus_file {
+    DBUS_FIRMWARE,
+    DBUS_NVFILE
+};
+
+typedef enum _DEVICE_SPEED {
+       INVALID_SPEED = -1,
+       LOW_SPEED     =  1,     /**< USB 1.1: 1.5 Mbps */
+       FULL_SPEED,             /**< USB 1.1: 12  Mbps */
+       HIGH_SPEED,             /**< USB 2.0: 480 Mbps */
+       SUPER_SPEED,            /**< USB 3.0: 4.8 Gbps */
+} DEVICE_SPEED;
+
+typedef struct {
+       int bustype;
+       int vid;
+       int pid;
+       int devid;
+       int chiprev; /**< chip revsion number */
+       int mtu;
+       int nchan; /**< Data Channels */
+       int has_2nd_bulk_in_ep;
+} dbus_attrib_t;
+
+/* FIX: Account for errors related to DBUS;
+ * Let upper layer account for packets/bytes
+ */
+typedef struct {
+       uint32 rx_errors;
+       uint32 tx_errors;
+       uint32 rx_dropped;
+       uint32 tx_dropped;
+} dbus_stats_t;
+
+/**
+ * Configurable BUS parameters
+ */
+enum {
+       DBUS_CONFIG_ID_RXCTL_DEFERRES = 1,
+       DBUS_CONFIG_ID_AGGR_LIMIT,
+       DBUS_CONFIG_ID_KEEPIF_ON_DEVRESET
+};
+
+typedef struct {
+       uint32 config_id;
+       union {
+               uint32 general_param;
+               bool rxctl_deferrespok;
+               struct {
+                       int maxrxsf;
+                       int maxrxsize;
+                       int maxtxsf;
+                       int maxtxsize;
+               } aggr_param;
+       };
+} dbus_config_t;
+
+/**
+ * External Download Info
+ */
+typedef struct dbus_extdl {
+       uint8 *fw;
+       int fwlen;
+       uint8 *vars;
+       int varslen;
+} dbus_extdl_t;
+
+struct dbus_callbacks;
+struct exec_parms;
+
+typedef void *(*probe_cb_t)(void *arg, const char *desc, uint32 bustype,
+       uint16 bus_no, uint16 slot, uint32 hdrlen);
+typedef void (*disconnect_cb_t)(void *arg);
+typedef void *(*exec_cb_t)(struct exec_parms *args);
+
+/** Client callbacks registered during dbus_attach() */
+typedef struct dbus_callbacks {
+       void (*send_complete)(void *cbarg, void *info, int status);
+       void (*recv_buf)(void *cbarg, uint8 *buf, int len);
+       void (*recv_pkt)(void *cbarg, void *pkt);
+       void (*txflowcontrol)(void *cbarg, bool onoff);
+       void (*errhandler)(void *cbarg, int err);
+       void (*ctl_complete)(void *cbarg, int type, int status);
+       void (*state_change)(void *cbarg, int state);
+       void *(*pktget)(void *cbarg, uint len, bool send);
+       void (*pktfree)(void *cbarg, void *p, bool send);
+} dbus_callbacks_t;
+
+struct dbus_pub;
+struct bcmstrbuf;
+struct dbus_irb;
+struct dbus_irb_rx;
+struct dbus_irb_tx;
+struct dbus_intf_callbacks;
+
+typedef struct {
+       void* (*attach)(struct dbus_pub *pub, void *cbarg, struct dbus_intf_callbacks *cbs);
+       void (*detach)(struct dbus_pub *pub, void *bus);
+
+       int (*up)(void *bus);
+       int (*down)(void *bus);
+       int (*send_irb)(void *bus, struct dbus_irb_tx *txirb);
+       int (*recv_irb)(void *bus, struct dbus_irb_rx *rxirb);
+       int (*cancel_irb)(void *bus, struct dbus_irb_tx *txirb);
+       int (*send_ctl)(void *bus, uint8 *buf, int len);
+       int (*recv_ctl)(void *bus, uint8 *buf, int len);
+       int (*get_stats)(void *bus, dbus_stats_t *stats);
+       int (*get_attrib)(void *bus, dbus_attrib_t *attrib);
+
+       int (*pnp)(void *bus, int evnt);
+       int (*remove)(void *bus);
+       int (*resume)(void *bus);
+       int (*suspend)(void *bus);
+       int (*stop)(void *bus);
+       int (*reset)(void *bus);
+
+       /* Access to bus buffers directly */
+       void *(*pktget)(void *bus, int len);
+       void (*pktfree)(void *bus, void *pkt);
+
+       int  (*iovar_op)(void *bus, const char *name, void *params, int plen, void *arg, int len,
+               bool set);
+       void (*dump)(void *bus, struct bcmstrbuf *strbuf);
+       int  (*set_config)(void *bus, dbus_config_t *config);
+       int  (*get_config)(void *bus, dbus_config_t *config);
+
+       bool (*device_exists)(void *bus);
+       int (*dlneeded)(void *bus);
+       int  (*dlstart)(void *bus, uint8 *fw, int len);
+       int  (*dlrun)(void *bus);
+       bool (*recv_needed)(void *bus);
+
+       void *(*exec_rxlock)(void *bus, exec_cb_t func, struct exec_parms *args);
+       void *(*exec_txlock)(void *bus, exec_cb_t func, struct exec_parms *args);
+
+       int (*tx_timer_init)(void *bus);
+       int (*tx_timer_start)(void *bus, uint timeout);
+       int (*tx_timer_stop)(void *bus);
+
+       int (*sched_dpc)(void *bus);
+       int (*lock)(void *bus);
+       int (*unlock)(void *bus);
+       int (*sched_probe_cb)(void *bus);
+
+       int (*shutdown)(void *bus);
+
+       int (*recv_stop)(void *bus);
+       int (*recv_resume)(void *bus);
+
+       int (*recv_irb_from_ep)(void *bus, struct dbus_irb_rx *rxirb, uint ep_idx);
+
+       int (*readreg)(void *bus, uint32 regaddr, int datalen, uint32 *value);
+
+       /* Add from the bottom */
+} dbus_intf_t;
+
+typedef struct dbus_pub {
+       struct osl_info *osh;
+       dbus_stats_t stats;
+       dbus_attrib_t attrib;
+       enum dbus_state busstate;
+       DEVICE_SPEED device_speed;
+       int ntxq, nrxq, rxsize;
+       void *bus;
+       struct shared_info *sh;
+    void *dev_info;
+} dbus_pub_t;
+
+#define BUS_INFO(bus, type) (((type *) bus)->pub->bus)
+
+#define        ALIGNED_LOCAL_VARIABLE(var, align)                                      \
+       uint8   buffer[SDALIGN+64];                                             \
+       uint8   *var = (uint8 *)(((uintptr)&buffer[0]) & ~(align-1)) + align;
+
+/*
+ * Public Bus Function Interface
+ */
+
+/*
+ * FIX: Is there better way to pass OS/Host handles to DBUS but still
+ *      maintain common interface for all OS??
+ * Under NDIS, param1 needs to be MiniportHandle
+ *  For NDIS60, param2 is WdfDevice
+ * Under Linux, param1 and param2 are NULL;
+ */
+extern int dbus_register(int vid, int pid, probe_cb_t prcb, disconnect_cb_t discb, void *prarg,
+       void *param1, void *param2);
+extern int dbus_deregister(void);
+
+//extern int dbus_download_firmware(dbus_pub_t *pub);
+//extern int dbus_up(struct dhd_bus *pub);
+extern int dbus_down(dbus_pub_t *pub);
+//extern int dbus_stop(struct dhd_bus *pub);
+extern int dbus_shutdown(dbus_pub_t *pub);
+extern void dbus_flowctrl_rx(dbus_pub_t *pub, bool on);
+
+extern int dbus_send_txdata(dbus_pub_t *dbus, void *pktbuf);
+extern int dbus_send_buf(dbus_pub_t *pub, uint8 *buf, int len, void *info);
+extern int dbus_send_pkt(dbus_pub_t *pub, void *pkt, void *info);
+//extern int dbus_send_ctl(struct dhd_bus *pub, uint8 *buf, int len);
+//extern int dbus_recv_ctl(struct dhd_bus *pub, uint8 *buf, int len);
+extern int dbus_recv_bulk(dbus_pub_t *pub, uint32 ep_idx);
+extern int dbus_poll_intr(dbus_pub_t *pub);
+extern int dbus_get_stats(dbus_pub_t *pub, dbus_stats_t *stats);
+extern int dbus_get_device_speed(dbus_pub_t *pub);
+extern int dbus_set_config(dbus_pub_t *pub, dbus_config_t *config);
+extern int dbus_get_config(dbus_pub_t *pub, dbus_config_t *config);
+extern void * dbus_get_devinfo(dbus_pub_t *pub);
+
+extern void *dbus_pktget(dbus_pub_t *pub, int len);
+extern void dbus_pktfree(dbus_pub_t *pub, void* pkt);
+
+extern int dbus_set_errmask(dbus_pub_t *pub, uint32 mask);
+extern int dbus_pnp_sleep(dbus_pub_t *pub);
+extern int dbus_pnp_resume(dbus_pub_t *pub, int *fw_reload);
+extern int dbus_pnp_disconnect(dbus_pub_t *pub);
+
+//extern int dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
+//     void *params, int plen, void *arg, int len, bool set);
+
+extern void *dhd_dbus_txq(const dbus_pub_t *pub);
+extern uint dhd_dbus_hdrlen(const dbus_pub_t *pub);
+
+/*
+ * Private Common Bus Interface
+ */
+
+/** IO Request Block (IRB) */
+typedef struct dbus_irb {
+       struct dbus_irb *next;  /**< it's casted from dbus_irb_tx or dbus_irb_rx struct */
+} dbus_irb_t;
+
+typedef struct dbus_irb_rx {
+       struct dbus_irb irb; /* Must be first */
+       uint8 *buf;
+       int buf_len;
+       int actual_len;
+       void *pkt;
+       void *info;
+       void *arg;
+} dbus_irb_rx_t;
+
+typedef struct dbus_irb_tx {
+       struct dbus_irb irb;    /** Must be first */
+       uint8 *buf;             /** mutually exclusive with struct member 'pkt' */
+       int len;                /** length of field 'buf' */
+       void *pkt;              /** mutually exclusive with struct member 'buf' */
+       int retry_count;
+       void *info;
+       void *arg;
+       void *send_buf;         /**< linear  bufffer for LINUX when aggreagtion is enabled */
+} dbus_irb_tx_t;
+
+/**
+ * DBUS interface callbacks are different from user callbacks
+ * so, internally, different info can be passed to upper layer
+ */
+typedef struct dbus_intf_callbacks {
+       void (*send_irb_timeout)(void *cbarg, dbus_irb_tx_t *txirb);
+       void (*send_irb_complete)(void *cbarg, dbus_irb_tx_t *txirb, int status);
+       void (*recv_irb_complete)(void *cbarg, dbus_irb_rx_t *rxirb, int status);
+       void (*errhandler)(void *cbarg, int err);
+       void (*ctl_complete)(void *cbarg, int type, int status);
+       void (*state_change)(void *cbarg, int state);
+       bool (*isr)(void *cbarg, bool *wantdpc);
+       bool (*dpc)(void *cbarg, bool bounded);
+       void (*watchdog)(void *cbarg);
+       void *(*pktget)(void *cbarg, uint len, bool send);
+       void (*pktfree)(void *cbarg, void *p, bool send);
+       struct dbus_irb* (*getirb)(void *cbarg, bool send);
+       void (*rxerr_indicate)(void *cbarg, bool on);
+} dbus_intf_callbacks_t;
+
+/*
+ * Porting: To support new bus, port these functions below
+ */
+
+/*
+ * Bus specific Interface
+ * Implemented by dbus_usb.c/dbus_sdio.c
+ */
+extern int dbus_bus_register(int vid, int pid, probe_cb_t prcb, disconnect_cb_t discb, void *prarg,
+       dbus_intf_t **intf, void *param1, void *param2);
+extern int dbus_bus_deregister(void);
+extern void dbus_bus_fw_get(void *bus, uint8 **fw, int *fwlen, int *decomp);
+
+/*
+ * Bus-specific and OS-specific Interface
+ * Implemented by dbus_usb_[linux/ndis].c/dbus_sdio_[linux/ndis].c
+ */
+extern int dbus_bus_osl_register(int vid, int pid, probe_cb_t prcb, disconnect_cb_t discb,
+       void *prarg, dbus_intf_t **intf, void *param1, void *param2);
+extern int dbus_bus_osl_deregister(void);
+
+/*
+ * Bus-specific, OS-specific, HW-specific Interface
+ * Mainly for SDIO Host HW controller
+ */
+extern int dbus_bus_osl_hw_register(int vid, int pid, probe_cb_t prcb, disconnect_cb_t discb,
+       void *prarg, dbus_intf_t **intf);
+extern int dbus_bus_osl_hw_deregister(void);
+
+extern uint usbdev_bulkin_eps(void);
+#if defined(BCM_REQUEST_FW)
+extern void *dbus_get_fw_nvfile(int devid, int chiprev, uint8 **fw, int *fwlen, int type,
+  uint16 boardtype, uint16 boardrev);
+extern void dbus_release_fw_nvfile(void *firmware);
+#endif  /* #if defined(BCM_REQUEST_FW) */
+
+#if defined(EHCI_FASTPATH_TX) || defined(EHCI_FASTPATH_RX)
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+       /* Backward compatibility */
+       typedef unsigned int gfp_t;
+
+       #define dma_pool pci_pool
+       #define dma_pool_create(name, dev, size, align, alloc) \
+               pci_pool_create(name, dev, size, align, alloc, GFP_DMA | GFP_ATOMIC)
+       #define dma_pool_destroy(pool) pci_pool_destroy(pool)
+       #define dma_pool_alloc(pool, flags, handle) pci_pool_alloc(pool, flags, handle)
+       #define dma_pool_free(pool, vaddr, addr) pci_pool_free(pool, vaddr, addr)
+
+       #define dma_map_single(dev, addr, size, dir)    pci_map_single(dev, addr, size, dir)
+       #define dma_unmap_single(dev, hnd, size, dir)   pci_unmap_single(dev, hnd, size, dir)
+       #define DMA_FROM_DEVICE PCI_DMA_FROMDEVICE
+       #define DMA_TO_DEVICE PCI_DMA_TODEVICE
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)) */
+
+/* Availability of these functions varies (when present, they have two arguments) */
+#ifndef hc32_to_cpu
+       #define hc32_to_cpu(x)  le32_to_cpu(x)
+       #define cpu_to_hc32(x)  cpu_to_le32(x)
+       typedef unsigned int __hc32;
+#else
+       #error Two-argument functions needed
+#endif // endif
+
+/* Private USB opcode base */
+#define EHCI_FASTPATH          0x31
+#define        EHCI_SET_EP_BYPASS      EHCI_FASTPATH
+#define        EHCI_SET_BYPASS_CB      (EHCI_FASTPATH + 1)
+#define        EHCI_SET_BYPASS_DEV     (EHCI_FASTPATH + 2)
+#define        EHCI_DUMP_STATE         (EHCI_FASTPATH + 3)
+#define        EHCI_SET_BYPASS_POOL    (EHCI_FASTPATH + 4)
+#define        EHCI_CLR_EP_BYPASS      (EHCI_FASTPATH + 5)
+
+/*
+ * EHCI QTD structure (hardware and extension)
+ * NOTE that is does not need to (and does not) match its kernel counterpart
+ */
+#define EHCI_QTD_NBUFFERS       5
+#define EHCI_QTD_ALIGN         32
+#define EHCI_BULK_PACKET_SIZE  512
+#define EHCI_QTD_XACTERR_MAX   32
+
+struct ehci_qtd {
+       /* Hardware map */
+       volatile uint32_t       qtd_next;
+       volatile uint32_t       qtd_altnext;
+       volatile uint32_t       qtd_status;
+#define        EHCI_QTD_GET_BYTES(x)   (((x)>>16) & 0x7fff)
+#define        EHCI_QTD_IOC            0x00008000
+#define        EHCI_QTD_GET_CERR(x)    (((x)>>10) & 0x3)
+#define EHCI_QTD_SET_CERR(x)    ((x) << 10)
+#define        EHCI_QTD_GET_PID(x)     (((x)>>8) & 0x3)
+#define EHCI_QTD_SET_PID(x)     ((x) <<  8)
+#define EHCI_QTD_ACTIVE         0x80
+#define EHCI_QTD_HALTED         0x40
+#define EHCI_QTD_BUFERR         0x20
+#define EHCI_QTD_BABBLE         0x10
+#define EHCI_QTD_XACTERR        0x08
+#define EHCI_QTD_MISSEDMICRO    0x04
+       volatile uint32_t       qtd_buffer[EHCI_QTD_NBUFFERS];
+       volatile uint32_t       qtd_buffer_hi[EHCI_QTD_NBUFFERS];
+
+       /* Implementation extension */
+       dma_addr_t              qtd_self;               /**< own hardware address */
+       struct ehci_qtd         *obj_next;              /**< software link to the next QTD */
+       void                    *rpc;                   /**< pointer to the rpc buffer */
+       size_t                  length;                 /**< length of the data in the buffer */
+       void                    *buff;                  /**< pointer to the reassembly buffer */
+       int                     xacterrs;               /**< retry counter for qtd xact error */
+} __attribute__ ((aligned(EHCI_QTD_ALIGN)));
+
+#define        EHCI_NULL       __constant_cpu_to_le32(1) /* HW null pointer shall be odd */
+
+#define SHORT_READ_Q(token) (EHCI_QTD_GET_BYTES(token) != 0 && EHCI_QTD_GET_PID(token) == 1)
+
+/**
+ * Queue Head
+ * NOTE This structure is slightly different from the one in the kernel; but needs to stay
+ * compatible.
+ */
+struct ehci_qh {
+       /* Hardware map */
+       volatile uint32_t       qh_link;
+       volatile uint32_t       qh_endp;
+       volatile uint32_t       qh_endphub;
+       volatile uint32_t       qh_curqtd;
+
+       /* QTD overlay */
+       volatile uint32_t       ow_next;
+       volatile uint32_t       ow_altnext;
+       volatile uint32_t       ow_status;
+       volatile uint32_t       ow_buffer [EHCI_QTD_NBUFFERS];
+       volatile uint32_t       ow_buffer_hi [EHCI_QTD_NBUFFERS];
+
+       /* Extension (should match the kernel layout) */
+       dma_addr_t              unused0;
+       void                    *unused1;
+       struct list_head        unused2;
+       struct ehci_qtd         *dummy;
+       struct ehci_qh          *unused3;
+
+       struct ehci_hcd         *unused4;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+       struct kref             unused5;
+       unsigned                unused6;
+
+       uint8_t                 unused7;
+
+       /* periodic schedule info */
+       uint8_t                 unused8;
+       uint8_t                 unused9;
+       uint8_t                 unused10;
+       uint16_t                unused11;
+       uint16_t                unused12;
+       uint16_t                unused13;
+       struct usb_device       *unused14;
+#else
+       unsigned                unused5;
+
+       u8                      unused6;
+
+       /* periodic schedule info */
+       u8                      unused7;
+       u8                      unused8;
+       u8                      unused9;
+       unsigned short          unused10;
+       unsigned short          unused11;
+#define NO_FRAME ((unsigned short)~0)
+#ifdef EHCI_QUIRK_FIX
+       struct usb_device       *unused12;
+#endif /* EHCI_QUIRK_FIX */
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)) */
+       struct ehci_qtd         *first_qtd;
+               /* Link to the first QTD; this is an optimized equivalent of the qtd_list field */
+               /* NOTE that ehci_qh in ehci.h shall reserve this word */
+} __attribute__ ((aligned(EHCI_QTD_ALIGN)));
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+/** The corresponding structure in the kernel is used to get the QH */
+struct hcd_dev {       /* usb_device.hcpriv points to this */
+       struct list_head        unused0;
+       struct list_head        unused1;
+
+       /* array of QH pointers */
+       void                    *ep[32];
+};
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)) */
+
+int optimize_qtd_fill_with_rpc(const dbus_pub_t *pub,  int epn, struct ehci_qtd *qtd, void *rpc,
+       int token, int len);
+int optimize_qtd_fill_with_data(const dbus_pub_t *pub, int epn, struct ehci_qtd *qtd, void *data,
+       int token, int len);
+int optimize_submit_async(struct ehci_qtd *qtd, int epn);
+void inline optimize_ehci_qtd_init(struct ehci_qtd *qtd, dma_addr_t dma);
+struct ehci_qtd *optimize_ehci_qtd_alloc(gfp_t flags);
+void optimize_ehci_qtd_free(struct ehci_qtd *qtd);
+void optimize_submit_rx_request(const dbus_pub_t *pub, int epn, struct ehci_qtd *qtd_in, void *buf);
+#endif /* EHCI_FASTPATH_TX || EHCI_FASTPATH_RX */
+
+void  dbus_flowctrl_tx(void *dbi, bool on);
+#endif /* __DBUS_H__ */
diff --git a/bcmdhd.101.10.240.x/include/dhd_daemon.h b/bcmdhd.101.10.240.x/include/dhd_daemon.h
new file mode 100644 (file)
index 0000000..d0cb12d
--- /dev/null
@@ -0,0 +1,55 @@
+/*
+ * Header file for DHD daemon to handle timeouts
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef __BCM_DHDD_H__
+#define __BCM_DHDD_H__
+
+#include <brcm_nl80211.h>
+/**
+ * To maintain compatabily when dhd driver and dhd daemon is taken from different branches,
+ * make sure to keep this file same across dhd driver branch and dhd apps branch.
+ * TODO: Make this file as shared between apps and dhd.ko
+ */
+
+#define BCM_TO_MAGIC 0x600DB055
+#define NO_TRAP 0
+#define DO_TRAP        1
+
+typedef enum notify_dhd_daemon_reason {
+       REASON_COMMAND_TO,
+       REASON_OQS_TO,
+       REASON_SCAN_TO,
+       REASON_JOIN_TO,
+       REASON_DAEMON_STARTED,
+       REASON_DEVICE_TX_STUCK_WARNING,
+       REASON_DEVICE_TX_STUCK,
+       REASON_UNKOWN
+} notify_dhd_daemon_reason_t;
+
+typedef struct bcm_to_info {
+       int magic;
+       int reason;
+       int trap;
+} bcm_to_info_t;
+
+#endif /* __BCM_DHDD_H__ */
diff --git a/bcmdhd.101.10.240.x/include/dhdioctl.h b/bcmdhd.101.10.240.x/include/dhdioctl.h
new file mode 100644 (file)
index 0000000..8ccea8f
--- /dev/null
@@ -0,0 +1,352 @@
+/*
+ * Definitions for ioctls to access DHD iovars.
+ * Based on wlioctl.h (for Broadcom 802.11abg driver).
+ * (Moves towards generic ioctls for BCM drivers/iovars.)
+ *
+ * Definitions subject to change without notice.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _dhdioctl_h_
+#define        _dhdioctl_h_
+
+#include <typedefs.h>
+
+/* Linux network driver ioctl encoding */
+typedef struct dhd_ioctl {
+       uint32 cmd;     /* common ioctl definition */
+       void *buf;      /* pointer to user buffer */
+       uint32 len;     /* length of user buffer */
+       uint32 set;     /* get or set request boolean (optional) */
+       uint32 used;    /* bytes read or written (optional) */
+       uint32 needed;  /* bytes needed (optional) */
+       uint32 driver;  /* to identify target driver */
+} dhd_ioctl_t;
+
+/* Underlying BUS definition */
+enum {
+       BUS_TYPE_USB = 0, /* for USB dongles */
+       BUS_TYPE_SDIO, /* for SDIO dongles */
+       BUS_TYPE_PCIE /* for PCIE dongles */
+};
+
+typedef enum {
+       DMA_XFER_SUCCESS = 0,
+       DMA_XFER_IN_PROGRESS,
+       DMA_XFER_FAILED
+} dma_xfer_status_t;
+
+typedef enum d11_lpbk_type {
+       M2M_DMA_LPBK = 0,
+       D11_LPBK = 1,
+       BMC_LPBK = 2,
+       M2M_NON_DMA_LPBK = 3,
+       D11_HOST_MEM_LPBK = 4,
+       BMC_HOST_MEM_LPBK = 5,
+       MAX_LPBK = 6
+} dma_xfer_type_t;
+
+typedef struct dmaxfer_info {
+       uint16 version;
+       uint16 length;
+       dma_xfer_status_t status;
+       dma_xfer_type_t type;
+       uint src_delay;
+       uint dest_delay;
+       uint should_wait;
+       uint core_num;
+       int error_code;
+       uint32 num_bytes;
+       uint64 time_taken;
+       uint64 tput;
+} dma_xfer_info_t;
+
+#define DHD_DMAXFER_VERSION 0x1
+
+#define DHD_FILENAME_MAX 64
+#define DHD_PATHNAME_MAX 128
+
+typedef struct tput_test {
+       uint16 version;
+       uint16 length;
+       uint8 direction;
+       uint8 tput_test_running;
+       uint8 mac_sta[6];
+       uint8 mac_ap[6];
+       uint8 PAD[2];
+       uint32 payload_size;
+       uint32 num_pkts;
+       uint32 timeout_ms;
+       uint32 flags;
+
+       uint32 pkts_good;
+       uint32 pkts_bad;
+       uint32 pkts_cmpl;
+       uint64 time_ms;
+       uint64 tput_bps;
+} tput_test_t;
+
+typedef enum {
+       TPUT_DIR_TX = 0,
+       TPUT_DIR_RX
+} tput_dir_t;
+
+/*
+ * Current supported roles considered for policy management are AP, P2P and NAN.
+ * Hence max value is limited to 3.
+ */
+#define DHD_MAX_IFACE_PRIORITY 3u
+typedef enum dhd_iftype {
+       DHD_IF_TYPE_STA         = 0,
+       DHD_IF_TYPE_AP          = 1,
+
+       DHD_IF_TYPE_NAN_NMI     = 3,
+       DHD_IF_TYPE_NAN         = 4,
+       DHD_IF_TYPE_P2P_GO      = 5,
+       DHD_IF_TYPE_P2P_GC      = 6,
+       DHD_IF_TYPE_P2P_DISC    = 7,
+       DHD_IF_TYPE_IBSS        = 8,
+       DHD_IF_TYPE_MONITOR     = 9,
+       DHD_IF_TYPE_AIBSS       = 10,
+       DHD_IF_TYPE_MAX
+} dhd_iftype_t;
+
+typedef struct dhd_iface_mgmt_data {
+       uint8 policy;
+       uint8 priority[DHD_IF_TYPE_MAX];
+} dhd_iface_mgmt_data_t;
+
+typedef enum dhd_iface_mgmt_policy {
+       DHD_IF_POLICY_DEFAULT           = 0,
+       DHD_IF_POLICY_FCFS              = 1,
+       DHD_IF_POLICY_LP                = 2,
+       DHD_IF_POLICY_ROLE_PRIORITY     = 3,
+       DHD_IF_POLICY_CUSTOM            = 4,
+       DHD_IF_POLICY_INVALID           = 5
+} dhd_iface_mgmt_policy_t;
+
+#define TPUT_TEST_T_VER 1
+#define TPUT_TEST_T_LEN 68
+#define TPUT_TEST_MIN_PAYLOAD_SIZE 16
+#define TPUT_TEST_USE_ETHERNET_HDR 0x1
+#define TPUT_TEST_USE_802_11_HDR 0x2
+
+/* per-driver magic numbers */
+#define DHD_IOCTL_MAGIC                0x00444944
+
+/* bump this number if you change the ioctl interface */
+#define DHD_IOCTL_VERSION      1
+
+/*
+ * Increase the DHD_IOCTL_MAXLEN to 16K for supporting download of NVRAM files of size
+ * > 8K. In the existing implementation when NVRAM is to be downloaded via the "vars"
+ * DHD IOVAR, the NVRAM is copied to the DHD Driver memory. Later on when "dwnldstate" is
+ * invoked with FALSE option, the NVRAM gets copied from the DHD driver to the Dongle
+ * memory. The simple way to support this feature without modifying the DHD application,
+ * driver logic is to increase the DHD_IOCTL_MAXLEN size. This macro defines the "size"
+ * of the buffer in which data is exchanged between the DHD App and DHD driver.
+ */
+#define        DHD_IOCTL_MAXLEN        (16384) /* max length ioctl buffer required */
+#define        DHD_IOCTL_SMLEN         256             /* "small" length ioctl buffer required */
+
+/* common ioctl definitions */
+#define DHD_GET_MAGIC                          0
+#define DHD_GET_VERSION                                1
+#define DHD_GET_VAR                            2
+#define DHD_SET_VAR                            3
+
+/* message levels */
+#define DHD_ERROR_VAL  0x0001
+#define DHD_TRACE_VAL  0x0002
+#define DHD_INFO_VAL   0x0004
+#define DHD_DATA_VAL   0x0008
+#define DHD_CTL_VAL    0x0010
+#define DHD_TIMER_VAL  0x0020
+#define DHD_HDRS_VAL   0x0040
+#define DHD_BYTES_VAL  0x0080
+#define DHD_INTR_VAL   0x0100
+#define DHD_LOG_VAL    0x0200
+#define DHD_GLOM_VAL   0x0400
+#define DHD_EVENT_VAL  0x0800
+#define DHD_BTA_VAL    0x1000
+#define DHD_ISCAN_VAL  0x2000
+#define DHD_ARPOE_VAL  0x4000
+#define DHD_REORDER_VAL        0x8000
+#define DHD_NOCHECKDIED_VAL            0x20000 /* UTF WAR */
+#define DHD_PNO_VAL            0x80000
+#define DHD_RTT_VAL            0x100000
+#define DHD_MSGTRACE_VAL       0x200000
+#define DHD_FWLOG_VAL          0x400000
+#define DHD_DBGIF_VAL          0x800000
+#ifdef DHD_PCIE_NATIVE_RUNTIMEPM
+#define DHD_RPM_VAL            0x1000000
+#endif /* DHD_PCIE_NATIVE_RUNTIMEPM */
+#define DHD_PKT_MON_VAL                0x2000000
+#define DHD_PKT_MON_DUMP_VAL   0x4000000
+#define DHD_ERROR_MEM_VAL      0x8000000
+#define DHD_DNGL_IOVAR_SET_VAL 0x10000000 /**< logs the setting of dongle iovars */
+#define DHD_LPBKDTDUMP_VAL     0x20000000
+#define DHD_PRSRV_MEM_VAL      0x40000000
+#define DHD_IOVAR_MEM_VAL      0x80000000
+#define DHD_ANDROID_VAL        0x10000
+#define DHD_IW_VAL     0x20000
+#define DHD_CFG_VAL    0x40000
+#define DHD_CONFIG_VAL 0x80000
+#define DHD_DUMP_VAL   0x100000
+#define DUMP_EAPOL_VAL 0x0001
+#define DUMP_ARP_VAL   0x0002
+#define DUMP_DHCP_VAL  0x0004
+#define DUMP_ICMP_VAL  0x0008
+#define DUMP_DNS_VAL   0x0010
+#define DUMP_TRX_VAL   0x0080
+
+#ifdef SDTEST
+/* For pktgen iovar */
+typedef struct dhd_pktgen {
+       uint32 version;         /* To allow structure change tracking */
+       uint32 freq;            /* Max ticks between tx/rx attempts */
+       uint32 count;           /* Test packets to send/rcv each attempt */
+       uint32 print;           /* Print counts every <print> attempts */
+       uint32 total;           /* Total packets (or bursts) */
+       uint32 minlen;          /* Minimum length of packets to send */
+       uint32 maxlen;          /* Maximum length of packets to send */
+       uint32 numsent;         /* Count of test packets sent */
+       uint32 numrcvd;         /* Count of test packets received */
+       uint32 numfail;         /* Count of test send failures */
+       uint32 mode;            /* Test mode (type of test packets) */
+       uint32 stop;            /* Stop after this many tx failures */
+} dhd_pktgen_t;
+
+/* Version in case structure changes */
+#define DHD_PKTGEN_VERSION 2
+
+/* Type of test packets to use */
+#define DHD_PKTGEN_ECHO                1 /* Send echo requests */
+#define DHD_PKTGEN_SEND        2 /* Send discard packets */
+#define DHD_PKTGEN_RXBURST     3 /* Request dongle send N packets */
+#define DHD_PKTGEN_RECV                4 /* Continuous rx from continuous tx dongle */
+#endif /* SDTEST */
+
+/* Enter idle immediately (no timeout) */
+#define DHD_IDLE_IMMEDIATE     (-1)
+
+/* Values for idleclock iovar: other values are the sd_divisor to use when idle */
+#define DHD_IDLE_ACTIVE        0       /* Do not request any SD clock change when idle */
+#define DHD_IDLE_STOP   (-1)   /* Request SD clock be stopped (and use SD1 mode) */
+
+enum dhd_maclist_xtlv_type {
+       DHD_MACLIST_XTLV_R = 0x1,
+       DHD_MACLIST_XTLV_X = 0x2,
+       DHD_SVMPLIST_XTLV = 0x3
+};
+
+typedef struct _dhd_maclist_t {
+       uint16 version;         /* Version */
+       uint16 bytes_len;       /* Total bytes length of lists, XTLV headers and paddings */
+       uint8 plist[1];         /* Pointer to the first list */
+} dhd_maclist_t;
+
+typedef struct _dhd_pd11regs_param {
+       uint16 start_idx;
+       uint8 verbose;
+       uint8 pad;
+       uint8 plist[1];
+} dhd_pd11regs_param;
+
+typedef struct _dhd_pd11regs_buf {
+       uint16 idx;
+       uint8 pad[2];
+       uint8 pbuf[1];
+} dhd_pd11regs_buf;
+
+/* BT logging and memory dump */
+
+#define BT_LOG_BUF_MAX_SIZE            (DHD_IOCTL_MAXLEN - (2 * sizeof(int)))
+#define BT_LOG_BUF_NOT_AVAILABLE       0
+#define BT_LOG_NEXT_BUF_NOT_AVAIL      1
+#define BT_LOG_NEXT_BUF_AVAIL          2
+#define BT_LOG_NOT_READY               3
+
+typedef struct bt_log_buf_info {
+       int availability;
+       int size;
+       char buf[BT_LOG_BUF_MAX_SIZE];
+} bt_log_buf_info_t;
+
+/* request BT memory in chunks */
+typedef struct bt_mem_req {
+       int offset;     /* offset from BT memory start */
+       int buf_size;   /* buffer size per chunk */
+} bt_mem_req_t;
+
+typedef struct fw_download_info {
+       uint32  fw_start_addr;
+       uint32  fw_size;
+       uint32  fw_entry_pt;
+       char    fw_signature_fname[DHD_FILENAME_MAX];
+       char    bootloader_fname[DHD_FILENAME_MAX];
+       uint32  bootloader_start_addr;
+       char    fw_path[DHD_PATHNAME_MAX];
+} fw_download_info_t;
+
+/* max dest supported */
+#define DEBUG_BUF_DEST_MAX     4
+
+/* debug buf dest stat */
+typedef struct debug_buf_dest_stat {
+       uint32 stat[DEBUG_BUF_DEST_MAX];
+} debug_buf_dest_stat_t;
+
+/* devreset */
+#define DHD_DEVRESET_VERSION 1
+
+typedef struct devreset_info {
+       uint16 version;
+       uint16 length;
+       uint16 mode;
+       int16 status;
+} devreset_info_t;
+
+#ifdef DHD_TX_PROFILE
+
+#define DHD_TX_PROFILE_VERSION 1
+
+/* tx_profile structure for tagging */
+typedef struct dhd_tx_profile_protocol {
+       uint16  version;
+       uint8   profile_index;
+       uint8   layer;
+       uint32  protocol_number;
+       uint16  src_port;
+       uint16  dest_port;
+} dhd_tx_profile_protocol_t;
+
+#define DHD_TX_PROFILE_DATA_LINK_LAYER (2u)    /* data link layer protocols */
+#define DHD_TX_PROFILE_NETWORK_LAYER   (3u)    /* network layer protocols */
+
+#define DHD_MAX_PROFILE_INDEX  (7u)    /* three bits are available to encode
+                                          the tx profile index in the rate
+                                          field in host_txbuf_post_t
+                                        */
+#define DHD_MAX_PROFILES       (1u)    /* ucode only supports 1 profile atm */
+
+#endif /* defined(DHD_TX_PROFILE) */
+#endif /* _dhdioctl_h_ */
diff --git a/bcmdhd.101.10.240.x/include/dngl_stats.h b/bcmdhd.101.10.240.x/include/dngl_stats.h
new file mode 100644 (file)
index 0000000..79bc720
--- /dev/null
@@ -0,0 +1,383 @@
+/*
+ * Common stats definitions for clients of dongle
+ * ports
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef _dngl_stats_h_
+#define _dngl_stats_h_
+
+#include <ethernet.h>
+#include <802.11.h>
+
+/* XXX happens to mirror a section of linux's net_device_stats struct */
+typedef struct {
+       unsigned long   rx_packets;             /* total packets received */
+       unsigned long   tx_packets;             /* total packets transmitted */
+       unsigned long   rx_bytes;               /* total bytes received */
+       unsigned long   tx_bytes;               /* total bytes transmitted */
+       unsigned long   rx_errors;              /* bad packets received */
+       unsigned long   tx_errors;              /* packet transmit problems */
+       unsigned long   rx_dropped;             /* packets dropped by dongle */
+       unsigned long   tx_dropped;             /* packets dropped by dongle */
+       unsigned long   multicast;      /* multicast packets received */
+} dngl_stats_t;
+
+typedef int32 wifi_radio;
+typedef int32 wifi_channel;
+typedef int32 wifi_rssi;
+typedef struct { uint16 version; uint16 length; } ver_len;
+
+typedef enum wifi_channel_width {
+       WIFI_CHAN_WIDTH_20        = 0,
+       WIFI_CHAN_WIDTH_40        = 1,
+       WIFI_CHAN_WIDTH_80        = 2,
+       WIFI_CHAN_WIDTH_160   = 3,
+       WIFI_CHAN_WIDTH_80P80 = 4,
+       WIFI_CHAN_WIDTH_5         = 5,
+       WIFI_CHAN_WIDTH_10        = 6,
+       WIFI_CHAN_WIDTH_INVALID = -1
+} wifi_channel_width_t;
+
+typedef enum {
+       WIFI_DISCONNECTED = 0,
+       WIFI_AUTHENTICATING = 1,
+       WIFI_ASSOCIATING = 2,
+       WIFI_ASSOCIATED = 3,
+       WIFI_EAPOL_STARTED = 4,   /* if done by firmware/driver */
+       WIFI_EAPOL_COMPLETED = 5, /* if done by firmware/driver */
+} wifi_connection_state;
+
+typedef enum {
+       WIFI_ROAMING_IDLE = 0,
+       WIFI_ROAMING_ACTIVE = 1
+} wifi_roam_state;
+
+typedef enum {
+       WIFI_INTERFACE_STA = 0,
+       WIFI_INTERFACE_SOFTAP = 1,
+       WIFI_INTERFACE_IBSS = 2,
+       WIFI_INTERFACE_P2P_CLIENT = 3,
+       WIFI_INTERFACE_P2P_GO = 4,
+       WIFI_INTERFACE_NAN = 5,
+       WIFI_INTERFACE_MESH = 6
+} wifi_interface_mode;
+
+#define WIFI_CAPABILITY_QOS          0x00000001     /* set for QOS association */
+#define WIFI_CAPABILITY_PROTECTED    0x00000002     /* set for protected association (802.11
+                                                    * beacon frame control protected bit set)
+                                                    */
+#define WIFI_CAPABILITY_INTERWORKING 0x00000004     /* set if 802.11 Extended Capabilities
+                                                    * element interworking bit is set
+                                                    */
+#define WIFI_CAPABILITY_HS20         0x00000008     /* set for HS20 association */
+#define WIFI_CAPABILITY_SSID_UTF8    0x00000010     /* set is 802.11 Extended Capabilities
+                                                    * element UTF-8 SSID bit is set
+                                                    */
+#define WIFI_CAPABILITY_COUNTRY      0x00000020     /* set is 802.11 Country Element is present */
+#define PACK_ATTRIBUTE __attribute__ ((packed))
+typedef struct {
+       wifi_interface_mode mode;     /* interface mode */
+       uint8 mac_addr[6];               /* interface mac address (self) */
+       uint8 PAD[2];
+       wifi_connection_state state;  /* connection state (valid for STA, CLI only) */
+       wifi_roam_state roaming;      /* roaming state */
+       uint32 capabilities;             /* WIFI_CAPABILITY_XXX (self) */
+       uint8 ssid[DOT11_MAX_SSID_LEN+1]; /* null terminated SSID */
+       uint8 bssid[ETHER_ADDR_LEN];     /* bssid */
+       uint8 PAD[1];
+       uint8 ap_country_str[3];         /* country string advertised by AP */
+       uint8 country_str[3];            /* country string for this association */
+       uint8 PAD[2];
+} wifi_interface_info;
+
+typedef wifi_interface_info *wifi_interface_handle;
+
+/* channel information */
+typedef struct {
+       wifi_channel_width_t width;   /* channel width (20, 40, 80, 80+80, 160) */
+       wifi_channel center_freq;   /* primary 20 MHz channel */
+       wifi_channel center_freq0;  /* center frequency (MHz) first segment */
+       wifi_channel center_freq1;  /* center frequency (MHz) second segment */
+} wifi_channel_info;
+
+/* wifi rate */
+typedef struct {
+       uint32 preamble;   /* 0: OFDM, 1:CCK, 2:HT 3:VHT 4..7 reserved */
+       uint32 nss;     /* 0:1x1, 1:2x2, 3:3x3, 4:4x4 */
+       uint32 bw;      /* 0:20MHz, 1:40Mhz, 2:80Mhz, 3:160Mhz */
+       uint32 rateMcsIdx; /* OFDM/CCK rate code would be as per ieee std
+                           * in the units of 0.5mbps
+                           */
+                       /* HT/VHT it would be mcs index */
+       uint32 reserved;   /* reserved */
+       uint32 bitrate;    /* units of 100 Kbps */
+} wifi_rate;
+
+typedef struct {
+       uint32 preamble   :3;   /* 0: OFDM, 1:CCK, 2:HT 3:VHT 4..7 reserved */
+       uint32 nss        :2;   /* 0:1x1, 1:2x2, 3:3x3, 4:4x4 */
+       uint32 bw         :3;   /* 0:20MHz, 1:40Mhz, 2:80Mhz, 3:160Mhz */
+       uint32 rateMcsIdx :8;   /* OFDM/CCK rate code would be as per ieee std
+                                       * in the units of 0.5mbps HT/VHT it would be
+                                       * mcs index
+                                       */
+       uint32 reserved  :16;   /* reserved */
+       uint32 bitrate;         /* units of 100 Kbps */
+} wifi_rate_v1;
+
+/* channel statistics */
+typedef struct {
+       wifi_channel_info channel;  /* channel */
+       uint32 on_time;                 /* msecs the radio is awake (32 bits number
+                                        * accruing over time)
+                                        */
+       uint32 cca_busy_time;          /* msecs the CCA register is busy (32 bits number
+                                       * accruing over time)
+                                       */
+} wifi_channel_stat;
+
+/* radio statistics */
+typedef struct {
+       struct {
+               uint16 version;
+               uint16 length;
+       };
+       wifi_radio radio;               /* wifi radio (if multiple radio supported) */
+       uint32 on_time;                    /* msecs the radio is awake (32 bits number
+                                           * accruing over time)
+                                           */
+       uint32 tx_time;                    /* msecs the radio is transmitting (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 rx_time;                    /* msecs the radio is in active receive (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_scan;               /* msecs the radio is awake due to all scan (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_nbd;                /* msecs the radio is awake due to NAN (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_gscan;              /* msecs the radio is awake due to G?scan (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_roam_scan;          /* msecs the radio is awake due to roam?scan (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_pno_scan;           /* msecs the radio is awake due to PNO scan (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_hs20;               /* msecs the radio is awake due to HS2.0 scans and
+                                           * GAS exchange (32 bits number accruing over time)
+                                           */
+       uint32 num_channels;               /* number of channels */
+       wifi_channel_stat channels[1];   /* channel statistics */
+} wifi_radio_stat;
+
+typedef struct {
+       wifi_radio radio;
+       uint32 on_time;
+       uint32 tx_time;
+       uint32 rx_time;
+       uint32 on_time_scan;
+       uint32 on_time_nbd;
+       uint32 on_time_gscan;
+       uint32 on_time_roam_scan;
+       uint32 on_time_pno_scan;
+       uint32 on_time_hs20;
+       uint32 num_channels;
+} wifi_radio_stat_h;
+
+/* per rate statistics */
+typedef struct {
+       wifi_rate_v1 rate;     /* rate information */
+       uint32 tx_mpdu;        /* number of successfully transmitted data pkts (ACK rcvd) */
+       uint32 rx_mpdu;        /* number of received data pkts */
+       uint32 mpdu_lost;      /* number of data packet losses (no ACK) */
+       uint32 retries;        /* total number of data pkt retries */
+       uint32 retries_short;  /* number of short data pkt retries */
+       uint32 retries_long;   /* number of long data pkt retries */
+} wifi_rate_stat_v1;
+
+typedef struct {
+       uint16 version;
+       uint16 length;
+       uint32 tx_mpdu;        /* number of successfully transmitted data pkts (ACK rcvd) */
+       uint32 rx_mpdu;        /* number of received data pkts */
+       uint32 mpdu_lost;      /* number of data packet losses (no ACK) */
+       uint32 retries;        /* total number of data pkt retries */
+       uint32 retries_short;  /* number of short data pkt retries */
+       uint32 retries_long;   /* number of long data pkt retries */
+       wifi_rate rate;
+} wifi_rate_stat;
+
+/* access categories */
+typedef enum {
+       WIFI_AC_VO  = 0,
+       WIFI_AC_VI  = 1,
+       WIFI_AC_BE  = 2,
+       WIFI_AC_BK  = 3,
+       WIFI_AC_MAX = 4
+} wifi_traffic_ac;
+
+/* wifi peer type */
+typedef enum
+{
+       WIFI_PEER_STA,
+       WIFI_PEER_AP,
+       WIFI_PEER_P2P_GO,
+       WIFI_PEER_P2P_CLIENT,
+       WIFI_PEER_NAN,
+       WIFI_PEER_TDLS,
+       WIFI_PEER_INVALID
+} wifi_peer_type;
+
+/* per peer statistics */
+typedef struct {
+       wifi_peer_type type;           /* peer type (AP, TDLS, GO etc.) */
+       uint8 peer_mac_address[6];        /* mac address */
+       uint32 capabilities;              /* peer WIFI_CAPABILITY_XXX */
+       uint32 num_rate;                  /* number of rates */
+       wifi_rate_stat rate_stats[1];   /* per rate statistics, number of entries  = num_rate */
+} wifi_peer_info;
+
+/* per access category statistics */
+typedef struct {
+       wifi_traffic_ac ac;             /* access category (VI, VO, BE, BK) */
+       uint32 tx_mpdu;                    /* number of successfully transmitted unicast data pkts
+                                           * (ACK rcvd)
+                                           */
+       uint32 rx_mpdu;                    /* number of received unicast mpdus */
+       uint32 tx_mcast;                   /* number of succesfully transmitted multicast
+                                           * data packets
+                                           */
+                                          /* STA case: implies ACK received from AP for the
+                                           * unicast packet in which mcast pkt was sent
+                                           */
+       uint32 rx_mcast;                   /* number of received multicast data packets */
+       uint32 rx_ampdu;                   /* number of received unicast a-mpdus */
+       uint32 tx_ampdu;                   /* number of transmitted unicast a-mpdus */
+       uint32 mpdu_lost;                  /* number of data pkt losses (no ACK) */
+       uint32 retries;                    /* total number of data pkt retries */
+       uint32 retries_short;              /* number of short data pkt retries */
+       uint32 retries_long;               /* number of long data pkt retries */
+       uint32 contention_time_min;        /* data pkt min contention time (usecs) */
+       uint32 contention_time_max;        /* data pkt max contention time (usecs) */
+       uint32 contention_time_avg;        /* data pkt avg contention time (usecs) */
+       uint32 contention_num_samples;     /* num of data pkts used for contention statistics */
+} wifi_wmm_ac_stat;
+
+/* interface statistics */
+typedef struct {
+       wifi_interface_handle iface;          /* wifi interface */
+       wifi_interface_info info;             /* current state of the interface */
+       uint32 beacon_rx;                     /* access point beacon received count from
+                                              * connected AP
+                                              */
+       uint64 average_tsf_offset;      /* average beacon offset encountered (beacon_TSF - TBTT)
+                                       * The average_tsf_offset field is used so as to calculate
+                                       * the typical beacon contention time on the channel as well
+                                       * may be used to debug beacon synchronization and related
+                                       * power consumption issue
+                                       */
+       uint32 leaky_ap_detected;       /* indicate that this AP
+                                       * typically leaks packets beyond
+                                       * the driver guard time.
+                                       */
+       uint32 leaky_ap_avg_num_frames_leaked;  /* average number of frame leaked by AP after
+                                       * frame with PM bit set was ACK'ed by AP
+                                       */
+       uint32 leaky_ap_guard_time;             /* guard time currently in force
+                                       * (when implementing IEEE power management
+                                       * based on frame control PM bit), How long
+                                       * driver waits before shutting down the radio and after
+                                       * receiving an ACK for a data frame with PM bit set)
+                                       */
+       uint32 mgmt_rx;                       /* access point mgmt frames received count from
+                                      * connected AP (including Beacon)
+                                      */
+       uint32 mgmt_action_rx;                /* action frames received count */
+       uint32 mgmt_action_tx;                /* action frames transmit count */
+       wifi_rssi rssi_mgmt;                  /* access Point Beacon and Management frames RSSI
+                                              * (averaged)
+                                              */
+       wifi_rssi rssi_data;                  /* access Point Data Frames RSSI (averaged) from
+                                              * connected AP
+                                              */
+       wifi_rssi rssi_ack;                   /* access Point ACK RSSI (averaged) from
+                                              * connected AP
+                                              */
+       wifi_wmm_ac_stat ac[WIFI_AC_MAX];     /* per ac data packet statistics */
+       uint32 num_peers;                        /* number of peers */
+       wifi_peer_info peer_info[1];           /* per peer statistics */
+} wifi_iface_stat;
+
+#ifdef CONFIG_COMPAT
+/* interface statistics */
+typedef struct {
+       compat_uptr_t iface;          /* wifi interface */
+       wifi_interface_info info;             /* current state of the interface */
+       uint32 beacon_rx;                     /* access point beacon received count from
+                                              * connected AP
+                                              */
+       uint64 average_tsf_offset;      /* average beacon offset encountered (beacon_TSF - TBTT)
+                                       * The average_tsf_offset field is used so as to calculate
+                                       * the typical beacon contention time on the channel as well
+                                       * may be used to debug beacon synchronization and related
+                                       * power consumption issue
+                                       */
+       uint32 leaky_ap_detected;       /* indicate that this AP
+                                       * typically leaks packets beyond
+                                       * the driver guard time.
+                                       */
+       uint32 leaky_ap_avg_num_frames_leaked;  /* average number of frame leaked by AP after
+                                       * frame with PM bit set was ACK'ed by AP
+                                       */
+       uint32 leaky_ap_guard_time;             /* guard time currently in force
+                                       * (when implementing IEEE power management
+                                       * based on frame control PM bit), How long
+                                       * driver waits before shutting down the radio and after
+                                       * receiving an ACK for a data frame with PM bit set)
+                                       */
+       uint32 mgmt_rx;                       /* access point mgmt frames received count from
+                                      * connected AP (including Beacon)
+                                      */
+       uint32 mgmt_action_rx;                /* action frames received count */
+       uint32 mgmt_action_tx;                /* action frames transmit count */
+       wifi_rssi rssi_mgmt;                  /* access Point Beacon and Management frames RSSI
+                                              * (averaged)
+                                              */
+       wifi_rssi rssi_data;                  /* access Point Data Frames RSSI (averaged) from
+                                              * connected AP
+                                              */
+       wifi_rssi rssi_ack;                   /* access Point ACK RSSI (averaged) from
+                                              * connected AP
+                                              */
+       wifi_wmm_ac_stat ac[WIFI_AC_MAX];     /* per ac data packet statistics */
+       uint32 num_peers;                        /* number of peers */
+       wifi_peer_info peer_info[1];           /* per peer statistics */
+} compat_wifi_iface_stat;
+#endif /* CONFIG_COMPAT */
+
+#endif /* _dngl_stats_h_ */
diff --git a/bcmdhd.101.10.240.x/include/dnglevent.h b/bcmdhd.101.10.240.x/include/dnglevent.h
new file mode 100644 (file)
index 0000000..e372ccc
--- /dev/null
@@ -0,0 +1,137 @@
+/*
+ * Broadcom Event protocol definitions
+ *
+ * Dependencies: bcmeth.h
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ *
+ * -----------------------------------------------------------------------------
+ *
+ */
+
+/*
+ * Broadcom dngl Ethernet Events protocol defines
+ *
+ */
+
+#ifndef _DNGLEVENT_H_
+#define _DNGLEVENT_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+#include <bcmeth.h>
+#include <ethernet.h>
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+#define BCM_DNGL_EVENT_MSG_VERSION             1
+#define DNGL_E_RSRVD_1                         0x0
+#define DNGL_E_RSRVD_2                         0x1
+#define DNGL_E_SOCRAM_IND                      0x2
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+       uint16  version; /* Current version is 1 */
+       uint16  reserved; /* reserved for any future extension */
+       uint16  event_type; /* DNGL_E_SOCRAM_IND */
+       uint16  datalen; /* Length of the event payload */
+} BWL_POST_PACKED_STRUCT bcm_dngl_event_msg_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct bcm_dngl_event {
+       struct ether_header eth;
+       bcmeth_hdr_t        bcm_hdr;
+       bcm_dngl_event_msg_t      dngl_event;
+       /* data portion follows */
+} BWL_POST_PACKED_STRUCT bcm_dngl_event_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct bcm_dngl_socramind {
+       uint16                  tag;    /* data tag */
+       uint16                  length; /* data length */
+       uint8                   value[1]; /* data value with variable length specified by length */
+} BWL_POST_PACKED_STRUCT bcm_dngl_socramind_t;
+
+/* SOCRAM_IND type tags */
+typedef enum socram_ind_tag {
+       SOCRAM_IND_ASSERT_TAG = 1,
+       SOCRAM_IND_TAG_HEALTH_CHECK = 2
+} socram_ind_tag_t;
+
+/* Health check top level module tags */
+typedef BWL_PRE_PACKED_STRUCT struct bcm_dngl_healthcheck {
+       uint16                  top_module_tag; /* top level module tag */
+       uint16                  top_module_len; /* Type of PCIE issue indication */
+       uint8                   value[1]; /* data value with variable length specified by length */
+} BWL_POST_PACKED_STRUCT bcm_dngl_healthcheck_t;
+
+/* Health check top level module tags */
+#define HEALTH_CHECK_TOP_LEVEL_MODULE_PCIEDEV_RTE 1
+#define HEALTH_CHECK_PCIEDEV_VERSION_1 1
+#define HEALTH_CHECK_PCIEDEV_FLAG_IN_D3_SHIFT  0
+#define HEALTH_CHECK_PCIEDEV_FLAG_AER_SHIFT            1
+#define HEALTH_CHECK_PCIEDEV_FLAG_LINKDOWN_SHIFT               2
+#define HEALTH_CHECK_PCIEDEV_FLAG_MSI_INT_SHIFT                        3
+#define HEALTH_CHECK_PCIEDEV_FLAG_NODS_SHIFT                   4
+#define HEALTH_CHECK_PCIEDEV_FLAG_NO_HOST_WAKE_SHIFT           5
+#define HEALTH_CHECK_PCIEDEV_FLAG_IN_D3        1 << HEALTH_CHECK_PCIEDEV_FLAG_IN_D3_SHIFT
+#define HEALTH_CHECK_PCIEDEV_FLAG_AER  1 << HEALTH_CHECK_PCIEDEV_FLAG_AER_SHIFT
+#define HEALTH_CHECK_PCIEDEV_FLAG_LINKDOWN     1 << HEALTH_CHECK_PCIEDEV_FLAG_LINKDOWN_SHIFT
+#define HEALTH_CHECK_PCIEDEV_FLAG_MSI_INT      1 << HEALTH_CHECK_PCIEDEV_FLAG_MSI_INT_SHIFT
+#define HEALTH_CHECK_PCIEDEV_FLAG_NODS 1 << HEALTH_CHECK_PCIEDEV_FLAG_NODS_SHIFT
+#define HEALTH_CHECK_PCIEDEV_FLAG_NO_HOST_WAKE 1 << HEALTH_CHECK_PCIEDEV_FLAG_NO_HOST_WAKE_SHIFT
+/* PCIE Module TAGs */
+#define HEALTH_CHECK_PCIEDEV_INDUCED_IND       0x1
+#define HEALTH_CHECK_PCIEDEV_H2D_DMA_IND       0x2
+#define HEALTH_CHECK_PCIEDEV_D2H_DMA_IND       0x3
+#define HEALTH_CHECK_PCIEDEV_IOCTL_STALL_IND   0x4
+#define HEALTH_CHECK_PCIEDEV_D3ACK_STALL_IND   0x5
+#define HEALTH_CHECK_PCIEDEV_NODS_IND  0x6
+#define HEALTH_CHECK_PCIEDEV_LINKSPEED_FALLBACK_IND    0x7
+#define HEALTH_CHECK_PCIEDEV_DSACK_STALL_IND   0x8
+#define HEALTH_CHECK_PCIEDEV_FLOWRING_IND      0x9
+
+#define HC_PCIEDEV_CONFIG_REGLIST_MAX  25
+typedef BWL_PRE_PACKED_STRUCT struct bcm_dngl_pcie_hc {
+       uint16                  version; /* HEALTH_CHECK_PCIEDEV_VERSION_1 */
+       uint16                  reserved;
+       uint16                  pcie_err_ind_type; /* PCIE Module TAGs */
+       uint16                  pcie_flag;
+       uint32                  pcie_control_reg;
+       uint32                  pcie_config_regs[HC_PCIEDEV_CONFIG_REGLIST_MAX];
+} BWL_POST_PACKED_STRUCT bcm_dngl_pcie_hc_t;
+
+/* define to avoid compile issues in older branches which define hchk_sw_entity_t */
+#ifdef HCHK_COMMON_SW_EVENT
+/* Enumerating top level SW entities for use by health check */
+typedef enum {
+       HCHK_SW_ENTITY_UNDEFINED = 0,
+       HCHK_SW_ENTITY_PCIE = 1,
+       HCHK_SW_ENTITY_SDIO = 2,
+       HCHK_SW_ENTITY_USB = 3,
+       HCHK_SW_ENTITY_RTE = 4,
+       HCHK_SW_ENTITY_WL_PRIMARY = 5, /* WL instance 0 */
+       HCHK_SW_ENTITY_WL_SECONDARY = 6, /* WL instance 1 */
+       HCHK_SW_ENTITY_MAX
+} hchk_sw_entity_t;
+#endif /* HCHK_COMMON_SW_EVENT */
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _DNGLEVENT_H_ */
diff --git a/bcmdhd.101.10.240.x/include/dnglioctl.h b/bcmdhd.101.10.240.x/include/dnglioctl.h
new file mode 100644 (file)
index 0000000..b877448
--- /dev/null
@@ -0,0 +1,163 @@
+/*
+ * HND Run Time Environment ioctl.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _dngl_ioctl_h_
+#define _dngl_ioctl_h_
+
+/* ==== Dongle IOCTLs i.e. non-d11 IOCTLs ==== */
+
+#ifndef _rte_ioctl_h_
+/* ================================================================ */
+/* These are the existing ioctls moved from src/include/rte_ioctl.h */
+/* ================================================================ */
+
+/* RTE IOCTL definitions for generic ether devices */
+#define RTEIOCTLSTART          0x8901
+#define RTEGHWADDR             0x8901
+#define RTESHWADDR             0x8902
+#define RTEGMTU                        0x8903
+#define RTEGSTATS              0x8904
+#define RTEGALLMULTI           0x8905
+#define RTESALLMULTI           0x8906
+#define RTEGPROMISC            0x8907
+#define RTESPROMISC            0x8908
+#define RTESMULTILIST  0x8909
+#define RTEGUP                 0x890A
+#define RTEGPERMADDR           0x890B
+#define RTEDEVPWRSTCHG         0x890C  /* Device pwr state change for PCIedev */
+#define RTEDEVPMETOGGLE                0x890D  /* Toggle PME# to wake up the host */
+#define RTEDEVTIMESYNC         0x890E  /* Device TimeSync */
+#define RTEDEVDSNOTIFY         0x890F  /* Bus DS state notification */
+#define RTED11DMALPBK_INIT     0x8910  /* D11 DMA loopback init */
+#define RTED11DMALPBK_UNINIT   0x8911  /* D11 DMA loopback uninit */
+#define RTED11DMALPBK_RUN      0x8912  /* D11 DMA loopback run */
+#define RTEDEVTSBUFPOST                0x8913  /* Async interface for tsync buffer post */
+#define RTED11DMAHOSTLPBK_RUN  0x8914  /* D11 DMA host memory loopback run */
+#define RTEDEVGETTSF           0x8915  /* Get device TSF */
+#define RTEDURATIONUNIT                0x8916  /* Duration unit */
+#define RTEWRITE_WAR_REGS      0x8917  /* write workaround regs */
+#define RTEDEVRMPMK            0x8918  /* Remove PMK */
+/* Ensure last RTE IOCTL define val is assigned to RTEIOCTLEND */
+#define RTEIOCTLEND            0x8918  /* LAST RTE IOCTL value */
+
+#define RTE_IOCTL_QUERY                0x00
+#define RTE_IOCTL_SET          0x01
+#define RTE_IOCTL_OVL_IDX_MASK 0x1e
+#define RTE_IOCTL_OVL_RSV      0x20
+#define RTE_IOCTL_OVL          0x40
+#define RTE_IOCTL_OVL_IDX_SHIFT        1
+
+enum hnd_ioctl_cmd {
+       HND_RTE_DNGL_IS_SS = 1, /* true if device connected at super speed */
+
+       /* PCIEDEV specific wl <--> bus ioctls */
+       BUS_GET_VAR = 2,
+       BUS_SET_VAR = 3,
+       BUS_FLUSH_RXREORDER_Q = 4,
+       BUS_SET_LTR_STATE = 5,
+       BUS_FLUSH_CHAINED_PKTS = 6,
+       BUS_SET_COPY_COUNT = 7,
+       BUS_UPDATE_FLOW_PKTS_MAX = 8,
+       BUS_UPDATE_EXTRA_TXLFRAGS = 9,
+       BUS_UPDATE_FRWD_RESRV_BUFCNT = 10,
+       BUS_PCIE_CONFIG_ACCESS = 11,
+       BUS_HC_EVENT_MASK_UPDATE = 12,
+       BUS_SET_MAC_WAKE_STATE = 13,
+       BUS_FRWD_PKT_RXCMPLT = 14,
+       BUS_PCIE_LATENCY_ENAB = 15, /* to enable latency feature in pcie */
+       BUS_GET_MAXITEMS = 16
+};
+
+#define SDPCMDEV_SET_MAXTXPKTGLOM      1
+#define RTE_MEMUSEINFO_VER 0x00
+
+typedef struct memuse_info {
+       uint16 ver;                     /* version of this struct */
+       uint16 len;                     /* length in bytes of this structure */
+       uint32 tot;                     /* Total memory */
+       uint32 text_len;        /* Size of Text segment memory */
+       uint32 data_len;        /* Size of Data segment memory */
+       uint32 bss_len;         /* Size of BSS segment memory */
+
+       uint32 arena_size;      /* Total Heap size */
+       uint32 arena_free;      /* Heap memory available or free */
+       uint32 inuse_size;      /* Heap memory currently in use */
+       uint32 inuse_hwm;       /* High watermark of memory - reclaimed memory */
+       uint32 inuse_overhead;  /* tally of allocated mem_t blocks */
+       uint32 inuse_total;     /* Heap in-use + Heap overhead memory  */
+       uint32 free_lwm;        /* Least free size since reclaim */
+       uint32 mf_count;        /* Malloc failure count */
+} memuse_info_t;
+
+/* Different DMA loopback modes */
+#define M2M_DMA_LOOPBACK       0       /* PCIE M2M mode */
+#define D11_DMA_LOOPBACK       1       /* PCIE M2M and D11 mode without ucode */
+#define BMC_DMA_LOOPBACK       2       /* PCIE M2M and D11 mode with ucode */
+#define M2M_NON_DMA_LOOPBACK   3       /* Non DMA(indirect) mode */
+#define D11_DMA_HOST_MEM_LPBK  4       /* D11 mode */
+#define M2M_DMA_WRITE_TO_RAM   6       /* PCIE M2M write to specific memory mode */
+#define M2M_DMA_READ_FROM_RAM  7       /* PCIE M2M read from specific memory mode */
+#define D11_DMA_WRITE_TO_RAM   8       /* D11 write to specific memory mode */
+#define D11_DMA_READ_FROM_RAM  9       /* D11 read from specific memory mode */
+
+/* For D11 DMA loopback test */
+typedef struct d11_dmalpbk_init_args {
+       uint8 core_num;
+       uint8 lpbk_mode;
+} d11_dmalpbk_init_args_t;
+
+typedef struct d11_dmalpbk_args {
+       uint8 *buf;
+       int32 len;
+       void *p;
+       uint8 core_num;
+       uint8 pad[3];
+} d11_dmalpbk_args_t;
+
+/* ================================================================ */
+/* These are the existing ioctls moved from src/include/rte_ioctl.h */
+/* ================================================================ */
+#endif /* _rte_ioctl_h_ */
+
+/* MPU test iovar version */
+#define MPU_TEST_STRUCT_VER    0
+
+/* MPU test OP */
+#define MPU_TEST_OP_READ       0
+#define MPU_TEST_OP_WRITE      1
+#define MPU_TEST_OP_EXECUTE    2
+
+/* Debug iovar for MPU testing */
+typedef struct mpu_test_args {
+       /* version control */
+       uint16 ver;
+       uint16 len;     /* the length of this structure */
+       /* data */
+       uint32 addr;
+       uint8 op;       /* see MPU_TEST_OP_XXXX */
+       uint8 rsvd;
+       uint16 size;    /* valid for read/write */
+       uint8 val[];
+} mpu_test_args_t;
+
+#endif /* _dngl_ioctl_h_ */
diff --git a/bcmdhd.101.10.240.x/include/eap.h b/bcmdhd.101.10.240.x/include/eap.h
new file mode 100644 (file)
index 0000000..c08af07
--- /dev/null
@@ -0,0 +1,121 @@
+/*
+ * Extensible Authentication Protocol (EAP) definitions
+ *
+ * See
+ * RFC 2284: PPP Extensible Authentication Protocol (EAP)
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _eap_h_
+#define _eap_h_
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* EAP packet format */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       unsigned char code;     /* EAP code */
+       unsigned char id;       /* Current request ID */
+       unsigned short length;  /* Length including header */
+       unsigned char type;     /* EAP type (optional) */
+       unsigned char data[1];  /* Type data (optional) */
+} BWL_POST_PACKED_STRUCT eap_header_t;
+
+#define EAP_HEADER_LEN                 4u
+#define EAP_HEADER_LEN_WITH_TYPE       5u
+#define ERP_FLAGS_LEN                  1u
+#define ERP_SEQ_LEN                    2u
+#define ERP_KEYNAMENAI_HEADER_LEN      2u
+#define ERP_CRYPTOSUITE_LEN            1u
+
+/* EAP codes */
+#define EAP_REQUEST            1u
+#define EAP_RESPONSE           2u
+#define EAP_SUCCESS            3u
+#define EAP_FAILURE            4u
+#define EAP_INITIATE           5u
+#define EAP_FINISH             6u
+
+/* EAP types */
+#define EAP_IDENTITY           1
+#define EAP_NOTIFICATION       2
+#define EAP_NAK                        3
+#define EAP_MD5                        4
+#define EAP_OTP                        5
+#define EAP_GTC                        6
+#define EAP_TLS                        13
+#define EAP_EXPANDED           254
+#define BCM_EAP_SES            10
+#define BCM_EAP_EXP_LEN                12  /* EAP_LEN 5 + 3 bytes for SMI ID + 4 bytes for ven type */
+#define BCM_SMI_ID             0x113d
+#define WFA_VENDOR_SMI 0x009F68
+
+/* ERP types */
+#define EAP_ERP_TYPE_REAUTH_START      1u
+#define EAP_ERP_TYPE_REAUTH            2u
+
+/* EAP FLAGS */
+#define ERP_R_FLAG     0x80 /* result flag, set = failure */
+#define ERP_B_FLAG     0x40 /* bootstrap flag, set = bootstrap */
+#define ERP_L_FLAG     0x20 /* rrk lifetime tlv is present */
+
+/* ERP TV/TLV types */
+#define EAP_ERP_TLV_KEYNAME_NAI                1u
+
+/* ERP Cryptosuite */
+#define EAP_ERP_CS_HMAC_SHA256_128     2u
+
+#ifdef  BCMCCX // MOG-NO
+#define EAP_LEAP               17
+
+#define LEAP_VERSION           1
+#define LEAP_CHALLENGE_LEN     8
+#define LEAP_RESPONSE_LEN      24
+
+/* LEAP challenge */
+typedef struct {
+       unsigned char version;          /* should be value of LEAP_VERSION */
+       unsigned char reserved;         /* not used */
+       unsigned char chall_len;        /* always value of LEAP_CHALLENGE_LEN */
+       unsigned char challenge[LEAP_CHALLENGE_LEN]; /* random */
+       unsigned char username[1];
+} leap_challenge_t;
+
+#define LEAP_CHALLENGE_HDR_LEN 12
+
+/* LEAP challenge reponse */
+typedef struct {
+       unsigned char version;  /* should be value of LEAP_VERSION */
+       unsigned char reserved; /* not used */
+       unsigned char resp_len; /* always value of LEAP_RESPONSE_LEN */
+       /* MS-CHAP hash of challenge and user's password */
+       unsigned char response[LEAP_RESPONSE_LEN];
+       unsigned char username[1];
+} leap_response_t;
+
+#define LEAP_RESPONSE_HDR_LEN  28
+
+#endif /* BCMCCX */
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _eap_h_ */
diff --git a/bcmdhd.101.10.240.x/include/eapol.h b/bcmdhd.101.10.240.x/include/eapol.h
new file mode 100644 (file)
index 0000000..e6b83b0
--- /dev/null
@@ -0,0 +1,279 @@
+/*
+ * 802.1x EAPOL definitions
+ *
+ * See
+ * IEEE Std 802.1X-2001
+ * IEEE 802.1X RADIUS Usage Guidelines
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _eapol_h_
+#define _eapol_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#if !defined(BCMCRYPTO_COMPONENT)
+#include <bcmcrypto/aeskeywrap.h>
+#endif /* !BCMCRYPTO_COMPONENT */
+
+/* EAPOL for 802.3/Ethernet */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       struct ether_header eth;        /* 802.3/Ethernet header */
+       unsigned char version;          /* EAPOL protocol version */
+       unsigned char type;             /* EAPOL type */
+       unsigned short length;          /* Length of body */
+       unsigned char body[1];          /* Body (optional) */
+} BWL_POST_PACKED_STRUCT eapol_header_t;
+
+#define EAPOL_HEADER_LEN 18
+
+typedef struct {
+       unsigned char version;          /* EAPOL protocol version */
+       unsigned char type;             /* EAPOL type */
+       unsigned short length;          /* Length of body */
+} eapol_hdr_t;
+
+#define EAPOL_HDR_LEN 4u
+
+/* EAPOL version */
+#define WPA2_EAPOL_VERSION     2u
+#define WPA_EAPOL_VERSION      1u
+#define LEAP_EAPOL_VERSION     1u
+#define SES_EAPOL_VERSION      1u
+
+/* EAPOL types */
+#define EAP_PACKET             0
+#define EAPOL_START            1u
+#define EAPOL_LOGOFF           2u
+#define EAPOL_KEY              3u
+#define EAPOL_ASF              4u
+
+/* EAPOL-Key types */
+#define EAPOL_RC4_KEY          1u
+#define EAPOL_WPA2_KEY         2u      /* 802.11i/WPA2 */
+#define EAPOL_WPA_KEY          254u    /* WPA */
+
+/* RC4 EAPOL-Key header field sizes */
+#define EAPOL_KEY_REPLAY_LEN   8u
+#define EAPOL_KEY_IV_LEN       16u
+#define EAPOL_KEY_SIG_LEN      16u
+
+/* RC4 EAPOL-Key */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       unsigned char type;                     /* Key Descriptor Type */
+       unsigned short length;                  /* Key Length (unaligned) */
+       unsigned char replay[EAPOL_KEY_REPLAY_LEN];     /* Replay Counter */
+       unsigned char iv[EAPOL_KEY_IV_LEN];             /* Key IV */
+       unsigned char index;                            /* Key Flags & Index */
+       unsigned char signature[EAPOL_KEY_SIG_LEN];     /* Key Signature */
+       unsigned char key[1];                           /* Key (optional) */
+} BWL_POST_PACKED_STRUCT eapol_key_header_t;
+
+#define EAPOL_KEY_HEADER_LEN   44u
+
+/* RC4 EAPOL-Key flags */
+#define EAPOL_KEY_FLAGS_MASK   0x80u
+#define EAPOL_KEY_BROADCAST    0u
+#define EAPOL_KEY_UNICAST      0x80u
+
+/* RC4 EAPOL-Key index */
+#define EAPOL_KEY_INDEX_MASK   0x7fu
+
+/* WPA/802.11i/WPA2 EAPOL-Key header field sizes */
+#define EAPOL_AKW_BLOCK_LEN 8
+#define EAPOL_WPA_KEY_REPLAY_LEN       8u
+#define EAPOL_WPA_KEY_NONCE_LEN                32u
+#define EAPOL_WPA_KEY_IV_LEN           16u
+#define EAPOL_WPA_KEY_RSC_LEN          8u
+#define EAPOL_WPA_KEY_ID_LEN           8u
+#define EAPOL_WPA_KEY_DATA_LEN         (EAPOL_WPA_MAX_KEY_SIZE + EAPOL_AKW_BLOCK_LEN)
+#define EAPOL_WPA_MAX_KEY_SIZE         32u
+#define EAPOL_WPA_KEY_MAX_MIC_LEN      32u
+#define EAPOL_WPA_ENCR_KEY_MAX_LEN     64u
+#define EAPOL_WPA_TEMP_ENCR_KEY_MAX_LEN        32u
+
+#define EAPOL_WPA_PMK_MAX_LEN           64u
+#define EAPOL_WPA_PMK_SHA384_LEN        48u
+#define EAPOL_WPA_PMK_DEFAULT_LEN      32u
+#define EAPOL_WPA_KCK_DEFAULT_LEN      16u
+#define EAPOL_WPA_KCK_SHA384_LEN       24u
+#define EAPOL_WPA_KCK_MIC_DEFAULT_LEN  16u
+#define EAPOL_WPA_KCK_MIC_SHA384_LEN   24u
+#define EAPOL_WPA_ENCR_KEY_DEFAULT_LEN 16u
+
+#define EAPOL_WPA_KEK2_SHA256_LEN      16u
+#define EAPOL_WPA_KEK2_SHA384_LEN      32u
+#define EAPOL_WPA_KCK2_SHA256_LEN      16u
+#define EAPOL_WPA_KCK2_SHA384_LEN      24u
+
+#ifndef EAPOL_KEY_HDR_VER_V2
+#define EAPOL_WPA_KEY_MIC_LEN          16u /* deprecated */
+#define EAPOL_WPA_KEY_LEN              95u /* deprecated */
+#endif
+
+#define EAPOL_PTK_KEY_MAX_LEN  (EAPOL_WPA_KEY_MAX_MIC_LEN +\
+                               EAPOL_WPA_ENCR_KEY_MAX_LEN +\
+                               EAPOL_WPA_TEMP_ENCR_KEY_MAX_LEN +\
+                               EAPOL_WPA_KCK2_SHA384_LEN +\
+                               EAPOL_WPA_KEK2_SHA384_LEN)
+
+#ifndef EAPOL_KEY_HDR_VER_V2
+
+/* WPA EAPOL-Key : deprecated */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       unsigned char type;             /* Key Descriptor Type */
+       unsigned short key_info;        /* Key Information (unaligned) */
+       unsigned short key_len;         /* Key Length (unaligned) */
+       unsigned char replay[EAPOL_WPA_KEY_REPLAY_LEN]; /* Replay Counter */
+       unsigned char nonce[EAPOL_WPA_KEY_NONCE_LEN];   /* Nonce */
+       unsigned char iv[EAPOL_WPA_KEY_IV_LEN];         /* Key IV */
+       unsigned char rsc[EAPOL_WPA_KEY_RSC_LEN];       /* Key RSC */
+       unsigned char id[EAPOL_WPA_KEY_ID_LEN];         /* WPA:Key ID, 802.11i/WPA2: Reserved */
+       unsigned char mic[EAPOL_WPA_KEY_MIC_LEN];       /* Key MIC */
+       unsigned short data_len;                        /* Key Data Length */
+       unsigned char data[EAPOL_WPA_KEY_DATA_LEN];     /* Key data */
+} BWL_POST_PACKED_STRUCT eapol_wpa_key_header_t;
+#else
+/* WPA EAPOL-Key : new structure to consider dynamic MIC length */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       unsigned char type;             /* Key Descriptor Type */
+       unsigned short key_info;        /* Key Information (unaligned) */
+       unsigned short key_len;         /* Key Length (unaligned) */
+       unsigned char replay[EAPOL_WPA_KEY_REPLAY_LEN]; /* Replay Counter */
+       unsigned char nonce[EAPOL_WPA_KEY_NONCE_LEN];   /* Nonce */
+       unsigned char iv[EAPOL_WPA_KEY_IV_LEN];         /* Key IV */
+       unsigned char rsc[EAPOL_WPA_KEY_RSC_LEN];       /* Key RSC */
+       unsigned char id[EAPOL_WPA_KEY_ID_LEN];         /* WPA:Key ID, 802.11i/WPA2: Reserved */
+} BWL_POST_PACKED_STRUCT eapol_wpa_key_header_v2_t;
+
+typedef eapol_wpa_key_header_v2_t eapol_wpa_key_header_t;
+#endif /* EAPOL_KEY_HDR_VER_V2 */
+
+#define EAPOL_WPA_KEY_DATA_LEN_SIZE    2u
+
+#ifdef  EAPOL_KEY_HDR_VER_V2
+#define EAPOL_WPA_KEY_HDR_SIZE(mic_len) (sizeof(eapol_wpa_key_header_v2_t) \
+       + mic_len + EAPOL_WPA_KEY_DATA_LEN_SIZE)
+
+/* WPA EAPOL-Key header macros to reach out mic/data_len/data field */
+#define EAPOL_WPA_KEY_HDR_MIC_PTR(pos) ((uint8 *)pos + sizeof(eapol_wpa_key_header_v2_t))
+#define EAPOL_WPA_KEY_HDR_DATA_LEN_PTR(pos, mic_len) \
+       ((uint8 *)pos + sizeof(eapol_wpa_key_header_v2_t) + mic_len)
+#define EAPOL_WPA_KEY_HDR_DATA_PTR(pos, mic_len) \
+       ((uint8 *)pos + EAPOL_WPA_KEY_HDR_SIZE(mic_len))
+#else
+#define EAPOL_WPA_KEY_HDR_SIZE(mic_len) EAPOL_WPA_KEY_LEN
+#define EAPOL_WPA_KEY_HDR_MIC_PTR(pos) ((uint8 *)&pos->mic)
+#define EAPOL_WPA_KEY_HDR_DATA_LEN_PTR(pos, mic_len) ((uint8 *)&pos->data_len)
+#define EAPOL_WPA_KEY_HDR_DATA_PTR(pos, mic_len) ((uint8 *)&pos->data)
+#endif /* EAPOL_KEY_HDR_VER_V2 */
+
+/* WPA/802.11i/WPA2 KEY KEY_INFO bits */
+#define WPA_KEY_DESC_OSEN      0x0
+#define WPA_KEY_DESC_V0                0x0
+#define WPA_KEY_DESC_V1                0x01
+#define WPA_KEY_DESC_V2                0x02
+#define WPA_KEY_DESC_V3                0x03
+#define WPA_KEY_PAIRWISE       0x08
+#define WPA_KEY_INSTALL                0x40
+#define WPA_KEY_ACK            0x80
+#define WPA_KEY_MIC            0x100
+#define WPA_KEY_SECURE         0x200
+#define WPA_KEY_ERROR          0x400
+#define WPA_KEY_REQ            0x800
+#define WPA_KEY_ENC_KEY_DATA   0x01000         /* Encrypted Key Data */
+#define WPA_KEY_SMK_MESSAGE    0x02000         /* SMK Message */
+#define WPA_KEY_DESC_VER(_ki)   ((_ki) & 0x03u)
+
+#define WPA_KEY_DESC_V2_OR_V3 WPA_KEY_DESC_V2
+
+/* WPA-only KEY KEY_INFO bits */
+#define WPA_KEY_INDEX_0                0x00
+#define WPA_KEY_INDEX_1                0x10
+#define WPA_KEY_INDEX_2                0x20
+#define WPA_KEY_INDEX_3                0x30
+#define WPA_KEY_INDEX_MASK     0x30
+#define WPA_KEY_INDEX_SHIFT    0x04
+
+/* 802.11i/WPA2-only KEY KEY_INFO bits */
+#define WPA_KEY_ENCRYPTED_DATA 0x1000
+
+/* Key Data encapsulation */
+/* this is really just a vendor-specific info element.  should define
+ * this in 802.11.h
+ */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint8 type;
+       uint8 length;
+       uint8 oui[3];
+       uint8 subtype;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_encap_data_t;
+
+#define EAPOL_WPA2_ENCAP_DATA_HDR_LEN  6
+
+#define WPA2_KEY_DATA_SUBTYPE_GTK      1
+#define WPA2_KEY_DATA_SUBTYPE_STAKEY   2
+#define WPA2_KEY_DATA_SUBTYPE_MAC      3
+#define WPA2_KEY_DATA_SUBTYPE_PMKID    4
+#define WPA2_KEY_DATA_SUBTYPE_IGTK     9
+
+/* GTK encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint8   flags;
+       uint8   reserved;
+       uint8   gtk[EAPOL_WPA_MAX_KEY_SIZE];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_key_gtk_encap_t;
+
+#define EAPOL_WPA2_KEY_GTK_ENCAP_HDR_LEN       2
+
+#define WPA2_GTK_INDEX_MASK    0x03
+#define WPA2_GTK_INDEX_SHIFT   0x00
+
+#define WPA2_GTK_TRANSMIT      0x04
+
+/* IGTK encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint16  key_id;
+       uint8   ipn[6];
+       uint8   key[EAPOL_WPA_MAX_KEY_SIZE];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_key_igtk_encap_t;
+
+#define EAPOL_WPA2_KEY_IGTK_ENCAP_HDR_LEN      8
+
+/* STAKey encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint8   reserved[2];
+       uint8   mac[ETHER_ADDR_LEN];
+       uint8   stakey[EAPOL_WPA_MAX_KEY_SIZE];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_key_stakey_encap_t;
+
+#define WPA2_KEY_DATA_PAD      0xdd
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _eapol_h_ */
diff --git a/bcmdhd.101.10.240.x/include/epivers.h b/bcmdhd.101.10.240.x/include/epivers.h
new file mode 100644 (file)
index 0000000..2134683
--- /dev/null
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+*/
+
+#ifndef _epivers_h_
+#define _epivers_h_
+
+#define EPI_MAJOR_VERSION      101
+
+#define EPI_MINOR_VERSION      10
+
+#define EPI_RC_NUMBER          240
+
+#define EPI_INCREMENTAL_NUMBER 0
+
+#define EPI_BUILD_NUMBER       0
+
+#define EPI_VERSION            101, 10, 240, 0
+
+#define EPI_VERSION_NUM                0x650af000
+
+#define EPI_VERSION_DEV                101.10.240
+
+/* Driver Version String, ASCII, 32 chars max */
+#ifdef BCMINTERNAL
+#define EPI_VERSION_STR                "101.10.240 (wlan=r864910 BCMINT)"
+#elif defined (WLTEST)
+#define EPI_VERSION_STR                "101.10.240 (wlan=r864910 WLTEST)"
+#elif (defined (BCMDBG_ASSERT) && !defined (BCMDBG_ASSERT_DISABLED))
+#define EPI_VERSION_STR                "101.10.240 (wlan=r864910 ASSRT)"
+#else
+#define EPI_VERSION_STR                "101.10.240.2 (wlan=r864910-20200715-1)"
+#endif /* BCMINTERNAL */
+
+#endif /* _epivers_h_ */
diff --git a/bcmdhd.101.10.240.x/include/etd.h b/bcmdhd.101.10.240.x/include/etd.h
new file mode 100644 (file)
index 0000000..77ffff0
--- /dev/null
@@ -0,0 +1,622 @@
+/*
+ * Extended Trap data component interface file.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _ETD_H_
+#define _ETD_H_
+
+#if defined(ETD) && !defined(WLETD)
+#include <hnd_trap.h>
+#endif
+#include <bcmutils.h>
+/* Tags for structures being used by etd info iovar.
+ * Related structures are defined in wlioctl.h.
+ */
+#define ETD_TAG_JOIN_CLASSIFICATION_INFO 10 /* general information about join request */
+#define ETD_TAG_JOIN_TARGET_CLASSIFICATION_INFO 11     /* per target (AP) join information */
+#define ETD_TAG_ASSOC_STATE 12 /* current state of the Device association state machine */
+#define ETD_TAG_CHANNEL 13     /* current channel on which the association was performed */
+#define ETD_TAG_TOTAL_NUM_OF_JOIN_ATTEMPTS 14 /* number of join attempts (bss_retries) */
+
+#define  PSMDBG_REG_READ_CNT_FOR_PSMWDTRAP_V1  3
+#define  PSMDBG_REG_READ_CNT_FOR_PSMWDTRAP_V2  6
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+#define HND_EXTENDED_TRAP_VERSION  1
+#define HND_EXTENDED_TRAP_BUFLEN   512
+
+typedef struct hnd_ext_trap_hdr {
+       uint8 version;    /* Extended trap version info */
+       uint8 reserved;   /* currently unused */
+       uint16 len;       /* Length of data excluding this header */
+       uint8 data[];     /* TLV data */
+} hnd_ext_trap_hdr_t;
+
+typedef enum {
+       TAG_TRAP_NONE            = 0,  /* None trap type */
+       TAG_TRAP_SIGNATURE       = 1,  /* Processor register dumps */
+       TAG_TRAP_STACK           = 2,  /* Processor stack dump (possible code locations) */
+       TAG_TRAP_MEMORY          = 3,  /* Memory subsystem dump */
+       TAG_TRAP_DEEPSLEEP       = 4,  /* Deep sleep health check failures */
+       TAG_TRAP_PSM_WD          = 5,  /* PSM watchdog information */
+       TAG_TRAP_PHY             = 6,  /* Phy related issues */
+       TAG_TRAP_BUS             = 7,  /* Bus level issues */
+       TAG_TRAP_MAC_SUSP        = 8,  /* Mac level suspend issues */
+       TAG_TRAP_BACKPLANE       = 9,  /* Backplane related errors */
+       /* Values 10 through 14 are in use by etd_data info iovar */
+       TAG_TRAP_PCIE_Q         = 15,  /* PCIE Queue state during memory trap */
+       TAG_TRAP_WLC_STATE      = 16,  /* WLAN state during memory trap */
+       TAG_TRAP_MAC_WAKE       = 17,  /* Mac level wake issues */
+       TAG_TRAP_PHYTXERR_THRESH = 18, /* Phy Tx Err */
+       TAG_TRAP_HC_DATA        = 19,  /* Data collected by HC module */
+       TAG_TRAP_LOG_DATA       = 20,
+       TAG_TRAP_CODE           = 21, /* The trap type */
+       TAG_TRAP_HMAP           = 22, /* HMAP violation Address and Info */
+       TAG_TRAP_PCIE_ERR_ATTN  = 23, /* PCIE error attn log */
+       TAG_TRAP_AXI_ERROR      = 24, /* AXI Error */
+       TAG_TRAP_AXI_HOST_INFO  = 25, /* AXI Host log */
+       TAG_TRAP_AXI_SR_ERROR   = 26, /* AXI SR error log */
+       TAG_TRAP_LAST  /* This must be the last entry */
+} hnd_ext_tag_trap_t;
+
+typedef struct hnd_ext_trap_bp_err
+{
+       uint32 error;
+       uint32 coreid;
+       uint32 baseaddr;
+       uint32 ioctrl;
+       uint32 iostatus;
+       uint32 resetctrl;
+       uint32 resetstatus;
+       uint32 resetreadid;
+       uint32 resetwriteid;
+       uint32 errlogctrl;
+       uint32 errlogdone;
+       uint32 errlogstatus;
+       uint32 errlogaddrlo;
+       uint32 errlogaddrhi;
+       uint32 errlogid;
+       uint32 errloguser;
+       uint32 errlogflags;
+       uint32 itipoobaout;
+       uint32 itipoobbout;
+       uint32 itipoobcout;
+       uint32 itipoobdout;
+} hnd_ext_trap_bp_err_t;
+
+#define HND_EXT_TRAP_AXISR_INFO_VER_1  1
+typedef struct hnd_ext_trap_axi_sr_err_v1
+{
+       uint8 version;
+       uint8 pad[3];
+       uint32 error;
+       uint32 coreid;
+       uint32 baseaddr;
+       uint32 ioctrl;
+       uint32 iostatus;
+       uint32 resetctrl;
+       uint32 resetstatus;
+       uint32 resetreadid;
+       uint32 resetwriteid;
+       uint32 errlogctrl;
+       uint32 errlogdone;
+       uint32 errlogstatus;
+       uint32 errlogaddrlo;
+       uint32 errlogaddrhi;
+       uint32 errlogid;
+       uint32 errloguser;
+       uint32 errlogflags;
+       uint32 itipoobaout;
+       uint32 itipoobbout;
+       uint32 itipoobcout;
+       uint32 itipoobdout;
+
+       /* axi_sr_issue_debug */
+       uint32 sr_pwr_control;
+       uint32 sr_corereset_wrapper_main;
+       uint32 sr_corereset_wrapper_aux;
+       uint32 sr_main_gci_status_0;
+       uint32 sr_aux_gci_status_0;
+       uint32 sr_dig_gci_status_0;
+} hnd_ext_trap_axi_sr_err_v1_t;
+
+#define HND_EXT_TRAP_PSMWD_INFO_VER    1
+typedef struct hnd_ext_trap_psmwd_v1 {
+       uint16 xtag;
+       uint16 version; /* version of the information following this */
+       uint32 i32_maccontrol;
+       uint32 i32_maccommand;
+       uint32 i32_macintstatus;
+       uint32 i32_phydebug;
+       uint32 i32_clk_ctl_st;
+       uint32 i32_psmdebug[PSMDBG_REG_READ_CNT_FOR_PSMWDTRAP_V1];
+       uint16 i16_0x1a8; /* gated clock en */
+       uint16 i16_0x406; /* Rcv Fifo Ctrl */
+       uint16 i16_0x408; /* Rx ctrl 1 */
+       uint16 i16_0x41a; /* Rxe Status 1 */
+       uint16 i16_0x41c; /* Rxe Status 2 */
+       uint16 i16_0x424; /* rcv wrd count 0 */
+       uint16 i16_0x426; /* rcv wrd count 1 */
+       uint16 i16_0x456; /* RCV_LFIFO_STS */
+       uint16 i16_0x480; /* PSM_SLP_TMR */
+       uint16 i16_0x490; /* PSM BRC */
+       uint16 i16_0x500; /* TXE CTRL */
+       uint16 i16_0x50e; /* TXE Status */
+       uint16 i16_0x55e; /* TXE_xmtdmabusy */
+       uint16 i16_0x566; /* TXE_XMTfifosuspflush */
+       uint16 i16_0x690; /* IFS Stat */
+       uint16 i16_0x692; /* IFS_MEDBUSY_CTR */
+       uint16 i16_0x694; /* IFS_TX_DUR */
+       uint16 i16_0x6a0; /* SLow_CTL */
+       uint16 i16_0x838; /* TXE_AQM fifo Ready */
+       uint16 i16_0x8c0; /* Dagg ctrl */
+       uint16 shm_prewds_cnt;
+       uint16 shm_txtplufl_cnt;
+       uint16 shm_txphyerr_cnt;
+       uint16 pad;
+} hnd_ext_trap_psmwd_v1_t;
+
+typedef struct hnd_ext_trap_psmwd {
+       uint16 xtag;
+       uint16 version; /* version of the information following this */
+       uint32 i32_maccontrol;
+       uint32 i32_maccommand;
+       uint32 i32_macintstatus;
+       uint32 i32_phydebug;
+       uint32 i32_clk_ctl_st;
+       uint32 i32_psmdebug[PSMDBG_REG_READ_CNT_FOR_PSMWDTRAP_V2];
+       uint16 i16_0x4b8; /* psm_brwk_0 */
+       uint16 i16_0x4ba; /* psm_brwk_1 */
+       uint16 i16_0x4bc; /* psm_brwk_2 */
+       uint16 i16_0x4be; /* psm_brwk_2 */
+       uint16 i16_0x1a8; /* gated clock en */
+       uint16 i16_0x406; /* Rcv Fifo Ctrl */
+       uint16 i16_0x408; /* Rx ctrl 1 */
+       uint16 i16_0x41a; /* Rxe Status 1 */
+       uint16 i16_0x41c; /* Rxe Status 2 */
+       uint16 i16_0x424; /* rcv wrd count 0 */
+       uint16 i16_0x426; /* rcv wrd count 1 */
+       uint16 i16_0x456; /* RCV_LFIFO_STS */
+       uint16 i16_0x480; /* PSM_SLP_TMR */
+       uint16 i16_0x500; /* TXE CTRL */
+       uint16 i16_0x50e; /* TXE Status */
+       uint16 i16_0x55e; /* TXE_xmtdmabusy */
+       uint16 i16_0x566; /* TXE_XMTfifosuspflush */
+       uint16 i16_0x690; /* IFS Stat */
+       uint16 i16_0x692; /* IFS_MEDBUSY_CTR */
+       uint16 i16_0x694; /* IFS_TX_DUR */
+       uint16 i16_0x6a0; /* SLow_CTL */
+       uint16 i16_0x490; /* psm_brc */
+       uint16 i16_0x4da; /* psm_brc_1 */
+       uint16 i16_0x838; /* TXE_AQM fifo Ready */
+       uint16 i16_0x8c0; /* Dagg ctrl */
+       uint16 shm_prewds_cnt;
+       uint16 shm_txtplufl_cnt;
+       uint16 shm_txphyerr_cnt;
+} hnd_ext_trap_psmwd_t;
+
+#define HEAP_HISTOGRAM_DUMP_LEN        6
+#define HEAP_MAX_SZ_BLKS_LEN   2
+
+/* Ignore chunks for which there are fewer than this many instances, irrespective of size */
+#define HEAP_HISTOGRAM_INSTANCE_MIN            4
+
+/*
+ * Use the last two length values for chunks larger than this, or when we run out of
+ * histogram entries (because we have too many different sized chunks) to store "other"
+ */
+#define HEAP_HISTOGRAM_SPECIAL 0xfffeu
+
+#define HEAP_HISTOGRAM_GRTR256K        0xffffu
+
+typedef struct hnd_ext_trap_heap_err {
+       uint32 arena_total;
+       uint32 heap_free;
+       uint32 heap_inuse;
+       uint32 mf_count;
+       uint32 stack_lwm;
+       uint16 heap_histogm[HEAP_HISTOGRAM_DUMP_LEN * 2]; /* size/number */
+       uint16 max_sz_free_blk[HEAP_MAX_SZ_BLKS_LEN];
+} hnd_ext_trap_heap_err_t;
+
+#define MEM_TRAP_NUM_WLC_TX_QUEUES             6
+#define HND_EXT_TRAP_WLC_MEM_ERR_VER_V2                2
+
+/* already there are quite a few chips which are ROM'ed wth this structure
+ * Will not be adding version. This will be the V1 structure.
+ */
+typedef struct hnd_ext_trap_wlc_mem_err {
+       uint8 instance;
+       uint8 associated;
+       uint8 soft_ap_client_cnt;
+       uint8 peer_cnt;
+       uint16 txqueue_len[MEM_TRAP_NUM_WLC_TX_QUEUES];
+} hnd_ext_trap_wlc_mem_err_t;
+
+typedef struct hnd_ext_trap_wlc_mem_err_v2 {
+       uint16 version;
+       uint16 pad;
+       uint8 instance;
+       uint8 stas_associated;
+       uint8 aps_associated;
+       uint8 soft_ap_client_cnt;
+       uint16 txqueue_len[MEM_TRAP_NUM_WLC_TX_QUEUES];
+} hnd_ext_trap_wlc_mem_err_v2_t;
+
+#define HND_EXT_TRAP_WLC_MEM_ERR_VER_V3                3
+
+typedef struct hnd_ext_trap_wlc_mem_err_v3 {
+       uint8 version;
+       uint8 instance;
+       uint8 stas_associated;
+       uint8 aps_associated;
+       uint8 soft_ap_client_cnt;
+       uint8 peer_cnt;
+       uint16 txqueue_len[MEM_TRAP_NUM_WLC_TX_QUEUES];
+} hnd_ext_trap_wlc_mem_err_v3_t;
+
+typedef struct hnd_ext_trap_pcie_mem_err {
+       uint16 d2h_queue_len;
+       uint16 d2h_req_queue_len;
+} hnd_ext_trap_pcie_mem_err_t;
+
+#define MAX_DMAFIFO_ENTRIES_V1                 1
+#define MAX_DMAFIFO_DESC_ENTRIES_V1            2
+#define HND_EXT_TRAP_AXIERROR_SIGNATURE                0xbabebabe
+#define HND_EXT_TRAP_AXIERROR_VERSION_1                1
+
+/* Structure to collect debug info of descriptor entry for dma channel on encountering AXI Error */
+/* Below three structures are dependant, any change will bump version of all the three */
+
+typedef struct hnd_ext_trap_desc_entry_v1 {
+       uint32  ctrl1;   /* descriptor entry at din < misc control bits > */
+       uint32  ctrl2;   /* descriptor entry at din <buffer count and address extension> */
+       uint32  addrlo;  /* descriptor entry at din <address of data buffer, bits 31:0> */
+       uint32  addrhi;  /* descriptor entry at din <address of data buffer, bits 63:32> */
+} dma_dentry_v1_t;
+
+/* Structure to collect debug info about a dma channel on encountering AXI Error */
+typedef struct hnd_ext_trap_dma_fifo_v1 {
+       uint8   valid;          /* no of valid desc entries filled, non zero = fifo entry valid */
+       uint8   direction;      /* TX=1, RX=2, currently only using TX */
+       uint16  index;          /* Index of the DMA channel in system */
+       uint32  dpa;            /* Expected Address of Descriptor table from software state */
+       uint32  desc_lo;        /* Low Address of Descriptor table programmed in DMA register */
+       uint32  desc_hi;        /* High Address of Descriptor table programmed in DMA register */
+       uint16  din;            /* rxin / txin */
+       uint16  dout;           /* rxout / txout */
+       dma_dentry_v1_t dentry[MAX_DMAFIFO_DESC_ENTRIES_V1]; /* Descriptor Entires */
+} dma_fifo_v1_t;
+
+typedef struct hnd_ext_trap_axi_error_v1 {
+       uint8 version;                  /* version = 1 */
+       uint8 dma_fifo_valid_count;     /* Number of valid dma_fifo entries */
+       uint16 length;                  /* length of whole structure */
+       uint32 signature;               /* indicate that its filled with AXI Error data */
+       uint32 axi_errorlog_status;     /* errlog_status from slave wrapper */
+       uint32 axi_errorlog_core;       /* errlog_core from slave wrapper */
+       uint32 axi_errorlog_lo;         /* errlog_lo from slave wrapper */
+       uint32 axi_errorlog_hi;         /* errlog_hi from slave wrapper */
+       uint32 axi_errorlog_id;         /* errlog_id from slave wrapper */
+       dma_fifo_v1_t dma_fifo[MAX_DMAFIFO_ENTRIES_V1];
+} hnd_ext_trap_axi_error_v1_t;
+
+#define HND_EXT_TRAP_MACSUSP_INFO_VER  1
+typedef struct hnd_ext_trap_macsusp {
+       uint16 xtag;
+       uint8 version; /* version of the information following this */
+       uint8 trap_reason;
+       uint32 i32_maccontrol;
+       uint32 i32_maccommand;
+       uint32 i32_macintstatus;
+       uint32 i32_phydebug[4];
+       uint32 i32_psmdebug[8];
+       uint16 i16_0x41a; /* Rxe Status 1 */
+       uint16 i16_0x41c; /* Rxe Status 2 */
+       uint16 i16_0x490; /* PSM BRC */
+       uint16 i16_0x50e; /* TXE Status */
+       uint16 i16_0x55e; /* TXE_xmtdmabusy */
+       uint16 i16_0x566; /* TXE_XMTfifosuspflush */
+       uint16 i16_0x690; /* IFS Stat */
+       uint16 i16_0x692; /* IFS_MEDBUSY_CTR */
+       uint16 i16_0x694; /* IFS_TX_DUR */
+       uint16 i16_0x7c0; /* WEP CTL */
+       uint16 i16_0x838; /* TXE_AQM fifo Ready */
+       uint16 i16_0x880; /* MHP_status */
+       uint16 shm_prewds_cnt;
+       uint16 shm_ucode_dbgst;
+} hnd_ext_trap_macsusp_t;
+
+#define HND_EXT_TRAP_MACENAB_INFO_VER  1
+typedef struct hnd_ext_trap_macenab {
+       uint16 xtag;
+       uint8 version; /* version of the information following this */
+       uint8 trap_reason;
+       uint32 i32_maccontrol;
+       uint32 i32_maccommand;
+       uint32 i32_macintstatus;
+       uint32 i32_psmdebug[8];
+       uint32 i32_clk_ctl_st;
+       uint32 i32_powerctl;
+       uint16 i16_0x1a8; /* gated clock en */
+       uint16 i16_0x480; /* PSM_SLP_TMR */
+       uint16 i16_0x490; /* PSM BRC */
+       uint16 i16_0x600; /* TSF CTL */
+       uint16 i16_0x690; /* IFS Stat */
+       uint16 i16_0x692; /* IFS_MEDBUSY_CTR */
+       uint16 i16_0x6a0; /* SLow_CTL */
+       uint16 i16_0x6a6; /* SLow_FRAC */
+       uint16 i16_0x6a8; /* fast power up delay */
+       uint16 i16_0x6aa; /* SLow_PER */
+       uint16 shm_ucode_dbgst;
+       uint16 PAD;
+} hnd_ext_trap_macenab_t;
+
+#define HND_EXT_TRAP_PHY_INFO_VER_1 (1)
+typedef struct hnd_ext_trap_phydbg {
+       uint16 err;
+       uint16 RxFeStatus;
+       uint16 TxFIFOStatus0;
+       uint16 TxFIFOStatus1;
+       uint16 RfseqMode;
+       uint16 RfseqStatus0;
+       uint16 RfseqStatus1;
+       uint16 RfseqStatus_Ocl;
+       uint16 RfseqStatus_Ocl1;
+       uint16 OCLControl1;
+       uint16 TxError;
+       uint16 bphyTxError;
+       uint16 TxCCKError;
+       uint16 TxCtrlWrd0;
+       uint16 TxCtrlWrd1;
+       uint16 TxCtrlWrd2;
+       uint16 TxLsig0;
+       uint16 TxLsig1;
+       uint16 TxVhtSigA10;
+       uint16 TxVhtSigA11;
+       uint16 TxVhtSigA20;
+       uint16 TxVhtSigA21;
+       uint16 txPktLength;
+       uint16 txPsdulengthCtr;
+       uint16 gpioClkControl;
+       uint16 gpioSel;
+       uint16 pktprocdebug;
+       uint16 PAD;
+       uint32 gpioOut[3];
+} hnd_ext_trap_phydbg_t;
+
+/* unique IDs for separate cores in SI */
+#define REGDUMP_MASK_MAC0              BCM_BIT(1)
+#define REGDUMP_MASK_ARM               BCM_BIT(2)
+#define REGDUMP_MASK_PCIE              BCM_BIT(3)
+#define REGDUMP_MASK_MAC1              BCM_BIT(4)
+#define REGDUMP_MASK_PMU               BCM_BIT(5)
+
+typedef struct {
+       uint16 reg_offset;
+       uint16 core_mask;
+} reg_dump_config_t;
+
+#define HND_EXT_TRAP_PHY_INFO_VER              2
+typedef struct hnd_ext_trap_phydbg_v2 {
+       uint8 version;
+       uint8 len;
+       uint16 err;
+       uint16 RxFeStatus;
+       uint16 TxFIFOStatus0;
+       uint16 TxFIFOStatus1;
+       uint16 RfseqMode;
+       uint16 RfseqStatus0;
+       uint16 RfseqStatus1;
+       uint16 RfseqStatus_Ocl;
+       uint16 RfseqStatus_Ocl1;
+       uint16 OCLControl1;
+       uint16 TxError;
+       uint16 bphyTxError;
+       uint16 TxCCKError;
+       uint16 TxCtrlWrd0;
+       uint16 TxCtrlWrd1;
+       uint16 TxCtrlWrd2;
+       uint16 TxLsig0;
+       uint16 TxLsig1;
+       uint16 TxVhtSigA10;
+       uint16 TxVhtSigA11;
+       uint16 TxVhtSigA20;
+       uint16 TxVhtSigA21;
+       uint16 txPktLength;
+       uint16 txPsdulengthCtr;
+       uint16 gpioClkControl;
+       uint16 gpioSel;
+       uint16 pktprocdebug;
+       uint32 gpioOut[3];
+       uint32 additional_regs[1];
+} hnd_ext_trap_phydbg_v2_t;
+
+#define HND_EXT_TRAP_PHY_INFO_VER_3            (3)
+typedef struct hnd_ext_trap_phydbg_v3 {
+       uint8 version;
+       uint8 len;
+       uint16 err;
+       uint16 RxFeStatus;
+       uint16 TxFIFOStatus0;
+       uint16 TxFIFOStatus1;
+       uint16 RfseqMode;
+       uint16 RfseqStatus0;
+       uint16 RfseqStatus1;
+       uint16 RfseqStatus_Ocl;
+       uint16 RfseqStatus_Ocl1;
+       uint16 OCLControl1;
+       uint16 TxError;
+       uint16 bphyTxError;
+       uint16 TxCCKError;
+       uint16 TxCtrlWrd0;
+       uint16 TxCtrlWrd1;
+       uint16 TxCtrlWrd2;
+       uint16 TxLsig0;
+       uint16 TxLsig1;
+       uint16 TxVhtSigA10;
+       uint16 TxVhtSigA11;
+       uint16 TxVhtSigA20;
+       uint16 TxVhtSigA21;
+       uint16 txPktLength;
+       uint16 txPsdulengthCtr;
+       uint16 gpioClkControl;
+       uint16 gpioSel;
+       uint16 pktprocdebug;
+       uint32 gpioOut[3];
+       uint16 HESigURateFlagStatus;
+       uint16 HESigUsRateFlagStatus;
+       uint32 additional_regs[1];
+} hnd_ext_trap_phydbg_v3_t;
+
+/* Phy TxErr Dump Structure */
+#define HND_EXT_TRAP_PHYTXERR_INFO_VER         1
+#define HND_EXT_TRAP_PHYTXERR_INFO_VER_V2      2
+typedef struct hnd_ext_trap_macphytxerr {
+       uint8 version; /* version of the information following this */
+       uint8 trap_reason;
+       uint16 i16_0x63E; /* tsf_tmr_rx_ts */
+       uint16 i16_0x640; /* tsf_tmr_tx_ts */
+       uint16 i16_0x642; /* tsf_tmr_rx_end_ts  */
+       uint16 i16_0x846; /* TDC_FrmLen0 */
+       uint16 i16_0x848; /* TDC_FrmLen1 */
+       uint16 i16_0x84a; /* TDC_Txtime */
+       uint16 i16_0xa5a; /* TXE_BytCntInTxFrmLo  */
+       uint16 i16_0xa5c; /* TXE_BytCntInTxFrmHi */
+       uint16 i16_0x856; /* TDC_VhtPsduLen0 */
+       uint16 i16_0x858; /* TDC_VhtPsduLen1 */
+       uint16 i16_0x490; /* psm_brc  */
+       uint16 i16_0x4d8; /* psm_brc_1 */
+       uint16 shm_txerr_reason;
+       uint16 shm_pctl0;
+       uint16 shm_pctl1;
+       uint16 shm_pctl2;
+       uint16 shm_lsig0;
+       uint16 shm_lsig1;
+       uint16 shm_plcp0;
+       uint16 shm_plcp1;
+       uint16 shm_plcp2;
+       uint16 shm_vht_sigb0;
+       uint16 shm_vht_sigb1;
+       uint16 shm_tx_tst;
+       uint16 shm_txerr_tm;
+       uint16 shm_curchannel;
+       uint16 shm_crx_rxtsf_pos;
+       uint16 shm_lasttx_tsf;
+       uint16 shm_s_rxtsftmrval;
+       uint16 i16_0x29;        /* Phy indirect address */
+       uint16 i16_0x2a;        /* Phy indirect address */
+} hnd_ext_trap_macphytxerr_t;
+
+typedef struct hnd_ext_trap_macphytxerr_v2 {
+       uint8 version; /* version of the information following this */
+       uint8 trap_reason;
+       uint16 i16_0x63E; /* tsf_tmr_rx_ts */
+       uint16 i16_0x640; /* tsf_tmr_tx_ts */
+       uint16 i16_0x642; /* tsf_tmr_rx_end_ts  */
+       uint16 i16_0x846; /* TDC_FrmLen0 */
+       uint16 i16_0x848; /* TDC_FrmLen1 */
+       uint16 i16_0x84a; /* TDC_Txtime */
+       uint16 i16_0xa5a; /* TXE_BytCntInTxFrmLo  */
+       uint16 i16_0xa5c; /* TXE_BytCntInTxFrmHi */
+       uint16 i16_0x856; /* TDC_VhtPsduLen0 */
+       uint16 i16_0x858; /* TDC_VhtPsduLen1 */
+       uint16 i16_0x490; /* psm_brc  */
+       uint16 i16_0x4d8; /* psm_brc_1 */
+       uint16 shm_txerr_reason;
+       uint16 shm_pctl0;
+       uint16 shm_pctl1;
+       uint16 shm_pctl2;
+       uint16 shm_lsig0;
+       uint16 shm_lsig1;
+       uint16 shm_plcp0;
+       uint16 shm_plcp1;
+       uint16 shm_plcp2;
+       uint16 shm_vht_sigb0;
+       uint16 shm_vht_sigb1;
+       uint16 shm_tx_tst;
+       uint16 shm_txerr_tm;
+       uint16 shm_curchannel;
+       uint16 shm_crx_rxtsf_pos;
+       uint16 shm_lasttx_tsf;
+       uint16 shm_s_rxtsftmrval;
+       uint16 i16_0x29;        /* Phy indirect address */
+       uint16 i16_0x2a;        /* Phy indirect address */
+       uint8 phyerr_bmac_cnt; /* number of times bmac raised phy tx err */
+       uint8 phyerr_bmac_rsn; /* bmac reason for phy tx error */
+       uint16 pad;
+       uint32 recv_fifo_status[3][2]; /* Rcv Status0 & Rcv Status1 for 3 Rx fifos */
+} hnd_ext_trap_macphytxerr_v2_t;
+
+#define HND_EXT_TRAP_PCIE_ERR_ATTN_VER_1       (1u)
+#define MAX_AER_HDR_LOG_REGS                   (4u)
+typedef struct hnd_ext_trap_pcie_err_attn_v1 {
+       uint8 version;
+       uint8 pad[3];
+       uint32 err_hdr_logreg1;
+       uint32 err_hdr_logreg2;
+       uint32 err_hdr_logreg3;
+       uint32 err_hdr_logreg4;
+       uint32 err_code_logreg;
+       uint32 err_type;
+       uint32 err_code_state;
+       uint32 last_err_attn_ts;
+       uint32 cfg_tlp_hdr[MAX_AER_HDR_LOG_REGS];
+} hnd_ext_trap_pcie_err_attn_v1_t;
+
+#define MAX_EVENTLOG_BUFFERS   48
+typedef struct eventlog_trapdata_info {
+       uint32 num_elements;
+       uint32 seq_num;
+       uint32 log_arr_addr;
+} eventlog_trapdata_info_t;
+
+typedef struct eventlog_trap_buf_info {
+       uint32 len;
+       uint32 buf_addr;
+} eventlog_trap_buf_info_t;
+
+#if defined(ETD) && !defined(WLETD)
+#define ETD_SW_FLAG_MEM                0x00000001
+
+int etd_init(osl_t *osh);
+int etd_register_trap_ext_callback(void *cb, void *arg);
+int (etd_register_trap_ext_callback_late)(void *cb, void *arg);
+uint32 *etd_get_trap_ext_data(void);
+uint32 etd_get_trap_ext_swflags(void);
+void etd_set_trap_ext_swflag(uint32 flag);
+void etd_notify_trap_ext_callback(trap_t *tr);
+reg_dump_config_t *etd_get_reg_dump_config_tbl(void);
+uint etd_get_reg_dump_config_len(void);
+
+extern bool _etd_enab;
+
+       #define ETD_ENAB(pub)           (_etd_enab)
+
+#else
+#define ETD_ENAB(pub)          (0)
+#endif /* WLETD */
+
+#endif /* !LANGUAGE_ASSEMBLY */
+
+#endif /* _ETD_H_ */
diff --git a/bcmdhd.101.10.240.x/include/ethernet.h b/bcmdhd.101.10.240.x/include/ethernet.h
new file mode 100644 (file)
index 0000000..b25a956
--- /dev/null
@@ -0,0 +1,220 @@
+/*
+ * From FreeBSD 2.2.7: Fundamental constants relating to ethernet.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _NET_ETHERNET_H_       /* use native BSD ethernet.h when available */
+#define _NET_ETHERNET_H_
+
+#ifndef _TYPEDEFS_H_
+#include "typedefs.h"
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/*
+ * The number of bytes in an ethernet (MAC) address.
+ */
+#define        ETHER_ADDR_LEN          6
+
+/*
+ * The number of bytes in the type field.
+ */
+#define        ETHER_TYPE_LEN          2
+
+/*
+ * The number of bytes in the trailing CRC field.
+ */
+#define        ETHER_CRC_LEN           4
+
+/*
+ * The length of the combined header.
+ */
+#define        ETHER_HDR_LEN           (ETHER_ADDR_LEN * 2 + ETHER_TYPE_LEN)
+
+/*
+ * The minimum packet length.
+ */
+#define        ETHER_MIN_LEN           64
+
+/*
+ * The minimum packet user data length.
+ */
+#define        ETHER_MIN_DATA          46
+
+/*
+ * The maximum packet length.
+ */
+#define        ETHER_MAX_LEN           1518
+
+/*
+ * The maximum packet user data length.
+ */
+#define        ETHER_MAX_DATA          1500
+
+/* ether types */
+#define ETHER_TYPE_MIN         0x0600          /* Anything less than MIN is a length */
+#define        ETHER_TYPE_IP           0x0800          /* IP */
+#define ETHER_TYPE_ARP         0x0806          /* ARP */
+#define ETHER_TYPE_8021Q       0x8100          /* 802.1Q */
+#define        ETHER_TYPE_IPV6         0x86dd          /* IPv6 */
+#define        ETHER_TYPE_BRCM         0x886c          /* Broadcom Corp. */
+#define        ETHER_TYPE_802_1X       0x888e          /* 802.1x */
+#define        ETHER_TYPE_802_1X_PREAUTH 0x88c7        /* 802.1x preauthentication */
+#define ETHER_TYPE_WAI         0x88b4          /* WAI */
+#define ETHER_TYPE_89_0D       0x890d          /* 89-0d frame for TDLS */
+#define ETHER_TYPE_RRB         ETHER_TYPE_89_0D  /* RRB 802.11r 2008 */
+
+#define ETHER_TYPE_PPP_SES     0x8864          /* PPPoE Session */
+
+#define ETHER_TYPE_IAPP_L2_UPDATE      0x6     /* IAPP L2 update frame */
+
+/* Broadcom subtype follows ethertype;  First 2 bytes are reserved; Next 2 are subtype; */
+#define        ETHER_BRCM_SUBTYPE_LEN  4       /* Broadcom 4 byte subtype */
+
+/* ether header */
+#define ETHER_DEST_OFFSET      (0 * ETHER_ADDR_LEN)    /* dest address offset */
+#define ETHER_SRC_OFFSET       (1 * ETHER_ADDR_LEN)    /* src address offset */
+#define ETHER_TYPE_OFFSET      (2 * ETHER_ADDR_LEN)    /* ether type offset */
+
+/*
+ * A macro to validate a length with
+ */
+#define        ETHER_IS_VALID_LEN(foo) \
+       ((foo) >= ETHER_MIN_LEN && (foo) <= ETHER_MAX_LEN)
+
+#define ETHER_FILL_MCAST_ADDR_FROM_IP(ea, mgrp_ip) {           \
+               ((uint8 *)ea)[0] = 0x01;                        \
+               ((uint8 *)ea)[1] = 0x00;                        \
+               ((uint8 *)ea)[2] = 0x5e;                        \
+               ((uint8 *)ea)[3] = ((mgrp_ip) >> 16) & 0x7f;    \
+               ((uint8 *)ea)[4] = ((mgrp_ip) >>  8) & 0xff;    \
+               ((uint8 *)ea)[5] = ((mgrp_ip) >>  0) & 0xff;    \
+}
+
+#ifndef __INCif_etherh /* Quick and ugly hack for VxWorks */
+/*
+ * Structure of a 10Mb/s Ethernet header.
+ */
+BWL_PRE_PACKED_STRUCT struct ether_header {
+       uint8   ether_dhost[ETHER_ADDR_LEN];
+       uint8   ether_shost[ETHER_ADDR_LEN];
+       uint16  ether_type;
+} BWL_POST_PACKED_STRUCT;
+
+/*
+ * Structure of a 48-bit Ethernet address.
+ */
+BWL_PRE_PACKED_STRUCT struct   ether_addr {
+       uint8 octet[ETHER_ADDR_LEN];
+} BWL_POST_PACKED_STRUCT;
+#endif /* __INCif_etherh */
+#ifdef __INCif_etherh
+#endif /* !__INCif_etherh Quick and ugly hack for VxWorks */
+
+/*
+ * Takes a pointer, set, test, clear, toggle locally admininistered
+ * address bit in the 48-bit Ethernet address.
+ */
+#define ETHER_SET_LOCALADDR(ea)        (((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] | 2))
+#define ETHER_IS_LOCALADDR(ea) (((uint8 *)(ea))[0] & 2)
+#define ETHER_CLR_LOCALADDR(ea)        (((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] & 0xfd))
+#define ETHER_TOGGLE_LOCALADDR(ea)     (((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] ^ 2))
+
+/* Takes a pointer, marks unicast address bit in the MAC address */
+#define ETHER_SET_UNICAST(ea)  (((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] & ~1))
+
+/*
+ * Takes a pointer, returns true if a 48-bit multicast address
+ * (including broadcast, since it is all ones)
+ */
+#define ETHER_ISMULTI(ea) (((const uint8 *)(ea))[0] & 1)
+
+/* compare two ethernet addresses - assumes the pointers can be referenced as shorts */
+#define eacmp(a, b)    ((((const uint16 *)(a))[0] ^ ((const uint16 *)(b))[0]) | \
+                        (((const uint16 *)(a))[1] ^ ((const uint16 *)(b))[1]) | \
+                        (((const uint16 *)(a))[2] ^ ((const uint16 *)(b))[2]))
+
+#define        ether_cmp(a, b) eacmp(a, b)
+
+/* copy an ethernet address - assumes the pointers can be referenced as shorts */
+#define eacopy(s, d) \
+do { \
+       ((uint16 *)(d))[0] = ((const uint16 *)(s))[0]; \
+       ((uint16 *)(d))[1] = ((const uint16 *)(s))[1]; \
+       ((uint16 *)(d))[2] = ((const uint16 *)(s))[2]; \
+} while (0)
+
+#define        ether_copy(s, d) eacopy(s, d)
+
+/* Copy an ethernet address in reverse order */
+#define        ether_rcopy(s, d) \
+do { \
+       ((uint16 *)(d))[2] = ((uint16 *)(s))[2]; \
+       ((uint16 *)(d))[1] = ((uint16 *)(s))[1]; \
+       ((uint16 *)(d))[0] = ((uint16 *)(s))[0]; \
+} while (0)
+
+/* Copy 14B ethernet header: 32bit aligned source and destination. */
+#define ehcopy32(s, d) \
+do { \
+       ((uint32 *)(d))[0] = ((const uint32 *)(s))[0]; \
+       ((uint32 *)(d))[1] = ((const uint32 *)(s))[1]; \
+       ((uint32 *)(d))[2] = ((const uint32 *)(s))[2]; \
+       ((uint16 *)(d))[6] = ((const uint16 *)(s))[6]; \
+} while (0)
+
+static const struct ether_addr ether_bcast = {{255, 255, 255, 255, 255, 255}};
+static const struct ether_addr ether_null = {{0, 0, 0, 0, 0, 0}};
+static const struct ether_addr ether_ipv6_mcast = {{0x33, 0x33, 0x00, 0x00, 0x00, 0x01}};
+
+#define ETHER_ISBCAST(ea)      ((((const uint8 *)(ea))[0] &            \
+                                 ((const uint8 *)(ea))[1] &            \
+                                 ((const uint8 *)(ea))[2] &            \
+                                 ((const uint8 *)(ea))[3] &            \
+                                 ((const uint8 *)(ea))[4] &            \
+                                 ((const uint8 *)(ea))[5]) == 0xff)
+#define ETHER_ISNULLADDR(ea)   ((((const uint8 *)(ea))[0] |            \
+                                 ((const uint8 *)(ea))[1] |            \
+                                 ((const uint8 *)(ea))[2] |            \
+                                 ((const uint8 *)(ea))[3] |            \
+                                 ((const uint8 *)(ea))[4] |            \
+                                 ((const uint8 *)(ea))[5]) == 0)
+
+#define ETHER_ISNULLDEST(da)   ((((const uint16 *)(da))[0] |           \
+                                 ((const uint16 *)(da))[1] |           \
+                                 ((const uint16 *)(da))[2]) == 0)
+#define ETHER_ISNULLSRC(sa)    ETHER_ISNULLDEST(sa)
+
+#define ETHER_MOVE_HDR(d, s) \
+do { \
+       struct ether_header t; \
+       t = *(struct ether_header *)(s); \
+       *(struct ether_header *)(d) = t; \
+} while (0)
+
+#define  ETHER_ISUCAST(ea) ((((uint8 *)(ea))[0] & 0x01) == 0)
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _NET_ETHERNET_H_ */
diff --git a/bcmdhd.101.10.240.x/include/event_log.h b/bcmdhd.101.10.240.x/include/event_log.h
new file mode 100644 (file)
index 0000000..df90967
--- /dev/null
@@ -0,0 +1,656 @@
+/*
+ * EVENT_LOG system definitions
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _EVENT_LOG_H_
+#define _EVENT_LOG_H_
+
+#include <typedefs.h>
+#include <event_log_set.h>
+#include <event_log_tag.h>
+#include <event_log_payload.h>
+
+/* logstrs header */
+#define LOGSTRS_MAGIC   0x4C4F4753
+#define LOGSTRS_VERSION 0x1
+
+/* We make sure that the block size will fit in a single packet
+ *  (allowing for a bit of overhead on each packet
+ */
+#if defined(BCMPCIEDEV)
+#define EVENT_LOG_MAX_BLOCK_SIZE       1648
+#else
+#define EVENT_LOG_MAX_BLOCK_SIZE       1400
+#endif
+
+#define EVENT_LOG_BLOCK_SIZE_1K                0x400u
+#define EVENT_LOG_WL_BLOCK_SIZE                0x200
+#define EVENT_LOG_PSM_BLOCK_SIZE       0x200
+#define EVENT_LOG_MEM_API_BLOCK_SIZE   0x200
+#define EVENT_LOG_BUS_BLOCK_SIZE       0x200
+#define EVENT_LOG_ERROR_BLOCK_SIZE     0x400
+#define EVENT_LOG_MSCH_BLOCK_SIZE      0x400
+#define EVENT_LOG_WBUS_BLOCK_SIZE      0x100
+#define EVENT_LOG_PRSV_PERIODIC_BLOCK_SIZE (0x200u)
+
+#define EVENT_LOG_TOF_INLINE_BLOCK_SIZE        1300u
+
+#define EVENT_LOG_PRSRV_BUF_SIZE       (EVENT_LOG_MAX_BLOCK_SIZE * 2)
+#define EVENT_LOG_BUS_PRSRV_BUF_SIZE   (EVENT_LOG_BUS_BLOCK_SIZE * 2)
+#define EVENT_LOG_WBUS_PRSRV_BUF_SIZE  (EVENT_LOG_WBUS_BLOCK_SIZE * 2)
+
+#define EVENT_LOG_BLOCK_SIZE_PRSRV_CHATTY      (EVENT_LOG_MAX_BLOCK_SIZE * 1)
+#define EVENT_LOG_BLOCK_SIZE_BUS_PRSRV_CHATTY  (EVENT_LOG_MAX_BLOCK_SIZE * 1)
+
+/* Maximum event log record payload size = 1016 bytes or 254 words. */
+#define EVENT_LOG_MAX_RECORD_PAYLOAD_SIZE      254
+
+#define EVENT_LOG_EXT_HDR_IND          (0x01)
+#define EVENT_LOG_EXT_HDR_BIN_DATA_IND (0x01 << 1)
+/* Format number to send binary data with extended event log header */
+#define EVENT_LOG_EXT_HDR_BIN_FMT_NUM  (0x3FFE << 2)
+
+#define EVENT_LOGSET_ID_MASK   0x3F
+/* For event_log_get iovar, set values from 240 to 255 mean special commands for a group of sets */
+#define EVENT_LOG_GET_IOV_CMD_MASK     (0xF0u)
+#define EVENT_LOG_GET_IOV_CMD_ID_MASK  (0xFu)
+#define EVENT_LOG_GET_IOV_CMD_ID_FORCE_FLUSH_PRSRV     (0xEu) /* 240 + 14 = 254 */
+#define EVENT_LOG_GET_IOV_CMD_ID_FORCE_FLUSH_ALL       (0xFu) /* 240 + 15 = 255 */
+
+/*
+ * There are multiple levels of objects define here:
+ *   event_log_set - a set of buffers
+ *   event log groups - every event log call is part of just one.  All
+ *                      event log calls in a group are handled the
+ *                      same way.  Each event log group is associated
+ *                      with an event log set or is off.
+ */
+
+#ifndef __ASSEMBLER__
+
+/* On the external system where the dumper is we need to make sure
+ * that these types are the same size as they are on the ARM the
+ * produced them
+ */
+#ifdef EVENT_LOG_DUMPER
+#define _EL_BLOCK_PTR uint32
+#define _EL_TYPE_PTR uint32
+#define _EL_SET_PTR uint32
+#define _EL_TOP_PTR uint32
+#else
+#define _EL_BLOCK_PTR struct event_log_block *
+#define _EL_TYPE_PTR uint32 *
+#define _EL_SET_PTR struct event_log_set **
+#define _EL_TOP_PTR struct event_log_top *
+#endif /* EVENT_LOG_DUMPER */
+
+/* Event log sets (a logical circurlar buffer) consist of one or more
+ * event_log_blocks.  The blocks themselves form a logical circular
+ * list.  The log entries are placed in each event_log_block until it
+ * is full.  Logging continues with the next event_log_block in the
+ * event_set until the last event_log_block is reached and then
+ * logging starts over with the first event_log_block in the
+ * event_set.
+ */
+typedef struct event_log_block {
+       _EL_BLOCK_PTR next_block;
+       _EL_BLOCK_PTR prev_block;
+       _EL_TYPE_PTR end_ptr;
+
+       /* Start of packet sent for log tracing */
+       uint16 pktlen;                  /* Size of rest of block */
+       uint16 count;                   /* Logtrace counter */
+       uint32 extra_hdr_info;          /* LSB: 6 bits set id. MSB 24 bits reserved */
+       uint32 event_logs;              /* Pointer to BEGINNING of event logs */
+       /* Event logs go here. Do not put extra fields below. */
+} event_log_block_t;
+
+/* Relative offset of extra_hdr_info field frpm pktlen field in log block */
+#define EVENT_LOG_BUF_EXTRA_HDR_INFO_REL_PKTLEN_OFFSET         \
+       (OFFSETOF(event_log_block_t, extra_hdr_info) -  OFFSETOF(event_log_block_t, pktlen))
+
+#define EVENT_LOG_SETID_MASK   (0x3Fu)
+
+#define EVENT_LOG_BLOCK_HDRLEN         (sizeof(((event_log_block_t *) 0)->pktlen) \
+                                       + sizeof(((event_log_block_t *) 0)->count) \
+                                       + sizeof(((event_log_block_t *) 0)->extra_hdr_info))
+#define EVENT_LOG_BLOCK_LEN            (EVENT_LOG_BLOCK_HDRLEN + sizeof(event_log_hdr_t))
+
+#define EVENT_LOG_PRESERVE_BLOCK       (1 << 0)
+#define EVENT_LOG_BLOCK_FLAG_MASK      0xff000000u
+#define EVENT_LOG_BLOCK_FLAG_SHIFT     24u
+
+#define EVENT_LOG_BLOCK_GET_PREV_BLOCK(block)  ((_EL_BLOCK_PTR)(((uint32)((block)->prev_block)) & \
+       ~EVENT_LOG_BLOCK_FLAG_MASK))
+#define EVENT_LOG_BLOCK_SET_PREV_BLOCK(block, prev)    ((block)->prev_block = \
+       ((_EL_BLOCK_PTR)((((uint32)(block)->prev_block) & EVENT_LOG_BLOCK_FLAG_MASK) | \
+       (((uint32)(prev)) & ~EVENT_LOG_BLOCK_FLAG_MASK))))
+#define EVENT_LOG_BLOCK_GET_FLAG(block)        ((((uint32)(block)->prev_block) &       \
+       EVENT_LOG_BLOCK_FLAG_MASK) >> EVENT_LOG_BLOCK_FLAG_SHIFT)
+#define EVENT_LOG_BLOCK_SET_FLAG(block, flag) ((block)->prev_block =   \
+               (_EL_BLOCK_PTR)(((uint32)EVENT_LOG_BLOCK_GET_PREV_BLOCK(block)) | flag))
+#define EVENT_LOG_BLOCK_OR_FLAG(block, flag)   EVENT_LOG_BLOCK_SET_FLAG(block, \
+               (EVENT_LOG_BLOCK_GET_FLAG(block) | flag) << EVENT_LOG_BLOCK_FLAG_SHIFT)
+
+typedef enum {
+       SET_DESTINATION_INVALID = -1,
+       SET_DESTINATION_HOST = 0,       /* Eventlog buffer is sent out to host once filled. */
+       SET_DESTINATION_NONE = 1,       /* The buffer is not sent out, and it will be overwritten
+                                          * with new messages.
+                                          */
+       SET_DESTINATION_FORCE_FLUSH_TO_HOST = 2, /* Buffers are sent to host once and then the
+                                                   *  value is reset back to SET_DESTINATION_NONE.
+                                                   */
+       SET_DESTINATION_FLUSH_ON_WATERMARK = 3, /* Buffers are sent to host when the watermark is
+                                                * reached, defined by the feature /chip
+                                                */
+       SET_DESTINATION_MAX
+} event_log_set_destination_t;
+
+/* sub destination for routing at the host */
+typedef enum {
+       SET_SUB_DESTINATION_0 = 0,
+       SET_SUB_DESTINATION_1 = 1,
+       SET_SUB_DESTINATION_2 = 2,
+       SET_SUB_DESTINATION_3 = 3,
+       SET_SUB_DESTINATION_DEFAULT = SET_SUB_DESTINATION_0
+} event_log_set_sub_destination_t;
+
+/* There can be multiple event_sets with each logging a set of
+ * associated events (i.e, "fast" and "slow" events).
+ */
+typedef struct event_log_set {
+       _EL_BLOCK_PTR first_block;      /* Pointer to first event_log block */
+       _EL_BLOCK_PTR last_block;       /* Pointer to last event_log block */
+       _EL_BLOCK_PTR logtrace_block;   /* next block traced */
+       _EL_BLOCK_PTR cur_block;        /* Pointer to current event_log block */
+       _EL_TYPE_PTR cur_ptr;           /* Current event_log pointer */
+       uint32 blockcount;              /* Number of blocks */
+       uint16 logtrace_count;          /* Last count for logtrace */
+       uint16 blockfill_count;         /* Fill count for logtrace */
+       uint32 timestamp;               /* Last timestamp event */
+       uint32 cyclecount;              /* Cycles at last timestamp event */
+       event_log_set_destination_t destination;
+       uint16 size;                    /* same size for all buffers in one  set */
+       uint16 flags;
+       uint16 num_preserve_blocks;
+       event_log_set_sub_destination_t sub_destination;
+       uint16  water_mark;             /* not used yet: threshold to flush host in percent */
+       uint32  period;                 /* period to flush host in ms */
+       uint32  last_rpt_ts;    /* last time to flush  in ms */
+} event_log_set_t;
+
+/* Definition of flags in set */
+#define EVENT_LOG_SET_SHRINK_ACTIVE    (1 << 0)
+#define EVENT_LOG_SET_CONFIG_PARTIAL_BLK_SEND  (0x1 << 1)
+#define EVENT_LOG_SET_CHECK_LOG_RATE   (1 << 2)
+#define EVENT_LOG_SET_PERIODIC                 (1 << 3)
+#define EVENT_LOG_SET_D3PRSV                   (1 << 4)
+
+/* Top data structure for access to everything else */
+typedef struct event_log_top {
+       uint32 magic;
+#define EVENT_LOG_TOP_MAGIC 0x474C8669 /* 'EVLG' */
+       uint32 version;
+#define EVENT_LOG_VERSION 1
+       uint32 num_sets;
+       uint32 logstrs_size;            /* Size of lognums + logstrs area */
+       uint32 timestamp;               /* Last timestamp event */
+       uint32 cyclecount;              /* Cycles at last timestamp event */
+       _EL_SET_PTR sets;               /* Ptr to array of <num_sets> set ptrs */
+       uint16 log_count;               /* Number of event logs from last flush */
+       uint16 rate_hc;                 /* Max number of prints per second */
+       uint32 hc_timestamp;            /* Timestamp of last hc window starting */
+       bool cpu_freq_changed;          /* Set to TRUE when CPU freq changed */
+} event_log_top_t;
+
+/* structure of the trailing 3 words in logstrs.bin */
+typedef struct {
+       uint32 fw_id;           /* FWID will be written by tool later */
+       uint32 flags;           /* 0th bit indicates whether encrypted or not */
+       /* Keep version and magic last since "header" is appended to the end of logstrs file. */
+       uint32 version;         /* Header version */
+       uint32 log_magic;       /* MAGIC number for verification 'LOGS' */
+} logstr_trailer_t;
+
+/* Data structure of Keeping the Header from logstrs.bin */
+typedef struct {
+       uint32 logstrs_size;    /* Size of the file */
+       uint32 rom_lognums_offset; /* Offset to the ROM lognum */
+       uint32 ram_lognums_offset; /* Offset to the RAM lognum */
+       uint32 rom_logstrs_offset; /* Offset to the ROM logstr */
+       uint32 ram_logstrs_offset; /* Offset to the RAM logstr */
+       uint32 fw_id;           /* FWID will be written by tool later */
+       uint32 flags;           /* 0th bit indicates whether encrypted or not */
+       /* Keep version and magic last since "header" is appended to the end of logstrs file. */
+       uint32 version;            /* Header version */
+       uint32 log_magic;       /* MAGIC number for verification 'LOGS' */
+} logstr_header_t;
+
+/* Data structure of Keeping the Header from logstrs.bin */
+typedef struct {
+       uint32 logstrs_size;    /* Size of the file */
+       uint32 rom_lognums_offset; /* Offset to the ROM lognum */
+       uint32 ram_lognums_offset; /* Offset to the RAM lognum */
+       uint32 rom_logstrs_offset; /* Offset to the ROM logstr */
+       uint32 ram_logstrs_offset; /* Offset to the RAM logstr */
+       /* Keep version and magic last since "header" is appended to the end of logstrs file. */
+       uint32 version;            /* Header version */
+       uint32 log_magic;       /* MAGIC number for verification 'LOGS' */
+} logstr_header_v1_t;
+
+/* Event log configuration table */
+typedef struct evt_log_tag_entry {
+       uint16  tag; /* Tag value. */
+       uint8   set; /* Set number. */
+       uint8   refcnt; /* Ref_count if sdc is used */
+} evt_log_tag_entry_t;
+
+#ifdef BCMDRIVER
+/* !!! The following section is for kernel mode code only !!! */
+#include <osl_decl.h>
+
+extern bool d3_preserve_enab;
+#if defined(ROM_ENAB_RUNTIME_CHECK)
+       #define D3_PRESERVE_ENAB()   (d3_preserve_enab)
+#elif defined(EVENTLOG_D3_PRESERVE_DISABLED)
+       #define D3_PRESERVE_ENAB()   (0)
+#else
+       #define D3_PRESERVE_ENAB()   (1)
+#endif
+
+#if defined(EVENTLOG_PRSV_PERIODIC)
+extern bool prsv_periodic_enab;
+#if defined(ROM_ENAB_RUNTIME_CHECK)
+       #define PRSV_PRD_ENAB()   (prsv_periodic_enab)
+#elif defined(EVENTLOG_PRSV_PERIODIC_DISABLED)
+       #define PRSV_PRD_ENAB()   (0)
+#else
+       #define PRSV_PRD_ENAB()   (1)
+#endif
+#endif /* EVENTLOG_PRSV_PERIODIC */
+
+/*
+ * Use the following macros for generating log events.
+ *
+ * The FAST versions check the enable of the tag before evaluating the arguments and calling the
+ * event_log function.  This adds 5 instructions.  The COMPACT versions evaluate the arguments
+ * and call the event_log function unconditionally.  The event_log function will then skip logging
+ * if this tag is disabled.
+ *
+ * To support easy usage of existing debugging (e.g. msglevel) via macro re-definition there are
+ * two variants of these macros to help.
+ *
+ * First there are the CAST versions.  The event_log function normally logs uint32 values or else
+ * they have to be cast to uint32.  The CAST versions blindly cast for you so you don't have to edit
+ * any existing code.
+ *
+ * Second there are the PAREN_ARGS versions.  These expect the logging format string and arguments
+ * to be enclosed in parentheses.  This allows us to make the following mapping of an existing
+ * msglevel macro:
+ *  #define WL_ERROR(args)   EVENT_LOG_CAST_PAREN_ARGS(EVENT_LOG_TAG_WL_ERROR, args)
+ *
+ * The versions of the macros without FAST or COMPACT in their name are just synonyms for the
+ * COMPACT versions.
+ *
+ * You should use the COMPACT macro (or its synonym) in cases where there is some preceding logic
+ * that prevents the execution of the macro, e.g. WL_ERROR by definition rarely gets executed.
+ * Use the FAST macro in performance sensitive paths. The key concept here is that you should be
+ * assuming that your macro usage is compiled into ROM and can't be changed ... so choose wisely.
+ *
+ */
+
+#if !defined(EVENT_LOG_DUMPER)
+
+#ifndef EVENT_LOG_COMPILE
+
+/* Null define if no tracing */
+#define EVENT_LOG(tag, fmt, ...)
+#define EVENT_LOG_FAST(tag, fmt, ...)
+#define EVENT_LOG_COMPACT(tag, fmt, ...)
+
+#define EVENT_LOG_CAST(tag, fmt, ...)
+#define EVENT_LOG_FAST_CAST(tag, fmt, ...)
+#define EVENT_LOG_COMPACT_CAST(tag, fmt, ...)
+
+#define EVENT_LOG_CAST_PAREN_ARGS(tag, pargs)
+#define EVENT_LOG_FAST_CAST_PAREN_ARGS(tag, pargs)
+#define EVENT_LOG_COMPACT_CAST_PAREN_ARGS(tag, pargs)
+
+#define EVENT_LOG_IF_READY(tag, fmt, ...)
+#define EVENT_LOG_IS_ON(tag)           0
+#define EVENT_LOG_IS_LOG_ON(tag)       0
+
+#define EVENT_LOG_BUFFER(tag, buf, size)
+#define EVENT_LOG_PRSRV_FLUSH()
+#define EVENT_LOG_FORCE_FLUSH_ALL()
+#define EVENT_LOG_FORCE_FLUSH_PRSRV_LOG_ALL()
+
+#else  /* EVENT_LOG_COMPILE */
+
+/* The first few _EVENT_LOGX() macros are special because they can be done more
+ * efficiently this way and they are the common case.  Once there are too many
+ * parameters the code size starts to be an issue and a loop is better
+ * The trailing arguments to the _EVENT_LOGX() macros are the format string, 'fmt',
+ * followed by the variable parameters for the format. The format string is not
+ * needed in the event_logX() replacement text, so fmt is dropped in all cases.
+ */
+#define _EVENT_LOG0(tag, fmt_num, fmt)                 \
+       event_log0(tag, fmt_num)
+#define _EVENT_LOG1(tag, fmt_num, fmt, t1)             \
+       event_log1(tag, fmt_num, t1)
+#define _EVENT_LOG2(tag, fmt_num, fmt, t1, t2)         \
+       event_log2(tag, fmt_num, t1, t2)
+#define _EVENT_LOG3(tag, fmt_num, fmt, t1, t2, t3)     \
+       event_log3(tag, fmt_num, t1, t2, t3)
+#define _EVENT_LOG4(tag, fmt_num, fmt, t1, t2, t3, t4) \
+       event_log4(tag, fmt_num, t1, t2, t3, t4)
+
+/* The rest call the generic routine that takes a count */
+#define _EVENT_LOG5(tag, fmt_num, fmt, ...) event_logn(5, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG6(tag, fmt_num, fmt, ...) event_logn(6, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG7(tag, fmt_num, fmt, ...) event_logn(7, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG8(tag, fmt_num, fmt, ...) event_logn(8, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG9(tag, fmt_num, fmt, ...) event_logn(9, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGA(tag, fmt_num, fmt, ...) event_logn(10, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGB(tag, fmt_num, fmt, ...) event_logn(11, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGC(tag, fmt_num, fmt, ...) event_logn(12, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGD(tag, fmt_num, fmt, ...) event_logn(13, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGE(tag, fmt_num, fmt, ...) event_logn(14, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGF(tag, fmt_num, fmt, ...) event_logn(15, tag, fmt_num, __VA_ARGS__)
+
+/* Casting  low level macros */
+#define _EVENT_LOG_CAST0(tag, fmt_num, fmt)            \
+       event_log0(tag, fmt_num)
+#define _EVENT_LOG_CAST1(tag, fmt_num, fmt, t1)                \
+       event_log1(tag, fmt_num, (uint32)(t1))
+#define _EVENT_LOG_CAST2(tag, fmt_num, fmt, t1, t2)    \
+       event_log2(tag, fmt_num, (uint32)(t1), (uint32)(t2))
+#define _EVENT_LOG_CAST3(tag, fmt_num, fmt, t1, t2, t3)        \
+       event_log3(tag, fmt_num, (uint32)(t1), (uint32)(t2), (uint32)(t3))
+#define _EVENT_LOG_CAST4(tag, fmt_num, fmt, t1, t2, t3, t4)    \
+       event_log4(tag, fmt_num, (uint32)(t1), (uint32)(t2), (uint32)(t3), (uint32)(t4))
+
+/* The rest call the generic routine that takes a count */
+#define _EVENT_LOG_CAST5(tag, fmt_num, ...) _EVENT_LOG5(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CAST6(tag, fmt_num, ...) _EVENT_LOG6(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CAST7(tag, fmt_num, ...) _EVENT_LOG7(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CAST8(tag, fmt_num, ...) _EVENT_LOG8(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CAST9(tag, fmt_num, ...) _EVENT_LOG9(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CASTA(tag, fmt_num, ...) _EVENT_LOGA(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CASTB(tag, fmt_num, ...) _EVENT_LOGB(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CASTC(tag, fmt_num, ...) _EVENT_LOGC(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CASTD(tag, fmt_num, ...) _EVENT_LOGD(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CASTE(tag, fmt_num, ...) _EVENT_LOGE(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CASTF(tag, fmt_num, ...) _EVENT_LOGF(tag, fmt_num, __VA_ARGS__)
+
+/* Hack to make the proper routine call when variadic macros get
+ * passed.  Note the max of 15 arguments.  More than that can't be
+ * handled by the event_log entries anyways so best to catch it at compile
+ * time
+ *
+ * Here is what happens with this macro: when _EVENT_LOG expands this macro,
+ * its __VA_ARGS__ argument is expanded. If __VA_ARGS__ contains only ONE
+ * argument, for example, then F maps to _1, E maps to _2, and so on, so that
+ * N maps to 0, and the macro expands to BASE ## N or BASE ## 0 which is
+ * EVENT_LOG0. If __VA_ARGS__ contains two arguments, then everything is
+ * shifted down by one, because the second argument in __VA_ARGS__ now maps
+ * to _1, so F maps to _2, E maps to _3, and so on, and 1 (instead of 0) maps
+ * to N, and this macro expands to become _EVENT_LOG1. This continues all
+ * the way up until __VA_ARGS__ has 15 arguments, in which case, stuff in
+ * __VA_ARGS__ maps to all of the values _1 through _F, which makes F (in'
+ * the _EVENT_LOG macro) map to N, and this macro then expands to EVENT_LOGF.
+ */
+
+#define _EVENT_LOG_VA_NUM_ARGS(BASE, _FMT, _1, _2, _3, _4, _5, _6, _7, _8, _9, \
+                              _A, _B, _C, _D, _E, _F, N, ...) BASE ## N
+
+/* Take a variable number of args and replace with only the first */
+#define FIRST_ARG(a1, ...) a1
+
+/* base = _EVENT_LOG for no casting
+ * base = _EVENT_LOG_CAST for casting of fmt arguments to uint32.
+ *        Only first 4 arguments are cast to uint32. event_logn() is called
+ *        if more than 4 arguments are present. This function internally assumes
+ *        all arguments are uint32
+ *
+ * The variable args in this call are the format string followed by the variable
+ * parameters for the format. E.g.
+ *
+ *     __VA_ARGS__ = "answer: %d", 42
+ *
+ * This means __VA_ARGS__ always has one or more arguments. Guaranteeing a non-empty
+ * __VA_ARGS__ means the special use of " , ## __VA_ARGS__" is not required to deal
+ * with a dangling comma --- the comma will always be followed with at leaset the format
+ * string. The use of ## caused issues when the format args contained a function like
+ * macro that expanded to more than one arg. The ## prevented macro expansion, so the
+ * _EVENT_LOG_VA_NUM_ARGS() calculation of the number of args was incorrect.
+ * Without the ##, the __VA_ARGS__ are macro replaced, and the num args calculation is
+ * accurate.
+ *
+ * This macro is setup so that if __VA_ARGS__ is as short as possible, then the "0" will
+ * map to "N" in the _EVENT_LOG_VA_NUM_ARGS macro, and that macro then expands to become
+ * _EVENT_LOG0. As __VA_ARGS__ gets longer, then the item that gets mapped to "N" gets
+ * pushed further and further up, so that by the time __VA_ARGS__ has 15 additional
+ * arguments, then "F" maps to "N" in the _EVENT_LOG_VA_NUM_ARGS macro.
+ */
+#define _EVENT_LOG(base, tag, ...)                                     \
+       static char logstr[] __attribute__ ((section(".logstrs"))) = FIRST_ARG(__VA_ARGS__); \
+       static uint32 fmtnum __attribute__ ((section(".lognums"))) = (uint32) &logstr; \
+       _EVENT_LOG_VA_NUM_ARGS(base, __VA_ARGS__,                       \
+                              F, E, D, C, B, A, 9, 8,                  \
+                              7, 6, 5, 4, 3, 2, 1, 0)                  \
+       (tag, (int) &fmtnum, __VA_ARGS__)
+
+#define EVENT_LOG_FAST(tag, ...)                                       \
+       do {                                                            \
+               if (event_log_tag_sets != NULL) {                       \
+                       uint8 tag_flag = *(event_log_tag_sets + tag);   \
+                       if ((tag_flag & ~EVENT_LOG_TAG_FLAG_SET_MASK) != 0) {   \
+                               _EVENT_LOG(_EVENT_LOG, tag, __VA_ARGS__);       \
+                       }                                               \
+               }                                                       \
+       } while (0)
+
+#define EVENT_LOG_COMPACT(tag, ...)                                    \
+       do {                                                            \
+               _EVENT_LOG(_EVENT_LOG, tag, __VA_ARGS__);               \
+       } while (0)
+
+/* Event log macro with casting to uint32 of arguments */
+#define EVENT_LOG_FAST_CAST(tag, ...)                                  \
+       do {                                                            \
+               if (event_log_tag_sets != NULL) {                       \
+                       uint8 tag_flag = *(event_log_tag_sets + tag);   \
+                       if ((tag_flag & ~EVENT_LOG_TAG_FLAG_SET_MASK) != 0) {   \
+                               _EVENT_LOG(_EVENT_LOG_CAST, tag, __VA_ARGS__);  \
+                       }                                               \
+               }                                                       \
+       } while (0)
+
+#define EVENT_LOG_COMPACT_CAST(tag, ...)                               \
+       do {                                                            \
+               _EVENT_LOG(_EVENT_LOG_CAST, tag, __VA_ARGS__);          \
+       } while (0)
+
+#define EVENT_LOG(tag, ...) EVENT_LOG_COMPACT(tag, __VA_ARGS__)
+
+#define EVENT_LOG_CAST(tag, ...) EVENT_LOG_COMPACT_CAST(tag, __VA_ARGS__)
+
+#define _EVENT_LOG_REMOVE_PAREN(...) __VA_ARGS__
+#define EVENT_LOG_REMOVE_PAREN(args) _EVENT_LOG_REMOVE_PAREN args
+
+#define EVENT_LOG_CAST_PAREN_ARGS(tag, pargs)                          \
+               EVENT_LOG_CAST(tag, EVENT_LOG_REMOVE_PAREN(pargs))
+
+#define EVENT_LOG_FAST_CAST_PAREN_ARGS(tag, pargs)                     \
+               EVENT_LOG_FAST_CAST(tag, EVENT_LOG_REMOVE_PAREN(pargs))
+
+#define EVENT_LOG_COMPACT_CAST_PAREN_ARGS(tag, pargs)                  \
+               EVENT_LOG_COMPACT_CAST(tag, EVENT_LOG_REMOVE_PAREN(pargs))
+
+/* Minimal event logging. Event log internally calls event_logx()
+ * log return address in caller.
+ * Note that the if(0){..} below is to avoid compiler warnings
+ * due to unused variables caused by this macro
+ */
+#define EVENT_LOG_RA(tag, args)                                                \
+       do {                                                            \
+               if (0) {                                                \
+                       EVENT_LOG_COMPACT_CAST_PAREN_ARGS(tag, args);   \
+               }                                                       \
+               event_log_caller_return_address(tag);                   \
+       } while (0)
+
+#define EVENT_LOG_IF_READY(_tag, ...) \
+       do {                                \
+               if (event_log_is_ready()) {             \
+                       EVENT_LOG(_tag, __VA_ARGS__); \
+               }                           \
+       }                               \
+       while (0)
+
+#define EVENT_LOG_IS_ON(tag) (*(event_log_tag_sets + (tag)) & ~EVENT_LOG_TAG_FLAG_SET_MASK)
+#define EVENT_LOG_IS_LOG_ON(tag) (*(event_log_tag_sets + (tag)) & EVENT_LOG_TAG_FLAG_LOG)
+
+#define EVENT_LOG_BUFFER(tag, buf, size)       event_log_buffer(tag, buf, size)
+#define EVENT_DUMP     event_log_buffer
+
+/* EVENT_LOG_PRSRV_FLUSH() will be deprecated. Use EVENT_LOG_FORCE_FLUSH_ALL instead */
+#define EVENT_LOG_PRSRV_FLUSH()                event_log_force_flush_all()
+#define EVENT_LOG_FORCE_FLUSH_ALL()    event_log_force_flush_all()
+
+#ifdef PRESERVE_LOG
+#define EVENT_LOG_FORCE_FLUSH_PRSRV_LOG_ALL()  event_log_force_flush_preserve_all()
+#else
+#define EVENT_LOG_FORCE_FLUSH_PRSRV_LOG_ALL()
+#endif /* PRESERVE_LOG */
+
+extern uint8 *event_log_tag_sets;
+
+extern int event_log_init(osl_t *osh);
+extern int event_log_set_init(osl_t *osh, int set_num, int size);
+extern int event_log_set_expand(osl_t *osh, int set_num, int size);
+extern int event_log_set_shrink(osl_t *osh, int set_num, int size);
+
+extern int event_log_tag_start(int tag, int set_num, int flags);
+extern int event_log_tag_set_retrieve(int tag);
+extern int event_log_tag_flags_retrieve(int tag);
+extern int event_log_tag_stop(int tag);
+
+typedef void (*event_log_logtrace_trigger_fn_t)(void *ctx);
+void event_log_set_logtrace_trigger_fn(event_log_logtrace_trigger_fn_t fn, void *ctx);
+
+event_log_top_t *event_log_get_top(void);
+
+extern int event_log_get(int set_num, int buflen, void *buf);
+
+extern uint8 *event_log_next_logtrace(int set_num);
+extern uint32 event_log_logtrace_max_buf_count(int set_num);
+extern int event_log_set_type(int set_num, uint8 *type, int is_get);
+extern int event_log_flush_set(wl_el_set_flush_prsrv_t *flush, int is_set);
+
+extern void event_log0(int tag, int fmtNum);
+extern void event_log1(int tag, int fmtNum, uint32 t1);
+extern void event_log2(int tag, int fmtNum, uint32 t1, uint32 t2);
+extern void event_log3(int tag, int fmtNum, uint32 t1, uint32 t2, uint32 t3);
+extern void event_log4(int tag, int fmtNum, uint32 t1, uint32 t2, uint32 t3, uint32 t4);
+extern void event_logn(int num_args, int tag, int fmtNum, ...);
+#ifdef ROM_COMPAT_MSCH_PROFILER
+/* For compatibility with ROM, for old msch event log function to pass parameters in stack */
+extern void event_logv(int num_args, int tag, int fmtNum, va_list ap);
+#endif /* ROM_COMPAT_MSCH_PROFILER */
+
+extern void event_log_time_sync(uint32 ms);
+extern bool event_log_time_sync_required(void);
+extern void event_log_cpu_freq_changed(void);
+extern void event_log_buffer(int tag, const uint8 *buf, int size);
+extern void event_log_caller_return_address(int tag);
+extern int event_log_set_destination_set(int set, event_log_set_destination_t dest);
+extern event_log_set_destination_t event_log_set_destination_get(int set);
+extern int event_log_set_sub_destination_set(uint set, event_log_set_sub_destination_t dest);
+extern event_log_set_sub_destination_t event_log_set_sub_destination_get(uint set);
+extern int event_log_flush_log_buffer(int set);
+extern int event_log_force_flush_all(void);
+extern int event_log_force_flush(int set);
+
+extern uint16 event_log_get_available_space(int set);
+extern bool event_log_is_tag_valid(int tag);
+/* returns number of blocks available for writing */
+extern int event_log_free_blocks_get(int set);
+extern bool event_log_is_ready(void);
+extern bool event_log_is_preserve_active(uint set);
+extern uint event_log_get_percentage_available_space(uint set);
+extern bool event_log_set_watermark_reached(int set_num);
+
+extern void event_log_set_config(int set, uint32 period, uint16 watermark, uint32 config_flags);
+#ifdef EVENTLOG_D3_PRESERVE
+#define EVENT_LOG_PRESERVE_EXPAND_SIZE 5u
+extern int event_log_preserve_set_shrink(osl_t *osh, int set_num);
+extern void event_log_d3_preserve_active_set(osl_t* osh, int set, bool active);
+extern void event_log_d3_prsv_set_all(osl_t *osh, bool active);
+#endif /* EVENTLOG_D3_PRESERVE */
+
+#ifdef EVENTLOG_PRSV_PERIODIC
+#define EVENT_LOG_SET_SIZE_INVALID     0xFFFFFFFFu
+#define EVENT_LOG_DEFAULT_PERIOD       3000u
+extern void event_log_prsv_periodic_wd_trigger(osl_t *osh);
+#endif /* EVENTLOG_PRSV_PERIODIC */
+
+/* Enable/disable rate health check for a set */
+#ifdef EVENT_LOG_RATE_HC
+extern int event_log_enable_hc_for_set(int set_num, bool enable);
+extern void event_log_set_hc_rate(uint16 num_prints);
+extern uint16 event_log_get_hc_rate(void);
+#endif /* EVENT_LOG_RATE_HC */
+
+/* Configure a set with ability to send partial log blocks */
+extern int event_log_send_partial_block_set(int set_num);
+
+/* Get number of log blocks associated to a log set */
+extern int event_log_num_blocks_get(int set, uint32 *num_blocks);
+
+/* Get a log buffer of a desired set */
+extern int event_log_block_get(int set, uint32 **buf, uint16 *len);
+extern uint32 event_log_get_maxsets(void);
+
+/* For all other non-logtrace consumers */
+extern int event_log_set_is_valid(int set);
+
+/* To be used by logtrace only */
+extern int event_log_get_num_sets(void);
+
+/* Given a buffer, return to which set it belongs to */
+extern int event_log_get_set_for_buffer(const void *buf);
+
+extern int event_log_flush_multiple_sets(const int *sets, uint16 num_sets);
+extern int event_log_force_flush_preserve_all(void);
+extern int event_log_get_iovar_handler(int set);
+#endif /* EVENT_LOG_COMPILE */
+
+#endif
+
+#endif /* BCMDRIVER */
+
+#endif /* __ASSEMBLER__ */
+
+#endif /* _EVENT_LOG_H_ */
diff --git a/bcmdhd.101.10.240.x/include/event_log_payload.h b/bcmdhd.101.10.240.x/include/event_log_payload.h
new file mode 100644 (file)
index 0000000..3f7a018
--- /dev/null
@@ -0,0 +1,1439 @@
+/*
+ * EVENT_LOG System Definitions
+ *
+ * This file describes the payloads of event log entries that are data buffers
+ * rather than formatted string entries. The contents are generally XTLVs.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _EVENT_LOG_PAYLOAD_H_
+#define _EVENT_LOG_PAYLOAD_H_
+
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <ethernet.h>
+#include <event_log_tag.h>
+
+/**
+ * A (legacy) timestamp message
+ */
+typedef struct ts_message {
+       uint32 timestamp;
+       uint32 cyclecount;
+} ts_msg_t;
+
+/**
+ * Enhanced timestamp message
+ */
+typedef struct enhanced_ts_message {
+       uint32 version;
+       /* More data, depending on version */
+       uint8 data[];
+} ets_msg_t;
+
+#define ENHANCED_TS_MSG_VERSION_1 (1u)
+
+/**
+ * Enhanced timestamp message, version 1
+ */
+typedef struct enhanced_ts_message_v1 {
+       uint32 version;
+       uint32 timestamp; /* PMU time, in milliseconds */
+       uint32 cyclecount;
+       uint32 cpu_freq;
+} ets_msg_v1_t;
+
+#define EVENT_LOG_XTLV_ID_STR                   0  /**< XTLV ID for a string */
+#define EVENT_LOG_XTLV_ID_TXQ_SUM               1  /**< XTLV ID for txq_summary_t */
+#define EVENT_LOG_XTLV_ID_SCBDATA_SUM           2  /**< XTLV ID for cb_subq_summary_t */
+#define EVENT_LOG_XTLV_ID_SCBDATA_AMPDU_TX_SUM  3  /**< XTLV ID for scb_ampdu_tx_summary_t */
+#define EVENT_LOG_XTLV_ID_BSSCFGDATA_SUM        4  /**< XTLV ID for bsscfg_q_summary_t */
+#define EVENT_LOG_XTLV_ID_UCTXSTATUS            5  /**< XTLV ID for ucode TxStatus array */
+#define EVENT_LOG_XTLV_ID_TXQ_SUM_V2            6  /**< XTLV ID for txq_summary_v2_t */
+#define EVENT_LOG_XTLV_ID_BUF                   7  /**< XTLV ID for event_log_buffer_t */
+
+/**
+ * An XTLV holding a string
+ * String is not null terminated, length is the XTLV len.
+ */
+typedef struct xtlv_string {
+       uint16 id;              /* XTLV ID: EVENT_LOG_XTLV_ID_STR */
+       uint16 len;             /* XTLV Len (String length) */
+       char   str[1];          /* var len array characters */
+} xtlv_string_t;
+
+#define XTLV_STRING_FULL_LEN(str_len)     (BCM_XTLV_HDR_SIZE + (str_len) * sizeof(char))
+
+/**
+ * Summary for a single TxQ context
+ * Two of these will be used per TxQ context---one for the high TxQ, and one for
+ * the low txq that contains DMA prepared pkts. The high TxQ is a full multi-precidence
+ * queue and also has a BSSCFG map to identify the BSSCFGS associated with the queue context.
+ * The low txq counterpart does not populate the BSSCFG map.
+ * The excursion queue will have no bsscfgs associated and is the first queue dumped.
+ */
+typedef struct txq_summary {
+       uint16 id;              /* XTLV ID: EVENT_LOG_XTLV_ID_TXQ_SUM */
+       uint16 len;             /* XTLV Len */
+       uint32 bsscfg_map;      /* bitmap of bsscfg indexes associated with this queue */
+       uint32 stopped;         /* flow control bitmap */
+       uint8  prec_count;      /* count of precedences/fifos and len of following array */
+       uint8  pad;
+       uint16 plen[1];         /* var len array of lengths of each prec/fifo in the queue */
+} txq_summary_t;
+
+#define TXQ_SUMMARY_LEN                   (OFFSETOF(txq_summary_t, plen))
+#define TXQ_SUMMARY_FULL_LEN(num_q)       (TXQ_SUMMARY_LEN + (num_q) * sizeof(uint16))
+
+typedef struct txq_summary_v2 {
+       uint16 id;              /* XTLV ID: EVENT_LOG_XTLV_ID_TXQ_SUM_V2 */
+       uint16 len;             /* XTLV Len */
+       uint32 bsscfg_map;      /* bitmap of bsscfg indexes associated with this queue */
+       uint32 stopped;         /* flow control bitmap */
+       uint32 hw_stopped;      /* flow control bitmap */
+       uint8  prec_count;      /* count of precedences/fifos and len of following array */
+       uint8  pad;
+       uint16 plen[1];         /* var len array of lengths of each prec/fifo in the queue */
+} txq_summary_v2_t;
+
+#define TXQ_SUMMARY_V2_LEN                (OFFSETOF(txq_summary_v2_t, plen))
+#define TXQ_SUMMARY_V2_FULL_LEN(num_q)    (TXQ_SUMMARY_V2_LEN + (num_q) * sizeof(uint16))
+
+/**
+ * Summary for tx datapath of an SCB cubby
+ * This is a generic summary structure (one size fits all) with
+ * a cubby ID and sub-ID to differentiate SCB cubby types and possible sub-queues.
+ */
+typedef struct scb_subq_summary {
+       uint16 id;             /* XTLV ID: EVENT_LOG_XTLV_ID_SCBDATA_SUM */
+       uint16 len;            /* XTLV Len */
+       uint32 flags;          /* cubby specficic flags */
+       uint8  cubby_id;       /* ID registered for cubby */
+       uint8  sub_id;         /* sub ID if a cubby has more than one queue */
+       uint8  prec_count;     /* count of precedences/fifos and len of following array */
+       uint8  pad;
+       uint16 plen[1];        /* var len array of lengths of each prec/fifo in the queue */
+} scb_subq_summary_t;
+
+#define SCB_SUBQ_SUMMARY_LEN              (OFFSETOF(scb_subq_summary_t, plen))
+#define SCB_SUBQ_SUMMARY_FULL_LEN(num_q)  (SCB_SUBQ_SUMMARY_LEN + (num_q) * sizeof(uint16))
+
+/* scb_subq_summary_t.flags for APPS */
+#define SCBDATA_APPS_F_PS               0x00000001
+#define SCBDATA_APPS_F_PSPEND           0x00000002
+#define SCBDATA_APPS_F_INPVB            0x00000004
+#define SCBDATA_APPS_F_APSD_USP         0x00000008
+#define SCBDATA_APPS_F_TXBLOCK          0x00000010
+#define SCBDATA_APPS_F_APSD_HPKT_TMR    0x00000020
+#define SCBDATA_APPS_F_APSD_TX_PEND     0x00000040
+#define SCBDATA_APPS_F_INTRANS          0x00000080
+#define SCBDATA_APPS_F_OFF_PEND         0x00000100
+#define SCBDATA_APPS_F_OFF_BLOCKED      0x00000200
+#define SCBDATA_APPS_F_OFF_IN_PROG      0x00000400
+
+/**
+ * Summary for tx datapath AMPDU SCB cubby
+ * This is a specific data structure to describe the AMPDU datapath state for an SCB
+ * used instead of scb_subq_summary_t.
+ * Info is for one TID, so one will be dumped per BA TID active for an SCB.
+ */
+typedef struct scb_ampdu_tx_summary {
+       uint16 id;              /* XTLV ID: EVENT_LOG_XTLV_ID_SCBDATA_AMPDU_TX_SUM */
+       uint16 len;             /* XTLV Len */
+       uint32 flags;           /* misc flags */
+       uint8  tid;             /* initiator TID (priority) */
+       uint8  ba_state;        /* internal BA state */
+       uint8  bar_cnt;         /* number of bars sent with no progress */
+       uint8  retry_bar;       /* reason code if bar to be retried at watchdog */
+       uint16 barpending_seq;  /* seqnum for bar */
+       uint16 bar_ackpending_seq; /* seqnum of bar for which ack is pending */
+       uint16 start_seq;       /* seqnum of the first unacknowledged packet */
+       uint16 max_seq;         /* max unacknowledged seqnum sent */
+       uint32 released_bytes_inflight; /* Number of bytes pending in bytes */
+       uint32 released_bytes_target;
+} scb_ampdu_tx_summary_t;
+
+/* scb_ampdu_tx_summary.flags defs */
+#define SCBDATA_AMPDU_TX_F_BAR_ACKPEND          0x00000001 /* bar_ackpending */
+
+/** XTLV stuct to summarize a BSSCFG's packet queue */
+typedef struct bsscfg_q_summary {
+       uint16 id;               /* XTLV ID: EVENT_LOG_XTLV_ID_BSSCFGDATA_SUM */
+       uint16 len;              /* XTLV Len */
+       struct ether_addr BSSID; /* BSSID */
+       uint8  bsscfg_idx;       /* bsscfg index */
+       uint8  type;             /* bsscfg type enumeration: BSSCFG_TYPE_XXX */
+       uint8  subtype;          /* bsscfg subtype enumeration: BSSCFG_SUBTYPE_XXX */
+       uint8  prec_count;       /* count of precedences/fifos and len of following array */
+       uint16 plen[1];          /* var len array of lengths of each prec/fifo in the queue */
+} bsscfg_q_summary_t;
+
+#define BSSCFG_Q_SUMMARY_LEN              (OFFSETOF(bsscfg_q_summary_t, plen))
+#define BSSCFG_Q_SUMMARY_FULL_LEN(num_q)  (BSSCFG_Q_SUMMARY_LEN + (num_q) * sizeof(uint16))
+
+/**
+ * An XTLV holding a TxStats array
+ * TxStatus entries are 8 or 16 bytes, size in words (2 or 4) givent in
+ * entry_size field.
+ * Array is uint32 words
+ */
+typedef struct xtlv_uc_txs {
+       uint16 id;              /* XTLV ID: EVENT_LOG_XTLV_ID_UCTXSTATUS */
+       uint16 len;             /* XTLV Len */
+       uint8  entry_size;      /* num uint32 words per entry */
+       uint8  pad[3];          /* reserved, zero */
+       uint32 w[1];            /* var len array of words */
+} xtlv_uc_txs_t;
+
+#define XTLV_UCTXSTATUS_LEN                (OFFSETOF(xtlv_uc_txs_t, w))
+#define XTLV_UCTXSTATUS_FULL_LEN(words)    (XTLV_UCTXSTATUS_LEN + (words) * sizeof(uint32))
+
+#define SCAN_SUMMARY_VERSION_1 1u
+#ifndef WLSCAN_SUMMARY_VERSION_ALIAS
+#define SCAN_SUMMARY_VERSION   SCAN_SUMMARY_VERSION_1
+#endif
+/* Scan flags */
+#define SCAN_SUM_CHAN_INFO     0x1
+/* Scan_sum flags */
+#define BAND5G_SIB_ENAB                0x2
+#define BAND2G_SIB_ENAB                0x4
+#define PARALLEL_SCAN          0x8
+#define SCAN_ABORT             0x10
+/* Note: Definitions  being reused in chan_info as SCAN_SUM_SCAN_CORE need clean up */
+#define SC_LOWSPAN_SCAN                0x20
+/* Note: Definitions  being reused in scan summary info as WL_SSUM_CLIENT_MASK need clean up */
+#define SC_SCAN                        0x40
+
+#define WL_SSUM_CLIENT_MASK    0x1C0u  /* bit 8 - 6 */
+#define WL_SSUM_CLIENT_SHIFT   6u      /* shift client scan opereration */
+
+#define WL_SSUM_MODE_MASK      0xE00u  /* bit 11 - 9 */
+#define WL_SSUM_MODE_SHIFT     9u      /* shift mode scan operation */
+
+/* Common bits for channel and scan summary info */
+#define SCAN_SUM_CHAN_RESHED   0x1000 /* Bit 12 as resched scan for chaninfo and scan summary */
+
+#define WL_SSUM_CLIENT_ASSOCSCAN       0x0u    /* Log as scan requested client is assoc scan */
+#define WL_SSUM_CLIENT_ROAMSCAN                0x1u    /* Log as scan requested client is roam scan */
+#define WL_SSUM_CLIENT_FWSCAN          0x2u    /* Log as scan requested client is other fw scan */
+#define WL_SSUM_CLIENT_HOSTSCAN                0x3u    /* Log as scan requested client is host scan */
+
+#define WL_SSUM_SCANFLAG_INVALID       0x7u    /* Log for invalid scan client or mode */
+
+/* scan_channel_info flags */
+#define ACTIVE_SCAN_SCN_SUM    0x2
+#define SCAN_SUM_WLC_CORE0     0x4
+#define SCAN_SUM_WLC_CORE1     0x8
+#define HOME_CHAN              0x10
+#define SCAN_SUM_SCAN_CORE     0x20
+
+typedef struct wl_scan_ssid_info
+{
+       uint8           ssid_len;       /* the length of SSID */
+       uint8           ssid[32];       /* SSID string */
+} wl_scan_ssid_info_t;
+
+typedef struct wl_scan_channel_info {
+       uint16 chanspec;        /* chanspec scanned */
+       uint16 reserv;
+       uint32 start_time;              /* Scan start time in
+                               * milliseconds for the chanspec
+                               * or home_dwell time start
+                               */
+       uint32 end_time;                /* Scan end time in
+                               * milliseconds for the chanspec
+                               * or home_dwell time end
+                               */
+       uint16 probe_count;     /* No of probes sent out. For future use
+                               */
+       uint16 scn_res_count;   /* Count of scan_results found per
+                               * channel. For future use
+                               */
+} wl_scan_channel_info_t;
+
+typedef struct wl_scan_summary_info {
+       uint32 total_chan_num;  /* Total number of channels scanned */
+       uint32 scan_start_time; /* Scan start time in milliseconds */
+       uint32 scan_end_time;   /* Scan end time in milliseconds */
+       wl_scan_ssid_info_t ssid[1];    /* SSID being scanned in current
+                               * channel. For future use
+                               */
+} wl_scan_summary_info_t;
+
+struct wl_scan_summary {
+       uint8 version;          /* Version */
+       uint8 reserved;
+       uint16 len;             /* Length of the data buffer including SSID
+                                * list.
+                                */
+       uint16 sync_id;         /* Scan Sync ID */
+       uint16 scan_flags;              /* flags [0] or SCAN_SUM_CHAN_INFO = */
+                               /* channel_info, if not set */
+                               /* it is scan_summary_info */
+                               /* when channel_info is used, */
+                               /* the following flag bits are overridden: */
+                               /* flags[1] or ACTIVE_SCAN_SCN_SUM = active channel if set */
+                               /* passive if not set */
+                               /* flags[2] or WLC_CORE0 = if set, represents wlc_core0 */
+                               /* flags[3] or WLC_CORE1 = if set, represents wlc_core1 */
+                               /* flags[4] or HOME_CHAN = if set, represents home-channel */
+                               /* flags[5] or SCAN_SUM_SCAN_CORE = if set,
+                                * represents chan_info from scan core.
+                                */
+                               /* flags[12] SCAN_SUM_CHAN_RESHED indicate scan rescheduled */
+                               /* flags[6:11, 13:15] = reserved */
+                               /* when scan_summary_info is used, */
+                               /* the following flag bits are used: */
+                               /* flags[1] or BAND5G_SIB_ENAB = */
+                               /* allowSIBParallelPassiveScan on 5G band */
+                               /* flags[2] or BAND2G_SIB_ENAB = */
+                               /* allowSIBParallelPassiveScan on 2G band */
+                               /* flags[3] or PARALLEL_SCAN = Parallel scan enabled or not */
+                               /* flags[4] or SCAN_ABORT = SCAN_ABORTED scenario */
+                               /* flags[5] = reserved */
+                               /* flags[6:8] is used as count value to identify SCAN CLIENT
+                                * WL_SSUM_CLIENT_ASSOCSCAN 0x0u, WL_SSUM_CLIENT_ROAMSCAN 0x1u,
+                                * WL_SSUM_CLIENT_FWSCAN        0x2u, WL_SSUM_CLIENT_HOSTSCAN 0x3u
+                                */
+                               /* flags[9:11] is used as count value to identify SCAN MODE
+                                * WL_SCAN_MODE_HIGH_ACC 0u, WL_SCAN_MODE_LOW_SPAN 1u,
+                                * WL_SCAN_MODE_LOW_POWER 2u
+                                */
+                               /* flags[12] SCAN_SUM_CHAN_RESHED indicate scan rescheduled */
+                               /* flags[13:15] = reserved */
+       union {
+               wl_scan_channel_info_t scan_chan_info;  /* scan related information
+                                                       * for each channel scanned
+                                                       */
+               wl_scan_summary_info_t scan_sum_info;   /* Cumulative scan related
+                                                       * information.
+                                                       */
+       } u;
+};
+
+#define SCAN_SUMMARY_VERSION_2 2u
+struct wl_scan_summary_v2 {
+       uint8 version;          /* Version */
+       uint8 reserved;
+       uint16 len;             /* Length of the data buffer including SSID
+                                * list.
+                                */
+       uint16 sync_id;         /* Scan Sync ID */
+       uint16 scan_flags;              /* flags [0] or SCAN_SUM_CHAN_INFO = */
+                               /* channel_info, if not set */
+                               /* it is scan_summary_info */
+                               /* when channel_info is used, */
+                               /* the following flag bits are overridden: */
+                               /* flags[1] or ACTIVE_SCAN_SCN_SUM = active channel if set */
+                               /* passive if not set */
+                               /* flags[2] or WLC_CORE0 = if set, represents wlc_core0 */
+                               /* flags[3] or WLC_CORE1 = if set, represents wlc_core1 */
+                               /* flags[4] or HOME_CHAN = if set, represents home-channel */
+                               /* flags[5] or SCAN_SUM_SCAN_CORE = if set,
+                                * represents chan_info from scan core.
+                                */
+                               /* flags[12] SCAN_SUM_CHAN_RESHED indicate scan rescheduled */
+                               /* flags[6:11, 13:15] = reserved */
+                               /* when scan_summary_info is used, */
+                               /* the following flag bits are used: */
+                               /* flags[1] or BAND5G_SIB_ENAB = */
+                               /* allowSIBParallelPassiveScan on 5G band */
+                               /* flags[2] or BAND2G_SIB_ENAB = */
+                               /* allowSIBParallelPassiveScan on 2G band */
+                               /* flags[3] or PARALLEL_SCAN = Parallel scan enabled or not */
+                               /* flags[4] or SCAN_ABORT = SCAN_ABORTED scenario */
+                               /* flags[5] = reserved */
+                               /* flags[6:8] is used as count value to identify SCAN CLIENT
+                                * WL_SSUM_CLIENT_ASSOCSCAN 0x0u, WL_SSUM_CLIENT_ROAMSCAN 0x1u,
+                                * WL_SSUM_CLIENT_FWSCAN        0x2u, WL_SSUM_CLIENT_HOSTSCAN 0x3u
+                                */
+                               /* flags[9:11] is used as count value to identify SCAN MODE
+                                * WL_SCAN_MODE_HIGH_ACC 0u, WL_SCAN_MODE_LOW_SPAN 1u,
+                                * WL_SCAN_MODE_LOW_POWER 2u
+                                */
+                               /* flags[12] SCAN_SUM_CHAN_RESHED indicate scan rescheduled */
+                               /* flags[13:15] = reserved */
+       /* scan_channel_ctx_t chan_cnt; */
+       uint8 channel_cnt_aux;                  /* Number of channels to be scanned on Aux core */
+       uint8 channel_cnt_main;                 /* Number of channels to be scanned on Main core */
+       uint8 channel_cnt_sc;                   /* Number of channels to be scanned on Scan core */
+       uint8 active_channel_cnt;
+       uint8 passive_channel_cnt;
+       char pad[3];                            /* Pad to keep it 32 bit aligned */
+       union {
+               wl_scan_channel_info_t scan_chan_info;  /* scan related information
+                                                       * for each channel scanned
+                                                       */
+               wl_scan_summary_info_t scan_sum_info;   /* Cumulative scan related
+                                                       * information.
+                                                       */
+       } u;
+};
+/* Channel switch log record structure
+ * Host may map the following structure on channel switch event log record
+ * received from dongle. Note that all payload entries in event log record are
+ * uint32/int32.
+ */
+typedef struct wl_chansw_event_log_record {
+       uint32 time;                    /* Time in us */
+       uint32 old_chanspec;            /* Old channel spec */
+       uint32 new_chanspec;            /* New channel spec */
+       uint32 chansw_reason;           /* Reason for channel change */
+       int32 dwell_time;
+} wl_chansw_event_log_record_t;
+
+typedef struct wl_chansw_event_log_record_v2 {
+       uint32 time;                    /* Time in us */
+       uint32 old_chanspec;            /* Old channel spec */
+       uint32 new_chanspec;            /* New channel spec */
+       uint32 chansw_reason;           /* Reason for channel change */
+       int32 dwell_time;
+       uint32 core;
+       int32 phychanswtime;            /* channel switch time */
+} wl_chansw_event_log_record_v2_t;
+
+/* Sub-block type for EVENT_LOG_TAG_AMPDU_DUMP */
+typedef enum {
+       WL_AMPDU_STATS_TYPE_RXMCSx1             = 0,    /* RX MCS rate (Nss = 1) */
+       WL_AMPDU_STATS_TYPE_RXMCSx2             = 1,
+       WL_AMPDU_STATS_TYPE_RXMCSx3             = 2,
+       WL_AMPDU_STATS_TYPE_RXMCSx4             = 3,
+       WL_AMPDU_STATS_TYPE_RXVHTx1             = 4,    /* RX VHT rate (Nss = 1) */
+       WL_AMPDU_STATS_TYPE_RXVHTx2             = 5,
+       WL_AMPDU_STATS_TYPE_RXVHTx3             = 6,
+       WL_AMPDU_STATS_TYPE_RXVHTx4             = 7,
+       WL_AMPDU_STATS_TYPE_TXMCSx1             = 8,    /* TX MCS rate (Nss = 1) */
+       WL_AMPDU_STATS_TYPE_TXMCSx2             = 9,
+       WL_AMPDU_STATS_TYPE_TXMCSx3             = 10,
+       WL_AMPDU_STATS_TYPE_TXMCSx4             = 11,
+       WL_AMPDU_STATS_TYPE_TXVHTx1             = 12,   /* TX VHT rate (Nss = 1) */
+       WL_AMPDU_STATS_TYPE_TXVHTx2             = 13,
+       WL_AMPDU_STATS_TYPE_TXVHTx3             = 14,
+       WL_AMPDU_STATS_TYPE_TXVHTx4             = 15,
+       WL_AMPDU_STATS_TYPE_RXMCSSGI            = 16,   /* RX SGI usage (for all MCS rates) */
+       WL_AMPDU_STATS_TYPE_TXMCSSGI            = 17,   /* TX SGI usage (for all MCS rates) */
+       WL_AMPDU_STATS_TYPE_RXVHTSGI            = 18,   /* RX SGI usage (for all VHT rates) */
+       WL_AMPDU_STATS_TYPE_TXVHTSGI            = 19,   /* TX SGI usage (for all VHT rates) */
+       WL_AMPDU_STATS_TYPE_RXMCSPER            = 20,   /* RX PER (for all MCS rates) */
+       WL_AMPDU_STATS_TYPE_TXMCSPER            = 21,   /* TX PER (for all MCS rates) */
+       WL_AMPDU_STATS_TYPE_RXVHTPER            = 22,   /* RX PER (for all VHT rates) */
+       WL_AMPDU_STATS_TYPE_TXVHTPER            = 23,   /* TX PER (for all VHT rates) */
+       WL_AMPDU_STATS_TYPE_RXDENS              = 24,   /* RX AMPDU density */
+       WL_AMPDU_STATS_TYPE_TXDENS              = 25,   /* TX AMPDU density */
+       WL_AMPDU_STATS_TYPE_RXMCSOK             = 26,   /* RX all MCS rates */
+       WL_AMPDU_STATS_TYPE_RXVHTOK             = 27,   /* RX all VHT rates */
+       WL_AMPDU_STATS_TYPE_TXMCSALL            = 28,   /* TX all MCS rates */
+       WL_AMPDU_STATS_TYPE_TXVHTALL            = 29,   /* TX all VHT rates */
+       WL_AMPDU_STATS_TYPE_TXMCSOK             = 30,   /* TX all MCS rates */
+       WL_AMPDU_STATS_TYPE_TXVHTOK             = 31,   /* TX all VHT rates */
+       WL_AMPDU_STATS_TYPE_RX_HE_SUOK          = 32,   /* DL SU MPDU frame per MCS */
+       WL_AMPDU_STATS_TYPE_RX_HE_SU_DENS       = 33,   /* DL SU AMPDU DENSITY */
+       WL_AMPDU_STATS_TYPE_RX_HE_MUMIMOOK      = 34,   /* DL MUMIMO Frame per MCS */
+       WL_AMPDU_STATS_TYPE_RX_HE_MUMIMO_DENS   = 35,   /* DL MUMIMO AMPDU Density */
+       WL_AMPDU_STATS_TYPE_RX_HE_DLOFDMAOK     = 36,   /* DL OFDMA Frame per MCS */
+       WL_AMPDU_STATS_TYPE_RX_HE_DLOFDMA_DENS  = 37,   /* DL OFDMA AMPDU Density */
+       WL_AMPDU_STATS_TYPE_RX_HE_DLOFDMA_HIST  = 38,   /* DL OFDMA frame RU histogram */
+       WL_AMPDU_STATS_TYPE_TX_HE_MCSALL        = 39,   /* TX HE (SU+MU) frames, all rates */
+       WL_AMPDU_STATS_TYPE_TX_HE_MCSOK         = 40,   /* TX HE (SU+MU) frames succeeded */
+       WL_AMPDU_STATS_TYPE_TX_HE_MUALL         = 41,   /* TX MU (UL OFDMA) frames all rates */
+       WL_AMPDU_STATS_TYPE_TX_HE_MUOK          = 42,   /* TX MU (UL OFDMA) frames succeeded */
+       WL_AMPDU_STATS_TYPE_TX_HE_RUBW          = 43,   /* TX UL RU by BW histogram */
+       WL_AMPDU_STATS_TYPE_TX_HE_PADDING       = 44,   /* TX padding total (single value) */
+       WL_AMPDU_STATS_MAX_CNTS                 = 64
+} wl_ampdu_stat_enum_t;
+typedef struct {
+       uint16  type;           /* AMPDU statistics sub-type */
+       uint16  len;            /* Number of 32-bit counters */
+       uint32  counters[WL_AMPDU_STATS_MAX_CNTS];
+} wl_ampdu_stats_generic_t;
+
+typedef wl_ampdu_stats_generic_t wl_ampdu_stats_rx_t;
+typedef wl_ampdu_stats_generic_t wl_ampdu_stats_tx_t;
+
+typedef struct {
+       uint16  type;           /* AMPDU statistics sub-type */
+       uint16  len;            /* Number of 32-bit counters + 2 */
+       uint32  total_ampdu;
+       uint32  total_mpdu;
+       uint32  aggr_dist[WL_AMPDU_STATS_MAX_CNTS + 1];
+} wl_ampdu_stats_aggrsz_t;
+
+/* Sub-block type for WL_IFSTATS_XTLV_HE_TXMU_STATS */
+typedef enum {
+       /* Reserve 0 to avoid potential concerns */
+       WL_HE_TXMU_STATS_TYPE_TIME              = 1,    /* per-dBm, total usecs transmitted */
+       WL_HE_TXMU_STATS_TYPE_PAD_TIME          = 2,    /* per-dBm, padding usecs transmitted */
+} wl_he_txmu_stat_enum_t;
+#define WL_IFSTATS_HE_TXMU_MAX 32u
+
+/* Sub-block type for EVENT_LOG_TAG_MSCHPROFILE */
+#define WL_MSCH_PROFILER_START         0       /* start event check */
+#define WL_MSCH_PROFILER_EXIT          1       /* exit event check */
+#define WL_MSCH_PROFILER_REQ           2       /* request event */
+#define WL_MSCH_PROFILER_CALLBACK      3       /* call back event */
+#define WL_MSCH_PROFILER_MESSAGE       4       /* message event */
+#define WL_MSCH_PROFILER_PROFILE_START 5
+#define WL_MSCH_PROFILER_PROFILE_END   6
+#define WL_MSCH_PROFILER_REQ_HANDLE    7
+#define WL_MSCH_PROFILER_REQ_ENTITY    8
+#define WL_MSCH_PROFILER_CHAN_CTXT     9
+#define WL_MSCH_PROFILER_EVENT_LOG     10
+#define WL_MSCH_PROFILER_REQ_TIMING    11
+#define WL_MSCH_PROFILER_TYPE_MASK     0x00ff
+#define WL_MSCH_PROFILER_WLINDEX_SHIFT 8
+#define WL_MSCH_PROFILER_WLINDEX_MASK  0x0f00
+#define WL_MSCH_PROFILER_VER_SHIFT     12
+#define WL_MSCH_PROFILER_VER_MASK      0xf000
+
+/* MSCH Event data current verion */
+#define WL_MSCH_PROFILER_VER           2
+
+/* msch version history */
+#define WL_MSCH_PROFILER_RSDB_VER      1
+#define WL_MSCH_PROFILER_REPORT_VER    2
+
+/* msch collect header size */
+#define WL_MSCH_PROFILE_HEAD_SIZE      OFFSETOF(msch_collect_tlv_t, value)
+
+/* msch event log header size */
+#define WL_MSCH_EVENT_LOG_HEAD_SIZE    OFFSETOF(msch_event_log_profiler_event_data_t, data)
+
+/* MSCH data buffer size */
+#define WL_MSCH_PROFILER_BUFFER_SIZE   512
+
+/* request type used in wlc_msch_req_param_t struct */
+#define WL_MSCH_RT_BOTH_FIXED  0       /* both start and end time is fixed */
+#define WL_MSCH_RT_START_FLEX  1       /* start time is flexible and duration is fixed */
+#define WL_MSCH_RT_DUR_FLEX    2       /* start time is fixed and end time is flexible */
+#define WL_MSCH_RT_BOTH_FLEX   3       /* Both start and duration is flexible */
+
+/* Flags used in wlc_msch_req_param_t struct */
+#define WL_MSCH_REQ_FLAGS_CHAN_CONTIGUOUS  (1 << 0) /* Don't break up channels in chanspec_list */
+#define WL_MSCH_REQ_FLAGS_MERGE_CONT_SLOTS (1 << 1)  /* No slot end if slots are continous */
+#define WL_MSCH_REQ_FLAGS_PREMTABLE        (1 << 2) /* Req can be pre-empted by PREMT_CURTS req */
+#define WL_MSCH_REQ_FLAGS_PREMT_CURTS      (1 << 3) /* Pre-empt request at the end of curts */
+#define WL_MSCH_REQ_FLAGS_PREMT_IMMEDIATE  (1 << 4) /* Pre-empt cur_ts immediately */
+
+/* Requested slot Callback states
+ * req->pend_slot/cur_slot->flags
+ */
+#define WL_MSCH_RC_FLAGS_ONCHAN_FIRE           (1 << 0)
+#define WL_MSCH_RC_FLAGS_START_FIRE_DONE       (1 << 1)
+#define WL_MSCH_RC_FLAGS_END_FIRE_DONE         (1 << 2)
+#define WL_MSCH_RC_FLAGS_ONFIRE_DONE           (1 << 3)
+#define WL_MSCH_RC_FLAGS_SPLIT_SLOT_START      (1 << 4)
+#define WL_MSCH_RC_FLAGS_SPLIT_SLOT_END                (1 << 5)
+#define WL_MSCH_RC_FLAGS_PRE_ONFIRE_DONE       (1 << 6)
+
+/* Request entity flags */
+#define WL_MSCH_ENTITY_FLAG_MULTI_INSTANCE     (1 << 0)
+
+/* Request Handle flags */
+#define WL_MSCH_REQ_HDL_FLAGS_NEW_REQ          (1 << 0) /* req_start callback */
+
+/* MSCH state flags (msch_info->flags) */
+#define        WL_MSCH_STATE_IN_TIEMR_CTXT             0x1
+#define WL_MSCH_STATE_SCHD_PENDING             0x2
+
+/* MSCH callback type */
+#define        WL_MSCH_CT_REQ_START            0x1
+#define        WL_MSCH_CT_ON_CHAN              0x2
+#define        WL_MSCH_CT_SLOT_START           0x4
+#define        WL_MSCH_CT_SLOT_END             0x8
+#define        WL_MSCH_CT_SLOT_SKIP            0x10
+#define        WL_MSCH_CT_OFF_CHAN             0x20
+#define WL_MSCH_CT_OFF_CHAN_DONE       0x40
+#define        WL_MSCH_CT_REQ_END              0x80
+#define        WL_MSCH_CT_PARTIAL              0x100
+#define        WL_MSCH_CT_PRE_ONCHAN           0x200
+#define        WL_MSCH_CT_PRE_REQ_START        0x400
+
+/* MSCH command bits */
+#define WL_MSCH_CMD_ENABLE_BIT         0x01
+#define WL_MSCH_CMD_PROFILE_BIT                0x02
+#define WL_MSCH_CMD_CALLBACK_BIT       0x04
+#define WL_MSCH_CMD_REGISTER_BIT       0x08
+#define WL_MSCH_CMD_ERROR_BIT          0x10
+#define WL_MSCH_CMD_DEBUG_BIT          0x20
+#define WL_MSCH_CMD_INFOM_BIT          0x40
+#define WL_MSCH_CMD_TRACE_BIT          0x80
+#define WL_MSCH_CMD_ALL_BITS           0xfe
+#define WL_MSCH_CMD_SIZE_MASK          0x00ff0000
+#define WL_MSCH_CMD_SIZE_SHIFT         16
+#define WL_MSCH_CMD_VER_MASK           0xff000000
+#define WL_MSCH_CMD_VER_SHIFT          24
+
+/* maximum channels returned by the get valid channels iovar */
+#define WL_MSCH_NUMCHANNELS            64
+
+typedef struct msch_collect_tlv {
+       uint16  type;
+       uint16  size;
+       char    value[1];
+} msch_collect_tlv_t;
+
+typedef struct msch_profiler_event_data {
+       uint32  time_lo;                /* Request time */
+       uint32  time_hi;
+} msch_profiler_event_data_t;
+
+typedef struct msch_start_profiler_event_data {
+       uint32  time_lo;                /* Request time */
+       uint32  time_hi;
+       uint32  status;
+} msch_start_profiler_event_data_t;
+
+typedef struct msch_message_profiler_event_data {
+       uint32  time_lo;                /* Request time */
+       uint32  time_hi;
+       char    message[1];             /* message */
+} msch_message_profiler_event_data_t;
+
+typedef struct msch_event_log_profiler_event_data {
+       uint32  time_lo;                /* Request time */
+       uint32  time_hi;
+       event_log_hdr_t hdr;            /* event log header */
+       uint32  data[9];                /* event data */
+} msch_event_log_profiler_event_data_t;
+
+typedef struct msch_req_param_profiler_event_data {
+       uint16  flags;                  /* Describe various request properties */
+       uint8   req_type;               /* Describe start and end time flexiblilty */
+       uint8   priority;               /* Define the request priority */
+       uint32  start_time_l;           /* Requested start time offset in us unit */
+       uint32  start_time_h;
+       uint32  duration;               /* Requested duration in us unit */
+       uint32  interval;               /* Requested periodic interval in us unit,
+                                        * 0 means non-periodic
+                                        */
+       union {
+               uint32  dur_flex;       /* MSCH_REG_DUR_FLEX, min_dur = duration - dur_flex */
+               struct {
+                       uint32 min_dur; /* min duration for traffic, maps to home_time */
+                       uint32 max_away_dur; /* max acceptable away dur, maps to home_away_time */
+                       uint32 hi_prio_time_l;
+                       uint32 hi_prio_time_h;
+                       uint32 hi_prio_interval; /* repeated high priority interval */
+               } bf;
+       } flex;
+} msch_req_param_profiler_event_data_t;
+
+typedef struct msch_req_timing_profiler_event_data {
+       uint32 p_req_timing;
+       uint32 p_prev;
+       uint32 p_next;
+       uint16 flags;
+       uint16 timeslot_ptr;
+       uint32 fire_time_l;
+       uint32 fire_time_h;
+       uint32 pre_start_time_l;
+       uint32 pre_start_time_h;
+       uint32 start_time_l;
+       uint32 start_time_h;
+       uint32 end_time_l;
+       uint32 end_time_h;
+       uint32 p_timeslot;
+} msch_req_timing_profiler_event_data_t;
+
+typedef struct msch_chan_ctxt_profiler_event_data {
+       uint32 p_chan_ctxt;
+       uint32 p_prev;
+       uint32 p_next;
+       uint16 chanspec;
+       uint16 bf_sch_pending;
+       uint32 bf_link_prev;
+       uint32 bf_link_next;
+       uint32 onchan_time_l;
+       uint32 onchan_time_h;
+       uint32 actual_onchan_dur_l;
+       uint32 actual_onchan_dur_h;
+       uint32 pend_onchan_dur_l;
+       uint32 pend_onchan_dur_h;
+       uint16 req_entity_list_cnt;
+       uint16 req_entity_list_ptr;
+       uint16 bf_entity_list_cnt;
+       uint16 bf_entity_list_ptr;
+       uint32 bf_skipped_count;
+} msch_chan_ctxt_profiler_event_data_t;
+
+typedef struct msch_req_entity_profiler_event_data {
+       uint32 p_req_entity;
+       uint32 req_hdl_link_prev;
+       uint32 req_hdl_link_next;
+       uint32 chan_ctxt_link_prev;
+       uint32 chan_ctxt_link_next;
+       uint32 rt_specific_link_prev;
+       uint32 rt_specific_link_next;
+       uint32 start_fixed_link_prev;
+       uint32 start_fixed_link_next;
+       uint32 both_flex_list_prev;
+       uint32 both_flex_list_next;
+       uint16 chanspec;
+       uint16 priority;
+       uint16 cur_slot_ptr;
+       uint16 pend_slot_ptr;
+       uint16 pad;
+       uint16 chan_ctxt_ptr;
+       uint32 p_chan_ctxt;
+       uint32 p_req_hdl;
+       uint32 bf_last_serv_time_l;
+       uint32 bf_last_serv_time_h;
+       uint16 onchan_chn_idx;
+       uint16 cur_chn_idx;
+       uint32 flags;
+       uint32 actual_start_time_l;
+       uint32 actual_start_time_h;
+       uint32 curts_fire_time_l;
+       uint32 curts_fire_time_h;
+} msch_req_entity_profiler_event_data_t;
+
+typedef struct msch_req_handle_profiler_event_data {
+       uint32 p_req_handle;
+       uint32 p_prev;
+       uint32 p_next;
+       uint32 cb_func;
+       uint32 cb_ctxt;
+       uint16 req_param_ptr;
+       uint16 req_entity_list_cnt;
+       uint16 req_entity_list_ptr;
+       uint16 chan_cnt;
+       uint32 flags;
+       uint16 chanspec_list;
+       uint16 chanspec_cnt;
+       uint16 chan_idx;
+       uint16 last_chan_idx;
+       uint32 req_time_l;
+       uint32 req_time_h;
+} msch_req_handle_profiler_event_data_t;
+
+typedef struct msch_profiler_profiler_event_data {
+       uint32 time_lo;                 /* Request time */
+       uint32 time_hi;
+       uint32 free_req_hdl_list;
+       uint32 free_req_entity_list;
+       uint32 free_chan_ctxt_list;
+       uint32 free_chanspec_list;
+       uint16 cur_msch_timeslot_ptr;
+       uint16 next_timeslot_ptr;
+       uint32 p_cur_msch_timeslot;
+       uint32 p_next_timeslot;
+       uint32 cur_armed_timeslot;
+       uint32 flags;
+       uint32 ts_id;
+       uint32 service_interval;
+       uint32 max_lo_prio_interval;
+       uint16 flex_list_cnt;
+       uint16 msch_chanspec_alloc_cnt;
+       uint16 msch_req_entity_alloc_cnt;
+       uint16 msch_req_hdl_alloc_cnt;
+       uint16 msch_chan_ctxt_alloc_cnt;
+       uint16 msch_timeslot_alloc_cnt;
+       uint16 msch_req_hdl_list_cnt;
+       uint16 msch_req_hdl_list_ptr;
+       uint16 msch_chan_ctxt_list_cnt;
+       uint16 msch_chan_ctxt_list_ptr;
+       uint16 msch_req_timing_list_cnt;
+       uint16 msch_req_timing_list_ptr;
+       uint16 msch_start_fixed_list_cnt;
+       uint16 msch_start_fixed_list_ptr;
+       uint16 msch_both_flex_req_entity_list_cnt;
+       uint16 msch_both_flex_req_entity_list_ptr;
+       uint16 msch_start_flex_list_cnt;
+       uint16 msch_start_flex_list_ptr;
+       uint16 msch_both_flex_list_cnt;
+       uint16 msch_both_flex_list_ptr;
+       uint32 slotskip_flag;
+} msch_profiler_profiler_event_data_t;
+
+typedef struct msch_req_profiler_event_data {
+       uint32 time_lo;                 /* Request time */
+       uint32 time_hi;
+       uint16 chanspec_cnt;
+       uint16 chanspec_ptr;
+       uint16 req_param_ptr;
+       uint16 pad;
+} msch_req_profiler_event_data_t;
+
+typedef struct msch_callback_profiler_event_data {
+       uint32 time_lo;                 /* Request time */
+       uint32 time_hi;
+       uint16 type;                    /* callback type */
+       uint16 chanspec;                /* actual chanspec, may different with requested one */
+       uint32 start_time_l;            /* time slot start time low 32bit */
+       uint32 start_time_h;            /* time slot start time high 32bit */
+       uint32 end_time_l;              /* time slot end time low 32 bit */
+       uint32 end_time_h;              /* time slot end time high 32 bit */
+       uint32 timeslot_id;             /* unique time slot id */
+       uint32 p_req_hdl;
+       uint32 onchan_idx;              /* Current channel index */
+       uint32 cur_chan_seq_start_time_l; /* start time of current sequence */
+       uint32 cur_chan_seq_start_time_h;
+} msch_callback_profiler_event_data_t;
+
+typedef struct msch_timeslot_profiler_event_data {
+       uint32 p_timeslot;
+       uint32 timeslot_id;
+       uint32 pre_start_time_l;
+       uint32 pre_start_time_h;
+       uint32 end_time_l;
+       uint32 end_time_h;
+       uint32 sch_dur_l;
+       uint32 sch_dur_h;
+       uint32 p_chan_ctxt;
+       uint32 fire_time_l;
+       uint32 fire_time_h;
+       uint32 state;
+} msch_timeslot_profiler_event_data_t;
+
+typedef struct msch_register_params    {
+       uint16 wlc_index;               /* Optional wlc index */
+       uint16 flags;                   /* Describe various request properties */
+       uint32 req_type;                /* Describe start and end time flexiblilty */
+       uint16 id;                      /* register id */
+       uint16 priority;                /* Define the request priority */
+       uint32 start_time;              /* Requested start time offset in ms unit */
+       uint32 duration;                /* Requested duration in ms unit */
+       uint32 interval;                /* Requested periodic interval in ms unit,
+                                        * 0 means non-periodic
+                                        */
+       uint32 dur_flex;                /* MSCH_REG_DUR_FLEX, min_dur = duration - dur_flex */
+       uint32 min_dur;                 /* min duration for traffic, maps to home_time */
+       uint32 max_away_dur;            /* max acceptable away dur, maps to home_away_time */
+       uint32 hi_prio_time;
+       uint32 hi_prio_interval;        /* repeated high priority interval */
+       uint32 chanspec_cnt;
+       uint16 chanspec_list[WL_MSCH_NUMCHANNELS];
+} msch_register_params_t;
+
+typedef struct {
+       uint32  txallfrm;       /**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+                               * Control Management (includes retransmissions)
+                               */
+       uint32  rxrsptmout;     /**< number of response timeouts for transmitted frames
+                               * expecting a response
+                               */
+       uint32  rxstrt;         /**< number of received frames with a good PLCP */
+       uint32  rxbadplcp;      /**< number of parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  rxnodelim;      /**< number of no valid delimiter detected by ampdu parser */
+       uint32  bphy_badplcp;   /**< number of bad PLCP reception on BPHY rate */
+       uint32  bphy_rxcrsglitch;       /**< PHY count of bphy glitches */
+       uint32  rxbadfcs;       /**< number of frames for which the CRC check failed in the MAC */
+       uint32  rxanyerr;       /**< Any RX error that is not counted by other counters. */
+       uint32  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint32  rxdtucastmbss;  /**< number of received DATA frames with good FCS and matching RA */
+       uint32  rxdtocast;      /**< number of received DATA frames (good FCS and no matching RA) */
+       uint32  rxtoolate;      /**< receive too late */
+       uint32  goodfcs;        /**< Good fcs counters  */
+       uint32  rxf0ovfl;       /** < Rx FIFO0 overflow counters information */
+       uint32  rxf1ovfl;       /** < Rx FIFO1 overflow counters information */
+} phy_periodic_counters_v1_t;
+
+typedef struct {
+
+       /* RX error related */
+       uint32  rxrsptmout;     /* number of response timeouts for transmitted frames
+                               * expecting a response
+                               */
+       uint32  rxbadplcp;      /* number of parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /* PHY was able to correlate the preamble but not the header */
+       uint32  rxnodelim;      /* number of no valid delimiter detected by ampdu parser */
+       uint32  bphy_badplcp;   /* number of bad PLCP reception on BPHY rate */
+       uint32  bphy_rxcrsglitch;       /* PHY count of bphy glitches */
+       uint32  rxbadfcs;       /* number of frames for which the CRC check failed in the MAC */
+       uint32  rxtoolate;      /* receive too late */
+       uint32  rxf0ovfl;       /* Rx FIFO0 overflow counters information */
+       uint32  rxf1ovfl;       /* Rx FIFO1 overflow counters information */
+       uint32  rxanyerr;       /* Any RX error that is not counted by other counters. */
+       uint32  rxdropped;      /* Frame dropped */
+       uint32  rxnobuf;        /* Rx error due to no buffer */
+       uint32  rxrunt;         /* Runt frame counter */
+       uint32  rxfrmtoolong;   /* Number of received frame that are too long */
+       uint32  rxdrop20s;
+
+       /* RX related */
+       uint32  rxstrt;         /* number of received frames with a good PLCP */
+       uint32  rxbeaconmbss;   /* beacons received from member of BSS */
+       uint32  rxdtucastmbss;  /* number of received DATA frames with good FCS and matching RA */
+       uint32  rxdtocast;      /* number of received DATA frames (good FCS and no matching RA) */
+       uint32  goodfcs;        /* Good fcs counters  */
+       uint32  rxctl;          /* Number of control frames */
+       uint32  rxaction;       /* Number of action frames */
+       uint32  rxback;         /* Number of block ack frames rcvd */
+       uint32  rxctlucast;     /* Number of received unicast ctl frames */
+       uint32  rxframe;        /* Number of received frames */
+
+       /* TX related */
+       uint32  txallfrm;       /* total number of frames sent, incl. Data, ACK, RTS, CTS,
+                               * Control Management (includes retransmissions)
+                               */
+       uint32  txmpdu;                 /* Numer of transmitted mpdus */
+       uint32  txackbackctsfrm;        /* Number of ACK + BACK + CTS */
+
+       /* TX error related */
+       uint32  txrtsfail;              /* RTS TX failure count */
+       uint32  txphyerr;               /* PHY TX error count */
+
+       uint16  nav_cntr_l;             /* The state of the NAV */
+       uint16  nav_cntr_h;
+} phy_periodic_counters_v3_t;
+
+typedef struct phycal_log_cmn {
+       uint16 chanspec; /* Current phy chanspec */
+       uint8  last_cal_reason;  /* Last Cal Reason */
+       uint8  pad1;  /* Padding byte to align with word */
+       uint32  last_cal_time; /* Last cal time in sec */
+} phycal_log_cmn_t;
+
+typedef struct phycal_log_cmn_v2 {
+       uint16 chanspec; /* Current phy chanspec */
+       uint8  last_cal_reason;  /* Last Cal Reason */
+       uint8  pad1;  /* Padding byte to align with word */
+       uint32   last_cal_time; /* Last cal time in sec */
+
+       /* New Parameters */
+       uint16 last_cal_temp; /* Duration of SS cal in usec */
+       uint16 last_ss_caldur; /* Last ss cal duration */
+
+       /* Misc general purpose debug counters (will be used for future debugging) */
+       uint16 debug_01;
+       uint16 debug_02;
+       uint16 debug_03;
+       uint16 debug_04;
+} phycal_log_cmn_v2_t;
+
+typedef struct phycal_log_core {
+       uint16 ofdm_txa; /* OFDM Tx IQ Cal a coeff */
+       uint16 ofdm_txb; /* OFDM Tx IQ Cal b coeff */
+       uint16 ofdm_txd; /* contain di & dq */
+       uint16 bphy_txa; /* BPHY Tx IQ Cal a coeff */
+       uint16 bphy_txb; /* BPHY Tx IQ Cal b coeff */
+       uint16 bphy_txd; /* contain di & dq */
+
+       uint16 rxa; /* Rx IQ Cal A coeffecient */
+       uint16 rxb; /* Rx IQ Cal B coeffecient */
+       int32 rxs;  /* FDIQ Slope coeffecient */
+
+       uint8 baseidx; /* TPC Base index */
+       uint8 adc_coeff_cap0_adcI; /* ADC CAP Cal Cap0 I */
+       uint8 adc_coeff_cap1_adcI; /* ADC CAP Cal Cap1 I */
+       uint8 adc_coeff_cap2_adcI; /* ADC CAP Cal Cap2 I */
+       uint8 adc_coeff_cap0_adcQ; /* ADC CAP Cal Cap0 Q */
+       uint8 adc_coeff_cap1_adcQ; /* ADC CAP Cal Cap1 Q */
+       uint8 adc_coeff_cap2_adcQ; /* ADC CAP Cal Cap2 Q */
+       uint8 pad; /* Padding byte to align with word */
+} phycal_log_core_t;
+
+#define PHYCAL_LOG_VER1         (1u)
+
+typedef struct phycal_log_v1 {
+       uint8  version; /* Logging structure version */
+       uint8  numcores; /* Numbe of cores for which core specific data present */
+       uint16 length;  /* Length of the entire structure */
+       phycal_log_cmn_t phycal_log_cmn; /* Logging common structure */
+       /* This will be a variable length based on the numcores field defined above */
+       phycal_log_core_t phycal_log_core[1];
+} phycal_log_v1_t;
+
+typedef struct phy_periodic_log_cmn {
+       uint16  chanspec; /* Current phy chanspec */
+       uint16  vbatmeas; /* Measured VBAT sense value */
+       uint16  featureflag; /* Currently active feature flags */
+       int8    chiptemp; /* Chip temparature */
+       int8    femtemp;  /* Fem temparature */
+
+       uint32  nrate; /* Current Tx nrate */
+
+       uint8   cal_phase_id; /* Current Multi phase cal ID */
+       uint8   rxchain; /* Rx Chain */
+       uint8   txchain; /* Tx Chain */
+       uint8   ofdm_desense; /* OFDM desense */
+
+       uint8   bphy_desense; /* BPHY desense */
+       uint8   pll_lockstatus; /* PLL Lock status */
+       uint8   pad1; /* Padding byte to align with word */
+       uint8   pad2; /* Padding byte to align with word */
+
+       uint32 duration;        /**< millisecs spent sampling this channel */
+       uint32 congest_ibss;    /**< millisecs in our bss (presumably this traffic will */
+                               /**<  move if cur bss moves channels) */
+       uint32 congest_obss;    /**< traffic not in our bss */
+       uint32 interference;    /**< millisecs detecting a non 802.11 interferer. */
+
+} phy_periodic_log_cmn_t;
+
+typedef struct phy_periodic_log_cmn_v2 {
+       uint16  chanspec; /* Current phy chanspec */
+       uint16  vbatmeas; /* Measured VBAT sense value */
+       uint16  featureflag; /* Currently active feature flags */
+       int8    chiptemp; /* Chip temparature */
+       int8    femtemp;  /* Fem temparature */
+
+       uint32  nrate; /* Current Tx nrate */
+
+       uint8   cal_phase_id; /* Current Multi phase cal ID */
+       uint8   rxchain; /* Rx Chain */
+       uint8   txchain; /* Tx Chain */
+       uint8   ofdm_desense; /* OFDM desense */
+
+       uint8   bphy_desense; /* BPHY desense */
+       uint8   pll_lockstatus; /* PLL Lock status */
+
+       uint32 duration;        /* millisecs spent sampling this channel */
+       uint32 congest_ibss;    /* millisecs in our bss (presumably this traffic will */
+                               /*  move if cur bss moves channels) */
+       uint32 congest_obss;    /* traffic not in our bss */
+       uint32 interference;    /* millisecs detecting a non 802.11 interferer. */
+
+       uint8 slice;
+       uint8 version;          /* version of fw/ucode for debug purposes */
+       bool phycal_disable;            /* Set if calibration is disabled */
+       uint8 pad;
+       uint16 phy_log_counter;
+       uint16 noise_mmt_overdue;       /* Count up if ucode noise mmt is overdue for 5 sec */
+       uint16 chan_switch_tm; /* Channel switch time */
+
+       /* HP2P related params */
+       uint16 shm_mpif_cnt_val;
+       uint16 shm_thld_cnt_val;
+       uint16 shm_nav_cnt_val;
+       uint16 shm_cts_cnt_val;
+
+       uint16 shm_m_prewds_cnt;        /* Count of pre-wds fired in the ucode */
+       uint32 last_cal_time;           /* Last cal execution time */
+       uint16 deaf_count;              /* Depth of stay_in_carrier_search function */
+       uint32 ed20_crs0;               /* ED-CRS status on core 0 */
+       uint32 ed20_crs1;               /* ED-CRS status on core 1 */
+       uint32 noise_cal_req_ts;        /* Time-stamp when noise cal was requested */
+       uint32 noise_cal_intr_ts;       /* Time-stamp when noise cal was completed */
+       uint32 phywdg_ts;               /* Time-stamp when wd was fired */
+       uint32 phywd_dur;                       /* Duration of the watchdog */
+       uint32 noise_mmt_abort_crs; /* Count of CRS during noise mmt */
+       uint32 chanspec_set_ts;         /* Time-stamp when chanspec was set */
+       uint32 vcopll_failure_cnt;      /* Number of VCO cal failures
+                                       * (including failures detected in ucode).
+                                       */
+       uint32 dcc_fail_counter;        /* Number of DC cal failures */
+       uint32 log_ts;                  /* Time-stamp when this log was collected */
+
+       /* Misc general purpose debug counters (will be used for future debugging) */
+       uint16 debug_01;
+       uint16 debug_02;
+       uint16 debug_03;
+       uint16 debug_04;
+       uint16 debug_05;
+} phy_periodic_log_cmn_v2_t;
+
+typedef struct phy_periodic_log_core {
+       uint8   baseindxval; /* TPC Base index */
+       int8    tgt_pwr; /* Programmed Target power */
+       int8    estpwradj; /* Current Est Power Adjust value */
+       int8    crsmin_pwr; /* CRS Min/Noise power */
+       int8    rssi_per_ant; /* RSSI Per antenna */
+       int8    snr_per_ant; /* SNR Per antenna */
+       int8    pad1; /* Padding byte to align with word */
+       int8    pad2; /* Padding byte to align with word */
+} phy_periodic_log_core_t;
+
+#define PHY_PERIODIC_LOG_VER1         (1u)
+
+typedef struct phy_periodic_log_v1 {
+       uint8  version; /* Logging structure version */
+       uint8  numcores; /* Number of cores for which core specific data present */
+       uint16 length;  /* Length of the entire structure */
+       phy_periodic_log_cmn_t phy_perilog_cmn;
+       phy_periodic_counters_v1_t counters_peri_log;
+       /* This will be a variable length based on the numcores field defined above */
+       phy_periodic_log_core_t phy_perilog_core[1];
+} phy_periodic_log_v1_t;
+
+#define PHYCAL_LOG_VER3                (3u)
+#define PHY_PERIODIC_LOG_VER3  (3u)
+
+/* 4387 onwards */
+typedef struct phy_periodic_log_v3 {
+       uint8  version; /* Logging structure version */
+       uint8  numcores; /* Number of cores for which core specific data present */
+       uint16 length;  /* Length of the structure */
+
+       /* Logs general PHY parameters */
+       phy_periodic_log_cmn_v2_t phy_perilog_cmn;
+
+       /* Logs ucode counters and NAVs */
+       phy_periodic_counters_v3_t counters_peri_log;
+
+       /* Logs data pertaining to each core */
+       phy_periodic_log_core_t phy_perilog_core[1];
+} phy_periodic_log_v3_t;
+
+typedef struct phycal_log_v3 {
+       uint8  version; /* Logging structure version */
+       uint8  numcores; /* Number of cores for which core specific data present */
+       uint16 length;  /* Length of the entire structure */
+       phycal_log_cmn_v2_t phycal_log_cmn; /* Logging common structure */
+       /* This will be a variable length based on the numcores field defined above */
+       phycal_log_core_t phycal_log_core[1];
+} phycal_log_v3_t;
+
+/* Note: The version 2 is reserved for 4357 only. Future chips must not use this version. */
+
+#define MAX_CORE_4357          (2u)
+#define PHYCAL_LOG_VER2                (2u)
+#define PHY_PERIODIC_LOG_VER2  (2u)
+
+typedef struct {
+       uint32  txallfrm;       /**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+                               * Control Management (includes retransmissions)
+                               */
+       uint32  rxrsptmout;     /**< number of response timeouts for transmitted frames
+                               * expecting a response
+                               */
+       uint32  rxstrt;         /**< number of received frames with a good PLCP */
+       uint32  rxbadplcp;      /**< number of parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  bphy_badplcp;   /**< number of bad PLCP reception on BPHY rate */
+       uint32  bphy_rxcrsglitch;       /**< PHY count of bphy glitches */
+       uint32  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint32  rxdtucastmbss;  /**< number of received DATA frames with good FCS and matching RA */
+       uint32  rxf0ovfl;       /** < Rx FIFO0 overflow counters information */
+       uint32  rxf1ovfl;       /** < Rx FIFO1 overflow counters information */
+       uint32  rxdtocast;      /**< number of received DATA frames (good FCS and no matching RA) */
+       uint32  rxtoolate;      /**< receive too late */
+       uint32  rxbadfcs;       /**< number of frames for which the CRC check failed in the MAC */
+} phy_periodic_counters_v2_t;
+
+/* Note: The version 2 is reserved for 4357 only. All future chips must not use this version. */
+
+typedef struct phycal_log_core_v2 {
+       uint16 ofdm_txa; /* OFDM Tx IQ Cal a coeff */
+       uint16 ofdm_txb; /* OFDM Tx IQ Cal b coeff */
+       uint16 ofdm_txd; /* contain di & dq */
+       uint16 rxa; /* Rx IQ Cal A coeffecient */
+       uint16 rxb; /* Rx IQ Cal B coeffecient */
+       uint8 baseidx; /* TPC Base index */
+       uint8 pad;
+       int32 rxs; /* FDIQ Slope coeffecient */
+} phycal_log_core_v2_t;
+
+/* Note: The version 2 is reserved for 4357 only. All future chips must not use this version. */
+
+typedef struct phycal_log_v2 {
+       uint8  version; /* Logging structure version */
+       uint16 length;  /* Length of the entire structure */
+       uint8 pad;
+       phycal_log_cmn_t phycal_log_cmn; /* Logging common structure */
+       phycal_log_core_v2_t phycal_log_core[MAX_CORE_4357];
+} phycal_log_v2_t;
+
+/* Note: The version 2 is reserved for 4357 only. All future chips must not use this version. */
+
+typedef struct phy_periodic_log_v2 {
+       uint8  version; /* Logging structure version */
+       uint16 length;  /* Length of the entire structure */
+       uint8 pad;
+       phy_periodic_log_cmn_t phy_perilog_cmn;
+       phy_periodic_counters_v2_t counters_peri_log;
+       phy_periodic_log_core_t phy_perilog_core[MAX_CORE_4357];
+} phy_periodic_log_v2_t;
+
+/* Event log payload for enhanced roam log */
+typedef enum {
+       ROAM_LOG_SCANSTART = 1,         /* EVT log for roam scan start */
+       ROAM_LOG_SCAN_CMPLT = 2,        /* EVT log for roam scan completeted */
+       ROAM_LOG_ROAM_CMPLT = 3,        /* EVT log for roam done */
+       ROAM_LOG_NBR_REQ = 4,           /* EVT log for Neighbor REQ */
+       ROAM_LOG_NBR_REP = 5,           /* EVT log for Neighbor REP */
+       ROAM_LOG_BCN_REQ = 6,           /* EVT log for BCNRPT REQ */
+       ROAM_LOG_BCN_REP = 7,           /* EVT log for BCNRPT REP */
+       ROAM_LOG_BTM_REP = 8,           /* EVT log for BTM REP */
+       PRSV_PERIODIC_ID_MAX
+} prsv_periodic_id_enum_t;
+
+typedef struct prsv_periodic_log_hdr {
+       uint8 version;
+       uint8 id;
+       uint16 length;
+} prsv_periodic_log_hdr_t;
+
+#define ROAM_LOG_VER_1 (1u)
+#define ROAM_LOG_VER_2 (2u)
+#define ROAM_LOG_VER_3 (3u)
+#define ROAM_SSID_LEN  (32u)
+typedef struct roam_log_trig_v1 {
+       prsv_periodic_log_hdr_t hdr;
+       int8 rssi;
+       uint8 current_cu;
+       uint8 pad[2];
+       uint reason;
+       int result;
+       union {
+               struct {
+                       uint rcvd_reason;
+               } prt_roam;
+               struct {
+                       uint8 req_mode;
+                       uint8 token;
+                       uint16 nbrlist_size;
+                       uint32 disassoc_dur;
+                       uint32 validity_dur;
+                       uint32 bss_term_dur;
+               } bss_trans;
+       };
+} roam_log_trig_v1_t;
+
+typedef struct roam_log_trig_v2 {
+       prsv_periodic_log_hdr_t hdr;
+       int8 rssi;
+       uint8 current_cu;
+       uint8 full_scan;
+       uint8 pad;
+       uint reason;
+       int result;
+       union {
+               struct {
+                       uint rcvd_reason;
+               } prt_roam;
+               struct {
+                       uint8 req_mode;
+                       uint8 token;
+                       uint16 nbrlist_size;
+                       uint32 disassoc_dur;
+                       uint32 validity_dur;
+                       uint32 bss_term_dur;
+               } bss_trans;
+               struct {
+                       int rssi_threshold;
+               } low_rssi;
+       };
+} roam_log_trig_v2_t;
+
+#define ROAM_LOG_RPT_SCAN_LIST_SIZE 3
+#define ROAM_LOG_INVALID_TPUT 0xFFFFFFFFu
+typedef struct roam_scan_ap_info {
+       int8 rssi;
+       uint8 cu;
+       uint8 pad[2];
+       uint32 score;
+       uint16 chanspec;
+       struct ether_addr addr;
+       uint32 estm_tput;
+} roam_scan_ap_info_t;
+
+typedef struct roam_log_scan_cmplt_v1 {
+       prsv_periodic_log_hdr_t hdr;
+       uint8 full_scan;
+       uint8 scan_count;
+       uint8 scan_list_size;
+       uint8 pad;
+       int32 score_delta;
+       roam_scan_ap_info_t cur_info;
+       roam_scan_ap_info_t scan_list[ROAM_LOG_RPT_SCAN_LIST_SIZE];
+} roam_log_scan_cmplt_v1_t;
+
+#define ROAM_CHN_UNI_2A                36u
+#define ROAM_CHN_UNI_2A_MAX    64u
+#define ROAM_CHN_UNI_2C                100u
+#define ROAM_CHN_UNI_2C_MAX    144u
+#define ROAM_CHN_UNI_3         149u
+#define ROAM_CHN_UNI_3_MAX     165u
+#define ROAM_CHN_SPACE         2u /* channel index space for 5G */
+
+typedef struct roam_log_scan_cmplt_v2 {
+       prsv_periodic_log_hdr_t hdr;
+       uint8 scan_count;
+       uint8 scan_list_size;
+       uint8 chan_num;
+       uint8 pad;
+       uint16 band2g_chan_list;
+       uint16 uni2a_chan_list;
+       uint8 uni2c_chan_list[3];
+       uint8 uni3_chan_list;
+       int32 score_delta;
+       roam_scan_ap_info_t cur_info;
+       roam_scan_ap_info_t scan_list[ROAM_LOG_RPT_SCAN_LIST_SIZE];
+} roam_log_scan_cmplt_v2_t;
+
+typedef struct roam_log_cmplt_v1 {
+       prsv_periodic_log_hdr_t hdr;
+       uint status;    /* status code WLC_E STATUS */
+       uint reason;    /* roam trigger reason */
+       uint16  chanspec; /* new bssid chansepc */
+       struct ether_addr addr; /* ether addr */
+       uint8 pad[3];
+       uint8 retry;
+} roam_log_cmplt_v1_t;
+
+typedef roam_log_cmplt_v1_t roam_log_cmplt_v2_t;
+
+typedef struct roam_log_nbrrep {
+       prsv_periodic_log_hdr_t hdr;
+       uint channel_num;
+} roam_log_nbrrep_v1_t;
+
+typedef struct roam_log_nbrrep_v2 {
+       prsv_periodic_log_hdr_t hdr;
+       uint channel_num;
+       uint16 band2g_chan_list; /* channel bit map */
+       uint16 uni2a_chan_list;
+       uint8 uni2c_chan_list[3];
+       uint8 uni3_chan_list;
+} roam_log_nbrrep_v2_t;
+
+typedef struct roam_log_nbrreq {
+       prsv_periodic_log_hdr_t hdr;
+       uint token;
+} roam_log_nbrreq_v1_t;
+
+typedef roam_log_nbrreq_v1_t roam_log_nbrreq_v2_t;
+
+typedef struct roam_log_bcnrptreq {
+       prsv_periodic_log_hdr_t hdr;
+       int32 result;
+       uint8 reg;      /* operating class */
+       uint8 channel;  /* number of requesting channel */
+       uint8 mode;             /* request mode d11 rmreq bcn */
+       uint8 bssid_wild; /* is wild bssid */
+       uint8 ssid_len;         /* length of SSID */
+       uint8 pad;
+       uint16 duration;        /* duration */
+       uint8 ssid[ROAM_SSID_LEN];
+} roam_log_bcnrpt_req_v1_t;
+
+typedef roam_log_bcnrpt_req_v1_t roam_log_bcnrpt_req_v2_t;
+
+typedef struct roam_log_bcnrptrep {
+       prsv_periodic_log_hdr_t hdr;
+       uint32 count;
+} roam_log_bcnrpt_rep_v1_t;
+
+typedef struct roam_log_bcnrptrep_v2 {
+       prsv_periodic_log_hdr_t hdr;
+       uint8 scan_inprogress; /* if scan in progress TRUE */
+       uint8 reason;                   /* report mode d11 RMREP mode */
+       uint32 count;
+} roam_log_bcnrpt_rep_v2_t;
+
+typedef struct roam_log_btmrep_v2 {
+       prsv_periodic_log_hdr_t hdr;
+       uint8 req_mode; /* d11 BSSTRANS req mode */
+       uint8 status; /* d11 BSSTRANS response status code */
+       uint16 pad[2];
+       int     result;
+} roam_log_btm_rep_v2_t;
+
+/* ROAM_LOG_VER_3 specific structures */
+typedef struct roam_log_btmrep_v3 {
+       prsv_periodic_log_hdr_t hdr;
+       uint8 req_mode; /* d11 BSSTRANS req mode */
+       uint8 status; /* d11 BSSTRANS response status code */
+       uint16 pad[2];
+       struct ether_addr target_addr; /* bssid to move */
+       int     result;
+} roam_log_btm_rep_v3_t;
+
+typedef struct roam_log_bcnrptreq_v3 {
+       prsv_periodic_log_hdr_t hdr;
+       int32 result;
+       uint8 reg;      /* operating class */
+       uint8 channel;  /* number of requesting channel */
+       uint8 mode;             /* request mode d11 rmreq bcn */
+       uint8 bssid_wild; /* is wild bssid */
+       uint8 ssid_len;         /* length of SSID */
+       uint8 pad;
+       uint16 duration;        /* duration */
+       uint8 ssid[ROAM_SSID_LEN];
+       uint channel_num;       /* number of scan channel */
+       uint16 band2g_chan_list; /* channel bit map */
+       uint16 uni2a_chan_list;
+       uint8 uni2c_chan_list[3];
+       uint8 uni3_chan_list;
+} roam_log_bcnrpt_req_v3_t;
+
+#define BCNRPT_RSN_SUCCESS     0
+#define BCNRPT_RSN_BADARG      1
+#define BCNRPT_RSN_SCAN_ING    2
+#define BCNRPT_RSN_SCAN_FAIL   3
+
+typedef struct roam_log_bcnrptrep_v3 {
+       prsv_periodic_log_hdr_t hdr;
+       uint8 scan_status;              /* scan status */
+       uint8 reason;                   /* report mode d11 RMREP mode */
+       uint16 reason_detail;
+       uint32 count;
+       uint16 duration;                /* duration */
+       uint16 pad;
+} roam_log_bcnrpt_rep_v3_t;
+
+#define EVENT_LOG_BUFFER_ID_PMK                        0
+#define EVENT_LOG_BUFFER_ID_ANONCE             1
+#define EVENT_LOG_BUFFER_ID_SNONCE             2
+#define EVENT_LOG_BUFFER_ID_WPA_M3_KEYDATA     3
+#define EVENT_LOG_BUFFER_ID_WPA_CACHED_KEYDATA 4
+
+typedef struct event_log_buffer {
+       uint16 id;      /* XTLV ID: EVENT_LOG_XTLV_ID_BUF */
+       uint16 len;     /* XTLV Len */
+       uint16 buf_id;  /* One of the above EVENT_LOG_BUFFER_ID_XXXs */
+       uint16 pad;     /* for 4-byte start alignment of data */
+       uint8 data[];   /* the payload of interest */
+} event_log_buffer_t;
+
+#define XTLV_EVENT_LOG_BUFFER_LEN              (OFFSETOF(event_log_buffer_t, data))
+#define XTLV_EVENT_LOG_BUFFER_FULL_LEN(buf_len)        ALIGN_SIZE((XTLV_EVENT_LOG_BUFFER_LEN + \
+                                                       (buf_len) * sizeof(uint8)), sizeof(uint32))
+
+/* Structures for parsing FSM log data
+ * Only used by host to parse data coming in FSM log set
+ * Following log tags use this structured data:
+ * EVENT_LOG_TAG_ASSOC_SM
+ * EVENT_LOG_TAG_SUP_SM
+ * EVENT_LOG_TAG_AUTH_SM
+ * EVENT_LOG_TAG_SAE_SM
+ * EVENT_LOG_TAG_FTM_SM
+ * EVENT_LOG_TAG_NAN_SM
+ * More state machine log tags may also use this format
+ */
+
+/* Generic FSM structure for logging. Must be wrapped into a proper structure. The wrapper
+ * structure can add more information but this needs to be one of the members of the wrapper
+ * structure.
+ */
+typedef struct event_log_generic_fsm_struct {
+       uint32 old_state;
+       uint32 new_state;
+       uint32 reason;
+       uint32 caller;
+} event_log_generic_fsm_struct_t;
+
+typedef struct event_log_wl_fsm_struct {
+       uint32 unit;
+       uint32 bsscfg_idx;
+       event_log_generic_fsm_struct_t generic_fsm;
+       uint32 data[]; /* Any other information relevant to this state transition */
+} event_log_wl_fsm_struct_t;
+
+/* To be used by  DVFS event log FSM logging */
+typedef struct event_log_rte_dvfs_fsm_struct {
+       event_log_generic_fsm_struct_t generic_fsm;
+       uint32 data[];          /* Any other information relevant to this state transition */
+} event_log_rte_dvfs_fsm_struct_t;
+
+#endif /* _EVENT_LOG_PAYLOAD_H_ */
diff --git a/bcmdhd.101.10.240.x/include/event_log_set.h b/bcmdhd.101.10.240.x/include/event_log_set.h
new file mode 100644 (file)
index 0000000..6700685
--- /dev/null
@@ -0,0 +1,136 @@
+/*
+ * EVENT_LOG system definitions
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _EVENT_LOG_SET_H_
+#define _EVENT_LOG_SET_H_
+
+/* Set assignments */
+#define EVENT_LOG_SET_BUS              (0u)
+#define EVENT_LOG_SET_WL               (1u)
+#define EVENT_LOG_SET_PSM              (2u)
+#define EVENT_LOG_SET_ERROR            (3u)
+
+/* MSCH logging */
+#define EVENT_LOG_SET_MSCH_PROFILER    (4u)
+
+/* A particular customer uses sets 5, 6, and 7. There is a request
+ * to not name these log sets as that could limit their ability to
+ * use different log sets in future.
+ * Sets 5, 6, and 7 are instantiated by host
+ * In such case, ecounters could be mapped to any set that host
+ * configures. They may or may not use set 5.
+ */
+#define EVENT_LOG_SET_5                        (5u)
+#define EVENT_LOG_SET_ECOUNTERS                (EVENT_LOG_SET_5)
+#define EVENT_LOG_SET_6                        (6u)
+#define EVENT_LOG_SET_7                        (7u)
+
+/* Temporary change to satisfy compilation across branches
+ * Will be removed after checkin
+ */
+#define EVENT_LOG_SET_8                        (8u)
+#define EVENT_LOG_SET_PRSRV            (EVENT_LOG_SET_8)
+
+#define EVENT_LOG_SET_9                        (9u)
+/* General purpose preserve chatty.
+ * EVENT_LOG_SET_PRSRV_CHATTY log set should not be used by FW as it is
+ * used by customer host. FW should use EVENT_LOG_SET_GP_PRSRV_CHATTY
+ * for general purpose preserve chatty logs.
+ */
+#define EVENT_LOG_SET_GP_PRSRV_CHATTY  (EVENT_LOG_SET_9)
+#define EVENT_LOG_SET_PRSRV_CHATTY     (EVENT_LOG_SET_6)
+
+/* BUS preserve */
+#define EVENT_LOG_SET_PRSRV_BUS                (10u)
+
+/* WL preserve */
+#define EVENT_LOG_SET_PRSRV_WL         (11u)
+
+/* Slotted BSS set */
+#define EVENT_LOG_SET_WL_SLOTTED_BSS    (12u)
+
+/* PHY entity logging */
+#define EVENT_LOG_SET_PHY              (13u)
+
+/* PHY preserve */
+#define EVENT_LOG_SET_PRSRV_PHY                (14u)
+
+/* RTE entity */
+#define EVENT_LOG_SET_RTE              (15u)
+
+/* Malloc and free logging */
+#define EVENT_LOG_SET_MEM_API          (16u)
+
+/* Console buffer */
+#define EVENT_LOG_SET_RTE_CONS_BUF     (17u)
+
+/* three log sets for general debug purposes */
+#define EVENT_LOG_SET_GENERAL_DBG_1    (18u)
+#define EVENT_LOG_SET_GENERAL_DBG_2    (19u)
+#define EVENT_LOG_SET_GENERAL_DBG_3    (20u)
+
+/* Log sets for capturing power related logs. Note that these sets
+ * are to be used across entire system and not just WL.
+ */
+#define EVENT_LOG_SET_POWER_1          (21u)
+#define EVENT_LOG_SET_POWER_2          (22u)
+
+/* Used for timestamp plotting, TS_LOG() */
+#define EVENT_LOG_SET_TS_LOG           (23u)
+
+/* BUS preserve chatty */
+#define EVENT_LOG_SET_PRSRV_BUS_CHATTY (24u)
+
+/* PRESERVE_PREIODIC_LOG_SET */
+/* flush if host is in D0 at every period */
+#define EVENT_LOG_SET_PRSV_PERIODIC    (25u)
+
+/* AMT logging and other related information */
+#define EVENT_LOG_SET_AMT              (26u)
+
+/* State machine logging. Part of preserve logs */
+#define EVENT_LOG_SET_FSM              (27u)
+
+/* wbus related logging */
+#define EVENT_LOG_SET_WBUS             (28u)
+
+#ifndef NUM_EVENT_LOG_SETS
+/* Set a maximum number of sets here.  It is not dynamic for
+ * efficiency of the EVENT_LOG calls. Old branches could define
+ * this to an appropriat enumber in their makefiles to reduce
+ * ROM invalidation
+ */
+#ifdef NUM_EVENT_LOG_SETS_V2
+/* for v2, everything has became unsigned */
+#define NUM_EVENT_LOG_SETS (29u)
+#else /* NUM_EVENT_LOG_SETS_V2 */
+#define NUM_EVENT_LOG_SETS (29)
+#endif /* NUM_EVENT_LOG_SETS_V2 */
+#endif /* NUM_EVENT_LOG_SETS */
+
+/* send delayed logs when >= 50% of buffer is full */
+#ifndef ECOUNTERS_DELAYED_FLUSH_PERCENTAGE
+#define ECOUNTERS_DELAYED_FLUSH_PERCENTAGE     (50)
+#endif
+
+#endif /* _EVENT_LOG_SET_H_ */
diff --git a/bcmdhd.101.10.240.x/include/event_log_tag.h b/bcmdhd.101.10.240.x/include/event_log_tag.h
new file mode 100644 (file)
index 0000000..5793d07
--- /dev/null
@@ -0,0 +1,528 @@
+/*
+ * EVENT_LOG system definitions
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _EVENT_LOG_TAG_H_
+#define _EVENT_LOG_TAG_H_
+
+#include <typedefs.h>
+
+/* Define new event log tags here */
+#define EVENT_LOG_TAG_NULL     0       /* Special null tag */
+#define EVENT_LOG_TAG_TS       1       /* Special timestamp tag */
+
+/* HSIC Legacy support */
+/* Possible candidates for reuse */
+#define EVENT_LOG_TAG_BUS_OOB  2
+#define EVENT_LOG_TAG_BUS_STATE        3
+#define EVENT_LOG_TAG_BUS_PROTO        4
+#define EVENT_LOG_TAG_BUS_CTL  5
+#define EVENT_LOG_TAG_BUS_EVENT        6
+#define EVENT_LOG_TAG_BUS_PKT  7
+#define EVENT_LOG_TAG_BUS_FRAME        8
+#define EVENT_LOG_TAG_BUS_DESC 9
+#define EVENT_LOG_TAG_BUS_SETUP        10
+#define EVENT_LOG_TAG_BUS_MISC 11
+
+#define EVENT_LOG_TAG_SRSCAN           22
+#define EVENT_LOG_TAG_PWRSTATS_INFO    23
+
+/* Timestamp logging for plotting. */
+#define EVENT_LOG_TAG_TSLOG            26
+
+/* Possible candidates for reuse */
+#define EVENT_LOG_TAG_UCODE_FIFO       27
+
+#define EVENT_LOG_TAG_SCAN_TRACE_LOW   28
+#define EVENT_LOG_TAG_SCAN_TRACE_HIGH  29
+#define EVENT_LOG_TAG_SCAN_ERROR       30
+#define EVENT_LOG_TAG_SCAN_WARN        31
+#define EVENT_LOG_TAG_MPF_ERR  32
+#define EVENT_LOG_TAG_MPF_WARN 33
+#define EVENT_LOG_TAG_MPF_INFO 34
+#define EVENT_LOG_TAG_MPF_DEBUG        35
+#define EVENT_LOG_TAG_EVENT_INFO       36
+#define EVENT_LOG_TAG_EVENT_ERR        37
+#define EVENT_LOG_TAG_PWRSTATS_ERROR   38
+#define EVENT_LOG_TAG_EXCESS_PM_ERROR  39
+#define EVENT_LOG_TAG_IOCTL_LOG                        40
+#define EVENT_LOG_TAG_PFN_ERR  41
+#define EVENT_LOG_TAG_PFN_WARN 42
+#define EVENT_LOG_TAG_PFN_INFO 43
+#define EVENT_LOG_TAG_PFN_DEBUG        44
+#define EVENT_LOG_TAG_BEACON_LOG       45
+#define EVENT_LOG_TAG_WNM_BSSTRANS_INFO 46
+#define EVENT_LOG_TAG_TRACE_CHANSW 47
+#define EVENT_LOG_TAG_PCI_ERROR        48
+#define EVENT_LOG_TAG_PCI_TRACE        49
+#define EVENT_LOG_TAG_PCI_WARN 50
+#define EVENT_LOG_TAG_PCI_INFO 51
+#define EVENT_LOG_TAG_PCI_DBG  52
+#define EVENT_LOG_TAG_PCI_DATA  53
+#define EVENT_LOG_TAG_PCI_RING 54
+
+#define EVENT_LOG_TAG_RANGING_TRACE    55
+#define EVENT_LOG_TAG_WL_ERROR         56
+#define EVENT_LOG_TAG_PHY_ERROR                57
+#define EVENT_LOG_TAG_OTP_ERROR                58
+#define EVENT_LOG_TAG_NOTIF_ERROR      59
+#define EVENT_LOG_TAG_MPOOL_ERROR      60
+#define EVENT_LOG_TAG_OBJR_ERROR       61
+#define EVENT_LOG_TAG_DMA_ERROR                62
+#define EVENT_LOG_TAG_PMU_ERROR                63
+#define EVENT_LOG_TAG_BSROM_ERROR      64
+#define EVENT_LOG_TAG_SI_ERROR         65
+#define EVENT_LOG_TAG_ROM_PRINTF       66
+#define EVENT_LOG_TAG_RATE_CNT         67
+#define EVENT_LOG_TAG_CTL_MGT_CNT      68
+#define EVENT_LOG_TAG_AMPDU_DUMP       69
+#define EVENT_LOG_TAG_MEM_ALLOC_SUCC   70
+#define EVENT_LOG_TAG_MEM_ALLOC_FAIL   71
+#define EVENT_LOG_TAG_MEM_FREE         72
+#define EVENT_LOG_TAG_WL_ASSOC_LOG     73
+#define EVENT_LOG_TAG_WL_PS_LOG                74
+#define EVENT_LOG_TAG_WL_ROAM_LOG      75
+#define EVENT_LOG_TAG_WL_MPC_LOG       76
+#define EVENT_LOG_TAG_WL_WSEC_LOG      77
+#define EVENT_LOG_TAG_WL_WSEC_DUMP     78
+#define EVENT_LOG_TAG_WL_MCNX_LOG      79
+#define EVENT_LOG_TAG_HEALTH_CHECK_ERROR 80
+#define EVENT_LOG_TAG_HNDRTE_EVENT_ERROR 81
+#define EVENT_LOG_TAG_ECOUNTERS_ERROR  82
+#define EVENT_LOG_TAG_WL_COUNTERS      83
+#define EVENT_LOG_TAG_ECOUNTERS_IPCSTATS       84
+#define EVENT_LOG_TAG_WL_P2P_LOG            85
+#define EVENT_LOG_TAG_SDIO_ERROR               86
+#define EVENT_LOG_TAG_SDIO_TRACE               87
+#define EVENT_LOG_TAG_SDIO_DBG          88
+#define EVENT_LOG_TAG_SDIO_PRHDRS              89
+#define EVENT_LOG_TAG_SDIO_PRPKT               90
+#define EVENT_LOG_TAG_SDIO_INFORM              91
+#define EVENT_LOG_TAG_MIMO_PS_ERROR    92
+#define EVENT_LOG_TAG_MIMO_PS_TRACE    93
+#define EVENT_LOG_TAG_MIMO_PS_INFO     94
+#define EVENT_LOG_TAG_BTCX_STATS       95
+#define EVENT_LOG_TAG_LEAKY_AP_STATS   96
+
+#define EVENT_LOG_TAG_MIMO_PS_STATS    98
+#define EVENT_LOG_TAG_PWRSTATS_PHY     99
+#define EVENT_LOG_TAG_PWRSTATS_SCAN    100
+
+#define EVENT_LOG_TAG_PWRSTATS_WAKE_V2 102
+#define EVENT_LOG_TAG_LQM              103
+#define EVENT_LOG_TAG_TRACE_WL_INFO    104
+#define EVENT_LOG_TAG_TRACE_BTCOEX_INFO        105
+#define EVENT_LOG_TAG_ECOUNTERS_TIME_DATA      106
+#define EVENT_LOG_TAG_NAN_ERROR                107
+#define EVENT_LOG_TAG_NAN_INFO         108
+#define EVENT_LOG_TAG_NAN_DBG          109
+#define EVENT_LOG_TAG_STF_ARBITRATOR_ERROR     110
+#define EVENT_LOG_TAG_STF_ARBITRATOR_TRACE     111
+#define EVENT_LOG_TAG_STF_ARBITRATOR_WARN      112
+#define EVENT_LOG_TAG_SCAN_SUMMARY             113
+#define EVENT_LOG_TAG_PROXD_SAMPLE_COLLECT     114
+#define EVENT_LOG_TAG_OCL_INFO                 115
+#define EVENT_LOG_TAG_RSDB_PMGR_DEBUG          116
+#define EVENT_LOG_TAG_RSDB_PMGR_ERR            117
+#define EVENT_LOG_TAG_NAT_ERR                   118
+#define EVENT_LOG_TAG_NAT_WARN                  119
+#define EVENT_LOG_TAG_NAT_INFO                  120
+#define EVENT_LOG_TAG_NAT_DEBUG                 121
+#define EVENT_LOG_TAG_STA_INFO                 122
+#define EVENT_LOG_TAG_PROXD_ERROR              123
+#define EVENT_LOG_TAG_PROXD_TRACE              124
+#define EVENT_LOG_TAG_PROXD_INFO               125
+#define EVENT_LOG_TAG_IE_ERROR                 126
+#define EVENT_LOG_TAG_ASSOC_ERROR              127
+#define EVENT_LOG_TAG_SCAN_ERR                 128
+#define EVENT_LOG_TAG_AMSDU_ERROR              129
+#define EVENT_LOG_TAG_AMPDU_ERROR              130
+#define EVENT_LOG_TAG_KM_ERROR                 131
+#define EVENT_LOG_TAG_DFS                      132
+#define EVENT_LOG_TAG_REGULATORY               133
+#define EVENT_LOG_TAG_CSA                      134
+#define EVENT_LOG_TAG_WNM_BSSTRANS_ERR         135
+#define EVENT_LOG_TAG_SUP_INFO                 136
+#define EVENT_LOG_TAG_SUP_ERROR                        137
+#define EVENT_LOG_TAG_CHANCTXT_TRACE           138
+#define EVENT_LOG_TAG_CHANCTXT_INFO            139
+#define EVENT_LOG_TAG_CHANCTXT_ERROR           140
+#define EVENT_LOG_TAG_CHANCTXT_WARN            141
+#define EVENT_LOG_TAG_MSCHPROFILE              142
+#define EVENT_LOG_TAG_4WAYHANDSHAKE            143
+#define EVENT_LOG_TAG_MSCHPROFILE_TLV          144
+#define EVENT_LOG_TAG_ADPS                     145
+#define EVENT_LOG_TAG_MBO_DBG                  146
+#define EVENT_LOG_TAG_MBO_INFO                 147
+#define EVENT_LOG_TAG_MBO_ERR                  148
+#define EVENT_LOG_TAG_TXDELAY                  149
+#define EVENT_LOG_TAG_BCNTRIM_INFO             150
+#define EVENT_LOG_TAG_BCNTRIM_TRACE            151
+#define EVENT_LOG_TAG_OPS_INFO                 152
+#define EVENT_LOG_TAG_STATS                    153
+#define EVENT_LOG_TAG_BAM                      154
+#define EVENT_LOG_TAG_TXFAIL                   155
+
+#define EVENT_LOG_TAG_RANDMAC_INFO             159
+#define EVENT_LOG_TAG_RANDMAC_DBG              160
+#define EVENT_LOG_TAG_RANDMAC_ERR              161
+
+#define EVENT_LOG_TAG_MSCH_CAL                 163
+#define EVENT_LOG_TAG_MSCH_OPP_CAL             164
+#define EVENT_LOG_TAG_MSCH                     165
+#define EVENT_LOG_TAG_NAN_SYNC                 166
+#define EVENT_LOG_TAG_NAN_DPE                  167
+#define EVENT_LOG_TAG_NAN_SCHED                        168
+#define EVENT_LOG_TAG_NAN_RNG                  169
+#define EVENT_LOG_TAG_NAN_DAM                  170
+#define EVENT_LOG_TAG_NAN_NA                   171
+#define EVENT_LOG_TAG_NAN_NDL                  172
+#define EVENT_LOG_TAG_NAN_NDP                  173
+#define EVENT_LOG_TAG_NAN_SEC                  174
+#define EVENT_LOG_TAG_NAN_MAC                  175
+#define EVENT_LOG_TAG_NAN_FSM                  176
+
+#define EVENT_LOG_TAG_TPA_ERR                  192
+#define EVENT_LOG_TAG_TPA_INFO                 193
+#define EVENT_LOG_TAG_OCE_DBG                  194
+#define EVENT_LOG_TAG_OCE_INFO                 195
+#define EVENT_LOG_TAG_OCE_ERR                  196
+#define EVENT_LOG_TAG_WL_WARN                  197
+#define EVENT_LOG_TAG_SB_ERR                   198
+#define EVENT_LOG_TAG_SB_INFO                  199
+#define EVENT_LOG_TAG_SB_SCHED                 200
+#define EVENT_LOG_TAG_ADPS_INFO                        201
+#define EVENT_LOG_TAG_SB_CMN_SYNC_INFO         202
+#define EVENT_LOG_TAG_PHY_CAL_INFO             203 /* PHY CALs scheduler info */
+#define EVENT_LOG_TAG_EVT_NOTIF_INFO           204
+#define EVENT_LOG_TAG_PHY_HC_ERROR             205
+#define EVENT_LOG_TAG_PHY_TXPWR_WARN           206
+#define EVENT_LOG_TAG_PHY_TXPWR_INFO           207
+#define EVENT_LOG_TAG_PHY_ACI_INFO             208
+#define EVENT_LOG_TAG_WL_COUNTERS_AUX          209
+#define EVENT_LOG_TAG_AMPDU_DUMP_AUX           210
+
+#define EVENT_LOG_TAG_PWRSTATS_PHY_AUX         212
+#define EVENT_LOG_TAG_PWRSTATS_SCAN_AUX                213
+#define EVENT_LOG_TAG_PWRSTATS_WAKE_V2_AUX     214
+#define EVENT_LOG_TAG_SVT_TESTING              215     /* SVT testing/verification */
+#define EVENT_LOG_TAG_HND_SMD_ERROR            216
+#define EVENT_LOG_TAG_PSBW_INFO                        217
+#define EVENT_LOG_TAG_PHY_CAL_DBG              218
+#define EVENT_LOG_TAG_FILS_DBG                 219
+#define EVENT_LOG_TAG_FILS_INFO                        220
+#define EVENT_LOG_TAG_FILS_ERROR               221
+#define EVENT_LOG_TAG_HWA_TXPOST               222
+#define EVENT_LOG_TAG_HWA_TXDMA                        223
+#define EVENT_LOG_TAG_PPR_ERROR                        224
+
+/* Arbitrator callback log tags */
+#define EVENT_LOG_TAG_STF_ARB_CB_TRACE         224
+#define EVENT_LOG_TAG_STF_ARB_CB_ERROR         225
+#define EVENT_LOG_TAG_PHY_PERIODIC_SEC         226
+#define EVENT_LOG_TAG_RTE_ERROR                        227
+#define EVENT_LOG_TAG_CPLT_ERROR               228
+#define EVENT_LOG_TAG_DNGL_ERROR               229
+#define EVENT_LOG_TAG_NVRAM_ERROR              230
+#define EVENT_LOG_TAG_NAC                      231
+#define EVENT_LOG_TAG_HP2P_ERR                 232
+#define EVENT_LOG_TAG_SB_SCHED_DBG_SYNC                233
+#define EVENT_LOG_TAG_ENHANCED_TS              234
+
+/* Available space for new tags for Dingo, Iguana and branches
+ * prior to Koala only. From Koala onwards, new tags must be greater
+ * than 255. If a tag is required for Koala and legacy productization branches,
+ * add that tag here. Tags > 255 will generate extended header. Legacy code
+ * does not understand extended header.
+ */
+
+/* Debug tags for making debug builds */
+#define EVENT_LOG_TAG_DBG1                     251
+#define EVENT_LOG_TAG_DBG2                     252
+#define EVENT_LOG_TAG_DBG3                     253
+#define EVENT_LOG_TAG_DBG4                     254
+#define EVENT_LOG_TAG_DBG5                     255
+
+/* Insert new tags here for Koala onwards */
+
+/* NAN INFO/ERR evnt tags */
+#define EVENT_LOG_TAG_NAN_SYNC_INFO             256
+#define EVENT_LOG_TAG_NAN_DPE_INFO              257
+#define EVENT_LOG_TAG_NAN_SCHED_INFO            258
+#define EVENT_LOG_TAG_NAN_RNG_INFO              259
+#define EVENT_LOG_TAG_NAN_DAM_INFO              260
+#define EVENT_LOG_TAG_NAN_NA_INFO               261
+#define EVENT_LOG_TAG_NAN_NDL_INFO              262
+#define EVENT_LOG_TAG_NAN_NDP_INFO              263
+#define EVENT_LOG_TAG_NAN_SEC_INFO              264
+#define EVENT_LOG_TAG_NAN_MAC_INFO              265
+#define EVENT_LOG_TAG_NAN_FSM_INFO              266
+#define EVENT_LOG_TAG_NAN_PEER_INFO             267
+#define EVENT_LOG_TAG_NAN_AVAIL_INFO            268
+#define EVENT_LOG_TAG_NAN_CMN_INFO              269
+#define EVENT_LOG_TAG_NAN_SYNC_ERR              270
+#define EVENT_LOG_TAG_NAN_DPE_ERR               271
+#define EVENT_LOG_TAG_NAN_SCHED_ERR             272
+#define EVENT_LOG_TAG_NAN_RNG_ERR               273
+#define EVENT_LOG_TAG_NAN_DAM_ERR               274
+#define EVENT_LOG_TAG_NAN_NA_ERR                275
+#define EVENT_LOG_TAG_NAN_NDL_ERR               276
+#define EVENT_LOG_TAG_NAN_NDP_ERR               277
+#define EVENT_LOG_TAG_NAN_SEC_ERR               278
+#define EVENT_LOG_TAG_NAN_MAC_ERR               279
+#define EVENT_LOG_TAG_NAN_FSM_ERR               280
+#define EVENT_LOG_TAG_NAN_PEER_ERR              281
+#define EVENT_LOG_TAG_NAN_AVAIL_ERR             282
+#define EVENT_LOG_TAG_NAN_CMN_ERR               283
+
+/* More NAN DBG evt Tags */
+#define EVENT_LOG_TAG_NAN_PEER                  284
+#define EVENT_LOG_TAG_NAN_AVAIL                 285
+#define EVENT_LOG_TAG_NAN_CMN                   286
+
+#define EVENT_LOG_TAG_SAE_ERROR                        287
+#define EVENT_LOG_TAG_SAE_INFO                 288
+
+/* rxsig module logging */
+#define EVENT_LOG_TAG_RXSIG_ERROR               289
+#define EVENT_LOG_TAG_RXSIG_DEBUG               290
+#define EVENT_LOG_TAG_RXSIG_INFO                291
+
+/* HE TWT HEB EVEVNT_LOG_TAG */
+#define EVENT_LOG_TAG_WL_HE_INFO                292
+#define EVENT_LOG_TAG_WL_HE_TRACE               293
+#define EVENT_LOG_TAG_WL_HE_WARN                294
+#define EVENT_LOG_TAG_WL_HE_ERROR               295
+#define EVENT_LOG_TAG_WL_TWT_INFO               296
+#define EVENT_LOG_TAG_WL_TWT_TRACE              297
+#define EVENT_LOG_TAG_WL_TWT_WARN               298
+#define EVENT_LOG_TAG_WL_TWT_ERROR              299
+#define EVENT_LOG_TAG_WL_HEB_ERROR              300
+#define EVENT_LOG_TAG_WL_HEB_TRACE              301
+
+/* RRM EVENT_LOG_TAG */
+#define EVENT_LOG_TAG_RRM_DBG                   302
+#define EVENT_LOG_TAG_RRM_INFO                  303
+#define EVENT_LOG_TAG_RRM_ERR                   304
+
+/* scan core */
+#define EVENT_LOG_TAG_SC                       305
+
+#define EVENT_LOG_TAG_ESP_DBG                  306
+#define EVENT_LOG_TAG_ESP_INFO                 307
+#define EVENT_LOG_TAG_ESP_ERR                  308
+
+/* SDC */
+#define EVENT_LOG_TAG_SDC_DBG                  309
+#define EVENT_LOG_TAG_SDC_INFO                 310
+#define EVENT_LOG_TAG_SDC_ERR                  311
+
+/* RTE */
+#define EVENT_LOG_TAG_RTE_ERR                  312
+
+/* TX FIFO */
+#define EVENT_LOG_TAG_FIFO_INFO                        313
+
+/* PKTTS */
+#define EVENT_LOG_TAG_LATENCY_INFO             314
+
+/* TDLS */
+#define EVENT_LOG_TAG_WL_TDLS_INFO              315
+#define EVENT_LOG_TAG_WL_TDLS_DBG               316
+#define EVENT_LOG_TAG_WL_TDLS_ERR               317
+
+/* MSCH messages */
+#define EVENT_LOG_TAG_MSCH_DATASTRUCT          319
+#define EVENT_LOG_TAG_MSCH_REGISTER            320
+#define EVENT_LOG_TAG_MSCH_CALLBACK            321
+#define EVENT_LOG_TAG_MSCH_ERROR               322
+#define EVENT_LOG_TAG_MSCH_DEBUG               323
+#define EVENT_LOG_TAG_MSCH_INFORM              324
+#define EVENT_LOG_TAG_MSCH_TRACE               325
+
+/* bus low power related info messages */
+#define EVENT_LOG_TAG_WL_BUS_LP_INFO           326
+#define EVENT_LOG_TAG_PCI_LP_INFO              327
+
+/* SBSS BT-Coex */
+#define EVENT_LOG_TAG_SB_BTCX_INFO             328
+
+/* wbus */
+#define EVENT_LOG_TAG_WBUS_ERR                 329
+#define EVENT_LOG_TAG_WBUS_INFO                        330
+#define EVENT_LOG_TAG_WBUS_SCHED               331
+
+/* MODESW */
+#define EVENT_LOG_TAG_MODESW_ERR               332
+
+/* LPHS */
+#define EVENT_LOG_TAG_LPHS_ERR                 333
+
+/* CPU statistics */
+#define EVENT_LOG_TAG_ARM_STAT                 334
+
+/* Event log tags for SOE */
+#define EVENT_LOG_TAG_SOE_ERROR                        335
+#define EVENT_LOG_TAG_SOE_INFO                 336
+
+/* Event log tags for GCI Shared Memory */
+#define EVENT_LOG_TAG_GCISHM_ERR               337
+#define EVENT_LOG_TAG_GCISHM_INFO              338
+
+/* Eevent log tags for Enhanced Roam Log */
+#define EVENT_LOG_TAG_ROAM_ENHANCED_LOG                339
+
+/* WL BTCEC */
+#define EVENT_LOG_TAG_BTCEC_ERR                        340
+#define EVENT_LOG_TAG_BTCEC_INFO               341
+#define EVENT_LOG_TAG_BTCEC_SCHED              342
+
+#ifdef SLOT_SCHED
+#define EVENT_LOG_TAG_SBSS_HC          344
+#endif /* SLOT_SCHED */
+
+/* wlc_chan_cal */
+#define EVENT_LOG_TAG_WCC_ERR                  345
+#define EVENT_LOG_TAG_WCC_INFO                 346
+#define EVENT_LOG_TAG_WCC_TRACE                        347
+
+/* AMT logging */
+#define EVENT_LOG_TAG_AMT_ERR                  348
+#define EVENT_LOG_TAG_AMT_INFO                 349
+#define EVENT_LOG_TAG_AMT_TRACE                        350
+
+/* OBSS hw logging */
+#define EVENT_LOG_TAG_WLC_OBSS_ERR             351
+#define EVENT_LOG_TAG_WLC_OBSS_TRACE           352
+#define EVENT_LOG_TAG_WLC_OBSS_INFO            353
+
+#define EVENT_LOG_TAG_ALLOC_TRACE              354
+
+/* ASSOC and SUP state machine log tags */
+#define EVENT_LOG_TAG_ASSOC_SM                 355
+#define EVENT_LOG_TAG_SUP_SM                   356
+/* Place holders for additional state machine logging */
+#define EVENT_LOG_TAG_AUTH_SM                  357
+#define EVENT_LOG_TAG_SAE_SM                   358
+#define EVENT_LOG_TAG_FTM_SM                   359
+#define EVENT_LOG_TAG_NAN_SM                   360
+
+/* HP2P - RLLW logging */
+#define EVENT_LOG_TAG_RLLW_TRACE               361
+
+#define EVENT_LOG_TAG_SDTC_INFO                        362
+#define EVENT_LOG_TAG_SDTC_ERR                 363
+
+/* KEEPALIVE logging */
+#define EVENT_LOG_TAG_KEEPALIVE                        364
+#define EVENT_LOG_TAG_DTIM_SCHED_LOG           365
+
+/* For printing PHY init time in the event logs for both slices. */
+#define EVENT_LOG_TAG_PHY_INIT_TM              366
+
+/* SensorC Coex logging */
+#define EVENT_LOG_TAG_SSCCX_ERR                        367
+#define EVENT_LOG_TAG_SSCCX_INFO               368
+#define EVENT_LOG_TAG_SSCCX_TRACE              369
+/* TAG for channel info */
+#define EVENT_LOG_TAG_SCAN_CHANNEL_INFO                370
+
+/* EVENT_LOG_TAG_MAX   = Set to the same value of last tag, not last tag + 1 */
+#define EVENT_LOG_TAG_MAX                      370
+
+typedef enum wl_el_set_type_def {
+       EVENT_LOG_SET_TYPE_DEFAULT = 0, /* flush the log buffer when it is full - Default option */
+       EVENT_LOG_SET_TYPE_PRSRV = 1, /* flush the log buffer based on fw or host trigger */
+       EVENT_LOG_SET_TYPE_DFLUSH = 2 /* flush the log buffer once the watermark is reached */
+} wl_el_set_type_def_t;
+
+#define EVENT_LOG_TAG_FLUSH_NONE               0x00    /* No flush */
+#define EVENT_LOG_TAG_FLUSH_ALL                        0x40    /* Flush all preserved sets */
+#define EVENT_LOG_TAG_FLUSH_SETNUM             0x80    /* Flush preserved set */
+#define EVENT_LOG_TAG_FLUSH_MASK               0x3f    /* SetNum Mask */
+
+typedef enum wl_el_flush_type {
+       EL_TAG_PRSRV_FLUSH_NONE = 0,    /* No flush of preserve buf on this tag */
+       EL_TAG_PRSRV_FLUSH_SETNUM,      /* Flush the buffer set specifid on this tag */
+       EL_TAG_PRSRV_FLUSH_ALL          /* Flush all preserved buffer set on this tag */
+} wl_el_flush_type_t;
+
+#define EVENT_LOG_FLUSH_CURRENT_VERSION 0
+typedef struct wl_el_set_flush_prsrv_s {
+       uint16  version;
+       uint16  len;
+       uint16  tag;            /* Tag for which preserve flush should be done */
+       uint8   flush_type;     /* Check wl_el_flush_type_t */
+       uint8   set_num;        /* Log set num to flush. Max is NUM_EVENT_LOG_SETS. Valid only when
+                                * action is EVENT_LOG_TAG_FLUSH_SETNUM
+                                */
+} wl_el_set_flush_prsrv_t;
+
+#define        SD_PRHDRS(i, s, h, p, n, l)
+#define        SD_PRPKT(m, b, n)
+#define        SD_INFORM(args)
+
+/* Flags for tag control */
+#define EVENT_LOG_TAG_FLAG_NONE                0
+#define EVENT_LOG_TAG_FLAG_LOG         0x80
+#define EVENT_LOG_TAG_FLAG_PRINT       0x40
+#define EVENT_LOG_TAG_FLAG_SET_MASK    0x3f
+
+/* Each event log entry has a type.  The type is the LAST word of the
+ * event log.  The printing code walks the event entries in reverse
+ * order to find the first entry.
+ */
+typedef union event_log_hdr {
+       struct {
+               uint8 tag;              /* Event_log entry tag */
+               uint8 count;            /* Count of 4-byte entries */
+               uint16 fmt_num;         /* Format number */
+       };
+       uint32 t;                       /* Type cheat */
+} event_log_hdr_t;
+
+/* for internal use - legacy max. tag */
+#define EVENT_LOG_TAG_MAX_LEGACY_FORMAT                255
+
+/*
+ * The position of the extended header in the event log stream will be as follows:
+ * <event log payload><ARM cycle count timestamp><extended header><regular header>
+ * Extended header could be due to count > 255 or tag > 255.
+ *
+ * Extended count: 6 bits long. 8 bits (existing) + 6 bits =>
+ * 2^14 words = 65536 bytes payload max
+ * Extended count field is currently reserved
+ * Extended tag: 8 (existing) + 4 bits = 12 bits =>2^12 = 4096 tags
+ * bits[7..4] of extended tags are reserved.
+ * MSB 16 bits of the extended header are reserved for future use.
+ */
+
+typedef union event_log_extended_hdr {
+       struct {
+               uint8 extended_tag; /* Extended tag, bits[7..4] are reserved */
+               uint8 extended_count; /* Extended count. Reserved for now. */
+               uint16 rsvd;    /* Reserved */
+       };
+
+       uint32 t;       /* Type cheat */
+} event_log_extended_hdr_t;
+#endif /* _EVENT_LOG_TAG_H_ */
diff --git a/bcmdhd.101.10.240.x/include/event_trace.h b/bcmdhd.101.10.240.x/include/event_trace.h
new file mode 100644 (file)
index 0000000..3be93c6
--- /dev/null
@@ -0,0 +1,187 @@
+/*
+ * Trace log blocks sent over HBUS
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+/**
+ * @file
+ * @brief
+ * Define the trace event ID and tag ID
+ */
+
+#ifndef        _WL_DIAG_H
+#define        _WL_DIAG_H
+
+#include <event_log.h>
+
+#define DIAG_MAJOR_VERSION      1      /* 4 bits */
+#define DIAG_MINOR_VERSION      0      /* 4 bits */
+#define DIAG_MICRO_VERSION      0      /* 4 bits */
+
+#define DIAG_VERSION           \
+       ((DIAG_MICRO_VERSION&0xF) | (DIAG_MINOR_VERSION&0xF)<<4 | \
+       (DIAG_MAJOR_VERSION&0xF)<<8)
+                                       /* bit[11:8] major ver */
+                                       /* bit[7:4] minor ver */
+                                       /* bit[3:0] micro ver */
+
+/* event ID for trace purpose only, to avoid the conflict with future new
+* WLC_E_ , starting from 0x8000
+*/
+#define TRACE_FW_AUTH_STARTED                  0x8000
+#define TRACE_FW_ASSOC_STARTED                 0x8001
+#define TRACE_FW_RE_ASSOC_STARTED              0x8002
+#define TRACE_G_SCAN_STARTED                   0x8003
+#define TRACE_ROAM_SCAN_STARTED                        0x8004
+#define TRACE_ROAM_SCAN_COMPLETE               0x8005
+#define TRACE_FW_EAPOL_FRAME_TRANSMIT_START    0x8006
+#define TRACE_FW_EAPOL_FRAME_TRANSMIT_STOP     0x8007
+#define TRACE_BLOCK_ACK_NEGOTIATION_COMPLETE   0x8008  /* protocol status */
+#define TRACE_BT_COEX_BT_SCO_START             0x8009
+#define TRACE_BT_COEX_BT_SCO_STOP              0x800a
+#define TRACE_BT_COEX_BT_SCAN_START            0x800b
+#define TRACE_BT_COEX_BT_SCAN_STOP             0x800c
+#define TRACE_BT_COEX_BT_HID_START             0x800d
+#define TRACE_BT_COEX_BT_HID_STOP              0x800e
+#define TRACE_ROAM_AUTH_STARTED                        0x800f
+/* Event ID for NAN, start from 0x9000 */
+#define TRACE_NAN_CLUSTER_STARTED               0x9000
+#define TRACE_NAN_CLUSTER_JOINED                0x9001
+#define TRACE_NAN_CLUSTER_MERGED                0x9002
+#define TRACE_NAN_ROLE_CHANGED                  0x9003
+#define TRACE_NAN_SCAN_COMPLETE                 0x9004
+#define TRACE_NAN_STATUS_CHNG                   0x9005
+
+/* Parameters of wifi logger events are TLVs */
+/* Event parameters tags are defined as: */
+#define TRACE_TAG_VENDOR_SPECIFIC      0 /* take a byte stream as parameter */
+#define TRACE_TAG_BSSID                        1 /* takes a 6 bytes MAC address as parameter */
+#define TRACE_TAG_ADDR                 2 /* takes a 6 bytes MAC address as parameter */
+#define TRACE_TAG_SSID                 3 /* takes a 32 bytes SSID address as parameter */
+#define TRACE_TAG_STATUS               4 /* takes an integer as parameter */
+#define TRACE_TAG_CHANNEL_SPEC         5 /* takes one or more wifi_channel_spec as */
+                                         /* parameter */
+#define TRACE_TAG_WAKE_LOCK_EVENT      6 /* takes a wake_lock_event struct as parameter */
+#define TRACE_TAG_ADDR1                        7 /* takes a 6 bytes MAC address as parameter */
+#define TRACE_TAG_ADDR2                        8 /* takes a 6 bytes MAC address as parameter */
+#define TRACE_TAG_ADDR3                        9 /* takes a 6 bytes MAC address as parameter */
+#define TRACE_TAG_ADDR4                        10 /* takes a 6 bytes MAC address as parameter */
+#define TRACE_TAG_TSF                  11 /* take a 64 bits TSF value as parameter */
+#define TRACE_TAG_IE                   12 /* take one or more specific 802.11 IEs */
+                                          /* parameter, IEs are in turn indicated in */
+                                          /* TLV format as per 802.11 spec */
+#define TRACE_TAG_INTERFACE            13 /* take interface name as parameter */
+#define TRACE_TAG_REASON_CODE          14 /* take a reason code as per 802.11 */
+                                          /* as parameter */
+#define TRACE_TAG_RATE_MBPS            15 /* take a wifi rate in 0.5 mbps */
+#define TRACE_TAG_REQUEST_ID           16 /* take an integer as parameter */
+#define TRACE_TAG_BUCKET_ID            17 /* take an integer as parameter */
+#define TRACE_TAG_GSCAN_PARAMS         18 /* takes a wifi_scan_cmd_params struct as parameter */
+#define TRACE_TAG_GSCAN_CAPABILITIES   19 /* takes a wifi_gscan_capabilities struct as parameter */
+#define TRACE_TAG_SCAN_ID              20 /* take an integer as parameter */
+#define TRACE_TAG_RSSI                 21 /* take an integer as parameter */
+#define TRACE_TAG_CHANNEL              22 /* take an integer as parameter */
+#define TRACE_TAG_LINK_ID              23 /* take an integer as parameter */
+#define TRACE_TAG_LINK_ROLE            24 /* take an integer as parameter */
+#define TRACE_TAG_LINK_STATE           25 /* take an integer as parameter */
+#define TRACE_TAG_LINK_TYPE            26 /* take an integer as parameter */
+#define TRACE_TAG_TSCO                 27 /* take an integer as parameter */
+#define TRACE_TAG_RSCO                 28 /* take an integer as parameter */
+#define TRACE_TAG_EAPOL_MESSAGE_TYPE   29 /* take an integer as parameter */
+                                          /* M1-1, M2-2, M3-3, M4-4 */
+
+typedef union {
+       struct {
+               uint16 event:   16;
+               uint16 version: 16;
+       };
+       uint32 t;
+} wl_event_log_id_ver_t;
+
+#define ETHER_ADDR_PACK_LOW(addr)  (((addr)->octet[3])<<24 | ((addr)->octet[2])<<16 | \
+       ((addr)->octet[1])<<8 | ((addr)->octet[0]))
+#define ETHER_ADDR_PACK_HI(addr)   (((addr)->octet[5])<<8 | ((addr)->octet[4]))
+#define SSID_PACK(addr)   (((uint8)(addr)[0])<<24 | ((uint8)(addr)[1])<<16 | \
+       ((uint8)(addr)[2])<<8 | ((uint8)(addr)[3]))
+
+/* for each event id with logging data, define its logging data structure */
+
+typedef union {
+       struct {
+               uint16 status:  16;
+               uint16 paraset: 16;
+       };
+       uint32 t;
+} wl_event_log_blk_ack_t;
+
+typedef union {
+       struct {
+               uint8   mode:   8;
+               uint8   count:  8;
+               uint16    ch:   16;
+       };
+       uint32 t;
+} wl_event_log_csa_t;
+
+typedef union {
+       struct {
+               uint8  status:          1;
+               uint16 notused:         15;
+               uint16 frag_tx_cnt:     16;
+       };
+       uint32 t;
+} wl_event_log_eapol_tx_t;
+
+typedef union {
+       struct {
+               uint16 tag;
+               uint16 length; /* length of value in bytes */
+       };
+       uint32 t;
+} wl_event_log_tlv_hdr_t;
+
+#ifdef WL_EVENT_LOG_COMPILE
+#define _WL_EVENT_LOG(tag, event, ...)                                 \
+       do {                                                            \
+               event_log_top_t * event_log_top = event_log_get_top();  \
+               wl_event_log_id_ver_t entry = {{event, DIAG_VERSION}};  \
+               event_log_top->timestamp = OSL_SYSUPTIME();             \
+               EVENT_LOG(tag, "WL event", entry.t , ## __VA_ARGS__);   \
+       } while (0)
+#define WL_EVENT_LOG(args)     _WL_EVENT_LOG args
+#else
+#define WL_EVENT_LOG(args)
+#endif    /* WL_EVENT_LOG_COMPILE */
+
+#ifdef NAN_EVENT_LOG_COMPILE
+#define _NAN_EVENT_LOG(tag, event, ...)                                        \
+       do {                                                            \
+               event_log_top_t * event_log_top = event_log_get_top();  \
+               wl_event_log_id_ver_t hdr = {{event, DIAG_VERSION}};    \
+               event_log_top->timestamp = OSL_SYSUPTIME();             \
+               EVENT_LOG(tag, "NAN event", hdr.t , ## __VA_ARGS__);    \
+       } while (0)
+#define NAN_EVENT_LOG(args)    _NAN_EVENT_LOG args
+#else
+#define NAN_EVENT_LOG(args)
+#endif /* NAN_EVENT_LOG_COMPILE */
+
+#endif /* _WL_DIAG_H */
diff --git a/bcmdhd.101.10.240.x/include/fils.h b/bcmdhd.101.10.240.x/include/fils.h
new file mode 100644 (file)
index 0000000..0588f29
--- /dev/null
@@ -0,0 +1,393 @@
+/*
+ * Fundamental types and constants relating to FILS AUTHENTICATION
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _FILSAUTH_H_
+#define _FILSAUTH_H_
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* 11ai D6.0 8.6.8.36 FILS Discovery frame format
+       category
+       action
+       fils_discovery_info_field_t
+       fils_rnr_element_t
+       fils_indication_element_t
+       fils_vendor_specific_element_t
+*/
+
+/* 11revmc D4.0 8.4.2.25 Vendor Specific element */
+typedef BWL_PRE_PACKED_STRUCT struct fils_vendor_specific_element {
+       uint8           elementid;
+       uint8           length;
+       /* variable len info */
+       uint8           orgid_vendorspecific_content[];
+} BWL_POST_PACKED_STRUCT fils_vendor_specific_element_t;
+
+#define FILS_VS_ELEM_HDR_LEN   (sizeof(fils_vendor_specific_element_t))
+
+/* 11ai D6.0 8.4.2.178 FILS Indication element */
+typedef BWL_PRE_PACKED_STRUCT struct fils_indication_element {
+       uint8           elementid;
+       uint8           length;
+       uint16          fils_info;
+       /* variable len info */
+       uint8           cache_domain_publickey_id[];
+} BWL_POST_PACKED_STRUCT fils_indication_element_t;
+
+#define FILS_INDICATION_ELEM_HDR_LEN   (sizeof(fils_indication_element_t))
+
+#define FILS_INDICATION_IE_TAG_FIXED_LEN               2
+
+#define FI_INFO_CACHE_IND_SUBFIELD_SIZE                        2
+
+/* FILS Indication Information field */
+#define FI_INFO_PUB_KEY_IDENTS_MASK            (0x0007)
+#define FI_INFO_REALM_IDENTS_MASK              (0x0038)
+#define FI_INFO_IP_ADDR_CFG_MASK               (0x0040)
+#define FI_INFO_CACHE_IDENT_MASK               (0x0080)
+#define FI_INFO_HESSID_MASK                    (0x0100)
+#define FI_INFO_SHRKEY_AUTH_WOPFS_MASK         (0x0200)
+#define FI_INFO_SHRKEY_AUTH_WPFS_MASK          (0x0400)
+#define FI_INFO_PUBKEY_AUTH_MASK               (0x0800)
+
+#define FI_INFO_CACHE_IDENT(fc)                        (((fc) & FI_INFO_CACHE_IDENT_MASK) != 0)
+#define FI_INFO_HESSID(fc)                     (((fc) & FI_INFO_HESSID_MASK) != 0)
+#define FI_INFO_SHRKEY_AUTH_WOPFS(fc)          (((fc) & FI_INFO_SHRKEY_AUTH_WOPFS_MASK) != 0)
+#define FI_INFO_SHRKEY_AUTH_WPFS(fc)           (((fc) & FI_INFO_SHRKEY_AUTH_WPFS_MASK) != 0)
+
+typedef struct ether_addr tbtt_bssid_t;
+
+/* As per D5.0 in 802.11ax Table 9 281 TBTT Information field contents . */
+
+typedef BWL_PRE_PACKED_STRUCT union rnr_tbtt_info_field {
+       BWL_PRE_PACKED_STRUCT struct len2 {
+               uint8   tbtt_offset;
+               uint8   bss_params;
+       } BWL_POST_PACKED_STRUCT len2_t;
+
+       BWL_PRE_PACKED_STRUCT struct len5 {
+               uint8   tbtt_offset;
+               uint32  short_ssid;
+       } BWL_POST_PACKED_STRUCT len5_t;
+
+       BWL_PRE_PACKED_STRUCT struct len6 {
+               uint8   tbtt_offset;
+               uint32  short_ssid;
+               uint8   bss_params;
+       } BWL_POST_PACKED_STRUCT len6_t;
+
+       BWL_PRE_PACKED_STRUCT struct len7 {
+               uint8           tbtt_offset;
+               tbtt_bssid_t    bssid;
+       } BWL_POST_PACKED_STRUCT len7_t;
+
+       BWL_PRE_PACKED_STRUCT struct len8 {
+               uint8           tbtt_offset;
+               tbtt_bssid_t    bssid;
+               uint8           bss_params;
+       } BWL_POST_PACKED_STRUCT len8_t;
+
+       BWL_PRE_PACKED_STRUCT struct len11 {
+               uint8           tbtt_offset;
+               tbtt_bssid_t    bssid;
+               uint32          short_ssid;
+       } BWL_POST_PACKED_STRUCT len11_t;
+
+       BWL_PRE_PACKED_STRUCT struct len12 {
+               uint8           tbtt_offset;
+               tbtt_bssid_t    bssid;
+               uint32          short_ssid;
+               uint8           bss_params;
+       } BWL_POST_PACKED_STRUCT len12_t;
+} BWL_POST_PACKED_STRUCT rnr_tbtt_info_field_t;
+
+/* 11ai D11.0 9.4.2.171.1 TBTT Information field */
+typedef BWL_PRE_PACKED_STRUCT struct tbtt_info_field {
+       uint8           tbtt_offset;
+       struct ether_addr bssid;
+       uint32          short_ssid;
+       uint8           bss_params;
+} BWL_POST_PACKED_STRUCT tbtt_info_field_t;
+#define TBTT_INFO_FIELD_HDR_LEN        (sizeof(tbtt_info_field_t))
+
+/* 11ai D11.0 9.4.2.171.1 Neighbor AP Information field */
+typedef BWL_PRE_PACKED_STRUCT struct neighbor_ap_info_field {
+       uint16          tbtt_info_header;
+       uint8           op_class;
+       uint8           channel;
+       /* variable len info */
+       uint8           tbtt_info_field[];
+} BWL_POST_PACKED_STRUCT neighbor_ap_info_field_t;
+
+#define NEIGHBOR_AP_INFO_FIELD_HDR_LEN (sizeof(neighbor_ap_info_field_t))
+
+/* 11ai D11.0 9.4.2.171 Reduced Neighbor Report element */
+typedef BWL_PRE_PACKED_STRUCT struct fils_rnr_element {
+       uint8           elementid;
+       uint8           length;
+       /* variable len info */
+       uint8           neighbor_ap_info[];
+} BWL_POST_PACKED_STRUCT fils_rnr_element_t;
+
+#define FILS_RNR_ELEM_HDR_LEN  (sizeof(fils_rnr_element_t))
+
+/* TBTT Info Header macros */
+#define TBTT_INFO_HDR_FIELD_TYPE_MASK          (0x0003u)
+#define TBTT_INFO_HDR_FN_AP_MASK               (0x0004u)
+#define TBTT_INFO_HDR_COUNT_MASK               (0x00f0u)
+#define TBTT_INFO_HDR_LENGTH_MASK              (0xff00u)
+
+#define TBTT_INFO_HDR_FIELD_TYPE(hdr)\
+       ((hdr) & TBTT_INFO_HDR_FIELD_TYPE_MASK)
+#define TBTT_INFO_HDR_FN_AP(hdr)\
+       (((hdr) & TBTT_INFO_HDR_FN_AP_MASK) != 0)
+#define TBTT_INFO_HDR_COUNT(hdr)\
+       (((hdr) & TBTT_INFO_HDR_COUNT_MASK) >> 4u)
+#define TBTT_INFO_HDR_LENGTH(hdr)\
+       (((hdr) & TBTT_INFO_HDR_LENGTH_MASK) >> 8u)
+
+/* BSS Params Macros */
+#define RNR_BSS_PARAMS_OCT_REC_MASK            (0x01u)
+#define RNR_BSS_PARAMS_SAME_SSID_MASK          (0x02u)
+#define RNR_BSS_PARAMS_MUTIPLE_BSSID_MASK      (0x04u)
+#define RNR_BSS_PARAMS_TRANSMITTED_BSSID_MASK  (0x08u)
+#define        RNR_BSS_MEMBER_OF_ESS_MASK              (0x10u)
+#define        RNR_BSS_20_TU_PRB_RSP_ACTIVE_MASK       (0x20u)
+#define        RNR_BSS_COLOCATED_AP_MASK               (0x40u)
+
+#define RNR_BSS_PARAMS_OCT_REC(bss)\
+       (((bss) & RNR_BSS_PARAMS_OCT_REC_MASK) != 0)
+#define RNR_BSS_PARAMS_SAME_SSID(bss)\
+       (((bss) & RNR_BSS_PARAMS_SAME_SSID_MASK) != 0)
+#define RNR_BSS_PARAMS_MUTIPLE_BSSID(bss)\
+       (((bss) & RNR_BSS_PARAMS_MUTIPLE_BSSID_MASK) != 0)
+#define RNR_BSS_PARAMS_TRANSMITTED_BSSID(bss)\
+       (((bss) & RNR_BSS_PARAMS_TRANSMITTED_BSSID_MASK) != 0)
+#define RNR_BSS_MEMBER_OF_ESS(bss)\
+       (((bss) & RNR_BSS_MEMBER_OF_ESS_MASK) != 0)
+#define RNR_BSS_20_TU_PRB_RSP_ACTIVE(bss)\
+       (((bss) & RNR_BSS_20_TU_PRB_RSP_ACTIVE_MASK) != 0)
+#define RNR_BSS_COLOCATED_AP(bss)\
+       (((bss) & RNR_BSS_COLOCATED_AP_MASK) != 0)
+
+/* TBTT Information field Contents */
+/* NBR_AP TBTT OFFSET field ( 1 Byte) */
+#define NBR_AP_TBTT_LEN                                1U
+
+/* NBR_AP TBTT OFFSETfield(1) + BSSPARAMS(1) 2Bytes */
+#define NBR_AP_TBTT_BSS_LEN                    2U
+
+/* NBR_AP TBTT OFFSETfield(1) + SHORTSSID (4) 5 Bytes */
+#define NBR_AP_TBTT_SHORT_SSID_LEN             5U
+
+/* NBR_AP TBTT OFFSETfield(1)+SHORTSSID (4)+BSS(1)  6 Bytes */
+#define NBR_AP_TBTT_BSS_SHORT_SSID_LEN         6U
+
+/* NBR_AP TBTT OFFSETfield(1) + BSSID(6) 7BYTES */
+#define NBR_AP_TBTT_BSSID_LEN                  7U
+
+/* NBR_AP TBTT OFFSETfield(1) + BSSID(6)+BSS(1) 8BYTES */
+#define NBR_AP_TBTT_BSSID_BSS_LEN              8U
+
+/* NBR_AP TBTT OFFSETfield(1) + BSSID(6)+SHORTSSID (4) 11Bytes */
+#define NBR_AP_TBTT_BSSID_SHORT_SSID_LEN       11U
+
+/*  NBR_AP TBTT OFFSETfield(1) + BSSID(6)+SHORTSSID (4)+BSS(1) 12 BYTES */
+#define NBR_AP_TBTT_BSSID_SHORT_SSID_BSS_LEN   12U
+
+/* FILS Nonce element */
+#define FILS_NONCE_LENGTH 16u
+
+typedef BWL_PRE_PACKED_STRUCT struct fils_nonce_element {
+       uint8           elementid;
+       uint8           length;
+       uint8           element_id_ext;
+       uint8           fils_nonce[FILS_NONCE_LENGTH];
+} BWL_POST_PACKED_STRUCT fils_nonce_element_t;
+
+/* 11ai 9.4.2.186 FILS Key Delivery element */
+#define FILS_KEY_RSC_LENGTH 8u
+
+typedef BWL_PRE_PACKED_STRUCT struct fils_key_delivery_element {
+       uint8           elementid;
+       uint8           length;
+       uint8           element_id_ext;
+       uint8           key_rsc[FILS_KEY_RSC_LENGTH];
+       uint8           kde_list[];     /* Key Data Elements */
+} BWL_POST_PACKED_STRUCT fils_key_delivery_element_t;
+
+/* 8.4.2.175 FILS Session element */
+#define FILS_SESSION_LENGTH 8u
+
+typedef BWL_PRE_PACKED_STRUCT struct fils_session_element {
+       uint8           elementid;
+       uint8           length;
+       uint8           element_id_ext;
+       uint8           fils_session[FILS_SESSION_LENGTH];
+} BWL_POST_PACKED_STRUCT fils_session_element_t;
+
+#define FILS_SESSION_ELEM_LEN  (sizeof(fils_session_element_t))
+
+/* 9.4.2.179 FILS key confirmation element */
+#define FILS_KEY_CONFIRMATION_HEADER_LEN 3u
+
+typedef BWL_PRE_PACKED_STRUCT struct fils_key_conf_element {
+       uint8           elementid;
+       uint8           length;
+       uint8           element_id_ext;
+       /* variable len info */
+       uint8           key_auth[];
+} BWL_POST_PACKED_STRUCT fils_key_conf_element_t;
+
+/* 8.4.2.174 FILS Key Confirmation element */
+typedef BWL_PRE_PACKED_STRUCT struct fils_key_confirm_element {
+       uint8           elementid;
+       uint8           length;
+       uint8           element_id_ext;
+       /* variable len info */
+       uint8           keyauth[];
+} BWL_POST_PACKED_STRUCT fils_key_confirm_element_t;
+
+#define FILS_CONFIRM_ELEM_HDR_LEN      (sizeof(fils_key_confirm_element_t))
+
+/* 9.4.2.180 FILS Public Key element */
+typedef BWL_PRE_PACKED_STRUCT struct fils_public_key_element {
+       uint8       elementid;
+       uint8       length;
+       uint8       element_id_ext;
+       uint8       key_type;
+       /* variable len info */
+       uint8       pub_key[];
+} BWL_POST_PACKED_STRUCT fils_public_key_element_t;
+
+/* 11ai D6.0 8.6.8.36 FILS Discovery frame format */
+typedef BWL_PRE_PACKED_STRUCT struct fils_discovery_info_field {
+       uint16          framecontrol;
+       uint32          timestamp[2];
+       uint16          bcninterval;
+       /* variable len info */
+       uint8           disc_info[];
+} BWL_POST_PACKED_STRUCT fils_discovery_info_field_t;
+
+#define FD_INFO_FIELD_HDR_LEN  (sizeof(fils_discovery_info_field_t))
+
+#define FD_INFO_CAP_SUBFIELD_SIZE                      2
+#define FD_INFO_LENGTH_FIELD_SIZE                      2
+
+/* FILS Discovery Information field */
+#define FD_INFO_SSID_LENGTH_MASK                       (0x001f)
+#define FD_INFO_CAP_IND_MASK                           (0x0020)
+#define FD_INFO_SHORT_SSID_IND_MASK                    (0x0040)
+#define FD_INFO_APCSN_IND_MASK                         (0x0080)
+#define FD_INFO_ANO_IND_MASK                           (0x0100)
+#define FD_INFO_CH_CENTER_FR_IND_MASK                  (0x0200)
+#define FD_INFO_PRIMARY_CH_IND_MASK                    (0x0400)
+#define FD_INFO_RSN_IND_MASK                           (0x0800)
+#define FD_INFO_LENGTH_IND_MASK                                (0x1000)
+#define FD_INFO_MD_IND_MASK                            (0x2000)
+
+#define FD_INFO_SET_SSID_LENGTH(fc, len)       ((fc) |= ((uint16)(len) & FD_INFO_SSID_LENGTH_MASK))
+#define FD_INFO_SET_CAP_PRESENT(fc)                    ((fc) |= FD_INFO_CAP_IND_MASK)
+#define FD_INFO_SET_SHORT_SSID_PRESENT(fc)             ((fc) |= FD_INFO_SHORT_SSID_IND_MASK)
+#define FD_INFO_SET_APCSN_PRESENT(fc)                  ((fc) |= FD_INFO_APCSN_IND_MASK)
+#define FD_INFO_SET_ANO_PRESENT(fc)                    ((fc) |= FD_INFO_ANO_IND_MASK)
+#define FD_INFO_SET_CH_CENTER_FR_PRESENT(fc)           ((fc) |= FD_INFO_CH_CENTER_FR_IND_MASK)
+#define FD_INFO_SET_PRIMARY_CH_PRESENT(fc)             ((fc) |= FD_INFO_PRIMARY_CH_IND_MASK)
+#define FD_INFO_SET_RSN_PRESENT(fc)                    ((fc) |= FD_INFO_RSN_IND_MASK)
+#define FD_INFO_SET_LENGTH_PRESENT(fc)                 ((fc) |= FD_INFO_LENGTH_IND_MASK)
+#define FD_INFO_SET_MD_PRESENT(fc)                     ((fc) |= FD_INFO_MD_IND_MASK)
+
+#define FD_INFO_SSID_LENGTH(fc)                                ((fc) & FD_INFO_SSID_LENGTH_MASK)
+#define FD_INFO_IS_CAP_PRESENT(fc)                     (((fc) & FD_INFO_CAP_IND_MASK) != 0)
+#define FD_INFO_IS_SHORT_SSID_PRESENT(fc)              (((fc) & FD_INFO_SHORT_SSID_IND_MASK) != 0)
+#define FD_INFO_IS_APCSN_PRESENT(fc)                   (((fc) & FD_INFO_APCSN_IND_MASK) != 0)
+#define FD_INFO_IS_ANO_PRESENT(fc)                     (((fc) & FD_INFO_ANO_IND_MASK) != 0)
+#define FD_INFO_IS_CH_CENTER_FR_PRESENT(fc)    (((fc) & FD_INFO_CH_CENTER_FR_IND_MASK) != 0)
+#define FD_INFO_IS_PRIMARY_CH_PRESENT(fc)              (((fc) & FD_INFO_PRIMARY_CH_IND_MASK) != 0)
+#define FD_INFO_IS_RSN_PRESENT(fc)                     (((fc) & FD_INFO_RSN_IND_MASK) != 0)
+#define FD_INFO_IS_LENGTH_PRESENT(fc)                  (((fc) & FD_INFO_LENGTH_IND_MASK) != 0)
+#define FD_INFO_IS_MD_PRESENT(fc)                      (((fc) & FD_INFO_MD_IND_MASK) != 0)
+
+/* FILS Discovery Capability subfield */
+#define FD_CAP_ESS_MASK                                (0x0001)
+#define FD_CAP_PRIVACY_MASK                    (0x0002)
+#define FD_CAP_BSS_CH_WIDTH_MASK               (0x001c)
+#define FD_CAP_MAX_NSS_MASK                    (0x00e0)
+#define FD_CAP_MULTI_BSS_MASK                  (0x0200)
+#define FD_CAP_PHY_INDEX_MASK                  (0x1c00)
+#define FD_CAP_FILS_MIN_RATE_MASK              (0xe000)
+
+#define FD_CAP_ESS(cap)                                (((cap) & FD_CAP_ESS_MASK) != 0)
+#define FD_CAP_PRIVACY(cap)                    (((cap) & FD_CAP_PRIVACY_MASK) != 0)
+#define FD_CAP_BSS_CH_WIDTH(cap)               (((cap) & FD_CAP_BSS_CH_WIDTH_MASK) >> 2)
+#define FD_CAP_MAX_NSS(cap)                    (((cap) & FD_CAP_MAX_NSS_MASK) >> 5)
+#define FD_CAP_MULTI_BSS(cap)                  (((cap) & FD_CAP_MULTI_BSS_MASK) != 0)
+#define FD_CAP_PHY_INDEX(cap)                  (((cap) & FD_CAP_PHY_INDEX_MASK) >> 10)
+#define FD_CAP_FILS_MIN_RATE(cap)              (((cap) & FD_CAP_FILS_MIN_RATE_MASK) >> 13)
+
+#define FD_CAP_SET_ESS(cap)                    (((cap) |= FD_CAP_ESS_MASK))
+#define FD_CAP_SET_PRIVACY(cap)                        (((cap) & FD_CAP_PRIVACY_MASK) >> 1)
+#define FD_CAP_SET_BSS_CH_WIDTH(cap, w)                ((cap) |= (((w) << 2) & FD_CAP_BSS_CH_WIDTH_MASK))
+#define FD_CAP_SET_MAX_NSS(cap)                        (((cap) & FD_CAP_MAX_NSS_MASK) >> 5)
+#define FD_CAP_SET_MULTI_BSS(cap)              (((cap) & FD_CAP_MULTI_BSS_MASK) >> 9)
+#define FD_CAP_SET_PHY_INDEX(cap)              (((cap) & FD_CAP_PHY_INDEX_MASK) >> 10)
+#define FD_CAP_SET_FILS_MIN_RATE(cap)          (((cap) & FD_CAP_FILS_MIN_RATE_MASK) >> 13)
+
+/* 11ai D6.0 8.4.2.173 FILS Request Parameters element */
+typedef BWL_PRE_PACKED_STRUCT struct fils_request_parameters_element {
+       uint8           elementid;
+       uint8           length;
+       uint8           element_id_ext;
+       uint8           params_bitmap;
+       /* variable len info */
+       uint8           params_fields[];
+} BWL_POST_PACKED_STRUCT fils_request_parameters_element_t;
+
+#define FILS_PARAM_MAX_CHANNEL_TIME            (1 << 2)
+
+/* 11ai 9.4.2.184 FILS HLP Container element */
+typedef BWL_PRE_PACKED_STRUCT struct fils_hlp_container_element {
+       uint8           elementid;
+       uint8           length;
+       uint8           element_id_ext;
+       uint8           dest_addr[ETHER_ADDR_LEN];
+       uint8           src_addr[ETHER_ADDR_LEN];
+       /* variable len hlp packet */
+       uint8           hlp[];
+} BWL_POST_PACKED_STRUCT fils_hlp_container_element_t;
+
+/* 11ai 9.4.2.184 FILS Wrapped Data element */
+typedef BWL_PRE_PACKED_STRUCT struct fils_wrapped_data_element {
+       uint8           elementid;
+       uint8           length;
+       uint8           element_id_ext;
+       /* variable len wrapped data packet */
+       uint8           wrapped_data[];
+} BWL_POST_PACKED_STRUCT fils_wrapped_data_element_t;
+
+#define FILS_HLP_CONTAINER_ELEM_LEN    (sizeof(fils_hlp_container_element_t))
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* __FILSAUTH_H__ */
diff --git a/bcmdhd.101.10.240.x/include/hnd_armtrap.h b/bcmdhd.101.10.240.x/include/hnd_armtrap.h
new file mode 100644 (file)
index 0000000..ca41851
--- /dev/null
@@ -0,0 +1,86 @@
+/*
+ * HND arm trap handling.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _hnd_armtrap_h_
+#define        _hnd_armtrap_h_
+
+/* ARM trap handling */
+
+/* Trap types defined by ARM (see arminc.h) */
+
+/* Trap locations in lo memory */
+#define        TRAP_STRIDE     4
+#define FIRST_TRAP     TR_RST
+#define LAST_TRAP      (TR_FIQ * TRAP_STRIDE)
+
+#if defined(__ARM_ARCH_7M__)
+#define        MAX_TRAP_TYPE   (TR_ISR + ARMCM3_NUMINTS)
+#endif /* __ARM_ARCH_7M__ */
+
+/* The trap structure is defined here as offsets for assembly */
+#define        TR_TYPE         0x00
+#define        TR_EPC          0x04
+#define        TR_CPSR         0x08
+#define        TR_SPSR         0x0c
+#define        TR_REGS         0x10
+#define        TR_REG(n)       (TR_REGS + (n) * 4)
+#define        TR_SP           TR_REG(13)
+#define        TR_LR           TR_REG(14)
+#define        TR_PC           TR_REG(15)
+
+/* Number of core ARM registers. */
+#define        TR_REGS_NUM     16u
+
+#define        TRAP_T_SIZE     80
+#define ASSERT_TRAP_SVC_NUMBER 255
+
+#ifndef        _LANGUAGE_ASSEMBLY
+
+#include <typedefs.h>
+
+typedef struct _trap_struct {
+       uint32          type;
+       uint32          epc;
+       uint32          cpsr;
+       uint32          spsr;
+       uint32          r0;     /* a1 */
+       uint32          r1;     /* a2 */
+       uint32          r2;     /* a3 */
+       uint32          r3;     /* a4 */
+       uint32          r4;     /* v1 */
+       uint32          r5;     /* v2 */
+       uint32          r6;     /* v3 */
+       uint32          r7;     /* v4 */
+       uint32          r8;     /* v5 */
+       uint32          r9;     /* sb/v6 */
+       uint32          r10;    /* sl/v7 */
+       uint32          r11;    /* fp/v8 */
+       uint32          r12;    /* ip */
+       uint32          r13;    /* sp */
+       uint32          r14;    /* lr */
+       uint32          pc;     /* r15 */
+} trap_t;
+
+#endif /* !_LANGUAGE_ASSEMBLY */
+
+#endif /* _hnd_armtrap_h_ */
diff --git a/bcmdhd.101.10.240.x/include/hnd_cons.h b/bcmdhd.101.10.240.x/include/hnd_cons.h
new file mode 100644 (file)
index 0000000..eb52458
--- /dev/null
@@ -0,0 +1,80 @@
+/*
+ * Console support for RTE - for host use only.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+#ifndef        _hnd_cons_h_
+#define        _hnd_cons_h_
+
+#include <typedefs.h>
+
+#define CBUF_LEN       (128)
+
+#ifndef LOG_BUF_LEN
+#if defined(BCM_BIG_LOG)
+#define LOG_BUF_LEN    (16 * 1024)
+#else
+#define LOG_BUF_LEN    1024
+#endif
+#endif /* LOG_BUF_LEN */
+
+#ifdef BOOTLOADER_CONSOLE_OUTPUT
+#undef RWL_MAX_DATA_LEN
+#undef CBUF_LEN
+#undef LOG_BUF_LEN
+#define RWL_MAX_DATA_LEN (4 * 1024 + 8)
+#define CBUF_LEN       (RWL_MAX_DATA_LEN + 64)
+#define LOG_BUF_LEN (16 * 1024)
+#endif
+
+typedef struct {
+       uint32          buf;            /* Can't be pointer on (64-bit) hosts */
+       uint            buf_size;
+       uint            idx;
+       uint            out_idx;        /* output index */
+       uint            dump_idx;       /* read idx for wl dump */
+} hnd_log_t;
+
+typedef struct {
+       /* Virtual UART
+        *   When there is no UART (e.g. Quickturn), the host should write a complete
+        *   input line directly into cbuf and then write the length into vcons_in.
+        *   This may also be used when there is a real UART (at risk of conflicting with
+        *   the real UART).  vcons_out is currently unused.
+        */
+       volatile uint   vcons_in;
+       volatile uint   vcons_out;
+
+       /* Output (logging) buffer
+        *   Console output is written to a ring buffer log_buf at index log_idx.
+        *   The host may read the output when it sees log_idx advance.
+        *   Output will be lost if the output wraps around faster than the host polls.
+        */
+       hnd_log_t       log;
+
+       /* Console input line buffer
+        *   Characters are read one at a time into cbuf until <CR> is received, then
+        *   the buffer is processed as a command line.  Also used for virtual UART.
+        */
+       uint            cbuf_idx;
+       char            cbuf[CBUF_LEN];
+} hnd_cons_t;
+
+#endif /* _hnd_cons_h_ */
diff --git a/bcmdhd.101.10.240.x/include/hnd_debug.h b/bcmdhd.101.10.240.x/include/hnd_debug.h
new file mode 100644 (file)
index 0000000..c51a566
--- /dev/null
@@ -0,0 +1,234 @@
+/*
+ * HND Run Time Environment debug info area
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _HND_DEBUG_H
+#define        _HND_DEBUG_H
+
+/* Magic number at a magic location to find HND_DEBUG pointers */
+#define HND_DEBUG_PTR_PTR_MAGIC 0x50504244u    /* DBPP */
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+#include <typedefs.h>
+
+/* Includes only when building dongle code */
+
+/* We use explicit sizes here since this gets included from different
+ * systems.  The sizes must be the size of the creating system
+ * (currently 32 bit ARM) since this is gleaned from  dump.
+ */
+
+#ifdef FWID
+extern uint32 gFWID;
+#endif
+
+enum hnd_debug_reloc_entry_type {
+       HND_DEBUG_RELOC_ENTRY_TYPE_ROM          = 0u,
+       HND_DEBUG_RELOC_ENTRY_TYPE_RAM          = 1u,
+       HND_DEBUG_RELOC_ENTRY_TYPE_MTH_STACK    = 2u, /* main thread stack */
+};
+typedef uint32 hnd_debug_reloc_entry_type_t;
+
+typedef struct hnd_debug_reloc_entry {
+       /* Identifies the type(hnd_debug_reloc_entry_type) of the data */
+       hnd_debug_reloc_entry_type_t type;
+       uint32 phys_addr;               /* Physical address */
+       uint32 virt_addr;               /* Virtual address */
+       uint32 size;                    /* Specifies the size of the segment */
+} hnd_debug_reloc_entry_t;
+
+/* Define pointers for use on other systems */
+#define _HD_EVLOG_P            uint32
+#define _HD_CONS_P             uint32
+#define _HD_TRAP_P             uint32
+#define _HD_DEBUG_RELOC_ENTRY_P        uint32
+#define _HD_DEBUG_RELOC_P      uint32
+
+/* MMU relocation info in the debug area */
+typedef struct hnd_debug_reloc {
+       _HD_DEBUG_RELOC_ENTRY_P hnd_reloc_ptr;  /* contains the pointer to the MMU reloc table */
+       uint32 hnd_reloc_ptr_size;              /* Specifies the size of the MMU reloc table */
+} hnd_debug_reloc_t;
+
+/* Number of MMU relocation entries supported in v2 */
+#define RELOC_NUM_ENTRIES              4u
+
+/* Total MMU relocation table size for v2 */
+#define HND_DEBUG_RELOC_PTR_SIZE       (RELOC_NUM_ENTRIES * sizeof(hnd_debug_reloc_entry_t))
+
+#define HND_DEBUG_VERSION_1    1u      /* Legacy, version 1 */
+#define HND_DEBUG_VERSION_2    2u      /* Version 2 contains the MMU information
+                                        * used for stack virtualization, etc.
+                                        */
+
+/* Legacy debug version for older branches. */
+#define HND_DEBUG_VERSION      HND_DEBUG_VERSION_1
+
+/* This struct is placed at a well-defined location, and contains a pointer to hnd_debug. */
+typedef struct hnd_debug_ptr {
+       uint32  magic;
+
+       /* RAM address of 'hnd_debug'. For legacy versions of this struct, it is a 0-indexed
+        * offset instead.
+        */
+       uint32  hnd_debug_addr;
+
+       /* Base address of RAM. This field does not exist for legacy versions of this struct.  */
+       uint32  ram_base_addr;
+
+} hnd_debug_ptr_t;
+extern hnd_debug_ptr_t debug_info_ptr;
+
+#define  HND_DEBUG_EPIVERS_MAX_STR_LEN         32u
+
+/* chip id string is 8 bytes long with null terminator. Example 43452a3 */
+#define  HND_DEBUG_BUILD_SIGNATURE_CHIPID_LEN  13u
+
+#define  HND_DEBUG_BUILD_SIGNATURE_FWID_LEN    17u
+
+/* ver=abc.abc.abc.abcdefgh size = 24bytes. 6 bytes extra for expansion */
+#define  HND_DEBUG_BUILD_SIGNATURE_VER_LEN     30u
+
+typedef struct hnd_debug {
+       uint32  magic;
+#define HND_DEBUG_MAGIC 0x47424544u    /* 'DEBG' */
+
+#ifndef HND_DEBUG_USE_V2
+       uint32  version;                /* Legacy, debug struct version */
+#else
+       /* Note: The original uint32 version is split into two fields:
+        * uint16 version and uint16 length to accomidate future expansion
+        * of the strucutre.
+        *
+        * The length field is not populated for the version 1 of the structure.
+        */
+       uint16  version;                /* Debug struct version */
+       uint16  length;                 /* Size of the whole structure in bytes */
+#endif /* HND_DEBUG_USE_V2 */
+
+       uint32  fwid;                   /* 4 bytes of fw info */
+       char    epivers[HND_DEBUG_EPIVERS_MAX_STR_LEN];
+
+       _HD_TRAP_P PHYS_ADDR_N(trap_ptr);       /* trap_t data struct physical address. */
+       _HD_CONS_P PHYS_ADDR_N(console);        /* Console physical address. */
+
+       uint32  ram_base;
+       uint32  ram_size;
+
+       uint32  rom_base;
+       uint32  rom_size;
+
+       _HD_EVLOG_P PHYS_ADDR_N(event_log_top); /* EVENT_LOG physical address. */
+
+       /* To populated fields below,
+        * INCLUDE_BUILD_SIGNATURE_IN_SOCRAM needs to be enabled
+        */
+       char fwid_signature[HND_DEBUG_BUILD_SIGNATURE_FWID_LEN]; /* fwid=<FWID> */
+       /* ver=abc.abc.abc.abcdefgh size = 24bytes. 6 bytes extra for expansion */
+       char ver_signature[HND_DEBUG_BUILD_SIGNATURE_VER_LEN];
+       char chipid_signature[HND_DEBUG_BUILD_SIGNATURE_CHIPID_LEN]; /* chip=12345a3 */
+
+#ifdef HND_DEBUG_USE_V2
+       /* Version 2 fields */
+       /* Specifies the hnd debug MMU info */
+       _HD_DEBUG_RELOC_P       hnd_debug_reloc_ptr;
+#endif /* HND_DEBUG_USE_V2 */
+} hnd_debug_t;
+
+#ifdef HND_DEBUG_USE_V2
+#define HND_DEBUG_V1_SIZE       (OFFSETOF(hnd_debug_t, chipid_signature) + \
+                                sizeof(((hnd_debug_t *)0)->chipid_signature))
+
+#define HND_DEBUG_V2_BASE_SIZE  (OFFSETOF(hnd_debug_t, hnd_debug_reloc_ptr) + \
+                                sizeof(((hnd_debug_t *)0)->hnd_debug_reloc_ptr))
+#endif /* HND_DEBUG_USE_V2 */
+
+/* The following structure is used in populating build information */
+typedef struct hnd_build_info {
+       uint8 version; /* Same as HND_DEBUG_VERSION */
+       uint8 rsvd[3]; /* Reserved fields for padding purposes */
+       /* To populated fields below,
+        * INCLUDE_BUILD_SIGNATURE_IN_SOCRAM needs to be enabled
+        */
+       uint32 fwid;
+       uint32 ver[4];
+       char chipid_signature[HND_DEBUG_BUILD_SIGNATURE_CHIPID_LEN]; /* chip=12345a3 */
+} hnd_build_info_t;
+
+/*
+ * timeval_t and prstatus_t are copies of the Linux structures.
+ * Included here because we need the definitions for the target processor
+ * (32 bits) and not the definition on the host this is running on
+ * (which could be 64 bits).
+ */
+
+typedef struct             {    /* Time value with microsecond resolution    */
+       uint32 tv_sec;  /* Seconds                                   */
+       uint32 tv_usec; /* Microseconds                              */
+} timeval_t;
+
+/* Linux/ARM 32 prstatus for notes section */
+typedef struct prstatus {
+         int32 si_signo;       /* Signal number */
+         int32 si_code;        /* Extra code */
+         int32 si_errno;       /* Errno */
+         uint16 pr_cursig;     /* Current signal.  */
+         uint16 unused;
+         uint32 pr_sigpend;    /* Set of pending signals.  */
+         uint32 pr_sighold;    /* Set of held signals.  */
+         uint32 pr_pid;
+         uint32 pr_ppid;
+         uint32 pr_pgrp;
+         uint32 pr_sid;
+         timeval_t pr_utime;   /* User time.  */
+         timeval_t pr_stime;   /* System time.  */
+         timeval_t pr_cutime;  /* Cumulative user time.  */
+         timeval_t pr_cstime;  /* Cumulative system time.  */
+         uint32 uregs[18];
+         int32 pr_fpvalid;     /* True if math copro being used.  */
+} prstatus_t;
+
+/* for mkcore and other utilities use */
+#define DUMP_INFO_PTR_PTR_0   0x74
+#define DUMP_INFO_PTR_PTR_1   0x78
+#define DUMP_INFO_PTR_PTR_2   0xf0
+#define DUMP_INFO_PTR_PTR_3   0xf8
+#define DUMP_INFO_PTR_PTR_4   0x874
+#define DUMP_INFO_PTR_PTR_5   0x878
+#define DUMP_INFO_PTR_PTR_END 0xffffffff
+#define DUMP_INFO_PTR_PTR_LIST DUMP_INFO_PTR_PTR_0, \
+               DUMP_INFO_PTR_PTR_1,                                    \
+               DUMP_INFO_PTR_PTR_2,                                    \
+               DUMP_INFO_PTR_PTR_3,                                    \
+               DUMP_INFO_PTR_PTR_4,                                    \
+               DUMP_INFO_PTR_PTR_5,                                    \
+               DUMP_INFO_PTR_PTR_END
+
+extern bool hnd_debug_info_in_trap_context(void);
+
+/* Get build information. */
+extern int hnd_build_info_get(void *ctx, void *arg2, uint32 *buf, uint16 *len);
+
+#endif /* !LANGUAGE_ASSEMBLY */
+
+#endif /* _HND_DEBUG_H */
diff --git a/bcmdhd.101.10.240.x/include/hnd_pktpool.h b/bcmdhd.101.10.240.x/include/hnd_pktpool.h
new file mode 100644 (file)
index 0000000..7ef32da
--- /dev/null
@@ -0,0 +1,287 @@
+/*
+ * HND generic packet pool operation primitives
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _hnd_pktpool_h_
+#define _hnd_pktpool_h_
+
+#include <typedefs.h>
+#include <osl.h>
+#include <osl_ext.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* mutex macros for thread safe */
+#ifdef HND_PKTPOOL_THREAD_SAFE
+#define HND_PKTPOOL_MUTEX_DECL(mutex)          OSL_EXT_MUTEX_DECL(mutex)
+#else
+#define HND_PKTPOOL_MUTEX_DECL(mutex)
+#endif
+
+#ifdef BCMPKTPOOL
+#define POOL_ENAB(pool)                ((pool) && (pool)->inited)
+#else /* BCMPKTPOOL */
+#define POOL_ENAB(bus)         0
+#endif /* BCMPKTPOOL */
+
+#ifndef PKTPOOL_LEN_MAX
+#define PKTPOOL_LEN_MAX                40
+#endif /* PKTPOOL_LEN_MAX */
+#define PKTPOOL_CB_MAX         3
+#define PKTPOOL_CB_MAX_AVL     4
+
+/* REMOVE_RXCPLID is an arg for pktpool callback function for removing rxcplID
+ * and host addr associated with the rxfrag or shared pool buffer during pktpool_reclaim().
+ */
+#define REMOVE_RXCPLID            2
+
+#define FREE_ALL_PKTS          0
+#define FREE_ALL_FRAG_PKTS     1
+
+/* forward declaration */
+struct pktpool;
+
+typedef void (*pktpool_cb_t)(struct pktpool *pool, void *arg);
+typedef struct {
+       pktpool_cb_t cb;
+       void *arg;
+       uint8 refcnt;
+} pktpool_cbinfo_t;
+
+/** PCIe SPLITRX related: call back fn extension to populate host address in pool pkt */
+typedef int (*pktpool_cb_extn_t)(struct pktpool *pool, void *arg1, void* pkt, int arg2);
+typedef struct {
+       pktpool_cb_extn_t cb;
+       void *arg;
+} pktpool_cbextn_info_t;
+
+#ifdef BCMDBG_POOL
+/* pkt pool debug states */
+#define POOL_IDLE      0
+#define POOL_RXFILL    1
+#define POOL_RXDH      2
+#define POOL_RXD11     3
+#define POOL_TXDH      4
+#define POOL_TXD11     5
+#define POOL_AMPDU     6
+#define POOL_TXENQ     7
+
+typedef struct {
+       void *p;
+       uint32 cycles;
+       uint32 dur;
+} pktpool_dbg_t;
+
+typedef struct {
+       uint8 txdh;     /* tx to host */
+       uint8 txd11;    /* tx to d11 */
+       uint8 enq;      /* waiting in q */
+       uint8 rxdh;     /* rx from host */
+       uint8 rxd11;    /* rx from d11 */
+       uint8 rxfill;   /* dma_rxfill */
+       uint8 idle;     /* avail in pool */
+} pktpool_stats_t;
+#endif /* BCMDBG_POOL */
+
+typedef struct pktpool {
+       bool inited;            /**< pktpool_init was successful */
+       uint8 type;             /**< type of lbuf: basic, frag, etc */
+       uint8 id;               /**< pktpool ID:  index in registry */
+       bool istx;              /**< direction: transmit or receive data path */
+       HND_PKTPOOL_MUTEX_DECL(mutex)   /**< thread-safe mutex */
+
+       void * freelist;        /**< free list: see PKTNEXTFREE(), PKTSETNEXTFREE() */
+       uint16 avail;           /**< number of packets in pool's free list */
+       uint16 n_pkts;             /**< number of packets managed by pool */
+       uint16 maxlen;          /**< maximum size of pool <= PKTPOOL_LEN_MAX */
+       uint16 max_pkt_bytes;   /**< size of pkt buffer in [bytes], excluding lbuf|lbuf_frag */
+
+       bool empty;
+       uint8 cbtoggle;
+       uint8 cbcnt;
+       uint8 ecbcnt;
+       uint8 emptycb_disable;  /**< Value of type enum pktpool_empty_cb_state */
+       pktpool_cbinfo_t *availcb_excl;
+       pktpool_cbinfo_t cbs[PKTPOOL_CB_MAX_AVL];
+       pktpool_cbinfo_t ecbs[PKTPOOL_CB_MAX];
+       pktpool_cbextn_info_t cbext;    /**< PCIe SPLITRX related */
+       pktpool_cbextn_info_t rxcplidfn;
+       pktpool_cbinfo_t dmarxfill;
+       /* variables for pool_heap management */
+       uint32 poolheap_flag;
+       uint16 poolheap_count;  /* Number of allocation done from this pool */
+       uint16 min_backup_buf;  /* Minimum number of buffer that should be kept in pool */
+       bool is_heap_pool;      /* Whether this pool can be used as heap */
+       bool release_active;
+       uint8 mem_handle;
+#ifdef BCMDBG_POOL
+       uint8 dbg_cbcnt;
+       pktpool_cbinfo_t dbg_cbs[PKTPOOL_CB_MAX];
+       uint16 dbg_qlen;
+       pktpool_dbg_t dbg_q[PKTPOOL_LEN_MAX + 1];
+#endif
+} pktpool_t;
+
+pktpool_t *get_pktpools_registry(int id);
+#define pktpool_get(pktp)      (pktpool_get_ext((pktp), (pktp)->type))
+
+/* Incarnate a pktpool registry. On success returns total_pools. */
+extern int pktpool_attach(osl_t *osh, uint32 total_pools);
+extern int pktpool_dettach(osl_t *osh); /* Relinquish registry */
+
+extern int pktpool_init(osl_t *osh, pktpool_t *pktp, int *pktplen, int plen, bool istx, uint8 type,
+       bool is_heap_pool, uint32 heap_pool_flag, uint16 min_backup_buf);
+extern int pktpool_deinit(osl_t *osh, pktpool_t *pktp);
+extern int pktpool_fill(osl_t *osh, pktpool_t *pktp, bool minimal);
+extern int pktpool_empty(osl_t *osh, pktpool_t *pktp);
+extern uint16 pktpool_reclaim(osl_t *osh, pktpool_t *pktp, uint16 free_cnt, uint8 action);
+extern void* pktpool_get_ext(pktpool_t *pktp, uint8 type);
+extern void pktpool_free(pktpool_t *pktp, void *p);
+extern int pktpool_add(pktpool_t *pktp, void *p);
+extern int pktpool_avail_notify_normal(osl_t *osh, pktpool_t *pktp);
+extern int pktpool_avail_notify_exclusive(osl_t *osh, pktpool_t *pktp, pktpool_cb_t cb);
+extern int pktpool_avail_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+extern int pktpool_avail_deregister(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+extern int pktpool_empty_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+extern int pktpool_setmaxlen(pktpool_t *pktp, uint16 max_pkts);
+extern int pktpool_setmaxlen_strict(osl_t *osh, pktpool_t *pktp, uint16 max_pkts);
+extern void pktpool_emptycb_disable(pktpool_t *pktp, bool disable);
+extern bool pktpool_emptycb_disabled(pktpool_t *pktp);
+extern int pktpool_hostaddr_fill_register(pktpool_t *pktp, pktpool_cb_extn_t cb, void *arg1);
+extern int pktpool_rxcplid_fill_register(pktpool_t *pktp, pktpool_cb_extn_t cb, void *arg);
+extern void pktpool_invoke_dmarxfill(pktpool_t *pktp);
+extern int pkpool_haddr_avail_register_cb(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+extern int pktpool_avail(pktpool_t *pktpool);
+#ifdef BCMD11HDRPOOL
+extern int d11hdr_pool_init(osl_t *osh, pktpool_t *pktp, uint *n_pkts, uint max_pkt_bytes,
+       bool istx, uint8 type, bool is_heap_pool, uint32 heap_pool_flag, uint16 min_backup_buf);
+extern int d11hdr_pool_deinit(osl_t *osh, pktpool_t *pktp);
+extern int d11hdr_pool_fill(osl_t *osh, pktpool_t *pktp, bool minimal);
+extern void d11hdr_pool_enq(pktpool_t *pktp, void *p);
+extern void *d11hdr_pool_deq(pktpool_t *pktp);
+#define D11HDRGET(pktp)          (void *)d11hdr_pool_deq((pktp))
+#define D11HDRFREE(pktp, p)    d11hdr_pool_enq((pktp), (p))
+#define D11HDRAVAIL()          (D11HDR_POOL->avail)
+#else
+#define d11hdr_pool_fill(osh, pktp, minimal)  BCME_OK
+#define D11HDRAVAIL(pktp)        (TRUE)
+#endif /* BCMD11HDRPOOL */
+
+#define POOLPTR(pp)         ((pktpool_t *)(pp))
+#define POOLID(pp)          (POOLPTR(pp)->id)
+
+#define POOLSETID(pp, ppid) (POOLPTR(pp)->id = (ppid))
+
+#define pktpool_tot_pkts(pp)  (POOLPTR(pp)->n_pkts)   /**< n_pkts = avail + in_use <= max_pkts */
+#define pktpool_max_pkt_bytes(pp)    (POOLPTR(pp)->max_pkt_bytes)
+#define pktpool_max_pkts(pp)  (POOLPTR(pp)->maxlen)
+
+/*
+ * ----------------------------------------------------------------------------
+ * A pool ID is assigned with a pkt pool during pool initialization. This is
+ * done by maintaining a registry of all initialized pools, and the registry
+ * index at which the pool is registered is used as the pool's unique ID.
+ * ID 0 is reserved and is used to signify an invalid pool ID.
+ * All packets henceforth allocated from a pool will be tagged with the pool's
+ * unique ID. Packets allocated from the heap will use the reserved ID = 0.
+ * Packets with non-zero pool id signify that they were allocated from a pool.
+ * A maximum of 15 pools are supported, allowing a 4bit pool ID to be used
+ * in place of a 32bit pool pointer in each packet.
+ * ----------------------------------------------------------------------------
+ */
+#define PKTPOOL_INVALID_ID          (0)
+#define PKTPOOL_MAXIMUM_ID          (15)
+
+/* Registry of pktpool(s) */
+/* Pool ID to/from Pool Pointer converters */
+#define PKTPOOL_ID2PTR(id)          (get_pktpools_registry(id))
+#define PKTPOOL_PTR2ID(pp)          (POOLID(pp))
+
+#ifdef BCMDBG_POOL
+extern int pktpool_dbg_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+extern int pktpool_start_trigger(pktpool_t *pktp, void *p);
+extern int pktpool_dbg_dump(pktpool_t *pktp);
+extern int pktpool_dbg_notify(pktpool_t *pktp);
+extern int pktpool_stats_dump(pktpool_t *pktp, pktpool_stats_t *stats);
+#endif /* BCMDBG_POOL */
+
+#ifdef BCMPKTPOOL
+#define SHARED_POOL            (pktpool_shared)
+extern pktpool_t *pktpool_shared;
+#ifdef BCMFRAGPOOL
+#define SHARED_FRAG_POOL       (pktpool_shared_lfrag)
+extern pktpool_t *pktpool_shared_lfrag;
+#endif
+
+#ifdef BCMRESVFRAGPOOL
+#define RESV_FRAG_POOL         (pktpool_resv_lfrag)
+#define RESV_POOL_INFO         (resv_pool_info)
+#else
+#define RESV_FRAG_POOL         ((struct pktpool *)NULL)
+#define RESV_POOL_INFO         (NULL)
+#endif /* BCMRESVFRAGPOOL */
+
+#ifdef BCMD11HDRPOOL
+#define D11HDR_POOL            (pktpool_d11hdr)
+extern pktpool_t *pktpool_d11hdr;
+#endif /* BCMD11HDRPOOL */
+
+/** PCIe SPLITRX related */
+#define SHARED_RXFRAG_POOL     (pktpool_shared_rxlfrag)
+extern pktpool_t *pktpool_shared_rxlfrag;
+
+int hnd_pktpool_init(osl_t *osh);
+void hnd_pktpool_deinit(osl_t *osh);
+int hnd_pktpool_fill(pktpool_t *pktpool, bool minimal);
+void hnd_pktpool_refill(bool minimal);
+
+#ifdef BCMRESVFRAGPOOL
+extern pktpool_t *pktpool_resv_lfrag;
+extern struct resv_info *resv_pool_info;
+#endif /* BCMRESVFRAGPOOL */
+
+/* Current identified use case flags for pool heap manager */
+#define POOL_HEAP_FLAG_D3      (1 << 0)
+#define POOL_HEAP_FLAG_RSRVPOOL        (1 << 1)
+
+#ifdef POOL_HEAP_RECONFIG
+typedef void (*pktpool_heap_cb_t)(void *arg, bool entry);
+
+extern void hnd_pktpool_heap_handle(osl_t *osh, uint32 flag, bool enable);
+extern int hnd_pktpool_heap_register_cb(pktpool_heap_cb_t fn, void *ctxt, uint32 flag);
+extern int hnd_pktpool_heap_deregister_cb(pktpool_heap_cb_t fn);
+extern void *hnd_pktpool_freelist_alloc(uint size, uint alignbits, uint32 flag);
+extern uint16 hnd_pktpool_get_min_bkup_buf(pktpool_t *pktp);
+#endif /* POOL_HEAP_RECONFIG */
+extern uint32 hnd_pktpool_get_total_poolheap_count(void);
+
+#else /* BCMPKTPOOL */
+#define SHARED_POOL            ((struct pktpool *)NULL)
+#endif /* BCMPKTPOOL */
+
+#ifdef __cplusplus
+       }
+#endif
+
+#endif /* _hnd_pktpool_h_ */
diff --git a/bcmdhd.101.10.240.x/include/hnd_pktq.h b/bcmdhd.101.10.240.x/include/hnd_pktq.h
new file mode 100644 (file)
index 0000000..8fd76a0
--- /dev/null
@@ -0,0 +1,329 @@
+/*
+ * HND generic pktq operation primitives
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _hnd_pktq_h_
+#define _hnd_pktq_h_
+
+#include <osl.h>
+#include <osl_ext.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* mutex macros for thread safe */
+#ifdef HND_PKTQ_THREAD_SAFE
+#define HND_PKTQ_MUTEX_DECL(mutex)             OSL_EXT_MUTEX_DECL(mutex)
+#else
+#define HND_PKTQ_MUTEX_DECL(mutex)
+#endif
+
+/* osl multi-precedence packet queue */
+#define PKTQ_LEN_MAX            0xFFFFu  /* Max uint16 65535 packets */
+#ifndef PKTQ_LEN_DEFAULT
+#define PKTQ_LEN_DEFAULT        128u   /* Max 128 packets */
+#endif
+#ifndef PKTQ_MAX_PREC
+#define PKTQ_MAX_PREC           16     /* Maximum precedence levels */
+#endif
+
+/** Queue for a single precedence level */
+typedef struct pktq_prec {
+       void *head;     /**< first packet to dequeue */
+       void *tail;     /**< last packet to dequeue */
+       uint16 n_pkts;       /**< number of queued packets */
+       uint16 max_pkts;     /**< maximum number of queued packets */
+       uint16 stall_count;    /**< # seconds since no packets are dequeued  */
+       uint16 dequeue_count;  /**< # of packets dequeued in last 1 second */
+} pktq_prec_t;
+
+#ifdef PKTQ_LOG
+typedef struct {
+       uint32 requested;    /**< packets requested to be stored */
+       uint32 stored;       /**< packets stored */
+       uint32 saved;        /**< packets saved,
+                                   because a lowest priority queue has given away one packet
+                             */
+       uint32 selfsaved;    /**< packets saved,
+                                   because an older packet from the same queue has been dropped
+                             */
+       uint32 full_dropped; /**< packets dropped,
+                                   because pktq is full with higher precedence packets
+                             */
+       uint32 dropped;      /**< packets dropped because pktq per that precedence is full */
+       uint32 sacrificed;   /**< packets dropped,
+                                   in order to save one from a queue of a highest priority
+                             */
+       uint32 busy;         /**< packets droped because of hardware/transmission error */
+       uint32 retry;        /**< packets re-sent because they were not received */
+       uint32 ps_retry;     /**< packets retried again prior to moving power save mode */
+       uint32 suppress;     /**< packets which were suppressed and not transmitted */
+       uint32 retry_drop;   /**< packets finally dropped after retry limit */
+       uint32 max_avail;    /**< the high-water mark of the queue capacity for packets -
+                                   goes to zero as queue fills
+                             */
+       uint32 max_used;     /**< the high-water mark of the queue utilisation for packets -
+                                                       increases with use ('inverse' of max_avail)
+                                         */
+       uint32 queue_capacity; /**< the maximum capacity of the queue */
+       uint32 rtsfail;        /**< count of rts attempts that failed to receive cts */
+       uint32 acked;          /**< count of packets sent (acked) successfully */
+       uint32 txrate_succ;    /**< running total of phy rate of packets sent successfully */
+       uint32 txrate_main;    /**< running totoal of primary phy rate of all packets */
+       uint32 throughput;     /**< actual data transferred successfully */
+       uint32 airtime;        /**< cumulative total medium access delay in useconds */
+       uint32  _logtime;      /**< timestamp of last counter clear  */
+} pktq_counters_t;
+
+#define PKTQ_LOG_COMMON \
+       uint32                  pps_time;       /**< time spent in ps pretend state */ \
+       uint32                  _prec_log;
+
+typedef struct {
+       PKTQ_LOG_COMMON
+       pktq_counters_t*        _prec_cnt[PKTQ_MAX_PREC];     /**< Counters per queue  */
+} pktq_log_t;
+#else
+typedef struct pktq_log pktq_log_t;
+#endif /* PKTQ_LOG */
+
+/** multi-priority packet queue */
+struct pktq {
+       HND_PKTQ_MUTEX_DECL(mutex)
+       pktq_log_t *pktqlog;
+       uint16 num_prec;        /**< number of precedences in use */
+       uint16 hi_prec;         /**< rapid dequeue hint (>= highest non-empty prec) */
+       uint16 max_pkts;        /**< max  packets */
+       uint16 n_pkts_tot;      /**< total (cummulative over all precedences) number of packets */
+       /* q array must be last since # of elements can be either PKTQ_MAX_PREC or 1 */
+       struct pktq_prec q[PKTQ_MAX_PREC];
+};
+
+/** simple, non-priority packet queue */
+struct spktq {
+       HND_PKTQ_MUTEX_DECL(mutex)
+       struct pktq_prec q;
+};
+
+#define PKTQ_PREC_ITER(pq, prec)        for (prec = (pq)->num_prec - 1; prec >= 0; prec--)
+
+/* fn(pkt, arg).  return true if pkt belongs to bsscfg */
+typedef bool (*ifpkt_cb_t)(void*, int);
+
+/*
+ * pktq filter support
+ */
+
+/** filter function return values */
+typedef enum {
+       PKT_FILTER_NOACTION = 0,    /**< restore the pkt to its position in the queue */
+       PKT_FILTER_DELETE = 1,      /**< delete the pkt */
+       PKT_FILTER_REMOVE = 2,      /**< do not restore the pkt to the queue,
+                                    *   filter fn has taken ownership of the pkt
+                                    */
+} pktq_filter_result_t;
+
+/**
+ * Caller supplied filter function to pktq_pfilter(), pktq_filter().
+ * Function filter(ctx, pkt) is called with its ctx pointer on each pkt in the
+ * pktq.  When the filter function is called, the supplied pkt will have been
+ * unlinked from the pktq.  The filter function returns a pktq_filter_result_t
+ * result specifying the action pktq_filter()/pktq_pfilter() should take for
+ * the pkt.
+ * Here are the actions taken by pktq_filter/pfilter() based on the supplied
+ * filter function's return value:
+ *
+ * PKT_FILTER_NOACTION - The filter will re-link the pkt at its
+ *     previous location.
+ *
+ * PKT_FILTER_DELETE - The filter will not relink the pkt and will
+ *     call the user supplied defer_free_pkt fn on the packet.
+ *
+ * PKT_FILTER_REMOVE - The filter will not relink the pkt. The supplied
+ *     filter fn took ownership (or deleted) the pkt.
+ *
+ * WARNING: pkts inserted by the user (in pkt_filter and/or flush callbacks
+ * and chains) in the prec queue will not be seen by the filter, and the prec
+ * queue will be temporarily be removed from the queue hence there're side
+ * effects including pktq_n_pkts_tot() on the queue won't reflect the correct number
+ * of packets in the queue.
+ */
+
+typedef pktq_filter_result_t (*pktq_filter_t)(void* ctx, void* pkt);
+
+/**
+ * The defer_free_pkt callback is invoked when the the pktq_filter callback
+ * returns PKT_FILTER_DELETE decision, which allows the user to deposite
+ * the packet appropriately based on the situation (free the packet or
+ * save it in a temporary queue etc.).
+ */
+typedef void (*defer_free_pkt_fn_t)(void *ctx, void *pkt);
+
+/**
+ * The flush_free_pkt callback is invoked when all packets in the pktq
+ * are processed.
+ */
+typedef void (*flush_free_pkt_fn_t)(void *ctx);
+
+#if defined(PROP_TXSTATUS)
+/* this callback will be invoked when in low_txq_scb flush()
+ *  two back-to-back pkts has same epoch value.
+ */
+typedef void (*flip_epoch_t)(void *ctx, void *pkt, uint8 *flipEpoch, uint8 *lastEpoch);
+#endif /* defined(PROP_TXSTATUS) */
+
+/** filter a pktq, using the caller supplied filter/deposition/flush functions */
+extern void  pktq_filter(struct pktq *pq, pktq_filter_t fn, void* arg,
+       defer_free_pkt_fn_t defer, void *defer_ctx, flush_free_pkt_fn_t flush, void *flush_ctx);
+/** filter a particular precedence in pktq, using the caller supplied filter function */
+extern void  pktq_pfilter(struct pktq *pq, int prec, pktq_filter_t fn, void* arg,
+       defer_free_pkt_fn_t defer, void *defer_ctx, flush_free_pkt_fn_t flush, void *flush_ctx);
+/** filter a simple non-precedence in spktq, using the caller supplied filter function */
+extern void spktq_filter(struct spktq *spq, pktq_filter_t fltr, void* fltr_ctx,
+       defer_free_pkt_fn_t defer, void *defer_ctx, flush_free_pkt_fn_t flush, void *flush_ctx);
+
+/* operations on a specific precedence in packet queue */
+#define pktqprec_max_pkts(pq, prec)            ((pq)->q[prec].max_pkts)
+#define pktqprec_n_pkts(pq, prec)              ((pq)->q[prec].n_pkts)
+#define pktqprec_empty(pq, prec)               ((pq)->q[prec].n_pkts == 0)
+#define pktqprec_peek(pq, prec)                        ((pq)->q[prec].head)
+#define pktqprec_peek_tail(pq, prec)   ((pq)->q[prec].tail)
+#define spktq_peek_tail(pq)            ((pq)->q.tail)
+#ifdef HND_PKTQ_THREAD_SAFE
+extern int pktqprec_avail_pkts(struct pktq *pq, int prec);
+extern bool pktqprec_full(struct pktq *pq, int prec);
+#else
+#define pktqprec_avail_pkts(pq, prec)  ((pq)->q[prec].max_pkts - (pq)->q[prec].n_pkts)
+#define pktqprec_full(pq, prec)        ((pq)->q[prec].n_pkts >= (pq)->q[prec].max_pkts)
+#endif /* HND_PKTQ_THREAD_SAFE */
+
+extern void  pktq_append(struct pktq *pq, int prec, struct spktq *list);
+extern void  spktq_append(struct spktq *spq, struct spktq *list);
+extern void  pktq_prepend(struct pktq *pq, int prec, struct spktq *list);
+extern void  spktq_prepend(struct spktq *spq, struct spktq *list);
+extern void *pktq_penq(struct pktq *pq, int prec, void *p);
+extern void *pktq_penq_head(struct pktq *pq, int prec, void *p);
+extern void *pktq_pdeq(struct pktq *pq, int prec);
+extern void *pktq_pdeq_prev(struct pktq *pq, int prec, void *prev_p);
+extern void *pktq_pdeq_with_fn(struct pktq *pq, int prec, ifpkt_cb_t fn, int arg);
+extern void *pktq_pdeq_tail(struct pktq *pq, int prec);
+/** Remove a specified packet from its queue */
+extern bool pktq_pdel(struct pktq *pq, void *p, int prec);
+
+/* For single precedence queues */
+extern void *spktq_enq_chain(struct spktq *dspq, struct spktq *sspq);
+extern void *spktq_enq(struct spktq *spq, void *p);
+extern void *spktq_enq_head(struct spktq *spq, void *p);
+extern void *spktq_deq(struct spktq *spq);
+extern void *spktq_deq_tail(struct spktq *spq);
+
+/* operations on a set of precedences in packet queue */
+
+extern int pktq_mlen(struct pktq *pq, uint prec_bmp);
+extern void *pktq_mdeq(struct pktq *pq, uint prec_bmp, int *prec_out);
+extern void *pktq_mpeek(struct pktq *pq, uint prec_bmp, int *prec_out);
+
+/* operations on packet queue as a whole */
+
+#define pktq_n_pkts_tot(pq)    ((int)(pq)->n_pkts_tot)
+#define pktq_max(pq)           ((int)(pq)->max_pkts)
+#define pktq_empty(pq)         ((pq)->n_pkts_tot == 0)
+#define spktq_n_pkts(spq)      ((int)(spq)->q.n_pkts)
+#define spktq_empty(spq)       ((spq)->q.n_pkts == 0)
+
+#define spktq_max(spq)         ((int)(spq)->q.max_pkts)
+#define spktq_empty(spq)       ((spq)->q.n_pkts == 0)
+#ifdef HND_PKTQ_THREAD_SAFE
+extern int pktq_avail(struct pktq *pq);
+extern bool pktq_full(struct pktq *pq);
+extern int spktq_avail(struct spktq *spq);
+extern bool spktq_full(struct spktq *spq);
+#else
+#define pktq_avail(pq)         ((int)((pq)->max_pkts - (pq)->n_pkts_tot))
+#define pktq_full(pq)          ((pq)->n_pkts_tot >= (pq)->max_pkts)
+#define spktq_avail(spq)       ((int)((spq)->q.max_pkts - (spq)->q.n_pkts))
+#define spktq_full(spq)                ((spq)->q.n_pkts >= (spq)->q.max_pkts)
+#endif /* HND_PKTQ_THREAD_SAFE */
+
+/* operations for single precedence queues */
+#define pktenq(pq, p)          pktq_penq((pq), 0, (p))
+#define pktenq_head(pq, p)     pktq_penq_head((pq), 0, (p))
+#define pktdeq(pq)             pktq_pdeq((pq), 0)
+#define pktdeq_tail(pq)                pktq_pdeq_tail((pq), 0)
+#define pktqflush(osh, pq, dir)        pktq_pflush(osh, (pq), 0, (dir))
+#define pktqinit(pq, max_pkts) pktq_init((pq), 1, (max_pkts))
+#define pktqdeinit(pq)         pktq_deinit((pq))
+#define pktqavail(pq)          pktq_avail((pq))
+#define pktqfull(pq)           pktq_full((pq))
+#define pktqfilter(pq, fltr, fltr_ctx, defer, defer_ctx, flush, flush_ctx) \
+       pktq_pfilter((pq), 0, (fltr), (fltr_ctx), (defer), (defer_ctx), (flush), (flush_ctx))
+
+/* operations for simple non-precedence queues */
+#define spktenq(spq, p)                        spktq_enq((spq), (p))
+#define spktenq_head(spq, p)           spktq_enq_head((spq), (p))
+#define spktdeq(spq)                   spktq_deq((spq))
+#define spktdeq_tail(spq)              spktq_deq_tail((spq))
+#define spktqflush(osh, spq, dir)      spktq_flush((osh), (spq), (dir))
+#define spktqinit(spq, max_pkts)       spktq_init((spq), (max_pkts))
+#define spktqdeinit(spq)               spktq_deinit((spq))
+#define spktqavail(spq)                        spktq_avail((spq))
+#define spktqfull(spq)                 spktq_full((spq))
+
+#define spktqfilter(spq, fltr, fltr_ctx, defer, defer_ctx, flush, flush_ctx) \
+       spktq_filter((spq), (fltr), (fltr_ctx), (defer), (defer_ctx), (flush), (flush_ctx))
+extern bool pktq_init(struct pktq *pq, int num_prec, uint max_pkts);
+extern bool pktq_deinit(struct pktq *pq);
+extern bool spktq_init(struct spktq *spq, uint max_pkts);
+extern bool spktq_init_list(struct spktq *spq, uint max_pkts,
+       void *head, void *tail, uint16 n_pkts);
+extern bool spktq_deinit(struct spktq *spq);
+
+extern void pktq_set_max_plen(struct pktq *pq, int prec, uint max_pkts);
+
+/* prec_out may be NULL if caller is not interested in return value */
+extern void *pktq_deq(struct pktq *pq, int *prec_out);
+extern void *pktq_deq_tail(struct pktq *pq, int *prec_out);
+extern void *pktq_peek(struct pktq *pq, int *prec_out);
+extern void *spktq_peek(struct spktq *spq);
+extern void *pktq_peek_tail(struct pktq *pq, int *prec_out);
+
+/** flush pktq */
+extern void pktq_flush(osl_t *osh, struct pktq *pq, bool dir);
+/* single precedence queue with callback before deleting a packet */
+extern void spktq_flush_ext(osl_t *osh, struct spktq *spq, bool dir,
+       void (*pktq_flush_cb)(void *ctx, void *pkt), void *pktq_flush_ctx);
+/* single precedence queue */
+#define spktq_flush(osh, spq, dir) spktq_flush_ext(osh, spq, dir, NULL, NULL)
+/** Empty the queue at particular precedence level */
+extern void pktq_pflush(osl_t *osh, struct pktq *pq, int prec, bool dir);
+
+typedef void (*spktq_cb_t)(void *arg, struct spktq *spq);
+extern void spktq_free_register(spktq_cb_t cb, void *arg);
+extern void spktq_cb(void *spq);
+#define SPKTQFREE      spktq_cb
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _hnd_pktq_h_ */
diff --git a/bcmdhd.101.10.240.x/include/hnd_trap.h b/bcmdhd.101.10.240.x/include/hnd_trap.h
new file mode 100644 (file)
index 0000000..eded5da
--- /dev/null
@@ -0,0 +1,33 @@
+/*
+ * HND Trap handling.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _hnd_trap_h_
+#define        _hnd_trap_h_
+
+#if defined(__arm__) || defined(__thumb__) || defined(__thumb2__) || defined(WLETD)
+#include <hnd_armtrap.h>
+#else
+#error "unsupported CPU architecture"
+#endif
+
+#endif /* _hnd_trap_h_ */
diff --git a/bcmdhd.101.10.240.x/include/hndchipc.h b/bcmdhd.101.10.240.x/include/hndchipc.h
new file mode 100644 (file)
index 0000000..26e53b3
--- /dev/null
@@ -0,0 +1,47 @@
+/*
+ * HND SiliconBackplane chipcommon support - OS independent.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _hndchipc_h_
+#define _hndchipc_h_
+
+#include <typedefs.h>
+#include <siutils.h>
+
+#ifdef RTE_UART
+typedef void (*si_serial_init_fn)(si_t *sih, void *regs, uint irq, uint baud_base, uint reg_shift);
+#else
+typedef void (*si_serial_init_fn)(void *regs, uint irq, uint baud_base, uint reg_shift);
+#endif
+extern void si_serial_init(si_t *sih, si_serial_init_fn add);
+
+extern volatile void *hnd_jtagm_init(si_t *sih, uint clkd, bool exttap, uint32 *prev_jtagctrl);
+extern void hnd_jtagm_disable(si_t *sih, volatile void *h, uint32 *prev_jtagctrl);
+extern uint32 jtag_scan(si_t *sih, volatile void *h, uint irsz, uint32 ir0, uint32 ir1,
+                        uint drsz, uint32 dr0, uint32 *dr1, bool rti);
+extern uint32 jtag_read_128(si_t *sih, volatile void *h, uint irsz, uint32 ir0, uint drsz,
+       uint32 dr0, uint32 *dr1, uint32 *dr2, uint32 *dr3);
+extern uint32 jtag_write_128(si_t *sih, volatile void *h, uint irsz, uint32 ir0, uint drsz,
+       uint32 dr0, uint32 *dr1, uint32 *dr2, uint32 *dr3);
+extern int jtag_setbit_128(si_t *sih, uint32 jtagureg_addr, uint8 bit_pos, uint8 bit_val);
+
+#endif /* _hndchipc_h_ */
diff --git a/bcmdhd.101.10.240.x/include/hndlhl.h b/bcmdhd.101.10.240.x/include/hndlhl.h
new file mode 100644 (file)
index 0000000..c399c6f
--- /dev/null
@@ -0,0 +1,79 @@
+/*
+ * HND SiliconBackplane PMU support.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _hndlhl_h_
+#define _hndlhl_h_
+
+enum {
+       LHL_MAC_TIMER = 0,
+       LHL_ARM_TIMER = 1
+};
+
+typedef struct {
+       uint16 offset;
+       uint32 mask;
+       uint32 val;
+} lhl_reg_set_t;
+
+#define LHL_REG_OFF(reg) OFFSETOF(gciregs_t, reg)
+
+extern void si_lhl_timer_config(si_t *sih, osl_t *osh, int timer_type);
+extern void si_lhl_timer_enable(si_t *sih);
+extern void si_lhl_timer_reset(si_t *sih, uint coreunit);
+
+extern void si_lhl_setup(si_t *sih, osl_t *osh);
+extern void si_lhl_enable(si_t *sih, osl_t *osh, bool enable);
+extern void si_lhl_ilp_config(si_t *sih, osl_t *osh, uint32 ilp_period);
+extern void si_lhl_enable_sdio_wakeup(si_t *sih, osl_t *osh);
+extern void si_lhl_disable_sdio_wakeup(si_t *sih);
+extern int si_lhl_set_lpoclk(si_t *sih, osl_t *osh, uint32 lpo_force);
+extern void si_set_lv_sleep_mode_lhl_config_4369(si_t *sih);
+extern void si_set_lv_sleep_mode_lhl_config_4362(si_t *sih);
+extern void si_set_lv_sleep_mode_lhl_config_4378(si_t *sih);
+extern void si_set_lv_sleep_mode_lhl_config_4387(si_t *sih);
+extern void si_set_lv_sleep_mode_lhl_config_4389(si_t *sih);
+
+#define HIB_EXT_WAKEUP_CAP(sih)  (PMUREV(sih->pmurev) >= 33)
+
+#ifdef WL_FWSIGN
+#define LHL_IS_PSMODE_0(sih)  (1)
+#define LHL_IS_PSMODE_1(sih)  (0)
+#else
+#define LHL_IS_PSMODE_0(sih)  (si_lhl_ps_mode(sih) == LHL_PS_MODE_0)
+#define LHL_IS_PSMODE_1(sih)  (si_lhl_ps_mode(sih) == LHL_PS_MODE_1)
+#endif /* WL_FWSIGN */
+
+/* LHL revid in capabilities register */
+#define        LHL_CAP_REV_MASK        0x000000ff
+
+/* LHL rev 6 requires this bit to be set first */
+#define LHL_PWRSEQCTL_WL_FLLPU_EN      (1 << 7)
+
+#define LHL_CBUCK_VOLT_SLEEP_SHIFT     12u
+#define LHL_CBUCK_VOLT_SLEEP_MASK      0x0000F000
+
+#define LHL_ABUCK_VOLT_SLEEP_SHIFT     0u
+#define LHL_ABUCK_VOLT_SLEEP_MASK      0x0000000F
+
+extern void si_lhl_mactim0_set(si_t *sih, uint32 val);
+#endif /* _hndlhl_h_ */
diff --git a/bcmdhd.101.10.240.x/include/hndoobr.h b/bcmdhd.101.10.240.x/include/hndoobr.h
new file mode 100644 (file)
index 0000000..3d096a9
--- /dev/null
@@ -0,0 +1,85 @@
+/*
+ * HND OOBR interface header
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _hndoobr_h_
+#define _hndoobr_h_
+
+#include <typedefs.h>
+#include <siutils.h>
+
+/* for 'srcpidx' of hnd_oobr_get_intr_config() */
+#define HND_CORE_MAIN_INTR     0
+#define HND_CORE_ALT_INTR      1
+
+uint32 hnd_oobr_get_intstatus(si_t *sih);
+int hnd_oobr_get_intr_config(si_t *sih, uint srccidx, uint srcpidx, uint dstcidx, uint *dstpidx);
+int hnd_oobr_set_intr_src(si_t *sih, uint dstcidx, uint dstpidx, uint intrnum);
+void hnd_oobr_init(si_t *sih);
+
+#define OOBR_INVALID_PORT       0xFFu
+
+/* per core source/dest sel reg */
+#define OOBR_INTR_PER_CONFREG           4u           /* 4 interrupts per configure reg */
+#define OOBR_INTR_NUM_MASK              0x7Fu
+#define OOBR_INTR_EN                    0x80u
+/* per core config reg */
+#define OOBR_CORECNF_OUTPUT_MASK        0x0000FF00u
+#define OOBR_CORECNF_OUTPUT_SHIFT       8u
+#define OOBR_CORECNF_INPUT_MASK         0x00FF0000u
+#define OOBR_CORECNF_INPUT_SHIFT        16u
+
+#define OOBR_EXT_RSRC_REQ_PERCORE_OFFSET 0x34u
+#define OOBR_EXT_RSRC_OFFSET 0x100u
+#define OOBR_EXT_RSRC_SHIFT 7u
+#define OOBR_EXT_RSRC_REQ_ADDR(oodr_base, core_idx) (uint32)((uintptr)(oodr_base) +\
+        OOBR_EXT_RSRC_OFFSET + ((core_idx) << OOBR_EXT_RSRC_SHIFT) +\
+        OOBR_EXT_RSRC_REQ_PERCORE_OFFSET)
+
+typedef volatile struct hndoobr_percore_reg {
+       uint32 sourcesel[OOBR_INTR_PER_CONFREG];        /* 0x00 - 0x0c */
+       uint32 destsel[OOBR_INTR_PER_CONFREG];          /* 0x10 - 0x1c */
+       uint32 reserved[6];
+       uint32 config;                                  /* 0x38 */
+       uint32 reserved1[17];                           /* 0x3c to 0x7c */
+} hndoobr_percore_reg_t;
+
+/* capability reg */
+#define OOBR_CAP_CORECNT_MASK                          0x0000001Fu
+#define OOBR_CAP_MAX_INT2CORE_MASK                     0x00F00000u
+#define OOBR_CAP_MAX_INT2CORE_SHIFT                    20u
+
+#define OOBR_MAX_INT_PER_REG                           4u
+
+/* CoreNConfig reg */
+#define OOBR_PERCORE_CORENCONFIG_INTOUTPUTS_MASK       0x0000FF00u
+#define OOBR_PERCORE_CORENCONFIG_INTOUTPUTS_SHIFT      8u
+
+typedef volatile struct hndoobr_reg {
+       uint32 capability;                      /* 0x00 */
+       uint32 reserved[3];
+       uint32 intstatus[4];                    /* 0x10 - 0x1c */
+       uint32 reserved1[56];                   /* 0x20 - 0xfc */
+       hndoobr_percore_reg_t percore_reg[1];   /* 0x100 */
+} hndoobr_reg_t;
+
+#endif /* _hndoobr_h_ */
diff --git a/bcmdhd.101.10.240.x/include/hndpmu.h b/bcmdhd.101.10.240.x/include/hndpmu.h
new file mode 100644 (file)
index 0000000..757e3b4
--- /dev/null
@@ -0,0 +1,96 @@
+/*
+ * HND SiliconBackplane PMU support.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _hndpmu_h_
+#define _hndpmu_h_
+
+#include <typedefs.h>
+#include <osl_decl.h>
+#include <siutils.h>
+#include <sbchipc.h>
+#if defined(BTOVERPCIE) || defined(BT_WLAN_REG_ON_WAR)
+#include <hnd_gcisem.h>
+#endif /* BTOVERPCIE || BT_WLAN_REG_ON_WAR */
+
+#if defined(EDV)
+extern uint32 si_pmu_get_backplaneclkspeed(si_t *sih);
+extern void si_pmu_update_backplane_clock(si_t *sih, osl_t *osh, uint reg, uint32 mask, uint32 val);
+#endif
+
+extern uint32 si_pmu_rsrc_macphy_clk_deps(si_t *sih, osl_t *osh, int maccore_index);
+extern uint32 si_pmu_rsrc_ht_avail_clk_deps(si_t *sih, osl_t *osh);
+extern uint32 si_pmu_rsrc_cb_ready_deps(si_t *sih, osl_t *osh);
+
+extern void si_pmu_otp_power(si_t *sih, osl_t *osh, bool on, uint32* min_res_mask);
+extern void si_sdiod_drive_strength_init(si_t *sih, osl_t *osh, uint32 drivestrength);
+
+extern void si_pmu_slow_clk_reinit(si_t *sih, osl_t *osh);
+extern void si_pmu_avbtimer_enable(si_t *sih, osl_t *osh, bool set_flag);
+extern uint32 si_pmu_dump_pmucap_binary(si_t *sih, uchar *p);
+extern uint32 si_pmu_dump_buf_size_pmucap(si_t *sih);
+extern int si_pmu_wait_for_steady_state(si_t *sih, osl_t *osh, pmuregs_t *pmu);
+extern uint32 si_pmu_wake_bit_offset(si_t *sih);
+extern uint32 si_pmu_get_pmutimer(si_t *sih);
+extern void si_pmu_set_min_res_mask(si_t *sih, osl_t *osh, uint min_res_mask);
+extern void si_pmu_set_mac_rsrc_req(si_t *sih, int macunit);
+extern void si_pmu_set_mac_rsrc_req_sc(si_t *sih, osl_t *osh);
+extern bool si_pmu_fast_lpo_enable_pcie(si_t *sih);
+extern bool si_pmu_fast_lpo_enable_pmu(si_t *sih);
+extern uint32 si_cur_pmu_time(si_t *sih);
+extern bool si_pmu_cap_fast_lpo(si_t *sih);
+extern int si_pmu_fast_lpo_disable(si_t *sih);
+extern void si_pmu_dmn1_perst_wakeup(si_t *sih, bool set);
+#ifdef BCMPMU_STATS
+extern void si_pmustatstimer_init(si_t *sih);
+extern void si_pmustatstimer_dump(si_t *sih);
+extern void si_pmustatstimer_start(si_t *sih, uint8 timerid);
+extern void si_pmustatstimer_stop(si_t *sih, uint8 timerid);
+extern void si_pmustatstimer_clear(si_t *sih, uint8 timerid);
+extern void si_pmustatstimer_clear_overflow(si_t *sih);
+extern uint32 si_pmustatstimer_read(si_t *sih, uint8 timerid);
+extern void si_pmustatstimer_cfg_src_num(si_t *sih, uint8 src_num, uint8 timerid);
+extern void si_pmustatstimer_cfg_cnt_mode(si_t *sih, uint8 cnt_mode, uint8 timerid);
+extern void si_pmustatstimer_int_enable(si_t *sih);
+extern void si_pmustatstimer_int_disable(si_t *sih);
+#endif /* BCMPMU_STATS */
+extern int si_pmu_min_res_set(si_t *sih, osl_t *osh, uint min_mask, bool set);
+extern void si_pmu_disable_intr_pwrreq(si_t *sih);
+
+extern void si_pmu_fis_setup(si_t *sih);
+
+extern uint si_pmu_get_mac_rsrc_req_tmr_cnt(si_t *sih);
+extern uint si_pmu_get_pmu_interrupt_rcv_cnt(si_t *sih);
+
+extern bool _bcm_pwr_opt_dis;
+#define BCM_PWR_OPT_ENAB()     (FALSE)
+
+extern int si_pmu_mem_pwr_off(si_t *sih, int core_idx);
+extern int si_pmu_mem_pwr_on(si_t *sih);
+
+#if defined(BT_WLAN_REG_ON_WAR)
+#define REG_ON_WAR_PMU_EXT_WAKE_REQ_MASK0_VAL 0x060000CDu
+
+extern void si_pmu_reg_on_war_ext_wake_perst_set(si_t *sih);
+extern void si_pmu_reg_on_war_ext_wake_perst_clear(si_t *sih);
+#endif /* BT_WLAN_REG_ON_WAR */
+#endif /* _hndpmu_h_ */
diff --git a/bcmdhd.101.10.240.x/include/hndsoc.h b/bcmdhd.101.10.240.x/include/hndsoc.h
new file mode 100644 (file)
index 0000000..c97749c
--- /dev/null
@@ -0,0 +1,344 @@
+/*
+ * Broadcom HND chip & on-chip-interconnect-related definitions.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _HNDSOC_H
+#define        _HNDSOC_H
+
+/* Include the soci specific files */
+#include <sbconfig.h>
+#include <aidmp.h>
+
+/*
+ * SOC Interconnect Address Map.
+ * All regions may not exist on all chips.
+ */
+#define SI_SDRAM_BASE          0x00000000      /* Physical SDRAM */
+#define SI_PCI_MEM             0x08000000      /* Host Mode sb2pcitranslation0 (64 MB) */
+#define SI_PCI_MEM_SZ          (64 * 1024 * 1024)
+#define SI_PCI_CFG             0x0c000000      /* Host Mode sb2pcitranslation1 (64 MB) */
+#define        SI_SDRAM_SWAPPED        0x10000000      /* Byteswapped Physical SDRAM */
+#define SI_SDRAM_R2            0x80000000      /* Region 2 for sdram (512 MB) */
+
+#ifndef SI_ENUM_BASE_DEFAULT
+#define SI_ENUM_BASE_DEFAULT           0x18000000      /* Enumeration space base */
+#endif
+
+#ifndef SI_WRAP_BASE_DEFAULT
+#define SI_WRAP_BASE_DEFAULT           0x18100000      /* Wrapper space base */
+#endif
+
+#define WL_BRIDGE1_S   (0x18132000)
+#define WL_BRIDGE2_S   (0x18133000)
+
+/** new(er) chips started locating their chipc core at a different BP address than 0x1800_0000 */
+// NIC and DHD driver binaries should support both old(er) and new(er) chips at the same time
+#define SI_ENUM_BASE(sih)      ((sih)->enum_base)
+#define SI_WRAP_BASE(sih)      (SI_ENUM_BASE(sih) + 0x00100000)
+
+#define SI_CORE_SIZE           0x1000          /* each core gets 4Kbytes for registers */
+
+#define SI_NIC400_GPV_BASE     0x18200000      /* NIC-400 Global Programmers View (GPV) */
+#define SI_GPV_WR_CAP_ADDR     0x4008  /* WR-CAP offset */
+#define SI_GPV_RD_CAP_EN       0x1     /* issue read */
+#define SI_GPV_WR_CAP_EN       0x2     /* issue write */
+
+#define SI_GPV_SL4_BM_ADDR  0x44024 /* NIC-400 Slave interface 4 Bypass merge */
+#define SI_GPV_SL6_BM_ADDR  0x46024 /* NIC-400 Slave interface 6 Bypass merge */
+#define SI_GPV_SL8_BM_ADDR  0x4a024 /* NIC-400 Slave interface 8 Bypass merge */
+#define SI_GPV_SL9_BM_ADDR  0x4b024 /* NIC-400 Slave interface 9 Bypass merge */
+
+/* AXI ID Node numbers wrt GPV base offset */
+#define NODE_HWA_MASTER                67
+#define NODE_HWA_SLAVE         11
+
+/* AXI Slave Interface Block (ASIB) offsets */
+#define ASIB_FN_MOD2           0x24
+
+#ifndef SI_MAXCORES
+#define        SI_MAXCORES             32              /* NorthStar has more cores */
+#endif /* SI_MAXCORES */
+
+#define        SI_MAXBR                4               /* Max bridges (this is arbitrary, for software
+                                        * convenience and could be changed if we
+                                        * make any larger chips
+                                        */
+
+#define        SI_FASTRAM              0x19000000      /* On-chip RAM on chips that also have DDR */
+#define        SI_FASTRAM_SWAPPED      0x19800000
+
+#define        SI_FLASH2               0x1c000000      /* Flash Region 2 (region 1 shadowed here) */
+#define        SI_FLASH2_SZ            0x02000000      /* Size of Flash Region 2 */
+#define        SI_ARMCM3_ROM           0x1e000000      /* ARM Cortex-M3 ROM */
+#define        SI_FLASH1               0x1fc00000      /* MIPS Flash Region 1 */
+#define        SI_FLASH1_SZ            0x00400000      /* MIPS Size of Flash Region 1 */
+#define        SI_FLASH_WINDOW         0x01000000      /* Flash XIP Window */
+
+#define SI_NS_NANDFLASH                0x1c000000      /* NorthStar NAND flash base */
+#define SI_NS_NORFLASH         0x1e000000      /* NorthStar NOR flash base */
+#define SI_NS_ROM              0xfffd0000      /* NorthStar ROM */
+#define        SI_NS_FLASH_WINDOW      0x02000000      /* Flash XIP Window */
+
+#define        SI_ARM7S_ROM            0x20000000      /* ARM7TDMI-S ROM */
+#define        SI_ARMCR4_ROM           0x000f0000      /* ARM Cortex-R4 ROM */
+#define        SI_ARMCM3_SRAM2         0x60000000      /* ARM Cortex-M3 SRAM Region 2 */
+#define        SI_ARM7S_SRAM2          0x80000000      /* ARM7TDMI-S SRAM Region 2 */
+#define        SI_ARMCA7_ROM           0x00000000      /* ARM Cortex-A7 ROM */
+#ifndef SI_ARMCA7_RAM
+#define        SI_ARMCA7_RAM           0x00200000      /* ARM Cortex-A7 RAM */
+#endif
+#define        SI_ARM_FLASH1           0xffff0000      /* ARM Flash Region 1 */
+#define        SI_ARM_FLASH1_SZ        0x00010000      /* ARM Size of Flash Region 1 */
+
+#define SI_SFLASH              0x14000000
+#define SI_PCI_DMA             0x40000000      /* Client Mode sb2pcitranslation2 (1 GB) */
+#define SI_PCI_DMA2            0x80000000      /* Client Mode sb2pcitranslation2 (1 GB) */
+#define SI_PCI_DMA_SZ          0x40000000      /* Client Mode sb2pcitranslation2 size in bytes */
+#define SI_PCIE_DMA_L32                0x00000000      /* PCIE Client Mode sb2pcitranslation2
+                                                * (2 ZettaBytes), low 32 bits
+                                                */
+#define SI_PCIE_DMA_H32                0x80000000      /* PCIE Client Mode sb2pcitranslation2
+                                                * (2 ZettaBytes), high 32 bits
+                                                */
+
+/* APB bridge code */
+#define        APB_BRIDGE_ID           0x135           /* APB Bridge 0, 1, etc. */
+
+/* ADB bridge code */
+#define ADB_BRIDGE_ID          0x031
+
+/* AXI-AHB bridge code */
+#define        AXI2AHB_BRIDGE_ID               0x240           /* AXI_AHB Bridge */
+
+/* core codes */
+#define        NODEV_CORE_ID           0x700           /* Invalid coreid */
+#define        CC_CORE_ID              0x800           /* chipcommon core */
+#define        ILINE20_CORE_ID         0x801           /* iline20 core */
+#define        SRAM_CORE_ID            0x802           /* sram core */
+#define        SDRAM_CORE_ID           0x803           /* sdram core */
+#define        PCI_CORE_ID             0x804           /* pci core */
+#define        MIPS_CORE_ID            0x805           /* mips core */
+#define        ENET_CORE_ID            0x806           /* enet mac core */
+#define        CODEC_CORE_ID           0x807           /* v90 codec core */
+#define        USB_CORE_ID             0x808           /* usb 1.1 host/device core */
+#define        ADSL_CORE_ID            0x809           /* ADSL core */
+#define        ILINE100_CORE_ID        0x80a           /* iline100 core */
+#define        IPSEC_CORE_ID           0x80b           /* ipsec core */
+#define        UTOPIA_CORE_ID          0x80c           /* utopia core */
+#define        PCMCIA_CORE_ID          0x80d           /* pcmcia core */
+#define        SOCRAM_CORE_ID          0x80e           /* internal memory core */
+#define        MEMC_CORE_ID            0x80f           /* memc sdram core */
+#define        OFDM_CORE_ID            0x810           /* OFDM phy core */
+#define        EXTIF_CORE_ID           0x811           /* external interface core */
+#define        D11_CORE_ID             0x812           /* 802.11 MAC core */
+#define        APHY_CORE_ID            0x813           /* 802.11a phy core */
+#define        BPHY_CORE_ID            0x814           /* 802.11b phy core */
+#define        GPHY_CORE_ID            0x815           /* 802.11g phy core */
+#define        MIPS33_CORE_ID          0x816           /* mips3302 core */
+#define        USB11H_CORE_ID          0x817           /* usb 1.1 host core */
+#define        USB11D_CORE_ID          0x818           /* usb 1.1 device core */
+#define        USB20H_CORE_ID          0x819           /* usb 2.0 host core */
+#define        USB20D_CORE_ID          0x81a           /* usb 2.0 device core */
+#define        SDIOH_CORE_ID           0x81b           /* sdio host core */
+#define        ROBO_CORE_ID            0x81c           /* roboswitch core */
+#define        ATA100_CORE_ID          0x81d           /* parallel ATA core */
+#define        SATAXOR_CORE_ID         0x81e           /* serial ATA & XOR DMA core */
+#define        GIGETH_CORE_ID          0x81f           /* gigabit ethernet core */
+#define        PCIE_CORE_ID            0x820           /* pci express core */
+#define        NPHY_CORE_ID            0x821           /* 802.11n 2x2 phy core */
+#define        SRAMC_CORE_ID           0x822           /* SRAM controller core */
+#define        MINIMAC_CORE_ID         0x823           /* MINI MAC/phy core */
+#define        ARM11_CORE_ID           0x824           /* ARM 1176 core */
+#define        ARM7S_CORE_ID           0x825           /* ARM7tdmi-s core */
+#define        LPPHY_CORE_ID           0x826           /* 802.11a/b/g phy core */
+#define        PMU_CORE_ID             0x827           /* PMU core */
+#define        SSNPHY_CORE_ID          0x828           /* 802.11n single-stream phy core */
+#define        SDIOD_CORE_ID           0x829           /* SDIO device core */
+#define        ARMCM3_CORE_ID          0x82a           /* ARM Cortex M3 core */
+#define        HTPHY_CORE_ID           0x82b           /* 802.11n 4x4 phy core */
+#define        MIPS74K_CORE_ID         0x82c           /* mips 74k core */
+#define        GMAC_CORE_ID            0x82d           /* Gigabit MAC core */
+#define        DMEMC_CORE_ID           0x82e           /* DDR1/2 memory controller core */
+#define        PCIERC_CORE_ID          0x82f           /* PCIE Root Complex core */
+#define        OCP_CORE_ID             0x830           /* OCP2OCP bridge core */
+#define        SC_CORE_ID              0x831           /* shared common core */
+#define        AHB_CORE_ID             0x832           /* OCP2AHB bridge core */
+#define        SPIH_CORE_ID            0x833           /* SPI host core */
+#define        I2S_CORE_ID             0x834           /* I2S core */
+#define        DMEMS_CORE_ID           0x835           /* SDR/DDR1 memory controller core */
+#define        DEF_SHIM_COMP           0x837           /* SHIM component in ubus/6362 */
+
+#define ACPHY_CORE_ID          0x83b           /* Dot11 ACPHY */
+#define PCIE2_CORE_ID          0x83c           /* pci express Gen2 core */
+#define USB30D_CORE_ID         0x83d           /* usb 3.0 device core */
+#define ARMCR4_CORE_ID         0x83e           /* ARM CR4 CPU */
+#define GCI_CORE_ID            0x840           /* GCI Core */
+#define SR_CORE_ID             0x841           /* SR_CORE ID */
+#define M2MDMA_CORE_ID          0x844           /* memory to memory dma */
+#define CMEM_CORE_ID           0x846           /* CNDS DDR2/3 memory controller */
+#define ARMCA7_CORE_ID         0x847           /* ARM CA7 CPU */
+#define SYSMEM_CORE_ID         0x849           /* System memory core */
+#define HUB_CORE_ID            0x84b           /* Hub core ID */
+#define HWA_CORE_ID            0x851           /* HWA Core ID */
+#define SPMI_SLAVE_CORE_ID     0x855           /* SPMI Slave Core ID */
+#define BT_CORE_ID             0x857           /* Bluetooth Core ID */
+#define HND_OOBR_CORE_ID       0x85c           /* Hnd oob router core ID */
+#define SOE_CORE_ID            0x85d           /* SOE core */
+#define APB_BRIDGE_CORE_ID     0x135           /* APB bridge core ID */
+#define AXI_CORE_ID            0x301           /* AXI/GPV core ID */
+#define EROM_CORE_ID           0x366           /* EROM core ID */
+#define OOB_ROUTER_CORE_ID     0x367           /* OOB router core ID */
+#define CCI400_CORE_ID         0x420           /* CCI-400 (Cache Coherent Interconnect) core ID */
+#define DEF_AI_COMP            0xfff           /* Default component, in ai chips it maps all
+                                                * unused address ranges
+                                                */
+
+#define NS_PCIEG2_CORE_ID      0x501           /* PCIE Gen 2 core */
+#define NS_DMA_CORE_ID         0x502           /* DMA core */
+#define NS_SDIO3_CORE_ID       0x503           /* SDIO3 core */
+#define NS_USB20_CORE_ID       0x504           /* USB2.0 core */
+#define NS_USB30_CORE_ID       0x505           /* USB3.0 core */
+#define NS_A9JTAG_CORE_ID      0x506           /* ARM Cortex A9 JTAG core */
+#define NS_DDR23_CORE_ID       0x507           /* Denali DDR2/DDR3 memory controller */
+#define NS_ROM_CORE_ID         0x508           /* ROM core */
+#define NS_NAND_CORE_ID                0x509           /* NAND flash controller core */
+#define NS_QSPI_CORE_ID                0x50a           /* SPI flash controller core */
+#define NS_CCB_CORE_ID         0x50b           /* ChipcommonB core */
+#define NS_SOCRAM_CORE_ID      0x50e           /* internal memory core */
+#define        ARMCA9_CORE_ID          0x510           /* ARM Cortex A9 core (ihost) */
+#define        NS_IHOST_CORE_ID        ARMCA9_CORE_ID  /* ARM Cortex A9 core (ihost) */
+#define AMEMC_CORE_ID          0x52e           /* DDR1/2 memory controller core */
+#define ALTA_CORE_ID           0x534           /* I2S core */
+#define DDR23_PHY_CORE_ID      0x5dd
+
+#define SI_PCI1_MEM            0x40000000      /* Host Mode sb2pcitranslation0 (64 MB) */
+#define SI_PCI1_CFG            0x44000000      /* Host Mode sb2pcitranslation1 (64 MB) */
+#define SI_PCIE1_DMA_H32       0xc0000000      /* PCIE Client Mode sb2pcitranslation2
+                                                * (2 ZettaBytes), high 32 bits
+                                                */
+#define NS_PCIEG2_CORE_REV_B0  0x7             /* NS-B0 PCIE Gen 2 core rev */
+
+/* There are TWO constants on all HND chips: SI_ENUM_BASE_DEFAULT above,
+ * and chipcommon being the first core:
+ */
+#define        SI_CC_IDX               0
+/* SOC Interconnect types (aka chip types) */
+#define        SOCI_SB                 0u
+#define        SOCI_AI                 1u
+#define        SOCI_UBUS               2u
+#define        SOCI_NAI                3u
+#define SOCI_DVTBUS            4u /* BCM7XXX Digital Video Tech bus */
+#define SOCI_NCI               6u /* NCI (non coherent interconnect) i.e. BOOKER */
+
+/* Common core control flags */
+#define        SICF_BIST_EN            0x8000
+#define        SICF_PME_EN             0x4000
+#define        SICF_CORE_BITS          0x3ffc
+#define        SICF_PCEN               0x0004
+#define        SICF_FGC                0x0002
+#define        SICF_CLOCK_EN           0x0001
+
+/* Common core status flags */
+#define        SISF_BIST_DONE          0x8000
+#define        SISF_BIST_ERROR         0x4000
+#define        SISF_GATED_CLK          0x2000
+#define        SISF_DMA64              0x1000
+#define        SISF_CORE_BITS          0x0fff
+#define        SISF_CORE_BITS_SCAN     0x0010          /* SCAN core */
+
+/* Norstar core status flags */
+#define SISF_NS_BOOTDEV_MASK   0x0003  /* ROM core */
+#define SISF_NS_BOOTDEV_NOR    0x0000  /* ROM core */
+#define SISF_NS_BOOTDEV_NAND   0x0001  /* ROM core */
+#define SISF_NS_BOOTDEV_ROM    0x0002  /* ROM core */
+#define SISF_NS_BOOTDEV_OFFLOAD        0x0003  /* ROM core */
+#define SISF_NS_SKUVEC_MASK    0x000c  /* ROM core */
+
+/* dot11 core-specific status flags */
+#define        SISF_MINORREV_D11_SHIFT 16
+#define        SISF_MINORREV_D11_MASK  0xF             /**< minor corerev (corerev == 61) */
+
+/* A register that is common to all cores to
+ * communicate w/PMU regarding clock control.
+ */
+#define SI_CLK_CTL_ST          0x1e0           /* clock control and status */
+#define SI_PWR_CTL_ST          0x1e8           /* For memory clock gating */
+
+/* clk_ctl_st register */
+#define        CCS_FORCEALP            0x00000001      /* force ALP request */
+#define        CCS_FORCEHT             0x00000002      /* force HT request */
+#define        CCS_FORCEILP            0x00000004      /* force ILP request */
+#define        CCS_ALPAREQ             0x00000008      /* ALP Avail Request */
+#define        CCS_HTAREQ              0x00000010      /* HT Avail Request */
+#define        CCS_FORCEHWREQOFF       0x00000020      /* Force HW Clock Request Off */
+#define CCS_HQCLKREQ           0x00000040      /* HQ Clock Required */
+#define CCS_USBCLKREQ          0x00000100      /* USB Clock Req */
+#define CCS_SECICLKREQ         0x00000100      /* SECI Clock Req */
+#define CCS_ARMFASTCLOCKREQ    0x00000100      /* ARM CR4/CA7 fast clock request */
+#define CCS_SFLASH_CLKREQ      0x00000200      /* Sflash clk request */
+#define CCS_AVBCLKREQ          0x00000400      /* AVB Clock enable request */
+#define CCS_ERSRC_REQ_MASK     0x00000700      /* external resource requests */
+#define CCS_ERSRC_REQ_SHIFT    8
+#define        CCS_ALPAVAIL            0x00010000      /* ALP is available */
+#define        CCS_HTAVAIL             0x00020000      /* HT is available */
+#define CCS_BP_ON_APL          0x00040000      /* RO: Backplane is running on ALP clock */
+#define CCS_BP_ON_HT           0x00080000      /* RO: Backplane is running on HT clock */
+#define CCS_ARMFASTCLOCKSTATUS 0x01000000      /* Fast CPU clock is running */
+#define CCS_ERSRC_STS_MASK     0x07000000      /* external resource status */
+#define CCS_ERSRC_STS_SHIFT    24
+#define CCS_SECI_AVAIL         0x01000000      /* RO: SECI is available  */
+
+/* Not really related to SOC Interconnect, but a couple of software
+ * conventions for the use the flash space:
+ */
+
+/* Minumum amount of flash we support */
+#define FLASH_MIN              0x00020000      /* Minimum flash size */
+
+/* A boot/binary may have an embedded block that describes its size  */
+#define        BISZ_OFFSET             0x3e0           /* At this offset into the binary */
+#define        BISZ_MAGIC              0x4249535a      /* Marked with this value: 'BISZ' */
+#define        BISZ_MAGIC_IDX          0               /* Word 0: magic */
+#define        BISZ_TXTST_IDX          1               /*      1: text start */
+#define        BISZ_TXTEND_IDX         2               /*      2: text end */
+#define        BISZ_DATAST_IDX         3               /*      3: data start */
+#define        BISZ_DATAEND_IDX        4               /*      4: data end */
+#define        BISZ_BSSST_IDX          5               /*      5: bss start */
+#define        BISZ_BSSEND_IDX         6               /*      6: bss end */
+#define BISZ_SIZE              7               /* descriptor size in 32-bit integers */
+
+/* Boot/Kernel related defintion and functions */
+#define        SOC_BOOTDEV_ROM         0x00000001
+#define        SOC_BOOTDEV_PFLASH      0x00000002
+#define        SOC_BOOTDEV_SFLASH      0x00000004
+#define        SOC_BOOTDEV_NANDFLASH   0x00000008
+
+#define        SOC_KNLDEV_NORFLASH     0x00000002
+#define        SOC_KNLDEV_NANDFLASH    0x00000004
+
+#if !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__)
+int soc_boot_dev(void *sih);
+int soc_knl_dev(void *sih);
+#endif /* !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__) */
+
+#define PMU_BASE_OFFSET        0x00012000      /* PMU offset is changed for ccrev >= 56 */
+#endif /* _HNDSOC_H */
diff --git a/bcmdhd.101.10.240.x/include/linux_osl.h b/bcmdhd.101.10.240.x/include/linux_osl.h
new file mode 100644 (file)
index 0000000..68dbc73
--- /dev/null
@@ -0,0 +1,571 @@
+/*
+ * Linux OS Independent Layer
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _linux_osl_h_
+#define _linux_osl_h_
+
+#include <typedefs.h>
+#define DECLSPEC_ALIGN(x)      __attribute__ ((aligned(x)))
+
+/* Linux Kernel: File Operations: start */
+extern void * osl_os_open_image(char * filename);
+extern int osl_os_get_image_block(char * buf, int len, void * image);
+extern void osl_os_close_image(void * image);
+extern int osl_os_image_size(void *image);
+/* Linux Kernel: File Operations: end */
+
+#ifdef BCMDRIVER
+
+/* OSL initialization */
+extern osl_t *osl_attach(void *pdev, uint bustype, bool pkttag);
+
+extern void osl_detach(osl_t *osh);
+extern int osl_static_mem_init(osl_t *osh, void *adapter);
+extern int osl_static_mem_deinit(osl_t *osh, void *adapter);
+extern void osl_set_bus_handle(osl_t *osh, void *bus_handle);
+extern void* osl_get_bus_handle(osl_t *osh);
+#ifdef DHD_MAP_LOGGING
+extern void osl_dma_map_dump(osl_t *osh);
+#define OSL_DMA_MAP_DUMP(osh)  osl_dma_map_dump(osh)
+#else
+#define OSL_DMA_MAP_DUMP(osh)  do {} while (0)
+#endif /* DHD_MAP_LOGGING */
+
+/* Global ASSERT type */
+extern uint32 g_assert_type;
+
+#ifdef CONFIG_PHYS_ADDR_T_64BIT
+#define PRI_FMT_x       "llx"
+#define PRI_FMT_X       "llX"
+#define PRI_FMT_o       "llo"
+#define PRI_FMT_d       "lld"
+#else
+#define PRI_FMT_x       "x"
+#define PRI_FMT_X       "X"
+#define PRI_FMT_o       "o"
+#define PRI_FMT_d       "d"
+#endif /* CONFIG_PHYS_ADDR_T_64BIT */
+/* ASSERT */
+#ifndef ASSERT
+#if defined(BCMASSERT_LOG) && !defined(BINCMP)
+       #define ASSERT(exp) \
+               do { if (!(exp)) osl_assert(#exp, __FILE__, __LINE__); } while (0)
+extern void osl_assert(const char *exp, const char *file, int line);
+#else
+#ifdef __GNUC__
+       #define GCC_VERSION \
+               (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
+#if GCC_VERSION > 30100
+       #define ASSERT(exp)     do {} while (0)
+#else
+       /* ASSERT could cause segmentation fault on GCC3.1, use empty instead */
+       #define ASSERT(exp)
+#endif /* GCC_VERSION > 30100 */
+#endif /* __GNUC__ */
+#endif
+#endif /* ASSERT */
+
+#define ASSERT_FP(exp) ASSERT(exp)
+
+/* microsecond delay */
+#define        OSL_DELAY(usec)         osl_delay(usec)
+extern void osl_delay(uint usec);
+
+#define OSL_SLEEP(ms)                  osl_sleep(ms)
+extern void osl_sleep(uint ms);
+
+/* PCI configuration space access macros */
+#define        OSL_PCI_READ_CONFIG(osh, offset, size) \
+       osl_pci_read_config((osh), (offset), (size))
+#define        OSL_PCI_WRITE_CONFIG(osh, offset, size, val) \
+       osl_pci_write_config((osh), (offset), (size), (val))
+extern uint32 osl_pci_read_config(osl_t *osh, uint offset, uint size);
+extern void osl_pci_write_config(osl_t *osh, uint offset, uint size, uint val);
+
+/* PCI device bus # and slot # */
+#define OSL_PCI_BUS(osh)       osl_pci_bus(osh)
+#define OSL_PCI_SLOT(osh)      osl_pci_slot(osh)
+#define OSL_PCIE_DOMAIN(osh)   osl_pcie_domain(osh)
+#define OSL_PCIE_BUS(osh)      osl_pcie_bus(osh)
+extern uint osl_pci_bus(osl_t *osh);
+extern uint osl_pci_slot(osl_t *osh);
+extern uint osl_pcie_domain(osl_t *osh);
+extern uint osl_pcie_bus(osl_t *osh);
+extern struct pci_dev *osl_pci_device(osl_t *osh);
+
+#define OSL_ACP_COHERENCE              (1<<1L)
+#define OSL_FWDERBUF                   (1<<2L)
+
+/* Pkttag flag should be part of public information */
+typedef struct {
+       bool pkttag;
+       bool mmbus;             /**< Bus supports memory-mapped register accesses */
+       pktfree_cb_fn_t tx_fn;  /**< Callback function for PKTFREE */
+       void *tx_ctx;           /**< Context to the callback function */
+       void    *unused[3];     /**< temp fix for USBAP cftpool handle currption */
+       void (*rx_fn)(void *rx_ctx, void *p);
+       void *rx_ctx;
+} osl_pubinfo_t;
+
+extern void osl_flag_set(osl_t *osh, uint32 mask);
+extern void osl_flag_clr(osl_t *osh, uint32 mask);
+extern bool osl_is_flag_set(osl_t *osh, uint32 mask);
+
+#define PKTFREESETCB(osh, _tx_fn, _tx_ctx)             \
+       do {                                            \
+          ((osl_pubinfo_t*)osh)->tx_fn = _tx_fn;       \
+          ((osl_pubinfo_t*)osh)->tx_ctx = _tx_ctx;     \
+       } while (0)
+
+#define PKTFREESETRXCB(osh, _rx_fn, _rx_ctx)           \
+       do {                                            \
+          ((osl_pubinfo_t*)osh)->rx_fn = _rx_fn;       \
+          ((osl_pubinfo_t*)osh)->rx_ctx = _rx_ctx;     \
+       } while (0)
+
+/* host/bus architecture-specific byte swap */
+#define BUS_SWAP32(v)          (v)
+
+       #define MALLOC(osh, size)       osl_malloc((osh), (size))
+       #define MALLOCZ(osh, size)      osl_mallocz((osh), (size))
+       #define MFREE(osh, addr, size) ({osl_mfree((osh), ((void *)addr), (size));(addr) = NULL;})
+       #define VMALLOC(osh, size)      osl_vmalloc((osh), (size))
+       #define VMALLOCZ(osh, size)     osl_vmallocz((osh), (size))
+       #define VMFREE(osh, addr, size) osl_vmfree((osh), (addr), (size))
+       #define MALLOCED(osh)           osl_malloced((osh))
+       #define MEMORY_LEFTOVER(osh) osl_check_memleak(osh)
+       extern void *osl_malloc(osl_t *osh, uint size);
+       extern void *osl_mallocz(osl_t *osh, uint size);
+       extern void osl_mfree(osl_t *osh, void *addr, uint size);
+       extern void *osl_vmalloc(osl_t *osh, uint size);
+       extern void *osl_vmallocz(osl_t *osh, uint size);
+       extern void osl_vmfree(osl_t *osh, void *addr, uint size);
+       extern uint osl_malloced(osl_t *osh);
+       extern uint osl_check_memleak(osl_t *osh);
+
+extern int memcpy_s(void *dest, size_t destsz, const void *src, size_t n);
+extern int memset_s(void *dest, size_t destsz, int c, size_t n);
+#define        MALLOC_FAILED(osh)      osl_malloc_failed((osh))
+extern uint osl_malloc_failed(osl_t *osh);
+
+/* allocate/free shared (dma-able) consistent memory */
+#define        DMA_CONSISTENT_ALIGN    osl_dma_consistent_align()
+#define        DMA_ALLOC_CONSISTENT(osh, size, align, tot, pap, dmah) \
+       osl_dma_alloc_consistent((osh), (size), (align), (tot), (pap))
+#define        DMA_FREE_CONSISTENT(osh, va, size, pa, dmah) \
+       osl_dma_free_consistent((osh), (void*)(va), (size), (pa))
+
+#define        DMA_ALLOC_CONSISTENT_FORCE32(osh, size, align, tot, pap, dmah) \
+       osl_dma_alloc_consistent((osh), (size), (align), (tot), (pap))
+#define        DMA_FREE_CONSISTENT_FORCE32(osh, va, size, pa, dmah) \
+       osl_dma_free_consistent((osh), (void*)(va), (size), (pa))
+
+extern uint osl_dma_consistent_align(void);
+extern void *osl_dma_alloc_consistent(osl_t *osh, uint size, uint16 align,
+       uint *tot, dmaaddr_t *pap);
+extern void osl_dma_free_consistent(osl_t *osh, void *va, uint size, dmaaddr_t pa);
+
+/* map/unmap direction */
+#define DMA_NO 0       /* Used to skip cache op */
+#define        DMA_TX  1       /* TX direction for DMA */
+#define        DMA_RX  2       /* RX direction for DMA */
+
+/* map/unmap shared (dma-able) memory */
+#define        DMA_UNMAP(osh, pa, size, direction, p, dmah) \
+       osl_dma_unmap((osh), (pa), (size), (direction))
+extern void osl_dma_flush(osl_t *osh, void *va, uint size, int direction, void *p,
+       hnddma_seg_map_t *txp_dmah);
+extern dmaaddr_t osl_dma_map(osl_t *osh, void *va, uint size, int direction, void *p,
+       hnddma_seg_map_t *txp_dmah);
+extern void osl_dma_unmap(osl_t *osh, dmaaddr_t pa, uint size, int direction);
+
+#ifndef PHYS_TO_VIRT
+#define        PHYS_TO_VIRT(pa)        osl_phys_to_virt(pa)
+#endif
+#ifndef VIRT_TO_PHYS
+#define        VIRT_TO_PHYS(va)        osl_virt_to_phys(va)
+#endif
+extern void * osl_phys_to_virt(void * pa);
+extern void * osl_virt_to_phys(void * va);
+
+/* API for DMA addressing capability */
+#define OSL_DMADDRWIDTH(osh, addrwidth) ({BCM_REFERENCE(osh); BCM_REFERENCE(addrwidth);})
+
+#define OSL_SMP_WMB()  smp_wmb()
+
+/* API for CPU relax */
+extern void osl_cpu_relax(void);
+#define OSL_CPU_RELAX() osl_cpu_relax()
+
+extern void osl_preempt_disable(osl_t *osh);
+extern void osl_preempt_enable(osl_t *osh);
+#define OSL_DISABLE_PREEMPTION(osh)    osl_preempt_disable(osh)
+#define OSL_ENABLE_PREEMPTION(osh)     osl_preempt_enable(osh)
+
+#if (!defined(DHD_USE_COHERENT_MEM_FOR_RING) && defined(__ARM_ARCH_7A__))
+
+       extern void osl_cache_flush(void *va, uint size);
+       extern void osl_cache_inv(void *va, uint size);
+       extern void osl_prefetch(const void *ptr);
+       #define OSL_CACHE_FLUSH(va, len)        osl_cache_flush((void *)(va), len)
+       #define OSL_CACHE_INV(va, len)          osl_cache_inv((void *)(va), len)
+       #define OSL_PREFETCH(ptr)                       osl_prefetch(ptr)
+#else  /* !__ARM_ARCH_7A__ */
+       #define OSL_CACHE_FLUSH(va, len)        BCM_REFERENCE(va)
+       #define OSL_CACHE_INV(va, len)          BCM_REFERENCE(va)
+       #define OSL_PREFETCH(ptr)               BCM_REFERENCE(ptr)
+#endif /* !__ARM_ARCH_7A__ */
+
+#ifdef AXI_TIMEOUTS_NIC
+extern void osl_set_bpt_cb(osl_t *osh, void *bpt_cb, void *bpt_ctx);
+extern void osl_bpt_rreg(osl_t *osh, ulong addr, volatile void *v, uint size);
+#endif /* AXI_TIMEOUTS_NIC */
+
+/* register access macros */
+#if defined(BCMSDIO)
+       #include <bcmsdh.h>
+       #define OSL_WRITE_REG(osh, r, v) (bcmsdh_reg_write(osl_get_bus_handle(osh), \
+               (uintptr)(r), sizeof(*(r)), (v)))
+       #define OSL_READ_REG(osh, r) (bcmsdh_reg_read(osl_get_bus_handle(osh), \
+               (uintptr)(r), sizeof(*(r))))
+#elif defined(AXI_TIMEOUTS_NIC)
+#define OSL_READ_REG(osh, r) \
+       ({\
+               __typeof(*(r)) __osl_v; \
+               osl_bpt_rreg(osh, (uintptr)(r), &__osl_v, sizeof(*(r))); \
+               __osl_v; \
+       })
+#endif
+
+#if defined(AXI_TIMEOUTS_NIC)
+       #define SELECT_BUS_WRITE(osh, mmap_op, bus_op) ({BCM_REFERENCE(osh); mmap_op;})
+       #define SELECT_BUS_READ(osh, mmap_op, bus_op) ({BCM_REFERENCE(osh); bus_op;})
+#else /* !AXI_TIMEOUTS_NIC */
+#if defined(BCMSDIO)
+       #define SELECT_BUS_WRITE(osh, mmap_op, bus_op) if (((osl_pubinfo_t*)(osh))->mmbus) \
+               mmap_op else bus_op
+       #define SELECT_BUS_READ(osh, mmap_op, bus_op) (((osl_pubinfo_t*)(osh))->mmbus) ? \
+               mmap_op : bus_op
+#else
+       #define SELECT_BUS_WRITE(osh, mmap_op, bus_op) ({BCM_REFERENCE(osh); mmap_op;})
+       #define SELECT_BUS_READ(osh, mmap_op, bus_op) ({BCM_REFERENCE(osh); mmap_op;})
+#endif /* defined(BCMSDIO) */
+#endif /* AXI_TIMEOUTS_NIC */
+
+#define OSL_ERROR(bcmerror)    osl_error(bcmerror)
+extern int osl_error(int bcmerror);
+
+/* the largest reasonable packet buffer driver uses for ethernet MTU in bytes */
+#define        PKTBUFSZ        2048   /* largest reasonable packet buffer, driver uses for ethernet MTU */
+
+#define OSH_NULL   NULL
+
+/*
+ * BINOSL selects the slightly slower function-call-based binary compatible osl.
+ * Macros expand to calls to functions defined in linux_osl.c .
+ */
+#include <linuxver.h>           /* use current 2.4.x calling conventions */
+#include <linux/kernel.h>       /* for vsn/printf's */
+#include <linux/string.h>       /* for mem*, str* */
+extern uint64 osl_sysuptime_us(void);
+#define OSL_SYSUPTIME()                ((uint32)jiffies_to_msecs(jiffies))
+#define OSL_SYSUPTIME_US()     osl_sysuptime_us()
+extern uint64 osl_localtime_ns(void);
+extern void osl_get_localtime(uint64 *sec, uint64 *usec);
+extern uint64 osl_systztime_us(void);
+#define OSL_LOCALTIME_NS()     osl_localtime_ns()
+#define OSL_GET_LOCALTIME(sec, usec)   osl_get_localtime((sec), (usec))
+#define OSL_SYSTZTIME_US()     osl_systztime_us()
+#define        printf(fmt, args...)    printk("[dhd] " fmt , ## args)
+#include <linux/kernel.h>      /* for vsn/printf's */
+#include <linux/string.h>      /* for mem*, str* */
+/* bcopy's: Linux kernel doesn't provide these (anymore) */
+#define        bcopy_hw(src, dst, len)         memcpy((dst), (src), (len))
+#define        bcopy_hw_async(src, dst, len)   memcpy((dst), (src), (len))
+#define        bcopy_hw_poll_for_completion()
+#define        bcopy(src, dst, len)    memcpy((dst), (src), (len))
+#define        bcmp(b1, b2, len)       memcmp((b1), (b2), (len))
+#define        bzero(b, len)           memset((b), '\0', (len))
+
+#if defined(CONFIG_SOC_EXYNOS9830)
+extern int exynos_pcie_l1_exit(int ch_num);
+#endif /* CONFIG_SOC_EXYNOS9830        */
+
+/* register access macros */
+
+#ifdef CONFIG_64BIT
+/* readq is defined only for 64 bit platform */
+#if defined(CONFIG_SOC_EXYNOS9830)
+#define R_REG(osh, r) (\
+       SELECT_BUS_READ(osh, \
+               ({ \
+                       __typeof(*(r)) __osl_v = 0; \
+                       exynos_pcie_l1_exit(0); \
+                       BCM_REFERENCE(osh);     \
+                       switch (sizeof(*(r))) { \
+                               case sizeof(uint8):     __osl_v = \
+                                       readb((volatile uint8*)(r)); break; \
+                               case sizeof(uint16):    __osl_v = \
+                                       readw((volatile uint16*)(r)); break; \
+                               case sizeof(uint32):    __osl_v = \
+                                       readl((volatile uint32*)(r)); break; \
+                               case sizeof(uint64):    __osl_v = \
+                                       readq((volatile uint64*)(r)); break; \
+                       } \
+                       __osl_v; \
+               }), \
+               OSL_READ_REG(osh, r)) \
+)
+#else
+#define R_REG(osh, r) (\
+       SELECT_BUS_READ(osh, \
+               ({ \
+                       __typeof(*(r)) __osl_v = 0; \
+                       BCM_REFERENCE(osh);     \
+                       switch (sizeof(*(r))) { \
+                               case sizeof(uint8):     __osl_v = \
+                                       readb((volatile uint8*)(r)); break; \
+                               case sizeof(uint16):    __osl_v = \
+                                       readw((volatile uint16*)(r)); break; \
+                               case sizeof(uint32):    __osl_v = \
+                                       readl((volatile uint32*)(r)); break; \
+                               case sizeof(uint64):    __osl_v = \
+                                       readq((volatile uint64*)(r)); break; \
+                       } \
+                       __osl_v; \
+               }), \
+               OSL_READ_REG(osh, r)) \
+)
+#endif /* CONFIG_SOC_EXYNOS9830 */
+#else /* !CONFIG_64BIT */
+#define R_REG(osh, r) (\
+       SELECT_BUS_READ(osh, \
+               ({ \
+                       __typeof(*(r)) __osl_v = 0; \
+                       switch (sizeof(*(r))) { \
+                               case sizeof(uint8):     __osl_v = \
+                                       readb((volatile uint8*)(r)); break; \
+                               case sizeof(uint16):    __osl_v = \
+                                       readw((volatile uint16*)(r)); break; \
+                               case sizeof(uint32):    __osl_v = \
+                                       readl((volatile uint32*)(r)); break; \
+                       } \
+                       __osl_v; \
+               }), \
+               OSL_READ_REG(osh, r)) \
+)
+#endif /* CONFIG_64BIT */
+
+#ifdef CONFIG_64BIT
+/* writeq is defined only for 64 bit platform */
+#if defined(CONFIG_SOC_EXYNOS9830)
+#define W_REG(osh, r, v) do { \
+       SELECT_BUS_WRITE(osh, \
+               ({ \
+                       exynos_pcie_l1_exit(0); \
+                       switch (sizeof(*(r))) { \
+                               case sizeof(uint8):     writeb((uint8)(v), \
+                                               (volatile uint8*)(r)); break; \
+                               case sizeof(uint16):    writew((uint16)(v), \
+                                               (volatile uint16*)(r)); break; \
+                               case sizeof(uint32):    writel((uint32)(v), \
+                                               (volatile uint32*)(r)); break; \
+                               case sizeof(uint64):    writeq((uint64)(v), \
+                                               (volatile uint64*)(r)); break; \
+                       } \
+                }), \
+               (OSL_WRITE_REG(osh, r, v))); \
+       } while (0)
+#else
+#define W_REG(osh, r, v) do { \
+       SELECT_BUS_WRITE(osh, \
+               switch (sizeof(*(r))) { \
+                       case sizeof(uint8):     writeb((uint8)(v), (volatile uint8*)(r)); break; \
+                       case sizeof(uint16):    writew((uint16)(v), (volatile uint16*)(r)); break; \
+                       case sizeof(uint32):    writel((uint32)(v), (volatile uint32*)(r)); break; \
+                       case sizeof(uint64):    writeq((uint64)(v), (volatile uint64*)(r)); break; \
+               }, \
+               (OSL_WRITE_REG(osh, r, v))); \
+       } while (0)
+#endif /* CONFIG_SOC_EXYNOS9830 */
+#else /* !CONFIG_64BIT */
+#define W_REG(osh, r, v) do { \
+       SELECT_BUS_WRITE(osh, \
+               switch (sizeof(*(r))) { \
+                       case sizeof(uint8):     writeb((uint8)(v), (volatile uint8*)(r)); break; \
+                       case sizeof(uint16):    writew((uint16)(v), (volatile uint16*)(r)); break; \
+                       case sizeof(uint32):    writel((uint32)(v), (volatile uint32*)(r)); break; \
+               }, \
+               (OSL_WRITE_REG(osh, r, v))); \
+       } while (0)
+#endif /* CONFIG_64BIT */
+
+#define        AND_REG(osh, r, v)              W_REG(osh, (r), R_REG(osh, r) & (v))
+#define        OR_REG(osh, r, v)               W_REG(osh, (r), R_REG(osh, r) | (v))
+
+/* bcopy, bcmp, and bzero functions */
+#define        bcopy(src, dst, len)    memcpy((dst), (src), (len))
+#define        bcmp(b1, b2, len)       memcmp((b1), (b2), (len))
+#define        bzero(b, len)           memset((b), '\0', (len))
+
+/* uncached/cached virtual address */
+#define OSL_UNCACHED(va)       ((void *)va)
+#define OSL_CACHED(va)         ((void *)va)
+
+#define OSL_PREF_RANGE_LD(va, sz) BCM_REFERENCE(va)
+#define OSL_PREF_RANGE_ST(va, sz) BCM_REFERENCE(va)
+
+/* get processor cycle count */
+#if defined(__i386__)
+#define        OSL_GETCYCLES(x)        rdtscl((x))
+#else
+#define OSL_GETCYCLES(x)       ((x) = 0)
+#endif /* __i386__ */
+
+/* dereference an address that may cause a bus exception */
+#define        BUSPROBE(val, addr)     ({ (val) = R_REG(NULL, (addr)); 0; })
+
+/* map/unmap physical to virtual I/O */
+#if !defined(CONFIG_MMC_MSM7X00A)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0))
+#define        REG_MAP(pa, size)       ioremap((unsigned long)(pa), (unsigned long)(size))
+#else
+#define        REG_MAP(pa, size)       ioremap_nocache((unsigned long)(pa), (unsigned long)(size))
+#endif
+#else
+#define REG_MAP(pa, size)       (void *)(0)
+#endif /* !defined(CONFIG_MMC_MSM7X00A */
+#define        REG_UNMAP(va)           iounmap((va))
+
+/* shared (dma-able) memory access macros */
+#define        R_SM(r)                 *(r)
+#define        W_SM(r, v)              (*(r) = (v))
+#define        OR_SM(r, v)             (*(r) |= (v))
+#define        BZERO_SM(r, len)        memset((r), '\0', (len))
+
+/* Because the non BINOSL implemenation of the PKT OSL routines are macros (for
+ * performance reasons),  we need the Linux headers.
+ */
+#include <linuxver.h>          /* use current 2.4.x calling conventions */
+
+#define OSL_RAND()             osl_rand()
+extern uint32 osl_rand(void);
+
+#define        DMA_FLUSH(osh, va, size, direction, p, dmah) \
+       osl_dma_flush((osh), (va), (size), (direction), (p), (dmah))
+#define        DMA_MAP(osh, va, size, direction, p, dmah) \
+       osl_dma_map((osh), (va), (size), (direction), (p), (dmah))
+
+#else /* ! BCMDRIVER */
+
+/* ASSERT */
+       #define ASSERT(exp)     do {} while (0)
+
+#define ASSERT_FP(exp) ASSERT(exp)
+
+/* MALLOC and MFREE */
+#define MALLOC(o, l) malloc(l)
+#define MFREE(o, p, l) free(p)
+#include <stdlib.h>
+
+/* str* and mem* functions */
+#include <string.h>
+
+/* *printf functions */
+#include <stdio.h>
+
+/* bcopy, bcmp, and bzero */
+extern void bcopy(const void *src, void *dst, size_t len);
+extern int bcmp(const void *b1, const void *b2, size_t len);
+extern void bzero(void *b, size_t len);
+#endif /* ! BCMDRIVER */
+
+typedef struct sk_buff_head PKT_LIST;
+#define PKTLIST_INIT(x)                skb_queue_head_init((x))
+#define PKTLIST_ENQ(x, y)      skb_queue_head((struct sk_buff_head *)(x), (struct sk_buff *)(y))
+#define PKTLIST_DEQ(x)         skb_dequeue((struct sk_buff_head *)(x))
+#define PKTLIST_UNLINK(x, y)   skb_unlink((struct sk_buff *)(y), (struct sk_buff_head *)(x))
+#define PKTLIST_FINI(x)                skb_queue_purge((struct sk_buff_head *)(x))
+
+#ifndef _linuxver_h_
+typedef struct timer_list_compat timer_list_compat_t;
+#endif /* _linuxver_h_ */
+typedef struct osl_timer {
+       timer_list_compat_t *timer;
+       bool   set;
+} osl_timer_t;
+
+typedef void (*linux_timer_fn)(ulong arg);
+
+extern osl_timer_t * osl_timer_init(osl_t *osh, const char *name, void (*fn)(void *arg), void *arg);
+extern void osl_timer_add(osl_t *osh, osl_timer_t *t, uint32 ms, bool periodic);
+extern void osl_timer_update(osl_t *osh, osl_timer_t *t, uint32 ms, bool periodic);
+extern bool osl_timer_del(osl_t *osh, osl_timer_t *t);
+
+#ifdef BCMDRIVER
+typedef atomic_t osl_atomic_t;
+#define OSL_ATOMIC_SET(osh, v, x)      atomic_set(v, x)
+#define OSL_ATOMIC_INIT(osh, v)                atomic_set(v, 0)
+#define OSL_ATOMIC_INC(osh, v)         atomic_inc(v)
+#define OSL_ATOMIC_INC_RETURN(osh, v)  atomic_inc_return(v)
+#define OSL_ATOMIC_DEC(osh, v)         atomic_dec(v)
+#define OSL_ATOMIC_DEC_RETURN(osh, v)  atomic_dec_return(v)
+#define OSL_ATOMIC_READ(osh, v)                atomic_read(v)
+#define OSL_ATOMIC_ADD(osh, v, x)      atomic_add(v, x)
+
+#ifndef atomic_set_mask
+#define OSL_ATOMIC_OR(osh, v, x)       atomic_or(x, v)
+#define OSL_ATOMIC_AND(osh, v, x)      atomic_and(x, v)
+#else
+#define OSL_ATOMIC_OR(osh, v, x)       atomic_set_mask(x, v)
+#define OSL_ATOMIC_AND(osh, v, x)      atomic_clear_mask(~x, v)
+#endif
+#endif /* BCMDRIVER */
+
+extern void *osl_spin_lock_init(osl_t *osh);
+extern void osl_spin_lock_deinit(osl_t *osh, void *lock);
+extern unsigned long osl_spin_lock(void *lock);
+extern void osl_spin_unlock(void *lock, unsigned long flags);
+extern unsigned long osl_spin_lock_irq(void *lock);
+extern void osl_spin_unlock_irq(void *lock, unsigned long flags);
+extern unsigned long osl_spin_lock_bh(void *lock);
+extern void osl_spin_unlock_bh(void *lock, unsigned long flags);
+
+extern void *osl_mutex_lock_init(osl_t *osh);
+extern void osl_mutex_lock_deinit(osl_t *osh, void *lock);
+extern unsigned long osl_mutex_lock(void *lock);
+void osl_mutex_unlock(void *lock, unsigned long flags);
+
+typedef struct osl_timespec {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0))
+       __kernel_old_time_t     tv_sec;                 /* seconds */
+#else
+       __kernel_time_t tv_sec;                 /* seconds */
+#endif
+       __kernel_suseconds_t    tv_usec;        /* microseconds */
+       long            tv_nsec;                /* nanoseconds */
+} osl_timespec_t;
+extern void osl_do_gettimeofday(struct osl_timespec *ts);
+extern void osl_get_monotonic_boottime(struct osl_timespec *ts);
+extern uint32 osl_do_gettimediff(struct osl_timespec *cur_ts, struct osl_timespec *old_ts);
+#endif /* _linux_osl_h_ */
diff --git a/bcmdhd.101.10.240.x/include/linux_pkt.h b/bcmdhd.101.10.240.x/include/linux_pkt.h
new file mode 100644 (file)
index 0000000..e7fe0d1
--- /dev/null
@@ -0,0 +1,226 @@
+/*
+ * Linux Packet (skb) interface
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _linux_pkt_h_
+#define _linux_pkt_h_
+
+#include <typedefs.h>
+
+#ifdef __ARM_ARCH_7A__
+#define PKT_HEADROOM_DEFAULT NET_SKB_PAD /**< NET_SKB_PAD is defined in a linux kernel header */
+#else
+#define PKT_HEADROOM_DEFAULT 16
+#endif /* __ARM_ARCH_7A__ */
+
+#ifdef BCMDRIVER
+/*
+ * BINOSL selects the slightly slower function-call-based binary compatible osl.
+ * Macros expand to calls to functions defined in linux_osl.c .
+ */
+/* Because the non BINOSL implemenation of the PKT OSL routines are macros (for
+ * performance reasons),  we need the Linux headers.
+ */
+#include <linuxver.h>
+
+/* packet primitives */
+#ifdef BCM_OBJECT_TRACE
+#define        PKTGET(osh, len, send)          linux_pktget((osh), (len), __LINE__, __FUNCTION__)
+#define        PKTDUP(osh, skb)                osl_pktdup((osh), (skb), __LINE__, __FUNCTION__)
+#else
+#define        PKTGET(osh, len, send)          linux_pktget((osh), (len))
+#define        PKTDUP(osh, skb)                osl_pktdup((osh), (skb))
+#endif /* BCM_OBJECT_TRACE */
+#define PKTLIST_DUMP(osh, buf)         BCM_REFERENCE(osh)
+#define PKTDBG_TRACE(osh, pkt, bit)    BCM_REFERENCE(osh)
+#if defined(BCM_OBJECT_TRACE)
+#define        PKTFREE(osh, skb, send)         linux_pktfree((osh), (skb), (send), __LINE__, __FUNCTION__)
+#else
+#define        PKTFREE(osh, skb, send)         linux_pktfree((osh), (skb), (send))
+#endif /* BCM_OBJECT_TRACE */
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+#define        PKTGET_STATIC(osh, len, send)           osl_pktget_static((osh), (len))
+#define        PKTFREE_STATIC(osh, skb, send)          osl_pktfree_static((osh), (skb), (send))
+#else
+#define        PKTGET_STATIC   PKTGET
+#define        PKTFREE_STATIC  PKTFREE
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+#define        PKTDATA(osh, skb)               ({BCM_REFERENCE(osh); (((struct sk_buff*)(skb))->data);})
+#define        PKTLEN(osh, skb)                ({BCM_REFERENCE(osh); (((struct sk_buff*)(skb))->len);})
+#define        PKTHEAD(osh, skb)               ({BCM_REFERENCE(osh); (((struct sk_buff*)(skb))->head);})
+#define        PKTSOCK(osh, skb)               ({BCM_REFERENCE(osh); (((struct sk_buff*)(skb))->sk);})
+#define PKTSETHEAD(osh, skb, h)                ({BCM_REFERENCE(osh); \
+                                       (((struct sk_buff *)(skb))->head = (h));})
+#define PKTHEADROOM(osh, skb)          (PKTDATA(osh, skb)-(((struct sk_buff*)(skb))->head))
+#define PKTEXPHEADROOM(osh, skb, b)    \
+       ({ \
+        BCM_REFERENCE(osh); \
+        skb_realloc_headroom((struct sk_buff*)(skb), (b)); \
+        })
+#define PKTTAILROOM(osh, skb)          \
+       ({ \
+        BCM_REFERENCE(osh); \
+        skb_tailroom((struct sk_buff*)(skb)); \
+        })
+#define PKTPADTAILROOM(osh, skb, padlen) \
+       ({ \
+        BCM_REFERENCE(osh); \
+        skb_pad((struct sk_buff*)(skb), (padlen)); \
+        })
+#define        PKTNEXT(osh, skb)               ({BCM_REFERENCE(osh); (((struct sk_buff*)(skb))->next);})
+#define        PKTSETNEXT(osh, skb, x)         \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->next = (struct sk_buff*)(x)); \
+        })
+#define        PKTSETLEN(osh, skb, len)        \
+       ({ \
+        BCM_REFERENCE(osh); \
+        __skb_trim((struct sk_buff*)(skb), (len)); \
+        })
+#define        PKTPUSH(osh, skb, bytes)        \
+       ({ \
+        BCM_REFERENCE(osh); \
+        skb_push((struct sk_buff*)(skb), (bytes)); \
+        })
+#define        PKTPULL(osh, skb, bytes)        \
+       ({ \
+        BCM_REFERENCE(osh); \
+        skb_pull((struct sk_buff*)(skb), (bytes)); \
+        })
+#define        PKTTAG(skb)                     ((void*)(((struct sk_buff*)(skb))->cb))
+#define PKTSETPOOL(osh, skb, x, y)     BCM_REFERENCE(osh)
+#define        PKTPOOL(osh, skb)               ({BCM_REFERENCE(osh); BCM_REFERENCE(skb); FALSE;})
+#define PKTFREELIST(skb)        PKTLINK(skb)
+#define PKTSETFREELIST(skb, x)  PKTSETLINK((skb), (x))
+#define PKTPTR(skb)             (skb)
+#define PKTID(skb)              ({BCM_REFERENCE(skb); 0;})
+#define PKTSETID(skb, id)       ({BCM_REFERENCE(skb); BCM_REFERENCE(id);})
+#define PKTSHRINK(osh, m)              ({BCM_REFERENCE(osh); m;})
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)) && defined(TSQ_MULTIPLIER)
+#define PKTORPHAN(skb, tsq)          osl_pkt_orphan_partial(skb, tsq)
+extern void osl_pkt_orphan_partial(struct sk_buff *skb, int tsq);
+#else
+#define PKTORPHAN(skb, tsq)          ({BCM_REFERENCE(skb); 0;})
+#endif /* Linux Version >= 3.6 */
+
+#define        PKTSETFAST(osh, skb)    ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTCLRFAST(osh, skb)    ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTISFAST(osh, skb)     ({BCM_REFERENCE(osh); BCM_REFERENCE(skb); FALSE;})
+#define PKTLITIDX(skb)         ({BCM_REFERENCE(skb); 0;})
+#define PKTSETLITIDX(skb, idx) ({BCM_REFERENCE(skb); BCM_REFERENCE(idx);})
+#define PKTRESETLITIDX(skb)    ({BCM_REFERENCE(skb);})
+#define PKTRITIDX(skb)         ({BCM_REFERENCE(skb); 0;})
+#define PKTSETRITIDX(skb, idx) ({BCM_REFERENCE(skb); BCM_REFERENCE(idx);})
+#define PKTRESETRITIDX(skb)    ({BCM_REFERENCE(skb);})
+
+#define        PKTSETSKIPCT(osh, skb)  ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTCLRSKIPCT(osh, skb)  ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTSKIPCT(osh, skb)     ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+
+#define PKTFRAGLEN(osh, lb, ix)                        (0)
+#define PKTSETFRAGLEN(osh, lb, ix, len)                BCM_REFERENCE(osh)
+
+#define        PKTSETTOBR(osh, skb)    ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTCLRTOBR(osh, skb)    ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTISTOBR(skb)  ({BCM_REFERENCE(skb); FALSE;})
+
+#ifdef BCMFA
+#ifdef BCMFA_HW_HASH
+#define PKTSETFAHIDX(skb, idx) (((struct sk_buff*)(skb))->napt_idx = idx)
+#else
+#define PKTSETFAHIDX(skb, idx) ({BCM_REFERENCE(skb); BCM_REFERENCE(idx);})
+#endif /* BCMFA_SW_HASH */
+#define PKTGETFAHIDX(skb)      (((struct sk_buff*)(skb))->napt_idx)
+#define PKTSETFADEV(skb, imp)  (((struct sk_buff*)(skb))->dev = imp)
+#define PKTSETRXDEV(skb)       (((struct sk_buff*)(skb))->rxdev = ((struct sk_buff*)(skb))->dev)
+
+#define        AUX_TCP_FIN_RST (1 << 0)
+#define        AUX_FREED       (1 << 1)
+#define PKTSETFAAUX(skb)       (((struct sk_buff*)(skb))->napt_flags |= AUX_TCP_FIN_RST)
+#define        PKTCLRFAAUX(skb)        (((struct sk_buff*)(skb))->napt_flags &= (~AUX_TCP_FIN_RST))
+#define        PKTISFAAUX(skb)         (((struct sk_buff*)(skb))->napt_flags & AUX_TCP_FIN_RST)
+#define PKTSETFAFREED(skb)     (((struct sk_buff*)(skb))->napt_flags |= AUX_FREED)
+#define        PKTCLRFAFREED(skb)      (((struct sk_buff*)(skb))->napt_flags &= (~AUX_FREED))
+#define        PKTISFAFREED(skb)       (((struct sk_buff*)(skb))->napt_flags & AUX_FREED)
+#define        PKTISFABRIDGED(skb)     PKTISFAAUX(skb)
+#else
+#define        PKTISFAAUX(skb)         ({BCM_REFERENCE(skb); FALSE;})
+#define        PKTISFABRIDGED(skb)     ({BCM_REFERENCE(skb); FALSE;})
+#define        PKTISFAFREED(skb)       ({BCM_REFERENCE(skb); FALSE;})
+
+#define        PKTCLRFAAUX(skb)        BCM_REFERENCE(skb)
+#define PKTSETFAFREED(skb)     BCM_REFERENCE(skb)
+#define        PKTCLRFAFREED(skb)      BCM_REFERENCE(skb)
+#endif /* BCMFA */
+
+#if defined(BCM_OBJECT_TRACE)
+extern void linux_pktfree(osl_t *osh, void *skb, bool send, int line, const char *caller);
+#else
+extern void linux_pktfree(osl_t *osh, void *skb, bool send);
+#endif /* BCM_OBJECT_TRACE */
+extern void *osl_pktget_static(osl_t *osh, uint len);
+extern void osl_pktfree_static(osl_t *osh, void *skb, bool send);
+extern void osl_pktclone(osl_t *osh, void **pkt);
+
+#ifdef BCM_OBJECT_TRACE
+extern void *linux_pktget(osl_t *osh, uint len, int line, const char *caller);
+extern void *osl_pktdup(osl_t *osh, void *skb, int line, const char *caller);
+#else
+extern void *linux_pktget(osl_t *osh, uint len);
+extern void *osl_pktdup(osl_t *osh, void *skb);
+#endif /* BCM_OBJECT_TRACE */
+extern void *osl_pkt_frmnative(osl_t *osh, void *skb);
+extern struct sk_buff *osl_pkt_tonative(osl_t *osh, void *pkt);
+#define PKTFRMNATIVE(osh, skb) osl_pkt_frmnative(((osl_t *)osh), (struct sk_buff*)(skb))
+#define PKTTONATIVE(osh, pkt)          osl_pkt_tonative((osl_t *)(osh), (pkt))
+
+#define        PKTLINK(skb)                    (((struct sk_buff*)(skb))->prev)
+#define        PKTSETLINK(skb, x)              (((struct sk_buff*)(skb))->prev = (struct sk_buff*)(x))
+#define        PKTPRIO(skb)                    (((struct sk_buff*)(skb))->priority)
+#define        PKTSETPRIO(skb, x)              (((struct sk_buff*)(skb))->priority = (x))
+#define PKTSUMNEEDED(skb)              (((struct sk_buff*)(skb))->ip_summed == CHECKSUM_HW)
+#define PKTSETSUMGOOD(skb, x)          (((struct sk_buff*)(skb))->ip_summed = \
+                                               ((x) ? CHECKSUM_UNNECESSARY : CHECKSUM_NONE))
+/* PKTSETSUMNEEDED and PKTSUMGOOD are not possible because skb->ip_summed is overloaded */
+#define PKTSHARED(skb)                  (((struct sk_buff*)(skb))->cloned)
+
+#ifdef CONFIG_NF_CONNTRACK_MARK
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#define PKTMARK(p)                     (((struct sk_buff *)(p))->mark)
+#define PKTSETMARK(p, m)               ((struct sk_buff *)(p))->mark = (m)
+#else /* !2.6.0 */
+#define PKTMARK(p)                     (((struct sk_buff *)(p))->nfmark)
+#define PKTSETMARK(p, m)               ((struct sk_buff *)(p))->nfmark = (m)
+#endif /* 2.6.0 */
+#else /* CONFIG_NF_CONNTRACK_MARK */
+#define PKTMARK(p)                     0
+#define PKTSETMARK(p, m)
+#endif /* CONFIG_NF_CONNTRACK_MARK */
+
+#define PKTALLOCED(osh)                osl_pktalloced(osh)
+extern uint osl_pktalloced(osl_t *osh);
+
+#endif /* BCMDRIVER */
+
+#endif /* _linux_pkt_h_ */
diff --git a/bcmdhd.101.10.240.x/include/linuxver.h b/bcmdhd.101.10.240.x/include/linuxver.h
new file mode 100644 (file)
index 0000000..154acea
--- /dev/null
@@ -0,0 +1,915 @@
+/*
+ * Linux-specific abstractions to gain some independence from linux kernel versions.
+ * Pave over some 2.2 versus 2.4 versus 2.6 kernel differences.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _linuxver_h_
+#define _linuxver_h_
+
+/*
+ * The below pragmas are added as workaround for errors caused by update
+ * of gcc version to 4.8.2. GCC 4.6 adds -Wunused-but-set-variable and
+ * -Wunused-but-set-parameter to -Wall, for some configurations those
+ * warnings are produced in linux kernel. So for now the below pragmas
+ * disable the offending warnings. Permanent solution is to use -isystem
+ * but there is a performance problem with this change on RHEL5 servers
+ *
+ */
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wunused-but-set-variable"
+#pragma GCC diagnostic ignored "-Wunused-but-set-parameter"
+#endif
+
+#include <typedefs.h>
+#include <linux/version.h>
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+#include <linux/config.h>
+#else
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 33))
+#include <generated/autoconf.h>
+#else
+#include <linux/autoconf.h>
+#endif
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0))
+#include <linux/kconfig.h>
+#endif
+#include <linux/module.h>
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 0))
+/* __NO_VERSION__ must be defined for all linkables except one in 2.2 */
+#ifdef __UNDEF_NO_VERSION__
+#undef __NO_VERSION__
+#else
+#define __NO_VERSION__
+#endif
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 0) */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 5, 0)
+#define module_param(_name_, _type_, _perm_)   MODULE_PARM(_name_, "i")
+#define module_param_string(_name_, _string_, _size_, _perm_) \
+               MODULE_PARM(_string_, "c" __MODULE_STRING(_size_))
+#endif
+
+/* linux/malloc.h is deprecated, use linux/slab.h instead. */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 9))
+#include <linux/malloc.h>
+#else
+#include <linux/slab.h>
+#endif
+
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/string.h>
+#include <linux/pci.h>
+#include <linux/interrupt.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+#include <linux/semaphore.h>
+#else
+#include <asm/semaphore.h>
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28))
+#undef IP_TOS
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)) */
+#include <asm/io.h>
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 41))
+#include <linux/workqueue.h>
+#else
+#include <linux/tqueue.h>
+#ifndef work_struct
+#define work_struct tq_struct
+#endif
+#ifndef INIT_WORK
+#define INIT_WORK(_work, _func, _data) INIT_TQUEUE((_work), (_func), (_data))
+#endif
+#ifndef schedule_work
+#define schedule_work(_work) schedule_task((_work))
+#endif
+#ifndef flush_scheduled_work
+#define flush_scheduled_work() flush_scheduled_tasks()
+#endif
+#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 41) */
+
+/*
+ * TODO:
+ * daemonize() API is deprecated from kernel-3.8 onwards. More debugging
+ *      has to be done whether this can cause any issue in case, if driver is
+ *      loaded as a module from userspace.
+ */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+#define DAEMONIZE(a)   do { \
+               allow_signal(SIGKILL);  \
+               allow_signal(SIGTERM);  \
+       } while (0)
+#elif ((LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)) && \
+       (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)))
+#define DAEMONIZE(a) daemonize(a); \
+       allow_signal(SIGKILL); \
+       allow_signal(SIGTERM);
+#else /* Linux 2.4 (w/o preemption patch) */
+#define RAISE_RX_SOFTIRQ() \
+       cpu_raise_softirq(smp_processor_id(), NET_RX_SOFTIRQ)
+#define DAEMONIZE(a) daemonize(); \
+       do { if (a) \
+               strncpy(current->comm, a, MIN(sizeof(current->comm), (strlen(a)))); \
+       } while (0);
+#endif /* LINUX_VERSION_CODE  */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
+#define        MY_INIT_WORK(_work, _func)      INIT_WORK(_work, _func)
+#else
+#define        MY_INIT_WORK(_work, _func)      INIT_WORK(_work, _func, _work)
+#if !(LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18) && defined(RHEL_MAJOR) && \
+       (RHEL_MAJOR == 5))
+/* Exclude RHEL 5 */
+typedef void (*work_func_t)(void *work);
+#endif
+#endif /* >= 2.6.20 */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+/* Some distributions have their own 2.6.x compatibility layers */
+#ifndef IRQ_NONE
+typedef void irqreturn_t;
+#define IRQ_NONE
+#define IRQ_HANDLED
+#define IRQ_RETVAL(x)
+#endif
+#else
+typedef irqreturn_t(*FN_ISR) (int irq, void *dev_id, struct pt_regs *ptregs);
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0) */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
+#define IRQF_SHARED    SA_SHIRQ
+#endif /* < 2.6.18 */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 17)
+#ifdef CONFIG_NET_RADIO
+#endif
+#endif /* < 2.6.17 */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 5, 67)
+#define MOD_INC_USE_COUNT
+#define MOD_DEC_USE_COUNT
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 5, 67) */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
+#include <linux/sched.h>
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
+#include <linux/sched/rt.h>
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0) */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29)
+#include <net/lib80211.h>
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29)
+#include <linux/ieee80211.h>
+#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 14)
+#include <net/ieee80211.h>
+#endif
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 30) */
+
+#ifndef __exit
+#define __exit
+#endif
+#ifndef __devexit
+#define __devexit
+#endif
+#ifndef __devinit
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
+       #define __devinit       __init
+#else
+/* All devices are hotpluggable since linux 3.8.0 */
+       #define __devinit
+#endif
+#endif /* !__devinit */
+#ifndef __devinitdata
+#define __devinitdata
+#endif
+#ifndef __devexit_p
+#define __devexit_p(x) x
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 0))
+
+#define pci_get_drvdata(dev)           (dev)->sysdata
+#define pci_set_drvdata(dev, value)    (dev)->sysdata = (value)
+
+/*
+ * New-style (2.4.x) PCI/hot-pluggable PCI/CardBus registration
+ */
+
+struct pci_device_id {
+       unsigned int vendor, device;            /* Vendor and device ID or PCI_ANY_ID */
+       unsigned int subvendor, subdevice;      /* Subsystem ID's or PCI_ANY_ID */
+       unsigned int class, class_mask;         /* (class,subclass,prog-if) triplet */
+       unsigned long driver_data;              /* Data private to the driver */
+};
+
+struct pci_driver {
+       struct list_head node;
+       char *name;
+       const struct pci_device_id *id_table;   /* NULL if wants all devices */
+       int (*probe)(struct pci_dev *dev,
+                    const struct pci_device_id *id); /* New device inserted */
+       void (*remove)(struct pci_dev *dev);    /* Device removed (NULL if not a hot-plug
+                                                * capable driver)
+                                                */
+       void (*suspend)(struct pci_dev *dev);   /* Device suspended */
+       void (*resume)(struct pci_dev *dev);    /* Device woken up */
+};
+
+#define MODULE_DEVICE_TABLE(type, name)
+#define PCI_ANY_ID (~0)
+
+/* compatpci.c */
+#define pci_module_init pci_register_driver
+extern int pci_register_driver(struct pci_driver *drv);
+extern void pci_unregister_driver(struct pci_driver *drv);
+
+#endif /* PCI registration */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18))
+#define pci_module_init pci_register_driver
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 2, 18))
+#ifdef MODULE
+#define module_init(x) int init_module(void) { return x(); }
+#define module_exit(x) void cleanup_module(void) { x(); }
+#else
+#define module_init(x) __initcall(x);
+#define module_exit(x) __exitcall(x);
+#endif
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 2, 18) */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31)
+#define WL_USE_NETDEV_OPS
+#else
+#undef WL_USE_NETDEV_OPS
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31)) && defined(CONFIG_RFKILL)
+#define WL_CONFIG_RFKILL
+#else
+#undef WL_CONFIG_RFKILL
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 48))
+#define list_for_each(pos, head) \
+       for (pos = (head)->next; pos != (head); pos = pos->next)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 13))
+#define pci_resource_start(dev, bar)   ((dev)->base_address[(bar)])
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 44))
+#define pci_resource_start(dev, bar)   ((dev)->resource[(bar)].start)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 23))
+#define pci_enable_device(dev) do { } while (0)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 14))
+#define net_device device
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 42))
+
+/*
+ * DMA mapping
+ *
+ * See linux/Documentation/DMA-mapping.txt
+ */
+
+#ifndef PCI_DMA_TODEVICE
+#define        PCI_DMA_TODEVICE        1
+#define        PCI_DMA_FROMDEVICE      2
+#endif
+
+typedef u32 dma_addr_t;
+
+/* Pure 2^n version of get_order */
+static inline int get_order(unsigned long size)
+{
+       int order;
+
+       size = (size-1) >> (PAGE_SHIFT-1);
+       order = -1;
+       do {
+               size >>= 1;
+               order++;
+       } while (size);
+       return order;
+}
+
+static inline void *pci_alloc_consistent(struct pci_dev *hwdev, size_t size,
+                                         dma_addr_t *dma_handle)
+{
+       void *ret;
+       int gfp = GFP_ATOMIC | GFP_DMA;
+
+       ret = (void *)__get_free_pages(gfp, get_order(size));
+
+       if (ret != NULL) {
+               bzero(ret, size);
+               *dma_handle = virt_to_bus(ret);
+       }
+       return ret;
+}
+static inline void pci_free_consistent(struct pci_dev *hwdev, size_t size,
+                                       void *vaddr, dma_addr_t dma_handle)
+{
+       free_pages((unsigned long)vaddr, get_order(size));
+}
+#define pci_map_single(cookie, address, size, dir)     virt_to_bus(address)
+#define pci_unmap_single(cookie, address, size, dir)
+
+#endif /* DMA mapping */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+
+typedef struct timer_list timer_list_compat_t;
+
+#define init_timer_compat(timer_compat, cb, priv) \
+       init_timer(timer_compat); \
+       (timer_compat)->data = (ulong)priv; \
+       (timer_compat)->function = cb
+#define timer_set_private(timer_compat, priv) (timer_compat)->data = (ulong)priv
+#define timer_expires(timer_compat) (timer_compat)->expires
+
+#else /* LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0) */
+
+typedef struct timer_list_compat {
+       struct timer_list timer;
+       void *arg;
+       void (*callback)(ulong arg);
+} timer_list_compat_t;
+
+extern void timer_cb_compat(struct timer_list *tl);
+
+#define init_timer_compat(timer_compat, cb, priv) \
+       (timer_compat)->arg = priv; \
+       (timer_compat)->callback = cb; \
+       timer_setup(&(timer_compat)->timer, timer_cb_compat, 0);
+#define timer_set_private(timer_compat, priv) (timer_compat)->arg = priv
+#define timer_expires(timer_compat) (timer_compat)->timer.expires
+
+#define del_timer(t) del_timer(&((t)->timer))
+#define del_timer_sync(t) del_timer_sync(&((t)->timer))
+#define timer_pending(t) timer_pending(&((t)->timer))
+#define add_timer(t) add_timer(&((t)->timer))
+#define mod_timer(t, j) mod_timer(&((t)->timer), j)
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0) */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 43))
+
+#define dev_kfree_skb_any(a)           dev_kfree_skb(a)
+#define netif_down(dev)                        do { (dev)->start = 0; } while (0)
+
+/* pcmcia-cs provides its own netdevice compatibility layer */
+#ifndef _COMPAT_NETDEVICE_H
+
+/*
+ * SoftNet
+ *
+ * For pre-softnet kernels we need to tell the upper layer not to
+ * re-enter start_xmit() while we are in there. However softnet
+ * guarantees not to enter while we are in there so there is no need
+ * to do the netif_stop_queue() dance unless the transmit queue really
+ * gets stuck. This should also improve performance according to tests
+ * done by Aman Singla.
+ */
+
+#define dev_kfree_skb_irq(a)   dev_kfree_skb(a)
+#define netif_wake_queue(dev) \
+               do { clear_bit(0, &(dev)->tbusy); mark_bh(NET_BH); } while (0)
+#define netif_stop_queue(dev)  set_bit(0, &(dev)->tbusy)
+
+static inline void netif_start_queue(struct net_device *dev)
+{
+       dev->tbusy = 0;
+       dev->interrupt = 0;
+       dev->start = 1;
+}
+
+#define netif_queue_stopped(dev)       (dev)->tbusy
+#define netif_running(dev)             (dev)->start
+
+#endif /* _COMPAT_NETDEVICE_H */
+
+#define netif_device_attach(dev)       netif_start_queue(dev)
+#define netif_device_detach(dev)       netif_stop_queue(dev)
+
+/* 2.4.x renamed bottom halves to tasklets */
+#define tasklet_struct                         tq_struct
+static inline void tasklet_schedule(struct tasklet_struct *tasklet)
+{
+       queue_task(tasklet, &tq_immediate);
+       mark_bh(IMMEDIATE_BH);
+}
+
+static inline void tasklet_init(struct tasklet_struct *tasklet,
+                                void (*func)(unsigned long),
+                                unsigned long data)
+{
+       tasklet->next = NULL;
+       tasklet->sync = 0;
+       tasklet->routine = (void (*)(void *))func;
+       tasklet->data = (void *)data;
+}
+#define tasklet_kill(tasklet)  { do {} while (0); }
+
+/* 2.4.x introduced del_timer_sync() */
+#define del_timer_sync(timer) del_timer(timer)
+
+#else
+
+#define netif_down(dev)
+
+#endif /* SoftNet */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 3))
+
+/*
+ * Emit code to initialise a tq_struct's routine and data pointers
+ */
+#define PREPARE_TQUEUE(_tq, _routine, _data)                   \
+       do {                                                    \
+               (_tq)->routine = _routine;                      \
+               (_tq)->data = _data;                            \
+       } while (0)
+
+/*
+ * Emit code to initialise all of a tq_struct
+ */
+#define INIT_TQUEUE(_tq, _routine, _data)                      \
+       do {                                                    \
+               INIT_LIST_HEAD(&(_tq)->list);                   \
+               (_tq)->sync = 0;                                \
+               PREPARE_TQUEUE((_tq), (_routine), (_data));     \
+       } while (0)
+
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 3) */
+
+/* Power management related macro & routines */
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 9)
+#define        PCI_SAVE_STATE(a, b)    pci_save_state(a)
+#define        PCI_RESTORE_STATE(a, b) pci_restore_state(a)
+#else
+#define        PCI_SAVE_STATE(a, b)    pci_save_state(a, b)
+#define        PCI_RESTORE_STATE(a, b) pci_restore_state(a, b)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 6))
+static inline int
+pci_save_state(struct pci_dev *dev, u32 *buffer)
+{
+       int i;
+       if (buffer) {
+               /* 100% dword access ok here? */
+               for (i = 0; i < 16; i++)
+                       pci_read_config_dword(dev, i * 4, &buffer[i]);
+       }
+       return 0;
+}
+
+static inline int
+pci_restore_state(struct pci_dev *dev, u32 *buffer)
+{
+       int i;
+
+       if (buffer) {
+               for (i = 0; i < 16; i++)
+                       pci_write_config_dword(dev, i * 4, buffer[i]);
+       }
+       /*
+        * otherwise, write the context information we know from bootup.
+        * This works around a problem where warm-booting from Windows
+        * combined with a D3(hot)->D0 transition causes PCI config
+        * header data to be forgotten.
+        */
+       else {
+               for (i = 0; i < 6; i ++)
+                       pci_write_config_dword(dev,
+                                              PCI_BASE_ADDRESS_0 + (i * 4),
+                                              pci_resource_start(dev, i));
+               pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
+       }
+       return 0;
+}
+#endif /* PCI power management */
+
+/* Old cp0 access macros deprecated in 2.4.19 */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 19))
+#define read_c0_count() read_32bit_cp0_register(CP0_COUNT)
+#endif
+
+/* Module refcount handled internally in 2.6.x */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24))
+#ifndef SET_MODULE_OWNER
+#define SET_MODULE_OWNER(dev)          do {} while (0)
+#define OLD_MOD_INC_USE_COUNT          MOD_INC_USE_COUNT
+#define OLD_MOD_DEC_USE_COUNT          MOD_DEC_USE_COUNT
+#else
+#define OLD_MOD_INC_USE_COUNT          do {} while (0)
+#define OLD_MOD_DEC_USE_COUNT          do {} while (0)
+#endif
+#else /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24) */
+#ifndef SET_MODULE_OWNER
+#define SET_MODULE_OWNER(dev)          do {} while (0)
+#endif
+#ifndef MOD_INC_USE_COUNT
+#define MOD_INC_USE_COUNT                      do {} while (0)
+#endif
+#ifndef MOD_DEC_USE_COUNT
+#define MOD_DEC_USE_COUNT                      do {} while (0)
+#endif
+#define OLD_MOD_INC_USE_COUNT          MOD_INC_USE_COUNT
+#define OLD_MOD_DEC_USE_COUNT          MOD_DEC_USE_COUNT
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24) */
+
+#ifndef SET_NETDEV_DEV
+#define SET_NETDEV_DEV(net, pdev)      do {} while (0)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 1, 0))
+#ifndef HAVE_FREE_NETDEV
+#define free_netdev(dev)               kfree(dev)
+#endif
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3, 1, 0) */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+/* struct packet_type redefined in 2.6.x */
+#define af_packet_priv                 data
+#endif
+
+/* suspend args */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11)
+#define DRV_SUSPEND_STATE_TYPE pm_message_t
+#else
+#define DRV_SUSPEND_STATE_TYPE uint32
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
+#define CHECKSUM_HW    CHECKSUM_PARTIAL
+#endif
+
+typedef struct {
+       void    *parent;  /* some external entity that the thread supposed to work for */
+       char    *proc_name;
+       struct  task_struct *p_task;
+       long    thr_pid;
+       int             prio; /* priority */
+       struct  semaphore sema;
+       int     terminated;
+       struct  completion completed;
+       int     flush_ind;
+       struct  completion flushed;
+       spinlock_t      spinlock;
+       int             up_cnt;
+} tsk_ctl_t;
+
+/* ANDREY: new MACROs to start stop threads(OLD kthread API STYLE) */
+/* requires  tsk_ctl_t tsk  argument, the caller's priv data is passed in owner ptr */
+/* note this macro assumes there may be only one context waiting on thread's completion */
+#ifdef DHD_DEBUG
+#define DBG_THR(x) printk x
+#else
+#define DBG_THR(x)
+#endif
+
+extern unsigned long osl_spin_lock(void *lock);
+extern void osl_spin_unlock(void *lock, unsigned long flags);
+
+#define TSK_LOCK(lock, flags)  (flags) = osl_spin_lock(lock)
+#define TSK_UNLOCK(lock, flags)        osl_spin_unlock((lock), (flags))
+
+static inline bool binary_sema_down(tsk_ctl_t *tsk)
+{
+       if (down_interruptible(&tsk->sema) == 0) {
+               unsigned long flags = 0;
+               TSK_LOCK(&tsk->spinlock, flags);
+               if (tsk->up_cnt == 1)
+                       tsk->up_cnt--;
+               else {
+                       DBG_THR(("dhd_dpc_thread: Unexpected up_cnt %d\n", tsk->up_cnt));
+               }
+               TSK_UNLOCK(&tsk->spinlock, flags);
+               return false;
+       } else
+               return true;
+}
+
+static inline bool binary_sema_up(tsk_ctl_t *tsk)
+{
+       bool sem_up = false;
+       unsigned long flags = 0;
+
+       TSK_LOCK(&tsk->spinlock, flags);
+       if (tsk->up_cnt == 0) {
+               tsk->up_cnt++;
+               sem_up = true;
+       } else if (tsk->up_cnt == 1) {
+               /* dhd_sched_dpc: dpc is alread up! */
+       } else
+               DBG_THR(("dhd_sched_dpc: unexpected up cnt %d!\n", tsk->up_cnt));
+
+       TSK_UNLOCK(&tsk->spinlock, flags);
+
+       if (sem_up)
+               up(&tsk->sema);
+
+       return sem_up;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#define SMP_RD_BARRIER_DEPENDS(x) smp_read_barrier_depends(x)
+#else
+#define SMP_RD_BARRIER_DEPENDS(x) smp_rmb(x)
+#endif
+
+#define PROC_START(thread_func, owner, tsk_ctl, flags, name) \
+{ \
+       sema_init(&((tsk_ctl)->sema), 0); \
+       init_completion(&((tsk_ctl)->completed)); \
+       init_completion(&((tsk_ctl)->flushed)); \
+       (tsk_ctl)->parent = owner; \
+       (tsk_ctl)->proc_name = name;  \
+       (tsk_ctl)->terminated = FALSE; \
+       (tsk_ctl)->flush_ind = FALSE; \
+       (tsk_ctl)->up_cnt = 0; \
+       (tsk_ctl)->p_task  = kthread_run(thread_func, tsk_ctl, (char*)name); \
+       if (IS_ERR((tsk_ctl)->p_task)) { \
+               (tsk_ctl)->thr_pid = -1; \
+               DBG_THR(("%s(): thread:%s create failed\n", __FUNCTION__, \
+                       (tsk_ctl)->proc_name)); \
+       } else { \
+               (tsk_ctl)->thr_pid = (tsk_ctl)->p_task->pid; \
+               spin_lock_init(&((tsk_ctl)->spinlock)); \
+               DBG_THR(("%s(): thread:%s:%lx started\n", __FUNCTION__, \
+                       (tsk_ctl)->proc_name, (tsk_ctl)->thr_pid)); \
+       }; \
+}
+
+#define PROC_WAIT_TIMEOUT_MSEC 5000 /* 5 seconds */
+
+#define PROC_STOP(tsk_ctl) \
+{ \
+       uint timeout = (uint)msecs_to_jiffies(PROC_WAIT_TIMEOUT_MSEC); \
+       (tsk_ctl)->terminated = TRUE; \
+       smp_wmb(); \
+       up(&((tsk_ctl)->sema)); \
+       DBG_THR(("%s(): thread:%s:%lx wait for terminate\n", __FUNCTION__, \
+                        (tsk_ctl)->proc_name, (tsk_ctl)->thr_pid)); \
+       timeout = (uint)wait_for_completion_timeout(&((tsk_ctl)->completed), timeout); \
+       if (timeout == 0) \
+               DBG_THR(("%s(): thread:%s:%lx terminate timeout\n", __FUNCTION__, \
+                        (tsk_ctl)->proc_name, (tsk_ctl)->thr_pid)); \
+       else \
+               DBG_THR(("%s(): thread:%s:%lx terminated OK\n", __FUNCTION__, \
+                        (tsk_ctl)->proc_name, (tsk_ctl)->thr_pid)); \
+       (tsk_ctl)->parent = NULL; \
+       (tsk_ctl)->proc_name = NULL;  \
+       (tsk_ctl)->thr_pid = -1; \
+       (tsk_ctl)->up_cnt = 0; \
+}
+
+#define PROC_STOP_USING_BINARY_SEMA(tsk_ctl) \
+{ \
+       uint timeout = (uint)msecs_to_jiffies(PROC_WAIT_TIMEOUT_MSEC); \
+       (tsk_ctl)->terminated = TRUE; \
+       smp_wmb(); \
+       binary_sema_up(tsk_ctl);        \
+       DBG_THR(("%s(): thread:%s:%lx wait for terminate\n", __FUNCTION__, \
+                        (tsk_ctl)->proc_name, (tsk_ctl)->thr_pid)); \
+       timeout = (uint)wait_for_completion_timeout(&((tsk_ctl)->completed), timeout); \
+       if (timeout == 0) \
+               DBG_THR(("%s(): thread:%s:%lx terminate timeout\n", __FUNCTION__, \
+                        (tsk_ctl)->proc_name, (tsk_ctl)->thr_pid)); \
+       else \
+               DBG_THR(("%s(): thread:%s:%lx terminated OK\n", __FUNCTION__, \
+                        (tsk_ctl)->proc_name, (tsk_ctl)->thr_pid)); \
+       (tsk_ctl)->parent = NULL; \
+       (tsk_ctl)->proc_name = NULL;  \
+       (tsk_ctl)->thr_pid = -1; \
+}
+
+/*
+* Flush is non-rentrant, so callers must make sure
+* there is no race condition.
+* For safer exit, added wait_for_completion_timeout
+* with 1 sec timeout.
+*/
+#define PROC_FLUSH_USING_BINARY_SEMA(tsk_ctl) \
+{ \
+       uint timeout = (uint)msecs_to_jiffies(PROC_WAIT_TIMEOUT_MSEC); \
+       (tsk_ctl)->flush_ind = TRUE; \
+       smp_wmb(); \
+       binary_sema_up(tsk_ctl);        \
+       DBG_THR(("%s(): thread:%s:%lx wait for flush\n", __FUNCTION__, \
+                        (tsk_ctl)->proc_name, (tsk_ctl)->thr_pid)); \
+       timeout = (uint)wait_for_completion_timeout(&((tsk_ctl)->flushed), timeout); \
+       if (timeout == 0) \
+               DBG_THR(("%s(): thread:%s:%lx flush timeout\n", __FUNCTION__, \
+                        (tsk_ctl)->proc_name, (tsk_ctl)->thr_pid)); \
+       else \
+               DBG_THR(("%s(): thread:%s:%lx flushed OK\n", __FUNCTION__, \
+                        (tsk_ctl)->proc_name, (tsk_ctl)->thr_pid)); \
+}
+
+/*  ----------------------- */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31))
+#define KILL_PROC(nr, sig) \
+{ \
+struct task_struct *tsk; \
+struct pid *pid;    \
+pid = find_get_pid((pid_t)nr);    \
+tsk = pid_task(pid, PIDTYPE_PID);    \
+if (tsk) send_sig(sig, tsk, 1); \
+}
+#else
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && (LINUX_VERSION_CODE <= \
+       KERNEL_VERSION(2, 6, 30))
+#define KILL_PROC(pid, sig) \
+{ \
+       struct task_struct *tsk; \
+       tsk = find_task_by_vpid(pid); \
+       if (tsk) send_sig(sig, tsk, 1); \
+}
+#else
+#define KILL_PROC(pid, sig) \
+{ \
+       kill_proc(pid, sig, 1); \
+}
+#endif
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#include <linux/time.h>
+#include <linux/wait.h>
+#else
+#include <linux/sched.h>
+
+#define __wait_event_interruptible_timeout(wq, condition, ret)         \
+do {                                                                   \
+       wait_queue_t __wait;                                            \
+       init_waitqueue_entry(&__wait, current);                         \
+                                                                       \
+       add_wait_queue(&wq, &__wait);                                   \
+       for (;;) {                                                      \
+               set_current_state(TASK_INTERRUPTIBLE);                  \
+               if (condition)                                          \
+                       break;                                          \
+               if (!signal_pending(current)) {                         \
+                       ret = schedule_timeout(ret);                    \
+                       if (!ret)                                       \
+                               break;                                  \
+                       continue;                                       \
+               }                                                       \
+               ret = -ERESTARTSYS;                                     \
+               break;                                                  \
+       }                                                               \
+       current->state = TASK_RUNNING;                                  \
+       remove_wait_queue(&wq, &__wait);                                \
+} while (0)
+
+#define wait_event_interruptible_timeout(wq, condition, timeout)       \
+({                                                                     \
+       long __ret = timeout;                                           \
+       if (!(condition))                                               \
+               __wait_event_interruptible_timeout(wq, condition, __ret); \
+       __ret;                                                          \
+})
+
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)) */
+
+/*
+For < 2.6.24, wl creates its own netdev but doesn't
+align the priv area like the genuine alloc_netdev().
+Since netdev_priv() always gives us the aligned address, it will
+not match our unaligned address for < 2.6.24
+*/
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24))
+#define DEV_PRIV(dev)  (dev->priv)
+#else
+#define DEV_PRIV(dev)  netdev_priv(dev)
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 20)
+#define WL_ISR(i, d, p)         wl_isr((i), (d))
+#else
+#define WL_ISR(i, d, p)         wl_isr((i), (d), (p))
+#endif  /* < 2.6.20 */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+#define netdev_priv(dev) dev->priv
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+#define CAN_SLEEP()    ((!in_atomic() && !irqs_disabled()))
+#else
+#define CAN_SLEEP()    (FALSE)
+#endif
+
+#define KMALLOC_FLAG (CAN_SLEEP() ? GFP_KERNEL: GFP_ATOMIC)
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+#define RANDOM32       prandom_u32
+#define RANDOM_BYTES    prandom_bytes
+#else
+#define RANDOM32       random32
+#define RANDOM_BYTES    get_random_bytes
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+#define SRANDOM32(entropy)     prandom_seed(entropy)
+#else
+#define SRANDOM32(entropy)     srandom32(entropy)
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0) */
+
+/*
+ * Overide latest kfifo functions with
+ * older version to work on older kernels
+ */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 33)) && !defined(WL_COMPAT_WIRELESS)
+#define kfifo_in_spinlocked(a, b, c, d)                kfifo_put(a, (u8 *)b, c)
+#define kfifo_out_spinlocked(a, b, c, d)       kfifo_get(a, (u8 *)b, c)
+#define kfifo_esize(a)                         1
+#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 32)) && \
+       (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 36)) &&      !defined(WL_COMPAT_WIRELESS)
+#define kfifo_in_spinlocked(a, b, c, d)                kfifo_in_locked(a, b, c, d)
+#define kfifo_out_spinlocked(a, b, c, d)       kfifo_out_locked(a, b, c, d)
+#define kfifo_esize(a)                         1
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 33)) */
+
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
+#pragma GCC diagnostic pop
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0))
+#include <linux/fs.h>
+static inline struct inode *file_inode(const struct file *f)
+{
+       return f->f_dentry->d_inode;
+}
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0)) */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0)
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0) */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0)
+#define vfs_write(fp, buf, len, pos) kernel_write(fp, buf, len, pos)
+#define vfs_read(fp, buf, len, pos) kernel_read(fp, buf, len, pos)
+int kernel_read_compat(struct file *file, loff_t offset, char *addr, unsigned long count);
+#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0) */
+#define kernel_read_compat(file, offset, addr, count) kernel_read(file, offset, addr, count)
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0) */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
+static inline void get_monotonic_boottime(struct timespec *ts)
+{
+       *ts = ktime_to_timespec(ktime_get_boottime());
+}
+#endif /* LINUX_VER >= 4.20 */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
+static inline void do_gettimeofday(struct timeval *tv)
+{
+       struct timespec64 now;
+
+       ktime_get_real_ts64(&now);
+       tv->tv_sec = now.tv_sec;
+       tv->tv_usec = now.tv_nsec/1000;
+}
+#endif /* LINUX_VER >= 5.0 */
+
+#endif /* _linuxver_h_ */
diff --git a/bcmdhd.101.10.240.x/include/lpflags.h b/bcmdhd.101.10.240.x/include/lpflags.h
new file mode 100644 (file)
index 0000000..f284bbb
--- /dev/null
@@ -0,0 +1,39 @@
+/*
+ * Chip related low power flags
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+#ifndef _lpflags_h_
+#define _lpflags_h_
+
+/* Chip related low power flags (lpflags) */
+#define LPFLAGS_SI_GLOBAL_DISABLE              (1 << 0)
+#define LPFLAGS_SI_MEM_STDBY_DISABLE           (1 << 1)
+#define LPFLAGS_SI_SFLASH_DISABLE              (1 << 2)
+#define LPFLAGS_SI_BTLDO3P3_DISABLE            (1 << 3)
+#define LPFLAGS_SI_GCI_FORCE_REGCLK_DISABLE    (1 << 4)
+#define LPFLAGS_SI_FORCE_PWM_WHEN_RADIO_ON     (1 << 5)
+#define LPFLAGS_SI_DS0_SLEEP_PDA_DISABLE       (1 << 6)
+#define LPFLAGS_SI_DS1_SLEEP_PDA_DISABLE       (1 << 7)
+#define LPFLAGS_PHY_GLOBAL_DISABLE             (1 << 16)
+#define LPFLAGS_PHY_LP_DISABLE                 (1 << 17)
+#define LPFLAGS_PSM_PHY_CTL                    (1 << 18)
+
+#endif /* _lpflags_h_ */
diff --git a/bcmdhd.101.10.240.x/include/mbo.h b/bcmdhd.101.10.240.x/include/mbo.h
new file mode 100644 (file)
index 0000000..14bd92b
--- /dev/null
@@ -0,0 +1,279 @@
+/*
+ * Fundamental types and constants relating to WFA MBO
+ * (Multiband Operation)
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _MBO_H_
+#define _MBO_H_
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* WiFi MBO OUI values */
+#define MBO_OUI         WFA_OUI      /* WiFi OUI 50:6F:9A */
+/* oui_type field identifying the type and version of the MBO IE. */
+#define MBO_OUI_TYPE    WFA_OUI_TYPE_MBO /* OUI Type/Version */
+/* IEEE 802.11 vendor specific information element. */
+#define MBO_IE_ID          0xdd
+
+/* MBO ATTR related macros */
+#define MBO_ATTR_ID_OFF         0
+#define MBO_ATTR_LEN_OFF        1
+#define MBO_ATTR_DATA_OFF       2
+
+#define MBO_ATTR_ID_LEN          1      /* Attr ID field length */
+#define MBO_ATTR_LEN_LEN         1      /* Attr Length field length */
+#define MBO_ATTR_HDR_LEN         2      /* ID + 1-byte length field */
+
+/* MBO subelemts related */
+#define MBO_SUBELEM_ID          0xdd
+#define MBO_SUBELEM_OUI         WFA_OUI
+
+#define MBO_SUBELEM_ID_LEN          1      /* SubElement ID field length */
+#define MBO_SUBELEM_LEN_LEN         1      /* SubElement length field length */
+#define MBO_SUBELEM_HDR_LEN         6      /* ID + length + OUI + OUY TYPE */
+
+#define MBO_NON_PREF_CHAN_SUBELEM_LEN_LEN(L)  (7 + (L))  /* value of length field */
+#define MBO_NON_PREF_CHAN_SUBELEM_TOT_LEN(L) \
+       (MBO_SUBELEM_ID_LEN + MBO_SUBELEM_LEN_LEN + MBO_NON_PREF_CHAN_SUBELEM_LEN_LEN(L))
+/* MBO attributes as defined in the mbo spec */
+enum {
+       MBO_ATTR_MBO_AP_CAPABILITY = 1,
+       MBO_ATTR_NON_PREF_CHAN_REPORT = 2,
+       MBO_ATTR_CELL_DATA_CAP = 3,
+       MBO_ATTR_ASSOC_DISALLOWED = 4,
+       MBO_ATTR_CELL_DATA_CONN_PREF = 5,
+       MBO_ATTR_TRANS_REASON_CODE = 6,
+       MBO_ATTR_TRANS_REJ_REASON_CODE = 7,
+       MBO_ATTR_ASSOC_RETRY_DELAY = 8
+};
+
+typedef BWL_PRE_PACKED_STRUCT struct wifi_mbo_ie_s {
+       uint8 id;      /* IE ID: MBO_IE_ID 0xDD */
+       uint8 len;     /* IE length */
+       uint8 oui[WFA_OUI_LEN]; /* MBO_OUI 50:6F:9A */
+       uint8 oui_type;   /* MBO_OUI_TYPE 0x16 */
+       uint8 attr[1]; /* var len attributes */
+} BWL_POST_PACKED_STRUCT wifi_mbo_ie_t;
+
+#define MBO_IE_HDR_SIZE (OFFSETOF(wifi_mbo_ie_t, attr))
+/* oui:3 bytes + oui type:1 byte */
+#define MBO_IE_NO_ATTR_LEN  4
+
+/* MBO AP Capability Attribute */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_mbo_ap_cap_ind_attr_s {
+       /* Attribute ID - 0x01. */
+       uint8 id;
+       /* Length of the following fields in the attribute */
+       uint8 len;
+       /* AP capability bitmap */
+       uint8 cap_ind;
+} BWL_POST_PACKED_STRUCT wifi_mbo_ap_cap_ind_attr_t;
+
+/* MBO AP Capability Indication Field Values */
+#define MBO_AP_CAP_IND_CELLULAR_AWARE  0x40
+
+/* Non-preferred Channel Report Attribute */
+#define MBO_NON_PREF_CHAN_ATTR_OPCALSS_OFF       2
+#define MBO_NON_PREF_CHAN_ATTR_CHANLIST_OFF      3
+#define MBO_NON_PREF_CHAN_ATTR_PREF_OFF(L)      \
+       (MBO_NON_PREF_CHAN_ATTR_CHANLIST_OFF + (L))
+
+#define MBO_NON_PREF_CHAN_ATTR_OPCALSS_LEN       1
+#define MBO_NON_PREF_CHAN_ATTR_PREF_LEN          1
+#define MBO_NON_PREF_CHAN_ATTR_REASON_LEN        1
+
+#define MBO_NON_PREF_CHAN_ATTR_LEN(L)  ((L) + 3)
+#define MBO_NON_PREF_CHAN_ATTR_TOT_LEN(L)  (MBO_ATTR_HDR_LEN + (L) + 3)
+
+/* attribute len - (opclass + Pref + Reason) */
+#define MBO_NON_PREF_CHAN_ATTR_CHANLIST_LEN(L) ((L) - 3)
+
+/* MBO Non-preferred Channel Report: "Preference" field value */
+enum {
+       MBO_STA_NON_OPERABLE_BAND_CHAN = 0,
+       MBO_STA_NON_PREFERRED_BAND_CHAN = 1,
+       MBO_STA_PREFERRED_BAND_CHAN = 255
+};
+
+/* MBO Non-preferred Channel Report: "Reason Code" field value */
+enum {
+       MBO_NON_PREF_CHAN_RC_UNSPECIFIED = 0,
+       MBO_NON_PREF_CHAN_RC_BCN_STRENGTH = 1,
+       MBO_NON_PREF_CHAN_RC_CO_LOC_INTERFERENCE = 2,
+       MBO_NON_PREF_CHAN_RC_IN_DEV_INTERFERENCE = 3
+};
+
+/* Cellular Data Capability Attribute */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_mbo_cell_data_cap_attr_s {
+       /* Attribute ID - 0x03. */
+       uint8 id;
+       /* Length of the following fields in the attribute */
+       uint8 len;
+       /* MBO STA's cellular capability */
+       uint8 cell_conn;
+} BWL_POST_PACKED_STRUCT wifi_mbo_cell_data_cap_attr_t;
+
+/* MBO Cellular Data Capability:  "Cellular Connectivity" field value */
+enum {
+       MBO_CELL_DATA_CONN_AVAILABLE = 1,
+       MBO_CELL_DATA_CONN_NOT_AVAILABLE = 2,
+       MBO_CELL_DATA_CONN_NOT_CAPABLE = 3
+};
+
+/* Association Disallowed attribute */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_mbo_assoc_disallowed_attr_s {
+       /* Attribute ID - 0x04. */
+       uint8 id;
+       /* Length of the following fields in the attribute */
+       uint8 len;
+       /* Reason of not accepting new association */
+       uint8 reason_code;
+} BWL_POST_PACKED_STRUCT wifi_mbo_assoc_disallowed_attr_t;
+
+/* Association Disallowed attr Reason code field values */
+enum {
+       MBO_ASSOC_DISALLOWED_RC_UNSPECIFIED = 1,
+       MBO_ASSOC_DISALLOWED_RC_MAX_STA_REACHED = 2,
+       MBO_ASSOC_DISALLOWED_RC_AIR_IFACE_OVERLOADED = 3,
+       MBO_ASSOC_DISALLOWED_RC_AUTH_SRVR_OVERLOADED = 4,
+       MBO_ASSOC_DISALLOWED_RC_INSUFFIC_RSSI = 5
+};
+
+/* Cellular Data Conn Pref attribute */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_mbo_cell_data_conn_pref_attr_s {
+       /* Attribute ID - 0x05. */
+       uint8 id;
+       /* Length of the following fields in the attribute */
+       uint8 len;
+       /* Preference value of cellular connection */
+       uint8 cell_pref;
+} BWL_POST_PACKED_STRUCT wifi_mbo_cell_data_conn_pref_attr_t;
+
+/* Cellular Data Conn Pref attr: Cellular Pref field values */
+enum {
+       MBO_CELLULAR_DATA_CONN_EXCLUDED = 1,
+       MBO_CELLULAR_DATA_CONN_NOT_PREFERRED = 2,
+       MBO_CELLULAR_DATA_CONN_PREFERRED = 255
+};
+
+/* Transition Reason Code Attribute */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_mbo_trans_reason_code_attr_s {
+       /* Attribute ID - 0x06. */
+       uint8 id;
+       /* Length of the following fields in the attribute */
+       uint8 len;
+       /* Reason of transition recommendation */
+       uint8 trans_reason_code;
+} BWL_POST_PACKED_STRUCT wifi_mbo_trans_reason_code_attr_t;
+
+/* Transition Reason Code Attr: trans reason code field values */
+enum {
+       MBO_TRANS_REASON_UNSPECIFIED = 0,
+       MBO_TRANS_REASON_EXCESSV_FRM_LOSS_RATE = 1,
+       MBO_TRANS_REASON_EXCESSV_TRAFFIC_DELAY = 2,
+       MBO_TRANS_REASON_INSUFF_BW = 3,
+       MBO_TRANS_REASON_LOAD_BALANCING = 4,
+       MBO_TRANS_REASON_LOW_RSSI = 5,
+       MBO_TRANS_REASON_EXCESSV_RETRANS_RCVD = 6,
+       MBO_TRANS_REASON_HIGH_INTERFERENCE = 7,
+       MBO_TRANS_REASON_GRAY_ZONE = 8,
+       MBO_TRANS_REASON_PREMIUM_AP_TRANS = 9
+};
+
+/* Transition Rejection Reason Code Attribute */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_mbo_trans_rej_reason_code_attr_s {
+       /* Attribute ID - 0x07. */
+       uint8 id;
+       /* Length of the following fields in the attribute */
+       uint8 len;
+       /* Reason of transition rejection */
+       uint8 trans_rej_reason_code;
+} BWL_POST_PACKED_STRUCT wifi_mbo_trans_rej_reason_code_attr_t;
+
+/* Transition Rej Reason Code Attr: trans rej reason code field values */
+enum {
+       MBO_TRANS_REJ_REASON_UNSPECIFIED = 0,
+       MBO_TRANS_REJ_REASON_EXSSIV_FRM_LOSS_RATE = 1,
+       MBO_TRANS_REJ_REASON_EXSSIV_TRAFFIC_DELAY = 2,
+       MBO_TRANS_REJ_REASON_INSUFF_QOS_CAPACITY = 3,
+       MBO_TRANS_REJ_REASON_LOW_RSSI = 4,
+       MBO_TRANS_REJ_REASON_HIGH_INTERFERENCE = 5,
+       MBO_TRANS_REJ_REASON_SERVICE_UNAVAIL = 6
+};
+
+/* Assoc Retry Delay Attribute */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_mbo_assoc_retry_delay_attr_s {
+       /* Attribute ID - 0x08. */
+       uint8 id;
+       /* Length of the following fields in the attribute */
+       uint8 len;
+       /* No of Seconds before next assoc attempt */
+       uint16 reassoc_delay;
+} BWL_POST_PACKED_STRUCT wifi_mbo_assoc_retry_delay_attr_t;
+
+#define MBO_ANQP_OUI_TYPE    0x12     /* OUTI Type/Version */
+
+/* MBO ANQP Element */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_mbo_anqp_elem_s {
+       /* ID - 56797 */
+       uint16 info_id;
+       /* Length of the OUI + Vendor Specific content */
+       uint16 len;
+       /* WFA_OUI 50:6F:9A */
+       uint8 oui[WFA_OUI_LEN];
+       /* MBO_ANQP_OUI_TYPE 0x12 */
+       uint8 oui_type;
+       /* MBO ANQP element type */
+       uint8 sub_type;
+       /* variable len payload */
+       uint8 payload[1];
+} BWL_POST_PACKED_STRUCT wifi_mbo_anqp_elem_t;
+
+#define MBO_ANQP_ELEM_HDR_SIZE (OFFSETOF(wifi_mbo_anqp_elem_t, payload))
+
+/* oui:3 bytes + oui type:1 byte + sub type:1 byte */
+#define MBO_ANQP_ELEM_NO_PAYLOAD_LEN  5
+
+/* MBO ANQP Subtype Values */
+enum {
+       MBO_ANQP_ELEM_MBO_QUERY_LIST = 1,
+       MBO_ANQP_ELEM_CELL_DATA_CONN_PREF = 2
+};
+
+/* MBO sub-elements */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_mbo_cell_cap_subelem_s {
+       /* 0xDD */
+       uint8 sub_elem_id;
+       /* Length of the following fields in sub-element */
+       uint8 len;
+       /* WFA_OUI 50:6F:9A */
+       uint8 oui[WFA_OUI_LEN];
+       /* OUI_TYPE 0x03 */
+       uint8 oui_type;
+       /* STA cellular capability */
+       uint8 cell_conn;
+} BWL_POST_PACKED_STRUCT wifi_mbo_cell_cap_subelem_t;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* __MBO_H__ */
diff --git a/bcmdhd.101.10.240.x/include/msgtrace.h b/bcmdhd.101.10.240.x/include/msgtrace.h
new file mode 100644 (file)
index 0000000..f564999
--- /dev/null
@@ -0,0 +1,56 @@
+/*
+ * Trace messages sent over HBUS
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _MSGTRACE_H
+#define        _MSGTRACE_H
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#define MSGTRACE_VERSION 1
+
+/* Message trace header */
+typedef BWL_PRE_PACKED_STRUCT struct msgtrace_hdr {
+       uint8   version;
+       uint8   trace_type;
+#define MSGTRACE_HDR_TYPE_MSG 0
+#define MSGTRACE_HDR_TYPE_LOG 1
+       uint16  len;    /* Len of the trace */
+       uint32  seqnum; /* Sequence number of message. Useful if the messsage has been lost
+                        * because of DMA error or a bus reset (ex: SDIO Func2)
+                        */
+       /* Msgtrace type  only */
+       uint32  discarded_bytes;  /* Number of discarded bytes because of trace overflow  */
+       uint32  discarded_printf; /* Number of discarded printf because of trace overflow */
+} BWL_POST_PACKED_STRUCT msgtrace_hdr_t;
+
+#define MSGTRACE_HDRLEN        sizeof(msgtrace_hdr_t)
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _MSGTRACE_H */
diff --git a/bcmdhd.101.10.240.x/include/nan.h b/bcmdhd.101.10.240.x/include/nan.h
new file mode 100644 (file)
index 0000000..ca073cf
--- /dev/null
@@ -0,0 +1,1556 @@
+/*
+ * Fundamental types and constants relating to WFA NAN
+ * (Neighbor Awareness Networking)
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+#ifndef _NAN_H_
+#define _NAN_H_
+
+#include <typedefs.h>
+#include <802.11.h>
+
+/* Do we want to include p2p.h for constants like P2P_WFDS_HASH_LEN and
+ * maybe P2P_WFDS_MAX_SVC_NAME_LEN etc.?
+ */
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* WiFi NAN OUI values */
+#define NAN_OUI                        "\x50\x6F\x9A"     /* WFA OUI. WiFi-Alliance OUI */
+/* For oui_type field identifying the type and version of the NAN IE. */
+#define NAN_OUI_TYPE           0x13        /* Type/Version */
+#define NAN_AF_OUI_TYPE                0x18        /* Type/Version */
+/* IEEE 802.11 vendor specific information element. (Same as P2P_IE_ID.) */
+#define NAN_IE_ID              0xdd
+
+/* Same as P2P_PUB_AF_CATEGORY and DOT11_ACTION_CAT_PUBLIC */
+#define NAN_PUB_AF_CATEGORY    DOT11_ACTION_CAT_PUBLIC
+/* Protected dual public action frame category */
+#define NAN_PROT_DUAL_PUB_AF_CATEGORY  DOT11_ACTION_CAT_PDPA
+/* IEEE 802.11 Public Action Frame Vendor Specific. (Same as P2P_PUB_AF_ACTION.) */
+#define NAN_PUB_AF_ACTION      DOT11_PUB_ACTION_VENDOR_SPEC
+/* Number of octents in hash of service name. (Same as P2P_WFDS_HASH_LEN.) */
+#define NAN_SVC_HASH_LEN       6
+/* Size of fixed length part of nan_pub_act_frame_t before attributes. */
+#define NAN_PUB_ACT_FRAME_FIXED_LEN 6
+/* Number of octents in master rank value. */
+#define NAN_MASTER_RANK_LEN     8
+/* NAN public action frame header size */
+#define NAN_PUB_ACT_FRAME_HDR_SIZE (OFFSETOF(nan_pub_act_frame_t, data))
+/* NAN network ID */
+#define NAN_NETWORK_ID         "\x51\x6F\x9A\x01\x00\x00"
+/* Service Control Type length */
+#define NAN_SVC_CONTROL_TYPE_LEN       2
+/* Binding Bitmap length */
+#define NAN_BINDING_BITMAP_LEN         2
+/* Service Response Filter (SRF) control field masks */
+#define NAN_SRF_BLOOM_MASK             0x01
+#define NAN_SRF_INCLUDE_MASK           0x02
+#define NAN_SRF_INDEX_MASK             0x0C
+/* SRF Bloom Filter index shift */
+#define NAN_SRF_BLOOM_SHIFT    2
+#define NAN_SRF_INCLUDE_SHIFT  1
+/* Mask for CRC32 output, used in hash function for NAN bloom filter */
+#define NAN_BLOOM_CRC32_MASK   0xFFFF
+
+/* Attribute TLV header size */
+#define NAN_ATTR_ID_OFF                0
+#define NAN_ATTR_LEN_OFF       1
+#define NAN_ATTR_DATA_OFF      3
+
+#define NAN_ATTR_ID_LEN                 1u     /* ID field length */
+#define NAN_ATTR_LEN_LEN        2u     /* Length field length */
+#define NAN_ATTR_HDR_LEN        (NAN_ATTR_ID_LEN + NAN_ATTR_LEN_LEN)
+#define NAN_ENTRY_CTRL_LEN       1      /* Entry control field length from FAM attribute */
+#define NAN_MAP_ID_LEN           1     /* MAP ID length to signify band */
+#define NAN_OPERATING_CLASS_LEN  1     /* operating class field length from NAN FAM */
+#define NAN_CHANNEL_NUM_LEN      1     /* channel number field length 1 byte */
+
+/* generic nan attribute total length */
+#define NAN_ATTR_TOT_LEN(_nan_attr)    (ltoh16_ua(((const uint8 *)(_nan_attr)) + \
+       NAN_ATTR_ID_LEN) + NAN_ATTR_HDR_LEN)
+
+/* NAN slot duration / period */
+#define NAN_MIN_TU             16
+#define NAN_TU_PER_DW          512
+#define NAN_MAX_DW             16
+#define NAN_MAX_TU             (NAN_MAX_DW * NAN_TU_PER_DW)
+
+#define NAN_SLOT_DUR_0TU       0
+#define NAN_SLOT_DUR_16TU      16
+#define NAN_SLOT_DUR_32TU      32
+#define NAN_SLOT_DUR_64TU      64
+#define NAN_SLOT_DUR_128TU     128
+#define NAN_SLOT_DUR_256TU     256
+#define NAN_SLOT_DUR_512TU     512
+#define NAN_SLOT_DUR_1024TU    1024
+#define NAN_SLOT_DUR_2048TU    2048
+#define NAN_SLOT_DUR_4096TU    4096
+#define NAN_SLOT_DUR_8192TU    8192
+
+#define NAN_SOC_CHAN_2G                6       /* NAN 2.4G discovery channel */
+#define NAN_SOC_CHAN_5G_CH149  149     /* NAN 5G discovery channel if upper band allowed */
+#define NAN_SOC_CHAN_5G_CH44   44      /* NAN 5G discovery channel if only lower band allowed */
+
+/* size of ndc id */
+#define NAN_DATA_NDC_ID_SIZE 6
+
+#define NAN_AVAIL_ENTRY_LEN_RES0 7      /* Avail entry len in FAM attribute for resolution 16TU */
+#define NAN_AVAIL_ENTRY_LEN_RES1 5      /* Avail entry len in FAM attribute for resolution 32TU */
+#define NAN_AVAIL_ENTRY_LEN_RES2 4      /* Avail entry len in FAM attribute for resolution 64TU */
+
+/* map id field */
+#define NAN_MAPID_SPECIFIC_MAP_MASK    0x01 /* apply to specific map */
+#define NAN_MAPID_MAPID_MASK           0x1E
+#define NAN_MAPID_MAPID_SHIFT          1
+#define NAN_MAPID_SPECIFIC_MAP(_mapid) ((_mapid) & NAN_MAPID_SPECIFIC_MAP_MASK)
+#define NAN_MAPID_ALL_MAPS(_mapid)     (!NAN_MAPID_SPECIFIC_MAP(_mapid))
+#define NAN_MAPID_MAPID(_mapid)                (((_mapid) & NAN_MAPID_MAPID_MASK) \
+               >> NAN_MAPID_MAPID_SHIFT)
+#define NAN_MAPID_SET_SPECIFIC_MAPID(map_id)   ((((map_id) << NAN_MAPID_MAPID_SHIFT) \
+               & NAN_MAPID_MAPID_MASK) | NAN_MAPID_SPECIFIC_MAP_MASK)
+
+/* Vendor-specific public action frame for NAN */
+typedef BWL_PRE_PACKED_STRUCT struct nan_pub_act_frame_s {
+       /* NAN_PUB_AF_CATEGORY 0x04 */
+       uint8 category_id;
+       /* NAN_PUB_AF_ACTION 0x09 */
+       uint8 action_field;
+       /* NAN_OUI 0x50-6F-9A */
+       uint8 oui[DOT11_OUI_LEN];
+       /* NAN_OUI_TYPE 0x13 */
+       uint8 oui_type;
+       /* One or more NAN Attributes follow */
+       uint8 data[];
+} BWL_POST_PACKED_STRUCT nan_pub_act_frame_t;
+
+/* NAN attributes as defined in the nan spec */
+enum {
+       NAN_ATTR_MASTER_IND     = 0,
+       NAN_ATTR_CLUSTER        = 1,
+       NAN_ATTR_SVC_ID_LIST    = 2,
+       NAN_ATTR_SVC_DESCRIPTOR = 3,
+       NAN_ATTR_CONN_CAP       = 4,
+       NAN_ATTR_INFRA          = 5,
+       NAN_ATTR_P2P            = 6,
+       NAN_ATTR_IBSS           = 7,
+       NAN_ATTR_MESH           = 8,
+       NAN_ATTR_FURTHER_NAN_SD = 9,
+       NAN_ATTR_FURTHER_AVAIL  = 10,
+       NAN_ATTR_COUNTRY_CODE   = 11,
+       NAN_ATTR_RANGING        = 12,
+       NAN_ATTR_CLUSTER_DISC   = 13,
+       /* nan 2.0 */
+       NAN_ATTR_SVC_DESC_EXTENSION = 14,
+       NAN_ATTR_NAN_DEV_CAP = 15,
+       NAN_ATTR_NAN_NDP = 16,
+       NAN_ATTR_NAN_NMSG = 17,
+       NAN_ATTR_NAN_AVAIL = 18,
+       NAN_ATTR_NAN_NDC = 19,
+       NAN_ATTR_NAN_NDL = 20,
+       NAN_ATTR_NAN_NDL_QOS = 21,
+       NAN_ATTR_MCAST_SCHED = 22,
+       NAN_ATTR_UNALIGN_SCHED = 23,
+       NAN_ATTR_PAGING_UCAST = 24,
+       NAN_ATTR_PAGING_MCAST = 25,
+       NAN_ATTR_RANGING_INFO = 26,
+       NAN_ATTR_RANGING_SETUP = 27,
+       NAN_ATTR_FTM_RANGE_REPORT = 28,
+       NAN_ATTR_ELEMENT_CONTAINER = 29,
+       NAN_ATTR_WLAN_INFRA_EXT = 30,
+       NAN_ATTR_EXT_P2P_OPER = 31,
+       NAN_ATTR_EXT_IBSS = 32,
+       NAN_ATTR_EXT_MESH = 33,
+       NAN_ATTR_CIPHER_SUITE_INFO = 34,
+       NAN_ATTR_SEC_CTX_ID_INFO = 35,
+       NAN_ATTR_SHARED_KEY_DESC = 36,
+       NAN_ATTR_MCAST_SCHED_CHANGE = 37,
+       NAN_ATTR_MCAST_SCHED_OWNER_CHANGE = 38,
+       NAN_ATTR_PUBLIC_AVAILABILITY = 39,
+       NAN_ATTR_SUB_SVC_ID_LIST = 40,
+       NAN_ATTR_NDPE = 41,
+       /* change NAN_ATTR_MAX_ID to max ids + 1, excluding NAN_ATTR_VENDOR_SPECIFIC.
+        * This is used in nan_parse.c
+        */
+       NAN_ATTR_MAX_ID         = NAN_ATTR_NDPE + 1,
+
+       NAN_ATTR_VENDOR_SPECIFIC = 221
+};
+
+enum wifi_nan_avail_resolution {
+       NAN_AVAIL_RES_16_TU = 0,
+       NAN_AVAIL_RES_32_TU = 1,
+       NAN_AVAIL_RES_64_TU = 2,
+       NAN_AVAIL_RES_INVALID = 255
+};
+
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ie_s {
+       uint8   id;             /* IE ID: NAN_IE_ID 0xDD */
+       uint8   len;            /* IE length */
+       uint8   oui[DOT11_OUI_LEN]; /* NAN_OUI 50:6F:9A */
+       uint8   oui_type;       /* NAN_OUI_TYPE 0x13 */
+       uint8   attr[]; /* var len attributes */
+} BWL_POST_PACKED_STRUCT wifi_nan_ie_t;
+
+#define NAN_IE_HDR_SIZE        (OFFSETOF(wifi_nan_ie_t, attr))
+
+/* master indication record  */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_master_ind_attr_s {
+       uint8   id;
+       uint16  len;
+       uint8   master_preference;
+       uint8   random_factor;
+} BWL_POST_PACKED_STRUCT wifi_nan_master_ind_attr_t;
+
+/* cluster attr record  */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_cluster_attr_s {
+       uint8   id;
+       uint16  len;
+       uint8   amr[NAN_MASTER_RANK_LEN];
+       uint8   hop_count;
+       /* Anchor Master Beacon Transmission Time */
+       uint32  ambtt;
+} BWL_POST_PACKED_STRUCT wifi_nan_cluster_attr_t;
+
+/*  container for service ID records  */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_svc_id_attr_s {
+       uint8   id;
+       uint16  len;
+       uint8   svcid[0]; /* 6*len of srvc IDs */
+} BWL_POST_PACKED_STRUCT wifi_nan_svc_id_attr_t;
+
+/* service_control bitmap for wifi_nan_svc_descriptor_attr_t below */
+#define NAN_SC_PUBLISH 0x0
+#define NAN_SC_SUBSCRIBE 0x1
+#define NAN_SC_FOLLOWUP 0x2
+/* Set to 1 if a Matching Filter field is included in descriptors. */
+#define NAN_SC_MATCHING_FILTER_PRESENT 0x4
+/* Set to 1 if a Service Response Filter field is included in descriptors. */
+#define NAN_SC_SR_FILTER_PRESENT 0x8
+/* Set to 1 if a Service Info field is included in descriptors. */
+#define NAN_SC_SVC_INFO_PRESENT 0x10
+/* range is close proximity only */
+#define NAN_SC_RANGE_LIMITED 0x20
+/* Set to 1 if binding bitamp is present in descriptors */
+#define NAN_SC_BINDING_BITMAP_PRESENT 0x40
+
+/* Service descriptor */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_svc_descriptor_attr_s {
+       /* Attribute ID - 0x03. */
+       uint8 id;
+       /* Length of the following fields in the attribute */
+       uint16 len;
+       /* Hash of the Service Name */
+       uint8 svc_hash[NAN_SVC_HASH_LEN];
+       /* Publish or subscribe instance id */
+       uint8 instance_id;
+       /* Requestor Instance ID */
+       uint8 requestor_id;
+       /* Service Control Bitmask. Also determines what data follows. */
+       uint8 svc_control;
+       /* Optional fields follow */
+} BWL_POST_PACKED_STRUCT wifi_nan_svc_descriptor_attr_t;
+
+/* IBSS attribute */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ibss_attr_s {
+       /* Attribute ID - 0x07. */
+       uint8 id;
+       /* Length of the following fields in the attribute */
+       uint16 len;
+       /* BSSID of the ibss */
+       struct ether_addr bssid;
+       /*
+        map control:, bits:
+       [0-3]: Id for associated further avail map attribute
+       [4-5]: avail interval duration: 0:16ms; 1:32ms; 2:64ms; 3:reserved
+       [6] : repeat : 0 - applies to next DW, 1: 16 intervals max? wtf?
+       [7] : reserved
+       */
+       uint8 map_ctrl;
+       /* avail. intervals bitmap, var len  */
+       uint8 avail_bmp[1];
+} BWL_POST_PACKED_STRUCT wifi_nan_ibss_attr_t;
+
+/* Country code attribute  */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_country_code_attr_s {
+       /* Attribute ID - 0x0B. */
+       uint8 id;
+       /* Length of the following fields in the attribute */
+       uint16 len;
+       /* Condensed Country String first two octets */
+       uint8 country_str[2];
+} BWL_POST_PACKED_STRUCT wifi_nan_country_code_attr_t;
+
+/* Further Availability MAP attr  */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_favail_attr_s {
+       /* Attribute ID - 0x0A. */
+       uint8 id;
+       /* Length of the following fields in the attribute */
+       uint16 len;
+       /* MAP id: val [0..15], values[16-255] reserved */
+       uint8 map_id;
+       /*  availibility entry, var len */
+       uint8 avil_entry[1];
+} BWL_POST_PACKED_STRUCT wifi_nan_favail_attr_t;
+
+/* Further Availability MAP attr  */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_avail_entry_s {
+       /*
+        entry control
+        [0-1]: avail interval duration: 0:16ms; 1:32ms; 2:64ms;
+        [2:7] reserved
+       */
+       uint8 entry_ctrl;
+       /* operating class: freq band etc IEEE 802.11 */
+       uint8 opclass;
+       /* channel number */
+       uint8 chan;
+       /*  avail bmp, var len */
+       uint8 avail_bmp[1];
+} BWL_POST_PACKED_STRUCT wifi_nan_avail_entry_t;
+
+/* Map control Field */
+#define NAN_MAPCTRL_IDMASK     0x7
+#define NAN_MAPCTRL_DURSHIFT   4
+#define NAN_MAPCTRL_DURMASK    0x30
+#define NAN_MAPCTRL_REPEAT     0x40
+#define NAN_MAPCTRL_REPEATSHIFT        6
+
+#define NAN_VENDOR_TYPE_RTT    0
+#define NAN_VENDOR_TYPE_P2P    1
+
+/* Vendor Specific Attribute - old definition */
+/* TODO remove */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_vendor_attr_s {
+       uint8   id;                     /* 0xDD */
+       uint16  len;            /* IE length */
+       uint8   oui[DOT11_OUI_LEN]; /* 00-90-4C */
+       uint8   type;           /* attribute type */
+       uint8   attr[1];        /* var len attributes */
+} BWL_POST_PACKED_STRUCT wifi_nan_vendor_attr_t;
+
+#define NAN_VENDOR_HDR_SIZE    (OFFSETOF(wifi_nan_vendor_attr_t, attr))
+
+/* vendor specific attribute */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_vndr_attr_s {
+       uint8   id;                     /* 0xDD */
+       uint16  len;                    /* length of following fields */
+       uint8   oui[DOT11_OUI_LEN];     /* vendor specific OUI */
+       uint8   body[];
+} BWL_POST_PACKED_STRUCT wifi_nan_vndr_attr_t;
+
+/* p2p operation attribute */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_p2p_op_attr_s {
+       /* Attribute ID - 0x06. */
+       uint8 id;
+       /* Length of the following fields in the attribute */
+       uint16 len;
+       /* P2P device role */
+       uint8 dev_role;
+       /* BSSID of the ibss */
+       struct ether_addr p2p_dev_addr;
+       /*
+       map control:, bits:
+       [0-3]: Id for associated further avail map attribute
+       [4-5]: avail interval duration: 0:16ms; 1:32ms; 2:64ms; 3:reserved
+       [6] : repeat : 0 - applies to next DW, 1: 16 intervals max? wtf?
+       [7] : reserved
+       */
+       uint8 map_ctrl;
+       /* avail. intervals bitmap */
+       uint8 avail_bmp[1];
+} BWL_POST_PACKED_STRUCT wifi_nan_p2p_op_attr_t;
+
+/* ranging attribute */
+#define NAN_RANGING_MAP_CTRL_ID_SHIFT 0
+#define NAN_RANGING_MAP_CTRL_ID_MASK 0x0F
+#define NAN_RANGING_MAP_CTRL_DUR_SHIFT 4
+#define NAN_RANGING_MAP_CTRL_DUR_MASK 0x30
+#define NAN_RANGING_MAP_CTRL_REPEAT_SHIFT 6
+#define NAN_RANGING_MAP_CTRL_REPEAT_MASK 0x40
+#define NAN_RANGING_MAP_CTRL_REPEAT_DW(_ctrl) (((_ctrl) & \
+       NAN_RANGING_MAP_CTRL_DUR_MASK) ? 16 : 1)
+#define NAN_RANGING_MAP_CTRL(_id, _dur, _repeat) (\
+       (((_id) << NAN_RANGING_MAP_CTRL_ID_SHIFT) & \
+                NAN_RANGING_MAP_CTRL_ID_MASK) | \
+       (((_dur) << NAN_RANGING_MAP_CTRL_DUR_SHIFT) & \
+               NAN_RANGING_MAP_CTRL_DUR_MASK) | \
+       (((_repeat) << NAN_RANGING_MAP_CTRL_REPEAT_SHIFT) & \
+                NAN_RANGING_MAP_CTRL_REPEAT_MASK))
+
+enum {
+       NAN_RANGING_PROTO_FTM = 0
+};
+
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ranging_attr_s {
+       uint8 id;                       /* 0x0C */
+       uint16 len;                     /* length that follows */
+       struct ether_addr dev_addr;     /* device mac address */
+
+       /*
+       map control:, bits:
+       [0-3]: Id for associated further avail map attribute
+       [4-5]: avail interval duration: 0:16ms; 1:32ms; 2:64ms; 3:reserved
+       [6] : repeat : 0 - applies to next DW, 1: 16 intervals max? wtf?
+       [7] : reserved
+       */
+       uint8 map_ctrl;
+
+       uint8 protocol;                                 /* FTM = 0 */
+       uint32 avail_bmp;                               /* avail interval bitmap */
+} BWL_POST_PACKED_STRUCT wifi_nan_ranging_attr_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ranging_info_attr_s {
+       uint8 id;                       /* 0x1A */
+       uint16 len;                     /* length that follows */
+       /*
+       location info availability bit map
+       0: LCI Local Coordinates
+       1: Geospatial LCI WGS84
+       2: Civi Location
+       3: Last Movement Indication
+       [4-7]: reserved
+       */
+       uint8 lc_info_avail;
+       /*
+       Last movement indication
+       present if bit 3 is set in lc_info_avail
+       cluster TSF[29:14] at the last detected platform movement
+       */
+       uint16 last_movement;
+
+} BWL_POST_PACKED_STRUCT wifi_nan_ranging_info_attr_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ranging_setup_attr_hdr_s {
+       uint8 id;                       /* 0x1B */
+       uint16 len;                     /* length that follows */
+       uint8 dialog_token;     /* Identify req and resp */
+       uint8 type_status;      /* bits 0-3 type, 4-7 status */
+       /* reason code
+       i. when frm type = response & status = reject
+       ii. frm type = termination
+       */
+       uint8 reason;
+} BWL_POST_PACKED_STRUCT wifi_nan_ranging_setup_attr_hdr_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ranging_setup_attr_s {
+
+       wifi_nan_ranging_setup_attr_hdr_t setup_attr_hdr;
+       /* Below fields not required when frm type = termination */
+       uint8 ranging_ctrl; /* Bit 0: ranging report required or not */
+       uint8 ftm_params[3];
+       uint8 data[];   /* schedule entry list */
+} BWL_POST_PACKED_STRUCT wifi_nan_ranging_setup_attr_t;
+
+#define NAN_RANGE_SETUP_ATTR_OFFSET_TBM_INFO (OFFSETOF(wifi_nan_ranging_setup_attr_t, data))
+
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ranging_report_attr_s {
+       uint8 id;                       /* 0x1C */
+       uint16 len;                     /* length that follows */
+       /* FTM report format in spec.
+       See definition in 9.4.2.22.18 in 802.11mc D5.0
+       */
+       uint8 entry_count;
+       uint8 data[]; /* Variable size range entry */
+       /*
+       dot11_ftm_range_entry_t entries[entry_count];
+       uint8 error_count;
+       dot11_ftm_error_entry_t errors[error_count];
+        */
+} BWL_POST_PACKED_STRUCT wifi_nan_ranging_report_attr_t;
+
+/* Ranging control flags */
+#define NAN_RNG_REPORT_REQUIRED                0x01
+#define NAN_RNG_FTM_PARAMS_PRESENT     0x02
+#define NAN_RNG_SCHED_ENTRY_PRESENT    0X04
+
+/* Location info flags */
+#define NAN_RNG_LOCATION_FLAGS_LOCAL_CORD              0x1
+#define NAN_RNG_LOCATION_FLAGS_GEO_SPATIAL             0x2
+#define NAN_RNG_LOCATION_FLAGS_CIVIC                   0x4
+#define NAN_RNG_LOCATION_FLAGS_LAST_MVMT               0x8
+
+/* Last movement mask and shift value */
+#define NAN_RNG_LOCATION_MASK_LAST_MVT_TSF     0x3FFFC000
+#define NAN_RNG_LOCATION_SHIFT_LAST_MVT_TSF    14
+
+/* FTM params shift values  */
+#define NAN_FTM_MAX_BURST_DUR_SHIFT    0
+#define NAN_FTM_MIN_FTM_DELTA_SHIFT    4
+#define NAN_FTM_NUM_FTM_SHIFT          10
+#define NAN_FTM_FORMAT_BW_SHIFT                15
+
+/* FTM params mask  */
+#define NAN_FTM_MAX_BURST_DUR_MASK     0x00000F
+#define NAN_FTM_MIN_FTM_DELTA_MASK     0x00003F
+#define NAN_FTM_NUM_FTM_MASK           0x00001F
+#define NAN_FTM_FORMAT_BW_MASK         0x00003F
+
+#define FTM_PARAMS_BURSTTMO_FACTOR 250
+
+/* set to value to uint32 */
+#define NAN_FTM_SET_BURST_DUR(ftm, dur) (ftm |= (((dur + 2) & NAN_FTM_MAX_BURST_DUR_MASK) <<\
+       NAN_FTM_MAX_BURST_DUR_SHIFT))
+#define NAN_FTM_SET_FTM_DELTA(ftm, delta) (ftm |= (((delta/100) & NAN_FTM_MIN_FTM_DELTA_MASK) <<\
+       NAN_FTM_MIN_FTM_DELTA_SHIFT))
+#define NAN_FTM_SET_NUM_FTM(ftm, delta) (ftm |= ((delta & NAN_FTM_NUM_FTM_MASK) <<\
+       NAN_FTM_NUM_FTM_SHIFT))
+#define NAN_FTM_SET_FORMAT_BW(ftm, delta) (ftm |= ((delta & NAN_FTM_FORMAT_BW_MASK) <<\
+       NAN_FTM_FORMAT_BW_SHIFT))
+/* set uint32 to attribute */
+#define NAN_FTM_PARAMS_UINT32_TO_ATTR(ftm_u32, ftm_attr) {ftm_attr[0] = ftm_u32 & 0xFF; \
+                       ftm_attr[1] = (ftm_u32 >> 8) & 0xFF; ftm_attr[2] = (ftm_u32 >> 16) & 0xFF;}
+
+/* get atrribute to uint32 */
+#define NAN_FTM_PARAMS_ATTR_TO_UINT32(ftm_p, ftm_u32) (ftm_u32 = ftm_p[0] | ftm_p[1] << 8 | \
+       ftm_p[2] << 16)
+/* get param values from uint32 */
+#define NAN_FTM_GET_BURST_DUR(ftm) (((ftm >> NAN_FTM_MAX_BURST_DUR_SHIFT) &\
+       NAN_FTM_MAX_BURST_DUR_MASK))
+#define NAN_FTM_GET_BURST_DUR_USEC(_val) ((1 << ((_val)-2)) * FTM_PARAMS_BURSTTMO_FACTOR)
+#define NAN_FTM_GET_FTM_DELTA(ftm) (((ftm >> NAN_FTM_MIN_FTM_DELTA_SHIFT) &\
+       NAN_FTM_MIN_FTM_DELTA_MASK)*100)
+#define NAN_FTM_GET_NUM_FTM(ftm) ((ftm >> NAN_FTM_NUM_FTM_SHIFT) &\
+       NAN_FTM_NUM_FTM_MASK)
+#define NAN_FTM_GET_FORMAT_BW(ftm) ((ftm >> NAN_FTM_FORMAT_BW_SHIFT) &\
+       NAN_FTM_FORMAT_BW_MASK)
+
+#define NAN_CONN_CAPABILITY_WFD                0x0001
+#define NAN_CONN_CAPABILITY_WFDS       0x0002
+#define NAN_CONN_CAPABILITY_TDLS       0x0004
+#define NAN_CONN_CAPABILITY_INFRA      0x0008
+#define NAN_CONN_CAPABILITY_IBSS       0x0010
+#define NAN_CONN_CAPABILITY_MESH       0x0020
+
+#define NAN_DEFAULT_MAP_ID             0       /* nan default map id */
+#define NAN_DEFAULT_MAP_CTRL           0       /* nan default map control */
+
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_conn_cap_attr_s {
+       /* Attribute ID - 0x04. */
+       uint8 id;
+       /* Length of the following fields in the attribute */
+       uint16  len;
+       uint16  conn_cap_bmp;   /* Connection capability bitmap */
+} BWL_POST_PACKED_STRUCT wifi_nan_conn_cap_attr_t;
+
+/* NAN Element container Attribute */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_container_attr_s {
+       uint8 id;       /* id - 0x20 */
+       uint16 len;     /* Total length of following IEs */
+       uint8 map_id;   /* map id */
+       uint8 data[1];  /* Data pointing to one or more IEs */
+} BWL_POST_PACKED_STRUCT wifi_nan_container_attr_t;
+
+/* NAN 2.0 NAN avail attribute */
+
+/* Availability Attribute */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_avail_attr_s {
+       uint8 id;       /* id - 0x12 */
+       uint16 len;     /* total length */
+       uint8 seqid;    /* sequence id */
+       uint16 ctrl;    /* attribute control */
+       uint8 entry[1]; /* availability entry list */
+} BWL_POST_PACKED_STRUCT wifi_nan_avail_attr_t;
+
+/* for processing/building time bitmap info in nan_avail_entry */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_time_bitmap_s {
+       uint16 ctrl;            /* Time bitmap control */
+       uint8 len;              /* Time bitmap length */
+       uint8 bitmap[]; /* Time bitmap */
+} BWL_POST_PACKED_STRUCT wifi_nan_time_bitmap_t;
+
+/* Availability Entry format */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_avail_entry_attr_s {
+       uint16 len;             /* Length */
+       uint16 entry_cntrl;     /* Entry Control */
+       uint8 var[];            /* Time bitmap and channel entry list */
+} BWL_POST_PACKED_STRUCT wifi_nan_avail_entry_attr_t;
+
+/* FAC Channel Entry  (section 10.7.19.1.5) */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_chan_entry_s {
+       uint8 oper_class;               /* Operating Class */
+       uint16 chan_bitmap;             /* Channel Bitmap */
+       uint8 primary_chan_bmp;         /* Primary Channel Bitmap */
+       uint8 aux_chan[0];                      /* Auxiliary Channel bitmap */
+} BWL_POST_PACKED_STRUCT wifi_nan_chan_entry_t;
+
+/* Channel entry */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_channel_entry_s {
+       uint8 opclass;          /* Operating class */
+       uint16 chan_bitmap;     /* Channel bitmap */
+       uint8 prim_bitmap;      /* Primary channel bitmap */
+       uint16 aux_bitmap;      /* Time bitmap length */
+} BWL_POST_PACKED_STRUCT wifi_nan_channel_entry_t;
+
+/* Type of  Availability: committed */
+#define NAN_ENTRY_CNTRL_TYPE_COMM_AVAIL_MASK   0x1
+/* Type of  Availability: potential */
+#define NAN_ENTRY_CNTRL_TYPE_POTEN_AVAIL_MASK  0x2
+/* Type of  Availability: conditional */
+#define NAN_ENTRY_CNTRL_TYPE_COND_AVAIL_MASK   0x4
+
+#define NAN_AVAIL_CTRL_MAP_ID_MASK             0x000F
+#define NAN_AVAIL_CTRL_MAP_ID(_ctrl)           ((_ctrl) & NAN_AVAIL_CTRL_MAP_ID_MASK)
+#define NAN_AVAIL_CTRL_COMM_CHANGED_MASK       0x0010
+#define NAN_AVAIL_CTRL_COMM_CHANGED(_ctrl)     ((_ctrl) & NAN_AVAIL_CTRL_COMM_CHANGED_MASK)
+#define NAN_AVAIL_CTRL_POTEN_CHANGED_MASK      0x0020
+#define NAN_AVAIL_CTRL_POTEN_CHANGED(_ctrl)    ((_ctrl) & NAN_AVAIL_CTRL_POTEN_CHANGED_MASK)
+#define NAN_AVAIL_CTRL_PUBLIC_CHANGED_MASK     0x0040
+#define NAN_AVAIL_CTRL_PUBLIC_CHANGED(_ctrl)   ((_ctrl) & NAN_AVAIL_CTRL_PUBLIC_CHANGED_MASK)
+#define NAN_AVAIL_CTRL_NDC_CHANGED_MASK                0x0080
+#define NAN_AVAIL_CTRL_NDC_CHANGED(_ctrl)      ((_ctrl) & NAN_AVAIL_CTRL_NDC_CHANGED_MASK)
+#define NAN_AVAIL_CTRL_MCAST_CHANGED_MASK      0x0100
+#define NAN_AVAIL_CTRL_MCAST_CHANGED(_ctrl)    ((_ctrl) & NAN_AVAIL_CTRL_MCAST_CHANGED_MASK)
+#define NAN_AVAIL_CTRL_MCAST_CHG_CHANGED_MASK  0x0200
+#define NAN_AVAIL_CTRL_MCAST_CHG_CHANGED(_ctrl)        ((_ctrl) & NAN_AVAIL_CTRL_MCAST_CHG_CHANGED_MASK)
+#define NAN_AVAIL_CTRL_CHANGED_FLAGS_MASK      0x03f0
+
+#define NAN_AVAIL_ENTRY_CTRL_AVAIL_TYPE_MASK 0x07
+#define NAN_AVAIL_ENTRY_CTRL_AVAIL_TYPE(_flags) ((_flags) & NAN_AVAIL_ENTRY_CTRL_AVAIL_TYPE_MASK)
+#define NAN_AVAIL_ENTRY_CTRL_USAGE_MASK 0x18
+#define NAN_AVAIL_ENTRY_CTRL_USAGE_SHIFT 3
+#define NAN_AVAIL_ENTRY_CTRL_USAGE(_flags) (((_flags) & NAN_AVAIL_ENTRY_CTRL_USAGE_MASK) \
+       >> NAN_AVAIL_ENTRY_CTRL_USAGE_SHIFT)
+#define NAN_AVAIL_ENTRY_CTRL_UTIL_MASK 0xE0
+#define NAN_AVAIL_ENTRY_CTRL_UTIL_SHIFT 5
+#define NAN_AVAIL_ENTRY_CTRL_UTIL(_flags) (((_flags) & NAN_AVAIL_ENTRY_CTRL_UTIL_MASK) \
+       >> NAN_AVAIL_ENTRY_CTRL_UTIL_SHIFT)
+#define NAN_AVAIL_ENTRY_CTRL_RX_NSS_MASK 0xF00
+#define NAN_AVAIL_ENTRY_CTRL_RX_NSS_SHIFT 8
+#define NAN_AVAIL_ENTRY_CTRL_RX_NSS(_flags) (((_flags) & NAN_AVAIL_ENTRY_CTRL_RX_NSS_MASK) \
+       >> NAN_AVAIL_ENTRY_CTRL_RX_NSS_SHIFT)
+#define NAN_AVAIL_ENTRY_CTRL_BITMAP_PRESENT_MASK 0x1000
+#define NAN_AVAIL_ENTRY_CTRL_BITMAP_PRESENT_SHIFT 12
+#define NAN_AVAIL_ENTRY_CTRL_BITMAP_PRESENT(_flags) (((_flags) & \
+       NAN_AVAIL_ENTRY_CTRL_BITMAP_PRESENT_MASK) >> NAN_AVAIL_ENTRY_CTRL_BITMAP_PRESENT_SHIFT)
+
+#define NAN_TIME_BMAP_CTRL_BITDUR_MASK 0x07
+#define NAN_TIME_BMAP_CTRL_BITDUR(_flags) ((_flags) & NAN_TIME_BMAP_CTRL_BITDUR_MASK)
+#define NAN_TIME_BMAP_CTRL_PERIOD_MASK 0x38
+#define NAN_TIME_BMAP_CTRL_PERIOD_SHIFT 3
+#define NAN_TIME_BMAP_CTRL_PERIOD(_flags) (((_flags) & NAN_TIME_BMAP_CTRL_PERIOD_MASK) \
+       >> NAN_TIME_BMAP_CTRL_PERIOD_SHIFT)
+#define NAN_TIME_BMAP_CTRL_OFFSET_MASK 0x7FC0
+#define NAN_TIME_BMAP_CTRL_OFFSET_SHIFT 6
+#define NAN_TIME_BMAP_CTRL_OFFSET(_flags) (((_flags) & NAN_TIME_BMAP_CTRL_OFFSET_MASK) \
+       >> NAN_TIME_BMAP_CTRL_OFFSET_SHIFT)
+#define NAN_TIME_BMAP_LEN(avail_entry) \
+       (*(uint8 *)(((wifi_nan_avail_entry_attr_t *)avail_entry)->var + 2))
+
+#define NAN_AVAIL_CHAN_LIST_HDR_LEN 1
+#define NAN_AVAIL_CHAN_LIST_TYPE_BAND          0x00
+#define NAN_AVAIL_CHAN_LIST_TYPE_CHANNEL       0x01
+#define NAN_AVAIL_CHAN_LIST_NON_CONTIG_BW      0x02
+#define NAN_AVAIL_CHAN_LIST_NUM_ENTRIES_MASK   0xF0
+#define NAN_AVAIL_CHAN_LIST_NUM_ENTRIES_SHIFT  4
+#define NAN_AVAIL_CHAN_LIST_NUM_ENTRIES(_ctrl) (((_ctrl) & NAN_AVAIL_CHAN_LIST_NUM_ENTRIES_MASK) \
+       >> NAN_AVAIL_CHAN_LIST_NUM_ENTRIES_SHIFT)
+
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_channel_entry_list_s {
+       uint8 chan_info;
+       uint8 var[0];
+} BWL_POST_PACKED_STRUCT wifi_nan_channel_entry_list_t;
+
+/* define for chan_info */
+#define NAN_CHAN_OP_CLASS_MASK 0x01
+#define NAN_CHAN_NON_CONT_BW_MASK 0x02
+#define NAN_CHAN_RSVD_MASK 0x03
+#define NAN_CHAN_NUM_ENTRIES_MASK 0xF0
+
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_band_entry_s {
+       uint8 band[1];
+} BWL_POST_PACKED_STRUCT wifi_nan_band_entry_t;
+
+/* Type of  Availability: committed */
+#define NAN_ENTRY_CNTRL_TYPE_COMM_AVAIL                0x1
+/* Type of  Availability: potential */
+#define NAN_ENTRY_CNTRL_TYPE_POTEN_AVAIL       0x2
+/* Type of  Availability: conditional */
+#define NAN_ENTRY_CNTRL_TYPE_COND_AVAIL                0x4
+/* Committed + Potential */
+#define NAN_ENTRY_CNTRL_TYPE_COMM_POTEN \
+       (NAN_ENTRY_CNTRL_TYPE_COMM_AVAIL | NAN_ENTRY_CNTRL_TYPE_POTEN_AVAIL)
+/* Conditional + Potential */
+#define NAN_ENTRY_CNTRL_TYPE_COND_POTEN \
+       (NAN_ENTRY_CNTRL_TYPE_COND_AVAIL | NAN_ENTRY_CNTRL_TYPE_POTEN_AVAIL)
+
+/* Type of  Availability */
+#define NAN_ENTRY_CNTRL_TYPE_OF_AVAIL_MASK     0x07
+#define NAN_ENTRY_CNTRL_TYPE_OF_AVAIL_SHIFT    0
+/* Usage Preference */
+#define NAN_ENTRY_CNTRL_USAGE_PREF_MASK                0x18
+#define NAN_ENTRY_CNTRL_USAGE_PREF_SHIFT       3
+/* Utilization */
+#define NAN_ENTRY_CNTRL_UTIL_MASK              0x1E0
+#define NAN_ENTRY_CNTRL_UTIL_SHIFT             5
+
+/* Time Bitmap Control field (section 5.7.18.2.3) */
+
+/* Reserved */
+#define NAN_TIME_BMP_CNTRL_RSVD_MASK   0x01
+#define NAN_TIME_BMP_CNTRL_RSVD_SHIFT  0
+/* Bitmap Len */
+#define NAN_TIME_BMP_CNTRL_BMP_LEN_MASK        0x7E
+#define NAN_TIME_BMP_CNTRL_BMP_LEN_SHIFT 1
+/* Bit Duration */
+#define NAN_TIME_BMP_CNTRL_BIT_DUR_MASK        0x380
+#define NAN_TIME_BMP_CNTRL_BIT_DUR_SHIFT       7
+/* Bitmap Len */
+#define NAN_TIME_BMP_CNTRL_PERIOD_MASK 0x1C00
+#define NAN_TIME_BMP_CNTRL_PERIOD_SHIFT        10
+/* Start Offset */
+#define NAN_TIME_BMP_CNTRL_START_OFFSET_MASK   0x3FE000
+#define NAN_TIME_BMP_CNTRL_START_OFFSET_SHIFT  13
+/* Reserved */
+#define NAN_TIME_BMP_CNTRL_RESERVED_MASK       0xC00000
+#define NAN_TIME_BMP_CNTRL_RESERVED_SHIFT      22
+
+/* Time Bitmap Control field: Period */
+typedef enum
+{
+       NAN_TIME_BMP_CTRL_PERIOD_128TU = 1,
+       NAN_TIME_BMP_CTRL_PERIOD_256TU = 2,
+       NAN_TIME_BMP_CTRL_PERIOD_512TU = 3,
+       NAN_TIME_BMP_CTRL_PERIOD_1024TU = 4,
+       NAN_TIME_BMP_CTRL_PERIOD_2048U = 5,
+       NAN_TIME_BMP_CTRL_PERIOD_4096U = 6,
+       NAN_TIME_BMP_CTRL_PERIOD_8192U = 7
+} nan_time_bmp_ctrl_repeat_interval_t;
+
+enum
+{
+       NAN_TIME_BMP_BIT_DUR_16TU_IDX = 0,
+       NAN_TIME_BMP_BIT_DUR_32TU_IDX = 1,
+       NAN_TIME_BMP_BIT_DUR_64TU_IDX = 2,
+       NAN_TIME_BMP_BIT_DUR_128TU_IDX = 3
+};
+
+enum
+{
+       NAN_TIME_BMP_BIT_DUR_IDX_0 = 16,
+       NAN_TIME_BMP_BIT_DUR_IDX_1 = 32,
+       NAN_TIME_BMP_BIT_DUR_IDX_2 = 64,
+       NAN_TIME_BMP_BIT_DUR_IDX_3 = 128
+};
+
+enum
+{
+       NAN_TIME_BMP_CTRL_PERIOD_IDX_1 = 128,
+       NAN_TIME_BMP_CTRL_PERIOD_IDX_2 = 256,
+       NAN_TIME_BMP_CTRL_PERIOD_IDX_3 = 512,
+       NAN_TIME_BMP_CTRL_PERIOD_IDX_4 = 1024,
+       NAN_TIME_BMP_CTRL_PERIOD_IDX_5 = 2048,
+       NAN_TIME_BMP_CTRL_PERIOD_IDX_6 = 4096,
+       NAN_TIME_BMP_CTRL_PERIOD_IDX_7 = 8192
+};
+
+/* Channel Entries List field */
+
+/* Type */
+#define NAN_CHAN_ENTRY_TYPE_MASK       0x01
+#define NAN_CHAN_ENTRY_TYPE_SHIFT      0
+/* Channel Entry Length Indication */
+#define NAN_CHAN_ENTRY_LEN_IND_MASK    0x02
+#define NAN_CHAN_ENTRY_LEN_IND_SHIFT   1
+/* Reserved */
+#define NAN_CHAN_ENTRY_RESERVED_MASK   0x0C
+#define NAN_CHAN_ENTRY_RESERVED_SHIFT  2
+/* Number of FAC Band or Channel Entries  */
+#define NAN_CHAN_ENTRY_NO_OF_CHAN_ENTRY_MASK   0xF0
+#define NAN_CHAN_ENTRY_NO_OF_CHAN_ENTRY_SHIFT  4
+
+#define NAN_CHAN_ENTRY_TYPE_BANDS      0
+#define NAN_CHAN_ENTRY_TYPE_OPCLASS_CHANS      1
+
+#define NAN_CHAN_ENTRY_BW_LT_80MHZ     0
+#define NAN_CHAN_ENTRY_BW_EQ_160MHZ    1
+
+/*
+ * NDL Attribute WFA Tech. Spec ver 1.0.r12 (section 10.7.19.2)
+ */
+#define NDL_ATTR_IM_MAP_ID_LEN         1
+#define NDL_ATTR_IM_TIME_BMP_CTRL_LEN  2
+#define NDL_ATTR_IM_TIME_BMP_LEN_LEN   1
+
+/*
+ * NDL Control field - Table xx
+ */
+#define NDL_ATTR_CTRL_PEER_ID_PRESENT_MASK             0x01
+#define NDL_ATTR_CTRL_PEER_ID_PRESENT_SHIFT            0
+#define NDL_ATTR_CTRL_IM_SCHED_PRESENT_MASK            0x02
+#define NDL_ATTR_CTRL_IM_SCHED_PRESENT_SHIFT   1
+#define NDL_ATTR_CTRL_NDC_ATTR_PRESENT_MASK            0x04
+#define NDL_ATTR_CTRL_NDC_ATTR_PRESENT_SHIFT   2
+#define NDL_ATTR_CTRL_QOS_ATTR_PRESENT_MASK            0x08
+#define NDL_ATTR_CTRL_QOS_ATTR_PRESENT_SHIFT   3
+#define NDL_ATTR_CTRL_MAX_IDLE_PER_PRESENT_MASK                0x10    /* max idle period */
+#define NDL_ATTR_CTRL_MAX_IDLE_PER_PRESENT_SHIFT       4
+#define NDL_ATTR_CTRL_NDL_TYPE_MASK                            0x20    /* NDL type */
+#define NDL_ATTR_CTRL_NDL_TYPE_SHIFT                   5
+#define NDL_ATTR_CTRL_NDL_SETUP_REASON_MASK            0xC0    /* NDL Setup Reason */
+#define NDL_ATTR_CTRL_NDL_SETUP_REASON_SHIFT   6
+
+/* NDL setup Reason */
+#define NDL_ATTR_CTRL_NDL_TYPE_S_NDL   0x0     /* S-NDL */
+#define NDL_ATTR_CTRL_NDL_TYPE_P_NDL   0x1     /* P-NDL */
+
+/* NDL setup Reason */
+#define NDL_ATTR_CTRL_NDL_SETUP_REASON_NDP_RANG        0x0     /* NDP or Ranging */
+#define NDL_ATTR_CTRL_NDL_SETUP_REASON_FSD_GAS 0x1     /* FSD using GAS */
+
+#define NAN_NDL_TYPE_MASK                              0x0F
+#define NDL_ATTR_TYPE_STATUS_REQUEST   0x00
+#define NDL_ATTR_TYPE_STATUS_RESPONSE  0x01
+#define NDL_ATTR_TYPE_STATUS_CONFIRM   0x02
+#define NDL_ATTR_TYPE_STATUS_CONTINUED 0x00
+#define NDL_ATTR_TYPE_STATUS_ACCEPTED  0x10
+#define NDL_ATTR_TYPE_STATUS_REJECTED  0x20
+
+#define NAN_NDL_TYPE_CHECK(_ndl, x)    (((_ndl)->type_status & NAN_NDL_TYPE_MASK) == (x))
+#define NAN_NDL_REQUEST(_ndl)          (((_ndl)->type_status & NAN_NDL_TYPE_MASK) == \
+                                                               NDL_ATTR_TYPE_STATUS_REQUEST)
+#define NAN_NDL_RESPONSE(_ndl)         (((_ndl)->type_status & NAN_NDL_TYPE_MASK) == \
+                                                               NDL_ATTR_TYPE_STATUS_RESPONSE)
+#define NAN_NDL_CONFIRM(_ndl)          (((_ndl)->type_status & NAN_NDL_TYPE_MASK) == \
+                                                               NDL_ATTR_TYPE_STATUS_CONFIRM)
+
+#define NAN_NDL_STATUS_SHIFT   4
+#define NAN_NDL_STATUS_MASK    0xF0
+#define NAN_NDL_CONT(_ndl)     (((_ndl)->type_status & NAN_NDL_STATUS_MASK) == \
+                                                               NDL_ATTR_TYPE_STATUS_CONTINUED)
+#define NAN_NDL_ACCEPT(_ndl)   (((_ndl)->type_status & NAN_NDL_STATUS_MASK) == \
+                                                               NDL_ATTR_TYPE_STATUS_ACCEPTED)
+#define NAN_NDL_REJECT(_ndl)   (((_ndl)->type_status & NAN_NDL_STATUS_MASK) == \
+                                                               NDL_ATTR_TYPE_STATUS_REJECTED)
+#define NAN_NDL_FRM_STATUS(_ndl) \
+       (((_ndl)->type_status & NAN_NDL_STATUS_MASK) >> NAN_NDL_STATUS_SHIFT)
+
+#define NDL_ATTR_CTRL_NONE                             0
+#define NDL_ATTR_CTRL_PEER_ID_PRESENT  (1 << NDL_ATTR_CTRL_PEER_ID_PRESENT_SHIFT)
+#define NDL_ATTR_CTRL_IMSCHED_PRESENT  (1 << NDL_ATTR_CTRL_IM_SCHED_PRESENT_SHIFT)
+#define NDL_ATTR_CTRL_NDC_PRESENT              (1 << NDL_ATTR_CTRL_NDC_ATTR_PRESENT_SHIFT)
+#define NDL_ATTR_CTRL_NDL_QOS_PRESENT  (1 << NDL_ATTR_CTRL_QOS_ATTR_PRESENT_SHIFT)
+#define NDL_ATTR_CTRL_MAX_IDLE_PER_PRESENT     (1 << NDL_ATTR_CTRL_MAX_IDLE_PER_PRESENT_SHIFT)
+
+#define NA_NDL_IS_IMMUT_PRESENT(ndl) (((ndl)->ndl_ctrl) & NDL_ATTR_CTRL_IMSCHED_PRESENT)
+#define NA_NDL_IS_PEER_ID_PRESENT(ndl) (((ndl)->ndl_ctrl) & NDL_ATTR_CTRL_PEER_ID_PRESENT)
+#define NA_NDL_IS_MAX_IDLE_PER_PRESENT(ndl) (((ndl)->ndl_ctrl) & NDL_ATTR_CTRL_MAX_IDLE_PER_PRESENT)
+
+#define NDL_ATTR_PEERID_LEN                            1
+#define NDL_ATTR_MAX_IDLE_PERIOD_LEN   2
+
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ndl_attr_s {
+       uint8 id;               /* NAN_ATTR_NAN_NDL = 0x17 */
+       uint16 len;             /* Length of the fields in the attribute */
+       uint8 dialog_token;     /* Identify req and resp */
+       uint8 type_status;              /* Bits[3-0] type subfield, Bits[7-4] status subfield */
+       uint8 reason;           /* Identifies reject reason */
+       uint8 ndl_ctrl;         /* NDL control field */
+       uint8 var[];            /* Optional fields follow */
+} BWL_POST_PACKED_STRUCT wifi_nan_ndl_attr_t;
+
+/*
+ * NDL QoS Attribute  WFA Tech. Spec ver r26
+ */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ndl_qos_attr_s {
+       uint8 id;               /* NAN_ATTR_NAN_NDL_QOS = 24 */
+       uint16 len;             /* Length of the attribute field following */
+       uint8 min_slots;        /* Min. number of FAW slots needed per DW interval */
+       uint16 max_latency;  /* Max interval between non-cont FAW */
+} BWL_POST_PACKED_STRUCT wifi_nan_ndl_qos_attr_t;
+
+/* no preference to min time slots */
+#define NAN_NDL_QOS_MIN_SLOT_NO_PREF   0
+/* no preference to no. of slots between two non-contiguous slots */
+#define NAN_NDL_QOS_MAX_LAT_NO_PREF            0xFFFF
+
+/* Device Capability Attribute */
+
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_dev_cap_s {
+       uint8 id;               /* 0x0F */
+       uint16 len;             /* Length */
+       uint8 map_id;           /* map id */
+       uint16 commit_dw_info;  /* Committed DW Info */
+       uint8 bands_supported;  /* Supported Bands */
+       uint8 op_mode;          /* Operation Mode */
+       uint8 num_antennas;     /* Bit 0-3 tx, 4-7 rx */
+       uint16 chan_switch_time;        /* Max channel switch time in us */
+       uint8 capabilities;     /* DFS Master, Extended key id etc */
+} BWL_POST_PACKED_STRUCT wifi_nan_dev_cap_t;
+
+/* map id related */
+
+/* all maps */
+#define NAN_DEV_CAP_ALL_MAPS_FLAG_MASK 0x1     /* nan default map control */
+#define NAN_DEV_CAP_ALL_MAPS_FLAG_SHIFT        0
+/* map id */
+#define NAN_DEV_CAP_MAPID_MASK 0x1E
+#define NAN_DEV_CAP_MAPID_SHIFT        1
+
+/* Awake DW Info field format */
+
+/* 2.4GHz DW */
+#define NAN_DEV_CAP_AWAKE_DW_2G_MASK   0x07
+/* 5GHz DW */
+#define NAN_DEV_CAP_AWAKE_DW_5G_MASK   0x38
+/* Reserved */
+#define NAN_DEV_CAP_AWAKE_DW_RSVD_MASK 0xC0
+
+/* bit shift for dev cap */
+#define NAN_DEV_CAP_AWAKE_DW_2G_SHIFT  0
+#define NAN_DEV_CAP_AWAKE_DW_5G_SHIFT  3
+
+/* Device Capability Attribute Format */
+
+/* Committed DW Info field format */
+/* 2.4GHz DW */
+#define NAN_DEV_CAP_COMMIT_DW_2G_MASK  0x07
+#define NAN_DEV_CAP_COMMIT_DW_2G_OVERWRITE_MASK        0x3C0
+/* 5GHz DW */
+#define NAN_DEV_CAP_COMMIT_DW_5G_MASK  0x38
+#define NAN_DEV_CAP_COMMIT_DW_5G_OVERWRITE_MASK 0x3C00
+/* Reserved */
+#define NAN_DEV_CAP_COMMIT_DW_RSVD_MASK        0xC000
+/* Committed DW bit shift for dev cap */
+#define NAN_DEV_CAP_COMMIT_DW_2G_SHIFT 0
+#define NAN_DEV_CAP_COMMIT_DW_5G_SHIFT 3
+#define NAN_DEV_CAP_COMMIT_DW_2G_OVERWRITE_SHIFT       6
+#define NAN_DEV_CAP_COMMIT_DW_5G_OVERWRITE_SHIFT       10
+/* Operation Mode */
+#define NAN_DEV_CAP_OP_PHY_MODE_HT_ONLY                0x00
+#define NAN_DEV_CAP_OP_PHY_MODE_VHT            0x01
+#define NAN_DEV_CAP_OP_PHY_MODE_VHT_8080       0x02
+#define NAN_DEV_CAP_OP_PHY_MODE_VHT_160                0x04
+#define NAN_DEV_CAP_OP_PAGING_NDL              0x08
+
+#define NAN_DEV_CAP_OP_MODE_VHT_MASK           0x01
+#define NAN_DEV_CAP_OP_MODE_VHT_SHIFT          0
+#define NAN_DEV_CAP_OP_MODE_VHT8080_MASK       0x02
+#define NAN_DEV_CAP_OP_MODE_VHT8080_SHIFT      1
+#define NAN_DEV_CAP_OP_MODE_VHT160_MASK                0x04
+#define NAN_DEV_CAP_OP_MODE_VHT160_SHIFT       2
+#define NAN_DEV_CAP_OP_MODE_PAGING_NDL_MASK    0x08
+#define NAN_DEV_CAP_OP_MODE_PAGING_NDL_SHIFT   3
+
+#define NAN_DEV_CAP_RX_ANT_SHIFT               4
+#define NAN_DEV_CAP_TX_ANT_MASK                        0x0F
+#define NAN_DEV_CAP_RX_ANT_MASK                        0xF0
+#define NAN_DEV_CAP_TX_ANT(_ant)               ((_ant) & NAN_DEV_CAP_TX_ANT_MASK)
+#define NAN_DEV_CAP_RX_ANT(_ant)               (((_ant) & NAN_DEV_CAP_RX_ANT_MASK) \
+               >> NAN_DEV_CAP_RX_ANT_SHIFT)
+
+/* Device capabilities */
+
+/* DFS master capability */
+#define NAN_DEV_CAP_DFS_MASTER_MASK            0x01
+#define NAN_DEV_CAP_DFS_MASTER_SHIFT   0
+/* extended iv cap */
+#define NAN_DEV_CAP_EXT_KEYID_MASK             0x02
+#define NAN_DEV_CAP_EXT_KEYID_SHIFT            1
+/* NDPE attribute support */
+#define        NAN_DEV_CAP_NDPE_ATTR_SUPPORT_MASK      0x08
+#define NAN_DEV_CAP_NDPE_ATTR_SUPPORT(_cap)    ((_cap) & NAN_DEV_CAP_NDPE_ATTR_SUPPORT_MASK)
+
+/* Band IDs */
+enum {
+       NAN_BAND_ID_TVWS                = 0,
+       NAN_BAND_ID_SIG                 = 1,    /* Sub 1 GHz */
+       NAN_BAND_ID_2G                  = 2,    /* 2.4 GHz */
+       NAN_BAND_ID_3G                  = 3,    /* 3.6 GHz */
+       NAN_BAND_ID_5G                  = 4,    /* 4.9 & 5 GHz */
+       NAN_BAND_ID_60G                 = 5
+};
+typedef uint8 nan_band_id_t;
+
+/* NAN supported band in device capability */
+#define NAN_DEV_CAP_SUPPORTED_BANDS_2G (1 << NAN_BAND_ID_2G)
+#define NAN_DEV_CAP_SUPPORTED_BANDS_5G (1 << NAN_BAND_ID_5G)
+
+/*
+ * Unaligned schedule attribute section 10.7.19.6 spec. ver r15
+ */
+#define NAN_ULW_ATTR_CTRL_SCHED_ID_MASK 0x000F
+#define NAN_ULW_ATTR_CTRL_SCHED_ID_SHIFT 0
+#define NAN_ULW_ATTR_CTRL_SEQ_ID_MASK 0xFF00
+#define NAN_ULW_ATTR_CTRL_SEQ_ID_SHIFT 8
+
+#define NAN_ULW_OVWR_ALL_MASK 0x01
+#define NAN_ULW_OVWR_ALL_SHIFT 0
+#define NAN_ULW_OVWR_MAP_ID_MASK 0x1E
+#define NAN_ULW_OVWR_MAP_ID_SHIFT 1
+
+#define NAN_ULW_CTRL_TYPE_MASK 0x03
+#define NAN_ULW_CTRL_TYPE_SHIFT 0
+#define NAN_ULW_CTRL_TYPE(ctrl)        (ctrl & NAN_ULW_CTRL_TYPE_MASK)
+#define NAN_ULW_CTRL_CHAN_AVAIL_MASK 0x04
+#define NAN_ULW_CTRL_CHAN_AVAIL_SHIFT 2
+#define NAN_ULW_CTRL_CHAN_AVAIL(ctrl)  ((ctrl & NAN_ULW_CTRL_CHAN_AVAIL_MASK) \
+       >> NAN_ULW_CTRL_CHAN_AVAIL_SHIFT)
+#define NAN_ULW_CTRL_RX_NSS_MASK 0x78
+#define NAN_ULW_CTRL_RX_NSS_SHIFT 3
+
+#define NAN_ULW_CTRL_TYPE_BAND         0
+#define NAN_ULW_CTRL_TYPE_CHAN_NOAUX   1
+#define NAN_ULW_CTRL_TYPE_CHAN_AUX     2
+
+#define NAN_ULW_CNT_DOWN_NO_EXPIRE     0xFF    /* ULWs doen't end until next sched update */
+#define NAN_ULW_CNT_DOWN_CANCEL                0x0             /* cancel remaining ulws */
+
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ulw_attr_s {
+       uint8 id;
+       uint16 len;
+       uint16 ctrl;
+       uint32 start; /* low 32 bits of tsf */
+       uint32 dur;
+       uint32 period;
+       uint8 count_down;
+       uint8 overwrite;
+       /*
+        * ulw[0] == optional field ULW control when present.
+        * band ID or channel follows
+        */
+       uint8 ulw_entry[];
+} BWL_POST_PACKED_STRUCT wifi_nan_ulw_attr_t;
+
+/* NAN2 Management Frame (section 5.6) */
+
+/* Public action frame for NAN2 */
+typedef BWL_PRE_PACKED_STRUCT struct nan2_pub_act_frame_s {
+       /* NAN_PUB_AF_CATEGORY 0x04 */
+       uint8 category_id;
+       /* NAN_PUB_AF_ACTION 0x09 */
+       uint8 action_field;
+       /* NAN_OUI 0x50-6F-9A */
+       uint8 oui[DOT11_OUI_LEN];
+       /* NAN_OUI_TYPE TBD */
+       uint8 oui_type;
+       /* NAN_OUI_SUB_TYPE TBD */
+       uint8 oui_sub_type;
+       /* One or more NAN Attributes follow */
+       uint8 data[];
+} BWL_POST_PACKED_STRUCT nan2_pub_act_frame_t;
+
+#define NAN2_PUB_ACT_FRM_SIZE  (OFFSETOF(nan2_pub_act_frame_t, data))
+
+/* NAN Action Frame Subtypes */
+/* Subtype-0 is Reserved */
+#define NAN_MGMT_FRM_SUBTYPE_RESERVED          0
+#define NAN_MGMT_FRM_SUBTYPE_INVALID           0
+/* NAN Ranging Request */
+#define NAN_MGMT_FRM_SUBTYPE_RANGING_REQ       1
+/* NAN Ranging Response */
+#define NAN_MGMT_FRM_SUBTYPE_RANGING_RESP      2
+/* NAN Ranging Termination */
+#define NAN_MGMT_FRM_SUBTYPE_RANGING_TERM      3
+/* NAN Ranging Report */
+#define NAN_MGMT_FRM_SUBTYPE_RANGING_RPT       4
+/* NDP Request */
+#define NAN_MGMT_FRM_SUBTYPE_NDP_REQ           5
+/* NDP Response */
+#define NAN_MGMT_FRM_SUBTYPE_NDP_RESP          6
+/* NDP Confirm */
+#define NAN_MGMT_FRM_SUBTYPE_NDP_CONFIRM       7
+/* NDP Key Installment */
+#define NAN_MGMT_FRM_SUBTYPE_NDP_KEY_INST      8
+/* NDP Termination */
+#define NAN_MGMT_FRM_SUBTYPE_NDP_END           9
+/* Schedule Request */
+#define NAN_MGMT_FRM_SUBTYPE_SCHED_REQ         10
+/* Schedule Response */
+#define NAN_MGMT_FRM_SUBTYPE_SCHED_RESP                11
+/* Schedule Confirm */
+#define NAN_MGMT_FRM_SUBTYPE_SCHED_CONF                12
+/* Schedule Update */
+#define NAN_MGMT_FRM_SUBTYPE_SCHED_UPD         13
+
+#define NAN_SCHEDULE_AF(_naf_subtype) \
+       ((_naf_subtype >= NAN_MGMT_FRM_SUBTYPE_SCHED_REQ) && \
+       (_naf_subtype <= NAN_MGMT_FRM_SUBTYPE_SCHED_UPD))
+
+/* Reason code defines */
+#define NAN_REASON_RESERVED                    0x0
+#define NAN_REASON_UNSPECIFIED                 0x1
+#define NAN_REASON_RESOURCE_LIMIT              0x2
+#define NAN_REASON_INVALID_PARAMS              0x3
+#define NAN_REASON_FTM_PARAM_INCAP             0x4
+#define NAN_REASON_NO_MOVEMENT                 0x5
+#define NAN_REASON_INVALID_AVAIL               0x6
+#define NAN_REASON_IMMUT_UNACCEPT              0x7
+#define NAN_REASON_SEC_POLICY                  0x8
+#define NAN_REASON_QOS_UNACCEPT                        0x9
+#define NAN_REASON_NDP_REJECT                  0xa
+#define NAN_REASON_NDL_UNACCEPTABLE            0xb
+
+/* nan 2.0 qos (not attribute) */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ndp_qos_s {
+       uint8 tid;              /* traffic identifier */
+       uint16 pkt_size;        /* service data pkt size */
+       uint8 data_rate;        /* mean data rate */
+       uint8 svc_interval;     /* max service interval */
+} BWL_POST_PACKED_STRUCT wifi_nan_ndp_qos_t;
+
+/* NDP control bitmap defines */
+#define NAN_NDP_CTRL_CONFIRM_REQUIRED          0x01
+#define NAN_NDP_CTRL_SECURTIY_PRESENT          0x04
+#define NAN_NDP_CTRL_PUB_ID_PRESENT            0x08
+#define NAN_NDP_CTRL_RESP_NDI_PRESENT          0x10
+#define NAN_NDP_CTRL_SPEC_INFO_PRESENT         0x20
+#define NAN_NDP_CTRL_RESERVED                  0xA0
+
+/* Used for both NDP Attribute and NDPE Attribute, since the structures are identical */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ndp_attr_s {
+       uint8 id;               /* NDP: 0x10, NDPE: 0x29 */
+       uint16 len;             /* length */
+       uint8 dialog_token;     /* dialog token */
+       uint8 type_status;      /* bits 0-3 type, 4-7 status */
+       uint8 reason;           /* reason code */
+       struct ether_addr init_ndi;     /* ndp initiator's data interface address */
+       uint8 ndp_id;           /* ndp identifier (created by initiator */
+       uint8 control;          /* ndp control field */
+       uint8 var[];            /* Optional fields follow */
+} BWL_POST_PACKED_STRUCT wifi_nan_ndp_attr_t;
+/* NDP attribute type and status macros */
+#define NAN_NDP_TYPE_MASK      0x0F
+#define NAN_NDP_TYPE_REQUEST   0x0
+#define NAN_NDP_TYPE_RESPONSE  0x1
+#define NAN_NDP_TYPE_CONFIRM   0x2
+#define NAN_NDP_TYPE_SECURITY  0x3
+#define NAN_NDP_TYPE_TERMINATE 0x4
+#define NAN_NDP_REQUEST(_ndp)  (((_ndp)->type_status & NAN_NDP_TYPE_MASK) == NAN_NDP_TYPE_REQUEST)
+#define NAN_NDP_RESPONSE(_ndp) (((_ndp)->type_status & NAN_NDP_TYPE_MASK) == NAN_NDP_TYPE_RESPONSE)
+#define NAN_NDP_CONFIRM(_ndp)  (((_ndp)->type_status & NAN_NDP_TYPE_MASK) == NAN_NDP_TYPE_CONFIRM)
+#define NAN_NDP_SECURITY_INST(_ndp)    (((_ndp)->type_status & NAN_NDP_TYPE_MASK) == \
+                                                                       NAN_NDP_TYPE_SECURITY)
+#define NAN_NDP_TERMINATE(_ndp) (((_ndp)->type_status & NAN_NDP_TYPE_MASK) == \
+                                                                       NAN_NDP_TYPE_TERMINATE)
+#define NAN_NDP_STATUS_SHIFT   4
+#define NAN_NDP_STATUS_MASK    0xF0
+#define NAN_NDP_STATUS_CONT    (0 << NAN_NDP_STATUS_SHIFT)
+#define NAN_NDP_STATUS_ACCEPT  (1 << NAN_NDP_STATUS_SHIFT)
+#define NAN_NDP_STATUS_REJECT  (2 << NAN_NDP_STATUS_SHIFT)
+#define NAN_NDP_CONT(_ndp)     (((_ndp)->type_status & NAN_NDP_STATUS_MASK) == NAN_NDP_STATUS_CONT)
+#define NAN_NDP_ACCEPT(_ndp)   (((_ndp)->type_status & NAN_NDP_STATUS_MASK) == \
+                                                                       NAN_NDP_STATUS_ACCEPT)
+#define NAN_NDP_REJECT(_ndp)   (((_ndp)->type_status & NAN_NDP_STATUS_MASK) == \
+                                                                       NAN_NDP_STATUS_REJECT)
+
+#define NAN_NDP_FRM_STATUS(_ndp) \
+       (((_ndp)->type_status & NAN_NDP_STATUS_MASK) >> NAN_NDP_STATUS_SHIFT)
+
+/* NDP Setup Status */
+#define NAN_NDP_SETUP_STATUS_OK                1
+#define NAN_NDP_SETUP_STATUS_FAIL      0
+#define NAN_NDP_SETUP_STATUS_REJECT    2
+
+/* NDPE TLV list */
+#define NDPE_TLV_TYPE_IPV6             0x00
+#define NDPE_TLV_TYPE_SVC_INFO         0x01
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ndpe_tlv_s {
+       uint8 type;             /* Operating Class */
+       uint16 length;          /* Channel Bitmap */
+       uint8 data[];
+} BWL_POST_PACKED_STRUCT wifi_nan_ndpe_tlv_t;
+
+/* Rng setup attribute type and status macros */
+#define NAN_RNG_TYPE_MASK      0x0F
+#define NAN_RNG_TYPE_REQUEST   0x0
+#define NAN_RNG_TYPE_RESPONSE  0x1
+#define NAN_RNG_TYPE_TERMINATE 0x2
+
+#define NAN_RNG_STATUS_SHIFT   4
+#define NAN_RNG_STATUS_MASK    0xF0
+#define NAN_RNG_STATUS_ACCEPT  (0 << NAN_RNG_STATUS_SHIFT)
+#define NAN_RNG_STATUS_REJECT  (1 << NAN_RNG_STATUS_SHIFT)
+
+#define NAN_RNG_ACCEPT(_rsua)  (((_rsua)->type_status & NAN_RNG_STATUS_MASK) == \
+                                                                       NAN_RNG_STATUS_ACCEPT)
+#define NAN_RNG_REJECT(_rsua)  (((_rsua)->type_status & NAN_RNG_STATUS_MASK) == \
+                                                                       NAN_RNG_STATUS_REJECT)
+
+/* schedule entry */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_sched_entry_s {
+       uint8 map_id;           /* map id */
+       uint16 tbmp_ctrl;       /* time bitmap control */
+       uint8 tbmp_len;         /* time bitmap len */
+       uint8 tbmp[];           /* time bitmap - Optional */
+} BWL_POST_PACKED_STRUCT wifi_nan_sched_entry_t;
+
+#define NAN_SCHED_ENTRY_MAPID_MASK     0x0F
+#define NAN_SCHED_ENTRY_MIN_SIZE       OFFSETOF(wifi_nan_sched_entry_t, tbmp)
+#define NAN_SCHED_ENTRY_SIZE(_entry)   (NAN_SCHED_ENTRY_MIN_SIZE + (_entry)->tbmp_len)
+
+/* for dev cap, element container etc. */
+#define NAN_DEV_ELE_MAPID_CTRL_MASK            0x1
+#define NAN_DEV_ELE_MAPID_CTRL_SHIFT   0
+#define NAN_DEV_ELE_MAPID_MASK         0x1E
+#define NAN_DEV_ELE_MAPID_SHIFT                1
+
+#define NAN_DEV_ELE_MAPID_CTRL_SET(_mapid_field, value) \
+       do {(_mapid_field) &= ~NAN_DEV_ELE_MAPID_CTRL_MASK; \
+               (_mapid_field) |= ((value << NAN_DEV_ELE_MAPID_CTRL_SHIFT) & \
+               NAN_DEV_ELE_MAPID_CTRL_MASK); \
+       } while (0);
+
+#define NAN_DEV_ELE_MAPID_CTRL_GET(_mapid_field) \
+       (((_mapid_field) & NAN_DEV_ELE_MAPID_CTRL_MASK) >> \
+       NAN_DEV_ELE_MAPID_CTRL_SHIFT)
+
+#define NAN_DEV_ELE_MAPID_SET(_mapid_field, value) \
+       do {(_mapid_field) &= ~NAN_DEV_ELE_MAPID_MASK; \
+               (_mapid_field) |= ((value << NAN_DEV_ELE_MAPID_SHIFT) & \
+               NAN_DEV_ELE_MAPID_MASK); \
+       } while (0);
+
+#define NAN_DEV_ELE_MAPID_GET(_mapid_field) \
+       (((_mapid_field) & NAN_DEV_ELE_MAPID_MASK) >> \
+       NAN_DEV_ELE_MAPID_SHIFT)
+
+/* schedule entry map id handling */
+#define NAN_SCHED_ENTRY_MAPID_MASK             0x0F
+#define NAN_SCHED_ENTRY_MAPID_SHIFT            0
+
+#define NAN_SCHED_ENTRY_MAPID_SET(_mapid_field, value) \
+       do {(_mapid_field) &= ~NAN_SCHED_ENTRY_MAPID_MASK; \
+               (_mapid_field) |= ((value << NAN_SCHED_ENTRY_MAPID_SHIFT) & \
+               NAN_SCHED_ENTRY_MAPID_MASK); \
+       } while (0);
+
+#define NAN_SCHED_ENTRY_MAPID_GET(_mapid_field) \
+       (((_mapid_field) & NAN_SCHED_ENTRY_MAPID_MASK) >> \
+       NAN_SCHED_ENTRY_MAPID_SHIFT)
+
+/* NDC attribute */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_ndc_attr_s {
+       uint8 id;
+       uint16 len;
+       uint8 ndc_id[NAN_DATA_NDC_ID_SIZE];
+       uint8 attr_cntrl;
+       uint8 var[];
+} BWL_POST_PACKED_STRUCT wifi_nan_ndc_attr_t;
+
+/* Attribute control subfield of NDC attr */
+/* Proposed NDC */
+#define NAN_NDC_ATTR_PROPOSED_NDC_MASK 0x1
+#define NAN_NDC_ATTR_PROPOSED_NDC_SHIFT 0
+
+/* get & set */
+#define NAN_NDC_GET_PROPOSED_FLAG(_attr)       \
+       (((_attr)->attr_cntrl & NAN_NDC_ATTR_PROPOSED_NDC_MASK) >>      \
+       NAN_NDC_ATTR_PROPOSED_NDC_SHIFT)
+#define NAN_NDC_SET_PROPOSED_FLAG(_attr, value) \
+       do {((_attr)->attr_cntrl &= ~NAN_NDC_ATTR_PROPOSED_NDC_MASK); \
+               ((_attr)->attr_cntrl |= \
+               (((value) << NAN_NDC_ATTR_PROPOSED_NDC_SHIFT) & NAN_NDC_ATTR_PROPOSED_NDC_MASK)); \
+       } while (0)
+
+/* Service descriptor extension attribute */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_svc_desc_ext_attr_s {
+       /* Attribute ID - 0x11 */
+       uint8 id;
+       /* Length of the following fields in the attribute */
+       uint16 len;
+       /* Instance id of associated service descriptor attribute */
+       uint8 instance_id;
+       /* SDE control field */
+       uint16 control;
+       /* range limit, svc upd indicator etc. */
+       uint8 var[];
+} BWL_POST_PACKED_STRUCT wifi_nan_svc_desc_ext_attr_t;
+
+#define NAN_SDE_ATTR_MIN_LEN OFFSETOF(wifi_nan_svc_desc_ext_attr_t, var)
+#define        NAN_SDE_ATTR_RANGE_LEN                  4
+#define        NAN_SDE_ATTR_SUI_LEN                    1
+#define        NAN_SDE_ATTR_INFO_LEN_PARAM_LEN         2
+#define        NAN_SDE_ATTR_RANGE_INGRESS_LEN          2
+#define        NAN_SDE_ATTR_RANGE_EGRESS_LEN           2
+#define NAN_SDE_ATTR_CTRL_LEN                  2
+/* max length of variable length field (matching filter, service response filter,
+ * or service info) in service descriptor attribute
+ */
+#define NAN_DISC_SDA_FIELD_MAX_LEN     255
+
+/* SDEA control field bit definitions and access macros */
+#define NAN_SDE_CF_FSD_REQUIRED                (1 << 0)
+#define NAN_SDE_CF_FSD_GAS             (1 << 1)
+#define NAN_SDE_CF_DP_REQUIRED         (1 << 2)
+#define NAN_SDE_CF_DP_TYPE             (1 << 3)
+#define NAN_SDE_CF_MULTICAST_TYPE      (1 << 4)
+#define NAN_SDE_CF_QOS_REQUIRED                (1 << 5)
+#define NAN_SDE_CF_SECURITY_REQUIRED   (1 << 6)
+#define NAN_SDE_CF_RANGING_REQUIRED    (1 << 7)
+#define NAN_SDE_CF_RANGE_PRESENT       (1 << 8)
+#define NAN_SDE_CF_SVC_UPD_IND_PRESENT (1 << 9)
+/* Using Reserved Bits as per Spec */
+#define NAN_SDE_CF_LIFE_CNT_PUB_RX      (1 << 15)
+#define NAN_SDE_FSD_REQUIRED(_sde)     ((_sde)->control & NAN_SDE_CF_FSD_REQUIRED)
+#define NAN_SDE_FSD_GAS(_sde)          ((_sde)->control & NAN_SDE_CF_FSD_GAS)
+#define NAN_SDE_DP_REQUIRED(_sde)      ((_sde)->control & NAN_SDE_CF_DP_REQUIRED)
+#define NAN_SDE_DP_MULTICAST(_sde)     ((_sde)->control & NAN_SDE_CF_DP_TYPE)
+#define NAN_SDE_MULTICAST_M_TO_M(_sde) ((_sde)->control & NAN_SDE_CF_MULTICAST_TYPE)
+#define NAN_SDE_QOS_REQUIRED(_sde)     ((_sde)->control & NAN_SDE_CF_QOS_REQUIRED)
+#define NAN_SDE_SECURITY_REQUIRED(_sde)        ((_sde)->control & NAN_SDE_CF_SECURITY_REQUIRED)
+#define NAN_SDE_RANGING_REQUIRED(_sde) ((_sde)->control & NAN_SDE_CF_RANGING_REQUIRED)
+#define NAN_SDE_RANGE_PRESENT(_sde)    ((_sde)->control & NAN_SDE_CF_RANGE_PRESENT)
+#define NAN_SDE_SVC_UPD_IND_PRESENT(_sde)      ((_sde)->control & NAN_SDE_CF_SVC_UPD_IND_PRESENT)
+#define NAN_SDE_LIFE_COUNT_FOR_PUB_RX(_sde)     (_sde & NAN_SDE_CF_LIFE_CNT_PUB_RX)
+
+/* nan2 security */
+
+/*
+ * Cipher suite information Attribute.
+ * WFA Tech. Spec ver 1.0.r21 (section 10.7.24.2)
+ */
+#define NAN_SEC_CIPHER_SUITE_CAP_REPLAY_4     0
+#define NAN_SEC_CIPHER_SUITE_CAP_REPLAY_16    (1 << 0)
+
+/* enum security algo.
+*/
+enum nan_sec_csid {
+       NAN_SEC_ALGO_NONE = 0,
+       NAN_SEC_ALGO_NCS_SK_CCM_128 = 1,     /* CCMP 128 */
+       NAN_SEC_ALGO_NCS_SK_GCM_256 = 2,     /* GCMP 256 */
+       NAN_SEC_ALGO_LAST = 3
+};
+typedef int8 nan_sec_csid_e;
+
+/* nan2 cipher suite attribute field */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_sec_cipher_suite_field_s {
+       uint8 cipher_suite_id;
+       uint8 inst_id;  /* Instance Id */
+} BWL_POST_PACKED_STRUCT wifi_nan_sec_cipher_suite_field_t;
+
+/* nan2 cipher suite information attribute field */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_sec_cipher_suite_info_attr_s {
+       uint8 attr_id;  /* 0x22 - NAN_ATTR_CIPHER_SUITE_INFO */
+       uint16 len;
+       uint8 capabilities;
+       uint8 var[];    /* cipher suite list */
+} BWL_POST_PACKED_STRUCT wifi_nan_sec_cipher_suite_info_attr_t;
+
+/*
+ * Security context identifier attribute
+ * WFA Tech. Spec ver 1.0.r21 (section 10.7.24.4)
+ */
+
+#define NAN_SEC_CTX_ID_TYPE_PMKID   (1 << 0)
+
+/* nan2 security context identifier attribute field */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_sec_ctx_id_field_s {
+       uint16 sec_ctx_id_type_len;     /* length of security ctx identifier */
+       uint8 sec_ctx_id_type;
+       uint8 inst_id;  /* Instance Id */
+       uint8 var[];    /* security ctx identifier */
+} BWL_POST_PACKED_STRUCT wifi_nan_sec_ctx_id_field_t;
+
+/* nan2 security context identifier info attribute field */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_sec_ctx_id_info_attr_s {
+       uint8 attr_id;  /* 0x23 - NAN_ATTR_SEC_CTX_ID_INFO */
+       uint16 len;
+       uint8 var[];    /* security context identifier  list */
+} BWL_POST_PACKED_STRUCT wifi_nan_sec_ctx_id_info_attr_t;
+
+/*
+ * Nan shared key descriptor attribute
+ * WFA Tech. Spec ver 23
+ */
+
+#define NAN_SEC_NCSSK_DESC_REPLAY_CNT_LEN      8
+#define NAN_SEC_NCSSK_DESC_KEY_NONCE_LEN       32
+
+/* nan shared key descriptor attr field */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_sec_ncssk_key_desc_attr_s {
+       uint8 attr_id;  /* 0x24 - NAN_ATTR_SHARED_KEY_DESC */
+       uint16 len;
+       uint8 inst_id;  /* Publish service instance ID */
+       uint8 desc_type;
+       uint16 key_info;
+       uint16 key_len;
+       uint8 key_replay_cntr[NAN_SEC_NCSSK_DESC_REPLAY_CNT_LEN];
+       uint8 key_nonce[NAN_SEC_NCSSK_DESC_KEY_NONCE_LEN];
+       uint8 reserved[32];     /* EAPOL IV + Key RSC + Rsvd fields in EAPOL Key */
+       uint8 mic[];  /* mic + key data len + key data */
+} BWL_POST_PACKED_STRUCT wifi_nan_sec_ncssk_key_desc_attr_t;
+
+/* Key Info fields */
+#define NAN_SEC_NCSSK_DESC_MASK                        0x7
+#define NAN_SEC_NCSSK_DESC_SHIFT               0
+#define NAN_SEC_NCSSK_DESC_KEY_TYPE_MASK       0x8
+#define NAN_SEC_NCSSK_DESC_KEY_TYPE_SHIFT      3
+#define NAN_SEC_NCSSK_DESC_KEY_INSTALL_MASK    0x40
+#define NAN_SEC_NCSSK_DESC_KEY_INSTALL_SHIFT   6
+#define NAN_SEC_NCSSK_DESC_KEY_ACK_MASK                0x80
+#define NAN_SEC_NCSSK_DESC_KEY_ACK_SHIFT       7
+#define NAN_SEC_NCSSK_DESC_KEY_MIC_MASK                0x100
+#define NAN_SEC_NCSSK_DESC_KEY_MIC_SHIFT       8
+#define NAN_SEC_NCSSK_DESC_KEY_SEC_MASK                0x200
+#define NAN_SEC_NCSSK_DESC_KEY_SEC_SHIFT       9
+#define NAN_SEC_NCSSK_DESC_KEY_ERR_MASK                0x400
+#define NAN_SEC_NCSSK_DESC_KEY_ERR_SHIFT       10
+#define NAN_SEC_NCSSK_DESC_KEY_REQ_MASK                0x800
+#define NAN_SEC_NCSSK_DESC_KEY_REQ_SHIFT       11
+#define NAN_SEC_NCSSK_DESC_KEY_ENC_KEY_MASK    0x1000
+#define NAN_SEC_NCSSK_DESC_KEY_ENC_KEY_SHIFT   12
+#define NAN_SEC_NCSSK_DESC_KEY_SMK_MSG_MASK    0x2000
+#define NAN_SEC_NCSSK_DESC_KEY_SMK_MSG_SHIFT   13
+
+/* Key Info get & set macros */
+#define NAN_SEC_NCSSK_KEY_DESC_VER_GET(_key_info)      \
+       (((_key_info) & NAN_SEC_NCSSK_DESC_MASK) >> NAN_SEC_NCSSK_DESC_SHIFT)
+#define NAN_SEC_NCSSK_KEY_DESC_VER_SET(_val, _key_info)        \
+       do {(_key_info) &= ~NAN_SEC_NCSSK_DESC_MASK; \
+               (_key_info) |= (((_val) << NAN_SEC_NCSSK_DESC_SHIFT) & \
+               NAN_SEC_NCSSK_DESC_MASK);} while (0)
+#define NAN_SEC_NCSSK_DESC_KEY_TYPE_GET(_key_info)     \
+       (((_key_info) & NAN_SEC_NCSSK_DESC_KEY_TYPE_MASK) >> NAN_SEC_NCSSK_DESC_KEY_TYPE_SHIFT)
+#define NAN_SEC_NCSSK_DESC_KEY_TYPE_SET(_val, _key_info)       \
+       do {(_key_info) &= ~NAN_SEC_NCSSK_DESC_KEY_TYPE_MASK; \
+               (_key_info) |= (((_val) << NAN_SEC_NCSSK_DESC_KEY_TYPE_SHIFT) & \
+               NAN_SEC_NCSSK_DESC_KEY_TYPE_MASK);} while (0)
+#define NAN_SEC_NCSSK_DESC_KEY_INSTALL_GET(_key_info)  \
+       (((_key_info) & NAN_SEC_NCSSK_DESC_KEY_INSTALL_MASK) >> \
+       NAN_SEC_NCSSK_DESC_KEY_INSTALL_SHIFT)
+#define NAN_SEC_NCSSK_DESC_KEY_INSTALL_SET(_val, _key_info)    \
+       do {(_key_info) &= ~NAN_SEC_NCSSK_DESC_KEY_INSTALL_MASK; \
+               (_key_info) |= (((_val) << NAN_SEC_NCSSK_DESC_KEY_INSTALL_SHIFT) & \
+               NAN_SEC_NCSSK_DESC_KEY_INSTALL_MASK);} while (0)
+#define NAN_SEC_NCSSK_DESC_KEY_ACK_GET(_key_info)      \
+       (((_key_info) & NAN_SEC_NCSSK_DESC_KEY_ACK_MASK) >> NAN_SEC_NCSSK_DESC_KEY_ACK_SHIFT)
+#define NAN_SEC_NCSSK_DESC_KEY_ACK_SET(_val, _key_info)        \
+       do {(_key_info) &= ~NAN_SEC_NCSSK_DESC_KEY_ACK_MASK; \
+               (_key_info) |= (((_val) << NAN_SEC_NCSSK_DESC_KEY_ACK_SHIFT) & \
+               NAN_SEC_NCSSK_DESC_KEY_ACK_MASK);} while (0)
+#define NAN_SEC_NCSSK_DESC_KEY_MIC_GET(_key_info)      \
+       (((_key_info) & NAN_SEC_NCSSK_DESC_KEY_MIC_MASK) >> NAN_SEC_NCSSK_DESC_KEY_MIC_SHIFT)
+#define NAN_SEC_NCSSK_DESC_KEY_MIC_SET(_val, _key_info)        \
+       do {(_key_info) &= ~NAN_SEC_NCSSK_DESC_KEY_MIC_MASK; \
+               (_key_info) |= (((_val) << NAN_SEC_NCSSK_DESC_KEY_MIC_SHIFT) & \
+               NAN_SEC_NCSSK_DESC_KEY_MIC_MASK);} while (0)
+#define NAN_SEC_NCSSK_DESC_KEY_SEC_GET(_key_info)      \
+       (((_key_info) & NAN_SEC_NCSSK_DESC_KEY_SEC_MASK) >> NAN_SEC_NCSSK_DESC_KEY_SEC_SHIFT)
+#define NAN_SEC_NCSSK_DESC_KEY_SEC_SET(_val, _key_info)        \
+       do {(_key_info) &= ~NAN_SEC_NCSSK_DESC_KEY_SEC_MASK; \
+               (_key_info) |= (((_val) << NAN_SEC_NCSSK_DESC_KEY_SEC_SHIFT) & \
+               NAN_SEC_NCSSK_DESC_KEY_SEC_MASK);} while (0)
+#define NAN_SEC_NCSSK_DESC_KEY_ERR_GET(_key_info)      \
+       (((_key_info) & NAN_SEC_NCSSK_DESC_KEY_ERR_MASK) >> NAN_SEC_NCSSK_DESC_KEY_ERR_SHIFT)
+#define NAN_SEC_NCSSK_DESC_KEY_ERR_SET(_val, _key_info)        \
+       do {(_key_info) &= ~NAN_SEC_NCSSK_DESC_KEY_ERR_MASK; \
+               (_key_info) |= (((_val) << NAN_SEC_NCSSK_DESC_KEY_ERR_SHIFT) & \
+               NAN_SEC_NCSSK_DESC_KEY_ERR_MASK);} while (0)
+#define NAN_SEC_NCSSK_DESC_KEY_REQ_GET(_key_info)      \
+       (((_key_info) & NAN_SEC_NCSSK_DESC_KEY_REQ_MASK) >> NAN_SEC_NCSSK_DESC_KEY_REQ_SHIFT)
+#define NAN_SEC_NCSSK_DESC_KEY_REQ_SET(_val, _key_info)        \
+       do {(_key_info) &= ~NAN_SEC_NCSSK_DESC_KEY_REQ_MASK; \
+               (_key_info) |= (((_val) << NAN_SEC_NCSSK_DESC_KEY_REQ_SHIFT) & \
+               NAN_SEC_NCSSK_DESC_KEY_REQ_MASK);} while (0)
+#define NAN_SEC_NCSSK_DESC_KEY_ENC_KEY_GET(_key_info)  \
+       (((_key_info) & NAN_SEC_NCSSK_DESC_KEY_ENC_KEY_MASK) >> \
+       NAN_SEC_NCSSK_DESC_KEY_ENC_KEY_SHIFT)
+#define NAN_SEC_NCSSK_DESC_KEY_ENC_KEY_SET(_val, _key_info)    \
+       do {(_key_info) &= ~NAN_SEC_NCSSK_DESC_KEY_ENC_KEY_MASK; \
+               (_key_info) |= (((_val) << NAN_SEC_NCSSK_DESC_KEY_ENC_KEY_SHIFT) & \
+               NAN_SEC_NCSSK_DESC_KEY_ENC_KEY_MASK);} while (0)
+#define NAN_SEC_NCSSK_DESC_KEY_SMK_MSG_GET(_key_info)  \
+       (((_key_info) & NAN_SEC_NCSSK_DESC_KEY_SMK_MSG_MASK) >> \
+       NAN_SEC_NCSSK_DESC_KEY_SMK_MSG_SHIFT)
+#define NAN_SEC_NCSSK_DESC_KEY_SMK_MSG_SET(_val, _key_info)    \
+       do {(_key_info) &= ~NAN_SEC_NCSSK_DESC_KEY_SMK_MSG_MASK; \
+               (_key_info) |= (((_val) << NAN_SEC_NCSSK_DESC_KEY_SMK_MSG_SHIFT) & \
+               NAN_SEC_NCSSK_DESC_KEY_SMK_MSG_MASK);} while (0)
+
+#define NAN_SEC_NCSSK_IEEE80211_KDESC_TYPE     2       /* IEEE 802.11 Key Descriptor Type */
+#define NAN_SEC_NCSSK_KEY_DESC_VER                     0       /* NCSSK-128/256 */
+#define NAN_SEC_NCSSK_KEY_TYPE_PAIRWISE                1       /* Pairwise */
+#define NAN_SEC_NCSSK_LIFETIME_KDE                     7       /* Lifetime KDE type */
+
+/* TODO include MTK related attributes */
+
+/* NAN Multicast service group(NMSG) definitions */
+/* Length of NMSG_ID -- (NDI * 2^16 + pub_id * 2^8 + Random_factor) */
+#define NAN_NMSG_ID_LEN                         8
+
+#define NAN_NMSG_TYPE_MASK                     0x0F
+#define NMSG_ATTR_TYPE_STATUS_REQUEST          0x00
+#define NMSG_ATTR_TYPE_STATUS_RESPONSE         0x01
+#define NMSG_ATTR_TYPE_STATUS_CONFIRM          0x02
+#define NMSG_ATTR_TYPE_STATUS_SEC_INSTALL      0x03
+#define NMSG_ATTR_TYPE_STATUS_TERMINATE                0x04
+#define NMSG_ATTR_TYPE_STATUS_IMPLICIT_ENROL   0x05
+
+#define NMSG_ATTR_TYPE_STATUS_CONTINUED                0x00
+#define NMSG_ATTR_TYPE_STATUS_ACCEPTED         0x10
+#define NMSG_ATTR_TYPE_STATUS_REJECTED         0x20
+
+#define NMSG_CTRL_PUB_ID_PRESENT                0x0001
+#define NMSG_CTRL_NMSG_ID_PRESENT               0x0002
+#define NMSG_CTRL_SECURITY_PRESENT              0x0004
+#define NMSG_CTRL_MANY_TO_MANY_PRESENT          0x0008
+#define NMSG_CTRL_SVC_INFO_PRESENT              0x0010
+
+/* NMSG attribute */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_nmsg_attr_s {
+       uint8 id; /* Attribute ID - 0x11 */
+       uint16 len; /* Length including pubid, NMSGID and svc info */
+       uint8 dialog_token;
+       uint8 type_status; /* Type and Status field byte */
+       uint8 reason_code;
+       uint8 mc_id; /* Multicast id similar to NDPID */
+       uint8 nmsg_ctrl; /* NMSG control field */
+       /* Optional publish id, NMSGID and svc info are included in var[] */
+       uint8 var[0];
+} BWL_POST_PACKED_STRUCT wifi_nan_nmsg_attr_t;
+
+#define NMSG_ATTR_MCAST_SCHED_MAP_ID_MASK     0x1E
+#define NMSG_ATTR_MCAST_SCHED_MAP_ID_SHIFT    1
+#define NMSG_ATTR_MCAST_SCHED_TIME_MAP_MASK   0x20
+#define NMSG_ATTR_MCAST_SCHED_TIME_MAP_SHIFT  5
+
+/* NAN Multicast Schedule atribute structure */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_mcast_sched_attr_s {
+       uint8 id; /* 0x16 */
+       uint16 len;
+       uint8 nmsg_id[NAN_NMSG_ID_LEN];
+       uint8 attr_cntrl;
+       uint8 sched_own[ETHER_ADDR_LEN];
+       uint8 var[]; /* multicast sched entry list (schedule_entry_list) */
+} BWL_POST_PACKED_STRUCT wifi_nan_mcast_sched_attr_t;
+
+/* FAC Channel Entry  (section 10.7.19.1.5) */
+typedef BWL_PRE_PACKED_STRUCT struct wifi_nan_fac_chan_entry_s {
+       uint8 oper_class;               /* Operating Class */
+       uint16 chan_bitmap;             /* Channel Bitmap */
+       uint8 primary_chan_bmp;         /* Primary Channel Bitmap */
+       uint16 aux_chan;                        /* Auxiliary Channel bitmap */
+} BWL_POST_PACKED_STRUCT wifi_nan_fac_chan_entry_t;
+
+/* TODO move this from nan.h */
+#define NAN_ALL_NAN_MGMT_FRAMES (NAN_FRM_SCHED_AF | \
+       NAN_FRM_NDP_AF | NAN_FRM_NDL_AF | \
+       NAN_FRM_DISC_BCN | NAN_FRM_SYNC_BCN | \
+       NAN_FRM_SVC_DISC | NAN_FRM_RNG_REQ_AF | \
+       NAN_FRM_RNG_RESP_AF | NAN_FRM_RNG_REPORT_AF | \
+       NAN_FRM_RNG_TERM_AF)
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _NAN_H_ */
diff --git a/bcmdhd.101.10.240.x/include/osl.h b/bcmdhd.101.10.240.x/include/osl.h
new file mode 100644 (file)
index 0000000..454a383
--- /dev/null
@@ -0,0 +1,406 @@
+/*
+ * OS Abstraction Layer
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _osl_h_
+#define _osl_h_
+
+#include <osl_decl.h>
+
+enum {
+       TAIL_BYTES_TYPE_FCS = 1,
+       TAIL_BYTES_TYPE_ICV = 2,
+       TAIL_BYTES_TYPE_MIC = 3
+};
+
+#if defined(MACOSX)
+#define OSL_PKTTAG_SZ  56
+#elif defined(__linux__)
+#define OSL_PKTTAG_SZ   48 /* standard linux pkttag size is 48 bytes */
+#else
+#ifndef OSL_PKTTAG_SZ
+#define OSL_PKTTAG_SZ  32 /* Size of PktTag */
+#endif /* !OSL_PKTTAG_SZ */
+#endif
+
+/* Drivers use PKTFREESETCB to register a callback function when a packet is freed by OSL */
+typedef void (*pktfree_cb_fn_t)(void *ctx, void *pkt, unsigned int status);
+
+/* Drivers use REGOPSSET() to register register read/write funcitons */
+typedef unsigned int (*osl_rreg_fn_t)(void *ctx, volatile void *reg, unsigned int size);
+typedef void  (*osl_wreg_fn_t)(void *ctx, volatile void *reg, unsigned int val, unsigned int size);
+
+#if defined(WL_UNITTEST)
+#include <utest_osl.h>
+#elif defined(__linux__)
+#include <linux_osl.h>
+#include <linux_pkt.h>
+#elif defined(MACOSX)
+#include <macosx_osl.h>
+#else
+#error "Unsupported OSL requested"
+#endif
+
+#ifndef PKTDBG_TRACE
+#define PKTDBG_TRACE(osh, pkt, bit)    BCM_REFERENCE(osh)
+#endif
+
+#ifndef BCM_UPTIME_PROFILE
+#define OSL_GETCYCLES_PROF(x)
+#endif
+
+/* --------------------------------------------------------------------------
+** Register manipulation macros.
+*/
+
+#define        SET_REG(osh, r, mask, val)      W_REG((osh), (r), ((R_REG((osh), r) & ~(mask)) | (val)))
+
+#ifndef AND_REG
+#define AND_REG(osh, r, v)             W_REG(osh, (r), R_REG(osh, r) & (v))
+#endif   /* !AND_REG */
+
+#ifndef OR_REG
+#define OR_REG(osh, r, v)              W_REG(osh, (r), R_REG(osh, r) | (v))
+#endif   /* !OR_REG */
+
+#if !defined(OSL_SYSUPTIME)
+#define OSL_SYSUPTIME() (0)
+#define OSL_SYSUPTIME_NOT_DEFINED 1
+#endif /* !defined(OSL_SYSUPTIME) */
+
+#if !defined(OSL_SYSUPTIME_US)
+#define OSL_SYSUPTIME_US() (0)
+#define OSL_SYSUPTIME_US_NOT_DEFINED 1
+#endif /* !defined(OSL_SYSUPTIME) */
+
+#if defined(OSL_SYSUPTIME_NOT_DEFINED) && defined(OSL_SYSUPTIME_US_NOT_DEFINED)
+#define OSL_SYSUPTIME_SUPPORT FALSE
+#else
+#define OSL_SYSUPTIME_SUPPORT TRUE
+#endif /* OSL_SYSUPTIME */
+
+#ifndef OSL_GET_LOCALTIME
+#define OSL_GET_LOCALTIME(sec, usec)   \
+       do { \
+               BCM_REFERENCE(sec); \
+               BCM_REFERENCE(usec); \
+       } while (0)
+#endif /* OSL_GET_LOCALTIME */
+
+#ifndef OSL_LOCALTIME_NS
+#define OSL_LOCALTIME_NS()     (OSL_SYSUPTIME_US() * NSEC_PER_USEC)
+#endif /* OSL_LOCALTIME_NS */
+
+#ifndef OSL_SYSTZTIME_US
+#define OSL_SYSTZTIME_US()     OSL_SYSUPTIME_US()
+#endif /* OSL_GET_SYSTZTIME */
+
+#if !defined(OSL_CPU_COUNTS_PER_US)
+#define OSL_CPU_COUNTS_PER_US() (0)
+#define OSL_CPU_COUNTS_PER_US_NOT_DEFINED 1
+#endif /* !defined(OSL_CPU_COUNTS_PER_US) */
+
+#ifndef OSL_SYS_HALT
+#define OSL_SYS_HALT() do {} while (0)
+#endif
+
+#ifndef DMB
+#define DMB()  do {} while (0)
+#endif /* DMB */
+
+#ifndef OSL_MEM_AVAIL
+#define OSL_MEM_AVAIL()        (0xffffffff)
+#endif
+
+#ifndef OSL_OBFUSCATE_BUF
+#define OSL_OBFUSCATE_BUF(x) (x)
+#endif /* OSL_OBFUSCATE_BUF */
+
+#ifndef OSL_GET_HCAPISTIMESYNC
+#define OSL_GET_HCAPISTIMESYNC()
+#endif /*  OSL_GET_HCAPISTIMESYNC */
+
+#ifndef OSL_GET_HCAPISPKTTXS
+#define OSL_GET_HCAPISPKTTXS()
+#endif /*  OSL_GET_HCAPISPKTTXS */
+
+#if !defined(PKTC_DONGLE)
+
+#define        PKTCGETATTR(skb)        (0)
+#define        PKTCSETATTR(skb, f, p, b) BCM_REFERENCE(skb)
+#define        PKTCCLRATTR(skb)        BCM_REFERENCE(skb)
+#define        PKTCCNT(skb)            (1)
+#define        PKTCLEN(skb)            PKTLEN(NULL, skb)
+#define        PKTCGETFLAGS(skb)       (0)
+#define        PKTCSETFLAGS(skb, f)    BCM_REFERENCE(skb)
+#define        PKTCCLRFLAGS(skb)       BCM_REFERENCE(skb)
+#define        PKTCFLAGS(skb)          (0)
+#define        PKTCSETCNT(skb, c)      BCM_REFERENCE(skb)
+#define        PKTCINCRCNT(skb)        BCM_REFERENCE(skb)
+#define        PKTCADDCNT(skb, c)      BCM_REFERENCE(skb)
+#define        PKTCSETLEN(skb, l)      BCM_REFERENCE(skb)
+#define        PKTCADDLEN(skb, l)      BCM_REFERENCE(skb)
+#define        PKTCSETFLAG(skb, fb)    BCM_REFERENCE(skb)
+#define        PKTCCLRFLAG(skb, fb)    BCM_REFERENCE(skb)
+#define        PKTCLINK(skb)           NULL
+#define        PKTSETCLINK(skb, x)     BCM_REFERENCE(skb)
+#define FOREACH_CHAINED_PKT(skb, nskb) \
+       for ((nskb) = NULL; (skb) != NULL; (skb) = (nskb))
+#define        PKTCFREE                PKTFREE
+#define PKTCENQTAIL(h, t, p) \
+do { \
+       if ((t) == NULL) { \
+               (h) = (t) = (p); \
+       } \
+} while (0)
+#endif
+
+#ifndef PKTSETCHAINED
+#define PKTSETCHAINED(osh, skb)                BCM_REFERENCE(osh)
+#endif
+#ifndef PKTCLRCHAINED
+#define PKTCLRCHAINED(osh, skb)                BCM_REFERENCE(osh)
+#endif
+#ifndef PKTISCHAINED
+#define PKTISCHAINED(skb)              FALSE
+#endif
+
+#ifndef PKTGETPROFILEIDX
+#define PKTGETPROFILEIDX(p)            (-1)
+#endif
+
+#ifndef PKTCLRPROFILEIDX
+#define PKTCLRPROFILEIDX(p)
+#endif
+
+#ifndef PKTSETPROFILEIDX
+#define PKTSETPROFILEIDX(p, idx)       BCM_REFERENCE(idx)
+#endif
+
+/* Lbuf with fraglist */
+#ifndef PKTFRAGPKTID
+#define PKTFRAGPKTID(osh, lb)          (0)
+#endif
+#ifndef PKTSETFRAGPKTID
+#define PKTSETFRAGPKTID(osh, lb, id)   BCM_REFERENCE(osh)
+#endif
+#ifndef PKTFRAGTOTNUM
+#define PKTFRAGTOTNUM(osh, lb)         (0)
+#endif
+#ifndef PKTSETFRAGTOTNUM
+#define PKTSETFRAGTOTNUM(osh, lb, tot) BCM_REFERENCE(osh)
+#endif
+#ifndef PKTFRAGTOTLEN
+#define PKTFRAGTOTLEN(osh, lb)         (0)
+#endif
+#ifndef PKTSETFRAGTOTLEN
+#define PKTSETFRAGTOTLEN(osh, lb, len) BCM_REFERENCE(osh)
+#endif
+#ifndef PKTIFINDEX
+#define PKTIFINDEX(osh, lb)            (0)
+#endif
+#ifndef PKTSETIFINDEX
+#define PKTSETIFINDEX(osh, lb, idx)    BCM_REFERENCE(osh)
+#endif
+#ifndef PKTGETLF
+#define        PKTGETLF(osh, len, send, lbuf_type)     (0)
+#endif
+
+/* in rx path, reuse totlen as used len */
+#ifndef PKTFRAGUSEDLEN
+#define PKTFRAGUSEDLEN(osh, lb)                        (0)
+#endif
+#ifndef PKTSETFRAGUSEDLEN
+#define PKTSETFRAGUSEDLEN(osh, lb, len)                BCM_REFERENCE(osh)
+#endif
+#ifndef PKTFRAGLEN
+#define PKTFRAGLEN(osh, lb, ix)                        (0)
+#endif
+#ifndef PKTSETFRAGLEN
+#define PKTSETFRAGLEN(osh, lb, ix, len)                BCM_REFERENCE(osh)
+#endif
+#ifndef PKTFRAGDATA_LO
+#define PKTFRAGDATA_LO(osh, lb, ix)            (0)
+#endif
+#ifndef PKTSETFRAGDATA_LO
+#define PKTSETFRAGDATA_LO(osh, lb, ix, addr)   BCM_REFERENCE(osh)
+#endif
+#ifndef PKTFRAGDATA_HI
+#define PKTFRAGDATA_HI(osh, lb, ix)            (0)
+#endif
+#ifndef PKTSETFRAGDATA_HI
+#define PKTSETFRAGDATA_HI(osh, lb, ix, addr)   BCM_REFERENCE(osh)
+#endif
+
+#ifndef PKTFRAGMOVE
+#define PKTFRAGMOVE(osh, dst, src) (BCM_REFERENCE(osh), BCM_REFERENCE(dst), BCM_REFERENCE(src))
+#endif
+
+/* RX FRAG */
+#ifndef PKTISRXFRAG
+#define PKTISRXFRAG(osh, lb)           (0)
+#endif
+#ifndef PKTSETRXFRAG
+#define PKTSETRXFRAG(osh, lb)          BCM_REFERENCE(osh)
+#endif
+#ifndef PKTRESETRXFRAG
+#define PKTRESETRXFRAG(osh, lb)                BCM_REFERENCE(osh)
+#endif
+
+/* TX FRAG */
+#ifndef PKTISTXFRAG
+#define PKTISTXFRAG(osh, lb)           (0)
+#endif
+#ifndef PKTSETTXFRAG
+#define PKTSETTXFRAG(osh, lb)          BCM_REFERENCE(osh)
+#endif
+
+/* Need Rx completion used for AMPDU reordering */
+#ifndef PKTNEEDRXCPL
+#define PKTNEEDRXCPL(osh, lb)           (TRUE)
+#endif
+#ifndef PKTSETNORXCPL
+#define PKTSETNORXCPL(osh, lb)          BCM_REFERENCE(osh)
+#endif
+#ifndef PKTRESETNORXCPL
+#define PKTRESETNORXCPL(osh, lb)        BCM_REFERENCE(osh)
+#endif
+#ifndef PKTISFRAG
+#define PKTISFRAG(osh, lb)             (0)
+#endif
+#ifndef PKTFRAGISCHAINED
+#define PKTFRAGISCHAINED(osh, i)       (0)
+#endif
+#ifndef PKTISHDRCONVTD
+#define PKTISHDRCONVTD(osh, lb)                (0)
+#endif
+
+/* Forwarded pkt indication */
+#ifndef PKTISFRWDPKT
+#define PKTISFRWDPKT(osh, lb)          0
+#endif
+#ifndef PKTSETFRWDPKT
+#define PKTSETFRWDPKT(osh, lb)         BCM_REFERENCE(osh)
+#endif
+#ifndef PKTRESETFRWDPKT
+#define PKTRESETFRWDPKT(osh, lb)       BCM_REFERENCE(osh)
+#endif
+
+/* PKT consumed for totlen calculation */
+#ifndef PKTISUSEDTOTLEN
+#define PKTISUSEDTOTLEN(osh, lb)               0
+#endif
+#ifndef PKTSETUSEDTOTLEN
+#define PKTSETUSEDTOTLEN(osh, lb)              BCM_REFERENCE(osh)
+#endif
+#ifndef PKTRESETUSEDTOTLEN
+#define PKTRESETUSEDTOTLEN(osh, lb)             BCM_REFERENCE(osh)
+#endif
+
+/* UDR Packet Indication */
+#ifndef PKTISUDR
+#define PKTISUDR(osh, lb)                      0
+#endif
+
+#ifndef PKTSETUDR
+#define PKTSETUDR(osh, lb)                     BCM_REFERENCE(osh)
+#endif
+
+#ifndef PKTSETUDR
+#define PKTRESETUDR(osh, lb)                   BCM_REFERENCE(osh)
+#endif
+
+#if !defined(__linux__)
+#define PKTLIST_INIT(x)                        BCM_REFERENCE(x)
+#define PKTLIST_ENQ(x, y)              BCM_REFERENCE(x)
+#define PKTLIST_DEQ(x)                 BCM_REFERENCE(x)
+#define PKTLIST_UNLINK(x, y)           BCM_REFERENCE(x)
+#define PKTLIST_FINI(x)                        BCM_REFERENCE(x)
+#endif
+
+#ifndef ROMMABLE_ASSERT
+#define ROMMABLE_ASSERT(exp) ASSERT(exp)
+#endif /* ROMMABLE_ASSERT */
+
+#ifndef MALLOC_NOPERSIST
+       #define MALLOC_NOPERSIST MALLOC
+#endif /* !MALLOC_NOPERSIST */
+
+#ifndef MALLOC_PERSIST
+       #define MALLOC_PERSIST MALLOC
+#endif /* !MALLOC_PERSIST */
+
+#ifndef MALLOC_NOPERSIST
+       #define MALLOC_NOPERSIST MALLOC
+#endif /* !MALLOC_NOPERSIST */
+
+#ifndef MALLOC_PERSIST_ATTACH
+       #define MALLOC_PERSIST_ATTACH MALLOC
+#endif /* !MALLOC_PERSIST_ATTACH */
+
+#ifndef MALLOCZ_PERSIST_ATTACH
+       #define MALLOCZ_PERSIST_ATTACH MALLOCZ
+#endif /* !MALLOCZ_PERSIST_ATTACH */
+
+#ifndef MALLOCZ_NOPERSIST
+       #define MALLOCZ_NOPERSIST MALLOCZ
+#endif /* !MALLOCZ_NOPERSIST */
+
+#ifndef MALLOCZ_PERSIST
+       #define MALLOCZ_PERSIST MALLOCZ
+#endif /* !MALLOCZ_PERSIST */
+
+#ifndef MFREE_PERSIST
+       #define MFREE_PERSIST MFREE
+#endif /* !MFREE_PERSIST */
+
+#ifndef MALLOC_SET_NOPERSIST
+       #define MALLOC_SET_NOPERSIST(osh)       do { } while (0)
+#endif /* !MALLOC_SET_NOPERSIST */
+
+#ifndef MALLOC_CLEAR_NOPERSIST
+       #define MALLOC_CLEAR_NOPERSIST(osh)     do { } while (0)
+#endif /* !MALLOC_CLEAR_NOPERSIST */
+
+#if defined(OSL_MEMCHECK)
+#define MEMCHECK(f, l) osl_memcheck(f, l)
+#else
+#define MEMCHECK(f, l)
+#endif /* OSL_MEMCHECK */
+
+#ifndef BCMDBGPERF
+#define PERF_TRACE_START(id)                   do {} while (0)
+#define PERF_TRACE_END(id)                     do {} while (0)
+#define PERF_TRACE_END2(id, mycounters)                do {} while (0)
+#define UPDATE_PERF_TRACE_COUNTER(counter, val)        do {} while (0)
+#endif /* OSL_MEMCHECK */
+
+/* Virtual/physical address translation. */
+#if !defined(OSL_VIRT_TO_PHYS_ADDR)
+       #define OSL_VIRT_TO_PHYS_ADDR(va)       ((void*)(uintptr)(va))
+#endif
+
+#if !defined(OSL_PHYS_TO_VIRT_ADDR)
+       #define OSL_PHYS_TO_VIRT_ADDR(pa)       ((void*)(uintptr)(pa))
+#endif
+
+#endif /* _osl_h_ */
diff --git a/bcmdhd.101.10.240.x/include/osl_decl.h b/bcmdhd.101.10.240.x/include/osl_decl.h
new file mode 100644 (file)
index 0000000..a86805a
--- /dev/null
@@ -0,0 +1,31 @@
+/*
+ * osl forward declarations
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _osl_decl_h_
+#define _osl_decl_h_
+
+/* osl handle type forward declaration */
+typedef struct osl_info osl_t;
+typedef struct osl_dmainfo osldma_t;
+extern unsigned int lmtest; /* low memory test */
+#endif
diff --git a/bcmdhd.101.10.240.x/include/osl_ext.h b/bcmdhd.101.10.240.x/include/osl_ext.h
new file mode 100644 (file)
index 0000000..460bc3a
--- /dev/null
@@ -0,0 +1,759 @@
+/*
+ * OS Abstraction Layer Extension - the APIs defined by the "extension" API
+ * are only supported by a subset of all operating systems.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _osl_ext_h_
+#define _osl_ext_h_
+
+/* ---- Include Files ---------------------------------------------------- */
+
+#if defined(THREADX)
+       #include <threadx_osl_ext.h>
+#else
+       #define OSL_EXT_DISABLED
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* ---- Constants and Types ---------------------------------------------- */
+
+/* -----------------------------------------------------------------------
+ * Generic OS types.
+ */
+typedef enum osl_ext_status_t
+{
+       OSL_EXT_SUCCESS,
+       OSL_EXT_ERROR,
+       OSL_EXT_TIMEOUT
+
+} osl_ext_status_t;
+
+#define OSL_EXT_STATUS_DECL(status)    osl_ext_status_t status;
+
+#define OSL_EXT_TIME_FOREVER ((osl_ext_time_ms_t)(-1))
+
+typedef unsigned int osl_ext_time_ms_t;
+typedef unsigned int osl_ext_time_us_t;
+
+typedef unsigned int osl_ext_event_bits_t;
+
+typedef unsigned int osl_ext_interrupt_state_t;
+
+/* -----------------------------------------------------------------------
+ * Timers.
+ */
+typedef enum
+{
+       /* One-shot timer. */
+       OSL_EXT_TIMER_MODE_ONCE,
+
+       /* Periodic timer. */
+       OSL_EXT_TIMER_MODE_REPEAT
+
+} osl_ext_timer_mode_t;
+
+/* User registered callback and parameter to invoke when timer expires. */
+typedef void* osl_ext_timer_arg_t;
+typedef void (*osl_ext_timer_callback)(osl_ext_timer_arg_t arg);
+
+/* -----------------------------------------------------------------------
+ * Tasks.
+ */
+
+/* Task entry argument. */
+typedef void* osl_ext_task_arg_t;
+
+/* Task entry function. */
+typedef void (*osl_ext_task_entry)(osl_ext_task_arg_t arg);
+
+/* Abstract task priority levels. */
+typedef enum
+{
+       OSL_EXT_TASK_IDLE_PRIORITY,
+       OSL_EXT_TASK_CPUUTIL_PRIORITY,
+       OSL_EXT_TASK_LOW_PRIORITY,
+       OSL_EXT_TASK_LOW_NORMAL_PRIORITY,
+       OSL_EXT_TASK_NORMAL_PRIORITY,
+       OSL_EXT_TASK_HIGH_NORMAL_PRIORITY,
+       OSL_EXT_TASK_HIGHEST_PRIORITY,
+       OSL_EXT_TASK_TIME_CRITICAL_PRIORITY,
+
+       /* This must be last. */
+       OSL_EXT_TASK_NUM_PRIORITES
+} osl_ext_task_priority_t;
+
+#ifndef OSL_EXT_DISABLED
+
+/* ---- Variable Externs ------------------------------------------------- */
+/* ---- Function Prototypes ---------------------------------------------- */
+
+/* --------------------------------------------------------------------------
+** Semaphore
+*/
+
+/****************************************************************************
+* Function:   osl_ext_sem_create
+*
+* Purpose:    Creates a counting semaphore object, which can subsequently be
+*             used for thread notification.
+*
+* Parameters: name     (in)  Name to assign to the semaphore (must be unique).
+*             init_cnt (in)  Initial count that the semaphore should have.
+*             sem      (out) Newly created semaphore.
+*
+* Returns:    OSL_EXT_SUCCESS if the semaphore was created successfully, or an
+*             error code if the semaphore could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_sem_create(char *name, int init_cnt, osl_ext_sem_t *sem);
+
+/****************************************************************************
+* Function:   osl_ext_sem_delete
+*
+* Purpose:    Destroys a previously created semaphore object.
+*
+* Parameters: sem (mod) Semaphore object to destroy.
+*
+* Returns:    OSL_EXT_SUCCESS if the semaphore was deleted successfully, or an
+*             error code if the semaphore could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_sem_delete(osl_ext_sem_t *sem);
+
+/****************************************************************************
+* Function:   osl_ext_sem_give
+*
+* Purpose:    Increments the count associated with the semaphore. This will
+*             cause one thread blocked on a take to wake up.
+*
+* Parameters: sem (mod) Semaphore object to give.
+*
+* Returns:    OSL_EXT_SUCCESS if the semaphore was given successfully, or an
+*             error code if the semaphore could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_sem_give(osl_ext_sem_t *sem);
+
+/****************************************************************************
+* Function:   osl_ext_sem_take
+*
+* Purpose:    Decrements the count associated with the semaphore. If the count
+*             is less than zero, then the calling task will become blocked until
+*             another thread does a give on the semaphore. This function will only
+*             block the calling thread for timeout_msec milliseconds, before
+*             returning with OSL_EXT_TIMEOUT.
+*
+* Parameters: sem          (mod) Semaphore object to take.
+*             timeout_msec (in)  Number of milliseconds to wait for the
+*                                semaphore to enter a state where it can be
+*                                taken.
+*
+* Returns:    OSL_EXT_SUCCESS if the semaphore was taken successfully, or an
+*             error code if the semaphore could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_sem_take(osl_ext_sem_t *sem, osl_ext_time_ms_t timeout_msec);
+
+/* --------------------------------------------------------------------------
+** Mutex
+*/
+
+/****************************************************************************
+* Function:   osl_ext_mutex_create
+*
+* Purpose:    Creates a mutex object, which can subsequently be used to control
+*             mutually exclusion of resources.
+*
+* Parameters: name  (in)  Name to assign to the mutex (must be unique).
+*             mutex (out) Mutex object to initialize.
+*
+* Returns:    OSL_EXT_SUCCESS if the mutex was created successfully, or an
+*             error code if the mutex could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_mutex_create(char *name, osl_ext_mutex_t *mutex);
+
+/****************************************************************************
+* Function:   osl_ext_mutex_delete
+*
+* Purpose:    Destroys a previously created mutex object.
+*
+* Parameters: mutex (mod) Mutex object to destroy.
+*
+* Returns:    OSL_EXT_SUCCESS if the mutex was deleted successfully, or an
+*             error code if the mutex could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_mutex_delete(osl_ext_mutex_t *mutex);
+
+/****************************************************************************
+* Function:   osl_ext_mutex_acquire
+*
+* Purpose:    Acquires the indicated mutual exclusion object. If the object is
+*             currently acquired by another task, then this function will wait
+*             for timeout_msec milli-seconds before returning with OSL_EXT_TIMEOUT.
+*
+* Parameters: mutex        (mod) Mutex object to acquire.
+*             timeout_msec (in)  Number of milliseconds to wait for the mutex.
+*
+* Returns:    OSL_EXT_SUCCESS if the mutex was acquired successfully, or an
+*             error code if the mutex could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_mutex_acquire(osl_ext_mutex_t *mutex, osl_ext_time_ms_t timeout_msec);
+
+/****************************************************************************
+* Function:   osl_ext_mutex_release
+*
+* Purpose:    Releases the indicated mutual exclusion object. This makes it
+*             available for another task to acquire.
+*
+* Parameters: mutex (mod) Mutex object to release.
+*
+* Returns:    OSL_EXT_SUCCESS if the mutex was released successfully, or an
+*             error code if the mutex could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_mutex_release(osl_ext_mutex_t *mutex);
+
+/* --------------------------------------------------------------------------
+** Timers
+*/
+
+/****************************************************************************
+* Function:   osl_ext_timer_create
+*
+* Purpose:    Creates a timer object.
+*
+* Parameters: name (in)         Name of timer.
+*             timeout_msec (in) Invoke callback after this number of milliseconds.
+*             mode (in)         One-shot or periodic timer.
+*             func (in)         Callback function to invoke on timer expiry.
+*             arg (in)          Argument to callback function.
+*             timer (out)       Timer object to create.
+*
+* Note: The function callback occurs in interrupt context. The application is
+*       required to provide context switch for the callback if required.
+*
+* Returns:    OSL_EXT_SUCCESS if the timer was created successfully, or an
+*             error code if the timer could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t
+osl_ext_timer_create(char *name, osl_ext_time_ms_t timeout_msec, osl_ext_timer_mode_t mode,
+                 osl_ext_timer_callback func, osl_ext_timer_arg_t arg, osl_ext_timer_t *timer);
+
+/****************************************************************************
+* Function:   osl_ext_timer_delete
+*
+* Purpose:    Destroys a previously created timer object.
+*
+* Parameters: timer (mod) Timer object to destroy.
+*
+* Returns:    OSL_EXT_SUCCESS if the timer was created successfully, or an
+*             error code if the timer could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_timer_delete(osl_ext_timer_t *timer);
+
+/****************************************************************************
+* Function:   osl_ext_timer_start
+*
+* Purpose:    Start a previously created timer object.
+*
+* Parameters: timer (in)        Timer object.
+*             timeout_msec (in) Invoke callback after this number of milliseconds.
+*             mode (in)         One-shot or periodic timer.
+*
+* Returns:    OSL_EXT_SUCCESS if the timer was created successfully, or an
+*             error code if the timer could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t
+osl_ext_timer_start(osl_ext_timer_t *timer,
+       osl_ext_time_ms_t timeout_msec, osl_ext_timer_mode_t mode);
+
+/****************************************************************************
+* Function:   osl_ext_timer_start
+*
+* Purpose:    Start a previously created timer object.
+*
+* Parameters: timer (in)        Timer object.
+*             timeout_usec (in) Invoke callback after this number of micro-seconds.
+*             mode (in)         One-shot or periodic timer.
+*
+* Returns:    OSL_EXT_SUCCESS if the timer was created successfully, or an
+*             error code if the timer could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t
+osl_ext_timer_start_us(osl_ext_timer_t *timer,
+       osl_ext_time_us_t timeout_usec, osl_ext_timer_mode_t mode);
+
+/****************************************************************************
+* Function:   osl_ext_timer_stop
+*
+* Purpose:    Stop a previously created timer object.
+*
+* Parameters: timer (in)        Timer object.
+*
+* Returns:    OSL_EXT_SUCCESS if the timer was created successfully, or an
+*             error code if the timer could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t
+osl_ext_timer_stop(osl_ext_timer_t *timer);
+
+/****************************************************************************
+* Function:   osl_ext_time_get
+*
+* Purpose:    Returns incrementing time counter.
+*
+* Parameters: None.
+*
+* Returns:    Returns incrementing time counter in msec.
+*****************************************************************************
+*/
+osl_ext_time_ms_t osl_ext_time_get(void);
+
+/* --------------------------------------------------------------------------
+** Tasks
+*/
+
+/****************************************************************************
+* Function:   osl_ext_task_create
+*
+* Purpose:    Create a task.
+*
+* Parameters: name       (in)  Pointer to task string descriptor.
+*             stack      (in)  Pointer to stack. NULL to allocate.
+*             stack_size (in)  Stack size - in bytes.
+*             priority   (in)  Abstract task priority.
+*             func       (in)  A pointer to the task entry point function.
+*             arg        (in)  Value passed into task entry point function.
+*             task       (out) Task to create.
+*
+* Returns:    OSL_EXT_SUCCESS if the task was created successfully, or an
+*             error code if the task could not be created.
+*****************************************************************************
+*/
+
+#define osl_ext_task_create(name, stack, stack_size, priority, func, arg, task) \
+          osl_ext_task_create_ex((name), (stack), (stack_size), (priority), 0, (func), \
+          (arg), TRUE, (task))
+
+/****************************************************************************
+* Function:   osl_ext_task_create_ex
+*
+* Purpose:    Create a task with autostart option.
+*
+* Parameters: name       (in)  Pointer to task string descriptor.
+*             stack      (in)  Pointer to stack. NULL to allocate.
+*             stack_size (in)  Stack size - in bytes.
+*             priority   (in)  Abstract task priority.
+*             func       (in)  A pointer to the task entry point function.
+*             arg        (in)  Value passed into task entry point function.
+*             autostart  (in)  TRUE to start task after creation.
+*             task       (out) Task to create.
+*
+* Returns:    OSL_EXT_SUCCESS if the task was created successfully, or an
+*             error code if the task could not be created.
+*****************************************************************************
+*/
+
+osl_ext_status_t osl_ext_task_create_ex(char* name,
+       void *stack, unsigned int stack_size, osl_ext_task_priority_t priority,
+       osl_ext_time_ms_t timslice_msec, osl_ext_task_entry func, osl_ext_task_arg_t arg,
+       bool autostart, osl_ext_task_t *task);
+
+/****************************************************************************
+* Function:   osl_ext_task_change_priority
+*
+* Purpose:    Change priority of a task.
+*
+* Parameters: task
+*             new_priority   (in)  New task priority.
+*             old_priority   (out) Old task priroty.
+*
+* Returns:    OSL_EXT_SUCCESS if the task was created successfully, or an
+*             error code if the priority could not be changed..
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_task_change_priority(osl_ext_task_t *task,
+       osl_ext_task_priority_t new_priority, osl_ext_task_priority_t *old_priority);
+
+/****************************************************************************
+* Function:   osl_ext_task_delete
+*
+* Purpose:    Destroy a task.
+*
+* Parameters: task (mod) Task to destroy.
+*
+* Returns:    OSL_EXT_SUCCESS if the task was created successfully, or an
+*             error code if the task could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_task_delete(osl_ext_task_t *task);
+
+/****************************************************************************
+* Function:   osl_ext_task_is_running
+*
+* Purpose:    Returns current running task.
+*
+* Parameters: None.
+*
+* Returns:    osl_ext_task_t of current running task.
+*****************************************************************************
+*/
+osl_ext_task_t *osl_ext_task_current(void);
+
+/****************************************************************************
+* Function:   osl_ext_task_yield
+*
+* Purpose:    Yield the CPU to other tasks of the same priority that are
+*             ready-to-run.
+*
+* Parameters: None.
+*
+* Returns:    OSL_EXT_SUCCESS if successful, else error code.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_task_yield(void);
+
+/****************************************************************************
+* Function:   osl_ext_task_suspend
+*
+* Purpose:    Suspend a task.
+*
+* Parameters: task (mod) Task to suspend.
+*
+* Returns:    OSL_EXT_SUCCESS if the task was suspended successfully, or an
+*             error code if the task could not be suspended.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_task_suspend(osl_ext_task_t *task);
+
+/****************************************************************************
+* Function:   osl_ext_task_resume
+*
+* Purpose:    Resume a task.
+*
+* Parameters: task (mod) Task to resume.
+*
+* Returns:    OSL_EXT_SUCCESS if the task was resumed successfully, or an
+*             error code if the task could not be resumed.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_task_resume(osl_ext_task_t *task);
+
+/****************************************************************************
+* Function:   osl_ext_task_enable_stack_check
+*
+* Purpose:    Enable task stack checking.
+*
+* Parameters: None.
+*
+* Returns:    OSL_EXT_SUCCESS if successful, else error code.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_task_enable_stack_check(void);
+
+/* --------------------------------------------------------------------------
+** Queue
+*/
+
+/****************************************************************************
+* Function:   osl_ext_queue_create
+*
+* Purpose:    Create a queue.
+*
+* Parameters: name     (in)  Name to assign to the queue (must be unique).
+*             buffer   (in)  Queue buffer. NULL to allocate.
+*             size     (in)  Size of the queue.
+*             queue    (out) Newly created queue.
+*
+* Returns:    OSL_EXT_SUCCESS if the queue was created successfully, or an
+*             error code if the queue could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_queue_create(char *name,
+       void *queue_buffer, unsigned int queue_size,
+       osl_ext_queue_t *queue);
+
+/****************************************************************************
+* Function:   osl_ext_queue_delete
+*
+* Purpose:    Destroys a previously created queue object.
+*
+* Parameters: queue    (mod) Queue object to destroy.
+*
+* Returns:    OSL_EXT_SUCCESS if the queue was deleted successfully, or an
+*             error code if the queue could not be deleteed.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_queue_delete(osl_ext_queue_t *queue);
+
+/****************************************************************************
+* Function:   osl_ext_queue_send
+*
+* Purpose:    Send/add data to the queue. This function will not block the
+*             calling thread if the queue is full.
+*
+* Parameters: queue    (mod) Queue object.
+*             data     (in)  Data pointer to be queued.
+*
+* Returns:    OSL_EXT_SUCCESS if the data was queued successfully, or an
+*             error code if the data could not be queued.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_queue_send(osl_ext_queue_t *queue, void *data);
+
+/****************************************************************************
+* Function:   osl_ext_queue_send_synchronous
+*
+* Purpose:    Send/add data to the queue. This function will block the
+*             calling thread until the data is dequeued.
+*
+* Parameters: queue    (mod) Queue object.
+*             data     (in)  Data pointer to be queued.
+*
+* Returns:    OSL_EXT_SUCCESS if the data was queued successfully, or an
+*             error code if the data could not be queued.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_queue_send_synchronous(osl_ext_queue_t *queue, void *data);
+
+/****************************************************************************
+* Function:   osl_ext_queue_receive
+*
+* Purpose:    Receive/remove data from the queue. This function will only
+*             block the calling thread for timeout_msec milliseconds, before
+*             returning with OSL_EXT_TIMEOUT.
+*
+* Parameters: queue        (mod) Queue object.
+*             timeout_msec (in)  Number of milliseconds to wait for the
+*                                data from the queue.
+*             data         (out) Data pointer received/removed from the queue.
+*
+* Returns:    OSL_EXT_SUCCESS if the data was dequeued successfully, or an
+*             error code if the data could not be dequeued.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_queue_receive(osl_ext_queue_t *queue,
+                 osl_ext_time_ms_t timeout_msec, void **data);
+
+/****************************************************************************
+* Function:   osl_ext_queue_count
+*
+* Purpose:    Returns the number of items in the queue.
+*
+* Parameters: queue        (mod) Queue object.
+*             count        (out) Data pointer received/removed from the queue.
+*
+* Returns:    OSL_EXT_SUCCESS if the count was returned successfully, or an
+*             error code if the count is invalid.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_queue_count(osl_ext_queue_t *queue, int *count);
+
+/* --------------------------------------------------------------------------
+** Event
+*/
+
+/****************************************************************************
+* Function:   osl_ext_event_create
+*
+* Purpose:    Creates a event object, which can subsequently be used to
+*             notify and trigger tasks.
+*
+* Parameters: name  (in)  Name to assign to the event (must be unique).
+*             event (out) Event object to initialize.
+*
+* Returns:    OSL_EXT_SUCCESS if the event was created successfully, or an
+*             error code if the event could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_event_create(char *name, osl_ext_event_t *event);
+
+/****************************************************************************
+* Function:   osl_ext_event_delete
+*
+* Purpose:    Destroys a previously created event object.
+*
+* Parameters: event (mod) Event object to destroy.
+*
+* Returns:    OSL_EXT_SUCCESS if the event was created successfully, or an
+*             error code if the event could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_event_delete(osl_ext_event_t *event);
+
+/****************************************************************************
+* Function:   osl_ext_event_get
+*
+* Purpose:    Get event from specified event object.
+*
+* Parameters: event        (mod) Event object to get.
+*             requested    (in)  Requested event to get.
+*             timeout_msec (in)  Number of milliseconds to wait for the event.
+*             event_bits   (out) Event bits retrieved.
+*
+* Returns:    OSL_EXT_SUCCESS if the event was created successfully, or an
+*             error code if the event could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_event_get(osl_ext_event_t *event,
+       osl_ext_event_bits_t requested, osl_ext_time_ms_t timeout_msec,
+       osl_ext_event_bits_t *event_bits);
+
+/****************************************************************************
+* Function:   osl_ext_event_set
+*
+* Purpose:    Set event of specified event object.
+*
+* Parameters: event      (mod) Event object to set.
+*             event_bits (in)  Event bits to set.
+*
+* Returns:    OSL_EXT_SUCCESS if the event was created successfully, or an
+*             error code if the event could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_event_set(osl_ext_event_t *event,
+       osl_ext_event_bits_t event_bits);
+
+/* --------------------------------------------------------------------------
+** Interrupt
+*/
+
+/****************************************************************************
+* Function:   osl_ext_interrupt_disable
+*
+* Purpose:    Disable CPU interrupt.
+*
+* Parameters: None.
+*
+* Returns:    The interrupt state before disable for restoring interrupt.
+*****************************************************************************
+*/
+osl_ext_interrupt_state_t osl_ext_interrupt_disable(void);
+
+/****************************************************************************
+* Function:   osl_ext_interrupt_restore
+*
+* Purpose:    Restore CPU interrupt state.
+*
+* Parameters: state (in)  Interrupt state to restore returned from
+*                         osl_ext_interrupt_disable().
+*
+* Returns:   None.
+*****************************************************************************
+*/
+void osl_ext_interrupt_restore(osl_ext_interrupt_state_t state);
+
+#else
+
+/* ---- Constants and Types ---------------------------------------------- */
+
+/* Interrupt control */
+#define OSL_INTERRUPT_SAVE_AREA
+#define OSL_DISABLE
+#define OSL_RESTORE
+
+/* Semaphore. */
+#define osl_ext_sem_t
+#define OSL_EXT_SEM_DECL(sem)
+
+/* Mutex. */
+#define osl_ext_mutex_t
+#define OSL_EXT_MUTEX_DECL(mutex)
+
+/* Timer. */
+#define osl_ext_timer_t
+#define OSL_EXT_TIMER_DECL(timer)
+
+/* Task. */
+#define osl_ext_task_t void
+#define OSL_EXT_TASK_DECL(task)
+
+/* Queue. */
+#define osl_ext_queue_t
+#define OSL_EXT_QUEUE_DECL(queue)
+
+/* Event. */
+#define osl_ext_event_t
+#define OSL_EXT_EVENT_DECL(event)
+
+/* ---- Variable Externs ------------------------------------------------- */
+/* ---- Function Prototypes ---------------------------------------------- */
+
+#define osl_ext_sem_create(name, init_cnt, sem)                (OSL_EXT_SUCCESS)
+#define osl_ext_sem_delete(sem)                                (OSL_EXT_SUCCESS)
+#define osl_ext_sem_give(sem)                          (OSL_EXT_SUCCESS)
+#define osl_ext_sem_take(sem, timeout_msec)            (OSL_EXT_SUCCESS)
+
+#define osl_ext_mutex_create(name, mutex)              (OSL_EXT_SUCCESS)
+#define osl_ext_mutex_delete(mutex)                    (OSL_EXT_SUCCESS)
+#define osl_ext_mutex_acquire(mutex, timeout_msec)     (OSL_EXT_SUCCESS)
+#define osl_ext_mutex_release(mutex)                   (OSL_EXT_SUCCESS)
+
+#define osl_ext_timer_create(name, timeout_msec, mode, func, arg, timer) \
+       (OSL_EXT_SUCCESS)
+#define osl_ext_timer_delete(timer)                    (OSL_EXT_SUCCESS)
+#define osl_ext_timer_start(timer, timeout_msec, mode) (OSL_EXT_SUCCESS)
+#define osl_ext_timer_stop(timer)                      (OSL_EXT_SUCCESS)
+#define osl_ext_time_get()                             (0)
+
+#define osl_ext_task_create(name, stack, stack_size, priority, func, arg, task) \
+       (OSL_EXT_SUCCESS)
+#define osl_ext_task_delete(task)                      (OSL_EXT_SUCCESS)
+#define osl_ext_task_current()                         (NULL)
+#define osl_ext_task_yield()                           (OSL_EXT_SUCCESS)
+#define osl_ext_task_enable_stack_check()              (OSL_EXT_SUCCESS)
+
+#define osl_ext_queue_create(name, queue_buffer, queue_size, queue) \
+       (OSL_EXT_SUCCESS)
+#define osl_ext_queue_delete(queue)                    (OSL_EXT_SUCCESS)
+#define osl_ext_queue_send(queue, data)                        (OSL_EXT_SUCCESS)
+#define osl_ext_queue_send_synchronous(queue, data)    (OSL_EXT_SUCCESS)
+#define osl_ext_queue_receive(queue, timeout_msec, data) \
+       (OSL_EXT_SUCCESS)
+#define osl_ext_queue_count(queue, count)              (OSL_EXT_SUCCESS)
+
+#define osl_ext_event_create(name, event)              (OSL_EXT_SUCCESS)
+#define osl_ext_event_delete(event)                    (OSL_EXT_SUCCESS)
+#define osl_ext_event_get(event, requested, timeout_msec, event_bits) \
+       (OSL_EXT_SUCCESS)
+#define osl_ext_event_set(event, event_bits)           (OSL_EXT_SUCCESS)
+
+#define osl_ext_interrupt_disable(void)                        (0)
+#define osl_ext_interrupt_restore(state)
+
+#endif /* OSL_EXT_DISABLED */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _osl_ext_h_ */
diff --git a/bcmdhd.101.10.240.x/include/p2p.h b/bcmdhd.101.10.240.x/include/p2p.h
new file mode 100644 (file)
index 0000000..727fe96
--- /dev/null
@@ -0,0 +1,695 @@
+/*
+ * Fundamental types and constants relating to WFA P2P (aka WiFi Direct)
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _P2P_H_
+#define _P2P_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+#include <wlioctl.h>
+#include <802.11.h>
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* WiFi P2P OUI values */
+#define P2P_VER                        WFA_OUI_TYPE_P2P        /* P2P version: 9=WiFi P2P v1.0 */
+
+#define P2P_IE_ID              0xdd                    /* P2P IE element ID */
+
+/* WiFi P2P IE */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_ie {
+       uint8   id;             /* IE ID: 0xDD */
+       uint8   len;            /* IE length */
+       uint8   OUI[3];         /* WiFi P2P specific OUI: P2P_OUI */
+       uint8   oui_type;       /* Identifies P2P version: P2P_VER */
+       uint8   subelts[1];     /* variable length subelements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_ie wifi_p2p_ie_t;
+
+#define P2P_IE_FIXED_LEN       6
+
+#define P2P_ATTR_ID_OFF                0
+#define P2P_ATTR_LEN_OFF       1
+#define P2P_ATTR_DATA_OFF      3
+
+#define P2P_ATTR_ID_LEN                1       /* ID filed length */
+#define P2P_ATTR_LEN_LEN       2       /* length field length */
+#define P2P_ATTR_HDR_LEN       3 /* ID + 2-byte length field spec 1.02 */
+
+#define P2P_WFDS_HASH_LEN              6
+#define P2P_WFDS_MAX_SVC_NAME_LEN      32
+
+/* P2P IE Subelement IDs from WiFi P2P Technical Spec 1.00 */
+#define P2P_SEID_STATUS                        0       /* Status */
+#define P2P_SEID_MINOR_RC              1       /* Minor Reason Code */
+#define P2P_SEID_P2P_INFO              2       /* P2P Capability (capabilities info) */
+#define P2P_SEID_DEV_ID                        3       /* P2P Device ID */
+#define P2P_SEID_INTENT                        4       /* Group Owner Intent */
+#define P2P_SEID_CFG_TIMEOUT           5       /* Configuration Timeout */
+#define P2P_SEID_CHANNEL               6       /* Listen channel */
+#define P2P_SEID_GRP_BSSID             7       /* P2P Group BSSID */
+#define P2P_SEID_XT_TIMING             8       /* Extended Listen Timing */
+#define P2P_SEID_INTINTADDR            9       /* Intended P2P Interface Address */
+#define P2P_SEID_P2P_MGBTY             10      /* P2P Manageability */
+#define P2P_SEID_CHAN_LIST             11      /* Channel List */
+#define P2P_SEID_ABSENCE               12      /* Notice of Absence */
+#define P2P_SEID_DEV_INFO              13      /* Device Info */
+#define P2P_SEID_GROUP_INFO            14      /* Group Info */
+#define P2P_SEID_GROUP_ID              15      /* Group ID */
+#define P2P_SEID_P2P_IF                        16      /* P2P Interface */
+#define P2P_SEID_OP_CHANNEL            17      /* Operating Channel */
+#define P2P_SEID_INVITE_FLAGS          18      /* Invitation Flags */
+#define P2P_SEID_SERVICE_HASH          21      /* Service hash */
+#define P2P_SEID_SESSION               22      /* Session information */
+#define P2P_SEID_CONNECT_CAP           23      /* Connection capability */
+#define P2P_SEID_ADVERTISE_ID          24      /* Advertisement ID */
+#define P2P_SEID_ADVERTISE_SERVICE     25      /* Advertised service */
+#define P2P_SEID_SESSION_ID            26      /* Session ID */
+#define P2P_SEID_FEATURE_CAP           27      /* Feature capability */
+#define        P2P_SEID_PERSISTENT_GROUP       28      /* Persistent group */
+#define P2P_SEID_SESSION_INFO_RESP     29      /* Session Information Response */
+#define P2P_SEID_VNDR                  221     /* Vendor-specific subelement */
+
+#define P2P_SE_VS_ID_SERVICES  0x1b /* BRCM proprietary subel: L2 Services */
+
+/* WiFi P2P IE subelement: P2P Capability (capabilities info) */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_info_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_P2P_INFO */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   dev;            /* Device Capability Bitmap */
+       uint8   group;          /* Group Capability Bitmap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_info_se_s wifi_p2p_info_se_t;
+
+/* P2P Capability subelement's Device Capability Bitmap bit values */
+#define P2P_CAPSE_DEV_SERVICE_DIS      0x1 /* Service Discovery */
+#define P2P_CAPSE_DEV_CLIENT_DIS       0x2 /* Client Discoverability */
+#define P2P_CAPSE_DEV_CONCURRENT       0x4 /* Concurrent Operation */
+#define P2P_CAPSE_DEV_INFRA_MAN                0x8 /* P2P Infrastructure Managed */
+#define P2P_CAPSE_DEV_LIMIT                    0x10 /* P2P Device Limit */
+#define P2P_CAPSE_INVITE_PROC          0x20 /* P2P Invitation Procedure */
+
+/* P2P Capability subelement's Group Capability Bitmap bit values */
+#define P2P_CAPSE_GRP_OWNER                    0x1 /* P2P Group Owner */
+#define P2P_CAPSE_PERSIST_GRP          0x2 /* Persistent P2P Group */
+#define P2P_CAPSE_GRP_LIMIT                    0x4 /* P2P Group Limit */
+#define P2P_CAPSE_GRP_INTRA_BSS                0x8 /* Intra-BSS Distribution */
+#define P2P_CAPSE_GRP_X_CONNECT                0x10 /* Cross Connection */
+#define P2P_CAPSE_GRP_PERSISTENT       0x20 /* Persistent Reconnect */
+#define P2P_CAPSE_GRP_FORMATION                0x40 /* Group Formation */
+
+/* WiFi P2P IE subelement: Group Owner Intent */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_intent_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_INTENT */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   intent;         /* Intent Value 0...15 (0=legacy 15=master only) */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_intent_se_s wifi_p2p_intent_se_t;
+
+/* WiFi P2P IE subelement: Configuration Timeout */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_cfg_tmo_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_CFG_TIMEOUT */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   go_tmo;         /* GO config timeout in units of 10 ms */
+       uint8   client_tmo;     /* Client config timeout in units of 10 ms */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_cfg_tmo_se_s wifi_p2p_cfg_tmo_se_t;
+
+/* WiFi P2P IE subelement: Listen Channel */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_listen_channel_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_CHANNEL */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   country[3];     /* Country String */
+       uint8   op_class;       /* Operating Class */
+       uint8   channel;        /* Channel */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_listen_channel_se_s wifi_p2p_listen_channel_se_t;
+
+/* WiFi P2P IE subelement: P2P Group BSSID */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_grp_bssid_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_GRP_BSSID */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   mac[6];         /* P2P group bssid */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_grp_bssid_se_s wifi_p2p_grp_bssid_se_t;
+
+/* WiFi P2P IE subelement: P2P Group ID */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_grp_id_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_GROUP_ID */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   mac[6];         /* P2P device address */
+       uint8   ssid[1];        /* ssid. device id. variable length */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_grp_id_se_s wifi_p2p_grp_id_se_t;
+
+/* WiFi P2P IE subelement: P2P Interface */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_intf_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_P2P_IF */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   mac[6];         /* P2P device address */
+       uint8   ifaddrs;        /* P2P Interface Address count */
+       uint8   ifaddr[1][6];   /* P2P Interface Address list */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_intf_se_s wifi_p2p_intf_se_t;
+
+/* WiFi P2P IE subelement: Status */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_status_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_STATUS */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   status;         /* Status Code: P2P_STATSE_* */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_status_se_s wifi_p2p_status_se_t;
+
+/* Status subelement Status Code definitions */
+#define P2P_STATSE_SUCCESS                     0
+                               /* Success */
+#define P2P_STATSE_FAIL_INFO_CURR_UNAVAIL      1
+                               /* Failed, information currently unavailable */
+#define P2P_STATSE_PASSED_UP                   P2P_STATSE_FAIL_INFO_CURR_UNAVAIL
+                               /* Old name for above in P2P spec 1.08 and older */
+#define P2P_STATSE_FAIL_INCOMPAT_PARAMS                2
+                               /* Failed, incompatible parameters */
+#define P2P_STATSE_FAIL_LIMIT_REACHED          3
+                               /* Failed, limit reached */
+#define P2P_STATSE_FAIL_INVALID_PARAMS         4
+                               /* Failed, invalid parameters */
+#define P2P_STATSE_FAIL_UNABLE_TO_ACCOM                5
+                               /* Failed, unable to accomodate request */
+#define P2P_STATSE_FAIL_PROTO_ERROR            6
+                               /* Failed, previous protocol error or disruptive behaviour */
+#define P2P_STATSE_FAIL_NO_COMMON_CHAN         7
+                               /* Failed, no common channels */
+#define P2P_STATSE_FAIL_UNKNOWN_GROUP          8
+                               /* Failed, unknown P2P Group */
+#define P2P_STATSE_FAIL_INTENT                 9
+                               /* Failed, both peers indicated Intent 15 in GO Negotiation */
+#define P2P_STATSE_FAIL_INCOMPAT_PROVIS                10
+                               /* Failed, incompatible provisioning method */
+#define P2P_STATSE_FAIL_USER_REJECT            11
+                               /* Failed, rejected by user */
+#define P2P_STATSE_SUCCESS_USER_ACCEPT         12
+                               /* Success, accepted by user */
+
+/* WiFi P2P IE attribute: Extended Listen Timing */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_ext_se_s {
+       uint8   eltId;          /* ID: P2P_SEID_EXT_TIMING */
+       uint8   len[2];         /* length not including eltId, len fields */
+       uint8   avail[2];       /* availibility period */
+       uint8   interval[2];    /* availibility interval */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_ext_se_s wifi_p2p_ext_se_t;
+
+#define P2P_EXT_MIN    10      /* minimum 10ms */
+
+/* WiFi P2P IE subelement: Intended P2P Interface Address */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_intintad_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_INTINTADDR */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   mac[6];         /* intended P2P interface MAC address */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_intintad_se_s wifi_p2p_intintad_se_t;
+
+/* WiFi P2P IE subelement: Channel */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_channel_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_STATUS */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   band;           /* Regulatory Class (band) */
+       uint8   channel;        /* Channel */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_channel_se_s wifi_p2p_channel_se_t;
+
+/* Channel Entry structure within the Channel List SE */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_chanlist_entry_s {
+       uint8   band;                                           /* Regulatory Class (band) */
+       uint8   num_channels;                           /* # of channels in the channel list */
+       uint8   channels[WL_NUMCHANNELS];       /* Channel List */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_chanlist_entry_s wifi_p2p_chanlist_entry_t;
+#define WIFI_P2P_CHANLIST_SE_MAX_ENTRIES 2
+
+/* WiFi P2P IE subelement: Channel List */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_chanlist_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_CHAN_LIST */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   country[3];     /* Country String */
+       uint8   num_entries;    /* # of channel entries */
+       wifi_p2p_chanlist_entry_t       entries[WIFI_P2P_CHANLIST_SE_MAX_ENTRIES];
+                                               /* Channel Entry List */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_chanlist_se_s wifi_p2p_chanlist_se_t;
+
+/* WiFi Primary Device Type structure */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_pri_devtype_s {
+       uint16  cat_id;         /* Category ID */
+       uint8   OUI[3];         /* WFA OUI: 0x0050F2 */
+       uint8   oui_type;       /* WPS_OUI_TYPE */
+       uint16  sub_cat_id;     /* Sub Category ID */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_pri_devtype_s wifi_p2p_pri_devtype_t;
+
+/* WiFi P2P Device Info Sub Element Primary Device Type Sub Category
+ * maximum values for each category
+ */
+#define P2P_DISE_SUBCATEGORY_MINVAL            1
+#define P2P_DISE_CATEGORY_COMPUTER             1
+#define P2P_DISE_SUBCATEGORY_COMPUTER_MAXVAL           8
+#define P2P_DISE_CATEGORY_INPUT_DEVICE         2
+#define P2P_DISE_SUBCATEGORY_INPUT_DEVICE_MAXVAL       9
+#define P2P_DISE_CATEGORY_PRINTER              3
+#define P2P_DISE_SUBCATEGORY_PRINTER_MAXVAL            5
+#define P2P_DISE_CATEGORY_CAMERA               4
+#define P2P_DISE_SUBCATEGORY_CAMERA_MAXVAL             4
+#define P2P_DISE_CATEGORY_STORAGE              5
+#define P2P_DISE_SUBCATEGORY_STORAGE_MAXVAL            1
+#define P2P_DISE_CATEGORY_NETWORK_INFRA                6
+#define P2P_DISE_SUBCATEGORY_NETWORK_INFRA_MAXVAL      4
+#define P2P_DISE_CATEGORY_DISPLAY              7
+#define P2P_DISE_SUBCATEGORY_DISPLAY_MAXVAL            4
+#define P2P_DISE_CATEGORY_MULTIMEDIA           8
+#define P2P_DISE_SUBCATEGORY_MULTIMEDIA_MAXVAL         6
+#define P2P_DISE_CATEGORY_GAMING               9
+#define P2P_DISE_SUBCATEGORY_GAMING_MAXVAL             5
+#define P2P_DISE_CATEGORY_TELEPHONE            10
+#define P2P_DISE_SUBCATEGORY_TELEPHONE_MAXVAL          5
+#define P2P_DISE_CATEGORY_AUDIO                        11
+#define P2P_DISE_SUBCATEGORY_AUDIO_MAXVAL              6
+
+/* WiFi P2P IE's Device Info subelement */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_devinfo_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_DEVINFO */
+       uint8   len[2];                 /* SE length not including eltId, len fields */
+       uint8   mac[6];                 /* P2P Device MAC address */
+       uint16  wps_cfg_meths;          /* Config Methods: reg_prototlv.h WPS_CONFMET_* */
+       uint8   pri_devtype[8];         /* Primary Device Type */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_devinfo_se_s wifi_p2p_devinfo_se_t;
+
+#define P2P_DEV_TYPE_LEN       8
+
+/* WiFi P2P IE's Group Info subelement Client Info Descriptor */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_cid_fixed_s {
+       uint8   len;
+       uint8   devaddr[ETHER_ADDR_LEN];        /* P2P Device Address */
+       uint8   ifaddr[ETHER_ADDR_LEN];         /* P2P Interface Address */
+       uint8   devcap;                         /* Device Capability */
+       uint8   cfg_meths[2];                   /* Config Methods: reg_prototlv.h WPS_CONFMET_* */
+       uint8   pridt[P2P_DEV_TYPE_LEN];        /* Primary Device Type */
+       uint8   secdts;                         /* Number of Secondary Device Types */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_cid_fixed_s wifi_p2p_cid_fixed_t;
+
+/* WiFi P2P IE's Device ID subelement */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_devid_se_s {
+       uint8   eltId;
+       uint8   len[2];
+       struct ether_addr       addr;                   /* P2P Device MAC address */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_devid_se_s wifi_p2p_devid_se_t;
+
+/* WiFi P2P IE subelement: P2P Manageability */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_mgbt_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_P2P_MGBTY */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   mg_bitmap;      /* manageability bitmap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_mgbt_se_s wifi_p2p_mgbt_se_t;
+/* mg_bitmap field bit values */
+#define P2P_MGBTSE_P2PDEVMGMT_FLAG   0x1 /* AP supports Managed P2P Device */
+
+/* WiFi P2P IE subelement: Group Info */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_grpinfo_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_GROUP_INFO */
+       uint8   len[2];                 /* SE length not including eltId, len fields */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_grpinfo_se_s wifi_p2p_grpinfo_se_t;
+
+/* WiFi IE subelement: Operating Channel */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_op_channel_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_OP_CHANNEL */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   country[3];     /* Country String */
+       uint8   op_class;       /* Operating Class */
+       uint8   channel;        /* Channel */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_op_channel_se_s wifi_p2p_op_channel_se_t;
+
+/* WiFi IE subelement: INVITATION FLAGS */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_invite_flags_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_INVITE_FLAGS */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   flags;          /* Flags */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_invite_flags_se_s wifi_p2p_invite_flags_se_t;
+
+/* WiFi P2P IE subelement: Service Hash */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_serv_hash_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_SERVICE_HASH */
+       uint8   len[2];                 /* SE length not including eltId, len fields
+                                        * in multiple of 6 Bytes
+                                       */
+       uint8   hash[1];                /* Variable length - SHA256 hash of
+                                        * service names (can be more than one hashes)
+                                       */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_serv_hash_se_s wifi_p2p_serv_hash_se_t;
+
+/* WiFi P2P IE subelement: Service Instance Data */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_serv_inst_data_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_SESSION */
+       uint8   len[2];                 /* SE length not including eltId, len */
+       uint8   ssn_info[1];            /* Variable length - Session information as specified by
+                                        * the service layer, type matches serv. name
+                                       */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_serv_inst_data_se_s wifi_p2p_serv_inst_data_se_t;
+
+/* WiFi P2P IE subelement: Connection capability */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_conn_cap_data_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_CONNECT_CAP */
+       uint8   len[2];                 /* SE length not including eltId, len */
+       uint8   conn_cap;               /* 1byte capability as specified by the
+                                        * service layer, valid bitmask/values
+                                       */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_conn_cap_data_se_s wifi_p2p_conn_cap_data_se_t;
+
+/* WiFi P2P IE subelement: Advertisement ID */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_advt_id_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_ADVERTISE_ID */
+       uint8   len[2];                 /* SE length not including eltId, len fixed 4 Bytes */
+       uint8   advt_id[4];             /* 4byte Advertisement ID of the peer device sent in
+                                        * PROV Disc in Network byte order
+                                       */
+       uint8   advt_mac[6];                    /* P2P device address of the service advertiser */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_advt_id_se_s wifi_p2p_advt_id_se_t;
+
+/* WiFi P2P IE subelement: Advertise Service Hash */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_adv_serv_info_s {
+       uint8   advt_id[4];             /* SE Advertise ID for the service */
+       uint16  nw_cfg_method;  /* SE Network Config method for the service */
+       uint8   serv_name_len;  /* SE length of the service name */
+       uint8   serv_name[1];   /* Variable length service name field */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_adv_serv_info_s wifi_p2p_adv_serv_info_t;
+
+/* WiFi P2P IE subelement: Advertise Service Hash */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_advt_serv_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_ADVERTISE_SERVICE */
+       uint8   len[2];                 /* SE length not including eltId, len fields mutiple len of
+                                        * wifi_p2p_adv_serv_info_t entries
+                                       */
+       wifi_p2p_adv_serv_info_t        p_advt_serv_info[1]; /* Variable length
+                                                               of multiple instances
+                                                               of the advertise service info
+                                                               */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_advt_serv_se_s wifi_p2p_advt_serv_se_t;
+
+/* WiFi P2P IE subelement: Session ID */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_ssn_id_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_SESSION_ID */
+       uint8   len[2];                 /* SE length not including eltId, len fixed 4 Bytes */
+       uint8   ssn_id[4];              /* 4byte Session ID of the peer device sent in
+                                                        * PROV Disc in Network byte order
+                                                        */
+       uint8   ssn_mac[6];             /* P2P device address of the seeker - session mac */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_ssn_id_se_s wifi_p2p_ssn_id_se_t;
+
+#define P2P_ADVT_SERV_SE_FIXED_LEN     3       /* Includes only the element ID and len */
+#define P2P_ADVT_SERV_INFO_FIXED_LEN   7       /* Per ADV Service Instance advt_id +
+                                                * nw_config_method + serv_name_len
+                                                */
+
+/* WiFi P2P Action Frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_action_frame {
+       uint8   category;       /* P2P_AF_CATEGORY */
+       uint8   OUI[3];         /* OUI - P2P_OUI */
+       uint8   type;           /* OUI Type - P2P_VER */
+       uint8   subtype;        /* OUI Subtype - P2P_AF_* */
+       uint8   dialog_token;   /* nonzero, identifies req/resp tranaction */
+       uint8   elts[1];        /* Variable length information elements.  Max size =
+                                * ACTION_FRAME_SIZE - sizeof(this structure) - 1
+                                */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_action_frame wifi_p2p_action_frame_t;
+#define P2P_AF_CATEGORY                0x7f
+
+#define P2P_AF_FIXED_LEN       7
+
+/* WiFi P2P Action Frame OUI Subtypes */
+#define P2P_AF_NOTICE_OF_ABSENCE       0       /* Notice of Absence */
+#define P2P_AF_PRESENCE_REQ            1       /* P2P Presence Request */
+#define P2P_AF_PRESENCE_RSP            2       /* P2P Presence Response */
+#define P2P_AF_GO_DISC_REQ             3       /* GO Discoverability Request */
+
+/* WiFi P2P Public Action Frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_pub_act_frame {
+       uint8   category;       /* P2P_PUB_AF_CATEGORY */
+       uint8   action;         /* P2P_PUB_AF_ACTION */
+       uint8   oui[3];         /* P2P_OUI */
+       uint8   oui_type;       /* OUI type - P2P_VER */
+       uint8   subtype;        /* OUI subtype - P2P_TYPE_* */
+       uint8   dialog_token;   /* nonzero, identifies req/rsp transaction */
+       uint8   elts[1];        /* Variable length information elements.  Max size =
+                                * ACTION_FRAME_SIZE - sizeof(this structure) - 1
+                                */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_pub_act_frame wifi_p2p_pub_act_frame_t;
+#define P2P_PUB_AF_FIXED_LEN   8
+#define P2P_PUB_AF_CATEGORY    0x04
+#define P2P_PUB_AF_ACTION      0x09
+
+/* WiFi P2P Public Action Frame OUI Subtypes */
+#define P2P_PAF_GON_REQ                0       /* Group Owner Negotiation Req */
+#define P2P_PAF_GON_RSP                1       /* Group Owner Negotiation Rsp */
+#define P2P_PAF_GON_CONF       2       /* Group Owner Negotiation Confirm */
+#define P2P_PAF_INVITE_REQ     3       /* P2P Invitation Request */
+#define P2P_PAF_INVITE_RSP     4       /* P2P Invitation Response */
+#define P2P_PAF_DEVDIS_REQ     5       /* Device Discoverability Request */
+#define P2P_PAF_DEVDIS_RSP     6       /* Device Discoverability Response */
+#define P2P_PAF_PROVDIS_REQ    7       /* Provision Discovery Request */
+#define P2P_PAF_PROVDIS_RSP    8       /* Provision Discovery Response */
+#define P2P_PAF_SUBTYPE_INVALID        255     /* Invalid Subtype */
+
+/* TODO: Stop using these obsolete aliases for P2P_PAF_GON_* */
+#define P2P_TYPE_MNREQ         P2P_PAF_GON_REQ
+#define P2P_TYPE_MNRSP         P2P_PAF_GON_RSP
+#define P2P_TYPE_MNCONF                P2P_PAF_GON_CONF
+
+/* WiFi P2P IE subelement: Notice of Absence */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_noa_desc {
+       uint8   cnt_type;       /* Count/Type */
+       uint32  duration;       /* Duration */
+       uint32  interval;       /* Interval */
+       uint32  start;          /* Start Time */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_noa_desc wifi_p2p_noa_desc_t;
+
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_noa_se {
+       uint8   eltId;          /* Subelement ID */
+       uint8   len[2];         /* Length */
+       uint8   index;          /* Index */
+       uint8   ops_ctw_parms;  /* CTWindow and OppPS Parameters */
+       wifi_p2p_noa_desc_t     desc[1];        /* Notice of Absence Descriptor(s) */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_noa_se wifi_p2p_noa_se_t;
+
+#define P2P_NOA_SE_FIXED_LEN   5
+
+#define P2P_NOA_SE_MAX_DESC    2       /* max NoA descriptors in presence request */
+
+/* cnt_type field values */
+#define P2P_NOA_DESC_CNT_RESERVED      0       /* reserved and should not be used */
+#define P2P_NOA_DESC_CNT_REPEAT                255     /* continuous schedule */
+#define P2P_NOA_DESC_TYPE_PREFERRED    1       /* preferred values */
+#define P2P_NOA_DESC_TYPE_ACCEPTABLE   2       /* acceptable limits */
+
+/* ctw_ops_parms field values */
+#define P2P_NOA_CTW_MASK       0x7f
+#define P2P_NOA_OPS_MASK       0x80
+#define P2P_NOA_OPS_SHIFT      7
+
+#define P2P_CTW_MIN    10      /* minimum 10TU */
+
+/*
+ * P2P Service Discovery related
+ */
+#define        P2PSD_ACTION_CATEGORY           0x04
+                               /* Public action frame */
+#define        P2PSD_ACTION_ID_GAS_IREQ        0x0a
+                               /* Action value for GAS Initial Request AF */
+#define        P2PSD_ACTION_ID_GAS_IRESP       0x0b
+                               /* Action value for GAS Initial Response AF */
+#define        P2PSD_ACTION_ID_GAS_CREQ        0x0c
+                               /* Action value for GAS Comeback Request AF */
+#define        P2PSD_ACTION_ID_GAS_CRESP       0x0d
+                               /* Action value for GAS Comeback Response AF */
+#define P2PSD_AD_EID                           0x6c
+                               /* Advertisement Protocol IE ID */
+#define P2PSD_ADP_TUPLE_QLMT_PAMEBI    0x00
+                               /* Query Response Length Limit 7 bits plus PAME-BI 1 bit */
+#define P2PSD_ADP_PROTO_ID                     0x00
+                               /* Advertisement Protocol ID. Always 0 for P2P SD */
+#define P2PSD_GAS_OUI                          P2P_OUI
+                               /* WFA OUI */
+#define P2PSD_GAS_OUI_SUBTYPE          P2P_VER
+                               /* OUI Subtype for GAS IE */
+#define P2PSD_GAS_NQP_INFOID           0xDDDD
+                               /* NQP Query Info ID: 56797 */
+#define P2PSD_GAS_COMEBACKDEALY                0x00
+                               /* Not used in the Native GAS protocol */
+
+/* Service Protocol Type */
+typedef enum p2psd_svc_protype {
+       SVC_RPOTYPE_ALL = 0,
+       SVC_RPOTYPE_BONJOUR = 1,
+       SVC_RPOTYPE_UPNP = 2,
+       SVC_RPOTYPE_WSD = 3,
+       SVC_RPOTYPE_WFDS = 11,
+       SVC_RPOTYPE_VENDOR = 255
+} p2psd_svc_protype_t;
+
+/* Service Discovery response status code */
+typedef enum {
+       P2PSD_RESP_STATUS_SUCCESS = 0,
+       P2PSD_RESP_STATUS_PROTYPE_NA = 1,
+       P2PSD_RESP_STATUS_DATA_NA = 2,
+       P2PSD_RESP_STATUS_BAD_REQUEST = 3
+} p2psd_resp_status_t;
+
+/* Advertisement Protocol IE tuple field */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_adp_tpl {
+       uint8   llm_pamebi;     /* Query Response Length Limit bit 0-6, set to 0 plus
+                               * Pre-Associated Message Exchange BSSID Independent bit 7, set to 0
+                               */
+       uint8   adp_id;         /* Advertisement Protocol ID: 0 for NQP Native Query Protocol */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_adp_tpl wifi_p2psd_adp_tpl_t;
+
+/* Advertisement Protocol IE */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_adp_ie {
+       uint8   id;             /* IE ID: 0x6c - 108 */
+       uint8   len;    /* IE length */
+       wifi_p2psd_adp_tpl_t adp_tpl;  /* Advertisement Protocol Tuple field. Only one
+                               * tuple is defined for P2P Service Discovery
+                               */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_adp_ie wifi_p2psd_adp_ie_t;
+
+/* NQP Vendor-specific Content */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_nqp_query_vsc {
+       uint8   oui_subtype;    /* OUI Subtype: 0x09 */
+       uint16  svc_updi;               /* Service Update Indicator */
+       uint8   svc_tlvs[1];    /* wifi_p2psd_qreq_tlv_t type for service request,
+                               * wifi_p2psd_qresp_tlv_t type for service response
+                               */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_nqp_query_vsc wifi_p2psd_nqp_query_vsc_t;
+
+/* Service Request TLV */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qreq_tlv {
+       uint16  len;                    /* Length: 5 plus size of Query Data */
+       uint8   svc_prot;               /* Service Protocol Type */
+       uint8   svc_tscid;              /* Service Transaction ID */
+       uint8   query_data[1];  /* Query Data, passed in from above Layer 2 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qreq_tlv wifi_p2psd_qreq_tlv_t;
+
+/* Query Request Frame, defined in generic format, instead of NQP specific */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qreq_frame {
+       uint16  info_id;        /* Info ID: 0xDDDD */
+       uint16  len;            /* Length of service request TLV, 5 plus the size of request data */
+       uint8   oui[3];         /* WFA OUI: 0x0050F2 */
+       uint8   qreq_vsc[1]; /* Vendor-specific Content: wifi_p2psd_nqp_query_vsc_t type for NQP */
+
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qreq_frame wifi_p2psd_qreq_frame_t;
+
+/* GAS Initial Request AF body, "elts" in wifi_p2p_pub_act_frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_ireq_frame {
+       wifi_p2psd_adp_ie_t             adp_ie;         /* Advertisement Protocol IE */
+       uint16                                  qreq_len;       /* Query Request Length */
+       uint8   qreq_frm[1];    /* Query Request Frame wifi_p2psd_qreq_frame_t */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_ireq_frame wifi_p2psd_gas_ireq_frame_t;
+
+/* Service Response TLV */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qresp_tlv {
+       uint16  len;                            /* Length: 5 plus size of Query Data */
+       uint8   svc_prot;                       /* Service Protocol Type */
+       uint8   svc_tscid;                      /* Service Transaction ID */
+       uint8   status;                         /* Value defined in Table 57 of P2P spec. */
+       uint8   query_data[1];          /* Response Data, passed in from above Layer 2 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qresp_tlv wifi_p2psd_qresp_tlv_t;
+
+/* Query Response Frame, defined in generic format, instead of NQP specific */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qresp_frame {
+       uint16  info_id;        /* Info ID: 0xDDDD */
+       uint16  len;            /* Lenth of service response TLV, 6 plus the size of resp data */
+       uint8   oui[3];         /* WFA OUI: 0x0050F2 */
+       uint8   qresp_vsc[1]; /* Vendor-specific Content: wifi_p2psd_qresp_tlv_t type for NQP */
+
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qresp_frame wifi_p2psd_qresp_frame_t;
+
+/* GAS Initial Response AF body, "elts" in wifi_p2p_pub_act_frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_iresp_frame {
+       uint16  status;                 /* Value defined in Table 7-23 of IEEE P802.11u */
+       uint16  cb_delay;               /* GAS Comeback Delay */
+       wifi_p2psd_adp_ie_t     adp_ie;         /* Advertisement Protocol IE */
+       uint16          qresp_len;      /* Query Response Length */
+       uint8   qresp_frm[1];   /* Query Response Frame wifi_p2psd_qresp_frame_t */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_iresp_frame wifi_p2psd_gas_iresp_frame_t;
+
+/* GAS Comeback Response AF body, "elts" in wifi_p2p_pub_act_frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_cresp_frame {
+       uint16  status;                 /* Value defined in Table 7-23 of IEEE P802.11u */
+       uint8   fragment_id;    /* Fragmentation ID */
+       uint16  cb_delay;               /* GAS Comeback Delay */
+       wifi_p2psd_adp_ie_t     adp_ie;         /* Advertisement Protocol IE */
+       uint16  qresp_len;              /* Query Response Length */
+       uint8   qresp_frm[1];   /* Query Response Frame wifi_p2psd_qresp_frame_t */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_cresp_frame wifi_p2psd_gas_cresp_frame_t;
+
+/* Wi-Fi GAS Public Action Frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_pub_act_frame {
+       uint8   category;               /* 0x04 Public Action Frame */
+       uint8   action;                 /* 0x6c Advertisement Protocol */
+       uint8   dialog_token;   /* nonzero, identifies req/rsp transaction */
+       uint8   query_data[1];  /* Query Data. wifi_p2psd_gas_ireq_frame_t
+                                        * or wifi_p2psd_gas_iresp_frame_t format
+                                        */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_pub_act_frame wifi_p2psd_gas_pub_act_frame_t;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _P2P_H_ */
diff --git a/bcmdhd.101.10.240.x/include/packed_section_end.h b/bcmdhd.101.10.240.x/include/packed_section_end.h
new file mode 100644 (file)
index 0000000..18a07c4
--- /dev/null
@@ -0,0 +1,53 @@
+/*
+ * Declare directives for structure packing. No padding will be provided
+ * between the members of packed structures, and therefore, there is no
+ * guarantee that structure members will be aligned.
+ *
+ * Declaring packed structures is compiler specific. In order to handle all
+ * cases, packed structures should be delared as:
+ *
+ * #include <packed_section_start.h>
+ *
+ * typedef BWL_PRE_PACKED_STRUCT struct foobar_t {
+ *    some_struct_members;
+ * } BWL_POST_PACKED_STRUCT foobar_t;
+ *
+ * #include <packed_section_end.h>
+ *
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+/* Error check - BWL_PACKED_SECTION is defined in packed_section_start.h
+ * and undefined in packed_section_end.h. If it is NOT defined at this
+ * point, then there is a missing include of packed_section_start.h.
+ */
+#ifdef BWL_PACKED_SECTION
+       #undef BWL_PACKED_SECTION
+#else
+       #error "BWL_PACKED_SECTION is NOT defined!"
+#endif
+
+/* Compiler-specific directives for structure packing are declared in
+ * packed_section_start.h. This marks the end of the structure packing section,
+ * so, undef them here.
+ */
+#undef BWL_PRE_PACKED_STRUCT
+#undef BWL_POST_PACKED_STRUCT
diff --git a/bcmdhd.101.10.240.x/include/packed_section_start.h b/bcmdhd.101.10.240.x/include/packed_section_start.h
new file mode 100644 (file)
index 0000000..820e30b
--- /dev/null
@@ -0,0 +1,100 @@
+/*
+ * Declare directives for structure packing. No padding will be provided
+ * between the members of packed structures, and therefore, there is no
+ * guarantee that structure members will be aligned.
+ *
+ * Declaring packed structures is compiler specific. In order to handle all
+ * cases, packed structures should be delared as:
+ *
+ * #include <packed_section_start.h>
+ *
+ * typedef BWL_PRE_PACKED_STRUCT struct foobar_t {
+ *    some_struct_members;
+ * } BWL_POST_PACKED_STRUCT foobar_t;
+ *
+ * #include <packed_section_end.h>
+ *
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+/* EFI does not support STATIC_ASSERT */
+
+#ifndef _alignment_test_
+#define _alignment_test_
+
+/* ASSERT default packing */
+typedef struct T4 {
+       uint8  a;
+       uint32 b;
+       uint16 c;
+       uint8  d;
+} T4_t;
+
+/* 4 byte alignment support */
+/*
+* a . . .
+* b b b b
+* c c d .
+*/
+
+/*
+ * Below function is meant to verify that this file is compiled with the default alignment of 4.
+ * Function will fail to compile if the condition is not met.
+ */
+#ifdef __GNUC__
+#define VARIABLE_IS_NOT_USED __attribute__ ((unused))
+#else
+#define VARIABLE_IS_NOT_USED
+#endif
+static void alignment_test(void);
+static void
+VARIABLE_IS_NOT_USED alignment_test(void)
+{
+       /* verify 4 byte alignment support */
+       STATIC_ASSERT(sizeof(T4_t) == 12);
+}
+#endif /* _alignment_test_ */
+
+/* Error check - BWL_PACKED_SECTION is defined in packed_section_start.h
+ * and undefined in packed_section_end.h. If it is already defined at this
+ * point, then there is a missing include of packed_section_end.h.
+ */
+#ifdef BWL_PACKED_SECTION
+       #error "BWL_PACKED_SECTION is already defined!"
+#else
+       #define BWL_PACKED_SECTION
+#endif
+
+#if defined(BWL_DEFAULT_PACKING)
+       /* generate an error if BWL_DEFAULT_PACKING is defined */
+       #error "BWL_DEFAULT_PACKING not supported any more."
+#endif /* BWL_PACKED_SECTION */
+
+/* Declare compiler-specific directives for structure packing. */
+#if defined(__GNUC__) || defined(__lint)
+       #define BWL_PRE_PACKED_STRUCT
+       #define BWL_POST_PACKED_STRUCT  __attribute__ ((packed))
+#elif defined(__CC_ARM)
+       #define BWL_PRE_PACKED_STRUCT   __packed
+       #define BWL_POST_PACKED_STRUCT
+#else
+       #error "Unknown compiler!"
+#endif
diff --git a/bcmdhd.101.10.240.x/include/pcicfg.h b/bcmdhd.101.10.240.x/include/pcicfg.h
new file mode 100644 (file)
index 0000000..a2147ab
--- /dev/null
@@ -0,0 +1,722 @@
+/*
+ * pcicfg.h: PCI configuration constants and structures.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _h_pcicfg_
+#define        _h_pcicfg_
+
+/* The following inside ifndef's so we don't collide with NTDDK.H */
+#ifndef PCI_MAX_BUS
+#define PCI_MAX_BUS            0x100
+#endif
+#ifndef PCI_MAX_DEVICES
+#define PCI_MAX_DEVICES                0x20
+#endif
+#ifndef PCI_MAX_FUNCTION
+#define PCI_MAX_FUNCTION       0x8
+#endif
+
+#ifndef PCI_INVALID_VENDORID
+#define PCI_INVALID_VENDORID   0xffff
+#endif
+#ifndef PCI_INVALID_DEVICEID
+#define PCI_INVALID_DEVICEID   0xffff
+#endif
+
+/* Convert between bus-slot-function-register and config addresses */
+
+#define        PCICFG_BUS_SHIFT        16      /* Bus shift */
+#define        PCICFG_SLOT_SHIFT       11      /* Slot shift */
+#define        PCICFG_FUN_SHIFT        8       /* Function shift */
+#define        PCICFG_OFF_SHIFT        0       /* Register shift */
+
+#define        PCICFG_BUS_MASK         0xff    /* Bus mask */
+#define        PCICFG_SLOT_MASK        0x1f    /* Slot mask */
+#define        PCICFG_FUN_MASK         7       /* Function mask */
+#define        PCICFG_OFF_MASK         0xff    /* Bus mask */
+
+#define        PCI_CONFIG_ADDR(b, s, f, o)                                     \
+               ((((b) & PCICFG_BUS_MASK) << PCICFG_BUS_SHIFT)          \
+                | (((s) & PCICFG_SLOT_MASK) << PCICFG_SLOT_SHIFT)      \
+                | (((f) & PCICFG_FUN_MASK) << PCICFG_FUN_SHIFT)        \
+                | (((o) & PCICFG_OFF_MASK) << PCICFG_OFF_SHIFT))
+
+#define        PCI_CONFIG_BUS(a)       (((a) >> PCICFG_BUS_SHIFT) & PCICFG_BUS_MASK)
+#define        PCI_CONFIG_SLOT(a)      (((a) >> PCICFG_SLOT_SHIFT) & PCICFG_SLOT_MASK)
+#define        PCI_CONFIG_FUN(a)       (((a) >> PCICFG_FUN_SHIFT) & PCICFG_FUN_MASK)
+#define        PCI_CONFIG_OFF(a)       (((a) >> PCICFG_OFF_SHIFT) & PCICFG_OFF_MASK)
+
+/* PCIE Config space accessing MACROS */
+
+#define        PCIECFG_BUS_SHIFT       24      /* Bus shift */
+#define        PCIECFG_SLOT_SHIFT      19      /* Slot/Device shift */
+#define        PCIECFG_FUN_SHIFT       16      /* Function shift */
+#define        PCIECFG_OFF_SHIFT       0       /* Register shift */
+
+#define        PCIECFG_BUS_MASK        0xff    /* Bus mask */
+#define        PCIECFG_SLOT_MASK       0x1f    /* Slot/Device mask */
+#define        PCIECFG_FUN_MASK        7       /* Function mask */
+#define        PCIECFG_OFF_MASK        0xfff   /* Register mask */
+
+#define        PCIE_CONFIG_ADDR(b, s, f, o)                                    \
+               ((((b) & PCIECFG_BUS_MASK) << PCIECFG_BUS_SHIFT)                \
+                | (((s) & PCIECFG_SLOT_MASK) << PCIECFG_SLOT_SHIFT)    \
+                | (((f) & PCIECFG_FUN_MASK) << PCIECFG_FUN_SHIFT)      \
+                | (((o) & PCIECFG_OFF_MASK) << PCIECFG_OFF_SHIFT))
+
+#define        PCIE_CONFIG_BUS(a)      (((a) >> PCIECFG_BUS_SHIFT) & PCIECFG_BUS_MASK)
+#define        PCIE_CONFIG_SLOT(a)     (((a) >> PCIECFG_SLOT_SHIFT) & PCIECFG_SLOT_MASK)
+#define        PCIE_CONFIG_FUN(a)      (((a) >> PCIECFG_FUN_SHIFT) & PCIECFG_FUN_MASK)
+#define        PCIE_CONFIG_OFF(a)      (((a) >> PCIECFG_OFF_SHIFT) & PCIECFG_OFF_MASK)
+
+/* The actual config space */
+
+#define        PCI_BAR_MAX             6
+
+#define        PCI_ROM_BAR             8
+
+#define        PCR_RSVDA_MAX           2
+
+/* Bits in PCI bars' flags */
+
+#define        PCIBAR_FLAGS            0xf
+#define        PCIBAR_IO               0x1
+#define        PCIBAR_MEM1M            0x2
+#define        PCIBAR_MEM64            0x4
+#define        PCIBAR_PREFETCH         0x8
+#define        PCIBAR_MEM32_MASK       0xFFFFFF80
+
+typedef struct _pci_config_regs {
+       uint16  vendor;
+       uint16  device;
+       uint16  command;
+       uint16  status;
+       uint8   rev_id;
+       uint8   prog_if;
+       uint8   sub_class;
+       uint8   base_class;
+       uint8   cache_line_size;
+       uint8   latency_timer;
+       uint8   header_type;
+       uint8   bist;
+       uint32  base[PCI_BAR_MAX];
+       uint32  cardbus_cis;
+       uint16  subsys_vendor;
+       uint16  subsys_id;
+       uint32  baserom;
+       uint32  rsvd_a[PCR_RSVDA_MAX];
+       uint8   int_line;
+       uint8   int_pin;
+       uint8   min_gnt;
+       uint8   max_lat;
+       uint8   dev_dep[192];
+} pci_config_regs;
+
+#define        SZPCR           (sizeof (pci_config_regs))
+#define        MINSZPCR        64              /* offsetof (dev_dep[0] */
+
+/* pci config status reg has a bit to indicate that capability ptr is present */
+
+#define PCI_CAPPTR_PRESENT     0x0010
+
+/* A structure for the config registers is nice, but in most
+ * systems the config space is not memory mapped, so we need
+ * field offsetts. :-(
+ */
+#define        PCI_CFG_VID             0
+#define        PCI_CFG_DID             2
+#define        PCI_CFG_CMD             4
+#define        PCI_CFG_STAT            6
+#define        PCI_CFG_REV             8
+#define        PCI_CFG_PROGIF          9
+#define        PCI_CFG_SUBCL           0xa
+#define        PCI_CFG_BASECL          0xb
+#define        PCI_CFG_CLSZ            0xc
+#define        PCI_CFG_LATTIM          0xd
+#define        PCI_CFG_HDR             0xe
+#define        PCI_CFG_BIST            0xf
+#define        PCI_CFG_BAR0            0x10
+#define        PCI_CFG_BAR1            0x18
+#define        PCI_CFG_BAR2            0x20
+#define        PCI_CFG_CIS             0x28
+#define        PCI_CFG_SVID            0x2c
+#define        PCI_CFG_SSID            0x2e
+#define        PCI_CFG_ROMBAR          0x30
+#define PCI_CFG_CAPPTR         0x34
+#define        PCI_CFG_INT             0x3c
+#define        PCI_CFG_PIN             0x3d
+#define        PCI_CFG_MINGNT          0x3e
+#define        PCI_CFG_MAXLAT          0x3f
+#define        PCI_CFG_DEVCTRL         0xd8
+#define PCI_CFG_TLCNTRL_5      0x814
+#define PCI_CFG_ERRATTN_MASK_FN0       0x8a0
+#define PCI_CFG_ERRATTN_STATUS_FN0     0x8a4
+#define PCI_CFG_ERRATTN_MASK_FN1       0x8a8
+#define PCI_CFG_ERRATTN_STATUS_FN1     0x8ac
+#define PCI_CFG_ERRATTN_MASK_CMN       0x8b0
+#define PCI_CFG_ERRATTN_STATUS_CMN     0x8b4
+
+/* Classes and subclasses */
+
+typedef enum {
+       PCI_CLASS_OLD = 0,
+       PCI_CLASS_DASDI,
+       PCI_CLASS_NET,
+       PCI_CLASS_DISPLAY,
+       PCI_CLASS_MMEDIA,
+       PCI_CLASS_MEMORY,
+       PCI_CLASS_BRIDGE,
+       PCI_CLASS_COMM,
+       PCI_CLASS_BASE,
+       PCI_CLASS_INPUT,
+       PCI_CLASS_DOCK,
+       PCI_CLASS_CPU,
+       PCI_CLASS_SERIAL,
+       PCI_CLASS_INTELLIGENT = 0xe,
+       PCI_CLASS_SATELLITE,
+       PCI_CLASS_CRYPT,
+       PCI_CLASS_DSP,
+       PCI_CLASS_XOR = 0xfe
+} pci_classes;
+
+typedef enum {
+       PCI_DASDI_SCSI,
+       PCI_DASDI_IDE,
+       PCI_DASDI_FLOPPY,
+       PCI_DASDI_IPI,
+       PCI_DASDI_RAID,
+       PCI_DASDI_OTHER = 0x80
+} pci_dasdi_subclasses;
+
+typedef enum {
+       PCI_NET_ETHER,
+       PCI_NET_TOKEN,
+       PCI_NET_FDDI,
+       PCI_NET_ATM,
+       PCI_NET_OTHER = 0x80
+} pci_net_subclasses;
+
+typedef enum {
+       PCI_DISPLAY_VGA,
+       PCI_DISPLAY_XGA,
+       PCI_DISPLAY_3D,
+       PCI_DISPLAY_OTHER = 0x80
+} pci_display_subclasses;
+
+typedef enum {
+       PCI_MMEDIA_VIDEO,
+       PCI_MMEDIA_AUDIO,
+       PCI_MMEDIA_PHONE,
+       PCI_MEDIA_OTHER = 0x80
+} pci_mmedia_subclasses;
+
+typedef enum {
+       PCI_MEMORY_RAM,
+       PCI_MEMORY_FLASH,
+       PCI_MEMORY_OTHER = 0x80
+} pci_memory_subclasses;
+
+typedef enum {
+       PCI_BRIDGE_HOST,
+       PCI_BRIDGE_ISA,
+       PCI_BRIDGE_EISA,
+       PCI_BRIDGE_MC,
+       PCI_BRIDGE_PCI,
+       PCI_BRIDGE_PCMCIA,
+       PCI_BRIDGE_NUBUS,
+       PCI_BRIDGE_CARDBUS,
+       PCI_BRIDGE_RACEWAY,
+       PCI_BRIDGE_OTHER = 0x80
+} pci_bridge_subclasses;
+
+typedef enum {
+       PCI_COMM_UART,
+       PCI_COMM_PARALLEL,
+       PCI_COMM_MULTIUART,
+       PCI_COMM_MODEM,
+       PCI_COMM_OTHER = 0x80
+} pci_comm_subclasses;
+
+typedef enum {
+       PCI_BASE_PIC,
+       PCI_BASE_DMA,
+       PCI_BASE_TIMER,
+       PCI_BASE_RTC,
+       PCI_BASE_PCI_HOTPLUG,
+       PCI_BASE_OTHER = 0x80
+} pci_base_subclasses;
+
+typedef enum {
+       PCI_INPUT_KBD,
+       PCI_INPUT_PEN,
+       PCI_INPUT_MOUSE,
+       PCI_INPUT_SCANNER,
+       PCI_INPUT_GAMEPORT,
+       PCI_INPUT_OTHER = 0x80
+} pci_input_subclasses;
+
+typedef enum {
+       PCI_DOCK_GENERIC,
+       PCI_DOCK_OTHER = 0x80
+} pci_dock_subclasses;
+
+typedef enum {
+       PCI_CPU_386,
+       PCI_CPU_486,
+       PCI_CPU_PENTIUM,
+       PCI_CPU_ALPHA = 0x10,
+       PCI_CPU_POWERPC = 0x20,
+       PCI_CPU_MIPS = 0x30,
+       PCI_CPU_COPROC = 0x40,
+       PCI_CPU_OTHER = 0x80
+} pci_cpu_subclasses;
+
+typedef enum {
+       PCI_SERIAL_IEEE1394,
+       PCI_SERIAL_ACCESS,
+       PCI_SERIAL_SSA,
+       PCI_SERIAL_USB,
+       PCI_SERIAL_FIBER,
+       PCI_SERIAL_SMBUS,
+       PCI_SERIAL_OTHER = 0x80
+} pci_serial_subclasses;
+
+typedef enum {
+       PCI_INTELLIGENT_I2O
+} pci_intelligent_subclasses;
+
+typedef enum {
+       PCI_SATELLITE_TV,
+       PCI_SATELLITE_AUDIO,
+       PCI_SATELLITE_VOICE,
+       PCI_SATELLITE_DATA,
+       PCI_SATELLITE_OTHER = 0x80
+} pci_satellite_subclasses;
+
+typedef enum {
+       PCI_CRYPT_NETWORK,
+       PCI_CRYPT_ENTERTAINMENT,
+       PCI_CRYPT_OTHER = 0x80
+} pci_crypt_subclasses;
+
+typedef enum {
+       PCI_DSP_DPIO,
+       PCI_DSP_OTHER = 0x80
+} pci_dsp_subclasses;
+
+typedef enum {
+       PCI_XOR_QDMA,
+       PCI_XOR_OTHER = 0x80
+} pci_xor_subclasses;
+
+/* Overlay for a PCI-to-PCI bridge */
+
+#define        PPB_RSVDA_MAX           2
+#define        PPB_RSVDD_MAX           8
+
+typedef struct _ppb_config_regs {
+       uint16  vendor;
+       uint16  device;
+       uint16  command;
+       uint16  status;
+       uint8   rev_id;
+       uint8   prog_if;
+       uint8   sub_class;
+       uint8   base_class;
+       uint8   cache_line_size;
+       uint8   latency_timer;
+       uint8   header_type;
+       uint8   bist;
+       uint32  rsvd_a[PPB_RSVDA_MAX];
+       uint8   prim_bus;
+       uint8   sec_bus;
+       uint8   sub_bus;
+       uint8   sec_lat;
+       uint8   io_base;
+       uint8   io_lim;
+       uint16  sec_status;
+       uint16  mem_base;
+       uint16  mem_lim;
+       uint16  pf_mem_base;
+       uint16  pf_mem_lim;
+       uint32  pf_mem_base_hi;
+       uint32  pf_mem_lim_hi;
+       uint16  io_base_hi;
+       uint16  io_lim_hi;
+       uint16  subsys_vendor;
+       uint16  subsys_id;
+       uint32  rsvd_b;
+       uint8   rsvd_c;
+       uint8   int_pin;
+       uint16  bridge_ctrl;
+       uint8   chip_ctrl;
+       uint8   diag_ctrl;
+       uint16  arb_ctrl;
+       uint32  rsvd_d[PPB_RSVDD_MAX];
+       uint8   dev_dep[192];
+} ppb_config_regs;
+
+/* Everything below is BRCM HND proprietary */
+
+/* Brcm PCI configuration registers */
+#define cap_list       rsvd_a[0]
+#define bar0_window    dev_dep[0x80 - 0x40]
+#define bar1_window    dev_dep[0x84 - 0x40]
+#define sprom_control  dev_dep[0x88 - 0x40]
+
+/* PCI CAPABILITY DEFINES */
+#define PCI_CAP_POWERMGMTCAP_ID                0x01
+#define PCI_CAP_MSICAP_ID              0x05
+#define PCI_CAP_VENDSPEC_ID            0x09
+#define PCI_CAP_PCIECAP_ID             0x10
+#define PCI_CAP_MSIXCAP_ID             0x11
+
+/* Data structure to define the Message Signalled Interrupt facility
+ * Valid for PCI and PCIE configurations
+ */
+typedef struct _pciconfig_cap_msi {
+       uint8   capID;
+       uint8   nextptr;
+       uint16  msgctrl;
+       uint32  msgaddr;
+} pciconfig_cap_msi;
+#define MSI_ENABLE     0x1             /* bit 0 of msgctrl */
+
+/* Data structure to define the Power managment facility
+ * Valid for PCI and PCIE configurations
+ */
+typedef struct _pciconfig_cap_pwrmgmt {
+       uint8   capID;
+       uint8   nextptr;
+       uint16  pme_cap;
+       uint16  pme_sts_ctrl;
+       uint8   pme_bridge_ext;
+       uint8   data;
+} pciconfig_cap_pwrmgmt;
+
+#define PME_CAP_PM_STATES (0x1f << 27) /* Bits 31:27 states that can generate PME */
+#define PME_CSR_OFFSET     0x4         /* 4-bytes offset */
+#define PME_CSR_PME_EN   (1 << 8)      /* Bit 8 Enable generating of PME */
+#define PME_CSR_PME_STAT  (1 << 15)    /* Bit 15 PME got asserted */
+
+/* Data structure to define the PCIE capability */
+typedef struct _pciconfig_cap_pcie {
+       uint8   capID;
+       uint8   nextptr;
+       uint16  pcie_cap;
+       uint32  dev_cap;
+       uint16  dev_ctrl;
+       uint16  dev_status;
+       uint32  link_cap;
+       uint16  link_ctrl;
+       uint16  link_status;
+       uint32  slot_cap;
+       uint16  slot_ctrl;
+       uint16  slot_status;
+       uint16  root_ctrl;
+       uint16  root_cap;
+       uint32  root_status;
+} pciconfig_cap_pcie;
+
+/* PCIE Enhanced CAPABILITY DEFINES */
+#define PCIE_EXTCFG_OFFSET     0x100
+#define PCIE_ADVERRREP_CAPID   0x0001
+#define PCIE_VC_CAPID          0x0002
+#define PCIE_DEVSNUM_CAPID     0x0003
+#define PCIE_PWRBUDGET_CAPID   0x0004
+
+/* PCIE Extended configuration */
+#define PCIE_ADV_CORR_ERR_MASK 0x114
+#define PCIE_ADV_CORR_ERR_MASK_OFFSET  0x14
+#define CORR_ERR_RE    (1 << 0) /* Receiver  */
+#define CORR_ERR_BT    (1 << 6) /* Bad TLP  */
+#define CORR_ERR_BD    (1 << 7) /* Bad DLLP */
+#define CORR_ERR_RR    (1 << 8) /* REPLAY_NUM rollover */
+#define CORR_ERR_RT    (1 << 12) /* Reply timer timeout */
+#define CORR_ERR_AE    (1 << 13) /* Adviosry Non-Fital Error Mask */
+#define ALL_CORR_ERRORS (CORR_ERR_RE | CORR_ERR_BT | CORR_ERR_BD | \
+                        CORR_ERR_RR | CORR_ERR_RT)
+
+/* PCIE Root Control Register bits (Host mode only) */
+#define        PCIE_RC_CORR_SERR_EN            0x0001
+#define        PCIE_RC_NONFATAL_SERR_EN        0x0002
+#define        PCIE_RC_FATAL_SERR_EN           0x0004
+#define        PCIE_RC_PME_INT_EN              0x0008
+#define        PCIE_RC_CRS_EN                  0x0010
+
+/* PCIE Root Capability Register bits (Host mode only) */
+#define        PCIE_RC_CRS_VISIBILITY          0x0001
+
+/* PCIe PMCSR Register bits */
+#define PCIE_PMCSR_PMESTAT             0x8000
+
+/* Header to define the PCIE specific capabilities in the extended config space */
+typedef struct _pcie_enhanced_caphdr {
+       uint16  capID;
+       uint16  cap_ver : 4;
+       uint16  next_ptr : 12;
+} pcie_enhanced_caphdr;
+
+#define        PCIE_CFG_PMCSR          0x4C
+#define        PCI_BAR0_WIN            0x80    /* backplane addres space accessed by BAR0 */
+#define        PCI_BAR1_WIN            0x84    /* backplane addres space accessed by BAR1 */
+#define        PCI_SPROM_CONTROL       0x88    /* sprom property control */
+#define        PCIE_CFG_SUBSYSTEM_CONTROL      0x88    /* used as subsystem control in PCIE devices */
+#define        PCI_BAR1_CONTROL        0x8c    /* BAR1 region burst control */
+#define        PCI_INT_STATUS          0x90    /* PCI and other cores interrupts */
+#define        PCI_INT_MASK            0x94    /* mask of PCI and other cores interrupts */
+#define PCI_TO_SB_MB           0x98    /* signal backplane interrupts */
+#define PCI_BACKPLANE_ADDR     0xa0    /* address an arbitrary location on the system backplane */
+#define PCI_BACKPLANE_DATA     0xa4    /* data at the location specified by above address */
+#define        PCI_CLK_CTL_ST          0xa8    /* pci config space clock control/status (>=rev14) */
+#define        PCI_BAR0_WIN2           0xac    /* backplane addres space accessed by second 4KB of BAR0 */
+#define        PCI_GPIO_IN             0xb0    /* pci config space gpio input (>=rev3) */
+#define        PCIE_CFG_DEVICE_CAPABILITY      0xb0    /* used as device capability in PCIE devices */
+#define        PCI_GPIO_OUT            0xb4    /* pci config space gpio output (>=rev3) */
+#define PCIE_CFG_DEVICE_CONTROL 0xb4    /* 0xb4 is used as device control in PCIE devices */
+#define PCIE_DC_AER_CORR_EN            (1u << 0u)
+#define PCIE_DC_AER_NON_FATAL_EN       (1u << 1u)
+#define PCIE_DC_AER_FATAL_EN           (1u << 2u)
+#define PCIE_DC_AER_UNSUP_EN           (1u << 3u)
+
+#define PCI_BAR0_WIN2_OFFSET           0x1000u
+#define PCIE2_BAR0_CORE2_WIN2_OFFSET   0x5000u
+
+#define        PCI_GPIO_OUTEN          0xb8    /* pci config space gpio output enable (>=rev3) */
+#define        PCI_L1SS_CTRL2          0x24c   /* The L1 PM Substates Control register */
+
+/* Private Registers */
+#define        PCI_STAT_CTRL           0xa80
+#define        PCI_L0_EVENTCNT         0xa84
+#define        PCI_L0_STATETMR         0xa88
+#define        PCI_L1_EVENTCNT         0xa8c
+#define        PCI_L1_STATETMR         0xa90
+#define        PCI_L1_1_EVENTCNT       0xa94
+#define        PCI_L1_1_STATETMR       0xa98
+#define        PCI_L1_2_EVENTCNT       0xa9c
+#define        PCI_L1_2_STATETMR       0xaa0
+#define        PCI_L2_EVENTCNT         0xaa4
+#define        PCI_L2_STATETMR         0xaa8
+
+#define        PCI_LINK_STATUS         0x4dc
+#define        PCI_LINK_SPEED_MASK     (15u << 0u)
+#define        PCI_LINK_SPEED_SHIFT    (0)
+#define PCIE_LNK_SPEED_GEN1            0x1
+#define PCIE_LNK_SPEED_GEN2            0x2
+#define PCIE_LNK_SPEED_GEN3            0x3
+
+#define        PCI_PL_SPARE    0x1808  /* Config to Increase external clkreq deasserted minimum time */
+#define        PCI_CONFIG_EXT_CLK_MIN_TIME_MASK        (1u << 31u)
+#define        PCI_CONFIG_EXT_CLK_MIN_TIME_SHIFT       (31)
+
+#define PCI_ADV_ERR_CAP                        0x100
+#define        PCI_UC_ERR_STATUS               0x104
+#define        PCI_UNCORR_ERR_MASK             0x108
+#define PCI_UCORR_ERR_SEVR             0x10c
+#define        PCI_CORR_ERR_STATUS             0x110
+#define        PCI_CORR_ERR_MASK               0x114
+#define        PCI_ERR_CAP_CTRL                0x118
+#define        PCI_TLP_HDR_LOG1                0x11c
+#define        PCI_TLP_HDR_LOG2                0x120
+#define        PCI_TLP_HDR_LOG3                0x124
+#define        PCI_TLP_HDR_LOG4                0x128
+#define        PCI_TL_CTRL_5                   0x814
+#define        PCI_TL_HDR_FC_ST                0x980
+#define        PCI_TL_TGT_CRDT_ST              0x990
+#define        PCI_TL_SMLOGIC_ST               0x998
+#define        PCI_DL_ATTN_VEC                 0x1040
+#define        PCI_DL_STATUS                   0x1048
+
+#define        PCI_PHY_CTL_0                   0x1800
+#define        PCI_SLOW_PMCLK_EXT_RLOCK        (1 << 7)
+#define PCI_REG_TX_DEEMPH_3_5_DB       (1 << 21)
+
+#define        PCI_LINK_STATE_DEBUG    0x1c24
+#define PCI_RECOVERY_HIST              0x1ce4
+#define PCI_PHY_LTSSM_HIST_0   0x1cec
+#define PCI_PHY_LTSSM_HIST_1   0x1cf0
+#define PCI_PHY_LTSSM_HIST_2   0x1cf4
+#define PCI_PHY_LTSSM_HIST_3   0x1cf8
+#define PCI_PHY_DBG_CLKREG_0   0x1e10
+#define PCI_PHY_DBG_CLKREG_1   0x1e14
+#define PCI_PHY_DBG_CLKREG_2   0x1e18
+#define PCI_PHY_DBG_CLKREG_3   0x1e1c
+
+#define PCI_TL_CTRL_0                   0x800u
+#define PCI_BEACON_DIS                  (1u << 20u)       /* Disable Beacon Generation */
+
+/* Bit settings for PCIE_CFG_SUBSYSTEM_CONTROL register */
+#define PCIE_BAR1COHERENTACCEN_BIT     8
+#define PCIE_BAR2COHERENTACCEN_BIT     9
+#define PCIE_SSRESET_STATUS_BIT                13
+#define PCIE_SSRESET_DISABLE_BIT       14
+#define PCIE_SSRESET_DIS_ENUM_RST_BIT          15
+
+#define PCIE_BARCOHERENTACCEN_MASK     0x300
+
+/* Bit settings for PCI_UC_ERR_STATUS register */
+#define PCI_UC_ERR_URES                        (1 << 20)       /* Unsupported Request Error Status */
+#define PCI_UC_ERR_ECRCS               (1 << 19)       /* ECRC Error Status */
+#define PCI_UC_ERR_MTLPS               (1 << 18)       /* Malformed TLP Status */
+#define PCI_UC_ERR_ROS                 (1 << 17)       /* Receiver Overflow Status */
+#define PCI_UC_ERR_UCS                 (1 << 16)       /* Unexpected Completion Status */
+#define PCI_UC_ERR_CAS                 (1 << 15)       /* Completer Abort Status */
+#define PCI_UC_ERR_CTS                 (1 << 14)       /* Completer Timeout Status */
+#define PCI_UC_ERR_FCPES               (1 << 13)       /* Flow Control Protocol Error Status */
+#define PCI_UC_ERR_PTLPS               (1 << 12)       /* Poisoned TLP Status */
+#define PCI_UC_ERR_DLPES               (1 << 4)        /* Data Link Protocol Error Status */
+
+#define PCI_DL_STATUS_PHY_LINKUP    (1 << 13) /* Status of LINK */
+
+#define        PCI_PMCR_REFUP          0x1814  /* Trefup time */
+#define PCI_PMCR_TREFUP_LO_MASK                0x3f
+#define PCI_PMCR_TREFUP_LO_SHIFT       24
+#define PCI_PMCR_TREFUP_LO_BITS                6
+#define PCI_PMCR_TREFUP_HI_MASK                0xf
+#define PCI_PMCR_TREFUP_HI_SHIFT       5
+#define PCI_PMCR_TREFUP_HI_BITS                4
+#define PCI_PMCR_TREFUP_MAX                    0x400
+#define PCI_PMCR_TREFUP_MAX_SCALE      0x2000
+
+#define        PCI_PMCR_REFUP_EXT      0x1818  /* Trefup extend Max */
+#define PCI_PMCR_TREFUP_EXT_SHIFT      22
+#define PCI_PMCR_TREFUP_EXT_SCALE      3
+#define PCI_PMCR_TREFUP_EXT_ON         1
+#define PCI_PMCR_TREFUP_EXT_OFF                0
+
+#define PCI_TPOWER_SCALE_MASK 0x3
+#define PCI_TPOWER_SCALE_SHIFT 3 /* 0:1 is scale and 2 is rsvd */
+
+#define        PCI_BAR0_SHADOW_OFFSET  (2 * 1024)      /* bar0 + 2K accesses sprom shadow (in pci core) */
+#define        PCI_BAR0_SPROM_OFFSET   (4 * 1024)      /* bar0 + 4K accesses external sprom */
+#define        PCI_BAR0_PCIREGS_OFFSET (6 * 1024)      /* bar0 + 6K accesses pci core registers */
+#define        PCI_BAR0_PCISBR_OFFSET  (4 * 1024)      /* pci core SB registers are at the end of the
+                                                * 8KB window, so their address is the "regular"
+                                                * address plus 4K
+                                                */
+/*
+ * PCIE GEN2 changed some of the above locations for
+ * Bar0WrapperBase, SecondaryBAR0Window and SecondaryBAR0WrapperBase
+ * BAR0 maps 32K of register space
+*/
+#define PCIE2_BAR0_WIN2                0x70 /* config register to map 2nd 4KB of BAR0 */
+#define PCIE2_BAR0_CORE2_WIN   0x74 /* config register to map 5th 4KB of BAR0 */
+#define PCIE2_BAR0_CORE2_WIN2  0x78 /* config register to map 6th 4KB of BAR0 */
+
+/* PCIE GEN2 BAR0 window size */
+#define PCIE2_BAR0_WINSZ       0x8000
+
+#define PCI_BAR0_WIN2_OFFSET           0x1000u
+#define PCI_CORE_ENUM_OFFSET           0x2000u
+#define PCI_CC_CORE_ENUM_OFFSET                0x3000u
+#define PCI_SEC_BAR0_WIN_OFFSET                0x4000u
+#define PCI_SEC_BAR0_WRAP_OFFSET       0x5000u
+#define PCI_CORE_ENUM2_OFFSET          0x6000u
+#define PCI_CC_CORE_ENUM2_OFFSET       0x7000u
+#define PCI_TER_BAR0_WIN_OFFSET                0x9000u
+#define PCI_TER_BAR0_WRAP_OFFSET       0xa000u
+
+#define PCI_BAR0_WINSZ         (16 * 1024)     /* bar0 window size Match with corerev 13 */
+/* On pci corerev >= 13 and all pcie, the bar0 is now 16KB and it maps: */
+#define        PCI_16KB0_PCIREGS_OFFSET (8 * 1024)     /* bar0 + 8K accesses pci/pcie core registers */
+#define        PCI_16KB0_CCREGS_OFFSET (12 * 1024)     /* bar0 + 12K accesses chipc core registers */
+#define PCI_16KBB0_WINSZ       (16 * 1024)     /* bar0 window size */
+#define PCI_SECOND_BAR0_OFFSET (16 * 1024)     /* secondary  bar 0 window */
+
+/* On AI chips we have a second window to map DMP regs are mapped: */
+#define        PCI_16KB0_WIN2_OFFSET   (4 * 1024)      /* bar0 + 4K is "Window 2" */
+
+/* PCI_INT_STATUS */
+#define        PCI_SBIM_STATUS_SERR    0x4     /* backplane SBErr interrupt status */
+
+/* PCI_INT_MASK */
+#define        PCI_SBIM_SHIFT          8       /* backplane core interrupt mask bits offset */
+#define        PCI_SBIM_MASK           0xff00  /* backplane core interrupt mask */
+#define        PCI_SBIM_MASK_SERR      0x4     /* backplane SBErr interrupt mask */
+#define        PCI_CTO_INT_SHIFT       16      /* backplane SBErr interrupt mask */
+#define        PCI_CTO_INT_MASK        (1 << PCI_CTO_INT_SHIFT)        /* backplane SBErr interrupt mask */
+
+/* PCI_SPROM_CONTROL */
+#define SPROM_SZ_MSK           0x02    /* SPROM Size Mask */
+#define SPROM_LOCKED           0x08    /* SPROM Locked */
+#define        SPROM_BLANK             0x04    /* indicating a blank SPROM */
+#define SPROM_WRITEEN          0x10    /* SPROM write enable */
+#define SPROM_BOOTROM_WE       0x20    /* external bootrom write enable */
+#define SPROM_BACKPLANE_EN     0x40    /* Enable indirect backplane access */
+#define SPROM_OTPIN_USE                0x80    /* device OTP In use */
+#define SPROM_BAR1_COHERENT_ACC_EN     0x100   /* PCIe acceeses through BAR1 are coherent */
+#define SPROM_BAR2_COHERENT_ACC_EN     0x200   /* PCIe acceeses through BAR2 are coherent */
+#define SPROM_CFG_TO_SB_RST    0x400   /* backplane reset */
+
+/* Bits in PCI command and status regs */
+#define PCI_CMD_IO             0x00000001      /* I/O enable */
+#define PCI_CMD_MEMORY         0x00000002      /* Memory enable */
+#define PCI_CMD_MASTER         0x00000004      /* Master enable */
+#define PCI_CMD_SPECIAL                0x00000008      /* Special cycles enable */
+#define PCI_CMD_INVALIDATE     0x00000010      /* Invalidate? */
+#define PCI_CMD_VGA_PAL                0x00000040      /* VGA Palate */
+#define PCI_STAT_TA            0x08000000      /* target abort status */
+
+/* Header types */
+#define        PCI_HEADER_MULTI        0x80
+#define        PCI_HEADER_MASK         0x7f
+typedef enum {
+       PCI_HEADER_NORMAL,
+       PCI_HEADER_BRIDGE,
+       PCI_HEADER_CARDBUS
+} pci_header_types;
+
+#define PCI_CONFIG_SPACE_SIZE  256
+
+#define DWORD_ALIGN(x)  ((x) & ~(0x03))
+#define BYTE_POS(x) ((x) & 0x3)
+#define WORD_POS(x) ((x) & 0x1)
+
+#define BYTE_SHIFT(x)  (8 * BYTE_POS(x))
+#define WORD_SHIFT(x)  (16 * WORD_POS(x))
+
+#define BYTE_VAL(a, x) ((a >> BYTE_SHIFT(x)) & 0xFF)
+#define WORD_VAL(a, x) ((a >> WORD_SHIFT(x)) & 0xFFFF)
+
+#define read_pci_cfg_byte(a) \
+       BYTE_VAL(OSL_PCI_READ_CONFIG(osh, DWORD_ALIGN(a), 4), a)
+
+#define read_pci_cfg_word(a) \
+       WORD_VAL(OSL_PCI_READ_CONFIG(osh, DWORD_ALIGN(a), 4), a)
+
+#define write_pci_cfg_byte(a, val) do {                                \
+       uint32 tmpval;                                          \
+       tmpval = OSL_PCI_READ_CONFIG(osh, DWORD_ALIGN(a), 4);   \
+       tmpval &= ~(0xFF << BYTE_SHIFT(a));                     \
+       tmpval |= ((uint8)(val)) << BYTE_SHIFT(a);              \
+       OSL_PCI_WRITE_CONFIG(osh, DWORD_ALIGN(a), 4, tmpval);   \
+       } while (0)
+
+#define write_pci_cfg_word(a, val) do { \
+       uint32 tmpval; \
+       tmpval = OSL_PCI_READ_CONFIG(osh, DWORD_ALIGN(a), 4);   \
+       tmpval &= ~(0xFFFF << WORD_SHIFT(a)));                  \
+       tmpval |= ((uint16)(val)) << WORD_SHIFT(a);             \
+       OSL_PCI_WRITE_CONFIG(osh, DWORD_ALIGN(a), 4, tmpval); \
+       } while (0)
+
+#endif /* _h_pcicfg_ */
diff --git a/bcmdhd.101.10.240.x/include/pcie_core.h b/bcmdhd.101.10.240.x/include/pcie_core.h
new file mode 100644 (file)
index 0000000..d4e7ff6
--- /dev/null
@@ -0,0 +1,1468 @@
+/*
+ * BCM43XX PCIE core hardware definitions.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+#ifndef        _PCIE_CORE_H
+#define        _PCIE_CORE_H
+
+#include <sbhnddma.h>
+#include <siutils.h>
+
+#define REV_GE_73(rev) (PCIECOREREV((rev)) >= 73)
+#define REV_GE_69(rev) (PCIECOREREV((rev)) >= 69)
+#define REV_GE_68(rev) (PCIECOREREV((rev)) >= 68)
+#define REV_GE_64(rev) (PCIECOREREV((rev)) >= 64)
+#define REV_GE_15(rev) (PCIECOREREV((rev)) >= 15)
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define        _PADLINE(line)  pad ## line
+#define        _XSTR(line)     _PADLINE(line)
+#define        PAD             _XSTR(__LINE__)
+#endif
+
+/* PCIE Enumeration space offsets */
+#define  PCIE_CORE_CONFIG_OFFSET       0x0
+#define  PCIE_FUNC0_CONFIG_OFFSET      0x400
+#define  PCIE_FUNC1_CONFIG_OFFSET      0x500
+#define  PCIE_FUNC2_CONFIG_OFFSET      0x600
+#define  PCIE_FUNC3_CONFIG_OFFSET      0x700
+#define  PCIE_SPROM_SHADOW_OFFSET      0x800
+#define  PCIE_SBCONFIG_OFFSET          0xE00
+
+#define PCIEDEV_MAX_DMAS                       4
+
+/* PCIE Bar0 Address Mapping. Each function maps 16KB config space */
+#define PCIE_DEV_BAR0_SIZE             0x4000
+#define PCIE_BAR0_WINMAPCORE_OFFSET    0x0
+#define PCIE_BAR0_EXTSPROM_OFFSET      0x1000
+#define PCIE_BAR0_PCIECORE_OFFSET      0x2000
+#define PCIE_BAR0_CCCOREREG_OFFSET     0x3000
+
+/* different register spaces to access thr'u pcie indirect access */
+#define PCIE_CONFIGREGS                1               /* Access to config space */
+#define PCIE_PCIEREGS          2               /* Access to pcie registers */
+
+#define PCIEDEV_HOSTADDR_MAP_BASE     0x8000000
+#define PCIEDEV_HOSTADDR_MAP_WIN_MASK 0xFE000000
+
+#define PCIEDEV_TR0_WINDOW_START 0x08000000
+#define PCIEDEV_TR0_WINDOW_END   0x09FFFFFF
+
+#define PCIEDEV_TR1_WINDOW_START 0x0A000000
+#define PCIEDEV_TR1_WINDOW_END   0x0BFFFFFF
+
+#define PCIEDEV_TR2_WINDOW_START 0x0C000000
+#define PCIEDEV_TR2_WINDOW_END   0x0DFFFFFF
+
+#define PCIEDEV_TR3_WINDOW_START 0x0E000000
+#define PCIEDEV_TR3_WINDOW_END   0x0FFFFFFF
+
+#define PCIEDEV_TRANS_WIN_LEN  0x2000000
+#define PCIEDEV_ARM_ADDR_SPACE 0x0FFFFFFF
+
+/* PCIe translation windoes */
+#define PCIEDEV_TRANS_WIN_0 0
+#define PCIEDEV_TRANS_WIN_1 1
+#define PCIEDEV_TRANS_WIN_2 2
+#define PCIEDEV_TRANS_WIN_3 3
+
+#define PCIEDEV_ARM_ADDR(host_addr, win) \
+       (((host_addr) & 0x1FFFFFF) | ((win) << 25) | PCIEDEV_HOSTADDR_MAP_BASE)
+
+/* Current mapping of PCIe translation windows to SW features */
+
+#define PCIEDEV_TRANS_WIN_TRAP_HANDLER PCIEDEV_TRANS_WIN_0
+#define PCIEDEV_TRANS_WIN_HOSTMEM      PCIEDEV_TRANS_WIN_1
+#define PCIEDEV_TRANS_WIN_SWPAGING     PCIEDEV_TRANS_WIN_1
+#define PCIEDEV_TRANS_WIN_BT           PCIEDEV_TRANS_WIN_2
+#define PCIEDEV_TRANS_WIN_UNUSED       PCIEDEV_TRANS_WIN_3
+
+/* dma regs to control the flow between host2dev and dev2host  */
+typedef volatile struct pcie_devdmaregs {
+       dma64regs_t     tx;
+       uint32          PAD[2];
+       dma64regs_t     rx;
+       uint32          PAD[2];
+} pcie_devdmaregs_t;
+
+#define PCIE_DB_HOST2DEV_0             0x1
+#define PCIE_DB_HOST2DEV_1             0x2
+#define PCIE_DB_DEV2HOST_0             0x3
+#define PCIE_DB_DEV2HOST_1             0x4
+#define PCIE_DB_DEV2HOST1_0            0x5
+
+/* door bell register sets */
+typedef struct pcie_doorbell {
+       uint32          host2dev_0;
+       uint32          host2dev_1;
+       uint32          dev2host_0;
+       uint32          dev2host_1;
+} pcie_doorbell_t;
+
+/* Flow Ring Manager */
+#define IFRM_FR_IDX_MAX                256
+#define IFRM_FR_CONFIG_GID     2
+#define IFRM_FR_GID_MAX                4
+#define IFRM_FR_DEV_MAX                8
+#define IFRM_FR_TID_MAX                8
+#define IFRM_FR_DEV_VALID      2
+
+#define IFRM_VEC_REG_BITS      32
+
+#define IFRM_FR_PER_VECREG                     4
+#define IFRM_FR_PER_VECREG_SHIFT       2
+#define IFRM_FR_PER_VECREG_MASK                ((0x1 << IFRM_FR_PER_VECREG_SHIFT) - 1)
+
+#define IFRM_VEC_BITS_PER_FR   (IFRM_VEC_REG_BITS/IFRM_FR_PER_VECREG)
+
+/* IFRM_DEV_0 : d11AC, IFRM_DEV_1 : d11AD */
+#define IFRM_DEV_0     0
+#define IFRM_DEV_1     1
+#define IHRM_FR_SW_MASK (1u << IFRM_DEV_0)
+#define IHRM_FR_HW_MASK (1u << IFRM_DEV_1)
+
+#define IFRM_FR_GID_0 0
+#define IFRM_FR_GID_1 1
+#define IFRM_FR_GID_2 2
+#define IFRM_FR_GID_3 3
+
+#define IFRM_TIDMASK 0xffffffff
+
+/* ifrm_ctrlst register */
+#define IFRM_EN (1<<0)
+#define IFRM_BUFF_INIT_DONE (1<<1)
+#define IFRM_COMPARE_EN0 (1<<4)
+#define IFRM_COMPARE_EN1 (1<<5)
+#define IFRM_COMPARE_EN2 (1<<6)
+#define IFRM_COMPARE_EN3 (1<<7)
+#define IFRM_INIT_DV0 (1<<8)
+#define IFRM_INIT_DV1 (1<<9)
+#define IFRM_INIT_DV2 (1<<10)
+#define IFRM_INIT_DV3 (1<<11)
+
+/* ifrm_msk_arr.addr, ifrm_tid_arr.addr register */
+#define IFRM_ADDR_SHIFT 0
+#define IFRM_FRG_ID_SHIFT 8
+
+/* ifrm_vec.diff_lat register */
+#define IFRM_DV_LAT                    (1<<0)
+#define IFRM_DV_LAT_DONE       (1<<1)
+#define IFRM_SDV_OFFSET_SHIFT  4
+#define IFRM_SDV_FRGID_SHIFT   8
+#define IFRM_VECSTAT_MASK              0x3
+#define IFRM_VEC_MASK                  0xff
+
+/* HMAP Windows */
+#define HMAP_MAX_WINDOWS       8
+
+/* idma frm array */
+typedef struct pcie_ifrm_array {
+       uint32          addr;
+       uint32          data;
+} pcie_ifrm_array_t;
+
+/* idma frm vector */
+typedef struct pcie_ifrm_vector {
+       uint32          diff_lat;
+       uint32          sav_tid;
+       uint32          sav_diff;
+       uint32          PAD[1];
+} pcie_ifrm_vector_t;
+
+/* idma frm interrupt */
+typedef struct pcie_ifrm_intr {
+       uint32          intstat;
+       uint32          intmask;
+} pcie_ifrm_intr_t;
+
+/* HMAP window register set */
+typedef volatile struct pcie_hmapwindow {
+       uint32 baseaddr_lo; /* BaseAddrLower */
+       uint32 baseaddr_hi; /* BaseAddrUpper */
+       uint32 windowlength; /* Window Length */
+       uint32  PAD[1];
+} pcie_hmapwindow_t;
+
+typedef struct pcie_hmapviolation {
+       uint32 hmap_violationaddr_lo;   /* violating address lo */
+       uint32 hmap_violationaddr_hi;   /* violating addr hi */
+       uint32 hmap_violation_info;     /* violation info */
+       uint32  PAD[1];
+} pcie_hmapviolation_t;
+
+/* SB side: PCIE core and host control registers */
+typedef volatile struct sbpcieregs {
+       uint32 control;         /* host mode only */
+       uint32 iocstatus;       /* PCIE2: iostatus */
+       uint32 PAD[1];
+       uint32 biststatus;      /* bist Status: 0x00C */
+       uint32 gpiosel;         /* PCIE gpio sel: 0x010 */
+       uint32 gpioouten;       /* PCIE gpio outen: 0x14 */
+       uint32 gpioout;         /* PCIE gpio out: 0x18 */
+       uint32 PAD;
+       uint32 intstatus;       /* Interrupt status: 0x20 */
+       uint32 intmask;         /* Interrupt mask: 0x24 */
+       uint32 sbtopcimailbox;  /* sb to pcie mailbox: 0x028 */
+       uint32 obffcontrol;     /* PCIE2: 0x2C */
+       uint32 obffintstatus;   /* PCIE2: 0x30 */
+       uint32 obffdatastatus;  /* PCIE2: 0x34 */
+       uint32 PAD[1];
+       uint32 ctoctrl;         /* PCIE2: 0x3C */
+       uint32 errlog;          /* PCIE2: 0x40 */
+       uint32 errlogaddr;      /* PCIE2: 0x44 */
+       uint32 mailboxint;      /* PCIE2: 0x48 */
+       uint32 mailboxintmsk; /* PCIE2: 0x4c */
+       uint32 ltrspacing;      /* PCIE2: 0x50 */
+       uint32 ltrhysteresiscnt;        /* PCIE2: 0x54 */
+       uint32 msivectorassign; /* PCIE2: 0x58 */
+       uint32 intmask2;        /* PCIE2: 0x5C */
+       uint32 PAD[40];
+       uint32 sbtopcie0;       /* sb to pcie translation 0: 0x100 */
+       uint32 sbtopcie1;       /* sb to pcie translation 1: 0x104 */
+       uint32 sbtopcie2;       /* sb to pcie translation 2: 0x108 */
+       uint32 sbtopcie0upper;  /* sb to pcie translation 0: 0x10C */
+       uint32 sbtopcie1upper;  /* sb to pcie translation 1: 0x110 */
+       uint32 PAD[3];
+
+       /* pcie core supports in direct access to config space */
+       uint32 configaddr;      /* pcie config space access: Address field: 0x120 */
+       uint32 configdata;      /* pcie config space access: Data field: 0x124 */
+       union {
+               struct {
+                       /* mdio access to serdes */
+                       uint32 mdiocontrol;     /* controls the mdio access: 0x128 */
+                       uint32 mdiodata;        /* Data to the mdio access: 0x12c */
+                       /* pcie protocol phy/dllp/tlp register indirect access mechanism */
+                       uint32 pcieindaddr; /* indirect access to the internal register: 0x130 */
+                       uint32 pcieinddata;     /* Data to/from the internal regsiter: 0x134 */
+                       uint32 clkreqenctrl;    /* >= rev 6, Clkreq rdma control : 0x138 */
+                       uint32 PAD[177]; /* last 0x3FC */
+                       /* 0x400 - 0x7FF, PCIE Cfg Space, note: not used anymore in PcieGen2 */
+                       uint32 pciecfg[4][64];
+               } pcie1;
+               struct {
+                       /* mdio access to serdes */
+                       uint32 mdiocontrol;     /* controls the mdio access: 0x128 */
+                       uint32 mdiowrdata;      /* write data to mdio 0x12C */
+                       uint32 mdiorddata;      /* read data to mdio 0x130 */
+                       uint32  PAD[3];         /* 0x134-0x138-0x13c */
+                       /* door bell registers available from gen2 rev5 onwards */
+                       pcie_doorbell_t    dbls[PCIEDEV_MAX_DMAS]; /* 0x140 - 0x17F */
+                       uint32  dataintf;       /* 0x180 */
+                       uint32  PAD[1];         /* 0x184 */
+                       uint32  d2h_intrlazy_0; /* 0x188 */
+                       uint32  h2d_intrlazy_0; /* 0x18c */
+                       uint32  h2d_intstat_0;  /* 0x190 */
+                       uint32  h2d_intmask_0;  /* 0x194 */
+                       uint32  d2h_intstat_0;  /* 0x198 */
+                       uint32  d2h_intmask_0;  /* 0x19c */
+                       uint32  ltr_state;      /* 0x1A0 */
+                       uint32  pwr_int_status; /* 0x1A4 */
+                       uint32  pwr_int_mask;   /* 0x1A8 */
+                       uint32  pme_source; /* 0x1AC */
+                       uint32  err_hdr_logreg1; /* 0x1B0 */
+                       uint32  err_hdr_logreg2; /* 0x1B4 */
+                       uint32  err_hdr_logreg3; /* 0x1B8 */
+                       uint32  err_hdr_logreg4; /* 0x1BC */
+                       uint32  err_code_logreg; /* 0x1C0 */
+                       uint32  axi_dbg_ctl; /* 0x1C4 */
+                       uint32  axi_dbg_data0; /* 0x1C8 */
+                       uint32  axi_dbg_data1; /* 0x1CC */
+                       uint32  PAD[4]; /* 0x1D0 - 0x1DF */
+                       uint32  clk_ctl_st;     /* 0x1E0 */
+                       uint32  PAD[1];         /* 0x1E4 */
+                       uint32  powerctl;       /* 0x1E8 */
+                       uint32  powerctl2;      /* 0x1EC */
+                       uint32  PAD[4];         /* 0x1F0 - 0x1FF */
+                       pcie_devdmaregs_t  h2d0_dmaregs; /* 0x200 - 0x23c */
+                       pcie_devdmaregs_t  d2h0_dmaregs; /* 0x240 - 0x27c */
+                       pcie_devdmaregs_t  h2d1_dmaregs; /* 0x280 - 0x2bc */
+                       pcie_devdmaregs_t  d2h1_dmaregs; /* 0x2c0 - 0x2fc */
+                       pcie_devdmaregs_t  h2d2_dmaregs; /* 0x300 - 0x33c */
+                       pcie_devdmaregs_t  d2h2_dmaregs; /* 0x340 - 0x37c */
+                       pcie_devdmaregs_t  h2d3_dmaregs; /* 0x380 - 0x3bc */
+                       pcie_devdmaregs_t  d2h3_dmaregs; /* 0x3c0 - 0x3fc */
+                       uint32  d2h_intrlazy_1; /* 0x400 */
+                       uint32  h2d_intrlazy_1; /* 0x404 */
+                       uint32  h2d_intstat_1;  /* 0x408 */
+                       uint32  h2d_intmask_1;  /* 0x40c */
+                       uint32  d2h_intstat_1;  /* 0x410 */
+                       uint32  d2h_intmask_1;  /* 0x414 */
+                       uint32  PAD[2];                 /* 0x418 - 0x41C */
+                       uint32  d2h_intrlazy_2; /* 0x420 */
+                       uint32  h2d_intrlazy_2; /* 0x424 */
+                       uint32  h2d_intstat_2;  /* 0x428 */
+                       uint32  h2d_intmask_2;  /* 0x42c */
+                       uint32  d2h_intstat_2;  /* 0x430 */
+                       uint32  d2h_intmask_2;  /* 0x434 */
+                       uint32  PAD[10];                /* 0x438 - 0x45F */
+                       uint32  ifrm_ctrlst;    /* 0x460 */
+                       uint32  PAD[1];                 /* 0x464 */
+                       pcie_ifrm_array_t       ifrm_msk_arr;           /* 0x468 - 0x46F */
+                       pcie_ifrm_array_t       ifrm_tid_arr[IFRM_FR_DEV_VALID];
+                               /* 0x470 - 0x47F */
+                       pcie_ifrm_vector_t      ifrm_vec[IFRM_FR_DEV_MAX];
+                               /* 0x480 - 0x4FF */
+                       pcie_ifrm_intr_t        ifrm_intr[IFRM_FR_DEV_MAX];
+                               /* 0x500 - 0x53F */
+                               /* HMAP regs for PCIE corerev >= 24  [0x540 - 0x5DF] */
+                       pcie_hmapwindow_t       hmapwindow[HMAP_MAX_WINDOWS];   /* 0x540 - 0x5BF */
+                       pcie_hmapviolation_t hmapviolation;     /* 0x5C0 - 0x5CF */
+                       uint32 hmap_window_config;      /* 0x5D0 */
+                       uint32  PAD[3];                 /* 0x5D4 - 0x5DF */
+                       uint32  idma_hwa_status;        /* 0x5E0 */
+                       uint32  PAD[7];                 /* 0x5E4 - 0x5FF */
+                       uint32  PAD[2][64];             /* 0x600 - 0x7FF */
+               } pcie2;
+       } u;
+       uint16  sprom[64];              /* SPROM shadow Area : 0x800 - 0x880 */
+       uint32  PAD[96];                /* 0x880 - 0x9FF */
+       /* direct memory access (pcie2 rev19 and after) : 0xA00 - 0xAFF */
+       union {
+               /* corerev < 64 */
+               struct {
+                       uint32          dar_ctrl;               /* 0xA00 */
+                       uint32          PAD[7];                 /* 0xA04-0xA1F */
+                       uint32          intstatus;              /* 0xA20 */
+                       uint32          PAD[1];                 /* 0xA24 */
+                       uint32          h2d_db_0_0;             /* 0xA28 */
+                       uint32          h2d_db_0_1;             /* 0xA2C */
+                       uint32          h2d_db_1_0;             /* 0xA30 */
+                       uint32          h2d_db_1_1;             /* 0xA34 */
+                       uint32          h2d_db_2_0;             /* 0xA38 */
+                       uint32          h2d_db_2_1;             /* 0xA3C */
+                       uint32          errlog;                 /* 0xA40 */
+                       uint32          erraddr;                /* 0xA44 */
+                       uint32          mbox_int;               /* 0xA48 */
+                       uint32          fis_ctrl;               /* 0xA4C */
+                       uint32          PAD[36];                /* 0xA50 - 0xADC */
+                       uint32          clk_ctl_st;             /* 0xAE0 */
+                       uint32          PAD[1];                 /* 0xAE4 */
+                       uint32          powerctl;               /* 0xAE8 */
+                       uint32          PAD[5];                 /* 0xAEC-0xAFF */
+               } dar;
+               /* corerev > = 64 */
+               struct {
+                       uint32          dar_ctrl;               /* 0xA00 */
+                       uint32          dar_cap;                /* 0xA04 */
+                       uint32          clk_ctl_st;             /* 0xA08 */
+                       uint32          powerctl;               /* 0xA0C */
+                       uint32          intstatus;              /* 0xA10 */
+                       uint32          PAD[3];                 /* 0xA14-0xA1F */
+                       uint32          h2d_db_0_0;             /* 0xA20 */
+                       uint32          h2d_db_0_1;             /* 0xA24 */
+                       uint32          h2d_db_1_0;             /* 0xA28 */
+                       uint32          h2d_db_1_1;             /* 0xA2C */
+                       uint32          h2d_db_2_0;             /* 0xA30 */
+                       uint32          h2d_db_2_1;             /* 0xA34 */
+                       uint32          h2d_db_3_0;             /* 0xA38 */
+                       uint32          h2d_db_3_1;             /* 0xA3C */
+                       uint32          h2d_db_4_0;             /* 0xA40 */
+                       uint32          h2d_db_4_1;             /* 0xA44 */
+                       uint32          h2d_db_5_0;             /* 0xA48 */
+                       uint32          h2d_db_5_1;             /* 0xA4C */
+                       uint32          h2d_db_6_0;             /* 0xA50 */
+                       uint32          h2d_db_6_1;             /* 0xA54 */
+                       uint32          h2d_db_7_0;             /* 0xA58 */
+                       uint32          h2d_db_7_1;             /* 0xA5C */
+                       uint32          errlog;                 /* 0xA60 */
+                       uint32          erraddr;                /* 0xA64 */
+                       uint32          mbox_int;               /* 0xA68 */
+                       uint32          fis_ctrl;               /* 0xA6C */
+                       uint32          PAD[36];                /* 0xA70-0xAFF */
+               } dar_64;
+       } u1;
+       uint32          PAD[64];                /* 0xB00-0xBFF */
+       /* Function Control/Status Registers for corerev >= 64 */
+       /* 0xC00 - 0xCFF */
+       struct {
+               uint32          control;                /* 0xC00 */
+               uint32          iostatus;               /* 0xC04 */
+               uint32          capability;             /* 0xC08 */
+               uint32          PAD[1];                 /* 0xC0C */
+               uint32          intstatus;              /* 0xC10 */
+               uint32          intmask;                /* 0xC14 */
+               uint32          pwr_intstatus;  /* 0xC18 */
+               uint32          pwr_intmask;    /* 0xC1C */
+               uint32          msi_vector;             /* 0xC20 */
+               uint32          msi_intmask;    /* 0xC24 */
+               uint32          msi_intstatus;  /* 0xC28 */
+               uint32          msi_pend_cnt;   /* 0xC2C */
+               uint32          mbox_intstatus; /* 0xC30 */
+               uint32          mbox_intmask;   /* 0xC34 */
+               uint32          ltr_state;              /* 0xC38 */
+               uint32          PAD[1];                 /* 0xC3C */
+               uint32          intr_vector;    /* 0xC40 */
+               uint32          intr_addrlow;   /* 0xC44 */
+               uint32          intr_addrhigh;  /* 0xC48 */
+               uint32          PAD[45];                /* 0xC4C-0xCFF */
+       } ftn_ctrl;
+} sbpcieregs_t;
+       /* defined(BCMINTERNAL) || defined(ATE_BUILD) defined(BCMDVFS) */
+
+#define PCIE_CFG_DA_OFFSET 0x400       /* direct access register offset for configuration space */
+
+/* 10th and 11th 4KB BAR0 windows */
+#define PCIE_TER_BAR0_WIN      0xc50
+#define PCIE_TER_BAR0_WRAPPER  0xc54
+
+/* PCI control */
+#define PCIE_RST_OE    0x01    /* When set, drives PCI_RESET out to pin */
+#define PCIE_RST       0x02    /* Value driven out to pin */
+#define PCIE_SPERST    0x04    /* SurvivePeRst */
+#define PCIE_FORCECFGCLKON_ALP 0x08
+#define PCIE_DISABLE_L1CLK_GATING      0x10
+#define PCIE_DLYPERST  0x100   /* Delay PeRst to CoE Core */
+#define PCIE_DISSPROMLD        0x200   /* DisableSpromLoadOnPerst */
+#define PCIE_WakeModeL2        0x1000  /* Wake on L2 */
+#define PCIE_MULTIMSI_EN               0x2000  /* enable multi-vector MSI messages */
+#define PCIE_PipeIddqDisable0  0x8000  /* Disable assertion of pcie_pipe_iddq during L1.2 and L2 */
+#define PCIE_PipeIddqDisable1  0x10000 /* Disable assertion of pcie_pipe_iddq during L2 */
+#define PCIE_EN_MDIO_IN_PERST  0x20000 /* enable access to internal registers when PERST */
+#define PCIE_HWDisableL1EntryEnable 0x40000 /* set, Hw requests can do entry/exit from L1 ASPM */
+#define PCIE_MSI_B2B_EN                0x100000        /* enable back-to-back MSI messages */
+#define PCIE_MSI_FIFO_CLEAR    0x200000        /* reset MSI FIFO */
+#define PCIE_IDMA_MODE_EN(rev) (REV_GE_64(rev) ? 0x1 : 0x800000) /* implicit M2M DMA mode */
+#define PCIE_TL_CLK_DETCT      0x4000000       /* enable TL clk detection */
+#define PCIE_REQ_PEND_DIS_L1   0x1000000 /* prevents entering L1 on pending requests from host */
+#define PCIE_DIS_L23CLK_GATE   0x10000000      /* disable clk gating in L23(pcie_tl_clk) */
+#define PCIE_HWA_IDX_UPD_EN    0x10000000      /* enable the HWA interface to iDMA */
+
+/* Function control (corerev > 64) */
+#define PCIE_CPLCA_ENABLE              0x01
+/* 1: send CPL with CA on BP error, 0: send CPLD with SC and data is FFFF */
+#define PCIE_DLY_PERST_TO_COE  0x02
+/* when set, PERST is holding asserted until sprom-related register updates has completed */
+
+#define        PCIE_CFGADDR    0x120   /* offsetof(configaddr) */
+#define        PCIE_CFGDATA    0x124   /* offsetof(configdata) */
+#define PCIE_SWPME_FN0 0x10000
+#define PCIE_SWPME_FN0_SHF 16
+
+/* Interrupt status/mask */
+#define PCIE_INTA      0x01    /* PCIE INTA message is received */
+#define PCIE_INTB      0x02    /* PCIE INTB message is received */
+#define PCIE_INTFATAL  0x04    /* PCIE INTFATAL message is received */
+#define PCIE_INTNFATAL 0x08    /* PCIE INTNONFATAL message is received */
+#define PCIE_INTCORR   0x10    /* PCIE INTCORR message is received */
+#define PCIE_INTPME    0x20    /* PCIE INTPME message is received */
+#define PCIE_PERST     0x40    /* PCIE Reset Interrupt */
+
+#define PCIE_INT_MB_FN0_0 0x0100 /* PCIE to SB Mailbox int Fn0.0 is received */
+#define PCIE_INT_MB_FN0_1 0x0200 /* PCIE to SB Mailbox int Fn0.1 is received */
+#define PCIE_INT_MB_FN1_0 0x0400 /* PCIE to SB Mailbox int Fn1.0 is received */
+#define PCIE_INT_MB_FN1_1 0x0800 /* PCIE to SB Mailbox int Fn1.1 is received */
+#define PCIE_INT_MB_FN2_0 0x1000 /* PCIE to SB Mailbox int Fn2.0 is received */
+#define PCIE_INT_MB_FN2_1 0x2000 /* PCIE to SB Mailbox int Fn2.1 is received */
+#define PCIE_INT_MB_FN3_0 0x4000 /* PCIE to SB Mailbox int Fn3.0 is received */
+#define PCIE_INT_MB_FN3_1 0x8000 /* PCIE to SB Mailbox int Fn3.1 is received */
+
+/* PCIE MSI Vector Assignment register */
+#define MSIVEC_MB_0    (0x1 << 1) /* MSI Vector offset for mailbox0 is 2 */
+#define MSIVEC_MB_1    (0x1 << 2) /* MSI Vector offset for mailbox1 is 3 */
+#define MSIVEC_D2H0_DB0        (0x1 << 3) /* MSI Vector offset for interface0 door bell 0 is 4 */
+#define MSIVEC_D2H0_DB1        (0x1 << 4) /* MSI Vector offset for interface0 door bell 1 is 5 */
+
+/* PCIE MailboxInt/MailboxIntMask register */
+#define PCIE_MB_TOSB_FN0_0     0x0001 /* write to assert PCIEtoSB Mailbox interrupt */
+#define PCIE_MB_TOSB_FN0_1     0x0002
+#define PCIE_MB_TOSB_FN1_0     0x0004
+#define PCIE_MB_TOSB_FN1_1     0x0008
+#define PCIE_MB_TOSB_FN2_0     0x0010
+#define PCIE_MB_TOSB_FN2_1     0x0020
+#define PCIE_MB_TOSB_FN3_0     0x0040
+#define PCIE_MB_TOSB_FN3_1     0x0080
+#define PCIE_MB_TOPCIE_FN0_0   0x0100 /* int status/mask for SBtoPCIE Mailbox interrupts */
+#define PCIE_MB_TOPCIE_FN0_1   0x0200
+#define PCIE_MB_TOPCIE_FN1_0   0x0400
+#define PCIE_MB_TOPCIE_FN1_1   0x0800
+#define PCIE_MB_TOPCIE_FN2_0   0x1000
+#define PCIE_MB_TOPCIE_FN2_1   0x2000
+#define PCIE_MB_TOPCIE_FN3_0   0x4000
+#define PCIE_MB_TOPCIE_FN3_1   0x8000
+
+#define PCIE_MB_TOPCIE_DB0_D2H0(rev)   (REV_GE_64(rev) ? 0x0001 : 0x010000)
+#define PCIE_MB_TOPCIE_DB0_D2H1(rev)   (REV_GE_64(rev) ? 0x0002 : 0x020000)
+#define PCIE_MB_TOPCIE_DB1_D2H0(rev)   (REV_GE_64(rev) ? 0x0004 : 0x040000)
+#define PCIE_MB_TOPCIE_DB1_D2H1(rev)   (REV_GE_64(rev) ? 0x0008 : 0x080000)
+#define PCIE_MB_TOPCIE_DB2_D2H0(rev)   (REV_GE_64(rev) ? 0x0010 : 0x100000)
+#define PCIE_MB_TOPCIE_DB2_D2H1(rev)   (REV_GE_64(rev) ? 0x0020 : 0x200000)
+#define PCIE_MB_TOPCIE_DB3_D2H0(rev)   (REV_GE_64(rev) ? 0x0040 : 0x400000)
+#define PCIE_MB_TOPCIE_DB3_D2H1(rev)   (REV_GE_64(rev) ? 0x0080 : 0x800000)
+#define PCIE_MB_TOPCIE_DB4_D2H0(rev)   (REV_GE_64(rev) ? 0x0100 : 0x0)
+#define PCIE_MB_TOPCIE_DB4_D2H1(rev)   (REV_GE_64(rev) ? 0x0200 : 0x0)
+#define PCIE_MB_TOPCIE_DB5_D2H0(rev)   (REV_GE_64(rev) ? 0x0400 : 0x0)
+#define PCIE_MB_TOPCIE_DB5_D2H1(rev)   (REV_GE_64(rev) ? 0x0800 : 0x0)
+#define PCIE_MB_TOPCIE_DB6_D2H0(rev)   (REV_GE_64(rev) ? 0x1000 : 0x0)
+#define PCIE_MB_TOPCIE_DB6_D2H1(rev)   (REV_GE_64(rev) ? 0x2000 : 0x0)
+#define PCIE_MB_TOPCIE_DB7_D2H0(rev)   (REV_GE_64(rev) ? 0x4000 : 0x0)
+#define PCIE_MB_TOPCIE_DB7_D2H1(rev)   (REV_GE_64(rev) ? 0x8000 : 0x0)
+
+#define PCIE_MB_D2H_MB_MASK(rev)               \
+       (PCIE_MB_TOPCIE_DB0_D2H0(rev) | PCIE_MB_TOPCIE_DB0_D2H1(rev) |  \
+       PCIE_MB_TOPCIE_DB1_D2H0(rev)  | PCIE_MB_TOPCIE_DB1_D2H1(rev) |  \
+       PCIE_MB_TOPCIE_DB2_D2H0(rev)  | PCIE_MB_TOPCIE_DB2_D2H1(rev) |  \
+       PCIE_MB_TOPCIE_DB3_D2H0(rev)  | PCIE_MB_TOPCIE_DB3_D2H1(rev) |  \
+       PCIE_MB_TOPCIE_DB4_D2H0(rev)  | PCIE_MB_TOPCIE_DB4_D2H1(rev) |  \
+       PCIE_MB_TOPCIE_DB5_D2H0(rev)  | PCIE_MB_TOPCIE_DB5_D2H1(rev) |  \
+       PCIE_MB_TOPCIE_DB6_D2H0(rev)  | PCIE_MB_TOPCIE_DB6_D2H1(rev) |  \
+       PCIE_MB_TOPCIE_DB7_D2H0(rev)  | PCIE_MB_TOPCIE_DB7_D2H1(rev))
+
+#define SBTOPCIE0_BASE 0x08000000
+#define SBTOPCIE1_BASE 0x0c000000
+
+/* Protection Control register */
+#define        PROTECT_CFG                             (1 << 0)
+#define        PROTECT_DMABADDR                (1 << 1)
+
+#define        PROTECT_FN_CFG_WRITE            (1 << 0)
+#define        PROTECT_FN_CFG_READ             (1 << 1)
+#define        PROTECT_FN_ENUM_WRITE           (1 << 2)
+#define        PROTECT_FN_ENUM_READ            (1 << 3)
+#define        PROTECT_FN_DMABADDR             (1 << 4)
+
+/* On chips with CCI-400, the small pcie 128 MB region base has shifted */
+#define CCI400_SBTOPCIE0_BASE  0x20000000
+#define CCI400_SBTOPCIE1_BASE  0x24000000
+
+/* SB to PCIE translation masks */
+#define SBTOPCIE0_MASK 0xfc000000
+#define SBTOPCIE1_MASK 0xfc000000
+#define SBTOPCIE2_MASK 0xc0000000
+
+/* Access type bits (0:1) */
+#define SBTOPCIE_MEM   0
+#define SBTOPCIE_IO    1
+#define SBTOPCIE_CFG0  2
+#define SBTOPCIE_CFG1  3
+
+/* Prefetch enable bit 2 */
+#define SBTOPCIE_PF            4
+
+/* Write Burst enable for memory write bit 3 */
+#define SBTOPCIE_WR_BURST      8
+
+/* config access */
+#define CONFIGADDR_FUNC_MASK   0x7000
+#define CONFIGADDR_FUNC_SHF    12
+#define CONFIGADDR_REG_MASK    0x0FFF
+#define CONFIGADDR_REG_SHF     0
+
+#define PCIE_CONFIG_INDADDR(f, r)      ((((f) & CONFIGADDR_FUNC_MASK) << CONFIGADDR_FUNC_SHF) | \
+                                        (((r) & CONFIGADDR_REG_MASK) << CONFIGADDR_REG_SHF))
+
+/* PCIE protocol regs Indirect Address */
+#define PCIEADDR_PROT_MASK     0x300
+#define PCIEADDR_PROT_SHF      8
+#define PCIEADDR_PL_TLP                0
+#define PCIEADDR_PL_DLLP       1
+#define PCIEADDR_PL_PLP                2
+
+#define        PCIE_CORE_REG_CONTROL           0x00u   /* Control     */
+#define        PCIE_CORE_REG_IOSTATUS          0x04u   /* IO status   */
+#define        PCIE_CORE_REG_BITSTATUS         0x0Cu   /* bitstatus   */
+#define        PCIE_CORE_REG_GPIO_SEL          0x10u   /* gpio sel    */
+#define        PCIE_CORE_REG_GPIO_OUT_EN       0x14u   /* gpio out en */
+#define        PCIE_CORE_REG_INT_STATUS        0x20u   /* int status  */
+#define        PCIE_CORE_REG_INT_MASK          0x24u   /* int mask    */
+#define        PCIE_CORE_REG_SB_PCIE_MB        0x28u   /* sbpcie mb   */
+#define        PCIE_CORE_REG_ERRLOG            0x40u   /* errlog      */
+#define        PCIE_CORE_REG_ERR_ADDR          0x44u   /* errlog addr */
+#define        PCIE_CORE_REG_MB_INTR           0x48u   /* MB intr     */
+#define        PCIE_CORE_REG_SB_PCIE_0         0x100u  /* sbpcie0 map */
+#define        PCIE_CORE_REG_SB_PCIE_1         0x104u  /* sbpcie1 map */
+#define        PCIE_CORE_REG_SB_PCIE_2         0x108u  /* sbpcie2 map */
+
+/* PCIE Config registers */
+#define        PCIE_CFG_DEV_STS_CTRL_2         0x0d4u  /* "dev_sts_control_2  */
+#define        PCIE_CFG_ADV_ERR_CAP            0x100u  /* adv_err_cap         */
+#define        PCIE_CFG_UC_ERR_STS             0x104u  /* uc_err_status       */
+#define        PCIE_CFG_UC_ERR_MASK            0x108u  /* ucorr_err_mask      */
+#define        PCIE_CFG_UNCOR_ERR_SERV         0x10cu  /* ucorr_err_sevr      */
+#define        PCIE_CFG_CORR_ERR_STS           0x110u  /* corr_err_status     */
+#define        PCIE_CFG_CORR_ERR_MASK          0x114u  /* corr_err_mask       */
+#define        PCIE_CFG_ADV_ERR_CTRL           0x118u  /* adv_err_cap_control */
+#define        PCIE_CFG_HDR_LOG1               0x11Cu  /* header_log1         */
+#define        PCIE_CFG_HDR_LOG2               0x120u  /* header_log2         */
+#define        PCIE_CFG_HDR_LOG3               0x124u  /* header_log3         */
+#define        PCIE_CFG_HDR_LOG4               0x128u  /* header_log4         */
+#define        PCIE_CFG_PML1_SUB_CAP_ID        0x240u  /* PML1sub_capID       */
+#define        PCIE_CFG_PML1_SUB_CAP_REG       0x244u  /* PML1_sub_Cap_reg    */
+#define        PCIE_CFG_PML1_SUB_CTRL1         0x248u  /* PML1_sub_control1   */
+#define        PCIE_CFG_PML1_SUB_CTRL3         0x24Cu  /* PML1_sub_control2   */
+#define        PCIE_CFG_TL_CTRL_5              0x814u  /* tl_control_5        */
+#define        PCIE_CFG_PHY_ERR_ATT_VEC        0x1820u /* phy_err_attn_vec    */
+#define        PCIE_CFG_PHY_ERR_ATT_MASK       0x1824u /* phy_err_attn_mask   */
+
+/* PCIE protocol PHY diagnostic registers */
+#define        PCIE_PLP_MODEREG                0x200u /* Mode */
+#define        PCIE_PLP_STATUSREG              0x204u /* Status */
+#define PCIE_PLP_LTSSMCTRLREG          0x208u /* LTSSM control */
+#define PCIE_PLP_LTLINKNUMREG          0x20cu /* Link Training Link number */
+#define PCIE_PLP_LTLANENUMREG          0x210u /* Link Training Lane number */
+#define PCIE_PLP_LTNFTSREG             0x214u /* Link Training N_FTS */
+#define PCIE_PLP_ATTNREG               0x218u /* Attention */
+#define PCIE_PLP_ATTNMASKREG           0x21Cu /* Attention Mask */
+#define PCIE_PLP_RXERRCTR              0x220u /* Rx Error */
+#define PCIE_PLP_RXFRMERRCTR           0x224u /* Rx Framing Error */
+#define PCIE_PLP_RXERRTHRESHREG                0x228u /* Rx Error threshold */
+#define PCIE_PLP_TESTCTRLREG           0x22Cu /* Test Control reg */
+#define PCIE_PLP_SERDESCTRLOVRDREG     0x230u /* SERDES Control Override */
+#define PCIE_PLP_TIMINGOVRDREG         0x234u /* Timing param override */
+#define PCIE_PLP_RXTXSMDIAGREG         0x238u /* RXTX State Machine Diag */
+#define PCIE_PLP_LTSSMDIAGREG          0x23Cu /* LTSSM State Machine Diag */
+
+/* PCIE protocol DLLP diagnostic registers */
+#define PCIE_DLLP_LCREG                        0x100u /* Link Control */
+#define PCIE_DLLP_LSREG                        0x104u /* Link Status */
+#define PCIE_DLLP_LAREG                        0x108u /* Link Attention */
+#define PCIE_DLLP_LAMASKREG            0x10Cu /* Link Attention Mask */
+#define PCIE_DLLP_NEXTTXSEQNUMREG      0x110u /* Next Tx Seq Num */
+#define PCIE_DLLP_ACKEDTXSEQNUMREG     0x114u /* Acked Tx Seq Num */
+#define PCIE_DLLP_PURGEDTXSEQNUMREG    0x118u /* Purged Tx Seq Num */
+#define PCIE_DLLP_RXSEQNUMREG          0x11Cu /* Rx Sequence Number */
+#define PCIE_DLLP_LRREG                        0x120u /* Link Replay */
+#define PCIE_DLLP_LACKTOREG            0x124u /* Link Ack Timeout */
+#define PCIE_DLLP_PMTHRESHREG          0x128u /* Power Management Threshold */
+#define PCIE_DLLP_RTRYWPREG            0x12Cu /* Retry buffer write ptr */
+#define PCIE_DLLP_RTRYRPREG            0x130u /* Retry buffer Read ptr */
+#define PCIE_DLLP_RTRYPPREG            0x134u /* Retry buffer Purged ptr */
+#define PCIE_DLLP_RTRRWREG             0x138u /* Retry buffer Read/Write */
+#define PCIE_DLLP_ECTHRESHREG          0x13Cu /* Error Count Threshold */
+#define PCIE_DLLP_TLPERRCTRREG         0x140u /* TLP Error Counter */
+#define PCIE_DLLP_ERRCTRREG            0x144u /* Error Counter */
+#define PCIE_DLLP_NAKRXCTRREG          0x148u /* NAK Received Counter */
+#define PCIE_DLLP_TESTREG              0x14Cu /* Test */
+#define PCIE_DLLP_PKTBIST              0x150u /* Packet BIST */
+#define PCIE_DLLP_PCIE11               0x154u /* DLLP PCIE 1.1 reg */
+
+#define PCIE_DLLP_LSREG_LINKUP         (1u << 16u)
+
+/* PCIE protocol TLP diagnostic registers */
+#define PCIE_TLP_CONFIGREG             0x000u /* Configuration */
+#define PCIE_TLP_WORKAROUNDSREG                0x004u /* TLP Workarounds */
+#define PCIE_TLP_WRDMAUPPER            0x010u /* Write DMA Upper Address */
+#define PCIE_TLP_WRDMALOWER            0x014u /* Write DMA Lower Address */
+#define PCIE_TLP_WRDMAREQ_LBEREG       0x018u /* Write DMA Len/ByteEn Req */
+#define PCIE_TLP_RDDMAUPPER            0x01Cu /* Read DMA Upper Address */
+#define PCIE_TLP_RDDMALOWER            0x020u /* Read DMA Lower Address */
+#define PCIE_TLP_RDDMALENREG           0x024u /* Read DMA Len Req */
+#define PCIE_TLP_MSIDMAUPPER           0x028u /* MSI DMA Upper Address */
+#define PCIE_TLP_MSIDMALOWER           0x02Cu /* MSI DMA Lower Address */
+#define PCIE_TLP_MSIDMALENREG          0x030u /* MSI DMA Len Req */
+#define PCIE_TLP_SLVREQLENREG          0x034u /* Slave Request Len */
+#define PCIE_TLP_FCINPUTSREQ           0x038u /* Flow Control Inputs */
+#define PCIE_TLP_TXSMGRSREQ            0x03Cu /* Tx StateMachine and Gated Req */
+#define PCIE_TLP_ADRACKCNTARBLEN       0x040u /* Address Ack XferCnt and ARB Len */
+#define PCIE_TLP_DMACPLHDR0            0x044u /* DMA Completion Hdr 0 */
+#define PCIE_TLP_DMACPLHDR1            0x048u /* DMA Completion Hdr 1 */
+#define PCIE_TLP_DMACPLHDR2            0x04Cu /* DMA Completion Hdr 2 */
+#define PCIE_TLP_DMACPLMISC0           0x050u /* DMA Completion Misc0 */
+#define PCIE_TLP_DMACPLMISC1           0x054u /* DMA Completion Misc1 */
+#define PCIE_TLP_DMACPLMISC2           0x058u /* DMA Completion Misc2 */
+#define PCIE_TLP_SPTCTRLLEN            0x05Cu /* Split Controller Req len */
+#define PCIE_TLP_SPTCTRLMSIC0          0x060u /* Split Controller Misc 0 */
+#define PCIE_TLP_SPTCTRLMSIC1          0x064u /* Split Controller Misc 1 */
+#define PCIE_TLP_BUSDEVFUNC            0x068u /* Bus/Device/Func */
+#define PCIE_TLP_RESETCTR              0x06Cu /* Reset Counter */
+#define PCIE_TLP_RTRYBUF               0x070u /* Retry Buffer value */
+#define PCIE_TLP_TGTDEBUG1             0x074u /* Target Debug Reg1 */
+#define PCIE_TLP_TGTDEBUG2             0x078u /* Target Debug Reg2 */
+#define PCIE_TLP_TGTDEBUG3             0x07Cu /* Target Debug Reg3 */
+#define PCIE_TLP_TGTDEBUG4             0x080u /* Target Debug Reg4 */
+
+/* PCIE2 MDIO register offsets */
+#define PCIE2_MDIO_CONTROL    0x128
+#define PCIE2_MDIO_WR_DATA    0x12C
+#define PCIE2_MDIO_RD_DATA    0x130
+
+/* MDIO control */
+#define MDIOCTL_DIVISOR_MASK           0x7fu   /* clock to be used on MDIO */
+#define MDIOCTL_DIVISOR_VAL            0x2u
+#define MDIOCTL_PREAM_EN               0x80u   /* Enable preamble sequnce */
+#define MDIOCTL_ACCESS_DONE            0x100u   /* Tranaction complete */
+
+/* MDIO Data */
+#define MDIODATA_MASK                  0x0000ffff      /* data 2 bytes */
+#define MDIODATA_TA                    0x00020000      /* Turnaround */
+#define MDIODATA_REGADDR_SHF_OLD       18              /* Regaddr shift (rev < 10) */
+#define MDIODATA_REGADDR_MASK_OLD      0x003c0000      /* Regaddr Mask (rev < 10) */
+#define MDIODATA_DEVADDR_SHF_OLD       22              /* Physmedia devaddr shift (rev < 10) */
+#define MDIODATA_DEVADDR_MASK_OLD      0x0fc00000      /* Physmedia devaddr Mask (rev < 10) */
+#define MDIODATA_REGADDR_SHF           18              /* Regaddr shift */
+#define MDIODATA_REGADDR_MASK          0x007c0000      /* Regaddr Mask */
+#define MDIODATA_DEVADDR_SHF           23              /* Physmedia devaddr shift */
+#define MDIODATA_DEVADDR_MASK          0x0f800000      /* Physmedia devaddr Mask */
+#define MDIODATA_WRITE                 0x10000000      /* write Transaction */
+#define MDIODATA_READ                  0x20000000      /* Read Transaction */
+#define MDIODATA_START                 0x40000000      /* start of Transaction */
+
+#define MDIODATA_DEV_ADDR              0x0             /* dev address for serdes */
+#define        MDIODATA_BLK_ADDR               0x1F            /* blk address for serdes */
+
+/* MDIO control/wrData/rdData register defines for PCIE Gen 2 */
+#define MDIOCTL2_DIVISOR_MASK          0x7f    /* clock to be used on MDIO */
+#define MDIOCTL2_DIVISOR_VAL           0x2
+#define MDIOCTL2_REGADDR_SHF           8               /* Regaddr shift */
+#define MDIOCTL2_REGADDR_MASK          0x00FFFF00      /* Regaddr Mask */
+#define MDIOCTL2_DEVADDR_SHF           24              /* Physmedia devaddr shift */
+#define MDIOCTL2_DEVADDR_MASK          0x0f000000      /* Physmedia devaddr Mask */
+#define MDIOCTL2_SLAVE_BYPASS          0x10000000      /* IP slave bypass */
+#define MDIOCTL2_READ                  0x20000000      /* IP slave bypass */
+
+#define MDIODATA2_DONE                 0x80000000u     /* rd/wr transaction done */
+#define MDIODATA2_MASK                 0x7FFFFFFF      /* rd/wr transaction data */
+#define MDIODATA2_DEVADDR_SHF          4               /* Physmedia devaddr shift */
+
+/* MDIO devices (SERDES modules)
+ *  unlike old pcie cores (rev < 10), rev10 pcie serde organizes registers into a few blocks.
+ *  two layers mapping (blockidx, register offset) is required
+ */
+#define MDIO_DEV_IEEE0         0x000
+#define MDIO_DEV_IEEE1         0x001
+#define MDIO_DEV_BLK0          0x800
+#define MDIO_DEV_BLK1          0x801
+#define MDIO_DEV_BLK2          0x802
+#define MDIO_DEV_BLK3          0x803
+#define MDIO_DEV_BLK4          0x804
+#define MDIO_DEV_TXPLL         0x808   /* TXPLL register block idx */
+#define MDIO_DEV_TXCTRL0       0x820
+#define MDIO_DEV_SERDESID      0x831
+#define MDIO_DEV_RXCTRL0       0x840
+
+/* XgxsBlk1_A Register Offsets */
+#define BLK1_PWR_MGMT0         0x16
+#define BLK1_PWR_MGMT1         0x17
+#define BLK1_PWR_MGMT2         0x18
+#define BLK1_PWR_MGMT3         0x19
+#define BLK1_PWR_MGMT4         0x1A
+
+/* serdes regs (rev < 10) */
+#define MDIODATA_DEV_PLL                       0x1d    /* SERDES PLL Dev */
+#define MDIODATA_DEV_TX                        0x1e    /* SERDES TX Dev */
+#define MDIODATA_DEV_RX                        0x1f    /* SERDES RX Dev */
+       /* SERDES RX registers */
+#define SERDES_RX_CTRL                 1       /* Rx cntrl */
+#define SERDES_RX_TIMER1               2       /* Rx Timer1 */
+#define SERDES_RX_CDR                  6       /* CDR */
+#define SERDES_RX_CDRBW                        7       /* CDR BW */
+
+       /* SERDES RX control register */
+#define SERDES_RX_CTRL_FORCE           0x80    /* rxpolarity_force */
+#define SERDES_RX_CTRL_POLARITY                0x40    /* rxpolarity_value */
+
+       /* SERDES PLL registers */
+#define SERDES_PLL_CTRL                 1       /* PLL control reg */
+#define PLL_CTRL_FREQDET_EN             0x4000  /* bit 14 is FREQDET on */
+
+/* Power management threshold */
+#define PCIE_L0THRESHOLDTIME_MASK       0xFF00u        /* bits 0 - 7 */
+#define PCIE_L1THRESHOLDTIME_MASK       0xFF00u        /* bits 8 - 15 */
+#define PCIE_L1THRESHOLDTIME_SHIFT      8      /* PCIE_L1THRESHOLDTIME_SHIFT */
+#define PCIE_L1THRESHOLD_WARVAL         0x72   /* WAR value */
+#define PCIE_ASPMTIMER_EXTEND          0x01000000      /* > rev7: enable extend ASPM timer */
+
+/* SPROM offsets */
+#define SRSH_ASPM_OFFSET               4       /* word 4 */
+#define SRSH_ASPM_ENB                  0x18    /* bit 3, 4 */
+#define SRSH_ASPM_L1_ENB               0x10    /* bit 4 */
+#define SRSH_ASPM_L0s_ENB              0x8     /* bit 3 */
+#define SRSH_PCIE_MISC_CONFIG          5       /* word 5 */
+#define SRSH_L23READY_EXIT_NOPERST     0x8000u /* bit 15 */
+#define SRSH_CLKREQ_OFFSET_REV5                20      /* word 20 for srom rev <= 5 */
+#define SRSH_CLKREQ_OFFSET_REV8                52      /* word 52 for srom rev 8 */
+#define SRSH_CLKREQ_ENB                        0x0800  /* bit 11 */
+#define SRSH_BD_OFFSET                  6       /* word 6 */
+#define SRSH_AUTOINIT_OFFSET            18      /* auto initialization enable */
+
+/* PCI Capability ID's
+ * Reference include/linux/pci_regs.h
+ * #define  PCI_CAP_LIST_ID    0       // Capability ID
+ * #define  PCI_CAP_ID_PM              0x01    // Power Management
+ * #define  PCI_CAP_ID_AGP             0x02    // Accelerated Graphics Port
+ * #define  PCI_CAP_ID_VPD             0x03    // Vital Product Data
+ * #define  PCI_CAP_ID_SLOTID  0x04    // Slot Identification
+ * #define  PCI_CAP_ID_MSI             0x05    // Message Signalled Interrupts
+ * #define  PCI_CAP_ID_CHSWP       0x06    // CompactPCI HotSwap
+ * #define  PCI_CAP_ID_PCIX        0x07    // PCI-X
+ * #define  PCI_CAP_ID_HT          0x08    // HyperTransport
+ * #define  PCI_CAP_ID_VNDR        0x09    // Vendor-Specific
+ * #define  PCI_CAP_ID_DBG         0x0A    // Debug port
+ * #define  PCI_CAP_ID_CCRC        0x0B    // CompactPCI Central Resource Control
+ * #define  PCI_CAP_ID_SHPC        0x0C    // PCI Standard Hot-Plug Controller
+ * #define  PCI_CAP_ID_SSVID       0x0D    // Bridge subsystem vendor/device ID
+ * #define  PCI_CAP_ID_AGP3        0x0E    // AGP Target PCI-PCI bridge
+ * #define  PCI_CAP_ID_SECDEV      0x0F    // Secure Device
+ * #define  PCI_CAP_ID_MSIX        0x11    // MSI-X
+ * #define  PCI_CAP_ID_SATA        0x12    // SATA Data/Index Conf.
+ * #define  PCI_CAP_ID_AF          0x13    // PCI Advanced Features
+ * #define  PCI_CAP_ID_EA          0x14    // PCI Enhanced Allocation
+ * #define  PCI_CAP_ID_MAX         PCI_CAP_ID_EA
+ */
+
+#define  PCIE_CAP_ID_EXP         0x10    // PCI Express
+
+/* PCIe Capabilities Offsets
+ * Reference include/linux/pci_regs.h
+ * #define PCIE_CAP_FLAGS           2       // Capabilities register
+ * #define PCIE_CAP_DEVCAP          4       // Device capabilities
+ * #define PCIE_CAP_DEVCTL          8       // Device Control
+ * #define PCIE_CAP_DEVSTA          10      // Device Status
+ * #define PCIE_CAP_LNKCAP          12      // Link Capabilities
+ * #define PCIE_CAP_LNKCTL          16      // Link Control
+ * #define PCIE_CAP_LNKSTA          18      // Link Status
+ * #define PCI_CAP_EXP_ENDPOINT_SIZEOF_V1  20      // v1 endpoints end here
+ * #define PCIE_CAP_SLTCAP          20      // Slot Capabilities
+ * #define PCIE_CAP_SLTCTL          24      // Slot Control
+ * #define PCIE_CAP_SLTSTA          26      // Slot Status
+ * #define PCIE_CAP_RTCTL           28      // Root Control
+ * #define PCIE_CAP_RTCAP           30      // Root Capabilities
+ * #define PCIE_CAP_RTSTA           32      // Root Status
+ */
+
+/* Linkcapability reg offset in PCIE Cap */
+#define PCIE_CAP_LINKCAP_OFFSET         12      /* linkcap offset in pcie cap */
+#define PCIE_CAP_LINKCAP_LNKSPEED_MASK 0xf     /* Supported Link Speeds */
+#define PCIE_CAP_LINKCAP_GEN2           0x2     /* Value for GEN2 */
+
+/* Uc_Err reg offset in AER Cap */
+#define PCIE_EXTCAP_ID_ERR             0x01    /* Advanced Error Reporting */
+#define PCIE_EXTCAP_AER_UCERR_OFFSET   4       /* Uc_Err reg offset in AER Cap */
+#define PCIE_EXTCAP_ERR_HEADER_LOG_0   28
+#define PCIE_EXTCAP_ERR_HEADER_LOG_1   32
+#define PCIE_EXTCAP_ERR_HEADER_LOG_2   36
+#define PCIE_EXTCAP_ERR_HEADER_LOG_3   40
+
+/* L1SS reg offset in L1SS Ext Cap */
+#define PCIE_EXTCAP_ID_L1SS            0x1e    /* PCI Express L1 PM Substates Capability */
+#define PCIE_EXTCAP_L1SS_CAP_OFFSET    4       /* L1SSCap reg offset in L1SS Cap */
+#define PCIE_EXTCAP_L1SS_CONTROL_OFFSET        8       /* L1SSControl reg offset in L1SS Cap */
+#define PCIE_EXTCAP_L1SS_CONTROL2_OFFSET       0xc     /* L1SSControl reg offset in L1SS Cap */
+
+/* Linkcontrol reg offset in PCIE Cap */
+#define PCIE_CAP_LINKCTRL_OFFSET       16      /* linkctrl offset in pcie cap */
+#define PCIE_CAP_LCREG_ASPML0s         0x01    /* ASPM L0s in linkctrl */
+#define PCIE_CAP_LCREG_ASPML1          0x02    /* ASPM L1 in linkctrl */
+#define PCIE_CLKREQ_ENAB               0x100   /* CLKREQ Enab in linkctrl */
+#define PCIE_LINKSPEED_MASK            0xF0000u        /* bits 0 - 3 of high word */
+#define PCIE_LINKSPEED_SHIFT           16      /* PCIE_LINKSPEED_SHIFT */
+#define PCIE_LINK_STS_LINKSPEED_5Gbps  (0x2 << PCIE_LINKSPEED_SHIFT)   /* PCIE_LINKSPEED 5Gbps */
+
+/* Devcontrol reg offset in PCIE Cap */
+#define PCIE_CAP_DEVCTRL_OFFSET                8       /* devctrl offset in pcie cap */
+#define PCIE_CAP_DEVCTRL_MRRS_MASK     0x7000  /* Max read request size mask */
+#define PCIE_CAP_DEVCTRL_MRRS_SHIFT    12      /* Max read request size shift */
+#define PCIE_CAP_DEVCTRL_MRRS_128B     0       /* 128 Byte */
+#define PCIE_CAP_DEVCTRL_MRRS_256B     1       /* 256 Byte */
+#define PCIE_CAP_DEVCTRL_MRRS_512B     2       /* 512 Byte */
+#define PCIE_CAP_DEVCTRL_MRRS_1024B    3       /* 1024 Byte */
+#define PCIE_CAP_DEVCTRL_MPS_MASK      0x00e0  /* Max payload size mask */
+#define PCIE_CAP_DEVCTRL_MPS_SHIFT     5       /* Max payload size shift */
+#define PCIE_CAP_DEVCTRL_MPS_128B      0       /* 128 Byte */
+#define PCIE_CAP_DEVCTRL_MPS_256B      1       /* 256 Byte */
+#define PCIE_CAP_DEVCTRL_MPS_512B      2       /* 512 Byte */
+#define PCIE_CAP_DEVCTRL_MPS_1024B     3       /* 1024 Byte */
+
+#define PCIE_ASPM_CTRL_MASK            3       /* bit 0 and 1 */
+#define PCIE_ASPM_ENAB                 3       /* ASPM L0s & L1 in linkctrl */
+#define PCIE_ASPM_L1_ENAB              2       /* ASPM L0s & L1 in linkctrl */
+#define PCIE_ASPM_L0s_ENAB             1       /* ASPM L0s & L1 in linkctrl */
+#define PCIE_ASPM_DISAB                        0       /* ASPM L0s & L1 in linkctrl */
+
+#define PCIE_ASPM_L11_ENAB             8       /* ASPM L1.1 in PML1_sub_control2 */
+#define PCIE_ASPM_L12_ENAB             4       /* ASPM L1.2 in PML1_sub_control2 */
+
+#define PCIE_EXT_L1SS_MASK             0xf     /* Bits [3:0] of L1SSControl 0x248 */
+#define PCIE_EXT_L1SS_ENAB             0xf     /* Bits [3:0] of L1SSControl 0x248 */
+
+/* NumMsg and NumMsgEn in PCIE MSI Cap */
+#define MSICAP_NUM_MSG_SHF             17
+#define MSICAP_NUM_MSG_MASK            (0x7 << MSICAP_NUM_MSG_SHF)
+#define MSICAP_NUM_MSG_EN_SHF  20
+#define MSICAP_NUM_MSG_EN_MASK (0x7 << MSICAP_NUM_MSG_EN_SHF)
+
+/* Devcontrol2 reg offset in PCIE Cap */
+#define PCIE_CAP_DEVCTRL2_OFFSET       0x28    /* devctrl2 offset in pcie cap */
+#define PCIE_CAP_DEVCTRL2_LTR_ENAB_MASK        0x400   /* Latency Tolerance Reporting Enable */
+#define PCIE_CAP_DEVCTRL2_OBFF_ENAB_SHIFT 13   /* Enable OBFF mechanism, select signaling method */
+#define PCIE_CAP_DEVCTRL2_OBFF_ENAB_MASK 0x6000        /* Enable OBFF mechanism, select signaling method */
+
+/* LTR registers in PCIE Cap */
+#define PCIE_LTR0_REG_OFFSET           0x844u          /* ltr0_reg offset in pcie cap */
+#define PCIE_LTR1_REG_OFFSET           0x848u          /* ltr1_reg offset in pcie cap */
+#define PCIE_LTR2_REG_OFFSET           0x84cu          /* ltr2_reg offset in pcie cap */
+#define PCIE_LTR0_REG_DEFAULT_60       0x883c883cu     /* active latency default to 60usec */
+#define PCIE_LTR0_REG_DEFAULT_150      0x88968896u     /* active latency default to 150usec */
+#define PCIE_LTR1_REG_DEFAULT          0x88648864u     /* idle latency default to 100usec */
+#define PCIE_LTR2_REG_DEFAULT          0x90039003u     /* sleep latency default to 3msec */
+#define PCIE_LTR_LAT_VALUE_MASK                0x3FFu          /* LTR Latency mask */
+#define PCIE_LTR_LAT_SCALE_SHIFT       10u             /* LTR Scale shift */
+#define PCIE_LTR_LAT_SCALE_MASK                0x1C00u         /* LTR Scale mask */
+#define PCIE_LTR_SNOOP_REQ_SHIFT       15u             /* LTR SNOOP REQ shift */
+#define PCIE_LTR_SNOOP_REQ_MASK                0x8000u         /* LTR SNOOP REQ mask */
+
+/* Status reg PCIE_PLP_STATUSREG */
+#define PCIE_PLP_POLARITYINV_STAT      0x10u
+
+/* PCIE BRCM Vendor CAP REVID reg  bits */
+#define BRCMCAP_PCIEREV_CT_MASK                        0xF00u
+#define BRCMCAP_PCIEREV_CT_SHIFT               8u
+#define BRCMCAP_PCIEREV_REVID_MASK             0xFFu
+#define BRCMCAP_PCIEREV_REVID_SHIFT            0
+
+#define PCIE_REVREG_CT_PCIE1           0
+#define PCIE_REVREG_CT_PCIE2           1
+
+/* PCIE GEN2 specific defines */
+/* PCIE BRCM Vendor Cap offsets w.r.t to vendor cap ptr */
+#define PCIE2R0_BRCMCAP_REVID_OFFSET           4
+#define PCIE2R0_BRCMCAP_BAR0_WIN0_WRAP_OFFSET  8
+#define PCIE2R0_BRCMCAP_BAR0_WIN2_OFFSET       12
+#define PCIE2R0_BRCMCAP_BAR0_WIN2_WRAP_OFFSET  16
+#define PCIE2R0_BRCMCAP_BAR0_WIN_OFFSET                20
+#define PCIE2R0_BRCMCAP_BAR1_WIN_OFFSET                24
+#define PCIE2R0_BRCMCAP_SPROM_CTRL_OFFSET      28
+#define PCIE2R0_BRCMCAP_BAR2_WIN_OFFSET                32
+#define PCIE2R0_BRCMCAP_INTSTATUS_OFFSET       36
+#define PCIE2R0_BRCMCAP_INTMASK_OFFSET         40
+#define PCIE2R0_BRCMCAP_PCIE2SB_MB_OFFSET      44
+#define PCIE2R0_BRCMCAP_BPADDR_OFFSET          48
+#define PCIE2R0_BRCMCAP_BPDATA_OFFSET          52
+#define PCIE2R0_BRCMCAP_CLKCTLSTS_OFFSET       56
+
+/*
+ * definition of configuration space registers of PCIe gen2
+ */
+#define PCIECFGREG_STATUS_CMD          0x4
+#define PCIECFGREG_PM_CSR              0x4C
+#define PCIECFGREG_MSI_CAP             0x58
+#define PCIECFGREG_MSI_ADDR_L          0x5C
+#define PCIECFGREG_MSI_ADDR_H          0x60
+#define PCIECFGREG_MSI_DATA            0x64
+#define PCIECFGREG_SPROM_CTRL           0x88
+#define PCIECFGREG_LINK_STATUS_CTRL    0xBCu
+#define PCIECFGREG_LINK_STATUS_CTRL2   0xDCu
+#define PCIECFGREG_DEV_STATUS_CTRL 0xB4u
+#define PCIECFGGEN_DEV_STATUS_CTRL2    0xD4
+#define PCIECFGREG_RBAR_CTRL           0x228
+#define PCIECFGREG_PML1_SUB_CTRL1      0x248
+#define PCIECFGREG_PML1_SUB_CTRL2      0x24C
+#define PCIECFGREG_REG_BAR2_CONFIG     0x4E0
+#define PCIECFGREG_REG_BAR3_CONFIG     0x4F4
+#define PCIECFGREG_PDL_CTRL1           0x1004
+#define PCIECFGREG_PDL_CTRL5           (0x1014u)
+#define PCIECFGREG_PDL_IDDQ            0x1814
+#define PCIECFGREG_REG_PHY_CTL7                0x181c
+#define PCIECFGREG_PHY_DBG_CLKREQ0             0x1E10
+#define PCIECFGREG_PHY_DBG_CLKREQ1             0x1E14
+#define PCIECFGREG_PHY_DBG_CLKREQ2             0x1E18
+#define PCIECFGREG_PHY_DBG_CLKREQ3             0x1E1C
+#define PCIECFGREG_PHY_LTSSM_HIST_0            0x1CEC
+#define PCIECFGREG_PHY_LTSSM_HIST_1            0x1CF0
+#define PCIECFGREG_PHY_LTSSM_HIST_2            0x1CF4
+#define PCIECFGREG_PHY_LTSSM_HIST_3            0x1CF8
+#define PCIECFGREG_TREFUP                      0x1814
+#define PCIECFGREG_TREFUP_EXT                  0x1818
+
+/* PCIECFGREG_STATUS_CMD reg bit definitions */
+#define PCIECFG_STS_CMD_MEM_SPACE_SHIFT                (1u)
+#define        PCIECFG_STS_CMD_BUS_MASTER_SHIFT        (2u)
+/* PCIECFGREG_PML1_SUB_CTRL1 Bit Definition */
+#define PCI_PM_L1_2_ENA_MASK           0x00000001      /* PCI-PM L1.2 Enabled */
+#define PCI_PM_L1_1_ENA_MASK           0x00000002      /* PCI-PM L1.1 Enabled */
+#define ASPM_L1_2_ENA_MASK             0x00000004      /* ASPM L1.2 Enabled */
+#define ASPM_L1_1_ENA_MASK             0x00000008      /* ASPM L1.1 Enabled */
+
+/* PCIECFGREG_PDL_CTRL1 reg bit definitions */
+#define PCIECFG_PDL_CTRL1_RETRAIN_REQ_MASK             (0x4000u)
+#define PCIECFG_PDL_CTRL1_RETRAIN_REQ_SHIFT            (14u)
+#define PCIECFG_PDL_CTRL1_MAX_DLP_L1_ENTER_MASK                (0x7Fu)
+#define PCIECFG_PDL_CTRL1_MAX_DLP_L1_ENTER_SHIFT       (16u)
+#define PCIECFG_PDL_CTRL1_MAX_DLP_L1_ENTER_VAL         (0x6Fu)
+
+/* PCIECFGREG_PDL_CTRL5 reg bit definitions */
+#define PCIECFG_PDL_CTRL5_DOWNSTREAM_PORT_SHIFT                (8u)
+#define        PCIECFG_PDL_CTRL5_GLOOPBACK_SHIFT               (9u)
+
+/* PCIe gen2 mailbox interrupt masks */
+#define I_MB    0x3
+#define I_BIT0  0x1
+#define I_BIT1  0x2
+
+/* PCIE gen2 config regs */
+#define PCIIntstatus   0x090
+#define PCIIntmask     0x094
+#define PCISBMbx       0x98
+
+/* enumeration Core regs */
+#define PCIH2D_MailBox  0x140
+#define PCIH2D_DB1             0x144
+#define PCID2H_MailBox  0x148
+#define PCIH2D_MailBox_1       0x150  /* for dma channel1 */
+#define PCIH2D_DB1_1           0x154
+#define PCID2H_MailBox_1       0x158
+#define PCIH2D_MailBox_2       0x160  /* for dma channel2 which will be used for Implicit DMA */
+#define PCIH2D_DB1_2           0x164
+#define PCID2H_MailBox_2       0x168
+#define PCIH2D_DB1_3           0x174
+#define PCIE_CLK_CTRL          0x1E0
+#define PCIE_PWR_CTRL          0x1E8
+
+#define PCIControl(rev)                (REV_GE_64(rev) ? 0xC00 : 0x00)
+/* for corerev < 64 idma_en is in PCIControl regsiter */
+#define IDMAControl(rev)       (REV_GE_64(rev) ? 0x480 : 0x00)
+#define PCIMailBoxInt(rev)     (REV_GE_64(rev) ? 0xC30 : 0x48)
+#define PCIMailBoxMask(rev)    (REV_GE_64(rev) ? 0xC34 : 0x4C)
+#define PCIFunctionIntstatus(rev)      (REV_GE_64(rev) ? 0xC10 : 0x20)
+#define PCIFunctionIntmask(rev)        (REV_GE_64(rev) ? 0xC14 : 0x24)
+#define PCIPowerIntstatus(rev) (REV_GE_64(rev) ? 0xC18 : 0x1A4)
+#define PCIPowerIntmask(rev)   (REV_GE_64(rev) ? 0xC1C : 0x1A8)
+#define PCIDARClkCtl(rev)      (REV_GE_64(rev) ? 0xA08 : 0xAE0)
+#define PCIDARPwrCtl(rev)      (REV_GE_64(rev) ? 0xA0C : 0xAE8)
+#define PCIDARFunctionIntstatus(rev)   (REV_GE_64(rev) ? 0xA10 : 0xA20)
+#define PCIDARH2D_DB0(rev)     (REV_GE_64(rev) ? 0xA20 : 0xA28)
+#define PCIDARErrlog(rev)      (REV_GE_64(rev) ? 0xA60 : 0xA40)
+#define PCIDARErrlog_Addr(rev) (REV_GE_64(rev) ? 0xA64 : 0xA44)
+#define PCIDARMailboxint(rev)  (REV_GE_64(rev) ? 0xA68 : 0xA48)
+
+#define PCIE_HWA_INDEX_UPDATE_EN       (1 << 1)
+
+#define PCIMSIVecAssign        0x58
+
+/* base of all HMAP window registers */
+/* base of all HMAP window registers */
+#define PCI_HMAP_WINDOW_BASE(rev)              (REV_GE_64(rev) ? 0x580u : 0x540u)
+#define PCI_HMAP_VIOLATION_ADDR_L(rev)         (REV_GE_64(rev) ? 0x600u : 0x5C0u)
+#define PCI_HMAP_VIOLATION_ADDR_U(rev)         (REV_GE_64(rev) ? 0x604u : 0x5C4u)
+#define PCI_HMAP_VIOLATION_INFO(rev)           (REV_GE_64(rev) ? 0x608u : 0x5C8u)
+#define PCI_HMAP_WINDOW_CONFIG(rev)            (REV_GE_64(rev) ? 0x610u : 0x5D0u)
+
+/* HMAP Register related  offsets */
+#define PCI_HMAP_NWINDOWS_SHIFT                8U
+#define PCI_HMAP_NWINDOWS_MASK         0x0000ff00U /* bits 8:15 */
+#define PCI_HMAP_VIO_ID_MASK           0x0000007fU /* 0:14 */
+#define PCI_HMAP_VIO_ID_SHIFT          0U
+#define PCI_HMAP_VIO_SRC_MASK          0x00008000U /* bit 15 */
+#define PCI_HMAP_VIO_SRC_SHIFT         15U
+#define PCI_HMAP_VIO_TYPE_MASK         0x00010000U /* bit 16 */
+#define PCI_HMAP_VIO_TYPE_SHIFT                16U
+#define PCI_HMAP_VIO_ERR_MASK          0x00060000U /* bit 17:18 */
+#define PCI_HMAP_VIO_ERR_SHIFT         17U
+
+#define I_F0_B0         (0x1 << 8) /* Mail box interrupt Function 0 interrupt, bit 0 */
+#define I_F0_B1         (0x1 << 9) /* Mail box interrupt Function 0 interrupt, bit 1 */
+
+#define PCIECFGREG_DEVCONTROL  0xB4
+#define PCIECFGREG_BASEADDR0   0x10
+#define PCIECFGREG_BASEADDR1   0x18
+#define PCIECFGREG_DEVCONTROL_MRRS_SHFT        12
+#define PCIECFGREG_DEVCONTROL_MRRS_MASK        (0x7 << PCIECFGREG_DEVCONTROL_MRRS_SHFT)
+#define PCIECFGREG_DEVCTRL_MPS_SHFT    5
+#define PCIECFGREG_DEVCTRL_MPS_MASK (0x7 << PCIECFGREG_DEVCTRL_MPS_SHFT)
+#define PCIECFGREG_PM_CSR_STATE_MASK 0x00000003
+#define PCIECFGREG_PM_CSR_STATE_D0 0
+#define PCIECFGREG_PM_CSR_STATE_D1 1
+#define PCIECFGREG_PM_CSR_STATE_D2 2
+#define PCIECFGREG_PM_CSR_STATE_D3_HOT 3
+#define PCIECFGREG_PM_CSR_STATE_D3_COLD 4
+
+/* Direct Access regs */
+#define DAR_ERRLOG(rev)                        (REV_GE_64(rev) ? \
+                                               OFFSETOF(sbpcieregs_t, u1.dar_64.errlog) : \
+                                               OFFSETOF(sbpcieregs_t, u1.dar.errlog))
+#define DAR_ERRADDR(rev)               (REV_GE_64(rev) ? \
+                                               OFFSETOF(sbpcieregs_t, u1.dar_64.erraddr) : \
+                                               OFFSETOF(sbpcieregs_t, u1.dar.erraddr))
+#define DAR_CLK_CTRL(rev)      (REV_GE_64(rev) ? \
+                                               OFFSETOF(sbpcieregs_t, u1.dar_64.clk_ctl_st) : \
+                                               OFFSETOF(sbpcieregs_t, u1.dar.clk_ctl_st))
+#define DAR_INTSTAT(rev)       (REV_GE_64(rev) ? \
+                                               OFFSETOF(sbpcieregs_t, u1.dar_64.intstatus) : \
+                                               OFFSETOF(sbpcieregs_t, u1.dar.intstatus))
+#define DAR_PCIH2D_DB0_0(rev)  (REV_GE_64(rev) ? \
+                                               OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_0_0) : \
+                                               OFFSETOF(sbpcieregs_t, u1.dar.h2d_db_0_0))
+#define DAR_PCIH2D_DB0_1(rev)  (REV_GE_64(rev) ? \
+                                               OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_0_1) : \
+                                               OFFSETOF(sbpcieregs_t, u1.dar.h2d_db_0_1))
+#define DAR_PCIH2D_DB1_0(rev)  (REV_GE_64(rev) ? \
+                                               OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_1_0) : \
+                                               OFFSETOF(sbpcieregs_t, u1.dar.h2d_db_1_0))
+#define DAR_PCIH2D_DB1_1(rev)  (REV_GE_64(rev) ? \
+                                               OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_1_1) : \
+                                               OFFSETOF(sbpcieregs_t, u1.dar.h2d_db_1_1))
+#define DAR_PCIH2D_DB2_0(rev)  (REV_GE_64(rev) ? \
+                                               OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_2_0) : \
+                                               OFFSETOF(sbpcieregs_t, u1.dar.h2d_db_2_0))
+#define DAR_PCIH2D_DB2_1(rev)  (REV_GE_64(rev) ? \
+                                               OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_2_1) : \
+                                               OFFSETOF(sbpcieregs_t, u1.dar.h2d_db_2_1))
+#define DAR_PCIH2D_DB3_0(rev)  OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_3_0)
+#define DAR_PCIH2D_DB3_1(rev)  OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_3_1)
+#define DAR_PCIH2D_DB4_0(rev)  OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_4_0)
+#define DAR_PCIH2D_DB4_1(rev)  OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_4_1)
+#define DAR_PCIH2D_DB5_0(rev)  OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_5_0)
+#define DAR_PCIH2D_DB5_1(rev)  OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_5_1)
+#define DAR_PCIH2D_DB6_0(rev)  OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_6_0)
+#define DAR_PCIH2D_DB6_1(rev)  OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_6_1)
+#define DAR_PCIH2D_DB7_0(rev)  OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_7_0)
+#define DAR_PCIH2D_DB7_1(rev)  OFFSETOF(sbpcieregs_t, u1.dar_64.h2d_db_7_1)
+
+#define DAR_PCIMailBoxInt(rev) (REV_GE_64(rev) ? \
+                                               OFFSETOF(sbpcieregs_t, u1.dar_64.mbox_int) : \
+                                               OFFSETOF(sbpcieregs_t, u1.dar.mbox_int))
+#define DAR_PCIE_PWR_CTRL(rev) (REV_GE_64(rev) ? \
+                                               OFFSETOF(sbpcieregs_t, u1.dar_64.powerctl) : \
+                                               OFFSETOF(sbpcieregs_t, u1.dar.powerctl))
+#define DAR_PCIE_DAR_CTRL(rev) (REV_GE_64(rev) ? \
+                                               OFFSETOF(sbpcieregs_t, u1.dar_64.dar_ctrl) : \
+                                               OFFSETOF(sbpcieregs_t, u1.dar.dar_ctrl))
+
+#define DAR_FIS_CTRL(rev)      OFFSETOF(sbpcieregs_t, u1.dar_64.fis_ctrl)
+
+#define DAR_FIS_START_SHIFT    0u
+#define DAR_FIS_START_MASK     (1u << DAR_FIS_START_SHIFT)
+
+#define PCIE_PWR_REQ_PCIE              (0x1 << 8)
+
+/* SROM hardware region */
+#define SROM_OFFSET_BAR1_CTRL  52
+
+#define BAR1_ENC_SIZE_MASK     0x000e
+#define BAR1_ENC_SIZE_SHIFT    1
+
+#define BAR1_ENC_SIZE_1M       0
+#define BAR1_ENC_SIZE_2M       1
+#define BAR1_ENC_SIZE_4M       2
+
+#define PCIEGEN2_CAP_DEVSTSCTRL2_OFFSET                0xD4
+#define PCIEGEN2_CAP_DEVSTSCTRL2_LTRENAB       0x400
+
+/*
+ * Latency Tolerance Reporting (LTR) states
+ * Active has the least tolerant latency requirement
+ * Sleep is most tolerant
+ */
+#define LTR_ACTIVE                             2
+#define LTR_ACTIVE_IDLE                                1
+#define LTR_SLEEP                              0
+#define LTR_FINAL_MASK                         0x300
+#define LTR_FINAL_SHIFT                                8
+
+/* pwrinstatus, pwrintmask regs */
+#define PCIEGEN2_PWRINT_D0_STATE_SHIFT         0
+#define PCIEGEN2_PWRINT_D1_STATE_SHIFT         1
+#define PCIEGEN2_PWRINT_D2_STATE_SHIFT         2
+#define PCIEGEN2_PWRINT_D3_STATE_SHIFT         3
+#define PCIEGEN2_PWRINT_L0_LINK_SHIFT          4
+#define PCIEGEN2_PWRINT_L0s_LINK_SHIFT         5
+#define PCIEGEN2_PWRINT_L1_LINK_SHIFT          6
+#define PCIEGEN2_PWRINT_L2_L3_LINK_SHIFT       7
+#define PCIEGEN2_PWRINT_OBFF_CHANGE_SHIFT      8
+
+#define PCIEGEN2_PWRINT_D0_STATE_MASK          (1 << PCIEGEN2_PWRINT_D0_STATE_SHIFT)
+#define PCIEGEN2_PWRINT_D1_STATE_MASK          (1 << PCIEGEN2_PWRINT_D1_STATE_SHIFT)
+#define PCIEGEN2_PWRINT_D2_STATE_MASK          (1 << PCIEGEN2_PWRINT_D2_STATE_SHIFT)
+#define PCIEGEN2_PWRINT_D3_STATE_MASK          (1 << PCIEGEN2_PWRINT_D3_STATE_SHIFT)
+#define PCIEGEN2_PWRINT_L0_LINK_MASK           (1 << PCIEGEN2_PWRINT_L0_LINK_SHIFT)
+#define PCIEGEN2_PWRINT_L0s_LINK_MASK          (1 << PCIEGEN2_PWRINT_L0s_LINK_SHIFT)
+#define PCIEGEN2_PWRINT_L1_LINK_MASK           (1 << PCIEGEN2_PWRINT_L1_LINK_SHIFT)
+#define PCIEGEN2_PWRINT_L2_L3_LINK_MASK                (1 << PCIEGEN2_PWRINT_L2_L3_LINK_SHIFT)
+#define PCIEGEN2_PWRINT_OBFF_CHANGE_MASK       (1 << PCIEGEN2_PWRINT_OBFF_CHANGE_SHIFT)
+
+/* sbtopcie mail box */
+#define SBTOPCIE_MB_FUNC0_SHIFT 8
+#define SBTOPCIE_MB_FUNC1_SHIFT 10
+#define SBTOPCIE_MB_FUNC2_SHIFT 12
+#define SBTOPCIE_MB_FUNC3_SHIFT 14
+
+#define SBTOPCIE_MB1_FUNC0_SHIFT 9
+#define SBTOPCIE_MB1_FUNC1_SHIFT 11
+#define SBTOPCIE_MB1_FUNC2_SHIFT 13
+#define SBTOPCIE_MB1_FUNC3_SHIFT 15
+
+/* pcieiocstatus */
+#define PCIEGEN2_IOC_D0_STATE_SHIFT            8
+#define PCIEGEN2_IOC_D1_STATE_SHIFT            9
+#define PCIEGEN2_IOC_D2_STATE_SHIFT            10
+#define PCIEGEN2_IOC_D3_STATE_SHIFT            11
+#define PCIEGEN2_IOC_L0_LINK_SHIFT             12
+#define PCIEGEN2_IOC_L1_LINK_SHIFT             13
+#define PCIEGEN2_IOC_L1L2_LINK_SHIFT           14
+#define PCIEGEN2_IOC_L2_L3_LINK_SHIFT          15
+#define PCIEGEN2_IOC_BME_SHIFT                 20
+
+#define PCIEGEN2_IOC_D0_STATE_MASK             (1 << PCIEGEN2_IOC_D0_STATE_SHIFT)
+#define PCIEGEN2_IOC_D1_STATE_MASK             (1 << PCIEGEN2_IOC_D1_STATE_SHIFT)
+#define PCIEGEN2_IOC_D2_STATE_MASK             (1 << PCIEGEN2_IOC_D2_STATE_SHIFT)
+#define PCIEGEN2_IOC_D3_STATE_MASK             (1 << PCIEGEN2_IOC_D3_STATE_SHIFT)
+#define PCIEGEN2_IOC_L0_LINK_MASK              (1 << PCIEGEN2_IOC_L0_LINK_SHIFT)
+#define PCIEGEN2_IOC_L1_LINK_MASK              (1 << PCIEGEN2_IOC_L1_LINK_SHIFT)
+#define PCIEGEN2_IOC_L1L2_LINK_MASK            (1 << PCIEGEN2_IOC_L1L2_LINK_SHIFT)
+#define PCIEGEN2_IOC_L2_L3_LINK_MASK           (1 << PCIEGEN2_IOC_L2_L3_LINK_SHIFT)
+#define PCIEGEN2_IOC_BME_MASK                  (1 << PCIEGEN2_IOC_BME_SHIFT)
+
+/* stat_ctrl */
+#define PCIE_STAT_CTRL_RESET           0x1
+#define PCIE_STAT_CTRL_ENABLE          0x2
+#define PCIE_STAT_CTRL_INTENABLE       0x4
+#define PCIE_STAT_CTRL_INTSTATUS       0x8
+
+/* cpl_timeout_ctrl_reg */
+#define PCIE_CTO_TO_THRESHOLD_SHIFT    0
+#define PCIE_CTO_TO_THRESHHOLD_MASK    (0xfffff << PCIE_CTO_TO_THRESHOLD_SHIFT)
+
+#define PCIE_CTO_CLKCHKCNT_SHIFT               24
+#define PCIE_CTO_CLKCHKCNT_MASK                (0xf << PCIE_CTO_CLKCHKCNT_SHIFT)
+
+#define PCIE_CTO_ENAB_SHIFT                    31
+#define PCIE_CTO_ENAB_MASK                     (0x1 << PCIE_CTO_ENAB_SHIFT)
+
+/*
+ * For corerev >= 69, core_fref is always 29.9MHz instead of 37.4MHz.
+ * Use different default threshold value to have 10ms timeout (0x49FB6 * 33ns).
+ */
+#define PCIE_CTO_TO_THRESH_DEFAULT             0x58000
+#define PCIE_CTO_TO_THRESH_DEFAULT_REV69       0x49FB6
+
+#define PCIE_CTO_CLKCHKCNT_VAL         0xA
+
+/* ErrLog */
+#define PCIE_SROMRD_ERR_SHIFT                  5
+#define PCIE_SROMRD_ERR_MASK                   (0x1 << PCIE_SROMRD_ERR_SHIFT)
+
+#define PCIE_CTO_ERR_SHIFT                     8
+#define PCIE_CTO_ERR_MASK                              (0x1 << PCIE_CTO_ERR_SHIFT)
+
+#define PCIE_CTO_ERR_CODE_SHIFT                9
+#define PCIE_CTO_ERR_CODE_MASK         (0x3 << PCIE_CTO_ERR_CODE_SHIFT)
+
+#define PCIE_BP_CLK_OFF_ERR_SHIFT              12
+#define PCIE_BP_CLK_OFF_ERR_MASK               (0x1 << PCIE_BP_CLK_OFF_ERR_SHIFT)
+
+#define PCIE_BP_IN_RESET_ERR_SHIFT     13
+#define PCIE_BP_IN_RESET_ERR_MASK              (0x1 << PCIE_BP_IN_RESET_ERR_SHIFT)
+
+/* PCIE control per Function */
+#define PCIE_FTN_DLYPERST_SHIFT                1
+#define PCIE_FTN_DLYPERST_MASK         (1 << PCIE_FTN_DLYPERST_SHIFT)
+
+#define PCIE_FTN_WakeModeL2_SHIFT      3
+#define PCIE_FTN_WakeModeL2_MASK       (1 << PCIE_FTN_WakeModeL2_SHIFT)
+
+#define PCIE_FTN_MSI_B2B_EN_SHIFT      4
+#define PCIE_FTN_MSI_B2B_EN_MASK       (1 << PCIE_FTN_MSI_B2B_EN_SHIFT)
+
+#define PCIE_FTN_MSI_FIFO_CLEAR_SHIFT  5
+#define PCIE_FTN_MSI_FIFO_CLEAR_MASK   (1 << PCIE_FTN_MSI_FIFO_CLEAR_SHIFT)
+
+#define PCIE_FTN_SWPME_SHIFT           6
+#define PCIE_FTN_SWPME_MASK                    (1 << PCIE_FTN_SWPME_SHIFT)
+
+#ifdef BCMDRIVER
+void pcie_watchdog_reset(osl_t *osh, si_t *sih, uint32 wd_mask, uint32 wd_val);
+void pcie_serdes_iddqdisable(osl_t *osh, si_t *sih, sbpcieregs_t *sbpcieregs);
+void pcie_set_trefup_time_100us(si_t *sih);
+uint32 pcie_cto_to_thresh_default(uint corerev);
+uint32 pcie_corereg(osl_t *osh, volatile void *regs, uint32 offset, uint32 mask, uint32 val);
+#endif /* BCMDRIVER */
+
+/* DMA intstatus and intmask */
+#define        I_PC            (1 << 10)       /* pci descriptor error */
+#define        I_PD            (1 << 11)       /* pci data error */
+#define        I_DE            (1 << 12)       /* descriptor protocol error */
+#define        I_RU            (1 << 13)       /* receive descriptor underflow */
+#define        I_RO            (1 << 14)       /* receive fifo overflow */
+#define        I_XU            (1 << 15)       /* transmit fifo underflow */
+#define        I_RI            (1 << 16)       /* receive interrupt */
+#define        I_XI            (1 << 24)       /* transmit interrupt */
+
+#define PD_DMA_INT_MASK_H2D            0x1DC00
+#define PD_DMA_INT_MASK_D2H            0x1DC00
+#define PD_DB_INT_MASK                 0xFF0000
+
+#define PCIE_INVALID_OFFSET            0x18003ffc /* Invalid Register Offset for Induce Error */
+#define PCIE_INVALID_DATA              0x55555555 /* Invalid Data for Induce Error */
+
+#define PD_DEV0_DB0_INTMASK       (0x1 << PD_DEV0_DB_INTSHIFT)
+#define PD_DEV0_DB1_INTMASK       (0x2 << PD_DEV0_DB_INTSHIFT)
+#define PD_DEV0_DB_INTMASK        ((PD_DEV0_DB0_INTMASK) | (PD_DEV0_DB1_INTMASK))
+
+#define PD_DEV1_DB0_INTMASK       (0x1 << PD_DEV1_DB_INTSHIFT)
+#define PD_DEV1_DB1_INTMASK       (0x2 << PD_DEV1_DB_INTSHIFT)
+#define PD_DEV1_DB_INTMASK        ((PD_DEV1_DB0_INTMASK) | (PD_DEV1_DB1_INTMASK))
+
+#define PD_DEV2_DB0_INTMASK       (0x1 << PD_DEV2_DB_INTSHIFT)
+#define PD_DEV2_DB1_INTMASK       (0x2 << PD_DEV2_DB_INTSHIFT)
+#define PD_DEV2_DB_INTMASK        ((PD_DEV2_DB0_INTMASK) | (PD_DEV2_DB1_INTMASK))
+
+#define PD_DEV3_DB0_INTMASK       (0x1 << PD_DEV3_DB_INTSHIFT)
+#define PD_DEV3_DB1_INTMASK       (0x2 << PD_DEV3_DB_INTSHIFT)
+#define PD_DEV3_DB_INTMASK        ((PD_DEV3_DB0_INTMASK) | (PD_DEV3_DB1_INTMASK))
+
+#define PD_DEV0_DMA_INTMASK       0x80
+
+#define PD_FUNC0_MB_INTSHIFT           8u
+#define PD_FUNC0_MB_INTMASK            (0x3 << PD_FUNC0_MB_INTSHIFT)
+
+#define PD_FUNC0_PCIE_SB_INTSHIFT       0u
+#define PD_FUNC0_PCIE_SB__INTMASK       (0x3 << PD_FUNC0_PCIE_SB_INTSHIFT)
+
+#define PD_DEV0_PWRSTATE_INTSHIFT      24u
+#define PD_DEV0_PWRSTATE_INTMASK       (0x1 << PD_DEV0_PWRSTATE_INTSHIFT)
+
+#define PD_DEV0_PERST_INTSHIFT         6u
+#define PD_DEV0_PERST_INTMASK          (0x1 << PD_DEV0_PERST_INTSHIFT)
+
+#define PD_MSI_FIFO_OVERFLOW_INTSHIFT          28u
+#define PD_MSI_FIFO_OVERFLOW_INTMASK           (0x1 << PD_MSI_FIFO_OVERFLOW_INTSHIFT)
+
+#if defined(BCMPCIE_IFRM)
+#define PD_IFRM_INTSHIFT               5u
+#define PD_IFRM_INTMASK                (0x1 << PD_IFRM_INTSHIFT)
+#endif /* BCMPCIE_IFRM */
+
+/* HMAP related constants */
+#define PD_HMAP_VIO_INTSHIFT   3u
+#define PD_HMAP_VIO_INTMASK    (0x1 << PD_HMAP_VIO_INTSHIFT)
+#define PD_HMAP_VIO_CLR_VAL    0x3 /* write 0b11 to clear HMAP violation */
+#define PD_HMAP_VIO_SHIFT_VAL  17u  /* bits 17:18 clear HMAP violation */
+
+#define PD_FLR0_IN_PROG_INTSHIFT               0u
+#define PD_FLR0_IN_PROG_INTMASK                        (0x1 << PD_FLR0_IN_PROG_INTSHIFT)
+#define PD_FLR1_IN_PROG_INTSHIFT               1u
+#define PD_FLR1_IN_PROG_INTMASK                        (0x1 << PD_FLR1_IN_PROG_INTSHIFT)
+
+/* DMA channel 2 datapath use case
+ * Implicit DMA uses DMA channel 2 (outbound only)
+ */
+#if defined(BCMPCIE_IDMA) && !defined(BCMPCIE_IDMA_DISABLED)
+#define PD_DEV2_INTMASK PD_DEV2_DB0_INTMASK
+#elif defined(BCMPCIE_IFRM) && !defined(BCMPCIE_IFRM_DISABLED)
+#define PD_DEV2_INTMASK PD_DEV2_DB0_INTMASK
+#elif defined(BCMPCIE_DMA_CH2)
+#define PD_DEV2_INTMASK PD_DEV2_DB0_INTMASK
+#else
+#define PD_DEV2_INTMASK 0u
+#endif /* BCMPCIE_IDMA || BCMPCIE_DMA_CH2 || BCMPCIE_IFRM */
+/* DMA channel 1 datapath use case */
+#ifdef BCMPCIE_DMA_CH1
+#define PD_DEV1_INTMASK PD_DEV1_DB0_INTMASK
+#else
+#define PD_DEV1_INTMASK 0u
+#endif /* BCMPCIE_DMA_CH1 */
+#if defined(BCMPCIE_IDMA) || defined(BCMPCIE_IFRM)
+#define PD_DEV1_IDMA_DW_INTMASK PD_DEV1_DB1_INTMASK
+#else
+#define PD_DEV1_IDMA_DW_INTMASK 0u
+#endif /* BCMPCIE_IDMA || BCMPCIE_IFRM */
+
+#define PD_DEV0_INTMASK                \
+       (PD_DEV0_DMA_INTMASK | PD_DEV0_DB0_INTMASK | PD_DEV0_PWRSTATE_INTMASK | \
+       PD_DEV0_PERST_INTMASK | PD_DEV1_INTMASK | PD_DEV2_INTMASK | PD_DEV0_DB1_INTMASK | \
+       PD_DEV1_IDMA_DW_INTMASK)
+
+/* implicit DMA index */
+#define        PD_IDMA_COMP                    0xf             /* implicit dma complete */
+#define        PD_IDMA_IDX0_COMP               ((uint32)1 << 0)        /* implicit dma index0 complete */
+#define        PD_IDMA_IDX1_COMP               ((uint32)1 << 1)        /* implicit dma index1 complete */
+#define        PD_IDMA_IDX2_COMP               ((uint32)1 << 2)        /* implicit dma index2 complete */
+#define        PD_IDMA_IDX3_COMP               ((uint32)1 << 3)        /* implicit dma index3 complete */
+
+#define PCIE_D2H_DB0_VAL   (0x12345678)
+
+#define PD_ERR_ATTN_INTMASK            (1u << 29)
+#define PD_LINK_DOWN_INTMASK   (1u << 27)
+
+#define PD_ERR_TTX_REQ_DURING_D3       (1u << 31)      /* Tx mem req on iface when in non-D0 */
+#define PD_PRI_SIG_TARGET_ABORT_F1     (1u << 19)      /* Rcvd target Abort Err Status (CA) F1 */
+#define PD_ERR_UNSPPORT_F1             (1u << 18)      /* Unsupported Request Error Status. F1 */
+#define PD_ERR_ECRC_F1                 (1u << 17)      /* ECRC Error TLP Status. F1 */
+#define PD_ERR_MALF_TLP_F1             (1u << 16)      /* Malformed TLP Status. F1 */
+#define PD_ERR_RX_OFLOW_F1             (1u << 15)      /* Receiver Overflow Status. */
+#define PD_ERR_UNEXP_CPL_F1            (1u << 14)      /* Unexpected Completion Status. F1 */
+#define PD_ERR_MASTER_ABRT_F1          (1u << 13)      /* Receive UR Completion Status. F1 */
+#define PD_ERR_CPL_TIMEOUT_F1          (1u << 12)      /* Completer Timeout Status F1 */
+#define PD_ERR_FC_PRTL_F1              (1u << 11)      /* Flow Control Protocol Error Status F1 */
+#define PD_ERR_PSND_TLP_F1             (1u << 10)      /* Poisoned Error Status F1 */
+#define PD_PRI_SIG_TARGET_ABORT                (1u << 9)       /* Received target Abort Error Status(CA) */
+#define PD_ERR_UNSPPORT                        (1u << 8)       /* Unsupported Request Error Status. */
+#define PD_ERR_ECRC                    (1u << 7)       /* ECRC Error TLP Status. */
+#define PD_ERR_MALF_TLP                        (1u << 6)       /* Malformed TLP Status. */
+#define PD_ERR_RX_OFLOW                        (1u << 5)       /* Receiver Overflow Status. */
+#define PD_ERR_UNEXP_CPL               (1u << 4)       /* Unexpected Completion Status. */
+#define PD_ERR_MASTER_ABRT             (1u << 3)       /* Receive UR Completion Status. */
+#define PD_ERR_CPL_TIMEOUT             (1u << 2)       /* Completer Timeout Status */
+#define PD_ERR_FC_PRTL                 (1u << 1)       /* Flow Control Protocol Error Status */
+#define PD_ERR_PSND_TLP                        (1u << 0)       /* Poisoned Error Status */
+
+/* All ERR_ATTN of F1 */
+#define PD_ERR_FUNCTION1       \
+       (PD_ERR_PSND_TLP_F1 | PD_ERR_FC_PRTL_F1 | PD_ERR_CPL_TIMEOUT_F1 | PD_ERR_MASTER_ABRT_F1 | \
+       PD_ERR_UNEXP_CPL_F1 | PD_ERR_RX_OFLOW_F1 | PD_ERR_MALF_TLP_F1 | PD_ERR_ECRC_F1 | \
+       PD_ERR_UNSPPORT_F1 | PD_PRI_SIG_TARGET_ABORT_F1)
+
+#define PD_ERR_TTX_REQ_DURING_D3_FN0   (1u << 10)      /* Tx mem req on iface when in non-D0 */
+
+/* HWA Doorbell-To-Function Mapping */
+#define PD_DB_IDMA_HWA_MASK    (0x03u)
+#define PD_DB_IDMA_HWA_SHIFT   (20u)
+
+/* H2D Doorbell Fields for IDMA / HWA / PWI */
+#define PD_DB_FRG_ID_SHIFT             (0u)
+#define PD_DB_FRG_ID_MASK              (0xFu)          /* bits 3:0 */
+#define PD_DB_DMA_TYPE_SHIFT           (4u)
+#define PD_DB_DMA_TYPE_MASK            (0xFu)          /* bits 7:4 */
+#define PD_DB_RINGIDX_NUM_SHIFT                (8u)
+#define PD_DB_RINGIDX_NUM_MASK         (0xFFu)         /* bits 15:8 */
+#define PD_DB_INDEX_VAL_SHIFT          (16u)
+#define PD_DB_INDEX_VAL_MASK           (0xFFFFu)       /* bits 31:16 */
+
+/* PWI LUT entry fields */
+#define PWI_FLOW_VALID_MASK            (0x1u)
+#define PWI_FLOW_VALID_SHIFT           (22u)
+#define PWI_FLOW_RING_GROUP_ID_MASK    (0x3u)
+#define PWI_FLOW_RING_GROUP_ID_SHIFT   (20u)
+#define PWI_HOST_RINGIDX_MASK  (0xFFu) /* Host Ring Index Number[19:12] */
+#define PWI_HOST_RINGIDX_SHIFT (12u)
+#define PWI_HWA_RINGTYPE_MASK  (0xFu)  /* HWA Ring Type Mapping-[11:8] */
+#define PWI_HWA_RINGTYPE_SHIFT (8u)
+#define PWI_HWA_RINGIDX_MASK   (0xFFu) /* HWA Ring Index Mapping- [7:0] */
+#define PWI_HWA_RINGIDX_SHIFT  (0u)
+
+/* DMA_TYPE Values */
+#define PD_DB_DMA_TYPE_NO_IDMA (0u)
+#define PD_DB_DMA_TYPE_IDMA    (1u)
+#define PD_DB_DMA_TYPE_PWI     (2u)
+#define PD_DB_DMA_TYPE_RXPOST(rev)     (REV_GE_73((rev)) ? (1u) : (5u))
+#define PD_DB_DMA_TYPE_TXCPL(rev)      (REV_GE_73((rev)) ? (2u) : (6u))
+#define PD_DB_DMA_TYPE_RXCPL(rev)      (REV_GE_73((rev)) ? (3u) : (7u))
+
+/* All ERR_ATTN of F0 */
+#define PD_ERR_FUNCTION0       \
+       (PD_ERR_PSND_TLP | PD_ERR_FC_PRTL | PD_ERR_CPL_TIMEOUT | PD_ERR_MASTER_ABRT | \
+       PD_ERR_UNEXP_CPL | PD_ERR_RX_OFLOW | PD_ERR_MALF_TLP | PD_ERR_ECRC | \
+       PD_ERR_UNSPPORT | PD_PRI_SIG_TARGET_ABORT)
+/* Shift of F1 bits */
+#define PD_ERR_FUNCTION1_SHIFT  10u
+
+#endif /* _PCIE_CORE_H */
diff --git a/bcmdhd.101.10.240.x/include/sbchipc.h b/bcmdhd.101.10.240.x/include/sbchipc.h
new file mode 100644 (file)
index 0000000..06a40bc
--- /dev/null
@@ -0,0 +1,4995 @@
+/*
+ * SiliconBackplane Chipcommon core hardware definitions.
+ *
+ * The chipcommon core provides chip identification, SB control,
+ * JTAG, 0/1/2 UARTs, clock frequency control, a watchdog interrupt timer,
+ * GPIO interface, extbus, and support for serial and parallel flashes.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _SBCHIPC_H
+#define        _SBCHIPC_H
+
+#if !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__)
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define        _PADLINE(line)  pad ## line
+#define        _XSTR(line)     _PADLINE(line)
+#define        PAD             _XSTR(__LINE__)
+#endif /* PAD */
+
+#define BCM_MASK32(msb, lsb)   ((~0u >> (32u - (msb) - 1u)) & (~0u << (lsb)))
+#include <bcmutils.h>
+
+/**
+ * In chipcommon rev 49 the pmu registers have been moved from chipc to the pmu core if the
+ * 'AOBPresent' bit of 'CoreCapabilitiesExt' is set. If this field is set, the traditional chipc to
+ * [pmu|gci|sreng] register interface is deprecated and removed. These register blocks would instead
+ * be assigned their respective chipc-specific address space and connected to the Always On
+ * Backplane via the APB interface.
+ */
+typedef volatile struct {
+       uint32  PAD[384];
+       uint32  pmucontrol;             /* 0x600 */
+       uint32  pmucapabilities;        /* 0x604 */
+       uint32  pmustatus;              /* 0x608 */
+       uint32  res_state;              /* 0x60C */
+       uint32  res_pending;            /* 0x610 */
+       uint32  pmutimer;               /* 0x614 */
+       uint32  min_res_mask;           /* 0x618 */
+       uint32  max_res_mask;           /* 0x61C */
+       uint32  res_table_sel;          /* 0x620 */
+       uint32  res_dep_mask;
+       uint32  res_updn_timer;
+       uint32  res_timer;
+       uint32  clkstretch;
+       uint32  pmuwatchdog;
+       uint32  gpiosel;                /* 0x638, rev >= 1 */
+       uint32  gpioenable;             /* 0x63c, rev >= 1 */
+       uint32  res_req_timer_sel;      /* 0x640 */
+       uint32  res_req_timer;          /* 0x644 */
+       uint32  res_req_mask;           /* 0x648 */
+       uint32  core_cap_ext;           /* 0x64C */
+       uint32  chipcontrol_addr;       /* 0x650 */
+       uint32  chipcontrol_data;       /* 0x654 */
+       uint32  regcontrol_addr;
+       uint32  regcontrol_data;
+       uint32  pllcontrol_addr;
+       uint32  pllcontrol_data;
+       uint32  pmustrapopt;            /* 0x668, corerev >= 28 */
+       uint32  pmu_xtalfreq;           /* 0x66C, pmurev >= 10 */
+       uint32  retention_ctl;          /* 0x670 */
+       uint32  ILPPeriod;              /* 0x674 */
+       uint32  PAD[2];
+       uint32  retention_grpidx;       /* 0x680 */
+       uint32  retention_grpctl;       /* 0x684 */
+       uint32  mac_res_req_timer;      /* 0x688 */
+       uint32  mac_res_req_mask;       /* 0x68c */
+       uint32  spm_ctrl;               /* 0x690 */
+       uint32  spm_cap;                /* 0x694 */
+       uint32  spm_clk_ctrl;           /* 0x698 */
+       uint32  int_hi_status;          /* 0x69c */
+       uint32  int_lo_status;          /* 0x6a0 */
+       uint32  mon_table_addr;         /* 0x6a4 */
+       uint32  mon_ctrl_n;             /* 0x6a8 */
+       uint32  mon_status_n;           /* 0x6ac */
+       uint32  int_treshold_n;         /* 0x6b0 */
+       uint32  watermarks_n;           /* 0x6b4 */
+       uint32  spm_debug;              /* 0x6b8 */
+       uint32  PAD[1];
+       uint32  vtrim_ctrl;             /* 0x6c0 */
+       uint32  vtrim_status;           /* 0x6c4 */
+       uint32  usec_timer;             /* 0x6c8 */
+       uint32  usec_timer_frac;        /* 0x6cc */
+       uint32  pcie_tpower_on;         /* 0x6d0 */
+       uint32  pcie_tport_cnt;         /* 0x6d4 */
+       uint32  pmucontrol_ext;         /* 0x6d8 */
+       uint32  slowclkperiod;          /* 0x6dc */
+       uint32  pmu_statstimer_addr;    /* 0x6e0 */
+       uint32  pmu_statstimer_ctrl;    /* 0x6e4 */
+       uint32  pmu_statstimer_N;       /* 0x6e8 */
+       uint32  PAD[1];
+       uint32  mac_res_req_timer1;     /* 0x6f0 */
+       uint32  mac_res_req_mask1;      /* 0x6f4 */
+       uint32  PAD[2];
+       uint32  pmuintmask0;            /* 0x700 */
+       uint32  pmuintmask1;            /* 0x704 */
+       uint32  PAD[2];
+       uint32  fis_start_min_res_mask; /* 0x710 */
+       uint32  PAD[3];
+       uint32  rsrc_event0;            /* 0x720 */
+       uint32  PAD[3];
+       uint32  slowtimer2;             /* 0x730 */
+       uint32  slowtimerfrac2;         /* 0x734 */
+       uint32  mac_res_req_timer2;     /* 0x738 */
+       uint32  mac_res_req_mask2;      /* 0x73c */
+       uint32  pmuintstatus;           /* 0x740 */
+       uint32  extwakeupstatus;        /* 0x744 */
+       uint32  watchdog_res_mask;      /* 0x748 */
+       uint32  PAD[1];                 /* 0x74C */
+       uint32  swscratch;              /* 0x750 */
+       uint32  PAD[3];                 /* 0x754-0x75C */
+       uint32  extwakemask0;           /* 0x760 */
+       uint32  extwakemask1;           /* 0x764 */
+       uint32  PAD[2];                 /* 0x768-0x76C */
+       uint32  extwakereqmask[2];      /* 0x770-0x774 */
+       uint32  PAD[2];                 /* 0x778-0x77C */
+       uint32  pmuintctrl0;            /* 0x780 */
+       uint32  pmuintctrl1;            /* 0x784 */
+       uint32  PAD[2];
+       uint32  extwakectrl[2];         /* 0x790 */
+       uint32  PAD[7];
+       uint32  fis_ctrl_status;        /* 0x7b4 */
+       uint32  fis_min_res_mask;       /* 0x7b8 */
+       uint32  PAD[1];
+       uint32  precision_tmr_ctrl_status;      /* 0x7c0 */
+       uint32  precision_tmr_capture_low;      /* 0x7c4 */
+       uint32  precision_tmr_capture_high;     /* 0x7c8 */
+       uint32  precision_tmr_capture_frac;     /* 0x7cc */
+       uint32  precision_tmr_running_low;      /* 0x7d0 */
+       uint32  precision_tmr_running_high;     /* 0x7d4 */
+       uint32  precision_tmr_running_frac;     /* 0x7d8 */
+       uint32  PAD[3];
+       uint32  core_cap_ext1;                  /* 0x7e8 */
+       uint32  PAD[5];
+       uint32  rsrc_substate_ctl_sts;          /* 0x800 */
+       uint32  rsrc_substate_trans_tmr;        /* 0x804 */
+       uint32  PAD[2];
+       uint32  dvfs_ctrl1;                     /* 0x810 */
+       uint32  dvfs_ctrl2;                     /* 0x814 */
+       uint32  dvfs_voltage;                   /* 0x818 */
+       uint32  dvfs_status;                    /* 0x81c */
+       uint32  dvfs_core_table_address;        /* 0x820 */
+       uint32  dvfs_core_ctrl;                 /* 0x824 */
+} pmuregs_t;
+
+typedef struct eci_prerev35 {
+       uint32  eci_output;
+       uint32  eci_control;
+       uint32  eci_inputlo;
+       uint32  eci_inputmi;
+       uint32  eci_inputhi;
+       uint32  eci_inputintpolaritylo;
+       uint32  eci_inputintpolaritymi;
+       uint32  eci_inputintpolarityhi;
+       uint32  eci_intmasklo;
+       uint32  eci_intmaskmi;
+       uint32  eci_intmaskhi;
+       uint32  eci_eventlo;
+       uint32  eci_eventmi;
+       uint32  eci_eventhi;
+       uint32  eci_eventmasklo;
+       uint32  eci_eventmaskmi;
+       uint32  eci_eventmaskhi;
+       uint32  PAD[3];
+} eci_prerev35_t;
+
+typedef struct eci_rev35 {
+       uint32  eci_outputlo;
+       uint32  eci_outputhi;
+       uint32  eci_controllo;
+       uint32  eci_controlhi;
+       uint32  eci_inputlo;
+       uint32  eci_inputhi;
+       uint32  eci_inputintpolaritylo;
+       uint32  eci_inputintpolarityhi;
+       uint32  eci_intmasklo;
+       uint32  eci_intmaskhi;
+       uint32  eci_eventlo;
+       uint32  eci_eventhi;
+       uint32  eci_eventmasklo;
+       uint32  eci_eventmaskhi;
+       uint32  eci_auxtx;
+       uint32  eci_auxrx;
+       uint32  eci_datatag;
+       uint32  eci_uartescvalue;
+       uint32  eci_autobaudctr;
+       uint32  eci_uartfifolevel;
+} eci_rev35_t;
+
+typedef struct flash_config {
+       uint32  PAD[19];
+       /* Flash struct configuration registers (0x18c) for BCM4706 (corerev = 31) */
+       uint32 flashstrconfig;
+} flash_config_t;
+
+typedef volatile struct {
+       uint32  chipid;                 /* 0x0 */
+       uint32  capabilities;
+       uint32  corecontrol;            /* corerev >= 1 */
+       uint32  bist;
+
+       /* OTP */
+       uint32  otpstatus;              /* 0x10, corerev >= 10 */
+       uint32  otpcontrol;
+       uint32  otpprog;
+       uint32  otplayout;              /* corerev >= 23 */
+
+       /* Interrupt control */
+       uint32  intstatus;              /* 0x20 */
+       uint32  intmask;
+
+       /* Chip specific regs */
+       uint32  chipcontrol;            /* 0x28, rev >= 11 */
+       uint32  chipstatus;             /* 0x2c, rev >= 11 */
+
+       /* Jtag Master */
+       uint32  jtagcmd;                /* 0x30, rev >= 10 */
+       uint32  jtagir;
+       uint32  jtagdr;
+       uint32  jtagctrl;
+
+       /* serial flash interface registers */
+       uint32  flashcontrol;           /* 0x40 */
+       uint32  flashaddress;
+       uint32  flashdata;
+       uint32  otplayoutextension;     /* rev >= 35 */
+
+       /* Silicon backplane configuration broadcast control */
+       uint32  broadcastaddress;       /* 0x50 */
+       uint32  broadcastdata;
+
+       /* gpio - cleared only by power-on-reset */
+       uint32  gpiopullup;             /* 0x58, corerev >= 20 */
+       uint32  gpiopulldown;           /* 0x5c, corerev >= 20 */
+       uint32  gpioin;                 /* 0x60 */
+       uint32  gpioout;                /* 0x64 */
+       uint32  gpioouten;              /* 0x68 */
+       uint32  gpiocontrol;            /* 0x6C */
+       uint32  gpiointpolarity;        /* 0x70 */
+       uint32  gpiointmask;            /* 0x74 */
+
+       /* GPIO events corerev >= 11 */
+       uint32  gpioevent;
+       uint32  gpioeventintmask;
+
+       /* Watchdog timer */
+       uint32  watchdog;               /* 0x80 */
+
+       /* GPIO events corerev >= 11 */
+       uint32  gpioeventintpolarity;
+
+       /* GPIO based LED powersave regs corerev >= 16 */
+       uint32  gpiotimerval;           /* 0x88 */         /* Obsolete and unused now */
+       uint32  gpiotimeroutmask;                          /* Obsolete and unused now */
+
+       /* clock control */
+       uint32  clockcontrol_n;         /* 0x90 */
+       uint32  clockcontrol_sb;        /* aka m0 */
+       uint32  clockcontrol_pci;       /* aka m1 */
+       uint32  clockcontrol_m2;        /* mii/uart/mipsref */
+       uint32  clockcontrol_m3;        /* cpu */
+       uint32  clkdiv;                 /* corerev >= 3 */
+       uint32  gpiodebugsel;           /* corerev >= 28 */
+       uint32  capabilities_ext;       /* 0xac  */
+
+       /* pll delay registers (corerev >= 4) */
+       uint32  pll_on_delay;           /* 0xb0 */
+       uint32  fref_sel_delay;
+       uint32  slow_clk_ctl;           /* 5 < corerev < 10 */
+       uint32  PAD;
+
+       /* Instaclock registers (corerev >= 10) */
+       uint32  system_clk_ctl;         /* 0xc0 */
+       uint32  clkstatestretch;
+       uint32  PAD[2];
+
+       /* Indirect backplane access (corerev >= 22) */
+       uint32  bp_addrlow;             /* 0xd0 */
+       uint32  bp_addrhigh;
+       uint32  bp_data;
+       uint32  PAD;
+       uint32  bp_indaccess;
+       /* SPI registers, corerev >= 37 */
+       uint32  gsioctrl;
+       uint32  gsioaddress;
+       uint32  gsiodata;
+
+       /* More clock dividers (corerev >= 32) */
+       uint32  clkdiv2;
+       /* FAB ID (corerev >= 40) */
+       uint32  otpcontrol1;
+       uint32  fabid;                  /* 0xf8 */
+
+       /* In AI chips, pointer to erom */
+       uint32  eromptr;                /* 0xfc */
+
+       /* ExtBus control registers (corerev >= 3) */
+       uint32  pcmcia_config;          /* 0x100 */
+       uint32  pcmcia_memwait;
+       uint32  pcmcia_attrwait;
+       uint32  pcmcia_iowait;
+       uint32  ide_config;
+       uint32  ide_memwait;
+       uint32  ide_attrwait;
+       uint32  ide_iowait;
+       uint32  prog_config;
+       uint32  prog_waitcount;
+       uint32  flash_config;
+       uint32  flash_waitcount;
+       uint32  SECI_config;            /* 0x130 SECI configuration */
+       uint32  SECI_status;
+       uint32  SECI_statusmask;
+       uint32  SECI_rxnibchanged;
+
+       uint32  PAD[20];
+
+       /* SROM interface (corerev >= 32) */
+       uint32  sromcontrol;            /* 0x190 */
+       uint32  sromaddress;
+       uint32  sromdata;
+       uint32  PAD[1];                         /* 0x19C */
+       /* NAND flash registers for BCM4706 (corerev = 31) */
+       uint32  nflashctrl;         /* 0x1a0 */
+       uint32  nflashconf;
+       uint32  nflashcoladdr;
+       uint32  nflashrowaddr;
+       uint32  nflashdata;
+       uint32  nflashwaitcnt0;         /* 0x1b4 */
+       uint32  PAD[2];
+
+       uint32  seci_uart_data;         /* 0x1C0 */
+       uint32  seci_uart_bauddiv;
+       uint32  seci_uart_fcr;
+       uint32  seci_uart_lcr;
+       uint32  seci_uart_mcr;
+       uint32  seci_uart_lsr;
+       uint32  seci_uart_msr;
+       uint32  seci_uart_baudadj;
+       /* Clock control and hardware workarounds (corerev >= 20) */
+       uint32  clk_ctl_st;             /* 0x1e0 */
+       uint32  hw_war;
+       uint32  powerctl;               /* 0x1e8 */
+       uint32  powerctl2;              /* 0x1ec */
+       uint32  PAD[68];
+
+       /* UARTs */
+       uint8   uart0data;              /* 0x300 */
+       uint8   uart0imr;
+       uint8   uart0fcr;
+       uint8   uart0lcr;
+       uint8   uart0mcr;
+       uint8   uart0lsr;
+       uint8   uart0msr;
+       uint8   uart0scratch;
+       uint8   PAD[184];               /* corerev >= 65 */
+       uint32  rng_ctrl_0;             /* 0x3c0 */
+       uint32  rng_rng_soft_reset;     /* 0x3c4 */
+       uint32  rng_rbg_soft_reset;     /* 0x3c8 */
+       uint32  rng_total_bit_cnt;      /* 0x3cc */
+       uint32  rng_total_bit_thrshld;  /* 0x3d0 */
+       uint32  rng_rev_id;             /* 0x3d4 */
+       uint32  rng_int_status_0;       /* 0x3d8 */
+       uint32  rng_int_enable_0;       /* 0x3dc */
+       uint32  rng_fifo_data;          /* 0x3e0 */
+       uint32  rng_fifo_cnt;           /* 0x3e4 */
+       uint8   PAD[24];                /* corerev >= 65 */
+
+       uint8   uart1data;              /* 0x400 */
+       uint8   uart1imr;
+       uint8   uart1fcr;
+       uint8   uart1lcr;
+       uint8   uart1mcr;
+       uint8   uart1lsr;
+       uint8   uart1msr;
+       uint8   uart1scratch;           /* 0x407 */
+       uint32  PAD[50];
+       uint32  sr_memrw_addr;          /* 0x4d0 */
+       uint32  sr_memrw_data;          /* 0x4d4 */
+       uint32  PAD[10];
+
+       /* save/restore, corerev >= 48 */
+       uint32  sr_capability;          /* 0x500 */
+       uint32  sr_control0;            /* 0x504 */
+       uint32  sr_control1;            /* 0x508 */
+       uint32  gpio_control;           /* 0x50C */
+       uint32  PAD[29];
+       /* 2 SR engines case */
+       uint32  sr1_control0;           /* 0x584 */
+       uint32  sr1_control1;           /* 0x588 */
+       uint32  PAD[29];
+       /* PMU registers (corerev >= 20) */
+       /* Note: all timers driven by ILP clock are updated asynchronously to HT/ALP.
+        * The CPU must read them twice, compare, and retry if different.
+        */
+       uint32  pmucontrol;             /* 0x600 */
+       uint32  pmucapabilities;
+       uint32  pmustatus;
+       uint32  res_state;
+       uint32  res_pending;
+       uint32  pmutimer;
+       uint32  min_res_mask;
+       uint32  max_res_mask;
+       uint32  res_table_sel;
+       uint32  res_dep_mask;
+       uint32  res_updn_timer;
+       uint32  res_timer;
+       uint32  clkstretch;
+       uint32  pmuwatchdog;
+       uint32  gpiosel;                /* 0x638, rev >= 1 */
+       uint32  gpioenable;             /* 0x63c, rev >= 1 */
+       uint32  res_req_timer_sel;
+       uint32  res_req_timer;
+       uint32  res_req_mask;
+       uint32  core_cap_ext;           /* 0x64c */
+       uint32  chipcontrol_addr;       /* 0x650 */
+       uint32  chipcontrol_data;       /* 0x654 */
+       uint32  regcontrol_addr;
+       uint32  regcontrol_data;
+       uint32  pllcontrol_addr;
+       uint32  pllcontrol_data;
+       uint32  pmustrapopt;            /* 0x668, corerev >= 28 */
+       uint32  pmu_xtalfreq;           /* 0x66C, pmurev >= 10 */
+       uint32  retention_ctl;          /* 0x670 */
+       uint32  ILPPeriod;              /* 0x674 */
+       uint32  PAD[2];
+       uint32  retention_grpidx;       /* 0x680 */
+       uint32  retention_grpctl;       /* 0x684 */
+       uint32  mac_res_req_timer;      /* 0x688 */
+       uint32  mac_res_req_mask;       /* 0x68c */
+       uint32  PAD[18];
+       uint32  pmucontrol_ext;         /* 0x6d8 */
+       uint32  slowclkperiod;          /* 0x6dc */
+       uint32  pmu_statstimer_addr;    /* 0x6e0 */
+       uint32  pmu_statstimer_ctrl;    /* 0x6e4 */
+       uint32  pmu_statstimer_N;       /* 0x6e8 */
+       uint32  PAD[1];
+       uint32  mac_res_req_timer1;     /* 0x6f0 */
+       uint32  mac_res_req_mask1;      /* 0x6f4 */
+       uint32  PAD[2];
+       uint32  pmuintmask0;            /* 0x700 */
+       uint32  pmuintmask1;            /* 0x704 */
+       uint32  PAD[14];
+       uint32  pmuintstatus;           /* 0x740 */
+       uint32  extwakeupstatus;        /* 0x744 */
+       uint32  PAD[6];
+       uint32  extwakemask0;           /* 0x760 */
+       uint32  extwakemask1;           /* 0x764 */
+       uint32  PAD[2];                 /* 0x768-0x76C */
+       uint32  extwakereqmask[2];      /* 0x770-0x774 */
+       uint32  PAD[2];                 /* 0x778-0x77C */
+       uint32  pmuintctrl0;            /* 0x780 */
+       uint32  PAD[3];                 /* 0x784 - 0x78c */
+       uint32  extwakectrl[1];         /* 0x790 */
+       uint32  PAD[PADSZ(0x794u, 0x7b0u)];     /* 0x794 - 0x7b0 */
+       uint32  fis_ctrl_status;        /* 0x7b4 */
+       uint32  fis_min_res_mask;       /* 0x7b8 */
+       uint32  PAD[PADSZ(0x7bcu, 0x7bcu)];     /* 0x7bc */
+       uint32  precision_tmr_ctrl_status;      /* 0x7c0 */
+       uint32  precision_tmr_capture_low;      /* 0x7c4 */
+       uint32  precision_tmr_capture_high;     /* 0x7c8 */
+       uint32  precision_tmr_capture_frac;     /* 0x7cc */
+       uint32  precision_tmr_running_low;      /* 0x7d0 */
+       uint32  precision_tmr_running_high;     /* 0x7d4 */
+       uint32  precision_tmr_running_frac;     /* 0x7d8 */
+       uint32  PAD[PADSZ(0x7dcu, 0x7e4u)];     /* 0x7dc - 0x7e4 */
+       uint32  core_cap_ext1;                  /* 0x7e8 */
+       uint32  PAD[PADSZ(0x7ecu, 0x7fcu)];     /* 0x7ec - 0x7fc */
+
+       uint16  sromotp[512];           /* 0x800 */
+#ifdef CCNFLASH_SUPPORT
+       /* Nand flash MLC controller registers (corerev >= 38) */
+       uint32  nand_revision;          /* 0xC00 */
+       uint32  nand_cmd_start;
+       uint32  nand_cmd_addr_x;
+       uint32  nand_cmd_addr;
+       uint32  nand_cmd_end_addr;
+       uint32  nand_cs_nand_select;
+       uint32  nand_cs_nand_xor;
+       uint32  PAD;
+       uint32  nand_spare_rd0;
+       uint32  nand_spare_rd4;
+       uint32  nand_spare_rd8;
+       uint32  nand_spare_rd12;
+       uint32  nand_spare_wr0;
+       uint32  nand_spare_wr4;
+       uint32  nand_spare_wr8;
+       uint32  nand_spare_wr12;
+       uint32  nand_acc_control;
+       uint32  PAD;
+       uint32  nand_config;
+       uint32  PAD;
+       uint32  nand_timing_1;
+       uint32  nand_timing_2;
+       uint32  nand_semaphore;
+       uint32  PAD;
+       uint32  nand_devid;
+       uint32  nand_devid_x;
+       uint32  nand_block_lock_status;
+       uint32  nand_intfc_status;
+       uint32  nand_ecc_corr_addr_x;
+       uint32  nand_ecc_corr_addr;
+       uint32  nand_ecc_unc_addr_x;
+       uint32  nand_ecc_unc_addr;
+       uint32  nand_read_error_count;
+       uint32  nand_corr_stat_threshold;
+       uint32  PAD[2];
+       uint32  nand_read_addr_x;
+       uint32  nand_read_addr;
+       uint32  nand_page_program_addr_x;
+       uint32  nand_page_program_addr;
+       uint32  nand_copy_back_addr_x;
+       uint32  nand_copy_back_addr;
+       uint32  nand_block_erase_addr_x;
+       uint32  nand_block_erase_addr;
+       uint32  nand_inv_read_addr_x;
+       uint32  nand_inv_read_addr;
+       uint32  PAD[2];
+       uint32  nand_blk_wr_protect;
+       uint32  PAD[3];
+       uint32  nand_acc_control_cs1;
+       uint32  nand_config_cs1;
+       uint32  nand_timing_1_cs1;
+       uint32  nand_timing_2_cs1;
+       uint32  PAD[20];
+       uint32  nand_spare_rd16;
+       uint32  nand_spare_rd20;
+       uint32  nand_spare_rd24;
+       uint32  nand_spare_rd28;
+       uint32  nand_cache_addr;
+       uint32  nand_cache_data;
+       uint32  nand_ctrl_config;
+       uint32  nand_ctrl_status;
+#endif /* CCNFLASH_SUPPORT */
+       /* Note: there is a clash between GCI and NFLASH. So,
+       * we decided to  have it like below. the functions accessing following
+       * have to be protected with NFLASH_SUPPORT. The functions will
+       * assert in case the clash happens.
+       */
+       uint32  gci_corecaps0; /* GCI starting at 0xC00 */
+       uint32  gci_corecaps1;
+       uint32  gci_corecaps2;
+       uint32  gci_corectrl;
+       uint32  gci_corestat; /* 0xC10 */
+       uint32  gci_intstat; /* 0xC14 */
+       uint32  gci_intmask; /* 0xC18 */
+       uint32  gci_wakemask; /* 0xC1C */
+       uint32  gci_levelintstat; /* 0xC20 */
+       uint32  gci_eventintstat; /* 0xC24 */
+       uint32  PAD[6];
+       uint32  gci_indirect_addr; /* 0xC40 */
+       uint32  gci_gpioctl; /* 0xC44 */
+       uint32  gci_gpiostatus;
+       uint32  gci_gpiomask; /* 0xC4C */
+       uint32  gci_eventsummary; /* 0xC50 */
+       uint32  gci_miscctl; /* 0xC54 */
+       uint32  gci_gpiointmask;
+       uint32  gci_gpiowakemask;
+       uint32  gci_input[32]; /* C60 */
+       uint32  gci_event[32]; /* CE0 */
+       uint32  gci_output[4]; /* D60 */
+       uint32  gci_control_0; /* 0xD70 */
+       uint32  gci_control_1; /* 0xD74 */
+       uint32  gci_intpolreg; /* 0xD78 */
+       uint32  gci_levelintmask; /* 0xD7C */
+       uint32  gci_eventintmask; /* 0xD80 */
+       uint32  PAD[3];
+       uint32  gci_inbandlevelintmask; /* 0xD90 */
+       uint32  gci_inbandeventintmask; /* 0xD94 */
+       uint32  PAD[2];
+       uint32  gci_seciauxtx; /* 0xDA0 */
+       uint32  gci_seciauxrx; /* 0xDA4 */
+       uint32  gci_secitx_datatag; /* 0xDA8 */
+       uint32  gci_secirx_datatag; /* 0xDAC */
+       uint32  gci_secitx_datamask; /* 0xDB0 */
+       uint32  gci_seciusef0tx_reg; /* 0xDB4 */
+       uint32  gci_secif0tx_offset; /* 0xDB8 */
+       uint32  gci_secif0rx_offset; /* 0xDBC */
+       uint32  gci_secif1tx_offset; /* 0xDC0 */
+       uint32  gci_rxfifo_common_ctrl; /* 0xDC4 */
+       uint32  gci_rxfifoctrl; /* 0xDC8 */
+       uint32  gci_uartreadid; /* DCC */
+       uint32  gci_seciuartescval; /* DD0 */
+       uint32  PAD;
+       uint32  gci_secififolevel; /* DD8 */
+       uint32  gci_seciuartdata; /* DDC */
+       uint32  gci_secibauddiv; /* DE0 */
+       uint32  gci_secifcr; /* DE4 */
+       uint32  gci_secilcr; /* DE8 */
+       uint32  gci_secimcr; /* DEC */
+       uint32  gci_secilsr; /* DF0 */
+       uint32  gci_secimsr; /* DF4 */
+       uint32  gci_baudadj; /* DF8 */
+       uint32  PAD;
+       uint32  gci_chipctrl; /* 0xE00 */
+       uint32  gci_chipsts; /* 0xE04 */
+       uint32  gci_gpioout; /* 0xE08 */
+       uint32  gci_gpioout_read; /* 0xE0C */
+       uint32  gci_mpwaketx; /* 0xE10 */
+       uint32  gci_mpwakedetect; /* 0xE14 */
+       uint32  gci_seciin_ctrl; /* 0xE18 */
+       uint32  gci_seciout_ctrl; /* 0xE1C */
+       uint32  gci_seciin_auxfifo_en; /* 0xE20 */
+       uint32  gci_seciout_txen_txbr; /* 0xE24 */
+       uint32  gci_seciin_rxbrstatus; /* 0xE28 */
+       uint32  gci_seciin_rxerrstatus; /* 0xE2C */
+       uint32  gci_seciin_fcstatus; /* 0xE30 */
+       uint32  gci_seciout_txstatus; /* 0xE34 */
+       uint32  gci_seciout_txbrstatus; /* 0xE38 */
+} chipcregs_t;
+
+#endif /* !_LANGUAGE_ASSEMBLY && !__ASSEMBLY__ */
+
+#define        CC_CHIPID               0
+#define        CC_CAPABILITIES         4
+#define        CC_CHIPST               0x2c
+#define        CC_EROMPTR              0xfc
+
+#define        CC_OTPST                0x10
+#define        CC_INTSTATUS            0x20
+#define        CC_INTMASK              0x24
+#define        CC_JTAGCMD              0x30
+#define        CC_JTAGIR               0x34
+#define        CC_JTAGDR               0x38
+#define        CC_JTAGCTRL             0x3c
+#define        CC_GPIOPU               0x58
+#define        CC_GPIOPD               0x5c
+#define        CC_GPIOIN               0x60
+#define        CC_GPIOOUT              0x64
+#define        CC_GPIOOUTEN            0x68
+#define        CC_GPIOCTRL             0x6c
+#define        CC_GPIOPOL              0x70
+#define        CC_GPIOINTM             0x74
+#define        CC_GPIOEVENT            0x78
+#define        CC_GPIOEVENTMASK        0x7c
+#define        CC_WATCHDOG             0x80
+#define        CC_GPIOEVENTPOL         0x84
+#define        CC_CLKC_N               0x90
+#define        CC_CLKC_M0              0x94
+#define        CC_CLKC_M1              0x98
+#define        CC_CLKC_M2              0x9c
+#define        CC_CLKC_M3              0xa0
+#define        CC_CLKDIV               0xa4
+#define        CC_CAP_EXT              0xac
+#define        CC_SYS_CLK_CTL          0xc0
+#define CC_BP_ADRLOW            0xd0
+#define CC_BP_ADRHI             0xd4
+#define CC_BP_DATA              0xd8
+#define CC_SCR_DHD_TO_BL        CC_BP_ADRHI
+#define CC_SCR_BL_TO_DHD        CC_BP_ADRLOW
+#define        CC_CLKDIV2              0xf0
+#define        CC_CLK_CTL_ST           SI_CLK_CTL_ST
+#define        PMU_CTL                 0x600
+#define        PMU_CAP                 0x604
+#define        PMU_ST                  0x608
+#define PMU_RES_STATE          0x60c
+#define PMU_RES_PENDING                0x610
+#define PMU_TIMER              0x614
+#define        PMU_MIN_RES_MASK        0x618
+#define        PMU_MAX_RES_MASK        0x61c
+#define CC_CHIPCTL_ADDR         0x650
+#define CC_CHIPCTL_DATA         0x654
+#define PMU_REG_CONTROL_ADDR   0x658
+#define PMU_REG_CONTROL_DATA   0x65C
+#define PMU_PLL_CONTROL_ADDR   0x660
+#define PMU_PLL_CONTROL_DATA   0x664
+#define PMU_RSRC_CONTROL_MASK   0x7B0
+
+#define CC_SROM_CTRL           0x190
+#define CC_SROM_ADDRESS                0x194u
+#define CC_SROM_DATA           0x198u
+#define        CC_SROM_OTP             0x0800
+#define CC_GCI_INDIRECT_ADDR_REG       0xC40
+#define CC_GCI_CHIP_CTRL_REG   0xE00
+#define CC_GCI_CC_OFFSET_2     2
+#define CC_GCI_CC_OFFSET_5     5
+#define CC_SWD_CTRL            0x380
+#define CC_SWD_REQACK          0x384
+#define CC_SWD_DATA            0x388
+#define GPIO_SEL_0                                     0x00001111
+#define GPIO_SEL_1                                     0x11110000
+#define GPIO_SEL_8                                     0x00001111
+#define GPIO_SEL_9                                     0x11110000
+
+#define CHIPCTRLREG0 0x0
+#define CHIPCTRLREG1 0x1
+#define CHIPCTRLREG2 0x2
+#define CHIPCTRLREG3 0x3
+#define CHIPCTRLREG4 0x4
+#define CHIPCTRLREG5 0x5
+#define CHIPCTRLREG6 0x6
+#define CHIPCTRLREG13 0xd
+#define CHIPCTRLREG16 0x10
+#define REGCTRLREG4 0x4
+#define REGCTRLREG5 0x5
+#define REGCTRLREG6 0x6
+#define MINRESMASKREG 0x618
+#define MAXRESMASKREG 0x61c
+#define CHIPCTRLADDR 0x650
+#define CHIPCTRLDATA 0x654
+#define RSRCTABLEADDR 0x620
+#define PMU_RES_DEP_MASK 0x624
+#define RSRCUPDWNTIME 0x628
+#define PMUREG_RESREQ_MASK 0x68c
+#define PMUREG_RESREQ_TIMER 0x688
+#define PMUREG_RESREQ_MASK1 0x6f4
+#define PMUREG_RESREQ_TIMER1 0x6f0
+#define EXT_LPO_AVAIL 0x100
+#define LPO_SEL                                        (1 << 0)
+#define CC_EXT_LPO_PU 0x200000
+#define GC_EXT_LPO_PU 0x2
+#define CC_INT_LPO_PU 0x100000
+#define GC_INT_LPO_PU 0x1
+#define EXT_LPO_SEL 0x8
+#define INT_LPO_SEL 0x4
+#define ENABLE_FINE_CBUCK_CTRL                 (1 << 30)
+#define REGCTRL5_PWM_AUTO_CTRL_MASK            0x007e0000
+#define REGCTRL5_PWM_AUTO_CTRL_SHIFT           17
+#define REGCTRL6_PWM_AUTO_CTRL_MASK            0x3fff0000
+#define REGCTRL6_PWM_AUTO_CTRL_SHIFT           16
+#define CC_BP_IND_ACCESS_START_SHIFT           9
+#define CC_BP_IND_ACCESS_START_MASK            (1 << CC_BP_IND_ACCESS_START_SHIFT)
+#define CC_BP_IND_ACCESS_RDWR_SHIFT            8
+#define CC_BP_IND_ACCESS_RDWR_MASK             (1 << CC_BP_IND_ACCESS_RDWR_SHIFT)
+#define CC_BP_IND_ACCESS_ERROR_SHIFT           10
+#define CC_BP_IND_ACCESS_ERROR_MASK            (1 << CC_BP_IND_ACCESS_ERROR_SHIFT)
+#define GC_BT_CTRL_UARTPADS_OVRD_EN            (1u << 1)
+
+#define LPO_SEL_TIMEOUT 1000
+
+#define LPO_FINAL_SEL_SHIFT 18
+
+#define LHL_LPO1_SEL 0
+#define LHL_LPO2_SEL 0x1
+#define LHL_32k_SEL 0x2
+#define LHL_EXT_SEL  0x3
+
+#define EXTLPO_BUF_PD  0x40
+#define LPO1_PD_EN     0x1
+#define LPO1_PD_SEL    0x6
+#define LPO1_PD_SEL_VAL        0x4
+#define LPO2_PD_EN     0x8
+#define LPO2_PD_SEL    0x30
+#define LPO2_PD_SEL_VAL        0x20
+#define OSC_32k_PD     0x80
+
+#define LHL_CLK_DET_CTL_AD_CNTR_CLK_SEL        0x3
+
+#define LHL_LPO_AUTO   0x0
+#define LHL_LPO1_ENAB  0x1
+#define LHL_LPO2_ENAB  0x2
+#define LHL_OSC_32k_ENAB       0x3
+#define LHL_EXT_LPO_ENAB       0x4
+#define RADIO_LPO_ENAB 0x5
+
+#define LHL_CLK_DET_CTL_ADR_LHL_CNTR_EN        0x4
+#define LHL_CLK_DET_CTL_ADR_LHL_CNTR_CLR       0x8
+#define LHL_CLK_DET_CNT                0xF0
+#define LHL_CLK_DET_CNT_SHIFT   4
+#define LPO_SEL_SHIFT          9
+
+#define LHL_MAIN_CTL_ADR_FINAL_CLK_SEL 0x3C0000
+#define LHL_MAIN_CTL_ADR_LHL_WLCLK_SEL 0x600
+
+#define CLK_DET_CNT_THRESH     8
+
+#ifdef SR_DEBUG
+#define SUBCORE_POWER_ON 0x0001
+#define PHY_POWER_ON 0x0010
+#define VDDM_POWER_ON 0x0100
+#define MEMLPLDO_POWER_ON 0x1000
+#define SUBCORE_POWER_ON_CHK 0x00040000
+#define PHY_POWER_ON_CHK 0x00080000
+#define VDDM_POWER_ON_CHK 0x00100000
+#define MEMLPLDO_POWER_ON_CHK 0x00200000
+#endif /* SR_DEBUG */
+
+#ifdef CCNFLASH_SUPPORT
+/* NAND flash support */
+#define CC_NAND_REVISION       0xC00
+#define CC_NAND_CMD_START      0xC04
+#define CC_NAND_CMD_ADDR       0xC0C
+#define CC_NAND_SPARE_RD_0     0xC20
+#define CC_NAND_SPARE_RD_4     0xC24
+#define CC_NAND_SPARE_RD_8     0xC28
+#define CC_NAND_SPARE_RD_C     0xC2C
+#define CC_NAND_CONFIG         0xC48
+#define CC_NAND_DEVID          0xC60
+#define CC_NAND_DEVID_EXT      0xC64
+#define CC_NAND_INTFC_STATUS   0xC6C
+#endif /* CCNFLASH_SUPPORT */
+
+/* chipid */
+#define        CID_ID_MASK             0x0000ffff      /**< Chip Id mask */
+#define        CID_REV_MASK            0x000f0000      /**< Chip Revision mask */
+#define        CID_REV_SHIFT           16              /**< Chip Revision shift */
+#define        CID_PKG_MASK            0x00f00000      /**< Package Option mask */
+#define        CID_PKG_SHIFT           20              /**< Package Option shift */
+#define        CID_CC_MASK             0x0f000000      /**< CoreCount (corerev >= 4) */
+#define CID_CC_SHIFT           24
+#define        CID_TYPE_MASK           0xf0000000      /**< Chip Type */
+#define CID_TYPE_SHIFT         28
+
+/* capabilities */
+#define        CC_CAP_UARTS_MASK       0x00000003u     /**< Number of UARTs */
+#define CC_CAP_MIPSEB          0x00000004u     /**< MIPS is in big-endian mode */
+#define CC_CAP_UCLKSEL         0x00000018u     /**< UARTs clock select */
+#define CC_CAP_UINTCLK         0x00000008u     /**< UARTs are driven by internal divided clock */
+#define CC_CAP_UARTGPIO                0x00000020u     /**< UARTs own GPIOs 15:12 */
+#define CC_CAP_EXTBUS_MASK     0x000000c0u     /**< External bus mask */
+#define CC_CAP_EXTBUS_NONE     0x00000000u     /**< No ExtBus present */
+#define CC_CAP_EXTBUS_FULL     0x00000040u     /**< ExtBus: PCMCIA, IDE & Prog */
+#define CC_CAP_EXTBUS_PROG     0x00000080u     /**< ExtBus: ProgIf only */
+#define        CC_CAP_FLASH_MASK       0x00000700u     /**< Type of flash */
+#define        CC_CAP_PLL_MASK         0x00038000u     /**< Type of PLL */
+#define CC_CAP_PWR_CTL         0x00040000u     /**< Power control */
+#define CC_CAP_OTPSIZE         0x00380000u     /**< OTP Size (0 = none) */
+#define CC_CAP_OTPSIZE_SHIFT   19              /**< OTP Size shift */
+#define CC_CAP_OTPSIZE_BASE    5               /**< OTP Size base */
+#define CC_CAP_JTAGP           0x00400000u     /**< JTAG Master Present */
+#define CC_CAP_ROM             0x00800000u     /**< Internal boot rom active */
+#define CC_CAP_BKPLN64         0x08000000u     /**< 64-bit backplane */
+#define        CC_CAP_PMU              0x10000000u     /**< PMU Present, rev >= 20 */
+#define        CC_CAP_ECI              0x20000000u     /**< ECI Present, rev >= 21 */
+#define        CC_CAP_SROM             0x40000000u     /**< Srom Present, rev >= 32 */
+#define        CC_CAP_NFLASH           0x80000000u     /**< Nand flash present, rev >= 35 */
+
+#define        CC_CAP2_SECI            0x00000001u     /**< SECI Present, rev >= 36 */
+#define        CC_CAP2_GSIO            0x00000002u     /**< GSIO (spi/i2c) present, rev >= 37 */
+
+/* capabilities extension */
+#define CC_CAP_EXT_SECI_PRESENT                        0x00000001u     /**< SECI present */
+#define CC_CAP_EXT_GSIO_PRESENT                        0x00000002u     /**< GSIO present */
+#define CC_CAP_EXT_GCI_PRESENT                 0x00000004u     /**< GCI present */
+#define CC_CAP_EXT_SECI_PUART_PRESENT          0x00000008u     /**< UART present */
+#define CC_CAP_EXT_AOB_PRESENT                 0x00000040u     /**< AOB present */
+#define CC_CAP_EXT_SWD_PRESENT                 0x00000400u     /**< SWD present */
+#define CC_CAP_SR_AON_PRESENT                  0x0001E000u     /**< SWD present */
+#define CC_CAP_EXT1_DVFS_PRESENT               0x00001000u     /**< DVFS present */
+
+/* SpmCtrl (Chipcommon Offset 0x690)
+ * Bits 27:16 AlpDiv
+ *   Clock divider control for dividing ALP or TCK clock
+ *   (bit 8 determines ALP vs TCK)
+ * Bits 8 UseDivTck
+ *   See UseDivAlp (bit 1) for more details
+ * Bits 7:6 DebugMuxSel
+ *   Controls the debug mux for SpmDebug register
+ * Bits 5 IntPending
+ *   This field is set to 1 when any of the bits in IntHiStatus or IntLoStatus
+ *   is set. It is automatically cleared after reading and clearing the
+ *   IntHiStatus and IntLoStatus registers. This bit is Read only.
+ * Bits 4 SpmIdle
+ *   Indicates whether the spm controller is running (SpmIdle=0) or in idle
+ *   state (SpmIdle=1); Note that after setting Spmen=1 (or 0), it takes a
+ *   few clock cycles (ILP or divided ALP) for SpmIdle to go to 0 (or 1).
+ *   This bit is Read only.
+ * Bits 3 RoDisOutput
+ *   Debug register - gate off all the SPM ring oscillator clock outputs
+ * Bits 2 RstSpm
+ *   Reset spm controller.
+ *   Put spm in reset before changing UseDivAlp and AlpDiv
+ * Bits 1 UseDivAlp
+ *   This field, along with UseDivTck, selects the clock as the reference clock
+ *   Bits [UseDivTck,UseDivAlp]:
+ *   00 - Use ILP clock as reference clock
+ *   01 - Use divided ALP clock
+ *   10 - Use divided jtag TCK
+ * Bits 0 Spmen
+ *   0 - SPM disabled
+ *   1 - SPM enabled
+ *   Program all the SPM controls before enabling spm. For one-shot operation,
+ *   SpmIdle indicates when the one-shot run has completed. After one-shot
+ *   completion, spmen needs to be disabled first before enabling again.
+ */
+#define SPMCTRL_ALPDIV_FUNC    0x1ffu
+#define SPMCTRL_ALPDIV_RO      0xfffu
+#define SPMCTRL_ALPDIV_SHIFT   16u
+#define SPMCTRL_ALPDIV_MASK    (0xfffu << SPMCTRL_ALPDIV_SHIFT)
+#define SPMCTRL_RSTSPM         0x1u
+#define SPMCTRL_RSTSPM_SHIFT   2u
+#define SPMCTRL_RSTSPM_MASK    (0x1u << SPMCTRL_RSTSPM_SHIFT)
+#define SPMCTRL_USEDIVALP      0x1u
+#define SPMCTRL_USEDIVALP_SHIFT        1u
+#define SPMCTRL_USEDIVALP_MASK (0x1u << SPMCTRL_USEDIVALP_SHIFT)
+#define SPMCTRL_SPMEN          0x1u
+#define SPMCTRL_SPMEN_SHIFT    0u
+#define SPMCTRL_SPMEN_MASK     (0x1u << SPMCTRL_SPMEN_SHIFT)
+
+/* SpmClkCtrl (Chipcommon Offset 0x698)
+ * Bits 31 OneShot
+ *   0 means Take periodic measurements based on IntervalValue
+ *   1 means Take a one shot measurement
+ *   when OneShot=1 IntervalValue determines the amount of time to wait before
+ *   taking the measurement
+ * Bits 30:28 ROClkprediv1
+ *    ROClkprediv1 and ROClkprediv2 controls the clock dividers of the RO clk
+ *    before it goes to the monitor
+ *    The RO clk goes through prediv1, followed by prediv2
+ *    prediv1:
+ *      0 - no divide
+ *      1 - divide by 2
+ *      2 - divide by 4
+ *      3 - divide by 8
+ *      4 - divide by 16
+ *      5 - divide by 32
+ *    prediv2:
+ *      0 - no divide
+ *      1 to 15 - divide by (prediv2+1)
+ */
+#define SPMCLKCTRL_SAMPLETIME          0x2u
+#define SPMCLKCTRL_SAMPLETIME_SHIFT    24u
+#define SPMCLKCTRL_SAMPLETIME_MASK     (0xfu << SPMCLKCTRL_SAMPLETIME_SHIFT)
+#define SPMCLKCTRL_ONESHOT             0x1u
+#define SPMCLKCTRL_ONESHOT_SHIFT       31u
+#define SPMCLKCTRL_ONESHOT_MASK                (0x1u << SPMCLKCTRL_ONESHOT_SHIFT)
+
+/* MonCtrlN (Chipcommon Offset 0x6a8)
+ * Bits 15:8 TargetRo
+ *   The target ring oscillator to observe
+ * Bits 7:6 TargetRoExt
+ *   Extended select option to choose the target clock to monitor;
+ *   00 - selects ring oscillator clock;
+ *   10 - selects functional clock;
+ *   11 - selects DFT clocks;
+ *   Bits 15:8 (TargetRO) is used to select the specific RO or functional or
+ *   DFT clock
+ * Bits 3 intHiEn
+ *   Interrupt hi enable (MonEn should be 1)
+ * Bits 2 intLoEn
+ *   Interrupt hi enable (MonEn should be 1)
+ * Bits 1 HwEnable
+ *   TBD
+ * Bits 0 MonEn
+ *   Enable monitor, interrupt and watermark functions
+ */
+#define MONCTRLN_TARGETRO_PMU_ALP_CLK          0u
+#define MONCTRLN_TARGETRO_PCIE_ALP_CLK         1u
+#define MONCTRLN_TARGETRO_CB_BP_CLK            2u
+#define MONCTRLN_TARGETRO_ARMCR4_CLK_4387B0    3u
+#define MONCTRLN_TARGETRO_ARMCR4_CLK_4387C0    20u
+#define MONCTRLN_TARGETRO_SHIFT                        8u
+#define MONCTRLN_TARGETRO_MASK                 (0xffu << MONCTRLN_TARGETRO_SHIFT)
+#define MONCTRLN_TARGETROMAX                   64u
+#define MONCTRLN_TARGETROHI                    32u
+#define MONCTRLN_TARGETROEXT_RO                        0x0u
+#define MONCTRLN_TARGETROEXT_FUNC              0x2u
+#define MONCTRLN_TARGETROEXT_DFT               0x3u
+#define MONCTRLN_TARGETROEXT_SHIFT             6u
+#define MONCTRLN_TARGETROEXT_MASK              (0x3u << MONCTRLN_TARGETROEXT_SHIFT)
+#define MONCTRLN_MONEN                         0x1u
+#define MONCTRLN_MONEN_SHIFT                   0u
+#define MONCTRLN_MONEN_MASK                    (0x1u << MONCTRLN_MONENEXT_SHIFT)
+
+/* DvfsCoreCtrlN
+ * Bits 10 Request_override_PDn
+ *   When set, the dvfs_request logic for this core is overridden with the
+ *   content in Request_val_PDn. This field is ignored when
+ *   DVFSCtrl1.dvfs_req_override is set.
+ * Bits 9:8 Request_val_PDn
+ *   see Request_override_PDn description
+ * Bits 4:0 DVFS_RsrcTrig_PDn
+ *   Specifies the pmu resource that is used to trigger the DVFS request for
+ *   this core request. Current plan is to use the appropriate PWRSW_* pmu
+ *   resource each power domain / cores
+ */
+#define CTRLN_REQUEST_OVERRIDE_SHIFT   10u
+#define CTRLN_REQUEST_OVERRIDE_MASK    (0x1u << CTRLN_REQUEST_OVERRIDE_SHIFT)
+#define CTRLN_REQUEST_VAL_SHIFT                8u
+#define CTRLN_REQUEST_VAL_MASK         (0x3u << CTRLN_REQUEST_VAL_SHIFT)
+#define CTRLN_RSRC_TRIG_SHIFT           0u
+#define CTRLN_RSRC_TRIG_MASK           (0x1Fu << CTRLN_RSRC_TRIG_SHIFT)
+#define CTRLN_RSRC_TRIG_CHIPC          0x1Au
+#define CTRLN_RSRC_TRIG_PCIE           0x1Au
+#define CTRLN_RSRC_TRIG_ARM            0x8u
+#define CTRLN_RSRC_TRIG_D11_MAIN       0xEu
+#define CTRLN_RSRC_TRIG_D11_AUX                0xBu
+#define CTRLN_RSRC_TRIG_D11_SCAN       0xCu
+#define CTRLN_RSRC_TRIG_BT_MAIN                0x9u
+#define CTRLN_RSRC_TRIG_BT_SCAN                0xAu
+
+#define DVFS_CORE_CHIPC                        0u
+#define DVFS_CORE_PCIE                 1u
+#define DVFS_CORE_ARM                  2u
+#define DVFS_CORE_D11_MAIN             3u
+#define DVFS_CORE_D11_AUX              4u
+#define DVFS_CORE_D11_SCAN             5u
+#define DVFS_CORE_BT_MAIN              6u
+#define DVFS_CORE_BT_SCAN              7u
+#define DVFS_CORE_MASK                 7u
+
+/* DVFS_Ctrl2 (PMU_BASE + 0x814)
+ * Bits 31:28 Voltage ramp down step
+ *   Voltage increment amount during ramp down (10mv units)
+ * Bits 27:24 Voltage ramp up step
+ *   Voltage increment amount during ramp up (10mv units)
+ * Bits 23:16 Voltage ramp down interval
+ *   Number of clocks to wait during each voltage decrement
+ * Bits 15:8 Voltage ramp up interval
+ *   Number of clocks to wait during each voltage increment
+ * Bits 7:0 Clock stable time
+ *   Number of clocks to wait after dvfs_clk_sel is asserted
+ */
+#define DVFS_VOLTAGE_RAMP_DOWN_STEP            1u
+#define DVFS_VOLTAGE_RAMP_DOWN_STEP_SHIFT      28u
+#define DVFS_VOLTAGE_RAMP_DOWN_STEP_MASK       (0xFu << DVFS_VOLTAGE_RAMP_DOWN_STEP_SHIFT)
+#define DVFS_VOLTAGE_RAMP_UP_STEP              1u
+#define DVFS_VOLTAGE_RAMP_UP_STEP_SHIFT                24u
+#define DVFS_VOLTAGE_RAMP_UP_STEP_MASK         (0xFu << DVFS_VOLTAGE_RAMP_UP_STEP_SHIFT)
+#define DVFS_VOLTAGE_RAMP_DOWN_INTERVAL                1u
+#define DVFS_VOLTAGE_RAMP_DOWN_INTERVAL_SHIFT  16u
+#define DVFS_VOLTAGE_RAMP_DOWN_INTERVAL_MASK   (0xFFu << DVFS_VOLTAGE_RAMP_DOWN_INTERVAL_SHIFT)
+#define DVFS_VOLTAGE_RAMP_UP_INTERVAL          1u
+#define DVFS_VOLTAGE_RAMP_UP_INTERVAL_SHIFT    8u
+#define DVFS_VOLTAGE_RAMP_UP_INTERVAL_MASK     (0xFFu << DVFS_VOLTAGE_RAMP_UP_INTERVAL_SHIFT)
+#define DVFS_CLOCK_STABLE_TIME                 3u
+#define DVFS_CLOCK_STABLE_TIME_SHIFT           0
+#define DVFS_CLOCK_STABLE_TIME_MASK            (0xFFu << DVFS_CLOCK_STABLE_TIME_SHIFT)
+
+/* DVFS_Voltage (PMU_BASE + 0x818)
+ * Bits 22:16 HDV Voltage
+ *   Specifies the target HDV voltage in 10mv units
+ * Bits 14:8 NDV Voltage
+ *   Specifies the target NDV voltage in 10mv units
+ * Bits 6:0 LDV Voltage
+ *   Specifies the target LDV voltage in 10mv units
+ */
+#define DVFS_VOLTAGE_XDV               0u      /* Reserved */
+#define DVFS_VOLTAGE_HDV               72u     /* 0.72V */
+#define DVFS_VOLTAGE_HDV_PWR_OPT       68u     /* 0.68V */
+#define DVFS_VOLTAGE_HDV_SHIFT         16u
+#define DVFS_VOLTAGE_HDV_MASK          (0x7Fu << DVFS_VOLTAGE_HDV_SHIFT)
+#define DVFS_VOLTAGE_NDV               72u     /* 0.72V */
+#define DVFS_VOLTAGE_NDV_PWR_OPT       68u     /* 0.68V */
+#define DVFS_VOLTAGE_NDV_SHIFT         8u
+#define DVFS_VOLTAGE_NDV_MASK          (0x7Fu << DVFS_VOLTAGE_NDV_SHIFT)
+#define DVFS_VOLTAGE_LDV               65u     /* 0.65V */
+#define DVFS_VOLTAGE_LDV_PWR_OPT       65u     /* 0.65V */
+#define DVFS_VOLTAGE_LDV_SHIFT         0u
+#define DVFS_VOLTAGE_LDV_MASK          (0x7Fu << DVFS_VOLTAGE_LDV_SHIFT)
+
+/* DVFS_Status (PMU_BASE + 0x81C)
+ * Bits 27:26 Raw_Core_Reqn
+ * Bits 25:24 Active_Core_Reqn
+ * Bits 12:11 Core_dvfs_status
+ * Bits 9:8 Dvfs_clk_sel
+ *   00 - LDV
+ *   01 - NDV
+ * Bits 6:0 Dvfs Voltage
+ *   The real time voltage that is being output from the dvfs controller
+ */
+#define DVFS_RAW_CORE_REQ_SHIFT        26u
+#define DVFS_RAW_CORE_REQ_MASK (0x3u << DVFS_RAW_CORE_REQ_SHIFT)
+#define DVFS_ACT_CORE_REQ_SHIFT        24u
+#define DVFS_ACT_CORE_REQ_MASK (0x3u << DVFS_ACT_CORE_REQ_SHIFT)
+#define DVFS_CORE_STATUS_SHIFT 11u
+#define DVFS_CORE_STATUS_MASK  (0x3u << DVFS_CORE_STATUS_SHIFT)
+#define DVFS_CLK_SEL_SHIFT     8u
+#define DVFS_CLK_SEL_MASK      (0x3u << DVFS_CLK_SEL_SHIFT)
+#define DVFS_VOLTAGE_SHIFT     0u
+#define DVFS_VOLTAGE_MASK      (0x7Fu << DVFS_VOLTAGE_SHIFT)
+
+/* DVFS_Ctrl1 (PMU_BASE + 0x810)
+ * Bits 0 Enable DVFS
+ *   This bit will enable DVFS operation. When cleared, the complete DVFS
+ *   controller is bypassed and DVFS_voltage output will be the contents of
+ *   NDV voltage register
+ */
+#define DVFS_DISABLE_DVFS      0u
+#define DVFS_ENABLE_DVFS       1u
+#define DVFS_ENABLE_DVFS_SHIFT 0u
+#define DVFS_ENABLE_DVFS_MASK  (1u << DVFS_ENABLE_DVFS_SHIFT)
+
+#define DVFS_LPO_DELAY         40u     /* usec (1 LPO clock + margin) */
+#define DVFS_FASTLPO_DELAY     2u      /* usec (1 FAST_LPO clock + margin) */
+#define DVFS_NDV_LPO_DELAY     1500u
+#define DVFS_NDV_FASTLPO_DELAY 50u
+
+#if defined(BCM_FASTLPO) && !defined(BCM_FASTLPO_DISABLED)
+#define DVFS_DELAY     DVFS_FASTLPO_DELAY
+#define DVFS_NDV_DELAY DVFS_NDV_FASTLPO_DELAY
+#else
+#define DVFS_DELAY     DVFS_LPO_DELAY
+#define DVFS_NDV_DELAY DVFS_NDV_LPO_DELAY
+#endif /* BCM_FASTLPO && !BCM_FASTLPO_DISABLED */
+
+#define DVFS_LDV       0u
+#define DVFS_NDV       1u
+#define DVFS_HDV       2u
+
+/* PowerControl2 (Core Offset 0x1EC)
+ * Bits 17:16 DVFSStatus
+ *   This 2-bit field is the DVFS voltage status mapped as
+ *   00 - LDV
+ *   01 - NDV
+ *   10 - HDV
+ * Bits 1:0 DVFSRequest
+ *   This 2-bit field is used to request DVFS voltage mapped as shown above
+ */
+#define DVFS_REQ_LDV           DVFS_LDV
+#define DVFS_REQ_NDV           DVFS_NDV
+#define DVFS_REQ_HDV           DVFS_HDV
+#define DVFS_REQ_SHIFT         0u
+#define DVFS_REQ_MASK          (0x3u << DVFS_REQ_SHIFT)
+#define DVFS_STATUS_SHIFT      16u
+#define DVFS_STATUS_MASK       (0x3u << DVFS_STATUS_SHIFT)
+
+/* GCI Chip Control 16 Register
+ * Bits 0 CB Clock sel
+ *   0 - 160MHz
+ *   1 - 80Mhz  - BT can force CB backplane clock to 80Mhz when wl is down
+ */
+#define GCI_CC16_CB_CLOCK_SEL_160      0u
+#define GCI_CC16_CB_CLOCK_SEL_80       1u
+#define GCI_CC16_CB_CLOCK_SEL_SHIFT    0u
+#define GCI_CC16_CB_CLOCK_SEL_MASK     (0x1u << GCI_CC16_CB_CLOCK_SEL_SHIFT)
+
+/* WL Channel Info to BT via GCI - bits 40 - 47 */
+#define GCI_WL_CHN_INFO_MASK   (0xFF00)
+/* WL indication of MCHAN enabled/disabled to BT - bit 36 */
+#define GCI_WL_MCHAN_BIT_MASK  (0x0010)
+
+#ifdef WLC_SW_DIVERSITY
+/* WL indication of SWDIV enabled/disabled to BT - bit 33 */
+#define GCI_WL_SWDIV_ANT_VALID_BIT_MASK        (0x0002)
+#define GCI_SWDIV_ANT_VALID_SHIFT 0x1
+#define GCI_SWDIV_ANT_VALID_DISABLE 0x0
+#endif
+
+/* Indicate to BT that WL is scheduling ACL based ble scan grant */
+#define GCI_WL2BT_ACL_BSD_BLE_SCAN_GRNT_MASK 0x8000000
+/* WLAN is awake Indicate to BT */
+#define GCI_WL2BT_2G_AWAKE_MASK          (1u << 27u)
+
+/* WL inidcation of Aux Core 2G hibernate status - bit 50 */
+#define GCI_WL2BT_2G_HIB_STATE_MASK    (0x0040000u)
+
+/* WL Strobe to BT */
+#define GCI_WL_STROBE_BIT_MASK (0x0020)
+/* bits [51:48] - reserved for wlan TX pwr index */
+/* bits [55:52] btc mode indication */
+#define GCI_WL_BTC_MODE_SHIFT  (20)
+#define GCI_WL_BTC_MODE_MASK   (0xF << GCI_WL_BTC_MODE_SHIFT)
+#define GCI_WL_ANT_BIT_MASK    (0x00c0)
+#define GCI_WL_ANT_SHIFT_BITS  (6)
+/* PLL type */
+#define PLL_NONE               0x00000000
+#define PLL_TYPE1              0x00010000      /**< 48MHz base, 3 dividers */
+#define PLL_TYPE2              0x00020000      /**< 48MHz, 4 dividers */
+#define PLL_TYPE3              0x00030000      /**< 25MHz, 2 dividers */
+#define PLL_TYPE4              0x00008000      /**< 48MHz, 4 dividers */
+#define PLL_TYPE5              0x00018000      /**< 25MHz, 4 dividers */
+#define PLL_TYPE6              0x00028000      /**< 100/200 or 120/240 only */
+#define PLL_TYPE7              0x00038000      /**< 25MHz, 4 dividers */
+
+/* ILP clock */
+#define        ILP_CLOCK               32000
+
+/* ALP clock on pre-PMU chips */
+#define        ALP_CLOCK               20000000
+
+#ifdef CFG_SIM
+#define NS_ALP_CLOCK           84922
+#define NS_SLOW_ALP_CLOCK      84922
+#define NS_CPU_CLOCK           534500
+#define NS_SLOW_CPU_CLOCK      534500
+#define NS_SI_CLOCK            271750
+#define NS_SLOW_SI_CLOCK       271750
+#define NS_FAST_MEM_CLOCK      271750
+#define NS_MEM_CLOCK           271750
+#define NS_SLOW_MEM_CLOCK      271750
+#else
+#define NS_ALP_CLOCK           125000000
+#define NS_SLOW_ALP_CLOCK      100000000
+#define NS_CPU_CLOCK           1000000000
+#define NS_SLOW_CPU_CLOCK      800000000
+#define NS_SI_CLOCK            250000000
+#define NS_SLOW_SI_CLOCK       200000000
+#define NS_FAST_MEM_CLOCK      800000000
+#define NS_MEM_CLOCK           533000000
+#define NS_SLOW_MEM_CLOCK      400000000
+#endif /* CFG_SIM */
+
+/* HT clock */
+#define        HT_CLOCK                80000000
+
+/* corecontrol */
+#define CC_UARTCLKO            0x00000001      /**< Drive UART with internal clock */
+#define        CC_SE                   0x00000002      /**< sync clk out enable (corerev >= 3) */
+#define CC_ASYNCGPIO   0x00000004      /**< 1=generate GPIO interrupt without backplane clock */
+#define CC_UARTCLKEN           0x00000008      /**< enable UART Clock (corerev > = 21 */
+#define CC_RBG_RESET           0x00000040      /**< Reset RBG block (corerev > = 65 */
+
+/* retention_ctl */
+#define RCTL_MEM_RET_SLEEP_LOG_SHIFT   29
+#define RCTL_MEM_RET_SLEEP_LOG_MASK    (1 << RCTL_MEM_RET_SLEEP_LOG_SHIFT)
+
+/* 4321 chipcontrol */
+#define CHIPCTRL_4321_PLL_DOWN 0x800000        /**< serdes PLL down override */
+
+/* Fields in the otpstatus register in rev >= 21 */
+#define OTPS_OL_MASK           0x000000ff
+#define OTPS_OL_MFG            0x00000001      /**< manuf row is locked */
+#define OTPS_OL_OR1            0x00000002      /**< otp redundancy row 1 is locked */
+#define OTPS_OL_OR2            0x00000004      /**< otp redundancy row 2 is locked */
+#define OTPS_OL_GU             0x00000008      /**< general use region is locked */
+#define OTPS_GUP_MASK          0x00000f00
+#define OTPS_GUP_SHIFT         8
+#define OTPS_GUP_HW            0x00000100      /**< h/w subregion is programmed */
+#define OTPS_GUP_SW            0x00000200      /**< s/w subregion is programmed */
+#define OTPS_GUP_CI            0x00000400      /**< chipid/pkgopt subregion is programmed */
+#define OTPS_GUP_FUSE          0x00000800      /**< fuse subregion is programmed */
+#define OTPS_READY             0x00001000
+#define OTPS_RV(x)             (1 << (16 + (x)))       /**< redundancy entry valid */
+#define OTPS_RV_MASK           0x0fff0000
+#define OTPS_PROGOK     0x40000000
+
+/* Fields in the otpcontrol register in rev >= 21 */
+#define OTPC_PROGSEL           0x00000001
+#define OTPC_PCOUNT_MASK       0x0000000e
+#define OTPC_PCOUNT_SHIFT      1
+#define OTPC_VSEL_MASK         0x000000f0
+#define OTPC_VSEL_SHIFT                4
+#define OTPC_TMM_MASK          0x00000700
+#define OTPC_TMM_SHIFT         8
+#define OTPC_ODM               0x00000800
+#define OTPC_PROGEN            0x80000000
+
+/* Fields in the 40nm otpcontrol register in rev >= 40 */
+#define OTPC_40NM_PROGSEL_SHIFT        0
+#define OTPC_40NM_PCOUNT_SHIFT 1
+#define OTPC_40NM_PCOUNT_WR    0xA
+#define OTPC_40NM_PCOUNT_V1X   0xB
+#define OTPC_40NM_REGCSEL_SHIFT        5
+#define OTPC_40NM_REGCSEL_DEF  0x4
+#define OTPC_40NM_PROGIN_SHIFT 8
+#define OTPC_40NM_R2X_SHIFT    10
+#define OTPC_40NM_ODM_SHIFT    11
+#define OTPC_40NM_DF_SHIFT     15
+#define OTPC_40NM_VSEL_SHIFT   16
+#define OTPC_40NM_VSEL_WR      0xA
+#define OTPC_40NM_VSEL_V1X     0xA
+#define OTPC_40NM_VSEL_R1X     0x5
+#define OTPC_40NM_COFAIL_SHIFT 30
+
+#define OTPC1_CPCSEL_SHIFT     0
+#define OTPC1_CPCSEL_DEF       6
+#define OTPC1_TM_SHIFT         8
+#define OTPC1_TM_WR            0x84
+#define OTPC1_TM_V1X           0x84
+#define OTPC1_TM_R1X           0x4
+#define OTPC1_CLK_EN_MASK      0x00020000
+#define OTPC1_CLK_DIV_MASK     0x00FC0000
+
+/* Fields in otpprog in rev >= 21 and HND OTP */
+#define OTPP_COL_MASK          0x000000ff
+#define OTPP_COL_SHIFT         0
+#define OTPP_ROW_MASK          0x0000ff00
+#define OTPP_ROW_MASK9         0x0001ff00              /* for ccrev >= 49 */
+#define OTPP_ROW_SHIFT         8
+#define OTPP_OC_MASK           0x0f000000
+#define OTPP_OC_SHIFT          24
+#define OTPP_READERR           0x10000000
+#define OTPP_VALUE_MASK                0x20000000
+#define OTPP_VALUE_SHIFT       29
+#define OTPP_START_BUSY                0x80000000
+#define        OTPP_READ               0x40000000      /* HND OTP */
+
+/* Fields in otplayout register */
+#define OTPL_HWRGN_OFF_MASK    0x00000FFF
+#define OTPL_HWRGN_OFF_SHIFT   0
+#define OTPL_WRAP_REVID_MASK   0x00F80000
+#define OTPL_WRAP_REVID_SHIFT  19
+#define OTPL_WRAP_TYPE_MASK    0x00070000
+#define OTPL_WRAP_TYPE_SHIFT   16
+#define OTPL_WRAP_TYPE_65NM    0
+#define OTPL_WRAP_TYPE_40NM    1
+#define OTPL_WRAP_TYPE_28NM    2
+#define OTPL_WRAP_TYPE_16NM    3
+#define OTPL_ROW_SIZE_MASK     0x0000F000
+#define OTPL_ROW_SIZE_SHIFT    12
+
+/* otplayout reg corerev >= 36 */
+#define OTP_CISFORMAT_NEW      0x80000000
+
+/* Opcodes for OTPP_OC field */
+#define OTPPOC_READ            0
+#define OTPPOC_BIT_PROG                1
+#define OTPPOC_VERIFY          3
+#define OTPPOC_INIT            4
+#define OTPPOC_SET             5
+#define OTPPOC_RESET           6
+#define OTPPOC_OCST            7
+#define OTPPOC_ROW_LOCK                8
+#define OTPPOC_PRESCN_TEST     9
+
+/* Opcodes for OTPP_OC field (40NM) */
+#define OTPPOC_READ_40NM       0
+#define OTPPOC_PROG_ENABLE_40NM 1
+#define OTPPOC_PROG_DISABLE_40NM       2
+#define OTPPOC_VERIFY_40NM     3
+#define OTPPOC_WORD_VERIFY_1_40NM      4
+#define OTPPOC_ROW_LOCK_40NM   5
+#define OTPPOC_STBY_40NM       6
+#define OTPPOC_WAKEUP_40NM     7
+#define OTPPOC_WORD_VERIFY_0_40NM      8
+#define OTPPOC_PRESCN_TEST_40NM 9
+#define OTPPOC_BIT_PROG_40NM   10
+#define OTPPOC_WORDPROG_40NM   11
+#define OTPPOC_BURNIN_40NM     12
+#define OTPPOC_AUTORELOAD_40NM 13
+#define OTPPOC_OVST_READ_40NM  14
+#define OTPPOC_OVST_PROG_40NM  15
+
+/* Opcodes for OTPP_OC field (28NM) */
+#define OTPPOC_READ_28NM       0
+#define OTPPOC_READBURST_28NM  1
+#define OTPPOC_PROG_ENABLE_28NM 2
+#define OTPPOC_PROG_DISABLE_28NM       3
+#define OTPPOC_PRESCREEN_28NM  4
+#define OTPPOC_PRESCREEN_RP_28NM       5
+#define OTPPOC_FLUSH_28NM      6
+#define OTPPOC_NOP_28NM        7
+#define OTPPOC_PROG_ECC_28NM   8
+#define OTPPOC_PROG_ECC_READ_28NM      9
+#define OTPPOC_PROG_28NM       10
+#define OTPPOC_PROGRAM_RP_28NM 11
+#define OTPPOC_PROGRAM_OVST_28NM       12
+#define OTPPOC_RELOAD_28NM     13
+#define OTPPOC_ERASE_28NM      14
+#define OTPPOC_LOAD_RF_28NM    15
+#define OTPPOC_CTRL_WR_28NM 16
+#define OTPPOC_CTRL_RD_28NM    17
+#define OTPPOC_READ_HP_28NM    18
+#define OTPPOC_READ_OVST_28NM  19
+#define OTPPOC_READ_VERIFY0_28NM       20
+#define OTPPOC_READ_VERIFY1_28NM       21
+#define OTPPOC_READ_FORCE0_28NM        22
+#define OTPPOC_READ_FORCE1_28NM        23
+#define OTPPOC_BURNIN_28NM     24
+#define OTPPOC_PROGRAM_LOCK_28NM       25
+#define OTPPOC_PROGRAM_TESTCOL_28NM    26
+#define OTPPOC_READ_TESTCOL_28NM       27
+#define OTPPOC_READ_FOUT_28NM  28
+#define OTPPOC_SFT_RESET_28NM  29
+
+#define OTPP_OC_MASK_28NM      0x0f800000
+#define OTPP_OC_SHIFT_28NM     23
+#define OTPC_PROGEN_28NM       0x8
+#define OTPC_DBLERRCLR         0x20
+#define OTPC_CLK_EN_MASK       0x00000040
+#define OTPC_CLK_DIV_MASK      0x00000F80
+
+/* Fields in otplayoutextension */
+#define OTPLAYOUTEXT_FUSE_MASK 0x3FF
+
+/* Jtagm characteristics that appeared at a given corerev */
+#define        JTAGM_CREV_OLD          10      /**< Old command set, 16bit max IR */
+#define        JTAGM_CREV_IRP          22      /**< Able to do pause-ir */
+#define        JTAGM_CREV_RTI          28      /**< Able to do return-to-idle */
+
+/* jtagcmd */
+#define JCMD_START             0x80000000
+#define JCMD_BUSY              0x80000000
+#define JCMD_STATE_MASK                0x60000000
+#define JCMD_STATE_TLR         0x00000000      /**< Test-logic-reset */
+#define JCMD_STATE_PIR         0x20000000      /**< Pause IR */
+#define JCMD_STATE_PDR         0x40000000      /**< Pause DR */
+#define JCMD_STATE_RTI         0x60000000      /**< Run-test-idle */
+#define JCMD0_ACC_MASK         0x0000f000
+#define JCMD0_ACC_IRDR         0x00000000
+#define JCMD0_ACC_DR           0x00001000
+#define JCMD0_ACC_IR           0x00002000
+#define JCMD0_ACC_RESET                0x00003000
+#define JCMD0_ACC_IRPDR                0x00004000
+#define JCMD0_ACC_PDR          0x00005000
+#define JCMD0_IRW_MASK         0x00000f00
+#define JCMD_ACC_MASK          0x000f0000      /**< Changes for corerev 11 */
+#define JCMD_ACC_IRDR          0x00000000
+#define JCMD_ACC_DR            0x00010000
+#define JCMD_ACC_IR            0x00020000
+#define JCMD_ACC_RESET         0x00030000
+#define JCMD_ACC_IRPDR         0x00040000
+#define JCMD_ACC_PDR           0x00050000
+#define JCMD_ACC_PIR           0x00060000
+#define JCMD_ACC_IRDR_I                0x00070000      /**< rev 28: return to run-test-idle */
+#define JCMD_ACC_DR_I          0x00080000      /**< rev 28: return to run-test-idle */
+#define JCMD_IRW_MASK          0x00001f00
+#define JCMD_IRW_SHIFT         8
+#define JCMD_DRW_MASK          0x0000003f
+
+/* jtagctrl */
+#define JCTRL_FORCE_CLK                4               /**< Force clock */
+#define JCTRL_EXT_EN           2               /**< Enable external targets */
+#define JCTRL_EN               1               /**< Enable Jtag master */
+#define JCTRL_TAPSEL_BIT       0x00000008      /**< JtagMasterCtrl tap_sel bit */
+
+/* swdmasterctrl */
+#define SWDCTRL_INT_EN         8               /**< Enable internal targets */
+#define SWDCTRL_FORCE_CLK      4               /**< Force clock */
+#define SWDCTRL_OVJTAG         2               /**< Enable shared SWD/JTAG pins */
+#define SWDCTRL_EN             1               /**< Enable Jtag master */
+
+/* Fields in clkdiv */
+#define        CLKD_SFLASH             0x1f000000
+#define        CLKD_SFLASH_SHIFT       24
+#define        CLKD_OTP                0x000f0000
+#define        CLKD_OTP_SHIFT          16
+#define        CLKD_JTAG               0x00000f00
+#define        CLKD_JTAG_SHIFT         8
+#define        CLKD_UART               0x000000ff
+
+#define        CLKD2_SROM              0x00000007
+#define        CLKD2_SROMDIV_32        0
+#define        CLKD2_SROMDIV_64        1
+#define        CLKD2_SROMDIV_96        2
+#define        CLKD2_SROMDIV_128       3
+#define        CLKD2_SROMDIV_192       4
+#define        CLKD2_SROMDIV_256       5
+#define        CLKD2_SROMDIV_384       6
+#define        CLKD2_SROMDIV_512       7
+#define        CLKD2_SWD               0xf8000000
+#define        CLKD2_SWD_SHIFT         27
+
+/* intstatus/intmask */
+#define        CI_GPIO                 0x00000001      /**< gpio intr */
+#define        CI_EI                   0x00000002      /**< extif intr (corerev >= 3) */
+#define        CI_TEMP                 0x00000004      /**< temp. ctrl intr (corerev >= 15) */
+#define        CI_SIRQ                 0x00000008      /**< serial IRQ intr (corerev >= 15) */
+#define        CI_ECI                  0x00000010      /**< eci intr (corerev >= 21) */
+#define        CI_PMU                  0x00000020      /**< pmu intr (corerev >= 21) */
+#define        CI_UART                 0x00000040      /**< uart intr (corerev >= 21) */
+#define        CI_WECI                 0x00000080      /* eci wakeup intr (corerev >= 21) */
+#define        CI_SPMI                 0x00100000      /* SPMI (corerev >= 65) */
+#define        CI_RNG                  0x00200000      /**<  rng intr (corerev >= 65) */
+#define        CI_SSRESET_F0   0x10000000      /**< ss reset occurred */
+#define        CI_SSRESET_F1   0x20000000      /**< ss reset occurred */
+#define        CI_SSRESET_F2   0x40000000      /**< ss reset occurred */
+#define        CI_WDRESET              0x80000000      /**< watchdog reset occurred */
+
+/* slow_clk_ctl */
+#define SCC_SS_MASK            0x00000007      /**< slow clock source mask */
+#define        SCC_SS_LPO              0x00000000      /**< source of slow clock is LPO */
+#define        SCC_SS_XTAL             0x00000001      /**< source of slow clock is crystal */
+#define        SCC_SS_PCI              0x00000002      /**< source of slow clock is PCI */
+#define SCC_LF                 0x00000200      /**< LPOFreqSel, 1: 160Khz, 0: 32KHz */
+#define SCC_LP                 0x00000400      /**< LPOPowerDown, 1: LPO is disabled,
+                                                * 0: LPO is enabled
+                                                */
+#define SCC_FS                 0x00000800 /**< ForceSlowClk, 1: sb/cores running on slow clock,
+                                                * 0: power logic control
+                                                */
+#define SCC_IP                 0x00001000 /**< IgnorePllOffReq, 1/0: power logic ignores/honors
+                                                * PLL clock disable requests from core
+                                                */
+#define SCC_XC                 0x00002000      /**< XtalControlEn, 1/0: power logic does/doesn't
+                                                * disable crystal when appropriate
+                                                */
+#define SCC_XP                 0x00004000      /**< XtalPU (RO), 1/0: crystal running/disabled */
+#define SCC_CD_MASK            0xffff0000      /**< ClockDivider (SlowClk = 1/(4+divisor)) */
+#define SCC_CD_SHIFT           16
+
+/* system_clk_ctl */
+#define        SYCC_IE                 0x00000001      /**< ILPen: Enable Idle Low Power */
+#define        SYCC_AE                 0x00000002      /**< ALPen: Enable Active Low Power */
+#define        SYCC_FP                 0x00000004      /**< ForcePLLOn */
+#define        SYCC_AR                 0x00000008      /**< Force ALP (or HT if ALPen is not set */
+#define        SYCC_HR                 0x00000010      /**< Force HT */
+#define SYCC_CD_MASK           0xffff0000      /**< ClkDiv  (ILP = 1/(4 * (divisor + 1)) */
+#define SYCC_CD_SHIFT          16
+
+/* watchdogcounter */
+/* WL sub-system reset */
+#define WD_SSRESET_PCIE_F0_EN                  0x10000000
+/* BT sub-system reset */
+#define WD_SSRESET_PCIE_F1_EN                  0x20000000
+#define WD_SSRESET_PCIE_F2_EN                  0x40000000
+/* Both WL and BT sub-system reset */
+#define WD_SSRESET_PCIE_ALL_FN_EN              0x80000000
+#define WD_COUNTER_MASK                                0x0fffffff
+#define WD_ENABLE_MASK \
+       (WD_SSRESET_PCIE_F0_EN | WD_SSRESET_PCIE_F1_EN | \
+       WD_SSRESET_PCIE_F2_EN | WD_SSRESET_PCIE_ALL_FN_EN)
+
+/* Indirect backplane access */
+#define        BPIA_BYTEEN             0x0000000f
+#define        BPIA_SZ1                0x00000001
+#define        BPIA_SZ2                0x00000003
+#define        BPIA_SZ4                0x00000007
+#define        BPIA_SZ8                0x0000000f
+#define        BPIA_WRITE              0x00000100
+#define        BPIA_START              0x00000200
+#define        BPIA_BUSY               0x00000200
+#define        BPIA_ERROR              0x00000400
+
+/* pcmcia/prog/flash_config */
+#define        CF_EN                   0x00000001      /**< enable */
+#define        CF_EM_MASK              0x0000000e      /**< mode */
+#define        CF_EM_SHIFT             1
+#define        CF_EM_FLASH             0               /**< flash/asynchronous mode */
+#define        CF_EM_SYNC              2               /**< synchronous mode */
+#define        CF_EM_PCMCIA            4               /**< pcmcia mode */
+#define        CF_DS                   0x00000010      /**< destsize:  0=8bit, 1=16bit */
+#define        CF_BS                   0x00000020      /**< byteswap */
+#define        CF_CD_MASK              0x000000c0      /**< clock divider */
+#define        CF_CD_SHIFT             6
+#define        CF_CD_DIV2              0x00000000      /**< backplane/2 */
+#define        CF_CD_DIV3              0x00000040      /**< backplane/3 */
+#define        CF_CD_DIV4              0x00000080      /**< backplane/4 */
+#define        CF_CE                   0x00000100      /**< clock enable */
+#define        CF_SB                   0x00000200      /**< size/bytestrobe (synch only) */
+
+/* pcmcia_memwait */
+#define        PM_W0_MASK              0x0000003f      /**< waitcount0 */
+#define        PM_W1_MASK              0x00001f00      /**< waitcount1 */
+#define        PM_W1_SHIFT             8
+#define        PM_W2_MASK              0x001f0000      /**< waitcount2 */
+#define        PM_W2_SHIFT             16
+#define        PM_W3_MASK              0x1f000000      /**< waitcount3 */
+#define        PM_W3_SHIFT             24
+
+/* pcmcia_attrwait */
+#define        PA_W0_MASK              0x0000003f      /**< waitcount0 */
+#define        PA_W1_MASK              0x00001f00      /**< waitcount1 */
+#define        PA_W1_SHIFT             8
+#define        PA_W2_MASK              0x001f0000      /**< waitcount2 */
+#define        PA_W2_SHIFT             16
+#define        PA_W3_MASK              0x1f000000      /**< waitcount3 */
+#define        PA_W3_SHIFT             24
+
+/* pcmcia_iowait */
+#define        PI_W0_MASK              0x0000003f      /**< waitcount0 */
+#define        PI_W1_MASK              0x00001f00      /**< waitcount1 */
+#define        PI_W1_SHIFT             8
+#define        PI_W2_MASK              0x001f0000      /**< waitcount2 */
+#define        PI_W2_SHIFT             16
+#define        PI_W3_MASK              0x1f000000      /**< waitcount3 */
+#define        PI_W3_SHIFT             24
+
+/* prog_waitcount */
+#define        PW_W0_MASK              0x0000001f      /**< waitcount0 */
+#define        PW_W1_MASK              0x00001f00      /**< waitcount1 */
+#define        PW_W1_SHIFT             8
+#define        PW_W2_MASK              0x001f0000      /**< waitcount2 */
+#define        PW_W2_SHIFT             16
+#define        PW_W3_MASK              0x1f000000      /**< waitcount3 */
+#define        PW_W3_SHIFT             24
+
+#define PW_W0                  0x0000000c
+#define PW_W1                  0x00000a00
+#define PW_W2                  0x00020000
+#define PW_W3                  0x01000000
+
+/* flash_waitcount */
+#define        FW_W0_MASK              0x0000003f      /**< waitcount0 */
+#define        FW_W1_MASK              0x00001f00      /**< waitcount1 */
+#define        FW_W1_SHIFT             8
+#define        FW_W2_MASK              0x001f0000      /**< waitcount2 */
+#define        FW_W2_SHIFT             16
+#define        FW_W3_MASK              0x1f000000      /**< waitcount3 */
+#define        FW_W3_SHIFT             24
+
+/* When Srom support present, fields in sromcontrol */
+#define        SRC_START               0x80000000
+#define        SRC_BUSY                0x80000000
+#define        SRC_OPCODE              0x60000000
+#define        SRC_OP_READ             0x00000000
+#define        SRC_OP_WRITE            0x20000000
+#define        SRC_OP_WRDIS            0x40000000
+#define        SRC_OP_WREN             0x60000000
+#define        SRC_OTPSEL              0x00000010
+#define SRC_OTPPRESENT         0x00000020
+#define        SRC_LOCK                0x00000008
+#define        SRC_SIZE_MASK           0x00000006
+#define        SRC_SIZE_1K             0x00000000
+#define        SRC_SIZE_4K             0x00000002
+#define        SRC_SIZE_16K            0x00000004
+#define        SRC_SIZE_SHIFT          1
+#define        SRC_PRESENT             0x00000001
+
+/* Fields in pmucontrol */
+#define        PCTL_ILP_DIV_MASK       0xffff0000
+#define        PCTL_ILP_DIV_SHIFT      16
+#define PCTL_LQ_REQ_EN         0x00008000
+#define PCTL_PLL_PLLCTL_UPD    0x00000400      /**< rev 2 */
+#define PCTL_NOILP_ON_WAIT     0x00000200      /**< rev 1 */
+#define        PCTL_HT_REQ_EN          0x00000100
+#define        PCTL_ALP_REQ_EN         0x00000080
+#define        PCTL_XTALFREQ_MASK      0x0000007c
+#define        PCTL_XTALFREQ_SHIFT     2
+#define        PCTL_ILP_DIV_EN         0x00000002
+#define        PCTL_LPO_SEL            0x00000001
+
+/* Fields in pmucontrol_ext */
+#define PCTL_EXT_FAST_TRANS_ENAB       0x00000001u
+#define PCTL_EXT_USE_LHL_TIMER         0x00000010u
+#define PCTL_EXT_FASTLPO_ENAB          0x00000080u
+#define PCTL_EXT_FASTLPO_SWENAB                0x00000200u
+#define PCTL_EXT_FASTSEQ_ENAB          0x00001000u
+#define PCTL_EXT_FASTLPO_PCIE_SWENAB   0x00004000u  /**< rev33 for FLL1M */
+#define PCTL_EXT_FASTLPO_SB_SWENAB     0x00008000u  /**< rev36 for FLL1M */
+#define PCTL_EXT_REQ_MIRROR_ENAB       0x00010000u  /**< rev36 for ReqMirrorEn */
+
+#define DEFAULT_43012_MIN_RES_MASK             0x0f8bfe77
+
+/*  Retention Control */
+#define PMU_RCTL_CLK_DIV_SHIFT         0
+#define PMU_RCTL_CHAIN_LEN_SHIFT       12
+#define PMU_RCTL_MACPHY_DISABLE_SHIFT  26
+#define PMU_RCTL_MACPHY_DISABLE_MASK   (1 << 26)
+#define PMU_RCTL_LOGIC_DISABLE_SHIFT   27
+#define PMU_RCTL_LOGIC_DISABLE_MASK    (1 << 27)
+#define PMU_RCTL_MEMSLP_LOG_SHIFT      28
+#define PMU_RCTL_MEMSLP_LOG_MASK       (1 << 28)
+#define PMU_RCTL_MEMRETSLP_LOG_SHIFT   29
+#define PMU_RCTL_MEMRETSLP_LOG_MASK    (1 << 29)
+
+/*  Retention Group Control */
+#define PMU_RCTLGRP_CHAIN_LEN_SHIFT    0
+#define PMU_RCTLGRP_RMODE_ENABLE_SHIFT 14
+#define PMU_RCTLGRP_RMODE_ENABLE_MASK  (1 << 14)
+#define PMU_RCTLGRP_DFT_ENABLE_SHIFT   15
+#define PMU_RCTLGRP_DFT_ENABLE_MASK    (1 << 15)
+#define PMU_RCTLGRP_NSRST_DISABLE_SHIFT        16
+#define PMU_RCTLGRP_NSRST_DISABLE_MASK (1 << 16)
+
+/* Fields in clkstretch */
+#define CSTRETCH_HT            0xffff0000
+#define CSTRETCH_ALP           0x0000ffff
+#define CSTRETCH_REDUCE_8              0x00080008
+
+/* gpiotimerval */
+#define GPIO_ONTIME_SHIFT      16
+
+/* clockcontrol_n */
+/* Some pll types use less than the number of bits in some of these (n or m) masks */
+#define        CN_N1_MASK              0x3f            /**< n1 control */
+#define        CN_N2_MASK              0x3f00          /**< n2 control */
+#define        CN_N2_SHIFT             8
+#define        CN_PLLC_MASK            0xf0000         /**< pll control */
+#define        CN_PLLC_SHIFT           16
+
+/* clockcontrol_sb/pci/uart */
+#define        CC_M1_MASK              0x3f            /**< m1 control */
+#define        CC_M2_MASK              0x3f00          /**< m2 control */
+#define        CC_M2_SHIFT             8
+#define        CC_M3_MASK              0x3f0000        /**< m3 control */
+#define        CC_M3_SHIFT             16
+#define        CC_MC_MASK              0x1f000000      /**< mux control */
+#define        CC_MC_SHIFT             24
+
+/* N3M Clock control magic field values */
+#define        CC_F6_2                 0x02            /**< A factor of 2 in */
+#define        CC_F6_3                 0x03            /**< 6-bit fields like */
+#define        CC_F6_4                 0x05            /**< N1, M1 or M3 */
+#define        CC_F6_5                 0x09
+#define        CC_F6_6                 0x11
+#define        CC_F6_7                 0x21
+
+#define        CC_F5_BIAS              5               /**< 5-bit fields get this added */
+
+#define        CC_MC_BYPASS            0x08
+#define        CC_MC_M1                0x04
+#define        CC_MC_M1M2              0x02
+#define        CC_MC_M1M2M3            0x01
+#define        CC_MC_M1M3              0x11
+
+/* Type 2 Clock control magic field values */
+#define        CC_T2_BIAS              2               /**< n1, n2, m1 & m3 bias */
+#define        CC_T2M2_BIAS            3               /**< m2 bias */
+
+#define        CC_T2MC_M1BYP           1
+#define        CC_T2MC_M2BYP           2
+#define        CC_T2MC_M3BYP           4
+
+/* Type 6 Clock control magic field values */
+#define        CC_T6_MMASK             1               /**< bits of interest in m */
+#define        CC_T6_M0                120000000       /**< sb clock for m = 0 */
+#define        CC_T6_M1                100000000       /**< sb clock for m = 1 */
+#define        SB2MIPS_T6(sb)          (2 * (sb))
+
+/* Common clock base */
+#define        CC_CLOCK_BASE1          24000000        /**< Half the clock freq */
+#define CC_CLOCK_BASE2         12500000        /**< Alternate crystal on some PLLs */
+
+/* Flash types in the chipcommon capabilities register */
+#define FLASH_NONE             0x000           /**< No flash */
+#define SFLASH_ST              0x100           /**< ST serial flash */
+#define SFLASH_AT              0x200           /**< Atmel serial flash */
+#define NFLASH                 0x300           /**< NAND flash */
+#define        PFLASH                  0x700           /**< Parallel flash */
+#define QSPIFLASH_ST           0x800
+#define QSPIFLASH_AT           0x900
+
+/* Bits in the ExtBus config registers */
+#define        CC_CFG_EN               0x0001          /**< Enable */
+#define        CC_CFG_EM_MASK          0x000e          /**< Extif Mode */
+#define        CC_CFG_EM_ASYNC         0x0000          /**<   Async/Parallel flash */
+#define        CC_CFG_EM_SYNC          0x0002          /**<   Synchronous */
+#define        CC_CFG_EM_PCMCIA        0x0004          /**<   PCMCIA */
+#define        CC_CFG_EM_IDE           0x0006          /**<   IDE */
+#define        CC_CFG_DS               0x0010          /**< Data size, 0=8bit, 1=16bit */
+#define        CC_CFG_CD_MASK          0x00e0          /**< Sync: Clock divisor, rev >= 20 */
+#define        CC_CFG_CE               0x0100          /**< Sync: Clock enable, rev >= 20 */
+#define        CC_CFG_SB               0x0200          /**< Sync: Size/Bytestrobe, rev >= 20 */
+#define        CC_CFG_IS               0x0400          /**< Extif Sync Clk Select, rev >= 20 */
+
+/* ExtBus address space */
+#define        CC_EB_BASE              0x1a000000      /**< Chipc ExtBus base address */
+#define        CC_EB_PCMCIA_MEM        0x1a000000      /**< PCMCIA 0 memory base address */
+#define        CC_EB_PCMCIA_IO         0x1a200000      /**< PCMCIA 0 I/O base address */
+#define        CC_EB_PCMCIA_CFG        0x1a400000      /**< PCMCIA 0 config base address */
+#define        CC_EB_IDE               0x1a800000      /**< IDE memory base */
+#define        CC_EB_PCMCIA1_MEM       0x1a800000      /**< PCMCIA 1 memory base address */
+#define        CC_EB_PCMCIA1_IO        0x1aa00000      /**< PCMCIA 1 I/O base address */
+#define        CC_EB_PCMCIA1_CFG       0x1ac00000      /**< PCMCIA 1 config base address */
+#define        CC_EB_PROGIF            0x1b000000      /**< ProgIF Async/Sync base address */
+
+/* Start/busy bit in flashcontrol */
+#define SFLASH_OPCODE          0x000000ff
+#define SFLASH_ACTION          0x00000700
+#define        SFLASH_CS_ACTIVE        0x00001000      /**< Chip Select Active, rev >= 20 */
+#define SFLASH_START           0x80000000
+#define SFLASH_BUSY            SFLASH_START
+
+/* flashcontrol action codes */
+#define        SFLASH_ACT_OPONLY       0x0000          /**< Issue opcode only */
+#define        SFLASH_ACT_OP1D         0x0100          /**< opcode + 1 data byte */
+#define        SFLASH_ACT_OP3A         0x0200          /**< opcode + 3 addr bytes */
+#define        SFLASH_ACT_OP3A1D       0x0300          /**< opcode + 3 addr & 1 data bytes */
+#define        SFLASH_ACT_OP3A4D       0x0400          /**< opcode + 3 addr & 4 data bytes */
+#define        SFLASH_ACT_OP3A4X4D     0x0500          /**< opcode + 3 addr, 4 don't care & 4 data bytes */
+#define        SFLASH_ACT_OP3A1X4D     0x0700          /**< opcode + 3 addr, 1 don't care & 4 data bytes */
+
+/* flashcontrol action+opcodes for ST flashes */
+#define SFLASH_ST_WREN         0x0006          /**< Write Enable */
+#define SFLASH_ST_WRDIS                0x0004          /**< Write Disable */
+#define SFLASH_ST_RDSR         0x0105          /**< Read Status Register */
+#define SFLASH_ST_WRSR         0x0101          /**< Write Status Register */
+#define SFLASH_ST_READ         0x0303          /**< Read Data Bytes */
+#define SFLASH_ST_PP           0x0302          /**< Page Program */
+#define SFLASH_ST_SE           0x02d8          /**< Sector Erase */
+#define SFLASH_ST_BE           0x00c7          /**< Bulk Erase */
+#define SFLASH_ST_DP           0x00b9          /**< Deep Power-down */
+#define SFLASH_ST_RES          0x03ab          /**< Read Electronic Signature */
+#define SFLASH_ST_CSA          0x1000          /**< Keep chip select asserted */
+#define SFLASH_ST_SSE          0x0220          /**< Sub-sector Erase */
+
+#define SFLASH_ST_READ4B       0x6313          /* Read Data Bytes in 4Byte address */
+#define SFLASH_ST_PP4B         0x6312          /* Page Program in 4Byte address */
+#define SFLASH_ST_SE4B         0x62dc          /* Sector Erase in 4Byte address */
+#define SFLASH_ST_SSE4B                0x6221          /* Sub-sector Erase */
+
+#define SFLASH_MXIC_RDID       0x0390          /* Read Manufacture ID */
+#define SFLASH_MXIC_MFID       0xc2            /* MXIC Manufacture ID */
+
+#define SFLASH_WINBOND_RDID    0x0390          /* Read Manufacture ID */
+#define SFLASH_WINBOND_MFID    0xef            /* Winbond Manufacture ID */
+
+/* Status register bits for ST flashes */
+#define SFLASH_ST_WIP          0x01            /**< Write In Progress */
+#define SFLASH_ST_WEL          0x02            /**< Write Enable Latch */
+#define SFLASH_ST_BP_MASK      0x1c            /**< Block Protect */
+#define SFLASH_ST_BP_SHIFT     2
+#define SFLASH_ST_SRWD         0x80            /**< Status Register Write Disable */
+
+/* flashcontrol action+opcodes for Atmel flashes */
+#define SFLASH_AT_READ                         0x07e8
+#define SFLASH_AT_PAGE_READ                    0x07d2
+/* PR9631: impossible to specify Atmel Buffer Read command */
+#define SFLASH_AT_BUF1_READ
+#define SFLASH_AT_BUF2_READ
+#define SFLASH_AT_STATUS                       0x01d7
+#define SFLASH_AT_BUF1_WRITE                   0x0384
+#define SFLASH_AT_BUF2_WRITE                   0x0387
+#define SFLASH_AT_BUF1_ERASE_PROGRAM           0x0283
+#define SFLASH_AT_BUF2_ERASE_PROGRAM           0x0286
+#define SFLASH_AT_BUF1_PROGRAM                 0x0288
+#define SFLASH_AT_BUF2_PROGRAM                 0x0289
+#define SFLASH_AT_PAGE_ERASE                   0x0281
+#define SFLASH_AT_BLOCK_ERASE                  0x0250
+#define SFLASH_AT_BUF1_WRITE_ERASE_PROGRAM     0x0382
+#define SFLASH_AT_BUF2_WRITE_ERASE_PROGRAM     0x0385
+#define SFLASH_AT_BUF1_LOAD                    0x0253
+#define SFLASH_AT_BUF2_LOAD                    0x0255
+#define SFLASH_AT_BUF1_COMPARE                 0x0260
+#define SFLASH_AT_BUF2_COMPARE                 0x0261
+#define SFLASH_AT_BUF1_REPROGRAM               0x0258
+#define SFLASH_AT_BUF2_REPROGRAM               0x0259
+
+/* Status register bits for Atmel flashes */
+#define SFLASH_AT_READY                                0x80
+#define SFLASH_AT_MISMATCH                     0x40
+#define SFLASH_AT_ID_MASK                      0x38
+#define SFLASH_AT_ID_SHIFT                     3
+
+/* SPI register bits, corerev >= 37 */
+#define GSIO_START                     0x80000000u
+#define GSIO_BUSY                      GSIO_START
+
+/* UART Function sel related */
+#define MUXENAB_DEF_UART_MASK           0x0000000fu
+#define MUXENAB_DEF_UART_SHIFT          0
+
+/* HOST_WAKE Function sel related */
+#define MUXENAB_DEF_HOSTWAKE_MASK      0x000000f0u     /**< configure GPIO for host_wake */
+#define MUXENAB_DEF_HOSTWAKE_SHIFT     4u
+
+/* GCI UART Function sel related */
+#define MUXENAB_GCI_UART_MASK          0x00000f00u
+#define MUXENAB_GCI_UART_SHIFT         8u
+#define MUXENAB_GCI_UART_FNSEL_MASK    0x00003000u
+#define MUXENAB_GCI_UART_FNSEL_SHIFT   12u
+
+/* Mask used to decide whether MUX to be performed or not */
+#define MUXENAB_DEF_GETIX(val, name) \
+       ((((val) & MUXENAB_DEF_ ## name ## _MASK) >> MUXENAB_DEF_ ## name ## _SHIFT) - 1)
+
+/*
+ * These are the UART port assignments, expressed as offsets from the base
+ * register.  These assignments should hold for any serial port based on
+ * a 8250, 16450, or 16550(A).
+ */
+
+#define UART_RX                0       /**< In:  Receive buffer (DLAB=0) */
+#define UART_TX                0       /**< Out: Transmit buffer (DLAB=0) */
+#define UART_DLL       0       /**< Out: Divisor Latch Low (DLAB=1) */
+#define UART_IER       1       /**< In/Out: Interrupt Enable Register (DLAB=0) */
+#define UART_DLM       1       /**< Out: Divisor Latch High (DLAB=1) */
+#define UART_IIR       2       /**< In: Interrupt Identity Register  */
+#define UART_FCR       2       /**< Out: FIFO Control Register */
+#define UART_LCR       3       /**< Out: Line Control Register */
+#define UART_MCR       4       /**< Out: Modem Control Register */
+#define UART_LSR       5       /**< In:  Line Status Register */
+#define UART_MSR       6       /**< In:  Modem Status Register */
+#define UART_SCR       7       /**< I/O: Scratch Register */
+#define UART_LCR_DLAB  0x80    /**< Divisor latch access bit */
+#define UART_LCR_WLEN8 0x03    /**< Word length: 8 bits */
+#define UART_MCR_OUT2  0x08    /**< MCR GPIO out 2 */
+#define UART_MCR_LOOP  0x10    /**< Enable loopback test mode */
+#define UART_LSR_RX_FIFO       0x80    /**< Receive FIFO error */
+#define UART_LSR_TDHR          0x40    /**< Data-hold-register empty */
+#define UART_LSR_THRE          0x20    /**< Transmit-hold-register empty */
+#define UART_LSR_BREAK         0x10    /**< Break interrupt */
+#define UART_LSR_FRAMING       0x08    /**< Framing error */
+#define UART_LSR_PARITY                0x04    /**< Parity error */
+#define UART_LSR_OVERRUN       0x02    /**< Overrun error */
+#define UART_LSR_RXRDY         0x01    /**< Receiver ready */
+#define UART_FCR_FIFO_ENABLE 1 /**< FIFO control register bit controlling FIFO enable/disable */
+
+/* Interrupt Identity Register (IIR) bits */
+#define UART_IIR_FIFO_MASK     0xc0    /**< IIR FIFO disable/enabled mask */
+#define UART_IIR_INT_MASK      0xf     /**< IIR interrupt ID source */
+#define UART_IIR_MDM_CHG       0x0     /**< Modem status changed */
+#define UART_IIR_NOINT         0x1     /**< No interrupt pending */
+#define UART_IIR_THRE          0x2     /**< THR empty */
+#define UART_IIR_RCVD_DATA     0x4     /**< Received data available */
+#define UART_IIR_RCVR_STATUS   0x6     /**< Receiver status */
+#define UART_IIR_CHAR_TIME     0xc     /**< Character time */
+
+/* Interrupt Enable Register (IER) bits */
+#define UART_IER_PTIME 128     /**< Programmable THRE Interrupt Mode Enable */
+#define UART_IER_EDSSI 8       /**< enable modem status interrupt */
+#define UART_IER_ELSI  4       /**< enable receiver line status interrupt */
+#define UART_IER_ETBEI  2      /**< enable transmitter holding register empty interrupt */
+#define UART_IER_ERBFI 1       /**< enable data available interrupt */
+
+/* pmustatus */
+#define PST_SLOW_WR_PENDING 0x0400
+#define PST_EXTLPOAVAIL        0x0100
+#define PST_WDRESET    0x0080
+#define        PST_INTPEND     0x0040
+#define        PST_SBCLKST     0x0030
+#define        PST_SBCLKST_ILP 0x0010
+#define        PST_SBCLKST_ALP 0x0020
+#define        PST_SBCLKST_HT  0x0030
+#define        PST_ALPAVAIL    0x0008
+#define        PST_HTAVAIL     0x0004
+#define        PST_RESINIT     0x0003
+#define        PST_ILPFASTLPO  0x00010000
+
+/* pmucapabilities */
+#define PCAP_REV_MASK  0x000000ff
+#define PCAP_RC_MASK   0x00001f00
+#define PCAP_RC_SHIFT  8
+#define PCAP_TC_MASK   0x0001e000
+#define PCAP_TC_SHIFT  13
+#define PCAP_PC_MASK   0x001e0000
+#define PCAP_PC_SHIFT  17
+#define PCAP_VC_MASK   0x01e00000
+#define PCAP_VC_SHIFT  21
+#define PCAP_CC_MASK   0x1e000000
+#define PCAP_CC_SHIFT  25
+#define PCAP5_PC_MASK  0x003e0000      /**< PMU corerev >= 5 */
+#define PCAP5_PC_SHIFT 17
+#define PCAP5_VC_MASK  0x07c00000
+#define PCAP5_VC_SHIFT 22
+#define PCAP5_CC_MASK  0xf8000000
+#define PCAP5_CC_SHIFT 27
+
+/* pmucapabilities ext */
+#define PCAP_EXT_ST_NUM_SHIFT                  (8)     /* stat timer number */
+#define PCAP_EXT_ST_NUM_MASK                   (0xf << PCAP_EXT_ST_NUM_SHIFT)
+#define PCAP_EXT_ST_SRC_NUM_SHIFT              (12)    /* stat timer source number */
+#define PCAP_EXT_ST_SRC_NUM_MASK               (0xf << PCAP_EXT_ST_SRC_NUM_SHIFT)
+#define PCAP_EXT_MAC_RSRC_REQ_TMR_CNT_SHIFT    (20u)   /* # of MAC rsrc req timers */
+#define PCAP_EXT_MAC_RSRC_REQ_TMR_CNT_MASK     (7u << PCAP_EXT_MAC_RSRC_REQ_TMR_CNT_SHIFT)
+#define PCAP_EXT_PMU_INTR_RCVR_CNT_SHIFT       (23u)   /* pmu int rcvr cnt */
+#define PCAP_EXT_PMU_INTR_RCVR_CNT_MASK                (7u << PCAP_EXT_PMU_INTR_RCVR_CNT_SHIFT)
+
+/* pmustattimer ctrl */
+#define PMU_ST_SRC_SHIFT       (0)     /* stat timer source number */
+#define PMU_ST_SRC_MASK                (0xff << PMU_ST_SRC_SHIFT)
+#define PMU_ST_CNT_MODE_SHIFT  (10)    /* stat timer count mode */
+#define PMU_ST_CNT_MODE_MASK   (0x3 << PMU_ST_CNT_MODE_SHIFT)
+#define PMU_ST_EN_SHIFT                (8)     /* stat timer enable */
+#define PMU_ST_EN_MASK         (0x1 << PMU_ST_EN_SHIFT)
+#define PMU_ST_ENAB            1
+#define PMU_ST_DISAB           0
+#define PMU_ST_INT_EN_SHIFT    (9)     /* stat timer enable */
+#define PMU_ST_INT_EN_MASK     (0x1 << PMU_ST_INT_EN_SHIFT)
+#define PMU_ST_INT_ENAB                1
+#define PMU_ST_INT_DISAB       0
+
+/* CoreCapabilitiesExtension */
+#define PCAP_EXT_USE_MUXED_ILP_CLK_MASK        0x04000000
+
+/* PMU Resource Request Timer registers */
+/* This is based on PmuRev0 */
+#define        PRRT_TIME_MASK  0x03ff
+#define        PRRT_INTEN      0x0400
+/* ReqActive   25
+ * The hardware sets this field to 1 when the timer expires.
+ * Software writes this field to 1 to make immediate resource requests.
+ */
+#define        PRRT_REQ_ACTIVE 0x0800  /* To check h/w status */
+#define        PRRT_IMMEDIATE_RES_REQ  0x0800  /* macro for sw immediate res req */
+#define        PRRT_ALP_REQ    0x1000
+#define        PRRT_HT_REQ     0x2000
+#define PRRT_HQ_REQ 0x4000
+
+/* PMU Int Control register bits */
+#define PMU_INTC_ALP_REQ       0x1
+#define PMU_INTC_HT_REQ                0x2
+#define PMU_INTC_HQ_REQ                0x4
+
+/* bit 0 of the PMU interrupt vector is asserted if this mask is enabled */
+#define RSRC_INTR_MASK_TIMER_INT_0 1
+#define PMU_INTR_MASK_EXTWAKE_REQ_ACTIVE_0 (1 << 20)
+
+#define PMU_INT_STAT_RSRC_EVENT_INT0_SHIFT     (8u)
+#define PMU_INT_STAT_RSRC_EVENT_INT0_MASK      (1u << PMU_INT_STAT_RSRC_EVENT_INT0_SHIFT)
+
+/* bit 16 of the PMU interrupt vector - Stats Timer Interrupt */
+#define PMU_INT_STAT_TIMER_INT_SHIFT           (16u)
+#define PMU_INT_STAT_TIMER_INT_MASK            (1u <<  PMU_INT_STAT_TIMER_INT_SHIFT)
+
+/*
+ * bit 18 of the PMU interrupt vector - S/R self test fails
+ */
+#define PMU_INT_STAT_SR_ERR_SHIFT              (18u)
+#define PMU_INT_STAT_SR_ERR_MASK               (1u <<  PMU_INT_STAT_SR_ERR_SHIFT)
+
+/* PMU resource bit position */
+#define PMURES_BIT(bit)        (1 << (bit))
+
+/* PMU resource number limit */
+#define PMURES_MAX_RESNUM      30
+
+/* PMU chip control0 register */
+#define        PMU_CHIPCTL0            0
+
+#define PMU_CC0_4369_XTALCORESIZE_BIAS_ADJ_START_VAL   (0x20 << 0)
+#define PMU_CC0_4369_XTALCORESIZE_BIAS_ADJ_START_MASK  (0x3F << 0)
+#define PMU_CC0_4369_XTALCORESIZE_BIAS_ADJ_NORMAL_VAL  (0xF << 6)
+#define PMU_CC0_4369B0_XTALCORESIZE_BIAS_ADJ_NORMAL_VAL        (0x1A << 6)
+#define PMU_CC0_4369_XTALCORESIZE_BIAS_ADJ_NORMAL_MASK (0x3F << 6)
+#define PMU_CC0_4369_XTAL_RES_BYPASS_START_VAL                 (0 << 12)
+#define PMU_CC0_4369_XTAL_RES_BYPASS_START_MASK                        (0x7 << 12)
+#define PMU_CC0_4369_XTAL_RES_BYPASS_NORMAL_VAL                        (0x1 << 15)
+#define PMU_CC0_4369_XTAL_RES_BYPASS_NORMAL_MASK               (0x7 << 15)
+
+// This is not used. so retains reset value
+#define PMU_CC0_4362_XTALCORESIZE_BIAS_ADJ_START_VAL           (0x20u << 0u)
+
+#define PMU_CC0_4362_XTALCORESIZE_BIAS_ADJ_START_MASK          (0x3Fu << 0u)
+#define PMU_CC0_4362_XTALCORESIZE_BIAS_ADJ_NORMAL_VAL          (0x1Au << 6u)
+#define PMU_CC0_4362_XTALCORESIZE_BIAS_ADJ_NORMAL_MASK         (0x3Fu << 6u)
+#define PMU_CC0_4362_XTAL_RES_BYPASS_START_VAL                 (0x00u << 12u)
+#define PMU_CC0_4362_XTAL_RES_BYPASS_START_MASK                        (0x07u << 12u)
+#define PMU_CC0_4362_XTAL_RES_BYPASS_NORMAL_VAL                        (0x02u << 15u)
+#define PMU_CC0_4362_XTAL_RES_BYPASS_NORMAL_MASK               (0x07u << 15u)
+
+#define PMU_CC0_4378_XTALCORESIZE_BIAS_ADJ_START_VAL   (0x20 << 0)
+#define PMU_CC0_4378_XTALCORESIZE_BIAS_ADJ_START_MASK  (0x3F << 0)
+#define PMU_CC0_4378_XTALCORESIZE_BIAS_ADJ_NORMAL_VAL  (0x1A << 6)
+#define PMU_CC0_4378_XTALCORESIZE_BIAS_ADJ_NORMAL_MASK (0x3F << 6)
+#define PMU_CC0_4378_XTAL_RES_BYPASS_START_VAL                 (0 << 12)
+#define PMU_CC0_4378_XTAL_RES_BYPASS_START_MASK                        (0x7 << 12)
+#define PMU_CC0_4378_XTAL_RES_BYPASS_NORMAL_VAL                        (0x2 << 15)
+#define PMU_CC0_4378_XTAL_RES_BYPASS_NORMAL_MASK               (0x7 << 15)
+
+#define PMU_CC0_4387_XTALCORESIZE_BIAS_ADJ_START_VAL   (0x20 << 0)
+#define PMU_CC0_4387_XTALCORESIZE_BIAS_ADJ_START_MASK  (0x3F << 0)
+#define PMU_CC0_4387_XTALCORESIZE_BIAS_ADJ_NORMAL_VAL  (0x1A << 6)
+#define PMU_CC0_4387_XTALCORESIZE_BIAS_ADJ_NORMAL_MASK (0x3F << 6)
+#define PMU_CC0_4387_XTAL_RES_BYPASS_START_VAL                 (0 << 12)
+#define PMU_CC0_4387_XTAL_RES_BYPASS_START_MASK                        (0x7 << 12)
+#define PMU_CC0_4387_XTAL_RES_BYPASS_NORMAL_VAL                        (0x2 << 15)
+#define PMU_CC0_4387_XTAL_RES_BYPASS_NORMAL_MASK               (0x7 << 15)
+#define PMU_CC0_4387_BT_PU_WAKE_MASK                           (0x3u << 30u)
+
+/* clock req types */
+#define PMU_CC1_CLKREQ_TYPE_SHIFT      19
+#define PMU_CC1_CLKREQ_TYPE_MASK       (1 << PMU_CC1_CLKREQ_TYPE_SHIFT)
+
+#define CLKREQ_TYPE_CONFIG_OPENDRAIN           0
+#define CLKREQ_TYPE_CONFIG_PUSHPULL            1
+
+/* Power Control */
+#define PWRCTL_ENAB_MEM_CLK_GATE_SHIFT         5
+#define PWRCTL_FORCE_HW_PWR_REQ_OFF_SHIFT      6
+#define PWRCTL_AUTO_MEM_STBYRET                        28
+
+/* PMU chip control1 register */
+#define        PMU_CHIPCTL1                    1
+#define        PMU_CC1_RXC_DLL_BYPASS          0x00010000
+#define PMU_CC1_ENABLE_BBPLL_PWR_DOWN  0x00000010
+
+#define PMU_CC1_IF_TYPE_MASK           0x00000030
+#define PMU_CC1_IF_TYPE_RMII           0x00000000
+#define PMU_CC1_IF_TYPE_MII            0x00000010
+#define PMU_CC1_IF_TYPE_RGMII          0x00000020
+
+#define PMU_CC1_SW_TYPE_MASK           0x000000c0
+#define PMU_CC1_SW_TYPE_EPHY           0x00000000
+#define PMU_CC1_SW_TYPE_EPHYMII                0x00000040
+#define PMU_CC1_SW_TYPE_EPHYRMII       0x00000080
+#define PMU_CC1_SW_TYPE_RGMII          0x000000c0
+
+#define PMU_CC1_ENABLE_CLOSED_LOOP_MASK 0x00000080
+#define PMU_CC1_ENABLE_CLOSED_LOOP      0x00000000
+
+#define PMU_CC1_PWRSW_CLKSTRSTP_DELAY_MASK     0x00003F00u
+#ifdef BCM_FASTLPO_PMU
+#define PMU_CC1_PWRSW_CLKSTRSTP_DELAY          0x00002000u
+#else
+#define PMU_CC1_PWRSW_CLKSTRSTP_DELAY          0x00000400u
+#endif /* BCM_FASTLPO_PMU */
+
+/* PMU chip control2 register */
+#define PMU_CC2_CB2WL_INTR_PWRREQ_EN           (1u << 13u)
+#define PMU_CC2_RFLDO3P3_PU_FORCE_ON           (1u << 15u)
+#define PMU_CC2_RFLDO3P3_PU_CLEAR              0x00000000u
+
+#define PMU_CC2_WL2CDIG_I_PMU_SLEEP            (1u << 16u)
+#define        PMU_CHIPCTL2            2u
+#define PMU_CC2_FORCE_SUBCORE_PWR_SWITCH_ON    (1u << 18u)
+#define PMU_CC2_FORCE_PHY_PWR_SWITCH_ON                (1u << 19u)
+#define PMU_CC2_FORCE_VDDM_PWR_SWITCH_ON       (1u << 20u)
+#define PMU_CC2_FORCE_MEMLPLDO_PWR_SWITCH_ON   (1u << 21u)
+#define PMU_CC2_MASK_WL_DEV_WAKE             (1u << 22u)
+#define PMU_CC2_INV_GPIO_POLARITY_PMU_WAKE   (1u << 25u)
+#define PMU_CC2_GCI2_WAKE                    (1u << 31u)
+
+#define PMU_CC2_4369_XTALCORESIZE_BIAS_ADJ_START_VAL   (0x3u << 26u)
+#define PMU_CC2_4369_XTALCORESIZE_BIAS_ADJ_START_MASK  (0x3u << 26u)
+#define PMU_CC2_4369_XTALCORESIZE_BIAS_ADJ_NORMAL_VAL  (0x0u << 28u)
+#define PMU_CC2_4369_XTALCORESIZE_BIAS_ADJ_NORMAL_MASK (0x3u << 28u)
+
+#define PMU_CC2_4362_XTALCORESIZE_BIAS_ADJ_START_VAL   (0x3u << 26u)
+#define PMU_CC2_4362_XTALCORESIZE_BIAS_ADJ_START_MASK  (0x3u << 26u)
+#define PMU_CC2_4362_XTALCORESIZE_BIAS_ADJ_NORMAL_VAL  (0x0u << 28u)
+#define PMU_CC2_4362_XTALCORESIZE_BIAS_ADJ_NORMAL_MASK (0x3u << 28u)
+
+#define PMU_CC2_4378_XTALCORESIZE_BIAS_ADJ_START_VAL   (0x3u << 26u)
+#define PMU_CC2_4378_XTALCORESIZE_BIAS_ADJ_START_MASK  (0x3u << 26u)
+#define PMU_CC2_4378_XTALCORESIZE_BIAS_ADJ_NORMAL_VAL  (0x0u << 28u)
+#define PMU_CC2_4378_XTALCORESIZE_BIAS_ADJ_NORMAL_MASK (0x3u << 28u)
+
+#define PMU_CC2_4368_SR_RET_ENABLE                     (0x7u << 14u)
+#define PMU_CC2_4368_WLAN2CB_INT_PWR_MASK              (1u << 13u)
+#define PMU_CC2_4368_WLAN2CB_INT_PWR_SHIFT             13u
+
+#define PMU_CC2_4387_XTALCORESIZE_BIAS_ADJ_START_VAL   (0x3u << 26u)
+#define PMU_CC2_4387_XTALCORESIZE_BIAS_ADJ_START_MASK  (0x3u << 26u)
+#define PMU_CC2_4387_XTALCORESIZE_BIAS_ADJ_NORMAL_VAL  (0x0u << 28u)
+#define PMU_CC2_4387_XTALCORESIZE_BIAS_ADJ_NORMAL_MASK (0x3u << 28u)
+
+/* PMU chip control3 register */
+#define        PMU_CHIPCTL3            3u
+#define PMU_CC3_ENABLE_SDIO_WAKEUP_SHIFT  19u
+#define PMU_CC3_ENABLE_RF_SHIFT           22u
+#define PMU_CC3_RF_DISABLE_IVALUE_SHIFT   23u
+
+#define PMU_CC3_4369_XTALCORESIZE_PMOS_START_VAL       (0x3Fu << 0u)
+#define PMU_CC3_4369_XTALCORESIZE_PMOS_START_MASK      (0x3Fu << 0u)
+#define PMU_CC3_4369_XTALCORESIZE_PMOS_NORMAL_VAL      (0x3Fu << 15u)
+#define PMU_CC3_4369_XTALCORESIZE_PMOS_NORMAL_MASK     (0x3Fu << 15u)
+#define PMU_CC3_4369_XTALCORESIZE_NMOS_START_VAL       (0x3Fu << 6u)
+#define PMU_CC3_4369_XTALCORESIZE_NMOS_START_MASK      (0x3Fu << 6u)
+#define PMU_CC3_4369_XTALCORESIZE_NMOS_NORMAL_VAL      (0x3Fu << 21)
+#define PMU_CC3_4369_XTALCORESIZE_NMOS_NORMAL_MASK     (0x3Fu << 21)
+#define PMU_CC3_4369_XTALSEL_BIAS_RES_START_VAL                (0x2u << 12u)
+#define PMU_CC3_4369_XTALSEL_BIAS_RES_START_MASK       (0x7u << 12u)
+#define PMU_CC3_4369_XTALSEL_BIAS_RES_NORMAL_VAL       (0x2u << 27u)
+#define PMU_CC3_4369_XTALSEL_BIAS_RES_NORMAL_MASK      (0x7u << 27u)
+
+#define PMU_CC3_4362_XTALCORESIZE_PMOS_START_VAL       (0x3Fu << 0u)
+#define PMU_CC3_4362_XTALCORESIZE_PMOS_START_MASK      (0x3Fu << 0u)
+#define PMU_CC3_4362_XTALCORESIZE_PMOS_NORMAL_VAL      (0x3Fu << 15u)
+#define PMU_CC3_4362_XTALCORESIZE_PMOS_NORMAL_MASK     (0x3Fu << 15u)
+#define PMU_CC3_4362_XTALCORESIZE_NMOS_START_VAL       (0x3Fu << 6u)
+#define PMU_CC3_4362_XTALCORESIZE_NMOS_START_MASK      (0x3Fu << 6u)
+#define PMU_CC3_4362_XTALCORESIZE_NMOS_NORMAL_VAL      (0x3Fu << 21u)
+#define PMU_CC3_4362_XTALCORESIZE_NMOS_NORMAL_MASK     (0x3Fu << 21u)
+#define PMU_CC3_4362_XTALSEL_BIAS_RES_START_VAL                (0x02u << 12u)
+#define PMU_CC3_4362_XTALSEL_BIAS_RES_START_MASK       (0x07u << 12u)
+/* Changed from 6 to 4 for wlan PHN and to 2 for BT PER issues */
+#define PMU_CC3_4362_XTALSEL_BIAS_RES_NORMAL_VAL       (0x02u << 27u)
+#define PMU_CC3_4362_XTALSEL_BIAS_RES_NORMAL_MASK      (0x07u << 27u)
+
+#define PMU_CC3_4378_XTALCORESIZE_PMOS_START_VAL       (0x3F << 0)
+#define PMU_CC3_4378_XTALCORESIZE_PMOS_START_MASK      (0x3F << 0)
+#define PMU_CC3_4378_XTALCORESIZE_PMOS_NORMAL_VAL      (0x3F << 15)
+#define PMU_CC3_4378_XTALCORESIZE_PMOS_NORMAL_MASK     (0x3F << 15)
+#define PMU_CC3_4378_XTALCORESIZE_NMOS_START_VAL       (0x3F << 6)
+#define PMU_CC3_4378_XTALCORESIZE_NMOS_START_MASK      (0x3F << 6)
+#define PMU_CC3_4378_XTALCORESIZE_NMOS_NORMAL_VAL      (0x3F << 21)
+#define PMU_CC3_4378_XTALCORESIZE_NMOS_NORMAL_MASK     (0x3F << 21)
+#define PMU_CC3_4378_XTALSEL_BIAS_RES_START_VAL                (0x2 << 12)
+#define PMU_CC3_4378_XTALSEL_BIAS_RES_START_MASK       (0x7 << 12)
+#define PMU_CC3_4378_XTALSEL_BIAS_RES_NORMAL_VAL       (0x2 << 27)
+#define PMU_CC3_4378_XTALSEL_BIAS_RES_NORMAL_MASK      (0x7 << 27)
+
+#define PMU_CC3_4387_XTALCORESIZE_PMOS_START_VAL       (0x3F << 0)
+#define PMU_CC3_4387_XTALCORESIZE_PMOS_START_MASK      (0x3F << 0)
+#define PMU_CC3_4387_XTALCORESIZE_PMOS_NORMAL_VAL      (0x3F << 15)
+#define PMU_CC3_4387_XTALCORESIZE_PMOS_NORMAL_MASK     (0x3F << 15)
+#define PMU_CC3_4387_XTALCORESIZE_NMOS_START_VAL       (0x3F << 6)
+#define PMU_CC3_4387_XTALCORESIZE_NMOS_START_MASK      (0x3F << 6)
+#define PMU_CC3_4387_XTALCORESIZE_NMOS_NORMAL_VAL      (0x3F << 21)
+#define PMU_CC3_4387_XTALCORESIZE_NMOS_NORMAL_MASK     (0x3F << 21)
+#define PMU_CC3_4387_XTALSEL_BIAS_RES_START_VAL                (0x2 << 12)
+#define PMU_CC3_4387_XTALSEL_BIAS_RES_START_MASK       (0x7 << 12)
+#define PMU_CC3_4387_XTALSEL_BIAS_RES_NORMAL_VAL       (0x5 << 27)
+#define PMU_CC3_4387_XTALSEL_BIAS_RES_NORMAL_MASK      (0x7 << 27)
+
+/* PMU chip control4 register */
+#define PMU_CHIPCTL4                    4
+
+/* 53537 series moved switch_type and gmac_if_type to CC4 [15:14] and [13:12] */
+#define PMU_CC4_IF_TYPE_MASK           0x00003000
+#define PMU_CC4_IF_TYPE_RMII           0x00000000
+#define PMU_CC4_IF_TYPE_MII            0x00001000
+#define PMU_CC4_IF_TYPE_RGMII          0x00002000
+
+#define PMU_CC4_SW_TYPE_MASK           0x0000c000
+#define PMU_CC4_SW_TYPE_EPHY           0x00000000
+#define PMU_CC4_SW_TYPE_EPHYMII                0x00004000
+#define PMU_CC4_SW_TYPE_EPHYRMII       0x00008000
+#define PMU_CC4_SW_TYPE_RGMII          0x0000c000
+#define PMU_CC4_DISABLE_LQ_AVAIL       (1<<27)
+
+#define PMU_CC4_4369_MAIN_PD_CBUCK2VDDB_ON     (1u << 15u)
+#define PMU_CC4_4369_MAIN_PD_CBUCK2VDDRET_ON   (1u << 16u)
+#define PMU_CC4_4369_MAIN_PD_MEMLPLDO2VDDB_ON  (1u << 17u)
+#define PMU_CC4_4369_MAIN_PD_MEMLPDLO2VDDRET_ON        (1u << 18u)
+
+#define PMU_CC4_4369_AUX_PD_CBUCK2VDDB_ON      (1u << 21u)
+#define PMU_CC4_4369_AUX_PD_CBUCK2VDDRET_ON    (1u << 22u)
+#define PMU_CC4_4369_AUX_PD_MEMLPLDO2VDDB_ON   (1u << 23u)
+#define PMU_CC4_4369_AUX_PD_MEMLPLDO2VDDRET_ON (1u << 24u)
+
+#define PMU_CC4_4362_PD_CBUCK2VDDB_ON          (1u << 15u)
+#define PMU_CC4_4362_PD_CBUCK2VDDRET_ON                (1u << 16u)
+#define PMU_CC4_4362_PD_MEMLPLDO2VDDB_ON       (1u << 17u)
+#define PMU_CC4_4362_PD_MEMLPDLO2VDDRET_ON     (1u << 18u)
+
+#define PMU_CC4_4378_MAIN_PD_CBUCK2VDDB_ON     (1u << 15u)
+#define PMU_CC4_4378_MAIN_PD_CBUCK2VDDRET_ON   (1u << 16u)
+#define PMU_CC4_4378_MAIN_PD_MEMLPLDO2VDDB_ON  (1u << 17u)
+#define PMU_CC4_4378_MAIN_PD_MEMLPDLO2VDDRET_ON        (1u << 18u)
+
+#define PMU_CC4_4378_AUX_PD_CBUCK2VDDB_ON      (1u << 21u)
+#define PMU_CC4_4378_AUX_PD_CBUCK2VDDRET_ON    (1u << 22u)
+#define PMU_CC4_4378_AUX_PD_MEMLPLDO2VDDB_ON   (1u << 23u)
+#define PMU_CC4_4378_AUX_PD_MEMLPLDO2VDDRET_ON (1u << 24u)
+
+#define PMU_CC4_4387_MAIN_PD_CBUCK2VDDB_ON     (1u << 15u)
+#define PMU_CC4_4387_MAIN_PD_CBUCK2VDDRET_ON   (1u << 16u)
+#define PMU_CC4_4387_MAIN_PD_MEMLPLDO2VDDB_ON  (1u << 17u)
+#define PMU_CC4_4387_MAIN_PD_MEMLPDLO2VDDRET_ON        (1u << 18u)
+
+#define PMU_CC4_4387_AUX_PD_CBUCK2VDDB_ON      (1u << 21u)
+#define PMU_CC4_4387_AUX_PD_CBUCK2VDDRET_ON    (1u << 22u)
+#define PMU_CC4_4387_AUX_PD_MEMLPLDO2VDDB_ON   (1u << 23u)
+#define PMU_CC4_4387_AUX_PD_MEMLPLDO2VDDRET_ON (1u << 24u)
+
+/* PMU chip control5 register */
+#define PMU_CHIPCTL5                    5
+
+#define PMU_CC5_4369_SUBCORE_CBUCK2VDDB_ON     (1u << 9u)
+#define PMU_CC5_4369_SUBCORE_CBUCK2VDDRET_ON   (1u << 10u)
+#define PMU_CC5_4369_SUBCORE_MEMLPLDO2VDDB_ON  (1u << 11u)
+#define PMU_CC5_4369_SUBCORE_MEMLPLDO2VDDRET_ON        (1u << 12u)
+
+#define PMU_CC5_4362_SUBCORE_CBUCK2VDDB_ON     (1u << 9u)
+#define PMU_CC5_4362_SUBCORE_CBUCK2VDDRET_ON   (1u << 10u)
+#define PMU_CC5_4362_SUBCORE_MEMLPLDO2VDDB_ON  (1u << 11u)
+#define PMU_CC5_4362_SUBCORE_MEMLPLDO2VDDRET_ON        (1u << 12u)
+
+#define PMU_CC5_4378_SUBCORE_CBUCK2VDDB_ON     (1u << 9u)
+#define PMU_CC5_4378_SUBCORE_CBUCK2VDDRET_ON   (1u << 10u)
+#define PMU_CC5_4378_SUBCORE_MEMLPLDO2VDDB_ON  (1u << 11u)
+#define PMU_CC5_4378_SUBCORE_MEMLPLDO2VDDRET_ON        (1u << 12u)
+
+#define PMU_CC5_4387_SUBCORE_CBUCK2VDDB_ON     (1u << 9u)
+#define PMU_CC5_4387_SUBCORE_CBUCK2VDDRET_ON   (1u << 10u)
+#define PMU_CC5_4387_SUBCORE_MEMLPLDO2VDDB_ON  (1u << 11u)
+#define PMU_CC5_4387_SUBCORE_MEMLPLDO2VDDRET_ON        (1u << 12u)
+
+#define PMU_CC5_4389_SUBCORE_SDTCCLK0_ON       (1u << 3u)
+#define PMU_CC5_4389_SUBCORE_SDTCCLK1_ON       (1u << 4u)
+
+/* PMU chip control6 register */
+#define PMU_CHIPCTL6                    6
+#define PMU_CC6_RX4_CLK_SEQ_SELECT_MASK        BCM_MASK32(1u, 0u)
+#define PMU_CC6_ENABLE_DMN1_WAKEUP      (1 << 3)
+#define PMU_CC6_ENABLE_CLKREQ_WAKEUP    (1 << 4)
+#define PMU_CC6_ENABLE_PMU_WAKEUP_ALP   (1 << 6)
+#define PMU_CC6_ENABLE_PCIE_RETENTION  (1 << 12)
+#define PMU_CC6_ENABLE_PMU_EXT_PERST   (1 << 13)
+#define PMU_CC6_ENABLE_PMU_WAKEUP_PERST        (1 << 14)
+#define PMU_CC6_ENABLE_LEGACY_WAKEUP   (1 << 16)
+
+/* PMU chip control7 register */
+#define PMU_CHIPCTL7                           7
+#define PMU_CC7_ENABLE_L2REFCLKPAD_PWRDWN      (1 << 25)
+#define PMU_CC7_ENABLE_MDIO_RESET_WAR          (1 << 27)
+/* 53537 series have gmca1 gmac_if_type in cc7 [7:6](defalut 0b01) */
+#define PMU_CC7_IF_TYPE_MASK           0x000000c0
+#define PMU_CC7_IF_TYPE_RMII           0x00000000
+#define PMU_CC7_IF_TYPE_MII            0x00000040
+#define PMU_CC7_IF_TYPE_RGMII          0x00000080
+
+#define PMU_CHIPCTL8                   8
+#define PMU_CHIPCTL9                   9
+
+#define PMU_CHIPCTL10                  10
+#define PMU_CC10_PCIE_PWRSW_RESET0_CNT_SHIFT           0
+#define PMU_CC10_PCIE_PWRSW_RESET0_CNT_MASK            0x000000ff
+#define PMU_CC10_PCIE_PWRSW_RESET1_CNT_SHIFT           8
+#define PMU_CC10_PCIE_PWRSW_RESET1_CNT_MASK            0x0000ff00
+#define PMU_CC10_PCIE_PWRSW_UP_DLY_SHIFT               16
+#define PMU_CC10_PCIE_PWRSW_UP_DLY_MASK                0x000f0000
+#define PMU_CC10_PCIE_PWRSW_FORCE_PWROK_DLY_SHIFT      20
+#define PMU_CC10_PCIE_PWRSW_FORCE_PWROK_DLY_MASK       0x00f00000
+#define PMU_CC10_FORCE_PCIE_ON         (1 << 24)
+#define PMU_CC10_FORCE_PCIE_SW_ON      (1 << 25)
+#define PMU_CC10_FORCE_PCIE_RETNT_ON   (1 << 26)
+
+#define PMU_CC10_4368_FORCE_PCIE_RETNT_ON (1 << 25)
+
+#define PMU_CC10_PCIE_PWRSW_RESET_CNT_4US              1
+#define PMU_CC10_PCIE_PWRSW_RESET_CNT_8US              2
+
+#define PMU_CC10_PCIE_PWRSW_UP_DLY_0US                 0
+
+#define PMU_CC10_PCIE_PWRSW_FORCE_PWROK_DLY_4US        1
+#define PMU_CC10_PCIE_RESET0_CNT_SLOW_MASK     (0xFu << 4u)
+#define PMU_CC10_PCIE_RESET1_CNT_SLOW_MASK     (0xFu << 12u)
+
+#define PMU_CHIPCTL11                  11
+
+/* PMU chip control12 register */
+#define PMU_CHIPCTL12                  12
+#define PMU_CC12_DISABLE_LQ_CLK_ON     (1u << 31u) /* HW4387-254 */
+
+/* PMU chip control13 register */
+#define PMU_CHIPCTL13                  13
+
+#define PMU_CC13_SUBCORE_CBUCK2VDDB_OFF                (1u << 0u)
+#define PMU_CC13_SUBCORE_CBUCK2VDDRET_OFF      (1u << 1u)
+#define PMU_CC13_SUBCORE_MEMLPLDO2VDDB_OFF     (1u << 2u)
+#define PMU_CC13_SUBCORE_MEMLPLDO2VDDRET_OFF   (1u << 3u)
+
+#define PMU_CC13_MAIN_CBUCK2VDDB_OFF           (1u << 4u)
+#define PMU_CC13_MAIN_CBUCK2VDDRET_OFF         (1u << 5u)
+#define PMU_CC13_MAIN_MEMLPLDO2VDDB_OFF                (1u << 6u)
+#define PMU_CC13_MAIN_MEMLPLDO2VDDRET_OFF      (1u << 7u)
+
+#define PMU_CC13_AUX_CBUCK2VDDB_OFF            (1u << 8u)
+#define PMU_CC13_AUX_MEMLPLDO2VDDB_OFF         (1u << 10u)
+#define PMU_CC13_AUX_MEMLPLDO2VDDRET_OFF       (1u << 11u)
+#define PMU_CC13_AUX_CBUCK2VDDRET_OFF          (1u << 12u)
+#define PMU_CC13_CMN_MEMLPLDO2VDDRET_ON                (1u << 18u)
+
+/* HW4368-331 */
+#define PMU_CC13_MAIN_ALWAYS_USE_COHERENT_IF0  (1u << 13u)
+#define PMU_CC13_MAIN_ALWAYS_USE_COHERENT_IF1  (1u << 14u)
+#define PMU_CC13_AUX_ALWAYS_USE_COHERENT_IF0   (1u << 15u)
+#define PMU_CC13_AUX_ALWAYS_USE_COHERENT_IF1   (1u << 19u)
+
+#define PMU_CC13_LHL_TIMER_SELECT              (1u << 23u)
+
+#define PMU_CC13_4369_LHL_TIMER_SELECT         (1u << 23u)
+#define PMU_CC13_4378_LHL_TIMER_SELECT         (1u << 23u)
+
+#define PMU_CC13_4387_ENAB_RADIO_REG_CLK       (1u << 9u)
+#define PMU_CC13_4387_LHL_TIMER_SELECT         (1u << 23u)
+
+#define PMU_CHIPCTL14                  14
+#define PMU_CHIPCTL15                  15
+#define PMU_CHIPCTL16                  16
+#define PMU_CC16_CLK4M_DIS             (1 << 4)
+#define PMU_CC16_FF_ZERO_ADJ           (4 << 5)
+
+/* PMU chip control17 register */
+#define PMU_CHIPCTL17                          17u
+
+#define PMU_CC17_SCAN_CBUCK2VDDB_OFF           (1u << 8u)
+#define PMU_CC17_SCAN_MEMLPLDO2VDDB_OFF                (1u << 10u)
+#define PMU_CC17_SCAN_MEMLPLDO2VDDRET_OFF      (1u << 11u)
+#define PMU_CC17_SCAN_CBUCK2VDDB_ON            (1u << 24u)
+#define PMU_CC17_SCAN_MEMLPLDO2VDDB_ON         (1u << 26u)
+#define PMU_CC17_SCAN_MEMLPLDO2VDDRET_ON       (1u << 27u)
+
+#define PMU_CHIPCTL23                  23
+#define PMU_CC23_MACPHYCLK_MASK                (1 << 31)
+
+#define PMU_CC23_AT_CLK0_ON            (1u << 14u)
+#define PMU_CC23_AT_CLK1_ON            (1u << 15u)
+
+/* PMU chip control14 register */
+#define PMU_CC14_MAIN_VDDB2VDDRET_UP_DLY_MASK          (0xF)
+#define PMU_CC14_MAIN_VDDB2VDD_UP_DLY_MASK             (0xF << 4)
+#define PMU_CC14_AUX_VDDB2VDDRET_UP_DLY_MASK           (0xF << 8)
+#define PMU_CC14_AUX_VDDB2VDD_UP_DLY_MASK              (0xF << 12)
+#define PMU_CC14_PCIE_VDDB2VDDRET_UP_DLY_MASK          (0xF << 16)
+#define PMU_CC14_PCIE_VDDB2VDD_UP_DLY_MASK             (0xF << 20)
+
+/* PMU chip control15 register */
+#define PMU_CC15_PCIE_VDDB_CURRENT_LIMIT_DELAY_MASK    (0xFu << 4u)
+#define PMU_CC15_PCIE_VDDB_FORCE_RPS_PWROK_DELAY_MASK  (0xFu << 8u)
+
+/* PMU corerev and chip specific PLL controls.
+ * PMU<rev>_PLL<num>_XX where <rev> is PMU corerev and <num> is an arbitrary number
+ * to differentiate different PLLs controlled by the same PMU rev.
+ */
+/* pllcontrol registers */
+/* PDIV, div_phy, div_arm, div_adc, dith_sel, ioff, kpd_scale, lsb_sel, mash_sel, lf_c & lf_r */
+#define        PMU0_PLL0_PLLCTL0               0
+#define        PMU0_PLL0_PC0_PDIV_MASK         1
+#define        PMU0_PLL0_PC0_PDIV_FREQ         25000
+#define PMU0_PLL0_PC0_DIV_ARM_MASK     0x00000038
+#define PMU0_PLL0_PC0_DIV_ARM_SHIFT    3
+#define PMU0_PLL0_PC0_DIV_ARM_BASE     8
+
+/* PC0_DIV_ARM for PLLOUT_ARM */
+#define PMU0_PLL0_PC0_DIV_ARM_110MHZ   0
+#define PMU0_PLL0_PC0_DIV_ARM_97_7MHZ  1
+#define PMU0_PLL0_PC0_DIV_ARM_88MHZ    2
+#define PMU0_PLL0_PC0_DIV_ARM_80MHZ    3 /* Default */
+#define PMU0_PLL0_PC0_DIV_ARM_73_3MHZ  4
+#define PMU0_PLL0_PC0_DIV_ARM_67_7MHZ  5
+#define PMU0_PLL0_PC0_DIV_ARM_62_9MHZ  6
+#define PMU0_PLL0_PC0_DIV_ARM_58_6MHZ  7
+
+/* Wildcard base, stop_mod, en_lf_tp, en_cal & lf_r2 */
+#define        PMU0_PLL0_PLLCTL1               1
+#define        PMU0_PLL0_PC1_WILD_INT_MASK     0xf0000000
+#define        PMU0_PLL0_PC1_WILD_INT_SHIFT    28
+#define        PMU0_PLL0_PC1_WILD_FRAC_MASK    0x0fffff00
+#define        PMU0_PLL0_PC1_WILD_FRAC_SHIFT   8
+#define        PMU0_PLL0_PC1_STOP_MOD          0x00000040
+
+/* Wildcard base, vco_calvar, vco_swc, vco_var_selref, vso_ical & vco_sel_avdd */
+#define        PMU0_PLL0_PLLCTL2               2
+#define        PMU0_PLL0_PC2_WILD_INT_MASK     0xf
+#define        PMU0_PLL0_PC2_WILD_INT_SHIFT    4
+
+/* pllcontrol registers */
+/* ndiv_pwrdn, pwrdn_ch<x>, refcomp_pwrdn, dly_ch<x>, p1div, p2div, _bypass_sdmod */
+#define PMU1_PLL0_PLLCTL0              0
+#define PMU1_PLL0_PC0_P1DIV_MASK       0x00f00000
+#define PMU1_PLL0_PC0_P1DIV_SHIFT      20
+#define PMU1_PLL0_PC0_P2DIV_MASK       0x0f000000
+#define PMU1_PLL0_PC0_P2DIV_SHIFT      24
+
+/* m<x>div */
+#define PMU1_PLL0_PLLCTL1              1
+#define PMU1_PLL0_PC1_M1DIV_MASK       0x000000ff
+#define PMU1_PLL0_PC1_M1DIV_SHIFT      0
+#define PMU1_PLL0_PC1_M2DIV_MASK       0x0000ff00
+#define PMU1_PLL0_PC1_M2DIV_SHIFT      8
+#define PMU1_PLL0_PC1_M3DIV_MASK       0x00ff0000
+#define PMU1_PLL0_PC1_M3DIV_SHIFT      16
+#define PMU1_PLL0_PC1_M4DIV_MASK       0xff000000
+#define PMU1_PLL0_PC1_M4DIV_SHIFT      24
+#define PMU1_PLL0_PC1_M4DIV_BY_9       9
+#define PMU1_PLL0_PC1_M4DIV_BY_18      0x12
+#define PMU1_PLL0_PC1_M4DIV_BY_36      0x24
+#define PMU1_PLL0_PC1_M4DIV_BY_60      0x3C
+#define PMU1_PLL0_PC1_M2_M4DIV_MASK     0xff00ff00
+#define PMU1_PLL0_PC1_HOLD_LOAD_CH      0x28
+
+#define DOT11MAC_880MHZ_CLK_DIVISOR_SHIFT 8
+#define DOT11MAC_880MHZ_CLK_DIVISOR_MASK (0xFF << DOT11MAC_880MHZ_CLK_DIVISOR_SHIFT)
+#define DOT11MAC_880MHZ_CLK_DIVISOR_VAL  (0xE << DOT11MAC_880MHZ_CLK_DIVISOR_SHIFT)
+
+/* m<x>div, ndiv_dither_mfb, ndiv_mode, ndiv_int */
+#define PMU1_PLL0_PLLCTL2              2
+#define PMU1_PLL0_PC2_M5DIV_MASK       0x000000ff
+#define PMU1_PLL0_PC2_M5DIV_SHIFT      0
+#define PMU1_PLL0_PC2_M5DIV_BY_12      0xc
+#define PMU1_PLL0_PC2_M5DIV_BY_18      0x12
+#define PMU1_PLL0_PC2_M5DIV_BY_31      0x1f
+#define PMU1_PLL0_PC2_M5DIV_BY_36      0x24
+#define PMU1_PLL0_PC2_M5DIV_BY_42      0x2a
+#define PMU1_PLL0_PC2_M5DIV_BY_60      0x3c
+#define PMU1_PLL0_PC2_M6DIV_MASK       0x0000ff00
+#define PMU1_PLL0_PC2_M6DIV_SHIFT      8
+#define PMU1_PLL0_PC2_M6DIV_BY_18      0x12
+#define PMU1_PLL0_PC2_M6DIV_BY_36      0x24
+#define PMU1_PLL0_PC2_NDIV_MODE_MASK   0x000e0000
+#define PMU1_PLL0_PC2_NDIV_MODE_SHIFT  17
+#define PMU1_PLL0_PC2_NDIV_MODE_MASH   1
+#define PMU1_PLL0_PC2_NDIV_MODE_MFB    2
+#define PMU1_PLL0_PC2_NDIV_INT_MASK    0x1ff00000
+#define PMU1_PLL0_PC2_NDIV_INT_SHIFT   20
+
+/* ndiv_frac */
+#define PMU1_PLL0_PLLCTL3              3
+#define PMU1_PLL0_PC3_NDIV_FRAC_MASK   0x00ffffff
+#define PMU1_PLL0_PC3_NDIV_FRAC_SHIFT  0
+
+/* pll_ctrl */
+#define PMU1_PLL0_PLLCTL4              4
+
+/* pll_ctrl, vco_rng, clkdrive_ch<x> */
+#define PMU1_PLL0_PLLCTL5              5
+#define PMU1_PLL0_PC5_CLK_DRV_MASK     0xffffff00
+#define PMU1_PLL0_PC5_CLK_DRV_SHIFT    8
+#define PMU1_PLL0_PC5_ASSERT_CH_MASK   0x3f000000
+#define PMU1_PLL0_PC5_ASSERT_CH_SHIFT  24
+#define PMU1_PLL0_PC5_DEASSERT_CH_MASK 0xff000000
+
+#define PMU1_PLL0_PLLCTL6              6
+#define PMU1_PLL0_PLLCTL7              7
+#define PMU1_PLL0_PLLCTL8              8
+
+#define PMU1_PLLCTL8_OPENLOOP_MASK     (1 << 1)
+
+#define PMU1_PLL0_PLLCTL9              9
+
+#define PMU1_PLL0_PLLCTL10             10
+
+/* PMU rev 2 control words */
+#define PMU2_PHY_PLL_PLLCTL            4
+#define PMU2_SI_PLL_PLLCTL             10
+
+/* PMU rev 2 */
+/* pllcontrol registers */
+/* ndiv_pwrdn, pwrdn_ch<x>, refcomp_pwrdn, dly_ch<x>, p1div, p2div, _bypass_sdmod */
+#define PMU2_PLL_PLLCTL0               0
+#define PMU2_PLL_PC0_P1DIV_MASK                0x00f00000
+#define PMU2_PLL_PC0_P1DIV_SHIFT       20
+#define PMU2_PLL_PC0_P2DIV_MASK                0x0f000000
+#define PMU2_PLL_PC0_P2DIV_SHIFT       24
+
+/* m<x>div */
+#define PMU2_PLL_PLLCTL1               1
+#define PMU2_PLL_PC1_M1DIV_MASK                0x000000ff
+#define PMU2_PLL_PC1_M1DIV_SHIFT       0
+#define PMU2_PLL_PC1_M2DIV_MASK                0x0000ff00
+#define PMU2_PLL_PC1_M2DIV_SHIFT       8
+#define PMU2_PLL_PC1_M3DIV_MASK                0x00ff0000
+#define PMU2_PLL_PC1_M3DIV_SHIFT       16
+#define PMU2_PLL_PC1_M4DIV_MASK                0xff000000
+#define PMU2_PLL_PC1_M4DIV_SHIFT       24
+
+/* m<x>div, ndiv_dither_mfb, ndiv_mode, ndiv_int */
+#define PMU2_PLL_PLLCTL2               2
+#define PMU2_PLL_PC2_M5DIV_MASK                0x000000ff
+#define PMU2_PLL_PC2_M5DIV_SHIFT       0
+#define PMU2_PLL_PC2_M6DIV_MASK                0x0000ff00
+#define PMU2_PLL_PC2_M6DIV_SHIFT       8
+#define PMU2_PLL_PC2_NDIV_MODE_MASK    0x000e0000
+#define PMU2_PLL_PC2_NDIV_MODE_SHIFT   17
+#define PMU2_PLL_PC2_NDIV_INT_MASK     0x1ff00000
+#define PMU2_PLL_PC2_NDIV_INT_SHIFT    20
+
+/* ndiv_frac */
+#define PMU2_PLL_PLLCTL3               3
+#define PMU2_PLL_PC3_NDIV_FRAC_MASK    0x00ffffff
+#define PMU2_PLL_PC3_NDIV_FRAC_SHIFT   0
+
+/* pll_ctrl */
+#define PMU2_PLL_PLLCTL4               4
+
+/* pll_ctrl, vco_rng, clkdrive_ch<x> */
+#define PMU2_PLL_PLLCTL5               5
+#define PMU2_PLL_PC5_CLKDRIVE_CH1_MASK 0x00000f00
+#define PMU2_PLL_PC5_CLKDRIVE_CH1_SHIFT        8
+#define PMU2_PLL_PC5_CLKDRIVE_CH2_MASK 0x0000f000
+#define PMU2_PLL_PC5_CLKDRIVE_CH2_SHIFT        12
+#define PMU2_PLL_PC5_CLKDRIVE_CH3_MASK 0x000f0000
+#define PMU2_PLL_PC5_CLKDRIVE_CH3_SHIFT        16
+#define PMU2_PLL_PC5_CLKDRIVE_CH4_MASK 0x00f00000
+#define PMU2_PLL_PC5_CLKDRIVE_CH4_SHIFT        20
+#define PMU2_PLL_PC5_CLKDRIVE_CH5_MASK 0x0f000000
+#define PMU2_PLL_PC5_CLKDRIVE_CH5_SHIFT        24
+#define PMU2_PLL_PC5_CLKDRIVE_CH6_MASK 0xf0000000
+#define PMU2_PLL_PC5_CLKDRIVE_CH6_SHIFT        28
+
+/* PMU rev 5 (& 6) */
+#define        PMU5_PLL_P1P2_OFF               0
+#define        PMU5_PLL_P1_MASK                0x0f000000
+#define        PMU5_PLL_P1_SHIFT               24
+#define        PMU5_PLL_P2_MASK                0x00f00000
+#define        PMU5_PLL_P2_SHIFT               20
+#define        PMU5_PLL_M14_OFF                1
+#define        PMU5_PLL_MDIV_MASK              0x000000ff
+#define        PMU5_PLL_MDIV_WIDTH             8
+#define        PMU5_PLL_NM5_OFF                2
+#define        PMU5_PLL_NDIV_MASK              0xfff00000
+#define        PMU5_PLL_NDIV_SHIFT             20
+#define        PMU5_PLL_NDIV_MODE_MASK         0x000e0000
+#define        PMU5_PLL_NDIV_MODE_SHIFT        17
+#define        PMU5_PLL_FMAB_OFF               3
+#define        PMU5_PLL_MRAT_MASK              0xf0000000
+#define        PMU5_PLL_MRAT_SHIFT             28
+#define        PMU5_PLL_ABRAT_MASK             0x08000000
+#define        PMU5_PLL_ABRAT_SHIFT            27
+#define        PMU5_PLL_FDIV_MASK              0x07ffffff
+#define        PMU5_PLL_PLLCTL_OFF             4
+#define        PMU5_PLL_PCHI_OFF               5
+#define        PMU5_PLL_PCHI_MASK              0x0000003f
+
+/* pmu XtalFreqRatio */
+#define        PMU_XTALFREQ_REG_ILPCTR_MASK    0x00001FFF
+#define        PMU_XTALFREQ_REG_MEASURE_MASK   0x80000000
+#define        PMU_XTALFREQ_REG_MEASURE_SHIFT  31
+
+/* Divider allocation in 5357 */
+#define        PMU5_MAINPLL_CPU                1
+#define        PMU5_MAINPLL_MEM                2
+#define        PMU5_MAINPLL_SI                 3
+
+#define PMU7_PLL_PLLCTL7                7
+#define PMU7_PLL_CTL7_M4DIV_MASK       0xff000000
+#define PMU7_PLL_CTL7_M4DIV_SHIFT      24
+#define PMU7_PLL_CTL7_M4DIV_BY_6       6
+#define PMU7_PLL_CTL7_M4DIV_BY_12      0xc
+#define PMU7_PLL_CTL7_M4DIV_BY_24      0x18
+#define PMU7_PLL_PLLCTL8                8
+#define PMU7_PLL_CTL8_M5DIV_MASK       0x000000ff
+#define PMU7_PLL_CTL8_M5DIV_SHIFT      0
+#define PMU7_PLL_CTL8_M5DIV_BY_8       8
+#define PMU7_PLL_CTL8_M5DIV_BY_12      0xc
+#define PMU7_PLL_CTL8_M5DIV_BY_24      0x18
+#define PMU7_PLL_CTL8_M6DIV_MASK       0x0000ff00
+#define PMU7_PLL_CTL8_M6DIV_SHIFT      8
+#define PMU7_PLL_CTL8_M6DIV_BY_12      0xc
+#define PMU7_PLL_CTL8_M6DIV_BY_24      0x18
+#define PMU7_PLL_PLLCTL11              11
+#define PMU7_PLL_PLLCTL11_MASK         0xffffff00
+#define PMU7_PLL_PLLCTL11_VAL          0x22222200
+
+/* PMU rev 15 */
+#define PMU15_PLL_PLLCTL0              0
+#define PMU15_PLL_PC0_CLKSEL_MASK      0x00000003
+#define PMU15_PLL_PC0_CLKSEL_SHIFT     0
+#define PMU15_PLL_PC0_FREQTGT_MASK     0x003FFFFC
+#define PMU15_PLL_PC0_FREQTGT_SHIFT    2
+#define PMU15_PLL_PC0_PRESCALE_MASK    0x00C00000
+#define PMU15_PLL_PC0_PRESCALE_SHIFT   22
+#define PMU15_PLL_PC0_KPCTRL_MASK      0x07000000
+#define PMU15_PLL_PC0_KPCTRL_SHIFT     24
+#define PMU15_PLL_PC0_FCNTCTRL_MASK    0x38000000
+#define PMU15_PLL_PC0_FCNTCTRL_SHIFT   27
+#define PMU15_PLL_PC0_FDCMODE_MASK     0x40000000
+#define PMU15_PLL_PC0_FDCMODE_SHIFT    30
+#define PMU15_PLL_PC0_CTRLBIAS_MASK    0x80000000
+#define PMU15_PLL_PC0_CTRLBIAS_SHIFT   31
+
+#define PMU15_PLL_PLLCTL1                      1
+#define PMU15_PLL_PC1_BIAS_CTLM_MASK           0x00000060
+#define PMU15_PLL_PC1_BIAS_CTLM_SHIFT          5
+#define PMU15_PLL_PC1_BIAS_CTLM_RST_MASK       0x00000040
+#define PMU15_PLL_PC1_BIAS_CTLM_RST_SHIFT      6
+#define PMU15_PLL_PC1_BIAS_SS_DIVR_MASK                0x0001FF80
+#define PMU15_PLL_PC1_BIAS_SS_DIVR_SHIFT       7
+#define PMU15_PLL_PC1_BIAS_SS_RSTVAL_MASK      0x03FE0000
+#define PMU15_PLL_PC1_BIAS_SS_RSTVAL_SHIFT     17
+#define PMU15_PLL_PC1_BIAS_INTG_BW_MASK                0x0C000000
+#define PMU15_PLL_PC1_BIAS_INTG_BW_SHIFT       26
+#define PMU15_PLL_PC1_BIAS_INTG_BYP_MASK       0x10000000
+#define PMU15_PLL_PC1_BIAS_INTG_BYP_SHIFT      28
+#define PMU15_PLL_PC1_OPENLP_EN_MASK           0x40000000
+#define PMU15_PLL_PC1_OPENLP_EN_SHIFT          30
+
+#define PMU15_PLL_PLLCTL2                      2
+#define PMU15_PLL_PC2_CTEN_MASK                        0x00000001
+#define PMU15_PLL_PC2_CTEN_SHIFT               0
+
+#define PMU15_PLL_PLLCTL3                      3
+#define PMU15_PLL_PC3_DITHER_EN_MASK           0x00000001
+#define PMU15_PLL_PC3_DITHER_EN_SHIFT          0
+#define PMU15_PLL_PC3_DCOCTLSP_MASK            0xFE000000
+#define PMU15_PLL_PC3_DCOCTLSP_SHIFT           25
+#define PMU15_PLL_PC3_DCOCTLSP_DIV2EN_MASK     0x01
+#define PMU15_PLL_PC3_DCOCTLSP_DIV2EN_SHIFT    0
+#define PMU15_PLL_PC3_DCOCTLSP_CH0EN_MASK      0x02
+#define PMU15_PLL_PC3_DCOCTLSP_CH0EN_SHIFT     1
+#define PMU15_PLL_PC3_DCOCTLSP_CH1EN_MASK      0x04
+#define PMU15_PLL_PC3_DCOCTLSP_CH1EN_SHIFT     2
+#define PMU15_PLL_PC3_DCOCTLSP_CH0SEL_MASK     0x18
+#define PMU15_PLL_PC3_DCOCTLSP_CH0SEL_SHIFT    3
+#define PMU15_PLL_PC3_DCOCTLSP_CH1SEL_MASK     0x60
+#define PMU15_PLL_PC3_DCOCTLSP_CH1SEL_SHIFT    5
+#define PMU15_PLL_PC3_DCOCTLSP_CHSEL_OUTP_DIV1 0
+#define PMU15_PLL_PC3_DCOCTLSP_CHSEL_OUTP_DIV2 1
+#define PMU15_PLL_PC3_DCOCTLSP_CHSEL_OUTP_DIV3 2
+#define PMU15_PLL_PC3_DCOCTLSP_CHSEL_OUTP_DIV5 3
+
+#define PMU15_PLL_PLLCTL4                      4
+#define PMU15_PLL_PC4_FLLCLK1_DIV_MASK         0x00000007
+#define PMU15_PLL_PC4_FLLCLK1_DIV_SHIFT                0
+#define PMU15_PLL_PC4_FLLCLK2_DIV_MASK         0x00000038
+#define PMU15_PLL_PC4_FLLCLK2_DIV_SHIFT                3
+#define PMU15_PLL_PC4_FLLCLK3_DIV_MASK         0x000001C0
+#define PMU15_PLL_PC4_FLLCLK3_DIV_SHIFT                6
+#define PMU15_PLL_PC4_DBGMODE_MASK             0x00000E00
+#define PMU15_PLL_PC4_DBGMODE_SHIFT            9
+#define PMU15_PLL_PC4_FLL480_CTLSP_LK_MASK     0x00001000
+#define PMU15_PLL_PC4_FLL480_CTLSP_LK_SHIFT    12
+#define PMU15_PLL_PC4_FLL480_CTLSP_MASK                0x000FE000
+#define PMU15_PLL_PC4_FLL480_CTLSP_SHIFT       13
+#define PMU15_PLL_PC4_DINPOL_MASK              0x00100000
+#define PMU15_PLL_PC4_DINPOL_SHIFT             20
+#define PMU15_PLL_PC4_CLKOUT_PD_MASK           0x00200000
+#define PMU15_PLL_PC4_CLKOUT_PD_SHIFT          21
+#define PMU15_PLL_PC4_CLKDIV2_PD_MASK          0x00400000
+#define PMU15_PLL_PC4_CLKDIV2_PD_SHIFT         22
+#define PMU15_PLL_PC4_CLKDIV4_PD_MASK          0x00800000
+#define PMU15_PLL_PC4_CLKDIV4_PD_SHIFT         23
+#define PMU15_PLL_PC4_CLKDIV8_PD_MASK          0x01000000
+#define PMU15_PLL_PC4_CLKDIV8_PD_SHIFT         24
+#define PMU15_PLL_PC4_CLKDIV16_PD_MASK         0x02000000
+#define PMU15_PLL_PC4_CLKDIV16_PD_SHIFT                25
+#define PMU15_PLL_PC4_TEST_EN_MASK             0x04000000
+#define PMU15_PLL_PC4_TEST_EN_SHIFT            26
+
+#define PMU15_PLL_PLLCTL5                      5
+#define PMU15_PLL_PC5_FREQTGT_MASK             0x000FFFFF
+#define PMU15_PLL_PC5_FREQTGT_SHIFT            0
+#define PMU15_PLL_PC5_DCOCTLSP_MASK            0x07F00000
+#define PMU15_PLL_PC5_DCOCTLSP_SHIFT           20
+#define PMU15_PLL_PC5_PRESCALE_MASK            0x18000000
+#define PMU15_PLL_PC5_PRESCALE_SHIFT           27
+
+#define PMU15_PLL_PLLCTL6              6
+#define PMU15_PLL_PC6_FREQTGT_MASK     0x000FFFFF
+#define PMU15_PLL_PC6_FREQTGT_SHIFT    0
+#define PMU15_PLL_PC6_DCOCTLSP_MASK    0x07F00000
+#define PMU15_PLL_PC6_DCOCTLSP_SHIFT   20
+#define PMU15_PLL_PC6_PRESCALE_MASK    0x18000000
+#define PMU15_PLL_PC6_PRESCALE_SHIFT   27
+
+#define PMU15_FREQTGT_480_DEFAULT      0x19AB1
+#define PMU15_FREQTGT_492_DEFAULT      0x1A4F5
+#define PMU15_ARM_96MHZ                        96000000        /**< 96 Mhz */
+#define PMU15_ARM_98MHZ                        98400000        /**< 98.4 Mhz */
+#define PMU15_ARM_97MHZ                        97000000        /**< 97 Mhz */
+
+#define PMU17_PLLCTL2_NDIVTYPE_MASK            0x00000070
+#define PMU17_PLLCTL2_NDIVTYPE_SHIFT           4
+
+#define PMU17_PLLCTL2_NDIV_MODE_INT            0
+#define PMU17_PLLCTL2_NDIV_MODE_INT1B8         1
+#define PMU17_PLLCTL2_NDIV_MODE_MASH111                2
+#define PMU17_PLLCTL2_NDIV_MODE_MASH111B8      3
+
+#define PMU17_PLLCTL0_BBPLL_PWRDWN             0
+#define PMU17_PLLCTL0_BBPLL_DRST               3
+#define PMU17_PLLCTL0_BBPLL_DISBL_CLK          8
+
+/* PLL usage in 4716/47162 */
+#define        PMU4716_MAINPLL_PLL0            12
+
+/* PLL Usages for 4368 */
+#define PMU4368_P1DIV_LO_SHIFT                 0
+#define PMU4368_P1DIV_HI_SHIFT                 2
+
+#define PMU4368_PLL1_PC4_P1DIV_MASK            0xC0000000
+#define PMU4368_PLL1_PC4_P1DIV_SHIFT           30
+#define PMU4368_PLL1_PC5_P1DIV_MASK            0x00000003
+#define PMU4368_PLL1_PC5_P1DIV_SHIFT           0
+#define PMU4368_PLL1_PC5_NDIV_INT_MASK         0x00000ffc
+#define PMU4368_PLL1_PC5_NDIV_INT_SHIFT                2
+#define PMU4368_PLL1_PC5_NDIV_FRAC_MASK                0xfffff000
+#define PMU4368_PLL1_PC5_NDIV_FRAC_SHIFT       12
+#define PMU4368_PLL1_PC7_CH0_MDIV_MASK         0x0000000f
+#define PMU4368_PLL1_PC7_CH0_MDIV_SHIFT                0
+#define PMU4368_PLL1_PC7_CH1_MDIV_MASK         0x000000f0
+#define PMU4368_PLL1_PC7_CH1_MDIV_SHIFT                4
+
+/* PLL usage in 4369 */
+#define PMU4369_PLL0_PC2_PDIV_MASK             0x000f0000
+#define PMU4369_PLL0_PC2_PDIV_SHIFT            16
+#define PMU4369_PLL0_PC2_NDIV_INT_MASK         0x3ff00000
+#define PMU4369_PLL0_PC2_NDIV_INT_SHIFT                20
+#define PMU4369_PLL0_PC3_NDIV_FRAC_MASK                0x000fffff
+#define PMU4369_PLL0_PC3_NDIV_FRAC_SHIFT       0
+#define PMU4369_PLL1_PC5_P1DIV_MASK            0xc0000000
+#define PMU4369_PLL1_PC5_P1DIV_SHIFT           30
+#define PMU4369_PLL1_PC6_P1DIV_MASK            0x00000003
+#define PMU4369_PLL1_PC6_P1DIV_SHIFT           0
+#define PMU4369_PLL1_PC6_NDIV_INT_MASK         0x00000ffc
+#define PMU4369_PLL1_PC6_NDIV_INT_SHIFT                2
+#define PMU4369_PLL1_PC6_NDIV_FRAC_MASK                0xfffff000
+#define PMU4369_PLL1_PC6_NDIV_FRAC_SHIFT       12
+
+#define PMU4369_P1DIV_LO_SHIFT         0
+#define PMU4369_P1DIV_HI_SHIFT         2
+
+#define PMU4369_PLL6VAL_P1DIV                  4
+#define PMU4369_PLL6VAL_P1DIV_BIT3_2           1
+#define PMU4369_PLL6VAL_PRE_SCALE              (1 << 17)
+#define PMU4369_PLL6VAL_POST_SCALE             (1 << 3)
+
+/* PLL usage in 4378
+* Temporay setting, update is needed.
+*/
+#define PMU4378_PLL0_PC2_P1DIV_MASK            0x000f0000
+#define PMU4378_PLL0_PC2_P1DIV_SHIFT           16
+#define PMU4378_PLL0_PC2_NDIV_INT_MASK         0x3ff00000
+#define PMU4378_PLL0_PC2_NDIV_INT_SHIFT                20
+
+/* PLL usage in 4387 */
+#define PMU4387_PLL0_PC1_ICH2_MDIV_SHIFT       18
+#define PMU4387_PLL0_PC1_ICH2_MDIV_MASK                0x07FC0000
+#define PMU4387_PLL0_PC2_ICH3_MDIV_MASK                0x000001ff
+
+/* PLL usage in 4389 */
+#define PMU4389_APLL_NDIV_P                    0x154u
+#define PMU4389_APLL_NDIV_Q                    0x1ffu
+#define PMU4389_APLL_PDIV                      0x3u
+#define PMU4389_ARMPLL_I_NDIV_INT_MASK         0x01ff8000u
+#define PMU4389_ARMPLL_I_NDIV_INT_SHIFT                15u
+
+/* 5357 Chip specific ChipControl register bits */
+#define CCTRL5357_EXTPA                 (1<<14) /* extPA in ChipControl 1, bit 14 */
+#define CCTRL5357_ANT_MUX_2o3          (1<<15) /* 2o3 in ChipControl 1, bit 15 */
+#define CCTRL5357_NFLASH               (1<<16) /* Nandflash in ChipControl 1, bit 16 */
+/* 43217 Chip specific ChipControl register bits */
+#define CCTRL43217_EXTPA_C0             (1<<13) /* core0 extPA in ChipControl 1, bit 13 */
+#define CCTRL43217_EXTPA_C1             (1<<8)  /* core1 extPA in ChipControl 1, bit 8 */
+
+#define PMU1_PLL0_CHIPCTL0             0
+#define PMU1_PLL0_CHIPCTL1             1
+#define PMU1_PLL0_CHIPCTL2             2
+
+#define SOCDEVRAM_BP_ADDR              0x1E000000
+#define SOCDEVRAM_ARM_ADDR             0x00800000
+
+#define PMU_VREG0_I_SR_CNTL_EN_SHIFT           0
+#define PMU_VREG0_DISABLE_PULLD_BT_SHIFT       2
+#define PMU_VREG0_DISABLE_PULLD_WL_SHIFT       3
+#define PMU_VREG0_CBUCKFSW_ADJ_SHIFT           7
+#define PMU_VREG0_CBUCKFSW_ADJ_MASK                    0x1F
+#define PMU_VREG0_RAMP_SEL_SHIFT                       13
+#define PMU_VREG0_RAMP_SEL_MASK                                0x7
+#define PMU_VREG0_VFB_RSEL_SHIFT                       17
+#define PMU_VREG0_VFB_RSEL_MASK                                3
+
+#define PMU_VREG4_ADDR                 4
+
+#define PMU_VREG4_CLDO_PWM_SHIFT       4
+#define PMU_VREG4_CLDO_PWM_MASK                0x7
+
+#define PMU_VREG4_LPLDO1_SHIFT         15
+#define PMU_VREG4_LPLDO1_MASK          0x7
+#define PMU_VREG4_LPLDO1_1p20V         0
+#define PMU_VREG4_LPLDO1_1p15V         1
+#define PMU_VREG4_LPLDO1_1p10V         2
+#define PMU_VREG4_LPLDO1_1p25V         3
+#define PMU_VREG4_LPLDO1_1p05V         4
+#define PMU_VREG4_LPLDO1_1p00V         5
+#define PMU_VREG4_LPLDO1_0p95V         6
+#define PMU_VREG4_LPLDO1_0p90V         7
+
+#define PMU_VREG4_LPLDO2_LVM_SHIFT     18
+#define PMU_VREG4_LPLDO2_LVM_MASK      0x7
+#define PMU_VREG4_LPLDO2_HVM_SHIFT     21
+#define PMU_VREG4_LPLDO2_HVM_MASK      0x7
+#define PMU_VREG4_LPLDO2_LVM_HVM_MASK  0x3f
+#define PMU_VREG4_LPLDO2_1p00V         0
+#define PMU_VREG4_LPLDO2_1p15V         1
+#define PMU_VREG4_LPLDO2_1p20V         2
+#define PMU_VREG4_LPLDO2_1p10V         3
+#define PMU_VREG4_LPLDO2_0p90V         4       /**< 4 - 7 is 0.90V */
+
+#define PMU_VREG4_HSICLDO_BYPASS_SHIFT 27
+#define PMU_VREG4_HSICLDO_BYPASS_MASK  0x1
+
+#define PMU_VREG5_ADDR                 5
+#define PMU_VREG5_HSICAVDD_PD_SHIFT    6
+#define PMU_VREG5_HSICAVDD_PD_MASK     0x1
+#define PMU_VREG5_HSICDVDD_PD_SHIFT    11
+#define PMU_VREG5_HSICDVDD_PD_MASK     0x1
+
+/* 43228 chipstatus  reg bits */
+#define        CST43228_OTP_PRESENT            0x2
+
+/* 4360 Chip specific ChipControl register bits */
+/* 43602 uses these ChipControl definitions as well */
+#define CCTRL4360_I2C_MODE                     (1 << 0)
+#define CCTRL4360_UART_MODE                    (1 << 1)
+#define CCTRL4360_SECI_MODE                    (1 << 2)
+#define CCTRL4360_BTSWCTRL_MODE                        (1 << 3)
+#define CCTRL4360_DISCRETE_FEMCTRL_MODE                (1 << 4)
+#define CCTRL4360_DIGITAL_PACTRL_MODE          (1 << 5)
+#define CCTRL4360_BTSWCTRL_AND_DIGPA_PRESENT   (1 << 6)
+#define CCTRL4360_EXTRA_GPIO_MODE              (1 << 7)
+#define CCTRL4360_EXTRA_FEMCTRL_MODE           (1 << 8)
+#define CCTRL4360_BT_LGCY_MODE                 (1 << 9)
+#define CCTRL4360_CORE2FEMCTRL4_ON             (1 << 21)
+#define CCTRL4360_SECI_ON_GPIO01               (1 << 24)
+
+/* 4360 Chip specific Regulator Control register bits */
+#define RCTRL4360_RFLDO_PWR_DOWN               (1 << 1)
+
+/* 4360 PMU resources and chip status bits */
+#define RES4360_REGULATOR          0
+#define RES4360_ILP_AVAIL          1
+#define RES4360_ILP_REQ            2
+#define RES4360_XTAL_LDO_PU        3
+#define RES4360_XTAL_PU            4
+#define RES4360_ALP_AVAIL          5
+#define RES4360_BBPLLPWRSW_PU      6
+#define RES4360_HT_AVAIL           7
+#define RES4360_OTP_PU             8
+#define RES4360_AVB_PLL_PWRSW_PU   9
+#define RES4360_PCIE_TL_CLK_AVAIL  10
+
+#define CST4360_XTAL_40MZ                  0x00000001
+#define CST4360_SFLASH                     0x00000002
+#define CST4360_SPROM_PRESENT              0x00000004
+#define CST4360_SFLASH_TYPE                0x00000004
+#define CST4360_OTP_ENABLED                0x00000008
+#define CST4360_REMAP_ROM                  0x00000010
+#define CST4360_RSRC_INIT_MODE_MASK        0x00000060
+#define CST4360_RSRC_INIT_MODE_SHIFT       5
+#define CST4360_ILP_DIVEN                  0x00000080
+#define CST4360_MODE_USB                   0x00000100
+#define CST4360_SPROM_SIZE_MASK            0x00000600
+#define CST4360_SPROM_SIZE_SHIFT           9
+#define CST4360_BBPLL_LOCK                 0x00000800
+#define CST4360_AVBBPLL_LOCK               0x00001000
+#define CST4360_USBBBPLL_LOCK              0x00002000
+#define CST4360_RSRC_INIT_MODE(cs)     ((cs & CST4360_RSRC_INIT_MODE_MASK) >> \
+                                               CST4360_RSRC_INIT_MODE_SHIFT)
+
+#define CCTRL_4360_UART_SEL            0x2
+
+#define CST4360_RSRC_INIT_MODE(cs)     ((cs & CST4360_RSRC_INIT_MODE_MASK) >> \
+                                               CST4360_RSRC_INIT_MODE_SHIFT)
+
+#define PMU4360_CC1_GPIO7_OVRD          (1<<23) /* GPIO7 override */
+
+/* 43602 PMU resources based on pmu_params.xls version v0.95 */
+#define RES43602_LPLDO_PU              0
+#define RES43602_REGULATOR             1
+#define RES43602_PMU_SLEEP             2
+#define RES43602_RSVD_3                        3
+#define RES43602_XTALLDO_PU            4
+#define RES43602_SERDES_PU             5
+#define RES43602_BBPLL_PWRSW_PU                6
+#define RES43602_SR_CLK_START          7
+#define RES43602_SR_PHY_PWRSW          8
+#define RES43602_SR_SUBCORE_PWRSW      9
+#define RES43602_XTAL_PU               10
+#define        RES43602_PERST_OVR              11
+#define RES43602_SR_CLK_STABLE         12
+#define RES43602_SR_SAVE_RESTORE       13
+#define RES43602_SR_SLEEP              14
+#define RES43602_LQ_START              15
+#define RES43602_LQ_AVAIL              16
+#define RES43602_WL_CORE_RDY           17
+#define RES43602_ILP_REQ               18
+#define RES43602_ALP_AVAIL             19
+#define RES43602_RADIO_PU              20
+#define RES43602_RFLDO_PU              21
+#define RES43602_HT_START              22
+#define RES43602_HT_AVAIL              23
+#define RES43602_MACPHY_CLKAVAIL       24
+#define RES43602_PARLDO_PU             25
+#define RES43602_RSVD_26               26
+
+/* 43602 chip status bits */
+#define CST43602_SPROM_PRESENT             (1<<1)
+#define CST43602_SPROM_SIZE                (1<<10) /* 0 = 16K, 1 = 4K */
+#define CST43602_BBPLL_LOCK                (1<<11)
+#define CST43602_RF_LDO_OUT_OK             (1<<15) /* RF LDO output OK */
+
+#define PMU43602_CC1_GPIO12_OVRD           (1<<28) /* GPIO12 override */
+
+#define PMU43602_CC2_PCIE_CLKREQ_L_WAKE_EN (1<<1)  /* creates gated_pcie_wake, pmu_wakeup logic */
+#define PMU43602_CC2_PCIE_PERST_L_WAKE_EN  (1<<2)  /* creates gated_pcie_wake, pmu_wakeup logic */
+#define PMU43602_CC2_ENABLE_L2REFCLKPAD_PWRDWN (1<<3)
+#define PMU43602_CC2_PMU_WAKE_ALP_AVAIL_EN (1<<5)  /* enable pmu_wakeup to request for ALP_AVAIL */
+#define PMU43602_CC2_PERST_L_EXTEND_EN     (1<<9)  /* extend perst_l until rsc PERST_OVR comes up */
+#define PMU43602_CC2_FORCE_EXT_LPO         (1<<19) /* 1=ext LPO clock is the final LPO clock */
+#define PMU43602_CC2_XTAL32_SEL            (1<<30) /* 0=ext_clock, 1=xtal */
+
+#define CC_SR1_43602_SR_ASM_ADDR       (0x0)
+
+/* PLL CTL register values for open loop, used during S/R operation */
+#define PMU43602_PLL_CTL6_VAL          0x68000528
+#define PMU43602_PLL_CTL7_VAL          0x6
+
+#define PMU43602_CC3_ARMCR4_DBG_CLK    (1 << 29)
+
+#define CC_SR0_43602_SR_ENG_EN_MASK            0x1
+#define CC_SR0_43602_SR_ENG_EN_SHIFT             0
+
+/* GCI function sel values */
+#define CC_FNSEL_HWDEF         (0u)
+#define CC_FNSEL_SAMEASPIN     (1u)
+#define CC_FNSEL_GPIO0         (2u)
+#define CC_FNSEL_GPIO1         (3u)
+#define CC_FNSEL_GCI0          (4u)
+#define CC_FNSEL_GCI1          (5u)
+#define CC_FNSEL_UART          (6u)
+#define CC_FNSEL_SFLASH                (7u)
+#define CC_FNSEL_SPROM         (8u)
+#define CC_FNSEL_MISC0         (9u)
+#define CC_FNSEL_MISC1         (10u)
+#define CC_FNSEL_MISC2         (11u)
+#define CC_FNSEL_IND           (12u)
+#define CC_FNSEL_PDN           (13u)
+#define CC_FNSEL_PUP           (14u)
+#define CC_FNSEL_TRI           (15u)
+
+/* 4387 GCI function sel values */
+#define CC4387_FNSEL_FUART             (3u)
+#define CC4387_FNSEL_DBG_UART          (6u)
+#define CC4387_FNSEL_SPI               (7u)
+
+/* Indices of PMU voltage regulator registers */
+#define PMU_VREG_0     (0u)
+#define PMU_VREG_1     (1u)
+#define PMU_VREG_2     (2u)
+#define PMU_VREG_3     (3u)
+#define PMU_VREG_4     (4u)
+#define PMU_VREG_5     (5u)
+#define PMU_VREG_6     (6u)
+#define PMU_VREG_7     (7u)
+#define PMU_VREG_8     (8u)
+#define PMU_VREG_9     (9u)
+#define PMU_VREG_10    (10u)
+#define PMU_VREG_11    (11u)
+#define PMU_VREG_12    (12u)
+#define PMU_VREG_13    (13u)
+#define PMU_VREG_14    (14u)
+#define PMU_VREG_15    (15u)
+#define PMU_VREG_16    (16u)
+
+/* 43012 Chipcommon ChipStatus bits */
+#define CST43012_FLL_LOCK      (1 << 13)
+/* 43012 resources - End */
+
+/* 43012 related Cbuck modes */
+#define PMU_43012_VREG8_DYNAMIC_CBUCK_MODE0 0x00001c03
+#define PMU_43012_VREG9_DYNAMIC_CBUCK_MODE0 0x00492490
+#define PMU_43012_VREG8_DYNAMIC_CBUCK_MODE1 0x00001c03
+#define PMU_43012_VREG9_DYNAMIC_CBUCK_MODE1 0x00490410
+
+/* 43012 related dynamic cbuck mode mask */
+#define PMU_43012_VREG8_DYNAMIC_CBUCK_MODE_MASK  0xFFFFFC07
+#define PMU_43012_VREG9_DYNAMIC_CBUCK_MODE_MASK  0xFFFFFFFF
+
+/* 4369 related VREG masks */
+#define PMU_4369_VREG_5_MISCLDO_POWER_UP_MASK          (1u << 11u)
+#define PMU_4369_VREG_5_MISCLDO_POWER_UP_SHIFT         11u
+#define PMU_4369_VREG_5_LPLDO_POWER_UP_MASK            (1u << 27u)
+#define PMU_4369_VREG_5_LPLDO_POWER_UP_SHIFT           27u
+#define PMU_4369_VREG_5_LPLDO_OP_VLT_ADJ_CTRL_MASK     BCM_MASK32(23u, 20u)
+#define PMU_4369_VREG_5_LPLDO_OP_VLT_ADJ_CTRL_SHIFT    20u
+#define PMU_4369_VREG_5_MEMLPLDO_OP_VLT_ADJ_CTRL_MASK  BCM_MASK32(31, 28)
+#define PMU_4369_VREG_5_MEMLPLDO_OP_VLT_ADJ_CTRL_SHIFT 28u
+
+#define PMU_4369_VREG_6_MEMLPLDO_POWER_UP_MASK         (1u << 3u)
+#define PMU_4369_VREG_6_MEMLPLDO_POWER_UP_SHIFT                3u
+
+#define PMU_4369_VREG_7_PMU_FORCE_HP_MODE_MASK         (1u << 27u)
+#define PMU_4369_VREG_7_PMU_FORCE_HP_MODE_SHIFT                27u
+#define PMU_4369_VREG_7_WL_PMU_LP_MODE_MASK            (1u << 28u)
+#define PMU_4369_VREG_7_WL_PMU_LP_MODE_SHIFT           28u
+#define PMU_4369_VREG_7_WL_PMU_LV_MODE_MASK            (1u << 29u)
+#define PMU_4369_VREG_7_WL_PMU_LV_MODE_SHIFT           29u
+
+#define PMU_4369_VREG8_ASR_OVADJ_LPPFM_MASK            BCM_MASK32(4, 0)
+#define PMU_4369_VREG8_ASR_OVADJ_LPPFM_SHIFT           0u
+
+#define PMU_4369_VREG13_RSRC_EN0_ASR_MASK              BCM_MASK32(9, 9)
+#define PMU_4369_VREG13_RSRC_EN0_ASR_SHIFT             9u
+#define PMU_4369_VREG13_RSRC_EN1_ASR_MASK              BCM_MASK32(10, 10)
+#define PMU_4369_VREG13_RSRC_EN1_ASR_SHIFT             10u
+#define PMU_4369_VREG13_RSRC_EN2_ASR_MASK              BCM_MASK32(11, 11)
+#define PMU_4369_VREG13_RSRC_EN2_ASR_SHIFT             11u
+
+#define PMU_4369_VREG14_RSRC_EN_CSR_MASK0_MASK         (1u << 23u)
+#define PMU_4369_VREG14_RSRC_EN_CSR_MASK0_SHIFT                23u
+
+#define PMU_4369_VREG16_RSRC0_CBUCK_MODE_MASK          BCM_MASK32(2, 0)
+#define PMU_4369_VREG16_RSRC0_CBUCK_MODE_SHIFT         0u
+#define PMU_4369_VREG16_RSRC0_ABUCK_MODE_MASK          BCM_MASK32(17, 15)
+#define PMU_4369_VREG16_RSRC0_ABUCK_MODE_SHIFT         15u
+#define PMU_4369_VREG16_RSRC1_ABUCK_MODE_MASK          BCM_MASK32(20, 18)
+#define PMU_4369_VREG16_RSRC1_ABUCK_MODE_SHIFT         18u
+#define PMU_4369_VREG16_RSRC2_ABUCK_MODE_MASK          BCM_MASK32(23, 21)
+#define PMU_4369_VREG16_RSRC2_ABUCK_MODE_SHIFT         21u
+
+/* 4362 related VREG masks */
+#define PMU_4362_VREG_5_MISCLDO_POWER_UP_MASK          (1u << 11u)
+#define PMU_4362_VREG_5_MISCLDO_POWER_UP_SHIFT         (11u)
+#define PMU_4362_VREG_5_LPLDO_POWER_UP_MASK            (1u << 27u)
+#define PMU_4362_VREG_5_LPLDO_POWER_UP_SHIFT           (27u)
+#define PMU_4362_VREG_5_MEMLPLDO_OP_VLT_ADJ_CTRL_MASK  BCM_MASK32(31, 28)
+#define PMU_4362_VREG_5_MEMLPLDO_OP_VLT_ADJ_CTRL_SHIFT (28u)
+#define PMU_4362_VREG_6_MEMLPLDO_POWER_UP_MASK         (1u << 3u)
+#define PMU_4362_VREG_6_MEMLPLDO_POWER_UP_SHIFT                (3u)
+
+#define PMU_4362_VREG_7_PMU_FORCE_HP_MODE_MASK         (1u << 27u)
+#define PMU_4362_VREG_7_PMU_FORCE_HP_MODE_SHIFT                (27u)
+#define PMU_4362_VREG_7_WL_PMU_LP_MODE_MASK            (1u << 28u)
+#define PMU_4362_VREG_7_WL_PMU_LP_MODE_SHIFT           (28u)
+#define PMU_4362_VREG_7_WL_PMU_LV_MODE_MASK            (1u << 29u)
+#define PMU_4362_VREG_7_WL_PMU_LV_MODE_SHIFT           (29u)
+
+#define PMU_4362_VREG8_ASR_OVADJ_LPPFM_MASK            BCM_MASK32(4, 0)
+#define PMU_4362_VREG8_ASR_OVADJ_LPPFM_SHIFT           (0u)
+
+#define PMU_4362_VREG8_ASR_OVADJ_PFM_MASK              BCM_MASK32(9, 5)
+#define PMU_4362_VREG8_ASR_OVADJ_PFM_SHIFT             (5u)
+
+#define PMU_4362_VREG8_ASR_OVADJ_PWM_MASK              BCM_MASK32(14, 10)
+#define PMU_4362_VREG8_ASR_OVADJ_PWM_SHIFT             (10u)
+
+#define PMU_4362_VREG13_RSRC_EN0_ASR_MASK              BCM_MASK32(9, 9)
+#define PMU_4362_VREG13_RSRC_EN0_ASR_SHIFT             9u
+#define PMU_4362_VREG13_RSRC_EN1_ASR_MASK              BCM_MASK32(10, 10)
+#define PMU_4362_VREG13_RSRC_EN1_ASR_SHIFT             10u
+#define PMU_4362_VREG13_RSRC_EN2_ASR_MASK              BCM_MASK32(11, 11)
+#define PMU_4362_VREG13_RSRC_EN2_ASR_SHIFT             11u
+
+#define PMU_4362_VREG14_RSRC_EN_CSR_MASK0_MASK         (1u << 23u)
+#define PMU_4362_VREG14_RSRC_EN_CSR_MASK0_SHIFT                (23u)
+
+#define PMU_4362_VREG16_RSRC0_CBUCK_MODE_MASK          BCM_MASK32(2, 0)
+#define PMU_4362_VREG16_RSRC0_CBUCK_MODE_SHIFT         (0u)
+#define PMU_4362_VREG16_RSRC0_ABUCK_MODE_MASK          BCM_MASK32(17, 15)
+#define PMU_4362_VREG16_RSRC0_ABUCK_MODE_SHIFT         (15u)
+#define PMU_4362_VREG16_RSRC1_ABUCK_MODE_MASK          BCM_MASK32(20, 18)
+#define PMU_4362_VREG16_RSRC1_ABUCK_MODE_SHIFT         (18u)
+#define PMU_4362_VREG16_RSRC2_ABUCK_MODE_MASK          BCM_MASK32(23, 21)
+#define PMU_4362_VREG16_RSRC2_ABUCK_MODE_SHIFT         21u
+
+#define VREG0_4378_CSR_VOLT_ADJ_PWM_MASK               0x00001F00u
+#define VREG0_4378_CSR_VOLT_ADJ_PWM_SHIFT              8u
+#define VREG0_4378_CSR_VOLT_ADJ_PFM_MASK               0x0003E000u
+#define VREG0_4378_CSR_VOLT_ADJ_PFM_SHIFT              13u
+#define VREG0_4378_CSR_VOLT_ADJ_LP_PFM_MASK            0x007C0000u
+#define VREG0_4378_CSR_VOLT_ADJ_LP_PFM_SHIFT           18u
+#define VREG0_4378_CSR_OUT_VOLT_TRIM_ADJ_MASK          0x07800000u
+#define VREG0_4378_CSR_OUT_VOLT_TRIM_ADJ_SHIFT         23u
+
+#define PMU_4387_VREG1_CSR_OVERI_DIS_MASK              (1u << 22u)
+
+#define PMU_4387_VREG6_WL_PMU_LV_MODE_MASK             (0x00000002u)
+
+#define PMU_4389_VREG6_WL_PMU_LV_MODE_SHIFT            (1u)
+#define PMU_4389_VREG6_WL_PMU_LV_MODE_MASK             (1u << PMU_4389_VREG6_WL_PMU_LV_MODE_SHIFT)
+#define PMU_4389_VREG6_MEMLDO_PU_SHIFT                 (3u)
+#define PMU_4389_VREG6_MEMLDO_PU_MASK                  (1u << PMU_4389_VREG6_MEMLDO_PU_SHIFT)
+
+#define PMU_4387_VREG8_ASR_OVERI_DIS_MASK              (1u << 7u)
+
+#define PMU_VREG13_ASR_OVADJ_PWM_MASK                  (0x001F0000u)
+#define PMU_VREG13_ASR_OVADJ_PWM_SHIFT                 (16u)
+
+#define PMU_VREG14_RSRC_EN_ASR_PWM_PFM_MASK            (1u << 18u)
+#define PMU_VREG14_RSRC_EN_ASR_PWM_PFM_SHIFT           (18u)
+
+#define CSR_VOLT_ADJ_PWM_4378                          (0x17u)
+#define CSR_VOLT_ADJ_PFM_4378                          (0x17u)
+#define CSR_VOLT_ADJ_LP_PFM_4378                       (0x17u)
+#define CSR_OUT_VOLT_TRIM_ADJ_4378                     (0xEu)
+
+/* 1.00V */
+#define ABUCK_VOLT_SW_DEFAULT_4387                     (0x1Fu)
+
+/* 0.68V */
+#define CBUCK_VOLT_SW_DEFAULT_4387                     (0xFu)
+
+#define CC_GCI1_REG                                    (0x1)
+
+#define FORCE_CLK_ON                                                    1
+#define FORCE_CLK_OFF                                                   0
+
+#define PMU1_PLL0_SWITCH_MACCLOCK_120MHZ                       (0)
+#define PMU1_PLL0_SWITCH_MACCLOCK_160MHZ                       (1)
+#define PMU1_PLL0_PC1_M2DIV_VALUE_120MHZ                       8
+#define PMU1_PLL0_PC1_M2DIV_VALUE_160MHZ                       6
+
+/* 4369 Related */
+
+/*
+ * PMU VREG Definitions:
+ *   http://confluence.broadcom.com/display/WLAN/BCM4369+PMU+Vreg+Control+Register
+ */
+/* PMU VREG4 */
+#define PMU_28NM_VREG4_WL_LDO_CNTL_EN                          (0x1 << 10)
+
+/* PMU VREG6 */
+#define PMU_28NM_VREG6_BTLDO3P3_PU                             (0x1 << 12)
+#define PMU_4387_VREG6_BTLDO3P3_PU                             (0x1 << 8)
+
+/* PMU resources */
+#define RES4347_XTAL_PU                        6
+#define RES4347_CORE_RDY_DIG           17
+#define RES4347_CORE_RDY_AUX           18
+#define RES4347_CORE_RDY_MAIN          22
+
+/* 4369 PMU Resources */
+#define RES4369_DUMMY                  0
+#define RES4369_ABUCK                  1
+#define RES4369_PMU_SLEEP              2
+#define RES4369_MISCLDO                        3
+#define RES4369_LDO3P3                 4
+#define RES4369_FAST_LPO_AVAIL         5
+#define RES4369_XTAL_PU                        6
+#define RES4369_XTAL_STABLE            7
+#define RES4369_PWRSW_DIG              8
+#define RES4369_SR_DIG                 9
+#define RES4369_SLEEP_DIG              10
+#define RES4369_PWRSW_AUX              11
+#define RES4369_SR_AUX                 12
+#define RES4369_SLEEP_AUX              13
+#define RES4369_PWRSW_MAIN             14
+#define RES4369_SR_MAIN                        15
+#define RES4369_SLEEP_MAIN             16
+#define RES4369_DIG_CORE_RDY           17
+#define RES4369_CORE_RDY_AUX           18
+#define RES4369_ALP_AVAIL              19
+#define RES4369_RADIO_AUX_PU           20
+#define RES4369_MINIPMU_AUX_PU         21
+#define RES4369_CORE_RDY_MAIN          22
+#define RES4369_RADIO_MAIN_PU          23
+#define RES4369_MINIPMU_MAIN_PU                24
+#define RES4369_PCIE_EP_PU             25
+#define RES4369_COLD_START_WAIT                26
+#define RES4369_ARMHTAVAIL             27
+#define RES4369_HT_AVAIL               28
+#define RES4369_MACPHY_AUX_CLK_AVAIL   29
+#define RES4369_MACPHY_MAIN_CLK_AVAIL  30
+
+/*
+* 4378 PMU Resources
+*/
+#define RES4378_DUMMY                  0
+#define RES4378_ABUCK                  1
+#define RES4378_PMU_SLEEP              2
+#define RES4378_MISC_LDO               3
+#define RES4378_LDO3P3_PU              4
+#define RES4378_FAST_LPO_AVAIL         5
+#define RES4378_XTAL_PU                6
+#define RES4378_XTAL_STABLE            7
+#define RES4378_PWRSW_DIG              8
+#define RES4378_SR_DIG                 9
+#define RES4378_SLEEP_DIG              10
+#define RES4378_PWRSW_AUX              11
+#define RES4378_SR_AUX                 12
+#define RES4378_SLEEP_AUX              13
+#define RES4378_PWRSW_MAIN             14
+#define RES4378_SR_MAIN                15
+#define RES4378_SLEEP_MAIN             16
+#define RES4378_CORE_RDY_DIG           17
+#define RES4378_CORE_RDY_AUX           18
+#define RES4378_ALP_AVAIL              19
+#define RES4378_RADIO_AUX_PU           20
+#define RES4378_MINIPMU_AUX_PU         21
+#define RES4378_CORE_RDY_MAIN          22
+#define RES4378_RADIO_MAIN_PU          23
+#define RES4378_MINIPMU_MAIN_PU        24
+#define RES4378_CORE_RDY_CB            25
+#define RES4378_PWRSW_CB               26
+#define RES4378_ARMHTAVAIL             27
+#define RES4378_HT_AVAIL               28
+#define RES4378_MACPHY_AUX_CLK_AVAIL   29
+#define RES4378_MACPHY_MAIN_CLK_AVAIL  30
+#define RES4378_RESERVED_31            31
+
+/*
+* 4387 PMU Resources
+*/
+#define RES4387_DUMMY                  0
+#define RES4387_RESERVED_1             1
+#define RES4387_FAST_LPO_AVAIL         1       /* C0 */
+#define RES4387_PMU_SLEEP              2
+#define RES4387_PMU_LP                 2       /* C0 */
+#define RES4387_MISC_LDO               3
+#define RES4387_RESERVED_4             4
+#define RES4387_SERDES_AFE_RET         4       /* C0 */
+#define RES4387_XTAL_HQ                        5
+#define RES4387_XTAL_PU                        6
+#define RES4387_XTAL_STABLE            7
+#define RES4387_PWRSW_DIG              8
+#define RES4387_CORE_RDY_BTMAIN                9
+#define RES4387_CORE_RDY_BTSC          10
+#define RES4387_PWRSW_AUX              11
+#define RES4387_PWRSW_SCAN             12
+#define RES4387_CORE_RDY_SCAN          13
+#define RES4387_PWRSW_MAIN             14
+#define RES4387_RESERVED_15            15
+#define RES4387_XTAL_PM_CLK            15      /* C0 */
+#define RES4387_RESERVED_16            16
+#define RES4387_CORE_RDY_DIG           17
+#define RES4387_CORE_RDY_AUX           18
+#define RES4387_ALP_AVAIL              19
+#define RES4387_RADIO_PU_AUX           20
+#define RES4387_RADIO_PU_SCAN          21
+#define RES4387_CORE_RDY_MAIN          22
+#define RES4387_RADIO_PU_MAIN          23
+#define RES4387_MACPHY_CLK_SCAN                24
+#define RES4387_CORE_RDY_CB            25
+#define RES4387_PWRSW_CB               26
+#define RES4387_ARMCLK_AVAIL           27
+#define RES4387_HT_AVAIL               28
+#define RES4387_MACPHY_CLK_AUX         29
+#define RES4387_MACPHY_CLK_MAIN                30
+#define RES4387_RESERVED_31            31
+
+/* 4388 PMU Resources */
+#define RES4388_DUMMY                  0u
+#define RES4388_FAST_LPO_AVAIL         1u
+#define RES4388_PMU_LP                 2u
+#define RES4388_MISC_LDO               3u
+#define RES4388_SERDES_AFE_RET         4u
+#define RES4388_XTAL_HQ                        5u
+#define RES4388_XTAL_PU                        6u
+#define RES4388_XTAL_STABLE            7u
+#define RES4388_PWRSW_DIG              8u
+#define RES4388_BTMC_TOP_RDY           9u
+#define RES4388_BTSC_TOP_RDY           10u
+#define RES4388_PWRSW_AUX              11u
+#define RES4388_PWRSW_SCAN             12u
+#define RES4388_CORE_RDY_SCAN          13u
+#define RES4388_PWRSW_MAIN             14u
+#define RES4388_RESERVED_15            15u
+#define RES4388_RESERVED_16            16u
+#define RES4388_CORE_RDY_DIG           17u
+#define RES4388_CORE_RDY_AUX           18u
+#define RES4388_ALP_AVAIL              19u
+#define RES4388_RADIO_PU_AUX           20u
+#define RES4388_RADIO_PU_SCAN          21u
+#define RES4388_CORE_RDY_MAIN          22u
+#define RES4388_RADIO_PU_MAIN          23u
+#define RES4388_MACPHY_CLK_SCAN                24u
+#define RES4388_CORE_RDY_CB            25u
+#define RES4388_PWRSW_CB               26u
+#define RES4388_ARMCLKAVAIL            27u
+#define RES4388_HT_AVAIL               28u
+#define RES4388_MACPHY_CLK_AUX         29u
+#define RES4388_MACPHY_CLK_MAIN                30u
+#define RES4388_RESERVED_31            31u
+
+/* 4389 PMU Resources */
+#define RES4389_DUMMY                  0u
+#define RES4389_FAST_LPO_AVAIL         1u
+#define RES4389_PMU_LP                 2u
+#define RES4389_MISC_LDO               3u
+#define RES4389_SERDES_AFE_RET         4u
+#define RES4389_XTAL_HQ                        5u
+#define RES4389_XTAL_PU                        6u
+#define RES4389_XTAL_STABLE            7u
+#define RES4389_PWRSW_DIG              8u
+#define RES4389_BTMC_TOP_RDY           9u
+#define RES4389_BTSC_TOP_RDY           10u
+#define RES4389_PWRSW_AUX              11u
+#define RES4389_PWRSW_SCAN             12u
+#define RES4389_CORE_RDY_SCAN          13u
+#define RES4389_PWRSW_MAIN             14u
+#define RES4389_RESERVED_15            15u
+#define RES4389_RESERVED_16            16u
+#define RES4389_CORE_RDY_DIG           17u
+#define RES4389_CORE_RDY_AUX           18u
+#define RES4389_ALP_AVAIL              19u
+#define RES4389_RADIO_PU_AUX           20u
+#define RES4389_RADIO_PU_SCAN          21u
+#define RES4389_CORE_RDY_MAIN          22u
+#define RES4389_RADIO_PU_MAIN          23u
+#define RES4389_MACPHY_CLK_SCAN                24u
+#define RES4389_CORE_RDY_CB            25u
+#define RES4389_PWRSW_CB               26u
+#define RES4389_ARMCLKAVAIL            27u
+#define RES4389_HT_AVAIL               28u
+#define RES4389_MACPHY_CLK_AUX         29u
+#define RES4389_MACPHY_CLK_MAIN                30u
+#define RES4389_RESERVED_31            31u
+
+/* 4397 PMU Resources */
+#define RES4397_DUMMY                  0u
+#define RES4397_FAST_LPO_AVAIL         1u
+#define RES4397_PMU_LP                 2u
+#define RES4397_MISC_LDO               3u
+#define RES4397_SERDES_AFE_RET         4u
+#define RES4397_XTAL_HQ                        5u
+#define RES4397_XTAL_PU                        6u
+#define RES4397_XTAL_STABLE            7u
+#define RES4397_PWRSW_DIG              8u
+#define RES4397_BTMC_TOP_RDY           9u
+#define RES4397_BTSC_TOP_RDY           10u
+#define RES4397_PWRSW_AUX              11u
+#define RES4397_PWRSW_SCAN             12u
+#define RES4397_CORE_RDY_SCAN          13u
+#define RES4397_PWRSW_MAIN             14u
+#define RES4397_XTAL_PM_CLK            15u
+#define RES4397_PWRSW_DRR2             16u
+#define RES4397_CORE_RDY_DIG           17u
+#define RES4397_CORE_RDY_AUX           18u
+#define RES4397_ALP_AVAIL              19u
+#define RES4397_RADIO_PU_AUX           20u
+#define RES4397_RADIO_PU_SCAN          21u
+#define RES4397_CORE_RDY_MAIN          22u
+#define RES4397_RADIO_PU_MAIN          23u
+#define RES4397_MACPHY_CLK_SCAN                24u
+#define RES4397_CORE_RDY_CB            25u
+#define RES4397_PWRSW_CB               26u
+#define RES4397_ARMCLKAVAIL            27u
+#define RES4397_HT_AVAIL               28u
+#define RES4397_MACPHY_CLK_AUX         29u
+#define RES4397_MACPHY_CLK_MAIN                30u
+#define RES4397_RESERVED_31            31u
+
+/* 0: BToverPCIe, 1: BToverUART */
+#define CST4378_CHIPMODE_BTOU(cs)      (((cs) & (1 << 6)) != 0)
+#define CST4378_CHIPMODE_BTOP(cs)      (((cs) & (1 << 6)) == 0)
+#define CST4378_SPROM_PRESENT          0x00000010
+
+#define CST4368_SFLASH_PRESENT         0x00000010U
+
+#define CST4387_CHIPMODE_BTOU(cs)      (((cs) & (1 << 6)) != 0)
+#define CST4387_CHIPMODE_BTOP(cs)      (((cs) & (1 << 6)) == 0)
+#define CST4387_SPROM_PRESENT          0x00000010
+
+/* GCI chip status */
+#define GCI_CS_4369_FLL1MHZ_LOCK_MASK  (1 << 1)
+#define GCI_CS_4387_FLL1MHZ_LOCK_MASK  (1 << 1)
+
+/* GCI chip control registers */
+#define GCI_CC7_AAON_BYPASS_PWRSW_SEL          13
+#define GCI_CC7_AAON_BYPASS_PWRSW_SEQ_ON       14
+
+/* 4368 GCI chip control registers */
+#define GCI_CC7_PRISEL_MASK                    (1 << 8 | 1 << 9)
+#define GCI_CC12_PRISEL_MASK                   (1 << 0 | 1 << 1)
+#define GCI_CC12_PRISEL_SHIFT                  0
+#define GCI_CC12_DMASK_MASK                    (0x3ff << 10)
+#define GCI_CC16_ANT_SHARE_MASK                (1 << 16 | 1 << 17)
+
+#define CC2_4362_SDIO_AOS_WAKEUP_MASK                  (1u << 24u)
+#define CC2_4362_SDIO_AOS_WAKEUP_SHIFT                 24u
+
+#define CC2_4378_MAIN_MEMLPLDO_VDDB_OFF_MASK           (1 << 12)
+#define CC2_4378_MAIN_MEMLPLDO_VDDB_OFF_SHIFT          12
+#define CC2_4378_AUX_MEMLPLDO_VDDB_OFF_MASK            (1 << 13)
+#define CC2_4378_AUX_MEMLPLDO_VDDB_OFF_SHIFT           13
+#define CC2_4378_MAIN_VDDRET_ON_MASK                   (1 << 15)
+#define CC2_4378_MAIN_VDDRET_ON_SHIFT                  15
+#define CC2_4378_AUX_VDDRET_ON_MASK                    (1 << 16)
+#define CC2_4378_AUX_VDDRET_ON_SHIFT                   16
+#define CC2_4378_GCI2WAKE_MASK                         (1 << 31)
+#define CC2_4378_GCI2WAKE_SHIFT                                31
+#define CC2_4378_SDIO_AOS_WAKEUP_MASK                  (1 << 24)
+#define CC2_4378_SDIO_AOS_WAKEUP_SHIFT                 24
+#define CC4_4378_LHL_TIMER_SELECT                      (1 << 0)
+#define CC6_4378_PWROK_WDT_EN_IN_MASK                  (1 << 6)
+#define CC6_4378_PWROK_WDT_EN_IN_SHIFT                 6
+#define CC6_4378_SDIO_AOS_CHIP_WAKEUP_MASK             (1 << 24)
+#define CC6_4378_SDIO_AOS_CHIP_WAKEUP_SHIFT            24
+
+#define CC2_4378_USE_WLAN_BP_CLK_ON_REQ_MASK           (1 << 15)
+#define CC2_4378_USE_WLAN_BP_CLK_ON_REQ_SHIFT          15
+#define CC2_4378_USE_CMN_BP_CLK_ON_REQ_MASK            (1 << 16)
+#define CC2_4378_USE_CMN_BP_CLK_ON_REQ_SHIFT           16
+
+#define CC2_4387_MAIN_MEMLPLDO_VDDB_OFF_MASK           (1 << 12)
+#define CC2_4387_MAIN_MEMLPLDO_VDDB_OFF_SHIFT          12
+#define CC2_4387_AUX_MEMLPLDO_VDDB_OFF_MASK            (1 << 13)
+#define CC2_4387_AUX_MEMLPLDO_VDDB_OFF_SHIFT           13
+#define CC2_4387_MAIN_VDDRET_ON_MASK                   (1 << 15)
+#define CC2_4387_MAIN_VDDRET_ON_SHIFT                  15
+#define CC2_4387_AUX_VDDRET_ON_MASK                    (1 << 16)
+#define CC2_4387_AUX_VDDRET_ON_SHIFT                   16
+#define CC2_4387_GCI2WAKE_MASK                         (1 << 31)
+#define CC2_4387_GCI2WAKE_SHIFT                                31
+#define CC2_4387_SDIO_AOS_WAKEUP_MASK                  (1 << 24)
+#define CC2_4387_SDIO_AOS_WAKEUP_SHIFT                 24
+#define CC4_4387_LHL_TIMER_SELECT                      (1 << 0)
+#define CC6_4387_PWROK_WDT_EN_IN_MASK                  (1 << 6)
+#define CC6_4387_PWROK_WDT_EN_IN_SHIFT                 6
+#define CC6_4387_SDIO_AOS_CHIP_WAKEUP_MASK             (1 << 24)
+#define CC6_4387_SDIO_AOS_CHIP_WAKEUP_SHIFT            24
+
+#define CC2_4387_USE_WLAN_BP_CLK_ON_REQ_MASK           (1 << 15)
+#define CC2_4387_USE_WLAN_BP_CLK_ON_REQ_SHIFT          15
+#define CC2_4387_USE_CMN_BP_CLK_ON_REQ_MASK            (1 << 16)
+#define CC2_4387_USE_CMN_BP_CLK_ON_REQ_SHIFT           16
+
+#define CC2_4389_MAIN_MEMLPLDO_VDDB_OFF_MASK           (1u << 12u)
+#define CC2_4389_MAIN_MEMLPLDO_VDDB_OFF_SHIFT          (12u)
+#define CC2_4389_AUX_MEMLPLDO_VDDB_OFF_MASK            (1u << 13u)
+#define CC2_4389_AUX_MEMLPLDO_VDDB_OFF_SHIFT           (13u)
+#define CC2_4389_MAIN_VDDRET_ON_MASK                   (1u << 15u)
+#define CC2_4389_MAIN_VDDRET_ON_SHIFT                  (15u)
+#define CC2_4389_AUX_VDDRET_ON_MASK                    (1u << 16u)
+#define CC2_4389_AUX_VDDRET_ON_SHIFT                   (16u)
+#define CC2_4389_GCI2WAKE_MASK                         (1u << 31u)
+#define CC2_4389_GCI2WAKE_SHIFT                                (31u)
+#define CC2_4389_SDIO_AOS_WAKEUP_MASK                  (1u << 24u)
+#define CC2_4389_SDIO_AOS_WAKEUP_SHIFT                 (24u)
+#define CC4_4389_LHL_TIMER_SELECT                      (1u << 0u)
+#define CC6_4389_PWROK_WDT_EN_IN_MASK                  (1u << 6u)
+#define CC6_4389_PWROK_WDT_EN_IN_SHIFT                 (6u)
+#define CC6_4389_SDIO_AOS_CHIP_WAKEUP_MASK             (1u << 24u)
+#define CC6_4389_SDIO_AOS_CHIP_WAKEUP_SHIFT            (24u)
+
+#define CC2_4389_USE_WLAN_BP_CLK_ON_REQ_MASK           (1u << 15u)
+#define CC2_4389_USE_WLAN_BP_CLK_ON_REQ_SHIFT          (15u)
+#define CC2_4389_USE_CMN_BP_CLK_ON_REQ_MASK            (1u << 16u)
+#define CC2_4389_USE_CMN_BP_CLK_ON_REQ_SHIFT           (16u)
+
+#define PCIE_GPIO1_GPIO_PIN    CC_GCI_GPIO_0
+#define PCIE_PERST_GPIO_PIN    CC_GCI_GPIO_1
+#define PCIE_CLKREQ_GPIO_PIN   CC_GCI_GPIO_2
+
+#define VREG5_4378_MEMLPLDO_ADJ_MASK                           0xF0000000
+#define VREG5_4378_MEMLPLDO_ADJ_SHIFT                          28
+#define VREG5_4378_LPLDO_ADJ_MASK                              0x00F00000
+#define VREG5_4378_LPLDO_ADJ_SHIFT                             20
+
+#define VREG5_4387_MISCLDO_PU_MASK                             (0x00000800u)
+#define VREG5_4387_MISCLDO_PU_SHIFT                            (11u)
+
+#define VREG5_4387_MEMLPLDO_ADJ_MASK                           0xF0000000
+#define VREG5_4387_MEMLPLDO_ADJ_SHIFT                          28
+#define VREG5_4387_LPLDO_ADJ_MASK                              0x00F00000
+#define VREG5_4387_LPLDO_ADJ_SHIFT                             20
+
+/* lpldo/memlpldo voltage */
+#define        PMU_VREG5_LPLDO_VOLT_0_88       0xf     /* 0.88v */
+#define        PMU_VREG5_LPLDO_VOLT_0_86       0xe     /* 0.86v */
+#define        PMU_VREG5_LPLDO_VOLT_0_84       0xd     /* 0.84v */
+#define        PMU_VREG5_LPLDO_VOLT_0_82       0xc     /* 0.82v */
+#define        PMU_VREG5_LPLDO_VOLT_0_80       0xb     /* 0.80v */
+#define        PMU_VREG5_LPLDO_VOLT_0_78       0xa     /* 0.78v */
+#define        PMU_VREG5_LPLDO_VOLT_0_76       0x9     /* 0.76v */
+#define        PMU_VREG5_LPLDO_VOLT_0_74       0x8     /* 0.74v */
+#define        PMU_VREG5_LPLDO_VOLT_0_72       0x7     /* 0.72v */
+#define        PMU_VREG5_LPLDO_VOLT_1_10       0x6     /* 1.10v */
+#define        PMU_VREG5_LPLDO_VOLT_1_00       0x5     /* 1.00v */
+#define        PMU_VREG5_LPLDO_VOLT_0_98       0x4     /* 0.98v */
+#define        PMU_VREG5_LPLDO_VOLT_0_96       0x3     /* 0.96v */
+#define        PMU_VREG5_LPLDO_VOLT_0_94       0x2     /* 0.94v */
+#define        PMU_VREG5_LPLDO_VOLT_0_92       0x1     /* 0.92v */
+#define        PMU_VREG5_LPLDO_VOLT_0_90       0x0     /* 0.90v */
+
+/* Save/Restore engine */
+
+/* 512 bytes block */
+#define SR_ASM_ADDR_BLK_SIZE_SHIFT     (9u)
+
+#define BM_ADDR_TO_SR_ADDR(bmaddr)     ((bmaddr) >> SR_ASM_ADDR_BLK_SIZE_SHIFT)
+#define SR_ADDR_TO_BM_ADDR(sraddr)     ((sraddr) << SR_ASM_ADDR_BLK_SIZE_SHIFT)
+
+/* Txfifo is 512KB for main core and 128KB for aux core
+ * We use first 12kB (0x3000) in BMC buffer for template in main core and
+ * 6.5kB (0x1A00) in aux core, followed by ASM code
+ */
+#define SR_ASM_ADDR_MAIN_4369          BM_ADDR_TO_SR_ADDR(0xC00)
+#define SR_ASM_ADDR_AUX_4369           BM_ADDR_TO_SR_ADDR(0xC00)
+#define SR_ASM_ADDR_DIG_4369           (0x0)
+
+#define SR_ASM_ADDR_MAIN_4362          BM_ADDR_TO_SR_ADDR(0xc00u)
+#define SR_ASM_ADDR_DIG_4362           (0x0u)
+
+#define SR_ASM_ADDR_MAIN_4378          (0x18)
+#define SR_ASM_ADDR_AUX_4378           (0xd)
+/* backplane address, use last 16k of BTCM for s/r */
+#define SR_ASM_ADDR_DIG_4378A0         (0x51c000)
+
+/* backplane address, use last 32k of BTCM for s/r */
+#define SR_ASM_ADDR_DIG_4378B0         (0x518000)
+
+#define SR_ASM_ADDR_MAIN_4368          (0x40)
+#define SR_ASM_ADDR_AUX_4368           (0x48)
+#define SR_ASM_ADDR_DIG_4368           (0x18520000)
+#define SR_ASM_SIZE_DIG_4368           (6114u * 8u)
+
+#define SR_ASM_ADDR_MAIN_4387          (0x18)
+#define SR_ASM_ADDR_AUX_4387           (0xd)
+#define SR_ASM_ADDR_SCAN_4387          (0)
+/* backplane address */
+#define SR_ASM_ADDR_DIG_4387           (0x800000)
+
+#define SR_ASM_ADDR_MAIN_4387C0                BM_ADDR_TO_SR_ADDR(0xC00)
+#define SR_ASM_ADDR_AUX_4387C0         BM_ADDR_TO_SR_ADDR(0xC00)
+#define SR_ASM_ADDR_DIG_4387C0         (0x931000)
+#define SR_ASM_ADDR_DIG_4387_C0                (0x931000)
+
+#define SR_ASM_ADDR_MAIN_4388          BM_ADDR_TO_SR_ADDR(0xC00)
+#define SR_ASM_ADDR_AUX_4388           BM_ADDR_TO_SR_ADDR(0xC00)
+#define SR_ASM_ADDR_SCAN_4388          BM_ADDR_TO_SR_ADDR(0)
+#define SR_ASM_ADDR_DIG_4388           (0x18520000)
+#define SR_ASM_SIZE_DIG_4388           (65536u)
+
+#define SR_ASM_ADDR_MAIN_4389C0                BM_ADDR_TO_SR_ADDR(0xC00)
+#define SR_ASM_ADDR_AUX_4389C0         BM_ADDR_TO_SR_ADDR(0xC00)
+#define SR_ASM_ADDR_SCAN_4389C0                BM_ADDR_TO_SR_ADDR(0x000)
+#define SR_ASM_ADDR_DIG_4389C0         (0x18520000)
+#define SR_ASM_SIZE_DIG_4389C0         (8192u * 8u)
+
+#define SR_ASM_ADDR_MAIN_4389          BM_ADDR_TO_SR_ADDR(0xC00)
+#define SR_ASM_ADDR_AUX_4389           BM_ADDR_TO_SR_ADDR(0xC00)
+#define SR_ASM_ADDR_SCAN_4389          BM_ADDR_TO_SR_ADDR(0x000)
+#define SR_ASM_ADDR_DIG_4389           (0x18520000)
+#define SR_ASM_SIZE_DIG_4389           (8192u * 8u)
+#define FIS_CMN_SUBCORE_ADDR_4389      (0x1640u)
+
+#define SR_ASM_ADDR_DIG_4397           (0x18520000)
+
+/* SR Control0 bits */
+#define SR0_SR_ENG_EN_MASK             0x1
+#define SR0_SR_ENG_EN_SHIFT            0
+#define SR0_SR_ENG_CLK_EN              (1 << 1)
+#define SR0_RSRC_TRIGGER               (0xC << 2)
+#define SR0_WD_MEM_MIN_DIV             (0x3 << 6)
+#define SR0_INVERT_SR_CLK              (1 << 11)
+#define SR0_MEM_STBY_ALLOW             (1 << 16)
+#define SR0_ENABLE_SR_ILP              (1 << 17)
+#define SR0_ENABLE_SR_ALP              (1 << 18)
+#define SR0_ENABLE_SR_HT               (1 << 19)
+#define SR0_ALLOW_PIC                  (3 << 20)
+#define SR0_ENB_PMU_MEM_DISABLE                (1 << 30)
+
+/* SR Control0 bits for 4369 */
+#define SR0_4369_SR_ENG_EN_MASK                0x1
+#define SR0_4369_SR_ENG_EN_SHIFT       0
+#define SR0_4369_SR_ENG_CLK_EN         (1 << 1)
+#define SR0_4369_RSRC_TRIGGER          (0xC << 2)
+#define SR0_4369_WD_MEM_MIN_DIV                (0x2 << 6)
+#define SR0_4369_INVERT_SR_CLK         (1 << 11)
+#define SR0_4369_MEM_STBY_ALLOW                (1 << 16)
+#define SR0_4369_ENABLE_SR_ILP         (1 << 17)
+#define SR0_4369_ENABLE_SR_ALP         (1 << 18)
+#define SR0_4369_ENABLE_SR_HT          (1 << 19)
+#define SR0_4369_ALLOW_PIC             (3 << 20)
+#define SR0_4369_ENB_PMU_MEM_DISABLE   (1 << 30)
+
+/* SR Control0 bits for 4378 */
+#define SR0_4378_SR_ENG_EN_MASK        0x1
+#define SR0_4378_SR_ENG_EN_SHIFT       0
+#define SR0_4378_SR_ENG_CLK_EN         (1 << 1)
+#define SR0_4378_RSRC_TRIGGER          (0xC << 2)
+#define SR0_4378_WD_MEM_MIN_DIV        (0x2 << 6)
+#define SR0_4378_INVERT_SR_CLK         (1 << 11)
+#define SR0_4378_MEM_STBY_ALLOW        (1 << 16)
+#define SR0_4378_ENABLE_SR_ILP         (1 << 17)
+#define SR0_4378_ENABLE_SR_ALP         (1 << 18)
+#define SR0_4378_ENABLE_SR_HT          (1 << 19)
+#define SR0_4378_ALLOW_PIC             (3 << 20)
+#define SR0_4378_ENB_PMU_MEM_DISABLE   (1 << 30)
+
+/* SR Control0 bits for 4368 */
+#define SR0_4368_SR_ENG_EN_MASK                0x1
+#define SR0_4368_SR_ENG_EN_SHIFT       0
+#define SR0_4368_SR_ENG_CLK_EN         (1 << 1)
+#define SR0_4368_RSRC_TRIGGER          (0xC << 2)
+#define SR0_4368_WD_MEM_MIN_DIV                (0x2 << 6)
+#define SR0_4368_INVERT_SR_CLK         (1 << 11)
+#define SR0_4368_MEM_STBY_ALLOW                (1 << 16)
+#define SR0_4368_ENABLE_SR_ILP         (1 << 17)
+#define SR0_4368_ENABLE_SR_ALP         (1 << 18)
+#define SR0_4368_ENABLE_SR_HT          (1 << 19)
+#define SR0_4368_ALLOW_PIC             (3 << 20)
+#define SR0_4368_ENB_PMU_MEM_DISABLE   (1 << 30)
+
+/* SR Control0 bits for 4387 */
+#define SR0_4387_SR_ENG_EN_MASK                0x1
+#define SR0_4387_SR_ENG_EN_SHIFT       0
+#define SR0_4387_SR_ENG_CLK_EN         (1 << 1)
+#define SR0_4387_RSRC_TRIGGER          (0xC << 2)
+#define SR0_4387_WD_MEM_MIN_DIV                (0x2 << 6)
+#define SR0_4387_WD_MEM_MIN_DIV_AUX    (0x4 << 6)
+#define SR0_4387_INVERT_SR_CLK         (1 << 11)
+#define SR0_4387_MEM_STBY_ALLOW                (1 << 16)
+#define SR0_4387_ENABLE_SR_ILP         (1 << 17)
+#define SR0_4387_ENABLE_SR_ALP         (1 << 18)
+#define SR0_4387_ENABLE_SR_HT          (1 << 19)
+#define SR0_4387_ALLOW_PIC             (3 << 20)
+#define SR0_4387_ENB_PMU_MEM_DISABLE   (1 << 30)
+
+/* SR Control0 bits for 4388 */
+#define SR0_4388_SR_ENG_EN_MASK                0x1u
+#define SR0_4388_SR_ENG_EN_SHIFT       0
+#define SR0_4388_SR_ENG_CLK_EN         (1u << 1u)
+#define SR0_4388_RSRC_TRIGGER          (0xCu << 2u)
+#define SR0_4388_WD_MEM_MIN_DIV                (0x2u << 6u)
+#define SR0_4388_INVERT_SR_CLK         (1u << 11u)
+#define SR0_4388_MEM_STBY_ALLOW                (1u << 16u)
+#define SR0_4388_ENABLE_SR_ILP         (1u << 17u)
+#define SR0_4388_ENABLE_SR_ALP         (1u << 18u)
+#define SR0_4388_ENABLE_SR_HT          (1u << 19u)
+#define SR0_4388_ALLOW_PIC             (3u << 20u)
+#define SR0_4388_ENB_PMU_MEM_DISABLE   (1u << 30u)
+
+/* SR Control0 bits for 4389 */
+#define SR0_4389_SR_ENG_EN_MASK                0x1
+#define SR0_4389_SR_ENG_EN_SHIFT       0
+#define SR0_4389_SR_ENG_CLK_EN         (1 << 1)
+#define SR0_4389_RSRC_TRIGGER          (0xC << 2)
+#define SR0_4389_WD_MEM_MIN_DIV                (0x2 << 6)
+#define SR0_4389_INVERT_SR_CLK         (1 << 11)
+#define SR0_4389_MEM_STBY_ALLOW                (1 << 16)
+#define SR0_4389_ENABLE_SR_ILP         (1 << 17)
+#define SR0_4389_ENABLE_SR_ALP         (1 << 18)
+#define SR0_4389_ENABLE_SR_HT          (1 << 19)
+#define SR0_4389_ALLOW_PIC             (3 << 20)
+#define SR0_4389_ENB_PMU_MEM_DISABLE   (1 << 30)
+
+/* SR Control1 bits */
+#define SR1_INIT_ADDR_MASK                     (0x000003FFu)
+#define SR1_SELFTEST_ENB_MASK                  (0x00004000u)
+#define SR1_SELFTEST_ERR_INJCT_ENB_MASK                (0x00008000u)
+#define SR1_SELFTEST_ERR_INJCT_PRD_MASK                (0xFFFF0000u)
+#define SR1_SELFTEST_ERR_INJCT_PRD_SHIFT       (16u)
+
+/* SR Control2 bits */
+#define SR2_INIT_ADDR_LONG_MASK                        (0x00003FFFu)
+
+#define SR_SELFTEST_ERR_INJCT_PRD              (0x10u)
+
+/* SR Status1 bits */
+#define SR_STS1_SR_ERR_MASK                    (0x00000001u)
+
+/* =========== LHL regs =========== */
+/* 4369 LHL register settings */
+#define LHL4369_UP_CNT                 0
+#define LHL4369_DN_CNT                 2
+#define LHL4369_PWRSW_EN_DWN_CNT       (LHL4369_DN_CNT + 2)
+#define LHL4369_ISO_EN_DWN_CNT         (LHL4369_PWRSW_EN_DWN_CNT + 3)
+#define LHL4369_SLB_EN_DWN_CNT         (LHL4369_ISO_EN_DWN_CNT + 1)
+#define LHL4369_ASR_CLK4M_DIS_DWN_CNT  (LHL4369_DN_CNT)
+#define LHL4369_ASR_LPPFM_MODE_DWN_CNT (LHL4369_DN_CNT)
+#define LHL4369_ASR_MODE_SEL_DWN_CNT   (LHL4369_DN_CNT)
+#define LHL4369_ASR_MANUAL_MODE_DWN_CNT        (LHL4369_DN_CNT)
+#define LHL4369_ASR_ADJ_DWN_CNT                (LHL4369_DN_CNT)
+#define LHL4369_ASR_OVERI_DIS_DWN_CNT  (LHL4369_DN_CNT)
+#define LHL4369_ASR_TRIM_ADJ_DWN_CNT   (LHL4369_DN_CNT)
+#define LHL4369_VDDC_SW_DIS_DWN_CNT    (LHL4369_SLB_EN_DWN_CNT + 1)
+#define LHL4369_VMUX_ASR_SEL_DWN_CNT   (LHL4369_VDDC_SW_DIS_DWN_CNT + 1)
+#define LHL4369_CSR_ADJ_DWN_CNT                (LHL4369_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4369_CSR_MODE_DWN_CNT       (LHL4369_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4369_CSR_OVERI_DIS_DWN_CNT  (LHL4369_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4369_HPBG_CHOP_DIS_DWN_CNT  (LHL4369_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4369_SRBG_REF_SEL_DWN_CNT   (LHL4369_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4369_PFM_PWR_SLICE_DWN_CNT  (LHL4369_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4369_CSR_TRIM_ADJ_DWN_CNT   (LHL4369_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4369_CSR_VOLTAGE_DWN_CNT    (LHL4369_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4369_HPBG_PU_EN_DWN_CNT     (LHL4369_CSR_MODE_DWN_CNT + 1)
+
+#define LHL4369_HPBG_PU_EN_UP_CNT      (LHL4369_UP_CNT + 1)
+#define LHL4369_CSR_ADJ_UP_CNT         (LHL4369_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4369_CSR_MODE_UP_CNT                (LHL4369_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4369_CSR_OVERI_DIS_UP_CNT   (LHL4369_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4369_HPBG_CHOP_DIS_UP_CNT   (LHL4369_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4369_SRBG_REF_SEL_UP_CNT    (LHL4369_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4369_PFM_PWR_SLICE_UP_CNT   (LHL4369_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4369_CSR_TRIM_ADJ_UP_CNT    (LHL4369_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4369_CSR_VOLTAGE_UP_CNT     (LHL4369_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4369_VMUX_ASR_SEL_UP_CNT    (LHL4369_CSR_MODE_UP_CNT + 1)
+#define LHL4369_VDDC_SW_DIS_UP_CNT     (LHL4369_VMUX_ASR_SEL_UP_CNT + 1)
+#define LHL4369_SLB_EN_UP_CNT          (LHL4369_VDDC_SW_DIS_UP_CNT + 8)
+#define LHL4369_ISO_EN_UP_CNT          (LHL4369_SLB_EN_UP_CNT + 1)
+#define LHL4369_PWRSW_EN_UP_CNT                (LHL4369_ISO_EN_UP_CNT + 3)
+#define LHL4369_ASR_ADJ_UP_CNT         (LHL4369_PWRSW_EN_UP_CNT + 1)
+#define LHL4369_ASR_CLK4M_DIS_UP_CNT   (LHL4369_PWRSW_EN_UP_CNT + 1)
+#define LHL4369_ASR_LPPFM_MODE_UP_CNT  (LHL4369_PWRSW_EN_UP_CNT + 1)
+#define LHL4369_ASR_MODE_SEL_UP_CNT    (LHL4369_PWRSW_EN_UP_CNT + 1)
+#define LHL4369_ASR_MANUAL_MODE_UP_CNT (LHL4369_PWRSW_EN_UP_CNT + 1)
+#define LHL4369_ASR_OVERI_DIS_UP_CNT   (LHL4369_PWRSW_EN_UP_CNT + 1)
+#define LHL4369_ASR_TRIM_ADJ_UP_CNT    (LHL4369_PWRSW_EN_UP_CNT + 1)
+
+/* 4362 LHL register settings */
+#define LHL4362_UP_CNT                 (0u)
+#define LHL4362_DN_CNT                 (2u)
+#define LHL4362_PWRSW_EN_DWN_CNT       (LHL4362_DN_CNT + 2)
+#define LHL4362_ISO_EN_DWN_CNT         (LHL4362_PWRSW_EN_DWN_CNT + 3)
+#define LHL4362_SLB_EN_DWN_CNT         (LHL4362_ISO_EN_DWN_CNT + 1)
+#define LHL4362_ASR_CLK4M_DIS_DWN_CNT  (LHL4362_DN_CNT)
+#define LHL4362_ASR_LPPFM_MODE_DWN_CNT (LHL4362_DN_CNT)
+#define LHL4362_ASR_MODE_SEL_DWN_CNT   (LHL4362_DN_CNT)
+#define LHL4362_ASR_MANUAL_MODE_DWN_CNT        (LHL4362_DN_CNT)
+#define LHL4362_ASR_ADJ_DWN_CNT                (LHL4362_DN_CNT)
+#define LHL4362_ASR_OVERI_DIS_DWN_CNT  (LHL4362_DN_CNT)
+#define LHL4362_ASR_TRIM_ADJ_DWN_CNT   (LHL4362_DN_CNT)
+#define LHL4362_VDDC_SW_DIS_DWN_CNT    (LHL4362_SLB_EN_DWN_CNT + 1)
+#define LHL4362_VMUX_ASR_SEL_DWN_CNT   (LHL4362_VDDC_SW_DIS_DWN_CNT + 1)
+#define LHL4362_CSR_ADJ_DWN_CNT                (LHL4362_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4362_CSR_MODE_DWN_CNT       (LHL4362_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4362_CSR_OVERI_DIS_DWN_CNT  (LHL4362_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4362_HPBG_CHOP_DIS_DWN_CNT  (LHL4362_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4362_SRBG_REF_SEL_DWN_CNT   (LHL4362_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4362_PFM_PWR_SLICE_DWN_CNT  (LHL4362_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4362_CSR_TRIM_ADJ_DWN_CNT   (LHL4362_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4362_CSR_VOLTAGE_DWN_CNT    (LHL4362_VMUX_ASR_SEL_DWN_CNT + 1)
+#define LHL4362_HPBG_PU_EN_DWN_CNT     (LHL4362_CSR_MODE_DWN_CNT + 1)
+
+#define LHL4362_HPBG_PU_EN_UP_CNT      (LHL4362_UP_CNT + 1)
+#define LHL4362_CSR_ADJ_UP_CNT         (LHL4362_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4362_CSR_MODE_UP_CNT                (LHL4362_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4362_CSR_OVERI_DIS_UP_CNT   (LHL4362_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4362_HPBG_CHOP_DIS_UP_CNT   (LHL4362_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4362_SRBG_REF_SEL_UP_CNT    (LHL4362_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4362_PFM_PWR_SLICE_UP_CNT   (LHL4362_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4362_CSR_TRIM_ADJ_UP_CNT    (LHL4362_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4362_CSR_VOLTAGE_UP_CNT     (LHL4362_HPBG_PU_EN_UP_CNT + 1)
+#define LHL4362_VMUX_ASR_SEL_UP_CNT    (LHL4362_CSR_MODE_UP_CNT + 1)
+#define LHL4362_VDDC_SW_DIS_UP_CNT     (LHL4362_VMUX_ASR_SEL_UP_CNT + 1)
+#define LHL4362_SLB_EN_UP_CNT          (LHL4362_VDDC_SW_DIS_UP_CNT + 8)
+#define LHL4362_ISO_EN_UP_CNT          (LHL4362_SLB_EN_UP_CNT + 1)
+#define LHL4362_PWRSW_EN_UP_CNT                (LHL4362_ISO_EN_UP_CNT + 3)
+#define LHL4362_ASR_ADJ_UP_CNT         (LHL4362_PWRSW_EN_UP_CNT + 1)
+#define LHL4362_ASR_CLK4M_DIS_UP_CNT   (LHL4362_PWRSW_EN_UP_CNT + 1)
+#define LHL4362_ASR_LPPFM_MODE_UP_CNT  (LHL4362_PWRSW_EN_UP_CNT + 1)
+#define LHL4362_ASR_MODE_SEL_UP_CNT    (LHL4362_PWRSW_EN_UP_CNT + 1)
+#define LHL4362_ASR_MANUAL_MODE_UP_CNT (LHL4362_PWRSW_EN_UP_CNT + 1)
+#define LHL4362_ASR_OVERI_DIS_UP_CNT   (LHL4362_PWRSW_EN_UP_CNT + 1)
+#define LHL4362_ASR_TRIM_ADJ_UP_CNT    (LHL4362_PWRSW_EN_UP_CNT + 1)
+
+/* 4378 LHL register settings */
+#define LHL4378_CSR_OVERI_DIS_DWN_CNT          5u
+#define LHL4378_CSR_MODE_DWN_CNT               5u
+#define LHL4378_CSR_ADJ_DWN_CNT                5u
+
+#define LHL4378_CSR_OVERI_DIS_UP_CNT           1u
+#define LHL4378_CSR_MODE_UP_CNT                1u
+#define LHL4378_CSR_ADJ_UP_CNT                 1u
+
+#define LHL4378_VDDC_SW_DIS_DWN_CNT            3u
+#define LHL4378_ASR_ADJ_DWN_CNT                3u
+#define LHL4378_HPBG_CHOP_DIS_DWN_CNT          0
+
+#define LHL4378_VDDC_SW_DIS_UP_CNT             3u
+#define LHL4378_ASR_ADJ_UP_CNT                 1u
+#define LHL4378_HPBG_CHOP_DIS_UP_CNT           0
+
+#define LHL4378_ASR_MANUAL_MODE_DWN_CNT        5u
+#define LHL4378_ASR_MODE_SEL_DWN_CNT           5u
+#define LHL4378_ASR_LPPFM_MODE_DWN_CNT         5u
+#define LHL4378_ASR_CLK4M_DIS_DWN_CNT          0
+
+#define LHL4378_ASR_MANUAL_MODE_UP_CNT         1u
+#define LHL4378_ASR_MODE_SEL_UP_CNT            1u
+#define LHL4378_ASR_LPPFM_MODE_UP_CNT          1u
+#define LHL4378_ASR_CLK4M_DIS_UP_CNT           0
+
+#define LHL4378_PFM_PWR_SLICE_DWN_CNT          5u
+#define LHL4378_ASR_OVERI_DIS_DWN_CNT          5u
+#define LHL4378_SRBG_REF_SEL_DWN_CNT           5u
+#define LHL4378_HPBG_PU_EN_DWN_CNT             6u
+
+#define LHL4378_PFM_PWR_SLICE_UP_CNT           1u
+#define LHL4378_ASR_OVERI_DIS_UP_CNT           1u
+#define LHL4378_SRBG_REF_SEL_UP_CNT            1u
+#define LHL4378_HPBG_PU_EN_UP_CNT              0
+
+#define        LHL4378_CSR_TRIM_ADJ_CNT_SHIFT          (16u)
+#define        LHL4378_CSR_TRIM_ADJ_CNT_MASK           (0x3Fu << LHL4378_CSR_TRIM_ADJ_CNT_SHIFT)
+#define LHL4378_CSR_TRIM_ADJ_DWN_CNT           0
+#define LHL4378_CSR_TRIM_ADJ_UP_CNT            0
+
+#define        LHL4378_ASR_TRIM_ADJ_CNT_SHIFT          (0u)
+#define        LHL4378_ASR_TRIM_ADJ_CNT_MASK           (0x3Fu << LHL4378_ASR_TRIM_ADJ_CNT_SHIFT)
+#define LHL4378_ASR_TRIM_ADJ_UP_CNT            0
+#define LHL4378_ASR_TRIM_ADJ_DWN_CNT           0
+
+#define LHL4378_PWRSW_EN_DWN_CNT               0
+#define LHL4378_SLB_EN_DWN_CNT                 2u
+#define LHL4378_ISO_EN_DWN_CNT                 1u
+
+#define LHL4378_VMUX_ASR_SEL_DWN_CNT           4u
+
+#define LHL4378_PWRSW_EN_UP_CNT                6u
+#define LHL4378_SLB_EN_UP_CNT                  4u
+#define LHL4378_ISO_EN_UP_CNT                  5u
+
+#define LHL4378_VMUX_ASR_SEL_UP_CNT            2u
+
+#define LHL4387_VMUX_ASR_SEL_DWN_CNT           (8u)
+#define LHL4387_VMUX_ASR_SEL_UP_CNT            (0x14u)
+
+/* MacResourceReqTimer0/1 */
+#define MAC_RSRC_REQ_TIMER_INT_ENAB_SHIFT      24
+#define MAC_RSRC_REQ_TIMER_FORCE_ALP_SHIFT     26
+#define MAC_RSRC_REQ_TIMER_FORCE_HT_SHIFT      27
+#define MAC_RSRC_REQ_TIMER_FORCE_HQ_SHIFT      28
+#define MAC_RSRC_REQ_TIMER_CLKREQ_GRP_SEL_SHIFT        29
+
+/* for pmu rev32 and higher */
+#define PMU32_MAC_MAIN_RSRC_REQ_TIMER  ((1 << MAC_RSRC_REQ_TIMER_INT_ENAB_SHIFT) |     \
+                                        (1 << MAC_RSRC_REQ_TIMER_FORCE_ALP_SHIFT) |    \
+                                        (1 << MAC_RSRC_REQ_TIMER_FORCE_HT_SHIFT) |     \
+                                        (1 << MAC_RSRC_REQ_TIMER_FORCE_HQ_SHIFT) |     \
+                                        (0 << MAC_RSRC_REQ_TIMER_CLKREQ_GRP_SEL_SHIFT))
+
+#define PMU32_MAC_AUX_RSRC_REQ_TIMER   ((1 << MAC_RSRC_REQ_TIMER_INT_ENAB_SHIFT) |     \
+                                        (1 << MAC_RSRC_REQ_TIMER_FORCE_ALP_SHIFT) |    \
+                                        (1 << MAC_RSRC_REQ_TIMER_FORCE_HT_SHIFT) |     \
+                                        (1 << MAC_RSRC_REQ_TIMER_FORCE_HQ_SHIFT) |     \
+                                        (0 << MAC_RSRC_REQ_TIMER_CLKREQ_GRP_SEL_SHIFT))
+
+/* for pmu rev38 and higher */
+#define PMU32_MAC_SCAN_RSRC_REQ_TIMER  ((1u << MAC_RSRC_REQ_TIMER_INT_ENAB_SHIFT) |    \
+                                        (1u << MAC_RSRC_REQ_TIMER_FORCE_ALP_SHIFT) |   \
+                                        (1u << MAC_RSRC_REQ_TIMER_FORCE_HT_SHIFT) |    \
+                                        (1u << MAC_RSRC_REQ_TIMER_FORCE_HQ_SHIFT) |    \
+                                        (0u << MAC_RSRC_REQ_TIMER_CLKREQ_GRP_SEL_SHIFT))
+
+/* 4369 related: 4369 parameters
+ * http://www.sj.broadcom.com/projects/BCM4369/gallery_backend.RC6.0/design/backplane/pmu_params.xls
+ */
+#define RES4369_DUMMY                          0
+#define RES4369_ABUCK                          1
+#define RES4369_PMU_SLEEP                      2
+#define RES4369_MISCLDO_PU                     3
+#define RES4369_LDO3P3_PU                      4
+#define RES4369_FAST_LPO_AVAIL                 5
+#define RES4369_XTAL_PU                                6
+#define RES4369_XTAL_STABLE                    7
+#define RES4369_PWRSW_DIG                      8
+#define RES4369_SR_DIG                         9
+#define RES4369_SLEEP_DIG                      10
+#define RES4369_PWRSW_AUX                      11
+#define RES4369_SR_AUX                         12
+#define RES4369_SLEEP_AUX                      13
+#define RES4369_PWRSW_MAIN                     14
+#define RES4369_SR_MAIN                                15
+#define RES4369_SLEEP_MAIN                     16
+#define RES4369_DIG_CORE_RDY                   17
+#define RES4369_CORE_RDY_AUX                   18
+#define RES4369_ALP_AVAIL                      19
+#define RES4369_RADIO_AUX_PU                   20
+#define RES4369_MINIPMU_AUX_PU                 21
+#define RES4369_CORE_RDY_MAIN                  22
+#define RES4369_RADIO_MAIN_PU                  23
+#define RES4369_MINIPMU_MAIN_PU                        24
+#define RES4369_PCIE_EP_PU                     25
+#define RES4369_COLD_START_WAIT                        26
+#define RES4369_ARMHTAVAIL                     27
+#define RES4369_HT_AVAIL                       28
+#define RES4369_MACPHY_AUX_CLK_AVAIL           29
+#define RES4369_MACPHY_MAIN_CLK_AVAIL          30
+#define RES4369_RESERVED_31                    31
+
+#define CST4369_CHIPMODE_SDIOD(cs)     (((cs) & (1 << 6)) != 0)        /* SDIO */
+#define CST4369_CHIPMODE_PCIE(cs)      (((cs) & (1 << 7)) != 0)        /* PCIE */
+#define CST4369_SPROM_PRESENT          0x00000010
+
+#define PMU_4369_MACCORE_0_RES_REQ_MASK                        0x3FCBF7FF
+#define PMU_4369_MACCORE_1_RES_REQ_MASK                        0x7FFB3647
+
+/* 4362 related */
+/* 4362 resource_table
+ * http://www.sj.broadcom.com/projects/BCM4362/gallery_backend.RC1.mar_15_2017/design/backplane/
+ * pmu_params.xls
+ */
+#define RES4362_DUMMY                          (0u)
+#define RES4362_ABUCK                          (1u)
+#define RES4362_PMU_SLEEP                      (2u)
+#define RES4362_MISCLDO_PU                     (3u)
+#define RES4362_LDO3P3_PU                      (4u)
+#define RES4362_FAST_LPO_AVAIL                 (5u)
+#define RES4362_XTAL_PU                                (6u)
+#define RES4362_XTAL_STABLE                    (7u)
+#define RES4362_PWRSW_DIG                      (8u)
+#define RES4362_SR_DIG                         (9u)
+#define RES4362_SLEEP_DIG                      (10u)
+#define RES4362_PWRSW_AUX                      (11u)
+#define RES4362_SR_AUX                         (12u)
+#define RES4362_SLEEP_AUX                      (13u)
+#define RES4362_PWRSW_MAIN                     (14u)
+#define RES4362_SR_MAIN                                (15u)
+#define RES4362_SLEEP_MAIN                     (16u)
+#define RES4362_DIG_CORE_RDY                   (17u)
+#define RES4362_CORE_RDY_AUX                   (18u)
+#define RES4362_ALP_AVAIL                      (19u)
+#define RES4362_RADIO_AUX_PU                   (20u)
+#define RES4362_MINIPMU_AUX_PU                 (21u)
+#define RES4362_CORE_RDY_MAIN                  (22u)
+#define RES4362_RADIO_MAIN_PU                  (23u)
+#define RES4362_MINIPMU_MAIN_PU                        (24u)
+#define RES4362_PCIE_EP_PU                     (25u)
+#define RES4362_COLD_START_WAIT                        (26u)
+#define RES4362_ARMHTAVAIL                     (27u)
+#define RES4362_HT_AVAIL                       (28u)
+#define RES4362_MACPHY_AUX_CLK_AVAIL           (29u)
+#define RES4362_MACPHY_MAIN_CLK_AVAIL          (30u)
+#define RES4362_RESERVED_31                    (31u)
+
+#define CST4362_CHIPMODE_SDIOD(cs)             (((cs) & (1 << 6)) != 0)        /* SDIO */
+#define CST4362_CHIPMODE_PCIE(cs)              (((cs) & (1 << 7)) != 0)        /* PCIE */
+#define CST4362_SPROM_PRESENT                  (0x00000010u)
+
+#define PMU_4362_MACCORE_0_RES_REQ_MASK                (0x3FCBF7FFu)
+#define PMU_4362_MACCORE_1_RES_REQ_MASK                (0x7FFB3647u)
+
+/* 4368 related */
+#define RES4368_ABUCK                  0
+#define RES4368_CBUCK                  1
+#define RES4368_MISCLDO_PU             2
+#define RES4368_VBOOST                 3
+#define RES4368_LDO3P3_PU              4
+#define RES4368_FAST_LPO_AVAIL         5
+#define RES4368_XTAL_PU                        6
+#define RES4368_XTAL_STABLE            7
+#define RES4368_PWRSW_DIG              8
+#define RES4368_SR_DIG                 9
+#define RES4368_SPARE10                        10
+#define RES4368_PWRSW_AUX              11
+#define RES4368_SR_AUX                 12
+#define RES4368_SPARE2                 13
+#define RES4368_PWRSW_MAIN             14
+#define RES4368_SR_MAIN                        15
+#define RES4368_ARMPLL_PWRUP           16
+#define RES4368_CORE_RDY_DIG           17
+#define RES4368_CORE_RDY_AUX           18
+#define RES4368_ALP_AVAIL              19
+#define RES4368_RADIO_AUX_PU           20
+#define RES4368_MINIPMU_AUX_PU         21
+#define RES4368_CORE_RDY_MAIN          22
+#define RES4368_RADIO_MAIN_PU          23
+#define RES4368_MINIPMU_MAIN_PU                24
+#define RES4368_PWRSW_CB               25
+#define RES4368_CORE_RDY_CB            26
+#define RES4368_ARMHTAVAIL             27
+#define RES4368_HT_AVAIL               28
+#define RES4368_MACPHY_AUX_CLK_AVAIL   29
+#define RES4368_MACPHY_MAIN_CLK_AVAIL  30
+#define RES4368_RESERVED_31            31
+
+#define PMU_MACCORE_0_RES_REQ_TIMER            0x1d000000
+#define PMU_MACCORE_0_RES_REQ_MASK             0x5FF2364F
+
+#define PMU43012_MAC_RES_REQ_TIMER             0x1D000000
+#define PMU43012_MAC_RES_REQ_MASK              0x3FBBF7FF
+
+#define PMU_MACCORE_1_RES_REQ_TIMER            0x1d000000
+#define PMU_MACCORE_1_RES_REQ_MASK             0x5FF2364F
+
+/* defines to detect active host interface in use */
+#define CHIP_HOSTIF_PCIEMODE   0x1
+#define CHIP_HOSTIF_USBMODE    0x2
+#define CHIP_HOSTIF_SDIOMODE   0x4
+#define CHIP_HOSTIF_PCIE(sih)  (si_chip_hostif(sih) == CHIP_HOSTIF_PCIEMODE)
+#define CHIP_HOSTIF_USB(sih)   (si_chip_hostif(sih) == CHIP_HOSTIF_USBMODE)
+#define CHIP_HOSTIF_SDIO(sih)  (si_chip_hostif(sih) == CHIP_HOSTIF_SDIOMODE)
+
+#define PATCHTBL_SIZE                  (0x800)
+#define CR4_4335_RAM_BASE                    (0x180000)
+#define CR4_4345_LT_C0_RAM_BASE              (0x1b0000)
+#define CR4_4345_GE_C0_RAM_BASE              (0x198000)
+#define CR4_4349_RAM_BASE                    (0x180000)
+#define CR4_4349_RAM_BASE_FROM_REV_9         (0x160000)
+#define CR4_4350_RAM_BASE                    (0x180000)
+#define CR4_4360_RAM_BASE                    (0x0)
+#define CR4_43602_RAM_BASE                   (0x180000)
+
+#define CR4_4347_RAM_BASE                    (0x170000)
+#define CR4_4362_RAM_BASE                    (0x170000)
+#define CR4_4364_RAM_BASE                    (0x160000)
+#define CR4_4369_RAM_BASE                    (0x170000)
+#define CR4_4377_RAM_BASE                    (0x170000)
+#define CR4_43751_RAM_BASE                   (0x170000)
+#define CR4_43752_RAM_BASE                   (0x170000)
+#define CR4_4376_RAM_BASE                    (0x352000)
+#define CR4_4378_RAM_BASE                    (0x352000)
+#define CR4_4387_RAM_BASE                    (0x740000)
+#define CR4_4385_RAM_BASE                    (0x740000)
+#define CA7_4368_RAM_BASE                    (0x200000)
+#define CA7_4389_RAM_BASE                    (0x200000)
+#define CA7_4385_RAM_BASE                    (0x200000)
+
+/* 43012 PMU resources based on pmu_params.xls  - Start */
+#define RES43012_MEMLPLDO_PU                   0
+#define RES43012_PMU_SLEEP                     1
+#define RES43012_FAST_LPO                      2
+#define RES43012_BTLPO_3P3                     3
+#define RES43012_SR_POK                                4
+#define RES43012_DUMMY_PWRSW                   5
+#define RES43012_DUMMY_LDO3P3                  6
+#define RES43012_DUMMY_BT_LDO3P3               7
+#define RES43012_DUMMY_RADIO                   8
+#define RES43012_VDDB_VDDRET                   9
+#define RES43012_HV_LDO3P3                     10
+#define RES43012_OTP_PU                                11
+#define RES43012_XTAL_PU                       12
+#define RES43012_SR_CLK_START                  13
+#define RES43012_XTAL_STABLE                   14
+#define RES43012_FCBS                          15
+#define RES43012_CBUCK_MODE                    16
+#define RES43012_CORE_READY                    17
+#define RES43012_ILP_REQ                       18
+#define RES43012_ALP_AVAIL                     19
+#define RES43012_RADIOLDO_1P8                  20
+#define RES43012_MINI_PMU                      21
+#define RES43012_UNUSED                                22
+#define RES43012_SR_SAVE_RESTORE               23
+#define RES43012_PHY_PWRSW                     24
+#define RES43012_VDDB_CLDO                     25
+#define RES43012_SUBCORE_PWRSW                 26
+#define RES43012_SR_SLEEP                      27
+#define RES43012_HT_START                      28
+#define RES43012_HT_AVAIL                      29
+#define RES43012_MACPHY_CLK_AVAIL              30
+#define CST43012_SPROM_PRESENT        0x00000010
+
+/* SR Control0 bits */
+#define SR0_43012_SR_ENG_EN_MASK             0x1
+#define SR0_43012_SR_ENG_EN_SHIFT            0
+#define SR0_43012_SR_ENG_CLK_EN              (1 << 1)
+#define SR0_43012_SR_RSRC_TRIGGER            (0xC << 2)
+#define SR0_43012_SR_WD_MEM_MIN_DIV          (0x3 << 6)
+#define SR0_43012_SR_MEM_STBY_ALLOW_MSK      (1 << 16)
+#define SR0_43012_SR_MEM_STBY_ALLOW_SHIFT    16
+#define SR0_43012_SR_ENABLE_ILP              (1 << 17)
+#define SR0_43012_SR_ENABLE_ALP              (1 << 18)
+#define SR0_43012_SR_ENABLE_HT               (1 << 19)
+#define SR0_43012_SR_ALLOW_PIC               (3 << 20)
+#define SR0_43012_SR_PMU_MEM_DISABLE         (1 << 30)
+#define CC_43012_VDDM_PWRSW_EN_MASK          (1 << 20)
+#define CC_43012_VDDM_PWRSW_EN_SHIFT         (20)
+#define CC_43012_SDIO_AOS_WAKEUP_MASK        (1 << 24)
+#define CC_43012_SDIO_AOS_WAKEUP_SHIFT       (24)
+
+/* 43012 - offset at 5K */
+#define SR1_43012_SR_INIT_ADDR_MASK          0x3ff
+#define SR1_43012_SR_ASM_ADDR                0xA
+
+/* PLL usage in 43012 */
+#define PMU43012_PLL0_PC0_NDIV_INT_MASK                        0x0000003f
+#define PMU43012_PLL0_PC0_NDIV_INT_SHIFT               0
+#define PMU43012_PLL0_PC0_NDIV_FRAC_MASK               0xfffffc00
+#define PMU43012_PLL0_PC0_NDIV_FRAC_SHIFT              10
+#define PMU43012_PLL0_PC3_PDIV_MASK                    0x00003c00
+#define PMU43012_PLL0_PC3_PDIV_SHIFT                   10
+#define PMU43012_PLL_NDIV_FRAC_BITS                    20
+#define PMU43012_PLL_P_DIV_SCALE_BITS                  10
+
+#define CCTL_43012_ARM_OFFCOUNT_MASK                   0x00000003
+#define CCTL_43012_ARM_OFFCOUNT_SHIFT                  0
+#define CCTL_43012_ARM_ONCOUNT_MASK                    0x0000000c
+#define CCTL_43012_ARM_ONCOUNT_SHIFT                   2
+
+/* PMU Rev >= 30 */
+#define PMU30_ALPCLK_ONEMHZ_ENAB                       0x80000000
+
+/* 43012 PMU Chip Control Registers */
+#define PMUCCTL02_43012_SUBCORE_PWRSW_FORCE_ON         0x00000010
+#define PMUCCTL02_43012_PHY_PWRSW_FORCE_ON             0x00000040
+#define PMUCCTL02_43012_LHL_TIMER_SELECT               0x00000800
+#define PMUCCTL02_43012_RFLDO3P3_PU_FORCE_ON           0x00008000
+#define PMUCCTL02_43012_WL2CDIG_I_PMU_SLEEP_ENAB       0x00010000
+#define PMUCCTL02_43012_BTLDO3P3_PU_FORCE_OFF          (1 << 12)
+
+#define PMUCCTL04_43012_BBPLL_ENABLE_PWRDN                     0x00100000
+#define PMUCCTL04_43012_BBPLL_ENABLE_PWROFF                    0x00200000
+#define PMUCCTL04_43012_FORCE_BBPLL_ARESET                     0x00400000
+#define PMUCCTL04_43012_FORCE_BBPLL_DRESET                     0x00800000
+#define PMUCCTL04_43012_FORCE_BBPLL_PWRDN                      0x01000000
+#define PMUCCTL04_43012_FORCE_BBPLL_ISOONHIGH                  0x02000000
+#define PMUCCTL04_43012_FORCE_BBPLL_PWROFF                     0x04000000
+#define PMUCCTL04_43012_DISABLE_LQ_AVAIL                       0x08000000
+#define PMUCCTL04_43012_DISABLE_HT_AVAIL                       0x10000000
+#define PMUCCTL04_43012_USE_LOCK                               0x20000000
+#define PMUCCTL04_43012_OPEN_LOOP_ENABLE                       0x40000000
+#define PMUCCTL04_43012_FORCE_OPEN_LOOP                                0x80000000
+#define PMUCCTL05_43012_DISABLE_SPM_CLK                                (1 << 8)
+#define PMUCCTL05_43012_RADIO_DIG_CLK_GATING_EN                        (1 << 14)
+#define PMUCCTL06_43012_GCI2RDIG_USE_ASYNCAPB                  (1 << 31)
+#define PMUCCTL08_43012_XTAL_CORE_SIZE_PMOS_NORMAL_MASK                0x00000FC0
+#define PMUCCTL08_43012_XTAL_CORE_SIZE_PMOS_NORMAL_SHIFT       6
+#define PMUCCTL08_43012_XTAL_CORE_SIZE_NMOS_NORMAL_MASK                0x00FC0000
+#define PMUCCTL08_43012_XTAL_CORE_SIZE_NMOS_NORMAL_SHIFT       18
+#define PMUCCTL08_43012_XTAL_SEL_BIAS_RES_NORMAL_MASK          0x07000000
+#define PMUCCTL08_43012_XTAL_SEL_BIAS_RES_NORMAL_SHIFT         24
+#define PMUCCTL09_43012_XTAL_CORESIZE_BIAS_ADJ_NORMAL_MASK     0x0003F000
+#define PMUCCTL09_43012_XTAL_CORESIZE_BIAS_ADJ_NORMAL_SHIFT    12
+#define PMUCCTL09_43012_XTAL_CORESIZE_RES_BYPASS_NORMAL_MASK   0x00000038
+#define PMUCCTL09_43012_XTAL_CORESIZE_RES_BYPASS_NORMAL_SHIFT  3
+
+#define PMUCCTL09_43012_XTAL_CORESIZE_BIAS_ADJ_STARTUP_MASK    0x00000FC0
+#define PMUCCTL09_43012_XTAL_CORESIZE_BIAS_ADJ_STARTUP_SHIFT   6
+/* during normal operation normal value is reduced for optimized power */
+#define PMUCCTL09_43012_XTAL_CORESIZE_BIAS_ADJ_STARTUP_VAL     0x1F
+
+#define PMUCCTL13_43012_FCBS_UP_TRIG_EN                                0x00000400
+
+#define PMUCCTL14_43012_ARMCM3_RESET_INITVAL                   0x00000001
+#define PMUCCTL14_43012_DOT11MAC_CLKEN_INITVAL                 0x00000020
+#define PMUCCTL14_43012_DOT11MAC_PHY_CLK_EN_INITVAL            0x00000080
+#define PMUCCTL14_43012_DOT11MAC_PHY_CNTL_EN_INITVAL           0x00000200
+#define PMUCCTL14_43012_SDIOD_RESET_INIVAL                     0x00000400
+#define PMUCCTL14_43012_SDIO_CLK_DMN_RESET_INITVAL             0x00001000
+#define PMUCCTL14_43012_SOCRAM_CLKEN_INITVAL                   0x00004000
+#define PMUCCTL14_43012_M2MDMA_RESET_INITVAL                   0x00008000
+#define PMUCCTL14_43012_DISABLE_LQ_AVAIL                       0x08000000
+
+#define VREG6_43012_MEMLPLDO_ADJ_MASK                          0x0000F000
+#define VREG6_43012_MEMLPLDO_ADJ_SHIFT                         12
+
+#define VREG6_43012_LPLDO_ADJ_MASK                             0x000000F0
+#define VREG6_43012_LPLDO_ADJ_SHIFT                            4
+
+#define VREG7_43012_PWRSW_1P8_PU_MASK                          0x00400000
+#define VREG7_43012_PWRSW_1P8_PU_SHIFT                         22
+
+/* 4378 PMU Chip Control Registers */
+#define PMUCCTL03_4378_XTAL_CORESIZE_PMOS_NORMAL_MASK          0x001F8000
+#define PMUCCTL03_4378_XTAL_CORESIZE_PMOS_NORMAL_SHIFT         15
+#define PMUCCTL03_4378_XTAL_CORESIZE_PMOS_NORMAL_VAL           0x3F
+
+#define PMUCCTL03_4378_XTAL_CORESIZE_NMOS_NORMAL_MASK          0x07E00000
+#define PMUCCTL03_4378_XTAL_CORESIZE_NMOS_NORMAL_SHIFT         21
+#define PMUCCTL03_4378_XTAL_CORESIZE_NMOS_NORMAL_VAL           0x3F
+
+#define PMUCCTL03_4378_XTAL_SEL_BIAS_RES_NORMAL_MASK           0x38000000
+#define PMUCCTL03_4378_XTAL_SEL_BIAS_RES_NORMAL_SHIFT          27
+#define PMUCCTL03_4378_XTAL_SEL_BIAS_RES_NORMAL_VAL                    0x0
+
+#define PMUCCTL00_4378_XTAL_CORESIZE_BIAS_ADJ_NORMAL_MASK      0x00000FC0
+#define PMUCCTL00_4378_XTAL_CORESIZE_BIAS_ADJ_NORMAL_SHIFT     6
+#define PMUCCTL00_4378_XTAL_CORESIZE_BIAS_ADJ_NORMAL_VAL       0x5
+
+#define PMUCCTL00_4378_XTAL_RES_BYPASS_NORMAL_MASK                     0x00038000
+#define PMUCCTL00_4378_XTAL_RES_BYPASS_NORMAL_SHIFT                    15
+#define PMUCCTL00_4378_XTAL_RES_BYPASS_NORMAL_VAL                      0x7
+
+/* 4387 PMU Chip Control Registers */
+#define PMUCCTL03_4387_XTAL_CORESIZE_PMOS_NORMAL_MASK          0x001F8000
+#define PMUCCTL03_4387_XTAL_CORESIZE_PMOS_NORMAL_SHIFT         15
+#define PMUCCTL03_4387_XTAL_CORESIZE_PMOS_NORMAL_VAL           0x3F
+
+#define PMUCCTL03_4387_XTAL_CORESIZE_NMOS_NORMAL_MASK          0x07E00000
+#define PMUCCTL03_4387_XTAL_CORESIZE_NMOS_NORMAL_SHIFT         21
+#define PMUCCTL03_4387_XTAL_CORESIZE_NMOS_NORMAL_VAL           0x3F
+
+#define PMUCCTL03_4387_XTAL_SEL_BIAS_RES_NORMAL_MASK           0x38000000
+#define PMUCCTL03_4387_XTAL_SEL_BIAS_RES_NORMAL_SHIFT          27
+#define PMUCCTL03_4387_XTAL_SEL_BIAS_RES_NORMAL_VAL                    0x0
+
+#define PMUCCTL00_4387_XTAL_CORESIZE_BIAS_ADJ_NORMAL_MASK      0x00000FC0
+#define PMUCCTL00_4387_XTAL_CORESIZE_BIAS_ADJ_NORMAL_SHIFT     6
+#define PMUCCTL00_4387_XTAL_CORESIZE_BIAS_ADJ_NORMAL_VAL       0x5
+
+#define PMUCCTL00_4387_XTAL_RES_BYPASS_NORMAL_MASK                     0x00038000
+#define PMUCCTL00_4387_XTAL_RES_BYPASS_NORMAL_SHIFT                    15
+#define PMUCCTL00_4387_XTAL_RES_BYPASS_NORMAL_VAL                      0x7
+
+/* GPIO pins */
+#define CC_PIN_GPIO_00 (0u)
+#define CC_PIN_GPIO_01 (1u)
+#define CC_PIN_GPIO_02 (2u)
+#define CC_PIN_GPIO_03 (3u)
+#define CC_PIN_GPIO_04 (4u)
+#define CC_PIN_GPIO_05 (5u)
+#define CC_PIN_GPIO_06 (6u)
+#define CC_PIN_GPIO_07 (7u)
+#define CC_PIN_GPIO_08 (8u)
+#define CC_PIN_GPIO_09 (9u)
+#define CC_PIN_GPIO_10 (10u)
+#define CC_PIN_GPIO_11 (11u)
+#define CC_PIN_GPIO_12 (12u)
+#define CC_PIN_GPIO_13 (13u)
+#define CC_PIN_GPIO_14 (14u)
+#define CC_PIN_GPIO_15 (15u)
+#define CC_PIN_GPIO_16 (16u)
+#define CC_PIN_GPIO_17 (17u)
+#define CC_PIN_GPIO_18 (18u)
+#define CC_PIN_GPIO_19 (19u)
+
+/* Last GPIO Pad */
+#define CC_PIN_GPIO_LAST (31u)
+
+/* GCI chipcontrol register indices */
+#define CC_GCI_CHIPCTRL_00     (0)
+#define CC_GCI_CHIPCTRL_01     (1)
+#define CC_GCI_CHIPCTRL_02     (2)
+#define CC_GCI_CHIPCTRL_03     (3)
+#define CC_GCI_CHIPCTRL_04     (4)
+#define CC_GCI_CHIPCTRL_05     (5)
+#define CC_GCI_CHIPCTRL_06     (6)
+#define CC_GCI_CHIPCTRL_07     (7)
+#define CC_GCI_CHIPCTRL_08     (8)
+#define CC_GCI_CHIPCTRL_09     (9)
+#define CC_GCI_CHIPCTRL_10     (10)
+#define CC_GCI_CHIPCTRL_10     (10)
+#define CC_GCI_CHIPCTRL_11     (11)
+#define CC_GCI_CHIPCTRL_12     (12)
+#define CC_GCI_CHIPCTRL_13     (13)
+#define CC_GCI_CHIPCTRL_14     (14)
+#define CC_GCI_CHIPCTRL_15     (15)
+#define CC_GCI_CHIPCTRL_16     (16)
+#define CC_GCI_CHIPCTRL_17     (17)
+#define CC_GCI_CHIPCTRL_18     (18)
+#define CC_GCI_CHIPCTRL_19     (19)
+#define CC_GCI_CHIPCTRL_20     (20)
+#define CC_GCI_CHIPCTRL_21     (21)
+#define CC_GCI_CHIPCTRL_22     (22)
+#define CC_GCI_CHIPCTRL_23     (23)
+#define CC_GCI_CHIPCTRL_24     (24)
+#define CC_GCI_CHIPCTRL_25     (25)
+#define CC_GCI_CHIPCTRL_26     (26)
+#define CC_GCI_CHIPCTRL_27     (27)
+#define CC_GCI_CHIPCTRL_28     (28)
+
+/* GCI chip ctrl SDTC Soft reset */
+#define GCI_CHIP_CTRL_SDTC_SOFT_RESET       (1 << 31)
+
+#define CC_GCI_XTAL_BUFSTRG_NFC (0xff << 12)
+
+#define CC_GCI_04_SDIO_DRVSTR_SHIFT    15
+#define CC_GCI_04_SDIO_DRVSTR_MASK     (0x0f << CC_GCI_04_SDIO_DRVSTR_SHIFT)   /* 0x00078000 */
+#define CC_GCI_04_SDIO_DRVSTR_OVERRIDE_BIT     (1 << 18)
+#define CC_GCI_04_SDIO_DRVSTR_DEFAULT_MA       14
+#define CC_GCI_04_SDIO_DRVSTR_MIN_MA   2
+#define CC_GCI_04_SDIO_DRVSTR_MAX_MA   16
+
+#define CC_GCI_04_4387C0_XTAL_PM_CLK   (1u << 20u)
+
+#define CC_GCI_CHIPCTRL_07_BTDEFLO_ANT0_NBIT   2u
+#define CC_GCI_CHIPCTRL_07_BTDEFLO_ANT0_MASK   0xFu
+#define CC_GCI_CHIPCTRL_07_BTDEFHI_ANT0_NBIT   11u
+#define CC_GCI_CHIPCTRL_07_BTDEFHI_ANT0_MASK   1u
+
+#define CC_GCI_CHIPCTRL_18_BTDEF_ANT0_NBIT             10u
+#define CC_GCI_CHIPCTRL_18_BTDEF_ANT0_MASK             0x1Fu
+#define CC_GCI_CHIPCTRL_18_BTDEFLO_ANT1_NBIT   15u
+#define CC_GCI_CHIPCTRL_18_BTDEFLO_ANT1_MASK   1u
+#define CC_GCI_CHIPCTRL_18_BTDEFHI_ANT1_NBIT   26u
+#define CC_GCI_CHIPCTRL_18_BTDEFHI_ANT1_MASK   0x3Fu
+
+#define CC_GCI_CHIPCTRL_19_BTDEF_ANT1_NBIT             10u
+#define CC_GCI_CHIPCTRL_19_BTDEF_ANT1_MASK             0x7u
+
+#define CC_GCI_CHIPCTRL_23_MAIN_WLSC_PRISEL_FORCE_NBIT         16u
+#define CC_GCI_CHIPCTRL_23_MAIN_WLSC_PRISEL_VAL_NBIT           17u
+#define CC_GCI_CHIPCTRL_23_AUX_WLSC_PRISEL_FORCE_NBIT          18u
+#define CC_GCI_CHIPCTRL_23_AUX_WLSC_PRISEL_VAL_NBIT            19u
+#define CC_GCI_CHIPCTRL_23_WLSC_BTSC_PRISEL_FORCE_NBIT         20u
+#define CC_GCI_CHIPCTRL_23_WLSC_BTSC_PRISEL_VAL_NBIT           21u
+#define CC_GCI_CHIPCTRL_23_WLSC_BTMAIN_PRISEL_FORCE_NBIT       22u
+#define CC_GCI_CHIPCTRL_23_WLSC_BTMAIN_PRISEL_VAL_NBIT         23u
+#define CC_GCI_CHIPCTRL_23_BTMAIN_BTSC_PRISEL_FORCE_NBIT       24u
+#define CC_GCI_CHIPCTRL_23_BTMAIN_BTSC_PRISEL_VAL_NBIT         25u
+
+#define CC_GCI_CHIPCTRL_23_MAIN_WLSC_PRISEL_FORCE_MASK (1u <<\
+                               CC_GCI_CHIPCTRL_23_MAIN_WLSC_PRISEL_FORCE_NBIT)
+#define CC_GCI_CHIPCTRL_23_MAIN_WLSC_PRISEL_VAL_MASK   (1u <<\
+                               CC_GCI_CHIPCTRL_23_MAIN_WLSC_PRISEL_VAL_NBIT)
+#define CC_GCI_CHIPCTRL_23_AUX_WLSC_PRISEL_FORCE_MASK  (1u <<\
+                               CC_GCI_CHIPCTRL_23_AUX_WLSC_PRISEL_FORCE_NBIT)
+#define CC_GCI_CHIPCTRL_23_AUX_WLSC_PRISEL_VAL_MASK    (1u <<\
+                               CC_GCI_CHIPCTRL_23_AUX_WLSC_PRISEL_VAL_NBIT)
+#define CC_GCI_CHIPCTRL_23_WLSC_BTSC_PRISEL_FORCE_MASK (1u <<\
+                               CC_GCI_CHIPCTRL_23_WLSC_BTSC_PRISEL_FORCE_NBIT)
+#define CC_GCI_CHIPCTRL_23_WLSC_BTSC_PRISEL_VAL_MASK   (1u <<\
+                               CC_GCI_CHIPCTRL_23_WLSC_BTSC_PRISEL_VAL_NBIT)
+#define CC_GCI_CHIPCTRL_23_WLSC_BTMAIN_PRISEL_FORCE_MASK       (1u <<\
+                               CC_GCI_CHIPCTRL_23_WLSC_BTMAIN_PRISEL_FORCE_NBIT)
+#define CC_GCI_CHIPCTRL_23_WLSC_BTMAIN_PRISEL_VAL_MASK (1u <<\
+                               CC_GCI_CHIPCTRL_23_WLSC_BTMAIN_PRISEL_VAL_NBIT)
+#define CC_GCI_CHIPCTRL_23_BTMAIN_BTSC_PRISEL_FORCE_MASK       (1u <<\
+                               CC_GCI_CHIPCTRL_23_BTMAIN_BTSC_PRISEL_FORCE_NBIT)
+#define CC_GCI_CHIPCTRL_23_BTMAIN_BTSC_PRISEL_VAL_MASK (1u <<\
+                               CC_GCI_CHIPCTRL_23_BTMAIN_BTSC_PRISEL_VAL_NBIT)
+
+/*     2G core0/core1 Pulse width register (offset : 0x47C)
+*      wl_rx_long_pulse_width_2g_core0 [4:0];
+*      wl_rx_short_pulse_width_2g_core0 [9:5];
+*      wl_rx_long_pulse_width_2g_core1  [20:16];
+*      wl_rx_short_pulse_width_2g_core1 [25:21];
+*/
+#define CC_GCI_CNCB_RESET_PULSE_WIDTH_2G_CORE1_NBIT    (16u)
+#define CC_GCI_CNCB_RESET_PULSE_WIDTH_2G_CORE0_MASK    (0x1Fu)
+#define CC_GCI_CNCB_RESET_PULSE_WIDTH_2G_CORE1_MASK    (0x1Fu <<\
+                               CC_GCI_CNCB_RESET_PULSE_WIDTH_2G_CORE1_NBIT)
+
+#define CC_GCI_CNCB_SHORT_RESET_PULSE_WIDTH_2G_CORE0_NBIT      (5u)
+#define CC_GCI_CNCB_LONG_RESET_PULSE_WIDTH_2G_CORE1_NBIT       (16u)
+#define CC_GCI_CNCB_SHORT_RESET_PULSE_WIDTH_2G_CORE1_NBIT      (21u)
+
+#define CC_GCI_CNCB_LONG_RESET_PULSE_WIDTH_2G_CORE0_MASK       (0x1Fu)
+#define CC_GCI_CNCB_LONG_RESET_PULSE_WIDTH_2G_CORE1_MASK       (0x1Fu <<\
+                               CC_GCI_CNCB_LONG_RESET_PULSE_WIDTH_2G_CORE1_NBIT)
+#define CC_GCI_CNCB_SHORT_RESET_PULSE_WIDTH_2G_CORE0_MASK      (0x1Fu <<\
+                               CC_GCI_CNCB_SHORT_RESET_PULSE_WIDTH_2G_CORE0_NBIT)
+#define CC_GCI_CNCB_SHORT_RESET_PULSE_WIDTH_2G_CORE1_MASK      (0x1Fu <<\
+                               CC_GCI_CNCB_SHORT_RESET_PULSE_WIDTH_2G_CORE1_NBIT)
+
+/*     5G core0/Core1 (offset : 0x480)
+*      wl_rx_long_pulse_width_5g[4:0];
+*      wl_rx_short_pulse_width_5g[9:5]
+*/
+
+#define CC_GCI_CNCB_SHORT_RESET_PULSE_WIDTH_5G_NBIT    (5u)
+
+#define CC_GCI_CNCB_LONG_RESET_PULSE_WIDTH_5G_MASK     (0x1Fu)
+#define CC_GCI_CNCB_SHORT_RESET_PULSE_WIDTH_5G_MASK    (0x1Fu <<\
+                               CC_GCI_CNCB_SHORT_RESET_PULSE_WIDTH_5G_NBIT)
+
+#define CC_GCI_CNCB_GLITCH_FILTER_WIDTH_MASK   (0xFFu)
+
+#define CC_GCI_06_JTAG_SEL_SHIFT       4
+#define CC_GCI_06_JTAG_SEL_MASK                (1 << 4)
+
+#define CC_GCI_NUMCHIPCTRLREGS(cap1)   ((cap1 & 0xF00) >> 8)
+
+#define CC_GCI_03_LPFLAGS_SFLASH_MASK          (0xFFFFFF << 8)
+#define CC_GCI_03_LPFLAGS_SFLASH_VAL           (0xCCCCCC << 8)
+
+#define CC_GCI_13_INSUFF_TREFUP_FIX_SHIFT      31
+/* Note: For 4368 B0 onwards, the shift offset remains the same,
+* but the Chip Common Ctrl GCI register is 16
+*/
+#define CC_GCI_16_INSUFF_TREFUP_FIX_SHIFT      31u
+
+#define GPIO_CTRL_REG_DISABLE_INTERRUPT                (3 << 9)
+#define GPIO_CTRL_REG_COUNT                    40
+
+#define XTAL_HQ_SETTING_4387   (0xFFF94D30u)
+#define XTAL_LQ_SETTING_4387   (0xFFF94380u)
+
+#define CC_GCI_16_BBPLL_CH_CTRL_GRP_PD_TRIG_1_MASK             (0x00000200u)
+#define CC_GCI_16_BBPLL_CH_CTRL_GRP_PD_TRIG_1_SHIFT            (9u)
+#define CC_GCI_16_BBPLL_CH_CTRL_GRP_PD_TRIG_24_3_MASK          (0xFFFFFC00u)
+#define CC_GCI_16_BBPLL_CH_CTRL_GRP_PD_TRIG_24_3_SHIFT         (10u)
+
+#define CC_GCI_17_BBPLL_CH_CTRL_GRP_PD_TRIG_30_25_MASK         (0x0000FC00u)
+#define CC_GCI_17_BBPLL_CH_CTRL_GRP_PD_TRIG_30_25_SHIFT                (10u)
+#define CC_GCI_17_BBPLL_CH_CTRL_EN_MASK                                (0x04000000u)
+
+#define CC_GCI_20_BBPLL_CH_CTRL_GRP_MASK                       (0xFC000000u)
+#define CC_GCI_20_BBPLL_CH_CTRL_GRP_SHIFT                      (26u)
+
+/* GCI Chip Ctrl Regs */
+#define GCI_CC28_IHRP_SEL_MASK                 (7 << 24)
+#define GCI_CC28_IHRP_SEL_SHIFT                        (24u)
+
+/* 30=MACPHY_CLK_MAIN, 29=MACPHY_CLK_AUX, 23=RADIO_PU_MAIN, 22=CORE_RDY_MAIN
+ * 20=RADIO_PU_AUX, 18=CORE_RDY_AUX, 14=PWRSW_MAIN, 11=PWRSW_AUX
+ */
+#define GRP_PD_TRIGGER_MASK_4387       (0x60d44800u)
+
+/* power down ch0=MAIN/AUX PHY_clk, ch2=MAIN/AUX MAC_clk, ch5=RFFE_clk */
+#define GRP_PD_MASK_4387               (0x25u)
+
+#define CC_GCI_CHIPCTRL_11_2x2_ANT_MASK                0x03
+#define CC_GCI_CHIPCTRL_11_SHIFT_ANT_MASK      26
+
+/* GCI chipstatus register indices */
+#define GCI_CHIPSTATUS_00      (0)
+#define GCI_CHIPSTATUS_01      (1)
+#define GCI_CHIPSTATUS_02      (2)
+#define GCI_CHIPSTATUS_03      (3)
+#define GCI_CHIPSTATUS_04      (4)
+#define GCI_CHIPSTATUS_05      (5)
+#define GCI_CHIPSTATUS_06      (6)
+#define GCI_CHIPSTATUS_07      (7)
+#define GCI_CHIPSTATUS_08      (8)
+#define GCI_CHIPSTATUS_09      (9)
+#define GCI_CHIPSTATUS_10      (10)
+#define GCI_CHIPSTATUS_11      (11)
+#define GCI_CHIPSTATUS_12      (12)
+#define GCI_CHIPSTATUS_13      (13)
+#define GCI_CHIPSTATUS_15      (15)
+
+/* 43021 GCI chipstatus registers */
+#define GCI43012_CHIPSTATUS_07_BBPLL_LOCK_MASK (1 << 3)
+
+/* GCI Core Control Reg */
+#define        GCI_CORECTRL_SR_MASK    (1 << 0)        /**< SECI block Reset */
+#define        GCI_CORECTRL_RSL_MASK   (1 << 1)        /**< ResetSECILogic */
+#define        GCI_CORECTRL_ES_MASK    (1 << 2)        /**< EnableSECI */
+#define        GCI_CORECTRL_FSL_MASK   (1 << 3)        /**< Force SECI Out Low */
+#define        GCI_CORECTRL_SOM_MASK   (7 << 4)        /**< SECI Op Mode */
+#define        GCI_CORECTRL_US_MASK    (1 << 7)        /**< Update SECI */
+#define        GCI_CORECTRL_BOS_MASK   (1 << 8)        /**< Break On Sleep */
+#define        GCI_CORECTRL_FORCEREGCLK_MASK   (1 << 18)       /* ForceRegClk */
+
+/* 4378 & 4387 GCI AVS function */
+#define GCI6_AVS_ENAB                  1u
+#define GCI6_AVS_ENAB_SHIFT            31u
+#define GCI6_AVS_ENAB_MASK             (1u << GCI6_AVS_ENAB_SHIFT)
+#define GCI6_AVS_CBUCK_VOLT_SHIFT      25u
+#define GCI6_AVS_CBUCK_VOLT_MASK       (0x1Fu << GCI6_AVS_CBUCK_VOLT_SHIFT)
+
+/* GCI GPIO for function sel GCI-0/GCI-1 */
+#define CC_GCI_GPIO_0                  (0)
+#define CC_GCI_GPIO_1                  (1)
+#define CC_GCI_GPIO_2                  (2)
+#define CC_GCI_GPIO_3                  (3)
+#define CC_GCI_GPIO_4                  (4)
+#define CC_GCI_GPIO_5                  (5)
+#define CC_GCI_GPIO_6                  (6)
+#define CC_GCI_GPIO_7                  (7)
+#define CC_GCI_GPIO_8                  (8)
+#define CC_GCI_GPIO_9                  (9)
+#define CC_GCI_GPIO_10                 (10)
+#define CC_GCI_GPIO_11                 (11)
+#define CC_GCI_GPIO_12                 (12)
+#define CC_GCI_GPIO_13                 (13)
+#define CC_GCI_GPIO_14                 (14)
+#define CC_GCI_GPIO_15                 (15)
+
+/* indicates Invalid GPIO, e.g. when PAD GPIO doesn't map to GCI GPIO */
+#define CC_GCI_GPIO_INVALID            0xFF
+
+/* 4378 LHL GPIO configuration */
+#define        LHL_IOCFG_P_ADDR_LHL_GPIO_DOUT_SEL_SHIFT        (3u)
+#define LHL_IOCFG_P_ADDR_LHL_GPIO_DOUT_SEL_MASK        (1u << LHL_IOCFG_P_ADDR_LHL_GPIO_DOUT_SEL_SHIFT)
+
+/* 4378 LHL SPMI bit definitions */
+#define LHL_LP_CTL5_SPMI_DATA_SEL_SHIFT                (8u)
+#define        LHL_LP_CTL5_SPMI_DATA_SEL_MASK          (0x3u << LHL_LP_CTL5_SPMI_CLK_DATA_SHIFT)
+#define LHL_LP_CTL5_SPMI_CLK_SEL_SHIFT         (6u)
+#define        LHL_LP_CTL5_SPMI_CLK_SEL_MASK           (0x3u << LHL_LP_CTL5_SPMI_CLK_SEL_SHIFT)
+#define        LHL_LP_CTL5_SPMI_CLK_DATA_GPIO0         (0u)
+#define        LHL_LP_CTL5_SPMI_CLK_DATA_GPIO1         (1u)
+#define        LHL_LP_CTL5_SPMI_CLK_DATA_GPIO2         (2u)
+
+/* Plese do not these following defines */
+/* find the 4 bit mask given the bit position */
+#define GCIMASK(pos)  (((uint32)0xF) << pos)
+/* get the value which can be used to directly OR with chipcontrol reg */
+#define GCIPOSVAL(val, pos)  ((((uint32)val) << pos) & GCIMASK(pos))
+/* Extract nibble from a given position */
+#define GCIGETNBL(val, pos)    ((val >> pos) & 0xF)
+
+/* find the 8 bit mask given the bit position */
+#define GCIMASK_8B(pos)  (((uint32)0xFF) << pos)
+/* get the value which can be used to directly OR with chipcontrol reg */
+#define GCIPOSVAL_8B(val, pos)  ((((uint32)val) << pos) & GCIMASK_8B(pos))
+/* Extract nibble from a given position */
+#define GCIGETNBL_8B(val, pos) ((val >> pos) & 0xFF)
+
+/* find the 4 bit mask given the bit position */
+#define GCIMASK_4B(pos)  (((uint32)0xF) << pos)
+/* get the value which can be used to directly OR with chipcontrol reg */
+#define GCIPOSVAL_4B(val, pos)  ((((uint32)val) << pos) & GCIMASK_4B(pos))
+/* Extract nibble from a given position */
+#define GCIGETNBL_4B(val, pos) ((val >> pos) & 0xF)
+
+/* GCI Intstatus(Mask)/WakeMask Register bits. */
+#define GCI_INTSTATUS_RBI      (1 << 0)        /**< Rx Break Interrupt */
+#define GCI_INTSTATUS_UB       (1 << 1)        /**< UART Break Interrupt */
+#define GCI_INTSTATUS_SPE      (1 << 2)        /**< SECI Parity Error Interrupt */
+#define GCI_INTSTATUS_SFE      (1 << 3)        /**< SECI Framing Error Interrupt */
+#define GCI_INTSTATUS_SRITI    (1 << 9)        /**< SECI Rx Idle Timer Interrupt */
+#define GCI_INTSTATUS_STFF     (1 << 10)       /**< SECI Tx FIFO Full Interrupt */
+#define GCI_INTSTATUS_STFAE    (1 << 11)       /**< SECI Tx FIFO Almost Empty Intr */
+#define GCI_INTSTATUS_SRFAF    (1 << 12)       /**< SECI Rx FIFO Almost Full */
+#define GCI_INTSTATUS_SRFNE    (1 << 14)       /**< SECI Rx FIFO Not Empty */
+#define GCI_INTSTATUS_SRFOF    (1 << 15)       /**< SECI Rx FIFO Not Empty Timeout */
+#define GCI_INTSTATUS_EVENT  (1 << 21)   /* GCI Event Interrupt */
+#define GCI_INTSTATUS_LEVELWAKE (1 << 22)   /* GCI Wake Level Interrupt */
+#define GCI_INTSTATUS_EVENTWAKE (1 << 23)   /* GCI Wake Event Interrupt */
+#define GCI_INTSTATUS_GPIOINT  (1 << 25)       /**< GCIGpioInt */
+#define GCI_INTSTATUS_GPIOWAKE (1 << 26)       /**< GCIGpioWake */
+#define GCI_INTSTATUS_LHLWLWAKE        (1 << 30)       /* LHL WL wake */
+
+/* GCI IntMask Register bits. */
+#define GCI_INTMASK_RBI                (1 << 0)        /**< Rx Break Interrupt */
+#define GCI_INTMASK_UB         (1 << 1)        /**< UART Break Interrupt */
+#define GCI_INTMASK_SPE                (1 << 2)        /**< SECI Parity Error Interrupt */
+#define GCI_INTMASK_SFE                (1 << 3)        /**< SECI Framing Error Interrupt */
+#define GCI_INTMASK_SRITI      (1 << 9)        /**< SECI Rx Idle Timer Interrupt */
+#define GCI_INTMASK_STFF       (1 << 10)       /**< SECI Tx FIFO Full Interrupt */
+#define GCI_INTMASK_STFAE      (1 << 11)       /**< SECI Tx FIFO Almost Empty Intr */
+#define GCI_INTMASK_SRFAF      (1 << 12)       /**< SECI Rx FIFO Almost Full */
+#define GCI_INTMASK_SRFNE      (1 << 14)       /**< SECI Rx FIFO Not Empty */
+#define GCI_INTMASK_SRFOF      (1 << 15)       /**< SECI Rx FIFO Not Empty Timeout */
+#define GCI_INTMASK_EVENT (1 << 21)   /* GCI Event Interrupt */
+#define GCI_INTMASK_LEVELWAKE   (1 << 22)   /* GCI Wake Level Interrupt */
+#define GCI_INTMASK_EVENTWAKE   (1 << 23)   /* GCI Wake Event Interrupt */
+#define GCI_INTMASK_GPIOINT    (1 << 25)       /**< GCIGpioInt */
+#define GCI_INTMASK_GPIOWAKE   (1 << 26)       /**< GCIGpioWake */
+#define GCI_INTMASK_LHLWLWAKE  (1 << 30)       /* LHL WL wake */
+
+/* GCI WakeMask Register bits. */
+#define GCI_WAKEMASK_RBI       (1 << 0)        /**< Rx Break Interrupt */
+#define GCI_WAKEMASK_UB                (1 << 1)        /**< UART Break Interrupt */
+#define GCI_WAKEMASK_SPE       (1 << 2)        /**< SECI Parity Error Interrupt */
+#define GCI_WAKEMASK_SFE       (1 << 3)        /**< SECI Framing Error Interrupt */
+#define GCI_WAKE_SRITI         (1 << 9)        /**< SECI Rx Idle Timer Interrupt */
+#define GCI_WAKEMASK_STFF      (1 << 10)       /**< SECI Tx FIFO Full Interrupt */
+#define GCI_WAKEMASK_STFAE     (1 << 11)       /**< SECI Tx FIFO Almost Empty Intr */
+#define GCI_WAKEMASK_SRFAF     (1 << 12)       /**< SECI Rx FIFO Almost Full */
+#define GCI_WAKEMASK_SRFNE     (1 << 14)       /**< SECI Rx FIFO Not Empty */
+#define GCI_WAKEMASK_SRFOF     (1 << 15)       /**< SECI Rx FIFO Not Empty Timeout */
+#define GCI_WAKEMASK_EVENT   (1 << 21)   /* GCI Event Interrupt */
+#define GCI_WAKEMASK_LEVELWAKE  (1 << 22)   /* GCI Wake Level Interrupt */
+#define GCI_WAKEMASK_EVENTWAKE  (1 << 23)   /* GCI Wake Event Interrupt */
+#define GCI_WAKEMASK_GPIOINT   (1 << 25)       /**< GCIGpioInt */
+#define GCI_WAKEMASK_GPIOWAKE  (1 << 26)       /**< GCIGpioWake */
+#define GCI_WAKEMASK_LHLWLWAKE (1 << 30)       /* LHL WL wake */
+
+#define        GCI_WAKE_ON_GCI_GPIO1   1
+#define        GCI_WAKE_ON_GCI_GPIO2   2
+#define        GCI_WAKE_ON_GCI_GPIO3   3
+#define        GCI_WAKE_ON_GCI_GPIO4   4
+#define        GCI_WAKE_ON_GCI_GPIO5   5
+#define        GCI_WAKE_ON_GCI_GPIO6   6
+#define        GCI_WAKE_ON_GCI_GPIO7   7
+#define        GCI_WAKE_ON_GCI_GPIO8   8
+#define        GCI_WAKE_ON_GCI_SECI_IN 9
+
+#define        PMU_EXT_WAKE_MASK_0_SDIO                (1u << 2u)
+#define        PMU_EXT_WAKE_MASK_0_PCIE_PERST          (1u << 5u)
+
+#define PMU_4362_EXT_WAKE_MASK_0_SDIO          (1u << 1u | 1u << 2u)
+
+/* =========== LHL regs =========== */
+#define LHL_PWRSEQCTL_SLEEP_EN                 (1 << 0)
+#define LHL_PWRSEQCTL_PMU_SLEEP_MODE           (1 << 1)
+#define LHL_PWRSEQCTL_PMU_FINAL_PMU_SLEEP_EN   (1 << 2)
+#define LHL_PWRSEQCTL_PMU_TOP_ISO_EN           (1 << 3)
+#define LHL_PWRSEQCTL_PMU_TOP_SLB_EN           (1 << 4)
+#define LHL_PWRSEQCTL_PMU_TOP_PWRSW_EN         (1 << 5)
+#define LHL_PWRSEQCTL_PMU_CLDO_PD              (1 << 6)
+#define LHL_PWRSEQCTL_PMU_LPLDO_PD             (1 << 7)
+#define LHL_PWRSEQCTL_PMU_RSRC6_EN             (1 << 8)
+
+#define PMU_SLEEP_MODE_0       (LHL_PWRSEQCTL_SLEEP_EN |\
+                               LHL_PWRSEQCTL_PMU_FINAL_PMU_SLEEP_EN)
+
+#define PMU_SLEEP_MODE_1       (LHL_PWRSEQCTL_SLEEP_EN |\
+                                 LHL_PWRSEQCTL_PMU_SLEEP_MODE |\
+                                 LHL_PWRSEQCTL_PMU_FINAL_PMU_SLEEP_EN |\
+                                 LHL_PWRSEQCTL_PMU_TOP_ISO_EN |\
+                                 LHL_PWRSEQCTL_PMU_TOP_SLB_EN |\
+                                 LHL_PWRSEQCTL_PMU_TOP_PWRSW_EN |\
+                                 LHL_PWRSEQCTL_PMU_CLDO_PD |\
+                                 LHL_PWRSEQCTL_PMU_RSRC6_EN)
+
+#define PMU_SLEEP_MODE_2       (LHL_PWRSEQCTL_SLEEP_EN |\
+                                 LHL_PWRSEQCTL_PMU_SLEEP_MODE |\
+                                 LHL_PWRSEQCTL_PMU_FINAL_PMU_SLEEP_EN |\
+                                 LHL_PWRSEQCTL_PMU_TOP_ISO_EN |\
+                                 LHL_PWRSEQCTL_PMU_TOP_SLB_EN |\
+                                 LHL_PWRSEQCTL_PMU_TOP_PWRSW_EN |\
+                                 LHL_PWRSEQCTL_PMU_CLDO_PD |\
+                                 LHL_PWRSEQCTL_PMU_LPLDO_PD |\
+                                 LHL_PWRSEQCTL_PMU_RSRC6_EN)
+
+#define LHL_PWRSEQ_CTL                         (0x000000ff)
+
+/* LHL Top Level Power Up Control Register (lhl_top_pwrup_ctl_adr, Offset 0xE78)
+* Top Level Counter values for isolation, retention, Power Switch control
+*/
+#define LHL_PWRUP_ISOLATION_CNT                        (0x6 << 8)
+#define LHL_PWRUP_RETENTION_CNT                        (0x5 << 16)
+#define LHL_PWRUP_PWRSW_CNT                    (0x7 << 24)
+/* Mask is taken only for isolation 8:13 , Retention 16:21 ,
+* Power Switch control 24:29
+*/
+#define LHL_PWRUP_CTL_MASK                     (0x3F3F3F00)
+#define LHL_PWRUP_CTL                          (LHL_PWRUP_ISOLATION_CNT |\
+                                               LHL_PWRUP_RETENTION_CNT |\
+                                               LHL_PWRUP_PWRSW_CNT)
+
+#define LHL_PWRUP2_CLDO_DN_CNT                 (0x0)
+#define LHL_PWRUP2_LPLDO_DN_CNT                        (0x0 << 8)
+#define LHL_PWRUP2_RSRC6_DN_CN                 (0x4 << 16)
+#define LHL_PWRUP2_RSRC7_DN_CN                 (0x0 << 24)
+#define LHL_PWRUP2_CTL_MASK                    (0x3F3F3F3F)
+#define LHL_PWRUP2_CTL                         (LHL_PWRUP2_CLDO_DN_CNT |\
+                                               LHL_PWRUP2_LPLDO_DN_CNT |\
+                                               LHL_PWRUP2_RSRC6_DN_CN |\
+                                               LHL_PWRUP2_RSRC7_DN_CN)
+
+/* LHL Top Level Power Down Control Register (lhl_top_pwrdn_ctl_adr, Offset 0xE74) */
+#define LHL_PWRDN_SLEEP_CNT                    (0x4)
+#define LHL_PWRDN_CTL_MASK                     (0x3F)
+
+/* LHL Top Level Power Down Control 2 Register (lhl_top_pwrdn2_ctl_adr, Offset 0xE80) */
+#define LHL_PWRDN2_CLDO_DN_CNT                 (0x4)
+#define LHL_PWRDN2_LPLDO_DN_CNT                        (0x4 << 8)
+#define LHL_PWRDN2_RSRC6_DN_CN                 (0x3 << 16)
+#define LHL_PWRDN2_RSRC7_DN_CN                 (0x0 << 24)
+#define LHL_PWRDN2_CTL                         (LHL_PWRDN2_CLDO_DN_CNT |\
+                                               LHL_PWRDN2_LPLDO_DN_CNT |\
+                                               LHL_PWRDN2_RSRC6_DN_CN |\
+                                               LHL_PWRDN2_RSRC7_DN_CN)
+#define LHL_PWRDN2_CTL_MASK                    (0x3F3F3F3F)
+
+#define LHL_FAST_WRITE_EN                      (1 << 14)
+
+#define LHL_WL_MACTIMER_MASK                   0xFFFFFFFF
+
+/* WL ARM Timer0 Interrupt Mask (lhl_wl_armtim0_intrp_adr) */
+#define LHL_WL_ARMTIM0_INTRP_EN                        0x00000001
+#define LHL_WL_ARMTIM0_INTRP_EDGE_TRIGGER      0x00000002
+
+/* WL ARM Timer0 Interrupt Status (lhl_wl_armtim0_st_adr) */
+#define LHL_WL_ARMTIM0_ST_WL_ARMTIM_INT_ST     0x00000001
+
+/* WL MAC TimerX Interrupt Mask (lhl_wl_mactimX_intrp_adr) */
+#define LHL_WL_MACTIM_INTRP_EN                 0x00000001
+#define LHL_WL_MACTIM_INTRP_EDGE_TRIGGER       0x00000002
+
+/* WL MAC TimerX Interrupt Status (lhl_wl_mactimX_st_adr) */
+#define LHL_WL_MACTIM_ST_WL_MACTIM_INT_ST      0x00000001
+
+/* LHL Wakeup Status (lhl_wkup_status_adr) */
+#define LHL_WKUP_STATUS_WR_PENDING_ARMTIM0     0x00100000
+
+#define LHL_PS_MODE_0  0
+#define LHL_PS_MODE_1  1
+
+/* GCI EventIntMask Register SW bits */
+#define GCI_MAILBOXDATA_TOWLAN (1 << 0)
+#define GCI_MAILBOXDATA_TOBT           (1 << 1)
+#define GCI_MAILBOXDATA_TONFC          (1 << 2)
+#define GCI_MAILBOXDATA_TOGPS          (1 << 3)
+#define GCI_MAILBOXDATA_TOLTE          (1 << 4)
+#define GCI_MAILBOXACK_TOWLAN          (1 << 8)
+#define GCI_MAILBOXACK_TOBT            (1 << 9)
+#define GCI_MAILBOXACK_TONFC           (1 << 10)
+#define GCI_MAILBOXACK_TOGPS           (1 << 11)
+#define GCI_MAILBOXACK_TOLTE           (1 << 12)
+#define GCI_WAKE_TOWLAN                                (1 << 16)
+#define GCI_WAKE_TOBT                          (1 << 17)
+#define GCI_WAKE_TONFC                         (1 << 18)
+#define GCI_WAKE_TOGPS                         (1 << 19)
+#define GCI_WAKE_TOLTE                         (1 << 20)
+#define GCI_SWREADY                                    (1 << 24)
+
+/* GCI SECI_OUT TX Status Regiser bits */
+#define GCI_SECIOUT_TXSTATUS_TXHALT            (1 << 0)
+#define GCI_SECIOUT_TXSTATUS_TI                        (1 << 16)
+
+/* 43012 MUX options */
+#define MUXENAB43012_HOSTWAKE_MASK     (0x00000001)
+#define MUXENAB43012_GETIX(val, name) (val - 1)
+
+/*
+* Maximum delay for the PMU state transition in us.
+* This is an upper bound intended for spinwaits etc.
+*/
+#define PMU_MAX_TRANSITION_DLY 15000
+
+/* PMU resource up transition time in ILP cycles */
+#define PMURES_UP_TRANSITION   2
+
+/* SECI Status (0x134) & Mask (0x138) bits - Rev 35 */
+#define SECI_STAT_BI   (1 << 0)        /* Break Interrupt */
+#define SECI_STAT_SPE  (1 << 1)        /* Parity Error */
+#define SECI_STAT_SFE  (1 << 2)        /* Parity Error */
+#define SECI_STAT_SDU  (1 << 3)        /* Data Updated */
+#define SECI_STAT_SADU (1 << 4)        /* Auxiliary Data Updated */
+#define SECI_STAT_SAS  (1 << 6)        /* AUX State */
+#define SECI_STAT_SAS2 (1 << 7)        /* AUX2 State */
+#define SECI_STAT_SRITI        (1 << 8)        /* Idle Timer Interrupt */
+#define SECI_STAT_STFF (1 << 9)        /* Tx FIFO Full */
+#define SECI_STAT_STFAE        (1 << 10)       /* Tx FIFO Almost Empty */
+#define SECI_STAT_SRFE (1 << 11)       /* Rx FIFO Empty */
+#define SECI_STAT_SRFAF        (1 << 12)       /* Rx FIFO Almost Full */
+#define SECI_STAT_SFCE (1 << 13)       /* Flow Control Event */
+
+/* SECI configuration */
+#define SECI_MODE_UART                 0x0
+#define SECI_MODE_SECI                 0x1
+#define SECI_MODE_LEGACY_3WIRE_BT      0x2
+#define SECI_MODE_LEGACY_3WIRE_WLAN    0x3
+#define SECI_MODE_HALF_SECI            0x4
+
+#define SECI_RESET             (1 << 0)
+#define SECI_RESET_BAR_UART    (1 << 1)
+#define SECI_ENAB_SECI_ECI     (1 << 2)
+#define SECI_ENAB_SECIOUT_DIS  (1 << 3)
+#define SECI_MODE_MASK         0x7
+#define SECI_MODE_SHIFT                4 /* (bits 5, 6, 7) */
+#define SECI_UPD_SECI          (1 << 7)
+
+#define SECI_AUX_TX_START       (1 << 31)
+#define SECI_SLIP_ESC_CHAR     0xDB
+#define SECI_SIGNOFF_0         SECI_SLIP_ESC_CHAR
+#define SECI_SIGNOFF_1     0
+#define SECI_REFRESH_REQ       0xDA
+
+/* seci clk_ctl_st bits */
+#define CLKCTL_STS_HT_AVAIL_REQ                (1 << 4)
+#define CLKCTL_STS_SECI_CLK_REQ                (1 << 8)
+#define CLKCTL_STS_SECI_CLK_AVAIL      (1 << 24)
+
+#define SECI_UART_MSR_CTS_STATE                (1 << 0)
+#define SECI_UART_MSR_RTS_STATE                (1 << 1)
+#define SECI_UART_SECI_IN_STATE                (1 << 2)
+#define SECI_UART_SECI_IN2_STATE       (1 << 3)
+
+/* GCI RX FIFO Control Register */
+#define        GCI_RXF_LVL_MASK        (0xFF << 0)
+#define        GCI_RXF_TIMEOUT_MASK    (0xFF << 8)
+
+/* GCI UART Registers' Bit definitions */
+/* Seci Fifo Level Register */
+#define        SECI_TXF_LVL_MASK       (0x3F << 8)
+#define        TXF_AE_LVL_DEFAULT      0x4
+#define        SECI_RXF_LVL_FC_MASK    (0x3F << 16)
+
+/* SeciUARTFCR Bit definitions */
+#define        SECI_UART_FCR_RFR               (1 << 0)
+#define        SECI_UART_FCR_TFR               (1 << 1)
+#define        SECI_UART_FCR_SR                (1 << 2)
+#define        SECI_UART_FCR_THP               (1 << 3)
+#define        SECI_UART_FCR_AB                (1 << 4)
+#define        SECI_UART_FCR_ATOE              (1 << 5)
+#define        SECI_UART_FCR_ARTSOE            (1 << 6)
+#define        SECI_UART_FCR_ABV               (1 << 7)
+#define        SECI_UART_FCR_ALM               (1 << 8)
+
+/* SECI UART LCR register bits */
+#define SECI_UART_LCR_STOP_BITS                (1 << 0) /* 0 - 1bit, 1 - 2bits */
+#define SECI_UART_LCR_PARITY_EN                (1 << 1)
+#define SECI_UART_LCR_PARITY           (1 << 2) /* 0 - odd, 1 - even */
+#define SECI_UART_LCR_RX_EN            (1 << 3)
+#define SECI_UART_LCR_LBRK_CTRL                (1 << 4) /* 1 => SECI_OUT held low */
+#define SECI_UART_LCR_TXO_EN           (1 << 5)
+#define SECI_UART_LCR_RTSO_EN          (1 << 6)
+#define SECI_UART_LCR_SLIPMODE_EN      (1 << 7)
+#define SECI_UART_LCR_RXCRC_CHK                (1 << 8)
+#define SECI_UART_LCR_TXCRC_INV                (1 << 9)
+#define SECI_UART_LCR_TXCRC_LSBF       (1 << 10)
+#define SECI_UART_LCR_TXCRC_EN         (1 << 11)
+#define        SECI_UART_LCR_RXSYNC_EN         (1 << 12)
+
+#define SECI_UART_MCR_TX_EN            (1 << 0)
+#define SECI_UART_MCR_PRTS             (1 << 1)
+#define SECI_UART_MCR_SWFLCTRL_EN      (1 << 2)
+#define SECI_UART_MCR_HIGHRATE_EN      (1 << 3)
+#define SECI_UART_MCR_LOOPBK_EN                (1 << 4)
+#define SECI_UART_MCR_AUTO_RTS         (1 << 5)
+#define SECI_UART_MCR_AUTO_TX_DIS      (1 << 6)
+#define SECI_UART_MCR_BAUD_ADJ_EN      (1 << 7)
+#define SECI_UART_MCR_XONOFF_RPT       (1 << 9)
+
+/* SeciUARTLSR Bit Mask */
+#define        SECI_UART_LSR_RXOVR_MASK        (1 << 0)
+#define        SECI_UART_LSR_RFF_MASK          (1 << 1)
+#define        SECI_UART_LSR_TFNE_MASK         (1 << 2)
+#define        SECI_UART_LSR_TI_MASK           (1 << 3)
+#define        SECI_UART_LSR_TPR_MASK          (1 << 4)
+#define        SECI_UART_LSR_TXHALT_MASK       (1 << 5)
+
+/* SeciUARTMSR Bit Mask */
+#define        SECI_UART_MSR_CTSS_MASK         (1 << 0)
+#define        SECI_UART_MSR_RTSS_MASK         (1 << 1)
+#define        SECI_UART_MSR_SIS_MASK          (1 << 2)
+#define        SECI_UART_MSR_SIS2_MASK         (1 << 3)
+
+/* SeciUARTData Bits */
+#define SECI_UART_DATA_RF_NOT_EMPTY_BIT        (1 << 12)
+#define SECI_UART_DATA_RF_FULL_BIT     (1 << 13)
+#define SECI_UART_DATA_RF_OVRFLOW_BIT  (1 << 14)
+#define        SECI_UART_DATA_FIFO_PTR_MASK    0xFF
+#define        SECI_UART_DATA_RF_RD_PTR_SHIFT  16
+#define        SECI_UART_DATA_RF_WR_PTR_SHIFT  24
+
+/* LTECX: ltecxmux */
+#define LTECX_EXTRACT_MUX(val, idx)    (getbit4(&(val), (idx)))
+
+/* LTECX: ltecxmux MODE */
+#define LTECX_MUX_MODE_IDX             0
+#define LTECX_MUX_MODE_WCI2            0x0
+#define LTECX_MUX_MODE_GPIO            0x1
+
+/* LTECX GPIO Information Index */
+#define LTECX_NVRAM_FSYNC_IDX  0
+#define LTECX_NVRAM_LTERX_IDX  1
+#define LTECX_NVRAM_LTETX_IDX  2
+#define LTECX_NVRAM_WLPRIO_IDX 3
+
+/* LTECX WCI2 Information Index */
+#define LTECX_NVRAM_WCI2IN_IDX 0
+#define LTECX_NVRAM_WCI2OUT_IDX        1
+
+/* LTECX: Macros to get GPIO/FNSEL/GCIGPIO */
+#define LTECX_EXTRACT_PADNUM(val, idx) (getbit8(&(val), (idx)))
+#define LTECX_EXTRACT_FNSEL(val, idx)  (getbit4(&(val), (idx)))
+#define LTECX_EXTRACT_GCIGPIO(val, idx)        (getbit4(&(val), (idx)))
+
+/* WLAN channel numbers - used from wifi.h */
+
+/* WLAN BW */
+#define ECI_BW_20   0x0
+#define ECI_BW_25   0x1
+#define ECI_BW_30   0x2
+#define ECI_BW_35   0x3
+#define ECI_BW_40   0x4
+#define ECI_BW_45   0x5
+#define ECI_BW_50   0x6
+#define ECI_BW_ALL  0x7
+
+/* WLAN - number of antenna */
+#define WLAN_NUM_ANT1 TXANT_0
+#define WLAN_NUM_ANT2 TXANT_1
+
+/* otpctrl1 0xF4 */
+#define OTPC_FORCE_PWR_OFF     0x02000000
+/* chipcommon s/r registers introduced with cc rev >= 48 */
+#define CC_SR_CTL0_ENABLE_MASK             0x1
+#define CC_SR_CTL0_ENABLE_SHIFT              0
+#define CC_SR_CTL0_EN_SR_ENG_CLK_SHIFT       1 /* sr_clk to sr_memory enable */
+#define CC_SR_CTL0_RSRC_TRIGGER_SHIFT        2 /* Rising edge resource trigger 0 to sr_engine  */
+#define CC_SR_CTL0_MIN_DIV_SHIFT             6 /* Min division value for fast clk in sr_engine */
+#define CC_SR_CTL0_EN_SBC_STBY_SHIFT        16 /* Allow Subcore mem StandBy? */
+#define CC_SR_CTL0_EN_SR_ALP_CLK_MASK_SHIFT 18
+#define CC_SR_CTL0_EN_SR_HT_CLK_SHIFT       19
+#define CC_SR_CTL0_ALLOW_PIC_SHIFT          20 /* Allow pic to separate power domains */
+#define CC_SR_CTL0_MAX_SR_LQ_CLK_CNT_SHIFT  25
+#define CC_SR_CTL0_EN_MEM_DISABLE_FOR_SLEEP 30
+
+#define CC_SR_CTL1_SR_INIT_MASK             0x3FF
+#define CC_SR_CTL1_SR_INIT_SHIFT            0
+
+#define        ECI_INLO_PKTDUR_MASK    0x000000f0 /* [7:4] - 4 bits */
+#define ECI_INLO_PKTDUR_SHIFT  4
+
+/* gci chip control bits */
+#define GCI_GPIO_CHIPCTRL_ENAB_IN_BIT          0
+#define GCI_GPIO_CHIPCTRL_ENAB_OP_BIT          1
+#define GCI_GPIO_CHIPCTRL_INVERT_BIT           2
+#define GCI_GPIO_CHIPCTRL_PULLUP_BIT           3
+#define GCI_GPIO_CHIPCTRL_PULLDN_BIT           4
+#define GCI_GPIO_CHIPCTRL_ENAB_BTSIG_BIT       5
+#define GCI_GPIO_CHIPCTRL_ENAB_OD_OP_BIT       6
+#define GCI_GPIO_CHIPCTRL_ENAB_EXT_GPIO_BIT    7
+
+/* gci GPIO input status bits */
+#define GCI_GPIO_STS_VALUE_BIT                 0
+#define GCI_GPIO_STS_POS_EDGE_BIT              1
+#define GCI_GPIO_STS_NEG_EDGE_BIT              2
+#define GCI_GPIO_STS_FAST_EDGE_BIT             3
+#define GCI_GPIO_STS_CLEAR                     0xF
+
+#define GCI_GPIO_STS_EDGE_TRIG_BIT                     0
+#define GCI_GPIO_STS_NEG_EDGE_TRIG_BIT         1
+#define GCI_GPIO_STS_DUAL_EDGE_TRIG_BIT                2
+#define GCI_GPIO_STS_WL_DIN_SELECT             6
+
+#define GCI_GPIO_STS_VALUE     (1 << GCI_GPIO_STS_VALUE_BIT)
+
+/* SR Power Control */
+#define SRPWR_DMN0_PCIE                        (0)                             /* PCIE */
+#define SRPWR_DMN0_PCIE_SHIFT          (SRPWR_DMN0_PCIE)               /* PCIE */
+#define SRPWR_DMN0_PCIE_MASK           (1 << SRPWR_DMN0_PCIE_SHIFT)    /* PCIE */
+#define SRPWR_DMN1_ARMBPSD             (1)                             /* ARM/BP/SDIO */
+#define SRPWR_DMN1_ARMBPSD_SHIFT       (SRPWR_DMN1_ARMBPSD)            /* ARM/BP/SDIO */
+#define SRPWR_DMN1_ARMBPSD_MASK                (1 << SRPWR_DMN1_ARMBPSD_SHIFT) /* ARM/BP/SDIO */
+#define SRPWR_DMN2_MACAUX              (2)                             /* MAC/Phy Aux */
+#define SRPWR_DMN2_MACAUX_SHIFT                (SRPWR_DMN2_MACAUX)             /* MAC/Phy Aux */
+#define SRPWR_DMN2_MACAUX_MASK         (1 << SRPWR_DMN2_MACAUX_SHIFT)  /* MAC/Phy Aux */
+#define SRPWR_DMN3_MACMAIN             (3)                             /* MAC/Phy Main */
+#define SRPWR_DMN3_MACMAIN_SHIFT       (SRPWR_DMN3_MACMAIN)            /* MAC/Phy Main */
+#define SRPWR_DMN3_MACMAIN_MASK                (1 << SRPWR_DMN3_MACMAIN_SHIFT) /* MAC/Phy Main */
+
+#define SRPWR_DMN4_MACSCAN             (4)                             /* MAC/Phy Scan */
+#define SRPWR_DMN4_MACSCAN_SHIFT       (SRPWR_DMN4_MACSCAN)            /* MAC/Phy Scan */
+#define SRPWR_DMN4_MACSCAN_MASK                (1 << SRPWR_DMN4_MACSCAN_SHIFT) /* MAC/Phy Scan */
+
+#define SRPWR_DMN_MAX          (5)
+/* all power domain mask */
+#define SRPWR_DMN_ALL_MASK(sih)                si_srpwr_domain_all_mask(sih)
+
+#define SRPWR_REQON_SHIFT              (8)     /* PowerOnRequest[11:8] */
+#define SRPWR_REQON_MASK(sih)          (SRPWR_DMN_ALL_MASK(sih) << SRPWR_REQON_SHIFT)
+
+#define SRPWR_STATUS_SHIFT             (16)    /* ExtPwrStatus[19:16], RO */
+#define SRPWR_STATUS_MASK(sih)         (SRPWR_DMN_ALL_MASK(sih) << SRPWR_STATUS_SHIFT)
+
+#define SRPWR_BT_STATUS_SHIFT          (20)    /* PowerDomain[20:21], RO */
+#define SRPWR_BT_STATUS_MASK           (0x3)
+
+#define SRPWR_DMN_ID_SHIFT             (28)    /* PowerDomain[31:28], RO */
+#define SRPWR_DMN_ID_MASK              (0xF)
+
+#define SRPWR_UP_DOWN_DELAY            100     /* more than 3 ILP clocks */
+
+/* PMU Precision Usec Timer */
+#define PMU_PREC_USEC_TIMER_ENABLE     0x1
+
+/* Random Number/Bit Generator defines */
+#define        MASK_1BIT(offset)                       (0x1u << offset)
+
+#define        CC_RNG_CTRL_0_RBG_EN_SHIFT              (0u)
+#define        CC_RNG_CTRL_0_RBG_EN_MASK               (0x1FFFu << CC_RNG_CTRL_0_RBG_EN_SHIFT)
+#define        CC_RNG_CTRL_0_RBG_EN                    (0x1FFFu)
+#define CC_RNG_CTRL_0_RBG_DEV_CTRL_SHIFT       (12u)
+#define CC_RNG_CTRL_0_RBG_DEV_CTRL_MASK                (0x3u << CC_RNG_CTRL_0_RBG_DEV_CTRL_SHIFT)
+#define CC_RNG_CTRL_0_RBG_DEV_CTRL_1MHz                (0x3u << CC_RNG_CTRL_0_RBG_DEV_CTRL_SHIFT)
+#define CC_RNG_CTRL_0_RBG_DEV_CTRL_2MHz                (0x2u << CC_RNG_CTRL_0_RBG_DEV_CTRL_SHIFT)
+#define CC_RNG_CTRL_0_RBG_DEV_CTRL_4MHz                (0x1u << CC_RNG_CTRL_0_RBG_DEV_CTRL_SHIFT)
+#define CC_RNG_CTRL_0_RBG_DEV_CTRL_8MHz                (0x0u << CC_RNG_CTRL_0_RBG_DEV_CTRL_SHIFT)
+
+/* RNG_FIFO_COUNT */
+/* RFC - RNG FIFO COUNT */
+#define CC_RNG_FIFO_COUNT_RFC_SHIFT            (0u)
+#define CC_RNG_FIFO_COUNT_RFC_MASK             (0xFFu << CC_RNG_FIFO_COUNT_RFC_SHIFT)
+
+/* RNG interrupt */
+#define CC_RNG_TOT_BITS_CNT_IRQ_SHIFT          (0u)
+#define CC_RNG_TOT_BITS_CNT_IRQ_MASK           (0x1u << CC_RNG_TOT_BITS_CNT_IRQ_SHIFT)
+#define CC_RNG_TOT_BITS_MAX_IRQ_SHIFT          (1u)
+#define CC_RNG_TOT_BITS_MAX_IRQ_MASK           (0x1u << CC_RNG_TOT_BITS_MAX_IRQ_SHIFT)
+#define CC_RNG_FIFO_FULL_IRQ_SHIFT             (2u)
+#define CC_RNG_FIFO_FULL_IRQ_MASK              (0x1u << CC_RNG_FIFO_FULL_IRQ_SHIFT)
+#define CC_RNG_FIFO_OVER_RUN_IRQ_SHIFT         (3u)
+#define CC_RNG_FIFO_OVER_RUN_IRQ_MASK          (0x1u << CC_RNG_FIFO_OVER_RUN_IRQ_SHIFT)
+#define CC_RNG_FIFO_UNDER_RUN_IRQ_SHIFT                (4u)
+#define CC_RNG_FIFO_UNDER_RUN_IRQ_MASK         (0x1u << CC_RNG_FIFO_UNDER_RUN_IRQ_SHIFT)
+#define CC_RNG_NIST_FAIL_IRQ_SHIFT             (5u)
+#define CC_RNG_NIST_FAIL_IRQ_MASK              (0x1u << CC_RNG_NIST_FAIL_IRQ_SHIFT)
+#define        CC_RNG_STARTUP_TRANSITION_MET_IRQ_SHIFT (17u)
+#define        CC_RNG_STARTUP_TRANSITION_MET_IRQ_MASK  (0x1u << \
+                                               CC_RNG_STARTUP_TRANSITION_MET_IRQ_SHIFT)
+#define        CC_RNG_MASTER_FAIL_LOCKOUT_IRQ_SHIFT    (31u)
+#define        CC_RNG_MASTER_FAIL_LOCKOUT_IRQ_MASK     (0x1u << \
+                                               CC_RNG_MASTER_FAIL_LOCKOUT_IRQ_SHIFT)
+
+/* FISCtrlStatus */
+#define PMU_CLEAR_FIS_DONE_SHIFT       1u
+#define PMU_CLEAR_FIS_DONE_MASK        (1u << PMU_CLEAR_FIS_DONE_SHIFT)
+
+#define PMU_FIS_FORCEON_ALL_SHIFT      4u
+#define PMU_FIS_FORCEON_ALL_MASK       (1u << PMU_FIS_FORCEON_ALL_SHIFT)
+
+#define PMU_FIS_DN_TIMER_VAL_SHIFT     16u
+#define PMU_FIS_DN_TIMER_VAL_MASK      0x7FFF0000u
+
+#define PMU_FIS_DN_TIMER_VAL_4378      0x2f80u /* micro second */
+#define PMU_FIS_DN_TIMER_VAL_4389      0x3f80u /* micro second */
+
+#define PMU_FIS_PCIE_SAVE_EN_SHIFT     5u
+#define PMU_FIS_PCIE_SAVE_EN_VALUE     (1u << PMU_FIS_PCIE_SAVE_EN_SHIFT)
+
+#define PMU_REG6_RFLDO_CTRL              0x000000E0
+#define PMU_REG6_RFLDO_CTRL_SHFT         5
+
+#define PMU_REG6_BTLDO_CTRL              0x0000E000
+#define PMU_REG6_BTLDO_CTRL_SHFT         13
+#endif /* _SBCHIPC_H */
diff --git a/bcmdhd.101.10.240.x/include/sbconfig.h b/bcmdhd.101.10.240.x/include/sbconfig.h
new file mode 100644 (file)
index 0000000..283eb0e
--- /dev/null
@@ -0,0 +1,279 @@
+/*
+ * Broadcom SiliconBackplane hardware register definitions.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _SBCONFIG_H
+#define        _SBCONFIG_H
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define        _PADLINE(line)  pad ## line
+#define        _XSTR(line)     _PADLINE(line)
+#define        PAD             _XSTR(__LINE__)
+#endif
+
+/* enumeration in SB is based on the premise that cores are contiguous in the
+ * enumeration space.
+ */
+#define SB_BUS_SIZE            0x10000         /**< Each bus gets 64Kbytes for cores */
+#define SB_BUS_BASE(sih, b)            (SI_ENUM_BASE(sih) + (b) * SB_BUS_SIZE)
+#define        SB_BUS_MAXCORES         (SB_BUS_SIZE / SI_CORE_SIZE)    /**< Max cores per bus */
+
+/*
+ * Sonics Configuration Space Registers.
+ */
+#define        SBCONFIGOFF             0xf00           /**< core sbconfig regs are top 256bytes of regs */
+#define        SBCONFIGSIZE            256             /**< sizeof (sbconfig_t) */
+
+#define SBIPSFLAG              0x08
+#define SBTPSFLAG              0x18
+#define        SBTMERRLOGA             0x48            /**< sonics >= 2.3 */
+#define        SBTMERRLOG              0x50            /**< sonics >= 2.3 */
+#define SBADMATCH3             0x60
+#define SBADMATCH2             0x68
+#define SBADMATCH1             0x70
+#define SBIMSTATE              0x90
+#define SBINTVEC               0x94
+#define SBTMSTATELOW           0x98
+#define SBTMSTATEHIGH          0x9c
+#define SBBWA0                 0xa0
+#define SBIMCONFIGLOW          0xa8
+#define SBIMCONFIGHIGH         0xac
+#define SBADMATCH0             0xb0
+#define SBTMCONFIGLOW          0xb8
+#define SBTMCONFIGHIGH         0xbc
+#define SBBCONFIG              0xc0
+#define SBBSTATE               0xc8
+#define SBACTCNFG              0xd8
+#define        SBFLAGST                0xe8
+#define SBIDLOW                        0xf8
+#define SBIDHIGH               0xfc
+
+/* All the previous registers are above SBCONFIGOFF, but with Sonics 2.3, we have
+ * a few registers *below* that line. I think it would be very confusing to try
+ * and change the value of SBCONFIGOFF, so I'm definig them as absolute offsets here,
+ */
+
+#define SBIMERRLOGA            0xea8
+#define SBIMERRLOG             0xeb0
+#define SBTMPORTCONNID0                0xed8
+#define SBTMPORTLOCK0          0xef8
+
+#if !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__)
+
+typedef volatile struct _sbconfig {
+       uint32  PAD[2];
+       uint32  sbipsflag;              /**< initiator port ocp slave flag */
+       uint32  PAD[3];
+       uint32  sbtpsflag;              /**< target port ocp slave flag */
+       uint32  PAD[11];
+       uint32  sbtmerrloga;            /**< (sonics >= 2.3) */
+       uint32  PAD;
+       uint32  sbtmerrlog;             /**< (sonics >= 2.3) */
+       uint32  PAD[3];
+       uint32  sbadmatch3;             /**< address match3 */
+       uint32  PAD;
+       uint32  sbadmatch2;             /**< address match2 */
+       uint32  PAD;
+       uint32  sbadmatch1;             /**< address match1 */
+       uint32  PAD[7];
+       uint32  sbimstate;              /**< initiator agent state */
+       uint32  sbintvec;               /**< interrupt mask */
+       uint32  sbtmstatelow;           /**< target state */
+       uint32  sbtmstatehigh;          /**< target state */
+       uint32  sbbwa0;                 /**< bandwidth allocation table0 */
+       uint32  PAD;
+       uint32  sbimconfiglow;          /**< initiator configuration */
+       uint32  sbimconfighigh;         /**< initiator configuration */
+       uint32  sbadmatch0;             /**< address match0 */
+       uint32  PAD;
+       uint32  sbtmconfiglow;          /**< target configuration */
+       uint32  sbtmconfighigh;         /**< target configuration */
+       uint32  sbbconfig;              /**< broadcast configuration */
+       uint32  PAD;
+       uint32  sbbstate;               /**< broadcast state */
+       uint32  PAD[3];
+       uint32  sbactcnfg;              /**< activate configuration */
+       uint32  PAD[3];
+       uint32  sbflagst;               /**< current sbflags */
+       uint32  PAD[3];
+       uint32  sbidlow;                /**< identification */
+       uint32  sbidhigh;               /**< identification */
+} sbconfig_t;
+
+#endif /* !_LANGUAGE_ASSEMBLY && !__ASSEMBLY__ */
+
+/* sbipsflag */
+#define        SBIPS_INT1_MASK         0x3f            /**< which sbflags get routed to mips interrupt 1 */
+#define        SBIPS_INT1_SHIFT        0
+#define        SBIPS_INT2_MASK         0x3f00          /**< which sbflags get routed to mips interrupt 2 */
+#define        SBIPS_INT2_SHIFT        8
+#define        SBIPS_INT3_MASK         0x3f0000        /**< which sbflags get routed to mips interrupt 3 */
+#define        SBIPS_INT3_SHIFT        16
+#define        SBIPS_INT4_MASK         0x3f000000      /**< which sbflags get routed to mips interrupt 4 */
+#define        SBIPS_INT4_SHIFT        24
+
+/* sbtpsflag */
+#define        SBTPS_NUM0_MASK         0x3f            /**< interrupt sbFlag # generated by this core */
+#define        SBTPS_F0EN0             0x40            /**< interrupt is always sent on the backplane */
+
+/* sbtmerrlog */
+#define        SBTMEL_CM               0x00000007      /**< command */
+#define        SBTMEL_CI               0x0000ff00      /**< connection id */
+#define        SBTMEL_EC               0x0f000000      /**< error code */
+#define        SBTMEL_ME               0x80000000      /**< multiple error */
+
+/* sbimstate */
+#define        SBIM_PC                 0xf             /**< pipecount */
+#define        SBIM_AP_MASK            0x30            /**< arbitration policy */
+#define        SBIM_AP_BOTH            0x00            /**< use both timeslaces and token */
+#define        SBIM_AP_TS              0x10            /**< use timesliaces only */
+#define        SBIM_AP_TK              0x20            /**< use token only */
+#define        SBIM_AP_RSV             0x30            /**< reserved */
+#define        SBIM_IBE                0x20000         /**< inbanderror */
+#define        SBIM_TO                 0x40000         /**< timeout */
+#define        SBIM_BY                 0x01800000      /**< busy (sonics >= 2.3) */
+#define        SBIM_RJ                 0x02000000      /**< reject (sonics >= 2.3) */
+
+/* sbtmstatelow */
+#define        SBTML_RESET             0x0001          /**< reset */
+#define        SBTML_REJ_MASK          0x0006          /**< reject field */
+#define        SBTML_REJ               0x0002          /**< reject */
+#define        SBTML_TMPREJ            0x0004          /**< temporary reject, for error recovery */
+
+#define        SBTML_SICF_SHIFT        16      /**< Shift to locate the SI control flags in sbtml */
+
+/* sbtmstatehigh */
+#define        SBTMH_SERR              0x0001          /**< serror */
+#define        SBTMH_INT               0x0002          /**< interrupt */
+#define        SBTMH_BUSY              0x0004          /**< busy */
+#define        SBTMH_TO                0x0020          /**< timeout (sonics >= 2.3) */
+
+#define        SBTMH_SISF_SHIFT        16              /**< Shift to locate the SI status flags in sbtmh */
+
+/* sbbwa0 */
+#define        SBBWA_TAB0_MASK         0xffff          /**< lookup table 0 */
+#define        SBBWA_TAB1_MASK         0xffff          /**< lookup table 1 */
+#define        SBBWA_TAB1_SHIFT        16
+
+/* sbimconfiglow */
+#define        SBIMCL_STO_MASK         0x7             /**< service timeout */
+#define        SBIMCL_RTO_MASK         0x70            /**< request timeout */
+#define        SBIMCL_RTO_SHIFT        4
+#define        SBIMCL_CID_MASK         0xff0000        /**< connection id */
+#define        SBIMCL_CID_SHIFT        16
+
+/* sbimconfighigh */
+#define        SBIMCH_IEM_MASK         0xc             /**< inband error mode */
+#define        SBIMCH_TEM_MASK         0x30            /**< timeout error mode */
+#define        SBIMCH_TEM_SHIFT        4
+#define        SBIMCH_BEM_MASK         0xc0            /**< bus error mode */
+#define        SBIMCH_BEM_SHIFT        6
+
+/* sbadmatch0 */
+#define        SBAM_TYPE_MASK          0x3             /**< address type */
+#define        SBAM_AD64               0x4             /**< reserved */
+#define        SBAM_ADINT0_MASK        0xf8            /**< type0 size */
+#define        SBAM_ADINT0_SHIFT       3
+#define        SBAM_ADINT1_MASK        0x1f8           /**< type1 size */
+#define        SBAM_ADINT1_SHIFT       3
+#define        SBAM_ADINT2_MASK        0x1f8           /**< type2 size */
+#define        SBAM_ADINT2_SHIFT       3
+#define        SBAM_ADEN               0x400           /**< enable */
+#define        SBAM_ADNEG              0x800           /**< negative decode */
+#define        SBAM_BASE0_MASK         0xffffff00      /**< type0 base address */
+#define        SBAM_BASE0_SHIFT        8
+#define        SBAM_BASE1_MASK         0xfffff000      /**< type1 base address for the core */
+#define        SBAM_BASE1_SHIFT        12
+#define        SBAM_BASE2_MASK         0xffff0000      /**< type2 base address for the core */
+#define        SBAM_BASE2_SHIFT        16
+
+/* sbtmconfiglow */
+#define        SBTMCL_CD_MASK          0xff            /**< clock divide */
+#define        SBTMCL_CO_MASK          0xf800          /**< clock offset */
+#define        SBTMCL_CO_SHIFT         11
+#define        SBTMCL_IF_MASK          0xfc0000        /**< interrupt flags */
+#define        SBTMCL_IF_SHIFT         18
+#define        SBTMCL_IM_MASK          0x3000000       /**< interrupt mode */
+#define        SBTMCL_IM_SHIFT         24
+
+/* sbtmconfighigh */
+#define        SBTMCH_BM_MASK          0x3             /**< busy mode */
+#define        SBTMCH_RM_MASK          0x3             /**< retry mode */
+#define        SBTMCH_RM_SHIFT         2
+#define        SBTMCH_SM_MASK          0x30            /**< stop mode */
+#define        SBTMCH_SM_SHIFT         4
+#define        SBTMCH_EM_MASK          0x300           /**< sb error mode */
+#define        SBTMCH_EM_SHIFT         8
+#define        SBTMCH_IM_MASK          0xc00           /**< int mode */
+#define        SBTMCH_IM_SHIFT         10
+
+/* sbbconfig */
+#define        SBBC_LAT_MASK           0x3             /**< sb latency */
+#define        SBBC_MAX0_MASK          0xf0000         /**< maxccntr0 */
+#define        SBBC_MAX0_SHIFT         16
+#define        SBBC_MAX1_MASK          0xf00000        /**< maxccntr1 */
+#define        SBBC_MAX1_SHIFT         20
+
+/* sbbstate */
+#define        SBBS_SRD                0x1             /**< st reg disable */
+#define        SBBS_HRD                0x2             /**< hold reg disable */
+
+/* sbidlow */
+#define        SBIDL_CS_MASK           0x3             /**< config space */
+#define        SBIDL_AR_MASK           0x38            /**< # address ranges supported */
+#define        SBIDL_AR_SHIFT          3
+#define        SBIDL_SYNCH             0x40            /**< sync */
+#define        SBIDL_INIT              0x80            /**< initiator */
+#define        SBIDL_MINLAT_MASK       0xf00           /**< minimum backplane latency */
+#define        SBIDL_MINLAT_SHIFT      8
+#define        SBIDL_MAXLAT            0xf000          /**< maximum backplane latency */
+#define        SBIDL_MAXLAT_SHIFT      12
+#define        SBIDL_FIRST             0x10000         /**< this initiator is first */
+#define        SBIDL_CW_MASK           0xc0000         /**< cycle counter width */
+#define        SBIDL_CW_SHIFT          18
+#define        SBIDL_TP_MASK           0xf00000        /**< target ports */
+#define        SBIDL_TP_SHIFT          20
+#define        SBIDL_IP_MASK           0xf000000       /**< initiator ports */
+#define        SBIDL_IP_SHIFT          24
+#define        SBIDL_RV_MASK           0xf0000000      /**< sonics backplane revision code */
+#define        SBIDL_RV_SHIFT          28
+#define        SBIDL_RV_2_2            0x00000000      /**< version 2.2 or earlier */
+#define        SBIDL_RV_2_3            0x10000000      /**< version 2.3 */
+
+/* sbidhigh */
+#define        SBIDH_RC_MASK           0x000f          /**< revision code */
+#define        SBIDH_RCE_MASK          0x7000          /**< revision code extension field */
+#define        SBIDH_RCE_SHIFT         8
+#define        SBCOREREV(sbidh) \
+       ((((sbidh) & SBIDH_RCE_MASK) >> SBIDH_RCE_SHIFT) | ((sbidh) & SBIDH_RC_MASK))
+#define        SBIDH_CC_MASK           0x8ff0          /**< core code */
+#define        SBIDH_CC_SHIFT          4
+#define        SBIDH_VC_MASK           0xffff0000      /**< vendor code */
+#define        SBIDH_VC_SHIFT          16
+
+#define        SB_COMMIT               0xfd8           /**< update buffered registers value */
+
+/* vendor codes */
+#define        SB_VEND_BCM             0x4243          /**< Broadcom's SB vendor code */
+
+#endif /* _SBCONFIG_H */
diff --git a/bcmdhd.101.10.240.x/include/sbgci.h b/bcmdhd.101.10.240.x/include/sbgci.h
new file mode 100644 (file)
index 0000000..a212725
--- /dev/null
@@ -0,0 +1,337 @@
+/*
+ * SiliconBackplane GCI core hardware definitions
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _SBGCI_H
+#define _SBGCI_H
+
+#include <bcmutils.h>
+
+#if !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__)
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define        _PADLINE(line)  pad ## line
+#define        _XSTR(line)     _PADLINE(line)
+#define        PAD             _XSTR(__LINE__)
+#endif /* PAD */
+
+#define GCI_OFFSETOF(sih, reg) \
+       (AOB_ENAB(sih) ? OFFSETOF(gciregs_t, reg) : OFFSETOF(chipcregs_t, reg))
+#define GCI_CORE_IDX(sih) (AOB_ENAB(sih) ? si_findcoreidx(sih, GCI_CORE_ID, 0) : SI_CC_IDX)
+
+typedef volatile struct {
+       uint32 gci_corecaps0;                           /* 0x000 */
+       uint32 gci_corecaps1;                           /* 0x004 */
+       uint32 gci_corecaps2;                           /* 0x008 */
+       uint32 gci_corectrl;                            /* 0x00c */
+       uint32 gci_corestat;                            /* 0x010 */
+       uint32 gci_intstat;                             /* 0x014 */
+       uint32 gci_intmask;                             /* 0x018 */
+       uint32 gci_wakemask;                            /* 0x01c */
+       uint32 gci_levelintstat;                        /* 0x020 */
+       uint32 gci_eventintstat;                        /* 0x024 */
+       uint32 gci_wakelevelintstat;                    /* 0x028 */
+       uint32 gci_wakeeventintstat;                    /* 0x02c */
+       uint32 semaphoreintstatus;                      /* 0x030 */
+       uint32 semaphoreintmask;                        /* 0x034 */
+       uint32 semaphorerequest;                        /* 0x038 */
+       uint32 semaphorereserve;                        /* 0x03c */
+       uint32 gci_indirect_addr;                       /* 0x040 */
+       uint32 gci_gpioctl;                             /* 0x044 */
+       uint32 gci_gpiostatus;                          /* 0x048 */
+       uint32 gci_gpiomask;                            /* 0x04c */
+       uint32 gci_eventsummary;                        /* 0x050 */
+       uint32 gci_miscctl;                             /* 0x054 */
+       uint32 gci_gpiointmask;                         /* 0x058 */
+       uint32 gci_gpiowakemask;                        /* 0x05c */
+       uint32 gci_input[32];                           /* 0x060 */
+       uint32 gci_event[32];                           /* 0x0e0 */
+       uint32 gci_output[4];                           /* 0x160 */
+       uint32 gci_control_0;                           /* 0x170 */
+       uint32 gci_control_1;                           /* 0x174 */
+       uint32 gci_intpolreg;                           /* 0x178 */
+       uint32 gci_levelintmask;                        /* 0x17c */
+       uint32 gci_eventintmask;                        /* 0x180 */
+       uint32 wakelevelintmask;                        /* 0x184 */
+       uint32 wakeeventintmask;                        /* 0x188 */
+       uint32 hwmask;                                  /* 0x18c */
+       uint32 PAD;
+       uint32 gci_inbandeventintmask;                  /* 0x194 */
+       uint32 PAD;
+       uint32 gci_inbandeventstatus;                   /* 0x19c */
+       uint32 gci_seciauxtx;                           /* 0x1a0 */
+       uint32 gci_seciauxrx;                           /* 0x1a4 */
+       uint32 gci_secitx_datatag;                      /* 0x1a8 */
+       uint32 gci_secirx_datatag;                      /* 0x1ac */
+       uint32 gci_secitx_datamask;                     /* 0x1b0 */
+       uint32 gci_seciusef0tx_reg;                     /* 0x1b4 */
+       uint32 gci_secif0tx_offset;                     /* 0x1b8 */
+       uint32 gci_secif0rx_offset;                     /* 0x1bc */
+       uint32 gci_secif1tx_offset;                     /* 0x1c0 */
+       uint32 gci_rxfifo_common_ctrl;                  /* 0x1c4 */
+       uint32 gci_rxfifoctrl;                          /* 0x1c8 */
+       uint32 gci_hw_sema_status;                      /* 0x1cc */
+       uint32 gci_seciuartescval;                      /* 0x1d0 */
+       uint32 gic_seciuartautobaudctr;                 /* 0x1d4 */
+       uint32 gci_secififolevel;                       /* 0x1d8 */
+       uint32 gci_seciuartdata;                        /* 0x1dc */
+       uint32 gci_secibauddiv;                         /* 0x1e0 */
+       uint32 gci_secifcr;                             /* 0x1e4 */
+       uint32 gci_secilcr;                             /* 0x1e8 */
+       uint32 gci_secimcr;                             /* 0x1ec */
+       uint32 gci_secilsr;                             /* 0x1f0 */
+       uint32 gci_secimsr;                             /* 0x1f4 */
+       uint32 gci_baudadj;                             /* 0x1f8 */
+       uint32 gci_inbandintmask;                       /* 0x1fc */
+       uint32 gci_chipctrl;                            /* 0x200 */
+       uint32 gci_chipsts;                             /* 0x204 */
+       uint32 gci_gpioout;                             /* 0x208 */
+       uint32 gci_gpioout_read;                        /* 0x20C */
+       uint32 gci_mpwaketx;                            /* 0x210 */
+       uint32 gci_mpwakedetect;                        /* 0x214 */
+       uint32 gci_seciin_ctrl;                         /* 0x218 */
+       uint32 gci_seciout_ctrl;                        /* 0x21C */
+       uint32 gci_seciin_auxfifo_en;                   /* 0x220 */
+       uint32 gci_seciout_txen_txbr;                   /* 0x224 */
+       uint32 gci_seciin_rxbrstatus;                   /* 0x228 */
+       uint32 gci_seciin_rxerrstatus;                  /* 0x22C */
+       uint32 gci_seciin_fcstatus;                     /* 0x230 */
+       uint32 gci_seciout_txstatus;                    /* 0x234 */
+       uint32 gci_seciout_txbrstatus;                  /* 0x238 */
+       uint32 wlan_mem_info;                           /* 0x23C */
+       uint32 wlan_bankxinfo;                          /* 0x240 */
+       uint32 bt_smem_select;                          /* 0x244 */
+       uint32 bt_smem_stby;                            /* 0x248 */
+       uint32 bt_smem_status;                          /* 0x24C */
+       uint32 wlan_bankxactivepda;                     /* 0x250 */
+       uint32 wlan_bankxsleeppda;                      /* 0x254 */
+       uint32 wlan_bankxkill;                          /* 0x258 */
+       uint32 reset_override;                          /* 0x25C */
+       uint32 ip_id;                                   /* 0x260 */
+       uint32 lpo_safe_zone;                           /* 0x264 */
+       uint32 function_sel_control_and_status;         /* 0x268 */
+       uint32 bt_smem_control0;                        /* 0x26C */
+       uint32 bt_smem_control1;                        /* 0x270 */
+       uint32 PAD[PADSZ(0x274, 0x2fc)];                /* 0x274-0x2fc */
+       uint32 gci_chipid;                              /* 0x300 */
+       uint32 PAD[PADSZ(0x304, 0x30c)];                /* 0x304-0x30c */
+       uint32 otpstatus;                               /* 0x310 */
+       uint32 otpcontrol;                              /* 0x314 */
+       uint32 otpprog;                                 /* 0x318 */
+       uint32 otplayout;                               /* 0x31c */
+       uint32 otplayoutextension;                      /* 0x320 */
+       uint32 otpcontrol1;                             /* 0x324 */
+       uint32 otpprogdata;                             /* 0x328 */
+       uint32 PAD[PADSZ(0x32c, 0x3f8)];                /* 0x32c-0x3f8 */
+       uint32 otpECCstatus;                            /* 0x3FC */
+       uint32 gci_rffe_rfem_data0;                     /* 0x400 */
+       uint32 gci_rffe_rfem_data1;                     /* 0x404 */
+       uint32 gci_rffe_rfem_data2;                     /* 0x408 */
+       uint32 gci_rffe_rfem_data3;                     /* 0x40c */
+       uint32 gci_rffe_rfem_addr;                      /* 0x410 */
+       uint32 gci_rffe_config;                         /* 0x414 */
+       uint32 gci_rffe_clk_ctrl;                       /* 0x418 */
+       uint32 gci_rffe_ctrl;                           /* 0x41c */
+       uint32 gci_rffe_misc_ctrl;                      /* 0x420 */
+       uint32 gci_rffe_rfem_reg0_field_ctrl;           /* 0x424 */
+       uint32 PAD[PADSZ(0x428, 0x438)];                /* 0x428-0x438 */
+       uint32 gci_rffe_rfem_mapping_mux0;              /* 0x43c */
+       uint32 gci_rffe_rfem_mapping_mux1;              /* 0x440 */
+       uint32 gci_rffe_rfem_mapping_mux2;              /* 0x444 */
+       uint32 gci_rffe_rfem_mapping_mux3;              /* 0x448 */
+       uint32 gci_rffe_rfem_mapping_mux4;              /* 0x44c */
+       uint32 gci_rffe_rfem_mapping_mux5;              /* 0x450 */
+       uint32 gci_rffe_rfem_mapping_mux6;              /* 0x454 */
+       uint32 gci_rffe_rfem_mapping_mux7;              /* 0x458 */
+       uint32 gci_rffe_change_detect_ovr_wlmc;         /* 0x45c */
+       uint32 gci_rffe_change_detect_ovr_wlac;         /* 0x460 */
+       uint32 gci_rffe_change_detect_ovr_wlsc;         /* 0x464 */
+       uint32 gci_rffe_change_detect_ovr_btmc;         /* 0x468 */
+       uint32 gci_rffe_change_detect_ovr_btsc;         /* 0x46c */
+       uint32 gci_cncb_ctrl_status;                    /* 0x470 */
+       uint32 gci_cncb_2g_force_unlock;                /* 0x474 */
+       uint32 gci_cncb_5g_force_unlock;                /* 0x478 */
+       uint32 gci_cncb_2g_reset_pulse_width;           /* 0x47c */
+       uint32 gci_cncb_5g_reset_pulse_width;           /* 0x480 */
+       uint32 gci_cncb_lut_indirect_addr;              /* 0x484 */
+       uint32 gci_cncb_2g_lut;                         /* 0x488 */
+       uint32 gci_cncb_5g_lut;                         /* 0x48c */
+       uint32 gci_cncb_glitch_filter_width;            /* 0x490 */
+       uint32 PAD[PADSZ(0x494, 0xbfc)];                /* 0x494-0xbfc */
+       uint32 lhl_core_capab_adr;                      /* 0xC00 */
+       uint32 lhl_main_ctl_adr;                        /* 0xC04 */
+       uint32 lhl_pmu_ctl_adr;                         /* 0xC08 */
+       uint32 lhl_extlpo_ctl_adr;                      /* 0xC0C */
+       uint32 lpo_ctl_adr;                             /* 0xC10 */
+       uint32 lhl_lpo2_ctl_adr;                        /* 0xC14 */
+       uint32 lhl_osc32k_ctl_adr;                      /* 0xC18 */
+       uint32 lhl_clk_status_adr;                      /* 0xC1C */
+       uint32 lhl_clk_det_ctl_adr;                     /* 0xC20 */
+       uint32 lhl_clk_sel_adr;                         /* 0xC24 */
+       uint32 hidoff_cnt_adr[2];                       /* 0xC28-0xC2C */
+       uint32 lhl_autoclk_ctl_adr;                     /* 0xC30 */
+       uint32 PAD;                                     /* reserved */
+       uint32 lhl_hibtim_adr;                          /* 0xC38 */
+       uint32 lhl_wl_ilp_val_adr;                      /* 0xC3C */
+       uint32 lhl_wl_armtim0_intrp_adr;                /* 0xC40 */
+       uint32 lhl_wl_armtim0_st_adr;                   /* 0xC44 */
+       uint32 lhl_wl_armtim0_adr;                      /* 0xC48 */
+       uint32 PAD[PADSZ(0xc4c, 0xc6c)];                /* 0xC4C-0xC6C */
+       uint32 lhl_wl_mactim0_intrp_adr;                /* 0xC70 */
+       uint32 lhl_wl_mactim0_st_adr;                   /* 0xC74 */
+       uint32 lhl_wl_mactim_int0_adr;                  /* 0xC78 */
+       uint32 lhl_wl_mactim_frac0_adr;                 /* 0xC7C */
+       uint32 lhl_wl_mactim1_intrp_adr;                /* 0xC80 */
+       uint32 lhl_wl_mactim1_st_adr;                   /* 0xC84 */
+       uint32 lhl_wl_mactim_int1_adr;                  /* 0xC88 */
+       uint32 lhl_wl_mactim_frac1_adr;                 /* 0xC8C */
+       uint32 lhl_wl_mactim2_intrp_adr;                /* 0xC90 */
+       uint32 lhl_wl_mactim2_st_adr;                   /* 0xC94 */
+       uint32 lhl_wl_mactim_int2_adr;                  /* 0xC98 */
+       uint32 lhl_wl_mactim_frac2_adr;                 /* 0xC9C */
+       uint32 PAD[PADSZ(0xca0, 0xcac)];                /* 0xCA0-0xCAC */
+       uint32 gpio_int_en_port_adr[4];                 /* 0xCB0-0xCBC */
+       uint32 gpio_int_st_port_adr[4];                 /* 0xCC0-0xCCC */
+       uint32 gpio_ctrl_iocfg_p_adr[40];               /* 0xCD0-0xD6C */
+       uint32 lhl_lp_up_ctl1_adr;                      /* 0xd70 */
+       uint32 lhl_lp_dn_ctl1_adr;                      /* 0xd74 */
+       uint32 PAD[PADSZ(0xd78, 0xdb4)];                /* 0xd78-0xdb4 */
+       uint32 lhl_sleep_timer_adr;                     /* 0xDB8 */
+       uint32 lhl_sleep_timer_ctl_adr;                 /* 0xDBC */
+       uint32 lhl_sleep_timer_load_val_adr;            /* 0xDC0 */
+       uint32 lhl_lp_main_ctl_adr;                     /* 0xDC4 */
+       uint32 lhl_lp_up_ctl_adr;                       /* 0xDC8 */
+       uint32 lhl_lp_dn_ctl_adr;                       /* 0xDCC */
+       uint32 gpio_gctrl_iocfg_p0_p39_adr;             /* 0xDD0 */
+       uint32 gpio_gdsctrl_iocfg_p0_p25_p30_p39_adr;   /* 0xDD4 */
+       uint32 gpio_gdsctrl_iocfg_p26_p29_adr;          /* 0xDD8 */
+       uint32 PAD[PADSZ(0xddc, 0xdf8)];                /* 0xDDC-0xDF8 */
+       uint32 lhl_gpio_din0_adr;                       /* 0xDFC */
+       uint32 lhl_gpio_din1_adr;                       /* 0xE00 */
+       uint32 lhl_wkup_status_adr;                     /* 0xE04 */
+       uint32 lhl_ctl_adr;                             /* 0xE08 */
+       uint32 lhl_adc_ctl_adr;                         /* 0xE0C */
+       uint32 lhl_qdxyz_in_dly_adr;                    /* 0xE10 */
+       uint32 lhl_optctl_adr;                          /* 0xE14 */
+       uint32 lhl_optct2_adr;                          /* 0xE18 */
+       uint32 lhl_scanp_cntr_init_val_adr;             /* 0xE1C */
+       uint32 lhl_opt_togg_val_adr[6];                 /* 0xE20-0xE34 */
+       uint32 lhl_optx_smp_val_adr;                    /* 0xE38 */
+       uint32 lhl_opty_smp_val_adr;                    /* 0xE3C */
+       uint32 lhl_optz_smp_val_adr;                    /* 0xE40 */
+       uint32 lhl_hidoff_keepstate_adr[3];             /* 0xE44-0xE4C */
+       uint32 lhl_bt_slmboot_ctl0_adr[4];              /* 0xE50-0xE5C */
+       uint32 lhl_wl_fw_ctl;                           /* 0xE60 */
+       uint32 lhl_wl_hw_ctl_adr[2];                    /* 0xE64-0xE68 */
+       uint32 lhl_bt_hw_ctl_adr;                       /* 0xE6C */
+       uint32 lhl_top_pwrseq_en_adr;                   /* 0xE70 */
+       uint32 lhl_top_pwrdn_ctl_adr;                   /* 0xE74 */
+       uint32 lhl_top_pwrup_ctl_adr;                   /* 0xE78 */
+       uint32 lhl_top_pwrseq_ctl_adr;                  /* 0xE7C */
+       uint32 lhl_top_pwrdn2_ctl_adr;                  /* 0xE80 */
+       uint32 lhl_top_pwrup2_ctl_adr;                  /* 0xE84 */
+       uint32 wpt_regon_intrp_cfg_adr;                 /* 0xE88 */
+       uint32 bt_regon_intrp_cfg_adr;                  /* 0xE8C */
+       uint32 wl_regon_intrp_cfg_adr;                  /* 0xE90 */
+       uint32 regon_intrp_st_adr;                      /* 0xE94 */
+       uint32 regon_intrp_en_adr;                      /* 0xE98 */
+       uint32 PAD[PADSZ(0xe9c, 0xeb4)];                /* 0xe9c-0xeb4 */
+       uint32 lhl_lp_main_ctl1_adr;                    /* 0xeb8 */
+       uint32 lhl_lp_up_ctl2_adr;                      /* 0xebc */
+       uint32 lhl_lp_dn_ctl2_adr;                      /* 0xec0 */
+       uint32 lhl_lp_up_ctl3_adr;                      /* 0xec4 */
+       uint32 lhl_lp_dn_ctl3_adr;                      /* 0xec8 */
+       uint32 PAD[PADSZ(0xecc, 0xed8)];                /* 0xecc-0xed8 */
+       uint32 lhl_lp_main_ctl2_adr;                    /* 0xedc */
+       uint32 lhl_lp_up_ctl4_adr;                      /* 0xee0 */
+       uint32 lhl_lp_dn_ctl4_adr;                      /* 0xee4 */
+       uint32 lhl_lp_up_ctl5_adr;                      /* 0xee8 */
+       uint32 lhl_lp_dn_ctl5_adr;                      /* 0xeec */
+       uint32 lhl_top_pwrdn3_ctl_adr;                  /* 0xEF0 */
+       uint32 lhl_top_pwrup3_ctl_adr;                  /* 0xEF4 */
+       uint32 PAD[PADSZ(0xef8, 0xf00)];
+       uint32 error_status;                            /* 0xF04 */
+       uint32 error_parity;                            /* 0xF08 */
+       uint32 PAD;                                     /* 0xF0C */
+       uint32 msg_buf_0[8];                            /* 0xF10 - 0xF2C */
+       uint32 PAD[PADSZ(0xf30, 0xf3c)];                /* 0xF30 - 0xF3C */
+       uint32 CTRL_REG0;                               /* 0xF40 */
+       uint32 CTRL_REG1;                               /* 0xF44 */
+       uint32 chipID;                                  /* 0xF48 */
+       uint32 PAD[PADSZ(0xf4c, 0xf5c)];                /* 0xF4C - 0xF5C */
+       uint32 wl_event_rdAddress;                      /* 0xF60 */
+       uint32 bt_event_rdAddress;                      /* 0xF64 */
+       uint32 interrupt_Address;                       /* 0xF68 */
+       uint32 PAD[PADSZ(0xf6c, 0xfdc)];                /* 0xF6C - 0xFDC */
+       uint32 spmi_shared_reg_status_intMask_adr;      /* 0xFE0 */
+       uint32 spmi_shared_reg_status_intStatus_adr;    /* 0xFE4 */
+       uint32 spmi_shared_reg_status_wakeMask_adr;     /* 0xFE8 */
+       uint32 spmi_shared_event_map_idx_adr;           /* 0xFEC */
+       uint32 spmi_shared_event_map_data_adr;          /* 0xFF0 */
+       uint32 spmi_coex_event_gpr_status_adr;          /* 0xFF4 */
+} gciregs_t;
+
+#define        GCI_CAP0_REV_MASK       0x000000ff
+
+/* GCI Capabilities registers */
+#define GCI_CORE_CAP_0_COREREV_MASK                    0xFF
+#define GCI_CORE_CAP_0_COREREV_SHIFT                   0
+
+#define GCI_INDIRECT_ADDRESS_REG_REGINDEX_MASK         0x3F
+#define GCI_INDIRECT_ADDRESS_REG_REGINDEX_SHIFT                0
+#define GCI_INDIRECT_ADDRESS_REG_GPIOINDEX_MASK                0xF
+#define GCI_INDIRECT_ADDRESS_REG_GPIOINDEX_SHIFT       16
+
+#define WLAN_BANKX_SLEEPPDA_REG_SLEEPPDA_MASK          0xFFFF
+
+#define WLAN_BANKX_PKILL_REG_SLEEPPDA_MASK             0x1
+
+/* WLAN BankXInfo Register */
+#define WLAN_BANKXINFO_BANK_SIZE_MASK                  0x00FFF000
+#define WLAN_BANKXINFO_BANK_SIZE_SHIFT                 12
+
+/* WLAN Mem Info Register */
+#define WLAN_MEM_INFO_REG_NUMSOCRAMBANKS_MASK          0x000000FF
+#define WLAN_MEM_INFO_REG_NUMSOCRAMBANKS_SHIFT         0
+
+#define WLAN_MEM_INFO_REG_NUMD11MACBM_MASK             0x0000FF00
+#define WLAN_MEM_INFO_REG_NUMD11MACBM_SHIFT            8
+
+#define WLAN_MEM_INFO_REG_NUMD11MACUCM_MASK            0x00FF0000
+#define WLAN_MEM_INFO_REG_NUMD11MACUCM_SHIFT           16
+
+#define WLAN_MEM_INFO_REG_NUMD11MACSHM_MASK            0xFF000000
+#define WLAN_MEM_INFO_REG_NUMD11MACSHM_SHIFT           24
+
+/* GCI chip status register 9 */
+#define GCI_CST9_SCAN_DIS      (1u << 31u)     /* scan core disable */
+
+/* GCI Output register indices */
+#define GCI_OUTPUT_IDX_0       0
+#define GCI_OUTPUT_IDX_1       1
+#define GCI_OUTPUT_IDX_2       2
+#define GCI_OUTPUT_IDX_3       3
+
+#endif /* !_LANGUAGE_ASSEMBLY && !__ASSEMBLY__ */
+
+#endif /* _SBGCI_H */
diff --git a/bcmdhd.101.10.240.x/include/sbhndarm.h b/bcmdhd.101.10.240.x/include/sbhndarm.h
new file mode 100644 (file)
index 0000000..fe0d28e
--- /dev/null
@@ -0,0 +1,150 @@
+/*
+ * Broadcom SiliconBackplane ARM definitions
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _sbhndarm_h_
+#define        _sbhndarm_h_
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define        _PADLINE(line)  pad ## line
+#define        _XSTR(line)     _PADLINE(line)
+#define        PAD             _XSTR(__LINE__)
+#endif /* PAD */
+
+/* cortex-m3 */
+typedef volatile struct {
+       uint32  corecontrol;    /* 0x0 */
+       uint32  corestatus;     /* 0x4 */
+       uint32  PAD[1];
+       uint32  biststatus;     /* 0xc */
+       uint32  nmiisrst;       /* 0x10 */
+       uint32  nmimask;        /* 0x14 */
+       uint32  isrmask;        /* 0x18 */
+       uint32  PAD[1];
+       uint32  resetlog;       /* 0x20 */
+       uint32  gpioselect;     /* 0x24 */
+       uint32  gpioenable;     /* 0x28 */
+       uint32  PAD[1];
+       uint32  bpaddrlo;       /* 0x30 */
+       uint32  bpaddrhi;       /* 0x34 */
+       uint32  bpdata;         /* 0x38 */
+       uint32  bpindaccess;    /* 0x3c */
+       uint32  ovlidx;         /* 0x40 */
+       uint32  ovlmatch;       /* 0x44 */
+       uint32  ovladdr;        /* 0x48 */
+       uint32  PAD[13];
+       uint32  bwalloc;        /* 0x80 */
+       uint32  PAD[3];
+       uint32  cyclecnt;       /* 0x90 */
+       uint32  inttimer;       /* 0x94 */
+       uint32  intmask;        /* 0x98 */
+       uint32  intstatus;      /* 0x9c */
+       uint32  PAD[80];
+       uint32  clk_ctl_st;     /* 0x1e0 */
+       uint32  PAD[1];
+       uint32  powerctl;       /* 0x1e8 */
+} cm3regs_t;
+#define ARM_CM3_REG(regs, reg) (&((cm3regs_t *)regs)->reg)
+
+/* cortex-R4 */
+typedef volatile struct {
+       uint32  corecontrol;            /* 0x0 */
+       uint32  corecapabilities;       /* 0x4 */
+       uint32  corestatus;             /* 0x8 */
+       uint32  biststatus;             /* 0xc */
+       uint32  nmiisrst;               /* 0x10 */
+       uint32  nmimask;                /* 0x14 */
+       uint32  isrmask;                /* 0x18 */
+       uint32  swintreg;               /* 0x1C */
+       uint32  intstatus;              /* 0x20 */
+       uint32  intmask;                /* 0x24 */
+       uint32  cyclecnt;               /* 0x28 */
+       uint32  inttimer;               /* 0x2c */
+       uint32  gpioselect;             /* 0x30 */
+       uint32  gpioenable;             /* 0x34 */
+       uint32  PAD[2];
+       uint32  bankidx;                /* 0x40 */
+       uint32  bankinfo;               /* 0x44 */
+       uint32  bankstbyctl;            /* 0x48 */
+       uint32  bankpda;                /* 0x4c */
+       uint32  dyn_stby_control;       /* 0x50 */
+       uint32  PAD[5];
+       uint32  tcampatchctrl;          /* 0x68 */
+       uint32  tcampatchtblbaseaddr;   /* 0x6c */
+       uint32  tcamcmdreg;             /* 0x70 */
+       uint32  tcamdatareg;            /* 0x74 */
+       uint32  tcambankxmaskreg;       /* 0x78 */
+       uint32  PAD[5];
+       uint32  mpucontrol;             /* 0x90 */
+       uint32  mpucapabilities;        /* 0x94 */
+       uint32  rom_reloc_addr;         /* 0x98 */
+       uint32  PAD[1];
+       uint32  region_n_regs[16];      /* 0xa0 - 0xdc */
+       uint32  PAD[16];
+       uint32  initiat_n_masks[16];    /* 0x120 - 0x15c */
+       uint32  PAD[32];
+       uint32  clk_ctl_st;             /* 0x1e0 */
+       uint32  hw_war;                 /* 0x1e4 */
+       uint32  powerctl;               /* 0x1e8 */
+       uint32  powerctl2;              /* 0x1ec */
+} cr4regs_t;
+#define ARM_CR4_REG(regs, reg) (&((cr4regs_t *)regs)->reg)
+
+#define SBRESETLOG_CR4         0x4
+
+/* cortex-A7 */
+typedef volatile struct {
+       uint32  corecontrol;            /* 0x0 */
+       uint32  corecapabilities;       /* 0x4 */
+       uint32  corestatus;             /* 0x8 */
+       uint32  tracecontrol;           /* 0xc */
+       uint32  gpioselect;             /* 0x10 */
+       uint32  gpioenable;             /* 0x14 */
+       uint32  PAD[114];
+       uint32  clk_ctl_st;             /* 0x1e0 */
+       uint32  workaround;             /* 0x1e4 */
+       uint32  powerctl;               /* 0x1e8 */
+       uint32  powerctl2;              /* 0x1ec */
+} ca7regs_t;
+#define ARM_CA7_REG(regs, reg) (&((ca7regs_t *)regs)->reg)
+
+#if defined(__ARM_ARCH_7M__)
+#define ARMREG(regs, reg)      ARM_CM3_REG(regs, reg)
+#endif /* __ARM_ARCH_7M__ */
+
+#if defined(__ARM_ARCH_7R__)
+#define ARMREG(regs, reg)      ARM_CR4_REG(regs, reg)
+#endif /* __ARM_ARCH_7R__ */
+
+#if defined(__ARM_ARCH_7A__)
+#define ARMREG(regs, reg)      ARM_CA7_REG(regs, reg)
+#endif /* __ARM_ARCH_7A__ */
+
+/* MPU is present mask of ca7regs_t->corecapabilities */
+#define CAP_MPU_MASK           2000000u
+
+#endif /* _LANGUAGE_ASSEMBLY */
+
+#endif /* _sbhndarm_h_ */
diff --git a/bcmdhd.101.10.240.x/include/sbhnddma.h b/bcmdhd.101.10.240.x/include/sbhnddma.h
new file mode 100644 (file)
index 0000000..3deb792
--- /dev/null
@@ -0,0 +1,469 @@
+/*
+ * Generic Broadcom Home Networking Division (HND) DMA engine HW interface
+ * This supports the following chips: BCM42xx, 44xx, 47xx .
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _sbhnddma_h_
+#define        _sbhnddma_h_
+
+/* DMA structure:
+ *  support two DMA engines: 32 bits address or 64 bit addressing
+ *  basic DMA register set is per channel(transmit or receive)
+ *  a pair of channels is defined for convenience
+ */
+
+/* 32 bits addressing */
+
+/** dma registers per channel(xmt or rcv) */
+typedef volatile struct {
+       uint32  control;                /**< enable, et al */
+       uint32  addr;                   /**< descriptor ring base address (4K aligned) */
+       uint32  ptr;                    /**< last descriptor posted to chip */
+       uint32  status;                 /**< current active descriptor, et al */
+} dma32regs_t;
+
+typedef volatile struct {
+       dma32regs_t     xmt;            /**< dma tx channel */
+       dma32regs_t     rcv;            /**< dma rx channel */
+} dma32regp_t;
+
+typedef volatile struct {      /* diag access */
+       uint32  fifoaddr;               /**< diag address */
+       uint32  fifodatalow;            /**< low 32bits of data */
+       uint32  fifodatahigh;           /**< high 32bits of data */
+       uint32  pad;                    /**< reserved */
+} dma32diag_t;
+
+/**
+ * DMA Descriptor
+ * Descriptors are only read by the hardware, never written back.
+ */
+typedef volatile struct {
+       uint32  ctrl;           /**< misc control bits & bufcount */
+       uint32  addr;           /**< data buffer address */
+} dma32dd_t;
+
+/** Each descriptor ring must be 4096byte aligned, and fit within a single 4096byte page. */
+#define        D32RINGALIGN_BITS       12
+#define        D32MAXRINGSZ            (1 << D32RINGALIGN_BITS)
+#define        D32RINGALIGN            (1 << D32RINGALIGN_BITS)
+
+#define        D32MAXDD        (D32MAXRINGSZ / sizeof (dma32dd_t))
+
+/* transmit channel control */
+#define        XC_XE           ((uint32)1 << 0)        /**< transmit enable */
+#define        XC_SE           ((uint32)1 << 1)        /**< transmit suspend request */
+#define        XC_LE           ((uint32)1 << 2)        /**< loopback enable */
+#define        XC_FL           ((uint32)1 << 4)        /**< flush request */
+#define XC_MR_MASK     0x000001C0              /**< Multiple outstanding reads */
+#define XC_MR_SHIFT    6
+#define        XC_PD           ((uint32)1 << 11)       /**< parity check disable */
+#define        XC_AE           ((uint32)3 << 16)       /**< address extension bits */
+#define        XC_AE_SHIFT     16
+#define XC_BL_MASK     0x001C0000              /**< BurstLen bits */
+#define XC_BL_SHIFT    18
+#define XC_PC_MASK     0x00E00000              /**< Prefetch control */
+#define XC_PC_SHIFT    21
+#define XC_PT_MASK     0x03000000              /**< Prefetch threshold */
+#define XC_PT_SHIFT    24
+
+/** Multiple outstanding reads */
+#define DMA_MR_1       0
+#define DMA_MR_2       1
+#define DMA_MR_4       2
+#define DMA_MR_8       3
+#define DMA_MR_12      4
+#define DMA_MR_16      5
+#define DMA_MR_20      6
+#define DMA_MR_32      7
+
+/** DMA Burst Length in bytes */
+#define DMA_BL_16      0
+#define DMA_BL_32      1
+#define DMA_BL_64      2
+#define DMA_BL_128     3
+#define DMA_BL_256     4
+#define DMA_BL_512     5
+#define DMA_BL_1024    6
+#define DMA_BL_INVALID 0xFF
+
+/** Prefetch control */
+#define DMA_PC_0       0
+#define DMA_PC_4       1
+#define DMA_PC_8       2
+#define DMA_PC_16      3
+#define DMA_PC_32      4
+/* others: reserved */
+
+/** Prefetch threshold */
+#define DMA_PT_1       0
+#define DMA_PT_2       1
+#define DMA_PT_4       2
+#define DMA_PT_8       3
+
+/** Channel Switch */
+#define DMA_CS_OFF     0
+#define DMA_CS_ON      1
+
+/* transmit descriptor table pointer */
+#define        XP_LD_MASK      0xfff                   /**< last valid descriptor */
+
+/* transmit channel status */
+#define        XS_CD_MASK      0x0fff                  /**< current descriptor pointer */
+#define        XS_XS_MASK      0xf000                  /**< transmit state */
+#define        XS_XS_SHIFT     12
+#define        XS_XS_DISABLED  0x0000                  /**< disabled */
+#define        XS_XS_ACTIVE    0x1000                  /**< active */
+#define        XS_XS_IDLE      0x2000                  /**< idle wait */
+#define        XS_XS_STOPPED   0x3000                  /**< stopped */
+#define        XS_XS_SUSP      0x4000                  /**< suspend pending */
+#define        XS_XE_MASK      0xf0000                 /**< transmit errors */
+#define        XS_XE_SHIFT     16
+#define        XS_XE_NOERR     0x00000                 /**< no error */
+#define        XS_XE_DPE       0x10000                 /**< descriptor protocol error */
+#define        XS_XE_DFU       0x20000                 /**< data fifo underrun */
+#define        XS_XE_BEBR      0x30000                 /**< bus error on buffer read */
+#define        XS_XE_BEDA      0x40000                 /**< bus error on descriptor access */
+#define        XS_AD_MASK      0xfff00000              /**< active descriptor */
+#define        XS_AD_SHIFT     20
+
+/* receive channel control */
+#define        RC_RE           ((uint32)1 << 0)        /**< receive enable */
+#define        RC_RO_MASK      0xfe                    /**< receive frame offset */
+#define        RC_RO_SHIFT     1
+#define        RC_FM           ((uint32)1 << 8)        /**< direct fifo receive (pio) mode */
+#define        RC_SH           ((uint32)1 << 9)        /**< separate rx header descriptor enable */
+#define        RC_OC           ((uint32)1 << 10)       /**< overflow continue */
+#define        RC_PD           ((uint32)1 << 11)       /**< parity check disable */
+#define        RC_AE           ((uint32)3 << 16)       /**< address extension bits */
+#define        RC_AE_SHIFT     16
+#define RC_BL_MASK     0x001C0000              /**< BurstLen bits */
+#define RC_BL_SHIFT    18
+#define RC_PC_MASK     0x00E00000              /**< Prefetch control */
+#define RC_PC_SHIFT    21
+#define RC_PT_MASK     0x03000000              /**< Prefetch threshold */
+#define RC_PT_SHIFT    24
+#define RC_WAITCMP_MASK 0x00001000
+#define RC_WAITCMP_SHIFT 12
+/* receive descriptor table pointer */
+#define        RP_LD_MASK      0xfff                   /**< last valid descriptor */
+
+/* receive channel status */
+#define        RS_CD_MASK      0x0fff                  /**< current descriptor pointer */
+#define        RS_RS_MASK      0xf000                  /**< receive state */
+#define        RS_RS_SHIFT     12
+#define        RS_RS_DISABLED  0x0000                  /**< disabled */
+#define        RS_RS_ACTIVE    0x1000                  /**< active */
+#define        RS_RS_IDLE      0x2000                  /**< idle wait */
+#define        RS_RS_STOPPED   0x3000                  /**< reserved */
+#define        RS_RE_MASK      0xf0000                 /**< receive errors */
+#define        RS_RE_SHIFT     16
+#define        RS_RE_NOERR     0x00000                 /**< no error */
+#define        RS_RE_DPE       0x10000                 /**< descriptor protocol error */
+#define        RS_RE_DFO       0x20000                 /**< data fifo overflow */
+#define        RS_RE_BEBW      0x30000                 /**< bus error on buffer write */
+#define        RS_RE_BEDA      0x40000                 /**< bus error on descriptor access */
+#define        RS_AD_MASK      0xfff00000              /**< active descriptor */
+#define        RS_AD_SHIFT     20
+
+/* fifoaddr */
+#define        FA_OFF_MASK     0xffff                  /**< offset */
+#define        FA_SEL_MASK     0xf0000                 /**< select */
+#define        FA_SEL_SHIFT    16
+#define        FA_SEL_XDD      0x00000                 /**< transmit dma data */
+#define        FA_SEL_XDP      0x10000                 /**< transmit dma pointers */
+#define        FA_SEL_RDD      0x40000                 /**< receive dma data */
+#define        FA_SEL_RDP      0x50000                 /**< receive dma pointers */
+#define        FA_SEL_XFD      0x80000                 /**< transmit fifo data */
+#define        FA_SEL_XFP      0x90000                 /**< transmit fifo pointers */
+#define        FA_SEL_RFD      0xc0000                 /**< receive fifo data */
+#define        FA_SEL_RFP      0xd0000                 /**< receive fifo pointers */
+#define        FA_SEL_RSD      0xe0000                 /**< receive frame status data */
+#define        FA_SEL_RSP      0xf0000                 /**< receive frame status pointers */
+
+/* descriptor control flags */
+#define        CTRL_BC_MASK    0x00001fff              /**< buffer byte count, real data len must <= 4KB */
+#define        CTRL_AE         ((uint32)3 << 16)       /**< address extension bits */
+#define        CTRL_AE_SHIFT   16
+#define        CTRL_PARITY     ((uint32)3 << 18)       /**< parity bit */
+#define        CTRL_EOT        ((uint32)1 << 28)       /**< end of descriptor table */
+#define        CTRL_IOC        ((uint32)1 << 29)       /**< interrupt on completion */
+#define        CTRL_EOF        ((uint32)1 << 30)       /**< end of frame */
+#define        CTRL_SOF        ((uint32)1 << 31)       /**< start of frame */
+
+/** control flags in the range [27:20] are core-specific and not defined here */
+#define        CTRL_CORE_MASK  0x0ff00000
+
+/* 64 bits addressing */
+
+/** dma registers per channel(xmt or rcv) */
+typedef volatile struct {
+       uint32  control;        /**< enable, et al */
+       uint32  ptr;            /**< last descriptor posted to chip */
+       uint32  addrlow;        /**< descriptor ring base address low 32-bits (8K aligned) */
+       uint32  addrhigh;       /**< descriptor ring base address bits 63:32 (8K aligned) */
+       uint32  status0;        /**< current descriptor, xmt state */
+       uint32  status1;        /**< active descriptor, xmt error */
+} dma64regs_t;
+
+typedef volatile struct {
+       dma64regs_t     tx;             /**< dma64 tx channel */
+       dma64regs_t     rx;             /**< dma64 rx channel */
+} dma64regp_t;
+
+typedef volatile struct {              /**< diag access */
+       uint32  fifoaddr;               /**< diag address */
+       uint32  fifodatalow;            /**< low 32bits of data */
+       uint32  fifodatahigh;           /**< high 32bits of data */
+       uint32  pad;                    /**< reserved */
+} dma64diag_t;
+
+/**
+ * DMA Descriptor
+ * Descriptors are only read by the hardware, never written back.
+ */
+typedef volatile struct {
+       uint32  ctrl1;          /**< misc control bits */
+       uint32  ctrl2;          /**< buffer count and address extension */
+       uint32  addrlow;        /**< memory address of the date buffer, bits 31:0 */
+       uint32  addrhigh;       /**< memory address of the date buffer, bits 63:32 */
+} dma64dd_t;
+
+/**
+ * Pool implementation: each pool is 64KB max.  Align it to maximize ability to grow
+ */
+#define D64POOLALIGN_BITS      15u
+#define D64POOLALIGN_BITS_MAX  16u
+/**
+ * Each descriptor ring must be 8kB aligned, and fit within a contiguous 8kB physical addresss.
+ */
+#define D64RINGALIGN_BITS      13
+#define        D64MAXRINGSZ            (1 << D64RINGALIGN_BITS)
+#define        D64RINGBOUNDARY         (1 << D64RINGALIGN_BITS)
+
+#define        D64MAXDD        (D64MAXRINGSZ / sizeof (dma64dd_t))
+
+/** for cores with large descriptor ring support, descriptor ring size can be up to 4096 */
+#define        D64MAXDD_LARGE          ((1 << 16) / sizeof (dma64dd_t))
+
+/**
+ * for cores with large descriptor ring support (4k descriptors), descriptor ring cannot cross
+ * 64K boundary
+ */
+#define        D64RINGBOUNDARY_LARGE   (1 << 16)
+
+/*
+ * Default DMA Burstlen values for USBRev >= 12 and SDIORev >= 11.
+ * When this field contains the value N, the burst length is 2**(N + 4) bytes.
+ */
+#define D64_DEF_USBBURSTLEN     2
+#define D64_DEF_SDIOBURSTLEN    1
+
+#ifndef D64_USBBURSTLEN
+#define D64_USBBURSTLEN        DMA_BL_64
+#endif
+#ifndef D64_SDIOBURSTLEN
+#define D64_SDIOBURSTLEN       DMA_BL_32
+#endif
+
+/* transmit channel control */
+#define        D64_XC_XE               0x00000001      /**< transmit enable */
+#define        D64_XC_SE               0x00000002      /**< transmit suspend request */
+#define        D64_XC_LE               0x00000004      /**< loopback enable */
+#define        D64_XC_FL               0x00000010      /**< flush request */
+#define D64_XC_MR_MASK         0x000001C0      /**< Multiple outstanding reads */
+#define D64_XC_MR_SHIFT                6
+#define D64_XC_CS_SHIFT                9               /**< channel switch enable */
+#define D64_XC_CS_MASK         0x00000200      /**< channel switch enable */
+#define        D64_XC_PD               0x00000800      /**< parity check disable */
+#define        D64_XC_AE               0x00030000      /**< address extension bits */
+#define        D64_XC_AE_SHIFT         16
+#define D64_XC_BL_MASK         0x001C0000      /**< BurstLen bits */
+#define D64_XC_BL_SHIFT                18
+#define D64_XC_PC_MASK         0x00E00000              /**< Prefetch control */
+#define D64_XC_PC_SHIFT                21
+#define D64_XC_PT_MASK         0x03000000              /**< Prefetch threshold */
+#define D64_XC_PT_SHIFT                24
+#define D64_XC_CO_MASK         0x04000000      /**< coherent transactions for descriptors */
+#define D64_XC_CO_SHIFT                26
+
+/* transmit descriptor table pointer */
+#define        D64_XP_LD_MASK          0x00001fff      /**< last valid descriptor */
+
+/* transmit channel status */
+#define        D64_XS0_CD_MASK         (di->d64_xs0_cd_mask)   /**< current descriptor pointer */
+#define        D64_XS0_XS_MASK         0xf0000000      /**< transmit state */
+#define        D64_XS0_XS_SHIFT                28
+#define        D64_XS0_XS_DISABLED     0x00000000      /**< disabled */
+#define        D64_XS0_XS_ACTIVE       0x10000000      /**< active */
+#define        D64_XS0_XS_IDLE         0x20000000      /**< idle wait */
+#define        D64_XS0_XS_STOPPED      0x30000000      /**< stopped */
+#define        D64_XS0_XS_SUSP         0x40000000      /**< suspend pending */
+
+#define        D64_XS1_AD_MASK         (di->d64_xs1_ad_mask)   /**< active descriptor */
+#define        D64_XS1_XE_MASK         0xf0000000      /**< transmit errors */
+#define        D64_XS1_XE_SHIFT                28
+#define        D64_XS1_XE_NOERR        0x00000000      /**< no error */
+#define        D64_XS1_XE_DPE          0x10000000      /**< descriptor protocol error */
+#define        D64_XS1_XE_DFU          0x20000000      /**< data fifo underrun */
+#define        D64_XS1_XE_DTE          0x30000000      /**< data transfer error */
+#define        D64_XS1_XE_DESRE        0x40000000      /**< descriptor read error */
+#define        D64_XS1_XE_COREE        0x50000000      /**< core error */
+
+/* receive channel control */
+#define        D64_RC_RE               0x00000001      /**< receive enable */
+#define        D64_RC_RO_MASK          0x000000fe      /**< receive frame offset */
+#define        D64_RC_RO_SHIFT         1
+#define        D64_RC_FM               0x00000100      /**< direct fifo receive (pio) mode */
+#define        D64_RC_SH               0x00000200      /**< separate rx header descriptor enable */
+#define        D64_RC_SHIFT            9       /**< separate rx header descriptor enable */
+#define        D64_RC_OC               0x00000400      /**< overflow continue */
+#define        D64_RC_PD               0x00000800      /**< parity check disable */
+#define D64_RC_WAITCMP_MASK    0x00001000
+#define D64_RC_WAITCMP_SHIFT   12
+#define D64_RC_SA              0x00002000      /**< select active */
+#define D64_RC_GE              0x00004000      /**< Glom enable */
+#define        D64_RC_AE               0x00030000      /**< address extension bits */
+#define        D64_RC_AE_SHIFT         16
+#define D64_RC_BL_MASK         0x001C0000      /**< BurstLen bits */
+#define D64_RC_BL_SHIFT                18
+#define D64_RC_PC_MASK         0x00E00000      /**< Prefetch control */
+#define D64_RC_PC_SHIFT                21
+#define D64_RC_PT_MASK         0x03000000      /**< Prefetch threshold */
+#define D64_RC_PT_SHIFT                24
+#define D64_RC_CO_MASK         0x04000000      /**< coherent transactions for descriptors */
+#define D64_RC_CO_SHIFT                26
+#define        D64_RC_ROEXT_MASK       0x08000000      /**< receive frame offset extension bit */
+#define        D64_RC_ROEXT_SHIFT      27
+#define D64_RC_MOW_SHIFT       (28u)           /**< multiple outstanding write */
+#define D64_RC_MOW_MASK                ((0x3u) << D64_RC_MOW_SHIFT)
+
+/* receive control values */
+/* RcvCtrl.MultipleOutstandingWrites(MOW) valid values(N) listed below.
+ * (N + 1) out standing write(s) supported
+ */
+#define D64_RC_MOW_1           (0u)            /**< 1 outstanding write */
+#define D64_RC_MOW_2           (1u)            /**< 2 outstanding writes */
+#define D64_RC_MOW_3           (2u)            /**< 3 outstanding writes */
+#define D64_RC_MOW_4           (3u)            /**< 4 outstanding writes */
+
+/* flags for dma controller */
+#define DMA_CTRL_PEN           (1u << 0u)      /**< partity enable */
+#define DMA_CTRL_ROC           (1u << 1u)      /**< rx overflow continue */
+#define DMA_CTRL_RXMULTI       (1u << 2u)      /**< allow rx scatter to multiple descriptors */
+#define DMA_CTRL_UNFRAMED      (1u << 3u)      /**< Unframed Rx/Tx data */
+#define DMA_CTRL_USB_BOUNDRY4KB_WAR (1u << 4u) /**< USB core REV9's SETUP dma channel's
+                                               *  buffer can not crossed 4K boundary PR80468
+                                               */
+#define DMA_CTRL_DMA_AVOIDANCE_WAR (1u << 5u)  /**< DMA avoidance WAR for 4331 */
+#define DMA_CTRL_RXSINGLE      (1u << 6u)      /**< always single buffer */
+#define DMA_CTRL_SDIO_RXGLOM   (1u << 7u)      /**< DMA Rx glome is enabled */
+#define DMA_CTRL_DESC_ONLY_FLAG (1u << 8u)     /**< For DMA which posts only descriptors,
+                                                * no packets
+                                                */
+#define DMA_CTRL_DESC_CD_WAR   (1u << 9u)      /**< WAR for descriptor only DMA's CD not being
+                                                * updated correctly by HW in CT mode.
+                                                */
+#define DMA_CTRL_CS            (1u << 10u)     /* channel switch enable */
+#define DMA_CTRL_ROEXT         (1u << 11u)     /* receive frame offset extension support */
+#define DMA_CTRL_RX_ALIGN_8BYTE        (1u << 12u)     /* RXDMA address 8-byte aligned */
+#define DMA_CTRL_HWA_TX                (1u << 13u)     /* HWA tx */
+#define DMA_CTRL_HWA_RX                (1u << 14u)     /* HWA rx */
+#define DMA_CTRL_SHARED_POOL   (1u << 15u)     /** shared descriptor pool */
+#define DMA_CTRL_HWA_DD_POOL   (1u << 16u)     /* HWA tx dma desc pool */
+
+/* receive descriptor table pointer */
+#define        D64_RP_LD_MASK          0x00001fff      /**< last valid descriptor */
+
+/* receive channel status */
+#define        D64_RS0_CD_MASK         (di->d64_rs0_cd_mask)   /**< current descriptor pointer */
+#define        D64_RS0_RS_MASK         0xf0000000      /**< receive state */
+#define        D64_RS0_RS_SHIFT                28
+#define        D64_RS0_RS_DISABLED     0x00000000      /**< disabled */
+#define        D64_RS0_RS_ACTIVE       0x10000000      /**< active */
+#define        D64_RS0_RS_IDLE         0x20000000      /**< idle wait */
+#define        D64_RS0_RS_STOPPED      0x30000000      /**< stopped */
+#define        D64_RS0_RS_SUSP         0x40000000      /**< suspend pending */
+
+#define        D64_RS1_AD_MASK         (di->d64_rs1_ad_mask)   /* active descriptor pointer */
+#define        D64_RS1_RE_MASK         0xf0000000      /* receive errors */
+#define        D64_RS1_RE_SHIFT                28
+#define        D64_RS1_RE_NOERR        0x00000000      /**< no error */
+#define        D64_RS1_RE_DPO          0x10000000      /**< descriptor protocol error */
+#define        D64_RS1_RE_DFU          0x20000000      /**< data fifo overflow */
+#define        D64_RS1_RE_DTE          0x30000000      /**< data transfer error */
+#define        D64_RS1_RE_DESRE        0x40000000      /**< descriptor read error */
+#define        D64_RS1_RE_COREE        0x50000000      /**< core error */
+
+/* fifoaddr */
+#define        D64_FA_OFF_MASK         0xffff          /**< offset */
+#define        D64_FA_SEL_MASK         0xf0000         /**< select */
+#define        D64_FA_SEL_SHIFT        16
+#define        D64_FA_SEL_XDD          0x00000         /**< transmit dma data */
+#define        D64_FA_SEL_XDP          0x10000         /**< transmit dma pointers */
+#define        D64_FA_SEL_RDD          0x40000         /**< receive dma data */
+#define        D64_FA_SEL_RDP          0x50000         /**< receive dma pointers */
+#define        D64_FA_SEL_XFD          0x80000         /**< transmit fifo data */
+#define        D64_FA_SEL_XFP          0x90000         /**< transmit fifo pointers */
+#define        D64_FA_SEL_RFD          0xc0000         /**< receive fifo data */
+#define        D64_FA_SEL_RFP          0xd0000         /**< receive fifo pointers */
+#define        D64_FA_SEL_RSD          0xe0000         /**< receive frame status data */
+#define        D64_FA_SEL_RSP          0xf0000         /**< receive frame status pointers */
+
+/* descriptor control flags 1 */
+#define D64_CTRL_COREFLAGS     0x0ff00000              /**< core specific flags */
+#define D64_CTRL1_COHERENT      ((uint32)1 << 17)       /* cache coherent per transaction */
+#define        D64_CTRL1_NOTPCIE       ((uint32)1 << 18)       /**< buirst size control */
+#define        D64_CTRL1_EOT           ((uint32)1 << 28)       /**< end of descriptor table */
+#define        D64_CTRL1_IOC           ((uint32)1 << 29)       /**< interrupt on completion */
+#define        D64_CTRL1_EOF           ((uint32)1 << 30)       /**< end of frame */
+#define        D64_CTRL1_SOF           ((uint32)1 << 31)       /**< start of frame */
+#define D64_CTRL1_SOFPTR       0x0000FFFFu
+#define D64_CTRL1_NUMD_MASK    0x00F00000u
+#define D64_CTRL1_NUMD_SHIFT   20u
+
+/* descriptor control flags 2 */
+#define        D64_CTRL2_MAX_LEN       0x0000fff7 /* Max transfer length (buffer byte count) <= 65527 */
+#define        D64_CTRL2_BC_MASK       0x0000ffff /**< mask for buffer byte count */
+#define        D64_CTRL2_AE            0x00030000 /**< address extension bits */
+#define        D64_CTRL2_AE_SHIFT      16
+#define D64_CTRL2_PARITY       0x00040000      /* parity bit */
+
+/** control flags in the range [27:20] are core-specific and not defined here */
+#define        D64_CTRL_CORE_MASK      0x0ff00000
+
+#define D64_RX_FRM_STS_LEN     0x0000ffff      /**< frame length mask */
+#define D64_RX_FRM_STS_OVFL    0x00800000      /**< RxOverFlow */
+#define D64_RX_FRM_STS_DSCRCNT 0x0f000000 /**< no. of descriptors used - 1, d11corerev >= 22 */
+#define D64_RX_FRM_STS_DSCRCNT_SHIFT   24      /* Shift for no .of dma descriptor field */
+#define D64_RX_FRM_STS_DATATYPE        0xf0000000      /**< core-dependent data type */
+
+#define BCM_D64_CTRL2_BOUND_DMA_LENGTH(len) \
+(((len) > D64_CTRL2_MAX_LEN) ? D64_CTRL2_MAX_LEN : (len))
+
+/** receive frame status */
+typedef volatile struct {
+       uint16 len;
+       uint16 flags;
+} dma_rxh_t;
+
+#endif /* _sbhnddma_h_ */
diff --git a/bcmdhd.101.10.240.x/include/sbpcmcia.h b/bcmdhd.101.10.240.x/include/sbpcmcia.h
new file mode 100644 (file)
index 0000000..930be17
--- /dev/null
@@ -0,0 +1,411 @@
+/*
+ * BCM43XX Sonics SiliconBackplane PCMCIA core hardware definitions.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _SBPCMCIA_H
+#define        _SBPCMCIA_H
+
+/* All the addresses that are offsets in attribute space are divided
+ * by two to account for the fact that odd bytes are invalid in
+ * attribute space and our read/write routines make the space appear
+ * as if they didn't exist. Still we want to show the original numbers
+ * as documented in the hnd_pcmcia core manual.
+ */
+
+/* PCMCIA Function Configuration Registers */
+#define        PCMCIA_FCR              (0x700 / 2)
+
+#define        FCR0_OFF                0
+#define        FCR1_OFF                (0x40 / 2)
+#define        FCR2_OFF                (0x80 / 2)
+#define        FCR3_OFF                (0xc0 / 2)
+
+#define        PCMCIA_FCR0             (0x700 / 2)
+#define        PCMCIA_FCR1             (0x740 / 2)
+#define        PCMCIA_FCR2             (0x780 / 2)
+#define        PCMCIA_FCR3             (0x7c0 / 2)
+
+/* Standard PCMCIA FCR registers */
+
+#define        PCMCIA_COR              0
+
+#define        COR_RST                 0x80
+#define        COR_LEV                 0x40
+#define        COR_IRQEN               0x04
+#define        COR_BLREN               0x01
+#define        COR_FUNEN               0x01
+
+#define        PCICIA_FCSR             (2 / 2)
+#define        PCICIA_PRR              (4 / 2)
+#define        PCICIA_SCR              (6 / 2)
+#define        PCICIA_ESR              (8 / 2)
+
+#define PCM_MEMOFF             0x0000
+#define F0_MEMOFF              0x1000
+#define F1_MEMOFF              0x2000
+#define F2_MEMOFF              0x3000
+#define F3_MEMOFF              0x4000
+
+/* Memory base in the function fcr's */
+#define MEM_ADDR0              (0x728 / 2)
+#define MEM_ADDR1              (0x72a / 2)
+#define MEM_ADDR2              (0x72c / 2)
+
+/* PCMCIA base plus Srom access in fcr0: */
+#define PCMCIA_ADDR0           (0x072e / 2)
+#define PCMCIA_ADDR1           (0x0730 / 2)
+#define PCMCIA_ADDR2           (0x0732 / 2)
+
+#define MEM_SEG                        (0x0734 / 2)
+#define SROM_CS                        (0x0736 / 2)
+#define SROM_DATAL             (0x0738 / 2)
+#define SROM_DATAH             (0x073a / 2)
+#define SROM_ADDRL             (0x073c / 2)
+#define SROM_ADDRH             (0x073e / 2)
+#define        SROM_INFO2              (0x0772 / 2)    /* Corerev >= 2 && <= 5 */
+#define        SROM_INFO               (0x07be / 2)    /* Corerev >= 6 */
+
+/*  Values for srom_cs: */
+#define SROM_IDLE              0
+#define SROM_WRITE             1
+#define SROM_READ              2
+#define SROM_WEN               4
+#define SROM_WDS               7
+#define SROM_DONE              8
+
+/* Fields in srom_info: */
+#define        SRI_SZ_MASK             0x03
+#define        SRI_BLANK               0x04
+#define        SRI_OTP                 0x80
+
+#define SROM16K_BANK_SEL_MASK          (3 << 11)
+#define SROM16K_BANK_SHFT_MASK         11
+#define SROM16K_ADDR_SEL_MASK  ((1 << SROM16K_BANK_SHFT_MASK) - 1)
+#define SROM_PRSNT_MASK                0x1
+#define SROM_SUPPORT_SHIFT_MASK 30
+#define SROM_SUPPORTED (0x1 << SROM_SUPPORT_SHIFT_MASK)
+#define SROM_SIZE_MASK    0x00000006
+#define SROM_SIZE_2K   2
+#define SROM_SIZE_512  1
+#define SROM_SIZE_128  0
+#define SROM_SIZE_SHFT_MASK  1
+
+/* CIS stuff */
+
+/* The CIS stops where the FCRs start */
+#define        CIS_SIZE                PCMCIA_FCR
+#define CIS_SIZE_12K    1154    /* Maximum h/w + s/w sub region size for 12k OTP */
+
+/* CIS tuple length field max */
+#define CIS_TUPLE_LEN_MAX      0xff
+
+/* Standard tuples we know about */
+
+#define CISTPL_NULL            0x00
+#define        CISTPL_END              0xff            /* End of the CIS tuple chain */
+
+#define        CISTPL_VERS_1           0x15            /* CIS ver, manf, dev & ver strings */
+#define        CISTPL_MANFID           0x20            /* Manufacturer and device id */
+#define CISTPL_FUNCID          0x21            /* Function identification */
+#define        CISTPL_FUNCE            0x22            /* Function extensions */
+#define        CISTPL_CFTABLE          0x1b            /* Config table entry */
+
+/* Function identifier provides context for the function extentions tuple */
+#define CISTPL_FID_SDIO                0x0c            /* Extensions defined by SDIO spec */
+
+/* Function extensions for LANs (assumed for extensions other than SDIO) */
+#define        LAN_TECH                1               /* Technology type */
+#define        LAN_SPEED               2               /* Raw bit rate */
+#define        LAN_MEDIA               3               /* Transmission media */
+#define        LAN_NID                 4               /* Node identification (aka MAC addr) */
+#define        LAN_CONN                5               /* Connector standard */
+
+/* CFTable */
+#define CFTABLE_REGWIN_2K      0x08            /* 2k reg windows size */
+#define CFTABLE_REGWIN_4K      0x10            /* 4k reg windows size */
+#define CFTABLE_REGWIN_8K      0x20            /* 8k reg windows size */
+
+/* Vendor unique tuples are 0x80-0x8f. Within Broadcom we'll
+ * take one for HNBU, and use "extensions" (a la FUNCE) within it.
+ */
+
+#define        CISTPL_BRCM_HNBU        0x80
+
+/* Subtypes of BRCM_HNBU: */
+
+#define HNBU_SROMREV           0x00    /* A byte with sromrev, 1 if not present */
+#define HNBU_CHIPID            0x01    /* Two 16bit values: PCI vendor & device id */
+
+#define HNBU_BOARDREV          0x02    /* One byte board revision */
+
+#define HNBU_PAPARMS           0x03    /* PA parameters: 8 (sromrev == 1)
+                                        * or 9 (sromrev > 1) bytes
+                                        */
+#define HNBU_OEM               0x04    /* Eight bytes OEM data (sromrev == 1) */
+#define HNBU_CC                        0x05    /* Default country code (sromrev == 1) */
+#define        HNBU_AA                 0x06    /* Antennas available */
+#define        HNBU_AG                 0x07    /* Antenna gain */
+#define HNBU_BOARDFLAGS                0x08    /* board flags (2 or 4 bytes) */
+#define HNBU_UNUSED            0x09    /* UNUSED (was LEDs) */
+#define HNBU_CCODE             0x0a    /* Country code (2 bytes ascii + 1 byte cctl)
+                                        * in rev 2
+                                        */
+#define HNBU_CCKPO             0x0b    /* 2 byte cck power offsets in rev 3 */
+#define HNBU_OFDMPO            0x0c    /* 4 byte 11g ofdm power offsets in rev 3 */
+#define HNBU_GPIOTIMER         0x0d    /* 2 bytes with on/off values in rev 3 */
+#define HNBU_PAPARMS5G         0x0e    /* 5G PA params */
+#define HNBU_ANT5G             0x0f    /* 4328 5G antennas available/gain */
+#define HNBU_RDLID             0x10    /* 2 byte USB remote downloader (RDL) product Id */
+#define HNBU_RSSISMBXA2G       0x11    /* 4328 2G RSSI mid pt sel & board switch arch,
+                                        * 2 bytes, rev 3.
+                                        */
+#define HNBU_RSSISMBXA5G       0x12    /* 4328 5G RSSI mid pt sel & board switch arch,
+                                        * 2 bytes, rev 3.
+                                        */
+#define HNBU_XTALFREQ          0x13    /* 4 byte Crystal frequency in kilohertz */
+#define HNBU_TRI2G             0x14    /* 4328 2G TR isolation, 1 byte */
+#define HNBU_TRI5G             0x15    /* 4328 5G TR isolation, 3 bytes */
+#define HNBU_RXPO2G            0x16    /* 4328 2G RX power offset, 1 byte */
+#define HNBU_RXPO5G            0x17    /* 4328 5G RX power offset, 1 byte */
+#define HNBU_BOARDNUM          0x18    /* board serial number, independent of mac addr */
+#define HNBU_MACADDR           0x19    /* mac addr override for the standard CIS LAN_NID */
+#define HNBU_RDLSN             0x1a    /* 2 bytes; serial # advertised in USB descriptor */
+
+#define HNBU_BOARDTYPE         0x1b    /* 2 bytes; boardtype */
+
+#define HNBU_UNUSED2           0x1c    /* was LEDs duty cycle */
+
+#define HNBU_HNBUCIS           0x1d    /* what follows is proprietary HNBU CIS format */
+
+#define HNBU_PAPARMS_SSLPNPHY  0x1e    /* SSLPNPHY PA params */
+#define HNBU_RSSISMBXA2G_SSLPNPHY 0x1f /* SSLPNPHY RSSI mid pt sel & board switch arch */
+#define HNBU_RDLRNDIS          0x20    /* 1 byte; 1 = RDL advertises RNDIS config */
+#define HNBU_CHAINSWITCH       0x21    /* 2 byte; txchain, rxchain */
+#define HNBU_REGREV            0x22    /* 1 byte; */
+#define HNBU_FEM               0x23    /* 2 or 4 byte: 11n frontend specification */
+#define HNBU_PAPARMS_C0                0x24    /* 8 or 30 bytes: 11n pa paramater for chain 0 */
+#define HNBU_PAPARMS_C1                0x25    /* 8 or 30 bytes: 11n pa paramater for chain 1 */
+#define HNBU_PAPARMS_C2                0x26    /* 8 or 30 bytes: 11n pa paramater for chain 2 */
+#define HNBU_PAPARMS_C3                0x27    /* 8 or 30 bytes: 11n pa paramater for chain 3 */
+#define HNBU_PO_CCKOFDM                0x28    /* 6 or 18 bytes: cck2g/ofdm2g/ofdm5g power offset */
+#define HNBU_PO_MCS2G          0x29    /* 8 bytes: mcs2g power offset */
+#define HNBU_PO_MCS5GM         0x2a    /* 8 bytes: mcs5g mid band power offset */
+#define HNBU_PO_MCS5GLH                0x2b    /* 16 bytes: mcs5g low-high band power offset */
+#define HNBU_PO_CDD            0x2c    /* 2 bytes: cdd2g/5g power offset */
+#define HNBU_PO_STBC           0x2d    /* 2 bytes: stbc2g/5g power offset */
+#define HNBU_PO_40M            0x2e    /* 2 bytes: 40Mhz channel 2g/5g power offset */
+#define HNBU_PO_40MDUP         0x2f    /* 2 bytes: 40Mhz channel dup 2g/5g power offset */
+
+#define HNBU_RDLRWU            0x30    /* 1 byte; 1 = RDL advertises Remote Wake-up */
+#define HNBU_WPS               0x31    /* 1 byte; GPIO pin for WPS button */
+#define HNBU_USBFS             0x32    /* 1 byte; 1 = USB advertises FS mode only */
+#define HNBU_BRMIN             0x33    /* 4 byte bootloader min resource mask */
+#define HNBU_BRMAX             0x34    /* 4 byte bootloader max resource mask */
+#define HNBU_PATCH             0x35    /* bootloader patch addr(2b) & data(4b) pair */
+#define HNBU_CCKFILTTYPE       0x36    /* CCK digital filter selection options */
+#define HNBU_OFDMPO5G          0x37    /* 4 * 3 = 12 byte 11a ofdm power offsets in rev 3 */
+#define HNBU_ELNA2G             0x38
+#define HNBU_ELNA5G             0x39
+#define HNBU_TEMPTHRESH 0x3A /* 2 bytes
+                                        * byte1 tempthresh
+                                        * byte2 period(msb 4 bits) | hysterisis(lsb 4 bits)
+                                        */
+#define HNBU_UUID 0x3B /* 16 Bytes Hex */
+
+#define HNBU_USBEPNUM          0x40    /* USB endpoint numbers */
+
+/* POWER PER RATE for SROM V9 */
+#define HNBU_CCKBW202GPO       0x41    /* 2 bytes each
+                                        * CCK Power offsets for 20 MHz rates (11, 5.5, 2, 1Mbps)
+                                        * cckbw202gpo cckbw20ul2gpo
+                                        */
+
+#define HNBU_LEGOFDMBW202GPO    0x42    /* 4 bytes each
+                                        * OFDM power offsets for 20 MHz Legacy rates
+                                        * (54, 48, 36, 24, 18, 12, 9, 6 Mbps)
+                                        * legofdmbw202gpo  legofdmbw20ul2gpo
+                                        */
+
+#define HNBU_LEGOFDMBW205GPO   0x43    /* 4 bytes each
+                                       * 5G band: OFDM power offsets for 20 MHz Legacy rates
+                                       * (54, 48, 36, 24, 18, 12, 9, 6 Mbps)
+                                       * low subband : legofdmbw205glpo  legofdmbw20ul2glpo
+                                       * mid subband :legofdmbw205gmpo  legofdmbw20ul2gmpo
+                                       * high subband :legofdmbw205ghpo  legofdmbw20ul2ghpo
+                                       */
+
+#define HNBU_MCS2GPO    0x44    /* 4 bytes each
+                                    * mcs 0-7  power-offset. LSB nibble: m0, MSB nibble: m7
+                                    * mcsbw202gpo  mcsbw20ul2gpo mcsbw402gpo
+                                    */
+#define HNBU_MCS5GLPO    0x45    /* 4 bytes each
+                                    * 5G low subband mcs 0-7 power-offset.
+                                    * LSB nibble: m0, MSB nibble: m7
+                                    * mcsbw205glpo  mcsbw20ul5glpo mcsbw405glpo
+                                    */
+#define HNBU_MCS5GMPO    0x46    /* 4 bytes each
+                                    * 5G mid subband mcs 0-7 power-offset.
+                                    * LSB nibble: m0, MSB nibble: m7
+                                    * mcsbw205gmpo  mcsbw20ul5gmpo mcsbw405gmpo
+                                    */
+#define HNBU_MCS5GHPO    0x47    /* 4 bytes each
+                                    * 5G high subband mcs 0-7 power-offset.
+                                    * LSB nibble: m0, MSB nibble: m7
+                                    * mcsbw205ghpo  mcsbw20ul5ghpo mcsbw405ghpo
+                                    */
+#define HNBU_MCS32PO   0x48    /*  2 bytes total
+                                * mcs-32 power offset for each band/subband.
+                                * LSB nibble: 2G band, MSB nibble:
+                                * mcs322ghpo, mcs325gmpo, mcs325glpo, mcs322gpo
+                                */
+#define HNBU_LEG40DUPPO        0x49 /*  2 bytes total
+                               * Additional power offset for Legacy Dup40 transmissions.
+                                * Applied in addition to legofdmbw20ulXpo, X=2g, 5gl, 5gm, or 5gh.
+                                * LSB nibble: 2G band, MSB nibble: 5G band high subband.
+                                * leg40dup5ghpo, leg40dup5gmpo, leg40dup5glpo, leg40dup2gpo
+                                */
+
+#define HNBU_PMUREGS   0x4a /* Variable length (5 bytes for each register)
+                               * The setting of the ChipCtrl, PLL, RegulatorCtrl, Up/Down Timer and
+                               * ResourceDependency Table registers.
+                               */
+
+#define HNBU_PATCH2            0x4b    /* bootloader TCAM patch addr(4b) & data(4b) pair .
+                               * This is required for socram rev 15 onwards.
+                               */
+
+#define HNBU_USBRDY            0x4c    /* Variable length (upto 5 bytes)
+                               * This is to indicate the USB/HSIC host controller
+                               * that the device is ready for enumeration.
+                               */
+
+#define HNBU_USBREGS   0x4d    /* Variable length
+                               * The setting of the devcontrol, HSICPhyCtrl1 and HSICPhyCtrl2
+                               * registers during the USB initialization.
+                               */
+
+#define HNBU_BLDR_TIMEOUT      0x4e    /* 2 bytes used for HSIC bootloader to reset chip
+                               * on connect timeout.
+                               * The Delay after USBConnect for timeout till dongle receives
+                               * get_descriptor request.
+                               */
+#define HNBU_USBFLAGS          0x4f
+#define HNBU_PATCH_AUTOINC     0x50
+#define HNBU_MDIO_REGLIST      0x51
+#define HNBU_MDIOEX_REGLIST    0x52
+/* Unified OTP: tupple to embed USB manfid inside SDIO CIS */
+#define HNBU_UMANFID           0x53
+#define HNBU_PUBKEY            0x54    /* 128 byte; publick key to validate downloaded FW */
+#define HNBU_WOWLGPIO       0x55   /* 1 byte bit 7 initial polarity, bit 6..0 gpio pin */
+#define HNBU_MUXENAB           0x56    /* 1 byte to enable mux options */
+#define HNBU_GCI_CCR           0x57    /* GCI Chip control register */
+
+#define HNBU_FEM_CFG           0x58    /* FEM config */
+#define HNBU_ACPA_C0           0x59    /* ACPHY PA parameters: chain 0 */
+#define HNBU_ACPA_C1           0x5a    /* ACPHY PA parameters: chain 1 */
+#define HNBU_ACPA_C2           0x5b    /* ACPHY PA parameters: chain 2 */
+#define HNBU_MEAS_PWR          0x5c
+#define HNBU_PDOFF             0x5d
+#define HNBU_ACPPR_2GPO                0x5e    /* ACPHY Power-per-rate 2gpo */
+#define HNBU_ACPPR_5GPO                0x5f    /* ACPHY Power-per-rate 5gpo */
+#define HNBU_ACPPR_SBPO                0x60    /* ACPHY Power-per-rate sbpo */
+#define HNBU_NOISELVL          0x61
+#define HNBU_RXGAIN_ERR                0x62
+#define HNBU_AGBGA             0x63
+#define HNBU_USBDESC_COMPOSITE 0x64    /* USB WLAN/BT composite descriptor */
+#define HNBU_PATCH_AUTOINC8    0x65    /* Auto increment patch entry for 8 byte patching */
+#define HNBU_PATCH8            0x66    /* Patch entry for 8 byte patching */
+#define HNBU_ACRXGAINS_C0      0x67    /* ACPHY rxgains: chain 0 */
+#define HNBU_ACRXGAINS_C1      0x68    /* ACPHY rxgains: chain 1 */
+#define HNBU_ACRXGAINS_C2      0x69    /* ACPHY rxgains: chain 2 */
+#define HNBU_TXDUTY            0x6a    /* Tx duty cycle for ACPHY 5g 40/80 Mhz */
+#define HNBU_USBUTMI_CTL        0x6b    /* 2 byte USB UTMI/LDO Control */
+#define HNBU_PDOFF_2G          0x6c
+#define HNBU_USBSSPHY_UTMI_CTL0 0x6d    /* 4 byte USB SSPHY UTMI Control */
+#define HNBU_USBSSPHY_UTMI_CTL1 0x6e    /* 4 byte USB SSPHY UTMI Control */
+#define HNBU_USBSSPHY_UTMI_CTL2 0x6f    /* 4 byte USB SSPHY UTMI Control */
+#define HNBU_USBSSPHY_SLEEP0    0x70    /* 2 byte USB SSPHY sleep */
+#define HNBU_USBSSPHY_SLEEP1    0x71    /* 2 byte USB SSPHY sleep */
+#define HNBU_USBSSPHY_SLEEP2    0x72    /* 2 byte USB SSPHY sleep */
+#define HNBU_USBSSPHY_SLEEP3    0x73    /* 2 byte USB SSPHY sleep */
+#define HNBU_USBSSPHY_MDIO      0x74    /* USB SSPHY INIT regs setting */
+#define HNBU_USB30PHY_NOSS      0x75    /* USB30 NO Super Speed */
+#define HNBU_USB30PHY_U1U2      0x76    /* USB30 PHY U1U2 Enable */
+#define HNBU_USB30PHY_REGS      0x77    /* USB30 PHY REGs update */
+#define HNBU_GPIO_PULL_DOWN     0x78    /* 4 byte GPIO pull down mask */
+
+#define HNBU_SROM3SWRGN                0x80    /* 78 bytes; srom rev 3 s/w region without crc8
+                                        * plus extra info appended.
+                                        */
+#define HNBU_RESERVED          0x81
+#define HNBU_CUSTOM1           0x82    /* 4 byte; For non-BRCM post-mfg additions */
+#define HNBU_CUSTOM2           0x83    /* Reserved; For non-BRCM post-mfg additions */
+#define HNBU_ACPAPARAM         0x84    /* ACPHY PAPARAM */
+#define HNBU_ACPA_CCK_C0       0x86    /* ACPHY PA trimming parameters: CCK */
+#define HNBU_ACPA_40           0x87    /* ACPHY PA trimming parameters: 40 */
+#define HNBU_ACPA_80           0x88    /* ACPHY PA trimming parameters: 80 */
+#define HNBU_ACPA_4080         0x89    /* ACPHY PA trimming parameters: 40/80 */
+#define HNBU_SUBBAND5GVER      0x8a    /* subband5gver */
+#define HNBU_PAPARAMBWVER      0x8b    /* paparambwver */
+
+#define HNBU_MCS5Gx1PO         0x8c
+#define HNBU_ACPPR_SB8080_PO           0x8d
+#define HNBU_TXBFRPCALS                        0x8f    /* phy txbf rpcalvars */
+#define HNBU_MACADDR2                          0x90    /* (optional) 2nd mac-addr for RSDB chips */
+
+#define HNBU_ACPA_4X4C0        0x91
+#define HNBU_ACPA_4X4C1        0x92
+#define HNBU_ACPA_4X4C2        0x93
+#define HNBU_ACPA_4X4C3        0x94
+#define HNBU_ACPA_BW20_4X4C0   0x95
+#define HNBU_ACPA_BW40_4X4C0   0x96
+#define HNBU_ACPA_BW80_4X4C0   0x97
+#define HNBU_ACPA_BW20_4X4C1   0x98
+#define HNBU_ACPA_BW40_4X4C1   0x99
+#define HNBU_ACPA_BW80_4X4C1   0x9a
+#define HNBU_ACPA_BW20_4X4C2   0x9b
+#define HNBU_ACPA_BW40_4X4C2   0x9c
+#define HNBU_ACPA_BW80_4X4C2   0x9d
+#define HNBU_ACPA_BW20_4X4C3   0x9e
+#define HNBU_ACPA_BW40_4X4C3   0x9f
+#define HNBU_ACPA_BW80_4X4C3   0xa0
+#define HNBU_ACPA_CCK_C1       0xa1    /* ACPHY PA trimming parameters: CCK */
+
+#define HNBU_GAIN_CAL_TEMP          0xa2 /* RSSI Cal temperature parameter              */
+#define HNBU_RSSI_DELTA_2G_B0       0xa3 /* RSSI Cal parameter for 2G channel group 0   */
+#define HNBU_RSSI_DELTA_2G_B1       0xa4 /* RSSI Cal parameter for 2G channel group 1   */
+#define HNBU_RSSI_DELTA_2G_B2       0xa5 /* RSSI Cal parameter for 2G channel group 2   */
+#define HNBU_RSSI_DELTA_2G_B3       0xa6 /* RSSI Cal parameter for 2G channel group 3   */
+#define HNBU_RSSI_DELTA_2G_B4       0xa7 /* RSSI Cal parameter for 2G channel group 4   */
+#define HNBU_RSSI_CAL_FREQ_GRP_2G   0xa8 /* RSSI Cal parameter for channel group def.   */
+#define HNBU_RSSI_DELTA_5GL         0xa9 /* RSSI Cal parameter for 5G low channel       */
+#define HNBU_RSSI_DELTA_5GML        0xaa /* RSSI Cal parameter for 5G mid lower channel */
+#define HNBU_RSSI_DELTA_5GMU        0xab /* RSSI Cal parameter for 5G mid upper channel */
+#define HNBU_RSSI_DELTA_5GH         0xac /* RSSI Cal parameter for 5G high channel      */
+
+/* sbtmstatelow */
+#define SBTML_INT_ACK          0x40000         /* ack the sb interrupt */
+#define SBTML_INT_EN           0x20000         /* enable sb interrupt */
+
+/* sbtmstatehigh */
+#define SBTMH_INT_STATUS       0x40000         /* sb interrupt status */
+#endif /* _SBPCMCIA_H */
diff --git a/bcmdhd.101.10.240.x/include/sbsdio.h b/bcmdhd.101.10.240.x/include/sbsdio.h
new file mode 100644 (file)
index 0000000..0a2c227
--- /dev/null
@@ -0,0 +1,185 @@
+/*
+ * SDIO device core hardware definitions.
+ * sdio is a portion of the pcmcia core in core rev 3 - rev 8
+ *
+ * SDIO core support 1bit, 4 bit SDIO mode as well as SPI mode.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _SBSDIO_H
+#define        _SBSDIO_H
+
+#define SBSDIO_NUM_FUNCTION            3       /* as of sdiod rev 0, supports 3 functions */
+
+/* function 1 miscellaneous registers */
+#define SBSDIO_SPROM_CS                        0x10000         /* sprom command and status */
+#define SBSDIO_SPROM_INFO              0x10001         /* sprom info register */
+#define SBSDIO_SPROM_DATA_LOW          0x10002         /* sprom indirect access data byte 0 */
+#define SBSDIO_SPROM_DATA_HIGH         0x10003         /* sprom indirect access data byte 1 */
+#define SBSDIO_SPROM_ADDR_LOW          0x10004         /* sprom indirect access addr byte 0 */
+#define SBSDIO_SPROM_ADDR_HIGH         0x10005         /* sprom indirect access addr byte 0 */
+#define SBSDIO_CHIP_CTRL_DATA          0x10006         /* xtal_pu (gpio) output */
+#define SBSDIO_CHIP_CTRL_EN            0x10007         /* xtal_pu (gpio) enable */
+#define SBSDIO_WATERMARK               0x10008         /* rev < 7, watermark for sdio device */
+#define SBSDIO_DEVICE_CTL              0x10009         /* control busy signal generation */
+
+/* registers introduced in rev 8, some content (mask/bits) defs in sbsdpcmdev.h */
+#define SBSDIO_FUNC1_SBADDRLOW         0x1000A         /* SB Address Window Low (b15) */
+#define SBSDIO_FUNC1_SBADDRMID         0x1000B         /* SB Address Window Mid (b23:b16) */
+#define SBSDIO_FUNC1_SBADDRHIGH                0x1000C         /* SB Address Window High (b31:b24)    */
+#define SBSDIO_FUNC1_FRAMECTRL         0x1000D         /* Frame Control (frame term/abort) */
+#define SBSDIO_FUNC1_CHIPCLKCSR                0x1000E         /* ChipClockCSR (ALP/HT ctl/status) */
+#define SBSDIO_FUNC1_SDIOPULLUP        0x1000F         /* SdioPullUp (on cmd, d0-d2) */
+#define SBSDIO_FUNC1_WFRAMEBCLO                0x10019         /* Write Frame Byte Count Low */
+#define SBSDIO_FUNC1_WFRAMEBCHI                0x1001A         /* Write Frame Byte Count High */
+#define SBSDIO_FUNC1_RFRAMEBCLO                0x1001B         /* Read Frame Byte Count Low */
+#define SBSDIO_FUNC1_RFRAMEBCHI                0x1001C         /* Read Frame Byte Count High */
+#define SBSDIO_FUNC1_MESBUSYCTRL       0x1001D         /* MesBusyCtl at 0x1001D (rev 11) */
+
+#define SBSDIO_FUNC1_MISC_REG_START    0x10000         /* f1 misc register start */
+#define SBSDIO_FUNC1_MISC_REG_LIMIT    0x1001C         /* f1 misc register end */
+
+/* Sdio Core Rev 12 */
+#define SBSDIO_FUNC1_WAKEUPCTRL                        0x1001E
+#define SBSDIO_FUNC1_WCTRL_ALPWAIT_MASK                0x1
+#define SBSDIO_FUNC1_WCTRL_ALPWAIT_SHIFT       0
+#define SBSDIO_FUNC1_WCTRL_HTWAIT_MASK         0x2
+#define SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT                1
+#define SBSDIO_FUNC1_SLEEPCSR                  0x1001F
+#define SBSDIO_FUNC1_SLEEPCSR_KSO_MASK         0x1
+#define SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT                0
+#define SBSDIO_FUNC1_SLEEPCSR_KSO_EN           1
+#define SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK       0x2
+#define SBSDIO_FUNC1_SLEEPCSR_DEVON_SHIFT      1
+
+/* SBSDIO_SPROM_CS */
+#define SBSDIO_SPROM_IDLE              0
+#define SBSDIO_SPROM_WRITE             1
+#define SBSDIO_SPROM_READ              2
+#define SBSDIO_SPROM_WEN               4
+#define SBSDIO_SPROM_WDS               7
+#define SBSDIO_SPROM_DONE              8
+
+/* SBSDIO_SPROM_INFO */
+#define SROM_SZ_MASK                   0x03            /* SROM size, 1: 4k, 2: 16k */
+#define SROM_BLANK                     0x04            /* depreciated in corerev 6 */
+#define        SROM_OTP                        0x80            /* OTP present */
+
+/* SBSDIO_WATERMARK */
+#define SBSDIO_WATERMARK_MASK          0x7f            /* number of words - 1 for sd device
+                                                        * to wait before sending data to host
+                                                        */
+
+/* SBSDIO_MESBUSYCTRL */
+/* When RX FIFO has less entries than this & MBE is set
+ * => busy signal is asserted between data blocks.
+*/
+#define SBSDIO_MESBUSYCTRL_MASK                0x7f
+#define SBSDIO_MESBUSYCTRL_ENAB                0x80            /* Enable busy capability for MES access */
+
+/* SBSDIO_DEVICE_CTL */
+#define SBSDIO_DEVCTL_SETBUSY          0x01            /* 1: device will assert busy signal when
+                                                        * receiving CMD53
+                                                        */
+#define SBSDIO_DEVCTL_SPI_INTR_SYNC    0x02            /* 1: assertion of sdio interrupt is
+                                                        * synchronous to the sdio clock
+                                                        */
+#define SBSDIO_DEVCTL_CA_INT_ONLY      0x04            /* 1: mask all interrupts to host
+                                                        * except the chipActive (rev 8)
+                                                        */
+#define SBSDIO_DEVCTL_PADS_ISO         0x08            /* 1: isolate internal sdio signals, put
+                                                        * external pads in tri-state; requires
+                                                        * sdio bus power cycle to clear (rev 9)
+                                                        */
+#define SBSDIO_DEVCTL_EN_F2_BLK_WATERMARK 0x10  /* Enable function 2 tx for each block */
+#define SBSDIO_DEVCTL_F2WM_ENAB                0x10            /* Enable F2 Watermark */
+#define SBSDIO_DEVCTL_NONDAT_PADS_ISO  0x20            /* Isolate sdio clk and cmd (non-data) */
+
+/* SBSDIO_FUNC1_CHIPCLKCSR */
+#define SBSDIO_FORCE_ALP               0x01            /* Force ALP request to backplane */
+#define SBSDIO_FORCE_HT                        0x02            /* Force HT request to backplane */
+#define SBSDIO_FORCE_ILP               0x04            /* Force ILP request to backplane */
+#define SBSDIO_ALP_AVAIL_REQ           0x08            /* Make ALP ready (power up xtal) */
+#define SBSDIO_HT_AVAIL_REQ            0x10            /* Make HT ready (power up PLL) */
+#define SBSDIO_FORCE_HW_CLKREQ_OFF     0x20            /* Squelch clock requests from HW */
+#define SBSDIO_ALP_AVAIL               0x40            /* Status: ALP is ready */
+#define SBSDIO_HT_AVAIL                        0x80            /* Status: HT is ready */
+/* In rev8, actual avail bits followed original docs */
+#define SBSDIO_Rev8_HT_AVAIL           0x40
+#define SBSDIO_Rev8_ALP_AVAIL          0x80
+#define SBSDIO_CSR_MASK                        0x1F
+
+/* WAR for PR 40695: determine HT/ALP regardless of actual bit order.  Need to use
+ * before we know corerev.  (Can drop if all supported revs have same bit order.)
+ */
+#define SBSDIO_AVBITS                  (SBSDIO_HT_AVAIL | SBSDIO_ALP_AVAIL)
+#define SBSDIO_ALPAV(regval)           ((regval) & SBSDIO_AVBITS)
+#define SBSDIO_HTAV(regval)            (((regval) & SBSDIO_AVBITS) == SBSDIO_AVBITS)
+#define SBSDIO_ALPONLY(regval)         (SBSDIO_ALPAV(regval) && !SBSDIO_HTAV(regval))
+#define SBSDIO_CLKAV(regval, alponly)  (SBSDIO_ALPAV(regval) && \
+                                       (alponly ? 1 : SBSDIO_HTAV(regval)))
+
+/* SBSDIO_FUNC1_SDIOPULLUP */
+#define SBSDIO_PULLUP_D0               0x01            /* Enable D0/MISO pullup */
+#define SBSDIO_PULLUP_D1               0x02            /* Enable D1/INT# pullup */
+#define SBSDIO_PULLUP_D2               0x04            /* Enable D2 pullup */
+#define SBSDIO_PULLUP_CMD              0x08            /* Enable CMD/MOSI pullup */
+#define SBSDIO_PULLUP_ALL              0x0f            /* All valid bits */
+
+/* function 1 OCP space */
+#define SBSDIO_SB_OFT_ADDR_MASK                0x07FFF         /* sb offset addr is <= 15 bits, 32k */
+#define SBSDIO_SB_OFT_ADDR_LIMIT       0x08000
+#define SBSDIO_SB_ACCESS_2_4B_FLAG     0x08000         /* with b15, maps to 32-bit SB access */
+
+/* some duplication with sbsdpcmdev.h here */
+/* valid bits in SBSDIO_FUNC1_SBADDRxxx regs */
+#define SBSDIO_SBADDRLOW_MASK          0x80            /* Valid bits in SBADDRLOW */
+#define SBSDIO_SBADDRMID_MASK          0xff            /* Valid bits in SBADDRMID */
+#define SBSDIO_SBADDRHIGH_MASK         0xffU           /* Valid bits in SBADDRHIGH */
+#define SBSDIO_SBWINDOW_MASK           0xffff8000      /* Address bits from SBADDR regs */
+
+/* direct(mapped) cis space */
+#define SBSDIO_CIS_BASE_COMMON         0x1000          /* MAPPED common CIS address */
+#ifdef BCMSPI
+#define SBSDIO_CIS_SIZE_LIMIT          0x100           /* maximum bytes in one spi CIS */
+#else
+#define SBSDIO_CIS_SIZE_LIMIT          0x200           /* maximum bytes in one CIS */
+#endif /* !BCMSPI */
+#define SBSDIO_OTP_CIS_SIZE_LIMIT       0x078           /* maximum bytes OTP CIS */
+
+#define SBSDIO_CIS_OFT_ADDR_MASK       0x1FFFF         /* cis offset addr is < 17 bits */
+
+#define SBSDIO_CIS_MANFID_TUPLE_LEN    6               /* manfid tuple length, include tuple,
+                                                        * link bytes
+                                                        */
+
+/* indirect cis access (in sprom) */
+#define SBSDIO_SPROM_CIS_OFFSET                0x8             /* 8 control bytes first, CIS starts from
+                                                        * 8th byte
+                                                        */
+
+#define SBSDIO_BYTEMODE_DATALEN_MAX    64              /* sdio byte mode: maximum length of one
+                                                        * data comamnd
+                                                        */
+
+#define SBSDIO_CORE_ADDR_MASK          0x1FFFF         /* sdio core function one address mask */
+
+#endif /* _SBSDIO_H */
diff --git a/bcmdhd.101.10.240.x/include/sbsdpcmdev.h b/bcmdhd.101.10.240.x/include/sbsdpcmdev.h
new file mode 100644 (file)
index 0000000..603702a
--- /dev/null
@@ -0,0 +1,303 @@
+/*
+ * Broadcom SiliconBackplane SDIO/PCMCIA hardware-specific
+ * device core support
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _sbsdpcmdev_h_
+#define        _sbsdpcmdev_h_
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define        _PADLINE(line)  pad ## line
+#define        _XSTR(line)     _PADLINE(line)
+#define        PAD             _XSTR(__LINE__)
+#endif /* PAD */
+
+typedef volatile struct {
+       dma64regs_t     xmt;            /* dma tx */
+       uint32 PAD[2];
+       dma64regs_t     rcv;            /* dma rx */
+       uint32 PAD[2];
+} dma64p_t;
+
+/* dma64 sdiod corerev >= 1 */
+typedef volatile struct {
+       dma64p_t dma64regs[2];
+       dma64diag_t dmafifo;            /* DMA Diagnostic Regs, 0x280-0x28c */
+       uint32 PAD[92];
+} sdiodma64_t;
+
+/* dma32 sdiod corerev == 0 */
+typedef volatile struct {
+       dma32regp_t dma32regs[2];       /* dma tx & rx, 0x200-0x23c */
+       dma32diag_t dmafifo;            /* DMA Diagnostic Regs, 0x240-0x24c */
+       uint32 PAD[108];
+} sdiodma32_t;
+
+/* dma32 regs for pcmcia core */
+typedef volatile struct {
+       dma32regp_t dmaregs;            /* DMA Regs, 0x200-0x21c, rev8 */
+       dma32diag_t dmafifo;            /* DMA Diagnostic Regs, 0x220-0x22c */
+       uint32 PAD[116];
+} pcmdma32_t;
+
+/* core registers */
+typedef volatile struct {
+       uint32 corecontrol;             /* CoreControl, 0x000, rev8 */
+       uint32 corestatus;              /* CoreStatus, 0x004, rev8  */
+       uint32 PAD[1];
+       uint32 biststatus;              /* BistStatus, 0x00c, rev8  */
+
+       /* PCMCIA access */
+       uint16 pcmciamesportaladdr;     /* PcmciaMesPortalAddr, 0x010, rev8   */
+       uint16 PAD[1];
+       uint16 pcmciamesportalmask;     /* PcmciaMesPortalMask, 0x014, rev8   */
+       uint16 PAD[1];
+       uint16 pcmciawrframebc;         /* PcmciaWrFrameBC, 0x018, rev8   */
+       uint16 PAD[1];
+       uint16 pcmciaunderflowtimer;    /* PcmciaUnderflowTimer, 0x01c, rev8   */
+       uint16 PAD[1];
+
+       /* interrupt */
+       uint32 intstatus;               /* IntStatus, 0x020, rev8   */
+       uint32 hostintmask;             /* IntHostMask, 0x024, rev8   */
+       uint32 intmask;                 /* IntSbMask, 0x028, rev8   */
+       uint32 sbintstatus;             /* SBIntStatus, 0x02c, rev8   */
+       uint32 sbintmask;               /* SBIntMask, 0x030, rev8   */
+       uint32 funcintmask;             /* SDIO Function Interrupt Mask, SDIO rev4 */
+       uint32 PAD[2];
+       uint32 tosbmailbox;             /* ToSBMailbox, 0x040, rev8   */
+       uint32 tohostmailbox;           /* ToHostMailbox, 0x044, rev8   */
+       uint32 tosbmailboxdata;         /* ToSbMailboxData, 0x048, rev8   */
+       uint32 tohostmailboxdata;       /* ToHostMailboxData, 0x04c, rev8   */
+
+       /* synchronized access to registers in SDIO clock domain */
+       uint32 sdioaccess;              /* SdioAccess, 0x050, rev8   */
+       uint32 PAD[1];
+       uint32 MiscHostAccessIntEn;
+       uint32 PAD[1];
+
+       /* PCMCIA frame control */
+       uint8 pcmciaframectrl;          /* pcmciaFrameCtrl, 0x060, rev8   */
+       uint8 PAD[3];
+       uint8 pcmciawatermark;          /* pcmciaWaterMark, 0x064, rev8   */
+       uint8 PAD[155];
+
+       /* interrupt batching control */
+       uint32 intrcvlazy;              /* IntRcvLazy, 0x100, rev8 */
+       uint32 PAD[3];
+
+       /* counters */
+       uint32 cmd52rd;                 /* Cmd52RdCount, 0x110, rev8, SDIO: cmd52 reads */
+       uint32 cmd52wr;                 /* Cmd52WrCount, 0x114, rev8, SDIO: cmd52 writes */
+       uint32 cmd53rd;                 /* Cmd53RdCount, 0x118, rev8, SDIO: cmd53 reads */
+       uint32 cmd53wr;                 /* Cmd53WrCount, 0x11c, rev8, SDIO: cmd53 writes */
+       uint32 abort;                   /* AbortCount, 0x120, rev8, SDIO: aborts */
+       uint32 datacrcerror;            /* DataCrcErrorCount, 0x124, rev8, SDIO: frames w/bad CRC */
+       uint32 rdoutofsync;             /* RdOutOfSyncCount, 0x128, rev8, SDIO/PCMCIA: Rd Frm OOS */
+       uint32 wroutofsync;             /* RdOutOfSyncCount, 0x12c, rev8, SDIO/PCMCIA: Wr Frm OOS */
+       uint32 writebusy;               /* WriteBusyCount, 0x130, rev8, SDIO: dev asserted "busy" */
+       uint32 readwait;                /* ReadWaitCount, 0x134, rev8, SDIO: read: no data avail */
+       uint32 readterm;                /* ReadTermCount, 0x138, rev8, SDIO: rd frm terminates */
+       uint32 writeterm;               /* WriteTermCount, 0x13c, rev8, SDIO: wr frm terminates */
+       uint32 PAD[40];
+       uint32 clockctlstatus;          /* ClockCtlStatus, 0x1e0, rev8 */
+       uint32 PAD[1];
+       uint32 powerctl;                /* 0x1e8 */
+       uint32 PAD[5];
+
+       /* DMA engines */
+       volatile union {
+               pcmdma32_t pcm32;
+               sdiodma32_t sdiod32;
+               sdiodma64_t sdiod64;
+       } dma;
+
+       /* SDIO/PCMCIA CIS region */
+       char cis[512];                  /* 512 byte CIS, 0x400-0x5ff, rev6 */
+
+       /* PCMCIA function control registers */
+       char pcmciafcr[256];            /* PCMCIA FCR, 0x600-6ff, rev6 */
+       uint16 PAD[55];
+
+       /* PCMCIA backplane access */
+       uint16 backplanecsr;            /* BackplaneCSR, 0x76E, rev6 */
+       uint16 backplaneaddr0;          /* BackplaneAddr0, 0x770, rev6 */
+       uint16 backplaneaddr1;          /* BackplaneAddr1, 0x772, rev6 */
+       uint16 backplaneaddr2;          /* BackplaneAddr2, 0x774, rev6 */
+       uint16 backplaneaddr3;          /* BackplaneAddr3, 0x776, rev6 */
+       uint16 backplanedata0;          /* BackplaneData0, 0x778, rev6 */
+       uint16 backplanedata1;          /* BackplaneData1, 0x77a, rev6 */
+       uint16 backplanedata2;          /* BackplaneData2, 0x77c, rev6 */
+       uint16 backplanedata3;          /* BackplaneData3, 0x77e, rev6 */
+       uint16 PAD[31];
+
+       /* sprom "size" & "blank" info */
+       uint16 spromstatus;             /* SPROMStatus, 0x7BE, rev2 */
+       uint32 PAD[464];
+
+       /* Sonics SiliconBackplane registers */
+       sbconfig_t sbconfig;            /* SbConfig Regs, 0xf00-0xfff, rev8 */
+} sdpcmd_regs_t;
+
+/* corecontrol */
+#define CC_CISRDY              (1 << 0)        /* CIS Ready */
+#define CC_BPRESEN             (1 << 1)        /* CCCR RES signal causes backplane reset */
+#define CC_F2RDY               (1 << 2)        /* set CCCR IOR2 bit */
+#define CC_CLRPADSISO          (1 << 3)        /* clear SDIO pads isolation bit (rev 11) */
+#define CC_XMTDATAAVAIL_MODE   (1 << 4)        /* data avail generates an interrupt */
+#define CC_XMTDATAAVAIL_CTRL   (1 << 5)        /* data avail interrupt ctrl */
+
+/* corestatus */
+#define CS_PCMCIAMODE  (1 << 0)        /* Device Mode; 0=SDIO, 1=PCMCIA */
+#define CS_SMARTDEV    (1 << 1)        /* 1=smartDev enabled */
+#define CS_F2ENABLED   (1 << 2)        /* 1=host has enabled the device */
+
+#define PCMCIA_MES_PA_MASK     0x7fff  /* PCMCIA Message Portal Address Mask */
+#define PCMCIA_MES_PM_MASK     0x7fff  /* PCMCIA Message Portal Mask Mask */
+#define PCMCIA_WFBC_MASK       0xffff  /* PCMCIA Write Frame Byte Count Mask */
+#define PCMCIA_UT_MASK         0x07ff  /* PCMCIA Underflow Timer Mask */
+
+/* intstatus */
+#define I_SMB_SW0      (1 << 0)        /* To SB Mail S/W interrupt 0 */
+#define I_SMB_SW1      (1 << 1)        /* To SB Mail S/W interrupt 1 */
+#define I_SMB_SW2      (1 << 2)        /* To SB Mail S/W interrupt 2 */
+#define I_SMB_SW3      (1 << 3)        /* To SB Mail S/W interrupt 3 */
+#define I_SMB_SW_MASK  0x0000000f      /* To SB Mail S/W interrupts mask */
+#define I_SMB_SW_SHIFT 0               /* To SB Mail S/W interrupts shift */
+#define I_HMB_SW0      (1 << 4)        /* To Host Mail S/W interrupt 0 */
+#define I_HMB_SW1      (1 << 5)        /* To Host Mail S/W interrupt 1 */
+#define I_HMB_SW2      (1 << 6)        /* To Host Mail S/W interrupt 2 */
+#define I_HMB_SW3      (1 << 7)        /* To Host Mail S/W interrupt 3 */
+#define I_HMB_SW_MASK  0x000000f0      /* To Host Mail S/W interrupts mask */
+#define I_HMB_SW_SHIFT 4               /* To Host Mail S/W interrupts shift */
+#define I_WR_OOSYNC    (1 << 8)        /* Write Frame Out Of Sync */
+#define I_RD_OOSYNC    (1 << 9)        /* Read Frame Out Of Sync */
+#define        I_PC            (1 << 10)       /* descriptor error */
+#define        I_PD            (1 << 11)       /* data error */
+#define        I_DE            (1 << 12)       /* Descriptor protocol Error */
+#define        I_RU            (1 << 13)       /* Receive descriptor Underflow */
+#define        I_RO            (1 << 14)       /* Receive fifo Overflow */
+#define        I_XU            (1 << 15)       /* Transmit fifo Underflow */
+#define        I_RI            (1 << 16)       /* Receive Interrupt */
+#define I_BUSPWR       (1 << 17)       /* SDIO Bus Power Change (rev 9) */
+#define I_XMTDATA_AVAIL (1 << 23)      /* bits in fifo */
+#define        I_XI            (1 << 24)       /* Transmit Interrupt */
+#define I_RF_TERM      (1 << 25)       /* Read Frame Terminate */
+#define I_WF_TERM      (1 << 26)       /* Write Frame Terminate */
+#define I_PCMCIA_XU    (1 << 27)       /* PCMCIA Transmit FIFO Underflow */
+#define I_SBINT                (1 << 28)       /* sbintstatus Interrupt */
+#define I_CHIPACTIVE   (1 << 29)       /* chip transitioned from doze to active state */
+#define I_SRESET       (1 << 30)       /* CCCR RES interrupt */
+#define I_IOE2         (1U << 31)      /* CCCR IOE2 Bit Changed */
+#define        I_ERRORS        (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)       /* DMA Errors */
+#define I_DMA          (I_RI | I_XI | I_ERRORS)
+
+/* sbintstatus */
+#define I_SB_SERR      (1 << 8)        /* Backplane SError (write) */
+#define I_SB_RESPERR   (1 << 9)        /* Backplane Response Error (read) */
+#define I_SB_SPROMERR  (1 << 10)       /* Error accessing the sprom */
+
+/* sdioaccess */
+#define SDA_DATA_MASK  0x000000ff      /* Read/Write Data Mask */
+#define SDA_ADDR_MASK  0x000fff00      /* Read/Write Address Mask */
+#define SDA_ADDR_SHIFT 8               /* Read/Write Address Shift */
+#define SDA_WRITE      0x01000000      /* Write bit  */
+#define SDA_READ       0x00000000      /* Write bit cleared for Read */
+#define SDA_BUSY       0x80000000      /* Busy bit */
+
+/* sdioaccess-accessible register address spaces */
+#define SDA_CCCR_SPACE         0x000   /* sdioAccess CCCR register space */
+#define SDA_F1_FBR_SPACE       0x100   /* sdioAccess F1 FBR register space */
+#define SDA_F2_FBR_SPACE       0x200   /* sdioAccess F2 FBR register space */
+#define SDA_F1_REG_SPACE       0x300   /* sdioAccess F1 core-specific register space */
+#define SDA_F3_FBR_SPACE       0x400   /* sdioAccess F3 FBR register space */
+
+/* SDA_F1_REG_SPACE sdioaccess-accessible F1 reg space register offsets */
+#define SDA_CHIPCONTROLDATA    0x006   /* ChipControlData */
+#define SDA_CHIPCONTROLENAB    0x007   /* ChipControlEnable */
+#define SDA_F2WATERMARK                0x008   /* Function 2 Watermark */
+#define SDA_DEVICECONTROL      0x009   /* DeviceControl */
+#define SDA_SBADDRLOW          0x00a   /* SbAddrLow */
+#define SDA_SBADDRMID          0x00b   /* SbAddrMid */
+#define SDA_SBADDRHIGH         0x00c   /* SbAddrHigh */
+#define SDA_FRAMECTRL          0x00d   /* FrameCtrl */
+#define SDA_CHIPCLOCKCSR       0x00e   /* ChipClockCSR */
+#define SDA_SDIOPULLUP         0x00f   /* SdioPullUp */
+#define SDA_SDIOWRFRAMEBCLOW   0x019   /* SdioWrFrameBCLow */
+#define SDA_SDIOWRFRAMEBCHIGH  0x01a   /* SdioWrFrameBCHigh */
+#define SDA_SDIORDFRAMEBCLOW   0x01b   /* SdioRdFrameBCLow */
+#define SDA_SDIORDFRAMEBCHIGH  0x01c   /* SdioRdFrameBCHigh */
+#define SDA_MESBUSYCNTRL       0x01d   /* mesBusyCntrl */
+#define SDA_WAKEUPCTRL         0x01e   /* WakeupCtrl */
+#define SDA_SLEEPCSR           0x01f   /* sleepCSR */
+
+/* SDA_F1_REG_SPACE register bits */
+/* sleepCSR register */
+#define SDA_SLEEPCSR_KEEP_SDIO_ON      0x1
+
+/* SDA_F2WATERMARK */
+#define SDA_F2WATERMARK_MASK   0x7f    /* F2Watermark Mask */
+
+/* SDA_SBADDRLOW */
+#define SDA_SBADDRLOW_MASK     0x80    /* SbAddrLow Mask */
+
+/* SDA_SBADDRMID */
+#define SDA_SBADDRMID_MASK     0xff    /* SbAddrMid Mask */
+
+/* SDA_SBADDRHIGH */
+#define SDA_SBADDRHIGH_MASK    0xff    /* SbAddrHigh Mask */
+
+/* SDA_FRAMECTRL */
+#define SFC_RF_TERM    (1 << 0)        /* Read Frame Terminate */
+#define SFC_WF_TERM    (1 << 1)        /* Write Frame Terminate */
+#define SFC_CRC4WOOS   (1 << 2)        /* HW reports CRC error for write out of sync */
+#define SFC_ABORTALL   (1 << 3)        /* Abort cancels all in-progress frames */
+
+/* pcmciaframectrl */
+#define PFC_RF_TERM    (1 << 0)        /* Read Frame Terminate */
+#define PFC_WF_TERM    (1 << 1)        /* Write Frame Terminate */
+
+/* intrcvlazy */
+#define        IRL_TO_MASK     0x00ffffff      /* timeout */
+#define        IRL_FC_MASK     0xff000000      /* frame count */
+#define        IRL_FC_SHIFT    24              /* frame count */
+
+/* rx header */
+typedef volatile struct {
+       uint16 len;
+       uint16 flags;
+} sdpcmd_rxh_t;
+
+/* rx header flags */
+#define RXF_CRC                0x0001          /* CRC error detected */
+#define RXF_WOOS       0x0002          /* write frame out of sync */
+#define RXF_WF_TERM    0x0004          /* write frame terminated */
+#define RXF_ABORT      0x0008          /* write frame aborted */
+#define RXF_DISCARD    (RXF_CRC | RXF_WOOS | RXF_WF_TERM | RXF_ABORT)  /* bad frame */
+
+/* HW frame tag */
+#define SDPCM_FRAMETAG_LEN     4       /* HW frametag: 2 bytes len, 2 bytes check val */
+
+#define SDPCM_HWEXT_LEN        8
+
+#endif /* _sbsdpcmdev_h_ */
diff --git a/bcmdhd.101.10.240.x/include/sbsocram.h b/bcmdhd.101.10.240.x/include/sbsocram.h
new file mode 100644 (file)
index 0000000..f8d6b0d
--- /dev/null
@@ -0,0 +1,198 @@
+/*
+ * BCM47XX Sonics SiliconBackplane embedded ram core
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _SBSOCRAM_H
+#define        _SBSOCRAM_H
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define        _PADLINE(line)  pad ## line
+#define        _XSTR(line)     _PADLINE(line)
+#define        PAD             _XSTR(__LINE__)
+#endif /* PAD */
+
+/* Memcsocram core registers */
+typedef volatile struct sbsocramregs {
+       uint32  coreinfo;
+       uint32  bwalloc;
+       uint32  extracoreinfo;
+       uint32  biststat;
+       uint32  bankidx;
+       uint32  standbyctrl;
+
+       uint32  errlogstatus;   /* rev 6 */
+       uint32  errlogaddr;     /* rev 6 */
+       /* used for patching rev 3 & 5 */
+       uint32  cambankidx;
+       uint32  cambankstandbyctrl;
+       uint32  cambankpatchctrl;
+       uint32  cambankpatchtblbaseaddr;
+       uint32  cambankcmdreg;
+       uint32  cambankdatareg;
+       uint32  cambankmaskreg;
+       uint32  PAD[1];
+       uint32  bankinfo;       /* corev 8 */
+       uint32  bankpda;
+       uint32  PAD[14];
+       uint32  extmemconfig;
+       uint32  extmemparitycsr;
+       uint32  extmemparityerrdata;
+       uint32  extmemparityerrcnt;
+       uint32  extmemwrctrlandsize;
+       uint32  PAD[84];
+       uint32  workaround;
+       uint32  pwrctl;         /* corerev >= 2 */
+       uint32  PAD[133];
+       uint32  sr_control;     /* corerev >= 15 */
+       uint32  sr_status;      /* corerev >= 15 */
+       uint32  sr_address;     /* corerev >= 15 */
+       uint32  sr_data;        /* corerev >= 15 */
+} sbsocramregs_t;
+
+#endif /* _LANGUAGE_ASSEMBLY */
+
+/* Register offsets */
+#define        SR_COREINFO             0x00
+#define        SR_BWALLOC              0x04
+#define        SR_BISTSTAT             0x0c
+#define        SR_BANKINDEX            0x10
+#define        SR_BANKSTBYCTL          0x14
+#define SR_PWRCTL              0x1e8
+
+/* Coreinfo register */
+#define        SRCI_PT_MASK            0x00070000      /* corerev >= 6; port type[18:16] */
+#define        SRCI_PT_SHIFT           16
+/* port types : SRCI_PT_<processorPT>_<backplanePT> */
+#define SRCI_PT_OCP_OCP                0
+#define SRCI_PT_AXI_OCP                1
+#define SRCI_PT_ARM7AHB_OCP    2
+#define SRCI_PT_CM3AHB_OCP     3
+#define SRCI_PT_AXI_AXI                4
+#define SRCI_PT_AHB_AXI                5
+/* corerev >= 3 */
+#define SRCI_LSS_MASK          0x00f00000
+#define SRCI_LSS_SHIFT         20
+#define SRCI_LRS_MASK          0x0f000000
+#define SRCI_LRS_SHIFT         24
+
+/* In corerev 0, the memory size is 2 to the power of the
+ * base plus 16 plus to the contents of the memsize field plus 1.
+ */
+#define        SRCI_MS0_MASK           0xf
+#define SR_MS0_BASE            16
+
+/*
+ * In corerev 1 the bank size is 2 ^ the bank size field plus 14,
+ * the memory size is number of banks times bank size.
+ * The same applies to rom size.
+ */
+#define        SRCI_ROMNB_MASK         0xf000
+#define        SRCI_ROMNB_SHIFT        12
+#define        SRCI_ROMBSZ_MASK        0xf00
+#define        SRCI_ROMBSZ_SHIFT       8
+#define        SRCI_SRNB_MASK          0xf0
+#define        SRCI_SRNB_SHIFT         4
+#define        SRCI_SRBSZ_MASK         0xf
+#define        SRCI_SRBSZ_SHIFT        0
+
+#define        SRCI_SRNB_MASK_EXT      0x100
+
+#define SR_BSZ_BASE            14
+
+/* Standby control register */
+#define        SRSC_SBYOVR_MASK        0x80000000
+#define        SRSC_SBYOVR_SHIFT       31
+#define        SRSC_SBYOVRVAL_MASK     0x60000000
+#define        SRSC_SBYOVRVAL_SHIFT    29
+#define        SRSC_SBYEN_MASK         0x01000000      /* rev >= 3 */
+#define        SRSC_SBYEN_SHIFT        24
+
+/* Power control register */
+#define SRPC_PMU_STBYDIS_MASK  0x00000010      /* rev >= 3 */
+#define SRPC_PMU_STBYDIS_SHIFT 4
+#define SRPC_STBYOVRVAL_MASK   0x00000008
+#define SRPC_STBYOVRVAL_SHIFT  3
+#define SRPC_STBYOVR_MASK      0x00000007
+#define SRPC_STBYOVR_SHIFT     0
+
+/* Extra core capability register */
+#define SRECC_NUM_BANKS_MASK   0x000000F0
+#define SRECC_NUM_BANKS_SHIFT  4
+#define SRECC_BANKSIZE_MASK    0x0000000F
+#define SRECC_BANKSIZE_SHIFT   0
+
+#define SRECC_BANKSIZE(value)   (1 << (value))
+
+/* CAM bank patch control */
+#define SRCBPC_PATCHENABLE 0x80000000
+
+#define SRP_ADDRESS   0x0001FFFC
+#define SRP_VALID     0x8000
+
+/* CAM bank command reg */
+#define SRCMD_WRITE  0x00020000
+#define SRCMD_READ   0x00010000
+#define SRCMD_DONE   0x80000000
+
+#define SRCMD_DONE_DLY 1000
+
+/* bankidx and bankinfo reg defines corerev >= 8 */
+#define SOCRAM_BANKINFO_SZMASK         0x7f
+#define SOCRAM_BANKIDX_ROM_MASK                0x100
+
+#define SOCRAM_BANKIDX_MEMTYPE_SHIFT   8
+/* socram bankinfo memtype */
+#define SOCRAM_MEMTYPE_RAM             0
+#define SOCRAM_MEMTYPE_ROM             1
+#define SOCRAM_MEMTYPE_DEVRAM          2
+
+#define        SOCRAM_BANKINFO_REG             0x40
+#define        SOCRAM_BANKIDX_REG              0x10
+#define        SOCRAM_BANKINFO_STDBY_MASK      0x400
+#define        SOCRAM_BANKINFO_STDBY_TIMER     0x800
+
+/* bankinfo rev >= 10 */
+#define SOCRAM_BANKINFO_DEVRAMSEL_SHIFT                13
+#define SOCRAM_BANKINFO_DEVRAMSEL_MASK         0x2000
+#define SOCRAM_BANKINFO_DEVRAMPRO_SHIFT                14
+#define SOCRAM_BANKINFO_DEVRAMPRO_MASK         0x4000
+#define SOCRAM_BANKINFO_SLPSUPP_SHIFT          15
+#define SOCRAM_BANKINFO_SLPSUPP_MASK           0x8000
+#define SOCRAM_BANKINFO_RETNTRAM_SHIFT         16
+#define SOCRAM_BANKINFO_RETNTRAM_MASK          0x00010000
+#define SOCRAM_BANKINFO_PDASZ_SHIFT            17
+#define SOCRAM_BANKINFO_PDASZ_MASK             0x003E0000
+#define SOCRAM_BANKINFO_DEVRAMREMAP_SHIFT      24
+#define SOCRAM_BANKINFO_DEVRAMREMAP_MASK       0x01000000
+
+/* extracoreinfo register */
+#define SOCRAM_DEVRAMBANK_MASK         0xF000
+#define SOCRAM_DEVRAMBANK_SHIFT                12
+
+/* bank info to calculate bank size */
+#define   SOCRAM_BANKINFO_SZBASE          8192
+#define SOCRAM_BANKSIZE_SHIFT         13      /* SOCRAM_BANKINFO_SZBASE */
+
+#endif /* _SBSOCRAM_H */
diff --git a/bcmdhd.101.10.240.x/include/sbsysmem.h b/bcmdhd.101.10.240.x/include/sbsysmem.h
new file mode 100644 (file)
index 0000000..0783e4b
--- /dev/null
@@ -0,0 +1,186 @@
+/*
+ * SiliconBackplane System Memory core
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _SBSYSMEM_H
+#define        _SBSYSMEM_H
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define        _PADLINE(line)  pad ## line
+#define        _XSTR(line)     _PADLINE(line)
+#define        PAD             _XSTR(__LINE__)
+#endif /* PAD */
+
+/* sysmem core registers */
+typedef volatile struct sysmemregs {
+       uint32  coreinfo;
+       uint32  bwalloc;
+       uint32  extracoreinfo;
+       uint32  biststat;
+       uint32  bankidx;
+       uint32  standbyctrl;
+
+       uint32  errlogstatus;
+       uint32  errlogaddr;
+
+       uint32  cambankidx;
+       uint32  cambankstandbyctrl;
+       uint32  cambankpatchctrl;
+       uint32  cambankpatchtblbaseaddr;
+       uint32  cambankcmdreg;
+       uint32  cambankdatareg;
+       uint32  standbywait;
+       uint32  PAD[1];
+       uint32  bankinfo;
+       uint32  PAD[7];
+       uint32  region_n_regs[32];
+       uint32  initiat_n_masks[31];
+       uint32  PAD[1];
+       uint32  mpucontrol;
+       uint32  mpucapabilities;
+       uint32  PAD[31];
+       uint32  workaround;
+       uint32  pwrctl;
+       uint32  PAD[133];
+       uint32  sr_control;
+       uint32  sr_status;
+       uint32  sr_address;
+       uint32  sr_data;
+} sysmemregs_t;
+
+/* bus MPU region count mask of sysmemregs_t->mpucapabilities */
+#define ACC_MPU_REGION_CNT_MASK        0x7u
+/* bus MPU disable mask of sysmemregs_t->mpucontrol */
+#define BUSMPU_DISABLE_MASK    0xfu
+
+#endif /* _LANGUAGE_ASSEMBLY */
+
+/* Register offsets */
+#define        SR_COREINFO             0x00
+#define        SR_BWALLOC              0x04
+#define        SR_BISTSTAT             0x0c
+#define        SR_BANKINDEX            0x10
+#define        SR_BANKSTBYCTL          0x14
+#define SR_PWRCTL              0x1e8
+
+/* Coreinfo register */
+#define        SRCI_PT_MASK            0x00070000      /* port type[18:16] */
+#define        SRCI_PT_SHIFT           16
+/* port types : SRCI_PT_<processorPT>_<backplanePT> */
+#define SRCI_PT_OCP_OCP                0
+#define SRCI_PT_AXI_OCP                1
+#define SRCI_PT_ARM7AHB_OCP    2
+#define SRCI_PT_CM3AHB_OCP     3
+#define SRCI_PT_AXI_AXI                4
+#define SRCI_PT_AHB_AXI                5
+
+#define SRCI_LSS_MASK          0x00f00000
+#define SRCI_LSS_SHIFT         20
+#define SRCI_LRS_MASK          0x0f000000
+#define SRCI_LRS_SHIFT         24
+
+/* In corerev 0, the memory size is 2 to the power of the
+ * base plus 16 plus to the contents of the memsize field plus 1.
+ */
+#define        SRCI_MS0_MASK           0xf
+#define SR_MS0_BASE            16
+
+/*
+ * In corerev 1 the bank size is 2 ^ the bank size field plus 14,
+ * the memory size is number of banks times bank size.
+ * The same applies to rom size.
+ */
+#define        SYSMEM_SRCI_ROMNB_MASK  0x3e0
+#define        SYSMEM_SRCI_ROMNB_SHIFT 5
+#define        SYSMEM_SRCI_SRNB_MASK   0x1f
+#define        SYSMEM_SRCI_SRNB_SHIFT  0
+
+/* Standby control register */
+#define        SRSC_SBYOVR_MASK        0x80000000
+#define        SRSC_SBYOVR_SHIFT       31
+#define        SRSC_SBYOVRVAL_MASK     0x60000000
+#define        SRSC_SBYOVRVAL_SHIFT    29
+#define        SRSC_SBYEN_MASK         0x01000000
+#define        SRSC_SBYEN_SHIFT        24
+
+/* Power control register */
+#define SRPC_PMU_STBYDIS_MASK  0x00000010
+#define SRPC_PMU_STBYDIS_SHIFT 4
+#define SRPC_STBYOVRVAL_MASK   0x00000008
+#define SRPC_STBYOVRVAL_SHIFT  3
+#define SRPC_STBYOVR_MASK      0x00000007
+#define SRPC_STBYOVR_SHIFT     0
+
+/* Extra core capability register */
+#define SRECC_NUM_BANKS_MASK   0x000000F0
+#define SRECC_NUM_BANKS_SHIFT  4
+#define SRECC_BANKSIZE_MASK    0x0000000F
+#define SRECC_BANKSIZE_SHIFT   0
+
+#define SRECC_BANKSIZE(value)   (1 << (value))
+
+/* CAM bank patch control */
+#define SRCBPC_PATCHENABLE 0x80000000
+
+#define SRP_ADDRESS   0x0001FFFC
+#define SRP_VALID     0x8000
+
+/* CAM bank command reg */
+#define SRCMD_WRITE  0x00020000
+#define SRCMD_READ   0x00010000
+#define SRCMD_DONE   0x80000000
+
+#define SRCMD_DONE_DLY 1000
+
+/* bankidx and bankinfo reg defines */
+#define SYSMEM_BANKINFO_SZMASK         0x7f
+#define SYSMEM_BANKIDX_ROM_MASK                0x80
+
+#define        SYSMEM_BANKINFO_REG             0x40
+#define        SYSMEM_BANKIDX_REG              0x10
+#define        SYSMEM_BANKINFO_STDBY_MASK      0x200
+#define        SYSMEM_BANKINFO_STDBY_TIMER     0x400
+
+#define SYSMEM_BANKINFO_SLPSUPP_SHIFT          14
+#define SYSMEM_BANKINFO_SLPSUPP_MASK           0x4000
+#define SYSMEM_BANKINFO_PDASZ_SHIFT            16
+#define SYSMEM_BANKINFO_PDASZ_MASK             0x001F0000
+
+/* extracoreinfo register */
+#define SYSMEM_DEVRAMBANK_MASK         0xF000
+#define SYSMEM_DEVRAMBANK_SHIFT                12
+
+/* bank info to calculate bank size */
+#define        SYSMEM_BANKINFO_SZBASE          8192
+#define SYSMEM_BANKSIZE_SHIFT          13      /* SYSMEM_BANKINFO_SZBASE */
+
+/* standbycontrol register default values */
+#define SYSMEM_SBYCNTRL_TIMEVAL                0x100000u       /* standbycontrol timeval[23:0] */
+#define SYSMEM_SBYCNTRL_TIMEVAL_MASK   0xffffffu
+
+/* sbywaitcycle register default values (sysme rev 8) */
+#define SYSMEM_SBYWAIT_RAM_TIMEVAL     0xau    /* RAM memory access after standby exit */
+
+#endif /* _SBSYSMEM_H */
diff --git a/bcmdhd.101.10.240.x/include/sdio.h b/bcmdhd.101.10.240.x/include/sdio.h
new file mode 100644 (file)
index 0000000..b995929
--- /dev/null
@@ -0,0 +1,644 @@
+/*
+ * SDIO spec header file
+ * Protocol and standard (common) device definitions
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _SDIO_H
+#define        _SDIO_H
+
+#ifdef BCMSDIO
+/*
+ * Standard SD Device Register Map.
+ *
+ * Reference definitions from:
+ *  SD Specifications, Part E1: SDIO Specification
+ *  Version 1.10
+ *  August 18, 2004
+ *  http://www.sdcard.org
+ *
+ * EXCEPTION: The speed_control register defined here is based on a
+ * draft of the next version, and is thus nonstandard.
+ */
+
+/* CCCR structure for function 0 */
+typedef volatile struct {
+       uint8   cccr_sdio_rev;          /* RO, cccr and sdio revision */
+       uint8   sd_rev;                 /* RO, sd spec revision */
+       uint8   io_en;                  /* I/O enable */
+       uint8   io_rdy;                 /* I/O ready reg */
+       uint8   intr_ctl;               /* Master and per function interrupt enable control */
+       uint8   intr_status;            /* RO, interrupt pending status */
+       uint8   io_abort;               /* read/write abort or reset all functions */
+       uint8   bus_inter;              /* bus interface control */
+       uint8   capability;             /* RO, card capability */
+
+       uint8   cis_base_low;           /* 0x9 RO, common CIS base address, LSB */
+       uint8   cis_base_mid;
+       uint8   cis_base_high;          /* 0xB RO, common CIS base address, MSB */
+
+       /* suspend/resume registers */
+       uint8   bus_suspend;            /* 0xC */
+       uint8   func_select;            /* 0xD */
+       uint8   exec_flag;              /* 0xE */
+       uint8   ready_flag;             /* 0xF */
+
+       uint8   fn0_blk_size[2];        /* 0x10(LSB), 0x11(MSB) */
+
+       uint8   power_control;          /* 0x12 (SDIO version 1.10) */
+
+       uint8   speed_control;          /* 0x13 */
+} sdio_regs_t;
+
+/* SDIO Device CCCR offsets */
+#define SDIOD_CCCR_REV                 0x00
+#define SDIOD_CCCR_SDREV               0x01
+#define SDIOD_CCCR_IOEN                        0x02
+#define SDIOD_CCCR_IORDY               0x03
+#define SDIOD_CCCR_INTEN               0x04
+#define SDIOD_CCCR_INTPEND             0x05
+#define SDIOD_CCCR_IOABORT             0x06
+#define SDIOD_CCCR_BICTRL              0x07
+#define SDIOD_CCCR_CAPABLITIES         0x08
+#define SDIOD_CCCR_CISPTR_0            0x09
+#define SDIOD_CCCR_CISPTR_1            0x0A
+#define SDIOD_CCCR_CISPTR_2            0x0B
+#define SDIOD_CCCR_BUSSUSP             0x0C
+#define SDIOD_CCCR_FUNCSEL             0x0D
+#define SDIOD_CCCR_EXECFLAGS           0x0E
+#define SDIOD_CCCR_RDYFLAGS            0x0F
+#define SDIOD_CCCR_BLKSIZE_0           0x10
+#define SDIOD_CCCR_BLKSIZE_1           0x11
+#define SDIOD_CCCR_POWER_CONTROL       0x12
+#define SDIOD_CCCR_SPEED_CONTROL       0x13
+#define SDIOD_CCCR_UHSI_SUPPORT                0x14
+#define SDIOD_CCCR_DRIVER_STRENGTH     0x15
+#define SDIOD_CCCR_INTR_EXTN           0x16
+
+/* Broadcom extensions (corerev >= 1) */
+#define SDIOD_CCCR_BRCM_CARDCAP                0xf0
+#define SDIOD_CCCR_BRCM_CARDCAP_CMD14_SUPPORT  0x02
+#define SDIOD_CCCR_BRCM_CARDCAP_CMD14_EXT      0x04
+#define SDIOD_CCCR_BRCM_CARDCAP_CMD_NODEC      0x08
+#define SDIOD_CCCR_BRCM_CARDCTL                        0xf1
+#define SDIOD_CCCR_BRCM_SEPINT                 0xf2
+
+/* cccr_sdio_rev */
+#define SDIO_REV_SDIOID_MASK   0xf0    /* SDIO spec revision number */
+#define SDIO_REV_CCCRID_MASK   0x0f    /* CCCR format version number */
+#define SDIO_SPEC_VERSION_3_0  0x40    /* SDIO spec version 3.0 */
+
+/* sd_rev */
+#define SD_REV_PHY_MASK                0x0f    /* SD format version number */
+
+/* io_en */
+#define SDIO_FUNC_ENABLE_1     0x02    /* function 1 I/O enable */
+#define SDIO_FUNC_ENABLE_2     0x04    /* function 2 I/O enable */
+#if defined(BT_OVER_SDIO)
+#define SDIO_FUNC_ENABLE_3     0x08    /* function 2 I/O enable */
+#define SDIO_FUNC_DISABLE_3    0xF0    /* function 2 I/O enable */
+#endif /* defined (BT_OVER_SDIO) */
+
+/* io_rdys */
+#define SDIO_FUNC_READY_1      0x02    /* function 1 I/O ready */
+#define SDIO_FUNC_READY_2      0x04    /* function 2 I/O ready */
+
+/* intr_ctl */
+#define INTR_CTL_MASTER_EN     0x1     /* interrupt enable master */
+#define INTR_CTL_FUNC1_EN      0x2     /* interrupt enable for function 1 */
+#define INTR_CTL_FUNC2_EN      0x4     /* interrupt enable for function 2 */
+#if defined(BT_OVER_SDIO)
+#define INTR_CTL_FUNC3_EN      0x8     /* interrupt enable for function 3 */
+#endif /* defined (BT_OVER_SDIO) */
+/* intr_status */
+#define INTR_STATUS_FUNC1      0x2     /* interrupt pending for function 1 */
+#define INTR_STATUS_FUNC2      0x4     /* interrupt pending for function 2 */
+
+/* io_abort */
+#define IO_ABORT_RESET_ALL     0x08    /* I/O card reset */
+#define IO_ABORT_FUNC_MASK     0x07    /* abort selction: function x */
+
+/* bus_inter */
+#define BUS_CARD_DETECT_DIS    0x80    /* Card Detect disable */
+#define BUS_SPI_CONT_INTR_CAP  0x40    /* support continuous SPI interrupt */
+#define BUS_SPI_CONT_INTR_EN   0x20    /* continuous SPI interrupt enable */
+#define BUS_SD_DATA_WIDTH_MASK 0x03    /* bus width mask */
+#define BUS_SD_DATA_WIDTH_4BIT 0x02    /* bus width 4-bit mode */
+#define BUS_SD_DATA_WIDTH_1BIT 0x00    /* bus width 1-bit mode */
+
+/* capability */
+#define SDIO_CAP_4BLS          0x80    /* 4-bit support for low speed card */
+#define SDIO_CAP_LSC           0x40    /* low speed card */
+#define SDIO_CAP_E4MI          0x20    /* enable interrupt between block of data in 4-bit mode */
+#define SDIO_CAP_S4MI          0x10    /* support interrupt between block of data in 4-bit mode */
+#define SDIO_CAP_SBS           0x08    /* support suspend/resume */
+#define SDIO_CAP_SRW           0x04    /* support read wait */
+#define SDIO_CAP_SMB           0x02    /* support multi-block transfer */
+#define SDIO_CAP_SDC           0x01    /* Support Direct commands during multi-byte transfer */
+
+/* power_control */
+#define SDIO_POWER_SMPC                0x01    /* supports master power control (RO) */
+#define SDIO_POWER_EMPC                0x02    /* enable master power control (allow > 200mA) (RW) */
+
+/* speed_control (control device entry into high-speed clocking mode) */
+#define SDIO_SPEED_SHS         0x01    /* supports high-speed [clocking] mode (RO) */
+#define SDIO_SPEED_EHS         0x02    /* enable high-speed [clocking] mode (RW) */
+#define SDIO_SPEED_UHSI_DDR50     0x08
+
+/* for setting bus speed in card: 0x13h */
+#define SDIO_BUS_SPEED_UHSISEL_M       BITFIELD_MASK(3)
+#define SDIO_BUS_SPEED_UHSISEL_S       1
+
+/* for getting bus speed cap in card: 0x14h */
+#define SDIO_BUS_SPEED_UHSICAP_M       BITFIELD_MASK(3)
+#define SDIO_BUS_SPEED_UHSICAP_S       0
+
+/* for getting driver type CAP in card: 0x15h */
+#define SDIO_BUS_DRVR_TYPE_CAP_M       BITFIELD_MASK(3)
+#define SDIO_BUS_DRVR_TYPE_CAP_S       0
+
+/* for setting driver type selection in card: 0x15h */
+#define SDIO_BUS_DRVR_TYPE_SEL_M       BITFIELD_MASK(2)
+#define SDIO_BUS_DRVR_TYPE_SEL_S       4
+
+/* for getting async int support in card: 0x16h */
+#define SDIO_BUS_ASYNCINT_CAP_M        BITFIELD_MASK(1)
+#define SDIO_BUS_ASYNCINT_CAP_S        0
+
+/* for setting async int selection in card: 0x16h */
+#define SDIO_BUS_ASYNCINT_SEL_M        BITFIELD_MASK(1)
+#define SDIO_BUS_ASYNCINT_SEL_S        1
+
+/* brcm sepint */
+#define SDIO_SEPINT_MASK       0x01    /* route sdpcmdev intr onto separate pad (chip-specific) */
+#define SDIO_SEPINT_OE         0x02    /* 1 asserts output enable for above pad */
+#define SDIO_SEPINT_ACT_HI     0x04    /* use active high interrupt level instead of active low */
+
+/* FBR structure for function 1-7, FBR addresses and register offsets */
+typedef volatile struct {
+       uint8   devctr;                 /* device interface, CSA control */
+       uint8   ext_dev;                /* extended standard I/O device type code */
+       uint8   pwr_sel;                /* power selection support */
+       uint8   PAD[6];                 /* reserved */
+
+       uint8   cis_low;                /* CIS LSB */
+       uint8   cis_mid;
+       uint8   cis_high;               /* CIS MSB */
+       uint8   csa_low;                /* code storage area, LSB */
+       uint8   csa_mid;
+       uint8   csa_high;               /* code storage area, MSB */
+       uint8   csa_dat_win;            /* data access window to function */
+
+       uint8   fnx_blk_size[2];        /* block size, little endian */
+} sdio_fbr_t;
+
+/* Maximum number of I/O funcs */
+#define SDIOD_MAX_FUNCS                        8
+#define SDIOD_MAX_IOFUNCS              7
+
+/* SDIO Device FBR Start Address  */
+#define SDIOD_FBR_STARTADDR            0x100
+
+/* SDIO Device FBR Size */
+#define SDIOD_FBR_SIZE                 0x100
+
+/* Macro to calculate FBR register base */
+#define SDIOD_FBR_BASE(n)              ((n) * 0x100)
+
+/* Function register offsets */
+#define SDIOD_FBR_DEVCTR               0x00    /* basic info for function */
+#define SDIOD_FBR_EXT_DEV              0x01    /* extended I/O device code */
+#define SDIOD_FBR_PWR_SEL              0x02    /* power selection bits */
+
+/* SDIO Function CIS ptr offset */
+#define SDIOD_FBR_CISPTR_0             0x09
+#define SDIOD_FBR_CISPTR_1             0x0A
+#define SDIOD_FBR_CISPTR_2             0x0B
+
+/* Code Storage Area pointer */
+#define SDIOD_FBR_CSA_ADDR_0           0x0C
+#define SDIOD_FBR_CSA_ADDR_1           0x0D
+#define SDIOD_FBR_CSA_ADDR_2           0x0E
+#define SDIOD_FBR_CSA_DATA             0x0F
+
+/* SDIO Function I/O Block Size */
+#define SDIOD_FBR_BLKSIZE_0            0x10
+#define SDIOD_FBR_BLKSIZE_1            0x11
+
+/* devctr */
+#define SDIOD_FBR_DEVCTR_DIC   0x0f    /* device interface code */
+#define SDIOD_FBR_DECVTR_CSA   0x40    /* CSA support flag */
+#define SDIOD_FBR_DEVCTR_CSA_EN        0x80    /* CSA enabled */
+/* interface codes */
+#define SDIOD_DIC_NONE         0       /* SDIO standard interface is not supported */
+#define SDIOD_DIC_UART         1
+#define SDIOD_DIC_BLUETOOTH_A  2
+#define SDIOD_DIC_BLUETOOTH_B  3
+#define SDIOD_DIC_GPS          4
+#define SDIOD_DIC_CAMERA       5
+#define SDIOD_DIC_PHS          6
+#define SDIOD_DIC_WLAN         7
+#define SDIOD_DIC_EXT          0xf     /* extended device interface, read ext_dev register */
+
+/* pwr_sel */
+#define SDIOD_PWR_SEL_SPS      0x01    /* supports power selection */
+#define SDIOD_PWR_SEL_EPS      0x02    /* enable power selection (low-current mode) */
+
+/* misc defines */
+#define SDIO_FUNC_0            0
+#define SDIO_FUNC_1            1
+#define SDIO_FUNC_2            2
+#define SDIO_FUNC_4            4
+#define SDIO_FUNC_5            5
+#define SDIO_FUNC_6            6
+#define SDIO_FUNC_7            7
+
+#define SD_CARD_TYPE_UNKNOWN   0       /* bad type or unrecognized */
+#define SD_CARD_TYPE_IO                1       /* IO only card */
+#define SD_CARD_TYPE_MEMORY    2       /* memory only card */
+#define SD_CARD_TYPE_COMBO     3       /* IO and memory combo card */
+
+#define SDIO_MAX_BLOCK_SIZE    2048    /* maximum block size for block mode operation */
+#define SDIO_MIN_BLOCK_SIZE    1       /* minimum block size for block mode operation */
+
+/* Card registers: status bit position */
+#define CARDREG_STATUS_BIT_OUTOFRANGE          31
+#define CARDREG_STATUS_BIT_COMCRCERROR         23
+#define CARDREG_STATUS_BIT_ILLEGALCOMMAND      22
+#define CARDREG_STATUS_BIT_ERROR               19
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE3     12
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE2     11
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE1     10
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE0     9
+#define CARDREG_STATUS_BIT_FUN_NUM_ERROR       4
+
+/* ----------------------------------------------------
+ * SDIO Protocol Definitions -- commands and responses
+ *
+ * Reference definitions from SDIO Specification v1.10
+ * of August 18, 2004; and SD Physical Layer v1.10 of
+ * October 15, 2004.
+ * ----------------------------------------------------
+ */
+
+/* Straight defines, mostly used by older driver(s). */
+
+#define SD_CMD_GO_IDLE_STATE           0       /* mandatory for SDIO */
+#define SD_CMD_SEND_OPCOND             1
+#define SD_CMD_MMC_SET_RCA             3
+#define SD_CMD_IO_SEND_OP_COND         5       /* mandatory for SDIO */
+#define SD_CMD_SELECT_DESELECT_CARD    7
+#define SD_CMD_SEND_CSD                        9
+#define SD_CMD_SEND_CID                        10
+#define SD_CMD_STOP_TRANSMISSION       12
+#define SD_CMD_SEND_STATUS             13
+#define SD_CMD_GO_INACTIVE_STATE       15
+#define SD_CMD_SET_BLOCKLEN            16
+#define SD_CMD_READ_SINGLE_BLOCK       17
+#define SD_CMD_READ_MULTIPLE_BLOCK     18
+#define SD_CMD_WRITE_BLOCK             24
+#define SD_CMD_WRITE_MULTIPLE_BLOCK    25
+#define SD_CMD_PROGRAM_CSD             27
+#define SD_CMD_SET_WRITE_PROT          28
+#define SD_CMD_CLR_WRITE_PROT          29
+#define SD_CMD_SEND_WRITE_PROT         30
+#define SD_CMD_ERASE_WR_BLK_START      32
+#define SD_CMD_ERASE_WR_BLK_END                33
+#define SD_CMD_ERASE                   38
+#define SD_CMD_LOCK_UNLOCK             42
+#define SD_CMD_IO_RW_DIRECT            52      /* mandatory for SDIO */
+#define SD_CMD_IO_RW_EXTENDED          53      /* mandatory for SDIO */
+#define SD_CMD_APP_CMD                 55
+#define SD_CMD_GEN_CMD                 56
+#define SD_CMD_READ_OCR                        58
+#define SD_CMD_CRC_ON_OFF              59      /* mandatory for SDIO */
+#define SD_ACMD_SD_STATUS              13
+#define SD_ACMD_SEND_NUM_WR_BLOCKS     22
+#define SD_ACMD_SET_WR_BLOCK_ERASE_CNT 23
+#define SD_ACMD_SD_SEND_OP_COND                41
+#define SD_ACMD_SET_CLR_CARD_DETECT    42
+#define SD_ACMD_SEND_SCR               51
+
+/* argument for SD_CMD_IO_RW_DIRECT and SD_CMD_IO_RW_EXTENDED */
+#define SD_IO_OP_READ          0   /* Read_Write: Read */
+#define SD_IO_OP_WRITE         1   /* Read_Write: Write */
+#define SD_IO_RW_NORMAL                0   /* no RAW */
+#define SD_IO_RW_RAW           1   /* RAW */
+#define SD_IO_BYTE_MODE                0   /* Byte Mode */
+#define SD_IO_BLOCK_MODE       1   /* BlockMode */
+#define SD_IO_FIXED_ADDRESS    0   /* fix Address */
+#define SD_IO_INCREMENT_ADDRESS        1   /* IncrementAddress */
+
+/* build SD_CMD_IO_RW_DIRECT Argument */
+#define SDIO_IO_RW_DIRECT_ARG(rw, raw, func, addr, data) \
+       ((((rw) & 1) << 31) | (((func) & 0x7) << 28) | (((raw) & 1) << 27) | \
+        (((addr) & 0x1FFFF) << 9) | ((data) & 0xFF))
+
+/* build SD_CMD_IO_RW_EXTENDED Argument */
+#define SDIO_IO_RW_EXTENDED_ARG(rw, blk, func, addr, inc_addr, count) \
+       ((((rw) & 1) << 31) | (((func) & 0x7) << 28) | (((blk) & 1) << 27) | \
+        (((inc_addr) & 1) << 26) | (((addr) & 0x1FFFF) << 9) | ((count) & 0x1FF))
+
+/* SDIO response parameters */
+#define SD_RSP_NO_NONE                 0
+#define SD_RSP_NO_1                    1
+#define SD_RSP_NO_2                    2
+#define SD_RSP_NO_3                    3
+#define SD_RSP_NO_4                    4
+#define SD_RSP_NO_5                    5
+#define SD_RSP_NO_6                    6
+
+       /* Modified R6 response (to CMD3) */
+#define SD_RSP_MR6_COM_CRC_ERROR       0x8000
+#define SD_RSP_MR6_ILLEGAL_COMMAND     0x4000
+#define SD_RSP_MR6_ERROR               0x2000
+
+       /* Modified R1 in R4 Response (to CMD5) */
+#define SD_RSP_MR1_SBIT                        0x80
+#define SD_RSP_MR1_PARAMETER_ERROR     0x40
+#define SD_RSP_MR1_RFU5                        0x20
+#define SD_RSP_MR1_FUNC_NUM_ERROR      0x10
+#define SD_RSP_MR1_COM_CRC_ERROR       0x08
+#define SD_RSP_MR1_ILLEGAL_COMMAND     0x04
+#define SD_RSP_MR1_RFU1                        0x02
+#define SD_RSP_MR1_IDLE_STATE          0x01
+
+       /* R5 response (to CMD52 and CMD53) */
+#define SD_RSP_R5_COM_CRC_ERROR                0x80
+#define SD_RSP_R5_ILLEGAL_COMMAND      0x40
+#define SD_RSP_R5_IO_CURRENTSTATE1     0x20
+#define SD_RSP_R5_IO_CURRENTSTATE0     0x10
+#define SD_RSP_R5_ERROR                        0x08
+#define SD_RSP_R5_RFU                  0x04
+#define SD_RSP_R5_FUNC_NUM_ERROR       0x02
+#define SD_RSP_R5_OUT_OF_RANGE         0x01
+
+#define SD_RSP_R5_ERRBITS              0xCB
+
+/* Mask/shift form, commonly used in newer driver(s) */
+
+/* ------------------------------------------------
+ *  SDIO Commands and responses
+ *
+ *  I/O only commands are:
+ *      CMD0, CMD3, CMD5, CMD7, CMD14, CMD15, CMD52, CMD53
+ * ------------------------------------------------
+ */
+
+/* SDIO Commands */
+#define SDIOH_CMD_0            0
+#define SDIOH_CMD_3            3
+#define SDIOH_CMD_5            5
+#define SDIOH_CMD_7            7
+#define SDIOH_CMD_11           11
+#define SDIOH_CMD_14           14
+#define SDIOH_CMD_15           15
+#define SDIOH_CMD_19           19
+#define SDIOH_CMD_52           52
+#define SDIOH_CMD_53           53
+#define SDIOH_CMD_59           59
+
+/* SDIO Command Responses */
+#define SDIOH_RSP_NONE         0
+#define SDIOH_RSP_R1           1
+#define SDIOH_RSP_R2           2
+#define SDIOH_RSP_R3           3
+#define SDIOH_RSP_R4           4
+#define SDIOH_RSP_R5           5
+#define SDIOH_RSP_R6           6
+
+/*
+ *  SDIO Response Error flags
+ */
+#define SDIOH_RSP5_ERROR_FLAGS 0xCB
+
+/* ------------------------------------------------
+ * SDIO Command structures. I/O only commands are:
+ *
+ *     CMD0, CMD3, CMD5, CMD7, CMD15, CMD52, CMD53
+ * ------------------------------------------------
+ */
+
+#define CMD5_OCR_M             BITFIELD_MASK(24)
+#define CMD5_OCR_S             0
+
+#define CMD5_S18R_M            BITFIELD_MASK(1)
+#define CMD5_S18R_S            24
+
+#define CMD7_RCA_M             BITFIELD_MASK(16)
+#define CMD7_RCA_S             16
+
+#define CMD14_RCA_M            BITFIELD_MASK(16)
+#define CMD14_RCA_S            16
+#define CMD14_SLEEP_M          BITFIELD_MASK(1)
+#define CMD14_SLEEP_S          15
+
+#define CMD_15_RCA_M           BITFIELD_MASK(16)
+#define CMD_15_RCA_S           16
+
+#define CMD52_DATA_M           BITFIELD_MASK(8)  /* Bits [7:0]    - Write Data/Stuff bits of CMD52
+                                                  */
+#define CMD52_DATA_S           0
+#define CMD52_REG_ADDR_M       BITFIELD_MASK(17) /* Bits [25:9]   - register address */
+#define CMD52_REG_ADDR_S       9
+#define CMD52_RAW_M            BITFIELD_MASK(1)  /* Bit  27       - Read after Write flag */
+#define CMD52_RAW_S            27
+#define CMD52_FUNCTION_M       BITFIELD_MASK(3)  /* Bits [30:28]  - Function number */
+#define CMD52_FUNCTION_S       28
+#define CMD52_RW_FLAG_M                BITFIELD_MASK(1)  /* Bit  31       - R/W flag */
+#define CMD52_RW_FLAG_S                31
+
+#define CMD53_BYTE_BLK_CNT_M   BITFIELD_MASK(9) /* Bits [8:0]     - Byte/Block Count of CMD53 */
+#define CMD53_BYTE_BLK_CNT_S   0
+#define CMD53_REG_ADDR_M       BITFIELD_MASK(17) /* Bits [25:9]   - register address */
+#define CMD53_REG_ADDR_S       9
+#define CMD53_OP_CODE_M                BITFIELD_MASK(1)  /* Bit  26       - R/W Operation Code */
+#define CMD53_OP_CODE_S                26
+#define CMD53_BLK_MODE_M       BITFIELD_MASK(1)  /* Bit  27       - Block Mode */
+#define CMD53_BLK_MODE_S       27
+#define CMD53_FUNCTION_M       BITFIELD_MASK(3)  /* Bits [30:28]  - Function number */
+#define CMD53_FUNCTION_S       28
+#define CMD53_RW_FLAG_M                BITFIELD_MASK(1)  /* Bit  31       - R/W flag */
+#define CMD53_RW_FLAG_S                31
+
+/* ------------------------------------------------------
+ * SDIO Command Response structures for SD1 and SD4 modes
+ *  -----------------------------------------------------
+ */
+#define RSP4_IO_OCR_M          BITFIELD_MASK(24) /* Bits [23:0]  - Card's OCR Bits [23:0] */
+#define RSP4_IO_OCR_S          0
+
+#define RSP4_S18A_M                    BITFIELD_MASK(1) /* Bits [23:0]  - Card's OCR Bits [23:0] */
+#define RSP4_S18A_S                    24
+
+#define RSP4_STUFF_M           BITFIELD_MASK(3)  /* Bits [26:24] - Stuff bits */
+#define RSP4_STUFF_S           24
+#define RSP4_MEM_PRESENT_M     BITFIELD_MASK(1)  /* Bit  27      - Memory present */
+#define RSP4_MEM_PRESENT_S     27
+#define RSP4_NUM_FUNCS_M       BITFIELD_MASK(3)  /* Bits [30:28] - Number of I/O funcs */
+#define RSP4_NUM_FUNCS_S       28
+#define RSP4_CARD_READY_M      BITFIELD_MASK(1)  /* Bit  31      - SDIO card ready */
+#define RSP4_CARD_READY_S      31
+
+#define RSP6_STATUS_M          BITFIELD_MASK(16) /* Bits [15:0]  - Card status bits [19,22,23,12:0]
+                                                  */
+#define RSP6_STATUS_S          0
+#define RSP6_IO_RCA_M          BITFIELD_MASK(16) /* Bits [31:16] - RCA bits[31-16] */
+#define RSP6_IO_RCA_S          16
+
+#define RSP1_AKE_SEQ_ERROR_M   BITFIELD_MASK(1)  /* Bit 3       - Authentication seq error */
+#define RSP1_AKE_SEQ_ERROR_S   3
+#define RSP1_APP_CMD_M         BITFIELD_MASK(1)  /* Bit 5       - Card expects ACMD */
+#define RSP1_APP_CMD_S         5
+#define RSP1_READY_FOR_DATA_M  BITFIELD_MASK(1)  /* Bit 8       - Ready for data (buff empty) */
+#define RSP1_READY_FOR_DATA_S  8
+#define RSP1_CURR_STATE_M      BITFIELD_MASK(4)  /* Bits [12:9] - State of card
+                                                  * when Cmd was received
+                                                  */
+#define RSP1_CURR_STATE_S      9
+#define RSP1_EARSE_RESET_M     BITFIELD_MASK(1)  /* Bit 13   - Erase seq cleared */
+#define RSP1_EARSE_RESET_S     13
+#define RSP1_CARD_ECC_DISABLE_M        BITFIELD_MASK(1)  /* Bit 14   - Card ECC disabled */
+#define RSP1_CARD_ECC_DISABLE_S        14
+#define RSP1_WP_ERASE_SKIP_M   BITFIELD_MASK(1)  /* Bit 15   - Partial blocks erased due to W/P */
+#define RSP1_WP_ERASE_SKIP_S   15
+#define RSP1_CID_CSD_OVERW_M   BITFIELD_MASK(1)  /* Bit 16   - Illegal write to CID or R/O bits
+                                                  * of CSD
+                                                  */
+#define RSP1_CID_CSD_OVERW_S   16
+#define RSP1_ERROR_M           BITFIELD_MASK(1)  /* Bit 19   - General/Unknown error */
+#define RSP1_ERROR_S           19
+#define RSP1_CC_ERROR_M                BITFIELD_MASK(1)  /* Bit 20   - Internal Card Control error */
+#define RSP1_CC_ERROR_S                20
+#define RSP1_CARD_ECC_FAILED_M BITFIELD_MASK(1)  /* Bit 21   - Card internal ECC failed
+                                                  * to correct data
+                                                  */
+#define RSP1_CARD_ECC_FAILED_S 21
+#define RSP1_ILLEGAL_CMD_M     BITFIELD_MASK(1)  /* Bit 22   - Cmd not legal for the card state */
+#define RSP1_ILLEGAL_CMD_S     22
+#define RSP1_COM_CRC_ERROR_M   BITFIELD_MASK(1)  /* Bit 23   - CRC check of previous command failed
+                                                  */
+#define RSP1_COM_CRC_ERROR_S   23
+#define RSP1_LOCK_UNLOCK_FAIL_M        BITFIELD_MASK(1)  /* Bit 24   - Card lock-unlock Cmd Seq error */
+#define RSP1_LOCK_UNLOCK_FAIL_S        24
+#define RSP1_CARD_LOCKED_M     BITFIELD_MASK(1)  /* Bit 25   - Card locked by the host */
+#define RSP1_CARD_LOCKED_S     25
+#define RSP1_WP_VIOLATION_M    BITFIELD_MASK(1)  /* Bit 26   - Attempt to program
+                                                  * write-protected blocks
+                                                  */
+#define RSP1_WP_VIOLATION_S    26
+#define RSP1_ERASE_PARAM_M     BITFIELD_MASK(1)  /* Bit 27   - Invalid erase blocks */
+#define RSP1_ERASE_PARAM_S     27
+#define RSP1_ERASE_SEQ_ERR_M   BITFIELD_MASK(1)  /* Bit 28   - Erase Cmd seq error */
+#define RSP1_ERASE_SEQ_ERR_S   28
+#define RSP1_BLK_LEN_ERR_M     BITFIELD_MASK(1)  /* Bit 29   - Block length error */
+#define RSP1_BLK_LEN_ERR_S     29
+#define RSP1_ADDR_ERR_M                BITFIELD_MASK(1)  /* Bit 30   - Misaligned address */
+#define RSP1_ADDR_ERR_S                30
+#define RSP1_OUT_OF_RANGE_M    BITFIELD_MASK(1)  /* Bit 31   - Cmd arg was out of range */
+#define RSP1_OUT_OF_RANGE_S    31
+
+#define RSP5_DATA_M            BITFIELD_MASK(8)  /* Bits [0:7]   - data */
+#define RSP5_DATA_S            0
+#define RSP5_FLAGS_M           BITFIELD_MASK(8)  /* Bit  [15:8]  - Rsp flags */
+#define RSP5_FLAGS_S           8
+#define RSP5_STUFF_M           BITFIELD_MASK(16) /* Bits [31:16] - Stuff bits */
+#define RSP5_STUFF_S           16
+
+/* ----------------------------------------------
+ * SDIO Command Response structures for SPI mode
+ * ----------------------------------------------
+ */
+#define SPIRSP4_IO_OCR_M       BITFIELD_MASK(16) /* Bits [15:0]    - Card's OCR Bits [23:8] */
+#define SPIRSP4_IO_OCR_S       0
+#define SPIRSP4_STUFF_M                BITFIELD_MASK(3)  /* Bits [18:16]   - Stuff bits */
+#define SPIRSP4_STUFF_S                16
+#define SPIRSP4_MEM_PRESENT_M  BITFIELD_MASK(1)  /* Bit  19        - Memory present */
+#define SPIRSP4_MEM_PRESENT_S  19
+#define SPIRSP4_NUM_FUNCS_M    BITFIELD_MASK(3)  /* Bits [22:20]   - Number of I/O funcs */
+#define SPIRSP4_NUM_FUNCS_S    20
+#define SPIRSP4_CARD_READY_M   BITFIELD_MASK(1)  /* Bit  23        - SDIO card ready */
+#define SPIRSP4_CARD_READY_S   23
+#define SPIRSP4_IDLE_STATE_M   BITFIELD_MASK(1)  /* Bit  24        - idle state */
+#define SPIRSP4_IDLE_STATE_S   24
+#define SPIRSP4_ILLEGAL_CMD_M  BITFIELD_MASK(1)  /* Bit  26        - Illegal Cmd error */
+#define SPIRSP4_ILLEGAL_CMD_S  26
+#define SPIRSP4_COM_CRC_ERROR_M        BITFIELD_MASK(1)  /* Bit  27        - COM CRC error */
+#define SPIRSP4_COM_CRC_ERROR_S        27
+#define SPIRSP4_FUNC_NUM_ERROR_M       BITFIELD_MASK(1)  /* Bit  28        - Function number error
+                                                          */
+#define SPIRSP4_FUNC_NUM_ERROR_S       28
+#define SPIRSP4_PARAM_ERROR_M  BITFIELD_MASK(1)  /* Bit  30        - Parameter Error Bit */
+#define SPIRSP4_PARAM_ERROR_S  30
+#define SPIRSP4_START_BIT_M    BITFIELD_MASK(1)  /* Bit  31        - Start Bit */
+#define SPIRSP4_START_BIT_S    31
+
+#define SPIRSP5_DATA_M                 BITFIELD_MASK(8)  /* Bits [23:16]   - R/W Data */
+#define SPIRSP5_DATA_S                 16
+#define SPIRSP5_IDLE_STATE_M           BITFIELD_MASK(1)  /* Bit  24        - Idle state */
+#define SPIRSP5_IDLE_STATE_S           24
+#define SPIRSP5_ILLEGAL_CMD_M          BITFIELD_MASK(1)  /* Bit  26        - Illegal Cmd error */
+#define SPIRSP5_ILLEGAL_CMD_S          26
+#define SPIRSP5_COM_CRC_ERROR_M                BITFIELD_MASK(1)  /* Bit  27        - COM CRC error */
+#define SPIRSP5_COM_CRC_ERROR_S                27
+#define SPIRSP5_FUNC_NUM_ERROR_M       BITFIELD_MASK(1)  /* Bit  28        - Function number error
+                                                          */
+#define SPIRSP5_FUNC_NUM_ERROR_S       28
+#define SPIRSP5_PARAM_ERROR_M          BITFIELD_MASK(1)  /* Bit  30        - Parameter Error Bit */
+#define SPIRSP5_PARAM_ERROR_S          30
+#define SPIRSP5_START_BIT_M            BITFIELD_MASK(1)  /* Bit  31        - Start Bit */
+#define SPIRSP5_START_BIT_S            31
+
+/* RSP6 card status format; Pg 68 Physical Layer spec v 1.10 */
+#define RSP6STAT_AKE_SEQ_ERROR_M       BITFIELD_MASK(1)  /* Bit 3      - Authentication seq error
+                                                          */
+#define RSP6STAT_AKE_SEQ_ERROR_S       3
+#define RSP6STAT_APP_CMD_M             BITFIELD_MASK(1)  /* Bit 5      - Card expects ACMD */
+#define RSP6STAT_APP_CMD_S             5
+#define RSP6STAT_READY_FOR_DATA_M      BITFIELD_MASK(1)  /* Bit 8      - Ready for data
+                                                          * (buff empty)
+                                                          */
+#define RSP6STAT_READY_FOR_DATA_S      8
+#define RSP6STAT_CURR_STATE_M          BITFIELD_MASK(4)  /* Bits [12:9] - Card state at
+                                                          * Cmd reception
+                                                          */
+#define RSP6STAT_CURR_STATE_S          9
+#define RSP6STAT_ERROR_M               BITFIELD_MASK(1)  /* Bit 13  - General/Unknown error Bit 19
+                                                          */
+#define RSP6STAT_ERROR_S               13
+#define RSP6STAT_ILLEGAL_CMD_M         BITFIELD_MASK(1)  /* Bit 14  - Illegal cmd for
+                                                          * card state Bit 22
+                                                          */
+#define RSP6STAT_ILLEGAL_CMD_S         14
+#define RSP6STAT_COM_CRC_ERROR_M       BITFIELD_MASK(1)  /* Bit 15  - CRC previous command
+                                                          * failed Bit 23
+                                                          */
+#define RSP6STAT_COM_CRC_ERROR_S       15
+
+#define SDIOH_XFER_TYPE_READ    SD_IO_OP_READ
+#define SDIOH_XFER_TYPE_WRITE   SD_IO_OP_WRITE
+
+/* command issue options */
+#define CMD_OPTION_DEFAULT     0
+#define CMD_OPTION_TUNING      1
+
+#endif /* def BCMSDIO */
+#endif /* _SDIO_H */
diff --git a/bcmdhd.101.10.240.x/include/sdioh.h b/bcmdhd.101.10.240.x/include/sdioh.h
new file mode 100644 (file)
index 0000000..805f061
--- /dev/null
@@ -0,0 +1,459 @@
+/*
+ * SDIO Host Controller Spec header file
+ * Register map and definitions for the Standard Host Controller
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _SDIOH_H
+#define        _SDIOH_H
+
+/*
+ * Standard SD Host Control Register Map.
+ *
+ * Reference definitions from:
+ *  SD Specification, Part A2: SD Host Controller Standard Specification
+ *  Version 1.00
+ *  February, 2004
+ *  http://www.sdcard.org
+ *
+ *  One set for each SDIO slot on the controller board.
+ *  In PCI, each set is mapped into a BAR.  Since PCI only
+ *  has six BARS, spec compliant PCI SDIO host controllers are
+ *  limited to 6 slots.
+ */
+#define SD_SysAddr                     0x000
+#define SD_BlockSize                   0x004
+#define SD_BlockCount                  0x006
+#define SD_Arg0                                0x008
+#define SD_Arg1                        0x00A /* Not really in spec, remove? */
+#define SD_TransferMode                        0x00C
+#define SD_Command                     0x00E
+#define SD_Response0                   0x010
+#define SD_Response1                   0x012
+#define SD_Response2                   0x014
+#define SD_Response3                   0x016
+#define SD_Response4                   0x018
+#define SD_Response5                   0x01A
+#define SD_Response6                   0x01C
+#define SD_Response7                   0x01E
+#define SD_BufferDataPort0             0x020
+#define SD_BufferDataPort1             0x022
+#define SD_PresentState                        0x024
+#define SD_HostCntrl                   0x028
+#define SD_PwrCntrl                    0x029
+#define SD_BlockGapCntrl               0x02A
+#define SD_WakeupCntrl                 0x02B
+#define SD_ClockCntrl                  0x02C /* Add (and use) bitdefs */
+#define SD_TimeoutCntrl                0x02E /* Add (and use) bitdefs */
+#define SD_SoftwareReset               0x02F
+#define SD_IntrStatus                  0x030
+#define SD_ErrorIntrStatus             0x032 /* Add (and use) bitdefs */
+#define SD_IntrStatusEnable            0x034
+#define SD_ErrorIntrStatusEnable       0x036
+#define SD_IntrSignalEnable            0x038
+#define SD_ErrorIntrSignalEnable       0x03A
+#define SD_CMD12ErrorStatus            0x03C
+#define SD_Capabilities                        0x040
+#define SD_Capabilities3               0x044
+#define SD_MaxCurCap                   0x048
+#define SD_MaxCurCap_Reserved          0x04C
+#define SD_ADMA_ErrStatus              0x054
+#define SD_ADMA_SysAddr                        0x58
+#define SD_SlotInterruptStatus         0x0FC
+#define SD_HostControllerVersion       0x0FE
+#define        SD_GPIO_Reg                     0x100
+#define        SD_GPIO_OE                      0x104
+#define        SD_GPIO_Enable                  0x108
+
+/* SD specific registers in PCI config space */
+#define SD_SlotInfo    0x40
+
+/* HC 3.0 specific registers and offsets */
+#define SD3_HostCntrl2                 0x03E
+/* preset regsstart and count */
+#define SD3_PresetValStart             0x060
+#define SD3_PresetValCount             8
+/* preset-indiv regs */
+#define SD3_PresetVal_init             0x060
+#define SD3_PresetVal_default  0x062
+#define SD3_PresetVal_HS               0x064
+#define SD3_PresetVal_SDR12            0x066
+#define SD3_PresetVal_SDR25            0x068
+#define SD3_PresetVal_SDR50            0x06a
+#define SD3_PresetVal_SDR104   0x06c
+#define SD3_PresetVal_DDR50            0x06e
+/* SDIO3.0 Revx specific Registers */
+#define SD3_Tuning_Info_Register 0x0EC
+#define SD3_WL_BT_reset_register 0x0F0
+
+/* preset value indices */
+#define SD3_PRESETVAL_INITIAL_IX       0
+#define SD3_PRESETVAL_DESPEED_IX       1
+#define SD3_PRESETVAL_HISPEED_IX       2
+#define SD3_PRESETVAL_SDR12_IX         3
+#define SD3_PRESETVAL_SDR25_IX         4
+#define SD3_PRESETVAL_SDR50_IX         5
+#define SD3_PRESETVAL_SDR104_IX                6
+#define SD3_PRESETVAL_DDR50_IX         7
+
+/* SD_Capabilities reg (0x040) */
+#define CAP_TO_CLKFREQ_M       BITFIELD_MASK(6)
+#define CAP_TO_CLKFREQ_S       0
+#define CAP_TO_CLKUNIT_M       BITFIELD_MASK(1)
+#define CAP_TO_CLKUNIT_S       7
+/* Note: for sdio-2.0 case, this mask has to be 6 bits, but msb 2
+       bits are reserved. going ahead with 8 bits, as it is req for 3.0
+*/
+#define CAP_BASECLK_M          BITFIELD_MASK(8)
+#define CAP_BASECLK_S          8
+#define CAP_MAXBLOCK_M         BITFIELD_MASK(2)
+#define CAP_MAXBLOCK_S         16
+#define CAP_ADMA2_M            BITFIELD_MASK(1)
+#define CAP_ADMA2_S            19
+#define CAP_ADMA1_M            BITFIELD_MASK(1)
+#define CAP_ADMA1_S            20
+#define CAP_HIGHSPEED_M                BITFIELD_MASK(1)
+#define CAP_HIGHSPEED_S                21
+#define CAP_DMA_M              BITFIELD_MASK(1)
+#define CAP_DMA_S              22
+#define CAP_SUSPEND_M          BITFIELD_MASK(1)
+#define CAP_SUSPEND_S          23
+#define CAP_VOLT_3_3_M         BITFIELD_MASK(1)
+#define CAP_VOLT_3_3_S         24
+#define CAP_VOLT_3_0_M         BITFIELD_MASK(1)
+#define CAP_VOLT_3_0_S         25
+#define CAP_VOLT_1_8_M         BITFIELD_MASK(1)
+#define CAP_VOLT_1_8_S         26
+#define CAP_64BIT_HOST_M       BITFIELD_MASK(1)
+#define CAP_64BIT_HOST_S       28
+
+#define SDIO_OCR_READ_FAIL     (2)
+
+#define CAP_ASYNCINT_SUP_M     BITFIELD_MASK(1)
+#define CAP_ASYNCINT_SUP_S     29
+
+#define CAP_SLOTTYPE_M         BITFIELD_MASK(2)
+#define CAP_SLOTTYPE_S         30
+
+#define CAP3_MSBits_OFFSET     (32)
+/* note: following are caps MSB32 bits.
+       So the bits start from 0, instead of 32. that is why
+       CAP3_MSBits_OFFSET is subtracted.
+*/
+#define CAP3_SDR50_SUP_M               BITFIELD_MASK(1)
+#define CAP3_SDR50_SUP_S               (32 - CAP3_MSBits_OFFSET)
+
+#define CAP3_SDR104_SUP_M      BITFIELD_MASK(1)
+#define CAP3_SDR104_SUP_S      (33 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DDR50_SUP_M       BITFIELD_MASK(1)
+#define CAP3_DDR50_SUP_S       (34 - CAP3_MSBits_OFFSET)
+
+/* for knowing the clk caps in a single read */
+#define CAP3_30CLKCAP_M                BITFIELD_MASK(3)
+#define CAP3_30CLKCAP_S                (32 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DRIVTYPE_A_M      BITFIELD_MASK(1)
+#define CAP3_DRIVTYPE_A_S      (36 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DRIVTYPE_C_M      BITFIELD_MASK(1)
+#define CAP3_DRIVTYPE_C_S      (37 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DRIVTYPE_D_M      BITFIELD_MASK(1)
+#define CAP3_DRIVTYPE_D_S      (38 - CAP3_MSBits_OFFSET)
+
+#define CAP3_RETUNING_TC_M     BITFIELD_MASK(4)
+#define CAP3_RETUNING_TC_S     (40 - CAP3_MSBits_OFFSET)
+
+#define CAP3_TUNING_SDR50_M    BITFIELD_MASK(1)
+#define CAP3_TUNING_SDR50_S    (45 - CAP3_MSBits_OFFSET)
+
+#define CAP3_RETUNING_MODES_M  BITFIELD_MASK(2)
+#define CAP3_RETUNING_MODES_S  (46 - CAP3_MSBits_OFFSET)
+
+#define CAP3_RETUNING_TC_DISABLED      (0x0)
+#define CAP3_RETUNING_TC_1024S         (0xB)
+#define CAP3_RETUNING_TC_OTHER         (0xF)
+
+#define CAP3_CLK_MULT_M                BITFIELD_MASK(8)
+#define CAP3_CLK_MULT_S                (48 - CAP3_MSBits_OFFSET)
+
+#define PRESET_DRIVR_SELECT_M  BITFIELD_MASK(2)
+#define PRESET_DRIVR_SELECT_S  14
+
+#define PRESET_CLK_DIV_M       BITFIELD_MASK(10)
+#define PRESET_CLK_DIV_S       0
+
+/* SD_MaxCurCap reg (0x048) */
+#define CAP_CURR_3_3_M         BITFIELD_MASK(8)
+#define CAP_CURR_3_3_S         0
+#define CAP_CURR_3_0_M         BITFIELD_MASK(8)
+#define CAP_CURR_3_0_S         8
+#define CAP_CURR_1_8_M         BITFIELD_MASK(8)
+#define CAP_CURR_1_8_S         16
+
+/* SD_SysAddr: Offset 0x0000, Size 4 bytes */
+
+/* SD_BlockSize: Offset 0x004, Size 2 bytes */
+#define BLKSZ_BLKSZ_M          BITFIELD_MASK(12)
+#define BLKSZ_BLKSZ_S          0
+#define BLKSZ_BNDRY_M          BITFIELD_MASK(3)
+#define BLKSZ_BNDRY_S          12
+
+/* SD_BlockCount: Offset 0x006, size 2 bytes */
+
+/* SD_Arg0: Offset 0x008, size = 4 bytes  */
+/* SD_TransferMode Offset 0x00C, size = 2 bytes */
+#define XFER_DMA_ENABLE_M      BITFIELD_MASK(1)
+#define XFER_DMA_ENABLE_S      0
+#define XFER_BLK_COUNT_EN_M    BITFIELD_MASK(1)
+#define XFER_BLK_COUNT_EN_S    1
+#define XFER_CMD_12_EN_M       BITFIELD_MASK(1)
+#define XFER_CMD_12_EN_S       2
+#define XFER_DATA_DIRECTION_M  BITFIELD_MASK(1)
+#define XFER_DATA_DIRECTION_S  4
+#define XFER_MULTI_BLOCK_M     BITFIELD_MASK(1)
+#define XFER_MULTI_BLOCK_S     5
+
+/* SD_Command: Offset 0x00E, size = 2 bytes */
+/* resp_type field */
+#define RESP_TYPE_NONE         0
+#define RESP_TYPE_136          1
+#define RESP_TYPE_48           2
+#define RESP_TYPE_48_BUSY      3
+/* type field */
+#define CMD_TYPE_NORMAL                0
+#define CMD_TYPE_SUSPEND       1
+#define CMD_TYPE_RESUME                2
+#define CMD_TYPE_ABORT         3
+
+#define CMD_RESP_TYPE_M                BITFIELD_MASK(2)        /* Bits [0-1]   - Response type */
+#define CMD_RESP_TYPE_S                0
+#define CMD_CRC_EN_M           BITFIELD_MASK(1)        /* Bit 3        - CRC enable */
+#define CMD_CRC_EN_S           3
+#define CMD_INDEX_EN_M         BITFIELD_MASK(1)        /* Bit 4        - Enable index checking */
+#define CMD_INDEX_EN_S         4
+#define CMD_DATA_EN_M          BITFIELD_MASK(1)        /* Bit 5        - Using DAT line */
+#define CMD_DATA_EN_S          5
+#define CMD_TYPE_M             BITFIELD_MASK(2)        /* Bit [6-7]    - Normal, abort, resume, etc
+                                                        */
+#define CMD_TYPE_S             6
+#define CMD_INDEX_M            BITFIELD_MASK(6)        /* Bits [8-13]  - Command number */
+#define CMD_INDEX_S            8
+
+/* SD_BufferDataPort0  : Offset 0x020, size = 2 or 4 bytes */
+/* SD_BufferDataPort1  : Offset 0x022, size = 2 bytes */
+/* SD_PresentState     : Offset 0x024, size = 4 bytes */
+#define PRES_CMD_INHIBIT_M     BITFIELD_MASK(1)        /* Bit 0        May use CMD */
+#define PRES_CMD_INHIBIT_S     0
+#define PRES_DAT_INHIBIT_M     BITFIELD_MASK(1)        /* Bit 1        May use DAT */
+#define PRES_DAT_INHIBIT_S     1
+#define PRES_DAT_BUSY_M                BITFIELD_MASK(1)        /* Bit 2        DAT is busy */
+#define PRES_DAT_BUSY_S                2
+#define PRES_PRESENT_RSVD_M    BITFIELD_MASK(5)        /* Bit [3-7]    rsvd */
+#define PRES_PRESENT_RSVD_S    3
+#define PRES_WRITE_ACTIVE_M    BITFIELD_MASK(1)        /* Bit 8        Write is active */
+#define PRES_WRITE_ACTIVE_S    8
+#define PRES_READ_ACTIVE_M     BITFIELD_MASK(1)        /* Bit 9        Read is active */
+#define PRES_READ_ACTIVE_S     9
+#define PRES_WRITE_DATA_RDY_M  BITFIELD_MASK(1)        /* Bit 10       Write buf is avail */
+#define PRES_WRITE_DATA_RDY_S  10
+#define PRES_READ_DATA_RDY_M   BITFIELD_MASK(1)        /* Bit 11       Read buf data avail */
+#define PRES_READ_DATA_RDY_S   11
+#define PRES_CARD_PRESENT_M    BITFIELD_MASK(1)        /* Bit 16       Card present - debounced */
+#define PRES_CARD_PRESENT_S    16
+#define PRES_CARD_STABLE_M     BITFIELD_MASK(1)        /* Bit 17       Debugging */
+#define PRES_CARD_STABLE_S     17
+#define PRES_CARD_PRESENT_RAW_M        BITFIELD_MASK(1)        /* Bit 18       Not debounced */
+#define PRES_CARD_PRESENT_RAW_S        18
+#define PRES_WRITE_ENABLED_M   BITFIELD_MASK(1)        /* Bit 19       Write protected? */
+#define PRES_WRITE_ENABLED_S   19
+#define PRES_DAT_SIGNAL_M      BITFIELD_MASK(4)        /* Bit [20-23]  Debugging */
+#define PRES_DAT_SIGNAL_S      20
+#define PRES_CMD_SIGNAL_M      BITFIELD_MASK(1)        /* Bit 24       Debugging */
+#define PRES_CMD_SIGNAL_S      24
+
+/* SD_HostCntrl: Offset 0x028, size = 1 bytes */
+#define HOST_LED_M             BITFIELD_MASK(1)        /* Bit 0        LED On/Off */
+#define HOST_LED_S             0
+#define HOST_DATA_WIDTH_M      BITFIELD_MASK(1)        /* Bit 1        4 bit enable */
+#define HOST_DATA_WIDTH_S      1
+#define HOST_HI_SPEED_EN_M     BITFIELD_MASK(1)        /* Bit 2        High speed vs low speed */
+#define HOST_DMA_SEL_S         3
+#define HOST_DMA_SEL_M         BITFIELD_MASK(2)        /* Bit 4:3      DMA Select */
+#define HOST_HI_SPEED_EN_S     2
+
+/* Host Control2: */
+#define HOSTCtrl2_PRESVAL_EN_M BITFIELD_MASK(1)        /* 1 bit */
+#define HOSTCtrl2_PRESVAL_EN_S 15                                      /* bit# */
+
+#define HOSTCtrl2_ASYINT_EN_M  BITFIELD_MASK(1)        /* 1 bit */
+#define HOSTCtrl2_ASYINT_EN_S  14                                      /* bit# */
+
+#define HOSTCtrl2_SAMPCLK_SEL_M        BITFIELD_MASK(1)        /* 1 bit */
+#define HOSTCtrl2_SAMPCLK_SEL_S        7                                       /* bit# */
+
+#define HOSTCtrl2_EXEC_TUNING_M        BITFIELD_MASK(1)        /* 1 bit */
+#define HOSTCtrl2_EXEC_TUNING_S        6                                       /* bit# */
+
+#define HOSTCtrl2_DRIVSTRENGTH_SEL_M   BITFIELD_MASK(2)        /* 2 bit */
+#define HOSTCtrl2_DRIVSTRENGTH_SEL_S   4                                       /* bit# */
+
+#define HOSTCtrl2_1_8SIG_EN_M  BITFIELD_MASK(1)        /* 1 bit */
+#define HOSTCtrl2_1_8SIG_EN_S  3                                       /* bit# */
+
+#define HOSTCtrl2_UHSMODE_SEL_M        BITFIELD_MASK(3)        /* 3 bit */
+#define HOSTCtrl2_UHSMODE_SEL_S        0                                       /* bit# */
+
+#define HOST_CONTR_VER_2               (1)
+#define HOST_CONTR_VER_3               (2)
+
+/* misc defines */
+/* Driver uses of these should be replaced! */
+#define SD1_MODE               0x1     /* SD Host Cntrlr Spec */
+#define SD4_MODE               0x2     /* SD Host Cntrlr Spec */
+
+/* SD_PwrCntrl: Offset 0x029, size = 1 bytes */
+#define PWR_BUS_EN_M           BITFIELD_MASK(1)        /* Bit 0        Power the bus */
+#define PWR_BUS_EN_S           0
+#define PWR_VOLTS_M            BITFIELD_MASK(3)        /* Bit [1-3]    Voltage Select */
+#define PWR_VOLTS_S            1
+
+/* SD_SoftwareReset: Offset 0x02F, size = 1 byte */
+#define SW_RESET_ALL_M         BITFIELD_MASK(1)        /* Bit 0        Reset All */
+#define SW_RESET_ALL_S         0
+#define SW_RESET_CMD_M         BITFIELD_MASK(1)        /* Bit 1        CMD Line Reset */
+#define SW_RESET_CMD_S         1
+#define SW_RESET_DAT_M         BITFIELD_MASK(1)        /* Bit 2        DAT Line Reset */
+#define SW_RESET_DAT_S         2
+
+/* SD_IntrStatus: Offset 0x030, size = 2 bytes */
+/* Defs also serve SD_IntrStatusEnable and SD_IntrSignalEnable */
+#define INTSTAT_CMD_COMPLETE_M         BITFIELD_MASK(1)        /* Bit 0 */
+#define INTSTAT_CMD_COMPLETE_S         0
+#define INTSTAT_XFER_COMPLETE_M                BITFIELD_MASK(1)
+#define INTSTAT_XFER_COMPLETE_S                1
+#define INTSTAT_BLOCK_GAP_EVENT_M      BITFIELD_MASK(1)
+#define INTSTAT_BLOCK_GAP_EVENT_S      2
+#define INTSTAT_DMA_INT_M              BITFIELD_MASK(1)
+#define INTSTAT_DMA_INT_S              3
+#define INTSTAT_BUF_WRITE_READY_M      BITFIELD_MASK(1)
+#define INTSTAT_BUF_WRITE_READY_S      4
+#define INTSTAT_BUF_READ_READY_M       BITFIELD_MASK(1)
+#define INTSTAT_BUF_READ_READY_S       5
+#define INTSTAT_CARD_INSERTION_M       BITFIELD_MASK(1)
+#define INTSTAT_CARD_INSERTION_S       6
+#define INTSTAT_CARD_REMOVAL_M         BITFIELD_MASK(1)
+#define INTSTAT_CARD_REMOVAL_S         7
+#define INTSTAT_CARD_INT_M             BITFIELD_MASK(1)
+#define INTSTAT_CARD_INT_S             8
+#define INTSTAT_RETUNING_INT_M         BITFIELD_MASK(1)        /* Bit 12 */
+#define INTSTAT_RETUNING_INT_S         12
+#define INTSTAT_ERROR_INT_M            BITFIELD_MASK(1)        /* Bit 15 */
+#define INTSTAT_ERROR_INT_S            15
+
+/* SD_ErrorIntrStatus: Offset 0x032, size = 2 bytes */
+/* Defs also serve SD_ErrorIntrStatusEnable and SD_ErrorIntrSignalEnable */
+#define ERRINT_CMD_TIMEOUT_M           BITFIELD_MASK(1)
+#define ERRINT_CMD_TIMEOUT_S           0
+#define ERRINT_CMD_CRC_M               BITFIELD_MASK(1)
+#define ERRINT_CMD_CRC_S               1
+#define ERRINT_CMD_ENDBIT_M            BITFIELD_MASK(1)
+#define ERRINT_CMD_ENDBIT_S            2
+#define ERRINT_CMD_INDEX_M             BITFIELD_MASK(1)
+#define ERRINT_CMD_INDEX_S             3
+#define ERRINT_DATA_TIMEOUT_M          BITFIELD_MASK(1)
+#define ERRINT_DATA_TIMEOUT_S          4
+#define ERRINT_DATA_CRC_M              BITFIELD_MASK(1)
+#define ERRINT_DATA_CRC_S              5
+#define ERRINT_DATA_ENDBIT_M           BITFIELD_MASK(1)
+#define ERRINT_DATA_ENDBIT_S           6
+#define ERRINT_CURRENT_LIMIT_M         BITFIELD_MASK(1)
+#define ERRINT_CURRENT_LIMIT_S         7
+#define ERRINT_AUTO_CMD12_M            BITFIELD_MASK(1)
+#define ERRINT_AUTO_CMD12_S            8
+#define ERRINT_VENDOR_M                        BITFIELD_MASK(4)
+#define ERRINT_VENDOR_S                        12
+#define ERRINT_ADMA_M                  BITFIELD_MASK(1)
+#define ERRINT_ADMA_S                  9
+
+/* Also provide definitions in "normal" form to allow combined masks */
+#define ERRINT_CMD_TIMEOUT_BIT         0x0001
+#define ERRINT_CMD_CRC_BIT             0x0002
+#define ERRINT_CMD_ENDBIT_BIT          0x0004
+#define ERRINT_CMD_INDEX_BIT           0x0008
+#define ERRINT_DATA_TIMEOUT_BIT                0x0010
+#define ERRINT_DATA_CRC_BIT            0x0020
+#define ERRINT_DATA_ENDBIT_BIT         0x0040
+#define ERRINT_CURRENT_LIMIT_BIT       0x0080
+#define ERRINT_AUTO_CMD12_BIT          0x0100
+#define ERRINT_ADMA_BIT                0x0200
+
+/* Masks to select CMD vs. DATA errors */
+#define ERRINT_CMD_ERRS                (ERRINT_CMD_TIMEOUT_BIT | ERRINT_CMD_CRC_BIT |\
+                                ERRINT_CMD_ENDBIT_BIT | ERRINT_CMD_INDEX_BIT)
+#define ERRINT_DATA_ERRS       (ERRINT_DATA_TIMEOUT_BIT | ERRINT_DATA_CRC_BIT |\
+                                ERRINT_DATA_ENDBIT_BIT | ERRINT_ADMA_BIT)
+#define ERRINT_TRANSFER_ERRS   (ERRINT_CMD_ERRS | ERRINT_DATA_ERRS)
+
+/* SD_WakeupCntr_BlockGapCntrl : Offset 0x02A , size = bytes */
+/* SD_ClockCntrl       : Offset 0x02C , size = bytes */
+/* SD_SoftwareReset_TimeoutCntrl       : Offset 0x02E , size = bytes */
+/* SD_IntrStatus       : Offset 0x030 , size = bytes */
+/* SD_ErrorIntrStatus  : Offset 0x032 , size = bytes */
+/* SD_IntrStatusEnable : Offset 0x034 , size = bytes */
+/* SD_ErrorIntrStatusEnable : Offset 0x036 , size = bytes */
+/* SD_IntrSignalEnable : Offset 0x038 , size = bytes */
+/* SD_ErrorIntrSignalEnable : Offset 0x03A , size = bytes */
+/* SD_CMD12ErrorStatus : Offset 0x03C , size = bytes */
+/* SD_Capabilities     : Offset 0x040 , size = bytes */
+/* SD_MaxCurCap                : Offset 0x048 , size = bytes */
+/* SD_MaxCurCap_Reserved: Offset 0x04C , size = bytes */
+/* SD_SlotInterruptStatus: Offset 0x0FC , size = bytes */
+/* SD_HostControllerVersion : Offset 0x0FE , size = bytes */
+
+/* SDIO Host Control Register DMA Mode Definitions */
+#define SDIOH_SDMA_MODE                        0
+#define SDIOH_ADMA1_MODE               1
+#define SDIOH_ADMA2_MODE               2
+#define SDIOH_ADMA2_64_MODE            3
+
+#define ADMA2_ATTRIBUTE_VALID          (1 << 0)        /* ADMA Descriptor line valid */
+#define ADMA2_ATTRIBUTE_END                    (1 << 1)        /* End of Descriptor */
+#define ADMA2_ATTRIBUTE_INT                    (1 << 2)        /* Interrupt when line is done */
+#define ADMA2_ATTRIBUTE_ACT_NOP                (0 << 4)        /* Skip current line, go to next. */
+#define ADMA2_ATTRIBUTE_ACT_RSV                (1 << 4)        /* Same as NOP */
+#define ADMA1_ATTRIBUTE_ACT_SET                (1 << 4)        /* ADMA1 Only - set transfer length */
+#define ADMA2_ATTRIBUTE_ACT_TRAN       (2 << 4)        /* Transfer Data of one descriptor line. */
+#define ADMA2_ATTRIBUTE_ACT_LINK       (3 << 4)        /* Link Descriptor */
+
+/* ADMA2 Descriptor Table Entry for 32-bit Address */
+typedef struct adma2_dscr_32b {
+       uint32 len_attr;
+       uint32 phys_addr;
+} adma2_dscr_32b_t;
+
+/* ADMA1 Descriptor Table Entry */
+typedef struct adma1_dscr {
+       uint32 phys_addr_attr;
+} adma1_dscr_t;
+
+#endif /* _SDIOH_H */
diff --git a/bcmdhd.101.10.240.x/include/sdiovar.h b/bcmdhd.101.10.240.x/include/sdiovar.h
new file mode 100644 (file)
index 0000000..33c8825
--- /dev/null
@@ -0,0 +1,124 @@
+/*
+ * Structure used by apps whose drivers access SDIO drivers.
+ * Pulled out separately so dhdu and wlu can both use it.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _sdiovar_h_
+#define _sdiovar_h_
+
+#include <typedefs.h>
+
+typedef struct sdreg {
+       int func;
+       int offset;
+       int value;
+} sdreg_t;
+
+typedef struct sdreg_64 {
+       int func;
+       int offset;
+       uint64 value;
+} sdreg_64_t;
+
+/* Common msglevel constants */
+#define SDH_ERROR_VAL          0x0001  /* Error */
+#define SDH_TRACE_VAL          0x0002  /* Trace */
+#define SDH_INFO_VAL           0x0004  /* Info */
+#define SDH_DEBUG_VAL          0x0008  /* Debug */
+#define SDH_DATA_VAL           0x0010  /* Data */
+#define SDH_CTRL_VAL           0x0020  /* Control Regs */
+#define SDH_LOG_VAL            0x0040  /* Enable bcmlog */
+#define SDH_DMA_VAL            0x0080  /* DMA */
+#define SDH_COST_VAL           0x8000  /* Control Regs */
+
+#define NUM_PREV_TRANSACTIONS  16
+
+#ifdef BCMSPI
+/* Error statistics for gSPI */
+struct spierrstats_t {
+       uint32  dna;    /* The requested data is not available. */
+       uint32  rdunderflow;    /* FIFO underflow happened due to current (F2, F3) rd command */
+       uint32  wroverflow;     /* FIFO underflow happened due to current (F1, F2, F3) wr command */
+
+       uint32  f2interrupt;    /* OR of all F2 related intr status bits. */
+       uint32  f3interrupt;    /* OR of all F3 related intr status bits. */
+
+       uint32  f2rxnotready;   /* F2 FIFO is not ready to receive data (FIFO empty) */
+       uint32  f3rxnotready;   /* F3 FIFO is not ready to receive data (FIFO empty) */
+
+       uint32  hostcmddataerr; /* Error in command or host data, detected by CRC/checksum
+                                * (optional)
+                                */
+       uint32  f2pktavailable; /* Packet is available in F2 TX FIFO */
+       uint32  f3pktavailable; /* Packet is available in F2 TX FIFO */
+
+       uint32  dstatus[NUM_PREV_TRANSACTIONS]; /* dstatus bits of last 16 gSPI transactions */
+       uint32  spicmd[NUM_PREV_TRANSACTIONS];
+};
+#endif /* BCMSPI */
+
+typedef struct sdio_bus_metrics {
+       uint32 active_dur;      /* msecs */
+
+       /* Generic */
+       uint32 data_intr_cnt;   /* data interrupt counter */
+       uint32 mb_intr_cnt;     /* mailbox interrupt counter */
+       uint32 error_intr_cnt;  /* error interrupt counter */
+       uint32 wakehost_cnt;    /* counter for OOB wakehost */
+
+       /* DS forcewake */
+       uint32 ds_wake_on_cnt;  /* counter for (clock) ON   */
+       uint32 ds_wake_on_dur;  /* duration for (clock) ON) */
+       uint32 ds_wake_off_cnt; /* counter for (clock) OFF  */
+       uint32 ds_wake_off_dur; /* duration for (clock) OFF */
+
+       /* DS_D0 state */
+       uint32 ds_d0_cnt;       /* counter for DS_D0 state */
+       uint32 ds_d0_dur;       /* duration for DS_D0 state */
+
+       /* DS_D3 state */
+       uint32 ds_d3_cnt;       /* counter for DS_D3 state */
+       uint32 ds_d3_dur;       /* duration for DS_D3 state */
+
+       /* DS DEV_WAKE */
+       uint32 ds_dw_assrt_cnt;         /* counter for DW_ASSERT */
+       uint32 ds_dw_dassrt_cnt;        /* counter for DW_DASSERT */
+
+       /* DS mailbox signals */
+       uint32 ds_tx_dsreq_cnt;         /* counter for tx HMB_DATA_DSREQ */
+       uint32 ds_tx_dsexit_cnt;        /* counter for tx HMB_DATA_DSEXIT */
+       uint32 ds_tx_d3ack_cnt;         /* counter for tx HMB_DATA_D3ACK */
+       uint32 ds_tx_d3exit_cnt;        /* counter for tx HMB_DATA_D3EXIT */
+       uint32 ds_rx_dsack_cnt;         /* counter for rx SMB_DATA_DSACK */
+       uint32 ds_rx_dsnack_cnt;        /* counter for rx SMB_DATA_DSNACK */
+       uint32 ds_rx_d3inform_cnt;      /* counter for rx SMB_DATA_D3INFORM */
+} sdio_bus_metrics_t;
+
+/* Bus interface info for SDIO */
+typedef struct wl_pwr_sdio_stats {
+       uint16 type;         /* WL_PWRSTATS_TYPE_SDIO */
+       uint16 len;          /* Up to 4K-1, top 4 bits are reserved */
+
+       sdio_bus_metrics_t sdio;        /* stats from SDIO bus driver */
+} wl_pwr_sdio_stats_t;
+
+#endif /* _sdiovar_h_ */
diff --git a/bcmdhd.101.10.240.x/include/siutils.h b/bcmdhd.101.10.240.x/include/siutils.h
new file mode 100644 (file)
index 0000000..5d44ce7
--- /dev/null
@@ -0,0 +1,900 @@
+/*
+ * Misc utility routines for accessing the SOC Interconnects
+ * of Broadcom HNBU chips.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _siutils_h_
+#define        _siutils_h_
+
+#include <osl_decl.h>
+
+/* Make the d11 core(s) selectable by the user config... */
+#ifndef D11_CORE_UNIT_MASK
+/* By default we allow all d11 cores to be used */
+#define D11_CORE_UNIT_MASK 0xFFFFFFFFu
+#endif
+
+/* Generic interrupt bit mask definitions */
+enum bcm_int_reg_idx {
+       BCM_INT_REG_IDX_0 = 0,
+       BCM_INT_REG_IDX_1 = 1,
+       BCM_INT_REGS_NUM
+};
+
+typedef struct bcm_int_bitmask {
+       uint32 bits[BCM_INT_REGS_NUM];
+} bcm_int_bitmask_t;
+
+#define BCM_INT_BITMASK_IS_ZERO(b) (\
+       (b)->bits[BCM_INT_REG_IDX_0] == 0 && \
+       (b)->bits[BCM_INT_REG_IDX_1] == 0)
+
+#define BCM_INT_BITMASK_SET(to, from) do { \
+       (to)->bits[BCM_INT_REG_IDX_0] = (from)->bits[BCM_INT_REG_IDX_0]; \
+       (to)->bits[BCM_INT_REG_IDX_1] = (from)->bits[BCM_INT_REG_IDX_1]; \
+} while (0)
+
+#define WARM_BOOT      0xA0B0C0D0
+
+typedef struct si_axi_error_info si_axi_error_info_t;
+
+#ifdef AXI_TIMEOUTS_NIC
+#define SI_MAX_ERRLOG_SIZE     4
+typedef struct si_axi_error
+{
+       uint32 error;
+       uint32 coreid;
+       uint32 errlog_lo;
+       uint32 errlog_hi;
+       uint32 errlog_id;
+       uint32 errlog_flags;
+       uint32 errlog_status;
+} si_axi_error_t;
+
+struct si_axi_error_info
+{
+       uint32 count;
+       si_axi_error_t axi_error[SI_MAX_ERRLOG_SIZE];
+};
+#endif /* AXI_TIMEOUTS_NIC */
+
+/**
+ * Data structure to export all chip specific common variables
+ *   public (read-only) portion of siutils handle returned by si_attach()/si_kattach()
+ */
+struct si_pub {
+       bool    issim;                  /**< chip is in simulation or emulation */
+
+       uint16  socitype;               /**< SOCI_SB, SOCI_AI */
+       int16   socirev;                /**< SOC interconnect rev */
+
+       uint16  bustype;                /**< SI_BUS, PCI_BUS */
+       uint16  buscoretype;            /**< PCI_CORE_ID, PCIE_CORE_ID */
+       int16   buscorerev;             /**< buscore rev */
+       uint16  buscoreidx;             /**< buscore index */
+
+       int16   ccrev;                  /**< chip common core rev */
+       uint32  cccaps;                 /**< chip common capabilities */
+       uint32  cccaps_ext;                     /**< chip common capabilities extension */
+       int16   pmurev;                 /**< pmu core rev */
+       uint32  pmucaps;                /**< pmu capabilities */
+
+       uint32  boardtype;              /**< board type */
+       uint32  boardrev;               /* board rev */
+       uint32  boardvendor;            /**< board vendor */
+       uint32  boardflags;             /**< board flags */
+       uint32  boardflags2;            /**< board flags2 */
+       uint32  boardflags4;            /**< board flags4 */
+
+       uint32  chip;                   /**< chip number */
+       uint16  chiprev;                /**< chip revision */
+       uint16  chippkg;                /**< chip package option */
+       uint32  chipst;                 /**< chip status */
+
+       int16   gcirev;                 /**< gci core rev */
+       int16   lhlrev;                 /**< gci core rev */
+
+       uint32  lpflags;                /**< low power flags */
+       uint32  enum_base;      /**< backplane address where the chipcommon core resides */
+       bool    _multibp_enable;
+       bool    rffe_debug_mode;
+       bool    rffe_elnabyp_mode;
+
+       si_axi_error_info_t * err_info;
+};
+
+/* for HIGH_ONLY driver, the si_t must be writable to allow states sync from BMAC to HIGH driver
+ * for monolithic driver, it is readonly to prevent accident change
+ */
+typedef struct si_pub si_t;
+
+/*
+ * Many of the routines below take an 'sih' handle as their first arg.
+ * Allocate this by calling si_attach().  Free it by calling si_detach().
+ * At any one time, the sih is logically focused on one particular si core
+ * (the "current core").
+ * Use si_setcore() or si_setcoreidx() to change the association to another core.
+ */
+#define        SI_OSH          NULL    /**< Use for si_kattach when no osh is available */
+
+#ifndef SOCI_NCI_BUS
+#define        BADIDX          (SI_MAXCORES + 1)
+#else
+#define        BADIDX          (0xffffu)       /* MAXCORES will be dynamically calculated for NCI. */
+#endif /* SOCI_NCI_BUS */
+
+/* clkctl xtal what flags */
+#define        XTAL                    0x1     /**< primary crystal oscillator (2050) */
+#define        PLL                     0x2     /**< main chip pll */
+
+/* clkctl clk mode */
+#define        CLK_FAST                0       /**< force fast (pll) clock */
+#define        CLK_DYNAMIC             2       /**< enable dynamic clock control */
+
+/* GPIO usage priorities */
+#define GPIO_DRV_PRIORITY      0       /**< Driver */
+#define GPIO_APP_PRIORITY      1       /**< Application */
+#define GPIO_HI_PRIORITY       2       /**< Highest priority. Ignore GPIO reservation */
+
+/* GPIO pull up/down */
+#define GPIO_PULLUP            0
+#define GPIO_PULLDN            1
+
+/* GPIO event regtype */
+#define GPIO_REGEVT            0       /**< GPIO register event */
+#define GPIO_REGEVT_INTMSK     1       /**< GPIO register event int mask */
+#define GPIO_REGEVT_INTPOL     2       /**< GPIO register event int polarity */
+
+/* device path */
+#define SI_DEVPATH_BUFSZ       16      /**< min buffer size in bytes */
+
+/* SI routine enumeration: to be used by update function with multiple hooks */
+#define        SI_DOATTACH     1
+#define SI_PCIDOWN     2       /**< wireless interface is down */
+#define SI_PCIUP       3       /**< wireless interface is up */
+
+#ifdef SR_DEBUG
+#define PMU_RES                31
+#endif /* SR_DEBUG */
+
+/* "access" param defines for si_seci_access() below */
+#define SECI_ACCESS_STATUSMASK_SET     0
+#define SECI_ACCESS_INTRS                      1
+#define SECI_ACCESS_UART_CTS           2
+#define SECI_ACCESS_UART_RTS           3
+#define SECI_ACCESS_UART_RXEMPTY       4
+#define SECI_ACCESS_UART_GETC          5
+#define SECI_ACCESS_UART_TXFULL                6
+#define SECI_ACCESS_UART_PUTC          7
+#define SECI_ACCESS_STATUSMASK_GET     8
+
+#define        ISSIM_ENAB(sih) FALSE
+
+#define ATE_BLD_ENAB(sih)      FALSE
+
+#define INVALID_ADDR (~0)
+
+/* PMU clock/power control */
+#if defined(BCMPMUCTL)
+#define PMUCTL_ENAB(sih)       (BCMPMUCTL)
+#else
+#define PMUCTL_ENAB(sih)       ((sih)->cccaps & CC_CAP_PMU)
+#endif
+
+#if defined(BCMAOBENAB)
+#define AOB_ENAB(sih)  (BCMAOBENAB)
+#else
+#define AOB_ENAB(sih)  ((sih)->ccrev >= 35 ? \
+                       ((sih)->cccaps_ext & CC_CAP_EXT_AOB_PRESENT) : 0)
+#endif /* BCMAOBENAB */
+
+/* chipcommon clock/power control (exclusive with PMU's) */
+#if defined(BCMPMUCTL) && BCMPMUCTL
+#define CCCTL_ENAB(sih)                (0)
+#define CCPLL_ENAB(sih)                (0)
+#else
+#define CCCTL_ENAB(sih)                ((sih)->cccaps & CC_CAP_PWR_CTL)
+#define CCPLL_ENAB(sih)                ((sih)->cccaps & CC_CAP_PLL_MASK)
+#endif
+
+typedef void (*gci_gpio_handler_t)(uint32 stat, void *arg);
+
+typedef void (*wci2_handler_t)(void *ctx, char *buf, int len);
+
+/* External BT Coex enable mask */
+#define CC_BTCOEX_EN_MASK  0x01
+/* External PA enable mask */
+#define GPIO_CTRL_EPA_EN_MASK 0x40
+/* WL/BT control enable mask */
+#define GPIO_CTRL_5_6_EN_MASK 0x60
+#define GPIO_CTRL_7_6_EN_MASK 0xC0
+#define GPIO_OUT_7_EN_MASK 0x80
+
+#define UCODE_WAKE_STATUS_BIT  1
+
+/* CR4 specific defines used by the host driver */
+#define SI_CR4_CAP                     (0x04)
+#define SI_CR4_BANKIDX         (0x40)
+#define SI_CR4_BANKINFO                (0x44)
+#define SI_CR4_BANKPDA         (0x4C)
+
+#define        ARMCR4_TCBBNB_MASK      0xf0
+#define        ARMCR4_TCBBNB_SHIFT     4
+#define        ARMCR4_TCBANB_MASK      0xf
+#define        ARMCR4_TCBANB_SHIFT     0
+
+#define        SICF_CPUHALT            (0x0020)
+#define        ARMCR4_BSZ_MASK         0x7f
+#define        ARMCR4_BUNITSZ_MASK     0x200
+#define        ARMCR4_BSZ_8K           8192
+#define        ARMCR4_BSZ_1K           1024
+#define        SI_BPIND_1BYTE          0x1
+#define        SI_BPIND_2BYTE          0x3
+#define        SI_BPIND_4BYTE          0xF
+
+#define GET_GCI_OFFSET(sih, gci_reg)   \
+       (AOB_ENAB(sih)? OFFSETOF(gciregs_t, gci_reg) : OFFSETOF(chipcregs_t, gci_reg))
+
+#define GET_GCI_CORE(sih)      \
+       (AOB_ENAB(sih)? si_findcoreidx(sih, GCI_CORE_ID, 0) : SI_CC_IDX)
+
+#define VARBUF_PRIO_INVALID            0u
+#define VARBUF_PRIO_NVRAM              1u
+#define VARBUF_PRIO_SROM               2u
+#define VARBUF_PRIO_OTP                        3u
+#define VARBUF_PRIO_SH_SFLASH          4u
+
+#define BT_IN_RESET_BIT_SHIFT          19u
+#define BT_IN_PDS_BIT_SHIFT            10u
+
+/* === exported functions === */
+extern si_t *si_attach(uint pcidev, osl_t *osh, volatile void *regs, uint bustype,
+                       void *sdh, char **vars, uint *varsz);
+extern si_t *si_kattach(osl_t *osh);
+extern void si_detach(si_t *sih);
+extern volatile void *si_d11_switch_addrbase(si_t *sih, uint coreunit);
+extern uint si_corelist(const si_t *sih, uint coreid[]);
+extern uint si_coreid(const si_t *sih);
+extern uint si_flag(si_t *sih);
+extern uint si_flag_alt(const si_t *sih);
+extern uint si_intflag(si_t *sih);
+extern uint si_coreidx(const si_t *sih);
+extern uint si_get_num_cores(const si_t *sih);
+extern uint si_coreunit(const si_t *sih);
+extern uint si_corevendor(const si_t *sih);
+extern uint si_corerev(const si_t *sih);
+extern uint si_corerev_minor(const si_t *sih);
+extern void *si_osh(si_t *sih);
+extern void si_setosh(si_t *sih, osl_t *osh);
+extern int si_backplane_access(si_t *sih, uint addr, uint size, uint *val, bool read);
+
+extern uint si_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val);
+extern uint si_corereg_writeonly(si_t *sih, uint coreidx, uint regoff, uint mask, uint val);
+extern uint si_pmu_corereg(si_t *sih, uint32 idx, uint regoff, uint mask, uint val);
+extern volatile uint32 *si_corereg_addr(si_t *sih, uint coreidx, uint regoff);
+extern volatile void *si_coreregs(const si_t *sih);
+extern uint si_wrapperreg(const si_t *sih, uint32 offset, uint32 mask, uint32 val);
+extern uint si_core_wrapperreg(si_t *sih, uint32 coreidx, uint32 offset, uint32 mask, uint32 val);
+extern void *si_wrapperregs(const si_t *sih);
+extern uint32 si_core_cflags(const si_t *sih, uint32 mask, uint32 val);
+extern void si_core_cflags_wo(const si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_core_sflags(const si_t *sih, uint32 mask, uint32 val);
+extern void si_commit(si_t *sih);
+extern bool si_iscoreup(const si_t *sih);
+extern uint si_numcoreunits(const si_t *sih, uint coreid);
+extern uint si_numd11coreunits(const si_t *sih);
+extern uint si_findcoreidx(const si_t *sih, uint coreid, uint coreunit);
+extern uint si_findcoreid(const si_t *sih, uint coreidx);
+extern volatile void *si_setcoreidx(si_t *sih, uint coreidx);
+extern volatile void *si_setcore(si_t *sih, uint coreid, uint coreunit);
+extern uint32 si_oobr_baseaddr(const si_t *sih, bool second);
+extern volatile void *si_switch_core(si_t *sih, uint coreid, uint *origidx,
+       bcm_int_bitmask_t *intr_val);
+extern void si_restore_core(si_t *sih, uint coreid, bcm_int_bitmask_t *intr_val);
+#ifdef USE_NEW_COREREV_API
+extern uint si_corerev_ext(si_t *sih, uint coreid, uint coreunit);
+#else
+uint si_get_corerev(si_t *sih, uint core_id);
+#endif
+extern int si_numaddrspaces(const si_t *sih);
+extern uint32 si_addrspace(const si_t *sih, uint spidx, uint baidx);
+extern uint32 si_addrspacesize(const si_t *sih, uint spidx, uint baidx);
+extern void si_coreaddrspaceX(const si_t *sih, uint asidx, uint32 *addr, uint32 *size);
+extern int si_corebist(const si_t *sih);
+extern void si_core_reset(si_t *sih, uint32 bits, uint32 resetbits);
+extern void si_core_disable(const si_t *sih, uint32 bits);
+extern uint32 si_clock_rate(uint32 pll_type, uint32 n, uint32 m);
+extern uint si_chip_hostif(const si_t *sih);
+extern uint32 si_clock(si_t *sih);
+extern uint32 si_alp_clock(si_t *sih); /* returns [Hz] units */
+extern uint32 si_ilp_clock(si_t *sih); /* returns [Hz] units */
+extern void si_pci_setup(si_t *sih, uint coremask);
+extern int si_pcie_setup(si_t *sih, uint coreidx);
+extern void si_setint(const si_t *sih, int siflag);
+extern bool si_backplane64(const si_t *sih);
+extern void si_register_intr_callback(si_t *sih, void *intrsoff_fn, void *intrsrestore_fn,
+       void *intrsenabled_fn, void *intr_arg);
+extern void si_deregister_intr_callback(si_t *sih);
+extern void si_clkctl_init(si_t *sih);
+extern uint16 si_clkctl_fast_pwrup_delay(si_t *sih);
+extern bool si_clkctl_cc(si_t *sih, uint mode);
+extern int si_clkctl_xtal(si_t *sih, uint what, bool on);
+extern void si_btcgpiowar(si_t *sih);
+extern bool si_deviceremoved(const si_t *sih);
+extern void si_set_device_removed(si_t *sih, bool status);
+extern uint32 si_sysmem_size(si_t *sih);
+extern uint32 si_socram_size(si_t *sih);
+extern uint32 si_socram_srmem_size(si_t *sih);
+extern void si_socram_set_bankpda(si_t *sih, uint32 bankidx, uint32 bankpda);
+extern bool si_is_bus_mpu_present(si_t *sih);
+
+extern void si_watchdog(si_t *sih, uint ticks);
+extern void si_watchdog_ms(si_t *sih, uint32 ms);
+extern uint32 si_watchdog_msticks(void);
+extern volatile void *si_gpiosetcore(si_t *sih);
+extern uint32 si_gpiocontrol(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioouten(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioout(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioin(si_t *sih);
+extern uint32 si_gpiointpolarity(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpiointmask(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioeventintmask(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioled(si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_gpioreserve(const si_t *sih, uint32 gpio_num, uint8 priority);
+extern uint32 si_gpiorelease(const si_t *sih, uint32 gpio_num, uint8 priority);
+extern uint32 si_gpiopull(si_t *sih, bool updown, uint32 mask, uint32 val);
+extern uint32 si_gpioevent(si_t *sih, uint regtype, uint32 mask, uint32 val);
+extern uint32 si_gpio_int_enable(si_t *sih, bool enable);
+extern void si_gci_uart_init(si_t *sih, osl_t *osh, uint8 seci_mode);
+extern void si_gci_enable_gpio(si_t *sih, uint8 gpio, uint32 mask, uint32 value);
+extern uint8 si_gci_host_wake_gpio_init(si_t *sih);
+extern uint8 si_gci_time_sync_gpio_init(si_t *sih);
+extern void si_gci_host_wake_gpio_enable(si_t *sih, uint8 gpio, bool state);
+extern void si_gci_time_sync_gpio_enable(si_t *sih, uint8 gpio, bool state);
+extern void si_gci_host_wake_gpio_tristate(si_t *sih, uint8 gpio, bool state);
+extern int si_gpio_enable(si_t *sih, uint32 mask);
+
+extern void si_invalidate_second_bar0win(si_t *sih);
+
+extern void si_gci_shif_config_wake_pin(si_t *sih, uint8 gpio_n,
+               uint8 wake_events, bool gci_gpio);
+extern void si_shif_int_enable(si_t *sih, uint8 gpio_n, uint8 wake_events, bool enable);
+
+/* GCI interrupt handlers */
+extern void si_gci_handler_process(si_t *sih);
+
+extern void si_enable_gpio_wake(si_t *sih, uint8 *wake_mask, uint8 *cur_status, uint8 gci_gpio,
+       uint32 pmu_cc2_mask, uint32 pmu_cc2_value);
+
+/* GCI GPIO event handlers */
+extern void *si_gci_gpioint_handler_register(si_t *sih, uint8 gpio, uint8 sts,
+       gci_gpio_handler_t cb, void *arg);
+extern void si_gci_gpioint_handler_unregister(si_t *sih, void* gci_i);
+
+extern uint8 si_gci_gpio_status(si_t *sih, uint8 gci_gpio, uint8 mask, uint8 value);
+extern void si_gci_config_wake_pin(si_t *sih, uint8 gpio_n, uint8 wake_events,
+       bool gci_gpio);
+extern void si_gci_free_wake_pin(si_t *sih, uint8 gpio_n);
+
+/* Wake-on-wireless-LAN (WOWL) */
+extern bool si_pci_pmestat(const si_t *sih);
+extern void si_pci_pmeclr(const si_t *sih);
+extern void si_pci_pmeen(const si_t *sih);
+extern void si_pci_pmestatclr(const si_t *sih);
+extern uint si_pcie_readreg(void *sih, uint addrtype, uint offset);
+extern uint si_pcie_writereg(void *sih, uint addrtype, uint offset, uint val);
+
+#ifdef BCMSDIO
+extern void si_sdio_init(si_t *sih);
+#endif
+
+extern uint16 si_d11_devid(si_t *sih);
+extern int si_corepciid(si_t *sih, uint func, uint16 *pcivendor, uint16 *pcidevice,
+       uint8 *pciclass, uint8 *pcisubclass, uint8 *pciprogif, uint8 *pciheader);
+
+extern uint32 si_seci_access(si_t *sih, uint32 val, int access);
+extern volatile void* si_seci_init(si_t *sih, uint8 seci_mode);
+extern void si_seci_clk_force(si_t *sih, bool val);
+extern bool si_seci_clk_force_status(si_t *sih);
+
+#define si_eci(sih) 0
+#define si_eci_init(sih) 0
+#define si_eci_notify_bt(sih, type, val)  (0)
+#define si_seci(sih) 0
+#define si_seci_upd(sih, a)    do {} while (0)
+#define si_gci_init(sih) NULL
+#define si_seci_down(sih) do {} while (0)
+#define si_gci(sih) 0
+#define si_sraon(sih) 0
+
+/* OTP status */
+extern bool si_is_otp_disabled(const si_t *sih);
+extern bool si_is_otp_powered(si_t *sih);
+extern void si_otp_power(si_t *sih, bool on, uint32* min_res_mask);
+
+/* SPROM availability */
+extern bool si_is_sprom_available(si_t *sih);
+
+/* SFlash availability */
+bool si_is_sflash_available(const si_t *sih);
+
+/* OTP/SROM CIS stuff */
+extern int si_cis_source(const si_t *sih);
+#define CIS_DEFAULT    0
+#define CIS_SROM       1
+#define CIS_OTP                2
+
+/* Fab-id information */
+#define        DEFAULT_FAB     0x0     /**< Original/first fab used for this chip */
+#define        CSM_FAB7        0x1     /**< CSM Fab7 chip */
+#define        TSMC_FAB12      0x2     /**< TSMC Fab12/Fab14 chip */
+#define        SMIC_FAB4       0x3     /**< SMIC Fab4 chip */
+
+/* bp_ind_access default timeout */
+#define BP_ACCESS_TO (500u * 1000u)
+
+extern uint16 si_fabid(si_t *sih);
+extern uint16 si_chipid(const si_t *sih);
+
+/*
+ * Build device path. Path size must be >= SI_DEVPATH_BUFSZ.
+ * The returned path is NULL terminated and has trailing '/'.
+ * Return 0 on success, nonzero otherwise.
+ */
+extern int si_devpath(const si_t *sih, char *path, int size);
+extern int si_devpath_pcie(const si_t *sih, char *path, int size);
+/* Read variable with prepending the devpath to the name */
+extern char *si_getdevpathvar(const si_t *sih, const char *name);
+extern int si_getdevpathintvar(const si_t *sih, const char *name);
+extern char *si_coded_devpathvar(const si_t *sih, char *varname, int var_len, const char *name);
+
+/* === HW PR WARs === */
+extern uint8 si_pcieclkreq(const si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_pcielcreg(const si_t *sih, uint32 mask, uint32 val);
+extern uint8 si_pcieltrenable(const si_t *sih, uint32 mask, uint32 val);
+extern uint8 si_pcieobffenable(const si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_pcieltr_reg(const si_t *sih, uint32 reg, uint32 mask, uint32 val);
+extern uint32 si_pcieltrspacing_reg(const si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_pcieltrhysteresiscnt_reg(const si_t *sih, uint32 mask, uint32 val);
+extern void si_pcie_set_error_injection(const si_t *sih, uint32 mode);
+extern void si_pcie_set_L1substate(const si_t *sih, uint32 substate);
+extern uint32 si_pcie_get_L1substate(const si_t *sih);
+extern void si_pci_down(const si_t *sih);
+extern void si_pci_up(const si_t *sih);
+extern void si_pci_sleep(const si_t *sih);
+extern void si_pcie_war_ovr_update(const si_t *sih, uint8 aspm);
+extern void si_pcie_power_save_enable(const si_t *sih, bool enable);
+extern int si_pci_fixcfg(si_t *sih);
+extern bool si_is_warmboot(void);
+
+extern void si_chipcontrl_restore(si_t *sih, uint32 val);
+extern uint32 si_chipcontrl_read(si_t *sih);
+extern void si_chipcontrl_srom4360(si_t *sih, bool on);
+extern void si_srom_clk_set(si_t *sih); /**< for chips with fast BP clock */
+extern void si_btc_enable_chipcontrol(si_t *sih);
+extern void si_pmu_avb_clk_set(si_t *sih, osl_t *osh, bool set_flag);
+/* === debug routines === */
+
+extern bool si_taclear(si_t *sih, bool details);
+
+#if defined(BCMDBG_PHYDUMP)
+struct bcmstrbuf;
+extern int si_dump_pcieinfo(const si_t *sih, struct bcmstrbuf *b);
+extern void si_dump_pmuregs(si_t *sih, struct bcmstrbuf *b);
+extern int si_dump_pcieregs(const si_t *sih, struct bcmstrbuf *b);
+#endif
+
+#if defined(BCMDBG_PHYDUMP)
+
+extern void si_dumpregs(si_t *sih, struct bcmstrbuf *b);
+#endif
+
+extern uint32 si_ccreg(si_t *sih, uint32 offset, uint32 mask, uint32 val);
+extern uint32 si_pciereg(const si_t *sih, uint32 offset, uint32 mask, uint32 val, uint type);
+extern int si_bpind_access(si_t *sih, uint32 addr_high, uint32 addr_low,
+       int32* data, bool read, uint32 us_timeout);
+extern void sih_write_sraon(si_t *sih, int offset, int len, const uint32* data);
+#ifdef SR_DEBUG
+extern void si_dump_pmu(si_t *sih, void *pmu_var);
+extern void si_pmu_keep_on(const si_t *sih, int32 int_val);
+extern uint32 si_pmu_keep_on_get(const si_t *sih);
+extern uint32 si_power_island_set(si_t *sih, uint32 int_val);
+extern uint32 si_power_island_get(si_t *sih);
+#endif /* SR_DEBUG */
+
+extern uint32 si_pcieserdesreg(const si_t *sih, uint32 mdioslave, uint32 offset,
+       uint32 mask, uint32 val);
+extern void si_pcie_set_request_size(const si_t *sih, uint16 size);
+extern uint16 si_pcie_get_request_size(const si_t *sih);
+extern void si_pcie_set_maxpayload_size(const si_t *sih, uint16 size);
+extern uint16 si_pcie_get_maxpayload_size(const si_t *sih);
+extern uint16 si_pcie_get_ssid(const si_t *sih);
+extern uint32 si_pcie_get_bar0(const si_t *sih);
+extern int si_pcie_configspace_cache(const si_t *sih);
+extern int si_pcie_configspace_restore(const si_t *sih);
+extern int si_pcie_configspace_get(const si_t *sih, uint8 *buf, uint size);
+
+extern uint32 si_findcoreidx_by_axiid(const si_t *sih, uint32 axiid);
+extern void si_wrapper_get_last_error(const si_t *sih, uint32 *error_status, uint32 *core,
+       uint32 *lo, uint32 *hi, uint32 *id);
+extern uint32 si_get_axi_timeout_reg(const si_t *sih);
+
+#ifdef AXI_TIMEOUTS_NIC
+extern const si_axi_error_info_t * si_get_axi_errlog_info(const si_t *sih);
+extern void si_reset_axi_errlog_info(const si_t * sih);
+#endif /* AXI_TIMEOUTS_NIC */
+
+extern void si_update_backplane_timeouts(const si_t *sih, bool enable, uint32 timeout, uint32 cid);
+
+extern uint32 si_tcm_size(si_t *sih);
+extern bool si_has_flops(si_t *sih);
+
+extern int si_set_sromctl(si_t *sih, uint32 value);
+extern uint32 si_get_sromctl(si_t *sih);
+
+extern uint32 si_gci_direct(si_t *sih, uint offset, uint32 mask, uint32 val);
+extern uint32 si_gci_indirect(si_t *sih, uint regidx, uint offset, uint32 mask, uint32 val);
+extern uint32 si_gci_output(si_t *sih, uint reg, uint32 mask, uint32 val);
+extern uint32 si_gci_input(si_t *sih, uint reg);
+extern uint32 si_gci_int_enable(si_t *sih, bool enable);
+extern void si_gci_reset(si_t *sih);
+#ifdef BCMLTECOEX
+extern void si_ercx_init(si_t *sih, uint32 ltecx_mux, uint32 ltecx_padnum,
+       uint32 ltecx_fnsel, uint32 ltecx_gcigpio);
+#endif /* BCMLTECOEX */
+#if defined(BCMLTECOEX)
+extern int si_wci2_rxfifo_handler_register(si_t *sih, wci2_handler_t rx_cb, void *ctx);
+extern void si_wci2_rxfifo_handler_unregister(si_t *sih);
+#endif
+extern void si_gci_seci_init(si_t *sih);
+extern void si_wci2_init(si_t *sih, uint8 baudrate, uint32 ltecx_mux, uint32 ltecx_padnum,
+       uint32 ltecx_fnsel, uint32 ltecx_gcigpio, uint32 xtalfreq);
+
+extern bool si_btcx_wci2_init(si_t *sih);
+
+extern void si_gci_set_functionsel(si_t *sih, uint32 pin, uint8 fnsel);
+extern uint32 si_gci_get_functionsel(si_t *sih, uint32 pin);
+extern void si_gci_clear_functionsel(si_t *sih, uint8 fnsel);
+extern uint8 si_gci_get_chipctrlreg_idx(uint32 pin, uint32 *regidx, uint32 *pos);
+extern uint32 si_gci_chipcontrol(si_t *sih, uint reg, uint32 mask, uint32 val);
+extern uint32 si_gci_chipstatus(si_t *sih, uint reg);
+extern uint8 si_enable_device_wake(si_t *sih, uint8 *wake_status, uint8 *cur_status);
+extern uint8 si_get_device_wake_opt(si_t *sih);
+extern void si_swdenable(si_t *sih, uint32 swdflag);
+extern uint8 si_enable_perst_wake(si_t *sih, uint8 *perst_wake_mask, uint8 *perst_cur_status);
+
+extern uint32 si_get_pmu_reg_addr(si_t *sih, uint32 offset);
+#define CHIPCTRLREG1 0x1
+#define CHIPCTRLREG2 0x2
+#define CHIPCTRLREG3 0x3
+#define CHIPCTRLREG4 0x4
+#define CHIPCTRLREG5 0x5
+#define MINRESMASKREG 0x618
+#define MAXRESMASKREG 0x61c
+#define CHIPCTRLADDR 0x650
+#define CHIPCTRLDATA 0x654
+#define RSRCTABLEADDR 0x620
+#define RSRCUPDWNTIME 0x628
+#define PMUREG_RESREQ_MASK 0x68c
+
+void si_update_masks(si_t *sih);
+void si_force_islanding(si_t *sih, bool enable);
+extern uint32 si_pmu_res_req_timer_clr(si_t *sih);
+extern void si_pmu_rfldo(si_t *sih, bool on);
+extern void si_pcie_ltr_war(const si_t *sih);
+extern void si_pcie_hw_LTR_war(const si_t *sih);
+extern void si_pcie_hw_L1SS_war(const si_t *sih);
+extern void si_pciedev_crwlpciegen2(const si_t *sih);
+extern void si_pcie_prep_D3(const si_t *sih, bool enter_D3);
+extern void si_pciedev_reg_pm_clk_period(const si_t *sih);
+extern void si_pcie_disable_oobselltr(const si_t *sih);
+extern uint32 si_raw_reg(const si_t *sih, uint32 reg, uint32 val, uint32 wrire_req);
+
+/* Macro to enable clock gating changes in different cores */
+#define MEM_CLK_GATE_BIT       5
+#define GCI_CLK_GATE_BIT       18
+
+#define USBAPP_CLK_BIT         0
+#define PCIE_CLK_BIT           3
+#define ARMCR4_DBG_CLK_BIT     4
+#define SAMPLE_SYNC_CLK_BIT    17
+#define PCIE_TL_CLK_BIT                18
+#define HQ_REQ_BIT             24
+#define PLL_DIV2_BIT_START     9
+#define PLL_DIV2_MASK          (0x37 << PLL_DIV2_BIT_START)
+#define PLL_DIV2_DIS_OP                (0x37 << PLL_DIV2_BIT_START)
+
+#define pmu_corereg(si, cc_idx, member, mask, val) \
+       (AOB_ENAB(si) ? \
+               si_pmu_corereg(si, si_findcoreidx(si, PMU_CORE_ID, 0), \
+                              OFFSETOF(pmuregs_t, member), mask, val): \
+               si_pmu_corereg(si, cc_idx, OFFSETOF(chipcregs_t, member), mask, val))
+
+#define PMU_REG(si, member, mask, val) \
+       (AOB_ENAB(si) ? \
+               si_corereg(si, si_findcoreidx(si, PMU_CORE_ID, 0), \
+                       OFFSETOF(pmuregs_t, member), mask, val): \
+               si_corereg(si, SI_CC_IDX, OFFSETOF(chipcregs_t, member), mask, val))
+
+/* Used only for the regs present in the pmu core and not present in the old cc core */
+#define PMU_REG_NEW(si, member, mask, val) \
+               si_corereg(si, si_findcoreidx(si, PMU_CORE_ID, 0), \
+                       OFFSETOF(pmuregs_t, member), mask, val)
+
+#define GCI_REG(si, offset, mask, val) \
+               (AOB_ENAB(si) ? \
+                       si_corereg(si, si_findcoreidx(si, GCI_CORE_ID, 0), \
+                               offset, mask, val): \
+                       si_corereg(si, SI_CC_IDX, offset, mask, val))
+
+/* Used only for the regs present in the gci core and not present in the old cc core */
+#define GCI_REG_NEW(si, member, mask, val) \
+               si_corereg(si, si_findcoreidx(si, GCI_CORE_ID, 0), \
+                       OFFSETOF(gciregs_t, member), mask, val)
+
+#define LHL_REG(si, member, mask, val) \
+               si_corereg(si, si_findcoreidx(si, GCI_CORE_ID, 0), \
+                       OFFSETOF(gciregs_t, member), mask, val)
+
+#define CHIPC_REG(si, member, mask, val) \
+               si_corereg(si, SI_CC_IDX, OFFSETOF(chipcregs_t, member), mask, val)
+
+/* GCI Macros */
+#define ALLONES_32                             0xFFFFFFFF
+#define GCI_CCTL_SECIRST_OFFSET                        0 /**< SeciReset */
+#define GCI_CCTL_RSTSL_OFFSET                  1 /**< ResetSeciLogic */
+#define GCI_CCTL_SECIEN_OFFSET                 2 /**< EnableSeci  */
+#define GCI_CCTL_FSL_OFFSET                    3 /**< ForceSeciOutLow */
+#define GCI_CCTL_SMODE_OFFSET                  4 /**< SeciOpMode, 6:4 */
+#define GCI_CCTL_US_OFFSET                     7 /**< UpdateSeci */
+#define GCI_CCTL_BRKONSLP_OFFSET               8 /**< BreakOnSleep */
+#define GCI_CCTL_SILOWTOUT_OFFSET              9 /**< SeciInLowTimeout, 10:9 */
+#define GCI_CCTL_RSTOCC_OFFSET                 11 /**< ResetOffChipCoex */
+#define GCI_CCTL_ARESEND_OFFSET                        12 /**< AutoBTSigResend */
+#define GCI_CCTL_FGCR_OFFSET                   16 /**< ForceGciClkReq */
+#define GCI_CCTL_FHCRO_OFFSET                  17 /**< ForceHWClockReqOff */
+#define GCI_CCTL_FREGCLK_OFFSET                        18 /**< ForceRegClk */
+#define GCI_CCTL_FSECICLK_OFFSET               19 /**< ForceSeciClk */
+#define GCI_CCTL_FGCA_OFFSET                   20 /**< ForceGciClkAvail */
+#define GCI_CCTL_FGCAV_OFFSET                  21 /**< ForceGciClkAvailValue */
+#define GCI_CCTL_SCS_OFFSET                    24 /**< SeciClkStretch, 31:24 */
+#define GCI_CCTL_SCS                           25 /* SeciClkStretch */
+
+#define GCI_MODE_UART                          0x0
+#define GCI_MODE_SECI                          0x1
+#define GCI_MODE_BTSIG                         0x2
+#define GCI_MODE_GPIO                          0x3
+#define GCI_MODE_MASK                          0x7
+
+#define GCI_CCTL_LOWTOUT_DIS                   0x0
+#define GCI_CCTL_LOWTOUT_10BIT                 0x1
+#define GCI_CCTL_LOWTOUT_20BIT                 0x2
+#define GCI_CCTL_LOWTOUT_30BIT                 0x3
+#define GCI_CCTL_LOWTOUT_MASK                  0x3
+
+#define GCI_CCTL_SCS_DEF                       0x19
+#define GCI_CCTL_SCS_MASK                      0xFF
+
+#define GCI_SECIIN_MODE_OFFSET                 0
+#define GCI_SECIIN_GCIGPIO_OFFSET              4
+#define GCI_SECIIN_RXID2IP_OFFSET              8
+
+#define GCI_SECIIN_MODE_MASK                    0x7
+#define GCI_SECIIN_GCIGPIO_MASK                 0xF
+
+#define GCI_SECIOUT_MODE_OFFSET                        0
+#define GCI_SECIOUT_GCIGPIO_OFFSET             4
+#define        GCI_SECIOUT_LOOPBACK_OFFSET             8
+#define GCI_SECIOUT_SECIINRELATED_OFFSET       16
+
+#define GCI_SECIOUT_MODE_MASK                   0x7
+#define GCI_SECIOUT_GCIGPIO_MASK                0xF
+#define GCI_SECIOUT_SECIINRELATED_MASK          0x1
+
+#define GCI_SECIOUT_SECIINRELATED               0x1
+
+#define GCI_SECIAUX_RXENABLE_OFFSET            0
+#define GCI_SECIFIFO_RXENABLE_OFFSET           16
+
+#define GCI_SECITX_ENABLE_OFFSET               0
+
+#define GCI_GPIOCTL_INEN_OFFSET                        0
+#define GCI_GPIOCTL_OUTEN_OFFSET               1
+#define GCI_GPIOCTL_PDN_OFFSET                 4
+
+#define GCI_GPIOIDX_OFFSET                     16
+
+#define GCI_LTECX_SECI_ID                      0 /**< SECI port for LTECX */
+#define GCI_LTECX_TXCONF_EN_OFFSET             2
+#define GCI_LTECX_PRISEL_EN_OFFSET             3
+
+/* To access per GCI bit registers */
+#define GCI_REG_WIDTH                          32
+
+/* number of event summary bits */
+#define GCI_EVENT_NUM_BITS                     32
+
+/* gci event bits per core */
+#define GCI_EVENT_BITS_PER_CORE        4
+#define GCI_EVENT_HWBIT_1                      1
+#define GCI_EVENT_HWBIT_2                      2
+#define GCI_EVENT_SWBIT_1                      3
+#define GCI_EVENT_SWBIT_2                      4
+
+#define GCI_MBDATA_TOWLAN_POS  96
+#define GCI_MBACK_TOWLAN_POS   104
+#define GCI_WAKE_TOWLAN_PO             112
+#define GCI_SWREADY_POS                        120
+
+/* GCI bit positions */
+/* GCI [127:000] = WLAN [127:0] */
+#define GCI_WLAN_IP_ID                         0
+#define GCI_WLAN_BEGIN                         0
+#define GCI_WLAN_PRIO_POS                      (GCI_WLAN_BEGIN + 4)
+#define GCI_WLAN_PERST_POS                     (GCI_WLAN_BEGIN + 15)
+
+/* GCI [255:128] = BT [127:0] */
+#define GCI_BT_IP_ID                                   1
+#define GCI_BT_BEGIN                                   128
+#define GCI_BT_MBDATA_TOWLAN_POS       (GCI_BT_BEGIN + GCI_MBDATA_TOWLAN_POS)
+#define GCI_BT_MBACK_TOWLAN_POS        (GCI_BT_BEGIN + GCI_MBACK_TOWLAN_POS)
+#define GCI_BT_WAKE_TOWLAN_POS (GCI_BT_BEGIN + GCI_WAKE_TOWLAN_PO)
+#define GCI_BT_SWREADY_POS                     (GCI_BT_BEGIN + GCI_SWREADY_POS)
+
+/* GCI [639:512] = LTE [127:0] */
+#define GCI_LTE_IP_ID                          4
+#define GCI_LTE_BEGIN                          512
+#define GCI_LTE_FRAMESYNC_POS                  (GCI_LTE_BEGIN + 0)
+#define GCI_LTE_RX_POS                         (GCI_LTE_BEGIN + 1)
+#define GCI_LTE_TX_POS                         (GCI_LTE_BEGIN + 2)
+#define GCI_LTE_WCI2TYPE_POS                   (GCI_LTE_BEGIN + 48)
+#define GCI_LTE_WCI2TYPE_MASK                  7
+#define GCI_LTE_AUXRXDVALID_POS                        (GCI_LTE_BEGIN + 56)
+
+/* Reg Index corresponding to ECI bit no x of ECI space */
+#define GCI_REGIDX(x)                          ((x)/GCI_REG_WIDTH)
+/* Bit offset of ECI bit no x in 32-bit words */
+#define GCI_BITOFFSET(x)                       ((x)%GCI_REG_WIDTH)
+
+#define GCI_ECI_HW0(ip_id)     (((ip_id) * GCI_EVENT_BITS_PER_CORE) + 0)
+#define GCI_ECI_HW1(ip_id)     (((ip_id) * GCI_EVENT_BITS_PER_CORE) + 1)
+#define GCI_ECI_SW0(ip_id)     (((ip_id) * GCI_EVENT_BITS_PER_CORE) + 2)
+#define GCI_ECI_SW1(ip_id)     (((ip_id) * GCI_EVENT_BITS_PER_CORE) + 3)
+
+/* BT SMEM Control Register 0 */
+#define GCI_BT_SMEM_CTRL0_SUBCORE_ENABLE_PKILL (1 << 28)
+
+/* GCI RXFIFO Common control */
+#define GCI_RXFIFO_CTRL_AUX_EN         0xFF
+#define GCI_RXFIFO_CTRL_FIFO_EN                0xFF00
+#define GCI_RXFIFO_CTRL_FIFO_TYPE2_EN  0x400
+
+/* End - GCI Macros */
+
+extern void si_pll_sr_reinit(si_t *sih);
+extern void si_pll_closeloop(si_t *sih);
+extern uint si_num_slaveports(const si_t *sih, uint coreid);
+extern uint32 si_get_slaveport_addr(si_t *sih, uint spidx, uint baidx,
+       uint core_id, uint coreunit);
+extern uint32 si_get_d11_slaveport_addr(si_t *sih, uint spidx,
+       uint baidx, uint coreunit);
+void si_introff(const si_t *sih, bcm_int_bitmask_t *intr_val);
+void si_intrrestore(const si_t *sih, bcm_int_bitmask_t *intr_val);
+bool si_get_nvram_rfldo3p3_war(const si_t *sih);
+void si_nvram_res_masks(const si_t *sih, uint32 *min_mask, uint32 *max_mask);
+extern uint32 si_xtalfreq(const si_t *sih);
+extern uint8 si_getspurmode(const si_t *sih);
+extern uint32 si_get_openloop_dco_code(const si_t *sih);
+extern void si_set_openloop_dco_code(si_t *sih, uint32 openloop_dco_code);
+extern uint32 si_wrapper_dump_buf_size(const si_t *sih);
+extern uint32 si_wrapper_dump_binary(const si_t *sih, uchar *p);
+extern uint32 si_wrapper_dump_last_timeout(const si_t *sih, uint32 *error, uint32 *core,
+       uint32 *ba, uchar *p);
+
+/* SR Power Control */
+extern uint32 si_srpwr_request(const si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_srpwr_request_on_rev80(si_t *sih, uint32 mask, uint32 val,
+       uint32 ucode_awake);
+extern uint32 si_srpwr_stat_spinwait(const si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_srpwr_stat(si_t *sih);
+extern uint32 si_srpwr_domain(si_t *sih);
+extern uint32 si_srpwr_domain_all_mask(const si_t *sih);
+extern uint8 si_srpwr_domain_wl(si_t *sih);
+extern uint32 si_srpwr_bt_status(si_t *sih);
+/* SR Power Control */
+bool si_srpwr_cap(si_t *sih);
+#define SRPWR_CAP(sih) (si_srpwr_cap(sih))
+
+#ifdef BCMSRPWR
+       extern bool _bcmsrpwr;
+       #define SRPWR_ENAB()    (_bcmsrpwr)
+#else
+       #define SRPWR_ENAB()            (0)
+#endif /* BCMSRPWR */
+
+/*
+ * Multi-BackPlane architecture.  Each can power up/down independently.
+ *   Common backplane: shared between BT and WL
+ *      ChipC, PCIe, GCI, PMU, SRs
+ *      HW powers up as needed
+ *   WL BackPlane (WLBP):
+ *      ARM, TCM, Main, Aux
+ *      Host needs to power up
+ */
+#define MULTIBP_CAP(sih)       (BCM4368_CHIP(sih->chip) || BCM4378_CHIP(sih->chip) || \
+                               BCM4387_CHIP(sih->chip) || BCM4388_CHIP(sih->chip) || \
+                               BCM4389_CHIP(sih->chip) || BCM4385_CHIP(sih->chip) || \
+                               BCM4376_CHIP(sih->chip) || BCM4397_CHIP(sih->chip))
+#define MULTIBP_ENAB(sih)      ((sih) && (sih)->_multibp_enable)
+
+uint32 si_enum_base(uint devid);
+
+/* Default ARM PLL freq 4369/4368 */
+#define ARMPLL_FREQ_400MHZ             (400u)
+#define ARMPLL_FREQ_800MHZ            (800u)
+/* ARM PLL freq computed using chip defaults is 1002.8235 Mhz */
+#define ARMPLL_FREQ_1000MHZ           (1003u)
+
+extern uint8 si_lhl_ps_mode(const si_t *sih);
+extern uint32 si_get_armpllclkfreq(const si_t *sih);
+uint8 si_get_ccidiv(const si_t *sih);
+extern uint8 si_hib_ext_wakeup_isenab(const si_t *sih);
+
+#ifdef UART_TRAP_DBG
+void si_dump_APB_Bridge_registers(const si_t *sih);
+#endif /* UART_TRAP_DBG */
+void si_force_clocks(const si_t *sih, uint clock_state);
+
+/* indicates to the siutils how the PICe BAR0 is mappend.
+ * here is the current scheme, which are all using BAR0:
+ * id     enum       wrapper
+ * ====   =========  =========
+ *    0   0000-0FFF  1000-1FFF
+ *    1   4000-4FFF  5000-5FFF
+ *    2   9000-9FFF  A000-AFFF
+ * >= 3   not supported
+ */
+void si_set_slice_id(si_t *sih, uint8 slice);
+uint8 si_get_slice_id(const si_t *sih);
+
+/* query the d11 core type */
+#define D11_CORE_TYPE_NORM     0u
+#define D11_CORE_TYPE_SCAN     1u
+uint si_core_d11_type(si_t *sih, uint coreunit);
+
+/* check if the package option allows the d11 core */
+bool si_pkgopt_d11_allowed(si_t *sih, uint coreuint);
+
+/* return if scan core is present */
+bool si_scan_core_present(const si_t *sih);
+void si_configure_pwrthrottle_gpio(si_t *sih, uint8 pwrthrottle_gpio_pin);
+void si_configure_onbody_gpio(si_t *sih, uint8 onbody_gpio_pin);
+
+/* return BT state */
+bool si_btc_bt_status_in_reset(si_t *sih);
+bool si_btc_bt_status_in_pds(si_t *sih);
+int si_btc_bt_pds_wakeup_force(si_t *sih, bool force);
+
+/* RFFE RFEM Functions */
+extern void si_jtag_udr_pwrsw_main_toggle(si_t *sih, bool on);
+extern int si_pmu_res_state_pwrsw_main_wait(si_t *sih);
+#endif /* _siutils_h_ */
diff --git a/bcmdhd.101.10.240.x/include/typedefs.h b/bcmdhd.101.10.240.x/include/typedefs.h
new file mode 100644 (file)
index 0000000..871b511
--- /dev/null
@@ -0,0 +1,372 @@
+/*
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _TYPEDEFS_H_
+#define _TYPEDEFS_H_
+
+#if (!defined(EDK_RELEASE_VERSION) || (EDK_RELEASE_VERSION < 0x00020000)) || \
+       !defined(BWL_NO_INTERNAL_STDLIB_SUPPORT)
+
+#ifdef SITE_TYPEDEFS
+
+/*
+ * Define SITE_TYPEDEFS in the compile to include a site-specific
+ * typedef file "site_typedefs.h".
+ *
+ * If SITE_TYPEDEFS is not defined, then the code section below makes
+ * inferences about the compile environment based on defined symbols and
+ * possibly compiler pragmas.
+ *
+ * Following these two sections is the Default Typedefs section.
+ * This section is only processed if USE_TYPEDEF_DEFAULTS is
+ * defined. This section has a default set of typedefs and a few
+ * preprocessor symbols (TRUE, FALSE, NULL, ...).
+ */
+
+#include "site_typedefs.h"
+
+#else
+
+/*
+ * Infer the compile environment based on preprocessor symbols and pragmas.
+ * Override type definitions as needed, and include configuration-dependent
+ * header files to define types.
+ */
+
+#ifdef __cplusplus
+
+#define TYPEDEF_BOOL
+#ifndef FALSE
+#define FALSE  false
+#endif
+#ifndef TRUE
+#define TRUE   true
+#endif
+
+#else  /* ! __cplusplus */
+
+#endif /* ! __cplusplus */
+
+#if !defined(TYPEDEF_UINTPTR)
+#if defined(__LP64__)
+#define TYPEDEF_UINTPTR
+typedef unsigned long long int uintptr;
+#endif
+#endif /* TYPEDEF_UINTPTR */
+
+/* float_t types conflict with the same typedefs from the standard ANSI-C
+** math.h header file. Don't re-typedef them here.
+*/
+
+#if defined(MACOSX)
+#define TYPEDEF_FLOAT_T
+#endif /* MACOSX */
+
+#if defined(_NEED_SIZE_T_)
+typedef long unsigned int size_t;
+#endif
+
+#if defined(__sparc__)
+#define TYPEDEF_ULONG
+#endif
+
+#if defined(__linux__)
+/*
+ * If this is either a Linux hybrid build or the per-port code of a hybrid build
+ * then use the Linux header files to get some of the typedefs.  Otherwise, define
+ * them entirely in this file.  We can't always define the types because we get
+ * a duplicate typedef error; there is no way to "undefine" a typedef.
+ * We know when it's per-port code because each file defines LINUX_PORT at the top.
+ */
+#define TYPEDEF_UINT
+#ifndef TARGETENV_android
+#define TYPEDEF_USHORT
+#define TYPEDEF_ULONG
+#endif /* TARGETENV_android */
+#ifdef __KERNEL__
+#include <linux/version.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19))
+#define TYPEDEF_BOOL
+#endif /* >= 2.6.19 */
+/* special detection for 2.6.18-128.7.1.0.1.el5 */
+#if (LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18))
+#include <linux/compiler.h>
+#ifdef noinline_for_stack
+#define TYPEDEF_BOOL
+#endif
+#endif /* == 2.6.18 */
+#endif /* __KERNEL__ */
+#endif
+
+#if !defined(__linux__) && !defined(__DJGPP__)
+#define TYPEDEF_UINT
+#define TYPEDEF_USHORT
+#endif
+
+/* Do not support the (u)int64 types with strict ansi for GNU C */
+#if defined(__GNUC__) && defined(__STRICT_ANSI__)
+#define TYPEDEF_INT64
+#define TYPEDEF_UINT64
+#endif /* defined(__GNUC__) && defined(__STRICT_ANSI__) */
+
+/* ICL accepts unsigned 64 bit type only, and complains in ANSI mode
+ * for signed or unsigned
+ */
+#if defined(__ICL)
+
+#define TYPEDEF_INT64
+
+#if defined(__STDC__)
+#define TYPEDEF_UINT64
+#endif
+
+#endif /* __ICL */
+
+#if !defined(__DJGPP__)
+
+/* pick up ushort & uint from standard types.h */
+#if defined(__linux__) && defined(__KERNEL__)
+
+/* See note above */
+#include <linux/types.h>       /* sys/types.h and linux/types.h are oil and water */
+
+#else
+
+#include <sys/types.h>
+
+#endif /* linux && __KERNEL__ */
+
+#endif
+
+/* use the default typedefs in the next section of this file */
+#define USE_TYPEDEF_DEFAULTS
+
+#endif /* SITE_TYPEDEFS */
+
+/*
+ * Default Typedefs
+ */
+
+#ifdef USE_TYPEDEF_DEFAULTS
+#undef USE_TYPEDEF_DEFAULTS
+
+#ifndef TYPEDEF_BOOL
+typedef        /* @abstract@ */ unsigned char  bool;
+#endif /* endif TYPEDEF_BOOL */
+
+/* define uchar, ushort, uint, ulong */
+
+#ifndef TYPEDEF_UCHAR
+typedef unsigned char  uchar;
+#endif
+
+#ifndef TYPEDEF_USHORT
+typedef unsigned short ushort;
+#endif
+
+#ifndef TYPEDEF_UINT
+typedef unsigned int   uint;
+#endif
+
+#ifndef TYPEDEF_ULONG
+typedef unsigned long  ulong;
+#endif
+
+/* define [u]int8/16/32/64, uintptr */
+
+#ifndef TYPEDEF_UINT8
+typedef unsigned char  uint8;
+#endif
+
+#ifndef TYPEDEF_UINT16
+typedef unsigned short uint16;
+#endif
+
+#ifndef TYPEDEF_UINT32
+typedef unsigned int   uint32;
+#endif
+
+#ifndef TYPEDEF_UINT64
+typedef unsigned long long uint64;
+#endif
+
+#ifndef TYPEDEF_UINTPTR
+typedef unsigned int   uintptr;
+#endif
+
+#ifndef TYPEDEF_INT8
+typedef signed char    int8;
+#endif
+
+#ifndef TYPEDEF_INT16
+typedef signed short   int16;
+#endif
+
+#ifndef TYPEDEF_INT32
+typedef signed int     int32;
+#endif
+
+#ifndef TYPEDEF_INT64
+typedef signed long long int64;
+#endif
+
+/* define float32/64, float_t */
+
+#ifndef TYPEDEF_FLOAT32
+typedef float          float32;
+#endif
+
+#ifndef TYPEDEF_FLOAT64
+typedef double         float64;
+#endif
+
+/*
+ * abstracted floating point type allows for compile time selection of
+ * single or double precision arithmetic.  Compiling with -DFLOAT32
+ * selects single precision; the default is double precision.
+ */
+
+#ifndef TYPEDEF_FLOAT_T
+
+#if defined(FLOAT32)
+typedef float32 float_t;
+#else /* default to double precision floating point */
+typedef float64 float_t;
+#endif
+
+#endif /* TYPEDEF_FLOAT_T */
+
+/* define macro values */
+
+#ifndef FALSE
+#define FALSE  0
+#endif
+
+#ifndef TRUE
+#define TRUE   1  /* TRUE */
+#endif
+
+#ifndef NULL
+#define        NULL    0
+#endif
+
+#ifndef OFF
+#define        OFF     0
+#endif
+
+#ifndef ON
+#define        ON      1  /* ON = 1 */
+#endif
+
+#define        AUTO    (-1) /* Auto = -1 */
+
+/* define PTRSZ, INLINE */
+
+#ifndef PTRSZ
+#define        PTRSZ   sizeof(char*)
+#endif
+
+/* Detect compiler type. */
+#if defined(__GNUC__) || defined(__lint)
+       #define BWL_COMPILER_GNU
+#elif defined(__CC_ARM) && __CC_ARM
+       #define BWL_COMPILER_ARMCC
+#else
+       #error "Unknown compiler!"
+#endif
+
+#ifndef INLINE
+#if defined(BWL_COMPILER_MICROSOFT)
+       #define INLINE __inline
+#elif defined(BWL_COMPILER_GNU)
+       #define INLINE __inline__
+#elif defined(BWL_COMPILER_ARMCC)
+       #define INLINE  __inline
+#else
+       #define INLINE
+#endif
+#endif /* INLINE */
+
+#undef TYPEDEF_BOOL
+#undef TYPEDEF_UCHAR
+#undef TYPEDEF_USHORT
+#undef TYPEDEF_UINT
+#undef TYPEDEF_ULONG
+#undef TYPEDEF_UINT8
+#undef TYPEDEF_UINT16
+#undef TYPEDEF_UINT32
+#undef TYPEDEF_UINT64
+#undef TYPEDEF_UINTPTR
+#undef TYPEDEF_INT8
+#undef TYPEDEF_INT16
+#undef TYPEDEF_INT32
+#undef TYPEDEF_INT64
+#undef TYPEDEF_FLOAT32
+#undef TYPEDEF_FLOAT64
+#undef TYPEDEF_FLOAT_T
+
+#endif /* USE_TYPEDEF_DEFAULTS */
+
+/* Suppress unused parameter warning */
+#define UNUSED_PARAMETER(x) (void)(x)
+
+/* Avoid warning for discarded const or volatile qualifier in special cases (-Wcast-qual) */
+#define DISCARD_QUAL(ptr, type) ((type *)(uintptr)(ptr))
+
+#else /* !EDK_RELEASE_VERSION || (EDK_RELEASE_VERSION < 0x00020000) */
+
+#include <sys/types.h>
+#include <strings.h>
+#include <stdlib.h>
+
+#ifdef stderr
+#undef stderr
+#define stderr stdout
+#endif
+
+typedef UINT8   uint8;
+typedef UINT16  uint16;
+typedef UINT32  uint32;
+typedef UINT64  uint64;
+typedef INT8    int8;
+typedef INT16   int16;
+typedef INT32   int32;
+typedef INT64   int64;
+
+typedef BOOLEAN       bool;
+typedef unsigned char uchar;
+typedef UINTN         uintptr;
+
+#define UNUSED_PARAMETER(x) (void)(x)
+#define DISCARD_QUAL(ptr, type) ((type *)(uintptr)(ptr))
+#define INLINE
+#define        AUTO    (-1) /* Auto = -1 */
+#define        ON      1  /* ON = 1 */
+#define        OFF     0
+
+#endif /* !EDK_RELEASE_VERSION || (EDK_RELEASE_VERSION < 0x00020000) */
+
+/*
+ * Including the bcmdefs.h here, to make sure everyone including typedefs.h
+ * gets this automatically
+*/
+#include <bcmdefs.h>
+#endif /* _TYPEDEFS_H_ */
diff --git a/bcmdhd.101.10.240.x/include/usbrdl.h b/bcmdhd.101.10.240.x/include/usbrdl.h
new file mode 100644 (file)
index 0000000..be5bd69
--- /dev/null
@@ -0,0 +1,134 @@
+/*
+ * Broadcom USB remote download definitions
+ *
+ * Copyright (C) 1999-2016, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: usbrdl.h 597933 2015-11-06 18:52:06Z $
+ */
+
+#ifndef _USB_RDL_H
+#define _USB_RDL_H
+
+/* Control messages: bRequest values */
+#define DL_GETSTATE            0       /* returns the rdl_state_t struct */
+#define DL_CHECK_CRC           1       /* currently unused */
+#define DL_GO                  2       /* execute downloaded image */
+#define DL_START               3       /* initialize dl state */
+#define DL_REBOOT              4       /* reboot the device in 2 seconds */
+#define DL_GETVER              5       /* returns the bootrom_id_t struct */
+#define DL_GO_PROTECTED                6       /* execute the downloaded code and set reset event
+                                        * to occur in 2 seconds.  It is the responsibility
+                                        * of the downloaded code to clear this event
+                                        */
+#define DL_EXEC                        7       /* jump to a supplied address */
+#define DL_RESETCFG            8       /* To support single enum on dongle
+                                        * - Not used by bootloader
+                                        */
+#define DL_DEFER_RESP_OK       9       /* Potentially defer the response to setup
+                                        * if resp unavailable
+                                        */
+#define DL_CHGSPD              0x0A
+
+#define        DL_HWCMD_MASK           0xfc    /* Mask for hardware read commands: */
+#define        DL_RDHW                 0x10    /* Read a hardware address (Ctl-in) */
+#define        DL_RDHW32               0x10    /* Read a 32 bit word */
+#define        DL_RDHW16               0x11    /* Read 16 bits */
+#define        DL_RDHW8                0x12    /* Read an 8 bit byte */
+#define        DL_WRHW                 0x14    /* Write a hardware address (Ctl-out) */
+#define DL_WRHW_BLK            0x13    /* Block write to hardware access */
+
+#define DL_CMD_WRHW            2
+
+
+/* states */
+#define DL_WAITING     0       /* waiting to rx first pkt that includes the hdr info */
+#define DL_READY       1       /* hdr was good, waiting for more of the compressed image */
+#define DL_BAD_HDR     2       /* hdr was corrupted */
+#define DL_BAD_CRC     3       /* compressed image was corrupted */
+#define DL_RUNNABLE    4       /* download was successful, waiting for go cmd */
+#define DL_START_FAIL  5       /* failed to initialize correctly */
+#define DL_NVRAM_TOOBIG        6       /* host specified nvram data exceeds DL_NVRAM value */
+#define DL_IMAGE_TOOBIG        7       /* download image too big (exceeds DATA_START for rdl) */
+
+#define TIMEOUT                5000    /* Timeout for usb commands */
+
+struct bcm_device_id {
+       char    *name;
+       uint32  vend;
+       uint32  prod;
+};
+
+typedef struct {
+       uint32  state;
+       uint32  bytes;
+} rdl_state_t;
+
+typedef struct {
+       uint32  chip;           /* Chip id */
+       uint32  chiprev;        /* Chip rev */
+       uint32  ramsize;    /* Size of RAM */
+       uint32  remapbase;   /* Current remap base address */
+       uint32  boardtype;   /* Type of board */
+       uint32  boardrev;    /* Board revision */
+} bootrom_id_t;
+
+/* struct for backplane & jtag accesses */
+typedef struct {
+       uint32  cmd;            /* tag to identify the cmd */
+       uint32  addr;           /* backplane address for write */
+       uint32  len;            /* length of data: 1, 2, 4 bytes */
+       uint32  data;           /* data to write */
+} hwacc_t;
+
+
+/* struct for querying nvram params from bootloader */
+#define QUERY_STRING_MAX 32
+typedef struct {
+       uint32  cmd;                    /* tag to identify the cmd */
+       char    var[QUERY_STRING_MAX];  /* param name */
+} nvparam_t;
+
+typedef void (*exec_fn_t)(void *sih);
+
+#define USB_CTRL_IN (USB_TYPE_VENDOR | 0x80 | USB_RECIP_INTERFACE)
+#define USB_CTRL_OUT (USB_TYPE_VENDOR | 0 | USB_RECIP_INTERFACE)
+
+#define USB_CTRL_EP_TIMEOUT 500 /* Timeout used in USB control_msg transactions. */
+#define USB_BULK_EP_TIMEOUT 500 /* Timeout used in USB bulk transactions. */
+
+#define RDL_CHUNK_MAX  (64 * 1024)  /* max size of each dl transfer */
+#define RDL_CHUNK      1500  /* size of each dl transfer */
+
+/* bootloader makes special use of trx header "offsets" array */
+#define TRX_OFFSETS_DLFWLEN_IDX        0       /* Size of the fw; used in uncompressed case */
+#define TRX_OFFSETS_JUMPTO_IDX 1       /* RAM address for jumpto after download */
+#define TRX_OFFSETS_NVM_LEN_IDX        2       /* Length of appended NVRAM data */
+#ifdef BCMTRXV2
+#define TRX_OFFSETS_DSG_LEN_IDX        3       /* Length of digital signature for the first image */
+#define TRX_OFFSETS_CFG_LEN_IDX        4       /* Length of config region, which is not digitally signed */
+#endif /* BCMTRXV2 */
+
+#define TRX_OFFSETS_DLBASE_IDX  0       /* RAM start address for download */
+
+#endif  /* _USB_RDL_H */
diff --git a/bcmdhd.101.10.240.x/include/vlan.h b/bcmdhd.101.10.240.x/include/vlan.h
new file mode 100644 (file)
index 0000000..bbf5e50
--- /dev/null
@@ -0,0 +1,91 @@
+/*
+ * 802.1Q VLAN protocol definitions
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _vlan_h_
+#define _vlan_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#ifndef         VLAN_VID_MASK
+#define VLAN_VID_MASK          0xfff   /* low 12 bits are vlan id */
+#endif
+
+#define        VLAN_CFI_SHIFT          12      /* canonical format indicator bit */
+#define VLAN_PRI_SHIFT         13      /* user priority */
+
+#define VLAN_PRI_MASK          7       /* 3 bits of priority */
+
+#define        VLAN_TPID_OFFSET        12      /* offset of tag protocol id field */
+#define        VLAN_TCI_OFFSET         14      /* offset of tag ctrl info field */
+
+#define        VLAN_TAG_LEN            4
+#define        VLAN_TAG_OFFSET         (2 * ETHER_ADDR_LEN)    /* offset in Ethernet II packet only */
+
+#define VLAN_TPID              0x8100  /* VLAN ethertype/Tag Protocol ID */
+
+struct vlan_header {
+       uint16  vlan_type;              /* 0x8100 */
+       uint16  vlan_tag;               /* priority, cfi and vid */
+};
+
+BWL_PRE_PACKED_STRUCT struct ethervlan_header {
+       uint8   ether_dhost[ETHER_ADDR_LEN];
+       uint8   ether_shost[ETHER_ADDR_LEN];
+       uint16  vlan_type;              /* 0x8100 */
+       uint16  vlan_tag;               /* priority, cfi and vid */
+       uint16  ether_type;
+} BWL_POST_PACKED_STRUCT;
+
+struct dot3_mac_llc_snapvlan_header {
+       uint8   ether_dhost[ETHER_ADDR_LEN];    /* dest mac */
+       uint8   ether_shost[ETHER_ADDR_LEN];    /* src mac */
+       uint16  length;                         /* frame length incl header */
+       uint8   dsap;                           /* always 0xAA */
+       uint8   ssap;                           /* always 0xAA */
+       uint8   ctl;                            /* always 0x03 */
+       uint8   oui[3];                         /* RFC1042: 0x00 0x00 0x00
+                                                * Bridge-Tunnel: 0x00 0x00 0xF8
+                                                */
+       uint16  vlan_type;                      /* 0x8100 */
+       uint16  vlan_tag;                       /* priority, cfi and vid */
+       uint16  ether_type;                     /* ethertype */
+};
+
+#define        ETHERVLAN_HDR_LEN       (ETHER_HDR_LEN + VLAN_TAG_LEN)
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#define ETHERVLAN_MOVE_HDR(d, s) \
+do { \
+       struct ethervlan_header t; \
+       t = *(struct ethervlan_header *)(s); \
+       *(struct ethervlan_header *)(d) = t; \
+} while (0)
+
+#endif /* _vlan_h_ */
diff --git a/bcmdhd.101.10.240.x/include/wl_bam.h b/bcmdhd.101.10.240.x/include/wl_bam.h
new file mode 100644 (file)
index 0000000..2c7d59c
--- /dev/null
@@ -0,0 +1,74 @@
+/*
+ * Bad AP Manager for ADPS
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+#ifndef _WL_BAM_H_
+#define _WL_BAM_H_
+#include <typedefs.h>
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <net/cfg80211.h>
+
+#include <wl_cfgp2p.h>
+#include <dhd.h>
+
+#define WL_BAD_AP_MAX_ENTRY_NUM                20u
+
+typedef struct wl_bad_ap_mngr {
+       osl_t *osh;
+
+       uint32 num;
+       spinlock_t lock;
+#if !defined(DHD_ADPS_BAM_EXPORT)
+       struct mutex fs_lock;           /* lock for bad ap file list */
+#endif  /* !DHD_ADPS_BAM_EXPORT */
+       struct list_head list;
+} wl_bad_ap_mngr_t;
+
+typedef struct wl_bad_ap_info {
+       struct  ether_addr bssid;
+#if !defined(DHD_ADPS_BAM_EXPORT)
+       struct  tm tm;
+       uint32  status;
+       uint32  reason;
+       uint32  connect_count;
+#endif /* !DHD_ADPS_BAM_EXPORT */
+} wl_bad_ap_info_t;
+
+typedef struct wl_bad_ap_info_entry {
+       wl_bad_ap_info_t bad_ap;
+       struct list_head list;
+} wl_bad_ap_info_entry_t;
+
+void wl_bad_ap_mngr_init(struct bcm_cfg80211 *cfg);
+void wl_bad_ap_mngr_deinit(struct bcm_cfg80211 *cfg);
+
+int wl_bad_ap_mngr_add(wl_bad_ap_mngr_t *bad_ap_mngr, wl_bad_ap_info_t *bad_ap_info);
+wl_bad_ap_info_entry_t* wl_bad_ap_mngr_find(wl_bad_ap_mngr_t *bad_ap_mngr,
+        const struct ether_addr *bssid);
+
+bool wl_adps_bad_ap_check(struct bcm_cfg80211 *cfg, const struct ether_addr *bssid);
+int wl_adps_enabled(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+int wl_adps_set_suspend(struct bcm_cfg80211 *cfg, struct net_device *ndev, uint8 suspend);
+
+s32 wl_adps_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#endif  /* _WL_BAM_H_ */
diff --git a/bcmdhd.101.10.240.x/include/wl_bigdata.h b/bcmdhd.101.10.240.x/include/wl_bigdata.h
new file mode 100644 (file)
index 0000000..bdd4019
--- /dev/null
@@ -0,0 +1,81 @@
+/*
+ * Bigdata logging and report. None EWP and Hang event.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+#ifndef __WL_BIGDATA_H_
+#define __WL_BIGDATA_H_
+
+#include <802.11.h>
+#include <bcmevent.h>
+#include <bcmwifi_channels.h>
+
+#define MAX_STA_INFO_AP_CNT    20
+
+#define DOT11_11B_MAX_RATE 11
+#define DOT11_2GHZ_MAX_CH_NUM 14
+#define DOT11_HT_MCS_RATE_MASK 0xFF
+
+enum {
+       BIGDATA_DOT11_11B_MODE = 0,
+       BIGDATA_DOT11_11G_MODE = 1,
+       BIGDATA_DOT11_11N_MODE = 2,
+       BIGDATA_DOT11_11A_MODE = 3,
+       BIGDATA_DOT11_11AC_MODE = 4,
+       BIGDATA_DOT11_11AX_MODE = 5,
+       BIGDATA_DOT11_MODE_MAX
+};
+
+typedef struct wl_ap_sta_data
+{
+       struct ether_addr mac;
+       uint32 mode_80211;
+       uint32 nss;
+       chanspec_t chanspec;
+       int16 rssi;
+       uint32 rate;
+       uint8 channel;
+       uint32 mimo;
+       uint32 disconnected;
+       uint32 is_empty;
+       uint32 reason_code;
+} wl_ap_sta_data_t;
+
+typedef struct ap_sta_wq_data
+{
+       wl_event_msg_t e;
+       void *dhdp;
+       void *bcm_cfg;
+       void *ndev;
+} ap_sta_wq_data_t;
+
+typedef struct wl_ap_sta_info
+{
+       wl_ap_sta_data_t *ap_sta_data;
+       uint32 sta_list_cnt;
+       struct mutex wq_data_sync;
+} wl_ap_sta_info_t;
+
+int wl_attach_ap_stainfo(void *bcm_cfg);
+int wl_detach_ap_stainfo(void *bcm_cfg);
+int wl_ap_stainfo_init(void *bcm_cfg);
+void wl_gather_ap_stadata(void *handle, void *event_info, u8 event);
+int wl_get_ap_stadata(void *bcm_cfg, struct ether_addr *sta_mac, void **data);
+#endif /* __WL_BIGDATA_H_ */
diff --git a/bcmdhd.101.10.240.x/include/wldev_common.h b/bcmdhd.101.10.240.x/include/wldev_common.h
new file mode 100644 (file)
index 0000000..ca44ecc
--- /dev/null
@@ -0,0 +1,131 @@
+/*
+ * Common function shared by Linux WEXT, cfg80211 and p2p drivers
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+#ifndef __WLDEV_COMMON_H__
+#define __WLDEV_COMMON_H__
+
+#include <wlioctl.h>
+
+/* wl_dev_ioctl - get/set IOCTLs, will call net_device's do_ioctl (or
+ *  netdev_ops->ndo_do_ioctl in new kernels)
+ *  @dev: the net_device handle
+ */
+s32 wldev_ioctl(
+       struct net_device *dev, u32 cmd, void *arg, u32 len, u32 set);
+
+s32 wldev_ioctl_get(
+       struct net_device *dev, u32 cmd, void *arg, u32 len);
+
+s32 wldev_ioctl_set(
+       struct net_device *dev, u32 cmd, const void *arg, u32 len);
+
+/** Retrieve named IOVARs, this function calls wl_dev_ioctl with
+ *  WLC_GET_VAR IOCTL code
+ */
+s32 wldev_iovar_getbuf(
+       struct net_device *dev, s8 *iovar_name,
+       const void *param, u32 paramlen, void *buf, u32 buflen, struct mutex* buf_sync);
+
+/** Set named IOVARs, this function calls wl_dev_ioctl with
+ *  WLC_SET_VAR IOCTL code
+ */
+s32 wldev_iovar_setbuf(
+       struct net_device *dev, s8 *iovar_name,
+       const void *param, s32 paramlen, void *buf, s32 buflen, struct mutex* buf_sync);
+
+s32 wldev_iovar_setint(
+       struct net_device *dev, s8 *iovar, s32 val);
+
+s32 wldev_iovar_getint(
+       struct net_device *dev, s8 *iovar, s32 *pval);
+
+/** The following function can be implemented if there is a need for bsscfg
+ *  indexed IOVARs
+ */
+
+s32 wldev_mkiovar_bsscfg(
+       const s8 *iovar_name, const s8 *param, s32 paramlen,
+       s8 *iovar_buf, s32 buflen, s32 bssidx);
+
+/** Retrieve named and bsscfg indexed IOVARs, this function calls wl_dev_ioctl with
+ *  WLC_GET_VAR IOCTL code
+ */
+s32 wldev_iovar_getbuf_bsscfg(
+       struct net_device *dev, s8 *iovar_name, void *param, s32 paramlen,
+       void *buf, s32 buflen, s32 bsscfg_idx, struct mutex* buf_sync);
+
+/** Set named and bsscfg indexed IOVARs, this function calls wl_dev_ioctl with
+ *  WLC_SET_VAR IOCTL code
+ */
+s32 wldev_iovar_setbuf_bsscfg(
+       struct net_device *dev, const s8 *iovar_name, const void *param, s32 paramlen,
+       void *buf, s32 buflen, s32 bsscfg_idx, struct mutex* buf_sync);
+
+s32 wldev_iovar_getint_bsscfg(
+       struct net_device *dev, s8 *iovar, s32 *pval, s32 bssidx);
+
+s32 wldev_iovar_setint_bsscfg(
+       struct net_device *dev, s8 *iovar, s32 val, s32 bssidx);
+
+extern int dhd_net_set_fw_path(struct net_device *dev, char *fw);
+extern int dhd_net_bus_suspend(struct net_device *dev);
+extern int dhd_net_bus_resume(struct net_device *dev, uint8 stage);
+extern int dhd_net_wifi_platform_set_power(struct net_device *dev, bool on,
+       unsigned long delay_msec);
+extern void dhd_get_customized_country_code(struct net_device *dev, char *country_iso_code,
+       wl_country_t *cspec);
+extern void dhd_bus_country_set(struct net_device *dev, wl_country_t *cspec, bool notify);
+
+extern bool dhd_force_country_change(struct net_device *dev);
+
+extern void dhd_bus_band_set(struct net_device *dev, uint band);
+extern int wldev_set_country(struct net_device *dev, char *country_code, bool notify,
+       bool user_enforced, int revinfo);
+extern int net_os_wake_lock(struct net_device *dev);
+extern int net_os_wake_unlock(struct net_device *dev);
+extern int net_os_wake_lock_timeout(struct net_device *dev);
+extern int net_os_wake_lock_timeout_enable(struct net_device *dev, int val);
+extern int net_os_set_dtim_skip(struct net_device *dev, int val);
+extern int net_os_set_suspend_disable(struct net_device *dev, int val);
+extern int net_os_set_suspend(struct net_device *dev, int val, int force);
+extern int net_os_set_suspend_bcn_li_dtim(struct net_device *dev, int val);
+extern int net_os_set_max_dtim_enable(struct net_device *dev, int val);
+#ifdef DISABLE_DTIM_IN_SUSPEND
+extern int net_os_set_disable_dtim_in_suspend(struct net_device *dev, int val);
+#endif /* DISABLE_DTIM_IN_SUSPEND */
+
+extern int wl_parse_ssid_list_tlv(char** list_str, wlc_ssid_ext_t* ssid,
+       int max, int *bytes_left);
+
+/* Get the link speed from dongle, speed is in kpbs */
+int wldev_get_link_speed(struct net_device *dev, int *plink_speed);
+
+int wldev_get_rssi(struct net_device *dev, scb_val_t *prssi);
+
+int wldev_get_ssid(struct net_device *dev, wlc_ssid_t *pssid);
+
+int wldev_get_band(struct net_device *dev, uint *pband);
+int wldev_get_mode(struct net_device *dev, uint8 *pband, uint8 caplen);
+int wldev_get_datarate(struct net_device *dev, int *datarate);
+int wldev_set_band(struct net_device *dev, uint band);
+
+#endif /* __WLDEV_COMMON_H__ */
diff --git a/bcmdhd.101.10.240.x/include/wlfc_proto.h b/bcmdhd.101.10.240.x/include/wlfc_proto.h
new file mode 100644 (file)
index 0000000..0296159
--- /dev/null
@@ -0,0 +1,465 @@
+/*
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ *
+ */
+
+/** WL flow control for PROP_TXSTATUS. Related to host AMPDU reordering. */
+
+#ifndef __wlfc_proto_definitions_h__
+#define __wlfc_proto_definitions_h__
+
+       /* Use TLV to convey WLFC information.
+        ---------------------------------------------------------------------------
+       | Type |  Len | value                    | Description
+        ---------------------------------------------------------------------------
+       |  1   |   1  | (handle)                 | MAC OPEN
+        ---------------------------------------------------------------------------
+       |  2   |   1  | (handle)                 | MAC CLOSE
+        ---------------------------------------------------------------------------
+       |  3   |   2  | (count, handle, prec_bmp)| Set the credit depth for a MAC dstn
+        ---------------------------------------------------------------------------
+       |  4   |   4+ | see pkttag comments      | TXSTATUS
+       |      |   12 | TX status & timestamps   | Present only when pkt timestamp is enabled
+        ---------------------------------------------------------------------------
+       |  5   |   4  | see pkttag comments      | PKKTTAG [host->firmware]
+        ---------------------------------------------------------------------------
+       |  6   |   8  | (handle, ifid, MAC)      | MAC ADD
+        ---------------------------------------------------------------------------
+       |  7   |   8  | (handle, ifid, MAC)      | MAC DEL
+        ---------------------------------------------------------------------------
+       |  8   |   1  | (rssi)                   | RSSI - RSSI value for the packet.
+        ---------------------------------------------------------------------------
+       |  9   |   1  | (interface ID)           | Interface OPEN
+        ---------------------------------------------------------------------------
+       |  10  |   1  | (interface ID)           | Interface CLOSE
+        ---------------------------------------------------------------------------
+       |  11  |   8  | fifo credit returns map  | FIFO credits back to the host
+       |      |      |                          |
+       |      |      |                          | --------------------------------------
+       |      |      |                          | | ac0 | ac1 | ac2 | ac3 | bcmc | atim |
+       |      |      |                          | --------------------------------------
+       |      |      |                          |
+        ---------------------------------------------------------------------------
+       |  12  |   2  | MAC handle,              | Host provides a bitmap of pending
+       |      |      | AC[0-3] traffic bitmap   | unicast traffic for MAC-handle dstn.
+       |      |      |                          | [host->firmware]
+        ---------------------------------------------------------------------------
+       |  13  |   3  | (count, handle, prec_bmp)| One time request for packet to a specific
+       |      |      |                          | MAC destination.
+        ---------------------------------------------------------------------------
+       |  15  |  12  | (pkttag, timestamps)     | Send TX timestamp at reception from host
+        ---------------------------------------------------------------------------
+       |  16  |  12  | (pkttag, timestamps)     | Send WLAN RX timestamp along with RX frame
+        ---------------------------------------------------------------------------
+       | 255  |  N/A |  N/A                     | FILLER - This is a special type
+       |      |      |                          | that has no length or value.
+       |      |      |                          | Typically used for padding.
+        ---------------------------------------------------------------------------
+       */
+
+typedef enum {
+       WLFC_CTL_TYPE_MAC_OPEN              = 1,
+       WLFC_CTL_TYPE_MAC_CLOSE             = 2,
+       WLFC_CTL_TYPE_MAC_REQUEST_CREDIT    = 3,
+       WLFC_CTL_TYPE_TXSTATUS              = 4,
+       WLFC_CTL_TYPE_PKTTAG                = 5, /** host<->dongle */
+
+       WLFC_CTL_TYPE_MACDESC_ADD           = 6,
+       WLFC_CTL_TYPE_MACDESC_DEL           = 7,
+       WLFC_CTL_TYPE_RSSI                  = 8,
+
+       WLFC_CTL_TYPE_INTERFACE_OPEN        = 9,
+       WLFC_CTL_TYPE_INTERFACE_CLOSE       = 10,
+
+       WLFC_CTL_TYPE_FIFO_CREDITBACK       = 11,
+
+       WLFC_CTL_TYPE_PENDING_TRAFFIC_BMP   = 12, /** host->dongle */
+       WLFC_CTL_TYPE_MAC_REQUEST_PACKET    = 13,
+       WLFC_CTL_TYPE_HOST_REORDER_RXPKTS   = 14,
+
+       WLFC_CTL_TYPE_TX_ENTRY_STAMP        = 15,
+       WLFC_CTL_TYPE_RX_STAMP              = 16,
+
+       WLFC_CTL_TYPE_UPD_FLR_FETCH         = 17, /* PCIE_FLOWCTL: Update Flowring Fetch */
+
+       WLFC_CTL_TYPE_TRANS_ID              = 18,
+       WLFC_CTL_TYPE_COMP_TXSTATUS         = 19,
+
+       WLFC_CTL_TYPE_TID_OPEN              = 20,
+       WLFC_CTL_TYPE_TID_CLOSE             = 21,
+       WLFC_CTL_TYPE_UPD_FLR_WEIGHT        = 22, /* WLATF_DONGLE */
+       WLFC_CTL_TYPE_ENAB_FFSCH            = 23, /* WLATF_DONGLE */
+
+       WLFC_CTL_TYPE_UPDATE_FLAGS          = 24, /* clear the flags set in flowring */
+       WLFC_CTL_TYPE_CLEAR_SUPPR           = 25, /* free the supression info in the flowring */
+
+       WLFC_CTL_TYPE_FLOWID_OPEN           = 26,
+       WLFC_CTL_TYPE_FLOWID_CLOSE          = 27,
+
+       WLFC_CTL_TYPE_PENDING_TX_PKTS       = 28, /* Get the outstandinding packets in host
+                                                  * flowring for the given interface.
+                                                  */
+       WLFC_CTL_TYPE_UPD_SCB_RATESEL_CHANGE= 29, /* Update flow's max rate dynamically */
+       WLFC_CTL_TYPE_AMSDU_STATE           = 30, /* Update flow's AMSDU state (Enabled/Disabled) */
+       WLFC_CTL_TYPE_FILLER                = 255
+} wlfc_ctl_type_t;
+
+#define WLFC_CTL_VALUE_LEN_FLOWID              2
+
+#define WLFC_CTL_VALUE_LEN_MACDESC             8       /** handle, interface, MAC */
+
+#define WLFC_CTL_VALUE_LEN_MAC                 1       /** MAC-handle */
+#define WLFC_CTL_VALUE_LEN_RSSI                        1
+
+#define WLFC_CTL_VALUE_LEN_INTERFACE           1
+#define WLFC_CTL_VALUE_LEN_PENDING_TRAFFIC_BMP 2
+
+#define WLFC_CTL_VALUE_LEN_TXSTATUS            4
+#define WLFC_CTL_VALUE_LEN_PKTTAG              4
+#define WLFC_CTL_VALUE_LEN_TIMESTAMP           12      /** 4-byte rate info + 2 TSF */
+
+#define WLFC_CTL_VALUE_LEN_SEQ                 2
+#define WLFC_CTL_VALUE_LEN_TID                 2       /* interface index, TID */
+
+/* Reset the flags set for the corresponding flowring of the SCB which is de-inited */
+/* FLOW_RING_FLAG_LAST_TIM | FLOW_RING_FLAG_INFORM_PKTPEND | FLOW_RING_FLAG_PKT_REQ */
+#define WLFC_RESET_ALL_FLAGS                   0
+#define WLFC_CTL_VALUE_LEN_FLAGS               7       /** flags, MAC */
+
+/* free the data stored to be used for suppressed packets in future */
+#define WLFC_CTL_VALUE_LEN_SUPR                        8       /** ifindex, tid, MAC */
+
+#define WLFC_CTL_VALUE_LEN_SCB_RATESEL_CHANGE          7       /* ifindex, MAC */
+/* enough space to host all 4 ACs, bc/mc and atim fifo credit */
+#define WLFC_CTL_VALUE_LEN_FIFO_CREDITBACK     6
+
+#define WLFC_CTL_VALUE_LEN_REQUEST_CREDIT      3       /* credit, MAC-handle, prec_bitmap */
+#define WLFC_CTL_VALUE_LEN_REQUEST_PACKET      3       /* credit, MAC-handle, prec_bitmap */
+
+/*
+       WLFC packet identifier: b[31:0] (WLFC_CTL_TYPE_PKTTAG)
+
+       Generation      : b[31]         => generation number for this packet [host->fw]
+                                  OR, current generation number [fw->host]
+       Flags           : b[30:27]      => command, status flags
+       FIFO-AC         : b[26:24]      => AC-FIFO id
+
+       h-slot          : b[23:8]       => hanger-slot
+       freerun         : b[7:0]        => A free running counter?
+
+       As far as the firmware is concerned, host generated b[23:0] should be just
+       reflected back on txstatus.
+*/
+
+#ifndef WLFC_PKTFLAG_COMPAT
+#define WLFC_PKTFLAG_PKTFROMHOST       0x01
+#define WLFC_PKTFLAG_PKT_REQUESTED     0x02
+#define WLFC_PKTFLAG_PKT_SENDTOHOST    0x04
+#define WLFC_PKTFLAG_PKT_FLUSHED       0x08
+#else
+#define WLFC_PKTFLAG_PKTFROMHOST_MASK          0x01
+#define WLFC_PKTFLAG_PKT_REQUESTED_MASK                0x02
+#define WLFC_PKTFLAG_PKT_SENDTOHOST_MASK       0x04
+#define WLFC_PKTFLAG_PKT_FLUSHED_MASK          0x08
+#endif /* WLFC_PKTFLAG_COMPAT */
+
+#define WL_TXSTATUS_STATUS_MASK                        0xff /* allow 8 bits */
+#define WL_TXSTATUS_STATUS_SHIFT               24
+
+#define WL_TXSTATUS_SET_STATUS(x, status)      ((x)  = \
+       ((x) & ~(WL_TXSTATUS_STATUS_MASK << WL_TXSTATUS_STATUS_SHIFT)) | \
+       (((status) & WL_TXSTATUS_STATUS_MASK) << WL_TXSTATUS_STATUS_SHIFT))
+#define WL_TXSTATUS_GET_STATUS(x)      (((x) >> WL_TXSTATUS_STATUS_SHIFT) & \
+       WL_TXSTATUS_STATUS_MASK)
+
+/**
+ * Bit 31 of the 32-bit packet tag is defined as 'generation ID'. It is set by the host to the
+ * "current" generation, and by the firmware to the "expected" generation, toggling on suppress. The
+ * firmware accepts a packet when the generation matches; on reset (startup) both "current" and
+ * "expected" are set to 0.
+ */
+#define WL_TXSTATUS_GENERATION_MASK            1 /* allow 1 bit */
+#define WL_TXSTATUS_GENERATION_SHIFT           31
+
+#define WL_TXSTATUS_SET_GENERATION(x, gen)     ((x) = \
+       ((x) & ~(WL_TXSTATUS_GENERATION_MASK << WL_TXSTATUS_GENERATION_SHIFT)) | \
+       (((gen) & WL_TXSTATUS_GENERATION_MASK) << WL_TXSTATUS_GENERATION_SHIFT))
+
+#define WL_TXSTATUS_GET_GENERATION(x)  (((x) >> WL_TXSTATUS_GENERATION_SHIFT) & \
+       WL_TXSTATUS_GENERATION_MASK)
+
+#define WL_TXSTATUS_FLAGS_MASK                 0xf /* allow 4 bits only */
+#define WL_TXSTATUS_FLAGS_SHIFT                        27
+
+#define WL_TXSTATUS_SET_FLAGS(x, flags)        ((x)  = \
+       ((x) & ~(WL_TXSTATUS_FLAGS_MASK << WL_TXSTATUS_FLAGS_SHIFT)) | \
+       (((flags) & WL_TXSTATUS_FLAGS_MASK) << WL_TXSTATUS_FLAGS_SHIFT))
+#define WL_TXSTATUS_GET_FLAGS(x)               (((x) >> WL_TXSTATUS_FLAGS_SHIFT) & \
+       WL_TXSTATUS_FLAGS_MASK)
+#define WL_TXSTATUS_CLEAR_FLAGS(x, flags)      ((x)  = \
+       ((x) & ~(((flags) & WL_TXSTATUS_FLAGS_MASK) << WL_TXSTATUS_FLAGS_SHIFT)))
+
+#define WL_TXSTATUS_FIFO_MASK                  0x7 /* allow 3 bits for FIFO ID */
+#define WL_TXSTATUS_FIFO_SHIFT                 24
+
+#define WL_TXSTATUS_SET_FIFO(x, flags) ((x)  = \
+       ((x) & ~(WL_TXSTATUS_FIFO_MASK << WL_TXSTATUS_FIFO_SHIFT)) | \
+       (((flags) & WL_TXSTATUS_FIFO_MASK) << WL_TXSTATUS_FIFO_SHIFT))
+#define WL_TXSTATUS_GET_FIFO(x)                (((x) >> WL_TXSTATUS_FIFO_SHIFT) & WL_TXSTATUS_FIFO_MASK)
+
+#define WL_TXSTATUS_PKTID_MASK                 0xffffff /* allow 24 bits */
+#define WL_TXSTATUS_SET_PKTID(x, num)  ((x) = \
+       ((x) & ~WL_TXSTATUS_PKTID_MASK) | (num))
+#define WL_TXSTATUS_GET_PKTID(x)               ((x) & WL_TXSTATUS_PKTID_MASK)
+
+#define WL_TXSTATUS_HSLOT_MASK                 0xffff /* allow 16 bits */
+#define WL_TXSTATUS_HSLOT_SHIFT                        8
+
+#define WL_TXSTATUS_SET_HSLOT(x, hslot)        ((x)  = \
+       ((x) & ~(WL_TXSTATUS_HSLOT_MASK << WL_TXSTATUS_HSLOT_SHIFT)) | \
+       (((hslot) & WL_TXSTATUS_HSLOT_MASK) << WL_TXSTATUS_HSLOT_SHIFT))
+#define WL_TXSTATUS_GET_HSLOT(x)       (((x) >> WL_TXSTATUS_HSLOT_SHIFT)& \
+       WL_TXSTATUS_HSLOT_MASK)
+
+#define WL_TXSTATUS_FREERUNCTR_MASK            0xff /* allow 8 bits */
+
+#define WL_TXSTATUS_SET_FREERUNCTR(x, ctr)     ((x)  = \
+       ((x) & ~(WL_TXSTATUS_FREERUNCTR_MASK)) | \
+       ((ctr) & WL_TXSTATUS_FREERUNCTR_MASK))
+#define WL_TXSTATUS_GET_FREERUNCTR(x)          ((x)& WL_TXSTATUS_FREERUNCTR_MASK)
+
+/* AMSDU part of d11 seq number */
+#define WL_SEQ_AMSDU_MASK             0x1 /* allow 1 bit */
+#define WL_SEQ_AMSDU_SHIFT            14
+#define WL_SEQ_SET_AMSDU(x, val)      ((x) = \
+       ((x) & ~(WL_SEQ_AMSDU_MASK << WL_SEQ_AMSDU_SHIFT)) | \
+       (((val) & WL_SEQ_AMSDU_MASK) << WL_SEQ_AMSDU_SHIFT)) /**< sets a single AMSDU bit */
+/** returns TRUE if ring item is AMSDU (seq = d11 seq nr) */
+#define WL_SEQ_IS_AMSDU(x)   (((x) >> WL_SEQ_AMSDU_SHIFT) & \
+       WL_SEQ_AMSDU_MASK)
+
+/* indicates last_suppr_seq is valid */
+#define WL_SEQ_VALIDSUPPR_MASK         0x1 /* allow 1 bit */
+#define WL_SEQ_VALIDSUPPR_SHIFT                12
+#define WL_SEQ_SET_VALIDSUPPR(x, val)  ((x) = \
+       ((x) & ~(WL_SEQ_VALIDSUPPR_MASK << WL_SEQ_VALIDSUPPR_SHIFT)) | \
+       (((val) & WL_SEQ_VALIDSUPPR_MASK) << WL_SEQ_VALIDSUPPR_SHIFT))
+#define WL_SEQ_GET_VALIDSUPPR(x)       (((x) >> WL_SEQ_VALIDSUPPR_SHIFT) & \
+       WL_SEQ_VALIDSUPPR_MASK)
+
+#define WL_SEQ_FROMFW_MASK             0x1 /* allow 1 bit */
+#define WL_SEQ_FROMFW_SHIFT            13
+#define WL_SEQ_SET_FROMFW(x, val)      ((x) = \
+       ((x) & ~(WL_SEQ_FROMFW_MASK << WL_SEQ_FROMFW_SHIFT)) | \
+       (((val) & WL_SEQ_FROMFW_MASK) << WL_SEQ_FROMFW_SHIFT))
+/** Set when firmware assigns D11 sequence number to packet */
+#define SET_WL_HAS_ASSIGNED_SEQ(x)     WL_SEQ_SET_FROMFW((x), 1)
+
+/** returns TRUE if packet has been assigned a d11 seq number by the WL firmware layer */
+#define GET_WL_HAS_ASSIGNED_SEQ(x)     (((x) >> WL_SEQ_FROMFW_SHIFT) & WL_SEQ_FROMFW_MASK)
+
+#ifdef WLFC_PKTFLAG_COMPAT
+/* Helper macros for WLFC pktflags */
+#define WLFC_PKTFLAG_PKTFROMHOST(p) \
+       (WL_TXSTATUS_GET_FLAGS(WLPKTTAG(p)->wl_hdr_information) & WLFC_PKTFLAG_PKTFROMHOST_MASK)
+#define WLFC_PKTFLAG_PKT_REQUESTED(p) \
+       (WL_TXSTATUS_GET_FLAGS(WLPKTTAG(p)->wl_hdr_information) & WLFC_PKTFLAG_PKT_REQUESTED_MASK)
+#define WLFC_PKTFLAG_PKT_SENDTOHOST(p) \
+       (WL_TXSTATUS_GET_FLAGS(WLPKTTAG(p)->wl_hdr_information) & WLFC_PKTFLAG_PKT_SENDTOHOST_MASK)
+#define WLFC_PKTFLAG_PKT_FLUSHED(p) \
+       (WL_TXSTATUS_GET_FLAGS(WLPKTTAG(p)->wl_hdr_information) & WLFC_PKTFLAG_PKT_FLUSHED_MASK)
+#endif /* WLFC_PKTFLAG_COMPAT */
+
+/**
+ * Proptxstatus related.
+ *
+ * When a packet is suppressed by WL or the D11 core, the packet has to be retried. Assigning
+ * a new d11 sequence number for the packet when retrying would cause the peer to be unable to
+ * reorder the packets within an AMPDU. So, suppressed packet from bus layer (DHD for SDIO and
+ * pciedev for PCIE) is re-using d11 seq number, so FW should not assign a new one.
+ */
+#define WL_SEQ_FROMDRV_MASK            0x1 /* allow 1 bit */
+#define WL_SEQ_FROMDRV_SHIFT           12
+
+/**
+ * Proptxstatus, host or fw PCIe layer requests WL layer to reuse d11 seq no. Bit is reset by WL
+ * subsystem when it reuses the seq number.
+ */
+#define WL_SEQ_SET_REUSE(x, val)       ((x) = \
+       ((x) & ~(WL_SEQ_FROMDRV_MASK << WL_SEQ_FROMDRV_SHIFT)) | \
+       (((val) & WL_SEQ_FROMDRV_MASK) << WL_SEQ_FROMDRV_SHIFT))
+#define SET_WL_TO_REUSE_SEQ(x)   WL_SEQ_SET_REUSE((x), 1)
+#define RESET_WL_TO_REUSE_SEQ(x) WL_SEQ_SET_REUSE((x), 0)
+
+/** Proptxstatus, related to reuse of d11 seq numbers when retransmitting */
+#define IS_WL_TO_REUSE_SEQ(x)  (((x) >> WL_SEQ_FROMDRV_SHIFT) & \
+       WL_SEQ_FROMDRV_MASK)
+
+#define WL_SEQ_NUM_MASK                        0xfff /* allow 12 bit */
+#define WL_SEQ_NUM_SHIFT               0
+/** Proptxstatus, sets d11seq no in pkt tag, related to reuse of d11seq no when retransmitting */
+#define WL_SEQ_SET_NUM(x, val) ((x) = \
+       ((x) & ~(WL_SEQ_NUM_MASK << WL_SEQ_NUM_SHIFT)) | \
+       (((val) & WL_SEQ_NUM_MASK) << WL_SEQ_NUM_SHIFT))
+/** Proptxstatus, gets d11seq no from pkt tag, related to reuse of d11seq no when retransmitting */
+#define WL_SEQ_GET_NUM(x)      (((x) >> WL_SEQ_NUM_SHIFT) & \
+       WL_SEQ_NUM_MASK)
+
+#define WL_SEQ_AMSDU_SUPPR_MASK        ((WL_SEQ_FROMDRV_MASK << WL_SEQ_FROMDRV_SHIFT) | \
+                               (WL_SEQ_AMSDU_MASK << WL_SEQ_AMSDU_SHIFT) | \
+                               (WL_SEQ_NUM_MASK << WL_SEQ_NUM_SHIFT))
+
+/* 32 STA should be enough??, 6 bits; Must be power of 2 */
+#define WLFC_MAC_DESC_TABLE_SIZE       32
+#define WLFC_MAX_IFNUM                         16
+#define WLFC_MAC_DESC_ID_INVALID       0xff
+
+/* b[7:5] -reuse guard, b[4:0] -value */
+#define WLFC_MAC_DESC_GET_LOOKUP_INDEX(x) ((x) & 0x1f)
+
+#define WLFC_PKTFLAG_SET_PKTREQUESTED(x)       (x) |= \
+       (WLFC_PKTFLAG_PKT_REQUESTED << WL_TXSTATUS_FLAGS_SHIFT)
+
+#define WLFC_PKTFLAG_CLR_PKTREQUESTED(x)       (x) &= \
+       ~(WLFC_PKTFLAG_PKT_REQUESTED << WL_TXSTATUS_FLAGS_SHIFT)
+
+#define WLFC_MAX_PENDING_DATALEN       120
+
+/* host is free to discard the packet */
+#define WLFC_CTL_PKTFLAG_DISCARD       0
+/* D11 suppressed a packet */
+#define WLFC_CTL_PKTFLAG_D11SUPPRESS   1
+/* WL firmware suppressed a packet because MAC is
+       already in PSMode (short time window)
+*/
+#define WLFC_CTL_PKTFLAG_WLSUPPRESS    2
+/* Firmware tossed this packet */
+#define WLFC_CTL_PKTFLAG_TOSSED_BYWLC  3
+/* Firmware tossed after retries */
+#define WLFC_CTL_PKTFLAG_DISCARD_NOACK 4
+/* Firmware wrongly reported suppressed previously,now fixing to acked */
+#define WLFC_CTL_PKTFLAG_SUPPRESS_ACKED        5
+/* Firmware send this packet expired, lifetime expiration */
+#define WLFC_CTL_PKTFLAG_EXPIRED       6
+/* Firmware drop this packet for any other reason  */
+#define WLFC_CTL_PKTFLAG_DROPPED       7
+/* Firmware free this packet  */
+#define WLFC_CTL_PKTFLAG_MKTFREE       8
+/* Firmware dropped the frame after suppress retries reached max */
+#define WLFC_CTL_PKTFLAG_MAX_SUP_RETR   9
+
+/* Firmware forced packet lifetime expiry */
+#define WLFC_CTL_PKTFLAG_FORCED_EXPIRED        10
+
+#define WLFC_CTL_PKTFLAG_MASK          (0x0f)  /* For 4-bit mask with one extra bit */
+
+#if defined(PROP_TXSTATUS_DEBUG) && !defined(BINCMP)
+#define WLFC_DBGMESG(x) printf x
+/* wlfc-breadcrumb */
+#define WLFC_BREADCRUMB(x) do {if ((x) == NULL) \
+       {printf("WLFC :%d:caller:%p\n", \
+       __LINE__, CALL_SITE);}} while (0)
+#define WLFC_WHEREIS(s) printf("WLFC: at %d, %s\n", __LINE__, (s))
+#else
+#define WLFC_DBGMESG(x)
+#define WLFC_BREADCRUMB(x)
+#define WLFC_WHEREIS(s)
+#endif /* PROP_TXSTATUS_DEBUG && !BINCMP */
+
+/* AMPDU host reorder packet flags */
+#define WLHOST_REORDERDATA_MAXFLOWS            256
+#define WLHOST_REORDERDATA_LEN          10
+#define WLHOST_REORDERDATA_TOTLEN      (WLHOST_REORDERDATA_LEN + 1 + 1) /* +tag +len */
+
+#define WLHOST_REORDERDATA_FLOWID_OFFSET               0
+#define WLHOST_REORDERDATA_MAXIDX_OFFSET               2
+#define WLHOST_REORDERDATA_FLAGS_OFFSET                        4
+#define WLHOST_REORDERDATA_CURIDX_OFFSET               6
+#define WLHOST_REORDERDATA_EXPIDX_OFFSET               8
+
+#define WLHOST_REORDERDATA_DEL_FLOW            0x01
+#define WLHOST_REORDERDATA_FLUSH_ALL           0x02
+#define WLHOST_REORDERDATA_CURIDX_VALID                0x04
+#define WLHOST_REORDERDATA_EXPIDX_VALID                0x08
+#define WLHOST_REORDERDATA_NEW_HOLE            0x10
+
+/* transaction id data len byte 0: rsvd, byte 1: seqnumber, byte 2-5 will be used for timestampe */
+#define WLFC_CTL_TRANS_ID_LEN                  6
+#define WLFC_TYPE_TRANS_ID_LEN                 6
+
+#define WLFC_MODE_HANGER       1 /* use hanger */
+#define WLFC_MODE_AFQ          2 /* use afq (At Firmware Queue) */
+#define WLFC_IS_OLD_DEF(x) ((x & 1) || (x & 2))
+
+#define WLFC_MODE_AFQ_SHIFT            2       /* afq bit */
+#define WLFC_SET_AFQ(x, val)   ((x) = \
+       ((x) & ~(1 << WLFC_MODE_AFQ_SHIFT)) | \
+       (((val) & 1) << WLFC_MODE_AFQ_SHIFT))
+/** returns TRUE if firmware supports 'at firmware queue' feature */
+#define WLFC_GET_AFQ(x)        (((x) >> WLFC_MODE_AFQ_SHIFT) & 1)
+
+#define WLFC_MODE_REUSESEQ_SHIFT       3       /* seq reuse bit */
+#define WLFC_SET_REUSESEQ(x, val)      ((x) = \
+       ((x) & ~(1 << WLFC_MODE_REUSESEQ_SHIFT)) | \
+       (((val) & 1) << WLFC_MODE_REUSESEQ_SHIFT))
+
+/** returns TRUE if 'd11 sequence reuse' has been agreed upon between host and dongle */
+#if defined(BCMPCIEDEV_ENABLED) && !defined(ROM_ENAB_RUNTIME_CHECK)
+/* GET_REUSESEQ is always TRUE in pciedev */
+#define WLFC_GET_REUSESEQ(x)   (TRUE)
+#else
+#define WLFC_GET_REUSESEQ(x)   (((x) >> WLFC_MODE_REUSESEQ_SHIFT) & 1)
+#endif /* defined(BCMPCIEDEV_ENABLED) && !defined(ROM_ENAB_RUNTIME_CHECK) */
+
+#define WLFC_MODE_REORDERSUPP_SHIFT    4       /* host reorder suppress pkt bit */
+#define WLFC_SET_REORDERSUPP(x, val)   ((x) = \
+       ((x) & ~(1 << WLFC_MODE_REORDERSUPP_SHIFT)) | \
+       (((val) & 1) << WLFC_MODE_REORDERSUPP_SHIFT))
+/** returns TRUE if 'reorder suppress' has been agreed upon between host and dongle */
+#define WLFC_GET_REORDERSUPP(x)        (((x) >> WLFC_MODE_REORDERSUPP_SHIFT) & 1)
+
+#define FLOW_RING_CREATE             1u
+#define FLOW_RING_DELETE             2u
+#define FLOW_RING_FLUSH              3u
+#define FLOW_RING_OPEN               4u
+#define FLOW_RING_CLOSED             5u
+#define FLOW_RING_FLUSHED            6u
+#define FLOW_RING_TIM_SET            7u
+#define FLOW_RING_TIM_RESET          8u
+#define FLOW_RING_FLUSH_TXFIFO       9u
+#define FLOW_RING_GET_PKT_MAX        10u
+#define FLOW_RING_RESET_WEIGHT       11u
+#define FLOW_RING_UPD_PRIOMAP        12u
+#define FLOW_RING_HP2P_CREATE        13u
+#define FLOW_RING_HP2P_DELETE        14u
+#define FLOW_RING_GET_BUFFERED_TIME  15u
+#define FLOW_RING_HP2P_TXQ_STRT      16u
+#define FLOW_RING_HP2P_TXQ_STOP      17u
+
+/* bit 7, indicating if is TID(1) or AC(0) mapped info in tid field) */
+#define PCIEDEV_IS_AC_TID_MAP_MASK     0x80
+
+#define WLFC_PCIEDEV_AC_PRIO_MAP        0
+#define WLFC_PCIEDEV_TID_PRIO_MAP     1
+#define WLFC_PCIEDEV_LLR_PRIO_MAP      2
+
+void wlc_wlfc_set_pkttime(void* pkt, uint16 time);
+
+#endif /* __wlfc_proto_definitions_h__ */
diff --git a/bcmdhd.101.10.240.x/include/wlioctl.h b/bcmdhd.101.10.240.x/include/wlioctl.h
new file mode 100644 (file)
index 0000000..9f5f5f0
--- /dev/null
@@ -0,0 +1,22856 @@
+/*
+ * Custom OID/ioctl definitions for
+ *
+ *
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _wlioctl_h_
+#define        _wlioctl_h_
+
+#include <typedefs.h>
+#include <ethernet.h>
+#include <bcmip.h>
+#include <bcmeth.h>
+#include <bcmip.h>
+#include <bcmipv6.h>
+#include <bcmevent.h>
+#include <802.11.h>
+#include <802.11s.h>
+#include <802.1d.h>
+#include <bcmwifi_channels.h>
+#ifdef WL11AX
+#include <802.11ax.h>
+#endif /* WL11AX */
+#include <bcmwifi_rates.h>
+#include <wlioctl_defs.h>
+#include <bcmipv6.h>
+
+#include <bcm_mpool_pub.h>
+#include <bcmcdc.h>
+#define SSSR_NEW_API
+
+/* Include bcmerror.h for error codes or aliases */
+#ifdef BCMUTILS_ERR_CODES
+#include <bcmerror.h>
+#endif /* BCMUTILS_ERR_CODES */
+#include <bcmtlv.h>
+
+/* NOTE re: Module specific error codes.
+ *
+ * BCME_.. error codes are extended by various features - e.g. FTM, NAN, SAE etc.
+ * The current process is to allocate a range of 1024 negative 32 bit integers to
+ * each module that extends the error codes to indicate a module specific status.
+ *
+ * The next range to use is below. If that range is used for a new feature, please
+ * update the range to be used by the next feature.
+ *
+ * The error codes -4096 ... -5119 are reserved for firmware signing.
+ *
+ * Next available (inclusive) range: [-8*1024 + 1, -7*1024]
+ *
+ * End Note
+ */
+
+/* 11ax trigger frame format - versioning info */
+#define TRIG_FRAME_FORMAT_11AX_DRAFT_1P1 0
+
+typedef struct {
+       uint32 num;
+       chanspec_t list[1];
+} chanspec_list_t;
+
+#define RSN_KCK_LENGTH 16
+#define RSN_KEK_LENGTH 16
+#define TPK_FTM_LEN            16
+#ifndef INTF_NAME_SIZ
+#define INTF_NAME_SIZ  16
+#endif
+
+#define WL_ASSOC_START_EVT_DATA_VERSION      1
+
+typedef struct assoc_event_data {
+       uint32 version;
+       uint32 flags;
+       chanspec_t join_chspec;
+} assoc_event_data_t;
+
+/**Used to send ioctls over the transport pipe */
+typedef struct remote_ioctl {
+       cdc_ioctl_t     msg;
+       uint32          data_len;
+       char           intf_name[INTF_NAME_SIZ];
+} rem_ioctl_t;
+#define REMOTE_SIZE    sizeof(rem_ioctl_t)
+
+#define BCM_IOV_XTLV_VERSION 0
+
+#define MAX_NUM_D11CORES 2
+
+/**DFS Forced param */
+typedef struct wl_dfs_forced_params {
+       chanspec_t chspec;
+       uint16 version;
+       chanspec_list_t chspec_list;
+} wl_dfs_forced_t;
+
+#define DFS_PREFCHANLIST_VER 0x01
+#define WL_CHSPEC_LIST_FIXED_SIZE      OFFSETOF(chanspec_list_t, list)
+/* size of dfs forced param size given n channels are in the list */
+#define WL_DFS_FORCED_PARAMS_SIZE(n) \
+       (sizeof(wl_dfs_forced_t) + (((n) < 1) ? (0) : (((n) - 1)* sizeof(chanspec_t))))
+#define WL_DFS_FORCED_PARAMS_FIXED_SIZE \
+       (WL_CHSPEC_LIST_FIXED_SIZE + OFFSETOF(wl_dfs_forced_t, chspec_list))
+#define WL_DFS_FORCED_PARAMS_MAX_SIZE \
+       WL_DFS_FORCED_PARAMS_FIXED_SIZE + (WL_NUMCHANNELS * sizeof(chanspec_t))
+
+/**association decision information */
+typedef struct {
+       uint8           assoc_approved;         /**< (re)association approved */
+       uint8           pad;
+       uint16          reject_reason;          /**< reason code for rejecting association */
+       struct          ether_addr   da;
+       uint8           pad1[6];
+       int64           sys_time;               /**< current system time */
+} assoc_decision_t;
+
+#define DFS_SCAN_S_IDLE                -1
+#define DFS_SCAN_S_RADAR_FREE 0
+#define DFS_SCAN_S_RADAR_FOUND 1
+#define DFS_SCAN_S_INPROGESS 2
+#define DFS_SCAN_S_SCAN_ABORTED 3
+#define DFS_SCAN_S_SCAN_MODESW_INPROGRESS 4
+#define DFS_SCAN_S_MAX 5
+
+#define ACTION_FRAME_SIZE 1800
+
+typedef struct wl_action_frame {
+       struct ether_addr       da;
+       uint16                  len;
+       uint32                  packetId;
+       uint8                   data[ACTION_FRAME_SIZE];
+} wl_action_frame_t;
+
+#define WL_WIFI_ACTION_FRAME_SIZE sizeof(struct wl_action_frame)
+
+typedef struct ssid_info
+{
+       uint8           ssid_len;       /**< the length of SSID */
+       uint8           ssid[32];       /**< SSID string */
+} ssid_info_t;
+
+typedef struct wl_af_params {
+       uint32                  channel;
+       int32                   dwell_time;
+       struct ether_addr       BSSID;
+       uint8 PAD[2];
+       wl_action_frame_t       action_frame;
+} wl_af_params_t;
+
+#define WL_WIFI_AF_PARAMS_SIZE sizeof(struct wl_af_params)
+
+#define MFP_TEST_FLAG_NORMAL   0
+#define MFP_TEST_FLAG_ANY_KEY  1
+typedef struct wl_sa_query {
+       uint32 flag;
+       uint8  action;
+       uint8  PAD;
+       uint16 id;
+       struct ether_addr da;
+       uint16  PAD;
+} wl_sa_query_t;
+
+/* EXT_STA */
+/**association information */
+typedef struct {
+       uint32          assoc_req;      /**< offset to association request frame */
+       uint32          assoc_req_len;  /**< association request frame length */
+       uint32          assoc_rsp;      /**< offset to association response frame */
+       uint32          assoc_rsp_len;  /**< association response frame length */
+       uint32          bcn;            /**< offset to AP beacon */
+       uint32          bcn_len;        /**< AP beacon length */
+       uint32          wsec;           /**< ucast security algo */
+       uint32          wpaie;          /**< offset to WPA ie */
+       uint8           auth_alg;       /**< 802.11 authentication mode */
+       uint8           WPA_auth;       /**< WPA: authenticated key management */
+       uint8           ewc_cap;        /**< EWC (MIMO) capable */
+       uint8           ofdm;           /**< OFDM */
+} assoc_info_t;
+/* defined(EXT_STA) */
+
+/* Flags for OBSS IOVAR Parameters */
+#define WL_OBSS_DYN_BWSW_FLAG_ACTIVITY_PERIOD        (0x01)
+#define WL_OBSS_DYN_BWSW_FLAG_NOACTIVITY_PERIOD      (0x02)
+#define WL_OBSS_DYN_BWSW_FLAG_NOACTIVITY_INCR_PERIOD (0x04)
+#define WL_OBSS_DYN_BWSW_FLAG_PSEUDO_SENSE_PERIOD    (0x08)
+#define WL_OBSS_DYN_BWSW_FLAG_RX_CRS_PERIOD          (0x10)
+#define WL_OBSS_DYN_BWSW_FLAG_DUR_THRESHOLD          (0x20)
+#define WL_OBSS_DYN_BWSW_FLAG_TXOP_PERIOD            (0x40)
+
+/* OBSS IOVAR Version information */
+#define WL_PROT_OBSS_CONFIG_PARAMS_VERSION 1
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint8 obss_bwsw_activity_cfm_count_cfg; /**< configurable count in
+               * seconds before we confirm that OBSS is present and
+               * dynamically activate dynamic bwswitch.
+               */
+       uint8 obss_bwsw_no_activity_cfm_count_cfg; /**< configurable count in
+               * seconds before we confirm that OBSS is GONE and
+               * dynamically start pseudo upgrade. If in pseudo sense time, we
+               * will see OBSS, [means that, we false detected that OBSS-is-gone
+               * in watchdog] this count will be incremented in steps of
+               * obss_bwsw_no_activity_cfm_count_incr_cfg for confirming OBSS
+               * detection again. Note that, at present, max 30seconds is
+               * allowed like this. [OBSS_BWSW_NO_ACTIVITY_MAX_INCR_DEFAULT]
+               */
+       uint8 obss_bwsw_no_activity_cfm_count_incr_cfg; /* see above
+               */
+       uint16 obss_bwsw_pseudo_sense_count_cfg; /**< number of msecs/cnt to be in
+               * pseudo state. This is used to sense/measure the stats from lq.
+               */
+       uint8 obss_bwsw_rx_crs_threshold_cfg; /**< RX CRS default threshold */
+       uint8 obss_bwsw_dur_thres; /**< OBSS dyn bwsw trigger/RX CRS Sec */
+       uint8 obss_bwsw_txop_threshold_cfg; /**< TXOP default threshold */
+} BWL_POST_PACKED_STRUCT wlc_obss_dynbwsw_config_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 version; /**< version field */
+       uint32 config_mask;
+       uint32 reset_mask;
+       wlc_obss_dynbwsw_config_t config_params;
+} BWL_POST_PACKED_STRUCT obss_config_params_t;
+#include <packed_section_end.h>
+
+/**bsscfg type */
+typedef enum bsscfg_type {
+       BSSCFG_TYPE_GENERIC = 0,        /**< Generic AP/STA/IBSS BSS */
+       BSSCFG_TYPE_P2P = 1,            /**< P2P BSS */
+       /* index 2 earlier used for BTAMP */
+       BSSCFG_TYPE_PSTA = 3,
+       BSSCFG_TYPE_TDLS = 4,
+       BSSCFG_TYPE_SLOTTED_BSS = 5,
+       BSSCFG_TYPE_PROXD = 6,
+       BSSCFG_TYPE_NAN = 7,
+       BSSCFG_TYPE_MESH = 8,
+       BSSCFG_TYPE_AIBSS = 9
+} bsscfg_type_t;
+
+/* bsscfg subtype */
+typedef enum bsscfg_subtype {
+       BSSCFG_SUBTYPE_NONE = 0,
+       BSSCFG_GENERIC_STA = 1,         /* GENERIC */
+       BSSCFG_GENERIC_AP = 2,
+       BSSCFG_GENERIC_IBSS = 6,
+       BSSCFG_P2P_GC = 3,              /* P2P */
+       BSSCFG_P2P_GO = 4,
+       BSSCFG_P2P_DISC = 5,
+       /* Index 7 & 8 earlier used for BTAMP */
+       BSSCFG_SUBTYPE_AWDL = 9, /* SLOTTED_BSS_TYPE */
+       BSSCFG_SUBTYPE_NAN_MGMT = 10,
+       BSSCFG_SUBTYPE_NAN_DATA = 11,
+       BSSCFG_SUBTYPE_NAN_MGMT_DATA = 12
+} bsscfg_subtype_t;
+
+typedef struct wlc_bsscfg_info {
+       uint32 type;
+       uint32 subtype;
+} wlc_bsscfg_info_t;
+
+/* ULP SHM Offsets info */
+typedef struct ulp_shm_info {
+       uint32 m_ulp_ctrl_sdio;
+       uint32 m_ulp_wakeevt_ind;
+       uint32 m_ulp_wakeind;
+} ulp_shm_info_t;
+
+/* Note: Due to unpredictable size, bool type should not be used in any ioctl argument structure
+ * Cf PR53622
+ */
+
+#define        WL_BSS_INFO_VERSION     109             /**< current version of wl_bss_info struct */
+
+/**
+ * BSS info structure
+ * Applications MUST CHECK ie_offset field and length field to access IEs and
+ * next bss_info structure in a vector (in wl_scan_results_t)
+ */
+typedef struct wl_bss_info {
+       uint32          version;                /**< version field */
+       uint32          length;                 /**< byte length of data in this record,
+                                                * starting at version and including IEs
+                                                */
+       struct ether_addr BSSID;
+       uint16          beacon_period;          /**< units are Kusec */
+       uint16          capability;             /**< Capability information */
+       uint8           SSID_len;
+       uint8           SSID[32];
+       uint8           bcnflags;               /* additional flags w.r.t. beacon */
+       struct {
+               uint32  count;                  /**< # rates in this set */
+               uint8   rates[16];              /**< rates in 500kbps units w/hi bit set if basic */
+       } rateset;                              /**< supported rates */
+       chanspec_t      chanspec;               /**< chanspec for bss */
+       uint16          atim_window;            /**< units are Kusec */
+       uint8           dtim_period;            /**< DTIM period */
+       uint8           accessnet;              /* from beacon interwork IE (if bcnflags) */
+       int16           RSSI;                   /**< receive signal strength (in dBm) */
+       int8            phy_noise;              /**< noise (in dBm) */
+       uint8           n_cap;                  /**< BSS is 802.11N Capable */
+       uint8           freespace1;             /* make implicit padding explicit */
+       uint8           load;                   /**< BSS Load from QBSS load IE if available */
+       uint32          nbss_cap;               /**< 802.11N+AC BSS Capabilities */
+       uint8           ctl_ch;                 /**< 802.11N BSS control channel number */
+       uint8           padding1[3];            /**< explicit struct alignment padding */
+       uint16          vht_rxmcsmap;   /**< VHT rx mcs map (802.11ac IE, VHT_CAP_MCS_MAP_*) */
+       uint16          vht_txmcsmap;   /**< VHT tx mcs map (802.11ac IE, VHT_CAP_MCS_MAP_*) */
+       uint8           flags;                  /**< flags */
+       uint8           vht_cap;                /**< BSS is vht capable */
+       uint8           reserved[2];            /**< Reserved for expansion of BSS properties */
+       uint8           basic_mcs[MCSSET_LEN];  /**< 802.11N BSS required MCS set */
+
+       uint16          ie_offset;              /**< offset at which IEs start, from beginning */
+       uint16          freespace2;             /* making implicit padding explicit */
+       uint32          ie_length;              /**< byte length of Information Elements */
+       int16           SNR;                    /**< average SNR of during frame reception */
+       uint16          vht_mcsmap;             /**< STA's Associated vhtmcsmap */
+       uint16          vht_mcsmap_prop;        /**< STA's Associated prop vhtmcsmap */
+       uint16          vht_txmcsmap_prop;      /**< prop VHT tx mcs prop */
+} wl_bss_info_v109_t;
+
+/**
+ * BSS info structure
+ * Applications MUST CHECK ie_offset field and length field to access IEs and
+ * next bss_info structure in a vector (in wl_scan_results_t)
+ */
+typedef struct wl_bss_info_v109_1 {
+       uint32          version;                /**< version field */
+       uint32          length;                 /**< byte length of data in this record,
+                                                * starting at version and including IEs
+                                                */
+       struct ether_addr BSSID;
+       uint16          beacon_period;          /**< units are Kusec */
+       uint16          capability;             /**< Capability information */
+       uint8           SSID_len;
+       uint8           SSID[32];
+       uint8           bcnflags;               /* additional flags w.r.t. beacon */
+       struct {
+               uint32  count;                  /**< # rates in this set */
+               uint8   rates[16];              /**< rates in 500kbps units w/hi bit set if basic */
+       } rateset;                              /**< supported rates */
+       chanspec_t      chanspec;               /**< chanspec for bss */
+       uint16          atim_window;            /**< units are Kusec */
+       uint8           dtim_period;            /**< DTIM period */
+       uint8           accessnet;              /* from beacon interwork IE (if bcnflags) */
+       int16           RSSI;                   /**< receive signal strength (in dBm) */
+       int8            phy_noise;              /**< noise (in dBm) */
+       uint8           n_cap;                  /**< BSS is 802.11N Capable */
+       uint8           he_cap;                 /**< BSS is he capable */
+       uint8           load;                   /**< BSS Load from QBSS load IE if available */
+       uint32          nbss_cap;               /**< 802.11N+AC BSS Capabilities */
+       uint8           ctl_ch;                 /**< 802.11N BSS control channel number */
+       uint8           padding1[3];            /**< explicit struct alignment padding */
+       uint16          vht_rxmcsmap;   /**< VHT rx mcs map (802.11ac IE, VHT_CAP_MCS_MAP_*) */
+       uint16          vht_txmcsmap;   /**< VHT tx mcs map (802.11ac IE, VHT_CAP_MCS_MAP_*) */
+       uint8           flags;                  /**< flags */
+       uint8           vht_cap;                /**< BSS is vht capable */
+       uint8           reserved[2];            /**< Reserved for expansion of BSS properties */
+       uint8           basic_mcs[MCSSET_LEN];  /**< 802.11N BSS required MCS set */
+
+       uint16          ie_offset;              /**< offset at which IEs start, from beginning */
+       uint16          freespace2;             /* making implicit padding explicit */
+       uint32          ie_length;              /**< byte length of Information Elements */
+       int16           SNR;                    /**< average SNR of during frame reception */
+       uint16          vht_mcsmap;             /**< STA's Associated vhtmcsmap */
+       uint16          vht_mcsmap_prop;        /**< STA's Associated prop vhtmcsmap */
+       uint16          vht_txmcsmap_prop;      /**< prop VHT tx mcs prop */
+       uint32          he_mcsmap;      /**< STA's Associated hemcsmap */
+       uint32          he_rxmcsmap;    /**< HE rx mcs map (802.11ax IE, HE_CAP_MCS_MAP_*) */
+       uint32          he_txmcsmap;    /**< HE tx mcs map (802.11ax IE, HE_CAP_MCS_MAP_*) */
+} wl_bss_info_v109_1_t;
+
+/**
+ * BSS info structure
+ * Applications MUST CHECK ie_offset field and length field to access IEs and
+ * next bss_info structure in a vector (in wl_scan_results_t)
+ */
+typedef struct wl_bss_info_v109_2 {
+       uint32          version;                /**< version field */
+       uint32          length;                 /**< byte length of data in this record,
+                                                * starting at version and including IEs
+                                                */
+       struct ether_addr BSSID;
+       uint16          beacon_period;          /**< units are Kusec */
+       uint16          capability;             /**< Capability information */
+       uint8           SSID_len;
+       uint8           SSID[32];
+       uint8           bcnflags;               /* additional flags w.r.t. beacon */
+       struct {
+               uint32  count;                  /**< # rates in this set */
+               uint8   rates[16];              /**< rates in 500kbps units w/hi bit set if basic */
+       } rateset;                              /**< supported rates */
+       chanspec_t      chanspec;               /**< chanspec for bss */
+       uint16          atim_window;            /**< units are Kusec */
+       uint8           dtim_period;            /**< DTIM period */
+       uint8           accessnet;              /* from beacon interwork IE (if bcnflags) */
+       int16           RSSI;                   /**< receive signal strength (in dBm) */
+       int8            phy_noise;              /**< noise (in dBm) */
+       uint8           n_cap;                  /**< BSS is 802.11N Capable */
+       uint8           he_cap;                 /**< BSS is he capable */
+       uint8           load;                   /**< BSS Load from QBSS load IE if available */
+       uint32          nbss_cap;               /**< 802.11N+AC BSS Capabilities */
+       uint8           ctl_ch;                 /**< 802.11N BSS control channel number */
+       uint8           padding1[3];            /**< explicit struct alignment padding */
+       uint16          vht_rxmcsmap;   /**< VHT rx mcs map (802.11ac IE, VHT_CAP_MCS_MAP_*) */
+       uint16          vht_txmcsmap;   /**< VHT tx mcs map (802.11ac IE, VHT_CAP_MCS_MAP_*) */
+       uint8           flags;                  /**< flags */
+       uint8           vht_cap;                /**< BSS is vht capable */
+       uint8           reserved[2];            /**< Reserved for expansion of BSS properties */
+       uint8           basic_mcs[MCSSET_LEN];  /**< 802.11N BSS required MCS set */
+
+       uint16          ie_offset;              /**< offset at which IEs start, from beginning */
+       uint16          freespace2;             /* making implicit padding explicit */
+       uint32          ie_length;              /**< byte length of Information Elements */
+       int16           SNR;                    /**< average SNR of during frame reception */
+       uint16          vht_mcsmap;             /**< STA's Associated vhtmcsmap */
+       uint16          vht_mcsmap_prop;        /**< STA's Associated prop vhtmcsmap */
+       uint16          vht_txmcsmap_prop;      /**< prop VHT tx mcs prop */
+       uint32          he_mcsmap;      /**< STA's Associated hemcsmap */
+       uint32          he_rxmcsmap;    /**< HE rx mcs map (802.11ax IE, HE_CAP_MCS_MAP_*) */
+       uint32          he_txmcsmap;    /**< HE tx mcs map (802.11ax IE, HE_CAP_MCS_MAP_*) */
+       uint32          timestamp[2];  /* Beacon Timestamp for FAKEAP req */
+} wl_bss_info_v109_2_t;
+
+#ifndef WL_BSS_INFO_TYPEDEF_HAS_ALIAS
+typedef wl_bss_info_v109_t wl_bss_info_t;
+#endif
+
+#define WL_GSCAN_FULL_RESULT_VERSION   2       /* current version of wl_gscan_result_t struct */
+
+typedef struct wl_gscan_bss_info {
+       uint32      timestamp[2];
+       wl_bss_info_v109_t info;
+       /* Do not add any more members below, fixed  */
+       /* and variable length Information Elements to follow */
+} wl_gscan_bss_info_v2_t;
+
+typedef struct wl_gscan_bss_info_v3 {
+       uint32      timestamp[2];
+       uint8 info[];   /* var length wl_bss_info_X structures */
+       /* Do not add any more members below, fixed  */
+       /* and variable length Information Elements to follow */
+} wl_gscan_bss_info_v3_t;
+
+#ifndef WL_BSS_INFO_TYPEDEF_HAS_ALIAS
+typedef wl_gscan_bss_info_v2_t wl_gscan_bss_info_t;
+#define WL_GSCAN_INFO_FIXED_FIELD_SIZE   (sizeof(wl_gscan_bss_info_t) - sizeof(wl_bss_info_t))
+#endif
+
+typedef struct wl_bsscfg {
+       uint32  bsscfg_idx;
+       uint32  wsec;
+       uint32  WPA_auth;
+       uint32  wsec_index;
+       uint32  associated;
+       uint32  BSS;
+       uint32  phytest_on;
+       struct ether_addr   prev_BSSID;
+       struct ether_addr   BSSID;
+       uint32  targetbss_wpa2_flags;
+       uint32 assoc_type;
+       uint32 assoc_state;
+} wl_bsscfg_t;
+
+typedef struct wl_if_add {
+       uint32  bsscfg_flags;
+       uint32  if_flags;
+       uint32  ap;
+       struct ether_addr   mac_addr;
+       uint16  PAD;
+       uint32  wlc_index;
+} wl_if_add_t;
+
+typedef struct wl_bss_config {
+       uint32  atim_window;
+       uint32  beacon_period;
+       uint32  chanspec;
+} wl_bss_config_t;
+
+/* Number of Bsscolor supported per core */
+#ifndef HE_MAX_BSSCOLOR_RES
+#define HE_MAX_BSSCOLOR_RES            2
+#endif
+
+#ifndef HE_MAX_STAID_PER_BSSCOLOR
+#define HE_MAX_STAID_PER_BSSCOLOR      4
+#endif
+
+/* BSSColor indices */
+#define BSSCOLOR0_IDX  0
+#define BSSCOLOR1_IDX  1
+#define HE_BSSCOLOR0   0
+#define HE_BSSCOLOR_MAX_VAL 63
+
+/* STAID indices */
+#define STAID0_IDX     0
+#define STAID1_IDX     1
+#define STAID2_IDX     2
+#define STAID3_IDX     3
+#define HE_STAID_MAX_VAL       0x07FF
+
+typedef struct wl_bsscolor_info {
+       uint16 version;         /**< structure version */
+       uint16 length;          /**< length of the bsscolor info */
+       uint8   bsscolor_index; /**< bsscolor index 0-1 */
+       uint8   bsscolor;       /**<bsscolor value from 0 to 63 */
+       uint8   partial_bsscolor_ind;
+       uint8   disable_bsscolor_ind;   /**< To disable particular bsscolor */
+       /* bsscolor_disable to be added as part of D1.0 */
+       uint16  staid_info[HE_MAX_STAID_PER_BSSCOLOR];  /**< 0-3 staid info of each bsscolor */
+} wl_bsscolor_info_t;
+
+#define WL_BSS_USER_RADAR_CHAN_SELECT  0x1     /**< User application will randomly select
+                                                * radar channel.
+                                                */
+
+#define DLOAD_HANDLER_VER              1       /**< Downloader version */
+#define DLOAD_FLAG_VER_MASK            0xf000  /**< Downloader version mask */
+#define DLOAD_FLAG_VER_SHIFT           12      /**< Downloader version shift */
+
+#define DL_CRC_NOT_INUSE       0x0001
+#define DL_BEGIN               0x0002
+#define DL_END                 0x0004
+
+/* Flags for Major/Minor/Date number shift and mask */
+#define EPI_VER_SHIFT     16
+#define EPI_VER_MASK      0xFFFF
+/** generic download types & flags */
+enum {
+       DL_TYPE_UCODE = 1,
+       DL_TYPE_CLM = 2
+};
+
+/** ucode type values */
+enum {
+       UCODE_FW,
+       INIT_VALS,
+       BS_INIT_VALS
+};
+
+struct wl_dload_data {
+       uint16 flag;
+       uint16 dload_type;
+       uint32 len;
+       uint32 crc;
+       uint8  data[1];
+};
+typedef struct wl_dload_data wl_dload_data_t;
+
+struct wl_ucode_info {
+       uint32 ucode_type;
+       uint32 num_chunks;
+       uint32 chunk_len;
+       uint32 chunk_num;
+       uint8  data_chunk[1];
+};
+typedef struct wl_ucode_info wl_ucode_info_t;
+
+struct wl_clm_dload_info {
+       uint32 ds_id;
+       uint32 clm_total_len;
+       uint32 num_chunks;
+       uint32 chunk_len;
+       uint32 chunk_offset;
+       uint8  data_chunk[1];
+};
+typedef struct wl_clm_dload_info wl_clm_dload_info_t;
+
+typedef struct wlc_ssid {
+       uint32          SSID_len;
+       uint8           SSID[DOT11_MAX_SSID_LEN];
+} wlc_ssid_t;
+
+typedef struct wlc_ssid_ext {
+       uint8      hidden;
+       uint8      PAD;
+       uint16     flags;
+       uint8      SSID_len;
+       int8       rssi_thresh;
+       uint8      SSID[DOT11_MAX_SSID_LEN];
+} wlc_ssid_ext_t;
+
+#define MAX_PREFERRED_AP_NUM     5
+typedef struct wlc_fastssidinfo {
+       uint32                  SSID_channel[MAX_PREFERRED_AP_NUM];
+       wlc_ssid_t              SSID_info[MAX_PREFERRED_AP_NUM];
+} wlc_fastssidinfo_t;
+
+typedef struct wnm_url {
+       uint8   len;
+       uint8   data[1];
+} wnm_url_t;
+
+typedef struct chan_scandata {
+       uint8           txpower;
+       uint8           pad;
+       chanspec_t      channel;                /**< Channel num, bw, ctrl_sb and band */
+       uint32          channel_mintime;
+       uint32          channel_maxtime;
+} chan_scandata_t;
+
+typedef enum wl_scan_type {
+       EXTDSCAN_FOREGROUND_SCAN,
+       EXTDSCAN_BACKGROUND_SCAN,
+       EXTDSCAN_FORCEDBACKGROUND_SCAN
+} wl_scan_type_t;
+
+#define WLC_EXTDSCAN_MAX_SSID          5
+
+typedef struct wl_extdscan_params {
+       int8            nprobes;                /**< 0, passive, otherwise active */
+       int8            split_scan;             /**< split scan */
+       int8            band;                   /**< band */
+       int8            pad;
+       wlc_ssid_t      ssid[WLC_EXTDSCAN_MAX_SSID]; /**< ssid list */
+       uint32          tx_rate;                /**< in 500ksec units */
+       wl_scan_type_t  scan_type;              /**< enum */
+       int32           channel_num;
+       chan_scandata_t channel_list[1];        /**< list of chandata structs */
+} wl_extdscan_params_t;
+
+#define WL_EXTDSCAN_PARAMS_FIXED_SIZE  (sizeof(wl_extdscan_params_t) - sizeof(chan_scandata_t))
+
+#define WL_SCAN_PARAMS_SSID_MAX                10
+
+struct wl_scan_params {
+       wlc_ssid_t ssid;                /**< default: {0, ""} */
+       struct ether_addr bssid;        /**< default: bcast */
+       int8 bss_type;                  /**< default: any,
+                                        * DOT11_BSSTYPE_ANY/INFRASTRUCTURE/INDEPENDENT
+                                        */
+       uint8 scan_type;                /**< flags, 0 use default */
+       int32 nprobes;                  /**< -1 use default, number of probes per channel */
+       int32 active_time;              /**< -1 use default, dwell time per channel for
+                                        * active scanning
+                                        */
+       int32 passive_time;             /**< -1 use default, dwell time per channel
+                                        * for passive scanning
+                                        */
+       int32 home_time;                /**< -1 use default, dwell time for the home channel
+                                        * between channel scans
+                                        */
+       int32 channel_num;              /**< count of channels and ssids that follow
+                                        *
+                                        * low half is count of channels in channel_list, 0
+                                        * means default (use all available channels)
+                                        *
+                                        * high half is entries in wlc_ssid_t array that
+                                        * follows channel_list, aligned for int32 (4 bytes)
+                                        * meaning an odd channel count implies a 2-byte pad
+                                        * between end of channel_list and first ssid
+                                        *
+                                        * if ssid count is zero, single ssid in the fixed
+                                        * parameter portion is assumed, otherwise ssid in
+                                        * the fixed portion is ignored
+                                        */
+       uint16 channel_list[1];         /**< list of chanspecs */
+};
+
+/* changes in wl_scan_params_v2 as comapred to wl_scan_params (v1)
+* unit8 scantype to uint32
+*/
+typedef struct wl_scan_params_v2 {
+       uint16 version;                 /* Version of wl_scan_params, change value of
+                                        * WL_SCAN_PARAM_VERSION on version update
+                                        */
+       uint16 length;                  /* length of structure wl_scan_params_v1_t
+                                        * without implicit pad
+                                        */
+       wlc_ssid_t ssid;                /**< default: {0, ""} */
+       struct ether_addr bssid;        /**< default: bcast */
+       int8 bss_type;                  /**< default: any,
+                                        * DOT11_BSSTYPE_ANY/INFRASTRUCTURE/INDEPENDENT
+                                        */
+       uint8 PAD;
+       uint32 scan_type;               /**< flags, 0 use default, and flags specified in
+                                        * WL_SCANFLAGS_XXX
+                                        */
+       int32 nprobes;                  /**< -1 use default, number of probes per channel */
+       int32 active_time;              /**< -1 use default, dwell time per channel for
+                                        * active scanning
+                                        */
+       int32 passive_time;             /**< -1 use default, dwell time per channel
+                                        * for passive scanning
+                                        */
+       int32 home_time;                /**< -1 use default, dwell time for the home channel
+                                        * between channel scans
+                                        */
+       int32 channel_num;              /**< count of channels and ssids that follow
+                                        *
+                                        * low half is count of channels in channel_list, 0
+                                        * means default (use all available channels)
+                                        *
+                                        * high half is entries in wlc_ssid_t array that
+                                        * follows channel_list, aligned for int32 (4 bytes)
+                                        * meaning an odd channel count implies a 2-byte pad
+                                        * between end of channel_list and first ssid
+                                        *
+                                        * if ssid count is zero, single ssid in the fixed
+                                        * parameter portion is assumed, otherwise ssid in
+                                        * the fixed portion is ignored
+                                        */
+       uint16 channel_list[1];         /**< list of chanspecs */
+} wl_scan_params_v2_t;
+
+#define WL_SCAN_PARAMS_VERSION_V2              2
+
+/** size of wl_scan_params not including variable length array */
+#define WL_SCAN_PARAMS_V2_FIXED_SIZE   (OFFSETOF(wl_scan_params_v2_t, channel_list))
+#define WL_MAX_ROAMSCAN_DATSZ  \
+       (WL_SCAN_PARAMS_FIXED_SIZE + (WL_NUMCHANNELS * sizeof(uint16)))
+#define WL_MAX_ROAMSCAN_V2_DATSZ \
+       (WL_SCAN_PARAMS_V2_FIXED_SIZE + (WL_NUMCHANNELS * sizeof(uint16)))
+
+/* changes in wl_scan_params_v3 as comapred to wl_scan_params (v2)
+*  pad byte used to differentiate Short SSID and Regular SSID
+*/
+typedef struct wl_scan_params_v3 {
+       uint16 version;                 /* Version of wl_scan_params, change value of
+                                        * WL_SCAN_PARAM_VERSION on version update
+                                        */
+       uint16 length;                  /* length of structure wl_scan_params_v1_t
+                                        * without implicit pad
+                                        */
+       wlc_ssid_t ssid;                /**< default: {0, ""} */
+       struct ether_addr bssid;        /**< default: bcast */
+       int8 bss_type;                  /**< default: any,
+                                        * DOT11_BSSTYPE_ANY/INFRASTRUCTURE/INDEPENDENT
+                                        */
+       uint8 ssid_type;                /**< ssid_type_flag ,0 use default, and flags specified
+                                        * WL_SCAN_SSID_FLAGS
+                                        */
+       uint32 scan_type;               /**< flags, 0 use default, and flags specified in
+                                        * WL_SCANFLAGS_XXX
+                                        */
+       int32 nprobes;                  /**< -1 use default, number of probes per channel */
+       int32 active_time;              /**< -1 use default, dwell time per channel for
+                                        * active scanning
+                                        */
+       int32 passive_time;             /**< -1 use default, dwell time per channel
+                                        * for passive scanning
+                                        */
+       int32 home_time;                /**< -1 use default, dwell time for the home channel
+                                        * between channel scans
+                                        */
+       int32 channel_num;              /**< count of channels and ssids that follow
+                                        *
+                                        * low half is count of channels in channel_list, 0
+                                        * means default (use all available channels)
+                                        *
+                                        * high half is entries in wlc_ssid_t array that
+                                        * follows channel_list, aligned for int32 (4 bytes)
+                                        * meaning an odd channel count implies a 2-byte pad
+                                        * between end of channel_list and first ssid
+                                        *
+                                        * if ssid count is zero, single ssid in the fixed
+                                        * parameter portion is assumed, otherwise ssid in
+                                        * the fixed portion is ignored
+                                        */
+       uint16 channel_list[];          /**< list of chanspecs */
+} wl_scan_params_v3_t;
+
+#define WL_SCAN_PARAMS_VERSION_V3              3
+
+/** size of wl_scan_params not including variable length array */
+#define WL_SCAN_PARAMS_V3_FIXED_SIZE   (OFFSETOF(wl_scan_params_v3_t, channel_list))
+#define WL_MAX_ROAMSCAN_V3_DATSZ \
+       (WL_SCAN_PARAMS_V3_FIXED_SIZE + (WL_NUMCHANNELS * sizeof(uint16)))
+
+#define ISCAN_REQ_VERSION 1
+#define ISCAN_REQ_VERSION_V2 2
+
+/** incremental scan struct */
+struct wl_iscan_params {
+       uint32 version;
+       uint16 action;
+       uint16 scan_duration;
+       struct wl_scan_params params;
+};
+
+/** incremental scan struct */
+typedef struct wl_iscan_params_v2 {
+       uint32 version;
+       uint16 action;
+       uint16 scan_duration;
+       wl_scan_params_v2_t params;
+} wl_iscan_params_v2_t;
+
+/** incremental scan struct */
+typedef struct wl_iscan_params_v3 {
+       uint32 version;
+       uint16 action;
+       uint16 scan_duration;
+       wl_scan_params_v3_t params;
+} wl_iscan_params_v3_t;
+
+/** 3 fields + size of wl_scan_params, not including variable length array */
+#define WL_ISCAN_PARAMS_FIXED_SIZE     (OFFSETOF(wl_iscan_params_t, params) + sizeof(wlc_ssid_t))
+#define WL_ISCAN_PARAMS_V2_FIXED_SIZE \
+       (OFFSETOF(wl_iscan_params_v2_t, params) + sizeof(wlc_ssid_t))
+#define WL_ISCAN_PARAMS_V3_FIXED_SIZE \
+               (OFFSETOF(wl_iscan_params_v3_t, params) + sizeof(wlc_ssid_t))
+
+typedef struct wl_scan_results {
+       uint32 buflen;
+       uint32 version;
+       uint32 count;
+       wl_bss_info_v109_t bss_info[1];
+} wl_scan_results_v109_t;
+
+typedef struct wl_scan_results_v2 {
+       uint32 buflen;
+       uint32 version;
+       uint32 count;
+       uint8 bss_info[];       /* var length wl_bss_info_X structures */
+} wl_scan_results_v2_t;
+
+#ifndef WL_BSS_INFO_TYPEDEF_HAS_ALIAS
+typedef wl_scan_results_v109_t wl_scan_results_t;
+/** size of wl_scan_results not including variable length array */
+#define WL_SCAN_RESULTS_FIXED_SIZE (sizeof(wl_scan_results_t) - sizeof(wl_bss_info_t))
+#endif
+
+#if defined(SIMPLE_ISCAN)
+/** the buf lengh can be WLC_IOCTL_MAXLEN (8K) to reduce iteration */
+#define WLC_IW_ISCAN_MAXLEN   2048
+typedef struct iscan_buf {
+       struct iscan_buf * next;
+       int8   iscan_buf[WLC_IW_ISCAN_MAXLEN];
+} iscan_buf_t;
+#endif /* SIMPLE_ISCAN */
+#define ESCAN_REQ_VERSION 1
+#define ESCAN_REQ_VERSION_V2 2
+
+/** event scan reduces amount of SOC memory needed to store scan results */
+struct wl_escan_params {
+       uint32 version;
+       uint16 action;
+       uint16 sync_id;
+       struct wl_scan_params params;
+};
+
+typedef struct wl_escan_params_v2 {
+       uint32 version;
+       uint16 action;
+       uint16 sync_id;
+       wl_scan_params_v2_t params;
+} wl_escan_params_v2_t;
+
+typedef struct wl_escan_params_v3 {
+       uint32 version;
+       uint16 action;
+       uint16 sync_id;
+       wl_scan_params_v3_t params;
+} wl_escan_params_v3_t;
+
+#define WL_ESCAN_PARAMS_FIXED_SIZE (OFFSETOF(wl_escan_params_t, params) + sizeof(wlc_ssid_t))
+#define WL_ESCAN_PARAMS_V2_FIXED_SIZE (OFFSETOF(wl_escan_params_v2_t, params) + sizeof(wlc_ssid_t))
+#define WL_ESCAN_PARAMS_V3_FIXED_SIZE (OFFSETOF(wl_escan_params_v3_t, params) + sizeof(wlc_ssid_t))
+/* New scan version is defined then change old version of scan to
+ * wl_scan_params_v1_t and new one to wl_scan_params_t
+ */
+#if defined(WL_SCAN_PARAMS_V3)
+typedef struct wl_scan_params  wl_scan_params_v1_t;
+typedef struct wl_escan_params wl_escan_params_v1_t;
+typedef struct wl_iscan_params wl_iscan_params_v1_t;
+typedef struct wl_scan_params_v3       wl_scan_params_t;
+typedef struct wl_escan_params_v3      wl_escan_params_t;
+typedef struct wl_iscan_params_v3      wl_iscan_params_t;
+#define WL_SCAN_PARAMS_FIXED_SIZE      (OFFSETOF(wl_scan_params_t, channel_list))
+#elif defined(WL_SCAN_PARAMS_V2)
+typedef struct wl_scan_params  wl_scan_params_v1_t;
+typedef struct wl_escan_params wl_escan_params_v1_t;
+typedef struct wl_iscan_params wl_iscan_params_v1_t;
+typedef struct wl_scan_params_v2       wl_scan_params_t;
+typedef struct wl_escan_params_v2      wl_escan_params_t;
+typedef struct wl_iscan_params_v2      wl_iscan_params_t;
+#define WL_SCAN_PARAMS_FIXED_SIZE      (OFFSETOF(wl_scan_params_t, channel_list))
+#else
+typedef struct wl_scan_params wl_scan_params_t;
+typedef struct wl_escan_params wl_escan_params_t;
+typedef struct wl_iscan_params wl_iscan_params_t;
+#define WL_SCAN_PARAMS_FIXED_SIZE      64
+#endif /* WL_SCAN_PARAMS_V3 */
+
+/** event scan reduces amount of SOC memory needed to store scan results */
+typedef struct wl_escan_result {
+       uint32 buflen;
+       uint32 version;
+       uint16 sync_id;
+       uint16 bss_count;
+       wl_bss_info_v109_t bss_info[1];
+} wl_escan_result_v109_t;
+
+/** event scan reduces amount of SOC memory needed to store scan results */
+typedef struct wl_escan_result_v2 {
+       uint32 buflen;
+       uint32 version;
+       uint16 sync_id;
+       uint16 bss_count;
+       uint8 bss_info[];       /* var length wl_bss_info_X structures */
+} wl_escan_result_v2_t;
+
+#ifndef WL_BSS_INFO_TYPEDEF_HAS_ALIAS
+typedef wl_escan_result_v109_t wl_escan_result_t;
+#define WL_ESCAN_RESULTS_FIXED_SIZE (sizeof(wl_escan_result_t) - sizeof(wl_bss_info_t))
+#endif
+
+typedef struct wl_gscan_result {
+       uint32 buflen;
+       uint32 version;
+       uint32 scan_ch_bucket;
+       wl_gscan_bss_info_v2_t bss_info[1];
+} wl_gscan_result_v2_t;
+
+typedef struct wl_gscan_result_v2_1 {
+       uint32 buflen;
+       uint32 version;
+       uint32 scan_ch_bucket;
+       uint8 bss_info[];       /* var length wl_bss_info_X structures */
+} wl_gscan_result_v2_1_t;
+
+#ifndef WL_BSS_INFO_TYPEDEF_HAS_ALIAS
+typedef wl_gscan_result_v2_t wl_gscan_result_t;
+#define WL_GSCAN_RESULTS_FIXED_SIZE (sizeof(wl_gscan_result_t) - sizeof(wl_gscan_bss_info_t))
+#endif
+
+/** incremental scan results struct */
+typedef struct wl_iscan_results {
+       uint32 status;
+       wl_scan_results_v109_t results;
+} wl_iscan_results_v109_t;
+
+/** incremental scan results struct */
+typedef struct wl_iscan_results_v2 {
+       uint32 status;
+       wl_scan_results_v2_t results;
+} wl_iscan_results_v2_t;
+
+#ifndef WL_BSS_INFO_TYPEDEF_HAS_ALIAS
+typedef wl_iscan_results_v109_t wl_iscan_results_t;
+/** size of wl_iscan_results not including variable length array */
+#define WL_ISCAN_RESULTS_FIXED_SIZE \
+       (WL_SCAN_RESULTS_FIXED_SIZE + OFFSETOF(wl_iscan_results_t, results))
+#endif
+
+typedef struct wl_probe_params {
+       wlc_ssid_t ssid;
+       struct ether_addr bssid;
+       struct ether_addr mac;
+} wl_probe_params_t;
+
+#define WL_MAXRATES_IN_SET             16      /**< max # of rates in a rateset */
+
+typedef struct wl_rateset {
+       uint32  count;                          /**< # rates in this set */
+       uint8   rates[WL_MAXRATES_IN_SET];      /**< rates in 500kbps units w/hi bit set if basic */
+} wl_rateset_t;
+
+#define WL_VHT_CAP_MCS_MAP_NSS_MAX     8
+
+typedef struct wl_rateset_args_v1 {
+       uint32  count;                          /**< # rates in this set */
+       uint8   rates[WL_MAXRATES_IN_SET];      /**< rates in 500kbps units w/hi bit set if basic */
+       uint8   mcs[MCSSET_LEN];        /**< supported mcs index bit map */
+       uint16 vht_mcs[WL_VHT_CAP_MCS_MAP_NSS_MAX]; /**< supported mcs index bit map per nss */
+} wl_rateset_args_v1_t;
+
+#define RATESET_ARGS_V1                (1)
+#define RATESET_ARGS_V2                (2)
+
+/* RATESET_VERSION_ENABLED is defined in wl.mk post J branch.
+ * Guidelines to use wl_rateset_args_t:
+ * [a] in wlioctl.h: Add macro RATESET_ARGS_VX where X is the new version number.
+ * [b] in wlioctl.h: Add a new structure with wl_rateset_args_vX_t
+ * [c] in wlu.c app: Add support to parse new structure under RATESET_ARGS_VX
+ * [d] in wlc_types.h: in respective branch and trunk: redefine wl_rateset_args_t with
+ *     new wl_rateset_args_vX_t
+ */
+#ifndef RATESET_VERSION_ENABLED
+/* rateset structure before versioning. legacy. DONOT update anymore here */
+#define RATESET_ARGS_VERSION   (RATESET_ARGS_V1)
+typedef wl_rateset_args_v1_t wl_rateset_args_t;
+#endif /* RATESET_VERSION_ENABLED */
+
+/* Note: dependent structures: sta_info_vX_t. When any update to this structure happens,
+ *     update sta_info_vX_t also.
+ */
+#define WL_HE_CAP_MCS_MAP_NSS_MAX      8
+
+typedef struct wl_rateset_args_v2 {
+       uint16 version;         /**< version. */
+       uint16 len;             /**< length */
+       uint32  count;          /**< # rates in this set */
+       uint8   rates[WL_MAXRATES_IN_SET];      /**< rates in 500kbps units w/hi bit set if basic */
+       uint8   mcs[MCSSET_LEN];                /**< supported mcs index bit map */
+       uint16 vht_mcs[WL_VHT_CAP_MCS_MAP_NSS_MAX]; /**< supported mcs index bit map per nss */
+       uint16 he_mcs[WL_HE_CAP_MCS_MAP_NSS_MAX]; /**< supported he mcs index bit map per nss */
+} wl_rateset_args_v2_t;
+
+/* HE Rates BITMAP */
+#define WL_HE_CAP_MCS_0_7_MAP          0x00ff
+#define WL_HE_CAP_MCS_0_8_MAP          0x01ff
+#define WL_HE_CAP_MCS_0_9_MAP          0x03ff
+#define WL_HE_CAP_MCS_0_10_MAP         0x07ff
+#define WL_HE_CAP_MCS_0_11_MAP         0x0fff
+
+#define TXBF_RATE_MCS_ALL              4
+#define TXBF_RATE_VHT_ALL              4
+#define TXBF_RATE_OFDM_ALL             8
+
+typedef struct wl_txbf_rateset {
+       uint8   txbf_rate_mcs[TXBF_RATE_MCS_ALL];       /**< one for each stream */
+       uint8   txbf_rate_mcs_bcm[TXBF_RATE_MCS_ALL];   /**< one for each stream */
+       uint16  txbf_rate_vht[TXBF_RATE_VHT_ALL];       /**< one for each stream */
+       uint16  txbf_rate_vht_bcm[TXBF_RATE_VHT_ALL];   /**< one for each stream */
+       uint8   txbf_rate_ofdm[TXBF_RATE_OFDM_ALL]; /**< bitmap of ofdm rates that enables txbf */
+       uint8   txbf_rate_ofdm_bcm[TXBF_RATE_OFDM_ALL]; /* bitmap of ofdm rates that enables txbf */
+       uint8   txbf_rate_ofdm_cnt;
+       uint8   txbf_rate_ofdm_cnt_bcm;
+} wl_txbf_rateset_t;
+
+#define NUM_BFGAIN_ARRAY_1RX   2
+#define NUM_BFGAIN_ARRAY_2RX   3
+#define NUM_BFGAIN_ARRAY_3RX   4
+#define NUM_BFGAIN_ARRAY_4RX   5
+
+typedef struct wl_txbf_expgainset {
+       /* bitmap for each element: B[4:0]=>c0, B[9:5]=>c1, B[14:10]=>c2, B[19:15]=>c[3-7]
+        * B[24:20]=>c[8-9], B[29:25]=>c[10-11]
+        */
+       uint32  bfgain_2x1[NUM_BFGAIN_ARRAY_1RX]; /* exp     1ss, imp 1ss */
+       uint32  bfgain_2x2[NUM_BFGAIN_ARRAY_2RX]; /* exp [1-2]ss, imp 1ss */
+       uint32  bfgain_3x1[NUM_BFGAIN_ARRAY_1RX];
+       uint32  bfgain_3x2[NUM_BFGAIN_ARRAY_2RX];
+       uint32  bfgain_3x3[NUM_BFGAIN_ARRAY_3RX]; /* exp [1-3]ss, imp 1ss */
+       uint32  bfgain_4x1[NUM_BFGAIN_ARRAY_1RX];
+       uint32  bfgain_4x2[NUM_BFGAIN_ARRAY_2RX];
+       uint32  bfgain_4x3[NUM_BFGAIN_ARRAY_3RX];
+       uint32  bfgain_4x4[NUM_BFGAIN_ARRAY_4RX]; /* exp [1-4]ss, imp 1ss */
+} wl_txbf_expgainset_t;
+
+#define OFDM_RATE_MASK                 0x0000007f
+typedef uint8 ofdm_rates_t;
+
+typedef struct wl_rates_info {
+       wl_rateset_t rs_tgt;
+       uint32 phy_type;
+       int32 bandtype;
+       uint8 cck_only;
+       uint8 rate_mask;
+       uint8 mcsallow;
+       uint8 bw;
+       uint8 txstreams;
+       uint8 PAD[3];
+} wl_rates_info_t;
+
+/**uint32 list */
+typedef struct wl_uint32_list {
+       /** in - # of elements, out - # of entries */
+       uint32 count;
+       /** variable length uint32 list */
+       uint32 element[1];
+} wl_uint32_list_t;
+
+#define CHAN_INFO_LIST_ALL_V1 1
+
+typedef struct wl_chanspec_attr_s_v1 {
+       uint32 chaninfo;
+       uint32 chanspec;
+} wl_chanspec_attr_v1_t;
+
+/**chanspecs list */
+typedef struct wl_chanspec_list_s_v1 {
+       uint16 version;
+       /** in - # of chanspecs, out - # of entries */
+       uint16 count;
+       /** variable length chanspecs list */
+       wl_chanspec_attr_v1_t chspecs[1];
+} wl_chanspec_list_v1_t;
+
+/* WLC_SET_ALLOW_MODE values */
+#define ALLOW_MODE_ANY_BSSID           0
+#define ALLOW_MODE_ONLY_DESIRED_BSSID  1
+#define ALLOW_MODE_NO_BSSID            2
+
+/** used for association with a specific BSSID and chanspec list */
+typedef struct wl_assoc_params {
+       struct ether_addr bssid;        /**< 00:00:00:00:00:00: broadcast scan */
+       uint16 bssid_cnt;               /**< 0: use chanspec_num, and the single bssid,
+                                       * otherwise count of chanspecs in chanspec_list
+                                       * AND paired bssids following chanspec_list
+                                       * also, chanspec_num has to be set to zero
+                                       * for bssid list to be used
+                                       */
+       int32 chanspec_num;             /**< 0: all available channels,
+                                       * otherwise count of chanspecs in chanspec_list
+                                       */
+       chanspec_t chanspec_list[1];    /**< list of chanspecs */
+} wl_assoc_params_t;
+
+#define WL_ASSOC_PARAMS_FIXED_SIZE     OFFSETOF(wl_assoc_params_t, chanspec_list)
+
+/** used for reassociation/roam to a specific BSSID and channel */
+typedef wl_assoc_params_t wl_reassoc_params_t;
+#define WL_REASSOC_PARAMS_FIXED_SIZE   WL_ASSOC_PARAMS_FIXED_SIZE
+
+#define WL_EXT_REASSOC_VER     1
+
+typedef struct wl_ext_reassoc_params {
+       uint16 version;
+       uint16 length;
+       uint32 flags;
+       wl_reassoc_params_t params;
+} wl_ext_reassoc_params_t;
+
+/* Flags field defined above in wl_ext_reassoc_params
+ * The value in bits [2:0] is used to specify the type
+ * of scan to be used for reassoc
+ */
+
+#define WL_SCAN_MODE_HIGH_ACC  0u      /**<  use high accuracy scans for roam */
+#define WL_SCAN_MODE_LOW_SPAN  1u      /**< use low span scans for roam */
+#define WL_SCAN_MODE_LOW_POWER 2u      /**< use low power scans for roam */
+
+#define WL_EXTREASSOC_PARAMS_FIXED_SIZE                (OFFSETOF(wl_ext_reassoc_params_t, params) + \
+                                        WL_REASSOC_PARAMS_FIXED_SIZE)
+
+/** used for association to a specific BSSID and channel */
+typedef wl_assoc_params_t wl_join_assoc_params_t;
+#define WL_JOIN_ASSOC_PARAMS_FIXED_SIZE        WL_ASSOC_PARAMS_FIXED_SIZE
+
+/** used for join with or without a specific bssid and channel list */
+typedef struct wl_join_params {
+       wlc_ssid_t ssid;
+       wl_assoc_params_t params;       /**< optional field, but it must include the fixed portion
+                                        * of the wl_assoc_params_t struct when it does present.
+                                        */
+} wl_join_params_t;
+
+#define WL_JOIN_PARAMS_FIXED_SIZE      (OFFSETOF(wl_join_params_t, params) + \
+                                        WL_ASSOC_PARAMS_FIXED_SIZE)
+
+typedef struct wlc_roam_exp_params {
+       int8 a_band_boost_threshold;
+       int8 a_band_penalty_threshold;
+       int8 a_band_boost_factor;
+       int8 a_band_penalty_factor;
+       int8 cur_bssid_boost;
+       int8 alert_roam_trigger_threshold;
+       int16 a_band_max_boost;
+} wlc_roam_exp_params_t;
+
+#define ROAM_EXP_CFG_VERSION     1
+
+#define ROAM_EXP_ENABLE_FLAG             (1 << 0)
+
+#define ROAM_EXP_CFG_PRESENT             (1 << 1)
+
+typedef struct wl_roam_exp_cfg {
+       uint16 version;
+       uint16 flags;
+       wlc_roam_exp_params_t params;
+} wl_roam_exp_cfg_t;
+
+typedef struct wl_bssid_pref_list {
+       struct ether_addr bssid;
+       /* Add this to modify rssi */
+       int8 rssi_factor;
+       int8 flags;
+} wl_bssid_pref_list_t;
+
+#define BSSID_PREF_LIST_VERSION        1
+#define ROAM_EXP_CLEAR_BSSID_PREF        (1 << 0)
+
+typedef struct wl_bssid_pref_cfg {
+       uint16 version;
+       uint16 flags;
+       uint16 count;
+       uint16 reserved;
+       wl_bssid_pref_list_t bssids[];
+} wl_bssid_pref_cfg_t;
+
+#define SSID_WHITELIST_VERSION         1
+
+#define ROAM_EXP_CLEAR_SSID_WHITELIST    (1 << 0)
+
+/* Roam SSID whitelist, ssids in this list are ok to  */
+/* be considered as targets to join when considering a roam */
+
+typedef struct wl_ssid_whitelist {
+
+       uint16 version;
+       uint16 flags;
+
+       uint8 ssid_count;
+       uint8 reserved[3];
+       wlc_ssid_t ssids[];
+} wl_ssid_whitelist_t;
+
+#define ROAM_EXP_EVENT_VERSION       1
+
+typedef struct wl_roam_exp_event {
+
+       uint16 version;
+       uint16 flags;
+       wlc_ssid_t cur_ssid;
+} wl_roam_exp_event_t;
+
+/** scan params for extended join */
+typedef struct wl_join_scan_params {
+       uint8 scan_type;                /**< 0 use default, active or passive scan */
+       uint8 PAD[3];
+       int32 nprobes;                  /**< -1 use default, number of probes per channel */
+       int32 active_time;              /**< -1 use default, dwell time per channel for
+                                        * active scanning
+                                        */
+       int32 passive_time;             /**< -1 use default, dwell time per channel
+                                        * for passive scanning
+                                        */
+       int32 home_time;                /**< -1 use default, dwell time for the home channel
+                                        * between channel scans
+                                        */
+} wl_join_scan_params_t;
+
+/** extended join params */
+typedef struct wl_extjoin_params {
+       wlc_ssid_t ssid;                /**< {0, ""}: wildcard scan */
+       wl_join_scan_params_t scan;
+       wl_join_assoc_params_t assoc;   /**< optional field, but it must include the fixed portion
+                                        * of the wl_join_assoc_params_t struct when it does
+                                        * present.
+                                        */
+} wl_extjoin_params_t;
+#define WL_EXTJOIN_PARAMS_FIXED_SIZE   (OFFSETOF(wl_extjoin_params_t, assoc) + \
+                                        WL_JOIN_ASSOC_PARAMS_FIXED_SIZE)
+
+#define ANT_SELCFG_MAX         4       /**< max number of antenna configurations */
+#define MAX_STREAMS_SUPPORTED  4       /**< max number of streams supported */
+typedef struct {
+       uint8 ant_config[ANT_SELCFG_MAX];       /**< antenna configuration */
+       uint8 num_antcfg;                       /**< number of available antenna configurations */
+} wlc_antselcfg_t;
+
+typedef struct {
+       uint32 duration;                /**< millisecs spent sampling this channel */
+       union {
+               uint32 congest_ibss;    /**< millisecs in our bss (presumably this traffic will */
+                                       /**<  move if cur bss moves channels) */
+               uint32 congest_me;      /**< millisecs in my own traffic */
+       };
+       union {
+               uint32 congest_obss;    /**< traffic not in our bss */
+               uint32 congest_notme;   /**< traffic not from/to me (including bc/mc) */
+       };
+       uint32 interference;            /**< millisecs detecting a non 802.11 interferer. */
+       uint32 timestamp;               /**< second timestamp */
+} cca_congest_t;
+
+typedef struct {
+       chanspec_t chanspec;            /**< Which channel? */
+       uint16 num_secs;                /**< How many secs worth of data */
+       cca_congest_t  secs[1];         /**< Data */
+} cca_congest_channel_req_t;
+
+typedef struct {
+       uint32 timestamp;               /**< second timestamp */
+
+       /* Base structure of cca_congest_t: CCA statistics all inclusive */
+       uint32 duration;                /**< millisecs spent sampling this channel */
+       uint32 congest_meonly;          /**< millisecs in my own traffic (TX + RX) */
+       uint32 congest_ibss;            /**< millisecs in our bss (presumably this traffic will */
+                                       /**<  move if cur bss moves channels) */
+       uint32 congest_obss;            /**< traffic not in our bss */
+       uint32 interference;            /**< millisecs detecting a non 802.11 interferer. */
+
+       /* CCA statistics for non PM only */
+       uint32 duration_nopm;           /**< millisecs spent sampling this channel */
+       uint32 congest_meonly_nopm;     /**< millisecs in my own traffic (TX + RX) */
+       uint32 congest_ibss_nopm;       /**< millisecs in our bss (presumably this traffic will */
+                                       /**<  move if cur bss moves channels) */
+       uint32 congest_obss_nopm;       /**< traffic not in our bss */
+       uint32 interference_nopm;       /**< millisecs detecting a non 802.11 interferer. */
+
+       /* CCA statistics for during PM only */
+       uint32 duration_pm;             /**< millisecs spent sampling this channel */
+       uint32 congest_meonly_pm;       /**< millisecs in my own traffic (TX + RX) */
+       uint32 congest_ibss_pm;         /**< millisecs in our bss (presumably this traffic will */
+                                       /**<  move if cur bss moves channels) */
+       uint32 congest_obss_pm;         /**< traffic not in our bss */
+       uint32 interference_pm;         /**< millisecs detecting a non 802.11 interferer. */
+} cca_congest_ext_t;
+
+#define WL_CCA_EXT_REQ_VER             0
+typedef struct {
+       uint16 ver;                     /**< version of this struct */
+       uint16 len;                     /**< len of this structure */
+       chanspec_t chanspec;            /**< Which channel? */
+       uint16 num_secs;                /**< How many secs worth of data */
+       cca_congest_ext_t secs[1];      /**< Data - 3 sets for ALL - non-PM - PM */
+} cca_congest_ext_channel_req_t;
+
+typedef struct {
+       uint32 duration;        /**< millisecs spent sampling this channel */
+       uint32 congest;         /**< millisecs detecting busy CCA */
+       uint32 timestamp;       /**< second timestamp */
+} cca_congest_simple_t;
+
+/* The following two structure must have same first 4 fields.
+ * The cca_chan_qual_event_t is used to report CCA in older formats and NF.
+ * The cca_only_chan_qual_event_t is used to report CCA only with newer format.
+ */
+typedef struct {
+       uint16 status;
+       uint16 id;
+       chanspec_t chanspec;                            /**< Which channel? */
+       uint16 len;
+       union {
+               cca_congest_simple_t  cca_busy;         /**< CCA busy */
+               cca_congest_t cca_busy_ext;             /**< Extended CCA report */
+               int32 noise;                            /**< noise floor */
+       };
+} cca_chan_qual_event_t;
+
+typedef struct {
+       uint16 status;
+       uint16 id;
+       chanspec_t chanspec;                            /**< Which channel? */
+       uint16 len;
+       union {
+               cca_congest_simple_t  cca_busy;         /**< CCA busy */
+               struct {
+                       cca_congest_t cca_busy_ext;     /**< Extended CCA report */
+                       cca_congest_t cca_busy_nopm;    /**< Extedned CCA report (PM awake time) */
+                       cca_congest_t cca_busy_pm;      /**< Extedned CCA report (PM sleep time) */
+               };
+       };
+} cca_only_chan_qual_event_t;
+
+typedef struct {
+       uint16 status;                                  /* Indicates the status of event */
+       uint16 id;
+       /* id is used to indicate the number of bytes to read */
+       chanspec_t chanspec;                            /**< Which channel? */
+       uint16 len;
+       union {
+               cca_congest_simple_t  cca_busy;         /**< CCA busy */
+               struct {
+                       cca_congest_t cca_busy_ext;     /**< Extended CCA report */
+                       cca_congest_t cca_busy_nopm;    /**< Extedned CCA report (PM awake time) */
+                       cca_congest_t cca_busy_pm;      /**< Extedned CCA report (PM sleep time) */
+               };
+       };
+       int32 ofdm_desense;
+} cca_only_chan_qual_event_v2_t;
+
+typedef struct {
+       uint32 msrmnt_time;     /**< Time for Measurement (msec) */
+       uint32 msrmnt_done;     /**< flag set when measurement complete */
+       char buf[];
+} cca_stats_n_flags;
+
+typedef struct {
+       uint32 msrmnt_query;    /* host to driver query for measurement done */
+       uint32 time_req;        /* time required for measurement */
+       uint8 report_opt;       /* option to print different stats in report */
+       uint8 PAD[3];
+} cca_msrmnt_query;
+
+/* interference sources */
+enum interference_source {
+       ITFR_NONE = 0,                  /**< interference */
+       ITFR_PHONE,                     /**< wireless phone */
+       ITFR_VIDEO_CAMERA,              /**< wireless video camera */
+       ITFR_MICROWAVE_OVEN,            /**< microwave oven */
+       ITFR_BABY_MONITOR,              /**< wireless baby monitor */
+       ITFR_BLUETOOTH,                 /**< bluetooth */
+       ITFR_VIDEO_CAMERA_OR_BABY_MONITOR,      /**< wireless camera or baby monitor */
+       ITFR_BLUETOOTH_OR_BABY_MONITOR, /**< bluetooth or baby monitor */
+       ITFR_VIDEO_CAMERA_OR_PHONE,     /**< video camera or phone */
+       ITFR_UNIDENTIFIED               /**< interference from unidentified source */
+};
+
+/** structure for interference source report */
+typedef struct {
+       uint32 flags;           /**< flags.  bit definitions below */
+       uint32 source;          /**< last detected interference source */
+       uint32 timestamp;       /**< second timestamp on interferenced flag change */
+} interference_source_rep_t;
+
+#define WLC_CNTRY_BUF_SZ       4               /**< Country string is 3 bytes + NUL */
+
+typedef struct wl_country {
+       char country_abbrev[WLC_CNTRY_BUF_SZ];  /**< nul-terminated country code used in
+                                                * the Country IE
+                                                */
+       int32 rev;                              /**< revision specifier for ccode
+                                                * on set, -1 indicates unspecified.
+                                                * on get, rev >= 0
+                                                */
+       char ccode[WLC_CNTRY_BUF_SZ];           /**< nul-terminated built-in country code.
+                                                * variable length, but fixed size in
+                                                * struct allows simple allocation for
+                                                * expected country strings <= 3 chars.
+                                                */
+} wl_country_t;
+
+#define CCODE_INFO_VERSION 1
+
+typedef enum wl_ccode_role {
+       WLC_CCODE_ROLE_ACTIVE = 0,
+       WLC_CCODE_ROLE_HOST,
+       WLC_CCODE_ROLE_80211D_ASSOC,
+       WLC_CCODE_ROLE_80211D_SCAN,
+       WLC_CCODE_ROLE_DEFAULT,
+       WLC_CCODE_ROLE_DEFAULT_SROM_BKUP,
+       WLC_CCODE_LAST
+} wl_ccode_role_t;
+#define WLC_NUM_CCODE_INFO WLC_CCODE_LAST
+
+typedef struct wl_ccode_entry {
+       uint16 reserved;
+       uint8 band;
+       uint8 role;
+       char    ccode[WLC_CNTRY_BUF_SZ];
+} wl_ccode_entry_t;
+
+typedef struct wl_ccode_info {
+       uint16 version;
+       uint16 count;   /**< Number of ccodes entries in the set */
+       wl_ccode_entry_t ccodelist[1];
+} wl_ccode_info_t;
+#define WL_CCODE_INFO_FIXED_LEN        OFFSETOF(wl_ccode_info_t, ccodelist)
+typedef struct wl_channels_in_country {
+       uint32 buflen;
+       uint32 band;
+       char country_abbrev[WLC_CNTRY_BUF_SZ];
+       uint32 count;
+       uint32 channel[1];
+} wl_channels_in_country_t;
+
+typedef struct wl_country_list {
+       uint32 buflen;
+       uint32 band_set;
+       uint32 band;
+       uint32 count;
+       char country_abbrev[1];
+} wl_country_list_t;
+
+typedef struct wl_rm_req_elt {
+       int8    type;
+       int8    flags;
+       chanspec_t      chanspec;
+       uint32  token;          /**< token for this measurement */
+       uint32  tsf_h;          /**< TSF high 32-bits of Measurement start time */
+       uint32  tsf_l;          /**< TSF low 32-bits */
+       uint32  dur;            /**< TUs */
+} wl_rm_req_elt_t;
+
+typedef struct wl_rm_req {
+       uint32  token;          /**< overall measurement set token */
+       uint32  count;          /**< number of measurement requests */
+       void    *cb;            /**< completion callback function: may be NULL */
+       void    *cb_arg;        /**< arg to completion callback function */
+       wl_rm_req_elt_t req[1]; /**< variable length block of requests */
+} wl_rm_req_t;
+#define WL_RM_REQ_FIXED_LEN    OFFSETOF(wl_rm_req_t, req)
+
+typedef struct wl_rm_rep_elt {
+       int8    type;
+       int8    flags;
+       chanspec_t      chanspec;
+       uint32  token;          /**< token for this measurement */
+       uint32  tsf_h;          /**< TSF high 32-bits of Measurement start time */
+       uint32  tsf_l;          /**< TSF low 32-bits */
+       uint32  dur;            /**< TUs */
+       uint32  len;            /**< byte length of data block */
+       uint8   data[1];        /**< variable length data block */
+} wl_rm_rep_elt_t;
+#define WL_RM_REP_ELT_FIXED_LEN        24      /**< length excluding data block */
+
+#define WL_RPI_REP_BIN_NUM 8
+typedef struct wl_rm_rpi_rep {
+       uint8   rpi[WL_RPI_REP_BIN_NUM];
+       int8    rpi_max[WL_RPI_REP_BIN_NUM];
+} wl_rm_rpi_rep_t;
+
+typedef struct wl_rm_rep {
+       uint32  token;          /**< overall measurement set token */
+       uint32  len;            /**< length of measurement report block */
+       wl_rm_rep_elt_t rep[1]; /**< variable length block of reports */
+} wl_rm_rep_t;
+#define WL_RM_REP_FIXED_LEN    8
+#ifdef BCMCCX // MOG-NO
+
+#define LEAP_USER_MAX          32
+#define LEAP_DOMAIN_MAX                32
+#define LEAP_PASSWORD_MAX      32
+
+typedef struct wl_leap_info {
+       wlc_ssid_t ssid;
+       uint8 user_len;
+       uint8 user[LEAP_USER_MAX];
+       uint8 password_len;
+       uint8 password[LEAP_PASSWORD_MAX];
+       uint8 domain_len;
+       uint8 domain[LEAP_DOMAIN_MAX];
+       uint8 PAD;
+} wl_leap_info_t;
+
+typedef struct wl_leap_list {
+       uint32 buflen;
+       uint32 version;
+       uint32 count;
+       wl_leap_info_t leap_info[1];
+} wl_leap_list_t;
+#endif /* BCMCCX */
+
+typedef enum sup_auth_status {
+       /* Basic supplicant authentication states */
+       WLC_SUP_DISCONNECTED = 0,
+       WLC_SUP_CONNECTING,
+       WLC_SUP_IDREQUIRED,
+       WLC_SUP_AUTHENTICATING,
+       WLC_SUP_AUTHENTICATED,
+       WLC_SUP_KEYXCHANGE,
+       WLC_SUP_KEYED,
+       WLC_SUP_TIMEOUT,
+       WLC_SUP_LAST_BASIC_STATE,
+
+       /* Extended supplicant authentication states */
+       /** Waiting to receive handshake msg M1 */
+       WLC_SUP_KEYXCHANGE_WAIT_M1 = WLC_SUP_AUTHENTICATED,
+       /** Preparing to send handshake msg M2 */
+       WLC_SUP_KEYXCHANGE_PREP_M2 = WLC_SUP_KEYXCHANGE,
+       /* Waiting to receive handshake msg M3 */
+       WLC_SUP_KEYXCHANGE_WAIT_M3 = WLC_SUP_LAST_BASIC_STATE,
+       WLC_SUP_KEYXCHANGE_PREP_M4,     /**< Preparing to send handshake msg M4 */
+       WLC_SUP_KEYXCHANGE_WAIT_G1,     /**< Waiting to receive handshake msg G1 */
+       WLC_SUP_KEYXCHANGE_PREP_G2      /**< Preparing to send handshake msg G2 */
+} sup_auth_status_t;
+
+typedef struct wl_wsec_key {
+       uint32          index;          /**< key index */
+       uint32          len;            /**< key length */
+       uint8           data[DOT11_MAX_KEY_SIZE];       /**< key data */
+       uint32          pad_1[18];
+       uint32          algo;           /**< CRYPTO_ALGO_AES_CCM, CRYPTO_ALGO_WEP128, etc */
+       uint32          flags;          /**< misc flags */
+       uint32          pad_2[2];
+       int32           pad_3;
+       int32           iv_initialized; /**< has IV been initialized already? */
+       int32           pad_4;
+       /* Rx IV */
+       struct {
+               uint32  hi;             /**< upper 32 bits of IV */
+               uint16  lo;             /**< lower 16 bits of IV */
+               uint16  PAD;
+       } rxiv;
+       uint32          pad_5[2];
+       struct ether_addr ea;           /**< per station */
+       uint16      PAD;
+} wl_wsec_key_t;
+
+/* Min length for PSK passphrase */
+#define WSEC_MIN_PSK_LEN       8
+/* Max length of supported passphrases for PSK */
+#define WSEC_MAX_PSK_LEN       64
+/* Max length of supported passphrases for SAE */
+#define WSEC_MAX_PASSPHRASE_LEN 256u
+/* Max length of SAE password ID */
+#define WSEC_MAX_SAE_PASSWORD_ID 255u
+
+/* Flag for key material needing passhash'ing */
+#define WSEC_PASSPHRASE                1u
+/* Flag indicating an SAE passphrase */
+#define WSEC_SAE_PASSPHRASE    2u
+
+/**receptacle for WLC_SET_WSEC_PMK parameter */
+
+typedef struct wsec_pmk {
+       ushort  key_len;                /* octets in key material */
+       ushort  flags;                  /* key handling qualification */
+       uint8   key[WSEC_MAX_PASSPHRASE_LEN];   /* PMK material */
+       uint16  opt_len;                /* optional field length */
+       uint8   opt_tlvs[1];            /* optional filed in bcm_xtlv_t format */
+} wsec_pmk_t;
+
+typedef enum {
+       WL_PMK_TLV_PASSWORD_ID  = 1,
+       WL_PMK_TLV_SSID         = 2,
+       WL_PMK_TLV_BSSID        = 3
+} wl_pmk_tlv_types_t;
+
+#define WL_AUTH_EVENT_DATA_V1          0x1
+#define WL_AUTH_EVENT_DATA_V2          0x2
+
+/* tlv ids for auth event */
+#define WL_AUTH_PMK_TLV_ID                     1u
+#define WL_AUTH_PMKID_TLV_ID           2u
+#define WL_AUTH_PMKID_TYPE_TLV_ID      3u
+#define WL_AUTH_SSID_TLV_ID                    4u
+
+#define WL_AUTH_PMKID_TYPE_BSSID       1u
+#define WL_AUTH_PMKID_TYPE_SSID                2u
+/* AUTH event data
+* pmk and pmkid in case of SAE auth
+* xtlvs will be 32 bit alligned
+*/
+typedef struct wl_auth_event {
+       uint16 version;
+       uint16 length;
+       uint8 xtlvs[];
+} wl_auth_event_t;
+
+#define WL_AUTH_EVENT_FIXED_LEN_V1     OFFSETOF(wl_auth_event_t, xtlvs)
+#define WL_AUTH_EVENT_FIXED_LEN_V2     OFFSETOF(wl_auth_event_t, xtlvs)
+
+#define WL_PMKSA_EVENT_DATA_V1 1u
+
+/* tlv ids for PMKSA event */
+#define WL_PMK_TLV_ID          1u
+#define WL_PMKID_TLV_ID                2u
+#define WL_PEER_ADDR_TLV_ID    3u
+
+/* PMKSA event data structure */
+typedef struct wl_pmksa_event {
+       uint16 version;
+       uint16 length;
+       uint8 xtlvs[];
+} wl_pmksa_event_t;
+
+#define WL_PMKSA_EVENT_FIXED_LEN_V1    OFFSETOF(wl_pmksa_event_t, xtlvs)
+
+#define FILS_CACHE_ID_LEN      2u
+#define PMK_LEN_MAX            48u
+
+typedef struct _pmkid_v1 {
+       struct ether_addr       BSSID;
+       uint8                           PMKID[WPA2_PMKID_LEN];
+} pmkid_v1_t;
+
+#define PMKID_ELEM_V2_LENGTH (sizeof(struct ether_addr) + WPA2_PMKID_LEN + PMK_LEN_MAX + \
+       sizeof(ssid_info_t) + FILS_CACHE_ID_LEN)
+
+typedef struct _pmkid_v2 {
+       uint16                          length; /* Should match PMKID_ELEM_VX_LENGTH */
+       struct ether_addr       BSSID;
+       uint8                           PMKID[WPA2_PMKID_LEN];
+       uint8                           pmk[PMK_LEN_MAX]; /* for FILS key deriviation */
+       uint16                          pmk_len;
+       ssid_info_t                     ssid;
+       uint8                           fils_cache_id[FILS_CACHE_ID_LEN];
+} pmkid_v2_t;
+
+#define PMKID_LIST_VER_2       2
+
+typedef struct _pmkid_v3 {
+       struct ether_addr       bssid;
+       uint8                   pmkid[WPA2_PMKID_LEN];
+       uint8                   pmkid_len;
+       uint8                   pmk[PMK_LEN_MAX];
+       uint8                   pmk_len;
+       uint16                  fils_cache_id; /* 2-byte length */
+       uint8                   akm;
+       uint8                   ssid_len;
+       uint8                   ssid[DOT11_MAX_SSID_LEN]; /* For FILS, to save ESSID */
+                                                         /* one pmkid used in whole ESS */
+       uint32                  time_left; /* remaining time until expirary in sec. */
+                                          /* 0 means expired, all 0xFF means never expire */
+} pmkid_v3_t;
+
+#define PMKID_LIST_VER_3       3
+typedef struct _pmkid_list_v1 {
+       uint32  npmkid;
+       pmkid_v1_t      pmkid[1];
+} pmkid_list_v1_t;
+
+typedef struct _pmkid_list_v2 {
+       uint16  version;
+       uint16  length;
+       pmkid_v2_t      pmkid[1];
+} pmkid_list_v2_t;
+
+#define PMKDB_SET_IOVAR 1u
+#define PMKDB_GET_IOVAR 2u
+#define PMKDB_CLEAR_IOVAR 4u
+
+typedef struct _pmkid_list_v3 {
+       uint16          version;
+       uint16          length;
+       uint16          count;
+       uint16          flag;
+       pmkid_v3_t      pmkid[];
+} pmkid_list_v3_t;
+
+#ifndef PMKID_VERSION_ENABLED
+/* pmkid structure before versioning. legacy. DONOT update anymore here */
+typedef pmkid_v1_t pmkid_t;
+typedef pmkid_list_v1_t pmkid_list_t;
+#endif /* PMKID_VERSION_ENABLED */
+
+typedef struct _pmkid_cand {
+       struct ether_addr       BSSID;
+       uint8                   preauth;
+} pmkid_cand_t;
+
+typedef struct _pmkid_cand_list {
+       uint32  npmkid_cand;
+       pmkid_cand_t    pmkid_cand[1];
+} pmkid_cand_list_t;
+
+#define WL_STA_ANT_MAX         4       /**< max possible rx antennas */
+
+typedef struct wl_assoc_info {
+       uint32          req_len;
+       uint32          resp_len;
+       uint32          flags;
+       struct dot11_assoc_req req;
+       struct ether_addr reassoc_bssid; /**< used in reassoc's */
+       struct dot11_assoc_resp resp;
+       uint32          state;
+} wl_assoc_info_t;
+
+/** srom read/write struct passed through ioctl */
+typedef struct {
+       uint32  byteoff;        /**< byte offset */
+       uint32  nbytes;         /**< number of bytes */
+       uint16  buf[];
+} srom_rw_t;
+
+#define CISH_FLAG_PCIECIS      (1 << 15)       /**< write CIS format bit for PCIe CIS */
+
+/** similar cis (srom or otp) struct [iovar: may not be aligned] */
+typedef struct {
+       uint16  source;         /**< cis source */
+       uint16  flags;          /**< flags */
+       uint32  byteoff;        /**< byte offset */
+       uint32  nbytes;         /**< number of bytes */
+       /* data follows here */
+} cis_rw_t;
+
+/** R_REG and W_REG struct passed through ioctl */
+typedef struct {
+       uint32  byteoff;        /**< byte offset of the field in d11regs_t */
+       uint32  val;            /**< read/write value of the field */
+       uint32  size;           /**< sizeof the field */
+       uint32  band;           /**< band (optional) */
+} rw_reg_t;
+
+/**
+ * Structure used by GET/SET_ATTEN ioctls - it controls power in b/g-band
+ * PCL - Power Control Loop
+ */
+typedef struct {
+       uint16  auto_ctrl;      /**< WL_ATTEN_XX */
+       uint16  bb;             /**< Baseband attenuation */
+       uint16  radio;          /**< Radio attenuation */
+       uint16  txctl1;         /**< Radio TX_CTL1 value */
+} atten_t;
+
+/** Per-AC retry parameters */
+struct wme_tx_params_s {
+       uint8  short_retry;
+       uint8  short_fallback;
+       uint8  long_retry;
+       uint8  long_fallback;
+       uint16 max_rate;  /**< In units of 512 Kbps */
+};
+
+typedef struct wme_tx_params_s wme_tx_params_t;
+
+#define WL_WME_TX_PARAMS_IO_BYTES (sizeof(wme_tx_params_t) * AC_COUNT)
+
+/**Used to get specific link/ac parameters */
+typedef struct {
+       int32 ac;
+       uint8 val;
+       struct ether_addr ea;
+       uint8 PAD;
+} link_val_t;
+
+#define WL_PM_MUTE_TX_VER 1
+
+typedef struct wl_pm_mute_tx {
+       uint16 version;         /**< version */
+       uint16 len;             /**< length */
+       uint16 deadline;        /**< deadline timer (in milliseconds) */
+       uint8  enable;          /**< set to 1 to enable mode; set to 0 to disable it */
+       uint8 PAD;
+} wl_pm_mute_tx_t;
+
+/*
+ * Pay attention to version if structure changes.
+ */
+
+/* sta_info_t version 4 */
+typedef struct {
+       uint16                  ver;            /**< version of this struct */
+       uint16                  len;            /**< length in bytes of this structure */
+       uint16                  cap;            /**< sta's advertised capabilities */
+       uint16                  PAD;
+       uint32                  flags;          /**< flags defined below */
+       uint32                  idle;           /**< time since data pkt rx'd from sta */
+       struct ether_addr       ea;             /**< Station address */
+       uint16                  PAD;
+       wl_rateset_t    rateset;        /**< rateset in use */
+       uint32                  in;             /**< seconds elapsed since associated */
+       uint32                  listen_interval_inms; /**< Min Listen interval in ms for this STA */
+       uint32                  tx_pkts;        /**< # of user packets transmitted (unicast) */
+       uint32                  tx_failures;    /**< # of user packets failed */
+       uint32                  rx_ucast_pkts;  /**< # of unicast packets received */
+       uint32                  rx_mcast_pkts;  /**< # of multicast packets received */
+       uint32                  tx_rate;        /**< Rate used by last tx frame */
+       uint32                  rx_rate;        /**< Rate of last successful rx frame */
+       uint32                  rx_decrypt_succeeds;    /**< # of packet decrypted successfully */
+       uint32                  rx_decrypt_failures;    /**< # of packet decrypted unsuccessfully */
+       uint32                  tx_tot_pkts;    /**< # of user tx pkts (ucast + mcast) */
+       uint32                  rx_tot_pkts;    /**< # of data packets recvd (uni + mcast) */
+       uint32                  tx_mcast_pkts;  /**< # of mcast pkts txed */
+       uint64                  tx_tot_bytes;   /**< data bytes txed (ucast + mcast) */
+       uint64                  rx_tot_bytes;   /**< data bytes recvd (ucast + mcast) */
+       uint64                  tx_ucast_bytes; /**< data bytes txed (ucast) */
+       uint64                  tx_mcast_bytes; /**< # data bytes txed (mcast) */
+       uint64                  rx_ucast_bytes; /**< data bytes recvd (ucast) */
+       uint64                  rx_mcast_bytes; /**< data bytes recvd (mcast) */
+       int8                    rssi[WL_STA_ANT_MAX]; /**< average rssi per antenna
+                                                       * of data frames
+                                                       */
+       int8                    nf[WL_STA_ANT_MAX];     /**< per antenna noise floor */
+       uint16                  aid;                    /**< association ID */
+       uint16                  ht_capabilities;        /**< advertised ht caps */
+       uint16                  vht_flags;              /**< converted vht flags */
+       uint16                  PAD;
+       uint32                  tx_pkts_retried;        /**< # of frames where a retry was
+                                                        * necessary
+                                                        */
+       uint32                  tx_pkts_retry_exhausted; /**< # of user frames where a retry
+                                                         * was exhausted
+                                                         */
+       int8                    rx_lastpkt_rssi[WL_STA_ANT_MAX]; /**< Per antenna RSSI of last
+                                                                 * received data frame.
+                                                                 */
+       /* TX WLAN retry/failure statistics:
+        * Separated for host requested frames and WLAN locally generated frames.
+        * Include unicast frame only where the retries/failures can be counted.
+        */
+       uint32                  tx_pkts_total;          /**< # user frames sent successfully */
+       uint32                  tx_pkts_retries;        /**< # user frames retries */
+       uint32                  tx_pkts_fw_total;       /**< # FW generated sent successfully */
+       uint32                  tx_pkts_fw_retries;     /**< # retries for FW generated frames */
+       uint32                  tx_pkts_fw_retry_exhausted;     /**< # FW generated where a retry
+                                                                * was exhausted
+                                                                */
+       uint32                  rx_pkts_retried;        /**< # rx with retry bit set */
+       uint32                  tx_rate_fallback;       /**< lowest fallback TX rate */
+       /* Fields above this line are common to sta_info_t versions 4 and 5 */
+
+       uint32                  rx_dur_total;   /* total user RX duration (estimated) */
+
+       chanspec_t              chanspec;       /** chanspec this sta is on */
+       uint16                  PAD;
+       wl_rateset_args_v1_t    rateset_adv;    /* rateset along with mcs index bitmap */
+       uint32                  PAD;
+} sta_info_v4_t;
+
+/* Note: Version 4 is the latest version of sta_info_t.  Version 5 is abandoned.
+ * Please add new fields to version 4, not version 5.
+ */
+/* sta_info_t version 5 */
+typedef struct {
+       uint16                  ver;            /**< version of this struct */
+       uint16                  len;            /**< length in bytes of this structure */
+       uint16                  cap;            /**< sta's advertised capabilities */
+       uint16                  PAD;
+       uint32                  flags;          /**< flags defined below */
+       uint32                  idle;           /**< time since data pkt rx'd from sta */
+       struct ether_addr       ea;             /**< Station address */
+       uint16                  PAD;
+       wl_rateset_t            rateset;        /**< rateset in use */
+       uint32                  in;             /**< seconds elapsed since associated */
+       uint32                  listen_interval_inms; /**< Min Listen interval in ms for this STA */
+       uint32                  tx_pkts;        /**< # of user packets transmitted (unicast) */
+       uint32                  tx_failures;    /**< # of user packets failed */
+       uint32                  rx_ucast_pkts;  /**< # of unicast packets received */
+       uint32                  rx_mcast_pkts;  /**< # of multicast packets received */
+       uint32                  tx_rate;        /**< Rate used by last tx frame */
+       uint32                  rx_rate;        /**< Rate of last successful rx frame */
+       uint32                  rx_decrypt_succeeds;    /**< # of packet decrypted successfully */
+       uint32                  rx_decrypt_failures;    /**< # of packet decrypted unsuccessfully */
+       uint32                  tx_tot_pkts;    /**< # of user tx pkts (ucast + mcast) */
+       uint32                  rx_tot_pkts;    /**< # of data packets recvd (uni + mcast) */
+       uint32                  tx_mcast_pkts;  /**< # of mcast pkts txed */
+       uint64                  tx_tot_bytes;   /**< data bytes txed (ucast + mcast) */
+       uint64                  rx_tot_bytes;   /**< data bytes recvd (ucast + mcast) */
+       uint64                  tx_ucast_bytes; /**< data bytes txed (ucast) */
+       uint64                  tx_mcast_bytes; /**< # data bytes txed (mcast) */
+       uint64                  rx_ucast_bytes; /**< data bytes recvd (ucast) */
+       uint64                  rx_mcast_bytes; /**< data bytes recvd (mcast) */
+       int8                    rssi[WL_STA_ANT_MAX]; /**< average rssi per antenna
+                                                       * of data frames
+                                                       */
+       int8                    nf[WL_STA_ANT_MAX];     /**< per antenna noise floor */
+       uint16                  aid;                    /**< association ID */
+       uint16                  ht_capabilities;        /**< advertised ht caps */
+       uint16                  vht_flags;              /**< converted vht flags */
+       uint16                  PAD;
+       uint32                  tx_pkts_retried;        /**< # of frames where a retry was
+                                                        * necessary
+                                                        */
+       uint32                  tx_pkts_retry_exhausted; /**< # of user frames where a retry
+                                                         * was exhausted
+                                                         */
+       int8                    rx_lastpkt_rssi[WL_STA_ANT_MAX]; /**< Per antenna RSSI of last
+                                                                 * received data frame.
+                                                                 */
+       /* TX WLAN retry/failure statistics:
+        * Separated for host requested frames and WLAN locally generated frames.
+        * Include unicast frame only where the retries/failures can be counted.
+        */
+       uint32                  tx_pkts_total;          /**< # user frames sent successfully */
+       uint32                  tx_pkts_retries;        /**< # user frames retries */
+       uint32                  tx_pkts_fw_total;       /**< # FW generated sent successfully */
+       uint32                  tx_pkts_fw_retries;     /**< # retries for FW generated frames */
+       uint32                  tx_pkts_fw_retry_exhausted;     /**< # FW generated where a retry
+                                                                * was exhausted
+                                                                */
+       uint32                  rx_pkts_retried;        /**< # rx with retry bit set */
+       uint32                  tx_rate_fallback;       /**< lowest fallback TX rate */
+       /* Fields above this line are common to sta_info_t versions 4 and 5 */
+
+       chanspec_t              chanspec;       /** chanspec this sta is on */
+       uint16                  PAD;
+       wl_rateset_args_v1_t    rateset_adv;    /* rateset along with mcs index bitmap */
+} sta_info_v5_t;
+
+/*
+ * Pay attention to version if structure changes.
+ */
+
+/* sta_info_t version 6
+       changes to wl_rateset_args_t is leading to update this struct version as well.
+ */
+typedef struct {
+       uint16                  ver;            /**< version of this struct */
+       uint16                  len;            /**< length in bytes of this structure */
+       uint16                  cap;            /**< sta's advertised capabilities */
+       uint16                  PAD;
+       uint32                  flags;          /**< flags defined below */
+       uint32                  idle;           /**< time since data pkt rx'd from sta */
+       struct ether_addr       ea;             /**< Station address */
+       uint16                  PAD;
+       wl_rateset_t    rateset;        /**< rateset in use */
+       uint32                  in;             /**< seconds elapsed since associated */
+       uint32                  listen_interval_inms; /**< Min Listen interval in ms for this STA */
+       uint32                  tx_pkts;        /**< # of user packets transmitted (unicast) */
+       uint32                  tx_failures;    /**< # of user packets failed */
+       uint32                  rx_ucast_pkts;  /**< # of unicast packets received */
+       uint32                  rx_mcast_pkts;  /**< # of multicast packets received */
+       uint32                  tx_rate;        /**< Rate used by last tx frame */
+       uint32                  rx_rate;        /**< Rate of last successful rx frame */
+       uint32                  rx_decrypt_succeeds;    /**< # of packet decrypted successfully */
+       uint32                  rx_decrypt_failures;    /**< # of packet decrypted unsuccessfully */
+       uint32                  tx_tot_pkts;    /**< # of user tx pkts (ucast + mcast) */
+       uint32                  rx_tot_pkts;    /**< # of data packets recvd (uni + mcast) */
+       uint32                  tx_mcast_pkts;  /**< # of mcast pkts txed */
+       uint64                  tx_tot_bytes;   /**< data bytes txed (ucast + mcast) */
+       uint64                  rx_tot_bytes;   /**< data bytes recvd (ucast + mcast) */
+       uint64                  tx_ucast_bytes; /**< data bytes txed (ucast) */
+       uint64                  tx_mcast_bytes; /**< # data bytes txed (mcast) */
+       uint64                  rx_ucast_bytes; /**< data bytes recvd (ucast) */
+       uint64                  rx_mcast_bytes; /**< data bytes recvd (mcast) */
+       int8                    rssi[WL_STA_ANT_MAX]; /**< average rssi per antenna
+                                                       * of data frames
+                                                       */
+       int8                    nf[WL_STA_ANT_MAX];     /**< per antenna noise floor */
+       uint16                  aid;                    /**< association ID */
+       uint16                  ht_capabilities;        /**< advertised ht caps */
+       uint16                  vht_flags;              /**< converted vht flags */
+       uint16                  PAD;
+       uint32                  tx_pkts_retried;        /**< # of frames where a retry was
+                                                        * necessary
+                                                        */
+       uint32                  tx_pkts_retry_exhausted; /**< # of user frames where a retry
+                                                         * was exhausted
+                                                         */
+       int8                    rx_lastpkt_rssi[WL_STA_ANT_MAX]; /**< Per antenna RSSI of last
+                                                                 * received data frame.
+                                                                 */
+       /* TX WLAN retry/failure statistics:
+        * Separated for host requested frames and WLAN locally generated frames.
+        * Include unicast frame only where the retries/failures can be counted.
+        */
+       uint32                  tx_pkts_total;          /**< # user frames sent successfully */
+       uint32                  tx_pkts_retries;        /**< # user frames retries */
+       uint32                  tx_pkts_fw_total;       /**< # FW generated sent successfully */
+       uint32                  tx_pkts_fw_retries;     /**< # retries for FW generated frames */
+       uint32                  tx_pkts_fw_retry_exhausted;     /**< # FW generated where a retry
+                                                                * was exhausted
+                                                                */
+       uint32                  rx_pkts_retried;        /**< # rx with retry bit set */
+       uint32                  tx_rate_fallback;       /**< lowest fallback TX rate */
+       /* Fields above this line are common to sta_info_t versions 4 and 5 */
+
+       uint32                  rx_dur_total;   /* total user RX duration (estimated) */
+
+       chanspec_t              chanspec;       /** chanspec this sta is on */
+       uint16                  PAD;
+       wl_rateset_args_v2_t    rateset_adv;    /* rateset along with mcs index bitmap */
+} sta_info_v6_t;
+
+/* define to help support one version older sta_info_t from user level
+ * applications.
+ */
+#define WL_OLD_STAINFO_SIZE    OFFSETOF(sta_info_t, tx_tot_pkts)
+
+#define WL_STA_VER_4           4
+#define WL_STA_VER_5           5
+#define WL_STA_VER             WL_STA_VER_4
+
+#define SWDIV_STATS_VERSION_2 2
+#define SWDIV_STATS_CURRENT_VERSION SWDIV_STATS_VERSION_2
+
+struct wlc_swdiv_stats_v1 {
+       uint32 auto_en;
+       uint32 active_ant;
+       uint32 rxcount;
+       int32 avg_snr_per_ant0;
+       int32 avg_snr_per_ant1;
+       int32 avg_snr_per_ant2;
+       uint32 swap_ge_rxcount0;
+       uint32 swap_ge_rxcount1;
+       uint32 swap_ge_snrthresh0;
+       uint32 swap_ge_snrthresh1;
+       uint32 swap_txfail0;
+       uint32 swap_txfail1;
+       uint32 swap_timer0;
+       uint32 swap_timer1;
+       uint32 swap_alivecheck0;
+       uint32 swap_alivecheck1;
+       uint32 rxcount_per_ant0;
+       uint32 rxcount_per_ant1;
+       uint32 acc_rxcount;
+       uint32 acc_rxcount_per_ant0;
+       uint32 acc_rxcount_per_ant1;
+       uint32 tx_auto_en;
+       uint32 tx_active_ant;
+       uint32 rx_policy;
+       uint32 tx_policy;
+       uint32 cell_policy;
+       uint32 swap_snrdrop0;
+       uint32 swap_snrdrop1;
+       uint32 mws_antsel_ovr_tx;
+       uint32 mws_antsel_ovr_rx;
+       uint8 swap_trig_event_id;
+};
+
+struct wlc_swdiv_stats_v2 {
+       uint16  version;        /* version of the structure
+                                               * as defined by SWDIV_STATS_CURRENT_VERSION
+                                               */
+       uint16  length;         /* length of the entire structure */
+       uint32 auto_en;
+       uint32 active_ant;
+       uint32 rxcount;
+       int32 avg_snr_per_ant0;
+       int32 avg_snr_per_ant1;
+       int32 avg_snr_per_ant2;
+       uint32 swap_ge_rxcount0;
+       uint32 swap_ge_rxcount1;
+       uint32 swap_ge_snrthresh0;
+       uint32 swap_ge_snrthresh1;
+       uint32 swap_txfail0;
+       uint32 swap_txfail1;
+       uint32 swap_timer0;
+       uint32 swap_timer1;
+       uint32 swap_alivecheck0;
+       uint32 swap_alivecheck1;
+       uint32 rxcount_per_ant0;
+       uint32 rxcount_per_ant1;
+       uint32 acc_rxcount;
+       uint32 acc_rxcount_per_ant0;
+       uint32 acc_rxcount_per_ant1;
+       uint32 tx_auto_en;
+       uint32 tx_active_ant;
+       uint32 rx_policy;
+       uint32 tx_policy;
+       uint32 cell_policy;
+       uint32 swap_snrdrop0;
+       uint32 swap_snrdrop1;
+       uint32 mws_antsel_ovr_tx;
+       uint32 mws_antsel_ovr_rx;
+       uint32 swap_trig_event_id;
+};
+
+#define        WLC_NUMRATES    16      /**< max # of rates in a rateset */
+
+/**Used to get specific STA parameters */
+typedef struct {
+       uint32  val;
+       struct ether_addr ea;
+       uint16  PAD;
+} scb_val_t;
+
+/**Used by iovar versions of some ioctls, i.e. WLC_SCB_AUTHORIZE et al */
+typedef struct {
+       uint32 code;
+       scb_val_t ioctl_args;
+} authops_t;
+
+/** channel encoding */
+typedef struct channel_info {
+       int32 hw_channel;
+       int32 target_channel;
+       int32 scan_channel;
+} channel_info_t;
+
+/** For ioctls that take a list of MAC addresses */
+typedef struct maclist {
+       uint32 count;                   /**< number of MAC addresses */
+       struct ether_addr ea[1];        /**< variable length array of MAC addresses */
+} maclist_t;
+
+typedef struct wds_client_info {
+       char    ifname[INTF_NAME_SIZ];  /* WDS ifname */
+       struct  ether_addr ea;          /* WDS client MAC address */
+} wds_client_info_t;
+
+#define WDS_MACLIST_MAGIC      0xFFFFFFFF
+#define WDS_MACLIST_VERSION    1
+
+/* For wds MAC list ioctls */
+typedef struct wds_maclist {
+       uint32 count;                           /* Number of WDS clients */
+       uint32 magic;                           /* Magic number */
+       uint32 version;                         /* Version number */
+       struct wds_client_info  client_list[1]; /* Variable length array of WDS clients */
+} wds_maclist_t;
+
+/**get pkt count struct passed through ioctl */
+typedef struct get_pktcnt {
+       uint32 rx_good_pkt;
+       uint32 rx_bad_pkt;
+       uint32 tx_good_pkt;
+       uint32 tx_bad_pkt;
+       uint32 rx_ocast_good_pkt; /**< unicast packets destined for others */
+} get_pktcnt_t;
+
+/* NINTENDO2 */
+#define LQ_IDX_MIN              0
+#define LQ_IDX_MAX              1
+#define LQ_IDX_AVG              2
+#define LQ_IDX_SUM              2
+#define LQ_IDX_LAST             3
+#define LQ_STOP_MONITOR         0
+#define LQ_START_MONITOR        1
+
+/** Get averages RSSI, Rx PHY rate and SNR values */
+/* Link Quality */
+typedef struct {
+       int32 rssi[LQ_IDX_LAST];  /**< Array to keep min, max, avg rssi */
+       int32 snr[LQ_IDX_LAST];   /**< Array to keep min, max, avg snr */
+       int32 isvalid;            /**< Flag indicating whether above data is valid */
+} wl_lq_t;
+
+typedef enum wl_wakeup_reason_type {
+       LCD_ON = 1,
+       LCD_OFF,
+       DRC1_WAKE,
+       DRC2_WAKE,
+       REASON_LAST
+} wl_wr_type_t;
+
+typedef struct {
+       /** Unique filter id */
+       uint32  id;
+       /** stores the reason for the last wake up */
+       uint8   reason;
+       uint8   PAD[3];
+} wl_wr_t;
+
+/** Get MAC specific rate histogram command */
+typedef struct {
+       struct  ether_addr ea;  /**< MAC Address */
+       uint8   ac_cat; /**< Access Category */
+       uint8   num_pkts;       /**< Number of packet entries to be averaged */
+} wl_mac_ratehisto_cmd_t;
+/** Get MAC rate histogram response */
+/* deprecated after JAGUAR branch */
+typedef struct {
+       uint32  rate[DOT11_RATE_MAX + 1];       /**< Rates */
+       uint32  mcs[WL_RATESET_SZ_HT_IOCTL * WL_TX_CHAINS_MAX]; /**< MCS counts */
+       uint32  vht[WL_RATESET_SZ_VHT_MCS][WL_TX_CHAINS_MAX];   /**< VHT counts */
+       uint32  tsf_timer[2][2];        /**< Start and End time for 8bytes value */
+       uint32  prop11n_mcs[WLC_11N_LAST_PROP_MCS - WLC_11N_FIRST_PROP_MCS + 1]; /** MCS counts */
+} wl_mac_ratehisto_res_t;
+
+/* sta_info ecounters */
+typedef struct {
+       struct ether_addr   ea;                         /* Station MAC addr */
+       struct ether_addr   BSSID;                      /* BSSID of the BSS */
+       uint32              tx_pkts_fw_total;           /* # FW generated sent successfully */
+       uint32              tx_pkts_fw_retries;         /* # retries for FW generated frames */
+       uint32              tx_pkts_fw_retry_exhausted; /* # FW generated which
+                                                        * failed after retry
+                                                        */
+} sta_info_ecounters_t;
+
+#define STAMON_MODULE_VER              1
+
+/**Linux network driver ioctl encoding */
+typedef struct wl_ioctl {
+       uint32 cmd;     /**< common ioctl definition */
+       void *buf;      /**< pointer to user buffer */
+       uint32 len;     /**< length of user buffer */
+       uint8 set;              /**< 1=set IOCTL; 0=query IOCTL */
+       uint32 used;    /**< bytes read or written (optional) */
+       uint32 needed;  /**< bytes needed (optional) */
+} wl_ioctl_t;
+
+#ifdef CONFIG_COMPAT
+typedef struct compat_wl_ioctl {
+       uint32 cmd;     /**< common ioctl definition */
+       uint32 buf;     /**< pointer to user buffer */
+       uint32 len;     /**< length of user buffer */
+       uint8 set;              /**< 1=set IOCTL; 0=query IOCTL */
+       uint32 used;    /**< bytes read or written (optional) */
+       uint32 needed;  /**< bytes needed (optional) */
+} compat_wl_ioctl_t;
+#endif /* CONFIG_COMPAT */
+
+#define WL_NUM_RATES_CCK               4 /**< 1, 2, 5.5, 11 Mbps */
+#define WL_NUM_RATES_OFDM              8 /**< 6, 9, 12, 18, 24, 36, 48, 54 Mbps SISO/CDD */
+#define WL_NUM_RATES_MCS_1STREAM       8 /**< MCS 0-7 1-stream rates - SISO/CDD/STBC/MCS */
+#define WL_NUM_RATES_EXTRA_VHT         2 /**< Additional VHT 11AC rates */
+#define WL_NUM_RATES_VHT               10
+#define WL_NUM_RATES_VHT_ALL           (WL_NUM_RATES_VHT + WL_NUM_RATES_EXTRA_VHT)
+#define WL_NUM_RATES_HE                        12
+#define WL_NUM_RATES_MCS32             1
+#define UC_PATH_LEN                    128u /**< uCode path length */
+
+/*
+ * Structure for passing hardware and software
+ * revision info up from the driver.
+ */
+typedef struct wlc_rev_info {
+       uint32          vendorid;       /**< PCI vendor id */
+       uint32          deviceid;       /**< device id of chip */
+       uint32          radiorev;       /**< radio revision */
+       uint32          chiprev;        /**< chip revision */
+       uint32          corerev;        /**< core revision */
+       uint32          boardid;        /**< board identifier (usu. PCI sub-device id) */
+       uint32          boardvendor;    /**< board vendor (usu. PCI sub-vendor id) */
+       uint32          boardrev;       /**< board revision */
+       uint32          driverrev;      /**< driver version */
+       uint32          ucoderev;       /**< uCode version */
+       uint32          bus;            /**< bus type */
+       uint32          chipnum;        /**< chip number */
+       uint32          phytype;        /**< phy type */
+       uint32          phyrev;         /**< phy revision */
+       uint32          anarev;         /**< anacore rev */
+       uint32          chippkg;        /**< chip package info */
+       uint32          nvramrev;       /**< nvram revision number */
+       uint32          phyminorrev;    /**< phy minor rev */
+       uint32          coreminorrev;   /**< core minor rev */
+       uint32          drvrev_major;   /**< driver version: major */
+       uint32          drvrev_minor;   /**< driver version: minor */
+       uint32          drvrev_rc;      /**< driver version: rc */
+       uint32          drvrev_rc_inc;  /**< driver version: rc incremental */
+       uint16          ucodeprebuilt;  /**< uCode prebuilt flag */
+       uint16          ucodediffct;    /**< uCode diff count */
+       uchar           ucodeurl[128u]; /* obsolete, kept for ROM compatiblity */
+       uchar           ucodepath[UC_PATH_LEN]; /**< uCode URL or path */
+} wlc_rev_info_t;
+
+#define WL_REV_INFO_LEGACY_LENGTH      48
+
+#define WL_BRAND_MAX 10
+typedef struct wl_instance_info {
+       uint32 instance;
+       int8 brand[WL_BRAND_MAX];
+       int8 PAD[4-(WL_BRAND_MAX%4)];
+} wl_instance_info_t;
+
+/** structure to change size of tx fifo */
+typedef struct wl_txfifo_sz {
+       uint16  magic;
+       uint16  fifo;
+       uint16  size;
+} wl_txfifo_sz_t;
+
+/* Transfer info about an IOVar from the driver */
+/**Max supported IOV name size in bytes, + 1 for nul termination */
+#define WLC_IOV_NAME_LEN       (32 + 1)
+
+typedef struct wlc_iov_trx_s {
+       uint8 module;
+       uint8 type;
+       char name[WLC_IOV_NAME_LEN];
+} wlc_iov_trx_t;
+
+/** bump this number if you change the ioctl interface */
+#define WLC_IOCTL_VERSION      2
+#define WLC_IOCTL_VERSION_LEGACY_IOTYPES       1
+/* ifdef EXT_STA */
+typedef struct _wl_assoc_result {
+       ulong associated;
+       ulong NDIS_auth;
+       ulong NDIS_infra;
+} wl_assoc_result_t;
+/* EXT_STA */
+
+#define WL_PHY_PAVARS_LEN      64      /**< Phytype, Bandrange, chain, a[0], b[0], c[0], d[0] .. */
+
+#define WL_PHY_PAVAR_VER       1       /**< pavars version */
+#define WL_PHY_PAVARS2_NUM     3       /**< a1, b0, b1 */
+typedef struct wl_pavars2 {
+       uint16 ver;             /**< version of this struct */
+       uint16 len;             /**< len of this structure */
+       uint16 inuse;           /**< driver return 1 for a1,b0,b1 in current band range */
+       uint16 phy_type;        /**< phy type */
+       uint16 bandrange;
+       uint16 chain;
+       uint16 inpa[WL_PHY_PAVARS2_NUM];        /**< phy pavars for one band range */
+} wl_pavars2_t;
+
+typedef struct wl_po {
+       uint16  phy_type;       /**< Phy type */
+       uint16  band;
+       uint16  cckpo;
+       uint16  PAD;
+       uint32  ofdmpo;
+       uint16  mcspo[8];
+} wl_po_t;
+
+#define WL_NUM_RPCALVARS 5     /**< number of rpcal vars */
+
+typedef struct wl_rpcal {
+       uint16 value;
+       uint16 update;
+} wl_rpcal_t;
+
+#define WL_NUM_RPCALPHASEVARS 5        /* number of rpcal phase vars */
+
+typedef struct wl_rpcal_phase {
+       uint16 value;
+       uint16 update;
+} wl_rpcal_phase_t;
+
+typedef struct wl_aci_args {
+       int32 enter_aci_thresh; /* Trigger level to start detecting ACI */
+       int32 exit_aci_thresh; /* Trigger level to exit ACI mode */
+       int32 usec_spin; /* microsecs to delay between rssi samples */
+       int32 glitch_delay; /* interval between ACI scans when glitch count is consistently high */
+       uint16 nphy_adcpwr_enter_thresh;        /**< ADC power to enter ACI mitigation mode */
+       uint16 nphy_adcpwr_exit_thresh; /**< ADC power to exit ACI mitigation mode */
+       uint16 nphy_repeat_ctr;         /**< Number of tries per channel to compute power */
+       uint16 nphy_num_samples;        /**< Number of samples to compute power on one channel */
+       uint16 nphy_undetect_window_sz; /**< num of undetects to exit ACI Mitigation mode */
+       uint16 nphy_b_energy_lo_aci;    /**< low ACI power energy threshold for bphy */
+       uint16 nphy_b_energy_md_aci;    /**< mid ACI power energy threshold for bphy */
+       uint16 nphy_b_energy_hi_aci;    /**< high ACI power energy threshold for bphy */
+       uint16 nphy_noise_noassoc_glitch_th_up; /**< wl interference 4 */
+       uint16 nphy_noise_noassoc_glitch_th_dn;
+       uint16 nphy_noise_assoc_glitch_th_up;
+       uint16 nphy_noise_assoc_glitch_th_dn;
+       uint16 nphy_noise_assoc_aci_glitch_th_up;
+       uint16 nphy_noise_assoc_aci_glitch_th_dn;
+       uint16 nphy_noise_assoc_enter_th;
+       uint16 nphy_noise_noassoc_enter_th;
+       uint16 nphy_noise_assoc_rx_glitch_badplcp_enter_th;
+       uint16 nphy_noise_noassoc_crsidx_incr;
+       uint16 nphy_noise_assoc_crsidx_incr;
+       uint16 nphy_noise_crsidx_decr;
+} wl_aci_args_t;
+
+#define WL_ACI_ARGS_LEGACY_LENGTH      16      /**< bytes of pre NPHY aci args */
+
+#define        WL_MACFIFO_PLAY_ARGS_T_VERSION  1u      /* version of wl_macfifo_play_args_t struct */
+
+enum wl_macfifo_play_flags {
+       WL_MACFIFO_PLAY_STOP =          0x00u,  /* stop playing samples */
+       WL_MACFIFO_PLAY_START =         0x01u,  /* start playing samples */
+       WL_MACFIFO_PLAY_LOAD =          0x02u,  /* for set: load samples
+                                                  for get: samples are loaded
+                                                */
+       WL_MACFIFO_PLAY_GET_MAX_SIZE =  0x10u,  /* get the macfifo buffer size */
+       WL_MACFIFO_PLAY_GET_STATUS =    0x20u,  /* get macfifo play status */
+};
+
+typedef struct wl_macfifo_play_args {
+       uint16 version;         /* structure version */
+       uint16 len;             /* size of structure */
+       uint16 flags;
+       uint8 PAD[2];
+       uint32 data_len;        /* data length */
+} wl_macfifo_play_args_t;
+
+#define        WL_MACFIFO_PLAY_DATA_T_VERSION  1u      /* version of wl_macfifo_play_data_t struct */
+
+typedef struct wl_macfifo_play_data {
+       uint16 version;         /* structure version */
+       uint16 len;             /* size of structure */
+       uint32 data_len;        /* data length */
+} wl_macfifo_play_data_t;
+
+#define        WL_SAMPLECOLLECT_T_VERSION      2       /**< version of wl_samplecollect_args_t struct */
+typedef struct wl_samplecollect_args {
+       /* version 0 fields */
+       uint8 coll_us;
+       uint8 PAD[3];
+       int32 cores;
+       /* add'l version 1 fields */
+       uint16 version;     /**< see definition of WL_SAMPLECOLLECT_T_VERSION */
+       uint16 length;      /**< length of entire structure */
+       int8 trigger;
+       uint8 PAD;
+       uint16 timeout;
+       uint16 mode;
+       uint16 PAD;
+       uint32 pre_dur;
+       uint32 post_dur;
+       uint8 gpio_sel;
+       uint8 downsamp;
+       uint8 be_deaf;
+       uint8 agc;              /**< loop from init gain and going down */
+       uint8 filter;           /**< override high pass corners to lowest */
+       /* add'l version 2 fields */
+       uint8 trigger_state;
+       uint8 module_sel1;
+       uint8 module_sel2;
+       uint16 nsamps;
+       uint16 PAD;
+       int32 bitStart;
+       uint32 gpioCapMask;
+       uint8 gpio_collection;
+       uint8 PAD[3];
+} wl_samplecollect_args_t;
+
+#define        WL_SAMPLEDATA_T_VERSION         1       /**< version of wl_samplecollect_args_t struct */
+/* version for unpacked sample data, int16 {(I,Q),Core(0..N)} */
+#define        WL_SAMPLEDATA_T_VERSION_SPEC_AN 2
+
+typedef struct wl_sampledata {
+       uint16 version; /**< structure version */
+       uint16 size;    /**< size of structure */
+       uint16 tag;     /**< Header/Data */
+       uint16 length;  /**< data length */
+       uint32 flag;    /**< bit def */
+} wl_sampledata_t;
+
+/* WL_OTA START */
+/* OTA Test Status */
+enum {
+       WL_OTA_TEST_IDLE = 0,           /**< Default Idle state */
+       WL_OTA_TEST_ACTIVE = 1,         /**< Test Running */
+       WL_OTA_TEST_SUCCESS = 2,        /**< Successfully Finished Test */
+       WL_OTA_TEST_FAIL = 3            /**< Test Failed in the Middle */
+};
+
+/* OTA SYNC Status */
+enum {
+       WL_OTA_SYNC_IDLE = 0,   /**< Idle state */
+       WL_OTA_SYNC_ACTIVE = 1, /**< Waiting for Sync */
+       WL_OTA_SYNC_FAIL = 2    /**< Sync pkt not recieved */
+};
+
+/* Various error states dut can get stuck during test */
+enum {
+       WL_OTA_SKIP_TEST_CAL_FAIL = 1,          /**< Phy calibration failed */
+       WL_OTA_SKIP_TEST_SYNCH_FAIL = 2,        /**< Sync Packet not recieved */
+       WL_OTA_SKIP_TEST_FILE_DWNLD_FAIL = 3,   /**< Cmd flow file download failed */
+       WL_OTA_SKIP_TEST_NO_TEST_FOUND = 4,     /**< No test found in Flow file */
+       WL_OTA_SKIP_TEST_WL_NOT_UP = 5,         /**< WL UP failed */
+       WL_OTA_SKIP_TEST_UNKNOWN_CALL           /**< Unintentional scheduling on ota test */
+};
+
+/* Differentiator for ota_tx and ota_rx */
+enum {
+       WL_OTA_TEST_TX = 0,             /**< ota_tx */
+       WL_OTA_TEST_RX = 1,             /**< ota_rx */
+};
+
+/* Catch 3 modes of operation: 20Mhz, 40Mhz, 20 in 40 Mhz */
+enum {
+       WL_OTA_TEST_BW_20_IN_40MHZ = 0,         /**< 20 in 40 operation */
+       WL_OTA_TEST_BW_20MHZ = 1,               /**< 20 Mhz operation */
+       WL_OTA_TEST_BW_40MHZ = 2,               /**< full 40Mhz operation */
+       WL_OTA_TEST_BW_80MHZ = 3                /* full 80Mhz operation */
+};
+#define HT_MCS_INUSE   0x00000080      /* HT MCS in use,indicates b0-6 holds an mcs */
+#define VHT_MCS_INUSE  0x00000100      /* VHT MCS in use,indicates b0-6 holds an mcs */
+#define OTA_RATE_MASK 0x0000007f       /* rate/mcs value */
+#define OTA_STF_SISO   0
+#define OTA_STF_CDD            1
+#define OTA_STF_STBC   2
+#define OTA_STF_SDM            3
+
+typedef struct ota_rate_info {
+       uint8 rate_cnt;                                 /**< Total number of rates */
+       uint8 PAD;
+       uint16 rate_val_mbps[WL_OTA_TEST_MAX_NUM_RATE]; /**< array of rates from 1mbps to 130mbps */
+                                                       /**< for legacy rates : ratein mbps * 2 */
+                                                       /**< for HT rates : mcs index */
+} ota_rate_info_t;
+
+typedef struct ota_power_info {
+       int8 pwr_ctrl_on;       /**< power control on/off */
+       int8 start_pwr;         /**< starting power/index */
+       int8 delta_pwr;         /**< delta power/index */
+       int8 end_pwr;           /**< end power/index */
+} ota_power_info_t;
+
+typedef struct ota_packetengine {
+       uint16 delay;           /**< Inter-packet delay */
+                               /**< for ota_tx, delay is tx ifs in micro seconds */
+                               /* for ota_rx, delay is wait time in milliseconds */
+       uint16 nframes;         /**< Number of frames */
+       uint16 length;          /**< Packet length */
+} ota_packetengine_t;
+
+/*
+ * OTA txant/rxant parameter
+ *    bit7-4: 4 bits swdiv_tx/rx_policy bitmask, specify antenna-policy for SW diversity
+ *    bit3-0: 4 bits TxCore bitmask, specify cores used for transmit frames
+ *            (maximum spatial expansion)
+ */
+#define WL_OTA_TEST_ANT_MASK   0xF0
+#define WL_OTA_TEST_CORE_MASK  0x0F
+
+/* OTA txant/rxant 'ant_mask' field; map to Tx/Rx antenna policy for SW diversity */
+enum {
+       WL_OTA_TEST_FORCE_ANT0 = 0x10,  /* force antenna to Ant 0 */
+       WL_OTA_TEST_FORCE_ANT1 = 0x20,  /* force antenna to Ant 1 */
+};
+
+/* antenna/core fields access */
+#define WL_OTA_TEST_GET_ANT(_txant) ((_txant) & WL_OTA_TEST_ANT_MASK)
+#define WL_OTA_TEST_GET_CORE(_txant) ((_txant) & WL_OTA_TEST_CORE_MASK)
+
+/** Test info vector */
+typedef struct wl_ota_test_args {
+       uint8 cur_test;                 /**< test phase */
+       uint8 chan;                     /**< channel */
+       uint8 bw;                       /**< bandwidth */
+       uint8 control_band;             /**< control band */
+       uint8 stf_mode;                 /**< stf mode */
+       uint8 PAD;
+       ota_rate_info_t rt_info;        /**< Rate info */
+       ota_packetengine_t pkteng;      /**< packeteng info */
+       uint8 txant;                    /**< tx antenna */
+       uint8 rxant;                    /**< rx antenna */
+       ota_power_info_t pwr_info;      /**< power sweep info */
+       uint8 wait_for_sync;            /**< wait for sync or not */
+       uint8 ldpc;
+       uint8 sgi;
+       uint8 PAD;
+       /* Update WL_OTA_TESTVEC_T_VERSION for adding new members to this structure */
+} wl_ota_test_args_t;
+
+#define WL_OTA_TESTVEC_T_VERSION               1       /* version of wl_ota_test_vector_t struct */
+typedef struct wl_ota_test_vector {
+       uint16 version;
+       wl_ota_test_args_t test_arg[WL_OTA_TEST_MAX_NUM_SEQ];   /**< Test argument struct */
+       uint16 test_cnt;                                        /**< Total no of test */
+       uint8 file_dwnld_valid;                                 /**< File successfully downloaded */
+       uint8 sync_timeout;                                     /**< sync packet timeout */
+       int8 sync_fail_action;                                  /**< sync fail action */
+       struct ether_addr sync_mac;                             /**< macaddress for sync pkt */
+       struct ether_addr tx_mac;                               /**< macaddress for tx */
+       struct ether_addr rx_mac;                               /**< macaddress for rx */
+       int8 loop_test;                                 /**< dbg feature to loop the test */
+       uint16 test_rxcnt;
+       /* Update WL_OTA_TESTVEC_T_VERSION for adding new members to this structure */
+} wl_ota_test_vector_t;
+
+/** struct copied back form dongle to host to query the status */
+typedef struct wl_ota_test_status {
+       int16 cur_test_cnt;             /**< test phase */
+       int8 skip_test_reason;          /**< skip test reasoin */
+       uint8 PAD;
+       wl_ota_test_args_t test_arg;    /**< cur test arg details */
+       uint16 test_cnt;                /**< total no of test downloaded */
+       uint8 file_dwnld_valid;         /**< file successfully downloaded ? */
+       uint8 sync_timeout;             /**< sync timeout */
+       int8 sync_fail_action;          /**< sync fail action */
+       struct ether_addr sync_mac;     /**< macaddress for sync pkt */
+       struct ether_addr tx_mac;       /**< tx mac address */
+       struct ether_addr rx_mac;       /**< rx mac address */
+       uint8  test_stage;              /**< check the test status */
+       int8 loop_test;                 /**< Debug feature to puts test enfine in a loop */
+       uint8 sync_status;              /**< sync status */
+} wl_ota_test_status_t;
+
+/* FOR ioctl that take the sta monitor information */
+typedef struct stamon_data {
+       struct ether_addr  ea;
+       uint8 PAD[2];
+       int32 rssi;
+} stamon_data_t;
+
+typedef struct stamon_info {
+       int32 version;
+       uint32 count;
+       stamon_data_t sta_data[1];
+} stamon_info_t;
+
+typedef struct wl_ota_rx_rssi {
+       uint16  pktcnt;         /* Pkt count used for this rx test */
+       chanspec_t chanspec;    /* Channel info on which the packets are received */
+       int16   rssi;           /* Average RSSI of the first 50% packets received */
+} wl_ota_rx_rssi_t;
+
+#define        WL_OTARSSI_T_VERSION            1       /* version of wl_ota_test_rssi_t struct */
+#define WL_OTA_TEST_RSSI_FIXED_SIZE    OFFSETOF(wl_ota_test_rssi_t, rx_rssi)
+
+typedef struct wl_ota_test_rssi {
+       uint8 version;
+       uint8   testcnt;                /* total measured RSSI values, valid on output only */
+       wl_ota_rx_rssi_t rx_rssi[1]; /* Variable length array of wl_ota_rx_rssi_t */
+} wl_ota_test_rssi_t;
+
+/* WL_OTA END */
+
+/**wl_radar_args_t */
+typedef struct {
+       int32 npulses;  /**< required number of pulses at n * t_int */
+       int32 ncontig;  /**< required number of pulses at t_int */
+       int32 min_pw;   /**< minimum pulse width (20 MHz clocks) */
+       int32 max_pw;   /**< maximum pulse width (20 MHz clocks) */
+       uint16 thresh0; /**< Radar detection, thresh 0 */
+       uint16 thresh1; /**< Radar detection, thresh 1 */
+       uint16 blank;   /**< Radar detection, blank control */
+       uint16 fmdemodcfg;      /**< Radar detection, fmdemod config */
+       int32 npulses_lp;  /**< Radar detection, minimum long pulses */
+       int32 min_pw_lp; /**< Minimum pulsewidth for long pulses */
+       int32 max_pw_lp; /**< Maximum pulsewidth for long pulses */
+       int32 min_fm_lp; /**< Minimum fm for long pulses */
+       int32 max_span_lp;  /**< Maximum deltat for long pulses */
+       int32 min_deltat; /**< Minimum spacing between pulses */
+       int32 max_deltat; /**< Maximum spacing between pulses */
+       uint16 autocorr;        /**< Radar detection, autocorr on or off */
+       uint16 st_level_time;   /**< Radar detection, start_timing level */
+       uint16 t2_min; /**< minimum clocks needed to remain in state 2 */
+       uint8 PAD[2];
+       uint32 version; /**< version */
+       uint32 fra_pulse_err;   /**< sample error margin for detecting French radar pulsed */
+       int32 npulses_fra;  /**< Radar detection, minimum French pulses set */
+       int32 npulses_stg2;  /**< Radar detection, minimum staggered-2 pulses set */
+       int32 npulses_stg3;  /**< Radar detection, minimum staggered-3 pulses set */
+       uint16 percal_mask;     /**< defines which period cal is masked from radar detection */
+       uint8 PAD[2];
+       int32 quant;    /**< quantization resolution to pulse positions */
+       uint32 min_burst_intv_lp;       /**< minimum burst to burst interval for bin3 radar */
+       uint32 max_burst_intv_lp;       /**< maximum burst to burst interval for bin3 radar */
+       int32 nskip_rst_lp;     /**< number of skipped pulses before resetting lp buffer */
+       int32 max_pw_tol; /* maximum tolerance allowd in detected pulse width for radar detection */
+       uint16 feature_mask; /**< 16-bit mask to specify enabled features */
+       uint16 thresh0_sc;      /**< Radar detection, thresh 0 */
+       uint16 thresh1_sc;      /**< Radar detection, thresh 1 */
+       uint8 PAD[2];
+} wl_radar_args_t;
+
+#define WL_RADAR_ARGS_VERSION 2
+
+typedef struct {
+       uint32 version; /**< version */
+       uint16 thresh0_20_lo;   /**< Radar detection, thresh 0 (range 5250-5350MHz) for BW 20MHz */
+       uint16 thresh1_20_lo;   /**< Radar detection, thresh 1 (range 5250-5350MHz) for BW 20MHz */
+       uint16 thresh0_40_lo;   /**< Radar detection, thresh 0 (range 5250-5350MHz) for BW 40MHz */
+       uint16 thresh1_40_lo;   /**< Radar detection, thresh 1 (range 5250-5350MHz) for BW 40MHz */
+       uint16 thresh0_80_lo;   /**< Radar detection, thresh 0 (range 5250-5350MHz) for BW 80MHz */
+       uint16 thresh1_80_lo;   /**< Radar detection, thresh 1 (range 5250-5350MHz) for BW 80MHz */
+       uint16 thresh0_20_hi;   /**< Radar detection, thresh 0 (range 5470-5725MHz) for BW 20MHz */
+       uint16 thresh1_20_hi;   /**< Radar detection, thresh 1 (range 5470-5725MHz) for BW 20MHz */
+       uint16 thresh0_40_hi;   /**< Radar detection, thresh 0 (range 5470-5725MHz) for BW 40MHz */
+       uint16 thresh1_40_hi;   /**< Radar detection, thresh 1 (range 5470-5725MHz) for BW 40MHz */
+       uint16 thresh0_80_hi;   /**< Radar detection, thresh 0 (range 5470-5725MHz) for BW 80MHz */
+       uint16 thresh1_80_hi;   /**< Radar detection, thresh 1 (range 5470-5725MHz) for BW 80MHz */
+       uint16 thresh0_160_lo;  /**< Radar detection, thresh 0 (range 5250-5350MHz) for BW 160MHz */
+       uint16 thresh1_160_lo;  /**< Radar detection, thresh 1 (range 5250-5350MHz) for BW 160MHz */
+       uint16 thresh0_160_hi;  /**< Radar detection, thresh 0 (range 5470-5725MHz) for BW 160MHz */
+       uint16 thresh1_160_hi;  /**< Radar detection, thresh 1 (range 5470-5725MHz) for BW 160MHz */
+} wl_radar_thr_t;
+
+typedef struct {
+       uint32 version; /* version */
+       uint16 thresh0_sc_20_lo;
+       uint16 thresh1_sc_20_lo;
+       uint16 thresh0_sc_40_lo;
+       uint16 thresh1_sc_40_lo;
+       uint16 thresh0_sc_80_lo;
+       uint16 thresh1_sc_80_lo;
+       uint16 thresh0_sc_20_hi;
+       uint16 thresh1_sc_20_hi;
+       uint16 thresh0_sc_40_hi;
+       uint16 thresh1_sc_40_hi;
+       uint16 thresh0_sc_80_hi;
+       uint16 thresh1_sc_80_hi;
+       uint16 fc_varth_sb;
+       uint16 fc_varth_bin5_sb;
+       uint16 notradar_enb;
+       uint16 max_notradar_lp;
+       uint16 max_notradar;
+       uint16 max_notradar_lp_sc;
+       uint16 max_notradar_sc;
+       uint16 highpow_war_enb;
+       uint16 highpow_sp_ratio;        //unit is 0.5
+} wl_radar_thr2_t;
+
+#define WL_RADAR_THR_VERSION   2
+
+typedef struct {
+       uint32 ver;
+       uint32 len;
+       int32  rssi_th[3];
+       uint8  rssi_gain_80[4];
+       uint8  rssi_gain_160[4];
+} wl_dyn_switch_th_t;
+
+#define WL_PHY_DYN_SWITCH_TH_VERSION   1
+
+/** RSSI per antenna */
+typedef struct {
+       uint32  version;                /**< version field */
+       uint32  count;                  /**< number of valid antenna rssi */
+       int8 rssi_ant[WL_RSSI_ANT_MAX]; /**< rssi per antenna */
+       int8 rssi_sum;                  /**< summed rssi across all antennas */
+       int8 PAD[3];
+} wl_rssi_ant_t;
+
+/* SNR per antenna */
+typedef struct {
+       uint32  version;                                /* version field */
+       uint32  count;                                  /* number of valid antenna snr */
+       int8 snr_ant[WL_RSSI_ANT_MAX];  /* snr per antenna */
+} wl_snr_ant_t;
+
+/* Weighted average support */
+#define        WL_WA_VER               0       /* Initial version - Basic WA algorithm only */
+
+#define WL_WA_ALGO_BASIC       0       /* Basic weighted average algorithm (all 4 metrics) */
+#define WL_WA_TYPE_RSSI                0
+#define WL_WA_TYPE_SNR         1
+#define WL_WA_TYPE_TXRATE      2
+#define WL_WA_TYPE_RXRATE      3
+#define WL_WA_TYPE_MAX         4
+
+typedef struct {                       /* payload of subcmd in xtlv */
+       uint8 id;
+       uint8 n_total;                  /* Total number of samples (n_total >= n_recent) */
+       uint8 n_recent;                 /* Number of samples denoted as recent */
+       uint8 w_recent;                 /* Total weight for the recent samples (as percentage) */
+} wl_wa_basic_params_t;
+
+typedef struct {
+       uint16 ver;
+       uint16 len;
+       uint8 subcmd[];                 /* sub-cmd in bcm_xtlv_t */
+} wl_wa_cmd_t;
+
+/** data structure used in 'dfs_status' wl interface, which is used to query dfs status */
+typedef struct {
+       uint32 state;           /**< noted by WL_DFS_CACSTATE_XX. */
+       uint32 duration;                /**< time spent in ms in state. */
+       /**
+        * as dfs enters ISM state, it removes the operational channel from quiet channel
+        * list and notes the channel in channel_cleared. set to 0 if no channel is cleared
+        */
+       chanspec_t chanspec_cleared;
+       /** chanspec cleared used to be a uint32, add another to uint16 to maintain size */
+       uint16 pad;
+} wl_dfs_status_t;
+
+typedef struct {
+       uint32 state;           /* noted by WL_DFS_CACSTATE_XX */
+       uint32 duration;                /* time spent in ms in state */
+       chanspec_t chanspec;    /* chanspec of this core */
+       chanspec_t chanspec_last_cleared; /* chanspec last cleared for operation by scanning */
+       uint16 sub_type;        /* currently just the index of the core or the respective PLL */
+       uint16 pad;
+} wl_dfs_sub_status_t;
+
+#define WL_DFS_STATUS_ALL_VERSION      (1)
+typedef struct {
+       uint16 version;         /* version field; current max version 1 */
+       uint16 num_sub_status;
+       wl_dfs_sub_status_t  dfs_sub_status[1]; /* struct array of length num_sub_status */
+} wl_dfs_status_all_t;
+
+#define WL_DFS_AP_MOVE_VERSION (1)
+
+struct wl_dfs_ap_move_status_v1 {
+       int16 dfs_status;       /* DFS scan status */
+       chanspec_t chanspec;    /* New AP Chanspec */
+       wl_dfs_status_t cac_status;     /* CAC status */
+};
+
+typedef struct wl_dfs_ap_move_status_v2 {
+       int8 version;            /* version field; current max version 1 */
+       int8 move_status;        /* DFS move status */
+       chanspec_t chanspec;     /* New AP Chanspec */
+       wl_dfs_status_all_t scan_status; /* status; see dfs_status_all for wl_dfs_status_all_t */
+} wl_dfs_ap_move_status_v2_t;
+
+#define WL_DFS_AP_MOVE_ABORT -1                /* Abort any dfs_ap_move in progress immediately */
+#define WL_DFS_AP_MOVE_STUNT -2                /* Stunt move but continue background CSA if in progress */
+
+/** data structure used in 'radar_status' wl interface, which is use to query radar det status */
+typedef struct {
+       uint8 detected;
+       uint8 PAD[3];
+       int32 count;
+       uint8 pretended;
+       uint8 PAD[3];
+       uint32 radartype;
+       uint32 timenow;
+       uint32 timefromL;
+       int32  lp_csect_single;
+       int32  detected_pulse_index;
+       int32  nconsecq_pulses;
+       chanspec_t ch;
+       uint8 PAD[2];
+       int32  pw[10];
+       int32  intv[10];
+       int32  fm[10];
+} wl_radar_status_t;
+
+#define NUM_PWRCTRL_RATES 12
+
+typedef struct {
+       uint8 txpwr_band_max[NUM_PWRCTRL_RATES];        /**< User set target */
+       uint8 txpwr_limit[NUM_PWRCTRL_RATES];           /**< reg and local power limit */
+       uint8 txpwr_local_max;                          /**< local max according to the AP */
+       uint8 txpwr_local_constraint;                   /**< local constraint according to the AP */
+       uint8 txpwr_chan_reg_max;                       /**< Regulatory max for this channel */
+       uint8 txpwr_target[2][NUM_PWRCTRL_RATES];       /**< Latest target for 2.4 and 5 Ghz */
+       uint8 txpwr_est_Pout[2];                        /**< Latest estimate for 2.4 and 5 Ghz */
+       uint8 txpwr_opo[NUM_PWRCTRL_RATES];             /**< On G phy, OFDM power offset */
+       uint8 txpwr_bphy_cck_max[NUM_PWRCTRL_RATES];    /**< Max CCK power for this band (SROM) */
+       uint8 txpwr_bphy_ofdm_max;                      /**< Max OFDM power for this band (SROM) */
+       uint8 txpwr_aphy_max[NUM_PWRCTRL_RATES];        /**< Max power for A band (SROM) */
+       int8  txpwr_antgain[2];                         /**< Ant gain for each band - from SROM */
+       uint8 txpwr_est_Pout_gofdm;                     /**< Pwr estimate for 2.4 OFDM */
+} tx_power_legacy_t;
+
+#define WL_TX_POWER_RATES_LEGACY    45
+#define WL_TX_POWER_MCS20_FIRST         12
+#define WL_TX_POWER_MCS20_NUM           16
+#define WL_TX_POWER_MCS40_FIRST         28
+#define WL_TX_POWER_MCS40_NUM           17
+
+typedef struct {
+       uint32 flags;
+       chanspec_t chanspec;                 /**< txpwr report for this channel */
+       chanspec_t local_chanspec;           /**< channel on which we are associated */
+       uint8 local_max;                 /**< local max according to the AP */
+       uint8 local_constraint;              /**< local constraint according to the AP */
+       int8  antgain[2];                /**< Ant gain for each band - from SROM */
+       uint8 rf_cores;                  /**< count of RF Cores being reported */
+       uint8 est_Pout[4];                           /**< Latest tx power out estimate per RF
+                                                         * chain without adjustment
+                                                         */
+       uint8 est_Pout_cck;                          /**< Latest CCK tx power out estimate */
+       uint8 user_limit[WL_TX_POWER_RATES_LEGACY];  /**< User limit */
+       uint8 reg_limit[WL_TX_POWER_RATES_LEGACY];   /**< Regulatory power limit */
+       uint8 board_limit[WL_TX_POWER_RATES_LEGACY]; /**< Max power board can support (SROM) */
+       uint8 target[WL_TX_POWER_RATES_LEGACY];      /**< Latest target power */
+       uint8 PAD[2];
+} tx_power_legacy2_t;
+
+#define WL_NUM_2x2_ELEMENTS            4
+#define WL_NUM_3x3_ELEMENTS            6
+#define WL_NUM_4x4_ELEMENTS            10
+
+typedef struct {
+       uint16 ver;                             /**< version of this struct */
+       uint16 len;                             /**< length in bytes of this structure */
+       uint32 flags;
+       chanspec_t chanspec;                    /**< txpwr report for this channel */
+       chanspec_t local_chanspec;              /**< channel on which we are associated */
+       uint32     buflen;                      /**< ppr buffer length */
+       uint8      pprbuf[1];                   /**< Latest target power buffer */
+} wl_txppr_t;
+
+#define WL_TXPPR_VERSION       1
+#define WL_TXPPR_LENGTH        (sizeof(wl_txppr_t))
+#define TX_POWER_T_VERSION     45
+#define TX_POWER_T_VERSION_V2  46
+
+/* curpower ppr types */
+enum {
+       PPRTYPE_TARGETPOWER     =       1,
+       PPRTYPE_BOARDLIMITS     =       2,
+       PPRTYPE_REGLIMITS       =       3,
+       PPRTYPE_RU_REGLIMITS    =       4,
+       PPRTYPE_RU_BOARDLIMITS  =       5,
+       PPRTYPE_RU_TARGETPOWER  =       6,
+       PPRTYPE_DYNAMIC_INFO    =       7,
+       PPRTYPE_LAST
+};
+
+/** number of ppr serialization buffers, it should be reg, board and target */
+#define WL_TXPPR_SER_BUF_NUM   (PPRTYPE_LAST - 1)
+
+typedef struct chanspec_txpwr_max {
+       chanspec_t chanspec;   /**< chanspec */
+       uint8 txpwr_max;       /**< max txpwr in all the rates */
+       uint8 padding;
+} chanspec_txpwr_max_t;
+
+typedef struct  wl_chanspec_txpwr_max {
+       uint16 ver;                     /**< version of this struct */
+       uint16 len;                     /**< length in bytes of this structure */
+       uint32 count;           /**< number of elements of (chanspec, txpwr_max) pair */
+       chanspec_txpwr_max_t txpwr[1];  /**< array of (chanspec, max_txpwr) pair */
+} wl_chanspec_txpwr_max_t;
+
+#define WL_CHANSPEC_TXPWR_MAX_VER      1
+#define WL_CHANSPEC_TXPWR_MAX_LEN      (sizeof(wl_chanspec_txpwr_max_t))
+
+typedef struct tx_inst_power {
+       uint8 txpwr_est_Pout[2];                        /**< Latest estimate for 2.4 and 5 Ghz */
+       uint8 txpwr_est_Pout_gofdm;                     /**< Pwr estimate for 2.4 OFDM */
+} tx_inst_power_t;
+
+#define WL_NUM_TXCHAIN_MAX     4
+typedef struct wl_txchain_pwr_offsets {
+       int8 offset[WL_NUM_TXCHAIN_MAX];        /**< quarter dBm signed offset for each chain */
+} wl_txchain_pwr_offsets_t;
+
+/** maximum channels returned by the get valid channels iovar */
+#define WL_NUMCHANNELS         64
+#define WL_NUMCHANNELS_MANY_CHAN 10
+#define WL_ITER_LIMIT_MANY_CHAN 5
+
+#define WL_MIMO_PS_CFG_VERSION_1 1
+
+typedef struct wl_mimops_cfg {
+       uint8 version;
+       /* active_chains: 0 for all, 1 for 1 chain. */
+       uint8 active_chains;
+       /* static (0) or dynamic (1).or disabled (3) Mode applies only when active_chains = 0. */
+       uint8 mode;
+       /* bandwidth = Full (0), 20M (1), 40M (2), 80M (3). */
+       uint8 bandwidth;
+       uint8 applychangesafterlearning;
+       uint8 pad[3];
+} wl_mimops_cfg_t;
+
+/* This event is for tracing MIMO PS metrics snapshot calls.
+ * It is helpful to debug out-of-sync issue between
+ * ucode SHM values and FW snapshot calculation.
+ * It is part of the EVENT_LOG_TAG_MIMO_PS_TRACE.
+ */
+#define WL_MIMO_PS_METRICS_SNAPSHOT_TRACE_TYPE 0
+typedef struct wl_mimo_ps_metrics_snapshot_trace {
+       /* type field for this TLV: */
+       uint16  type;
+       /* length field for this TLV */
+       uint16  len;
+       uint32  idle_slotcnt_mimo;      /* MIMO idle slotcnt raw SHM value */
+       uint32  last_idle_slotcnt_mimo; /* stored value snapshot */
+       uint32  idle_slotcnt_siso;      /* SISO idle slotcnt raw SHM value */
+       uint32  last_idle_slotcnt_siso; /* stored value snapshot */
+       uint32  rx_time_mimo;           /* Rx MIMO raw SHM value */
+       uint32  last_rx_time_mimo;      /* stored value snapshot */
+       uint32  rx_time_siso;           /* RX SISO raw SHM value */
+       uint32  last_rx_time_siso;      /* stored value snapshot */
+       uint32  tx_time_1chain;         /* Tx 1-chain raw SHM value */
+       uint32  last_tx_time_1chain;    /* stored value snapshot */
+       uint32  tx_time_2chain;         /* Tx 2-chain raw SHM value */
+       uint32  last_tx_time_2chain;    /* stored value snapshot */
+       uint32  tx_time_3chain;         /* Tx 3-chain raw SHM value */
+       uint32  last_tx_time_3chain;    /* stored value snapshot */
+       uint16  reason;                 /* reason for snapshot call, see below */
+       /* Does the call reset last values after delta calculation */
+       uint16  reset_last;
+} wl_mimo_ps_metrics_snapshot_trace_t;
+/* reason codes for mimo ps metrics snapshot function calls */
+#define WL_MIMOPS_METRICS_SNAPSHOT_REPORT              1
+#define WL_MIMOPS_METRICS_SNAPSHOT_RXCHAIN_SET         2
+#define WL_MIMOPS_METRICS_SNAPSHOT_ARBI                        3
+#define WL_MIMOPS_METRICS_SNAPSHOT_SLOTUPD             4
+#define WL_MIMOPS_METRICS_SNAPSHOT_PMBCNRX             5
+#define WL_MIMOPS_METRICS_SNAPSHOT_BMACINIT            6
+#define WL_MIMOPS_METRICS_SNAPSHOT_HT_COMPLETE         7
+#define WL_MIMOPS_METRICS_SNAPSHOT_OCL                  8
+
+#define WL_MIMO_PS_STATUS_VERSION_2    2
+typedef struct wl_mimo_ps_status {
+       uint8 version;
+       uint8 ap_cap;                   /* The associated AP's capability (BW, MIMO/SISO). */
+       uint8 association_status;       /* How we are associated to the AP (MIMO/SISO). */
+       uint8 mimo_ps_state;            /* mimo_ps_cfg states: [0-5]. See below for values */
+       uint8 mrc_state;                /* MRC state: NONE (0), ACTIVE(1) */
+       uint8 bss_rxchain;              /* bss rxchain bitmask */
+       uint8 bss_txchain;              /* bss txchain bitmask */
+       uint8 bss_bw;                   /* bandwidth: Full (0), 20M (1), 40M (2), 80M (3), etc */
+       uint16 hw_state;                /* bitmask of hw state. See below for values */
+       uint8 hw_rxchain;               /* actual HW rxchain bitmask */
+       uint8 hw_txchain;               /* actual HW txchain bitmask */
+       uint8 hw_bw;                    /* bandwidth: Full (0), 20M (1), 40M (2), 80M (3), etc */
+       uint8 pm_bcnrx_state;           /* actual state of ucode flag */
+       uint8 basic_rates_present;      /* internal flag to trigger siso bcmc rx */
+       uint8 siso_bcmc_rx_state;       /* actual state of ucode flag */
+} wl_mimo_ps_status_t;
+
+#define WL_MIMO_PS_STATUS_VERSION_1    1
+typedef struct wl_mimo_ps_status_v1 {
+       uint8 version;
+       uint8 ap_cap;                   /* The associated AP's capability (BW, MIMO/SISO). */
+       uint8 association_status;       /* How we are associated to the AP (MIMO/SISO). */
+       uint8 mimo_ps_state;            /* mimo_ps_cfg states: [0-5]. See below for values */
+       uint8 mrc_state;                /* MRC state: NONE (0), ACTIVE(1) */
+       uint8 bss_rxchain;              /* bss rxchain bitmask */
+       uint8 bss_txchain;              /* bss txchain bitmask */
+       uint8 bss_bw;                   /* bandwidth: Full (0), 20M (1), 40M (2), 80M (3), etc */
+       uint16 hw_state;                /* bitmask of hw state. See below for values */
+       uint8 hw_rxchain;               /* actual HW rxchain bitmask */
+       uint8 hw_txchain;               /* actual HW txchain bitmask */
+       uint8 hw_bw;                    /* bandwidth: Full (0), 20M (1), 40M (2), 80M (3), etc */
+       uint8 pad[3];
+} wl_mimo_ps_status_v1_t;
+
+#define WL_MIMO_PS_STATUS_AP_CAP(ap_cap)       (ap_cap & 0x0F)
+#define WL_MIMO_PS_STATUS_AP_CAP_BW(ap_cap)    (ap_cap >> 4)
+#define WL_MIMO_PS_STATUS_ASSOC_BW_SHIFT 4
+
+/* version 3: assoc status: low nibble is status enum, high other flags */
+#define WL_MIMO_PS_STATUS_VERSION_3                    3
+#define WL_MIMO_PS_STATUS_ASSOC_STATUS_MASK            0x0F
+#define WL_MIMO_PS_STATUS_ASSOC_STATUS_VHT_WITHOUT_OMN 0x80
+
+/* mimo_ps_status: ap_cap/association status */
+enum {
+       WL_MIMO_PS_STATUS_ASSOC_NONE    = 0,
+       WL_MIMO_PS_STATUS_ASSOC_SISO    = 1,
+       WL_MIMO_PS_STATUS_ASSOC_MIMO    = 2,
+       WL_MIMO_PS_STATUS_ASSOC_LEGACY  = 3
+};
+
+/* mimo_ps_status: mimo_ps_cfg states */
+enum {
+       WL_MIMO_PS_CFG_STATE_NONE                       = 0,
+       WL_MIMO_PS_CFG_STATE_INFORM_AP_INPROGRESS       = 1,
+       WL_MIMO_PS_CFG_STATE_INFORM_AP_DONE             = 2,
+       WL_MIMO_PS_CFG_STATE_LEARNING                   = 3,
+       WL_MIMO_PS_CFG_STATE_HW_CONFIGURE               = 4,
+       WL_MIMO_PS_CFG_STATE_INFORM_AP_PENDING          = 5
+};
+
+/* mimo_ps_status: hw_state values */
+#define WL_MIMO_PS_STATUS_HW_STATE_NONE                        0
+#define WL_MIMO_PS_STATUS_HW_STATE_LTECOEX             (0x1 << 0)
+#define WL_MIMO_PS_STATUS_HW_STATE_MIMOPS_BSS          (0x1 << 1)
+
+#define WL_MIMO_PS_STATUS_HW_STATE_SCAN                        (0x1 << 3)
+#define WL_MIMO_PS_STATUS_HW_STATE_TXPPR               (0x1 << 4)
+#define WL_MIMO_PS_STATUS_HW_STATE_PWRTHOTTLE          (0x1 << 5)
+#define WL_MIMO_PS_STATUS_HW_STATE_TMPSENSE            (0x1 << 6)
+#define WL_MIMO_PS_STATUS_HW_STATE_IOVAR               (0x1 << 7)
+#define WL_MIMO_PS_STATUS_HW_STATE_AP_BSS              (0x1 << 8)
+
+/* mimo_ps_status: mrc states */
+#define WL_MIMO_PS_STATUS_MRC_NONE     0
+#define WL_MIMO_PS_STATUS_MRC_ACTIVE   1
+
+/* mimo_ps_status: core flag states for single-core beacon and siso-bcmc rx */
+#define WL_MIMO_PS_STATUS_MHF_FLAG_NONE                0
+#define WL_MIMO_PS_STATUS_MHF_FLAG_ACTIVE      1
+#define WL_MIMO_PS_STATUS_MHF_FLAG_COREDOWN    2
+#define WL_MIMO_PS_STATUS_MHF_FLAG_INVALID     3
+
+/* Type values for the REASON */
+#define WL_MIMO_PS_PS_LEARNING_ABORTED          (1 << 0)
+#define WL_MIMO_PS_PS_LEARNING_COMPLETED        (1 << 1)
+#define WL_MIMO_PS_PS_LEARNING_ONGOING          (1 << 2)
+
+typedef struct wl_mimo_ps_learning_event_data {
+       uint32 startTimeStamp;
+       uint32 endTimeStamp;
+       uint16 reason;
+       struct ether_addr BSSID;
+       uint32 totalSISO_below_rssi_threshold;
+       uint32 totalMIMO_below_rssi_threshold;
+       uint32 totalSISO_above_rssi_threshold;
+       uint32 totalMIMO_above_rssi_threshold;
+} wl_mimo_ps_learning_event_data_t;
+
+#define WL_MIMO_PS_PS_LEARNING_CFG_ABORT       (1 << 0)
+#define WL_MIMO_PS_PS_LEARNING_CFG_STATUS      (1 << 1)
+#define WL_MIMO_PS_PS_LEARNING_CFG_CONFIG      (1 << 2)
+#define WL_MIMO_PS_PS_LEARNING_CFG_MASK                (0x7)
+
+#define WL_MIMO_PS_PS_LEARNING_CFG_V1 1
+
+typedef struct wl_mimops_learning_cfg {
+       /* flag:  bit 0 for abort */
+       /* flag:  bit 1 for status */
+       /* flag:  bit 2 for configuring no of packets and rssi */
+       uint8                  flag;
+       /* mimo ps learning version, compatible version is 0 */
+       uint8                  version;
+       /* if version is 0 or rssi is 0, ignored */
+       int8                   learning_rssi_threshold;
+       uint8                  reserved;
+       uint32                 no_of_packets_for_learning;
+       wl_mimo_ps_learning_event_data_t mimops_learning_data;
+} wl_mimops_learning_cfg_t;
+
+#define WL_OCL_STATUS_VERSION 1
+typedef struct ocl_status_info {
+       uint8  version;
+       uint8  len;
+       uint16 fw_status;     /* Bits representing FW disable reasons */
+       uint8  hw_status;     /* Bits for actual HW config and SISO/MIMO coremask */
+       uint8  coremask;      /* The ocl core mask (indicating listening core) */
+} ocl_status_info_t;
+
+/* MWS OCL map */
+#define WL_MWS_OCL_OVERRIDE_VERSION 1
+typedef struct wl_mws_ocl_override {
+       uint16  version;    /* Structure version */
+       uint16  bitmap_2g; /* bitmap for 2.4G channels bits 1-13 */
+       uint16  bitmap_5g_lo;  /* bitmap for 5G low channels by 2:
+                               *34-48, 52-56, 60-64, 100-102
+                               */
+       uint16  bitmap_5g_mid; /* bitmap for 5G mid channels by 2:
+                               * 104, 108-112, 116-120, 124-128,
+                               * 132-136, 140, 149-151
+                               */
+       uint16  bitmap_5g_high; /* bitmap for 5G high channels by 2
+                               * 153, 157-161, 165
+                               */
+} wl_mws_ocl_override_t;
+
+/* Bits for fw_status */
+#define OCL_DISABLED_HOST              0x01   /* Host has disabled through ocl_enable */
+#define OCL_DISABLED_RSSI              0x02   /* Disabled because of ocl_rssi_threshold */
+#define OCL_DISABLED_LTEC              0x04   /* Disabled due to LTE Coex activity */
+#define OCL_DISABLED_SISO              0x08   /* Disabled while in SISO mode */
+#define OCL_DISABLED_CAL               0x10   /* Disabled during active calibration */
+#define OCL_DISABLED_CHANSWITCH                0x20   /* Disabled during active channel switch */
+#define OCL_DISABLED_ASPEND            0x40   /* Disabled due to assoc pending */
+#define OCL_DISABLED_SEQ_RANGE         0x80   /* Disabled during SEQ Ranging */
+
+/* Bits for hw_status */
+#define OCL_HWCFG                      0x01   /* State of OCL config bit in phy HW */
+#define OCL_HWMIMO                     0x02   /* Set if current coremask is > 1 bit */
+#define OCL_COREDOWN                   0x80   /* Set if core is currently down */
+
+#define WL_OPS_CFG_VERSION_1  1
+/* Common IOVAR struct */
+typedef struct wl_ops_cfg_v1 {
+       uint16  version;
+       uint16 len;             /* total length includes fixed fields and variable data[] */
+       uint16 subcmd_id;       /* subcommand id */
+       uint16 padding;         /* reserved / padding for 4 byte align */
+       uint8 data[];           /* subcommand data; could be empty */
+} wl_ops_cfg_v1_t;
+
+/* subcommands ids */
+enum {
+       WL_OPS_CFG_SUBCMD_ENABLE =              0,      /* OPS enable/disable mybss and obss
+                                                        * for nav and plcp options
+                                                        */
+       WL_OPS_CFG_SUBCMD_MAX_SLEEP_DUR =       1,      /* Max sleep duration used for OPS */
+       WL_OPS_CFG_SUBCMD_RESET_STATS =         2       /* Reset stats part of ops_status
+                                                        * on both slices
+                                                        */
+};
+
+#define WL_OPS_CFG_MASK                                0xffff
+#define WL_OPS_CFG_CAP_MASK                    0xffff0000
+#define WL_OPS_CFG_CAP_SHIFT                   16      /* Shift bits to locate the OPS CAP */
+#define WL_OPS_MAX_SLEEP_DUR                   12500   /* max ops duration in us */
+#define WL_OPS_MINOF_MAX_SLEEP_DUR             512     /* minof max ops duration in us */
+#define WL_OPS_SUPPORTED_CFG                   (WL_OPS_MYBSS_PLCP_DUR | WL_OPS_MYBSS_NAV_DUR \
+                                                | WL_OPS_OBSS_PLCP_DUR | WL_OPS_OBSS_NAV_DUR)
+#define WL_OPS_DEFAULT_CFG                     WL_OPS_SUPPORTED_CFG
+
+/* WL_OPS_CFG_SUBCMD_ENABLE */
+typedef struct wl_ops_cfg_enable {
+       uint32   bits;   /* selectively enable ops for mybss and obss */
+} wl_ops_cfg_enable_t;
+/* Bits for WL_OPS_CFG_SUBCMD_ENABLE Parameter */
+#define WL_OPS_MYBSS_PLCP_DUR          0x1     /* OPS based on mybss 11b & 11n mixed HT frames
+                                                * PLCP header duration
+                                                */
+#define WL_OPS_MYBSS_NAV_DUR           0x2     /* OPS based on mybss RTS-CTS duration */
+#define WL_OPS_OBSS_PLCP_DUR           0x4     /* OPS based on obss 11b & 11n mixed HT frames
+                                                * PLCP header duration
+                                                */
+#define WL_OPS_OBSS_NAV_DUR            0x8     /* OPS based on obss RTS-CTS duration */
+
+/* WL_OPS_CFG_SUBCMD_MAX_SLEEP_DUR */
+typedef struct wl_ops_cfg_max_sleep_dur {
+       uint32  val;   /* maximum sleep duration (us) used for OPS */
+} wl_ops_cfg_max_sleep_dur_t;
+
+/* WL_OPS_CFG_SUBCMD_RESET_STATS */
+typedef struct wl_ops_cfg_reset_stats {
+       uint32  val;   /* bitmap of slices, 0 means all slices */
+} wl_ops_cfg_reset_stats_t;
+
+#define WL_OPS_STATUS_VERSION_1 1
+#define OPS_DUR_HIST_BINS      5       /* number of bins used, 0-1, 1-2, 2-4, 4-8, >8 msec */
+typedef struct wl_ops_status_v1 {
+       uint16  version;
+       uint16  len;                    /* Total length including all fixed fields */
+       uint8   slice_index;            /* Slice for which status is reported */
+       uint8   disable_obss;           /* indicate if obss cfg is disabled */
+       uint8   pad[2];                 /* 4-byte alignment */
+       uint32  disable_reasons;        /* FW disable reasons */
+       uint32  disable_duration;       /* ops disable time(ms) due to disable reasons */
+       uint32  applied_ops_config;     /* currently applied ops config */
+       uint32  partial_ops_dur;        /* Total time (in usec) of partial ops duration */
+       uint32  full_ops_dur;           /* Total time (in usec) of full ops duration */
+       uint32  count_dur_hist[OPS_DUR_HIST_BINS];      /* ops occurrence histogram */
+       uint32  nav_cnt;                /* number of times ops triggered based NAV duration */
+       uint32  plcp_cnt;               /* number of times ops triggered based PLCP duration */
+       uint32  mybss_cnt;              /* number of times mybss ops trigger */
+       uint32  obss_cnt;               /* number of times obss ops trigger */
+       uint32  miss_dur_cnt;           /* number of times ops couldn't happen
+                                        * due to insufficient duration
+                                        */
+       uint32  miss_premt_cnt;         /* number of times ops couldn't happen due
+                                        * to not meeting Phy preemption thresh
+                                        */
+       uint32  max_dur_cnt;            /* number of times ops did not trigger due to
+                                        * frames exceeding max sleep duration
+                                        */
+       uint32  wake_cnt;               /* number of ops miss due to wake reason */
+       uint32  bcn_wait_cnt;           /* number of ops miss due to waiting for bcn */
+} wl_ops_status_v1_t;
+/* Bits for disable_reasons */
+#define OPS_DISABLED_HOST      0x01    /* Host has disabled through ops_cfg */
+#define OPS_DISABLED_UNASSOC   0x02    /* Disabled because the slice is in unassociated state */
+#define OPS_DISABLED_SCAN      0x04    /* Disabled because the slice is in scan state */
+#define OPS_DISABLED_BCN_MISS  0x08    /* Disabled because beacon missed for a duration */
+
+#define WL_PSBW_CFG_VERSION_1  1
+/* Common IOVAR struct */
+typedef struct wl_psbw_cfg_v1 {
+       uint16  version;
+       uint16 len;                     /* total length includes fixed fields and variable data[] */
+       uint16 subcmd_id;               /* subcommand id */
+       uint16 pad;                     /* reserved / padding for 4 byte align */
+       uint8 data[];                   /* subcommand data */
+} wl_psbw_cfg_v1_t;
+
+/* subcommands ids */
+enum {
+       /* PSBW enable/disable */
+       WL_PSBW_CFG_SUBCMD_ENABLE =                0,
+       /* override psbw disable requests */
+       WL_PSBW_CFG_SUBCMD_OVERRIDE_DISABLE_MASK = 1,
+       /* Reset stats part of psbw status */
+       WL_PSBW_CFG_SUBCMD_RESET_STATS =           2
+};
+
+#define WL_PSBW_OVERRIDE_DISA_CFG_MASK                 0x0000ffff
+#define WL_PSBW_OVERRIDE_DISA_CAP_MASK                 0xffff0000
+#define WL_PSBW_OVERRIDE_DISA_CAP_SHIFT                        16  /* shift bits for cap */
+
+/* WL_PSBW_CFG_SUBCMD_ENABLE */
+typedef struct wl_psbw_cfg_enable {
+       bool   enable;          /* enable or disable */
+} wl_psbw_cfg_enable_t;
+
+/* WL_PSBW_CFG_SUBCMD_OVERRIDE_DISABLE_MASK */
+typedef struct wl_psbw_cfg_override_disable_mask {
+       uint32  mask;           /* disable requests to override, cap and current cfg */
+} wl_psbw_cfg_override_disable_mask_t;
+
+/* WL_PSBW_CFG_SUBCMD_RESET_STATS */
+typedef struct wl_psbw_cfg_reset_stats {
+       uint32  val;            /* infra interface index, 0 */
+} wl_psbw_cfg_reset_stats_t;
+
+#define WL_PSBW_STATUS_VERSION_1 1
+typedef struct wl_psbw_status_v1 {
+       uint16  version;
+       uint16  len;                    /* total length including all fixed fields */
+       uint8   curr_slice_index;       /* current slice index of the interface */
+       uint8   associated;             /* interface associatd */
+       chanspec_t   chspec;            /* radio chspec */
+       uint32  state;                  /* psbw state */
+       uint32  disable_reasons;        /* FW disable reasons */
+       uint32  slice_enable_dur;       /* time(ms) psbw remains enabled on this slice */
+       uint32  total_enable_dur;       /* time(ms) psbw remains enabled total */
+       uint32  enter_cnt;              /* total cnt entering PSBW active */
+       uint32  exit_cnt;               /* total cnt exiting PSBW active */
+       uint32  exit_imd_cnt;           /* total cnt imd exit when waited N tbtts */
+       uint32  enter_skip_cnt;         /* total cnt entering PSBW active skipped */
+} wl_psbw_status_v1_t;
+
+/* Bit for state */
+#define PSBW_ACTIVE                            0x1 /* active 20MHz */
+#define PSBW_TTTT_PEND                         0x2 /* waiting for TTTT intr */
+#define PSBW_WAIT_ENTER                                0x4 /* in wait period before entering */
+#define PSBW_CAL_DONE                          0x8 /* 20M channel cal done */
+
+/* Bits for disable_reasons */
+#define WL_PSBW_DISA_HOST                      0x00000001 /* Host has disabled through psbw_cfg */
+#define WL_PSBW_DISA_AP20M                     0x00000002 /* AP is operating on 20 MHz */
+#define WL_PSBW_DISA_SLOTTED_BSS               0x00000004 /* slot_bss active */
+#define WL_PSBW_DISA_NOT_PMFAST                        0x00000008 /* Not PM_FAST */
+#define WL_PSBW_DISA_BASICRATESET              0x00000010 /* BasicRateSet is empty */
+#define WL_PSBW_DISA_NOT_D3                    0x00000020 /* PCIe not in D3 */
+#define WL_PSBW_DISA_CSA                       0x00000040 /* CSA IE is present */
+#define WL_PSBW_DISA_ASSOC                     0x00000080 /* assoc state is active/or unassoc */
+#define WL_PSBW_DISA_SCAN                      0x00000100 /* scan state is active */
+#define WL_PSBW_DISA_CAL                       0x00000200 /* cal pending or active */
+#define WL_PSBW_DISA_BCN_OFFLOAD               0x00000400 /* PSBW disabled due to scan
+                                                           * core beacon offload
+                                                           */
+/* following are not part of disable reasons */
+#define WL_PSBW_EXIT_PM                                0x00001000 /* Out of PM */
+#define WL_PSBW_EXIT_TIM                       0x00002000 /* unicast TIM bit present */
+#define WL_PSBW_EXIT_DATA                      0x00004000 /* Data for transmission */
+#define WL_PSBW_EXIT_MGMTDATA                  0x00008000 /* management frame for transmission */
+#define WL_PSBW_EXIT_BW_UPD                    0x00010000 /* BW being updated */
+#define WL_PSBW_DISA_NONE                      0x80000000 /* reserved for internal use only */
+
+/* DVFS */
+#define DVFS_CMND_VERSION_1 1
+/* Common IOVAR struct */
+typedef struct dvfs_cmnd_v1 {
+       uint16 ver;                             /* version of this structure */
+       uint16 len;                             /* includes both fixed and variable data[] fields */
+       uint32 subcmd;                          /* subcommand id */
+       uint8 data[];                           /* subcommand data */
+} dvfs_cmnd_v1_t;
+
+/* subcommand ids */
+enum {
+       DVFS_SUBCMD_ENABLE = 0,                 /* DVFS enable/disable, 1-byte data
+                                                * DVFS enable:1, disable:0
+                                                */
+       DVFS_SUBCMD_LDV =    1,                 /* DVFS force arm state to LDV, 1-byte data
+                                                * DVFS force LDV ON 1, LDV OFF 0
+                                                */
+       DVFS_SUBCMD_STATUS = 2,                 /* DVFS status, data[] contains dvfs_status */
+       DVFS_SUBCMD_HIST =   3,                 /* DVFS history, data[] contains
+                                                * history of dvfs state change
+                                                */
+       DVFS_SUBCMD_LAST
+};
+
+/* DVFS Status */
+/* current DVFS state request for ARM */
+#define DVFS_STATE_BIT_MASK                    0x0Fu
+#define DVFS_STATE_BIT_SHIFT                   0u
+/* Bit value for DVFS state request */
+#define DVFS_STATE_LDV                         0u
+#define DVFS_STATE_NDV                         1u
+/* current DVFS status */
+#define DVFS_STATUS_BIT_MASK                   0xF0u
+#define DVFS_STATUS_BIT_SHIFT                  4u
+/* Bit value for DVFS status */
+#define DVFS_STATUS_LDV                                0u
+#define DVFS_STATUS_NDV                                1u
+/* DVFS bits are for status, raw request and active request */
+/* 4387b0 supports only status bits for aux, main, and bt */
+/* 4387c0 supports all eight status and request bits */
+#define DVFS_BIT_AUX_MASK                      0x0001u
+#define DVFS_BIT_AUX_SHIFT                     0u
+#define DVFS_BIT_AUX_VAL(_val)                 (((_val) & DVFS_BIT_AUX_MASK) \
+                                               >> DVFS_BIT_AUX_SHIFT)
+#define DVFS_BIT_MAIN_MASK                     0x0002u
+#define DVFS_BIT_MAIN_SHIFT                    1u
+#define DVFS_BIT_MAIN_VAL(_val)                        (((_val) & DVFS_BIT_MAIN_MASK) \
+                                               >> DVFS_BIT_MAIN_SHIFT)
+#define DVFS_BIT_BT_MASK                       0x0004u
+#define DVFS_BIT_BT_SHIFT                      2u
+#define DVFS_BIT_BT_VAL(_val)                  (((_val) & DVFS_BIT_BT_MASK) \
+                                               >> DVFS_BIT_BT_SHIFT)
+#define DVFS_BIT_CHIPC_MASK                    0x0008u
+#define DVFS_BIT_CHIPC_SHIFT                   3u
+#define DVFS_BIT_CHIPC_VAL(_val)               (((_val) & DVFS_BIT_CHIPC_MASK) \
+                                               >> DVFS_BIT_CHIPC_SHIFT)
+#define DVFS_BIT_PCIE_MASK                     0x0010u
+#define DVFS_BIT_PCIE_SHIFT                    4u
+#define DVFS_BIT_PCIE_VAL(_val)                        (((_val) & DVFS_BIT_PCIE_MASK) \
+                                               >> DVFS_BIT_PCIE_SHIFT)
+#define DVFS_BIT_ARM_MASK                      0x0020u
+#define DVFS_BIT_ARM_SHIFT                     5u
+#define DVFS_BIT_ARM_VAL(_val)                 (((_val) & DVFS_BIT_ARM_MASK) \
+                                               >> DVFS_BIT_ARM_SHIFT)
+#define DVFS_BIT_SCAN_MASK                     0x0040u
+#define DVFS_BIT_SCAN_SHIFT                    6u
+#define DVFS_BIT_SCAN_VAL(_val)                        (((_val) & DVFS_BIT_SCAN_MASK) \
+                                               >> DVFS_BIT_SCAN_SHIFT)
+#define DVFS_BIT_BTSCAN_MASK                   0x0080u
+#define DVFS_BIT_BTSCAN_SHIFT                  7u
+#define DVFS_BIT_BTSCAN_VAL(_val)              (((_val) & DVFS_BIT_BTSCAN_MASK) \
+                                               >> DVFS_BIT_BTSCAN_SHIFT)
+/* to convert voltage to volt from multiple of 10mVolt */
+#define DVFS_CONVERT_TO_VOLT                   100u
+
+/* status version for 4387b0 */
+#define DVFS_STATUS_VERSION_1                  1
+typedef struct dvfs_status_v1 {
+       uint16  version;                        /* version of dvfs_status */
+       uint16  len;                            /* total length including all fixed fields */
+       uint8   info;                           /* current dvfs state request and status */
+       uint8   voltage;                        /* voltage (multiple of 10mV) */
+       uint16  freq;                           /* arm clock frequency (in MHz) */
+       uint32  state_change_count;             /* total state (LDV/NDV) transition count */
+       uint32  ldv_duration;                   /* total time (ms) in LDV */
+       uint32  ndv_duration;                   /* total time (ms) in NDV */
+       uint16  status;                         /* status bits */
+       uint16  pad;                            /* word aligned for size */
+} dvfs_status_v1_t;
+#define DVFS_STATUS_VER_1_LEN                  (sizeof(dvfs_status_v1_t))
+/* status version for 4387c0 */
+#define DVFS_STATUS_VERSION_2                  2
+typedef struct dvfs_status_v2 {
+       uint16  version;                        /* version of dvfs_status */
+       uint16  len;                            /* total length including all fixed fields */
+       uint8   info;                           /* current dvfs state request and status */
+       uint8   voltage;                        /* voltage (multiple of 10mV) */
+       uint16  freq;                           /* arm clock frequency (in MHz) */
+       uint32  state_change_count;             /* total state (LDV/NDV) transition count */
+       uint32  ldv_duration;                   /* total time (ms) in LDV */
+       uint32  ndv_duration;                   /* total time (ms) in NDV */
+       uint16  status;                         /* status bits */
+       uint16  raw_request;                    /* raw request bits */
+       uint16  active_request;                 /* active request bits */
+} dvfs_status_v2_t;
+#define DVFS_STATUS_VER_2_LEN                  (sizeof(dvfs_status_v2_t))
+
+/* DVFS_SUBCMD_HIST */
+#define DVFS_HIST_CMD_VERSION_1 1
+typedef struct dvfs_hist_cmd_v1 {
+       uint16 version;                         /* version of this structure */
+       uint16 len;                             /* includes both fixed and variable data[] fields */
+       uint8 data[];                           /* subcommand data : array of dvfs_hist_v1_t */
+} dvfs_hist_cmd_v1_t;
+
+/* DVFS_SUBCMD_HIST data[] payload */
+typedef struct dvfs_hist_v1 {
+       uint8 old_state;                        /* old state */
+       uint8 new_state;                        /* new state */
+       uint16 reason;                          /* reason for state change */
+       uint32 timestamp;                       /* timestamp of state change */
+} dvfs_hist_v1_t;
+
+/* Bits for DVFS state change reason */
+#define WL_DVFS_REASON_NOTPM                   0x0001u /* Not PM */
+#define WL_DVFS_REASON_MPC                     0x0002u /* MPC */
+#define WL_DVFS_REASON_TX_ACTIVE               0x0004u /* TX Active */
+#define WL_DVFS_REASON_DBGST_ACTIVE            0x0008u /* Power state ative */
+#define WL_DVFS_REASON_DBGST_ASLEEP            0x0010u /* Power state asleep */
+#define WL_DVFS_REASON_LTR_ACTIVE              0x0020u /* LTR Active */
+#define WL_DVFS_REASON_HOST                    0x0040u /* Host disabled */
+
+/*
+ * Join preference iovar value is an array of tuples. Each tuple has a one-byte type,
+ * a one-byte length, and a variable length value.  RSSI type tuple must be present
+ * in the array.
+ *
+ * Types are defined in "join preference types" section.
+ *
+ * Length is the value size in octets. It is reserved for WL_JOIN_PREF_WPA type tuple
+ * and must be set to zero.
+ *
+ * Values are defined below.
+ *
+ * 1. RSSI - 2 octets
+ * offset 0: reserved
+ * offset 1: reserved
+ *
+ * 2. WPA - 2 + 12 * n octets (n is # tuples defined below)
+ * offset 0: reserved
+ * offset 1: # of tuples
+ * offset 2: tuple 1
+ * offset 14: tuple 2
+ * ...
+ * offset 2 + 12 * (n - 1) octets: tuple n
+ *
+ * struct wpa_cfg_tuple {
+ *   uint8 akm[DOT11_OUI_LEN+1];     akm suite
+ *   uint8 ucipher[DOT11_OUI_LEN+1]; unicast cipher suite
+ *   uint8 mcipher[DOT11_OUI_LEN+1]; multicast cipher suite
+ * };
+ *
+ * multicast cipher suite can be specified as a specific cipher suite or WL_WPA_ACP_MCS_ANY.
+ *
+ * 3. BAND - 2 octets
+ * offset 0: reserved
+ * offset 1: see "band preference" and "band types"
+ *
+ * 4. BAND RSSI - 2 octets
+ * offset 0: band types
+ * offset 1: +ve RSSI boost value in dB
+ */
+
+struct tsinfo_arg {
+       uint8 octets[3];
+};
+
+#define RATE_CCK_1MBPS 0
+#define RATE_CCK_2MBPS 1
+#define RATE_CCK_5_5MBPS 2
+#define RATE_CCK_11MBPS 3
+
+#define RATE_LEGACY_OFDM_6MBPS 0
+#define RATE_LEGACY_OFDM_9MBPS 1
+#define RATE_LEGACY_OFDM_12MBPS 2
+#define RATE_LEGACY_OFDM_18MBPS 3
+#define RATE_LEGACY_OFDM_24MBPS 4
+#define RATE_LEGACY_OFDM_36MBPS 5
+#define RATE_LEGACY_OFDM_48MBPS 6
+#define RATE_LEGACY_OFDM_54MBPS 7
+
+#define WL_BSSTRANS_RSSI_RATE_MAP_VERSION 1
+#define WL_BSSTRANS_RSSI_RATE_MAP_VERSION_V1 1
+#define WL_BSSTRANS_RSSI_RATE_MAP_VERSION_V2 2
+
+typedef struct wl_bsstrans_rssi {
+       int8 rssi_2g;   /**< RSSI in dbm for 2.4 G */
+       int8 rssi_5g;   /**< RSSI in dbm for 5G, unused for cck */
+} wl_bsstrans_rssi_t;
+
+#define RSSI_RATE_MAP_MAX_STREAMS 4    /**< max streams supported */
+
+/** RSSI to rate mapping, all 20Mhz, no SGI */
+typedef struct wl_bsstrans_rssi_rate_map_v2 {
+       uint16 ver;
+       uint16 len; /**< length of entire structure */
+       wl_bsstrans_rssi_t cck[WL_NUM_RATES_CCK]; /**< 2.4G only */
+       wl_bsstrans_rssi_t ofdm[WL_NUM_RATES_OFDM]; /**< 6 to 54mbps */
+       wl_bsstrans_rssi_t phy_n[RSSI_RATE_MAP_MAX_STREAMS][WL_NUM_RATES_MCS_1STREAM]; /* MCS0-7 */
+       wl_bsstrans_rssi_t phy_ac[RSSI_RATE_MAP_MAX_STREAMS][WL_NUM_RATES_VHT_ALL]; /**< MCS0-11 */
+       wl_bsstrans_rssi_t phy_ax[RSSI_RATE_MAP_MAX_STREAMS][WL_NUM_RATES_HE]; /**< MCS0-11 */
+} wl_bsstrans_rssi_rate_map_v2_t;
+
+/** RSSI to rate mapping, all 20Mhz, no SGI */
+typedef struct wl_bsstrans_rssi_rate_map_v1 {
+       uint16 ver;
+       uint16 len; /**< length of entire structure */
+       wl_bsstrans_rssi_t cck[WL_NUM_RATES_CCK]; /**< 2.4G only */
+       wl_bsstrans_rssi_t ofdm[WL_NUM_RATES_OFDM]; /**< 6 to 54mbps */
+       wl_bsstrans_rssi_t phy_n[RSSI_RATE_MAP_MAX_STREAMS][WL_NUM_RATES_MCS_1STREAM]; /* MCS0-7 */
+       wl_bsstrans_rssi_t phy_ac[RSSI_RATE_MAP_MAX_STREAMS][WL_NUM_RATES_VHT]; /**< MCS0-9 */
+} wl_bsstrans_rssi_rate_map_v1_t;
+
+/** RSSI to rate mapping, all 20Mhz, no SGI */
+typedef struct wl_bsstrans_rssi_rate_map {
+       uint16 ver;
+       uint16 len; /**< length of entire structure */
+       wl_bsstrans_rssi_t cck[WL_NUM_RATES_CCK]; /**< 2.4G only */
+       wl_bsstrans_rssi_t ofdm[WL_NUM_RATES_OFDM]; /**< 6 to 54mbps */
+       wl_bsstrans_rssi_t phy_n[RSSI_RATE_MAP_MAX_STREAMS][WL_NUM_RATES_MCS_1STREAM]; /* MCS0-7 */
+       wl_bsstrans_rssi_t phy_ac[RSSI_RATE_MAP_MAX_STREAMS][WL_NUM_RATES_VHT]; /**< MCS0-9 */
+} wl_bsstrans_rssi_rate_map_t;
+
+#define WL_BSSTRANS_ROAMTHROTTLE_VERSION 1
+
+/** Configure number of scans allowed per throttle period */
+typedef struct wl_bsstrans_roamthrottle {
+       uint16 ver;
+       uint16 period;
+       uint16 scans_allowed;
+} wl_bsstrans_roamthrottle_t;
+
+#define        NFIFO                   6       /**< # tx/rx fifopairs */
+
+#ifndef NFIFO_EXT
+#if defined(BCM_AQM_DMA_DESC) && !defined(BCM_AQM_DMA_DESC_DISABLED)
+#define NFIFO_EXT              10              /* 4EDCA + 4 TWT + 1 Mcast/Bcast + 1 Spare */
+#elif defined(WL11AX_TRIGGERQ) && !defined(WL11AX_TRIGGERQ_DISABLED)
+#define NFIFO_EXT              10
+#else
+#define NFIFO_EXT              NFIFO
+#endif /* BCM_AQM_DMA_DESC && !BCM_AQM_DMA_DESC_DISABLED */
+#endif /* NFIFO_EXT */
+
+/* When new reason codes are added to list, Please update wl_reinit_names also */
+/* Reinit reason codes */
+enum {
+       WL_REINIT_RC_NONE             = 0,
+       WL_REINIT_RC_PS_SYNC          = 1,
+       WL_REINIT_RC_PSM_WD           = 2,
+       WL_REINIT_RC_MAC_WAKE         = 3,
+       WL_REINIT_RC_MAC_SUSPEND      = 4,
+       WL_REINIT_RC_MAC_SPIN_WAIT    = 5,
+       WL_REINIT_RC_AXI_BUS_ERROR    = 6,
+       WL_REINIT_RC_DEVICE_REMOVED   = 7,
+       WL_REINIT_RC_PCIE_FATAL_ERROR = 8,
+       WL_REINIT_RC_OL_FW_TRAP       = 9,
+       WL_REINIT_RC_FIFO_ERR         = 10,
+       WL_REINIT_RC_INV_TX_STATUS    = 11,
+       WL_REINIT_RC_MQ_ERROR         = 12,
+       WL_REINIT_RC_PHYTXERR_THRESH  = 13,
+       WL_REINIT_RC_USER_FORCED      = 14,
+       WL_REINIT_RC_FULL_RESET       = 15,
+       WL_REINIT_RC_AP_BEACON        = 16,
+       WL_REINIT_RC_PM_EXCESSED      = 17,
+       WL_REINIT_RC_NO_CLK           = 18,
+       WL_REINIT_RC_SW_ASSERT        = 19,
+       WL_REINIT_RC_PSM_JMP0         = 20,
+       WL_REINIT_RC_PSM_RUN          = 21,
+       WL_REINIT_RC_ENABLE_MAC       = 22,
+       WL_REINIT_RC_SCAN_TIMEOUT     = 23,
+       WL_REINIT_RC_JOIN_TIMEOUT     = 24,
+       /* Below error codes are generated during D3 exit validation */
+       WL_REINIT_RC_LINK_NOT_ACTIVE  = 25,
+       WL_REINIT_RC_PCI_CFG_RD_FAIL  = 26,
+       WL_REINIT_RC_INV_VEN_ID       = 27,
+       WL_REINIT_RC_INV_DEV_ID       = 28,
+       WL_REINIT_RC_INV_BAR0         = 29,
+       WL_REINIT_RC_INV_BAR2         = 30,
+       WL_REINIT_RC_AER_UC_FATAL     = 31,
+       WL_REINIT_RC_AER_UC_NON_FATAL = 32,
+       WL_REINIT_RC_AER_CORR         = 33,
+       WL_REINIT_RC_AER_DEV_STS      = 34,
+       WL_REINIT_RC_PCIe_STS         = 35,
+       WL_REINIT_RC_MMIO_RD_FAIL     = 36,
+       WL_REINIT_RC_MMIO_RD_INVAL    = 37,
+       WL_REINIT_RC_MMIO_ARM_MEM_RD_FAIL = 38,
+       WL_REINIT_RC_MMIO_ARM_MEM_INVAL   = 39,
+       WL_REINIT_RC_SROM_LOAD_FAILED     = 40,
+       WL_REINIT_RC_PHY_CRASH            = 41,
+       WL_REINIT_TX_STALL                = 42,
+       WL_REINIT_RC_TX_FLOW_CONTROL_BLOCKED    = 43,
+       WL_REINIT_RC_RX_HC_FAIL           = 44,
+       WL_REINIT_RC_RX_DMA_STALL         = 45,
+       WL_REINIT_UTRACE_BUF_OVERLAP_SR   = 46,
+       WL_REINIT_UTRACE_TPL_OUT_BOUNDS   = 47,
+       WL_REINIT_UTRACE_TPL_OSET_STRT0   = 48,
+       WL_REINIT_RC_PHYTXERR             = 49,
+       WL_REINIT_RC_PSM_FATAL_SUSP       = 50,
+       WL_REINIT_RC_TX_FIFO_SUSP         = 51,
+       WL_REINIT_RC_MAC_ENABLE           = 52,
+       WL_REINIT_RC_SCAN_STALLED         = 53,
+       WL_REINIT_RC_PHY_HC               = 54,
+       WL_REINIT_RC_LAST,      /* DONOT use this any more, kept for legacy reasons */
+       WL_REINIT_RC_RADIO_CRASH          = 55,
+       WL_REINIT_RC_SUPPORTED_LAST     /* Use for app ONLY, DONOT use this in wlc code.
+                                        * For wlc, use WL_REINIT_RC_VERSIONED_LAST
+                                        */
+};
+
+#define WL_REINIT_RC_V2                (2u)
+#define WL_REINIT_RC_LAST_V2   (WL_REINIT_RC_RADIO_CRASH)
+
+#define WL_REINIT_RC_INVALID   255
+
+#define NREINITREASONCOUNT     8
+/* NREINITREASONCOUNT is 8 in other branches.
+ * Any change to this will break wl tool compatibility with other branches
+ * #define NREINITREASONCOUNT  WL_REINIT_RC_LAST
+ */
+/* REINITRSNIDX is kept for legacy reasons. Use REINIT_RSN_IDX for new versioned structure */
+#define REINITRSNIDX(_x)       (((_x) < WL_REINIT_RC_LAST) ? (_x) : 0)
+#define REINIT_RSN_IDX(_x)     (((_x) < WL_REINIT_RC_SUPPORTED_LAST) ? (_x) : 0)
+
+#define        WL_CNT_T_VERSION        30      /**< current version of wl_cnt_t struct */
+#define WL_CNT_VERSION_6       6
+#define WL_CNT_VERSION_7       7
+#define WL_CNT_VERSION_11      11
+#define WL_CNT_VERSION_XTLV    30
+
+#define WL_COUNTERS_IOV_VERSION_1      1
+#define WL_SUBCNTR_IOV_VER             WL_COUNTERS_IOV_VERSION_1
+/* First two uint16 are version and lenght fields. So offset of the first counter will be 4 */
+#define FIRST_COUNTER_OFFSET           0x04
+
+/* need for now due to src/wl/ndis automerged to other branches. e.g. BISON */
+#define WLC_WITH_XTLV_CNT
+
+/* Number of xtlv info as required to calculate subcounter offsets */
+#define WL_CNT_XTLV_ID_NUM     12
+#define WL_TLV_IOV_VER         1
+
+/**
+ * tlv IDs uniquely identifies counter component
+ * packed into wl_cmd_t container
+ */
+enum wl_cnt_xtlv_id {
+       WL_CNT_XTLV_SLICE_IDX = 0x1,            /**< Slice index */
+       WL_CNT_XTLV_WLC = 0x100,                /**< WLC layer counters */
+       WL_CNT_XTLV_WLC_RINIT_RSN = 0x101,      /**< WLC layer reinitreason extension: LEGACY */
+       WL_CNT_XTLV_WLC_HE = 0x102,             /* he counters */
+       WL_CNT_XTLV_WLC_SECVLN = 0x103,         /* security vulnerabilities counters */
+       WL_CNT_XTLV_WLC_HE_OMI = 0x104,         /* he omi counters */
+       WL_CNT_XTLV_WLC_RINIT_RSN_V2 = 0x105,   /**< WLC layer reinitreason extension */
+       WL_CNT_XTLV_CNTV_LE10_UCODE = 0x200,    /**< wl counter ver < 11 UCODE MACSTAT */
+       WL_CNT_XTLV_LT40_UCODE_V1 = 0x300,      /**< corerev < 40 UCODE MACSTAT */
+       WL_CNT_XTLV_GE40_UCODE_V1 = 0x400,      /**< corerev >= 40 UCODE MACSTAT */
+       WL_CNT_XTLV_GE64_UCODEX_V1 = 0x800,     /* corerev >= 64 UCODEX MACSTAT */
+       WL_CNT_XTLV_GE80_UCODE_V1 = 0x900,      /* corerev >= 80 UCODEX MACSTAT */
+       WL_CNT_XTLV_GE80_TXFUNFL_UCODE_V1 = 0x1000      /* corerev >= 80 UCODEX MACSTAT */
+};
+
+/* tlv IDs uniquely identifies periodic state component */
+enum wl_periodic_slice_state_xtlv_id {
+       WL_STATE_COMPACT_COUNTERS = 0x1,
+       WL_STATE_TXBF_COUNTERS = 0x2,
+       WL_STATE_COMPACT_HE_COUNTERS = 0x3
+};
+
+/* Sub tlvs for chan_counters */
+enum wl_periodic_chan_xtlv_id {
+       WL_CHAN_GENERIC_COUNTERS = 0x1,
+       WL_CHAN_PERIODIC_COUNTERS = 0x2
+};
+
+#ifdef WLC_CHAN_ECNTR_TEST
+#define WL_CHAN_PERIODIC_CNTRS_VER_1 1
+typedef struct wlc_chan_periodic_cntr
+{
+       uint16 version;
+       uint16 pad;
+       uint32  rxstrt;
+} wlc_chan_periodic_cntr_t;
+#endif /* WLC_CHAN_ECNTR_TEST */
+
+#define WL_CHANCNTR_HDR_VER_1 1
+typedef struct wlc_chan_cntr_hdr_v1
+{
+       uint16 version;
+       uint16 pad;
+       chanspec_t chanspec;    /* Dont add any fields above this */
+       uint16 pad1;
+       uint32 total_time;
+       uint32 chan_entry_cnt;
+} wlc_chan_cntr_hdr_v1_t;
+
+/* tlv IDs uniquely identifies periodic state component */
+enum wl_periodic_if_state_xtlv_id {
+       WL_STATE_IF_COMPACT_STATE = 0x1,
+       WL_STATE_IF_ADPS_STATE = 0x02,
+       WL_STATE_IF_ADPS_ENERGY_GAIN = 0x03
+};
+
+enum wl_periodic_tdls_if_state_xtlv_id {
+       WL_STATE_IF_TDLS_STATE = 0x1
+};
+
+#define TDMTX_CNT_VERSION_V1      1
+#define TDMTX_CNT_VERSION_V2      2
+
+/* structure holding tdm counters that interface to iovar */
+typedef struct tdmtx_cnt_v1 {
+       uint16 ver;
+       uint16 length; /* length of this structure */
+       uint16 wlc_idx; /* index for wlc */
+       uint16 enabled; /* tdmtx is enabled on slice */
+       uint32 tdmtx_txa_on; /* TXA on requests */
+       uint32 tdmtx_txa_tmcnt; /* Total number of TXA timeout */
+       uint32 tdmtx_por_on; /* TXA POR requests */
+       uint32 tdmtx_txpuen; /* Path enable requests */
+       uint32 tdmtx_txpudis; /* Total number of times Tx path is muted on the slice */
+       uint32 tdmtx_txpri_on; /* Total number of times Tx priority was obtained by the slice */
+       uint32 tdmtx_txdefer; /* Total number of times Tx was deferred on the slice */
+       uint32 tdmtx_txmute; /* Total number of times active Tx muted on the slice */
+       uint32 tdmtx_actpwrboff; /* Total number of times TX power is backed off by the slice */
+       uint32 tdmtx_txa_dur; /* Total time txa on */
+       uint32 tdmtx_txpri_dur; /* Total time TXPri */
+       uint32 tdmtx_txdefer_dur; /* Total time txdefer */
+       /* TDMTX input fields */
+       uint32 tdmtx_txpri;
+       uint32 tdmtx_defer;
+       uint32 tdmtx_threshold;
+       uint32 tdmtx_rssi_threshold;
+       uint32 tdmtx_txpwrboff;
+       uint32 tdmtx_txpwrboff_dt;
+} tdmtx_cnt_v1_t;
+
+typedef struct {
+       uint16  ver;
+       uint16  length; /* length of the data portion */
+       uint16  cnt;
+       uint16  pad; /* pad to align to 32 bit */
+       uint8   data[]; /* array of tdmtx_cnt_v1_t */
+} tdmtx_status_t;
+
+/* structure holding counters that match exactly shm field sizes */
+typedef struct tdmtx_cnt_shm_v1 {
+       uint16 tdmtx_txa_on; /* TXA on requests */
+       uint16 tdmtx_tmcnt; /* TXA on requests */
+       uint16 tdmtx_por_on; /* TXA POR requests */
+       uint16 tdmtx_txpuen; /* Path enable requests */
+       uint16 tdmtx_txpudis; /* Total number of times Tx path is muted on the slice */
+       uint16 tdmtx_txpri_on; /* Total number of times Tx priority was obtained by the slice */
+       uint16 tdmtx_txdefer; /* Total number of times Tx was defered by the slice */
+       uint16 tdmtx_txmute; /* Total number of times active Tx muted on the slice */
+       uint16 tdmtx_actpwrboff; /* Total number of times TX power is backed off by the slice */
+       uint16 tdmtx_txa_dur_l; /* Total time (low 16 bits) txa on */
+       uint16 tdmtx_txa_dur_h; /* Total time (low 16 bits) txa on */
+       uint16 tdmtx_txpri_dur_l; /* Total time (low 16 bits) TXPri */
+       uint16 tdmtx_txpri_dur_h; /* Total time (high 16 bits) TXPri */
+       uint16 tdmtx_txdefer_dur_l; /* Total time (low 16 bits)  txdefer */
+       uint16 tdmtx_txdefer_dur_h; /* Total time (high 16 bits) txdefer */
+} tdmtx_cnt_shm_v1_t;
+
+/* structure holding tdm counters that interface to iovar for version 2 */
+typedef struct tdmtx_cnt_v2 {
+       uint16 ver;
+       uint16 length; /* length of this structure */
+       uint16 wlc_idx; /* index for wlc */
+       uint16 enabled; /* tdmtx is enabled on slice */
+       uint32 tdmtx_txa_on; /* TXA on requests */
+       uint32 tdmtx_txa_tmcnt; /* Total number of TXA timeout */
+       uint32 tdmtx_porhi_on; /* TXA PORHI requests */
+       uint32 tdmtx_porlo_on; /* TXA PORLO requests */
+       uint32 tdmtx_txpuen; /* Path enable requests */
+       uint32 tdmtx_txpudis; /* Total number of times Tx path is muted on the slice */
+       uint32 tdmtx_txpri_on; /* Total number of times Tx priority was obtained by the slice */
+       uint32 tdmtx_txdefer; /* Total number of times Tx was deferred on the slice */
+       uint32 tdmtx_txmute; /* Total number of times active Tx muted on the slice */
+       uint32 tdmtx_actpwrboff; /* Total number of times TX power is backed off by the slice */
+       uint32 tdmtx_txa_dur; /* Total time txa on */
+       uint32 tdmtx_txpri_dur; /* Total time TXPri */
+       uint32 tdmtx_txdefer_dur; /* Total time txdefer */
+       /* TDMTX input fields */
+       uint32 tdmtx_txpri;
+       uint32 tdmtx_defer;
+       uint32 tdmtx_threshold;
+       uint32 tdmtx_rssi_threshold;
+       uint32 tdmtx_txpwrboff;
+       uint32 tdmtx_txpwrboff_dt;
+} tdmtx_cnt_v2_t;
+
+/* structure holding counters that match exactly shm field sizes */
+typedef struct tdmtx_cnt_shm_v2 {
+       uint16 tdmtx_txa_on; /* TXA on requests */
+       uint16 tdmtx_tmcnt; /* TXA on requests */
+       uint16 tdmtx_porhi_on; /* TXA PORHI requests */
+       uint16 tdmtx_porlo_on; /* TXA PORLO requests */
+       uint16 tdmtx_txpuen; /* Path enable requests */
+       uint16 tdmtx_txpudis; /* Total number of times Tx path is muted on the slice */
+       uint16 tdmtx_txpri_on; /* Total number of times Tx priority was obtained by the slice */
+       uint16 tdmtx_txdefer; /* Total number of times Tx was defered by the slice */
+       uint16 tdmtx_txmute; /* Total number of times active Tx muted on the slice */
+       uint16 tdmtx_actpwrboff; /* Total number of times TX power is backed off by the slice */
+       uint16 tdmtx_txa_dur_l; /* Total time (low 16 bits) txa on */
+       uint16 tdmtx_txa_dur_h; /* Total time (low 16 bits) txa on */
+       uint16 tdmtx_txpri_dur_l; /* Total time (low 16 bits) TXPri */
+       uint16 tdmtx_txpri_dur_h; /* Total time (high 16 bits) TXPri */
+       uint16 tdmtx_txdefer_dur_l; /* Total time (low 16 bits)  txdefer */
+       uint16 tdmtx_txdefer_dur_h; /* Total time (high 16 bits) txdefer */
+} tdmtx_cnt_shm_v2_t;
+
+typedef struct wl_tdmtx_ioc {
+       uint16 id;      /* ID of the sub-command */
+       uint16 len;     /* total length of all data[] */
+       uint8  data[];  /* var len payload */
+} wl_tdmtx_ioc_t;
+
+/*
+ * iovar subcommand ids
+ */
+enum {
+       IOV_TDMTX_ENB = 1,
+       IOV_TDMTX_STATUS = 2,
+       IOV_TDMTX_TXPRI = 3,
+       IOV_TDMTX_DEFER = 4,
+       IOV_TDMTX_TXA = 5,
+       IOV_TDMTX_CFG = 6,
+       IOV_TDMTX_LAST
+};
+
+/**
+ * The number of variables in wl macstat cnt struct.
+ * (wl_cnt_ge40mcst_v1_t, wl_cnt_lt40mcst_v1_t, wl_cnt_v_le10_mcst_t)
+ */
+#define WL_CNT_MCST_VAR_NUM 64
+/* sizeof(wl_cnt_ge40mcst_v1_t), sizeof(wl_cnt_lt40mcst_v1_t), and sizeof(wl_cnt_v_le10_mcst_t) */
+#define WL_CNT_MCST_STRUCT_SZ ((uint32)sizeof(uint32) * WL_CNT_MCST_VAR_NUM)
+#define WL_CNT_REV80_MCST_STRUCT_SZ ((uint32)sizeof(wl_cnt_ge80mcst_v1_t))
+#define WL_CNT_REV80_MCST_TXFUNFlW_STRUCT_FIXED_SZ \
+       ((uint32)OFFSETOF(wl_cnt_ge80_txfunfl_v1_t, txfunfl))
+#define WL_CNT_REV80_MCST_TXFUNFl_STRUCT_SZ(fcnt) \
+       (WL_CNT_REV80_MCST_TXFUNFlW_STRUCT_FIXED_SZ + (fcnt * sizeof(uint32)))
+#define WL_CNT_REV80_MCST_TXFUNFlW_STRUCT_SZ (WL_CNT_REV80_MCST_TXFUNFl_STRUCT_SZ(NFIFO_EXT))
+
+#define WL_CNT_MCXST_STRUCT_SZ ((uint32)sizeof(wl_cnt_ge64mcxst_v1_t))
+
+#define WL_CNT_HE_STRUCT_SZ ((uint32)sizeof(wl_he_cnt_wlc_t))
+
+#define WL_CNT_SECVLN_STRUCT_SZ ((uint32)sizeof(wl_secvln_cnt_t))
+
+#define WL_CNT_HE_OMI_STRUCT_SZ ((uint32)sizeof(wl_he_omi_cnt_wlc_v1_t))
+#define INVALID_CNT_VAL (uint32)(-1)
+
+#define WL_XTLV_CNTBUF_MAX_SIZE ((uint32)(OFFSETOF(wl_cnt_info_t, data)) +     \
+               (uint32)BCM_XTLV_HDR_SIZE + (uint32)sizeof(wl_cnt_wlc_t) +              \
+               (uint32)BCM_XTLV_HDR_SIZE + WL_CNT_MCST_STRUCT_SZ +              \
+               (uint32)BCM_XTLV_HDR_SIZE + WL_CNT_MCXST_STRUCT_SZ)
+
+#define WL_CNTBUF_MAX_SIZE MAX(WL_XTLV_CNTBUF_MAX_SIZE, (uint32)sizeof(wl_cnt_ver_11_t))
+
+/** Top structure of counters IOVar buffer */
+typedef struct {
+       uint16  version;        /**< see definition of WL_CNT_T_VERSION */
+       uint16  datalen;        /**< length of data including all paddings. */
+       uint8   data [];        /**< variable length payload:
+                                * 1 or more bcm_xtlv_t type of tuples.
+                                * each tuple is padded to multiple of 4 bytes.
+                                * 'datalen' field of this structure includes all paddings.
+                                */
+} wl_cnt_info_t;
+
+/* Top structure of subcounters IOVar buffer
+ * Whenever we make any change in this structure
+ * WL_SUBCNTR_IOV_VER should be updated accordingly
+ * The structure definition should remain consistant b/w
+ * FW and wl/WLM app.
+ */
+typedef struct {
+       uint16  version;          /* Version of IOVAR structure. Used for backward
+                                  * compatibility in future. Whenever we make any
+                                  * changes to this structure then value of WL_SUBCNTR_IOV_VER
+                                  * needs to be updated properly.
+                                  */
+       uint16  length;           /* length in bytes of this structure */
+       uint16  counters_version; /* see definition of WL_CNT_T_VERSION
+                                  * wl app will send the version of counters
+                                  * which is used to calculate the offset of counters.
+                                  * It must match the version of counters FW is using
+                                  * else FW will return error with his version of counters
+                                  * set in this field.
+                                  */
+       uint16  num_subcounters;  /* Number of counter offset passed by wl app to FW. */
+       uint32  data[1];          /* variable length payload:
+                                  * Offsets to the counters will be passed to FW
+                                  * throught this data field. FW will return the value of counters
+                                  * at the offsets passed by wl app in this fiels itself.
+                                  */
+} wl_subcnt_info_t;
+
+/* Top structure of counters TLV version IOVar buffer
+ * The structure definition should remain consistant b/w
+ * FW and wl/WLM app.
+ */
+typedef struct {
+       uint16   version;       /* Version of IOVAR structure. Added for backward
+                       * compatibility feature. If any changes are done,
+                       * WL_TLV_IOV_VER need to be updated.
+                       */
+       uint16   length;        /* total len in bytes of this structure + payload */
+       uint16   counters_version;      /* See definition of WL_CNT_VERSION_XTLV
+                       * wl app will update counter tlv version to be used
+                       * so to calculate offset of supported TLVs.
+                       * If there is a mismatch in the version, FW will update an error
+                       */
+       uint16  num_tlv;        /* Max number of TLV info passed by FW to WL app.
+                       * and vice-versa
+                       */
+       uint32   data[];        /* variable length payload:
+                       * This stores the tlv as supported by F/W to the wl app.
+                       * This table is required to compute subcounter offsets at WLapp end.
+                       */
+} wl_cntr_tlv_info_t;
+
+/** wlc layer counters */
+typedef struct {
+       /* transmit stat counters */
+       uint32  txframe;        /**< tx data frames */
+       uint32  txbyte;         /**< tx data bytes */
+       uint32  txretrans;      /**< tx mac retransmits */
+       uint32  txerror;        /**< tx data errors (derived: sum of others) */
+       uint32  txctl;          /**< tx management frames */
+       uint32  txprshort;      /**< tx short preamble frames */
+       uint32  txserr;         /**< tx status errors */
+       uint32  txnobuf;        /**< tx out of buffers errors */
+       uint32  txnoassoc;      /**< tx discard because we're not associated */
+       uint32  txrunt;         /**< tx runt frames */
+       uint32  txchit;         /**< tx header cache hit (fastpath) */
+       uint32  txcmiss;        /**< tx header cache miss (slowpath) */
+
+       /* transmit chip error counters */
+       uint32  txuflo;         /**< tx fifo underflows */
+       uint32  txphyerr;       /**< tx phy errors (indicated in tx status) */
+       uint32  txphycrs;       /**< PR8861/8963 counter */
+
+       /* receive stat counters */
+       uint32  rxframe;        /**< rx data frames */
+       uint32  rxbyte;         /**< rx data bytes */
+       uint32  rxerror;        /**< rx data errors (derived: sum of others) */
+       uint32  rxctl;          /**< rx management frames */
+       uint32  rxnobuf;        /**< rx out of buffers errors */
+       uint32  rxnondata;      /**< rx non data frames in the data channel errors */
+       uint32  rxbadds;        /**< rx bad DS errors */
+       uint32  rxbadcm;        /**< rx bad control or management frames */
+       uint32  rxfragerr;      /**< rx fragmentation errors */
+       uint32  rxrunt;         /**< rx runt frames */
+       uint32  rxgiant;        /**< rx giant frames */
+       uint32  rxnoscb;        /**< rx no scb error */
+       uint32  rxbadproto;     /**< rx invalid frames */
+       uint32  rxbadsrcmac;    /**< rx frames with Invalid Src Mac */
+       uint32  rxbadda;        /**< rx frames tossed for invalid da */
+       uint32  rxfilter;       /**< rx frames filtered out */
+
+       /* receive chip error counters */
+       uint32  rxoflo;         /**< rx fifo overflow errors */
+       uint32  rxuflo[NFIFO];  /**< rx dma descriptor underflow errors */
+
+       uint32  d11cnt_txrts_off;       /**< d11cnt txrts value when reset d11cnt */
+       uint32  d11cnt_rxcrc_off;       /**< d11cnt rxcrc value when reset d11cnt */
+       uint32  d11cnt_txnocts_off;     /**< d11cnt txnocts value when reset d11cnt */
+
+       /* misc counters */
+       uint32  dmade;          /**< tx/rx dma descriptor errors */
+       uint32  dmada;          /**< tx/rx dma data errors */
+       uint32  dmape;          /**< tx/rx dma descriptor protocol errors */
+       uint32  reset;          /**< reset count */
+       uint32  tbtt;           /**< cnts the TBTT int's */
+       uint32  txdmawar;       /**< # occurrences of PR15420 workaround */
+       uint32  pkt_callback_reg_fail;  /**< callbacks register failure */
+
+       /* 802.11 MIB counters, pp. 614 of 802.11 reaff doc. */
+       uint32  txfrag;         /**< dot11TransmittedFragmentCount */
+       uint32  txmulti;        /**< dot11MulticastTransmittedFrameCount */
+       uint32  txfail;         /**< dot11FailedCount */
+       uint32  txretry;        /**< dot11RetryCount */
+       uint32  txretrie;       /**< dot11MultipleRetryCount */
+       uint32  rxdup;          /**< dot11FrameduplicateCount */
+       uint32  txrts;          /**< dot11RTSSuccessCount */
+       uint32  txnocts;        /**< dot11RTSFailureCount */
+       uint32  txnoack;        /**< dot11ACKFailureCount */
+       uint32  rxfrag;         /**< dot11ReceivedFragmentCount */
+       uint32  rxmulti;        /**< dot11MulticastReceivedFrameCount */
+       uint32  rxcrc;          /**< dot11FCSErrorCount */
+       uint32  txfrmsnt;       /**< dot11TransmittedFrameCount (bogus MIB?) */
+       uint32  rxundec;        /**< dot11WEPUndecryptableCount */
+
+       /* WPA2 counters (see rxundec for DecryptFailureCount) */
+       uint32  tkipmicfaill;   /**< TKIPLocalMICFailures */
+       uint32  tkipcntrmsr;    /**< TKIPCounterMeasuresInvoked */
+       uint32  tkipreplay;     /**< TKIPReplays */
+       uint32  ccmpfmterr;     /**< CCMPFormatErrors */
+       uint32  ccmpreplay;     /**< CCMPReplays */
+       uint32  ccmpundec;      /**< CCMPDecryptErrors */
+       uint32  fourwayfail;    /**< FourWayHandshakeFailures */
+       uint32  wepundec;       /**< dot11WEPUndecryptableCount */
+       uint32  wepicverr;      /**< dot11WEPICVErrorCount */
+       uint32  decsuccess;     /**< DecryptSuccessCount */
+       uint32  tkipicverr;     /**< TKIPICVErrorCount */
+       uint32  wepexcluded;    /**< dot11WEPExcludedCount */
+
+       uint32  txchanrej;      /**< Tx frames suppressed due to channel rejection */
+       uint32  psmwds;         /**< Count PSM watchdogs */
+       uint32  phywatchdog;    /**< Count Phy watchdogs (triggered by ucode) */
+
+       /* MBSS counters, AP only */
+       uint32  prq_entries_handled;    /**< PRQ entries read in */
+       uint32  prq_undirected_entries; /**<    which were bcast bss & ssid */
+       uint32  prq_bad_entries;        /**<    which could not be translated to info */
+       uint32  atim_suppress_count;    /**< TX suppressions on ATIM fifo */
+       uint32  bcn_template_not_ready; /**< Template marked in use on send bcn ... */
+       uint32  bcn_template_not_ready_done; /**< ...but "DMA done" interrupt rcvd */
+       uint32  late_tbtt_dpc;  /**< TBTT DPC did not happen in time */
+
+       /* per-rate receive stat counters */
+       uint32  rx1mbps;        /**< packets rx at 1Mbps */
+       uint32  rx2mbps;        /**< packets rx at 2Mbps */
+       uint32  rx5mbps5;       /**< packets rx at 5.5Mbps */
+       uint32  rx6mbps;        /**< packets rx at 6Mbps */
+       uint32  rx9mbps;        /**< packets rx at 9Mbps */
+       uint32  rx11mbps;       /**< packets rx at 11Mbps */
+       uint32  rx12mbps;       /**< packets rx at 12Mbps */
+       uint32  rx18mbps;       /**< packets rx at 18Mbps */
+       uint32  rx24mbps;       /**< packets rx at 24Mbps */
+       uint32  rx36mbps;       /**< packets rx at 36Mbps */
+       uint32  rx48mbps;       /**< packets rx at 48Mbps */
+       uint32  rx54mbps;       /**< packets rx at 54Mbps */
+       uint32  rx108mbps;      /**< packets rx at 108mbps */
+       uint32  rx162mbps;      /**< packets rx at 162mbps */
+       uint32  rx216mbps;      /**< packets rx at 216 mbps */
+       uint32  rx270mbps;      /**< packets rx at 270 mbps */
+       uint32  rx324mbps;      /**< packets rx at 324 mbps */
+       uint32  rx378mbps;      /**< packets rx at 378 mbps */
+       uint32  rx432mbps;      /**< packets rx at 432 mbps */
+       uint32  rx486mbps;      /**< packets rx at 486 mbps */
+       uint32  rx540mbps;      /**< packets rx at 540 mbps */
+
+       uint32  rfdisable;      /**< count of radio disables */
+
+       uint32  txexptime;      /**< Tx frames suppressed due to timer expiration */
+
+       uint32  txmpdu_sgi;     /**< count for sgi transmit */
+       uint32  rxmpdu_sgi;     /**< count for sgi received */
+       uint32  txmpdu_stbc;    /**< count for stbc transmit */
+       uint32  rxmpdu_stbc;    /**< count for stbc received */
+
+       uint32  rxundec_mcst;   /**< dot11WEPUndecryptableCount */
+
+       /* WPA2 counters (see rxundec for DecryptFailureCount) */
+       uint32  tkipmicfaill_mcst;      /**< TKIPLocalMICFailures */
+       uint32  tkipcntrmsr_mcst;       /**< TKIPCounterMeasuresInvoked */
+       uint32  tkipreplay_mcst;        /**< TKIPReplays */
+       uint32  ccmpfmterr_mcst;        /**< CCMPFormatErrors */
+       uint32  ccmpreplay_mcst;        /**< CCMPReplays */
+       uint32  ccmpundec_mcst; /**< CCMPDecryptErrors */
+       uint32  fourwayfail_mcst;       /**< FourWayHandshakeFailures */
+       uint32  wepundec_mcst;  /**< dot11WEPUndecryptableCount */
+       uint32  wepicverr_mcst; /**< dot11WEPICVErrorCount */
+       uint32  decsuccess_mcst;        /**< DecryptSuccessCount */
+       uint32  tkipicverr_mcst;        /**< TKIPICVErrorCount */
+       uint32  wepexcluded_mcst;       /**< dot11WEPExcludedCount */
+
+       uint32  dma_hang;       /**< count for dma hang */
+       uint32  reinit;         /**< count for reinit */
+
+       uint32  pstatxucast;    /**< count of ucast frames xmitted on all psta assoc */
+       uint32  pstatxnoassoc;  /**< count of txnoassoc frames xmitted on all psta assoc */
+       uint32  pstarxucast;    /**< count of ucast frames received on all psta assoc */
+       uint32  pstarxbcmc;     /**< count of bcmc frames received on all psta */
+       uint32  pstatxbcmc;     /**< count of bcmc frames transmitted on all psta */
+
+       uint32  cso_passthrough; /**< hw cso required but passthrough */
+       uint32  cso_normal;     /**< hw cso hdr for normal process */
+       uint32  chained;        /**< number of frames chained */
+       uint32  chainedsz1;     /**< number of chain size 1 frames */
+       uint32  unchained;      /**< number of frames not chained */
+       uint32  maxchainsz;     /**< max chain size so far */
+       uint32  currchainsz;    /**< current chain size */
+       uint32  pciereset;      /**< Secondary Bus Reset issued by driver */
+       uint32  cfgrestore;     /**< configspace restore by driver */
+       uint32  reinitreason[NREINITREASONCOUNT]; /**< reinitreason counters; 0: Unknown reason */
+       uint32  rxrtry;
+       uint32  rxmpdu_mu;      /**< Number of MU MPDUs received */
+
+       /* detailed control/management frames */
+       uint32  txbar;          /**< Number of TX BAR */
+       uint32  rxbar;          /**< Number of RX BAR */
+       uint32  txpspoll;       /**< Number of TX PS-poll */
+       uint32  rxpspoll;       /**< Number of RX PS-poll */
+       uint32  txnull;         /**< Number of TX NULL_DATA */
+       uint32  rxnull;         /**< Number of RX NULL_DATA */
+       uint32  txqosnull;      /**< Number of TX NULL_QoSDATA */
+       uint32  rxqosnull;      /**< Number of RX NULL_QoSDATA */
+       uint32  txassocreq;     /**< Number of TX ASSOC request */
+       uint32  rxassocreq;     /**< Number of RX ASSOC request */
+       uint32  txreassocreq;   /**< Number of TX REASSOC request */
+       uint32  rxreassocreq;   /**< Number of RX REASSOC request */
+       uint32  txdisassoc;     /**< Number of TX DISASSOC */
+       uint32  rxdisassoc;     /**< Number of RX DISASSOC */
+       uint32  txassocrsp;     /**< Number of TX ASSOC response */
+       uint32  rxassocrsp;     /**< Number of RX ASSOC response */
+       uint32  txreassocrsp;   /**< Number of TX REASSOC response */
+       uint32  rxreassocrsp;   /**< Number of RX REASSOC response */
+       uint32  txauth;         /**< Number of TX AUTH */
+       uint32  rxauth;         /**< Number of RX AUTH */
+       uint32  txdeauth;       /**< Number of TX DEAUTH */
+       uint32  rxdeauth;       /**< Number of RX DEAUTH */
+       uint32  txprobereq;     /**< Number of TX probe request */
+       uint32  rxprobereq;     /**< Number of RX probe request */
+       uint32  txprobersp;     /**< Number of TX probe response */
+       uint32  rxprobersp;     /**< Number of RX probe response */
+       uint32  txaction;       /**< Number of TX action frame */
+       uint32  rxaction;       /**< Number of RX action frame */
+       uint32  ampdu_wds;      /**< Number of AMPDU watchdogs */
+       uint32  txlost;         /**< Number of lost packets reported in txs */
+       uint32  txdatamcast;    /**< Number of TX multicast data packets */
+       uint32  txdatabcast;    /**< Number of TX broadcast data packets */
+       uint32  psmxwds;        /**< Number of PSMx watchdogs */
+       uint32  rxback;
+       uint32  txback;
+       uint32  p2p_tbtt;       /**< Number of P2P TBTT Events */
+       uint32  p2p_tbtt_miss;  /**< Number of P2P TBTT Events Miss */
+       uint32  txqueue_start;
+       uint32  txqueue_end;
+       uint32  txbcast;        /* Broadcast TransmittedFrameCount */
+       uint32  txdropped;      /* tx dropped pkts */
+       uint32  rxbcast;        /* BroadcastReceivedFrameCount */
+       uint32  rxdropped;      /* rx dropped pkts (derived: sum of others) */
+       uint32  txq_end_assoccb; /* forced txqueue_end callback fired in assoc */
+       uint32  tx_toss_cnt;    /* number of tx packets tossed */
+       uint32  rx_toss_cnt;    /* number of rx packets tossed  */
+       uint32  last_tx_toss_rsn; /* reason because of which last tx pkt tossed */
+       uint32  last_rx_toss_rsn; /* reason because of which last rx pkt tossed */
+       uint32  pmk_badlen_cnt; /* number of invalid pmk len */
+       uint32  txbar_notx;     /* number of TX BAR not sent (maybe supressed or muted) */
+       uint32  txbar_noack;    /* number of TX BAR sent, but not acknowledged by peer */
+       uint32  rxfrag_agedout; /**< # of aged out rx fragmentation */
+       uint32  pmkid_mismatch_cnt; /* number of EAPOL msg1 PMKID mismatch */
+       uint32  txaction_vndr_attempt; /* Number of VS AFs scheduled successfully for Tx */
+       uint32  txaction_vndr_fail; /* Number of VS AFs not sent or not acked */
+
+       /* Do not remove or rename in the middle of this struct.
+        * All counter variables have to be of uint32.
+        */
+} wl_cnt_wlc_t;
+
+/* he counters Version 1 */
+#define HE_COUNTERS_V1         (1)
+typedef struct wl_he_cnt_wlc_v1 {
+       uint32 he_rxtrig_myaid;
+       uint32 he_rxtrig_rand;
+       uint32 he_colormiss_cnt;
+       uint32 he_txmampdu;
+       uint32 he_txmtid_back;
+       uint32 he_rxmtid_back;
+       uint32 he_rxmsta_back;
+       uint32 he_txfrag;
+       uint32 he_rxdefrag;
+       uint32 he_txtrig;
+       uint32 he_rxtrig_basic;
+       uint32 he_rxtrig_murts;
+       uint32 he_rxtrig_bsrp;
+       uint32 he_rxdlmu;
+       uint32 he_physu_rx;
+       uint32 he_phyru_rx;
+       uint32 he_txtbppdu;
+} wl_he_cnt_wlc_v1_t;
+
+/* he counters Version 2 */
+#define HE_COUNTERS_V2         (2)
+typedef struct wl_he_cnt_wlc_v2 {
+       uint16 version;
+       uint16 len;
+       uint32 he_rxtrig_myaid; /**< rxed valid trigger frame with myaid */
+       uint32 he_rxtrig_rand; /**< rxed valid trigger frame with random aid */
+       uint32 he_colormiss_cnt; /**< for bss color mismatch cases */
+       uint32 he_txmampdu; /**< for multi-TID AMPDU transmission */
+       uint32 he_txmtid_back; /**< for multi-TID BACK transmission */
+       uint32 he_rxmtid_back; /**< reception of multi-TID BACK */
+       uint32 he_rxmsta_back; /**< reception of multi-STA BACK */
+       uint32 he_txfrag; /**< transmission of Dynamic fragmented packets */
+       uint32 he_rxdefrag; /**< reception of dynamic fragmented packets */
+       uint32 he_txtrig; /**< transmission of trigger frames */
+       uint32 he_rxtrig_basic; /**< reception of basic trigger frame */
+       uint32 he_rxtrig_murts; /**< reception of MU-RTS trigger frame */
+       uint32 he_rxtrig_bsrp; /**< reception of BSR poll trigger frame */
+       uint32 he_rxdlmu; /**< reception of DL MU PPDU */
+       uint32 he_physu_rx; /**< reception of SU frame */
+       uint32 he_phyru_rx; /**< reception of RU frame */
+       uint32 he_txtbppdu; /**< increments on transmission of every TB PPDU */
+       uint32 he_null_tbppdu; /**< null TB PPDU's sent as a response to basic trigger frame */
+} wl_he_cnt_wlc_v2_t;
+
+/* he counters Version 3 */
+#define WL_RU_TYPE_MAX                 6
+#define HE_COUNTERS_V3         (3)
+
+typedef struct wl_he_cnt_wlc_v3 {
+       uint16 version;
+       uint16 len;
+       uint32 he_rxtrig_myaid; /**< rxed valid trigger frame with myaid */
+       uint32 he_rxtrig_rand; /**< rxed valid trigger frame with random aid */
+       uint32 he_colormiss_cnt; /**< for bss color mismatch cases */
+       uint32 he_txmampdu; /**< for multi-TID AMPDU transmission */
+       uint32 he_txmtid_back; /**< for multi-TID BACK transmission */
+       uint32 he_rxmtid_back; /**< reception of multi-TID BACK */
+       uint32 he_rxmsta_back; /**< reception of multi-STA BACK */
+       uint32 he_txfrag; /**< transmission of Dynamic fragmented packets */
+       uint32 he_rxdefrag; /**< reception of dynamic fragmented packets */
+       uint32 he_txtrig; /**< transmission of trigger frames */
+       uint32 he_rxtrig_basic; /**< reception of basic trigger frame */
+       uint32 he_rxtrig_murts; /**< reception of MU-RTS trigger frame */
+       uint32 he_rxtrig_bsrp; /**< reception of BSR poll trigger frame */
+       uint32 he_rxhemuppdu_cnt; /**< rxing HE MU PPDU */
+       uint32 he_physu_rx; /**< reception of SU frame */
+       uint32 he_phyru_rx; /**< reception of RU frame */
+       uint32 he_txtbppdu; /**< increments on transmission of every TB PPDU */
+       uint32 he_null_tbppdu; /**< null TB PPDU's sent as a response to basic trigger frame */
+       uint32 he_rxhesuppdu_cnt; /**< rxing SU PPDU */
+       uint32 he_rxhesureppdu_cnt; /**< rxing Range Extension(RE) SU PPDU */
+       uint32 he_null_zero_agg; /**< null AMPDU's transmitted in response to basic trigger
+                                * because of zero aggregation
+                                */
+       uint32 he_null_bsrp_rsp; /**< null AMPDU's txed in response to BSR poll */
+       uint32 he_null_fifo_empty; /**< null AMPDU's in response to basic trigger
+                                * because of no frames in fifo's
+                                */
+       uint32 he_myAID_cnt;
+       uint32 he_rxtrig_bfm_cnt;
+       uint32 he_rxtrig_mubar;
+       uint32 rxheru[WL_RU_TYPE_MAX];          /**< HE of rx pkts */
+       uint32 txheru[WL_RU_TYPE_MAX];
+       uint32 he_mgmt_tbppdu;
+       uint32 he_cs_req_tx_cancel;
+       uint32 he_wrong_nss;
+       uint32 he_trig_unsupp_rate;
+       uint32 he_rxtrig_nfrp;
+       uint32 he_rxtrig_bqrp;
+       uint32 he_rxtrig_gcrmubar;
+} wl_he_cnt_wlc_v3_t;
+
+/* he counters Version 4 */
+#define HE_COUNTERS_V4         (4)
+typedef struct wl_he_cnt_wlc_v4 {
+       uint16 version;
+       uint16 len;
+       uint32 he_rxtrig_myaid; /**< rxed valid trigger frame with myaid */
+       uint32 he_rxtrig_rand; /**< rxed valid trigger frame with random aid */
+       uint32 he_colormiss_cnt; /**< for bss color mismatch cases */
+       uint32 he_txmampdu; /**< for multi-TID AMPDU transmission */
+       uint32 he_txmtid_back; /**< for multi-TID BACK transmission */
+       uint32 he_rxmtid_back; /**< reception of multi-TID BACK */
+       uint32 he_rxmsta_back; /**< reception of multi-STA BACK */
+       uint32 he_txfrag; /**< transmission of Dynamic fragmented packets */
+       uint32 he_rxdefrag; /**< reception of dynamic fragmented packets */
+       uint32 he_txtrig; /**< transmission of trigger frames */
+       uint32 he_rxtrig_basic; /**< reception of basic trigger frame */
+       uint32 he_rxtrig_murts; /**< reception of MU-RTS trigger frame */
+       uint32 he_rxtrig_bsrp; /**< reception of BSR poll trigger frame */
+       uint32 he_rxtsrt_hemuppdu_cnt; /**< rxing HE MU PPDU */
+       uint32 he_physu_rx; /**< reception of SU frame */
+       uint32 he_phyru_rx; /**< reception of RU frame */
+       uint32 he_txtbppdu; /**< increments on transmission of every TB PPDU */
+       uint32 he_null_tbppdu; /**< null TB PPDU's sent as a response to basic trigger frame */
+       uint32 he_rxstrt_hesuppdu_cnt; /**< rxing SU PPDU */
+       uint32 he_rxstrt_hesureppdu_cnt; /**< rxing Range Extension(RE) SU PPDU */
+       uint32 he_null_zero_agg; /**< null AMPDU's transmitted in response to basic trigger
+                                * because of zero aggregation
+                                */
+       uint32 he_null_bsrp_rsp; /**< null AMPDU's txed in response to BSR poll */
+       uint32 he_null_fifo_empty; /**< null AMPDU's in response to basic trigger
+                                * because of no frames in fifo's
+                                */
+       uint32 he_myAID_cnt;
+       uint32 he_rxtrig_bfm_cnt;
+       uint32 he_rxtrig_mubar;
+       uint32 rxheru[WL_RU_TYPE_MAX];          /**< HE of rx pkts */
+       uint32 txheru[WL_RU_TYPE_MAX];
+       uint32 he_mgmt_tbppdu;
+       uint32 he_cs_req_tx_cancel;
+       uint32 he_wrong_nss;
+       uint32 he_trig_unsupp_rate;
+       uint32 he_rxtrig_nfrp;
+       uint32 he_rxtrig_bqrp;
+       uint32 he_rxtrig_gcrmubar;
+       uint32 he_rxtrig_basic_htpack; /**< triggers received with HTP ack policy */
+       uint32 he_rxtrig_ed_cncl;       /**< count of cancelled packets
+                                        * becasue of cs_req in trigger frame
+                                        */
+       uint32 he_rxtrig_suppr_null_tbppdu; /**<  count of null frame sent becasue of
+                                        * suppression scenarios
+                                        */
+       uint32 he_ulmu_disable;         /**< number of UL MU disable scenario's handled in ucode */
+       uint32 he_ulmu_data_disable;    /**<number of UL MU data disable scenarios
+                                        * handled in ucode
+                                        */
+} wl_he_cnt_wlc_v4_t;
+
+#ifndef HE_COUNTERS_VERSION_ENABLED
+#define HE_COUNTERS_VERSION    (HE_COUNTERS_V1)
+typedef wl_he_cnt_wlc_v1_t wl_he_cnt_wlc_t;
+#endif /* HE_COUNTERS_VERSION_ENABLED */
+
+/* he omi counters Version 1 */
+#define HE_OMI_COUNTERS_V1             (1)
+typedef struct wl_he_omi_cnt_wlc_v1 {
+       uint16 version;
+       uint16 len;
+       uint32 he_omitx_sched;          /* Count for total number of OMIs scheduled */
+       uint32 he_omitx_success;        /* Count for OMI Tx success */
+       uint32 he_omitx_retries;        /* Count for OMI retries as TxDone not set */
+       uint32 he_omitx_dur;            /* Accumulated duration of OMI completion time */
+       uint32 he_omitx_ulmucfg;        /* count for UL MU enable/disable change req */
+       uint32 he_omitx_ulmucfg_ack;    /* count for UL MU enable/disable req txed successfully */
+       uint32 he_omitx_txnsts;         /* count for Txnsts change req */
+       uint32 he_omitx_txnsts_ack;     /* count for Txnsts change req txed successfully */
+       uint32 he_omitx_rxnss;          /* count for Rxnss change req */
+       uint32 he_omitx_rxnss_ack;      /* count for Rxnss change req txed successfully */
+       uint32 he_omitx_bw;             /* count for BW change req */
+       uint32 he_omitx_bw_ack;         /* count for BW change req txed successfully */
+       uint32 he_omitx_ersudis;        /* count for ER SU enable/disable req */
+       uint32 he_omitx_ersudis_ack;    /* count for ER SU enable/disable req txed successfully */
+       uint32 he_omitx_dlmursdrec;     /* count for Resound recommendation change req */
+       uint32 he_omitx_dlmursdrec_ack; /* count for Resound recommendation req txed successfully */
+} wl_he_omi_cnt_wlc_v1_t;
+
+/* WL_IFSTATS_XTLV_WL_SLICE_TXBF */
+/* beamforming counters version 1 */
+#define TXBF_ECOUNTERS_V1      (1u)
+#define WL_TXBF_CNT_ARRAY_SZ   (8u)
+typedef struct wl_txbf_ecounters_v1 {
+       uint16 version;
+       uint16 len;
+       /* transmit beamforming stats */
+       uint16 txndpa;                          /* null data packet announcements */
+       uint16 txndp;                           /* null data packets */
+       uint16 txbfpoll;                        /* beamforming report polls */
+       uint16 txsf;                            /* subframes */
+       uint16 txcwrts;                         /* contention window rts */
+       uint16 txcwcts;                         /* contention window cts */
+       uint16 txbfm;
+       /* receive beamforming stats */
+       uint16 rxndpa_u;                        /* unicast NDPAs */
+       uint16 rxndpa_m;                        /* multicast NDPAs */
+       uint16 rxbfpoll;                        /* unicast bf-polls */
+       uint16 bferpt;                          /* beamforming reports */
+       uint16 rxsf;
+       uint16 rxcwrts;
+       uint16 rxcwcts;
+       uint16 rxtrig_bfpoll;
+       uint16 unused_uint16;                   /* pad */
+       /* sounding stats - interval capture */
+       uint16 rxnontb_sound[WL_TXBF_CNT_ARRAY_SZ];     /* non-TB sounding for last 8 captures */
+       uint16 rxtb_sound[WL_TXBF_CNT_ARRAY_SZ];        /* TB sounding count for last 8 captures */
+       uint32 cap_dur_ms[WL_TXBF_CNT_ARRAY_SZ];        /* last 8 capture durations (in ms) */
+       uint32 cap_last_ts;                     /* timestamp of last sample capture */
+} wl_txbf_ecounters_v1_t;
+
+/* security vulnerabilities counters */
+typedef struct {
+       uint32  ie_unknown;             /* number of unknown IEs */
+       uint32  ie_invalid_length;      /* number of IEs with invalid length */
+       uint32  ie_invalid_data;        /* number of IEs with invalid data */
+       uint32  ipv6_invalid_length;    /* number of IPv6 packets with invalid payload length */
+} wl_secvln_cnt_t;
+
+/* Reinit reasons - do not put anything else other than reinit reasons here */
+/* LEGACY STRUCTURE, DO NO MODIFY, SEE reinit_rsns_v1_t and further versions */
+typedef struct {
+       uint32 rsn[WL_REINIT_RC_LAST];
+} reinit_rsns_t;
+
+typedef struct {
+       uint16 version;
+       uint16 len;
+       uint32 rsn[WL_REINIT_RC_LAST_V2];
+} reinit_rsns_v2_t;
+
+/* MACXSTAT counters for ucodex (corerev >= 64) */
+typedef struct {
+       uint32 macxsusp;
+       uint32 m2vmsg;
+       uint32 v2mmsg;
+       uint32 mboxout;
+       uint32 musnd;
+       uint32 sfb2v;
+} wl_cnt_ge64mcxst_v1_t;
+
+/** MACSTAT counters for ucode (corerev >= 40) */
+typedef struct {
+       /* MAC counters: 32-bit version of d11.h's macstat_t */
+       uint32  txallfrm;       /**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+                                * Control Management (includes retransmissions)
+                                */
+       uint32  txrtsfrm;       /**< number of RTS sent out by the MAC */
+       uint32  txctsfrm;       /**< number of CTS sent out by the MAC */
+       uint32  txackfrm;       /**< number of ACK frames sent out */
+       uint32  txdnlfrm;       /**< number of Null-Data transmission generated from template  */
+       uint32  txbcnfrm;       /**< beacons transmitted */
+       uint32  txfunfl[6];     /**< per-fifo tx underflows */
+       uint32  txampdu;        /**< number of AMPDUs transmitted */
+       uint32  txmpdu;         /**< number of MPDUs transmitted */
+       uint32  txtplunfl;      /**< Template underflows (mac was too slow to transmit ACK/CTS
+                                * or BCN)
+                                */
+       uint32  txphyerror;     /**< Transmit phy error, type of error is reported in tx-status for
+                                * driver enqueued frames
+                                */
+       uint32  pktengrxducast; /**< unicast frames rxed by the pkteng code */
+       uint32  pktengrxdmcast; /**< multicast frames rxed by the pkteng code */
+       uint32  rxfrmtoolong;   /**< Received frame longer than legal limit (2346 bytes) */
+       uint32  rxfrmtooshrt; /**< Received frame did not contain enough bytes for its frame type */
+       uint32  rxanyerr;       /**< Any RX error that is not counted by other counters. */
+       uint32  rxbadfcs;       /**< number of frames for which the CRC check failed in the MAC */
+       uint32  rxbadplcp;      /**< parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  rxstrt;         /**< Number of received frames with a good PLCP
+                                * (i.e. passing parity check)
+                                */
+       uint32  rxdtucastmbss; /**< number of received DATA frames with good FCS and matching RA */
+       uint32  rxmgucastmbss; /**< number of received mgmt frames with good FCS and matching RA */
+       uint32  rxctlucast; /**< number of received CNTRL frames with good FCS and matching RA */
+       uint32  rxrtsucast;     /**< number of unicast RTS addressed to the MAC (good FCS) */
+       uint32  rxctsucast;     /**< number of unicast CTS addressed to the MAC (good FCS) */
+       uint32  rxackucast;     /**< number of ucast ACKS received (good FCS) */
+       uint32  rxdtocast; /**< number of received DATA frames (good FCS and not matching RA) */
+       uint32  rxmgocast; /**< number of received MGMT frames (good FCS and not matching RA) */
+       uint32  rxctlocast; /**< number of received CNTRL frame (good FCS and not matching RA) */
+       uint32  rxrtsocast;     /**< number of received RTS not addressed to the MAC */
+       uint32  rxctsocast;     /**< number of received CTS not addressed to the MAC */
+       uint32  rxdtmcast;      /**< number of RX Data multicast frames received by the MAC */
+       uint32  rxmgmcast;      /**< number of RX Management multicast frames received by the MAC */
+       uint32  rxctlmcast;     /**< number of RX Control multicast frames received by the MAC
+                                * (unlikely to see these)
+                                */
+       uint32  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint32  rxdtucastobss; /**< number of unicast frames addressed to the MAC from
+                                 * other BSS (WDS FRAME)
+                                 */
+       uint32  rxbeaconobss;   /**< beacons received from other BSS */
+       uint32  rxrsptmout;     /**< number of response timeouts for transmitted frames
+                                * expecting a response
+                                */
+       uint32  bcntxcancl;     /**< transmit beacons canceled due to receipt of beacon (IBSS) */
+       uint32  rxnodelim;      /**< number of no valid delimiter detected by ampdu parser */
+       uint32  rxf0ovfl;       /**< number of receive fifo 0 overflows */
+       uint32  rxf1ovfl;       /**< number of receive fifo 1 overflows */
+       uint32  rxhlovfl;       /**< number of length / header fifo overflows */
+       uint32  missbcn_dbg;    /**< number of beacon missed to receive */
+       uint32  pmqovfl;        /**< number of PMQ overflows */
+       uint32  rxcgprqfrm;     /**< number of received Probe requests that made it into
+                                * the PRQ fifo
+                                */
+       uint32  rxcgprsqovfl;   /**< Rx Probe Request Que overflow in the AP */
+       uint32  txcgprsfail;    /**< Tx Probe Response Fail. AP sent probe response but did
+                                * not get ACK
+                                */
+       uint32  txcgprssuc;     /**< Tx Probe Response Success (ACK was received) */
+       uint32  prs_timeout;    /**< number of probe requests that were dropped from the PRQ
+                                * fifo because a probe response could not be sent out within
+                                * the time limit defined in M_PRS_MAXTIME
+                                */
+       uint32  txrtsfail;      /**< number of rts transmission failure that reach retry limit */
+       uint32  txucast;        /**< number of unicast tx expecting response other than cts/cwcts */
+       uint32  txinrtstxop;    /**< number of data frame transmissions during rts txop */
+       uint32  rxback;         /**< blockack rxcnt */
+       uint32  txback;         /**< blockack txcnt */
+       uint32  bphy_rxcrsglitch;       /**< PHY count of bphy glitches */
+       uint32  rxdrop20s;      /**< drop secondary cnt */
+       uint32  rxtoolate;      /**< receive too late */
+       uint32  bphy_badplcp;   /**< number of bad PLCP reception on BPHY rate */
+       /* All counter variables have to be of uint32. */
+} wl_cnt_ge40mcst_v1_t;
+
+/** MACSTAT counters for ucode (corerev < 40) */
+typedef struct {
+       /* MAC counters: 32-bit version of d11.h's macstat_t */
+       uint32  txallfrm;       /**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+                                * Control Management (includes retransmissions)
+                                */
+       uint32  txrtsfrm;       /**< number of RTS sent out by the MAC */
+       uint32  txctsfrm;       /**< number of CTS sent out by the MAC */
+       uint32  txackfrm;       /**< number of ACK frames sent out */
+       uint32  txdnlfrm;       /**< number of Null-Data transmission generated from template  */
+       uint32  txbcnfrm;       /**< beacons transmitted */
+       uint32  txfunfl[6];     /**< per-fifo tx underflows */
+       uint32  txampdu;        /**< number of AMPDUs transmitted */
+       uint32  txmpdu;         /**< number of MPDUs transmitted */
+       uint32  txtplunfl;      /**< Template underflows (mac was too slow to transmit ACK/CTS
+                                * or BCN)
+                                */
+       uint32  txphyerror;     /**< Transmit phy error, type of error is reported in tx-status for
+                                * driver enqueued frames
+                                */
+       uint32  pktengrxducast; /**< unicast frames rxed by the pkteng code */
+       uint32  pktengrxdmcast; /**< multicast frames rxed by the pkteng code */
+       uint32  rxfrmtoolong;   /**< Received frame longer than legal limit (2346 bytes) */
+       uint32  rxfrmtooshrt; /**< Received frame did not contain enough bytes for its frame type */
+       uint32  rxanyerr;       /**< Any RX error that is not counted by other counters. */
+       uint32  rxbadfcs;       /**< number of frames for which the CRC check failed in the MAC */
+       uint32  rxbadplcp;      /**< parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  rxstrt;         /**< Number of received frames with a good PLCP
+                                * (i.e. passing parity check)
+                                */
+       uint32  rxdtucastmbss; /**< number of received DATA frames with good FCS and matching RA */
+       uint32  rxmgucastmbss; /**< number of received mgmt frames with good FCS and matching RA */
+       uint32  rxctlucast; /**< number of received CNTRL frames with good FCS and matching RA */
+       uint32  rxrtsucast;     /**< number of unicast RTS addressed to the MAC (good FCS) */
+       uint32  rxctsucast;     /**< number of unicast CTS addressed to the MAC (good FCS) */
+       uint32  rxackucast;     /**< number of ucast ACKS received (good FCS) */
+       uint32  rxdtocast;  /**< number of received DATA frames (good FCS and not matching RA) */
+       uint32  rxmgocast;  /**< number of received MGMT frames (good FCS and not matching RA) */
+       uint32  rxctlocast; /**< number of received CNTRL frame (good FCS and not matching RA) */
+       uint32  rxrtsocast;     /**< number of received RTS not addressed to the MAC */
+       uint32  rxctsocast;     /**< number of received CTS not addressed to the MAC */
+       uint32  rxdtmcast;      /**< number of RX Data multicast frames received by the MAC */
+       uint32  rxmgmcast;      /**< number of RX Management multicast frames received by the MAC */
+       uint32  rxctlmcast;     /**< number of RX Control multicast frames received by the MAC
+                                * (unlikely to see these)
+                                */
+       uint32  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint32  rxdtucastobss; /**< number of unicast frames addressed to the MAC from
+                                 * other BSS (WDS FRAME)
+                                 */
+       uint32  rxbeaconobss;   /**< beacons received from other BSS */
+       uint32  rxrsptmout;     /**< number of response timeouts for transmitted frames
+                                * expecting a response
+                                */
+       uint32  bcntxcancl;     /**< transmit beacons canceled due to receipt of beacon (IBSS) */
+       uint32  rxnodelim;      /**< number of no valid delimiter detected by ampdu parser */
+       uint32  rxf0ovfl;       /**< number of receive fifo 0 overflows */
+       uint32  dbgoff46;       /**< BTCX protection failure count,
+                                * getting RX antenna in PHY DEBUG,
+                                * PR84273 timeout count
+                                */
+       uint32  dbgoff47;       /**< BTCX preemption failure count,
+                                * getting RX antenna in PHY DEBUG,
+                                * PR84273 reset CCA count,
+                                * RATEENGDBG
+                                */
+       uint32  dbgoff48;       /**< Used for counting txstatus queue overflow (corerev <= 4)  */
+       uint32  pmqovfl;        /**< number of PMQ overflows */
+       uint32  rxcgprqfrm;     /**< number of received Probe requests that made it into
+                                * the PRQ fifo
+                                */
+       uint32  rxcgprsqovfl;   /**< Rx Probe Request Que overflow in the AP */
+       uint32  txcgprsfail;    /**< Tx Probe Response Fail. AP sent probe response but did
+                                * not get ACK
+                                */
+       uint32  txcgprssuc;     /**< Tx Probe Response Success (ACK was received) */
+       uint32  prs_timeout;    /**< number of probe requests that were dropped from the PRQ
+                                * fifo because a probe response could not be sent out within
+                                * the time limit defined in M_PRS_MAXTIME
+                                */
+       uint32  txrtsfail;      /**< number of rts transmission failure that reach retry limit */
+       uint32  txucast;        /**< number of unicast tx expecting response other than cts/cwcts */
+       uint32  txinrtstxop;    /**< number of data frame transmissions during rts txop */
+       uint32  rxback;         /**< blockack rxcnt */
+       uint32  txback;         /**< blockack txcnt */
+       uint32  bphy_rxcrsglitch;       /**< PHY count of bphy glitches */
+       uint32  phywatch;       /**< number of phywatchdog to kill any pending transmissions.
+                                * (PR 38187 corerev == 11)
+                                */
+       uint32  rxtoolate;      /**< receive too late */
+       uint32  bphy_badplcp;   /**< number of bad PLCP reception on BPHY rate */
+       /* All counter variables have to be of uint32. */
+} wl_cnt_lt40mcst_v1_t;
+
+/** MACSTAT counters for ucode (corerev >= 80) */
+typedef struct {
+       /* MAC counters: 32-bit version of d11.h's macstat_t */
+       /* Start of PSM2HOST stats(72) block */
+       uint32  txallfrm;       /**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+                                * Control Management (includes retransmissions)
+                                */
+       uint32  txrtsfrm;       /**< number of RTS sent out by the MAC */
+       uint32  txctsfrm;       /**< number of CTS sent out by the MAC */
+       uint32  txackfrm;       /**< number of ACK frames sent out */
+       uint32  txdnlfrm;       /**< number of Null-Data transmission generated from template  */
+       uint32  txbcnfrm;       /**< beacons transmitted */
+       uint32  txampdu;        /**< number of AMPDUs transmitted */
+       uint32  txmpdu;         /**< number of MPDUs transmitted */
+       uint32  txtplunfl;      /**< Template underflows (mac was too slow to transmit ACK/CTS
+                                * or BCN)
+                                */
+       uint32  txphyerror;     /**< Transmit phy error, type of error is reported in tx-status for
+                                * driver enqueued frames
+                                */
+       uint32  pktengrxducast; /**< unicast frames rxed by the pkteng code */
+       uint32  pktengrxdmcast; /**< multicast frames rxed by the pkteng code */
+       uint32  rxfrmtoolong;   /**< Received frame longer than legal limit (2346 bytes) */
+       uint32  rxfrmtooshrt; /**< Received frame did not contain enough bytes for its frame type */
+       uint32  rxanyerr;       /**< Any RX error that is not counted by other counters. */
+       uint32  rxbadfcs;       /**< number of frames for which the CRC check failed in the MAC */
+       uint32  rxbadplcp;      /**< parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  rxstrt;         /**< Number of received frames with a good PLCP
+                                * (i.e. passing parity check)
+                                */
+       uint32  rxdtucastmbss; /**< number of received DATA frames with good FCS and matching RA */
+       uint32  rxmgucastmbss; /**< number of received mgmt frames with good FCS and matching RA */
+       uint32  rxctlucast; /**< number of received CNTRL frames with good FCS and matching RA */
+       uint32  rxrtsucast;     /**< number of unicast RTS addressed to the MAC (good FCS) */
+       uint32  rxctsucast;     /**< number of unicast CTS addressed to the MAC (good FCS) */
+       uint32  rxackucast;     /**< number of ucast ACKS received (good FCS) */
+       uint32  rxdtocast; /**< number of received DATA frames (good FCS and not matching RA) */
+       uint32  rxmgocast; /**< number of received MGMT frames (good FCS and not matching RA) */
+       uint32  rxctlocast; /**< number of received CNTRL frame (good FCS and not matching RA) */
+       uint32  rxrtsocast;     /**< number of received RTS not addressed to the MAC */
+       uint32  rxctsocast;     /**< number of received CTS not addressed to the MAC */
+       uint32  rxdtmcast;      /**< number of RX Data multicast frames received by the MAC */
+       uint32  rxmgmcast;      /**< number of RX Management multicast frames received by the MAC */
+       uint32  rxctlmcast;     /**< number of RX Control multicast frames received by the MAC
+                                * (unlikely to see these)
+                                */
+       uint32  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint32  rxdtucastobss; /**< number of unicast frames addressed to the MAC from
+                                 * other BSS (WDS FRAME)
+                                 */
+       uint32  rxbeaconobss;   /**< beacons received from other BSS */
+       uint32  rxrsptmout;     /**< number of response timeouts for transmitted frames
+                                * expecting a response
+                                */
+       uint32  bcntxcancl;     /**< transmit beacons canceled due to receipt of beacon (IBSS) */
+       uint32  rxnodelim;      /**< number of no valid delimiter detected by ampdu parser */
+       uint32  missbcn_dbg;    /**< number of beacon missed to receive */
+       uint32  pmqovfl;        /**< number of PMQ overflows */
+       uint32  rxcgprqfrm;     /**< number of received Probe requests that made it into
+                                * the PRQ fifo
+                                */
+       uint32  rxcgprsqovfl;   /**< Rx Probe Request Que overflow in the AP */
+       uint32  txcgprsfail;    /**< Tx Probe Response Fail. AP sent probe response but did
+                                * not get ACK
+                                */
+       uint32  txcgprssuc;     /**< Tx Probe Response Success (ACK was received) */
+       uint32  prs_timeout;    /**< number of probe requests that were dropped from the PRQ
+                                * fifo because a probe response could not be sent out within
+                                * the time limit defined in M_PRS_MAXTIME
+                                */
+       uint32  txrtsfail;      /**< number of rts transmission failure that reach retry limit */
+       uint32  txucast;        /**< number of unicast tx expecting response other than cts/cwcts */
+       uint32  txinrtstxop;    /**< number of data frame transmissions during rts txop */
+       uint32  rxback;         /**< blockack rxcnt */
+       uint32  txback;         /**< blockack txcnt */
+       uint32  bphy_rxcrsglitch;       /**< PHY count of bphy glitches */
+       uint32  rxdrop20s;      /**< drop secondary cnt */
+       uint32  rxtoolate;      /**< receive too late */
+       uint32  bphy_badplcp;   /**< number of bad PLCP reception on BPHY rate */
+       uint32  rxtrig_myaid;   /* New counters added in corerev 80 */
+       uint32  rxtrig_rand;
+       uint32  goodfcs;
+       uint32  colormiss;
+       uint32  txmampdu;
+       uint32  rxmtidback;
+       uint32  rxmstaback;
+       uint32  txfrag;
+       /* End of PSM2HOST stats block */
+       /* start of rxerror overflow counter(24) block which are modified/added in corerev 80 */
+       uint32  phyovfl;
+       uint32  rxf0ovfl;       /**< number of receive fifo 0 overflows */
+       uint32  rxf1ovfl;       /**< number of receive fifo 1 overflows */
+       uint32  lenfovfl;
+       uint32  weppeof;
+       uint32  badplcp;
+       uint32  msduthresh;
+       uint32  strmeof;
+       uint32  stsfifofull;
+       uint32  stsfifoerr;
+       uint32  PAD[6];
+       uint32  rxerr_stat;
+       uint32  ctx_fifo_full;
+       uint32  PAD0[9];
+       uint32  ctmode_ufc_cnt;
+       uint32  PAD1[28]; /* PAD added for counter elements to be added soon */
+} wl_cnt_ge80mcst_v1_t;
+
+typedef struct {
+       uint32 fifocount;
+       uint32 txfunfl[];
+} wl_cnt_ge80_txfunfl_v1_t;
+
+/** MACSTAT counters for "wl counter" version <= 10 */
+/*  With ucode before its macstat cnts cleaned up */
+typedef struct {
+       /* MAC counters: 32-bit version of d11.h's macstat_t */
+       uint32  txallfrm;       /**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+                                * Control Management (includes retransmissions)
+                                */
+       uint32  txrtsfrm;       /**< number of RTS sent out by the MAC */
+       uint32  txctsfrm;       /**< number of CTS sent out by the MAC */
+       uint32  txackfrm;       /**< number of ACK frames sent out */
+       uint32  txdnlfrm;       /**< number of Null-Data transmission generated from template  */
+       uint32  txbcnfrm;       /**< beacons transmitted */
+       uint32  txfunfl[6];     /**< per-fifo tx underflows */
+       uint32  txfbw;          /**< transmit at fallback bw (dynamic bw) */
+       uint32  PAD0;           /**< number of MPDUs transmitted */
+       uint32  txtplunfl;      /**< Template underflows (mac was too slow to transmit ACK/CTS
+                                * or BCN)
+                                */
+       uint32  txphyerror;     /**< Transmit phy error, type of error is reported in tx-status for
+                                * driver enqueued frames
+                                */
+       uint32  pktengrxducast; /**< unicast frames rxed by the pkteng code */
+       uint32  pktengrxdmcast; /**< multicast frames rxed by the pkteng code */
+       uint32  rxfrmtoolong;   /**< Received frame longer than legal limit (2346 bytes) */
+       uint32  rxfrmtooshrt; /**< Received frame did not contain enough bytes for its frame type */
+       uint32  rxinvmachdr;    /**< Either the protocol version != 0 or frame type not
+                                * data/control/management
+                                */
+       uint32  rxbadfcs;       /**< number of frames for which the CRC check failed in the MAC */
+       uint32  rxbadplcp;      /**< parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  rxstrt;         /**< Number of received frames with a good PLCP
+                                * (i.e. passing parity check)
+                                */
+       uint32  rxdfrmucastmbss; /* number of received DATA frames with good FCS and matching RA */
+       uint32  rxmfrmucastmbss; /* number of received mgmt frames with good FCS and matching RA */
+       uint32  rxcfrmucast; /**< number of received CNTRL frames with good FCS and matching RA */
+       uint32  rxrtsucast;  /**< number of unicast RTS addressed to the MAC (good FCS) */
+       uint32  rxctsucast;  /**< number of unicast CTS addressed to the MAC (good FCS) */
+       uint32  rxackucast;     /**< number of ucast ACKS received (good FCS) */
+       uint32  rxdfrmocast; /**< number of received DATA frames (good FCS and not matching RA) */
+       uint32  rxmfrmocast; /**< number of received MGMT frames (good FCS and not matching RA) */
+       uint32  rxcfrmocast; /**< number of received CNTRL frame (good FCS and not matching RA) */
+       uint32  rxrtsocast;     /**< number of received RTS not addressed to the MAC */
+       uint32  rxctsocast;     /**< number of received CTS not addressed to the MAC */
+       uint32  rxdfrmmcast;    /**< number of RX Data multicast frames received by the MAC */
+       uint32  rxmfrmmcast;    /**< number of RX Management multicast frames received by the MAC */
+       uint32  rxcfrmmcast;    /**< number of RX Control multicast frames received by the MAC
+                                * (unlikely to see these)
+                                */
+       uint32  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint32  rxdfrmucastobss; /**< number of unicast frames addressed to the MAC from
+                                 * other BSS (WDS FRAME)
+                                 */
+       uint32  rxbeaconobss;   /**< beacons received from other BSS */
+       uint32  rxrsptmout;     /**< number of response timeouts for transmitted frames
+                                * expecting a response
+                                */
+       uint32  bcntxcancl;     /**< transmit beacons canceled due to receipt of beacon (IBSS) */
+       uint32  PAD1;
+       uint32  rxf0ovfl;       /**< number of receive fifo 0 overflows */
+       uint32  rxf1ovfl;       /**< Number of receive fifo 1 overflows (obsolete) */
+       uint32  rxf2ovfl;       /**< Number of receive fifo 2 overflows (obsolete) */
+       uint32  txsfovfl;       /**< Number of transmit status fifo overflows (obsolete) */
+       uint32  pmqovfl;        /**< number of PMQ overflows */
+       uint32  rxcgprqfrm;     /**< number of received Probe requests that made it into
+                                * the PRQ fifo
+                                */
+       uint32  rxcgprsqovfl;   /**< Rx Probe Request Que overflow in the AP */
+       uint32  txcgprsfail;    /**< Tx Probe Response Fail. AP sent probe response but did
+                                * not get ACK
+                                */
+       uint32  txcgprssuc;     /**< Tx Probe Response Success (ACK was received) */
+       uint32  prs_timeout;    /**< number of probe requests that were dropped from the PRQ
+                                * fifo because a probe response could not be sent out within
+                                * the time limit defined in M_PRS_MAXTIME
+                                */
+       uint32  rxnack;         /**< obsolete */
+       uint32  frmscons;       /**< obsolete */
+       uint32  txnack;         /**< obsolete */
+       uint32  rxback;         /**< blockack rxcnt */
+       uint32  txback;         /**< blockack txcnt */
+       uint32  bphy_rxcrsglitch;       /**< PHY count of bphy glitches */
+       uint32  rxdrop20s;      /**< drop secondary cnt */
+       uint32  rxtoolate;      /**< receive too late */
+       uint32  bphy_badplcp;   /**< number of bad PLCP reception on BPHY rate */
+       /* All counter variables have to be of uint32. */
+} wl_cnt_v_le10_mcst_t;
+
+#define MAX_RX_FIFO 3
+#define WL_RXFIFO_CNT_VERSION  1   /* current version of wl_rxfifo_cnt_t */
+typedef struct {
+       /* Counters for frames received from rx fifos */
+       uint16  version;
+       uint16  length;         /* length of entire structure */
+       uint32  rxf_data[MAX_RX_FIFO];          /* data frames from rx fifo */
+       uint32  rxf_mgmtctl[MAX_RX_FIFO];       /* mgmt/ctl frames from rx fifo */
+} wl_rxfifo_cnt_t;
+
+typedef struct {
+       uint16  version;        /**< see definition of WL_CNT_T_VERSION */
+       uint16  length;         /**< length of entire structure */
+
+       /* transmit stat counters */
+       uint32  txframe;        /**< tx data frames */
+       uint32  txbyte;         /**< tx data bytes */
+       uint32  txretrans;      /**< tx mac retransmits */
+       uint32  txerror;        /**< tx data errors (derived: sum of others) */
+       uint32  txctl;          /**< tx management frames */
+       uint32  txprshort;      /**< tx short preamble frames */
+       uint32  txserr;         /**< tx status errors */
+       uint32  txnobuf;        /**< tx out of buffers errors */
+       uint32  txnoassoc;      /**< tx discard because we're not associated */
+       uint32  txrunt;         /**< tx runt frames */
+       uint32  txchit;         /**< tx header cache hit (fastpath) */
+       uint32  txcmiss;        /**< tx header cache miss (slowpath) */
+
+       /* transmit chip error counters */
+       uint32  txuflo;         /**< tx fifo underflows */
+       uint32  txphyerr;       /**< tx phy errors (indicated in tx status) */
+       uint32  txphycrs;       /**< PR8861/8963 counter */
+
+       /* receive stat counters */
+       uint32  rxframe;        /**< rx data frames */
+       uint32  rxbyte;         /**< rx data bytes */
+       uint32  rxerror;        /**< rx data errors (derived: sum of others) */
+       uint32  rxctl;          /**< rx management frames */
+       uint32  rxnobuf;        /**< rx out of buffers errors */
+       uint32  rxnondata;      /**< rx non data frames in the data channel errors */
+       uint32  rxbadds;        /**< rx bad DS errors */
+       uint32  rxbadcm;        /**< rx bad control or management frames */
+       uint32  rxfragerr;      /**< rx fragmentation errors */
+       uint32  rxrunt;         /**< rx runt frames */
+       uint32  rxgiant;        /**< rx giant frames */
+       uint32  rxnoscb;        /**< rx no scb error */
+       uint32  rxbadproto;     /**< rx invalid frames */
+       uint32  rxbadsrcmac;    /**< rx frames with Invalid Src Mac */
+       uint32  rxbadda;        /**< rx frames tossed for invalid da */
+       uint32  rxfilter;       /**< rx frames filtered out */
+
+       /* receive chip error counters */
+       uint32  rxoflo;         /**< rx fifo overflow errors */
+       uint32  rxuflo[NFIFO];  /**< rx dma descriptor underflow errors */
+
+       uint32  d11cnt_txrts_off;       /**< d11cnt txrts value when reset d11cnt */
+       uint32  d11cnt_rxcrc_off;       /**< d11cnt rxcrc value when reset d11cnt */
+       uint32  d11cnt_txnocts_off;     /**< d11cnt txnocts value when reset d11cnt */
+
+       /* misc counters */
+       uint32  dmade;          /**< tx/rx dma descriptor errors */
+       uint32  dmada;          /**< tx/rx dma data errors */
+       uint32  dmape;          /**< tx/rx dma descriptor protocol errors */
+       uint32  reset;          /**< reset count */
+       uint32  tbtt;           /**< cnts the TBTT int's */
+       uint32  txdmawar;       /**< # occurrences of PR15420 workaround */
+       uint32  pkt_callback_reg_fail;  /**< callbacks register failure */
+
+       /* MAC counters: 32-bit version of d11.h's macstat_t */
+       uint32  txallfrm;       /**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+                                * Control Management (includes retransmissions)
+                                */
+       uint32  txrtsfrm;       /**< number of RTS sent out by the MAC */
+       uint32  txctsfrm;       /**< number of CTS sent out by the MAC */
+       uint32  txackfrm;       /**< number of ACK frames sent out */
+       uint32  txdnlfrm;       /**< Not used */
+       uint32  txbcnfrm;       /**< beacons transmitted */
+       uint32  txfunfl[6];     /**< per-fifo tx underflows */
+       uint32  rxtoolate;      /**< receive too late */
+       uint32  txfbw;          /**< transmit at fallback bw (dynamic bw) */
+       uint32  txtplunfl;      /**< Template underflows (mac was too slow to transmit ACK/CTS
+                                * or BCN)
+                                */
+       uint32  txphyerror;     /**< Transmit phy error, type of error is reported in tx-status for
+                                * driver enqueued frames
+                                */
+       uint32  rxfrmtoolong;   /**< Received frame longer than legal limit (2346 bytes) */
+       uint32  rxfrmtooshrt; /**< Received frame did not contain enough bytes for its frame type */
+       uint32  rxinvmachdr;    /**< Either the protocol version != 0 or frame type not
+                                * data/control/management
+                                */
+       uint32  rxbadfcs;       /**< number of frames for which the CRC check failed in the MAC */
+       uint32  rxbadplcp;      /**< parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  rxstrt;         /**< Number of received frames with a good PLCP
+                                * (i.e. passing parity check)
+                                */
+       uint32  rxdfrmucastmbss; /* Number of received DATA frames with good FCS and matching RA */
+       uint32  rxmfrmucastmbss; /* number of received mgmt frames with good FCS and matching RA */
+       uint32  rxcfrmucast; /**< number of received CNTRL frames with good FCS and matching RA */
+       uint32  rxrtsucast;     /**< number of unicast RTS addressed to the MAC (good FCS) */
+       uint32  rxctsucast;     /**< number of unicast CTS addressed to the MAC (good FCS) */
+       uint32  rxackucast;     /**< number of ucast ACKS received (good FCS) */
+       uint32  rxdfrmocast; /**< number of received DATA frames (good FCS and not matching RA) */
+       uint32  rxmfrmocast; /**< number of received MGMT frames (good FCS and not matching RA) */
+       uint32  rxcfrmocast; /**< number of received CNTRL frame (good FCS and not matching RA) */
+       uint32  rxrtsocast;     /**< number of received RTS not addressed to the MAC */
+       uint32  rxctsocast;     /**< number of received CTS not addressed to the MAC */
+       uint32  rxdfrmmcast;    /**< number of RX Data multicast frames received by the MAC */
+       uint32  rxmfrmmcast;    /**< number of RX Management multicast frames received by the MAC */
+       uint32  rxcfrmmcast;    /**< number of RX Control multicast frames received by the MAC
+                                * (unlikely to see these)
+                                */
+       uint32  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint32  rxdfrmucastobss; /**< number of unicast frames addressed to the MAC from
+                                 * other BSS (WDS FRAME)
+                                 */
+       uint32  rxbeaconobss;   /**< beacons received from other BSS */
+       uint32  rxrsptmout;     /**< Number of response timeouts for transmitted frames
+                                * expecting a response
+                                */
+       uint32  bcntxcancl;     /**< transmit beacons canceled due to receipt of beacon (IBSS) */
+       uint32  rxf0ovfl;       /**< Number of receive fifo 0 overflows */
+       uint32  rxf1ovfl;       /**< Number of receive fifo 1 overflows (obsolete) */
+       uint32  rxf2ovfl;       /**< Number of receive fifo 2 overflows (obsolete) */
+       uint32  txsfovfl;       /**< Number of transmit status fifo overflows (obsolete) */
+       uint32  pmqovfl;        /**< Number of PMQ overflows */
+       uint32  rxcgprqfrm;     /**< Number of received Probe requests that made it into
+                                * the PRQ fifo
+                                */
+       uint32  rxcgprsqovfl;   /**< Rx Probe Request Que overflow in the AP */
+       uint32  txcgprsfail;    /**< Tx Probe Response Fail. AP sent probe response but did
+                                * not get ACK
+                                */
+       uint32  txcgprssuc;     /**< Tx Probe Response Success (ACK was received) */
+       uint32  prs_timeout;    /**< Number of probe requests that were dropped from the PRQ
+                                * fifo because a probe response could not be sent out within
+                                * the time limit defined in M_PRS_MAXTIME
+                                */
+       uint32  rxnack;         /**< obsolete */
+       uint32  frmscons;       /**< obsolete */
+       uint32  txnack;         /**< obsolete */
+       uint32  rxback;         /**< blockack rxcnt */
+       uint32  txback;         /**< blockack txcnt */
+
+       /* 802.11 MIB counters, pp. 614 of 802.11 reaff doc. */
+       uint32  txfrag;         /**< dot11TransmittedFragmentCount */
+       uint32  txmulti;        /**< dot11MulticastTransmittedFrameCount */
+       uint32  txfail;         /**< dot11FailedCount */
+       uint32  txretry;        /**< dot11RetryCount */
+       uint32  txretrie;       /**< dot11MultipleRetryCount */
+       uint32  rxdup;          /**< dot11FrameduplicateCount */
+       uint32  txrts;          /**< dot11RTSSuccessCount */
+       uint32  txnocts;        /**< dot11RTSFailureCount */
+       uint32  txnoack;        /**< dot11ACKFailureCount */
+       uint32  rxfrag;         /**< dot11ReceivedFragmentCount */
+       uint32  rxmulti;        /**< dot11MulticastReceivedFrameCount */
+       uint32  rxcrc;          /**< dot11FCSErrorCount */
+       uint32  txfrmsnt;       /**< dot11TransmittedFrameCount (bogus MIB?) */
+       uint32  rxundec;        /**< dot11WEPUndecryptableCount */
+
+       /* WPA2 counters (see rxundec for DecryptFailureCount) */
+       uint32  tkipmicfaill;   /**< TKIPLocalMICFailures */
+       uint32  tkipcntrmsr;    /**< TKIPCounterMeasuresInvoked */
+       uint32  tkipreplay;     /**< TKIPReplays */
+       uint32  ccmpfmterr;     /**< CCMPFormatErrors */
+       uint32  ccmpreplay;     /**< CCMPReplays */
+       uint32  ccmpundec;      /**< CCMPDecryptErrors */
+       uint32  fourwayfail;    /**< FourWayHandshakeFailures */
+       uint32  wepundec;       /**< dot11WEPUndecryptableCount */
+       uint32  wepicverr;      /**< dot11WEPICVErrorCount */
+       uint32  decsuccess;     /**< DecryptSuccessCount */
+       uint32  tkipicverr;     /**< TKIPICVErrorCount */
+       uint32  wepexcluded;    /**< dot11WEPExcludedCount */
+
+       uint32  txchanrej;      /**< Tx frames suppressed due to channel rejection */
+       uint32  psmwds;         /**< Count PSM watchdogs */
+       uint32  phywatchdog;    /**< Count Phy watchdogs (triggered by ucode) */
+
+       /* MBSS counters, AP only */
+       uint32  prq_entries_handled;    /**< PRQ entries read in */
+       uint32  prq_undirected_entries; /**<    which were bcast bss & ssid */
+       uint32  prq_bad_entries;        /**<    which could not be translated to info */
+       uint32  atim_suppress_count;    /**< TX suppressions on ATIM fifo */
+       uint32  bcn_template_not_ready; /**< Template marked in use on send bcn ... */
+       uint32  bcn_template_not_ready_done; /**< ...but "DMA done" interrupt rcvd */
+       uint32  late_tbtt_dpc;  /**< TBTT DPC did not happen in time */
+
+       /* per-rate receive stat counters */
+       uint32  rx1mbps;        /**< packets rx at 1Mbps */
+       uint32  rx2mbps;        /**< packets rx at 2Mbps */
+       uint32  rx5mbps5;       /**< packets rx at 5.5Mbps */
+       uint32  rx6mbps;        /**< packets rx at 6Mbps */
+       uint32  rx9mbps;        /**< packets rx at 9Mbps */
+       uint32  rx11mbps;       /**< packets rx at 11Mbps */
+       uint32  rx12mbps;       /**< packets rx at 12Mbps */
+       uint32  rx18mbps;       /**< packets rx at 18Mbps */
+       uint32  rx24mbps;       /**< packets rx at 24Mbps */
+       uint32  rx36mbps;       /**< packets rx at 36Mbps */
+       uint32  rx48mbps;       /**< packets rx at 48Mbps */
+       uint32  rx54mbps;       /**< packets rx at 54Mbps */
+       uint32  rx108mbps;      /**< packets rx at 108mbps */
+       uint32  rx162mbps;      /**< packets rx at 162mbps */
+       uint32  rx216mbps;      /**< packets rx at 216 mbps */
+       uint32  rx270mbps;      /**< packets rx at 270 mbps */
+       uint32  rx324mbps;      /**< packets rx at 324 mbps */
+       uint32  rx378mbps;      /**< packets rx at 378 mbps */
+       uint32  rx432mbps;      /**< packets rx at 432 mbps */
+       uint32  rx486mbps;      /**< packets rx at 486 mbps */
+       uint32  rx540mbps;      /**< packets rx at 540 mbps */
+
+       /* pkteng rx frame stats */
+       uint32  pktengrxducast; /**< unicast frames rxed by the pkteng code */
+       uint32  pktengrxdmcast; /**< multicast frames rxed by the pkteng code */
+
+       uint32  rfdisable;      /**< count of radio disables */
+       uint32  bphy_rxcrsglitch;       /**< PHY count of bphy glitches */
+       uint32  bphy_badplcp;
+
+       uint32  txexptime;      /**< Tx frames suppressed due to timer expiration */
+
+       uint32  txmpdu_sgi;     /**< count for sgi transmit */
+       uint32  rxmpdu_sgi;     /**< count for sgi received */
+       uint32  txmpdu_stbc;    /**< count for stbc transmit */
+       uint32  rxmpdu_stbc;    /**< count for stbc received */
+
+       uint32  rxundec_mcst;   /**< dot11WEPUndecryptableCount */
+
+       /* WPA2 counters (see rxundec for DecryptFailureCount) */
+       uint32  tkipmicfaill_mcst;      /**< TKIPLocalMICFailures */
+       uint32  tkipcntrmsr_mcst;       /**< TKIPCounterMeasuresInvoked */
+       uint32  tkipreplay_mcst;        /**< TKIPReplays */
+       uint32  ccmpfmterr_mcst;        /**< CCMPFormatErrors */
+       uint32  ccmpreplay_mcst;        /**< CCMPReplays */
+       uint32  ccmpundec_mcst; /**< CCMPDecryptErrors */
+       uint32  fourwayfail_mcst;       /**< FourWayHandshakeFailures */
+       uint32  wepundec_mcst;  /**< dot11WEPUndecryptableCount */
+       uint32  wepicverr_mcst; /**< dot11WEPICVErrorCount */
+       uint32  decsuccess_mcst;        /**< DecryptSuccessCount */
+       uint32  tkipicverr_mcst;        /**< TKIPICVErrorCount */
+       uint32  wepexcluded_mcst;       /**< dot11WEPExcludedCount */
+
+       uint32  dma_hang;       /**< count for dma hang */
+       uint32  reinit;         /**< count for reinit */
+
+       uint32  pstatxucast;    /**< count of ucast frames xmitted on all psta assoc */
+       uint32  pstatxnoassoc;  /**< count of txnoassoc frames xmitted on all psta assoc */
+       uint32  pstarxucast;    /**< count of ucast frames received on all psta assoc */
+       uint32  pstarxbcmc;     /**< count of bcmc frames received on all psta */
+       uint32  pstatxbcmc;     /**< count of bcmc frames transmitted on all psta */
+
+       uint32  cso_passthrough; /**< hw cso required but passthrough */
+       uint32  cso_normal;     /**< hw cso hdr for normal process */
+       uint32  chained;        /**< number of frames chained */
+       uint32  chainedsz1;     /**< number of chain size 1 frames */
+       uint32  unchained;      /**< number of frames not chained */
+       uint32  maxchainsz;     /**< max chain size so far */
+       uint32  currchainsz;    /**< current chain size */
+       uint32  rxdrop20s;      /**< drop secondary cnt */
+       uint32  pciereset;      /**< Secondary Bus Reset issued by driver */
+       uint32  cfgrestore;     /**< configspace restore by driver */
+       uint32  reinitreason[NREINITREASONCOUNT]; /**< reinitreason counters; 0: Unknown reason */
+       uint32  rxrtry;         /**< num of received packets with retry bit on */
+       uint32  txmpdu;         /**< macstat cnt only valid in ver 11. number of MPDUs txed.  */
+       uint32  rxnodelim;      /**< macstat cnt only valid in ver 11.
+                                * number of occasions that no valid delimiter is detected
+                                * by ampdu parser.
+                                */
+       uint32  rxmpdu_mu;      /**< Number of MU MPDUs received */
+
+       /* detailed control/management frames */
+       uint32  txbar;          /**< Number of TX BAR */
+       uint32  rxbar;          /**< Number of RX BAR */
+       uint32  txpspoll;       /**< Number of TX PS-poll */
+       uint32  rxpspoll;       /**< Number of RX PS-poll */
+       uint32  txnull;         /**< Number of TX NULL_DATA */
+       uint32  rxnull;         /**< Number of RX NULL_DATA */
+       uint32  txqosnull;      /**< Number of TX NULL_QoSDATA */
+       uint32  rxqosnull;      /**< Number of RX NULL_QoSDATA */
+       uint32  txassocreq;     /**< Number of TX ASSOC request */
+       uint32  rxassocreq;     /**< Number of RX ASSOC request */
+       uint32  txreassocreq;   /**< Number of TX REASSOC request */
+       uint32  rxreassocreq;   /**< Number of RX REASSOC request */
+       uint32  txdisassoc;     /**< Number of TX DISASSOC */
+       uint32  rxdisassoc;     /**< Number of RX DISASSOC */
+       uint32  txassocrsp;     /**< Number of TX ASSOC response */
+       uint32  rxassocrsp;     /**< Number of RX ASSOC response */
+       uint32  txreassocrsp;   /**< Number of TX REASSOC response */
+       uint32  rxreassocrsp;   /**< Number of RX REASSOC response */
+       uint32  txauth;         /**< Number of TX AUTH */
+       uint32  rxauth;         /**< Number of RX AUTH */
+       uint32  txdeauth;       /**< Number of TX DEAUTH */
+       uint32  rxdeauth;       /**< Number of RX DEAUTH */
+       uint32  txprobereq;     /**< Number of TX probe request */
+       uint32  rxprobereq;     /**< Number of RX probe request */
+       uint32  txprobersp;     /**< Number of TX probe response */
+       uint32  rxprobersp;     /**< Number of RX probe response */
+       uint32  txaction;       /**< Number of TX action frame */
+       uint32  rxaction;       /**< Number of RX action frame */
+       uint32  ampdu_wds;      /**< Number of AMPDU watchdogs */
+       uint32  txlost;         /**< Number of lost packets reported in txs */
+       uint32  txdatamcast;    /**< Number of TX multicast data packets */
+       uint32  txdatabcast;    /**< Number of TX broadcast data packets */
+       uint32  txbcast;        /* Broadcast TransmittedFrameCount */
+       uint32  txdropped;      /* tx dropped pkts */
+       uint32  rxbcast;        /* BroadcastReceivedFrameCount */
+       uint32  rxdropped;      /* rx dropped pkts (derived: sum of others) */
+
+       /* This structure is deprecated and used only for ver <= 11.
+        * All counter variables have to be of uint32.
+        */
+} wl_cnt_ver_11_t;
+
+typedef struct {
+       uint16  version;        /* see definition of WL_CNT_T_VERSION */
+       uint16  length;         /* length of entire structure */
+
+       /* transmit stat counters */
+       uint32  txframe;        /* tx data frames */
+       uint32  txbyte;         /* tx data bytes */
+       uint32  txretrans;      /* tx mac retransmits */
+       uint32  txerror;        /* tx data errors (derived: sum of others) */
+       uint32  txctl;          /* tx management frames */
+       uint32  txprshort;      /* tx short preamble frames */
+       uint32  txserr;         /* tx status errors */
+       uint32  txnobuf;        /* tx out of buffers errors */
+       uint32  txnoassoc;      /* tx discard because we're not associated */
+       uint32  txrunt;         /* tx runt frames */
+       uint32  txchit;         /* tx header cache hit (fastpath) */
+       uint32  txcmiss;        /* tx header cache miss (slowpath) */
+
+       /* transmit chip error counters */
+       uint32  txuflo;         /* tx fifo underflows */
+       uint32  txphyerr;       /* tx phy errors (indicated in tx status) */
+       uint32  txphycrs;       /* PR8861/8963 counter */
+
+       /* receive stat counters */
+       uint32  rxframe;        /* rx data frames */
+       uint32  rxbyte;         /* rx data bytes */
+       uint32  rxerror;        /* rx data errors (derived: sum of others) */
+       uint32  rxctl;          /* rx management frames */
+       uint32  rxnobuf;        /* rx out of buffers errors */
+       uint32  rxnondata;      /* rx non data frames in the data channel errors */
+       uint32  rxbadds;        /* rx bad DS errors */
+       uint32  rxbadcm;        /* rx bad control or management frames */
+       uint32  rxfragerr;      /* rx fragmentation errors */
+       uint32  rxrunt;         /* rx runt frames */
+       uint32  rxgiant;        /* rx giant frames */
+       uint32  rxnoscb;        /* rx no scb error */
+       uint32  rxbadproto;     /* rx invalid frames */
+       uint32  rxbadsrcmac;    /* rx frames with Invalid Src Mac */
+       uint32  rxbadda;        /* rx frames tossed for invalid da */
+       uint32  rxfilter;       /* rx frames filtered out */
+
+       /* receive chip error counters */
+       uint32  rxoflo;         /* rx fifo overflow errors */
+       uint32  rxuflo[NFIFO];  /* rx dma descriptor underflow errors */
+
+       uint32  d11cnt_txrts_off;       /* d11cnt txrts value when reset d11cnt */
+       uint32  d11cnt_rxcrc_off;       /* d11cnt rxcrc value when reset d11cnt */
+       uint32  d11cnt_txnocts_off;     /* d11cnt txnocts value when reset d11cnt */
+
+       /* misc counters */
+       uint32  dmade;          /* tx/rx dma descriptor errors */
+       uint32  dmada;          /* tx/rx dma data errors */
+       uint32  dmape;          /* tx/rx dma descriptor protocol errors */
+       uint32  reset;          /* reset count */
+       uint32  tbtt;           /* cnts the TBTT int's */
+       uint32  txdmawar;       /* # occurrences of PR15420 workaround */
+       uint32  pkt_callback_reg_fail;  /* callbacks register failure */
+
+       /* MAC counters: 32-bit version of d11.h's macstat_t */
+       uint32  txallfrm;       /* total number of frames sent, incl. Data, ACK, RTS, CTS,
+                                * Control Management (includes retransmissions)
+                                */
+       uint32  txrtsfrm;       /* number of RTS sent out by the MAC */
+       uint32  txctsfrm;       /* number of CTS sent out by the MAC */
+       uint32  txackfrm;       /* number of ACK frames sent out */
+       uint32  txdnlfrm;       /* Not used */
+       uint32  txbcnfrm;       /* beacons transmitted */
+       uint32  txfunfl[8];     /* per-fifo tx underflows */
+       uint32  txtplunfl;      /* Template underflows (mac was too slow to transmit ACK/CTS
+                                * or BCN)
+                                */
+       uint32  txphyerror;     /* Transmit phy error, type of error is reported in tx-status for
+                                * driver enqueued frames
+                                */
+       uint32  rxfrmtoolong;   /* Received frame longer than legal limit (2346 bytes) */
+       uint32  rxfrmtooshrt;   /* Received frame did not contain enough bytes for its frame type */
+       uint32  rxinvmachdr;    /* Either the protocol version != 0 or frame type not
+                                * data/control/management
+                                */
+       uint32  rxbadfcs;       /* number of frames for which the CRC check failed in the MAC */
+       uint32  rxbadplcp;      /* parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /* PHY was able to correlate the preamble but not the header */
+       uint32  rxstrt;         /* Number of received frames with a good PLCP
+                                * (i.e. passing parity check)
+                                */
+       uint32  rxdfrmucastmbss; /* Number of received DATA frames with good FCS and matching RA */
+       uint32  rxmfrmucastmbss; /* number of received mgmt frames with good FCS and matching RA */
+       uint32  rxcfrmucast;    /* number of received CNTRL frames with good FCS and matching RA */
+       uint32  rxrtsucast;     /* number of unicast RTS addressed to the MAC (good FCS) */
+       uint32  rxctsucast;     /* number of unicast CTS addressed to the MAC (good FCS) */
+       uint32  rxackucast;     /* number of ucast ACKS received (good FCS) */
+       uint32  rxdfrmocast;    /* number of received DATA frames (good FCS and not matching RA) */
+       uint32  rxmfrmocast;    /* number of received MGMT frames (good FCS and not matching RA) */
+       uint32  rxcfrmocast;    /* number of received CNTRL frame (good FCS and not matching RA) */
+       uint32  rxrtsocast;     /* number of received RTS not addressed to the MAC */
+       uint32  rxctsocast;     /* number of received CTS not addressed to the MAC */
+       uint32  rxdfrmmcast;    /* number of RX Data multicast frames received by the MAC */
+       uint32  rxmfrmmcast;    /* number of RX Management multicast frames received by the MAC */
+       uint32  rxcfrmmcast;    /* number of RX Control multicast frames received by the MAC
+                                * (unlikely to see these)
+                                */
+       uint32  rxbeaconmbss;   /* beacons received from member of BSS */
+       uint32  rxdfrmucastobss; /* number of unicast frames addressed to the MAC from
+                                 * other BSS (WDS FRAME)
+                                 */
+       uint32  rxbeaconobss;   /* beacons received from other BSS */
+       uint32  rxrsptmout;     /* Number of response timeouts for transmitted frames
+                                * expecting a response
+                                */
+       uint32  bcntxcancl;     /* transmit beacons canceled due to receipt of beacon (IBSS) */
+       uint32  rxf0ovfl;       /* Number of receive fifo 0 overflows */
+       uint32  rxf1ovfl;       /* Number of receive fifo 1 overflows (obsolete) */
+       uint32  rxf2ovfl;       /* Number of receive fifo 2 overflows (obsolete) */
+       uint32  txsfovfl;       /* Number of transmit status fifo overflows (obsolete) */
+       uint32  pmqovfl;        /* Number of PMQ overflows */
+       uint32  rxcgprqfrm;     /* Number of received Probe requests that made it into
+                                * the PRQ fifo
+                                */
+       uint32  rxcgprsqovfl;   /* Rx Probe Request Que overflow in the AP */
+       uint32  txcgprsfail;    /* Tx Probe Response Fail. AP sent probe response but did
+                                * not get ACK
+                                */
+       uint32  txcgprssuc;     /* Tx Probe Response Success (ACK was received) */
+       uint32  prs_timeout;    /* Number of probe requests that were dropped from the PRQ
+                                * fifo because a probe response could not be sent out within
+                                * the time limit defined in M_PRS_MAXTIME
+                                */
+       uint32  rxnack;         /* obsolete */
+       uint32  frmscons;       /* obsolete */
+       uint32  txnack;         /* obsolete */
+       uint32  txglitch_nack;  /* obsolete */
+       uint32  txburst;        /* obsolete */
+
+       /* 802.11 MIB counters, pp. 614 of 802.11 reaff doc. */
+       uint32  txfrag;         /* dot11TransmittedFragmentCount */
+       uint32  txmulti;        /* dot11MulticastTransmittedFrameCount */
+       uint32  txfail;         /* dot11FailedCount */
+       uint32  txretry;        /* dot11RetryCount */
+       uint32  txretrie;       /* dot11MultipleRetryCount */
+       uint32  rxdup;          /* dot11FrameduplicateCount */
+       uint32  txrts;          /* dot11RTSSuccessCount */
+       uint32  txnocts;        /* dot11RTSFailureCount */
+       uint32  txnoack;        /* dot11ACKFailureCount */
+       uint32  rxfrag;         /* dot11ReceivedFragmentCount */
+       uint32  rxmulti;        /* dot11MulticastReceivedFrameCount */
+       uint32  rxcrc;          /* dot11FCSErrorCount */
+       uint32  txfrmsnt;       /* dot11TransmittedFrameCount (bogus MIB?) */
+       uint32  rxundec;        /* dot11WEPUndecryptableCount */
+
+       /* WPA2 counters (see rxundec for DecryptFailureCount) */
+       uint32  tkipmicfaill;   /* TKIPLocalMICFailures */
+       uint32  tkipcntrmsr;    /* TKIPCounterMeasuresInvoked */
+       uint32  tkipreplay;     /* TKIPReplays */
+       uint32  ccmpfmterr;     /* CCMPFormatErrors */
+       uint32  ccmpreplay;     /* CCMPReplays */
+       uint32  ccmpundec;      /* CCMPDecryptErrors */
+       uint32  fourwayfail;    /* FourWayHandshakeFailures */
+       uint32  wepundec;       /* dot11WEPUndecryptableCount */
+       uint32  wepicverr;      /* dot11WEPICVErrorCount */
+       uint32  decsuccess;     /* DecryptSuccessCount */
+       uint32  tkipicverr;     /* TKIPICVErrorCount */
+       uint32  wepexcluded;    /* dot11WEPExcludedCount */
+
+       uint32  txchanrej;      /* Tx frames suppressed due to channel rejection */
+       uint32  psmwds;         /* Count PSM watchdogs */
+       uint32  phywatchdog;    /* Count Phy watchdogs (triggered by ucode) */
+
+       /* MBSS counters, AP only */
+       uint32  prq_entries_handled;    /* PRQ entries read in */
+       uint32  prq_undirected_entries; /*    which were bcast bss & ssid */
+       uint32  prq_bad_entries;        /*    which could not be translated to info */
+       uint32  atim_suppress_count;    /* TX suppressions on ATIM fifo */
+       uint32  bcn_template_not_ready; /* Template marked in use on send bcn ... */
+       uint32  bcn_template_not_ready_done; /* ...but "DMA done" interrupt rcvd */
+       uint32  late_tbtt_dpc;  /* TBTT DPC did not happen in time */
+
+       /* per-rate receive stat counters */
+       uint32  rx1mbps;        /* packets rx at 1Mbps */
+       uint32  rx2mbps;        /* packets rx at 2Mbps */
+       uint32  rx5mbps5;       /* packets rx at 5.5Mbps */
+       uint32  rx6mbps;        /* packets rx at 6Mbps */
+       uint32  rx9mbps;        /* packets rx at 9Mbps */
+       uint32  rx11mbps;       /* packets rx at 11Mbps */
+       uint32  rx12mbps;       /* packets rx at 12Mbps */
+       uint32  rx18mbps;       /* packets rx at 18Mbps */
+       uint32  rx24mbps;       /* packets rx at 24Mbps */
+       uint32  rx36mbps;       /* packets rx at 36Mbps */
+       uint32  rx48mbps;       /* packets rx at 48Mbps */
+       uint32  rx54mbps;       /* packets rx at 54Mbps */
+       uint32  rx108mbps;      /* packets rx at 108mbps */
+       uint32  rx162mbps;      /* packets rx at 162mbps */
+       uint32  rx216mbps;      /* packets rx at 216 mbps */
+       uint32  rx270mbps;      /* packets rx at 270 mbps */
+       uint32  rx324mbps;      /* packets rx at 324 mbps */
+       uint32  rx378mbps;      /* packets rx at 378 mbps */
+       uint32  rx432mbps;      /* packets rx at 432 mbps */
+       uint32  rx486mbps;      /* packets rx at 486 mbps */
+       uint32  rx540mbps;      /* packets rx at 540 mbps */
+
+       /* pkteng rx frame stats */
+       uint32  pktengrxducast; /* unicast frames rxed by the pkteng code */
+       uint32  pktengrxdmcast; /* multicast frames rxed by the pkteng code */
+
+       uint32  rfdisable;      /* count of radio disables */
+       uint32  bphy_rxcrsglitch;       /* PHY count of bphy glitches */
+
+       uint32  txexptime;      /* Tx frames suppressed due to timer expiration */
+
+       uint32  txmpdu_sgi;     /* count for sgi transmit */
+       uint32  rxmpdu_sgi;     /* count for sgi received */
+       uint32  txmpdu_stbc;    /* count for stbc transmit */
+       uint32  rxmpdu_stbc;    /* count for stbc received */
+
+       uint32  rxundec_mcst;   /* dot11WEPUndecryptableCount */
+
+       /* WPA2 counters (see rxundec for DecryptFailureCount) */
+       uint32  tkipmicfaill_mcst;      /* TKIPLocalMICFailures */
+       uint32  tkipcntrmsr_mcst;       /* TKIPCounterMeasuresInvoked */
+       uint32  tkipreplay_mcst;        /* TKIPReplays */
+       uint32  ccmpfmterr_mcst;        /* CCMPFormatErrors */
+       uint32  ccmpreplay_mcst;        /* CCMPReplays */
+       uint32  ccmpundec_mcst; /* CCMPDecryptErrors */
+       uint32  fourwayfail_mcst;       /* FourWayHandshakeFailures */
+       uint32  wepundec_mcst;  /* dot11WEPUndecryptableCount */
+       uint32  wepicverr_mcst; /* dot11WEPICVErrorCount */
+       uint32  decsuccess_mcst;        /* DecryptSuccessCount */
+       uint32  tkipicverr_mcst;        /* TKIPICVErrorCount */
+       uint32  wepexcluded_mcst;       /* dot11WEPExcludedCount */
+
+       uint32  dma_hang;       /* count for stbc received */
+       uint32  rxrtry;         /* number of packets with retry bit set to 1 */
+} wl_cnt_ver_7_t;
+
+typedef struct {
+       uint16  version;    /**< see definition of WL_CNT_T_VERSION */
+       uint16  length;     /**< length of entire structure */
+
+       /* transmit stat counters */
+       uint32  txframe;    /**< tx data frames */
+       uint32  txbyte;     /**< tx data bytes */
+       uint32  txretrans;  /**< tx mac retransmits */
+       uint32  txerror;    /**< tx data errors (derived: sum of others) */
+       uint32  txctl;      /**< tx management frames */
+       uint32  txprshort;  /**< tx short preamble frames */
+       uint32  txserr;     /**< tx status errors */
+       uint32  txnobuf;    /**< tx out of buffers errors */
+       uint32  txnoassoc;  /**< tx discard because we're not associated */
+       uint32  txrunt;     /**< tx runt frames */
+       uint32  txchit;     /**< tx header cache hit (fastpath) */
+       uint32  txcmiss;    /**< tx header cache miss (slowpath) */
+
+       /* transmit chip error counters */
+       uint32  txuflo;     /**< tx fifo underflows */
+       uint32  txphyerr;   /**< tx phy errors (indicated in tx status) */
+       uint32  txphycrs;   /**< PR8861/8963 counter */
+
+       /* receive stat counters */
+       uint32  rxframe;    /**< rx data frames */
+       uint32  rxbyte;     /**< rx data bytes */
+       uint32  rxerror;    /**< rx data errors (derived: sum of others) */
+       uint32  rxctl;      /**< rx management frames */
+       uint32  rxnobuf;    /**< rx out of buffers errors */
+       uint32  rxnondata;  /**< rx non data frames in the data channel errors */
+       uint32  rxbadds;    /**< rx bad DS errors */
+       uint32  rxbadcm;    /**< rx bad control or management frames */
+       uint32  rxfragerr;  /**< rx fragmentation errors */
+       uint32  rxrunt;     /**< rx runt frames */
+       uint32  rxgiant;    /**< rx giant frames */
+       uint32  rxnoscb;    /**< rx no scb error */
+       uint32  rxbadproto; /**< rx invalid frames */
+       uint32  rxbadsrcmac;    /**< rx frames with Invalid Src Mac */
+       uint32  rxbadda;    /**< rx frames tossed for invalid da */
+       uint32  rxfilter;   /**< rx frames filtered out */
+
+       /* receive chip error counters */
+       uint32  rxoflo;     /**< rx fifo overflow errors */
+       uint32  rxuflo[NFIFO];  /**< rx dma descriptor underflow errors */
+
+       uint32  d11cnt_txrts_off;   /**< d11cnt txrts value when reset d11cnt */
+       uint32  d11cnt_rxcrc_off;   /**< d11cnt rxcrc value when reset d11cnt */
+       uint32  d11cnt_txnocts_off; /**< d11cnt txnocts value when reset d11cnt */
+
+       /* misc counters */
+       uint32  dmade;      /**< tx/rx dma descriptor errors */
+       uint32  dmada;      /**< tx/rx dma data errors */
+       uint32  dmape;      /**< tx/rx dma descriptor protocol errors */
+       uint32  reset;      /**< reset count */
+       uint32  tbtt;       /**< cnts the TBTT int's */
+       uint32  txdmawar;   /**< # occurrences of PR15420 workaround */
+       uint32  pkt_callback_reg_fail;  /**< callbacks register failure */
+
+       /* MAC counters: 32-bit version of d11.h's macstat_t */
+       uint32  txallfrm;   /**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+                            * Control Management (includes retransmissions)
+                            */
+       uint32  txrtsfrm;   /**< number of RTS sent out by the MAC */
+       uint32  txctsfrm;   /**< number of CTS sent out by the MAC */
+       uint32  txackfrm;   /**< number of ACK frames sent out */
+       uint32  txdnlfrm;   /**< Not used */
+       uint32  txbcnfrm;   /**< beacons transmitted */
+       uint32  txfunfl[6]; /**< per-fifo tx underflows */
+       uint32  rxtoolate;      /**< receive too late */
+       uint32  txfbw;      /**< transmit at fallback bw (dynamic bw) */
+       uint32  txtplunfl;  /**< Template underflows (mac was too slow to transmit ACK/CTS
+                            * or BCN)
+                            */
+       uint32  txphyerror; /**< Transmit phy error, type of error is reported in tx-status for
+                            * driver enqueued frames
+                            */
+       uint32  rxfrmtoolong;   /**< Received frame longer than legal limit (2346 bytes) */
+       uint32  rxfrmtooshrt; /**< Received frame did not contain enough bytes for its frame type */
+       uint32  rxinvmachdr;    /**< Either the protocol version != 0 or frame type not
+                                * data/control/management
+                          */
+       uint32  rxbadfcs;   /**< number of frames for which the CRC check failed in the MAC */
+       uint32  rxbadplcp;  /**< parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  rxstrt;     /**< Number of received frames with a good PLCP
+                            * (i.e. passing parity check)
+                            */
+       uint32  rxdfrmucastmbss; /**< # of received DATA frames with good FCS and matching RA */
+       uint32  rxmfrmucastmbss; /**< # of received mgmt frames with good FCS and matching RA */
+       uint32  rxcfrmucast;     /**< # of received CNTRL frames with good FCS and matching RA */
+       uint32  rxrtsucast; /**< number of unicast RTS addressed to the MAC (good FCS) */
+       uint32  rxctsucast; /**< number of unicast CTS addressed to the MAC (good FCS) */
+       uint32  rxackucast; /**< number of ucast ACKS received (good FCS) */
+       uint32  rxdfrmocast;    /**< # of received DATA frames (good FCS and not matching RA) */
+       uint32  rxmfrmocast;    /**< # of received MGMT frames (good FCS and not matching RA) */
+       uint32  rxcfrmocast;    /**< # of received CNTRL frame (good FCS and not matching RA) */
+       uint32  rxrtsocast; /**< number of received RTS not addressed to the MAC */
+       uint32  rxctsocast; /**< number of received CTS not addressed to the MAC */
+       uint32  rxdfrmmcast;    /**< number of RX Data multicast frames received by the MAC */
+       uint32  rxmfrmmcast;    /**< number of RX Management multicast frames received by the MAC */
+       uint32  rxcfrmmcast;    /**< number of RX Control multicast frames received by the MAC
+                                * (unlikely to see these)
+                                */
+       uint32  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint32  rxdfrmucastobss; /**< number of unicast frames addressed to the MAC from
+                                 * other BSS (WDS FRAME)
+                                 */
+       uint32  rxbeaconobss;   /**< beacons received from other BSS */
+       uint32  rxrsptmout; /**< Number of response timeouts for transmitted frames
+                            * expecting a response
+                            */
+       uint32  bcntxcancl; /**< transmit beacons canceled due to receipt of beacon (IBSS) */
+       uint32  rxf0ovfl;   /**< Number of receive fifo 0 overflows */
+       uint32  rxf1ovfl;   /**< Number of receive fifo 1 overflows (obsolete) */
+       uint32  rxf2ovfl;   /**< Number of receive fifo 2 overflows (obsolete) */
+       uint32  txsfovfl;   /**< Number of transmit status fifo overflows (obsolete) */
+       uint32  pmqovfl;    /**< Number of PMQ overflows */
+       uint32  rxcgprqfrm; /**< Number of received Probe requests that made it into
+                            * the PRQ fifo
+                            */
+       uint32  rxcgprsqovfl;   /**< Rx Probe Request Que overflow in the AP */
+       uint32  txcgprsfail;    /**< Tx Probe Response Fail. AP sent probe response but did
+                                * not get ACK
+                                */
+       uint32  txcgprssuc; /**< Tx Probe Response Success (ACK was received) */
+       uint32  prs_timeout;    /**< Number of probe requests that were dropped from the PRQ
+                                * fifo because a probe response could not be sent out within
+                                * the time limit defined in M_PRS_MAXTIME
+                                */
+       uint32  rxnack;     /**< Number of NACKS received (Afterburner) */
+       uint32  frmscons;   /**< Number of frames completed without transmission because of an
+                            * Afterburner re-queue
+                            */
+       uint32  txnack;         /**< obsolete */
+       uint32  rxback;         /**< blockack rxcnt */
+       uint32  txback;         /**< blockack txcnt */
+
+       /* 802.11 MIB counters, pp. 614 of 802.11 reaff doc. */
+       uint32  txfrag;     /**< dot11TransmittedFragmentCount */
+       uint32  txmulti;    /**< dot11MulticastTransmittedFrameCount */
+       uint32  txfail;     /**< dot11FailedCount */
+       uint32  txretry;    /**< dot11RetryCount */
+       uint32  txretrie;   /**< dot11MultipleRetryCount */
+       uint32  rxdup;      /**< dot11FrameduplicateCount */
+       uint32  txrts;      /**< dot11RTSSuccessCount */
+       uint32  txnocts;    /**< dot11RTSFailureCount */
+       uint32  txnoack;    /**< dot11ACKFailureCount */
+       uint32  rxfrag;     /**< dot11ReceivedFragmentCount */
+       uint32  rxmulti;    /**< dot11MulticastReceivedFrameCount */
+       uint32  rxcrc;      /**< dot11FCSErrorCount */
+       uint32  txfrmsnt;   /**< dot11TransmittedFrameCount (bogus MIB?) */
+       uint32  rxundec;    /**< dot11WEPUndecryptableCount */
+
+       /* WPA2 counters (see rxundec for DecryptFailureCount) */
+       uint32  tkipmicfaill;   /**< TKIPLocalMICFailures */
+       uint32  tkipcntrmsr;    /**< TKIPCounterMeasuresInvoked */
+       uint32  tkipreplay; /**< TKIPReplays */
+       uint32  ccmpfmterr; /**< CCMPFormatErrors */
+       uint32  ccmpreplay; /**< CCMPReplays */
+       uint32  ccmpundec;  /**< CCMPDecryptErrors */
+       uint32  fourwayfail;    /**< FourWayHandshakeFailures */
+       uint32  wepundec;   /**< dot11WEPUndecryptableCount */
+       uint32  wepicverr;  /**< dot11WEPICVErrorCount */
+       uint32  decsuccess; /**< DecryptSuccessCount */
+       uint32  tkipicverr; /**< TKIPICVErrorCount */
+       uint32  wepexcluded;    /**< dot11WEPExcludedCount */
+
+       uint32  rxundec_mcst;   /**< dot11WEPUndecryptableCount */
+
+       /* WPA2 counters (see rxundec for DecryptFailureCount) */
+       uint32  tkipmicfaill_mcst;  /**< TKIPLocalMICFailures */
+       uint32  tkipcntrmsr_mcst;   /**< TKIPCounterMeasuresInvoked */
+       uint32  tkipreplay_mcst;    /**< TKIPReplays */
+       uint32  ccmpfmterr_mcst;    /**< CCMPFormatErrors */
+       uint32  ccmpreplay_mcst;    /**< CCMPReplays */
+       uint32  ccmpundec_mcst; /**< CCMPDecryptErrors */
+       uint32  fourwayfail_mcst;   /**< FourWayHandshakeFailures */
+       uint32  wepundec_mcst;  /**< dot11WEPUndecryptableCount */
+       uint32  wepicverr_mcst; /**< dot11WEPICVErrorCount */
+       uint32  decsuccess_mcst;    /**< DecryptSuccessCount */
+       uint32  tkipicverr_mcst;    /**< TKIPICVErrorCount */
+       uint32  wepexcluded_mcst;   /**< dot11WEPExcludedCount */
+
+       uint32  txchanrej;  /**< Tx frames suppressed due to channel rejection */
+       uint32  txexptime;  /**< Tx frames suppressed due to timer expiration */
+       uint32  psmwds;     /**< Count PSM watchdogs */
+       uint32  phywatchdog;    /**< Count Phy watchdogs (triggered by ucode) */
+
+       /* MBSS counters, AP only */
+       uint32  prq_entries_handled;    /**< PRQ entries read in */
+       uint32  prq_undirected_entries; /**<    which were bcast bss & ssid */
+       uint32  prq_bad_entries;    /**<    which could not be translated to info */
+       uint32  atim_suppress_count;    /**< TX suppressions on ATIM fifo */
+       uint32  bcn_template_not_ready; /**< Template marked in use on send bcn ... */
+       uint32  bcn_template_not_ready_done; /**< ...but "DMA done" interrupt rcvd */
+       uint32  late_tbtt_dpc;  /**< TBTT DPC did not happen in time */
+
+       /* per-rate receive stat counters */
+       uint32  rx1mbps;    /**< packets rx at 1Mbps */
+       uint32  rx2mbps;    /**< packets rx at 2Mbps */
+       uint32  rx5mbps5;   /**< packets rx at 5.5Mbps */
+       uint32  rx6mbps;    /**< packets rx at 6Mbps */
+       uint32  rx9mbps;    /**< packets rx at 9Mbps */
+       uint32  rx11mbps;   /**< packets rx at 11Mbps */
+       uint32  rx12mbps;   /**< packets rx at 12Mbps */
+       uint32  rx18mbps;   /**< packets rx at 18Mbps */
+       uint32  rx24mbps;   /**< packets rx at 24Mbps */
+       uint32  rx36mbps;   /**< packets rx at 36Mbps */
+       uint32  rx48mbps;   /**< packets rx at 48Mbps */
+       uint32  rx54mbps;   /**< packets rx at 54Mbps */
+       uint32  rx108mbps;  /**< packets rx at 108mbps */
+       uint32  rx162mbps;  /**< packets rx at 162mbps */
+       uint32  rx216mbps;  /**< packets rx at 216 mbps */
+       uint32  rx270mbps;  /**< packets rx at 270 mbps */
+       uint32  rx324mbps;  /**< packets rx at 324 mbps */
+       uint32  rx378mbps;  /**< packets rx at 378 mbps */
+       uint32  rx432mbps;  /**< packets rx at 432 mbps */
+       uint32  rx486mbps;  /**< packets rx at 486 mbps */
+       uint32  rx540mbps;  /**< packets rx at 540 mbps */
+
+       /* pkteng rx frame stats */
+       uint32  pktengrxducast; /**< unicast frames rxed by the pkteng code */
+       uint32  pktengrxdmcast; /**< multicast frames rxed by the pkteng code */
+
+       uint32  rfdisable;  /**< count of radio disables */
+       uint32  bphy_rxcrsglitch;   /**< PHY count of bphy glitches */
+       uint32  bphy_badplcp;
+
+       uint32  txmpdu_sgi; /**< count for sgi transmit */
+       uint32  rxmpdu_sgi; /**< count for sgi received */
+       uint32  txmpdu_stbc;    /**< count for stbc transmit */
+       uint32  rxmpdu_stbc;    /**< count for stbc received */
+
+       uint32  rxdrop20s;      /**< drop secondary cnt */
+       /* All counter variables have to be of uint32. */
+} wl_cnt_ver_6_t;
+
+#define        WL_DELTA_STATS_T_VERSION        2       /**< current version of wl_delta_stats_t struct */
+
+typedef struct {
+       uint16 version;     /**< see definition of WL_DELTA_STATS_T_VERSION */
+       uint16 length;      /**< length of entire structure */
+
+       /* transmit stat counters */
+       uint32 txframe;     /**< tx data frames */
+       uint32 txbyte;      /**< tx data bytes */
+       uint32 txretrans;   /**< tx mac retransmits */
+       uint32 txfail;      /**< tx failures */
+
+       /* receive stat counters */
+       uint32 rxframe;     /**< rx data frames */
+       uint32 rxbyte;      /**< rx data bytes */
+
+       /* per-rate receive stat counters */
+       uint32  rx1mbps;        /**< packets rx at 1Mbps */
+       uint32  rx2mbps;        /**< packets rx at 2Mbps */
+       uint32  rx5mbps5;       /**< packets rx at 5.5Mbps */
+       uint32  rx6mbps;        /**< packets rx at 6Mbps */
+       uint32  rx9mbps;        /**< packets rx at 9Mbps */
+       uint32  rx11mbps;       /**< packets rx at 11Mbps */
+       uint32  rx12mbps;       /**< packets rx at 12Mbps */
+       uint32  rx18mbps;       /**< packets rx at 18Mbps */
+       uint32  rx24mbps;       /**< packets rx at 24Mbps */
+       uint32  rx36mbps;       /**< packets rx at 36Mbps */
+       uint32  rx48mbps;       /**< packets rx at 48Mbps */
+       uint32  rx54mbps;       /**< packets rx at 54Mbps */
+       uint32  rx108mbps;      /**< packets rx at 108mbps */
+       uint32  rx162mbps;      /**< packets rx at 162mbps */
+       uint32  rx216mbps;      /**< packets rx at 216 mbps */
+       uint32  rx270mbps;      /**< packets rx at 270 mbps */
+       uint32  rx324mbps;      /**< packets rx at 324 mbps */
+       uint32  rx378mbps;      /**< packets rx at 378 mbps */
+       uint32  rx432mbps;      /**< packets rx at 432 mbps */
+       uint32  rx486mbps;      /**< packets rx at 486 mbps */
+       uint32  rx540mbps;      /**< packets rx at 540 mbps */
+
+       /* phy stats */
+       uint32 rxbadplcp;
+       uint32 rxcrsglitch;
+       uint32 bphy_rxcrsglitch;
+       uint32 bphy_badplcp;
+
+       uint32 slice_index; /**< Slice for which stats are reported */
+
+} wl_delta_stats_t;
+
+/* Partial statistics counter report */
+#define WL_CNT_CTL_MGT_FRAMES  0
+
+typedef struct {
+       uint16  type;
+       uint16  len;
+
+       /* detailed control/management frames */
+       uint32  txnull;
+       uint32  rxnull;
+       uint32  txqosnull;
+       uint32  rxqosnull;
+       uint32  txassocreq;
+       uint32  rxassocreq;
+       uint32  txreassocreq;
+       uint32  rxreassocreq;
+       uint32  txdisassoc;
+       uint32  rxdisassoc;
+       uint32  txassocrsp;
+       uint32  rxassocrsp;
+       uint32  txreassocrsp;
+       uint32  rxreassocrsp;
+       uint32  txauth;
+       uint32  rxauth;
+       uint32  txdeauth;
+       uint32  rxdeauth;
+       uint32  txprobereq;
+       uint32  rxprobereq;
+       uint32  txprobersp;
+       uint32  rxprobersp;
+       uint32  txaction;
+       uint32  rxaction;
+       uint32  txrts;
+       uint32  rxrts;
+       uint32  txcts;
+       uint32  rxcts;
+       uint32  txack;
+       uint32  rxack;
+       uint32  txbar;
+       uint32  rxbar;
+       uint32  txback;
+       uint32  rxback;
+       uint32  txpspoll;
+       uint32  rxpspoll;
+} wl_ctl_mgt_cnt_t;
+
+typedef struct {
+       uint32 packets;
+       uint32 bytes;
+} wl_traffic_stats_t;
+
+typedef struct {
+       uint16  version;        /**< see definition of WL_WME_CNT_VERSION */
+       uint16  length;         /**< length of entire structure */
+
+       wl_traffic_stats_t tx[AC_COUNT];        /**< Packets transmitted */
+       wl_traffic_stats_t tx_failed[AC_COUNT]; /**< Packets dropped or failed to transmit */
+       wl_traffic_stats_t rx[AC_COUNT];        /**< Packets received */
+       wl_traffic_stats_t rx_failed[AC_COUNT]; /**< Packets failed to receive */
+
+       wl_traffic_stats_t forward[AC_COUNT];   /**< Packets forwarded by AP */
+
+       wl_traffic_stats_t tx_expired[AC_COUNT]; /**< packets dropped due to lifetime expiry */
+
+} wl_wme_cnt_t;
+
+struct wl_msglevel2 {
+       uint32 low;
+       uint32 high;
+};
+
+/* A versioned structure for setting and retrieving debug message levels. */
+#define WL_MSGLEVEL_STRUCT_VERSION_1   1
+
+typedef struct wl_msglevel_v1 {
+       uint16 version;
+       uint16 length;
+       uint32 msglevel1;
+       uint32 msglevel2;
+       uint32 msglevel3;
+       /* add another uint32 when full */
+} wl_msglevel_v1_t;
+
+#define WL_ICMP_IPV6_CFG_VERSION         1
+#define WL_ICMP_IPV6_CLEAR_ALL           (1 << 0)
+
+typedef struct wl_icmp_ipv6_cfg {
+       uint16 version;
+       uint16 length;
+       uint16 fixed_length;
+       uint16 flags;
+       uint32 num_ipv6;
+       /* num_ipv6 to follow */
+       struct ipv6_addr host_ipv6[];
+} wl_icmp_ipv6_cfg_t;
+
+#define WL_ICMP_CFG_IPV6_FIXED_LEN      OFFSETOF(wl_icmp_ipv6_cfg_t, host_ipv6)
+#define WL_ICMP_CFG_IPV6_LEN(count)    (WL_ICMP_CFG_IPV6_FIXED_LEN + \
+                                       ((count) * sizeof(struct ipv6_addr)))
+
+typedef struct wl_mkeep_alive_pkt {
+       uint16  version; /* Version for mkeep_alive */
+       uint16  length; /* length of fixed parameters in the structure */
+       uint32  period_msec; /* high bit on means immediate send */
+       uint16  len_bytes;
+       uint8   keep_alive_id; /* 0 - 3 for N = 4 */
+       uint8   data[1];
+} wl_mkeep_alive_pkt_t;
+
+#define WL_MKEEP_ALIVE_VERSION         1
+#define WL_MKEEP_ALIVE_FIXED_LEN       OFFSETOF(wl_mkeep_alive_pkt_t, data)
+/* 1/2 second precision since idle time is a seconds counter anyway */
+#define WL_MKEEP_ALIVE_PRECISION       500
+#define WL_MKEEP_ALIVE_PERIOD_MASK  0x7FFFFFFF
+#define WL_MKEEP_ALIVE_IMMEDIATE    0x80000000
+
+typedef struct wl_mkeep_alive_hist_info_v1 {
+       uint32 first_pktsend_ts;        /**< timestamp(ms): packet was sent */
+       uint32 first_txs_ts;            /**< timestamp(ms): received the first txstatus */
+       uint32 last_retry_txs_ts;       /**< timestamp(ms): received the last txstatus */
+       uint32 first_retry_ts;          /**< timestamp(ms): resent the packet first time */
+       uint32 last_retry_ts;           /**< timestamp(ms): resent the packet last time */
+       uint32 first_txs;               /**< txstatus when dongle received first time */
+       uint32 last_retry_txs;          /**< txstatus when dongle received last time */
+       uint32 retry_cnt;               /**< number of retries for the packet */
+} wl_mkeep_alive_hist_info_v1_t;
+
+typedef struct wl_mkeep_alive_hist_req_v1 {
+       uint16 version;         /**< version of structure */
+       uint16 length;          /**< length of this structure */
+       uint16 flags;           /**< mkeepalive idx, operation codes */
+       uint16 count;           /**< number of results */
+       uint16 max;             /**< maximum number of history */
+       wl_mkeep_alive_hist_info_v1_t info[]; /**< struct array of length count */
+} wl_mkeep_alive_hist_req_v1_t;
+
+/* version of the mkeep_alive_hist IOVAR */
+#define WL_MKEEP_ALIVE_HIST_REQ_VER_1          1u
+/* Fixed length of wl_mkeep_alive_hist_req_v1_t */
+#define WL_MKEEP_ALIVE_HIST_REQ_FIXED_LEN_VER_1        OFFSETOF(wl_mkeep_alive_hist_req_v1_t, info)
+/* Keepalive ID */
+#define WL_MKEEP_ALIVE_HIST_ID_MASK            0xFF00u /**< ID mask */
+#define WL_MKEEP_ALIVE_HIST_ID_SHIFT           8u      /**< Offset of keepalive ID */
+/* OP Codes */
+#define WL_MKEEP_ALIVE_HIST_OP_MASK            0x00FFu /**< OP code mask */
+#define WL_MKEEP_ALIVE_HIST_RESET              (0x1u << 0u) /**< Clear history of specified ID */
+#define WL_MKEEP_ALIVE_HIST_RESET_ALL          (0x1u << 1u) /**< Clear all history */
+
+/** TCP Keep-Alive conn struct */
+typedef struct wl_mtcpkeep_alive_conn_pkt {
+       struct ether_addr saddr;                /**< src mac address */
+       struct ether_addr daddr;                /**< dst mac address */
+       struct ipv4_addr sipaddr;               /**< source IP addr */
+       struct ipv4_addr dipaddr;               /**< dest IP addr */
+       uint16 sport;                           /**< src port */
+       uint16 dport;                           /**< dest port */
+       uint32 seq;                             /**< seq number */
+       uint32 ack;                             /**< ACK number */
+       uint16 tcpwin;                          /**< TCP window */
+       uint16 PAD;
+} wl_mtcpkeep_alive_conn_pkt_t;
+
+/** TCP Keep-Alive interval struct */
+typedef struct wl_mtcpkeep_alive_timers_pkt {
+       uint16 interval;                /**< interval timer */
+       uint16 retry_interval;          /**< retry_interval timer */
+       uint16 retry_count;             /**< retry_count */
+} wl_mtcpkeep_alive_timers_pkt_t;
+
+typedef struct wake_info {
+       uint32 wake_reason;
+       uint32 wake_info_len;           /**< size of packet */
+       uint8  packet[];
+} wake_info_t;
+
+typedef struct wake_pkt {
+       uint32 wake_pkt_len;            /**< size of packet */
+       uint8  packet[];
+} wake_pkt_t;
+
+#define WL_MTCPKEEP_ALIVE_VERSION              1
+
+/* #ifdef WLBA */
+
+#define WLC_BA_CNT_VERSION  1   /**< current version of wlc_ba_cnt_t */
+
+/** block ack related stats */
+typedef struct wlc_ba_cnt {
+       uint16  version;    /**< WLC_BA_CNT_VERSION */
+       uint16  length;     /**< length of entire structure */
+
+       /* transmit stat counters */
+       uint32 txpdu;       /**< pdus sent */
+       uint32 txsdu;       /**< sdus sent */
+       uint32 txfc;        /**< tx side flow controlled packets */
+       uint32 txfci;       /**< tx side flow control initiated */
+       uint32 txretrans;   /**< retransmitted pdus */
+       uint32 txbatimer;   /**< ba resend due to timer */
+       uint32 txdrop;      /**< dropped packets */
+       uint32 txaddbareq;  /**< addba req sent */
+       uint32 txaddbaresp; /**< addba resp sent */
+       uint32 txdelba;     /**< delba sent */
+       uint32 txba;        /**< ba sent */
+       uint32 txbar;       /**< bar sent */
+       uint32 txpad[4];    /**< future */
+
+       /* receive side counters */
+       uint32 rxpdu;       /**< pdus recd */
+       uint32 rxqed;       /**< pdus buffered before sending up */
+       uint32 rxdup;       /**< duplicate pdus */
+       uint32 rxnobuf;     /**< pdus discarded due to no buf */
+       uint32 rxaddbareq;  /**< addba req recd */
+       uint32 rxaddbaresp; /**< addba resp recd */
+       uint32 rxdelba;     /**< delba recd */
+       uint32 rxba;        /**< ba recd */
+       uint32 rxbar;       /**< bar recd */
+       uint32 rxinvba;     /**< invalid ba recd */
+       uint32 rxbaholes;   /**< ba recd with holes */
+       uint32 rxunexp;     /**< unexpected packets */
+       uint32 rxpad[4];    /**< future */
+} wlc_ba_cnt_t;
+/* #endif  WLBA */
+
+/** structure for per-tid ampdu control */
+struct ampdu_tid_control {
+       uint8 tid;                      /* tid */
+       uint8 enable;                   /* enable/disable */
+};
+
+/** struct for ampdu tx/rx aggregation control */
+struct ampdu_aggr {
+       int8 aggr_override;     /**< aggr overrided by dongle. Not to be set by host. */
+       uint16 conf_TID_bmap;   /**< bitmap of TIDs to configure */
+       uint16 enab_TID_bmap;   /**< enable/disable per TID */
+};
+
+/** structure for identifying ea/tid for sending addba/delba */
+struct ampdu_ea_tid {
+       struct ether_addr ea;           /**< Station address */
+       uint8 tid;                      /**< tid */
+       uint8 initiator;        /**< 0 is recipient, 1 is originator */
+};
+
+/** structure for identifying retry/tid for retry_limit_tid/rr_retry_limit_tid */
+struct ampdu_retry_tid {
+       uint8 tid;      /**< tid */
+       uint8 retry;    /**< retry value */
+};
+
+#define BDD_FNAME_LEN       32  /**< Max length of friendly name */
+typedef struct bdd_fname {
+       uint8 len;          /**< length of friendly name */
+       uchar name[BDD_FNAME_LEN];  /**< friendly name */
+} bdd_fname_t;
+
+/* structure for addts arguments */
+/** For ioctls that take a list of TSPEC */
+struct tslist {
+       int32 count;                    /**< number of tspecs */
+       struct tsinfo_arg tsinfo[];     /**< variable length array of tsinfo */
+};
+
+/* WLTDLS */
+/**structure for tdls iovars */
+typedef struct tdls_iovar {
+       struct ether_addr ea;           /**< Station address */
+       uint8 mode;                     /**< mode: depends on iovar */
+       uint8 PAD;
+       chanspec_t chanspec;
+       uint8 PAD[6];
+} tdls_iovar_t;
+
+#define TDLS_WFD_IE_SIZE               512
+/**structure for tdls wfd ie */
+typedef struct tdls_wfd_ie_iovar {
+       struct ether_addr ea;           /**< Station address */
+       uint8 mode;
+       uint8 PAD;
+       uint16 length;
+       uint8 data[TDLS_WFD_IE_SIZE];
+} tdls_wfd_ie_iovar_t;
+/* #endif WLTDLS */
+
+/** structure for addts/delts arguments */
+typedef struct tspec_arg {
+       uint16 version;                 /**< see definition of TSPEC_ARG_VERSION */
+       uint16 length;                  /**< length of entire structure */
+       uint32 flag;                    /**< bit field */
+       /* TSPEC Arguments */
+       struct tsinfo_arg tsinfo;       /**< TS Info bit field */
+       uint8  PAD;
+       uint16 nom_msdu_size;           /**< (Nominal or fixed) MSDU Size (bytes) */
+       uint16 max_msdu_size;           /**< Maximum MSDU Size (bytes) */
+       uint32 min_srv_interval;                /**< Minimum Service Interval (us) */
+       uint32 max_srv_interval;                /**< Maximum Service Interval (us) */
+       uint32 inactivity_interval;     /**< Inactivity Interval (us) */
+       uint32 suspension_interval;     /**< Suspension Interval (us) */
+       uint32 srv_start_time;          /**< Service Start Time (us) */
+       uint32 min_data_rate;           /**< Minimum Data Rate (bps) */
+       uint32 mean_data_rate;          /**< Mean Data Rate (bps) */
+       uint32 peak_data_rate;          /**< Peak Data Rate (bps) */
+       uint32 max_burst_size;          /**< Maximum Burst Size (bytes) */
+       uint32 delay_bound;             /**< Delay Bound (us) */
+       uint32 min_phy_rate;            /**< Minimum PHY Rate (bps) */
+       uint16 surplus_bw;              /**< Surplus Bandwidth Allowance (range 1.0 to 8.0) */
+       uint16 medium_time;             /**< Medium Time (32 us/s periods) */
+       uint8 dialog_token;             /**< dialog token */
+       uint8  PAD[3];
+} tspec_arg_t;
+
+/** tspec arg for desired station */
+typedef        struct tspec_per_sta_arg {
+       struct ether_addr ea;
+       uint8  PAD[2];
+       struct tspec_arg ts;
+} tspec_per_sta_arg_t;
+
+/** structure for max bandwidth for each access category */
+typedef        struct wme_max_bandwidth {
+       uint32  ac[AC_COUNT];   /**< max bandwidth for each access category */
+} wme_max_bandwidth_t;
+
+#define WL_WME_MBW_PARAMS_IO_BYTES (sizeof(wme_max_bandwidth_t))
+
+/* current version of wl_tspec_arg_t struct */
+#define        TSPEC_ARG_VERSION               2       /**< current version of wl_tspec_arg_t struct */
+#define TSPEC_ARG_LENGTH               55      /**< argument length from tsinfo to medium_time */
+#define TSPEC_DEFAULT_DIALOG_TOKEN     42      /**< default dialog token */
+#define TSPEC_DEFAULT_SBW_FACTOR       0x3000  /**< default surplus bw */
+
+#define WL_WOWL_KEEPALIVE_MAX_PACKET_SIZE  80
+#define WLC_WOWL_MAX_KEEPALIVE 2
+
+/** Packet lifetime configuration per ac */
+typedef struct wl_lifetime {
+       uint32 ac;              /**< access class */
+       uint32 lifetime;    /**< Packet lifetime value in ms */
+} wl_lifetime_t;
+
+/** Management time configuration */
+typedef struct wl_lifetime_mg {
+       uint32 mgmt_bitmap;     /**< Mgmt subtype */
+       uint32 lifetime;    /**< Packet lifetime value in us */
+} wl_lifetime_mg_t;
+
+/* MAC Sample Capture related */
+#define        WL_MACCAPTR_DEFSTART_PTR        0xA00
+#define        WL_MACCAPTR_DEFSTOP_PTR         0xA3F
+#define        WL_MACCAPTR_DEFSZ               0x3F
+
+#define WL_MACCAPTR_DEF_MASK           0xFFFFFFFF
+
+typedef enum {
+       WL_MACCAPT_TRIG         = 0,
+       WL_MACCAPT_STORE        = 1,
+       WL_MACCAPT_TRANS        = 2,
+       WL_MACCAPT_MATCH        = 3
+} maccaptr_optn;
+
+typedef enum {
+       WL_MACCAPT_STRT = 1,
+       WL_MACCAPT_STOP = 2,
+       WL_MACCAPT_RST  = 3
+} maccaptr_cmd_t;
+
+/* MAC Sample Capture Set-up Paramters */
+typedef struct wl_maccapture_params {
+       uint8   gpio_sel;
+       uint8   la_mode;        /* TRUE: GPIO Out Enabled */
+       uint8   PAD[2];
+       uint32  start_ptr;      /* Start address to store */
+       uint32  stop_ptr;       /* Stop address to store */
+       uint8   optn_bmp;       /* Options */
+       uint8   PAD[3];
+       /* Don't change the order after this nor
+        * add anything in betw. Code uses offsets to populate
+        * registers
+        */
+       uint32  tr_mask;        /* Trigger Mask */
+       uint32  tr_val;         /* Trigger Value */
+       uint32  s_mask;         /* Store Mode Mask */
+       uint32  x_mask;         /* Trans. Mode Mask */
+       uint32  m_mask;         /* Match Mode Mask */
+       uint32  m_val;          /* Match Value */
+       maccaptr_cmd_t cmd;     /* Start / Stop */
+} wl_maccapture_params_t;
+
+/** Channel Switch Announcement param */
+typedef struct wl_chan_switch {
+       uint8 mode;             /**< value 0 or 1 */
+       uint8 count;            /**< count # of beacons before switching */
+       chanspec_t chspec;      /**< chanspec */
+       uint8 reg;              /**< regulatory class */
+       uint8 frame_type;               /**< csa frame type, unicast or broadcast */
+} wl_chan_switch_t;
+
+enum {
+       PFN_LIST_ORDER,
+       PFN_RSSI
+};
+
+enum {
+       DISABLE,
+       ENABLE
+};
+
+enum {
+       OFF_ADAPT,
+       SMART_ADAPT,
+       STRICT_ADAPT,
+       SLOW_ADAPT
+};
+
+#define SORT_CRITERIA_BIT              0
+#define AUTO_NET_SWITCH_BIT            1
+#define ENABLE_BKGRD_SCAN_BIT          2
+#define IMMEDIATE_SCAN_BIT             3
+#define        AUTO_CONNECT_BIT                4
+#define        ENABLE_BD_SCAN_BIT              5
+#define ENABLE_ADAPTSCAN_BIT           6
+#define IMMEDIATE_EVENT_BIT            8
+#define SUPPRESS_SSID_BIT              9
+#define ENABLE_NET_OFFLOAD_BIT         10
+/** report found/lost events for SSID and BSSID networks seperately */
+#define REPORT_SEPERATELY_BIT          11
+
+#define SORT_CRITERIA_MASK     0x0001
+#define AUTO_NET_SWITCH_MASK   0x0002
+#define ENABLE_BKGRD_SCAN_MASK 0x0004
+#define IMMEDIATE_SCAN_MASK    0x0008
+#define AUTO_CONNECT_MASK      0x0010
+
+#define ENABLE_BD_SCAN_MASK    0x0020
+#define ENABLE_ADAPTSCAN_MASK  0x00c0
+#define IMMEDIATE_EVENT_MASK   0x0100
+#define SUPPRESS_SSID_MASK     0x0200
+#define ENABLE_NET_OFFLOAD_MASK        0x0400
+/** report found/lost events for SSID and BSSID networks seperately */
+#define REPORT_SEPERATELY_MASK 0x0800
+
+#define PFN_COMPLETE                   1
+#define PFN_INCOMPLETE                 0
+
+#define DEFAULT_BESTN                  2
+#define DEFAULT_MSCAN                  0
+#define DEFAULT_REPEAT                 10
+#define DEFAULT_EXP                    2
+
+#define PFN_PARTIAL_SCAN_BIT           0
+#define PFN_PARTIAL_SCAN_MASK          1
+
+#define PFN_SWC_RSSI_WINDOW_MAX   8
+#define PFN_SWC_MAX_NUM_APS       16
+#define PFN_HOTLIST_MAX_NUM_APS   64
+
+#define MAX_EPNO_HIDDEN_SSID    8
+#define MAX_WHITELIST_SSID      2
+
+/* Version 1 and 2 for various scan results structures defined below */
+#define PFN_SCANRESULTS_VERSION_V1     1
+#define PFN_SCANRESULTS_VERSION_V2     2
+
+/** PFN network info structure */
+typedef struct wl_pfn_subnet_info_v1 {
+       struct ether_addr BSSID;
+       uint8   channel; /**< channel number only */
+       uint8   SSID_len;
+       uint8   SSID[32];
+} wl_pfn_subnet_info_v1_t;
+
+typedef struct wl_pfn_subnet_info_v2 {
+       struct ether_addr BSSID;
+       uint8   channel; /**< channel number only */
+       uint8   SSID_len;
+       union {
+               uint8   SSID[32];
+               uint16 index;
+       } u;
+} wl_pfn_subnet_info_v2_t;
+
+typedef struct wl_pfn_net_info_v1 {
+       wl_pfn_subnet_info_v1_t pfnsubnet;
+       int16   RSSI; /**< receive signal strength (in dBm) */
+       uint16  timestamp; /**< age in seconds */
+} wl_pfn_net_info_v1_t;
+
+typedef struct wl_pfn_net_info_v2 {
+       wl_pfn_subnet_info_v2_t pfnsubnet;
+       int16   RSSI; /**< receive signal strength (in dBm) */
+       uint16  timestamp; /**< age in seconds */
+} wl_pfn_net_info_v2_t;
+
+/* Version 1 and 2 for various lbest scan results structures below */
+#define PFN_LBEST_SCAN_RESULT_VERSION_V1 1
+#define PFN_LBEST_SCAN_RESULT_VERSION_V2 2
+
+#define MAX_CHBKT_PER_RESULT           4
+
+typedef struct wl_pfn_lnet_info_v1 {
+       wl_pfn_subnet_info_v1_t pfnsubnet; /**< BSSID + channel + SSID len + SSID */
+       uint16  flags; /**< partial scan, etc */
+       int16   RSSI; /**< receive signal strength (in dBm) */
+       uint32  timestamp; /**< age in miliseconds */
+       uint16  rtt0; /**< estimated distance to this AP in centimeters */
+       uint16  rtt1; /**< standard deviation of the distance to this AP in centimeters */
+} wl_pfn_lnet_info_v1_t;
+
+typedef struct wl_pfn_lnet_info_v2 {
+       wl_pfn_subnet_info_v2_t pfnsubnet; /**< BSSID + channel + SSID len + SSID */
+       uint16  flags; /**< partial scan, etc */
+       int16   RSSI; /**< receive signal strength (in dBm) */
+       uint32  timestamp; /**< age in miliseconds */
+       uint16  rtt0; /**< estimated distance to this AP in centimeters */
+       uint16  rtt1; /**< standard deviation of the distance to this AP in centimeters */
+} wl_pfn_lnet_info_v2_t;
+
+typedef struct wl_pfn_lscanresults_v1 {
+       uint32 version;
+       uint32 status;
+       uint32 count;
+       wl_pfn_lnet_info_v1_t netinfo[1];
+} wl_pfn_lscanresults_v1_t;
+
+typedef struct wl_pfn_lscanresults_v2 {
+       uint32 version;
+       uint16 status;
+       uint16 count;
+       uint32 scan_ch_buckets[MAX_CHBKT_PER_RESULT];
+       wl_pfn_lnet_info_v2_t netinfo[1];
+} wl_pfn_lscanresults_v2_t;
+
+/**this is used to report on 1-* pfn scan results */
+typedef struct wl_pfn_scanresults_v1 {
+       uint32 version;
+       uint32 status;
+       uint32 count;
+       wl_pfn_net_info_v1_t netinfo[1];
+} wl_pfn_scanresults_v1_t;
+
+typedef struct wl_pfn_scanresults_v2 {
+       uint32 version;
+       uint32 status;
+       uint32 count;
+       uint32 scan_ch_bucket;
+       wl_pfn_net_info_v2_t netinfo[1];
+} wl_pfn_scanresults_v2_t;
+
+typedef struct wl_pfn_significant_net {
+       uint16 flags;
+       uint16 channel;
+       struct ether_addr BSSID;
+       int8 rssi[PFN_SWC_RSSI_WINDOW_MAX];
+} wl_pfn_significant_net_t;
+
+#define PFN_SWC_SCANRESULT_VERSION     1
+
+typedef struct wl_pfn_swc_results {
+       uint32 version;
+       uint32 pkt_count;   /**< No. of results in current frame */
+       uint32 total_count; /**< Total expected results */
+       wl_pfn_significant_net_t list[];
+} wl_pfn_swc_results_t;
+typedef struct wl_pfn_net_info_bssid {
+       struct ether_addr BSSID;
+       uint8 channel;  /**< channel number only */
+       int8  RSSI;     /**< receive signal strength (in dBm) */
+       uint16 flags;   /**< (e.g. partial scan, off channel) */
+       uint16 timestamp; /**< age in seconds */
+} wl_pfn_net_info_bssid_t;
+
+typedef struct wl_pfn_scanhist_bssid {
+       uint32 version;
+       uint32 status;
+       uint32 count;
+       wl_pfn_net_info_bssid_t netinfo[1];
+} wl_pfn_scanhist_bssid_t;
+
+/* Version 1 and 2 for various single scan result */
+#define PFN_SCANRESULT_VERSION_V1      1
+#define PFN_SCANRESULT_VERSION_V2      2
+
+/* used to report exactly one scan result */
+/* plus reports detailed scan info in bss_info */
+typedef struct wl_pfn_scanresult_v1 {
+       uint32 version;
+       uint32 status;
+       uint32 count;
+       wl_pfn_net_info_v1_t netinfo;
+       wl_bss_info_v109_t bss_info;
+} wl_pfn_scanresult_v1_t;
+
+typedef struct wl_pfn_scanresult_v2 {
+       uint32 version;
+       uint32 status;
+       uint32 count;
+       wl_pfn_net_info_v2_t netinfo;
+       wl_bss_info_v109_t bss_info;
+} wl_pfn_scanresult_v2_t;
+
+typedef struct wl_pfn_scanresult_v2_1 {
+       uint32 version;
+       uint32 status;
+       uint32 count;
+       wl_pfn_net_info_v2_t netinfo;
+       uint8 bss_info[];       /* var length wl_bss_info_X structures */
+} wl_pfn_scanresult_v2_1_t;
+
+#define WL_PFN_MAX_RAND_LIMIT          20u
+#define PFN_VERSION_V2                 2u
+/**PFN data structure */
+typedef struct wl_pfn_param_v2 {
+       int32 version;                  /**< PNO parameters version */
+       int32 scan_freq;                /**< Scan frequency */
+       int32 lost_network_timeout;     /**< Timeout in sec. to declare
+                                       * discovered network as lost
+                                       */
+       int16 flags;                    /**< Bit field to control features
+                                       * of PFN such as sort criteria auto
+                                       * enable switch and background scan
+                                       */
+       int16 rssi_margin;              /**< Margin to avoid jitter for choosing a
+                                       * PFN based on RSSI sort criteria
+                                       */
+       uint8 bestn;                    /**< number of best networks in each scan */
+       uint8 mscan;                    /**< number of scans recorded */
+       uint8 repeat;                   /**< Minimum number of scan intervals
+                                       *before scan frequency changes in adaptive scan
+                                       */
+       uint8 exp;                      /**< Exponent of 2 for maximum scan interval */
+       int32 slow_freq;                /**< slow scan period */
+} wl_pfn_param_v2_t;
+
+#define PFN_VERSION_V3                 3u
+typedef struct wl_pfn_param_v3 {
+       int16 version;                  /**< PNO parameters version */
+       int16 length;                   /* length of the structure */
+       int32 scan_freq;                /**< Scan frequency */
+       int32 lost_network_timeout;     /**< Timeout in sec. to declare
+                                       * discovered network as lost
+                                       */
+       int16 flags;                    /**< Bit field to control features
+                                       * of PFN such as sort criteria auto
+                                       * enable switch and background scan
+                                       */
+       int16 rssi_margin;              /**< Margin to avoid jitter for choosing a
+                                       * PFN based on RSSI sort criteria
+                                       */
+       uint8 bestn;                    /**< number of best networks in each scan */
+       uint8 mscan;                    /**< number of scans recorded */
+       uint8 repeat;                   /**< Minimum number of scan intervals
+                                       *before scan frequency changes in adaptive scan
+                                       */
+       uint8 exp;                      /**< Exponent of 2 for maximum scan interval */
+       int32 slow_freq;                /**< slow scan period */
+       uint8 min_bound;                /**< pfn scan period randomization - lower bound % */
+       uint8 max_bound;                /**< pfn scan period randomization - upper bound % */
+       uint8 pfn_lp_scan_disable;      /* add support to enable/disable scan-core scan for PNO */
+       uint8 PAD[1];                   /**< Pad to 32-bit alignment */
+} wl_pfn_param_v3_t;
+
+#ifndef PFN_PARAM_HAS_ALIAS
+typedef wl_pfn_param_v2_t wl_pfn_param_t;
+#define PFN_VERSION PFN_VERSION_V2
+#endif
+
+typedef struct wl_pfn_bssid {
+       struct ether_addr  macaddr;
+       /* Bit4: suppress_lost, Bit3: suppress_found */
+       uint16             flags;
+} wl_pfn_bssid_t;
+typedef struct wl_pfn_significant_bssid {
+       struct ether_addr       macaddr;
+       int8    rssi_low_threshold;
+       int8    rssi_high_threshold;
+} wl_pfn_significant_bssid_t;
+#define WL_PFN_SUPPRESSFOUND_MASK      0x08
+#define WL_PFN_SUPPRESSLOST_MASK       0x10
+#define WL_PFN_SSID_IMPRECISE_MATCH    0x80
+#define WL_PFN_SSID_SAME_NETWORK       0x10000
+#define WL_PFN_SUPPRESS_AGING_MASK     0x20000
+#define WL_PFN_FLUSH_ALL_SSIDS         0x40000
+
+#define WL_PFN_IOVAR_FLAG_MASK         0xFFFF00FF
+#define WL_PFN_RSSI_MASK               0xff00
+#define WL_PFN_RSSI_SHIFT              8
+
+typedef struct wl_pfn_cfg {
+       uint32  reporttype;
+       int32   channel_num;
+       uint16  channel_list[WL_NUMCHANNELS];
+       uint32  flags;
+} wl_pfn_cfg_t;
+
+#define WL_PFN_SSID_CFG_VERSION                1
+#define WL_PFN_SSID_CFG_CLEAR          0x1
+
+typedef struct wl_pfn_ssid_params {
+       int8 min5G_rssi;           /* minimum 5GHz RSSI for a BSSID to be considered      */
+       int8 min2G_rssi;           /* minimum 2.4GHz RSSI for a BSSID to be considered   */
+       int16 init_score_max;     /* The maximum score that a network can have before bonuses  */
+
+       int16 cur_bssid_bonus;    /* Add to current bssid                                      */
+       int16 same_ssid_bonus;    /* score bonus for all networks with the same network flag   */
+       int16 secure_bonus;       /* score bonus for networks that are not open          */
+       int16 band_5g_bonus;
+} wl_pfn_ssid_params_t;
+
+typedef struct wl_ssid_ext_params {
+       int8 min5G_rssi;        /* minimum 5GHz RSSI for a BSSID to be considered      */
+       int8 min2G_rssi;        /* minimum 2.4GHz RSSI for a BSSID to be considered   */
+       int16 init_score_max;   /* The maximum score that a network can have before bonuses  */
+       int16 cur_bssid_bonus;  /* Add to current bssid                                      */
+       int16 same_ssid_bonus;  /* score bonus for all networks with the same network flag   */
+       int16 secure_bonus;     /* score bonus for networks that are not open                */
+       int16 band_5g_bonus;
+} wl_ssid_ext_params_t;
+
+typedef struct wl_pfn_ssid_cfg {
+       uint16 version;
+       uint16 flags;
+       wl_ssid_ext_params_t params;
+} wl_pfn_ssid_cfg_t;
+
+#define CH_BUCKET_REPORT_NONE                   0
+#define CH_BUCKET_REPORT_SCAN_COMPLETE_ONLY     1
+#define CH_BUCKET_REPORT_FULL_RESULT            2
+#define CH_BUCKET_REPORT_SCAN_COMPLETE    (CH_BUCKET_REPORT_SCAN_COMPLETE_ONLY | \
+                                                               CH_BUCKET_REPORT_FULL_RESULT)
+#define CH_BUCKET_REPORT_REGULAR            0
+#define CH_BUCKET_GSCAN                     4
+
+typedef struct wl_pfn_gscan_ch_bucket_cfg {
+       uint8 bucket_end_index;
+       uint8 bucket_freq_multiple;
+       uint8 flag;
+       uint8 reserved;
+       uint16 repeat;
+       uint16 max_freq_multiple;
+} wl_pfn_gscan_ch_bucket_cfg_t;
+
+typedef struct wl_pfn_capabilities {
+       uint16 max_mscan;
+       uint16 max_bestn;
+       uint16 max_swc_bssid;
+       uint16 max_hotlist_bssid;
+} wl_pfn_capabilities_t;
+
+#define GSCAN_SEND_ALL_RESULTS_MASK          (1 << 0)
+#define GSCAN_ALL_BUCKETS_IN_FIRST_SCAN_MASK (1 << 3)
+#define GSCAN_CFG_FLAGS_ONLY_MASK            (1 << 7)
+#define WL_GSCAN_CFG_VERSION                     1
+typedef struct wl_pfn_gscan_cfg {
+       uint16 version;
+       /**
+        * BIT0 1 = send probes/beacons to HOST
+        * BIT1 Reserved
+        * BIT2 Reserved
+        * Add any future flags here
+        * BIT7 1 = no other useful cfg sent
+        */
+       uint8  flags;
+       /** Buffer filled threshold in % to generate an event */
+       uint8   buffer_threshold;
+       /**
+        * No. of BSSIDs with "change" to generate an evt
+        * change - crosses rssi threshold/lost
+        */
+       uint8   swc_nbssid_threshold;
+       /* Max=8 (for now) Size of rssi cache buffer */
+       uint8  swc_rssi_window_size;
+       uint8  count_of_channel_buckets;
+       uint8  retry_threshold;
+       uint16  lost_ap_window;
+       wl_pfn_gscan_ch_bucket_cfg_t channel_bucket[1];
+} wl_pfn_gscan_cfg_t;
+
+#define WL_PFN_REPORT_ALLNET    0
+#define WL_PFN_REPORT_SSIDNET   1
+#define WL_PFN_REPORT_BSSIDNET  2
+
+#define WL_PFN_CFG_FLAGS_PROHIBITED    0x00000001      /* Accept and use prohibited channels */
+#define WL_PFN_CFG_FLAGS_RESERVED      0xfffffffe      /**< Remaining reserved for future use */
+
+typedef struct wl_pfn {
+       wlc_ssid_t              ssid;                   /**< ssid name and its length */
+       int32                   flags;                  /**< bit2: hidden */
+       int32                   infra;                  /**< BSS Vs IBSS */
+       int32                   auth;                   /**< Open Vs Closed */
+       int32                   wpa_auth;               /**< WPA type */
+       int32                   wsec;                   /**< wsec value */
+} wl_pfn_t;
+
+typedef struct wl_pfn_list {
+       uint32          version;
+       uint32          enabled;
+       uint32          count;
+       wl_pfn_t        pfn[1];
+} wl_pfn_list_t;
+
+#define PFN_SSID_EXT_VERSION   1
+
+typedef struct wl_pfn_ext {
+       uint8 flags;
+       int8 rssi_thresh; /* RSSI threshold, track only if RSSI > threshold */
+       uint16 wpa_auth; /* Match the wpa auth type defined in wlioctl_defs.h */
+       uint8 ssid[DOT11_MAX_SSID_LEN];
+       uint8 ssid_len;
+       uint8 pad;
+} wl_pfn_ext_t;
+typedef struct wl_pfn_ext_list {
+       uint16 version;
+       uint16 count;
+       wl_pfn_ext_t pfn_ext[1];
+} wl_pfn_ext_list_t;
+
+#define WL_PFN_SSID_EXT_FOUND   0x1
+#define WL_PFN_SSID_EXT_LOST    0x2
+typedef struct wl_pfn_result_ssid {
+       uint8 flags;
+       int8 rssi;
+       /* channel number */
+       uint16 channel;
+       /* Assume idx in order of cfg */
+       uint32 index;
+} wl_pfn_result_ssid_crc32_t;
+
+typedef struct wl_pfn_ssid_ext_result {
+       uint16 version;
+       uint16 count;
+       wl_pfn_result_ssid_crc32_t net[1];
+} wl_pfn_ssid_ext_result_t;
+
+#define PFN_EXT_AUTH_CODE_OPEN   1 /* open */
+#define PFN_EXT_AUTH_CODE_PSK   2 /* WPA_PSK or WPA2PSK */
+#define PFN_EXT_AUTH_CODE_EAPOL 4 /* any EAPOL  */
+
+#define WL_PFN_HIDDEN_BIT              2
+#define WL_PFN_HIDDEN_MASK             0x4
+
+#ifndef BESTN_MAX
+#define BESTN_MAX                      10
+#endif
+
+#ifndef MSCAN_MAX
+#define MSCAN_MAX                      90
+#endif
+
+/* Dynamic scan configuration for motion profiles */
+
+#define WL_PFN_MPF_VERSION 1
+
+/* Valid group IDs, may be expanded in the future */
+#define WL_PFN_MPF_GROUP_SSID 0
+#define WL_PFN_MPF_GROUP_BSSID 1
+#define WL_PFN_MPF_MAX_GROUPS 2
+
+/* Max number of MPF states supported in this time */
+#define WL_PFN_MPF_STATES_MAX  4u
+#define WL_PFN_MPF_LP_CNT_MAX  7u
+
+/* Flags for the mpf-specific stuff */
+#define WL_PFN_MPF_ADAPT_ON_BIT                0u
+#define WL_PFN_MPF_ADAPTSCAN_BIT       1u
+#define WL_PFN_MPF_LP_SCAN_BIT         3u
+
+#define WL_PFN_MPF_ADAPT_ON_MASK       0x0001  /* Bit  0     */
+#define WL_PFN_MPF_ADAPTSCAN_MASK      0x0006  /* Bits [2:1] */
+#define WL_PFN_MPF_LP_SCAN_CNT_MASK    0x0038  /* Bits [5:3] */
+
+/* Per-state timing values */
+typedef struct wl_pfn_mpf_state_params {
+       int32  scan_freq;               /* Scan frequency (secs) */
+       int32  lost_network_timeout;    /* Timeout to declare net lost (secs) */
+       int16  flags;                   /* Space for flags: ADAPT, LP_SCAN cnt etc */
+       uint8  exp;                     /* Exponent of 2 for max interval for SMART/STRICT_ADAPT */
+       uint8  repeat;                  /* Number of scans before changing adaptation level */
+       int32  slow_freq;               /* Slow scan period for SLOW_ADAPT */
+} wl_pfn_mpf_state_params_t;
+
+typedef struct wl_pfn_mpf_param {
+       uint16 version;         /* Structure version */
+       uint16 groupid;         /* Group ID: 0 (SSID), 1 (BSSID), other: reserved */
+       wl_pfn_mpf_state_params_t state[WL_PFN_MPF_STATES_MAX];
+} wl_pfn_mpf_param_t;
+
+/* Structure for setting pfn_override iovar */
+typedef struct wl_pfn_override_param {
+       uint16 version;         /* Structure version */
+       uint16 start_offset;    /* Seconds from now to apply new params */
+       uint16 duration;        /* Seconds to keep new params applied */
+       uint16 reserved;
+       wl_pfn_mpf_state_params_t override;
+} wl_pfn_override_param_t;
+#define WL_PFN_OVERRIDE_VERSION        1
+
+/*
+ * Definitions for base MPF configuration
+ */
+
+#define WL_MPF_VERSION 1
+#define WL_MPF_MAX_BITS 3
+#define WL_MPF_MAX_STATES (1 << WL_MPF_MAX_BITS)
+
+#define WL_MPF_STATE_NAME_MAX 12
+
+typedef struct wl_mpf_val {
+       uint16 val;             /* Value of GPIO bits */
+       uint16 state;           /* State identifier */
+       char name[WL_MPF_STATE_NAME_MAX]; /* Optional name */
+} wl_mpf_val_t;
+
+typedef struct wl_mpf_map {
+       uint16 version;
+       uint16 type;
+       uint16 mask;            /* Which GPIO bits to use */
+       uint8  count;           /* Count of state/value mappings */
+       uint8  PAD;
+       wl_mpf_val_t vals[WL_MPF_MAX_STATES];
+} wl_mpf_map_t;
+
+#define WL_MPF_STATE_AUTO (0xFFFF) /* (uint16)-1) */
+
+typedef struct wl_mpf_state {
+       uint16 version;
+       uint16 type;
+       uint16 state;           /* Get/Set */
+       uint8 force;            /* 0 - auto (HW) state, 1 - forced state */
+       char name[WL_MPF_STATE_NAME_MAX]; /* Get/Set: Optional/actual name */
+       uint8  PAD;
+} wl_mpf_state_t;
+/*
+ * WLFCTS definition
+ */
+typedef struct wl_txstatus_additional_info {
+       uint32 rspec;
+       uint32 enq_ts;
+       uint32 last_ts;
+       uint32 entry_ts;
+       uint16 seq;
+       uint8  rts_cnt;
+       uint8  tx_cnt;
+} wl_txstatus_additional_info_t;
+
+/** Service discovery */
+typedef struct {
+       uint8   transaction_id; /**< Transaction id */
+       uint8   protocol;       /**< Service protocol type */
+       uint16  query_len;      /**< Length of query */
+       uint16  response_len;   /**< Length of response */
+       uint8   qrbuf[];
+} wl_p2po_qr_t;
+
+typedef struct {
+       uint16                  period;                 /**< extended listen period */
+       uint16                  interval;               /**< extended listen interval */
+       uint16                  count;                  /* count to repeat */
+       uint16                  pad;                    /* pad for 32bit align */
+} wl_p2po_listen_t;
+
+/** GAS state machine tunable parameters.  Structure field values of 0 means use the default. */
+typedef struct wl_gas_config {
+       uint16 max_retransmit;          /**< Max # of firmware/driver retransmits on no Ack
+                                        * from peer (on top of the ucode retries).
+                                        */
+       uint16 response_timeout;        /**< Max time to wait for a GAS-level response
+                                        * after sending a packet.
+                                        */
+       uint16 max_comeback_delay;      /**< Max GAS response comeback delay.
+                                        * Exceeding this fails the GAS exchange.
+                                        */
+       uint16 max_retries;             /**< Max # of GAS state machine retries on failure
+                                        * of a GAS frame exchange.
+                                        */
+} wl_gas_config_t;
+
+/** P2P Find Offload parameters */
+typedef struct wl_p2po_find_config {
+       uint16 version;                 /**< Version of this struct */
+       uint16 length;                  /**< sizeof(wl_p2po_find_config_t) */
+       int32 search_home_time;         /**< P2P search state home time when concurrent
+                                        * connection exists.  -1 for default.
+                                        */
+       uint8 num_social_channels;
+                       /**< Number of social channels up to WL_P2P_SOCIAL_CHANNELS_MAX.
+                        * 0 means use default social channels.
+                        */
+       uint8 flags;
+       uint16 social_channels[1];      /**< Variable length array of social channels */
+} wl_p2po_find_config_t;
+#define WL_P2PO_FIND_CONFIG_VERSION 2  /**< value for version field */
+
+/** wl_p2po_find_config_t flags */
+#define P2PO_FIND_FLAG_SCAN_ALL_APS 0x01       /**< Whether to scan for all APs in the p2po_find
+                                                * periodic scans of all channels.
+                                                * 0 means scan for only P2P devices.
+                                                * 1 means scan for P2P devices plus non-P2P APs.
+                                                */
+
+/** For adding a WFDS service to seek */
+typedef struct {
+       uint32 seek_hdl;                /**< unique id chosen by host */
+       uint8 addr[6];                  /**< Seek service from a specific device with this
+                                        * MAC address, all 1's for any device.
+                                        */
+       uint8 service_hash[P2P_WFDS_HASH_LEN];
+       uint8 service_name_len;
+       uint8 service_name[MAX_WFDS_SEEK_SVC_NAME_LEN];
+                                       /**< Service name to seek, not null terminated */
+       uint8 service_info_req_len;
+       uint8 service_info_req[1];      /**< Service info request, not null terminated.
+                                        * Variable length specified by service_info_req_len.
+                                        * Maximum length is MAX_WFDS_SEEK_SVC_INFO_LEN.
+                                        */
+} wl_p2po_wfds_seek_add_t;
+
+/** For deleting a WFDS service to seek */
+typedef struct {
+       uint32 seek_hdl;                /**< delete service specified by id */
+} wl_p2po_wfds_seek_del_t;
+
+/** For adding a WFDS service to advertise */
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 advertise_hdl;           /**< unique id chosen by host */
+       uint8 service_hash[P2P_WFDS_HASH_LEN];
+       uint32 advertisement_id;
+       uint16 service_config_method;
+       uint8 service_name_len;
+       uint8 service_name[MAX_WFDS_SVC_NAME_LEN];
+                                       /**< Service name , not null terminated */
+       uint8 service_status;
+       uint16 service_info_len;
+       uint8 service_info[1];          /**< Service info, not null terminated.
+                                        * Variable length specified by service_info_len.
+                                        * Maximum length is MAX_WFDS_ADV_SVC_INFO_LEN.
+                                        */
+} BWL_POST_PACKED_STRUCT wl_p2po_wfds_advertise_add_t;
+#include <packed_section_end.h>
+
+/** For deleting a WFDS service to advertise */
+typedef struct {
+       uint32 advertise_hdl;   /**< delete service specified by hdl */
+} wl_p2po_wfds_advertise_del_t;
+
+/** P2P Offload discovery mode for the p2po_state iovar */
+typedef enum {
+       WL_P2PO_DISC_STOP,
+       WL_P2PO_DISC_LISTEN,
+       WL_P2PO_DISC_DISCOVERY
+} disc_mode_t;
+
+/* ANQP offload */
+
+#define ANQPO_MAX_QUERY_SIZE           256
+typedef struct {
+       uint16 max_retransmit;          /**< ~0 use default, max retransmit on no ACK from peer */
+       uint16 response_timeout; /**< ~0 use default, msec to wait for resp after tx packet */
+       uint16 max_comeback_delay;      /**< ~0 use default, max comeback delay in resp else fail */
+       uint16 max_retries;             /**< ~0 use default, max retries on failure */
+       uint16 query_len;               /**< length of ANQP query */
+       uint8 query_data[1];            /**< ANQP encoded query (max ANQPO_MAX_QUERY_SIZE) */
+} wl_anqpo_set_t;
+
+#define WL_ANQPO_FLAGS_BSSID_WILDCARD          0x0001
+#define WL_ANQPO_PEER_LIST_VERSION_2           2
+typedef struct {
+       uint16 channel;                 /**< channel of the peer */
+       struct ether_addr addr;         /**< addr of the peer */
+} wl_anqpo_peer_v1_t;
+typedef struct {
+       uint16 channel;                 /**< channel of the peer */
+       struct ether_addr addr;         /**< addr of the peer */
+       uint32 flags;                   /**< 0x01-Peer is MBO Capable */
+} wl_anqpo_peer_v2_t;
+
+#define ANQPO_MAX_PEER_LIST                    64
+typedef struct {
+       uint16 count;                           /**< number of peers in list */
+       wl_anqpo_peer_v1_t peer[1];     /**< max ANQPO_MAX_PEER_LIST */
+} wl_anqpo_peer_list_v1_t;
+
+typedef struct {
+       uint16  version;    /**<VERSION */
+       uint16  length;     /**< length of entire structure */
+       uint16 count;                           /**< number of peers in list */
+       wl_anqpo_peer_v2_t peer[1];     /**< max ANQPO_MAX_PEER_LIST */
+} wl_anqpo_peer_list_v2_t;
+
+#ifndef WL_ANQPO_PEER_LIST_TYPEDEF_HAS_ALIAS
+typedef wl_anqpo_peer_list_v1_t wl_anqpo_peer_list_t;
+typedef wl_anqpo_peer_v1_t wl_anqpo_peer_t;
+#endif /* WL_ANQPO_PEER_LIST_TYPEDEF_HAS_ALIAS */
+
+#define ANQPO_MAX_IGNORE_SSID          64
+typedef struct {
+       uint8 is_clear;                         /**< set to clear list (not used on GET) */
+       uint8 PAD;
+       uint16 count;                           /**< number of SSID in list */
+       wlc_ssid_t ssid[1];                     /**< max ANQPO_MAX_IGNORE_SSID */
+} wl_anqpo_ignore_ssid_list_t;
+
+#define ANQPO_MAX_IGNORE_BSSID         64
+typedef struct {
+       uint8 is_clear;                         /**< set to clear list (not used on GET) */
+       uint8 PAD;
+       uint16 count;                           /**< number of addr in list */
+       struct ether_addr bssid[];      /**< max ANQPO_MAX_IGNORE_BSSID */
+} wl_anqpo_ignore_bssid_list_t;
+
+struct toe_ol_stats_t {
+       /** Num of tx packets that don't need to be checksummed */
+       uint32 tx_summed;
+
+       /* Num of tx packets where checksum is filled by offload engine */
+       uint32 tx_iph_fill;
+       uint32 tx_tcp_fill;
+       uint32 tx_udp_fill;
+       uint32 tx_icmp_fill;
+
+       /*  Num of rx packets where toe finds out if checksum is good or bad */
+       uint32 rx_iph_good;
+       uint32 rx_iph_bad;
+       uint32 rx_tcp_good;
+       uint32 rx_tcp_bad;
+       uint32 rx_udp_good;
+       uint32 rx_udp_bad;
+       uint32 rx_icmp_good;
+       uint32 rx_icmp_bad;
+
+       /* Num of tx packets in which csum error is injected */
+       uint32 tx_tcp_errinj;
+       uint32 tx_udp_errinj;
+       uint32 tx_icmp_errinj;
+
+       /* Num of rx packets in which csum error is injected */
+       uint32 rx_tcp_errinj;
+       uint32 rx_udp_errinj;
+       uint32 rx_icmp_errinj;
+};
+
+/** Arp offload statistic counts */
+struct arp_ol_stats_t {
+       uint32  host_ip_entries; /**< Host IP table addresses (more than one if multihomed) */
+       uint32  host_ip_overflow;       /**< Host IP table additions skipped due to overflow */
+
+       uint32  arp_table_entries;      /**< ARP table entries */
+       uint32  arp_table_overflow;     /**< ARP table additions skipped due to overflow */
+
+       uint32  host_request;           /**< ARP requests from host */
+       uint32  host_reply;             /**< ARP replies from host */
+       uint32  host_service;           /**< ARP requests from host serviced by ARP Agent */
+
+       uint32  peer_request;           /**< ARP requests received from network */
+       uint32  peer_request_drop;      /**< ARP requests from network that were dropped */
+       uint32  peer_reply;             /**< ARP replies received from network */
+       uint32  peer_reply_drop;        /**< ARP replies from network that were dropped */
+       uint32  peer_service;           /**< ARP request from host serviced by ARP Agent */
+};
+
+/** NS offload statistic counts */
+struct nd_ol_stats_t {
+       uint32  host_ip_entries;    /**< Host IP table addresses (more than one if multihomed) */
+       uint32  host_ip_overflow;   /**< Host IP table additions skipped due to overflow */
+       uint32  peer_request;       /**< NS requests received from network */
+       uint32  peer_request_drop;  /**< NS requests from network that were dropped */
+       uint32  peer_reply_drop;    /**< NA replies from network that were dropped */
+       uint32  peer_service;       /**< NS request from host serviced by firmware */
+};
+
+/*
+ * Neighbor Discovery Offloading
+ */
+enum {
+       WL_ND_IPV6_ADDR_TYPE_UNICAST = 0,
+       WL_ND_IPV6_ADDR_TYPE_ANYCAST
+};
+
+typedef struct wl_nd_host_ip_addr {
+       struct ipv6_addr ip_addr;       /* host ip address */
+       uint8 type;                     /* type of address */
+       uint8 pad[3];
+} wl_nd_host_ip_addr_t;
+
+typedef struct wl_nd_host_ip_list {
+       uint32 count;
+       wl_nd_host_ip_addr_t host_ip[1];
+} wl_nd_host_ip_list_t;
+
+#define WL_ND_HOSTIP_IOV_VER    1
+
+enum {
+       WL_ND_HOSTIP_OP_VER = 0,        /* get version */
+       WL_ND_HOSTIP_OP_ADD,            /* add address */
+       WL_ND_HOSTIP_OP_DEL,            /* delete specified address */
+       WL_ND_HOSTIP_OP_DEL_UC,         /* delete all unicast address */
+       WL_ND_HOSTIP_OP_DEL_AC,         /* delete all anycast address */
+       WL_ND_HOSTIP_OP_DEL_ALL,        /* delete all addresses */
+       WL_ND_HOSTIP_OP_LIST,           /* get list of host ip address */
+       WL_ND_HOSTIP_OP_MAX
+};
+
+typedef struct wl_nd_hostip {
+       uint16 version;                         /* version of iovar buf */
+       uint16 op_type;                         /* operation type */
+       uint32 length;                          /* length of entire structure */
+       union {
+               wl_nd_host_ip_addr_t host_ip;   /* set param for add */
+               uint16 version;                 /* get return for ver */
+       } u;
+} wl_nd_hostip_t;
+
+#define WL_ND_HOSTIP_FIXED_LEN         OFFSETOF(wl_nd_hostip_t, u)
+#define WL_ND_HOSTIP_WITH_ADDR_LEN     (WL_ND_HOSTIP_FIXED_LEN + sizeof(wl_nd_host_ip_addr_t))
+
+/*
+ * Keep-alive packet offloading.
+ */
+
+/**
+ * NAT keep-alive packets format: specifies the re-transmission period, the packet
+ * length, and packet contents.
+ */
+typedef struct wl_keep_alive_pkt {
+       uint32  period_msec;    /** Retransmission period (0 to disable packet re-transmits) */
+       uint16  len_bytes;      /* Size of packet to transmit (0 to disable packet re-transmits) */
+       uint8   data[1];        /** Variable length packet to transmit.  Contents should include
+                                * entire ethernet packet (enet header, IP header, UDP header,
+                                * and UDP payload) in network byte order.
+                                */
+} wl_keep_alive_pkt_t;
+
+#define WL_KEEP_ALIVE_FIXED_LEN                OFFSETOF(wl_keep_alive_pkt_t, data)
+
+#define MAX_RSSI_COUNT                 8
+typedef struct rssi_struct {
+       int8    val[MAX_RSSI_COUNT];    /**< rssi values in AFs */
+       int16   sum;                    /**< total rssi sum */
+       uint8   cnt;                    /**< number rssi samples */
+       uint8   idx;                    /**< next rssi location */
+} rssi_struct_t;
+
+/*
+ * ptk_start: iovar to start 4-way handshake for secured ranging
+*/
+
+/* ptk negotiation security type - determines negotiation parameters */
+typedef enum {
+       WL_PTK_START_SEC_TYPE_PMK = 1
+} wl_ptk_start_sec_type_t;
+
+/* ptk negotiation role */
+typedef enum {
+       ROLE_NONE       = 0x0,
+       ROLE_AUTH       = 0x1,
+       ROLE_SUP        = 0x2,
+       ROLE_STATIC     = 0x3,
+       ROLE_INVALID    = 0xff,
+       WL_PTK_START_ROLE_NONE = ROLE_NONE,
+       WL_PTK_START_ROLE_AUTH = ROLE_AUTH,
+       WL_PTK_START_ROLE_SUP = ROLE_SUP,
+       WL_PTK_START_ROLE_STATIC = ROLE_STATIC,
+       WL_PTK_START_ROLE_INVALID = ROLE_INVALID
+} wl_ptk_start_role_t;
+
+typedef struct wl_ptk_start_tlv {
+       uint16 id;
+       uint16 len;
+       uint8 data[1];
+} wl_ptk_start_tlv_t;
+
+typedef enum {
+       WL_PTK_START_TLV_PMK    = 1     /* uint8[] */
+} wl_ptk_start_tlv_type;
+
+typedef enum {
+       WL_PTK_START_FLAG_NO_DATA_PROT  = 1,    /* data frame protection disabled */
+       WL_PTK_START_FLAG_GEN_FTM_TPK   = 2     /* Generate FTM Toast/Seq Protection Key */
+} wl_ptk_start_flags_t;
+
+typedef struct wl_ptk_start_iov {
+       uint16 version;
+       uint16 len;                             /* length of entire iov from version */
+       wl_ptk_start_flags_t flags;
+       wl_ptk_start_sec_type_t sec_type;
+       wl_ptk_start_role_t role;
+       struct ether_addr peer_addr;
+       uint16 pad;                             /* reserved/32 bit alignment */
+       wl_ptk_start_tlv_t tlvs[1];
+} wl_ptk_start_iov_t;
+
+/*
+ * Dongle pattern matching filter.
+ */
+
+#define MAX_WAKE_PACKET_CACHE_BYTES 128 /**< Maximum cached wake packet */
+
+#define MAX_WAKE_PACKET_BYTES      (DOT11_A3_HDR_LEN +                     \
+                                    DOT11_QOS_LEN +                        \
+                                    sizeof(struct dot11_llc_snap_header) + \
+                                    ETHER_MAX_DATA)
+
+typedef struct pm_wake_packet {
+       uint32  status;         /**< Is the wake reason a packet (if all the other field's valid) */
+       uint32  pattern_id;     /**< Pattern ID that matched */
+       uint32  original_packet_size;
+       uint32  saved_packet_size;
+       uint8   packet[MAX_WAKE_PACKET_CACHE_BYTES];
+} pm_wake_packet_t;
+
+/* Packet filter types. Currently, only pattern matching is supported. */
+typedef enum wl_pkt_filter_type {
+       WL_PKT_FILTER_TYPE_PATTERN_MATCH=0,       /**< Pattern matching filter */
+       WL_PKT_FILTER_TYPE_MAGIC_PATTERN_MATCH=1, /**< Magic packet match */
+       WL_PKT_FILTER_TYPE_PATTERN_LIST_MATCH=2,  /**< A pattern list (match all to match filter) */
+       WL_PKT_FILTER_TYPE_ENCRYPTED_PATTERN_MATCH=3, /**< SECURE WOWL magic / net pattern match */
+       WL_PKT_FILTER_TYPE_APF_MATCH=4, /* Android packet filter match */
+       WL_PKT_FILTER_TYPE_PATTERN_MATCH_TIMEOUT=5, /* Pattern matching filter with timeout event */
+       WL_PKT_FILTER_TYPE_IMMEDIATE_PATTERN_MATCH=6, /* Immediately pattern matching filter */
+       WL_PKT_FILTYER_TYPE_MAX = 7,    /* Pkt filter type MAX */
+} wl_pkt_filter_type_t;
+
+#define WL_PKT_FILTER_TYPE wl_pkt_filter_type_t        /* backward compatibility; remove */
+
+/* String mapping for types that may be used by applications or debug */
+#define WL_PKT_FILTER_TYPE_NAMES \
+       { "PATTERN", WL_PKT_FILTER_TYPE_PATTERN_MATCH },        \
+       { "MAGIC",   WL_PKT_FILTER_TYPE_MAGIC_PATTERN_MATCH },  \
+       { "PATLIST", WL_PKT_FILTER_TYPE_PATTERN_LIST_MATCH },   \
+       { "SECURE WOWL", WL_PKT_FILTER_TYPE_ENCRYPTED_PATTERN_MATCH },  \
+       { "APF", WL_PKT_FILTER_TYPE_APF_MATCH }, \
+       { "PATTERN TIMEOUT", WL_PKT_FILTER_TYPE_PATTERN_MATCH_TIMEOUT }, \
+       { "IMMEDIATE", WL_PKT_FILTER_TYPE_IMMEDIATE_PATTERN_MATCH }
+
+/** Secured WOWL packet was encrypted, need decrypted before check filter match */
+typedef struct wl_pkt_decrypter {
+       uint8* (*dec_cb)(void* dec_ctx, const void *sdu, int sending);
+       void*  dec_ctx;
+} wl_pkt_decrypter_t;
+
+/**
+ * Pattern matching filter. Specifies an offset within received packets to
+ * start matching, the pattern to match, the size of the pattern, and a bitmask
+ * that indicates which bits within the pattern should be matched.
+ */
+typedef struct wl_pkt_filter_pattern {
+       uint32  offset;         /**< Offset within received packet to start pattern matching.
+                                * Offset '0' is the first byte of the ethernet header.
+                                */
+       uint32  size_bytes;     /**< Size of the pattern.  Bitmask must be the same size. */
+       uint8   mask_and_pattern[]; /**< Variable length mask and pattern data.  mask starts
+                                     * at offset 0.  Pattern immediately follows mask. for
+                                     * secured pattern, put the descrypter pointer to the
+                                     * beginning, mask and pattern postponed correspondingly
+                                     */
+} wl_pkt_filter_pattern_t;
+
+/** A pattern list is a numerically specified list of modified pattern structures. */
+typedef struct wl_pkt_filter_pattern_listel {
+       uint16 rel_offs;        /**< Offset to begin match (relative to 'base' below) */
+       uint16 base_offs;       /**< Base for offset (defined below) */
+       uint16 size_bytes;      /**< Size of mask/pattern */
+       uint16 match_flags;     /**< Addition flags controlling the match */
+       uint8  mask_and_data[]; /**< Variable length mask followed by data, each size_bytes */
+} wl_pkt_filter_pattern_listel_t;
+
+typedef struct wl_pkt_filter_pattern_list {
+       uint8 list_cnt;         /**< Number of elements in the list */
+       uint8 PAD1[1];          /**< Reserved (possible version: reserved) */
+       uint16 totsize;         /**< Total size of this pattern list (includes this struct) */
+       uint8 patterns[]; /**< Variable number of wl_pkt_filter_pattern_listel_t elements */
+} wl_pkt_filter_pattern_list_t;
+
+typedef struct wl_apf_program {
+       uint16 version;
+       uint16 instr_len;       /* number of instruction blocks */
+       uint32 inst_ts;         /* program installation timestamp */
+       uint8 instrs[]; /* variable length instructions */
+} wl_apf_program_t;
+
+typedef struct wl_pkt_filter_pattern_timeout {
+       uint32  offset; /* Offset within received packet to start pattern matching.
+                                        * Offset '0' is the first byte of the ethernet header.
+                                        */
+       uint32  size_bytes;     /* Size of the pattern. Bitmask must be the same size. */
+       uint32  timeout;        /* Timeout(seconds) */
+       uint8   mask_and_pattern[]; /* Variable length mask and pattern data.
+                                                                * mask starts at offset 0. Pattern
+                                                                * immediately follows mask.
+                                                               */
+} wl_pkt_filter_pattern_timeout_t;
+
+/** IOVAR "pkt_filter_add" parameter. Used to install packet filters. */
+typedef struct wl_pkt_filter {
+       uint32  id;             /**< Unique filter id, specified by app. */
+       uint32  type;           /**< Filter type (WL_PKT_FILTER_TYPE_xxx). */
+       uint32  negate_match;   /**< Negate the result of filter matches */
+       union {                 /* Filter definitions */
+               wl_pkt_filter_pattern_t pattern;        /**< Pattern matching filter */
+               wl_pkt_filter_pattern_list_t patlist; /**< List of patterns to match */
+               wl_apf_program_t apf_program; /* apf program */
+               wl_pkt_filter_pattern_timeout_t pattern_timeout; /* Pattern timeout event filter */
+       } u;
+       /* Do NOT add structure members after the filter definitions, since they
+        * may include variable length arrays.
+        */
+} wl_pkt_filter_t;
+
+/** IOVAR "tcp_keep_set" parameter. Used to install tcp keep_alive stuff. */
+typedef struct wl_tcp_keep_set {
+       uint32  val1;
+       uint32  val2;
+} wl_tcp_keep_set_t;
+
+#define WL_PKT_FILTER_FIXED_LEN                  OFFSETOF(wl_pkt_filter_t, u)
+#define WL_PKT_FILTER_PATTERN_FIXED_LEN          OFFSETOF(wl_pkt_filter_pattern_t, mask_and_pattern)
+#define WL_PKT_FILTER_PATTERN_LIST_FIXED_LEN OFFSETOF(wl_pkt_filter_pattern_list_t, patterns)
+#define WL_PKT_FILTER_PATTERN_LISTEL_FIXED_LEN \
+                       OFFSETOF(wl_pkt_filter_pattern_listel_t, mask_and_data)
+#define WL_PKT_FILTER_PATTERN_TIMEOUT_FIXED_LEN        \
+                       OFFSETOF(wl_pkt_filter_pattern_timeout_t, mask_and_pattern)
+
+#define WL_APF_INTERNAL_VERSION        1
+#define WL_APF_PROGRAM_MAX_SIZE (2 * 1024)
+#define WL_APF_PROGRAM_FIXED_LEN       OFFSETOF(wl_apf_program_t, instrs)
+#define WL_APF_PROGRAM_LEN(apf_program)        \
+       ((apf_program)->instr_len * sizeof((apf_program)->instrs[0]))
+#define WL_APF_PROGRAM_TOTAL_LEN(apf_program)  \
+       (WL_APF_PROGRAM_FIXED_LEN + WL_APF_PROGRAM_LEN(apf_program))
+
+/** IOVAR "pkt_filter_enable" parameter. */
+typedef struct wl_pkt_filter_enable {
+       uint32  id;             /**< Unique filter id */
+       uint32  enable;         /**< Enable/disable bool */
+} wl_pkt_filter_enable_t;
+
+/** IOVAR "pkt_filter_list" parameter. Used to retrieve a list of installed filters. */
+typedef struct wl_pkt_filter_list {
+       uint32  num;            /**< Number of installed packet filters */
+       uint8   filter[];       /**< Variable array of packet filters. */
+} wl_pkt_filter_list_t;
+
+#define WL_PKT_FILTER_LIST_FIXED_LEN     OFFSETOF(wl_pkt_filter_list_t, filter)
+
+/** IOVAR "pkt_filter_stats" parameter. Used to retrieve debug statistics. */
+typedef struct wl_pkt_filter_stats {
+       uint32  num_pkts_matched;       /**< # filter matches for specified filter id */
+       uint32  num_pkts_forwarded;     /**< # packets fwded from dongle to host for all filters */
+       uint32  num_pkts_discarded;     /**< # packets discarded by dongle for all filters */
+} wl_pkt_filter_stats_t;
+
+/** IOVAR "pkt_filter_ports" parameter.  Configure TCP/UDP port filters. */
+typedef struct wl_pkt_filter_ports {
+       uint8 version;          /**< Be proper */
+       uint8 reserved;         /**< Be really proper */
+       uint16 count;           /**< Number of ports following */
+       /* End of fixed data */
+       uint16 ports[1];        /**< Placeholder for ports[<count>] */
+} wl_pkt_filter_ports_t;
+
+#define WL_PKT_FILTER_PORTS_FIXED_LEN  OFFSETOF(wl_pkt_filter_ports_t, ports)
+
+#define WL_PKT_FILTER_PORTS_VERSION    0
+#if defined(WL_PKT_FLTR_EXT) && !defined(WL_PKT_FLTR_EXT_DISABLED)
+#define WL_PKT_FILTER_PORTS_MAX        256
+#else
+#define WL_PKT_FILTER_PORTS_MAX        128
+#endif /* WL_PKT_FLTR_EXT && !WL_PKT_FLTR_EXT_DISABLED */
+
+#define RSN_REPLAY_LEN 8
+typedef struct _gtkrefresh {
+       uint8   KCK[RSN_KCK_LENGTH];
+       uint8   KEK[RSN_KEK_LENGTH];
+       uint8   ReplayCounter[RSN_REPLAY_LEN];
+} gtk_keyinfo_t, *pgtk_keyinfo_t;
+
+/** Sequential Commands ioctl */
+typedef struct wl_seq_cmd_ioctl {
+       uint32 cmd;             /**< common ioctl definition */
+       uint32 len;             /**< length of user buffer */
+} wl_seq_cmd_ioctl_t;
+
+#define WL_SEQ_CMD_ALIGN_BYTES 4
+
+/**
+ * These are the set of get IOCTLs that should be allowed when using
+ * IOCTL sequence commands. These are issued implicitly by wl.exe each time
+ * it is invoked. We never want to buffer these, or else wl.exe will stop working.
+ */
+#define WL_SEQ_CMDS_GET_IOCTL_FILTER(cmd) \
+       (((cmd) == WLC_GET_MAGIC)               || \
+        ((cmd) == WLC_GET_VERSION)             || \
+        ((cmd) == WLC_GET_AP)                  || \
+        ((cmd) == WLC_GET_INSTANCE))
+
+#define MAX_PKTENG_SWEEP_STEPS 40
+typedef struct wl_pkteng {
+       uint32 flags;
+       uint32 delay;                   /**< Inter-packet delay */
+       uint32 nframes;                 /**< Number of frames */
+       uint32 length;                  /**< Packet length */
+       uint8  seqno;                   /**< Enable/disable sequence no. */
+       struct ether_addr dest;         /**< Destination address */
+       struct ether_addr src;          /**< Source address */
+       uint8  sweep_steps;             /**< Number of sweep power */
+       uint8  PAD[2];
+} wl_pkteng_t;
+
+/* IOVAR pkteng_sweep_counters response structure */
+#define WL_PKTENG_SWEEP_COUNTERS_VERSION    1
+typedef struct wl_pkteng_sweep_ctrs {
+       uint16 version;                 /**< Version - 1 */
+       uint16 size;                    /**< Complete Size including sweep_counters */
+       uint16 sweep_steps;             /**< Number of steps */
+       uint16 PAD;
+       uint16 sweep_counter[];         /**< Array of frame counters */
+} wl_pkteng_sweep_ctrs_t;
+
+/* IOVAR pkteng_rx_pkt response structure */
+#define WL_PKTENG_RX_PKT_VERSION    1
+typedef struct wl_pkteng_rx_pkt {
+       uint16 version;         /**< Version - 1 */
+       uint16 size;            /**< Complete Size including the packet */
+       uint8 payload[];        /**< Packet payload */
+} wl_pkteng_rx_pkt_t;
+
+#define WL_PKTENG_RU_FILL_VER_1                1u
+#define WL_PKTENG_RU_FILL_VER_2                2u
+#define WL_PKTENG_RU_FILL_VER_3                3u
+
+// struct for ru packet engine
+typedef struct wl_pkteng_ru_v1 {
+       uint16 version;                 /* ver is 1 */
+       uint16 length;                  /* size of complete structure */
+       uint8 bw;                       /* bandwidth info */
+       uint8 ru_alloc_val;             /* ru allocation index number */
+       uint8 mcs_val;                  /* mcs allocated value */
+       uint8 nss_val;                  /* num of spatial streams */
+       uint32 num_bytes;               /* approx num of bytes to calculate other required params */
+       uint8 cp_ltf_val ;              /* GI and LTF symbol size */
+       uint8 he_ltf_symb ;             /* num of HE-LTF symbols */
+       uint8 stbc;                     /* STBC support */
+       uint8 coding_val;               /* BCC/LDPC coding support */
+       uint8 pe_category;              /* PE duration 0/8/16usecs  */
+       uint8 dcm;                      /* dual carrier modulation */
+       uint8 mumimo_ltfmode;           /* ltf mode */
+       uint8 trig_tx;                  /* form and transmit the trigger frame */
+       uint8 trig_type;                /* type of trigger frame */
+       uint8 trig_period;              /* trigger tx periodicity TBD */
+       struct ether_addr dest;         /* destination address for un-associated mode */
+} wl_pkteng_ru_v1_t;
+
+typedef struct wl_pkteng_ru_v2 {
+       uint16 version;                 /* ver is 1 */
+       uint16 length;                  /* size of complete structure */
+       uint8 bw;                       /* bandwidth info */
+       uint8 ru_alloc_val;             /* ru allocation index number */
+       uint8 mcs_val;                  /* mcs allocated value */
+       uint8 nss_val;                  /* num of spatial streams */
+       uint32 num_bytes;               /* approx num of bytes to calculate other required params */
+       struct ether_addr dest;         /* destination address for un-associated mode */
+       uint8 cp_ltf_val ;              /* GI and LTF symbol size */
+       uint8 he_ltf_symb ;             /* num of HE-LTF symbols */
+       uint8 stbc;                     /* STBC support */
+       uint8 coding_val;               /* BCC/LDPC coding support */
+       uint8 pe_category;              /* PE duration 0/8/16usecs  */
+       uint8 dcm;                      /* dual carrier modulation */
+       uint8 mumimo_ltfmode;           /* ltf mode */
+       uint8 trig_tx;                  /* form and transmit the trigger frame */
+       uint8 trig_type;                /* type of trigger frame */
+       uint8 trig_period;              /* trigger tx periodicity TBD */
+       uint8 tgt_rssi; /* target rssi value in encoded format */
+       uint8 pad[3];           /* 2 byte padding to make structure size a multiple of 32bits */
+} wl_pkteng_ru_v2_t;
+
+typedef struct wl_pkteng_ru_v3 {
+       uint16 version;                 /* ver is 3 */
+       uint16 length;                  /* size of complete structure */
+       uint8 bw;                       /* bandwidth info */
+       uint8 ru_alloc_val;             /* ru allocation index number */
+       uint8 mcs_val;                  /* mcs allocated value */
+       uint8 nss_val;                  /* num of spatial streams */
+       uint32 num_bytes;               /* approx num of bytes to calculate other required params */
+       struct ether_addr dest;         /* destination address for un-associated mode */
+       uint8 cp_ltf_val ;              /* GI and LTF symbol size */
+       uint8 he_ltf_symb ;             /* num of HE-LTF symbols */
+       uint8 stbc;                     /* STBC support */
+       uint8 coding_val;               /* BCC/LDPC coding support */
+       uint8 pe_category;              /* PE duration 0/8/16usecs  */
+       uint8 dcm;                      /* dual carrier modulation */
+       uint8 mumimo_ltfmode;           /* ltf mode */
+       uint8 trig_tx;                  /* form and transmit the trigger frame */
+       uint8 trig_type;                /* type of trigger frame */
+       uint8 trig_period;              /* trigger tx periodicity TBD */
+       uint8 tgt_rssi; /* target rssi value in encoded format */
+       uint8 sub_band; /* in 160MHz case, 80L, 80U */
+       uint8 pad[2];           /* 2 byte padding to make structure size a multiple of 32bits */
+} wl_pkteng_ru_v3_t;
+
+#ifndef WL_PKTENG_RU_VER
+/* App uses the latest version - source picks it up from wlc_types.h */
+typedef wl_pkteng_ru_v3_t wl_pkteng_ru_fill_t;
+#endif
+
+typedef struct wl_trig_frame_info {
+       /* Structure versioning and structure length params */
+       uint16 version;
+       uint16 length;
+       /* Below params are the fields related to trigger frame contents */
+       /* Common Info Params Figure 9-52d - 11ax Draft 1.1 */
+       uint16 lsig_len;
+       uint16 trigger_type;
+       uint16 cascade_indication;
+       uint16 cs_req;
+       uint16 bw;
+       uint16 cp_ltf_type;
+       uint16 mu_mimo_ltf_mode;
+       uint16 num_he_ltf_syms;
+       uint16 stbc;
+       uint16 ldpc_extra_symb;
+       uint16 ap_tx_pwr;
+       uint16 afactor;
+       uint16 pe_disambiguity;
+       uint16 spatial_resuse;
+       uint16 doppler;
+       uint16 he_siga_rsvd;
+       uint16 cmn_info_rsvd;
+       /* User Info Params Figure 9-52e - 11ax Draft 1.1 */
+       uint16 aid12;
+       uint16 ru_alloc;
+       uint16 coding_type;
+       uint16 mcs;
+       uint16 dcm;
+       uint16 ss_alloc;
+       uint16 tgt_rssi;
+       uint16 usr_info_rsvd;
+} wl_trig_frame_info_t;
+
+/* wl pkteng_stats related definitions */
+#define WL_PKTENG_STATS_V1 (1)
+#define WL_PKTENG_STATS_V2 (2)
+
+typedef struct wl_pkteng_stats_v1 {
+       uint32 lostfrmcnt;              /**< RX PER test: no of frames lost (skip seqno) */
+       int32 rssi;                     /**< RSSI */
+       int32 snr;                      /**< signal to noise ratio */
+       uint16 rxpktcnt[NUM_80211_RATES+1];
+       uint8 rssi_qdb;                 /**< qdB portion of the computed rssi */
+       uint8  version;
+} wl_pkteng_stats_v1_t;
+
+typedef struct wl_pkteng_stats_v2 {
+       uint32 lostfrmcnt;              /**< RX PER test: no of frames lost (skip seqno) */
+       int32 rssi;                     /**< RSSI */
+       int32 snr;                      /**< signal to noise ratio */
+       uint16 rxpktcnt[NUM_80211_RATES+1];
+       uint8 rssi_qdb;                 /**< qdB portion of the computed rssi */
+       uint8  version;
+       uint16 length;
+       uint16 pad;
+       int32 rssi_per_core[WL_RSSI_ANT_MAX];
+       int32 rssi_per_core_qdb[WL_RSSI_ANT_MAX];
+} wl_pkteng_stats_v2_t;
+
+#ifndef WL_PKTENG_STATS_TYPEDEF_HAS_ALIAS
+typedef wl_pkteng_stats_v1_t wl_pkteng_stats_t;
+#endif /* WL_PKTENG_STATS_TYPEDEF_HAS_ALIAS */
+
+typedef struct wl_txcal_params {
+       wl_pkteng_t pkteng;
+       uint8 gidx_start;
+       int8 gidx_step;
+       uint8 gidx_stop;
+       uint8  PAD;
+} wl_txcal_params_t;
+
+typedef struct wl_txcal_gainidx {
+       uint8 num_actv_cores;
+       uint8 gidx_start_percore[WL_STA_ANT_MAX];
+       uint8 gidx_stop_percore[WL_STA_ANT_MAX];
+       uint8 PAD[3];
+} wl_txcal_gainidx_t;
+
+typedef struct wl_txcal_params_v2 {
+       wl_pkteng_t pkteng;
+       int8 gidx_step;
+       uint8 pwr_start[WL_STA_ANT_MAX];
+       uint8 pwr_stop[WL_STA_ANT_MAX];
+       uint8 init_start_idx;
+       uint8 gidx_start_percore[WL_STA_ANT_MAX];
+       uint8 gidx_stop_percore[WL_STA_ANT_MAX];
+       uint16 version;
+} wl_txcal_params_v2_t;
+
+typedef struct wl_txtone_idxsweep_params {
+       int8 gidx_step;
+       uint8 gidx_start_percore[WL_STA_ANT_MAX];
+       uint8 gidx_stop_percore[WL_STA_ANT_MAX];
+       uint32 dwell_time;
+} wl_txtone_idxsweep_params;
+
+typedef wl_txcal_params_t wl_txcal_params_v1_t;
+
+typedef struct wl_rssilog_params {
+       uint8 enable;
+       uint8 rssi_threshold;
+       uint8 time_threshold;
+       uint8 pad;
+} wl_rssilog_params_t;
+
+typedef struct wl_sslpnphy_papd_debug_data {
+       uint8 psat_pwr;
+       uint8 psat_indx;
+       uint8 final_idx;
+       uint8 start_idx;
+       int32 min_phase;
+       int32 voltage;
+       int8 temperature;
+       uint8  PAD[3];
+} wl_sslpnphy_papd_debug_data_t;
+typedef struct wl_sslpnphy_debug_data {
+       int16 papdcompRe [64];
+       int16 papdcompIm [64];
+} wl_sslpnphy_debug_data_t;
+typedef struct wl_sslpnphy_spbdump_data {
+       uint16 tbl_length;
+       int16 spbreal[256];
+       int16 spbimg[256];
+} wl_sslpnphy_spbdump_data_t;
+typedef struct wl_sslpnphy_percal_debug_data {
+       uint32 cur_idx;
+       uint32 tx_drift;
+       uint8 prev_cal_idx;
+       uint8  PAD[3];
+       uint32 percal_ctr;
+       int32 nxt_cal_idx;
+       uint32 force_1idxcal;
+       uint32 onedxacl_req;
+       int32 last_cal_volt;
+       int8 last_cal_temp;
+       uint8  PAD[3];
+       uint32 vbat_ripple;
+       uint32 exit_route;
+       int32 volt_winner;
+} wl_sslpnphy_percal_debug_data_t;
+
+typedef enum {
+       wowl_pattern_type_bitmap = 0,
+       wowl_pattern_type_arp,
+       wowl_pattern_type_na
+} wowl_pattern_type_t;
+
+typedef struct wl_wowl_pattern {
+       uint32              masksize;           /**< Size of the mask in #of bytes */
+       uint32              offset;             /**< Pattern byte offset in packet */
+       uint32              patternoffset;      /**< Offset of start of pattern in the structure */
+       uint32              patternsize;        /**< Size of the pattern itself in #of bytes */
+       uint32              id;                 /**< id */
+       uint32              reasonsize;         /**< Size of the wakeup reason code */
+       wowl_pattern_type_t type;               /**< Type of pattern */
+       /* Mask follows the structure above */
+       /* Pattern follows the mask is at 'patternoffset' from the start */
+} wl_wowl_pattern_t;
+
+typedef struct wl_wowl_pattern_list {
+       uint32                  count;
+       wl_wowl_pattern_t       pattern[1];
+} wl_wowl_pattern_list_t;
+
+typedef struct wl_wowl_wakeind {
+       uint8   pci_wakeind;    /**< Whether PCI PMECSR PMEStatus bit was set */
+       uint32  ucode_wakeind;  /**< What wakeup-event indication was set by ucode */
+} wl_wowl_wakeind_t;
+
+/** per AC rate control related data structure */
+typedef struct wl_txrate_class {
+       uint8           init_rate;
+       uint8           min_rate;
+       uint8           max_rate;
+} wl_txrate_class_t;
+
+/** structure for Overlap BSS scan arguments */
+typedef struct wl_obss_scan_arg {
+       int16   passive_dwell;
+       int16   active_dwell;
+       int16   bss_widthscan_interval;
+       int16   passive_total;
+       int16   active_total;
+       int16   chanwidth_transition_delay;
+       int16   activity_threshold;
+} wl_obss_scan_arg_t;
+
+#define WL_OBSS_SCAN_PARAM_LEN sizeof(wl_obss_scan_arg_t)
+
+/** RSSI event notification configuration. */
+typedef struct wl_rssi_event {
+       uint32 rate_limit_msec;         /**< # of events posted to application will be limited to
+                                        * one per specified period (0 to disable rate limit).
+                                        */
+       uint8 num_rssi_levels;          /**< Number of entries in rssi_levels[] below */
+       int8 rssi_levels[MAX_RSSI_LEVELS];      /**< Variable number of RSSI levels. An event
+                                                * will be posted each time the RSSI of received
+                                                * beacons/packets crosses a level.
+                                                */
+       int8 pad[3];
+} wl_rssi_event_t;
+
+#define RSSI_MONITOR_VERSION    1
+#define RSSI_MONITOR_STOP       (1 << 0)
+typedef struct wl_rssi_monitor_cfg {
+       uint8 version;
+       uint8 flags;
+       int8 max_rssi;
+       int8 min_rssi;
+} wl_rssi_monitor_cfg_t;
+
+typedef struct wl_rssi_monitor_evt {
+       uint8 version;
+       int8 cur_rssi;
+       uint16 pad;
+} wl_rssi_monitor_evt_t;
+
+/* CCA based channel quality event configuration (ID values for both config and report) */
+#define WL_CHAN_QUAL_CCA       0
+#define WL_CHAN_QUAL_NF                1
+#define WL_CHAN_QUAL_NF_LTE    2
+#define WL_CHAN_QUAL_TOTAL     3       /* The total IDs supported in both config and report */
+/* Additional channel quality event support in report only (>= 0x100)
+ * Notice that uint8 is used in configuration struct wl_chan_qual_metric_t, but uint16 is
+ * used for report in struct cca_chan_qual_event_t. So the ID values beyond 8-bit are used
+ * for reporting purpose only.
+ */
+#define WL_CHAN_QUAL_FULL_CCA  (0x100u | WL_CHAN_QUAL_CCA)     /* CCA: ibss vs. obss */
+#define WL_CHAN_QUAL_FULLPM_CCA        (0x200u | WL_CHAN_QUAL_CCA)     /* CCA: me vs. notme, PM vs. !PM */
+#define WL_CHAN_QUAL_FULLPM_CCA_OFDM_DESENSE   (0x400u | WL_CHAN_QUAL_CCA)
+/* CCA: me vs. notme, PM vs. !PM with OFDM Desense */
+
+#define MAX_CHAN_QUAL_LEVELS   8
+
+typedef struct wl_chan_qual_metric {
+       uint8 id;                               /**< metric ID */
+       uint8 num_levels;                       /**< Number of entries in rssi_levels[] below */
+       uint16 flags;
+       int16 htol[MAX_CHAN_QUAL_LEVELS];       /**< threshold level array: hi-to-lo */
+       int16 ltoh[MAX_CHAN_QUAL_LEVELS];       /**< threshold level array: lo-to-hi */
+} wl_chan_qual_metric_t;
+
+typedef struct wl_chan_qual_event {
+       uint32 rate_limit_msec;         /**< # of events posted to application will be limited to
+                                        * one per specified period (0 to disable rate limit).
+                                        */
+       uint16 flags;
+       uint16 num_metrics;
+       wl_chan_qual_metric_t metric[WL_CHAN_QUAL_TOTAL];       /**< metric array */
+} wl_chan_qual_event_t;
+typedef struct wl_action_obss_coex_req {
+       uint8 info;
+       uint8 num;
+       uint8 ch_list[1];
+} wl_action_obss_coex_req_t;
+
+/** IOVar parameter block for small MAC address array with type indicator */
+#define WL_IOV_MAC_PARAM_LEN  4
+
+/** This value is hardcoded to be 16 and MUST match PKTQ_MAX_PREC value defined elsewhere */
+#define WL_IOV_PKTQ_LOG_PRECS 16
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 num_addrs;
+       uint8   addr_type[WL_IOV_MAC_PARAM_LEN];
+       struct ether_addr ea[WL_IOV_MAC_PARAM_LEN];
+} BWL_POST_PACKED_STRUCT wl_iov_mac_params_t;
+#include <packed_section_end.h>
+
+/** This is extra info that follows wl_iov_mac_params_t */
+typedef struct {
+       uint32 addr_info[WL_IOV_MAC_PARAM_LEN];
+} wl_iov_mac_extra_params_t;
+
+/** Combined structure */
+typedef struct {
+       wl_iov_mac_params_t params;
+       wl_iov_mac_extra_params_t extra_params;
+} wl_iov_mac_full_params_t;
+
+/** Parameter block for PKTQ_LOG statistics */
+/* NOTE: this structure cannot change! It is exported to wlu as a binary format
+ * A new format revision number must be created if the interface changes
+ * The latest is v05; previous v01...v03 are no longer supported, v04 has
+ * common base with v05
+*/
+#define PKTQ_LOG_COUNTERS_V4 \
+       /* packets requested to be stored */ \
+       uint32 requested; \
+       /* packets stored */ \
+       uint32 stored; \
+       /* packets saved, because a lowest priority queue has given away one packet */ \
+       uint32 saved; \
+       /* packets saved, because an older packet from the same queue has been dropped */ \
+       uint32 selfsaved; \
+       /* packets dropped, because pktq is full with higher precedence packets */ \
+       uint32 full_dropped; \
+        /* packets dropped because pktq per that precedence is full */ \
+       uint32 dropped; \
+       /* packets dropped, in order to save one from a queue of a highest priority */ \
+       uint32 sacrificed; \
+       /* packets droped because of hardware/transmission error */ \
+       uint32 busy; \
+       /* packets re-sent because they were not received */ \
+       uint32 retry; \
+       /* packets retried again (ps pretend) prior to moving power save mode */ \
+       uint32 ps_retry; \
+        /* suppressed packet count */ \
+       uint32 suppress; \
+       /* packets finally dropped after retry limit */ \
+       uint32 retry_drop; \
+       /* the high-water mark of the queue capacity for packets - goes to zero as queue fills */ \
+       uint32 max_avail; \
+       /* the high-water mark of the queue utilisation for packets - ('inverse' of max_avail) */ \
+       uint32 max_used; \
+        /* the maximum capacity of the queue */ \
+       uint32 queue_capacity; \
+       /* count of rts attempts that failed to receive cts */ \
+       uint32 rtsfail; \
+       /* count of packets sent (acked) successfully */ \
+       uint32 acked; \
+       /* running total of phy rate of packets sent successfully */ \
+       uint32 txrate_succ; \
+       /* running total of phy 'main' rate */ \
+       uint32 txrate_main; \
+       /* actual data transferred successfully */ \
+       uint32 throughput; \
+       /* time difference since last pktq_stats */ \
+       uint32 time_delta;
+
+typedef struct {
+       PKTQ_LOG_COUNTERS_V4
+} pktq_log_counters_v04_t;
+
+/** v5 is the same as V4 with extra parameter */
+typedef struct {
+       PKTQ_LOG_COUNTERS_V4
+       /** cumulative time to transmit */
+       uint32 airtime;
+} pktq_log_counters_v05_t;
+
+typedef struct {
+       uint8                num_prec[WL_IOV_MAC_PARAM_LEN];
+       pktq_log_counters_v04_t  counters[WL_IOV_MAC_PARAM_LEN][WL_IOV_PKTQ_LOG_PRECS];
+       uint32               counter_info[WL_IOV_MAC_PARAM_LEN];
+       uint32               pspretend_time_delta[WL_IOV_MAC_PARAM_LEN];
+       char                 headings[];
+} pktq_log_format_v04_t;
+
+typedef struct {
+       uint8                num_prec[WL_IOV_MAC_PARAM_LEN];
+       pktq_log_counters_v05_t  counters[WL_IOV_MAC_PARAM_LEN][WL_IOV_PKTQ_LOG_PRECS];
+       uint32               counter_info[WL_IOV_MAC_PARAM_LEN];
+       uint32               pspretend_time_delta[WL_IOV_MAC_PARAM_LEN];
+       char                 headings[];
+} pktq_log_format_v05_t;
+
+typedef struct {
+       uint32               version;
+       wl_iov_mac_params_t  params;
+       union {
+               pktq_log_format_v04_t v04;
+               pktq_log_format_v05_t v05;
+       } pktq_log;
+} wl_iov_pktq_log_t;
+
+/* PKTQ_LOG_AUTO, PKTQ_LOG_DEF_PREC flags introduced in v05, they are ignored by v04 */
+#define PKTQ_LOG_AUTO     (1 << 31)
+#define PKTQ_LOG_DEF_PREC (1 << 30)
+
+typedef struct wl_pfn_macaddr_cfg_0 {
+       uint8 version;
+       uint8 reserved;
+       struct ether_addr macaddr;
+} wl_pfn_macaddr_cfg_0_t;
+#define LEGACY1_WL_PFN_MACADDR_CFG_VER 0
+#define WL_PFN_MAC_OUI_ONLY_MASK      1
+#define WL_PFN_SET_MAC_UNASSOC_MASK   2
+#define WL_PFN_RESTRICT_LA_MAC_MASK   4
+#define WL_PFN_MACADDR_FLAG_MASK     0x7
+/** To configure pfn_macaddr */
+typedef struct wl_pfn_macaddr_cfg {
+       uint8 version;
+       uint8 flags;
+       struct ether_addr macaddr;
+} wl_pfn_macaddr_cfg_t;
+#define WL_PFN_MACADDR_CFG_VER 1
+
+/*
+ * SCB_BS_DATA iovar definitions start.
+ */
+#define SCB_BS_DATA_STRUCT_VERSION     1
+
+/** The actual counters maintained for each station */
+typedef struct {
+       /* The following counters are a subset of what pktq_stats provides per precedence. */
+       uint32 retry;          /**< packets re-sent because they were not received */
+       uint32 retry_drop;     /**< packets finally dropped after retry limit */
+       uint32 rtsfail;        /**< count of rts attempts that failed to receive cts */
+       uint32 acked;          /**< count of packets sent (acked) successfully */
+       uint32 txrate_succ;    /**< running total of phy rate of packets sent successfully */
+       uint32 txrate_main;    /**< running total of phy 'main' rate */
+       uint32 throughput;     /**< actual data transferred successfully */
+       uint32 time_delta;     /**< time difference since last pktq_stats */
+       uint32 airtime;        /**< cumulative total medium access delay in useconds */
+} iov_bs_data_counters_t;
+
+/** The structure for individual station information. */
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       struct ether_addr       station_address;        /**< The station MAC address */
+       uint16                  station_flags;          /**< Bit mask of flags, for future use. */
+       iov_bs_data_counters_t  station_counters;       /**< The actual counter values */
+} BWL_POST_PACKED_STRUCT iov_bs_data_record_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint16  structure_version;      /**< Structure version number (for wl/wlu matching) */
+       uint16  structure_count;        /**< Number of iov_bs_data_record_t records following */
+       iov_bs_data_record_t    structure_record[1];    /**< 0 - structure_count records */
+} BWL_POST_PACKED_STRUCT iov_bs_data_struct_t;
+#include <packed_section_end.h>
+
+/* Bitmask of options that can be passed in to the iovar. */
+enum {
+       SCB_BS_DATA_FLAG_NO_RESET = (1<<0)      /**< Do not clear the counters after reading */
+};
+/*
+ * SCB_BS_DATA iovar definitions end.
+ */
+
+typedef struct wlc_extlog_cfg {
+       int32 max_number;
+       uint16 module;  /**< bitmap */
+       uint8 level;
+       uint8 flag;
+       uint16 version;
+       uint16 PAD;
+} wlc_extlog_cfg_t;
+
+typedef struct log_record {
+       uint32 time;
+       uint16 module;
+       uint16 id;
+       uint8 level;
+       uint8 sub_unit;
+       uint8 seq_num;
+       uint8 pad;
+       int32 arg;
+       char  str[MAX_ARGSTR_LEN];
+       char  PAD[4-MAX_ARGSTR_LEN%4];
+} log_record_t;
+
+typedef struct wlc_extlog_req {
+       uint32 from_last;
+       uint32 num;
+} wlc_extlog_req_t;
+
+typedef struct wlc_extlog_results {
+       uint16 version;
+       uint16 record_len;
+       uint32 num;
+       log_record_t logs[1];
+} wlc_extlog_results_t;
+
+typedef struct log_idstr {
+       uint16  id;
+       uint16  flag;
+       uint8   arg_type;
+       const char      *fmt_str;
+} log_idstr_t;
+
+#define FMTSTRF_USER           1
+
+/* flat ID definitions
+ * New definitions HAVE TO BE ADDED at the end of the table. Otherwise, it will
+ * affect backward compatibility with pre-existing apps
+ */
+typedef enum {
+       FMTSTR_DRIVER_UP_ID = 0,
+       FMTSTR_DRIVER_DOWN_ID = 1,
+       FMTSTR_SUSPEND_MAC_FAIL_ID = 2,
+       FMTSTR_NO_PROGRESS_ID = 3,
+       FMTSTR_RFDISABLE_ID = 4,
+       FMTSTR_REG_PRINT_ID = 5,
+       FMTSTR_EXPTIME_ID = 6,
+       FMTSTR_JOIN_START_ID = 7,
+       FMTSTR_JOIN_COMPLETE_ID = 8,
+       FMTSTR_NO_NETWORKS_ID = 9,
+       FMTSTR_SECURITY_MISMATCH_ID = 10,
+       FMTSTR_RATE_MISMATCH_ID = 11,
+       FMTSTR_AP_PRUNED_ID = 12,
+       FMTSTR_KEY_INSERTED_ID = 13,
+       FMTSTR_DEAUTH_ID = 14,
+       FMTSTR_DISASSOC_ID = 15,
+       FMTSTR_LINK_UP_ID = 16,
+       FMTSTR_LINK_DOWN_ID = 17,
+       FMTSTR_RADIO_HW_OFF_ID = 18,
+       FMTSTR_RADIO_HW_ON_ID = 19,
+       FMTSTR_EVENT_DESC_ID = 20,
+       FMTSTR_PNP_SET_POWER_ID = 21,
+       FMTSTR_RADIO_SW_OFF_ID = 22,
+       FMTSTR_RADIO_SW_ON_ID = 23,
+       FMTSTR_PWD_MISMATCH_ID = 24,
+       FMTSTR_FATAL_ERROR_ID = 25,
+       FMTSTR_AUTH_FAIL_ID = 26,
+       FMTSTR_ASSOC_FAIL_ID = 27,
+       FMTSTR_IBSS_FAIL_ID = 28,
+       FMTSTR_EXTAP_FAIL_ID = 29,
+       FMTSTR_MAX_ID
+} log_fmtstr_id_t;
+
+/** 11k Neighbor Report element (unversioned, deprecated) */
+typedef struct nbr_element {
+       uint8 id;
+       uint8 len;
+       struct ether_addr bssid;
+       uint32 bssid_info;
+       uint8 reg;
+       uint8 channel;
+       uint8 phytype;
+       uint8 pad;
+} nbr_element_t;
+#define NBR_ADD_STATIC 0
+#define NBR_ADD_DYNAMIC 1
+
+#define WL_RRM_NBR_RPT_VER             1
+
+#define WL_NBR_RPT_FLAG_BSS_PREF_FROM_AP  0x01
+/** 11k Neighbor Report element */
+typedef struct nbr_rpt_elem {
+       uint8 version;
+       uint8 id;
+       uint8 len;
+       uint8 pad;
+       struct ether_addr bssid;
+       uint8 pad_1[2];
+       uint32 bssid_info;
+       uint8 reg;
+       uint8 channel;
+       uint8 phytype;
+       uint8 addtype; /* static for manual add or dynamic if auto-learning of neighbors */
+       wlc_ssid_t ssid;
+       chanspec_t chanspec;
+       uint8 bss_trans_preference;
+       uint8 flags;
+} nbr_rpt_elem_t;
+
+typedef enum event_msgs_ext_command {
+       EVENTMSGS_NONE          =       0,
+       EVENTMSGS_SET_BIT       =       1,
+       EVENTMSGS_RESET_BIT     =       2,
+       EVENTMSGS_SET_MASK      =       3
+} event_msgs_ext_command_t;
+
+#define EVENTMSGS_VER 1
+#define EVENTMSGS_EXT_STRUCT_SIZE      ((uint)(sizeof(eventmsgs_ext_t) - 1))
+
+/* len-        for SET it would be mask size from the application to the firmware */
+/*             for GET it would be actual firmware mask size */
+/* maxgetsize -        is only used for GET. indicate max mask size that the */
+/*                             application can read from the firmware */
+typedef struct eventmsgs_ext
+{
+       uint8   ver;
+       uint8   command;
+       uint8   len;
+       uint8   maxgetsize;
+       uint8   mask[1];
+} eventmsgs_ext_t;
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct pcie_bus_tput_params {
+       /** no of host dma descriptors programmed by the firmware before a commit */
+       uint16          max_dma_descriptors;
+
+       uint16          host_buf_len; /**< length of host buffer */
+       dmaaddr_t       host_buf_addr; /**< physical address for bus_throughput_buf */
+} BWL_POST_PACKED_STRUCT pcie_bus_tput_params_t;
+#include <packed_section_end.h>
+
+typedef struct pcie_bus_tput_stats {
+       uint16          time_taken; /**< no of secs the test is run */
+       uint16          nbytes_per_descriptor; /**< no of bytes of data dma ed per descriptor */
+
+       /** no of desciptors for which dma is sucessfully completed within the test time */
+       uint32          count;
+} pcie_bus_tput_stats_t;
+
+#define HOST_WAKEUP_DATA_VER 1
+#include <packed_section_start.h>
+/* Bus interface host wakeup data */
+typedef BWL_PRE_PACKED_STRUCT struct wl_host_wakeup_data {
+       uint16 ver;
+       uint16 len;
+       uchar data[1];  /* wakeup data */
+} BWL_POST_PACKED_STRUCT wl_host_wakeup_data_t;
+#include <packed_section_end.h>
+
+#define HOST_WAKEUP_DATA_VER_2 2
+#include <packed_section_start.h>
+/* Bus interface host wakeup data */
+typedef BWL_PRE_PACKED_STRUCT struct wl_host_wakeup_data_v2 {
+       uint16 ver;
+       uint16 len;
+       uint32 gpio_toggle_time; /* gpio toggle time in ms */
+       uchar data[1];  /* wakeup data */
+} BWL_POST_PACKED_STRUCT wl_host_wakeup_data_v2_t;
+#include <packed_section_end.h>
+
+typedef struct keepalives_max_idle {
+       uint16  keepalive_count;        /**< nmbr of keepalives per bss_max_idle period */
+       uint8   mkeepalive_index;       /**< mkeepalive_index for keepalive frame to be used */
+       uint8   PAD;                    /**< to align next field */
+       uint16  max_interval;           /**< seconds */
+} keepalives_max_idle_t;
+
+#define PM_IGNORE_BCMC_PROXY_ARP (1 << 0)
+#define PM_IGNORE_BCMC_ALL_DMS_ACCEPTED (1 << 1)
+
+/* ##### HMAP section ##### */
+#define PCIE_MAX_HMAP_WINDOWS 8
+#define PCIE_HMAPTEST_VERSION 2
+#define HMAPTEST_INVALID_OFFSET 0xFFFFFFFFu
+#define HMAPTEST_DEFAULT_WRITE_PATTERN 0xBABECAFEu
+#define HMAPTEST_ACCESS_ARM 0
+#define HMAPTEST_ACCESS_M2M 1
+#define HMAPTEST_ACCESS_D11 2
+#define HMAPTEST_ACCESS_NONE 3
+
+typedef struct pcie_hmaptest {
+       uint16  version;                /* Version */
+       uint16  length;         /* Length of entire structure */
+       uint32  xfer_len;
+       uint32  accesstype;
+       uint32  is_write;
+       uint32  is_invalid;
+       uint32  host_addr_hi;
+       uint32  host_addr_lo;
+       uint32  host_offset;
+       uint32  value; /* 4 byte value to be filled in case of write access test */
+       uint32  delay; /* wait time  in seconds before initiating access from dongle */
+} pcie_hmaptest_t;
+
+/* HMAP window register set */
+typedef struct hmapwindow {
+       uint32 baseaddr_lo; /* BaseAddrLower */
+       uint32 baseaddr_hi; /* BaseAddrUpper */
+       uint32 windowlength; /* Window Length */
+} hmapwindow_t;
+
+#define PCIE_HMAP_VERSION 1
+typedef struct pcie_hmap {
+       uint16  version;                /**< Version */
+       uint16  length;                 /**< Length of entire structure */
+       uint32  enable;                 /**< status of HMAP enabled/disabled */
+       uint32  nwindows;               /* no. of HMAP windows enabled */
+       uint32  window_config;          /* HMAP window_config register */
+       uint32  hmap_violationaddr_lo;  /* violating address lo */
+       uint32  hmap_violationaddr_hi;  /* violating addr hi */
+       uint32  hmap_violation_info;    /* violation info */
+       hmapwindow_t hwindows[];        /* Multiple hwindows */
+} pcie_hmap_t;
+
+/* ##### Power Stats section ##### */
+
+#define WL_PWRSTATS_VERSION    2
+
+/** Input structure for pwrstats IOVAR */
+typedef struct wl_pwrstats_query {
+       uint16 length;          /**< Number of entries in type array. */
+       uint16 type[1];         /**< Types (tags) to retrieve.
+                                * Length 0 (no types) means get all.
+                                */
+} wl_pwrstats_query_t;
+
+/** This structure is for version 2; version 1 will be deprecated in by FW */
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwrstats {
+       uint16 version;               /**< Version = 2 is TLV format */
+       uint16 length;                /**< Length of entire structure */
+       uint8 data[1];                /**< TLV data, a series of structures,
+                                      * each starting with type and length.
+                                      *
+                                      * Padded as necessary so each section
+                                      * starts on a 4-byte boundary.
+                                      *
+                                      * Both type and len are uint16, but the
+                                      * upper nibble of length is reserved so
+                                      * valid len values are 0-4095.
+                                      */
+} BWL_POST_PACKED_STRUCT wl_pwrstats_t;
+#include <packed_section_end.h>
+#define WL_PWR_STATS_HDRLEN    OFFSETOF(wl_pwrstats_t, data)
+
+/* Bits for wake reasons */
+#define WLC_PMD_WAKE_SET               0x1u
+#define WLC_PMD_PM_AWAKE_BCN           0x2u
+/* BIT:3 is no longer being used */
+#define WLC_PMD_SCAN_IN_PROGRESS       0x8u
+#define WLC_PMD_RM_IN_PROGRESS         0x10u
+#define WLC_PMD_AS_IN_PROGRESS         0x20u
+#define WLC_PMD_PM_PEND                        0x40u
+#define WLC_PMD_PS_POLL                        0x80u
+#define WLC_PMD_CHK_UNALIGN_TBTT       0x100u
+#define WLC_PMD_APSD_STA_UP            0x200u
+#define WLC_PMD_TX_PEND_WAR            0x400u   /* obsolete, can be reused */
+#define WLC_PMD_NAN_AWAKE              0x400u   /* Reusing for NAN */
+#define WLC_PMD_GPTIMER_STAY_AWAKE     0x800u
+
+#define WLC_PMD_PM2_RADIO_SOFF_PEND    0x2000u
+#define WLC_PMD_NON_PRIM_STA_UP                0x4000u
+#define WLC_PMD_AP_UP                  0x8000u
+#define WLC_PMD_TX_IN_PROGRESS         0x10000u        /* Dongle awake due to packet TX */
+#define WLC_PMD_4WAYHS_IN_PROGRESS     0x20000u        /* Dongle awake due to 4 way handshake */
+#define WLC_PMD_PM_OVERRIDE            0x40000u        /* Dongle awake due to PM override */
+#define WLC_PMD_WAKE_OTHER             0x80000u
+
+typedef struct wlc_pm_debug {
+       uint32 timestamp;            /**< timestamp in millisecond */
+       uint32 reason;               /**< reason(s) for staying awake */
+} wlc_pm_debug_t;
+
+/** WL_PWRSTATS_TYPE_PM_AWAKE1 structures (for 6.25 firmware) */
+#define WLC_STA_AWAKE_STATES_MAX_V1    30
+#define WLC_PMD_EVENT_MAX_V1           32
+/** Data sent as part of pwrstats IOVAR (and EXCESS_PM_WAKE event) */
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct pm_awake_data_v1 {
+       uint32 curr_time;       /**< ms */
+       uint32 hw_macc;         /**< HW maccontrol */
+       uint32 sw_macc;         /**< SW maccontrol */
+       uint32 pm_dur;          /**< Total sleep time in PM, msecs */
+       uint32 mpc_dur;         /**< Total sleep time in MPC, msecs */
+
+       /* int32 drifts = remote - local; +ve drift => local-clk slow */
+       int32 last_drift;       /**< Most recent TSF drift from beacon */
+       int32 min_drift;        /**< Min TSF drift from beacon in magnitude */
+       int32 max_drift;        /**< Max TSF drift from beacon in magnitude */
+
+       uint32 avg_drift;       /**< Avg TSF drift from beacon */
+
+       /* Wake history tracking */
+       uint8  pmwake_idx;                                 /**< for stepping through pm_state */
+       wlc_pm_debug_t pm_state[WLC_STA_AWAKE_STATES_MAX_V1]; /**< timestamped wake bits */
+       uint32 pmd_event_wake_dur[WLC_PMD_EVENT_MAX_V1];   /**< cumulative usecs per wake reason */
+       uint32 drift_cnt;       /**< Count of drift readings over which avg_drift was computed */
+} BWL_POST_PACKED_STRUCT pm_awake_data_v1_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_pm_awake_stats_v1 {
+       uint16 type;         /**< WL_PWRSTATS_TYPE_PM_AWAKE */
+       uint16 len;          /**< Up to 4K-1, top 4 bits are reserved */
+
+       pm_awake_data_v1_t awake_data;
+       uint32 frts_time;       /**< Cumulative ms spent in frts since driver load */
+       uint32 frts_end_cnt;    /**< No of times frts ended since driver load */
+} BWL_POST_PACKED_STRUCT wl_pwr_pm_awake_stats_v1_t;
+#include <packed_section_end.h>
+
+/** WL_PWRSTATS_TYPE_PM_AWAKE2 structures. Data sent as part of pwrstats IOVAR */
+typedef struct pm_awake_data_v2 {
+       uint32 curr_time;       /**< ms */
+       uint32 hw_macc;         /**< HW maccontrol */
+       uint32 sw_macc;         /**< SW maccontrol */
+       uint32 pm_dur;          /**< Total sleep time in PM, msecs */
+       uint32 mpc_dur;         /**< Total sleep time in MPC, msecs */
+
+       /* int32 drifts = remote - local; +ve drift => local-clk slow */
+       int32 last_drift;       /**< Most recent TSF drift from beacon */
+       int32 min_drift;        /**< Min TSF drift from beacon in magnitude */
+       int32 max_drift;        /**< Max TSF drift from beacon in magnitude */
+
+       uint32 avg_drift;       /**< Avg TSF drift from beacon */
+
+       /* Wake history tracking */
+
+       /* pmstate array (type wlc_pm_debug_t) start offset */
+       uint16 pm_state_offset;
+       /** pmstate number of array entries */
+       uint16 pm_state_len;
+
+       /** array (type uint32) start offset */
+       uint16 pmd_event_wake_dur_offset;
+       /** pmd_event_wake_dur number of array entries */
+       uint16 pmd_event_wake_dur_len;
+
+       uint32 drift_cnt;       /**< Count of drift readings over which avg_drift was computed */
+       uint8  pmwake_idx;      /**< for stepping through pm_state */
+       uint8  flags;           /**< bit0: 1-sleep, 0- wake. bit1: 0-bit0 invlid, 1-bit0 valid */
+       uint8  pad[2];
+       uint32 frts_time;       /**< Cumulative ms spent in frts since driver load */
+       uint32 frts_end_cnt;    /**< No of times frts ended since driver load */
+} pm_awake_data_v2_t;
+
+typedef struct wl_pwr_pm_awake_stats_v2 {
+       uint16 type;         /**< WL_PWRSTATS_TYPE_PM_AWAKE */
+       uint16 len;          /**< Up to 4K-1, top 4 bits are reserved */
+
+       pm_awake_data_v2_t awake_data;
+} wl_pwr_pm_awake_stats_v2_t;
+
+/* bit0: 1-sleep, 0- wake. bit1: 0-bit0 invlid, 1-bit0 valid */
+#define WL_PWR_PM_AWAKE_STATS_WAKE      0x02
+#define WL_PWR_PM_AWAKE_STATS_ASLEEP    0x03
+#define WL_PWR_PM_AWAKE_STATS_WAKE_MASK 0x03
+
+/* WL_PWRSTATS_TYPE_PM_AWAKE Version 2 structures taken from 4324/43342 */
+/* These structures are only to be used with 4324/43342 devices */
+
+#define WL_STA_AWAKE_STATES_MAX_V2     30
+#define WL_PMD_EVENT_MAX_V2            32
+#define MAX_P2P_BSS_DTIM_PRD           4
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct ucode_dbg_v2 {
+       uint32 macctrl;
+       uint16 m_p2p_hps;
+       uint16 m_p2p_bss_dtim_prd[MAX_P2P_BSS_DTIM_PRD];
+       uint32 psmdebug[20];
+       uint32 phydebug[20];
+       uint32 psm_brc;
+       uint32 ifsstat;
+} BWL_POST_PACKED_STRUCT ucode_dbg_v2_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct pmalert_awake_data_v2 {
+       uint32 curr_time;       /* ms */
+       uint32 hw_macc;         /* HW maccontrol */
+       uint32 sw_macc;         /* SW maccontrol */
+       uint32 pm_dur;          /* Total sleep time in PM, msecs */
+       uint32 mpc_dur;         /* Total sleep time in MPC, msecs */
+
+       /* int32 drifts = remote - local; +ve drift => local-clk slow */
+       int32 last_drift;       /* Most recent TSF drift from beacon */
+       int32 min_drift;        /* Min TSF drift from beacon in magnitude */
+       int32 max_drift;        /* Max TSF drift from beacon in magnitude */
+
+       uint32 avg_drift;       /* Avg TSF drift from beacon */
+
+       /* Wake history tracking */
+       uint8  pmwake_idx;                                 /* for stepping through pm_state */
+       wlc_pm_debug_t pm_state[WL_STA_AWAKE_STATES_MAX_V2]; /* timestamped wake bits */
+       uint32 pmd_event_wake_dur[WL_PMD_EVENT_MAX_V2];      /* cumulative usecs per wake reason */
+       uint32 drift_cnt;       /* Count of drift readings over which avg_drift was computed */
+       uint32  start_event_dur[WL_PMD_EVENT_MAX_V2]; /* start event-duration */
+       ucode_dbg_v2_t ud;
+       uint32 frts_time;       /* Cumulative ms spent in frts since driver load */
+       uint32 frts_end_cnt;    /* No of times frts ended since driver load */
+} BWL_POST_PACKED_STRUCT pmalert_awake_data_v2_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct pm_alert_data_v2 {
+       uint32 version;
+       uint32 length; /* Length of entire structure */
+       uint32 reasons; /* reason(s) for pm_alert */
+       /* Following fields are present only for reasons
+        * PM_DUR_EXCEEDED, MPC_DUR_EXCEEDED & CONST_AWAKE_DUR_EXCEEDED
+        */
+       uint32 prev_stats_time; /* msecs */
+       uint32 prev_pm_dur;     /* msecs */
+       uint32 prev_mpc_dur;    /* msecs */
+       pmalert_awake_data_v2_t awake_data;
+} BWL_POST_PACKED_STRUCT pm_alert_data_v2_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_pm_awake_status_v2 {
+       uint16 type;         /* WL_PWRSTATS_TYPE_PM_AWAKE */
+       uint16 len;          /* Up to 4K-1, top 4 bits are reserved */
+
+       pmalert_awake_data_v2_t awake_data;
+       uint32 frts_time;       /* Cumulative ms spent in frts since driver load */
+       uint32 frts_end_cnt;    /* No of times frts ended since driver load */
+} BWL_POST_PACKED_STRUCT wl_pwr_pm_awake_status_v2_t;
+#include <packed_section_end.h>
+
+/* Below are latest definitions from PHO25178RC100_BRANCH_6_50 */
+/* wl_pwr_pm_awake_stats_v1_t is used for WL_PWRSTATS_TYPE_PM_AWAKE */
+/* Use regs from d11.h instead of raw addresses for */
+/* (at least) the chip independent registers */
+typedef struct ucode_dbg_ext {
+       uint32 x120;
+       uint32 x124;
+       uint32 x154;
+       uint32 x158;
+       uint32 x15c;
+       uint32 x180;
+       uint32 x184;
+       uint32 x188;
+       uint32 x18c;
+       uint32 x1a0;
+       uint32 x1a8;
+       uint32 x1e0;
+       uint32 scr_x14;
+       uint32 scr_x2b;
+       uint32 scr_x2c;
+       uint32 scr_x2d;
+       uint32 scr_x2e;
+
+       uint16 x40a;
+       uint16 x480;
+       uint16 x490;
+       uint16 x492;
+       uint16 x4d8;
+       uint16 x4b8;
+       uint16 x4ba;
+       uint16 x4bc;
+       uint16 x4be;
+       uint16 x500;
+       uint16 x50e;
+       uint16 x522;
+       uint16 x546;
+       uint16 x578;
+       uint16 x602;
+       uint16 x646;
+       uint16 x648;
+       uint16 x666;
+       uint16 x670;
+       uint16 x690;
+       uint16 x692;
+       uint16 x6a0;
+       uint16 x6a2;
+       uint16 x6a4;
+       uint16 x6b2;
+       uint16 x7c0;
+
+       uint16 shm_x20;
+       uint16 shm_x4a;
+       uint16 shm_x5e;
+       uint16 shm_x5f;
+       uint16 shm_xaab;
+       uint16 shm_x74a;
+       uint16 shm_x74b;
+       uint16 shm_x74c;
+       uint16 shm_x74e;
+       uint16 shm_x756;
+       uint16 shm_x75b;
+       uint16 shm_x7b9;
+       uint16 shm_x7d4;
+
+       uint16 shm_P2P_HPS;
+       uint16 shm_P2P_intr[16];
+       uint16 shm_P2P_perbss[48];
+} ucode_dbg_ext_t;
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct pm_alert_data_v1 {
+       uint32 version;
+       uint32 length; /**< Length of entire structure */
+       uint32 reasons; /**< reason(s) for pm_alert */
+       /* Following fields are present only for reasons
+        * PM_DUR_EXCEEDED, MPC_DUR_EXCEEDED & CONST_AWAKE_DUR_EXCEEDED
+        */
+       uint32 prev_stats_time; /**< msecs */
+       uint32 prev_pm_dur;     /**< msecs */
+       uint32 prev_mpc_dur;    /**< msecs */
+       pm_awake_data_v1_t awake_data;
+       uint32  start_event_dur[WLC_PMD_EVENT_MAX_V1]; /**< start event-duration */
+       ucode_dbg_v2_t ud;
+       uint32 frts_time;       /**< Cumulative ms spent in frts since driver load */
+       uint32 frts_end_cnt;    /**< No of times frts ended since driver load */
+       ucode_dbg_ext_t ud_ext;
+       uint32 prev_frts_dur; /**< ms */
+} BWL_POST_PACKED_STRUCT pm_alert_data_v1_t;
+#include <packed_section_end.h>
+
+/* End of 43342/4324 v2 structure definitions */
+
+/* Original bus structure is for HSIC */
+
+typedef struct bus_metrics {
+       uint32 suspend_ct;      /**< suspend count */
+       uint32 resume_ct;       /**< resume count */
+       uint32 disconnect_ct;   /**< disconnect count */
+       uint32 reconnect_ct;    /**< reconnect count */
+       uint32 active_dur;      /**< msecs in bus, usecs for user */
+       uint32 suspend_dur;     /**< msecs in bus, usecs for user */
+       uint32 disconnect_dur;  /**< msecs in bus, usecs for user */
+} bus_metrics_t;
+
+/** Bus interface info for USB/HSIC */
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_usb_hsic_stats {
+       uint16 type;         /**< WL_PWRSTATS_TYPE_USB_HSIC */
+       uint16 len;          /**< Up to 4K-1, top 4 bits are reserved */
+
+       bus_metrics_t hsic;     /**< stats from hsic bus driver */
+} BWL_POST_PACKED_STRUCT wl_pwr_usb_hsic_stats_t;
+#include <packed_section_end.h>
+
+/* PCIe Event counter tlv IDs */
+enum pcie_cnt_xtlv_id {
+       PCIE_CNT_XTLV_METRICS = 0x1,    /**< PCIe Bus Metrics */
+       PCIE_CNT_XTLV_BUS_CNT = 0x2     /**< PCIe Bus counters */
+};
+
+typedef struct pcie_bus_metrics {
+       uint32 d3_suspend_ct;   /**< suspend count */
+       uint32 d0_resume_ct;    /**< resume count */
+       uint32 perst_assrt_ct;  /**< PERST# assert count */
+       uint32 perst_deassrt_ct;        /**< PERST# de-assert count */
+       uint32 active_dur;      /**< msecs */
+       uint32 d3_suspend_dur;  /**< msecs */
+       uint32 perst_dur;       /**< msecs */
+       uint32 l0_cnt;          /**< L0 entry count */
+       uint32 l0_usecs;        /**< L0 duration in usecs */
+       uint32 l1_cnt;          /**< L1 entry count */
+       uint32 l1_usecs;        /**< L1 duration in usecs */
+       uint32 l1_1_cnt;        /**< L1_1ss entry count */
+       uint32 l1_1_usecs;      /**< L1_1ss duration in usecs */
+       uint32 l1_2_cnt;        /**< L1_2ss entry count */
+       uint32 l1_2_usecs;      /**< L1_2ss duration in usecs */
+       uint32 l2_cnt;          /**< L2 entry count */
+       uint32 l2_usecs;        /**< L2 duration in usecs */
+       uint32 timestamp;       /**< Timestamp on when stats are collected */
+       uint32 num_h2d_doorbell;        /**< # of doorbell interrupts - h2d */
+       uint32 num_d2h_doorbell;        /**< # of doorbell interrupts - d2h */
+       uint32 num_submissions; /**< # of submissions */
+       uint32 num_completions; /**< # of completions */
+       uint32 num_rxcmplt;     /**< # of rx completions */
+       uint32 num_rxcmplt_drbl;        /**< of drbl interrupts for rx complt. */
+       uint32 num_txstatus;    /**< # of tx completions */
+       uint32 num_txstatus_drbl;       /**< of drbl interrupts for tx complt. */
+       uint32 deepsleep_count; /**< # of times chip went to deepsleep */
+       uint32 deepsleep_dur;   /**< # of msecs chip was in deepsleep */
+       uint32 ltr_active_ct;   /**< # of times chip went to LTR ACTIVE */
+       uint32 ltr_active_dur;  /**< # of msecs chip was in LTR ACTIVE */
+       uint32 ltr_sleep_ct;    /**< # of times chip went to LTR SLEEP */
+       uint32 ltr_sleep_dur;   /**< # of msecs chip was in LTR SLEEP */
+} pcie_bus_metrics_t;
+
+typedef struct pcie_cnt {
+       uint32 ltr_state; /**< Current LTR state */
+       uint32 l0_sr_cnt; /**< SR count during L0 */
+       uint32 l2l3_sr_cnt; /**< SR count during L2L3 */
+       uint32 d3_ack_sr_cnt; /**< srcount during last D3-ACK */
+       uint32 d3_sr_cnt; /**< SR count during D3 */
+       uint32 d3_info_start; /**< D3 INFORM received time */
+       uint32 d3_info_enter_cnt; /**< # of D3 INFORM received */
+       uint32 d3_cnt; /**< # of real D3 */
+       uint32 d3_ack_sent_cnt; /**< # of D3 ACK sent count */
+       uint32 d3_drop_cnt_event; /**< # of events dropped during D3 */
+       uint32 d2h_req_q_len; /**< # of Packet pending in D2H request queue */
+       uint32 hw_reason; /**< Last Host wake assert reason */
+       uint32 hw_assert_cnt; /**< # of times Host wake Asserted */
+       uint32 host_ready_cnt; /**< # of Host ready interrupts */
+       uint32 hw_assert_reason_0; /**< timestamp when hw_reason is TRAP  */
+       uint32 hw_assert_reason_1; /**< timestamp when hw_reason is WL_EVENT */
+       uint32 hw_assert_reason_2; /**< timestamp when hw_reason is DATA */
+       uint32 hw_assert_reason_3; /**< timestamp when hw_reason is DELAYED_WAKE */
+       uint32 last_host_ready; /**< Timestamp of last Host ready */
+       bool hw_asserted; /**< Flag to indicate if Host wake is Asserted */
+       bool event_delivery_pend; /**< No resources to send event */
+       uint16 pad; /**< Word alignment for scripts */
+} pcie_cnt_t;
+
+/** Bus interface info for PCIE */
+typedef struct wl_pwr_pcie_stats {
+       uint16 type;         /**< WL_PWRSTATS_TYPE_PCIE */
+       uint16 len;          /**< Up to 4K-1, top 4 bits are reserved */
+       pcie_bus_metrics_t pcie;        /**< stats from pcie bus driver */
+} wl_pwr_pcie_stats_t;
+
+/** Scan information history per category */
+typedef struct scan_data {
+       uint32 count;           /**< Number of scans performed */
+       uint32 dur;             /**< Total time (in us) used */
+} scan_data_t;
+
+typedef struct wl_pwr_scan_stats {
+       uint16 type;         /**< WL_PWRSTATS_TYPE_SCAN */
+       uint16 len;          /**< Up to 4K-1, top 4 bits are reserved */
+
+       /* Scan history */
+       scan_data_t user_scans;   /**< User-requested scans: (i/e/p)scan */
+       scan_data_t assoc_scans;  /**< Scans initiated by association requests */
+       scan_data_t roam_scans;   /**< Scans initiated by the roam engine */
+       scan_data_t pno_scans[8]; /**< For future PNO bucketing (BSSID, SSID, etc) */
+       scan_data_t other_scans;  /**< Scan engine usage not assigned to the above */
+} wl_pwr_scan_stats_t;
+
+typedef struct wl_pwr_connect_stats {
+       uint16 type;         /**< WL_PWRSTATS_TYPE_SCAN */
+       uint16 len;          /**< Up to 4K-1, top 4 bits are reserved */
+
+       /* Connection (Association + Key exchange) data */
+       uint32 count;   /**< Number of connections performed */
+       uint32 dur;             /**< Total time (in ms) used */
+} wl_pwr_connect_stats_t;
+
+typedef struct wl_pwr_phy_stats {
+       uint16 type;        /**< WL_PWRSTATS_TYPE_PHY */
+       uint16 len;         /**< Up to 4K-1, top 4 bits are reserved */
+       uint32 tx_dur;      /**< TX Active duration in us */
+       uint32 rx_dur;      /**< RX Active duration in us */
+} wl_pwr_phy_stats_t;
+
+typedef struct wl_mimo_meas_metrics_v1 {
+       uint16 type;
+       uint16 len;
+       /* Total time(us) idle in MIMO RX chain configuration */
+       uint32 total_idle_time_mimo;
+       /* Total time(us) idle in SISO  RX chain configuration */
+       uint32 total_idle_time_siso;
+       /* Total receive time (us) in SISO RX chain configuration */
+       uint32 total_rx_time_siso;
+       /* Total receive time (us) in MIMO RX chain configuration */
+       uint32 total_rx_time_mimo;
+       /* Total 1-chain transmit time(us) */
+       uint32 total_tx_time_1chain;
+       /* Total 2-chain transmit time(us) */
+       uint32 total_tx_time_2chain;
+       /* Total 3-chain transmit time(us) */
+       uint32 total_tx_time_3chain;
+} wl_mimo_meas_metrics_v1_t;
+
+typedef struct wl_mimo_meas_metrics {
+       uint16 type;
+       uint16 len;
+       /* Total time(us) idle in MIMO RX chain configuration */
+       uint32 total_idle_time_mimo;
+       /* Total time(us) idle in SISO  RX chain configuration */
+       uint32 total_idle_time_siso;
+       /* Total receive time (us) in SISO RX chain configuration */
+       uint32 total_rx_time_siso;
+       /* Total receive time (us) in MIMO RX chain configuration */
+       uint32 total_rx_time_mimo;
+       /* Total 1-chain transmit time(us) */
+       uint32 total_tx_time_1chain;
+       /* Total 2-chain transmit time(us) */
+       uint32 total_tx_time_2chain;
+       /* Total 3-chain transmit time(us) */
+       uint32 total_tx_time_3chain;
+       /* End of original, OCL fields start here */
+       /* Total time(us) idle in ocl mode */
+       uint32 total_idle_time_ocl;
+       /* Total receive time (us) in ocl mode */
+       uint32 total_rx_time_ocl;
+       /* End of OCL fields, internal adjustment fields here */
+       /* Total SIFS idle time in MIMO mode */
+       uint32 total_sifs_time_mimo;
+       /* Total SIFS idle time in SISO mode */
+       uint32 total_sifs_time_siso;
+} wl_mimo_meas_metrics_t;
+
+typedef struct wl_pwr_slice_index {
+       uint16 type;         /* WL_PWRSTATS_TYPE_SLICE_INDEX */
+       uint16 len;
+
+       uint32 slice_index;     /* Slice index for which stats are meant for */
+} wl_pwr_slice_index_t;
+
+typedef struct wl_pwr_tsync_stats {
+       uint16 type;            /**< WL_PWRSTATS_TYPE_TSYNC */
+       uint16 len;
+       uint32 avb_uptime;      /**< AVB uptime in msec */
+} wl_pwr_tsync_stats_t;
+
+typedef struct wl_pwr_ops_stats {
+       uint16 type;                    /* WL_PWRSTATS_TYPE_OPS_STATS */
+       uint16 len;                     /* total length includes fixed fields */
+       uint32 partial_ops_dur;         /* Total time(in usec) partial ops duration */
+       uint32 full_ops_dur;            /* Total time(in usec) full ops duration */
+} wl_pwr_ops_stats_t;
+
+typedef struct wl_pwr_bcntrim_stats {
+       uint16 type;                    /* WL_PWRSTATS_TYPE_BCNTRIM_STATS */
+       uint16 len;                     /* total length includes fixed fields */
+       uint8  associated;              /* STA is associated ? */
+       uint8  slice_idx;               /* on which slice STA is associated */
+       uint16 pad;                     /* padding */
+       uint32 slice_beacon_seen;       /* number of beacons seen on the Infra
+                                        * interface on this slice
+                                        */
+       uint32 slice_beacon_trimmed;    /* number beacons actually trimmed on this slice */
+       uint32 total_beacon_seen;       /* total number of beacons seen on the Infra interface */
+       uint32 total_beacon_trimmed;    /* total beacons actually trimmed */
+} wl_pwr_bcntrim_stats_t;
+
+typedef struct wl_pwr_slice_index_band {
+       uint16 type;                    /* WL_PWRSTATS_TYPE_SLICE_INDEX_BAND_INFO */
+       uint16 len;                     /* Total length includes fixed fields */
+       uint16 index;                   /* Slice Index */
+       int16  bandtype;                /* Slice Bandtype */
+} wl_pwr_slice_index_band_t;
+
+typedef struct wl_pwr_psbw_stats {
+       uint16 type;                    /* WL_PWRSTATS_TYPE_PSBW_STATS */
+       uint16 len;                     /* total length includes fixed fields */
+       uint8  slice_idx;               /* on which slice STA is associated */
+       uint8  pad[3];
+       uint32 slice_enable_dur;        /* time(ms) psbw remains enabled on this slice */
+       uint32 total_enable_dur;        /* time(ms) psbw remains enabled total */
+} wl_pwr_psbw_stats_t;
+
+/* ##### End of Power Stats section ##### */
+
+/** IPV4 Arp offloads for ndis context */
+#include <packed_section_start.h>
+BWL_PRE_PACKED_STRUCT struct hostip_id {
+       struct ipv4_addr ipa;
+       uint8 id;
+} BWL_POST_PACKED_STRUCT;
+#include <packed_section_end.h>
+
+/* Return values */
+#define ND_REPLY_PEER          0x1     /**< Reply was sent to service NS request from peer */
+#define ND_REQ_SINK            0x2     /**< Input packet should be discarded */
+#define ND_FORCE_FORWARD       0X3     /**< For the dongle to forward req to HOST */
+
+/** Neighbor Solicitation Response Offload IOVAR param */
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct nd_param {
+       struct ipv6_addr        host_ip[2];
+       struct ipv6_addr        solicit_ip;
+       struct ipv6_addr        remote_ip;
+       uint8   host_mac[ETHER_ADDR_LEN];
+       uint32  offload_id;
+} BWL_POST_PACKED_STRUCT nd_param_t;
+#include <packed_section_end.h>
+
+typedef struct wl_pfn_roam_thresh {
+       uint32 pfn_alert_thresh; /**< time in ms */
+       uint32 roam_alert_thresh; /**< time in ms */
+} wl_pfn_roam_thresh_t;
+
+/* Reasons for wl_pmalert_t */
+#define PM_DUR_EXCEEDED                        (1<<0)
+#define MPC_DUR_EXCEEDED               (1<<1)
+#define ROAM_ALERT_THRESH_EXCEEDED     (1<<2)
+#define PFN_ALERT_THRESH_EXCEEDED      (1<<3)
+#define CONST_AWAKE_DUR_ALERT          (1<<4)
+#define CONST_AWAKE_DUR_RECOVERY       (1<<5)
+
+#define MIN_PM_ALERT_LEN 9
+
+/** Data sent in EXCESS_PM_WAKE event */
+#define WL_PM_ALERT_VERSION 3
+
+/** This structure is for version 3; version 2 will be deprecated in by FW */
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct wl_pmalert {
+       uint16 version;         /**< Version = 3 is TLV format */
+       uint16 length;          /**< Length of entire structure */
+       uint32 reasons;         /**< reason(s) for pm_alert */
+       uint8 data[1];          /**< TLV data, a series of structures,
+                                * each starting with type and length.
+                                *
+                                * Padded as necessary so each section
+                                * starts on a 4-byte boundary.
+                                *
+                                * Both type and len are uint16, but the
+                                * upper nibble of length is reserved so
+                                * valid len values are 0-4095.
+                               */
+} BWL_POST_PACKED_STRUCT wl_pmalert_t;
+#include <packed_section_end.h>
+
+/* Type values for the data section */
+#define WL_PMALERT_FIXED       0       /**< struct wl_pmalert_fixed_t, fixed fields */
+#define WL_PMALERT_PMSTATE     1       /**< struct wl_pmalert_pmstate_t, variable */
+#define WL_PMALERT_EVENT_DUR   2       /**< struct wl_pmalert_event_dur_t, variable */
+#define WL_PMALERT_UCODE_DBG   3       /**< struct wl_pmalert_ucode_dbg_v1, variable */
+#define WL_PMALERT_PS_ALLOWED_HIST     4 /**< struct wl_pmalert_ps_allowed_history, variable */
+#define WL_PMALERT_EXT_UCODE_DBG       5 /**< struct wl_pmalert_ext_ucode_dbg_t, variable */
+#define WL_PMALERT_EPM_START_EVENT_DUR 6 /**< struct wl_pmalert_event_dur_t, variable */
+#define WL_PMALERT_UCODE_DBG_V2                7 /**< struct wl_pmalert_ucode_dbg_v2, variable */
+
+typedef struct wl_pmalert_fixed {
+       uint16 type;            /**< WL_PMALERT_FIXED */
+       uint16 len;             /**< Up to 4K-1, top 4 bits are reserved */
+       uint32 prev_stats_time; /**< msecs */
+       uint32 curr_time;       /**< ms */
+       uint32 prev_pm_dur;     /**< msecs */
+       uint32 pm_dur;          /**< Total sleep time in PM, msecs */
+       uint32 prev_mpc_dur;    /**< msecs */
+       uint32 mpc_dur;         /**< Total sleep time in MPC, msecs */
+       uint32 hw_macc;         /**< HW maccontrol */
+       uint32 sw_macc;         /**< SW maccontrol */
+
+       /* int32 drifts = remote - local; +ve drift -> local-clk slow */
+       int32 last_drift;       /**< Most recent TSF drift from beacon */
+       int32 min_drift;        /**< Min TSF drift from beacon in magnitude */
+       int32 max_drift;        /**< Max TSF drift from beacon in magnitude */
+
+       uint32 avg_drift;       /**< Avg TSF drift from beacon */
+       uint32 drift_cnt;       /**< Count of drift readings over which avg_drift was computed */
+       uint32 frts_time;       /**< Cumulative ms spent in data frts since driver load */
+       uint32 frts_end_cnt;    /**< No of times frts ended since driver load */
+       uint32 prev_frts_dur;   /**< Data frts duration at start of pm-period */
+       uint32 cal_dur;         /**< Cumulative ms spent in calibration */
+       uint32 prev_cal_dur;    /**< cal duration at start of pm-period */
+} wl_pmalert_fixed_t;
+
+typedef struct wl_pmalert_pmstate {
+       uint16 type;         /**< WL_PMALERT_PMSTATE */
+       uint16 len;          /**< Up to 4K-1, top 4 bits are reserved */
+
+       uint8 pmwake_idx;   /**< for stepping through pm_state */
+       uint8 pad[3];
+       /* Array of pmstate; len of array is based on tlv len */
+       wlc_pm_debug_t pmstate[1];
+} wl_pmalert_pmstate_t;
+
+typedef struct wl_pmalert_event_dur {
+       uint16 type;         /**< WL_PMALERT_EVENT_DUR */
+       uint16 len;          /**< Up to 4K-1, top 4 bits are reserved */
+
+       /* Array of event_dur, len of array is based on tlv len */
+       uint32 event_dur[1];
+} wl_pmalert_event_dur_t;
+
+#include <packed_section_start.h>
+BWL_PRE_PACKED_STRUCT struct wl_pmalert_ucode_dbg_v1 {
+       uint16 type;         /* WL_PMALERT_UCODE_DBG */
+       uint16 len;      /* Up to 4K-1, top 4 bits are reserved */
+       uint32 macctrl;
+       uint16 m_p2p_hps;
+       uint32 psm_brc;
+       uint32 ifsstat;
+       uint16 m_p2p_bss_dtim_prd[MAX_P2P_BSS_DTIM_PRD];
+       uint32 psmdebug[20];
+       uint32 phydebug[20];
+       uint16 M_P2P_BSS[3][12];
+       uint16 M_P2P_PRE_TBTT[3];
+
+       /* Following is valid only for corerevs<40 */
+       uint16 xmtfifordy;
+
+       /* Following 3 are valid only for 11ac corerevs (>=40) */
+       uint16 psm_maccommand;
+       uint16 txe_status1;
+       uint16 AQMFifoReady;
+} BWL_POST_PACKED_STRUCT;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+BWL_PRE_PACKED_STRUCT struct wl_pmalert_ucode_dbg_v2 {
+       uint16 type;         /**< WL_PMALERT_UCODE_DBG_V2 */
+       uint16 len;          /**< Up to 4K-1, top 4 bits are reserved */
+       uint32 macctrl;
+       uint16 m_p2p_hps;
+       uint32 psm_brc;
+       uint32 ifsstat;
+       uint16 m_p2p_bss_dtim_prd[MAX_P2P_BSS_DTIM_PRD];
+       uint32 psmdebug[20];
+       uint32 phydebug[20];
+       uint16 M_P2P_BSS[3][12];
+       uint16 M_P2P_PRE_TBTT[3];
+
+       /* Following is valid only for corerevs<40 */
+       uint16 xmtfifordy;
+
+       /* Following 3 are valid only for 11ac corerevs (>=40) */
+       uint16 psm_maccommand;
+       uint16 txe_status1;
+       uint32 AQMFifoReady;
+} BWL_POST_PACKED_STRUCT;
+#include <packed_section_end.h>
+
+typedef struct wlc_ps_debug {
+       uint32 timestamp;            /**< timestamp in millisecond */
+       uint32 ps_mask;              /**< reason(s) for disallowing ps */
+} wlc_ps_debug_t;
+
+typedef struct wl_pmalert_ps_allowed_hist {
+       uint16 type;         /**< WL_PMALERT_PS_ALLOWED_HIST */
+       uint16 len;          /**< Up to 4K-1, top 4 bits are reserved */
+       uint32 ps_allowed_start_idx;
+       /* Array of ps_debug, len of array is based on tlv len */
+       wlc_ps_debug_t ps_debug[1];
+} wl_pmalert_ps_allowed_hist_t;
+
+/* Structures and constants used for "vndr_ie" IOVar interface */
+#define VNDR_IE_CMD_LEN                4       /**< length of the set command string:
+                                        * "add", "del" (+ NUL)
+                                        */
+
+#define VNDR_IE_INFO_HDR_LEN   (sizeof(uint32))
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 pktflag;                 /**< bitmask indicating which packet(s) contain this IE */
+       vndr_ie_t vndr_ie_data;         /**< vendor IE data */
+} BWL_POST_PACKED_STRUCT vndr_ie_info_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       int32 iecount;                  /**< number of entries in the vndr_ie_list[] array */
+       vndr_ie_info_t vndr_ie_list[1]; /**< variable size list of vndr_ie_info_t structs */
+} BWL_POST_PACKED_STRUCT vndr_ie_buf_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       char cmd[VNDR_IE_CMD_LEN];      /**< vndr_ie IOVar set command : "add", "del" + NUL */
+       vndr_ie_buf_t vndr_ie_buffer;   /**< buffer containing Vendor IE list information */
+} BWL_POST_PACKED_STRUCT vndr_ie_setbuf_t;
+#include <packed_section_end.h>
+
+/** tag_ID/length/value_buffer tuple */
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint8   id;
+       uint8   len;
+       uint8   data[1];
+} BWL_POST_PACKED_STRUCT tlv_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 pktflag;                 /**< bitmask indicating which packet(s) contain this IE */
+       tlv_t ie_data;          /**< IE data */
+} BWL_POST_PACKED_STRUCT ie_info_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       int32 iecount;                  /**< number of entries in the ie_list[] array */
+       ie_info_t ie_list[1];   /**< variable size list of ie_info_t structs */
+} BWL_POST_PACKED_STRUCT ie_buf_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       char cmd[VNDR_IE_CMD_LEN];      /**< ie IOVar set command : "add" + NUL */
+       ie_buf_t ie_buffer;     /**< buffer containing IE list information */
+} BWL_POST_PACKED_STRUCT ie_setbuf_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 pktflag;         /**< bitmask indicating which packet(s) contain this IE */
+       uint8 id;               /**< IE type */
+} BWL_POST_PACKED_STRUCT ie_getbuf_t;
+#include <packed_section_end.h>
+
+/* structures used to define format of wps ie data from probe requests */
+/* passed up to applications via iovar "prbreq_wpsie" */
+typedef struct sta_prbreq_wps_ie_hdr {
+       struct ether_addr staAddr;
+       uint16 ieLen;
+} sta_prbreq_wps_ie_hdr_t;
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct sta_prbreq_wps_ie_data {
+       sta_prbreq_wps_ie_hdr_t hdr;
+       uint8 ieData[1];
+} BWL_POST_PACKED_STRUCT sta_prbreq_wps_ie_data_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct sta_prbreq_wps_ie_list {
+       uint32 totLen;
+       uint8 ieDataList[1];
+} BWL_POST_PACKED_STRUCT sta_prbreq_wps_ie_list_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 flags;
+       chanspec_t chanspec;                    /**< txpwr report for this channel */
+       chanspec_t local_chanspec;              /**< channel on which we are associated */
+       uint8 local_max;                        /**< local max according to the AP */
+       uint8 local_constraint;                 /**< local constraint according to the AP */
+       int8  antgain[2];                       /**< Ant gain for each band - from SROM */
+       uint8 rf_cores;                         /**< count of RF Cores being reported */
+       uint8 est_Pout[4];                      /**< Latest tx power out estimate per RF chain */
+       uint8 est_Pout_act[4]; /**< Latest tx power out estimate per RF chain w/o adjustment */
+       uint8 est_Pout_cck;                     /**< Latest CCK tx power out estimate */
+       uint8 tx_power_max[4];                  /**< Maximum target power among all rates */
+       uint32 tx_power_max_rate_ind[4];  /**< Index of the rate with the max target power */
+       int8 sar;                               /**< SAR limit for display by wl executable */
+       int8 channel_bandwidth;         /**< 20, 40 or 80 MHz bandwidth? */
+       uint8 version;                          /**< Version of the data format wlu <--> driver */
+       uint8 display_core;                     /**< Displayed curpower core */
+       int8 target_offsets[4];         /**< Target power offsets for current rate per core */
+       uint32 last_tx_ratespec;        /**< Ratespec for last transmition */
+       uint32 user_target;             /**< user limit */
+       uint32 ppr_len;         /**< length of each ppr serialization buffer */
+       int8 SARLIMIT[MAX_STREAMS_SUPPORTED];
+       uint8  pprdata[1];              /**< ppr serialization buffer */
+} BWL_POST_PACKED_STRUCT tx_pwr_rpt_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 flags;
+       chanspec_t chanspec;                    /**< txpwr report for this channel */
+       chanspec_t local_chanspec;              /**< channel on which we are associated */
+       uint8 local_max;                        /**< local max according to the AP */
+       uint8 local_constraint;                 /**< local constraint according to the AP */
+       int8  pad[2];                           /**< unused */
+       uint8 rf_cores;                         /**< count of RF Cores being reported */
+       uint8 est_Pout[4];                      /**< Latest tx power out estimate per RF chain */
+       uint8 est_Pout_act[4]; /**< Latest tx power out estimate per RF chain w/o adjustment */
+       uint8 est_Pout_cck;                     /**< Latest CCK tx power out estimate */
+       uint8 tx_power_max[4];                  /**< Maximum target power among all rates */
+       uint32 tx_power_max_rate_ind[4];  /**< Index of the rate with the max target power */
+       int8 sar;                               /**< SAR limit for display by wl executable */
+       int8 channel_bandwidth;         /**< 20, 40 or 80 MHz bandwidth? */
+       uint8 version;                          /**< Version of the data format wlu <--> driver */
+       uint8 display_core;                     /**< Displayed curpower core */
+       int8 target_offsets[4];         /**< Target power offsets for current rate per core */
+       uint32 last_tx_ratespec;        /**< Ratespec for last transmition */
+       uint32 user_target;             /**< user limit */
+       uint32 ppr_len;         /**< length of each ppr serialization buffer */
+       int8 SARLIMIT[MAX_STREAMS_SUPPORTED];
+       int8  antgain[3];                       /**< Ant gain for each band - from SROM */
+       uint8  pprdata[1];              /**< ppr serialization buffer */
+} BWL_POST_PACKED_STRUCT tx_pwr_rpt_v2_t;
+#include <packed_section_end.h>
+
+typedef struct tx_pwr_ru_rate_info {
+       uint16 version;
+       uint16 ru_alloc;
+       uint16 mcs;
+       uint16 nss;
+       uint16 num_he_ltf_syms;
+       uint16 ldpc;
+       uint16 gi;
+       uint16 txmode;
+       uint16 dcm;
+       uint16 tx_chain;
+} tx_pwr_ru_rate_info_t;
+
+#define TX_PWR_RU_RATE_INFO_VER                1
+
+/* TLV ID for curpower report, ID < 63 is reserved for ppr module */
+typedef enum tx_pwr_tlv_id {
+       TX_PWR_RPT_RU_RATE_INFO_ID = 64
+} tx_pwr_tlv_id_t;
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       struct ipv4_addr        ipv4_addr;
+       struct ether_addr nexthop;
+} BWL_POST_PACKED_STRUCT ibss_route_entry_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 num_entry;
+       ibss_route_entry_t route_entry[1];
+} BWL_POST_PACKED_STRUCT ibss_route_tbl_t;
+#include <packed_section_end.h>
+
+#define MAX_IBSS_ROUTE_TBL_ENTRY       64
+
+#define TXPWR_TARGET_VERSION  0
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       int32 version;          /**< version number */
+       chanspec_t chanspec;    /**< txpwr report for this channel */
+       int8 txpwr[WL_STA_ANT_MAX]; /**< Max tx target power, in qdb */
+       uint8 rf_cores;         /**< count of RF Cores being reported */
+} BWL_POST_PACKED_STRUCT txpwr_target_max_t;
+#include <packed_section_end.h>
+
+#define BSS_PEER_INFO_PARAM_CUR_VER    0
+/** Input structure for IOV_BSS_PEER_INFO */
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT  struct {
+       uint16                  version;
+       struct  ether_addr ea;  /**< peer MAC address */
+} BWL_POST_PACKED_STRUCT bss_peer_info_param_t;
+#include <packed_section_end.h>
+
+#define BSS_PEER_INFO_CUR_VER          0
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint16                  version;
+       struct ether_addr       ea;
+       int32                   rssi;
+       uint32                  tx_rate;        /**< current tx rate */
+       uint32                  rx_rate;        /**< current rx rate */
+       wl_rateset_t            rateset;        /**< rateset in use */
+       uint32                  age;            /**< age in seconds */
+} BWL_POST_PACKED_STRUCT bss_peer_info_t;
+#include <packed_section_end.h>
+
+#define BSS_PEER_LIST_INFO_CUR_VER     0
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint16                  version;
+       uint16                  bss_peer_info_len;      /**< length of bss_peer_info_t */
+       uint32                  count;                  /**< number of peer info */
+       bss_peer_info_t         peer_info[1];           /**< peer info */
+} BWL_POST_PACKED_STRUCT bss_peer_list_info_t;
+#include <packed_section_end.h>
+
+#define BSS_PEER_LIST_INFO_FIXED_LEN OFFSETOF(bss_peer_list_info_t, peer_info)
+
+#define AIBSS_BCN_FORCE_CONFIG_VER_0   0
+
+/** structure used to configure AIBSS beacon force xmit */
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint16  version;
+       uint16  len;
+       uint32 initial_min_bcn_dur;     /**< dur in ms to check a bcn in bcn_flood period */
+       uint32 min_bcn_dur;     /**< dur in ms to check a bcn after bcn_flood period */
+       uint32 bcn_flood_dur; /**< Initial bcn xmit period in ms */
+} BWL_POST_PACKED_STRUCT aibss_bcn_force_config_t;
+#include <packed_section_end.h>
+
+#define AIBSS_TXFAIL_CONFIG_VER_0    0
+#define AIBSS_TXFAIL_CONFIG_VER_1    1
+#define AIBSS_TXFAIL_CONFIG_CUR_VER            AIBSS_TXFAIL_CONFIG_VER_1
+
+/** structure used to configure aibss tx fail event */
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint16  version;
+       uint16  len;
+       uint32 bcn_timeout;     /**< dur in seconds to receive 1 bcn */
+       uint32 max_tx_retry;     /**< no of consecutive no acks to send txfail event */
+       uint32 max_atim_failure; /**< no of consecutive atim failure */
+} BWL_POST_PACKED_STRUCT aibss_txfail_config_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct wl_aibss_if {
+       uint16 version;
+       uint16 len;
+       uint32 flags;
+       struct ether_addr addr;
+       chanspec_t chspec;
+} BWL_POST_PACKED_STRUCT wl_aibss_if_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct wlc_ipfo_route_entry {
+       struct ipv4_addr ip_addr;
+       struct ether_addr nexthop;
+} BWL_POST_PACKED_STRUCT wlc_ipfo_route_entry_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct wlc_ipfo_route_tbl {
+       uint32 num_entry;
+       wlc_ipfo_route_entry_t route_entry[1];
+} BWL_POST_PACKED_STRUCT wlc_ipfo_route_tbl_t;
+#include <packed_section_end.h>
+
+/* Version of wlc_btc_stats_t structure.
+ * Increment whenever a change is made to wlc_btc_stats_t
+ */
+#define BTCX_STATS_VER_4 4
+typedef struct wlc_btc_stats_v4 {
+       uint16 version; /* version number of struct */
+       uint16 valid; /* Size of this struct */
+       uint32 stats_update_timestamp;  /* tStamp when data is updated. */
+       uint32 btc_status; /* Hybrid/TDM indicator: Bit2:Hybrid, Bit1:TDM,Bit0:CoexEnabled */
+       uint32 bt_req_type_map; /* BT Antenna Req types since last stats sample */
+       uint32 bt_req_cnt; /* #BT antenna requests since last stats sampl */
+       uint32 bt_gnt_cnt; /* #BT antenna grants since last stats sample */
+       uint32 bt_gnt_dur; /* usec BT owns antenna since last stats sample */
+       uint16 bt_abort_cnt; /* #Times WL was preempted due to BT since WL up */
+       uint16 bt_rxf1ovfl_cnt; /* #Time PSNULL retry count exceeded since WL up */
+       uint16 bt_latency_cnt; /* #Time ucode high latency detected since WL up */
+       uint16 bt_succ_pm_protect_cnt; /* successful PM protection */
+       uint16 bt_succ_cts_cnt; /* successful CTS2A protection */
+       uint16 bt_wlan_tx_preempt_cnt; /* WLAN TX Preemption */
+       uint16 bt_wlan_rx_preempt_cnt; /* WLAN RX Preemption */
+       uint16 bt_ap_tx_after_pm_cnt; /* AP TX even after PM protection */
+       uint16 bt_peraud_cumu_gnt_cnt; /* Grant cnt for periodic audio */
+       uint16 bt_peraud_cumu_deny_cnt; /* Deny cnt for periodic audio */
+       uint16 bt_a2dp_cumu_gnt_cnt; /* Grant cnt for A2DP */
+       uint16 bt_a2dp_cumu_deny_cnt; /* Deny cnt for A2DP */
+       uint16 bt_sniff_cumu_gnt_cnt; /* Grant cnt for Sniff */
+       uint16 bt_sniff_cumu_deny_cnt; /* Deny cnt for Sniff */
+       uint16 bt_dcsn_map; /* Accumulated decision bitmap once Ant grant */
+       uint16 bt_dcsn_cnt; /* Accumulated decision bitmap counters once Ant grant */
+       uint16 bt_a2dp_hiwat_cnt; /* Ant grant by a2dp high watermark */
+       uint16 bt_datadelay_cnt; /* Ant grant by acl/a2dp datadelay */
+       uint16 bt_crtpri_cnt; /* Ant grant by critical BT task */
+       uint16 bt_pri_cnt; /* Ant grant by high BT task */
+       uint16 a2dpbuf1cnt;     /* Ant request with a2dp buffercnt 1 */
+       uint16 a2dpbuf2cnt;     /* Ant request with a2dp buffercnt 2 */
+       uint16 a2dpbuf3cnt;     /* Ant request with a2dp buffercnt 3 */
+       uint16 a2dpbuf4cnt;     /* Ant request with a2dp buffercnt 4 */
+       uint16 a2dpbuf5cnt;     /* Ant request with a2dp buffercnt 5 */
+       uint16 a2dpbuf6cnt;     /* Ant request with a2dp buffercnt 6 */
+       uint16 a2dpbuf7cnt;     /* Ant request with a2dp buffercnt 7 */
+       uint16 a2dpbuf8cnt;     /* Ant request with a2dp buffercnt 8 */
+       uint16 antgrant_lt10ms; /* Ant grant duration cnt 0~10ms */
+       uint16 antgrant_lt30ms; /* Ant grant duration cnt 10~30ms */
+       uint16 antgrant_lt60ms; /* Ant grant duration cnt 30~60ms */
+       uint16 antgrant_ge60ms; /* Ant grant duration cnt 60~ms */
+} wlc_btc_stats_v4_t;
+
+#define BTCX_STATS_VER_3 3
+
+typedef struct wlc_btc_stats_v3 {
+       uint16 version; /* version number of struct */
+       uint16 valid; /* Size of this struct */
+       uint32 stats_update_timestamp;  /* tStamp when data is updated. */
+       uint32 btc_status; /* Hybrid/TDM indicator: Bit2:Hybrid, Bit1:TDM,Bit0:CoexEnabled */
+       uint32 bt_req_type_map; /* BT Antenna Req types since last stats sample */
+       uint32 bt_req_cnt; /* #BT antenna requests since last stats sampl */
+       uint32 bt_gnt_cnt; /* #BT antenna grants since last stats sample */
+       uint32 bt_gnt_dur; /* usec BT owns antenna since last stats sample */
+       uint16 bt_abort_cnt; /* #Times WL was preempted due to BT since WL up */
+       uint16 bt_rxf1ovfl_cnt; /* #Time PSNULL retry count exceeded since WL up */
+       uint16 bt_latency_cnt; /* #Time ucode high latency detected since WL up */
+       uint16 rsvd; /* pad to align struct to 32bit bndry       */
+       uint16 bt_succ_pm_protect_cnt; /* successful PM protection */
+       uint16 bt_succ_cts_cnt; /* successful CTS2A protection */
+       uint16 bt_wlan_tx_preempt_cnt; /* WLAN TX Preemption */
+       uint16 bt_wlan_rx_preempt_cnt; /* WLAN RX Preemption */
+       uint16 bt_ap_tx_after_pm_cnt; /* AP TX even after PM protection */
+       uint16 bt_peraud_cumu_gnt_cnt; /* Grant cnt for periodic audio */
+       uint16 bt_peraud_cumu_deny_cnt; /* Deny cnt for periodic audio */
+       uint16 bt_a2dp_cumu_gnt_cnt; /* Grant cnt for A2DP */
+       uint16 bt_a2dp_cumu_deny_cnt; /* Deny cnt for A2DP */
+       uint16 bt_sniff_cumu_gnt_cnt; /* Grant cnt for Sniff */
+       uint16 bt_sniff_cumu_deny_cnt; /* Deny cnt for Sniff */
+       uint8 pad; /* Padding */
+       uint8 slice_index; /* Slice to report */
+} wlc_btc_stats_v3_t;
+
+#define BTCX_STATS_VER_2 2
+
+typedef struct wlc_btc_stats_v2 {
+       uint16 version; /* version number of struct */
+       uint16 valid; /* Size of this struct */
+       uint32 stats_update_timestamp;  /* tStamp when data is updated. */
+       uint32 btc_status; /* Hybrid/TDM indicator: Bit2:Hybrid, Bit1:TDM,Bit0:CoexEnabled */
+       uint32 bt_req_type_map; /* BT Antenna Req types since last stats sample */
+       uint32 bt_req_cnt; /* #BT antenna requests since last stats sampl */
+       uint32 bt_gnt_cnt; /* #BT antenna grants since last stats sample */
+       uint32 bt_gnt_dur; /* usec BT owns antenna since last stats sample */
+       uint16 bt_abort_cnt; /* #Times WL was preempted due to BT since WL up */
+       uint16 bt_rxf1ovfl_cnt; /* #Time PSNULL retry count exceeded since WL up */
+       uint16 bt_latency_cnt; /* #Time ucode high latency detected since WL up */
+       uint16 rsvd; /* pad to align struct to 32bit bndry       */
+} wlc_btc_stats_v2_t;
+
+/* Durations for each bt task in millisecond */
+#define WL_BTCX_DURSTATS_VER_1 (1u)
+typedef struct wlc_btcx_durstats_v1 {
+       uint16 version;                 /* version number of struct */
+       uint16 valid;                   /* validity of this struct */
+       uint32 stats_update_timestamp;  /* tStamp when data is updated */
+       uint16 bt_acl_dur;              /* acl duration in ms */
+       uint16 bt_sco_dur;              /* sco duration in ms */
+       uint16 bt_esco_dur;             /* esco duration in ms */
+       uint16 bt_a2dp_dur;             /* a2dp duration in ms */
+       uint16 bt_sniff_dur;            /* sniff duration in ms */
+       uint16 bt_pscan_dur;            /* page scan duration in ms */
+       uint16 bt_iscan_dur;            /* inquiry scan duration in ms */
+       uint16 bt_page_dur;             /* paging duration in ms */
+       uint16 bt_inquiry_dur;          /* inquiry duration in ms */
+       uint16 bt_mss_dur;              /* mss duration in ms */
+       uint16 bt_park_dur;             /* park duration in ms */
+       uint16 bt_rssiscan_dur;         /* rssiscan duration in ms */
+       uint16 bt_iscan_sco_dur;        /* inquiry scan sco duration in ms */
+       uint16 bt_pscan_sco_dur;        /* page scan sco duration in ms */
+       uint16 bt_tpoll_dur;            /* tpoll duration in ms */
+       uint16 bt_sacq_dur;             /* sacq duration in ms */
+       uint16 bt_sdata_dur;            /* sdata duration in ms */
+       uint16 bt_rs_listen_dur;        /* rs listen duration in ms */
+       uint16 bt_rs_burst_dur;         /* rs brust duration in ms */
+       uint16 bt_ble_adv_dur;          /* ble adv duration in ms */
+       uint16 bt_ble_scan_dur;         /* ble scan duration in ms */
+       uint16 bt_ble_init_dur;         /* ble init duration in ms */
+       uint16 bt_ble_conn_dur;         /* ble connection duration in ms */
+       uint16 bt_task_lmp_dur;         /* lmp duration in ms */
+       uint16 bt_esco_retran_dur;      /* esco retransmission duration in ms */
+       uint16 bt_task26_dur;           /* task26 duration in ms */
+       uint16 bt_task27_dur;           /* task27 duration in ms */
+       uint16 bt_task28_dur;           /* task28 duration in ms */
+       uint16 bt_task_pred_dur;        /* prediction task duration in ms */
+       uint16 bt_multihid_dur;         /* multihid duration in ms */
+} wlc_btcx_durstats_v1_t;
+
+#define WL_IPFO_ROUTE_TBL_FIXED_LEN 4
+#define WL_MAX_IPFO_ROUTE_TBL_ENTRY    64
+
+       /* Global ASSERT Logging */
+#define ASSERTLOG_CUR_VER      0x0100
+#define MAX_ASSRTSTR_LEN       64
+
+       typedef struct assert_record {
+               uint32 time;
+               uint8 seq_num;
+               int8 str[MAX_ASSRTSTR_LEN];
+       } assert_record_t;
+
+       typedef struct assertlog_results {
+               uint16 version;
+               uint16 record_len;
+               uint32 num;
+               assert_record_t logs[1];
+       } assertlog_results_t;
+
+#define LOGRRC_FIX_LEN 8
+#define IOBUF_ALLOWED_NUM_OF_LOGREC(type, len) ((len - LOGRRC_FIX_LEN)/sizeof(type))
+/* BCMWAPI_WAI */
+#define IV_LEN 16 /* same as SMS4_WPI_PN_LEN */
+       struct wapi_sta_msg_t
+       {
+               uint16  msg_type;
+               uint16  datalen;
+               uint8   vap_mac[6];
+               uint8   reserve_data1[2];
+               uint8   sta_mac[6];
+               uint8   reserve_data2[2];
+               uint8   gsn[IV_LEN];
+               uint8   wie[TLV_BODY_LEN_MAX + TLV_HDR_LEN]; /* 257 */
+               uint8   pad[3]; /* padding for alignment */
+       };
+/* #endif BCMWAPI_WAI */
+       /* chanim acs record */
+       typedef struct {
+               uint8 valid;
+               uint8 trigger;
+               chanspec_t selected_chspc;
+               int8 bgnoise;
+               uint32 glitch_cnt;
+               uint8 ccastats;
+               uint8 chan_idle;
+               uint32 timestamp;
+       } chanim_acs_record_t;
+
+       typedef struct {
+               chanim_acs_record_t acs_record[CHANIM_ACS_RECORD];
+               uint8 count;
+               uint32 timestamp;
+       } wl_acs_record_t;
+
+#define WL_CHANIM_STATS_V2 2
+#define CCASTATS_V2_MAX 9
+typedef struct chanim_stats_v2 {
+       uint32 glitchcnt;               /**< normalized as per second count */
+       uint32 badplcp;                 /**< normalized as per second count */
+       uint8 ccastats[CCASTATS_V2_MAX];   /**< normalized as 0-255 */
+       int8 bgnoise;                   /**< background noise level (in dBm) */
+       chanspec_t chanspec;            /**< ctrl chanspec of the interface */
+       uint32 timestamp;               /**< time stamp at which the stats are collected */
+       uint32 bphy_glitchcnt;          /**< normalized as per second count */
+       uint32 bphy_badplcp;            /**< normalized as per second count */
+       uint8 chan_idle;                /**< normalized as 0~255 */
+       uint8 PAD[3];
+} chanim_stats_v2_t;
+
+typedef struct chanim_stats {
+       uint32 glitchcnt;               /**< normalized as per second count */
+       uint32 badplcp;                 /**< normalized as per second count */
+       uint8 ccastats[CCASTATS_MAX];   /**< normalized as 0-255 */
+       int8 bgnoise;                   /**< background noise level (in dBm) */
+       uint8 pad_1[11 - CCASTATS_MAX];
+       chanspec_t chanspec;            /**< ctrl chanspec of the interface */
+       uint8 pad_2[2];
+       uint32 timestamp;               /**< time stamp at which the stats are collected */
+       uint32 bphy_glitchcnt;          /**< normalized as per second count */
+       uint32 bphy_badplcp;            /**< normalized as per second count */
+       uint8 chan_idle;                /**< normalized as 0~255 */
+       uint8 PAD[3];
+} chanim_stats_t;
+
+#define WL_CHANIM_STATS_VERSION 3
+typedef struct {
+       uint32 buflen;
+       uint32 version;
+       uint32 count;
+       chanim_stats_t stats[1];
+} wl_chanim_stats_t;
+
+#define WL_SC_CHANIM_STATS_V1   1u
+/* sc chanim interface stats */
+typedef struct sc_chanim_stats_v1 {
+       uint32 stats_ms;                /* duraion for which stats are collected, in ms */
+       chanspec_t chanspec;
+       uint16 PAD;
+       uint32 sc_only_rx_dur;          /* rx only on sc, in ms */
+       uint32 sc_rx_mc_rx_dur;         /* Rx on SC when MC is active, in ms */
+       uint32 sc_rx_ac_rx_dur;         /* Rx on SC when AC is active, in ms */
+       uint32 sc_rx_mc_tx_dur;         /* sc rx with MC tx, in ms */
+       uint32 sc_rx_ac_bt_tx_dur;      /* sc rx with AC-BT tx, in ms */
+       uint32 sc_rx_bt_rx_dur;         /* sc rx when BT Main is active, in ms */
+       uint32 sc_rx_btsc_rx_dur;       /* BT sc and wlan SC rx is active, in ms */
+} sc_chanim_stats_v1_t;
+
+typedef struct {
+       uint32 version;
+       uint32 length;
+       uint8 flags;    /* flags: to print the stats,
+                        * WL_CHANIM_COUNT_ONE ==> Query stats for Home channel,
+                        * WL_CHANIM_COUNT_ALL ==> Query stats for all channels
+                        */
+       uint8 id;       /* Module id, to know which module has sent the stats
+                        * SC_CHANIM_ID_SCAN ==> For SCAN
+                        * SC_CHANIM_ID_STA ==> For STA
+                        */
+       uint8 count;    /* o/p: Count of channels for which stats needs to be displayed.
+                        * This value is number of channels supported in particular locale when
+                        * flags is WL_CHANIM_COUNT_ALL, one when flag is
+                        * WL_CHANIM_COUNT_ONE
+                        */
+       uint8 PAD;
+       sc_chanim_stats_v1_t sc_stats[1];
+} wl_chanim_sc_stats_v1_t;
+
+/* WL_CHANIM_SC_STATS_FIXED_LEN: when we change size of any field above sc_stats, this macro
+ * needs versioning. At present it uses offset of v1, which is same for all versions so far
+ */
+#define WL_CHANIM_SC_STATS_FIXED_LEN OFFSETOF(wl_chanim_sc_stats_v1_t, sc_stats)
+#define WL_CHANIM_STATS_FIXED_LEN OFFSETOF(wl_chanim_stats_t, stats)
+
+#define WL_SC_CHANIM_STATS_V2   2u
+/* sc chanim interface stats */
+typedef struct sc_chanim_stats_v2 {
+       uint32 stats_ms;                /* duraion for which stats are collected, in ms */
+       chanspec_t chanspec;
+       uint16 PAD;
+       uint32 sc_only_rx_dur;          /* rx only on sc, in ms */
+       uint32 sc_rx_mc_rx_dur;         /* Rx on SC when MC is active, in ms */
+       uint32 sc_rx_ac_rx_dur;         /* Rx on SC when AC is active, in ms */
+       uint32 sc_rx_mc_tx_dur;         /* sc rx with MC tx, in ms */
+       uint32 sc_rx_ac_bt_tx_dur;      /* sc rx with AC-BT tx, in ms */
+       uint32 sc_rx_bt_rx_dur;         /* sc rx when BT Main is active, in ms */
+       uint32 sc_btle_overlap_dur;     /* wlsc was awake and btsc le scan overlapped, in ms */
+       uint32 sc_btpage_overlap_dur;   /* wlsc was awake and btsc page scan overlapped, in ms */
+       uint32 sc_btle_blnk_dur;        /* wlauxtx blanked btsc le scan, in ms */
+       uint32 sc_btpage_blnk_dur;      /* wlauxtx blanked btsc page scan, in ms */
+} sc_chanim_stats_v2_t;
+
+typedef struct {
+       uint32 version;
+       uint32 length;
+       uint8 flags;    /* flags: to print the stats,
+                        * WL_CHANIM_COUNT_ONE ==> Query stats for Home channel,
+                        * WL_CHANIM_COUNT_ALL ==> Query stats for all channels
+                        */
+       uint8 id;       /* Module id, to know which module has sent the stats
+                        * SC_CHANIM_ID_SCAN ==> For SCAN
+                        * SC_CHANIM_ID_STA ==> For STA
+                        */
+       uint8 count;    /* o/p: Count of channels for which stats needs to be displayed.
+                        * This value is number of channels supported in particular locale when
+                        * flags is WL_CHANIM_COUNT_ALL, one when flag is
+                        * WL_CHANIM_COUNT_ONE
+                        */
+       uint8 PAD;
+       sc_chanim_stats_v2_t sc_stats[1];
+} wl_chanim_sc_stats_v2_t;
+
+#define WL_SC_CHANIM_STATS_V3   3u
+/* sc chanim interface stats */
+typedef struct sc_chanim_stats_v3 {
+       uint32 stats_ms;                /* duraion for which stats are collected, in ms */
+       chanspec_t chanspec;
+       uint16 PAD;
+       uint32 sc_only_rx_dur;          /* rx only on sc, in ms */
+       uint32 sc_rx_mc_rx_dur;         /* Rx on SC when MC is active, in ms */
+       uint32 sc_rx_ac_rx_dur;         /* Rx on SC when AC is active, in ms */
+       uint32 sc_rx_mc_tx_dur;         /* sc rx with MC tx, in ms */
+       uint32 sc_rx_ac_bt_tx_dur;      /* sc rx with AC-BT tx, in ms */
+       uint32 sc_rx_bt_rx_dur;         /* sc rx when BT Main is active, in ms */
+       uint32 sc_btle_overlap_dur;     /* wlsc was awake and btsc le scan overlapped, in ms */
+       uint32 sc_btpage_overlap_dur;   /* wlsc was awake and btsc page scan overlapped, in ms */
+       uint32 sc_btle_blnk_dur;        /* wlauxtx blanked btsc le scan, in ms */
+       uint32 sc_btpage_blnk_dur;      /* wlauxtx blanked btsc page scan, in ms */
+       uint32 ac_btle_overlap_dur;     /* wlaux was awake and btsc le scan overlapped, in ms */
+       uint32 ac_btpage_overlap_dur;   /* wlaux was awake and btsc page scan overlapped, in ms */
+} sc_chanim_stats_v3_t;
+
+typedef struct {
+       uint32 version;
+       uint32 length;
+       uint8 flags;    /* flags: to print the stats,
+                        * WL_CHANIM_COUNT_ONE ==> Query stats for Home channel,
+                        * WL_CHANIM_COUNT_ALL ==> Query stats for all channels
+                        */
+       uint8 id;       /* Module id, to know which module has sent the stats
+                        * SC_CHANIM_ID_SCAN ==> For SCAN
+                        * SC_CHANIM_ID_STA ==> For STA
+                        */
+       uint8 count;    /* o/p: Count of channels for which stats needs to be displayed.
+                        * This value is number of channels supported in particular locale when
+                        * flags is WL_CHANIM_COUNT_ALL, one when flag is
+                        * WL_CHANIM_COUNT_ONE
+                        */
+       uint8 PAD;
+       sc_chanim_stats_v3_t sc_stats[1];
+} wl_chanim_sc_stats_v3_t;
+
+/* sc_chanim periodic ecounters structs for WL_IFSTATS_XTLV_SC_CHANIM_PERIODIC_STATS
+ *  [similar to wl_chanim_sc_stats_vX_t, but constrained in size due to its known periodicity
+ *  of reporting]
+ */
+#define WLC_SC_CHANIM_PERIODIC_STATS_V2        (2u)
+#define WLC_SC_STATS_MAX_BANDS_V1      2u
+
+typedef struct sc_chanim_stats_perband_periodic_v2 {
+       uint8   pad[3];
+       uint8   band_id;                /* band for which stats reported; 0:5G,1:2G */
+       uint16  sc_only_rx_dur;         /* rx only on sc, in ms */
+       uint16  sc_rx_mc_rx_dur;        /* Rx on SC when MC is active, in ms */
+       uint16  sc_rx_ac_rx_dur;        /* Rx on SC when AC is active, in ms */
+       uint16  sc_rx_mc_tx_dur;        /* sc rx with MC tx, in ms */
+       uint16  sc_rx_ac_bt_tx_dur;     /* sc rx with AC-BT tx, in ms */
+       uint16  sc_rx_bt_rx_dur;        /* sc rx when BT Main is active, in ms */
+       uint16  sc_btle_overlap_dur;    /* wlsc was awake and btsc le scan overlapped, in ms */
+       uint16  sc_btpage_overlap_dur;  /* wlsc was awake and btsc page scan overlapped, in ms */
+       uint16  sc_btle_blnk_dur;       /* wlauxtx blanked btsc le scan, in ms */
+       uint16  sc_btpage_blnk_dur;     /* wlauxtx blanked btsc page scan, in ms */
+} sc_chanim_stats_perband_periodic_v2_t;
+
+typedef struct wl_chanim_sc_periodic_stats_v2 {
+       uint16  ver;
+       uint16  len;
+       uint8   pad[3];
+       uint8   count;  /* number of sc_stats below */
+       /* per band accum stats */
+       sc_chanim_stats_perband_periodic_v2_t sc_stats[WLC_SC_STATS_MAX_BANDS_V1];
+} wl_chanim_sc_periodic_stats_v2_t;
+
+#define WLC_SC_CHANIM_PERIODIC_STATS_V3        (3u)
+
+typedef struct sc_chanim_stats_perband_periodic_v3 {
+       uint8   pad[3];
+       uint8   band_id;                /* band for which stats reported; 0:5G,1:2G */
+       uint16  sc_only_rx_dur;         /* rx only on sc, in ms */
+       uint16  sc_rx_mc_rx_dur;        /* Rx on SC when MC is active, in ms */
+       uint16  sc_rx_ac_rx_dur;        /* Rx on SC when AC is active, in ms */
+       uint16  sc_rx_mc_tx_dur;        /* sc rx with MC tx, in ms */
+       uint16  sc_rx_ac_bt_tx_dur;     /* sc rx with AC-BT tx, in ms */
+       uint16  sc_rx_bt_rx_dur;        /* sc rx when BT Main is active, in ms */
+       uint16  sc_btle_overlap_dur;    /* wlsc was awake and btsc le scan overlapped, in ms */
+       uint16  sc_btpage_overlap_dur;  /* wlsc was awake and btsc page scan overlapped, in ms */
+       uint16  sc_btle_blnk_dur;       /* wlauxtx blanked btsc le scan, in ms */
+       uint16  sc_btpage_blnk_dur;     /* wlauxtx blanked btsc page scan, in ms */
+       uint16  ac_btle_overlap_dur;    /* wlaux was awake and btsc le scan overlapped, in ms */
+       uint16  ac_btpage_overlap_dur;  /* wlaux was awake and btsc page scan overlapped, in ms */
+} sc_chanim_stats_perband_periodic_v3_t;
+
+typedef struct wl_chanim_sc_periodic_stats_v3 {
+       uint16  ver;
+       uint16  len;
+       uint8   pad[3];
+       uint8   count;  /* number of sc_stats below */
+       /* per band accum stats */
+       sc_chanim_stats_perband_periodic_v3_t sc_stats[WLC_SC_STATS_MAX_BANDS_V1];
+} wl_chanim_sc_periodic_stats_v3_t;
+
+/** Noise measurement metrics. */
+#define NOISE_MEASURE_KNOISE   0x1
+
+/** scb probe parameter */
+typedef struct {
+       uint32 scb_timeout;
+       uint32 scb_activity_time;
+       uint32 scb_max_probe;
+} wl_scb_probe_t;
+
+/* structure/defines for selective mgmt frame (smf) stats support */
+
+#define SMFS_VERSION 1
+/** selected mgmt frame (smf) stats element */
+typedef struct wl_smfs_elem {
+       uint32 count;
+       uint16 code;  /**< SC or RC code */
+       uint8 PAD[2];
+} wl_smfs_elem_t;
+
+typedef struct wl_smf_stats {
+       uint32 version;
+       uint16 length;  /**< reserved for future usage */
+       uint8 type;
+       uint8 codetype;
+       uint32 ignored_cnt;
+       uint32 malformed_cnt;
+       uint32 count_total; /**< count included the interested group */
+       wl_smfs_elem_t elem[1];
+} wl_smf_stats_t;
+
+#define WL_SMFSTATS_FIXED_LEN OFFSETOF(wl_smf_stats_t, elem);
+
+enum {
+       SMFS_CODETYPE_SC,
+       SMFS_CODETYPE_RC
+};
+
+typedef enum smfs_type {
+       SMFS_TYPE_AUTH,
+       SMFS_TYPE_ASSOC,
+       SMFS_TYPE_REASSOC,
+       SMFS_TYPE_DISASSOC_TX,
+       SMFS_TYPE_DISASSOC_RX,
+       SMFS_TYPE_DEAUTH_TX,
+       SMFS_TYPE_DEAUTH_RX,
+       SMFS_TYPE_MAX
+} smfs_type_t;
+
+/* #ifdef PHYMON */
+
+#define PHYMON_VERSION 1
+
+typedef struct wl_phycal_core_state {
+       /* Tx IQ/LO calibration coeffs */
+       int16 tx_iqlocal_a;
+       int16 tx_iqlocal_b;
+       int8 tx_iqlocal_ci;
+       int8 tx_iqlocal_cq;
+       int8 tx_iqlocal_di;
+       int8 tx_iqlocal_dq;
+       int8 tx_iqlocal_ei;
+       int8 tx_iqlocal_eq;
+       int8 tx_iqlocal_fi;
+       int8 tx_iqlocal_fq;
+
+       /** Rx IQ calibration coeffs */
+       int16 rx_iqcal_a;
+       int16 rx_iqcal_b;
+
+       uint8 tx_iqlocal_pwridx; /**< Tx Power Index for Tx IQ/LO calibration */
+       uint8 PAD[3];
+       uint32 papd_epsilon_table[64]; /**< PAPD epsilon table */
+       int16 papd_epsilon_offset; /**< PAPD epsilon offset */
+       uint8 curr_tx_pwrindex; /**< Tx power index */
+       int8 idle_tssi; /**< Idle TSSI */
+       int8 est_tx_pwr; /**< Estimated Tx Power (dB) */
+       int8 est_rx_pwr; /**< Estimated Rx Power (dB) from RSSI */
+       uint16 rx_gaininfo; /**< Rx gain applied on last Rx pkt */
+       uint16 init_gaincode; /**< initgain required for ACI */
+       int8 estirr_tx;
+       int8 estirr_rx;
+} wl_phycal_core_state_t;
+
+typedef struct wl_phycal_state {
+       int32 version;
+       int8 num_phy_cores; /**< number of cores */
+       int8 curr_temperature; /**< on-chip temperature sensor reading */
+       chanspec_t chspec; /**< channspec for this state */
+       uint8 aci_state; /**< ACI state: ON/OFF */
+       uint8 PAD;
+       uint16 crsminpower; /**< crsminpower required for ACI */
+       uint16 crsminpowerl; /**< crsminpowerl required for ACI */
+       uint16 crsminpoweru; /**< crsminpoweru required for ACI */
+       wl_phycal_core_state_t phycal_core[1];
+} wl_phycal_state_t;
+
+#define WL_PHYCAL_STAT_FIXED_LEN OFFSETOF(wl_phycal_state_t, phycal_core)
+/* endif PHYMON */
+
+/** discovery state */
+typedef struct wl_p2p_disc_st {
+       uint8 state;    /**< see state */
+       uint8 PAD;
+       chanspec_t chspec;      /**< valid in listen state */
+       uint16 dwell;   /**< valid in listen state, in ms */
+} wl_p2p_disc_st_t;
+
+/** scan request */
+typedef struct wl_p2p_scan {
+       uint8 type;             /**< 'S' for WLC_SCAN, 'E' for "escan" */
+       uint8 reserved[3];
+       /* scan or escan parms... */
+} wl_p2p_scan_t;
+
+/** i/f request */
+typedef struct wl_p2p_if {
+       struct ether_addr addr;
+       uint8 type;     /**< see i/f type */
+       uint8 PAD;
+       chanspec_t chspec;      /**< for p2p_ifadd GO */
+} wl_p2p_if_t;
+
+/** i/f query */
+typedef struct wl_p2p_ifq {
+       uint32 bsscfgidx;
+       char ifname[BCM_MSG_IFNAME_MAX];
+} wl_p2p_ifq_t;
+
+/** OppPS & CTWindow */
+typedef struct wl_p2p_ops {
+       uint8 ops;      /**< 0: disable 1: enable */
+       uint8 ctw;      /**< >= 10 */
+} wl_p2p_ops_t;
+
+/** absence and presence request */
+typedef struct wl_p2p_sched_desc {
+       uint32 start;
+       uint32 interval;
+       uint32 duration;
+       uint32 count;   /**< see count */
+} wl_p2p_sched_desc_t;
+
+typedef struct wl_p2p_sched {
+       uint8 type;     /**< see schedule type */
+       uint8 action;   /**< see schedule action */
+       uint8 option;   /**< see schedule option */
+       uint8 PAD;
+       wl_p2p_sched_desc_t desc[1];
+} wl_p2p_sched_t;
+
+typedef struct wl_p2p_wfds_hash {
+       uint32  advt_id;
+       uint16  nw_cfg_method;
+       uint8   wfds_hash[6];
+       uint8   name_len;
+       uint8   service_name[MAX_WFDS_SVC_NAME_LEN];
+       uint8   PAD[3];
+} wl_p2p_wfds_hash_t;
+
+typedef struct wl_p2p_config_params {
+       uint16          enable;                 /**< 0: disable 1: enable */
+       uint16          chanspec;               /* GO chanspec */
+       wlc_ssid_t      ssid;                   /* SSID */
+} wl_p2p_config_params_t;
+
+typedef struct wl_bcmdcs_data {
+       uint32 reason;
+       chanspec_t chspec;
+       uint8   PAD[2];
+} wl_bcmdcs_data_t;
+/* ifdef EXT_STA */
+/**
+ * Format of IHV data passed to OID_DOT11_NIC_SPECIFIC_EXTENSION.
+ */
+typedef struct _IHV_NIC_SPECIFIC_EXTENSION {
+       uint8                   oui[4];     /**< vendor specific OUI value */
+       uint32                  event;      /**< event code */
+       uint8                   ihvData[1];    /**< ihv data */
+} IHV_NIC_SPECIFIC_EXTENSION, *PIHV_NIC_SPECIFIC_EXTENSION;
+#define IHV_NIC_SPECIFIC_EXTENTION_HEADER      OFFSETOF(IHV_NIC_SPECIFIC_EXTENSION, ihvData[0])
+/* EXT_STA */
+/** NAT configuration */
+typedef struct {
+       uint32 ipaddr;          /**< interface ip address */
+       uint32 ipaddr_mask;     /**< interface ip address mask */
+       uint32 ipaddr_gateway;  /**< gateway ip address */
+       uint8 mac_gateway[6];   /**< gateway mac address */
+       uint8   PAD[2];
+       uint32 ipaddr_dns;      /**< DNS server ip address, valid only for public if */
+       uint8 mac_dns[6];       /**< DNS server mac address,  valid only for public if */
+       uint8 GUID[38];         /**< interface GUID */
+} nat_if_info_t;
+
+typedef struct {
+       uint32 op;              /**< operation code */
+       uint8 pub_if;           /**< set for public if, clear for private if */
+       uint8   PAD[3];
+       nat_if_info_t if_info;  /**< interface info */
+} nat_cfg_t;
+
+typedef struct {
+       int32 state;    /**< NAT state returned */
+} nat_state_t;
+
+typedef struct flush_txfifo {
+       uint32 txfifobmp;
+       uint32 hwtxfifoflush;
+       struct ether_addr ea;
+       uint8   PAD[2];
+} flush_txfifo_t;
+
+enum {
+       SPATIAL_MODE_2G_IDX = 0,
+       SPATIAL_MODE_5G_LOW_IDX,
+       SPATIAL_MODE_5G_MID_IDX,
+       SPATIAL_MODE_5G_HIGH_IDX,
+       SPATIAL_MODE_5G_UPPER_IDX,
+       SPATIAL_MODE_MAX_IDX
+};
+
+#define WLC_TXCORE_MAX         4       /**< max number of txcore supports */
+#define WLC_TXCORE_MAX_OLD     2       /**< backward compatibilty for TXCAL */
+#define WLC_SUBBAND_MAX                4       /**< max number of sub-band supports */
+typedef struct {
+       uint8   band2g[WLC_TXCORE_MAX];
+       uint8   band5g[WLC_SUBBAND_MAX][WLC_TXCORE_MAX];
+} sar_limit_t;
+
+#define MAX_NUM_TXCAL_MEAS 128
+#define MAX_NUM_PWR_STEP 40
+#define TXCAL_IOVAR_VERSION    0x1
+
+#define TXCAL_GAINSWEEP_VER (TXCAL_GAINSWEEP_VERSION_V2)
+#define TXCAL_GAINSWEEP_VERSION_V2 2
+
+/* Below macro defines the latest txcal iovar version updated */
+/* This macro also reflects in the 'txcal_ver' iovar */
+#define TXCAL_IOVAR_LATEST TXCAL_GAINSWEEP_VER
+
+/* below are used for bphy/ofdm separated LSC */
+#define TXCAL_PWR_BPHY    0
+#define TXCAL_PWR_OFDM    1
+
+typedef struct wl_txcal_meas_percore {
+       uint16 tssi[MAX_NUM_TXCAL_MEAS];
+       int16 pwr[MAX_NUM_TXCAL_MEAS];
+} wl_txcal_meas_percore_t;
+
+typedef struct wl_txcal_meas_ncore {
+       uint16 version;
+       uint8 valid_cnt;
+       uint8 num_core;
+       wl_txcal_meas_percore_t txcal_percore[1];
+} wl_txcal_meas_ncore_t;
+
+typedef struct wl_txcal_power_tssi_percore {
+       int16 tempsense;
+       int16 pwr_start;
+       uint8 pwr_start_idx;
+       uint8 num_entries;
+       uint16 pad;
+       uint8 tssi[MAX_NUM_PWR_STEP];
+} wl_txcal_power_tssi_percore_t;
+
+typedef struct wl_txcal_power_tssi_ncore {
+       uint16 version;
+       uint8 set_core;
+       uint8 channel;
+       uint8 num_core;
+       uint8 gen_tbl;
+       uint8 ofdm;
+       uint8 pad;
+       wl_txcal_power_tssi_percore_t tssi_percore[4];
+} wl_txcal_power_tssi_ncore_t;
+
+typedef struct wl_txcal_meas {
+       uint16 tssi[WLC_TXCORE_MAX][MAX_NUM_TXCAL_MEAS];
+       int16 pwr[WLC_TXCORE_MAX][MAX_NUM_TXCAL_MEAS];
+       uint8 valid_cnt;
+       uint8 PAD;
+} wl_txcal_meas_t;
+
+typedef struct wl_txcal_meas_old {
+       uint16 tssi[WLC_TXCORE_MAX_OLD][MAX_NUM_TXCAL_MEAS];
+       int16 pwr[WLC_TXCORE_MAX_OLD][MAX_NUM_TXCAL_MEAS];
+       uint8 valid_cnt;
+       uint8 PAD;
+} wl_txcal_meas_old_t;
+
+typedef struct wl_txcal_power_tssi {
+       uint8 set_core;
+       uint8 channel;
+       int16 tempsense[WLC_TXCORE_MAX];
+       int16 pwr_start[WLC_TXCORE_MAX];
+       uint8 pwr_start_idx[WLC_TXCORE_MAX];
+       uint8 num_entries[WLC_TXCORE_MAX];
+       uint8 tssi[WLC_TXCORE_MAX][MAX_NUM_PWR_STEP];
+       uint8 gen_tbl;
+       uint8 ofdm;
+} wl_txcal_power_tssi_t;
+
+typedef struct wl_txcal_power_tssi_old {
+       uint8 set_core;
+       uint8 channel;
+       int16 tempsense[WLC_TXCORE_MAX_OLD];
+       int16 pwr_start[WLC_TXCORE_MAX_OLD];
+       uint8 pwr_start_idx[WLC_TXCORE_MAX_OLD];
+       uint8 num_entries[WLC_TXCORE_MAX_OLD];
+       uint8 tssi[WLC_TXCORE_MAX_OLD][MAX_NUM_PWR_STEP];
+       uint8 gen_tbl;
+       uint8 ofdm;
+} wl_txcal_power_tssi_old_t;
+
+typedef struct wl_olpc_pwr {
+       uint16 version;
+       uint8 core;
+       uint8 channel;
+       int16 tempsense;
+       uint8 olpc_idx;
+       uint8 ofdm;
+} wl_olpc_pwr_t;
+
+typedef struct wl_rfem_temp_vdet_temp {
+       uint8   vdet_fem_t1;
+       int8    rfem_temp_t1;
+       uint8   vdet_fem_t2;
+       int8    rfem_temp_t2;
+} wl_rfem_temp_vdet_temp_t;
+
+typedef struct wl_rfem_temp_vin_tssi {
+       uint16  vin_chip_v1;
+       int16   tssi_chip_v1;
+       uint16  vin_chip_v2;
+       int16   tssi_chip_v2;
+} wl_rfem_temp_vin_tssi_t;
+
+typedef struct wl_txcal_tempsense {
+       uint16 version;
+       uint8 valid_cnt;
+       uint8 core;
+       int16 ref_temperature;
+       int16 meas_temperature;
+       wl_rfem_temp_vdet_temp_t vdet_temp;
+       wl_rfem_temp_vin_tssi_t vin_tssi;
+} wl_txcal_tempsense_t;
+
+/** IOVAR "mempool" parameter. Used to retrieve a list of memory pool statistics. */
+typedef struct wl_mempool_stats {
+       int32 num;              /**< Number of memory pools */
+       bcm_mp_stats_t s[1];    /**< Variable array of memory pool stats. */
+} wl_mempool_stats_t;
+
+typedef struct {
+       uint32 ipaddr;
+       uint32 ipaddr_netmask;
+       uint32 ipaddr_gateway;
+} nwoe_ifconfig_t;
+
+/* Both powersel_params and lpc_params are used by IOVAR lpc_params.
+ * The powersel_params is replaced by lpc_params in later WLC versions.
+ */
+typedef struct powersel_params {
+       /* LPC Params exposed via IOVAR */
+       int32           tp_ratio_thresh;  /**< Throughput ratio threshold */
+       uint8           rate_stab_thresh; /**< Thresh for rate stability based on nupd */
+       uint8           pwr_stab_thresh; /**< Number of successes before power step down */
+       uint8           pwr_sel_exp_time; /**< Time lapse for expiry of database */
+       uint8           PAD;
+} powersel_params_t;
+
+#define WL_LPC_PARAMS_VER_2    2
+#define WL_LPC_PARAMS_CURRENT_VERSION WL_LPC_PARAMS_VER_2
+
+typedef struct lpc_params {
+       uint16          version;
+       uint16          length;
+       /* LPC Params exposed via IOVAR */
+       uint8           rate_stab_thresh; /**< Thresh for rate stability based on nupd */
+       uint8           pwr_stab_thresh; /**< Number of successes before power step down */
+       uint8           lpc_exp_time; /**< Time lapse for expiry of database */
+       uint8           pwrup_slow_step; /**< Step size for slow step up */
+       uint8           pwrup_fast_step; /**< Step size for fast step up */
+       uint8           pwrdn_slow_step; /**< Step size for slow step down */
+} lpc_params_t;
+
+/* tx pkt delay statistics */
+#define        SCB_RETRY_SHORT_DEF     7       /**< Default Short retry Limit */
+#define WLPKTDLY_HIST_NBINS    16      /**< number of bins used in the Delay histogram */
+
+/** structure to store per-AC delay statistics */
+typedef struct scb_delay_stats {
+       uint32 txmpdu_lost;     /**< number of MPDUs lost */
+       uint32 txmpdu_cnt[SCB_RETRY_SHORT_DEF]; /**< retry times histogram */
+       uint32 delay_sum[SCB_RETRY_SHORT_DEF]; /**< cumulative packet latency */
+       uint32 delay_min;       /**< minimum packet latency observed */
+       uint32 delay_max;       /**< maximum packet latency observed */
+       uint32 delay_avg;       /**< packet latency average */
+       uint32 delay_hist[WLPKTDLY_HIST_NBINS]; /**< delay histogram */
+       uint32 delay_count;     /**< minimum number of time period units before
+                               consequent packet delay events can be generated
+                               */
+       uint32 prev_txmpdu_cnt; /**< Previous value of txmpdu_cnt[] during last iteration */
+       uint32 prev_delay_sum;  /**< Previous value of delay_sum[] during last iteration */
+} scb_delay_stats_t;
+
+/** structure for txdelay event */
+typedef struct txdelay_event {
+       uint8                           status;
+       uint8                           PAD[3];
+       int32                           rssi;
+       chanim_stats_t          chanim_stats;
+       scb_delay_stats_t       delay_stats[AC_COUNT];
+} txdelay_event_t;
+
+/** structure for txdelay parameters */
+typedef struct txdelay_params {
+       uint16  ratio;  /**< Avg Txdelay Delta */
+       uint8   cnt;    /**< Sample cnt */
+       uint8   period; /**< Sample period */
+       uint8   tune;   /**< Debug */
+       uint8   PAD;
+} txdelay_params_t;
+#define MAX_TXDELAY_STATS_SCBS 6
+#define TXDELAY_STATS_VERSION 1
+
+enum {
+       TXDELAY_STATS_PARTIAL_RESULT = 0,
+       TXDELAY_STATS_FULL_RESULT = 1
+};
+
+typedef struct scb_total_delay_stats {
+       struct  ether_addr ea;
+       uint8   pad[2];
+       scb_delay_stats_t dlystats[AC_COUNT];
+} scb_total_delay_stats_t;
+
+typedef struct txdelay_stats {
+       uint32  version;
+       uint32  full_result;    /* 0:Partial, 1:full */
+       uint32  scb_cnt;        /* in:requested, out:returned */
+       scb_total_delay_stats_t scb_delay_stats[1];
+} txdelay_stats_t;
+
+#define WL_TXDELAY_STATS_FIXED_SIZE \
+       (sizeof(txdelay_stats_t)+(MAX_TXDELAY_STATS_SCBS-1)*sizeof(scb_total_delay_stats_t))
+enum {
+       WNM_SERVICE_DMS = 1,
+       WNM_SERVICE_FMS = 2,
+       WNM_SERVICE_TFS = 3
+};
+
+/** Definitions for WNM/NPS TCLAS */
+typedef struct wl_tclas {
+       uint8 user_priority;
+       uint8 fc_len;
+       dot11_tclas_fc_t fc;
+} wl_tclas_t;
+
+#define WL_TCLAS_FIXED_SIZE    OFFSETOF(wl_tclas_t, fc)
+
+typedef struct wl_tclas_list {
+       uint32 num;
+       wl_tclas_t tclas[];
+} wl_tclas_list_t;
+
+/** Definitions for WNM/NPS Traffic Filter Service */
+typedef struct wl_tfs_req {
+       uint8 tfs_id;
+       uint8 tfs_actcode;
+       uint8 tfs_subelem_id;
+       uint8 send;
+} wl_tfs_req_t;
+
+typedef struct wl_tfs_filter {
+       uint8 status;                   /**< Status returned by the AP */
+       uint8 tclas_proc;               /**< TCLAS processing value (0:and, 1:or)  */
+       uint8 tclas_cnt;                /**< count of all wl_tclas_t in tclas array */
+       uint8 tclas[1];                 /**< VLA of wl_tclas_t */
+} wl_tfs_filter_t;
+#define WL_TFS_FILTER_FIXED_SIZE       OFFSETOF(wl_tfs_filter_t, tclas)
+
+typedef struct wl_tfs_fset {
+       struct ether_addr ea;           /**< Address of AP/STA involved with this filter set */
+       uint8 tfs_id;                   /**< TFS ID field chosen by STA host */
+       uint8 status;                   /**< Internal status TFS_STATUS_xxx */
+       uint8 actcode;                  /**< Action code DOT11_TFS_ACTCODE_xxx */
+       uint8 token;                    /**< Token used in last request frame */
+       uint8 notify;                   /**< Notify frame sent/received because of this set */
+       uint8 filter_cnt;               /**< count of all wl_tfs_filter_t in filter array */
+       uint8 filter[1];                /**< VLA of wl_tfs_filter_t */
+} wl_tfs_fset_t;
+#define WL_TFS_FSET_FIXED_SIZE         OFFSETOF(wl_tfs_fset_t, filter)
+
+enum {
+       TFS_STATUS_DISABLED = 0,        /**< TFS filter set disabled by user */
+       TFS_STATUS_DISABLING = 1,       /**< Empty request just sent to AP */
+       TFS_STATUS_VALIDATED = 2,       /**< Filter set validated by AP (but maybe not enabled!) */
+       TFS_STATUS_VALIDATING = 3,      /**< Filter set just sent to AP */
+       TFS_STATUS_NOT_ASSOC = 4,       /**< STA not associated */
+       TFS_STATUS_NOT_SUPPORT = 5,     /**< TFS not supported by AP */
+       TFS_STATUS_DENIED = 6,          /**< Filter set refused by AP (=> all sets are disabled!) */
+};
+
+typedef struct wl_tfs_status {
+       uint8 fset_cnt;                 /**< count of all wl_tfs_fset_t in fset array */
+       wl_tfs_fset_t fset[1];          /**< VLA of wl_tfs_fset_t */
+} wl_tfs_status_t;
+
+typedef struct wl_tfs_set {
+       uint8 send;             /**< Immediatly register registered sets on AP side */
+       uint8 tfs_id;           /**< ID of a specific set (existing or new), or nul for all */
+       uint8 actcode;          /**< Action code for this filter set */
+       uint8 tclas_proc;       /**< TCLAS processing operator for this filter set */
+} wl_tfs_set_t;
+
+typedef struct wl_tfs_term {
+       uint8 del;                      /**< Delete internal set once confirmation received */
+       uint8 tfs_id;                   /**< ID of a specific set (existing), or nul for all */
+} wl_tfs_term_t;
+
+#define DMS_DEP_PROXY_ARP (1 << 0)
+
+/* Definitions for WNM/NPS Directed Multicast Service */
+enum {
+       DMS_STATUS_DISABLED     = 0,    /**< DMS desc disabled by user */
+       DMS_STATUS_ACCEPTED     = 1,    /**< Request accepted by AP */
+       DMS_STATUS_NOT_ASSOC    = 2,    /**< STA not associated */
+       DMS_STATUS_NOT_SUPPORT  = 3,    /**< DMS not supported by AP */
+       DMS_STATUS_DENIED       = 4,    /**< Request denied by AP */
+       DMS_STATUS_TERM         = 5,    /**< Request terminated by AP */
+       DMS_STATUS_REMOVING     = 6,    /**< Remove request just sent */
+       DMS_STATUS_ADDING       = 7,    /**< Add request just sent */
+       DMS_STATUS_ERROR        = 8,    /**< Non compliant AP behvior */
+       DMS_STATUS_IN_PROGRESS  = 9,    /**< Request just sent */
+       DMS_STATUS_REQ_MISMATCH = 10,   /**< Conditions for sending DMS req not met */
+       DMS_STATUS_TIMEOUT      = 11    /**< Request Time out */
+};
+
+typedef struct wl_dms_desc {
+       uint8 user_id;
+       uint8 status;
+       uint8 token;
+       uint8 dms_id;
+       uint8 tclas_proc;
+       uint8 mac_len;          /**< length of all ether_addr in data array, 0 if STA */
+       uint8 tclas_len;        /**< length of all wl_tclas_t in data array */
+       uint8 data[1];          /**< VLA of 'ether_addr' and 'wl_tclas_t' (in this order ) */
+} wl_dms_desc_t;
+
+#define WL_DMS_DESC_FIXED_SIZE OFFSETOF(wl_dms_desc_t, data)
+
+typedef struct wl_dms_status {
+       uint32 cnt;
+       wl_dms_desc_t desc[1];
+} wl_dms_status_t;
+
+typedef struct wl_dms_set {
+       uint8 send;
+       uint8 user_id;
+       uint8 tclas_proc;
+} wl_dms_set_t;
+
+typedef struct wl_dms_term {
+       uint8 del;
+       uint8 user_id;
+} wl_dms_term_t;
+
+typedef struct wl_service_term {
+       uint8 service;
+       union {
+               wl_dms_term_t dms;
+       } u;
+} wl_service_term_t;
+
+/** Definitions for WNM/NPS BSS Transistion */
+#define WL_BSSTRANS_QUERY_VERSION_1 1
+typedef struct wl_bsstrans_query {
+       uint16 version;   /* structure  version */
+       uint16 pad0;  /* padding for 4-byte allignment */
+       wlc_ssid_t ssid; /* SSID of NBR elem to be queried for */
+       uint8 reason; /* Reason code of the BTQ */
+       uint8 pad1[3];  /* padding for 4-byte allignment */
+} wl_bsstrans_query_t;
+
+#define BTM_QUERY_NBR_COUNT_MAX 16
+
+#define WL_BTQ_NBR_LIST_VERSION_1 1
+typedef struct wl_btq_nbr_list {
+       uint16 version;   /* structure  version */
+       uint8 count; /* No. of BTQ NBRs returned */
+       uint8 pad;  /* padding for 4-byte allignment */
+       nbr_rpt_elem_t btq_nbt_elem[]; /* BTQ NBR elem in a BTQ NBR list */
+} wl_btq_nbr_list_t;
+
+typedef struct wl_bsstrans_req {
+       uint16 tbtt;                    /**< time of BSS to end of life, in unit of TBTT */
+       uint16 dur;                     /**< time of BSS to keep off, in unit of minute */
+       uint8 reqmode;                  /**< request mode of BSS transition request */
+       uint8 unicast;                  /**< request by unicast or by broadcast */
+} wl_bsstrans_req_t;
+
+enum {
+       BSSTRANS_RESP_AUTO = 0,         /**< Currently equivalent to ENABLE */
+       BSSTRANS_RESP_DISABLE = 1,      /**< Never answer BSS Trans Req frames */
+       BSSTRANS_RESP_ENABLE = 2,       /**< Always answer Req frames with preset data */
+       BSSTRANS_RESP_WAIT = 3,         /**< Send ind, wait and/or send preset data (NOT IMPL) */
+       BSSTRANS_RESP_IMMEDIATE = 4     /**< After an ind, set data and send resp (NOT IMPL) */
+};
+
+typedef struct wl_bsstrans_resp {
+       uint8 policy;
+       uint8 status;
+       uint8 delay;
+       struct ether_addr target;
+} wl_bsstrans_resp_t;
+
+/* "wnm_bsstrans_policy" argument programs behavior after BSSTRANS Req reception.
+ * BSS-Transition feature is used by multiple programs such as NPS-PF, VE-PF,
+ * Band-steering, Hotspot 2.0 and customer requirements. Each PF and its test plan
+ * mandates different behavior on receiving BSS-transition request. To accomodate
+ * such divergent behaviors these policies have been created.
+ */
+typedef enum {
+       WL_BSSTRANS_POLICY_ROAM_ALWAYS = 0,     /**< Roam (or disassociate) in all cases */
+       WL_BSSTRANS_POLICY_ROAM_IF_MODE = 1,    /**< Roam only if requested by Request Mode field */
+       WL_BSSTRANS_POLICY_ROAM_IF_PREF = 2,    /**< Roam only if Preferred BSS provided */
+       WL_BSSTRANS_POLICY_WAIT = 3,            /**< Wait for deauth and send Accepted status */
+       WL_BSSTRANS_POLICY_PRODUCT = 4, /**< Policy for real product use cases (Olympic) */
+       WL_BSSTRANS_POLICY_PRODUCT_WBTEXT = 5,  /**< Policy for real product use cases (SS) */
+       WL_BSSTRANS_POLICY_MBO = 6,   /**< Policy for MBO certification */
+       WL_BSSTRANS_POLICY_MAX = 7
+} wnm_bsstrans_policy_type_t;
+
+/** Definitions for WNM/NPS TIM Broadcast */
+typedef struct wl_timbc_offset {
+       int16 offset;           /**< offset in us */
+       uint16 fix_intv;        /**< override interval sent from STA */
+       uint16 rate_override;   /**< use rate override to send high rate TIM broadcast frame */
+       uint8 tsf_present;      /**< show timestamp in TIM broadcast frame */
+       uint8 PAD;
+} wl_timbc_offset_t;
+
+typedef struct wl_timbc_set {
+       uint8 interval;         /**< Interval in DTIM wished or required. */
+       uint8 flags;            /**< Bitfield described below */
+       uint16 rate_min;        /**< Minimum rate required for High/Low TIM frames. Optionnal */
+       uint16 rate_max;        /**< Maximum rate required for High/Low TIM frames. Optionnal */
+} wl_timbc_set_t;
+
+enum {
+       WL_TIMBC_SET_TSF_REQUIRED = 1,  /**< Enable TIMBC only if TSF in TIM frames */
+       WL_TIMBC_SET_NO_OVERRIDE = 2,   /**< ... if AP does not override interval */
+       WL_TIMBC_SET_PROXY_ARP = 4,     /**< ... if AP support Proxy ARP */
+       WL_TIMBC_SET_DMS_ACCEPTED = 8   /**< ... if all DMS desc have been accepted */
+};
+
+typedef struct wl_timbc_status {
+       uint8 status_sta;               /**< Status from internal state machine (check below) */
+       uint8 status_ap;                /**< From AP response frame (check 8.4.2.86 from 802.11) */
+       uint8 interval;
+       uint8 pad;
+       int32 offset;
+       uint16 rate_high;
+       uint16 rate_low;
+} wl_timbc_status_t;
+
+enum {
+       WL_TIMBC_STATUS_DISABLE = 0,            /**< TIMBC disabled by user */
+       WL_TIMBC_STATUS_REQ_MISMATCH = 1,       /**< AP settings do no match user requirements */
+       WL_TIMBC_STATUS_NOT_ASSOC = 2,          /**< STA not associated */
+       WL_TIMBC_STATUS_NOT_SUPPORT = 3,        /**< TIMBC not supported by AP */
+       WL_TIMBC_STATUS_DENIED = 4,             /**< Req to disable TIMBC sent to AP */
+       WL_TIMBC_STATUS_ENABLE = 5              /**< TIMBC enabled */
+};
+
+/** Definitions for PM2 Dynamic Fast Return To Sleep */
+typedef struct wl_pm2_sleep_ret_ext {
+       uint8  logic;                   /**< DFRTS logic: see WL_DFRTS_LOGIC_* below */
+       uint8  PAD;
+       uint16 low_ms;                  /**< Low FRTS timeout */
+       uint16 high_ms;                 /**< High FRTS timeout */
+       uint16 rx_pkts_threshold;       /**< switching threshold: # rx pkts */
+       uint16 tx_pkts_threshold;       /**< switching threshold: # tx pkts */
+       uint16 txrx_pkts_threshold;     /**< switching threshold: # (tx+rx) pkts */
+       uint32 rx_bytes_threshold;      /**< switching threshold: # rx bytes */
+       uint32 tx_bytes_threshold;      /**< switching threshold: # tx bytes */
+       uint32 txrx_bytes_threshold;    /**< switching threshold: # (tx+rx) bytes */
+} wl_pm2_sleep_ret_ext_t;
+
+#define WL_DFRTS_LOGIC_OFF     0       /**< Feature is disabled */
+#define WL_DFRTS_LOGIC_OR      1       /**< OR all non-zero threshold conditions */
+#define WL_DFRTS_LOGIC_AND     2       /**< AND all non-zero threshold conditions */
+
+/* Values for the passive_on_restricted_mode iovar.  When set to non-zero, this iovar
+ * disables automatic conversions of a channel from passively scanned to
+ * actively scanned.  These values only have an effect for country codes such
+ * as XZ where some 5 GHz channels are defined to be passively scanned.
+ */
+#define WL_PASSACTCONV_DISABLE_NONE    0       /**< Enable permanent and temporary conversions */
+#define WL_PASSACTCONV_DISABLE_ALL     1       /**< Disable permanent and temporary conversions */
+#define WL_PASSACTCONV_DISABLE_PERM    2       /**< Disable only permanent conversions */
+
+/* Definitions for Reliable Multicast */
+#define WL_RMC_CNT_VERSION        1
+#define WL_RMC_TR_VERSION         1
+#define WL_RMC_MAX_CLIENT         32
+#define WL_RMC_FLAG_INBLACKLIST           1
+#define WL_RMC_FLAG_ACTIVEACKER           2
+#define WL_RMC_FLAG_RELMCAST      4
+#define WL_RMC_MAX_TABLE_ENTRY     4
+
+#define WL_RMC_VER                1
+#define WL_RMC_INDEX_ACK_ALL       255
+#define WL_RMC_NUM_OF_MC_STREAMS   4
+#define WL_RMC_MAX_TRS_PER_GROUP   1
+#define WL_RMC_MAX_TRS_IN_ACKALL   1
+#define WL_RMC_ACK_MCAST0          0x02
+#define WL_RMC_ACK_MCAST_ALL       0x01
+#define WL_RMC_ACTF_TIME_MIN       300         /**< time in ms */
+#define WL_RMC_ACTF_TIME_MAX       20000       /**< time in ms */
+#define WL_RMC_MAX_NUM_TRS        32           /**< maximun transmitters allowed */
+#define WL_RMC_ARTMO_MIN           350         /**< time in ms */
+#define WL_RMC_ARTMO_MAX           40000       /**< time in ms */
+
+/* RMC events in action frames */
+enum rmc_opcodes {
+       RELMCAST_ENTRY_OP_DISABLE = 0,   /**< Disable multi-cast group */
+       RELMCAST_ENTRY_OP_DELETE  = 1,   /**< Delete multi-cast group */
+       RELMCAST_ENTRY_OP_ENABLE  = 2,   /**< Enable multi-cast group */
+       RELMCAST_ENTRY_OP_ACK_ALL = 3    /**< Enable ACK ALL bit in AMT */
+};
+
+/* RMC operational modes */
+enum rmc_modes {
+       WL_RMC_MODE_RECEIVER    = 0,     /**< Receiver mode by default */
+       WL_RMC_MODE_TRANSMITTER = 1,     /**< Transmitter mode using wl ackreq */
+       WL_RMC_MODE_INITIATOR   = 2      /**< Initiator mode using wl ackreq */
+};
+
+/** Each RMC mcast client info */
+typedef struct wl_relmcast_client {
+       uint8 flag;                     /**< status of client such as AR, R, or blacklisted */
+       uint8 PAD;
+       int16 rssi;                     /**< rssi value of RMC client */
+       struct ether_addr addr;         /**< mac address of RMC client */
+} wl_relmcast_client_t;
+
+/** RMC Counters */
+typedef struct wl_rmc_cnts {
+       uint16  version;                /**< see definition of WL_CNT_T_VERSION */
+       uint16  length;                 /**< length of entire structure */
+       uint16  dupcnt;                 /**< counter for duplicate rmc MPDU */
+       uint16  ackreq_err;             /**< counter for wl ackreq error    */
+       uint16  af_tx_err;              /**< error count for action frame transmit   */
+       uint16  null_tx_err;            /**< error count for rmc null frame transmit */
+       uint16  af_unicast_tx_err;      /**< error count for rmc unicast frame transmit */
+       uint16  mc_no_amt_slot;         /**< No mcast AMT entry available */
+       /* Unused. Keep for rom compatibility */
+       uint16  mc_no_glb_slot;         /**< No mcast entry available in global table */
+       uint16  mc_not_mirrored;        /**< mcast group is not mirrored */
+       uint16  mc_existing_tr;         /**< mcast group is already taken by transmitter */
+       uint16  mc_exist_in_amt;        /**< mcast group is already programmed in amt */
+       /* Unused. Keep for rom compatibility */
+       uint16  mc_not_exist_in_gbl;    /**< mcast group is not in global table */
+       uint16  mc_not_exist_in_amt;    /**< mcast group is not in AMT table */
+       uint16  mc_utilized;            /**< mcast addressed is already taken */
+       uint16  mc_taken_other_tr;      /**< multi-cast addressed is already taken */
+       uint32  rmc_rx_frames_mac;      /**< no of mc frames received from mac */
+       uint32  rmc_tx_frames_mac;      /**< no of mc frames transmitted to mac */
+       uint32  mc_null_ar_cnt;         /**< no. of times NULL AR is received */
+       uint32  mc_ar_role_selected;    /**< no. of times took AR role */
+       uint32  mc_ar_role_deleted;     /**< no. of times AR role cancelled */
+       uint32  mc_noacktimer_expired;  /**< no. of times noack timer expired */
+       uint16  mc_no_wl_clk;           /**< no wl clk detected when trying to access amt */
+       uint16  mc_tr_cnt_exceeded;     /**< No of transmitters in the network exceeded */
+} wl_rmc_cnts_t;
+
+/** RMC Status */
+typedef struct wl_relmcast_st {
+       uint8         ver;              /**< version of RMC */
+       uint8         num;              /**< number of clients detected by transmitter */
+       wl_relmcast_client_t clients[WL_RMC_MAX_CLIENT];
+       uint16        err;              /**< error status (used in infra) */
+       uint16        actf_time;        /**< action frame time period */
+} wl_relmcast_status_t;
+
+/** Entry for each STA/node */
+typedef struct wl_rmc_entry {
+       /* operation on multi-cast entry such add,
+        * delete, ack-all
+        */
+       int8    flag;
+       struct ether_addr addr;         /**< multi-cast group mac address */
+} wl_rmc_entry_t;
+
+/** RMC table */
+typedef struct wl_rmc_entry_table {
+       uint8   index;                  /**< index to a particular mac entry in table */
+       uint8   opcode;                 /**< opcodes or operation on entry */
+       wl_rmc_entry_t entry[WL_RMC_MAX_TABLE_ENTRY];
+} wl_rmc_entry_table_t;
+
+typedef struct wl_rmc_trans_elem {
+       struct ether_addr tr_mac;       /**< transmitter mac */
+       struct ether_addr ar_mac;       /**< ar mac */
+       uint16 artmo;                   /**< AR timeout */
+       uint8 amt_idx;                  /**< amt table entry */
+       uint8 PAD;
+       uint16 flag;                    /**< entry will be acked, not acked, programmed, full etc */
+} wl_rmc_trans_elem_t;
+
+/** RMC transmitters */
+typedef struct wl_rmc_trans_in_network {
+       uint8         ver;              /**< version of RMC */
+       uint8         num_tr;           /**< number of transmitters in the network */
+       wl_rmc_trans_elem_t trs[WL_RMC_MAX_NUM_TRS];
+} wl_rmc_trans_in_network_t;
+
+/** To update vendor specific ie for RMC */
+typedef struct wl_rmc_vsie {
+       uint8   oui[DOT11_OUI_LEN];
+       uint8   PAD;
+       uint16  payload;        /**< IE Data Payload */
+} wl_rmc_vsie_t;
+
+/* structures  & defines for proximity detection  */
+enum proxd_method {
+       PROXD_UNDEFINED_METHOD = 0,
+       PROXD_RSSI_METHOD = 1,
+       PROXD_TOF_METHOD = 2
+};
+
+/* structures for proximity detection device role */
+#define WL_PROXD_MODE_DISABLE  0
+#define WL_PROXD_MODE_NEUTRAL  1
+#define WL_PROXD_MODE_INITIATOR        2
+#define WL_PROXD_MODE_TARGET   3
+
+#define WL_PROXD_ACTION_STOP           0
+#define WL_PROXD_ACTION_START          1
+
+#define WL_PROXD_FLAG_TARGET_REPORT    0x1
+#define WL_PROXD_FLAG_REPORT_FAILURE   0x2
+#define WL_PROXD_FLAG_INITIATOR_REPORT 0x4
+#define WL_PROXD_FLAG_NOCHANSWT                0x8
+#define WL_PROXD_FLAG_NETRUAL          0x10
+#define WL_PROXD_FLAG_INITIATOR_RPTRTT 0x20
+#define WL_PROXD_FLAG_ONEWAY           0x40
+#define WL_PROXD_FLAG_SEQ_EN           0x80
+
+#define WL_PROXD_SETFLAG_K             0x1
+#define WL_PROXD_SETFLAG_N             0x2
+#define WL_PROXD_SETFLAG_S             0x4
+
+#define WL_PROXD_SETFLAG_K             0x1
+#define WL_PROXD_SETFLAG_N             0x2
+#define WL_PROXD_SETFLAG_S             0x4
+
+#define WL_PROXD_RANDOM_WAKEUP 0x8000
+#define WL_PROXD_MAXREPORT     8
+
+typedef struct wl_proxd_iovar {
+       uint16  method;         /**< Proximity Detection method */
+       uint16  mode;           /**< Mode (neutral, initiator, target) */
+} wl_proxd_iovar_t;
+
+/*
+ * structures for proximity detection parameters
+ * consists of two parts, common and method specific params
+ * common params should be placed at the beginning
+ */
+
+typedef struct wl_proxd_params_common  {
+       chanspec_t      chanspec;       /**< channel spec */
+       int16           tx_power;       /**< tx power of Proximity Detection(PD) frames (in dBm) */
+       uint16          tx_rate;        /**< tx rate of PD rames  (in 500kbps units) */
+       uint16          timeout;        /**< timeout value */
+       uint16          interval;       /**< interval between neighbor finding attempts (in TU) */
+       uint16          duration;       /**< duration of neighbor finding attempts (in ms) */
+} wl_proxd_params_common_t;
+
+typedef struct wl_proxd_params_rssi_method {
+       chanspec_t      chanspec;       /**< chanspec for home channel */
+       int16           tx_power;       /**< tx power of Proximity Detection frames (in dBm) */
+       uint16          tx_rate;        /**< tx rate of PD frames, 500kbps units */
+       uint16          timeout;        /**< state machine wait timeout of the frames (in ms) */
+       uint16          interval;       /**< interval between neighbor finding attempts (in TU) */
+       uint16          duration;       /**< duration of neighbor finding attempts (in ms) */
+                                       /* method specific ones go after this line */
+       int16           rssi_thresh;    /**< RSSI threshold (in dBm) */
+       uint16          maxconvergtmo;  /**< max wait converge timeout (in ms) */
+} wl_proxd_params_rssi_method_t;
+
+#define Q1_NS                  25      /**< Q1 time units */
+
+/* Number of bandwidth that the TOF can support */
+#define TOF_BW_NUM             3
+/* Number of total index including seq tx/rx idx */
+#define TOF_BW_SEQ_NUM          5
+
+enum tof_bw_index {
+       TOF_BW_20MHZ_INDEX = 0,
+       TOF_BW_40MHZ_INDEX = 1,
+       TOF_BW_80MHZ_INDEX = 2,
+       TOF_BW_SEQTX_INDEX = 3,
+       TOF_BW_SEQRX_INDEX = 4
+};
+
+/*
+ * Version 2 of above bw defines
+ * and enum tof_bw_index,
+ * with advent of 160 MHz
+ */
+#define TOF_BW_NUM_V2          4u
+#define TOF_BW_SEQ_NUM_V2      6u
+
+enum tof_bw_index_v2 {
+       TOF_BW_20MHZ_INDEX_V2 = 0,
+       TOF_BW_40MHZ_INDEX_V2 = 1,
+       TOF_BW_80MHZ_INDEX_V2 = 2,
+       TOF_BW_160MHZ_INDEX_V2 = 3,
+       TOF_BW_SEQTX_INDEX_V2 = 4,
+       TOF_BW_SEQRX_INDEX_V2 = 5
+};
+
+#define BANDWIDTH_BASE 20      /**< base value of bandwidth */
+#define TOF_BW_20MHZ    (BANDWIDTH_BASE << TOF_BW_20MHZ_INDEX_V2)
+#define TOF_BW_40MHZ    (BANDWIDTH_BASE << TOF_BW_40MHZ_INDEX_V2)
+#define TOF_BW_80MHZ    (BANDWIDTH_BASE << TOF_BW_80MHZ_INDEX_V2)
+#define TOF_BW_160MHZ    (BANDWIDTH_BASE << TOF_BW_160MHZ_INDEX_V2)
+
+#define TOF_BW_10MHZ    10
+
+#define NFFT_BASE              64      /**< base size of fft */
+#define TOF_NFFT_20MHZ  (NFFT_BASE << TOF_BW_20MHZ_INDEX_V2)
+#define TOF_NFFT_40MHZ  (NFFT_BASE << TOF_BW_40MHZ_INDEX_V2)
+#define TOF_NFFT_80MHZ  (NFFT_BASE << TOF_BW_80MHZ_INDEX_V2)
+#define TOF_NFFT_160MHZ  (NFFT_BASE << TOF_BW_160MHZ_INDEX_V2)
+
+typedef struct wl_proxd_params_tof_method {
+       chanspec_t      chanspec;       /**< chanspec for home channel */
+       int16           tx_power;       /**< tx power of Proximity Detection(PD) frames (in dBm) */
+       uint16          tx_rate;        /**< tx rate of PD rames  (in 500kbps units) */
+       uint16          timeout;        /**< state machine wait timeout of the frames (in ms) */
+       uint16          interval;       /**< interval between neighbor finding attempts (in TU) */
+       uint16          duration;       /**< duration of neighbor finding attempts (in ms) */
+       /* specific for the method go after this line */
+       struct ether_addr tgt_mac;      /**< target mac addr for TOF method */
+       uint16          ftm_cnt;        /**< number of the frames txed by initiator */
+       uint16          retry_cnt;      /**< number of retransmit attampts for ftm frames */
+       int16           vht_rate;       /**< ht or vht rate */
+       /* add more params required for other methods can be added here  */
+} wl_proxd_params_tof_method_t;
+
+typedef struct wl_proxd_seq_config
+{
+       int16 N_tx_log2;
+       int16 N_rx_log2;
+       int16 N_tx_scale;
+       int16 N_rx_scale;
+       int16 w_len;
+       int16 w_offset;
+} wl_proxd_seq_config_t;
+
+#define WL_PROXD_TUNE_VERSION_1                1
+#define WL_PROXD_TUNE_VERSION_2                2
+#include <packed_section_start.h>
+/* For legacy ranging target (e.g. 43430, 43342) */
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_params_tof_tune_v1 {
+       uint32          version;
+       uint32          Ki;                     /**< h/w delay K factor for initiator */
+       uint32          Kt;                     /**< h/w delay K factor for target */
+       int16           vhtack;                 /**< enable/disable VHT ACK */
+       int16           N_log2[TOF_BW_SEQ_NUM]; /**< simple threshold crossing */
+       int16           w_offset[TOF_BW_NUM];   /**< offset of threshold crossing window(per BW) */
+       int16           w_len[TOF_BW_NUM];      /**< length of threshold crossing window(per BW) */
+       int32           maxDT;                  /**< max time difference of T4/T1 or T3/T2 */
+       int32           minDT;                  /**< min time difference of T4/T1 or T3/T2 */
+       uint8           totalfrmcnt;    /**< total count of transfered measurement frames */
+       uint16          rsv_media;              /**< reserve media value for TOF */
+       uint32          flags;                  /**< flags */
+       uint8           core;                   /**< core to use for tx */
+       uint8           setflags;               /* set flags of K, N. S values  */
+       int16           N_scale[TOF_BW_SEQ_NUM]; /**< simple threshold crossing */
+       uint8           sw_adj;                 /**< enable sw assisted timestamp adjustment */
+       uint8           hw_adj;                 /**< enable hw assisted timestamp adjustment */
+       uint8           seq_en;                 /**< enable ranging sequence */
+       uint8           ftm_cnt[TOF_BW_SEQ_NUM]; /**< number of ftm frames based on bandwidth */
+       int16           N_log2_2g;              /**< simple threshold crossing for 2g channel */
+       int16           N_scale_2g;             /**< simple threshold crossing for 2g channel */
+       wl_proxd_seq_config_t seq_5g20;
+       wl_proxd_seq_config_t seq_2g20;         /* Thresh crossing params for 2G Sequence */
+       uint16          bitflip_thresh;         /* bitflip threshold */
+       uint16          snr_thresh;             /* SNR threshold */
+       int8            recv_2g_thresh;         /* 2g recieve sensitivity threshold */
+       uint32          acs_gdv_thresh;
+       int8            acs_rssi_thresh;
+       uint8           smooth_win_en;
+       int32           emu_delay;
+} BWL_POST_PACKED_STRUCT wl_proxd_params_tof_tune_v1_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+/* For legacy ranging initiator (including 4364) */
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_params_tof_tune_v2 {
+       uint32          version;
+       uint32          Ki;                     /**< h/w delay K factor for initiator */
+       uint32          Kt;                     /**< h/w delay K factor for target */
+       int16           vhtack;                 /**< enable/disable VHT ACK */
+       int16           N_log2[TOF_BW_SEQ_NUM]; /**< simple threshold crossing */
+       int16           w_offset[TOF_BW_NUM];   /**< offset of threshold crossing window(per BW) */
+       int16           w_len[TOF_BW_NUM];      /**< length of threshold crossing window(per BW) */
+       int32           maxDT;                  /**< max time difference of T4/T1 or T3/T2 */
+       int32           minDT;                  /**< min time difference of T4/T1 or T3/T2 */
+       uint8           totalfrmcnt;            /**< total count of transfered measurement frames */
+       uint16          rsv_media;              /**< reserve media value for TOF */
+       uint32          flags;                  /**< flags */
+       uint8           core;                   /**< core to use for tx */
+       uint8           setflags;               /* set flags of K, N. S values  */
+       int16           N_scale[TOF_BW_SEQ_NUM]; /**< simple threshold crossing */
+       uint8           sw_adj;                 /**< enable sw assisted timestamp adjustment */
+       uint8           hw_adj;                 /**< enable hw assisted timestamp adjustment */
+       uint8           seq_en;                 /**< enable ranging sequence */
+       uint8           ftm_cnt[TOF_BW_SEQ_NUM]; /**< number of ftm frames based on bandwidth */
+       int16           N_log2_2g;              /**< simple threshold crossing for 2g channel */
+       int16           N_scale_2g;             /**< simple threshold crossing for 2g channel */
+       wl_proxd_seq_config_t seq_5g20;
+       wl_proxd_seq_config_t seq_2g20;         /* Thresh crossing params for 2G Sequence */
+       uint16          bitflip_thresh;         /* bitflip threshold */
+       uint16          snr_thresh;             /* SNR threshold */
+       int8            recv_2g_thresh;         /* 2g recieve sensitivity threshold */
+       uint32          acs_gdv_thresh;
+       int8            acs_rssi_thresh;
+       uint8           smooth_win_en;
+       int32           acs_gdmm_thresh;
+       int8            acs_delta_rssi_thresh;
+       int32           emu_delay;
+       uint8           core_mask;              /* core mask selection */
+} BWL_POST_PACKED_STRUCT wl_proxd_params_tof_tune_v2_t;
+#include <packed_section_end.h>
+
+#define WL_PROXD_TUNE_VERSION_3                3
+/* Future ranging support */
+typedef struct wl_proxd_params_tof_tune_v3 {
+       uint16          version;
+       uint16          len;
+       uint32          Ki;                     /**< h/w delay K factor for initiator */
+       uint32          Kt;                     /**< h/w delay K factor for target */
+       int16           vhtack;                 /**< enable/disable VHT ACK */
+       uint16          PAD;
+       int16           N_log2[TOF_BW_SEQ_NUM]; /**< simple threshold crossing */
+       uint16          PAD;
+       int16           w_offset[TOF_BW_NUM];   /**< offset of threshold crossing window(per BW) */
+       uint16          PAD;
+       int16           w_len[TOF_BW_NUM];      /**< length of threshold crossing window(per BW) */
+       uint16          PAD;
+       int32           maxDT;                  /**< max time difference of T4/T1 or T3/T2 */
+       int32           minDT;                  /**< min time difference of T4/T1 or T3/T2 */
+       uint8           totalfrmcnt;    /**< total count of transfered measurement frames */
+       uint8           PAD[3];
+       uint16          rsv_media;              /**< reserve media value for TOF */
+       uint16          PAD;
+       uint32          flags;                  /**< flags */
+       uint8           core;                   /**< core to use for tx */
+       uint8           setflags;               /* set flags of K, N. S values  */
+       uint16          PAD;
+       int16           N_scale[TOF_BW_SEQ_NUM]; /**< simple threshold crossing */
+       uint8           sw_adj;                 /**< enable sw assisted timestamp adjustment */
+       uint8           hw_adj;                 /**< enable hw assisted timestamp adjustment */
+       uint8           seq_en;                 /**< enable ranging sequence */
+       uint8           PAD[3];
+       uint8           ftm_cnt[TOF_BW_SEQ_NUM]; /**< number of ftm frames based on bandwidth */
+       uint8           PAD[3];
+       int16           N_log2_2g;              /**< simple threshold crossing for 2g channel */
+       int16           N_scale_2g;             /**< simple threshold crossing for 2g channel */
+       wl_proxd_seq_config_t seq_5g20;
+       wl_proxd_seq_config_t seq_2g20;         /* Thresh crossing params for 2G Sequence */
+       uint16          bitflip_thresh;         /* bitflip threshold */
+       uint16          snr_thresh;             /* SNR threshold */
+       int8            recv_2g_thresh;         /* 2g recieve sensitivity threshold */
+       uint8           PAD[3];
+       uint32          acs_gdv_thresh;
+       int8            acs_rssi_thresh;
+       uint8           smooth_win_en;
+       uint16          PAD;
+       int32           acs_gdmm_thresh;
+       int8            acs_delta_rssi_thresh;
+       uint8           PAD[3];
+       int32           emu_delay;
+       uint8           core_mask;              /* core mask selection */
+       uint8           PAD[3];
+} wl_proxd_params_tof_tune_v3_t;
+
+/*
+ * tof tune with 160 MHz support
+ */
+#define WL_PROXD_TUNE_VERSION_4                4u
+typedef struct wl_proxd_params_tof_tune_v4 {
+       uint16  version;
+       uint16  len;
+       uint8   core;           /**< core to use for tx */
+       uint8   setflags;       /* set flags of K, N. S values  */
+       uint8   totalfrmcnt;    /**< total count of transfered measurement frames */
+       uint8   sw_adj;         /**< enable sw assisted timestamp adjustment */
+       uint8   hw_adj;         /**< enable hw assisted timestamp adjustment */
+       uint8   seq_en;         /**< enable ranging sequence */
+       uint8   smooth_win_en;
+       uint8   core_mask;      /* core mask selection */
+       int8    recv_2g_thresh; /* 2g recieve sensitivity threshold */
+       int8    acs_rssi_thresh;
+       int8    acs_delta_rssi_thresh;
+       uint8   ftm_cnt[TOF_BW_SEQ_NUM_V2];     /**< no. of ftm frames based on bw */
+       uint8   PAD[3];         /* Use this for any int8/16 uint8/16 ext in future */
+       uint16  rsv_media;      /**< reserve media value for TOF */
+       uint16  bitflip_thresh; /* bitflip threshold */
+       uint16  snr_thresh;     /* SNR threshold */
+       int16   vhtack;         /**< enable/disable VHT ACK */
+       int16   N_log2_2g;      /**< simple threshold crossing for 2g channel */
+       int16   N_scale_2g;     /**< simple threshold crossing for 2g channel */
+       int16   N_log2[TOF_BW_SEQ_NUM_V2];      /**< simple threshold crossing */
+       int16   w_offset[TOF_BW_NUM_V2];        /**< offset of thresh crossing window(per BW) */
+       int16   w_len[TOF_BW_NUM_V2];           /**< length of thresh crossing window(per BW) */
+       int16   N_scale[TOF_BW_SEQ_NUM_V2];     /**< simple threshold crossing */
+       uint32  Ki;             /**< h/w delay K factor for initiator */
+       uint32  Kt;             /**< h/w delay K factor for target */
+       uint32  flags;          /**< flags */
+       uint32  acs_gdv_thresh;
+       int32   maxDT;          /**< max time difference of T4/T1 or T3/T2 */
+       int32   minDT;          /**< min time difference of T4/T1 or T3/T2 */
+       int32   acs_gdmm_thresh;
+       int32   emu_delay;
+       wl_proxd_seq_config_t seq_5g20;         /* Thresh crossing params for 2G Sequence */
+       wl_proxd_seq_config_t seq_2g20;         /* Thresh crossing params for 2G Sequence */
+} wl_proxd_params_tof_tune_v4_t;
+
+typedef struct wl_proxd_params_iovar {
+       uint16  method;                 /**< Proximity Detection method */
+       uint8   PAD[2];
+       union {
+               /* common params for pdsvc */
+               wl_proxd_params_common_t        cmn_params;     /**< common parameters */
+               /*  method specific */
+               wl_proxd_params_rssi_method_t   rssi_params;    /**< RSSI method parameters */
+               wl_proxd_params_tof_method_t    tof_params;     /**< TOF method parameters */
+               /* tune parameters */
+               wl_proxd_params_tof_tune_v3_t   tof_tune;       /**< TOF tune parameters */
+       } u;                            /**< Method specific optional parameters */
+} wl_proxd_params_iovar_t;
+
+/*
+ * proxd param iov with 160 MHz support
+ */
+#define WL_PROXD_IOVAR_VERSION_2       2u
+typedef struct wl_proxd_params_iovar_v2 {
+       uint16  version;
+       uint16  len;
+       uint16  method;                 /**< Proximity Detection method */
+       uint16  PAD;
+       union {
+               /* common params for pdsvc */
+               wl_proxd_params_common_t        cmn_params;     /**< common parameters */
+               /*  method specific */
+               wl_proxd_params_rssi_method_t   rssi_params;    /**< RSSI method parameters */
+               wl_proxd_params_tof_method_t    tof_params;     /**< TOF method parameters */
+               /* tune parameters */
+               wl_proxd_params_tof_tune_v4_t   tof_tune;       /**< TOF tune parameters */
+       } u;                            /**< Method specific optional parameters */
+       uint8 tlv_params[];     /* xtlvs for variable ext params */
+} wl_proxd_params_iovar_v2_t;
+
+#define PROXD_COLLECT_GET_STATUS       0
+#define PROXD_COLLECT_SET_STATUS       1
+#define PROXD_COLLECT_QUERY_HEADER     2
+#define PROXD_COLLECT_QUERY_DATA       3
+#define PROXD_COLLECT_QUERY_DEBUG      4
+#define PROXD_COLLECT_REMOTE_REQUEST   5
+#define PROXD_COLLECT_DONE             6
+
+typedef enum {
+       WL_PROXD_COLLECT_METHOD_TYPE_DISABLE            = 0x0,
+       WL_PROXD_COLLECT_METHOD_TYPE_IOVAR              = 0x1,
+       WL_PROXD_COLLECT_METHOD_TYPE_EVENT              = 0x2,
+       WL_PROXD_COLLECT_METHOD_TYPE_EVENT_LOG          = 0x4
+} wl_proxd_collect_method_type_t;
+
+typedef uint16 wl_proxd_collect_method_t;      /* query status: method to send proxd collect */
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_collect_query {
+       uint32          method;         /**< method */
+       uint8           request;        /**< Query request. */
+       uint8           status;         /**< bitmask 0 -- disable, 0x1 -- enable collection, */
+                                       /* 0x2 -- Use generic event, 0x4 -- use event log */
+       uint16          index;          /**< The current frame index [0 to total_frames - 1]. */
+       uint16          mode;           /**< Initiator or Target */
+       uint8           busy;           /**< tof sm is busy */
+       uint8           remote;         /**< Remote collect data */
+} BWL_POST_PACKED_STRUCT wl_proxd_collect_query_t;
+#include <packed_section_end.h>
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_collect_header {
+       uint16          total_frames;                   /**< The total frames for this collect. */
+       uint16          nfft;                           /**< nfft value */
+       uint16          bandwidth;                      /**< bandwidth */
+       uint16          channel;                        /**< channel number */
+       uint32          chanspec;                       /**< channel spec */
+       uint32          fpfactor;                       /**< avb timer value factor */
+       uint16          fpfactor_shift;                 /**< avb timer value shift bits */
+       int32           distance;                       /**< distance calculated by fw */
+       uint32          meanrtt;                        /**< mean of RTTs */
+       uint32          modertt;                        /**< mode of RTTs */
+       uint32          medianrtt;                      /**< median of RTTs */
+       uint32          sdrtt;                          /**< standard deviation of RTTs */
+       uint32          clkdivisor;                     /**< clock divisor */
+       uint16          chipnum;                        /**< chip type */
+       uint8           chiprev;                        /**< chip revision */
+       uint8           phyver;                         /**< phy version */
+       struct ether_addr       localMacAddr;           /**< local mac address */
+       struct ether_addr       remoteMacAddr;          /**< remote mac address */
+       wl_proxd_params_tof_tune_v3_t params;
+} BWL_POST_PACKED_STRUCT wl_proxd_collect_header_t;
+#include <packed_section_end.h>
+
+/*
+ * proxd collect header with 160 MHz support
+ */
+#define WL_PROXD_COLLECT_HEADER_VERSION_2      2u
+typedef struct wl_proxd_collect_header_v2 {
+       uint16  version;
+       uint16  len;
+       uint8   chiprev;        /**< chip revision */
+       uint8   phyver;         /**< phy version */
+       uint8   PAD[2];         /* Use this for any int8/16 uint8/16 ext in future */
+       uint16  total_frames;   /**< The total frames for this collect. */
+       uint16  nfft;           /**< nfft value */
+       uint16  bandwidth;      /**< bandwidth */
+       uint16  channel;        /**< channel number */
+       uint16  fpfactor_shift; /**< avb timer value shift bits */
+       uint16  chipnum;        /**< chip type */
+       uint32  chanspec;       /**< channel spec */
+       uint32  fpfactor;       /**< avb timer value factor */
+       uint32  meanrtt;        /**< mean of RTTs */
+       uint32  modertt;        /**< mode of RTTs */
+       uint32  medianrtt;      /**< median of RTTs */
+       uint32  sdrtt;          /**< standard deviation of RTTs */
+       uint32  clkdivisor;     /**< clock divisor */
+       int32   distance;       /**< distance calculated by fw */
+       struct ether_addr localMacAddr;         /**< local mac address */
+       uint16  PAD;            /* Use this for any int8/16 uint8/16 ext in future */
+       struct ether_addr remoteMacAddr;        /**< remote mac address */
+       uint16  PAD;            /* Use this for any int8/16 uint8/16 ext in future */
+       wl_proxd_params_tof_tune_v4_t params;   /* TOF tune params */
+       uint8 tlv_params[];     /* xtlvs for variable ext params */
+} wl_proxd_collect_header_v2_t;
+
+/* ifdef WL_NAN */
+/*  ********************** NAN wl interface struct types and defs ******************** */
+/*
+ * Uses new common IOVAR batch processing mechanism
+ */
+
+/*
+ * NAN config control
+ * Bits 0 - 23 can be set by host
+ * Bits 24 - 31 - Internal use for firmware, host cannot set it
+ */
+
+/*
+ * Bit 0 : If set to 1, means event uses nan bsscfg,
+ * otherwise uses infra bsscfg. Default is using infra bsscfg
+ */
+#define WL_NAN_CTRL_ROUTE_EVENT_VIA_NAN_BSSCFG 0x000001
+/* If set, discovery beacons are transmitted on 2G band */
+#define WL_NAN_CTRL_DISC_BEACON_TX_2G          0x000002
+/* If set, sync beacons are transmitted on 2G band */
+#define WL_NAN_CTRL_SYNC_BEACON_TX_2G          0x000004
+/* If set, discovery beacons are transmitted on 5G band */
+#define WL_NAN_CTRL_DISC_BEACON_TX_5G          0x000008
+/* If set, sync beacons are transmitted on 5G band */
+#define WL_NAN_CTRL_SYNC_BEACON_TX_5G          0x000010
+/* If set, auto datapath responses will be sent by FW */
+#define WL_NAN_CTRL_AUTO_DPRESP                        0x000020
+/* If set, auto datapath confirms will be sent by FW */
+#define WL_NAN_CTRL_AUTO_DPCONF                        0x000040
+/* If set, auto schedule responses will be sent by FW */
+#define WL_NAN_CTRL_AUTO_SCHEDRESP             0x000080
+/* If set, auto schedule confirms will be sent by FW */
+#define WL_NAN_CTRL_AUTO_SCHEDCONF             0x000100
+/* If set, proprietary rates are supported by FW */
+#define WL_NAN_CTRL_PROP_RATE                  0x000200
+/* If set, service awake_dw overrides global dev awake_dw */
+#define WL_NAN_CTRL_SVC_OVERRIDE_DEV_AWAKE_DW  0x000400
+/* If set, merge scan will be disabled */
+#define WL_NAN_CTRL_SCAN_DISABLE               0x000800
+/* If set, power save will be disabled */
+#define WL_NAN_CTRL_POWER_SAVE_DISABLE         0x001000
+/* If set, device will merge to configured CID only */
+#define WL_NAN_CTRL_MERGE_CONF_CID_ONLY                0x002000
+/* If set, 5g core will be brought down in single band NAN */
+#define WL_NAN_CTRL_5G_SLICE_POWER_OPT         0x004000
+#define WL_NAN_CTRL_DUMP_HEAP                  0x008000
+/* If set, host generates and assign ndp id for ndp sessions */
+#define WL_NAN_CTRL_HOST_GEN_NDPID             0x010000
+/* If set, nan ndp inactivity watchdog will be activated */
+#define WL_NAN_CTRL_DELETE_INACTIVE_PEERS      0x020000
+/* If set, nan assoc coex will be activated */
+#define WL_NAN_CTRL_INFRA_ASSOC_COEX           0x040000
+/* If set, dam will accept all NDP/RNG request from the peer including counter */
+#define WL_NAN_CTRL_DAM_ACCEPT_ALL             0x080000
+/* If set, nan mac ignores role for tx discovery beacon for periodic config */
+#define WL_NAN_CTRL_FASTDISC_IGNO_ROLE         0x100000
+/* If set, include NA in NAN beacons (disc beacons for now) */
+#define WL_NAN_CTRL_INCL_NA_IN_BCNS            0x200000
+/* If set, host assist will be enabled */
+#define WL_NAN_CTRL_HOST_ASSIST                        0x400000
+/* If set, host configures NDI associated with the service */
+#define WL_NAN_CTRL_HOST_CFG_SVC_NDI           0x800000
+
+/* Value when all host-configurable bits set */
+#define WL_NAN_CTRL_MAX_MASK                   0xFFFFFF
+#define WL_NAN_CFG_CTRL_FW_BITS                        8
+
+/* Last 8-bits are firmware controlled bits.
+ * Bit 31:
+ * If set - indicates that NAN initialization is successful
+ * Bit 30:
+ * If set - indicates that NAN MAC cfg creation is successful
+ *
+ * NOTE: These are only ready-only bits for host.
+ * All sets to these bits from host are masked off
+ */
+#define WL_NAN_PROTO_INIT_DONE         (1u << 31u)
+#define WL_NAN_CFG_CREATE_DONE         (1u << 30u)
+
+#define WL_NAN_GET_PROTO_INIT_STATUS(x) \
+               (((x) & WL_NAN_PROTO_INIT_DONE) ? TRUE:FALSE)
+#define WL_NAN_CLEAR_PROTO_INIT_STATUS(x) \
+               ((x) &= ~WL_NAN_PROTO_INIT_DONE)
+#define WL_NAN_SET_PROTO_INIT_STATUS(x) \
+               ((x) |= (WL_NAN_PROTO_INIT_DONE))
+
+#define WL_NAN_GET_CFG_CREATE_STATUS(x) \
+               (((x) & WL_NAN_CFG_CREATE_DONE) ? TRUE:FALSE)
+#define WL_NAN_CLEAR_CFG_CREATE_STATUS(x) \
+               ((x) &= ~WL_NAN_CFG_CREATE_DONE)
+#define WL_NAN_SET_CFG_CREATE_STATUS(x) \
+               ((x) |= (WL_NAN_CFG_CREATE_DONE))
+
+#define WL_NAN_IOCTL_VERSION                   0x2
+/* < some sufficient ioc buff size for our module */
+#define WL_NAN_IOC_BUFSZ                       256
+/* some sufficient ioc buff size for dump commands */
+#define WL_NAN_IOC_BUFSZ_EXT                   1024
+#define WL_NAN_MAX_SIDS_IN_BEACONS             127 /* Max allowed SIDs */
+#define WL_NAN_MASTER_RANK_LEN                 8
+#define WL_NAN_RANGE_LIMITED                   0x0040 /* Publish/Subscribe flags */
+
+/** The service hash (service id) is exactly this many bytes. */
+#define WL_NAN_SVC_HASH_LEN                    6
+#define WL_NAN_HASHES_PER_BLOOM                        4 /** Number of hash functions per bloom filter */
+
+/* no. of max last disc results */
+#define WL_NAN_MAX_DISC_RESULTS                        3
+
+/* Max len of Rx and Tx filters */
+#define WL_NAN_MAX_SVC_MATCH_FILTER_LEN        255
+
+/* Max service name len */
+#define WL_NAN_MAX_SVC_NAME_LEN        32
+
+/* Type of Data path connection */
+#define WL_NAN_DP_TYPE_UNICAST                 0
+#define WL_NAN_DP_TYPE_MULTICAST               1
+
+/* MAX security params length PMK field */
+#define WL_NAN_NCS_SK_PMK_LEN 32
+
+/* Post disc attr ID type */
+typedef uint8 wl_nan_post_disc_attr_id_t;
+
+/*
+ * Component IDs
+ */
+typedef enum {
+       WL_NAN_COMPID_CONFIG = 1,
+       WL_NAN_COMPID_ELECTION = 2,
+       WL_NAN_COMPID_SD = 3,
+       WL_NAN_COMPID_TIMESYNC = 4,
+       WL_NAN_COMPID_DATA_PATH = 5,
+       WL_NAN_COMPID_DEBUG = 15 /* Keep this at the end */
+} wl_nan_comp_id_t;
+
+#define WL_NAN_COMP_SHIFT      8
+#define WL_NAN_COMP_MASK(_c)   (0x0F & ((uint8)(_c)))
+#define WL_NAN_COMP_ID(_c)     (WL_NAN_COMP_MASK(_c) << WL_NAN_COMP_SHIFT)
+
+/* NAN Events */
+
+/** Instance ID type (unique identifier) */
+typedef uint8 wl_nan_instance_id_t;
+
+/* Publish sent for a subscribe */
+/* WL_NAN_EVENT_REPLIED */
+
+typedef struct wl_nan_ev_replied {
+       struct ether_addr       sub_mac; /* Subscriber MAC */
+       wl_nan_instance_id_t    pub_id; /* Publisher Instance ID */
+       uint8                   sub_id; /* Subscriber ID */
+       int8                    sub_rssi; /* Subscriber RSSI */
+       uint8                   pad[3];
+} wl_nan_ev_replied_t;
+
+typedef struct wl_nan_event_replied {
+       struct ether_addr       sub_mac; /* Subscriber MAC */
+       wl_nan_instance_id_t    pub_id; /* Publisher Instance ID */
+       uint8                   sub_id; /* Subscriber ID */
+       int8                    sub_rssi; /* Subscriber RSSI */
+       uint8           attr_num;
+       uint16          attr_list_len;  /* sizeof attributes attached to payload */
+       uint8           attr_list[0];   /* attributes payload */
+} wl_nan_event_replied_t;
+
+/* NAN Tx status of transmitted frames */
+#define WL_NAN_TXS_FAILURE     0
+#define WL_NAN_TXS_SUCCESS     1
+
+/* NAN frame types */
+enum wl_nan_frame_type {
+       /* discovery frame types */
+       WL_NAN_FRM_TYPE_PUBLISH = 1,
+       WL_NAN_FRM_TYPE_SUBSCRIBE = 2,
+       WL_NAN_FRM_TYPE_FOLLOWUP = 3,
+
+       /* datapath frame types */
+       WL_NAN_FRM_TYPE_DP_REQ = 4,
+       WL_NAN_FRM_TYPE_DP_RESP = 5,
+       WL_NAN_FRM_TYPE_DP_CONF = 6,
+       WL_NAN_FRM_TYPE_DP_INSTALL = 7,
+       WL_NAN_FRM_TYPE_DP_END = 8,
+
+       /* schedule frame types */
+       WL_NAN_FRM_TYPE_SCHED_REQ = 9,
+       WL_NAN_FRM_TYPE_SCHED_RESP = 10,
+       WL_NAN_FRM_TYPE_SCHED_CONF = 11,
+       WL_NAN_FRM_TYPE_SCHED_UPD = 12,
+
+       /* ranging frame types */
+       WL_NAN_FRM_TYPE_RNG_REQ = 13,
+       WL_NAN_FRM_TYPE_RNG_RESP = 14,
+       WL_NAN_FRM_TYPE_RNG_TERM = 15,
+       WL_NAN_FRM_TYPE_RNG_REPORT = 16,
+
+       WL_NAN_FRM_TYPE_UNSOLICIT_SDF = 17,
+       WL_NAN_FRM_TYPE_INVALID
+};
+typedef uint8 wl_nan_frame_type_t;
+
+/* NAN Reason codes for tx status */
+enum wl_nan_txs_reason_codes {
+       WL_NAN_REASON_SUCCESS = 1,    /* NAN status success */
+       WL_NAN_REASON_TIME_OUT = 2,   /* timeout reached */
+       WL_NAN_REASON_DROPPED = 3,    /* pkt dropped due to internal failure */
+       WL_NAN_REASON_MAX_RETRIES_DONE = 4 /* Max retries exceeded */
+};
+
+/* For NAN TX status */
+typedef struct wl_nan_event_txs {
+       uint8 status;           /* For TX status, success or failure */
+       uint8 reason_code;      /* to identify reason when status is failure */
+       uint16 host_seq;        /* seq num to keep track of pkts sent by host */
+       uint8 type;             /* wl_nan_frame_type_t */
+       uint8 pad;
+       uint16 opt_tlvs_len;
+       uint8 opt_tlvs[];
+} wl_nan_event_txs_t;
+
+/* SD transmit pkt's event status is sent as optional tlv in wl_nan_event_txs_t */
+typedef struct wl_nan_event_sd_txs {
+       uint8 inst_id;      /* Publish or subscribe instance id */
+       uint8 req_id;       /* Requestor instance id */
+} wl_nan_event_sd_txs_t;
+
+/* nanho fsm tlv WL_NAN_XTLV_NANHO_OOB_TXS(0x0b0a) */
+typedef struct wl_nan_event_nanho_txs {
+       uint32 fsm_id;      /* nho fsm id */
+       uint16 seq_id;      /* nho seq id */
+       uint16 pad;
+} wl_nan_event_nanho_txs_t;
+
+/* Subscribe or Publish instance Terminated */
+
+/* WL_NAN_EVENT_TERMINATED */
+
+#define        NAN_SD_TERM_REASON_TIMEOUT      1
+#define        NAN_SD_TERM_REASON_HOSTREQ      2
+#define        NAN_SD_TERM_REASON_FWTERM       3
+#define        NAN_SD_TERM_REASON_FAIL         4
+
+typedef struct wl_nan_ev_terminated {
+       uint8 instance_id;      /* publish / subscribe instance id */
+       uint8 reason;           /* 1=timeout, 2=Host/IOVAR, 3=FW Terminated 4=Failure */
+       uint8 svctype;          /* 0 - Publish, 0x1 - Subscribe */
+       uint8 pad;              /* Align */
+       uint32 tx_cnt;          /* Number of SDFs sent */
+} wl_nan_ev_terminated_t;
+
+/* Follow up received against a pub / subscr */
+/* WL_NAN_EVENT_RECEIVE */
+
+typedef struct wl_nan_ev_receive {
+       struct ether_addr remote_addr;  /* Peer NAN device MAC */
+       uint8   local_id;               /* Local subscribe or publish ID */
+       uint8   remote_id;              /* Remote subscribe or publish ID */
+       int8    fup_rssi;
+       uint8   attr_num;
+       uint16  attr_list_len;  /* sizeof attributes attached to payload */
+       uint8   attr_list[0];   /* attributes payload */
+} wl_nan_ev_receive_t;
+
+/* WL_NAN_EVENT_DISC_CACHE_TIMEOUT */
+#define WL_NAN_DISC_CACHE_EXPIRY_ENTRIES_MAX 8
+
+typedef struct wl_nan_disc_expired_cache_entry {
+       uint8 l_sub_id;                 /* local sub instance_id */
+       uint8 r_pub_id;                 /* remote-matched pub instance_id */
+       struct ether_addr r_nmi_addr;   /* remote-matched pub nmi addr */
+} wl_nan_disc_expired_cache_entry_t;
+
+typedef struct wl_nan_ev_disc_cache_timeout {
+       uint16 count;      /* no. of expired cache entries */
+       uint16 pad;
+       wl_nan_disc_expired_cache_entry_t cache_exp_list[];
+} wl_nan_ev_disc_cache_timeout_t;
+
+/* For NAN event mask extention */
+#define WL_NAN_EVMASK_EXTN_VER 1
+#define WL_NAN_EVMASK_EXTN_LEN 16      /* 16*8 = 128 masks supported */
+
+typedef struct wl_nan_event_extn {
+       uint8   ver;
+       uint8   pad;
+       uint16  len;
+       uint8   evmask[];
+} wl_nan_evmask_extn_t;
+
+/* WL_NAN_XTLV_DATA_DP_TXS */
+
+typedef struct wl_nan_data_dp_txs {
+       uint8 ndp_id;
+       uint8 pad;
+       struct ether_addr indi; /* initiator ndi */
+} wl_nan_data_dp_txs_t;
+
+/* WL_NAN_XTLV_RNG_TXS */
+
+typedef struct wl_nan_range_txs {
+       uint8   range_id;
+       uint8   pad[3];
+} wl_nan_range_txs_t;
+
+#define NAN_MAX_BANDS 2
+
+enum wl_nan_oob_af_txs_reason_code {
+       WL_NAN_OOB_AF_TX_REASON_BMAP    = 0x01, /* Bitmap schedule */
+       WL_NAN_OOB_AF_TX_REASON_TIMEOUT = 0x02, /* OOB AF session timeout */
+       WL_NAN_OOB_AF_TX_REASON_DISABLED= 0x03, /* OOB disabled while it was scheduled */
+};
+
+/* WL_NAN_EVENT_OOB_AF_TXS event sent to host after NAN OOB AF transmit attempted */
+typedef struct wl_nan_event_oob_af_txs {
+       uint8 result; /* For TX status, success or failure */
+       uint8 reason; /* wl_nan_oob_af_txs_reason_code */
+       uint16 token; /* Token from the host */
+} wl_nan_event_oob_af_txs_t;
+
+/* WL_NAN_EVENT_OOB_AF_TXS status */
+#define NAN_OOB_AF_TXS_ACK             0x1
+#define NAN_OOB_AF_TXS_NO_ACK          0x2
+#define NAN_OOB_AF_TXS_EXPIRED         0x3
+#define NAN_OOB_AF_TXS_DISABLED                0x4
+
+/* WL_NAN_EVENT_OOB_AF_RX event sent to host upon receiving a NAN OOB AF frame */
+typedef struct wl_nan_event_oob_af_rx {
+       struct ether_addr sa;
+       struct ether_addr da;
+       struct ether_addr bssid;
+       uint16 payload_len;
+       uint8  payload[];       /* AF hdr + NAN attrbutes in TLV format */
+} wl_nan_event_oob_af_rx_t;
+
+#define WL_NAN_CFG_OOB_AF_BODY_MAX_SIZE        1024u /* Max size of AF payload */
+#define WL_NAN_CFG_OOB_AF_MAX_TIMEOUT  8000u /* 8 Sec. Max timeout(in ms) for OOB AF session */
+
+/* Max size of the NAN OOB AF information in the IOVAR */
+#define WL_NAN_CFG_OOB_AF_MAX_INFO_SIZE \
+       (sizeof(bcm_xtlv_t) + sizeof(wl_nan_oob_af_t) + \
+         WL_NAN_CFG_OOB_AF_BODY_MAX_SIZE)
+/*
+ * TLVs - Below XTLV definitions will be deprecated
+ * in due course (soon as all other branches update
+ * to the comp ID based XTLVs listed below).
+ */
+enum wl_nan_cmd_xtlv_id {
+       WL_NAN_XTLV_MAC_ADDR = 0x120,
+       WL_NAN_XTLV_MATCH_RX = 0x121,
+       WL_NAN_XTLV_MATCH_TX = 0x122,
+       WL_NAN_XTLV_SVC_INFO = 0x123,
+       WL_NAN_XTLV_SVC_NAME = 0x124,
+       WL_NAN_XTLV_SR_FILTER = 0x125,
+       WL_NAN_XTLV_FOLLOWUP = 0x126,
+       WL_NAN_XTLV_SVC_LIFE_COUNT = 0x127,
+       WL_NAN_XTLV_AVAIL = 0x128,
+       WL_NAN_XTLV_SDF_RX = 0x129,
+       WL_NAN_XTLV_SDE_CONTROL = 0x12a,
+       WL_NAN_XTLV_SDE_RANGE_LIMIT = 0x12b,
+       WL_NAN_XTLV_NAN_AF = 0x12c,
+       WL_NAN_XTLV_SD_TERMINATE = 0x12d,
+       WL_NAN_XTLV_CLUSTER_ID = 0x12e,
+       WL_NAN_XTLV_PEER_RSSI = 0x12f,
+       WL_NAN_XTLV_BCN_RX = 0x130,
+       WL_NAN_XTLV_REPLIED = 0x131, /* Publish sent for a subscribe */
+       WL_NAN_XTLV_RECEIVED = 0x132, /* FUP Received */
+       WL_NAN_XTLV_DISC_RESULTS = 0x133, /* Discovery results */
+       WL_NAN_XTLV_TXS = 0x134 /* TX status */
+};
+
+#define WL_NAN_CMD_GLOBAL              0x00
+#define WL_NAN_CMD_CFG_COMP_ID         0x01
+#define WL_NAN_CMD_ELECTION_COMP_ID    0x02
+#define WL_NAN_CMD_SD_COMP_ID          0x03
+#define WL_NAN_CMD_SYNC_COMP_ID                0x04
+#define WL_NAN_CMD_DATA_COMP_ID                0x05
+#define WL_NAN_CMD_DAM_COMP_ID         0x06
+#define WL_NAN_CMD_RANGE_COMP_ID       0x07
+#define WL_NAN_CMD_GENERIC_COMP_ID     0x08
+#define WL_NAN_CMD_SCHED_COMP_ID       0x09
+#define WL_NAN_CMD_NSR_COMP_ID         0x0a /* NAN Save Restore */
+#define WL_NAN_CMD_NANHO_COMP_ID       0x0b /* NAN Host offload */
+#define WL_NAN_CMD_DBG_COMP_ID         0x0f
+
+#define WL_NAN_CMD_COMP_SHIFT          8
+#define NAN_CMD(x, y)  (((x) << WL_NAN_CMD_COMP_SHIFT) | (y))
+
+/*
+ * Module based NAN TLV IDs
+ */
+typedef enum wl_nan_tlv {
+
+       WL_NAN_XTLV_CFG_MATCH_RX        = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x01),
+       WL_NAN_XTLV_CFG_MATCH_TX        = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x02),
+       WL_NAN_XTLV_CFG_SR_FILTER       = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x03),
+       WL_NAN_XTLV_CFG_SVC_NAME        = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x04),
+       WL_NAN_XTLV_CFG_NAN_STATUS      = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x05),
+       WL_NAN_XTLV_CFG_SVC_LIFE_COUNT  = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x06),
+       WL_NAN_XTLV_CFG_SVC_HASH        = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x07),
+       WL_NAN_XTLV_CFG_SEC_CSID        = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x08), /* Security CSID */
+       WL_NAN_XTLV_CFG_SEC_PMK         = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x09), /* Security PMK */
+       WL_NAN_XTLV_CFG_SEC_PMKID       = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x0A),
+       WL_NAN_XTLV_CFG_SEC_SCID        = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x0B),
+       WL_NAN_XTLV_CFG_VNDR_PAYLOAD    = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x0C),
+       WL_NAN_XTLV_CFG_HOST_INDPID     = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x0D),
+       /* when host ndpid is used */
+       WL_NAN_XTLV_CFG_MAC_ADDR        = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x0E),
+       /* fast disc time bitmap config */
+       WL_NAN_XTLV_CFG_FDISC_TBMP      = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x0F),
+
+       WL_NAN_XTLV_SD_SVC_INFO         = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x01),
+       WL_NAN_XTLV_SD_FOLLOWUP         = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x02),
+       WL_NAN_XTLV_SD_SDF_RX           = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x03),
+       WL_NAN_XTLV_SD_SDE_CONTROL      = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x04),
+       WL_NAN_XTLV_SD_SDE_RANGE_LIMIT  = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x05),
+       WL_NAN_XTLV_SD_NAN_AF           = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x06),
+       WL_NAN_XTLV_SD_TERM             = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x07),
+       WL_NAN_XTLV_SD_REPLIED          = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x08), /* Pub sent */
+       WL_NAN_XTLV_SD_FUP_RECEIVED     = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x09), /* FUP Received */
+       WL_NAN_XTLV_SD_DISC_RESULTS     = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x0A), /* Pub RX */
+       WL_NAN_XTLV_SD_TXS              = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x0B), /* Tx status */
+       WL_NAN_XTLV_SD_SDE_SVC_INFO     = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x0C),
+       WL_NAN_XTLV_SD_SDE_SVC_UPD_IND  = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x0D),
+       WL_NAN_XTLV_SD_SVC_NDI          = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x0E),
+       WL_NAN_XTLV_SD_NDP_SPEC_INFO    = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x0F),
+       WL_NAN_XTLV_SD_NDPE_TLV_LIST    = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x10),
+       WL_NAN_XTLV_SD_NDL_QOS_UPD      = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x11),
+       WL_NAN_XTLV_SD_DISC_CACHE_TIMEOUT       = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x12),
+       WL_NAN_XTLV_SD_PEER_NMI         = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x13),
+
+       WL_NAN_XTLV_SYNC_BCN_RX         = NAN_CMD(WL_NAN_CMD_SYNC_COMP_ID, 0x01),
+       WL_NAN_XTLV_EV_MR_CHANGED       = NAN_CMD(WL_NAN_CMD_SYNC_COMP_ID, 0x02),
+
+       WL_NAN_XTLV_DATA_DP_END         = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x01),
+       WL_NAN_XTLV_DATA_DP_INFO        = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x02),
+       WL_NAN_XTLV_DATA_DP_SEC_INST    = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x03),
+       WL_NAN_XTLV_DATA_DP_TXS         = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x04), /* txs for dp */
+       WL_NAN_XTLV_DATA_DP_OPAQUE_INFO  = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x05),
+       WL_NAN_XTLV_RANGE_INFO          = NAN_CMD(WL_NAN_CMD_RANGE_COMP_ID, 0x01),
+       WL_NAN_XTLV_RNG_TXS             = NAN_CMD(WL_NAN_CMD_RANGE_COMP_ID, 0x02),
+
+       WL_NAN_XTLV_EV_SLOT_INFO        = NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x01),
+       WL_NAN_XTLV_EV_GEN_INFO         = NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x02),
+       WL_NAN_XTLV_CCA_STATS           = NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x03),
+       WL_NAN_XTLV_PER_STATS           = NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x04),
+       WL_NAN_XTLV_CHBOUND_INFO        = NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x05),
+       WL_NAN_XTLV_SLOT_STATS          = NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x06),
+
+       WL_NAN_XTLV_DAM_NA_ATTR         = NAN_CMD(WL_NAN_CMD_DAM_COMP_ID, 0x01), /* na attr */
+       WL_NAN_XTLV_HOST_ASSIST_REQ     = NAN_CMD(WL_NAN_CMD_DAM_COMP_ID, 0x02), /* host assist */
+
+       /* wl_nan_fw_cap_t */
+       WL_NAN_XTLV_GEN_FW_CAP          = NAN_CMD(WL_NAN_CMD_GENERIC_COMP_ID, 0x01),
+       /* wl_nan_fw_cap_v2_t */
+       WL_NAN_XTLV_GEN_FW_CAP_V2       = NAN_CMD(WL_NAN_CMD_GENERIC_COMP_ID, 0x02),
+
+       /* NAN OOB AF tlv */
+       WL_NAN_XTLV_OOB_AF              = NAN_CMD(WL_NAN_CMD_GENERIC_COMP_ID, 0x03),
+
+       WL_NAN_XTLV_SCHED_INFO          = NAN_CMD(WL_NAN_CMD_SCHED_COMP_ID, 0x01),
+
+       /* Nan Save-Restore XTLVs */
+       WL_NAN_XTLV_NSR2_PEER           = NAN_CMD(WL_NAN_CMD_NSR_COMP_ID, 0x21),
+       WL_NAN_XTLV_NSR2_NDP            = NAN_CMD(WL_NAN_CMD_NSR_COMP_ID, 0x22),
+
+       /* Host offload XTLVs */
+       WL_NAN_XTLV_NANHO_PEER_ENTRY    = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x01),
+       WL_NAN_XTLV_NANHO_DCAPLIST      = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x02),
+       WL_NAN_XTLV_NANHO_DCSLIST       = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x03),
+       WL_NAN_XTLV_NANHO_BLOB          = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x04),
+       WL_NAN_XTLV_NANHO_NDP_STATE     = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x05),
+       WL_NAN_XTLV_NANHO_FRM_TPLT      = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x06),
+       WL_NAN_XTLV_NANHO_OOB_NAF       = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x07),
+       WL_NAN_XTLV_NANHO_LOG_ERR_CTRL  = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x08),
+       WL_NAN_XTLV_NANHO_LOG_DBG_CTRL  = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x09),
+       WL_NAN_XTLV_NANHO_OOB_TXS       = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x0A),
+       WL_NAN_XTLV_NANHO_DCAP_ATTR = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x0B),
+       WL_NAN_XTLV_NANHO_ELEM_ATTR = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x0C),
+       WL_NAN_XTLV_NANHO_SEC_SA = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x0D)
+} wl_nan_tlv_t;
+
+/* Sub Module ID's for NAN */
+enum {
+       NAN_MAC =               0,      /* nan mac */
+       NAN_DISC =              1,      /* nan discovery */
+       NAN_DBG =               2,      /* nan debug */
+       NAN_SCHED =             3,      /* nan sched */
+       NAN_PEER_ENTRY =        4,      /* nan peer entry */
+       NAN_AVAIL =             5,      /* nan avail */
+       NAN_DAM =               6,      /* nan dam */
+       NAN_FSM =               7, /* nan fsm registry */
+       NAN_NDP =               8,      /* nan ndp */
+       NAN_NDL =               9,      /* nan ndl */
+       NAN_DP =                10,     /* nan dp core */
+       NAN_RNG =               11,     /* nan ranging */
+       NAN_SEC =               12,     /* nan sec */
+       NAN_LAST =              13
+};
+
+enum wl_nan_sub_cmd_xtlv_id {
+
+       /* Special command - Tag zero */
+       WL_NAN_CMD_GLB_NAN_VER = NAN_CMD(WL_NAN_CMD_GLOBAL, 0x00),
+
+        /* nan cfg sub-commands */
+
+       WL_NAN_CMD_CFG_NAN_INIT = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x01),
+       WL_NAN_CMD_CFG_ROLE = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x02),
+       WL_NAN_CMD_CFG_HOP_CNT = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x03),
+       WL_NAN_CMD_CFG_HOP_LIMIT = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x04),
+       WL_NAN_CMD_CFG_WARMUP_TIME = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x05),
+       WL_NAN_CMD_CFG_STATUS = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x06),
+       WL_NAN_CMD_CFG_OUI = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x07),
+       WL_NAN_CMD_CFG_COUNT = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x08),
+       WL_NAN_CMD_CFG_CLEARCOUNT = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x09),
+       WL_NAN_CMD_CFG_CHANNEL = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x0A),
+       WL_NAN_CMD_CFG_BAND = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x0B),
+       WL_NAN_CMD_CFG_CID = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x0C),
+       WL_NAN_CMD_CFG_IF_ADDR = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x0D),
+       WL_NAN_CMD_CFG_BCN_INTERVAL = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x0E),
+       WL_NAN_CMD_CFG_SDF_TXTIME = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x0F),
+       WL_NAN_CMD_CFG_SID_BEACON = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x10),
+       WL_NAN_CMD_CFG_DW_LEN = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x11),
+       WL_NAN_CMD_CFG_AVAIL = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x12),
+       WL_NAN_CMD_CFG_WFA_TM = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x13),
+       WL_NAN_CMD_CFG_EVENT_MASK =  NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x14),
+       WL_NAN_CMD_CFG_NAN_CONFIG = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x15), /* ctrl */
+       WL_NAN_CMD_CFG_NAN_ENAB = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x16),
+       WL_NAN_CMD_CFG_ULW = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x17),
+       WL_NAN_CMD_CFG_NAN_CONFIG2 = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x18), /* ctrl2 */
+       WL_NAN_CMD_CFG_DEV_CAP = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x19),
+       WL_NAN_CMD_CFG_SCAN_PARAMS = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x1A),
+       WL_NAN_CMD_CFG_VNDR_PAYLOAD = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x1B),
+       WL_NAN_CMD_CFG_FASTDISC = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x1C),
+       WL_NAN_CMD_CFG_MIN_TX_RATE = NAN_CMD(WL_NAN_CMD_CFG_COMP_ID, 0x1D),
+       WL_NAN_CMD_CFG_MAX = WL_NAN_CMD_CFG_MIN_TX_RATE,
+
+       /* Add new commands before and update */
+
+       /* nan election sub-commands */
+       WL_NAN_CMD_ELECTION_HOST_ENABLE = NAN_CMD(WL_NAN_CMD_ELECTION_COMP_ID, 0x01),
+       WL_NAN_CMD_ELECTION_METRICS_CONFIG = NAN_CMD(WL_NAN_CMD_ELECTION_COMP_ID, 0x02),
+       WL_NAN_CMD_ELECTION_METRICS_STATE = NAN_CMD(WL_NAN_CMD_ELECTION_COMP_ID, 0x03),
+       WL_NAN_CMD_ELECTION_LEAVE = NAN_CMD(WL_NAN_CMD_ELECTION_COMP_ID, 0x03),
+       WL_NAN_CMD_ELECTION_MERGE = NAN_CMD(WL_NAN_CMD_ELECTION_COMP_ID, 0x04),
+       WL_NAN_CMD_ELECTION_ADVERTISERS = NAN_CMD(WL_NAN_CMD_ELECTION_COMP_ID, 0x05),
+       WL_NAN_CMD_ELECTION_RSSI_THRESHOLD = NAN_CMD(WL_NAN_CMD_ELECTION_COMP_ID, 0x06),
+       WL_NAN_CMD_ELECTION_MAX = WL_NAN_CMD_ELECTION_RSSI_THRESHOLD,
+       /* New commands go before and update */
+
+       /* nan SD sub-commands */
+       WL_NAN_CMD_SD_PARAMS = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x01),
+       WL_NAN_CMD_SD_PUBLISH = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x02),
+       WL_NAN_CMD_SD_PUBLISH_LIST = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x03),
+       WL_NAN_CMD_SD_CANCEL_PUBLISH = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x04),
+       WL_NAN_CMD_SD_SUBSCRIBE = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x05),
+       WL_NAN_CMD_SD_SUBSCRIBE_LIST = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x06),
+       WL_NAN_CMD_SD_CANCEL_SUBSCRIBE = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x07),
+       WL_NAN_CMD_SD_VND_INFO = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x08),
+       WL_NAN_CMD_SD_STATS = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x09),
+       WL_NAN_CMD_SD_TRANSMIT = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x0A),
+       WL_NAN_CMD_SD_FUP_TRANSMIT = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x0B),
+       WL_NAN_CMD_SD_CONNECTION = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x0C),
+       WL_NAN_CMD_SD_SHOW = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x0D),
+       WL_NAN_CMD_SD_DISC_CACHE_TIMEOUT = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x0E),
+       WL_NAN_CMD_SD_DISC_CACHE_CLEAR = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x0F),
+       WL_NAN_CMD_SD_MAX = WL_NAN_CMD_SD_DISC_CACHE_CLEAR,
+
+       /* nan time sync sub-commands */
+
+       WL_NAN_CMD_SYNC_SOCIAL_CHAN = NAN_CMD(WL_NAN_CMD_SYNC_COMP_ID, 0x01),
+       WL_NAN_CMD_SYNC_AWAKE_DWS = NAN_CMD(WL_NAN_CMD_SYNC_COMP_ID, 0x02),
+       WL_NAN_CMD_SYNC_BCN_RSSI_NOTIF_THRESHOLD = NAN_CMD(WL_NAN_CMD_SYNC_COMP_ID, 0x03),
+       WL_NAN_CMD_SYNC_MAX = WL_NAN_CMD_SYNC_BCN_RSSI_NOTIF_THRESHOLD,
+
+       /* nan2 commands */
+       WL_NAN_CMD_DATA_CONFIG = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x01),
+       WL_NAN_CMD_DATA_RSVD02 = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x02),
+       WL_NAN_CMD_DATA_RSVD03 = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x03),
+       WL_NAN_CMD_DATA_DATAREQ = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x04),
+       WL_NAN_CMD_DATA_DATARESP = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x05),
+       WL_NAN_CMD_DATA_DATAEND = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x06),
+       WL_NAN_CMD_DATA_SCHEDUPD = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x07),
+       WL_NAN_CMD_DATA_RSVD08 = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x08),
+       WL_NAN_CMD_DATA_CAP = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x9),
+       WL_NAN_CMD_DATA_STATUS = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x0A),
+       WL_NAN_CMD_DATA_STATS = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x0B),
+       WL_NAN_CMD_DATA_RSVD0C = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x0C),
+       WL_NAN_CMD_DATA_NDP_SHOW = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x0D),
+       WL_NAN_CMD_DATA_DATACONF = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x0E),
+       WL_NAN_CMD_DATA_MIN_TX_RATE = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x0F),
+       WL_NAN_CMD_DATA_MAX_PEERS = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x10),
+       WL_NAN_CMD_DATA_DP_IDLE_PERIOD = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x11),
+       WL_NAN_CMD_DATA_DP_OPAQUE_INFO = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x12),
+       WL_NAN_CMD_DATA_DP_HB_DURATION = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x13),
+       WL_NAN_CMD_DATA_PATH_MAX = WL_NAN_CMD_DATA_DP_HB_DURATION, /* New ones before and update */
+
+       /* nan dam sub-commands */
+       WL_NAN_CMD_DAM_CFG = NAN_CMD(WL_NAN_CMD_DAM_COMP_ID, 0x01),
+       WL_NAN_CMD_DAM_MAX = WL_NAN_CMD_DAM_CFG,  /* New ones before and update */
+
+       /* nan2.0 ranging commands */
+       WL_NAN_CMD_RANGE_REQUEST = NAN_CMD(WL_NAN_CMD_RANGE_COMP_ID, 0x01),
+       WL_NAN_CMD_RANGE_AUTO = NAN_CMD(WL_NAN_CMD_RANGE_COMP_ID, 0x02),
+       WL_NAN_CMD_RANGE_RESPONSE = NAN_CMD(WL_NAN_CMD_RANGE_COMP_ID, 0x03),
+       WL_NAN_CMD_RANGE_CANCEL = NAN_CMD(WL_NAN_CMD_RANGE_COMP_ID, 0x04),
+       WL_NAN_CMD_RANGE_IDLE_COUNT = NAN_CMD(WL_NAN_CMD_RANGE_COMP_ID, 0x05),
+       WL_NAN_CMD_RANGE_CANCEL_EXT = NAN_CMD(WL_NAN_CMD_RANGE_COMP_ID, 0x06),
+
+       /*  nan debug sub-commands  */
+       WL_NAN_CMD_DBG_SCAN_PARAMS = NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x01),
+       WL_NAN_CMD_DBG_SCAN = NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x02),
+       WL_NAN_CMD_DBG_SCAN_RESULTS =  NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x03),
+       /* This is now moved under CFG */
+       WL_NAN_CMD_DBG_EVENT_MASK =  NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x04),
+       WL_NAN_CMD_DBG_EVENT_CHECK =  NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x05),
+       WL_NAN_CMD_DBG_DUMP =  NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x06),
+       WL_NAN_CMD_DBG_CLEAR =  NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x07),
+       WL_NAN_CMD_DBG_RSSI =  NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x08),
+       WL_NAN_CMD_DBG_DEBUG =  NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x09),
+       WL_NAN_CMD_DBG_TEST1 =  NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x0A),
+       WL_NAN_CMD_DBG_TEST2 =  NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x0B),
+       WL_NAN_CMD_DBG_TEST3 =  NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x0C),
+       WL_NAN_CMD_DBG_DISC_RESULTS =  NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x0D),
+       WL_NAN_CMD_DBG_STATS =  NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x0E),
+       WL_NAN_CMD_DBG_LEVEL =  NAN_CMD(WL_NAN_CMD_DBG_COMP_ID, 0x0F),
+       WL_NAN_CMD_DBG_MAX = WL_NAN_CMD_DBG_LEVEL, /* New ones before and update */
+
+        /* Generic componenet */
+       WL_NAN_CMD_GEN_STATS = NAN_CMD(WL_NAN_CMD_GENERIC_COMP_ID, 0x01),
+       WL_NAN_CMD_GEN_FW_CAP = NAN_CMD(WL_NAN_CMD_GENERIC_COMP_ID, 0x02),
+       WL_NAN_CMD_CFG_OOB_AF = NAN_CMD(WL_NAN_CMD_GENERIC_COMP_ID, 0x03),
+       WL_NAN_CMD_GEN_MAX = WL_NAN_CMD_CFG_OOB_AF,
+
+       /* NAN Save-Restore */
+       WL_NAN_CMD_NSR2 = NAN_CMD(WL_NAN_CMD_NSR_COMP_ID, 0x20),
+       WL_NAN_CMD_NSR2_MAX = WL_NAN_CMD_NSR2,
+
+       /* Host offload sub-commands */
+       WL_NAN_CMD_NANHO_UPDATE = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x01), /* WILL BE REMOVED */
+       WL_NAN_CMD_NANHO_INFO = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x01),
+       WL_NAN_CMD_NANHO_FRM_TPLT = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x02),    /* unused */
+       WL_NAN_CMD_NANHO_OOB_NAF = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x03),     /* unused */
+       WL_NAN_CMD_NANHO_LOG_CTRL = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x04),
+       WL_NAN_CMD_NANHO_VER = NAN_CMD(WL_NAN_CMD_NANHO_COMP_ID, 0x05),
+       WL_NAN_CMD_NANHO_MAX = WL_NAN_CMD_NANHO_VER,
+
+       /* Add submodules below, and update WL_NAN_CMD_MAX */
+
+       /* ROML check for this enum should use WL_NAN_CMD_MAX */
+       WL_NAN_CMD_MAX = WL_NAN_CMD_NANHO_MAX
+};
+
+/*
+ * Component/Module based NAN TLV IDs for NAN stats
+ */
+typedef enum wl_nan_stats_tlv {
+       WL_NAN_XTLV_SYNC_MAC_STATS              = NAN_CMD(WL_NAN_CMD_SYNC_COMP_ID, 0x01),
+
+       WL_NAN_XTLV_SD_DISC_STATS               = NAN_CMD(WL_NAN_CMD_SD_COMP_ID, 0x01),
+
+       WL_NAN_XTLV_DATA_NDP_STATS              = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x01),
+       WL_NAN_XTLV_DATA_NDL_STATS              = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x02),
+       WL_NAN_XTLV_DATA_SEC_STATS              = NAN_CMD(WL_NAN_CMD_DATA_COMP_ID, 0x03),
+
+       WL_NAN_XTLV_GEN_SCHED_STATS             = NAN_CMD(WL_NAN_CMD_GENERIC_COMP_ID, 0x01),
+       WL_NAN_XTLV_GEN_PEER_STATS              = NAN_CMD(WL_NAN_CMD_GENERIC_COMP_ID, 0x02),
+       WL_NAN_XTLV_GEN_PEER_STATS_DEVCAP       = NAN_CMD(WL_NAN_CMD_GENERIC_COMP_ID, 0x03),
+       WL_NAN_XTLV_GEN_PEER_STATS_NDP          = NAN_CMD(WL_NAN_CMD_GENERIC_COMP_ID, 0x04),
+       WL_NAN_XTLV_GEN_PEER_STATS_SCHED        = NAN_CMD(WL_NAN_CMD_GENERIC_COMP_ID, 0x05),
+       WL_NAN_XTLV_GEN_AVAIL_STATS_SCHED       = NAN_CMD(WL_NAN_CMD_GENERIC_COMP_ID, 0x06),
+       WL_NAN_XTLV_GEN_NDP_STATS               = NAN_CMD(WL_NAN_CMD_GENERIC_COMP_ID, 0x07),
+       WL_NAN_XTLV_GEN_PARSE_STATS             = NAN_CMD(WL_NAN_CMD_GENERIC_COMP_ID, 0x08),
+
+       WL_NAN_XTLV_DAM_STATS                   = NAN_CMD(WL_NAN_CMD_DAM_COMP_ID, 0x01),
+       WL_NAN_XTLV_DAM_AVAIL_STATS             = NAN_CMD(WL_NAN_CMD_DAM_COMP_ID, 0x02),
+
+       WL_NAN_XTLV_RANGE_STATS                 = NAN_CMD(WL_NAN_CMD_RANGE_COMP_ID, 0x01)
+} wl_nan_stats_tlv_t;
+
+/* NAN stats WL_NAN_CMD_GEN_STATS command */
+/* Input data */
+typedef struct wl_nan_cmn_get_stat {
+       uint32  modules_btmap;  /* Bitmap to indicate module stats are needed:
+                                * See NAN Sub Module ID's above
+                                */
+       uint8   operation;      /* Get, Get and Clear */
+       uint8   arg1;           /* Submodule control variable1 */
+       uint8   arg2;           /* Submodule control variable2 */
+       uint8   pad;            /* May not be needed as TLV's are aligned,add to pass compile chk */
+} wl_nan_cmn_get_stat_t;
+
+/* Output for Stats container */
+typedef struct wl_nan_cmn_stat {
+       uint32  n_stats;        /* Number of different sub TLV stats present in the container */
+       uint32  totlen;         /* Total Length of stats data in container */
+       uint8   stats_tlvs [];  /* Stat TLV's container */
+} wl_nan_cmn_stat_t;
+
+/* Defines for operation */
+#define WLA_NAN_STATS_GET      0
+#define WLA_NAN_STATS_GET_CLEAR        1
+
+#define WL_NAN_STAT_ALL 0xFFFFFFFF
+
+/* NAN Mac stats */
+
+typedef struct wl_nan_mac_band_stats {
+       uint32 bcn_tx;  /* 2g/5g disc/sync beacon tx count */
+       uint32 bcn_rx;  /* 2g/5g disc/sync beacon rx count */
+       uint32 dws;     /* Number of 2g/5g DW's */
+} wl_nan_mac_band_stats_t;
+
+/* Note: if this struct is changing update wl_nan_slot_ecounters_vX_t version,
+ * as this struct is sent as payload in wl_nan_slot_ecounter_vX_ts
+ */
+typedef struct wl_nan_mac_stats {
+       wl_nan_mac_band_stats_t band[NAN_MAX_BANDS];    /* MAC sync band specific stats */
+       uint32 naf_tx;                  /* NAN AF tx */
+       uint32 naf_rx;                  /* NAN AF rx */
+       uint32 sdf_tx;                  /* SDF tx */
+       uint32 sdf_rx;                  /* SDF rx */
+       uint32 cnt_sync_bcn_rx_tu[3];   /* delta bw */
+       uint32 cnt_bcn_tx_out_dw;       /* TX sync beacon outside dw */
+       uint32 cnt_role_am_dw;          /* anchor master role due to dw */
+       uint32 cnt_am_hop_err;          /* wrong hopcount set for AM */
+} wl_nan_mac_stats_t;
+
+/* NAN Sched stats */
+/* Per core Sched stats */
+typedef struct nan_sched_stats_core {
+       uint32  slotstart;              /* slot_start */
+       uint32  slotend;                /* slot_end */
+       uint32  slotskip;               /* slot_skip */
+       uint32  slotstart_partial;      /* slot resume */
+       uint32  slotend_partial;        /* slot pre-empt */
+       uint8   avail_upd_cnt;          /* count to track num of times avail has been updated */
+       uint8   pad[3];
+} nan_sched_stats_core_t;
+/* Common Sched stats */
+typedef struct nan_sched_stats_cmn {
+       uint32  slot_adj_dw;    /* Slot adjusts due to DW changes */
+       uint32  slot_dur;       /* Total slot duration in TU's */
+} nan_sched_stats_cmn_t;
+
+/* Note: if this struct is changing update wl_nan_slot_ecounters_vX_t version,
+ * as this struct is sent as payload in wl_nan_slot_ecounters_vX_t
+ */
+typedef struct nan_sched_stats {
+       nan_sched_stats_cmn_t cmn;
+       nan_sched_stats_core_t slice[MAX_NUM_D11CORES];
+} nan_sched_stats_t;
+/* End NAN Sched stats */
+
+/* NAN Discovery stats */
+typedef struct nan_disc_stats {
+       uint32 pub_tx;          /* Publish tx */
+       uint32 pub_rx;          /* Publish rx */
+       uint32 sub_tx;          /* Subscribe tx */
+       uint32 sub_rx;          /* Subscribe rx */
+       uint32 fup_tx;          /* Followup tx */
+       uint32 fup_rx;          /* Followup rx */
+       uint32 pub_resp_ignored;        /* response to incoming publish ignored */
+       uint32 sub_resp_ignored;        /* response to incoming subscribe ignored */
+} nan_disc_stats_t;
+/* NAN Discovery stats end */
+
+/* statistics for nan sec */
+typedef struct nan_sec_stats_s {
+       uint32 mic_fail;                /* rx mic fail */
+       uint32 replay_fail;             /* replay counter */
+       uint32 tx_fail;                 /* tx fail (from txstatus) */
+       uint32 key_info_err;            /* key info field err */
+       uint32 ok_sessions;             /* successful mx negotiations */
+       uint32 fail_sessions;           /* failed sessions */
+       uint32 keydesc_err;             /* key desc error */
+       uint32 invalid_cipher;          /* cipher suite not valid */
+       uint32 pmk_not_found;           /* no pmk found for given service or for any reason */
+       uint32 no_pmk_for_pmkid;        /* no pmk found for give pmkid */
+       uint32 key_install_err;         /* failed to install keys */
+       uint32 no_keydesc_attr;         /* key desc attr missing */
+       uint32 nonce_mismatch;          /* nonce mismatch */
+} nan_sec_stats_t;
+
+/* WL_NAN_XTLV_GEN_PEER_STATS */
+typedef struct wl_nan_peer_stats {
+       struct ether_addr nmi;
+       uint8 pad[2];
+       uint32 pkt_enq; /* counter for queued pkt of peer */
+
+       /* NDL */
+       bool ndl_exist;
+       uint8 ndl_state;
+       bool counter_proposed;
+       uint8 pad1;
+
+       /* NDL QoS */
+       uint16 local_max_latency;
+       uint16 peer_max_latency;
+       uint8 local_min_slots;
+       uint8 peer_min_slots;
+
+       /* security association */
+       struct ether_addr sec_laddr;    /* local mac addr */
+       struct ether_addr sec_raddr;    /* remote mac addr */
+       uint8 sec_csid;
+       uint8 pad2;
+} wl_nan_peer_stats_t;
+
+/* WL_NAN_XTLV_GEN_PEER_STATS_DEVCAP */
+typedef struct wl_nan_peer_stats_dev_cap {
+       uint8 mapid;
+       uint8 awake_dw_2g;
+       uint8 awake_dw_5g;
+       uint8 bands_supported;
+       uint8 op_mode;
+       uint8 num_antennas;
+       uint16 chan_switch_time;
+       uint8 capabilities;
+       uint8 pad[3];
+} wl_nan_peer_stats_dev_cap_t;
+
+/* WL_NAN_XTLV_GEN_PEER_STATS_NDP */
+typedef struct wl_nan_peer_stats_ndp {
+       uint8 peer_role;
+       uint8 ndp_state;
+       uint8 indp_id;  /* initiator ndp id */
+       uint8 ndp_ctrl; /* ndp control field */
+       struct ether_addr peer_nmi;
+       struct ether_addr peer_ndi;
+       struct ether_addr local_ndi;
+
+       /* peer scb info */
+       bool scb_allocated;
+       bool scb_found;
+       uint32 scb_flags;
+       uint32 scb_flags2;
+       uint32 scb_flags3;
+} wl_nan_peer_stats_ndp_t;
+
+enum {
+       WL_NAN_SCHED_STAT_SLOT_COMM     = 0x01, /* Committed slot */
+       WL_NAN_SCHED_STAT_SLOT_COND     = 0x02, /* Conditional slot(proposal/counter) */
+       WL_NAN_SCHED_STAT_SLOT_NDC      = 0x04, /* NDC slot */
+       WL_NAN_SCHED_STAT_SLOT_IMMUT    = 0x08, /* Immutable slot */
+       WL_NAN_SCHED_STAT_SLOT_RANGE    = 0x10, /* Ranging slot */
+};
+typedef uint16 wl_nan_stats_sched_slot_info_t;
+
+typedef struct wl_nan_stats_sched_slot {
+       wl_nan_stats_sched_slot_info_t info;    /* capture slot type and more info */
+       chanspec_t chanspec;
+} wl_nan_stats_sched_slot_t;
+
+/* WL_NAN_XTLV_GEN_PEER_STATS_SCHED, WL_NAN_XTLV_GEN_AVAIL_STATS_SCHED */
+typedef struct wl_nan_stats_sched {
+       uint8 map_id;
+       uint8 seq_id;   /* seq id from NA attr */
+       uint8 slot_dur;
+       uint8 pad;
+       uint16 period;
+       uint16 num_slot;
+       wl_nan_stats_sched_slot_t slot[];
+} wl_nan_stats_sched_t;
+
+/* WL_NAN_XTLV_GEN_PEER_STATS_SCHED */
+typedef struct wl_nan_peer_stats_sched {
+       uint8 map_id;
+       uint8 seq_id;   /* seq id from NA attr */
+       uint8 slot_dur;
+       uint8 pad;
+       uint16 period;
+       uint16 num_slot;
+       wl_nan_stats_sched_slot_t slot[];
+} wl_nan_peer_stats_sched_t;
+
+/* WL_NAN_XTLV_RANGE_STATS  */
+typedef struct wl_nan_range_stats {
+       uint16 rng_ssn_estb;
+       uint16 rng_ssn_fail;
+       uint16 rng_sched_start;
+       uint16 rng_sched_end;
+       uint16 ftm_ssn_success; /* number of succesfull ftm sessions */
+       uint16 ftm_ssn_fail;
+       uint16 num_meas; /* number of ftm frames */
+       uint16 num_valid_meas; /* number of ftm frames with valid timestamp */
+} wl_nan_range_stats_t;
+
+/* defines for ndp stats flag */
+
+#define NAN_NDP_STATS_FLAG_ROLE_MASK                      0x01
+#define NAN_NDP_STATS_FLAG_ROLE_INIT                      0x00
+#define NAN_NDP_STATS_FLAG_ROLE_RESP                      0x01
+
+#define NAN_NDP_STATS_STATE_BIT_SHIFT                     1
+#define NAN_NDP_STATS_FLAG_STATE_MASK                     0x07
+#define NAN_NDP_STATS_FLAG_STATE_IN_PROG                  0x00
+#define NAN_NDP_STATS_FLAG_STATE_ESTB                     0x01
+#define NAN_NDP_STATS_FLAG_STATE_TEARDOWN_WAIT            0x02
+/* More states can be added here, when needed */
+
+/* WL_NAN_XTLV_GEN_NDP_STATS */
+typedef struct wl_nan_ndp_stats_s {
+       uint8 ndp_id;
+       uint8 indp_id;
+       uint8 flags;
+       uint8 nan_sec_csid;
+       struct ether_addr lndi_addr;
+       struct ether_addr pnmi_addr;
+       struct ether_addr pndi_addr;
+       uint8 PAD[2];
+} wl_nan_ndp_stats_t;
+
+/* WL_NAN_XTLV_EV_SLOT_INFO */
+typedef struct wl_nan_slot_info_s {
+       /* dw slot start expected */
+       uint32  dwst_h;
+       uint32  dwst_l;
+       /* dw slot start actual */
+       uint32  act_dwst_h;
+       uint32  act_dwst_l;
+       uint16  cur_chan[MAX_NUM_D11CORES];     /* sdb channels */
+       uint16  dw_chan;        /* dw channel */
+       uint8   dw_no;          /* dw number */
+       uint8   slot_seq_no;    /* slot seq no. */
+} wl_nan_slot_info_t;
+
+/* WL_NAN_XTLV_DAM_STATS */
+typedef struct wl_nan_dam_stats {
+       uint32 cnt_rej_crb_inuse;               /* DAM rejections because of crb in use already */
+} wl_nan_dam_stats_t;
+
+/* WL_NAN_EVENT_MR_CHANGED */
+typedef uint8 wl_nan_mr_changed_t;
+#define WL_NAN_AMR_CHANGED     1
+#define WL_NAN_IMR_CHANGED     2
+
+/*
+ * The macro BCMUTILS_ERR_CODES is defined only
+ * when using the common header file(a new approach) bcmutils/include/bcmerror.h.
+ * Otherwise, use the error codes from this file.
+ */
+#ifndef BCMUTILS_ERR_CODES
+
+/** status - TBD BCME_ vs NAN status - range reserved for BCME_ */
+enum {
+       /* add new status here... */
+       WL_NAN_E_INVALID_TOKEN          = -2135,        /* invalid token or mismatch */
+       WL_NAN_E_INVALID_ATTR           = -2134,        /* generic invalid attr error */
+       WL_NAN_E_INVALID_NDL_ATTR       = -2133,        /* invalid NDL attribute */
+       WL_NAN_E_SCB_NORESOURCE         = -2132,        /* no more peer scb available */
+       WL_NAN_E_PEER_NOTAVAIL          = -2131,
+       WL_NAN_E_SCB_EXISTS             = -2130,
+       WL_NAN_E_INVALID_PEER_NDI       = -2129,
+       WL_NAN_E_INVALID_LOCAL_NDI      = -2128,
+       WL_NAN_E_ALREADY_EXISTS         = -2127,        /* generic NAN error for duplication */
+       WL_NAN_E_EXCEED_MAX_NUM_MAPS    = -2126,
+       WL_NAN_E_INVALID_DEV_CHAN_SCHED = -2125,
+       WL_NAN_E_INVALID_PEER_BLOB_TYPE = -2124,
+       WL_NAN_E_INVALID_LCL_BLOB_TYPE  = -2123,
+       WL_NAN_E_BCMC_PDPA              = -2122,        /* BCMC NAF PDPA */
+       WL_NAN_E_TIMEOUT                = -2121,
+       WL_NAN_E_HOST_CFG               = -2120,
+       WL_NAN_E_NO_ACK                 = -2119,
+       WL_NAN_E_SECINST_FAIL           = -2118,
+       WL_NAN_E_REJECT_NDL             = -2117,        /* generic NDL rejection error */
+       WL_NAN_E_INVALID_NDP_ATTR       = -2116,
+       WL_NAN_E_HOST_REJECTED          = -2115,
+       WL_NAN_E_PCB_NORESOURCE         = -2114,
+       WL_NAN_E_NDC_EXISTS             = -2113,
+       WL_NAN_E_NO_NDC_ENTRY_AVAIL     = -2112,
+       WL_NAN_E_INVALID_NDC_ENTRY      = -2111,
+       WL_NAN_E_SD_TX_LIST_FULL        = -2110,
+       WL_NAN_E_SVC_SUB_LIST_FULL      = -2109,
+       WL_NAN_E_SVC_PUB_LIST_FULL      = -2108,
+       WL_NAN_E_SDF_MAX_LEN_EXCEEDED   = -2107,
+       WL_NAN_E_ZERO_CRB               = -2106,        /* no CRB between local and peer */
+       WL_NAN_E_PEER_NDC_NOT_SELECTED  = -2105,        /* peer ndc not selected */
+       WL_NAN_E_DAM_CHAN_CONFLICT      = -2104,        /* dam schedule channel conflict */
+       WL_NAN_E_DAM_SCHED_PERIOD       = -2103,        /* dam schedule period mismatch */
+       WL_NAN_E_LCL_NDC_NOT_SELECTED   = -2102,        /* local selected ndc not configured */
+       WL_NAN_E_NDL_QOS_INVALID_NA     = -2101,        /* na doesn't comply with ndl qos */
+       WL_NAN_E_CLEAR_NAF_WITH_SA_AS_RNDI = -2100,     /* rx clear naf with peer rndi */
+       WL_NAN_E_SEC_CLEAR_PKT          = -2099,        /* rx clear pkt from a peer with sec_sa */
+       WL_NAN_E_PROT_NON_PDPA_NAF      = -2098,        /* rx protected non PDPA frame */
+       WL_NAN_E_DAM_DOUBLE_REMOVE      = -2097,        /* remove peer schedule already removed */
+       WL_NAN_E_DAM_DOUBLE_MERGE       = -2096,        /* merge peer schedule already merged */
+       WL_NAN_E_DAM_REJECT_INVALID     = -2095,        /* reject for invalid schedule */
+       WL_NAN_E_DAM_REJECT_RANGE       = -2094,
+       WL_NAN_E_DAM_REJECT_QOS         = -2093,
+       WL_NAN_E_DAM_REJECT_NDC         = -2092,
+       WL_NAN_E_DAM_REJECT_PEER_IMMUT  = -2091,
+       WL_NAN_E_DAM_REJECT_LCL_IMMUT   = -2090,
+       WL_NAN_E_DAM_EXCEED_NUM_SCHED   = -2089,
+       WL_NAN_E_DAM_INVALID_SCHED_MAP  = -2088,        /* invalid schedule map list */
+       WL_NAN_E_DAM_INVALID_LCL_SCHED  = -2087,
+       WL_NAN_E_INVALID_MAP_ID         = -2086,
+       WL_NAN_E_CHAN_OVERLAP_ACROSS_MAP = -2085,
+       WL_NAN_E_INVALID_CHAN_LIST      = -2084,
+       WL_NAN_E_INVALID_RANGE_TBMP     = -2083,
+       WL_NAN_E_INVALID_IMMUT_SCHED    = -2082,
+       WL_NAN_E_INVALID_NDC_ATTR       = -2081,
+       WL_NAN_E_INVALID_TIME_BITMAP    = -2080,
+       WL_NAN_E_INVALID_NA_ATTR        = -2079,
+       WL_NAN_E_NO_NA_ATTR_IN_AVAIL_MAP = -2078,       /* no na attr saved in avail map */
+       WL_NAN_E_INVALID_MAP_IDX        = -2077,
+       WL_NAN_E_SEC_SA_NOTFOUND        = -2076,
+       WL_NAN_E_BSSCFG_NOTFOUND        = -2075,
+       WL_NAN_E_SCB_NOTFOUND           = -2074,
+       WL_NAN_E_NCS_SK_KDESC_TYPE      = -2073,
+       WL_NAN_E_NCS_SK_KEY_DESC_VER    = -2072,        /* key descr ver */
+       WL_NAN_E_NCS_SK_KEY_TYPE        = -2071,        /* key descr type */
+       WL_NAN_E_NCS_SK_KEYINFO_FAIL    = -2070,        /* key info (generic) */
+       WL_NAN_E_NCS_SK_KEY_LEN         = -2069,        /* key len */
+       WL_NAN_E_NCS_SK_KDESC_NOT_FOUND = -2068,        /* key desc not found */
+       WL_NAN_E_NCS_SK_INVALID_PARAMS  = -2067,        /* invalid args */
+       WL_NAN_E_NCS_SK_KDESC_INVALID   = -2066,        /* key descr is not valid */
+       WL_NAN_E_NCS_SK_NONCE_MISMATCH  = -2065,
+       WL_NAN_E_NCS_SK_KDATA_SAVE_FAIL = -2064,        /* not able to save key data */
+       WL_NAN_E_NCS_SK_AUTH_TOKEN_CALC_FAIL = -2063,
+       WL_NAN_E_NCS_SK_PTK_CALC_FAIL   = -2062,
+       WL_NAN_E_INVALID_STARTOFFSET    = -2061,
+       WL_NAN_E_BAD_NA_ENTRY_TYPE      = -2060,
+       WL_NAN_E_INVALID_CHANBMP        = -2059,
+       WL_NAN_E_INVALID_OP_CLASS       = -2058,
+       WL_NAN_E_NO_IES                 = -2057,
+       WL_NAN_E_NO_PEER_ENTRY_AVAIL    = -2056,
+       WL_NAN_E_INVALID_PEER           = -2055,
+       WL_NAN_E_PEER_EXISTS            = -2054,
+       WL_NAN_E_PEER_NOTFOUND          = -2053,
+       WL_NAN_E_NO_MEM                 = -2052,
+       WL_NAN_E_INVALID_OPTION         = -2051,
+       WL_NAN_E_INVALID_BAND           = -2050,
+       WL_NAN_E_INVALID_MAC            = -2049,
+       WL_NAN_E_BAD_INSTANCE           = -2048,
+       /* NAN status code reserved from -2048 to -3071 */
+       /* Do NOT add new status below -2048 */
+       WL_NAN_E_ERROR                  = -1,
+       WL_NAN_E_OK                     = 0
+};
+
+#endif /* BCMUTILS_ERR_CODES */
+
+/* Error codes used in vendor specific attribute in Data Path Termination frames */
+enum {
+       WL_NAN_DPEND_E_OK               = 0,
+       WL_NAN_DPEND_E_ERROR            = 1,
+       WL_NAN_DPEND_E_HOST_CMD         = 2,
+       WL_NAN_DPEND_E_HOST_REJECTED    = 3,    /* host rejected rx frame  */
+       WL_NAN_DPEND_E_RESOURCE_LIMIT   = 4,
+       WL_NAN_DPEND_E_NO_ACK_RCV       = 5,
+       WL_NAN_DPEND_E_TIMEOUT          = 6,
+       WL_NAN_DPEND_E_NO_ELT           = 7,    /* rx frame missing element container */
+       WL_NAN_DPEND_E_NO_NDP_ATTR      = 8,
+       WL_NAN_DPEND_E_NO_AVAIL_ATTR    = 9,
+       WL_NAN_DPEND_E_NO_NDC_ATTR      = 10,
+       WL_NAN_DPEND_E_NO_RANGE_BM      = 11,
+       WL_NAN_DPEND_E_INVALID_NDP_ATTR = 12,
+       WL_NAN_DPEND_E_INVALID_NDC_ATTR = 13,
+       WL_NAN_DPEND_E_INVALID_IMMUT    = 14,
+       WL_NAN_DPEND_E_INVALID_NDL_QOS  = 15,
+       WL_NAN_DPEND_E_INVALID_SEC_PARAMS = 16,
+       WL_NAN_DPEND_E_REJECT_AVAIL     = 17,
+       WL_NAN_DPEND_E_REJECT_NDL       = 18,
+       WL_NAN_DPEND_E_SCB_NORESOURCE   = 19
+};
+
+typedef int32 wl_nan_status_t;
+
+/** nan cmd list entry  */
+enum wl_nan_sub_cmd_input_flags {
+       WL_NAN_SUB_CMD_FLAG_NONE = 0,
+       WL_NAN_SUB_CMD_FLAG_SKIP = 1, /* Skip to next sub-command on error */
+       WL_NAN_SUB_CMD_FLAG_TERMINATE = 2, /* Terminate processing and return */
+       WL_NAN_SUB_CMD_FLAG_LAST /* Keep this at the end */
+};
+
+/** container for nan events */
+typedef struct wl_nan_ioc {
+       uint16  version;        /**< interface command or event version */
+       uint16  id;                     /**< nan ioctl cmd  ID  */
+       uint16  len;            /**< total length of all tlv records in data[]  */
+       uint16  pad;            /**< pad to be 32 bit aligment */
+       uint8   data [];        /**< var len payload of bcm_xtlv_t type */
+} wl_nan_ioc_t;
+
+/*
+ * NAN sub-command data structures
+ */
+
+/*
+ * Config component WL_NAN_CMD_CFG_XXXX sub-commands
+ * WL_NAN_CMD_CFG_ENABLE
+ */
+enum wl_nan_config_state {
+       WL_NAN_CONFIG_STATE_DISABLE = 0,
+       WL_NAN_CONFIG_STATE_ENABLE = 1
+};
+
+typedef int8 wl_nan_config_state_t;
+
+/* WL_NAN_CMD_CFG_NAN_INIT */
+
+typedef uint8 wl_nan_init_t;
+
+/* WL_NAN_CMD_CFG_NAN_VERSION */
+typedef uint16 wl_nan_ver_t;
+
+/* WL_NAN_CMD_CFG_NAN_CONFIG  */
+typedef uint32 wl_nan_cfg_ctrl_t;
+
+/* WL_NAN_CMD_CFG_NAN_CONFIG2 */
+typedef struct wl_nan_cfg_ctrl2 {
+       uint32 flags1; /* wl_nan_cfg_ctrl2_flags1 */
+       uint32 flags2; /* wl_nan_cfg_ctrl2_flags2 */
+} wl_nan_cfg_ctrl2_t;
+
+enum wl_nan_cfg_ctrl2_flags1 {
+       /* Allows unicast SDF TX while local device is under NDP/NDL negotiation,
+        * but Not with the peer SDF destined to.
+        */
+       WL_NAN_CTRL2_FLAG1_ALLOW_SDF_TX_UCAST_IN_PROG   = 0x00000001,
+       /* Allows broadcast SDF TX while local device is under NDP/NDL negotiation */
+       WL_NAN_CTRL2_FLAG1_ALLOW_SDF_TX_BCAST_IN_PROG   = 0x00000002,
+       /* Allows the device to send schedule update automatically on local schedule change */
+       WL_NAN_CTRL2_FLAG1_AUTO_SCHEDUPD                = 0x00000004,
+       /* Allows the device to handle slot pre_close operations */
+       WL_NAN_CTRL2_FLAG1_SLOT_PRE_CLOSE               = 0x00000008,
+       /* Control flag to enable/disable NDPE capability */
+       WL_NAN_CTRL2_FLAG1_NDPE_CAP                     = 0x000000010,
+       /* Control flag to enable/disable AUTO DAM LWT mode */
+       WL_NAN_CTRL2_FLAG1_AUTODAM_LWT_MODE             = 0x000000020,
+       /* Control flag to enable/disable PMK per NDP */
+       WL_NAN_CTRL2_FLAG1_PMK_PER_NDP          = 0x000000040
+};
+#define WL_NAN_CTRL2_FLAGS1_MASK       0x0000007F
+
+#define WL_NAN_CTRL2_FLAGS2_MASK       0x00000000
+
+/*
+ * WL_NAN_CMD_CFG_BAND, WL_NAN_CMD_CFG_RSSI_THRESHOLD(Get only)
+ */
+typedef uint8 wl_nan_band_t;
+
+/*
+ * WL_NAN_CMD_CFG_ROLE
+ */
+enum wl_nan_role {
+       WL_NAN_ROLE_AUTO = 0,
+       WL_NAN_ROLE_NON_MASTER_NON_SYNC = 1,
+       WL_NAN_ROLE_NON_MASTER_SYNC = 2,
+       WL_NAN_ROLE_MASTER = 3,
+       WL_NAN_ROLE_ANCHOR_MASTER = 4
+};
+
+typedef uint8 wl_nan_role_t;
+
+typedef struct wl_nan_device_state
+{
+       wl_nan_role_t role;             /* Sync Master, Non-Sync Master */
+       uint8 state;    /* TBD  */
+       uint8 hopcount; /* Hops to the Anchor Master */
+       struct ether_addr immediate_master; /* Master MAC */
+       struct ether_addr anchor_master;        /* Anchor Master MAC */
+       struct ether_addr cluster_id; /* Cluster ID to which this device belongs to */
+       uint8 PAD[3];
+       uint32 tsf_high;  /* NAN Cluster TSFs */
+       uint32 tsf_low;
+} wl_nan_device_state_t;
+
+/*
+ * WL_NAN_CMD_CFG_HOP_CNT, WL_NAN_CMD_CFG_HOP_LIMIT
+ */
+typedef uint8 wl_nan_hop_count_t;
+
+/*
+ * WL_NAN_CMD_CFG_WARMUP_TIME
+ */
+typedef uint32 wl_nan_warmup_time_ticks_t;
+
+/*
+ * WL_NAN_CMD_CFG_RSSI_THRESHOLD
+ * rssi_close and rssi_mid are used to transition master to non-master
+ * role by NAN state machine. rssi thresholds corresponding to the band
+ * will be updated.
+ */
+/* To be deprecated */
+typedef struct wl_nan_rssi_threshold {
+       wl_nan_band_t band;
+       int8 rssi_close;
+       int8 rssi_mid;
+       uint8 pad;
+} wl_nan_rssi_threshold_t;
+
+/* WL_NAN_CMD_ELECTION_RSSI_THRESHOLD */
+
+typedef struct wl_nan_rssi_thld {
+       int8 rssi_close_2g;
+       int8 rssi_mid_2g;
+       int8 rssi_close_5g;
+       int8 rssi_mid_5g;
+} wl_nan_rssi_thld_t;
+
+/* WL_NAN_CMD_DATA_MAX_PEERS */
+
+typedef uint8 wl_nan_max_peers_t;
+
+/*
+ * WL_NAN_CMD_CFG_STATUS
+ */
+
+typedef enum wl_nan_election_mode {
+       WL_NAN_ELECTION_RUN_BY_HOST = 1,
+       WL_NAN_ELECTION_RUN_BY_FW = 2
+} wl_nan_election_mode_t;
+
+typedef struct wl_nan_conf_status {
+       struct ether_addr       nmi;            /*  NAN mgmt interface address */
+       uint8                   enabled;        /* NAN is enabled */
+       uint8                   role;           /* Current nan sync role */
+       struct ether_addr       cid;            /*  Current Cluster id */
+       uint8                   social_chans[2];        /* Social channels */
+       uint8                   mr[8];          /* Self Master Rank */
+       uint8                   amr[8];         /* Anchor Master Rank */
+       uint32                  ambtt;          /* Anchor master beacon target time */
+       uint32                  cluster_tsf_h;  /* Current Cluster TSF High */
+       uint32                  cluster_tsf_l;  /* Current Cluster TSF Low */
+       uint8                   election_mode; /* Election mode, host or firmware */
+       uint8                   hop_count;      /* Current Hop count */
+       uint8                   imr[8];         /* Immediate Master Rank */
+       uint8                   pad[4];         /* remove after precommit */
+       uint16                  opt_tlvs_len;
+       uint8                   opt_tlvs[];
+} wl_nan_conf_status_t;
+
+/*
+ * WL_NAN_CMD_CFG_OUI
+ */
+typedef struct wl_nan_oui_type {
+       uint8 nan_oui[DOT11_OUI_LEN];
+       uint8 type;
+} wl_nan_oui_type_t;
+
+/*
+ * WL_NAN_CMD_CFG_COUNT
+ */
+typedef struct wl_nan_count {
+       uint32 cnt_bcn_tx;              /**< TX disc/sync beacon count */
+       uint32 cnt_bcn_rx;              /**< RX disc/sync beacon count */
+       uint32 cnt_svc_disc_tx;         /**< TX svc disc frame count */
+       uint32 cnt_svc_disc_rx;         /**< RX svc disc frame count */
+} wl_nan_count_t;
+/*
+ * Election component WL_NAN_CMD_ELECTION_XXXX sub-commands
+ * WL_NAN_CMD_ELECTION_HOST_ENABLE
+ */
+enum wl_nan_enable_flags {
+       WL_NAN_DISABLE_FLAG_HOST_ELECTION = 0,
+       WL_NAN_ENABLE_FLAG_HOST_ELECTION = 1
+};
+
+/*
+ * 0 - disable host based election
+ * 1 - enable host based election
+ */
+typedef uint8 wl_nan_host_enable_t;
+
+/*
+ * WL_NAN_CMD_ELECTION_METRICS_CONFIG
+ */
+/* Set only */
+typedef struct wl_nan_election_metric_config {
+       uint8 random_factor; /* Configured random factor */
+       uint8 master_pref;      /* configured master preference */
+       uint8 pad[2];
+} wl_nan_election_metric_config_t;
+
+/*
+ * WL_NAN_CMD_ELECTION_METRICS_STATE
+ */
+/* Get only */
+typedef struct wl_nan_election_metric_state {
+       uint8 random_factor; /* random factor used in MIs */
+       uint8 master_pref;       /* Master advertised in MIs */
+       uint8 pad[2];
+} wl_nan_election_metric_state_t;
+
+/*
+ * WL_NAN_CMD_ELECTION_LEAVE
+ * WL_NAN_CMD_ELECTION_STOP
+ */
+typedef struct ether_addr wl_nan_cluster_id_t;
+
+#define NHO_SEC_NCS_SK_REPLAY_CNT_LEN    8u
+/* kck */
+#define NHO_SEC_NCS_SK_256_KCK_LEN         24u  /* refer nan2 r21 7.1.4.1 */
+/* kek */
+#define NHO_SEC_NCS_SK_256_KEK_LEN         32u  /* refer nan2 r21 7.1.4.1 */
+/* tk */
+#define NHO_SEC_NCS_SK_256_TK_LEN          32u  /* refer nan2 r21 section 7 */
+
+#define NHO_SEC_NCS_SK_MAX_KEY_LEN      (NHO_SEC_NCS_SK_256_KCK_LEN \
+                                       + NHO_SEC_NCS_SK_256_KEK_LEN \
+                                       + NHO_SEC_NCS_SK_256_TK_LEN)
+
+#define NHO_SEC_KEY_INSTALL_FLAG                 (1 << 0)
+#define NHO_SEC_KEY_UNINSTALL_FLAG               (1 << 1)
+
+/* WL_NAN_XTLV_NANHO_SEC_SA */
+typedef struct nanho_sec_sa {
+       int8 csid;      /* Cipher suite ID to identify the security type */
+       uint8 kck_len; /* KCK len in key_buf */
+       uint8 kek_len; /* KEK len in key_buf */
+       uint8 tk_len; /* Transient key len in key_buf */
+       uint16 flags;
+       uint16 pad;
+       struct ether_addr laddr;        /* local mac addr */
+       struct ether_addr raddr;        /* remote mac addr */
+       uint8 key_krc[NHO_SEC_NCS_SK_REPLAY_CNT_LEN];   /* Key Replay ctr */
+       uint8 key_buf[NHO_SEC_NCS_SK_MAX_KEY_LEN];              /* PTK = KCK + KEK + TK */
+} nanho_sec_sa_t;
+
+/*
+ * WL_NAN_CMD_ELECTION_MERGE
+ * 0 - disable cluster merge
+ * 1 - enable cluster merge
+ */
+typedef uint8 wl_nan_merge_enable_t;
+
+/*
+ * WL_NAN_CMD_CFG_ROLE
+ * role = 0 means configuration by firmware(obsolete); otherwise by host
+ * when host configures role, also need target master address to sync to
+ */
+#define NAN_SYNC_MASTER_SELF   1
+#define NAN_SYNC_MASTER_USE_TIMING             2       /*  Use the tsf timing provided */
+#define NAN_SYNC_MASTER_AMREC_UPD              4       /* provide AM record update */
+
+/*
+       struct ether_addr addr:
+       when NAN_SYNC_MASTER_USE_TIMING is set, addr is the mac of Rx NAN beacon
+       providing the timing info
+       ltsf_h, ltsf_l:
+       The local TSF timestamp filled in by FW in the WL_NAN_EVENT_BCN_RX event;
+       rtsf_h, rtsf_l:
+       The timestamp in the Rx beacon frame, filled in by host
+       uint32 ambtt:
+       the amtt in the cluster ID attribute in the Rx beacon frame
+*/
+
+typedef struct nan_sync_master {
+       uint8 flag;     /*  1: self; 2: use TSF timing; 4: AMR update */
+       uint8  hop_count;
+       struct ether_addr addr;
+       struct ether_addr cluster_id;
+       chanspec_t channel; /* bcn reception channel */
+       uint32 ltsf_h;
+       uint32 ltsf_l;
+       uint32 rtsf_h;
+       uint32 rtsf_l;
+       uint8 amr[WL_NAN_MASTER_RANK_LEN];
+       uint32 ambtt;
+} nan_sync_master_t;
+
+/* NAN advertiser structure */
+/* TODO RSDB: add chspec to indicates core corresponds correct core */
+typedef struct nan_adv_entry {
+       uint8 age;      /* used to remove stale entries */
+       uint8 hop_count;        /* for NTLV support, use bit7 for virtual NAN peer */
+       struct ether_addr addr;
+       struct ether_addr cluster_id;
+       chanspec_t channel; /* bcn reception channel */
+       uint32 ltsf_h;
+       uint32 ltsf_l;
+       uint32 rtsf_h;
+       uint32 rtsf_l;
+       uint8 amr[WL_NAN_MASTER_RANK_LEN];
+       uint32 ambtt;
+       int8    rssi[NAN_MAX_BANDS];            /* rssi last af was received at */
+       int8    last_rssi[NAN_MAX_BANDS];       /* rssi in the last AF */
+} nan_adv_entry_t;
+#define NAN_VIRTUAL_PEER_BIT   0x80
+
+typedef enum {
+       NAC_CNT_NTLV_AF_TX = 0,         /* count of AF containing NTLV tx */
+       NAC_CNT_NTLV_AF_RX,             /* count of AF containing NTLV rx */
+       NAC_CNT_NTLV_TMERR_TX,          /* count of NTLV tx timing error */
+       NAC_CNT_NTLV_TMERR_RX,          /* count of NTLV rx timing error */
+       NAC_CNT_NTLV_TM_MISMATCH,       /* count of TopMaster mismatch in Rx NTLV processing */
+       NAC_CNT_NTLV_ADV_EXISTED,       /* count of NTLV ignored bc advertiser existed from bcn */
+       NAC_CNT_NTLV_STALED_BCN,        /* count of staled bcn from NTLV info */
+       NAC_CNT_NTLV_MERGE,             /* count of NTLV used for NAN cluster merge */
+       NAC_CNT_NTLV_ELECTION_DROP,     /* count of NTLV dropped in NAN election */
+       NAC_CNT_NTLV_TSF_ADOPT,         /* count of NTLV used for NAN TSF adoption */
+       NAC_CNT_NTLV_LAST
+} nac_cnt_enum_t;
+
+#define NAC_MAX_CNT    (NAC_CNT_NTLV_LAST)
+
+typedef struct nac_stats {
+       uint32 nac_cnt[NAC_MAX_CNT];
+} nac_stats_t;
+
+typedef struct nan_adv_table {
+       uint8  num_adv;
+       uint8   adv_size;
+       uint8   pad[2];
+       nan_adv_entry_t adv_nodes[0];
+} nan_adv_table_t;
+
+typedef struct wl_nan_role_cfg {
+       wl_nan_role_t cfg_role;
+       wl_nan_role_t cur_role;
+       uint8 pad[2];
+       nan_sync_master_t target_master;
+} wl_nan_role_cfg_t;
+
+typedef struct wl_nan_role_config {
+       wl_nan_role_t role;
+       struct ether_addr target_master;
+       uint8 pad;
+} wl_nan_role_config_t;
+
+typedef int8 wl_nan_sd_optional_field_types_t;
+
+/* Flag bits for Publish and Subscribe (wl_nan_sd_params_t flags) */
+
+/* First 8 bits are blocked for mapping
+ * against svc_control flag bits which goes out
+ * as part of SDA attribute in air in SDF frames
+ */
+#define WL_NAN_RANGE_LIMITED           0x0040
+
+/* Event generation indicator (default is continuous) */
+
+#define WL_NAN_MATCH_ONCE              0x100000
+#define WL_NAN_MATCH_NEVER             0x200000
+
+/* Bits specific to Publish */
+
+#define WL_NAN_PUB_UNSOLICIT   0x1000  /* Unsolicited Tx */
+#define WL_NAN_PUB_SOLICIT             0x2000  /* Solicited Tx */
+#define WL_NAN_PUB_BOTH                        0x3000  /* Both the above */
+
+#define WL_NAN_PUB_BCAST               0x4000  /* bcast solicited Tx only */
+#define WL_NAN_PUB_EVENT               0x8000  /* Event on each solicited Tx */
+#define WL_NAN_PUB_SOLICIT_PENDING     0x10000 /* Used for one-time solicited Publish */
+
+#define WL_NAN_FOLLOWUP                        0x20000 /* Follow-up frames */
+#define WL_NAN_TX_FOLLOWUP             0x40000 /* host generated transmit Follow-up frames */
+
+/* Bits specific to Subscribe */
+
+#define WL_NAN_SUB_ACTIVE              0x1000 /* Active subscribe mode */
+#define WL_NAN_SUB_MATCH_IF_SVC_INFO   0x2000 /* Service info in publish */
+
+#define WL_NAN_TTL_UNTIL_CANCEL        0xFFFFFFFF /* Special values for time to live (ttl) parameter */
+
+/*
+ * Publish -  runs until first transmission
+ * Subscribe - runs until first  DiscoveryResult event
+ */
+#define WL_NAN_TTL_FIRST       0
+
+/* Nan Service Based control Flags */
+
+/* If set, dev will take care of dp_resp */
+#define WL_NAN_SVC_CTRL_AUTO_DPRESP               0x1000000
+
+/* If set, host wont rec event "receive" */
+#define WL_NAN_SVC_CTRL_SUPPRESS_EVT_RECEIVE      0x2000000
+
+/* If set, host wont rec event "replied" */
+#define WL_NAN_SVC_CTRL_SUPPRESS_EVT_REPLIED      0x4000000
+
+/* If set, host wont rec event "terminated" */
+#define WL_NAN_SVC_CTRL_SUPPRESS_EVT_TERMINATED   0x8000000
+
+/*
+ * WL_NAN_CMD_SD_PARAMS
+ */
+typedef struct wl_nan_sd_params
+{
+       uint16  length; /* length including options */
+       uint8   period; /* period of the unsolicited SDF xmission in DWs */
+       uint8   awake_dw; /* interval between two DWs where SDF tx/rx are done */
+       uint8   svc_hash[WL_NAN_SVC_HASH_LEN]; /* Hash for the service name */
+       uint8   instance_id; /* Instance of the current service */
+       int8    proximity_rssi; /* RSSI limit to Rx subscribe or pub SDF 0 no effect */
+       uint32  flags; /* bitmap representing aforesaid optional flags */
+       int32   ttl; /* TTL for this instance id, -1 will run till cancelled */
+       tlv_t   optional[1]; /* optional fields in the SDF  as appropriate */
+} wl_nan_sd_params_t;
+
+/*
+ * WL_NAN_CMD_SD_PUBLISH_LIST
+ * WL_NAN_CMD_SD_SUBSCRIBE_LIST
+ */
+typedef struct wl_nan_service_info
+{
+       uint8 instance_id;      /* Publish instance ID */
+       uint8 service_hash[WL_NAN_SVC_HASH_LEN]; /* Hash for service name */
+} wl_nan_service_info_t;
+
+typedef struct wl_nan_service_list
+{
+       uint16 id_count; /* Number of registered publish/subscribe services */
+       wl_nan_service_info_t list[1]; /* service info defined by nan_service instance */
+} wl_nan_service_list_t;
+
+/*
+ * WL_NAN_CMD_CFG_BCN_INTERVAL
+ */
+typedef uint16 wl_nan_disc_bcn_interval_t;
+
+/*
+ * WL_NAN_CMD_CFG_SDF_TXTIME
+ */
+typedef uint16 wl_nan_svc_disc_txtime_t;
+
+/*
+ * WL_NAN_CMD_CFG_STOP_BCN_TX
+ */
+typedef uint16 wl_nan_stop_bcn_tx_t;
+
+/*
+ * WL_NAN_CMD_CFG_SID_BEACON
+ */
+typedef struct wl_nan_sid_beacon_control {
+       uint8 sid_enable;       /* Flag to indicate the inclusion of Service IDs in Beacons */
+       uint8 sid_count;        /* Limit for number of publish SIDs to be included in Beacons */
+       uint8 sub_sid_count;    /* Limit for number of subscribe SIDs to be included in Beacons */
+       uint8 pad;
+} wl_nan_sid_beacon_control_t;
+
+/*
+ * WL_NAN_CMD_CFG_DW_LEN
+ */
+typedef uint16 wl_nan_dw_len_t;
+
+/*
+ * WL_NAN_CMD_CFG_AWAKE_DW   Will be deprecated.
+ */
+typedef struct wl_nan_awake_dw {
+       wl_nan_band_t band;     /* 0 - b mode 1- a mode */
+       uint8 interval;         /* 1 or 2 or 4 or 8 or 16 */
+       uint16 pad;
+} wl_nan_awake_dw_t;
+
+/*
+ * WL_NAN_CMD_CFG_AWAKE_DWS
+ */
+typedef struct wl_nan_awake_dws {
+       uint8 dw_interval_2g;   /* 2G DW interval */
+       uint8 dw_interval_5g;   /* 5G DW interval */
+       uint16 pad;
+} wl_nan_awake_dws_t;
+
+/* WL_NAN_CMD_SYNC_BCN_RSSI_NOTIF_THRESHOLD */
+
+typedef struct wl_nan_rssi_notif_thld {
+       int8 bcn_rssi_2g;
+       int8 bcn_rssi_5g;
+       int16 pad;
+} wl_nan_rssi_notif_thld_t;
+
+/*
+ * WL_NAN_CMD_CFG_SOCIAL_CHAN
+ */
+typedef struct wl_nan_social_channels {
+       uint8 soc_chan_2g;      /* 2G social channel */
+       uint8 soc_chan_5g;      /* 5G social channel */
+       uint16 pad;
+} wl_nan_social_channels_t;
+
+/*
+ * WL_NAN_CMD_SD_CANCEL_PUBLISH
+ * WL_NAN_CMD_SD_CANCEL_SUBSCRIBE
+ */
+typedef uint8 wl_nan_instance_id; /* Instance ID of an active publish instance */
+
+/*
+ * WL_NAN_CMD_SD_VND_INFO
+ */
+typedef struct wl_nan_sd_vendor_info
+{
+       uint16 length; /* Size in bytes of the payload following this field */
+       uint8 data[];   /* Vendor Information */
+} wl_nan_sd_vendor_info_t;
+
+/*
+ * WL_NAN_CMD_SD_STATS
+ */
+typedef struct wl_nan_sd_stats {
+       uint32  sdftx;
+       uint32  sdfrx;
+       uint32  sdsrffail;
+       uint32  sdrejrssi;
+       uint32  sdfollowuprx;
+       uint32  sdsubmatch;
+       uint32  sdpubreplied;
+       uint32  sdmftfail1;
+       uint32  sdmftfail2;
+       uint32  sdmftfail3;
+       uint32  sdmftfail4;
+}  wl_nan_sd_stats_t;
+
+/* Flag bits for sd transmit message (wl_nan_sd_transmit_t flags) */
+
+/* If set, host wont rec "tx status" event for tx-followup msg */
+#define WL_NAN_FUP_SUPR_EVT_TXS      0x01
+/* more flags can be added here */
+
+/*
+ * WL_NAN_CMD_SD_TRANSMIT
+ * WL_NAN_CMD_SD_FUP_TRANSMIT
+ */
+typedef struct wl_nan_sd_transmit {
+       uint8   local_service_id;               /* Sender Service ID */
+       uint8   requestor_service_id;           /* Destination Service ID */
+       struct ether_addr destination_addr;     /* Destination MAC */
+       uint16  token;                          /* follow_up_token when a follow-up
+                                                * msg is queued successfully
+                                                */
+       uint8   priority;                       /* requested relative prio */
+       uint8   flags;                          /* Flags for tx follow-up msg */
+       uint16  opt_len;                        /* total length of optional tlvs */
+       uint8   opt_tlv[];                      /* optional tlvs in bcm_xtlv_t type */
+} wl_nan_sd_transmit_t;
+
+/* disc cache timeout for a cache entry */
+typedef uint16 wl_nan_disc_cache_timeout_t;
+
+/*
+ * WL_NAN_CMD_SYNC_TSRESERVE
+ */
+/** time slot */
+#define NAN_MAX_TIMESLOT       32
+typedef struct wl_nan_timeslot {
+       uint32  abitmap; /**< available bitmap */
+       uint32 chanlist[NAN_MAX_TIMESLOT];
+} wl_nan_timeslot_t;
+
+/*
+ * Deprecated
+ *
+ * WL_NAN_CMD_SYNC_TSRELEASE
+ */
+typedef uint32 wl_nan_ts_bitmap_t;
+
+/* nan passive scan params */
+#define NAN_SCAN_MAX_CHCNT 8
+/* nan merge scan params */
+typedef struct wl_nan_scan_params {
+       /* dwell time of discovery channel corresponds to band_idx.
+        * If set to 0 then fw default will be used.
+        */
+       uint16 dwell_time;
+       /* scan period of  discovery channel corresponds to band_idx.
+        * If set to 0 then fw default will be used.
+        */
+       uint16 scan_period;
+       /* band index of discovery channel */
+       uint8 band_index;
+} wl_nan_scan_params_t;
+
+/*
+ * WL_NAN_CMD_DBG_SCAN
+ */
+typedef struct wl_nan_dbg_scan {
+       struct ether_addr cid;
+       uint8 pad[2];
+} wl_nan_dbg_scan_t;
+
+/* NAN_DBG_LEVEL */
+typedef struct wl_nan_dbg_level {
+       uint32 nan_err_level; /* for Error levels */
+       uint32 nan_dbg_level; /* for bebug logs and trace */
+       uint32 nan_info_level; /* for dumps like prhex */
+} wl_nan_dbg_level_t;
+
+/*
+ * WL_NAN_CMD_DBG_EVENT_MASK
+ */
+typedef uint32 wl_nan_event_mask_t;
+
+/*
+ * WL_NAN_CMD_DBG_EVENT_CHECK
+ */
+typedef uint8 wl_nan_dbg_ifname[BCM_MSG_IFNAME_MAX];
+
+/*
+ * WL_NAN_CMD_DBG_DUMP
+ * WL_NAN_CMD_DBG_CLEAR
+ */
+enum wl_nan_dbg_dump_type {
+       WL_NAN_DBG_DT_RSSI_DATA = 1,
+       WL_NAN_DBG_DT_STATS_DATA = 2,
+       /*
+        * Additional enums before this line
+        */
+       WL_NAN_DBG_DT_INVALID
+};
+typedef int8 wl_nan_dbg_dump_type_t;
+
+/** various params and ctl swithce for nan_debug instance  */
+/*
+ * WL_NAN_CMD_DBG_DEBUG
+ */
+typedef struct wl_nan_debug_params {
+       uint16  cmd;    /**< debug cmd to perform a debug action */
+       uint16  status;
+       uint32  msglevel; /**< msg level if enabled */
+       uint8   enabled; /**< runtime debuging enabled */
+       uint8 collect;
+       uint8 PAD[2];
+} wl_nan_debug_params_t;
+
+typedef struct wl_nan_sched_svc_timeslot_s {
+       uint32 abitmap; /* availability bitmap */
+       uint32 chanlist[NAN_MAX_TIMESLOT];
+       uint8  res; /* resolution: 0 = 16ms, 1 = 32ms, 2 = 64ms 3 = reserved. REfer NAN spec */
+       uint8  mapid; /* mapid from NAN spec. Used to differentiate 2G Vs 5G band */
+       uint8 PAD[2];
+} wl_nan_sched_svc_timeslot_t;
+
+/*
+ * WL_NAN_CMD_DATA_DP_IDLE_PERIOD
+ */
+typedef uint16 wl_nan_ndp_idle_period_t;
+
+/*
+ * WL_NAN_CMD_DATA_DP_HB_DURATION
+ */
+typedef uint16 wl_nan_ndp_hb_duration_t;
+
+/* nan cmd IDs */
+enum wl_nan_cmds {
+        /* nan cfg /disc & dbg ioctls */
+       WL_NAN_CMD_ENABLE = 1,
+       WL_NAN_CMD_ATTR = 2,
+       WL_NAN_CMD_NAN_JOIN = 3,
+       WL_NAN_CMD_LEAVE = 4,
+       WL_NAN_CMD_MERGE = 5,
+       WL_NAN_CMD_STATUS = 6,
+       WL_NAN_CMD_TSRESERVE = 7,
+       WL_NAN_CMD_TSSCHEDULE = 8,
+       WL_NAN_CMD_TSRELEASE = 9,
+       WL_NAN_CMD_OUI = 10,
+       WL_NAN_CMD_OOB_AF = 11,
+       WL_NAN_CMD_SCAN_PARAMS = 12,
+
+       WL_NAN_CMD_COUNT = 15,
+       WL_NAN_CMD_CLEARCOUNT = 16,
+
+       /*  discovery engine commands */
+       WL_NAN_CMD_PUBLISH = 20,
+       WL_NAN_CMD_SUBSCRIBE = 21,
+       WL_NAN_CMD_CANCEL_PUBLISH = 22,
+       WL_NAN_CMD_CANCEL_SUBSCRIBE = 23,
+       WL_NAN_CMD_TRANSMIT = 24,
+       WL_NAN_CMD_CONNECTION = 25,
+       WL_NAN_CMD_SHOW = 26,
+       WL_NAN_CMD_STOP = 27,   /* stop nan for a given cluster ID  */
+       /*  nan debug iovars & cmds  */
+       WL_NAN_CMD_SCAN = 47,
+       WL_NAN_CMD_SCAN_RESULTS = 48,
+       WL_NAN_CMD_EVENT_MASK = 49,
+       WL_NAN_CMD_EVENT_CHECK = 50,
+       WL_NAN_CMD_DUMP = 51,
+       WL_NAN_CMD_CLEAR = 52,
+       WL_NAN_CMD_RSSI = 53,
+
+       WL_NAN_CMD_DEBUG = 60,
+       WL_NAN_CMD_TEST1 = 61,
+       WL_NAN_CMD_TEST2 = 62,
+       WL_NAN_CMD_TEST3 = 63,
+       WL_NAN_CMD_DISC_RESULTS = 64,
+       /* nan 2.0 data path commands */
+       WL_NAN_CMD_DATAPATH = 65
+};
+
+/*   NAN DP interface commands  */
+enum wl_nan_dp_cmds {
+       /* nan 2.0 ioctls */
+       WL_NAN_CMD_DP_CAP = 1000,
+       WL_NAN_CMD_DP_CONFIG = 1001,
+       WL_NAN_CMD_DP_CREATE = 1002,
+       WL_NAN_CMD_DP_AUTO_CONNECT = 1003,
+       WL_NAN_CMD_DP_DATA_REQ = 1004,
+       WL_NAN_CMD_DP_DATA_RESP = 1005,
+       WL_NAN_CMD_DP_SCHED_UPD = 1006,
+       WL_NAN_CMD_DP_END = 1007,
+       WL_NAN_CMD_DP_CONNECT = 1008,
+       WL_NAN_CMD_DP_STATUS = 1009
+};
+
+/* TODO Should remove this fixed length */
+#define WL_NAN_DATA_SVC_SPEC_INFO_LEN 32 /* arbitrary */
+#define WL_NAN_DP_MAX_SVC_INFO       0xFF
+#define WL_NAN_DATA_NDP_INST_SUPPORT 16
+
+/* Nan flags (16 bits) */
+#define WL_NAN_DP_FLAG_SVC_INFO                0x0001
+#define WL_NAN_DP_FLAG_CONFIRM         0x0002
+#define WL_NAN_DP_FLAG_EXPLICIT_CFM    0x0004
+#define WL_NAN_DP_FLAG_SECURITY                0x0008
+#define WL_NAN_DP_FLAG_HAST_NDL_COUNTER        0x0010 /* Host assisted NDL counter */
+
+/* NAN Datapath host status */
+#define WL_NAN_DP_STATUS_ACCEPTED     1
+#define WL_NAN_DP_STATUS_REJECTED     0
+
+/* to be done */
+typedef struct wl_nan_dp_cap {
+       uint8 tbd;
+} wl_nan_dp_cap_t;
+
+/** The service hash (service id) is exactly this many bytes. */
+#define WL_NAN_SVC_HASH_LEN    6
+/** Number of hash functions per bloom filter */
+#define WL_NAN_HASHES_PER_BLOOM 4
+/* no. of max last disc results */
+#define WL_NAN_MAX_DISC_RESULTS        3
+
+/* NAN security related defines */
+/* NCS-SK related */
+#define WL_NAN_NCS_SK_PMK_LEN  32
+#define WL_NAN_NCS_SK_PMKID_LEN        16
+
+/* recent discovery results */
+typedef struct wl_nan_disc_result_s
+{
+       wl_nan_instance_id_t instance_id;       /* instance id of pub/sub req */
+       wl_nan_instance_id_t peer_instance_id;  /* peer instance id of pub/sub req/resp */
+       uint8 svc_hash[WL_NAN_SVC_HASH_LEN];    /* service descp string */
+       struct ether_addr peer_mac;     /* peer mac address */
+} wl_nan_disc_result_t;
+
+/* list of recent discovery results */
+typedef struct wl_nan_disc_results_s
+{
+       wl_nan_disc_result_t disc_result[WL_NAN_MAX_DISC_RESULTS];
+} wl_nan_disc_results_list_t;
+
+/* nan 1.0 events */
+/* To be deprecated - will be replaced by event_disc_result */
+typedef struct wl_nan_ev_disc_result {
+       wl_nan_instance_id_t pub_id;
+       wl_nan_instance_id_t sub_id;
+       struct ether_addr pub_mac;
+       uint8 opt_tlvs[0];
+} wl_nan_ev_disc_result_t;
+
+typedef struct wl_nan_event_disc_result {
+       wl_nan_instance_id_t pub_id;
+       wl_nan_instance_id_t sub_id;
+       struct ether_addr pub_mac;
+       int8            publish_rssi;           /* publisher RSSI */
+       uint8           attr_num;
+       uint16          attr_list_len;  /* length of the all the attributes in the SDF */
+       uint8           attr_list[0];   /* list of NAN attributes */
+} wl_nan_event_disc_result_t;
+
+typedef struct wl_nan_ev_p2p_avail {
+       struct ether_addr sender;
+       struct ether_addr p2p_dev_addr;
+       uint8 dev_role;
+       uint8 resolution;
+       uint8 repeat;
+       uint8 pad[3];
+       chanspec_t chanspec;
+       uint32 avail_bmap;
+} wl_nan_ev_p2p_avail_t;
+
+/*
+* discovery interface event structures *
+*/
+
+enum wl_nan_oob_af_flags {
+       WL_NAN_OOB_AF_FLAG_SEND_EVENT   = 0x0001, /* send tx status event */
+       WL_NAN_OOB_AF_FLAG_FLUSH_PCB    = 0x0002, /* flush PCB */
+       WL_NAN_OOB_AF_FLAG_ADD_DCAP     = 0x0004, /* add dev cap attr into NAF body */
+       WL_NAN_OOB_AF_FLAG_ADD_ELMT     = 0x0008, /* add elmt container attr into NAF body */
+       WL_NAN_OOB_AF_FLAG_MFP_REQUIRED = 0x0010  /* MFP required */
+};
+typedef uint16 wl_nan_oob_af_flags_t;
+
+/* mandatory parameters for OOB action frame */
+typedef struct wl_nan_oob_af_params_s
+{
+       uint8 fup_lcl_id;       /* local instance ID of follow-up SDF */
+       uint8 fup_peer_id;      /* peer instance ID of follow-up SDF */
+       uint8 sdf_type;         /* represented by service control type NAN_SC_XXX */
+       uint8 unused_uint8;
+       uint32 unused_uint32;
+       struct ether_addr bssid;
+       struct ether_addr dest;
+       uint32 pkt_lifetime;
+       uint8 n2af_sub_type;    /* NAN2 AF sub type */
+       uint8 retry_cnt;        /* NAF tx retry (not 802.11 re-tx) */
+       uint16 token;           /* NAN host seq num */
+       uint16 flags;           /* wl_nan_oob_af_flags_t */
+       uint32 fsm_id;          /* unique fsm id */
+       uint16 payload_len;
+       uint8 payload[1];
+} wl_nan_oob_af_params_t;
+
+/* NAN Ranging */
+
+/* Bit defines for global flags */
+#define WL_NAN_RANGING_ENABLE          1 /**< enable RTT */
+#define WL_NAN_RANGING_RANGED          2 /**< Report to host if ranged as target */
+typedef struct nan_ranging_config {
+       uint32 chanspec;                /**< Ranging chanspec */
+       uint16 timeslot;                /**< NAN RTT start time slot  1-511 */
+       uint16 duration;                /**< NAN RTT duration in ms */
+       struct ether_addr allow_mac;    /**< peer initiated ranging: the allowed peer mac
+                                        * address, a unicast (for one peer) or
+                                        * a broadcast for all. Setting it to all zeros
+                                        * means responding to none,same as not setting
+                                        * the flag bit NAN_RANGING_RESPOND
+                                        */
+       uint16 flags;
+} wl_nan_ranging_config_t;
+
+/** list of peers for self initiated ranging */
+/** Bit defines for per peer flags */
+#define WL_NAN_RANGING_REPORT (1<<0)   /**< Enable reporting range to target */
+typedef struct nan_ranging_peer {
+       uint32 chanspec;                /**< desired chanspec for this peer */
+       uint32 abitmap;                 /**< available bitmap */
+       struct ether_addr ea;           /**< peer MAC address */
+       uint8 frmcnt;                   /**< frame count */
+       uint8 retrycnt;                 /**< retry count */
+       uint16 flags;                   /**< per peer flags, report or not */
+       uint16 PAD;
+} wl_nan_ranging_peer_t;
+typedef struct nan_ranging_list {
+       uint8 count;                    /**< number of MAC addresses */
+       uint8 num_peers_done;           /**< host set to 0, when read, shows number of peers
+                                        * completed, success or fail
+                                        */
+       uint8 num_dws;                  /**< time period to do the ranging, specified in dws */
+       uint8 reserve;                  /**< reserved field */
+       wl_nan_ranging_peer_t rp[1];    /**< variable length array of peers */
+} wl_nan_ranging_list_t;
+
+/* ranging results, a list for self initiated ranging and one for peer initiated ranging */
+/* There will be one structure for each peer */
+#define WL_NAN_RANGING_STATUS_SUCCESS          1
+#define WL_NAN_RANGING_STATUS_FAIL             2
+#define WL_NAN_RANGING_STATUS_TIMEOUT          3
+#define WL_NAN_RANGING_STATUS_ABORT            4 /**< with partial results if sounding count > 0 */
+typedef struct nan_ranging_result {
+       uint8 status;                   /**< 1: Success, 2: Fail 3: Timeout 4: Aborted */
+       uint8 sounding_count;           /**< number of measurements completed (0 = failure) */
+       struct ether_addr ea;           /**< initiator MAC address */
+       uint32 chanspec;                /**< Chanspec where the ranging was done */
+       uint32 timestamp;               /**< 32bits of the TSF timestamp ranging was completed at */
+       uint32 distance;                /**< mean distance in meters expressed as Q4 number.
+                                        * Only valid when sounding_count > 0. Examples:
+                                        * 0x08 = 0.5m
+                                        * 0x10 = 1m
+                                        * 0x18 = 1.5m
+                                        * set to 0xffffffff to indicate invalid number
+                                        */
+       int32 rtt_var;                  /**< standard deviation in 10th of ns of RTTs measured.
+                                        * Only valid when sounding_count > 0
+                                        */
+       struct ether_addr tgtea;        /**< target MAC address */
+       uint8 PAD[2];
+} wl_nan_ranging_result_t;
+typedef struct nan_ranging_event_data {
+       uint8 mode;                     /**< 1: Result of host initiated ranging */
+                                       /* 2: Result of peer initiated ranging */
+       uint8 reserved;
+       uint8 success_count;            /**< number of peers completed successfully */
+       uint8 count;                    /**< number of peers in the list */
+       wl_nan_ranging_result_t rr[1];  /**< variable array of ranging peers */
+} wl_nan_ranging_event_data_t;
+
+enum {
+       WL_NAN_STATS_RSSI = 1,
+       WL_NAN_STATS_DATA = 2,
+       WL_NAN_STATS_DP = 3,
+/*
+ * ***** ADD before this line ****
+ */
+       WL_NAN_STATS_INVALID
+};
+typedef struct wl_nan_dp_stats {
+       uint32 tbd; /* TBD */
+} wl_nan_dp_stats_t;
+
+typedef struct wl_nan_stats {
+       /* general */
+       uint32 cnt_dw; /* DW slots */
+       uint32 cnt_disc_bcn_sch; /* disc beacon slots */
+       uint32 cnt_amr_exp; /* count of ambtt expiries resetting roles */
+       uint32 cnt_bcn_upd; /* count of beacon template updates */
+       uint32 cnt_bcn_tx; /* count of sync & disc bcn tx */
+       uint32 cnt_bcn_rx; /* count of sync & disc bcn rx */
+       uint32 cnt_sync_bcn_tx; /* count of sync bcn tx within DW */
+       uint32 cnt_disc_bcn_tx; /* count of disc bcn tx */
+       uint32 cnt_sdftx_bcmc; /* count of bcast/mcast sdf tx */
+       uint32 cnt_sdftx_uc; /* count of unicast sdf tx */
+       uint32 cnt_sdftx_fail; /* count of unicast sdf tx fails */
+       uint32 cnt_sdf_rx; /* count of  sdf rx */
+       /* NAN roles */
+       uint32 cnt_am; /* anchor master */
+       uint32 cnt_master; /* master */
+       uint32 cnt_nms; /* non master sync */
+       uint32 cnt_nmns; /* non master non sync */
+       /* TX */
+       uint32 cnt_err_txtime; /* txtime in sync bcn frame not a multiple of dw intv */
+       uint32 cnt_err_unsch_tx; /* tx while not in DW/ disc bcn slot */
+       uint32 cnt_err_bcn_tx; /*  beacon tx error */
+       uint32 cnt_sync_bcn_tx_miss; /* no. of times time delta between 2 cosequetive
+                                               * sync beacons is more than expected
+                                               */
+       /* MSCH */
+       uint32 cnt_err_msch_reg; /* error is Dw/disc reg with msch */
+       uint32 cnt_err_wrong_ch_cb; /* count of msch calbacks in wrong channel */
+       uint32 cnt_dw_skip;     /* count of DW rejected */
+       uint32 cnt_disc_skip; /* count of disc bcn rejected */
+       uint32 cnt_dw_start_early; /* msch cb not at registered time */
+       uint32 cnt_dw_start_late; /* no. of delays in slot start */
+       /* SCANS */
+       uint32 cnt_mrg_scan; /* count of merge scans completed */
+       uint32 cnt_err_ms_rej; /* number of merge scan failed */
+       uint32 cnt_scan_results; /* no. of nan beacons scanned */
+       uint32 cnt_join_scan_rej; /* no. of join scans rejected */
+       uint32 cnt_nan_scan_abort; /* no. of join scans rejected */
+       /* enable/disable */
+       uint32 cnt_nan_enab; /* no. of times nan feature got enabled */
+       uint32 cnt_nan_disab; /* no. of times nan feature got disabled */
+       uint32 cnt_sync_bcn_rx; /* count of sync bcn rx within DW */
+       uint32 cnt_sync_bcn_rx_tu[3]; /* Delta bw the tsf in bcn & remote */
+       uint32 cnt_bcn_tx_out_dw;  /* TX sync beacon outside dw */
+       uint32 cnt_role_am_dw; /* anchor master role due to dw */
+       uint32 cnt_am_hop_err; /* wrong hopcount set for AM */
+} wl_nan_stats_t;
+
+#define WL_NAN_MAC_MAX_NAN_PEERS 6
+#define WL_NAN_MAC_MAX_RSSI_DATA_PER_PEER  10
+
+typedef struct wl_nan_nbr_rssi {
+       uint8 rx_chan; /* channel number on which bcn rcvd */
+       uint8 PAD[3];
+       int32 rssi_raw;  /* received rssi value */
+       int32 rssi_avg;  /* normalized rssi value */
+} wl_nan_peer_rssi_t;
+
+typedef struct wl_nan_peer_rssi_entry {
+       struct ether_addr mac;  /* peer mac address */
+       uint8 flags;   /* TODO:rssi data order: latest first, oldest first etc */
+       uint8 rssi_cnt;   /* rssi data sample present */
+       wl_nan_peer_rssi_t rssi[WL_NAN_MAC_MAX_RSSI_DATA_PER_PEER]; /* RSSI data frm peer */
+} wl_nan_peer_rssi_entry_t;
+
+#define WL_NAN_PEER_RSSI      0x1
+#define WL_NAN_PEER_RSSI_LIST 0x2
+
+typedef struct wl_nan_nbr_rssi_data {
+       uint8 flags;   /* this is a list or single rssi data */
+       uint8 peer_cnt; /* number of peers */
+       uint16 pad; /* padding */
+       wl_nan_peer_rssi_entry_t peers[1]; /* peers data list */
+} wl_nan_peer_rssi_data_t;
+
+/* WL_NAN_CMD_DBG_DUMP, GET Resp */
+typedef struct wl_nan_dbg_dump_rsp {
+       wl_nan_dbg_dump_type_t dump_type; /* dump data type */
+       uint8 pad[3];
+       union {
+               wl_nan_peer_rssi_data_t peer_rssi;
+               wl_nan_stats_t          nan_stats;
+       } u;
+} wl_nan_dbg_dump_rsp_t;
+
+enum nan_termination_status {
+       NAN_TERM_REASON_INVALID = 1,
+       NAN_TERM_REASON_TIMEOUT = 2,
+       NAN_TERM_REASON_USER_REQ = 3,
+       NAN_TERM_REASON_FAILURE = 4,
+       NAN_TERM_REASON_COUNT_REACHED = 5,
+       NAN_TERM_REASON_DE_SHUTDOWN = 6,
+       NAN_TERM_REASON_DISABLE_IN_PROGRESS = 7
+};
+
+/* nan2 data iovar */
+/* nan2 qos */
+typedef struct wl_nan_dp_qos
+{
+       uint8 tid;
+       uint8 pad;
+       uint16 pkt_size;
+       uint16 mean_rate;
+       uint16 svc_interval;
+} wl_nan_dp_qos_t;
+
+#define WL_NAN_NDL_QOS_MAX_LAT_NO_PREF 0xFFFF
+
+/* nan2 qos */
+typedef struct wl_nan_ndl_qos
+{
+       uint8 min_slots;        /* min slots per dw interval */
+       uint8 pad;
+       uint16 max_latency;     /* max latency */
+} wl_nan_ndl_qos_t;
+
+/* ndp config */
+typedef struct wl_nan_ndp_config
+{
+       uint8 ndp_id;
+       uint8 pub_id;
+       struct ether_addr pub_addr;
+       struct ether_addr data_addr;    /* configure local data addr */
+       struct ether_addr init_data_addr;       /* initiator data addr */
+       uint8 svc_spec_info[WL_NAN_DATA_SVC_SPEC_INFO_LEN];
+       wl_nan_dp_qos_t qos;
+       uint16 avail_len;
+       uint8 pad[3];
+       uint8 data[1];
+} wl_nan_ndp_config_t;
+
+/* nan2 device capabilities */
+typedef struct wl_nan_ndp_oper_cfg {
+       uint8 awake_dw_2g;
+       uint8 awake_dw_5g;
+       uint8 bands_supported;
+       uint8 op_mode;
+} wl_nan_ndp_oper_cfg_t;
+
+typedef uint8 wl_nan_ndp_ndpid_t;
+typedef uint8 wl_nan_ndp_conn_t;
+
+#define WL_NAN_INVALID_NDPID   0       /* reserved ndp id */
+
+typedef struct wl_nan_dp_req {
+       uint8 type;                 /* 0- unicast 1 - multicast */
+       uint8 pub_id;               /* Publisher ID */
+       uint16 flags;
+       struct ether_addr peer_mac; /* Peer's NMI addr */
+       struct ether_addr mcast_mac; /* Multicast addr */
+       struct ether_addr ndi;
+       wl_nan_dp_qos_t qos;
+       wl_nan_ndl_qos_t ndl_qos;       /* ndl qos */
+       uint8 tlv_params[];     /* xtlv parameters for command */
+} wl_nan_dp_req_t;
+
+/* TODO  Need to replace ndp_id with lndp_id */
+/* Return structure to data req IOVAR */
+typedef struct wl_nan_dp_req_ret {
+       struct ether_addr indi;     /* Initiators data mac addr */
+       uint8 ndp_id;               /* Initiators ndpid */
+       uint8 pad;
+} wl_nan_dp_req_ret_t;
+
+typedef struct wl_nan_dp_resp {
+       uint8 type;                 /* 0- unicast 1 - multicast */
+       uint8 status;               /* Accepted or Rejected */
+       uint8 reason_code;
+       /* Local NDP ID for unicast, mc_id for multicast, 0 for implicit NMSG */
+       uint8 ndp_id;   /* can be host indp id also */
+       wl_nan_dp_qos_t qos;
+       /* Initiator data address for unicast or multicast address for multicast */
+       struct ether_addr mac_addr;
+       struct ether_addr ndi;
+       uint16 flags;
+       wl_nan_ndl_qos_t ndl_qos;       /* ndl qos */
+       uint8 tlv_params[];     /* xtlv parameters for command */
+} wl_nan_dp_resp_t;
+
+/* Return structure to data resp IOVAR */
+typedef struct wl_nan_dp_resp_ret {
+       uint8 nmsgid;               /* NMSG ID or for multicast else 0 */
+       uint8 pad[3];
+} wl_nan_dp_resp_ret_t;
+
+typedef struct wl_nan_dp_conf {
+       uint8 lndp_id;  /* can be host ndp id */
+       uint8 status;   /* Accepted or Rejected */
+       uint8 pad[2];
+} wl_nan_dp_conf_t;
+
+typedef struct wl_nan_dp_end
+{
+       uint8 lndp_id;  /* can be host ndp id */
+       uint8 status;
+       struct ether_addr mac_addr;     /* initiator's ndi */
+} wl_nan_dp_end_t;
+
+typedef struct wl_nan_dp_schedupd {
+       uint8 type;             /* 0: unicast, 1: multicast */
+       uint8 flags;
+       struct ether_addr addr; /* peer NMI or multicast addr */
+       wl_nan_dp_qos_t qos;
+       wl_nan_ndl_qos_t ndl_qos;       /* ndl qos */
+       uint8 map_id;
+       uint8 pad;
+       uint16 hostseq;
+} wl_nan_dp_schedupd_t;
+
+/* set: update with notification, unset: NDL setup handshake */
+#define WL_NAN_DP_SCHEDUPD_NOTIF (1 << 0)
+
+/* list ndp ids */
+typedef struct wl_nan_ndp_id_list {
+       uint16 ndp_count;
+       uint8 lndp_id[];
+} wl_nan_ndp_id_list_t;
+
+/* nan2 status */
+typedef struct ndp_session {
+       uint8 lndp_id;
+       uint8 state;
+       uint8 pub_id;
+       uint8 pad;
+} ndp_session_t;
+
+typedef struct wl_nan_ndp_status {
+       struct ether_addr peer_nmi;
+       struct ether_addr peer_ndi;
+       ndp_session_t session;
+       struct ether_addr lndi;
+       uint8 pad[2];
+} wl_nan_ndp_status_t;
+
+#define NAN_DP_OPAQUE_INFO_DP_RESP 0x01
+#define NAN_DP_OPAQUE_INFO_DP_CONF 0x02
+
+typedef struct wl_nan_dp_opaque_info {
+       uint8 frm_mask;   /* dp_resp / dp_conf as defined above. */
+       struct ether_addr initiator_ndi;  /* NDI to match in the dp_req. */
+       uint8 pub_id;     /* publish id where the opaque data is included. */
+       uint8 len;        /* len of opaque_info[]. */
+       uint8 pad[3];
+       uint8 opaque_info[0];
+} wl_nan_dp_opaque_info_t;
+
+/* events */
+#define NAN_DP_SESSION_UNICAST         0
+#define NAN_DP_SESSION_MULTICAST       1
+#define NAN_DP_SECURITY_NONE           0
+#define NAN_DP_SECURITY_CSID           1
+#define NAN_DP_SECURITY_MK             2
+#define WL_NAN_DATA_NMSGID_LEN    8 /* 8 bytes as per nan spec */
+
+/* DP TERM event causes */
+#define WL_NAN_DP_TERM_WITH_INACTIVITY         1u
+#define WL_NAN_DP_TERM_WITH_FSM_DESTROY                2u
+#define WL_NAN_DP_TERM_WITH_PEER_DP_END                3u
+#define WL_NAN_DP_TERM_WITH_STALE_NDP          4u
+#define WL_NAN_DP_TERM_WITH_DISABLE            5u
+#define WL_NAN_DP_TERM_WITH_NDI_DEL            6u
+#define WL_NAN_DP_TERM_WITH_PEER_HB_FAIL       7u
+#define WL_NAN_DP_TERM_WITH_HOST_IOVAR         8u
+#define WL_NAN_DP_TERM_WITH_ESTB_FAIL          9u
+#define WL_NAN_DP_TERM_WITH_SCHED_REJECT       10u
+
+/* Common event structure for Nan Datapath
+ * Used for sending NDP Indication, Response, Confirmation, Securty Install and Establish events
+ */
+typedef struct wl_nan_ev_datapath_cmn {
+       uint8 type;
+       /* ndp_id is valid only if type is unicast */
+       uint8 ndp_id;
+       uint8 pub_id;
+       uint8 security;
+       /* Following two fields are valid only if type is unicast */
+       struct ether_addr initiator_ndi;
+       struct ether_addr responder_ndi;
+       struct ether_addr peer_nmi;
+       uint8 status;
+       uint8 role;
+       /* Following two fields are valid only if type is multicast */
+       uint8 nmsg_id[WL_NAN_DATA_NMSGID_LEN];
+       uint8 mc_id;
+       uint8 event_cause;
+       uint16 opt_tlv_len;
+       uint8 opt_tlvs[];
+} wl_nan_ev_datapath_cmn_t;
+
+/* this is obsolete - DON'T USE */
+typedef struct wl_nan_ev_datapath_end {
+       uint8 ndp_id;
+       uint8 status;
+       uint8 pad[2];
+       struct ether_addr peer_nmi;
+       struct ether_addr peer_ndi;
+} wl_nan_ev_datapath_end_t;
+
+typedef struct wl_tsf {
+       uint32 tsf_l;
+       uint32 tsf_h;
+} wl_tsf_t;
+
+typedef struct wl_nan_ev_rx_bcn {
+       wl_tsf_t tsf;
+       uint16   bcn_len;
+       uint8    pad[2];
+       uint8    bcn[0];
+} wl_nan_ev_rx_bcn_t;
+
+/* reason of host assist request */
+enum wl_nan_host_assist_reason {
+       WL_NAN_HAST_REASON_NONE         = 0,
+
+       /* reason for host assist request */
+       WL_NAN_HAST_REASON_NO_CRB                       = 1, /* NDL: no common NA */
+       WL_NAN_HAST_REASON_NDC                          = 2, /* NDL: NDC not compliant */
+       WL_NAN_HAST_REASON_IMMUT                        = 3, /* NDL: peer immutable schedule */
+       WL_NAN_HAST_REASON_RNG                          = 4, /* NDL: ranging schedule */
+       WL_NAN_HAST_REASON_QOS                          = 5, /* NDL: QoS not satisfied */
+       WL_NAN_HAST_REASON_SVC_NDI_MISSING              = 6, /* SD: SVC NDI missing */
+       WL_NAN_HAST_REASON_PEER_SCB_NORESOURCE          = 7, /* NDP: no more peer scb available */
+       WL_NAN_HAST_REASON_NDP_PMK_MISSING              = 8, /* NDP: PMK needed from host */
+       WL_NAN_HAST_REASON_SVC_NDI_AND_PMK_MISSING      = 9  /* PMK and SVC NDI needed from host */
+};
+typedef uint8 wl_nan_host_assist_reason_t;
+
+/* WL_NAN_XTLV_HOST_ASSIST_REQ */
+typedef struct wl_nan_host_assist_req {
+       struct ether_addr peer_nmi;             /* peer nmi */
+       struct ether_addr initiator_ndi;        /* initiator ndi */
+       uint8 indp_id;                          /* initiator NDP ID */
+       wl_nan_frame_type_t frm_type;           /* received NAF type */
+       wl_nan_host_assist_reason_t reason;     /* reason of host assist request */
+       uint8 pub_id;                           /* Publish ID (valid for WL_NAN_FRM_TYPE_DP_REQ) */
+       uint8 pad[2];
+} wl_nan_host_assist_req_t;
+
+/* nan sub-features */
+enum wl_nan_fw_cap_flag1 {
+       WL_NAN_FW_CAP_FLAG_NONE                 = 0x00000000, /* dummy */
+       WL_NAN_FW_CAP_FLAG1_AVAIL               = 0x00000001,
+       WL_NAN_FW_CAP_FLAG1_DISC                = 0x00000002,
+       WL_NAN_FW_CAP_FLAG1_DATA                = 0x00000004,
+       WL_NAN_FW_CAP_FLAG1_SEC                 = 0x00000008,
+       WL_NAN_FW_CAP_FLAG1_RANGE               = 0x00000010,
+       WL_NAN_FW_CAP_FLAG1_WFA_TB              = 0x00000020,
+       WL_NAN_FW_CAP_FLAG1_DAM                 = 0x00000040,
+       WL_NAN_FW_CAP_FLAG1_DAM_STRICT          = 0x00000080,
+       WL_NAN_FW_CAP_FLAG1_DAM_AUTO            = 0x00000100,
+       WL_NAN_FW_CAP_FLAG1_DBG                 = 0x00000200,
+       WL_NAN_FW_CAP_FLAG1_BCMC_IN_NDC         = 0x00000400,
+       WL_NAN_FW_CAP_FLAG1_CHSTATS             = 0x00000800,
+       WL_NAN_FW_CAP_FLAG1_ASSOC_COEX          = 0x00001000,
+       WL_NAN_FW_CAP_FLAG1_FASTDISC            = 0x00002000,
+       WL_NAN_FW_CAP_FLAG1_NO_ID_GEN           = 0x00004000,
+       WL_NAN_FW_CAP_FLAG1_DP_OPAQUE_DATA      = 0x00008000,
+       WL_NAN_FW_CAP_FLAG1_NSR2                = 0x00010000,
+       WL_NAN_FW_CAP_FLAG1_NSR2_SAVE           = 0x00020000,
+       WL_NAN_FW_CAP_FLAG1_NANHO               = 0x00040000,
+       WL_NAN_FW_CAP_FLAG1_NDPE                = 0x00080000,
+       WL_NAN_FW_CAP_FLAG1_OOB_AF              = 0x00100000,
+       WL_NAN_FW_CAP_FLAG1_PMK_PER_NDP         = 0x00200000
+};
+
+/* WL_NAN_XTLV_GEN_FW_CAP */
+typedef struct wl_nan_fw_cap {
+       uint32 flags1;                  /* nan sub-features compiled in firmware */
+       uint32 flags2;                  /* for more sub-features in future */
+       uint8  max_svc_publishes;        /* max num of service publish */
+       uint8  max_svc_subscribes;       /* max num of service subscribe */
+       uint8  max_lcl_sched_maps;       /* max num of local schedule map */
+       uint8  max_lcl_ndc_entries;      /* max num of local NDC entry */
+       uint8  max_lcl_ndi_interfaces;   /* max num of local NDI interface */
+       uint8  max_peer_entries;         /* max num of peer entry */
+       uint8  max_ndp_sessions;         /* max num of NDP session */
+       uint8  max_concurrent_nan_clusters; /* max num of concurrent clusters */
+       uint16 max_service_name_len; /* max service name length */
+       uint16 max_match_filter_len; /* max match filter length */
+       uint16 max_total_match_filter_len; /* max total match filter length */
+       uint16 max_service_specific_info_len; /* max service specific info length */
+       uint16 max_vsa_data_len; /* max vendor specific attrib data length */
+       uint16 max_mesh_data_len; /* max mesh data length */
+       uint16 max_app_info_len; /* max app info length */
+       uint16 max_sdea_svc_specific_info_len; /* max sdea ser specific info length */
+       uint8  max_queued_tx_followup_msgs; /* max no. of queued tx followup msgs */
+       uint8  max_subscribe_address; /* max subscribe addresses supported */
+       uint8  ndp_supported_bands; /* number of ndp supported bands */
+       uint8  is_ndp_security_supported; /* if secure ndp is supported */
+       uint8  cipher_suites_supported_mask; /* bitmask for suites supported */
+       uint8  pad[3];
+} wl_nan_fw_cap_t;
+
+/* WL_NAN_XTLV_GEN_FW_CAP_V2 */
+typedef struct wl_nan_fw_cap_v2 {
+       uint32 flags1;                  /* nan sub-features compiled in firmware */
+       uint32 flags2;                  /* for more sub-features in future */
+       uint8  max_svc_publishes;       /* max num of service publish */
+       uint8  max_svc_subscribes;      /* max num of service subscribe */
+       uint8  max_lcl_sched_maps;      /* max num of local schedule map */
+       uint8  max_lcl_ndc_entries;     /* max num of local NDC entry */
+       uint8  max_lcl_ndi_interfaces;  /* max num of local NDI interface */
+       uint8  max_peer_entries;        /* max num of peer entry */
+       uint8  max_peer_sched_maps;     /* max num of peer schedule maps */
+       uint8  max_ndp_sessions;        /* max num of NDP session */
+       uint32 cipher_suites_supported_mask; /* bitmask for supported cipher suites */
+       uint32 reserved_uint32_1;       /* reserved for future sub-features */
+       uint32 reserved_uint32_2;       /* reserved for future sub-features */
+       uint32 reserved_uint32_3;       /* reserved for future sub-features */
+       uint32 reserved_uint32_4;       /* reserved for future sub-features */
+} wl_nan_fw_cap_v2_t;
+
+/* nan cipher suite support mask bits */
+#define WL_NAN_CIPHER_SUITE_SHARED_KEY_128_MASK  0x01
+#define WL_NAN_CIPHER_SUITE_SHARED_KEY_256_MASK  0x02
+
+/* NAN Save Restore */
+#define WL_NAN_NSR2_INFO_MAX_SIZE      2048 /* arbitrary */
+
+/* WL_NAN_XTLV_NSR2_PEER */
+typedef struct wl_nan_nsr_peer_info {
+       struct ether_addr nmi;
+       uint8 l_min_slots;      /* local QoS min slots */
+       uint8 p_min_slots;      /* peer QoS min slots */
+       uint16 l_max_latency;   /* local QoS max latency */
+       uint16 p_max_latency;   /* peer QoS max latency */
+       uint8 num_map;          /* num of NA map */
+       uint8 pad;
+       uint16 attrs_len;       /* total len of following attrs */
+       uint8 attrs[];          /* peer attributes (NA/NDC/ULW/DevCap/Element container) */
+} wl_nan_nsr_peer_info_t;
+
+enum wl_nan_nsr_ndp_flag {
+       WL_NAN_NSR_NDP_FLAG_LCL_INITATOR        = 0x0001,
+       WL_NAN_NSR_NDP_FLAG_MCAST               = 0x0002
+};
+typedef uint16 wl_nan_nsr_ndp_flag_t;
+
+/* WL_NAN_XTLV_NSR2_NDP */
+typedef struct wl_nan_nsr_ndp_info {
+       struct ether_addr peer_nmi;
+       struct ether_addr peer_ndi;
+       struct ether_addr lcl_ndi;
+       uint16 flags;           /* wl_nan_nsr_ndp_flag_t */
+       uint8 pub_id;           /* publish id */
+       uint8 indp_id;          /* initiator's ndp id */
+       uint8 last_token;       /* last NDP dialog token */
+       uint8 pad;
+} wl_nan_nsr_ndp_info_t;
+
+/* NAN2.0 Ranging definitions */
+
+/* result indication bit map */
+#define NAN_RANGE_INDICATION_NONE              0
+#define NAN_RANGE_INDICATION_CONT              (1<<0)
+#define NAN_RANGE_INDICATION_INGRESS           (1<<1)
+#define NAN_RANGE_INDICATION_EGRESS            (1<<2)
+
+/* responder flags */
+#define NAN_RANGE_FLAG_AUTO_ACCEPT     (1 << 0)
+#define NAN_RANGE_FLAG_RESULT_REQUIRED (1 << 1)
+
+typedef struct wl_nan_range_req {
+       struct ether_addr peer;
+       uint8 publisher_id;
+       uint8 indication; /* bit map for result event */
+       uint32 resolution; /* default millimeters */
+       uint32 ingress; /* ingress limit in mm */
+       uint32 egress; /* egress limit in mm */
+       uint32 interval; /* max interval(in TU) b/w two ranging measurements */
+} wl_nan_range_req_t;
+
+#define NAN_RNG_REQ_IOV_LEN    24
+
+typedef uint8 wl_nan_range_id;
+
+typedef struct wl_nan_range_resp {
+       wl_nan_range_id range_id;
+       uint8 flags; /* auto response, range result required */
+       uint8 status; /* accept, reject */
+       uint8 indication; /* bit map for result event */
+       uint32 resolution; /* default millimeters */
+       uint32 ingress; /* ingress limit in mm */
+       uint32 egress; /* egress limit in mm */
+       uint32 interval; /* max interval(in TU) b/w two ranging measurements */
+} wl_nan_range_resp_t;
+
+#define NAN_RNG_RESP_IOV_LEN   20
+
+#define NAN_RNG_TERM_FLAG_IMMEDIATE                            (1u << 0u) /* Do not wait for TXS */
+#define NAN_RNG_TERM_FLAG_SILIENT_TEARDOWN     (1u << 1u) /* Do not TX rng_term */
+#define NAN_RNG_TERM_FLAG_EVENT_HOST                   (1u << 2u) /* Notify event to host */
+#define NAN_RNG_TERM_FLAG_OPT_TLVS                             (1u << 3u) /* opt tlvs present */
+
+typedef struct wl_nan_range_cancel_ext {
+       wl_nan_range_id range_id;
+       uint8 flags;
+       uint8 pad[2];
+} wl_nan_range_cancel_ext_t;
+
+#define NAN_RNG_CANCEL_IOV_FIXED_LEN   4u
+
+#define NAN_RNG_MAX_IOV_LEN    255
+
+typedef struct wl_nan_ev_rng_req_ind {
+       struct ether_addr peer_m_addr;
+       uint8 rng_id;
+       /* ftm parameters */
+       uint8 max_burst_dur;
+       uint8 min_ftm_delta;
+       uint8 max_num_ftm;
+       uint8 ftm_format_bw;
+       /* location info availability bit map */
+       uint8 lc_info_avail;
+       /* Last movement indication */
+       uint16 last_movement;
+       uint8 pad[2];
+} wl_nan_ev_rng_req_ind_t;
+
+#define NAN_RNG_REQ_IND_SIZE 14
+
+typedef struct wl_nan_ev_rng_rpt_ind {
+       uint32 dist_mm; /* in millimeter */
+       struct ether_addr peer_m_addr;
+       uint8 indication; /* indication definitions mentioned above */
+       uint8 rng_id;
+} wl_nan_ev_rng_rpt_ind_t;
+
+#define NAN_RNG_RPT_IND_SIZE 12
+
+/* number of continuous ranging crbs which can be idle,
+* after which ranging session will be terminated.
+* Default value is 5. Set to zero for disabling the
+* idle timeout functionality
+*/
+typedef uint8 wl_nan_range_idle_count_t;
+
+/* nan ranging termination reason codes */
+#define NAN_RNG_TERM_REASON_CODE_BASE          100u
+#define NAN_RNG_TERM_REASON_CODE(reason_code) \
+       (NAN_RNG_TERM_REASON_CODE_BASE + (reason_code))
+
+/* Reason Code Unspecified */
+#define NAN_RNG_TERM_UNSPECIFIED       NAN_RNG_TERM_REASON_CODE(0u)
+/* no ftms from peer */
+#define NAN_RNG_TERM_IDLE_TIMEOUT      NAN_RNG_TERM_REASON_CODE(1u)
+/* On Peer Termination */
+#define NAN_RNG_TERM_PEER_REQ          NAN_RNG_TERM_REASON_CODE(2u)
+/* On User or Host Termination */
+#define NAN_RNG_TERM_USER_REQ          NAN_RNG_TERM_REASON_CODE(3u)
+/* On FSM Timeout, waiting for Resp from peer */
+#define NAN_RNG_TERM_RNG_RESP_TIMEOUT  NAN_RNG_TERM_REASON_CODE(4u)
+/* On range resp, reject from peer */
+#define NAN_RNG_TERM_RNG_RESP_REJ      NAN_RNG_TERM_REASON_CODE(5u)
+/* On range req/resp txs fail */
+#define NAN_RNG_TERM_RNG_TXS_FAIL      NAN_RNG_TERM_REASON_CODE(6u)
+
+typedef struct wl_nan_ev_rng_term_ind {
+       struct ether_addr peer_m_addr;
+       uint8 reason_code;
+       uint8 rng_id;
+} wl_nan_ev_rng_term_ind_t;
+
+#define NAN_RNG_TERM_IND_SIZE 8
+
+typedef struct wl_nan_ev_rng_resp {
+       struct ether_addr peer_m_addr;
+       uint8 status;
+       uint8 rng_id;
+} wl_nan_ev_rng_resp_t;
+
+/* Used by NDL schedule events -
+ * WL_NAN_EVENT_PEER_SCHED_UPD_NOTIF, WL_NAN_EVENT_PEER_SCHED_REQ
+ * WL_NAN_EVENT_PEER_SCHED_RESP, WL_NAN_EVENT_PEER_SCHED_CONF
+ */
+typedef struct wl_nan_ev_sched_info {
+       struct ether_addr peer_nmi;
+       uint8   ndl_status;     /* applies only to sched resp/conf */
+       uint8   pad;
+       uint16  opt_tlv_len;
+       uint8   opt_tlvs[];
+} wl_nan_ev_sched_info_t;
+
+/* WL_NAN_EVENT_CHAN_BOUNDARY */
+typedef struct wl_nan_chbound_info {
+       uint32  cluster_tsf_h;  /* Current Cluster TSF High */
+       uint32  cluster_tsf_l;  /* Current Cluster TSF Low */
+       uint16  cur_chspec;
+       uint16  opt_tlvs_len;
+       uint8   opt_tlvs[];
+} wl_nan_chbound_info_t;
+
+/* channel stats (includes nan & non-nan) */
+
+/* WL_NAN_XTLV_CCA_STATS */
+typedef struct wl_nan_cca_stats {
+       uint16  chanspec;
+       uint8   pad[2];
+       uint32  sample_dur;
+
+       uint32  congest_ibss;
+       uint32  congest_obss;
+       uint32  interference;
+} wl_nan_cca_stats_t;
+
+/* WL_NAN_XTLV_PER_STATS */
+typedef struct wl_nan_per_stats_s {
+       uint16  chanspec;
+       uint8   pad[2];
+       uint32  sample_dur;
+
+       uint32  txframe;        /* tx data frames */
+       uint32  txretrans;      /* tx mac retransmits */
+       uint32  txerror;        /* tx data errors  */
+       uint32  txctl;          /* tx management frames */
+       uint32  txserr;         /* tx status errors */
+
+       uint32  rxframe;        /* rx data frames */
+       uint32  rxerror;        /* rx data errors */
+       uint32  rxctl;          /* rx management frames */
+
+       uint32  txbar;          /* tx bar */
+       uint32  rxbar;          /* rx bar */
+       uint32  txaction;       /* tx action frame */
+       uint32  rxaction;       /* rx action frame */
+       uint32  txlost;         /* lost packets reported in txs */
+       uint32  rxback;         /* rx block ack */
+       uint32  txback;         /* tx bloak ack */
+} wl_nan_per_stats_t;
+
+/* fast discovery beacon config
+ * WL_NAN_XTLV_CFG_FDISC_TBMP
+*/
+typedef struct wl_nan_fastdisc_s {
+       uint8 id;
+       uint8 bitmap_len;
+       uint8 pad[2];
+       uint8 bitmap[];
+} wl_nan_fastdisc_t;
+
+#define WL_NAN_FASTDISC_CFG_SIZE       1024 /* arbitrary */
+
+/* ********************* end of NAN section ******************************** */
+/* endif WL_NAN */
+
+#define P2P_NAN_IOC_BUFSZ  512 /* some sufficient ioc buff size */
+#define WL_P2P_NAN_IOCTL_VERSION    0x1
+
+/* container for p2p nan iovtls & events */
+typedef struct wl_p2p_nan_ioc {
+       uint16  version;    /* interface command or event version */
+       uint16  id;     /* p2p nan ioctl cmd  ID  */
+       uint16  len;        /* total length of data[]  */
+       uint16  pad;        /* padding */
+       uint8   data [];   /* var len payload of bcm_xtlv_t type */
+} wl_p2p_nan_ioc_t;
+
+/* p2p nan cmd IDs */
+enum wl_p2p_nan_cmds {
+       /* p2p nan cfg ioctls */
+       WL_P2P_NAN_CMD_ENABLE = 1,
+       WL_P2P_NAN_CMD_CONFIG = 2,
+       WL_P2P_NAN_CMD_DEL_CONFIG = 3,
+       WL_P2P_NAN_CMD_GET_INSTS = 4
+};
+
+#define WL_P2P_NAN_CONFIG_VERSION       1
+
+#define WL_P2P_NAN_DEVICE_P2P  0x0
+#define WL_P2P_NAN_DEVICE_GO   0x1
+#define WL_P2P_NAN_DEVICE_GC   0x2
+#define WL_P2P_NAN_DEVICE_INVAL   0xFF
+
+/* NAN P2P operation */
+typedef struct p2p_nan_config {
+       uint16 version;            /* wl_p2p_nan_config_t structure version */
+       uint16 len;                /* total length including version and variable IE */
+       uint32 flags;              /* 0x1 to NEW, 0x2 to ADD, 0x4 to DEL */
+       uint8  inst_id;            /* publisher/subscriber id */
+       uint8  inst_type;          /* publisher/subscriber */
+       uint8  dev_role;           /* P2P device role: 'P2P','GO' or 'GC' */
+       uint8  pad1;               /* padding */
+       uint8  resolution;         /* Availability bitmap resolution */
+       uint8  repeat;             /* Whether Availabilty repeat across DW */
+       uint16 ie_len;             /* variable ie len */
+       struct ether_addr dev_mac; /* P2P device addres */
+       uint16 pad2;               /* Padding */
+       uint32 avail_bmap;         /* availability interval bitmap */
+       uint32 chanspec;           /* Chanspec */
+       uint8  ie[];              /* hex ie data */
+} wl_p2p_nan_config_t;
+
+#define WL_P2P_NAN_SERVICE_LIST_VERSION 1
+typedef enum wl_nan_service_type {
+       WL_NAN_SVC_INST_PUBLISHER = 1,
+       WL_NAN_SVC_INST_SUBSCRIBER = 2
+} wl_nan_service_type_t;
+
+#define WL_P2P_NAN_CONFIG_NEW   0x1
+#define WL_P2P_NAN_CONFIG_ADD   0x2
+#define WL_P2P_NAN_CONFIG_DEL   0x4
+
+typedef struct wl_nan_svc_inst {
+       uint8  inst_id;      /* publisher/subscriber id */
+       uint8  inst_type;    /* publisher/subscriber */
+} wl_nan_svc_inst_t;
+
+typedef struct wl_nan_svc_inst_list {
+       uint16 version;           /* this structure version */
+       uint16 len;               /* total length including version and variable svc list */
+       uint16 count;             /* service instance count */
+       uint16 pad;               /* padding */
+       wl_nan_svc_inst_t svc[1]; /* service instance list */
+} wl_nan_svc_inst_list_t;
+
+#define NAN_POST_DISC_P2P_DATA_VER  1
+/* This structure will be used send peer p2p data with
+ * NAN discovery result
+ */
+typedef struct nan_post_disc_p2p_data {
+       uint8 ver;                 /* this structure version */
+       uint8 dev_role;            /* P2P Device role */
+       uint8 resolution;          /* Availability bitmap resolution */
+       uint8 repeat;              /* Whether Availabilty repeat across DW */
+       struct ether_addr dev_mac; /* P2P device addres */
+       uint16 pad1;               /* Padding */
+       uint32 chanspec;           /* Chanspec */
+       uint32 avl_bmp;                         /* availability interval bitmap */
+} nan_post_disc_p2p_data_t;
+
+enum {
+       WL_AVAIL_NONE           = 0x0000,
+       WL_AVAIL_LOCAL          = 0x0001,
+       WL_AVAIL_PEER           = 0x0002,
+       WL_AVAIL_NDC            = 0x0003,
+       WL_AVAIL_IMMUTABLE      = 0x0004,
+       WL_AVAIL_RESPONSE       = 0x0005,
+       WL_AVAIL_COUNTER        = 0x0006,
+       WL_AVAIL_RANGING        = 0x0007,
+       WL_AVAIL_UPD_POT        = 0x0008,       /* modify potential, keep committed/conditional */
+       WL_AVAIL_UPD_COM_COND   = 0x0009,       /* modify committed/conditional, keep potential */
+       WL_AVAIL_REMOVE_MAP     = 0x000A,       /* remove map */
+       WL_AVAIL_FRM_TYPE       = 0x000B,       /* specify frame types containing NA */
+       WL_AVAIL_TYPE_MAX       = WL_AVAIL_FRM_TYPE     /* New ones before and update */
+};
+#define WL_AVAIL_TYPE_MASK             0x000F
+#define WL_AVAIL_FLAG_REMOVE           0x2000  /* remove schedule attr of given type & map id */
+#define WL_AVAIL_FLAG_SELECTED_NDC     0x4000
+#define WL_AVAIL_FLAG_RAW_MODE         0x8000
+#define WL_AVAIL_FLAGS_MASK            0xFF00
+#define WL_AVAIL_FLAGS_SHIFT           8
+
+typedef int16 wl_avail_flags_t;
+
+/* availability entry flags */
+enum {
+       WL_AVAIL_ENTRY_NONE             = 0x0000,
+       WL_AVAIL_ENTRY_COM              = 0x0001,               /* committed */
+       WL_AVAIL_ENTRY_POT              = 0x0002,               /* potential */
+       WL_AVAIL_ENTRY_COND             = 0x0004,       /* conditional */
+       WL_AVAIL_ENTRY_PAGED            = 0x0008,       /* P-NDL */
+       WL_AVAIL_ENTRY_USAGE            = 0x0030,       /* usage preference */
+       WL_AVAIL_ENTRY_BIT_DUR          = 0x00C0,       /* bit duration */
+       WL_AVAIL_ENTRY_BAND_PRESENT     = 0x0100,       /* band present */
+       WL_AVAIL_ENTRY_CHAN_PRESENT     = 0x0200,       /* channel information present */
+       WL_AVAIL_ENTRY_CHAN_ENTRY_PRESENT = 0x0400,     /* channel entry (opclass+bitmap) */
+       /* free to use 0x0800 */
+       WL_AVAIL_ENTRY_RXNSS            = 0xF000        /* max num of spatial stream RX */
+};
+
+/* bit duration */
+enum {
+       WL_AVAIL_BIT_DUR_16     = 0,    /* 16TU */
+       WL_AVAIL_BIT_DUR_32     = 1,    /* 32TU */
+       WL_AVAIL_BIT_DUR_64     = 2,    /* 64TU */
+       WL_AVAIL_BIT_DUR_128    = 3,    /* 128TU */
+};
+
+/* period */
+enum {
+       WL_AVAIL_PERIOD_0       = 0,    /* 0TU */
+       WL_AVAIL_PERIOD_128     = 1,    /* 128TU */
+       WL_AVAIL_PERIOD_256     = 2,    /* 256TU */
+       WL_AVAIL_PERIOD_512     = 3,    /* 512TU */
+       WL_AVAIL_PERIOD_1024    = 4,    /* 1024TU */
+       WL_AVAIL_PERIOD_2048    = 5,    /* 2048TU */
+       WL_AVAIL_PERIOD_4096    = 6,    /* 4096TU */
+       WL_AVAIL_PERIOD_8192    = 7,    /* 8192TU */
+};
+
+/* band */
+enum {
+       WL_AVAIL_BAND_NONE      = 0,    /* reserved */
+       WL_AVAIL_BAND_SUB1G     = 1,    /* sub-1 GHz */
+       WL_AVAIL_BAND_2G        = 2,    /* 2.4 GHz */
+       WL_AVAIL_BAND_3G        = 3,    /* reserved (for 3.6 GHz) */
+       WL_AVAIL_BAND_5G        = 4,    /* 4.9 and 5 GHz */
+       WL_AVAIL_BAND_60G       = 5,    /* reserved (for 60 GHz) */
+};
+
+#define WL_AVAIL_ENTRY_TYPE_MASK       0x000F
+#define WL_AVAIL_ENTRY_USAGE_MASK      0x0030 /* up to 4 usage preferences */
+#define WL_AVAIL_ENTRY_USAGE_SHIFT     4
+#define WL_AVAIL_ENTRY_USAGE_VAL(_flags)       (((_flags) & WL_AVAIL_ENTRY_USAGE_MASK) \
+       >> WL_AVAIL_ENTRY_USAGE_SHIFT)
+
+#define WL_AVAIL_ENTRY_BIT_DUR_MASK    0x00C0 /* 0:16TU, 1:32TU, 2:64TU, 3:128TU */
+#define WL_AVAIL_ENTRY_BIT_DUR_SHIFT   6
+#define WL_AVAIL_ENTRY_BIT_DUR_VAL(_flags)     (((_flags) & WL_AVAIL_ENTRY_BIT_DUR_MASK) \
+       >> WL_AVAIL_ENTRY_BIT_DUR_SHIFT)
+
+#define WL_AVAIL_ENTRY_BAND_MASK       0x0100 /* 0=band not present, 1=present */
+#define WL_AVAIL_ENTRY_BAND_SHIFT      8
+
+#define WL_AVAIL_ENTRY_CHAN_MASK       0x0200 /* 0=channel info not present, 1=present */
+#define WL_AVAIL_ENTRY_CHAN_SHIFT      9
+
+#define WL_AVAIL_ENTRY_CHAN_ENTRY_MASK 0x0400 /* 0=chanspec, 1=hex channel entry */
+#define WL_AVAIL_ENTRY_CHAN_ENTRY_SHIFT        10
+
+#define WL_AVAIL_ENTRY_RXNSS_MASK      0xF000
+#define WL_AVAIL_ENTRY_RXNSS_SHIFT     12
+#define WL_AVAIL_ENTRY_RXNSS_VAL(_flags)       (((_flags) & WL_AVAIL_ENTRY_RXNSS_MASK) \
+       >> WL_AVAIL_ENTRY_RXNSS_SHIFT)
+#define WL_AVAIL_ENTRY_RXNSS_MAX       15      /* 0-15 */
+
+/* mask for channel_entry (to be obsoleted) */
+#define WL_AVAIL_ENTRY_OPCLASS_MASK            0xFF
+#define WL_AVAIL_ENTRY_CHAN_BITMAP_MASK                0xFF00
+#define WL_AVAIL_ENTRY_CHAN_BITMAP_SHIFT       8
+#define WL_AVAIL_ENTRY_CHAN_BITMAP_VAL(_info)  (((_info) & WL_AVAIL_ENTRY_CHAN_BITMAP_MASK) \
+       >> WL_AVAIL_ENTRY_CHAN_BITMAP_SHIFT)
+
+/* Used for raw channel entry field input */
+#define MAX_CHAN_ENTRY_LEN 6
+
+typedef struct wl_avail_entry {
+       uint16          length;         /* total length */
+       uint16          start_offset;   /* in TUs, multiply by 16 for total offset */
+       union {
+               uint32 channel_info;    /* either chanspec or hex channel entry (opclass +
+                                        * bitmap per NAN spec), as indicated by setting
+                                        * WL_AVAIL_ENTRY_HEX_CHAN_ENTRY flag
+                                        */
+               uint32 band;            /* defined by WL_BAND enum, 2=2.4GHz, 4=5GHz */
+               uint8 channel_entry[MAX_CHAN_ENTRY_LEN];
+               uint8 align[8];         /* aligned len of union in structure (not for use)
+                                        * if member of union is changed,
+                                        * update length of align[] accordingly.
+                                        */
+       } u;                            /* band or channel value, 0=all band/channels */
+       uint8           sched_map_id;   /* avail map id associated with sched entry */
+       uint8           pad;
+       uint8           period;         /* in TUs, defined by WL_AVAIL_PERIOD enum
+                                        * 1:128, 2:256, 3:512, 4:1024, 5:2048, 6:4096,
+                                        * 7:8192
+                                        */
+       uint8           bitmap_len;
+       uint16          flags;          /* defined by avail entry flags enum:
+                                        * type, usage pref, bit duration, rx nss,
+                                        * and band, channel or channel entry
+                                        */
+       uint8           bitmap[];       /* time bitmap */
+} wl_avail_entry_t;
+
+#define WL_AVAIL_VERSION       1       /* current wl_avail version */
+
+typedef struct wl_avail {
+       uint16          length;         /* total length */
+       uint16          flags;          /* LSB - avail type (defined by WL_AVAIL enum)
+                                        * MSB - avail flags
+                                        */
+       uint8           id;             /* id used for multiple maps/avail */
+       uint8           lndc_id;        /* ndc id used in multi-ndc case */
+       uint8           version;
+       uint8           pad;
+       struct ether_addr addr;         /* peer mac address or ndc id */
+       uint8           num_entries;
+       uint8           unused_byte;
+       /* add additional fields above this line */
+       uint8           entry[];
+} wl_avail_t;
+
+#define WL_AVAIL_MIN_LEN(n) ((n) ? OFFSETOF(wl_avail_t, entry) + \
+               ((n) * OFFSETOF(wl_avail_entry_t, bitmap)) : 0)
+
+/* unaligned schedule (window) */
+typedef struct wl_avail_ulw {
+       uint8   id;             /* schedule ID */
+       uint8   overwrite;      /* bit 0: overwrite all
+                                * 1-4: map ID if overwrite all is 0
+                                */
+       uint16  flags;
+       uint32  start;          /* start time of first ULW, in us */
+       uint32  dur;            /* duration of ULW, in us */
+       uint32  period;         /* time between consecutive ULWs, in us */
+       union {
+               uint32 chanspec;
+               uint32 band;
+               uint8 chan_entry[MAX_CHAN_ENTRY_LEN];
+               uint8 pad[8];
+       } u;
+       uint8   cntdwn;         /* remaining ULWs before schedule ends */
+       uint8   pad[3];
+} wl_avail_ulw_t;
+
+/* unset: NAN is not available during ULW, set: NAN is avail depending on ctrl flags */
+#define WL_NAN_ULW_CTRL_PRESENT                (1 << 0)
+/* unset: band, set: channel */
+#define WL_NAN_ULW_CTRL_TYPE           (1 << 1)
+/* set: NAN is availabile on specified band/channel */
+#define WL_NAN_ULW_CTRL_AVAIL          (1 << 2)
+/* channel is provided in raw attribute format */
+#define WL_NAN_ULW_CTRL_RAW_CHAN       (1 << 3)
+
+/* nan wfa testmode operations */
+enum {
+       WL_NAN_WFA_TM_IGNORE_TERMINATE_NAF              = 0x00000001,
+       WL_NAN_WFA_TM_IGNORE_RX_DATA_OUTSIDE_CRB        = 0x00000002,
+       WL_NAN_WFA_TM_ALLOW_TX_DATA_OUTSIDE_CRB         = 0x00000004,
+       WL_NAN_WFA_TM_ENFORCE_NDL_COUNTER               = 0x00000008,
+       WL_NAN_WFA_TM_BYPASS_NDL_PROPOSAL_VALIDATION    = 0x00000010,
+       /* allow data(pings) tx while ndp sec negotiation */
+       WL_NAN_WFA_TM_SEC_SEND_PINGS_BYPASS_NDP_SM      = 0x00000020,
+       /* generate and insert incorrect mic */
+       WL_NAN_WFA_TM_SEC_INCORRECT_MIC                 = 0x00000040,
+       /* send m4 reject deliberately */
+       WL_NAN_WFA_TM_SEC_REJECT_STATUS4M4              = 0x00000080,
+       /* send mgmt frame (for eg. ndp terminate) in clear txt (bypass security) */
+       WL_NAN_WFA_TM_SEC_SEND_MGMT_CLEAR               = 0x00000100,
+       /* validate qos */
+       WL_NAN_WFA_TM_NDL_QOS_VALIDATE                  = 0x00000200,
+       /* firmware generated schedule update */
+       WL_NAN_WFA_TM_GEN_SCHED_UPD                     = 0x00000400,
+       /* add lower 4-bytes of TSF to configured start time */
+       WL_NAN_WFA_TM_ULW_START_TIME                    = 0x00000800,
+       /* enable schedule validation for SDF */
+       WL_NAN_WFA_TM_SDF_SCHED_VALIDATE                = 0x00001000,
+       /* by pass faw na iovar */
+       WL_NAN_WFA_TM_SKIP_RAW_NA_BLOB                  = 0x00002000,
+       /* overwrite local NA with peer NA in received frame */
+       WL_NAN_WFA_TM_LOCAL_NA_OVERWRITE                = 0x00004000,
+       /* randomize and self configure ndl qos(needed at responder in auto mode) */
+       WL_NAN_WFA_TM_SELF_CFG_NDL_QOS                  = 0x00008000,
+       /* send NAF frames only in DW */
+       WL_NAN_WFA_TM_SEND_NAF_IN_DW                    = 0x00010000,
+       /* restrict channels used for countered slots to Ch 6/149 only */
+       WL_NAN_WFA_TM_RESTRICT_COUNTER_SLOTS_CHAN       = 0x00020000,
+       /* NDPE negative test case (4.2.5 & 4.2.6) */
+       WL_NAN_WFA_TM_NDPE_NEGATIVE_TEST_TB             = 0x00040000,
+       /* Set NDPE(NAN3.0) capable bit in dev cap attr */
+       WL_NAN_WFA_TM_ENABLE_NDPE_CAP                   = 0x00080000,
+       /* NDPE negative test case (4.2.5.2). Enable both NDP and NDPE attributes */
+       WL_NAN_WFA_TM_ENABLE_NDP_NDPE_ATTR              = 0x00100000,
+
+       /* add above & update mask */
+       WL_NAN_WFA_TM_FLAG_MASK                         = 0x001FFFFF
+};
+typedef uint32 wl_nan_wfa_testmode_t;
+
+/* To be removed; replaced by wl_nan_vndr_payload */
+typedef struct wl_nan_vndr_ie {
+       uint32  flags;                  /* bitmask indicating which packet(s) contain this IE */
+       uint16  body_len;               /* length of body (does not include oui field) */
+       uint8   pad[2];
+       uint8   oui[DOT11_OUI_LEN];
+       uint8   pad2;
+       uint8   body[];                 /* vendor IE payload */
+} wl_nan_vndr_ie_t;
+
+typedef struct wl_nan_vndr_payload {
+       uint32  flags;                  /* bitmask indicating which packet(s) contain payload */
+       uint16  payload_len;            /* length of payload */
+       uint8   pad[2];
+       uint8   payload[];              /* payload to be appended to NAN frame */
+} wl_nan_vndr_payload_t;
+
+typedef struct wl_nan_dev_cap {
+       uint8 bands[NAN_MAX_BANDS];
+       uint8 awake_dw[NAN_MAX_BANDS];
+       uint8 overwrite_mapid[NAN_MAX_BANDS];
+       uint8 mapid;    /* dev cap mapid */
+       uint8 all_maps; /* applies to device */
+       uint8 paging;
+       uint8 pad[3];
+} wl_nan_dev_cap_t;
+
+/* arbitrary max len for frame template */
+#define WL_NAN_FRM_TPLT_MAX_LEN        1024
+
+typedef struct wl_nan_frm_tplt {
+       wl_nan_frame_type_t type;
+       uint8   pad;
+       uint16  len;            /* length of template */
+       uint8   data[];         /* template */
+} wl_nan_frm_tplt_t;
+
+#define RSSI_THRESHOLD_SIZE 16
+#define MAX_IMP_RESP_SIZE 256
+
+typedef struct wl_proxd_rssi_bias {
+       int32           version;                        /**< version */
+       int32           threshold[RSSI_THRESHOLD_SIZE]; /**< threshold */
+       int32           peak_offset;                    /**< peak offset */
+       int32           bias;                           /**< rssi bias */
+       int32           gd_delta;                       /**< GD - GD_ADJ */
+       int32           imp_resp[MAX_IMP_RESP_SIZE];    /**< (Hi*Hi)+(Hr*Hr) */
+} wl_proxd_rssi_bias_t;
+
+typedef struct wl_proxd_rssi_bias_avg {
+       int32           avg_threshold[RSSI_THRESHOLD_SIZE];     /**< avg threshold */
+       int32           avg_peak_offset;                        /**< avg peak offset */
+       int32           avg_rssi;                               /**< avg rssi */
+       int32           avg_bias;                               /**< avg bias */
+} wl_proxd_rssi_bias_avg_t;
+
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_collect_info {
+       uint16          type;  /**< type: 0 channel table, 1 channel smoothing table, 2 and 3 seq */
+       uint16          index;          /**< The current frame index, from 1 to total_frames. */
+       uint16          tof_cmd;        /**< M_TOF_CMD      */
+       uint16          tof_rsp;        /**< M_TOF_RSP      */
+       uint16          tof_avb_rxl;    /**< M_TOF_AVB_RX_L */
+       uint16          tof_avb_rxh;    /**< M_TOF_AVB_RX_H */
+       uint16          tof_avb_txl;    /**< M_TOF_AVB_TX_L */
+       uint16          tof_avb_txh;    /**< M_TOF_AVB_TX_H */
+       uint16          tof_id;         /**< M_TOF_ID */
+       uint8           tof_frame_type;
+       uint8           tof_frame_bw;
+       int8            tof_rssi;
+       int32           tof_cfo;
+       int32           gd_adj_ns;      /**< gound delay */
+       int32           gd_h_adj_ns;    /**< group delay + threshold crossing */
+       int16           nfft;           /**< number of samples stored in H */
+       uint8           num_max_cores;
+
+} BWL_POST_PACKED_STRUCT wl_proxd_collect_info_t;
+#include <packed_section_end.h>
+
+#define K_TOF_COLLECT_H_PAD 1
+#define K_TOF_COLLECT_SC_20MHZ (64)
+/* Maximum possible size of sample capture */
+#define K_TOF_COLLECT_SC_80MHZ (2*K_TOF_COLLECT_SC_20MHZ)
+/* Maximum possible size of channel dump */
+#define K_TOF_COLLECT_CHAN_SIZE (2*K_TOF_COLLECT_SC_80MHZ)
+
+/*
+A few extra samples are required to estimate frequency offset
+Right now 16 samples are being used. Can be changed in future.
+*/
+#define K_TOF_COLLECT_SAMP_SIZE_20MHZ          ((2u) * (K_TOF_COLLECT_SC_20MHZ) + \
+                                                       (16u) + (K_TOF_COLLECT_H_PAD))
+#define K_TOF_COLLECT_RAW_SAMP_SIZE_20MHZ      ((2u) * (K_TOF_COLLECT_SAMP_SIZE_20MHZ))
+#define K_TOF_COLLECT_H_SIZE_20MHZ             (K_TOF_COLLECT_SAMP_SIZE_20MHZ)
+#define K_TOF_COLLECT_HRAW_SIZE_20MHZ          (K_TOF_COLLECT_RAW_SAMP_SIZE_20MHZ)
+
+#define K_TOF_COLLECT_SAMP_SIZE_80MHZ          ((2u) * (K_TOF_COLLECT_SC_80MHZ) + \
+                                                       (16u) + (K_TOF_COLLECT_H_PAD))
+#define K_TOF_COLLECT_RAW_SAMP_SIZE_80MHZ      ((2u) * K_TOF_COLLECT_SAMP_SIZE_80MHZ)
+#define K_TOF_COLLECT_H_SIZE_80MHZ             (K_TOF_COLLECT_SAMP_SIZE_80MHZ)
+#define K_TOF_COLLECT_HRAW_SIZE_80MHZ          (K_TOF_COLLECT_RAW_SAMP_SIZE_80MHZ)
+#define K_TOF_COLLECT_HRAW_SIZE_20MHZ_1FS      (K_TOF_COLLECT_SAMP_SIZE_20MHZ)
+#define K_TOF_COLLECT_HRAW_SIZE_80MHZ_1FS      ((2u) * (K_TOF_COLLECT_SAMP_SIZE_20MHZ))
+
+#define WL_PROXD_COLLECT_DATA_VERSION_1                1
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_collect_data_v1 {
+       wl_proxd_collect_info_t  info;
+       uint8   ri_rr[FTM_TPK_RI_RR_LEN];
+       /**< raw data read from phy used to adjust timestamps */
+       uint32  H[K_TOF_COLLECT_H_SIZE_20MHZ];
+} BWL_POST_PACKED_STRUCT wl_proxd_collect_data_t_v1;
+#include <packed_section_end.h>
+
+#define WL_PROXD_COLLECT_DATA_VERSION_2                2
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_collect_data_v2 {
+       wl_proxd_collect_info_t  info;
+       uint8   ri_rr[FTM_TPK_RI_RR_LEN_SECURE_2_0];
+       /**< raw data read from phy used to adjust timestamps */
+       uint32  H[K_TOF_COLLECT_H_SIZE_20MHZ];
+} BWL_POST_PACKED_STRUCT wl_proxd_collect_data_t_v2;
+#include <packed_section_end.h>
+
+#define WL_PROXD_COLLECT_DATA_VERSION_3         3
+typedef struct wl_proxd_collect_data_v3 {
+       uint16                  version;
+       uint16                  len;
+       wl_proxd_collect_info_t info;
+       uint8                   ri_rr[FTM_TPK_RI_RR_LEN_SECURE_2_0];
+       /**< raw data read from phy used to adjust timestamps */
+       uint32                  H[K_TOF_COLLECT_H_SIZE_20MHZ];
+       uint32                  chan[4 * K_TOF_COLLECT_CHAN_SIZE];
+} wl_proxd_collect_data_t_v3;
+
+#define WL_PROXD_COLLECT_DATA_VERSION_4         4
+typedef struct wl_proxd_collect_data_v4 {
+       uint16                  version;
+       uint16                  len;
+       wl_proxd_collect_info_t info;
+       uint8                   ri_rr[FTM_TPK_RI_RR_LEN_SECURE_2_0_5G];
+       /**< raw data read from phy used to adjust timestamps */
+       uint32                  H[K_TOF_COLLECT_H_SIZE_20MHZ];
+       uint32                  chan[4 * K_TOF_COLLECT_CHAN_SIZE];
+} wl_proxd_collect_data_t_v4;
+#define WL_PROXD_COLLECT_DATA_VERSION_MAX      WL_PROXD_COLLECT_DATA_VERSION_4
+
+typedef struct wl_proxd_debug_data {
+       uint8           count;          /**< number of packets */
+       uint8           stage;          /**< state machone stage */
+       uint8           received;       /**< received or txed */
+       uint8           paket_type;     /**< packet type */
+       uint8           category;       /**< category field */
+       uint8           action;         /**< action field */
+       uint8           token;          /**< token number */
+       uint8           follow_token;   /**< following token number */
+       uint16          index;          /**< index of the packet */
+       uint16          tof_cmd;        /**< M_TOF_CMD */
+       uint16          tof_rsp;        /**< M_TOF_RSP */
+       uint16          tof_avb_rxl;    /**< M_TOF_AVB_RX_L */
+       uint16          tof_avb_rxh;    /**< M_TOF_AVB_RX_H */
+       uint16          tof_avb_txl;    /**< M_TOF_AVB_TX_L */
+       uint16          tof_avb_txh;    /**< M_TOF_AVB_TX_H */
+       uint16          tof_id;         /**< M_TOF_ID */
+       uint16          tof_status0;    /**< M_TOF_STATUS_0 */
+       uint16          tof_status2;    /**< M_TOF_STATUS_2 */
+       uint16          tof_chsm0;      /**< M_TOF_CHNSM_0 */
+       uint16          tof_phyctl0;    /**< M_TOF_PHYCTL0 */
+       uint16          tof_phyctl1;    /**< M_TOF_PHYCTL1 */
+       uint16          tof_phyctl2;    /**< M_TOF_PHYCTL2 */
+       uint16          tof_lsig;       /**< M_TOF_LSIG */
+       uint16          tof_vhta0;      /**< M_TOF_VHTA0 */
+       uint16          tof_vhta1;      /**< M_TOF_VHTA1 */
+       uint16          tof_vhta2;      /**< M_TOF_VHTA2 */
+       uint16          tof_vhtb0;      /**< M_TOF_VHTB0 */
+       uint16          tof_vhtb1;      /**< M_TOF_VHTB1 */
+       uint16          tof_apmductl;   /**< M_TOF_AMPDU_CTL */
+       uint16          tof_apmdudlim;  /**< M_TOF_AMPDU_DLIM */
+       uint16          tof_apmdulen;   /**< M_TOF_AMPDU_LEN */
+} wl_proxd_debug_data_t;
+
+/** version of the wl_wsec_info structure */
+#define WL_WSEC_INFO_VERSION 0x01
+
+/** start enum value for BSS properties */
+#define WL_WSEC_INFO_BSS_BASE 0x0100
+/* for WFA testing (CTT testbed) */
+#define WL_WSEC_INFO_TEST_BASE 0x0300
+/** size of len and type fields of wl_wsec_info_tlv_t struct */
+#define WL_WSEC_INFO_TLV_HDR_LEN OFFSETOF(wl_wsec_info_tlv_t, data)
+
+/** Allowed wl_wsec_info properties; not all of them may be supported. */
+typedef enum {
+       WL_WSEC_INFO_NONE = 0,
+       WL_WSEC_INFO_MAX_KEYS = 1,
+       WL_WSEC_INFO_NUM_KEYS = 2,
+       WL_WSEC_INFO_NUM_HW_KEYS = 3,
+       WL_WSEC_INFO_MAX_KEY_IDX = 4,
+       WL_WSEC_INFO_NUM_REPLAY_CNTRS = 5,
+       WL_WSEC_INFO_SUPPORTED_ALGOS = 6,
+       WL_WSEC_INFO_MAX_KEY_LEN = 7,
+       WL_WSEC_INFO_FLAGS = 8,
+       /* add global/per-wlc properties above */
+       WL_WSEC_INFO_BSS_FLAGS = (WL_WSEC_INFO_BSS_BASE + 1),
+       WL_WSEC_INFO_BSS_WSEC = (WL_WSEC_INFO_BSS_BASE + 2),
+       WL_WSEC_INFO_BSS_TX_KEY_ID = (WL_WSEC_INFO_BSS_BASE + 3),
+       WL_WSEC_INFO_BSS_ALGO = (WL_WSEC_INFO_BSS_BASE + 4),
+       WL_WSEC_INFO_BSS_KEY_LEN = (WL_WSEC_INFO_BSS_BASE + 5),
+       WL_WSEC_INFO_BSS_ALGOS = (WL_WSEC_INFO_BSS_BASE + 6),
+       WL_WSEC_INFO_BSS_WPA_AP_RESTRICT = (WL_WSEC_INFO_BSS_BASE + 7),
+       WL_WSEC_INFO_BSS_PMK_PASSPHRASE = (WL_WSEC_INFO_BSS_BASE + 8),
+       WL_WSEC_INFO_BSS_SAE_PWE = (WL_WSEC_INFO_BSS_BASE + 9),
+       /*
+        * ADD NEW ENUM ABOVE HERE
+        */
+       /* WPA3 CTT: supported SAE groups */
+       WL_WSEC_INFO_TEST_SAE_GROUPS = (WL_WSEC_INFO_TEST_BASE),
+       /* WPA3 CTT: SAE group id injecting into rejected group IE */
+       WL_WSEC_INFO_TEST_SAE_GROUP_REJ = (WL_WSEC_INFO_TEST_BASE + 1),
+       /* add per-BSS properties above */
+       WL_WSEC_INFO_MAX = 0xffff
+} wl_wsec_info_type_t;
+
+#define WL_WSEC_PMK_INFO_VERSION               0x0100 /**< version 1.0 */
+
+typedef uint16 wl_wsec_info_pmk_info_flags_t;
+typedef uint32 wl_wsec_info_pmk_lifetime_t;
+typedef uint8 wl_wsec_info_akm_mask_t;
+typedef uint16 wl_wsec_info_pmk_info_flags;
+
+enum {
+       WL_WSEC_PMK_INFO_SSID_PRESENT   = 0x1,
+       WL_WSEC_PMK_DEFAULT_LIFETIME    = 0x2
+};
+
+struct bcm_xlo {
+       uint16 len;
+       uint16 off;
+};
+typedef struct bcm_xlo bcm_xlo_t;
+
+/*
+** all offsets are from the beginning of the structure that starts
+** with the version field and length field is the total length of the structure
+** including the version and length fields
+*/
+typedef struct wl_wsec_info_pmk_info {
+       uint16 version;  /* WL_WSEC_PMK_INFO_VERSION */
+       uint16 len;
+       uint16 next_offset;  /* If non zero, specifies offset of next next_offset field */
+       wl_wsec_info_pmk_info_flags_t flags;    /* Fill in the input based on the flags */
+       wl_wsec_info_pmk_lifetime_t pmk_lifetime;
+       wl_wsec_info_akm_mask_t akm_mask;       /* RSN authenticated key management suite */
+       uint8 rsvd[3];          /* reserved for future use */
+       bcm_xlo_t ssid; /* ssid - key, zero length is allowed for SSID */
+       bcm_xlo_t bssid;        /* bssid - key, zero length = broadcast/wildcard */
+       bcm_xlo_t pass_id;      /* key - optional password id for SAE */
+       bcm_xlo_t pmk;  /* pmk - either 32 or 48 byte for SuiteB-192 */
+       bcm_xlo_t passphrase;   /* passphrase info */
+       /* data follows */
+} wl_wsec_info_pmk_info_t;
+
+typedef struct {
+       uint32 algos; /* set algos to be enabled/disabled */
+       uint32 mask; /* algos outside mask unaltered */
+} wl_wsec_info_algos_t;
+
+/** tlv used to return wl_wsec_info properties */
+typedef struct {
+       uint16 type;
+       uint16 len;             /**< data length */
+       uint8 data[1];  /**< data follows */
+} wl_wsec_info_tlv_t;
+
+/** input/output data type for wsec_info iovar */
+typedef struct wl_wsec_info {
+       uint8 version; /**< structure version */
+       uint8 pad[2];
+       uint8 num_tlvs;
+       wl_wsec_info_tlv_t tlvs[1]; /**< tlv data follows */
+} wl_wsec_info_t;
+#define AP_BLOCK_NONE          0x0000  /* default: No restriction */
+#define AP_ALLOW_WPA2          0x0001  /* allow WPA2PSK AP */
+#define AP_ALLOW_TSN           0x0002  /* WPA3 transition AP  */
+#define AP_ALLOW_WPA3_ONLY     0x0004  /* WPA3 only AP */
+#define AP_ALLOW_MAX   (AP_ALLOW_WPA2 | AP_ALLOW_TSN | \
+                       AP_ALLOW_WPA3_ONLY)
+typedef struct {
+       uint32 wpa_ap_restrict; /* set WPA2 / WPA3 AP restriction policy */
+} wl_wsec_info_wpa_ap_restrict_t;
+
+/* SAE PWE derivation method */
+#define SAE_PWE_LOOP   0x1u
+#define SAE_PWE_H2E    0x2u
+
+/*
+ * randmac definitions
+ */
+#define WL_RANDMAC_MODULE                      "randmac"
+#define WL_RANDMAC_API_VERSION         0x0100 /**< version 1.0 */
+#define WL_RANDMAC_API_MIN_VERSION     0x0100 /**< version 1.0 */
+
+/** subcommands that can apply to randmac */
+enum {
+       WL_RANDMAC_SUBCMD_NONE                          = 0,
+       WL_RANDMAC_SUBCMD_GET_VERSION                   = 1,
+       WL_RANDMAC_SUBCMD_ENABLE                        = 2,
+       WL_RANDMAC_SUBCMD_DISABLE                       = 3,
+       WL_RANDMAC_SUBCMD_CONFIG                        = 4,
+       WL_RANDMAC_SUBCMD_STATS                         = 5,
+       WL_RANDMAC_SUBCMD_CLEAR_STATS                   = 6,
+
+       WL_RANDMAC_SUBCMD_MAX
+};
+typedef int16 wl_randmac_subcmd_t;
+
+/* Common IOVAR struct */
+typedef struct wl_randmac {
+       uint16 version;
+       uint16 len;                     /* total length */
+       wl_randmac_subcmd_t subcmd_id;  /* subcommand id */
+       uint8 data[0];                  /* subcommand data */
+} wl_randmac_t;
+
+#define WL_RANDMAC_IOV_HDR_SIZE OFFSETOF(wl_randmac_t, data)
+
+/* randmac version subcommand */
+typedef struct wl_randmac_version {
+       uint16 version;  /* Randmac method version info */
+       uint8 pad[2];    /* Align on 4 byte boundary */
+} wl_randmac_version_t;
+
+/*
+ * Bitmask for methods supporting MAC randomization feature
+ */
+#define WL_RANDMAC_USER_NONE           0x0000
+#define WL_RANDMAC_USER_FTM            0x0001
+#define WL_RANDMAC_USER_NAN            0x0002
+#define WL_RANDMAC_USER_SCAN           0x0004
+#define WL_RANDMAC_USER_ANQP           0x0008
+#define WL_RANDMAC_USER_ALL            0xFFFF
+typedef uint16 wl_randmac_method_t;
+
+enum {
+       WL_RANDMAC_FLAGS_NONE   = 0x00,
+       WL_RANDMAC_FLAGS_ADDR   = 0x01,
+       WL_RANDMAC_FLAGS_MASK   = 0x02,
+       WL_RANDMAC_FLAGS_METHOD = 0x04,
+       WL_RANDMAC_FLAGS_ALL    = 0xFF
+};
+typedef uint8 wl_randmac_flags_t;
+
+/* randmac statistics subcommand */
+typedef struct wl_randmac_stats {
+       uint32 set_ok;          /* Set random addr success count */
+       uint32 set_fail;        /* Set random addr failed count */
+       uint32 set_reqs;        /* Set random addr count */
+       uint32 reset_reqs;      /* Restore random addr count */
+       uint32 restore_ok;      /* Restore random addr succes count */
+       uint32 restore_fail;    /* Restore random addr failed count */
+       uint32 events_sent;     /* randmac module events count */
+       uint32 events_rcvd;     /* randmac events received count */
+} wl_randmac_stats_t;
+
+/* randmac config subcommand */
+typedef struct wl_randmac_config {
+       struct ether_addr addr;                 /* Randomized MAC address */
+       struct ether_addr addr_mask;            /* bitmask for randomization */
+       wl_randmac_method_t method;             /* Enabled methods */
+       wl_randmac_flags_t flags;               /* What config info changed */
+       uint8   PAD;
+} wl_randmac_config_t;
+
+enum {
+       WL_RANDMAC_EVENT_NONE                   = 0,    /**< not an event, reserved */
+       WL_RANDMAC_EVENT_BSSCFG_ADDR_SET        = 1,    /* bsscfg addr randomized */
+       WL_RANDMAC_EVENT_BSSCFG_ADDR_RESTORE    = 2,    /* bsscfg addr restored */
+       WL_RANDMAC_EVENT_ENABLED                = 3,    /* randmac module enabled */
+       WL_RANDMAC_EVENT_DISABLE                = 4,    /* randmac module disabled */
+       WL_RANDMAC_EVENT_BSSCFG_STATUS  = 5,    /* bsscfg enable/disable */
+
+       WL_RANDMAC_EVENT_MAX
+};
+typedef int16 wl_randmac_event_type_t;
+typedef int32 wl_randmac_status_t;
+typedef uint32 wl_randmac_event_mask_t;
+
+#define WL_RANDMAC_EVENT_MASK_ALL 0xfffffffe
+#define WL_RANDMAC_EVENT_MASK_EVENT(_event_type) (1 << (_event_type))
+#define WL_RANDMAC_EVENT_ENABLED(_mask, _event_type) (\
+       ((_mask) & WL_RANDMAC_EVENT_MASK_EVENT(_event_type)) != 0)
+
+/** tlv IDs - data length 4 bytes unless overridden by type, alignment 32 bits */
+enum {
+       WL_RANDMAC_TLV_NONE             = 0,
+       WL_RANDMAC_TLV_METHOD           = 1,
+       WL_RANDMAC_TLV_ADDR             = 2,
+       WL_RANDMAC_TLV_MASK             = 3
+};
+typedef uint16 wl_randmac_tlv_id_t;
+
+typedef struct wl_randmac_tlv {
+       wl_randmac_tlv_id_t id;
+       uint16 len;             /* Length of variable */
+       uint8  data[1];
+} wl_randmac_tlv_t;
+
+/** randmac event */
+typedef struct wl_randmac_event {
+       uint16                                  version;
+       uint16                                  len;    /* Length of all variables */
+       wl_randmac_event_type_t                 type;
+       wl_randmac_method_t                     method;
+       uint8                                   pad[2];
+       wl_randmac_tlv_t                        tlvs[1];        /**< variable */
+} wl_randmac_event_t;
+
+/*
+ * scan MAC definitions
+ */
+
+/** common iovar struct */
+typedef struct wl_scanmac {
+       uint16 subcmd_id;       /**< subcommand id */
+       uint16 len;             /**< total length of data[] */
+       uint8 data[];           /**< subcommand data */
+} wl_scanmac_t;
+
+/* subcommand ids */
+#define WL_SCANMAC_SUBCMD_ENABLE   0
+#define WL_SCANMAC_SUBCMD_BSSCFG   1   /**< only GET supported */
+#define WL_SCANMAC_SUBCMD_CONFIG   2
+
+/** scanmac enable data struct */
+typedef struct wl_scanmac_enable {
+       uint8 enable;   /**< 1 - enable, 0 - disable */
+       uint8 pad[3];   /**< 4-byte struct alignment */
+} wl_scanmac_enable_t;
+
+/** scanmac bsscfg data struct */
+typedef struct wl_scanmac_bsscfg {
+       uint32 bsscfg;  /**< bsscfg index */
+} wl_scanmac_bsscfg_t;
+
+/** scanmac config data struct */
+typedef struct wl_scanmac_config {
+       struct ether_addr mac;  /**< 6 bytes of MAC address or MAC prefix (i.e. OUI) */
+       struct ether_addr random_mask;  /**< randomized bits on each scan */
+       uint16 scan_bitmap;     /**< scans to use this MAC address */
+       uint8 pad[2];   /**< 4-byte struct alignment */
+} wl_scanmac_config_t;
+
+/* scan bitmap */
+#define WL_SCANMAC_SCAN_UNASSOC         (0x01 << 0u)   /**< unassociated scans */
+#define WL_SCANMAC_SCAN_ASSOC_ROAM     (0x01 << 1u)    /**< associated roam scans */
+#define WL_SCANMAC_SCAN_ASSOC_PNO      (0x01 << 2u)    /**< associated PNO scans */
+#define WL_SCANMAC_SCAN_ASSOC_HOST     (0x01 << 3u)    /**< associated host scans */
+#define WL_SCANMAC_SCAN_RAND_PERPRQ    (0x01 << 4u)    /* enable per probe rand */
+#define WL_SCANMAC_SCAN_RAND_SCANCH    (0x01 << 5u)    /* enable scan chan rand */
+
+#define WL_SCAN_EVENT_VER1     1
+#define WL_SCAN_EVENT_VER2     2
+
+#define WL_SCAN_TYPE_ASSOC      0x1   /* Assoc scan     */
+#define WL_SCAN_TYPE_ROAM       0x2   /* Roam scan     */
+#define WL_SCAN_TYPE_FWSCAN     0x4   /* Other FW scan     */
+#define WL_SCAN_TYPE_HOSTSCAN   0x8   /* Host scan     */
+
+typedef struct scan_event_data {
+       uint32 version;
+       uint32 flags;
+       uint16 num_chan_slice0;
+       uint16 num_chan_slice1;
+       /* Will contain num_chan_slice0 followed by num_chan_slice1 chanspecs */
+       chanspec_t scan_chan_list[];
+} scan_event_data_v1_t;
+
+/** tlv used to return chanspec list of each slice */
+typedef struct scan_chan_tlv {
+       uint16 type; /* slice index */
+       uint16 len; /* data length */
+       uint8 data[1]; /* chanspec list */
+} scan_chan_tlv_t;
+
+typedef struct scan_event_data_v2 {
+       uint32 version;
+       uint32 flags;
+       uint32 num_tlvs; /* no of chanspec list tlvs */
+       scan_chan_tlv_t tlvs[1];
+} scan_event_data_v2_t;
+
+#ifdef WL_SCAN_EVENT_V2
+typedef scan_event_data_v2_t   scan_event_data_t;
+#define WL_SCAN_EVENT_FIXED_LEN_V2     OFFSETOF(scan_event_data_t, tlvs)
+#define WL_SCAN_EVENT_VERSION  WL_SCAN_EVENT_VER2
+#else
+#define WL_SCAN_EVENT_VERSION  WL_SCAN_EVENT_VER1
+typedef scan_event_data_v1_t   scan_event_data_t;
+#endif
+
+/*
+ * bonjour dongle offload definitions
+ */
+
+/* common iovar struct */
+typedef struct wl_bdo {
+       uint16 subcmd_id;       /* subcommand id */
+       uint16 len;             /* total length of data[] */
+       uint8 data[];           /* subcommand data */
+} wl_bdo_t;
+
+/* subcommand ids */
+#define WL_BDO_SUBCMD_DOWNLOAD         0       /* Download flattened database  */
+#define WL_BDO_SUBCMD_ENABLE           1       /* Start bonjour after download */
+#define WL_BDO_SUBCMD_MAX_DOWNLOAD     2       /* Get the max download size    */
+
+/* maximum fragment size */
+#define BDO_MAX_FRAGMENT_SIZE  1024
+
+/* download flattened database
+ *
+ * BDO must be disabled before database download else fail.
+ *
+ * If database size is within BDO_MAX_FRAGMENT_SIZE then only a single fragment
+ * is required (i.e. frag_num = 0, total_size = frag_size).
+ * If database size exceeds BDO_MAX_FRAGMENT_SIZE then multiple fragments are required.
+ */
+typedef struct wl_bdo_download {
+       uint16 total_size;      /* total database size */
+       uint16 frag_num;        /* fragment number, 0 for first fragment, N-1 for last fragment */
+       uint16 frag_size;       /* size of fragment (max BDO_MAX_FRAGMENT_SIZE) */
+       uint8 pad[2];           /* 4-byte struct alignment */
+       uint8 fragment[BDO_MAX_FRAGMENT_SIZE];  /* fragment data */
+} wl_bdo_download_t;
+
+/* enable
+ *
+ * Enable requires a downloaded database else fail.
+ */
+typedef struct wl_bdo_enable {
+       uint8 enable;   /* 1 - enable, 0 - disable */
+       uint8 pad[3];   /* 4-byte struct alignment */
+} wl_bdo_enable_t;
+
+/*
+ * Get the max download size for Bonjour Offload.
+ */
+typedef struct wl_bdo_max_download {
+       uint16 size;    /* Max download size in bytes */
+       uint8 pad[2];   /* 4-byte struct alignment    */
+} wl_bdo_max_download_t;
+
+/*
+ * TCP keepalive offload definitions
+ */
+
+/* common iovar struct */
+typedef struct wl_tko {
+       uint16 subcmd_id;       /* subcommand id */
+       uint16 len;             /* total length of data[] */
+       uint8 data[];           /* subcommand data */
+} wl_tko_t;
+
+/* subcommand ids */
+#define WL_TKO_SUBCMD_MAX_TCP          0       /* max TCP connections supported */
+#define WL_TKO_SUBCMD_PARAM            1       /* configure offload common parameters  */
+#define WL_TKO_SUBCMD_CONNECT          2       /* TCP connection info */
+#define WL_TKO_SUBCMD_ENABLE           3       /* enable/disable */
+#define WL_TKO_SUBCMD_STATUS           4       /* TCP connection status */
+
+/* WL_TKO_SUBCMD_MAX_CONNECT subcommand data */
+typedef struct wl_tko_max_tcp {
+       uint8 max;      /* max TCP connections supported */
+       uint8 pad[3];   /* 4-byte struct alignment */
+} wl_tko_max_tcp_t;
+
+/* WL_TKO_SUBCMD_PARAM subcommand data */
+typedef struct wl_tko_param {
+       uint16 interval;        /* keepalive tx interval (secs) */
+       uint16 retry_interval;  /* keepalive retry interval (secs) */
+       uint16 retry_count;     /* retry_count */
+       uint8 pad[2];           /* 4-byte struct alignment */
+} wl_tko_param_t;
+
+/* WL_TKO_SUBCMD_CONNECT subcommand data
+ * invoke with unique 'index' for each TCP connection
+ */
+typedef struct wl_tko_connect {
+       uint8 index;            /* TCP connection index, 0 to max-1 */
+       uint8 ip_addr_type;     /* 0 - IPv4, 1 - IPv6 */
+       uint16 local_port;      /* local port */
+       uint16 remote_port;     /* remote port */
+       uint16 PAD;
+       uint32 local_seq;       /* local sequence number */
+       uint32 remote_seq;      /* remote sequence number */
+       uint16 request_len;     /* TCP keepalive request packet length */
+       uint16 response_len;    /* TCP keepalive response packet length */
+       uint8 data[];           /* variable length field containing local/remote IPv4/IPv6,
+                                * TCP keepalive request packet, TCP keepalive response packet
+                                *    For IPv4, length is 4 * 2 + request_length + response_length
+                                *       offset 0 - local IPv4
+                                *       offset 4 - remote IPv4
+                                *       offset 8 - TCP keepalive request packet
+                                *       offset 8+request_length - TCP keepalive response packet
+                                *    For IPv6, length is 16 * 2 + request_length + response_length
+                                *       offset 0 - local IPv6
+                                *       offset 16 - remote IPv6
+                                *       offset 32 - TCP keepalive request packet
+                                *       offset 32+request_length - TCP keepalive response packet
+                                */
+} wl_tko_connect_t;
+
+/* WL_TKO_SUBCMD_CONNECT subcommand data to GET configured info for specific index */
+typedef struct wl_tko_get_connect {
+       uint8 index;            /* TCP connection index, 0 to max-1 */
+       uint8 pad[3];           /* 4-byte struct alignment */
+} wl_tko_get_connect_t;
+
+typedef struct wl_tko_enable {
+       uint8 enable;   /* 1 - enable, 0 - disable */
+       uint8 pad[3];   /* 4-byte struct alignment */
+} wl_tko_enable_t;
+
+/* WL_TKO_SUBCMD_STATUS subcommand data */
+/* must be invoked before tko is disabled else status is unavailable */
+typedef struct wl_tko_status {
+       uint8 count;            /* number of status entries (i.e. equals
+                                * max TCP connections supported)
+                                */
+       uint8 status[1];        /* variable length field contain status for
+                                * each TCP connection index
+                                */
+} wl_tko_status_t;
+
+typedef enum {
+       TKO_STATUS_NORMAL                       = 0,    /* TCP connection normal, no error */
+       TKO_STATUS_NO_RESPONSE                  = 1,    /* no response to TCP keepalive */
+       TKO_STATUS_NO_TCP_ACK_FLAG              = 2,    /* TCP ACK flag not set */
+       TKO_STATUS_UNEXPECT_TCP_FLAG            = 3,    /* unexpect TCP flags set other than ACK */
+       TKO_STATUS_SEQ_NUM_INVALID              = 4,    /* ACK != sequence number */
+       TKO_STATUS_REMOTE_SEQ_NUM_INVALID       = 5,    /* SEQ > remote sequence number */
+       TKO_STATUS_TCP_DATA                     = 6,    /* TCP data available */
+       TKO_STATUS_UNAVAILABLE                  = 255,  /* not used/configured */
+} tko_status_t;
+
+enum rssi_reason {
+       RSSI_REASON_UNKNOW = 0,
+       RSSI_REASON_LOWRSSI = 1,
+       RSSI_REASON_NSYC = 2,
+       RSSI_REASON_TIMEOUT = 3
+};
+
+enum tof_reason {
+       TOF_REASON_OK = 0,
+       TOF_REASON_REQEND = 1,
+       TOF_REASON_TIMEOUT = 2,
+       TOF_REASON_NOACK = 3,
+       TOF_REASON_INVALIDAVB = 4,
+       TOF_REASON_INITIAL = 5,
+       TOF_REASON_ABORT = 6
+};
+
+enum rssi_state {
+       RSSI_STATE_POLL = 0,
+       RSSI_STATE_TPAIRING = 1,
+       RSSI_STATE_IPAIRING = 2,
+       RSSI_STATE_THANDSHAKE = 3,
+       RSSI_STATE_IHANDSHAKE = 4,
+       RSSI_STATE_CONFIRMED = 5,
+       RSSI_STATE_PIPELINE = 6,
+       RSSI_STATE_NEGMODE = 7,
+       RSSI_STATE_MONITOR = 8,
+       RSSI_STATE_LAST = 9
+};
+
+enum tof_state {
+       TOF_STATE_IDLE   = 0,
+       TOF_STATE_IWAITM = 1,
+       TOF_STATE_TWAITM = 2,
+       TOF_STATE_ILEGACY = 3,
+       TOF_STATE_IWAITCL = 4,
+       TOF_STATE_TWAITCL = 5,
+       TOF_STATE_ICONFIRM = 6,
+       TOF_STATE_IREPORT = 7
+};
+
+enum tof_mode_type {
+       TOF_LEGACY_UNKNOWN      = 0,
+       TOF_LEGACY_AP           = 1,
+       TOF_NONLEGACY_AP        = 2
+};
+
+enum tof_way_type {
+       TOF_TYPE_ONE_WAY = 0,
+       TOF_TYPE_TWO_WAY = 1,
+       TOF_TYPE_REPORT = 2
+};
+
+enum tof_rate_type {
+       TOF_FRAME_RATE_VHT = 0,
+       TOF_FRAME_RATE_LEGACY = 1
+};
+
+#define TOF_ADJ_TYPE_NUM       4       /**< number of assisted timestamp adjustment */
+enum tof_adj_mode {
+       TOF_ADJ_SOFTWARE = 0,
+       TOF_ADJ_HARDWARE = 1,
+       TOF_ADJ_SEQ = 2,
+       TOF_ADJ_NONE = 3
+};
+
+#define FRAME_TYPE_NUM         4       /**< number of frame type */
+enum frame_type {
+       FRAME_TYPE_CCK  = 0,
+       FRAME_TYPE_OFDM = 1,
+       FRAME_TYPE_11N  = 2,
+       FRAME_TYPE_11AC = 3
+};
+
+typedef struct wl_proxd_status_iovar {
+       uint16                  method;                         /**< method */
+       uint8                   mode;                           /**< mode */
+       uint8                   peermode;                       /**< peer mode */
+       uint8                   state;                          /**< state */
+       uint8                   reason;                         /**< reason code */
+       uint8                   PAD[2];
+       uint32                  distance;                       /**< distance */
+       uint32                  txcnt;                          /**< tx pkt counter */
+       uint32                  rxcnt;                          /**< rx pkt counter */
+       struct ether_addr       peer;                           /**< peer mac address */
+       int8                    avg_rssi;                       /**< average rssi */
+       int8                    hi_rssi;                        /**< highest rssi */
+       int8                    low_rssi;                       /**< lowest rssi */
+       uint8                   PAD[3];
+       uint32                  dbgstatus;                      /**< debug status */
+       uint16                  frame_type_cnt[FRAME_TYPE_NUM]; /**< frame types */
+       uint8                   adj_type_cnt[TOF_ADJ_TYPE_NUM]; /**< adj types HW/SW */
+} wl_proxd_status_iovar_t;
+
+/* ifdef NET_DETECT */
+typedef struct net_detect_adapter_features {
+       uint8   wowl_enabled;
+       uint8   net_detect_enabled;
+       uint8   nlo_enabled;
+} net_detect_adapter_features_t;
+
+typedef enum net_detect_bss_type {
+       nd_bss_any = 0,
+       nd_ibss,
+       nd_ess
+} net_detect_bss_type_t;
+
+typedef struct net_detect_profile {
+       wlc_ssid_t              ssid;
+       net_detect_bss_type_t   bss_type;       /**< Ignore for now since Phase 1 is only for ESS */
+       uint32                  cipher_type;    /**< DOT11_CIPHER_ALGORITHM enumeration values */
+       uint32                  auth_type;      /**< DOT11_AUTH_ALGORITHM enumeration values */
+} net_detect_profile_t;
+
+typedef struct net_detect_profile_list {
+       uint32                  num_nd_profiles;
+       net_detect_profile_t    nd_profile[];
+} net_detect_profile_list_t;
+
+typedef struct net_detect_config {
+       uint8                       nd_enabled;
+       uint8                           PAD[3];
+       uint32                      scan_interval;
+       uint32                      wait_period;
+       uint8                       wake_if_connected;
+       uint8                       wake_if_disconnected;
+       uint8                           PAD[2];
+       net_detect_profile_list_t   nd_profile_list;
+} net_detect_config_t;
+
+typedef enum net_detect_wake_reason {
+       nd_reason_unknown,
+       nd_net_detected,
+       nd_wowl_event,
+       nd_ucode_error
+} net_detect_wake_reason_t;
+
+typedef struct net_detect_wake_data {
+       net_detect_wake_reason_t    nd_wake_reason;
+       uint32                      nd_wake_date_length;
+       uint8                       nd_wake_data[0];        /**< Wake data (currently unused) */
+} net_detect_wake_data_t;
+
+/* endif NET_DETECT */
+
+/* (unversioned, deprecated) */
+typedef struct bcnreq {
+       uint8 bcn_mode;
+       uint8 PAD[3];
+       int32 dur;
+       int32 channel;
+       struct ether_addr da;
+       uint16 random_int;
+       wlc_ssid_t ssid;
+       uint16 reps;
+       uint8 PAD[2];
+} bcnreq_t;
+
+#define WL_RRM_BCN_REQ_VER             1
+typedef struct bcn_req {
+       uint8 version;
+       uint8 bcn_mode;
+       uint8 pad_1[2];
+       int32 dur;
+       int32 channel;
+       struct ether_addr da;
+       uint16 random_int;
+       wlc_ssid_t ssid;
+       uint16 reps;
+       uint8 req_elements;
+       uint8 pad_2;
+       chanspec_list_t chspec_list;
+} bcn_req_t;
+
+typedef struct rrmreq {
+       struct ether_addr da;
+       uint8 reg;
+       uint8 chan;
+       uint16 random_int;
+       uint16 dur;
+       uint16 reps;
+} rrmreq_t;
+
+typedef struct framereq {
+       struct ether_addr da;
+       uint8 reg;
+       uint8 chan;
+       uint16 random_int;
+       uint16 dur;
+       struct ether_addr ta;
+       uint16 reps;
+} framereq_t;
+
+typedef struct statreq {
+       struct ether_addr da;
+       struct ether_addr peer;
+       uint16 random_int;
+       uint16 dur;
+       uint8 group_id;
+       uint8 PAD;
+       uint16 reps;
+} statreq_t;
+
+typedef struct txstrmreq {
+       struct ether_addr da;   /* Destination address */
+       uint16 random_int;      /* Random interval for measurement start */
+       uint16 dur;             /* Measurement duration */
+       uint16 reps;            /* number of repetitions */
+       struct ether_addr peer; /* Peer MAC address */
+       uint8 tid;              /* Traffic ID */
+       uint8 bin0_range;       /* Delay range of the first bin */
+} txstrmreq_t;
+
+typedef struct lcireq {
+       struct ether_addr da;   /* Destination address */
+       uint16 reps;            /* number of repetitions */
+       uint8 subj;             /* Local/Remote/Thid party */
+       uint8 lat_res;          /* Latitude requested Resolution */
+       uint8 lon_res;          /* Longitude requested Resolution */
+       uint8 alt_res;          /* Altitude requested Resolution */
+} lcireq_t;
+
+typedef struct civicreq {
+       struct ether_addr da;   /* Destination address */
+       uint16 reps;            /* number of repetitions */
+       uint8 subj;             /* Local/Remote/Thid party */
+       uint8 civloc_type;      /* Format of location info */
+       uint8 siu;              /* Unit of Location service interval */
+       uint8 pad;
+       uint16 si;              /* Location service interval */
+} civicreq_t;
+
+typedef struct locidreq {
+       struct ether_addr da;   /* Destination address */
+       uint16 reps;            /* number of repetitions */
+       uint8 subj;             /* Local/Remote/Thid party */
+       uint8 siu;              /* Unit of Location service interval */
+       uint16 si;              /* Location service interval */
+} locidreq_t;
+
+typedef struct wl_rrm_config_ioc {
+       uint16 version; /* command version */
+       uint16 id;      /* subiovar cmd ID */
+       uint16 len;     /* total length of all bytes in data[] */
+       uint16 pad;     /* 4-byte boundary padding */
+       uint8 data[1];  /* payload */
+} wl_rrm_config_ioc_t;
+
+enum {
+       WL_RRM_CONFIG_NONE      = 0,    /* reserved */
+       WL_RRM_CONFIG_GET_LCI   = 1,    /* get LCI */
+       WL_RRM_CONFIG_SET_LCI   = 2,    /* set LCI */
+       WL_RRM_CONFIG_GET_CIVIC = 3,    /* get civic location */
+       WL_RRM_CONFIG_SET_CIVIC = 4,    /* set civic location */
+       WL_RRM_CONFIG_GET_LOCID = 5,    /* get location identifier */
+       WL_RRM_CONFIG_SET_LOCID = 6,    /* set location identifier */
+       WL_RRM_CONFIG_MAX       = 7
+};
+
+#define WL_RRM_CONFIG_NAME "rrm_config"
+#define WL_RRM_CONFIG_MIN_LENGTH OFFSETOF(wl_rrm_config_ioc_t, data)
+
+enum {
+       WL_RRM_EVENT_NONE               = 0,    /* not an event, reserved */
+       WL_RRM_EVENT_FRNG_REQ   = 1,    /* Receipt of FRNG request frame */
+       WL_RRM_EVENT_FRNG_REP   = 2,    /* Receipt of FRNG report frame */
+
+       WL_RRM_EVENT_MAX
+};
+typedef int16 wl_rrm_event_type_t;
+
+typedef struct frngreq_target {
+       uint32 bssid_info;
+       uint8 channel;
+       uint8 phytype;
+       uint8 reg;
+       uint8 pad;
+       struct ether_addr bssid;
+       chanspec_t chanspec;
+       uint32 sid;
+} frngreq_target_t;
+
+typedef struct frngreq {
+       wl_rrm_event_type_t event;                      /* RRM event type */
+       struct ether_addr da;
+       uint16 max_init_delay;  /* Upper bound of random delay, in TUs */
+       uint8 min_ap_count;             /* Min FTM ranges requested (1-15) */
+       uint8 num_aps;                  /* Number of APs to range, at least min_ap_count */
+       uint16 max_age;                 /* Max elapsed time before FTM request, 0xFFFF = any */
+       uint16 reps;                    /* Number of repetitions of this measurement type */
+       frngreq_target_t targets[1];    /* Target BSSIDs to range */
+} frngreq_t;
+
+typedef struct frngrep_range {
+       uint32 start_tsf;               /* 4 lsb of tsf */
+       struct ether_addr bssid;
+       uint8 pad[2];
+       uint32 range;
+       uint32 max_err;
+       uint8  rsvd;
+       uint8 pad2[3];
+} frngrep_range_t;
+
+typedef struct frngrep_error {
+       uint32 start_tsf;               /* 4 lsb of tsf */
+       struct ether_addr bssid;
+       uint8  code;
+       uint8 pad[1];
+} frngrep_error_t;
+
+typedef struct frngrep {
+       wl_rrm_event_type_t event;                      /* RRM event type */
+       struct ether_addr da;
+       uint8 range_entry_count;
+       uint8 error_entry_count;
+       uint16 dialog_token;                            /* dialog token */
+       frngrep_range_t range_entries[DOT11_FTM_RANGE_ENTRY_MAX_COUNT];
+       frngrep_error_t error_entries[DOT11_FTM_RANGE_ERROR_ENTRY_MAX_COUNT];
+} frngrep_t;
+
+typedef struct wl_rrm_frng_ioc {
+       uint16 version; /* command version */
+       uint16 id;      /* subiovar cmd ID */
+       uint16 len;     /* total length of all bytes in data[] */
+       uint16 pad;     /* 4-byte boundary padding */
+       uint8 data[];  /* payload */
+} wl_rrm_frng_ioc_t;
+
+enum {
+       WL_RRM_FRNG_NONE        = 0,    /* reserved */
+       WL_RRM_FRNG_SET_REQ     = 1,    /* send ftm ranging request */
+       WL_RRM_FRNG_MAX         = 2
+};
+
+#define WL_RRM_FRNG_NAME "rrm_frng"
+#define WL_RRM_FRNG_MIN_LENGTH OFFSETOF(wl_rrm_frng_ioc_t, data)
+
+#define WL_RRM_RPT_VER         0
+#define WL_RRM_RPT_MAX_PAYLOAD 256
+#define WL_RRM_RPT_MIN_PAYLOAD 7
+#define WL_RRM_RPT_FALG_ERR    0
+#define WL_RRM_RPT_FALG_GRP_ID_PROPR   (1 << 0)
+#define WL_RRM_RPT_FALG_GRP_ID_0       (1 << 1)
+typedef struct {
+       uint16 ver;             /**< version */
+       struct ether_addr addr; /**< STA MAC addr */
+       uint32 timestamp;       /**< timestamp of the report */
+       uint16 flag;            /**< flag */
+       uint16 len;             /**< length of payload data */
+       uint8 data[WL_RRM_RPT_MAX_PAYLOAD];
+} statrpt_t;
+
+typedef struct wlc_dwds_config {
+       uint32          enable;
+       uint32          mode; /**< STA/AP interface */
+       struct ether_addr ea;
+       uint8  PAD[2];
+} wlc_dwds_config_t;
+
+typedef struct wl_el_set_params_s {
+       uint8 set;      /**< Set number */
+       uint8  PAD[3];
+       uint32 size;    /**< Size to make/expand */
+} wl_el_set_params_t;
+
+typedef struct wl_el_tag_params_s {
+       uint16 tag;
+       uint8 set;
+       uint8 flags;
+} wl_el_tag_params_t;
+
+#define EVENT_LOG_SET_TYPE_CURRENT_VERSION 0
+typedef struct wl_el_set_type_s {
+       uint16  version;
+       uint16  len;
+       uint8   set;    /* Set number */
+       uint8   type;   /* Type- EVENT_LOG_SET_TYPE_DEFAULT or EVENT_LOG_SET_TYPE_PRSRV */
+       uint16  PAD;
+} wl_el_set_type_t;
+
+#define EVENT_LOG_SET_TYPE_ALL_V1 1
+
+typedef struct wl_el_set_type_s_v1 {
+       uint8 set_val;
+       uint8 type_val;
+} wl_el_set_type_v1_t;
+
+typedef struct wl_el_set_all_type_s_v1 {
+       uint16  version;
+       uint16  len;
+       uint32  max_sets;
+       wl_el_set_type_v1_t set_type[1]; /* set-Type Values Array */
+} wl_el_set_all_type_v1_t;
+
+typedef struct wl_staprio_cfg {
+       struct ether_addr ea;   /**< mac addr */
+       uint8 prio;             /**< scb priority */
+} wl_staprio_cfg_t;
+
+#define STAMON_STACONFIG_VER    1
+/* size of struct wlc_stamon_sta_config_t elements */
+#define STAMON_STACONFIG_LENGTH 20
+
+typedef enum wl_stamon_cfg_cmd_type {
+       STAMON_CFG_CMD_DEL = 0,
+       STAMON_CFG_CMD_ADD = 1,
+       STAMON_CFG_CMD_ENB = 2,
+       STAMON_CFG_CMD_DSB = 3,
+       STAMON_CFG_CMD_CNT = 4,
+       STAMON_CFG_CMD_RSTCNT = 5,
+       STAMON_CFG_CMD_GET_STATS = 6,
+       STAMON_CFG_CMD_SET_MONTIME = 7
+} wl_stamon_cfg_cmd_type_t;
+
+typedef struct wlc_stamon_sta_config {
+       wl_stamon_cfg_cmd_type_t cmd;   /**< 0 - delete, 1 - add */
+       struct ether_addr ea;
+       uint16  version;                /* Command structure version */
+       uint16  length;                 /* Command structure length */
+       uint8   pad[2];
+       /* Time (ms) for which STA's are monitored. Value ZERO indicates no time limit */
+       uint32  monitor_time;
+} wlc_stamon_sta_config_t;
+
+/* ifdef SR_DEBUG */
+typedef struct /* pmu_reg */{
+       uint32  pmu_control;
+       uint32  pmu_capabilities;
+       uint32  pmu_status;
+       uint32  res_state;
+       uint32  res_pending;
+       uint32  pmu_timer1;
+       uint32  min_res_mask;
+       uint32  max_res_mask;
+       uint32  pmu_chipcontrol1[4];
+       uint32  pmu_regcontrol[5];
+       uint32  pmu_pllcontrol[5];
+       uint32  pmu_rsrc_up_down_timer[31];
+       uint32  rsrc_dep_mask[31];
+} pmu_reg_t;
+/* endif SR_DEBUG */
+
+typedef struct wl_taf_define {
+       struct ether_addr ea;   /**< STA MAC or 0xFF... */
+       uint16 version;         /**< version */
+       uint32 sch;             /**< method index */
+       uint32 prio;            /**< priority */
+       uint32 misc;            /**< used for return value */
+       uint8  text[];         /**< used to pass and return ascii text */
+} wl_taf_define_t;
+
+/** Received Beacons lengths information */
+#define WL_LAST_BCNS_INFO_FIXED_LEN            OFFSETOF(wlc_bcn_len_hist_t, bcnlen_ring)
+typedef struct wlc_bcn_len_hist {
+       uint16  ver;                            /**< version field */
+       uint16  cur_index;                      /**< current pointed index in ring buffer */
+       uint32  max_bcnlen;             /**< Max beacon length received */
+       uint32  min_bcnlen;             /**< Min beacon length received */
+       uint32  ringbuff_len;           /**< Length of the ring buffer 'bcnlen_ring' */
+       uint32  bcnlen_ring[1]; /**< ring buffer storing received beacon lengths */
+} wlc_bcn_len_hist_t;
+
+/* WDS net interface types */
+#define WL_WDSIFTYPE_NONE  0x0 /**< The interface type is neither WDS nor DWDS. */
+#define WL_WDSIFTYPE_WDS   0x1 /**< The interface is WDS type. */
+#define WL_WDSIFTYPE_DWDS  0x2 /**< The interface is DWDS type. */
+
+typedef struct wl_bssload_static {
+       uint8 is_static;
+       uint8  PAD;
+       uint16 sta_count;
+       uint8 chan_util;
+       uint8  PAD;
+       uint16 aac;
+} wl_bssload_static_t;
+
+/* Buffer of size WLC_SAMPLECOLLECT_MAXLEN (=10240 for 4345a0 ACPHY)
+ * gets copied to this, multiple times
+ */
+typedef enum wl_gpaio_option {
+       GPAIO_PMU_AFELDO,
+       GPAIO_PMU_TXLDO,
+       GPAIO_PMU_VCOLDO,
+       GPAIO_PMU_LNALDO,
+       GPAIO_PMU_ADCLDO,
+       GPAIO_ICTAT_CAL,
+       GPAIO_PMU_CLEAR,
+       GPAIO_OFF,
+       GPAIO_PMU_LOGENLDO,
+       GPAIO_PMU_RXLDO2G,
+       GPAIO_PMU_RXLDO5G,
+       GPAIO_PMU_LPFTXLDO,
+       GPAIO_PMU_LDO1P6,
+       GPAIO_RCAL,
+       GPAIO_IQDAC_BUF_DC_MEAS,
+       GPAIO_IQDAC_BUF_DC_CLEAR,
+       GPAIO_DAC_IQ_DC_RDBK,
+       GPAIO_DAC_IQ_DC_RDBK_CLEAR,
+       GPAIO_AFE_LDO_FOR_DAC_DC,
+       GPAIO_PA5G_VCAS_SOURCE,
+       GPAIO_BIQ2_DC_MEAS,
+       GPAIO_BIQ2_DC_CLEAR,
+       GPAIO_VBATMONITOR,
+       GPAIO_PA5G_VCAS_GMDRAIN,
+       GPAIO_PMU_ROLDO,
+       GPAIO_PMU_PFDLDO,
+       GPAIO_PMU_LCHLDO,
+       GPAIO_PMU_MMDLDO,
+       GPAIO_PMU_VCOCORELDO,
+       GPAIO_PMU_PLLLDO,
+       GPAIO_PMU_RXLDO,
+       GPAIO_IQDAC_DC_TP,
+       GPAIO_BG_ICTAT_CAL,
+       GPAIO_BG_ICTAT_UNCAL,
+       GPAIO_BG_CTAT_UNCAL
+} wl_gpaio_option_t;
+
+/** IO Var Operations - the Value of iov_op In wlc_ap_doiovar */
+typedef enum wlc_ap_iov_bss_operation {
+       WLC_AP_IOV_OP_DELETE                   = -1,
+       WLC_AP_IOV_OP_DISABLE                  = 0,
+       WLC_AP_IOV_OP_ENABLE                   = 1,
+       WLC_AP_IOV_OP_MANUAL_AP_BSSCFG_CREATE  = 2,
+       WLC_AP_IOV_OP_MANUAL_STA_BSSCFG_CREATE = 3,
+       WLC_AP_IOV_OP_MOVE                     = 4
+} wlc_ap_iov_bss_oper_t;
+
+/* LTE coex info */
+/* Analogue of HCI Set MWS Signaling cmd */
+typedef struct {
+       int16   mws_rx_assert_offset;
+       int16   mws_rx_assert_jitter;
+       int16   mws_rx_deassert_offset;
+       int16   mws_rx_deassert_jitter;
+       int16   mws_tx_assert_offset;
+       int16   mws_tx_assert_jitter;
+       int16   mws_tx_deassert_offset;
+       int16   mws_tx_deassert_jitter;
+       int16   mws_pattern_assert_offset;
+       int16   mws_pattern_assert_jitter;
+       int16   mws_inact_dur_assert_offset;
+       int16   mws_inact_dur_assert_jitter;
+       int16   mws_scan_freq_assert_offset;
+       int16   mws_scan_freq_assert_jitter;
+       int16   mws_prio_assert_offset_req;
+} wci2_config_t;
+
+/** Analogue of HCI MWS Channel Params */
+typedef struct {
+       uint16  mws_rx_center_freq; /**< MHz */
+       uint16  mws_tx_center_freq;
+       uint16  mws_rx_channel_bw;  /**< KHz */
+       uint16  mws_tx_channel_bw;
+       uint8   mws_channel_en;
+       uint8   mws_channel_type;   /**< Don't care for WLAN? */
+} mws_params_t;
+
+#define LTECX_MAX_NUM_PERIOD_TYPES     7
+
+/* LTE Frame params */
+typedef struct {
+       uint16  mws_frame_dur;
+       int16   mws_framesync_assert_offset;
+       uint16  mws_framesync_assert_jitter;
+       uint16  mws_period_dur[LTECX_MAX_NUM_PERIOD_TYPES];
+       uint8   mws_period_type[LTECX_MAX_NUM_PERIOD_TYPES];
+       uint8   mws_num_periods;
+} mws_frame_config_t;
+
+/** MWS wci2 message */
+typedef struct {
+       uint8   mws_wci2_data; /**< BT-SIG msg */
+       uint8   PAD;
+       uint16  mws_wci2_interval; /**< Interval in us */
+       uint16  mws_wci2_repeat; /**< No of msgs to send */
+} mws_wci2_msg_t;
+/* MWS ANT map */
+typedef struct {
+       uint16  combo1; /* mws ant selection 1 */
+       uint16  combo2; /* mws ant selection 2 */
+       uint16  combo3; /* mws ant selection 3 */
+       uint16  combo4; /* mws ant selection 4 */
+} mws_ant_map_t;
+
+/* MWS ANT map 2nd generation */
+typedef struct {
+       uint16  combo[16]; /* mws ant selection 2nd */
+} mws_ant_map_t_2nd;
+
+/* MWS Coex bitmap v2 map for Type0/Type6 */
+typedef struct {
+       uint16  bitmap_2G;     /* 2G Bitmap */
+       uint16  bitmap_5G_lo;  /* 5G lo bitmap */
+       uint16  bitmap_5G_mid; /* 5G mid bitmap */
+       uint16  bitmap_5G_hi;  /* 5G hi bitmap */
+} mws_coex_bitmap_v2_t;
+
+/* MWS SCAN_REQ Bitmap */
+typedef struct mws_scanreq_params {
+       uint16 idx;
+       uint16 bm_2g;
+       uint16 bm_5g_lo;
+       uint16 bm_5g_mid;
+       uint16 bm_5g_hi;
+} mws_scanreq_params_t;
+
+/* MWS NR Coex Channel map */
+#define WL_MWS_NR_COEXMAP_VERSION 1
+typedef struct wl_mws_nr_coexmap {
+       uint16  version;    /* Structure version */
+       uint16  bitmap_5g_lo;  /* bitmap for 5G low channels by 2:
+                               *34-48, 52-56, 60-64, 100-102
+                               */
+       uint16  bitmap_5g_mid; /* bitmap for 5G mid channels by 2:
+                               * 104, 108-112, 116-120, 124-128,
+                               * 132-136, 140, 149-151
+                               */
+       uint16  bitmap_5g_high; /* bitmap for 5G high channels by 2
+                               * 153, 157-161, 165
+                               */
+} wl_mws_nr_coexmap_t;
+
+typedef struct {
+       uint32 config;  /**< MODE: AUTO (-1), Disable (0), Enable (1) */
+       uint32 status;  /**< Current state: Disabled (0), Enabled (1) */
+} wl_config_t;
+
+#define WLC_RSDB_MODE_AUTO_MASK 0x80
+#define WLC_RSDB_EXTRACT_MODE(val) ((int8)((val) & (~(WLC_RSDB_MODE_AUTO_MASK))))
+
+typedef struct {
+       uint16  request; /* type of sensor hub request */
+       uint16  enable; /* enable/disable response for specified request */
+       uint16  interval; /* interval between responses to the request */
+} shub_req_t;
+
+#define        WL_IF_STATS_T_VERSION 1 /**< current version of wl_if_stats structure */
+
+/** per interface counters */
+typedef struct wl_if_stats {
+       uint16  version;                /**< version of the structure */
+       uint16  length;                 /**< length of the entire structure */
+       uint32  PAD;                    /**< padding */
+
+       /* transmit stat counters */
+       uint64  txframe;                /**< tx data frames */
+       uint64  txbyte;                 /**< tx data bytes */
+       uint64  txerror;                /**< tx data errors (derived: sum of others) */
+       uint64  txnobuf;                /**< tx out of buffer errors */
+       uint64  txrunt;                 /**< tx runt frames */
+       uint64  txfail;                 /**< tx failed frames */
+       uint64  txretry;                /**< tx retry frames */
+       uint64  txretrie;               /**< tx multiple retry frames */
+       uint64  txfrmsnt;               /**< tx sent frames */
+       uint64  txmulti;                /**< tx mulitcast sent frames */
+       uint64  txfrag;                 /**< tx fragments sent */
+
+       /* receive stat counters */
+       uint64  rxframe;                /**< rx data frames */
+       uint64  rxbyte;                 /**< rx data bytes */
+       uint64  rxerror;                /**< rx data errors (derived: sum of others) */
+       uint64  rxnobuf;                /**< rx out of buffer errors */
+       uint64  rxrunt;                 /**< rx runt frames */
+       uint64  rxfragerr;              /**< rx fragment errors */
+       uint64  rxmulti;                /**< rx multicast frames */
+
+       uint64  txexptime;              /* DATA Tx frames suppressed due to timer expiration */
+       uint64  txrts;                  /* RTS/CTS succeeeded count */
+       uint64  txnocts;                /* RTS/CTS faled count */
+
+       uint64  txretrans;              /* Number of frame retransmissions */
+}
+wl_if_stats_t;
+
+typedef struct wl_band {
+       uint16          bandtype;               /**< WL_BAND_2G, WL_BAND_5G */
+       uint16          bandunit;               /**< bandstate[] index */
+       uint16          phytype;                /**< phytype */
+       uint16          phyrev;
+}
+wl_band_t;
+
+#define        WL_ROAM_STATS_VER_1 (1u)        /**< current version of wl_if_stats structure */
+
+/** roam statistics counters */
+typedef struct {
+       uint16  version;                /**< version of the structure */
+       uint16  length;                 /**< length of the entire structure */
+       uint32  initial_assoc_time;
+       uint32  prev_roam_time;
+       uint32  last_roam_event_type;
+       uint32  last_roam_event_status;
+       uint32  last_roam_event_reason;
+       uint16  roam_success_cnt;
+       uint16  roam_fail_cnt;
+       uint16  roam_attempt_cnt;
+       uint16  max_roam_target_cnt;
+       uint16  min_roam_target_cnt;
+       uint16  max_cached_ch_cnt;
+       uint16  min_cached_ch_cnt;
+       uint16  partial_roam_scan_cnt;
+       uint16  full_roam_scan_cnt;
+       uint16  most_roam_reason;
+       uint16  most_roam_reason_cnt;
+} wl_roam_stats_v1_t;
+
+#define        WL_WLC_VERSION_T_VERSION 1 /**< current version of wlc_version structure */
+
+/** wlc interface version */
+typedef struct wl_wlc_version {
+       uint16  version;                /**< version of the structure */
+       uint16  length;                 /**< length of the entire structure */
+
+       /* epi version numbers */
+       uint16  epi_ver_major;          /**< epi major version number */
+       uint16  epi_ver_minor;          /**< epi minor version number */
+       uint16  epi_rc_num;             /**< epi RC number */
+       uint16  epi_incr_num;           /**< epi increment number */
+
+       /* wlc interface version numbers */
+       uint16  wlc_ver_major;          /**< wlc interface major version number */
+       uint16  wlc_ver_minor;          /**< wlc interface minor version number */
+}
+wl_wlc_version_t;
+
+#define        WL_SCAN_VERSION_T_VERSION 1 /**< current version of scan_version structure */
+/** scan interface version */
+typedef struct wl_scan_version {
+       uint16  version;                /**< version of the structure */
+       uint16  length;                 /**< length of the entire structure */
+
+       /* scan interface version numbers */
+       uint16  scan_ver_major;         /**< scan interface major version number */
+} wl_scan_version_t;
+
+/* Highest version of WLC_API_VERSION supported */
+#define WLC_API_VERSION_MAJOR_MAX      8
+#define WLC_API_VERSION_MINOR_MAX      0
+
+/* begin proxd definitions */
+#include <packed_section_start.h>
+
+#define WL_PROXD_API_VERSION 0x0300u /**< version 3.0 */
+
+/* proxd version with 11az */
+#define WL_PROXD_11AZ_API_VERSION_1 0x0400u
+
+/** Minimum supported API version */
+#define WL_PROXD_API_MIN_VERSION 0x0300u
+
+/** proximity detection methods */
+enum {
+       WL_PROXD_METHOD_NONE    = 0,
+       WL_PROXD_METHOD_RSVD1   = 1, /**< backward compatibility - RSSI, not supported */
+       WL_PROXD_METHOD_TOF     = 2, /**< 11v+BCM proprietary */
+       WL_PROXD_METHOD_RSVD2   = 3, /**< 11v only - if needed */
+       WL_PROXD_METHOD_FTM     = 4, /**< IEEE rev mc/2014 */
+       WL_PROXD_METHOD_MAX
+};
+typedef int16 wl_proxd_method_t;
+
+/** 11az ftm types */
+enum {
+       WL_FTM_TYPE_NONE = 0, /* ftm type unspecified */
+       WL_FTM_TYPE_MC   = 1, /* Legacy MC ftm */
+       WL_FTM_TYPE_TB   = 2, /* 11az Trigger based */
+       WL_FTM_TYPE_NTB  = 3, /* 11az Non-trigger based */
+       WL_FTM_TYPE_MAX
+};
+typedef uint8 wl_ftm_type_t;
+
+/** global and method configuration flags */
+enum {
+       WL_PROXD_FLAG_NONE                      = 0x00000000,
+       WL_PROXD_FLAG_RX_ENABLED                = 0x00000001, /**< respond to requests, per bss */
+       WL_PROXD_FLAG_RX_RANGE_REQ              = 0x00000002, /**< 11mc range requests enabled */
+       WL_PROXD_FLAG_TX_LCI                    = 0x00000004, /**< tx lci, if known */
+       WL_PROXD_FLAG_TX_CIVIC                  = 0x00000008, /**< tx civic, if known */
+       WL_PROXD_FLAG_RX_AUTO_BURST             = 0x00000010, /**< auto respond w/o host action */
+       WL_PROXD_FLAG_TX_AUTO_BURST             = 0x00000020, /**< continue tx w/o host action */
+       WL_PROXD_FLAG_AVAIL_PUBLISH             = 0x00000040,     /**< publish availability */
+       WL_PROXD_FLAG_AVAIL_SCHEDULE            = 0x00000080,    /**< schedule using availability */
+       WL_PROXD_FLAG_ASAP_CAPABLE              = 0x00000100, /* ASAP capable */
+       WL_PROXD_FLAG_MBURST_FOLLOWUP           = 0x00000200, /* new multi-burst algorithm */
+       WL_PROXD_FLAG_SECURE                    = 0x00000400, /* per bsscfg option */
+       WL_PROXD_FLAG_NO_TSF_SYNC               = 0x00000800, /* disable tsf sync */
+       WL_PROXD_FLAG_ALL                       = 0xffffffff
+};
+typedef uint32 wl_proxd_flags_t;
+
+#define WL_PROXD_FLAGS_AVAIL (WL_PROXD_FLAG_AVAIL_PUBLISH | \
+       WL_PROXD_FLAG_AVAIL_SCHEDULE)
+
+/** session flags */
+enum {
+       WL_PROXD_SESSION_FLAG_NONE              = 0x00000000,  /**< no flags */
+       WL_PROXD_SESSION_FLAG_INITIATOR         = 0x00000001,  /**< local device is initiator */
+       WL_PROXD_SESSION_FLAG_TARGET            = 0x00000002,  /**< local device is target */
+       WL_PROXD_SESSION_FLAG_ONE_WAY           = 0x00000004,  /**< (initiated) 1-way rtt */
+       WL_PROXD_SESSION_FLAG_AUTO_BURST        = 0x00000008,  /**< created w/ rx_auto_burst */
+       WL_PROXD_SESSION_FLAG_PERSIST           = 0x00000010,  /**< good until cancelled */
+       WL_PROXD_SESSION_FLAG_RTT_DETAIL        = 0x00000020,  /**< rtt detail in results */
+       WL_PROXD_SESSION_FLAG_SECURE            = 0x00000040,  /**< sessionis secure */
+       WL_PROXD_SESSION_FLAG_AOA               = 0x00000080,  /**< AOA along w/ RTT */
+       WL_PROXD_SESSION_FLAG_RX_AUTO_BURST     = 0x00000100,  /**< Same as proxd flags above */
+       WL_PROXD_SESSION_FLAG_TX_AUTO_BURST     = 0x00000200,  /**< Same as proxd flags above */
+       WL_PROXD_SESSION_FLAG_NAN_BSS           = 0x00000400,  /**< Use NAN BSS, if applicable */
+       WL_PROXD_SESSION_FLAG_TS1               = 0x00000800,  /**< e.g. FTM1 - ASAP-capable */
+       WL_PROXD_SESSION_FLAG_RANDMAC           = 0x00001000,  /**< use random mac */
+       WL_PROXD_SESSION_FLAG_REPORT_FAILURE    = 0x00002000, /**< report failure to target */
+       WL_PROXD_SESSION_FLAG_INITIATOR_RPT     = 0x00004000, /**< report distance to target */
+       WL_PROXD_SESSION_FLAG_NOCHANSWT         = 0x00008000,
+       WL_PROXD_SESSION_FLAG_NETRUAL           = 0x00010000, /**< netrual mode */
+       WL_PROXD_SESSION_FLAG_SEQ_EN            = 0x00020000, /**< Toast */
+       WL_PROXD_SESSION_FLAG_NO_PARAM_OVRD     = 0x00040000, /**< no param override from target */
+       WL_PROXD_SESSION_FLAG_ASAP              = 0x00080000, /**< ASAP session */
+       WL_PROXD_SESSION_FLAG_REQ_LCI           = 0x00100000, /**< transmit LCI req */
+       WL_PROXD_SESSION_FLAG_REQ_CIV           = 0x00200000, /**< transmit civic loc req */
+       WL_PROXD_SESSION_FLAG_PRE_SCAN          = 0x00400000, /* enable pre-scan for asap=1 */
+       WL_PROXD_SESSION_FLAG_AUTO_VHTACK       = 0x00800000, /* use vhtack based on brcm ie */
+       WL_PROXD_SESSION_FLAG_VHTACK            = 0x01000000, /* vht ack is in use - output only */
+       WL_PROXD_SESSION_FLAG_BDUR_NOPREF       = 0x02000000, /* burst-duration: no preference */
+       WL_PROXD_SESSION_FLAG_NUM_FTM_NOPREF    = 0x04000000, /* num of FTM frames: no preference */
+       WL_PROXD_SESSION_FLAG_FTM_SEP_NOPREF    = 0x08000000, /* time btw FTM frams: no pref */
+       WL_PROXD_SESSION_FLAG_NUM_BURST_NOPREF  = 0x10000000, /* num of bursts: no pref */
+       WL_PROXD_SESSION_FLAG_BURST_PERIOD_NOPREF = 0x20000000, /* burst period: no pref */
+       WL_PROXD_SESSION_FLAG_MBURST_FOLLOWUP   = 0x40000000, /* new mburst algo  - reserved */
+       WL_PROXD_SESSION_FLAG_MBURST_NODELAY    = 0x80000000, /**< good until cancelled */
+       WL_PROXD_SESSION_FLAG_ALL               = 0xffffffff
+
+};
+typedef uint32 wl_proxd_session_flags_t;
+
+/** time units - mc supports up to 0.1ns resolution */
+enum {
+       WL_PROXD_TMU_TU                 = 0,            /**< 1024us */
+       WL_PROXD_TMU_SEC                = 1,
+       WL_PROXD_TMU_MILLI_SEC  = 2,
+       WL_PROXD_TMU_MICRO_SEC  = 3,
+       WL_PROXD_TMU_NANO_SEC   = 4,
+       WL_PROXD_TMU_PICO_SEC   = 5
+};
+typedef int16 wl_proxd_tmu_t;
+
+/** time interval e.g. 10ns */
+typedef struct wl_proxd_intvl {
+       uint32 intvl;
+       wl_proxd_tmu_t tmu;
+       uint8   pad[2];
+} wl_proxd_intvl_t;
+
+/** commands that can apply to proxd, method or a session */
+enum {
+       WL_PROXD_CMD_NONE                       = 0,
+       WL_PROXD_CMD_GET_VERSION                = 1,
+       WL_PROXD_CMD_ENABLE                     = 2,
+       WL_PROXD_CMD_DISABLE                    = 3,
+       WL_PROXD_CMD_CONFIG                     = 4,
+       WL_PROXD_CMD_START_SESSION              = 5,
+       WL_PROXD_CMD_BURST_REQUEST              = 6,
+       WL_PROXD_CMD_STOP_SESSION               = 7,
+       WL_PROXD_CMD_DELETE_SESSION             = 8,
+       WL_PROXD_CMD_GET_RESULT                 = 9,
+       WL_PROXD_CMD_GET_INFO                   = 10,
+       WL_PROXD_CMD_GET_STATUS                 = 11,
+       WL_PROXD_CMD_GET_SESSIONS               = 12,
+       WL_PROXD_CMD_GET_COUNTERS               = 13,
+       WL_PROXD_CMD_CLEAR_COUNTERS             = 14,
+       WL_PROXD_CMD_COLLECT                    = 15,   /* not supported, see 'wl proxd_collect' */
+       WL_PROXD_CMD_TUNE                       = 16,   /* not supported, see 'wl proxd_tune' */
+       WL_PROXD_CMD_DUMP                       = 17,
+       WL_PROXD_CMD_START_RANGING              = 18,
+       WL_PROXD_CMD_STOP_RANGING               = 19,
+       WL_PROXD_CMD_GET_RANGING_INFO           = 20,
+       WL_PROXD_CMD_IS_TLV_SUPPORTED           = 21,
+
+       WL_PROXD_CMD_MAX
+};
+typedef int16 wl_proxd_cmd_t;
+
+/* session ids:
+ * id 0 is reserved
+ * ids 1..0x7fff - allocated by host/app
+ * 0x8000-0xffff - allocated by firmware, used for auto/rx
+ */
+enum {
+        WL_PROXD_SESSION_ID_GLOBAL = 0
+};
+
+/* Externally allocated sids */
+#define WL_PROXD_SID_EXT_MAX 0x7fff
+#define WL_PROXD_SID_EXT_ALLOC(_sid) ((_sid) > 0 && (_sid) <= WL_PROXD_SID_EXT_MAX)
+
+/* block size for reserved sid blocks */
+#define WL_PROXD_SID_EXT_BLKSZ 256
+#define WL_PROXD_SID_EXT_BLK_START(_i) (WL_PROXD_SID_EXT_MAX - (_i) * WL_PROXD_SID_EXT_BLKSZ + 1)
+#define WL_PROXD_SID_EXT_BLK_END(_start) ((_start) + WL_PROXD_SID_EXT_BLKSZ - 1)
+
+/* rrm block */
+#define WL_PROXD_SID_RRM_START WL_PROXD_SID_EXT_BLK_START(1)
+#define WL_PROXD_SID_RRM_END WL_PROXD_SID_EXT_BLK_END(WL_PROXD_SID_RRM_START)
+
+/* nan block */
+#define WL_PROXD_SID_NAN_START WL_PROXD_SID_EXT_BLK_START(2)
+#define WL_PROXD_SID_NAN_END WL_PROXD_SID_EXT_BLK_END(WL_PROXD_SID_NAN_START)
+
+/** maximum number sessions that can be allocated, may be less if tunable */
+#define WL_PROXD_MAX_SESSIONS 16
+
+typedef uint16 wl_proxd_session_id_t;
+
+/* Use WL_PROXD_E_* errorcodes from this file if BCMUTILS_ERR_CODES not defined */
+#ifndef BCMUTILS_ERR_CODES
+
+/** status - TBD BCME_ vs proxd status - range reserved for BCME_ */
+enum {
+       WL_PROXD_E_LAST                 = -1056,
+       WL_PROXD_E_NOAVAIL              = -1056,
+       WL_PROXD_E_EXT_SCHED            = -1055,
+       WL_PROXD_E_NOT_BCM              = -1054,
+       WL_PROXD_E_FRAME_TYPE           = -1053,
+       WL_PROXD_E_VERNOSUPPORT         = -1052,
+       WL_PROXD_E_SEC_NOKEY            = -1051,
+       WL_PROXD_E_SEC_POLICY           = -1050,
+       WL_PROXD_E_SCAN_INPROCESS       = -1049,
+       WL_PROXD_E_BAD_PARTIAL_TSF      = -1048,
+       WL_PROXD_E_SCANFAIL             = -1047,
+       WL_PROXD_E_NOTSF                = -1046,
+       WL_PROXD_E_POLICY               = -1045,
+       WL_PROXD_E_INCOMPLETE           = -1044,
+       WL_PROXD_E_OVERRIDDEN           = -1043,
+       WL_PROXD_E_ASAP_FAILED          = -1042,
+       WL_PROXD_E_NOTSTARTED           = -1041,
+       WL_PROXD_E_INVALIDMEAS          = -1040,
+       WL_PROXD_E_INCAPABLE            = -1039,
+       WL_PROXD_E_MISMATCH             = -1038,
+       WL_PROXD_E_DUP_SESSION          = -1037,
+       WL_PROXD_E_REMOTE_FAIL          = -1036,
+       WL_PROXD_E_REMOTE_INCAPABLE     = -1035,
+       WL_PROXD_E_SCHED_FAIL           = -1034,
+       WL_PROXD_E_PROTO                = -1033,
+       WL_PROXD_E_EXPIRED              = -1032,
+       WL_PROXD_E_TIMEOUT              = -1031,
+       WL_PROXD_E_NOACK                = -1030,
+       WL_PROXD_E_DEFERRED             = -1029,
+       WL_PROXD_E_INVALID_SID          = -1028,
+       WL_PROXD_E_REMOTE_CANCEL        = -1027,
+       WL_PROXD_E_CANCELED             = -1026,        /**< local */
+       WL_PROXD_E_INVALID_SESSION      = -1025,
+       WL_PROXD_E_BAD_STATE            = -1024,
+       WL_PROXD_E_START                = -1024,
+       WL_PROXD_E_ERROR                = -1,
+       WL_PROXD_E_OK                   = 0
+};
+typedef int32 wl_proxd_status_t;
+
+#endif /* BCMUTILS_ERR_CODES */
+
+/* proxd errors from phy */
+#define PROXD_TOF_INIT_ERR_BITS 16
+
+enum {
+       WL_PROXD_PHY_ERR_LB_CORR_THRESH    = (1 << 0), /* Loopback Correlation threshold */
+       WL_PROXD_PHY_ERR_RX_CORR_THRESH    = (1 << 1), /* Received Correlation threshold */
+       WL_PROXD_PHY_ERR_LB_PEAK_POWER     = (1 << 2), /* Loopback Peak power   */
+       WL_PROXD_PHY_ERR_RX_PEAK_POWER     = (1 << 3), /* Received Peak power   */
+       WL_PROXD_PHY_ERR_BITFLIP           = (1 << 4), /* Bitflips */
+       WL_PROXD_PHY_ERR_SNR               = (1 << 5), /* SNR */
+       WL_PROXD_PHY_RX_STRT_WIN_OFF       = (1 << 6), /* Receive start window is off */
+       WL_PROXD_PHY_RX_END_WIN_OFF        = (1 << 7), /* Receive End window is off */
+       WL_PROXD_PHY_ERR_LOW_CONFIDENCE    = (1 << 15), /* Low confidence on meas distance */
+};
+typedef uint32 wl_proxd_phy_error_t;
+
+/** session states */
+enum {
+       WL_PROXD_SESSION_STATE_NONE                     = 0,
+       WL_PROXD_SESSION_STATE_CREATED                  = 1,
+       WL_PROXD_SESSION_STATE_CONFIGURED               = 2,
+       WL_PROXD_SESSION_STATE_STARTED                  = 3,
+       WL_PROXD_SESSION_STATE_DELAY                    = 4,
+       WL_PROXD_SESSION_STATE_USER_WAIT                = 5,
+       WL_PROXD_SESSION_STATE_SCHED_WAIT               = 6,
+       WL_PROXD_SESSION_STATE_BURST                    = 7,
+       WL_PROXD_SESSION_STATE_STOPPING                 = 8,
+       WL_PROXD_SESSION_STATE_ENDED                    = 9,
+       WL_PROXD_SESSION_STATE_START_WAIT               = 10,
+       WL_PROXD_SESSION_STATE_DESTROYING               = -1
+};
+typedef int16 wl_proxd_session_state_t;
+
+/** RTT sample flags */
+enum {
+       WL_PROXD_RTT_SAMPLE_NONE        = 0x00,
+       WL_PROXD_RTT_SAMPLE_DISCARD     = 0x01
+};
+typedef uint8 wl_proxd_rtt_sample_flags_t;
+typedef int16 wl_proxd_rssi_t;
+typedef uint16 wl_proxd_snr_t;
+typedef uint16 wl_proxd_bitflips_t;
+
+/** result flags */
+enum {
+       WL_PRXOD_RESULT_FLAG_NONE       = 0x0000,
+       WL_PROXD_RESULT_FLAG_NLOS       = 0x0001,       /**< LOS - if available */
+       WL_PROXD_RESULT_FLAG_LOS        = 0x0002,       /**< NLOS - if available */
+       WL_PROXD_RESULT_FLAG_FATAL      = 0x0004,       /**< Fatal error during burst */
+       WL_PROXD_RESULT_FLAG_VHTACK     = 0x0008,       /* VHTACK or Legacy ACK used */
+       WL_PROXD_REQUEST_SENT           = 0x0010,       /* FTM request was sent */
+       WL_PROXD_REQUEST_ACKED          = 0x0020,       /* FTM request was acked */
+       WL_PROXD_LTFSEQ_STARTED         = 0x0040,       /* LTF sequence started */
+       WL_PROXD_RESULT_FLAG_ALL        = 0xffff
+};
+typedef int16 wl_proxd_result_flags_t;
+
+#define WL_PROXD_RTT_SAMPLE_VERSION_1  1
+typedef struct wl_proxd_rtt_sample_v1 {
+       uint8                           id;             /**< id for the sample - non-zero */
+       wl_proxd_rtt_sample_flags_t     flags;
+       wl_proxd_rssi_t                 rssi;
+       wl_proxd_intvl_t                rtt;            /**< round trip time */
+       uint32                          ratespec;
+       wl_proxd_snr_t                  snr;
+       wl_proxd_bitflips_t             bitflips;
+       wl_proxd_status_t               status;
+       int32                           distance;
+       wl_proxd_phy_error_t            tof_phy_error;
+       wl_proxd_phy_error_t            tof_tgt_phy_error; /* target phy error bit map */
+       wl_proxd_snr_t                  tof_tgt_snr;
+       wl_proxd_bitflips_t             tof_tgt_bitflips;
+       uint8                           coreid;
+       uint8                           pad[3];
+} wl_proxd_rtt_sample_v1_t;
+
+#define WL_PROXD_RTT_RESULT_VERSION_1  1
+/** rtt measurement result */
+typedef struct wl_proxd_rtt_result_v1 {
+       wl_proxd_session_id_t           sid;
+       wl_proxd_result_flags_t         flags;
+       wl_proxd_status_t               status;
+       struct ether_addr               peer;
+       wl_proxd_session_state_t        state;          /**< current state */
+       union {
+               wl_proxd_intvl_t        retry_after;    /* hint for errors */
+               wl_proxd_intvl_t        burst_duration; /* burst duration */
+       } u;
+       wl_proxd_rtt_sample_v1_t        avg_rtt;
+       uint32                          avg_dist;       /* 1/256m units */
+       uint16                          sd_rtt;         /* RTT standard deviation */
+       uint8                           num_valid_rtt;  /* valid rtt cnt */
+       uint8                           num_ftm;        /* actual num of ftm cnt (Configured) */
+       uint16                          burst_num;      /* in a session */
+       uint16                          num_rtt;        /* 0 if no detail */
+       uint16                          num_meas;       /* number of ftm frames seen OTA */
+       uint8                           pad[2];
+       wl_proxd_rtt_sample_v1_t        rtt[1];         /* variable */
+} wl_proxd_rtt_result_v1_t;
+
+#define WL_PROXD_RTT_SAMPLE_VERSION_2  2
+typedef struct wl_proxd_rtt_sample_v2 {
+       uint16                          version;
+       uint16                          length;
+       uint8                           id;             /**< id for the sample - non-zero */
+       wl_proxd_rtt_sample_flags_t     flags;
+       wl_proxd_rssi_t                 rssi;
+       wl_proxd_intvl_t                rtt;            /**< round trip time */
+       uint32                          ratespec;
+       wl_proxd_snr_t                  snr;
+       wl_proxd_bitflips_t             bitflips;
+       wl_proxd_status_t               status;
+       int32                           distance;
+       wl_proxd_phy_error_t            tof_phy_error;
+       wl_proxd_phy_error_t            tof_tgt_phy_error; /* target phy error bit map */
+       wl_proxd_snr_t                  tof_tgt_snr;
+       wl_proxd_bitflips_t             tof_tgt_bitflips;
+       uint8                           coreid;
+       uint8                           pad[3];
+       uint32                          chanspec;
+} wl_proxd_rtt_sample_v2_t;
+
+#define WL_PROXD_RTT_RESULT_VERSION_2  2
+/** rtt measurement result */
+typedef struct wl_proxd_rtt_result_v2 {
+       uint16                          version;
+       uint16                          length;         /* up to rtt[] */
+       wl_proxd_session_id_t           sid;
+       wl_proxd_result_flags_t         flags;
+       wl_proxd_status_t               status;
+       struct ether_addr               peer;
+       wl_proxd_session_state_t        state;          /**< current state */
+       union {
+               wl_proxd_intvl_t        retry_after;    /* hint for errors */
+               wl_proxd_intvl_t        burst_duration; /* burst duration */
+       } u;
+       uint32                          avg_dist;       /* 1/256m units */
+       uint16                          sd_rtt;         /* RTT standard deviation */
+       uint8                           num_valid_rtt;  /* valid rtt cnt */
+       uint8                           num_ftm;        /* actual num of ftm cnt (Configured) */
+       uint16                          burst_num;      /* in a session */
+       uint16                          num_rtt;        /* 0 if no detail */
+       uint16                          num_meas;       /* number of ftm frames seen OTA */
+       uint8                           pad[2];
+       wl_proxd_rtt_sample_v2_t        rtt[1];         /* variable, first element is avg_rtt */
+} wl_proxd_rtt_result_v2_t;
+
+/** aoa measurement result */
+typedef struct wl_proxd_aoa_result {
+       wl_proxd_session_id_t           sid;
+       wl_proxd_result_flags_t         flags;
+       wl_proxd_status_t               status;
+       struct ether_addr               peer;
+       wl_proxd_session_state_t        state;
+       uint16                          burst_num;
+       uint8                           pad[2];
+       /* wl_proxd_aoa_sample_t sample_avg; TBD */
+} BWL_POST_PACKED_STRUCT wl_proxd_aoa_result_t;
+#include <packed_section_end.h>
+
+/** global stats */
+typedef struct wl_proxd_counters {
+       uint32 tx;                      /* tx frame count */
+       uint32 rx;                      /* rx frame count */
+       uint32 burst;                   /* total number of burst */
+       uint32 sessions;                /* total number of sessions */
+       uint32 max_sessions;            /* max concurrency */
+       uint32 sched_fail;              /* scheduling failures */
+       uint32 timeouts;                /* timeouts */
+       uint32 protoerr;                /* protocol errors */
+       uint32 noack;                   /* tx w/o ack */
+       uint32 txfail;                  /* any tx falure */
+       uint32 lci_req_tx;              /* tx LCI requests */
+       uint32 lci_req_rx;              /* rx LCI requests */
+       uint32 lci_rep_tx;              /* tx LCI reports */
+       uint32 lci_rep_rx;              /* rx LCI reports */
+       uint32 civic_req_tx;            /* tx civic requests */
+       uint32 civic_req_rx;            /* rx civic requests */
+       uint32 civic_rep_tx;            /* tx civic reports */
+       uint32 civic_rep_rx;            /* rx civic reports */
+       uint32 rctx;                    /* ranging contexts created */
+       uint32 rctx_done;               /* count of ranging done */
+       uint32 publish_err;             /* availability publishing errors */
+       uint32 on_chan;                 /* count of scheduler onchan */
+       uint32 off_chan;                /* count of scheduler offchan */
+       uint32 tsf_lo;                  /* local tsf or session tsf */
+       uint32 tsf_hi;
+       uint32 num_meas;
+} wl_proxd_counters_t;
+
+typedef struct wl_proxd_counters wl_proxd_session_counters_t;
+
+enum {
+       WL_PROXD_CAP_NONE               = 0x0000,
+       WL_PROXD_CAP_ALL                = 0xffff
+};
+typedef int16 wl_proxd_caps_t;
+
+/** method capabilities */
+enum {
+       WL_PROXD_FTM_CAP_NONE = 0x0000,
+       WL_PROXD_FTM_CAP_FTM1 = 0x0001
+};
+typedef uint16 wl_proxd_ftm_caps_t;
+
+typedef struct wl_proxd_tlv_id_list {
+       uint16                  num_ids;
+       uint16                  ids[1];
+} wl_proxd_tlv_id_list_t;
+
+typedef struct wl_proxd_session_id_list {
+       uint16 num_ids;
+       wl_proxd_session_id_t ids[1];
+} wl_proxd_session_id_list_t;
+
+typedef struct wl_proxd_tpk {
+       struct ether_addr       peer;
+       uint8 tpk[TPK_FTM_LEN];
+} wl_proxd_tpk_t;
+
+/* tlvs returned for get_info on ftm method
+ *     configuration:
+ *     proxd flags
+ *     event mask
+ *     debug mask
+ *     session defaults (session tlvs)
+ * status tlv - not supported for ftm method
+ * info tlv
+ */
+typedef struct wl_proxd_ftm_info {
+       wl_proxd_ftm_caps_t caps;
+       uint16 max_sessions;
+       uint16 num_sessions;
+       uint16 rx_max_burst;
+} wl_proxd_ftm_info_t;
+
+enum {
+       WL_PROXD_WAIT_NONE      = 0x0000,
+       WL_PROXD_WAIT_KEY       = 0x0001,
+       WL_PROXD_WAIT_SCHED     = 0x0002,
+       WL_PROXD_WAIT_TSF       = 0x0004
+};
+typedef int16 wl_proxd_wait_reason_t;
+
+/* tlvs returned for get_info on session
+ * session config (tlvs)
+ * session info tlv
+ */
+typedef struct wl_proxd_ftm_session_info {
+       uint16 sid;
+       uint8 bss_index;
+       uint8 pad;
+       struct ether_addr bssid;
+       wl_proxd_session_state_t state;
+       wl_proxd_status_t status;
+       uint16  burst_num;
+       wl_proxd_wait_reason_t wait_reason;
+       uint32  meas_start_lo; /* sn tsf of 1st meas for cur/prev burst */
+       uint32  meas_start_hi;
+} wl_proxd_ftm_session_info_t;
+
+typedef struct wl_proxd_ftm_session_status {
+       uint16 sid;
+       wl_proxd_session_state_t state;
+       wl_proxd_status_t status;
+       uint16  burst_num;
+       uint16  pad;
+} wl_proxd_ftm_session_status_t;
+
+/** rrm range request */
+typedef struct wl_proxd_range_req {
+       uint16                  num_repeat;
+       uint16                  init_delay_range;       /**< in TUs */
+       uint8                   pad;
+       uint8                   num_nbr;                /**< number of (possible) neighbors */
+       nbr_element_t           nbr[1];
+} wl_proxd_range_req_t;
+
+#define WL_PROXD_LCI_LAT_OFF   0
+#define WL_PROXD_LCI_LONG_OFF  5
+#define WL_PROXD_LCI_ALT_OFF   10
+
+#define WL_PROXD_LCI_GET_LAT(_lci, _lat, _lat_err) { \
+       unsigned _off = WL_PROXD_LCI_LAT_OFF; \
+       _lat_err = (_lci)->data[(_off)] & 0x3f; \
+       _lat = (_lci)->data[(_off)+1]; \
+       _lat |= (_lci)->data[(_off)+2] << 8; \
+       _lat |= (_lci)->data[_(_off)+3] << 16; \
+       _lat |= (_lci)->data[(_off)+4] << 24; \
+       _lat <<= 2; \
+       _lat |= (_lci)->data[(_off)] >> 6; \
+}
+
+#define WL_PROXD_LCI_GET_LONG(_lci, _lcilong, _long_err) { \
+       unsigned _off = WL_PROXD_LCI_LONG_OFF; \
+       _long_err = (_lci)->data[(_off)] & 0x3f; \
+       _lcilong = (_lci)->data[(_off)+1]; \
+       _lcilong |= (_lci)->data[(_off)+2] << 8; \
+       _lcilong |= (_lci)->data[_(_off)+3] << 16; \
+       _lcilong |= (_lci)->data[(_off)+4] << 24; \
+       __lcilong <<= 2; \
+       _lcilong |= (_lci)->data[(_off)] >> 6; \
+}
+
+#define WL_PROXD_LCI_GET_ALT(_lci, _alt_type, _alt, _alt_err) { \
+       unsigned _off = WL_PROXD_LCI_ALT_OFF; \
+       _alt_type = (_lci)->data[_off] & 0x0f; \
+       _alt_err = (_lci)->data[(_off)] >> 4; \
+       _alt_err |= ((_lci)->data[(_off)+1] & 0x03) << 4; \
+       _alt = (_lci)->data[(_off)+2]; \
+       _alt |= (_lci)->data[(_off)+3] << 8; \
+       _alt |= (_lci)->data[_(_off)+4] << 16; \
+       _alt <<= 6; \
+       _alt |= (_lci)->data[(_off) + 1] >> 2; \
+}
+
+#define WL_PROXD_LCI_VERSION(_lci) ((_lci)->data[15] >> 6)
+
+/* availability. advertising mechanism bss specific */
+/** availablity flags */
+enum {
+       WL_PROXD_AVAIL_NONE = 0,
+       WL_PROXD_AVAIL_NAN_PUBLISHED = 0x0001,
+       WL_PROXD_AVAIL_SCHEDULED = 0x0002        /**< scheduled by proxd */
+};
+typedef int16 wl_proxd_avail_flags_t;
+
+/** time reference */
+enum {
+       WL_PROXD_TREF_NONE = 0,
+       WL_PROXD_TREF_DEV_TSF = 1,
+       WL_PROXD_TREF_NAN_DW = 2,
+       WL_PROXD_TREF_TBTT = 3,
+       WL_PROXD_TREF_MAX               /* last entry */
+};
+typedef int16 wl_proxd_time_ref_t;
+
+/** proxd channel-time slot */
+typedef struct {
+       wl_proxd_intvl_t start;         /**< from ref */
+       wl_proxd_intvl_t duration;      /**< from start */
+       uint32  chanspec;
+} wl_proxd_time_slot_t;
+
+typedef struct wl_proxd_avail24 {
+       wl_proxd_avail_flags_t flags; /**< for query only */
+       wl_proxd_time_ref_t time_ref;
+       uint16  max_slots; /**< for query only */
+       uint16  num_slots;
+       wl_proxd_time_slot_t slots[1];  /**< ROM compat - not used */
+       wl_proxd_intvl_t        repeat;
+       wl_proxd_time_slot_t ts0[1];
+} wl_proxd_avail24_t;
+#define WL_PROXD_AVAIL24_TIMESLOT(_avail24, _i) (&(_avail24)->ts0[(_i)])
+#define WL_PROXD_AVAIL24_TIMESLOT_OFFSET(_avail24) OFFSETOF(wl_proxd_avail24_t, ts0)
+#define WL_PROXD_AVAIL24_TIMESLOTS(_avail24) WL_PROXD_AVAIL24_TIMESLOT(_avail24, 0)
+#define WL_PROXD_AVAIL24_SIZE(_avail24, _num_slots) (\
+       WL_PROXD_AVAIL24_TIMESLOT_OFFSET(_avail24) + \
+       (_num_slots) * sizeof(*WL_PROXD_AVAIL24_TIMESLOT(_avail24, 0)))
+
+typedef struct wl_proxd_avail {
+       wl_proxd_avail_flags_t flags; /**< for query only */
+       wl_proxd_time_ref_t time_ref;
+       uint16  max_slots; /**< for query only */
+       uint16  num_slots;
+       wl_proxd_intvl_t        repeat;
+       wl_proxd_time_slot_t slots[1];
+} wl_proxd_avail_t;
+#define WL_PROXD_AVAIL_TIMESLOT(_avail, _i) (&(_avail)->slots[(_i)])
+#define WL_PROXD_AVAIL_TIMESLOT_OFFSET(_avail) OFFSETOF(wl_proxd_avail_t, slots)
+
+#define WL_PROXD_AVAIL_TIMESLOTS(_avail) WL_PROXD_AVAIL_TIMESLOT(_avail, 0)
+#define WL_PROXD_AVAIL_SIZE(_avail, _num_slots) (\
+       WL_PROXD_AVAIL_TIMESLOT_OFFSET(_avail) + \
+       (_num_slots) * sizeof(*WL_PROXD_AVAIL_TIMESLOT(_avail, 0)))
+
+/* collect support TBD */
+
+/** debugging */
+enum {
+       WL_PROXD_DEBUG_NONE             = 0x00000000,
+       WL_PROXD_DEBUG_LOG              = 0x00000001,
+       WL_PROXD_DEBUG_IOV              = 0x00000002,
+       WL_PROXD_DEBUG_EVENT            = 0x00000004,
+       WL_PROXD_DEBUG_SESSION          = 0x00000008,
+       WL_PROXD_DEBUG_PROTO            = 0x00000010,
+       WL_PROXD_DEBUG_SCHED            = 0x00000020,
+       WL_PROXD_DEBUG_RANGING          = 0x00000040,
+       WL_PROXD_DEBUG_NAN              = 0x00000080,
+       WL_PROXD_DEBUG_PKT              = 0x00000100,
+       WL_PROXD_DEBUG_SEC              = 0x00000200,
+       WL_PROXD_DEBUG_EVENTLOG         = 0x80000000,   /* map/enable EVNET_LOG_TAG_PROXD_INFO */
+       WL_PROXD_DEBUG_ALL              = 0xffffffff
+};
+typedef uint32 wl_proxd_debug_mask_t;
+
+/** tlv IDs - data length 4 bytes unless overridden by type, alignment 32 bits */
+typedef enum {
+       WL_PROXD_TLV_ID_NONE                    = 0,
+       WL_PROXD_TLV_ID_METHOD                  = 1,
+       WL_PROXD_TLV_ID_FLAGS                   = 2,
+       WL_PROXD_TLV_ID_CHANSPEC                = 3,    /**< note: uint32 */
+       WL_PROXD_TLV_ID_TX_POWER                = 4,
+       WL_PROXD_TLV_ID_RATESPEC                = 5,
+       WL_PROXD_TLV_ID_BURST_DURATION          = 6,    /**< intvl - length of burst */
+       WL_PROXD_TLV_ID_BURST_PERIOD            = 7,    /**< intvl - between bursts */
+       WL_PROXD_TLV_ID_BURST_FTM_SEP           = 8,    /**< intvl - between FTMs */
+       WL_PROXD_TLV_ID_BURST_NUM_FTM           = 9,    /**< uint16 - per burst */
+       WL_PROXD_TLV_ID_NUM_BURST               = 10,   /**< uint16 */
+       WL_PROXD_TLV_ID_FTM_RETRIES             = 11,   /**< uint16 at FTM level */
+       WL_PROXD_TLV_ID_BSS_INDEX               = 12,   /**< uint8 */
+       WL_PROXD_TLV_ID_BSSID                   = 13,
+       WL_PROXD_TLV_ID_INIT_DELAY              = 14,   /**< intvl - optional,non-standalone only */
+       WL_PROXD_TLV_ID_BURST_TIMEOUT           = 15,   /**< expect response within - intvl */
+       WL_PROXD_TLV_ID_EVENT_MASK              = 16,   /**< interested events - in/out */
+       WL_PROXD_TLV_ID_FLAGS_MASK              = 17,   /**< interested flags - in only */
+       WL_PROXD_TLV_ID_PEER_MAC                = 18,   /**< mac address of peer */
+       WL_PROXD_TLV_ID_FTM_REQ                 = 19,   /**< dot11_ftm_req */
+       WL_PROXD_TLV_ID_LCI_REQ                 = 20,
+       WL_PROXD_TLV_ID_LCI                     = 21,
+       WL_PROXD_TLV_ID_CIVIC_REQ               = 22,
+       WL_PROXD_TLV_ID_CIVIC                   = 23,
+       WL_PROXD_TLV_ID_AVAIL24                 = 24,   /**< ROM compatibility */
+       WL_PROXD_TLV_ID_SESSION_FLAGS           = 25,
+       WL_PROXD_TLV_ID_SESSION_FLAGS_MASK      = 26,   /**< in only */
+       WL_PROXD_TLV_ID_RX_MAX_BURST            = 27,   /**< uint16 - limit bursts per session */
+       WL_PROXD_TLV_ID_RANGING_INFO            = 28,   /**< ranging info */
+       WL_PROXD_TLV_ID_RANGING_FLAGS           = 29,   /**< uint16 */
+       WL_PROXD_TLV_ID_RANGING_FLAGS_MASK      = 30,   /**< uint16, in only */
+       WL_PROXD_TLV_ID_NAN_MAP_ID              = 31,
+       WL_PROXD_TLV_ID_DEV_ADDR                = 32,
+       WL_PROXD_TLV_ID_AVAIL                   = 33,   /**< wl_proxd_avail_t  */
+       WL_PROXD_TLV_ID_TLV_ID                  = 34,   /* uint16 tlv-id */
+       WL_PROXD_TLV_ID_FTM_REQ_RETRIES         = 35,   /* uint16 FTM request retries */
+       WL_PROXD_TLV_ID_TPK                     = 36,   /* 32byte TPK  */
+       WL_PROXD_TLV_ID_RI_RR                   = 36,   /* RI_RR */
+       WL_PROXD_TLV_ID_TUNE                    = 37,   /* wl_proxd_pararms_tof_tune_t */
+       WL_PROXD_TLV_ID_CUR_ETHER_ADDR          = 38,   /* Source Address used for Tx */
+
+       /* output - 512 + x */
+       WL_PROXD_TLV_ID_STATUS                  = 512,
+       WL_PROXD_TLV_ID_COUNTERS                = 513,
+       WL_PROXD_TLV_ID_INFO                    = 514,
+       WL_PROXD_TLV_ID_RTT_RESULT              = 515,
+       WL_PROXD_TLV_ID_AOA_RESULT              = 516,
+       WL_PROXD_TLV_ID_SESSION_INFO            = 517,
+       WL_PROXD_TLV_ID_SESSION_STATUS          = 518,
+       WL_PROXD_TLV_ID_SESSION_ID_LIST         = 519,
+       WL_PROXD_TLV_ID_RTT_RESULT_V2           = 520,
+
+       /* debug tlvs can be added starting 1024 */
+       WL_PROXD_TLV_ID_DEBUG_MASK              = 1024,
+       WL_PROXD_TLV_ID_COLLECT                 = 1025, /**< output only */
+       WL_PROXD_TLV_ID_STRBUF                  = 1026,
+
+       WL_PROXD_TLV_ID_COLLECT_HEADER          = 1025, /* wl_proxd_collect_header_t */
+       WL_PROXD_TLV_ID_COLLECT_INFO            = 1028, /* wl_proxd_collect_info_t */
+       WL_PROXD_TLV_ID_COLLECT_DATA            = 1029, /* wl_proxd_collect_data_t */
+       WL_PROXD_TLV_ID_COLLECT_CHAN_DATA       = 1030, /* wl_proxd_collect_data_t */
+       WL_PROXD_TLV_ID_MF_STATS_DATA           = 1031, /* mf_stats_buffer */
+
+       WL_PROXD_TLV_ID_COLLECT_INLINE_HEADER   = 1032,
+       WL_PROXD_TLV_ID_COLLECT_INLINE_FRAME_INFO       = 1033,
+       WL_PROXD_TLV_ID_COLLECT_INLINE_FRAME_DATA       = 1034,
+       WL_PROXD_TLV_ID_COLLECT_INLINE_RESULTS  = 1035,
+
+       WL_PROXD_TLV_ID_MAX
+} wl_proxd_tlv_types_t;
+
+#define TOF_COLLECT_INLINE_HEADER_INFO_VER_1   1
+
+typedef struct wl_proxd_collect_inline_header_info_v1
+{
+       uint16                  version;
+       uint16                  pad1;
+       uint32                  ratespec;               /* override */
+       chanspec_t              chanspec;
+       uint16                  num_ftm;
+       struct ether_addr       peer_mac;
+       struct ether_addr       cur_ether_addr;         /* source address for Tx */
+} wl_proxd_collect_inline_header_info_v1_t;
+
+#define TOF_COLLECT_INLINE_RESULTS_VER_1               1
+typedef struct wl_proxd_collect_inline_results_info_v1
+{
+       uint16 version;
+       uint16 pad1;
+       uint32 meanrtt;
+       uint32 distance;
+       uint16 num_rtt;
+       uint16 pad2;
+       int32 status;
+       uint32 ratespec;
+} wl_proxd_collect_inline_results_info_v1_t;
+
+#define TOF_COLLECT_INLINE_FRAME_INFO_VER_1    1
+typedef struct wl_proxd_collect_inline_frame_info_v1
+{
+       uint16 version;
+       uint16 pad1;
+       int32 gd;
+       uint32 T[4];
+       uint32 prev_t1;
+       uint32 prev_t4;
+       int32 hadj;
+       int8 rssi;
+       uint8 pad[3];
+} wl_proxd_collect_inline_frame_info_v1_t;
+
+#define TOF_COLLECT_INLINE_FRAME_INFO_VER_2    2
+typedef struct wl_proxd_collect_inline_frame_info_v2
+{
+       uint16 version;
+       uint16 pad1;
+       int32 gd;
+       uint32 T[4];
+       int32 hadj;
+       int8 rssi;
+       uint8 pad[3];
+} wl_proxd_collect_inline_frame_info_v2_t;
+
+typedef struct wl_proxd_tlv {
+       uint16 id;
+       uint16 len;
+       uint8  data[1];
+} wl_proxd_tlv_t;
+
+/** proxd iovar - applies to proxd, method or session */
+typedef struct wl_proxd_iov {
+       uint16                  version;
+       uint16                  len;
+       wl_proxd_cmd_t          cmd;
+       wl_proxd_method_t       method;
+       wl_proxd_session_id_t   sid;
+       wl_ftm_type_t           ftm_type; /* 11az ftm type. Only valid with PROXD vers >= 0x0400 */
+       uint8                   PAD[1];
+       wl_proxd_tlv_t          tlvs[1];        /**< variable */
+} wl_proxd_iov_t;
+
+#define WL_PROXD_IOV_HDR_SIZE OFFSETOF(wl_proxd_iov_t, tlvs)
+
+/* The following event definitions may move to bcmevent.h, but sharing proxd types
+ * across needs more invasive changes unrelated to proxd
+ */
+enum {
+       WL_PROXD_EVENT_NONE                     = 0,    /**< not an event, reserved */
+       WL_PROXD_EVENT_SESSION_CREATE           = 1,
+       WL_PROXD_EVENT_SESSION_START            = 2,
+       WL_PROXD_EVENT_FTM_REQ                  = 3,
+       WL_PROXD_EVENT_BURST_START              = 4,
+       WL_PROXD_EVENT_BURST_END                = 5,
+       WL_PROXD_EVENT_SESSION_END              = 6,
+       WL_PROXD_EVENT_SESSION_RESTART          = 7,
+       WL_PROXD_EVENT_BURST_RESCHED            = 8,    /**< burst rescheduled-e.g. partial TSF */
+       WL_PROXD_EVENT_SESSION_DESTROY          = 9,
+       WL_PROXD_EVENT_RANGE_REQ                = 10,
+       WL_PROXD_EVENT_FTM_FRAME                = 11,
+       WL_PROXD_EVENT_DELAY                    = 12,
+       WL_PROXD_EVENT_VS_INITIATOR_RPT         = 13,   /**< (target) rx initiator-report */
+       WL_PROXD_EVENT_RANGING                  = 14,
+       WL_PROXD_EVENT_LCI_MEAS_REP             = 15,   /* LCI measurement report */
+       WL_PROXD_EVENT_CIVIC_MEAS_REP           = 16,   /* civic measurement report */
+       WL_PROXD_EVENT_COLLECT                  = 17,
+       WL_PROXD_EVENT_START_WAIT               = 18,   /* waiting to start */
+       WL_PROXD_EVENT_MF_STATS                 = 19,   /* mf stats event */
+
+       WL_PROXD_EVENT_MAX
+};
+typedef int16 wl_proxd_event_type_t;
+
+/** proxd event mask - upto 32 events for now */
+typedef uint32 wl_proxd_event_mask_t;
+
+#define WL_PROXD_EVENT_MASK_ALL 0xfffffffe
+#define WL_PROXD_EVENT_MASK_EVENT(_event_type) (1 << (_event_type))
+#define WL_PROXD_EVENT_ENABLED(_mask, _event_type) (\
+       ((_mask) & WL_PROXD_EVENT_MASK_EVENT(_event_type)) != 0)
+
+/** proxd event - applies to proxd, method or session */
+typedef struct wl_proxd_event {
+       uint16                  version;
+       uint16                  len;
+       wl_proxd_event_type_t   type;
+       wl_proxd_method_t       method;
+       wl_proxd_session_id_t   sid;
+       uint8                   pad[2];         /* This field is used fragmentation purpose */
+       wl_proxd_tlv_t          tlvs[1];        /**< variable */
+} wl_proxd_event_t;
+
+enum {
+       WL_PROXD_RANGING_STATE_NONE = 0,
+       WL_PROXD_RANGING_STATE_NOTSTARTED = 1,
+       WL_PROXD_RANGING_STATE_INPROGRESS = 2,
+       WL_PROXD_RANGING_STATE_DONE = 3
+};
+typedef int16 wl_proxd_ranging_state_t;
+
+/** proxd ranging flags */
+enum {
+       WL_PROXD_RANGING_FLAG_NONE = 0x0000,  /**< no flags */
+       WL_PROXD_RANGING_FLAG_DEL_SESSIONS_ON_STOP = 0x0001,
+       WL_PROXD_RANGING_FLAG_ALL = 0xffff
+};
+typedef uint16 wl_proxd_ranging_flags_t;
+
+struct wl_proxd_ranging_info {
+       wl_proxd_status_t   status;
+       wl_proxd_ranging_state_t state;
+       wl_proxd_ranging_flags_t flags;
+       uint16  num_sids;
+       uint16  num_done;
+};
+typedef struct wl_proxd_ranging_info wl_proxd_ranging_info_t;
+
+#include <packed_section_start.h>
+/* Legacy platform i.e. 43342/43430 */
+#define WL_PROXD_COLLECT_EVENT_DATA_VERSION_1          1
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_collect_event_data_v1 {
+       uint32                  H_LB[K_TOF_COLLECT_H_SIZE_20MHZ];
+       uint32                  H_RX[K_TOF_COLLECT_H_SIZE_20MHZ];
+       uint8                   ri_rr[FTM_TPK_LEN];
+       wl_proxd_phy_error_t    phy_err_mask;
+} BWL_POST_PACKED_STRUCT wl_proxd_collect_event_data_v1_t;
+
+/* Secured 2.0 supoorted devices i.e. 4364 */
+#define WL_PROXD_COLLECT_EVENT_DATA_VERSION_2          2
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_collect_event_data_v2 {
+       uint32                  H_LB[K_TOF_COLLECT_H_SIZE_20MHZ];
+       uint32                  H_RX[K_TOF_COLLECT_H_SIZE_20MHZ];
+       uint8                   ri_rr[FTM_TPK_RI_RR_LEN_SECURE_2_0];
+       wl_proxd_phy_error_t    phy_err_mask;
+} BWL_POST_PACKED_STRUCT wl_proxd_collect_event_data_v2_t;
+#include <packed_section_end.h>
+
+#define WL_PROXD_COLLECT_EVENT_DATA_VERSION_3          3
+typedef struct wl_proxd_collect_event_data_v3 {
+       uint16                  version;
+       uint16                  length;
+       uint32                  H_LB[K_TOF_COLLECT_H_SIZE_20MHZ];
+       uint32                  H_RX[K_TOF_COLLECT_H_SIZE_20MHZ];
+       uint8                   ri_rr[FTM_TPK_RI_RR_LEN_SECURE_2_0];
+       wl_proxd_phy_error_t    phy_err_mask;
+} wl_proxd_collect_event_data_v3_t;
+
+#define WL_PROXD_COLLECT_EVENT_DATA_VERSION_4          4
+typedef struct wl_proxd_collect_event_data_v4 {
+       uint16                  version;
+       uint16                  length;
+       uint32                  H_LB[K_TOF_COLLECT_H_SIZE_20MHZ];
+       uint32                  H_RX[K_TOF_COLLECT_H_SIZE_20MHZ];
+       uint8                   ri_rr[FTM_TPK_RI_RR_LEN_SECURE_2_0_5G];
+       wl_proxd_phy_error_t    phy_err_mask;
+} wl_proxd_collect_event_data_v4_t;
+
+#define WL_PROXD_COLLECT_EVENT_DATA_VERSION_MAX        WL_PROXD_COLLECT_EVENT_DATA_VERSION_4
+
+/** Data returned by the bssload_report iovar. This is also the WLC_E_BSS_LOAD event data */
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct wl_bssload {
+       uint16 sta_count;               /**< station count */
+       uint16 aac;                     /**< available admission capacity */
+       uint8 chan_util;                /**< channel utilization */
+} BWL_POST_PACKED_STRUCT wl_bssload_t;
+#include <packed_section_end.h>
+
+/**
+ * Maximum number of configurable BSS Load levels.  The number of BSS Load
+ * ranges is always 1 more than the number of configured levels.  eg. if
+ * 3 levels of 10, 20, 30 are configured then this defines 4 load ranges:
+ * 0-10, 11-20, 21-30, 31-255.  A WLC_E_BSS_LOAD event is generated each time
+ * the utilization level crosses into another range, subject to the rate limit.
+ */
+#define MAX_BSSLOAD_LEVELS 8
+#define MAX_BSSLOAD_RANGES (MAX_BSSLOAD_LEVELS + 1)
+
+/** BSS Load event notification configuration. */
+typedef struct wl_bssload_cfg {
+       uint32 rate_limit_msec; /**< # of events posted to application will be limited to
+                                * one per specified period (0 to disable rate limit).
+                                */
+       uint8 num_util_levels;  /**< Number of entries in util_levels[] below */
+       uint8 util_levels[MAX_BSSLOAD_LEVELS];
+                               /**< Variable number of BSS Load utilization levels in
+                                * low to high order.  An event will be posted each time
+                                * a received beacon's BSS Load IE channel utilization
+                                * value crosses a level.
+                                */
+       uint8 PAD[3];
+} wl_bssload_cfg_t;
+
+/** User roam cache support */
+#define WL_USER_ROAM_CACHE_VER_1       1u
+#define WL_USER_ROAM_CACHE_VER         WL_USER_ROAM_CACHE_VER_1
+
+#define WL_USER_ROAM_CACHE_GET         0u      /**< Read back the chanspec[s] */
+#define WL_USER_ROAM_CACHE_ADD         1u      /**< Add chanspec[s] */
+#define WL_USER_ROAM_CACHE_DEL         2u      /**< Delete chanspec[s] */
+#define WL_USER_ROAM_CACHE_CLR         3u      /**< Delete all chanspec[s] */
+#define WL_USER_ROAM_CACHE_OVERRIDE    4u      /**< Set to use roam cached chanspec only */
+
+typedef struct wl_user_roamcache {
+       uint16  version;
+       uint16  length;         /**< Total length including version and length */
+       uint32  subcmd;         /**< Sub-command for chanspec add/rel etc.. */
+       union {
+               uint32  val;    /**< Command value when applicable */
+               struct {
+                       uint16  num_ch; /**< Number of chanspecs in the following array */
+                       chanspec_t chanspecs[];
+               } chlist;
+       } u;
+} wl_user_roamcache_t;
+
+/** Multiple roaming profile suport */
+#define WL_MAX_ROAM_PROF_BRACKETS      4
+
+#define WL_ROAM_PROF_VER_0     0
+#define WL_ROAM_PROF_VER_1     1
+#define WL_ROAM_PROF_VER_2     2
+#define WL_ROAM_PROF_VER_3     3
+
+#define WL_MAX_ROAM_PROF_VER   WL_ROAM_PROF_VER_1
+
+#define WL_ROAM_PROF_NONE      (0 << 0)
+#define WL_ROAM_PROF_LAZY      (1 << 0)
+#define WL_ROAM_PROF_NO_CI     (1 << 1)
+#define WL_ROAM_PROF_SUSPEND   (1 << 2)
+#define WL_ROAM_PROF_EXTSCAN   (1 << 3)
+#define WL_ROAM_PROF_SYNC_DTIM (1 << 6)
+#define WL_ROAM_PROF_DEFAULT   (1 << 7)        /**< backward compatible single default profile */
+
+#define WL_FACTOR_TABLE_MAX_LIMIT 5
+
+#define WL_CU_2G_ROAM_TRIGGER (-60)
+#define WL_CU_5G_ROAM_TRIGGER (-70)
+
+#define WL_CU_SCORE_DELTA_DEFAULT 20
+
+#define WL_MAX_CHANNEL_USAGE 0x0FF
+#define WL_CU_PERCENTAGE_DISABLE 0
+#define WL_CU_PERCENTAGE_DEFAULT 70
+#define WL_CU_PERCENTAGE_MAX 100
+#define WL_CU_CALC_DURATION_DEFAULT 10 /* seconds */
+#define WL_CU_CALC_DURATION_MAX 60 /* seconds */
+
+#define WL_ESTM_LOW_TRIGGER_DISABLE 0
+#define WL_ESTM_LOW_TRIGGER_DEFAULT 5 /* Mbps */
+#define WL_ESTM_LOW_TRIGGER_MAX 250  /* Mbps */
+#define WL_ESTM_ROAM_DELTA_DEFAULT 10
+
+typedef struct wl_roam_prof_v4 {
+       uint8   roam_flags;             /**< bit flags */
+       int8    roam_trigger;           /**< RSSI trigger level per profile/RSSI bracket */
+       int8    rssi_lower;
+       int8    roam_delta;
+
+       /* if channel_usage if zero, roam_delta is rssi delta required for new AP */
+       /* if channel_usage if non-zero, roam_delta is score delta(%) required for new AP */
+       int8    rssi_boost_thresh;      /**< Min RSSI to qualify for RSSI boost */
+       int8    rssi_boost_delta;       /**< RSSI boost for AP in the other band */
+       uint16  nfscan;                 /**< number of full scan to start with */
+       uint16  fullscan_period;
+       uint16  init_scan_period;
+       uint16  backoff_multiplier;
+       uint16  max_scan_period;
+       uint8   channel_usage;
+       uint8   cu_avg_calc_dur;
+       uint16  estm_low_trigger;       /**< ESTM low throughput roam trigger */
+       int8    estm_roam_delta;        /**< ESTM low throughput roam delta */
+       int8    pad[3];
+       uint16  lp_roamscan_period;
+       uint16  max_fullscan_period;
+} wl_roam_prof_v4_t;
+
+typedef struct wl_roam_prof_v3 {
+       uint8   roam_flags;             /**< bit flags */
+       int8    roam_trigger;           /**< RSSI trigger level per profile/RSSI bracket */
+       int8    rssi_lower;
+       int8    roam_delta;
+
+       /* if channel_usage if zero, roam_delta is rssi delta required for new AP */
+       /* if channel_usage if non-zero, roam_delta is score delta(%) required for new AP */
+       int8    rssi_boost_thresh;      /**< Min RSSI to qualify for RSSI boost */
+       int8    rssi_boost_delta;       /**< RSSI boost for AP in the other band */
+       uint16  nfscan;                 /**< number of full scan to start with */
+       uint16  fullscan_period;
+       uint16  init_scan_period;
+       uint16  backoff_multiplier;
+       uint16  max_scan_period;
+       uint8   channel_usage;
+       uint8   cu_avg_calc_dur;
+       uint16  estm_low_trigger; /**< ESTM low throughput roam trigger */
+       int8    estm_roam_delta; /**< ESTM low throughput roam delta */
+       uint8 pad;
+} wl_roam_prof_v3_t;
+
+typedef struct wl_roam_prof_v2 {
+       int8    roam_flags;             /**< bit flags */
+       int8    roam_trigger;           /**< RSSI trigger level per profile/RSSI bracket */
+       int8    rssi_lower;
+       int8    roam_delta;
+
+       /* if channel_usage if zero, roam_delta is rssi delta required for new AP */
+       /* if channel_usage if non-zero, roam_delta is score delta(%) required for new AP */
+       int8    rssi_boost_thresh;      /**< Min RSSI to qualify for RSSI boost */
+       int8    rssi_boost_delta;       /**< RSSI boost for AP in the other band */
+       uint16  nfscan;                 /**< number of full scan to start with */
+       uint16  fullscan_period;
+       uint16  init_scan_period;
+       uint16  backoff_multiplier;
+       uint16  max_scan_period;
+       uint8   channel_usage;
+       uint8   cu_avg_calc_dur;
+       uint8   pad[2];
+} wl_roam_prof_v2_t;
+
+typedef struct wl_roam_prof_v1 {
+       int8    roam_flags;             /**< bit flags */
+       int8    roam_trigger;           /**< RSSI trigger level per profile/RSSI bracket */
+       int8    rssi_lower;
+       int8    roam_delta;
+
+       /* if channel_usage if zero, roam_delta is rssi delta required for new AP */
+       /* if channel_usage if non-zero, roam_delta is score delta(%) required for new AP */
+       int8    rssi_boost_thresh;      /**< Min RSSI to qualify for RSSI boost */
+       int8    rssi_boost_delta;       /**< RSSI boost for AP in the other band */
+       uint16  nfscan;                 /**< number of full scan to start with */
+       uint16  fullscan_period;
+       uint16  init_scan_period;
+       uint16  backoff_multiplier;
+       uint16  max_scan_period;
+} wl_roam_prof_v1_t;
+
+typedef struct wl_roam_prof_band_v4 {
+       uint32  band;                   /**< Must be just one band */
+       uint16  ver;                    /**< version of this struct */
+       uint16  len;                    /**< length in bytes of this structure */
+       wl_roam_prof_v4_t roam_prof[WL_MAX_ROAM_PROF_BRACKETS];
+} wl_roam_prof_band_v4_t;
+
+typedef struct wl_roam_prof_band_v3 {
+       uint32  band;                   /**< Must be just one band */
+       uint16  ver;                    /**< version of this struct */
+       uint16  len;                    /**< length in bytes of this structure */
+       wl_roam_prof_v3_t roam_prof[WL_MAX_ROAM_PROF_BRACKETS];
+} wl_roam_prof_band_v3_t;
+
+typedef struct wl_roam_prof_band_v2 {
+       uint32  band;                   /**< Must be just one band */
+       uint16  ver;                    /**< version of this struct */
+       uint16  len;                    /**< length in bytes of this structure */
+       wl_roam_prof_v2_t roam_prof[WL_MAX_ROAM_PROF_BRACKETS];
+} wl_roam_prof_band_v2_t;
+
+typedef struct wl_roam_prof_band_v1 {
+       uint32  band;                   /**< Must be just one band */
+       uint16  ver;                    /**< version of this struct */
+       uint16  len;                    /**< length in bytes of this structure */
+       wl_roam_prof_v1_t roam_prof[WL_MAX_ROAM_PROF_BRACKETS];
+} wl_roam_prof_band_v1_t;
+
+#define BSS_MAXTABLE_SIZE 10
+#define WNM_BSS_SELECT_FACTOR_VERSION   1
+typedef struct wnm_bss_select_factor_params {
+       uint8 low;
+       uint8 high;
+       uint8 factor;
+       uint8 pad;
+} wnm_bss_select_factor_params_t;
+
+#define WNM_BSS_SELECT_FIXED_SIZE OFFSETOF(wnm_bss_select_factor_cfg_t, params)
+typedef struct wnm_bss_select_factor_cfg {
+       uint8 version;
+       uint8 band;
+       uint16 type;
+       uint16 pad;
+       uint16 count;
+       wnm_bss_select_factor_params_t params[1];
+} wnm_bss_select_factor_cfg_t;
+
+#define WNM_BSS_SELECT_WEIGHT_VERSION   1
+typedef struct wnm_bss_select_weight_cfg {
+       uint8 version;
+       uint8 band;
+       uint16 type;
+       uint16 weight; /* weightage for each type between 0 to 100 */
+} wnm_bss_select_weight_cfg_t;
+
+/* For branches before koala .. wbtext is part
+ * of wnm need to use below type only
+ */
+typedef struct wnm_btm_default_score_cfg {
+       uint32 default_score; /* default score */
+       uint8 band;
+} wnm_btm_default_score_cfg_t;
+
+/* For branches from koala and above .. wbtext is
+ * seperate module..need to use below type only
+ */
+typedef struct wbtext_btm_default_score_cfg {
+       uint32 default_score; /* default score */
+       uint8 band;
+} wbtext_btm_default_score_cfg_t;
+
+#define WNM_BSS_SELECT_TYPE_RSSI   0
+#define WNM_BSS_SELECT_TYPE_CU   1
+#define WNM_BSS_SELECT_TYPE_ESTM_DL   2
+
+#define WNM_BSSLOAD_MONITOR_VERSION   1
+typedef struct wnm_bssload_monitor_cfg {
+       uint8 version;
+       uint8 band;
+       uint8 duration; /* duration between 1 to 20sec */
+} wnm_bssload_monitor_cfg_t;
+
+#define WNM_ROAM_TRIGGER_VERSION   1
+typedef struct wnm_roam_trigger_cfg {
+       uint8 version;
+       uint8 band;
+       uint16 type;
+       int16 trigger; /* trigger for each type in new roam algorithm */
+} wnm_roam_trigger_cfg_t;
+
+/* Data structures for Interface Create/Remove  */
+
+#define WL_INTERFACE_CREATE_VER        (0)
+#define WL_INTERFACE_CREATE_VER_1      1
+#define WL_INTERFACE_CREATE_VER_2      2
+#define WL_INTERFACE_CREATE_VER_3      3
+
+/*
+ * The flags filed of the wl_interface_create is designed to be
+ * a Bit Mask. As of now only Bit 0 and Bit 1 are used as mentioned below.
+ * The rest of the bits can be used, incase we have to provide
+ * more information to the dongle
+ */
+
+/*
+ * Bit 0 of flags field is used to inform whether the interface requested to
+ * be created is STA or AP.
+ * 0 - Create a STA interface
+ * 1 - Create an AP interface
+ * NOTE: This Bit 0 is applicable for the WL_INTERFACE_CREATE_VER < 2
+ */
+#define WL_INTERFACE_CREATE_STA        (0 << 0)
+#define WL_INTERFACE_CREATE_AP (1 << 0)
+
+/*
+ * From revision >= 2 Bit 0 of flags field will not used be for STA or AP interface creation.
+ * "iftype" field shall be used for identifying the interface type.
+ */
+typedef enum wl_interface_type {
+       WL_INTERFACE_TYPE_STA = 0,
+       WL_INTERFACE_TYPE_AP = 1,
+
+       WL_INTERFACE_TYPE_NAN = 3,
+       WL_INTERFACE_TYPE_P2P_GO = 4,
+       WL_INTERFACE_TYPE_P2P_GC = 5,
+       WL_INTERFACE_TYPE_P2P_DISC = 6,
+       WL_INTERFACE_TYPE_IBSS = 7,
+       WL_INTERFACE_TYPE_MAX
+} wl_interface_type_t;
+
+/*
+ * Bit 1 of flags field is used to inform whether MAC is present in the
+ * data structure or not.
+ * 0 - Ignore mac_addr field
+ * 1 - Use the mac_addr field
+ */
+#define WL_INTERFACE_MAC_DONT_USE      (0 << 1)
+#define WL_INTERFACE_MAC_USE           (1 << 1)
+
+/*
+ * Bit 2 of flags field is used to inform whether core or wlc index
+ * is present in the data structure or not.
+ * 0 - Ignore wlc_index field
+ * 1 - Use the wlc_index field
+ */
+#define WL_INTERFACE_WLC_INDEX_DONT_USE        (0 << 2)
+#define WL_INTERFACE_WLC_INDEX_USE     (1 << 2)
+
+/*
+ * Bit 3 of flags field is used to create interface on the host requested interface index
+ * 0 - Ignore if_index field
+ * 1 - Use the if_index field
+ */
+#define WL_INTERFACE_IF_INDEX_USE       (1 << 3)
+
+/*
+ * Bit 4 of flags field is used to assign BSSID
+ * 0 - Ignore bssid field
+ * 1 - Use the bssid field
+ */
+#define WL_INTERFACE_BSSID_INDEX_USE   (1 << 4)
+
+typedef struct wl_interface_create {
+       uint16  ver;                    /* version of this struct */
+       uint32  flags;                  /* flags that defines the operation */
+       struct  ether_addr   mac_addr;  /* Optional Mac address */
+} wl_interface_create_t;
+
+typedef struct wl_interface_create_v1 {
+       uint16  ver;                    /**< version of this struct */
+       uint8   pad1[2];                /**< Padding bytes */
+       uint32  flags;                  /**< flags that defines the operation */
+       struct  ether_addr   mac_addr;  /**< Optional Mac address */
+       uint8   pad2[2];                /**< Padding bytes */
+       uint32  wlc_index;              /**< Optional wlc index */
+} wl_interface_create_v1_t;
+
+typedef struct wl_interface_create_v2 {
+       uint16  ver;                    /**< version of this struct */
+       uint8   pad1[2];                /**< Padding bytes */
+       uint32  flags;                  /**< flags that defines the operation */
+       struct  ether_addr   mac_addr;  /**< Optional Mac address */
+       uint8   iftype;                 /**< Type of interface created */
+       uint8   pad2;                   /**< Padding bytes */
+       uint32  wlc_index;              /**< Optional wlc index */
+} wl_interface_create_v2_t;
+
+typedef struct wl_interface_create_v3 {
+       uint16  ver;                    /**< version of this struct */
+       uint16  len;                    /**< length of whole structure including variable length */
+       uint16  fixed_len;              /**< Fixed length of this structure excluding data[] */
+       uint8   iftype;                 /**< Type of interface created */
+       uint8   wlc_index;              /**< Optional wlc index */
+       uint32  flags;                  /**< flags that defines the operation */
+       struct  ether_addr   mac_addr;  /**< Optional Mac address */
+       struct  ether_addr   bssid;     /**< Optional BSSID */
+       uint8   if_index;               /**< interface index requested by Host */
+       uint8   pad[3];                 /**< Padding bytes to ensure data[] is at 32 bit aligned */
+       uint8   data[];                 /**< Optional application/Module specific data */
+} wl_interface_create_v3_t;
+
+#define WL_INTERFACE_INFO_VER_1                1
+#define WL_INTERFACE_INFO_VER_2                2
+
+typedef struct wl_interface_info {
+    uint16  ver;            /* version of this struct */
+    struct ether_addr    mac_addr;  /* MAC address of the interface */
+    char    ifname[BCM_MSG_IFNAME_MAX]; /* name of interface */
+    uint8   bsscfgidx;      /* source bsscfg index */
+} wl_interface_info_t;
+
+typedef struct wl_interface_info_v1 {
+       uint16  ver;                    /**< version of this struct */
+       struct ether_addr    mac_addr;  /**< MAC address of the interface */
+       char    ifname[BCM_MSG_IFNAME_MAX]; /**< name of interface */
+       uint8   bsscfgidx;              /**< source bsscfg index */
+       uint8   PAD;
+} wl_interface_info_v1_t;
+
+typedef struct wl_interface_info_v2 {
+       uint16                  ver;                    /**< version of this struct */
+       uint16                  length;                 /**< length of the whole structure */
+       struct  ether_addr      mac_addr;               /**< MAC address of the interface */
+       uint8                   bsscfgidx;              /**< source bsscfg index */
+       uint8                   if_index;               /**< Interface index allocated by FW */
+       char                    ifname[BCM_MSG_IFNAME_MAX]; /**< name of interface */
+} wl_interface_info_v2_t;
+
+#define PHY_RXIQEST_AVERAGING_DELAY 10
+
+typedef struct wl_iqest_params {
+       uint32 rxiq;
+       uint8 niter;
+       uint8 delay;
+       uint8 PAD[2];
+} wl_iqest_params_t;
+
+typedef struct wl_iqest_sweep_params {
+       wl_iqest_params_t params;
+       uint8 nchannels;
+       uint8 channel[3];       /** variable */
+} wl_iqest_sweep_params_t;
+
+typedef struct wl_iqest_value {
+       uint8 channel;
+       uint8 PAD[3];
+       uint32 rxiq;
+} wl_iqest_value_t;
+
+typedef struct wl_iqest_result {
+       uint8 nvalues;
+       uint8 PAD[3];
+       wl_iqest_value_t value[1];
+} wl_iqest_result_t;
+
+#define WL_PRIO_ROAM_PROF_V1 (1u)
+
+typedef struct wl_prio_roam_prof_v1 {
+       uint16 version; /* Version info */
+       uint16 length; /* byte length of this structure */
+       uint8 prio_roam_mode; /* Roam mode RCC/RCC+Full Scan */
+       uint8 PAD[3];
+} wl_prio_roam_prof_v1_t;
+
+typedef enum wl_prio_roam_mode {
+       PRIO_ROAM_MODE_OFF = 0, /* Prio_Roam feature disable */
+       PRIO_ROAM_MODE_RCC_ONLY = 1, /* Scan RCC list only */
+       PRIO_ROAM_MODE_RCC_FULLSCAN = 2, /* Scan RCC list + Full scan */
+       PRIO_ROAM_MODE_FULLSCAN_ONLY = 3 /* Full Scan only */
+} wl_prio_roam_mode_t;
+
+/* BTCX AIBSS (Oxygen) Status */
+typedef struct wlc_btc_aibss_info {
+       uint32  prev_tsf_l;             // Lower 32 bits of last read of TSF
+       uint32  prev_tsf_h;             // Higher 32 bits of last read of TSF
+       uint32  last_btinfo;            // Last read of BT info
+       uint32  local_btinfo;           // Local BT INFO BitMap
+       uint8   bt_out_of_sync_cnt;     // BT not in sync with strobe
+       uint8   esco_off_cnt;           // Count incremented when ESCO is off
+       uint8   strobe_enabled;         // Set only in AIBSS mode
+       uint8   strobe_on;              // strobe to BT is on for Oxygen
+       uint8   local_bt_in_sync;       // Sync status of local BT when strobe is on
+       uint8   other_bt_in_sync;       // Sync state of BT in other devices in AIBSS
+       uint8   local_bt_is_master;     // Local BT is master
+       uint8   sco_prot_on;            // eSCO Protection on in local device
+       uint8   other_esco_present;     // eSCO status in other devices in AIBSS
+       uint8   rx_agg_change;          // Indicates Rx Agg size needs to change
+       uint8   rx_agg_modified;        // Rx Agg size modified
+       uint8   acl_grant_set;          // ACL grants on for speeding up sync
+       uint8   write_ie_err_cnt;       // BTCX Ie write error cnt
+       uint8   parse_ie_err_cnt;       // BTCX IE parse error cnt
+       uint8   wci2_fail_cnt;          // WCI2 init failure cnt
+       uint8   strobe_enable_err_cnt;  // Strobe enable err cnt
+       uint8   strobe_init_err_cnt;    // Strobe init err cnt
+       uint8   tsf_jump_cnt;           // TSF jump cnt
+       uint8   acl_grant_cnt;          // ALC grant cnt
+       uint8   pad1;
+       uint16  ibss_tsf_shm;           // SHM address of strobe TSF
+       uint16  pad2;
+} wlc_btc_aibss_info_t;
+
+#define WLC_BTC_AIBSS_STATUS_VER       1
+#define WLC_BTC_AIBSS_STATUS_LEN       (sizeof(wlc_btc_aibss_status_t) - 2 * (sizeof(uint16)))
+
+typedef struct wlc_btc_aibss_status {
+       uint16  version;                // Version #
+       uint16  len;                    // Length of the structure(excluding len & version)
+       int32   mode;                   // Current value of btc_mode
+       uint16  bth_period;             // bt coex period. read from shm.
+       uint16  agg_off_bm;             // AGG OFF BM read from SHM
+       uint8   bth_active;             // bt active session
+       uint8   pad[3];
+       wlc_btc_aibss_info_t aibss_info;        // Structure definition above
+} wlc_btc_aibss_status_t;
+
+typedef enum {
+       STATE_NONE = 0,
+
+       /* WLAN -> BT */
+       W2B_DATA_SET = 21,
+       B2W_ACK_SET = 22,
+       W2B_DATA_CLEAR = 23,
+       B2W_ACK_CLEAR = 24,
+
+       /* BT -> WLAN */
+       B2W_DATA_SET = 31,
+       W2B_ACK_SET = 32,
+       B2W_DATA_CLEAR = 33,
+       W2B_ACK_CLEAR = 34
+} bwte_gci_intstate_t;
+
+#define WL_BWTE_STATS_VERSION 1 /* version of bwte_stats_t */
+typedef struct {
+       uint32 version;
+
+       bwte_gci_intstate_t inttobt;
+       bwte_gci_intstate_t intfrombt;
+
+       uint32 bt2wl_intrcnt; /* bt->wlan interrrupt count */
+       uint32 wl2bt_intrcnt; /* wlan->bt interrupt count  */
+
+       uint32 wl2bt_dset_cnt;
+       uint32 wl2bt_dclear_cnt;
+       uint32 wl2bt_aset_cnt;
+       uint32 wl2bt_aclear_cnt;
+
+       uint32 bt2wl_dset_cnt;
+       uint32 bt2wl_dclear_cnt;
+       uint32 bt2wl_aset_cnt;
+       uint32 bt2wl_aclear_cnt;
+
+       uint32 state_error_1;
+       uint32 state_error_2;
+       uint32 state_error_3;
+       uint32 state_error_4;
+} bwte_stats_t;
+
+#define TBOW_MAX_SSID_LEN        32
+#define TBOW_MAX_PASSPHRASE_LEN  63
+
+#define WL_TBOW_SETUPINFO_T_VERSION 1 /* version of tbow_setup_netinfo_t */
+typedef struct tbow_setup_netinfo {
+       uint32 version;
+       uint8 opmode;
+       uint8 pad;
+       uint8 macaddr[ETHER_ADDR_LEN];
+       uint32 ssid_len;
+       uint8 ssid[TBOW_MAX_SSID_LEN];
+       uint8 passphrase_len;
+       uint8 passphrase[TBOW_MAX_PASSPHRASE_LEN];
+       chanspec_t chanspec;
+       uint8 PAD[2];
+       uint32 channel;
+} tbow_setup_netinfo_t;
+
+typedef enum tbow_ho_opmode {
+       TBOW_HO_MODE_START_GO = 0,
+       TBOW_HO_MODE_START_STA,
+       TBOW_HO_MODE_START_GC,
+       TBOW_HO_MODE_TEST_GO,
+       TBOW_HO_MODE_STOP_GO = 0x10,
+       TBOW_HO_MODE_STOP_STA,
+       TBOW_HO_MODE_STOP_GC,
+       TBOW_HO_MODE_TEARDOWN
+} tbow_ho_opmode_t;
+
+/* Beacon trim feature statistics */
+/* configuration */
+#define BCNTRIMST_PER                  0       /* Number of beacons to trim (0: disable) */
+#define BCNTRIMST_TIMEND               1       /* Number of bytes till TIM IE */
+#define BCNTRIMST_TSFLMT               2       /* TSF tolerance value (usecs) */
+/* internal use */
+#define BCNTRIMST_CUR                  3       /* PSM's local beacon trim counter */
+#define BCNTRIMST_PREVLEN              4       /* Beacon length excluding the TIM IE */
+#define BCNTRIMST_TIMLEN               5       /* TIM IE Length */
+#define BCNTRIMST_RSSI                 6       /* Partial beacon RSSI */
+#define BCNTRIMST_CHAN                 7       /* Partial beacon channel */
+/* debug stat (off by default) */
+#define BCNTRIMST_DUR                  8       /* RX duration until beacon trimmed */
+#define BCNTRIMST_RXMBSS               9       /* MYBSSID beacon received */
+#define BCNTRIMST_CANTRIM              10      /* # beacons which were trimmed */
+#define BCNTRIMST_LENCHG               11      /* # beacons not trimmed due to length change */
+#define BCNTRIMST_TSFDRF               12      /* # beacons not trimmed due to large TSF delta */
+#define BCNTRIMST_NOTIM                        13      /* # beacons not trimmed due to TIM missing */
+
+#define BCNTRIMST_NUM                  14
+
+#define WL_BCNTRIM_STATUS_VERSION_1    1
+#define WL_BCNTRIM_STATUS_VERSION_2    2       /* current version of
+                                                * struct wl_bcntrim_status_v2_t and
+                                                * struct wl_bcntrim_status_query_v2_t
+                                                * changes in v2: curr_slice_id also include
+                                                * beacon offload state
+                                                */
+
+typedef struct wl_bcntrim_status_query_v1 {
+       uint16  version;
+       uint16  len;     /* Total length includes fixed fields */
+       uint8   reset;   /* reset after reading the stats */
+       uint8   pad[3];  /* 4-byte alignment */
+} wl_bcntrim_status_query_v1_t;
+
+/* bits for curr_slice_id */
+#define WL_BCNTRIM_CURR_SLICE_ID_MASK        0x0Fu     /* bits 0-3 for curr_slice_id */
+#define WL_BCNTRIM_SC_OFFLOAD_ACTIVE_MASK    0x80u     /* mask for sc beacon offload */
+#define WL_BCNTRIM_SC_OFFLOAD_ACTIVE_FLAG    (1u << 7u)        /* MSB of curr_slice_id is used
+                                                        * to indicate if the offload is
+                                                        * currently active or not
+                                                        */
+typedef struct wl_bcntrim_status_v1 {
+       uint16  version;
+       uint16  len;            /* Total length includes fixed fields and variable data[] */
+       uint8   curr_slice_id;  /* slice index of the interface */
+       uint8   applied_cfg;    /* applied bcntrim N threshold */
+       uint8   pad[2];         /* 4-byte alignment */
+       uint32  fw_status;      /* Bits representing bcntrim disable reason in FW */
+       uint32  total_disable_dur;    /* total duration (msec) bcntrim remains
+                                        disabled due to FW disable reasons
+                                      */
+       uint32  data[];         /* variable length data containing stats */
+} wl_bcntrim_status_v1_t;
+
+/* v1 and v2 struct format for query and status are identical */
+typedef wl_bcntrim_status_v1_t wl_bcntrim_status_v2_t;
+typedef wl_bcntrim_status_query_v1_t wl_bcntrim_status_query_v2_t;
+
+#define BCNTRIM_STATS_MAX              10      /* Total stats part of the status data[] */
+
+/* Bits for FW status */
+#define WL_BCNTRIM_DISABLE_HOST                0x1     /* Host disabled bcntrim through bcntrim IOVar */
+#define WL_BCNTRIM_DISABLE_PHY_RATE    0x2     /* bcntrim disabled because beacon rx rate is
+                                                * higher than phy_rate_thresh
+                                                */
+#define WL_BCNTRIM_DISABLE_QUIET_IE    0x4     /* bcntrim disable when Quiet IE present */
+#define WL_BCNTRIM_DISABLE_QBSSLOAD_IE 0x8     /* bcntrim disable when QBSS Load IE present */
+#define WL_BCNTRIM_DISABLE_OPERMODE_IE 0x10    /* bcntrim disable when opermode IE is present */
+#define WL_BCNTRIM_DISABLE_CSA_IE      0x20    /* bcntrim dsiable when CSA IE is present */
+#define WL_BCNTRIM_DISABLE_SC_OFFLOAD  0x40    /* bcntrim disable on SC */
+
+#define BCNTRIM_DISABLE_THRESHOLD_TIME  1000 * 10      /* enable bcntrim after a threshold (10sec)
+                                                        * when disabled due to above mentioned IE's
+                                                        */
+#define WL_BCNTRIM_CFG_VERSION_1     1
+/* Common IOVAR struct */
+typedef struct wl_bcntrim_cfg_v1 {
+       uint16  version;
+       uint16 len;          /* Total length includes fixed fields and variable data[] */
+       uint16 subcmd_id;    /* subcommand id */
+       uint16 pad;          /* pad/reserved */
+       uint8 data[];        /* subcommand data; could be empty */
+} wl_bcntrim_cfg_v1_t;
+
+/* subcommands ids */
+enum {
+       WL_BCNTRIM_CFG_SUBCMD_PHY_RATE_THRESH =       0,   /* PHY rate threshold above
+                                                           * which bcntrim is not applied
+                                                           */
+       WL_BCNTRIM_CFG_SUBCMD_OVERRIDE_DISABLE_MASK = 1,   /* Override bcntrim disable reasons */
+       WL_BCNTRIM_CFG_SUBCMD_TSF_DRIFT_LIMIT =       2,   /* TSF drift limit to consider bcntrim */
+       WL_BCNTRIM_CFG_SUBCMD_SC_BCNTRIM =            3    /* config bcntrim on SC */
+};
+
+#define BCNTRIM_MAX_PHY_RATE   48     /* in 500Kbps */
+#define BCNTRIM_MAX_TSF_DRIFT   65535  /* in usec */
+#define WL_BCNTRIM_OVERRIDE_DISABLE_MASK \
+               (WL_BCNTRIM_DISABLE_QUIET_IE | WL_BCNTRIM_DISABLE_QBSSLOAD_IE)
+
+/* WL_BCNTRIM_CFG_SUBCMD_PHY_RATE_TRESH */
+typedef struct wl_bcntrim_cfg_phy_rate_thresh {
+       uint32 rate;      /* beacon rate (in 500kbps units)  */
+} wl_bcntrim_cfg_phy_rate_thresh_t;
+
+/* WL_BCNTRIM_CFG_SUBCMD_OVERRIDE_DISABLE_MASK */
+typedef struct wl_bcntrim_cfg_override_disable_mask {
+       uint32  mask;     /* bits representing individual disable reason to override */
+} wl_bcntrim_cfg_override_disable_mask_t;
+
+/* WL_BCNTRIM_CFG_SUBCMD_TSF_DRIFT_LIMIT */
+typedef struct wl_bcntrim_cfg_tsf_drift_limit {
+       uint16   drift;   /* tsf drift limit specified in usec */
+       uint8    pad[2];  /* 4-byte alignment */
+} wl_bcntrim_cfg_tsf_drift_limit_t;
+
+/* WL_BCNTRIM_CFG_SUBCMD_SC_BCNTRIM */
+typedef struct wl_bcntrim_cfg_sc_bcntrim {
+       uint32  sc_config; /* 0 disable or 1 enable sc bcntrim */
+} wl_bcntrim_cfg_sc_bcntrim_t;
+
+/* --------------  TX Power Cap --------------- */
+#define TXPWRCAP_MAX_NUM_CORES 8
+#define TXPWRCAP_MAX_NUM_ANTENNAS (TXPWRCAP_MAX_NUM_CORES * 2)
+
+#define TXPWRCAP_MAX_NUM_CORES_V3 4
+#define TXPWRCAP_MAX_NUM_ANTENNAS_V3 (TXPWRCAP_MAX_NUM_CORES_V3 * 2)
+
+#define TXPWRCAP_NUM_SUBBANDS 5
+#define TXPWRCAP_MAX_NUM_SUBGRPS 10
+
+/* IOVAR txcapconfig enum's */
+#define TXPWRCAPCONFIG_WCI2 0u
+#define TXPWRCAPCONFIG_HOST 1u
+#define TXPWRCAPCONFIG_WCI2_AND_HOST 2u
+#define TXPWRCAPCONFIG_NONE 0xFFu
+
+/* IOVAR txcapstate enum's */
+#define TXPWRCAPSTATE_LOW_CAP  0
+#define TXPWRCAPSTATE_HIGH_CAP 1
+#define TXPWRCAPSTATE_HOST_LOW_WCI2_LOW_CAP    0
+#define TXPWRCAPSTATE_HOST_LOW_WCI2_HIGH_CAP   1
+#define TXPWRCAPSTATE_HOST_HIGH_WCI2_LOW_CAP   2
+#define TXPWRCAPSTATE_HOST_HIGH_WCI2_HIGH_CAP  3
+
+/* IOVAR txcapconfig and txcapstate structure is shared: SET and GET */
+#define TXPWRCAPCTL_VERSION 2
+#define TXPWRCAPCTL_VERSION_3 3
+
+typedef struct wl_txpwrcap_ctl {
+       uint8   version;
+       uint8   ctl[TXPWRCAP_NUM_SUBBANDS];
+} wl_txpwrcap_ctl_t;
+
+typedef struct wl_txpwrcap_ctl_v3 {
+       uint8   version;
+       uint8   ctl[TXPWRCAP_MAX_NUM_SUBGRPS];
+} wl_txpwrcap_ctl_v3_t;
+
+/* IOVAR txcapdump structure: GET only */
+#define TXPWRCAP_DUMP_VERSION 2
+typedef struct wl_txpwrcap_dump {
+       uint8   version;
+       uint8   pad0;
+       uint8   current_country[2];
+       uint32  current_channel;
+       uint8   config[TXPWRCAP_NUM_SUBBANDS];
+       uint8   state[TXPWRCAP_NUM_SUBBANDS];
+       uint8   high_cap_state_enabled;
+       uint8   wci2_cell_status_last;
+       uint8   download_present;
+       uint8   num_subbands;
+       uint8   num_antennas;
+       uint8   num_antennas_per_core[TXPWRCAP_MAX_NUM_CORES];
+       uint8   num_cc_groups;
+       uint8   current_country_cc_group_info_index;
+       int8    low_cap[TXPWRCAP_MAX_NUM_ANTENNAS*TXPWRCAP_NUM_SUBBANDS];
+       int8    high_cap[TXPWRCAP_MAX_NUM_ANTENNAS*TXPWRCAP_NUM_SUBBANDS];
+       uint8   PAD[3];
+} wl_txpwrcap_dump_t;
+
+typedef struct wl_txpwrcap_dump_v3 {
+       uint8   version;
+       uint8   pad0;
+       uint8   current_country[2];
+       uint32  current_channel;
+       uint8   config[TXPWRCAP_NUM_SUBBANDS];
+       uint8   state[TXPWRCAP_NUM_SUBBANDS];
+       uint8   high_cap_state_enabled;
+       uint8   wci2_cell_status_last;
+       uint8   download_present;
+       uint8   num_subbands;
+       uint8   num_antennas;
+       uint8   num_antennas_per_core[TXPWRCAP_MAX_NUM_CORES];
+       uint8   num_cc_groups;
+       uint8   current_country_cc_group_info_index;
+       uint8   cap_states_per_cc_group;
+       int8    host_low_wci2_low_cap[TXPWRCAP_MAX_NUM_ANTENNAS*TXPWRCAP_NUM_SUBBANDS];
+       int8    host_low_wci2_high_cap[TXPWRCAP_MAX_NUM_ANTENNAS*TXPWRCAP_NUM_SUBBANDS];
+       int8    host_high_wci2_low_cap[TXPWRCAP_MAX_NUM_ANTENNAS*TXPWRCAP_NUM_SUBBANDS];
+       int8    host_high_wci2_high_cap[TXPWRCAP_MAX_NUM_ANTENNAS*TXPWRCAP_NUM_SUBBANDS];
+       uint8   PAD[2];
+} wl_txpwrcap_dump_v3_t;
+
+/*
+* Capability flag for wl_txpwrcap_tbl_v2_t and wl_txpwrcap_t
+* The index into pwrs will be:  0: onbody-cck, 1: onbody-ofdm, 2:offbody-cck, 3:offbody-ofdm
+*
+* For 5G power in SDB case as well as for non-SDB case, the value of flag will be: CAP_ONOFF_BODY
+* The index into pwrs will be:  0: onbody, 1: offbody-ofdm
+*/
+
+#define CAP_ONOFF_BODY (0x1)   /* on/off body only */
+#define CAP_CCK_OFDM   (0x2)   /* cck/ofdm capability only */
+#define CAP_LTE_CELL   (0x4)   /* cell on/off capability; required for iOS builds */
+#define CAP_HEAD_BODY  (0x8)   /* head/body capability */
+#define CAP_2G_DEPON_5G (0x10) /* 2G pwr caps depend on other slice 5G subband */
+#define CAP_SISO_MIMO  (0x20)  /* Siso/Mimo Separate Power Caps */
+#define CAP_ANT_TX     (0x40)  /* Separate Power Caps based on cell ant tx value */
+#define CAP_LTE_PQBIT  (0x100u) /* QPBit is enabled */
+#define CAP_ONOFF_BODY_CCK_OFDM        (CAP_ONOFF_BODY | CAP_CCK_OFDM)
+#define CAP_TXPWR_ALL  (CAP_ONOFF_BODY|CAP_CCK_OFDM|CAP_LTE_CELL|\
+       CAP_SISO_MIMO|CAP_HEAD_BODY|CAP_ANT_TX)
+
+#define TXHDR_SEC_MAX          5u      /* Deprecated.  Kept till removed in all branches */
+#define TXPWRCAP_MAX_STATES    4u
+#define TXPWRCAP_MAX_STATES_V3 10u
+#define TXPWRCAP_CCKOFDM_ONOFFBODY_MAX_STATES 4u
+#define TXPWRCAP_ONOFFBODY_MAX_STATES 2u
+#define TXPWRCAP_ONOFFCELL_MAX_STATES 2u
+
+#define TXHDR_SEC_NONSDB_MAIN_2G       0
+#define TXHDR_SEC_NONSDB_MAIN_5G       1
+#define TXHDR_SEC_NONSDB_AUX_2G                2
+#define TXHDR_SEC_NONSDB_AUX_5G                3
+#define TXHDR_SEC_SDB_MAIN_2G          4
+#define TXHDR_SEC_SDB_MAIN_5G          5
+#define TXHDR_SEC_SDB_AUX_2G           6
+#define TXHDR_SEC_SDB_AUX_5G           7
+#define TXHDR_MAX_SECTION              8
+
+#define WL_TXPWRCAP_MAX_SLICES 2
+#define WL_TXPWRCAPDUMP_VER    4
+
+#define WL_TXPWRCAP_VERSION_2 2
+#define WL_TXPWRCAP_VERSION_3 3
+
+typedef struct wl_txpwrcap {
+       uint8   capability;
+       uint8   num_cap_states;
+       uint8   section; /* Index from above,eg. TXHDR_SEC_NONSDB */
+       int8    pwrs[][TXPWRCAP_NUM_SUBBANDS][TXPWRCAP_MAX_NUM_CORES];
+} wl_txpwrcap_t;
+
+typedef struct {
+       uint8   capability;
+       uint8   num_cap_states;
+       uint8   num_subgrps;
+       uint8   section; /* Index from above,eg. TXHDR_SEC_NONSDB */
+       int8    pwrs[][TXPWRCAP_MAX_NUM_SUBGRPS][TXPWRCAP_MAX_NUM_ANTENNAS_V3];
+} wl_txpwrcap_v2_t;
+
+#define TXPWRCAP_DUMP_VERSION_4 4u
+#define TXPWRCAP_DUMP_VERSION_5 5u
+#define TXPWRCAP_DUMP_VERSION_6 6u
+
+typedef struct wl_txpwrcap_dump_v4 {
+       uint8           version;
+       uint8           num_pwrcap;
+       uint8           current_country[2];
+       uint32          current_channel;
+       uint8           download_present;
+       uint8           num_cores;      /* number cores on slice */
+       uint8           num_cc_groups;  /* number cc groups */
+       uint8           current_country_cc_group_info_index;
+       /* first power cap always exist
+       * On main,-non-sdb follows by sdb2g and then sdb5g
+       * On aux slice - aux2g then aux5g.
+       */
+       wl_txpwrcap_t   pwrcap; /* first power cap */
+} wl_txpwrcap_dump_v4_t;
+
+typedef struct wl_txpwrcap_dump_v5 {
+       uint8   version;
+       uint8   num_pwrcap;
+       uint8   current_country[2];
+       uint8   current_channel;
+       uint8   high_cap_state_enabled;
+       uint8   reserved[2];
+       uint8   download_present;
+       uint8   num_ants;       /* number antenna slice */
+       uint8   num_cc_groups;  /* number cc groups */
+       uint8   current_country_cc_group_info_index;
+       uint8   ant_tx; /* current value of ant_tx */
+       uint8   cell_status; /* current value of cell status */
+       int8    pwrcap[]; /* variable size power caps (wl_txpwrcap_v2_t) */
+} wl_txpwrcap_dump_v5_t;
+
+typedef struct wl_txpwrcap_dump_v6 {
+       uint8   version;
+       uint8   num_pwrcap;
+       uint8   current_country[2];
+       uint8   current_channel;
+       uint8   high_cap_state_enabled;
+       uint8   reserved[2];
+       uint8   download_present;
+       uint8   num_ants;       /* number antenna slice */
+       uint8   num_cc_groups;  /* number cc groups */
+       uint8   current_country_cc_group_info_index;
+       uint8   ant_tx; /* current value of ant_tx */
+       uint8   cell_status; /* current value of cell status */
+       uint16   capability[TXHDR_MAX_SECTION]; /* capabilities */
+       int8    pwrcap[]; /* variable size power caps (wl_txpwrcap_v2_t) */
+} wl_txpwrcap_dump_v6_t;
+
+#define TXCAPINFO_VERSION_1 1
+typedef struct wl_txpwrcap_ccgrp_info {
+       uint8   num_cc;
+       char    cc_list[1][2]; /* 2 letters for each country. At least one country */
+} wl_txpwrcap_ccgrp_info_t;
+
+typedef struct {
+       uint16  version;
+       uint16  length; /* length in bytes */
+       uint8   num_ccgrp;
+       /* followed by one or more wl_txpwrcap_ccgrp_info_t */
+       wl_txpwrcap_ccgrp_info_t   ccgrp_data[1];
+} wl_txpwrcap_info_t;
+
+typedef struct wl_txpwrcap_tbl {
+       uint8 num_antennas_per_core[TXPWRCAP_MAX_NUM_CORES];
+       /* Stores values for valid antennas */
+       int8 pwrcap_cell_on[TXPWRCAP_MAX_NUM_ANTENNAS]; /* qdBm units */
+       int8 pwrcap_cell_off[TXPWRCAP_MAX_NUM_ANTENNAS]; /* qdBm units */
+} wl_txpwrcap_tbl_t;
+
+typedef struct wl_txpwrcap_tbl_v2 {
+       uint8 version;
+       uint8 length;           /* size of entire structure, including the pwrs */
+       uint8 capability;       /* capability bitmap */
+       uint8 num_cores;        /* number of cores i.e. entries in each cap state row */
+       /*
+       * pwrs array has TXPWRCAP_MAX_STATES rows - one for each cap state.
+       * Each row has up to TXPWRCAP_MAX_NUM_CORES entries - one for each core.
+       */
+       uint8 pwrs[][TXPWRCAP_MAX_NUM_CORES];  /* qdBm units */
+} wl_txpwrcap_tbl_v2_t;
+
+typedef struct wl_txpwrcap_tbl_v3 {
+       uint8 version;
+       uint8 length;           /* size of entire structure, including the pwrs */
+       uint8 capability;       /* capability bitmap */
+       uint8 num_cores;        /* number of cores */
+       uint8 num_antennas_per_core[TXPWRCAP_MAX_NUM_CORES_V3];
+       /*
+       * pwrs array has TXPWRCAP_MAX_STATES rows - one for each cap state.
+       * Each row has up to TXPWRCAP_MAX_NUM_ANTENNAS entries - for each antenna.
+       * Included in the rows of powers are rows for fail safe.
+       */
+       int8 pwrs[][TXPWRCAP_MAX_NUM_ANTENNAS_V3];      /* qdBm units */
+} wl_txpwrcap_tbl_v3_t;
+
+/* dynamic sar iovar subcommand ids */
+enum {
+       IOV_DYNSAR_MODE         = 1,
+       IOV_DYNSAR_PWR_OFF      = 2,
+       IOV_DYNSAR_STAT_SUM     = 3,
+       IOV_DYNSAR_STAT_DET     = 4,
+       IOV_DYNSAR_TS           = 5,
+       IOV_DYNSAR_OPT_DUR      = 6,
+       IOV_DYNSAR_OPT_TXDC     = 7,
+       IOV_DYNSAR_STATUS       = 8,
+       IOV_DYNSAR_EVENT        = 9,
+       IOV_DYNSAR_CMD_LAST
+};
+
+/* when subcommand is IOV_DYNSAR_MODE, the mode can be one of the below */
+enum {
+       IOV_DYNSAR_MODE_OFF        = 0, /* DSA optimization turned off */
+       IOV_DYNSAR_MODE_PWR        = 1, /* DSA Power optimization mode */
+       IOV_DYNSAR_MODE_HBR_NOMUTE = 2, /* DSA Hybrid power and nomute optimization mode */
+
+       IOV_DYNSAR_MODE_MAX
+};
+
+#define DYNSAR_CNT_VERSION_V1  1u
+#define DYNSAR_CNT_VERSION_V2  2u
+#define DYNSAR_STS_OBS_WIN     20u
+#define DYNSAR_MAX_ANT         4u /* max antennas per slice */
+#define DYNSAR_MAX_AGG_IDX (DYNSAR_MAX_ANT << 1u) /* max antenna aggregation index */
+#define DYNSAR_MAC_NUM         2u
+
+/* Error bits */
+#define DYNSAR_NO_TXCAP                (1u << 0u)
+#define DYNSAR_NO_CLM          (1u << 1u)
+#define DYNSAR_TDMTX_DISABLED  (1u << 2u)
+
+typedef struct wlc_dynsar_sts_mon_ctr_st {
+       uint32 tx_dur;          /* in usec */
+       uint32 tx_dur_raw;      /* in usec */
+       uint32 plim_avg;        /* In uw. plim averaged over mon win. */
+       uint32 energy;          /* pavg * dur in mw * ms */
+       uint32 qsar;            /* plim * dur in mw * ms */
+       uint16 fs;              /* failsafe duration in usec */
+       uint8  util_hist;       /* utilization in past observe sec */
+       uint8  util_pred;       /* utilization of past (observe - budget) & predicted budget sec */
+} wlc_dynsar_sts_mon_ctr_t;
+
+typedef struct wlc_dynsar_sts_obs_win {
+       uint8 opt;
+       uint8 valid;
+       uint16 pad;
+       uint32 dur;     /* monitor duration in usec */
+       uint64 ts;      /* timestamp in usec */
+} wlc_dynsar_sts_obs_win_t;
+
+/* structure holding dynsar per slice counters that interface to iovar */
+typedef struct dynsar_cnt_v1 {
+       uint16 ver;
+       uint16 len;     /* length of this structure */
+       uint8  num_ant; /* num_antennas */
+       uint8  win;     /* number of valid entries in the observe window */
+       uint8  slice;
+       uint8  pad;     /* num_antennas */
+       uint64 sync_ts; /* time of first mon period collection after last sync */
+       wlc_dynsar_sts_obs_win_t obs[DYNSAR_STS_OBS_WIN];
+       wlc_dynsar_sts_mon_ctr_t mon_ctr[DYNSAR_STS_OBS_WIN][DYNSAR_MAX_ANT];
+} dynsar_cnt_v1_t;
+
+typedef struct dynsar_shared_ant_stats {
+       uint32 tx_dur;          /* tx duration */
+       uint8  sar_util;        /* sar utilization */
+       uint8  pad[3];          /* pad */
+} dynsar_shared_ant_stats_t;
+
+typedef struct dynsar_unshared_ant_stats {
+       uint32 qsar;    /* mw * ms */
+       uint32 energy;  /* mw * ms */
+       uint32 tx_dur;  /* tx duration */
+} dynsar_unshared_ant_stats_t;
+
+typedef struct dynsar_sum_v1 {
+       uint16 ver;
+       uint16 len;      /* length of this structure */
+       uint32 dur;      /* duration in us */
+       uint64 ts;       /* time stamp of report in us */
+       uint64 sync_ts;  /* time of first mon period collection after last sync */
+       uint8  slice;
+       uint8  num_ant;
+       uint8  opt;
+       uint8  sync;
+       /* per antenna counters aggregated if shared between radios */
+       struct {
+               uint32 tx_dur;  /* tx duration */
+               uint8 sar_util; /* sar utilization */
+               uint8 PAD[3];   /* pad */
+       } shared[DYNSAR_MAX_ANT];
+
+       /* per antenna counters not aggregated between radios */
+       struct {
+               uint32 qsar;    /* mw * ms */
+               uint32 energy;  /* mw * ms */
+       } unshared[DYNSAR_MAX_ANT];
+} dynsar_sum_v1_t;
+
+typedef struct dynsar_sum_v2 {
+       uint16 ver;
+       uint16 len;      /* length of this structure */
+       uint32 dur;      /* duration in us */
+       uint64 ts;       /* time stamp of report in us */
+       uint64 sync_ts;  /* time of first mon period collection after last sync */
+       uint8  num_ant; /* max number of antennas between 2 slices */
+       uint8  opt;
+       uint8  sync;
+       uint8  max_mac; /* number of slices */
+       uint8  num_agg; /* number of aggregated antennas */
+       uint8  offset_shared; /* offset from beginning of structure to shared antenna data */
+       uint8  offset_unshared; /* offset from beginning of structure to unshared antenna data */
+       uint8  pad;
+       /* Variable length data sections follow as per above offsets:
+       * dynsar_unshared_ant_stats_t [max_mac][num_ant]
+       * dynsar_shared_ant_stats_t [num_agg]
+       */
+} dynsar_sum_v2_t;
+
+typedef struct dynsar_status {
+       uint16 ver;
+       uint16 len;             /* length of this structure */
+       uint8  slice;           /* slice number */
+       uint8  mode;            /* optimization mode */
+       uint8  util_thrhd;      /* utilization threshold */
+       uint8  opt_txdc;        /* txdc prediction percentage */
+       uint8  opt_dur;         /* optimization prediction duration */
+       uint8  event;           /* if wl event is configured */
+       uint8  time_sync;       /* if gpio pulse is configured */
+       uint8  power_off;       /* power offset in db */
+       uint8  num_ant;         /* num antenna */
+       uint8  status;          /* status bitmap. e.g. WL_DYNSAR_STS_PWR_OPT.
+                               * These are same as status field in wl_event
+                               */
+       uint8  error;           /* error bits */
+       uint8  gpio_pin;        /* gpio pin */
+       /* aggregation index array of num_ant entries */
+       uint8  agg[];           /* aggregation indices */
+} dynsar_status_t;
+
+typedef struct wl_dynsar_ioc {
+       uint16 id;      /* ID of the sub-command */
+       uint16 len;     /* total length of all data[] */
+       union { /* var len payload */
+               uint8 cnt;
+               dynsar_cnt_v1_t det;
+               dynsar_sum_v1_t sum;
+               dynsar_sum_v2_t sumv2;
+               dynsar_status_t status;
+       } data;
+} wl_dynsar_ioc_t;
+
+typedef struct wlc_dynsar_status {
+       uint16 ver;
+       uint16 len;      /* length of this structure */
+} wl_dynsar_status_t;
+
+/* ##### Ecounters section ##### */
+#define ECOUNTERS_VERSION_1    1
+
+/* Input structure for ecounters IOVAR */
+typedef struct ecounters_config_request {
+       uint16 version;         /* config version */
+       uint16 set;             /* Set where data will go. */
+       uint16 size;            /* Size of the set. */
+       uint16 timeout;         /* timeout in seconds. */
+       uint16 num_events;      /* Number of events to report. */
+       uint16 ntypes;          /* Number of entries in type array. */
+       uint16 type[1];         /* Statistics Types (tags) to retrieve. */
+} ecounters_config_request_t;
+
+#define ECOUNTERS_EVENTMSGS_VERSION_1          1
+#define ECOUNTERS_TRIGGER_CONFIG_VERSION_1     1
+
+#define ECOUNTERS_EVENTMSGS_EXT_MASK_OFFSET    \
+               OFFSETOF(ecounters_eventmsgs_ext_t, mask[0])
+
+#define ECOUNTERS_TRIG_CONFIG_TYPE_OFFSET      \
+               OFFSETOF(ecounters_trigger_config_t, type[0])
+
+typedef struct ecounters_eventmsgs_ext {
+       uint8 version;
+       uint8 len;
+       uint8 mask[1];
+} ecounters_eventmsgs_ext_t;
+
+typedef struct ecounters_trigger_config {
+       uint16 version;         /* version */
+       uint16 set;             /* set where data should go */
+       uint16 rsvd;            /* reserved */
+       uint16 pad;             /* pad/reserved */
+       uint16 ntypes;          /* number of types/tags */
+       uint16 type[1];         /* list of types */
+} ecounters_trigger_config_t;
+
+#define ECOUNTERS_TRIGGER_REASON_VERSION_1     1
+typedef enum {
+       /* Triggered due to timer based ecounters */
+       ECOUNTERS_TRIGGER_REASON_TIMER = 0,
+       /* Triggered due to event based configuration */
+       ECOUNTERS_TRIGGER_REASON_EVENTS = 1,
+       ECOUNTERS_TRIGGER_REASON_D2H_EVENTS = 2,
+       ECOUNTERS_TRIGGER_REASON_H2D_EVENTS = 3,
+       ECOUNTERS_TRIGGER_REASON_USER_EVENTS = 4,
+       ECOUNTERS_TRIGGER_REASON_MAX = 5
+} ecounters_trigger_reasons_list_t;
+
+typedef struct ecounters_trigger_reason {
+       uint16 version;                 /* version */
+       uint16 trigger_reason;          /* trigger reason */
+       uint32 sub_reason_code;         /* sub reason code */
+       uint32 trigger_time_now;        /* time in ms  at trigger */
+       uint32 host_ref_time;           /* host ref time */
+} ecounters_trigger_reason_t;
+
+#define WL_LQM_VERSION_1 1
+
+/* For wl_lqm_t flags field */
+#define WL_LQM_CURRENT_BSS_VALID 0x1
+#define WL_LQM_TARGET_BSS_VALID 0x2
+
+#define WL_PERIODIC_COMPACT_CNTRS_VER_1 (1)
+#define WL_PERIODIC_TXBF_CNTRS_VER_1 (1)
+typedef struct {
+       uint16 version;
+       uint16 pad;
+       /* taken from wl_wlc_cnt_t */
+       uint32 txfail;
+       /* taken from wl_cnt_ge40mcst_v1_t */
+       uint32  txallfrm;       /**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+                                * Control Management (includes retransmissions)
+                                */
+       uint32  txrtsfrm;       /**< number of RTS sent out by the MAC */
+       uint32  txctsfrm;       /**< number of CTS sent out by the MAC */
+       uint32  txback;         /**< blockack txcnt */
+       uint32  txucast;        /**< number of unicast tx expecting response other than cts/cwcts */
+       uint32  txnoack;        /**< dot11ACKFailureCount */
+       uint32  txframe;        /**< tx data frames */
+       uint32  txretrans;      /**< tx mac retransmits */
+       uint32  txpspoll;       /**< Number of TX PS-poll */
+
+       uint32  rxrsptmout;     /**< number of response timeouts for transmitted frames
+                                * expecting a response
+                                */
+       uint32  txrtsfail;      /**< number of rts transmission failure that reach retry limit */
+       uint32  rxstrt;         /**< number of received frames with a good PLCP */
+       uint32  rxbadplcp;      /**< number of parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  rxnodelim;      /**< number of no valid delimiter detected by ampdu parser */
+       uint32  bphy_badplcp;   /**< number of bad PLCP reception on BPHY rate */
+       uint32  bphy_rxcrsglitch;       /**< PHY count of bphy glitches */
+       uint32  rxbadfcs;       /**< number of frames for which the CRC check failed in the MAC */
+       uint32  rxf0ovfl;       /**< number of receive fifo 0 overflows */
+       uint32  rxf1ovfl;       /**< number of receive fifo 0 overflows */
+       uint32  rxhlovfl;       /**< number of length / header fifo overflows */
+       uint32  rxrtsucast;     /**< number of unicast RTS addressed to the MAC (good FCS) */
+       uint32  rxctsucast;     /**< number of unicast CTS addressed to the MAC (good FCS) */
+       uint32  rxackucast;     /**< number of ucast ACKS received (good FCS) */
+       uint32  rxback;         /**< blockack rxcnt */
+       uint32  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint32  rxdtucastmbss;  /**< number of received DATA frames with good FCS and matching RA */
+       uint32  rxbeaconobss;   /**< beacons received from other BSS */
+       uint32  rxdtucastobss;  /**< number of unicast frames addressed to the MAC from
+                               * other BSS (WDS FRAME)
+                               */
+       uint32  rxdtocast;      /**< number of received DATA frames (good FCS and no matching RA) */
+       uint32  rxrtsocast;     /**< number of received RTS not addressed to the MAC */
+       uint32  rxctsocast;     /**< number of received CTS not addressed to the MAC */
+       uint32  rxdtmcast;      /**< number of RX Data multicast frames received by the MAC */
+       uint32  rxmpdu_mu;      /**< Number of MU MPDUs received */
+       uint32  rxtoolate;      /**< receive too late */
+       uint32  rxframe;        /**< rx data frames */
+       uint32  lqcm_report;    /**<  lqcm metric tx/rx idx */
+       uint32  tx_toss_cnt;    /* number of tx packets tossed */
+       uint32  rx_toss_cnt;    /* number of rx packets tossed  */
+       uint32  last_tx_toss_rsn; /* reason because of which last tx pkt tossed */
+       uint32  last_rx_toss_rsn; /* reason because of which last rx pkt tossed */
+       uint32  txbcnfrm;       /**< beacons transmitted */
+} wl_periodic_compact_cntrs_v1_t;
+
+#define WL_PERIODIC_COMPACT_CNTRS_VER_2 (2)
+typedef struct {
+       uint16 version;
+       uint16 pad;
+       /* taken from wl_wlc_cnt_t */
+       uint32 txfail;
+       /* taken from wl_cnt_ge40mcst_v1_t */
+       uint32  txallfrm;       /**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+                                * Control Management (includes retransmissions)
+                                */
+       uint32  txrtsfrm;       /**< number of RTS sent out by the MAC */
+       uint32  txctsfrm;       /**< number of CTS sent out by the MAC */
+       uint32  txback;         /**< blockack txcnt */
+       uint32  txucast;        /**< number of unicast tx expecting response other than cts/cwcts */
+       uint32  txnoack;        /**< dot11ACKFailureCount */
+       uint32  txframe;        /**< tx data frames */
+       uint32  txretrans;      /**< tx mac retransmits */
+       uint32  txpspoll;       /**< Number of TX PS-poll */
+
+       uint32  rxrsptmout;     /**< number of response timeouts for transmitted frames
+                                * expecting a response
+                                */
+       uint32  txrtsfail;      /**< number of rts transmission failure that reach retry limit */
+       uint32  rxstrt;         /**< number of received frames with a good PLCP */
+       uint32  rxbadplcp;      /**< number of parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  rxnodelim;      /**< number of no valid delimiter detected by ampdu parser */
+       uint32  bphy_badplcp;   /**< number of bad PLCP reception on BPHY rate */
+       uint32  bphy_rxcrsglitch;       /**< PHY count of bphy glitches */
+       uint32  rxbadfcs;       /**< number of frames for which the CRC check failed in the MAC */
+       uint32  rxf0ovfl;       /**< number of receive fifo 0 overflows */
+       uint32  rxf1ovfl;       /**< number of receive fifo 0 overflows */
+       uint32  rxhlovfl;       /**< number of length / header fifo overflows */
+       uint32  rxrtsucast;     /**< number of unicast RTS addressed to the MAC (good FCS) */
+       uint32  rxctsucast;     /**< number of unicast CTS addressed to the MAC (good FCS) */
+       uint32  rxackucast;     /**< number of ucast ACKS received (good FCS) */
+       uint32  rxback;         /**< blockack rxcnt */
+       uint32  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint32  rxdtucastmbss;  /**< number of received DATA frames with good FCS and matching RA */
+       uint32  rxbeaconobss;   /**< beacons received from other BSS */
+       uint32  rxdtucastobss;  /**< number of unicast frames addressed to the MAC from
+                               * other BSS (WDS FRAME)
+                               */
+       uint32  rxdtocast;      /**< number of received DATA frames (good FCS and no matching RA) */
+       uint32  rxrtsocast;     /**< number of received RTS not addressed to the MAC */
+       uint32  rxctsocast;     /**< number of received CTS not addressed to the MAC */
+       uint32  rxdtmcast;      /**< number of RX Data multicast frames received by the MAC */
+       uint32  rxmpdu_mu;      /**< Number of MU MPDUs received */
+       uint32  rxtoolate;      /**< receive too late */
+       uint32  rxframe;        /**< rx data frames */
+       uint32  lqcm_report;    /**<  lqcm metric tx/rx idx */
+       uint32  tx_toss_cnt;    /* number of tx packets tossed */
+       uint32  rx_toss_cnt;    /* number of rx packets tossed  */
+       uint32  last_tx_toss_rsn; /* reason because of which last tx pkt tossed */
+       uint32  last_rx_toss_rsn; /* reason because of which last rx pkt tossed */
+       uint32  txbcnfrm;       /**< beacons transmitted */
+       uint32  rxretry;        /* Number of rx packets received after retry */
+       uint32  rxdup;          /* Number of dump packet. Indicates whether peer is receiving ack */
+       uint32  chswitch_cnt;   /* Number of channel switches */
+       uint32 pm_dur;          /* Total sleep time in PM, msecs */
+} wl_periodic_compact_cntrs_v2_t;
+
+#define WL_PERIODIC_COMPACT_CNTRS_VER_3 (3)
+typedef struct {
+       uint16 version;
+       uint16 pad;
+       /* taken from wl_wlc_cnt_t */
+       uint32 txfail;
+       /* taken from wl_cnt_ge40mcst_v1_t */
+       uint32  txallfrm;       /**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+                                * Control Management (includes retransmissions)
+                                */
+       uint32  txrtsfrm;       /**< number of RTS sent out by the MAC */
+       uint32  txctsfrm;       /**< number of CTS sent out by the MAC */
+       uint32  txback;         /**< blockack txcnt */
+       uint32  txucast;        /**< number of unicast tx expecting response other than cts/cwcts */
+       uint32  txnoack;        /**< dot11ACKFailureCount */
+       uint32  txframe;        /**< tx data frames */
+       uint32  txretrans;      /**< tx mac retransmits */
+       uint32  txpspoll;       /**< Number of TX PS-poll */
+
+       uint32  rxrsptmout;     /**< number of response timeouts for transmitted frames
+                                * expecting a response
+                                */
+       uint32  txrtsfail;      /**< number of rts transmission failure that reach retry limit */
+       uint32  rxstrt;         /**< number of received frames with a good PLCP */
+       uint32  rxbadplcp;      /**< number of parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  rxnodelim;      /**< number of no valid delimiter detected by ampdu parser */
+       uint32  bphy_badplcp;   /**< number of bad PLCP reception on BPHY rate */
+       uint32  bphy_rxcrsglitch;       /**< PHY count of bphy glitches */
+       uint32  rxbadfcs;       /**< number of frames for which the CRC check failed in the MAC */
+       uint32  rxf0ovfl;       /**< number of receive fifo 0 overflows */
+       uint32  rxf1ovfl;       /**< number of receive fifo 0 overflows */
+       uint32  rxhlovfl;       /**< number of length / header fifo overflows */
+       uint32  rxrtsucast;     /**< number of unicast RTS addressed to the MAC (good FCS) */
+       uint32  rxctsucast;     /**< number of unicast CTS addressed to the MAC (good FCS) */
+       uint32  rxackucast;     /**< number of ucast ACKS received (good FCS) */
+       uint32  rxback;         /**< blockack rxcnt */
+       uint32  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint32  rxdtucastmbss;  /**< number of received DATA frames with good FCS and matching RA */
+       uint32  rxbeaconobss;   /**< beacons received from other BSS */
+       uint32  rxdtucastobss;  /**< number of unicast frames addressed to the MAC from
+                               * other BSS (WDS FRAME)
+                               */
+       uint32  rxdtocast;      /**< number of received DATA frames (good FCS and no matching RA) */
+       uint32  rxrtsocast;     /**< number of received RTS not addressed to the MAC */
+       uint32  rxctsocast;     /**< number of received CTS not addressed to the MAC */
+       uint32  rxdtmcast;      /**< number of RX Data multicast frames received by the MAC */
+       uint32  rxmpdu_mu;      /**< Number of MU MPDUs received */
+       uint32  rxtoolate;      /**< receive too late */
+       uint32  rxframe;        /**< rx data frames */
+       uint32  lqcm_report;    /**<  lqcm metric tx/rx idx */
+       uint32  tx_toss_cnt;    /* number of tx packets tossed */
+       uint32  rx_toss_cnt;    /* number of rx packets tossed  */
+       uint32  last_tx_toss_rsn; /* reason because of which last tx pkt tossed */
+       uint32  last_rx_toss_rsn; /* reason because of which last rx pkt tossed */
+       uint32  txbcnfrm;       /**< beacons transmitted */
+       uint32  rxretry;        /* Number of rx packets received after retry */
+       uint32  rxdup;          /* Number of dump packet. Indicates whether peer is receiving ack */
+       uint32  chswitch_cnt;   /* Number of channel switches */
+       uint32 pm_dur;          /* Total sleep time in PM, msecs */
+       uint32 rxholes;         /* Count of missed packets from peer */
+} wl_periodic_compact_cntrs_v3_t;
+
+#define WL_PERIODIC_COMPACT_HE_CNTRS_VER_1 (1)
+typedef struct {
+       uint16 version;
+       uint16 len;
+       uint32 he_rxtrig_rand;
+       uint32 he_colormiss_cnt;
+       uint32 he_txmtid_back;
+       uint32 he_rxmtid_back;
+       uint32 he_rxmsta_back;
+       uint32 he_rxtrig_basic;
+       uint32 he_rxtrig_murts;
+       uint32 he_rxtrig_bsrp;
+       uint32 he_rxdlmu;
+       uint32 he_physu_rx;
+       uint32 he_txtbppdu;
+} wl_compact_he_cnt_wlc_v1_t;
+
+#define WL_PERIODIC_COMPACT_HE_CNTRS_VER_2 (2)
+typedef struct {
+       uint16 version;
+       uint16 len;
+       uint32 he_rxtrig_myaid;
+       uint32 he_rxtrig_rand;
+       uint32 he_colormiss_cnt;
+       uint32 he_txmampdu;
+       uint32 he_txmtid_back;
+       uint32 he_rxmtid_back;
+       uint32 he_rxmsta_back;
+       uint32 he_txfrag;
+       uint32 he_rxdefrag;
+       uint32 he_txtrig;
+       uint32 he_rxtrig_basic;
+       uint32 he_rxtrig_murts;
+       uint32 he_rxtrig_bsrp;
+       uint32 he_rxhemuppdu_cnt;
+       uint32 he_physu_rx;
+       uint32 he_phyru_rx;
+       uint32 he_txtbppdu;
+       uint32 he_null_tbppdu;
+       uint32 he_rxhesuppdu_cnt;
+       uint32 he_rxhesureppdu_cnt;
+       uint32 he_null_zero_agg;
+       uint32 he_null_bsrp_rsp;
+       uint32 he_null_fifo_empty;
+} wl_compact_he_cnt_wlc_v2_t;
+
+/* for future versions of this data structure, can consider wl_txbf_ecounters_t
+ * which contains the full list of txbf dump counters
+ */
+typedef struct {
+       uint16  version;
+       uint16  coreup;
+       uint32  txndpa;
+       uint32  txndp;
+       uint32  rxsf;
+       uint32  txbfm;
+       uint32  rxndpa_u;
+       uint32  rxndpa_m;
+       uint32  bferpt;
+       uint32  rxbfpoll;
+       uint32  txsf;
+} wl_periodic_txbf_cntrs_v1_t;
+
+typedef struct {
+       struct ether_addr BSSID;
+       chanspec_t chanspec;
+       int32 rssi;
+       int32 snr;
+} wl_rx_signal_metric_t;
+
+typedef struct {
+       uint8 version;
+       uint8 flags;
+       uint16 pad;
+       int32 noise_level; /* current noise level */
+       wl_rx_signal_metric_t current_bss;
+       wl_rx_signal_metric_t target_bss;
+} wl_lqm_t;
+
+#define WL_PERIODIC_IF_STATE_VER_1 (1)
+typedef struct wl_if_state_compact {
+       uint8 version;
+       uint8 assoc_state;
+       uint8 antenna_count;            /**< number of valid antenna rssi */
+       int8 noise_level;               /**< noise right after tx (in dBm) */
+       int8 snr;                       /* current noise level */
+       int8 rssi_sum;                  /**< summed rssi across all antennas */
+       uint16 pad16;
+       int8 rssi_ant[WL_RSSI_ANT_MAX]; /**< rssi per antenna */
+       struct ether_addr BSSID;
+       chanspec_t chanspec;
+} wl_if_state_compact_t;
+
+#define WL_EVENT_STATISTICS_VER_1 (1)
+/* Event based statistics ecounters */
+typedef struct {
+       uint16 version;
+       uint16 pad;
+       struct ether_addr   BSSID;                      /* BSSID of the BSS */
+       uint32 txdeauthivalclass;
+} wl_event_based_statistics_v1_t;
+
+#define WL_EVENT_STATISTICS_VER_2 (2)
+/* Event based statistics ecounters */
+typedef struct {
+       uint16 version;
+       uint16 pad;
+       struct ether_addr   BSSID;              /* BSSID of the BSS */
+       uint32 txdeauthivalclass;
+       /* addition for v2 */
+       int32 timestamp;                        /* last deauth time */
+       struct ether_addr last_deauth;          /* wrong deauth MAC */
+       uint16 misdeauth;                       /* wrong deauth count every 1sec */
+       int16 cur_rssi;                         /* current bss rssi */
+       int16 deauth_rssi;                      /* deauth pkt rssi */
+} wl_event_based_statistics_v2_t;
+
+#define WL_EVENT_STATISTICS_VER_3 (3)
+/* Event based statistics ecounters */
+typedef struct {
+       uint16 version;
+       uint16 pad;
+       struct ether_addr   BSSID;                      /* BSSID of the BSS */
+       uint16 PAD;
+       uint32 txdeauthivalclass;
+       /* addition for v2 */
+       int32 timestamp;                        /* last deauth time */
+       struct ether_addr last_deauth;          /* wrong deauth MAC */
+       uint16 misdeauth;                       /* wrong deauth count every 1sec */
+       int16 cur_rssi;                         /* current bss rssi */
+       int16 deauth_rssi;                      /* deauth pkt rssi */
+       /* addition for v3 (roam statistics) */
+       uint32 initial_assoc_time;
+       uint32 prev_roam_time;
+       uint32 last_roam_event_type;
+       uint32 last_roam_event_status;
+       uint32 last_roam_event_reason;
+       uint16 roam_success_cnt;
+       uint16 roam_fail_cnt;
+       uint16 roam_attempt_cnt;
+       uint16 max_roam_target_cnt;
+       uint16 min_roam_target_cnt;
+       uint16 max_cached_ch_cnt;
+       uint16 min_cached_ch_cnt;
+       uint16 partial_roam_scan_cnt;
+       uint16 full_roam_scan_cnt;
+       uint16 most_roam_reason;
+       uint16 most_roam_reason_cnt;
+} wl_event_based_statistics_v3_t;
+
+#define WL_EVENT_STATISTICS_VER_4 (4u)
+/* Event based statistics ecounters */
+typedef struct {
+       uint16 version;
+       uint16 pad;
+       struct ether_addr   BSSID;                      /* BSSID of the BSS */
+       uint16 PAD;
+       uint32 txdeauthivalclass;
+       /* addition for v2 */
+       int32 timestamp;                        /* last deauth time */
+       struct ether_addr last_deauth;          /* wrong deauth MAC */
+       uint16 misdeauth;                       /* wrong deauth count every 1sec */
+       int16 cur_rssi;                         /* current bss rssi */
+       int16 deauth_rssi;                      /* deauth pkt rssi */
+} wl_event_based_statistics_v4_t;
+
+/* ##### SC/ Sc offload/ WBUS related ecounters */
+
+#define WL_SC_PERIODIC_COMPACT_CNTRS_VER_1 (1)
+typedef struct {
+       uint16  version;
+       uint16  pad;
+       uint32  rxstrt;         /**< number of received frames with a good PLCP */
+       uint32  rxbadplcp;      /**< number of parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  rxnodelim;      /**< number of no valid delimiter detected by ampdu parser */
+       uint32  bphy_badplcp;   /**< number of bad PLCP reception on BPHY rate */
+       uint32  bphy_rxcrsglitch;       /**< PHY count of bphy glitches */
+       uint32  rxbadfcs;       /**< number of frames for which the CRC check failed in the MAC */
+       uint16  rxrtsucast;     /**< number of unicast RTS addressed to the MAC (good FCS) */
+       uint16  rxf0ovfl;       /**< number of receive fifo 0 overflows */
+       uint16  rxf1ovfl;       /**< number of receive fifo 0 overflows */
+       uint16  rxhlovfl;       /**< number of length / header fifo overflows */
+       uint16  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint16  rxdtucastmbss;  /**< number of received DATA frames with good FCS and matching RA */
+       uint16  rxbeaconobss;   /**< beacons received from other BSS */
+       uint16  rxdtmcast;      /**< number of RX Data multicast frames received by the MAC */
+       uint16  rxtoolate;      /**< receive too late */
+       uint16  chswitch_cnt;   /* Number of channel switches */
+       uint32  pm_dur;         /* Total sleep time in PM, msecs */
+       uint16  hibernate_cnt;  /* Number of times sc went to hibernate */
+       uint16  awake_cnt;      /* Number of times sc awake is called */
+       uint16  sc_up_cnt;      /* Number of times sc up/down happened */
+       uint16  sc_down_cnt;    /* Number of times sc down happened */
+} wl_sc_periodic_compact_cntrs_v1_t;
+
+#define WL_WBUS_PERIODIC_CNTRS_VER_1 (1)
+typedef struct {
+       uint16 version;
+       uint16 pad;
+       uint16 num_register;            /* Number of registrations */
+       uint16 num_deregister;          /* Number of deregistrations */
+       uint8 num_pending;              /* Number of pending non-bt */
+       uint8 num_active;               /* Number of active non-bt */
+       uint8 num_bt;                   /* Number of bt users */
+       uint8 pad1;
+       uint16 num_rej;                 /* Number of reject */
+       uint16 num_rej_bt;              /* Number of rejects for bt */
+       uint16 num_accept_attempt;      /* Numbber of accept attempt */
+       uint16 num_accept_ok;           /* Number of accept ok */
+} wl_wbus_periodic_cntrs_v1_t;
+
+#define WL_STA_OFLD_CNTRS_VER_1 (1)
+typedef struct {
+       uint16  version;
+       uint16  pad;
+
+       uint16  sc_ofld_enter_cnt;
+       uint16  sc_ofld_exit_cnt;
+       uint16  sc_ofld_wbus_reject_cnt;
+       uint16  sc_ofld_wbus_cb_fail_cnt;
+       uint16  sc_ofld_missed_bcn_cnt;
+       uint8   sc_ofld_last_exit_reason;
+       uint8   sc_ofld_last_enter_fail_reason;
+} wl_sta_ofld_cntrs_v1_t;
+
+/* ##### Ecounters v2 section ##### */
+
+#define ECOUNTERS_VERSION_2    2
+
+/* Enumeration of various ecounters request types. This namespace is different from
+ * global reportable stats namespace.
+*/
+enum {
+       WL_ECOUNTERS_XTLV_REPORT_REQ = 1
+};
+
+/* Input structure for ecounters IOVAR */
+typedef struct ecounters_config_request_v2 {
+       uint16 version;         /* config version */
+       uint16 len;             /* Length of this struct including variable len */
+       uint16 logset;          /* Set where data will go. */
+       uint16 reporting_period;        /* reporting_period */
+       uint16 num_reports;     /* Number of timer expirations to report on */
+       uint8 pad[2];           /* Reserved for future use */
+       uint8 ecounters_xtlvs[];        /* Statistics Types (tags) to retrieve. */
+} ecounters_config_request_v2_t;
+
+#define ECOUNTERS_STATS_TYPES_FLAG_SLICE       0x1
+#define ECOUNTERS_STATS_TYPES_FLAG_IFACE       0x2
+#define ECOUNTERS_STATS_TYPES_FLAG_GLOBAL      0x4
+#define ECOUNTERS_STATS_TYPES_DEFAULT          0x8
+
+/* Slice mask bits */
+#define ECOUNTERS_STATS_TYPES_SLICE_MASK_SLICE0                0x1u
+#define ECOUNTERS_STATS_TYPES_SLICE_MASK_SLICE1                0x2u
+#define ECOUNTERS_STATS_TYPES_SLICE_MASK_SLICE_SC      0x4u
+
+typedef struct ecounters_stats_types_report_req {
+       /* flags: bit0 = slice, bit1 = iface, bit2 = global,
+        * rest reserved
+        */
+       uint16 flags;
+       uint16 if_index;        /* host interface index */
+       uint16 slice_mask;      /* bit0 = slice0, bit1=slice1, rest reserved */
+       uint8 pad[2];   /* padding */
+       uint8 stats_types_req[]; /* XTLVs of requested types */
+} ecounters_stats_types_report_req_t;
+
+/* ##### Ecounters_Eventmsgs v2 section ##### */
+
+#define ECOUNTERS_EVENTMSGS_VERSION_2          2
+
+typedef struct event_ecounters_config_request_v2 {
+       uint16 version; /* config version */
+       uint16 len;     /* Length of this struct including variable len */
+       uint16 logset;  /* Set where data will go. */
+       uint16 event_id;        /* Event id for which this config is meant for */
+       uint8 flags;    /* Config flags */
+       uint8 pad[3];   /* Reserved for future use */
+       uint8 ecounters_xtlvs[];        /* Statistics Types (tags) to retrieve. */
+} event_ecounters_config_request_v2_t;
+
+#define EVENT_ECOUNTERS_FLAGS_ADD      (1 << 0) /* Add configuration for the event_id if set */
+#define EVENT_ECOUNTERS_FLAGS_DEL      (1 << 1) /* Delete configuration for event_id if set */
+#define EVENT_ECOUNTERS_FLAGS_ANYIF    (1 << 2) /* Interface filtering disable / off bit */
+#define EVENT_ECOUNTERS_FLAGS_BE       (1 << 3) /* If cleared report stats of
+                                                   * one event log buffer
+                                                   */
+#define EVENT_ECOUNTERS_FLAGS_DEL_ALL  (1 << 4) /* Delete all the configurations of
+                                                   * event ecounters if set
+                                                   */
+
+#define EVENT_ECOUNTERS_FLAGS_BUS      (1 << 5) /* Add configuration for the bus events */
+#define EVENT_ECOUNTERS_FLAGS_BUS_H2D  (1 << 6) /* Add configuration for the bus direction
+                                                 * 0 - D2H and 1 - H2D
+                                                 */
+
+#define EVENT_ECOUNTERS_FLAGS_DELAYED_FLUSH    (1 << 7) /* Flush only when half of the total size
+                                                  * of blocks gets filled. This is to avoid
+                                                  * many interrupts to host.
+                                                  */
+#define EVENT_ECOUNTERS_FLAGS_USER     (1 << 6) /* Add configuration for user defined events
+                                               * Reuse the same flag as H2D
+                                               */
+
+/* Ecounters suspend resume */
+#define ECOUNTERS_SUSPEND_VERSION_V1   1
+/* To be used in populating suspend_mask and suspend_bitmap */
+#define ECOUNTERS_SUSPEND_TIMER (1 << ECOUNTERS_TRIGGER_REASON_TIMER)
+#define ECOUNTERS_SUSPEND_EVENTS (1 << ECOUNTERS_TRIGGER_REASON_EVENTS)
+
+typedef struct ecounters_suspend {
+       uint16 version;
+       uint16 len;
+       uint32 suspend_bitmap; /* type of ecounter reporting to be suspended */
+       uint32 suspend_mask; /* type of ecounter reporting to be suspended */
+} ecounters_suspend_t;
+
+/* -------------- dynamic BTCOEX --------------- */
+#define DCTL_TROWS     2                       /**< currently practical number of rows  */
+#define DCTL_TROWS_MAX 4                       /**<  2 extra rows RFU */
+/* DYNCTL profile flags */
+#define DCTL_FLAGS_DISABLED    0               /**< default value: all features disabled */
+#define DCTL_FLAGS_DYNCTL      (1 << 0)        /**<  1 - enabled, 0 - legacy only */
+#define DCTL_FLAGS_DESENSE     (1 << 1)        /**< auto desense is enabled */
+#define DCTL_FLAGS_MSWITCH     (1 << 2)        /**< mode switching is enabled */
+#define DCTL_FLAGS_PWRCTRL     (1 << 3)        /**< Tx power control is enabled */
+/* for now AGG on/off is handled separately  */
+#define DCTL_FLAGS_TX_AGG_OFF  (1 << 4)        /**< TBD: allow TX agg Off */
+#define DCTL_FLAGS_RX_AGG_OFF  (1 << 5)        /**< TBD: allow RX agg Off */
+/* used for dry run testing only */
+#define DCTL_FLAGS_DRYRUN      (1 << 7)        /**< Enables dynctl dry run mode  */
+#define IS_DYNCTL_ON(prof)     ((prof->flags & DCTL_FLAGS_DYNCTL) != 0)
+#define IS_DESENSE_ON(prof)    ((prof->flags & DCTL_FLAGS_DESENSE) != 0)
+#define IS_MSWITCH_ON(prof)    ((prof->flags & DCTL_FLAGS_MSWITCH) != 0)
+#define IS_PWRCTRL_ON(prof)    ((prof->flags & DCTL_FLAGS_PWRCTRL) != 0)
+/* desense level currently in use */
+#define DESENSE_OFF    0
+#define DFLT_DESENSE_MID       12
+#define DFLT_DESENSE_HIGH      2
+
+/**
+ * dynctl data points(a set of btpwr & wlrssi thresholds)
+ * for mode & desense switching
+ */
+typedef struct btc_thr_data {
+       int8    mode;   /**< used by desense sw */
+       int8    bt_pwr; /**< BT tx power threshold */
+       int8    bt_rssi;        /**< BT rssi threshold */
+       /* wl rssi range when mode or desense change may be needed */
+       int8    wl_rssi_high;
+       int8    wl_rssi_low;
+} btc_thr_data_t;
+
+/* dynctl. profile data structure  */
+#define DCTL_PROFILE_VER 0x01
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct  dctl_prof {
+       uint8 version;  /**< dynctl profile version */
+       /* dynctl profile flags bit:0 - dynctl On, bit:1 dsns On, bit:2 mode sw On, */
+       uint8 flags;  /**< bit[6:3] reserved, bit7 - Dryrun (sim) - On */
+       /**  wl desense levels to apply */
+       uint8   dflt_dsns_level;
+       uint8   low_dsns_level;
+       uint8   mid_dsns_level;
+       uint8   high_dsns_level;
+       /** mode switching hysteresis in dBm */
+       int8    msw_btrssi_hyster;
+       /** default btcoex mode */
+       uint8   default_btc_mode;
+       /** num of active rows in mode switching table */
+       uint8   msw_rows;
+       /** num of rows in desense table */
+       uint8   dsns_rows;
+       /** dynctl mode switching data table  */
+       btc_thr_data_t msw_data[DCTL_TROWS_MAX];
+       /** dynctl desense switching data table */
+       btc_thr_data_t dsns_data[DCTL_TROWS_MAX];
+} BWL_POST_PACKED_STRUCT dctl_prof_t;
+#include <packed_section_end.h>
+
+/**  dynctl status info */
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct  dynctl_status {
+       uint8 sim_on;   /**< true if simulation is On */
+       uint16  bt_pwr_shm; /**< BT per/task power as read from ucode  */
+       int8    bt_pwr;         /**< BT pwr extracted & converted to dBm */
+       int8    bt_rssi;        /**< BT rssi in dBm */
+       int8    wl_rssi;        /**< last wl rssi reading used by btcoex */
+       uint8   dsns_level; /**< current desense level */
+       uint8   btc_mode;   /**< current btcoex mode */
+       /* add more status items if needed,  pad to 4 BB if needed */
+} BWL_POST_PACKED_STRUCT dynctl_status_t;
+#include <packed_section_end.h>
+
+/**  dynctl simulation (dryrun data) */
+#include <packed_section_start.h>
+typedef BWL_PRE_PACKED_STRUCT struct  dynctl_sim {
+       uint8 sim_on;   /**< simulation mode on/off */
+       int8 btpwr;             /**< simulated BT power in dBm */
+       int8 btrssi;    /**< simulated BT rssi in dBm */
+       int8 wlrssi;    /**< simulated WL rssi in dBm */
+} BWL_POST_PACKED_STRUCT dynctl_sim_t;
+/* no default structure packing */
+#include <packed_section_end.h>
+
+/** PTK key maintained per SCB */
+#define RSN_TEMP_ENCR_KEY_LEN 16
+typedef struct wpa_ptk {
+       uint8 kck[RSN_KCK_LENGTH]; /**< EAPOL-Key Key Confirmation Key (KCK) */
+       uint8 kek[RSN_KEK_LENGTH]; /**< EAPOL-Key Key Encryption Key (KEK) */
+       uint8 tk1[RSN_TEMP_ENCR_KEY_LEN]; /**< Temporal Key 1 (TK1) */
+       uint8 tk2[RSN_TEMP_ENCR_KEY_LEN]; /**< Temporal Key 2 (TK2) */
+} wpa_ptk_t;
+
+/** GTK key maintained per SCB */
+typedef struct wpa_gtk {
+       uint32 idx;
+       uint32 key_len;
+       uint8  key[DOT11_MAX_KEY_SIZE];
+} wpa_gtk_t;
+
+/** FBT Auth Response Data structure */
+typedef struct wlc_fbt_auth_resp {
+       uint8 macaddr[ETHER_ADDR_LEN]; /**< station mac address */
+       uint8 pad[2];
+       uint8 pmk_r1_name[WPA2_PMKID_LEN];
+       wpa_ptk_t ptk; /**< pairwise key */
+       wpa_gtk_t gtk; /**< group key */
+       uint32 ie_len;
+       uint8 status;  /**< Status of parsing FBT authentication
+                                       Request in application
+                                       */
+       uint8 ies[1]; /**< IEs contains MDIE, RSNIE,
+                                       FBTIE (ANonce, SNonce,R0KH-ID, R1KH-ID)
+                                       */
+} wlc_fbt_auth_resp_t;
+
+/** FBT Action Response frame */
+typedef struct wlc_fbt_action_resp {
+       uint16 version; /**< structure version */
+       uint16 length; /**< length of structure */
+       uint8 macaddr[ETHER_ADDR_LEN]; /**< station mac address */
+       uint8 data_len;  /**< len of ie from Category */
+       uint8 data[1]; /**< data contains category, action, sta address, target ap,
+                                               status code,fbt response frame body
+                                               */
+} wlc_fbt_action_resp_t;
+
+#define MACDBG_PMAC_ADDR_INPUT_MAXNUM 16
+#define MACDBG_PMAC_OBJ_TYPE_LEN 8
+
+typedef struct _wl_macdbg_pmac_param_t {
+       char type[MACDBG_PMAC_OBJ_TYPE_LEN];
+       uint8 step;
+       uint8 w_en;
+       uint16 num;
+       uint32 bitmap;
+       uint8 addr_raw;
+       uint8 addr_num;
+       uint16 addr[MACDBG_PMAC_ADDR_INPUT_MAXNUM];
+       uint8 pad0[2];
+       uint32 w_val;
+} wl_macdbg_pmac_param_t;
+
+/** IOVAR 'svmp_sampcol' parameter. Used to set and read SVMP_SAMPLE_COLLECT's setting */
+typedef struct wl_svmp_sampcol_param {
+       uint32 version;           /* version */
+       uint8  enable;
+       uint8  trigger_mode;      /* SVMP_SAMPCOL_TRIGGER */
+       uint8  trigger_mode_s[2]; /* SVMP_SAMPCOL_PKTPROC */
+       uint8  data_samplerate;   /* SVMP_SAMPCOL_SAMPLERATE */
+       uint8  data_sel_phy1;     /* SVMP_SAMPCOL_PHY1MUX */
+       uint8  data_sel_rx1;      /* SVMP_SAMPCOL_RX1MUX without iqCompOut */
+       uint8  data_sel_dualcap;  /* SVMP_SAMPCOL_RX1MUX */
+       uint8  pack_mode;         /* SVMP_SAMPCOL_PACK */
+       uint8  pack_order;
+       uint8  pack_cfix_fmt;
+       uint8  pack_1core_sel;
+       uint16 waitcnt;
+       uint16 caplen;
+       uint32 buff_addr_start;   /* in word-size (2-bytes) */
+       uint32 buff_addr_end;     /* note: Tcl in byte-size, HW in vector-size (8-bytes) */
+       uint8  int2vasip;
+       uint8  PAD;
+       uint16 status;
+} wl_svmp_sampcol_t;
+
+#define WL_SVMP_SAMPCOL_PARAMS_VERSION 1
+
+enum {
+       SVMP_SAMPCOL_TRIGGER_PKTPROC_TRANSITION = 0,
+       SVMP_SAMPCOL_TRIGGER_FORCE_IMMEDIATE,
+       SVMP_SAMPCOL_TRIGGER_RADAR_DET
+};
+
+enum {
+       SVMP_SAMPCOL_PHY1MUX_GPIOOUT = 0,
+       SVMP_SAMPCOL_PHY1MUX_FFT,
+       SVMP_SAMPCOL_PHY1MUX_DBGHX,
+       SVMP_SAMPCOL_PHY1MUX_RX1MUX
+};
+
+enum {
+       SVMP_SAMPCOL_RX1MUX_FARROWOUT = 4,
+       SVMP_SAMPCOL_RX1MUX_IQCOMPOUT,
+       SVMP_SAMPCOL_RX1MUX_DCFILTEROUT,
+       SVMP_SAMPCOL_RX1MUX_RXFILTEROUT,
+       SVMP_SAMPCOL_RX1MUX_ACIFILTEROUT
+};
+
+enum {
+       SVMP_SAMPCOL_SAMPLERATE_1XBW = 0,
+       SVMP_SAMPCOL_SAMPLERATE_2XBW
+};
+
+enum {
+       SVMP_SAMPCOL_PACK_DUALCAP = 0,
+       SVMP_SAMPCOL_PACK_4CORE,
+       SVMP_SAMPCOL_PACK_2CORE,
+       SVMP_SAMPCOL_PACK_1CORE
+};
+
+enum {
+       SVMP_SAMPCOL_PKTPROC_RESET = 0,
+       SVMP_SAMPCOL_PKTPROC_CARRIER_SEARCH,
+       SVMP_SAMPCOL_PKTPROC_WAIT_FOR_NB_PWR,
+       SVMP_SAMPCOL_PKTPROC_WAIT_FOR_W1_PWR,
+       SVMP_SAMPCOL_PKTPROC_WAIT_FOR_W2_PWR,
+       SVMP_SAMPCOL_PKTPROC_OFDM_PHY,
+       SVMP_SAMPCOL_PKTPROC_TIMING_SEARCH,
+       SVMP_SAMPCOL_PKTPROC_CHAN_EST_1,
+       SVMP_SAMPCOL_PKTPROC_LEG_SIG_DEC,
+       SVMP_SAMPCOL_PKTPROC_SIG_DECODE_1,
+       SVMP_SAMPCOL_PKTPROC_SIG_DECODE_2,
+       SVMP_SAMPCOL_PKTPROC_HT_AGC,
+       SVMP_SAMPCOL_PKTPROC_CHAN_EST_2,
+       SVMP_SAMPCOL_PKTPROC_PAY_DECODE,
+       SVMP_SAMPCOL_PKTPROC_DSSS_CCK_PHY,
+       SVMP_SAMPCOL_PKTPROC_WAIT_ENERGY_DROP,
+       SVMP_SAMPCOL_PKTPROC_WAIT_NCLKS,
+       SVMP_SAMPCOL_PKTPROC_PAY_DEC_EXT,
+       SVMP_SAMPCOL_PKTPROC_SIG_FAIL_DELAY,
+       SVMP_SAMPCOL_PKTPROC_RIFS_SEARCH,
+       SVMP_SAMPCOL_PKTPROC_BOARD_SWITCH_DIV_SEARCH,
+       SVMP_SAMPCOL_PKTPROC_DSSS_CCK_BOARD_SWITCH_DIV_SEARCH,
+       SVMP_SAMPCOL_PKTPROC_CHAN_EST_3,
+       SVMP_SAMPCOL_PKTPROC_CHAN_EST_4,
+       SVMP_SAMPCOL_PKTPROC_FINE_TIMING_SEARCH,
+       SVMP_SAMPCOL_PKTPROC_SET_CLIP_GAIN,
+       SVMP_SAMPCOL_PKTPROC_NAP,
+       SVMP_SAMPCOL_PKTPROC_VHT_SIGA_DEC,
+       SVMP_SAMPCOL_PKTPROC_VHT_SIGB_DEC,
+       SVMP_SAMPCOL_PKTPROC_PKT_ABORT,
+       SVMP_SAMPCOL_PKTPROC_DCCAL
+};
+
+/** IOVAR 'svmp_mem' parameter. Used to read/clear svmp memory */
+typedef struct svmp_mem {
+       uint32 addr;    /**< offset to read svmp memory from vasip base address */
+       uint16 len;     /**< length in count of uint16's */
+       uint16 val;     /**< set the range of addr/len with a value */
+} svmp_mem_t;
+
+/** IOVAR 'mu_rate' parameter. read/set mu rate for upto four users */
+#define MU_RATE_CFG_VERSION    1
+typedef struct mu_rate {
+       uint16  version;        /**< version of the structure as defined by MU_RATE_CFG_VERSION */
+       uint16  length;         /**< length of entire structure */
+       uint8   auto_rate;      /**< enable/disable auto rate */
+       uint8   PAD;
+       uint16  rate_user[4];   /**< rate per each of four users, set to -1 for no change */
+} mu_rate_t;
+
+/** IOVAR 'mu_group' parameter. Used to set and read MU group recommendation setting */
+#define WL_MU_GROUP_AUTO_COMMAND      -1
+#define WL_MU_GROUP_PARAMS_VERSION     3
+#define WL_MU_GROUP_METHOD_NAMELEN    64
+#define WL_MU_GROUP_NGROUP_MAX        15
+#define WL_MU_GROUP_NUSER_MAX          4
+#define WL_MU_GROUP_METHOD_MIN         0
+#define WL_MU_GROUP_NUMBER_AUTO_MIN    1
+#define WL_MU_GROUP_NUMBER_AUTO_MAX   15
+#define WL_MU_GROUP_NUMBER_FORCED_MAX  8
+#define WL_MU_GROUP_METHOD_OLD         0
+#define WL_MU_GROUP_MODE_AUTO          0
+#define WL_MU_GROUP_MODE_FORCED        1
+#define WL_MU_GROUP_FORCED_1GROUP      1
+#define WL_MU_GROUP_ENTRY_EMPTY       -1
+typedef struct mu_group {
+       uint32 version;          /* version */
+       int16  forced;           /* forced group recommendation */
+       int16  forced_group_mcs; /* forced group with mcs */
+       int16  forced_group_num; /* forced group number */
+       int16  group_option[WL_MU_GROUP_NGROUP_MAX][WL_MU_GROUP_NUSER_MAX];
+                                /* set mode for forced grouping and read mode for auto grouping */
+       int16  group_GID[WL_MU_GROUP_NGROUP_MAX];
+       int16  group_method;     /* methof for VASIP group recommendation */
+       int16  group_number;     /* requested number for VASIP group recommendation */
+       int16  auto_group_num;   /* exact number from VASIP group recommendation */
+       int8   group_method_name[WL_MU_GROUP_METHOD_NAMELEN];
+       uint8  PAD[2];
+} mu_group_t;
+
+typedef struct mupkteng_sta {
+       struct ether_addr ea;
+       uint8  PAD[2];
+       int32 nrxchain;
+       int32 idx;
+} mupkteng_sta_t;
+
+typedef struct mupkteng_client {
+       int32 rspec;
+       int32 idx;
+       int32 flen;
+       int32 nframes;
+} mupkteng_client_t;
+
+typedef struct mupkteng_tx {
+       mupkteng_client_t client[8];
+       int32 nclients;
+       int32 ntx;
+} mupkteng_tx_t;
+
+/*
+ * MU Packet engine interface.
+ * The following two definitions will go into
+ * wlioctl_defs.h
+ * when wl utility changes are merged to EAGLE TOB & Trunk
+ */
+
+#define WL_MUPKTENG_PER_TX_START               0x10
+#define WL_MUPKTENG_PER_TX_STOP                        0x20
+
+/** IOVAR 'mu_policy' parameter. Used to configure MU admission control policies */
+#define WL_MU_POLICY_PARAMS_VERSION     1
+#define WL_MU_POLICY_SCHED_DEFAULT     60
+#define WL_MU_POLICY_DISABLED          0
+#define WL_MU_POLICY_ENABLED           1
+#define WL_MU_POLICY_NRX_MIN           1
+#define WL_MU_POLICY_NRX_MAX           2
+typedef struct mu_policy {
+       uint16 version;
+       uint16 length;
+       uint32 sched_timer;
+       uint32 pfmon;
+       uint32 pfmon_gpos;
+       uint32 samebw;
+       uint32 nrx;
+       uint32 max_muclients;
+} mu_policy_t;
+
+#define WL_NAN_BAND_STR_SIZE 5       /* sizeof ("auto") */
+
+/** Definitions of different NAN Bands */
+/* do not change the order */
+enum {
+               NAN_BAND_B = 0,
+               NAN_BAND_A,
+               NAN_BAND_AUTO,
+               NAN_BAND_INVALID = 0xFF
+};
+
+/* ifdef WL11ULB */
+/* ULB Mode configured via "ulb_mode" IOVAR */
+enum {
+       ULB_MODE_DISABLED = 0,
+       ULB_MODE_STD_ALONE_MODE = 1,    /* Standalone ULB Mode */
+       ULB_MODE_DYN_MODE = 2,      /* Dynamic ULB Mode */
+       /* Add all other enums before this */
+       MAX_SUPP_ULB_MODES
+};
+
+/* ULB BWs configured via "ulb_bw" IOVAR during Standalone Mode Only.
+ * Values of this enumeration are also used to specify 'Current Operational Bandwidth'
+ * and 'Primary Operational Bandwidth' sub-fields in 'ULB Operations' field (used in
+ * 'ULB Operations' Attribute or 'ULB Mode Switch' Attribute)
+ */
+typedef enum {
+       ULB_BW_DISABLED = 0,
+       ULB_BW_10MHZ    = 1,    /* Standalone ULB BW in 10 MHz BW */
+       ULB_BW_5MHZ = 2,    /* Standalone ULB BW in 5 MHz BW */
+       ULB_BW_2P5MHZ   = 3,    /* Standalone ULB BW in 2.5 MHz BW */
+       /* Add all other enums before this */
+       MAX_SUPP_ULB_BW
+} ulb_bw_type_t;
+/* endif WL11ULB */
+
+#define WL_MESH_IOCTL_VERSION     1
+#define MESH_IOC_BUFSZ            512 /* sufficient ioc buff size for mesh */
+
+/* container for mesh iovtls & events */
+typedef struct wl_mesh_ioc {
+       uint16  version;        /* interface command or event version */
+       uint16  id;             /* mesh ioctl cmd  ID  */
+       uint16  len;            /* total length of all tlv records in data[]  */
+       uint16  pad;            /* pad to be 32 bit aligment */
+       uint8   data[];       /* var len payload of bcm_xtlv_t type */
+} wl_mesh_ioc_t;
+
+enum wl_mesh_cmds {
+       WL_MESH_CMD_ENABLE = 1,
+       WL_MESH_CMD_JOIN = 2,
+       WL_MESH_CMD_PEER_STATUS = 3,
+       WL_MESH_CMD_ADD_ROUTE = 4,
+       WL_MESH_CMD_DEL_ROUTE = 5,
+       WL_MESH_CMD_ADD_FILTER = 6,
+       WL_MESH_CMD_ENAB_AL_METRIC = 7
+};
+
+enum wl_mesh_cmd_xtlv_id {
+       WL_MESH_XTLV_ENABLE = 1,
+       WL_MESH_XTLV_JOIN = 2,
+       WL_MESH_XTLV_STATUS = 3,
+       WL_MESH_XTLV_ADD_ROUTE = 4,
+       WL_MESH_XTLV_DEL_ROUTE = 5,
+       WL_MESH_XTLV_ADD_FILTER = 6,
+       WL_MESH_XTLV_ENAB_AIRLINK = 7
+};
+/* endif WLMESH */
+
+/* Fast BSS Transition parameter configuration */
+#define FBT_PARAM_CURRENT_VERSION 0
+
+typedef struct _wl_fbt_params {
+       uint16  version;                /* version of the structure
+                                       * as defined by FBT_PARAM_CURRENT_VERSION
+                                       */
+       uint16  length;                 /* length of the entire structure */
+
+       uint16 param_type;              /* type of parameter defined below */
+       uint16 param_len;               /* length of the param_value */
+       uint8 param_value[1];           /* variable length */
+} wl_fbt_params_t;
+
+#define WL_FBT_PARAM_TYPE_RSNIE                        0
+#define WL_FBT_PARAM_TYPE_FTIE                 0x1
+#define WL_FBT_PARAM_TYPE_SNONCE               0x2
+#define WL_FBT_PARAM_TYPE_MDE                  0x3
+#define WL_FBT_PARAM_TYPE_PMK_R0_NAME          0x4
+#define WL_FBT_PARAM_TYPE_R0_KHID              0x5
+#define WL_FBT_PARAM_TYPE_R1_KHID              0x6
+#define WL_FBT_PARAM_TYPE_FIRST_INVALID                0x7
+
+/* Assoc Mgr commands for fine control of assoc */
+#define WL_ASSOC_MGR_CURRENT_VERSION  0x0
+
+typedef struct {
+       uint16  version;                /* version of the structure as
+                                        * defined by WL_ASSOC_MGR_CURRENT_VERSION
+                                        */
+       uint16  length;                 /* length of the entire structure */
+
+       uint16 cmd;
+       uint16 params;
+} wl_assoc_mgr_cmd_t;
+
+enum wl_sae_auth_xtlv_id {
+       WL_SAE_AUTH_XTLV_CONTAINER      = 0xa1,
+       WL_SAE_AUTH_XTLV_BSSID          = 0xa2,
+       WL_SAE_AUTH_XTLV_CYCLIC_GROUP   = 0xa3,
+       WL_SAE_AUTH_XTLV_SCALAR         = 0xa4,
+       WL_SAE_AUTH_XTLV_ELEMENTS       = 0xa5,
+       WL_SAE_AUTH_XTLV_ANTI_CLOGGING  = 0xa6,
+       WL_SAE_AUTH_XTLV_SEND_CONFIRM   = 0xa7,
+       WL_SAE_AUTH_XTLV_CONFIRM        = 0xa8,
+       WL_SAE_AUTH_XTLV_STATUS         = 0xa9,
+       WL_SAE_AUTH_XTLV_LAST           = 0xac
+};
+
+#define WL_ASSOC_MGR_CMD_PAUSE_ON_EVT          0 /* have assoc pause on certain events */
+#define WL_ASSOC_MGR_CMD_ABORT_ASSOC           1
+#define WL_ASSOC_MGR_CMD_SET_SAE_FRAME         2
+
+#define WL_ASSOC_MGR_PARAMS_EVENT_NONE                 0 /* use this to resume as well as clear */
+#define WL_ASSOC_MGR_PARAMS_PAUSE_EVENT_AUTH_RESP      1
+
+#define WL_WINVER_STRUCT_VER_1 (1)
+
+typedef struct wl_winver {
+
+       /* Version and length of this structure. Length includes all fields in wl_winver_t */
+       uint16 struct_version;
+       uint16 struct_length;
+
+       /* Windows operating system version info (Microsoft provided) */
+       struct {
+               uint32 major_ver;
+               uint32 minor_ver;
+               uint32 build;
+       } os_runtime;
+
+       /* NDIS runtime version (Microsoft provided) */
+       struct {
+               uint16 major_ver;
+               uint16 minor_ver;
+       } ndis_runtime;
+
+       /* NDIS Driver version (Broadcom provided) */
+       struct {
+               uint16 major_ver;
+               uint16 minor_ver;
+       } ndis_driver;
+
+       /* WDI Upper Edge (UE) Driver version (Microsoft provided) */
+       struct {
+               uint8 major_ver;
+               uint8 minor_ver;
+               uint8 suffix;
+       } wdi_ue;
+
+       /* WDI Lower Edge (LE) Driver version (Broadcom provided) */
+       struct {
+               uint8 major_ver;
+               uint8 minor_ver;
+               uint8 suffix;
+       } wdi_le;
+       uint8 PAD[2];
+} wl_winver_t;
+
+/* defined(WLRCC) || defined(ROAM_CHANNEL_CACHE) */
+#define MAX_ROAM_CHANNEL      20
+typedef struct {
+       int32 n;
+       chanspec_t channels[MAX_ROAM_CHANNEL];
+} wl_roam_channel_list_t;
+/* endif RCC || ROAM_CHANNEL_CACHE */
+
+/* values for IOV_MFP arg */
+enum {
+       WL_MFP_NONE = 0,
+       WL_MFP_CAPABLE,
+       WL_MFP_REQUIRED
+};
+
+typedef enum {
+       CHANSW_UNKNOWN = 0,     /* channel switch due to unknown reason */
+       CHANSW_SCAN = 1,        /* channel switch due to scan */
+       CHANSW_PHYCAL = 2,      /* channel switch due to phy calibration */
+       CHANSW_INIT = 3,        /* channel set at WLC up time */
+       CHANSW_ASSOC = 4,       /* channel switch due to association */
+       CHANSW_ROAM = 5,        /* channel switch due to roam */
+       CHANSW_MCHAN = 6,       /* channel switch triggered by mchan module */
+       CHANSW_IOVAR = 7,       /* channel switch due to IOVAR */
+       CHANSW_CSA_DFS = 8,     /* channel switch due to chan switch  announcement from AP */
+       CHANSW_APCS = 9,        /* Channel switch from AP channel select module */
+
+       CHANSW_FBT = 11,        /* Channel switch from FBT module for action frame response */
+       CHANSW_UPDBW = 12,      /* channel switch at update bandwidth */
+       CHANSW_ULB = 13,        /* channel switch at ULB */
+       CHANSW_LAST = 14        /* last channel switch reason */
+} chansw_reason_t;
+
+/*
+ * WOWL unassociated mode power svae pattern.
+ */
+typedef struct wowl_radio_duty_cycle {
+       uint16 wake_interval;
+       uint16  sleep_interval;
+} wowl_radio_duty_cycle_t;
+
+typedef struct nd_ra_ol_limits {
+       uint16 version;         /* version of the iovar buffer */
+       uint16 type;            /* type of data provided */
+       uint16 length;          /* length of the entire structure */
+       uint16 pad1;            /* pad union to 4 byte boundary */
+       union {
+               struct {
+                       uint16 min_time;         /* seconds, min time for RA offload hold */
+                       uint16 lifetime_percent;
+                       /* percent, lifetime percentage for offload hold time */
+               } lifetime_relative;
+               struct {
+                       uint16 hold_time;        /* seconds, RA offload hold time */
+                       uint16 pad2;             /* unused */
+               } fixed;
+       } limits;
+} nd_ra_ol_limits_t;
+
+#define ND_RA_OL_LIMITS_VER 1
+
+/* nd_ra_ol_limits sub-types */
+#define ND_RA_OL_LIMITS_REL_TYPE   0     /* relative, percent of RA lifetime */
+#define ND_RA_OL_LIMITS_FIXED_TYPE 1     /* fixed time */
+
+/* buffer lengths for the different nd_ra_ol_limits types */
+#define ND_RA_OL_LIMITS_REL_TYPE_LEN   12
+#define ND_RA_OL_LIMITS_FIXED_TYPE_LEN  10
+
+/*
+ * Temperature Throttling control mode
+ */
+typedef struct wl_temp_control {
+       uint8 enable;
+       uint8 PAD;
+       uint16 control_bit;
+} wl_temp_control_t;
+
+/* SensorHub Interworking mode */
+
+#define SHUB_CONTROL_VERSION    1
+#define SHUB_CONTROL_LEN    12
+
+typedef struct {
+       uint16  verison;
+       uint16  length;
+       uint16  cmd;
+       uint16  op_mode;
+       uint16  interval;
+       uint16  enable;
+} shub_control_t;
+
+/* WLC_MAJOR_VER <= 5 */
+/* Data structures for non-TLV format */
+
+/* Data structures for rsdb caps */
+/*
+ * The flags field of the rsdb_caps_response is designed to be
+ * a Bit Mask. As of now only Bit 0 is used as mentioned below.
+ */
+
+/* Bit-0 in flags is used to indicate if the cores can operate synchronously
+* i.e either as 2x2 MIMO or 2(1x1 SISO). This is true only for 4349 variants
+* 0 - device can operate only in rsdb mode (eg: 4364)
+* 1 - device can operate in both rsdb and mimo (eg : 4359 variants)
+*/
+
+#define WL_RSDB_CAPS_VER 2
+#define SYNCHRONOUS_OPERATION_TRUE     (1 << 0)
+#define WL_RSDB_CAPS_FIXED_LEN  OFFSETOF(rsdb_caps_response_t, num_chains)
+
+typedef struct rsdb_caps_response {
+       uint8 ver;              /* Version */
+       uint8 len;              /* length of this structure excluding ver and len */
+       uint8 rsdb;             /* TRUE for rsdb chip */
+       uint8 num_of_cores;     /* no of d11 cores */
+       uint16 flags;           /* Flags to indicate various capabilities */
+       uint8 num_chains[1];    /* Tx/Rx chains for each core */
+} rsdb_caps_response_t;
+
+/* Data structures for rsdb bands */
+
+#define WL_RSDB_BANDS_VER       2
+#define WL_RSDB_BANDS_FIXED_LEN  OFFSETOF(rsdb_bands_t, band)
+
+typedef struct rsdb_bands
+{
+       uint8 ver;
+       uint8 len;
+       uint16 num_cores;       /* num of D11 cores */
+       int16 band[1];          /* The band operating on each of the d11 cores */
+} rsdb_bands_t;
+
+/* rsdb config */
+
+#define WL_RSDB_CONFIG_VER 3
+#define ALLOW_SIB_PARALLEL_SCAN        (1 << 0)
+#define MAX_BANDS 2
+
+#define WL_RSDB_CONFIG_LEN sizeof(rsdb_config_t)
+
+typedef uint8 rsdb_opmode_t;
+typedef uint32 rsdb_flags_t;
+
+typedef enum rsdb_modes {
+       WLC_SDB_MODE_NOSDB_MAIN = 1, /* 2X2 or MIMO mode (applicable only for 4355) */
+       WLC_SDB_MODE_NOSDB_AUX = 2,
+       WLC_SDB_MODE_SDB_MAIN = 3, /* This is RSDB mode(default) applicable only for 4364 */
+       WLC_SDB_MODE_SDB_AUX = 4,
+       WLC_SDB_MODE_SDB_AUTO = 5, /* Same as WLC_RSDB_MODE_RSDB(1+1) mode above */
+} rsdb_modes_t;
+
+typedef struct rsdb_config {
+       uint8 ver;
+       uint8 len;
+       uint16 reserved;
+       rsdb_opmode_t non_infra_mode;
+       rsdb_opmode_t infra_mode[MAX_BANDS];
+       rsdb_flags_t flags[MAX_BANDS];
+       rsdb_opmode_t current_mode;   /* Valid only in GET, returns the current mode */
+       uint8  pad[3];
+} rsdb_config_t;
+
+/* WLC_MAJOR_VER > =5 */
+/* TLV definitions and data structures for rsdb subcmds */
+
+enum wl_rsdb_cmd_ids {
+       /* RSDB ioctls */
+       WL_RSDB_CMD_VER = 0,
+       WL_RSDB_CMD_CAPS = 1,
+       WL_RSDB_CMD_BANDS = 2,
+       WL_RSDB_CMD_CONFIG = 3,
+       /* Add before this !! */
+       WL_RSDB_CMD_LAST
+};
+#define WL_RSDB_IOV_VERSION    0x1
+
+typedef struct rsdb_caps_response_v1 {
+       uint8 rsdb;             /* TRUE for rsdb chip */
+       uint8 num_of_cores;     /* no of d11 cores */
+       uint16 flags;           /* Flags to indicate various capabilities */
+       uint8 num_chains[MAX_NUM_D11CORES];     /* Tx/Rx chains for each core */
+       uint8 band_cap[MAX_NUM_D11CORES]; /* band cap bitmask per slice */
+} rsdb_caps_response_v1_t;
+
+typedef struct rsdb_bands_v1
+{
+       uint8 num_cores;                /* num of D11 cores */
+       uint8 pad;                      /* padding bytes for 4 byte alignment */
+       int8 band[MAX_NUM_D11CORES];    /* The band operating on each of the d11 cores */
+} rsdb_bands_v1_t;
+
+typedef struct rsdb_config_xtlv {
+       rsdb_opmode_t reserved1;        /* Non_infra mode is no more applicable */
+       rsdb_opmode_t infra_mode[MAX_BANDS]; /* Target mode for Infra association */
+       uint8 pad;      /* pad bytes for 4 byte alignment */
+       rsdb_flags_t  flags[MAX_BANDS];
+       rsdb_opmode_t current_mode; /* GET only; has current mode of operation */
+       uint8 pad1[3];
+} rsdb_config_xtlv_t;
+
+/* Definitions for slot_bss chanseq iovar */
+#define WL_SLOT_BSS_VERSION 1
+
+/* critical slots max size */
+#define WL_SLOTTED_BSS_CS_BMP_CFG_MAX_SZ       128 /* arbitrary */
+
+enum wl_slotted_bss_cmd_id {
+       WL_SLOTTED_BSS_CMD_VER = 0,
+       WL_SLOTTED_BSS_CMD_CHANSEQ = 1,
+       WL_SLOTTED_BSS_CMD_CS_BMP = 2 /* critical slots bitmap */
+};
+
+typedef uint16 chan_seq_type_t;
+enum chan_seq_type {
+       CHAN_SEQ_TYPE_AWDL      = 1,
+       CHAN_SEQ_TYPE_SLICE     = 2,
+       CHAN_SEQ_TYPE_NAN       = 3, /* NAN avail XTLV */
+       CHAN_SEQ_TYPE_NANHO     = 4  /* NANHO channel schedule XTLV */
+};
+
+typedef uint8 sched_flag_t;
+enum sched_flag {
+       NO_SDB_SCHED = 0x1,
+       SDB_TDM_SCHED = 0x2,
+       SDB_SPLIT_BAND_SCHED = 0x4, /* default mode for 4357 */
+       MAIN_ONLY = 0x8,
+       AUX_ONLY = 0x10,
+       SDB_DUAL_TIME = (MAIN_ONLY | AUX_ONLY),
+       NO_SDB_MAIN_ONLY = (NO_SDB_SCHED | MAIN_ONLY), /* default mode for 4364 */
+       SDB_TDM_SCHED_MAIN = (SDB_TDM_SCHED | MAIN_ONLY),
+       SDB_TDM_SCHED_AUX = (SDB_TDM_SCHED | AUX_ONLY),
+       SDB_TDM_SCHED_DUAL_TIME = (SDB_TDM_SCHED | SDB_DUAL_TIME),
+       SDB_SPLIT_BAND_SCHED_DUAL_TIME = (SDB_SPLIT_BAND_SCHED | SDB_DUAL_TIME)
+};
+
+typedef struct chan_seq_tlv_data {
+       uint32 flags;
+       uint8 data[1];
+} chan_seq_tlv_data_t;
+
+typedef struct chan_seq_tlv {
+       chan_seq_type_t type;
+       uint16 len;
+       chan_seq_tlv_data_t chanseq_data[1];
+} chan_seq_tlv_t;
+
+typedef struct sb_channel_sequence {
+       sched_flag_t sched_flags; /* (sdb-tdm or sdb-sb or Dual-Time) */
+       uint8 num_seq; /* number of chan_seq_tlv following */
+       uint16 pad;
+       chan_seq_tlv_t seq[1];
+} sb_channel_sequence_t;
+
+typedef struct slice_chan_seq {
+       uint8 slice_index;  /* 0(Main) or 1 (Aux) */
+       uint8 num_chanspecs;
+       uint8 dur;
+       uint8 pad;
+       chanspec_t chanspecs[1];
+} slice_chan_seq_t;
+
+#define SLOT_BSS_SLICE_TYPE_DUR_MAX_RANGE      2u
+#define SLOTTED_BSS_AGGR_EN                    (1 << 0)    /* Bitmap of mode */
+#define SLOTTED_BSS_AGGR_LIMIT_DUR             (1 << 1)    /* Jira 49554 */
+#define SLOTTED_BSS_HE_1024_QAM_SUPPORT                (1 << 2)    /* MCS10-11 Support */
+
+#define WL_SLICE_CHAN_SEQ_FIXED_LEN   OFFSETOF(slice_chan_seq_t, chanspecs)
+/* Definitions for slotted_bss stats */
+#define SBSS_STATS_VERSION 1
+#define SBSS_STATS_CURRENT_VERSION SBSS_STATS_VERSION
+
+#define SBSS_MAX_CHAN_STATS 4
+
+typedef struct sbss_core_stats {
+       uint32 sb_slot_start;
+       uint32 sb_slot_end;
+       uint32 sb_slot_skip;
+       uint32 mismatch_count;
+} sbss_core_stats_t;
+
+typedef struct sbss_chan_stats {
+       chanspec_t chanspec;
+       uint32 slot_start;
+       uint32 slot_end;
+       uint32 slot_skip;
+} sbss_chan_stats_t;
+
+typedef struct sbss_stats_v1 {
+       uint16 version;
+       uint16 length;
+       sbss_core_stats_t corestats[MAX_NUM_D11CORES];
+       sbss_chan_stats_t sbss_chanstats[MAX_NUM_D11CORES][SBSS_MAX_CHAN_STATS];
+} sbss_stats_t;
+
+/* slotted bss critical slots */
+typedef struct wl_sbss_cs_bmp_s {
+       uint8 bitmap_len;
+       uint8 pad[3];
+       uint8 bitmap[];
+} wl_sbss_cs_bmp_t;
+
+typedef struct sim_pm_params {
+       uint32 enabled;
+       uint16 cycle;
+       uint16 up;
+} sim_pm_params_t;
+
+/* Digital napping status */
+#define WL_NAP_STATUS_VERSION_1                1
+typedef struct wl_nap_status_v1 {
+       uint16 version;                 /* structure version  */
+       uint16 len;                     /* length of returned data */
+       uint16 fw_status;               /* bitmask of FW disable reasons */
+       uint8  hw_status;               /* bitmask for actual HW state info */
+       uint8  slice_index;             /* which slice this represents */
+       uint32 total_disable_dur;       /* total time (ms) disabled for fw_status */
+} wl_nap_status_v1_t;
+
+/* Bits for fw_status */
+#define NAP_DISABLED_HOST              0x0001   /* Host has disabled through nap_enable */
+#define NAP_DISABLED_RSSI              0x0002   /* Disabled because of nap_rssi_threshold */
+#define NAP_DISABLED_SCAN              0x0004   /* Disabled because of scan */
+#define NAP_DISABLED_ASSOC             0x0008   /* Disabled because of association */
+#define NAP_DISABLED_LTE               0x0010   /* Disabled because of LTE */
+#define NAP_DISABLED_ACI               0x0020   /* Disabled because of ACI mitigation */
+#define NAP_DISABLED_SEQ_RANGE          0x0040   /* Disabled during SEQ Ranging */
+
+/* Bits for hw_status */
+#define NAP_HWCFG                      0x01   /* State of NAP config bit in phy HW */
+#define NAP_NOCLK                      0x80   /* No clock to read HW (e.g. core down) */
+
+/* ifdef WL_NATOE */
+#define WL_NATOE_IOCTL_VERSION         1
+#define WL_NATOE_IOC_BUFSZ             512     /* sufficient ioc buff size for natoe */
+#define WL_NATOE_DBG_STATS_BUFSZ       2048
+#define NATOE_FLAGS_ENAB_MASK          0x1
+#define NATOE_FLAGS_ACTIVE_MASK                0x2
+#define NATOE_FLAGS_PUBNW_MASK         0x4
+#define NATOE_FLAGS_PVTNW_MASK         0x8
+#define NATOE_FLAGS_ENAB_SHFT_MASK     0
+#define NATOE_FLAGS_ACTIVE_SHFT_MASK   1
+#define NATOE_FLAGS_PUBNW_SHFT_MASK    2
+#define NATOE_FLAGS_PVTNW_SHFT_MASK    3
+#define NATOE_FLAGS_PUB_NW_UP  (1 << NATOE_FLAGS_PUBNW_SHFT_MASK)
+#define NATOE_FLAGS_PVT_NW_UP  (1 << NATOE_FLAGS_PVTNW_SHFT_MASK)
+
+#define PCIE_FRWDPKT_STATS_VERSION     1
+
+/* Module version is 1 for IGUANA */
+#define WL_NATOE_MODULE_VER_1  1
+/* Module version is 2 for Lemur */
+#define WL_NATOE_MODULE_VER_2  2
+
+/* WL_NATOE_CMD_MOD_VER */
+typedef uint16 wl_natoe_ver_t;
+/* config natoe STA and AP IP's structure */
+typedef struct {
+       uint32 sta_ip;
+       uint32 sta_netmask;
+       uint32 sta_router_ip;
+       uint32 sta_dnsip;
+       uint32 ap_ip;
+       uint32 ap_netmask;
+} wl_natoe_config_ips_t;
+
+/* natoe ports config structure */
+typedef struct {
+       uint16 start_port_num;
+       uint16 no_of_ports;
+} wl_natoe_ports_config_t;
+
+/* natoe ports exception info */
+typedef struct {
+       uint16 sta_port_num;
+       uint16 dst_port_num;    /* for SIP type protocol, dst_port_num info can be ignored by FW */
+       uint32 ip;              /* for SIP ip is APcli_ip and for port clash it is dst_ip */
+       uint8  entry_type;      /* Create/Destroy */
+       uint8  pad[3];
+} wl_natoe_exception_port_t;
+
+/* container for natoe ioctls & events */
+typedef struct wl_natoe_ioc {
+       uint16  version;        /* interface command or event version */
+       uint16  id;             /* natoe ioctl cmd  ID  */
+       uint16  len;            /* total length of all tlv records in data[]  */
+       uint16  pad;            /* pad to be 32 bit aligment */
+       uint8   data[];       /* var len payload of bcm_xtlv_t type */
+} wl_natoe_ioc_t;
+
+typedef struct wl_natoe_pool_stats_v1 {
+       /* For debug purposes */
+       uint16 poolreorg_cnt;
+       uint16 poolrevert_cnt;
+       uint16 txfrag_state;
+       uint16 rxfrag_state;
+       uint16 txfrag_plen;
+       uint16 rxfrag_plen;
+       uint16 tx_pavail;
+       uint16 rx_pavail;
+       uint16 txmin_bkup_bufs;
+       uint16 rxmin_bkup_bufs;
+       uint16 pktpool_sbuf_alloc;
+       uint16 pktpool_plen;
+       uint16 pktpool_pavail;
+       /* Peak shared buffer count in all iterations */
+       uint16 sbuf_peak;
+       /* Peak shared buffer count in current D3 iteration */
+       uint16 sbuf_peak_cur;
+} wl_natoe_pool_stats_v1_t;
+
+typedef struct wl_natoe_arp_entry_v1 {
+       struct ipv4_addr ip;
+       struct ether_addr mac_addr;
+       uint8  lifetime;
+       uint8 flags;
+} wl_natoe_arp_entry_v1_t;
+
+typedef struct wl_natoe_dbg_arp_tbl_info_v1 {
+       uint8 valid_arp_entries;
+       uint8 PAD[3];
+       wl_natoe_arp_entry_v1_t arp_ent[];
+} wl_natoe_dbg_arp_tbl_info_v1_t;
+
+typedef struct wl_natoe_skip_port_entry_v1 {
+       struct ipv4_addr srcip;
+       uint16 src_port;
+       uint16 lifetime;
+} wl_natoe_skip_port_entry_v1_t;
+
+typedef struct wl_natoe_skip_port_info_v1 {
+       uint8 valid_entries;
+       uint8 PAD[3];
+       wl_natoe_skip_port_entry_v1_t skip_port_ent[];
+} wl_natoe_skip_port_info_v1_t;
+
+typedef struct wl_natoe_dbg_stats_v1 {
+       uint16 active_nat_entries;
+       uint16 active_dns_entries;
+       uint16 active_icmp_entries;
+       uint16 valid_arp_entries;
+       uint16 prev_nat_entries;
+       uint16 prev_dns_entries;
+       uint16 tcp_fast_reclaim_cnt;
+       uint16 mcast_packets;
+       uint16 bcast_packets;
+       uint16 port_commands_rcvd;
+       uint16 unsupported_prot;
+       uint16 arp_req_sent;
+       uint16 arp_rsp_rcvd;
+       uint16 non_ether_frames;
+       uint16 port_alloc_fail;
+       uint16 srcip_tbl_full;
+       uint16 dstip_tbl_full;
+       uint16 nat_tbl_full;
+       uint16 icmp_error_cnt;
+       uint16 pkt_drops_resource;
+       uint32 frwd_nat_pkt_cnt;
+       uint32 reverse_nat_pkt_cnt;
+       uint16 pub_nw_chspec;
+       uint16 pvt_nw_chspec;
+       uint8 pubnw_cfg_idx;
+       uint8 pvtnw_cfg_idx;
+       uint8 pubnw_cfg_ID;
+       uint8 pvtnw_cfg_ID;
+       uint16 natoe_flags;
+} wl_natoe_dbg_stats_v1_t;
+
+typedef struct wl_natoe_exception_port_inf_v1 {
+       uint16 except_bmap_size;
+       uint8 port_except_bmap[];
+} wl_natoe_exception_port_inf_v1_t;
+
+typedef struct wl_natoe_dstnat_entry_v1 {
+       struct ipv4_addr clientip;
+       struct ether_addr client_mac_addr;
+       uint16 client_listenport;
+       uint8 opcode;
+} wl_natoe_dstnat_entry_v1_t;
+
+typedef struct wl_pcie_frwd_stats_v1 {
+       uint16 version;
+       uint16 len;
+       uint16 frwd_txfrag_q_cnt; /* no. of txfrags in frwd_txfrag_list */
+       /* no. of outstanding lbufs in txpath on if0/ifx */
+       uint16 tx_frwd_n_lb_if0;
+       uint16 tx_frwd_n_lb_ifx;
+       /* no. of outstanding lfrags in txpath on if0/ifx */
+       uint16 tx_frwd_n_lf_if0;
+       uint16 tx_frwd_n_lf_ifx;
+       /* no. of pending frwd pkts dropped upon d3 entry */
+       uint16 tx_frwd_d3_drop_cnt;
+       /* Total no. of lbufs frwded in txpath on if0/ifx */
+       uint32 tx_frwd_n_lb_if0_cnt;
+       uint32 tx_frwd_n_lb_ifx_cnt;
+       /* Total no. of lfrags frwded in txpath on if0/ifx */
+       uint32 tx_frwd_n_lf_if0_cnt;
+       uint32 tx_frwd_n_lf_ifx_cnt;
+       uint32 frwd_tx_drop_thr_cnt; /* no. of pkts dropped due to txfrag threshold */
+       uint32 frwd_tx_drop_err_cnt; /* no. of pkts dropped due to txfrags not avail / errors */
+} wl_pcie_frwd_stats_v1_t;
+
+enum wl_natoe_cmds {
+       WL_NATOE_CMD_MOD_VER = 0,
+       WL_NATOE_CMD_ENABLE = 1,
+       WL_NATOE_CMD_CONFIG_IPS = 2,
+       WL_NATOE_CMD_CONFIG_PORTS = 3,
+       WL_NATOE_CMD_DBG_STATS = 4,
+       WL_NATOE_CMD_EXCEPTION_PORT = 5,
+       WL_NATOE_CMD_SKIP_PORT = 6,
+       WL_NATOE_CMD_TBL_CNT = 7,
+       WL_NATOE_CMD_CONFIG_DSTNAT = 8,
+       WL_NATOE_CMD_CTRL = 9
+};
+
+enum wl_natoe_cmd_xtlv_id {
+       WL_NATOE_XTLV_MOD_VER = 0,
+       WL_NATOE_XTLV_ENABLE = 1,
+       WL_NATOE_XTLV_CONFIG_IPS = 2,
+       WL_NATOE_XTLV_CONFIG_PORTS = 3,
+       WL_NATOE_XTLV_DBG_STATS = 4,
+       WL_NATOE_XTLV_EXCEPTION_PORT = 5,
+       WL_NATOE_XTLV_SKIP_PORT = 6,
+       WL_NATOE_XTLV_TBL_CNT = 7,
+       WL_NATOE_XTLV_ARP_TBL = 8,
+       WL_NATOE_XTLV_POOLREORG = 9,
+       WL_NATOE_XTLV_CONFIG_DSTNAT = 10,
+       WL_NATOE_XTLV_CTRL = 11
+};
+
+/* endif WL_NATOE */
+
+enum wl_idauth_cmd_ids {
+       WL_IDAUTH_CMD_CONFIG                            = 1,
+       WL_IDAUTH_CMD_PEER_INFO                         = 2,
+       WL_IDAUTH_CMD_COUNTERS                          = 3,
+       WL_IDAUTH_CMD_LAST
+};
+enum wl_idauth_xtlv_id {
+       WL_IDAUTH_XTLV_AUTH_ENAB                        = 0x1,
+       WL_IDAUTH_XTLV_GTK_ROTATION                     = 0x2,
+       WL_IDAUTH_XTLV_EAPOL_COUNT                      = 0x3,
+       WL_IDAUTH_XTLV_EAPOL_INTRVL                     = 0x4,
+       WL_IDAUTH_XTLV_BLKLIST_COUNT                    = 0x5,
+       WL_IDAUTH_XTLV_BLKLIST_AGE                      = 0x6,
+       WL_IDAUTH_XTLV_PEERS_INFO                       = 0x7,
+       WL_IDAUTH_XTLV_COUNTERS                         = 0x8
+};
+enum wl_idauth_stats {
+       WL_AUTH_PEER_STATE_AUTHORISED                   = 0x01,
+       WL_AUTH_PEER_STATE_BLACKLISTED                  = 0x02,
+       WL_AUTH_PEER_STATE_4WAY_HS_ONGOING              = 0x03,
+       WL_AUTH_PEER_STATE_LAST
+};
+typedef struct {
+       uint16 state;                           /* Peer State: Authorised or Blacklisted */
+       struct ether_addr peer_addr;            /* peer Address */
+       uint32 blklist_end_time;                /* Time of blacklist end */
+} auth_peer_t;
+typedef struct wl_idauth_counters {
+       uint32 auth_reqs;                       /* No of auth req recvd */
+       uint32 mic_fail;                        /* No of mic fails */
+       uint32 four_way_hs_fail;                /* No of 4-way handshake fails */
+} wl_idauth_counters_t;
+
+#define WLC_UTRACE_LEN         (1024u * 4u) // default length
+#define WLC_UTRACE_LEN_AUX     (1024u * 3u) // reduced length to fit smaller AUX BM
+#define WLC_UTRACE_LEN_SC      (1024u * 3u) // reduced length to fit smaller Scan core BM
+
+#define WLC_UTRACE_READ_END 0
+#define WLC_UTRACE_MORE_DATA 1
+
+typedef struct wl_utrace_capture_args_v1 {
+       uint32 length;
+       uint32 flag;
+} wl_utrace_capture_args_v1_t;
+
+#define UTRACE_CAPTURE_VER_2   2
+typedef struct wl_utrace_capture_args_v2 {
+       /* structure control */
+       uint16 version;         /**< structure version */
+       uint16 length;          /**< length of the response */
+       uint32 flag;            /* Indicates if there is more data or not */
+} wl_utrace_capture_args_v2_t;
+
+/* Signal read end. */
+#define WLC_REGVAL_READ_END 0
+/* Signal more data pending. */
+#define WLC_REGVAL_MORE_DATA 1
+/* Internal read state. */
+#define WLC_REGVAL_READ_CONTINUE 2
+
+#define WLC_REGVAL_DUMP_PHYREG 0
+#define WLC_REGVAL_DUMP_RADREG 1
+
+#define PHYREGVAL_CAPTURE_BUFFER_LEN 2048
+
+typedef struct wl_regval_capture_args {
+       uint32 control_flag;    /* Carries status information. */
+} wl_regval_capture_args_t;
+
+/* XTLV IDs for the Health Check "hc" iovar top level container */
+enum {
+       WL_HC_XTLV_ID_CAT_HC = 1,               /* category for HC as a whole */
+       WL_HC_XTLV_ID_CAT_DATAPATH_TX = 2,      /* Datapath Tx */
+       WL_HC_XTLV_ID_CAT_DATAPATH_RX = 3,      /* Datapath Rx */
+       WL_HC_XTLV_ID_CAT_SCAN  = 4,            /* Scan */
+       WL_HC_XTLV_ID_CAT_EVENTMASK     = 5,            /* Health Check event mask. */
+};
+
+/* Health Check: Common XTLV IDs for sub-elements in the top level container
+ * Number starts at 0x8000 to be out of the way for category specific IDs.
+ */
+enum {
+       WL_HC_XTLV_ID_ERR       = 0x8000,       /* for sub-command  err return */
+       WL_HC_XTLV_ID_IDLIST    = 0x8001,       /* container for uint16 IDs */
+};
+
+/* Health Check: Datapath TX IDs */
+enum {
+       WL_HC_TX_XTLV_ID_VAL_STALL_THRESHOLD   = 1,     /* stall_threshold */
+       WL_HC_TX_XTLV_ID_VAL_STALL_SAMPLE_SIZE = 2,     /* stall_sample_size */
+       WL_HC_TX_XTLV_ID_VAL_STALL_TIMEOUT     = 3,     /* stall_timeout */
+       WL_HC_TX_XTLV_ID_VAL_STALL_FORCE       = 4,     /* stall_force */
+       WL_HC_TX_XTLV_ID_VAL_STALL_EXCLUDE     = 5,     /* stall_exclude */
+       WL_HC_TX_XTLV_ID_VAL_FC_TIMEOUT        = 6,     /* flow ctl timeout */
+       WL_HC_TX_XTLV_ID_VAL_FC_FORCE          = 7,     /* flow ctl force failure */
+       WL_HC_TX_XTLV_ID_VAL_DELAY_TO_TRAP     = 8,     /* delay threshold for forced trap */
+       WL_HC_TX_XTLV_ID_VAL_DELAY_TO_RPT      = 9,     /* delay threshold for event log report */
+       WL_HC_TX_XTLV_ID_VAL_FAILURE_TO_RPT    = 10,    /* threshold for consecutive TX failures */
+};
+
+/* Health Check: Datapath RX IDs */
+enum {
+       WL_HC_RX_XTLV_ID_VAL_DMA_STALL_TIMEOUT = 1,     /* dma_stall_timeout */
+       WL_HC_RX_XTLV_ID_VAL_DMA_STALL_FORCE   = 2,     /* dma_stall test trigger */
+       WL_HC_RX_XTLV_ID_VAL_STALL_THRESHOLD   = 3,     /* stall_threshold */
+       WL_HC_RX_XTLV_ID_VAL_STALL_SAMPLE_SIZE = 4,     /* stall_sample_size */
+       WL_HC_RX_XTLV_ID_VAL_STALL_FORCE       = 5,     /* stall test trigger */
+       WL_HC_RX_XTLV_ID_VAL_STALL_UC_DECRYPT_FAIL = 6,  /* trigger uc decrypt failures */
+       WL_HC_RX_XTLV_ID_VAL_STALL_BCMC_DECRYPT_FAIL = 7, /* trigger bcmc decrypt failures */
+};
+
+/* Health Check: Datapath SCAN IDs */
+enum {
+       WL_HC_XTLV_ID_VAL_SCAN_STALL_THRESHOLD  = 1,    /* scan stall threshold */
+};
+
+/* Health check: PHY IDs */
+/* Needed for iguana 13.35 branch */
+typedef enum {
+       PHY_HC_DD_ALL           = 0,
+       PHY_HC_DD_TEMPSENSE     = 1,
+       PHY_HC_DD_VCOCAL        = 2,
+       PHY_HC_DD_RX            = 3,
+       PHY_HC_DD_TX            = 4,
+       PHY_HC_DD_LAST          /* This must be the last entry */
+} phy_hc_dd_type_t;
+
+typedef enum {
+       PHY_HC_DD_TEMP_FAIL     = 0,
+       PHY_HC_DD_VCO_FAIL      = 1,
+       PHY_HC_DD_RXDSN_FAIL    = 2,
+       PHY_HC_DD_TXPOW_FAIL    = 3,
+       PHY_HC_DD_END           /* This must be the last entry */
+} phy_hc_dd_type_v2_t;
+
+/* IDs of Health Check report structures for sub types of health checks within WL */
+typedef enum wl_hc_dd_type {
+       WL_HC_DD_PCIE           = 0,    /* PCIe */
+       WL_HC_DD_RX_DMA_STALL   = 1,    /* RX DMA stall check */
+       WL_HC_DD_RX_STALL       = 2,    /* RX stall check */
+       WL_HC_DD_TX_STALL       = 3,    /* TX stall check */
+       WL_HC_DD_SCAN_STALL     = 4,    /* SCAN stall check */
+       WL_HC_DD_PHY            = 5,    /* PHY health check */
+       WL_HC_DD_REINIT         = 6,    /* Reinit due to other reasons */
+       WL_HC_DD_TXQ_STALL      = 7,    /* TXQ stall */
+       WL_HC_DD_RX_STALL_V2    = 8,    /* RX stall check v2 */
+
+       WL_HC_DD_SBSS           =10,    /* Slotted bss health check */
+       WL_HC_DD_NAN            =11,    /* NAN health check */
+       WL_HC_DD_MAX
+} wl_hc_dd_type_t;
+
+/* RX stall reason codes sent with wl_rx_hc_info_v2_t */
+typedef enum bcm_rx_hc_stall_reason {
+       BCM_RX_HC_RESERVED              = 0,
+       BCM_RX_HC_UNSPECIFIED           = 1,    /* All other. Catch all */
+       BCM_RX_HC_UNICAST_DECRYPT_FAIL  = 2,    /* Unicast decrypt fail */
+       BCM_RX_HC_BCMC_DECRYPT_FAIL     = 3,    /* BCMC decrypt fail */
+       BCM_RX_HC_UNICAST_REPLAY        = 4,    /* Unicast replay */
+       BCM_RX_HC_BCMC_REPLAY           = 5,    /* BCMC replay */
+       BCM_RX_HC_AMPDU_DUP             = 6,    /* AMPDU DUP */
+       BCM_RX_HC_MAX
+} bcm_rx_hc_stall_reason_t;
+
+/*
+ * Health Check report structures for sub types of health checks within WL
+ */
+
+/* Health Check report structure for Rx DMA Stall check */
+typedef struct {
+       uint16 type;
+       uint16 length;
+       uint16 timeout;
+       uint16 stalled_dma_bitmap;
+} wl_rx_dma_hc_info_t;
+
+/* Health Check report structure for Tx packet failure check */
+typedef struct {
+       uint16 type;
+       uint16 length;
+       uint32 stall_bitmap;
+       uint32 stall_bitmap1;
+       uint32 failure_ac;
+       uint32 threshold;
+       uint32 tx_all;
+       uint32 tx_failure_all;
+} wl_tx_hc_info_t;
+
+/* Health Check report structure for Rx dropped packet failure check */
+typedef struct {
+       uint16 type; /* WL_HC_RX_DD_STALL */
+       uint16 length;
+       uint32 bsscfg_idx;
+       uint32 rx_hc_pkts;
+       uint32 rx_hc_dropped_all;
+       uint32 rx_hc_alert_th;
+} wl_rx_hc_info_t;
+
+/* Health Check report structure for Rx dropped packet failure check */
+typedef struct {
+       uint16 type; /* WL_HC_RX_DD_STALL_V2 */
+       uint16 length;
+       uint8 if_idx; /* interface index on which issue is reported */
+       uint8 ac; /* access category on which this problem is seen */
+       uint8 pad[2]; /* Reserved */
+       uint32 rx_hc_pkts;
+       uint32 rx_hc_dropped_all;
+       uint32 rx_hc_alert_th;
+       uint32 reason;  /* refer to bcm_rx_hc_stall_reason_t above */
+       struct ether_addr peer_ea;
+} wl_rx_hc_info_v2_t;
+
+/* HE top level command IDs */
+enum {
+       WL_HE_CMD_ENAB                          = 0u,
+       WL_HE_CMD_FEATURES                      = 1u,
+       WL_HE_CMD_TWT_SETUP                     = 2u,
+       WL_HE_CMD_TWT_TEARDOWN                  = 3u,
+       WL_HE_CMD_TWT_INFO                      = 4u,
+       WL_HE_CMD_BSSCOLOR                      = 5u,
+       WL_HE_CMD_PARTIAL_BSSCOLOR              = 6u,
+       WL_HE_CMD_CAP                           = 7u,
+       WL_HE_CMD_STAID                         = 8u,
+       WL_HE_CMD_MUEDCA                        = 9u,
+       WL_HE_CMD_RTSDURTHRESH                  = 10u,
+       WL_HE_CMD_PEDURATION                    = 11u,
+       WL_HE_CMD_TESTBED_MODE                  = 12u,
+       WL_HE_CMD_OMI_CONFIG                    = 13u,
+       WL_HE_CMD_OMI_STATUS                    = 14u,
+       WL_HE_CMD_OMI_ULMU_THROTTLE             = 15u,
+       WL_HE_CMD_ULMU_DISABLE_POLICY           = 16u,
+       WL_HE_CMD_ULMU_DISABLE_STATS            = 17u,
+       WL_HE_CMD_OMI_DLMU_RSD_RCM_MPF_MAP      = 18u,
+       WL_HE_CMD_SR_PROHIBIT                   = 19u,
+       WL_HE_CMD_LAST
+};
+
+enum {
+       WL_HE_MUEDCA_IE         = 0,
+       WL_HE_MUEDCA_SHM        = 1,
+       WL_HE_MUEDCA_LAST
+};
+
+#ifdef WL11AX
+
+/* struct for dump MU EDCA IE/SHM paramters */
+typedef struct wl_he_muedca_ie_v1 {
+       uint16 version; /* structure version */
+       uint16 length;  /* data length (starting after this field) */
+       uint8 mu_qos_info;
+       he_mu_ac_param_record_t param_ac[AC_COUNT];
+} wl_he_muedca_ie_v1_t;
+
+typedef wl_he_muedca_ie_v1_t   wl_he_muedca_ie_t;
+
+#define WL_HE_MUEDCA_VER_1     1
+
+#endif /* WL11AX */
+
+/* TWT top level command IDs */
+enum {
+       WL_TWT_CMD_ENAB                 = 0,
+       WL_TWT_CMD_SETUP                = 1,
+       WL_TWT_CMD_TEARDOWN             = 2,
+       WL_TWT_CMD_INFO                 = 3,
+       WL_TWT_CMD_AUTOSCHED            = 4,
+       WL_TWT_CMD_STATS                = 5,
+       WL_TWT_CMD_EARLY_TERM_TIME      = 6,
+       WL_TWT_CMD_RESP_CONFIG          = 7,
+       WL_TWT_CMD_SPPS_ENAB            = 8,
+       WL_TWT_CMD_LAST
+};
+
+/* TODO: Remove the follwoing after mering TWT changes to trunk */
+#define WL_TWT_CMD_DEF_IN_WLIOCTL 1
+
+#define WL_HEB_VER_1   1
+
+/* HEB top level command IDs */
+enum {
+       WL_HEB_CMD_ENAB                 = 0,
+       WL_HEB_CMD_NUM_HEB              = 1,
+       WL_HEB_CMD_COUNTERS             = 2,
+       WL_HEB_CMD_CLEAR_COUNTERS       = 3,
+       WL_HEB_CMD_CONFIG               = 4,
+       WL_HEB_CMD_STATUS               = 5,
+       WL_HEB_CMD_LAST
+};
+
+/* HEB counters structures */
+typedef struct wl_heb_int_cnt_v1 {
+       uint16 pre_event;
+       uint16 start_event;
+       uint16 end_event;
+       uint16 missed;
+} wl_heb_int_cnt_v1_t;
+
+typedef struct wl_heb_cnt_v1 {
+       /* structure control */
+       uint16 version; /* structure version */
+       uint16 length;  /* data length (starting after this field) */
+       wl_heb_int_cnt_v1_t heb_int_cnt[1];
+} wl_heb_cnt_v1_t;
+
+// struct for configuring HEB
+typedef struct wl_config_heb_fill_v1 {
+       uint16 version; /* structure version */
+       uint16 length;  /* data length (starting after this field) */
+       uint32 duration;
+       uint32 periodicity;
+       uint16 heb_idx;
+       uint16 preeventtime;
+       uint8 count;
+       uint8 PAD[3];
+} wl_config_heb_fill_v1_t;
+
+typedef struct wl_heb_blk_params_v1 {
+       /* Don't change the order of following elements. This is as per the HEB HW spec */
+       uint32 event_int_val_l;
+       uint32 event_int_val_h;
+       uint32 param2;
+       uint32 param3;
+       uint32 pre_event_intmsk_bmp;
+       uint32 start_event_intmsk_bmp;
+       uint32 end_event_intmsk_bmp;
+       uint32 event_driver_info;
+       uint16 param1;
+       uint8 event_count;
+       uint8 noa_invert;
+} wl_heb_blk_params_v1_t;
+
+typedef struct wl_heb_int_status_v1 {
+       uint32 heb_idx;
+       wl_heb_blk_params_v1_t blk_params;
+} wl_heb_reg_status_v1_t;
+
+typedef struct wl_heb_status_v1 {
+       uint16 version; /* structure version */
+       uint16 length;  /* data length (starting after this field) */
+       wl_heb_reg_status_v1_t heb_status[1];
+} wl_heb_status_v1_t;
+
+/* HWA */
+#define WL_HWA_VER_1   1
+
+/* HWA top level command IDs */
+typedef enum wl_hwa_cmd_type {
+       WL_HWA_CMD_ENAB         = 0,
+       WL_HWA_CMD_CAPS         = 1,
+       WL_HWA_CMD_COUNTERS     = 2,
+       WL_HWA_CMD_CLRCNTS      = 3,
+       WL_HWA_CMD_REGDUMP      = 4,
+       WL_HWA_CMD_INDUCE_ERR   = 5,
+       WL_HWA_CMD_LAST
+} wl_hwa_cmd_type_t;
+
+typedef struct wl_hwa_cnts_info_v1 {
+       uint16  cnt_rxs_filter;                  /* #filters added */
+       uint16  cnt_rxs_chainable;               /* #rxchainable matched */
+} wl_hwa_cnts_info_v1_t;
+
+/* HWA dump info structures */
+typedef struct wl_hwa_hwcaps_info_v1 {
+       uint16  up;                              /* is hwa init'd/deint'd */
+       uint16  corerev;                         /* hwa core revision */
+       uint32  submodules_mask;                 /* mask for hwa submodules that are enabled */
+} wl_hwa_hwcaps_info_v1_t;
+
+typedef struct wl_hwa_cnts_v1 {
+       /* structure control */
+       uint16  version;                         /* structure version */
+       uint16  length;                          /* data length (starting after this field) */
+       wl_hwa_cnts_info_v1_t hwa_cnts_info[];   /* variable length array with hwa counters */
+} wl_hwa_cnts_v1_t;
+
+/* All submodules, order is important and define order of initialization. */
+/* Not use enumeration here because these defines are also used in macro */
+#define        HWA_SUBMODULES_COMMON           0       /**< Common */
+#define        HWA_SUBMODULES_TXPOST           1u      /**< TxPost 3a */
+#define        HWA_SUBMODULES_RXPOSTFILL       2u      /**< RxPost and Fill 1a/1b */
+#define        HWA_SUBMODULES_TXDMA            3u      /**< TxDMA 3b */
+#define        HWA_SUBMODULES_TXS              4u      /**< TxStatus 4a */
+#define        HWA_SUBMODULES_BUFMGR           5u      /**< Buffer Manager, RX and TX. Do this last */
+#define        HWA_SUBMODULES_CPL              6u      /**< Completion 2b/4b */
+#define        HWA_SUBMODULES_RXS              7u      /**< RxStatus 2a */
+#define        HWA_SUBMODULES_NUM              8u      /**< number of submodules */
+
+#define HWA_SUBMODULES_ALL             0xFF    /* Bitmaps for all submodules */
+#ifdef HWA
+#define HWA_SUBMODULE_MASK(submodule)  (1u << (submodule))
+#else
+#define HWA_SUBMODULE_MASK(submodule)  (0)
+#endif /* HWA */
+/*
+ * NOTES:
+ * wl_twt_sdesc_t is used to support both broadcast TWT and individual TWT.
+ * Value in bit[0:2] in 'flow_id' field is interpreted differently:
+ * - flow id for individual TWT (when WL_TWT_FLOW_FLAG_BROADCAST bit is NOT set
+ *   in 'flow_flags' field)
+ * - flow id as defined in Table 8-248l1 for broadcast TWT (when
+ *   WL_TWT_FLOW_FLAG_BROADCAST bit is set)
+ * In latter case other bits could be used to differentiate different flows
+ * in order to support multiple broadcast TWTs with the same flow id.
+ */
+
+/* TWT Setup descriptor */
+typedef struct wl_twt_sdesc {
+       /* Setup Command. */
+       uint8 setup_cmd;                /* See TWT_SETUP_CMD_XXXX in 802.11ah.h */
+       uint8 flow_flags;               /* Flow attributes. See WL_TWT_FLOW_FLAG_XXXX below */
+       uint8 flow_id;          /* must be between 0 and 7. Set 0xFF for auto assignment */
+       uint8 bid;              /* must be between 0 and 31. Set 0xFF for auto assignment */
+       uint8 channel;          /* Twt channel - Not used for now */
+       uint8 negotiation_type; /* Negotiation Type: See macros TWT_NEGO_TYPE_X */
+       uint8 frame_recomm;     /* frame recommendation for broadcast TWTs - Not used for now    */
+       uint8 wake_type;        /* See WL_TWT_TIME_TYPE_XXXX below */
+       uint32 wake_time_h;     /* target wake time - BSS TSF (us) */
+       uint32 wake_time_l;
+       uint32 wake_dur;        /* target wake duration in unit of microseconds */
+       uint32 wake_int;        /* target wake interval */
+       uint32 btwt_persistence;        /* Broadcast TWT Persistence */
+       uint32 wake_int_max;    /* max wake interval(uS) for TWT */
+       uint8 duty_cycle_min;   /* min duty cycle for TWT(Percentage) */
+       uint8 pad;
+       /* deprecated - to be removed */
+       uint16 li;
+
+} wl_twt_sdesc_t;
+
+/* Flow flags */
+#define WL_TWT_FLOW_FLAG_UNANNOUNCED   (1u << 0u)
+#define WL_TWT_FLOW_FLAG_TRIGGER       (1u << 1u)
+#define WL_TWT_FLOW_FLAG_REQUEST       (1u << 2u)
+#define WL_TWT_FLOW_FLAG_PROTECT       (1u << 3u)
+#define WL_TWT_FLOW_FLAG_RESPONDER_PM  (1u << 4u)
+#define WL_TWT_FLOW_FLAG_UNSOLICITED   (1u << 5u)
+
+/* Deprecated - To be removed */
+#define WL_TWT_FLOW_FLAG_BROADCAST     (1u << 5u)
+#define WL_TWT_FLOW_FLAG_WAKE_TBTT_NEGO (1u << 6u)
+#define WL_TWT_FLOW_FLAG_IMPLICIT      (1u << 7u)
+
+/* Flow id */
+#define WL_TWT_FLOW_ID_FID     0x07u   /* flow id */
+#define WL_TWT_FLOW_ID_GID_MASK        0x70u   /* group id - broadcast TWT only */
+#define WL_TWT_FLOW_ID_GID_SHIFT 4u
+
+#define WL_TWT_INV_BCAST_ID    0xFFu
+#define WL_TWT_INV_FLOW_ID     0xFFu
+
+/* auto flow_id */
+#define WL_TWT_SETUP_FLOW_ID_AUTO      0xFFu
+/* auto broadcast ID */
+#define WL_TWT_SETUP_BCAST_ID_AUTO     0xFFu
+/* Infinite persistence for broadcast schedule */
+#define WL_TWT_INFINITE_BTWT_PERSIST   0xFFFFFFFFu
+
+/* should be larger than what chip supports */
+#define WL_TWT_STATS_MAX_BTWT  4u
+#define WL_TWT_STATS_MAX_ITWT  4u
+
+/* Wake type */
+/* TODO: not yet finalized */
+#define WL_TWT_TIME_TYPE_BSS   0u      /* The time specified in wake_time_h/l is
+                                        * the BSS TSF time.
+                                        */
+#define WL_TWT_TIME_TYPE_OFFSET        1u      /* The time specified in wake_time_h/l is an offset
+                                        * of the TSF time when the iovar is processed.
+                                        */
+#define WL_TWT_TIME_TYPE_AUTO  2u      /* The target wake time is chosen internally by the FW */
+
+#define WL_TWT_SETUP_VER       0u
+
+/* HE TWT Setup command */
+typedef struct wl_twt_setup {
+       /* structure control */
+       uint16 version; /* structure version */
+       uint16 length;  /* data length (starting after this field) */
+       /* peer address */
+       struct ether_addr peer; /* leave it all 0s' for AP */
+       uint8 pad[2];
+       /* setup descriptor */
+       wl_twt_sdesc_t desc;
+
+       /* deprecated - to be removed */
+       uint16 dialog;
+       uint8 pad1[2];
+} wl_twt_setup_t;
+
+/* deprecated -to be removed */
+#define WL_TWT_DIALOG_TOKEN_AUTO 0xFFFF
+
+#define WL_TWT_TEARDOWN_VER    0u
+
+/* twt teardown descriptor */
+typedef struct wl_twt_teardesc {
+       uint8 negotiation_type;
+       uint8 flow_id;          /* must be between 0 and 7 */
+       uint8 bid;              /* must be between 0 and 31 */
+       bool alltwt;            /* all twt teardown - 0 or 1 */
+} wl_twt_teardesc_t;
+
+/* HE TWT Teardown command */
+typedef struct wl_twt_teardown {
+       /* structure control */
+       uint16 version; /* structure version */
+       uint16 length;  /* data length (starting after this field) */
+       /* peer address */
+       struct ether_addr peer; /* leave it all 0s' for AP */
+       wl_twt_teardesc_t teardesc;     /* Teardown descriptor */
+
+       /* deprecated - to be removed */
+       uint8 flow_flags;
+       uint8 flow_id;
+       uint8 bid;
+       uint8 pad;
+} wl_twt_teardown_t;
+
+/* twt information descriptor */
+typedef struct wl_twt_infodesc {
+       uint8 flow_flags;       /* See WL_TWT_INFO_FLAG_XXX below */
+       uint8 flow_id;
+       uint8 pad[2];
+       uint32 next_twt_h;
+       uint32 next_twt_l;
+       /* deprecated - to be removed */
+       uint8 wake_type;
+       uint8 pad1[3];
+} wl_twt_infodesc_t;
+
+/* Flow flags */
+#define WL_TWT_INFO_FLAG_ALL_TWT       (1u << 0u)      /* All TWT */
+#define WL_TWT_INFO_FLAG_RESUME                (1u << 1u)      /* 1 is TWT Resume, 0 is TWT Suspend */
+
+/* deprecated - to be removed */
+#define WL_TWT_INFO_FLAG_RESP_REQ      (1 << 0)        /* Response Requested */
+#define WL_TWT_INFO_FLAG_NEXT_TWT_REQ  (1 << 1)        /* Next TWT Request */
+#define WL_TWT_INFO_FLAG_BTWT_RESCHED  (1 << 2)        /* Broadcast Reschedule */
+typedef wl_twt_infodesc_t wl_twt_idesc_t;
+
+#define WL_TWT_INFO_VER        0u
+
+/* HE TWT Information command */
+typedef struct wl_twt_info {
+       /* structure control */
+       uint16 version; /* structure version */
+       uint16 length;  /* data length (starting after this field) */
+       /* peer address */
+       struct ether_addr peer; /* leave it all 0s' for AP */
+       uint8 pad[2];
+       wl_twt_infodesc_t infodesc;     /* information descriptor */
+       /* deprecated - to be removed */
+       wl_twt_idesc_t desc;
+} wl_twt_info_t;
+
+#define WL_TWT_PEER_STATS_VERSION_1    1u
+typedef struct wl_twt_peer_stats_v1 {
+       uint16  version;
+       uint16  length;
+       struct  ether_addr peer;
+       uint8   PAD[2];
+       uint8   id;
+       uint8   flow_flags;
+       uint8   PAD[2];
+       uint32  sp_seq;         /* sequence number of the service period */
+       uint32  tx_ucast_pkts;
+       uint32  tx_pkts_min;
+       uint32  tx_pkts_max;
+       uint32  tx_pkts_avg;
+       uint32  tx_failures;
+       uint32  rx_ucast_pkts;
+       uint32  rx_pkts_min;
+       uint32  rx_pkts_max;
+       uint32  rx_pkts_avg;
+       uint32  rx_pkts_retried;
+} wl_twt_peer_stats_v1_t;
+
+#define WL_TWT_STATS_VERSION_1         1
+typedef struct wl_twt_stats_v1 {
+       uint16  version;
+       uint16  length;
+       uint32  num_stats;      /* number of peer stats in the peer_stats_list */
+       wl_twt_peer_stats_v1_t  peer_stats_list[];
+} wl_twt_stats_v1_t;
+
+#define WL_TWT_STATS_CMD_VERSION_1     1
+#define WL_TWT_STATS_CMD_FLAGS_RESET   (1u << 0u)
+/* HE TWT stats command */
+typedef struct wl_twt_stats_cmd_v1 {
+       uint16  version;
+       uint16  length;
+       struct ether_addr peer;
+       uint8   PAD[2];
+       uint16  flags;          /* see WL_TWT_STATS_CMD_FLAGS */
+       uint8   num_fid;
+       uint8   num_bid;
+       uint8   fid_list[WL_TWT_STATS_MAX_ITWT];
+       uint8   bid_list[WL_TWT_STATS_MAX_BTWT];
+} wl_twt_stats_cmd_v1_t;
+
+#define WL_TWT_RESP_CFG_VER    0u
+
+#define WL_TWT_CMD_RESP_CFG_TYPE_ALTERNATE     0u
+#define WL_TWT_CMD_RESP_CFG_TYPE_DICTATE       1u
+/* HE TWT resp command */
+typedef struct wl_twt_resp_cfg {
+       /* structure control */
+       uint16 version;         /* Structure version */
+       uint16 length;          /* Data length (starting after this field) */
+       uint8 dc_max;           /* Max supported duty cycle for single TWT */
+       uint8 resp_type;        /* Resp. type(Alt/dict) if duty cycle>max duty cycle */
+} wl_twt_resp_cfg_t;
+
+/* Current version for wlc_clm_power_limits_req_t structure and flags */
+#define WLC_CLM_POWER_LIMITS_REQ_VERSION 1
+/* "clm_power_limits" iovar request structure */
+typedef struct wlc_clm_power_limits_req {
+       /* Input. Structure and flags version */
+       uint32 version;
+       /* Full length of buffer (includes this structure and space for TLV-encoded PPR) */
+       uint32 buflen;
+       /* Input. Flags (see WLC_CLM_POWER_LIMITS_INPUT_FLAG_... below) */
+       uint32 input_flags;
+       /* Input. CC of region whose data is being requested */
+       char cc[WLC_CNTRY_BUF_SZ];
+       /* Input. Channel/subchannel in chanspec_t format */
+       uint32 chanspec;
+       /* Subchannel encoded as clm_limits_type_t */
+       uint32 clm_subchannel;
+       /* Input. 0-based antenna index */
+       uint32 antenna_idx;
+       /* Output. General flags (see WLC_CLM_POWER_LIMITS_OUTPUT_FLAG_... below) */
+       uint32 output_flags;
+       /* Output. 2.4G country flags, encoded as clm_flags_t enum */
+       uint32 clm_country_flags_2g;
+       /* Output. 5G country flags, encoded as clm_flags_t enum */
+       uint32 clm_country_flags_5g;
+       /* Output. Length of TLV-encoded PPR data that follows this structure */
+       uint32 ppr_tlv_size;
+       /* Output. Beginning of buffer for TLV-encoded PPR data */
+       uint8 ppr_tlv[1];
+} wlc_clm_power_limits_req_t;
+
+/* Input. Do not apply SAR limits */
+#define WLC_CLM_POWER_LIMITS_INPUT_FLAG_NO_SAR                         0x00000001
+/* Input. Do not apply board limits */
+#define WLC_CLM_POWER_LIMITS_INPUT_FLAG_NO_BOARD                       0x00000002
+/* Output. Limits taken from product-specific country data */
+#define WLC_CLM_POWER_LIMITS_OUTPUT_FLAG_PRODUCT_LIMITS                        0x00000001
+/* Output. Limits taken from product-specific worldwide data */
+#define WLC_CLM_POWER_LIMITS_OUTPUT_FLAG_WORLDWIDE_LIMITS              0x00000002
+/* Output. Limits taken from country-default (all-product) data */
+#define WLC_CLM_POWER_LIMITS_OUTPUT_FLAG_DEFAULT_COUNTRY_LIMITS                0x00000004
+
+#define WL_MBO_IOV_MAJOR_VER 1
+#define WL_MBO_IOV_MINOR_VER 1
+#define WL_MBO_IOV_MAJOR_VER_SHIFT 8
+#define WL_MBO_IOV_VERSION \
+       ((WL_MBO_IOV_MAJOR_VER << WL_MBO_IOV_MAJOR_VER_SHIFT)| WL_MBO_IOV_MINOR_VER)
+
+#define MBO_MAX_CHAN_PREF_ENTRIES  16
+
+enum wl_mbo_cmd_ids {
+       WL_MBO_CMD_ADD_CHAN_PREF = 1,
+       WL_MBO_CMD_DEL_CHAN_PREF = 2,
+       WL_MBO_CMD_LIST_CHAN_PREF = 3,
+       WL_MBO_CMD_CELLULAR_DATA_CAP = 4,
+       WL_MBO_CMD_DUMP_COUNTERS = 5,
+       WL_MBO_CMD_CLEAR_COUNTERS = 6,
+       WL_MBO_CMD_FORCE_ASSOC = 7,
+       WL_MBO_CMD_BSSTRANS_REJECT = 8,
+       WL_MBO_CMD_SEND_NOTIF = 9,
+       /* Unused command, This enum no can be use
+        * for next new command
+        */
+       WL_MBO_CMD_CLEAR_CHAN_PREF = 10,
+       WL_MBO_CMD_NBR_INFO_CACHE = 11,
+       WL_MBO_CMD_ANQPO_SUPPORT = 12,
+       WL_MBO_CMD_DBG_EVENT_CHECK = 13,
+       WL_MBO_CMD_EVENT_MASK = 14,
+       /* Add before this !! */
+       WL_MBO_CMD_LAST
+};
+
+enum wl_mbo_xtlv_id {
+       WL_MBO_XTLV_OPCLASS            = 0x1,
+       WL_MBO_XTLV_CHAN               = 0x2,
+       WL_MBO_XTLV_PREFERENCE         = 0x3,
+       WL_MBO_XTLV_REASON_CODE        = 0x4,
+       WL_MBO_XTLV_CELL_DATA_CAP      = 0x5,
+       WL_MBO_XTLV_COUNTERS           = 0x6,
+       WL_MBO_XTLV_ENABLE             = 0x7,
+       WL_MBO_XTLV_SUB_ELEM_TYPE      = 0x8,
+       WL_MBO_XTLV_BTQ_TRIG_START_OFFSET = 0x9,
+       WL_MBO_XTLV_BTQ_TRIG_RSSI_DELTA = 0xa,
+       WL_MBO_XTLV_ANQP_CELL_SUPP      = 0xb,
+       WL_MBO_XTLV_BIT_MASK            = 0xc
+};
+
+/* event bit mask flags for MBO */
+#define MBO_EVT_BIT_MASK_CELLULAR_SWITCH        0x0001  /* Evt bit mask to enab cellular switch */
+#define MBO_EVT_BIT_MASK_BTM_REQ_RCVD           0x0002  /* Evt bit mask to enab BTM req rcvd */
+
+typedef struct wl_mbo_counters {
+       /* No of transition req recvd */
+       uint16 trans_req_rcvd;
+       /* No of transition req with disassoc imminent */
+       uint16 trans_req_disassoc;
+       /* No of transition req with BSS Termination */
+       uint16 trans_req_bss_term;
+       /* No of trans req w/ unspecified reason */
+       uint16 trans_resn_unspec;
+       /* No of trans req w/ reason frame loss */
+       uint16 trans_resn_frm_loss;
+       /* No of trans req w/ reason traffic delay */
+       uint16 trans_resn_traffic_delay;
+       /* No of trans req w/ reason insufficient buffer */
+       uint16 trans_resn_insuff_bw;
+       /* No of trans req w/ reason load balance */
+       uint16 trans_resn_load_bal;
+       /* No of trans req w/ reason low rssi */
+       uint16 trans_resn_low_rssi;
+       /* No of trans req w/ reason excessive retransmission */
+       uint16 trans_resn_xcess_retransmn;
+       /* No of trans req w/ reason gray zone */
+       uint16 trans_resn_gray_zone;
+       /* No of trans req w/ reason switch to premium AP */
+       uint16 trans_resn_prem_ap_sw;
+       /* No of transition rejection sent */
+       uint16 trans_rejn_sent;
+       /* No of trans rejn reason excessive frame loss */
+       uint16 trans_rejn_xcess_frm_loss;
+       /* No of trans rejn reason excessive traffic delay */
+       uint16 trans_rejn_xcess_traffic_delay;
+       /* No of trans rejn reason insufficient QoS capability */
+       uint16 trans_rejn_insuffic_qos_cap;
+       /* No of trans rejn reason low RSSI */
+       uint16 trans_rejn_low_rssi;
+       /* No of trans rejn reason high interference */
+       uint16 trans_rejn_high_interference;
+       /* No of trans rejn reason service unavilable */
+       uint16 trans_rejn_service_unavail;
+       /* No of beacon request rcvd */
+       uint16 bcn_req_rcvd;
+       /* No of beacon report sent */
+       uint16 bcn_rep_sent;
+       /* No of null beacon report sent */
+       uint16 null_bcn_rep_sent;
+       /* No of wifi to cell switch */
+       uint16 wifi_to_cell;
+} wl_mbo_counters_t;
+
+#define WL_FILS_IOV_MAJOR_VER 1
+#define WL_FILS_IOV_MINOR_VER 1
+#define WL_FILS_IOV_MAJOR_VER_SHIFT 8
+#define WL_FILS_IOV_VERSION \
+       ((WL_FILS_IOV_MAJOR_VER << WL_FILS_IOV_MAJOR_VER_SHIFT)| WL_FILS_IOV_MINOR_VER)
+
+enum wl_fils_cmd_ids {
+       WL_FILS_CMD_ADD_IND_IE          = 1,
+       WL_FILS_CMD_ADD_AUTH_DATA       = 2,    /* Deprecated, kept to prevent ROM invalidation */
+       WL_FILS_CMD_ADD_HLP_IE          = 3,
+       WL_FILS_CMD_ADD_CONNECT_PARAMS  = 4,
+       WL_FILS_CMD_GET_CONNECT_PARAMS  = 5,
+       /* Add before this !! */
+       WL_FILS_CMD_LAST
+};
+
+enum wl_fils_xtlv_id {
+       WL_FILS_XTLV_IND_IE             = 0x1,
+       WL_FILS_XTLV_AUTH_DATA          = 0x2,  /* Deprecated, kept to prevent ROM invalidation */
+       WL_FILS_XTLV_HLP_IE             = 0x3,
+       WL_FILS_XTLV_ERP_USERNAME       = 0x4,
+       WL_FILS_XTLV_ERP_REALM          = 0x5,
+       WL_FILS_XTLV_ERP_RRK            = 0x6,
+       WL_FILS_XTLV_ERP_NEXT_SEQ_NUM   = 0x7,
+       WL_FILS_XTLV_KEK                = 0x8,
+       WL_FILS_XTLV_PMK                = 0x9,
+       WL_FILS_XTLV_TK                 = 0xa,
+       WL_FILS_XTLV_PMKID              = 0xb
+};
+
+#define WL_OCE_IOV_MAJOR_VER 1
+#define WL_OCE_IOV_MINOR_VER 1
+#define WL_OCE_IOV_MAJOR_VER_SHIFT 8
+#define WL_OCE_IOV_VERSION \
+       ((WL_OCE_IOV_MAJOR_VER << WL_OCE_IOV_MAJOR_VER_SHIFT)| WL_OCE_IOV_MINOR_VER)
+
+enum wl_oce_cmd_ids {
+       WL_OCE_CMD_ENABLE = 1,
+       WL_OCE_CMD_PROBE_DEF_TIME = 2,
+       WL_OCE_CMD_FD_TX_PERIOD = 3,
+       WL_OCE_CMD_FD_TX_DURATION = 4,
+       WL_OCE_CMD_RSSI_TH = 5,
+       WL_OCE_CMD_RWAN_LINKS = 6,
+       WL_OCE_CMD_CU_TRIGGER = 7,
+       /* Add before this !! */
+       WL_OCE_CMD_LAST
+};
+
+enum wl_oce_xtlv_id {
+       WL_OCE_XTLV_ENABLE  = 0x1,
+       WL_OCE_XTLV_PROBE_DEF_TIME  = 0x2,
+       WL_OCE_XTLV_FD_TX_PERIOD    = 0x3,
+       WL_OCE_XTLV_FD_TX_DURATION  = 0x4,
+       WL_OCE_XTLV_RSSI_TH = 0x5,
+       WL_OCE_XTLV_RWAN_LINKS = 0x6,
+       WL_OCE_XTLV_CU_TRIGGER = 0x7
+};
+
+#define WL_ESP_IOV_MAJOR_VER 1
+#define WL_ESP_IOV_MINOR_VER 1
+#define WL_ESP_IOV_MAJOR_VER_SHIFT 8
+#define WL_ESP_IOV_VERSION \
+       ((WL_ESP_IOV_MAJOR_VER << WL_ESP_IOV_MAJOR_VER_SHIFT)| WL_ESP_IOV_MINOR_VER)
+
+enum wl_esp_cmd_ids {
+       WL_ESP_CMD_ENABLE = 1,
+       WL_ESP_CMD_STATIC = 2,
+       /* Add before this !! */
+       WL_ESP_CMD_LAST
+};
+
+enum wl_esp_xtlv_id {
+       WL_ESP_XTLV_ENABLE  = 0x1,
+       WL_ESP_XTLV_STATIC_AC    = 0x2, /* access category */
+       WL_ESP_XTLV_STATIC_TYPE  = 0x3, /* data type */
+       WL_ESP_XTLV_STATIC_VAL   = 0x4
+};
+
+/* otpread command */
+#define WL_OTPREAD_VER 1
+
+typedef struct {
+       uint16 version;         /* cmd structure version */
+       uint16 cmd_len;         /* cmd struct len */
+       uint32 rdmode;          /* otp read mode */
+       uint32 rdoffset;        /* byte offset into otp to start read */
+       uint32 rdsize;          /* number of bytes to read */
+} wl_otpread_cmd_t;
+
+/* "otpecc_rows" command */
+typedef struct {
+       uint16 version;         /* version of this structure */
+       uint16 len;                     /* len in bytes of this structure */
+       uint32 cmdtype;         /* command type : 0 : read row data, 1 : ECC lock  */
+       uint32 rowoffset;       /* start row offset */
+       uint32 numrows;         /* number of rows */
+       uint8  rowdata[];       /* read rows data */
+} wl_otpecc_rows_t;
+
+#define WL_OTPECC_ROWS_VER  1
+
+#define WL_OTPECC_ROWS_CMD_READ  0
+#define WL_OTPECC_ROWS_CMD_LOCK  1
+
+#define WL_OTPECC_ARGIDX_CMDTYPE               0       /* command type */
+#define WL_OTPECC_ARGIDX_ROWOFFSET             1       /* start row offset */
+#define WL_OTPECC_ARGIDX_NUMROWS               2       /* number of rows */
+
+/* "otpeccrows" raw data size per row */
+#define WL_ECCDUMP_ROW_SIZE_BYTE       6 /* 4 bytes row data + 2 bytes ECC status */
+#define WL_ECCDUMP_ROW_SIZE_WORD       3
+
+/* otpECCstatus */
+#define OTP_ECC_ENAB_SHIFT             13
+#define OTP_ECC_ENAB_MASK              0x7
+#define OTP_ECC_CORR_ST_SHIFT  12
+#define OTP_ECC_CORR_ST_MASK   0x1
+#define OTP_ECC_DBL_ERR_SHIFT  11
+#define OTP_ECC_DBL_ERR_MASK   0x1
+#define OTP_ECC_DED_ST_SHIFT   10
+#define OTP_ECC_DED_ST_MASK            0x1
+#define OTP_ECC_SEC_ST_SHIFT   9
+#define OTP_ECC_SEC_ST_MASK            0x1
+#define OTP_ECC_DATA_SHIFT             0
+#define OTP_ECC_DATA_MASK              0x7f
+
+/* OTP_ECC_CORR_ST field */
+#define OTP_ECC_MODE           1
+#define OTP_NO_ECC_MODE                0
+
+/* OTP_ECC_ENAB field (bit15:13) :
+ * When 2 or 3 bits are set,
+ * it indicates that OTP ECC is enabled on the last row read.
+ * Otherwise, ECC is disabled
+ */
+#define OTP_ECC_ENAB(val) \
+       (bcm_bitcount((uint8 *)&(val), sizeof(uint8)) > 1)
+
+/* otp command details */
+#define WL_OTP_IOV_MAJOR_VER           1u
+#define WL_OTP_IOV_MINOR_VER           1u
+#define WL_OTP_IOV_MAJOR_VER_SHIFT     8u
+#define WL_OTP_IOV_VERSION \
+               ((WL_OTP_IOV_MAJOR_VER << WL_OTP_IOV_MAJOR_VER_SHIFT) | WL_OTP_IOV_MINOR_VER)
+
+#define OTP_RGN_NONE   0x0u
+#define OTP_RGN_HW     0x1u
+#define OTP_RGN_SW     0x2u
+
+enum wl_otp_cmd_ids {
+       WL_OTP_CMD_RGNSTATUS    = 0x1,
+       WL_OTP_CMD_RGNDUMP      = 0x2,
+       WL_OTP_CMD_RGNWRITE     = 0x3,
+       /* Add before this !!! */
+       WL_OTP_CMD_LAST
+};
+
+enum wl_otp_xtlv_id {
+       WL_OTP_XTLV_RGN         = 0x1,
+       WL_OTP_XTLV_ADDR        = 0x2,
+       WL_OTP_XTLV_SIZE        = 0x3,
+       WL_OTP_XTLV_DATA        = 0x4
+};
+
+#define WL_LEAKY_AP_STATS_GT_TYPE      0
+#define WL_LEAKY_AP_STATS_PKT_TYPE     1
+typedef struct wlc_leaked_infra_guard_marker {
+       /* type field for this TLV: WL_LEAKY_AP_STATS_GT_TYPE */
+       uint16  type;
+       /* length field for this TLV */
+       uint16  len;
+       /* guard sample sequence number; Updated by 1 on every guard sample */
+       uint32  seq_number;
+       /* Guard time start time (tsf; PS indicated and acked) */
+       uint32  start_time;
+       /* tsf timestamp for the GT end event */
+       uint32  gt_tsf_l;
+       /* Guard time period in ms */
+       uint16  guard_duration;
+       /* Number PPDUs in the notification */
+       uint16  num_pkts;
+       /* Flags to indicate some states see below */
+       uint8   flag;
+       /* pad for 32-bit alignment */
+       uint8   reserved[3];
+} wlc_leaked_infra_guard_marker_t;
+
+/* Flag information */
+#define WL_LEAKED_GUARD_TIME_NONE      0               /* Not in any guard time */
+#define WL_LEAKED_GUARD_TIME_FRTS      (0x01 << 0)     /* Normal FRTS power save */
+#define WL_LEAKED_GUARD_TIME_SCAN      (0x01 << 1)     /* Channel switch due to scanning */
+
+#define WL_LEAKED_GUARD_TIME_INFRA_STA (0x01 << 4)     /* generic type infra sta channel switch */
+#define WL_LEAKED_GUARD_TIME_TERMINATED (0x01 << 7)     /* indicate a GT is terminated early */
+
+typedef struct wlc_leaked_infra_packet_stat {
+       uint16  type;                   /* type field for this TLV: WL_LEAKY_AP_STATS_PKT_TYPE */
+       uint16  len;                    /* length field for this TLV */
+       uint16  ppdu_len_bytes;         /* PPDU packet length in bytes */
+       uint16  num_mpdus;              /* number of the MPDUs in the PPDU */
+       uint32  ppdu_time;              /* PPDU arrival time at the begining of the guard time */
+       uint32  rate;                   /* PPDU packet rate; Received packet's data rate */
+       uint16  seq_number;             /* sequence number */
+       int8    rssi;                   /* RSSI */
+       uint8   tid;                    /* tid */
+} wlc_leaked_infra_packet_stat_t;
+
+/* Wake timer structure definition */
+#define WAKE_TIMER_VERSION 1
+#define WAKE_TIMER_NOLIMIT 0xFFFF
+
+typedef struct wake_timer {
+       uint16 ver;
+       uint16 len;
+       uint16 limit;   /* number of events to deliver
+                       * 0-disable, 0xffff-indefinite, num_events otherwise
+                       */
+       uint16 count;   /* number of events delivered since enable (get only) */
+       uint16 period;  /* timeout/period in milliseconds */
+} wake_timer_t;
+
+typedef struct wl_desense_restage_gain {
+       uint16 version;
+       uint16 length;
+       uint32 band;
+       uint8 num_cores;
+       uint8 desense_array[WL_TX_CHAINS_MAX];
+       uint8 PAD[3];
+} wl_desense_restage_gain_t;
+
+#define MAX_UCM_CHAINS 5
+#define MAX_UCM_PROFILES 10
+#define UCM_PROFILE_VERSION_1 1
+
+/* UCM per chain attribute struct */
+typedef struct wlc_btcx_chain_attr {
+       uint16 length;                  /* chain attr length, version is same as profile version */
+       int8 desense_level;             /* per chain desense level */
+       int8 ack_pwr_strong_rssi;       /* per chain ack power at strong rssi */
+       int8 ack_pwr_weak_rssi;         /* per chain ack power at weak rssi */
+       int8 tx_pwr_strong_rssi;        /* per chain tx power at strong rssi */
+       int8 tx_pwr_weak_rssi;          /* per chain tx power at weak rssi */
+       uint8 PAD[1];                   /* additional bytes for alignment */
+} wlc_btcx_chain_attr_t;
+
+typedef struct wlc_btcx_profile_v1 {
+       uint16 version;                 /* UCM profile version */
+       uint16 length;                  /* profile size */
+       uint16 fixed_length;            /* size of the fixed portion of the profile */
+       uint8 init;                     /* profile initialized or not */
+       uint8 chain_attr_count;         /* Number of elements in chain_attr array */
+       uint8 profile_index;            /* profile index */
+       uint8 mode_strong_wl_bt;        /* Mode under strong WLAN and BT RSSI */
+       uint8 mode_weak_wl;             /* Mode under weak WLAN RSSI */
+       uint8 mode_weak_bt;             /* Mode under weak BT RSSI */
+       uint8 mode_weak_wl_bt;          /* Mode under weak BT and WLAN RSSI */
+       int8 mode_wl_hi_lo_rssi_thresh; /* Strong to weak WLAN RSSI threshold for mode selection */
+       int8 mode_wl_lo_hi_rssi_thresh; /* Weak to strong WLAN RSSI threshold for mode selection */
+       int8 mode_bt_hi_lo_rssi_thresh; /* Strong to weak BT RSSI threshold for mode selection */
+       int8 mode_bt_lo_hi_rssi_thresh; /* Weak to strong BT RSSI threshold for mode selection */
+       int8 desense_wl_hi_lo_rssi_thresh;      /* Strong to weak RSSI threshold for desense */
+       int8 desense_wl_lo_hi_rssi_thresh;      /* Weak to strong RSSI threshold for desense */
+       int8 ack_pwr_wl_hi_lo_rssi_thresh;      /* Strong to weak RSSI threshold for ACK power */
+       int8 ack_pwr_wl_lo_hi_rssi_thresh;      /* Weak to strong RSSI threshold for ACK power */
+       int8 tx_pwr_wl_hi_lo_rssi_thresh;       /* Strong to weak RSSI threshold for Tx power */
+       int8 tx_pwr_wl_lo_hi_rssi_thresh;       /* Weak to strong RSSI threshold for Tx power */
+       uint8 PAD[1];                           /* additional bytes for 4 byte alignment */
+       wlc_btcx_chain_attr_t chain_attr[];     /* variable length array with chain attributes */
+} wlc_btcx_profile_v1_t;
+
+#define SSSR_D11_RESET_SEQ_STEPS   5u
+#define SSSR_HWA_RESET_SEQ_STEPS   8u
+
+#define SSSR_REG_INFO_VER_0    0u
+#define SSSR_REG_INFO_VER_1    1u
+#define SSSR_REG_INFO_VER_2    2u
+#define SSSR_REG_INFO_VER_3    3u
+
+typedef struct sssr_reg_info_v0 {
+       uint16 version;
+       uint16 length;  /* length of the structure validated at host */
+       struct {
+               struct {
+                       uint32 pmuintmask0;
+                       uint32 pmuintmask1;
+                       uint32 resreqtimer;
+                       uint32 macresreqtimer;
+                       uint32 macresreqtimer1;
+               } base_regs;
+       } pmu_regs;
+       struct {
+               struct {
+                       uint32 intmask;
+                       uint32 powerctrl;
+                       uint32 clockcontrolstatus;
+                       uint32 powerctrl_mask;
+               } base_regs;
+       } chipcommon_regs;
+       struct {
+               struct {
+                       uint32 clockcontrolstatus;
+                       uint32 clockcontrolstatus_val;
+               } base_regs;
+               struct {
+                       uint32 resetctrl;
+                       uint32 itopoobb;
+               } wrapper_regs;
+       } arm_regs;
+       struct {
+               struct {
+                       uint32 ltrstate;
+                       uint32 clockcontrolstatus;
+                       uint32 clockcontrolstatus_val;
+               } base_regs;
+               struct {
+                       uint32 itopoobb;
+               } wrapper_regs;
+       } pcie_regs;
+       struct {
+               struct {
+                       uint32 ioctrl;
+               } wrapper_regs;
+               uint32 vasip_sr_addr;
+               uint32 vasip_sr_size;
+       } vasip_regs;
+       struct {
+               struct {
+                       uint32 xmtaddress;
+                       uint32 xmtdata;
+                       uint32 clockcontrolstatus;
+                       uint32 clockcontrolstatus_val;
+               } base_regs;
+               struct {
+                       uint32 resetctrl;
+                       uint32 itopoobb;
+                       uint32 ioctrl;
+                       uint32 ioctrl_resetseq_val[SSSR_D11_RESET_SEQ_STEPS];
+               } wrapper_regs;
+               uint32 sr_size;
+       } mac_regs[MAX_NUM_D11CORES];
+} sssr_reg_info_v0_t;
+
+typedef struct sssr_reg_info_v1 {
+       uint16 version;
+       uint16 length;  /* length of the structure validated at host */
+       struct {
+               struct {
+                       uint32 pmuintmask0;
+                       uint32 pmuintmask1;
+                       uint32 resreqtimer;
+                       uint32 macresreqtimer;
+                       uint32 macresreqtimer1;
+               } base_regs;
+       } pmu_regs;
+       struct {
+               struct {
+                       uint32 intmask;
+                       uint32 powerctrl;
+                       uint32 clockcontrolstatus;
+                       uint32 powerctrl_mask;
+               } base_regs;
+       } chipcommon_regs;
+       struct {
+               struct {
+                       uint32 clockcontrolstatus;
+                       uint32 clockcontrolstatus_val;
+               } base_regs;
+               struct {
+                       uint32 resetctrl;
+                       uint32 itopoobb;
+               } wrapper_regs;
+       } arm_regs;
+       struct {
+               struct {
+                       uint32 ltrstate;
+                       uint32 clockcontrolstatus;
+                       uint32 clockcontrolstatus_val;
+               } base_regs;
+               struct {
+                       uint32 itopoobb;
+               } wrapper_regs;
+       } pcie_regs;
+       struct {
+               struct {
+                       uint32 ioctrl;
+               } wrapper_regs;
+               uint32 vasip_sr_addr;
+               uint32 vasip_sr_size;
+       } vasip_regs;
+       struct {
+               struct {
+                       uint32 xmtaddress;
+                       uint32 xmtdata;
+                       uint32 clockcontrolstatus;
+                       uint32 clockcontrolstatus_val;
+               } base_regs;
+               struct {
+                       uint32 resetctrl;
+                       uint32 itopoobb;
+                       uint32 ioctrl;
+                       uint32 ioctrl_resetseq_val[SSSR_D11_RESET_SEQ_STEPS];
+               } wrapper_regs;
+               uint32 sr_size;
+       } mac_regs[MAX_NUM_D11CORES];
+       struct {
+               uint32 dig_sr_addr;
+               uint32 dig_sr_size;
+       } dig_mem_info;
+} sssr_reg_info_v1_t;
+
+#define MAX_NUM_D11_CORES_WITH_SCAN    3u
+
+typedef struct sssr_reg_info_v2 {
+       uint16 version;
+       uint16 length;  /* length of the structure validated at host */
+       struct {
+               struct {
+                       uint32 pmuintmask0;
+                       uint32 pmuintmask1;
+                       uint32 resreqtimer;
+                       uint32 macresreqtimer;
+                       uint32 macresreqtimer1;
+                       uint32 macresreqtimer2;
+               } base_regs;
+       } pmu_regs;
+       struct {
+               struct {
+                       uint32 intmask;
+                       uint32 powerctrl;
+                       uint32 clockcontrolstatus;
+                       uint32 powerctrl_mask;
+               } base_regs;
+       } chipcommon_regs;
+       struct {
+               struct {
+                       uint32 clockcontrolstatus;
+                       uint32 clockcontrolstatus_val;
+               } base_regs;
+               struct {
+                       uint32 resetctrl;
+                       uint32 extrsrcreq;
+               } wrapper_regs;
+       } arm_regs;
+       struct {
+               struct {
+                       uint32 ltrstate;
+                       uint32 clockcontrolstatus;
+                       uint32 clockcontrolstatus_val;
+               } base_regs;
+               struct {
+                       uint32 extrsrcreq;
+               } wrapper_regs;
+       } pcie_regs;
+       struct {
+               struct {
+                       uint32 xmtaddress;
+                       uint32 xmtdata;
+                       uint32 clockcontrolstatus;
+                       uint32 clockcontrolstatus_val;
+               } base_regs;
+               struct {
+                       uint32 resetctrl;
+                       uint32 extrsrcreq;
+                       uint32 ioctrl;
+                       uint32 ioctrl_resetseq_val[SSSR_D11_RESET_SEQ_STEPS];
+               } wrapper_regs;
+               uint32 sr_size;
+       } mac_regs[MAX_NUM_D11_CORES_WITH_SCAN];
+       struct {
+               uint32 dig_sr_addr;
+               uint32 dig_sr_size;
+       } dig_mem_info;
+} sssr_reg_info_v2_t;
+
+typedef struct sssr_reg_info_v3 {
+       uint16 version;
+       uint16 length;  /* length of the structure validated at host */
+       struct {
+               struct {
+                       uint32 pmuintmask0;
+                       uint32 pmuintmask1;
+                       uint32 resreqtimer;
+                       uint32 macresreqtimer;
+                       uint32 macresreqtimer1;
+                       uint32 macresreqtimer2;
+               } base_regs;
+       } pmu_regs;
+       struct {
+               struct {
+                       uint32 intmask;
+                       uint32 powerctrl;
+                       uint32 clockcontrolstatus;
+                       uint32 powerctrl_mask;
+               } base_regs;
+       } chipcommon_regs;
+       struct {
+               struct {
+                       uint32 clockcontrolstatus;
+                       uint32 clockcontrolstatus_val;
+               } base_regs;
+               struct {
+                       uint32 resetctrl;
+                       uint32 extrsrcreq;
+               } wrapper_regs;
+       } arm_regs;
+       struct {
+               struct {
+                       uint32 ltrstate;
+                       uint32 clockcontrolstatus;
+                       uint32 clockcontrolstatus_val;
+               } base_regs;
+               struct {
+                       uint32 extrsrcreq;
+               } wrapper_regs;
+       } pcie_regs;
+       struct {
+               struct {
+                       uint32 xmtaddress;
+                       uint32 xmtdata;
+                       uint32 clockcontrolstatus;
+                       uint32 clockcontrolstatus_val;
+               } base_regs;
+               struct {
+                       uint32 resetctrl;
+                       uint32 extrsrcreq;
+                       uint32 ioctrl;
+                       uint32 ioctrl_resetseq_val[SSSR_D11_RESET_SEQ_STEPS];
+               } wrapper_regs;
+               uint32 sr_size;
+       } mac_regs[MAX_NUM_D11_CORES_WITH_SCAN];
+       struct {
+               uint32 dig_sr_addr;
+               uint32 dig_sr_size;
+       } dig_mem_info;
+       uint32 fis_enab;
+       struct {
+               struct {
+                       uint32 clkenable;
+                       uint32 clkgatingenable;
+                       uint32 clkext;
+                       uint32 clkctlstatus;
+               } base_regs;
+               struct {
+                       uint32 ioctrl;
+                       uint32 resetctrl;
+               } wrapper_regs;
+               uint32 hwa_resetseq_val[SSSR_HWA_RESET_SEQ_STEPS];
+       } hwa_regs;
+} sssr_reg_info_v3_t;
+
+#ifndef SSSR_REG_INFO_HAS_ALIAS
+typedef sssr_reg_info_v0_t sssr_reg_info_t;
+#define SSSR_REG_INFO_VER SSSR_REG_INFO_VER_0
+#endif
+
+/* A wrapper structure for all versions of SSSR register information structures */
+typedef union sssr_reg_info {
+       sssr_reg_info_v0_t rev0;
+       sssr_reg_info_v1_t rev1;
+       sssr_reg_info_v2_t rev2;
+       sssr_reg_info_v3_t rev3;
+} sssr_reg_info_cmn_t;
+
+/* ADaptive Power Save(ADPS) structure definition */
+#define WL_ADPS_IOV_MAJOR_VER  1
+#define WL_ADPS_IOV_MINOR_VER  0
+#define WL_ADPS_IOV_MAJOR_VER_SHIFT    8
+#define WL_ADPS_IOV_VER \
+       ((WL_ADPS_IOV_MAJOR_VER << WL_ADPS_IOV_MAJOR_VER_SHIFT) | WL_ADPS_IOV_MINOR_VER)
+
+#define ADPS_NUM_DIR   2
+#define ADPS_RX                0
+#define ADPS_TX                1
+
+#define WL_ADPS_IOV_MODE       0x0001
+#define WL_ADPS_IOV_RSSI       0x0002
+#define WL_ADPS_IOV_DUMP       0x0003
+#define WL_ADPS_IOV_DUMP_CLEAR 0x0004
+#define WL_ADPS_IOV_SUSPEND    0x0005
+#define WL_ADPS_IOV_GAIN        0x0006
+#define WL_ADPS_IOV_RESET_GAIN  0x0007
+
+#define ADPS_SUMMARY_STEP_NUM   2
+#define ADPS_SUMMARY_STEP_LOW  0
+#define ADPS_SUMMARY_STEP_HIGH 1
+
+#define ADPS_SUB_IOV_VERSION_1 1
+#define ADPS_SUB_IOV_VERSION_2 2
+
+/* suspend/resume ADPS by wl/private command from host */
+#define ADPS_RESUME    0u
+#define ADPS_SUSPEND   1u
+
+typedef struct wl_adps_params_v1 {
+       uint16 version;
+       uint16 length;
+       uint8 band;             /* band - 2G or 5G */
+       uint8 mode;             /* operation mode, default = 0 (ADPS disable) */
+       uint16 padding;
+} wl_adps_params_v1_t;
+
+typedef struct wl_adps_rssi {
+       int32 thresh_hi;        /* rssi threshold to resume ADPS operation */
+       int32 thresh_lo;        /* rssi threshold to suspend ADPS operation */
+} wl_adps_rssi_t;
+
+typedef struct wl_adps_rssi_params_v1 {
+       uint16 version;
+       uint16 length;
+       uint8 band;
+       uint8 padding[3];
+       wl_adps_rssi_t rssi;
+} wl_adps_rssi_params_v1_t;
+
+typedef struct adps_stat_elem {
+       uint32 duration;        /* each step duration time (mSec) */
+       uint32 counts;          /* each step hit count number */
+} adps_stat_elem_t;
+
+typedef struct wl_adps_dump_summary_v1 {
+       uint16 version;
+       uint16 length;
+       uint8 mode;                                     /* operation mode: On/Off */
+       uint8 flags;                                    /* restrict flags */
+       uint8 current_step;                             /* current step */
+       uint8 padding;
+       adps_stat_elem_t stat[ADPS_SUMMARY_STEP_NUM];   /* statistics */
+} wl_adps_dump_summary_v1_t;
+
+typedef struct wl_adps_dump_summary_v2 {
+       uint16 version;
+       uint16 length;
+       uint8 mode;                                     /* operation mode: On/Off */
+       uint8 current_step;                             /* current step */
+       uint8 padding[2];
+       uint32 flags;                                   /* restrict flags */
+       adps_stat_elem_t stat[ADPS_SUMMARY_STEP_NUM];   /* statistics */
+} wl_adps_dump_summary_v2_t;
+
+typedef struct wl_adps_suspend_v1 {
+       uint16 version;
+       uint16 length;
+       uint8 suspend;                  /* 1: suspend 0: resume */
+       uint8 padding[3];
+} wl_adps_suspend_v1_t;
+
+/* For ADPS energy gain */
+typedef struct wlc_adps_energy_gain_data {
+       uint32  pm_dur_gain;    /* gain of pm duration by ADPS */
+       uint32  step0_dur;      /* duration of ADPS STEP0(PM MAX + PSPOLL PRD) */
+       uint32  wake_up_dur;    /* duration of wake up state  */
+       uint32  pad;
+       uint64  tx_tot_bytes;   /* Total Tx bytes */
+} wlc_adps_energy_gain_data_t;
+
+typedef struct wl_adps_energy_gain_v1 {
+       uint16 version;
+       uint16 length;
+       uint32 pad;
+       wlc_adps_energy_gain_data_t gain_data[MAX_BANDS];
+} wl_adps_energy_gain_v1_t;
+
+typedef struct wlc_btc_2gchain_dis {
+       uint16 ver;
+       uint16 len;
+       uint8 chain_dis;
+       uint8 flag;
+} wlc_btc_2gchain_dis_t;
+
+/* TDLS structure definition */
+#define WL_TDLS_T_VERSION_V1   1
+typedef struct wl_tdls_dump_summary_v1 {
+       uint16 version;
+       uint16 length;          /* length of the entire structure */
+       uint32 txsetupreq;      /* tdls setup req sent */
+       uint32 txsetupresp;     /* tdls setup resp sent */
+       uint32 txsetupcfm;      /* tdls setup confirm sent */
+       uint32 txteardown;      /* tdls teardwon frames sent */
+       uint32 txptireq;        /* tdls pti req frames sent */
+       uint32 txptiresp;       /* tdls pti resp frames sent */
+       uint32 txchswreq;       /* tdls chsw req frames sent */
+       uint32 txchswresp;      /* tdls chsw resp frame sent */
+       uint32 rxsetupreq;      /* tdls setup req rcvd */
+       uint32 rxdsetupresp;    /* tdls setup resp rcvd */
+       uint32 rxsetupcfm;      /* tdls setup confirm rcvd */
+       uint32 rxteardown;      /* tdls teardown frames rcvd */
+       uint32 rxptireq;        /* tdls pti req frames rcvd */
+       uint32 rxptiresp;       /* tdls pti resp frames rcvd */
+       uint32 rxchswreq;       /* tdls chsw req frames rcvd */
+       uint32 rxchswresp;      /* tdls chsw resp frames rcvd */
+       uint32 discard;         /* frames discarded due to full buffer */
+       uint32 ubuffered;       /* frames buffered by TDLS txmod */
+       uint32 buf_reinserted;  /* frames reinserted */
+       uint32 idletime;        /* time since no traffic on tdls link */
+       uint32 uptime;          /* time since  tdls link connected */
+       uint32 tx_cnt;          /* frames txed over tdls link */
+       uint32 rx_cnt;          /* frames rcvd over tdls link */
+       uint32 blist_cnt;       /* number of tdls black list */
+       uint32 scb_flags;       /* connected tdls scb flags */
+       struct ether_addr peer_addr;    /* connected peer addr */
+       uint8 padding[2];
+} wl_tdls_dump_summary_v1_t;
+
+#define WLC_BTC_2GCHAIN_DIS_REASSOC    0x1
+#define WLC_BTC_2GCHAIN_DIS_VER1       0x1
+#define WLC_BTC_2GCHAIN_DIS_VER1_LEN   6
+
+/* --- BTCX WiFi Protection (btc_wifi_prot iovar) --- */
+
+/* Current iovar structure version: 1 */
+#define WL_BTC_WIFI_PROT_VER_1 1
+
+typedef struct wl_btc_wifi_prot_v1 {
+       uint16 ver;     /* version */
+       uint16 len;     /* total length */
+       uint8 data[];   /* bcm_xtlv_t payload */
+} wl_btc_wifi_prot_v1_t;
+
+/* Xtlv tags (protection type) and data */
+#define WL_BTC_WIFI_PROT_M1_M4 1
+typedef struct wl_btc_wifi_prot_m1_m4 {
+       uint32 enable;  /* enable/disable m1-m4 protection */
+       uint32 timeout; /* maximum timeout in ms (0: default) */
+} wl_btc_wifi_prot_m1_m4_t;
+
+#define WL_BTC_WIFI_PROT_ENABLE                1
+#define WL_BTC_WIFI_PROT__DISABLE      0
+
+/* --- End BTCX WiFi Protection --- */
+
+/* --- BTCX ULMU disable (btc_ulmu_config iovar) --- */
+
+/* Version number */
+#define WL_BTC_ULMU_CONFIG_VER_1 1
+typedef struct wl_btc_ulmu_config_v1 {
+       uint16 version;                 /* btc_ulmu_config version */
+       uint16 len;                     /* Total length */
+       uint32 ulmu_bt_task_bm;         /* BT Task bimtap for ULMU disable */
+       uint32 ulmu_bt_period_th;       /* BT period thresh for ULMU disable */
+} wl_btc_ulmu_config_v1_t;
+
+/* --- End BTCX ULMU config --- */
+
+#define RPSNOA_IOV_MAJOR_VER 1
+#define RPSNOA_IOV_MINOR_VER 1
+#define RPSNOA_IOV_MAJOR_VER_SHIFT 8
+#define RPSNOA_IOV_VERSION \
+       ((RPSNOA_IOV_MAJOR_VER << RPSNOA_IOV_MAJOR_VER_SHIFT)| RPSNOA_IOV_MINOR_VER)
+
+enum wl_rpsnoa_cmd_ids {
+       WL_RPSNOA_CMD_ENABLE = 1,
+       WL_RPSNOA_CMD_STATUS,
+       WL_RPSNOA_CMD_PARAMS,
+       WL_RPSNOA_CMD_LAST
+};
+
+typedef struct rpsnoa_cmnhdr {
+       uint16 ver;             /* cmd structure version */
+       uint16 len;             /* cmd structure len */
+       uint32 subcmd;
+       uint32 cnt;
+} rpsnoa_cmnhdr_t;
+
+typedef struct rpsnoa_data {
+       int16 band;
+       int16 value;
+} rpsnoa_data_t;
+
+typedef struct rpsnoa_stats {
+       int16 band;
+       int16 state;
+       uint32 sleep_dur;
+       uint32 sleep_avail_dur;
+       uint32 last_pps;
+} rpsnoa_stats_t;
+
+typedef struct rpsnoa_param {
+       uint16 band;
+       uint8 level;
+       uint8 stas_assoc_check;
+       uint32 pps;
+       uint32 quiet_time;
+} rpsnoa_param_t;
+
+typedef struct rpsnoa_iovar {
+       rpsnoa_cmnhdr_t hdr;
+       rpsnoa_data_t data[1];
+} rpsnoa_iovar_t;
+
+typedef struct rpsnoa_iovar_status {
+       rpsnoa_cmnhdr_t hdr;
+       rpsnoa_stats_t stats[1];
+} rpsnoa_iovar_status_t;
+
+typedef struct rpsnoa_iovar_params {
+       rpsnoa_cmnhdr_t hdr;
+       rpsnoa_param_t param[1];
+} rpsnoa_iovar_params_t;
+
+/* Per-interface reportable stats types */
+enum wl_ifstats_xtlv_id {
+       /* global */
+       WL_IFSTATS_XTLV_SLICE_INDEX = 1,
+       WL_IFSTATS_XTLV_IF_INDEX = 2,
+       WL_IFSTATS_XTLV_MAC_ADDR = 3,
+       WL_IFSTATS_XTLV_REPORT_CMD = 4, /* Comes in an iovar */
+       WL_IFSTATS_XTLV_BUS_PCIE = 5,
+       WL_STATS_XTLV_BUS_PCIE_TX_HISTOGRAMS = 6,
+       WL_STATS_XTLV_BUS_PCIE_TX_QUEUE_DEPTH = 7,
+       /* history of blocks freed most recently */
+       WL_STATS_XTLV_FBINFO_STATS = 8,
+
+       /* Report data across all SCBs using ecounters */
+       /* STA_info ecounters */
+       WL_IFSTATS_XTLV_WL_STA_INFO_ECOUNTERS = 0x100,
+       /* For AMPDU stat sub-types requested in a different format */
+       /* these could be sum and report stats across slices. OR
+        * report sub-types in pairs so host can sum and add.
+        * Information sent here is across slices, therefore global
+        */
+       WL_IFSTATS_XTLV_TX_AMPDU_STATS = 0x101,
+       WL_IFSTATS_XTLV_RX_AMPDU_STATS = 0x102,
+       /* scb ecounter statistics */
+       WL_IFSTATS_XTLV_SCB_ECOUNTERS = 0x103,
+       /* Global NAN stats */
+       WL_IFSTATS_XTLV_NAN_STATS = 0x104,
+       WL_IFSTATS_XTLV_CHAN_STATS = 0x105,
+       /* TDLS state */
+       WL_IFSTATS_XTLV_IF_TDLS_STATE = 0x106,
+       WL_IFSTATS_XTLV_KEY_PLUMB_INFO = 0x107,
+       /* HE TX related stats */
+       WL_IFSTATS_XTLV_HE_TXMU_STATS = 0x108,
+
+       WL_IFSTATS_XTLV_SC_PERIODIC_STATE = 0x109,
+       WL_IFSTATS_XTLV_WBUS_PERIODIC_STATE = 0x10A,
+
+       /* Per-slice information
+        * Per-interface reporting could also include slice specific data
+        */
+       /* xtlv container for reporting */
+       WL_IFSTATS_XTLV_WL_SLICE = 0x301,
+       /* Per-slice AMPDU stats */
+       WL_IFSTATS_XTLV_WL_SLICE_TX_AMPDU_DUMP = 0x302,
+       WL_IFSTATS_XTLV_WL_SLICE_RX_AMPDU_DUMP = 0x303,
+       /* Per-slice BTCOEX stats */
+       WL_IFSTATS_XTLV_WL_SLICE_BTCOEX = 0x304,
+       /* V11_WLCNTRS used in ecounters */
+       WL_IFSTATS_XTLV_WL_SLICE_V11_WLCNTRS = 0x305,
+       /* V30_WLCNTRS Used in ecounters */
+       WL_IFSTATS_XTLV_WL_SLICE_V30_WLCNTRS = 0x306,
+       /* phy,ucode,scan pwrstats */
+       WL_IFSTATS_XTLV_WL_SLICE_PWRSTATS_PHY = 0x307,
+       WL_IFSTATS_XTLV_WL_SLICE_PWRSTATS_SCAN = 0x308,
+       WL_IFSTATS_XTLV_WL_SLICE_PWRSTATS_WAKE_V2 = 0x309,
+       /* Per-slice LTECOEX stats */
+       WL_IFSTATS_XTLV_WL_SLICE_LTECOEX = 0x30A,
+       /* TVPM ecounters */
+       WL_IFSTATS_XTLV_WL_SLICE_TVPM = 0x30B,
+       /* TDMTX ecounters */
+       WL_IFSTATS_XTLV_WL_SLICE_TDMTX = 0x30C,
+       /* Slice specific state capture in periodic fasion */
+       WL_SLICESTATS_XTLV_PERIODIC_STATE = 0x30D,
+       WL_SLICESTATS_XTLV_HIST_TX_STATS = 0x30E,
+       WL_SLICESTATS_XTLV_HIST_RX_STATS = 0x30F,
+       /* TX histograms */
+       WL_STATS_XTLV_WL_SLICE_TX_HISTOGRAMS = 0x310,
+       /* TX queue depth */
+       WL_STATS_XTLV_WL_SLICE_TX_QUEUE_DEPTH = 0x311,
+       /* Latency instrumentation debug */
+       WL_STATS_XTLV_WL_QUEUE_STOP = 0x312,
+       /* Beamforming counters */
+       WL_IFSTATS_XTLV_WL_SLICE_TXBF = 0x313,
+       /* Per-slice BTCOEX task duration stats */
+       WL_IFSTATS_XTLV_WL_SLICE_BTCOEX_TSKDUR_STATS = 0x314,
+       /* Per-slice RC1 COEX (NR5G Coex) stats */
+       WL_IFSTATS_XTLV_WL_SLICE_NR5GCX = 0x315,
+       /* Per-slice sta offload stats */
+       WL_IFSTATS_XTLV_WL_SLICE_STA_OFLD_STATS = 0x316,
+       /* Per-Slice [only aux] btcec sc stats */
+       WL_IFSTATS_XTLV_WL_SLICE_BTCEC_PERIODIC_STATS = 0x317,
+       /* Per-Slice sc lq stats */
+       WL_IFSTATS_XTLV_SC_CHANIM_PERIODIC_STATS = 0x318,
+       /* Per-slice RC2 COEX stats */
+       WL_IFSTATS_XTLV_WL_SLICE_RC2CX = 0x319,
+
+       /* Per-interface */
+       /* XTLV container for reporting */
+       WL_IFSTATS_XTLV_IF = 0x501,
+       /* Generic stats applicable to all IFs */
+       WL_IFSTATS_XTLV_GENERIC = 0x502,
+       /* Infra specific */
+       WL_IFSTATS_XTLV_INFRA_SPECIFIC = 0x503,
+       /* MGT counters infra and softAP */
+       WL_IFSTATS_XTLV_MGT_CNT = 0x504,
+       /* AMPDU stats on per-IF */
+       WL_IFSTATS_XTLV_AMPDU_DUMP = 0x505,
+       WL_IFSTATS_XTLV_IF_SPECIFIC = 0x506,
+
+       WL_IFSTATS_XTLV_IF_LQM = 0x508,
+       /* Interface specific state capture in periodic fashion */
+       WL_IFSTATS_XTLV_IF_PERIODIC_STATE = 0x509,
+       /* Event statistics on per-IF */
+       WL_IFSTATS_XTLV_IF_EVENT_STATS = 0x50A,
+       /* Infra HE specific */
+       WL_IFSTATS_XTLV_INFRA_SPECIFIC_HE = 0x50B,
+       /* Roam statistics */
+       WL_IFSTATS_XTLV_ROAM_STATS_PERIODIC = 0x50C,
+       WL_IFSTATS_XTLV_ROAM_STATS_EVENT = 0x50D,
+       /* ecounters for nan */
+       /* nan slot stats */
+       WL_IFSTATS_XTLV_NAN_SLOT_STATS = 0x601,
+       /* Ecounters for NDP session status */
+       WL_STATS_XTLV_NDP_SESSION_STATUS = 0x602,
+       /* NAN disc frame status ecounters */
+       WL_STATS_XTLV_NAN_DISC_FRM_STATUS = 0x603
+};
+
+/* current version of wl_stats_report_t structure for request */
+#define WL_STATS_REPORT_REQUEST_VERSION_V2     2
+
+/* current version of wl_stats_report_t structure for response */
+#define WL_STATS_REPORT_RESPONSE_VERSION_V2    2
+
+/** Top structure of if_counters IOVar buffer */
+typedef struct wl_stats_report {
+       uint16  version;        /**< see version definitions above */
+       uint16  length;         /**< length of data including all paddings. */
+       uint8   data [];        /**< variable length payload:
+                                * 1 or more bcm_xtlv_t type of tuples.
+                                * each tuple is padded to multiple of 4 bytes.
+                                * 'length' field of this structure includes all paddings.
+                                */
+} wl_stats_report_t;
+
+/* interface specific mgt count */
+#define WL_MGT_STATS_VERSION_V1        1
+/* Associated stats type: WL_IFSTATS_MGT_CNT */
+typedef struct {
+       uint16  version;
+       uint16  length;
+
+       /* detailed control/management frames */
+       uint32  txnull;
+       uint32  rxnull;
+       uint32  txqosnull;
+       uint32  rxqosnull;
+       uint32  txassocreq;
+       uint32  rxassocreq;
+       uint32  txreassocreq;
+       uint32  rxreassocreq;
+       uint32  txdisassoc;
+       uint32  rxdisassoc;
+       uint32  txassocrsp;
+       uint32  rxassocrsp;
+       uint32  txreassocrsp;
+       uint32  rxreassocrsp;
+       uint32  txauth;
+       uint32  rxauth;
+       uint32  txdeauth;
+       uint32  rxdeauth;
+       uint32  txprobereq;
+       uint32  rxprobereq;
+       uint32  txprobersp;
+       uint32  rxprobersp;
+       uint32  txaction;
+       uint32  rxaction;
+       uint32  txpspoll;
+       uint32  rxpspoll;
+} wl_if_mgt_stats_t;
+
+#define WL_INFRA_STATS_VERSION_V1      1
+/* Associated stats type: WL_IFSTATS_INFRA_SPECIFIC */
+typedef struct wl_infra_stats {
+       uint16 version;             /**< version of the structure */
+       uint16 length;
+       uint32 rxbeaconmbss;
+       uint32 tbtt;
+} wl_if_infra_stats_t;
+
+#define WL_INFRA_STATS_HE_VERSION_V1   (1u)
+/* Associated stats type: WL_IFSTATS_INFRA_SPECIFIC_HE */
+typedef struct wl_infra_stats_he {
+       uint16 version;                 /**< version of the structure */
+       uint16 length;
+       uint32  PAD;                    /**< Explicit padding */
+
+       /* DL SU MPDUs and total number of bytes */
+       uint64 dlsu_mpdudata;
+       uint64 dlsu_mpdu_bytes;
+
+       /* DL MUMIMO MPDUs and total number of bytes  */
+       uint64 dlmumimo_mpdudata;
+       uint64 dlmumimo_mpdu_bytes;
+
+       /* DL OFDMA MPDUs and total number of bytes  */
+       uint64 dlofdma_mpdudata;
+       uint64 dlofdma_mpdu_bytes;
+
+       /* UL SU MPDUs and total number of bytes  */
+       uint64 ulsu_mpdudata;
+       uint64 ulsu_mpdu_bytes;
+
+       /* ULOFDMA MPSUs and total number of bytes  */
+       uint64 ulofdma_mpdudata;
+       uint64 ulofdma_mpdu_bytes;
+} wl_if_infra_stats_he_t;
+
+#define LTECOEX_STATS_VER   1
+
+typedef struct wlc_ltecoex_stats {
+       uint16 version;      /**< WL_IFSTATS_XTLV_WL_SLICE_LTECOEX */
+       uint16 len;                     /* Length of  wl_ltecx_stats structure */
+       uint8 slice_index;      /* Slice unit of  wl_ltecx_stats structure */
+       uint8 pad[3];   /* Padding */
+       /* LTE noise based eCounters Bins
+        cumulative the wl_cnt_wlc_t and  wl_ctl_mgt_cnt_t
+        counter information based on LTE Coex interference level
+        */
+       uint32  txframe_no_LTE;         /* txframe counter in no LTE Coex case */
+       uint32  rxframe_no_LTE;         /* rxframe counter in no LTE Coex case */
+       uint32  rxrtry_no_LTE;          /* rxrtry counter in no LTE Coex case */
+       uint32  txretrans_no_LTE;       /* txretrans counter in no LTE Coex case */
+       uint32  txnocts_no_LTE;         /* txnocts counter in no LTE Coex case */
+       uint32  txrts_no_LTE;           /* txrts counter in no LTE Coex case */
+       uint32  txdeauth_no_LTE;        /* txdeauth counter in no LTE Coex case */
+       uint32  txassocreq_no_LTE;      /* txassocreq counter in no LTE Coex case */
+       uint32  txassocrsp_no_LTE;              /* txassocrsp counter in no LTE Coex case */
+       uint32  txreassocreq_no_LTE;    /* txreassocreq counter in no LTE Coex case */
+       uint32  txreassocrsp_no_LTE;    /* txreassocrsp counter in no LTE Coex case */
+       uint32  txframe_light_LTE;      /* txframe counter in light LTE Coex case */
+       uint32  txretrans_light_LTE;    /* txretrans counter in light LTE Coex case */
+       uint32  rxframe_light_LTE;      /* rxframe counter in light LTE Coex case */
+       uint32  rxrtry_light_LTE;       /* rxrtry counter in light LTE Coex case */
+       uint32  txnocts_light_LTE;      /* txnocts counter in light LTE Coex case */
+       uint32  txrts_light_LTE;        /* txrts counter in light LTE Coex case */
+       uint32  txdeauth_light_LTE;     /* txdeauth counter in light LTE Coex case */
+       uint32  txassocreq_light_LTE;   /* txassocreq counter in light LTE Coex case */
+       uint32  txassocrsp_light_LTE;   /* txassocrsp counter in light LTE Coex case */
+       uint32  txreassocreq_light_LTE; /* txreassocreq counter in light LTE Coex case */
+       uint32  txreassocrsp_light_LTE; /* txreassocrsp counter in light LTE Coex case */
+       uint32  txframe_heavy_LTE;      /* txframe counter in heavy LTE Coex case */
+       uint32  txretrans_heavy_LTE;    /* txretrans counter in heavy LTE Coex case */
+       uint32  rxframe_heavy_LTE;      /* rxframe counter in heavy LTE Coex case */
+       uint32  rxrtry_heavy_LTE;       /* rxrtry counter in heavy LTE Coex case */
+       uint32  txnocts_heavy_LTE;      /* txnocts counter in heavy LTE Coex case */
+       uint32  txrts_heavy_LTE;        /* txrts counter in heavy LTE Coex case */
+       uint32  txdeauth_heavy_LTE;     /* txdeauth counter in heavy LTE Coex case */
+       uint32  txassocreq_heavy_LTE;   /* txassocreq counter in heavy LTE Coex case */
+       uint32  txassocrsp_heavy_LTE;   /* txassocrsp counter in heavy LTE Coex case */
+       uint32  txreassocreq_heavy_LTE; /* txreassocreq counter in heavy LTE Coex case */
+       uint32  txreassocrsp_heavy_LTE; /* txreassocrsp counter in heavy LTE Coex case */
+
+       /* LTE specific ecounters */
+       uint16  type4_txinhi_dur;       /* Duration of tx inhibit(in ms) due to Type4 */
+       uint16  type4_nonzero_cnt;      /* Counts of none zero Type4 msg */
+       uint16  type4_timeout_cnt;      /* Counts of Type4 timeout */
+       uint16  rx_pri_dur;             /* Duration of wlan_rx_pri assertions */
+       uint16  rx_pri_cnt;             /* Count of wlan_rx_pri assertions */
+       uint16  type6_dur;              /* duration of LTE Tx power limiting assertions */
+       uint16  type6_cnt;              /* Count of LTE Tx power limiting assertions */
+       uint16  ts_prot_frm_cnt;        /* count of WLAN protection frames triggered by LTE coex */
+       uint16  ts_gr_cnt;              /* count of intervals granted to WLAN in timesharing */
+       uint16  ts_gr_dur;              /* duration granted to WLAN in timesharing */
+} wlc_ltecoex_stats_t;
+
+#define CSA_EVT_CSA_RXED        (1 << 0)
+#define CSA_EVT_CSA_TIMEOUT     (1 << 1)
+#define CSA_EVT_FROM_INFRA      (1 << 2)
+typedef struct csa_event_data {
+       chanspec_t chan_old;
+       dot11_ext_csa_ie_t ecsa;
+       dot11_mesh_csp_ie_t mcsp;
+       dot11_wide_bw_chan_switch_ie_t wbcs;
+       uint8 flags;
+       uint8 pad[3];
+} csa_event_data_t;
+
+/* ifdef (WL_ASSOC_BCN_RPT) */
+enum wl_bcn_report_cmd_id {
+       WL_BCN_RPT_CMD_VER              = 0,
+       WL_BCN_RPT_CMD_CONFIG           = 1,
+       WL_BCN_RPT_CMD_VENDOR_IE        = 2,
+       WL_BCN_RPT_CMD_LAST
+};
+
+/* beacon report specific macros */
+#define WL_BCN_RPT_CCX_IE_OVERRIDE     (1u << 0)
+
+/* beacon report specific macros */
+#define WL_BCN_RPT_ASSOC_SCAN_UNSOLICITED_MODE (1u << 1)
+#define WL_BCN_RPT_ASSOC_SCAN_SOLICITED_MODE   (1u << 2)
+#define WL_BCN_RPT_ASSOC_SCAN_MODE_SHIFT       (1)
+#define WL_BCN_RPT_ASSOC_SCAN_MODE_MASK                (WL_BCN_RPT_ASSOC_SCAN_UNSOLICITED_MODE |\
+                                                       WL_BCN_RPT_ASSOC_SCAN_SOLICITED_MODE)
+#define WL_BCN_RPT_ASSOC_SCAN_MODE_MAX         (WL_BCN_RPT_ASSOC_SCAN_MODE_MASK >> \
+                                                       WL_BCN_RPT_ASSOC_SCAN_MODE_SHIFT)
+/* beacon report mode specific macro */
+#define WL_BCN_RPT_ASSOC_SCAN_MODE_DEFAULT     WL_BCN_RPT_ASSOC_SCAN_UNSOLICITED_MODE
+
+/* beacon report timeout config specific macros */
+#define WL_BCN_RPT_ASSOC_SCAN_CACHE_TIMEOUT_DEFAULT    (120000)
+#define WL_BCN_RPT_ASSOC_SCAN_CACHE_TIMEOUT_MIN                (60000)
+#define WL_BCN_RPT_ASSOC_SCAN_CACHE_TIMEOUT_MAX                (0xFFFFFFFF)
+
+/* beacon report cache count specific macros */
+#define WL_BCN_RPT_ASSOC_SCAN_CACHE_COUNT_MIN          (0)
+#define WL_BCN_RPT_ASSOC_SCAN_CACHE_COUNT_MAX          (8)
+#define WL_BCN_RPT_ASSOC_SCAN_CACHE_COUNT_DEFAULT      (WL_BCN_RPT_ASSOC_SCAN_CACHE_COUNT_MAX)
+
+#define WL_BCN_REPORT_CMD_VERSION              1
+struct wl_bcn_report_cfg {
+       uint32  flags;                  /**< Flags that defines the operation/setting information */
+       uint32  scan_cache_timeout;     /**< scan cache timeout value in millisec */
+       uint32  scan_cache_timer_pend;  /**< Read only pending time for timer expiry in millisec */
+       uint8   scan_cache_cnt;         /**< scan cache count */
+};
+
+/* endif (WL_ASSOC_BCN_RPT) */
+
+/* Thermal, Voltage, and Power Mitigation */
+#define TVPM_REQ_VERSION_1             1
+#define TVPM_REQ_CURRENT_VERSION       TVPM_REQ_VERSION_1
+
+/* tvpm iovar data */
+typedef struct {
+       uint16  version;                /* TVPM request version */
+       uint16  length;                 /* Length of the entire structure */
+
+       uint16  req_type;               /* Request type: wl_tvpm_req_type_t */
+       uint16  req_len;                /* Length of the following value */
+       uint8   value[];                /* Variable length data depending on req_type */
+} wl_tvpm_req_t;
+
+/* tvpm iovar request types */
+typedef enum {
+       WL_TVPM_REQ_CLTM_INDEX, /* req_value: uint32, range 1...100 */
+       WL_TVPM_REQ_PPM_INDEX,  /* req_value: uint32, range 1...100 */
+       WL_TVPM_REQ_ENABLE,     /* req_value: uint32, range 0...1 */
+       WL_TVPM_REQ_STATUS,     /* req_value: none */
+       WL_TVPM_REQ_PERIOD,     /* req_value: int32, range {-1,1-10} */
+       WL_TVPM_REQ_TXDC,       /* req_value: uint32, range 1...100 */
+       WL_TVPM_REQ_MAX
+} wl_tvpm_req_type_t;
+
+/* structure for data returned by request type WL_TVPM_REQ_STATUS */
+typedef struct wl_tvpm_status {
+       uint16  enable;                 /* whether TVPM is enabled */
+       uint16  tx_dutycycle;           /* a percentage: 1-100 */
+       int16   tx_power_backoff;       /* 0...-6 */
+       uint16  num_active_chains;      /* 1...3 */
+       int16   temp;                   /* local temperature in degrees C */
+       uint8   vbat;                   /* local voltage in units of 0.1V */
+       uint8   pad;
+} wl_tvpm_status_t;
+
+/* TVPM ecounters */
+typedef struct wl_tvpm_ecounters_t {
+       uint16  version;                /* version field */
+       uint16  length;                 /* byte length in wl_tvpm_ecounters_t starting at version */
+       uint16  tx_dutycycle;           /* a percentage: 1-100 */
+       int16   tx_power_backoff;       /* 0...-6 */
+       uint16  num_active_chains;      /* 1...3 */
+       int16   temp;                   /* local temperature */
+       uint8   vbat;                   /* local voltage */
+       uint8   cltm;                   /* CLTM index  */
+       uint8   ppm;                    /* PPM index  */
+       uint8   pad;                    /* pad to align to uint16 */
+} wl_tvpm_ecounters_t;
+
+#define TDMTX_ECOUNTERS_VERSION_V1      1
+#define TDMTX_ECOUNTERS_VERSION_V2      2
+
+/* TDMTX ecounters */
+typedef struct wl_tdmtx_ecounters_v1 {
+       uint16  version;        /* version field */
+       uint16  length; /* byte length in wl_tdmtx_ecounters_t starting at version */
+       uint32  txa_on; /* TXA on requests */
+       uint32  txa_tmcnt; /* Total number of TXA timeout */
+       uint32  por_on; /* TXA POR requests */
+       uint32  txpuen; /* Path enable requests */
+       uint32  txpudis; /* Total number of times Tx path is muted on the slice */
+       uint32  txpri_on; /* Total number of times Tx priority was obtained by the slice */
+       uint32  txdefer; /* Total number of times Tx was deferred by the slice */
+       uint32  txmute; /* Total number of times active Tx muted on the slice */
+       uint32  actpwrboff; /* Total number of times TX power is backed off by the slice */
+       uint32  txa_dur; /* Total time txa on */
+       uint32  txpri_dur; /* Total time TXPri */
+       uint32  txdefer_dur; /* Total time txdefer */
+} wl_tdmtx_ecounters_v1_t;
+
+/* TDMTX ecounters for version 2 */
+typedef struct wl_tdmtx_ecounters_v2 {
+       uint16  version;        /* version field */
+       uint16  length; /* byte length in wl_tdmtx_ecounters_t starting at version */
+       uint32  txa_on; /* TXA on requests */
+       uint32  txa_tmcnt; /* Total number of TXA timeout */
+       uint32  porhi_on; /* TXA PORHI requests */
+       uint32  porlo_on; /* TXA PORLO requests */
+       uint32  txpuen; /* Path enable requests */
+       uint32  txpudis; /* Total number of times Tx path is muted on the slice */
+       uint32  txpri_on; /* Total number of times Tx priority was obtained by the slice */
+       uint32  txdefer; /* Total number of times Tx was deferred by the slice */
+       uint32  txmute; /* Total number of times active Tx muted on the slice */
+       uint32  actpwrboff; /* Total number of times TX power is backed off by the slice */
+       uint32  txa_dur; /* Total time txa on */
+       uint32  txpri_dur; /* Total time TXPri */
+       uint32  txdefer_dur; /* Total time txdefer */
+} wl_tdmtx_ecounters_v2_t;
+
+/* Note: if this struct is changing update wl_scb_ecounters_vX_t version,
+ * as this struct is sent as payload in wl_scb_ecounters_vX_t
+ */
+typedef struct wlc_scb_stats_v1 {
+       uint32 tx_pkts;                     /* num of packets transmitted (ucast) */
+       uint32 tx_failures;                 /* num of packets failed */
+       uint32 rx_ucast_pkts;               /* num of unicast packets received */
+       uint32 rx_mcast_pkts;               /* num of multicast packets received */
+       uint32 tx_rate;                     /* Rate of last successful tx frame */
+       uint32 rx_rate;                     /* Rate of last successful rx frame */
+       uint32 rx_decrypt_succeeds;         /* num of packets decrypted successfully */
+       uint32 rx_decrypt_failures;         /* num of packets decrypted unsuccessfully */
+       uint32 tx_mcast_pkts;               /* num of mcast pkts txed */
+       uint64 tx_ucast_bytes;              /* data bytes txed (ucast) */
+       uint64 tx_mcast_bytes;              /* data bytes txed (mcast) */
+       uint64 rx_ucast_bytes;              /* data bytes recvd ucast */
+       uint64 rx_mcast_bytes;              /* data bytes recvd mcast */
+       uint32 tx_pkts_retried;             /* num of packets where a retry was necessary */
+       uint32 tx_pkts_retry_exhausted;     /* num of packets where a retry was exhausted */
+       uint32 tx_rate_mgmt;                /* Rate of last transmitted management frame */
+       uint32 tx_rate_fallback;            /* last used lowest fallback TX rate */
+       uint32 rx_pkts_retried;             /* # rx with retry bit set */
+       uint32 tx_pkts_total;               /* total num of tx pkts */
+       uint32 tx_pkts_retries;             /* total num of tx retries */
+       uint32 tx_pkts_fw_total;            /* total num of tx pkts generated from fw */
+       uint32 tx_pkts_fw_retries;          /* num of fw generated tx pkts retried */
+       uint32 tx_pkts_fw_retry_exhausted;  /* num of fw generated tx pkts where retry exhausted */
+} wlc_scb_stats_v1_t;
+
+/* ecounters for scb stats
+ * XTLV ID: WL_IFSTATS_XTLV_SCB_ECOUNTERS
+ */
+
+#define WL_SCB_ECOUNTERS_VERSION_1             1
+#define WL_SCB_ECOUNTERS_VERSION_2             2
+
+typedef struct wl_scb_ecounters_v1 {
+       uint16  version;        /* version field */
+       uint16  length;         /* struct length starting from version */
+       uint32  chanspec;       /* current chanspec where scb is operating */
+       struct  ether_addr  ea; /* peer ndi or sta ea */
+       uint8   peer_type;      /* peer type */
+       uint8   pad;
+
+       /* scb tx and rx stats */
+       wlc_scb_stats_v1_t stats;
+} wl_scb_ecounters_v1_t;
+
+typedef struct wl_scb_ecounters_v2 {
+       uint16  version;        /* version field */
+       uint16  length;         /* struct length starting from version */
+       uint32  chanspec;       /* current chanspec where scb is operating */
+       struct  ether_addr  ea; /* peer ndi or sta ea */
+       uint8   peer_type;      /* peer type */
+       uint8   pad;
+
+       /* scb tx and rx stats */
+       uint16 tx_rate;                     /* Rate(in Mbps) of last successful tx frame */
+       uint16 rx_rate;                     /* Rate(in Mbps) of last successful rx frame */
+       uint16 tx_rate_fallback;            /* last used lowest fallback TX rate(in Mbps) */
+       uint16 pad1;
+       uint32 rx_decrypt_succeeds;         /* num of packets decrypted successfully */
+       uint32 rx_decrypt_failures;         /* num of packets decrypted unsuccessfully */
+       uint32 rx_pkts_retried;             /* # rx with retry bit set */
+       uint32 tx_pkts_retries;             /* total num of tx retries */
+       uint32 tx_failures;                 /* num of packets failed */
+       uint32 tx_pkts_total;               /* total num of tx pkts */
+       int8   rssi[WL_STA_ANT_MAX];        /* average rssi per antenna of data frames */
+} wl_scb_ecounters_v2_t;
+
+/* ecounters for nan slot stats
+ * XTLV ID: WL_IFSTATS_XTLV_NAN_SLOT_STATS
+ */
+
+#define WL_NAN_SLOT_ECOUNTERS_VERSION_1                1
+#define WL_NAN_SLOT_ECOUNTERS_VERSION_2                2
+
+typedef struct wl_nan_slot_ecounters_v1 {
+       uint16  version;              /* version field */
+       uint16  length;               /* struct length starting from version */
+       uint32  chan[NAN_MAX_BANDS];  /* cur nan slot chanspec of both bands */
+       uint16  cur_slot_idx;         /* cur nan slot index */
+       uint16  pad;
+       nan_sched_stats_t sched;      /* sched stats */
+       wl_nan_mac_stats_t mac;       /* mac stats */
+} wl_nan_slot_ecounters_v1_t;
+
+typedef struct wl_nan_slot_ecounters_v2 {
+       uint16  version;              /* version field */
+       uint16  length;               /* struct length starting from version */
+       uint32  chan[NAN_MAX_BANDS];  /* cur nan slot chanspec of both bands */
+       uint16  cur_slot_idx;         /* cur nan slot index */
+       uint16  pad;
+       nan_sched_stats_t sched;      /* sched stats */
+       wl_nan_mac_stats_t mac;       /* mac stats */
+       /* for v2 */
+       uint16 bcn_rx_drop_rssi;      /* Beacon received but ignored due to weak rssi */
+       uint16 bcn_rx_drop_rssi_5g;   /* 5G Beacon received but ignored due to weak rssi */
+       uint16 cnt_rssi_close;        /* cnt of beacon rssi > rssi_close received */
+       uint16 cnt_rssi_close_5g;     /* cnt of 5G beacon rssi > rssi_close received */
+       uint16 cnt_rssi_mid;          /* cnt of beacon rssi > rssi_middle received */
+       uint16 cnt_rssi_mid_5g;       /* cnt of 5G beacon rssi > rssi_middle received */
+       uint16 bcn_txfail;            /* Beacon sending failure count */
+       uint16 bcn_txfail_5g;         /* sending 5G beacon failure count */
+} wl_nan_slot_ecounters_v2_t;
+
+/* WL_STATS_XTLV_NDP_SESSION_STATUS for ecounters */
+#define WL_NAN_SESSION_STATUS_EC_VERSION_1  1
+typedef struct wl_nan_ndp_session_status_v1_s {
+       uint16  version;              /* version field */
+       uint16  length;               /* struct length starting from version */
+       uint8   role;                 /* Role of NAN device */
+       uint8   ndp_id;               /* local NDP ID */
+       uint8   state;                /* NDP state */
+       uint8   nan_sec_csid;         /* security csid */
+       struct  ether_addr lndi_addr; /* Local NDI addr */
+       struct  ether_addr pnmi_addr; /* Peer NMI addr */
+       struct  ether_addr pndi_addr; /* Peer NDI addr */
+       uint8   dpe_state;            /* DPE state to know where timeout/dpend has come */
+       uint8   pad;
+} wl_nan_ndp_session_status_v1_t;
+
+/* WL_STATS_XTLV_NAN_DISC_FRM_STATUS for ecounters */
+#define WL_NAN_DISC_FRM_STATUS_EC_VERSION_1  1
+typedef struct wl_nan_disc_frame_status_v1_s {
+       uint16  version;              /* version field */
+       uint16  length;               /* struct length starting from version */
+       uint8   type;                 /* wl_nan_frame_type_t */
+       uint8   status;               /* For TX status, success or failure */
+       uint8   reason_code;          /* to identify reason when status is failure */
+       uint8   inst_id;              /* Publish or subscribe instance id */
+       uint8   req_id;               /* Requestor instance id */
+       uint8   pad;
+       uint16  token;                /* seq num to keep track of pkts sent by host */
+} wl_nan_disc_frame_status_v1_t;
+
+typedef struct wl_nan_oob_af {
+       uint64 bitmap;                  /* 16 TU slots in 1024 TU window */
+       struct ether_addr sa;           /* Optional SA. Default set to NMI */
+       struct ether_addr da;
+       struct ether_addr bssid;
+       bool   secured;                 /* Optional. Default set to 0 (Open) */
+       uint8  map_id;                  /* Host selected map id. Default 0 */
+       uint16 timeout;                 /* OOB AF session timeout in milliseconds */
+       uint16 pad[3];                  /* Structure padding. Can be used in future */
+       uint16 token;                   /* host generated. Used by FW in TX status event */
+       uint16 payload_len;
+       uint8  payload[];               /* AF hdr + NAN attrbutes in TLV format */
+} wl_nan_oob_af_t;
+
+/*
+ * BT log definitions
+ */
+
+/* common iovar struct */
+typedef struct wl_btl {
+       uint16 subcmd_id;       /* subcommand id */
+       uint16 len;             /* total length of data[] */
+       uint8 data[2];          /* subcommand data, variable length */
+} wl_btl_t;
+
+/* subcommand ids */
+#define WL_BTL_SUBCMD_ENABLE   0       /* enable/disable logging */
+#define WL_BTL_SUBCMD_STATS    1       /* statistics */
+
+/* WL_BTL_SUBCMD_ENABLE data */
+typedef struct wl_blt_enable {
+       uint8 enable;                   /* 1 - enable, 0 - disable */
+       uint8 pad[3];                   /* 4-byte struct alignment */
+} wl_btl_enable_t;
+
+/* WL_BTL_SUBCMD_STATS data */
+typedef struct wl_blt_stats {
+       uint32 bt_interrupt;                    /* num BT interrupts */
+       uint32 config_req;                      /* num CONFIG_REQ */
+       uint32 config_res_success;              /* num CONFIG_RES successful */
+       uint32 config_res_fail;                 /* num CONFIG_RES failed */
+       uint32 log_req;                         /* num LOG_REQ */
+       uint32 log_res_success;                 /* num LOG_RES successful */
+       uint32 log_res_fail;                    /* num LOG_RES failed */
+       uint32 indirect_read_fail;              /* num indirect read fail */
+       uint32 indirect_write_fail;             /* num indirect write fail */
+       uint32 dma_fail;                        /* num DMA failed */
+       uint32 min_log_req_duration;            /* min log request duration in usec */
+       uint32 max_log_req_duration;            /* max log request duration in usec */
+       uint16 mem_dump_req;                    /* num mem dump requests */
+       uint16 mem_dump_success;                /* num mem dumps successful */
+       uint16 mem_dump_fail;                   /* num mem dumps failed */
+       uint16 bt_wake_success;                 /* num BT wakes successful */
+       uint16 bt_wake_fail;                    /* num BT wakes failed */
+       uint16 mem_dump_req_interrupt;          /* num MEM_DUMP_REQ interrupt */
+       uint16 mem_dump_res_interrupt;          /* num MEM_DUMP_RES interrupt */
+       uint16 mem_dump_res_timeout;            /* num MEM_DUMP_RES timeout */
+       uint16 mem_dump_proc_no_bt_ready;       /* num proceed if no BT ready */
+       uint16 mem_dump_proc_no_bt_response;    /* num proceed if no BT response */
+       uint16 mem_dump_proc_no_bt_clock;       /* num proceed if no BT clock */
+       uint16 pad;                             /* alignment */
+       uint32 last_failed_region;              /* start addr of last failed region */
+       uint32 min_mem_dump_duration;           /* min mem dump duration in usec */
+       uint32 max_mem_dump_duration;           /* max mem dump duration in usec */
+} wl_btl_stats_t;
+
+/* IOV AWD DATA */
+
+/* AWD DATA structures */
+typedef struct {
+       uint8 version;  /* Extended trap version info */
+       uint8 reserved; /* currently unused */
+       uint16 length;  /* Length of data excluding this header */
+       uint8 data[];   /* this data is TLV of tags */
+} awd_data_v1_t;
+
+/* AWD TAG structure */
+typedef struct {
+       uint8 tagid;    /* one of AWD DATA TAGs numbers */
+       uint8 length;   /* the data size represented by this field must be aligned to 32 bits */
+       uint8 data[];   /* variable size, defined by length field */
+} awd_tag_data_v1_t;
+
+/* IOV ETD DATA */
+
+/* ETD DATA structures */
+typedef struct {
+       uint8 version;  /* Extended trap version info */
+       uint8 reserved; /* currently unused */
+       uint16 length;  /* Length of data excluding this header */
+       uint8 data[];   /* this data is TLV of tags */
+} etd_data_v1_t;
+
+/* ETD TAG structure */
+typedef struct {
+       uint8 tagid;    /* one of ETD DATA TAGs numbers */
+       uint8 length;   /* the data size represented by this field must be aligned to 32 bits */
+       uint8 data[];   /* variable size, defined by length field */
+} etd_tag_data_v1_t;
+
+/* ETD information structures associated with ETD_DATA_Tags */
+/* ETD_JOIN_CLASSIFICATION_INFO 10 */
+typedef struct {
+       uint8 assoc_type;               /* assoc type */
+       uint8 assoc_state;              /* current state of assoc state machine */
+       uint8 wpa_state;                /* wpa->state */
+       uint8 wsec_portopen;            /* shows if security port is open */
+       uint8 total_attempts_num;       /* total number of join attempts (bss_retries) */
+       uint8 num_of_targets;           /* up to 3, in current design */
+       uint8 reserved [2];             /* padding to get 32 bits alignment */
+       uint32 wsec;                    /* bsscfg->wsec */
+       uint32 wpa_auth;                /* bsscfg->WPA_auth */
+       uint32 time_to_join;            /* time duration to process WLC_SET_SSID request (ms) */
+} join_classification_info_v1_t;
+
+/* ETD_JOIN_TARGET_CLASSIFICATION_INFO 11 */
+typedef struct {
+       int8 rssi;                      /* RSSI on current channel */
+       uint8 cca;                      /* CCA on current channel */
+       uint8 channel;                  /* current channel */
+       uint8 num_of_attempts;          /* (bss_retries) up to 5 */
+       uint8 oui[3];                   /* the first three octets of the AP's address */
+       uint8 reserved;                 /* padding to get 32 bits alignment */
+       uint32 time_duration;           /* time duration of current attempt (ms) */
+} join_target_classification_info_v1_t;
+
+/* ETD_ASSOC_STATE 12 */
+typedef struct {
+       uint8 assoc_state;              /* assoc type */
+       uint8 reserved [3];             /* padding to get 32 bits alignment */
+} join_assoc_state_v1_t;
+
+/* ETD_CHANNEL 13 tag */
+typedef struct {
+       uint8 channel;                  /* last attempt channel */
+       uint8 reserved [3];             /* padding to get 32 bits alignment */
+} join_channel_v1_t;
+
+/* ETD_TOTAL_NUM_OF_JOIN_ATTEMPTS 14 */
+typedef struct {
+       uint8 total_attempts_num;       /* total number of join attempts (bss_retries) */
+       uint8 reserved [3];             /* padding to get 32 bits alignment */
+} join_total_attempts_num_v1_t;
+
+/* IOV_ROAM_CACHE structures */
+
+enum wl_rmc_report_cmd_id {
+       WL_RMC_RPT_CMD_VER      = 0,
+       WL_RMC_RPT_CMD_DATA     = 1,
+       WL_RMC_RPT_CMD_LAST
+};
+
+enum wl_rmc_report_xtlv_id {
+       WL_RMC_RPT_XTLV_VER             = 0x0,
+       WL_RMC_RPT_XTLV_BSS_INFO        = 0x1,
+       WL_RMC_RPT_XTLV_CANDIDATE_INFO  = 0x2,
+       WL_RMC_RPT_XTLV_USER_CACHE_INFO = 0x3
+};
+
+/* WL_RMC_RPT_XTLV_BSS_INFO */
+typedef struct {
+       int16 rssi;             /* current BSS RSSI */
+       uint8 reason;           /* reason code for last full scan */
+       uint8 status;           /* last status code for not roaming */
+       uint32 fullscan_count;  /* number of full scans performed on current BSS */
+       uint32 time_full_scan;  /* delta time (in ms) between cur time and full scan timestamp */
+} rmc_bss_info_v1_t;
+
+/* WL_RMC_RPT_XTLV_CANDIDATE_INFO */
+typedef struct {
+       int16 rssi;             /* last seen rssi */
+       uint16 ctl_channel;     /* channel */
+       uint32 time_last_seen;  /* delta time (in ms) between cur time and last seen timestamp */
+       uint16 bss_load;        /* BSS load */
+       uint8 bssid [6];        /* padding to get 32 bits alignment */
+} rmc_candidate_info_v1_t;
+
+#define WL_FILTER_IE_VERSION 1 /* deprecated */
+enum wl_filter_ie_options {
+       WL_FILTER_IE_CLEAR              = 0,    /* allow  element id in packet.For suboption */
+       WL_FILTER_IE_SET                = 1,    /* filter element id in packet.For suboption */
+       WL_FILTER_IE_LIST               = 2,    /* list  element ID's.Set as option */
+       WL_FILTER_IE_CLEAR_ALL          = 3,    /* clear all the element.Set as option */
+       WL_FILTER_IE_CHECK_SUB_OPTION   = 4     /* check for suboptions.Set only as option */
+};
+
+typedef struct wl_filter_ie_tlv {
+       uint16  id;             /* elelment id [ + ext id ] */
+       uint16  len;            /* sub option length + pattern length */
+       uint8   data[];         /* sub option + pattern matching(OUI,type,sub-type) */
+} wl_filter_ie_tlv_t;
+
+#define WL_FILTER_IE_VERSION_1 1 /* the latest version */
+typedef struct wl_filter_ie_iov_v1 {
+       uint16  version;        /* Structure version */
+       uint16  len;            /* Total length of the structure */
+       uint16  fixed_length;   /* Total length of fixed fields */
+       uint8   option;         /* Filter action - check for suboption */
+       uint8   pad[1];         /* Align to 4 bytes */
+       uint32  pktflag;        /* frame type - FC_XXXX */
+       uint8   tlvs[];         /* variable data (zero in for list ,clearall) */
+} wl_filter_ie_iov_v1_t;
+
+/* Event aggregation config */
+#define EVENT_AGGR_CFG_VERSION         1
+#define EVENT_AGGR_DISABLED            0x0
+#define EVENT_AGGR_ENABLED             0x1
+
+#define EVENT_AGGR_BUFSIZE_MAX         1512
+#define EVENT_AGGR_BUFSIZE_MIN         512
+
+#define EVENT_AGGR_FLUSH_TIMEOUT_DEFAULT       100
+#define EVENT_AGGR_FLUSH_TIMEOUT_MAX           2000
+#define EVENT_AGGR_NUM_EVENTS_FLUSH            5
+typedef struct event_aggr_config {
+       uint16 version;
+       uint16 len;
+       uint16 flags;                   /* bit 0 to enable/disable the feature */
+       uint16 bufsize;                 /* Aggregate buffer size */
+       uint16 flush_timeout;           /* Timeout for event flush */
+       uint16 num_events_flush;        /* Number of events aggregated before flush */
+} event_aggr_config_t;
+
+#ifndef WL_TDMTX_TYPEDEF_HAS_ALIAS
+typedef tdmtx_cnt_v1_t tdmtx_cnt_t;
+typedef tdmtx_cnt_shm_v1_t tdmtx_cnt_shm_t;
+typedef wl_tdmtx_ecounters_v1_t wl_tdmtx_ecounters_t;
+#define WL_CNT_TDMTX_STRUCT_SZ (sizeof(tdmtx_cnt_t))
+#define WL_CNT_TDMTX_SHM_SZ (sizeof(tdmtx_cnt_shm_t))
+#endif
+
+/** chanctxt related statistics */
+#define CHANCTXT_STATS_VERSION_1 1
+#define CHANCTXT_STATS_CURRENT_VERSION CHANCTXT_STATS_VERSION_1
+typedef struct wlc_chanctxt_stats {
+       uint32  excursionq_end_miss;
+       uint32  activeq_end_miss;
+       uint32  no_chanctxt_count;
+       uint32  txqueue_end_incomplete;
+       uint32  txqueue_start_incomplete;
+} wlc_chanctxt_stats_core_t;
+
+typedef struct chanctxt_stats {
+       uint16  version;
+       uint16  length;
+       wlc_chanctxt_stats_core_t corestats[MAX_NUM_D11CORES];
+} wlc_chanctxt_stats_t;
+
+typedef struct wl_txdc_ioc {
+       uint8 ver;
+       uint8 id;       /* ID of the sub-command */
+       uint16 len;     /* total length of all data[] */
+       uint8  data[];  /* var len payload */
+} wl_txdc_ioc_t;
+
+/*
+ * iovar subcommand ids
+ */
+enum {
+       IOV_TXDC_ENB = 1,
+       IOV_TXDC_MODE = 2,
+       IOV_TXDC_DUMP = 3,
+       IOV_TXDC_LAST
+};
+
+/* WL_NAN_XTLV_SLOT_STATS */
+/* WL_NAN_EVENT_SLOT_START, WL_NAN_EVENT_SLOT_END */
+typedef struct nan_slot_event_data {
+       uint32 cur_slot_idx; /* current idx in channel schedule */
+       uint32 fw_time; /* target current time in microseconds */
+       uint32 band; /* current band (2G/5G) for which the event is received */
+} nan_slot_event_data_t;
+
+#ifndef BCMUTILS_ERR_CODES
+
+/* SAE (Simultaneous Authentication of Equals) error codes.
+ * These error codes are local.
+ */
+
+/*  SAE status codes are reserved from -3072 to -4095 (1K) */
+
+enum wl_sae_status {
+       WL_SAE_E_AUTH_FAILURE                   = -3072,
+       /* Discard silently */
+       WL_SAE_E_AUTH_DISCARD                   = -3073,
+       /* Authentication in progress */
+       WL_SAE_E_AUTH_CONTINUE                  = -3074,
+       /* Invalid scalar/elt */
+       WL_SAE_E_AUTH_COMMIT_INVALID            = -3075,
+       /* Invalid confirm token */
+       WL_SAE_E_AUTH_CONFIRM_INVALID           = -3076,
+       /* Peer scalar validation failure */
+       WL_SAE_E_CRYPTO_SCALAR_VALIDATION       = -3077,
+       /* Peer element prime validation failure */
+       WL_SAE_E_CRYPTO_ELE_PRIME_VALIDATION    = -3078,
+       /* Peer element is not on the curve */
+       WL_SAE_E_CRYPTO_ELE_NOT_ON_CURVE        = -3079,
+       /* Generic EC error (eliptic curve related) */
+       WL_SAE_E_CRYPTO_EC_ERROR                = -3080,
+       /* Both local and peer mac addrs are same */
+       WL_SAE_E_CRYPTO_EQUAL_MACADDRS          = -3081,
+       /* Loop exceeded in deriving the scalar */
+       WL_SAE_E_CRYPTO_SCALAR_ITER_EXCEEDED    = -3082,
+       /* ECC group is unsupported */
+       WL_SAE_E_CRYPTO_UNSUPPORTED_GROUP       = -3083,
+       /* Exceeded the hunting-and-pecking counter */
+       WL_SAE_E_CRYPTO_PWE_COUNTER_EXCEEDED    = -3084,
+       /* SAE crypto component is not initialized */
+       WL_SAE_E_CRYPTO_NOT_INITED              = -3085,
+       /* bn_get has failed */
+       WL_SAE_E_CRYPTO_BN_GET_ERROR            = -3086,
+       /* bn_set has failed */
+       WL_SAE_E_CRYPTO_BN_SET_ERROR            = -3087,
+       /* PMK is not computed yet */
+       WL_SAE_E_CRYPTO_PMK_UNAVAILABLE         = -3088,
+       /* Peer confirm did not match */
+       WL_SAE_E_CRYPTO_CONFIRM_MISMATCH        = -3089,
+       /* Element K is at infinity no the curve */
+       WL_SAE_E_CRYPTO_KEY_AT_INFINITY         = -3090,
+       /* SAE Crypto private data magic number mismatch */
+       WL_SAE_E_CRYPTO_PRIV_MAGIC_MISMATCH     = -3091,
+       /* Max retry exhausted */
+       WL_SAE_E_MAX_RETRY_LIMIT_REACHED        = -3092
+};
+
+/* PMK manager block. Event codes from -5120 to -6143 */
+
+/* PSK hashing event codes */
+typedef enum wlc_pmk_psk_hash_status {
+       WL_PMK_E_PSK_HASH_FAILED =  -5120,
+       WL_PMK_E_PSK_HASH_DONE =    -5121,
+       WL_PMK_E_PSK_HASH_RUNNING = -5122,
+       WL_PMK_E_PSK_INVALID = -5123,
+       WL_PMK_E_PSK_NOMEM = -5124
+} wlc_pmk_psk_hash_status_t;
+
+#endif /* BCMUTILS_ERR_CODES */
+
+/* Block Channel */
+#define WL_BLOCK_CHANNEL_VER_1 1u
+
+typedef struct wl_block_ch_v1 {
+       uint16 version;
+       uint16 len;
+       uint32 band;            /* Band select */
+       uint8 channel_num;      /* The number of block channels in the selected band */
+       uint8 padding[3];
+       uint8 channel[];        /* Channel to block, Variable Length */
+} wl_block_ch_v1_t;
+
+typedef struct dma_wl_addr_region {
+       uint32 addr_low;
+       uint32 addr_high;
+} dma_wl_addr_region_t;
+
+#define WL_ROAMSTATS_IOV_VERSION 1
+
+#define MAX_PREV_ROAM_EVENTS   16u
+
+#define ROAMSTATS_UNKNOWN_CNT  0xFFFFu
+
+/* roaming statistics counter structures */
+typedef struct wlc_assoc_roamstats_event_msg_v1 {
+       uint32  event_type;             /* Message (see below) */
+       uint32  status;                 /* Status code (see below) */
+       uint32  reason;                 /* Reason code (if applicable) */
+       uint32  timestamp;              /* Timestamp of event */
+} wlc_assoc_roamstats_event_msg_v1_t;
+
+enum wl_roamstats_cmd_id {
+       WL_ROAMSTATS_XTLV_CMD_VER = 0,
+       WL_ROAMSTATS_XTLV_CMD_RESET = 1,
+       WL_ROAMSTATS_XTLV_CMD_STATUS = 2,
+       WL_ROAMSTATS_XTLV_CMD_LAST      /* Keep this at the end */
+};
+
+enum wl_roamstats_xtlv_id {
+       WL_ROAMSTATS_XTLV_VER           = 0x0,
+       WL_ROAMSTATS_XTLV_COUNTER_INFO          = 0x1,
+       WL_ROAMSTATS_XTLV_PREV_ROAM_EVENTS      = 0x2,
+       WL_ROAMSTATS_XTLV_REASON_INFO           = 0x3
+};
+
+/* WL_ROAMSTATS_XTLV_COUNTER_INFO */
+typedef struct {
+       uint32 initial_assoc_time;
+       uint32 prev_roam_time;
+       uint32 host_access_time;
+       uint16 roam_success_cnt;
+       uint16 roam_fail_cnt;
+       uint16 roam_attempt_cnt;
+       uint16 max_roam_target_cnt;
+       uint16 min_roam_target_cnt;
+       uint16 max_cached_ch_cnt;
+       uint16 min_cached_ch_cnt;
+       uint16 partial_roam_scan_cnt;
+       uint16 full_roam_scan_cnt;
+} roamstats_counter_info_v1_t;
+
+/* WL_ROAMSTATS_XTLV_PREV_ROAM_EVENTS */
+typedef struct {
+       uint16 max;
+       uint16 pos;
+       wlc_assoc_roamstats_event_msg_v1_t roam_event[];
+} roamstats_prev_roam_events_v1_t;
+
+/* WL_ROAMSTATS_XTLV_REASON_INFO */
+typedef struct {
+       uint16 max;
+       uint16 reason_cnt[];
+} roamstats_reason_info_v1_t;
+
+#ifdef HEALTH_CHECK_WLIOCTL
+/* Health check status format:
+ * reporting status size = uint32
+ * 8 LSB bits are reserved for: WARN (0), ERROR (1), and other levels
+ * MSB 24 bits are reserved for client to fill in its specific status
+ */
+#define HEALTH_CHECK_STATUS_OK                 0
+/* Bit positions. */
+#define HEALTH_CHECK_STATUS_WARN               0x1
+#define HEALTH_CHECK_STATUS_ERROR              0x2
+#define HEALTH_CHECK_STATUS_TRAP               0x4
+#define HEALTH_CHECK_STATUS_NOEVENT            0x8
+
+/* Indication that required information is populated in log buffers */
+#define HEALTH_CHECK_STATUS_INFO_LOG_BUF       0x80
+#define HEALTH_CHECK_STATUS_MASK               (0xFF)
+
+#define HEALTH_CHECK_STATUS_MSB_SHIFT          8
+#endif /* HEALTH_CHECK_WLIOCTL */
+
+/** receive signal reporting module interface */
+
+#define WL_RXSIG_IOV_MAJOR_VER       (1u)
+#define WL_RXSIG_IOV_MINOR_VER       (1u)
+#define WL_RXSIG_IOV_MAJOR_VER_SHIFT (8u)
+#define WL_RXSIG_IOV_VERSION \
+       ((WL_RXSIG_IOV_MAJOR_VER << WL_RXSIG_IOV_MAJOR_VER_SHIFT) | WL_RXSIG_IOV_MINOR_VER)
+#define WL_RXSIG_IOV_GET_MAJOR(x)    (x >> WL_RXSIG_IOV_MAJOR_VER_SHIFT)
+#define WL_RXSIG_IOV_GET_MINOR(x)    (x & 0xFF)
+
+enum wl_rxsig_cmd_rssi_mode {
+       WL_RXSIG_MODE_DB =   0x0,
+       WL_RXSIG_MODE_QDB =  0x1,
+       WL_RXSIG_MODE_LAST
+};
+
+/* structure defs for 'wl rxsig [cmd]' iovars */
+enum wl_rxsig_iov_v1 {
+       WL_RXSIG_CMD_RSSI =      0x1,     /**< combined rssi moving avg */
+       WL_RXSIG_CMD_SNR =       0x2,     /**< combined snr moving avg */
+       WL_RXSIG_CMD_RSSIANT =   0x3,     /**< rssi moving avg per-ant */
+       WL_RXSIG_CMD_SNRANT =    0x4,     /**< snr moving avg per-snr */
+       WL_RXSIG_CMD_SMPLWIN =   0x5,     /**< config for sampling window size */
+       WL_RXSIG_CMD_SMPLGRP =   0x7,     /**< config for grouping of pkt type */
+       WL_RXSIG_CMD_STA_MA =    0x8,
+       WL_RXSIG_CMD_MAMODE =    0x9,
+       WL_RXSIG_CMD_MADIV =     0xa,
+       WL_RXSIG_CMD_DUMP =      0xb,
+       WL_RXSIG_CMD_DUMPWIN =   0xc,
+       WL_RXSIG_CMD_TOTAL
+};
+
+struct wl_rxsig_cfg_v1 {
+       uint16 version;
+       chanspec_t chan;       /**< chanspec info for querying stats */
+       uint8 pmac[ETHER_ADDR_LEN];       /**< peer(link) mac address */
+};
+
+struct wl_rxsig_iov_rssi_v1 {
+       int8 rssi;
+       uint8 rssi_qdb;
+       uint8 pad[2];
+};
+
+struct wl_rxsig_iov_snr_v1 {
+       int16 snr;
+       uint16 pad;
+};
+
+struct wl_rxsig_iov_rssi_ant_v1 {
+       int8 deci[WL_RSSI_ANT_MAX];
+       uint8 frac[WL_RSSI_ANT_MAX];
+       uint8 rssi_mode;       /**< MODE_DB or MODE_QDB */
+       uint8 num_of_ant;      /**< total number of ants */
+       uint8 pad[2];          /**< padding for 32bit align */
+};
+
+#ifdef BCM_SDC
+
+#define SDC_TRIGGER_CONFIG_VER_1       1
+typedef struct {
+       uint16  version;
+       uint16  type;
+       uint8   activate;
+       uint8   pad;
+} sdc_trigger_cfg_t;
+
+typedef enum sdc_trigger_types {
+       SDC_TYPE_STA_ONBOARD_DEBUG = 1,
+       SDC_TYPE_SCAN_DEBUG = 2,
+#ifdef SDC_TEST
+       /*
+        * This is for test purpose only. Don't assign specific value.
+        * Keep at the end
+        */
+       SDC_TYPE_TEST1,
+       SDC_TYPE_TEST2,
+       SDC_TYPE_TEST3,
+#endif /* SDC_TEST */
+       SDC_TYPE_MAX_TRIGGER
+} sdc_trigger_types_t;
+
+/* *** SDC_TYPE_STA_ONBOARD_DEBUG specific ******* */
+
+/* tlv IDs uniquely identifies tx and rx stats component */
+enum wl_slice_hist_stats_xtlv_id {
+       WL_STATE_HIST_TX_TOSS_REASONS = 0x1,
+       WL_STATE_HIST_RX_TOSS_REASONS = 0x2
+};
+
+#ifndef WLC_HIST_TOSS_LEN
+#define WLC_HIST_TOSS_LEN   (8u)
+#endif
+#define WL_HIST_COMPACT_TOSS_STATS_TX_VER_1    (1u)
+#define WL_HIST_COMPACT_TOSS_STATS_RX_VER_1    (1u)
+
+/* Format of running toss reasons with seq
+ * [see  HIST_TOSS_xxxx macros]
+ * bits [7..0] : 8 bits : toss sts.
+ *     [11..8] : cfgidx
+ *     [15..12]: ac
+ *     [31..16]: seq
+ */
+#define HIST_TOSS_STS_POS      (0u)
+#define HIST_TOSS_STS_MASK     (0x000000ffu)
+#define HIST_TOSS_CFGIDX_POS   (8u)
+#define HIST_TOSS_CFGIDX_MASK  (0x00000f00u)
+#define HIST_TOSS_AC_POS       (12u)
+#define HIST_TOSS_AC_MASK      (0x0000f000u)
+#define HIST_TOSS_SEQ_POS      (16u)
+#define HIST_TOSS_SEQ_MASK     (0xffff0000u)
+
+/* Format of toss reasons with count
+ * bits [15..0]        : 16 bits : toss reason
+ * bits [31..16]: 16 bits : count
+ */
+#define HIST_TOSS_RC_REASON_POS                (0u)
+#define HIST_TOSS_RC_REASON_MASK       (0xffffu)
+#define HIST_TOSS_RC_COUNT_POS         (16u)
+#define HIST_TOSS_RC_COUNT_MASK                (0xffff0000u)
+
+typedef struct {
+       uint16  version;
+       uint8   hist_toss_type;         /* from wl_slice_hist_XX_stats_xtlv_id */
+       uint8   hist_toss_num;          /* number of elements in hist_toss_xxx */
+       uint32  hist_toss_cur_idx;      /* latest data is in this index */
+       uint32  hist_toss_reasons[WLC_HIST_TOSS_LEN];   /* last 8 reasons along with seq, etc as
+                                                        * per HIST_TOSS_xxx format
+                                                        */
+       uint32  hist_toss_counts[WLC_HIST_TOSS_LEN];    /* toss counts corr to reasons */
+} wl_hist_compact_toss_stats_v1_t;
+
+#define WL_HIST_COMPACT_TOSS_STATS_TX_VER_2    (2u)
+#define WL_HIST_COMPACT_TOSS_STATS_RX_VER_2    (2u)
+
+typedef struct {
+       uint16  version;
+       uint8   htr_type;       /* from wl_slice_hist_XX_stats_xtlv_id */
+       uint8   htr_num;        /* number of elements in htr_running or htr_rc */
+       uint16  htr_rnidx;      /* htr_running[rnidx-1] has latest data */
+       uint16  htr_rcidx;      /* htr_rc[rcidx-1] has latest data */
+       uint32  htr_running[WLC_HIST_TOSS_LEN]; /* last 8 reasons along with seq, etc as
+                                                * per WLC_SDC_COMPACT_TOSS_REASON() format
+                                                */
+       uint32  htr_rn_ts[WLC_HIST_TOSS_LEN]; /* time stamps corr to htr_running data */
+       uint32  htr_rc[WLC_HIST_TOSS_LEN];      /* last 8 toss reasons and counts in
+                                                * WLC_SDC_COMPACT_TOSS_RC() format
+                                                */
+       uint32  htr_rc_ts[WLC_HIST_TOSS_LEN]; /* time stamps corr to htr_rc */
+} wl_hist_compact_toss_stats_v2_t;
+
+/* ***END of SDC_TYPE_STA_ONBOARD_DEBUG specific ******* */
+
+#endif /* BCM_SDC */
+
+typedef struct wl_avs_info_v1 {
+       uint16 version;         /* Structure version */
+       uint16 equ_version;     /* Equation Version */
+       uint32 RO;              /* RO in OTP */
+       uint32 equ_csr;         /* Equated CSR */
+       uint32 read_csr;        /* Read Back CSR */
+       uint32 aging;           /* aging setting in nvram */
+} wl_avs_info_v1_t;
+
+#define WL_AVS_INFO_VER_1      1
+
+/* bitmap for clm_flags iovar */
+#define WL_CLM_TXBF                0x01 /**< Flag for Tx beam forming */
+#define WL_CLM_RED_EU              0x02 /* Flag for EU RED */
+#define WL_CLM_EDCRS_EU            0x04 /**< Use EU post-2015 energy detect */
+#define WL_CLM_DFS_TPC             0x08 /**< Flag for DFS TPC */
+#define WL_CLM_RADAR_TYPE_EU       0x10 /**< Flag for EU */
+#define WL_CLM_DFS_FCC             WL_CLM_DFS_TPC /**< Flag for DFS FCC */
+#define WL_CLM_DFS_EU              (WL_CLM_DFS_TPC | WL_CLM_RADAR_TYPE_EU) /**< Flag for DFS EU */
+
+/* SC (scan core) command IDs */
+enum wl_sc_cmd {
+       WL_SC_CMD_DBG = 0,
+       WL_SC_CMD_CNX = 1,
+       WL_SC_CMD_CAP = 2,
+       WL_SC_CMD_CONFIG = 3,
+       WL_SC_CMD_LAST
+};
+
+typedef struct wl_ext_auth_evt {
+       wlc_ssid_t ssid;
+       struct ether_addr bssid;
+       unsigned int key_mgmt_suite;
+       int status;
+} wl_ext_auth_evt_t;
+
+/* WBUS sub-command IDs for unit test */
+#define WL_WBUS_INA_SLOT_START                0x01u /**< Inactive slot start sub command ID. */
+#define WL_WBUS_INA_SLOT_STOP                 0x02u /**< Inactive slot stop sub command ID. */
+
+/* WBUS (WiFi BT uniform scheduler) command IDs */
+enum wl_wbus_cmd {
+       WL_WBUS_CMD_VER = 0,
+       WL_WBUS_CMD_STATS = 1,
+       WL_WBUS_CMD_UNIT_TEST = 2,
+       WL_WBUS_CMD_BT_TEST = 3,
+       WL_WBUS_CMD_CAP = 4,
+       WL_WBUS_CMD_LAST
+};
+
+#define WBUS_BT_SCHED_TEST_PARAMS_VER_1        1
+
+typedef struct wbus_bt_sched_test_params_v1 {
+       uint16  version;
+       uint8   min_duty_cycle;
+       uint8   type;
+       uint32  flags;
+       uint32  action;
+       uint32  duration;
+       uint32  interval;
+} wbus_bt_sched_test_params_v1_t;
+
+enum wl_wbus_bt_test_type {
+       WBUS_TEST_BT_USER_TYPE_LE_SCAN          = 0u,
+       WBUS_TEST_BT_USER_TYPE_PAGE_SCAN        = 1u,
+       WBUS_TEST_BT_USER_TYPE_MAX              = 2u
+};
+
+#define WBUS_BT_SCHED_ADD      0u
+#define WBUS_BT_SCHED_REMOVE   1u
+#define WBUS_BT_SCHED_INVALID  0xFFu
+
+enum wlc_btcec_iocv_subcmds {
+       WL_BTCEC_SUBCMD_TEST = 0,
+       WL_BTCEC_SUBCMD_STATS = 1,
+       WL_BTCEC_SUBCMD_LAST
+};
+
+/* btcec - bt schedule id's */
+typedef enum {
+       BTCEC_SCHED_ID_LE_SCAN          = 1,
+       BTCEC_SCHED_ID_PAGE_SCAN        = 2
+} BTCEC_SCHED_IDS;
+/* max schedule id must be equal to last valid schedule id */
+#define BTCEC_SCHED_MAX_V1     BTCEC_SCHED_ID_PAGE_SCAN
+
+/* meanings of flags */
+/* bit0: schedule with the given sch_id is present in btcec */
+#define BTCEC_SCHSTATS_FLAG_ACTIVE             (0x1)
+/* bit1: schedule with the given sch_id is successfully registered with wbus */
+#define BTCEC_SCHSTATS_FLAG_WBUS_REG_OK                (0x2)
+/* bit2: schedule with the given sch_id is being scheduled in wbus */
+#define BTCEC_SCHSTATS_FLAG_WBUS_SCHEDULED     (0x4)
+
+/* v1 supports pmdur only */
+#define WLC_BTCEC_STATS_V1     1u
+typedef struct wlc_btcec_stats_v1 {
+       uint16 ver;
+       uint16 len;
+       uint32 pmdur;   /* duration in millisec granted for bt corr to which wlsc slept */
+} wlc_btcec_stats_v1_t;
+
+/* v2 supports 1 page scan and 1 le scan */
+#define WLC_BTCEC_STATS_V2     2u
+/* btcec per schedule stats for general reporting */
+typedef struct wlc_btcec_sch_stats_v2 {
+       uint8   sch_id;         /* schedule id */
+       uint8   flags;          /* flags. see BTCEC_SCHSTATS_FLAG_xxx */
+       uint8   pad[2];
+       uint32  slcnt;          /* num slots granted to bt */
+       uint32  skip;           /* count of btsc le/page scan, skipped */
+       uint32  btdur;          /* duration in millisec granted for bt corr to which wlsc slept */
+       uint32  overlap;        /* wlsc was awake and btsc le/page scan overlapped, in ms */
+       uint32  txblnk;         /* wlauxtx blanked btsc le/page scan, in ms */
+} wlc_btcec_sch_stats_v2_t;
+
+/* btcec stats for general reporting */
+typedef struct wlc_btcec_stats_v2 {
+       uint16  ver;
+       uint16  len;
+       uint32  rx_msg_cnt;     /* received messages counter */
+       uint32  tx_msg_cnt;     /* transmitted messages counter */
+       uint32  add_msg_cnt;    /* rx add messages counter */
+       uint32  del_msg_cnt;    /* rx del messages counter */
+       uint32  stats_dur;      /* dur in sec for which stats is accumulated */
+       uint8   pad[3];
+       uint8   num_sstats;     /* number of elements in sstats struct */
+       wlc_btcec_sch_stats_v2_t sstats[];      /* sch specific stats */
+} wlc_btcec_stats_v2_t;
+
+/* v3 = v2 + ac_overlap */
+#define WLC_BTCEC_STATS_V3     3u
+/* btcec per schedule stats for general reporting */
+typedef struct wlc_btcec_sch_stats_v3 {
+       uint8   sch_id;         /* schedule id */
+       uint8   flags;          /* flags. see BTCEC_SCHSTATS_FLAG_xxx */
+       uint8   pad[2];
+       uint32  slcnt;          /* num slots granted to bt */
+       uint32  skip;           /* count of btsc le/page scan, skipped */
+       uint32  btdur;          /* duration in millisec granted for bt corr to which wlsc slept */
+       uint32  overlap;        /* wlsc was awake and btsc le/page scan overlapped, in ms */
+       uint32  txblnk;         /* wlauxtx blanked btsc le/page scan, in ms */
+       uint32  ac_overlap;     /* wlaux overlapped btsc le/page scan, in ms */
+       uint16  sched_duration; /* duration finally scheduled in msch, in ms */
+       uint16  sched_interval; /* interval finally scheduled in msch, in ms */
+       uint16  req_duration;   /* duration finally scheduled in msch, in ms */
+       uint16  req_interval;   /* interval finally scheduled in msch, in ms */
+       uint16  min_duty_cycle; /* interval finally scheduled in msch, in ms */
+       uint16  pad2;
+} wlc_btcec_sch_stats_v3_t;
+
+/* btcec stats for general reporting */
+typedef struct wlc_btcec_stats_v3 {
+       uint16  ver;
+       uint16  len;
+       uint32  rx_msg_cnt;     /* received messages counter */
+       uint32  tx_msg_cnt;     /* transmitted messages counter */
+       uint32  add_msg_cnt;    /* rx add messages counter */
+       uint32  del_msg_cnt;    /* rx del messages counter */
+       uint32  stats_dur;      /* dur in sec for which stats is accumulated */
+       uint8   pad[3];
+       uint8   num_sstats;     /* number of elements in sstats struct */
+       wlc_btcec_sch_stats_v3_t sstats[];      /* sch specific stats */
+} wlc_btcec_stats_v3_t;
+
+/* btcec periodic ecounters structs
+ *  [similar to wlc_btcec_stats_vX_t, but constrained in size due to its periodicity of reporting]
+ */
+#define WLC_BTCEC_PERIODIC_CNTRS_V1    (1u)
+
+/* btcec per schedule stats for periodic ecounters reporting */
+typedef struct wlc_btcec_periodic_sch_stats_v1 {
+       uint8   sch_id;         /* schedule id from BTCEC_SCHED_IDS */
+       uint8   flags;          /* flags. see BTCEC_SCHSTATS_FLAG_xxx */
+       uint8   slcnt;          /* num slots granted to bt */
+       uint8   skip;           /* count of btsc le/page scan, skipped */
+       uint16  btdur;          /* duration in millisec granted for bt corr to which wlsc slept */
+       uint16  overlap;        /* wlsc was awake and btsc le/page scan overlapped, in ms */
+       uint16  txblnk;         /* wlauxtx blanked btsc le/page scan, in ms */
+       uint16  ac_overlap;     /* wlaux overlapped btsc le/page scan, in ms */
+       uint16  sched_duration; /* duration finally scheduled in msch, in ms */
+       uint16  sched_interval; /* interval finally scheduled in msch, in ms */
+       uint16  req_duration;   /* duration finally scheduled in msch, in ms */
+       uint16  req_interval;   /* interval finally scheduled in msch, in ms */
+       uint16  min_duty_cycle; /* interval finally scheduled in msch, in ms */
+       uint16  pad2;
+} wlc_btcec_periodic_sch_stats_v1_t;
+
+/* btcec stats for periodic ecounters reporting */
+typedef struct {
+       uint16  ver;
+       uint16  len;
+       uint8   rx_msg_cnt;     /* received messages counter */
+       uint8   tx_msg_cnt;     /* transmitted messages counter */
+       uint8   add_msg_cnt;    /* rx add messages counter */
+       uint8   del_msg_cnt;    /* rx del messages counter */
+       uint8   pad[3];
+       uint8   num_sstats;     /* number of elements in sstats struct */
+       wlc_btcec_periodic_sch_stats_v1_t sstats[BTCEC_SCHED_MAX_V1];   /* sch specific */
+} wlc_btcec_periodic_stats_v1_t;
+
+#define WBUS_OFFLOAD_STATS_V1          1u
+#define WBUS_OFFLOAD_USER_STATS_V1     1u
+
+typedef struct wbus_offload_user_stats_v1 {
+       uint16  version;                        /* version of this structure */
+       uint16  len;                            /* size of this structure */
+       uint8   type;                           /* Offload type */
+       uint8   pad[3];
+       uint32  num_accepted;                   /* num of times user got accepted */
+       uint32  num_rejected;                   /* num of times user got rejected */
+       uint32  num_failed;                     /* num of times user accept failed */
+} wbus_offload_user_stats_v1_t;
+
+typedef struct wbus_offload_stats_v1 {
+       uint16  version;                                /* version of this structure */
+       uint16  len;                                    /* size of this structure */
+       uint32  num_accept_ok;                          /* num accept pass */
+       uint32  num_accept_fail;                        /* num accept fail */
+       uint32  num_rejected;                           /* num of rejected users so far */
+       uint32  num_rejected_bt;                        /* num of rejected users so far for BT */
+       uint32  num_rejected_all;                       /* num times all offloads are rejected */
+       uint8   pad[3];
+       uint8   num_user;                               /* num of users stats */
+       wbus_offload_user_stats_v1_t user_stats[];      /* per user stats */
+} wbus_offload_stats_v1_t;
+
+#define KEY_UPDATE_INFO_VER_V1 1
+typedef struct key_update_info_v1
+{
+       uint16 ver;
+       uint8 pad;
+       uint8 flags;
+       uint32 timestamp;
+       uint32 algo;
+       uint32 key_flags;
+       struct ether_addr ea;
+       struct ether_addr sa;
+} key_update_info_v1_t;
+
+/* Key update flag bit field */
+#define KEY_UPD_FLAG_ADD_KEY 0x1 /* 0 - Removal, 1 - Add key */
+
+#ifdef WLLLW
+/* LLW Session */
+#define LLW_VERSION                            1
+#define LLW_STATS_VERSION              1
+
+/* LLW roles */
+#define LLW_ROLE_SCHEDULER             0
+#define LLW_ROLE_CLIENT                        1
+
+/* LLW modes */
+#define LLW_MODE_GAPS                  0
+#define LLW_MODE_BACK_TO_BACK  1
+
+/* LLW session max values */
+#define LLW_MAX_SESSION_ID             10
+#define LLW_MAX_FLOW_ID                        40
+#define LLW_MAX_CLIENT_NUM             15
+#define LLW_MAX_GAPS_PERIOD            20
+#define LLW_MAX_GAPS_VAR                       3
+#define LLW_MAX_RETX_CNT                       10
+#define LLW_MAX_AIFSN                  EDCF_AIFSN_MAX
+#define LLW_MAX_CWMIN                  EDCF_ECW_MAX
+#define LLW_MAX_CWMAX                  EDCF_ECW_MAX
+#define LLW_MAX_PER_NUMERATOR  100
+#define LLW_MAX_PER_DENOM              10000
+#define LLW_MAX_CLIENT_ID              15
+#define LLW_MAX_PKT_SIZE                       1500
+#define LLW_MAX_PKT_NUM                        10
+#define LLW_MAX_MCS                            9
+#define LLW_MAX_NUM_STREAMS            8
+#define LLW_MAX_IBS                            32
+
+/* Per LLW session config */
+/* WL_LLW_CMD_SESSION_CREATE, WL_LLW_CMD_SESSION_UPDATE */
+typedef struct wl_llw_session_cfg {
+       uint8 session_id;
+       uint8 role;
+       uint8 mode;
+       uint8 client_id;
+       uint8 gaps_period;
+       uint8 gaps_var;
+       uint8 aifsn;
+       uint8 ecwmin;           /* exponent value for minimum contention window */
+       uint8 ecwmax;           /* exponent value for maximum contention window */
+       uint8 mcs;
+       uint8 num_streams;
+       uint8 ibs;      /* interblock spacing in usecs, for spacing between Transaction Blocks */
+       uint16 ul_pkt_size;
+       uint16 dl_pkt_size;
+       uint16 per_denom;       /* denominator for target PER */
+       uint8 per_numerator;    /* this value divided by per_denom gives the target PER */
+       uint8 dl_pkt_num;
+       uint8 client_num;
+       uint8 retx_cnt;
+       uint8 pwr_save;
+       uint8 auto_ba;          /* automatic RX/TX BA session setup (no negotiation needed) */
+       uint8 if_index;
+       uint8 padding[3];
+       struct ether_addr multicast_addr;
+       struct ether_addr scheduler_addr;
+} wl_llw_session_cfg_t;
+
+/* WL_LLW_CMD_SESSION_DELETE, WL_LLW_CMD_SESSION_ENABLE, WL_LLW_CMD_SESSION_DISABLE, */
+/* WL_LLW_CMD_SESSION_GET */
+typedef struct wl_llw_session_cmd {
+       uint8 session_id;
+       uint8 padding[3];
+} wl_llw_session_cmd_t;
+
+/* LLW client config */
+/* WL_LLW_CMD_CLIENT_ADD, WL_LLW_CMD_CLIENT_DELETE, WL_LLW_CMD_CLIENT_GET */
+typedef struct wl_llw_client_cfg {
+       uint8 session_id;
+       uint8 client_id;
+       struct ether_addr mac;
+} wl_llw_client_cfg_t;
+
+/* Get list of session IDs from FW */
+/* WL_LLW_CMD_SESSION_ID */
+typedef struct llw_session_id_list {
+       uint8 id_count; /* Number of session IDs */
+       uint8 list[];   /* list of session IDs */
+} llw_session_id_list_t;
+
+/* LLW XTLV structures */
+typedef struct wl_llw_iov_cmd {
+       uint16 version;
+       uint8 cmd_cnt;
+       uint8 pad;
+       uint8 cmds[];
+} wl_llw_iov_cmd_t;
+
+typedef struct wl_llw_iov_sub_cmd {
+       uint16 type;
+       uint16 len;
+       union {
+               int32 status;   /* Processed status - Set by FW */
+               uint32 options; /* Command Process Options - Set by Host */
+       } u;
+       uint8 data[];
+} wl_llw_iov_sub_cmd_t;
+
+/* to be used in type field of wl_llw_iov_sub_cmd_t structure while issuing LLW commands */
+typedef enum wl_llw_sub_cmd_xtlv_id {
+       WL_LLW_CMD_SESSION_ID,
+       WL_LLW_CMD_SESSION_CREATE,
+       WL_LLW_CMD_SESSION_DELETE,
+       WL_LLW_CMD_SESSION_UPDATE,
+       WL_LLW_CMD_SESSION_ENABLE,
+       WL_LLW_CMD_SESSION_DISABLE,
+       WL_LLW_CMD_SESSION_GET,
+       WL_LLW_CMD_CLIENT_ADD,
+       WL_LLW_CMD_CLIENT_DELETE,
+       WL_LLW_CMD_CLIENT_GET,
+       WL_LLW_CMD_FLOW_ADD,
+       WL_LLW_CMD_FLOW_DELETE,
+       WL_LLW_CMD_FLOW_GET,
+       WL_LLW_CMD_STATS
+} wl_llw_sub_cmd_xtlv_id_t;
+
+/* LLW stats */
+typedef enum wl_llw_xtlv {
+       WL_LLW_XTLV_STATS
+} wl_llw_xtlv_t;
+
+typedef struct wl_llw_stats {
+       uint32 txpackets;
+       uint32 txbytes;
+       uint32 txrts;
+       uint32 txnocts;
+       uint32 txnoack;
+       uint32 txfail;
+       uint32 txretry;
+       uint32 txdropped;
+       uint32 tx_avg_q_time;
+       uint32 tx_min_q_time;
+       uint32 tx_max_q_time;
+       uint32 tx_avg_rem_lifetime;
+       uint32 tx_min_rem_lifetime;
+       uint32 tx_max_rem_lifetime;
+       uint32 rxpackets;
+       uint32 rxbytes;
+       uint32 rxfail;
+       uint32 rxretry;
+       uint32 txschedfrm;
+       uint32 retxschedfrm;
+} wl_llw_stats_t;
+
+typedef struct wl_llw_stats_hdr {
+       uint16 version;
+       uint16 stats_cnt;
+       uint32 tot_len;
+       uint8 stat_xtlvs[];
+} wl_llw_stats_hdr_t;
+
+/* WL_LLW_XTLV_STATS */
+typedef struct wl_llw_stats_xtlv {
+       uint16 type;
+       uint16 len;
+       uint8 stats[];
+} wl_llw_stats_xtlv_t;
+
+/* WL_LLW_CMD_STATS */
+typedef struct wl_llw_stats_cmd {
+       uint8 session_id;
+       uint8 client_id;
+       uint16 padding;
+} wl_llw_stats_cmd_t;
+
+/* LLW flow ring ID config */
+/* WL_LLW_CMD_FLOW_ADD, WL_LLW_CMD_FLOW_DELETE, WL_LLW_CMD_FLOW_GET */
+typedef struct wl_llw_flow_cfg {
+       uint8 session_id;
+       uint8 flow_id;
+       uint16 padding;
+} wl_llw_flow_cfg_t;
+#endif /* End of LLW Session */
+
+#define WL_OMI_CONFIG_VERSION_1        1u
+
+/* values for valid_bm */
+#define OMI_CONFIG_VALID_BMP_RXNSS                     0x0001u
+#define        OMI_CONFIG_VALID_BMP_BW                         0x0002u
+#define OMI_CONFIG_VALID_BMP_ULMU_DISABLE              0x0004u
+#define OMI_CONFIG_VALID_BMP_TXNSTS                    0x0008u
+#define OMI_CONFIG_VALID_BMP_ERSU_DISABLE              0x0010u
+#define OMI_CONFIG_VALID_BMP_DLMU_RSD_RCM              0x0020u
+#define OMI_CONFIG_VALID_BMP_ULMU_DATA_DISABLE         0x0040u
+#define OMI_CONFIG_VALID_BMP_ALL                       0x0FFFu
+
+#define OMI_CONFIG_BW_MAX                      3u
+
+typedef struct wl_omi_config {
+       uint16  valid_bm;               /* validity bitmask for each config */
+       uint8   rxnss;
+       uint8   bw;
+       uint8   ulmu_disable;
+       uint8   txnsts;
+       uint8   ersu_disable;
+       uint8   dlmu_resound_rec;
+       uint8   ulmu_data_disable;
+       uint8   pad[3];
+} wl_omi_config_t;
+
+typedef struct wl_omi_req {
+       uint16  version;
+       uint16  len;
+       wl_omi_config_t config;
+} wl_omi_req_v1_t;
+
+/* Bits for ULMU disable reason */
+#define OMI_ULMU_DISABLED_HOST                 0x01u   /* Host has disabled through he omi */
+
+#define OMI_ULMU_DISABLED_NAN                  0x04u   /* Disabled due to NAN enabled */
+#define OMI_ULMU_DISABLED_BTCOEX               0x08u   /* Disabled while in BT Coex activity */
+#define OMI_ULMU_DISABLED_LTECOEX              0x10u   /* Disabled due to LTE Coex activity */
+#define OMI_ULMU_DISABLED_NON11AX_CONN 0x20u   /* Disabled due to not associated to 11ax AP */
+#define OMI_ULMU_DISABLED_THROTTLE_ENABLE      0x40u   /* Disabled due to throttle timer running */
+#define OMI_ULMU_DISABLED_TXCHAIN_DOWNGRADE    0x80u /* Disabled due to Txchain downgrade */
+#define OMI_ULMU_DISABLED_TX_DUTY_CYCLE                0x100u /* Disabled due to tx duty cycle */
+
+/* Bits for DLMU Resound Recommendation reason */
+#define OMI_DLMU_RSD_RCM_HOST  (0x1u << 0u)    /* Host directly set the bit */
+#define OMI_DLMU_RSD_RCM_MPF   (0x1u << 1u)    /* Set on MPF state change */
+
+#define WL_OMI_STATUS_VERSION_1        1u
+typedef struct wl_omi_status {
+       uint16  version;
+       uint16  len;
+       wl_omi_config_t omi_pending;    /* OMI requests pending */
+       uint16  omi_data;               /* current OM Control field for completed OMI requests */
+       uint16  ulmu_disable_reason;    /* Bits representing UL OFDMA disable reasons */
+       uint32  ulmu_disable_duration;  /* Duration (ms) for which UL OFDMA is disabled */
+} wl_omi_status_v1_t;
+
+#define WL_OMI_STATUS_VERSION_2        2u
+typedef struct wl_omi_status_v2 {
+       uint16  version;
+       uint16  len;
+       wl_omi_config_t omi_pending;    /* OMI requests pending */
+       uint16  omi_data;               /* Current OM Control field for completed OMI requests */
+       uint16  ulmu_disable_reason;    /* Bits representing UL OFDMA disable reasons */
+       uint32  ulmu_disable_duration;  /* Duration (ms) for which UL OFDMA is disabled */
+       uint32  dlmu_rsd_rcm_duration;  /* Dur (ms) for which ResoundRecommentation is set */
+       uint16  dlmu_rsd_rcm_mpf_state; /* The MPF state value */
+       uint16  dlmu_rsd_rcm_reason;    /* DL MU-MIMO recommendation reasons bitmap */
+} wl_omi_status_v2_t;
+
+#define WL_ULMU_DISABLE_STATS_VERSION_1        1u
+typedef struct wl_ulmu_disable_stats {
+       uint16 version;
+       uint16 len;
+       uint32 ulmu_disable_ts; /* UL OFDMA disabled timestamp (ms) */
+       uint16 ulmu_disable_reason;     /* Bits representing UL OFDMA disable reasons */
+       uint16 ulmu_disable_count;      /* UL MU disable count during current infra association */
+       uint32 last_trig_rx_ts; /* Last trigger frame received timestamp (ms) */
+       uint16 trig_rx_count;   /* No of trigger frames received after last UL OFDMA disable */
+       uint16 max_latency;     /* Max latency by AP to re-act for UL OFDMA disable request (ms) */
+       uint16 min_latency;     /* Min latency by AP to re-act for UL OFDMA disable request (ms) */
+       uint16 avg_latency;     /* Avg latency by AP to re-act for UL OFDMA disable request (ms) */
+} wl_ulmu_disable_stats_v1_t;
+
+/* sub-xtlv IDs within WL_STATS_XTLV_WL_SLICE_TX_HISTOGRAMS */
+enum wl_tx_histogram_id {
+       WL_TX_HIST_TXQ_ID               = 1,
+       WL_TX_HIST_LOW_TXQ_ID           = 2,
+       WL_TX_HIST_SCBQ_ID              = 3,
+       WL_TX_HIST_EXCUR_TXQ_ID         = 4,
+       WL_TX_HIST_EXCUR_LOW_TXQ_ID     = 5
+};
+
+/* common tx histogram structure */
+typedef struct wl_tx_hist {
+       uint16 hist_bmap;       /* bit N indicates histogram follows for priority or fifo N */
+       uint16 hist_count;      /* count of histograms in var len array */
+       uint32 hist[1];         /* var len array of histograms each prefix by hist length */
+} wl_tx_hist_t;
+
+#define WL_TX_HIST_FIXED_LEN   (OFFSETOF(wl_tx_hist_t, hist))
+#define WL_TX_HIST_FULL_LEN(num_hist, max_hist_size)   \
+       (WL_TX_HIST_FIXED_LEN + (num_hist) *            \
+       (max_hist_size + 1) * sizeof(uint32))
+
+/* structure for WL_TX_HIST_TXQ, WL_TX_HIST_EXCUR_TXQ_ID */
+typedef struct wl_tx_hist_txq {
+       uint32 bsscfg_bmap;      /* bitmap of bsscfg indexes associated with this queue */
+       wl_tx_hist_t tx_hist;   /* tx histograms */
+} wl_tx_hist_txq_t;
+
+#define WL_TX_HIST_TXQ_FIXED_LEN       \
+       (OFFSETOF(wl_tx_hist_txq_t, tx_hist) + WL_TX_HIST_FIXED_LEN)
+#define WL_TX_HIST_TXQ_FULL_LEN(num_hist, max_hist_size)       \
+       (OFFSETOF(wl_tx_hist_txq_t, tx_hist) +                  \
+       WL_TX_HIST_FULL_LEN(num_hist, max_hist_size))
+
+/* sub-xtlv IDs within WL_STATS_XTLV_WL_SLICE_TX_HISTOGRAMS */
+enum wl_txq_stop_histogram_id {
+       WL_TXQ_STOP_HIST_SW             = 1,
+       WL_TXQ_STOP_HIST_HW             = 2,
+       WL_TXQ_STOP_HIST_PKTS_SW        = 3,
+       WL_TXQ_STOP_HIST_PKTS_HW        = 4,
+       WL_TXQ_STOP_HIST_MAX            = WL_TXQ_STOP_HIST_PKTS_HW
+};
+
+/* common tx histogram structure */
+typedef struct wl_txq_stop_hist {
+       wl_tx_hist_t tx_hist;   /* tx histograms */
+} wl_txq_stop_hist_t;
+
+#define WL_TXQ_STOP_HIST_FIXED_LEN     \
+       (OFFSETOF(wl_txq_stop_hist_t, tx_hist) + WL_TX_HIST_FIXED_LEN)
+#define WL_TXQ_STOP_HIST_FULL_LEN(num_hist, max_hist_size)     \
+       (OFFSETOF(wl_txq_stop_hist_t, tx_hist) +                \
+       WL_TX_HIST_FULL_LEN(num_hist, max_hist_size))
+
+/* structure for WL_TX_HIST_LOW_TXQ, WL_TX_HIST_EXCUR_LOW_TXQ_ID */
+typedef struct wl_tx_hist_low_txq {
+       wl_tx_hist_t tx_hist;   /* tx histograms */
+} wl_tx_hist_low_txq_t;
+
+#define WL_TX_HIST_LOW_TXQ_FIXED_LEN   \
+       (OFFSETOF(wl_tx_hist_low_txq_t, tx_hist) + WL_TX_HIST_FIXED_LEN)
+#define WL_TX_HIST_LOW_TXQ_FULL_LEN(num_hist, max_hist_size)   \
+       (OFFSETOF(wl_tx_hist_low_txq_t, tx_hist) +              \
+       WL_TX_HIST_FULL_LEN(num_hist, max_hist_size))
+
+/* structure for WL_TX_HIST_SCBQ */
+typedef struct wl_tx_hist_scbq {
+       struct ether_addr ea;   /* ether addr of peer */
+       uint16 bsscfg_idx;      /* bsscfg index */
+       wl_tx_hist_t tx_hist;   /* tx histograms */
+} wl_tx_hist_scbq_t;
+
+#define WL_TX_HIST_SCBQ_FIXED_LEN      \
+       (OFFSETOF(wl_tx_hist_scbq_t, tx_hist) + WL_TX_HIST_FIXED_LEN)
+#define WL_TX_HIST_SCBQ_FULL_LEN(num_hist, max_hist_size)      \
+       (OFFSETOF(wl_tx_hist_scbq_t, tx_hist) +                 \
+       WL_TX_HIST_FULL_LEN(num_hist, max_hist_size))
+
+/* sub-xtlv IDs within WL_STATS_XTLV_WL_SLICE_TX_QUEUE_DEPTH */
+enum wl_tx_queue_depth_id {
+       WL_TX_QUEUE_DEPTH_TXQ_ID                = 1,
+       WL_TX_QUEUE_DEPTH_LOW_TXQ_ID            = 2,
+       WL_TX_QUEUE_DEPTH_SCBQ_ID               = 3,
+       WL_TX_QUEUE_DEPTH_EXCUR_TXQ_ID          = 4,
+       WL_TX_QUEUE_DEPTH_EXCUR_LOW_TXQ_ID      = 5
+};
+
+/* common tx queue depth structure */
+typedef struct wl_tx_queue_depth {
+       uint16 queue_depth_bmap;        /* bitmap of queue depth in var len array */
+       uint16 queue_depth_count;       /* count of queue depth in var len array */
+       uint16 queue_depth[1];          /* var len array of queue depth */
+} wl_tx_queue_depth_t;
+
+#define WL_TX_QUEUE_DEPTH_FIXED_LEN    (OFFSETOF(wl_tx_queue_depth_t, queue_depth))
+#define WL_TX_QUEUE_DEPTH_FULL_LEN(num_queue_depth)            \
+       (WL_TX_QUEUE_DEPTH_FIXED_LEN + (num_queue_depth) *      \
+       sizeof(uint16))
+
+/* structure for WL_TX_QUEUE_DEPTH_TXQ_ID, WL_TX_QUEUE_DEPTH_EXCUR_TXQ_ID */
+typedef struct wl_tx_queue_depth_txq {
+       uint32 bsscfg_map;      /* bitmap of bsscfg indexes associated with this queue */
+       wl_tx_queue_depth_t tx_queue_depth;     /* queue depth */
+} wl_tx_queue_depth_txq_t;
+
+#define WL_TX_QUEUE_DEPTH_TXQ_FIXED_LEN        \
+       (OFFSETOF(wl_tx_queue_depth_txq_t, tx_queue_depth) + WL_TX_QUEUE_DEPTH_FIXED_LEN)
+#define WL_TX_QUEUE_DEPTH_TXQ_FULL_LEN(num_queue_depth)                \
+       (OFFSETOF(wl_tx_queue_depth_txq_t, tx_queue_depth) +    \
+       WL_TX_QUEUE_DEPTH_FULL_LEN(num_queue_depth))
+
+/* structure for WL_TX_QUEUE_DEPTH_LOW_TXQ_ID, WL_TX_QUEUE_DEPTH_EXCUR_LOW_TXQ_ID */
+typedef struct wl_tx_queue_depth_low_txq {
+       wl_tx_queue_depth_t tx_queue_depth;     /* queue depth */
+} wl_tx_queue_depth_low_txq_t;
+
+#define WL_TX_QUEUE_DEPTH_LOW_TXQ_FIXED_LEN    \
+       (OFFSETOF(wl_tx_queue_depth_low_txq_t, tx_queue_depth) + WL_TX_QUEUE_DEPTH_FIXED_LEN)
+#define WL_TX_QUEUE_DEPTH_LOW_TXQ_FULL_LEN(num_queue_depth)            \
+       (OFFSETOF(wl_tx_queue_depth_low_txq_t, tx_queue_depth) +        \
+       WL_TX_QUEUE_DEPTH_FULL_LEN(num_queue_depth))
+
+/* structure for WL_TX_QUEUE_DEPTH_SCBQ_ID */
+typedef struct wl_tx_queue_depth_scbq {
+       struct ether_addr ea;                   /* ether addr of peer */
+       uint16 bsscfg_idx;                      /* bsscfg index */
+       wl_tx_queue_depth_t tx_queue_depth;     /* queue depth */
+} wl_tx_queue_depth_scbq_t;
+
+#define WL_TX_QUEUE_DEPTH_SCBQ_FIXED_LEN       \
+       (OFFSETOF(wl_tx_queue_depth_scbq_t, tx_queue_depth) + WL_TX_QUEUE_DEPTH_FIXED_LEN)
+#define WL_TX_QUEUE_DEPTH_SCBQ_FULL_LEN(num_queue_depth)       \
+       (OFFSETOF(wl_tx_queue_depth_scbq_t, tx_queue_depth) +   \
+       WL_TX_QUEUE_DEPTH_FULL_LEN(num_queue_depth))
+
+/* sub-xtlv IDs within WL_STATS_XTLV_BUS_PCIE_TX_HISTOGRAMS */
+enum wl_pcie_tx_histogram_id {
+       WL_PCIE_TX_HIST_ID = 1
+};
+
+/* structure for PCIE_TX_HIST_ID */
+typedef struct wl_pcie_tx_hist {
+       uint16 ring_id;         /* PCIe ring id */
+       uint16 pad;             /* 4-byte alignment */
+       wl_tx_hist_t tx_hist;   /* hist_bmap:
+                                *      0x1=tx histogram
+                                *      0x2=tx status pending histogram
+                                */
+} wl_pcie_tx_hist_t;
+
+#define WL_PCIE_TX_HIST_FIXED_LEN      \
+       (OFFSETOF(wl_pcie_tx_hist_t, tx_hist) + WL_TX_HIST_FIXED_LEN)
+#define WL_PCIE_TX_HIST_FULL_LEN(num_hist, max_hist_size)      \
+       (OFFSETOF(wl_pcie_tx_hist_t, tx_hist) +                 \
+       WL_TX_HIST_FULL_LEN(num_hist, max_hist_size))
+
+/* sub-xtlv IDs within WL_STATS_XTLV_BUS_PCIE_TX_QUEUE_DEPTH */
+enum wl_pcie_tx_queue_depth_id {
+       WL_PCIE_TX_QUEUE_DEPTH_ID = 1
+};
+
+/* structure for WL_PCIE_TX_QUEUE_DEPTH_ID */
+typedef struct wl_pcie_tx_queue_depth {
+       uint16 ring_id;         /* PCIe ring id */
+       uint16 queue_depth;     /* queue depth of ring id */
+       uint16 tx_status_pend;  /* tx status pending of ring id */
+       uint16 pad;             /* 4-byte alignment */
+} wl_pcie_tx_queue_depth_t;
+
+#define WL_PCIE_TX_QUEUE_DEPTH_FIXED_LEN       sizeof(wl_pcie_tx_queue_depth_t)
+
+#define WL_WSEC_DEL_PMK_VER_V1 1u
+/* tlv ids for del pmk */
+#define WL_DEL_PMK_TLV_ID                      1u
+#define WL_DEL_PMKID_TLV_ID                    2u
+#define WL_DEL_PEER_ADDR_TLV_ID                3u
+typedef struct wl_wsec_del_pmk {
+       uint16 version;
+       uint16 length;
+       uint8 xtlvs[];
+} wl_wsec_del_pmk_t;
+#define WL_WSEC_DEL_PMK_FIXED_LEN_V1   OFFSETOF(wl_wsec_del_pmk_t, xtlvs)
+
+#define WLC_RC_ROAM_VER_1      1
+
+typedef struct wlc_rcroam {
+       uint16 ver;
+       uint16 len;
+       uint8 data[];
+} wlc_rcroam_t;
+
+typedef struct wlc_rcroam_info_v1 {
+       uint16  inactivity_period; /* inactivty monitor period */
+       uint16  roam_scan_timeout;
+       uint16  periodic_roam_scan_timeout;
+       uint8   roam_trig_step; /* roaming trigger step value */
+       bool enab;
+} wlc_rcroam_info_v1_t;
+
+#define WLC_RC_ROAM_CUR_VER            WLC_RC_ROAM_VER_1
+#define RCROAM_HDRLEN                  4u
+#define MAX_RCSCAN_TIMER               300u
+
+/* Reasons for re-setting RC ROAM params */
+#define WLC_RCROAM_RESET_JOIN  0 /* New  join */
+#define WLC_RCROAM_REASON_ROAM_SUCCESS 1 /* Successful roam */
+#define WLC_RCROAM_RESET_RSSI_CHANGE   2 /* RSSI of the link which was bad regained/worsened */
+#define WLC_RCROAM_RESET_BCN_LOSS      3       /* Beacon loss */
+#define WLC_RCROAM_RESET_DISASSOC_RX   4       /* Disassoc was received */
+#define WLC_RCROAM_RESET_DEAUTH_RX     5       /* Deauth was received */
+#define WLC_RCROAM_RESET_IOVAR 6       /* Iovar to disable rcroam was received from host */
+
+#define WLC_SILENT_ROAM_VER_1  1
+/* silent roam information struct */
+typedef struct wlc_sroam_info_v1 {
+       /* Silent roam Set/Get value */
+       uint8 sroam_on;                 /* sroam on/off */
+       int8 sroam_min_rssi;            /* minimum rssi threshold to activate the feature */
+       uint8 sroam_rssi_range;         /* rssi tolerance to determine stationary status */
+       uint8 sroam_score_delta;        /* roam score delta value to prune candidate ap */
+       uint8 sroam_period_time;        /* required monitoring period to trigger roaming scan */
+       uint8 sroam_band;               /* band setting of roaming scan (all, 5g, 2g) */
+       uint8 sroam_inact_cnt;          /* tx/rx frame count threshold for checking inactivity */
+       /* Silent roam monitor value */
+       int8 sroam_ref_rssi;            /* reference rssi which is picked when monitoring is
+                                        * started. it is updated to current rssi when it's
+                                        * out from rssi range
+                                        */
+       uint8 sroam_time_since;         /* elapsed time since start monitoring */
+       uint8 pad[3];
+       uint32 sroam_txfrm_prev;        /* save current tx frame counts */
+       uint32 sroam_rxfrm_prev;        /* save current rx frame counts */
+} wlc_sroam_info_v1_t;
+
+typedef struct wlc_sroam {
+       uint16 ver;
+       uint16 len;
+       uint8 data[];
+} wlc_sroam_t;
+
+#define WLC_SILENT_ROAM_CUR_VER                WLC_SILENT_ROAM_VER_1
+#define SROAM_HDRLEN                   4u
+
+#define        DEF_SROAM_OFF                   0
+#define        DEF_SROAM_MIN_RSSI              -65
+#define        DEF_SROAM_RSSI_RANGE            3u
+#define        DEF_SROAM_SCORE_DELTA           1u
+#define        DEF_SROAM_PERIOD_TIME           10u
+#define        DEF_SROAM_INACT_CNT             5u
+#define        MAX_SROAM_RSSI                  -70
+#define        MAX_SROAM_RSSI_RANGE            5u
+#define        MAX_SROAM_SCORE_DELTA           10u
+#define        MAX_SROAM_PERIOD_TIME           250u
+#define        SROAM_BAND_AUTO                 3u
+
+/* MACSMPL IOVAR parameters */
+typedef enum wl_macdbg_macsmpl_iovar_id {
+       WL_MACSMPL_START        = 0,
+       WL_MACSMPL_STOP         = 1,
+       WL_MACSMPL_DUMP         = 2,
+       WL_MACSMPL_STATUS       = 3,
+       WL_MACSMPL_SIZE         = 4
+} wl_macdbg_macsmpl_iovar_id_t;
+
+/* WL_MACSMPL_STATUS values */
+typedef enum wl_macdbg_macsmpl_status {
+       WL_MACSMPL_STATUS_IDLE          = 0,
+       WL_MACSMPL_STATUS_ACTIVE        = 1,
+       WL_MACSMPL_STATUS_WAIT_FOR_TRIG = 2,
+       WL_MACSMPL_STATUS_TRIGGERED     = 3
+} wl_macdbg_macsmpl_status_t;
+
+/* WL_MACSMPL_START_PARAM subcommand data */
+typedef struct wl_macsmpl_start_param {
+       uint32 trig_condition;  /* trigger condition */
+       uint16 gpio_mux;        /* MACControl1 GPIOSel field */
+       uint8 pad[2];           /* 4-byte struct alignment */
+} wl_macsmpl_param_start_t;
+
+/* MAC SC fragment request data */
+typedef struct wl_macsmpl_frag_req_param {
+       uint32 offset;          /* requested MAC SC fragment offset */
+       uint32 size;            /* requested MAC SC fragment size, bytes */
+} wl_macsmpl_frag_req_param_t;
+
+/* MAC SC fragment response data */
+typedef struct wl_macsmpl_frag_resp_param {
+       uint32 offset;          /* MAC SC response fragment offset */
+       uint32 size;            /* MAC SC reponse fragment size, bytes */
+       uint8 data[];           /* MAC SC response fragment data, flexible array */
+} wl_macsmpl_frag_resp_param_t;
+
+/* MAC SC status data */
+typedef struct wl_macsmpl_status {
+       uint32 maccontrol1;     /* MACControl1 register value */
+       uint32 macsc_flags;     /* M_MACSC_FLAGS SHM register value */
+       uint16 sc_play_ctrl;    /* TXE SampleCollectPlayCtrl register value */
+       uint16 sc_cur_ptr;      /* TXE SampleCollectCurPtr register value */
+       uint16 sc_start_ptr;    /* TXE SampleCollectStartPtr register value */
+       uint16 sc_stop_ptr;     /* TXE SampleCollectStopPtr register value */
+} wl_macsmpl_status_t;
+
+/* WL_MACSMPL parameters data */
+typedef struct wl_macsmpl_param {
+       wl_macdbg_macsmpl_iovar_id_t subcmd_id;
+       union {
+               wl_macsmpl_param_start_t start;
+               wl_macsmpl_frag_req_param_t frag_req;
+       } u;
+} wl_macsmpl_param_t;
+
+/* High priority P2P */
+#define WL_HP2P_COUNTERS_VER           2u
+typedef struct hp2p_counters {
+       uint16 frames_queued;
+       uint16 frames_processed;
+       uint16 frames_exp;
+       uint16 frames_preempt;
+       uint16 frames_retried;
+       uint16 reserved;                /* reserved, rsvd2 and rsvd3 are experimental counters */
+       uint16 rsvd2;
+       uint16 rsvd3;
+} hp2p_counters_t;
+
+typedef struct hp2p_counters_v2 {
+       uint32 frames_queued;           /* Number of AMPDUs processed */
+       uint16 frames_exp;              /* Number of Lifetime expiries */
+       uint16 edt_retry;               /* Exceed due to - retry */
+       uint16 mpif_reconf;             /* MPIF Reconfigure */
+       uint16 exceed_delay;            /* Exceed delay threshold */
+       uint16 edt_nav_thresh;          /* Exceed due to - NAV threshold */
+       uint16 edt_dc_def;              /* Exceed due to - DC based deferral */
+       uint16 edt_tx_fifo_full;        /* Exceed due to - Tx FIFO full */
+       uint16 edt_cts_thresh;          /* Exceed due to - CTS threshold */
+       uint16 dbg1;                    /* dbgX are for internal debugging */
+       uint16 dbg2;
+       uint16 dbg3;
+       uint16 dbg4;
+       uint16 dbg5;
+       uint16 dbg6;
+       uint16 dbg7;
+       uint16 dbg8;
+       uint16 dbg9;
+       uint16 dbg10;
+} hp2p_counters_v2_t;
+
+typedef struct hp2p_counters_hdr {
+       uint16 version;         /* version of hp2p_counters_t structure */
+       uint16 len;
+       uint16 slice_idx;
+       uint16 pad;
+       uint8 counters[];
+} hp2p_counters_hdr_t;
+
+/* HP2P RLLW Stats */
+#define WL_HP2P_RLLW_STATS_VER 1u
+typedef struct hp2p_rllw_stats_hdr {
+       uint16  version;        /* version of hptp_rllw_stats structure */
+       uint16  len;            /* length of the payload */
+       uint8   slice_idx;      /* Slice idx BAND_2G_INDEX - 0 / BAND_5G_INDEX - 1 */
+       uint8   pad[3];
+       uint8 stats[];          /* rllw_stats instance */
+} hp2p_rllw_stats_hdr_t;
+
+/*
+ * rllw stats common & per band
+ *
+ */
+typedef struct hp2p_rllw_stats_v1 {
+       /* Slice Specific Stats */
+       uint16  n_hnav_intrs;                   /* # of high nav interrupts */
+       uint16  n_switches;                     /* # of Switches to band n */
+       /* Stats on wlc_trig */
+       uint16  n_override_pkts;                /* # of pkts enqd with ovrd bit set */
+       uint16  n_overrides;                    /* # of overrides - this is only trig_wlc */
+       uint16  n_override_pkts_acked;          /* # of ovrd pkts that got an ACK */
+       uint16  n_override_pkts_not_acked;      /* # of ovrd pkts that werent ACKed */
+} hp2p_rllw_stats_v1_t;
+
+/* TX enable flags */
+#define WL_HP2P_TX_AMPDU                               0x0001u
+#define WL_HP2P_TX_AMSDU                               0x0002u
+#define WL_HP2P_TX_RDG                                 0x0004u
+#define WL_HP2P_TX_TXOP                                        0x0008u
+#define WL_HP2P_TX_TXOP_RTS                            0x0010u
+
+/* RX enable flags */
+#define WL_HP2P_RX_AMPDU                               0x0001u
+#define WL_HP2P_RX_AMSDU                               0x0002u
+#define WL_HP2P_RX_RDG                                 0x0004u
+#define WL_HP2P_RX_AMPDU_REORDER                       0x0008u
+#define WL_HP2P_RX_DELETE                              0x0010u
+
+/* Max/min values for configuration parameters to check validity */
+#define WL_HP2P_MAX_RETRY_MAX                  14u
+#define WL_HP2P_MAX_RETRY_MIN                  6u
+#define WL_HP2P_LATENCY_TARGET_MAX             30u
+#define WL_HP2P_BURST_INTERVAL_MAX             64u
+#define WL_HP2P_MAX_FIFO                       5u
+#define WL_HP2P_MAX_UCODE_LATENCY_THR          500u
+#define WL_HP2P_MAX_UCODE_RECOV_TO             500u
+#define WL_HP2P_MAX_UCODE_NAV_THR              50000u
+
+#define WLC_HP2P_DEF_NAV_THRESH                        13u
+#define WLC_HP2P_MIN_NAV_THRESH                        1u
+#define WLC_HP2P_MAX_NAV_THRESH                        35u
+
+#define WL_HP2P_VERSION                1u
+typedef struct hp2p_tx_config {
+       struct ether_addr peer_addr;
+       uint16 max_burst;
+       uint16 txop;            /* stored in network order (ls octet first) */
+       uint16 flags;   /* flags to enable/disable AMPDU, AMSDU, RDG, TXOP, TXOP_RTS */
+       uint8 aci;
+       uint8 ecw;
+       uint8 fifo;
+       uint8 tid;
+       uint8 burst_interval;
+       uint8 latency_target;
+       uint8 max_retry;
+       uint8 pad;
+} hp2p_tx_config_t;
+
+typedef struct hp2p_rx_config {
+       struct ether_addr peer_addr;
+       uint16 flags;   /* flags to enable/disable AMPDU, AMSDU, RDG, AMPDU Reorder */
+       uint8 tid;
+       uint8 pad[3];
+} hp2p_rx_config_t;
+
+typedef struct hp2p_udbg_config {
+       uint16 recovery_timeout;        /* multiples of 256 usecs */
+       uint16 latency_thresh;          /* multiples of 256 usecs */
+       uint16 enable_trap;             /* trap if ucode delay exceeds latency_thresh */
+       uint16 nav_thresh;              /* in usec */
+} hp2p_udbg_config_t;
+
+#define WLC_HP2P_RLLW_RETRY_LIMIT      7u
+#define WLC_HP2P_MAX_PKTLIFETIME_IN_MS 2000u   /* 2 seconds */
+
+/*
+ * nav_thresh: 13      : By default set to 13ms
+ * retry_limit: 0      : Auto / Default retry limit to be applied
+ *                     Max retry limit is 7
+ * pkt_lifetime: 0     : Auto / Default pkt lifetime to be applied
+ *                     Max value cant exceed 2000u (2seconds)
+ * floor_rate: 0       : Auto / Default min rate to be applied
+ * ceiling_rate: 0     : Auto / Default max rate to be applied
+ */
+typedef struct hp2p_rllw_cfg {
+       uint8   nav_thresh;     /* NAV threshold in ms */
+       uint8   retry_limit;    /* # max retries before pkt is discarded */
+       uint16  pkt_lifetime;   /* Pkt lifetime in ms */
+       uint16  floor_rate;     /* Min rate in Mbps */
+       uint16  ceiling_rate;   /* Max rate in Mbps */
+} hp2p_rllw_cfg_t;
+
+#define WL_HP2P_CAP_MPEER      0x01u   /* Multipeer Hp2p */
+#define WL_HP2P_CAP_MPEER_TXOP 0x02u   /* Same txop transmit on mpeer Hp2p */
+#define WL_HP2P_CAP_RLLW       0x04u   /* Band switching and override on NAV */
+#define WL_HP2P_CAP_SPLIT_TXS  0x08u   /* Spilt tx status for rllw sub feature */
+
+typedef uint32 hp2p_cap_t;     /* HP2P capabilities */
+
+typedef struct hp2p_cmd {
+       uint16 type;
+       uint16 len;
+       uint8 data[];
+} hp2p_cmd_t;
+
+#define WL_HP2P_CTRL_MPEER_TXOP_ENAB   0x01u   /* Same txop transmit on mpeer Hp2p */
+/*
+ * Band switching on NAV. Control for band
+ * switching for HPP traffic, applies only
+ * for dual local/peer map availability.
+ */
+#define WL_HP2P_CTRL_RLLW_SWITCH_ENAB  0x02u   /* RLLW Band switching enabled */
+#define WL_HP2P_CTRL_RLLW_PRIMARY_OVR  0x04u   /* RLLW Override enab on primary band. */
+#define WL_HP2P_CTRL_RLLW_DENY_BT      0x08u   /* RLLW Give WiFi priority over BT */
+#define WL_HP2P_CTRL_RLLW_PKTLT_ENAB   0x10u   /* RLLW pkt lifetime based decision enabled */
+
+typedef uint32 hp2p_ctrl_t;    /* HP2P Ctrl bits */
+
+/* TLVs for HP2P related IOVARs */
+typedef enum wl_hp2p_tlv {
+       HP2P_TLV_RLLW_SLICE_STATS       = 1u,
+       HP2P_TLV_RLLW_PEER_STATS        = 2u
+} wl_hp2p_tlv_t;
+
+/* Top level HP2P RLLW stats header */
+typedef struct wl_hp2p_stats_hdr {
+       uint32  n_stats;        /* # of TLVs in the payload */
+       uint32  totlen;         /* total length of TLVs following this field */
+       uint8   stats_tlvs[];   /* chain of TLVs for reader to decode based on length */
+} wl_hp2p_stats_hdr;
+
+/* Per Slice RLLW Stats */
+typedef struct wlc_hp2p_rllw_slice_stats {
+       uint8   slice;                          /* slice number */
+       uint8   pad;
+       uint16  n_hnav_intrs;                   /* # of high nav interrupts on slice n */
+       uint16  n_overrides;                    /* # of overrides */
+       uint16  n_switches;                     /* # of switches */
+       uint32  n_switched_pkts;                /* # of packets after switching to slice n */
+       uint32  n_switched_pkts_not_acked;      /* # of packets after switch & Not ACKed */
+       uint32  n_override_pkts;                /* # of pkts enqd with ovrd bit set on slice n */
+       uint32  n_override_pkts_not_acked;      /* # of ovrd pkts that werent ACKed on slice n */
+       uint32  n_no_switch_in_pktlife;         /* # of no switch happened,pkts within lifetime */
+       uint32  n_no_override_in_pktlife;       /* # of no ovrd happened,pkts within lifetime */
+} wlc_hp2p_rllw_slice_stats_t;
+
+/* Peer specific stats */
+
+typedef struct {
+       uint8   slice;                          /* slice number */
+       uint8   pad[3];
+       uint16  n_overrides;                    /* # of overrides */
+       uint16  n_switches;                     /* # of switches */
+       uint32  n_switched_pkts;                /* # of packets after switching to slice n */
+       uint32  n_switched_pkts_not_acked;      /* # of packets after switch & Not ACKed */
+       uint32  n_override_pkts;                /* # of pkts enqd with ovrd bit set on slice n */
+       uint32  n_override_pkts_not_acked;      /* # of ovrd pkts that werent ACKed on slice n */
+       uint32  n_no_switch_in_pktlife;         /* # of no switch happened,pkts within lifetime */
+       uint32  n_no_override_in_pktlife;       /* # of no ovrd happened,pkts within lifetime */
+} wlc_hp2p_rllw_peer_stats_t;
+
+/* Peer Stats Info to host */
+typedef struct wlc_hp2p_peer_stats_info {
+       struct ether_addr               peer_mac;       /* Mac Address of the HP2P peer */
+       uint16                          nslices;        /* Number of slices */
+       wlc_hp2p_rllw_peer_stats_t      peer_stats[MAX_NUM_D11CORES];   /* Peer specific stats */
+} wlc_hp2p_peer_stats_info_t;
+
+typedef struct hp2p_cmd_hdr {
+       uint16 version;
+       uint16 slice_idx;
+       uint8 cmd[];
+} hp2p_cmd_hdr_t;
+
+/* to be used in type field of hp2p_cmd_t structure while issuing HP2P commands */
+typedef enum hp2p_cmd_id {
+       WL_HP2P_CMD_ENABLE      = 0,    /* Enable HP2P */
+       WL_HP2P_CMD_TX_CONFIG   = 1,    /* Tx Configuration */
+       WL_HP2P_CMD_RX_CONFIG   = 2,    /* Rx Configuration */
+       WL_HP2P_CMD_COUNTERS    = 3,    /* HP2P Counters */
+       WL_HP2P_CMD_UDBG_CONFIG = 4,    /* ucode debug config */
+       WL_HP2P_CMD_RLLW_CFG    = 5,    /* HP2P RLLW config */
+       WL_HP2P_CMD_RLLW_STATS  = 6,    /* HP2P RLLW Stats */
+       WL_HP2P_CMD_CAP         = 7,    /* HP2P Capability */
+       WL_HP2P_CMD_CTRL        = 8     /* HP2P feature ctrl */
+} hp2p_cmd_id_t;
+
+/**
+ * TX Profile.
+ *
+ * TX Profile allows the host to configure frames with a specific profile. This
+ * includes but is not limited to transmit rate, number of retries, whether or
+ * not to use frame aggregation, whether or not to use AMSDU and RTS protection
+ * threshold. The original intent is for the host to be able to specify transmit
+ * "reliability".
+ */
+
+/* IOVAR */
+typedef struct wlc_tx_profile_ioc {
+       uint16  id;
+       uint16  length;
+       union {
+               uint32 options;
+               uint32 status;
+       } u;
+       uint8   data[];
+} wlc_tx_profile_ioc_t;
+
+#define TX_PROFILE_IOV_HDR_SIZE (OFFSETOF(wlc_tx_profile_ioc_t, u))
+#define TX_PROFILE_IOV_OPTION_SIZE (sizeof(wlc_tx_profile_ioc_t) - TX_PROFILE_IOV_HDR_SIZE)
+
+/* TX Profile parameter TLV */
+enum tx_profile_param_id {
+       WL_TX_PROFILE_PARAM_RATE        = 0,
+       WL_TX_PROFILE_PARAM_RTS         = 1,
+       WL_TX_PROFILE_PARAM_RETRY       = 2,
+       WL_TX_PROFILE_PARAM_BW          = 3,
+       WL_TX_PROFILE_PARAM_AGGRE       = 4,
+       WL_TX_PROFILE_PARAM_AMSDU       = 5,
+       WL_TX_PROFILE_PARAM_AMPDU       = 6,
+       WL_TX_PROFILE_PARAM_LAST        = 7
+};
+
+typedef enum tx_profile_param_id tx_profile_param_id_t;
+
+typedef struct tx_profile_param {
+       uint16                  param_id;
+       uint16                  length;
+       uint8                   param[];
+} tx_profile_param_t;
+
+/* Subcommands */
+typedef enum tx_profile_cmd_id {
+       /* The IOVAR to enable/disable the TX Profile in general. An integer
+        *  is passed to the firmware with value 0 or 1.
+        */
+       WL_TX_PROFILE_ENABLE    = 0,
+       /* Create a TX Profile with provided parameters. */
+       WL_TX_PROFILE_CREATE    = 1,
+       /* Update a TX profile with provided parameters. */
+       WL_TX_PROFILE_UPDATE    = 2,
+       /* Delete a TX Profile. */
+       WL_TX_PROFILE_DELETE    = 3,
+       /* Dump TX Profile related debug information. */
+       WL_TX_PROFILE_DUMP      = 4,
+       /* Show TX Profile stats */
+       WL_TX_PROFILE_STATS     = 5,
+       /* Show Tx Profile tagged packets log */
+       WL_TX_PROFILE_PKT_LOGS  = 6
+} tx_profile_cmd_id_t;
+
+typedef struct tx_profile_index_params {
+       uint16  profile_index;
+       uint16  length;
+       uint8   params[];
+} tx_profile_index_params_t;
+
+typedef struct tx_profile_index_stats {
+       uint32  profile_index;
+       uint32  tx_finish_cnt;
+       uint32  tx_acked_cnt;
+       uint32  tx_phy_err_cnt;
+       uint32  tx_suspend_cnt;
+} tx_profile_index_stats_t;
+
+typedef struct tx_profile_pkt_log {
+       uint32  rate;
+       uint16  retries;
+       uint16  rts;
+} tx_profile_pkt_log_t;
+
+/* End TX Profile section */
+
+typedef enum wl_rffe_cmd_type {
+       WL_RFFE_CMD_DEBUG_MODE          = 0,
+       WL_RFFE_CMD_ELNABYP_MODE        = 1,
+       WL_RFFE_CMD_REG                 = 2,
+       WL_RFFE_CMD_LAST
+} wl_rffe_cmd_type_t;
+
+/** RFFE struct passed through ioctl */
+typedef struct {
+       uint32  regaddr;        /**< rFEM_RegAddr */
+       uint32  antnum;         /**< rFEM AntNum */
+       uint32  slaveid;        /**< rFEM SlaveID */
+       uint32  value;          /**< read/write value */
+} rffe_reg_t;
+
+#ifndef BCMUTILS_ERR_CODES
+
+/*
+ * SOE (Security Offload Engine) status codes.
+ */
+
+/*  SOE status codes are reserved from -6144 to -7167 (1K) */
+
+enum wl_soe_status {
+       /* Invalid operational context */
+       WL_SOE_E_BAD_OP_CONTEXT                         = -6144,
+
+       /* Invalid operational type */
+       WL_SOE_E_BAD_OP_TYPE                            = -6145,
+
+       /* Failure to get NAF3 encoded scalar */
+       WL_SOE_E_BN_GET_NAF3_ERROR                      = -6146,
+
+       /* Failure to get NAF3 params */
+       WL_SOE_E_ECG_GET_NAF3_PARAMS_ERROR              = -6147,
+
+       /* FAILURE to get Montgomery params */
+       WL_SOE_E_MONT_PARAMS_GET_ERROR                  = -6148,
+
+       /* Invalid OSL handle */
+       WL_SOE_E_BAD_SI_OSH                             = -6149,
+
+       /* Invalid ECG group */
+       WL_SOE_E_BAD_ECG_GROUP                          = -6150,
+
+       /* Invalid BN context */
+       WL_SOE_E_BAD_BN_CTX                             = -6151,
+
+       /* Invalid SOE core register base address */
+       WL_SOE_E_BAD_SOE_REGBASE                        = -6152,
+
+       /* Invalid SOE context */
+       WL_SOE_E_BAD_SOE_CONTXT                         = -6153,
+
+       /* Number of words are too short (i.e., not enough
+        * room to encode the PKA sequence)
+        */
+       WL_SOE_E_PKA_SEQUENCE_WORDS_TOO_SHORT           = -6154,
+
+       /* Generic bn_get error */
+       WL_SOE_E_PKA_BN_GET_ERROR                       = -6155,
+
+       /* Sequence buf too short for BN */
+       WL_SOE_E_PKA_BN_BUF_TOO_SHORT_BN                = -6156,
+
+       /* Sequence buf too short for ECG prime */
+       WL_SOE_E_PKA_BN_BUF_TOO_SHORT_ECG_PRIME         = -6157,
+
+       /* Sequence buf too short for Montgomery N' */
+       WL_SOE_E_PKA_SEQ_BUF_TOO_SHORT_MONT_PRIME       = -6158,
+
+       /* Sequence buf too short for Accumulator registers */
+       WL_SOE_E_PKA_SEQ_BUF_TOO_SHORT_ACCM_REG         = -6159,
+
+       /* Sequence buf too short for the point P */
+       WL_SOE_E_PKA_SEQ_BUF_TOO_SHORT_P                = -6160,
+
+       /* Sequence buf too short for -P */
+       WL_SOE_E_PKA_SEQ_BUF_TOO_SHORT_PN               = -6161,
+
+       /* Sequence buf too short for 3P */
+       WL_SOE_E_PKA_SEQ_BUF_TOO_SHORT_3P               = -6162,
+
+       /* Sequence buf too short for -3P */
+       WL_SOE_E_PKA_SEQ_BUF_TOO_SHORT_3PN              = -6163,
+
+       /* Sequence buf too short for NAF3 scalar */
+       WL_SOE_E_PKA_SEQ_BUF_TOO_SHORT_NAF3_SCALAR      = -6164,
+
+       /* Sequence buf too short for load shift count */
+       WL_SOE_E_PKA_SEQ_BUF_TOO_SHORT_PRE_JMP          = -6165,
+
+       /* SOE engine(SHA/PKA) failed to complete the operation */
+       WL_SOE_E_ENGINE_UNABLE_TO_COMPLETE              = -6166,
+
+       /* Wrong LIR (Long Integer Register) type */
+       WL_SOE_E_PKA_BAD_LIR_TYPE                       = -6167,
+
+       /* Reference count has reached maximum */
+       WL_SOE_E_MAX_REF_COUNT_REACHED                  = -6168,
+
+       /* Failed to get the SOE context reference */
+       WL_SOE_E_GET_REF_FAILED                         = -6169,
+
+       /* Incoming digest length is invalid */
+       WL_SOE_E_SHA_WRONG_DIGEST_LEN                   = -6170
+};
+
+#endif /* BCMUTILS_ERR_CODES */
+
+#define NR5GCX_STATUS_VER_1 1
+/* NR coex status structures */
+typedef struct wlc_nr5gcx_status_v1 {
+       uint16 version;                 /* version info */
+       uint16 len;                     /* status length */
+       uint32 mode;                    /* NR coex status */
+       uint32 nr_req_cnt;              /* NR req number since last read */
+       uint32 nr_dur;                  /* NR duration since last read, us */
+       uint32 nr_duty_cycle;           /* NR duty cycle since last read */
+       uint32 nr_max_dur;              /* NR max duration in a single request */
+       uint32 wlan_crit_cnt;           /* aggregated # of WLAN critical events */
+       uint32 wlan_crit_dur;           /* aggregated WLAN critical event duration, ms */
+       uint32 wlan_crit_max_dur;       /* Duration of the WLAN critical events whose dur is max */
+       uint16 wlan_crit_evt_bitmap;    /* WLAN critical event occurrence bitmap,
+                                       * 1 event per bit.
+                                       */
+       uint16 wlan_crit_max_evt_type;  /* The event type of the WLAN critical
+                                       * event whose dur is max
+                                       */
+} wlc_nr5gcx_status_v1_t;
+
+#define RC2CX_STATUS_VER_1 1
+/* RC2 coex status structures */
+typedef struct wlc_rc2cx_stats_v1 {
+       uint16  version;                /* version info */
+       uint8   len;                    /* status length */
+       uint8   mode;                   /* RC2 coex mode */
+       uint16  rc2_req_cnt;            /* RC2 req number since last read. */
+       uint16  rc2_grant_cnt;          /* RC2 grant count since last read. */
+       uint32  rc2_dur;                /* RC2 duration since last read, us. */
+       uint16  rc2_succ_pm_prot_cnt;   /* RC2 number of successfully acked PM. */
+       uint16  rc2_succ_cts_prot_cnt;  /* RC2 number of successfully TXed CTS2A. */
+       uint16  rc2_grant_delay_cnt;    /* RC2 grant delay counter, delay > 4.5ms. */
+       uint16  rc2_crit_phycal_cnt;    /* RC2 WLAN/BT critical: PHY cal. counter. */
+       uint16  rc2_crit_rate_cnt;      /* RC2 WLAN/BT critical: rate recovery counter. */
+       uint16  rc2_crit_bcnloss_cnt;   /* RC2 WLAN/BT critical: beacon loss counter. */
+       uint16  rc2_crit_hpp_cnt;       /* RC2 WLAN/BT critical: HPP counter. */
+       uint16  rc2_crit_bt_cnt;        /* RC2 WLAN/BT critical: BT counter. */
+       uint16  rc2_crit_slotbss_cnt;   /* RC2 WLAN/BT critical: AWDL/NAN counter. */
+       uint16  rsvd;
+       uint32  rc2_crit_cnt;           /* RC2 WLAN/BT critical counter, aggregate. */
+} wlc_rc2cx_stats_v1_t;
+
+/* ifdef (WLC_OBSS_HW) */
+/* OBSS HW specific Macros */
+#define WLC_OBSS_HW_CMD_VERSION_1      1u
+
+/* OBSS HW config sub command identification flag */
+#define OBSS_HW_CFG_SUB_CMD_ENABLE             (1u << 0u)
+#define OBSS_HW_CFG_SUB_CMD_SW_CACHE_INTVL     (1u << 1u)
+#define OBSS_HW_CFG_SUB_CMD_PHY_SENSE_DUR      (1u << 2u)
+#define OBSS_HW_CFG_SUB_CMD_MASK               (OBSS_HW_CFG_SUB_CMD_ENABLE | \
+                                               OBSS_HW_CFG_SUB_CMD_SW_CACHE_INTVL | \
+                                               OBSS_HW_CFG_SUB_CMD_PHY_SENSE_DUR)
+
+#define WLC_OBSS_HW_DEF_SW_CACHE_INTVL         1u /* 1 sec */
+#define WLC_OBSS_HW_MAX_SW_CACHE_INTVL         5u /* 5 sec */
+#define WLC_OBSS_HW_DEF_PHY_SENSE_DUR          30 /* 30 msec */
+#define WLC_OBSS_HW_MAX_PHY_SENSE_DUR          500 /* 500 msec */
+
+/* OBSS HW test sub command identification flag */
+#define WLC_OBSS_HW_TEST_SUB_CMD_TEST_MODE     (1u << 0u)
+#define WLC_OBSS_HW_TEST_SUB_CMD_MITI_MODE     (1u << 1u)
+#define WLC_OBSS_HW_TEST_SUB_CMD_MASK          (WLC_OBSS_HW_TEST_SUB_CMD_TEST_MODE |\
+                                                       WLC_OBSS_HW_TEST_SUB_CMD_MITI_MODE)
+
+/* Test mode values */
+#define WLC_OBSS_HW_TEST_MODE_STOP             0u /* Stop the test */
+#define WLC_OBSS_HW_TEST_MODE_TRIGGER          1u /* Trigger mode */
+#define WLC_OBSS_HW_TEST_MODE_FREE_RUNNING     2u /* Free running stats collection */
+
+#define WLC_OBSS_HW_TEST_MITI_TX_RX_DISABLE    0u /* Both Tx and Rx mitigation disabled */
+#define WLC_OBSS_HW_TEST_MITI_RX_FILT_PKTENG   1u /* Rx mitigation via filter override enabled */
+                                                       /* All Tx miti disabled; Only pkteng */
+#define WLC_OBSS_HW_TEST_MITI_TX_ONLY          2u /* Rx mitigation disabled, Tx mitigation */
+#define WLC_OBSS_HW_TEST_MITI_TX_RX_FILT       3u /* Rx Tx mitigation enabled */
+#define WLC_OBSS_HW_TEST_MITI_CHAN_CHANGE      4u /* Mitigation by chanspec change */
+
+#define WL_OBSS_ANT_MAX                        2u      /* Max Antennas */
+#define ACPHY_OBSS_STATS_BIN_CNT       8u      /* min 1 for default */
+#define ACPHY_OBSS_SUBBAND_CNT         8u      /* Max sub band counts i.e., 160Mhz = 8 * 20MHZ */
+
+enum wlc_obss_hw_cmd_id {
+       WLC_OBSS_HW_CMD_VER             = 1u,
+       WLC_OBSS_HW_CMD_CONFIG          = 2u,
+       WLC_OBSS_HW_CMD_DUMP_STATS      = 3u,
+       WLC_OBSS_HW_CMD_TEST            = 4u,
+       WLC_OBSS_HW_CMD_LAST
+};
+
+/* OBSS HW specific structures */
+typedef struct wlc_obss_hw_cfg_v1 {
+       uint16 sub_cmd_flags;           /* Flag bits to Identify configuring sub command */
+       uint8 is_enable;                /* Feature is enabled or not */
+       uint8 sw_cache_interval;        /* SW cache interval to cache OBSS stats in sec */
+       uint16 phy_sensing_duration;    /* PHY OBSS sensing duration in msec */
+} wlc_obss_hw_cfg_v1_t;
+
+typedef struct  wlc_obss_hw_stats_v1 {
+       uint16 avg_obss_stats[WL_OBSS_ANT_MAX][ACPHY_OBSS_SUBBAND_CNT][ACPHY_OBSS_STATS_BIN_CNT];
+       uint16 obss_det_stats[ACPHY_OBSS_SUBBAND_CNT];
+       uint16 stats_cnt;               /* Stats count */
+       uint8 obss_mit_status;          /* OBSS mitigation status */
+       uint8 mit_bw;                   /* Mitigation BW that got selected */
+} wlc_obss_hw_stats_v1_t;
+
+typedef struct wlc_obss_hw_test_v1 {
+       uint16 sub_cmd_flags;           /* Flag bits to Identify configuring sub command */
+       uint8 test_mode;                /* To stop/start respective test mode */
+       uint8 mitigation_mode;          /* mitigation enabling/disabling options */
+} wlc_obss_hw_test_v1_t;
+
+#define STA_PM_SC_OFLD_CFG_VER_V1                1u
+#define STA_PM_SC_OFLD_ENAB_FLAG                 (1u << 0u)
+
+#define STA_PM_SC_FLAG_MASK                      (1u << 0u)
+#define STA_PM_SC_CONS_EXP_BCN_RX_THR_MASK       (1u << 1u)
+#define STA_PM_SC_MISSED_BCN_THR_MASK            (1u << 2u)
+#define STA_PM_SC_OFLD_RSSI_THR_MASK             (1u << 3u)
+#define STA_PM_SC_OFLD_RSSI_HYST_MASK            (1u << 4u)
+#define STA_PM_SC_OFLD_FIELD_MASK_ALL    (STA_PM_SC_FLAG_MASK | \
+                               STA_PM_SC_CONS_EXP_BCN_RX_THR_MASK | \
+                               STA_PM_SC_MISSED_BCN_THR_MASK | \
+                               STA_PM_SC_OFLD_RSSI_THR_MASK | \
+                               STA_PM_SC_OFLD_RSSI_HYST_MASK)
+
+#define STA_PM_SC_OFLD_RSSI_HYST_MAX              80u
+
+typedef struct wlc_sta_pm_sc_ofld_cfg_v1 {
+       uint16 version;
+       uint16 len;
+       uint16 field_mask;           /* Provides info on which of the following fields are valid */
+       uint16 flags;                /* enable 0x1 */
+       uint8  cons_exp_bcn_rx_thr;  /* Consecutive expected bcn in true slice to offload to SC */
+       uint8  sc_missed_bcn_thr;    /* Missed beacons threshold in SC to exit offload */
+       int8   sc_offload_rssi_thr;  /* Bcn RSSI threshold to exit offload, must be negative */
+       uint8  sc_offload_rssi_hyst; /* Hysteresis for the RSSI threshold, 0 - RSSI_HYST_MAX */
+} wlc_sta_pm_sc_ofld_cfg_v1_t;
+
+typedef enum wlc_sta_pm_sc_ofld_fail_reason {
+       STA_PM_SC_OFLD_FAIL_RSSI =                      (1u << 0u),  /* Low rssi */
+       STA_PM_SC_OFLD_FAIL_UNSUPPORTED =               (1u << 1u),  /* Unsupported by WBUS */
+       STA_PM_SC_OFLD_FAIL_MISSED_BCN =                (1u << 2u),  /* missed bcns on true slice */
+       STA_PM_SC_OFLD_FAIL_NO_PS =                     (1u << 3u),  /* not in PM */
+       STA_PM_SC_OFLD_FAIL_TX_ACTIVE =                 (1u << 4u),  /* Active TX in true slice */
+       STA_PM_SC_OFLD_FAIL_CSA =                       (1u << 5u),  /* CSA */
+       STA_PM_SC_OFLD_FAIL_MRC =                       (1u << 6u),  /* in MRC */
+       STA_PM_SC_OFLD_FAIL_AS_STATE =                  (1u << 7u),  /* Assoc state not IDLE */
+       STA_PM_SC_OFLD_FAIL_NO_BASIC_RATESET =          (1u << 8u),  /* AP doesn't sup basic rate */
+       STA_PM_SC_OFLD_FAIL_DISABLED =                  (1u << 9u),  /* Offload disabled */
+       STA_PM_SC_OFLD_FAIL_CAL =                       (1u << 10u), /* Cal on main/aux core */
+       STA_PM_SC_OFLD_FAIL_UNSUP_BCMC_RATE_RX =        (1u << 11u), /* unsupported bcmc rate rx */
+       STA_PM_SC_OFLD_FAIL_TWT_ACTIVE =                (1u << 12u),  /* TWT is active */
+       STA_PM_SC_OFLD_FAIL_AP_ENAB =                   (1u << 13u)  /* AP cfg is enabled */
+} wlc_sta_pm_sc_ofld_fail_reason_t;
+
+typedef enum wlc_sta_pm_sc_ofld_exit_reason {
+       STA_PM_SC_OFLD_EXIT_AS_STATE = 1u,      /* Exit due to assoc state not IDLE */
+       STA_PM_SC_OFLD_EXIT_BCN_LOSS,           /* Exit due to beacon loss */
+       STA_PM_SC_OFLD_EXIT_TIM,                /* Exit due to TIM bit set */
+       STA_PM_SC_OFLD_EXIT_PM,                 /* Exit due to exit out of PM mode */
+       STA_PM_SC_OFLD_EXIT_TX,                 /* Exit due to tx on true slice */
+       STA_PM_SC_OFLD_EXIT_CSA,                /* Exit due to CSA */
+       STA_PM_SC_OFLD_EXIT_LOW_RSSI,           /* Exit due to rssi lower than threshold */
+       STA_PM_SC_OFLD_EXIT_MRC,                /* Exit due to MRC being active */
+       STA_PM_SC_OFLD_EXIT_BSSCFG_DOWN,        /* Exit due to bsscfg down */
+       STA_PM_SC_OFLD_EXIT_WLC_DOWN,           /* Exit due to wlc down */
+       STA_PM_SC_OFLD_EXIT_WBUS_REJECT,        /* Exit due to wbus reject */
+       STA_PM_SC_OFLD_EXIT_HOST_DISABLE,       /* Exit due to disable by host */
+       STA_PM_SC_OFLD_EXIT_CAL_TVPM,           /* Exit due to Cal/TVPM on main/aux core */
+       STA_PM_SC_OFLD_EXIT_DISASSOC,           /* Exit due to disassoc */
+       STA_PM_SC_OFLD_EXIT_CAC,                /* Exit due to CAC admit */
+       STA_PM_SC_OFLD_EXIT_CHN_OVERLAP,        /* Exit due to true slice chan overlap */
+       STA_PM_SC_OFLD_EXIT_UNSUP_BCMC_RATE_RX, /* Exit due to unsupported bcmc rate rx */
+       STA_PM_SC_OFLD_EXIT_BCMC_LOSS,          /* Exit due to bcmc pkt loss */
+       STA_PM_SC_OFLD_EXIT_TWT,                /* Exit due to TWT active */
+       STA_PM_SC_OFLD_EXIT_MAX = 255u          /* Max, uint8 for now */
+} wlc_sta_pm_sc_ofld_exit_reason_t;
+
+#define STA_PM_SC_OFLD_STATUS_VER_V1                1u
+
+#define STA_PM_SC_OFLD_STATUS_CLEAR          (1u << 0u)
+#define STA_PM_SC_OFLD_STATUS_OFFLOADED      (1u << 1u)
+#define STA_PM_SC_OFLD_STATUS_ASSOCIATED     (1u << 2u)
+
+typedef struct wlc_sta_pm_sc_status_v1 {
+       uint16 version;
+       uint16 len;
+       uint32 flags;
+       uint32 sc_offload_enter_cnt;           /* Offload enter cnt */
+       uint32 sc_offload_exit_cnt;            /* Offload exit cnt */
+       uint32 sc_offload_wbus_reject_cnt;     /* WBUS reject reg cnt */
+       uint32 sc_offload_exp_bcn_cnt;         /* SC ofld expected bcn cnt */
+       uint32 sc_offload_exp_bcn_missed_cnt;  /* SC ofld missed bcn cnt */
+       uint32 sc_offload_last_exit_reason;    /* Previous exit reason */
+       uint32 sc_offload_enter_fail_reason;   /* SC ofld enter fail reason  */
+       uint32 sc_offload_total_dur_ms;        /* Cumulative duration in offload (ms) */
+} wlc_sta_pm_sc_status_v1_t;
+
+#define WL_SDTC_IOV_VERSION            1
+#define SDTC_SUB_IOV_VERSION_1         1
+#define SDTC_SUB_IOV_VERSION_1_1       1
+#define MAX_ATID_CORES                 5u
+#define SDTC_ID_ALL                    0xFFu
+
+/* SDTC IOV ID's */
+enum wl_sdtc_iov_id {
+       SDTC_ID_INVALID = 0x0,
+       SDTC_ID_CB      = 0x1,
+       SDTC_ID_PCIE    = 0x2,
+       SDTC_ID_SYSMEM  = 0x3,
+       SDTC_ID_AUXMAC  = 0x4,
+       SDTC_ID_MAINMAC = 0x5
+};
+
+/* SDTC Iovars */
+enum wl_sdtc_cmd_ids {
+       WL_SDTC_CMD_EN                  = 0x1,
+       WL_SDTC_CMD_CONFIG              = 0x2,
+       WL_SDTC_CMD_CORE_ENAB           = 0x3,
+       WL_SDTC_CMD_ETB_INFO            = 0x4,
+       WL_SDTC_CMD_LAST
+};
+
+enum wl_sdtc_xtlv_version {
+       WL_SDTC_ENABLE_V1  = 0x1
+};
+
+typedef struct sdtc_regs {
+       uint32 addr;
+       uint32 val;
+} sdtc_regs_t;
+
+typedef struct sdtc_config {
+       uint16          version;
+       uint16          len;
+
+       uint8           sdtc_id;        /* 0xFF indicates, all core id's enable */
+       uint8           pad;            /* 32 bit alignment */
+       uint16          num_of_registers; /* if no of reg is "0",it will use default SDTC config */
+       sdtc_regs_t     regs[1];        /* Array of register list */
+} sdtc_config_t;
+
+typedef struct sdtc_enab_atid_list {
+       uint16  version;
+       uint16  len;
+
+       uint32  sdtc_id_bmp;
+       uint32  sdtc_id_mask;
+} sdtc_enab_atid_list_t;
+
+typedef struct etb_addr_info {
+       uint16  version;
+       uint16  len;
+       uint32  etbinfo_addr;   /* etb_info address */
+} etb_addr_info_t;
+
+typedef struct etb_info {
+       uint16  version;
+       uint16  len;
+       uint32  read_write_p;   /* read write pointer address */
+       uint8   etb_full;       /* status bit */
+       uint8   pad[3];         /* 32bit alignment */
+       uint32  addr;           /* H/W Address */
+       uint32  read_bytes;     /* Size of ETB(Embedded Trace Buffer) Memory */
+} etb_info_t;
+
+/* This ROAM RSSI limit value is used in order to prune LOW RSSI candidate
+ * for Priority roam and Beacon lost
+ * WLC_E_REASON_DEAUTH, WLC_E_REASON_DISASSOC, WLC_E_REASON_BCNS_LOST
+ */
+#define WLC_ROAM_RSSI_LMT_VER_1        1
+typedef struct wlc_roam_rssi_lmt_info_v1 {
+       int16 rssi_limit_2g;
+       int16 rssi_limit_5g;
+} wlc_roam_rssi_lmt_info_v1_t;
+
+typedef struct wlc_wlc_roam_rssi_limit {
+       uint16 ver;
+       uint16 len;
+       uint8 data[];
+} wlc_roam_rssi_limit_t;
+
+#define ROAMRSSI_HDRLEN                4u
+#define ROAMRSSI_2G_DEFAULT    -128
+#define ROAMRSSI_2G_MAX                -70
+#define ROAMRSSI_2G_MIN                -128
+#define ROAMRSSI_5G_DEFAULT    -128
+#define ROAMRSSI_5G_MAX                -70
+#define ROAMRSSI_5G_MIN                -128
+
+/* Beacon mute mitigation specific Macros */
+
+/* Macro flags to identify the specific config commands in IOVAR set operation */
+#define WLC_BCN_MUTE_MITI_CFG_CMD_ENABLE               (1u << 0u)
+#define WLC_BCN_MUTE_MITI_CFG_CMD_PM0_PERIOD           (1u << 1u)
+#define WLC_BCN_MUTE_MITI_CFG_CMD_MAX_MITI_TIMEOUT     (1u << 2u)
+#define WLC_BCN_MUTE_MITI_CFG_CMD_MASK                 (WLC_BCN_MUTE_MITI_CFG_CMD_ENABLE |\
+                                                       WLC_BCN_MUTE_MITI_CFG_CMD_PM0_PERIOD |\
+                                                       WLC_BCN_MUTE_MITI_CFG_CMD_MAX_MITI_TIMEOUT)
+
+/* Configurable PM0 period range */
+#define WLC_BCN_MUTE_MITI_CFG_PM0_PERIOD_MIN           (1u)    /* Period in sec */
+#define WLC_BCN_MUTE_MITI_CFG_PM0_PERIOD_MAX           (10u)   /* Period in sec */
+
+/* Configurable mitigation Timeout range */
+#define WLC_BCN_MUTE_MITI_CFG_TIMEOUT_MIN              (30u)   /* Minimum Timeout in sec */
+#define WLC_BCN_MUTE_MITI_CFG_TIMEOUT_DEFAULT          (60u)   /* Default Timeout in sec */
+#define WLC_BCN_MUTE_MITI_CFG_TIMEOUT_MAX              (120u)  /* Maximum Timeout in sec */
+
+#define WLC_BCN_MUTE_MITI_CMD_VER_1    1u /* Version number for wlc_bcn_mute_miti_cfg_v1 struct */
+typedef struct wlc_bcn_mute_miti_cfg_v1 {
+       uint16  version;                /* Structure version */
+       uint16  length;                 /* Length of whole struct */
+       uint32  cmd_flags;              /* Flag bits to Identify configuring command */
+       uint8   is_enabled;             /* Feature is enabled or not */
+       uint8   pm0_periodicity;        /* Interval between consecutive PM0 during mitigation
+                                        * period (in sec)
+                                        */
+       uint16  max_miti_timeout;       /* Maximum mitigation timeout in sec to send
+                                        * Mitigation Timeout event.
+                                        */
+} wlc_bcn_mute_miti_cfg_v1_t;
+
+#define WLC_BCN_TBTT_CMD_VER_1 (1u)    /* Ver num for wlc_bcn_tbtt_cfg struct */
+/* Configurable mitigation Timeout range */
+#define WLC_BCN_TBTT_CFG_EVENT_PERIOD  (3u)    /* Send event after this value of drift */
+#define WLC_BCN_TBTT_CFG_DRIFT_THRESH  (3)             /* in ms */
+#define WLC_BCN_TBTT_CFG_JITTER_THRESH (1)             /* in ms */
+
+/* Macro flags to identify the specific config commands in IOVAR set operation */
+#define WLC_BCN_DRIFT_BCN_OFFSET       (1u << 0u)
+#define WLC_BCN_DRIFT_EVENT_PERIOD     (1u << 1u)
+#define WLC_BCN_DRIFT_DRIFT_THRESHOLD  (1u << 2u)
+#define WLC_BCN_DRIFT_JITTER_THRESHOLD (1u << 3u)
+
+/* configurable range */
+#define WLC_BCN_DRIFT_BCN_OFFSET_MAX   (15u)
+#define WLC_BCN_DRIFT_BCN_OFFSET_MIN   (5u)
+
+#define WLC_BCN_DRIFT_DRIFT_THRESHOLD_MAX      (10)
+#define WLC_BCN_DRIFT_DRIFT_THRESHOLD_MIN      (-4)
+
+#define WLC_BCN_DRIFT_JITTER_THRESHOLD_MAX     (2)
+#define WLC_BCN_DRIFT_JITTER_THRESHOLD_MIN     (-2)
+
+typedef struct wlc_bcn_tbtt_cfg_v1 {
+       uint16  version;                /* Structure version */
+       uint16  length;                 /* Length of whole struct */
+       uint32  cmd;                    /* type of cmd */
+       uint8   tbtt_bcn_off;   /* num btw (5-15u) for uatbtt */
+       uint8   event_period;   /* continous / periodic event */
+       int8    drift_thres;    /* drift threshold for event in ms */
+       int8    jitter_thres;   /* jitter threshold for event in ms */
+} wlc_bcn_tbtt_cfg_v1_t;
+
+/* SC scan retry config params */
+#define SC_SCAN_RETRY_CFG_VERSION      1u
+
+/* Bits indicating which are the valid params in the set command. */
+#define SC_SCAN_RETRY_CFG_PARAMS_THRESHOLD             (1u << 0u)
+#define SC_SCAN_RETRY_CFG_PARAMS_MODE                  (1u << 1u)
+
+/* Input structure for sc_scan_retry_cfg IOVAR */
+typedef struct sc_scan_retry_cfg_params_v1 {
+       uint16 version;         /* config version. */
+       uint16 len;             /* Length of this struct. */
+       uint32 set_flag;        /* Flag bits to Identify valid param type to be set */
+       uint8 threshold;        /* Amount of Tx-Blanking in percentage considered as failed scan. */
+       uint8 scan_mode;        /* Scan mode in which scan need to be re-scheduled. */
+       uint8 PAD[2];           /* 32bit alignment */
+} sc_scan_retry_cfg_params_v1_t;
+
+/* host queries RNG version from 'wl cap' iovar */
+#define BCM_RNG_VERSION_1      1u /* for initial "reseed" version */
+/* Supported entropy size, bytes */
+#define BCM_RNG_ENTROPY_SIZE_BYTES     64u
+
+/* RNG top level command IDs */
+typedef enum wl_rng_cmd_id {
+       WL_RNG_CMD_RESEED = 0u,
+       WL_RNG_CMD_LAST = 1u
+} wl_rng_cmd_id_t;
+
+/* RNG reseed host entropy */
+typedef struct bcm_rng_reseed {
+       uint16          entropy_size;           /* host entropy size, bytes */
+       uint8           entropy[];              /* host entropy, flexible array */
+} bcm_rng_reseed_t;
+
+/* RNG IOVAR data */
+typedef struct wl_rng_iovar {
+       uint16  version;                        /* Version of this structure */
+       uint16  subcmd_id;                      /* RNG subcmd ID */
+       uint16  pad;                            /* padding for 32-bit struct alignment */
+       uint16  length;                         /* Length of data following this length field */
+       union {
+               bcm_rng_reseed_t reseed;        /* RNG reseed data */
+       } u;
+} wl_rng_iovar_t;
+
+enum phy_rxgcrs_ed_enhncd_cmd_id {
+       PHY_RXGCRS_ED_ENHNCD_CMD_EN             = 1u,
+       PHY_RXGCRS_ED_ENHNCD_CMD_STATUS         = 2u,
+       PHY_RXGCRS_ED_ENHNCD_CMD_COREMASK       = 3u,
+       PHY_RXGCRS_ED_ENHNCD_CMD_LAST
+};
+
+/* SAE command
+ * Only IOV batching support - see bcmiov.h
+ */
+
+/* SAE command version */
+#define WL_SAE_CMD_VERSION     1
+
+/* SAE sub-commands */
+typedef enum sae_cmd_id {
+       WL_SAE_CMD_AP_SESSION_HOLD_TIME = 1, /* AP rate limit session hold time
+                                                                                * Data: uint32,
+                                                                                * miliseconds
+                                                                                */
+       WL_SAE_CMD_AP_MAX_ACTIVE_SESSIONS       = 2, /* AP max sessions
+                                                                                       * Data:
+                                                                                       * uint32
+                                                                                       */
+} sae_cmd_id_t;
+
+#endif /* _wlioctl_h_ */
diff --git a/bcmdhd.101.10.240.x/include/wlioctl_defs.h b/bcmdhd.101.10.240.x/include/wlioctl_defs.h
new file mode 100644 (file)
index 0000000..f88f751
--- /dev/null
@@ -0,0 +1,2428 @@
+/*
+ * Custom OID/ioctl definitions for
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef wlioctl_defs_h
+#define wlioctl_defs_h
+
+/* All builds use the new 11ac ratespec/chanspec */
+#undef  D11AC_IOTYPES
+#define D11AC_IOTYPES
+
+#ifndef USE_NEW_RSPEC_DEFS
+/* Remove when no referencing branches exist.
+ * These macros will be used only in older branches (prior to K branch).
+ * Wl layer in newer branches and trunk use those defined in bcmwifi_rspec.h.
+ * Non-wl layer in newer branches and trunk may use these as well
+ * until they are removed.
+ */
+/* WL_RSPEC defines for rate information */
+#define WL_RSPEC_RATE_MASK             0x000000FF      /* rate or HT MCS value */
+#define WL_RSPEC_VHT_MCS_MASK          0x0000000F      /* VHT MCS value */
+#define WL_RSPEC_VHT_NSS_MASK          0x000000F0      /* VHT Nss value */
+#define WL_RSPEC_VHT_NSS_SHIFT         4               /* VHT Nss value shift */
+#define WL_RSPEC_TXEXP_MASK            0x00000300
+#define WL_RSPEC_TXEXP_SHIFT           8
+#define WL_RSPEC_BW_MASK               0x00070000      /* bandwidth mask */
+#define WL_RSPEC_BW_SHIFT              16              /* bandwidth shift */
+#define WL_RSPEC_STBC                  0x00100000      /* STBC encoding, Nsts = 2 x Nss */
+#define WL_RSPEC_TXBF                  0x00200000      /* bit indicates TXBF mode */
+#define WL_RSPEC_LDPC                  0x00400000      /* bit indicates adv coding in use */
+#define WL_RSPEC_SGI                   0x00800000      /* Short GI mode */
+#define WL_RSPEC_ENCODING_MASK         0x03000000      /* Encoding of Rate/MCS field */
+#define WL_RSPEC_OVERRIDE_RATE         0x40000000      /* bit indicate to override mcs only */
+#define WL_RSPEC_OVERRIDE_MODE         0x80000000      /* bit indicates override rate & mode */
+
+/* WL_RSPEC_ENCODING field defs */
+#define WL_RSPEC_ENCODE_RATE   0x00000000      /* Legacy rate is stored in RSPEC_RATE_MASK */
+#define WL_RSPEC_ENCODE_HT     0x01000000      /* HT MCS is stored in RSPEC_RATE_MASK */
+#define WL_RSPEC_ENCODE_VHT    0x02000000      /* VHT MCS and Nss is stored in RSPEC_RATE_MASK */
+
+/* WL_RSPEC_BW field defs */
+#define WL_RSPEC_BW_UNSPECIFIED 0
+#define WL_RSPEC_BW_20MHZ       0x00010000
+#define WL_RSPEC_BW_40MHZ       0x00020000
+#define WL_RSPEC_BW_80MHZ       0x00030000
+#define WL_RSPEC_BW_160MHZ      0x00040000
+#define WL_RSPEC_BW_10MHZ      0x00050000
+#define WL_RSPEC_BW_5MHZ       0x00060000
+#define WL_RSPEC_BW_2P5MHZ      0x00070000
+
+#define HIGHEST_SINGLE_STREAM_MCS      7 /* MCS values greater than this enable multiple streams */
+
+#endif /* !USE_NEW_RSPEC_DEFS */
+
+/* Legacy defines for the nrate iovar */
+#define OLD_NRATE_MCS_INUSE         0x00000080 /* MSC in use,indicates b0-6 holds an mcs */
+#define OLD_NRATE_RATE_MASK         0x0000007f /* rate/mcs value */
+#define OLD_NRATE_STF_MASK          0x0000ff00 /* stf mode mask: siso, cdd, stbc, sdm */
+#define OLD_NRATE_STF_SHIFT         8          /* stf mode shift */
+#define OLD_NRATE_OVERRIDE          0x80000000 /* bit indicates override both rate & mode */
+#define OLD_NRATE_OVERRIDE_MCS_ONLY 0x40000000 /* bit indicate to override mcs only */
+#define OLD_NRATE_SGI               0x00800000 /* sgi mode */
+#define OLD_NRATE_LDPC_CODING       0x00400000 /* bit indicates adv coding in use */
+
+#define OLD_NRATE_STF_SISO     0               /* stf mode SISO */
+#define OLD_NRATE_STF_CDD      1               /* stf mode CDD */
+#define OLD_NRATE_STF_STBC     2               /* stf mode STBC */
+#define OLD_NRATE_STF_SDM      3               /* stf mode SDM */
+
+#define WLC_11N_N_PROP_MCS     6               /* number of proprietary 11n MCS'es */
+#define WLC_11N_FIRST_PROP_MCS 87              /* first Broadcom proprietary MCS */
+#define WLC_11N_LAST_PROP_MCS  102
+
+#define MAX_CCA_CHANNELS 38    /* Max number of 20 Mhz wide channels */
+#define MAX_CCA_SECS   60      /* CCA keeps this many seconds history */
+
+#define IBSS_MED        15     /* Mediom in-bss congestion percentage */
+#define IBSS_HI         25     /* Hi in-bss congestion percentage */
+#define OBSS_MED        12
+#define OBSS_HI         25
+#define INTERFER_MED    5
+#define INTERFER_HI     10
+
+#define  CCA_FLAG_2G_ONLY              0x01    /* Return a channel from 2.4 Ghz band */
+#define  CCA_FLAG_5G_ONLY              0x02    /* Return a channel from 2.4 Ghz band */
+#define  CCA_FLAG_IGNORE_DURATION      0x04    /* Ignore dwell time for each channel */
+#define  CCA_FLAGS_PREFER_1_6_11       0x10
+#define  CCA_FLAG_IGNORE_INTERFER      0x20    /* do not exclude channel based on interfer level */
+
+#define CCA_ERRNO_BAND         1       /* After filtering for band pref, no choices left */
+#define CCA_ERRNO_DURATION     2       /* After filtering for duration, no choices left */
+#define CCA_ERRNO_PREF_CHAN    3       /* After filtering for chan pref, no choices left */
+#define CCA_ERRNO_INTERFER     4       /* After filtering for interference, no choices left */
+#define CCA_ERRNO_TOO_FEW      5       /* Only 1 channel was input */
+
+#define WL_STA_AID(a)          ((a) &~ 0xc000)
+
+/* Flags for sta_info_t indicating properties of STA */
+#define WL_STA_BRCM            0x00000001      /* Running a Broadcom driver */
+#define WL_STA_WME             0x00000002      /* WMM association */
+#define WL_STA_NONERP          0x00000004      /* No ERP */
+#define WL_STA_AUTHE           0x00000008      /* Authenticated */
+#define WL_STA_ASSOC           0x00000010      /* Associated */
+#define WL_STA_AUTHO           0x00000020      /* Authorized */
+#define WL_STA_WDS             0x00000040      /* Wireless Distribution System */
+#define WL_STA_WDS_LINKUP      0x00000080      /* WDS traffic/probes flowing properly */
+#define WL_STA_PS              0x00000100      /* STA is in power save mode from AP's viewpoint */
+#define WL_STA_APSD_BE         0x00000200      /* APSD delv/trigger for AC_BE is default enabled */
+#define WL_STA_APSD_BK         0x00000400      /* APSD delv/trigger for AC_BK is default enabled */
+#define WL_STA_APSD_VI         0x00000800      /* APSD delv/trigger for AC_VI is default enabled */
+#define WL_STA_APSD_VO         0x00001000      /* APSD delv/trigger for AC_VO is default enabled */
+#define WL_STA_N_CAP           0x00002000      /* STA 802.11n capable */
+#define WL_STA_SCBSTATS                0x00004000      /* Per STA debug stats */
+#define WL_STA_AMPDU_CAP       0x00008000      /* STA AMPDU capable */
+#define WL_STA_AMSDU_CAP       0x00010000      /* STA AMSDU capable */
+#define WL_STA_MIMO_PS         0x00020000      /* mimo ps mode is enabled */
+#define WL_STA_MIMO_RTS                0x00040000      /* send rts in mimo ps mode */
+#define WL_STA_RIFS_CAP                0x00080000      /* rifs enabled */
+#define WL_STA_VHT_CAP         0x00100000      /* STA VHT(11ac) capable */
+#define WL_STA_WPS             0x00200000      /* WPS state */
+#define WL_STA_DWDS_CAP                0x01000000      /* DWDS CAP */
+#define WL_STA_DWDS            0x02000000      /* DWDS active */
+#define WL_WDS_LINKUP          WL_STA_WDS_LINKUP       /* deprecated */
+
+/* STA HT cap fields */
+#define WL_STA_CAP_LDPC_CODING         0x0001  /* Support for rx of LDPC coded pkts */
+#define WL_STA_CAP_40MHZ               0x0002  /* FALSE:20Mhz, TRUE:20/40MHZ supported */
+#define WL_STA_CAP_MIMO_PS_MASK                0x000C  /* Mimo PS mask */
+#define WL_STA_CAP_MIMO_PS_SHIFT       0x0002  /* Mimo PS shift */
+#define WL_STA_CAP_MIMO_PS_OFF         0x0003  /* Mimo PS, no restriction */
+#define WL_STA_CAP_MIMO_PS_RTS         0x0001  /* Mimo PS, send RTS/CTS around MIMO frames */
+#define WL_STA_CAP_MIMO_PS_ON          0x0000  /* Mimo PS, MIMO disallowed */
+#define WL_STA_CAP_GF                  0x0010  /* Greenfield preamble support */
+#define WL_STA_CAP_SHORT_GI_20         0x0020  /* 20MHZ short guard interval support */
+#define WL_STA_CAP_SHORT_GI_40         0x0040  /* 40Mhz short guard interval support */
+#define WL_STA_CAP_TX_STBC             0x0080  /* Tx STBC support */
+#define WL_STA_CAP_RX_STBC_MASK                0x0300  /* Rx STBC mask */
+#define WL_STA_CAP_RX_STBC_SHIFT       8       /* Rx STBC shift */
+#define WL_STA_CAP_DELAYED_BA          0x0400  /* delayed BA support */
+#define WL_STA_CAP_MAX_AMSDU           0x0800  /* Max AMSDU size in bytes , 0=3839, 1=7935 */
+#define WL_STA_CAP_DSSS_CCK            0x1000  /* DSSS/CCK supported by the BSS */
+#define WL_STA_CAP_PSMP                        0x2000  /* Power Save Multi Poll support */
+#define WL_STA_CAP_40MHZ_INTOLERANT    0x4000  /* 40MHz Intolerant */
+#define WL_STA_CAP_LSIG_TXOP           0x8000  /* L-SIG TXOP protection support */
+
+#define WL_STA_CAP_RX_STBC_NO          0x0     /* no rx STBC support */
+#define WL_STA_CAP_RX_STBC_ONE_STREAM  0x1     /* rx STBC support of 1 spatial stream */
+#define WL_STA_CAP_RX_STBC_TWO_STREAM  0x2     /* rx STBC support of 1-2 spatial streams */
+#define WL_STA_CAP_RX_STBC_THREE_STREAM        0x3     /* rx STBC support of 1-3 spatial streams */
+
+/* scb vht flags */
+#define WL_STA_VHT_LDPCCAP     0x0001
+#define WL_STA_SGI80           0x0002
+#define WL_STA_SGI160          0x0004
+#define WL_STA_VHT_TX_STBCCAP  0x0008
+#define WL_STA_VHT_RX_STBCCAP  0x0010
+#define WL_STA_SU_BEAMFORMER   0x0020
+#define WL_STA_SU_BEAMFORMEE   0x0040
+#define WL_STA_MU_BEAMFORMER   0x0080
+#define WL_STA_MU_BEAMFORMEE   0x0100
+#define WL_STA_VHT_TXOP_PS     0x0200
+#define WL_STA_HTC_VHT_CAP     0x0400
+
+/* Values for TX Filter override mode */
+#define WLC_TXFILTER_OVERRIDE_DISABLED  0
+#define WLC_TXFILTER_OVERRIDE_ENABLED   1
+
+#define WL_IOCTL_ACTION_GET            0x0
+#define WL_IOCTL_ACTION_SET            0x1
+#define WL_IOCTL_ACTION_OVL_IDX_MASK   0x1e
+#define WL_IOCTL_ACTION_OVL_RSV                0x20
+#define WL_IOCTL_ACTION_OVL            0x40
+#define WL_IOCTL_ACTION_MASK           0x7e
+#define WL_IOCTL_ACTION_OVL_SHIFT      1
+
+/* For WLC_SET_INFRA ioctl & infra_configuration iovar SET/GET operations */
+#define WL_BSSTYPE_INDEP 0
+#define WL_BSSTYPE_INFRA 1
+#define WL_BSSTYPE_ANY   2     /* deprecated */
+#define WL_BSSTYPE_MESH  3
+
+/* Bit definitions of mws_active_scan_throttle iovar */
+
+#define WL_SCAN_THROTTLE_MASK  0xF
+
+#define WL_SCAN_THROTTLE_ASSOCSCAN             (1U << 0)
+#define WL_SCAN_THROTTLE_ROAMSCAN              (1U << 1)
+#define WL_SCAN_THROTTLE_OTHER_FW_SCAN         (1U << 2)  /* for other scans like pno etc */
+#define WL_SCAN_THROTTLE_HOSTSCAN              (1U << 3)
+
+/* Mask bit for Assoc scan, Roam scan, Other FW scan, Host scan bit defines */
+#define WL_SCANFLAGS_CLIENT_MASK       0xF00u
+#define WL_SCANFLAGS_CLIENT_SHIFT      8
+
+/* Mask bit for LOW power scan, High accuracy scan, LOW span scan bit defines */
+#define WL_SCANFLAGS_SCAN_MODE_MASK    0x7000u
+#define WL_SCANFLAGS_SCAN_MODE_SHIFT   12u
+
+/* Bitmask for scan_type */
+/* Reserved flag precludes the use of 0xff for scan_type which is
+ * interpreted as default for backward compatibility.
+ * Low priority scan uses currently reserved bit,
+ * this should be changed as scan_type extended.
+ * So, reserved flag definition removed.
+ */
+/* Use lower 16 bit for scan flags, the upper 16 bits are for internal use */
+#define WL_SCANFLAGS_PASSIVE   0x01U   /* force passive scan */
+#define WL_SCANFLAGS_LOW_PRIO  0x02U   /* Low priority scan */
+#define WL_SCANFLAGS_PROHIBITED        0x04U   /* allow scanning prohibited channels */
+#define WL_SCANFLAGS_OFFCHAN   0x08U   /* allow scanning/reporting off-channel APs */
+#define WL_SCANFLAGS_HOTSPOT   0x10U   /* automatic ANQP to hotspot APs */
+#define WL_SCANFLAGS_SWTCHAN   0x20U   /* Force channel switch for differerent bandwidth */
+#define WL_SCANFLAGS_FORCE_PARALLEL 0x40U /* Force parallel scan even when actcb_fn_t is on.
+                                         * by default parallel scan will be disabled if actcb_fn_t
+                                         * is provided.
+                                         */
+#define WL_SCANFLAGS_SISO      0x40U   /* Use 1 RX chain for scanning */
+#define WL_SCANFLAGS_MIMO      0x80U   /* Force MIMO scanning */
+#define WL_SCANFLAGS_ASSOCSCAN  0x100U   /* Assoc scan    */
+#define WL_SCANFLAGS_ROAMSCAN   0x200U   /* Roam scan     */
+#define WL_SCANFLAGS_FWSCAN     0x400U   /* Other FW scan */
+#define WL_SCANFLAGS_HOSTSCAN   0x800U   /* Host scan     */
+#define WL_SCANFLAGS_LOW_POWER_SCAN     0x1000U /* LOW power scan, scheduled scan
+                                               * only on scancore
+                                               */
+#define WL_SCANFLAGS_HIGH_ACCURACY      0x2000U  /* High accuracy scan, which needs
+                                                * reliable scan results
+                                                */
+#define WL_SCANFLAGS_LOW_SPAN            0x4000U  /* LOW span scan, which expects
+                                                * scan to be completed ASAP
+                                                */
+#define WL_SCANFLAGS_LISTEN             0x8000U  /* Listen option in escan
+                                                * enable LISTEN along with PASSIVE flag
+                                                */
+
+/* BIT MASK for SSID TYPE */
+#define WL_SCAN_SSIDFLAGS_SHORT_SSID           0x01U /* Use as Regular SSID */
+
+/* Value to decide scan type based on scqs */
+#define WL_SC_RETRY_SCAN_MODE_NO_SCAN          0x0u    /* Do not reschedule scan */
+#define WL_SC_RETRY_SCAN_MODE_HIGH_ACC         0x1u    /* Reschedule scan as HighAccuracy */
+#define WL_SC_RETRY_SCAN_MODE_LOWPOWER         0x2u    /* Reschedule scan as LOWPOWER */
+#define WL_SC_RETRY_SCAN_MODE_AUTO             0x3u    /* Scan rescheduling type is decided
+                                                       * dynamically.
+                                                       */
+
+/* wl_iscan_results status values */
+#define WL_SCAN_RESULTS_SUCCESS        0
+#define WL_SCAN_RESULTS_PARTIAL        1
+#define WL_SCAN_RESULTS_PENDING        2
+#define WL_SCAN_RESULTS_ABORTED        3
+#define WL_SCAN_RESULTS_NO_MEM  4
+
+/* Flags for parallel scan */
+/* Bitmap to enable/disable rsdb parallel scan, 5g-5g/2g-2g parallel scan
+ * SCAN_PARALLEL_PASSIVE_5G ==> 5g-5g parallel scan
+ * SCAN_PARALLEL_PASSIVE_2G ==> 2g-2g parallel scan
+ */
+#define SCAN_PARALLEL_PASSIVE_5G       (0x40)
+#define SCAN_PARALLEL_PASSIVE_2G       (0x80)
+
+#define SCANOL_ENABLED                 (1 << 0)
+#define SCANOL_BCAST_SSID              (1 << 1)
+#define SCANOL_NOTIFY_BCAST_SSID       (1 << 2)
+#define SCANOL_RESULTS_PER_CYCLE       (1 << 3)
+
+/* scan times in milliseconds */
+#define SCANOL_HOME_TIME               45      /* for home channel processing */
+#define SCANOL_ASSOC_TIME              20      /* dwell on a channel while associated */
+#define SCANOL_UNASSOC_TIME            40      /* dwell on a channel while unassociated */
+#define SCANOL_PASSIVE_TIME            110     /* listen on a channelfor passive scan */
+#define SCANOL_AWAY_LIMIT              100     /* max time to be away from home channel */
+#define SCANOL_IDLE_REST_TIME          40
+#define SCANOL_IDLE_REST_MULTIPLIER    0
+#define SCANOL_ACTIVE_REST_TIME                20
+#define SCANOL_ACTIVE_REST_MULTIPLIER  0
+#define SCANOL_CYCLE_IDLE_REST_TIME    300000  /* Idle Rest Time between Scan Cycle (msec) */
+#define SCANOL_CYCLE_IDLE_REST_MULTIPLIER      0       /* Idle Rest Time Multiplier */
+#define SCANOL_CYCLE_ACTIVE_REST_TIME  200
+#define SCANOL_CYCLE_ACTIVE_REST_MULTIPLIER    0
+#define SCANOL_MAX_REST_TIME           3600000 /* max rest time between scan cycle (msec) */
+#define SCANOL_CYCLE_DEFAULT           0       /* default for Max Scan Cycle, 0 = forever */
+#define SCANOL_CYCLE_MAX               864000  /* Max Scan Cycle */
+                                               /* 10 sec/scan cycle => 100 days */
+#define SCANOL_NPROBES                 2       /* for Active scan; send n probes on each channel */
+#define SCANOL_NPROBES_MAX             5       /* for Active scan; send n probes on each channel */
+#define SCANOL_SCAN_START_DLY          10      /* delay start of offload scan (sec) */
+#define SCANOL_SCAN_START_DLY_MAX      240     /* delay start of offload scan (sec) */
+#define SCANOL_MULTIPLIER_MAX          10      /* Max Multiplier */
+#define SCANOL_UNASSOC_TIME_MAX                100     /* max dwell on a channel while unassociated */
+#define SCANOL_PASSIVE_TIME_MAX                500     /* max listen on a channel for passive scan */
+#define SCANOL_SSID_MAX                        16      /* max supported preferred SSID */
+
+/* masks for channel and ssid count */
+#define WL_SCAN_PARAMS_COUNT_MASK 0x0000ffff
+#define WL_SCAN_PARAMS_NSSID_SHIFT 16
+
+#define WL_SCAN_ACTION_START      1
+#define WL_SCAN_ACTION_CONTINUE   2
+#define WL_SCAN_ACTION_ABORT      3
+#if defined(SIMPLE_ISCAN)
+#define ISCAN_RETRY_CNT   5
+#define ISCAN_STATE_IDLE   0
+#define ISCAN_STATE_SCANING 1
+#define ISCAN_STATE_PENDING 2
+#endif /* SIMPLE_ISCAN */
+
+#define ANTENNA_NUM_1  1               /* total number of antennas to be used */
+#define ANTENNA_NUM_2  2
+#define ANTENNA_NUM_3  3
+#define ANTENNA_NUM_4  4
+
+#define ANT_SELCFG_AUTO                0x80    /* bit indicates antenna sel AUTO */
+#define ANT_SELCFG_MASK                0x33    /* antenna configuration mask */
+#define ANT_SELCFG_TX_UNICAST  0       /* unicast tx antenna configuration */
+#define ANT_SELCFG_RX_UNICAST  1       /* unicast rx antenna configuration */
+#define ANT_SELCFG_TX_DEF      2       /* default tx antenna configuration */
+#define ANT_SELCFG_RX_DEF      3       /* default rx antenna configuration */
+
+/* interference source detection and identification mode */
+#define ITFR_MODE_DISABLE      0       /* disable feature */
+#define ITFR_MODE_MANUAL_ENABLE        1       /* enable manual detection */
+#define ITFR_MODE_AUTO_ENABLE  2       /* enable auto detection */
+
+/* bit definitions for flags in interference source report */
+#define ITFR_INTERFERENCED     1       /* interference detected */
+#define ITFR_HOME_CHANNEL      2       /* home channel has interference */
+#define ITFR_NOISY_ENVIRONMENT 4       /* noisy environemnt so feature stopped */
+
+#define WL_NUM_RPI_BINS                8
+#define WL_RM_TYPE_BASIC       1
+#define WL_RM_TYPE_CCA         2
+#define WL_RM_TYPE_RPI         3
+#define WL_RM_TYPE_ABORT       -1      /* ABORT any in-progress RM request */
+
+#define WL_RM_FLAG_PARALLEL    (1<<0)
+
+#define WL_RM_FLAG_LATE                (1<<1)
+#define WL_RM_FLAG_INCAPABLE   (1<<2)
+#define WL_RM_FLAG_REFUSED     (1<<3)
+
+/* flags */
+#define WLC_ASSOC_REQ_IS_REASSOC 0x01 /* assoc req was actually a reassoc */
+
+#define WLC_CIS_DEFAULT        0       /* built-in default */
+#define WLC_CIS_SROM   1       /* source is sprom */
+#define WLC_CIS_OTP    2       /* source is otp */
+
+/* PCL - Power Control Loop */
+/* current gain setting is replaced by user input */
+#define WL_ATTEN_APP_INPUT_PCL_OFF     0       /* turn off PCL, apply supplied input */
+#define WL_ATTEN_PCL_ON                        1       /* turn on PCL */
+/* current gain setting is maintained */
+#define WL_ATTEN_PCL_OFF               2       /* turn off PCL. */
+
+/* defines used by poweridx iovar - it controls power in a-band */
+/* current gain setting is maintained */
+#define WL_PWRIDX_PCL_OFF      -2      /* turn off PCL.  */
+#define WL_PWRIDX_PCL_ON       -1      /* turn on PCL */
+#define WL_PWRIDX_LOWER_LIMIT  -2      /* lower limit */
+#define WL_PWRIDX_UPPER_LIMIT  63      /* upper limit */
+/* value >= 0 causes
+ *     - input to be set to that value
+ *     - PCL to be off
+ */
+
+#define BCM_MAC_STATUS_INDICATION      (0x40010200L)
+
+/* Values for TX Filter override mode */
+#define WLC_TXFILTER_OVERRIDE_DISABLED  0
+#define WLC_TXFILTER_OVERRIDE_ENABLED   1
+
+/* magic pattern used for mismatch driver and wl */
+#define WL_TXFIFO_SZ_MAGIC     0xa5a5
+
+/* check this magic number */
+#define WLC_IOCTL_MAGIC                0x14e46c77
+
+/* bss_info_cap_t flags */
+#define WL_BSS_FLAGS_FROM_BEACON       0x01    /* bss_info derived from beacon */
+#define WL_BSS_FLAGS_FROM_CACHE                0x02    /* bss_info collected from cache */
+#define WL_BSS_FLAGS_RSSI_ONCHANNEL    0x04    /* rssi info received on channel (vs offchannel) */
+#define WL_BSS_FLAGS_HS20              0x08    /* hotspot 2.0 capable */
+#define WL_BSS_FLAGS_RSSI_INVALID      0x10    /* BSS contains invalid RSSI */
+#define WL_BSS_FLAGS_RSSI_INACCURATE   0x20    /* BSS contains inaccurate RSSI */
+#define WL_BSS_FLAGS_SNR_INVALID       0x40    /* BSS contains invalid SNR */
+#define WL_BSS_FLAGS_NF_INVALID                0x80    /* BSS contains invalid noise floor */
+
+/* bit definitions for bcnflags in wl_bss_info */
+#define WL_BSS_BCNFLAGS_INTERWORK_PRESENT      0x01 /* beacon had IE, accessnet valid */
+#define WL_BSS_BCNFLAGS_INTERWORK_PRESENT_VALID 0x02 /* on indicates support for this API */
+#define WL_BSS_BCNFLAGS_MULTIPLE_BSSID_SET 0x4 /* this AP belongs to a multiple BSSID set */
+#define WL_BSS_BCNFLAGS_NONTRANSMITTED_BSSID 0x8 /* this AP is the transmitted BSSID */
+
+/* bssinfo flag for nbss_cap */
+#define VHT_BI_SGI_80MHZ                       0x00000100
+#define VHT_BI_80MHZ                       0x00000200
+#define VHT_BI_160MHZ                      0x00000400
+#define VHT_BI_8080MHZ                     0x00000800
+
+/* reference to wl_ioctl_t struct used by usermode driver */
+#define ioctl_subtype  set             /* subtype param */
+#define ioctl_pid      used            /* pid param */
+#define ioctl_status   needed          /* status param */
+
+/* Enumerate crypto algorithms */
+#define        CRYPTO_ALGO_OFF                 0
+#define        CRYPTO_ALGO_WEP1                1
+#define        CRYPTO_ALGO_TKIP                2
+#define        CRYPTO_ALGO_WEP128              3
+#define CRYPTO_ALGO_AES_CCM            4
+#define CRYPTO_ALGO_AES_OCB_MSDU       5
+#define CRYPTO_ALGO_AES_OCB_MPDU       6
+#if !defined(BCMCCX) && !defined(BCMEXTCCX) // MOG-NO
+#define CRYPTO_ALGO_NALG               7
+#else
+#define CRYPTO_ALGO_CKIP               7
+#define CRYPTO_ALGO_CKIP_MMH   8
+#define CRYPTO_ALGO_WEP_MMH            9
+#define CRYPTO_ALGO_NALG               10
+#endif /* !BCMCCX && !BCMEXTCCX */
+
+#define CRYPTO_ALGO_SMS4               11
+#define CRYPTO_ALGO_PMK                        12      /* for 802.1x supp to set PMK before 4-way */
+#define CRYPTO_ALGO_BIP                        13  /* 802.11w BIP (aes cmac) */
+
+#define CRYPTO_ALGO_AES_GCM     14  /* 128 bit GCM */
+#define CRYPTO_ALGO_AES_CCM256  15  /* 256 bit CCM */
+#define CRYPTO_ALGO_AES_GCM256  16  /* 256 bit GCM */
+#define CRYPTO_ALGO_BIP_CMAC256 17  /* 256 bit BIP CMAC */
+#define CRYPTO_ALGO_BIP_GMAC    18  /* 128 bit BIP GMAC */
+#define CRYPTO_ALGO_BIP_GMAC256 19  /* 256 bit BIP GMAC */
+
+#define CRYPTO_ALGO_NONE        CRYPTO_ALGO_OFF
+
+/* algo bit vector */
+#define KEY_ALGO_MASK(_algo)   (1 << _algo)
+
+#if defined(BCMCCX) || defined(BCMEXTCCX) // MOG-NO
+#define KEY_ALGO_MASK_CCX              (KEY_ALGO_MASK(CRYPTO_ALGO_CKIP) | \
+                                       KEY_ALGO_MASK(CRYPTO_ALGO_CKIP_MMH) | \
+                                       KEY_ALGO_MASK(CRYPTO_ALGO_WEP_MMH))
+#endif /* defined(BCMCCX) || defined(BCMEXTCCX) */
+
+#define KEY_ALGO_MASK_WEP              (KEY_ALGO_MASK(CRYPTO_ALGO_WEP1) | \
+                                       KEY_ALGO_MASK(CRYPTO_ALGO_WEP128) | \
+                                       KEY_ALGO_MASK(CRYPTO_ALGO_NALG))
+
+#define KEY_ALGO_MASK_AES              (KEY_ALGO_MASK(CRYPTO_ALGO_AES_CCM) | \
+                                       KEY_ALGO_MASK(CRYPTO_ALGO_AES_CCM256) | \
+                                       KEY_ALGO_MASK(CRYPTO_ALGO_AES_GCM) | \
+                                       KEY_ALGO_MASK(CRYPTO_ALGO_AES_GCM256))
+#define KEY_ALGO_MASK_TKIP             (KEY_ALGO_MASK(CRYPTO_ALGO_TKIP))
+#define KEY_ALGO_MASK_WAPI             (KEY_ALGO_MASK(CRYPTO_ALGO_SMS4))
+
+#define WSEC_GEN_MIC_ERROR     0x0001
+#define WSEC_GEN_REPLAY                0x0002
+#define WSEC_GEN_ICV_ERROR     0x0004
+#define WSEC_GEN_MFP_ACT_ERROR 0x0008
+#define WSEC_GEN_MFP_DISASSOC_ERROR    0x0010
+#define WSEC_GEN_MFP_DEAUTH_ERROR      0x0020
+
+#define WL_SOFT_KEY    (1 << 0)        /* Indicates this key is using soft encrypt */
+#define WL_PRIMARY_KEY (1 << 1)        /* Indicates this key is the primary (ie tx) key */
+#if defined(BCMCCX) || defined(BCMEXTCCX) // MOG-NO
+#define WL_CKIP_KP     (1 << 4)        /* CMIC */
+#define WL_CKIP_MMH    (1 << 5)        /* CKIP */
+#else
+#define WL_KF_RES_4    (1 << 4)        /* Reserved for backward compat */
+#define WL_KF_RES_5    (1 << 5)        /* Reserved for backward compat */
+#endif /* BCMCCX || BCMEXTCCX */
+#define WL_IBSS_PEER_GROUP_KEY (1 << 6)        /* Indicates a group key for a IBSS PEER */
+#define WL_LINK_KEY    (1 << 7)        /* For linking keys of both cores */
+#define WL_UNLINK_KEY  (1 << 8)        /* For unlinking keys of both cores */
+
+/* wireless security bitvec */
+#define WSEC_NONE              0x0
+#define WEP_ENABLED            0x0001
+#define TKIP_ENABLED           0x0002
+#define AES_ENABLED            0x0004
+#define WSEC_SWFLAG            0x0008
+#ifdef BCMCCX // MOG-NO
+#define CKIP_KP_ENABLED                0x0010
+#define CKIP_MIC_ENABLED       0x0020
+#endif /* BCMCCX */
+#define SES_OW_ENABLED         0x0040  /* to go into transition mode without setting wep */
+
+#ifdef BCMWAPI_WPI
+#define SMS4_ENABLED           0x0100
+#endif /* BCMWAPI_WPI */
+
+#define WSEC_WEP_ENABLED(wsec) ((wsec) & WEP_ENABLED)
+#define WSEC_TKIP_ENABLED(wsec)        ((wsec) & TKIP_ENABLED)
+#define WSEC_AES_ENABLED(wsec) ((wsec) & AES_ENABLED)
+
+/* Macros to check if algorithm is enabled */
+#define        WSEC_INFO_ALGO_ENABLED(_wi, _algo) \
+       (_wi).cur_algos & (1 << CRYPTO_ALGO_##_algo)
+
+#define WSEC_INFO_ALGO_NONE(_wi) (((_wi).cur_algos) == 0)
+
+#ifdef BCMCCX // MOG-NO
+#define WSEC_CKIP_KP_ENABLED(wsec)     ((wsec) & CKIP_KP_ENABLED)
+#define WSEC_CKIP_MIC_ENABLED(wsec)    ((wsec) & CKIP_MIC_ENABLED)
+#define WSEC_CKIP_ENABLED(wsec)        ((wsec) & (CKIP_KP_ENABLED|CKIP_MIC_ENABLED))
+
+#ifdef BCMWAPI_WPI
+#define WSEC_ENABLED(wsec) \
+       ((wsec) & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED | CKIP_KP_ENABLED | \
+         CKIP_MIC_ENABLED | SMS4_ENABLED))
+#endif /* BCMWAPI_WPI */
+
+#ifndef BCMWAPI_WPI /* BCMWAPI_WPI */
+#define WSEC_ENABLED(wsec) \
+               ((wsec) & \
+                (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED | CKIP_KP_ENABLED | CKIP_MIC_ENABLED))
+#endif /* BCMWAPI_WPI */
+#else /* defined BCMCCX */
+
+#ifdef BCMWAPI_WPI
+#define WSEC_ENABLED(wsec)     ((wsec) & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED | SMS4_ENABLED))
+#endif /* BCMWAPI_WPI */
+
+#ifndef BCMWAPI_WPI /* BCMWAPI_WPI */
+#define WSEC_ENABLED(wsec)     ((wsec) & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED))
+#endif /* BCMWAPI_WPI */
+#endif /* BCMCCX */
+
+#define WSEC_SES_OW_ENABLED(wsec)      ((wsec) & SES_OW_ENABLED)
+
+#ifdef BCMWAPI_WAI
+#define WSEC_SMS4_ENABLED(wsec)        ((wsec) & SMS4_ENABLED)
+#endif /* BCMWAPI_WAI */
+
+/* Following macros are not used any more. Just kept here to
+ * avoid build issue in BISON/CARIBOU branch
+ */
+#define MFP_CAPABLE            0x0200
+#define MFP_REQUIRED   0x0400
+#define MFP_SHA256             0x0800 /* a special configuration for STA for WIFI test tool */
+
+/* WPA authentication mode bitvec */
+#define WPA_AUTH_DISABLED              0x0000  /* Legacy (i.e., non-WPA) */
+#define WPA_AUTH_NONE                  0x0001  /* none (IBSS) */
+#define WPA_AUTH_UNSPECIFIED           0x0002  /* over 802.1x */
+#define WPA_AUTH_PSK                   0x0004  /* Pre-shared key */
+#if defined(BCMCCX) || defined(BCMEXTCCX) // MOG-NO
+#define WPA_AUTH_CCKM                  0x0008  /* CCKM */
+#define WPA2_AUTH_CCKM                 0x0010  /* CCKM2 */
+#endif /* BCMCCX || BCMEXTCCX */
+/* #define WPA_AUTH_8021X 0x0020 */    /* 802.1x, reserved */
+#define WPA2_AUTH_UNSPECIFIED          0x0040  /* over 802.1x */
+#define WPA2_AUTH_PSK                  0x0080  /* Pre-shared key */
+#define BRCM_AUTH_PSK                  0x0100  /* BRCM specific PSK */
+#define BRCM_AUTH_DPT                  0x0200  /* DPT PSK without group keys */
+#if defined(BCMWAPI_WAI) || defined(BCMWAPI_WPI)
+#define WPA_AUTH_WAPI                  0x0400 /* why it is same as WAPI_AUTH_UNSPECIFIED */
+#define WAPI_AUTH_NONE                 WPA_AUTH_NONE   /* none (IBSS) */
+#define WAPI_AUTH_UNSPECIFIED          0x0400  /* over AS */
+#define WAPI_AUTH_PSK                  0x0800  /* Pre-shared key */
+#endif /* BCMWAPI_WAI || BCMWAPI_WPI */
+#define WPA2_AUTH_1X_SHA256            0x1000  /* 1X with SHA256 key derivation */
+#define WPA2_AUTH_TPK                  0x2000  /* TDLS Peer Key */
+#define WPA2_AUTH_FT                   0x4000  /* Fast Transition. */
+#define WPA2_AUTH_PSK_SHA256           0x8000  /* PSK with SHA256 key derivation */
+#define WPA2_AUTH_FILS_SHA256          0x10000 /* FILS with SHA256 key derivation */
+#define WPA2_AUTH_FILS_SHA384          0x20000 /* FILS with SHA384 key derivation */
+#define WPA2_AUTH_IS_FILS(auth) ((auth) & (WPA2_AUTH_FILS_SHA256 | WPA2_AUTH_FILS_SHA384))
+#define WPA3_AUTH_SAE_PSK              0x40000 /* SAE with 4-way handshake */
+#define WPA3_AUTH_DPP_AKM              0x80000 /* Device Provisioning Protocol (DPP) */
+#define WPA3_AUTH_OWE                  0x100000 /* OWE */
+#define WPA3_AUTH_1X_SUITE_B_SHA256    0x200000 /* Suite B SHA256 */
+#define WPA3_AUTH_1X_SUITE_B_SHA384    0x400000 /* Suite B-192 SHA384 */
+#define WPA3_AUTH_PSK_SHA384           0x800000 /* PSK with SHA384 key derivation */
+#define WPA3_AUTH_SAE_AP_ONLY          0x1000000 /* SAE restriction to connect to pure SAE APs */
+/* WPA2_AUTH_SHA256 not used anymore. Just kept here to avoid build issue in DINGO */
+#define WPA2_AUTH_SHA256               0x8000
+#define WPA_AUTH_PFN_ANY               0xffffffff      /* for PFN, match only ssid */
+
+/* pmkid */
+#define        MAXPMKID                16      /* max # PMKID cache entries NDIS */
+
+#ifdef MACOSX
+/* Macos limits ioctl maxlen to 2k */
+#define        WLC_IOCTL_MAXLEN                2048    /* max length ioctl buffer required */
+#else
+/* SROM12 changes */
+#define        WLC_IOCTL_MAXLEN                8192    /* max length ioctl buffer required */
+#endif /* MACOSX */
+
+#define WLC_IOCTL_SMLEN                256     /* "small" length ioctl buffer required */
+#define WLC_IOCTL_MEDLEN               1896    /* "med" length ioctl buffer required */
+#if defined(LCNCONF) || defined(LCN40CONF) || defined(LCN20CONF)
+#define WLC_SAMPLECOLLECT_MAXLEN       8192    /* Max Sample Collect buffer */
+#else
+#define WLC_SAMPLECOLLECT_MAXLEN       10240   /* Max Sample Collect buffer for two cores */
+#endif
+#define WLC_SAMPLECOLLECT_MAXLEN_LCN40  8192
+
+#define WLC_IOCTL_NANRESP_MAXLEN        4096u    /* "max" length nan ioctl resp buffer required */
+#define WLC_IOCTL_NANRESP_MEDLEN        800u     /* "med" length nan ioctl resp buffer required */
+
+/* common ioctl definitions */
+#define WLC_GET_MAGIC                          0
+#define WLC_GET_VERSION                                1
+#define WLC_UP                                 2
+#define WLC_DOWN                               3
+#define WLC_GET_LOOP                           4
+#define WLC_SET_LOOP                           5
+#define WLC_DUMP                               6
+#define WLC_GET_MSGLEVEL                       7
+#define WLC_SET_MSGLEVEL                       8
+#define WLC_GET_PROMISC                                9
+#define WLC_SET_PROMISC                                10
+/* #define WLC_OVERLAY_IOCTL                   11 */ /* not supported */
+#define WLC_GET_RATE                           12
+#define WLC_GET_MAX_RATE                       13
+#define WLC_GET_INSTANCE                       14
+/* #define WLC_GET_FRAG                                15 */ /* no longer supported */
+/* #define WLC_SET_FRAG                                16 */ /* no longer supported */
+/* #define WLC_GET_RTS                         17 */ /* no longer supported */
+/* #define WLC_SET_RTS                         18 */ /* no longer supported */
+#define WLC_GET_INFRA                          19
+#define WLC_SET_INFRA                          20
+#define WLC_GET_AUTH                           21
+#define WLC_SET_AUTH                           22
+#define WLC_GET_BSSID                          23
+#define WLC_SET_BSSID                          24
+#define WLC_GET_SSID                           25
+#define WLC_SET_SSID                           26
+#define WLC_RESTART                            27
+#define WLC_TERMINATED                         28
+/* #define WLC_DUMP_SCB                                28 */ /* no longer supported */
+#define WLC_GET_CHANNEL                                29
+#define WLC_SET_CHANNEL                                30
+#define WLC_GET_SRL                            31
+#define WLC_SET_SRL                            32
+#define WLC_GET_LRL                            33
+#define WLC_SET_LRL                            34
+#define WLC_GET_PLCPHDR                                35
+#define WLC_SET_PLCPHDR                                36
+#define WLC_GET_RADIO                          37
+#define WLC_SET_RADIO                          38
+#define WLC_GET_PHYTYPE                                39
+#define WLC_DUMP_RATE                          40
+#define WLC_SET_RATE_PARAMS                    41
+#define WLC_GET_FIXRATE                                42
+#define WLC_SET_FIXRATE                                43
+/* #define WLC_GET_WEP                         42 */ /* no longer supported */
+/* #define WLC_SET_WEP                         43 */ /* no longer supported */
+#define WLC_GET_KEY                            44
+#define WLC_SET_KEY                            45
+#define WLC_GET_REGULATORY                     46
+#define WLC_SET_REGULATORY                     47
+#define WLC_GET_PASSIVE_SCAN                   48
+#define WLC_SET_PASSIVE_SCAN                   49
+#define WLC_SCAN                               50
+#define WLC_SCAN_RESULTS                       51
+#define WLC_DISASSOC                           52
+#define WLC_REASSOC                            53
+#define WLC_GET_ROAM_TRIGGER                   54
+#define WLC_SET_ROAM_TRIGGER                   55
+#define WLC_GET_ROAM_DELTA                     56
+#define WLC_SET_ROAM_DELTA                     57
+#define WLC_GET_ROAM_SCAN_PERIOD               58
+#define WLC_SET_ROAM_SCAN_PERIOD               59
+#define WLC_EVM                                        60      /* diag */
+#define WLC_GET_TXANT                          61
+#define WLC_SET_TXANT                          62
+#define WLC_GET_ANTDIV                         63
+#define WLC_SET_ANTDIV                         64
+/* #define WLC_GET_TXPWR                       65 */ /* no longer supported */
+/* #define WLC_SET_TXPWR                       66 */ /* no longer supported */
+#define WLC_GET_CLOSED                         67
+#define WLC_SET_CLOSED                         68
+#define WLC_GET_MACLIST                                69
+#define WLC_SET_MACLIST                                70
+#define WLC_GET_RATESET                                71
+#define WLC_SET_RATESET                                72
+/* #define WLC_GET_LOCALE                      73 */ /* no longer supported */
+#define WLC_LONGTRAIN                          74
+#define WLC_GET_BCNPRD                         75
+#define WLC_SET_BCNPRD                         76
+#define WLC_GET_DTIMPRD                                77
+#define WLC_SET_DTIMPRD                                78
+#define WLC_GET_SROM                           79
+#define WLC_SET_SROM                           80
+#define WLC_GET_WEP_RESTRICT                   81
+#define WLC_SET_WEP_RESTRICT                   82
+#define WLC_GET_COUNTRY                                83
+#define WLC_SET_COUNTRY                                84
+#define WLC_GET_PM                             85
+#define WLC_SET_PM                             86
+#define WLC_GET_WAKE                           87
+#define WLC_SET_WAKE                           88
+/* #define WLC_GET_D11CNTS                     89 */ /* -> "counters" iovar */
+#define WLC_GET_FORCELINK                      90      /* ndis only */
+#define WLC_SET_FORCELINK                      91      /* ndis only */
+#define WLC_FREQ_ACCURACY                      92      /* diag */
+#define WLC_CARRIER_SUPPRESS                   93      /* diag */
+#define WLC_GET_PHYREG                         94
+#define WLC_SET_PHYREG                         95
+#define WLC_GET_RADIOREG                       96
+#define WLC_SET_RADIOREG                       97
+#define WLC_GET_REVINFO                                98
+#define WLC_GET_UCANTDIV                       99
+#define WLC_SET_UCANTDIV                       100
+#define WLC_R_REG                              101
+#define WLC_W_REG                              102
+/* #define WLC_DIAG_LOOPBACK                   103     old tray diag */
+/* #define WLC_RESET_D11CNTS                   104 */ /* -> "reset_d11cnts" iovar */
+#define WLC_GET_MACMODE                                105
+#define WLC_SET_MACMODE                                106
+#define WLC_GET_MONITOR                                107
+#define WLC_SET_MONITOR                                108
+#define WLC_GET_GMODE                          109
+#define WLC_SET_GMODE                          110
+#define WLC_GET_LEGACY_ERP                     111
+#define WLC_SET_LEGACY_ERP                     112
+#define WLC_GET_RX_ANT                         113
+#define WLC_GET_CURR_RATESET                   114     /* current rateset */
+#define WLC_GET_SCANSUPPRESS                   115
+#define WLC_SET_SCANSUPPRESS                   116
+#define WLC_GET_AP                             117
+#define WLC_SET_AP                             118
+#define WLC_GET_EAP_RESTRICT                   119
+#define WLC_SET_EAP_RESTRICT                   120
+#define WLC_SCB_AUTHORIZE                      121
+#define WLC_SCB_DEAUTHORIZE                    122
+#define WLC_GET_WDSLIST                                123
+#define WLC_SET_WDSLIST                                124
+#define WLC_GET_ATIM                           125
+#define WLC_SET_ATIM                           126
+#define WLC_GET_RSSI                           127
+#define WLC_GET_PHYANTDIV                      128
+#define WLC_SET_PHYANTDIV                      129
+#define WLC_AP_RX_ONLY                         130
+#define WLC_GET_TX_PATH_PWR                    131
+#define WLC_SET_TX_PATH_PWR                    132
+#define WLC_GET_WSEC                           133
+#define WLC_SET_WSEC                           134
+#define WLC_GET_PHY_NOISE                      135
+#define WLC_GET_BSS_INFO                       136
+#define WLC_GET_PKTCNTS                                137
+#define WLC_GET_LAZYWDS                                138
+#define WLC_SET_LAZYWDS                                139
+#define WLC_GET_BANDLIST                       140
+
+#define WLC_GET_BAND                           141
+#define WLC_SET_BAND                           142
+#define WLC_SCB_DEAUTHENTICATE                 143
+#define WLC_GET_SHORTSLOT                      144
+#define WLC_GET_SHORTSLOT_OVERRIDE             145
+#define WLC_SET_SHORTSLOT_OVERRIDE             146
+#define WLC_GET_SHORTSLOT_RESTRICT             147
+#define WLC_SET_SHORTSLOT_RESTRICT             148
+#define WLC_GET_GMODE_PROTECTION               149
+#define WLC_GET_GMODE_PROTECTION_OVERRIDE      150
+#define WLC_SET_GMODE_PROTECTION_OVERRIDE      151
+#define WLC_UPGRADE                            152
+/* #define WLC_GET_MRATE                       153 */ /* no longer supported */
+/* #define WLC_SET_MRATE                       154 */ /* no longer supported */
+#define WLC_GET_IGNORE_BCNS                    155
+#define WLC_SET_IGNORE_BCNS                    156
+#define WLC_GET_SCB_TIMEOUT                    157
+#define WLC_SET_SCB_TIMEOUT                    158
+#define WLC_GET_ASSOCLIST                      159
+#define WLC_GET_CLK                            160
+#define WLC_SET_CLK                            161
+#define WLC_GET_UP                             162
+#define WLC_OUT                                        163
+#define WLC_GET_WPA_AUTH                       164
+#define WLC_SET_WPA_AUTH                       165
+#define WLC_GET_UCFLAGS                                166
+#define WLC_SET_UCFLAGS                                167
+#define WLC_GET_PWRIDX                         168
+#define WLC_SET_PWRIDX                         169
+#define WLC_GET_TSSI                           170
+#define WLC_GET_SUP_RATESET_OVERRIDE           171
+#define WLC_SET_SUP_RATESET_OVERRIDE           172
+/* #define WLC_SET_FAST_TIMER                  173 */ /* no longer supported */
+/* #define WLC_GET_FAST_TIMER                  174 */ /* no longer supported */
+/* #define WLC_SET_SLOW_TIMER                  175 */ /* no longer supported */
+/* #define WLC_GET_SLOW_TIMER                  176 */ /* no longer supported */
+/* #define WLC_DUMP_PHYREGS                    177 */ /* no longer supported */
+#define WLC_GET_PROTECTION_CONTROL             178
+#define WLC_SET_PROTECTION_CONTROL             179
+#define WLC_GET_PHYLIST                                180
+#define WLC_ENCRYPT_STRENGTH                   181     /* ndis only */
+#define WLC_DECRYPT_STATUS                     182     /* ndis only */
+#define WLC_GET_KEY_SEQ                                183
+#define WLC_GET_SCAN_CHANNEL_TIME              184
+#define WLC_SET_SCAN_CHANNEL_TIME              185
+#define WLC_GET_SCAN_UNASSOC_TIME              186
+#define WLC_SET_SCAN_UNASSOC_TIME              187
+#define WLC_GET_SCAN_HOME_TIME                 188
+#define WLC_SET_SCAN_HOME_TIME                 189
+#define WLC_GET_SCAN_NPROBES                   190
+#define WLC_SET_SCAN_NPROBES                   191
+#define WLC_GET_PRB_RESP_TIMEOUT               192
+#define WLC_SET_PRB_RESP_TIMEOUT               193
+#define WLC_GET_ATTEN                          194
+#define WLC_SET_ATTEN                          195
+#define WLC_GET_SHMEM                          196     /* diag */
+#define WLC_SET_SHMEM                          197     /* diag */
+/* #define WLC_GET_GMODE_PROTECTION_CTS                198 */ /* no longer supported */
+/* #define WLC_SET_GMODE_PROTECTION_CTS                199 */ /* no longer supported */
+#define WLC_SET_WSEC_TEST                      200
+#define WLC_SCB_DEAUTHENTICATE_FOR_REASON      201
+#define WLC_TKIP_COUNTERMEASURES               202
+#define WLC_GET_PIOMODE                                203
+#define WLC_SET_PIOMODE                                204
+#define WLC_SET_ASSOC_PREFER                   205
+#define WLC_GET_ASSOC_PREFER                   206
+#define WLC_SET_ROAM_PREFER                    207
+#define WLC_GET_ROAM_PREFER                    208
+/* #define WLC_SET_LED                         209 */ /* no longer supported */
+/* #define WLC_GET_LED                         210 */ /* no longer supported */
+#define WLC_GET_INTERFERENCE_MODE              211
+#define WLC_SET_INTERFERENCE_MODE              212
+#define WLC_GET_CHANNEL_QA                     213
+#define WLC_START_CHANNEL_QA                   214
+#define WLC_GET_CHANNEL_SEL                    215
+#define WLC_START_CHANNEL_SEL                  216
+#define WLC_GET_VALID_CHANNELS                 217
+#define WLC_GET_FAKEFRAG                       218
+#define WLC_SET_FAKEFRAG                       219
+#define WLC_GET_PWROUT_PERCENTAGE              220
+#define WLC_SET_PWROUT_PERCENTAGE              221
+#define WLC_SET_BAD_FRAME_PREEMPT              222
+#define WLC_GET_BAD_FRAME_PREEMPT              223
+#define WLC_SET_LEAP_LIST                      224
+#define WLC_GET_LEAP_LIST                      225
+#define WLC_GET_CWMIN                          226
+#define WLC_SET_CWMIN                          227
+#define WLC_GET_CWMAX                          228
+#define WLC_SET_CWMAX                          229
+#define WLC_GET_WET                            230
+#define WLC_SET_WET                            231
+#define WLC_GET_PUB                            232
+/* #define WLC_SET_GLACIAL_TIMER               233 */ /* no longer supported */
+/* #define WLC_GET_GLACIAL_TIMER               234 */ /* no longer supported */
+#define WLC_GET_KEY_PRIMARY                    235
+#define WLC_SET_KEY_PRIMARY                    236
+
+/* #define WLC_DUMP_RADIOREGS                  237 */ /* no longer supported */
+#define WLC_GET_ACI_ARGS                       238
+#define WLC_SET_ACI_ARGS                       239
+#define WLC_UNSET_CALLBACK                     240
+#define WLC_SET_CALLBACK                       241
+#define WLC_GET_RADAR                          242
+#define WLC_SET_RADAR                          243
+#define WLC_SET_SPECT_MANAGMENT                        244
+#define WLC_GET_SPECT_MANAGMENT                        245
+#define WLC_WDS_GET_REMOTE_HWADDR              246     /* handled in wl_linux.c/wl_vx.c */
+#define WLC_WDS_GET_WPA_SUP                    247
+#define WLC_SET_CS_SCAN_TIMER                  248
+#define WLC_GET_CS_SCAN_TIMER                  249
+#define WLC_MEASURE_REQUEST                    250
+#define WLC_INIT                               251
+#define WLC_SEND_QUIET                         252
+#define WLC_KEEPALIVE                  253
+#define WLC_SEND_PWR_CONSTRAINT                        254
+#define WLC_UPGRADE_STATUS                     255
+#define WLC_CURRENT_PWR                                256
+#define WLC_GET_SCAN_PASSIVE_TIME              257
+#define WLC_SET_SCAN_PASSIVE_TIME              258
+#define WLC_LEGACY_LINK_BEHAVIOR               259
+#define WLC_GET_CHANNELS_IN_COUNTRY            260
+#define WLC_GET_COUNTRY_LIST                   261
+#define WLC_GET_VAR                            262     /* get value of named variable */
+#define WLC_SET_VAR                            263     /* set named variable to value */
+#define WLC_NVRAM_GET                          264     /* deprecated */
+#define WLC_NVRAM_SET                          265
+#define WLC_NVRAM_DUMP                         266
+#define WLC_REBOOT                             267
+#define WLC_SET_WSEC_PMK                       268
+#define WLC_GET_AUTH_MODE                      269
+#define WLC_SET_AUTH_MODE                      270
+#define WLC_GET_WAKEENTRY                      271
+#define WLC_SET_WAKEENTRY                      272
+#define WLC_NDCONFIG_ITEM                      273     /* currently handled in wl_oid.c */
+#define WLC_NVOTPW                             274
+#define WLC_OTPW                               275
+#define WLC_IOV_BLOCK_GET                      276
+#define WLC_IOV_MODULES_GET                    277
+#define WLC_SOFT_RESET                         278
+#define WLC_GET_ALLOW_MODE                     279
+#define WLC_SET_ALLOW_MODE                     280
+#define WLC_GET_DESIRED_BSSID                  281
+#define WLC_SET_DESIRED_BSSID                  282
+#define        WLC_DISASSOC_MYAP                       283
+#define WLC_GET_NBANDS                         284     /* for Dongle EXT_STA support */
+#define WLC_GET_BANDSTATES                     285     /* for Dongle EXT_STA support */
+#define WLC_GET_WLC_BSS_INFO                   286     /* for Dongle EXT_STA support */
+#define WLC_GET_ASSOC_INFO                     287     /* for Dongle EXT_STA support */
+#define WLC_GET_OID_PHY                                288     /* for Dongle EXT_STA support */
+#define WLC_SET_OID_PHY                                289     /* for Dongle EXT_STA support */
+#define WLC_SET_ASSOC_TIME                     290     /* for Dongle EXT_STA support */
+#define WLC_GET_DESIRED_SSID                   291     /* for Dongle EXT_STA support */
+#define WLC_GET_CHANSPEC                       292     /* for Dongle EXT_STA support */
+#define WLC_GET_ASSOC_STATE                    293     /* for Dongle EXT_STA support */
+#define WLC_SET_PHY_STATE                      294     /* for Dongle EXT_STA support */
+#define WLC_GET_SCAN_PENDING                   295     /* for Dongle EXT_STA support */
+#define WLC_GET_SCANREQ_PENDING                        296     /* for Dongle EXT_STA support */
+#define WLC_GET_PREV_ROAM_REASON               297     /* for Dongle EXT_STA support */
+#define WLC_SET_PREV_ROAM_REASON               298     /* for Dongle EXT_STA support */
+#define WLC_GET_BANDSTATES_PI                  299     /* for Dongle EXT_STA support */
+#define WLC_GET_PHY_STATE                      300     /* for Dongle EXT_STA support */
+#define WLC_GET_BSS_WPA_RSN                    301     /* for Dongle EXT_STA support */
+#define WLC_GET_BSS_WPA2_RSN                   302     /* for Dongle EXT_STA support */
+#define WLC_GET_BSS_BCN_TS                     303     /* for Dongle EXT_STA support */
+#define WLC_GET_INT_DISASSOC                   304     /* for Dongle EXT_STA support */
+#define WLC_SET_NUM_PEERS                      305     /* for Dongle EXT_STA support */
+#define WLC_GET_NUM_BSS                                306     /* for Dongle EXT_STA support */
+#define WLC_PHY_SAMPLE_COLLECT                 307     /* phy sample collect mode */
+/* #define WLC_UM_PRIV                         308 */  /* Deprecated: usermode driver */
+#define WLC_GET_CMD                            309
+/* #define WLC_LAST                            310 */  /* Never used - can be reused */
+#define WLC_SET_INTERFERENCE_OVERRIDE_MODE     311     /* set inter mode override */
+#define WLC_GET_INTERFERENCE_OVERRIDE_MODE     312     /* get inter mode override */
+/* #define WLC_GET_WAI_RESTRICT        313 */  /* for WAPI, deprecated use iovar instead */
+/* #define WLC_SET_WAI_RESTRICT        314 */  /* for WAPI, deprecated use iovar instead */
+/* #define WLC_SET_WAI_REKEY   315 */  /* for WAPI, deprecated use iovar instead */
+#define WLC_SET_NAT_CONFIG                     316     /* for configuring NAT filter driver */
+#define WLC_GET_NAT_STATE                      317
+#define WLC_GET_TXBF_RATESET                   318
+#define WLC_SET_TXBF_RATESET                   319
+#define WLC_SCAN_CQ                            320
+#define WLC_GET_RSSI_QDB                       321 /* qdB portion of the RSSI */
+#define WLC_DUMP_RATESET                       322
+#define WLC_ECHO                               323
+#define WLC_SCB_AUTHENTICATE   325
+#define WLC_LAST                               326     /* The last ioctl. Also push this
+                                                        * number when adding new ioctls
+                                                        */
+/*
+ * Alert:
+ * Duplicate a few definitions that irelay requires from epiioctl.h here
+ * so caller doesn't have to include this file and epiioctl.h .
+ * If this grows any more, it would be time to move these irelay-specific
+ * definitions out of the epiioctl.h and into a separate driver common file.
+ */
+#define WLC_SPEC_FLAG                  0x80000000 /* For some special IOCTL */
+#ifndef EPICTRL_COOKIE
+#define EPICTRL_COOKIE         0xABADCEDE
+#endif
+
+/* vx wlc ioctl's offset */
+#define CMN_IOCTL_OFF 0x180
+
+/*
+ * custom OID support
+ *
+ * 0xFF - implementation specific OID
+ * 0xE4 - first byte of Broadcom PCI vendor ID
+ * 0x14 - second byte of Broadcom PCI vendor ID
+ * 0xXX - the custom OID number
+ */
+
+/* begin 0x1f values beyond the start of the ET driver range. */
+#define WL_OID_BASE            0xFFE41420
+
+/* NDIS overrides */
+#define OID_WL_GETINSTANCE     (WL_OID_BASE + WLC_GET_INSTANCE)
+#define OID_WL_GET_FORCELINK   (WL_OID_BASE + WLC_GET_FORCELINK)
+#define OID_WL_SET_FORCELINK   (WL_OID_BASE + WLC_SET_FORCELINK)
+#define        OID_WL_ENCRYPT_STRENGTH (WL_OID_BASE + WLC_ENCRYPT_STRENGTH)
+#define OID_WL_DECRYPT_STATUS  (WL_OID_BASE + WLC_DECRYPT_STATUS)
+#define OID_LEGACY_LINK_BEHAVIOR (WL_OID_BASE + WLC_LEGACY_LINK_BEHAVIOR)
+#define OID_WL_NDCONFIG_ITEM   (WL_OID_BASE + WLC_NDCONFIG_ITEM)
+
+/* EXT_STA Dongle suuport */
+#define OID_STA_CHANSPEC       (WL_OID_BASE + WLC_GET_CHANSPEC)
+#define OID_STA_NBANDS         (WL_OID_BASE + WLC_GET_NBANDS)
+#define OID_STA_GET_PHY                (WL_OID_BASE + WLC_GET_OID_PHY)
+#define OID_STA_SET_PHY                (WL_OID_BASE + WLC_SET_OID_PHY)
+#define OID_STA_ASSOC_TIME     (WL_OID_BASE + WLC_SET_ASSOC_TIME)
+#define OID_STA_DESIRED_SSID   (WL_OID_BASE + WLC_GET_DESIRED_SSID)
+#define OID_STA_SET_PHY_STATE  (WL_OID_BASE + WLC_SET_PHY_STATE)
+#define OID_STA_SCAN_PENDING   (WL_OID_BASE + WLC_GET_SCAN_PENDING)
+#define OID_STA_SCANREQ_PENDING (WL_OID_BASE + WLC_GET_SCANREQ_PENDING)
+#define OID_STA_GET_ROAM_REASON (WL_OID_BASE + WLC_GET_PREV_ROAM_REASON)
+#define OID_STA_SET_ROAM_REASON (WL_OID_BASE + WLC_SET_PREV_ROAM_REASON)
+#define OID_STA_GET_PHY_STATE  (WL_OID_BASE + WLC_GET_PHY_STATE)
+#define OID_STA_INT_DISASSOC   (WL_OID_BASE + WLC_GET_INT_DISASSOC)
+#define OID_STA_SET_NUM_PEERS  (WL_OID_BASE + WLC_SET_NUM_PEERS)
+#define OID_STA_GET_NUM_BSS    (WL_OID_BASE + WLC_GET_NUM_BSS)
+
+/* NAT filter driver support */
+#define OID_NAT_SET_CONFIG     (WL_OID_BASE + WLC_SET_NAT_CONFIG)
+#define OID_NAT_GET_STATE      (WL_OID_BASE + WLC_GET_NAT_STATE)
+
+#define WL_DECRYPT_STATUS_SUCCESS      1
+#define WL_DECRYPT_STATUS_FAILURE      2
+#define WL_DECRYPT_STATUS_UNKNOWN      3
+
+/* allows user-mode app to poll the status of USB image upgrade */
+#define WLC_UPGRADE_SUCCESS                    0
+#define WLC_UPGRADE_PENDING                    1
+
+/* WLC_GET_AUTH, WLC_SET_AUTH values */
+#define WL_AUTH_OPEN_SYSTEM            0       /* d11 open authentication */
+#define WL_AUTH_SHARED_KEY             1       /* d11 shared authentication */
+#define WL_AUTH_OPEN_SHARED            2       /* try open, then shared if open failed w/rc 13 */
+#define WL_AUTH_SAE_KEY                        3       /* d11 sae authentication */
+#define WL_AUTH_FILS_SHARED            4       /* d11 fils shared key authentication */
+#define WL_AUTH_FILS_SHARED_PFS                5       /* d11 fils shared key w/ pfs authentication */
+#define WL_AUTH_FILS_PUBLIC            6       /* d11 fils public key authentication */
+/* Some branch use different define for WL_AUTH_OPEN_SHARED
+ * for example, PHOENIX2 Branch defined WL_AUTH_OPEN_SHARED as 3
+ * But other branch defined WL_AUTH_OPEN_SHARED as 2
+ * if it is mismatch, WEP association can be failed.
+ * More information - RB:5320
+ */
+
+/* a large TX Power as an init value to factor out of MIN() calculations,
+ * keep low enough to fit in an int8, units are .25 dBm
+ */
+#define WLC_TXPWR_MAX          (127)   /* ~32 dBm = 1,500 mW */
+
+/* "diag" iovar argument and error code */
+#define WL_DIAG_INTERRUPT                      1       /* d11 loopback interrupt test */
+#define WL_DIAG_LOOPBACK                       2       /* d11 loopback data test */
+#define WL_DIAG_MEMORY                         3       /* d11 memory test */
+#define WL_DIAG_LED                            4       /* LED test */
+#define WL_DIAG_REG                            5       /* d11/phy register test */
+#define WL_DIAG_SROM                           6       /* srom read/crc test */
+#define WL_DIAG_DMA                            7       /* DMA test */
+#define WL_DIAG_LOOPBACK_EXT                   8       /* enhenced d11 loopback data test */
+
+#define WL_DIAGERR_SUCCESS                     0
+#define WL_DIAGERR_FAIL_TO_RUN                 1       /* unable to run requested diag */
+#define WL_DIAGERR_NOT_SUPPORTED               2       /* diag requested is not supported */
+#define WL_DIAGERR_INTERRUPT_FAIL              3       /* loopback interrupt test failed */
+#define WL_DIAGERR_LOOPBACK_FAIL               4       /* loopback data test failed */
+#define WL_DIAGERR_SROM_FAIL                   5       /* srom read failed */
+#define WL_DIAGERR_SROM_BADCRC                 6       /* srom crc failed */
+#define WL_DIAGERR_REG_FAIL                    7       /* d11/phy register test failed */
+#define WL_DIAGERR_MEMORY_FAIL                 8       /* d11 memory test failed */
+#define WL_DIAGERR_NOMEM                       9       /* diag test failed due to no memory */
+#define WL_DIAGERR_DMA_FAIL                    10      /* DMA test failed */
+
+#define WL_DIAGERR_MEMORY_TIMEOUT              11      /* d11 memory test didn't finish in time */
+#define WL_DIAGERR_MEMORY_BADPATTERN           12      /* d11 memory test result in bad pattern */
+
+/* band types */
+#define        WLC_BAND_AUTO           0       /* auto-select */
+#define        WLC_BAND_5G             1       /* 5 Ghz */
+#define        WLC_BAND_2G             2       /* 2.4 Ghz */
+#define        WLC_BAND_ALL            3       /* all bands */
+#define        WLC_BAND_6G             4       /* 6 Ghz */
+#define WLC_BAND_INVALID       -1      /* Invalid band */
+
+/* band range returned by band_range iovar */
+#define WL_CHAN_FREQ_RANGE_2G      0
+#define WL_CHAN_FREQ_RANGE_5GL     1
+#define WL_CHAN_FREQ_RANGE_5GM     2
+#define WL_CHAN_FREQ_RANGE_5GH     3
+
+#define WL_CHAN_FREQ_RANGE_5GLL_5BAND    4
+#define WL_CHAN_FREQ_RANGE_5GLH_5BAND    5
+#define WL_CHAN_FREQ_RANGE_5GML_5BAND    6
+#define WL_CHAN_FREQ_RANGE_5GMH_5BAND    7
+#define WL_CHAN_FREQ_RANGE_5GH_5BAND     8
+
+#define WL_CHAN_FREQ_RANGE_5G_BAND0     1
+#define WL_CHAN_FREQ_RANGE_5G_BAND1     2
+#define WL_CHAN_FREQ_RANGE_5G_BAND2     3
+#define WL_CHAN_FREQ_RANGE_5G_BAND3     4
+#define WL_CHAN_FREQ_RANGE_5G_4BAND     5
+#define WL_CHAN_FREQ_RANGE_6G_6BAND            6
+
+/* SROM12 */
+#define WL_CHAN_FREQ_RANGE_5G_BAND4 5
+#define WL_CHAN_FREQ_RANGE_2G_40 6
+#define WL_CHAN_FREQ_RANGE_5G_BAND0_40 7
+#define WL_CHAN_FREQ_RANGE_5G_BAND1_40 8
+#define WL_CHAN_FREQ_RANGE_5G_BAND2_40 9
+#define WL_CHAN_FREQ_RANGE_5G_BAND3_40 10
+#define WL_CHAN_FREQ_RANGE_5G_BAND4_40 11
+#define WL_CHAN_FREQ_RANGE_5G_BAND0_80 12
+#define WL_CHAN_FREQ_RANGE_5G_BAND1_80 13
+#define WL_CHAN_FREQ_RANGE_5G_BAND2_80 14
+#define WL_CHAN_FREQ_RANGE_5G_BAND3_80 15
+#define WL_CHAN_FREQ_RANGE_5G_BAND4_80 16
+
+#define WL_CHAN_FREQ_RANGE_5G_5BAND    18
+#define WL_CHAN_FREQ_RANGE_5G_5BAND_40 19
+#define WL_CHAN_FREQ_RANGE_5G_5BAND_80 20
+
+#define WLC_MACMODE_DISABLED   0       /* MAC list disabled */
+#define WLC_MACMODE_DENY       1       /* Deny specified (i.e. allow unspecified) */
+#define WLC_MACMODE_ALLOW      2       /* Allow specified (i.e. deny unspecified) */
+#define WLC_MACMODE_AVOID      3       /* Avoid specified (i.e. conditionally avoid unspecified) */
+
+/*
+ * 54g modes (basic bits may still be overridden)
+ *
+ * GMODE_LEGACY_B                      Rateset: 1b, 2b, 5.5, 11
+ *                                     Preamble: Long
+ *                                     Shortslot: Off
+ * GMODE_AUTO                          Rateset: 1b, 2b, 5.5b, 11b, 18, 24, 36, 54
+ *                                     Extended Rateset: 6, 9, 12, 48
+ *                                     Preamble: Long
+ *                                     Shortslot: Auto
+ * GMODE_ONLY                          Rateset: 1b, 2b, 5.5b, 11b, 18, 24b, 36, 54
+ *                                     Extended Rateset: 6b, 9, 12b, 48
+ *                                     Preamble: Short required
+ *                                     Shortslot: Auto
+ * GMODE_B_DEFERRED                    Rateset: 1b, 2b, 5.5b, 11b, 18, 24, 36, 54
+ *                                     Extended Rateset: 6, 9, 12, 48
+ *                                     Preamble: Long
+ *                                     Shortslot: On
+ * GMODE_PERFORMANCE                   Rateset: 1b, 2b, 5.5b, 6b, 9, 11b, 12b, 18, 24b, 36, 48, 54
+ *                                     Preamble: Short required
+ *                                     Shortslot: On and required
+ * GMODE_LRS                           Rateset: 1b, 2b, 5.5b, 11b
+ *                                     Extended Rateset: 6, 9, 12, 18, 24, 36, 48, 54
+ *                                     Preamble: Long
+ *                                     Shortslot: Auto
+ */
+#define GMODE_LEGACY_B         0
+#define GMODE_AUTO             1
+#define GMODE_ONLY             2
+#define GMODE_B_DEFERRED       3
+#define GMODE_PERFORMANCE      4
+#define GMODE_LRS              5
+#define GMODE_MAX              6
+
+/* values for PLCPHdr_override */
+#define WLC_PLCP_AUTO  -1
+#define WLC_PLCP_SHORT 0
+#define WLC_PLCP_LONG  1
+
+/* values for g_protection_override and n_protection_override */
+#define WLC_PROTECTION_AUTO            -1
+#define WLC_PROTECTION_OFF             0
+#define WLC_PROTECTION_ON              1
+#define WLC_PROTECTION_MMHDR_ONLY      2
+#define WLC_PROTECTION_CTS_ONLY                3
+
+/* values for g_protection_control and n_protection_control */
+#define WLC_PROTECTION_CTL_OFF         0
+#define WLC_PROTECTION_CTL_LOCAL       1
+#define WLC_PROTECTION_CTL_OVERLAP     2
+
+/* values for n_protection */
+#define WLC_N_PROTECTION_OFF           0
+#define WLC_N_PROTECTION_OPTIONAL      1
+#define WLC_N_PROTECTION_20IN40                2
+#define WLC_N_PROTECTION_MIXEDMODE     3
+
+/* values for n_preamble_type */
+#define WLC_N_PREAMBLE_MIXEDMODE       0
+#define WLC_N_PREAMBLE_GF              1
+#define WLC_N_PREAMBLE_GF_BRCM          2
+
+/* values for band specific 40MHz capabilities (deprecated) */
+#define WLC_N_BW_20ALL                 0
+#define WLC_N_BW_40ALL                 1
+#define WLC_N_BW_20IN2G_40IN5G         2
+
+#define WLC_BW_20MHZ_BIT               (1<<0)
+#define WLC_BW_40MHZ_BIT               (1<<1)
+#define WLC_BW_80MHZ_BIT               (1<<2)
+#define WLC_BW_160MHZ_BIT              (1<<3)
+#define WLC_BW_10MHZ_BIT               (1<<4)
+#define WLC_BW_5MHZ_BIT                        (1<<5)
+#define WLC_BW_2P5MHZ_BIT              (1<<6)
+/* Bandwidth capabilities */
+#define WLC_BW_CAP_20MHZ               (WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_40MHZ               (WLC_BW_40MHZ_BIT|WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_80MHZ               (WLC_BW_80MHZ_BIT|WLC_BW_40MHZ_BIT|WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_160MHZ              (WLC_BW_160MHZ_BIT|WLC_BW_80MHZ_BIT| \
+       WLC_BW_40MHZ_BIT|WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_2P5MHZ              (WLC_BW_2P5MHZ_BIT)
+#define WLC_BW_CAP_5MHZ                        (WLC_BW_5MHZ_BIT)
+#define WLC_BW_CAP_10MHZ               (WLC_BW_10MHZ_BIT)
+#define WLC_BW_CAP_UNRESTRICTED                0xFF
+
+#define WL_BW_CAP_20MHZ(bw_cap)        (((bw_cap) & WLC_BW_20MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_40MHZ(bw_cap)        (((bw_cap) & WLC_BW_40MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_80MHZ(bw_cap)        (((bw_cap) & WLC_BW_80MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_160MHZ(bw_cap)(((bw_cap) & WLC_BW_160MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_2P5MHZ(bw_cap)(((bw_cap) & WLC_BW_2P5MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_5MHZ(bw_cap) (((bw_cap) & WLC_BW_5MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_10MHZ(bw_cap)        (((bw_cap) & WLC_BW_10MHZ_BIT) ? TRUE : FALSE)
+/* values to force tx/rx chain */
+#define WLC_N_TXRX_CHAIN0              0
+#define WLC_N_TXRX_CHAIN1              1
+
+/* bitflags for SGI support (sgi_rx iovar) */
+#define WLC_N_SGI_20                   0x01
+#define WLC_N_SGI_40                   0x02
+#define WLC_VHT_SGI_80                 0x04
+#define WLC_VHT_SGI_160                        0x08
+
+/* when sgi_tx==WLC_SGI_ALL, bypass rate selection, enable sgi for all mcs */
+#define WLC_SGI_ALL                            0x02
+
+#define LISTEN_INTERVAL                        10
+/* interference mitigation options */
+#define        INTERFERE_OVRRIDE_OFF   -1      /* interference override off */
+#define        INTERFERE_NONE  0       /* off */
+#define        NON_WLAN        1       /* foreign/non 802.11 interference, no auto detect */
+#define        WLAN_MANUAL     2       /* ACI: no auto detection */
+#define        WLAN_AUTO       3       /* ACI: auto detect */
+#define        WLAN_AUTO_W_NOISE       4       /* ACI: auto - detect and non 802.11 interference */
+#define AUTO_ACTIVE    (1 << 7) /* Auto is currently active */
+
+/* interfernece mode bit-masks (ACPHY) */
+#define ACPHY_ACI_GLITCHBASED_DESENSE 1   /* bit 0 */
+#define ACPHY_ACI_HWACI_PKTGAINLMT 2      /* bit 1 */
+#define ACPHY_ACI_W2NB_PKTGAINLMT 4       /* bit 2 */
+#define ACPHY_ACI_PREEMPTION 8            /* bit 3 */
+#define ACPHY_HWACI_MITIGATION 16         /* bit 4 */
+#define ACPHY_LPD_PREEMPTION 32           /* bit 5 */
+#define ACPHY_HWOBSS_MITIGATION 64        /* bit 6 */
+#define ACPHY_ACI_MAX_MODE 127
+
+/* AP environment */
+#define AP_ENV_DETECT_NOT_USED         0 /* We aren't using AP environment detection */
+#define AP_ENV_DENSE                   1 /* "Corporate" or other AP dense environment */
+#define AP_ENV_SPARSE                  2 /* "Home" or other sparse environment */
+#define AP_ENV_INDETERMINATE           3 /* AP environment hasn't been identified */
+
+#define TRIGGER_NOW                            0
+#define TRIGGER_CRS                            0x01
+#define TRIGGER_CRSDEASSERT                    0x02
+#define TRIGGER_GOODFCS                                0x04
+#define TRIGGER_BADFCS                         0x08
+#define TRIGGER_BADPLCP                                0x10
+#define TRIGGER_CRSGLITCH                      0x20
+#define TRIGGER_ASYNC                          0x40
+
+#define        WL_SAMPLEDATA_HEADER_TYPE       1
+#define WL_SAMPLEDATA_HEADER_SIZE      80      /* sample collect header size (bytes) */
+#define        WL_SAMPLEDATA_TYPE              2
+#define        WL_SAMPLEDATA_SEQ               0xff    /* sequence # */
+#define        WL_SAMPLEDATA_MORE_DATA         0x100   /* more data mask */
+
+/* WL_OTA START */
+#define WL_OTA_ARG_PARSE_BLK_SIZE      1200
+#define WL_OTA_TEST_MAX_NUM_RATE       30
+#define WL_OTA_TEST_MAX_NUM_SEQ                100
+#define WL_OTA_TEST_MAX_NUM_RSSI       85
+#define WL_THRESHOLD_LO_BAND   70      /* range from 5250MHz - 5350MHz */
+
+/* radar iovar SET defines */
+#define WL_RADAR_DETECTOR_OFF          0       /* radar detector off */
+#define WL_RADAR_DETECTOR_ON           1       /* radar detector on */
+#define WL_RADAR_SIMULATED             2       /* force radar detector to declare
+                                                * detection once
+                                                */
+#define WL_RADAR_SIMULATED_SC          3       /* force radar detector to declare
+                                                * detection once on scan core
+                                                * if available and active
+                                                */
+#define WL_RSSI_ANT_VERSION    1       /* current version of wl_rssi_ant_t */
+#define WL_ANT_RX_MAX          2       /* max 2 receive antennas */
+#define WL_ANT_HT_RX_MAX       4       /* max 4 receive antennas/cores */
+#define WL_ANT_IDX_1           0       /* antenna index 1 */
+#define WL_ANT_IDX_2           1       /* antenna index 2 */
+
+#ifndef WL_RSSI_ANT_MAX
+#define WL_RSSI_ANT_MAX                4       /* max possible rx antennas */
+#elif WL_RSSI_ANT_MAX != 4
+#error "WL_RSSI_ANT_MAX does not match"
+#endif
+
+/* dfs_status iovar-related defines */
+
+/* cac - channel availability check,
+ * ism - in-service monitoring
+ * csa - channel switching announcement
+ */
+
+/* cac state values */
+#define WL_DFS_CACSTATE_IDLE           0       /* state for operating in non-radar channel */
+#define        WL_DFS_CACSTATE_PREISM_CAC      1       /* CAC in progress */
+#define WL_DFS_CACSTATE_ISM            2       /* ISM in progress */
+#define WL_DFS_CACSTATE_CSA            3       /* csa */
+#define WL_DFS_CACSTATE_POSTISM_CAC    4       /* ISM CAC */
+#define WL_DFS_CACSTATE_PREISM_OOC     5       /* PREISM OOC */
+#define WL_DFS_CACSTATE_POSTISM_OOC    6       /* POSTISM OOC */
+#define WL_DFS_CACSTATES               7       /* this many states exist */
+
+/* Defines used with channel_bandwidth for curpower */
+#define WL_BW_20MHZ            0
+#define WL_BW_40MHZ            1
+#define WL_BW_80MHZ            2
+#define WL_BW_160MHZ           3
+#define WL_BW_8080MHZ          4
+#define WL_BW_2P5MHZ           5
+#define WL_BW_5MHZ             6
+#define WL_BW_10MHZ            7
+
+/* tx_power_t.flags bits */
+#define WL_TX_POWER_F_ENABLED  1
+#define WL_TX_POWER_F_HW               2
+#define WL_TX_POWER_F_MIMO             4
+#define WL_TX_POWER_F_SISO             8
+#define WL_TX_POWER_F_HT               0x10
+#define WL_TX_POWER_F_VHT              0x20
+#define WL_TX_POWER_F_OPENLOOP         0x40
+#define WL_TX_POWER_F_PROP11NRATES     0x80
+#define WL_TX_POWER_F_UNIT_QDBM                0x100
+#define WL_TX_POWER_F_TXCAP            0x200
+#define WL_TX_POWER_F_HE               0x400
+#define WL_TX_POWER_F_RU_RATE          0x800
+
+/* Message levels */
+#define WL_ERROR_VAL           0x00000001
+#define WL_TRACE_VAL           0x00000002
+#define WL_PRHDRS_VAL          0x00000004
+#define WL_PRPKT_VAL           0x00000008
+#define WL_INFORM_VAL          0x00000010
+#define WL_TMP_VAL             0x00000020
+#define WL_OID_VAL             0x00000040
+#define WL_RATE_VAL            0x00000080
+#define WL_ASSOC_VAL           0x00000100
+#define WL_PRUSR_VAL           0x00000200
+#define WL_PS_VAL              0x00000400
+#define WL_TXPWR_VAL           0x00000000      /* retired in TOT on 6/10/2009 */
+#define WL_MODE_SWITCH_VAL     0x00000800      /* Using retired TXPWR val */
+#define WL_PORT_VAL            0x00001000
+#define WL_DUAL_VAL            0x00002000
+#define WL_WSEC_VAL            0x00004000
+#define WL_WSEC_DUMP_VAL       0x00008000
+#define WL_LOG_VAL             0x00010000
+#define WL_NRSSI_VAL           0x00000000      /* retired in TOT on 6/10/2009 */
+#define WL_BCNTRIM_VAL         0x00020000      /* Using retired NRSSI VAL */
+#define WL_LOFT_VAL            0x00000000      /* retired in TOT on 6/10/2009 */
+#define WL_PFN_VAL             0x00040000      /* Using retired LOFT_VAL */
+#define WL_REGULATORY_VAL      0x00080000
+#define WL_CSA_VAL             0x00080000      /* Reusing REGULATORY_VAL due to lackof bits */
+#define WL_TAF_VAL             0x00100000
+#define WL_RADAR_VAL           0x00000000      /* retired in TOT on 6/10/2009 */
+#define WL_WDI_VAL             0x00200000      /* Using retired WL_RADAR_VAL VAL */
+#define WL_MPC_VAL             0x00400000
+#define WL_APSTA_VAL           0x00800000
+#define WL_DFS_VAL             0x01000000
+#define WL_BA_VAL              0x00000000      /* retired in TOT on 6/14/2010 */
+#define WL_MUMIMO_VAL          0x02000000      /* Using retired WL_BA_VAL */
+#define WL_ACI_VAL             0x04000000
+#define WL_PRMAC_VAL           0x04000000
+#define WL_MBSS_VAL            0x04000000
+#define WL_CAC_VAL             0x08000000
+#define WL_AMSDU_VAL           0x10000000
+#define WL_AMPDU_VAL           0x20000000
+#define WL_FFPLD_VAL           0x40000000
+#define WL_ROAM_EXP_VAL                0x80000000
+
+/* wl_msg_level is full. For new bits take the next one and AND with
+ * wl_msg_level2 in wl_dbg.h
+ */
+#define WL_DPT_VAL             0x00000001
+/* re-using WL_DPT_VAL */
+/* re-using WL_MESH_VAL */
+#define WL_NATOE_VAL           0x00000001
+#define WL_MESH_VAL            0x00000001
+#define WL_SCAN_VAL            0x00000002
+#define WL_WOWL_VAL            0x00000004
+#define WL_COEX_VAL            0x00000008
+#define WL_RTDC_VAL            0x00000010
+#define WL_PROTO_VAL           0x00000020
+#define WL_SWDIV_VAL           0x00000040
+#define WL_CHANINT_VAL         0x00000080
+#define WL_WMF_VAL             0x00000100
+#define WL_P2P_VAL             0x00000200
+#define WL_ITFR_VAL            0x00000400
+#define WL_MCHAN_VAL           0x00000800
+#define WL_TDLS_VAL            0x00001000
+#define WL_MCNX_VAL            0x00002000
+#define WL_PROT_VAL            0x00004000
+#define WL_TSO_VAL             0x00010000
+#define WL_TRF_MGMT_VAL                0x00020000
+#define WL_LPC_VAL             0x00040000
+#define WL_L2FILTER_VAL                0x00080000
+#define WL_TXBF_VAL            0x00100000
+#define WL_P2PO_VAL            0x00200000
+#define WL_TBTT_VAL            0x00400000
+#define WL_FBT_VAL             0x00800000
+#define WL_RRM_VAL             0x00800000      /* reuse */
+#define WL_MQ_VAL              0x01000000
+/* This level is currently used in Phoenix2 only */
+#define WL_SRSCAN_VAL          0x02000000
+#define WL_WNM_VAL             0x04000000
+/* re-using WL_WNM_VAL for MBO */
+#define WL_MBO_VAL             0x04000000
+/* re-using WL_SRSCAN_VAL */
+#define WL_RANDMAC_VAL         0x02000000
+
+#define WL_UNUSED_VAL          0x10000000      /* Was a duplicate for WL_LPC_VAL. Removed */
+#define WL_NET_DETECT_VAL      0x20000000
+#define WL_OCE_VAL  0x20000000 /* reuse */
+#define WL_PCIE_VAL            0x40000000
+#define WL_PMDUR_VAL   0x80000000
+/* use top-bit for WL_TIME_STAMP_VAL because this is a modifier
+ * rather than a message-type of its own
+ */
+#define WL_TIMESTAMP_VAL        0x80000000
+
+/* wl_msg_level2 is full. For new bits take the next one and AND with
+ * wl_msg_level3 in wl_dbg.h
+ */
+#define WL_ASSOC_AP_VAL                0x00000001
+#define WL_FILS_VAL            0x00000002
+#define WL_LATENCY_VAL         0x00000004
+#define WL_WBUS_VAL            0x00000008
+
+/* number of bytes needed to define a proper bit mask for MAC event reporting */
+#define BCMIO_ROUNDUP(x, y)    ((((x) + ((y) - 1)) / (y)) * (y))
+#define BCMIO_NBBY             8
+#define WL_EVENTING_MASK_LEN   (16+4)          /* Don't increase this without wl review */
+
+#define WL_EVENTING_MASK_EXT_LEN       ROUNDUP(WLC_E_LAST, NBBY)/NBBY
+
+/* join preference types */
+#define WL_JOIN_PREF_RSSI      1       /* by RSSI */
+#define WL_JOIN_PREF_WPA       2       /* by akm and ciphers */
+#define WL_JOIN_PREF_BAND      3       /* by 802.11 band */
+#define WL_JOIN_PREF_RSSI_DELTA        4       /* by 802.11 band only if RSSI delta condition matches */
+#define WL_JOIN_PREF_TRANS_PREF        5       /* defined by requesting AP */
+
+/* band preference */
+#define WLJP_BAND_ASSOC_PREF   255     /* use what WLC_SET_ASSOC_PREFER ioctl specifies */
+
+/* any multicast cipher suite */
+#define WL_WPA_ACP_MCS_ANY     "\x00\x00\x00\x00"
+
+/* 802.11h measurement types */
+#define WLC_MEASURE_TPC                        1
+#define WLC_MEASURE_CHANNEL_BASIC      2
+#define WLC_MEASURE_CHANNEL_CCA                3
+#define WLC_MEASURE_CHANNEL_RPI                4
+
+/* regulatory enforcement levels */
+#define SPECT_MNGMT_OFF                        0               /* both 11h and 11d disabled */
+#define SPECT_MNGMT_LOOSE_11H          1               /* allow non-11h APs in scan lists */
+#define SPECT_MNGMT_STRICT_11H         2               /* prune out non-11h APs from scan list */
+#define SPECT_MNGMT_STRICT_11D         3               /* switch to 802.11D mode */
+/* SPECT_MNGMT_LOOSE_11H_D - same as SPECT_MNGMT_LOOSE with the exception that Country IE
+ * adoption is done regardless of capability spectrum_management
+ */
+#define SPECT_MNGMT_LOOSE_11H_D                4               /* operation defined above */
+
+/* bit position in per_chan_info; these depend on current country/regulatory domain */
+#define WL_CHAN_VALID_HW           (1u << 0)     /* valid with current HW */
+#define WL_CHAN_VALID_SW           (1u << 1)     /* valid with current country setting */
+#define WL_CHAN_BAND_5G            (1u << 2)     /* 5GHz-band channel */
+#define WL_CHAN_RADAR              (1u << 3)     /* radar sensitive channel */
+#define WL_CHAN_INACTIVE           (1u << 4)     /* temporarily inactive due to radar */
+#define WL_CHAN_PASSIVE            (1u << 5)     /* channel is in passive mode */
+#define WL_CHAN_RESTRICTED         (1u << 6)     /* restricted use channel */
+#define WL_CHAN_RADAR_EU_WEATHER   (1u << 7)     /* EU Radar weather channel.
+                                                 * Implies an EU Radar channel.
+                                                 */
+#define WL_CHAN_CLM_RESTRICTED     (1u << 8)     /* channel restricted in CLM (i.e. by default) */
+#define WL_CHAN_BAND_6G            (1u << 9)     /* 6GHz-band channel */
+#define WL_CHAN_OOS_SHIFT          24u           /* shift for OOS field */
+#define WL_CHAN_OOS_MASK           0xFF000000u   /* field specifying minutes remaining for this
+                                                 * channel's out-of-service period due to radar
+                                                 * detection
+                                                 */
+
+/* BTC mode used by "btc_mode" iovar */
+#define        WL_BTC_DISABLE          0       /* disable BT coexistence */
+#define WL_BTC_FULLTDM      1  /* full TDM COEX */
+#define WL_BTC_ENABLE       1  /* full TDM COEX to maintain backward compatiblity */
+#define WL_BTC_PREMPT      2    /* full TDM COEX with preemption */
+#define WL_BTC_LITE        3   /* light weight coex for large isolation platform */
+#define WL_BTC_PARALLEL                4   /* BT and WLAN run in parallel with separate antenna  */
+#define WL_BTC_HYBRID          5   /* hybrid coex, only ack is allowed to transmit in BT slot */
+#define WL_BTC_DEFAULT         8       /* set the default mode for the device */
+#define WL_INF_BTC_DISABLE      0
+#define WL_INF_BTC_ENABLE       1
+#define WL_INF_BTC_AUTO         3
+
+/* BTC wire used by "btc_wire" iovar */
+#define        WL_BTC_DEFWIRE          0       /* use default wire setting */
+#define WL_BTC_2WIRE           2       /* use 2-wire BTC */
+#define WL_BTC_3WIRE           3       /* use 3-wire BTC */
+#define WL_BTC_4WIRE           4       /* use 4-wire BTC */
+
+/* BTC flags: BTC configuration that can be set by host */
+#define WL_BTC_FLAG_PREMPT               (1 << 0)
+#define WL_BTC_FLAG_BT_DEF               (1 << 1)
+#define WL_BTC_FLAG_ACTIVE_PROT          (1 << 2)
+#define WL_BTC_FLAG_SIM_RSP              (1 << 3)
+#define WL_BTC_FLAG_PS_PROTECT           (1 << 4)
+#define WL_BTC_FLAG_SIM_TX_LP           (1 << 5)
+#define WL_BTC_FLAG_ECI                  (1 << 6)
+#define WL_BTC_FLAG_LIGHT                (1 << 7)
+#define WL_BTC_FLAG_PARALLEL             (1 << 8)
+
+/* maximum channels returned by the get valid channels iovar */
+#define WL_NUMCHANNELS         64
+
+/* This constant is obsolete, not part of ioctl/iovar interface and should never be used
+ * It is preserved only for compatibility with older branches that use it
+ */
+#ifdef WL_BAND6G
+#ifdef WL11AC_80P80
+#define WL_NUMCHANSPECS 446
+#else
+#define WL_NUMCHANSPECS 350
+#endif
+#else
+#if defined(WL11AC_80P80)
+#define WL_NUMCHANSPECS 206
+#elif defined(WL_BW160MHZ)
+#define WL_NUMCHANSPECS 140
+#else
+#define WL_NUMCHANSPECS 110
+#endif
+#endif /* WL_BAND6G */
+
+/* WDS link local endpoint WPA role */
+#define WL_WDS_WPA_ROLE_AUTH   0       /* authenticator */
+#define WL_WDS_WPA_ROLE_SUP    1       /* supplicant */
+#define WL_WDS_WPA_ROLE_AUTO   255     /* auto, based on mac addr value */
+
+/* Base offset values */
+#define WL_PKT_FILTER_BASE_PKT   0
+#define WL_PKT_FILTER_BASE_END   1
+#define WL_PKT_FILTER_BASE_D11_H 2 /* May be removed */
+#define WL_PKT_FILTER_BASE_D11_D 3 /* May be removed */
+#define WL_PKT_FILTER_BASE_ETH_H 4
+#define WL_PKT_FILTER_BASE_ETH_D 5
+#define WL_PKT_FILTER_BASE_ARP_H 6
+#define WL_PKT_FILTER_BASE_ARP_D 7 /* May be removed */
+#define WL_PKT_FILTER_BASE_IP4_H 8
+#define WL_PKT_FILTER_BASE_IP4_D 9
+#define WL_PKT_FILTER_BASE_IP6_H 10
+#define WL_PKT_FILTER_BASE_IP6_D 11
+#define WL_PKT_FILTER_BASE_TCP_H 12
+#define WL_PKT_FILTER_BASE_TCP_D 13 /* May be removed */
+#define WL_PKT_FILTER_BASE_UDP_H 14
+#define WL_PKT_FILTER_BASE_UDP_D 15
+#define WL_PKT_FILTER_BASE_IP6_P 16
+#define WL_PKT_FILTER_BASE_COUNT 17 /* May be removed */
+
+/* String mapping for bases that may be used by applications or debug */
+#define WL_PKT_FILTER_BASE_NAMES \
+       { "START", WL_PKT_FILTER_BASE_PKT },   \
+       { "END",   WL_PKT_FILTER_BASE_END },   \
+       { "ETH_H", WL_PKT_FILTER_BASE_ETH_H }, \
+       { "ETH_D", WL_PKT_FILTER_BASE_ETH_D }, \
+       { "D11_H", WL_PKT_FILTER_BASE_D11_H }, \
+       { "D11_D", WL_PKT_FILTER_BASE_D11_D }, \
+       { "ARP_H", WL_PKT_FILTER_BASE_ARP_H }, \
+       { "IP4_H", WL_PKT_FILTER_BASE_IP4_H }, \
+       { "IP4_D", WL_PKT_FILTER_BASE_IP4_D }, \
+       { "IP6_H", WL_PKT_FILTER_BASE_IP6_H }, \
+       { "IP6_D", WL_PKT_FILTER_BASE_IP6_D }, \
+       { "IP6_P", WL_PKT_FILTER_BASE_IP6_P }, \
+       { "TCP_H", WL_PKT_FILTER_BASE_TCP_H }, \
+       { "TCP_D", WL_PKT_FILTER_BASE_TCP_D }, \
+       { "UDP_H", WL_PKT_FILTER_BASE_UDP_H }, \
+       { "UDP_D", WL_PKT_FILTER_BASE_UDP_D }
+
+/* Flags for a pattern list element */
+#define WL_PKT_FILTER_MFLAG_NEG 0x0001
+
+/*
+ * Packet engine interface
+ */
+
+#define WL_PKTENG_PER_TX_START                 0x01
+#define WL_PKTENG_PER_TX_STOP                  0x02
+#define WL_PKTENG_PER_RX_START                 0x04
+#define WL_PKTENG_PER_RX_WITH_ACK_START                0x05
+#define WL_PKTENG_PER_TX_WITH_ACK_START                0x06
+#define WL_PKTENG_PER_RX_STOP                  0x08
+#define WL_PKTENG_PER_RU_TX_START              0x09
+#define WL_PKTENG_PER_TRIG_TX_START            0x0a
+#define WL_PKTENG_PER_MASK                     0xff
+
+#define WL_PKTENG_SYNCHRONOUS                  0x100   /* synchronous flag */
+#define WL_PKTENG_SYNCHRONOUS_UNBLK            0x200   /* synchronous unblock flag */
+#define WL_PKTENG_COLLECT                      0x400   /* Save last Rx'ed packet */
+#ifdef PKTENG_LONGPKTSZ
+/* max pktsz limit for pkteng */
+#define WL_PKTENG_MAXPKTSZ                             PKTENG_LONGPKTSZ
+#else
+#define WL_PKTENG_MAXPKTSZ                             16384
+#endif
+
+#define NUM_80211b_RATES       4
+#define NUM_80211ag_RATES      8
+#define NUM_80211n_RATES       32
+#define NUM_80211_RATES                (NUM_80211b_RATES+NUM_80211ag_RATES+NUM_80211n_RATES)
+
+/*
+ * WOWL capability/override settings
+ */
+#define WL_WOWL_MAGIC           (1 << 0)    /* Wakeup on Magic packet */
+#define WL_WOWL_NET             (1 << 1)    /* Wakeup on Netpattern */
+#define WL_WOWL_DIS             (1 << 2)    /* Wakeup on loss-of-link due to Disassoc/Deauth */
+#define WL_WOWL_RETR            (1 << 3)    /* Wakeup on retrograde TSF */
+#define WL_WOWL_BCN             (1 << 4)    /* Wakeup on loss of beacon */
+#define WL_WOWL_TST             (1 << 5)    /* Wakeup after test */
+#define WL_WOWL_M1              (1 << 6)    /* Wakeup after PTK refresh */
+#define WL_WOWL_EAPID           (1 << 7)    /* Wakeup after receipt of EAP-Identity Req */
+#define WL_WOWL_PME_GPIO        (1 << 8)    /* Wakeind via PME(0) or GPIO(1) */
+#define WL_WOWL_ULP_BAILOUT     (1 << 8)    /* wakeind via unknown pkt by basic ULP-offloads -
+ * WL_WOWL_ULP_BAILOUT - same as WL_WOWL_PME_GPIO used only for DONGLE BUILDS
+ */
+#define WL_WOWL_NEEDTKIP1       (1 << 9)    /* need tkip phase 1 key to be updated by the driver */
+#define WL_WOWL_GTK_FAILURE     (1 << 10)   /* enable wakeup if GTK fails */
+#define WL_WOWL_EXTMAGPAT       (1 << 11)   /* support extended magic packets */
+#define WL_WOWL_ARPOFFLOAD      (1 << 12)   /* support ARP/NS/keepalive offloading */
+#define WL_WOWL_WPA2            (1 << 13)   /* read protocol version for EAPOL frames */
+#define WL_WOWL_KEYROT          (1 << 14)   /* If the bit is set, use key rotaton */
+#define WL_WOWL_BCAST           (1 << 15)   /* If the bit is set, frm received was bcast frame */
+#define WL_WOWL_SCANOL          (1 << 16)   /* If the bit is set, scan offload is enabled */
+#define WL_WOWL_TCPKEEP_TIME    (1 << 17)   /* Wakeup on tcpkeep alive timeout */
+#define WL_WOWL_MDNS_CONFLICT   (1 << 18)   /* Wakeup on mDNS Conflict Resolution */
+#define WL_WOWL_MDNS_SERVICE    (1 << 19)   /* Wakeup on mDNS Service Connect */
+#define WL_WOWL_TCPKEEP_DATA    (1 << 20)   /* tcp keepalive got data */
+#define WL_WOWL_FW_HALT         (1 << 21)   /* Firmware died in wowl mode */
+#define WL_WOWL_ENAB_HWRADIO    (1 << 22)   /* Enable detection of radio button changes */
+#define WL_WOWL_MIC_FAIL        (1 << 23)   /* Offloads detected MIC failure(s) */
+#define WL_WOWL_UNASSOC         (1 << 24)   /* Wakeup in Unassociated state (Net/Magic Pattern) */
+#define WL_WOWL_SECURE          (1 << 25)   /* Wakeup if received matched secured pattern */
+#define WL_WOWL_EXCESS_WAKE     (1 << 26)   /* Excess wake */
+#define WL_WOWL_LINKDOWN        (1 << 31)   /* Link Down indication in WoWL mode */
+
+#define WL_WOWL_TCPKEEP         (1 << 20)   /* temp copy to satisfy automerger */
+#define MAGIC_PKT_MINLEN 102    /* Magic pkt min length is 6 * 0xFF + 16 * ETHER_ADDR_LEN */
+
+#define WOWL_PATTEN_TYPE_ARP   (1 << 0)        /* ARP offload Pattern */
+#define WOWL_PATTEN_TYPE_NA    (1 << 1)        /* NA offload Pattern */
+
+#define MAGIC_PKT_MINLEN       102    /* Magic pkt min length is 6 * 0xFF + 16 * ETHER_ADDR_LEN */
+#define MAGIC_PKT_NUM_MAC_ADDRS        16
+
+/* Overlap BSS Scan parameters default, minimum, maximum */
+#define WLC_OBSS_SCAN_PASSIVE_DWELL_DEFAULT            20      /* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_DWELL_MIN                        5       /* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_DWELL_MAX                        1000    /* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_DWELL_DEFAULT             10      /* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_DWELL_MIN                 10      /* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_DWELL_MAX                 1000    /* unit TU */
+#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_DEFAULT       300     /* unit Sec */
+#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_MIN           10      /* unit Sec */
+#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_MAX           900     /* unit Sec */
+#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_DEFAULT 5
+#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_MIN     5
+#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_MAX     100
+#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_DEFAULT        200     /* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_MIN    200     /* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_MAX    10000   /* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_DEFAULT 20      /* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_MIN     20      /* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_MAX     10000   /* unit TU */
+#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_DEFAULT       25      /* unit percent */
+#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_MIN           0       /* unit percent */
+#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_MAX           100     /* unit percent */
+
+#define WL_MIN_NUM_OBSS_SCAN_ARG 7     /* minimum number of arguments required for OBSS Scan */
+
+#define WL_COEX_INFO_MASK              0x07
+#define WL_COEX_INFO_REQ               0x01
+#define        WL_COEX_40MHZ_INTOLERANT        0x02
+#define        WL_COEX_WIDTH20                 0x04
+
+#define        WLC_RSSI_INVALID         0      /* invalid RSSI value */
+
+#define MAX_RSSI_LEVELS 8
+
+/* **** EXTLOG **** */
+#define EXTLOG_CUR_VER         0x0100
+
+#define MAX_ARGSTR_LEN         18 /* At least big enough for storing ETHER_ADDR_STR_LEN */
+
+/* log modules (bitmap) */
+#define LOG_MODULE_COMMON      0x0001
+#define LOG_MODULE_ASSOC       0x0002
+#define LOG_MODULE_EVENT       0x0004
+#define LOG_MODULE_MAX         3                       /* Update when adding module */
+
+/* log levels */
+#define WL_LOG_LEVEL_DISABLE   0
+#define WL_LOG_LEVEL_ERR       1
+#define WL_LOG_LEVEL_WARN      2
+#define WL_LOG_LEVEL_INFO      3
+#define WL_LOG_LEVEL_MAX       WL_LOG_LEVEL_INFO       /* Update when adding level */
+
+/* flag */
+#define LOG_FLAG_EVENT         1
+
+/* log arg_type */
+#define LOG_ARGTYPE_NULL       0
+#define LOG_ARGTYPE_STR                1       /* %s */
+#define LOG_ARGTYPE_INT                2       /* %d */
+#define LOG_ARGTYPE_INT_STR    3       /* %d...%s */
+#define LOG_ARGTYPE_STR_INT    4       /* %s...%d */
+
+/* 802.11 Mgmt Packet flags */
+#define VNDR_IE_BEACON_FLAG    0x1
+#define VNDR_IE_PRBRSP_FLAG    0x2
+#define VNDR_IE_ASSOCRSP_FLAG  0x4
+#define VNDR_IE_AUTHRSP_FLAG   0x8
+#define VNDR_IE_PRBREQ_FLAG    0x10
+#define VNDR_IE_ASSOCREQ_FLAG  0x20
+#define VNDR_IE_IWAPID_FLAG    0x40 /* vendor IE in IW advertisement protocol ID field */
+#define VNDR_IE_AUTHREQ_FLAG   0x80
+#define VNDR_IE_CUSTOM_FLAG    0x100 /* allow custom IE id */
+#define VNDR_IE_DISASSOC_FLAG  0x200
+
+#if defined(WLP2P)
+/* P2P Action Frames flags (spec ordered) */
+#define VNDR_IE_GONREQ_FLAG     0x001000
+#define VNDR_IE_GONRSP_FLAG     0x002000
+#define VNDR_IE_GONCFM_FLAG     0x004000
+#define VNDR_IE_INVREQ_FLAG     0x008000
+#define VNDR_IE_INVRSP_FLAG     0x010000
+#define VNDR_IE_DISREQ_FLAG     0x020000
+#define VNDR_IE_DISRSP_FLAG     0x040000
+#define VNDR_IE_PRDREQ_FLAG     0x080000
+#define VNDR_IE_PRDRSP_FLAG     0x100000
+
+#define VNDR_IE_P2PAF_SHIFT    12
+#endif /* WLP2P */
+
+/* channel interference measurement (chanim) related defines */
+
+/* chanim mode */
+#define CHANIM_DISABLE 0       /* disabled */
+#define CHANIM_DETECT  1       /* detection only */
+#define CHANIM_EXT             2       /* external state machine */
+#define CHANIM_ACT             3       /* full internal state machine, detect + act */
+#define CHANIM_MODE_MAX 4
+
+/* define for apcs reason code */
+#define APCS_INIT              0
+#define APCS_IOCTL             1
+#define APCS_CHANIM            2
+#define APCS_CSTIMER           3
+#define APCS_TXDLY             5
+#define APCS_NONACSD           6
+#define APCS_DFS_REENTRY       7
+#define APCS_TXFAIL            8
+#define APCS_MAX               9
+
+/* number of ACS record entries */
+#define CHANIM_ACS_RECORD                      10
+
+/* CHANIM */
+#define CCASTATS_TXDUR  0
+#define CCASTATS_INBSS  1
+#define CCASTATS_OBSS   2
+#define CCASTATS_NOCTG  3
+#define CCASTATS_NOPKT  4
+#define CCASTATS_DOZE   5
+#define CCASTATS_TXOP  6
+#define CCASTATS_GDTXDUR        7
+#define CCASTATS_BDTXDUR        8
+
+/* FIXME: CCASTATS_MAX is 9 for existing chips and 10 for new ones.
+ * This is to avoid rom invalidation of existing chips.
+ */
+#ifndef WLCHANIM_V2
+#define CCASTATS_MAX    9
+#else /* WLCHANIM_V2 */
+#define CCASTATS_MYRX      9
+#define CCASTATS_MAX    10
+#endif /* WLCHANIM_V2 */
+
+#define WL_CHANIM_COUNT_ALL    0xff
+#define WL_CHANIM_COUNT_ONE    0x1
+
+/* Module id: to know which module has sent the stats */
+#define SC_CHANIM_ID_NULL      0u
+#define SC_CHANIM_ID_SCAN      1u      /* Module Id of scan, used to report scqs */
+#define SC_CHANIM_ID_STA       2u      /* Module Id of STA, used tp report scqs */
+
+/* ap tpc modes */
+#define        AP_TPC_OFF              0
+#define        AP_TPC_BSS_PWR          1       /* BSS power control */
+#define AP_TPC_AP_PWR          2       /* AP power control */
+#define        AP_TPC_AP_BSS_PWR       3       /* Both AP and BSS power control */
+#define AP_TPC_MAX_LINK_MARGIN 127
+
+/* ap tpc modes */
+#define        AP_TPC_OFF              0
+#define        AP_TPC_BSS_PWR          1       /* BSS power control */
+#define AP_TPC_AP_PWR          2       /* AP power control */
+#define        AP_TPC_AP_BSS_PWR       3       /* Both AP and BSS power control */
+#define AP_TPC_MAX_LINK_MARGIN 127
+
+/* tpc option bits */
+#define TPC_OPT_NO_11DH_TXPWR  1       /* Do not adopt 11d+11h AP power constraints when
+                                        * autocountry is 0
+                                        */
+
+/* state */
+#define WL_P2P_DISC_ST_SCAN    0
+#define WL_P2P_DISC_ST_LISTEN  1
+#define WL_P2P_DISC_ST_SEARCH  2
+
+/* i/f type */
+#define WL_P2P_IF_CLIENT       0
+#define WL_P2P_IF_GO           1
+#define WL_P2P_IF_DYNBCN_GO    2
+#define WL_P2P_IF_DEV          3
+
+/* p2p GO configuration */
+#define WL_P2P_ENABLE_CONF     1       /* configure */
+#define WL_P2P_DISABLE_CONF    0       /* un-configure */
+
+/* count */
+#define WL_P2P_SCHED_RSVD      0
+#define WL_P2P_SCHED_REPEAT    255     /* anything > 255 will be treated as 255 */
+
+#define WL_P2P_SCHED_FIXED_LEN         3
+
+/* schedule type */
+#define WL_P2P_SCHED_TYPE_ABS          0       /* Scheduled Absence */
+#define WL_P2P_SCHED_TYPE_REQ_ABS      1       /* Requested Absence */
+
+/* at some point we may need bitvec here (combination of actions) */
+/* schedule action during absence periods (for WL_P2P_SCHED_ABS type) */
+#define WL_P2P_SCHED_ACTION_NONE       0       /* no action */
+#define WL_P2P_SCHED_ACTION_DOZE       1       /* doze */
+/* schedule option - WL_P2P_SCHED_TYPE_REQ_ABS */
+#define WL_P2P_SCHED_ACTION_GOOFF      2       /* turn off GO beacon/prbrsp functions */
+/* schedule option - WL_P2P_SCHED_TYPE_XXX */
+#define WL_P2P_SCHED_ACTION_RESET      255     /* reset */
+
+/* at some point we may need bitvec here (combination of options) */
+/* schedule option - WL_P2P_SCHED_TYPE_ABS */
+#define WL_P2P_SCHED_OPTION_NORMAL     0       /* normal start/interval/duration/count */
+#define WL_P2P_SCHED_OPTION_BCNPCT     1       /* percentage of beacon interval */
+/* schedule option - WL_P2P_SCHED_TYPE_REQ_ABS */
+#define WL_P2P_SCHED_OPTION_TSFOFS     2       /* normal start/internal/duration/count with
+                                                * start being an offset of the 'current' TSF
+                                                */
+
+/* feature flags */
+#define WL_P2P_FEAT_GO_CSA     (1 << 0)        /* GO moves with the STA using CSA method */
+#define WL_P2P_FEAT_GO_NOLEGACY        (1 << 1)        /* GO does not probe respond to non-p2p probe
+                                                * requests
+                                                */
+#define WL_P2P_FEAT_RESTRICT_DEV_RESP (1 << 2) /* Restrict p2p dev interface from responding */
+
+/* n-mode support capability */
+/* 2x2 includes both 1x1 & 2x2 devices
+ * reserved #define 2 for future when we want to separate 1x1 & 2x2 and
+ * control it independently
+ */
+#define WL_11N_2x2                     1
+#define WL_11N_3x3                     3
+#define WL_11N_4x4                     4
+
+/* define 11n feature disable flags */
+#define WLFEATURE_DISABLE_11N          0x00000001
+#define WLFEATURE_DISABLE_11N_STBC_TX  0x00000002
+#define WLFEATURE_DISABLE_11N_STBC_RX  0x00000004
+#define WLFEATURE_DISABLE_11N_SGI_TX   0x00000008
+#define WLFEATURE_DISABLE_11N_SGI_RX   0x00000010
+#define WLFEATURE_DISABLE_11N_AMPDU_TX 0x00000020
+#define WLFEATURE_DISABLE_11N_AMPDU_RX 0x00000040
+#define WLFEATURE_DISABLE_11N_GF       0x00000080
+
+/* op code in nat_cfg */
+#define NAT_OP_ENABLE          1       /* enable NAT on given interface */
+#define NAT_OP_DISABLE         2       /* disable NAT on given interface */
+#define NAT_OP_DISABLE_ALL     3       /* disable NAT on all interfaces */
+
+/* NAT state */
+#define NAT_STATE_ENABLED      1       /* NAT is enabled */
+#define NAT_STATE_DISABLED     2       /* NAT is disabled */
+
+#define CHANNEL_5G_LOW_START   36      /* 5G low (36..48) CDD enable/disable bit mask */
+#define CHANNEL_5G_MID_START   52      /* 5G mid (52..64) CDD enable/disable bit mask */
+#define CHANNEL_5G_HIGH_START  100     /* 5G high (100..140) CDD enable/disable bit mask */
+#define CHANNEL_5G_UPPER_START 149     /* 5G upper (149..161) CDD enable/disable bit mask */
+
+/* D0 Coalescing */
+#define IPV4_ARP_FILTER                0x0001
+#define IPV4_NETBT_FILTER      0x0002
+#define IPV4_LLMNR_FILTER      0x0004
+#define IPV4_SSDP_FILTER       0x0008
+#define IPV4_WSD_FILTER                0x0010
+#define IPV6_NETBT_FILTER      0x0200
+#define IPV6_LLMNR_FILTER      0x0400
+#define IPV6_SSDP_FILTER       0x0800
+#define IPV6_WSD_FILTER                0x1000
+
+/* Network Offload Engine */
+#define NWOE_OL_ENABLE         0x00000001
+
+/*
+ * Traffic management structures/defines.
+ */
+
+/* Traffic management bandwidth parameters */
+#define TRF_MGMT_MAX_PRIORITIES                 3
+
+#define TRF_MGMT_FLAG_ADD_DSCP                  0x0001  /* Add DSCP to IP TOS field */
+#define TRF_MGMT_FLAG_DISABLE_SHAPING           0x0002  /* Don't shape traffic */
+#define TRF_MGMT_FLAG_MANAGE_LOCAL_TRAFFIC      0x0008  /* Manage traffic over our local subnet */
+#define TRF_MGMT_FLAG_FILTER_ON_MACADDR         0x0010  /* filter on MAC address */
+#define TRF_MGMT_FLAG_NO_RX                     0x0020  /* do not apply fiters to rx packets */
+
+#define TRF_FILTER_MAC_ADDR              0x0001 /* L2 filter use dst mac address for filtering */
+#define TRF_FILTER_IP_ADDR               0x0002 /* L3 filter use ip ddress for filtering */
+#define TRF_FILTER_L4                    0x0004 /* L4 filter use tcp/udp for filtering */
+#define TRF_FILTER_DWM                   0x0008 /* L3 filter use DSCP for filtering */
+#define TRF_FILTER_FAVORED               0x0010 /* Tag the packet FAVORED */
+
+/* WNM/NPS subfeatures mask */
+#define WL_WNM_BSSTRANS                0x00000001
+#define WL_WNM_PROXYARP                0x00000002
+#define WL_WNM_MAXIDLE         0x00000004
+#define WL_WNM_TIMBC           0x00000008
+#define WL_WNM_TFS             0x00000010
+#define WL_WNM_SLEEP           0x00000020
+#define WL_WNM_DMS             0x00000040
+#define WL_WNM_FMS             0x00000080
+#define WL_WNM_NOTIF           0x00000100
+#define WL_WNM_WBTEXT  0x00000200
+#define WL_WNM_ESTM            0x00000400
+#define WL_WNM_MAX             0x00000800
+#ifdef WLWNM_BRCM
+#define BRCM_WNM_FEATURE_SET\
+                                       (WL_WNM_PROXYARP | \
+                                       WL_WNM_SLEEP | \
+                                       WL_WNM_FMS | \
+                                       WL_WNM_TFS | \
+                                       WL_WNM_TIMBC | \
+                                       WL_WNM_BSSTRANS | \
+                                       WL_WNM_DMS | \
+                                       WL_WNM_NOTIF | \
+                                       0)
+#endif /* WLWNM_BRCM */
+#ifndef ETHER_MAX_DATA
+#define ETHER_MAX_DATA 1500
+#endif /* ETHER_MAX_DATA */
+
+/* Different discovery modes for dpt */
+#define        DPT_DISCOVERY_MANUAL    0x01    /* manual discovery mode */
+#define        DPT_DISCOVERY_AUTO      0x02    /* auto discovery mode */
+#define        DPT_DISCOVERY_SCAN      0x04    /* scan-based discovery mode */
+
+/* different path selection values */
+#define DPT_PATHSEL_AUTO       0       /* auto mode for path selection */
+#define DPT_PATHSEL_DIRECT     1       /* always use direct DPT path */
+#define DPT_PATHSEL_APPATH     2       /* always use AP path */
+
+/* different ops for deny list */
+#define DPT_DENY_LIST_ADD      1       /* add to dpt deny list */
+#define DPT_DENY_LIST_REMOVE   2       /* remove from dpt deny list */
+
+/* different ops for manual end point */
+#define DPT_MANUAL_EP_CREATE   1       /* create manual dpt endpoint */
+#define DPT_MANUAL_EP_MODIFY   2       /* modify manual dpt endpoint */
+#define DPT_MANUAL_EP_DELETE   3       /* delete manual dpt endpoint */
+
+/* flags to indicate DPT status */
+#define        DPT_STATUS_ACTIVE       0x01    /* link active (though may be suspended) */
+#define        DPT_STATUS_AES          0x02    /* link secured through AES encryption */
+#define        DPT_STATUS_FAILED       0x04    /* DPT link failed */
+
+#ifdef WLTDLS
+/* different ops for manual end point */
+#define TDLS_MANUAL_EP_CREATE  1       /* create manual dpt endpoint */
+#define TDLS_MANUAL_EP_MODIFY  2       /* modify manual dpt endpoint */
+#define TDLS_MANUAL_EP_DELETE  3       /* delete manual dpt endpoint */
+#define TDLS_MANUAL_EP_PM              4       /*  put dpt endpoint in PM mode */
+#define TDLS_MANUAL_EP_WAKE            5       /* wake up dpt endpoint from PM */
+#define TDLS_MANUAL_EP_DISCOVERY       6       /* discover if endpoint is TDLS capable */
+#define TDLS_MANUAL_EP_CHSW            7       /* channel switch */
+#define TDLS_MANUAL_EP_WFD_TPQ 8       /* WiFi-Display Tunneled Probe reQuest */
+
+/* modes */
+#define TDLS_WFD_IE_TX                 0
+#define TDLS_WFD_IE_RX                 1
+#define TDLS_WFD_PROBE_IE_TX   2
+#define TDLS_WFD_PROBE_IE_RX   3
+#endif /* WLTDLS */
+
+/* define for flag */
+#define TSPEC_PENDING          0       /* TSPEC pending */
+#define TSPEC_ACCEPTED         1       /* TSPEC accepted */
+#define TSPEC_REJECTED         2       /* TSPEC rejected */
+#define TSPEC_UNKNOWN          3       /* TSPEC unknown */
+#define TSPEC_STATUS_MASK      7       /* TSPEC status mask */
+
+#ifdef BCMCCX // MOG-NO
+/* "wlan_reason" iovar interface */
+#define WL_WLAN_ASSOC_REASON_NORMAL_NETWORK    0 /* normal WLAN network setup */
+#define WL_WLAN_ASSOC_REASON_ROAM_FROM_CELLULAR_NETWORK        1 /* roam from Cellular network */
+#define WL_WLAN_ASSOC_REASON_ROAM_FROM_LAN     2 /* roam from LAN */
+#define WL_WLAN_ASSOC_REASON_MAX               2 /* largest value allowed */
+#endif /* BCMCCX */
+
+/* Software feature flag defines used by wlfeatureflag */
+#ifdef WLAFTERBURNER
+#define WL_SWFL_ABBFL       0x0001 /* Allow Afterburner on systems w/o hardware BFL */
+#define WL_SWFL_ABENCORE    0x0002 /* Allow AB on non-4318E chips */
+#endif /* WLAFTERBURNER */
+#define WL_SWFL_NOHWRADIO      0x0004 /* Disable HW Radio monitor (e.g., Cust Spec) */
+#define WL_SWFL_FLOWCONTROL     0x0008 /* Enable backpressure to OS stack */
+#define WL_SWFL_WLBSSSORT      0x0010 /* Per-port supports sorting of BSS */
+
+#define WL_LIFETIME_MAX 0xFFFF /* Max value in ms */
+
+#define CSA_BROADCAST_ACTION_FRAME     0       /* csa broadcast action frame */
+#define CSA_UNICAST_ACTION_FRAME         1 /* csa unicast action frame */
+
+/* Roaming trigger definitions for WLC_SET_ROAM_TRIGGER.
+ *
+ * (-100 < value < 0)   value is used directly as a roaming trigger in dBm
+ * (0 <= value) value specifies a logical roaming trigger level from
+ *                      the list below
+ *
+ * WLC_GET_ROAM_TRIGGER always returns roaming trigger value in dBm, never
+ * the logical roam trigger value.
+ */
+#define WLC_ROAM_TRIGGER_DEFAULT       0 /* default roaming trigger */
+#define WLC_ROAM_TRIGGER_BANDWIDTH     1 /* optimize for bandwidth roaming trigger */
+#define WLC_ROAM_TRIGGER_DISTANCE      2 /* optimize for distance roaming trigger */
+#define WLC_ROAM_TRIGGER_AUTO          3 /* auto-detect environment */
+#define WLC_ROAM_TRIGGER_MAX_VALUE     3 /* max. valid value */
+
+#define WLC_ROAM_NEVER_ROAM_TRIGGER    (-100) /* Avoid Roaming by setting a large value */
+
+/* Preferred Network Offload (PNO, formerly PFN) defines */
+#define WPA_AUTH_PFN_ANY       0xffffffff      /* for PFN, match only ssid */
+
+#define SORT_CRITERIA_BIT              0
+#define AUTO_NET_SWITCH_BIT            1
+#define ENABLE_BKGRD_SCAN_BIT          2
+#define IMMEDIATE_SCAN_BIT             3
+#define        AUTO_CONNECT_BIT                4
+#define        ENABLE_BD_SCAN_BIT              5
+#define ENABLE_ADAPTSCAN_BIT           6
+#define IMMEDIATE_EVENT_BIT            8
+#define SUPPRESS_SSID_BIT              9
+#define ENABLE_NET_OFFLOAD_BIT         10
+/* report found/lost events for SSID and BSSID networks seperately */
+#define REPORT_SEPERATELY_BIT          11
+#define BESTN_BSSID_ONLY_BIT           12
+
+#define SORT_CRITERIA_MASK             0x0001
+#define AUTO_NET_SWITCH_MASK           0x0002
+#define ENABLE_BKGRD_SCAN_MASK         0x0004
+#define IMMEDIATE_SCAN_MASK            0x0008
+#define        AUTO_CONNECT_MASK               0x0010
+
+#define ENABLE_BD_SCAN_MASK            0x0020
+#define ENABLE_ADAPTSCAN_MASK          0x00c0
+#define IMMEDIATE_EVENT_MASK           0x0100
+#define SUPPRESS_SSID_MASK             0x0200
+#define ENABLE_NET_OFFLOAD_MASK                0x0400
+/* report found/lost events for SSID and BSSID networks seperately */
+#define REPORT_SEPERATELY_MASK         0x0800
+#define BESTN_BSSID_ONLY_MASK          0x1000
+
+#ifdef PFN_SCANRESULT_2
+#define PFN_SCANRESULT_VERSION         2
+#else
+#define PFN_SCANRESULT_VERSION         1
+#endif /* PFN_SCANRESULT_2 */
+#ifndef MAX_PFN_LIST_COUNT
+#define MAX_PFN_LIST_COUNT             16
+#endif /* MAX_PFN_LIST_COUNT */
+
+#define PFN_COMPLETE                   1
+#define PFN_INCOMPLETE                 0
+
+#define DEFAULT_BESTN                  2
+#define DEFAULT_MSCAN                  0
+#define DEFAULT_REPEAT                 10
+#define DEFAULT_EXP                            2
+
+#define PFN_PARTIAL_SCAN_BIT           0
+#define PFN_PARTIAL_SCAN_MASK          1
+
+#define WL_PFN_SUPPRESSFOUND_MASK      0x08
+#define WL_PFN_SUPPRESSLOST_MASK       0x10
+#define WL_PFN_SSID_A_BAND_TRIG                0x20
+#define WL_PFN_SSID_BG_BAND_TRIG       0x40
+#define WL_PFN_SSID_IMPRECISE_MATCH    0x80
+#define WL_PFN_SSID_SAME_NETWORK       0x10000
+#define WL_PFN_SUPPRESS_AGING_MASK     0x20000
+#define WL_PFN_FLUSH_ALL_SSIDS         0x40000
+#define WL_PFN_RSSI_MASK               0xff00
+#define WL_PFN_RSSI_SHIFT              8
+
+#define WL_PFN_REPORT_ALLNET    0
+#define WL_PFN_REPORT_SSIDNET   1
+#define WL_PFN_REPORT_BSSIDNET  2
+
+#define WL_PFN_CFG_FLAGS_PROHIBITED    0x00000001      /* Accept and use prohibited channels */
+#define WL_PFN_CFG_FLAGS_HISTORY_OFF   0x00000002      /* Scan history suppressed */
+
+#define WL_PFN_HIDDEN_BIT              2
+#define PNO_SCAN_MAX_FW                        508*1000        /* max time scan time in msec */
+#define PNO_SCAN_MAX_FW_SEC            PNO_SCAN_MAX_FW/1000 /* max time scan time in SEC */
+#define PNO_SCAN_MIN_FW_SEC            10                      /* min time scan time in SEC */
+#define WL_PFN_HIDDEN_MASK             0x4
+#define MAX_BSSID_PREF_LIST_NUM        32
+
+#ifdef CUSTOM_SSID_WHITELIST_NUM
+#define MAX_SSID_WHITELIST_NUM         CUSTOM_SSID_WHITELIST_NUM
+#else
+#define MAX_SSID_WHITELIST_NUM         4
+#endif /* CUSTOM_SSID_WHITELIST_NUM */
+#ifdef CUSTOM_BSSID_BLACKLIST_NUM
+#define MAX_BSSID_BLACKLIST_NUM                CUSTOM_BSSID_BLACKLIST_NUM
+#else
+#define MAX_BSSID_BLACKLIST_NUM        32
+#endif /* CUSTOM_BSSID_BLACKLIST_NUM */
+
+#ifndef BESTN_MAX
+#define BESTN_MAX                      10
+#endif
+
+#ifndef MSCAN_MAX
+#define MSCAN_MAX                      32
+#endif
+
+/* TCP Checksum Offload error injection for testing */
+#define TOE_ERRTEST_TX_CSUM    0x00000001
+#define TOE_ERRTEST_RX_CSUM    0x00000002
+#define TOE_ERRTEST_RX_CSUM2   0x00000004
+
+/* ARP Offload feature flags for arp_ol iovar */
+#define ARP_OL_AGENT                   0x00000001
+#define ARP_OL_SNOOP                   0x00000002
+#define ARP_OL_HOST_AUTO_REPLY         0x00000004
+#define ARP_OL_PEER_AUTO_REPLY         0x00000008
+#define ARP_OL_UPDATE_HOST_CACHE       0x00000010
+
+/* ARP Offload error injection */
+#define ARP_ERRTEST_REPLY_PEER 0x1
+#define ARP_ERRTEST_REPLY_HOST 0x2
+
+#define ARP_MULTIHOMING_MAX    8       /* Maximum local host IP addresses */
+#if defined(WL_PKT_FLTR_EXT) && !defined(WL_PKT_FLTR_EXT_DISABLED)
+#define ND_MULTIHOMING_MAX 32  /* Maximum local host IP addresses */
+#else
+#define ND_MULTIHOMING_MAX 10  /* Maximum local host IP addresses */
+#endif /* WL_PKT_FLTR_EXT && !WL_PKT_FLTR_EXT_DISABLED */
+#define ND_REQUEST_MAX         5       /* Max set of offload params */
+
+/* AOAC wake event flag */
+#define WAKE_EVENT_NLO_DISCOVERY_BIT           1
+#define WAKE_EVENT_AP_ASSOCIATION_LOST_BIT     2
+#define WAKE_EVENT_GTK_HANDSHAKE_ERROR_BIT 4
+#define WAKE_EVENT_4WAY_HANDSHAKE_REQUEST_BIT 8
+#define WAKE_EVENT_NET_PACKET_BIT 0x10
+
+#define MAX_NUM_WOL_PATTERN    22 /* LOGO requirements min 22 */
+
+/* Packet filter operation mode */
+/* True: 1; False: 0 */
+#define PKT_FILTER_MODE_FORWARD_ON_MATCH               1
+/* Enable and disable pkt_filter as a whole */
+#define PKT_FILTER_MODE_DISABLE                                        2
+/* Cache first matched rx pkt(be queried by host later) */
+#define PKT_FILTER_MODE_PKT_CACHE_ON_MATCH             4
+/* If pkt_filter is enabled and no filter is set, don't forward anything */
+#define PKT_FILTER_MODE_PKT_FORWARD_OFF_DEFAULT 8
+
+#ifdef DONGLEOVERLAYS
+#define OVERLAY_IDX_MASK               0x000000ff
+#define OVERLAY_IDX_SHIFT              0
+#define OVERLAY_FLAGS_MASK             0xffffff00
+#define OVERLAY_FLAGS_SHIFT            8
+/* overlay written to device memory immediately after loading the base image */
+#define OVERLAY_FLAG_POSTLOAD  0x100
+/* defer overlay download until the device responds w/WLC_E_OVL_DOWNLOAD event */
+#define OVERLAY_FLAG_DEFER_DL  0x200
+/* overlay downloaded prior to the host going to sleep */
+#define OVERLAY_FLAG_PRESLEEP  0x400
+#define OVERLAY_DOWNLOAD_CHUNKSIZE     1024
+#endif /* DONGLEOVERLAYS */
+
+/* reuse two number in the sc/rc space */
+#define        SMFS_CODE_MALFORMED 0xFFFE
+#define SMFS_CODE_IGNORED      0xFFFD
+
+/* RFAWARE def */
+#define BCM_ACTION_RFAWARE             0x77
+#define BCM_ACTION_RFAWARE_DCS  0x01
+
+/* DCS reason code define */
+#define BCM_DCS_IOVAR          0x1
+#define BCM_DCS_UNKNOWN                0xFF
+
+#ifdef PROP_TXSTATUS
+/* Bit definitions for tlv iovar */
+/*
+ * enable RSSI signals:
+ * WLFC_CTL_TYPE_RSSI
+ */
+#define WLFC_FLAGS_RSSI_SIGNALS                        0x0001
+
+/* enable (if/mac_open, if/mac_close,, mac_add, mac_del) signals:
+ *
+ * WLFC_CTL_TYPE_MAC_OPEN
+ * WLFC_CTL_TYPE_MAC_CLOSE
+ *
+ * WLFC_CTL_TYPE_INTERFACE_OPEN
+ * WLFC_CTL_TYPE_INTERFACE_CLOSE
+ *
+ * WLFC_CTL_TYPE_MACDESC_ADD
+ * WLFC_CTL_TYPE_MACDESC_DEL
+ *
+ */
+#define WLFC_FLAGS_XONXOFF_SIGNALS             0x0002
+
+/* enable (status, fifo_credit, mac_credit) signals
+ * WLFC_CTL_TYPE_MAC_REQUEST_CREDIT
+ * WLFC_CTL_TYPE_TXSTATUS
+ * WLFC_CTL_TYPE_FIFO_CREDITBACK
+ */
+#define WLFC_FLAGS_CREDIT_STATUS_SIGNALS       0x0004
+
+#define WLFC_FLAGS_HOST_PROPTXSTATUS_ACTIVE    0x0008
+#define WLFC_FLAGS_PSQ_GENERATIONFSM_ENABLE    0x0010
+#define WLFC_FLAGS_PSQ_ZERO_BUFFER_ENABLE      0x0020
+#define WLFC_FLAGS_HOST_RXRERODER_ACTIVE       0x0040
+#define WLFC_FLAGS_PKT_STAMP_SIGNALS           0x0080
+
+#endif /* PROP_TXSTATUS */
+
+#define WL_TIMBC_STATUS_AP_UNKNOWN     255     /* AP status for internal use only */
+
+#define WL_DFRTS_LOGIC_OFF     0       /* Feature is disabled */
+#define WL_DFRTS_LOGIC_OR      1       /* OR all non-zero threshold conditions */
+#define WL_DFRTS_LOGIC_AND     2       /* AND all non-zero threshold conditions */
+
+/* Definitions for Reliable Multicast */
+#define WL_RELMCAST_MAX_CLIENT         32
+#define WL_RELMCAST_FLAG_INBLACKLIST   1
+#define WL_RELMCAST_FLAG_ACTIVEACKER   2
+#define WL_RELMCAST_FLAG_RELMCAST      4
+
+/* structures for proximity detection device role */
+#define WL_PROXD_MODE_DISABLE  0
+#define WL_PROXD_MODE_NEUTRAL  1
+#define WL_PROXD_MODE_INITIATOR        2
+#define WL_PROXD_MODE_TARGET   3
+#define WL_PROXD_RANDOM_WAKEUP 0x8000
+
+#ifdef NET_DETECT
+#define NET_DETECT_MAX_WAKE_DATA_SIZE  2048
+#define NET_DETECT_MAX_PROFILES                16
+#define NET_DETECT_MAX_CHANNELS                50
+#endif /* NET_DETECT */
+
+/* Bit masks for radio disabled status - returned by WL_GET_RADIO */
+#define WL_RADIO_SW_DISABLE            (1<<0)
+#define WL_RADIO_HW_DISABLE            (1<<1)
+#define WL_RADIO_MPC_DISABLE           (1<<2)
+#define WL_RADIO_COUNTRY_DISABLE       (1<<3)  /* some countries don't support any channel */
+#define WL_RADIO_PERCORE_DISABLE       (1<<4)  /* Radio diable per core for DVT */
+#define WL_RADIO_TSYNC_PWRSAVE_DISABLE  (1<<5)  /* Disable Radio in tsync mode for power saving */
+
+#define        WL_SPURAVOID_OFF        0
+#define        WL_SPURAVOID_ON1        1
+#define        WL_SPURAVOID_ON2        2
+
+#define WL_4335_SPURAVOID_ON1  1
+#define WL_4335_SPURAVOID_ON2  2
+#define WL_4335_SPURAVOID_ON3  3
+#define WL_4335_SPURAVOID_ON4  4
+#define WL_4335_SPURAVOID_ON5  5
+#define WL_4335_SPURAVOID_ON6  6
+#define WL_4335_SPURAVOID_ON7  7
+#define WL_4335_SPURAVOID_ON8  8
+#define WL_4335_SPURAVOID_ON9  9
+
+/* Override bit for WLC_SET_TXPWR.  if set, ignore other level limits */
+#define WL_TXPWR_OVERRIDE      (1U<<31)
+#define WL_TXPWR_2G            (1U<<30)
+#define WL_TXPWR_5G            (1U<<29)
+#define WL_TXPWR_NEG   (1U<<28)
+
+#define WL_TXPWR_MASK          (~(0x7<<29))
+#define WL_TXPWR_CORE_MAX      (3)
+#define WL_TXPWR_CORE0_MASK    (0x000000FF)
+#define WL_TXPWR_CORE0_SHIFT   (0)
+#define WL_TXPWR_CORE1_MASK    (0x0000FF00)
+#define WL_TXPWR_CORE1_SHIFT   (8)
+#define WL_TXPWR_CORE2_MASK    (0x00FF0000)
+#define WL_TXPWR_CORE2_SHIFT   (16)
+
+/* phy types (returned by WLC_GET_PHYTPE) */
+#define        WLC_PHY_TYPE_A          0
+#define        WLC_PHY_TYPE_B          1
+#define        WLC_PHY_TYPE_G          2
+#define        WLC_PHY_TYPE_N          4
+#define        WLC_PHY_TYPE_LP         5
+#define        WLC_PHY_TYPE_SSN        6
+#define        WLC_PHY_TYPE_HT         7
+#define        WLC_PHY_TYPE_LCN        8
+#define        WLC_PHY_TYPE_LCN40      10
+#define WLC_PHY_TYPE_AC                11
+#define        WLC_PHY_TYPE_LCN20      12
+#define        WLC_PHY_TYPE_NULL       0xf
+
+/* Values for PM */
+#define PM_OFF 0
+#define PM_MAX 1
+#define PM_FAST 2
+#define PM_FORCE_OFF 3         /* use this bit to force PM off even bt is active */
+
+#define WL_WME_CNT_VERSION     1       /* current version of wl_wme_cnt_t */
+
+/* fbt_cap: FBT assoc / reassoc modes. */
+#define WLC_FBT_CAP_DRV_4WAY_AND_REASSOC  1 /* Driver 4-way handshake & reassoc (WLFBT). */
+
+/* monitor_promisc_level bits */
+#define WL_MONPROMISC_PROMISC 0x0001
+#define WL_MONPROMISC_CTRL 0x0002
+#define WL_MONPROMISC_FCS 0x0004
+
+/* TCP Checksum Offload defines */
+#define TOE_TX_CSUM_OL         0x00000001
+#define TOE_RX_CSUM_OL         0x00000002
+
+/* Wi-Fi Display Services (WFDS) */
+#define WL_P2P_SOCIAL_CHANNELS_MAX  WL_NUMCHANNELS
+#define MAX_WFDS_SEEK_SVC 4    /* Max # of wfds services to seek */
+#define MAX_WFDS_ADVERT_SVC 4  /* Max # of wfds services to advertise */
+#define MAX_WFDS_SVC_NAME_LEN 200      /* maximum service_name length */
+#define MAX_WFDS_ADV_SVC_INFO_LEN 65000        /* maximum adv service_info length */
+#define P2P_WFDS_HASH_LEN 6            /* Length of a WFDS service hash */
+#define MAX_WFDS_SEEK_SVC_INFO_LEN 255 /* maximum seek service_info req length */
+#define MAX_WFDS_SEEK_SVC_NAME_LEN 200 /* maximum service_name length */
+
+/* ap_isolate bitmaps */
+#define AP_ISOLATE_DISABLED            0x0
+#define AP_ISOLATE_SENDUP_ALL          0x01
+#define AP_ISOLATE_SENDUP_MCAST                0x02
+
+/* Type values for the wl_pwrstats_t data field */
+#define WL_PWRSTATS_TYPE_PHY           0 /**< struct wl_pwr_phy_stats */
+#define WL_PWRSTATS_TYPE_SCAN          1 /**< struct wl_pwr_scan_stats */
+#define WL_PWRSTATS_TYPE_USB_HSIC      2 /**< struct wl_pwr_usb_hsic_stats */
+#define WL_PWRSTATS_TYPE_PM_AWAKE1     3 /**< struct wl_pwr_pm_awake_stats_v1 */
+#define WL_PWRSTATS_TYPE_CONNECTION    4 /* struct wl_pwr_connect_stats; assoc and key-exch time */
+
+#define WL_PWRSTATS_TYPE_PCIE          6 /**< struct wl_pwr_pcie_stats */
+#define WL_PWRSTATS_TYPE_PM_AWAKE2     7 /**< struct wl_pwr_pm_awake_stats_v2 */
+#define WL_PWRSTATS_TYPE_SDIO          8 /* struct wl_pwr_sdio_stats */
+#define WL_PWRSTATS_TYPE_MIMO_PS_METRICS 9 /* struct wl_mimo_meas_metrics_t */
+#define WL_PWRSTATS_TYPE_SLICE_INDEX   10 /* slice index for which this report is meant for */
+#define WL_PWRSTATS_TYPE_TSYNC         11 /**< struct wl_pwr_tsync_stats */
+#define        WL_PWRSTATS_TYPE_OPS_STATS      12 /* struct wl_pwr_ops_stats_t */
+#define WL_PWRSTATS_TYPE_BCNTRIM_STATS 13 /* struct wl_pwr_bcntrim_stats_t */
+#define WL_PWRSTATS_TYPE_SLICE_INDEX_BAND_INFO 14 /* wl_pwr_slice_index_band_t */
+#define WL_PWRSTATS_TYPE_PSBW_STATS    15 /* struct wl_pwr_psbw_stats_t */
+
+/* IOV AWD DATA */
+#define AWD_DATA_JOIN_INFO     0
+#define AWD_DATA_VERSION_V1    1
+
+/* IOV ETD DATA */
+#define ETD_DATA_JOIN_INFO     0
+#define ETD_DATA_VERSION_V1    1
+
+/* CTMODE DBG */
+/* input param: [31:16] => MPDU_THRESHOLD
+ *             [15:03] => RESERVED
+ *             [02]    => enable UFP
+ *             [01]    => enable UFC
+ *             [00]    => enalbe CTMODE
+ */
+#define        CTMODE_DBG_CTMODE_EN    (0x1u)
+#define        CTMODE_DBG_UFC_EN       (0x2u)
+#define CTMODE_DBG_UFP_EN      (0x4u)
+#define        CTMODE_DBG_MPDU_THRESHOLD_SHIFT (7u)
+#define CTMODE_DBG_MPDU_THRESHOLD_MASK ((0x1FFu) << CTMODE_DBG_MPDU_THRESHOLD_SHIFT)
+#define        CTMODE_DBG_BYTES_THRESHOLD_SHIFT        (16u)
+#define CTMODE_DBG_BYTES_THRESHOLD_MASK        ((0xFFFu) << CTMODE_DBG_BYTES_THRESHOLD_SHIFT)
+
+/* ====== SC use case configs ========= */
+/* SC user/use case request */
+#define WL_SC_REQ_SCAN 0u      /* user scan */
+#define WL_SC_REQ_CNX  1u      /* associated idle */
+#define WL_SC_REQ_NAN  2u      /* NAN synchronization and discovery offload */
+
+/* === Per use case configuration === */
+/* scan cfgs */
+#define SC_SCAN_CFG_PASSIVE_MASK       0x01u   /* Enable passive scan on sc */
+#define SC_SCAN_CFG_PASSIVE_SHIFT      0u
+#define SC_SCAN_CFG_LP_SCAN_MASK       0x02u   /* Enable low prio scan on sc */
+#define SC_SCAN_CFG_LP_SCAN_SHIFT      1u
+#define SC_SCAN_CFG_REG_SCAN_MASK      0x04u   /* Enable split scan using sc */
+#define SC_SCAN_CFG_REG_SCAN_SHIFT     2u
+#define SC_SCAN_CFG_FULL_SCAN_MASK     0x08u   /* Enable full scan on sc */
+#define SC_SCAN_CFG_FULL_SCAN_SHIFT    3u
+/* Add get and set macros for each of the configs? */
+
+/* === Place holder for cnx and nan cfgs === */
+#endif /* wlioctl_defs_h */
diff --git a/bcmdhd.101.10.240.x/include/wlioctl_utils.h b/bcmdhd.101.10.240.x/include/wlioctl_utils.h
new file mode 100644 (file)
index 0000000..b419d17
--- /dev/null
@@ -0,0 +1,60 @@
+/*
+ * Custom OID/ioctl related helper functions.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _wlioctl_utils_h_
+#define _wlioctl_utils_h_
+
+#include <wlioctl.h>
+
+#ifndef BCMDRIVER
+#define CCA_THRESH_MILLI       14
+#define CCA_THRESH_INTERFERE   6
+
+extern cca_congest_channel_req_t * cca_per_chan_summary(cca_congest_channel_req_t *input,
+       cca_congest_channel_req_t *avg, bool percent);
+
+extern int cca_analyze(cca_congest_channel_req_t *input[], int num_chans,
+       uint flags, chanspec_t *answer);
+#endif /* BCMDRIVER */
+
+extern int wl_cntbuf_to_xtlv_format(void *ctx, void *cntbuf,
+       int buflen, uint32 corerev);
+
+extern const char * wl_get_reinit_rc_name(int rc);
+
+/* Get data pointer of wlc layer counters tuple from xtlv formatted counters IOVar buffer. */
+#define GET_WLCCNT_FROM_CNTBUF(cntbuf) (const wl_cnt_wlc_t*) \
+               bcm_get_data_from_xtlv_buf(((const wl_cnt_info_t *)cntbuf)->data,       \
+               ((const wl_cnt_info_t *)cntbuf)->datalen, WL_CNT_XTLV_WLC,              \
+               NULL, BCM_XTLV_OPTION_ALIGN32)
+
+/* We keep adding new counters, so give warning in case we exceed the ioctl buf len
+ * and need to move on to larger ioctl length in the future.
+ */
+#define CHK_CNTBUF_DATALEN(cntbuf, ioctl_buflen) do {                                  \
+       if (((wl_cnt_info_t *)cntbuf)->datalen +                        \
+               OFFSETOF(wl_cnt_info_t, data) > ioctl_buflen)   \
+               printf("IOVAR buffer short!\n");        \
+} while (0)
+
+#endif /* _wlioctl_utils_h_ */
diff --git a/bcmdhd.101.10.240.x/include/wpa.h b/bcmdhd.101.10.240.x/include/wpa.h
new file mode 100644 (file)
index 0000000..9104c8e
--- /dev/null
@@ -0,0 +1,305 @@
+/*
+ * Fundamental types and constants relating to WPA
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _proto_wpa_h_
+#define _proto_wpa_h_
+
+#include <typedefs.h>
+#include <ethernet.h>
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* Reason Codes */
+
+/* 13 through 23 taken from IEEE Std 802.11i-2004 */
+#define DOT11_RC_INVALID_WPA_IE                13      /* Invalid info. element */
+#define DOT11_RC_MIC_FAILURE           14      /* Michael failure */
+#define DOT11_RC_4WH_TIMEOUT           15      /* 4-way handshake timeout */
+#define DOT11_RC_GTK_UPDATE_TIMEOUT    16      /* Group key update timeout */
+#define DOT11_RC_WPA_IE_MISMATCH       17      /* WPA IE in 4-way handshake differs from
+                                                * (re-)assoc. request/probe response
+                                                */
+#define DOT11_RC_INVALID_MC_CIPHER     18      /* Invalid multicast cipher */
+#define DOT11_RC_INVALID_UC_CIPHER     19      /* Invalid unicast cipher */
+#define DOT11_RC_INVALID_AKMP          20      /* Invalid authenticated key management protocol */
+#define DOT11_RC_BAD_WPA_VERSION       21      /* Unsupported WPA version */
+#define DOT11_RC_INVALID_WPA_CAP       22      /* Invalid WPA IE capabilities */
+#define DOT11_RC_8021X_AUTH_FAIL       23      /* 802.1X authentication failure */
+
+#define WPA2_PMKID_LEN 16
+
+/* WPA IE fixed portion */
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+       uint8 tag;      /* TAG */
+       uint8 length;   /* TAG length */
+       uint8 oui[3];   /* IE OUI */
+       uint8 oui_type; /* OUI type */
+       BWL_PRE_PACKED_STRUCT struct {
+               uint8 low;
+               uint8 high;
+       } BWL_POST_PACKED_STRUCT version;       /* IE version */
+} BWL_POST_PACKED_STRUCT wpa_ie_fixed_t;
+#define WPA_IE_OUITYPE_LEN     4
+#define WPA_IE_FIXED_LEN       8
+#define WPA_IE_TAG_FIXED_LEN   6
+
+#define BIP_OUI_TYPE WPA2_OUI "\x06"
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint8 tag;      /* TAG */
+       uint8 length;   /* TAG length */
+       BWL_PRE_PACKED_STRUCT struct {
+               uint8 low;
+               uint8 high;
+       } BWL_POST_PACKED_STRUCT version;       /* IE version */
+} BWL_POST_PACKED_STRUCT wpa_rsn_ie_fixed_t;
+#define WPA_RSN_IE_FIXED_LEN   4
+#define WPA_RSN_IE_TAG_FIXED_LEN       2
+typedef uint8 wpa_pmkid_t[WPA2_PMKID_LEN];
+
+#define WFA_OSEN_IE_FIXED_LEN  6
+
+/* WPA suite/multicast suite */
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+       uint8 oui[3];
+       uint8 type;
+} BWL_POST_PACKED_STRUCT wpa_suite_t, wpa_suite_mcast_t;
+#define WPA_SUITE_LEN  4
+
+/* WPA unicast suite list/key management suite list */
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+       BWL_PRE_PACKED_STRUCT struct {
+               uint8 low;
+               uint8 high;
+       } BWL_POST_PACKED_STRUCT count;
+       wpa_suite_t list[1];
+} BWL_POST_PACKED_STRUCT wpa_suite_ucast_t, wpa_suite_auth_key_mgmt_t;
+#define WPA_IE_SUITE_COUNT_LEN 2
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+       BWL_PRE_PACKED_STRUCT struct {
+               uint8 low;
+               uint8 high;
+       } BWL_POST_PACKED_STRUCT count;
+       wpa_pmkid_t list[1];
+} BWL_POST_PACKED_STRUCT wpa_pmkid_list_t;
+
+/* WPA cipher suites */
+#define WPA_CIPHER_NONE                0       /* None */
+#define WPA_CIPHER_WEP_40      1       /* WEP (40-bit) */
+#define WPA_CIPHER_TKIP                2       /* TKIP: default for WPA */
+#define WPA_CIPHER_AES_OCB     3       /* AES (OCB) */
+#define WPA_CIPHER_AES_CCM     4       /* AES (CCM) */
+#define WPA_CIPHER_WEP_104     5       /* WEP (104-bit) */
+#define WPA_CIPHER_BIP         6       /* WEP (104-bit) */
+#define WPA_CIPHER_TPK         7       /* Group addressed traffic not allowed */
+#ifdef BCMCCX // MOG-NO
+#define WPA_CIPHER_CKIP                8       /* KP with no MIC */
+#define WPA_CIPHER_CKIP_MMH    9       /* KP with MIC ("CKIP/MMH", "CKIP+CMIC") */
+#define WPA_CIPHER_WEP_MMH     10      /* MIC with no KP ("WEP/MMH", "CMIC") */
+
+#define IS_CCX_CIPHER(cipher)  ((cipher) == WPA_CIPHER_CKIP || \
+                                (cipher) == WPA_CIPHER_CKIP_MMH || \
+                                (cipher) == WPA_CIPHER_WEP_MMH)
+#endif /* BCMCCX */
+
+#define WPA_CIPHER_AES_GCM     8       /* AES (GCM) */
+#define WPA_CIPHER_AES_GCM256  9       /* AES (GCM256) */
+#define WPA_CIPHER_CCMP_256    10      /* CCMP-256 */
+#define WPA_CIPHER_BIP_GMAC_128        11      /* BIP_GMAC_128 */
+#define WPA_CIPHER_BIP_GMAC_256 12     /* BIP_GMAC_256 */
+#define WPA_CIPHER_BIP_CMAC_256 13     /* BIP_CMAC_256 */
+
+#ifdef BCMWAPI_WAI
+#define WAPI_CIPHER_NONE       WPA_CIPHER_NONE
+#define WAPI_CIPHER_SMS4       11
+
+#define WAPI_CSE_WPI_SMS4      1
+#endif /* BCMWAPI_WAI */
+
+#define IS_WPA_CIPHER(cipher)  ((cipher) == WPA_CIPHER_NONE || \
+                                (cipher) == WPA_CIPHER_WEP_40 || \
+                                (cipher) == WPA_CIPHER_WEP_104 || \
+                                (cipher) == WPA_CIPHER_TKIP || \
+                                (cipher) == WPA_CIPHER_AES_OCB || \
+                                (cipher) == WPA_CIPHER_AES_CCM || \
+                                (cipher) == WPA_CIPHER_AES_GCM || \
+                                (cipher) == WPA_CIPHER_AES_GCM256 || \
+                                (cipher) == WPA_CIPHER_CCMP_256 || \
+                                (cipher) == WPA_CIPHER_TPK)
+
+#define IS_WPA_BIP_CIPHER(cipher)  ((cipher) == WPA_CIPHER_BIP || \
+                                   (cipher) == WPA_CIPHER_BIP_GMAC_128 || \
+                                   (cipher) == WPA_CIPHER_BIP_GMAC_256 || \
+                                   (cipher) == WPA_CIPHER_BIP_CMAC_256)
+
+#ifdef BCMWAPI_WAI
+#define IS_WAPI_CIPHER(cipher) ((cipher) == WAPI_CIPHER_NONE || \
+                                (cipher) == WAPI_CSE_WPI_SMS4)
+
+/* convert WAPI_CSE_WPI_XXX to WAPI_CIPHER_XXX */
+#define WAPI_CSE_WPI_2_CIPHER(cse) ((cse) == WAPI_CSE_WPI_SMS4 ? \
+                               WAPI_CIPHER_SMS4 : WAPI_CIPHER_NONE)
+
+#define WAPI_CIPHER_2_CSE_WPI(cipher) ((cipher) == WAPI_CIPHER_SMS4 ? \
+                               WAPI_CSE_WPI_SMS4 : WAPI_CIPHER_NONE)
+#endif /* BCMWAPI_WAI */
+
+#define IS_VALID_AKM(akm) ((akm) == RSN_AKM_NONE || \
+                       (akm) == RSN_AKM_UNSPECIFIED || \
+                       (akm) == RSN_AKM_PSK || \
+                       (akm) == RSN_AKM_FBT_1X || \
+                       (akm) == RSN_AKM_FBT_PSK || \
+                       (akm) == RSN_AKM_MFP_1X || \
+                       (akm) == RSN_AKM_MFP_PSK || \
+                       (akm) == RSN_AKM_SHA256_1X || \
+                       (akm) == RSN_AKM_SHA256_PSK || \
+                       (akm) == RSN_AKM_TPK || \
+                       (akm) == RSN_AKM_SAE_PSK || \
+                       (akm) == RSN_AKM_SAE_FBT || \
+                       (akm) == RSN_AKM_FILS_SHA256 || \
+                       (akm) == RSN_AKM_FILS_SHA384 || \
+                       (akm) == RSN_AKM_OWE || \
+                       (akm) == RSN_AKM_SUITEB_SHA256_1X || \
+                       (akm) == RSN_AKM_SUITEB_SHA384_1X)
+
+#define IS_VALID_BIP_CIPHER(cipher) ((cipher) == WPA_CIPHER_BIP || \
+                                       (cipher) == WPA_CIPHER_BIP_GMAC_128 || \
+                                       (cipher) == WPA_CIPHER_BIP_GMAC_256 || \
+                                       (cipher) == WPA_CIPHER_BIP_CMAC_256)
+
+#define WPA_IS_FT_AKM(akm)     ((akm) == RSN_AKM_FBT_SHA256 || \
+                       (akm) == RSN_AKM_FBT_SHA384)
+
+#define WPA_IS_FILS_AKM(akm)   ((akm) == RSN_AKM_FILS_SHA256 || \
+                       (akm) == RSN_AKM_FILS_SHA384)
+
+#define WPA_IS_FILS_FT_AKM(akm)        ((akm) == RSN_AKM_FBT_SHA256_FILS || \
+                       (akm) == RSN_AKM_FBT_SHA384_FILS)
+
+/* WPA TKIP countermeasures parameters */
+#define WPA_TKIP_CM_DETECT     60      /* multiple MIC failure window (seconds) */
+#define WPA_TKIP_CM_BLOCK      60      /* countermeasures active window (seconds) */
+
+/* RSN IE defines */
+#define RSN_CAP_LEN            2       /* Length of RSN capabilities field (2 octets) */
+
+/* RSN Capabilities defined in 802.11i */
+#define RSN_CAP_PREAUTH                        0x0001
+#define RSN_CAP_NOPAIRWISE             0x0002
+#define RSN_CAP_PTK_REPLAY_CNTR_MASK   0x000C
+#define RSN_CAP_PTK_REPLAY_CNTR_SHIFT  2
+#define RSN_CAP_GTK_REPLAY_CNTR_MASK   0x0030
+#define RSN_CAP_GTK_REPLAY_CNTR_SHIFT  4
+#define RSN_CAP_1_REPLAY_CNTR          0
+#define RSN_CAP_2_REPLAY_CNTRS         1
+#define RSN_CAP_4_REPLAY_CNTRS         2
+#define RSN_CAP_16_REPLAY_CNTRS                3
+#define RSN_CAP_MFPR                   0x0040
+#define RSN_CAP_MFPC                   0x0080
+#define RSN_CAP_SPPC                   0x0400
+#define RSN_CAP_SPPR                   0x0800
+
+/* WPA capabilities defined in 802.11i */
+#define WPA_CAP_4_REPLAY_CNTRS         RSN_CAP_4_REPLAY_CNTRS
+#define WPA_CAP_16_REPLAY_CNTRS                RSN_CAP_16_REPLAY_CNTRS
+#define WPA_CAP_REPLAY_CNTR_SHIFT      RSN_CAP_PTK_REPLAY_CNTR_SHIFT
+#define WPA_CAP_REPLAY_CNTR_MASK       RSN_CAP_PTK_REPLAY_CNTR_MASK
+
+/* WPA capabilities defined in 802.11zD9.0 */
+#define WPA_CAP_PEER_KEY_ENABLE                (0x1 << 1)      /* bit 9 */
+
+/* WPA Specific defines */
+#define WPA_CAP_LEN    RSN_CAP_LEN     /* Length of RSN capabilities in RSN IE (2 octets) */
+#define WPA_PMKID_CNT_LEN      2       /* Length of RSN PMKID count (2 octests) */
+
+#define        WPA_CAP_WPA2_PREAUTH            RSN_CAP_PREAUTH
+
+#define WPA2_PMKID_COUNT_LEN   2
+
+/* RSN dev type in rsn_info struct */
+typedef enum {
+       DEV_NONE = 0,
+       DEV_STA = 1,
+       DEV_AP = 2
+} device_type_t;
+
+typedef uint32 rsn_akm_mask_t;                 /* RSN_AKM_... see 802.11.h */
+typedef uint8  rsn_cipher_t;                   /* WPA_CIPHER_xxx */
+typedef uint32 rsn_ciphers_t;                  /* mask of rsn_cipher_t */
+typedef uint8 rsn_akm_t;
+typedef uint8 auth_ie_type_mask_t;
+
+/* Old location for this structure. Moved to bcmwpa.h */
+#ifndef RSN_IE_INFO_STRUCT_RELOCATED
+typedef struct rsn_ie_info {
+       uint8 version;
+       rsn_cipher_t g_cipher;
+       uint8 p_count;
+       uint8 akm_count;
+       uint8 pmkid_count;
+       rsn_akm_t sta_akm;                      /* single STA akm */
+       uint16 caps;
+       rsn_ciphers_t p_ciphers;
+       rsn_akm_mask_t akms;
+       uint8 pmkids_offset;                    /* offset into the IE */
+       rsn_cipher_t g_mgmt_cipher;
+       device_type_t dev_type;                 /* AP or STA */
+       rsn_cipher_t sta_cipher;                /* single STA cipher */
+       uint16 key_desc;                        /* key descriptor version as STA */
+       int parse_status;
+       uint16 mic_len;                         /* unused. keep for ROM compatibility. */
+       auth_ie_type_mask_t auth_ie_type;       /* bit field of WPA, WPA2 and (not yet) CCX WAPI */
+       uint8 pmk_len;                          /* EAPOL PMK */
+       uint8 kck_mic_len;                      /* EAPOL MIC (by KCK) */
+       uint8 kck_len;                          /* EAPOL KCK */
+       uint8 kek_len;                          /* EAPOL KEK */
+       uint8 tk_len;                           /* EAPOL TK */
+       uint8 ptk_len;                          /* EAPOL PTK */
+       uint8 kck2_len;                         /* EAPOL KCK2 */
+       uint8 kek2_len;                         /* EAPOL KEK2 */
+} rsn_ie_info_t;
+#endif /* RSN_IE_INFO_STRUCT_RELOCATED */
+
+#ifdef BCMWAPI_WAI
+#define WAPI_CAP_PREAUTH               RSN_CAP_PREAUTH
+
+/* Other WAI definition */
+#define WAPI_WAI_REQUEST               0x00F1
+#define WAPI_UNICAST_REKEY             0x00F2
+#define WAPI_STA_AGING                 0x00F3
+#define WAPI_MUTIL_REKEY               0x00F4
+#define WAPI_STA_STATS                 0x00F5
+
+#define WAPI_USK_REKEY_COUNT           0x4000000 /* 0xA00000 */
+#define WAPI_MSK_REKEY_COUNT           0x4000000 /* 0xA00000 */
+#endif /* BCMWAPI_WAI */
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _proto_wpa_h_ */
diff --git a/bcmdhd.101.10.240.x/linux_osl.c b/bcmdhd.101.10.240.x/linux_osl.c
new file mode 100644 (file)
index 0000000..8e1ce7d
--- /dev/null
@@ -0,0 +1,1447 @@
+/*
+ * Linux OS Independent Layer
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#define LINUX_PORT
+
+#include <typedefs.h>
+#include <bcmendian.h>
+#include <linuxver.h>
+#include <bcmdefs.h>
+
+#if defined(__ARM_ARCH_7A__) && !defined(DHD_USE_COHERENT_MEM_FOR_RING)
+#include <asm/cacheflush.h>
+#endif /* __ARM_ARCH_7A__ && !DHD_USE_COHERENT_MEM_FOR_RING */
+
+#include <linux/random.h>
+
+#include <osl.h>
+#include <bcmutils.h>
+#include <linux/delay.h>
+#include <linux/vmalloc.h>
+#include <pcicfg.h>
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(4, 8, 0))
+#include <asm-generic/pci-dma-compat.h>
+#endif
+
+#include <linux/fs.h>
+
+#ifdef BCM_OBJECT_TRACE
+#include <bcmutils.h>
+#endif /* BCM_OBJECT_TRACE */
+#include "linux_osl_priv.h"
+
+#define PCI_CFG_RETRY          10      /* PR15065: retry count for pci cfg accesses */
+
+#define DUMPBUFSZ 1024
+
+#ifdef CUSTOMER_HW4_DEBUG
+uint32 g_assert_type = 1; /* By Default not cause Kernel Panic */
+#else
+uint32 g_assert_type = 0; /* By Default Kernel Panic */
+#endif /* CUSTOMER_HW4_DEBUG */
+
+module_param(g_assert_type, int, 0);
+
+#ifdef USE_DMA_LOCK
+static void osl_dma_lock(osl_t *osh);
+static void osl_dma_unlock(osl_t *osh);
+static void osl_dma_lock_init(osl_t *osh);
+
+#define DMA_LOCK(osh)          osl_dma_lock(osh)
+#define DMA_UNLOCK(osh)                osl_dma_unlock(osh)
+#define DMA_LOCK_INIT(osh)     osl_dma_lock_init(osh);
+#else
+#define DMA_LOCK(osh)          do { /* noop */ } while(0)
+#define DMA_UNLOCK(osh)                do { /* noop */ } while(0)
+#define DMA_LOCK_INIT(osh)     do { /* noop */ } while(0)
+#endif /* USE_DMA_LOCK */
+
+static int16 linuxbcmerrormap[] =
+{      0,                              /* 0 */
+       -EINVAL,                /* BCME_ERROR */
+       -EINVAL,                /* BCME_BADARG */
+       -EINVAL,                /* BCME_BADOPTION */
+       -EINVAL,                /* BCME_NOTUP */
+       -EINVAL,                /* BCME_NOTDOWN */
+       -EINVAL,                /* BCME_NOTAP */
+       -EINVAL,                /* BCME_NOTSTA */
+       -EINVAL,                /* BCME_BADKEYIDX */
+       -EINVAL,                /* BCME_RADIOOFF */
+       -EINVAL,                /* BCME_NOTBANDLOCKED */
+       -EINVAL,                /* BCME_NOCLK */
+       -EINVAL,                /* BCME_BADRATESET */
+       -EINVAL,                /* BCME_BADBAND */
+       -E2BIG,                 /* BCME_BUFTOOSHORT */
+       -E2BIG,                 /* BCME_BUFTOOLONG */
+       -EBUSY,                 /* BCME_BUSY */
+       -EINVAL,                /* BCME_NOTASSOCIATED */
+       -EINVAL,                /* BCME_BADSSIDLEN */
+       -EINVAL,                /* BCME_OUTOFRANGECHAN */
+       -EINVAL,                /* BCME_BADCHAN */
+       -EFAULT,                /* BCME_BADADDR */
+       -ENOMEM,                /* BCME_NORESOURCE */
+       -EOPNOTSUPP,            /* BCME_UNSUPPORTED */
+       -EMSGSIZE,              /* BCME_BADLENGTH */
+       -EINVAL,                /* BCME_NOTREADY */
+       -EPERM,                 /* BCME_EPERM */
+       -ENOMEM,                /* BCME_NOMEM */
+       -EINVAL,                /* BCME_ASSOCIATED */
+       -ERANGE,                /* BCME_RANGE */
+       -EINVAL,                /* BCME_NOTFOUND */
+       -EINVAL,                /* BCME_WME_NOT_ENABLED */
+       -EINVAL,                /* BCME_TSPEC_NOTFOUND */
+       -EINVAL,                /* BCME_ACM_NOTSUPPORTED */
+       -EINVAL,                /* BCME_NOT_WME_ASSOCIATION */
+       -EIO,                   /* BCME_SDIO_ERROR */
+       -ENODEV,                /* BCME_DONGLE_DOWN */
+       -EINVAL,                /* BCME_VERSION */
+       -EIO,                   /* BCME_TXFAIL */
+       -EIO,                   /* BCME_RXFAIL */
+       -ENODEV,                /* BCME_NODEVICE */
+       -EINVAL,                /* BCME_NMODE_DISABLED */
+       -ENODATA,               /* BCME_NONRESIDENT */
+       -EINVAL,                /* BCME_SCANREJECT */
+       -EINVAL,                /* BCME_USAGE_ERROR */
+       -EIO,                   /* BCME_IOCTL_ERROR */
+       -EIO,                   /* BCME_SERIAL_PORT_ERR */
+       -EOPNOTSUPP,            /* BCME_DISABLED, BCME_NOTENABLED */
+       -EIO,                   /* BCME_DECERR */
+       -EIO,                   /* BCME_ENCERR */
+       -EIO,                   /* BCME_MICERR */
+       -ERANGE,                /* BCME_REPLAY */
+       -EINVAL,                /* BCME_IE_NOTFOUND */
+       -EINVAL,                /* BCME_DATA_NOTFOUND */
+       -EINVAL,                /* BCME_NOT_GC */
+       -EINVAL,                /* BCME_PRS_REQ_FAILED */
+       -EINVAL,                /* BCME_NO_P2P_SE */
+       -EINVAL,                /* BCME_NOA_PND */
+       -EINVAL,                /* BCME_FRAG_Q_FAILED */
+       -EINVAL,                /* BCME_GET_AF_FAILED */
+       -EINVAL,                /* BCME_MSCH_NOTREADY */
+       -EINVAL,                /* BCME_IOV_LAST_CMD */
+       -EINVAL,                /* BCME_MINIPMU_CAL_FAIL */
+       -EINVAL,                /* BCME_RCAL_FAIL */
+       -EINVAL,                /* BCME_LPF_RCCAL_FAIL */
+       -EINVAL,                /* BCME_DACBUF_RCCAL_FAIL */
+       -EINVAL,                /* BCME_VCOCAL_FAIL */
+       -EINVAL,                /* BCME_BANDLOCKED */
+       -EINVAL,                /* BCME_BAD_IE_DATA */
+       -EINVAL,                /* BCME_REG_FAILED */
+       -EINVAL,                /* BCME_NOCHAN */
+       -EINVAL,                /* BCME_PKTTOSS */
+       -EINVAL,                /* BCME_DNGL_DEVRESET */
+       -EINVAL,                /* BCME_ROAM */
+
+/* When an new error code is added to bcmutils.h, add os
+ * specific error translation here as well
+ */
+/* check if BCME_LAST changed since the last time this function was updated */
+#if BCME_LAST != BCME_ROAM
+#error "You need to add a OS error translation in the linuxbcmerrormap \
+       for new error code defined in bcmutils.h"
+#endif
+};
+uint lmtest = FALSE;
+
+#ifdef DHD_MAP_LOGGING
+#define DHD_MAP_LOG_SIZE 2048
+
+typedef struct dhd_map_item {
+       dmaaddr_t pa;           /* DMA address (physical) */
+       uint64 ts_nsec;         /* timestamp: nsec */
+       uint32 size;            /* mapping size */
+       uint8 rsvd[4];          /* reserved for future use */
+} dhd_map_item_t;
+
+typedef struct dhd_map_record {
+       uint32 items;           /* number of total items */
+       uint32 idx;             /* current index of metadata */
+       dhd_map_item_t map[0];  /* metadata storage */
+} dhd_map_log_t;
+
+void
+osl_dma_map_dump(osl_t *osh)
+{
+       dhd_map_log_t *map_log, *unmap_log;
+       uint64 ts_sec, ts_usec;
+
+       map_log = (dhd_map_log_t *)(osh->dhd_map_log);
+       unmap_log = (dhd_map_log_t *)(osh->dhd_unmap_log);
+       osl_get_localtime(&ts_sec, &ts_usec);
+
+       if (map_log && unmap_log) {
+               printk("%s: map_idx=%d unmap_idx=%d "
+                       "current time=[%5lu.%06lu]\n", __FUNCTION__,
+                       map_log->idx, unmap_log->idx, (unsigned long)ts_sec,
+                       (unsigned long)ts_usec);
+               printk("%s: dhd_map_log(pa)=0x%llx size=%d,"
+                       " dma_unmap_log(pa)=0x%llx size=%d\n", __FUNCTION__,
+                       (uint64)__virt_to_phys((ulong)(map_log->map)),
+                       (uint32)(sizeof(dhd_map_item_t) * map_log->items),
+                       (uint64)__virt_to_phys((ulong)(unmap_log->map)),
+                       (uint32)(sizeof(dhd_map_item_t) * unmap_log->items));
+       }
+}
+
+static void *
+osl_dma_map_log_init(uint32 item_len)
+{
+       dhd_map_log_t *map_log;
+       gfp_t flags;
+       uint32 alloc_size = sizeof(dhd_map_log_t) +
+               (item_len * sizeof(dhd_map_item_t));
+
+       flags = CAN_SLEEP() ? GFP_KERNEL : GFP_ATOMIC;
+       map_log = (dhd_map_log_t *)kmalloc(alloc_size, flags);
+       if (map_log) {
+               memset(map_log, 0, alloc_size);
+               map_log->items = item_len;
+               map_log->idx = 0;
+       }
+
+       return (void *)map_log;
+}
+
+static void
+osl_dma_map_log_deinit(osl_t *osh)
+{
+       if (osh->dhd_map_log) {
+               kfree(osh->dhd_map_log);
+               osh->dhd_map_log = NULL;
+       }
+
+       if (osh->dhd_unmap_log) {
+               kfree(osh->dhd_unmap_log);
+               osh->dhd_unmap_log = NULL;
+       }
+}
+
+static void
+osl_dma_map_logging(osl_t *osh, void *handle, dmaaddr_t pa, uint32 len)
+{
+       dhd_map_log_t *log = (dhd_map_log_t *)handle;
+       uint32 idx;
+
+       if (log == NULL) {
+               printk("%s: log is NULL\n", __FUNCTION__);
+               return;
+       }
+
+       idx = log->idx;
+       log->map[idx].ts_nsec = osl_localtime_ns();
+       log->map[idx].pa = pa;
+       log->map[idx].size = len;
+       log->idx = (idx + 1) % log->items;
+}
+#endif /* DHD_MAP_LOGGING */
+
+/* translate bcmerrors into linux errors */
+int
+osl_error(int bcmerror)
+{
+       if (bcmerror > 0)
+               bcmerror = 0;
+       else if (bcmerror < BCME_LAST)
+               bcmerror = BCME_ERROR;
+
+       /* Array bounds covered by ASSERT in osl_attach */
+       return linuxbcmerrormap[-bcmerror];
+}
+osl_t *
+osl_attach(void *pdev, uint bustype, bool pkttag)
+{
+       void **osl_cmn = NULL;
+       osl_t *osh;
+       gfp_t flags;
+
+       flags = CAN_SLEEP() ? GFP_KERNEL: GFP_ATOMIC;
+       if (!(osh = kmalloc(sizeof(osl_t), flags)))
+               return osh;
+
+       ASSERT(osh);
+
+       bzero(osh, sizeof(osl_t));
+
+       if (osl_cmn == NULL || *osl_cmn == NULL) {
+               if (!(osh->cmn = kmalloc(sizeof(osl_cmn_t), flags))) {
+                       kfree(osh);
+                       return NULL;
+               }
+               bzero(osh->cmn, sizeof(osl_cmn_t));
+               if (osl_cmn)
+                       *osl_cmn = osh->cmn;
+               atomic_set(&osh->cmn->malloced, 0);
+               osh->cmn->dbgmem_list = NULL;
+               spin_lock_init(&(osh->cmn->dbgmem_lock));
+
+               spin_lock_init(&(osh->cmn->pktalloc_lock));
+
+       } else {
+               osh->cmn = *osl_cmn;
+       }
+       atomic_add(1, &osh->cmn->refcount);
+
+       bcm_object_trace_init();
+       /* Check that error map has the right number of entries in it */
+       ASSERT(ABS(BCME_LAST) == (ARRAYSIZE(linuxbcmerrormap) - 1));
+       osh->failed = 0;
+       osh->pdev = pdev;
+       osh->pub.pkttag = pkttag;
+       osh->bustype = bustype;
+       osh->magic = OS_HANDLE_MAGIC;
+
+       switch (bustype) {
+               case PCI_BUS:
+               case SI_BUS:
+                       osh->pub.mmbus = TRUE;
+                       break;
+               case SDIO_BUS:
+               case USB_BUS:
+               case SPI_BUS:
+               case RPC_BUS:
+                       osh->pub.mmbus = FALSE;
+                       break;
+               default:
+                       ASSERT(FALSE);
+                       break;
+       }
+
+       DMA_LOCK_INIT(osh);
+
+#ifdef DHD_MAP_LOGGING
+       osh->dhd_map_log = osl_dma_map_log_init(DHD_MAP_LOG_SIZE);
+       if (osh->dhd_map_log == NULL) {
+               printk("%s: Failed to alloc dhd_map_log\n", __FUNCTION__);
+       }
+
+       osh->dhd_unmap_log = osl_dma_map_log_init(DHD_MAP_LOG_SIZE);
+       if (osh->dhd_unmap_log == NULL) {
+               printk("%s: Failed to alloc dhd_unmap_log\n", __FUNCTION__);
+       }
+#endif /* DHD_MAP_LOGGING */
+
+       return osh;
+}
+
+void osl_set_bus_handle(osl_t *osh, void *bus_handle)
+{
+       osh->bus_handle = bus_handle;
+}
+
+void* osl_get_bus_handle(osl_t *osh)
+{
+       return osh->bus_handle;
+}
+
+#if defined(AXI_TIMEOUTS_NIC)
+void osl_set_bpt_cb(osl_t *osh, void *bpt_cb, void *bpt_ctx)
+{
+       if (osh) {
+               osh->bpt_cb = (bpt_cb_fn)bpt_cb;
+               osh->sih = bpt_ctx;
+       }
+}
+#endif /* AXI_TIMEOUTS_NIC */
+
+void
+osl_detach(osl_t *osh)
+{
+       if (osh == NULL)
+               return;
+
+       bcm_object_trace_deinit();
+
+#ifdef DHD_MAP_LOGGING
+       osl_dma_map_log_deinit(osh->dhd_map_log);
+       osl_dma_map_log_deinit(osh->dhd_unmap_log);
+#endif /* DHD_MAP_LOGGING */
+
+       ASSERT(osh->magic == OS_HANDLE_MAGIC);
+       atomic_sub(1, &osh->cmn->refcount);
+       if (atomic_read(&osh->cmn->refcount) == 0) {
+                       kfree(osh->cmn);
+       }
+       kfree(osh);
+}
+
+/* APIs to set/get specific quirks in OSL layer */
+void
+BCMFASTPATH(osl_flag_set)(osl_t *osh, uint32 mask)
+{
+       osh->flags |= mask;
+}
+
+void
+osl_flag_clr(osl_t *osh, uint32 mask)
+{
+       osh->flags &= ~mask;
+}
+
+bool
+osl_is_flag_set(osl_t *osh, uint32 mask)
+{
+       return (osh->flags & mask);
+}
+
+#if (defined(__ARM_ARCH_7A__) && !defined(DHD_USE_COHERENT_MEM_FOR_RING))
+
+inline void
+BCMFASTPATH(osl_cache_flush)(void *va, uint size)
+{
+       if (size > 0)
+               dma_sync_single_for_device(OSH_NULL, virt_to_dma(OSH_NULL, va), size,
+                       DMA_TO_DEVICE);
+}
+
+inline void
+BCMFASTPATH(osl_cache_inv)(void *va, uint size)
+{
+       dma_sync_single_for_cpu(OSH_NULL, virt_to_dma(OSH_NULL, va), size, DMA_FROM_DEVICE);
+}
+
+inline void
+BCMFASTPATH(osl_prefetch)(const void *ptr)
+{
+       __asm__ __volatile__("pld\t%0" :: "o"(*(const char *)ptr) : "cc");
+}
+
+#endif /* !__ARM_ARCH_7A__ */
+
+uint32
+osl_pci_read_config(osl_t *osh, uint offset, uint size)
+{
+       uint val = 0;
+       uint retry = PCI_CFG_RETRY;      /* PR15065: faulty cardbus controller bug */
+
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+       /* only 4byte access supported */
+       ASSERT(size == 4);
+
+       do {
+               pci_read_config_dword(osh->pdev, offset, &val);
+               if (val != 0xffffffff)
+                       break;
+       } while (retry--);
+
+       return (val);
+}
+
+void
+osl_pci_write_config(osl_t *osh, uint offset, uint size, uint val)
+{
+       uint retry = PCI_CFG_RETRY;      /* PR15065: faulty cardbus controller bug */
+
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+       /* only 4byte access supported */
+       ASSERT(size == 4);
+
+       do {
+               pci_write_config_dword(osh->pdev, offset, val);
+               /* PR15065: PCI_BAR0_WIN is believed to be the only pci cfg write that can occur
+                * when dma activity is possible
+                */
+               if (offset != PCI_BAR0_WIN)
+                       break;
+               if (osl_pci_read_config(osh, offset, size) == val)
+                       break;
+       } while (retry--);
+
+}
+
+/* return bus # for the pci device pointed by osh->pdev */
+uint
+osl_pci_bus(osl_t *osh)
+{
+       ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+#if defined(__ARM_ARCH_7A__)
+       return pci_domain_nr(((struct pci_dev *)osh->pdev)->bus);
+#else
+       return ((struct pci_dev *)osh->pdev)->bus->number;
+#endif
+}
+
+/* return slot # for the pci device pointed by osh->pdev */
+uint
+osl_pci_slot(osl_t *osh)
+{
+       ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+#if defined(__ARM_ARCH_7A__)
+       return PCI_SLOT(((struct pci_dev *)osh->pdev)->devfn) + 1;
+#else
+       return PCI_SLOT(((struct pci_dev *)osh->pdev)->devfn);
+#endif
+}
+
+/* return domain # for the pci device pointed by osh->pdev */
+uint
+osl_pcie_domain(osl_t *osh)
+{
+       ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+       return pci_domain_nr(((struct pci_dev *)osh->pdev)->bus);
+}
+
+/* return bus # for the pci device pointed by osh->pdev */
+uint
+osl_pcie_bus(osl_t *osh)
+{
+       ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+       return ((struct pci_dev *)osh->pdev)->bus->number;
+}
+
+/* return the pci device pointed by osh->pdev */
+struct pci_dev *
+osl_pci_device(osl_t *osh)
+{
+       ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+       return osh->pdev;
+}
+
+void *
+osl_malloc(osl_t *osh, uint size)
+{
+       void *addr;
+       gfp_t flags;
+
+       /* only ASSERT if osh is defined */
+       if (osh)
+               ASSERT(osh->magic == OS_HANDLE_MAGIC);
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+       if (bcm_static_buf)
+       {
+               unsigned long irq_flags;
+               int i = 0;
+               if ((size >= PAGE_SIZE)&&(size <= STATIC_BUF_SIZE))
+               {
+                       OSL_STATIC_BUF_LOCK(&bcm_static_buf->static_lock, irq_flags);
+
+                       for (i = 0; i < STATIC_BUF_MAX_NUM; i++)
+                       {
+                               if (bcm_static_buf->buf_use[i] == 0)
+                                       break;
+                       }
+
+                       if (i == STATIC_BUF_MAX_NUM)
+                       {
+                               OSL_STATIC_BUF_UNLOCK(&bcm_static_buf->static_lock, irq_flags);
+                               printk("all static buff in use!\n");
+                               goto original;
+                       }
+
+                       bcm_static_buf->buf_use[i] = 1;
+                       OSL_STATIC_BUF_UNLOCK(&bcm_static_buf->static_lock, irq_flags);
+
+                       bzero(bcm_static_buf->buf_ptr+STATIC_BUF_SIZE*i, size);
+                       if (osh)
+                               atomic_add(size, &osh->cmn->malloced);
+
+                       return ((void *)(bcm_static_buf->buf_ptr+STATIC_BUF_SIZE*i));
+               }
+       }
+original:
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+       flags = CAN_SLEEP() ? GFP_KERNEL: GFP_ATOMIC;
+       if ((addr = kmalloc(size, flags)) == NULL) {
+               if (osh)
+                       osh->failed++;
+               return (NULL);
+       }
+       if (osh && osh->cmn)
+               atomic_add(size, &osh->cmn->malloced);
+
+       return (addr);
+}
+
+void *
+osl_mallocz(osl_t *osh, uint size)
+{
+       void *ptr;
+
+       ptr = osl_malloc(osh, size);
+
+       if (ptr != NULL) {
+               bzero(ptr, size);
+       }
+
+       return ptr;
+}
+
+void
+osl_mfree(osl_t *osh, void *addr, uint size)
+{
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+       unsigned long flags;
+
+       if (addr == NULL) {
+               return;
+       }
+
+       if (bcm_static_buf)
+       {
+               if ((addr > (void *)bcm_static_buf) && ((unsigned char *)addr
+                       <= ((unsigned char *)bcm_static_buf + STATIC_BUF_TOTAL_LEN)))
+               {
+                       int buf_idx = 0;
+
+                       buf_idx = ((unsigned char *)addr - bcm_static_buf->buf_ptr)/STATIC_BUF_SIZE;
+
+                       OSL_STATIC_BUF_LOCK(&bcm_static_buf->static_lock, flags);
+                       bcm_static_buf->buf_use[buf_idx] = 0;
+                       OSL_STATIC_BUF_UNLOCK(&bcm_static_buf->static_lock, flags);
+
+                       if (osh && osh->cmn) {
+                               ASSERT(osh->magic == OS_HANDLE_MAGIC);
+                               atomic_sub(size, &osh->cmn->malloced);
+                       }
+                       return;
+               }
+       }
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+       if (osh && osh->cmn) {
+               ASSERT(osh->magic == OS_HANDLE_MAGIC);
+
+               ASSERT(size <= osl_malloced(osh));
+
+               atomic_sub(size, &osh->cmn->malloced);
+       }
+       kfree(addr);
+}
+
+void *
+osl_vmalloc(osl_t *osh, uint size)
+{
+       void *addr;
+
+       /* only ASSERT if osh is defined */
+       if (osh)
+               ASSERT(osh->magic == OS_HANDLE_MAGIC);
+       if ((addr = vmalloc(size)) == NULL) {
+               if (osh)
+                       osh->failed++;
+               return (NULL);
+       }
+       if (osh && osh->cmn)
+               atomic_add(size, &osh->cmn->malloced);
+
+       return (addr);
+}
+
+void *
+osl_vmallocz(osl_t *osh, uint size)
+{
+       void *ptr;
+
+       ptr = osl_vmalloc(osh, size);
+
+       if (ptr != NULL) {
+               bzero(ptr, size);
+       }
+
+       return ptr;
+}
+
+void
+osl_vmfree(osl_t *osh, void *addr, uint size)
+{
+       if (osh && osh->cmn) {
+               ASSERT(osh->magic == OS_HANDLE_MAGIC);
+
+               ASSERT(size <= osl_malloced(osh));
+
+               atomic_sub(size, &osh->cmn->malloced);
+       }
+       vfree(addr);
+}
+
+uint
+osl_check_memleak(osl_t *osh)
+{
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+       if (atomic_read(&osh->cmn->refcount) == 1)
+               return (atomic_read(&osh->cmn->malloced));
+       else
+               return 0;
+}
+
+uint
+osl_malloced(osl_t *osh)
+{
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+       return (atomic_read(&osh->cmn->malloced));
+}
+
+uint
+osl_malloc_failed(osl_t *osh)
+{
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+       return (osh->failed);
+}
+
+uint
+osl_dma_consistent_align(void)
+{
+       return (PAGE_SIZE);
+}
+
+void*
+osl_dma_alloc_consistent(osl_t *osh, uint size, uint16 align_bits, uint *alloced, dmaaddr_t *pap)
+{
+       void *va;
+       uint16 align = (1 << align_bits);
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+       if (!ISALIGNED(DMA_CONSISTENT_ALIGN, align))
+               size += align;
+       *alloced = size;
+
+#if (defined(__ARM_ARCH_7A__) && !defined(DHD_USE_COHERENT_MEM_FOR_RING))
+       va = kmalloc(size, GFP_ATOMIC | __GFP_ZERO);
+       if (va)
+               *pap = (ulong)__virt_to_phys((ulong)va);
+#else
+       {
+               dma_addr_t pap_lin;
+               struct pci_dev *hwdev = osh->pdev;
+               gfp_t flags;
+#ifdef DHD_ALLOC_COHERENT_MEM_FROM_ATOMIC_POOL
+               flags = GFP_ATOMIC;
+#else
+               flags = CAN_SLEEP() ? GFP_KERNEL: GFP_ATOMIC;
+#endif /* DHD_ALLOC_COHERENT_MEM_FROM_ATOMIC_POOL */
+#ifdef DHD_ALLOC_COHERENT_MEM_WITH_GFP_COMP
+               flags |= __GFP_COMP;
+#endif /* DHD_ALLOC_COHERENT_MEM_WITH_GFP_COMP */
+               va = dma_alloc_coherent(&hwdev->dev, size, &pap_lin, flags);
+#ifdef BCMDMA64OSL
+               PHYSADDRLOSET(*pap, pap_lin & 0xffffffff);
+               PHYSADDRHISET(*pap, (pap_lin >> 32) & 0xffffffff);
+#else
+               *pap = (dmaaddr_t)pap_lin;
+#endif /* BCMDMA64OSL */
+       }
+#endif /* __ARM_ARCH_7A__ && !DHD_USE_COHERENT_MEM_FOR_RING */
+
+       return va;
+}
+
+void
+osl_dma_free_consistent(osl_t *osh, void *va, uint size, dmaaddr_t pa)
+{
+#ifdef BCMDMA64OSL
+       dma_addr_t paddr;
+#endif /* BCMDMA64OSL */
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+#if (defined(__ARM_ARCH_7A__) && !defined(DHD_USE_COHERENT_MEM_FOR_RING))
+       kfree(va);
+#else
+#ifdef BCMDMA64OSL
+       PHYSADDRTOULONG(pa, paddr);
+       pci_free_consistent(osh->pdev, size, va, paddr);
+#else
+       pci_free_consistent(osh->pdev, size, va, (dma_addr_t)pa);
+#endif /* BCMDMA64OSL */
+#endif /* __ARM_ARCH_7A__ && !DHD_USE_COHERENT_MEM_FOR_RING */
+}
+
+void *
+osl_virt_to_phys(void *va)
+{
+       return (void *)(uintptr)virt_to_phys(va);
+}
+
+#include <asm/cacheflush.h>
+void
+BCMFASTPATH(osl_dma_flush)(osl_t *osh, void *va, uint size, int direction, void *p,
+       hnddma_seg_map_t *dmah)
+{
+       return;
+}
+
+dmaaddr_t
+BCMFASTPATH(osl_dma_map)(osl_t *osh, void *va, uint size, int direction, void *p,
+       hnddma_seg_map_t *dmah)
+{
+       int dir;
+       dmaaddr_t ret_addr;
+       dma_addr_t map_addr;
+       int ret;
+
+       DMA_LOCK(osh);
+
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+       dir = (direction == DMA_TX)? PCI_DMA_TODEVICE: PCI_DMA_FROMDEVICE;
+
+       map_addr = pci_map_single(osh->pdev, va, size, dir);
+
+       ret = pci_dma_mapping_error(osh->pdev, map_addr);
+
+       if (ret) {
+               printk("%s: Failed to map memory\n", __FUNCTION__);
+               PHYSADDRLOSET(ret_addr, 0);
+               PHYSADDRHISET(ret_addr, 0);
+       } else {
+               PHYSADDRLOSET(ret_addr, map_addr & 0xffffffff);
+               PHYSADDRHISET(ret_addr, (map_addr >> 32) & 0xffffffff);
+       }
+
+#ifdef DHD_MAP_LOGGING
+       osl_dma_map_logging(osh, osh->dhd_map_log, ret_addr, size);
+#endif /* DHD_MAP_LOGGING */
+
+       DMA_UNLOCK(osh);
+
+       return ret_addr;
+}
+
+void
+BCMFASTPATH(osl_dma_unmap)(osl_t *osh, dmaaddr_t pa, uint size, int direction)
+{
+       int dir;
+#ifdef BCMDMA64OSL
+       dma_addr_t paddr;
+#endif /* BCMDMA64OSL */
+
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+       DMA_LOCK(osh);
+
+       dir = (direction == DMA_TX)? PCI_DMA_TODEVICE: PCI_DMA_FROMDEVICE;
+
+#ifdef DHD_MAP_LOGGING
+       osl_dma_map_logging(osh, osh->dhd_unmap_log, pa, size);
+#endif /* DHD_MAP_LOGGING */
+
+#ifdef BCMDMA64OSL
+       PHYSADDRTOULONG(pa, paddr);
+       pci_unmap_single(osh->pdev, paddr, size, dir);
+#else /* BCMDMA64OSL */
+       pci_unmap_single(osh->pdev, (uint32)pa, size, dir);
+#endif /* BCMDMA64OSL */
+
+       DMA_UNLOCK(osh);
+}
+
+/* OSL function for CPU relax */
+inline void
+BCMFASTPATH(osl_cpu_relax)(void)
+{
+       cpu_relax();
+}
+
+extern void osl_preempt_disable(osl_t *osh)
+{
+       preempt_disable();
+}
+
+extern void osl_preempt_enable(osl_t *osh)
+{
+       preempt_enable();
+}
+
+#if defined(BCMASSERT_LOG)
+void
+osl_assert(const char *exp, const char *file, int line)
+{
+       char tempbuf[256];
+       const char *basename;
+
+       basename = strrchr(file, '/');
+       /* skip the '/' */
+       if (basename)
+               basename++;
+
+       if (!basename)
+               basename = file;
+
+#ifdef BCMASSERT_LOG
+       snprintf(tempbuf, 64, "\"%s\": file \"%s\", line %d\n",
+               exp, basename, line);
+#endif /* BCMASSERT_LOG */
+
+       switch (g_assert_type) {
+       case 0:
+               printk("%s", tempbuf);
+               BUG();
+               break;
+       case 1:
+               /* fall through */
+       case 3:
+               printk("%s", tempbuf);
+               break;
+       case 2:
+               printk("%s", tempbuf);
+               BUG();
+               break;
+       default:
+               break;
+       }
+}
+#endif
+
+void
+osl_delay(uint usec)
+{
+       uint d;
+
+       while (usec > 0) {
+               d = MIN(usec, 1000);
+               udelay(d);
+               usec -= d;
+       }
+}
+
+void
+osl_sleep(uint ms)
+{
+
+       if (ms < 20)
+               usleep_range(ms*1000, ms*1000 + 1000);
+       else
+               msleep(ms);
+}
+
+uint64
+osl_sysuptime_us(void)
+{
+       struct osl_timespec tv;
+       uint64 usec;
+
+       osl_do_gettimeofday(&tv);
+       /* tv_usec content is fraction of a second */
+       usec = (uint64)tv.tv_sec * 1000000ul + tv.tv_usec;
+       return usec;
+}
+
+uint64
+osl_localtime_ns(void)
+{
+       uint64 ts_nsec = 0;
+
+       /* Some Linux based platform cannot use local_clock()
+        * since it is defined by EXPORT_SYMBOL_GPL().
+        * GPL-incompatible module (NIC builds wl.ko)
+        * cannnot use the GPL-only symbol.
+        */
+       ts_nsec = local_clock();
+       return ts_nsec;
+}
+
+void
+osl_get_localtime(uint64 *sec, uint64 *usec)
+{
+       uint64 ts_nsec = 0;
+       unsigned long rem_nsec = 0;
+
+       /* Some Linux based platform cannot use local_clock()
+        * since it is defined by EXPORT_SYMBOL_GPL().
+        * GPL-incompatible module (NIC builds wl.ko) can
+        * not use the GPL-only symbol.
+        */
+       ts_nsec = local_clock();
+       rem_nsec = do_div(ts_nsec, NSEC_PER_SEC);
+       *sec = (uint64)ts_nsec;
+       *usec = (uint64)(rem_nsec / MSEC_PER_SEC);
+}
+
+uint64
+osl_systztime_us(void)
+{
+       struct osl_timespec tv;
+       uint64 tzusec;
+
+       osl_do_gettimeofday(&tv);
+       /* apply timezone */
+       tzusec = (uint64)((tv.tv_sec - (sys_tz.tz_minuteswest * 60)) *
+               USEC_PER_SEC);
+       tzusec += tv.tv_usec;
+
+       return tzusec;
+}
+
+/*
+ * OSLREGOPS specifies the use of osl_XXX routines to be used for register access
+ */
+
+/*
+ * BINOSL selects the slightly slower function-call-based binary compatible osl.
+ */
+
+uint32
+osl_rand(void)
+{
+       uint32 rand;
+
+       get_random_bytes(&rand, sizeof(rand));
+
+       return rand;
+}
+
+/* Linux Kernel: File Operations: start */
+void *
+osl_os_open_image(char *filename)
+{
+       struct file *fp;
+
+       fp = filp_open(filename, O_RDONLY, 0);
+       /*
+        * 2.6.11 (FC4) supports filp_open() but later revs don't?
+        * Alternative:
+        * fp = open_namei(AT_FDCWD, filename, O_RD, 0);
+        * ???
+        */
+       if (IS_ERR(fp)) {
+               printk("ERROR %ld: Unable to open file %s\n", PTR_ERR(fp), filename);
+               fp = NULL;
+       }
+
+       return fp;
+}
+
+int
+osl_os_get_image_block(char *buf, int len, void *image)
+{
+       struct file *fp = (struct file *)image;
+       int rdlen;
+
+       if (fp == NULL) {
+               return 0;
+       }
+
+       rdlen = kernel_read_compat(fp, fp->f_pos, buf, len);
+       if (rdlen > 0) {
+               fp->f_pos += rdlen;
+       }
+
+       return rdlen;
+}
+
+void
+osl_os_close_image(void *image)
+{
+       struct file *fp = (struct file *)image;
+
+       if (fp != NULL) {
+               filp_close(fp, NULL);
+       }
+}
+
+int
+osl_os_image_size(void *image)
+{
+       int len = 0, curroffset;
+
+       if (image) {
+               /* store the current offset */
+               curroffset = generic_file_llseek(image, 0, 1);
+               /* goto end of file to get length */
+               len = generic_file_llseek(image, 0, 2);
+               /* restore back the offset */
+               generic_file_llseek(image, curroffset, 0);
+       }
+       return len;
+}
+
+/* Linux Kernel: File Operations: end */
+
+#if defined(AXI_TIMEOUTS_NIC)
+inline void osl_bpt_rreg(osl_t *osh, ulong addr, volatile void *v, uint size)
+{
+       bool poll_timeout = FALSE;
+       static int in_si_clear = FALSE;
+
+       switch (size) {
+       case sizeof(uint8):
+               *(volatile uint8*)v = readb((volatile uint8*)(addr));
+               if (*(volatile uint8*)v == 0xff)
+                       poll_timeout = TRUE;
+               break;
+       case sizeof(uint16):
+               *(volatile uint16*)v = readw((volatile uint16*)(addr));
+               if (*(volatile uint16*)v == 0xffff)
+                       poll_timeout = TRUE;
+               break;
+       case sizeof(uint32):
+               *(volatile uint32*)v = readl((volatile uint32*)(addr));
+               if (*(volatile uint32*)v == 0xffffffff)
+                       poll_timeout = TRUE;
+               break;
+       case sizeof(uint64):
+               *(volatile uint64*)v = *((volatile uint64*)(addr));
+               if (*(volatile uint64*)v == 0xffffffffffffffff)
+                       poll_timeout = TRUE;
+               break;
+       }
+
+       if (osh && osh->sih && (in_si_clear == FALSE) && poll_timeout && osh->bpt_cb) {
+               in_si_clear = TRUE;
+               osh->bpt_cb((void *)osh->sih, (void *)addr);
+               in_si_clear = FALSE;
+       }
+}
+#endif /* AXI_TIMEOUTS_NIC */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0)
+void
+timer_cb_compat(struct timer_list *tl)
+{
+       timer_list_compat_t *t = container_of(tl, timer_list_compat_t, timer);
+       t->callback((ulong)t->arg);
+}
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0) */
+
+/* timer apis */
+/* Note: All timer api's are thread unsafe and should be protected with locks by caller */
+
+osl_timer_t *
+osl_timer_init(osl_t *osh, const char *name, void (*fn)(void *arg), void *arg)
+{
+       osl_timer_t *t;
+       BCM_REFERENCE(fn);
+       if ((t = MALLOCZ(NULL, sizeof(osl_timer_t))) == NULL) {
+               printk(KERN_ERR "osl_timer_init: out of memory, malloced %d bytes\n",
+                       (int)sizeof(osl_timer_t));
+               return (NULL);
+       }
+       bzero(t, sizeof(osl_timer_t));
+       if ((t->timer = MALLOCZ(NULL, sizeof(timer_list_compat_t))) == NULL) {
+               printf("osl_timer_init: malloc failed\n");
+               MFREE(NULL, t, sizeof(osl_timer_t));
+               return (NULL);
+       }
+
+       t->set = TRUE;
+
+       init_timer_compat(t->timer, (linux_timer_fn)fn, arg);
+
+       return (t);
+}
+
+void
+osl_timer_add(osl_t *osh, osl_timer_t *t, uint32 ms, bool periodic)
+{
+       if (t == NULL) {
+               printf("%s: Timer handle is NULL\n", __FUNCTION__);
+               return;
+       }
+       ASSERT(!t->set);
+
+       t->set = TRUE;
+       if (periodic) {
+               printf("Periodic timers are not supported by Linux timer apis\n");
+       }
+       timer_expires(t->timer) = jiffies + ms*HZ/1000;
+
+       add_timer(t->timer);
+
+       return;
+}
+
+void
+osl_timer_update(osl_t *osh, osl_timer_t *t, uint32 ms, bool periodic)
+{
+       if (t == NULL) {
+               printf("%s: Timer handle is NULL\n", __FUNCTION__);
+               return;
+       }
+       if (periodic) {
+               printf("Periodic timers are not supported by Linux timer apis\n");
+       }
+       t->set = TRUE;
+       timer_expires(t->timer) = jiffies + ms*HZ/1000;
+
+       mod_timer(t->timer, timer_expires(t->timer));
+
+       return;
+}
+
+/*
+ * Return TRUE if timer successfully deleted, FALSE if still pending
+ */
+bool
+osl_timer_del(osl_t *osh, osl_timer_t *t)
+{
+       if (t == NULL) {
+               printf("%s: Timer handle is NULL\n", __FUNCTION__);
+               return (FALSE);
+       }
+       if (t->set) {
+               t->set = FALSE;
+               if (t->timer) {
+                       del_timer(t->timer);
+                       MFREE(NULL, t->timer, sizeof(struct timer_list));
+               }
+               MFREE(NULL, t, sizeof(osl_timer_t));
+       }
+       return (TRUE);
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0))
+int
+kernel_read_compat(struct file *file, loff_t offset, char *addr, unsigned long count)
+{
+       return (int)kernel_read(file, addr, (size_t)count, &offset);
+}
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0)) */
+
+/* Linux specific multipurpose spinlock API */
+void *
+osl_spin_lock_init(osl_t *osh)
+{
+       /* Adding 4 bytes since the sizeof(spinlock_t) could be 0 */
+       /* if CONFIG_SMP and CONFIG_DEBUG_SPINLOCK are not defined */
+       /* and this results in kernel asserts in internal builds */
+       spinlock_t * lock = MALLOC(osh, sizeof(spinlock_t) + 4);
+       if (lock)
+               spin_lock_init(lock);
+       return ((void *)lock);
+}
+void
+osl_spin_lock_deinit(osl_t *osh, void *lock)
+{
+       if (lock)
+               MFREE(osh, lock, sizeof(spinlock_t) + 4);
+}
+
+unsigned long
+osl_spin_lock(void *lock)
+{
+       unsigned long flags = 0;
+
+       if (lock) {
+#ifdef DHD_USE_SPIN_LOCK_BH
+               /* Calling spin_lock_bh with both irq and non-irq context will lead to deadlock */
+               ASSERT(!in_irq());
+               spin_lock_bh((spinlock_t *)lock);
+#else
+               spin_lock_irqsave((spinlock_t *)lock, flags);
+#endif /* DHD_USE_SPIN_LOCK_BH */
+       }
+
+       return flags;
+}
+
+void
+osl_spin_unlock(void *lock, unsigned long flags)
+{
+       if (lock) {
+#ifdef DHD_USE_SPIN_LOCK_BH
+               /* Calling spin_lock_bh with both irq and non-irq context will lead to deadlock */
+               ASSERT(!in_irq());
+               spin_unlock_bh((spinlock_t *)lock);
+#else
+               spin_unlock_irqrestore((spinlock_t *)lock, flags);
+#endif /* DHD_USE_SPIN_LOCK_BH */
+       }
+}
+
+unsigned long
+osl_spin_lock_irq(void *lock)
+{
+       unsigned long flags = 0;
+
+       if (lock)
+               spin_lock_irqsave((spinlock_t *)lock, flags);
+
+       return flags;
+}
+
+void
+osl_spin_unlock_irq(void *lock, unsigned long flags)
+{
+       if (lock)
+               spin_unlock_irqrestore((spinlock_t *)lock, flags);
+}
+
+unsigned long
+osl_spin_lock_bh(void *lock)
+{
+       unsigned long flags = 0;
+
+       if (lock) {
+               /* Calling spin_lock_bh with both irq and non-irq context will lead to deadlock */
+               ASSERT(!in_irq());
+               spin_lock_bh((spinlock_t *)lock);
+       }
+
+       return flags;
+}
+
+void
+osl_spin_unlock_bh(void *lock, unsigned long flags)
+{
+       if (lock) {
+               /* Calling spin_lock_bh with both irq and non-irq context will lead to deadlock */
+               ASSERT(!in_irq());
+               spin_unlock_bh((spinlock_t *)lock);
+       }
+}
+
+void *
+osl_mutex_lock_init(osl_t *osh)
+{
+       struct mutex *mtx = NULL;
+
+       mtx = MALLOCZ(osh, sizeof(*mtx));
+       if (mtx)
+               mutex_init(mtx);
+
+       return mtx;
+}
+
+void
+osl_mutex_lock_deinit(osl_t *osh, void *mtx)
+{
+       if (mtx) {
+               mutex_destroy(mtx);
+               MFREE(osh, mtx, sizeof(struct mutex));
+       }
+}
+
+/* For mutex lock/unlock unsigned long flags is used,
+ * this is to keep in sync with spin lock apis, so that
+ * locks can be easily interchanged based on contexts
+ */
+unsigned long
+osl_mutex_lock(void *lock)
+{
+       if (lock)
+               mutex_lock((struct mutex *)lock);
+
+       return 0;
+}
+
+void
+osl_mutex_unlock(void *lock, unsigned long flags)
+{
+       if (lock)
+               mutex_unlock((struct mutex *)lock);
+       return;
+}
+
+#ifdef USE_DMA_LOCK
+static void
+osl_dma_lock(osl_t *osh)
+{
+       /* The conditional check is to avoid the scheduling bug.
+        * If the spin_lock_bh is used under the spin_lock_irqsave,
+        * Kernel triggered the warning message as the spin_lock_irqsave
+        * disables the interrupt and the spin_lock_bh doesn't use in case
+        * interrupt is disabled.
+        * Please refer to the __local_bh_enable_ip() function
+        * in kernel/softirq.c to understand the condtion.
+        */
+       if (likely(in_irq() || irqs_disabled())) {
+               spin_lock(&osh->dma_lock);
+       } else {
+               spin_lock_bh(&osh->dma_lock);
+               osh->dma_lock_bh = TRUE;
+       }
+}
+
+static void
+osl_dma_unlock(osl_t *osh)
+{
+       if (unlikely(osh->dma_lock_bh)) {
+               osh->dma_lock_bh = FALSE;
+               spin_unlock_bh(&osh->dma_lock);
+       } else {
+               spin_unlock(&osh->dma_lock);
+       }
+}
+
+static void
+osl_dma_lock_init(osl_t *osh)
+{
+       spin_lock_init(&osh->dma_lock);
+       osh->dma_lock_bh = FALSE;
+}
+#endif /* USE_DMA_LOCK */
+
+void
+osl_do_gettimeofday(struct osl_timespec *ts)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
+       struct timespec64 curtime;
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
+       struct timespec curtime;
+#else
+       struct timeval curtime;
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
+       ktime_get_real_ts64(&curtime);
+       ts->tv_nsec = curtime.tv_nsec;
+       ts->tv_usec     = curtime.tv_nsec / 1000;
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
+       getnstimeofday(&curtime);
+       ts->tv_nsec = curtime.tv_nsec;
+       ts->tv_usec = curtime.tv_nsec / 1000;
+#else
+       do_gettimeofday(&curtime);
+       ts->tv_usec = curtime.tv_usec;
+       ts->tv_nsec = curtime.tv_usec * 1000;
+#endif
+       ts->tv_sec = curtime.tv_sec;
+}
+
+uint32
+osl_do_gettimediff(struct osl_timespec *cur_ts, struct osl_timespec *old_ts)
+{
+       uint32 diff_s, diff_us, total_diff_us;
+       bool pgc_g = FALSE;
+
+       diff_s = (uint32)cur_ts->tv_sec - (uint32)old_ts->tv_sec;
+       pgc_g = (cur_ts->tv_usec > old_ts->tv_usec) ? TRUE : FALSE;
+       diff_us = pgc_g ? (cur_ts->tv_usec - old_ts->tv_usec) : (old_ts->tv_usec - cur_ts->tv_usec);
+       total_diff_us = pgc_g ? (diff_s * 1000000 + diff_us) : (diff_s * 1000000 - diff_us);
+       return total_diff_us;
+}
+
+void
+osl_get_monotonic_boottime(struct osl_timespec *ts)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
+       struct timespec64 curtime;
+#else
+       struct timespec curtime;
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
+       curtime = ktime_to_timespec64(ktime_get_boottime());
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
+       curtime = ktime_to_timespec(ktime_get_boottime());
+#else
+       get_monotonic_boottime(&curtime);
+#endif
+       ts->tv_sec = curtime.tv_sec;
+       ts->tv_nsec = curtime.tv_nsec;
+       ts->tv_usec = curtime.tv_nsec / 1000;
+}
\ No newline at end of file
diff --git a/bcmdhd.101.10.240.x/linux_osl_priv.h b/bcmdhd.101.10.240.x/linux_osl_priv.h
new file mode 100644 (file)
index 0000000..b716244
--- /dev/null
@@ -0,0 +1,175 @@
+/*
+ * Private header file for Linux OS Independent Layer
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _LINUX_OSL_PRIV_H_
+#define _LINUX_OSL_PRIV_H_
+
+#include <osl.h>
+
+#define OS_HANDLE_MAGIC                0x1234abcd      /* Magic # to recognize osh */
+#define BCM_MEM_FILENAME_LEN   24              /* Mem. filename length */
+
+/* dependancy check */
+#if !defined(BCMPCIE) && defined(DHD_USE_STATIC_CTRLBUF)
+#error "DHD_USE_STATIC_CTRLBUF suppored PCIE target only"
+#endif /* !BCMPCIE && DHD_USE_STATIC_CTRLBUF */
+
+#define OSL_MEMLIST_LOCK(lock, flags)  (flags) = osl_spin_lock(lock)
+#define OSL_MEMLIST_UNLOCK(lock, flags)        osl_spin_unlock((lock), (flags))
+
+#define OSL_STATIC_BUF_LOCK(lock, flags)       (flags) = osl_spin_lock(lock)
+#define OSL_STATIC_BUF_UNLOCK(lock, flags)     osl_spin_unlock((lock), (flags))
+
+#define OSL_STATIC_PKT_LOCK(lock, flags)       (flags) = osl_spin_lock(lock)
+#define OSL_STATIC_PKT_UNLOCK(lock, flags)     osl_spin_unlock((lock), (flags))
+
+#define OSL_PKTLIST_LOCK(lock, flags)  (flags) = osl_spin_lock(lock)
+#define OSL_PKTLIST_UNLOCK(lock, flags)        osl_spin_unlock((lock), (flags))
+
+#define OSL_CTRACE_LOCK(lock, flags)   (flags) = osl_spin_lock(lock)
+#define OSL_CTRACE_UNLOCK(lock, flags) osl_spin_unlock((lock), (flags))
+
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+#ifdef DHD_USE_STATIC_CTRLBUF
+#define DHD_SKB_1PAGE_BUFSIZE  (PAGE_SIZE*1)
+#define DHD_SKB_2PAGE_BUFSIZE  (PAGE_SIZE*2)
+#define DHD_SKB_4PAGE_BUFSIZE  (PAGE_SIZE*4)
+
+#define PREALLOC_FREE_MAGIC    0xFEDC
+#define PREALLOC_USED_MAGIC    0xFCDE
+#else
+#define DHD_SKB_HDRSIZE                336
+#define DHD_SKB_1PAGE_BUFSIZE  ((PAGE_SIZE*1)-DHD_SKB_HDRSIZE)
+#define DHD_SKB_2PAGE_BUFSIZE  ((PAGE_SIZE*2)-DHD_SKB_HDRSIZE)
+#define DHD_SKB_4PAGE_BUFSIZE  ((PAGE_SIZE*4)-DHD_SKB_HDRSIZE)
+#endif /* DHD_USE_STATIC_CTRLBUF */
+
+#define STATIC_BUF_MAX_NUM     16
+#define STATIC_BUF_SIZE        (PAGE_SIZE*2)
+#define STATIC_BUF_TOTAL_LEN   (STATIC_BUF_MAX_NUM * STATIC_BUF_SIZE)
+
+typedef struct bcm_static_buf {
+       spinlock_t static_lock;
+       unsigned char *buf_ptr;
+       unsigned char buf_use[STATIC_BUF_MAX_NUM];
+} bcm_static_buf_t;
+
+extern bcm_static_buf_t *bcm_static_buf;
+
+#ifdef DHD_USE_STATIC_CTRLBUF
+#define STATIC_PKT_4PAGE_NUM   0
+#define DHD_SKB_MAX_BUFSIZE    DHD_SKB_2PAGE_BUFSIZE
+#elif defined(ENHANCED_STATIC_BUF)
+#define STATIC_PKT_4PAGE_NUM   1
+#define DHD_SKB_MAX_BUFSIZE    DHD_SKB_4PAGE_BUFSIZE
+#else
+#define STATIC_PKT_4PAGE_NUM   0
+#define DHD_SKB_MAX_BUFSIZE    DHD_SKB_2PAGE_BUFSIZE
+#endif /* DHD_USE_STATIC_CTRLBUF */
+
+#ifdef DHD_USE_STATIC_CTRLBUF
+#define STATIC_PKT_1PAGE_NUM   0
+#define STATIC_PKT_2PAGE_NUM   128
+#else
+#define STATIC_PKT_1PAGE_NUM   8
+#define STATIC_PKT_2PAGE_NUM   8
+#endif /* DHD_USE_STATIC_CTRLBUF */
+
+#define STATIC_PKT_1_2PAGE_NUM \
+       ((STATIC_PKT_1PAGE_NUM) + (STATIC_PKT_2PAGE_NUM))
+#define STATIC_PKT_MAX_NUM     \
+       ((STATIC_PKT_1_2PAGE_NUM) + (STATIC_PKT_4PAGE_NUM))
+
+typedef struct bcm_static_pkt {
+#ifdef DHD_USE_STATIC_CTRLBUF
+       struct sk_buff *skb_8k[STATIC_PKT_2PAGE_NUM];
+       unsigned char pkt_invalid[STATIC_PKT_2PAGE_NUM];
+       spinlock_t osl_pkt_lock;
+       uint32 last_allocated_index;
+#else
+       struct sk_buff *skb_4k[STATIC_PKT_1PAGE_NUM];
+       struct sk_buff *skb_8k[STATIC_PKT_2PAGE_NUM];
+#ifdef ENHANCED_STATIC_BUF
+       struct sk_buff *skb_16k;
+#endif /* ENHANCED_STATIC_BUF */
+       struct semaphore osl_pkt_sem;
+#endif /* DHD_USE_STATIC_CTRLBUF */
+       unsigned char pkt_use[STATIC_PKT_MAX_NUM];
+} bcm_static_pkt_t;
+
+extern bcm_static_pkt_t *bcm_static_skb;
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+typedef struct bcm_mem_link {
+       struct bcm_mem_link *prev;
+       struct bcm_mem_link *next;
+       uint    size;
+       int     line;
+       void    *osh;
+       char    file[BCM_MEM_FILENAME_LEN];
+} bcm_mem_link_t;
+
+struct osl_cmn_info {
+       atomic_t malloced;
+       atomic_t pktalloced;    /* Number of allocated packet buffers */
+       spinlock_t dbgmem_lock;
+       bcm_mem_link_t *dbgmem_list;
+       bcm_mem_link_t *dbgvmem_list;
+       spinlock_t pktalloc_lock;
+       atomic_t refcount; /* Number of references to this shared structure. */
+};
+typedef struct osl_cmn_info osl_cmn_t;
+
+#if defined(AXI_TIMEOUTS_NIC)
+typedef uint32 (*bpt_cb_fn)(void *ctx, void *addr);
+#endif /* AXI_TIMEOUTS_NIC */
+
+struct osl_info {
+       osl_pubinfo_t pub;
+       uint32  flags;          /* If specific cases to be handled in the OSL */
+       uint magic;
+       void *pdev;
+       uint failed;
+       uint bustype;
+       osl_cmn_t *cmn; /* Common OSL related data shred between two OSH's */
+
+       /* for host drivers, a bus handle is needed when reading from and/or writing to dongle
+        * registeres, however ai/si utilities only passes osh handle to R_REG and W_REG. as
+        * a work around, save the bus handle here
+        */
+       void *bus_handle;
+#if defined(AXI_TIMEOUTS_NIC)
+       bpt_cb_fn bpt_cb;
+       void *sih;
+#endif /* AXI_TIMEOUTS_NIC */
+#ifdef USE_DMA_LOCK
+       spinlock_t dma_lock;
+       bool dma_lock_bh;
+#endif /* USE_DMA_LOCK */
+#ifdef DHD_MAP_LOGGING
+       void *dhd_map_log;
+       void *dhd_unmap_log;
+#endif /* DHD_MAP_LOGGING */
+};
+
+#endif /* _LINUX_OSL_PRIV_H_ */
diff --git a/bcmdhd.101.10.240.x/linux_pkt.c b/bcmdhd.101.10.240.x/linux_pkt.c
new file mode 100644 (file)
index 0000000..b2b0a8d
--- /dev/null
@@ -0,0 +1,613 @@
+/*
+ * Linux Packet (skb) interface
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <typedefs.h>
+#include <bcmendian.h>
+#include <linuxver.h>
+#include <bcmdefs.h>
+
+#include <linux/random.h>
+
+#include <osl.h>
+#include <bcmutils.h>
+#include <pcicfg.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+
+#include <linux/fs.h>
+#include "linux_osl_priv.h"
+
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+
+bcm_static_buf_t *bcm_static_buf = 0;
+bcm_static_pkt_t *bcm_static_skb = 0;
+
+void* wifi_platform_prealloc(void *adapter, int section, unsigned long size);
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+#ifdef BCM_OBJECT_TRACE
+/* don't clear the first 4 byte that is the pkt sn */
+#define OSL_PKTTAG_CLEAR(p) \
+do { \
+       struct sk_buff *s = (struct sk_buff *)(p); \
+       uint tagsz = sizeof(s->cb); \
+       ASSERT(OSL_PKTTAG_SZ <= tagsz); \
+       memset(s->cb + 4, 0, tagsz - 4); \
+} while (0)
+#else
+#define OSL_PKTTAG_CLEAR(p) \
+do { \
+       struct sk_buff *s = (struct sk_buff *)(p); \
+       uint tagsz = sizeof(s->cb); \
+       ASSERT(OSL_PKTTAG_SZ <= tagsz); \
+       memset(s->cb, 0, tagsz); \
+} while (0)
+#endif /* BCM_OBJECT_TRACE */
+
+int osl_static_mem_init(osl_t *osh, void *adapter)
+{
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+               if (!bcm_static_buf && adapter) {
+                       if (!(bcm_static_buf = (bcm_static_buf_t *)wifi_platform_prealloc(adapter,
+                               DHD_PREALLOC_OSL_BUF, STATIC_BUF_SIZE + STATIC_BUF_TOTAL_LEN))) {
+                               printk("can not alloc static buf!\n");
+                               bcm_static_skb = NULL;
+                               ASSERT(osh->magic == OS_HANDLE_MAGIC);
+                               return -ENOMEM;
+                       } else {
+                               printk("succeed to alloc static buf\n");
+                       }
+
+                       spin_lock_init(&bcm_static_buf->static_lock);
+
+                       bcm_static_buf->buf_ptr = (unsigned char *)bcm_static_buf + STATIC_BUF_SIZE;
+               }
+
+#if defined(BCMSDIO) || defined(DHD_USE_STATIC_CTRLBUF)
+               if (!bcm_static_skb && adapter) {
+                       int i;
+                       void *skb_buff_ptr = 0;
+                       bcm_static_skb = (bcm_static_pkt_t *)((char *)bcm_static_buf + 2048);
+                       skb_buff_ptr = wifi_platform_prealloc(adapter, DHD_PREALLOC_SKB_BUF, 0);
+                       if (!skb_buff_ptr) {
+                               printk("cannot alloc static buf!\n");
+                               bcm_static_buf = NULL;
+                               bcm_static_skb = NULL;
+                               ASSERT(osh->magic == OS_HANDLE_MAGIC);
+                               return -ENOMEM;
+                       }
+
+                       bcopy(skb_buff_ptr, bcm_static_skb, sizeof(struct sk_buff *) *
+                               (STATIC_PKT_MAX_NUM));
+                       for (i = 0; i < STATIC_PKT_MAX_NUM; i++) {
+                               bcm_static_skb->pkt_use[i] = 0;
+                       }
+
+#ifdef DHD_USE_STATIC_CTRLBUF
+                       spin_lock_init(&bcm_static_skb->osl_pkt_lock);
+                       bcm_static_skb->last_allocated_index = 0;
+#else
+                       sema_init(&bcm_static_skb->osl_pkt_sem, 1);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+               }
+#endif /* BCMSDIO || DHD_USE_STATIC_CTRLBUF */
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+       return 0;
+}
+
+int osl_static_mem_deinit(osl_t *osh, void *adapter)
+{
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+       if (bcm_static_buf) {
+               bcm_static_buf = 0;
+       }
+#ifdef BCMSDIO
+       if (bcm_static_skb) {
+               bcm_static_skb = 0;
+       }
+#endif /* BCMSDIO */
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+       return 0;
+}
+
+static struct sk_buff *
+BCMFASTPATH(osl_alloc_skb)(osl_t *osh, unsigned int len)
+{
+       struct sk_buff *skb;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)
+       gfp_t flags = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
+
+#ifdef DHD_USE_ATOMIC_PKTGET
+       flags = GFP_ATOMIC;
+#endif /* DHD_USE_ATOMIC_PKTGET */
+       skb = __dev_alloc_skb(len, flags);
+#else
+       skb = dev_alloc_skb(len);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25) */
+
+       return skb;
+}
+
+/* Convert a driver packet to native(OS) packet
+ * In the process, packettag is zeroed out before sending up
+ * IP code depends on skb->cb to be setup correctly with various options
+ * In our case, that means it should be 0
+ */
+struct sk_buff *
+BCMFASTPATH(osl_pkt_tonative)(osl_t *osh, void *pkt)
+{
+       struct sk_buff *nskb;
+
+       if (osh->pub.pkttag)
+               OSL_PKTTAG_CLEAR(pkt);
+
+       /* Decrement the packet counter */
+       for (nskb = (struct sk_buff *)pkt; nskb; nskb = nskb->next) {
+               atomic_sub(PKTISCHAINED(nskb) ? PKTCCNT(nskb) : 1, &osh->cmn->pktalloced);
+
+       }
+       return (struct sk_buff *)pkt;
+}
+
+/* Convert a native(OS) packet to driver packet.
+ * In the process, native packet is destroyed, there is no copying
+ * Also, a packettag is zeroed out
+ */
+void *
+BCMFASTPATH(osl_pkt_frmnative)(osl_t *osh, void *pkt)
+{
+       struct sk_buff *cskb;
+       struct sk_buff *nskb;
+       unsigned long pktalloced = 0;
+
+       if (osh->pub.pkttag)
+               OSL_PKTTAG_CLEAR(pkt);
+
+       /* walk the PKTCLINK() list */
+       for (cskb = (struct sk_buff *)pkt;
+            cskb != NULL;
+            cskb = PKTISCHAINED(cskb) ? PKTCLINK(cskb) : NULL) {
+
+               /* walk the pkt buffer list */
+               for (nskb = cskb; nskb; nskb = nskb->next) {
+
+                       /* Increment the packet counter */
+                       pktalloced++;
+
+                       /* clean the 'prev' pointer
+                        * Kernel 3.18 is leaving skb->prev pointer set to skb
+                        * to indicate a non-fragmented skb
+                        */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+                       nskb->prev = NULL;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0) */
+
+               }
+       }
+
+       /* Increment the packet counter */
+       atomic_add(pktalloced, &osh->cmn->pktalloced);
+
+       return (void *)pkt;
+}
+
+/* Return a new packet. zero out pkttag */
+#ifdef BCM_OBJECT_TRACE
+void *
+BCMFASTPATH(linux_pktget)(osl_t *osh, uint len, int line, const char *caller)
+#else
+void *
+BCMFASTPATH(linux_pktget)(osl_t *osh, uint len)
+#endif /* BCM_OBJECT_TRACE */
+{
+       struct sk_buff *skb;
+       uchar num = 0;
+       if (lmtest != FALSE) {
+               get_random_bytes(&num, sizeof(uchar));
+               if ((num + 1) <= (256 * lmtest / 100))
+                       return NULL;
+       }
+
+       if ((skb = osl_alloc_skb(osh, len))) {
+               skb->tail += len;
+               skb->len  += len;
+               skb->priority = 0;
+
+               atomic_inc(&osh->cmn->pktalloced);
+#ifdef BCM_OBJECT_TRACE
+               bcm_object_trace_opr(skb, BCM_OBJDBG_ADD_PKT, caller, line);
+#endif /* BCM_OBJECT_TRACE */
+       }
+
+       return ((void*) skb);
+}
+
+/* Free the driver packet. Free the tag if present */
+#ifdef BCM_OBJECT_TRACE
+void
+BCMFASTPATH(linux_pktfree)(osl_t *osh, void *p, bool send, int line, const char *caller)
+#else
+void
+BCMFASTPATH(linux_pktfree)(osl_t *osh, void *p, bool send)
+#endif /* BCM_OBJECT_TRACE */
+{
+       struct sk_buff *skb, *nskb;
+       if (osh == NULL)
+               return;
+
+       skb = (struct sk_buff*) p;
+
+       if (send) {
+               if (osh->pub.tx_fn) {
+                       osh->pub.tx_fn(osh->pub.tx_ctx, p, 0);
+               }
+       } else {
+               if (osh->pub.rx_fn) {
+                       osh->pub.rx_fn(osh->pub.rx_ctx, p);
+               }
+       }
+
+       PKTDBG_TRACE(osh, (void *) skb, PKTLIST_PKTFREE);
+
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_CTRLBUF)
+       if (skb && (skb->mac_len == PREALLOC_USED_MAGIC)) {
+               printk("%s: pkt %p is from static pool\n",
+                       __FUNCTION__, p);
+               dump_stack();
+               return;
+       }
+
+       if (skb && (skb->mac_len == PREALLOC_FREE_MAGIC)) {
+               printk("%s: pkt %p is from static pool and not in used\n",
+                       __FUNCTION__, p);
+               dump_stack();
+               return;
+       }
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_CTRLBUF */
+
+       /* perversion: we use skb->next to chain multi-skb packets */
+       while (skb) {
+               nskb = skb->next;
+               skb->next = NULL;
+
+#ifdef BCM_OBJECT_TRACE
+               bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE, caller, line);
+#endif /* BCM_OBJECT_TRACE */
+
+               if (skb->destructor) {
+                       /* cannot kfree_skb() on hard IRQ (net/core/skbuff.c) if
+                        * destructor exists
+                        */
+                       dev_kfree_skb_any(skb);
+               } else {
+                       /* can free immediately (even in_irq()) if destructor
+                        * does not exist
+                        */
+                       dev_kfree_skb(skb);
+               }
+               atomic_dec(&osh->cmn->pktalloced);
+               skb = nskb;
+       }
+}
+
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+void*
+osl_pktget_static(osl_t *osh, uint len)
+{
+       int i = 0;
+       struct sk_buff *skb;
+#ifdef DHD_USE_STATIC_CTRLBUF
+       unsigned long flags;
+#endif /* DHD_USE_STATIC_CTRLBUF */
+
+       if (!bcm_static_skb)
+               return linux_pktget(osh, len);
+
+       if (len > DHD_SKB_MAX_BUFSIZE) {
+               printk("%s: attempt to allocate huge packet (0x%x)\n", __FUNCTION__, len);
+               return linux_pktget(osh, len);
+       }
+
+#ifdef DHD_USE_STATIC_CTRLBUF
+       OSL_STATIC_PKT_LOCK(&bcm_static_skb->osl_pkt_lock, flags);
+
+       if (len <= DHD_SKB_2PAGE_BUFSIZE) {
+               uint32 index;
+               for (i = 0; i < STATIC_PKT_2PAGE_NUM; i++) {
+                       index = bcm_static_skb->last_allocated_index % STATIC_PKT_2PAGE_NUM;
+                       bcm_static_skb->last_allocated_index++;
+                       if (bcm_static_skb->skb_8k[index] &&
+                               bcm_static_skb->pkt_use[index] == 0) {
+                               break;
+                       }
+               }
+
+               if (i < STATIC_PKT_2PAGE_NUM) {
+                       bcm_static_skb->pkt_use[index] = 1;
+                       skb = bcm_static_skb->skb_8k[index];
+                       skb->data = skb->head;
+#ifdef NET_SKBUFF_DATA_USES_OFFSET
+                       skb_set_tail_pointer(skb, PKT_HEADROOM_DEFAULT);
+#else
+                       skb->tail = skb->data + PKT_HEADROOM_DEFAULT;
+#endif /* NET_SKBUFF_DATA_USES_OFFSET */
+                       skb->data += PKT_HEADROOM_DEFAULT;
+                       skb->cloned = 0;
+                       skb->priority = 0;
+#ifdef NET_SKBUFF_DATA_USES_OFFSET
+                       skb_set_tail_pointer(skb, len);
+#else
+                       skb->tail = skb->data + len;
+#endif /* NET_SKBUFF_DATA_USES_OFFSET */
+                       skb->len = len;
+                       skb->mac_len = PREALLOC_USED_MAGIC;
+                       OSL_STATIC_PKT_UNLOCK(&bcm_static_skb->osl_pkt_lock, flags);
+                       return skb;
+               }
+       }
+
+       OSL_STATIC_PKT_UNLOCK(&bcm_static_skb->osl_pkt_lock, flags);
+       printk("%s: all static pkt in use!\n", __FUNCTION__);
+       return NULL;
+#else
+       down(&bcm_static_skb->osl_pkt_sem);
+
+       if (len <= DHD_SKB_1PAGE_BUFSIZE) {
+               for (i = 0; i < STATIC_PKT_1PAGE_NUM; i++) {
+                       if (bcm_static_skb->skb_4k[i] &&
+                               bcm_static_skb->pkt_use[i] == 0) {
+                               break;
+                       }
+               }
+
+               if (i != STATIC_PKT_1PAGE_NUM) {
+                       bcm_static_skb->pkt_use[i] = 1;
+
+                       skb = bcm_static_skb->skb_4k[i];
+#ifdef NET_SKBUFF_DATA_USES_OFFSET
+                       skb_set_tail_pointer(skb, len);
+#else
+                       skb->tail = skb->data + len;
+#endif /* NET_SKBUFF_DATA_USES_OFFSET */
+                       skb->len = len;
+
+                       up(&bcm_static_skb->osl_pkt_sem);
+                       return skb;
+               }
+       }
+
+       if (len <= DHD_SKB_2PAGE_BUFSIZE) {
+               for (i = STATIC_PKT_1PAGE_NUM; i < STATIC_PKT_1_2PAGE_NUM; i++) {
+                       if (bcm_static_skb->skb_8k[i - STATIC_PKT_1PAGE_NUM] &&
+                               bcm_static_skb->pkt_use[i] == 0) {
+                               break;
+                       }
+               }
+
+               if ((i >= STATIC_PKT_1PAGE_NUM) && (i < STATIC_PKT_1_2PAGE_NUM)) {
+                       bcm_static_skb->pkt_use[i] = 1;
+                       skb = bcm_static_skb->skb_8k[i - STATIC_PKT_1PAGE_NUM];
+#ifdef NET_SKBUFF_DATA_USES_OFFSET
+                       skb_set_tail_pointer(skb, len);
+#else
+                       skb->tail = skb->data + len;
+#endif /* NET_SKBUFF_DATA_USES_OFFSET */
+                       skb->len = len;
+
+                       up(&bcm_static_skb->osl_pkt_sem);
+                       return skb;
+               }
+       }
+
+#if defined(ENHANCED_STATIC_BUF)
+       if (bcm_static_skb->skb_16k &&
+               bcm_static_skb->pkt_use[STATIC_PKT_MAX_NUM - 1] == 0) {
+               bcm_static_skb->pkt_use[STATIC_PKT_MAX_NUM - 1] = 1;
+
+               skb = bcm_static_skb->skb_16k;
+#ifdef NET_SKBUFF_DATA_USES_OFFSET
+               skb_set_tail_pointer(skb, len);
+#else
+               skb->tail = skb->data + len;
+#endif /* NET_SKBUFF_DATA_USES_OFFSET */
+               skb->len = len;
+
+               up(&bcm_static_skb->osl_pkt_sem);
+               return skb;
+       }
+#endif /* ENHANCED_STATIC_BUF */
+
+       up(&bcm_static_skb->osl_pkt_sem);
+       printk("%s: all static pkt in use!\n", __FUNCTION__);
+       return linux_pktget(osh, len);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+}
+
+void
+osl_pktfree_static(osl_t *osh, void *p, bool send)
+{
+       int i;
+#ifdef DHD_USE_STATIC_CTRLBUF
+       struct sk_buff *skb = (struct sk_buff *)p;
+       unsigned long flags;
+#endif /* DHD_USE_STATIC_CTRLBUF */
+
+       if (!p) {
+               return;
+       }
+
+       if (!bcm_static_skb) {
+               linux_pktfree(osh, p, send);
+               return;
+       }
+
+#ifdef DHD_USE_STATIC_CTRLBUF
+       OSL_STATIC_PKT_LOCK(&bcm_static_skb->osl_pkt_lock, flags);
+
+       for (i = 0; i < STATIC_PKT_2PAGE_NUM; i++) {
+               if (p == bcm_static_skb->skb_8k[i]) {
+                       if (bcm_static_skb->pkt_use[i] == 0) {
+                               printk("%s: static pkt idx %d(%p) is double free\n",
+                                       __FUNCTION__, i, p);
+                       } else {
+                               bcm_static_skb->pkt_use[i] = 0;
+                       }
+
+                       if (skb->mac_len != PREALLOC_USED_MAGIC) {
+                               printk("%s: static pkt idx %d(%p) is not in used\n",
+                                       __FUNCTION__, i, p);
+                       }
+
+                       skb->mac_len = PREALLOC_FREE_MAGIC;
+                       OSL_STATIC_PKT_UNLOCK(&bcm_static_skb->osl_pkt_lock, flags);
+                       return;
+               }
+       }
+
+       OSL_STATIC_PKT_UNLOCK(&bcm_static_skb->osl_pkt_lock, flags);
+       printk("%s: packet %p does not exist in the pool\n", __FUNCTION__, p);
+#else
+       down(&bcm_static_skb->osl_pkt_sem);
+       for (i = 0; i < STATIC_PKT_1PAGE_NUM; i++) {
+               if (p == bcm_static_skb->skb_4k[i]) {
+                       bcm_static_skb->pkt_use[i] = 0;
+                       up(&bcm_static_skb->osl_pkt_sem);
+                       return;
+               }
+       }
+
+       for (i = STATIC_PKT_1PAGE_NUM; i < STATIC_PKT_1_2PAGE_NUM; i++) {
+               if (p == bcm_static_skb->skb_8k[i - STATIC_PKT_1PAGE_NUM]) {
+                       bcm_static_skb->pkt_use[i] = 0;
+                       up(&bcm_static_skb->osl_pkt_sem);
+                       return;
+               }
+       }
+#ifdef ENHANCED_STATIC_BUF
+       if (p == bcm_static_skb->skb_16k) {
+               bcm_static_skb->pkt_use[STATIC_PKT_MAX_NUM - 1] = 0;
+               up(&bcm_static_skb->osl_pkt_sem);
+               return;
+       }
+#endif
+       up(&bcm_static_skb->osl_pkt_sem);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+       linux_pktfree(osh, p, send);
+}
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+/* Clone a packet.
+ * The pkttag contents are NOT cloned.
+ */
+void *
+#ifdef BCM_OBJECT_TRACE
+osl_pktdup(osl_t *osh, void *skb, int line, const char *caller)
+#else
+osl_pktdup(osl_t *osh, void *skb)
+#endif /* BCM_OBJECT_TRACE */
+{
+       void * p;
+
+       ASSERT(!PKTISCHAINED(skb));
+
+       if ((p = skb_clone((struct sk_buff *)skb, GFP_ATOMIC)) == NULL)
+               return NULL;
+
+       /* skb_clone copies skb->cb.. we don't want that */
+       if (osh->pub.pkttag)
+               OSL_PKTTAG_CLEAR(p);
+
+       /* Increment the packet counter */
+       atomic_inc(&osh->cmn->pktalloced);
+#ifdef BCM_OBJECT_TRACE
+       bcm_object_trace_opr(p, BCM_OBJDBG_ADD_PKT, caller, line);
+#endif /* BCM_OBJECT_TRACE */
+
+       return (p);
+}
+
+/*
+ * BINOSL selects the slightly slower function-call-based binary compatible osl.
+ */
+
+uint
+osl_pktalloced(osl_t *osh)
+{
+       if (atomic_read(&osh->cmn->refcount) == 1)
+               return (atomic_read(&osh->cmn->pktalloced));
+       else
+               return 0;
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0) && defined(TSQ_MULTIPLIER)
+#include <linux/kallsyms.h>
+#include <net/sock.h>
+#define DHD_TCP_LIMIT_OUTPUT_BYTES (16 * 1024 * 1024)
+void
+osl_pkt_orphan_partial(struct sk_buff *skb, int tsq)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 19, 0) && defined(DHD_TCP_LIMIT_OUTPUT)
+       if (skb->sk) {
+               sock_net(skb->sk)->ipv4.sysctl_tcp_limit_output_bytes = DHD_TCP_LIMIT_OUTPUT_BYTES;
+       }
+#else
+       uint32 fraction;
+       static void *p_tcp_wfree = NULL;
+
+       if (tsq <= 0)
+               return;
+
+       if (!skb->destructor || skb->destructor == sock_wfree)
+               return;
+
+       if (unlikely(!p_tcp_wfree)) {
+               /* this is a hack to get tcp_wfree pointer since it's not
+                * exported. There are two possible call back function pointer
+                * stored in skb->destructor: tcp_wfree and sock_wfree.
+                * This expansion logic should only apply to TCP traffic which
+                * uses tcp_wfree as skb destructor
+                */
+               char sym[KSYM_SYMBOL_LEN];
+               sprint_symbol(sym, (unsigned long)skb->destructor);
+               sym[9] = 0;
+               if (!strcmp(sym, "tcp_wfree"))
+                       p_tcp_wfree = skb->destructor;
+               else
+                       return;
+       }
+
+       if (unlikely(skb->destructor != p_tcp_wfree || !skb->sk))
+               return;
+
+       /* abstract a certain portion of skb truesize from the socket
+        * sk_wmem_alloc to allow more skb can be allocated for this
+        * socket for better cusion meeting WiFi device requirement
+        */
+       fraction = skb->truesize * (tsq - 1) / tsq;
+       skb->truesize -= fraction;
+       atomic_sub(fraction, (atomic_t *)&skb->sk->sk_wmem_alloc);
+       skb_orphan(skb);
+#endif /* LINUX_VERSION >= 4.19.0 && DHD_TCP_LIMIT_OUTPUT */
+}
+#endif /* LINUX_VERSION >= 3.6.0 && TSQ_MULTIPLIER */
diff --git a/bcmdhd.101.10.240.x/pcie_core.c b/bcmdhd.101.10.240.x/pcie_core.c
new file mode 100644 (file)
index 0000000..89435c4
--- /dev/null
@@ -0,0 +1,172 @@
+/** @file pcie_core.c
+ *
+ * Contains PCIe related functions that are shared between different driver models (e.g. firmware
+ * builds, DHD builds, BMAC builds), in order to avoid code duplication.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <siutils.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <pcicfg.h>
+#include "pcie_core.h"
+#include <bcmdevs.h>
+
+/* local prototypes */
+
+/* local variables */
+
+/* function definitions */
+
+#ifdef BCMDRIVER /* this workaround can only be run on the host side since it resets \
+       the chip */
+
+/* To avoid build error for dongle standalone test, define CAN_SLEEP if not defined */
+#ifndef CAN_SLEEP
+#define CAN_SLEEP()    (FALSE)
+#endif
+
+#ifndef USEC_PER_MSEC
+#define USEC_PER_MSEC  1000
+#endif
+
+/* wd_mask/wd_val is only for chipc_corerev >= 65 */
+void pcie_watchdog_reset(osl_t *osh, si_t *sih, uint32 wd_mask, uint32 wd_val)
+{
+       uint32 val, i, lsc;
+       uint16 cfg_offset[] = {PCIECFGREG_STATUS_CMD, PCIECFGREG_PM_CSR,
+               PCIECFGREG_MSI_CAP, PCIECFGREG_MSI_ADDR_L,
+               PCIECFGREG_MSI_ADDR_H, PCIECFGREG_MSI_DATA,
+               PCIECFGREG_LINK_STATUS_CTRL2, PCIECFGREG_RBAR_CTRL,
+               PCIECFGREG_PML1_SUB_CTRL1, PCIECFGREG_REG_BAR2_CONFIG,
+               PCIECFGREG_REG_BAR3_CONFIG};
+       sbpcieregs_t *pcieregs = NULL;
+       uint32 origidx = si_coreidx(sih);
+
+       /* Switch to PCIE2 core */
+       pcieregs = (sbpcieregs_t *)si_setcore(sih, PCIE2_CORE_ID, 0);
+       BCM_REFERENCE(pcieregs);
+       ASSERT(pcieregs != NULL);
+
+       /* Disable/restore ASPM Control to protect the watchdog reset */
+       W_REG(osh, &pcieregs->configaddr, PCIECFGREG_LINK_STATUS_CTRL);
+       lsc = R_REG(osh, &pcieregs->configdata);
+       val = lsc & (~PCIE_ASPM_ENAB);
+       W_REG(osh, &pcieregs->configdata, val);
+
+       if (CCREV(sih->ccrev) >= 65) {
+               si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, watchdog), wd_mask, wd_val);
+               si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, watchdog), WD_COUNTER_MASK, 4);
+               CAN_SLEEP() ? OSL_SLEEP(2) : OSL_DELAY(2 * USEC_PER_MSEC); /* 2 ms */
+               val = si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, intstatus), 0, 0);
+               si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, intstatus),
+                       wd_mask, val & wd_mask);
+       } else {
+               si_corereg_writeonly(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, watchdog), ~0, 4);
+               /* Read a config space to make sure the above write gets flushed on PCIe bus */
+               val = OSL_PCI_READ_CONFIG(osh, PCI_CFG_VID, sizeof(uint32));
+               CAN_SLEEP() ? OSL_SLEEP(100) : OSL_DELAY(100 * USEC_PER_MSEC); /* 100 ms */
+       }
+
+       W_REG(osh, &pcieregs->configaddr, PCIECFGREG_LINK_STATUS_CTRL);
+       W_REG(osh, &pcieregs->configdata, lsc);
+
+       if (sih->buscorerev <= 13) {
+               /* Write configuration registers back to the shadow registers
+                * cause shadow registers are cleared out after watchdog reset.
+                */
+               for (i = 0; i < ARRAYSIZE(cfg_offset); i++) {
+                       W_REG(osh, &pcieregs->configaddr, cfg_offset[i]);
+                       val = R_REG(osh, &pcieregs->configdata);
+                       W_REG(osh, &pcieregs->configdata, val);
+               }
+       }
+       si_setcoreidx(sih, origidx);
+}
+
+/* CRWLPCIEGEN2-117 pcie_pipe_Iddq should be controlled
+ * by the L12 state from MAC to save power by putting the
+ * SerDes analog in IDDQ mode
+ */
+void  pcie_serdes_iddqdisable(osl_t *osh, si_t *sih, sbpcieregs_t *sbpcieregs)
+{
+       sbpcieregs_t *pcie = NULL;
+       uint crwlpciegen2_117_disable = 0;
+       uint32 origidx = si_coreidx(sih);
+
+       crwlpciegen2_117_disable = PCIE_PipeIddqDisable0 | PCIE_PipeIddqDisable1;
+       /* Switch to PCIE2 core */
+       pcie = (sbpcieregs_t *)si_setcore(sih, PCIE2_CORE_ID, 0);
+       BCM_REFERENCE(pcie);
+       ASSERT(pcie != NULL);
+
+       OR_REG(osh, &sbpcieregs->control,
+               crwlpciegen2_117_disable);
+
+       si_setcoreidx(sih, origidx);
+}
+
+#define PCIE_PMCR_REFUP_MASK 0x3f0001e0
+#define PCIE_PMCR_REFEXT_MASK 0x400000
+#define PCIE_PMCR_REFUP_100US 0x38000080
+#define PCIE_PMCR_REFEXT_100US 0x400000
+
+/* Set PCIE TRefUp time to 100us */
+void pcie_set_trefup_time_100us(si_t *sih)
+{
+       si_corereg(sih, sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, configaddr), ~0, PCI_PMCR_REFUP);
+       si_corereg(sih, sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, configdata), PCIE_PMCR_REFUP_MASK, PCIE_PMCR_REFUP_100US);
+
+       si_corereg(sih, sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, configaddr), ~0, PCI_PMCR_REFUP_EXT);
+       si_corereg(sih, sih->buscoreidx,
+               OFFSETOF(sbpcieregs_t, configdata), PCIE_PMCR_REFEXT_MASK, PCIE_PMCR_REFEXT_100US);
+}
+
+uint32
+pcie_cto_to_thresh_default(uint corerev)
+{
+       return REV_GE_69(corerev) ?
+                       PCIE_CTO_TO_THRESH_DEFAULT_REV69 : PCIE_CTO_TO_THRESH_DEFAULT;
+}
+
+uint32
+pcie_corereg(osl_t *osh, volatile void *regs, uint32 offset, uint32 mask, uint32 val)
+{
+       volatile uint32 *regsva =
+               (volatile uint32 *)((volatile char *)regs + PCI_16KB0_PCIREGS_OFFSET + offset);
+
+       if (mask || val) {
+               uint32 w = R_REG(osh, regsva);
+               w &= ~mask;
+               w |= val;
+               W_REG(osh, regsva, w);
+       }
+       return (R_REG(osh, regsva));
+}
+
+#endif /* BCMDRIVER */
diff --git a/bcmdhd.101.10.240.x/sbutils.c b/bcmdhd.101.10.240.x/sbutils.c
new file mode 100644 (file)
index 0000000..80e74c5
--- /dev/null
@@ -0,0 +1,897 @@
+/*
+ * Misc utility routines for accessing chip-specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <bcmdevs.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <pcicfg.h>
+#include <sbpcmcia.h>
+
+#include "siutils_priv.h"
+
+/* local prototypes */
+static uint _sb_coreidx(const si_info_t *sii, uint32 sba);
+static uint _sb_scan(si_info_t *sii, uint32 sba, volatile void *regs, uint bus, uint32 sbba,
+                     uint ncores, uint devid);
+static uint32 _sb_coresba(const si_info_t *sii);
+static volatile void *_sb_setcoreidx(const si_info_t *sii, uint coreidx);
+#define        SET_SBREG(sii, r, mask, val)    \
+               W_SBREG((sii), (r), ((R_SBREG((sii), (r)) & ~(mask)) | (val)))
+#define        REGS2SB(va)     (sbconfig_t*) ((volatile int8*)(va) + SBCONFIGOFF)
+
+/* sonicsrev */
+#define        SONICS_2_2      (SBIDL_RV_2_2 >> SBIDL_RV_SHIFT)
+#define        SONICS_2_3      (SBIDL_RV_2_3 >> SBIDL_RV_SHIFT)
+
+/*
+ * Macros to read/write sbconfig registers.
+ */
+#define        R_SBREG(sii, sbr)       sb_read_sbreg((sii), (sbr))
+#define        W_SBREG(sii, sbr, v)    sb_write_sbreg((sii), (sbr), (v))
+#define        AND_SBREG(sii, sbr, v)  W_SBREG((sii), (sbr), (R_SBREG((sii), (sbr)) & (v)))
+#define        OR_SBREG(sii, sbr, v)   W_SBREG((sii), (sbr), (R_SBREG((sii), (sbr)) | (v)))
+
+static uint32
+sb_read_sbreg(const si_info_t *sii, volatile uint32 *sbr)
+{
+       return R_REG(sii->osh, sbr);
+}
+
+static void
+sb_write_sbreg(const si_info_t *sii, volatile uint32 *sbr, uint32 v)
+{
+       W_REG(sii->osh, sbr, v);
+}
+
+uint
+sb_coreid(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       sbconfig_t *sb = REGS2SB(sii->curmap);
+
+       return ((R_SBREG(sii, &sb->sbidhigh) & SBIDH_CC_MASK) >> SBIDH_CC_SHIFT);
+}
+
+uint
+sb_intflag(si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       volatile void *corereg;
+       sbconfig_t *sb;
+       uint origidx, intflag;
+       bcm_int_bitmask_t intr_val;
+
+       INTR_OFF(sii, &intr_val);
+       origidx = si_coreidx(sih);
+       corereg = si_setcore(sih, CC_CORE_ID, 0);
+       ASSERT(corereg != NULL);
+       sb = REGS2SB(corereg);
+       intflag = R_SBREG(sii, &sb->sbflagst);
+       sb_setcoreidx(sih, origidx);
+       INTR_RESTORE(sii, &intr_val);
+
+       return intflag;
+}
+
+uint
+sb_flag(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       sbconfig_t *sb = REGS2SB(sii->curmap);
+
+       return R_SBREG(sii, &sb->sbtpsflag) & SBTPS_NUM0_MASK;
+}
+
+void
+sb_setint(const si_t *sih, int siflag)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       sbconfig_t *sb = REGS2SB(sii->curmap);
+       uint32 vec;
+
+       if (siflag == -1)
+               vec = 0;
+       else
+               vec = 1 << siflag;
+       W_SBREG(sii, &sb->sbintvec, vec);
+}
+
+/* return core index of the core with address 'sba' */
+static uint
+_sb_coreidx(const si_info_t *sii, uint32 sba)
+{
+       uint i;
+       const si_cores_info_t *cores_info = (const si_cores_info_t *)sii->cores_info;
+
+       for (i = 0; i < sii->numcores; i ++)
+               if (sba == cores_info->coresba[i])
+                       return i;
+       return BADIDX;
+}
+
+/* return core address of the current core */
+static uint32
+_sb_coresba(const si_info_t *sii)
+{
+       uint32 sbaddr;
+
+       switch (BUSTYPE(sii->pub.bustype)) {
+       case SI_BUS: {
+               sbconfig_t *sb = REGS2SB(sii->curmap);
+               sbaddr = sb_base(R_SBREG(sii, &sb->sbadmatch0));
+               break;
+       }
+
+       case PCI_BUS:
+               sbaddr = OSL_PCI_READ_CONFIG(sii->osh, PCI_BAR0_WIN, sizeof(uint32));
+               break;
+
+#ifdef BCMSDIO
+       case SPI_BUS:
+       case SDIO_BUS:
+               sbaddr = (uint32)(uintptr)sii->curmap;
+               break;
+#endif
+
+       default:
+               sbaddr = BADCOREADDR;
+               break;
+       }
+
+       return sbaddr;
+}
+
+uint
+sb_corevendor(const si_t *sih)
+{
+       const si_info_t *sii;
+       sbconfig_t *sb;
+
+       sii = SI_INFO(sih);
+       sb = REGS2SB(sii->curmap);
+
+       return ((R_SBREG(sii, &sb->sbidhigh) & SBIDH_VC_MASK) >> SBIDH_VC_SHIFT);
+}
+
+uint
+sb_corerev(const si_t *sih)
+{
+       const si_info_t *sii;
+       sbconfig_t *sb;
+       uint sbidh;
+
+       sii = SI_INFO(sih);
+       sb = REGS2SB(sii->curmap);
+       sbidh = R_SBREG(sii, &sb->sbidhigh);
+
+       return (SBCOREREV(sbidh));
+}
+
+/* set core-specific control flags */
+void
+sb_core_cflags_wo(const si_t *sih, uint32 mask, uint32 val)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       sbconfig_t *sb = REGS2SB(sii->curmap);
+       uint32 w;
+
+       ASSERT((val & ~mask) == 0);
+
+       /* mask and set */
+       w = (R_SBREG(sii, &sb->sbtmstatelow) & ~(mask << SBTML_SICF_SHIFT)) |
+               (val << SBTML_SICF_SHIFT);
+       W_SBREG(sii, &sb->sbtmstatelow, w);
+}
+
+/* set/clear core-specific control flags */
+uint32
+sb_core_cflags(const si_t *sih, uint32 mask, uint32 val)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       sbconfig_t *sb = REGS2SB(sii->curmap);
+       uint32 w;
+
+       ASSERT((val & ~mask) == 0);
+
+       /* mask and set */
+       if (mask || val) {
+               w = (R_SBREG(sii, &sb->sbtmstatelow) & ~(mask << SBTML_SICF_SHIFT)) |
+                       (val << SBTML_SICF_SHIFT);
+               W_SBREG(sii, &sb->sbtmstatelow, w);
+       }
+
+       /* return the new value
+        * for write operation, the following readback ensures the completion of write opration.
+        */
+       return (R_SBREG(sii, &sb->sbtmstatelow) >> SBTML_SICF_SHIFT);
+}
+
+/* set/clear core-specific status flags */
+uint32
+sb_core_sflags(const si_t *sih, uint32 mask, uint32 val)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       sbconfig_t *sb = REGS2SB(sii->curmap);
+       uint32 w;
+
+       ASSERT((val & ~mask) == 0);
+       ASSERT((mask & ~SISF_CORE_BITS) == 0);
+
+       /* mask and set */
+       if (mask || val) {
+               w = (R_SBREG(sii, &sb->sbtmstatehigh) & ~(mask << SBTMH_SISF_SHIFT)) |
+                       (val << SBTMH_SISF_SHIFT);
+               W_SBREG(sii, &sb->sbtmstatehigh, w);
+       }
+
+       /* return the new value */
+       return (R_SBREG(sii, &sb->sbtmstatehigh) >> SBTMH_SISF_SHIFT);
+}
+
+bool
+sb_iscoreup(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       sbconfig_t *sb = REGS2SB(sii->curmap);
+
+       return ((R_SBREG(sii, &sb->sbtmstatelow) &
+                (SBTML_RESET | SBTML_REJ_MASK | (SICF_CLOCK_EN << SBTML_SICF_SHIFT))) ==
+               (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
+}
+
+/*
+ * Switch to 'coreidx', issue a single arbitrary 32bit register mask&set operation,
+ * switch back to the original core, and return the new value.
+ *
+ * When using the silicon backplane, no fidleing with interrupts or core switches are needed.
+ *
+ * Also, when using pci/pcie, we can optimize away the core switching for pci registers
+ * and (on newer pci cores) chipcommon registers.
+ */
+uint
+sb_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val)
+{
+       uint origidx = 0;
+       volatile uint32 *r = NULL;
+       uint w;
+       bcm_int_bitmask_t intr_val;
+       bool fast = FALSE;
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       ASSERT(GOODIDX(coreidx, sii->numcores));
+       ASSERT(regoff < SI_CORE_SIZE);
+       ASSERT((val & ~mask) == 0);
+
+       if (coreidx >= SI_MAXCORES)
+               return 0;
+
+       if (BUSTYPE(sii->pub.bustype) == SI_BUS) {
+               /* If internal bus, we can always get at everything */
+               fast = TRUE;
+               /* map if does not exist */
+               if (!cores_info->regs[coreidx]) {
+                       cores_info->regs[coreidx] = REG_MAP(cores_info->coresba[coreidx],
+                                                   SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->regs[coreidx]));
+               }
+               r = (volatile uint32 *)((volatile uchar *)cores_info->regs[coreidx] + regoff);
+       } else if (BUSTYPE(sii->pub.bustype) == PCI_BUS) {
+               /* If pci/pcie, we can get at pci/pcie regs and on newer cores to chipc */
+
+               if ((cores_info->coreid[coreidx] == CC_CORE_ID) && SI_FAST(sii)) {
+                       /* Chipc registers are mapped at 12KB */
+
+                       fast = TRUE;
+                       r = (volatile uint32 *)((volatile char *)sii->curmap +
+                                      PCI_16KB0_CCREGS_OFFSET + regoff);
+               } else if (sii->pub.buscoreidx == coreidx) {
+                       /* pci registers are at either in the last 2KB of an 8KB window
+                        * or, in pcie and pci rev 13 at 8KB
+                        */
+                       fast = TRUE;
+                       if (SI_FAST(sii))
+                               r = (volatile uint32 *)((volatile char *)sii->curmap +
+                                              PCI_16KB0_PCIREGS_OFFSET + regoff);
+                       else
+                               r = (volatile uint32 *)((volatile char *)sii->curmap +
+                                              ((regoff >= SBCONFIGOFF) ?
+                                               PCI_BAR0_PCISBR_OFFSET : PCI_BAR0_PCIREGS_OFFSET) +
+                                              regoff);
+               }
+       }
+
+       if (!fast) {
+               INTR_OFF(sii, &intr_val);
+
+               /* save current core index */
+               origidx = si_coreidx(&sii->pub);
+
+               /* switch core */
+               r = (volatile uint32*) ((volatile uchar*)sb_setcoreidx(&sii->pub, coreidx) +
+                              regoff);
+       }
+       ASSERT(r != NULL);
+
+       /* mask and set */
+       if (mask || val) {
+               if (regoff >= SBCONFIGOFF) {
+                       w = (R_SBREG(sii, r) & ~mask) | val;
+                       W_SBREG(sii, r, w);
+               } else {
+                       w = (R_REG(sii->osh, r) & ~mask) | val;
+                       W_REG(sii->osh, r, w);
+               }
+       }
+
+       /* readback */
+       if (regoff >= SBCONFIGOFF)
+               w = R_SBREG(sii, r);
+       else {
+               w = R_REG(sii->osh, r);
+       }
+
+       if (!fast) {
+               /* restore core index */
+               if (origidx != coreidx)
+                       sb_setcoreidx(&sii->pub, origidx);
+
+               INTR_RESTORE(sii, &intr_val);
+       }
+
+       return (w);
+}
+
+/*
+ * If there is no need for fiddling with interrupts or core switches (typically silicon
+ * back plane registers, pci registers and chipcommon registers), this function
+ * returns the register offset on this core to a mapped address. This address can
+ * be used for W_REG/R_REG directly.
+ *
+ * For accessing registers that would need a core switch, this function will return
+ * NULL.
+ */
+volatile uint32 *
+sb_corereg_addr(const si_t *sih, uint coreidx, uint regoff)
+{
+       volatile uint32 *r = NULL;
+       bool fast = FALSE;
+       const si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       ASSERT(GOODIDX(coreidx, sii->numcores));
+       ASSERT(regoff < SI_CORE_SIZE);
+
+       if (coreidx >= SI_MAXCORES)
+               return 0;
+
+       if (BUSTYPE(sii->pub.bustype) == SI_BUS) {
+               /* If internal bus, we can always get at everything */
+               fast = TRUE;
+               /* map if does not exist */
+               if (!cores_info->regs[coreidx]) {
+                       cores_info->regs[coreidx] = REG_MAP(cores_info->coresba[coreidx],
+                                                   SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->regs[coreidx]));
+               }
+               r = (volatile uint32 *)((volatile uchar *)cores_info->regs[coreidx] + regoff);
+       } else if (BUSTYPE(sii->pub.bustype) == PCI_BUS) {
+               /* If pci/pcie, we can get at pci/pcie regs and on newer cores to chipc */
+
+               if ((cores_info->coreid[coreidx] == CC_CORE_ID) && SI_FAST(sii)) {
+                       /* Chipc registers are mapped at 12KB */
+
+                       fast = TRUE;
+                       r = (volatile uint32 *)((volatile char *)sii->curmap +
+                                      PCI_16KB0_CCREGS_OFFSET + regoff);
+               } else if (sii->pub.buscoreidx == coreidx) {
+                       /* pci registers are at either in the last 2KB of an 8KB window
+                        * or, in pcie and pci rev 13 at 8KB
+                        */
+                       fast = TRUE;
+                       if (SI_FAST(sii))
+                               r = (volatile uint32 *)((volatile char *)sii->curmap +
+                                              PCI_16KB0_PCIREGS_OFFSET + regoff);
+                       else
+                               r = (volatile uint32 *)((volatile char *)sii->curmap +
+                                              ((regoff >= SBCONFIGOFF) ?
+                                               PCI_BAR0_PCISBR_OFFSET : PCI_BAR0_PCIREGS_OFFSET) +
+                                              regoff);
+               }
+       }
+
+       if (!fast)
+               return 0;
+
+       return (r);
+}
+
+/* Scan the enumeration space to find all cores starting from the given
+ * bus 'sbba'. Append coreid and other info to the lists in 'si'. 'sba'
+ * is the default core address at chip POR time and 'regs' is the virtual
+ * address that the default core is mapped at. 'ncores' is the number of
+ * cores expected on bus 'sbba'. It returns the total number of cores
+ * starting from bus 'sbba', inclusive.
+ */
+#define SB_MAXBUSES    2
+static uint
+_sb_scan(si_info_t *sii, uint32 sba, volatile void *regs, uint bus,
+       uint32 sbba, uint numcores, uint devid)
+{
+       uint next;
+       uint ncc = 0;
+       uint i;
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       /* bail out in case it is too deep to scan at the specified bus level */
+       if (bus >= SB_MAXBUSES) {
+               SI_ERROR(("_sb_scan: bus 0x%08x at level %d is too deep to scan\n", sbba, bus));
+               return 0;
+       }
+       SI_MSG(("_sb_scan: scan bus 0x%08x assume %u cores\n", sbba, numcores));
+
+       /* Scan all cores on the bus starting from core 0.
+        * Core addresses must be contiguous on each bus.
+        */
+       for (i = 0, next = sii->numcores; i < numcores && next < SB_BUS_MAXCORES; i++, next++) {
+               cores_info->coresba[next] = sbba + (i * SI_CORE_SIZE);
+
+               /* keep and reuse the initial register mapping */
+               if ((BUSTYPE(sii->pub.bustype) == SI_BUS) && (cores_info->coresba[next] == sba)) {
+                       SI_VMSG(("_sb_scan: reuse mapped regs %p for core %u\n", regs, next));
+                       cores_info->regs[next] = regs;
+               }
+
+               /* change core to 'next' and read its coreid */
+               sii->curmap = _sb_setcoreidx(sii, next);
+               sii->curidx = next;
+
+               cores_info->coreid[next] = sb_coreid(&sii->pub);
+
+               /* core specific processing... */
+               /* chipc provides # cores */
+               if (cores_info->coreid[next] == CC_CORE_ID) {
+                       chipcregs_t *cc = (chipcregs_t *)sii->curmap;
+
+                       /* determine numcores - this is the total # cores in the chip */
+                       ASSERT(cc);
+                       numcores = (R_REG(sii->osh, &cc->chipid) & CID_CC_MASK) >> CID_CC_SHIFT;
+                       SI_VMSG(("_sb_scan: there are %u cores in the chip %s\n", numcores,
+                               sii->pub.issim ? "QT" : ""));
+               }
+               /* scan bridged SB(s) and add results to the end of the list */
+               else if (cores_info->coreid[next] == OCP_CORE_ID) {
+                       sbconfig_t *sb = REGS2SB(sii->curmap);
+                       uint32 nsbba = R_SBREG(sii, &sb->sbadmatch1);
+                       uint nsbcc;
+
+                       sii->numcores = next + 1;
+
+                       if ((nsbba & 0xfff00000) != si_enum_base(devid))
+                               continue;
+                       nsbba &= 0xfffff000;
+                       if (_sb_coreidx(sii, nsbba) != BADIDX)
+                               continue;
+
+                       nsbcc = (R_SBREG(sii, &sb->sbtmstatehigh) & 0x000f0000) >> 16;
+                       nsbcc = _sb_scan(sii, sba, regs, bus + 1, nsbba, nsbcc, devid);
+                       if (sbba == si_enum_base(devid))
+                               numcores -= nsbcc;
+                       ncc += nsbcc;
+               }
+       }
+
+       SI_MSG(("_sb_scan: found %u cores on bus 0x%08x\n", i, sbba));
+
+       sii->numcores = i + ncc;
+       return sii->numcores;
+}
+
+/* scan the sb enumerated space to identify all cores */
+void
+sb_scan(si_t *sih, volatile void *regs, uint devid)
+{
+       uint32 origsba;
+       sbconfig_t *sb;
+       si_info_t *sii = SI_INFO(sih);
+       BCM_REFERENCE(devid);
+
+       sb = REGS2SB(sii->curmap);
+
+       sii->pub.socirev = (R_SBREG(sii, &sb->sbidlow) & SBIDL_RV_MASK) >> SBIDL_RV_SHIFT;
+
+       /* Save the current core info and validate it later till we know
+        * for sure what is good and what is bad.
+        */
+       origsba = _sb_coresba(sii);
+
+       /* scan all SB(s) starting from SI_ENUM_BASE_DEFAULT */
+       sii->numcores = _sb_scan(sii, origsba, regs, 0, si_enum_base(devid), 1, devid);
+}
+
+/*
+ * This function changes logical "focus" to the indicated core;
+ * must be called with interrupts off.
+ * Moreover, callers should keep interrupts off during switching out of and back to d11 core
+ */
+volatile void *
+sb_setcoreidx(si_t *sih, uint coreidx)
+{
+       si_info_t *sii = SI_INFO(sih);
+
+       if (coreidx >= sii->numcores)
+               return (NULL);
+
+       /*
+        * If the user has provided an interrupt mask enabled function,
+        * then assert interrupts are disabled before switching the core.
+        */
+       ASSERT((sii->intrsenabled_fn == NULL) || !(*(sii)->intrsenabled_fn)((sii)->intr_arg));
+
+       sii->curmap = _sb_setcoreidx(sii, coreidx);
+       sii->curidx = coreidx;
+
+       return (sii->curmap);
+}
+
+/* This function changes the logical "focus" to the indicated core.
+ * Return the current core's virtual address.
+ */
+static volatile void *
+_sb_setcoreidx(const si_info_t *sii, uint coreidx)
+{
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint32 sbaddr = cores_info->coresba[coreidx];
+       volatile void *regs;
+
+       switch (BUSTYPE(sii->pub.bustype)) {
+       case SI_BUS:
+               /* map new one */
+               if (!cores_info->regs[coreidx]) {
+                       cores_info->regs[coreidx] = REG_MAP(sbaddr, SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->regs[coreidx]));
+               }
+               regs = cores_info->regs[coreidx];
+               break;
+
+       case PCI_BUS:
+               /* point bar0 window */
+               OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, 4, sbaddr);
+               regs = sii->curmap;
+               break;
+
+#ifdef BCMSDIO
+       case SPI_BUS:
+       case SDIO_BUS:
+               /* map new one */
+               if (!cores_info->regs[coreidx]) {
+                       cores_info->regs[coreidx] = (void *)(uintptr)sbaddr;
+                       ASSERT(GOODREGS(cores_info->regs[coreidx]));
+               }
+               regs = cores_info->regs[coreidx];
+               break;
+#endif /* BCMSDIO */
+
+       default:
+               ASSERT(0);
+               regs = NULL;
+               break;
+       }
+
+       return regs;
+}
+
+/* Return the address of sbadmatch0/1/2/3 register */
+static volatile uint32 *
+sb_admatch(const si_info_t *sii, uint asidx)
+{
+       sbconfig_t *sb;
+       volatile uint32 *addrm;
+
+       sb = REGS2SB(sii->curmap);
+
+       switch (asidx) {
+       case 0:
+               addrm =  &sb->sbadmatch0;
+               break;
+
+       case 1:
+               addrm =  &sb->sbadmatch1;
+               break;
+
+       case 2:
+               addrm =  &sb->sbadmatch2;
+               break;
+
+       case 3:
+               addrm =  &sb->sbadmatch3;
+               break;
+
+       default:
+               SI_ERROR(("sb_admatch: Address space index (%d) out of range\n", asidx));
+               return 0;
+       }
+
+       return (addrm);
+}
+
+/* Return the number of address spaces in current core */
+int
+sb_numaddrspaces(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       sbconfig_t *sb = REGS2SB(sii->curmap);
+
+       /* + 1 because of enumeration space */
+       return ((R_SBREG(sii, &sb->sbidlow) & SBIDL_AR_MASK) >> SBIDL_AR_SHIFT) + 1;
+}
+
+/* Return the address of the nth address space in the current core */
+uint32
+sb_addrspace(const si_t *sih, uint asidx)
+{
+       const si_info_t *sii = SI_INFO(sih);
+
+       return (sb_base(R_SBREG(sii, sb_admatch(sii, asidx))));
+}
+
+/* Return the size of the nth address space in the current core */
+uint32
+sb_addrspacesize(const si_t *sih, uint asidx)
+{
+       const si_info_t *sii = SI_INFO(sih);
+
+       return (sb_size(R_SBREG(sii, sb_admatch(sii, asidx))));
+}
+
+/* do buffered registers update */
+void
+sb_commit(si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       uint origidx;
+       bcm_int_bitmask_t intr_val;
+
+       origidx = sii->curidx;
+       ASSERT(GOODIDX(origidx, sii->numcores));
+
+       INTR_OFF(sii, &intr_val);
+
+       /* switch over to chipcommon core if there is one, else use pci */
+       if (sii->pub.ccrev != NOREV) {
+               chipcregs_t *ccregs = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+               ASSERT(ccregs != NULL);
+
+               /* do the buffer registers update */
+               W_REG(sii->osh, &ccregs->broadcastaddress, SB_COMMIT);
+               W_REG(sii->osh, &ccregs->broadcastdata, 0x0);
+       } else
+               ASSERT(0);
+
+       /* restore core index */
+       sb_setcoreidx(sih, origidx);
+       INTR_RESTORE(sii, &intr_val);
+}
+
+void
+sb_core_disable(const si_t *sih, uint32 bits)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       volatile uint32 dummy;
+       sbconfig_t *sb;
+
+       ASSERT(GOODREGS(sii->curmap));
+       sb = REGS2SB(sii->curmap);
+
+       /* if core is already in reset, just return */
+       if (R_SBREG(sii, &sb->sbtmstatelow) & SBTML_RESET)
+               return;
+
+       /* if clocks are not enabled, put into reset and return */
+       if ((R_SBREG(sii, &sb->sbtmstatelow) & (SICF_CLOCK_EN << SBTML_SICF_SHIFT)) == 0)
+               goto disable;
+
+       /* set target reject and spin until busy is clear (preserve core-specific bits) */
+       OR_SBREG(sii, &sb->sbtmstatelow, SBTML_REJ);
+       dummy = R_SBREG(sii, &sb->sbtmstatelow);
+       BCM_REFERENCE(dummy);
+       OSL_DELAY(1);
+       SPINWAIT((R_SBREG(sii, &sb->sbtmstatehigh) & SBTMH_BUSY), 100000);
+       if (R_SBREG(sii, &sb->sbtmstatehigh) & SBTMH_BUSY)
+               SI_ERROR(("sb_core_disable: target state still busy\n"));
+
+       /*
+        * If core is initiator, set the Reject bit and allow Busy to clear.
+        * sonicsrev < 2.3 chips don't have the Reject and Busy bits (nops).
+        * Don't assert - dma engine might be stuck (PR4871).
+        */
+       if (R_SBREG(sii, &sb->sbidlow) & SBIDL_INIT) {
+               OR_SBREG(sii, &sb->sbimstate, SBIM_RJ);
+               dummy = R_SBREG(sii, &sb->sbimstate);
+               BCM_REFERENCE(dummy);
+               OSL_DELAY(1);
+               SPINWAIT((R_SBREG(sii, &sb->sbimstate) & SBIM_BY), 100000);
+       }
+
+       /* set reset and reject while enabling the clocks */
+       W_SBREG(sii, &sb->sbtmstatelow,
+               (((bits | SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
+                SBTML_REJ | SBTML_RESET));
+       dummy = R_SBREG(sii, &sb->sbtmstatelow);
+       BCM_REFERENCE(dummy);
+       OSL_DELAY(10);
+
+       /* don't forget to clear the initiator reject bit */
+       if (R_SBREG(sii, &sb->sbidlow) & SBIDL_INIT)
+               AND_SBREG(sii, &sb->sbimstate, ~SBIM_RJ);
+
+disable:
+       /* leave reset and reject asserted */
+       W_SBREG(sii, &sb->sbtmstatelow, ((bits << SBTML_SICF_SHIFT) | SBTML_REJ | SBTML_RESET));
+       OSL_DELAY(1);
+}
+
+/* reset and re-enable a core
+ * inputs:
+ * bits - core specific bits that are set during and after reset sequence
+ * resetbits - core specific bits that are set only during reset sequence
+ */
+void
+sb_core_reset(const si_t *sih, uint32 bits, uint32 resetbits)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       sbconfig_t *sb;
+       volatile uint32 dummy;
+
+       ASSERT(GOODREGS(sii->curmap));
+       sb = REGS2SB(sii->curmap);
+
+       /*
+        * Must do the disable sequence first to work for arbitrary current core state.
+        */
+       sb_core_disable(sih, (bits | resetbits));
+
+       /*
+        * Now do the initialization sequence.
+        */
+
+       /* set reset while enabling the clock and forcing them on throughout the core */
+       W_SBREG(sii, &sb->sbtmstatelow,
+               (((bits | resetbits | SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
+                SBTML_RESET));
+       dummy = R_SBREG(sii, &sb->sbtmstatelow);
+       BCM_REFERENCE(dummy);
+       OSL_DELAY(1);
+
+       /* PR3158 - clear any serror */
+       if (R_SBREG(sii, &sb->sbtmstatehigh) & SBTMH_SERR) {
+               W_SBREG(sii, &sb->sbtmstatehigh, 0);
+       }
+       if ((dummy = R_SBREG(sii, &sb->sbimstate)) & (SBIM_IBE | SBIM_TO)) {
+               AND_SBREG(sii, &sb->sbimstate, ~(SBIM_IBE | SBIM_TO));
+       }
+
+       /* clear reset and allow it to propagate throughout the core */
+       W_SBREG(sii, &sb->sbtmstatelow,
+               ((bits | resetbits | SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT));
+       dummy = R_SBREG(sii, &sb->sbtmstatelow);
+       BCM_REFERENCE(dummy);
+       OSL_DELAY(1);
+
+       /* leave clock enabled */
+       W_SBREG(sii, &sb->sbtmstatelow, ((bits | SICF_CLOCK_EN) << SBTML_SICF_SHIFT));
+       dummy = R_SBREG(sii, &sb->sbtmstatelow);
+       BCM_REFERENCE(dummy);
+       OSL_DELAY(1);
+}
+
+uint32
+sb_base(uint32 admatch)
+{
+       uint32 base;
+       uint type;
+
+       type = admatch & SBAM_TYPE_MASK;
+       ASSERT(type < 3);
+
+       base = 0;
+
+       if (type == 0) {
+               base = admatch & SBAM_BASE0_MASK;
+       } else if (type == 1) {
+               ASSERT(!(admatch & SBAM_ADNEG));        /* neg not supported */
+               base = admatch & SBAM_BASE1_MASK;
+       } else if (type == 2) {
+               ASSERT(!(admatch & SBAM_ADNEG));        /* neg not supported */
+               base = admatch & SBAM_BASE2_MASK;
+       }
+
+       return (base);
+}
+
+uint32
+sb_size(uint32 admatch)
+{
+       uint32 size;
+       uint type;
+
+       type = admatch & SBAM_TYPE_MASK;
+       ASSERT(type < 3);
+
+       size = 0;
+
+       if (type == 0) {
+               size = 1 << (((admatch & SBAM_ADINT0_MASK) >> SBAM_ADINT0_SHIFT) + 1);
+       } else if (type == 1) {
+               ASSERT(!(admatch & SBAM_ADNEG));        /* neg not supported */
+               size = 1 << (((admatch & SBAM_ADINT1_MASK) >> SBAM_ADINT1_SHIFT) + 1);
+       } else if (type == 2) {
+               ASSERT(!(admatch & SBAM_ADNEG));        /* neg not supported */
+               size = 1 << (((admatch & SBAM_ADINT2_MASK) >> SBAM_ADINT2_SHIFT) + 1);
+       }
+
+       return (size);
+}
+
+#if defined(BCMDBG_PHYDUMP)
+/* print interesting sbconfig registers */
+void
+sb_dumpregs(si_t *sih, struct bcmstrbuf *b)
+{
+       sbconfig_t *sb;
+       uint origidx, i;
+       bcm_int_bitmask_t intr_val;
+       const si_info_t *sii = SI_INFO(sih);
+       const si_cores_info_t *cores_info = (const si_cores_info_t *)sii->cores_info;
+
+       origidx = sii->curidx;
+
+       INTR_OFF(sii, &intr_val);
+
+       for (i = 0; i < sii->numcores; i++) {
+               sb = REGS2SB(sb_setcoreidx(sih, i));
+
+               bcm_bprintf(b, "core 0x%x: \n", cores_info->coreid[i]);
+
+               if (sii->pub.socirev > SONICS_2_2)
+                       bcm_bprintf(b, "sbimerrlog 0x%x sbimerrloga 0x%x\n",
+                                 sb_corereg(sih, si_coreidx(&sii->pub), SBIMERRLOG, 0, 0),
+                                 sb_corereg(sih, si_coreidx(&sii->pub), SBIMERRLOGA, 0, 0));
+
+               bcm_bprintf(b, "sbtmstatelow 0x%x sbtmstatehigh 0x%x sbidhigh 0x%x "
+                           "sbimstate 0x%x\n sbimconfiglow 0x%x sbimconfighigh 0x%x\n",
+                           R_SBREG(sii, &sb->sbtmstatelow), R_SBREG(sii, &sb->sbtmstatehigh),
+                           R_SBREG(sii, &sb->sbidhigh), R_SBREG(sii, &sb->sbimstate),
+                           R_SBREG(sii, &sb->sbimconfiglow), R_SBREG(sii, &sb->sbimconfighigh));
+       }
+
+       sb_setcoreidx(sih, origidx);
+       INTR_RESTORE(sii, &intr_val);
+}
+#endif
diff --git a/bcmdhd.101.10.240.x/siutils.c b/bcmdhd.101.10.240.x/siutils.c
new file mode 100644 (file)
index 0000000..aca5ec9
--- /dev/null
@@ -0,0 +1,3986 @@
+/*
+ * Misc utility routines for accessing chip-specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <bcmdevs.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <sbgci.h>
+#ifndef BCMSDIO
+#include <pcie_core.h>
+#endif
+#ifdef BCMPCIEDEV
+#include <pcieregsoffs.h>
+#include <pciedev.h>
+#endif /* BCMPCIEDEV */
+#include <pcicfg.h>
+#include <sbpcmcia.h>
+#include <sbsysmem.h>
+#include <sbsocram.h>
+#ifdef BCMSDIO
+#include <bcmsdh.h>
+#include <sdio.h>
+#include <sbsdio.h>
+#include <sbhnddma.h>
+#include <sbsdpcmdev.h>
+#include <bcmsdpcm.h>
+#endif /* BCMSDIO */
+#include <hndpmu.h>
+#ifdef BCMSPI
+#include <spid.h>
+#endif /* BCMSPI */
+#include <dhd_config.h>
+
+#ifdef BCM_SDRBL
+#include <hndcpu.h>
+#endif /* BCM_SDRBL */
+#ifdef HNDGCI
+#include <hndgci.h>
+#endif /* HNDGCI */
+#include <hndlhl.h>
+#include <hndoobr.h>
+#include <lpflags.h>
+#ifdef BCM_SH_SFLASH
+#include <sh_sflash.h>
+#endif
+#ifdef BCMGCISHM
+#include <hnd_gcishm.h>
+#endif
+#include "siutils_priv.h"
+#include "sbhndarm.h"
+#include <hndchipc.h>
+
+#ifdef SECI_UART
+/* Defines the set of GPIOs to be used for SECI UART if not specified in NVRAM */
+/* For further details on each ppin functionality please refer to PINMUX table in
+ * Top level architecture of BCMXXXX Chip
+ */
+#define DEFAULT_SECI_UART_PINMUX       0x08090a0b
+static bool force_seci_clk = 0;
+#endif /* SECI_UART */
+
+#define XTAL_FREQ_26000KHZ             26000
+#define XTAL_FREQ_59970KHZ             59970
+#define WCI2_UART_RX_BUF_SIZE  64
+
+/**
+ * A set of PMU registers is clocked in the ILP domain, which has an implication on register write
+ * behavior: if such a register is written, it takes multiple ILP clocks for the PMU block to absorb
+ * the write. During that time the 'SlowWritePending' bit in the PMUStatus register is set.
+ */
+#define PMUREGS_ILP_SENSITIVE(regoff) \
+       ((regoff) == OFFSETOF(pmuregs_t, pmutimer) || \
+        (regoff) == OFFSETOF(pmuregs_t, pmuwatchdog) || \
+        (regoff) == OFFSETOF(pmuregs_t, res_req_timer))
+
+#define CHIPCREGS_ILP_SENSITIVE(regoff) \
+       ((regoff) == OFFSETOF(chipcregs_t, pmutimer) || \
+        (regoff) == OFFSETOF(chipcregs_t, pmuwatchdog) || \
+        (regoff) == OFFSETOF(chipcregs_t, res_req_timer))
+
+#define GCI_FEM_CTRL_WAR 0x11111111
+
+#ifndef AXI_TO_VAL
+#define AXI_TO_VAL 19
+#endif /* AXI_TO_VAL */
+
+#ifndef AXI_TO_VAL_25
+/*
+ * Increase BP timeout for fast clock and short PCIe timeouts
+ * New timeout: 2 ** 25 cycles
+ */
+#define AXI_TO_VAL_25  25
+#endif /* AXI_TO_VAL_25 */
+
+#define si_srpwr_domain_mask(rval, mask) \
+       (((rval) >> SRPWR_STATUS_SHIFT) & (mask))
+
+/* local prototypes */
+static int32 si_alloc_wrapper(si_info_t *sii);
+static si_info_t *si_doattach(si_info_t *sii, uint devid, osl_t *osh, volatile void *regs,
+                              uint bustype, void *sdh, char **vars, uint *varsz);
+static bool si_buscore_prep(si_info_t *sii, uint bustype, uint devid, void *sdh);
+static bool si_buscore_setup(si_info_t *sii, chipcregs_t *cc, uint bustype, uint32 savewin,
+       uint *origidx, volatile const void *regs);
+
+static bool si_pmu_is_ilp_sensitive(uint32 idx, uint regoff);
+
+static void si_oob_war_BT_F1(si_t *sih);
+
+#if defined(BCMLTECOEX)
+static void si_wci2_rxfifo_intr_handler_process(si_t *sih, uint32 intstatus);
+#endif
+
+/* global variable to indicate reservation/release of gpio's */
+static uint32 si_gpioreservation = 0;
+/* global flag to prevent shared resources from being initialized multiple times in si_attach() */
+static bool si_onetimeinit = FALSE;
+
+#ifdef SR_DEBUG
+static const uint32 si_power_island_test_array[] = {
+       0x0000, 0x0001, 0x0010, 0x0011,
+       0x0100, 0x0101, 0x0110, 0x0111,
+       0x1000, 0x1001, 0x1010, 0x1011,
+       0x1100, 0x1101, 0x1110, 0x1111
+};
+#endif /* SR_DEBUG */
+
+/* 4360 pcie2 WAR */
+int do_4360_pcie2_war = 0;
+
+/* global kernel resource */
+static si_info_t ksii;
+static si_cores_info_t ksii_cores_info;
+
+static uint32  wd_msticks;             /**< watchdog timer ticks normalized to ms */
+
+/** Returns the backplane address of the chipcommon core for a particular chip */
+uint32
+si_enum_base(uint devid)
+{
+       return SI_ENUM_BASE_DEFAULT;
+}
+
+/**
+ * Allocate an si handle. This function may be called multiple times.
+ *
+ * devid - pci device id (used to determine chip#)
+ * osh - opaque OS handle
+ * regs - virtual address of initial core registers
+ * bustype - pci/sb/sdio/etc
+ * vars - pointer to a to-be created pointer area for "environment" variables. Some callers of this
+ *        function set 'vars' to NULL, making dereferencing of this parameter undesired.
+ * varsz - pointer to int to return the size of the vars
+ */
+si_t *
+si_attach(uint devid, osl_t *osh, volatile void *regs,
+                       uint bustype, void *sdh, char **vars, uint *varsz)
+{
+       si_info_t *sii;
+
+       /* alloc si_info_t */
+       /* freed after ucode download for firmware builds */
+       if ((sii = MALLOCZ_NOPERSIST(osh, sizeof(si_info_t))) == NULL) {
+               SI_ERROR(("si_attach: malloc failed! malloced %d bytes\n", MALLOCED(osh)));
+               return (NULL);
+       }
+
+#ifdef BCMDVFS
+       if (si_dvfs_info_init((si_t *)sii, osh) == NULL) {
+               SI_ERROR(("si_dvfs_info_init failed\n"));
+               return (NULL);
+       }
+#endif /* BCMDVFS */
+
+       if (si_doattach(sii, devid, osh, regs, bustype, sdh, vars, varsz) == NULL) {
+               MFREE(osh, sii, sizeof(si_info_t));
+               return (NULL);
+       }
+       sii->vars = vars ? *vars : NULL;
+       sii->varsz = varsz ? *varsz : 0;
+
+#if defined(BCM_SH_SFLASH) && !defined(BCM_SH_SFLASH_DISABLED)
+       sh_sflash_attach(osh, (si_t *)sii);
+#endif
+
+       return (si_t *)sii;
+}
+
+/** generic kernel variant of si_attach(). Is not called for Linux WLAN NIC builds. */
+si_t *
+si_kattach(osl_t *osh)
+{
+       static bool ksii_attached = FALSE;
+       si_cores_info_t *cores_info;
+
+       if (!ksii_attached) {
+               void *regs = NULL;
+               const uint device_id = BCM4710_DEVICE_ID; // pick an arbitrary default device_id
+
+               regs = REG_MAP(si_enum_base(device_id), SI_CORE_SIZE); // map physical to virtual
+               cores_info = (si_cores_info_t *)&ksii_cores_info;
+               ksii.cores_info = cores_info;
+
+               /* Use osh as the deciding factor if the memory management
+                * system has been initialized. Pass non-NULL vars & varsz only
+                * if memory management has been initialized. Otherwise MALLOC()
+                * will fail/crash.
+                */
+               ASSERT(osh);
+               if (si_doattach(&ksii, device_id, osh, regs,
+                               SI_BUS, NULL,
+                               osh != SI_OSH ? &(ksii.vars) : NULL,
+                               osh != SI_OSH ? &(ksii.varsz) : NULL) == NULL) {
+                       SI_ERROR(("si_kattach: si_doattach failed\n"));
+                       REG_UNMAP(regs);
+                       return NULL;
+               }
+               REG_UNMAP(regs);
+
+               /* save ticks normalized to ms for si_watchdog_ms() */
+               if (PMUCTL_ENAB(&ksii.pub)) {
+                       /* based on 32KHz ILP clock */
+                       wd_msticks = 32;
+               } else {
+                       wd_msticks = ALP_CLOCK / 1000;
+               }
+
+               ksii_attached = TRUE;
+               SI_MSG(("si_kattach done. ccrev = %d, wd_msticks = %d\n",
+                       CCREV(ksii.pub.ccrev), wd_msticks));
+       }
+
+       return &ksii.pub;
+}
+
+static bool
+si_buscore_prep(si_info_t *sii, uint bustype, uint devid, void *sdh)
+{
+       BCM_REFERENCE(sdh);
+       BCM_REFERENCE(devid);
+
+#if defined(BCMSDIO) && !defined(BCMSDIOLITE)
+       /* PR 39902, 43618, 44891, 41539 -- avoid backplane accesses that may
+        * cause SDIO clock requests before a stable ALP clock.  Originally had
+        * this later (just before srom_var_init() below) to guarantee ALP for
+        * CIS read, but due to these PRs moving it here before backplane use.
+        */
+       /* As it precedes any backplane access, can't check chipid; but may
+        * be able to qualify with devid if underlying SDIO allows.  But should
+        * be ok for all our SDIO (4318 doesn't support clock and pullup regs,
+        * but the access attempts don't seem to hurt.)  Might elimiante the
+        * the need for ALP for CIS at all if underlying SDIO uses CMD53...
+        */
+       if (BUSTYPE(bustype) == SDIO_BUS) {
+               int err;
+               uint8 clkset;
+
+               /* Try forcing SDIO core to do ALPAvail request only */
+               clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
+               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
+               if (!err) {
+                       uint8 clkval;
+
+                       /* If register supported, wait for ALPAvail and then force ALP */
+                       clkval = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, NULL);
+                       if ((clkval & ~SBSDIO_AVBITS) == clkset) {
+                               SPINWAIT(((clkval = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+                                       SBSDIO_FUNC1_CHIPCLKCSR, NULL)), !SBSDIO_ALPAV(clkval)),
+                                       PMU_MAX_TRANSITION_DLY);
+                               if (!SBSDIO_ALPAV(clkval)) {
+                                       SI_ERROR(("timeout on ALPAV wait, clkval 0x%02x\n",
+                                               clkval));
+                                       return FALSE;
+                               }
+                               clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP;
+                               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                                       clkset, &err);
+                               /* PR 40613: account for possible ALP delay */
+                               OSL_DELAY(65);
+                       }
+               }
+
+               /* Also, disable the extra SDIO pull-ups */
+               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
+       }
+
+#ifdef BCMSPI
+       /* Avoid backplane accesses before wake-wlan (i.e. htavail) for spi.
+        * F1 read accesses may return correct data but with data-not-available dstatus bit set.
+        */
+       if (BUSTYPE(bustype) == SPI_BUS) {
+
+               int err;
+               uint32 regdata;
+               /* wake up wlan function :WAKE_UP goes as HT_AVAIL request in hardware */
+               regdata = bcmsdh_cfg_read_word(sdh, SDIO_FUNC_0, SPID_CONFIG, NULL);
+               SI_MSG(("F0 REG0 rd = 0x%x\n", regdata));
+               regdata |= WAKE_UP;
+
+               bcmsdh_cfg_write_word(sdh, SDIO_FUNC_0, SPID_CONFIG, regdata, &err);
+
+               /* It takes time for wakeup to take effect. */
+               OSL_DELAY(100000);
+       }
+#endif /* BCMSPI */
+#endif /* BCMSDIO && BCMDONGLEHOST && !BCMSDIOLITE */
+
+       return TRUE;
+}
+
+/* note: this function is used by dhd */
+uint32
+si_get_pmu_reg_addr(si_t *sih, uint32 offset)
+{
+       si_info_t *sii = SI_INFO(sih);
+       uint32 pmuaddr = INVALID_ADDR;
+       uint origidx = 0;
+
+       SI_MSG(("si_get_pmu_reg_addr: pmu access, offset: %x\n", offset));
+       if (!(sii->pub.cccaps & CC_CAP_PMU)) {
+               goto done;
+       }
+       if (AOB_ENAB(&sii->pub)) {
+               uint pmucoreidx;
+               pmuregs_t *pmu;
+               SI_MSG(("si_get_pmu_reg_addr: AOBENAB: %x\n", offset));
+               origidx = sii->curidx;
+               pmucoreidx = si_findcoreidx(&sii->pub, PMU_CORE_ID, 0);
+               pmu = si_setcoreidx(&sii->pub, pmucoreidx);
+               /* note: this function is used by dhd and possible 64 bit compilation needs
+                * a cast to (unsigned long) for avoiding a compilation error.
+                */
+               pmuaddr = (uint32)(uintptr)((volatile uint8*)pmu + offset);
+               si_setcoreidx(sih, origidx);
+       } else
+               pmuaddr = SI_ENUM_BASE(sih) + offset;
+
+done:
+       SI_MSG(("%s: addrRET: %x\n", __FUNCTION__, pmuaddr));
+       return pmuaddr;
+}
+
+static bool
+si_buscore_setup(si_info_t *sii, chipcregs_t *cc, uint bustype, uint32 savewin,
+       uint *origidx, volatile const void *regs)
+{
+       const si_cores_info_t *cores_info = sii->cores_info;
+       bool pci, pcie, pcie_gen2 = FALSE;
+       uint i;
+       uint pciidx, pcieidx, pcirev, pcierev;
+
+#if defined(AXI_TIMEOUTS_NIC) || defined(AXI_TIMEOUTS)
+       /* first, enable backplane timeouts */
+       si_slave_wrapper_add(&sii->pub);
+#endif
+       sii->curidx = 0;
+
+       cc = si_setcoreidx(&sii->pub, SI_CC_IDX);
+       ASSERT((uintptr)cc);
+
+       /* get chipcommon rev */
+       sii->pub.ccrev = (int)si_corerev(&sii->pub);
+
+       /* get chipcommon chipstatus */
+       if (CCREV(sii->pub.ccrev) >= 11)
+               sii->pub.chipst = R_REG(sii->osh, &cc->chipstatus);
+
+       /* get chipcommon capabilites */
+       sii->pub.cccaps = R_REG(sii->osh, &cc->capabilities);
+       /* get chipcommon extended capabilities */
+
+       if (CCREV(sii->pub.ccrev) >= 35) /* PR77565 */
+               sii->pub.cccaps_ext = R_REG(sii->osh, &cc->capabilities_ext);
+
+       /* get pmu rev and caps */
+       if (sii->pub.cccaps & CC_CAP_PMU) {
+               if (AOB_ENAB(&sii->pub)) {
+                       uint pmucoreidx;
+                       pmuregs_t *pmu;
+
+                       pmucoreidx = si_findcoreidx(&sii->pub, PMU_CORE_ID, 0);
+                       if (!GOODIDX(pmucoreidx, sii->numcores)) {
+                               SI_ERROR(("si_buscore_setup: si_findcoreidx failed\n"));
+                               return FALSE;
+                       }
+
+                       pmu = si_setcoreidx(&sii->pub, pmucoreidx);
+                       sii->pub.pmucaps = R_REG(sii->osh, &pmu->pmucapabilities);
+                       si_setcoreidx(&sii->pub, SI_CC_IDX);
+
+                       sii->pub.gcirev = si_corereg(&sii->pub, GCI_CORE_IDX(&sii->pub),
+                               GCI_OFFSETOF(&sii->pub, gci_corecaps0), 0, 0) & GCI_CAP0_REV_MASK;
+
+                       if (GCIREV(sii->pub.gcirev) >= 9) {
+                               sii->pub.lhlrev = si_corereg(&sii->pub, GCI_CORE_IDX(&sii->pub),
+                                       OFFSETOF(gciregs_t, lhl_core_capab_adr), 0, 0) &
+                                       LHL_CAP_REV_MASK;
+                       } else {
+                               sii->pub.lhlrev = NOREV;
+                       }
+
+               } else
+                       sii->pub.pmucaps = R_REG(sii->osh, &cc->pmucapabilities);
+
+               sii->pub.pmurev = sii->pub.pmucaps & PCAP_REV_MASK;
+       }
+
+       SI_MSG(("Chipc: rev %d, caps 0x%x, chipst 0x%x pmurev %d, pmucaps 0x%x\n",
+               CCREV(sii->pub.ccrev), sii->pub.cccaps, sii->pub.chipst, sii->pub.pmurev,
+               sii->pub.pmucaps));
+
+       /* figure out bus/orignal core idx */
+       /* note for PCI_BUS the buscoretype variable is setup in ai_scan() */
+       if (BUSTYPE(sii->pub.bustype) != PCI_BUS) {
+               sii->pub.buscoretype = NODEV_CORE_ID;
+       }
+       sii->pub.buscorerev = NOREV;
+       sii->pub.buscoreidx = BADIDX;
+
+       pci = pcie = FALSE;
+       pcirev = pcierev = NOREV;
+       pciidx = pcieidx = BADIDX;
+
+       /* This loop can be optimized */
+       for (i = 0; i < sii->numcores; i++) {
+               uint cid, crev;
+
+               si_setcoreidx(&sii->pub, i);
+               cid = si_coreid(&sii->pub);
+               crev = si_corerev(&sii->pub);
+
+               /* Display cores found */
+               if (CHIPTYPE(sii->pub.socitype) != SOCI_NCI) {
+                       SI_VMSG(("CORE[%d]: id 0x%x rev %d base 0x%x size:%x regs 0x%p\n",
+                               i, cid, crev, cores_info->coresba[i], cores_info->coresba_size[i],
+                               OSL_OBFUSCATE_BUF(cores_info->regs[i])));
+               }
+
+               if (BUSTYPE(bustype) == SI_BUS) {
+                       /* now look at the chipstatus register to figure the pacakge */
+                       /* this shoudl be a general change to cover all teh chips */
+                       /* this also shoudl validate the build where the dongle is built */
+                       /* for SDIO but downloaded on PCIE dev */
+#ifdef BCMPCIEDEV_ENABLED
+                       if (cid == PCIE2_CORE_ID) {
+                               pcieidx = i;
+                               pcierev = crev;
+                               pcie = TRUE;
+                               pcie_gen2 = TRUE;
+                       }
+#endif
+                       /* rest fill it up here */
+
+               } else if (BUSTYPE(bustype) == PCI_BUS) {
+                       if (cid == PCI_CORE_ID) {
+                               pciidx = i;
+                               pcirev = crev;
+                               pci = TRUE;
+                       } else if ((cid == PCIE_CORE_ID) || (cid == PCIE2_CORE_ID)) {
+                               pcieidx = i;
+                               pcierev = crev;
+                               pcie = TRUE;
+                               if (cid == PCIE2_CORE_ID)
+                                       pcie_gen2 = TRUE;
+                       }
+               }
+#ifdef BCMSDIO
+               else if (((BUSTYPE(bustype) == SDIO_BUS) ||
+                         (BUSTYPE(bustype) == SPI_BUS)) &&
+                        (cid == SDIOD_CORE_ID)) {
+                       sii->pub.buscorerev = (int16)crev;
+                       sii->pub.buscoretype = (uint16)cid;
+                       sii->pub.buscoreidx = (uint16)i;
+               }
+#endif /* BCMSDIO */
+
+               /* find the core idx before entering this func. */
+               if (CHIPTYPE(sii->pub.socitype) == SOCI_NCI) {
+                       if (regs == sii->curmap) {
+                               *origidx = i;
+                       }
+               } else {
+                       /* find the core idx before entering this func. */
+                       if ((savewin && (savewin == cores_info->coresba[i])) ||
+                       (regs == cores_info->regs[i])) {
+                               *origidx = i;
+                       }
+               }
+       }
+
+#if defined(PCIE_FULL_DONGLE)
+       if (pcie) {
+               if (pcie_gen2)
+                       sii->pub.buscoretype = PCIE2_CORE_ID;
+               else
+                       sii->pub.buscoretype = PCIE_CORE_ID;
+               sii->pub.buscorerev = (int16)pcierev;
+               sii->pub.buscoreidx = (uint16)pcieidx;
+       }
+       BCM_REFERENCE(pci);
+       BCM_REFERENCE(pcirev);
+       BCM_REFERENCE(pciidx);
+#else
+       if (pci) {
+               sii->pub.buscoretype = PCI_CORE_ID;
+               sii->pub.buscorerev = (int16)pcirev;
+               sii->pub.buscoreidx = (uint16)pciidx;
+       } else if (pcie) {
+               if (pcie_gen2)
+                       sii->pub.buscoretype = PCIE2_CORE_ID;
+               else
+                       sii->pub.buscoretype = PCIE_CORE_ID;
+               sii->pub.buscorerev = (int16)pcierev;
+               sii->pub.buscoreidx = (uint16)pcieidx;
+       }
+#endif /* defined(PCIE_FULL_DONGLE) */
+
+       SI_VMSG(("Buscore id/type/rev %d/0x%x/%d\n", sii->pub.buscoreidx, sii->pub.buscoretype,
+                sii->pub.buscorerev));
+
+#if defined(BCMSDIO)
+       /* Make sure any on-chip ARM is off (in case strapping is wrong), or downloaded code was
+        * already running.
+        */
+       if ((BUSTYPE(bustype) == SDIO_BUS) || (BUSTYPE(bustype) == SPI_BUS)) {
+               if (si_setcore(&sii->pub, ARM7S_CORE_ID, 0) ||
+                   si_setcore(&sii->pub, ARMCM3_CORE_ID, 0))
+                       si_core_disable(&sii->pub, 0);
+       }
+#endif /* BCMSDIO && BCMDONGLEHOST */
+
+       /* return to the original core */
+       si_setcoreidx(&sii->pub, *origidx);
+
+       return TRUE;
+}
+
+uint16
+si_chipid(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+
+       return (sii->chipnew) ? sii->chipnew : sih->chip;
+}
+
+/* CHIP_ID's being mapped here should not be used anywhere else in the code */
+static void
+si_chipid_fixup(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+
+       ASSERT(sii->chipnew == 0);
+       switch (sih->chip) {
+               case BCM4377_CHIP_ID:
+                       sii->chipnew = sih->chip; /* save it */
+                       sii->pub.chip = BCM4369_CHIP_ID; /* chip class */
+               break;
+               case BCM4375_CHIP_ID:
+                       sii->chipnew = sih->chip; /* save it */
+                       sii->pub.chip = BCM4375_CHIP_ID; /* chip class */
+               break;
+               case BCM4362_CHIP_ID:
+                       sii->chipnew = sih->chip; /* save it */
+                       sii->pub.chip = BCM4362_CHIP_ID; /* chip class */
+               break;
+               case BCM4356_CHIP_ID:
+               case BCM4371_CHIP_ID:
+                       sii->chipnew = sih->chip; /* save it */
+                       sii->pub.chip = BCM4354_CHIP_ID; /* chip class */
+                       break;
+               default:
+               break;
+       }
+}
+
+#ifdef AXI_TIMEOUTS_NIC
+uint32
+si_clear_backplane_to_fast(void *sih, void *addr)
+{
+       si_t *_sih = DISCARD_QUAL(sih, si_t);
+
+       if (CHIPTYPE(_sih->socitype) == SOCI_AI) {
+               return ai_clear_backplane_to_fast(_sih, addr);
+       }
+
+       return 0;
+}
+
+const si_axi_error_info_t *
+si_get_axi_errlog_info(const si_t *sih)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_AI) {
+               return (const si_axi_error_info_t *)sih->err_info;
+       }
+
+       return NULL;
+}
+
+void
+si_reset_axi_errlog_info(const si_t *sih)
+{
+       if (sih->err_info) {
+               sih->err_info->count = 0;
+       }
+}
+#endif /* AXI_TIMEOUTS_NIC */
+
+/* TODO: Can we allocate only one instance? */
+static int32
+si_alloc_wrapper(si_info_t *sii)
+{
+       if (sii->osh) {
+               sii->axi_wrapper = (axi_wrapper_t *)MALLOCZ(sii->osh,
+                       (sizeof(axi_wrapper_t) * SI_MAX_AXI_WRAPPERS));
+
+               if (sii->axi_wrapper == NULL) {
+                       return BCME_NOMEM;
+               }
+       } else {
+               sii->axi_wrapper = NULL;
+               return BCME_ERROR;
+       }
+       return BCME_OK;
+}
+
+static void
+si_free_wrapper(si_info_t *sii)
+{
+       if (sii->axi_wrapper) {
+
+               MFREE(sii->osh, sii->axi_wrapper, (sizeof(axi_wrapper_t) * SI_MAX_AXI_WRAPPERS));
+       }
+}
+
+static void *
+si_alloc_coresinfo(si_info_t *sii, osl_t *osh, chipcregs_t *cc)
+{
+       if (CHIPTYPE(sii->pub.socitype) == SOCI_NCI) {
+               sii->nci_info = nci_init(&sii->pub, (void*)(uintptr)cc, sii->pub.bustype);
+
+               return sii->nci_info;
+
+       } else {
+
+               if (sii->cores_info == NULL) {
+                       /* alloc si_cores_info_t */
+                       if ((sii->cores_info = (si_cores_info_t *)MALLOCZ(osh,
+                               sizeof(si_cores_info_t))) == NULL) {
+                               SI_ERROR(("si_attach: malloc failed for cores_info! malloced"
+                                       " %d bytes\n", MALLOCED(osh)));
+                               return (NULL);
+                       }
+               } else {
+                       ASSERT(sii->cores_info == &ksii_cores_info);
+
+               }
+               return sii->cores_info;
+       }
+
+}
+
+static void
+si_free_coresinfo(si_info_t *sii, osl_t *osh)
+{
+
+       if (CHIPTYPE(sii->pub.socitype) == SOCI_NCI) {
+               if (sii->nci_info) {
+                       nci_uninit(sii->nci_info);
+                       sii->nci_info = NULL;
+               }
+       } else {
+               if (sii->cores_info && (sii->cores_info != &ksii_cores_info)) {
+                       MFREE(osh, sii->cores_info, sizeof(si_cores_info_t));
+               }
+       }
+}
+
+/**
+ * Allocate an si handle. This function may be called multiple times. This function is called by
+ * both si_attach() and si_kattach().
+ *
+ * vars - pointer to a to-be created pointer area for "environment" variables. Some callers of this
+ *        function set 'vars' to NULL.
+ */
+static si_info_t *
+si_doattach(si_info_t *sii, uint devid, osl_t *osh, volatile void *regs,
+                       uint bustype, void *sdh, char **vars, uint *varsz)
+{
+       struct si_pub *sih = &sii->pub;
+       uint32 w, savewin;
+       chipcregs_t *cc;
+       char *pvars = NULL;
+       uint origidx;
+#ifdef NVSRCX
+       char *sromvars;
+#endif
+       uint err_at = 0;
+
+       ASSERT(GOODREGS(regs));
+
+       savewin = 0;
+
+       sih->buscoreidx = BADIDX;
+       sii->device_removed = FALSE;
+
+       sii->curmap = regs;
+       sii->sdh = sdh;
+       sii->osh = osh;
+       sii->second_bar0win = ~0x0;
+       sih->enum_base = si_enum_base(devid);
+
+#if defined(AXI_TIMEOUTS_NIC)
+       sih->err_info = MALLOCZ(osh, sizeof(si_axi_error_info_t));
+       if (sih->err_info == NULL) {
+               SI_ERROR(("si_doattach: %zu bytes MALLOC FAILED",
+                       sizeof(si_axi_error_info_t)));
+       }
+#endif /* AXI_TIMEOUTS_NIC */
+
+#if defined(AXI_TIMEOUTS_NIC) && defined(__linux__)
+       osl_set_bpt_cb(osh, (void *)si_clear_backplane_to_fast, (void *)sih);
+#endif /* AXI_TIMEOUTS_NIC && linux */
+
+       /* check to see if we are a si core mimic'ing a pci core */
+       if ((bustype == PCI_BUS) &&
+           (OSL_PCI_READ_CONFIG(sii->osh, PCI_SPROM_CONTROL, sizeof(uint32)) == 0xffffffff)) {
+               SI_ERROR(("si_doattach: incoming bus is PCI but it's a lie, switching to SI "
+                         "devid:0x%x\n", devid));
+               bustype = SI_BUS;
+       }
+
+       /* find Chipcommon address */
+       if (bustype == PCI_BUS) {
+               savewin = OSL_PCI_READ_CONFIG(sii->osh, PCI_BAR0_WIN, sizeof(uint32));
+               /* PR 29857: init to core0 if bar0window is not programmed properly */
+               if (!GOODCOREADDR(savewin, SI_ENUM_BASE(sih)))
+                       savewin = SI_ENUM_BASE(sih);
+               OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, 4, SI_ENUM_BASE(sih));
+               if (!regs) {
+                       err_at = 1;
+                       goto exit;
+               }
+               cc = (chipcregs_t *)regs;
+#ifdef BCMSDIO
+       } else if ((bustype == SDIO_BUS) || (bustype == SPI_BUS)) {
+               cc = (chipcregs_t *)sii->curmap;
+#endif
+       } else {
+               cc = (chipcregs_t *)REG_MAP(SI_ENUM_BASE(sih), SI_CORE_SIZE);
+       }
+
+       sih->bustype = (uint16)bustype;
+#ifdef BCMBUSTYPE
+       if (bustype != BUSTYPE(bustype)) {
+               SI_ERROR(("si_doattach: bus type %d does not match configured bus type %d\n",
+                       bustype, BUSTYPE(bustype)));
+               err_at = 2;
+               goto exit;
+       }
+#endif
+
+       /* bus/core/clk setup for register access */
+       if (!si_buscore_prep(sii, bustype, devid, sdh)) {
+               SI_ERROR(("si_doattach: si_core_clk_prep failed %d\n", bustype));
+               err_at = 3;
+               goto exit;
+       }
+
+       /* ChipID recognition.
+       *   We assume we can read chipid at offset 0 from the regs arg.
+       *   If we add other chiptypes (or if we need to support old sdio hosts w/o chipcommon),
+       *   some way of recognizing them needs to be added here.
+       */
+       if (!cc) {
+               err_at = 3;
+               goto exit;
+       }
+       w = R_REG(osh, &cc->chipid);
+       /* plz refer to RB:13157 */
+       if ((w & 0xfffff) == 148277) w -= 65532;
+       sih->socitype = (w & CID_TYPE_MASK) >> CID_TYPE_SHIFT;
+       /* Might as wll fill in chip id rev & pkg */
+       sih->chip = w & CID_ID_MASK;
+       sih->chiprev = (w & CID_REV_MASK) >> CID_REV_SHIFT;
+       sih->chippkg = (w & CID_PKG_MASK) >> CID_PKG_SHIFT;
+
+#if defined(BCMSDIO) && (defined(HW_OOB) || defined(FORCE_WOWLAN))
+       dhd_conf_set_hw_oob_intr(sdh, sih);
+#endif
+
+       si_chipid_fixup(sih);
+
+       sih->issim = IS_SIM(sih->chippkg);
+
+       if (MULTIBP_CAP(sih)) {
+               sih->_multibp_enable = TRUE;
+       }
+
+       /* scan for cores */
+        if (CHIPTYPE(sii->pub.socitype) == SOCI_NCI) {
+
+               if (si_alloc_coresinfo(sii, osh, cc) == NULL) {
+                       err_at = 4;
+                       goto exit;
+               }
+               ASSERT(sii->nci_info);
+
+               if (!FWSIGN_ENAB()) {
+                       if ((si_alloc_wrapper(sii)) != BCME_OK) {
+                               err_at = 5;
+                               goto exit;
+                       }
+               }
+
+               if ((sii->numcores = nci_scan(sih)) == 0u) {
+                       err_at = 6;
+                       goto exit;
+               } else {
+                       if (!FWSIGN_ENAB()) {
+                               nci_dump_erom(sii->nci_info);
+                       }
+               }
+       } else {
+
+               if (si_alloc_coresinfo(sii, osh, cc) == NULL) {
+                       err_at = 7;
+                       goto exit;
+               }
+
+               if (CHIPTYPE(sii->pub.socitype) == SOCI_SB) {
+                       SI_MSG(("Found chip type SB (0x%08x)\n", w));
+                       sb_scan(&sii->pub, regs, devid);
+               } else if ((CHIPTYPE(sii->pub.socitype) == SOCI_AI) ||
+                       (CHIPTYPE(sii->pub.socitype) == SOCI_NAI) ||
+                       (CHIPTYPE(sii->pub.socitype) == SOCI_DVTBUS)) {
+
+                       if (CHIPTYPE(sii->pub.socitype) == SOCI_AI)
+                               SI_MSG(("Found chip type AI (0x%08x)\n", w));
+                       else if (CHIPTYPE(sii->pub.socitype) == SOCI_NAI)
+                               SI_MSG(("Found chip type NAI (0x%08x)\n", w));
+                       else
+                               SI_MSG(("Found chip type DVT (0x%08x)\n", w));
+                       /* pass chipc address instead of original core base */
+                       if ((si_alloc_wrapper(sii)) != BCME_OK) {
+                               err_at = 8;
+                               goto exit;
+                       }
+                       ai_scan(&sii->pub, (void *)(uintptr)cc, devid);
+                       /* make sure the wrappers are properly accounted for */
+                       if (sii->axi_num_wrappers == 0) {
+                               SI_ERROR(("FATAL: Wrapper count 0\n"));
+                               err_at = 16;
+                               goto exit;
+                       }
+               }
+                else if (CHIPTYPE(sii->pub.socitype) == SOCI_UBUS) {
+                       SI_MSG(("Found chip type UBUS (0x%08x), chip id = 0x%4x\n", w, sih->chip));
+                       /* pass chipc address instead of original core base */
+                       ub_scan(&sii->pub, (void *)(uintptr)cc, devid);
+               } else {
+                       SI_ERROR(("Found chip of unknown type (0x%08x)\n", w));
+                       err_at = 9;
+                       goto exit;
+               }
+       }
+       /* no cores found, bail out */
+       if (sii->numcores == 0) {
+               err_at = 10;
+               goto exit;
+       }
+       /* bus/core/clk setup */
+       origidx = SI_CC_IDX;
+       if (!si_buscore_setup(sii, cc, bustype, savewin, &origidx, regs)) {
+               err_at = 11;
+               goto exit;
+       }
+
+       /* JIRA: SWWLAN-98321: SPROM read showing wrong values */
+       /* Set the clkdiv2 divisor bits (2:0) to 0x4 if srom is present */
+       if (bustype == SI_BUS) {
+               uint32 clkdiv2, sromprsnt, capabilities, srom_supported;
+               capabilities =  R_REG(osh, &cc->capabilities);
+               srom_supported = capabilities & SROM_SUPPORTED;
+               if (srom_supported) {
+                       sromprsnt = R_REG(osh, &cc->sromcontrol);
+                       sromprsnt = sromprsnt & SROM_PRSNT_MASK;
+                       if (sromprsnt) {
+                               /* SROM clock come from backplane clock/div2. Must <= 1Mhz */
+                               clkdiv2 = (R_REG(osh, &cc->clkdiv2) & ~CLKD2_SROM);
+                               clkdiv2 |= CLKD2_SROMDIV_192;
+                               W_REG(osh, &cc->clkdiv2, clkdiv2);
+                       }
+               }
+       }
+
+       if (bustype == PCI_BUS) {
+
+       }
+#ifdef BCM_SDRBL
+       /* 4360 rom bootloader in PCIE case, if the SDR is enabled, But preotection is
+        * not turned on, then we want to hold arm in reset.
+        * Bottomline: In sdrenable case, we allow arm to boot only when protection is
+        * turned on.
+        */
+       if (CHIP_HOSTIF_PCIE(&(sii->pub))) {
+               uint32 sflags = si_arm_sflags(&(sii->pub));
+
+               /* If SDR is enabled but protection is not turned on
+               * then we want to force arm to WFI.
+               */
+               if ((sflags & (SISF_SDRENABLE | SISF_TCMPROT)) == SISF_SDRENABLE) {
+                       disable_arm_irq();
+                       while (1) {
+                               hnd_cpu_wait(sih);
+                       }
+               }
+       }
+#endif /* BCM_SDRBL */
+
+       pvars = NULL;
+       BCM_REFERENCE(pvars);
+
+       if (!si_onetimeinit) {
+
+               if (CCREV(sii->pub.ccrev) >= 20) {
+                       uint32 gpiopullup = 0, gpiopulldown = 0;
+                       cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+                       ASSERT(cc != NULL);
+
+                       W_REG(osh, &cc->gpiopullup, gpiopullup);
+                       W_REG(osh, &cc->gpiopulldown, gpiopulldown);
+                       si_setcoreidx(sih, origidx);
+               }
+
+#if defined(BT_WLAN_REG_ON_WAR)
+       /*
+        * 4389B0/C0 - WLAN and BT turn on WAR - synchronize WLAN and BT firmware using GCI
+        * semaphore - THREAD_0_GCI_SEM_3_ID to ensure that simultaneous register accesses
+        * does not occur. The WLAN firmware will acquire the semaphore just to ensure that
+        * if BT firmware is already executing the WAR, then wait until it finishes.
+        * In BT firmware checking for WL_REG_ON status is sufficient to decide whether
+        * to apply the WAR or not (i.e, WLAN is turned ON/OFF).
+        */
+       if ((hnd_gcisem_acquire(GCI_BT_WLAN_REG_ON_WAR_SEM, TRUE,
+                       GCI_BT_WLAN_REG_ON_WAR_SEM_TIMEOUT) != BCME_OK)) {
+               err_at = 14;
+               hnd_gcisem_set_err(GCI_BT_WLAN_REG_ON_WAR_SEM);
+               goto exit;
+       }
+       if ((hnd_gcisem_release(GCI_BT_WLAN_REG_ON_WAR_SEM) != BCME_OK)) {
+               hnd_gcisem_set_err(GCI_BT_WLAN_REG_ON_WAR_SEM);
+               err_at = 15;
+               goto exit;
+       }
+#endif /* BT_WLAN_REG_ON_WAR */
+
+               /* Skip PMU initialization from the Dongle Host.
+                * Firmware will take care of it when it comes up.
+                */
+       }
+
+       /* clear any previous epidiag-induced target abort */
+       ASSERT(!si_taclear(sih, FALSE));
+
+#if defined(BCMPMU_STATS) && !defined(BCMPMU_STATS_DISABLED)
+       si_pmustatstimer_init(sih);
+#endif /* BCMPMU_STATS */
+
+#ifdef BOOTLOADER_CONSOLE_OUTPUT
+       /* Enable console prints */
+       si_muxenab(sii, 3);
+#endif
+
+       if (((PCIECOREREV(sih->buscorerev) == 66) || (PCIECOREREV(sih->buscorerev) == 68)) &&
+               CST4378_CHIPMODE_BTOP(sih->chipst)) {
+               /*
+                * HW4378-413 :
+                * BT oob connections for pcie function 1 seen at oob_ain[5] instead of oob_ain[1]
+                */
+               si_oob_war_BT_F1(sih);
+       }
+
+       return (sii);
+
+exit:
+
+       if (err_at) {
+               SI_ERROR(("si_doattach Failed. Error at %d\n", err_at));
+               si_free_coresinfo(sii, osh);
+               si_free_wrapper(sii);
+       }
+       return NULL;
+}
+
+/** may be called with core in reset */
+void
+si_detach(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint idx;
+
+#ifdef BCM_SH_SFLASH
+       if (BCM_SH_SFLASH_ENAB()) {
+               sh_sflash_detach(sii->osh, sih);
+       }
+#endif
+       if (BUSTYPE(sih->bustype) == SI_BUS) {
+               if (CHIPTYPE(sii->pub.socitype) == SOCI_NCI) {
+                       if (sii->nci_info) {
+                               nci_uninit(sii->nci_info);
+                               sii->nci_info = NULL;
+
+                               /* TODO: REG_UNMAP */
+                       }
+               } else {
+                       for (idx = 0; idx < SI_MAXCORES; idx++) {
+                               if (cores_info->regs[idx]) {
+                                       REG_UNMAP(cores_info->regs[idx]);
+                                       cores_info->regs[idx] = NULL;
+                               }
+                       }
+               }
+       }
+
+       si_free_coresinfo(sii, sii->osh);
+
+#if defined(AXI_TIMEOUTS_NIC)
+       if (sih->err_info) {
+               MFREE(sii->osh, sih->err_info, sizeof(si_axi_error_info_t));
+               sii->pub.err_info = NULL;
+       }
+#endif /* AXI_TIMEOUTS_NIC */
+
+       si_free_wrapper(sii);
+
+#ifdef BCMDVFS
+       si_dvfs_info_deinit(sih, sii->osh);
+#endif /* BCMDVFS */
+
+       if (sii != &ksii) {
+               MFREE(sii->osh, sii, sizeof(si_info_t));
+       }
+}
+
+void *
+si_osh(si_t *sih)
+{
+       const si_info_t *sii;
+
+       sii = SI_INFO(sih);
+       return sii->osh;
+}
+
+void
+si_setosh(si_t *sih, osl_t *osh)
+{
+       si_info_t *sii;
+
+       sii = SI_INFO(sih);
+       if (sii->osh != NULL) {
+               SI_ERROR(("osh is already set....\n"));
+               ASSERT(!sii->osh);
+       }
+       sii->osh = osh;
+}
+
+/** register driver interrupt disabling and restoring callback functions */
+void
+si_register_intr_callback(si_t *sih, void *intrsoff_fn, void *intrsrestore_fn,
+                          void *intrsenabled_fn, void *intr_arg)
+{
+       si_info_t *sii = SI_INFO(sih);
+       sii->intr_arg = intr_arg;
+       sii->intrsoff_fn = (si_intrsoff_t)intrsoff_fn;
+       sii->intrsrestore_fn = (si_intrsrestore_t)intrsrestore_fn;
+       sii->intrsenabled_fn = (si_intrsenabled_t)intrsenabled_fn;
+       /* save current core id.  when this function called, the current core
+        * must be the core which provides driver functions(il, et, wl, etc.)
+        */
+       sii->dev_coreid = si_coreid(sih);
+}
+
+void
+si_deregister_intr_callback(si_t *sih)
+{
+       si_info_t *sii;
+
+       sii = SI_INFO(sih);
+       sii->intrsoff_fn = NULL;
+       sii->intrsrestore_fn = NULL;
+       sii->intrsenabled_fn = NULL;
+}
+
+uint
+si_intflag(si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_intflag(sih);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return R_REG(sii->osh, ((uint32 *)(uintptr)
+                           (sii->oob_router + OOB_STATUSA)));
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_intflag(sih);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+uint
+si_flag(si_t *sih)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_flag(sih);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_flag(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_flag(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_flag(sih);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+uint
+si_flag_alt(const si_t *sih)
+{
+       if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+       (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+       (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_flag_alt(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_flag_alt(sih);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+void
+si_setint(const si_t *sih, int siflag)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               sb_setint(sih, siflag);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               ai_setint(sih, siflag);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               ub_setint(sih, siflag);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               nci_setint(sih, siflag);
+       else
+               ASSERT(0);
+}
+
+uint32
+si_oobr_baseaddr(const si_t *sih, bool second)
+{
+       const si_info_t *sii = SI_INFO(sih);
+
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return 0;
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return (second ? sii->oob_router1 : sii->oob_router);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_oobr_baseaddr(sih, second);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+uint
+si_coreid(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       const si_cores_info_t *cores_info = (const si_cores_info_t *)sii->cores_info;
+       if (CHIPTYPE(sii->pub.socitype) == SOCI_NCI) {
+               return nci_coreid(sih, sii->curidx);
+       } else
+       {
+               return cores_info->coreid[sii->curidx];
+       }
+}
+
+uint
+si_coreidx(const si_t *sih)
+{
+       const si_info_t *sii;
+
+       sii = SI_INFO(sih);
+       return sii->curidx;
+}
+
+uint
+si_get_num_cores(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       return sii->numcores;
+}
+
+volatile void *
+si_d11_switch_addrbase(si_t *sih, uint coreunit)
+{
+       return si_setcore(sih,  D11_CORE_ID, coreunit);
+}
+
+/** return the core-type instantiation # of the current core */
+uint
+si_coreunit(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       const si_cores_info_t *cores_info = (const si_cores_info_t *)sii->cores_info;
+       uint idx;
+       uint coreid;
+       uint coreunit;
+       uint i;
+
+       if (CHIPTYPE(sii->pub.socitype) == SOCI_NCI) {
+               return nci_coreunit(sih);
+       }
+
+       coreunit = 0;
+
+       idx = sii->curidx;
+
+       ASSERT(GOODREGS(sii->curmap));
+       coreid = si_coreid(sih);
+
+       /* count the cores of our type */
+       for (i = 0; i < idx; i++)
+               if (cores_info->coreid[i] == coreid)
+                       coreunit++;
+
+       return (coreunit);
+}
+
+uint
+si_corevendor(const si_t *sih)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_corevendor(sih);
+               else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_corevendor(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_corevendor(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_corevendor(sih);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+bool
+si_backplane64(const si_t *sih)
+{
+       return ((sih->cccaps & CC_CAP_BKPLN64) != 0);
+}
+
+uint
+si_corerev(const si_t *sih)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_corerev(sih);
+               else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_corerev(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_corerev(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_corerev(sih);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+uint
+si_corerev_minor(const si_t *sih)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_AI) {
+               return ai_corerev_minor(sih);
+       }
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_corerev_minor(sih);
+       else {
+               return 0;
+       }
+}
+
+/* return index of coreid or BADIDX if not found */
+uint
+si_findcoreidx(const si_t *sih, uint coreid, uint coreunit)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       const si_cores_info_t *cores_info = (const si_cores_info_t *)sii->cores_info;
+       uint found;
+       uint i;
+
+       if (CHIPTYPE(sih->socitype) == SOCI_NCI) {
+               return nci_findcoreidx(sih, coreid, coreunit);
+       }
+
+       found = 0;
+
+       for (i = 0; i < sii->numcores; i++) {
+               if (cores_info->coreid[i] == coreid) {
+                       if (found == coreunit)
+                               return (i);
+                       found++;
+               }
+       }
+
+       return (BADIDX);
+}
+
+/* return the coreid of the core at index */
+uint
+si_findcoreid(const si_t *sih, uint coreidx)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       const si_cores_info_t *cores_info = sii->cores_info;
+
+       if (coreidx >= sii->numcores) {
+               return NODEV_CORE_ID;
+       }
+       if (CHIPTYPE(sih->socitype) == SOCI_NCI) {
+               return nci_coreid(sih, coreidx);
+       }
+       return cores_info->coreid[coreidx];
+}
+
+/** return total coreunit of coreid or zero if not found */
+uint
+si_numcoreunits(const si_t *sih, uint coreid)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       const si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint found = 0;
+       uint i;
+
+       if (CHIPTYPE(sih->socitype) == SOCI_NCI) {
+               return nci_numcoreunits(sih, coreid);
+       }
+       for (i = 0; i < sii->numcores; i++) {
+               if (cores_info->coreid[i] == coreid) {
+                       found++;
+               }
+       }
+
+       return found;
+}
+
+/** return total D11 coreunits */
+uint
+BCMRAMFN(si_numd11coreunits)(const si_t *sih)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_NCI) {
+               return nci_numcoreunits(sih, D11_CORE_ID);
+       }
+       return si_numcoreunits(sih, D11_CORE_ID);
+}
+
+/** return list of found cores */
+uint
+si_corelist(const si_t *sih, uint coreid[])
+{
+       const si_info_t *sii = SI_INFO(sih);
+       const si_cores_info_t *cores_info = (const si_cores_info_t *)sii->cores_info;
+
+       if (CHIPTYPE(sih->socitype) == SOCI_NCI) {
+               return nci_corelist(sih, coreid);
+       }
+       (void)memcpy_s(coreid, (sii->numcores * sizeof(uint)), cores_info->coreid,
+               (sii->numcores * sizeof(uint)));
+       return (sii->numcores);
+}
+
+/** return current wrapper mapping */
+void *
+si_wrapperregs(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+
+       ASSERT(GOODREGS(sii->curwrap));
+
+       return (sii->curwrap);
+}
+
+/** return current register mapping */
+volatile void *
+si_coreregs(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+
+       ASSERT(GOODREGS(sii->curmap));
+
+       return (sii->curmap);
+}
+
+/**
+ * This function changes logical "focus" to the indicated core;
+ * must be called with interrupts off.
+ * Moreover, callers should keep interrupts off during switching out of and back to d11 core
+ */
+volatile void *
+si_setcore(si_t *sih, uint coreid, uint coreunit)
+{
+       si_info_t *sii = SI_INFO(sih);
+       uint idx;
+
+       idx = si_findcoreidx(sih, coreid, coreunit);
+       if (!GOODIDX(idx, sii->numcores)) {
+               return (NULL);
+       }
+
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_setcoreidx(sih, idx);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_setcoreidx(sih, idx);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_setcoreidx(sih, idx);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_setcoreidx(sih, idx);
+       else {
+               ASSERT(0);
+               return NULL;
+       }
+}
+
+volatile void *
+si_setcoreidx(si_t *sih, uint coreidx)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_setcoreidx(sih, coreidx);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_setcoreidx(sih, coreidx);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_setcoreidx(sih, coreidx);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_setcoreidx(sih, coreidx);
+       else {
+               ASSERT(0);
+               return NULL;
+       }
+}
+
+/** Turn off interrupt as required by sb_setcore, before switch core */
+volatile void *
+si_switch_core(si_t *sih, uint coreid, uint *origidx, bcm_int_bitmask_t *intr_val)
+{
+       volatile void *cc;
+       si_info_t *sii = SI_INFO(sih);
+
+       if (SI_FAST(sii)) {
+               /* Overloading the origidx variable to remember the coreid,
+                * this works because the core ids cannot be confused with
+                * core indices.
+                */
+               *origidx = coreid;
+               if (coreid == CC_CORE_ID)
+                       return (volatile void *)CCREGS_FAST(sii);
+               else if (coreid == BUSCORETYPE(sih->buscoretype))
+                       return (volatile void *)PCIEREGS(sii);
+       }
+       INTR_OFF(sii, intr_val);
+       *origidx = sii->curidx;
+       cc = si_setcore(sih, coreid, 0);
+       ASSERT(cc != NULL);
+
+       return cc;
+}
+
+/* restore coreidx and restore interrupt */
+void
+si_restore_core(si_t *sih, uint coreid, bcm_int_bitmask_t *intr_val)
+{
+       si_info_t *sii = SI_INFO(sih);
+
+       if (SI_FAST(sii) && ((coreid == CC_CORE_ID) || (coreid == BUSCORETYPE(sih->buscoretype))))
+               return;
+
+       si_setcoreidx(sih, coreid);
+       INTR_RESTORE(sii, intr_val);
+}
+
+/* Switch to particular core and get corerev */
+#ifdef USE_NEW_COREREV_API
+uint
+si_corerev_ext(si_t *sih, uint coreid, uint coreunit)
+{
+       uint coreidx;
+       uint corerev;
+
+       coreidx = si_coreidx(sih);
+       (void)si_setcore(sih, coreid, coreunit);
+
+       corerev = si_corerev(sih);
+
+       si_setcoreidx(sih, coreidx);
+       return corerev;
+}
+#else
+uint si_get_corerev(si_t *sih, uint core_id)
+{
+       uint corerev, orig_coreid;
+       bcm_int_bitmask_t intr_val;
+
+       si_switch_core(sih, core_id, &orig_coreid, &intr_val);
+       corerev = si_corerev(sih);
+       si_restore_core(sih, orig_coreid, &intr_val);
+       return corerev;
+}
+#endif /* !USE_NEW_COREREV_API */
+
+int
+si_numaddrspaces(const si_t *sih)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_numaddrspaces(sih);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_numaddrspaces(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_numaddrspaces(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_numaddrspaces(sih);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+/* Return the address of the nth address space in the current core
+ * Arguments:
+ * sih : Pointer to struct si_t
+ * spidx : slave port index
+ * baidx : base address index
+ */
+
+uint32
+si_addrspace(const si_t *sih, uint spidx, uint baidx)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_addrspace(sih, baidx);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_addrspace(sih, spidx, baidx);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_addrspace(sih, baidx);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_addrspace(sih, spidx, baidx);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+/* Return the size of the nth address space in the current core
+ * Arguments:
+ * sih : Pointer to struct si_t
+ * spidx : slave port index
+ * baidx : base address index
+ */
+uint32
+si_addrspacesize(const si_t *sih, uint spidx, uint baidx)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_addrspacesize(sih, baidx);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_addrspacesize(sih, spidx, baidx);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_addrspacesize(sih, baidx);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_addrspacesize(sih, spidx, baidx);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+void
+si_coreaddrspaceX(const si_t *sih, uint asidx, uint32 *addr, uint32 *size)
+{
+       /* Only supported for SOCI_AI */
+       if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               ai_coreaddrspaceX(sih, asidx, addr, size);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               nci_coreaddrspaceX(sih, asidx, addr, size);
+       else
+               *size = 0;
+}
+
+uint32
+si_core_cflags(const si_t *sih, uint32 mask, uint32 val)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_core_cflags(sih, mask, val);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_core_cflags(sih, mask, val);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_core_cflags(sih, mask, val);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_core_cflags(sih, mask, val);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+void
+si_core_cflags_wo(const si_t *sih, uint32 mask, uint32 val)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               sb_core_cflags_wo(sih, mask, val);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               ai_core_cflags_wo(sih, mask, val);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               ub_core_cflags_wo(sih, mask, val);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               nci_core_cflags_wo(sih, mask, val);
+       else
+               ASSERT(0);
+}
+
+uint32
+si_core_sflags(const si_t *sih, uint32 mask, uint32 val)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_core_sflags(sih, mask, val);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_core_sflags(sih, mask, val);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_core_sflags(sih, mask, val);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_core_sflags(sih, mask, val);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+void
+si_commit(si_t *sih)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               sb_commit(sih);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               ;
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               ;
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               ;
+       else {
+               ASSERT(0);
+       }
+}
+
+bool
+si_iscoreup(const si_t *sih)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_iscoreup(sih);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_iscoreup(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_iscoreup(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_iscoreup(sih);
+       else {
+               ASSERT(0);
+               return FALSE;
+       }
+}
+
+/** Caller should make sure it is on the right core, before calling this routine */
+uint
+si_wrapperreg(const si_t *sih, uint32 offset, uint32 mask, uint32 val)
+{
+       /* only for AI back plane chips */
+       if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return (ai_wrap_reg(sih, offset, mask, val));
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return (nci_get_wrap_reg(sih, offset, mask, val));
+       return 0;
+}
+/* si_backplane_access is used to read full backplane address from host for PCIE FD
+ * it uses secondary bar-0 window which lies at an offset of 16K from primary bar-0
+ * Provides support for read/write of 1/2/4 bytes of backplane address
+ * Can be used to read/write
+ *     1. core regs
+ *     2. Wrapper regs
+ *     3. memory
+ *     4. BT area
+ * For accessing any 32 bit backplane address, [31 : 12] of backplane should be given in "region"
+ * [11 : 0] should be the "regoff"
+ * for reading  4 bytes from reg 0x200 of d11 core use it like below
+ * : si_backplane_access(sih, 0x18001000, 0x200, 4, 0, TRUE)
+ */
+static int si_backplane_addr_sane(uint addr, uint size)
+{
+       int bcmerror = BCME_OK;
+
+       /* For 2 byte access, address has to be 2 byte aligned */
+       if (size == 2) {
+               if (addr & 0x1) {
+                       bcmerror = BCME_ERROR;
+               }
+       }
+       /* For 4 byte access, address has to be 4 byte aligned */
+       if (size == 4) {
+               if (addr & 0x3) {
+                       bcmerror = BCME_ERROR;
+               }
+       }
+
+       return bcmerror;
+}
+
+void
+si_invalidate_second_bar0win(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       sii->second_bar0win = ~0x0;
+}
+
+int
+si_backplane_access(si_t *sih, uint addr, uint size, uint *val, bool read)
+{
+       volatile uint32 *r = NULL;
+       uint32 region = 0;
+       si_info_t *sii = SI_INFO(sih);
+
+       /* Valid only for pcie bus */
+       if (BUSTYPE(sih->bustype) != PCI_BUS) {
+               SI_ERROR(("Valid only for pcie bus \n"));
+               return BCME_ERROR;
+       }
+       if (CHIPTYPE(sih->socitype) == SOCI_NCI) {
+               return nci_backplane_access(sih, addr, size, val, read);
+       }
+
+       /* Split adrr into region and address offset */
+       region = (addr & (0xFFFFF << 12));
+       addr = addr & 0xFFF;
+
+       /* check for address and size sanity */
+       if (si_backplane_addr_sane(addr, size) != BCME_OK)
+               return BCME_ERROR;
+
+       /* Update window if required */
+       if (sii->second_bar0win != region) {
+               OSL_PCI_WRITE_CONFIG(sii->osh, PCIE2_BAR0_CORE2_WIN, 4, region);
+               sii->second_bar0win = region;
+       }
+
+       /* Estimate effective address
+        * sii->curmap   : bar-0 virtual address
+        * PCI_SECOND_BAR0_OFFSET  : secondar bar-0 offset
+        * regoff : actual reg offset
+        */
+       r = (volatile uint32 *)((volatile char *)sii->curmap + PCI_SECOND_BAR0_OFFSET + addr);
+
+       SI_VMSG(("si curmap %p  region %x regaddr %x effective addr %p READ %d\n",
+               (volatile char*)sii->curmap, region, addr, r, read));
+
+       switch (size) {
+               case sizeof(uint8) :
+                       if (read)
+                               *val = R_REG(sii->osh, (volatile uint8*)r);
+                       else
+                               W_REG(sii->osh, (volatile uint8*)r, *val);
+                       break;
+               case sizeof(uint16) :
+                       if (read)
+                               *val = R_REG(sii->osh, (volatile uint16*)r);
+                       else
+                               W_REG(sii->osh, (volatile uint16*)r, *val);
+                       break;
+               case sizeof(uint32) :
+                       if (read)
+                               *val = R_REG(sii->osh, (volatile uint32*)r);
+                       else
+                               W_REG(sii->osh, (volatile uint32*)r, *val);
+                       break;
+               default :
+                       SI_ERROR(("Invalid  size %d \n", size));
+                       return (BCME_ERROR);
+                       break;
+       }
+
+       return (BCME_OK);
+}
+
+uint
+si_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_corereg(sih, coreidx, regoff, mask, val);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_corereg(sih, coreidx, regoff, mask, val);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_corereg(sih, coreidx, regoff, mask, val);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_corereg(sih, coreidx, regoff, mask, val);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+uint
+si_corereg_writeonly(si_t *sih, uint coreidx, uint regoff, uint mask, uint val)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_NCI) {
+               return nci_corereg_writeonly(sih, coreidx, regoff, mask, val);
+       } else
+       {
+               return ai_corereg_writeonly(sih, coreidx, regoff, mask, val);
+       }
+}
+
+/** ILP sensitive register access needs special treatment to avoid backplane stalls */
+bool si_pmu_is_ilp_sensitive(uint32 idx, uint regoff)
+{
+       if (idx == SI_CC_IDX) {
+               if (CHIPCREGS_ILP_SENSITIVE(regoff))
+                       return TRUE;
+       } else if (PMUREGS_ILP_SENSITIVE(regoff)) {
+               return TRUE;
+       }
+
+       return FALSE;
+}
+
+/** 'idx' should refer either to the chipcommon core or the PMU core */
+uint
+si_pmu_corereg(si_t *sih, uint32 idx, uint regoff, uint mask, uint val)
+{
+       int pmustatus_offset;
+
+       /* prevent backplane stall on double write to 'ILP domain' registers in the PMU */
+       if (mask != 0 && PMUREV(sih->pmurev) >= 22 &&
+           si_pmu_is_ilp_sensitive(idx, regoff)) {
+               pmustatus_offset = AOB_ENAB(sih) ? OFFSETOF(pmuregs_t, pmustatus) :
+                       OFFSETOF(chipcregs_t, pmustatus);
+
+               while (si_corereg(sih, idx, pmustatus_offset, 0, 0) & PST_SLOW_WR_PENDING)
+                       {};
+       }
+
+       return si_corereg(sih, idx, regoff, mask, val);
+}
+
+/*
+ * If there is no need for fiddling with interrupts or core switches (typically silicon
+ * back plane registers, pci registers and chipcommon registers), this function
+ * returns the register offset on this core to a mapped address. This address can
+ * be used for W_REG/R_REG directly.
+ *
+ * For accessing registers that would need a core switch, this function will return
+ * NULL.
+ */
+volatile uint32 *
+si_corereg_addr(si_t *sih, uint coreidx, uint regoff)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_corereg_addr(sih, coreidx, regoff);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_corereg_addr(sih, coreidx, regoff);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               return nci_corereg_addr(sih, coreidx, regoff);
+       else {
+               return 0;
+       }
+}
+
+void
+si_core_disable(const si_t *sih, uint32 bits)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               sb_core_disable(sih, bits);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               ai_core_disable(sih, bits);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               nci_core_disable(sih, bits);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               ub_core_disable(sih, bits);
+}
+
+void
+si_core_reset(si_t *sih, uint32 bits, uint32 resetbits)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               sb_core_reset(sih, bits, resetbits);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               ai_core_reset(sih, bits, resetbits);
+       else if (CHIPTYPE(sih->socitype) == SOCI_NCI)
+               nci_core_reset(sih, bits, resetbits);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               ub_core_reset(sih, bits, resetbits);
+}
+
+/** Run bist on current core. Caller needs to take care of core-specific bist hazards */
+int
+si_corebist(const si_t *sih)
+{
+       uint32 cflags;
+       int result = 0;
+
+       /* Read core control flags */
+       cflags = si_core_cflags(sih, 0, 0);
+
+       /* Set bist & fgc */
+       si_core_cflags(sih, ~0, (SICF_BIST_EN | SICF_FGC));
+
+       /* Wait for bist done */
+       SPINWAIT(((si_core_sflags(sih, 0, 0) & SISF_BIST_DONE) == 0), 100000);
+
+       if (si_core_sflags(sih, 0, 0) & SISF_BIST_ERROR)
+               result = BCME_ERROR;
+
+       /* Reset core control flags */
+       si_core_cflags(sih, 0xffff, cflags);
+
+       return result;
+}
+
+uint
+si_num_slaveports(const si_t *sih, uint coreid)
+{
+       uint idx = si_findcoreidx(sih, coreid, 0);
+       uint num = 0;
+
+       if (idx != BADIDX) {
+               if (CHIPTYPE(sih->socitype) == SOCI_AI) {
+                       num = ai_num_slaveports(sih, idx);
+               }
+               else if (CHIPTYPE(sih->socitype) == SOCI_NCI) {
+                       num = nci_num_slaveports(sih, idx);
+               }
+       }
+       return num;
+}
+
+/* TODO: Check if NCI has a slave port address */
+uint32
+si_get_slaveport_addr(si_t *sih, uint spidx, uint baidx, uint core_id, uint coreunit)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       uint origidx = sii->curidx;
+       uint32 addr = 0x0;
+
+       if (!((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NCI)))
+               goto done;
+
+       si_setcore(sih, core_id, coreunit);
+
+       addr = si_addrspace(sih, spidx, baidx);
+
+       si_setcoreidx(sih, origidx);
+
+done:
+       return addr;
+}
+
+/* TODO: Check if NCI has a d11 slave port address */
+uint32
+si_get_d11_slaveport_addr(si_t *sih, uint spidx, uint baidx, uint coreunit)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       uint origidx = sii->curidx;
+       uint32 addr = 0x0;
+
+       if (!((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NAI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_NCI)))
+               goto done;
+
+       si_setcore(sih, D11_CORE_ID, coreunit);
+
+       addr = si_addrspace(sih, spidx, baidx);
+
+       si_setcoreidx(sih, origidx);
+
+done:
+       return addr;
+}
+
+static uint32
+factor6(uint32 x)
+{
+       switch (x) {
+       case CC_F6_2:   return 2;
+       case CC_F6_3:   return 3;
+       case CC_F6_4:   return 4;
+       case CC_F6_5:   return 5;
+       case CC_F6_6:   return 6;
+       case CC_F6_7:   return 7;
+       default:        return 0;
+       }
+}
+
+/*
+ * Divide the clock by the divisor with protection for
+ * a zero divisor.
+ */
+static uint32
+divide_clock(uint32 clock, uint32 div)
+{
+       return div ? clock / div : 0;
+}
+
+/** calculate the speed the SI would run at given a set of clockcontrol values */
+uint32
+si_clock_rate(uint32 pll_type, uint32 n, uint32 m)
+{
+       uint32 n1, n2, clock, m1, m2, m3, mc;
+
+       n1 = n & CN_N1_MASK;
+       n2 = (n & CN_N2_MASK) >> CN_N2_SHIFT;
+
+       if (pll_type == PLL_TYPE6) {
+               if (m & CC_T6_MMASK)
+                       return CC_T6_M1;
+               else
+                       return CC_T6_M0;
+       } else if ((pll_type == PLL_TYPE1) ||
+                  (pll_type == PLL_TYPE3) ||
+                  (pll_type == PLL_TYPE4) ||
+                  (pll_type == PLL_TYPE7)) {
+               n1 = factor6(n1);
+               n2 += CC_F5_BIAS;
+       } else if (pll_type == PLL_TYPE2) {
+               n1 += CC_T2_BIAS;
+               n2 += CC_T2_BIAS;
+               ASSERT((n1 >= 2) && (n1 <= 7));
+               ASSERT((n2 >= 5) && (n2 <= 23));
+       } else if (pll_type == PLL_TYPE5) {
+               /* 5365 */
+               return (100000000);
+       } else
+               ASSERT(0);
+       /* PLL types 3 and 7 use BASE2 (25Mhz) */
+       if ((pll_type == PLL_TYPE3) ||
+           (pll_type == PLL_TYPE7)) {
+               clock = CC_CLOCK_BASE2 * n1 * n2;
+       } else
+               clock = CC_CLOCK_BASE1 * n1 * n2;
+
+       if (clock == 0)
+               return 0;
+
+       m1 = m & CC_M1_MASK;
+       m2 = (m & CC_M2_MASK) >> CC_M2_SHIFT;
+       m3 = (m & CC_M3_MASK) >> CC_M3_SHIFT;
+       mc = (m & CC_MC_MASK) >> CC_MC_SHIFT;
+
+       if ((pll_type == PLL_TYPE1) ||
+           (pll_type == PLL_TYPE3) ||
+           (pll_type == PLL_TYPE4) ||
+           (pll_type == PLL_TYPE7)) {
+               m1 = factor6(m1);
+               if ((pll_type == PLL_TYPE1) || (pll_type == PLL_TYPE3))
+                       m2 += CC_F5_BIAS;
+               else
+                       m2 = factor6(m2);
+               m3 = factor6(m3);
+
+               switch (mc) {
+               case CC_MC_BYPASS:      return (clock);
+               case CC_MC_M1:          return divide_clock(clock, m1);
+               case CC_MC_M1M2:        return divide_clock(clock, m1 * m2);
+               case CC_MC_M1M2M3:      return divide_clock(clock, m1 * m2 * m3);
+               case CC_MC_M1M3:        return divide_clock(clock, m1 * m3);
+               default:                return (0);
+               }
+       } else {
+               ASSERT(pll_type == PLL_TYPE2);
+
+               m1 += CC_T2_BIAS;
+               m2 += CC_T2M2_BIAS;
+               m3 += CC_T2_BIAS;
+               ASSERT((m1 >= 2) && (m1 <= 7));
+               ASSERT((m2 >= 3) && (m2 <= 10));
+               ASSERT((m3 >= 2) && (m3 <= 7));
+
+               if ((mc & CC_T2MC_M1BYP) == 0)
+                       clock /= m1;
+               if ((mc & CC_T2MC_M2BYP) == 0)
+                       clock /= m2;
+               if ((mc & CC_T2MC_M3BYP) == 0)
+                       clock /= m3;
+
+               return (clock);
+       }
+}
+
+/**
+ * Some chips could have multiple host interfaces, however only one will be active.
+ * For a given chip. Depending pkgopt and cc_chipst return the active host interface.
+ */
+uint
+si_chip_hostif(const si_t *sih)
+{
+       uint hosti = 0;
+
+       switch (CHIPID(sih->chip)) {
+       case BCM43012_CHIP_ID:
+       case BCM43013_CHIP_ID:
+       case BCM43014_CHIP_ID:
+               hosti = CHIP_HOSTIF_SDIOMODE;
+               break;
+       CASE_BCM43602_CHIP:
+               hosti = CHIP_HOSTIF_PCIEMODE;
+               break;
+
+       case BCM4360_CHIP_ID:
+               /* chippkg bit-0 == 0 is PCIE only pkgs
+                * chippkg bit-0 == 1 has both PCIE and USB cores enabled
+                */
+               if ((sih->chippkg & 0x1) && (sih->chipst & CST4360_MODE_USB))
+                       hosti = CHIP_HOSTIF_USBMODE;
+               else
+                       hosti = CHIP_HOSTIF_PCIEMODE;
+
+               break;
+
+       case BCM4369_CHIP_GRPID:
+                if (CST4369_CHIPMODE_SDIOD(sih->chipst))
+                        hosti = CHIP_HOSTIF_SDIOMODE;
+                else if (CST4369_CHIPMODE_PCIE(sih->chipst))
+                        hosti = CHIP_HOSTIF_PCIEMODE;
+                break;
+       case BCM4368_CHIP_GRPID:
+                hosti = CHIP_HOSTIF_PCIEMODE;
+                break;
+       case BCM4376_CHIP_GRPID:
+       case BCM4378_CHIP_GRPID:
+       case BCM4385_CHIP_GRPID:
+       case BCM4387_CHIP_GRPID:
+       case BCM4388_CHIP_GRPID:
+       case BCM4389_CHIP_GRPID:
+                hosti = CHIP_HOSTIF_PCIEMODE;
+                break;
+        case BCM4362_CHIP_GRPID:
+               if (CST4362_CHIPMODE_SDIOD(sih->chipst)) {
+                       hosti = CHIP_HOSTIF_SDIOMODE;
+               } else if (CST4362_CHIPMODE_PCIE(sih->chipst)) {
+                       hosti = CHIP_HOSTIF_PCIEMODE;
+               }
+               break;
+
+       default:
+               break;
+       }
+
+       return hosti;
+}
+
+/** set chip watchdog reset timer to fire in 'ticks' */
+void
+si_watchdog(si_t *sih, uint ticks)
+{
+       uint nb, maxt;
+       uint pmu_wdt = 1;
+
+       if (PMUCTL_ENAB(sih) && pmu_wdt) {
+               nb = (CCREV(sih->ccrev) < 26) ? 16 : ((CCREV(sih->ccrev) >= 37) ? 32 : 24);
+               /* The mips compiler uses the sllv instruction,
+                * so we specially handle the 32-bit case.
+                */
+               if (nb == 32)
+                       maxt = 0xffffffff;
+               else
+                       maxt = ((1 << nb) - 1);
+
+               /* PR43821: PMU watchdog timer needs min. of 2 ticks */
+               if (ticks == 1)
+                       ticks = 2;
+               else if (ticks > maxt)
+                       ticks = maxt;
+               if ((CHIPID(sih->chip) == BCM43012_CHIP_ID) ||
+                       (CHIPID(sih->chip) == BCM43013_CHIP_ID) ||
+                       (CHIPID(sih->chip) == BCM43014_CHIP_ID)) {
+                       PMU_REG_NEW(sih, min_res_mask, ~0, DEFAULT_43012_MIN_RES_MASK);
+                       PMU_REG_NEW(sih, watchdog_res_mask, ~0, DEFAULT_43012_MIN_RES_MASK);
+                       PMU_REG_NEW(sih, pmustatus, PST_WDRESET, PST_WDRESET);
+                       PMU_REG_NEW(sih, pmucontrol_ext, PCTL_EXT_FASTLPO_SWENAB, 0);
+                       SPINWAIT((PMU_REG(sih, pmustatus, 0, 0) & PST_ILPFASTLPO),
+                               PMU_MAX_TRANSITION_DLY);
+               }
+               pmu_corereg(sih, SI_CC_IDX, pmuwatchdog, ~0, ticks);
+       } else {
+               maxt = (1 << 28) - 1;
+               if (ticks > maxt)
+                       ticks = maxt;
+
+               if (CCREV(sih->ccrev) >= 65) {
+                       si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, watchdog), ~0,
+                               (ticks & WD_COUNTER_MASK) | WD_SSRESET_PCIE_F0_EN |
+                                       WD_SSRESET_PCIE_ALL_FN_EN);
+               } else {
+                       si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, watchdog), ~0, ticks);
+               }
+       }
+}
+
+/** trigger watchdog reset after ms milliseconds */
+void
+si_watchdog_ms(si_t *sih, uint32 ms)
+{
+       si_watchdog(sih, wd_msticks * ms);
+}
+
+uint32 si_watchdog_msticks(void)
+{
+       return wd_msticks;
+}
+
+bool
+si_taclear(si_t *sih, bool details)
+{
+       return FALSE;
+}
+
+/** return the slow clock source - LPO, XTAL, or PCI */
+static uint
+si_slowclk_src(si_info_t *sii)
+{
+       chipcregs_t *cc;
+
+       ASSERT(SI_FAST(sii) || si_coreid(&sii->pub) == CC_CORE_ID);
+
+       if (CCREV(sii->pub.ccrev) < 6) {
+               if ((BUSTYPE(sii->pub.bustype) == PCI_BUS) &&
+                   (OSL_PCI_READ_CONFIG(sii->osh, PCI_GPIO_OUT, sizeof(uint32)) &
+                    PCI_CFG_GPIO_SCS))
+                       return (SCC_SS_PCI);
+               else
+                       return (SCC_SS_XTAL);
+       } else if (CCREV(sii->pub.ccrev) < 10) {
+               cc = (chipcregs_t *)si_setcoreidx(&sii->pub, sii->curidx);
+               ASSERT(cc);
+               return (R_REG(sii->osh, &cc->slow_clk_ctl) & SCC_SS_MASK);
+       } else  /* Insta-clock */
+               return (SCC_SS_XTAL);
+}
+
+/** return the ILP (slowclock) min or max frequency */
+static uint
+si_slowclk_freq(si_info_t *sii, bool max_freq, chipcregs_t *cc)
+{
+       uint32 slowclk;
+       uint div;
+
+       ASSERT(SI_FAST(sii) || si_coreid(&sii->pub) == CC_CORE_ID);
+
+       /* shouldn't be here unless we've established the chip has dynamic clk control */
+       ASSERT(R_REG(sii->osh, &cc->capabilities) & CC_CAP_PWR_CTL);
+
+       slowclk = si_slowclk_src(sii);
+       if (CCREV(sii->pub.ccrev) < 6) {
+               if (slowclk == SCC_SS_PCI)
+                       return (max_freq ? (PCIMAXFREQ / 64) : (PCIMINFREQ / 64));
+               else
+                       return (max_freq ? (XTALMAXFREQ / 32) : (XTALMINFREQ / 32));
+       } else if (CCREV(sii->pub.ccrev) < 10) {
+               div = 4 *
+                       (((R_REG(sii->osh, &cc->slow_clk_ctl) & SCC_CD_MASK) >> SCC_CD_SHIFT) + 1);
+               if (slowclk == SCC_SS_LPO)
+                       return (max_freq ? LPOMAXFREQ : LPOMINFREQ);
+               else if (slowclk == SCC_SS_XTAL)
+                       return (max_freq ? (XTALMAXFREQ / div) : (XTALMINFREQ / div));
+               else if (slowclk == SCC_SS_PCI)
+                       return (max_freq ? (PCIMAXFREQ / div) : (PCIMINFREQ / div));
+               else
+                       ASSERT(0);
+       } else {
+               /* Chipc rev 10 is InstaClock */
+               div = R_REG(sii->osh, &cc->system_clk_ctl) >> SYCC_CD_SHIFT;
+               div = 4 * (div + 1);
+               return (max_freq ? XTALMAXFREQ : (XTALMINFREQ / div));
+       }
+       return (0);
+}
+
+static void
+si_clkctl_setdelay(si_info_t *sii, void *chipcregs)
+{
+       chipcregs_t *cc = (chipcregs_t *)chipcregs;
+       uint slowmaxfreq, pll_delay, slowclk;
+       uint pll_on_delay, fref_sel_delay;
+
+       pll_delay = PLL_DELAY;
+
+       /* If the slow clock is not sourced by the xtal then add the xtal_on_delay
+        * since the xtal will also be powered down by dynamic clk control logic.
+        */
+
+       slowclk = si_slowclk_src(sii);
+       if (slowclk != SCC_SS_XTAL)
+               pll_delay += XTAL_ON_DELAY;
+
+       /* Starting with 4318 it is ILP that is used for the delays */
+       slowmaxfreq = si_slowclk_freq(sii, (CCREV(sii->pub.ccrev) >= 10) ? FALSE : TRUE, cc);
+
+       pll_on_delay = ((slowmaxfreq * pll_delay) + 999999) / 1000000;
+       fref_sel_delay = ((slowmaxfreq * FREF_DELAY) + 999999) / 1000000;
+
+       W_REG(sii->osh, &cc->pll_on_delay, pll_on_delay);
+       W_REG(sii->osh, &cc->fref_sel_delay, fref_sel_delay);
+}
+
+/** initialize power control delay registers */
+void
+si_clkctl_init(si_t *sih)
+{
+       si_info_t *sii;
+       uint origidx = 0;
+       chipcregs_t *cc;
+       bool fast;
+
+       if (!CCCTL_ENAB(sih))
+               return;
+
+       sii = SI_INFO(sih);
+       fast = SI_FAST(sii);
+       if (!fast) {
+               origidx = sii->curidx;
+               if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL)
+                       return;
+       } else if ((cc = (chipcregs_t *)CCREGS_FAST(sii)) == NULL)
+               return;
+       ASSERT(cc != NULL);
+
+       /* set all Instaclk chip ILP to 1 MHz */
+       if (CCREV(sih->ccrev) >= 10)
+               SET_REG(sii->osh, &cc->system_clk_ctl, SYCC_CD_MASK,
+                       (ILP_DIV_1MHZ << SYCC_CD_SHIFT));
+
+       si_clkctl_setdelay(sii, (void *)(uintptr)cc);
+
+       /* PR 110294 */
+       OSL_DELAY(20000);
+
+       if (!fast)
+               si_setcoreidx(sih, origidx);
+}
+
+/** change logical "focus" to the gpio core for optimized access */
+volatile void *
+si_gpiosetcore(si_t *sih)
+{
+       return (si_setcoreidx(sih, SI_CC_IDX));
+}
+
+/**
+ * mask & set gpiocontrol bits.
+ * If a gpiocontrol bit is set to 0, chipcommon controls the corresponding GPIO pin.
+ * If a gpiocontrol bit is set to 1, the GPIO pin is no longer a GPIO and becomes dedicated
+ *   to some chip-specific purpose.
+ */
+uint32
+si_gpiocontrol(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+       uint regoff;
+
+       regoff = 0;
+
+       /* gpios could be shared on router platforms
+        * ignore reservation if it's high priority (e.g., test apps)
+        */
+       if ((priority != GPIO_HI_PRIORITY) &&
+           (BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+               mask = priority ? (si_gpioreservation & mask) :
+                       ((si_gpioreservation | mask) & ~(si_gpioreservation));
+               val &= mask;
+       }
+
+       regoff = OFFSETOF(chipcregs_t, gpiocontrol);
+       return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/** mask&set gpio output enable bits */
+uint32
+si_gpioouten(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+       uint regoff;
+
+       regoff = 0;
+
+       /* gpios could be shared on router platforms
+        * ignore reservation if it's high priority (e.g., test apps)
+        */
+       if ((priority != GPIO_HI_PRIORITY) &&
+           (BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+               mask = priority ? (si_gpioreservation & mask) :
+                       ((si_gpioreservation | mask) & ~(si_gpioreservation));
+               val &= mask;
+       }
+
+       regoff = OFFSETOF(chipcregs_t, gpioouten);
+       return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/** mask&set gpio output bits */
+uint32
+si_gpioout(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+       uint regoff;
+
+       regoff = 0;
+
+       /* gpios could be shared on router platforms
+        * ignore reservation if it's high priority (e.g., test apps)
+        */
+       if ((priority != GPIO_HI_PRIORITY) &&
+           (BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+               mask = priority ? (si_gpioreservation & mask) :
+                       ((si_gpioreservation | mask) & ~(si_gpioreservation));
+               val &= mask;
+       }
+
+       regoff = OFFSETOF(chipcregs_t, gpioout);
+       return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/** reserve one gpio */
+uint32
+si_gpioreserve(const si_t *sih, uint32 gpio_bitmask, uint8 priority)
+{
+       /* only cores on SI_BUS share GPIO's and only applcation users need to
+        * reserve/release GPIO
+        */
+       if ((BUSTYPE(sih->bustype) != SI_BUS) || (!priority)) {
+               ASSERT((BUSTYPE(sih->bustype) == SI_BUS) && (priority));
+               return 0xffffffff;
+       }
+       /* make sure only one bit is set */
+       if ((!gpio_bitmask) || ((gpio_bitmask) & (gpio_bitmask - 1))) {
+               ASSERT((gpio_bitmask) && !((gpio_bitmask) & (gpio_bitmask - 1)));
+               return 0xffffffff;
+       }
+
+       /* already reserved */
+       if (si_gpioreservation & gpio_bitmask)
+               return 0xffffffff;
+       /* set reservation */
+       si_gpioreservation |= gpio_bitmask;
+
+       return si_gpioreservation;
+}
+
+/**
+ * release one gpio.
+ *
+ * releasing the gpio doesn't change the current value on the GPIO last write value
+ * persists till someone overwrites it.
+ */
+uint32
+si_gpiorelease(const si_t *sih, uint32 gpio_bitmask, uint8 priority)
+{
+       /* only cores on SI_BUS share GPIO's and only applcation users need to
+        * reserve/release GPIO
+        */
+       if ((BUSTYPE(sih->bustype) != SI_BUS) || (!priority)) {
+               ASSERT((BUSTYPE(sih->bustype) == SI_BUS) && (priority));
+               return 0xffffffff;
+       }
+       /* make sure only one bit is set */
+       if ((!gpio_bitmask) || ((gpio_bitmask) & (gpio_bitmask - 1))) {
+               ASSERT((gpio_bitmask) && !((gpio_bitmask) & (gpio_bitmask - 1)));
+               return 0xffffffff;
+       }
+
+       /* already released */
+       if (!(si_gpioreservation & gpio_bitmask))
+               return 0xffffffff;
+
+       /* clear reservation */
+       si_gpioreservation &= ~gpio_bitmask;
+
+       return si_gpioreservation;
+}
+
+/* return the current gpioin register value */
+uint32
+si_gpioin(si_t *sih)
+{
+       uint regoff;
+
+       regoff = OFFSETOF(chipcregs_t, gpioin);
+       return (si_corereg(sih, SI_CC_IDX, regoff, 0, 0));
+}
+
+/* mask&set gpio interrupt polarity bits */
+uint32
+si_gpiointpolarity(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+       uint regoff;
+
+       /* gpios could be shared on router platforms */
+       if ((BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+               mask = priority ? (si_gpioreservation & mask) :
+                       ((si_gpioreservation | mask) & ~(si_gpioreservation));
+               val &= mask;
+       }
+
+       regoff = OFFSETOF(chipcregs_t, gpiointpolarity);
+       return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/* mask&set gpio interrupt mask bits */
+uint32
+si_gpiointmask(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+       uint regoff;
+
+       /* gpios could be shared on router platforms */
+       if ((BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+               mask = priority ? (si_gpioreservation & mask) :
+                       ((si_gpioreservation | mask) & ~(si_gpioreservation));
+               val &= mask;
+       }
+
+       regoff = OFFSETOF(chipcregs_t, gpiointmask);
+       return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+uint32
+si_gpioeventintmask(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+       uint regoff;
+       /* gpios could be shared on router platforms */
+       if ((BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+               mask = priority ? (si_gpioreservation & mask) :
+                       ((si_gpioreservation | mask) & ~(si_gpioreservation));
+               val &= mask;
+       }
+       regoff = OFFSETOF(chipcregs_t, gpioeventintmask);
+       return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+uint32
+si_gpiopull(si_t *sih, bool updown, uint32 mask, uint32 val)
+{
+       uint offs;
+
+       if (CCREV(sih->ccrev) < 20)
+               return 0xffffffff;
+
+       offs = (updown ? OFFSETOF(chipcregs_t, gpiopulldown) : OFFSETOF(chipcregs_t, gpiopullup));
+       return (si_corereg(sih, SI_CC_IDX, offs, mask, val));
+}
+
+uint32
+si_gpioevent(si_t *sih, uint regtype, uint32 mask, uint32 val)
+{
+       uint offs;
+
+       if (CCREV(sih->ccrev) < 11)
+               return 0xffffffff;
+
+       if (regtype == GPIO_REGEVT)
+               offs = OFFSETOF(chipcregs_t, gpioevent);
+       else if (regtype == GPIO_REGEVT_INTMSK)
+               offs = OFFSETOF(chipcregs_t, gpioeventintmask);
+       else if (regtype == GPIO_REGEVT_INTPOL)
+               offs = OFFSETOF(chipcregs_t, gpioeventintpolarity);
+       else
+               return 0xffffffff;
+
+       return (si_corereg(sih, SI_CC_IDX, offs, mask, val));
+}
+
+uint32
+si_gpio_int_enable(si_t *sih, bool enable)
+{
+       uint offs;
+
+       if (CCREV(sih->ccrev) < 11)
+               return 0xffffffff;
+
+       offs = OFFSETOF(chipcregs_t, intmask);
+       return (si_corereg(sih, SI_CC_IDX, offs, CI_GPIO, (enable ? CI_GPIO : 0)));
+}
+
+/** Return the size of the specified SYSMEM bank */
+static uint
+sysmem_banksize(const si_info_t *sii, sysmemregs_t *regs, uint8 idx)
+{
+       uint banksize, bankinfo;
+       uint bankidx = idx;
+
+       W_REG(sii->osh, &regs->bankidx, bankidx);
+       bankinfo = R_REG(sii->osh, &regs->bankinfo);
+       banksize = SYSMEM_BANKINFO_SZBASE * ((bankinfo & SYSMEM_BANKINFO_SZMASK) + 1);
+       return banksize;
+}
+
+/** Return the RAM size of the SYSMEM core */
+uint32
+si_sysmem_size(si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       uint origidx;
+       bcm_int_bitmask_t intr_val;
+
+       sysmemregs_t *regs;
+       bool wasup;
+       uint32 coreinfo;
+       uint memsize = 0;
+       uint8 i;
+       uint nb, nrb;
+
+       /* Block ints and save current core */
+       INTR_OFF(sii, &intr_val);
+       origidx = si_coreidx(sih);
+
+       /* Switch to SYSMEM core */
+       if (!(regs = si_setcore(sih, SYSMEM_CORE_ID, 0)))
+               goto done;
+
+       /* Get info for determining size */
+       if (!(wasup = si_iscoreup(sih)))
+               si_core_reset(sih, 0, 0);
+       coreinfo = R_REG(sii->osh, &regs->coreinfo);
+
+       /* Number of ROM banks, SW need to skip the ROM banks. */
+       nrb = (coreinfo & SYSMEM_SRCI_ROMNB_MASK) >> SYSMEM_SRCI_ROMNB_SHIFT;
+
+       nb = (coreinfo & SYSMEM_SRCI_SRNB_MASK) >> SYSMEM_SRCI_SRNB_SHIFT;
+       for (i = 0; i < nb; i++)
+               memsize += sysmem_banksize(sii, regs, i + nrb);
+
+       si_setcoreidx(sih, origidx);
+
+done:
+       INTR_RESTORE(sii, &intr_val);
+
+       return memsize;
+}
+
+/** Return the size of the specified SOCRAM bank */
+static uint
+socram_banksize(const si_info_t *sii, sbsocramregs_t *regs, uint8 idx, uint8 mem_type)
+{
+       uint banksize, bankinfo;
+       uint bankidx = idx | (mem_type << SOCRAM_BANKIDX_MEMTYPE_SHIFT);
+
+       ASSERT(mem_type <= SOCRAM_MEMTYPE_DEVRAM);
+
+       W_REG(sii->osh, &regs->bankidx, bankidx);
+       bankinfo = R_REG(sii->osh, &regs->bankinfo);
+       banksize = SOCRAM_BANKINFO_SZBASE * ((bankinfo & SOCRAM_BANKINFO_SZMASK) + 1);
+       return banksize;
+}
+
+void si_socram_set_bankpda(si_t *sih, uint32 bankidx, uint32 bankpda)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       uint origidx;
+       bcm_int_bitmask_t intr_val;
+       sbsocramregs_t *regs;
+       bool wasup;
+       uint corerev;
+
+       /* Block ints and save current core */
+       INTR_OFF(sii, &intr_val);
+       origidx = si_coreidx(sih);
+
+       /* Switch to SOCRAM core */
+       if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+               goto done;
+
+       if (!(wasup = si_iscoreup(sih)))
+               si_core_reset(sih, 0, 0);
+
+       corerev = si_corerev(sih);
+       if (corerev >= 16) {
+               W_REG(sii->osh, &regs->bankidx, bankidx);
+               W_REG(sii->osh, &regs->bankpda, bankpda);
+       }
+
+       /* Return to previous state and core */
+       if (!wasup)
+               si_core_disable(sih, 0);
+       si_setcoreidx(sih, origidx);
+
+done:
+       INTR_RESTORE(sii, &intr_val);
+}
+
+/** Return the RAM size of the SOCRAM core */
+uint32
+si_socram_size(si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       uint origidx;
+       bcm_int_bitmask_t intr_val;
+
+       sbsocramregs_t *regs;
+       bool wasup;
+       uint corerev;
+       uint32 coreinfo;
+       uint memsize = 0;
+
+       /* Block ints and save current core */
+       INTR_OFF(sii, &intr_val);
+       origidx = si_coreidx(sih);
+
+       /* Switch to SOCRAM core */
+       if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+               goto done;
+
+       /* Get info for determining size */
+       if (!(wasup = si_iscoreup(sih)))
+               si_core_reset(sih, 0, 0);
+       corerev = si_corerev(sih);
+       coreinfo = R_REG(sii->osh, &regs->coreinfo);
+
+       /* Calculate size from coreinfo based on rev */
+       if (corerev == 0)
+               memsize = 1 << (16 + (coreinfo & SRCI_MS0_MASK));
+       else if (corerev < 3) {
+               memsize = 1 << (SR_BSZ_BASE + (coreinfo & SRCI_SRBSZ_MASK));
+               memsize *= (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+       } else if ((corerev <= 7) || (corerev == 12)) {
+               uint nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+               uint bsz = (coreinfo & SRCI_SRBSZ_MASK);
+               uint lss = (coreinfo & SRCI_LSS_MASK) >> SRCI_LSS_SHIFT;
+               if (lss != 0)
+                       nb --;
+               memsize = nb * (1 << (bsz + SR_BSZ_BASE));
+               if (lss != 0)
+                       memsize += (1 << ((lss - 1) + SR_BSZ_BASE));
+       } else {
+               uint8 i;
+               uint nb;
+               /* length of SRAM Banks increased for corerev greater than 23 */
+               if (corerev >= 23) {
+                       nb = (coreinfo & (SRCI_SRNB_MASK | SRCI_SRNB_MASK_EXT)) >> SRCI_SRNB_SHIFT;
+               } else {
+                       nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+               }
+               for (i = 0; i < nb; i++)
+                       memsize += socram_banksize(sii, regs, i, SOCRAM_MEMTYPE_RAM);
+       }
+
+       /* Return to previous state and core */
+       if (!wasup)
+               si_core_disable(sih, 0);
+       si_setcoreidx(sih, origidx);
+
+done:
+       INTR_RESTORE(sii, &intr_val);
+
+       return memsize;
+}
+
+/* Return true if bus MPU is present */
+bool
+si_is_bus_mpu_present(si_t *sih)
+{
+       uint origidx, newidx = NODEV_CORE_ID;
+       sysmemregs_t *sysmemregs = NULL;
+       cr4regs_t *cr4regs;
+       const si_info_t *sii = SI_INFO(sih);
+       uint ret = 0;
+       bool wasup;
+
+       origidx = si_coreidx(sih);
+
+       cr4regs = si_setcore(sih, ARMCR4_CORE_ID, 0);
+       if (cr4regs) {
+               /* ARMCR4 */
+               newidx = ARMCR4_CORE_ID;
+       } else {
+               sysmemregs = si_setcore(sih, SYSMEM_CORE_ID, 0);
+               if (sysmemregs) {
+                       /* ARMCA7 */
+                       newidx = SYSMEM_CORE_ID;
+               }
+       }
+
+       if (newidx != NODEV_CORE_ID) {
+               if (!(wasup = si_iscoreup(sih))) {
+                       si_core_reset(sih, 0, 0);
+               }
+               if (newidx == ARMCR4_CORE_ID) {
+                       /* ARMCR4 */
+                       ret = R_REG(sii->osh, &cr4regs->corecapabilities) & CAP_MPU_MASK;
+               } else {
+                       /* ARMCA7 */
+                       ret = R_REG(sii->osh, &sysmemregs->mpucapabilities) &
+                               ACC_MPU_REGION_CNT_MASK;
+               }
+               if (!wasup) {
+                       si_core_disable(sih, 0);
+               }
+       }
+
+       si_setcoreidx(sih, origidx);
+
+       return ret ? TRUE : FALSE;
+}
+
+/** Return the TCM-RAM size of the ARMCR4 core. */
+uint32
+si_tcm_size(si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       uint origidx;
+       bcm_int_bitmask_t intr_val;
+       volatile uint8 *regs;
+       bool wasup;
+       uint32 corecap;
+       uint memsize = 0;
+       uint banku_size = 0;
+       uint32 nab = 0;
+       uint32 nbb = 0;
+       uint32 totb = 0;
+       uint32 bxinfo = 0;
+       uint32 idx = 0;
+       volatile uint32 *arm_cap_reg;
+       volatile uint32 *arm_bidx;
+       volatile uint32 *arm_binfo;
+
+       /* Block ints and save current core */
+       INTR_OFF(sii, &intr_val);
+       origidx = si_coreidx(sih);
+
+       /* Switch to CR4 core */
+       if (!(regs = si_setcore(sih, ARMCR4_CORE_ID, 0)))
+               goto done;
+
+       /* Get info for determining size. If in reset, come out of reset,
+        * but remain in halt
+        */
+       if (!(wasup = si_iscoreup(sih)))
+               si_core_reset(sih, SICF_CPUHALT, SICF_CPUHALT);
+
+       arm_cap_reg = (volatile uint32 *)(regs + SI_CR4_CAP);
+       corecap = R_REG(sii->osh, arm_cap_reg);
+
+       nab = (corecap & ARMCR4_TCBANB_MASK) >> ARMCR4_TCBANB_SHIFT;
+       nbb = (corecap & ARMCR4_TCBBNB_MASK) >> ARMCR4_TCBBNB_SHIFT;
+       totb = nab + nbb;
+
+       arm_bidx = (volatile uint32 *)(regs + SI_CR4_BANKIDX);
+       arm_binfo = (volatile uint32 *)(regs + SI_CR4_BANKINFO);
+       for (idx = 0; idx < totb; idx++) {
+               W_REG(sii->osh, arm_bidx, idx);
+
+               bxinfo = R_REG(sii->osh, arm_binfo);
+               if (bxinfo & ARMCR4_BUNITSZ_MASK) {
+                       banku_size = ARMCR4_BSZ_1K;
+               } else {
+                       banku_size = ARMCR4_BSZ_8K;
+               }
+               memsize += ((bxinfo & ARMCR4_BSZ_MASK) + 1) * banku_size;
+       }
+
+       /* Return to previous state and core */
+       if (!wasup)
+               si_core_disable(sih, 0);
+       si_setcoreidx(sih, origidx);
+
+done:
+       INTR_RESTORE(sii, &intr_val);
+
+       return memsize;
+}
+
+bool
+si_has_flops(si_t *sih)
+{
+       uint origidx, cr4_rev;
+
+       /* Find out CR4 core revision */
+       origidx = si_coreidx(sih);
+       if (si_setcore(sih, ARMCR4_CORE_ID, 0)) {
+               cr4_rev = si_corerev(sih);
+               si_setcoreidx(sih, origidx);
+
+               if (cr4_rev == 1 || cr4_rev >= 3)
+                       return TRUE;
+       }
+       return FALSE;
+}
+
+uint32
+si_socram_srmem_size(si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       uint origidx;
+       bcm_int_bitmask_t intr_val;
+
+       sbsocramregs_t *regs;
+       bool wasup;
+       uint corerev;
+       uint32 coreinfo;
+       uint memsize = 0;
+
+       /* Block ints and save current core */
+       INTR_OFF(sii, &intr_val);
+       origidx = si_coreidx(sih);
+
+       /* Switch to SOCRAM core */
+       if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+               goto done;
+
+       /* Get info for determining size */
+       if (!(wasup = si_iscoreup(sih)))
+               si_core_reset(sih, 0, 0);
+       corerev = si_corerev(sih);
+       coreinfo = R_REG(sii->osh, &regs->coreinfo);
+
+       /* Calculate size from coreinfo based on rev */
+       if (corerev >= 16) {
+               uint8 i;
+               uint nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+               for (i = 0; i < nb; i++) {
+                       W_REG(sii->osh, &regs->bankidx, i);
+                       if (R_REG(sii->osh, &regs->bankinfo) & SOCRAM_BANKINFO_RETNTRAM_MASK)
+                               memsize += socram_banksize(sii, regs, i, SOCRAM_MEMTYPE_RAM);
+               }
+       }
+
+       /* Return to previous state and core */
+       if (!wasup)
+               si_core_disable(sih, 0);
+       si_setcoreidx(sih, origidx);
+
+done:
+       INTR_RESTORE(sii, &intr_val);
+
+       return memsize;
+}
+
+/**
+ * For boards that use GPIO(8) is used for Bluetooth Coex TX_WLAN pin,
+ * when GPIOControl for Pin 8 is with ChipCommon core,
+ * if UART_TX_1 (bit 5: Chipc capabilities) strapping option is set, then
+ * GPIO pin 8 is driven by Uart0MCR:2 rather than GPIOOut:8. To drive this pin
+ * low, one has to set Uart0MCR:2 to 1. This is required when the BTC is disabled,
+ * or the driver goes down. Refer to PR35488.
+ */
+void
+si_btcgpiowar(si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       uint origidx;
+       bcm_int_bitmask_t intr_val;
+       chipcregs_t *cc;
+
+       /* Make sure that there is ChipCommon core present &&
+        * UART_TX is strapped to 1
+        */
+       if (!(sih->cccaps & CC_CAP_UARTGPIO))
+               return;
+
+       /* si_corereg cannot be used as we have to guarantee 8-bit read/writes */
+       INTR_OFF(sii, &intr_val);
+
+       origidx = si_coreidx(sih);
+
+       cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+       ASSERT(cc != NULL);
+
+       W_REG(sii->osh, &cc->uart0mcr, R_REG(sii->osh, &cc->uart0mcr) | 0x04);
+
+       /* restore the original index */
+       si_setcoreidx(sih, origidx);
+
+       INTR_RESTORE(sii, &intr_val);
+}
+
+void
+si_chipcontrl_restore(si_t *sih, uint32 val)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("si_chipcontrl_restore: Failed to find CORE ID!\n"));
+               return;
+       }
+       W_REG(sii->osh, &cc->chipcontrol, val);
+       si_setcoreidx(sih, origidx);
+}
+
+uint32
+si_chipcontrl_read(si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+       uint32 val;
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("si_chipcontrl_read: Failed to find CORE ID!\n"));
+               return -1;
+       }
+       val = R_REG(sii->osh, &cc->chipcontrol);
+       si_setcoreidx(sih, origidx);
+       return val;
+}
+
+/** switch muxed pins, on: SROM, off: FEMCTRL. Called for a family of ac chips, not just 4360. */
+void
+si_chipcontrl_srom4360(si_t *sih, bool on)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+       uint32 val;
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("si_chipcontrl_srom4360: Failed to find CORE ID!\n"));
+               return;
+       }
+       val = R_REG(sii->osh, &cc->chipcontrol);
+
+       if (on) {
+               val &= ~(CCTRL4360_SECI_MODE |
+                       CCTRL4360_BTSWCTRL_MODE |
+                       CCTRL4360_EXTRA_FEMCTRL_MODE |
+                       CCTRL4360_BT_LGCY_MODE |
+                       CCTRL4360_CORE2FEMCTRL4_ON);
+
+               W_REG(sii->osh, &cc->chipcontrol, val);
+       } else {
+               /* huh, nothing here? */
+       }
+
+       si_setcoreidx(sih, origidx);
+}
+
+/**
+ * The SROM clock is derived from the backplane clock. For chips having a fast
+ * backplane clock that requires a higher-than-POR-default clock divisor ratio for the SROM clock.
+ */
+void
+si_srom_clk_set(si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+       uint32 val;
+       uint32 divisor = 1;
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("si_srom_clk_set: Failed to find CORE ID!\n"));
+               return;
+       }
+
+       val = R_REG(sii->osh, &cc->clkdiv2);
+       ASSERT(0);
+
+       W_REG(sii->osh, &cc->clkdiv2, ((val & ~CLKD2_SROM) | divisor));
+       si_setcoreidx(sih, origidx);
+}
+
+void
+si_pmu_avb_clk_set(si_t *sih, osl_t *osh, bool set_flag)
+{
+}
+
+void
+si_btc_enable_chipcontrol(si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("si_btc_enable_chipcontrol: Failed to find CORE ID!\n"));
+               return;
+       }
+
+       /* BT fix */
+       W_REG(sii->osh, &cc->chipcontrol,
+               R_REG(sii->osh, &cc->chipcontrol) | CC_BTCOEX_EN_MASK);
+
+       si_setcoreidx(sih, origidx);
+}
+
+/** cache device removed state */
+void si_set_device_removed(si_t *sih, bool status)
+{
+       si_info_t *sii = SI_INFO(sih);
+
+       sii->device_removed = status;
+}
+
+/** check if the device is removed */
+bool
+si_deviceremoved(const si_t *sih)
+{
+       uint32 w;
+       const si_info_t *sii = SI_INFO(sih);
+
+       if (sii->device_removed) {
+               return TRUE;
+       }
+
+       switch (BUSTYPE(sih->bustype)) {
+       case PCI_BUS:
+               ASSERT(SI_INFO(sih)->osh != NULL);
+               w = OSL_PCI_READ_CONFIG(SI_INFO(sih)->osh, PCI_CFG_VID, sizeof(uint32));
+               if ((w & 0xFFFF) != VENDOR_BROADCOM)
+                       return TRUE;
+               break;
+       default:
+               break;
+       }
+       return FALSE;
+}
+
+bool
+si_is_warmboot(void)
+{
+
+       return FALSE;
+}
+
+bool
+si_is_sprom_available(si_t *sih)
+{
+       if (CCREV(sih->ccrev) >= 31) {
+               const si_info_t *sii;
+               uint origidx;
+               chipcregs_t *cc;
+               uint32 sromctrl;
+
+               if ((sih->cccaps & CC_CAP_SROM) == 0)
+                       return FALSE;
+
+               sii = SI_INFO(sih);
+               origidx = sii->curidx;
+               cc = si_setcoreidx(sih, SI_CC_IDX);
+               ASSERT(cc);
+               sromctrl = R_REG(sii->osh, &cc->sromcontrol);
+               si_setcoreidx(sih, origidx);
+               return (sromctrl & SRC_PRESENT);
+       }
+
+       switch (CHIPID(sih->chip)) {
+       case BCM4369_CHIP_GRPID:
+               if (CHIPREV(sih->chiprev) == 0) {
+                       /* WAR for 4369a0: HW4369-1729. no sprom, default to otp always. */
+                       return 0;
+               } else {
+                       return (sih->chipst & CST4369_SPROM_PRESENT) != 0;
+               }
+       case BCM4368_CHIP_ID:
+               return FALSE;   /* revisit if sprom_present chipstatus bit becomes available */
+               break;
+       CASE_BCM43602_CHIP:
+               return (sih->chipst & CST43602_SPROM_PRESENT) != 0;
+       case BCM43012_CHIP_ID:
+       case BCM43013_CHIP_ID:
+       case BCM43014_CHIP_ID:
+               return FALSE;
+       case BCM4362_CHIP_GRPID:
+               return (sih->chipst & CST4362_SPROM_PRESENT) != 0;
+       case BCM4376_CHIP_GRPID:
+       case BCM4378_CHIP_GRPID:
+               return (sih->chipst & CST4378_SPROM_PRESENT) != 0;
+       case BCM4385_CHIP_GRPID:
+       case BCM4387_CHIP_GRPID:
+               return (sih->chipst & CST4387_SPROM_PRESENT) != 0;
+       case BCM4388_CHIP_GRPID:
+       case BCM4389_CHIP_GRPID:
+       case BCM4397_CHIP_GRPID:
+               /* 4389 supports only OTP */
+               return FALSE;
+       default:
+               return TRUE;
+       }
+}
+
+bool
+si_is_sflash_available(const si_t *sih)
+{
+       switch (CHIPID(sih->chip)) {
+       case BCM4368_CHIP_ID:
+               return (sih->chipst & CST4368_SFLASH_PRESENT) != 0;
+       default:
+               return FALSE;
+       }
+}
+
+uint32 si_get_sromctl(si_t *sih)
+{
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+       uint32 sromctl;
+       osl_t *osh = si_osh(sih);
+
+       cc = si_setcoreidx(sih, SI_CC_IDX);
+       ASSERT((uintptr)cc);
+
+       sromctl = R_REG(osh, &cc->sromcontrol);
+
+       /* return to the original core */
+       si_setcoreidx(sih, origidx);
+       return sromctl;
+}
+
+int si_set_sromctl(si_t *sih, uint32 value)
+{
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+       osl_t *osh = si_osh(sih);
+       int ret = BCME_OK;
+
+       cc = si_setcoreidx(sih, SI_CC_IDX);
+       ASSERT((uintptr)cc);
+
+       /* get chipcommon rev */
+       if (si_corerev(sih) >= 32) {
+               /* SpromCtrl is only accessible if CoreCapabilities.SpromSupported and
+                * SpromPresent is 1.
+                */
+               if ((R_REG(osh, &cc->capabilities) & CC_CAP_SROM) != 0 &&
+                    (R_REG(osh, &cc->sromcontrol) & SRC_PRESENT)) {
+                       W_REG(osh, &cc->sromcontrol, value);
+               } else {
+                       ret = BCME_NODEVICE;
+               }
+       } else {
+               ret = BCME_UNSUPPORTED;
+       }
+
+       /* return to the original core */
+       si_setcoreidx(sih, origidx);
+
+       return ret;
+}
+
+uint
+si_core_wrapperreg(si_t *sih, uint32 coreidx, uint32 offset, uint32 mask, uint32 val)
+{
+       uint origidx;
+       bcm_int_bitmask_t intr_val;
+       uint ret_val;
+       const si_info_t *sii = SI_INFO(sih);
+
+       origidx = si_coreidx(sih);
+
+       INTR_OFF(sii, &intr_val);
+       /* Validate the core idx */
+       si_setcoreidx(sih, coreidx);
+
+       ret_val = si_wrapperreg(sih, offset, mask, val);
+
+       /* return to the original core */
+       si_setcoreidx(sih, origidx);
+       INTR_RESTORE(sii, &intr_val);
+       return ret_val;
+}
+
+/* cleanup the timer from the host when ARM is been halted
+ * without a chance for ARM cleanup its resources
+ * If left not cleanup, Intr from a software timer can still
+ * request HT clk when ARM is halted.
+ */
+uint32
+si_pmu_res_req_timer_clr(si_t *sih)
+{
+       uint32 mask;
+
+       mask = PRRT_REQ_ACTIVE | PRRT_INTEN | PRRT_HT_REQ;
+       mask <<= 14;
+       /* clear mask bits */
+       pmu_corereg(sih, SI_CC_IDX, res_req_timer, mask, 0);
+       /* readback to ensure write completes */
+       return pmu_corereg(sih, SI_CC_IDX, res_req_timer, 0, 0);
+}
+
+/** turn on/off rfldo */
+void
+si_pmu_rfldo(si_t *sih, bool on)
+{
+}
+
+/* Caller of this function should make sure is on PCIE core
+ * Used in pciedev.c.
+ */
+void
+si_pcie_disable_oobselltr(const si_t *sih)
+{
+       ASSERT(si_coreid(sih) == PCIE2_CORE_ID);
+       if (PCIECOREREV(sih->buscorerev) >= 23)
+               si_wrapperreg(sih, AI_OOBSELIND74, ~0, 0);
+       else
+               si_wrapperreg(sih, AI_OOBSELIND30, ~0, 0);
+}
+
+void
+si_pcie_ltr_war(const si_t *sih)
+{
+}
+
+void
+si_pcie_hw_LTR_war(const si_t *sih)
+{
+}
+
+void
+si_pciedev_reg_pm_clk_period(const si_t *sih)
+{
+}
+
+void
+si_pciedev_crwlpciegen2(const si_t *sih)
+{
+}
+
+void
+si_pcie_prep_D3(const si_t *sih, bool enter_D3)
+{
+}
+
+#if defined(AXI_TIMEOUTS) || defined(AXI_TIMEOUTS_NIC)
+uint32
+si_clear_backplane_to_per_core(si_t *sih, uint coreid, uint coreunit, void * wrap)
+{
+       if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS)) {
+               return ai_clear_backplane_to_per_core(sih, coreid, coreunit, wrap);
+       }
+
+       return AXI_WRAP_STS_NONE;
+}
+#endif /* AXI_TIMEOUTS || AXI_TIMEOUTS_NIC */
+
+uint32
+si_clear_backplane_to(si_t *sih)
+{
+       if ((CHIPTYPE(sih->socitype) == SOCI_AI) ||
+               (CHIPTYPE(sih->socitype) == SOCI_DVTBUS)) {
+               return ai_clear_backplane_to(sih);
+       }
+
+       return 0;
+}
+
+void
+si_update_backplane_timeouts(const si_t *sih, bool enable, uint32 timeout_exp,
+       uint32 cid)
+{
+#if defined(AXI_TIMEOUTS) || defined(AXI_TIMEOUTS_NIC)
+       /* Enable only for AXI */
+       if (CHIPTYPE(sih->socitype) != SOCI_AI) {
+               return;
+       }
+
+       ai_update_backplane_timeouts(sih, enable, timeout_exp, cid);
+#endif /* AXI_TIMEOUTS  || AXI_TIMEOUTS_NIC */
+}
+
+/*
+ * This routine adds the AXI timeouts for
+ * chipcommon, pcie and ARM slave wrappers
+ */
+void
+si_slave_wrapper_add(si_t *sih)
+{
+#if defined(AXI_TIMEOUTS) || defined(AXI_TIMEOUTS_NIC)
+       uint32 axi_to = 0;
+
+       /* Enable only for AXI */
+       if ((CHIPTYPE(sih->socitype) != SOCI_AI) &&
+               (CHIPTYPE(sih->socitype) != SOCI_DVTBUS)) {
+               return;
+       }
+
+       axi_to = AXI_TO_VAL;
+
+       /* All required slave wrappers are added in ai_scan */
+       ai_update_backplane_timeouts(sih, TRUE, axi_to, 0);
+
+#ifdef DISABLE_PCIE2_AXI_TIMEOUT
+       ai_update_backplane_timeouts(sih, FALSE, 0, PCIE_CORE_ID);
+       ai_update_backplane_timeouts(sih, FALSE, 0, PCIE2_CORE_ID);
+#endif
+
+#endif /* AXI_TIMEOUTS  || AXI_TIMEOUTS_NIC */
+
+}
+
+void
+si_pll_sr_reinit(si_t *sih)
+{
+}
+
+void
+si_pll_closeloop(si_t *sih)
+{
+#if defined(SAVERESTORE)
+       uint32 data;
+
+       BCM_REFERENCE(data);
+
+       /* disable PLL open loop operation */
+       switch (CHIPID(sih->chip)) {
+               case BCM4369_CHIP_GRPID:
+               case BCM4362_CHIP_GRPID:
+               case BCM4368_CHIP_GRPID:
+               case BCM4376_CHIP_GRPID:
+               case BCM4378_CHIP_GRPID:
+               case BCM4385_CHIP_GRPID:
+               case BCM4387_CHIP_GRPID:
+               case BCM4388_CHIP_GRPID:
+               case BCM4389_CHIP_GRPID:
+               case BCM4397_CHIP_GRPID:
+                       si_pmu_chipcontrol(sih, PMU_CHIPCTL1,
+                               PMU_CC1_ENABLE_CLOSED_LOOP_MASK, PMU_CC1_ENABLE_CLOSED_LOOP);
+                       break;
+               default:
+                       /* any unsupported chip bail */
+                       return;
+       }
+#endif
+}
+
+uint32 si_findcoreidx_by_axiid(const si_t *sih, uint32 axiid)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_AI)
+               return ai_findcoreidx_by_axiid(sih, axiid);
+       return 0;
+}
+
+void
+si_wrapper_get_last_error(const si_t *sih, uint32 *error_status, uint32 *core, uint32 *lo,
+        uint32 *hi, uint32 *id)
+{
+#if defined(AXI_TIMEOUTS_NIC) || defined(AXI_TIMEOUTS)
+       if (CHIPTYPE(sih->socitype) == SOCI_AI)
+               ai_wrapper_get_last_error(sih, error_status, core, lo, hi, id);
+#endif /* (AXI_TIMEOUTS_NIC) || (AXI_TIMEOUTS) */
+       return;
+}
+
+uint32
+si_get_axi_timeout_reg(const si_t *sih)
+{
+#if defined(AXI_TIMEOUTS_NIC) || defined(AXI_TIMEOUTS)
+       if (CHIPTYPE(sih->socitype) == SOCI_AI) {
+               return ai_get_axi_timeout_reg();
+       }
+#endif /* (AXI_TIMEOUTS_NIC) || (AXI_TIMEOUTS) */
+       return 0;
+}
+
+#if defined(BCMSRPWR) && !defined(BCMSRPWR_DISABLED)
+bool _bcmsrpwr = TRUE;
+#else
+bool _bcmsrpwr = FALSE;
+#endif
+
+#define PWRREQ_OFFSET(sih)     OFFSETOF(chipcregs_t, powerctl)
+
+static void
+si_corereg_pciefast_write(const si_t *sih, uint regoff, uint val)
+{
+       volatile uint32 *r = NULL;
+       const si_info_t *sii = SI_INFO(sih);
+
+       ASSERT((BUSTYPE(sih->bustype) == PCI_BUS));
+
+       r = (volatile uint32 *)((volatile char *)sii->curmap +
+               PCI_16KB0_PCIREGS_OFFSET + regoff);
+
+       W_REG(sii->osh, r, val);
+}
+
+static uint
+si_corereg_pciefast_read(const si_t *sih, uint regoff)
+{
+       volatile uint32 *r = NULL;
+       const si_info_t *sii = SI_INFO(sih);
+
+       ASSERT((BUSTYPE(sih->bustype) == PCI_BUS));
+
+       r = (volatile uint32 *)((volatile char *)sii->curmap +
+               PCI_16KB0_PCIREGS_OFFSET + regoff);
+
+       return R_REG(sii->osh, r);
+}
+
+uint32
+si_srpwr_request(const si_t *sih, uint32 mask, uint32 val)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       uint32 r, offset = (BUSTYPE(sih->bustype) == SI_BUS) ?
+               OFFSETOF(chipcregs_t, powerctl) : PWRREQ_OFFSET(sih);
+       uint32 mask2 = mask;
+       uint32 val2 = val;
+       volatile uint32 *fast_srpwr_addr = (volatile uint32 *)((uintptr)SI_ENUM_BASE(sih)
+                                        + (uintptr)offset);
+
+       if (FWSIGN_ENAB()) {
+               return 0;
+       }
+
+       if (mask || val) {
+               mask <<= SRPWR_REQON_SHIFT;
+               val  <<= SRPWR_REQON_SHIFT;
+
+               /* Return if requested power request is already set */
+               if (BUSTYPE(sih->bustype) == SI_BUS) {
+                       r = R_REG(sii->osh, fast_srpwr_addr);
+               } else {
+                       r = si_corereg_pciefast_read(sih, offset);
+               }
+
+               if ((r & mask) == val) {
+                       return r;
+               }
+
+               r = (r & ~mask) | val;
+
+               if (BUSTYPE(sih->bustype) == SI_BUS) {
+                       W_REG(sii->osh, fast_srpwr_addr, r);
+                       r = R_REG(sii->osh, fast_srpwr_addr);
+               } else {
+                       si_corereg_pciefast_write(sih, offset, r);
+                       r = si_corereg_pciefast_read(sih, offset);
+               }
+
+               if (val2) {
+                       if ((r & (mask2 << SRPWR_STATUS_SHIFT)) ==
+                       (val2 << SRPWR_STATUS_SHIFT)) {
+                               return r;
+                       }
+                       si_srpwr_stat_spinwait(sih, mask2, val2);
+               }
+       } else {
+               if (BUSTYPE(sih->bustype) == SI_BUS) {
+                       r = R_REG(sii->osh, fast_srpwr_addr);
+               } else {
+                       r = si_corereg_pciefast_read(sih, offset);
+               }
+       }
+
+       return r;
+}
+
+#ifdef CORE_PWRUP_WAR
+uint32
+si_srpwr_request_on_rev80(si_t *sih, uint32 mask, uint32 val, uint32 ucode_awake)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       uint32 r, offset = OFFSETOF(chipcregs_t, powerctl); /* Same 0x1e8 per core */
+       uint cidx = (BUSTYPE(sih->bustype) == SI_BUS) ? SI_CC_IDX : sih->buscoreidx;
+       uint32 mask2 = mask;
+       uint32 val2 = val;
+       volatile uint32 *fast_srpwr_addr = (volatile uint32 *)((uintptr)SI_ENUM_BASE(sih)
+                                        + (uintptr)offset);
+       if (mask || val) {
+               mask <<= SRPWR_REQON_SHIFT;
+               val  <<= SRPWR_REQON_SHIFT;
+
+               /* Return if requested power request is already set */
+               if (BUSTYPE(sih->bustype) == SI_BUS) {
+                       r = R_REG(sii->osh, fast_srpwr_addr);
+               } else {
+                       r = si_corereg(sih, cidx, offset, 0, 0);
+               }
+
+               if ((r & mask) == val) {
+                       W_REG(sii->osh, fast_srpwr_addr, r);
+                       return r;
+               }
+
+               r = (r & ~mask) | val;
+
+               if (BUSTYPE(sih->bustype) == SI_BUS) {
+                       W_REG(sii->osh, fast_srpwr_addr, r);
+                       r = R_REG(sii->osh, fast_srpwr_addr);
+               } else {
+                       r = si_corereg(sih, cidx, offset, ~0, r);
+               }
+
+               if (val2) {
+
+                       /*
+                        * When ucode is not requested to be awake by FW,
+                        * the power status may indicate ON due to FW or
+                        * ucode's earlier power down request is not
+                        * honored yet. In such case, FW will find the
+                        * power status high at this stage, but as it is in
+                        * transition (from ON to OFF), it may go down any
+                        * time and lead to AXI slave error. Hence we need
+                        * a fixed delay to cross any such transition state.
+                        */
+                       if (ucode_awake == 0) {
+                               hnd_delay(SRPWR_UP_DOWN_DELAY);
+                       }
+
+                       if ((r & (mask2 << SRPWR_STATUS_SHIFT)) ==
+                       (val2 << SRPWR_STATUS_SHIFT)) {
+                               return r;
+                       }
+                       si_srpwr_stat_spinwait(sih, mask2, val2);
+               }
+       } else {
+               if (BUSTYPE(sih->bustype) == SI_BUS) {
+                       r = R_REG(sii->osh, fast_srpwr_addr);
+               } else {
+                       r = si_corereg(sih, cidx, offset, 0, 0);
+               }
+               SPINWAIT(((R_REG(sii->osh, fast_srpwr_addr) &
+                               (mask2 << SRPWR_REQON_SHIFT)) != 0),
+                               PMU_MAX_TRANSITION_DLY);
+       }
+
+       return r;
+}
+#endif /* CORE_PWRUP_WAR */
+
+uint32
+si_srpwr_stat_spinwait(const si_t *sih, uint32 mask, uint32 val)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       uint32 r, offset = (BUSTYPE(sih->bustype) == SI_BUS) ?
+               OFFSETOF(chipcregs_t, powerctl) : PWRREQ_OFFSET(sih);
+       volatile uint32 *fast_srpwr_addr = (volatile uint32 *)((uintptr)SI_ENUM_BASE(sih)
+                                        + (uintptr)offset);
+
+       if (FWSIGN_ENAB()) {
+               return 0;
+       }
+       ASSERT(mask);
+       ASSERT(val);
+
+       /* spinwait on pwrstatus */
+       mask <<= SRPWR_STATUS_SHIFT;
+       val <<= SRPWR_STATUS_SHIFT;
+
+       if (BUSTYPE(sih->bustype) == SI_BUS) {
+               SPINWAIT(((R_REG(sii->osh, fast_srpwr_addr) & mask) != val),
+                       PMU_MAX_TRANSITION_DLY);
+               r = R_REG(sii->osh, fast_srpwr_addr) & mask;
+               ASSERT(r == val);
+       } else {
+               SPINWAIT(((si_corereg_pciefast_read(sih, offset) & mask) != val),
+                       PMU_MAX_TRANSITION_DLY);
+               r = si_corereg_pciefast_read(sih, offset) & mask;
+               ASSERT(r == val);
+       }
+
+       r = (r >> SRPWR_STATUS_SHIFT) & SRPWR_DMN_ALL_MASK(sih);
+
+       return r;
+}
+
+uint32
+si_srpwr_stat(si_t *sih)
+{
+       uint32 r, offset = (BUSTYPE(sih->bustype) == SI_BUS) ?
+               OFFSETOF(chipcregs_t, powerctl) : PWRREQ_OFFSET(sih);
+       uint cidx = (BUSTYPE(sih->bustype) == SI_BUS) ? SI_CC_IDX : sih->buscoreidx;
+
+       if (BUSTYPE(sih->bustype) == SI_BUS) {
+               r = si_corereg(sih, cidx, offset, 0, 0);
+       } else {
+               r = si_corereg_pciefast_read(sih, offset);
+       }
+
+       r = (r >> SRPWR_STATUS_SHIFT) & SRPWR_DMN_ALL_MASK(sih);
+
+       return r;
+}
+
+uint32
+si_srpwr_domain(si_t *sih)
+{
+       uint32 r, offset = (BUSTYPE(sih->bustype) == SI_BUS) ?
+               OFFSETOF(chipcregs_t, powerctl) : PWRREQ_OFFSET(sih);
+       uint cidx = (BUSTYPE(sih->bustype) == SI_BUS) ? SI_CC_IDX : sih->buscoreidx;
+
+       if (FWSIGN_ENAB()) {
+               return 0;
+       }
+
+       if (BUSTYPE(sih->bustype) == SI_BUS) {
+               r = si_corereg(sih, cidx, offset, 0, 0);
+       } else {
+               r = si_corereg_pciefast_read(sih, offset);
+       }
+
+       r = (r >> SRPWR_DMN_ID_SHIFT) & SRPWR_DMN_ID_MASK;
+
+       return r;
+}
+
+uint8
+si_srpwr_domain_wl(si_t *sih)
+{
+       return SRPWR_DMN1_ARMBPSD;
+}
+
+bool
+si_srpwr_cap(si_t *sih)
+{
+       if (FWSIGN_ENAB()) {
+               return FALSE;
+       }
+
+       /* If domain ID is non-zero, chip supports power domain control */
+       return si_srpwr_domain(sih) != 0 ? TRUE : FALSE;
+}
+
+uint32
+si_srpwr_domain_all_mask(const si_t *sih)
+{
+       uint32 mask = SRPWR_DMN0_PCIE_MASK |
+                     SRPWR_DMN1_ARMBPSD_MASK |
+                     SRPWR_DMN2_MACAUX_MASK |
+                     SRPWR_DMN3_MACMAIN_MASK;
+
+       if (si_scan_core_present(sih)) {
+               mask |= SRPWR_DMN4_MACSCAN_MASK;
+       }
+
+       return mask;
+}
+
+uint32
+si_srpwr_bt_status(si_t *sih)
+{
+       uint32 r;
+       uint32 offset = (BUSTYPE(sih->bustype) == SI_BUS) ?
+               OFFSETOF(chipcregs_t, powerctl) : PWRREQ_OFFSET(sih);
+       uint32 cidx = (BUSTYPE(sih->bustype) == SI_BUS) ? SI_CC_IDX : sih->buscoreidx;
+
+       if (BUSTYPE(sih->bustype) == SI_BUS) {
+               r = si_corereg(sih, cidx, offset, 0, 0);
+       } else {
+               r = si_corereg_pciefast_read(sih, offset);
+       }
+
+       r = (r >> SRPWR_BT_STATUS_SHIFT) & SRPWR_BT_STATUS_MASK;
+
+       return r;
+}
+/* Utility API to read/write the raw registers with absolute address.
+ * This function can be invoked from either FW or host driver.
+ */
+uint32
+si_raw_reg(const si_t *sih, uint32 reg, uint32 val, uint32 wrire_req)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       uint32 address_space = reg & ~0xFFF;
+       volatile uint32 * addr = (void*)(uintptr)(reg);
+       uint32 prev_value = 0;
+       uint32 cfg_reg = 0;
+
+       if (sii == NULL) {
+               return 0;
+       }
+
+       /* No need to translate the absolute address on SI bus */
+       if (BUSTYPE(sih->bustype) == SI_BUS) {
+               goto skip_cfg;
+       }
+
+       /* This API supports only the PCI host interface */
+       if (BUSTYPE(sih->bustype) != PCI_BUS) {
+               return ID32_INVALID;
+       }
+
+       if (PCIE_GEN2(sii)) {
+               /* Use BAR0 Secondary window is PCIe Gen2.
+                * Set the secondary BAR0 Window to current register of interest
+                */
+               addr = (volatile uint32*)(((volatile uint8*)sii->curmap) +
+                       PCI_SEC_BAR0_WIN_OFFSET + (reg & 0xfff));
+               cfg_reg = PCIE2_BAR0_CORE2_WIN;
+
+       } else {
+               /* PCIe Gen1 do not have secondary BAR0 window.
+                * reuse the BAR0 WIN2
+                */
+               addr = (volatile uint32*)(((volatile uint8*)sii->curmap) +
+                       PCI_BAR0_WIN2_OFFSET + (reg & 0xfff));
+               cfg_reg = PCI_BAR0_WIN2;
+       }
+
+       prev_value = OSL_PCI_READ_CONFIG(sii->osh, cfg_reg, 4);
+
+       if (prev_value != address_space) {
+               OSL_PCI_WRITE_CONFIG(sii->osh, cfg_reg,
+                       sizeof(uint32), address_space);
+       } else {
+               prev_value = 0;
+       }
+
+skip_cfg:
+       if (wrire_req) {
+               W_REG(sii->osh, addr, val);
+       } else {
+               val = R_REG(sii->osh, addr);
+       }
+
+       if (prev_value) {
+               /* Restore BAR0 WIN2 for PCIE GEN1 devices */
+               OSL_PCI_WRITE_CONFIG(sii->osh,
+                       cfg_reg, sizeof(uint32), prev_value);
+       }
+
+       return val;
+}
+
+uint8
+si_lhl_ps_mode(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       return sii->lhl_ps_mode;
+}
+
+uint8
+si_hib_ext_wakeup_isenab(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+       return sii->hib_ext_wakeup_enab;
+}
+
+static void
+si_oob_war_BT_F1(si_t *sih)
+{
+       uint origidx = si_coreidx(sih);
+       volatile void *regs;
+
+       if (FWSIGN_ENAB()) {
+               return;
+       }
+       regs = si_setcore(sih, AXI2AHB_BRIDGE_ID, 0);
+       ASSERT(regs);
+       BCM_REFERENCE(regs);
+
+       si_wrapperreg(sih, AI_OOBSELINA30, 0xF00, 0x300);
+
+       si_setcoreidx(sih, origidx);
+}
+
+#ifdef UART_TRAP_DBG
+void
+si_dump_APB_Bridge_registers(const si_t *sih)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_AI) {
+               ai_dump_APB_Bridge_registers(sih);
+       }
+}
+#endif /* UART_TRAP_DBG */
+
+void
+si_force_clocks(const si_t *sih, uint clock_state)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_AI) {
+               ai_force_clocks(sih, clock_state);
+       }
+}
+
+/* Indicates to the siutils how the PICe BAR0 is mappend,
+ * used for siutils to arrange BAR0 window management,
+ * for PCI NIC driver.
+ *
+ * Here is the current scheme, which are all using BAR0:
+ *
+ * id     enum       wrapper
+ * ====   =========  =========
+ *    0   0000-0FFF  1000-1FFF
+ *    1   4000-4FFF  5000-5FFF
+ *    2   9000-9FFF  A000-AFFF
+ * >= 3   not supported
+ */
+void
+si_set_slice_id(si_t *sih, uint8 slice)
+{
+       si_info_t *sii = SI_INFO(sih);
+
+       sii->slice = slice;
+}
+
+uint8
+si_get_slice_id(const si_t *sih)
+{
+       const si_info_t *sii = SI_INFO(sih);
+
+       return sii->slice;
+}
+
+bool
+BCMRAMFN(si_scan_core_present)(const si_t *sih)
+{
+       return ((si_numcoreunits(sih, D11_CORE_ID) >= 2) &&
+               (si_numcoreunits(sih, SR_CORE_ID) > 4));
+}
+
+void
+si_jtag_udr_pwrsw_main_toggle(si_t *sih, bool on)
+{
+}
diff --git a/bcmdhd.101.10.240.x/siutils_priv.h b/bcmdhd.101.10.240.x/siutils_priv.h
new file mode 100644 (file)
index 0000000..8e09d40
--- /dev/null
@@ -0,0 +1,481 @@
+/*
+ * Include file private to the SOC Interconnect support files.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef        _siutils_priv_h_
+#define        _siutils_priv_h_
+
+#if defined(SI_ERROR_ENFORCE)
+#define        SI_ERROR(args)  printf args
+#else
+#define        SI_ERROR(args)
+#endif
+
+#if defined(ENABLE_CORECAPTURE)
+
+#define        SI_PRINT(args)  osl_wificc_logDebug args
+
+#else
+
+#define        SI_PRINT(args)  printf args
+
+#endif /* ENABLE_CORECAPTURE */
+
+#define        SI_MSG(args)
+
+#ifdef BCMDBG_SI
+#define        SI_VMSG(args)   printf args
+#else
+#define        SI_VMSG(args)
+#endif
+
+#define        IS_SIM(chippkg) ((chippkg == HDLSIM_PKG_ID) || (chippkg == HWSIM_PKG_ID))
+
+typedef void (*si_intrsoff_t)(void *intr_arg, bcm_int_bitmask_t *mask);
+typedef void (*si_intrsrestore_t)(void *intr_arg, bcm_int_bitmask_t *mask);
+typedef bool (*si_intrsenabled_t)(void *intr_arg);
+
+#define SI_GPIO_MAX            16
+
+typedef struct gci_gpio_item {
+       void                    *arg;
+       uint8                   gci_gpio;
+       uint8                   status;
+       gci_gpio_handler_t      handler;
+       struct gci_gpio_item    *next;
+} gci_gpio_item_t;
+
+typedef struct wci2_cbs {
+    void *context;
+    wci2_handler_t handler;
+} wci2_cbs_t;
+
+typedef struct wci2_rxfifo_info {
+       char *rx_buf;
+       int     rx_idx;
+       wci2_cbs_t      *cbs;
+} wci2_rxfifo_info_t;
+
+#define AI_SLAVE_WRAPPER        0
+#define AI_MASTER_WRAPPER       1
+
+typedef struct axi_wrapper {
+       uint32  mfg;
+       uint32  cid;
+       uint32  rev;
+       uint32  wrapper_type;
+       uint32  wrapper_addr;
+       uint32  wrapper_size;
+       uint32  node_type;
+} axi_wrapper_t;
+
+#ifdef SOCI_NCI_BUS
+#define SI_MAX_AXI_WRAPPERS            65u
+#else
+#define SI_MAX_AXI_WRAPPERS            32u
+#endif /* SOCI_NCI_BUS */
+#define AI_REG_READ_TIMEOUT            300u /* in msec */
+
+/* for some combo chips, BT side accesses chipcommon->0x190, as a 16 byte addr */
+/* register at 0x19C doesn't exist, so error is logged at the slave wrapper */
+/* Since this can't be fixed in the boot rom, WAR it */
+#define BT_CC_SPROM_BADREG_LO   0x18000190
+#define BT_CC_SPROM_BADREG_SIZE 4
+#define BT_CC_SPROM_BADREG_HI   0
+
+#define BCM4389_BT_AXI_ID      2
+#define BCM4369_BT_AXI_ID      4
+#define BCM4378_BT_AXI_ID      2
+#define BCM4368_BT_AXI_ID      2
+#define BCM43602_BT_AXI_ID     1
+#define BCM4378_ARM_PREFETCH_AXI_ID     9
+
+#define BCM4378_BT_ADDR_HI     0
+#define BCM4378_BT_ADDR_LO     0x19000000      /* BT address space */
+#define BCM4378_BT_SIZE                0x01000000      /* BT address space size */
+#define BCM4378_UNUSED_AXI_ID  0xffffffff
+#define BCM4378_CC_AXI_ID      0
+#define BCM4378_PCIE_AXI_ID    1
+
+#define BCM4387_BT_ADDR_HI     0
+#define BCM4387_BT_ADDR_LO     0x19000000      /* BT address space */
+#define BCM4387_BT_SIZE                0x01000000      /* BT address space size */
+#define BCM4387_UNUSED_AXI_ID  0xffffffff
+#define BCM4387_CC_AXI_ID      0
+#define BCM4387_PCIE_AXI_ID    1
+
+#define BCM_AXI_ID_MASK        0xFu
+#define BCM_AXI_ACCESS_TYPE_MASK 0xF0u
+
+#define BCM43xx_CR4_AXI_ID     3
+#define BCM43xx_AXI_ACCESS_TYPE_PREFETCH (1 << 4)
+
+typedef struct si_cores_info {
+       volatile void   *regs[SI_MAXCORES];     /* other regs va */
+
+       uint    coreid[SI_MAXCORES];    /**< id of each core */
+       uint32  coresba[SI_MAXCORES];   /**< backplane address of each core */
+       void    *regs2[SI_MAXCORES];    /**< va of each core second register set (usbh20) */
+       uint32  coresba2[SI_MAXCORES];  /**< address of each core second register set (usbh20) */
+       uint32  coresba_size[SI_MAXCORES]; /**< backplane address space size */
+       uint32  coresba2_size[SI_MAXCORES]; /**< second address space size */
+
+       void    *wrappers[SI_MAXCORES]; /**< other cores wrapper va */
+       uint32  wrapba[SI_MAXCORES];    /**< address of controlling wrapper */
+
+       void    *wrappers2[SI_MAXCORES];        /**< other cores wrapper va */
+       uint32  wrapba2[SI_MAXCORES];   /**< address of controlling wrapper */
+
+       void    *wrappers3[SI_MAXCORES];        /**< other cores wrapper va */
+       uint32  wrapba3[SI_MAXCORES];   /**< address of controlling wrapper */
+
+       uint32  cia[SI_MAXCORES];       /**< erom cia entry for each core */
+       uint32  cib[SI_MAXCORES];       /**< erom cia entry for each core */
+
+       uint32  csp2ba[SI_MAXCORES];            /**< Second slave port base addr 0 */
+       uint32  csp2ba_size[SI_MAXCORES];       /**< Second slave port addr space size */
+} si_cores_info_t;
+
+#define RES_PEND_STATS_COUNT   8
+
+typedef struct res_state_info
+{
+       uint32 low;
+       uint32 low_time;
+       uint32 high;
+       uint32 high_time;
+} si_res_state_info_t;
+
+/** misc si info needed by some of the routines */
+typedef struct si_info {
+       struct si_pub pub;              /**< back plane public state (must be first field) */
+
+       void    *osh;                   /**< osl os handle */
+       void    *sdh;                   /**< bcmsdh handle */
+
+       uint    dev_coreid;             /**< the core provides driver functions */
+       void    *intr_arg;              /**< interrupt callback function arg */
+       si_intrsoff_t intrsoff_fn;      /**< turns chip interrupts off */
+       si_intrsrestore_t intrsrestore_fn; /**< restore chip interrupts */
+       si_intrsenabled_t intrsenabled_fn; /**< check if interrupts are enabled */
+
+       void    *pch;                   /**< PCI/E core handle */
+
+       bool    memseg;                 /**< flag to toggle MEM_SEG register */
+
+       char    *vars;
+       uint    varsz;
+
+       volatile void *curmap;          /* current regs va */
+
+       uint    curidx;                 /**< current core index */
+       uint    numcores;               /**< # discovered cores */
+
+       void    *curwrap;               /**< current wrapper va */
+
+       uint32  oob_router;             /**< oob router registers for axi */
+       uint32  oob_router1;            /**< oob router registers for axi */
+
+       si_cores_info_t *cores_info;
+       gci_gpio_item_t *gci_gpio_head; /**< gci gpio interrupts head */
+       uint    chipnew;                /**< new chip number */
+       uint second_bar0win;            /**< Backplane region */
+       uint    num_br;                 /**< # discovered bridges */
+       uint32  br_wrapba[SI_MAXBR];    /**< address of bridge controlling wrapper */
+       uint32  xtalfreq;
+       uint32  openloop_dco_code;      /**< OPEN loop calibration dco code */
+       uint8   spurmode;
+       bool    device_removed;
+       uint    axi_num_wrappers;
+       axi_wrapper_t *axi_wrapper;
+       uint8   device_wake_opt;        /* device_wake GPIO number */
+       uint8   lhl_ps_mode;
+       uint8   hib_ext_wakeup_enab;
+       uint32  armpllclkfreq;             /**< arm clock rate from nvram */
+       uint32  ccidiv;                 /**< arm clock : cci clock ratio
+                                        * (determines sysmem frequency)
+                                        */
+       wci2_rxfifo_info_t *wci2_info;  /* wci2_rxfifo interrupt info */
+       uint8   slice;                  /* this instance of the si accesses
+                                        * the first(0)/second(1)/...
+                                        * d11 core
+                                        */
+       si_res_state_info_t res_state[RES_PEND_STATS_COUNT];
+       uint32  res_pend_count;
+       bool    rfldo3p3_war;           /**< singing cap war enable from nvram */
+       void    *nci_info;
+} si_info_t;
+
+#define        SI_INFO(sih)    ((si_info_t *)(uintptr)sih)
+
+#define        GOODCOREADDR(x, b) (((x) >= (b)) && ((x) < ((b) + SI_MAXCORES * SI_CORE_SIZE)) && \
+               ISALIGNED((x), SI_CORE_SIZE))
+#define        GOODREGS(regs)  ((regs) != NULL && ISALIGNED((uintptr)(regs), SI_CORE_SIZE))
+#define BADCOREADDR    0
+#define        GOODIDX(idx, maxcores)  (((uint)idx) < maxcores)
+#define        NOREV           (int16)-1               /**< Invalid rev */
+
+#define PCI(si)                ((BUSTYPE((si)->pub.bustype) == PCI_BUS) &&     \
+                        ((si)->pub.buscoretype == PCI_CORE_ID))
+
+#define PCIE_GEN1(si)  ((BUSTYPE((si)->pub.bustype) == PCI_BUS) &&     \
+                        ((si)->pub.buscoretype == PCIE_CORE_ID))
+
+#define PCIE_GEN2(si)  ((BUSTYPE((si)->pub.bustype) == PCI_BUS) &&     \
+                        ((si)->pub.buscoretype == PCIE2_CORE_ID))
+
+#define PCIE(si)       (PCIE_GEN1(si) || PCIE_GEN2(si))
+
+/** Newer chips can access PCI/PCIE and CC core without requiring to change PCI BAR0 WIN */
+#define SI_FAST(si) (PCIE(si) || (PCI(si) && ((si)->pub.buscorerev >= 13)))
+
+#define CCREGS_FAST(si) \
+       (((si)->curmap == NULL) ? NULL : \
+           ((volatile char *)((si)->curmap) + PCI_16KB0_CCREGS_OFFSET))
+#define PCIEREGS(si) (((volatile char *)((si)->curmap) + PCI_16KB0_PCIREGS_OFFSET))
+
+/*
+ * Macros to disable/restore function core(D11, ENET, ILINE20, etc) interrupts before/
+ * after core switching to avoid invalid register accesss inside ISR.
+ * Adding SOCI_NCI_BUS to avoid abandons in the branches that use this MACRO.
+ */
+#ifdef SOCI_NCI_BUS
+#define INTR_OFF(si, intr_val) \
+       if ((si)->intrsoff_fn && (si_coreid(&(si)->pub) == (si)->dev_coreid)) { \
+               (*(si)->intrsoff_fn)((si)->intr_arg, intr_val); }
+#define INTR_RESTORE(si, intr_val) \
+       if ((si)->intrsrestore_fn && (si_coreid(&(si)->pub) == (si)->dev_coreid)) { \
+               (*(si)->intrsrestore_fn)((si)->intr_arg, intr_val); }
+#else
+#define INTR_OFF(si, intr_val) \
+       if ((si)->intrsoff_fn && (si)->cores_info->coreid[(si)->curidx] == (si)->dev_coreid) { \
+               (*(si)->intrsoff_fn)((si)->intr_arg, intr_val); }
+#define INTR_RESTORE(si, intr_val) \
+       if ((si)->intrsrestore_fn && (si)->cores_info->coreid[(si)->curidx] == (si)->dev_coreid) { \
+               (*(si)->intrsrestore_fn)((si)->intr_arg, intr_val); }
+#endif /* SOCI_NCI_BUS */
+
+/* dynamic clock control defines */
+#define        LPOMINFREQ              25000           /**< low power oscillator min */
+#define        LPOMAXFREQ              43000           /**< low power oscillator max */
+#define        XTALMINFREQ             19800000        /**< 20 MHz - 1% */
+#define        XTALMAXFREQ             20200000        /**< 20 MHz + 1% */
+#define        PCIMINFREQ              25000000        /**< 25 MHz */
+#define        PCIMAXFREQ              34000000        /**< 33 MHz + fudge */
+
+#define        ILP_DIV_5MHZ            0               /**< ILP = 5 MHz */
+#define        ILP_DIV_1MHZ            4               /**< ILP = 1 MHz */
+
+/* GPIO Based LED powersave defines */
+#define DEFAULT_GPIO_ONTIME    10              /**< Default: 10% on */
+#define DEFAULT_GPIO_OFFTIME   90              /**< Default: 10% on */
+
+#ifndef DEFAULT_GPIOTIMERVAL
+#define DEFAULT_GPIOTIMERVAL  ((DEFAULT_GPIO_ONTIME << GPIO_ONTIME_SHIFT) | DEFAULT_GPIO_OFFTIME)
+#endif
+
+/* Silicon Backplane externs */
+extern void sb_scan(si_t *sih, volatile void *regs, uint devid);
+extern uint sb_coreid(const si_t *sih);
+extern uint sb_intflag(si_t *sih);
+extern uint sb_flag(const si_t *sih);
+extern void sb_setint(const si_t *sih, int siflag);
+extern uint sb_corevendor(const si_t *sih);
+extern uint sb_corerev(const si_t *sih);
+extern uint sb_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val);
+extern volatile uint32 *sb_corereg_addr(const si_t *sih, uint coreidx, uint regoff);
+extern bool sb_iscoreup(const si_t *sih);
+extern volatile void *sb_setcoreidx(si_t *sih, uint coreidx);
+extern uint32 sb_core_cflags(const si_t *sih, uint32 mask, uint32 val);
+extern void sb_core_cflags_wo(const si_t *sih, uint32 mask, uint32 val);
+extern uint32 sb_core_sflags(const si_t *sih, uint32 mask, uint32 val);
+extern void sb_commit(si_t *sih);
+extern uint32 sb_base(uint32 admatch);
+extern uint32 sb_size(uint32 admatch);
+extern void sb_core_reset(const si_t *sih, uint32 bits, uint32 resetbits);
+extern void sb_core_disable(const si_t *sih, uint32 bits);
+extern uint32 sb_addrspace(const si_t *sih, uint asidx);
+extern uint32 sb_addrspacesize(const si_t *sih, uint asidx);
+extern int sb_numaddrspaces(const si_t *sih);
+
+extern bool sb_taclear(si_t *sih, bool details);
+
+#if defined(BCMDBG_PHYDUMP)
+extern void sb_dumpregs(si_t *sih, struct bcmstrbuf *b);
+#endif
+
+/* AMBA Interconnect exported externs */
+extern si_t *ai_attach(uint pcidev, osl_t *osh, void *regs, uint bustype,
+                       void *sdh, char **vars, uint *varsz);
+extern si_t *ai_kattach(osl_t *osh);
+extern void ai_scan(si_t *sih, void *regs, uint devid);
+
+extern uint ai_flag(si_t *sih);
+extern uint ai_flag_alt(const si_t *sih);
+extern void ai_setint(const si_t *sih, int siflag);
+extern uint ai_corevendor(const si_t *sih);
+extern uint ai_corerev(const si_t *sih);
+extern uint ai_corerev_minor(const si_t *sih);
+extern volatile uint32 *ai_corereg_addr(si_t *sih, uint coreidx, uint regoff);
+extern bool ai_iscoreup(const si_t *sih);
+extern volatile void *ai_setcoreidx(si_t *sih, uint coreidx);
+extern volatile void *ai_setcoreidx_2ndwrap(si_t *sih, uint coreidx);
+extern volatile void *ai_setcoreidx_3rdwrap(si_t *sih, uint coreidx);
+extern uint32 ai_core_cflags(const si_t *sih, uint32 mask, uint32 val);
+extern void ai_core_cflags_wo(const si_t *sih, uint32 mask, uint32 val);
+extern uint32 ai_core_sflags(const si_t *sih, uint32 mask, uint32 val);
+extern uint ai_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val);
+extern uint ai_corereg_writeonly(si_t *sih, uint coreidx, uint regoff, uint mask, uint val);
+extern void ai_core_reset(si_t *sih, uint32 bits, uint32 resetbits);
+extern void ai_d11rsdb_core_reset(si_t *sih, uint32 bits,
+       uint32 resetbits, void *p, volatile void *s);
+extern void ai_core_disable(const si_t *sih, uint32 bits);
+extern void ai_d11rsdb_core_disable(const si_info_t *sii, uint32 bits,
+       aidmp_t *pmacai, aidmp_t *smacai);
+extern int ai_numaddrspaces(const si_t *sih);
+extern uint32 ai_addrspace(const si_t *sih, uint spidx, uint baidx);
+extern uint32 ai_addrspacesize(const si_t *sih, uint spidx, uint baidx);
+extern void ai_coreaddrspaceX(const si_t *sih, uint asidx, uint32 *addr, uint32 *size);
+extern uint ai_wrap_reg(const si_t *sih, uint32 offset, uint32 mask, uint32 val);
+extern void ai_update_backplane_timeouts(const si_t *sih, bool enable, uint32 timeout, uint32 cid);
+extern uint32 ai_clear_backplane_to(si_t *sih);
+void ai_force_clocks(const si_t *sih, uint clock_state);
+extern uint ai_num_slaveports(const si_t *sih, uint coreidx);
+
+#ifdef AXI_TIMEOUTS_NIC
+uint32 ai_clear_backplane_to_fast(si_t *sih, void * addr);
+#endif /* AXI_TIMEOUTS_NIC */
+
+#ifdef BOOKER_NIC400_INF
+extern void ai_core_reset_ext(const si_t *sih, uint32 bits, uint32 resetbits);
+#endif /* BOOKER_NIC400_INF */
+
+#if defined(AXI_TIMEOUTS) || defined(AXI_TIMEOUTS_NIC)
+extern uint32 ai_clear_backplane_to_per_core(si_t *sih, uint coreid, uint coreunit, void * wrap);
+#endif /* AXI_TIMEOUTS || AXI_TIMEOUTS_NIC */
+
+#if defined(BCMDBG_PHYDUMP)
+extern void ai_dumpregs(const si_t *sih, struct bcmstrbuf *b);
+#endif
+
+extern uint32 ai_wrapper_dump_buf_size(const si_t *sih);
+extern uint32 ai_wrapper_dump_binary(const si_t *sih, uchar *p);
+extern bool ai_check_enable_backplane_log(const si_t *sih);
+extern uint32 ai_wrapper_dump_last_timeout(const si_t *sih, uint32 *error, uint32 *core,
+       uint32 *ba, uchar *p);
+extern uint32 ai_findcoreidx_by_axiid(const si_t *sih, uint32 axiid);
+#if defined(AXI_TIMEOUTS_NIC) || defined(AXI_TIMEOUTS)
+extern void ai_wrapper_get_last_error(const si_t *sih, uint32 *error_status, uint32 *core,
+       uint32 *lo, uint32 *hi, uint32 *id);
+extern uint32 ai_get_axi_timeout_reg(void);
+#endif /* (AXI_TIMEOUTS_NIC) || (AXI_TIMEOUTS) */
+
+#ifdef UART_TRAP_DBG
+void ai_dump_APB_Bridge_registers(const si_t *sih);
+#endif /* UART_TRAP_DBG */
+void ai_force_clocks(const si_t *sih, uint clock_state);
+
+#define ub_scan(a, b, c) do {} while (0)
+#define ub_flag(a) (0)
+#define ub_setint(a, b) do {} while (0)
+#define ub_coreidx(a) (0)
+#define ub_corevendor(a) (0)
+#define ub_corerev(a) (0)
+#define ub_iscoreup(a) (0)
+#define ub_setcoreidx(a, b) (0)
+#define ub_core_cflags(a, b, c) (0)
+#define ub_core_cflags_wo(a, b, c) do {} while (0)
+#define ub_core_sflags(a, b, c) (0)
+#define ub_corereg(a, b, c, d, e) (0)
+#define ub_core_reset(a, b, c) do {} while (0)
+#define ub_core_disable(a, b) do {} while (0)
+#define ub_numaddrspaces(a) (0)
+#define ub_addrspace(a, b)  (0)
+#define ub_addrspacesize(a, b) (0)
+#define ub_view(a, b) do {} while (0)
+#define ub_dumpregs(a, b) do {} while (0)
+
+#ifndef SOCI_NCI_BUS
+#define nci_uninit(a) do {} while (0)
+#define nci_scan(a) (0)
+#define nci_dump_erom(a) do {} while (0)
+#define nci_init(a, b, c) (NULL)
+#define nci_setcore(a, b, c) (NULL)
+#define nci_setcoreidx(a, b) (NULL)
+#define nci_findcoreidx(a, b, c) (0)
+#define nci_corereg_addr(a, b, c) (NULL)
+#define nci_corereg_writeonly(a, b, c, d, e) (0)
+#define nci_corereg(a, b, c, d, e) (0)
+#define nci_corerev_minor(a) (0)
+#define nci_corerev(a) (0)
+#define nci_corevendor(a) (0)
+#define nci_get_wrap_reg(a, b, c, d) (0)
+#define nci_core_reset(a, b, c) do {} while (0)
+#define nci_core_disable(a, b) do {} while (0)
+#define nci_iscoreup(a) (FALSE)
+#define nci_coreid(a, b) (0)
+#define nci_numcoreunits(a, b) (0)
+#define nci_addr_space(a, b, c) (0)
+#define nci_addr_space_size(a, b, c) (0)
+#define nci_iscoreup(a) (FALSE)
+#define nci_intflag(a) (0)
+#define nci_flag(a) (0)
+#define nci_flag_alt(a) (0)
+#define nci_setint(a, b) do {} while (0)
+#define nci_oobr_baseaddr(a, b) (0)
+#define nci_coreunit(a) (0)
+#define nci_corelist(a, b) (0)
+#define nci_numaddrspaces(a) (0)
+#define nci_addrspace(a, b, c) (0)
+#define nci_addrspacesize(a, b, c) (0)
+#define nci_coreaddrspaceX(a, b, c, d) do {} while (0)
+#define nci_core_cflags(a, b, c) (0)
+#define nci_core_cflags_wo(a, b, c) do {} while (0)
+#define nci_core_sflags(a, b, c) (0)
+#define nci_wrapperreg(a, b, c, d) (0)
+#define nci_invalidate_second_bar0win(a) do {} while (0)
+#define nci_backplane_access(a, b, c, d, e) (0)
+#define nci_backplane_access_64(a, b, c, d, e) (0)
+#define nci_num_slaveports(a, b) (0)
+#if defined(BCMDBG_PHYDUMP)
+#define nci_dumpregs(a, b) do {} while (0)
+#endif
+#define nci_get_nth_wrapper(a, b) (0)
+#define nci_get_axi_addr(a, b) (0)
+#define nci_wrapper_dump_binary_one(a, b, c) (NULL)
+#define nci_wrapper_dump_binary(a, b) (0)
+#define nci_wrapper_dump_last_timeout(a, b, c, d, e) (0)
+#define nci_check_enable_backplane_log(a) (FALSE)
+#define nci_get_core_baaddr(a, b, c) (0)
+#define nci_clear_backplane_to(a) (0)
+#define nci_clear_backplane_to_per_core(a, b, c, d) (0)
+#define nci_ignore_errlog(a, b, c, d, e, f) (FALSE)
+#define nci_wrapper_get_last_error(a, b, c, d, e, f) do {} while (0)
+#define nci_get_axi_timeout_reg() (0)
+#define nci_findcoreidx_by_axiid(a, b) (0)
+#define nci_wrapper_dump_binary_one(a, b, c) (NULL)
+#define nci_wrapper_dump_binary(a, b) (0)
+#define nci_wrapper_dump_last_timeout(a, b, c, d, e) (0)
+#define nci_check_enable_backplane_log(a) (FALSE)
+#define nci_wrapper_dump_buf_size(a) (0)
+#endif /* SOCI_NCI_BUS */
+#endif /* _siutils_priv_h_ */
diff --git a/bcmdhd.101.10.240.x/wifi_stats.h b/bcmdhd.101.10.240.x/wifi_stats.h
new file mode 100644 (file)
index 0000000..a4d2e73
--- /dev/null
@@ -0,0 +1,377 @@
+/*
+ * Common stats definitions for clients of dongle
+ * ports
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _wifi_stats_h_
+#define _wifi_stats_h_
+
+// remove the conditional after moving all branches to use the new code
+#ifdef USE_WIFI_STATS_H
+
+#include <ethernet.h>
+#include <802.11.h>
+
+typedef int32 wifi_radio;
+typedef int32 wifi_channel;
+typedef int32 wifi_rssi;
+typedef struct { uint16 version; uint16 length; } ver_len;
+
+typedef enum wifi_channel_width {
+       WIFI_CHAN_WIDTH_20        = 0,
+       WIFI_CHAN_WIDTH_40        = 1,
+       WIFI_CHAN_WIDTH_80        = 2,
+       WIFI_CHAN_WIDTH_160   = 3,
+       WIFI_CHAN_WIDTH_80P80 = 4,
+       WIFI_CHAN_WIDTH_5         = 5,
+       WIFI_CHAN_WIDTH_10        = 6,
+       WIFI_CHAN_WIDTH_INVALID = -1
+} wifi_channel_width_t;
+
+typedef enum {
+       WIFI_DISCONNECTED = 0,
+       WIFI_AUTHENTICATING = 1,
+       WIFI_ASSOCIATING = 2,
+       WIFI_ASSOCIATED = 3,
+       WIFI_EAPOL_STARTED = 4,   /* if done by firmware/driver */
+       WIFI_EAPOL_COMPLETED = 5, /* if done by firmware/driver */
+} wifi_connection_state;
+
+typedef enum {
+       WIFI_ROAMING_IDLE = 0,
+       WIFI_ROAMING_ACTIVE = 1
+} wifi_roam_state;
+
+typedef enum {
+       WIFI_INTERFACE_STA = 0,
+       WIFI_INTERFACE_SOFTAP = 1,
+       WIFI_INTERFACE_IBSS = 2,
+       WIFI_INTERFACE_P2P_CLIENT = 3,
+       WIFI_INTERFACE_P2P_GO = 4,
+       WIFI_INTERFACE_NAN = 5,
+       WIFI_INTERFACE_MESH = 6
+} wifi_interface_mode;
+
+#define WIFI_CAPABILITY_QOS          0x00000001     /* set for QOS association */
+#define WIFI_CAPABILITY_PROTECTED    0x00000002     /* set for protected association (802.11
+                                                    * beacon frame control protected bit set)
+                                                    */
+#define WIFI_CAPABILITY_INTERWORKING 0x00000004     /* set if 802.11 Extended Capabilities
+                                                    * element interworking bit is set
+                                                    */
+#define WIFI_CAPABILITY_HS20         0x00000008     /* set for HS20 association */
+#define WIFI_CAPABILITY_SSID_UTF8    0x00000010     /* set is 802.11 Extended Capabilities
+                                                    * element UTF-8 SSID bit is set
+                                                    */
+#define WIFI_CAPABILITY_COUNTRY      0x00000020     /* set is 802.11 Country Element is present */
+#if defined(__linux__)
+#define PACK_ATTRIBUTE __attribute__ ((packed))
+#else
+#define PACK_ATTRIBUTE
+#endif
+typedef struct {
+       wifi_interface_mode mode;     /* interface mode */
+       uint8 mac_addr[6];               /* interface mac address (self) */
+       uint8 PAD[2];
+       wifi_connection_state state;  /* connection state (valid for STA, CLI only) */
+       wifi_roam_state roaming;      /* roaming state */
+       uint32 capabilities;             /* WIFI_CAPABILITY_XXX (self) */
+       uint8 ssid[DOT11_MAX_SSID_LEN+1]; /* null terminated SSID */
+       uint8 bssid[ETHER_ADDR_LEN];     /* bssid */
+       uint8 PAD[1];
+       uint8 ap_country_str[3];         /* country string advertised by AP */
+       uint8 country_str[3];            /* country string for this association */
+       uint8 PAD[2];
+} wifi_interface_info;
+
+typedef wifi_interface_info *wifi_interface_handle;
+
+/* channel information */
+typedef struct {
+       wifi_channel_width_t width;   /* channel width (20, 40, 80, 80+80, 160) */
+       wifi_channel center_freq;   /* primary 20 MHz channel */
+       wifi_channel center_freq0;  /* center frequency (MHz) first segment */
+       wifi_channel center_freq1;  /* center frequency (MHz) second segment */
+} wifi_channel_info;
+
+/* wifi rate */
+typedef struct {
+       uint32 preamble;   /* 0: OFDM, 1:CCK, 2:HT 3:VHT 4..7 reserved */
+       uint32 nss;     /* 0:1x1, 1:2x2, 3:3x3, 4:4x4 */
+       uint32 bw;      /* 0:20MHz, 1:40Mhz, 2:80Mhz, 3:160Mhz */
+       uint32 rateMcsIdx; /* OFDM/CCK rate code would be as per ieee std
+                           * in the units of 0.5mbps
+                           */
+                       /* HT/VHT it would be mcs index */
+       uint32 reserved;   /* reserved */
+       uint32 bitrate;    /* units of 100 Kbps */
+} wifi_rate;
+
+typedef struct {
+       uint32 preamble   :3;   /* 0: OFDM, 1:CCK, 2:HT 3:VHT 4..7 reserved */
+       uint32 nss        :2;   /* 0:1x1, 1:2x2, 3:3x3, 4:4x4 */
+       uint32 bw         :3;   /* 0:20MHz, 1:40Mhz, 2:80Mhz, 3:160Mhz */
+       uint32 rateMcsIdx :8;   /* OFDM/CCK rate code would be as per ieee std
+                                       * in the units of 0.5mbps HT/VHT it would be
+                                       * mcs index
+                                       */
+       uint32 reserved  :16;   /* reserved */
+       uint32 bitrate;         /* units of 100 Kbps */
+} wifi_rate_v1;
+
+/* channel statistics */
+typedef struct {
+       wifi_channel_info channel;  /* channel */
+       uint32 on_time;                 /* msecs the radio is awake (32 bits number
+                                        * accruing over time)
+                                        */
+       uint32 cca_busy_time;          /* msecs the CCA register is busy (32 bits number
+                                       * accruing over time)
+                                       */
+} wifi_channel_stat;
+
+/* radio statistics */
+typedef struct {
+       struct {
+               uint16 version;
+               uint16 length;
+       };
+       wifi_radio radio;               /* wifi radio (if multiple radio supported) */
+       uint32 on_time;                    /* msecs the radio is awake (32 bits number
+                                           * accruing over time)
+                                           */
+       uint32 tx_time;                    /* msecs the radio is transmitting (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 rx_time;                    /* msecs the radio is in active receive (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_scan;               /* msecs the radio is awake due to all scan (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_nbd;                /* msecs the radio is awake due to NAN (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_gscan;              /* msecs the radio is awake due to G?scan (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_roam_scan;          /* msecs the radio is awake due to roam?scan (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_pno_scan;           /* msecs the radio is awake due to PNO scan (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_hs20;               /* msecs the radio is awake due to HS2.0 scans and
+                                           * GAS exchange (32 bits number accruing over time)
+                                           */
+       uint32 num_channels;               /* number of channels */
+       wifi_channel_stat channels[1];   /* channel statistics */
+} wifi_radio_stat;
+
+typedef struct {
+       wifi_radio radio;
+       uint32 on_time;
+       uint32 tx_time;
+       uint32 rx_time;
+       uint32 on_time_scan;
+       uint32 on_time_nbd;
+       uint32 on_time_gscan;
+       uint32 on_time_roam_scan;
+       uint32 on_time_pno_scan;
+       uint32 on_time_hs20;
+       uint32 num_channels;
+} wifi_radio_stat_h;
+
+/* per rate statistics */
+typedef struct {
+       wifi_rate_v1 rate;     /* rate information */
+       uint32 tx_mpdu;        /* number of successfully transmitted data pkts (ACK rcvd) */
+       uint32 rx_mpdu;        /* number of received data pkts */
+       uint32 mpdu_lost;      /* number of data packet losses (no ACK) */
+       uint32 retries;        /* total number of data pkt retries */
+       uint32 retries_short;  /* number of short data pkt retries */
+       uint32 retries_long;   /* number of long data pkt retries */
+} wifi_rate_stat_v1;
+
+typedef struct {
+       uint16 version;
+       uint16 length;
+       uint32 tx_mpdu;        /* number of successfully transmitted data pkts (ACK rcvd) */
+       uint32 rx_mpdu;        /* number of received data pkts */
+       uint32 mpdu_lost;      /* number of data packet losses (no ACK) */
+       uint32 retries;        /* total number of data pkt retries */
+       uint32 retries_short;  /* number of short data pkt retries */
+       uint32 retries_long;   /* number of long data pkt retries */
+       wifi_rate rate;
+} wifi_rate_stat;
+
+/* access categories */
+typedef enum {
+       WIFI_AC_VO  = 0,
+       WIFI_AC_VI  = 1,
+       WIFI_AC_BE  = 2,
+       WIFI_AC_BK  = 3,
+       WIFI_AC_MAX = 4
+} wifi_traffic_ac;
+
+/* wifi peer type */
+typedef enum
+{
+       WIFI_PEER_STA,
+       WIFI_PEER_AP,
+       WIFI_PEER_P2P_GO,
+       WIFI_PEER_P2P_CLIENT,
+       WIFI_PEER_NAN,
+       WIFI_PEER_TDLS,
+       WIFI_PEER_INVALID
+} wifi_peer_type;
+
+/* per peer statistics */
+typedef struct {
+       wifi_peer_type type;           /* peer type (AP, TDLS, GO etc.) */
+       uint8 peer_mac_address[6];        /* mac address */
+       uint32 capabilities;              /* peer WIFI_CAPABILITY_XXX */
+       uint32 num_rate;                  /* number of rates */
+       wifi_rate_stat rate_stats[1];   /* per rate statistics, number of entries  = num_rate */
+} wifi_peer_info;
+
+/* per access category statistics */
+typedef struct {
+       wifi_traffic_ac ac;             /* access category (VI, VO, BE, BK) */
+       uint32 tx_mpdu;                    /* number of successfully transmitted unicast data pkts
+                                           * (ACK rcvd)
+                                           */
+       uint32 rx_mpdu;                    /* number of received unicast mpdus */
+       uint32 tx_mcast;                   /* number of succesfully transmitted multicast
+                                           * data packets
+                                           */
+                                          /* STA case: implies ACK received from AP for the
+                                           * unicast packet in which mcast pkt was sent
+                                           */
+       uint32 rx_mcast;                   /* number of received multicast data packets */
+       uint32 rx_ampdu;                   /* number of received unicast a-mpdus */
+       uint32 tx_ampdu;                   /* number of transmitted unicast a-mpdus */
+       uint32 mpdu_lost;                  /* number of data pkt losses (no ACK) */
+       uint32 retries;                    /* total number of data pkt retries */
+       uint32 retries_short;              /* number of short data pkt retries */
+       uint32 retries_long;               /* number of long data pkt retries */
+       uint32 contention_time_min;        /* data pkt min contention time (usecs) */
+       uint32 contention_time_max;        /* data pkt max contention time (usecs) */
+       uint32 contention_time_avg;        /* data pkt avg contention time (usecs) */
+       uint32 contention_num_samples;     /* num of data pkts used for contention statistics */
+} wifi_wmm_ac_stat;
+
+/* interface statistics */
+typedef struct {
+       wifi_interface_handle iface;          /* wifi interface */
+       wifi_interface_info info;             /* current state of the interface */
+       uint32 beacon_rx;                     /* access point beacon received count from
+                                              * connected AP
+                                              */
+       uint64 average_tsf_offset;      /* average beacon offset encountered (beacon_TSF - TBTT)
+                                       * The average_tsf_offset field is used so as to calculate
+                                       * the typical beacon contention time on the channel as well
+                                       * may be used to debug beacon synchronization and related
+                                       * power consumption issue
+                                       */
+       uint32 leaky_ap_detected;       /* indicate that this AP
+                                       * typically leaks packets beyond
+                                       * the driver guard time.
+                                       */
+       uint32 leaky_ap_avg_num_frames_leaked;  /* average number of frame leaked by AP after
+                                       * frame with PM bit set was ACK'ed by AP
+                                       */
+       uint32 leaky_ap_guard_time;             /* guard time currently in force
+                                       * (when implementing IEEE power management
+                                       * based on frame control PM bit), How long
+                                       * driver waits before shutting down the radio and after
+                                       * receiving an ACK for a data frame with PM bit set)
+                                       */
+       uint32 mgmt_rx;                       /* access point mgmt frames received count from
+                                      * connected AP (including Beacon)
+                                      */
+       uint32 mgmt_action_rx;                /* action frames received count */
+       uint32 mgmt_action_tx;                /* action frames transmit count */
+       wifi_rssi rssi_mgmt;                  /* access Point Beacon and Management frames RSSI
+                                              * (averaged)
+                                              */
+       wifi_rssi rssi_data;                  /* access Point Data Frames RSSI (averaged) from
+                                              * connected AP
+                                              */
+       wifi_rssi rssi_ack;                   /* access Point ACK RSSI (averaged) from
+                                              * connected AP
+                                              */
+       wifi_wmm_ac_stat ac[WIFI_AC_MAX];     /* per ac data packet statistics */
+       uint32 num_peers;                        /* number of peers */
+       wifi_peer_info peer_info[1];           /* per peer statistics */
+} wifi_iface_stat;
+
+#ifdef CONFIG_COMPAT
+/* interface statistics */
+typedef struct {
+       compat_uptr_t iface;          /* wifi interface */
+       wifi_interface_info info;             /* current state of the interface */
+       uint32 beacon_rx;                     /* access point beacon received count from
+                                              * connected AP
+                                              */
+       uint64 average_tsf_offset;      /* average beacon offset encountered (beacon_TSF - TBTT)
+                                       * The average_tsf_offset field is used so as to calculate
+                                       * the typical beacon contention time on the channel as well
+                                       * may be used to debug beacon synchronization and related
+                                       * power consumption issue
+                                       */
+       uint32 leaky_ap_detected;       /* indicate that this AP
+                                       * typically leaks packets beyond
+                                       * the driver guard time.
+                                       */
+       uint32 leaky_ap_avg_num_frames_leaked;  /* average number of frame leaked by AP after
+                                       * frame with PM bit set was ACK'ed by AP
+                                       */
+       uint32 leaky_ap_guard_time;             /* guard time currently in force
+                                       * (when implementing IEEE power management
+                                       * based on frame control PM bit), How long
+                                       * driver waits before shutting down the radio and after
+                                       * receiving an ACK for a data frame with PM bit set)
+                                       */
+       uint32 mgmt_rx;                       /* access point mgmt frames received count from
+                                      * connected AP (including Beacon)
+                                      */
+       uint32 mgmt_action_rx;                /* action frames received count */
+       uint32 mgmt_action_tx;                /* action frames transmit count */
+       wifi_rssi rssi_mgmt;                  /* access Point Beacon and Management frames RSSI
+                                              * (averaged)
+                                              */
+       wifi_rssi rssi_data;                  /* access Point Data Frames RSSI (averaged) from
+                                              * connected AP
+                                              */
+       wifi_rssi rssi_ack;                   /* access Point ACK RSSI (averaged) from
+                                              * connected AP
+                                              */
+       wifi_wmm_ac_stat ac[WIFI_AC_MAX];     /* per ac data packet statistics */
+       uint32 num_peers;                        /* number of peers */
+       wifi_peer_info peer_info[1];           /* per peer statistics */
+} compat_wifi_iface_stat;
+#endif /* CONFIG_COMPAT */
+
+#endif /* USE_WIFI_STATS_H */
+
+#endif /* _wifi_stats_h_ */
diff --git a/bcmdhd.101.10.240.x/wl_android.c b/bcmdhd.101.10.240.x/wl_android.c
new file mode 100644 (file)
index 0000000..414a14c
--- /dev/null
@@ -0,0 +1,12472 @@
+/*
+ * Linux cfg80211 driver - Android related functions
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <net/netlink.h>
+#ifdef CONFIG_COMPAT
+#include <linux/compat.h>
+#endif
+
+#include <wl_android.h>
+#include <wldev_common.h>
+#include <wlioctl.h>
+#include <wlioctl_utils.h>
+#include <bcmutils.h>
+#include <bcmstdlib_s.h>
+#include <linux_osl.h>
+#include <dhd_dbg.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_config.h>
+#include <bcmip.h>
+#ifdef PNO_SUPPORT
+#include <dhd_pno.h>
+#endif
+#ifdef BCMSDIO
+#include <bcmsdbus.h>
+#endif
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#include <wl_cfgscan.h>
+#endif
+#ifdef WL_NAN
+#include <wl_cfgnan.h>
+#endif /* WL_NAN */
+#ifdef DHDTCPACK_SUPPRESS
+#include <dhd_ip.h>
+#endif /* DHDTCPACK_SUPPRESS */
+#include <bcmwifi_rspec.h>
+#include <dhd_linux.h>
+#include <bcmiov.h>
+#ifdef DHD_PKT_LOGGING
+#include <dhd_pktlog.h>
+#endif /* DHD_PKT_LOGGING */
+#ifdef WL_BCNRECV
+#include <wl_cfgvendor.h>
+#include <brcm_nl80211.h>
+#endif /* WL_BCNRECV */
+#ifdef WL_MBO
+#include <mbo.h>
+#endif /* WL_MBO */
+#ifdef RTT_SUPPORT
+#include <dhd_rtt.h>
+#endif /* RTT_SUPPORT */
+#ifdef DHD_EVENT_LOG_FILTER
+#include <dhd_event_log_filter.h>
+#endif /* DHD_EVENT_LOG_FILTER */
+#ifdef WL_ESCAN
+#include <wl_escan.h>
+#endif
+
+#ifdef WL_STATIC_IF
+#define WL_BSSIDX_MAX  16
+#endif /* WL_STATIC_IF */
+
+uint android_msg_level = ANDROID_ERROR_LEVEL | ANDROID_MSG_LEVEL;
+
+#define ANDROID_ERROR_MSG(x, args...) \
+       do { \
+               if (android_msg_level & ANDROID_ERROR_LEVEL) { \
+                       printk(KERN_ERR "[dhd] ANDROID-ERROR) " x, ## args); \
+               } \
+       } while (0)
+#define ANDROID_TRACE_MSG(x, args...) \
+       do { \
+               if (android_msg_level & ANDROID_TRACE_LEVEL) { \
+                       printk(KERN_INFO "[dhd] ANDROID-TRACE) " x, ## args); \
+               } \
+       } while (0)
+#define ANDROID_INFO_MSG(x, args...) \
+       do { \
+               if (android_msg_level & ANDROID_INFO_LEVEL) { \
+                       printk(KERN_INFO "[dhd] ANDROID-INFO) " x, ## args); \
+               } \
+       } while (0)
+#define ANDROID_ERROR(x) ANDROID_ERROR_MSG x
+#define ANDROID_TRACE(x) ANDROID_TRACE_MSG x
+#define ANDROID_INFO(x) ANDROID_INFO_MSG x
+
+/*
+ * Android private command strings, PLEASE define new private commands here
+ * so they can be updated easily in the future (if needed)
+ */
+
+#define CMD_START              "START"
+#define CMD_STOP               "STOP"
+#define        CMD_SCAN_ACTIVE         "SCAN-ACTIVE"
+#define        CMD_SCAN_PASSIVE        "SCAN-PASSIVE"
+#define CMD_RSSI               "RSSI"
+#define CMD_LINKSPEED          "LINKSPEED"
+#define CMD_RXFILTER_START     "RXFILTER-START"
+#define CMD_RXFILTER_STOP      "RXFILTER-STOP"
+#define CMD_RXFILTER_ADD       "RXFILTER-ADD"
+#define CMD_RXFILTER_REMOVE    "RXFILTER-REMOVE"
+#define CMD_BTCOEXSCAN_START   "BTCOEXSCAN-START"
+#define CMD_BTCOEXSCAN_STOP    "BTCOEXSCAN-STOP"
+#define CMD_BTCOEXMODE         "BTCOEXMODE"
+#define CMD_SETSUSPENDOPT      "SETSUSPENDOPT"
+#define CMD_SETSUSPENDMODE      "SETSUSPENDMODE"
+#define CMD_SETDTIM_IN_SUSPEND  "SET_DTIM_IN_SUSPEND"
+#define CMD_MAXDTIM_IN_SUSPEND  "MAX_DTIM_IN_SUSPEND"
+#define CMD_DISDTIM_IN_SUSPEND  "DISABLE_DTIM_IN_SUSPEND"
+#define CMD_P2P_DEV_ADDR       "P2P_DEV_ADDR"
+#define CMD_SETFWPATH          "SETFWPATH"
+#define CMD_SETBAND            "SETBAND"
+#define CMD_GETBAND            "GETBAND"
+#define CMD_COUNTRY            "COUNTRY"
+#define CMD_P2P_SET_NOA                "P2P_SET_NOA"
+#if !defined WL_ENABLE_P2P_IF
+#define CMD_P2P_GET_NOA                        "P2P_GET_NOA"
+#endif /* WL_ENABLE_P2P_IF */
+#define CMD_P2P_SD_OFFLOAD             "P2P_SD_"
+#define CMD_P2P_LISTEN_OFFLOAD         "P2P_LO_"
+#define CMD_P2P_SET_PS         "P2P_SET_PS"
+#define CMD_P2P_ECSA           "P2P_ECSA"
+#define CMD_P2P_INC_BW         "P2P_INCREASE_BW"
+#define CMD_SET_AP_WPS_P2P_IE          "SET_AP_WPS_P2P_IE"
+#define CMD_SETROAMMODE        "SETROAMMODE"
+#define CMD_SETIBSSBEACONOUIDATA       "SETIBSSBEACONOUIDATA"
+#define CMD_MIRACAST           "MIRACAST"
+#ifdef WL_NAN
+#define CMD_NAN         "NAN_"
+#endif /* WL_NAN */
+#define CMD_COUNTRY_DELIMITER "/"
+
+#if defined(WL_SUPPORT_AUTO_CHANNEL)
+#define CMD_GET_BEST_CHANNELS  "GET_BEST_CHANNELS"
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+
+#define CMD_80211_MODE    "MODE"  /* 802.11 mode a/b/g/n/ac */
+#define CMD_CHANSPEC      "CHANSPEC"
+#define CMD_DATARATE      "DATARATE"
+#define CMD_ASSOC_CLIENTS "ASSOCLIST"
+#define CMD_SET_CSA       "SETCSA"
+#ifdef WL_SUPPORT_AUTO_CHANNEL
+#define CMD_SET_HAPD_AUTO_CHANNEL      "HAPD_AUTO_CHANNEL"
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+#ifdef SUPPORT_HIDDEN_AP
+/* Hostapd private command */
+#define CMD_SET_HAPD_MAX_NUM_STA       "HAPD_MAX_NUM_STA"
+#define CMD_SET_HAPD_SSID              "HAPD_SSID"
+#define CMD_SET_HAPD_HIDE_SSID         "HAPD_HIDE_SSID"
+#endif /* SUPPORT_HIDDEN_AP */
+#ifdef SUPPORT_SOFTAP_SINGL_DISASSOC
+#define CMD_HAPD_STA_DISASSOC          "HAPD_STA_DISASSOC"
+#endif /* SUPPORT_SOFTAP_SINGL_DISASSOC */
+#ifdef SUPPORT_SET_LPC
+#define CMD_HAPD_LPC_ENABLED           "HAPD_LPC_ENABLED"
+#endif /* SUPPORT_SET_LPC */
+#ifdef SUPPORT_TRIGGER_HANG_EVENT
+#define CMD_TEST_FORCE_HANG            "TEST_FORCE_HANG"
+#endif /* SUPPORT_TRIGGER_HANG_EVENT */
+#ifdef SUPPORT_LTECX
+#define CMD_LTECX_SET          "LTECOEX"
+#endif /* SUPPORT_LTECX */
+#ifdef TEST_TX_POWER_CONTROL
+#define CMD_TEST_SET_TX_POWER          "TEST_SET_TX_POWER"
+#define CMD_TEST_GET_TX_POWER          "TEST_GET_TX_POWER"
+#endif /* TEST_TX_POWER_CONTROL */
+#define CMD_SARLIMIT_TX_CONTROL                "SET_TX_POWER_CALLING"
+#ifdef SUPPORT_SET_TID
+#define CMD_SET_TID            "SET_TID"
+#define CMD_GET_TID            "GET_TID"
+#endif /* SUPPORT_SET_TID */
+#define CMD_ROAM_VSIE_ENAB_SET "SET_ROAMING_REASON_ENABLED"
+#define CMD_ROAM_VSIE_ENAB_GET "GET_ROAMING_REASON_ENABLED"
+#define CMD_BR_VSIE_ENAB_SET   "SET_BR_ERR_REASON_ENABLED"
+#define CMD_BR_VSIE_ENAB_GET   "GET_BR_ERR_REASON_ENABLED"
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+#define CMD_KEEP_ALIVE          "KEEPALIVE"
+
+#ifdef PNO_SUPPORT
+#define CMD_PNOSSIDCLR_SET     "PNOSSIDCLR"
+#define CMD_PNOSETUP_SET       "PNOSETUP "
+#define CMD_PNOENABLE_SET      "PNOFORCE"
+#define CMD_PNODEBUG_SET       "PNODEBUG"
+#define CMD_WLS_BATCHING       "WLS_BATCHING"
+#endif /* PNO_SUPPORT */
+
+#define CMD_HAPD_SET_AX_MODE "HAPD_SET_AX_MODE"
+
+#define        CMD_HAPD_MAC_FILTER     "HAPD_MAC_FILTER"
+
+#if defined(SUPPORT_RANDOM_MAC_SCAN)
+#define ENABLE_RANDOM_MAC "ENABLE_RANDOM_MAC"
+#define DISABLE_RANDOM_MAC "DISABLE_RANDOM_MAC"
+#endif /* SUPPORT_RANDOM_MAC_SCAN */
+#define CMD_GET_FACTORY_MAC      "FACTORY_MAC"
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+
+#ifdef ROAM_API
+#define CMD_ROAMTRIGGER_SET "SETROAMTRIGGER"
+#define CMD_ROAMTRIGGER_GET "GETROAMTRIGGER"
+#define CMD_ROAMDELTA_SET "SETROAMDELTA"
+#define CMD_ROAMDELTA_GET "GETROAMDELTA"
+#define CMD_ROAMSCANPERIOD_SET "SETROAMSCANPERIOD"
+#define CMD_ROAMSCANPERIOD_GET "GETROAMSCANPERIOD"
+#define CMD_FULLROAMSCANPERIOD_SET "SETFULLROAMSCANPERIOD"
+#define CMD_FULLROAMSCANPERIOD_GET "GETFULLROAMSCANPERIOD"
+#define CMD_COUNTRYREV_SET "SETCOUNTRYREV"
+#define CMD_COUNTRYREV_GET "GETCOUNTRYREV"
+#endif /* ROAM_API */
+
+#if defined(SUPPORT_NAN_RANGING_TEST_BW)
+#define CMD_NAN_RANGING_SET_BW "NAN_RANGING_SET_BW"
+#endif /* SUPPORT_NAN_RANGING_TEST_BW */
+
+#ifdef WES_SUPPORT
+#define CMD_GETSCANCHANNELTIMELEGACY "GETSCANCHANNELTIME_LEGACY"
+#define CMD_SETSCANCHANNELTIMELEGACY "SETSCANCHANNELTIME_LEGACY"
+#define CMD_GETSCANUNASSOCTIMELEGACY "GETSCANUNASSOCTIME_LEGACY"
+#define CMD_SETSCANUNASSOCTIMELEGACY "SETSCANUNASSOCTIME_LEGACY"
+#define CMD_GETSCANPASSIVETIMELEGACY "GETSCANPASSIVETIME_LEGACY"
+#define CMD_SETSCANPASSIVETIMELEGACY "SETSCANPASSIVETIME_LEGACY"
+#define CMD_GETSCANHOMETIMELEGACY "GETSCANHOMETIME_LEGACY"
+#define CMD_SETSCANHOMETIMELEGACY "SETSCANHOMETIME_LEGACY"
+#define CMD_GETSCANHOMEAWAYTIMELEGACY "GETSCANHOMEAWAYTIME_LEGACY"
+#define CMD_SETSCANHOMEAWAYTIMELEGACY "SETSCANHOMEAWAYTIME_LEGACY"
+#define CMD_GETROAMSCANCHLEGACY "GETROAMSCANCHANNELS_LEGACY"
+#define CMD_ADDROAMSCANCHLEGACY "ADDROAMSCANCHANNELS_LEGACY"
+#define CMD_GETROAMTRIGLEGACY "GETROAMTRIGGER_LEGACY"
+#define CMD_SETROAMTRIGLEGACY "SETROAMTRIGGER_LEGACY"
+#define CMD_REASSOCLEGACY "REASSOC_LEGACY"
+
+#define CMD_GETROAMSCANCONTROL "GETROAMSCANCONTROL"
+#define CMD_SETROAMSCANCONTROL "SETROAMSCANCONTROL"
+#define CMD_GETROAMSCANCHANNELS "GETROAMSCANCHANNELS"
+#define CMD_SETROAMSCANCHANNELS "SETROAMSCANCHANNELS"
+#define CMD_ADDROAMSCANCHANNELS "ADDROAMSCANCHANNELS"
+#define CMD_GETSCANCHANNELTIME "GETSCANCHANNELTIME"
+#define CMD_SETSCANCHANNELTIME "SETSCANCHANNELTIME"
+#define CMD_GETSCANUNASSOCTIME "GETSCANUNASSOCTIME"
+#define CMD_SETSCANUNASSOCTIME "SETSCANUNASSOCTIME"
+#define CMD_GETSCANPASSIVETIME "GETSCANPASSIVETIME"
+#define CMD_SETSCANPASSIVETIME "SETSCANPASSIVETIME"
+#define CMD_GETSCANHOMETIME "GETSCANHOMETIME"
+#define CMD_SETSCANHOMETIME "SETSCANHOMETIME"
+#define CMD_GETSCANHOMEAWAYTIME "GETSCANHOMEAWAYTIME"
+#define CMD_SETSCANHOMEAWAYTIME "SETSCANHOMEAWAYTIME"
+#define CMD_GETSCANNPROBES "GETSCANNPROBES"
+#define CMD_SETSCANNPROBES "SETSCANNPROBES"
+#define CMD_GETDFSSCANMODE "GETDFSSCANMODE"
+#define CMD_SETDFSSCANMODE "SETDFSSCANMODE"
+#define CMD_SETJOINPREFER "SETJOINPREFER"
+
+#define CMD_SENDACTIONFRAME "SENDACTIONFRAME"
+#define CMD_REASSOC "REASSOC"
+
+#define CMD_GETWESMODE "GETWESMODE"
+#define CMD_SETWESMODE "SETWESMODE"
+#define CMD_GETNCHOMODE        "GETNCHOMODE"
+#define CMD_SETNCHOMODE        "SETNCHOMODE"
+
+/* Customer requested to Remove OKCMODE command */
+#define CMD_GETOKCMODE "GETOKCMODE"
+#define CMD_SETOKCMODE "SETOKCMODE"
+
+#define CMD_OKC_SET_PMK         "SET_PMK"
+#define CMD_OKC_ENABLE          "OKC_ENABLE"
+
+typedef struct android_wifi_reassoc_params {
+       unsigned char bssid[18];
+       int channel;
+} android_wifi_reassoc_params_t;
+
+#define ANDROID_WIFI_REASSOC_PARAMS_SIZE sizeof(struct android_wifi_reassoc_params)
+
+#define ANDROID_WIFI_ACTION_FRAME_SIZE 1040
+
+typedef struct android_wifi_af_params {
+       unsigned char bssid[18];
+       int channel;
+       int dwell_time;
+       int len;
+       unsigned char data[ANDROID_WIFI_ACTION_FRAME_SIZE];
+} android_wifi_af_params_t;
+
+#define ANDROID_WIFI_AF_PARAMS_SIZE sizeof(struct android_wifi_af_params)
+#endif /* WES_SUPPORT */
+#ifdef SUPPORT_AMPDU_MPDU_CMD
+#define CMD_AMPDU_MPDU         "AMPDU_MPDU"
+#endif /* SUPPORT_AMPDU_MPDU_CMD */
+
+#define CMD_CHANGE_RL  "CHANGE_RL"
+#define CMD_RESTORE_RL  "RESTORE_RL"
+
+#define CMD_SET_RMC_ENABLE                     "SETRMCENABLE"
+#define CMD_SET_RMC_TXRATE                     "SETRMCTXRATE"
+#define CMD_SET_RMC_ACTPERIOD          "SETRMCACTIONPERIOD"
+#define CMD_SET_RMC_IDLEPERIOD         "SETRMCIDLEPERIOD"
+#define CMD_SET_RMC_LEADER                     "SETRMCLEADER"
+#define CMD_SET_RMC_EVENT                      "SETRMCEVENT"
+
+#define CMD_SET_SCSCAN         "SETSINGLEANT"
+#define CMD_GET_SCSCAN         "GETSINGLEANT"
+#ifdef WLTDLS
+#define CMD_TDLS_RESET "TDLS_RESET"
+#endif /* WLTDLS */
+
+#ifdef CONFIG_SILENT_ROAM
+#define CMD_SROAM_TURN_ON      "SROAMTURNON"
+#define CMD_SROAM_SET_INFO     "SROAMSETINFO"
+#define CMD_SROAM_GET_INFO     "SROAMGETINFO"
+#endif /* CONFIG_SILENT_ROAM */
+
+#ifdef CONFIG_ROAM_RSSI_LIMIT
+#define CMD_ROAM_RSSI_LMT      "ROAMRSSILIMIT"
+#endif /* CONFIG_ROAM_RSSI_LIMIT */
+
+#define CMD_SET_DISCONNECT_IES  "SET_DISCONNECT_IES"
+
+#ifdef FCC_PWR_LIMIT_2G
+#define CMD_GET_FCC_PWR_LIMIT_2G "GET_FCC_CHANNEL"
+#define CMD_SET_FCC_PWR_LIMIT_2G "SET_FCC_CHANNEL"
+/* CUSTOMER_HW4's value differs from BRCM FW value for enable/disable */
+#define CUSTOMER_HW4_ENABLE            0
+#define CUSTOMER_HW4_DISABLE   -1
+#endif /* FCC_PWR_LIMIT_2G */
+#define CUSTOMER_HW4_EN_CONVERT(i)     (i += 1)
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+
+#ifdef WLFBT
+#define CMD_GET_FTKEY      "GET_FTKEY"
+#endif
+
+#ifdef WLAIBSS
+#define CMD_SETIBSSTXFAILEVENT         "SETIBSSTXFAILEVENT"
+#define CMD_GET_IBSS_PEER_INFO         "GETIBSSPEERINFO"
+#define CMD_GET_IBSS_PEER_INFO_ALL     "GETIBSSPEERINFOALL"
+#define CMD_SETIBSSROUTETABLE          "SETIBSSROUTETABLE"
+#define CMD_SETIBSSAMPDU                       "SETIBSSAMPDU"
+#define CMD_SETIBSSANTENNAMODE         "SETIBSSANTENNAMODE"
+#endif /* WLAIBSS */
+
+#define CMD_ROAM_OFFLOAD                       "SETROAMOFFLOAD"
+#define CMD_INTERFACE_CREATE                   "INTERFACE_CREATE"
+#define CMD_INTERFACE_DELETE                   "INTERFACE_DELETE"
+#define CMD_GET_LINK_STATUS                    "GETLINKSTATUS"
+
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+#define CMD_GET_BSS_INFO            "GETBSSINFO"
+#define CMD_GET_ASSOC_REJECT_INFO   "GETASSOCREJECTINFO"
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+#define CMD_GET_STA_INFO   "GETSTAINFO"
+
+/* related with CMD_GET_LINK_STATUS */
+#define WL_ANDROID_LINK_VHT                                    0x01
+#define WL_ANDROID_LINK_MIMO                                   0x02
+#define WL_ANDROID_LINK_AP_VHT_SUPPORT         0x04
+#define WL_ANDROID_LINK_AP_MIMO_SUPPORT        0x08
+
+#ifdef P2PRESP_WFDIE_SRC
+#define CMD_P2P_SET_WFDIE_RESP      "P2P_SET_WFDIE_RESP"
+#define CMD_P2P_GET_WFDIE_RESP      "P2P_GET_WFDIE_RESP"
+#endif /* P2PRESP_WFDIE_SRC */
+
+#define CMD_DFS_AP_MOVE                        "DFS_AP_MOVE"
+#define CMD_WBTEXT_ENABLE              "WBTEXT_ENABLE"
+#define CMD_WBTEXT_PROFILE_CONFIG      "WBTEXT_PROFILE_CONFIG"
+#define CMD_WBTEXT_WEIGHT_CONFIG       "WBTEXT_WEIGHT_CONFIG"
+#define CMD_WBTEXT_TABLE_CONFIG                "WBTEXT_TABLE_CONFIG"
+#define CMD_WBTEXT_DELTA_CONFIG                "WBTEXT_DELTA_CONFIG"
+#define CMD_WBTEXT_BTM_TIMER_THRESHOLD "WBTEXT_BTM_TIMER_THRESHOLD"
+#define CMD_WBTEXT_BTM_DELTA           "WBTEXT_BTM_DELTA"
+#define CMD_WBTEXT_ESTM_ENABLE "WBTEXT_ESTM_ENABLE"
+
+#ifdef WBTEXT
+#define CMD_WBTEXT_PROFILE_CONFIG      "WBTEXT_PROFILE_CONFIG"
+#define CMD_WBTEXT_WEIGHT_CONFIG       "WBTEXT_WEIGHT_CONFIG"
+#define CMD_WBTEXT_TABLE_CONFIG                "WBTEXT_TABLE_CONFIG"
+#define CMD_WBTEXT_DELTA_CONFIG                "WBTEXT_DELTA_CONFIG"
+#define DEFAULT_WBTEXT_PROFILE_A_V2            "a -70 -75 70 10 -75 -128 0 10"
+#define DEFAULT_WBTEXT_PROFILE_B_V2            "b -60 -75 70 10 -75 -128 0 10"
+#define DEFAULT_WBTEXT_PROFILE_A_V3            "a -70 -75 70 10 -75 -128 0 10"
+#define DEFAULT_WBTEXT_PROFILE_B_V3            "b -60 -75 70 10 -75 -128 0 10"
+#define DEFAULT_WBTEXT_WEIGHT_RSSI_A   "RSSI a 65"
+#define DEFAULT_WBTEXT_WEIGHT_RSSI_B   "RSSI b 65"
+#define DEFAULT_WBTEXT_WEIGHT_CU_A     "CU a 35"
+#define DEFAULT_WBTEXT_WEIGHT_CU_B     "CU b 35"
+#define DEFAULT_WBTEXT_WEIGHT_ESTM_DL_A        "ESTM_DL a 70"
+#define DEFAULT_WBTEXT_WEIGHT_ESTM_DL_B        "ESTM_DL b 70"
+#define DEFAULT_WBTEXT_CU_RSSI_TRIG_A  -70
+#define DEFAULT_WBTEXT_CU_RSSI_TRIG_B  -60
+#ifdef WBTEXT_SCORE_V2
+#define DEFAULT_WBTEXT_TABLE_RSSI_A    "RSSI a 0 55 100 55 60 90 \
+60 70 60 70 80 20 80 90 0 90 128 0"
+#define DEFAULT_WBTEXT_TABLE_RSSI_B    "RSSI b 0 55 100 55 60 90 \
+60 70 60 70 80 20 80 90 0 90 128 0"
+#define DEFAULT_WBTEXT_TABLE_CU_A      "CU a 0 30 100 30 80 20 \
+80 100 20"
+#define DEFAULT_WBTEXT_TABLE_CU_B      "CU b 0 10 100 10 70 20 \
+70 100 20"
+#else
+#define DEFAULT_WBTEXT_TABLE_RSSI_A    "RSSI a 0 55 100 55 60 90 \
+60 65 70 65 70 50 70 128 20"
+#define DEFAULT_WBTEXT_TABLE_RSSI_B    "RSSI b 0 55 100 55 60 90 \
+60 65 70 65 70 50 70 128 20"
+#define DEFAULT_WBTEXT_TABLE_CU_A      "CU a 0 30 100 30 50 90 \
+50 60 70 60 80 50 80 100 20"
+#define DEFAULT_WBTEXT_TABLE_CU_B      "CU b 0 10 100 10 25 90 \
+25 40 70 40 70 50 70 100 20"
+#endif /* WBTEXT_SCORE_V2 */
+#endif /* WBTEXT */
+
+#define BUFSZ 8
+#define BUFSZN BUFSZ + 1
+
+#define _S(x) #x
+#define S(x) _S(x)
+
+#define  MAXBANDS    2  /**< Maximum #of bands */
+#define BAND_2G_INDEX      1
+#define BAND_5G_INDEX      0
+
+typedef union {
+       wl_roam_prof_band_v1_t v1;
+       wl_roam_prof_band_v2_t v2;
+       wl_roam_prof_band_v3_t v3;
+       wl_roam_prof_band_v4_t v4;
+} wl_roamprof_band_t;
+
+#ifdef WLWFDS
+#define CMD_ADD_WFDS_HASH      "ADD_WFDS_HASH"
+#define CMD_DEL_WFDS_HASH      "DEL_WFDS_HASH"
+#endif /* WLWFDS */
+
+#ifdef BT_WIFI_HANDOVER
+#define CMD_TBOW_TEARDOWN "TBOW_TEARDOWN"
+#endif /* BT_WIFI_HANDOVER */
+
+#define CMD_MURX_BFE_CAP "MURX_BFE_CAP"
+
+#ifdef SUPPORT_RSSI_SUM_REPORT
+#define CMD_SET_RSSI_LOGGING                           "SET_RSSI_LOGGING"
+#define CMD_GET_RSSI_LOGGING                           "GET_RSSI_LOGGING"
+#define CMD_GET_RSSI_PER_ANT                           "GET_RSSI_PER_ANT"
+#endif /* SUPPORT_RSSI_SUM_REPORT */
+
+#define CMD_GET_SNR                                                    "GET_SNR"
+
+#ifdef SUPPORT_AP_HIGHER_BEACONRATE
+#define CMD_SET_AP_BEACONRATE                          "SET_AP_BEACONRATE"
+#define CMD_GET_AP_BASICRATE                           "GET_AP_BASICRATE"
+#endif /* SUPPORT_AP_HIGHER_BEACONRATE */
+
+#ifdef SUPPORT_AP_RADIO_PWRSAVE
+#define CMD_SET_AP_RPS                                         "SET_AP_RPS"
+#define CMD_GET_AP_RPS                                         "GET_AP_RPS"
+#define CMD_SET_AP_RPS_PARAMS                          "SET_AP_RPS_PARAMS"
+#endif /* SUPPORT_AP_RADIO_PWRSAVE */
+
+#ifdef SUPPORT_AP_SUSPEND
+#define CMD_SET_AP_SUSPEND                     "SET_AP_SUSPEND"
+#endif /* SUPPORT_AP_SUSPEND */
+
+#ifdef SUPPORT_AP_BWCTRL
+#define CMD_SET_AP_BW                  "SET_AP_BW"
+#define CMD_GET_AP_BW                  "GET_AP_BW"
+#endif /* SUPPORT_AP_BWCTRL */
+
+/* miracast related definition */
+#define MIRACAST_MODE_OFF      0
+#define MIRACAST_MODE_SOURCE   1
+#define MIRACAST_MODE_SINK     2
+
+#ifdef CONNECTION_STATISTICS
+#define CMD_GET_CONNECTION_STATS       "GET_CONNECTION_STATS"
+
+struct connection_stats {
+       u32 txframe;
+       u32 txbyte;
+       u32 txerror;
+       u32 rxframe;
+       u32 rxbyte;
+       u32 txfail;
+       u32 txretry;
+       u32 txretrie;
+       u32 txrts;
+       u32 txnocts;
+       u32 txexptime;
+       u32 txrate;
+       u8      chan_idle;
+};
+#endif /* CONNECTION_STATISTICS */
+
+#ifdef SUPPORT_LQCM
+#define CMD_SET_LQCM_ENABLE                    "SET_LQCM_ENABLE"
+#define CMD_GET_LQCM_REPORT                    "GET_LQCM_REPORT"
+#endif
+
+static LIST_HEAD(miracast_resume_list);
+#ifdef WL_CFG80211
+static u8 miracast_cur_mode;
+#endif /* WL_CFG80211 */
+
+#ifdef DHD_LOG_DUMP
+#define CMD_NEW_DEBUG_PRINT_DUMP       "DEBUG_DUMP"
+#define SUBCMD_UNWANTED                        "UNWANTED"
+#define SUBCMD_DISCONNECTED            "DISCONNECTED"
+void dhd_log_dump_trigger(dhd_pub_t *dhdp, int subcmd);
+#endif /* DHD_LOG_DUMP */
+
+#ifdef DHD_STATUS_LOGGING
+#define CMD_DUMP_STATUS_LOG            "DUMP_STAT_LOG"
+#define CMD_QUERY_STATUS_LOG           "QUERY_STAT_LOG"
+#endif /* DHD_STATUS_LOGGING */
+
+#ifdef DHD_HANG_SEND_UP_TEST
+#define CMD_MAKE_HANG  "MAKE_HANG"
+#endif /* CMD_DHD_HANG_SEND_UP_TEST */
+#ifdef DHD_DEBUG_UART
+extern bool dhd_debug_uart_is_running(struct net_device *dev);
+#endif /* DHD_DEBUG_UART */
+
+#ifdef RTT_GEOFENCE_INTERVAL
+#if defined(RTT_SUPPORT) && defined(WL_NAN)
+#define CMD_GEOFENCE_INTERVAL  "GEOFENCE_INT"
+#endif /* RTT_SUPPORT && WL_NAN */
+#endif /* RTT_GEOFENCE_INTERVAL */
+
+struct io_cfg {
+       s8 *iovar;
+       s32 param;
+       u32 ioctl;
+       void *arg;
+       u32 len;
+       struct list_head list;
+};
+
+#if defined(BCMFW_ROAM_ENABLE)
+#define CMD_SET_ROAMPREF       "SET_ROAMPREF"
+
+#define MAX_NUM_SUITES         10
+#define WIDTH_AKM_SUITE                8
+#define JOIN_PREF_RSSI_LEN             0x02
+#define JOIN_PREF_RSSI_SIZE            4       /* RSSI pref header size in bytes */
+#define JOIN_PREF_WPA_HDR_SIZE         4 /* WPA pref header size in bytes */
+#define JOIN_PREF_WPA_TUPLE_SIZE       12      /* Tuple size in bytes */
+#define JOIN_PREF_MAX_WPA_TUPLES       16
+#define MAX_BUF_SIZE           (JOIN_PREF_RSSI_SIZE + JOIN_PREF_WPA_HDR_SIZE + \
+                                          (JOIN_PREF_WPA_TUPLE_SIZE * JOIN_PREF_MAX_WPA_TUPLES))
+#endif /* BCMFW_ROAM_ENABLE */
+
+#if defined(CONFIG_TIZEN)
+/*
+ * adding these private commands corresponding to atd-server's implementation
+ * __atd_control_pm_state()
+ */
+#define CMD_POWERSAVEMODE_SET "SETPOWERSAVEMODE"
+#define CMD_POWERSAVEMODE_GET "GETPOWERSAVEMODE"
+#endif /* CONFIG_TIZEN */
+
+#define CMD_DEBUG_VERBOSE          "DEBUG_VERBOSE"
+#ifdef WL_NATOE
+
+#define CMD_NATOE              "NATOE"
+
+#define NATOE_MAX_PORT_NUM     65535
+
+/* natoe command info structure */
+typedef struct wl_natoe_cmd_info {
+       uint8  *command;        /* pointer to the actual command */
+       uint16 tot_len;        /* total length of the command */
+       uint16 bytes_written;  /* Bytes written for get response */
+} wl_natoe_cmd_info_t;
+
+typedef struct wl_natoe_sub_cmd wl_natoe_sub_cmd_t;
+typedef int (natoe_cmd_handler_t)(struct net_device *dev,
+               const wl_natoe_sub_cmd_t *cmd, char *command, wl_natoe_cmd_info_t *cmd_info);
+
+struct wl_natoe_sub_cmd {
+       char *name;
+       uint8  version;              /* cmd  version */
+       uint16 id;                   /* id for the dongle f/w switch/case */
+       uint16 type;                 /* base type of argument */
+       natoe_cmd_handler_t *handler; /* cmd handler  */
+};
+
+#define WL_ANDROID_NATOE_FUNC(suffix) wl_android_natoe_subcmd_ ##suffix
+static int wl_android_process_natoe_cmd(struct net_device *dev,
+               char *command, int total_len);
+static int wl_android_natoe_subcmd_enable(struct net_device *dev,
+               const wl_natoe_sub_cmd_t *cmd, char *command, wl_natoe_cmd_info_t *cmd_info);
+static int wl_android_natoe_subcmd_config_ips(struct net_device *dev,
+               const wl_natoe_sub_cmd_t *cmd, char *command, wl_natoe_cmd_info_t *cmd_info);
+static int wl_android_natoe_subcmd_config_ports(struct net_device *dev,
+               const wl_natoe_sub_cmd_t *cmd, char *command, wl_natoe_cmd_info_t *cmd_info);
+static int wl_android_natoe_subcmd_dbg_stats(struct net_device *dev,
+               const wl_natoe_sub_cmd_t *cmd, char *command, wl_natoe_cmd_info_t *cmd_info);
+static int wl_android_natoe_subcmd_tbl_cnt(struct net_device *dev,
+               const wl_natoe_sub_cmd_t *cmd, char *command, wl_natoe_cmd_info_t *cmd_info);
+
+static const wl_natoe_sub_cmd_t natoe_cmd_list[] = {
+       /* wl natoe enable [0/1] or new: "wl natoe [0/1]" */
+       {"enable", 0x01, WL_NATOE_CMD_ENABLE,
+       IOVT_BUFFER, WL_ANDROID_NATOE_FUNC(enable)
+       },
+       {"config_ips", 0x01, WL_NATOE_CMD_CONFIG_IPS,
+       IOVT_BUFFER, WL_ANDROID_NATOE_FUNC(config_ips)
+       },
+       {"config_ports", 0x01, WL_NATOE_CMD_CONFIG_PORTS,
+       IOVT_BUFFER, WL_ANDROID_NATOE_FUNC(config_ports)
+       },
+       {"stats", 0x01, WL_NATOE_CMD_DBG_STATS,
+       IOVT_BUFFER, WL_ANDROID_NATOE_FUNC(dbg_stats)
+       },
+       {"tbl_cnt", 0x01, WL_NATOE_CMD_TBL_CNT,
+       IOVT_BUFFER, WL_ANDROID_NATOE_FUNC(tbl_cnt)
+       },
+       {NULL, 0, 0, 0, NULL}
+};
+
+#endif /* WL_NATOE */
+
+#ifdef SET_PCIE_IRQ_CPU_CORE
+#define CMD_PCIE_IRQ_CORE      "PCIE_IRQ_CORE"
+#endif /* SET_PCIE_IRQ_CPU_CORE */
+
+#ifdef WLADPS_PRIVATE_CMD
+#define CMD_SET_ADPS   "SET_ADPS"
+#define CMD_GET_ADPS   "GET_ADPS"
+#ifdef WLADPS_ENERGY_GAIN
+#define CMD_GET_GAIN_ADPS      "GET_GAIN_ADPS"
+#define CMD_RESET_GAIN_ADPS    "RESET_GAIN_ADPS"
+#ifndef ADPS_GAIN_2G_PM0_IDLE
+#define ADPS_GAIN_2G_PM0_IDLE 0
+#endif
+#ifndef ADPS_GAIN_5G_PM0_IDLE
+#define ADPS_GAIN_5G_PM0_IDLE 0
+#endif
+#ifndef ADPS_GAIN_2G_TX_PSPOLL
+#define ADPS_GAIN_2G_TX_PSPOLL 0
+#endif
+#ifndef ADPS_GAIN_5G_TX_PSPOLL
+#define ADPS_GAIN_5G_TX_PSPOLL 0
+#endif
+#endif /* WLADPS_ENERGY_GAIN */
+#endif /* WLADPS_PRIVATE_CMD */
+
+#ifdef DHD_PKT_LOGGING
+#define CMD_PKTLOG_FILTER_ENABLE       "PKTLOG_FILTER_ENABLE"
+#define CMD_PKTLOG_FILTER_DISABLE      "PKTLOG_FILTER_DISABLE"
+#define CMD_PKTLOG_FILTER_PATTERN_ENABLE       "PKTLOG_FILTER_PATTERN_ENABLE"
+#define CMD_PKTLOG_FILTER_PATTERN_DISABLE      "PKTLOG_FILTER_PATTERN_DISABLE"
+#define CMD_PKTLOG_FILTER_ADD  "PKTLOG_FILTER_ADD"
+#define CMD_PKTLOG_FILTER_DEL  "PKTLOG_FILTER_DEL"
+#define CMD_PKTLOG_FILTER_INFO "PKTLOG_FILTER_INFO"
+#define CMD_PKTLOG_START       "PKTLOG_START"
+#define CMD_PKTLOG_STOP                "PKTLOG_STOP"
+#define CMD_PKTLOG_FILTER_EXIST "PKTLOG_FILTER_EXIST"
+#define CMD_PKTLOG_MINMIZE_ENABLE      "PKTLOG_MINMIZE_ENABLE"
+#define CMD_PKTLOG_MINMIZE_DISABLE     "PKTLOG_MINMIZE_DISABLE"
+#define CMD_PKTLOG_CHANGE_SIZE "PKTLOG_CHANGE_SIZE"
+#define CMD_PKTLOG_DEBUG_DUMP  "PKTLOG_DEBUG_DUMP"
+#endif /* DHD_PKT_LOGGING */
+
+#ifdef DHD_EVENT_LOG_FILTER
+#define CMD_EWP_FILTER         "EWP_FILTER"
+#endif /* DHD_EVENT_LOG_FILTER */
+
+#ifdef WL_BCNRECV
+#define CMD_BEACON_RECV "BEACON_RECV"
+#endif /* WL_BCNRECV */
+#ifdef WL_CAC_TS
+#define CMD_CAC_TSPEC "CAC_TSPEC"
+#endif /* WL_CAC_TS */
+#ifdef WL_GET_CU
+#define CMD_GET_CHAN_UTIL "GET_CU"
+#endif /* WL_GET_CU */
+
+#ifdef SUPPORT_SOFTAP_ELNA_BYPASS
+#define CMD_SET_SOFTAP_ELNA_BYPASS                             "SET_SOFTAP_ELNA_BYPASS"
+#define CMD_GET_SOFTAP_ELNA_BYPASS                             "GET_SOFTAP_ELNA_BYPASS"
+#endif /* SUPPORT_SOFTAP_ELNA_BYPASS */
+
+#ifdef WL_NAN
+#define CMD_GET_NAN_STATUS     "GET_NAN_STATUS"
+#endif /* WL_NAN */
+
+/* drv command info structure */
+typedef struct wl_drv_cmd_info {
+       uint8  *command;        /* pointer to the actual command */
+       uint16 tot_len;         /* total length of the command */
+       uint16 bytes_written;   /* Bytes written for get response */
+} wl_drv_cmd_info_t;
+
+typedef struct wl_drv_sub_cmd wl_drv_sub_cmd_t;
+typedef int (drv_cmd_handler_t)(struct net_device *dev,
+               const wl_drv_sub_cmd_t *cmd, char *command, wl_drv_cmd_info_t *cmd_info);
+
+struct wl_drv_sub_cmd {
+       char *name;
+       uint8  version;              /* cmd  version */
+       uint16 id;                   /* id for the dongle f/w switch/case */
+       uint16 type;                 /* base type of argument */
+       drv_cmd_handler_t *handler;  /* cmd handler  */
+};
+
+#ifdef WL_MBO
+
+#define CMD_MBO                "MBO"
+enum {
+       WL_MBO_CMD_NON_CHAN_PREF = 1,
+       WL_MBO_CMD_CELL_DATA_CAP = 2
+};
+#define WL_ANDROID_MBO_FUNC(suffix) wl_android_mbo_subcmd_ ##suffix
+
+static int wl_android_process_mbo_cmd(struct net_device *dev,
+               char *command, int total_len);
+static int wl_android_mbo_subcmd_cell_data_cap(struct net_device *dev,
+               const wl_drv_sub_cmd_t *cmd, char *command, wl_drv_cmd_info_t *cmd_info);
+static int wl_android_mbo_subcmd_non_pref_chan(struct net_device *dev,
+               const wl_drv_sub_cmd_t *cmd, char *command, wl_drv_cmd_info_t *cmd_info);
+
+static const wl_drv_sub_cmd_t mbo_cmd_list[] = {
+       {"non_pref_chan", 0x01, WL_MBO_CMD_NON_CHAN_PREF,
+       IOVT_BUFFER, WL_ANDROID_MBO_FUNC(non_pref_chan)
+       },
+       {"cell_data_cap", 0x01, WL_MBO_CMD_CELL_DATA_CAP,
+       IOVT_BUFFER, WL_ANDROID_MBO_FUNC(cell_data_cap)
+       },
+       {NULL, 0, 0, 0, NULL}
+};
+
+#endif /* WL_MBO */
+
+#ifdef WL_GENL
+static s32 wl_genl_handle_msg(struct sk_buff *skb, struct genl_info *info);
+static int wl_genl_init(void);
+static int wl_genl_deinit(void);
+
+extern struct net init_net;
+/* attribute policy: defines which attribute has which type (e.g int, char * etc)
+ * possible values defined in net/netlink.h
+ */
+static struct nla_policy wl_genl_policy[BCM_GENL_ATTR_MAX + 1] = {
+       [BCM_GENL_ATTR_STRING] = { .type = NLA_NUL_STRING },
+       [BCM_GENL_ATTR_MSG] = { .type = NLA_BINARY },
+};
+
+#define WL_GENL_VER 1
+/* family definition */
+static struct genl_family wl_genl_family = {
+       .id = GENL_ID_GENERATE,    /* Genetlink would generate the ID */
+       .hdrsize = 0,
+       .name = "bcm-genl",        /* Netlink I/F for Android */
+       .version = WL_GENL_VER,     /* Version Number */
+       .maxattr = BCM_GENL_ATTR_MAX,
+};
+
+/* commands: mapping between the command enumeration and the actual function */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0))
+struct genl_ops wl_genl_ops[] = {
+       {
+       .cmd = BCM_GENL_CMD_MSG,
+       .flags = 0,
+       .policy = wl_genl_policy,
+       .doit = wl_genl_handle_msg,
+       .dumpit = NULL,
+       },
+};
+#else
+struct genl_ops wl_genl_ops = {
+       .cmd = BCM_GENL_CMD_MSG,
+       .flags = 0,
+       .policy = wl_genl_policy,
+       .doit = wl_genl_handle_msg,
+       .dumpit = NULL,
+
+};
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0))
+static struct genl_multicast_group wl_genl_mcast[] = {
+        { .name = "bcm-genl-mcast", },
+};
+#else
+static struct genl_multicast_group wl_genl_mcast = {
+       .id = GENL_ID_GENERATE,    /* Genetlink would generate the ID */
+       .name = "bcm-genl-mcast",
+};
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0) */
+#endif /* WL_GENL */
+
+#ifdef SUPPORT_LQCM
+#define LQCM_ENAB_MASK                 0x000000FF      /* LQCM enable flag mask */
+#define LQCM_TX_INDEX_MASK             0x0000FF00      /* LQCM tx index mask */
+#define LQCM_RX_INDEX_MASK             0x00FF0000      /* LQCM rx index mask */
+
+#define LQCM_TX_INDEX_SHIFT            8       /* LQCM tx index shift */
+#define LQCM_RX_INDEX_SHIFT            16      /* LQCM rx index shift */
+#endif /* SUPPORT_LQCM */
+
+#ifdef DHD_SEND_HANG_PRIVCMD_ERRORS
+#define NUMBER_SEQUENTIAL_PRIVCMD_ERRORS       7
+static int priv_cmd_errors = 0;
+#endif /* DHD_SEND_HANG_PRIVCMD_ERRORS */
+
+/**
+ * Extern function declarations (TODO: move them to dhd_linux.h)
+ */
+int dhd_net_bus_devreset(struct net_device *dev, uint8 flag);
+int dhd_dev_init_ioctl(struct net_device *dev);
+#ifdef WL_CFG80211
+int wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr);
+int wl_cfg80211_set_btcoex_dhcp(struct net_device *dev, dhd_pub_t *dhd, char *command);
+#ifdef WES_SUPPORT
+int wl_cfg80211_set_wes_mode(struct net_device *dev, int mode);
+int wl_cfg80211_get_wes_mode(struct net_device *dev);
+int wl_cfg80211_set_ncho_mode(struct net_device *dev, int mode);
+int wl_cfg80211_get_ncho_mode(struct net_device *dev);
+#endif /* WES_SUPPORT */
+#else
+int wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr)
+{ return 0; }
+int wl_cfg80211_set_p2p_noa(struct net_device *net, char* buf, int len)
+{ return 0; }
+int wl_cfg80211_get_p2p_noa(struct net_device *net, char* buf, int len)
+{ return 0; }
+int wl_cfg80211_set_p2p_ps(struct net_device *net, char* buf, int len)
+{ return 0; }
+int wl_cfg80211_set_p2p_ecsa(struct net_device *net, char* buf, int len)
+{ return 0; }
+int wl_cfg80211_increase_p2p_bw(struct net_device *net, char* buf, int len)
+{ return 0; }
+#endif /* WL_CFG80211 */
+#ifdef WBTEXT
+static int wl_android_wbtext(struct net_device *dev, char *command, int total_len);
+static int wl_cfg80211_wbtext_btm_timer_threshold(struct net_device *dev,
+       char *command, int total_len);
+static int wl_cfg80211_wbtext_btm_delta(struct net_device *dev,
+       char *command, int total_len);
+static int wl_cfg80211_wbtext_estm_enable(struct net_device *dev,
+       char *command, int total_len);
+static int wlc_wbtext_get_roam_prof(struct net_device *ndev, wl_roamprof_band_t *rp,
+       uint8 band, uint8 *roam_prof_ver, uint8 *roam_prof_size);
+static int wl_android_wbtext_enable(struct net_device *dev, int mode);
+#endif /* WBTEXT */
+#ifdef WES_SUPPORT
+/* wl_roam.c */
+extern int get_roamscan_mode(struct net_device *dev, int *mode);
+extern int set_roamscan_mode(struct net_device *dev, int mode);
+extern int get_roamscan_channel_list(struct net_device *dev,
+       unsigned char channels[], int n_channels);
+extern int set_roamscan_channel_list(struct net_device *dev, unsigned char n,
+       unsigned char channels[], int ioctl_ver);
+extern int add_roamscan_channel_list(struct net_device *dev, char *pcmd, int ioctl_ver);
+
+static char* legacy_cmdlist[] =
+{
+       CMD_GETROAMSCANCHLEGACY, CMD_ADDROAMSCANCHLEGACY,
+       CMD_GETROAMTRIGLEGACY, CMD_SETROAMTRIGLEGACY,
+       CMD_REASSOCLEGACY,
+       CMD_GETSCANCHANNELTIMELEGACY, CMD_SETSCANCHANNELTIMELEGACY,
+       CMD_GETSCANUNASSOCTIMELEGACY, CMD_SETSCANUNASSOCTIMELEGACY,
+       CMD_GETSCANPASSIVETIMELEGACY, CMD_SETSCANPASSIVETIMELEGACY,
+       CMD_GETSCANHOMETIMELEGACY, CMD_SETSCANHOMETIMELEGACY,
+       CMD_GETSCANHOMEAWAYTIMELEGACY, CMD_SETSCANHOMEAWAYTIMELEGACY,
+       "\0"
+};
+
+static char* ncho_cmdlist[] =
+{
+       CMD_ROAMTRIGGER_GET, CMD_ROAMTRIGGER_SET,
+       CMD_ROAMDELTA_GET, CMD_ROAMDELTA_SET,
+       CMD_ROAMSCANPERIOD_GET, CMD_ROAMSCANPERIOD_SET,
+       CMD_FULLROAMSCANPERIOD_GET, CMD_FULLROAMSCANPERIOD_SET,
+       CMD_COUNTRYREV_GET, CMD_COUNTRYREV_SET,
+       CMD_GETROAMSCANCONTROL, CMD_SETROAMSCANCONTROL, CMD_ADDROAMSCANCHANNELS,
+       CMD_GETROAMSCANCHANNELS, CMD_SETROAMSCANCHANNELS,
+       CMD_SENDACTIONFRAME,
+       CMD_REASSOC,
+       CMD_GETSCANCHANNELTIME, CMD_SETSCANCHANNELTIME,
+       CMD_GETSCANUNASSOCTIME, CMD_SETSCANUNASSOCTIME,
+       CMD_GETSCANPASSIVETIME, CMD_SETSCANPASSIVETIME,
+       CMD_GETSCANHOMETIME, CMD_SETSCANHOMETIME,
+       CMD_GETSCANHOMEAWAYTIME, CMD_SETSCANHOMEAWAYTIME,
+       CMD_GETSCANNPROBES, CMD_SETSCANNPROBES,
+       CMD_GETDFSSCANMODE, CMD_SETDFSSCANMODE,
+       CMD_SETJOINPREFER,
+       CMD_GETWESMODE, CMD_SETWESMODE,
+       "\0"
+};
+#endif /* WES_SUPPORT */
+#ifdef ROAM_CHANNEL_CACHE
+extern void wl_update_roamscan_cache_by_band(struct net_device *dev, int band);
+#endif /* ROAM_CHANNEL_CACHE */
+
+int wl_android_priority_roam_enable(struct net_device *dev, int mode);
+#ifdef CONFIG_SILENT_ROAM
+int wl_android_sroam_turn_on(struct net_device *dev, int mode);
+#endif /* CONFIG_SILENT_ROAM */
+int wl_android_rcroam_turn_on(struct net_device *dev, int mode);
+
+#ifdef ENABLE_4335BT_WAR
+extern int bcm_bt_lock(int cookie);
+extern void bcm_bt_unlock(int cookie);
+static int lock_cookie_wifi = 'W' | 'i'<<8 | 'F'<<16 | 'i'<<24;        /* cookie is "WiFi" */
+#endif /* ENABLE_4335BT_WAR */
+
+extern bool ap_fw_loaded;
+extern char iface_name[IFNAMSIZ];
+#ifdef DHD_PM_CONTROL_FROM_FILE
+extern bool g_pm_control;
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+
+/* private command support for restoring roam/scan parameters */
+#if defined(SUPPORT_RESTORE_SCAN_PARAMS) || defined(WES_SUPPORT)
+#define CMD_RESTORE_SCAN_PARAMS "RESTORE_SCAN_PARAMS"
+
+typedef int (*PRIV_CMD_HANDLER) (struct net_device *dev, char *command);
+typedef int (*PRIV_CMD_HANDLER_WITH_LEN) (struct net_device *dev, char *command, int total_len);
+
+enum {
+       RESTORE_TYPE_UNSPECIFIED = 0,
+       RESTORE_TYPE_PRIV_CMD = 1,
+       RESTORE_TYPE_PRIV_CMD_WITH_LEN = 2
+};
+
+typedef struct android_restore_scan_params {
+       char command[64];
+       int parameter;
+       int cmd_type;
+       union {
+               PRIV_CMD_HANDLER cmd_handler;
+               PRIV_CMD_HANDLER_WITH_LEN cmd_handler_w_len;
+       };
+} android_restore_scan_params_t;
+
+/* function prototypes of private command handler */
+static int wl_android_default_set_scan_params(struct net_device *dev, char *command, int total_len);
+static int wl_android_set_roam_trigger(struct net_device *dev, char* command);
+int wl_android_set_roam_delta(struct net_device *dev, char* command);
+int wl_android_set_roam_scan_period(struct net_device *dev, char* command);
+int wl_android_set_full_roam_scan_period(struct net_device *dev, char* command);
+int wl_android_set_roam_scan_control(struct net_device *dev, char *command);
+int wl_android_set_scan_channel_time(struct net_device *dev, char *command);
+int wl_android_set_scan_home_time(struct net_device *dev, char *command);
+int wl_android_set_scan_home_away_time(struct net_device *dev, char *command);
+int wl_android_set_scan_nprobes(struct net_device *dev, char *command);
+static int wl_android_set_band(struct net_device *dev, char *command);
+int wl_android_set_scan_dfs_channel_mode(struct net_device *dev, char *command);
+int wl_android_set_wes_mode(struct net_device *dev, char *command);
+int wl_android_set_okc_mode(struct net_device *dev, char *command);
+
+/* default values */
+#ifdef ROAM_API
+#define DEFAULT_ROAM_TIRGGER   -75
+#define DEFAULT_ROAM_DELTA     10
+#define DEFAULT_ROAMSCANPERIOD 10
+#define DEFAULT_FULLROAMSCANPERIOD_SET 120
+#endif /* ROAM_API */
+#ifdef WES_SUPPORT
+#define DEFAULT_ROAMSCANCONTROL        0
+#define DEFAULT_SCANCHANNELTIME        40
+#ifdef BCM4361_CHIP
+#define DEFAULT_SCANHOMETIME   60
+#else
+#define DEFAULT_SCANHOMETIME   45
+#endif /* BCM4361_CHIP */
+#define DEFAULT_SCANHOMEAWAYTIME       100
+#define DEFAULT_SCANPROBES     2
+#define DEFAULT_DFSSCANMODE    1
+#define DEFAULT_WESMODE                0
+#define DEFAULT_OKCMODE                1
+#endif /* WES_SUPPORT */
+#define DEFAULT_BAND           0
+#ifdef WBTEXT
+#define DEFAULT_WBTEXT_ENABLE  1
+#endif /* WBTEXT */
+
+/* restoring parameter list, please don't change order */
+static android_restore_scan_params_t restore_params[] =
+{
+/* wbtext need to be disabled while updating roam/scan parameters */
+#ifdef WBTEXT
+       { CMD_WBTEXT_ENABLE, 0, RESTORE_TYPE_PRIV_CMD_WITH_LEN,
+               .cmd_handler_w_len = wl_android_wbtext},
+#endif /* WBTEXT */
+#ifdef ROAM_API
+       { CMD_ROAMTRIGGER_SET, DEFAULT_ROAM_TIRGGER,
+               RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_roam_trigger},
+       { CMD_ROAMDELTA_SET, DEFAULT_ROAM_DELTA,
+               RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_roam_delta},
+       { CMD_ROAMSCANPERIOD_SET, DEFAULT_ROAMSCANPERIOD,
+               RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_roam_scan_period},
+       { CMD_FULLROAMSCANPERIOD_SET, DEFAULT_FULLROAMSCANPERIOD_SET,
+               RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_full_roam_scan_period},
+#endif /* ROAM_API */
+#ifdef WES_SUPPORT
+       { CMD_SETROAMSCANCONTROL, DEFAULT_ROAMSCANCONTROL,
+               RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_roam_scan_control},
+       { CMD_SETSCANCHANNELTIME, DEFAULT_SCANCHANNELTIME,
+               RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_scan_channel_time},
+       { CMD_SETSCANHOMETIME, DEFAULT_SCANHOMETIME,
+               RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_scan_home_time},
+       { CMD_GETSCANHOMEAWAYTIME, DEFAULT_SCANHOMEAWAYTIME,
+               RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_scan_home_away_time},
+       { CMD_SETSCANNPROBES, DEFAULT_SCANPROBES,
+               RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_scan_nprobes},
+       { CMD_SETDFSSCANMODE, DEFAULT_DFSSCANMODE,
+               RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_scan_dfs_channel_mode},
+       { CMD_SETWESMODE, DEFAULT_WESMODE,
+               RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_wes_mode},
+#endif /* WES_SUPPORT */
+       { CMD_SETBAND, DEFAULT_BAND,
+               RESTORE_TYPE_PRIV_CMD, .cmd_handler = wl_android_set_band},
+#ifdef WBTEXT
+       { CMD_WBTEXT_ENABLE, DEFAULT_WBTEXT_ENABLE,
+               RESTORE_TYPE_PRIV_CMD_WITH_LEN, .cmd_handler_w_len = wl_android_wbtext},
+#endif /* WBTEXT */
+       { "\0", 0, RESTORE_TYPE_UNSPECIFIED, .cmd_handler = NULL}
+};
+#endif /* SUPPORT_RESTORE_SCAN_PARAMS || WES_SUPPORT */
+
+#ifdef SUPPORT_LATENCY_CRITICAL_DATA
+#define CMD_GET_LATENCY_CRITICAL_DATA  "GET_LATENCY_CRT_DATA"
+#define CMD_SET_LATENCY_CRITICAL_DATA  "SET_LATENCY_CRT_DATA"
+#endif /* SUPPORT_LATENCY_CRITICAL_DATA */
+
+typedef struct android_priv_cmd_log_cfg_table {
+       char command[64];
+       int  enable;
+} android_priv_cmd_log_cfg_table_t;
+
+static android_priv_cmd_log_cfg_table_t loging_params[] = {
+       {CMD_GET_SNR, FALSE},
+#ifdef SUPPORT_LQCM
+       {CMD_GET_LQCM_REPORT, FALSE},
+#endif
+#ifdef WL_GET_CU
+       {CMD_GET_CHAN_UTIL, FALSE},
+#endif
+       {"\0", FALSE}
+};
+
+/**
+ * Local (static) functions and variables
+ */
+
+/* Initialize g_wifi_on to 1 so dhd_bus_start will be called for the first
+ * time (only) in dhd_open, subsequential wifi on will be handled by
+ * wl_android_wifi_on
+ */
+int g_wifi_on = TRUE;
+
+/**
+ * Local (static) function definitions
+ */
+
+static char* wl_android_get_band_str(u16 band)
+{
+       switch (band) {
+#ifdef WL_6G_BAND
+               case WLC_BAND_6G:
+                       return "6G";
+#endif /* WL_6G_BAND */
+               case WLC_BAND_5G:
+                       return "5G";
+               case WLC_BAND_2G:
+                       return "2G";
+               default:
+                       ANDROID_ERROR(("Unkown band: %d \n", band));
+                       return "Unknown band";
+       }
+}
+
+#ifdef WBTEXT
+static int wl_android_bandstr_to_fwband(char *band, u8 *fw_band)
+{
+       int err = BCME_OK;
+
+       if (!strcasecmp(band, "a")) {
+               *fw_band = WLC_BAND_5G;
+       } else if (!strcasecmp(band, "b")) {
+               *fw_band = WLC_BAND_2G;
+#ifdef WL_6G_BAND
+       } else if (!strcasecmp(band, "6g")) {
+               *fw_band = WLC_BAND_6G;
+#endif /* WL_6G_BAND */
+       } else if (!strcasecmp(band, "all")) {
+               *fw_band = WLC_BAND_ALL;
+       } else {
+               err = BCME_BADBAND;
+       }
+
+       return err;
+}
+#endif /* WBTEXT */
+
+#ifdef WLWFDS
+static int wl_android_set_wfds_hash(
+       struct net_device *dev, char *command, bool enable)
+{
+       int error = 0;
+       wl_p2p_wfds_hash_t *wfds_hash = NULL;
+       char *smbuf = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       smbuf = (char *)MALLOC(cfg->osh, WLC_IOCTL_MAXLEN);
+       if (smbuf == NULL) {
+               ANDROID_ERROR(("wl_android_set_wfds_hash: failed to allocated memory %d bytes\n",
+                       WLC_IOCTL_MAXLEN));
+               return -ENOMEM;
+       }
+
+       if (enable) {
+               wfds_hash = (wl_p2p_wfds_hash_t *)(command + strlen(CMD_ADD_WFDS_HASH) + 1);
+               error = wldev_iovar_setbuf(dev, "p2p_add_wfds_hash", wfds_hash,
+                       sizeof(wl_p2p_wfds_hash_t), smbuf, WLC_IOCTL_MAXLEN, NULL);
+       }
+       else {
+               wfds_hash = (wl_p2p_wfds_hash_t *)(command + strlen(CMD_DEL_WFDS_HASH) + 1);
+               error = wldev_iovar_setbuf(dev, "p2p_del_wfds_hash", wfds_hash,
+                       sizeof(wl_p2p_wfds_hash_t), smbuf, WLC_IOCTL_MAXLEN, NULL);
+       }
+
+       if (error) {
+               ANDROID_ERROR(("wl_android_set_wfds_hash: failed to %s, error=%d\n", command, error));
+       }
+
+       if (smbuf) {
+               MFREE(cfg->osh, smbuf, WLC_IOCTL_MAXLEN);
+       }
+       return error;
+}
+#endif /* WLWFDS */
+
+static int wl_android_get_link_speed(struct net_device *net, char *command, int total_len)
+{
+       int link_speed;
+       int bytes_written;
+       int error;
+
+       error = wldev_get_link_speed(net, &link_speed);
+       if (error) {
+               ANDROID_ERROR(("Get linkspeed failed \n"));
+               return -1;
+       }
+
+       /* Convert Kbps to Android Mbps */
+       link_speed = link_speed / 1000;
+       bytes_written = snprintf(command, total_len, "LinkSpeed %d", link_speed);
+       ANDROID_INFO(("wl_android_get_link_speed: command result is %s\n", command));
+       return bytes_written;
+}
+
+static int wl_android_get_rssi(struct net_device *net, char *command, int total_len)
+{
+       wlc_ssid_t ssid = {0, {0}};
+       int bytes_written = 0;
+       int error = 0;
+       scb_val_t scbval;
+       char *delim = NULL;
+       struct net_device *target_ndev = net;
+#ifdef WL_VIRTUAL_APSTA
+       char *pos = NULL;
+       struct bcm_cfg80211 *cfg;
+#endif /* WL_VIRTUAL_APSTA */
+
+       delim = strchr(command, ' ');
+       /* For Ap mode rssi command would be
+        * driver rssi <sta_mac_addr>
+        * for STA/GC mode
+        * driver rssi
+       */
+       if (delim) {
+               /* Ap/GO mode
+               * driver rssi <sta_mac_addr>
+               */
+               ANDROID_TRACE(("wl_android_get_rssi: cmd:%s\n", delim));
+               /* skip space from delim after finding char */
+               delim++;
+               if (!(bcm_ether_atoe((delim), &scbval.ea))) {
+                       ANDROID_ERROR(("wl_android_get_rssi: address err\n"));
+                       return -1;
+               }
+               scbval.val = htod32(0);
+               ANDROID_TRACE(("wl_android_get_rssi: address:"MACDBG, MAC2STRDBG(scbval.ea.octet)));
+#ifdef WL_VIRTUAL_APSTA
+               /* RSDB AP may have another virtual interface
+                * In this case, format of private command is as following,
+                * DRIVER rssi <sta_mac_addr> <AP interface name>
+                */
+
+               /* Current position is start of MAC address string */
+               pos = delim;
+               delim = strchr(pos, ' ');
+               if (delim) {
+                       /* skip space from delim after finding char */
+                       delim++;
+                       if (strnlen(delim, IFNAMSIZ)) {
+                               cfg = wl_get_cfg(net);
+                               target_ndev = wl_get_ap_netdev(cfg, delim);
+                               if (target_ndev == NULL)
+                                       target_ndev = net;
+                       }
+               }
+#endif /* WL_VIRTUAL_APSTA */
+       }
+       else {
+               /* STA/GC mode */
+               bzero(&scbval, sizeof(scb_val_t));
+       }
+
+       error = wldev_get_rssi(target_ndev, &scbval);
+       if (error)
+               return -1;
+#if defined(RSSIOFFSET)
+       scbval.val = wl_update_rssi_offset(net, scbval.val);
+#endif
+
+       error = wldev_get_ssid(target_ndev, &ssid);
+       if (error)
+               return -1;
+       if ((ssid.SSID_len == 0) || (ssid.SSID_len > DOT11_MAX_SSID_LEN)) {
+               ANDROID_ERROR(("wl_android_get_rssi: wldev_get_ssid failed\n"));
+       } else if (total_len <= ssid.SSID_len) {
+               return -ENOMEM;
+       } else {
+               memcpy(command, ssid.SSID, ssid.SSID_len);
+               bytes_written = ssid.SSID_len;
+       }
+       if ((total_len - bytes_written) < (strlen(" rssi -XXX") + 1))
+               return -ENOMEM;
+
+       bytes_written += scnprintf(&command[bytes_written], total_len - bytes_written,
+               " rssi %d", scbval.val);
+       command[bytes_written] = '\0';
+
+       ANDROID_TRACE(("wl_android_get_rssi: command result is %s (%d)\n", command, bytes_written));
+       return bytes_written;
+}
+
+static int wl_android_set_suspendopt(struct net_device *dev, char *command)
+{
+       int suspend_flag;
+       int ret_now;
+       int ret = 0;
+
+       suspend_flag = *(command + strlen(CMD_SETSUSPENDOPT) + 1) - '0';
+
+       if (suspend_flag != 0) {
+               suspend_flag = 1;
+       }
+       ret_now = net_os_set_suspend_disable(dev, suspend_flag);
+
+       if (ret_now != suspend_flag) {
+               if (!(ret = net_os_set_suspend(dev, ret_now, 1))) {
+                       ANDROID_INFO(("wl_android_set_suspendopt: Suspend Flag %d -> %d\n",
+                               ret_now, suspend_flag));
+               } else {
+                       ANDROID_ERROR(("wl_android_set_suspendopt: failed %d\n", ret));
+               }
+       }
+
+       return ret;
+}
+
+static int wl_android_set_suspendmode(struct net_device *dev, char *command)
+{
+       int ret = 0;
+
+#if !defined(CONFIG_HAS_EARLYSUSPEND) || !defined(DHD_USE_EARLYSUSPEND)
+       int suspend_flag;
+
+       suspend_flag = *(command + strlen(CMD_SETSUSPENDMODE) + 1) - '0';
+       if (suspend_flag != 0)
+               suspend_flag = 1;
+
+       if (!(ret = net_os_set_suspend(dev, suspend_flag, 0)))
+               ANDROID_INFO(("wl_android_set_suspendmode: Suspend Mode %d\n", suspend_flag));
+       else
+               ANDROID_ERROR(("wl_android_set_suspendmode: failed %d\n", ret));
+#endif
+
+       return ret;
+}
+
+#ifdef WL_CFG80211
+int wl_android_get_80211_mode(struct net_device *dev, char *command, int total_len)
+{
+       uint8 mode[5];
+       int  error = 0;
+       int bytes_written = 0;
+
+       error = wldev_get_mode(dev, mode, sizeof(mode));
+       if (error)
+               return -1;
+
+       ANDROID_INFO(("wl_android_get_80211_mode: mode:%s\n", mode));
+       bytes_written = snprintf(command, total_len, "%s %s", CMD_80211_MODE, mode);
+       ANDROID_INFO(("wl_android_get_80211_mode: command:%s EXIT\n", command));
+       return bytes_written;
+
+}
+
+extern chanspec_t
+wl_chspec_driver_to_host(chanspec_t chanspec);
+int wl_android_get_chanspec(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       int bytes_written = 0;
+       int chsp = {0};
+       uint16 band = 0;
+       uint16 bw = 0;
+       uint16 channel = 0;
+       u32 sb = 0;
+       chanspec_t chanspec;
+
+       /* command is
+        * driver chanspec
+        */
+       error = wldev_iovar_getint(dev, "chanspec", &chsp);
+       if (error)
+               return -1;
+
+       chanspec = wl_chspec_driver_to_host(chsp);
+       ANDROID_INFO(("wl_android_get_80211_mode: return value of chanspec:%x\n", chanspec));
+
+       channel = chanspec & WL_CHANSPEC_CHAN_MASK;
+       band = chanspec & WL_CHANSPEC_BAND_MASK;
+       bw = chanspec & WL_CHANSPEC_BW_MASK;
+
+       ANDROID_INFO(("wl_android_get_80211_mode: channel:%d band:%d bandwidth:%d\n",
+               channel, band, bw));
+
+       if (bw == WL_CHANSPEC_BW_160) {
+               bw = WL_CH_BANDWIDTH_160MHZ;
+       } else if (bw == WL_CHANSPEC_BW_80) {
+               bw = WL_CH_BANDWIDTH_80MHZ;
+       } else if (bw == WL_CHANSPEC_BW_40) {
+               bw = WL_CH_BANDWIDTH_40MHZ;
+       } else if (bw == WL_CHANSPEC_BW_20) {
+               bw = WL_CH_BANDWIDTH_20MHZ;
+       } else {
+               bw = WL_CH_BANDWIDTH_20MHZ;
+       }
+
+       if (bw == WL_CH_BANDWIDTH_40MHZ) {
+               if (CHSPEC_SB_UPPER(chanspec)) {
+                       channel += CH_10MHZ_APART;
+               } else {
+                       channel -= CH_10MHZ_APART;
+               }
+       }
+       else if (bw == WL_CH_BANDWIDTH_80MHZ) {
+               sb = chanspec & WL_CHANSPEC_CTL_SB_MASK;
+               if (sb == WL_CHANSPEC_CTL_SB_LL) {
+                       channel -= (CH_10MHZ_APART + CH_20MHZ_APART);
+               } else if (sb == WL_CHANSPEC_CTL_SB_LU) {
+                       channel -= CH_10MHZ_APART;
+               } else if (sb == WL_CHANSPEC_CTL_SB_UL) {
+                       channel += CH_10MHZ_APART;
+               } else {
+                       /* WL_CHANSPEC_CTL_SB_UU */
+                       channel += (CH_10MHZ_APART + CH_20MHZ_APART);
+               }
+       } else if (bw == WL_CH_BANDWIDTH_160MHZ) {
+               channel = wf_chspec_primary20_chan(chanspec);
+       }
+       bytes_written = snprintf(command, total_len, "%s channel %d band %s bw %d", CMD_CHANSPEC,
+               channel, wl_android_get_band_str(CHSPEC2WLC_BAND(chanspec)), bw);
+
+       ANDROID_INFO(("wl_android_get_chanspec: command:%s EXIT\n", command));
+       return bytes_written;
+
+}
+#endif /* WL_CFG80211 */
+
+/* returns current datarate datarate returned from firmware are in 500kbps */
+int wl_android_get_datarate(struct net_device *dev, char *command, int total_len)
+{
+       int  error = 0;
+       int datarate = 0;
+       int bytes_written = 0;
+
+       error = wldev_get_datarate(dev, &datarate);
+       if (error)
+               return -1;
+
+       ANDROID_INFO(("wl_android_get_datarate: datarate:%d\n", datarate));
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_DATARATE, (datarate/2));
+       return bytes_written;
+}
+int wl_android_get_assoclist(struct net_device *dev, char *command, int total_len)
+{
+       int  error = 0;
+       int bytes_written = 0;
+       uint i;
+       int len = 0;
+       char mac_buf[MAX_NUM_OF_ASSOCLIST *
+               sizeof(struct ether_addr) + sizeof(uint)] = {0};
+       struct maclist *assoc_maclist = (struct maclist *)mac_buf;
+
+       ANDROID_TRACE(("wl_android_get_assoclist: ENTER\n"));
+
+       assoc_maclist->count = htod32(MAX_NUM_OF_ASSOCLIST);
+
+       error = wldev_ioctl_get(dev, WLC_GET_ASSOCLIST, assoc_maclist, sizeof(mac_buf));
+       if (error)
+               return -1;
+
+       assoc_maclist->count = dtoh32(assoc_maclist->count);
+       bytes_written = snprintf(command, total_len, "%s listcount: %d Stations:",
+               CMD_ASSOC_CLIENTS, assoc_maclist->count);
+
+       for (i = 0; i < assoc_maclist->count; i++) {
+               len = snprintf(command + bytes_written, total_len - bytes_written, " " MACDBG,
+                       MAC2STRDBG(assoc_maclist->ea[i].octet));
+               /* A return value of '(total_len - bytes_written)' or more means that the
+                * output was truncated
+                */
+               if ((len > 0) && (len < (total_len - bytes_written))) {
+                       bytes_written += len;
+               } else {
+                       ANDROID_ERROR(("wl_android_get_assoclist: Insufficient buffer %d,"
+                               " bytes_written %d\n",
+                               total_len, bytes_written));
+                       bytes_written = -1;
+                       break;
+               }
+       }
+       return bytes_written;
+}
+
+#ifdef WL_CFG80211
+extern chanspec_t
+wl_chspec_host_to_driver(chanspec_t chanspec);
+static int wl_android_set_csa(struct net_device *dev, char *command)
+{
+       int error = 0;
+       char smbuf[WLC_IOCTL_SMLEN];
+       wl_chan_switch_t csa_arg;
+       u32 chnsp = 0;
+       int err = 0;
+
+       ANDROID_INFO(("wl_android_set_csa: command:%s\n", command));
+
+       command = (command + strlen(CMD_SET_CSA));
+       /* Order is mode, count channel */
+       if (!*++command) {
+               ANDROID_ERROR(("wl_android_set_csa:error missing arguments\n"));
+               return -1;
+       }
+       csa_arg.mode = bcm_atoi(command);
+
+       if (csa_arg.mode != 0 && csa_arg.mode != 1) {
+               ANDROID_ERROR(("Invalid mode\n"));
+               return -1;
+       }
+
+       if (!*++command) {
+               ANDROID_ERROR(("wl_android_set_csa: error missing count\n"));
+               return -1;
+       }
+       command++;
+       csa_arg.count = bcm_atoi(command);
+
+       csa_arg.reg = 0;
+       csa_arg.chspec = 0;
+       command += 2;
+       if (!*command) {
+               ANDROID_ERROR(("wl_android_set_csa: error missing channel\n"));
+               return -1;
+       }
+
+       chnsp = wf_chspec_aton(command);
+       if (chnsp == 0) {
+               ANDROID_ERROR(("wl_android_set_csa:chsp is not correct\n"));
+               return -1;
+       }
+       chnsp = wl_chspec_host_to_driver(chnsp);
+       csa_arg.chspec = chnsp;
+
+       if (chnsp & WL_CHANSPEC_BAND_5G) {
+               u32 chanspec = chnsp;
+               err = wldev_iovar_getint(dev, "per_chan_info", &chanspec);
+               if (!err) {
+                       if ((chanspec & WL_CHAN_RADAR) || (chanspec & WL_CHAN_PASSIVE)) {
+                               ANDROID_ERROR(("Channel is radar sensitive\n"));
+                               return -1;
+                       }
+                       if (chanspec == 0) {
+                               ANDROID_ERROR(("Invalid hw channel\n"));
+                               return -1;
+                       }
+               } else  {
+                       ANDROID_ERROR(("does not support per_chan_info\n"));
+                       return -1;
+               }
+               ANDROID_INFO(("non radar sensitivity\n"));
+       }
+       error = wldev_iovar_setbuf(dev, "csa", &csa_arg, sizeof(csa_arg),
+               smbuf, sizeof(smbuf), NULL);
+       if (error) {
+               ANDROID_ERROR(("wl_android_set_csa:set csa failed:%d\n", error));
+               return -1;
+       }
+       return 0;
+}
+#endif /* WL_CFG80211 */
+
+static int
+wl_android_set_bcn_li_dtim(struct net_device *dev, char *command)
+{
+       int ret = 0;
+       int dtim;
+
+       dtim = *(command + strlen(CMD_SETDTIM_IN_SUSPEND) + 1) - '0';
+
+       if (dtim > (MAX_DTIM_ALLOWED_INTERVAL / MAX_DTIM_SKIP_BEACON_INTERVAL)) {
+               ANDROID_ERROR(("%s: failed, invalid dtim %d\n",
+                       __FUNCTION__, dtim));
+               return BCME_ERROR;
+       }
+
+       if (!(ret = net_os_set_suspend_bcn_li_dtim(dev, dtim))) {
+               ANDROID_TRACE(("%s: SET bcn_li_dtim in suspend %d\n",
+                       __FUNCTION__, dtim));
+       } else {
+               ANDROID_ERROR(("%s: failed %d\n", __FUNCTION__, ret));
+       }
+
+       return ret;
+}
+
+static int
+wl_android_set_max_dtim(struct net_device *dev, char *command)
+{
+       int ret = 0;
+       int dtim_flag;
+
+       dtim_flag = *(command + strlen(CMD_MAXDTIM_IN_SUSPEND) + 1) - '0';
+
+       if (!(ret = net_os_set_max_dtim_enable(dev, dtim_flag))) {
+               ANDROID_TRACE(("wl_android_set_max_dtim: use Max bcn_li_dtim in suspend %s\n",
+                       (dtim_flag ? "Enable" : "Disable")));
+       } else {
+               ANDROID_ERROR(("wl_android_set_max_dtim: failed %d\n", ret));
+       }
+
+       return ret;
+}
+
+#ifdef DISABLE_DTIM_IN_SUSPEND
+static int
+wl_android_set_disable_dtim_in_suspend(struct net_device *dev, char *command)
+{
+       int ret = 0;
+       int dtim_flag;
+
+       dtim_flag = *(command + strlen(CMD_DISDTIM_IN_SUSPEND) + 1) - '0';
+
+       if (!(ret = net_os_set_disable_dtim_in_suspend(dev, dtim_flag))) {
+               ANDROID_TRACE(("wl_android_set_disable_dtim_in_suspend: "
+                       "use Disable bcn_li_dtim in suspend %s\n",
+                       (dtim_flag ? "Enable" : "Disable")));
+       } else {
+               ANDROID_ERROR(("wl_android_set_disable_dtim_in_suspend: failed %d\n", ret));
+       }
+
+       return ret;
+}
+#endif /* DISABLE_DTIM_IN_SUSPEND */
+
+static int wl_android_get_band(struct net_device *dev, char *command, int total_len)
+{
+       uint band;
+       int bytes_written;
+       int error = BCME_OK;
+
+       error = wldev_iovar_getint(dev, "if_band", &band);
+       if (error == BCME_UNSUPPORTED) {
+               error = wldev_get_band(dev, &band);
+               if (error) {
+                       return error;
+               }
+       }
+       bytes_written = snprintf(command, total_len, "Band %d", band);
+       return bytes_written;
+}
+
+#ifdef WL_CFG80211
+static int
+wl_android_set_band(struct net_device *dev, char *command)
+{
+       int error = 0;
+       uint band = *(command + strlen(CMD_SETBAND) + 1) - '0';
+#ifdef WL_HOST_BAND_MGMT
+       int ret = 0;
+       if ((ret = wl_cfg80211_set_band(dev, band)) < 0) {
+               if (ret == BCME_UNSUPPORTED) {
+                       /* If roam_var is unsupported, fallback to the original method */
+                       ANDROID_ERROR(("WL_HOST_BAND_MGMT defined, "
+                               "but roam_band iovar unsupported in the firmware\n"));
+               } else {
+                       error = -1;
+               }
+       }
+       if (((ret == 0) && (band == WLC_BAND_AUTO)) || (ret == BCME_UNSUPPORTED)) {
+               /* Apply if roam_band iovar is not supported or band setting is AUTO */
+               error = wldev_set_band(dev, band);
+       }
+#else
+       error = wl_cfg80211_set_if_band(dev, band);
+#endif /* WL_HOST_BAND_MGMT */
+#ifdef ROAM_CHANNEL_CACHE
+       wl_update_roamscan_cache_by_band(dev, band);
+#endif /* ROAM_CHANNEL_CACHE */
+       return error;
+}
+#endif /* WL_CFG80211 */
+
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+#ifdef ROAM_API
+#ifdef WBTEXT
+static bool wl_android_check_wbtext_support(struct net_device *dev)
+{
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       return dhdp->wbtext_support;
+}
+#endif /* WBTEXT */
+
+static bool
+wl_android_check_wbtext_policy(struct net_device *dev)
+{
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       if (dhdp->wbtext_policy == WL_BSSTRANS_POLICY_PRODUCT_WBTEXT) {
+               return TRUE;
+       }
+
+       return FALSE;
+}
+
+static int
+wl_android_set_roam_trigger(struct net_device *dev, char* command)
+{
+       int roam_trigger[2] = {0, 0};
+       int error;
+
+#ifdef WBTEXT
+       if (wl_android_check_wbtext_policy(dev)) {
+               ANDROID_ERROR(("blocked to set roam trigger. try with setting roam profile\n"));
+               return BCME_ERROR;
+       }
+#endif /* WBTEXT */
+
+       sscanf(command, "%*s %10d", &roam_trigger[0]);
+       if (roam_trigger[0] >= 0) {
+               ANDROID_ERROR(("wrong roam trigger value (%d)\n", roam_trigger[0]));
+               return BCME_ERROR;
+       }
+
+       roam_trigger[1] = WLC_BAND_ALL;
+       error = wldev_ioctl_set(dev, WLC_SET_ROAM_TRIGGER, roam_trigger,
+               sizeof(roam_trigger));
+       if (error != BCME_OK) {
+               ANDROID_ERROR(("failed to set roam trigger (%d)\n", error));
+               return BCME_ERROR;
+       }
+
+       return BCME_OK;
+}
+
+static int
+wl_android_get_roam_trigger(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written, error;
+       int roam_trigger[2] = {0, 0};
+       uint16 band = 0;
+       int chsp = {0};
+       chanspec_t chanspec;
+#ifdef WBTEXT
+       int i;
+       wl_roamprof_band_t rp;
+       uint8 roam_prof_ver = 0, roam_prof_size = 0;
+#endif /* WBTEXT */
+
+       error = wldev_iovar_getint(dev, "chanspec", &chsp);
+       if (error != BCME_OK) {
+               ANDROID_ERROR(("failed to get chanspec (%d)\n", error));
+               return BCME_ERROR;
+       }
+
+       chanspec = wl_chspec_driver_to_host(chsp);
+       band = CHSPEC2WLC_BAND(chanspec);
+
+       if (wl_android_check_wbtext_policy(dev)) {
+#ifdef WBTEXT
+               memset_s(&rp, sizeof(rp), 0, sizeof(rp));
+               if ((error = wlc_wbtext_get_roam_prof(dev, &rp, band, &roam_prof_ver,
+                       &roam_prof_size))) {
+                       ANDROID_ERROR(("Getting roam_profile failed with err=%d \n", error));
+                       return -EINVAL;
+               }
+               switch (roam_prof_ver) {
+                       case WL_ROAM_PROF_VER_1:
+                       {
+                               for (i = 0; i < WL_MAX_ROAM_PROF_BRACKETS; i++) {
+                                       if (rp.v2.roam_prof[i].channel_usage == 0) {
+                                               roam_trigger[0] = rp.v2.roam_prof[i].roam_trigger;
+                                               break;
+                                       }
+                               }
+                       }
+                       break;
+                       case WL_ROAM_PROF_VER_2:
+                       {
+                               for (i = 0; i < WL_MAX_ROAM_PROF_BRACKETS; i++) {
+                                       if (rp.v3.roam_prof[i].channel_usage == 0) {
+                                               roam_trigger[0] = rp.v3.roam_prof[i].roam_trigger;
+                                               break;
+                                       }
+                               }
+                       }
+                       break;
+                       case WL_ROAM_PROF_VER_3:
+                       {
+                               for (i = 0; i < WL_MAX_ROAM_PROF_BRACKETS; i++) {
+                                       if (rp.v4.roam_prof[i].channel_usage == 0) {
+                                               roam_trigger[0] = rp.v4.roam_prof[i].roam_trigger;
+                                               break;
+                                       }
+                               }
+                       }
+                       break;
+                       default:
+                               ANDROID_ERROR(("bad version = %d \n", roam_prof_ver));
+                               return BCME_VERSION;
+               }
+#endif /* WBTEXT */
+               if (roam_trigger[0] == 0) {
+                       ANDROID_ERROR(("roam trigger was not set properly\n"));
+                       return BCME_ERROR;
+               }
+       } else {
+               roam_trigger[1] = band;
+               error = wldev_ioctl_get(dev, WLC_GET_ROAM_TRIGGER, roam_trigger,
+                       sizeof(roam_trigger));
+               if (error != BCME_OK) {
+                       ANDROID_ERROR(("failed to get roam trigger (%d)\n", error));
+                       return BCME_ERROR;
+               }
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d",
+               CMD_ROAMTRIGGER_GET, roam_trigger[0]);
+
+       return bytes_written;
+}
+
+#ifdef WBTEXT
+s32
+wl_cfg80211_wbtext_roam_trigger_config(struct net_device *ndev, int roam_trigger)
+{
+       char *commandp = NULL;
+       s32 ret = BCME_OK;
+       char *data;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       uint8 bandidx = 0;
+
+       commandp = (char *)MALLOCZ(cfg->osh, WLC_IOCTL_SMLEN);
+       if (unlikely(!commandp)) {
+               ANDROID_ERROR(("%s: failed to allocate memory\n", __func__));
+               ret =  -ENOMEM;
+               goto exit;
+       }
+
+       ANDROID_INFO(("roam trigger %d\n", roam_trigger));
+       if (roam_trigger > 0) {
+               ANDROID_ERROR(("Invalid roam trigger value %d\n", roam_trigger));
+               goto exit;
+       }
+
+       for (bandidx = 0; bandidx < MAXBANDS; bandidx++) {
+               char *band;
+               int tri0, tri1, low0, low1, cu0, cu1, dur0, dur1;
+               int tri0_dflt;
+               if (bandidx == BAND_5G_INDEX) {
+                       band = "a";
+                       tri0_dflt = DEFAULT_WBTEXT_CU_RSSI_TRIG_A;
+               } else {
+                       band = "b";
+                       tri0_dflt = DEFAULT_WBTEXT_CU_RSSI_TRIG_B;
+               }
+
+               /* Get ROAM Profile
+                * WBTEXT_PROFILE_CONFIG band
+                */
+               bzero(commandp, WLC_IOCTL_SMLEN);
+               snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s",
+                       CMD_WBTEXT_PROFILE_CONFIG, band);
+               data = (commandp + strlen(CMD_WBTEXT_PROFILE_CONFIG) + 1);
+               wl_cfg80211_wbtext_config(ndev, data, commandp, WLC_IOCTL_SMLEN);
+
+               /* Set ROAM Profile
+                * WBTEXT_PROFILE_CONFIG band -70 roam_trigger 70 10 roam_trigger -128 0 10
+                */
+               sscanf(commandp, "RSSI[%d,%d] CU(trigger:%d%%: duration:%ds)"
+                       "RSSI[%d,%d] CU(trigger:%d%%: duration:%ds)",
+                       &tri0, &low0, &cu0, &dur0, &tri1, &low1, &cu1, &dur1);
+
+               if (tri0_dflt <= roam_trigger) {
+                       tri0 = roam_trigger + 1;
+               } else {
+                       tri0 = tri0_dflt;
+               }
+
+               memset_s(commandp, WLC_IOCTL_SMLEN, 0, WLC_IOCTL_SMLEN);
+               snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s %d %d %d %d %d %d %d %d",
+                       CMD_WBTEXT_PROFILE_CONFIG, band,
+                       tri0, roam_trigger, cu0, dur0, roam_trigger, low1, cu1, dur1);
+
+               ret = wl_cfg80211_wbtext_config(ndev, data, commandp, WLC_IOCTL_SMLEN);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("Failed to set roam_prof %s error = %d\n", data, ret));
+                       goto exit;
+               }
+       }
+
+exit:
+       if (commandp) {
+               MFREE(cfg->osh, commandp, WLC_IOCTL_SMLEN);
+       }
+       return ret;
+}
+#endif /* WBTEXT */
+
+static int
+wl_android_set_roam_trigger_legacy(struct net_device *dev, char* command)
+{
+       int roam_trigger[2] = {0, 0};
+       int error;
+
+       sscanf(command, "%*s %10d", &roam_trigger[0]);
+       if (roam_trigger[0] >= 0) {
+               ANDROID_ERROR(("wrong roam trigger value (%d)\n", roam_trigger[0]));
+               return BCME_ERROR;
+       }
+
+       if (wl_android_check_wbtext_policy(dev)) {
+#ifdef WBTEXT
+               error = wl_cfg80211_wbtext_roam_trigger_config(dev, roam_trigger[0]);
+               if (error != BCME_OK) {
+                       ANDROID_ERROR(("failed to set roam prof trigger (%d)\n", error));
+                       return BCME_ERROR;
+               }
+#endif /* WBTEXT */
+       } else {
+               if (roam_trigger[0] >= 0) {
+                       ANDROID_ERROR(("wrong roam trigger value (%d)\n", roam_trigger[0]));
+                       return BCME_ERROR;
+               }
+
+               roam_trigger[1] = WLC_BAND_ALL;
+               error = wldev_ioctl_set(dev, WLC_SET_ROAM_TRIGGER, roam_trigger,
+                       sizeof(roam_trigger));
+               if (error != BCME_OK) {
+                       ANDROID_ERROR(("failed to set roam trigger (%d)\n", error));
+                       return BCME_ERROR;
+               }
+       }
+
+       return BCME_OK;
+}
+
+int wl_android_set_roam_delta(
+       struct net_device *dev, char* command)
+{
+       int roam_delta[2];
+
+       sscanf(command, "%*s %10d", &roam_delta[0]);
+       roam_delta[1] = WLC_BAND_ALL;
+
+       return wldev_ioctl_set(dev, WLC_SET_ROAM_DELTA, roam_delta,
+               sizeof(roam_delta));
+}
+
+static int wl_android_get_roam_delta(
+       struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written;
+       int roam_delta[2] = {0, 0};
+
+       roam_delta[1] = WLC_BAND_2G;
+       if (wldev_ioctl_get(dev, WLC_GET_ROAM_DELTA, roam_delta,
+               sizeof(roam_delta))) {
+               roam_delta[1] = WLC_BAND_5G;
+#ifdef WL_6G_BAND
+               if (wldev_ioctl_get(dev, WLC_GET_ROAM_DELTA, roam_delta,
+                       sizeof(roam_delta))) {
+                       roam_delta[1] = WLC_BAND_6G;
+#endif /* WL_6G_BAND */
+                       if (wldev_ioctl_get(dev, WLC_GET_ROAM_DELTA, roam_delta,
+                               sizeof(roam_delta))) {
+                               return -1;
+                       }
+#ifdef WL_6G_BAND
+               }
+#endif /* WL_6G_BAND */
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d",
+               CMD_ROAMDELTA_GET, roam_delta[0]);
+
+       return bytes_written;
+}
+
+int wl_android_set_roam_scan_period(
+       struct net_device *dev, char* command)
+{
+       int roam_scan_period = 0;
+
+       sscanf(command, "%*s %10d", &roam_scan_period);
+       return wldev_ioctl_set(dev, WLC_SET_ROAM_SCAN_PERIOD, &roam_scan_period,
+               sizeof(roam_scan_period));
+}
+
+static int wl_android_get_roam_scan_period(
+       struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written;
+       int roam_scan_period = 0;
+
+       if (wldev_ioctl_get(dev, WLC_GET_ROAM_SCAN_PERIOD, &roam_scan_period,
+               sizeof(roam_scan_period)))
+               return -1;
+
+       bytes_written = snprintf(command, total_len, "%s %d",
+               CMD_ROAMSCANPERIOD_GET, roam_scan_period);
+
+       return bytes_written;
+}
+
+int wl_android_set_full_roam_scan_period(
+       struct net_device *dev, char* command)
+{
+       int error = 0;
+       int full_roam_scan_period = 0;
+       char smbuf[WLC_IOCTL_SMLEN];
+
+       sscanf(command+sizeof("SETFULLROAMSCANPERIOD"), "%d", &full_roam_scan_period);
+       WL_TRACE(("fullroamperiod = %d\n", full_roam_scan_period));
+
+       error = wldev_iovar_setbuf(dev, "fullroamperiod", &full_roam_scan_period,
+               sizeof(full_roam_scan_period), smbuf, sizeof(smbuf), NULL);
+       if (error) {
+               ANDROID_ERROR(("Failed to set full roam scan period, error = %d\n", error));
+       }
+
+       return error;
+}
+
+static int wl_android_get_full_roam_scan_period(
+       struct net_device *dev, char *command, int total_len)
+{
+       int error;
+       int bytes_written;
+       int full_roam_scan_period = 0;
+
+       error = wldev_iovar_getint(dev, "fullroamperiod", &full_roam_scan_period);
+
+       if (error) {
+               ANDROID_ERROR(("%s: get full roam scan period failed code %d\n",
+                       __func__, error));
+               return -1;
+       } else {
+               ANDROID_INFO(("%s: get full roam scan period %d\n", __func__, full_roam_scan_period));
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d",
+               CMD_FULLROAMSCANPERIOD_GET, full_roam_scan_period);
+
+       return bytes_written;
+}
+
+int wl_android_set_country_rev(
+       struct net_device *dev, char* command)
+{
+       int error = 0;
+       wl_country_t cspec = {{0}, 0, {0} };
+       char country_code[WLC_CNTRY_BUF_SZ];
+       char smbuf[WLC_IOCTL_SMLEN];
+       int rev = 0;
+
+       bzero(country_code, sizeof(country_code));
+       sscanf(command+sizeof("SETCOUNTRYREV"), "%3s %10d", country_code, &rev);
+       WL_TRACE(("country_code = %s, rev = %d\n", country_code, rev));
+
+       memcpy(cspec.country_abbrev, country_code, sizeof(country_code));
+       memcpy(cspec.ccode, country_code, sizeof(country_code));
+       cspec.rev = rev;
+
+       error = wldev_iovar_setbuf(dev, "country", (char *)&cspec,
+               sizeof(cspec), smbuf, sizeof(smbuf), NULL);
+
+       if (error) {
+               ANDROID_ERROR(("wl_android_set_country_rev: set country '%s/%d' failed code %d\n",
+                       cspec.ccode, cspec.rev, error));
+       } else {
+               dhd_bus_country_set(dev, &cspec, true);
+               ANDROID_INFO(("wl_android_set_country_rev: set country '%s/%d'\n",
+                       cspec.ccode, cspec.rev));
+       }
+
+       return error;
+}
+
+static int wl_android_get_country_rev(
+       struct net_device *dev, char *command, int total_len)
+{
+       int error;
+       int bytes_written;
+       char smbuf[WLC_IOCTL_SMLEN];
+       wl_country_t cspec;
+
+       error = wldev_iovar_getbuf(dev, "country", NULL, 0, smbuf,
+               sizeof(smbuf), NULL);
+
+       if (error) {
+               ANDROID_ERROR(("wl_android_get_country_rev: get country failed code %d\n",
+                       error));
+               return -1;
+       } else {
+               memcpy(&cspec, smbuf, sizeof(cspec));
+               ANDROID_INFO(("wl_android_get_country_rev: get country '%c%c %d'\n",
+                       cspec.ccode[0], cspec.ccode[1], cspec.rev));
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %c%c %d",
+               CMD_COUNTRYREV_GET, cspec.ccode[0], cspec.ccode[1], cspec.rev);
+
+       return bytes_written;
+}
+#endif /* ROAM_API */
+
+#ifdef WES_SUPPORT
+int wl_android_get_roam_scan_control(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       int bytes_written = 0;
+       int mode = 0;
+
+       error = get_roamscan_mode(dev, &mode);
+       if (error) {
+               ANDROID_ERROR(("wl_android_get_roam_scan_control: Failed to get Scan Control,"
+                       " error = %d\n", error));
+               return -1;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_GETROAMSCANCONTROL, mode);
+
+       return bytes_written;
+}
+
+int wl_android_set_roam_scan_control(struct net_device *dev, char *command)
+{
+       int error = 0;
+       int mode = 0;
+
+       if (sscanf(command, "%*s %d", &mode) != 1) {
+               ANDROID_ERROR(("wl_android_set_roam_scan_control: Failed to get Parameter\n"));
+               return -1;
+       }
+
+       error = set_roamscan_mode(dev, mode);
+       if (error) {
+               ANDROID_ERROR(("wl_android_set_roam_scan_control: Failed to set Scan Control %d,"
+               " error = %d\n",
+                mode, error));
+               return -1;
+       }
+
+       return 0;
+}
+
+int wl_android_get_roam_scan_channels(struct net_device *dev, char *command, int total_len,
+       char *cmd)
+{
+       int bytes_written = 0;
+       unsigned char channels[MAX_ROAM_CHANNEL] = {0};
+       int channel_cnt = 0;
+       int i = 0;
+       int buf_avail, len;
+
+       channel_cnt = get_roamscan_channel_list(dev, channels, MAX_ROAM_CHANNEL);
+       if (channel_cnt < 0) {
+               ANDROID_ERROR(("Failed to get roamscan channels, err = %d\n", channel_cnt));
+               return -1;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d", cmd, channel_cnt);
+
+       buf_avail = total_len - bytes_written;
+       for (i = 0; i < channel_cnt; i++) {
+               /* A return value of 'buf_avail' or more means that the output was truncated */
+               len = snprintf(command + bytes_written, buf_avail, " %d", channels[i]);
+               if (len >= buf_avail) {
+                       ANDROID_ERROR(("Insufficient memory, %d bytes\n", total_len));
+                       bytes_written = -1;
+                       break;
+               }
+               /* 'buf_avail' decremented by number of bytes written */
+               buf_avail -= len;
+               bytes_written += len;
+       }
+       ANDROID_INFO(("%s\n", command));
+       return bytes_written;
+}
+
+int wl_android_set_roam_scan_channels(struct net_device *dev, char *command)
+{
+       int error = BCME_OK;
+       unsigned char *p = (unsigned char *)(command + strlen(CMD_SETROAMSCANCHANNELS) + 1);
+       int get_ioctl_version = wl_cfg80211_get_ioctl_version();
+       error = set_roamscan_channel_list(dev, p[0], &p[1], get_ioctl_version);
+       if (error) {
+               ANDROID_ERROR(("Failed to set Scan Channels %d, error = %d\n", p[0], error));
+               return error;
+       }
+
+       return error;
+}
+
+int
+wl_android_add_roam_scan_channels(struct net_device *dev, char *command, uint cmdlen)
+{
+       int error = BCME_OK;
+       unsigned char *pcmd = NULL;
+       int get_ioctl_version = wl_cfg80211_get_ioctl_version();
+
+       pcmd = (unsigned char *)(command + cmdlen + 1);
+
+       error = add_roamscan_channel_list(dev, pcmd, get_ioctl_version);
+       if (error) {
+               ANDROID_ERROR(("Failed to add Scan Channels %s, error = %d\n", pcmd, error));
+       }
+
+       return error;
+}
+int
+wl_android_get_scan_channel_time(struct net_device *dev, char *command, int total_len)
+{
+       int error = BCME_OK;
+       int bytes_written = 0;
+       int time = 0;
+
+       error = wldev_ioctl_get(dev, WLC_GET_SCAN_CHANNEL_TIME, &time, sizeof(time));
+       if (error) {
+               ANDROID_ERROR(("Failed to get Scan Channel Time, error = %d\n", error));
+               return BCME_ERROR;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_GETSCANCHANNELTIME, time);
+
+       return bytes_written;
+}
+
+int
+wl_android_set_scan_channel_time(struct net_device *dev, char *command)
+{
+       int error = BCME_OK;
+       int time = 0;
+
+       if (sscanf(command, "%*s %d", &time) != 1) {
+               ANDROID_ERROR(("Failed to get Parameter\n"));
+               return BCME_ERROR;
+       }
+#ifdef CUSTOMER_SCAN_TIMEOUT_SETTING
+       wl_cfg80211_custom_scan_time(dev, WL_CUSTOM_SCAN_CHANNEL_TIME, time);
+       error = wldev_ioctl_set(dev, WLC_SET_SCAN_CHANNEL_TIME, &time, sizeof(time));
+#endif /* CUSTOMER_SCAN_TIMEOUT_SETTING */
+       if (error) {
+               ANDROID_ERROR(("Failed to set Scan Channel Time %d, error = %d\n", time, error));
+               return BCME_ERROR;
+       }
+
+       return error;
+}
+
+int
+wl_android_get_scan_unassoc_time(struct net_device *dev, char *command, int total_len)
+{
+       int error = BCME_OK;
+       int bytes_written = 0;
+       int time = 0;
+
+       error = wldev_ioctl_get(dev, WLC_GET_SCAN_UNASSOC_TIME, &time, sizeof(time));
+       if (error) {
+               ANDROID_ERROR(("Failed to get Scan Unassoc Time, error = %d\n", error));
+               return BCME_ERROR;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_GETSCANUNASSOCTIME, time);
+
+       return bytes_written;
+}
+
+int
+wl_android_set_scan_unassoc_time(struct net_device *dev, char *command)
+{
+       int error = BCME_OK;
+       int time = 0;
+
+       if (sscanf(command, "%*s %d", &time) != 1) {
+               ANDROID_ERROR(("Failed to get Parameter\n"));
+               return BCME_ERROR;
+       }
+#ifdef CUSTOMER_SCAN_TIMEOUT_SETTING
+       wl_cfg80211_custom_scan_time(dev, WL_CUSTOM_SCAN_UNASSOC_TIME, time);
+       error = wldev_ioctl_set(dev, WLC_SET_SCAN_UNASSOC_TIME, &time, sizeof(time));
+#endif /* CUSTOMER_SCAN_TIMEOUT_SETTING */
+       if (error) {
+               ANDROID_ERROR(("Failed to set Scan Unassoc Time %d, error = %d\n", time, error));
+               return BCME_ERROR;
+       }
+
+       return error;
+}
+
+int
+wl_android_get_scan_passive_time(struct net_device *dev, char *command, int total_len)
+{
+       int error = BCME_OK;
+       int bytes_written = 0;
+       int time = 0;
+
+       error = wldev_ioctl_get(dev, WLC_GET_SCAN_PASSIVE_TIME, &time, sizeof(time));
+       if (error) {
+               ANDROID_ERROR(("Failed to get Scan Passive Time, error = %d\n", error));
+               return BCME_ERROR;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_GETSCANPASSIVETIME, time);
+
+       return bytes_written;
+}
+
+int
+wl_android_set_scan_passive_time(struct net_device *dev, char *command)
+{
+       int error = BCME_OK;
+       int time = 0;
+
+       if (sscanf(command, "%*s %d", &time) != 1) {
+               ANDROID_ERROR(("Failed to get Parameter\n"));
+               return BCME_ERROR;
+       }
+#ifdef CUSTOMER_SCAN_TIMEOUT_SETTING
+       wl_cfg80211_custom_scan_time(dev, WL_CUSTOM_SCAN_PASSIVE_TIME, time);
+       error = wldev_ioctl_set(dev, WLC_SET_SCAN_PASSIVE_TIME, &time, sizeof(time));
+#endif /* CUSTOMER_SCAN_TIMEOUT_SETTING */
+       if (error) {
+               ANDROID_ERROR(("Failed to set Scan Passive Time %d, error = %d\n", time, error));
+               return BCME_ERROR;
+       }
+
+       return error;
+}
+
+int
+wl_android_get_scan_home_time(struct net_device *dev, char *command, int total_len)
+{
+       int error = BCME_OK;
+       int bytes_written = 0;
+       int time = 0;
+
+       error = wldev_ioctl_get(dev, WLC_GET_SCAN_HOME_TIME, &time, sizeof(time));
+       if (error) {
+               ANDROID_ERROR(("Failed to get Scan Home Time, error = %d\n", error));
+               return BCME_ERROR;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_GETSCANHOMETIME, time);
+
+       return bytes_written;
+}
+
+int wl_android_set_scan_home_time(struct net_device *dev, char *command)
+{
+       int error = BCME_OK;
+       int time = 0;
+
+       if (sscanf(command, "%*s %d", &time) != 1) {
+               ANDROID_ERROR(("Failed to get Parameter\n"));
+               return BCME_ERROR;
+       }
+#ifdef CUSTOMER_SCAN_TIMEOUT_SETTING
+       wl_cfg80211_custom_scan_time(dev, WL_CUSTOM_SCAN_HOME_TIME, time);
+       error = wldev_ioctl_set(dev, WLC_SET_SCAN_HOME_TIME, &time, sizeof(time));
+#endif /* CUSTOMER_SCAN_TIMEOUT_SETTING */
+       if (error) {
+               ANDROID_ERROR(("Failed to set Scan Home Time %d, error = %d\n", time, error));
+               return BCME_ERROR;
+       }
+
+       return error;
+}
+
+int
+wl_android_get_scan_home_away_time(struct net_device *dev, char *command, int total_len)
+{
+       int error = BCME_OK;
+       int bytes_written = 0;
+       int time = 0;
+
+       error = wldev_iovar_getint(dev, "scan_home_away_time", &time);
+       if (error) {
+               ANDROID_ERROR(("Failed to get Scan Home Away Time, error = %d\n", error));
+               return BCME_ERROR;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_GETSCANHOMEAWAYTIME, time);
+
+       return bytes_written;
+}
+
+int
+wl_android_set_scan_home_away_time(struct net_device *dev, char *command)
+{
+       int error = BCME_OK;
+       int time = 0;
+
+       if (sscanf(command, "%*s %d", &time) != 1) {
+               ANDROID_ERROR(("Failed to get Parameter\n"));
+               return BCME_ERROR;
+       }
+#ifdef CUSTOMER_SCAN_TIMEOUT_SETTING
+       wl_cfg80211_custom_scan_time(dev, WL_CUSTOM_SCAN_HOME_AWAY_TIME, time);
+       error = wldev_iovar_setint(dev, "scan_home_away_time", time);
+#endif /* CUSTOMER_SCAN_TIMEOUT_SETTING */
+       if (error) {
+               ANDROID_ERROR(("Failed to set Scan Home Away Time %d, error = %d\n",  time, error));
+               return BCME_ERROR;
+       }
+
+       return error;
+}
+
+int
+wl_android_get_scan_nprobes(struct net_device *dev, char *command, int total_len)
+{
+       int error = BCME_OK;
+       int bytes_written = 0;
+       int num = 0;
+
+       error = wldev_ioctl_get(dev, WLC_GET_SCAN_NPROBES, &num, sizeof(num));
+       if (error) {
+               ANDROID_ERROR(("Failed to get Scan NProbes, error = %d\n", error));
+               return BCME_ERROR;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_GETSCANNPROBES, num);
+
+       return bytes_written;
+}
+
+int
+wl_android_set_scan_nprobes(struct net_device *dev, char *command)
+{
+       int error = BCME_OK;
+       int num = 0;
+
+       if (sscanf(command, "%*s %d", &num) != 1) {
+               ANDROID_ERROR(("Failed to get Parameter\n"));
+               return BCME_ERROR;
+       }
+
+       error = wldev_ioctl_set(dev, WLC_SET_SCAN_NPROBES, &num, sizeof(num));
+       if (error) {
+               ANDROID_ERROR(("Failed to set Scan NProbes %d, error = %d\n", num, error));
+               return BCME_ERROR;
+       }
+
+       return error;
+}
+
+int
+wl_android_get_scan_dfs_channel_mode(struct net_device *dev, char *command, int total_len)
+{
+       int error = BCME_OK;
+       int bytes_written = 0;
+       int mode = 0;
+       int scan_passive_time = 0;
+
+       error = wldev_iovar_getint(dev, "scan_passive_time", &scan_passive_time);
+       if (error) {
+               ANDROID_ERROR(("Failed to get Passive Time, error = %d\n", error));
+               return BCME_ERROR;
+       }
+
+       if (scan_passive_time == 0) {
+               mode = 0;
+       } else {
+               mode = 1;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_GETDFSSCANMODE, mode);
+
+       return bytes_written;
+}
+
+int
+wl_android_set_scan_dfs_channel_mode(struct net_device *dev, char *command)
+{
+       int error = BCME_OK;
+       int mode = 0;
+       int scan_passive_time = 0;
+
+       if (sscanf(command, "%*s %d", &mode) != 1) {
+               ANDROID_ERROR(("Failed to get Parameter\n"));
+               return BCME_ERROR;
+       }
+
+       if (mode == 1) {
+               scan_passive_time = DHD_SCAN_PASSIVE_TIME;
+       } else if (mode == 0) {
+               scan_passive_time = 0;
+       } else {
+               ANDROID_ERROR(("Failed to set Scan DFS channel mode %d\n", mode));
+               return BCME_ERROR;
+       }
+       error = wldev_iovar_setint(dev, "scan_passive_time", scan_passive_time);
+       if (error) {
+               ANDROID_ERROR(("Failed to set Scan Passive Time %d, error = %d\n",
+                       scan_passive_time, error));
+               return BCME_ERROR;
+       }
+
+       return error;
+}
+
+#define JOINPREFFER_BUF_SIZE 12
+
+static int
+wl_android_set_join_prefer(struct net_device *dev, char *command)
+{
+       int error = BCME_OK;
+       char smbuf[WLC_IOCTL_SMLEN];
+       uint8 buf[JOINPREFFER_BUF_SIZE];
+       char *pcmd;
+       int total_len_left;
+       int i;
+       char hex[] = "XX";
+#ifdef WBTEXT
+       int turn_on = OFF;
+       char clear[] = { 0x01, 0x02, 0x00, 0x00, 0x03, 0x02, 0x00, 0x00, 0x04, 0x02, 0x00, 0x00 };
+#endif /* WBTEXT */
+
+       pcmd = command + strlen(CMD_SETJOINPREFER) + 1;
+       total_len_left = strlen(pcmd);
+
+       bzero(buf, sizeof(buf));
+
+       if (total_len_left != JOINPREFFER_BUF_SIZE << 1) {
+               ANDROID_ERROR(("wl_android_set_join_prefer: Failed to get Parameter\n"));
+               return BCME_ERROR;
+       }
+
+       /* Store the MSB first, as required by join_pref */
+       for (i = 0; i < JOINPREFFER_BUF_SIZE; i++) {
+               hex[0] = *pcmd++;
+               hex[1] = *pcmd++;
+               buf[i] = (uint8)simple_strtoul(hex, NULL, 16);
+       }
+
+#ifdef WBTEXT
+       /* Set WBTEXT mode */
+       turn_on = memcmp(buf, clear, sizeof(buf)) == 0 ? TRUE : FALSE;
+       error = wl_android_wbtext_enable(dev, turn_on);
+       if (error) {
+               ANDROID_ERROR(("Failed to set WBTEXT(%d) = %s\n",
+                       error, (turn_on ? "Enable" : "Disable")));
+       }
+#endif /* WBTEXT */
+
+       prhex("join pref", (uint8 *)buf, JOINPREFFER_BUF_SIZE);
+       error = wldev_iovar_setbuf(dev, "join_pref", buf, JOINPREFFER_BUF_SIZE,
+               smbuf, sizeof(smbuf), NULL);
+       if (error) {
+               ANDROID_ERROR(("Failed to set join_pref, error = %d\n", error));
+       }
+
+       return error;
+}
+
+int wl_android_send_action_frame(struct net_device *dev, char *command, int total_len)
+{
+       int error = -1;
+       android_wifi_af_params_t *params = NULL;
+       wl_action_frame_t *action_frame = NULL;
+       wl_af_params_t *af_params = NULL;
+       char *smbuf = NULL;
+       struct ether_addr tmp_bssid;
+       int tmp_channel = 0;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       if (total_len <
+                       (strlen(CMD_SENDACTIONFRAME) + 1 + sizeof(android_wifi_af_params_t))) {
+               ANDROID_ERROR(("wl_android_send_action_frame: Invalid parameters \n"));
+               goto send_action_frame_out;
+       }
+
+       params = (android_wifi_af_params_t *)(command + strlen(CMD_SENDACTIONFRAME) + 1);
+
+       if ((uint16)params->len > ANDROID_WIFI_ACTION_FRAME_SIZE) {
+               ANDROID_ERROR(("wl_android_send_action_frame: Requested action frame len"
+                       " was out of range(%d)\n",
+                       params->len));
+               goto send_action_frame_out;
+       }
+
+       smbuf = (char *)MALLOC(cfg->osh, WLC_IOCTL_MAXLEN);
+       if (smbuf == NULL) {
+               ANDROID_ERROR(("wl_android_send_action_frame: failed to allocated memory %d bytes\n",
+               WLC_IOCTL_MAXLEN));
+               goto send_action_frame_out;
+       }
+
+       af_params = (wl_af_params_t *)MALLOCZ(cfg->osh, WL_WIFI_AF_PARAMS_SIZE);
+       if (af_params == NULL) {
+               ANDROID_ERROR(("wl_android_send_action_frame: unable to allocate frame\n"));
+               goto send_action_frame_out;
+       }
+
+       bzero(&tmp_bssid, ETHER_ADDR_LEN);
+       if (bcm_ether_atoe((const char *)params->bssid, (struct ether_addr *)&tmp_bssid) == 0) {
+               bzero(&tmp_bssid, ETHER_ADDR_LEN);
+
+               error = wldev_ioctl_get(dev, WLC_GET_BSSID, &tmp_bssid, ETHER_ADDR_LEN);
+               if (error) {
+                       bzero(&tmp_bssid, ETHER_ADDR_LEN);
+                       ANDROID_ERROR(("wl_android_send_action_frame: failed to get bssid,"
+                               " error=%d\n", error));
+                       goto send_action_frame_out;
+               }
+       }
+
+       if (params->channel < 0) {
+               struct channel_info ci;
+               bzero(&ci, sizeof(ci));
+               error = wldev_ioctl_get(dev, WLC_GET_CHANNEL, &ci, sizeof(ci));
+               if (error) {
+                       ANDROID_ERROR(("wl_android_send_action_frame: failed to get channel,"
+                               " error=%d\n", error));
+                       goto send_action_frame_out;
+               }
+
+               tmp_channel = ci.hw_channel;
+       }
+       else {
+               tmp_channel = params->channel;
+       }
+
+       af_params->channel = tmp_channel;
+       af_params->dwell_time = params->dwell_time;
+       memcpy(&af_params->BSSID, &tmp_bssid, ETHER_ADDR_LEN);
+       action_frame = &af_params->action_frame;
+
+       action_frame->packetId = 0;
+       memcpy(&action_frame->da, &tmp_bssid, ETHER_ADDR_LEN);
+       action_frame->len = (uint16)params->len;
+       memcpy(action_frame->data, params->data, action_frame->len);
+
+       error = wldev_iovar_setbuf(dev, "actframe", af_params,
+               sizeof(wl_af_params_t), smbuf, WLC_IOCTL_MAXLEN, NULL);
+       if (error) {
+               ANDROID_ERROR(("wl_android_send_action_frame: failed to set action frame,"
+                       " error=%d\n", error));
+       }
+
+send_action_frame_out:
+       if (af_params) {
+               MFREE(cfg->osh, af_params, WL_WIFI_AF_PARAMS_SIZE);
+       }
+
+       if (smbuf) {
+               MFREE(cfg->osh, smbuf, WLC_IOCTL_MAXLEN);
+       }
+
+       if (error)
+               return -1;
+       else
+               return 0;
+}
+
+int wl_android_reassoc(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       android_wifi_reassoc_params_t *params = NULL;
+       uint band;
+       chanspec_t channel;
+       u32 params_size;
+       wl_reassoc_params_t reassoc_params;
+       char pcmd[WL_PRIV_CMD_LEN + 1];
+
+       sscanf(command, "%"S(WL_PRIV_CMD_LEN)"s *", pcmd);
+       if (total_len <
+               (strlen(pcmd) + 1 + sizeof(android_wifi_reassoc_params_t))) {
+               ANDROID_ERROR(("wl_android_reassoc: Invalid parameters \n"));
+               return -1;
+       }
+       params = (android_wifi_reassoc_params_t *)(command + strlen(pcmd) + 1);
+
+       bzero(&reassoc_params, WL_REASSOC_PARAMS_FIXED_SIZE);
+
+       if (bcm_ether_atoe((const char *)params->bssid,
+       (struct ether_addr *)&reassoc_params.bssid) == 0) {
+               ANDROID_ERROR(("wl_android_reassoc: Invalid bssid \n"));
+               return -1;
+       }
+
+       if (params->channel < 0) {
+               ANDROID_ERROR(("wl_android_reassoc: Invalid Channel \n"));
+               return -1;
+       }
+
+       reassoc_params.chanspec_num = 1;
+
+       channel = params->channel;
+#ifdef D11AC_IOTYPES
+       if (wl_cfg80211_get_ioctl_version() == 1) {
+               band = ((channel <= CH_MAX_2G_CHANNEL) ?
+               WL_LCHANSPEC_BAND_2G : WL_LCHANSPEC_BAND_5G);
+               reassoc_params.chanspec_list[0] = channel |
+               band | WL_LCHANSPEC_BW_20 | WL_LCHANSPEC_CTL_SB_NONE;
+       }
+       else {
+               band = ((channel <= CH_MAX_2G_CHANNEL) ? WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G);
+               reassoc_params.chanspec_list[0] = channel | band | WL_CHANSPEC_BW_20;
+       }
+#else
+       band = ((channel <= CH_MAX_2G_CHANNEL) ? WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G);
+       reassoc_params.chanspec_list[0] = channel |
+       band | WL_CHANSPEC_BW_20 | WL_CHANSPEC_CTL_SB_NONE;
+#endif /* D11AC_IOTYPES */
+       params_size = WL_REASSOC_PARAMS_FIXED_SIZE + sizeof(chanspec_t);
+
+       error = wldev_ioctl_set(dev, WLC_REASSOC, &reassoc_params, params_size);
+       if (error) {
+               ANDROID_ERROR(("wl_android_reassoc: failed to reassoc, error=%d\n", error));
+               return -1;
+       }
+       return 0;
+}
+
+int wl_android_get_wes_mode(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       int mode = 0;
+
+       mode = wl_cfg80211_get_wes_mode(dev);
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_GETWESMODE, mode);
+
+       return bytes_written;
+}
+
+int wl_android_set_wes_mode(struct net_device *dev, char *command)
+{
+       int error = 0;
+       int mode = 0;
+
+       if (sscanf(command, "%*s %d", &mode) != 1) {
+               ANDROID_ERROR(("wl_android_set_wes_mode: Failed to get Parameter\n"));
+               return -1;
+       }
+
+       error = wl_cfg80211_set_wes_mode(dev, mode);
+       if (error) {
+               ANDROID_ERROR(("wl_android_set_wes_mode: Failed to set WES Mode %d, error = %d\n",
+               mode, error));
+               return -1;
+       }
+
+       return 0;
+}
+
+int
+wl_android_get_ncho_mode(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       int mode = 0;
+
+       mode = wl_cfg80211_get_ncho_mode(dev);
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_GETNCHOMODE, mode);
+
+       return bytes_written;
+}
+
+int
+wl_android_set_ncho_mode(struct net_device *dev, int mode)
+{
+       char cmd[WLC_IOCTL_SMLEN];
+       int error = BCME_OK;
+
+#ifdef WBTEXT
+       /* Set WBTEXT mode */
+       error = wl_android_wbtext_enable(dev, !mode);
+       if (error) {
+               ANDROID_ERROR(("Failed to set WBTEXT(%d) = %s\n",
+                       error, (mode ? "Disable" : "Enable")));
+       }
+#endif /* WBTEXT */
+       /* Set Piority roam mode */
+       error = wl_android_priority_roam_enable(dev, !mode);
+       if (error) {
+               ANDROID_ERROR(("Failed to set Priority Roam(%d) = %s\n",
+                       error, (mode ? "Disable" : "Enable")));
+       }
+#ifdef CONFIG_SILENT_ROAM
+       /* Set Silent roam  mode */
+       error = wl_android_sroam_turn_on(dev, !mode);
+       if (error) {
+               ANDROID_ERROR(("Failed to set SROAM(%d) = %s\n",
+                       error, (mode ? "Disable" : "Enable")));
+       }
+#endif /* CONFIG_SILENT_ROAM */
+       /* Set RCROAM(ROAMEXT) mode */
+       error = wl_android_rcroam_turn_on(dev, !mode);
+       if (error) {
+               ANDROID_ERROR(("Failed to set RCROAM(%d) = %s\n",
+                       error, (mode ? "Disable" : "Enable")));
+       }
+
+       if (mode == OFF) {
+               /* restore NCHO set parameters */
+               sprintf(cmd, "%s", CMD_RESTORE_SCAN_PARAMS);
+               error = wl_android_default_set_scan_params(dev, cmd, WLC_IOCTL_SMLEN);
+               if (error) {
+                       ANDROID_ERROR(("Failed to set RESTORE_SCAN_PARAMS(%d)\n", error));
+               }
+
+               wl_cfg80211_set_wes_mode(dev, OFF);
+               set_roamscan_mode(dev, ROAMSCAN_MODE_NORMAL);
+       }
+
+       error = wl_cfg80211_set_ncho_mode(dev, mode);
+       if (error) {
+               ANDROID_ERROR(("Failed to set NCHO Mode %d, error = %d\n", mode, error));
+       }
+
+       return error;
+}
+
+static int
+wl_android_set_pmk(struct net_device *dev, char *command, int total_len)
+{
+       uchar pmk[33];
+       int error = 0;
+       char smbuf[WLC_IOCTL_SMLEN];
+       dhd_pub_t *dhdp;
+#ifdef OKC_DEBUG
+       int i = 0;
+#endif
+
+       if (total_len < (strlen("SET_PMK ") + 32)) {
+               ANDROID_ERROR(("wl_android_set_pmk: Invalid argument\n"));
+               return -1;
+       }
+
+       dhdp = wl_cfg80211_get_dhdp(dev);
+       if (!dhdp) {
+               ANDROID_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return -1;
+       }
+
+       bzero(pmk, sizeof(pmk));
+       DHD_STATLOG_CTRL(dhdp, ST(INSTALL_OKC_PMK), dhd_net2idx(dhdp->info, dev), 0);
+       memcpy((char *)pmk, command + strlen("SET_PMK "), 32);
+       error = wldev_iovar_setbuf(dev, "okc_info_pmk", pmk, 32, smbuf, sizeof(smbuf), NULL);
+       if (error) {
+               ANDROID_ERROR(("Failed to set PMK for OKC, error = %d\n", error));
+       }
+#ifdef OKC_DEBUG
+       ANDROID_ERROR(("PMK is "));
+       for (i = 0; i < 32; i++)
+               ANDROID_ERROR(("%02X ", pmk[i]));
+
+       ANDROID_ERROR(("\n"));
+#endif
+       return error;
+}
+
+static int
+wl_android_okc_enable(struct net_device *dev, char *command)
+{
+       int error = 0;
+       char okc_enable = 0;
+
+       okc_enable = command[strlen(CMD_OKC_ENABLE) + 1] - '0';
+       error = wldev_iovar_setint(dev, "okc_enable", okc_enable);
+       if (error) {
+               ANDROID_ERROR(("Failed to %s OKC, error = %d\n",
+                       okc_enable ? "enable" : "disable", error));
+       }
+
+       return error;
+}
+
+static int
+wl_android_legacy_check_command(struct net_device *dev, char *command)
+{
+       int cnt = 0;
+
+       while (strlen(legacy_cmdlist[cnt]) > 0) {
+               if (strnicmp(command, legacy_cmdlist[cnt], strlen(legacy_cmdlist[cnt])) == 0) {
+                       char cmd[100];
+                       sscanf(command, "%s ", cmd);
+                       if (strlen(legacy_cmdlist[cnt]) == strlen(cmd)) {
+                               return TRUE;
+                       }
+               }
+               cnt++;
+       }
+       return FALSE;
+}
+
+static int
+wl_android_legacy_private_command(struct net_device *net, char *command, int total_len)
+{
+       int bytes_written = 0;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+
+       if (cfg->ncho_mode == ON) {
+               ANDROID_ERROR(("Enabled NCHO mode\n"));
+               /* In order to avoid Sequential error HANG event. */
+               return BCME_UNSUPPORTED;
+       }
+
+       if (strnicmp(command, CMD_ADDROAMSCANCHLEGACY, strlen(CMD_ADDROAMSCANCHLEGACY)) == 0) {
+               bytes_written = wl_android_add_roam_scan_channels(net, command,
+                       strlen(CMD_ADDROAMSCANCHLEGACY));
+       }
+       else if (strnicmp(command, CMD_GETROAMSCANCHLEGACY, strlen(CMD_GETROAMSCANCHLEGACY)) == 0) {
+               bytes_written = wl_android_get_roam_scan_channels(net, command, total_len,
+                       CMD_GETROAMSCANCHLEGACY);
+       }
+       else if (strnicmp(command, CMD_GETROAMTRIGLEGACY, strlen(CMD_GETROAMTRIGLEGACY)) == 0) {
+               bytes_written = wl_android_get_roam_trigger(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SETROAMTRIGLEGACY, strlen(CMD_SETROAMTRIGLEGACY)) == 0) {
+               bytes_written = wl_android_set_roam_trigger_legacy(net, command);
+       }
+       else if (strnicmp(command, CMD_REASSOCLEGACY, strlen(CMD_REASSOCLEGACY)) == 0) {
+               bytes_written = wl_android_reassoc(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_GETSCANCHANNELTIMELEGACY,
+               strlen(CMD_GETSCANCHANNELTIMELEGACY)) == 0) {
+               bytes_written = wl_android_get_scan_channel_time(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SETSCANCHANNELTIMELEGACY,
+               strlen(CMD_SETSCANCHANNELTIMELEGACY)) == 0) {
+               bytes_written = wl_android_set_scan_channel_time(net, command);
+       }
+       else if (strnicmp(command, CMD_GETSCANUNASSOCTIMELEGACY,
+               strlen(CMD_GETSCANUNASSOCTIMELEGACY)) == 0) {
+               bytes_written = wl_android_get_scan_unassoc_time(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SETSCANUNASSOCTIMELEGACY,
+               strlen(CMD_SETSCANUNASSOCTIMELEGACY)) == 0) {
+               bytes_written = wl_android_set_scan_unassoc_time(net, command);
+       }
+       else if (strnicmp(command, CMD_GETSCANPASSIVETIMELEGACY,
+               strlen(CMD_GETSCANPASSIVETIMELEGACY)) == 0) {
+               bytes_written = wl_android_get_scan_passive_time(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SETSCANPASSIVETIMELEGACY,
+               strlen(CMD_SETSCANPASSIVETIMELEGACY)) == 0) {
+               bytes_written = wl_android_set_scan_passive_time(net, command);
+       }
+       else if (strnicmp(command, CMD_GETSCANHOMETIMELEGACY,
+               strlen(CMD_GETSCANHOMETIMELEGACY)) == 0) {
+               bytes_written = wl_android_get_scan_home_time(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SETSCANHOMETIMELEGACY,
+               strlen(CMD_SETSCANHOMETIMELEGACY)) == 0) {
+               bytes_written = wl_android_set_scan_home_time(net, command);
+       }
+       else if (strnicmp(command, CMD_GETSCANHOMEAWAYTIMELEGACY,
+               strlen(CMD_GETSCANHOMEAWAYTIMELEGACY)) == 0) {
+               bytes_written = wl_android_get_scan_home_away_time(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SETSCANHOMEAWAYTIMELEGACY,
+               strlen(CMD_SETSCANHOMEAWAYTIMELEGACY)) == 0) {
+               bytes_written = wl_android_set_scan_home_away_time(net, command);
+       }
+       else {
+               ANDROID_ERROR(("Unknown NCHO PRIVATE command %s - ignored\n", command));
+               bytes_written = scnprintf(command, sizeof("FAIL"), "FAIL");
+       }
+
+       return bytes_written;
+}
+
+static int
+wl_android_ncho_check_command(struct net_device *dev, char *command)
+{
+       int cnt = 0;
+
+       while (strlen(ncho_cmdlist[cnt]) > 0) {
+               if (strnicmp(command, ncho_cmdlist[cnt], strlen(ncho_cmdlist[cnt])) == 0) {
+                       char cmd[100];
+                       sscanf(command, "%s ", cmd);
+                       if (strlen(ncho_cmdlist[cnt]) == strlen(cmd)) {
+                               return TRUE;
+                       }
+               }
+               cnt++;
+       }
+       return FALSE;
+}
+
+static int
+wl_android_ncho_private_command(struct net_device *net, char *command, int total_len)
+{
+       int bytes_written = 0;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+
+       if (cfg->ncho_mode == OFF) {
+               ANDROID_ERROR(("Disable NCHO mode\n"));
+               /* In order to avoid Sequential error HANG event. */
+               return BCME_UNSUPPORTED;
+       }
+
+#ifdef ROAM_API
+       if (strnicmp(command, CMD_ROAMTRIGGER_SET, strlen(CMD_ROAMTRIGGER_SET)) == 0) {
+               bytes_written = wl_android_set_roam_trigger(net, command);
+       } else if (strnicmp(command, CMD_ROAMTRIGGER_GET, strlen(CMD_ROAMTRIGGER_GET)) == 0) {
+               bytes_written = wl_android_get_roam_trigger(net, command, total_len);
+       } else if (strnicmp(command, CMD_ROAMDELTA_SET, strlen(CMD_ROAMDELTA_SET)) == 0) {
+               bytes_written = wl_android_set_roam_delta(net, command);
+       } else if (strnicmp(command, CMD_ROAMDELTA_GET, strlen(CMD_ROAMDELTA_GET)) == 0) {
+               bytes_written = wl_android_get_roam_delta(net, command, total_len);
+       } else if (strnicmp(command, CMD_ROAMSCANPERIOD_SET,
+               strlen(CMD_ROAMSCANPERIOD_SET)) == 0) {
+               bytes_written = wl_android_set_roam_scan_period(net, command);
+       } else if (strnicmp(command, CMD_ROAMSCANPERIOD_GET,
+               strlen(CMD_ROAMSCANPERIOD_GET)) == 0) {
+               bytes_written = wl_android_get_roam_scan_period(net, command, total_len);
+       } else if (strnicmp(command, CMD_FULLROAMSCANPERIOD_SET,
+               strlen(CMD_FULLROAMSCANPERIOD_SET)) == 0) {
+               bytes_written = wl_android_set_full_roam_scan_period(net, command);
+       } else if (strnicmp(command, CMD_FULLROAMSCANPERIOD_GET,
+               strlen(CMD_FULLROAMSCANPERIOD_GET)) == 0) {
+               bytes_written = wl_android_get_full_roam_scan_period(net, command, total_len);
+       } else if (strnicmp(command, CMD_COUNTRYREV_SET, strlen(CMD_COUNTRYREV_SET)) == 0) {
+               bytes_written = wl_android_set_country_rev(net, command);
+#ifdef FCC_PWR_LIMIT_2G
+               if (wldev_iovar_setint(net, "fccpwrlimit2g", FALSE)) {
+                       ANDROID_ERROR(("fccpwrlimit2g deactivation is failed\n"));
+               } else {
+                       ANDROID_ERROR(("fccpwrlimit2g is deactivated\n"));
+               }
+#endif /* FCC_PWR_LIMIT_2G */
+       } else if (strnicmp(command, CMD_COUNTRYREV_GET, strlen(CMD_COUNTRYREV_GET)) == 0) {
+               bytes_written = wl_android_get_country_rev(net, command, total_len);
+       } else
+#endif /* ROAM_API */
+       if (strnicmp(command, CMD_GETROAMSCANCONTROL, strlen(CMD_GETROAMSCANCONTROL)) == 0) {
+               bytes_written = wl_android_get_roam_scan_control(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SETROAMSCANCONTROL, strlen(CMD_SETROAMSCANCONTROL)) == 0) {
+               bytes_written = wl_android_set_roam_scan_control(net, command);
+       }
+       else if (strnicmp(command, CMD_ADDROAMSCANCHANNELS, strlen(CMD_ADDROAMSCANCHANNELS)) == 0) {
+               bytes_written = wl_android_add_roam_scan_channels(net, command,
+                       strlen(CMD_ADDROAMSCANCHANNELS));
+       }
+       else if (strnicmp(command, CMD_GETROAMSCANCHANNELS, strlen(CMD_GETROAMSCANCHANNELS)) == 0) {
+               bytes_written = wl_android_get_roam_scan_channels(net, command, total_len,
+                       CMD_GETROAMSCANCHANNELS);
+       }
+       else if (strnicmp(command, CMD_SETROAMSCANCHANNELS, strlen(CMD_SETROAMSCANCHANNELS)) == 0) {
+               bytes_written = wl_android_set_roam_scan_channels(net, command);
+       }
+       else if (strnicmp(command, CMD_SENDACTIONFRAME, strlen(CMD_SENDACTIONFRAME)) == 0) {
+               bytes_written = wl_android_send_action_frame(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_REASSOC, strlen(CMD_REASSOC)) == 0) {
+               bytes_written = wl_android_reassoc(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_GETSCANCHANNELTIME, strlen(CMD_GETSCANCHANNELTIME)) == 0) {
+               bytes_written = wl_android_get_scan_channel_time(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SETSCANCHANNELTIME, strlen(CMD_SETSCANCHANNELTIME)) == 0) {
+               bytes_written = wl_android_set_scan_channel_time(net, command);
+       }
+       else if (strnicmp(command, CMD_GETSCANUNASSOCTIME, strlen(CMD_GETSCANUNASSOCTIME)) == 0) {
+               bytes_written = wl_android_get_scan_unassoc_time(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SETSCANUNASSOCTIME, strlen(CMD_SETSCANUNASSOCTIME)) == 0) {
+               bytes_written = wl_android_set_scan_unassoc_time(net, command);
+       }
+       else if (strnicmp(command, CMD_GETSCANPASSIVETIME, strlen(CMD_GETSCANPASSIVETIME)) == 0) {
+               bytes_written = wl_android_get_scan_passive_time(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SETSCANPASSIVETIME, strlen(CMD_SETSCANPASSIVETIME)) == 0) {
+               bytes_written = wl_android_set_scan_passive_time(net, command);
+       }
+       else if (strnicmp(command, CMD_GETSCANHOMETIME, strlen(CMD_GETSCANHOMETIME)) == 0) {
+               bytes_written = wl_android_get_scan_home_time(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SETSCANHOMETIME, strlen(CMD_SETSCANHOMETIME)) == 0) {
+               bytes_written = wl_android_set_scan_home_time(net, command);
+       }
+       else if (strnicmp(command, CMD_GETSCANHOMEAWAYTIME, strlen(CMD_GETSCANHOMEAWAYTIME)) == 0) {
+               bytes_written = wl_android_get_scan_home_away_time(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SETSCANHOMEAWAYTIME, strlen(CMD_SETSCANHOMEAWAYTIME)) == 0) {
+               bytes_written = wl_android_set_scan_home_away_time(net, command);
+       }
+       else if (strnicmp(command, CMD_GETSCANNPROBES, strlen(CMD_GETSCANNPROBES)) == 0) {
+               bytes_written = wl_android_get_scan_nprobes(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SETSCANNPROBES, strlen(CMD_SETSCANNPROBES)) == 0) {
+               bytes_written = wl_android_set_scan_nprobes(net, command);
+       }
+       else if (strnicmp(command, CMD_GETDFSSCANMODE, strlen(CMD_GETDFSSCANMODE)) == 0) {
+               bytes_written = wl_android_get_scan_dfs_channel_mode(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SETDFSSCANMODE, strlen(CMD_SETDFSSCANMODE)) == 0) {
+               bytes_written = wl_android_set_scan_dfs_channel_mode(net, command);
+       }
+       else if (strnicmp(command, CMD_SETJOINPREFER, strlen(CMD_SETJOINPREFER)) == 0) {
+               bytes_written = wl_android_set_join_prefer(net, command);
+       }
+       else if (strnicmp(command, CMD_GETWESMODE, strlen(CMD_GETWESMODE)) == 0) {
+               bytes_written = wl_android_get_wes_mode(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SETWESMODE, strlen(CMD_SETWESMODE)) == 0) {
+               bytes_written = wl_android_set_wes_mode(net, command);
+       }
+       else {
+               ANDROID_ERROR(("Unknown NCHO PRIVATE command %s - ignored\n", command));
+               bytes_written = scnprintf(command, sizeof("FAIL"), "FAIL");
+       }
+
+       return bytes_written;
+}
+#endif /* WES_SUPPORT */
+
+#if defined(SUPPORT_RESTORE_SCAN_PARAMS) || defined(WES_SUPPORT)
+static int
+wl_android_default_set_scan_params(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       uint error_cnt = 0;
+       int cnt = 0;
+       char restore_command[WLC_IOCTL_SMLEN];
+
+       while (strlen(restore_params[cnt].command) > 0 && restore_params[cnt].cmd_handler) {
+               sprintf(restore_command, "%s %d", restore_params[cnt].command,
+                       restore_params[cnt].parameter);
+               if (restore_params[cnt].cmd_type == RESTORE_TYPE_PRIV_CMD) {
+                       error = restore_params[cnt].cmd_handler(dev, restore_command);
+               }  else if (restore_params[cnt].cmd_type == RESTORE_TYPE_PRIV_CMD_WITH_LEN) {
+                       error = restore_params[cnt].cmd_handler_w_len(dev,
+                               restore_command, total_len);
+               } else {
+                       ANDROID_ERROR(("Unknown restore command handler\n"));
+                       error = -1;
+               }
+               if (error) {
+                       ANDROID_ERROR(("Failed to restore scan parameters %s, error : %d\n",
+                               restore_command, error));
+                       error_cnt++;
+               }
+               cnt++;
+       }
+       if (error_cnt > 0) {
+               ANDROID_ERROR(("Got %d error(s) while restoring scan parameters\n",
+                       error_cnt));
+               error = -1;
+       }
+       return error;
+}
+#endif /* SUPPORT_RESTORE_SCAN_PARAMS || WES_SUPPORT  */
+
+#ifdef WLTDLS
+int wl_android_tdls_reset(struct net_device *dev)
+{
+       int ret = 0;
+       ret = dhd_tdls_enable(dev, false, false, NULL);
+       if (ret < 0) {
+               ANDROID_ERROR(("Disable tdls failed. %d\n", ret));
+               return ret;
+       }
+       ret = dhd_tdls_enable(dev, true, true, NULL);
+       if (ret < 0) {
+               ANDROID_ERROR(("enable tdls failed. %d\n", ret));
+               return ret;
+       }
+       return 0;
+}
+#endif /* WLTDLS */
+
+int
+wl_android_rcroam_turn_on(struct net_device *dev, int rcroam_enab)
+{
+       int ret = BCME_OK;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+       wlc_rcroam_t *prcroam;
+       wlc_rcroam_info_v1_t *rcroam;
+       uint rcroamlen = sizeof(*rcroam) + RCROAM_HDRLEN;
+
+       ANDROID_INFO(("RCROAM mode %s\n", rcroam_enab ? "enable" : "disable"));
+
+       prcroam = (wlc_rcroam_t *)MALLOCZ(dhdp->osh, rcroamlen);
+       if (!prcroam) {
+               ANDROID_ERROR(("Fail to malloc buffer\n"));
+               return BCME_NOMEM;
+       }
+
+       /* Get RCROAM param */
+       ret = wldev_iovar_getbuf(dev, "rcroam", NULL, 0, prcroam, rcroamlen, NULL);
+       if (ret) {
+               ANDROID_ERROR(("Failed to get RCROAM info(%d)\n", ret));
+               goto done;
+       }
+
+       if (prcroam->ver != WLC_RC_ROAM_CUR_VER) {
+               ret = BCME_VERSION;
+               ANDROID_ERROR(("Ver(%d:%d). mismatch RCROAM info(%d)\n",
+                       prcroam->ver, WLC_RC_ROAM_CUR_VER, ret));
+               goto done;
+       }
+
+       /* Set RCROAM param */
+       rcroam = (wlc_rcroam_info_v1_t *)prcroam->data;
+       prcroam->ver = WLC_RC_ROAM_CUR_VER;
+       prcroam->len = sizeof(*rcroam);
+       rcroam->enab = rcroam_enab;
+
+       ret = wldev_iovar_setbuf(dev, "rcroam", prcroam, rcroamlen,
+               ioctl_buf, sizeof(ioctl_buf), NULL);
+       if (ret) {
+               ANDROID_ERROR(("Failed to set RCROAM %s(%d)\n",
+                       rcroam_enab ? "Enable" : "Disable", ret));
+               goto done;
+       }
+done:
+       if (prcroam) {
+               MFREE(dhdp->osh, prcroam, rcroamlen);
+       }
+
+       return ret;
+}
+
+#ifdef CONFIG_SILENT_ROAM
+int
+wl_android_sroam_turn_on(struct net_device *dev, int sroam_mode)
+{
+       int ret = BCME_OK;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+
+       dhdp->sroam_turn_on = sroam_mode;
+       ANDROID_INFO(("%s Silent mode %s\n", __FUNCTION__,
+               sroam_mode ? "enable" : "disable"));
+
+       if (!sroam_mode) {
+               ret = dhd_sroam_set_mon(dhdp, FALSE);
+               if (ret) {
+                       ANDROID_ERROR(("%s Failed to Set sroam %d\n",
+                               __FUNCTION__, ret));
+               }
+       }
+
+       return ret;
+}
+
+int
+wl_android_sroam_set_info(struct net_device *dev, char *data,
+       char *command, int total_len)
+{
+       int ret = BCME_OK;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       size_t slen = strlen(data);
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+       wlc_sroam_t *psroam;
+       wlc_sroam_info_t *sroam;
+       uint sroamlen = sizeof(*sroam) + SROAM_HDRLEN;
+
+       data[slen] = '\0';
+       psroam = (wlc_sroam_t *)MALLOCZ(dhdp->osh, sroamlen);
+       if (!psroam) {
+               ANDROID_ERROR(("%s Fail to malloc buffer\n", __FUNCTION__));
+               ret = BCME_NOMEM;
+               goto done;
+       }
+
+       psroam->ver = WLC_SILENT_ROAM_CUR_VER;
+       psroam->len = sizeof(*sroam);
+       sroam = (wlc_sroam_info_t *)psroam->data;
+
+       sroam->sroam_on = FALSE;
+       if (*data && *data != '\0') {
+               sroam->sroam_min_rssi = simple_strtol(data, &data, 10);
+               ANDROID_INFO(("1.Minimum RSSI %d\n", sroam->sroam_min_rssi));
+               data++;
+       }
+       if (*data && *data != '\0') {
+               sroam->sroam_rssi_range = simple_strtol(data, &data, 10);
+               ANDROID_INFO(("2.RSSI Range %d\n", sroam->sroam_rssi_range));
+               data++;
+       }
+       if (*data && *data != '\0') {
+               sroam->sroam_score_delta = simple_strtol(data, &data, 10);
+               ANDROID_INFO(("3.Score Delta %d\n", sroam->sroam_score_delta));
+               data++;
+       }
+       if (*data && *data != '\0') {
+               sroam->sroam_period_time = simple_strtol(data, &data, 10);
+               ANDROID_INFO(("4.Sroam period %d\n", sroam->sroam_period_time));
+               data++;
+       }
+       if (*data && *data != '\0') {
+               sroam->sroam_band = simple_strtol(data, &data, 10);
+               ANDROID_INFO(("5.Sroam Band %d\n", sroam->sroam_band));
+               data++;
+       }
+       if (*data && *data != '\0') {
+               sroam->sroam_inact_cnt = simple_strtol(data, &data, 10);
+               ANDROID_INFO(("6.Inactivity Count %d\n", sroam->sroam_inact_cnt));
+               data++;
+       }
+
+       if (*data != '\0') {
+               ret = BCME_BADARG;
+               goto done;
+       }
+
+       ret = wldev_iovar_setbuf(dev, "sroam", psroam, sroamlen, ioctl_buf,
+               sizeof(ioctl_buf), NULL);
+       if (ret) {
+               ANDROID_ERROR(("Failed to set silent roam info(%d)\n", ret));
+               goto done;
+       }
+done:
+       if (psroam) {
+               MFREE(dhdp->osh, psroam, sroamlen);
+       }
+
+       return ret;
+}
+
+int
+wl_android_sroam_get_info(struct net_device *dev, char *command, int total_len)
+{
+       int ret = BCME_OK;
+       int bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       wlc_sroam_t *psroam;
+       wlc_sroam_info_t *sroam;
+       uint sroamlen = sizeof(*sroam) + SROAM_HDRLEN;
+
+       psroam = (wlc_sroam_t *)MALLOCZ(dhdp->osh, sroamlen);
+       if (!psroam) {
+               ANDROID_ERROR(("%s Fail to malloc buffer\n", __FUNCTION__));
+               ret = BCME_NOMEM;
+               goto done;
+       }
+
+       ret = wldev_iovar_getbuf(dev, "sroam", NULL, 0, psroam, sroamlen, NULL);
+       if (ret) {
+               ANDROID_ERROR(("Failed to get silent roam info(%d)\n", ret));
+               goto done;
+       }
+
+       if (psroam->ver != WLC_SILENT_ROAM_CUR_VER) {
+               ret = BCME_VERSION;
+               ANDROID_ERROR(("Ver(%d:%d). mismatch silent roam info(%d)\n",
+                       psroam->ver, WLC_SILENT_ROAM_CUR_VER, ret));
+               goto done;
+       }
+
+       sroam = (wlc_sroam_info_t *)psroam->data;
+       bytes_written = snprintf(command, total_len,
+               "%s %d %d %d %d %d %d %d\n",
+               CMD_SROAM_GET_INFO, sroam->sroam_on, sroam->sroam_min_rssi, sroam->sroam_rssi_range,
+               sroam->sroam_score_delta, sroam->sroam_period_time, sroam->sroam_band,
+               sroam->sroam_inact_cnt);
+       ret = bytes_written;
+
+       ANDROID_INFO(("%s", command));
+done:
+       if (psroam) {
+               MFREE(dhdp->osh, psroam, sroamlen);
+       }
+
+       return ret;
+}
+#endif /* CONFIG_SILENT_ROAM */
+
+int
+wl_android_priority_roam_enable(struct net_device *dev, int mode)
+{
+       int error = BCME_OK;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+       wl_prio_roam_prof_v1_t *prio_roam;
+       uint buf_len = sizeof(wl_prio_roam_prof_v1_t) + (uint)strlen("priority_roam") + 1;
+
+       prio_roam = (wl_prio_roam_prof_v1_t *)MALLOCZ(dhdp->osh, buf_len);
+       if (!prio_roam) {
+               ANDROID_ERROR(("%s Fail to malloc buffer\n", __FUNCTION__));
+               error = BCME_NOMEM;
+               goto done;
+       }
+
+       error = wldev_iovar_getbuf(dev, "priority_roam", NULL, 0, prio_roam, buf_len, NULL);
+       if (error == BCME_UNSUPPORTED) {
+               ANDROID_ERROR(("Priority Roam Unsupport\n"));
+               error = BCME_OK;
+               goto done;
+       } else if (prio_roam->version != WL_PRIO_ROAM_PROF_V1) {
+               ANDROID_ERROR(("Priority Roam Version mismatch\n"));
+               goto done;
+       } else if (prio_roam->prio_roam_mode == mode) {
+               ANDROID_INFO(("Priority Roam already set(mode:%d)\n", mode));
+               goto done;
+       }
+
+       prio_roam->version = WL_PRIO_ROAM_PROF_V1;
+       prio_roam->length = sizeof(wl_prio_roam_prof_v1_t);
+       prio_roam->prio_roam_mode = mode;
+
+       error = wldev_iovar_setbuf(dev, "priority_roam", prio_roam,
+               sizeof(wl_prio_roam_prof_v1_t), ioctl_buf, sizeof(ioctl_buf), NULL);
+       if (error) {
+               ANDROID_ERROR(("Failed to set Priority Roam %s(%d)\n",
+                       mode ? "Enable" : "Disable", error));
+               goto done;
+       }
+done:
+       if (prio_roam) {
+               MFREE(dhdp->osh, prio_roam, sizeof(wl_prio_roam_prof_v1_t));
+       }
+
+       return error;
+}
+
+#ifdef CONFIG_ROAM_RSSI_LIMIT
+int
+wl_android_roam_rssi_limit(struct net_device *dev, char *command, int total_len)
+{
+       int ret = BCME_OK;
+       int argc, bytes_written = 0;
+       int lmt2g, lmt5g;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+
+       argc = sscanf(command, CMD_ROAM_RSSI_LMT " %d %d\n", &lmt2g, &lmt5g);
+
+       if (!argc) {
+               ret = dhd_roam_rssi_limit_get(dhdp, &lmt2g, &lmt5g);
+               if (ret) {
+                       ANDROID_ERROR(("Failed to Get roam_rssi_limit (%d)\n", ret));
+                       return ret;
+               }
+               bytes_written = snprintf(command, total_len, "%d, %d\n", lmt2g, lmt5g);
+               /* Get roam rssi limit */
+               return bytes_written;
+       } else {
+               /* Set roam rssi limit */
+               ret = dhd_roam_rssi_limit_set(dhdp, lmt2g, lmt5g);
+               if (ret) {
+                       ANDROID_ERROR(("Failed to Set roam_rssi_limit (%d)\n", ret));
+                       return ret;
+               }
+       }
+
+       return ret;
+}
+#endif /* CONFIG_ROAM_RSSI_LIMIT */
+
+static int
+get_int_bytes(uchar *oui_str, uchar *oui, int len)
+{
+       int idx;
+       uchar val;
+       uchar *src, *dest;
+       char hexstr[3];
+
+       if ((oui_str == NULL) || (oui == NULL) || (len == 0)) {
+               return BCME_BADARG;
+       }
+       src = oui_str;
+       dest = oui;
+
+       for (idx = 0; idx < len; idx++) {
+               if (*src == '\0') {
+                       *dest = '\0';
+                       break;
+               }
+               hexstr[0] = src[0];
+               hexstr[1] = src[1];
+               hexstr[2] = '\0';
+
+               val = (uchar)bcm_strtoul(hexstr, NULL, 16);
+               if (val == (uchar)-1) {
+                       return BCME_ERROR;
+               }
+               *dest++ = val;
+               src += 2;
+       }
+       return BCME_OK;
+}
+
+#define TAG_BYTE 0
+static int
+wl_android_set_disconnect_ies(struct net_device *dev, char *command)
+{
+       int cmd_prefix_len = 0;
+       char ie_len = 0;
+       int hex_ie_len = 0;
+       int total_len = 0;
+       int max_len = 0;
+       int cmd_len = 0;
+       uchar disassoc_ie[VNDR_IE_MAX_LEN] = {0};
+       s32 bssidx = 0;
+       struct bcm_cfg80211 *cfg = NULL;
+       s32 ret = 0;
+       cfg = wl_get_cfg(dev);
+
+       cmd_prefix_len = strlen("SET_DISCONNECT_IES ");
+       cmd_len = strlen(command);
+       /*
+        * <CMD> + <IES in HEX format>
+        * IES in hex format has to be in following format
+        * First byte = Tag, Second Byte = len and rest of
+        * bytes will be value. For ex: SET_DISCONNECT_IES dd0411223344
+        * tag = dd, len =04. Total IEs len = len + 2
+        */
+       ANDROID_INFO(("cmd recv = %s\n", command));
+       max_len = MIN(cmd_len, VNDR_IE_MAX_LEN);
+       /* Validate IEs len */
+       get_int_bytes(&command[cmd_prefix_len + 2], &ie_len, 1);
+       ANDROID_INFO(("ie_len = %d \n", ie_len));
+       if (ie_len <= 0 || ie_len > max_len) {
+               ret = BCME_BADLEN;
+               return ret;
+       }
+
+       /* Total len in hex is sum of double binary len, tag and len byte */
+       hex_ie_len = (ie_len * 2) + 4;
+       total_len = cmd_prefix_len + hex_ie_len;
+       if (command[total_len] != '\0' || (cmd_len != total_len)) {
+               ANDROID_ERROR(("command recv not matching with len, command = %s"
+                       "total_len = %d, cmd_len = %d\n", command, total_len, cmd_len));
+               ret = BCME_BADARG;
+               return ret;
+       }
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               ANDROID_ERROR(("Find index failed\n"));
+               ret = -EINVAL;
+               return ret;
+       }
+
+       /* Tag and len bytes are also part of total len of ies in binary */
+       ie_len = ie_len + 2;
+       /* Convert IEs in binary */
+       get_int_bytes(&command[cmd_prefix_len], disassoc_ie, ie_len);
+       if (disassoc_ie[TAG_BYTE] != 0xdd) {
+               ANDROID_ERROR(("Wrong tag recv, tag = 0x%02x\n", disassoc_ie[TAG_BYTE]));
+               ret = BCME_UNSUPPORTED;
+               return ret;
+       }
+
+       ret = wl_cfg80211_set_mgmt_vndr_ies(cfg,
+               ndev_to_cfgdev(dev), bssidx, VNDR_IE_DISASSOC_FLAG, disassoc_ie, ie_len);
+
+       return ret;
+}
+
+#ifdef FCC_PWR_LIMIT_2G
+int
+wl_android_set_fcc_pwr_limit_2g(struct net_device *dev, char *command)
+{
+       int error = 0;
+       int enable = 0;
+
+       sscanf(command+sizeof("SET_FCC_CHANNEL"), "%d", &enable);
+
+       if ((enable != CUSTOMER_HW4_ENABLE) && (enable != CUSTOMER_HW4_DISABLE)) {
+               ANDROID_ERROR(("wl_android_set_fcc_pwr_limit_2g: Invalid data\n"));
+               return BCME_ERROR;
+       }
+
+       CUSTOMER_HW4_EN_CONVERT(enable);
+
+       ANDROID_ERROR(("wl_android_set_fcc_pwr_limit_2g: fccpwrlimit2g set (%d)\n", enable));
+       error = wldev_iovar_setint(dev, "fccpwrlimit2g", enable);
+       if (error) {
+               ANDROID_ERROR(("wl_android_set_fcc_pwr_limit_2g: fccpwrlimit2g"
+                       " set returned (%d)\n", error));
+               return BCME_ERROR;
+       }
+
+       return error;
+}
+
+int
+wl_android_get_fcc_pwr_limit_2g(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       int enable = 0;
+       int bytes_written = 0;
+
+       error = wldev_iovar_getint(dev, "fccpwrlimit2g", &enable);
+       if (error) {
+               ANDROID_ERROR(("wl_android_get_fcc_pwr_limit_2g: fccpwrlimit2g get"
+                       " error (%d)\n", error));
+               return BCME_ERROR;
+       }
+       ANDROID_ERROR(("wl_android_get_fcc_pwr_limit_2g: fccpwrlimit2g get (%d)\n", enable));
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_GET_FCC_PWR_LIMIT_2G, enable);
+
+       return bytes_written;
+}
+#endif /* FCC_PWR_LIMIT_2G */
+
+/* Additional format of sta_info
+ * tx_pkts, tx_failures, tx_rate(kbps), rssi(main), rssi(aux), tx_pkts_retried,
+ * tx_pkts_retry_exhausted, rx_lastpkt_rssi(main), rx_lastpkt_rssi(aux),
+ * tx_pkts_total, tx_pkts_retries, tx_pkts_fw_total, tx_pkts_fw_retries,
+ * tx_pkts_fw_retry_exhausted
+ */
+#define STA_INFO_ADD_FMT       "%d %d %d %d %d %d %d %d %d %d %d %d %d %d"
+
+#ifdef BIGDATA_SOFTAP
+#define BIGDATA_SOFTAP_FMT     MACOUI " %d %s %d %d %d %d %d %d"
+#endif /* BIGDATA_SOFTAP */
+
+s32
+wl_cfg80211_get_sta_info(struct net_device *dev, char* command, int total_len)
+{
+       int bytes_written = -1, ret = 0;
+       char *pos, *token, *cmdstr;
+       bool is_macaddr = FALSE;
+       sta_info_v4_t *sta = NULL;
+       struct ether_addr mac;
+       char *iovar_buf = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       struct net_device *apdev = NULL;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+
+#ifdef BIGDATA_SOFTAP
+       void *data = NULL;
+       wl_ap_sta_data_t *sta_data = NULL;
+#endif /* BIGDATA_SOFTAP */
+
+       /* Client information */
+       uint16 cap = 0;
+       uint32 rxrtry = 0, rxmulti = 0;
+       uint32 tx_pkts = 0, tx_failures = 0, tx_rate = 0;
+       uint32 tx_pkts_retried = 0, tx_pkts_retry_exhausted = 0;
+       uint32 tx_pkts_total = 0, tx_pkts_retries = 0;
+       uint32 tx_pkts_fw_total = 0, tx_pkts_fw_retries = 0;
+       uint32 tx_pkts_fw_retry_exhausted = 0;
+       int8 rssi[WL_STA_ANT_MAX] = {0};
+       int8 rx_lastpkt_rssi[WL_STA_ANT_MAX] = {0};
+       wl_if_stats_t *if_stats = NULL;
+
+       BCM_REFERENCE(if_stats);
+       /* This Command used during only SoftAP mode. */
+       ANDROID_INFO(("%s\n", command));
+
+       /* Check the current op_mode */
+       if (!(dhdp->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+               ANDROID_ERROR(("unsupported op mode: %d\n", dhdp->op_mode));
+               return BCME_NOTAP;
+       }
+
+       /*
+        * DRIVER GETSTAINFO [client MAC or ALL] [ifname]
+        */
+       pos = command;
+
+       /* drop command */
+       token = bcmstrtok(&pos, " ", NULL);
+
+       /* Client MAC or ALL */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               ANDROID_ERROR(("GETSTAINFO subcmd not provided wl_cfg80211_get_sta_info\n"));
+               return -EINVAL;
+       }
+       cmdstr = token;
+
+       bzero(&mac, ETHER_ADDR_LEN);
+       if ((!strncmp(token, "all", 3)) || (!strncmp(token, "ALL", 3))) {
+               is_macaddr = FALSE;
+       } else if ((bcm_ether_atoe(token, &mac))) {
+               is_macaddr = TRUE;
+       } else {
+               ANDROID_ERROR(("Failed to get address\n"));
+               return -EINVAL;
+       }
+
+       /* get the interface name */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               /* assign requested dev for compatibility */
+               apdev = dev;
+       } else {
+               /* Find a net_device for SoftAP by interface name */
+               apdev = wl_get_ap_netdev(cfg, token);
+               if (!apdev) {
+                       ANDROID_ERROR(("cannot find a net_device for SoftAP\n"));
+                       return -EINVAL;
+               }
+       }
+
+       iovar_buf = (char *)MALLOCZ(cfg->osh, WLC_IOCTL_MAXLEN);
+       if (!iovar_buf) {
+               ANDROID_ERROR(("Failed to allocated memory %d bytes\n",
+                       WLC_IOCTL_MAXLEN));
+               return BCME_NOMEM;
+       }
+
+       if (is_macaddr) {
+               int cnt;
+
+               /* get the sta info */
+               ret = wldev_iovar_getbuf(apdev, "sta_info",
+                       (struct ether_addr *)mac.octet, ETHER_ADDR_LEN,
+                       iovar_buf, WLC_IOCTL_MAXLEN, NULL);
+               if (ret < 0) {
+                       ANDROID_ERROR(("Get sta_info ERR %d\n", ret));
+
+#ifdef BIGDATA_SOFTAP
+                       /* Customer wants to send basic client information
+                        * to the framework even if DHD cannot get the sta_info.
+                        */
+                       goto get_bigdata;
+#endif /* BIGDATA_SOFTAP */
+
+#ifndef BIGDATA_SOFTAP
+                       goto error;
+#endif /* BIGDATA_SOFTAP */
+               }
+
+               sta = (sta_info_v4_t *)iovar_buf;
+               if (dtoh16(sta->ver) != WL_STA_VER_4) {
+                       ANDROID_ERROR(("sta_info struct version mismatch, "
+                               "host ver : %d, fw ver : %d\n", WL_STA_VER_4,
+                               dtoh16(sta->ver)));
+
+#ifdef BIGDATA_SOFTAP
+                       /* Customer wants to send basic client information
+                        * to the framework even if DHD cannot get the sta_info.
+                        */
+                       goto get_bigdata;
+#endif /* BIGDATA_SOFTAP */
+
+#ifndef BIGDATA_SOFTAP
+                       goto error;
+#endif /* BIGDATA_SOFTAP */
+               }
+               cap = dtoh16(sta->cap);
+               rxrtry = dtoh32(sta->rx_pkts_retried);
+               rxmulti = dtoh32(sta->rx_mcast_pkts);
+               tx_pkts = dtoh32(sta->tx_pkts);
+               tx_failures = dtoh32(sta->tx_failures);
+               tx_rate = dtoh32(sta->tx_rate);
+               tx_pkts_retried = dtoh32(sta->tx_pkts_retried);
+               tx_pkts_retry_exhausted = dtoh32(sta->tx_pkts_retry_exhausted);
+               tx_pkts_total = dtoh32(sta->tx_pkts_total);
+               tx_pkts_retries = dtoh32(sta->tx_pkts_retries);
+               tx_pkts_fw_total = dtoh32(sta->tx_pkts_fw_total);
+               tx_pkts_fw_retries = dtoh32(sta->tx_pkts_fw_retries);
+               tx_pkts_fw_retry_exhausted = dtoh32(sta->tx_pkts_fw_retry_exhausted);
+               for (cnt = WL_ANT_IDX_1; cnt < WL_RSSI_ANT_MAX; cnt++) {
+                       rssi[cnt] = sta->rssi[cnt];
+                       rx_lastpkt_rssi[cnt] = sta->rx_lastpkt_rssi[cnt];
+               }
+       } else {
+               const wl_cnt_wlc_t* wlc_cnt = NULL;
+               ret = wldev_iovar_getbuf(apdev, "counters", NULL, 0,
+                       iovar_buf, WLC_IOCTL_MAXLEN, NULL);
+               if (unlikely(ret)) {
+                       ANDROID_ERROR(("counters error (%d) - size = %zu\n",
+                               ret, sizeof(wl_cnt_wlc_t)));
+                       goto error;
+               }
+               ret = wl_cntbuf_to_xtlv_format(NULL, iovar_buf,
+                       WL_CNTBUF_MAX_SIZE, 0);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("wl_cntbuf_to_xtlv_format ERR %d\n", ret));
+                       goto error;
+               }
+               if (!(wlc_cnt = GET_WLCCNT_FROM_CNTBUF(iovar_buf))) {
+                       ANDROID_ERROR(("wlc_cnt NULL!\n"));
+                       goto error;
+               }
+
+#ifndef DISABLE_IF_COUNTERS
+               if_stats = (wl_if_stats_t *)MALLOCZ(cfg->osh,
+                       sizeof(wl_if_stats_t));
+               if (!if_stats) {
+                       ANDROID_ERROR(("MALLOCZ failed\n"));
+                       goto error;
+               }
+               bzero(if_stats, sizeof(wl_if_stats_t));
+               if (FW_SUPPORTED(dhdp, ifst)) {
+                       ret = wl_cfg80211_ifstats_counters(apdev, if_stats);
+               } else
+               {
+                       ret = wldev_iovar_getbuf(apdev, "if_counters",
+                               NULL, 0, (char *)if_stats,
+                               sizeof(wl_if_stats_t), NULL);
+               }
+               if (ret) {
+                       ANDROID_ERROR(("if_counters not supported ret=%d\n", ret));
+#endif /* !DISABLE_IF_COUNTERS */
+                       /* In case if_stats IOVAR is not supported,
+                        * get information from counters.
+                        */
+                       rxrtry = dtoh32(wlc_cnt->rxrtry);
+                       rxmulti = dtoh32(wlc_cnt->rxmulti);
+                       tx_pkts = dtoh32(wlc_cnt->txframe);
+                       tx_failures = dtoh32(wlc_cnt->txnobuf) +
+                               dtoh32(wlc_cnt->rxrunt) + dtoh32(wlc_cnt->txfail);
+                       tx_pkts_total = dtoh32(wlc_cnt->txfrmsnt);
+                       tx_pkts_retries = dtoh32(wlc_cnt->txretrans);
+                       tx_pkts_fw_total = dtoh32(wlc_cnt->txfrmsnt);
+                       tx_pkts_fw_retries = dtoh32(wlc_cnt->txretrans);
+                       tx_pkts_fw_retry_exhausted = dtoh32(wlc_cnt->txfail);
+#ifndef DISABLE_IF_COUNTERS
+               } else {
+                       /* Populate from if_stats */
+                       if (dtoh16(if_stats->version) > WL_IF_STATS_T_VERSION) {
+                               ANDROID_ERROR(("incorrect version of wl_if_stats_t,"
+                                       " expected=%u got=%u\n", WL_IF_STATS_T_VERSION,
+                                       if_stats->version));
+                               goto error;
+                       }
+                       rxrtry = (uint32)(wlc_cnt->rxrtry);
+                       rxmulti = (uint32)dtoh64(if_stats->rxmulti);
+                       tx_pkts = (uint32)dtoh64(if_stats->txframe);
+                       tx_failures = (uint32)dtoh64(if_stats->txnobuf) +
+                               (uint32)dtoh64(if_stats->rxrunt) +
+                               (uint32)dtoh64(if_stats->txfail);
+                       tx_pkts_total = (uint32)dtoh64(if_stats->txfrmsnt);
+                       tx_pkts_retries = (uint32)dtoh64(if_stats->txretrans);
+                       tx_pkts_fw_total = (uint32)dtoh64(if_stats->txfrmsnt);
+                       tx_pkts_fw_retries = (uint32)dtoh64(if_stats->txretrans);
+                       tx_pkts_fw_retry_exhausted = (uint32)dtoh64(if_stats->txfail);
+               }
+#endif /* !DISABLE_IF_COUNTERS */
+       }
+
+#ifdef BIGDATA_SOFTAP
+get_bigdata:
+
+       if (is_macaddr && wl_get_ap_stadata(cfg, &mac, &data) == BCME_OK) {
+               ANDROID_ERROR(("mac " MACDBG" \n", MAC2STRDBG((char*)&mac)));
+               sta_data = (wl_ap_sta_data_t *)data;
+               bytes_written = snprintf(command, total_len,
+                       "%s %s Rx_Retry_Pkts=%d Rx_BcMc_Pkts=%d "
+                       "CAP=%04x " BIGDATA_SOFTAP_FMT " " STA_INFO_ADD_FMT
+                       "\n", CMD_GET_STA_INFO, cmdstr, rxrtry, rxmulti, cap,
+                       MACOUI2STR((char*)&sta_data->mac),
+                       sta_data->channel, wf_chspec_to_bw_str(sta_data->chanspec),
+                       sta_data->rssi, sta_data->rate, sta_data->mode_80211,
+                       sta_data->nss, sta_data->mimo, sta_data->reason_code,
+                       tx_pkts, tx_failures, tx_rate,
+                       (int32)rssi[WL_ANT_IDX_1], (int32)rssi[WL_ANT_IDX_2],
+                       tx_pkts_retried, tx_pkts_retry_exhausted,
+                       (int32)rx_lastpkt_rssi[WL_ANT_IDX_1],
+                       (int32)rx_lastpkt_rssi[WL_ANT_IDX_2],
+                       tx_pkts_total, tx_pkts_retries, tx_pkts_fw_total,
+                       tx_pkts_fw_retries, tx_pkts_fw_retry_exhausted);
+       } else
+#endif /* BIGDATA_SOFTAP */
+
+       {
+               ANDROID_ERROR(("ALL\n"));
+               bytes_written = snprintf(command, total_len,
+                       "%s %s Rx_Retry_Pkts=%d Rx_BcMc_Pkts=%d CAP=%04x "
+                       STA_INFO_ADD_FMT "\n", CMD_GET_STA_INFO, cmdstr, rxrtry, rxmulti, cap,
+                       tx_pkts, tx_failures, tx_rate, (int32)rssi[WL_ANT_IDX_1],
+                       (int32)rssi[WL_ANT_IDX_2], tx_pkts_retried,
+                       tx_pkts_retry_exhausted, (int32)rx_lastpkt_rssi[WL_ANT_IDX_1],
+                       (int32)rx_lastpkt_rssi[WL_ANT_IDX_2], tx_pkts_total,
+                       tx_pkts_retries, tx_pkts_fw_total, tx_pkts_fw_retries,
+                       tx_pkts_fw_retry_exhausted);
+       }
+       WL_ERR_KERN(("Command: %s", command));
+
+error:
+       if (iovar_buf) {
+               MFREE(cfg->osh, iovar_buf, WLC_IOCTL_MAXLEN);
+       }
+       if (if_stats) {
+               MFREE(cfg->osh, if_stats, sizeof(*if_stats));
+       }
+
+       return bytes_written;
+}
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+
+#ifdef WBTEXT
+static int wl_android_wbtext(struct net_device *dev, char *command, int total_len)
+{
+       int error = BCME_OK, argc = 0;
+       int data, bytes_written;
+       int roam_trigger[2];
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+
+       argc = sscanf(command+sizeof(CMD_WBTEXT_ENABLE), "%d", &data);
+       if (!argc) {
+               error = wldev_iovar_getint(dev, "wnm_bsstrans_resp", &data);
+               if (error) {
+                       ANDROID_ERROR(("wl_android_wbtext: Failed to set wbtext error = %d\n",
+                               error));
+                       return error;
+               }
+               bytes_written = snprintf(command, total_len, "WBTEXT %s\n",
+                               (data == WL_BSSTRANS_POLICY_PRODUCT_WBTEXT)?
+                               "ENABLED" : "DISABLED");
+               return bytes_written;
+       } else {
+               if (data) {
+                       data = WL_BSSTRANS_POLICY_PRODUCT_WBTEXT;
+               }
+
+               if ((error = wldev_iovar_setint(dev, "wnm_bsstrans_resp", data)) != BCME_OK) {
+                       ANDROID_ERROR(("wl_android_wbtext: Failed to set wbtext error = %d\n",
+                               error));
+                       return error;
+               }
+
+               if (data) {
+                       /* reset roam_prof when wbtext is on */
+                       if ((error = wl_cfg80211_wbtext_set_default(dev)) != BCME_OK) {
+                               return error;
+                       }
+               } else {
+                       /* reset legacy roam trigger when wbtext is off */
+                       roam_trigger[0] = DEFAULT_ROAM_TRIGGER_VALUE;
+                       roam_trigger[1] = WLC_BAND_ALL;
+                       if ((error = wldev_ioctl_set(dev, WLC_SET_ROAM_TRIGGER, roam_trigger,
+                                       sizeof(roam_trigger))) != BCME_OK) {
+                               ANDROID_ERROR(("wl_android_wbtext: Failed to reset roam trigger = %d\n",
+                                       error));
+                               return error;
+                       }
+               }
+               dhdp->wbtext_policy = data;
+       }
+       return error;
+}
+
+static int
+wl_android_wbtext_enable(struct net_device *dev, int mode)
+{
+       int error = BCME_OK;
+       char commandp[WLC_IOCTL_SMLEN];
+
+       if (wl_android_check_wbtext_support(dev)) {
+               bzero(commandp, sizeof(commandp));
+               snprintf(commandp, WLC_IOCTL_SMLEN, "WBTEXT_ENABLE %d", mode);
+               error = wl_android_wbtext(dev, commandp, WLC_IOCTL_SMLEN);
+               if (error) {
+                       ANDROID_ERROR(("Failed to set WBTEXT = %d\n", error));
+                       return error;
+               }
+       }
+
+       return error;
+}
+
+static int wl_cfg80211_wbtext_btm_timer_threshold(struct net_device *dev,
+       char *command, int total_len)
+{
+       int error = BCME_OK, argc = 0;
+       int data, bytes_written;
+
+       argc = sscanf(command, CMD_WBTEXT_BTM_TIMER_THRESHOLD " %d\n", &data);
+       if (!argc) {
+               error = wldev_iovar_getint(dev, "wnm_bsstrans_timer_threshold", &data);
+               if (error) {
+                       ANDROID_ERROR(("Failed to get wnm_bsstrans_timer_threshold (%d)\n", error));
+                       return error;
+               }
+               bytes_written = snprintf(command, total_len, "%d\n", data);
+               return bytes_written;
+       } else {
+               if ((error = wldev_iovar_setint(dev, "wnm_bsstrans_timer_threshold",
+                               data)) != BCME_OK) {
+                       ANDROID_ERROR(("Failed to set wnm_bsstrans_timer_threshold (%d)\n", error));
+                       return error;
+               }
+       }
+       return error;
+}
+
+static int wl_cfg80211_wbtext_btm_delta(struct net_device *dev,
+       char *command, int total_len)
+{
+       int error = BCME_OK, argc = 0;
+       int data = 0, bytes_written;
+
+       argc = sscanf(command, CMD_WBTEXT_BTM_DELTA " %d\n", &data);
+       if (!argc) {
+               error = wldev_iovar_getint(dev, "wnm_btmdelta", &data);
+               if (error) {
+                       ANDROID_ERROR(("Failed to get wnm_btmdelta (%d)\n", error));
+                       return error;
+               }
+               bytes_written = snprintf(command, total_len, "%d\n", data);
+               return bytes_written;
+       } else {
+               if ((error = wldev_iovar_setint(dev, "wnm_btmdelta",
+                               data)) != BCME_OK) {
+                       ANDROID_ERROR(("Failed to set wnm_btmdelta (%d)\n", error));
+                       return error;
+               }
+       }
+       return error;
+}
+
+static int wl_cfg80211_wbtext_estm_enable(struct net_device *dev,
+       char *command, int total_len)
+{
+       int error = BCME_OK;
+       int data = 0, bytes_written = 0;
+       int wnmmask = 0;
+       char *pcmd = command;
+
+       bcmstrtok(&pcmd, " ", NULL);
+
+       error = wldev_iovar_getint(dev, "wnm", &wnmmask);
+       if (error) {
+               ANDROID_ERROR(("Failed to get wnm_btmdelta (%d)\n", error));
+               return error;
+       }
+       ANDROID_INFO(("wnmmask %x\n", wnmmask));
+       if (*pcmd == WL_IOCTL_ACTION_GET) {
+               bytes_written = snprintf(command, total_len, "wbtext_estm_enable %d\n",
+                       (wnmmask & WL_WNM_ESTM) ? 1:0);
+               return bytes_written;
+       } else {
+               data = bcm_atoi(pcmd);
+               if (data == 0) {
+                       wnmmask &= ~WL_WNM_ESTM;
+               } else {
+                       wnmmask |= WL_WNM_ESTM;
+               }
+               ANDROID_INFO(("wnmmask %x\n", wnmmask));
+               if ((error = wldev_iovar_setint(dev, "wnm", wnmmask)) != BCME_OK) {
+                       ANDROID_ERROR(("Failed to set wnm mask (%d)\n", error));
+                       return error;
+               }
+       }
+       return error;
+}
+#endif /* WBTEXT */
+
+#ifdef PNO_SUPPORT
+#define PNO_PARAM_SIZE 50
+#define VALUE_SIZE 50
+#define LIMIT_STR_FMT  ("%50s %50s")
+
+static int
+wls_parse_batching_cmd(struct net_device *dev, char *command, int total_len)
+{
+       int err = BCME_OK;
+       uint i, tokens, len_remain;
+       char *pos, *pos2, *token, *token2, *delim;
+       char param[PNO_PARAM_SIZE+1], value[VALUE_SIZE+1];
+       struct dhd_pno_batch_params batch_params;
+
+       ANDROID_INFO(("wls_parse_batching_cmd: command=%s, len=%d\n", command, total_len));
+       len_remain = total_len;
+       if (len_remain > (strlen(CMD_WLS_BATCHING) + 1)) {
+               pos = command + strlen(CMD_WLS_BATCHING) + 1;
+               len_remain -= strlen(CMD_WLS_BATCHING) + 1;
+       } else {
+               ANDROID_ERROR(("wls_parse_batching_cmd: No arguments, total_len %d\n", total_len));
+               err = BCME_ERROR;
+               goto exit;
+       }
+       bzero(&batch_params, sizeof(struct dhd_pno_batch_params));
+       if (!strncmp(pos, PNO_BATCHING_SET, strlen(PNO_BATCHING_SET))) {
+               if (len_remain > (strlen(PNO_BATCHING_SET) + 1)) {
+                       pos += strlen(PNO_BATCHING_SET) + 1;
+               } else {
+                       ANDROID_ERROR(("wls_parse_batching_cmd: %s missing arguments, total_len %d\n",
+                               PNO_BATCHING_SET, total_len));
+                       err = BCME_ERROR;
+                       goto exit;
+               }
+               while ((token = strsep(&pos, PNO_PARAMS_DELIMETER)) != NULL) {
+                       bzero(param, sizeof(param));
+                       bzero(value, sizeof(value));
+                       if (token == NULL || !*token)
+                               break;
+                       if (*token == '\0')
+                               continue;
+                       delim = strchr(token, PNO_PARAM_VALUE_DELLIMETER);
+                       if (delim != NULL)
+                               *delim = ' ';
+
+                       tokens = sscanf(token, LIMIT_STR_FMT, param, value);
+                       if (!strncmp(param, PNO_PARAM_SCANFREQ, strlen(PNO_PARAM_SCANFREQ))) {
+                               batch_params.scan_fr = simple_strtol(value, NULL, 0);
+                               ANDROID_INFO(("scan_freq : %d\n", batch_params.scan_fr));
+                       } else if (!strncmp(param, PNO_PARAM_BESTN, strlen(PNO_PARAM_BESTN))) {
+                               batch_params.bestn = simple_strtol(value, NULL, 0);
+                               ANDROID_INFO(("bestn : %d\n", batch_params.bestn));
+                       } else if (!strncmp(param, PNO_PARAM_MSCAN, strlen(PNO_PARAM_MSCAN))) {
+                               batch_params.mscan = simple_strtol(value, NULL, 0);
+                               ANDROID_INFO(("mscan : %d\n", batch_params.mscan));
+                       } else if (!strncmp(param, PNO_PARAM_CHANNEL, strlen(PNO_PARAM_CHANNEL))) {
+                               i = 0;
+                               pos2 = value;
+                               tokens = sscanf(value, "<%s>", value);
+                               if (tokens != 1) {
+                                       err = BCME_ERROR;
+                                       ANDROID_ERROR(("wls_parse_batching_cmd: invalid format"
+                                       " for channel"
+                                       " <> params\n"));
+                                       goto exit;
+                               }
+                               while ((token2 = strsep(&pos2,
+                                               PNO_PARAM_CHANNEL_DELIMETER)) != NULL) {
+                                       if (token2 == NULL || !*token2)
+                                               break;
+                                       if (*token2 == '\0')
+                                               continue;
+                                       if (*token2 == 'A' || *token2 == 'B') {
+                                               batch_params.band = (*token2 == 'A')?
+                                                       WLC_BAND_5G : WLC_BAND_2G;
+                                               ANDROID_INFO(("band : %s\n",
+                                                       (*token2 == 'A')? "A" : "B"));
+                                       } else {
+                                               if ((batch_params.nchan >= WL_NUMCHANNELS) ||
+                                                       (i >= WL_NUMCHANNELS)) {
+                                                       ANDROID_ERROR(("Too many nchan %d\n",
+                                                               batch_params.nchan));
+                                                       err = BCME_BUFTOOSHORT;
+                                                       goto exit;
+                                               }
+                                               batch_params.chan_list[i++] =
+                                                       simple_strtol(token2, NULL, 0);
+                                               batch_params.nchan++;
+                                               ANDROID_INFO(("channel :%d\n",
+                                                       batch_params.chan_list[i-1]));
+                                       }
+                                }
+                       } else if (!strncmp(param, PNO_PARAM_RTT, strlen(PNO_PARAM_RTT))) {
+                               batch_params.rtt = simple_strtol(value, NULL, 0);
+                               ANDROID_INFO(("rtt : %d\n", batch_params.rtt));
+                       } else {
+                               ANDROID_ERROR(("wls_parse_batching_cmd : unknown param: %s\n", param));
+                               err = BCME_ERROR;
+                               goto exit;
+                       }
+               }
+               err = dhd_dev_pno_set_for_batch(dev, &batch_params);
+               if (err < 0) {
+                       ANDROID_ERROR(("failed to configure batch scan\n"));
+               } else {
+                       bzero(command, total_len);
+                       err = snprintf(command, total_len, "%d", err);
+               }
+       } else if (!strncmp(pos, PNO_BATCHING_GET, strlen(PNO_BATCHING_GET))) {
+               err = dhd_dev_pno_get_for_batch(dev, command, total_len);
+               if (err < 0) {
+                       ANDROID_ERROR(("failed to getting batching results\n"));
+               } else {
+                       err = strlen(command);
+               }
+       } else if (!strncmp(pos, PNO_BATCHING_STOP, strlen(PNO_BATCHING_STOP))) {
+               err = dhd_dev_pno_stop_for_batch(dev);
+               if (err < 0) {
+                       ANDROID_ERROR(("failed to stop batching scan\n"));
+               } else {
+                       bzero(command, total_len);
+                       err = snprintf(command, total_len, "OK");
+               }
+       } else {
+               ANDROID_ERROR(("wls_parse_batching_cmd : unknown command\n"));
+               err = BCME_ERROR;
+               goto exit;
+       }
+exit:
+       return err;
+}
+
+#ifndef WL_SCHED_SCAN
+static int wl_android_set_pno_setup(struct net_device *dev, char *command, int total_len)
+{
+       wlc_ssid_ext_t ssids_local[MAX_PFN_LIST_COUNT];
+       int res = -1;
+       int nssid = 0;
+       cmd_tlv_t *cmd_tlv_temp;
+       char *str_ptr;
+       int tlv_size_left;
+       int pno_time = 0;
+       int pno_repeat = 0;
+       int pno_freq_expo_max = 0;
+
+#ifdef PNO_SET_DEBUG
+       int i;
+       char pno_in_example[] = {
+               'P', 'N', 'O', 'S', 'E', 'T', 'U', 'P', ' ',
+               'S', '1', '2', '0',
+               'S',
+               0x05,
+               'd', 'l', 'i', 'n', 'k',
+               'S',
+               0x04,
+               'G', 'O', 'O', 'G',
+               'T',
+               '0', 'B',
+               'R',
+               '2',
+               'M',
+               '2',
+               0x00
+               };
+#endif /* PNO_SET_DEBUG */
+       ANDROID_INFO(("wl_android_set_pno_setup: command=%s, len=%d\n", command, total_len));
+
+       if (total_len < (strlen(CMD_PNOSETUP_SET) + sizeof(cmd_tlv_t))) {
+               ANDROID_ERROR(("wl_android_set_pno_setup: argument=%d less min size\n", total_len));
+               goto exit_proc;
+       }
+#ifdef PNO_SET_DEBUG
+       memcpy(command, pno_in_example, sizeof(pno_in_example));
+       total_len = sizeof(pno_in_example);
+#endif
+       str_ptr = command + strlen(CMD_PNOSETUP_SET);
+       tlv_size_left = total_len - strlen(CMD_PNOSETUP_SET);
+
+       cmd_tlv_temp = (cmd_tlv_t *)str_ptr;
+       bzero(ssids_local, sizeof(ssids_local));
+
+       if ((cmd_tlv_temp->prefix == PNO_TLV_PREFIX) &&
+               (cmd_tlv_temp->version == PNO_TLV_VERSION) &&
+               (cmd_tlv_temp->subtype == PNO_TLV_SUBTYPE_LEGACY_PNO)) {
+
+               str_ptr += sizeof(cmd_tlv_t);
+               tlv_size_left -= sizeof(cmd_tlv_t);
+
+               if ((nssid = wl_parse_ssid_list_tlv(&str_ptr, ssids_local,
+                       MAX_PFN_LIST_COUNT, &tlv_size_left)) <= 0) {
+                       ANDROID_ERROR(("SSID is not presented or corrupted ret=%d\n", nssid));
+                       goto exit_proc;
+               } else {
+                       if ((str_ptr[0] != PNO_TLV_TYPE_TIME) || (tlv_size_left <= 1)) {
+                               ANDROID_ERROR(("wl_android_set_pno_setup: scan duration corrupted"
+                                       " field size %d\n",
+                                       tlv_size_left));
+                               goto exit_proc;
+                       }
+                       str_ptr++;
+                       pno_time = simple_strtoul(str_ptr, &str_ptr, 16);
+                       ANDROID_INFO(("wl_android_set_pno_setup: pno_time=%d\n", pno_time));
+
+                       if (str_ptr[0] != 0) {
+                               if ((str_ptr[0] != PNO_TLV_FREQ_REPEAT)) {
+                                       ANDROID_ERROR(("wl_android_set_pno_setup: pno repeat:"
+                                               " corrupted field\n"));
+                                       goto exit_proc;
+                               }
+                               str_ptr++;
+                               pno_repeat = simple_strtoul(str_ptr, &str_ptr, 16);
+                               ANDROID_INFO(("wl_android_set_pno_setup: got pno_repeat=%d\n",
+                                       pno_repeat));
+                               if (str_ptr[0] != PNO_TLV_FREQ_EXPO_MAX) {
+                                       ANDROID_ERROR(("wl_android_set_pno_setup: FREQ_EXPO_MAX"
+                                               " corrupted field size\n"));
+                                       goto exit_proc;
+                               }
+                               str_ptr++;
+                               pno_freq_expo_max = simple_strtoul(str_ptr, &str_ptr, 16);
+                               ANDROID_INFO(("wl_android_set_pno_setup: pno_freq_expo_max=%d\n",
+                                       pno_freq_expo_max));
+                       }
+               }
+       } else {
+               ANDROID_ERROR(("wl_android_set_pno_setup: get wrong TLV command\n"));
+               goto exit_proc;
+       }
+
+       res = dhd_dev_pno_set_for_ssid(dev, ssids_local, nssid, pno_time, pno_repeat,
+               pno_freq_expo_max, NULL, 0);
+exit_proc:
+       return res;
+}
+#endif /* !WL_SCHED_SCAN */
+#endif /* PNO_SUPPORT  */
+
+static int wl_android_get_p2p_dev_addr(struct net_device *ndev, char *command, int total_len)
+{
+       int ret;
+       struct ether_addr p2pdev_addr;
+
+#define MAC_ADDR_STR_LEN 18
+       if (total_len < MAC_ADDR_STR_LEN) {
+               ANDROID_ERROR(("wl_android_get_p2p_dev_addr: buflen %d is less than p2p dev addr\n",
+                       total_len));
+               return -1;
+       }
+
+       ret = wl_cfg80211_get_p2p_dev_addr(ndev, &p2pdev_addr);
+       if (ret) {
+               ANDROID_ERROR(("wl_android_get_p2p_dev_addr: Failed to get p2p dev addr\n"));
+               return -1;
+       }
+       return (snprintf(command, total_len, MACF, ETHERP_TO_MACF(&p2pdev_addr)));
+}
+
+int
+wl_android_set_ap_mac_list(struct net_device *dev, int macmode, struct maclist *maclist)
+{
+       int i, j, match;
+       int ret = 0;
+       char mac_buf[MAX_NUM_OF_ASSOCLIST *
+               sizeof(struct ether_addr) + sizeof(uint)] = {0};
+       struct maclist *assoc_maclist = (struct maclist *)mac_buf;
+
+       /* set filtering mode */
+       if ((ret = wldev_ioctl_set(dev, WLC_SET_MACMODE, &macmode, sizeof(macmode)) != 0)) {
+               ANDROID_ERROR(("wl_android_set_ap_mac_list : WLC_SET_MACMODE error=%d\n", ret));
+               return ret;
+       }
+       if (macmode != MACLIST_MODE_DISABLED) {
+               /* set the MAC filter list */
+               if ((ret = wldev_ioctl_set(dev, WLC_SET_MACLIST, maclist,
+                       sizeof(int) + sizeof(struct ether_addr) * maclist->count)) != 0) {
+                       ANDROID_ERROR(("wl_android_set_ap_mac_list : WLC_SET_MACLIST error=%d\n", ret));
+                       return ret;
+               }
+               /* get the current list of associated STAs */
+               assoc_maclist->count = MAX_NUM_OF_ASSOCLIST;
+               if ((ret = wldev_ioctl_get(dev, WLC_GET_ASSOCLIST, assoc_maclist,
+                       sizeof(mac_buf))) != 0) {
+                       ANDROID_ERROR(("wl_android_set_ap_mac_list: WLC_GET_ASSOCLIST error=%d\n",
+                               ret));
+                       return ret;
+               }
+               /* do we have any STA associated?  */
+               if (assoc_maclist->count) {
+                       /* iterate each associated STA */
+                       for (i = 0; i < assoc_maclist->count; i++) {
+                               match = 0;
+                               /* compare with each entry */
+                               for (j = 0; j < maclist->count; j++) {
+                                       ANDROID_INFO(("wl_android_set_ap_mac_list: associated="MACDBG
+                                       "list = "MACDBG "\n",
+                                       MAC2STRDBG(assoc_maclist->ea[i].octet),
+                                       MAC2STRDBG(maclist->ea[j].octet)));
+                                       if (memcmp(assoc_maclist->ea[i].octet,
+                                               maclist->ea[j].octet, ETHER_ADDR_LEN) == 0) {
+                                               match = 1;
+                                               break;
+                                       }
+                               }
+                               /* do conditional deauth */
+                               /*   "if not in the allow list" or "if in the deny list" */
+                               if ((macmode == MACLIST_MODE_ALLOW && !match) ||
+                                       (macmode == MACLIST_MODE_DENY && match)) {
+                                       scb_val_t scbval;
+
+                                       scbval.val = htod32(1);
+                                       memcpy(&scbval.ea, &assoc_maclist->ea[i],
+                                               ETHER_ADDR_LEN);
+                                       if ((ret = wldev_ioctl_set(dev,
+                                               WLC_SCB_DEAUTHENTICATE_FOR_REASON,
+                                               &scbval, sizeof(scb_val_t))) != 0)
+                                               ANDROID_ERROR(("wl_android_set_ap_mac_list:"
+                                                       " WLC_SCB_DEAUTHENTICATE"
+                                                       " error=%d\n",
+                                                       ret));
+                               }
+                       }
+               }
+       }
+       return ret;
+}
+
+/*
+ * HAPD_MAC_FILTER mac_mode mac_cnt mac_addr1 mac_addr2
+ *
+ */
+static int
+wl_android_set_mac_address_filter(struct net_device *dev, char* str)
+{
+       int i;
+       int ret = 0;
+       int macnum = 0;
+       int macmode = MACLIST_MODE_DISABLED;
+       struct maclist *list;
+       char eabuf[ETHER_ADDR_STR_LEN];
+       const char *token;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       /* string should look like below (macmode/macnum/maclist) */
+       /*   1 2 00:11:22:33:44:55 00:11:22:33:44:ff  */
+
+       /* get the MAC filter mode */
+       token = strsep((char**)&str, " ");
+       if (!token) {
+               return -1;
+       }
+       macmode = bcm_atoi(token);
+
+       if (macmode < MACLIST_MODE_DISABLED || macmode > MACLIST_MODE_ALLOW) {
+               ANDROID_ERROR(("wl_android_set_mac_address_filter: invalid macmode %d\n", macmode));
+               return -1;
+       }
+
+       token = strsep((char**)&str, " ");
+       if (!token) {
+               return -1;
+       }
+       macnum = bcm_atoi(token);
+       if (macnum < 0 || macnum > MAX_NUM_MAC_FILT) {
+               ANDROID_ERROR(("wl_android_set_mac_address_filter: invalid number of MAC"
+                       " address entries %d\n",
+                       macnum));
+               return -1;
+       }
+       /* allocate memory for the MAC list */
+       list = (struct maclist*) MALLOCZ(cfg->osh, sizeof(int) +
+               sizeof(struct ether_addr) * macnum);
+       if (!list) {
+               ANDROID_ERROR(("wl_android_set_mac_address_filter : failed to allocate memory\n"));
+               return -1;
+       }
+       /* prepare the MAC list */
+       list->count = htod32(macnum);
+       bzero((char *)eabuf, ETHER_ADDR_STR_LEN);
+       for (i = 0; i < list->count; i++) {
+               token = strsep((char**)&str, " ");
+               if (token == NULL) {
+                       ANDROID_ERROR(("wl_android_set_mac_address_filter : No mac address present\n"));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+               strlcpy(eabuf, token, sizeof(eabuf));
+               if (!(ret = bcm_ether_atoe(eabuf, &list->ea[i]))) {
+                       ANDROID_ERROR(("wl_android_set_mac_address_filter : mac parsing err index=%d,"
+                               " addr=%s\n",
+                               i, eabuf));
+                       list->count = i;
+                       break;
+               }
+               ANDROID_INFO(("wl_android_set_mac_address_filter : %d/%d MACADDR=%s",
+                       i, list->count, eabuf));
+       }
+       if (i == 0)
+               goto exit;
+
+       /* set the list */
+       if ((ret = wl_android_set_ap_mac_list(dev, macmode, list)) != 0)
+               ANDROID_ERROR(("wl_android_set_mac_address_filter: Setting MAC list failed error=%d\n",
+                       ret));
+
+exit:
+       MFREE(cfg->osh, list, sizeof(int) + sizeof(struct ether_addr) * macnum);
+
+       return ret;
+}
+
+static int wl_android_get_factory_mac_addr(struct net_device *ndev, char *command, int total_len)
+{
+       int ret;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+
+       if (total_len < ETHER_ADDR_STR_LEN) {
+               ANDROID_ERROR(("wl_android_get_factory_mac_addr buflen %d"
+                       "is less than factory mac addr\n", total_len));
+               return BCME_ERROR;
+       }
+       ret = snprintf(command, total_len, MACDBG,
+               MAC2STRDBG(bcmcfg_to_prmry_ndev(cfg)->perm_addr));
+       return ret;
+}
+
+#if defined(WLAN_ACCEL_BOOT)
+int wl_android_wifi_accel_on(struct net_device *dev, bool force_reg_on)
+{
+       int ret = 0;
+
+       ANDROID_ERROR(("%s: force_reg_on = %d\n", __FUNCTION__, force_reg_on));
+       if (!dev) {
+               ANDROID_ERROR(("%s: dev is null\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       if (force_reg_on) {
+               /* First resume the bus if it is in suspended state */
+               dhd_net_bus_resume(dev, 0);
+               /* Toggle wl_reg_on */
+               wl_android_wifi_off(dev, TRUE);
+               wl_android_wifi_on(dev);
+       } else {
+               ret = dhd_net_bus_resume(dev, 0);
+       }
+
+       return ret;
+}
+
+int wl_android_wifi_accel_off(struct net_device *dev, bool force_reg_on)
+{
+       int ret = 0;
+
+       ANDROID_ERROR(("%s: force_reg_on = %d\n", __FUNCTION__, force_reg_on));
+       if (!dev) {
+               ANDROID_ERROR(("%s: dev is null\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       if (force_reg_on) {
+               ANDROID_ERROR(("%s: do nothing as wl_reg_on will be toggled in UP\n",
+                       __FUNCTION__));
+       } else {
+               ret = dhd_net_bus_suspend(dev);
+       }
+
+       return ret;
+}
+#endif /* WLAN_ACCEL_BOOT */
+
+/**
+ * Global function definitions (declared in wl_android.h)
+ */
+
+int wl_android_wifi_on(struct net_device *dev)
+{
+       int ret = 0;
+       int retry = POWERUP_MAX_RETRY;
+
+       if (!dev) {
+               ANDROID_ERROR(("wl_android_wifi_on: dev is null\n"));
+               return -EINVAL;
+       }
+
+       dhd_net_if_lock(dev);
+       WL_MSG(dev->name, "in g_wifi_on=%d\n", g_wifi_on);
+       if (!g_wifi_on) {
+               do {
+                       dhd_net_wifi_platform_set_power(dev, TRUE, WIFI_TURNON_DELAY);
+#ifdef BCMSDIO
+                       ret = dhd_net_bus_resume(dev, 0);
+#endif /* BCMSDIO */
+#ifdef BCMPCIE
+                       ret = dhd_net_bus_devreset(dev, FALSE);
+#endif /* BCMPCIE */
+                       if (ret == 0) {
+                               break;
+                       }
+                       ANDROID_ERROR(("\nfailed to power up wifi chip, retry again (%d left) **\n\n",
+                               retry));
+#ifdef BCMPCIE
+                       dhd_net_bus_devreset(dev, TRUE);
+#endif /* BCMPCIE */
+                       dhd_net_wifi_platform_set_power(dev, FALSE, WIFI_TURNOFF_DELAY);
+               } while (retry-- > 0);
+               if (ret != 0) {
+                       ANDROID_ERROR(("\nfailed to power up wifi chip, max retry reached **\n\n"));
+#ifdef BCM_DETECT_TURN_ON_FAILURE
+                       BUG_ON(1);
+#endif /* BCM_DETECT_TURN_ON_FAILURE */
+                       goto exit;
+               }
+#if defined(BCMSDIO) || defined(BCMDBUS)
+               ret = dhd_net_bus_devreset(dev, FALSE);
+               if (ret)
+                       goto err;
+#ifdef BCMSDIO
+               dhd_net_bus_resume(dev, 1);
+#endif /* BCMSDIO */
+#endif /* BCMSDIO || BCMDBUS */
+#if defined(BCMSDIO) || defined(BCMDBUS)
+               if (!ret) {
+                       if (dhd_dev_init_ioctl(dev) < 0) {
+                               ret = -EFAULT;
+                               goto err;
+                       }
+               }
+#endif /* BCMSDIO || BCMDBUS */
+               g_wifi_on = TRUE;
+       }
+
+exit:
+       WL_MSG(dev->name, "Success\n");
+       dhd_net_if_unlock(dev);
+       return ret;
+
+#if defined(BCMSDIO) || defined(BCMDBUS)
+err:
+       dhd_net_bus_devreset(dev, TRUE);
+#ifdef BCMSDIO
+       dhd_net_bus_suspend(dev);
+#endif /* BCMSDIO */
+       dhd_net_wifi_platform_set_power(dev, FALSE, WIFI_TURNOFF_DELAY);
+       WL_MSG(dev->name, "Failed\n");
+       dhd_net_if_unlock(dev);
+       return ret;
+#endif /* BCMSDIO || BCMDBUS */
+}
+
+int wl_android_wifi_off(struct net_device *dev, bool on_failure)
+{
+       int ret = 0;
+
+       if (!dev) {
+               ANDROID_ERROR(("%s: dev is null\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+#if defined(BCMPCIE) && defined(DHD_DEBUG_UART)
+       ret = dhd_debug_uart_is_running(dev);
+       if (ret) {
+               ANDROID_ERROR(("wl_android_wifi_off: - Debug UART App is running\n"));
+               return -EBUSY;
+       }
+#endif /* BCMPCIE && DHD_DEBUG_UART */
+       dhd_net_if_lock(dev);
+       WL_MSG(dev->name, "in g_wifi_on=%d, on_failure=%d\n", g_wifi_on, on_failure);
+       if (g_wifi_on || on_failure) {
+#if defined(BCMSDIO) || defined(BCMPCIE) || defined(BCMDBUS)
+               ret = dhd_net_bus_devreset(dev, TRUE);
+#ifdef BCMSDIO
+               dhd_net_bus_suspend(dev);
+#endif /* BCMSDIO */
+#endif /* BCMSDIO || BCMPCIE || BCMDBUS */
+               dhd_net_wifi_platform_set_power(dev, FALSE, WIFI_TURNOFF_DELAY);
+               g_wifi_on = FALSE;
+       }
+       WL_MSG(dev->name, "out\n");
+       dhd_net_if_unlock(dev);
+
+       return ret;
+}
+
+static int wl_android_set_fwpath(struct net_device *net, char *command, int total_len)
+{
+       if ((strlen(command) - strlen(CMD_SETFWPATH)) > MOD_PARAM_PATHLEN)
+               return -1;
+       return dhd_net_set_fw_path(net, command + strlen(CMD_SETFWPATH) + 1);
+}
+
+#ifdef CONNECTION_STATISTICS
+static int
+wl_chanim_stats(struct net_device *dev, u8 *chan_idle)
+{
+       int err;
+       wl_chanim_stats_t *list;
+       /* Parameter _and_ returned buffer of chanim_stats. */
+       wl_chanim_stats_t param;
+       u8 result[WLC_IOCTL_SMLEN];
+       chanim_stats_t *stats;
+
+       bzero(&param, sizeof(param));
+
+       param.buflen = htod32(sizeof(wl_chanim_stats_t));
+       param.count = htod32(WL_CHANIM_COUNT_ONE);
+
+       if ((err = wldev_iovar_getbuf(dev, "chanim_stats", (char*)&param, sizeof(wl_chanim_stats_t),
+               (char*)result, sizeof(result), 0)) < 0) {
+               ANDROID_ERROR(("Failed to get chanim results %d \n", err));
+               return err;
+       }
+
+       list = (wl_chanim_stats_t*)result;
+
+       list->buflen = dtoh32(list->buflen);
+       list->version = dtoh32(list->version);
+       list->count = dtoh32(list->count);
+
+       if (list->buflen == 0) {
+               list->version = 0;
+               list->count = 0;
+       } else if (list->version != WL_CHANIM_STATS_VERSION) {
+               ANDROID_ERROR(("Sorry, firmware has wl_chanim_stats version %d "
+                       "but driver supports only version %d.\n",
+                               list->version, WL_CHANIM_STATS_VERSION));
+               list->buflen = 0;
+               list->count = 0;
+       }
+
+       stats = list->stats;
+       stats->glitchcnt = dtoh32(stats->glitchcnt);
+       stats->badplcp = dtoh32(stats->badplcp);
+       stats->chanspec = dtoh16(stats->chanspec);
+       stats->timestamp = dtoh32(stats->timestamp);
+       stats->chan_idle = dtoh32(stats->chan_idle);
+
+       ANDROID_INFO(("chanspec: 0x%4x glitch: %d badplcp: %d idle: %d timestamp: %d\n",
+               stats->chanspec, stats->glitchcnt, stats->badplcp, stats->chan_idle,
+               stats->timestamp));
+
+       *chan_idle = stats->chan_idle;
+
+       return (err);
+}
+
+static int
+wl_android_get_connection_stats(struct net_device *dev, char *command, int total_len)
+{
+       static char iovar_buf[WLC_IOCTL_MAXLEN];
+       const wl_cnt_wlc_t* wlc_cnt = NULL;
+#ifndef DISABLE_IF_COUNTERS
+       wl_if_stats_t* if_stats = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+#endif /* DISABLE_IF_COUNTERS */
+
+       int link_speed = 0;
+       struct connection_stats *output;
+       unsigned int bufsize = 0;
+       int bytes_written = -1;
+       int ret = 0;
+
+       ANDROID_INFO(("wl_android_get_connection_stats: enter Get Connection Stats\n"));
+
+       if (total_len <= 0) {
+               ANDROID_ERROR(("wl_android_get_connection_stats: invalid buffer size %d\n", total_len));
+               goto error;
+       }
+
+       bufsize = total_len;
+       if (bufsize < sizeof(struct connection_stats)) {
+               ANDROID_ERROR(("wl_android_get_connection_stats: not enough buffer size, provided=%u,"
+                       " requires=%zu\n",
+                       bufsize,
+                       sizeof(struct connection_stats)));
+               goto error;
+       }
+
+       output = (struct connection_stats *)command;
+
+#ifndef DISABLE_IF_COUNTERS
+       if_stats = (wl_if_stats_t *)MALLOCZ(cfg->osh, sizeof(*if_stats));
+       if (if_stats == NULL) {
+               ANDROID_ERROR(("wl_android_get_connection_stats: MALLOCZ failed\n"));
+               goto error;
+       }
+       bzero(if_stats, sizeof(*if_stats));
+
+       if (FW_SUPPORTED(dhdp, ifst)) {
+               ret = wl_cfg80211_ifstats_counters(dev, if_stats);
+       } else
+       {
+               ret = wldev_iovar_getbuf(dev, "if_counters", NULL, 0,
+                       (char *)if_stats, sizeof(*if_stats), NULL);
+       }
+
+       ret = wldev_iovar_getbuf(dev, "if_counters", NULL, 0,
+               (char *)if_stats, sizeof(*if_stats), NULL);
+       if (ret) {
+               ANDROID_ERROR(("wl_android_get_connection_stats: if_counters not supported ret=%d\n",
+                       ret));
+
+               /* In case if_stats IOVAR is not supported, get information from counters. */
+#endif /* DISABLE_IF_COUNTERS */
+               ret = wldev_iovar_getbuf(dev, "counters", NULL, 0,
+                       iovar_buf, WLC_IOCTL_MAXLEN, NULL);
+               if (unlikely(ret)) {
+                       ANDROID_ERROR(("counters error (%d) - size = %zu\n", ret, sizeof(wl_cnt_wlc_t)));
+                       goto error;
+               }
+               ret = wl_cntbuf_to_xtlv_format(NULL, iovar_buf, WL_CNTBUF_MAX_SIZE, 0);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("wl_android_get_connection_stats:"
+                       " wl_cntbuf_to_xtlv_format ERR %d\n",
+                       ret));
+                       goto error;
+               }
+
+               if (!(wlc_cnt = GET_WLCCNT_FROM_CNTBUF(iovar_buf))) {
+                       ANDROID_ERROR(("wl_android_get_connection_stats: wlc_cnt NULL!\n"));
+                       goto error;
+               }
+
+               output->txframe   = dtoh32(wlc_cnt->txframe);
+               output->txbyte    = dtoh32(wlc_cnt->txbyte);
+               output->txerror   = dtoh32(wlc_cnt->txerror);
+               output->rxframe   = dtoh32(wlc_cnt->rxframe);
+               output->rxbyte    = dtoh32(wlc_cnt->rxbyte);
+               output->txfail    = dtoh32(wlc_cnt->txfail);
+               output->txretry   = dtoh32(wlc_cnt->txretry);
+               output->txretrie  = dtoh32(wlc_cnt->txretrie);
+               output->txrts     = dtoh32(wlc_cnt->txrts);
+               output->txnocts   = dtoh32(wlc_cnt->txnocts);
+               output->txexptime = dtoh32(wlc_cnt->txexptime);
+#ifndef DISABLE_IF_COUNTERS
+       } else {
+               /* Populate from if_stats. */
+               if (dtoh16(if_stats->version) > WL_IF_STATS_T_VERSION) {
+                       ANDROID_ERROR(("wl_android_get_connection_stats: incorrect version of"
+                               " wl_if_stats_t,"
+                               " expected=%u got=%u\n",
+                               WL_IF_STATS_T_VERSION, if_stats->version));
+                       goto error;
+               }
+
+               output->txframe   = (uint32)dtoh64(if_stats->txframe);
+               output->txbyte    = (uint32)dtoh64(if_stats->txbyte);
+               output->txerror   = (uint32)dtoh64(if_stats->txerror);
+               output->rxframe   = (uint32)dtoh64(if_stats->rxframe);
+               output->rxbyte    = (uint32)dtoh64(if_stats->rxbyte);
+               output->txfail    = (uint32)dtoh64(if_stats->txfail);
+               output->txretry   = (uint32)dtoh64(if_stats->txretry);
+               output->txretrie  = (uint32)dtoh64(if_stats->txretrie);
+               if (dtoh16(if_stats->length) > OFFSETOF(wl_if_stats_t, txexptime)) {
+                       output->txexptime = (uint32)dtoh64(if_stats->txexptime);
+                       output->txrts     = (uint32)dtoh64(if_stats->txrts);
+                       output->txnocts   = (uint32)dtoh64(if_stats->txnocts);
+               } else {
+                       output->txexptime = 0;
+                       output->txrts     = 0;
+                       output->txnocts   = 0;
+               }
+       }
+#endif /* DISABLE_IF_COUNTERS */
+
+       /* link_speed is in kbps */
+       ret = wldev_get_link_speed(dev, &link_speed);
+       if (ret || link_speed < 0) {
+               ANDROID_ERROR(("wl_android_get_connection_stats: wldev_get_link_speed()"
+                       " failed, ret=%d, speed=%d\n",
+                       ret, link_speed));
+               goto error;
+       }
+
+       output->txrate    = link_speed;
+
+       /* Channel idle ratio. */
+       if (wl_chanim_stats(dev, &(output->chan_idle)) < 0) {
+               output->chan_idle = 0;
+       };
+
+       bytes_written = sizeof(struct connection_stats);
+
+error:
+#ifndef DISABLE_IF_COUNTERS
+       if (if_stats) {
+               MFREE(cfg->osh, if_stats, sizeof(*if_stats));
+       }
+#endif /* DISABLE_IF_COUNTERS */
+
+       return bytes_written;
+}
+#endif /* CONNECTION_STATISTICS */
+
+#ifdef WL_NATOE
+static int
+wl_android_process_natoe_cmd(struct net_device *dev, char *command, int total_len)
+{
+       int ret = BCME_ERROR;
+       char *pcmd = command;
+       char *str = NULL;
+       wl_natoe_cmd_info_t cmd_info;
+       const wl_natoe_sub_cmd_t *natoe_cmd = &natoe_cmd_list[0];
+
+       /* skip to cmd name after "natoe" */
+       str = bcmstrtok(&pcmd, " ", NULL);
+
+       /* If natoe subcmd name is not provided, return error */
+       if (*pcmd == '\0') {
+               ANDROID_ERROR(("natoe subcmd not provided wl_android_process_natoe_cmd\n"));
+               ret = -EINVAL;
+               return ret;
+       }
+
+       /* get the natoe command name to str */
+       str = bcmstrtok(&pcmd, " ", NULL);
+
+       while (natoe_cmd->name != NULL) {
+               if (strcmp(natoe_cmd->name, str) == 0)  {
+                       /* dispacth cmd to appropriate handler */
+                       if (natoe_cmd->handler) {
+                               cmd_info.command = command;
+                               cmd_info.tot_len = total_len;
+                               ret = natoe_cmd->handler(dev, natoe_cmd, pcmd, &cmd_info);
+                       }
+                       return ret;
+               }
+               natoe_cmd++;
+       }
+       return ret;
+}
+
+static int
+wlu_natoe_set_vars_cbfn(void *ctx, uint8 *data, uint16 type, uint16 len)
+{
+       int res = BCME_OK;
+       wl_natoe_cmd_info_t *cmd_info = (wl_natoe_cmd_info_t *)ctx;
+       uint8 *command = cmd_info->command;
+       uint16 total_len = cmd_info->tot_len;
+       uint16 bytes_written = 0;
+
+       UNUSED_PARAMETER(len);
+
+       switch (type) {
+
+       case WL_NATOE_XTLV_ENABLE:
+       {
+               bytes_written = snprintf(command, total_len, "natoe: %s\n",
+                               *data?"enabled":"disabled");
+               cmd_info->bytes_written = bytes_written;
+               break;
+       }
+
+       case WL_NATOE_XTLV_CONFIG_IPS:
+       {
+               wl_natoe_config_ips_t *config_ips;
+               uint8 buf[16];
+
+               config_ips = (wl_natoe_config_ips_t *)data;
+               bcm_ip_ntoa((struct ipv4_addr *)&config_ips->sta_ip, buf);
+               bytes_written = snprintf(command, total_len, "sta ip: %s\n", buf);
+               bcm_ip_ntoa((struct ipv4_addr *)&config_ips->sta_netmask, buf);
+               bytes_written += snprintf(command + bytes_written, total_len,
+                               "sta netmask: %s\n", buf);
+               bcm_ip_ntoa((struct ipv4_addr *)&config_ips->sta_router_ip, buf);
+               bytes_written += snprintf(command + bytes_written, total_len,
+                               "sta router ip: %s\n", buf);
+               bcm_ip_ntoa((struct ipv4_addr *)&config_ips->sta_dnsip, buf);
+               bytes_written += snprintf(command + bytes_written, total_len,
+                               "sta dns ip: %s\n", buf);
+               bcm_ip_ntoa((struct ipv4_addr *)&config_ips->ap_ip, buf);
+               bytes_written += snprintf(command + bytes_written, total_len,
+                               "ap ip: %s\n", buf);
+               bcm_ip_ntoa((struct ipv4_addr *)&config_ips->ap_netmask, buf);
+               bytes_written += snprintf(command + bytes_written, total_len,
+                               "ap netmask: %s\n", buf);
+               cmd_info->bytes_written = bytes_written;
+               break;
+       }
+
+       case WL_NATOE_XTLV_CONFIG_PORTS:
+       {
+               wl_natoe_ports_config_t *ports_config;
+
+               ports_config = (wl_natoe_ports_config_t *)data;
+               bytes_written = snprintf(command, total_len, "starting port num: %d\n",
+                               dtoh16(ports_config->start_port_num));
+               bytes_written += snprintf(command + bytes_written, total_len,
+                               "number of ports: %d\n", dtoh16(ports_config->no_of_ports));
+               cmd_info->bytes_written = bytes_written;
+               break;
+       }
+
+       case WL_NATOE_XTLV_DBG_STATS:
+       {
+               char *stats_dump = (char *)data;
+
+               bytes_written = snprintf(command, total_len, "%s\n", stats_dump);
+               cmd_info->bytes_written = bytes_written;
+               break;
+       }
+
+       case WL_NATOE_XTLV_TBL_CNT:
+       {
+               bytes_written = snprintf(command, total_len, "natoe max tbl entries: %d\n",
+                               dtoh32(*(uint32 *)data));
+               cmd_info->bytes_written = bytes_written;
+               break;
+       }
+
+       default:
+               /* ignore */
+               break;
+       }
+
+       return res;
+}
+
+/*
+ *   --- common for all natoe get commands ----
+ */
+static int
+wl_natoe_get_ioctl(struct net_device *dev, wl_natoe_ioc_t *natoe_ioc,
+               uint16 iocsz, uint8 *buf, uint16 buflen, wl_natoe_cmd_info_t *cmd_info)
+{
+       /* for gets we only need to pass ioc header */
+       wl_natoe_ioc_t *iocresp = (wl_natoe_ioc_t *)buf;
+       int res;
+
+       /*  send getbuf natoe iovar */
+       res = wldev_iovar_getbuf(dev, "natoe", natoe_ioc, iocsz, buf,
+                       buflen, NULL);
+
+       /*  check the response buff  */
+       if ((res == BCME_OK)) {
+               /* scans ioctl tlvbuf f& invokes the cbfn for processing  */
+               res = bcm_unpack_xtlv_buf(cmd_info, iocresp->data, iocresp->len,
+                               BCM_XTLV_OPTION_ALIGN32, wlu_natoe_set_vars_cbfn);
+
+               if (res == BCME_OK) {
+                       res = cmd_info->bytes_written;
+               }
+       }
+       else
+       {
+               ANDROID_ERROR(("wl_natoe_get_ioctl: get command failed code %d\n", res));
+               res = BCME_ERROR;
+       }
+
+       return res;
+}
+
+static int
+wl_android_natoe_subcmd_enable(struct net_device *dev, const wl_natoe_sub_cmd_t *cmd,
+               char *command, wl_natoe_cmd_info_t *cmd_info)
+{
+       int ret = BCME_OK;
+       wl_natoe_ioc_t *natoe_ioc;
+       char *pcmd = command;
+       uint16 iocsz = sizeof(*natoe_ioc) + WL_NATOE_IOC_BUFSZ;
+       uint16 buflen = WL_NATOE_IOC_BUFSZ;
+       bcm_xtlv_t *pxtlv = NULL;
+       char *ioctl_buf = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       ioctl_buf = (char *)MALLOCZ(cfg->osh, WLC_IOCTL_MEDLEN);
+       if (!ioctl_buf) {
+               ANDROID_ERROR(("ioctl memory alloc failed\n"));
+               return -ENOMEM;
+       }
+
+       /* alloc mem for ioctl headr + tlv data */
+       natoe_ioc = (wl_natoe_ioc_t *)MALLOCZ(cfg->osh, iocsz);
+       if (!natoe_ioc) {
+               ANDROID_ERROR(("ioctl header memory alloc failed\n"));
+               MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_MEDLEN);
+               return -ENOMEM;
+       }
+
+       /* make up natoe cmd ioctl header */
+       natoe_ioc->version = htod16(WL_NATOE_IOCTL_VERSION);
+       natoe_ioc->id = htod16(cmd->id);
+       natoe_ioc->len = htod16(WL_NATOE_IOC_BUFSZ);
+       pxtlv = (bcm_xtlv_t *)natoe_ioc->data;
+
+       if(*pcmd == WL_IOCTL_ACTION_GET) { /* get */
+               iocsz = sizeof(*natoe_ioc) + sizeof(*pxtlv);
+               ret = wl_natoe_get_ioctl(dev, natoe_ioc, iocsz, ioctl_buf,
+                               WLC_IOCTL_MEDLEN, cmd_info);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("Fail to get iovar wl_android_natoe_subcmd_enable\n"));
+                       ret = -EINVAL;
+               }
+       } else {        /* set */
+               uint8 val = bcm_atoi(pcmd);
+
+               /* buflen is max tlv data we can write, it will be decremented as we pack */
+               /* save buflen at start */
+               uint16 buflen_at_start = buflen;
+
+               /* we'll adjust final ioc size at the end */
+               ret = bcm_pack_xtlv_entry((uint8**)&pxtlv, &buflen, WL_NATOE_XTLV_ENABLE,
+                       sizeof(uint8), &val, BCM_XTLV_OPTION_ALIGN32);
+
+               if (ret != BCME_OK) {
+                       ret = -EINVAL;
+                       goto exit;
+               }
+
+               /* adjust iocsz to the end of last data record */
+               natoe_ioc->len = (buflen_at_start - buflen);
+               iocsz = sizeof(*natoe_ioc) + natoe_ioc->len;
+
+               ret = wldev_iovar_setbuf(dev, "natoe",
+                               natoe_ioc, iocsz, ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("Fail to set iovar %d\n", ret));
+                       ret = -EINVAL;
+               }
+       }
+
+exit:
+       MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_MEDLEN);
+       MFREE(cfg->osh, natoe_ioc, iocsz);
+
+       return ret;
+}
+
+static int
+wl_android_natoe_subcmd_config_ips(struct net_device *dev,
+               const wl_natoe_sub_cmd_t *cmd, char *command, wl_natoe_cmd_info_t *cmd_info)
+{
+       int ret = BCME_OK;
+       wl_natoe_config_ips_t config_ips;
+       wl_natoe_ioc_t *natoe_ioc;
+       char *pcmd = command;
+       char *str;
+       uint16 iocsz = sizeof(*natoe_ioc) + WL_NATOE_IOC_BUFSZ;
+       uint16 buflen = WL_NATOE_IOC_BUFSZ;
+       bcm_xtlv_t *pxtlv = NULL;
+       char *ioctl_buf = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       ioctl_buf = (char *)MALLOCZ(cfg->osh, WLC_IOCTL_MEDLEN);
+       if (!ioctl_buf) {
+               ANDROID_ERROR(("ioctl memory alloc failed\n"));
+               return -ENOMEM;
+       }
+
+       /* alloc mem for ioctl headr + tlv data */
+       natoe_ioc = (wl_natoe_ioc_t *)MALLOCZ(cfg->osh, iocsz);
+       if (!natoe_ioc) {
+               ANDROID_ERROR(("ioctl header memory alloc failed\n"));
+               MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_MEDLEN);
+               return -ENOMEM;
+       }
+
+       /* make up natoe cmd ioctl header */
+       natoe_ioc->version = htod16(WL_NATOE_IOCTL_VERSION);
+       natoe_ioc->id = htod16(cmd->id);
+       natoe_ioc->len = htod16(WL_NATOE_IOC_BUFSZ);
+       pxtlv = (bcm_xtlv_t *)natoe_ioc->data;
+
+       if(*pcmd == WL_IOCTL_ACTION_GET) { /* get */
+               iocsz = sizeof(*natoe_ioc) + sizeof(*pxtlv);
+               ret = wl_natoe_get_ioctl(dev, natoe_ioc, iocsz, ioctl_buf,
+                               WLC_IOCTL_MEDLEN, cmd_info);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("Fail to get iovar wl_android_natoe_subcmd_config_ips\n"));
+                       ret = -EINVAL;
+               }
+       } else {        /* set */
+               /* buflen is max tlv data we can write, it will be decremented as we pack */
+               /* save buflen at start */
+               uint16 buflen_at_start = buflen;
+
+               bzero(&config_ips, sizeof(config_ips));
+
+               str = bcmstrtok(&pcmd, " ", NULL);
+               if (!str || !bcm_atoipv4(str, (struct ipv4_addr *)&config_ips.sta_ip)) {
+                       ANDROID_ERROR(("Invalid STA IP addr %s\n", str));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+
+               str = bcmstrtok(&pcmd, " ", NULL);
+               if (!str || !bcm_atoipv4(str, (struct ipv4_addr *)&config_ips.sta_netmask)) {
+                       ANDROID_ERROR(("Invalid STA netmask %s\n", str));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+
+               str = bcmstrtok(&pcmd, " ", NULL);
+               if (!str || !bcm_atoipv4(str, (struct ipv4_addr *)&config_ips.sta_router_ip)) {
+                       ANDROID_ERROR(("Invalid STA router IP addr %s\n", str));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+
+               str = bcmstrtok(&pcmd, " ", NULL);
+               if (!str || !bcm_atoipv4(str, (struct ipv4_addr *)&config_ips.sta_dnsip)) {
+                       ANDROID_ERROR(("Invalid STA DNS IP addr %s\n", str));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+
+               str = bcmstrtok(&pcmd, " ", NULL);
+               if (!str || !bcm_atoipv4(str, (struct ipv4_addr *)&config_ips.ap_ip)) {
+                       ANDROID_ERROR(("Invalid AP IP addr %s\n", str));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+
+               str = bcmstrtok(&pcmd, " ", NULL);
+               if (!str || !bcm_atoipv4(str, (struct ipv4_addr *)&config_ips.ap_netmask)) {
+                       ANDROID_ERROR(("Invalid AP netmask %s\n", str));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+
+               ret = bcm_pack_xtlv_entry((uint8**)&pxtlv,
+                               &buflen, WL_NATOE_XTLV_CONFIG_IPS, sizeof(config_ips),
+                               &config_ips, BCM_XTLV_OPTION_ALIGN32);
+
+               if (ret != BCME_OK) {
+                       ret = -EINVAL;
+                       goto exit;
+               }
+
+               /* adjust iocsz to the end of last data record */
+               natoe_ioc->len = (buflen_at_start - buflen);
+               iocsz = sizeof(*natoe_ioc) + natoe_ioc->len;
+
+               ret = wldev_iovar_setbuf(dev, "natoe",
+                               natoe_ioc, iocsz, ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("Fail to set iovar %d\n", ret));
+                       ret = -EINVAL;
+               }
+       }
+
+exit:
+       MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_MEDLEN);
+       MFREE(cfg->osh, natoe_ioc, sizeof(*natoe_ioc) + WL_NATOE_IOC_BUFSZ);
+
+       return ret;
+}
+
+static int
+wl_android_natoe_subcmd_config_ports(struct net_device *dev,
+               const wl_natoe_sub_cmd_t *cmd, char *command, wl_natoe_cmd_info_t *cmd_info)
+{
+       int ret = BCME_OK;
+       wl_natoe_ports_config_t ports_config;
+       wl_natoe_ioc_t *natoe_ioc;
+       char *pcmd = command;
+       char *str;
+       uint16 iocsz = sizeof(*natoe_ioc) + WL_NATOE_IOC_BUFSZ;
+       uint16 buflen = WL_NATOE_IOC_BUFSZ;
+       bcm_xtlv_t *pxtlv = NULL;
+       char *ioctl_buf = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       ioctl_buf = (char *)MALLOCZ(cfg->osh, WLC_IOCTL_MEDLEN);
+       if (!ioctl_buf) {
+               ANDROID_ERROR(("ioctl memory alloc failed\n"));
+               return -ENOMEM;
+       }
+
+       /* alloc mem for ioctl headr + tlv data */
+       natoe_ioc = (wl_natoe_ioc_t *)MALLOCZ(cfg->osh, iocsz);
+       if (!natoe_ioc) {
+               ANDROID_ERROR(("ioctl header memory alloc failed\n"));
+               MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_MEDLEN);
+               return -ENOMEM;
+       }
+
+       /* make up natoe cmd ioctl header */
+       natoe_ioc->version = htod16(WL_NATOE_IOCTL_VERSION);
+       natoe_ioc->id = htod16(cmd->id);
+       natoe_ioc->len = htod16(WL_NATOE_IOC_BUFSZ);
+       pxtlv = (bcm_xtlv_t *)natoe_ioc->data;
+
+       if(*pcmd == WL_IOCTL_ACTION_GET) { /* get */
+               iocsz = sizeof(*natoe_ioc) + sizeof(*pxtlv);
+               ret = wl_natoe_get_ioctl(dev, natoe_ioc, iocsz, ioctl_buf,
+                               WLC_IOCTL_MEDLEN, cmd_info);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("Fail to get iovar wl_android_natoe_subcmd_config_ports\n"));
+                       ret = -EINVAL;
+               }
+       } else {        /* set */
+               /* buflen is max tlv data we can write, it will be decremented as we pack */
+               /* save buflen at start */
+               uint16 buflen_at_start = buflen;
+
+               bzero(&ports_config, sizeof(ports_config));
+
+               str = bcmstrtok(&pcmd, " ", NULL);
+               if (!str) {
+                       ANDROID_ERROR(("Invalid port string %s\n", str));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+               ports_config.start_port_num = htod16(bcm_atoi(str));
+
+               str = bcmstrtok(&pcmd, " ", NULL);
+               if (!str) {
+                       ANDROID_ERROR(("Invalid port string %s\n", str));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+               ports_config.no_of_ports = htod16(bcm_atoi(str));
+
+               if ((uint32)(ports_config.start_port_num + ports_config.no_of_ports) >
+                               NATOE_MAX_PORT_NUM) {
+                       ANDROID_ERROR(("Invalid port configuration\n"));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+               ret = bcm_pack_xtlv_entry((uint8**)&pxtlv,
+                               &buflen, WL_NATOE_XTLV_CONFIG_PORTS, sizeof(ports_config),
+                               &ports_config, BCM_XTLV_OPTION_ALIGN32);
+
+               if (ret != BCME_OK) {
+                       ret = -EINVAL;
+                       goto exit;
+               }
+
+               /* adjust iocsz to the end of last data record */
+               natoe_ioc->len = (buflen_at_start - buflen);
+               iocsz = sizeof(*natoe_ioc) + natoe_ioc->len;
+
+               ret = wldev_iovar_setbuf(dev, "natoe",
+                               natoe_ioc, iocsz, ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("Fail to set iovar %d\n", ret));
+                       ret = -EINVAL;
+               }
+       }
+
+exit:
+       MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_MEDLEN);
+       MFREE(cfg->osh, natoe_ioc, sizeof(*natoe_ioc) + WL_NATOE_IOC_BUFSZ);
+
+       return ret;
+}
+
+static int
+wl_android_natoe_subcmd_dbg_stats(struct net_device *dev, const wl_natoe_sub_cmd_t *cmd,
+               char *command, wl_natoe_cmd_info_t *cmd_info)
+{
+       int ret = BCME_OK;
+       wl_natoe_ioc_t *natoe_ioc;
+       char *pcmd = command;
+       uint16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+       uint16 iocsz = sizeof(*natoe_ioc) + WL_NATOE_DBG_STATS_BUFSZ;
+       uint16 buflen = WL_NATOE_DBG_STATS_BUFSZ;
+       bcm_xtlv_t *pxtlv = NULL;
+       char *ioctl_buf = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       ioctl_buf = (char *)MALLOCZ(cfg->osh, WLC_IOCTL_MAXLEN);
+       if (!ioctl_buf) {
+               ANDROID_ERROR(("ioctl memory alloc failed\n"));
+               return -ENOMEM;
+       }
+
+       /* alloc mem for ioctl headr + tlv data */
+       natoe_ioc = (wl_natoe_ioc_t *)MALLOCZ(cfg->osh, iocsz);
+       if (!natoe_ioc) {
+               ANDROID_ERROR(("ioctl header memory alloc failed\n"));
+               MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_MAXLEN);
+               return -ENOMEM;
+       }
+
+       /* make up natoe cmd ioctl header */
+       natoe_ioc->version = htod16(WL_NATOE_IOCTL_VERSION);
+       natoe_ioc->id = htod16(cmd->id);
+       natoe_ioc->len = htod16(WL_NATOE_DBG_STATS_BUFSZ);
+       pxtlv = (bcm_xtlv_t *)natoe_ioc->data;
+
+       if(*pcmd == WL_IOCTL_ACTION_GET) { /* get */
+               iocsz = sizeof(*natoe_ioc) + sizeof(*pxtlv);
+               ret = wl_natoe_get_ioctl(dev, natoe_ioc, iocsz, ioctl_buf,
+                               WLC_IOCTL_MAXLEN, cmd_info);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("Fail to get iovar wl_android_natoe_subcmd_dbg_stats\n"));
+                       ret = -EINVAL;
+               }
+       } else {        /* set */
+               uint8 val = bcm_atoi(pcmd);
+
+               /* buflen is max tlv data we can write, it will be decremented as we pack */
+               /* save buflen at start */
+               uint16 buflen_at_start = buflen;
+
+               /* we'll adjust final ioc size at the end */
+               ret = bcm_pack_xtlv_entry((uint8**)&pxtlv, &buflen, WL_NATOE_XTLV_ENABLE,
+                       sizeof(uint8), &val, BCM_XTLV_OPTION_ALIGN32);
+
+               if (ret != BCME_OK) {
+                       ret = -EINVAL;
+                       goto exit;
+               }
+
+               /* adjust iocsz to the end of last data record */
+               natoe_ioc->len = (buflen_at_start - buflen);
+               iocsz = sizeof(*natoe_ioc) + natoe_ioc->len;
+
+               ret = wldev_iovar_setbuf(dev, "natoe",
+                               natoe_ioc, iocsz, ioctl_buf, WLC_IOCTL_MAXLEN, NULL);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("Fail to set iovar %d\n", ret));
+                       ret = -EINVAL;
+               }
+       }
+
+exit:
+       MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_MAXLEN);
+       MFREE(cfg->osh, natoe_ioc, sizeof(*natoe_ioc) + WL_NATOE_DBG_STATS_BUFSZ);
+
+       return ret;
+}
+
+static int
+wl_android_natoe_subcmd_tbl_cnt(struct net_device *dev, const wl_natoe_sub_cmd_t *cmd,
+               char *command, wl_natoe_cmd_info_t *cmd_info)
+{
+       int ret = BCME_OK;
+       wl_natoe_ioc_t *natoe_ioc;
+       char *pcmd = command;
+       uint16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+       uint16 iocsz = sizeof(*natoe_ioc) + WL_NATOE_IOC_BUFSZ;
+       uint16 buflen = WL_NATOE_IOC_BUFSZ;
+       bcm_xtlv_t *pxtlv = NULL;
+       char *ioctl_buf = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       ioctl_buf = (char *)MALLOCZ(cfg->osh, WLC_IOCTL_MEDLEN);
+       if (!ioctl_buf) {
+               ANDROID_ERROR(("ioctl memory alloc failed\n"));
+               return -ENOMEM;
+       }
+
+       /* alloc mem for ioctl headr + tlv data */
+       natoe_ioc = (wl_natoe_ioc_t *)MALLOCZ(cfg->osh, iocsz);
+       if (!natoe_ioc) {
+               ANDROID_ERROR(("ioctl header memory alloc failed\n"));
+               MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_MEDLEN);
+               return -ENOMEM;
+       }
+
+       /* make up natoe cmd ioctl header */
+       natoe_ioc->version = htod16(WL_NATOE_IOCTL_VERSION);
+       natoe_ioc->id = htod16(cmd->id);
+       natoe_ioc->len = htod16(WL_NATOE_IOC_BUFSZ);
+       pxtlv = (bcm_xtlv_t *)natoe_ioc->data;
+
+       if(*pcmd == WL_IOCTL_ACTION_GET) { /* get */
+               iocsz = sizeof(*natoe_ioc) + sizeof(*pxtlv);
+               ret = wl_natoe_get_ioctl(dev, natoe_ioc, iocsz, ioctl_buf,
+                               WLC_IOCTL_MEDLEN, cmd_info);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("Fail to get iovar wl_android_natoe_subcmd_tbl_cnt\n"));
+                       ret = -EINVAL;
+               }
+       } else {        /* set */
+               uint32 val = bcm_atoi(pcmd);
+
+               /* buflen is max tlv data we can write, it will be decremented as we pack */
+               /* save buflen at start */
+               uint16 buflen_at_start = buflen;
+
+               /* we'll adjust final ioc size at the end */
+               ret = bcm_pack_xtlv_entry((uint8**)&pxtlv, &buflen, WL_NATOE_XTLV_TBL_CNT,
+                       sizeof(uint32), &val, BCM_XTLV_OPTION_ALIGN32);
+
+               if (ret != BCME_OK) {
+                       ret = -EINVAL;
+                       goto exit;
+               }
+
+               /* adjust iocsz to the end of last data record */
+               natoe_ioc->len = (buflen_at_start - buflen);
+               iocsz = sizeof(*natoe_ioc) + natoe_ioc->len;
+
+               ret = wldev_iovar_setbuf(dev, "natoe",
+                               natoe_ioc, iocsz, ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("Fail to set iovar %d\n", ret));
+                       ret = -EINVAL;
+               }
+       }
+
+exit:
+       MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_MEDLEN);
+       MFREE(cfg->osh, natoe_ioc, sizeof(*natoe_ioc) + WL_NATOE_IOC_BUFSZ);
+
+       return ret;
+}
+
+#endif /* WL_NATOE */
+
+#ifdef WL_MBO
+static int
+wl_android_process_mbo_cmd(struct net_device *dev, char *command, int total_len)
+{
+       int ret = BCME_ERROR;
+       char *pcmd = command;
+       char *str = NULL;
+       wl_drv_cmd_info_t cmd_info;
+       const wl_drv_sub_cmd_t *mbo_cmd = &mbo_cmd_list[0];
+
+       /* skip to cmd name after "mbo" */
+       str = bcmstrtok(&pcmd, " ", NULL);
+
+       /* If mbo subcmd name is not provided, return error */
+       if (*pcmd == '\0') {
+               ANDROID_ERROR(("mbo subcmd not provided %s\n", __FUNCTION__));
+               ret = -EINVAL;
+               return ret;
+       }
+
+       /* get the mbo command name to str */
+       str = bcmstrtok(&pcmd, " ", NULL);
+
+       while (mbo_cmd->name != NULL) {
+               if (strnicmp(mbo_cmd->name, str, strlen(mbo_cmd->name)) == 0) {
+                       /* dispatch cmd to appropriate handler */
+                       if (mbo_cmd->handler) {
+                               cmd_info.command = command;
+                               cmd_info.tot_len = total_len;
+                               ret = mbo_cmd->handler(dev, mbo_cmd, pcmd, &cmd_info);
+                       }
+                       return ret;
+               }
+               mbo_cmd++;
+       }
+       return ret;
+}
+
+static int
+wl_android_send_wnm_notif(struct net_device *dev, bcm_iov_buf_t *iov_buf,
+       uint16 iov_buf_len, uint8 *iov_resp, uint16 iov_resp_len, uint8 sub_elem_type)
+{
+       int ret = BCME_OK;
+       uint8 *pxtlv = NULL;
+       uint16 iovlen = 0;
+       uint16 buflen = 0, buflen_start = 0;
+
+       memset_s(iov_buf, iov_buf_len, 0, iov_buf_len);
+       iov_buf->version = WL_MBO_IOV_VERSION;
+       iov_buf->id = WL_MBO_CMD_SEND_NOTIF;
+       buflen = buflen_start = iov_buf_len - sizeof(bcm_iov_buf_t);
+       pxtlv = (uint8 *)&iov_buf->data[0];
+       ret = bcm_pack_xtlv_entry(&pxtlv, &buflen, WL_MBO_XTLV_SUB_ELEM_TYPE,
+               sizeof(sub_elem_type), &sub_elem_type, BCM_XTLV_OPTION_ALIGN32);
+       if (ret != BCME_OK) {
+               return ret;
+       }
+       iov_buf->len = buflen_start - buflen;
+       iovlen = sizeof(bcm_iov_buf_t) + iov_buf->len;
+       ret = wldev_iovar_setbuf(dev, "mbo",
+                       iov_buf, iovlen, iov_resp, WLC_IOCTL_MAXLEN, NULL);
+       if (ret != BCME_OK) {
+               ANDROID_ERROR(("Fail to sent wnm notif %d\n", ret));
+       }
+       return ret;
+}
+
+static int
+wl_android_mbo_resp_parse_cbfn(void *ctx, const uint8 *data, uint16 type, uint16 len)
+{
+       wl_drv_cmd_info_t *cmd_info = (wl_drv_cmd_info_t *)ctx;
+       uint8 *command = cmd_info->command;
+       uint16 total_len = cmd_info->tot_len;
+       uint16 bytes_written = 0;
+
+       UNUSED_PARAMETER(len);
+       /* TODO: validate data value */
+       if (data == NULL) {
+               ANDROID_ERROR(("%s: Bad argument !!\n", __FUNCTION__));
+               return -EINVAL;
+       }
+       switch (type) {
+               case WL_MBO_XTLV_CELL_DATA_CAP:
+               {
+                       bytes_written = snprintf(command, total_len, "cell_data_cap: %u\n", *data);
+                       cmd_info->bytes_written = bytes_written;
+               }
+               break;
+               default:
+                       ANDROID_ERROR(("%s: Unknown tlv %u\n", __FUNCTION__, type));
+       }
+       return BCME_OK;
+}
+
+static int
+wl_android_mbo_subcmd_cell_data_cap(struct net_device *dev, const wl_drv_sub_cmd_t *cmd,
+               char *command, wl_drv_cmd_info_t *cmd_info)
+{
+       int ret = BCME_OK;
+       uint8 *pxtlv = NULL;
+       uint16 buflen = 0, buflen_start = 0;
+       uint16 iovlen = 0;
+       char *pcmd = command;
+       bcm_iov_buf_t *iov_buf = NULL;
+       bcm_iov_buf_t *p_resp = NULL;
+       uint8 *iov_resp = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       uint16 version;
+
+       /* first get the configured value */
+       iov_buf = (bcm_iov_buf_t *)MALLOCZ(cfg->osh, WLC_IOCTL_MEDLEN);
+       if (iov_buf == NULL) {
+               ret = -ENOMEM;
+               ANDROID_ERROR(("iov buf memory alloc exited\n"));
+               goto exit;
+       }
+       iov_resp = (uint8 *)MALLOCZ(cfg->osh, WLC_IOCTL_MAXLEN);
+       if (iov_resp == NULL) {
+               ret = -ENOMEM;
+               ANDROID_ERROR(("iov resp memory alloc exited\n"));
+               goto exit;
+       }
+
+       /* fill header */
+       iov_buf->version = WL_MBO_IOV_VERSION;
+       iov_buf->id = WL_MBO_CMD_CELLULAR_DATA_CAP;
+
+       ret = wldev_iovar_getbuf(dev, "mbo", iov_buf, WLC_IOCTL_MEDLEN, iov_resp,
+               WLC_IOCTL_MAXLEN,
+               NULL);
+       if (ret != BCME_OK) {
+               goto exit;
+       }
+       p_resp = (bcm_iov_buf_t *)iov_resp;
+
+       /* get */
+       if (*pcmd == WL_IOCTL_ACTION_GET) {
+               /* Check for version */
+               version = dtoh16(*(uint16 *)iov_resp);
+               if (version != WL_MBO_IOV_VERSION) {
+                       ret = -EINVAL;
+               }
+               if (p_resp->id == WL_MBO_CMD_CELLULAR_DATA_CAP) {
+                       ret = bcm_unpack_xtlv_buf((void *)cmd_info, (uint8 *)p_resp->data,
+                               p_resp->len, BCM_XTLV_OPTION_ALIGN32,
+                               wl_android_mbo_resp_parse_cbfn);
+                       if (ret == BCME_OK) {
+                               ret = cmd_info->bytes_written;
+                       }
+               } else {
+                       ret = -EINVAL;
+                       ANDROID_ERROR(("Mismatch: resp id %d req id %d\n", p_resp->id, cmd->id));
+                       goto exit;
+               }
+       } else {
+               uint8 cell_cap = bcm_atoi(pcmd);
+               const uint8* old_cell_cap = NULL;
+               uint16 len = 0;
+
+               old_cell_cap = bcm_get_data_from_xtlv_buf((uint8 *)p_resp->data, p_resp->len,
+                       WL_MBO_XTLV_CELL_DATA_CAP, &len, BCM_XTLV_OPTION_ALIGN32);
+               if (old_cell_cap && *old_cell_cap == cell_cap) {
+                       ANDROID_ERROR(("No change is cellular data capability\n"));
+                       /* No change in value */
+                       goto exit;
+               }
+
+               buflen = buflen_start = WLC_IOCTL_MEDLEN - sizeof(bcm_iov_buf_t);
+
+               if (cell_cap < MBO_CELL_DATA_CONN_AVAILABLE ||
+                       cell_cap > MBO_CELL_DATA_CONN_NOT_CAPABLE) {
+                       ANDROID_ERROR(("wrong value %u\n", cell_cap));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+               pxtlv = (uint8 *)&iov_buf->data[0];
+               ret = bcm_pack_xtlv_entry(&pxtlv, &buflen, WL_MBO_XTLV_CELL_DATA_CAP,
+                       sizeof(cell_cap), &cell_cap, BCM_XTLV_OPTION_ALIGN32);
+               if (ret != BCME_OK) {
+                       goto exit;
+               }
+               iov_buf->len = buflen_start - buflen;
+               iovlen = sizeof(bcm_iov_buf_t) + iov_buf->len;
+               ret = wldev_iovar_setbuf(dev, "mbo",
+                               iov_buf, iovlen, iov_resp, WLC_IOCTL_MAXLEN, NULL);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("Fail to set iovar %d\n", ret));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+               /* Skip for CUSTOMER_HW4 - WNM notification
+                * for cellular data capability is handled by host
+                */
+#if !defined(CUSTOMER_HW4)
+               /* send a WNM notification request to associated AP */
+               if (wl_get_drv_status(cfg, CONNECTED, dev)) {
+                       ANDROID_INFO(("Sending WNM Notif\n"));
+                       ret = wl_android_send_wnm_notif(dev, iov_buf, WLC_IOCTL_MEDLEN,
+                               iov_resp, WLC_IOCTL_MAXLEN, MBO_ATTR_CELL_DATA_CAP);
+                       if (ret != BCME_OK) {
+                               ANDROID_ERROR(("Fail to send WNM notification %d\n", ret));
+                               ret = -EINVAL;
+                       }
+               }
+#endif /* CUSTOMER_HW4 */
+       }
+exit:
+       if (iov_buf) {
+               MFREE(cfg->osh, iov_buf, WLC_IOCTL_MEDLEN);
+       }
+       if (iov_resp) {
+               MFREE(cfg->osh, iov_resp, WLC_IOCTL_MAXLEN);
+       }
+       return ret;
+}
+
+static int
+wl_android_mbo_non_pref_chan_parse_cbfn(void *ctx, const uint8 *data, uint16 type, uint16 len)
+{
+       wl_drv_cmd_info_t *cmd_info = (wl_drv_cmd_info_t *)ctx;
+       uint8 *command = cmd_info->command + cmd_info->bytes_written;
+       uint16 total_len = cmd_info->tot_len;
+       uint16 bytes_written = 0;
+
+       ANDROID_INFO(("Total bytes written at begining %u\n", cmd_info->bytes_written));
+       UNUSED_PARAMETER(len);
+       if (data == NULL) {
+               ANDROID_ERROR(("%s: Bad argument !!\n", __FUNCTION__));
+               return -EINVAL;
+       }
+       switch (type) {
+               case WL_MBO_XTLV_OPCLASS:
+               {
+                       bytes_written = snprintf(command, total_len, "%u:", *data);
+                       ANDROID_ERROR(("wr %u %u\n", bytes_written, *data));
+                       command += bytes_written;
+                       cmd_info->bytes_written += bytes_written;
+               }
+               break;
+               case WL_MBO_XTLV_CHAN:
+               {
+                       bytes_written = snprintf(command, total_len, "%u:", *data);
+                       ANDROID_ERROR(("wr %u\n", bytes_written));
+                       command += bytes_written;
+                       cmd_info->bytes_written += bytes_written;
+               }
+               break;
+               case WL_MBO_XTLV_PREFERENCE:
+               {
+                       bytes_written = snprintf(command, total_len, "%u:", *data);
+                       ANDROID_ERROR(("wr %u\n", bytes_written));
+                       command += bytes_written;
+                       cmd_info->bytes_written += bytes_written;
+               }
+               break;
+               case WL_MBO_XTLV_REASON_CODE:
+               {
+                       bytes_written = snprintf(command, total_len, "%u ", *data);
+                       ANDROID_ERROR(("wr %u\n", bytes_written));
+                       command += bytes_written;
+                       cmd_info->bytes_written += bytes_written;
+               }
+               break;
+               default:
+                       ANDROID_ERROR(("%s: Unknown tlv %u\n", __FUNCTION__, type));
+       }
+       ANDROID_INFO(("Total bytes written %u\n", cmd_info->bytes_written));
+       return BCME_OK;
+}
+
+static int
+wl_android_mbo_subcmd_non_pref_chan(struct net_device *dev,
+               const wl_drv_sub_cmd_t *cmd, char *command,
+               wl_drv_cmd_info_t *cmd_info)
+{
+       int ret = BCME_OK;
+       uint8 *pxtlv = NULL;
+       uint16 buflen = 0, buflen_start = 0;
+       uint16 iovlen = 0;
+       char *pcmd = command;
+       bcm_iov_buf_t *iov_buf = NULL;
+       bcm_iov_buf_t *p_resp = NULL;
+       uint8 *iov_resp = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       uint16 version;
+
+       ANDROID_ERROR(("%s:%d\n", __FUNCTION__, __LINE__));
+       iov_buf = (bcm_iov_buf_t *)MALLOCZ(cfg->osh, WLC_IOCTL_MEDLEN);
+       if (iov_buf == NULL) {
+               ret = -ENOMEM;
+               ANDROID_ERROR(("iov buf memory alloc exited\n"));
+               goto exit;
+       }
+       iov_resp = (uint8 *)MALLOCZ(cfg->osh, WLC_IOCTL_MAXLEN);
+       if (iov_resp == NULL) {
+               ret = -ENOMEM;
+               ANDROID_ERROR(("iov resp memory alloc exited\n"));
+               goto exit;
+       }
+       /* get */
+       if (*pcmd == WL_IOCTL_ACTION_GET) {
+               /* fill header */
+               iov_buf->version = WL_MBO_IOV_VERSION;
+               iov_buf->id = WL_MBO_CMD_LIST_CHAN_PREF;
+
+               ret = wldev_iovar_getbuf(dev, "mbo", iov_buf, WLC_IOCTL_MEDLEN, iov_resp,
+                               WLC_IOCTL_MAXLEN, NULL);
+               if (ret != BCME_OK) {
+                       goto exit;
+               }
+               p_resp = (bcm_iov_buf_t *)iov_resp;
+               /* Check for version */
+               version = dtoh16(*(uint16 *)iov_resp);
+               if (version != WL_MBO_IOV_VERSION) {
+                       ANDROID_ERROR(("Version mismatch. returned ver %u expected %u\n",
+                               version, WL_MBO_IOV_VERSION));
+                       ret = -EINVAL;
+               }
+               if (p_resp->id == WL_MBO_CMD_LIST_CHAN_PREF) {
+                       ret = bcm_unpack_xtlv_buf((void *)cmd_info, (uint8 *)p_resp->data,
+                               p_resp->len, BCM_XTLV_OPTION_ALIGN32,
+                               wl_android_mbo_non_pref_chan_parse_cbfn);
+                       if (ret == BCME_OK) {
+                               ret = cmd_info->bytes_written;
+                       }
+               } else {
+                       ret = -EINVAL;
+                       ANDROID_ERROR(("Mismatch: resp id %d req id %d\n", p_resp->id, cmd->id));
+                       goto exit;
+               }
+       } else {
+               char *str = pcmd;
+               uint opcl = 0, ch = 0, pref = 0, rc = 0;
+
+               str = bcmstrtok(&pcmd, " ", NULL);
+               if (!(strnicmp(str, "set", 3)) || (!strnicmp(str, "clear", 5))) {
+                       /* delete all configurations */
+                       iov_buf->version = WL_MBO_IOV_VERSION;
+                       iov_buf->id = WL_MBO_CMD_DEL_CHAN_PREF;
+                       iov_buf->len = 0;
+                       iovlen = sizeof(bcm_iov_buf_t) + iov_buf->len;
+                       ret = wldev_iovar_setbuf(dev, "mbo",
+                               iov_buf, iovlen, iov_resp, WLC_IOCTL_MAXLEN, NULL);
+                       if (ret != BCME_OK) {
+                               ANDROID_ERROR(("Fail to set iovar %d\n", ret));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+               } else {
+                       ANDROID_ERROR(("Unknown command %s\n", str));
+                       goto exit;
+               }
+               /* parse non pref channel list */
+               if (strnicmp(str, "set", 3) == 0) {
+                       uint8 cnt = 0;
+                       str = bcmstrtok(&pcmd, " ", NULL);
+                       while (str != NULL) {
+                               ret = sscanf(str, "%u:%u:%u:%u", &opcl, &ch, &pref, &rc);
+                               ANDROID_ERROR(("buflen %u op %u, ch %u, pref %u rc %u\n",
+                                       buflen, opcl, ch, pref, rc));
+                               if (ret != 4) {
+                                       ANDROID_ERROR(("Not all parameter presents\n"));
+                                       ret = -EINVAL;
+                               }
+                               /* TODO: add a validation check here */
+                               memset_s(iov_buf, WLC_IOCTL_MEDLEN, 0, WLC_IOCTL_MEDLEN);
+                               buflen = buflen_start = WLC_IOCTL_MEDLEN;
+                               pxtlv = (uint8 *)&iov_buf->data[0];
+                               /* opclass */
+                               ret = bcm_pack_xtlv_entry(&pxtlv, &buflen, WL_MBO_XTLV_OPCLASS,
+                                       sizeof(uint8), (uint8 *)&opcl, BCM_XTLV_OPTION_ALIGN32);
+                               if (ret != BCME_OK) {
+                                       goto exit;
+                               }
+                               /* channel */
+                               ret = bcm_pack_xtlv_entry(&pxtlv, &buflen, WL_MBO_XTLV_CHAN,
+                                       sizeof(uint8), (uint8 *)&ch, BCM_XTLV_OPTION_ALIGN32);
+                               if (ret != BCME_OK) {
+                                       goto exit;
+                               }
+                               /* preference */
+                               ret = bcm_pack_xtlv_entry(&pxtlv, &buflen, WL_MBO_XTLV_PREFERENCE,
+                                       sizeof(uint8), (uint8 *)&pref, BCM_XTLV_OPTION_ALIGN32);
+                               if (ret != BCME_OK) {
+                                       goto exit;
+                               }
+                               /* reason */
+                               ret = bcm_pack_xtlv_entry(&pxtlv, &buflen, WL_MBO_XTLV_REASON_CODE,
+                                       sizeof(uint8), (uint8 *)&rc, BCM_XTLV_OPTION_ALIGN32);
+                               if (ret != BCME_OK) {
+                                       goto exit;
+                               }
+                               ANDROID_ERROR(("len %u\n", (buflen_start - buflen)));
+                               /* Now set the new non pref channels */
+                               iov_buf->version = WL_MBO_IOV_VERSION;
+                               iov_buf->id = WL_MBO_CMD_ADD_CHAN_PREF;
+                               iov_buf->len = buflen_start - buflen;
+                               iovlen = sizeof(bcm_iov_buf_t) + iov_buf->len;
+                               ret = wldev_iovar_setbuf(dev, "mbo",
+                                       iov_buf, iovlen, iov_resp, WLC_IOCTL_MEDLEN, NULL);
+                               if (ret != BCME_OK) {
+                                       ANDROID_ERROR(("Fail to set iovar %d\n", ret));
+                                       ret = -EINVAL;
+                                       goto exit;
+                               }
+                               cnt++;
+                               if (cnt >= MBO_MAX_CHAN_PREF_ENTRIES) {
+                                       break;
+                               }
+                               ANDROID_ERROR(("%d cnt %u\n", __LINE__, cnt));
+                               str = bcmstrtok(&pcmd, " ", NULL);
+                       }
+               }
+               /* send a WNM notification request to associated AP */
+               if (wl_get_drv_status(cfg, CONNECTED, dev)) {
+                       ANDROID_INFO(("Sending WNM Notif\n"));
+                       ret = wl_android_send_wnm_notif(dev, iov_buf, WLC_IOCTL_MEDLEN,
+                               iov_resp, WLC_IOCTL_MAXLEN, MBO_ATTR_NON_PREF_CHAN_REPORT);
+                       if (ret != BCME_OK) {
+                               ANDROID_ERROR(("Fail to send WNM notification %d\n", ret));
+                               ret = -EINVAL;
+                       }
+               }
+       }
+exit:
+       if (iov_buf) {
+               MFREE(cfg->osh, iov_buf, WLC_IOCTL_MEDLEN);
+       }
+       if (iov_resp) {
+               MFREE(cfg->osh, iov_resp, WLC_IOCTL_MAXLEN);
+       }
+       return ret;
+}
+#endif /* WL_MBO */
+
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+#ifdef SUPPORT_AMPDU_MPDU_CMD
+/* CMD_AMPDU_MPDU */
+static int
+wl_android_set_ampdu_mpdu(struct net_device *dev, const char* string_num)
+{
+       int err = 0;
+       int ampdu_mpdu;
+
+       ampdu_mpdu = bcm_atoi(string_num);
+
+       if (ampdu_mpdu > 32) {
+               ANDROID_ERROR(("wl_android_set_ampdu_mpdu : ampdu_mpdu MAX value is 32.\n"));
+               return -1;
+       }
+
+       ANDROID_ERROR(("wl_android_set_ampdu_mpdu : ampdu_mpdu = %d\n", ampdu_mpdu));
+       err = wldev_iovar_setint(dev, "ampdu_mpdu", ampdu_mpdu);
+       if (err < 0) {
+               ANDROID_ERROR(("wl_android_set_ampdu_mpdu : ampdu_mpdu set error. %d\n", err));
+               return -1;
+       }
+
+       return 0;
+}
+#endif /* SUPPORT_AMPDU_MPDU_CMD */
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+
+#if defined(CONFIG_WLAN_BEYONDX) || defined(CONFIG_SEC_5GMODEL)
+extern int wl_cfg80211_send_msg_to_ril(void);
+extern void wl_cfg80211_register_dev_ril_bridge_event_notifier(void);
+extern void wl_cfg80211_unregister_dev_ril_bridge_event_notifier(void);
+extern int g_mhs_chan_for_cpcoex;
+#endif /* CONFIG_WLAN_BEYONDX || defined(CONFIG_SEC_5GMODEL) */
+
+#if defined(WL_SUPPORT_AUTO_CHANNEL)
+int
+wl_android_set_spect(struct net_device *dev, int spect)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       int wlc_down = 1;
+       int wlc_up = 1;
+       int err = BCME_OK;
+
+       if (!wl_get_drv_status_all(cfg, CONNECTED)) {
+               err = wldev_ioctl_set(dev, WLC_DOWN, &wlc_down, sizeof(wlc_down));
+               if (err) {
+                       ANDROID_ERROR(("%s: WLC_DOWN failed: code: %d\n", __func__, err));
+                       return err;
+               }
+
+               err = wldev_ioctl_set(dev, WLC_SET_SPECT_MANAGMENT, &spect, sizeof(spect));
+               if (err) {
+                       ANDROID_ERROR(("%s: error setting spect: code: %d\n", __func__, err));
+                       return err;
+               }
+
+               err = wldev_ioctl_set(dev, WLC_UP, &wlc_up, sizeof(wlc_up));
+               if (err) {
+                       ANDROID_ERROR(("%s: WLC_UP failed: code: %d\n", __func__, err));
+                       return err;
+               }
+       }
+       return err;
+}
+
+/* SoftAP feature */
+#define APCS_BAND_2G_LEGACY1   20
+#define APCS_BAND_2G_LEGACY2   0
+#define APCS_BAND_AUTO         "band=auto"
+#define APCS_BAND_2G           "band=2g"
+#define APCS_BAND_5G           "band=5g"
+#define APCS_MAX_2G_CHANNELS   11
+#define APCS_MAX_RETRY         10
+#define APCS_DEFAULT_2G_CH     1
+#define APCS_DEFAULT_5G_CH     149
+
+static int
+wl_android_set_auto_channel(struct net_device *dev, const char* cmd_str,
+       char* command, int total_len)
+{
+       int channel = 0;
+       int chosen = 0;
+       int retry = 0;
+       int ret = 0;
+       int spect = 0;
+       u8 *reqbuf = NULL;
+       uint32 band = WLC_BAND_2G, sta_band = WLC_BAND_2G;
+       uint32 buf_size;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       if (cmd_str) {
+               ANDROID_INFO(("Command: %s len:%d \n", cmd_str, (int)strlen(cmd_str)));
+               if (strnicmp(cmd_str, APCS_BAND_AUTO, strlen(APCS_BAND_AUTO)) == 0) {
+                       band = WLC_BAND_AUTO;
+               } else if (strnicmp(cmd_str, APCS_BAND_5G, strlen(APCS_BAND_5G)) == 0) {
+                       band = WLC_BAND_5G;
+               } else if (strnicmp(cmd_str, APCS_BAND_2G, strlen(APCS_BAND_2G)) == 0) {
+                       band = WLC_BAND_2G;
+               } else {
+                       /*
+                        * For backward compatibility: Some platforms used to issue argument 20 or 0
+                        * to enforce the 2G channel selection
+                        */
+                       channel = bcm_atoi(cmd_str);
+                       if ((channel == APCS_BAND_2G_LEGACY1) ||
+                               (channel == APCS_BAND_2G_LEGACY2)) {
+                               band = WLC_BAND_2G;
+                       } else {
+                               ANDROID_ERROR(("Invalid argument\n"));
+                               return -EINVAL;
+                       }
+               }
+       } else {
+               /* If no argument is provided, default to 2G */
+               ANDROID_ERROR(("No argument given default to 2.4G scan\n"));
+               band = WLC_BAND_2G;
+       }
+       ANDROID_INFO(("HAPD_AUTO_CHANNEL = %d, band=%d \n", channel, band));
+
+#if defined(CONFIG_WLAN_BEYONDX) || defined(CONFIG_SEC_5GMODEL)
+       wl_cfg80211_register_dev_ril_bridge_event_notifier();
+       if (band == WLC_BAND_2G) {
+               wl_cfg80211_send_msg_to_ril();
+
+               if (g_mhs_chan_for_cpcoex) {
+                       channel = g_mhs_chan_for_cpcoex;
+                       g_mhs_chan_for_cpcoex = 0;
+                       goto done2;
+               }
+       }
+       wl_cfg80211_unregister_dev_ril_bridge_event_notifier();
+#endif /* CONFIG_WLAN_BEYONDX || defined(CONFIG_SEC_5GMODEL) */
+
+       /* If STA is connected, return is STA channel, else ACS can be issued,
+        * set spect to 0 and proceed with ACS
+        */
+       channel = wl_cfg80211_get_sta_channel(cfg);
+       if (channel) {
+               sta_band = WL_GET_BAND(channel);
+               switch (sta_band) {
+                       case (WLC_BAND_5G): {
+                               if (band == WLC_BAND_2G || band == WLC_BAND_AUTO) {
+                                       channel = APCS_DEFAULT_2G_CH;
+                               }
+                               break;
+                       }
+                       case (WLC_BAND_2G): {
+                               if (band == WLC_BAND_5G) {
+                                       channel = APCS_DEFAULT_5G_CH;
+                               }
+                               break;
+                       }
+                       default:
+                               /* Intentional fall through to use same sta channel for softap */
+                               break;
+               }
+               WL_MSG(dev->name, "band=%d, sta_band=%d, channel=%d\n", band, sta_band, channel);
+               goto done2;
+       }
+
+       /* If AP is started on wlan0 iface,
+        * do not issue any iovar to fw and choose default ACS channel for softap
+        */
+       if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+               if (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP) {
+                       ANDROID_INFO(("Softap started on primary iface\n"));
+                       goto done;
+               }
+       }
+
+       channel = wl_ext_autochannel(dev, ACS_FW_BIT|ACS_DRV_BIT, band);
+       if (channel)
+               goto done2;
+       else
+               goto done;
+
+       ret = wldev_ioctl_get(dev, WLC_GET_SPECT_MANAGMENT, &spect, sizeof(spect));
+       if (ret) {
+               ANDROID_ERROR(("ACS: error getting the spect, ret=%d\n", ret));
+               goto done;
+       }
+
+       if (spect > 0) {
+               ret = wl_android_set_spect(dev, 0);
+               if (ret < 0) {
+                       ANDROID_ERROR(("ACS: error while setting spect, ret=%d\n", ret));
+                       goto done;
+               }
+       }
+
+       reqbuf = (u8 *)MALLOCZ(cfg->osh, CHANSPEC_BUF_SIZE);
+       if (reqbuf == NULL) {
+               ANDROID_ERROR(("failed to allocate chanspec buffer\n"));
+               return -ENOMEM;
+       }
+
+       if (band == WLC_BAND_AUTO) {
+               ANDROID_INFO(("ACS full channel scan \n"));
+               reqbuf[0] = htod32(0);
+       } else if (band == WLC_BAND_5G) {
+               ANDROID_INFO(("ACS 5G band scan \n"));
+               if ((ret = wl_cfg80211_get_chanspecs_5g(dev, reqbuf, CHANSPEC_BUF_SIZE)) < 0) {
+                       ANDROID_ERROR(("ACS 5g chanspec retreival failed! \n"));
+                       goto done;
+               }
+       } else if (band == WLC_BAND_2G) {
+               /*
+                * If channel argument is not provided/ argument 20 is provided,
+                * Restrict channel to 2GHz, 20MHz BW, No SB
+                */
+               ANDROID_INFO(("ACS 2G band scan \n"));
+               if ((ret = wl_cfg80211_get_chanspecs_2g(dev, reqbuf, CHANSPEC_BUF_SIZE)) < 0) {
+                       ANDROID_ERROR(("ACS 2g chanspec retreival failed! \n"));
+                       goto done;
+               }
+       } else {
+               ANDROID_ERROR(("ACS: No band chosen\n"));
+               goto done2;
+       }
+
+       buf_size = (band == WLC_BAND_AUTO) ? sizeof(int) : CHANSPEC_BUF_SIZE;
+       ret = wldev_ioctl_set(dev, WLC_START_CHANNEL_SEL, (void *)reqbuf,
+               buf_size);
+       if (ret < 0) {
+               ANDROID_ERROR(("can't start auto channel scan, err = %d\n", ret));
+               channel = 0;
+               goto done;
+       }
+
+       /* Wait for auto channel selection, max 3000 ms */
+       if ((band == WLC_BAND_2G) || (band == WLC_BAND_5G)) {
+               OSL_SLEEP(500);
+       } else {
+               /*
+                * Full channel scan at the minimum takes 1.2secs
+                * even with parallel scan. max wait time: 3500ms
+                */
+               OSL_SLEEP(1000);
+       }
+
+       retry = APCS_MAX_RETRY;
+       while (retry--) {
+               ret = wldev_ioctl_get(dev, WLC_GET_CHANNEL_SEL, &chosen,
+                       sizeof(chosen));
+               if (ret < 0) {
+                       chosen = 0;
+               } else {
+                       chosen = dtoh32(chosen);
+               }
+
+               if (chosen) {
+                       int chosen_band;
+                       int apcs_band;
+#ifdef D11AC_IOTYPES
+                       if (wl_cfg80211_get_ioctl_version() == 1) {
+                               channel = LCHSPEC_CHANNEL((chanspec_t)chosen);
+                       } else {
+                               channel = CHSPEC_CHANNEL((chanspec_t)chosen);
+                       }
+#else
+                       channel = CHSPEC_CHANNEL((chanspec_t)chosen);
+#endif /* D11AC_IOTYPES */
+                       apcs_band = (band == WLC_BAND_AUTO) ? WLC_BAND_2G : band;
+                       chosen_band = (channel <= CH_MAX_2G_CHANNEL) ? WLC_BAND_2G : WLC_BAND_5G;
+                       if (apcs_band == chosen_band) {
+                               WL_MSG(dev->name, "selected channel = %d\n", channel);
+                               break;
+                       }
+               }
+               ANDROID_INFO(("%d tried, ret = %d, chosen = 0x%x\n",
+                       (APCS_MAX_RETRY - retry), ret, chosen));
+               OSL_SLEEP(250);
+       }
+
+done:
+       if ((retry == 0) || (ret < 0)) {
+               /* On failure, fallback to a default channel */
+               if (band == WLC_BAND_5G) {
+                       channel = APCS_DEFAULT_5G_CH;
+               } else {
+                       channel = APCS_DEFAULT_2G_CH;
+               }
+               ANDROID_ERROR(("ACS failed. Fall back to default channel (%d) \n", channel));
+       }
+done2:
+       if (spect > 0) {
+               if ((ret = wl_android_set_spect(dev, spect) < 0)) {
+                       ANDROID_ERROR(("ACS: error while setting spect\n"));
+               }
+       }
+
+       if (reqbuf) {
+               MFREE(cfg->osh, reqbuf, CHANSPEC_BUF_SIZE);
+       }
+
+       if (channel) {
+               ret = snprintf(command, total_len, "%d", channel);
+               ANDROID_INFO(("command result is %s \n", command));
+       }
+
+       return ret;
+}
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+static int
+wl_android_set_roam_vsie_enab(struct net_device *dev, const char *cmd, u32 cmd_len)
+{
+       s32 err = BCME_OK;
+       u32 roam_vsie_enable = 0;
+       u32 cmd_str_len = (u32)strlen(CMD_ROAM_VSIE_ENAB_SET);
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       /* <CMD><SPACE><VAL> */
+       if (!cmd || (cmd_len < (cmd_str_len + 1))) {
+               ANDROID_ERROR(("wrong arg\n"));
+               err = -EINVAL;
+               goto exit;
+       }
+
+       if (dev != bcmcfg_to_prmry_ndev(cfg)) {
+               ANDROID_ERROR(("config not supported on non primary i/f\n"));
+               err = -ENODEV;
+               goto exit;
+       }
+
+       roam_vsie_enable = cmd[(cmd_str_len + 1)] - '0';
+       if (roam_vsie_enable > 1) {
+               roam_vsie_enable = 1;
+       }
+
+       WL_DBG_MEM(("set roam vsie %d\n", roam_vsie_enable));
+       err = wldev_iovar_setint(dev, "roam_vsie", roam_vsie_enable);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("set roam vsie enable failed. ret:%d\n", err));
+       }
+
+exit:
+       return err;
+}
+
+static int
+wl_android_get_roam_vsie_enab(struct net_device *dev, char *cmd, u32 cmd_len)
+{
+       s32 err = BCME_OK;
+       u32 roam_vsie_enable = 0;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       int bytes_written;
+
+       /* <CMD> */
+       if (!cmd) {
+               ANDROID_ERROR(("wrong arg\n"));
+               return -1;
+       }
+
+       if (dev != bcmcfg_to_prmry_ndev(cfg)) {
+               ANDROID_ERROR(("config not supported on non primary i/f\n"));
+               return -1;
+       }
+
+       err = wldev_iovar_getint(dev, "roam_vsie", &roam_vsie_enable);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("get roam vsie enable failed. ret:%d\n", err));
+               return -1;
+       }
+       ANDROID_INFO(("get roam vsie %d\n", roam_vsie_enable));
+
+       bytes_written = snprintf(cmd, cmd_len, "%s %d",
+               CMD_ROAM_VSIE_ENAB_GET, roam_vsie_enable);
+
+       return bytes_written;
+}
+
+static int
+wl_android_set_bcn_rpt_vsie_enab(struct net_device *dev, const char *cmd, u32 cmd_len)
+{
+       s32 err;
+       u32 bcn_vsie_enable = 0;
+       u32 cmd_str_len = strlen(CMD_BR_VSIE_ENAB_SET);
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       /* <CMD><SPACE><VAL> */
+       if (!cmd || (cmd_len < (cmd_str_len + 1))) {
+               ANDROID_ERROR(("invalid arg\n"));
+               err = -EINVAL;
+               goto exit;
+       }
+
+       if (dev != bcmcfg_to_prmry_ndev(cfg)) {
+               ANDROID_ERROR(("config not supported on non primary i/f\n"));
+               err = -ENODEV;
+               goto exit;
+       }
+
+       bcn_vsie_enable = cmd[cmd_str_len + 1] - '0';
+       if (bcn_vsie_enable > 1) {
+               bcn_vsie_enable = 1;
+       }
+
+       WL_DBG_MEM(("set bcn report vsie %d\n", bcn_vsie_enable));
+       err = wldev_iovar_setint(dev, "bcnrpt_vsie_en", bcn_vsie_enable);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("set bcn vsie failed. ret:%d\n", err));
+       }
+
+exit:
+       return err;
+}
+
+static int
+wl_android_get_bcn_rpt_vsie_enab(struct net_device *dev, char *cmd, u32 cmd_len)
+{
+       s32 err = BCME_OK;
+       u32 bcn_vsie_enable = 0;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       int bytes_written;
+
+       /* <CMD> */
+       if (!cmd) {
+               ANDROID_ERROR(("wrong arg\n"));
+               return -1;
+       }
+
+       if (dev != bcmcfg_to_prmry_ndev(cfg)) {
+               ANDROID_ERROR(("config not supported on non primary i/f\n"));
+               return -1;
+       }
+
+       err = wldev_iovar_getint(dev, "bcnrpt_vsie_en", &bcn_vsie_enable);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("get bcn vsie failed. ret:%d\n", err));
+               return -1;
+       }
+       ANDROID_INFO(("get bcn report vsie %d\n", bcn_vsie_enable));
+
+       bytes_written = snprintf(cmd, cmd_len, "%s %d",
+               CMD_BR_VSIE_ENAB_GET, bcn_vsie_enable);
+
+       return bytes_written;
+}
+
+#ifdef SUPPORT_HIDDEN_AP
+static int
+wl_android_set_max_num_sta(struct net_device *dev, const char* string_num)
+{
+       int err = BCME_ERROR;
+       int max_assoc;
+
+       max_assoc = bcm_atoi(string_num);
+       ANDROID_INFO(("wl_android_set_max_num_sta : HAPD_MAX_NUM_STA = %d\n", max_assoc));
+
+       err = wldev_iovar_setint(dev, "maxassoc", max_assoc);
+       if (err < 0) {
+               ANDROID_ERROR(("failed to set maxassoc, error:%d\n", err));
+       }
+
+       return err;
+}
+
+static int
+wl_android_set_ssid(struct net_device *dev, const char* hapd_ssid)
+{
+       wlc_ssid_t ssid;
+       s32 ret;
+
+       ssid.SSID_len = strlen(hapd_ssid);
+       if (ssid.SSID_len == 0) {
+               ANDROID_ERROR(("wl_android_set_ssids : No SSID\n"));
+               return -1;
+       }
+       if (ssid.SSID_len > DOT11_MAX_SSID_LEN) {
+               ssid.SSID_len = DOT11_MAX_SSID_LEN;
+               ANDROID_ERROR(("wl_android_set_ssid : Too long SSID Length %zu\n", strlen(hapd_ssid)));
+       }
+       bcm_strncpy_s(ssid.SSID, sizeof(ssid.SSID), hapd_ssid, ssid.SSID_len);
+       ANDROID_INFO(("wl_android_set_ssid: HAPD_SSID = %s\n", ssid.SSID));
+       ret = wldev_ioctl_set(dev, WLC_SET_SSID, &ssid, sizeof(wlc_ssid_t));
+       if (ret < 0) {
+               ANDROID_ERROR(("wl_android_set_ssid : WLC_SET_SSID Error:%d\n", ret));
+       }
+       return 1;
+
+}
+
+static int
+wl_android_set_hide_ssid(struct net_device *dev, const char* string_num)
+{
+       int hide_ssid;
+       int enable = 0;
+       int err = BCME_ERROR;
+
+       hide_ssid = bcm_atoi(string_num);
+       ANDROID_INFO(("wl_android_set_hide_ssid: HAPD_HIDE_SSID = %d\n", hide_ssid));
+       if (hide_ssid) {
+               enable = 1;
+       }
+
+       err = wldev_iovar_setint(dev, "closednet", enable);
+       if (err < 0) {
+               ANDROID_ERROR(("failed to set closednet, error:%d\n", err));
+       }
+
+       return err;
+}
+#endif /* SUPPORT_HIDDEN_AP */
+
+#ifdef SUPPORT_SOFTAP_SINGL_DISASSOC
+static int
+wl_android_sta_diassoc(struct net_device *dev, const char* straddr)
+{
+       scb_val_t scbval;
+       int error  = 0;
+
+       ANDROID_INFO(("wl_android_sta_diassoc: deauth STA %s\n", straddr));
+
+       /* Unspecified reason */
+       scbval.val = htod32(1);
+
+       if (bcm_ether_atoe(straddr, &scbval.ea) == 0) {
+               ANDROID_ERROR(("wl_android_sta_diassoc: Invalid station MAC Address!!!\n"));
+               return -1;
+       }
+
+       ANDROID_ERROR(("wl_android_sta_diassoc: deauth STA: "MACDBG " scb_val.val %d\n",
+               MAC2STRDBG(scbval.ea.octet), scbval.val));
+
+       error = wldev_ioctl_set(dev, WLC_SCB_DEAUTHENTICATE_FOR_REASON, &scbval,
+               sizeof(scb_val_t));
+       if (error) {
+               ANDROID_ERROR(("Fail to DEAUTH station, error = %d\n", error));
+       }
+
+       return 1;
+}
+#endif /* SUPPORT_SOFTAP_SINGL_DISASSOC */
+
+#ifdef SUPPORT_SET_LPC
+static int
+wl_android_set_lpc(struct net_device *dev, const char* string_num)
+{
+       int lpc_enabled, ret;
+       s32 val = 1;
+
+       lpc_enabled = bcm_atoi(string_num);
+       ANDROID_INFO(("wl_android_set_lpc: HAPD_LPC_ENABLED = %d\n", lpc_enabled));
+
+       ret = wldev_ioctl_set(dev, WLC_DOWN, &val, sizeof(s32));
+       if (ret < 0)
+               ANDROID_ERROR(("WLC_DOWN error %d\n", ret));
+
+       wldev_iovar_setint(dev, "lpc", lpc_enabled);
+
+       ret = wldev_ioctl_set(dev, WLC_UP, &val, sizeof(s32));
+       if (ret < 0)
+               ANDROID_ERROR(("WLC_UP error %d\n", ret));
+
+       return 1;
+}
+#endif /* SUPPORT_SET_LPC */
+
+static int
+wl_android_ch_res_rl(struct net_device *dev, bool change)
+{
+       int error = 0;
+       s32 srl = 7;
+       s32 lrl = 4;
+       printk("wl_android_ch_res_rl: enter\n");
+       if (change) {
+               srl = 4;
+               lrl = 2;
+       }
+
+       BCM_REFERENCE(lrl);
+
+       error = wldev_ioctl_set(dev, WLC_SET_SRL, &srl, sizeof(s32));
+       if (error) {
+               ANDROID_ERROR(("Failed to set SRL, error = %d\n", error));
+       }
+#ifndef CUSTOM_LONG_RETRY_LIMIT
+       error = wldev_ioctl_set(dev, WLC_SET_LRL, &lrl, sizeof(s32));
+       if (error) {
+               ANDROID_ERROR(("Failed to set LRL, error = %d\n", error));
+       }
+#endif /* CUSTOM_LONG_RETRY_LIMIT */
+       return error;
+}
+
+#ifdef SUPPORT_LTECX
+#define DEFAULT_WLANRX_PROT    1
+#define DEFAULT_LTERX_PROT     0
+#define DEFAULT_LTETX_ADV      1200
+
+static int
+wl_android_set_ltecx(struct net_device *dev, const char* string_num)
+{
+       uint16 chan_bitmap;
+       int ret;
+
+       chan_bitmap = bcm_strtoul(string_num, NULL, 16);
+
+       ANDROID_INFO(("wl_android_set_ltecx: LTECOEX 0x%x\n", chan_bitmap));
+
+       if (chan_bitmap) {
+               ret = wldev_iovar_setint(dev, "mws_coex_bitmap", chan_bitmap);
+               if (ret < 0) {
+                       ANDROID_ERROR(("mws_coex_bitmap error %d\n", ret));
+               }
+
+               ret = wldev_iovar_setint(dev, "mws_wlanrx_prot", DEFAULT_WLANRX_PROT);
+               if (ret < 0) {
+                       ANDROID_ERROR(("mws_wlanrx_prot error %d\n", ret));
+               }
+
+               ret = wldev_iovar_setint(dev, "mws_lterx_prot", DEFAULT_LTERX_PROT);
+               if (ret < 0) {
+                       ANDROID_ERROR(("mws_lterx_prot error %d\n", ret));
+               }
+
+               ret = wldev_iovar_setint(dev, "mws_ltetx_adv", DEFAULT_LTETX_ADV);
+               if (ret < 0) {
+                       ANDROID_ERROR(("mws_ltetx_adv error %d\n", ret));
+               }
+       } else {
+               ret = wldev_iovar_setint(dev, "mws_coex_bitmap", chan_bitmap);
+               if (ret < 0) {
+                       if (ret == BCME_UNSUPPORTED) {
+                               ANDROID_ERROR(("LTECX_CHAN_BITMAP is UNSUPPORTED\n"));
+                       } else {
+                               ANDROID_ERROR(("LTECX_CHAN_BITMAP error %d\n", ret));
+                       }
+               }
+       }
+       return 1;
+}
+#endif /* SUPPORT_LTECX */
+
+#ifdef WL_RELMCAST
+static int
+wl_android_rmc_enable(struct net_device *net, int rmc_enable)
+{
+       int err;
+
+       err = wldev_iovar_setint(net, "rmc_ackreq", rmc_enable);
+       if (err != BCME_OK) {
+               ANDROID_ERROR(("wl_android_rmc_enable: rmc_ackreq, error = %d\n", err));
+       }
+       return err;
+}
+
+static int
+wl_android_rmc_set_leader(struct net_device *dev, const char* straddr)
+{
+       int error  = BCME_OK;
+       char smbuf[WLC_IOCTL_SMLEN];
+       wl_rmc_entry_t rmc_entry;
+       ANDROID_INFO(("wl_android_rmc_set_leader: Set new RMC leader %s\n", straddr));
+
+       bzero(&rmc_entry, sizeof(wl_rmc_entry_t));
+       if (!bcm_ether_atoe(straddr, &rmc_entry.addr)) {
+               if (strlen(straddr) == 1 && bcm_atoi(straddr) == 0) {
+                       ANDROID_INFO(("wl_android_rmc_set_leader: Set auto leader selection mode\n"));
+                       bzero(&rmc_entry, sizeof(wl_rmc_entry_t));
+               } else {
+                       ANDROID_ERROR(("wl_android_rmc_set_leader: No valid mac address provided\n"));
+                       return BCME_ERROR;
+               }
+       }
+
+       error = wldev_iovar_setbuf(dev, "rmc_ar", &rmc_entry, sizeof(wl_rmc_entry_t),
+               smbuf, sizeof(smbuf), NULL);
+
+       if (error != BCME_OK) {
+               ANDROID_ERROR(("wl_android_rmc_set_leader: Unable to set RMC leader, error = %d\n",
+                       error));
+       }
+
+       return error;
+}
+
+static int wl_android_set_rmc_event(struct net_device *dev, char *command)
+{
+       int err = 0;
+       int pid = 0;
+
+       if (sscanf(command, CMD_SET_RMC_EVENT " %d", &pid) <= 0) {
+               ANDROID_ERROR(("Failed to get Parameter from : %s\n", command));
+               return -1;
+       }
+
+       /* set pid, and if the event was happened, let's send a notification through netlink */
+       wl_cfg80211_set_rmc_pid(dev, pid);
+
+       ANDROID_INFO(("RMC pid=%d\n", pid));
+
+       return err;
+}
+#endif /* WL_RELMCAST */
+
+int wl_android_get_singlecore_scan(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       int bytes_written = 0;
+       int mode = 0;
+
+       error = wldev_iovar_getint(dev, "scan_ps", &mode);
+       if (error) {
+               ANDROID_ERROR(("wl_android_get_singlecore_scan: Failed to get single core scan Mode,"
+                       " error = %d\n",
+                       error));
+               return -1;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_GET_SCSCAN, mode);
+
+       return bytes_written;
+}
+
+int wl_android_set_singlecore_scan(struct net_device *dev, char *command)
+{
+       int error = 0;
+       int mode = 0;
+
+       if (sscanf(command, "%*s %d", &mode) != 1) {
+               ANDROID_ERROR(("wl_android_set_singlecore_scan: Failed to get Parameter\n"));
+               return -1;
+       }
+
+       error = wldev_iovar_setint(dev, "scan_ps", mode);
+       if (error) {
+               ANDROID_ERROR(("wl_android_set_singlecore_scan[1]: Failed to set Mode %d, error = %d\n",
+               mode, error));
+               return -1;
+       }
+
+       return error;
+}
+#ifdef TEST_TX_POWER_CONTROL
+static int
+wl_android_set_tx_power(struct net_device *dev, const char* string_num)
+{
+       int err = 0;
+       s32 dbm;
+       enum nl80211_tx_power_setting type;
+
+       dbm = bcm_atoi(string_num);
+
+       if (dbm < -1) {
+               ANDROID_ERROR(("wl_android_set_tx_power: dbm is negative...\n"));
+               return -EINVAL;
+       }
+
+       if (dbm == -1)
+               type = NL80211_TX_POWER_AUTOMATIC;
+       else
+               type = NL80211_TX_POWER_FIXED;
+
+       err = wl_set_tx_power(dev, type, dbm);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("wl_android_set_tx_power: error (%d)\n", err));
+               return err;
+       }
+
+       return 1;
+}
+
+static int
+wl_android_get_tx_power(struct net_device *dev, char *command, int total_len)
+{
+       int err;
+       int bytes_written;
+       s32 dbm = 0;
+
+       err = wl_get_tx_power(dev, &dbm);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("wl_android_get_tx_power: error (%d)\n", err));
+               return err;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d",
+               CMD_TEST_GET_TX_POWER, dbm);
+
+       ANDROID_ERROR(("wl_android_get_tx_power: GET_TX_POWER: dBm=%d\n", dbm));
+
+       return bytes_written;
+}
+#endif /* TEST_TX_POWER_CONTROL */
+
+static int
+wl_android_set_sarlimit_txctrl(struct net_device *dev, const char* string_num)
+{
+       int err = BCME_ERROR;
+       int setval = 0;
+       s32 mode = bcm_atoi(string_num);
+       s32 mode_bit = 0;
+       int enab = 0;
+
+       /* As Samsung specific and their requirement,
+        * the mode set as the following form.
+        * -1 : HEAD SAR disabled
+        *  0 : HEAD SAR enabled
+        *  1 : GRIP SAR disabled
+        *  2 : GRIP SAR enabled
+        *  3 : NR mmWave SAR disabled
+        *  4 : NR mmWave SAR enabled
+        *  5 : NR Sub6 SAR disabled
+        *  6 : NR Sub6 SAR enabled
+        *  7 : SAR BACKOFF disabled all
+        * The 'SAR BACKOFF disabled all' index should be the end of the mode.
+        */
+       if ((mode < HEAD_SAR_BACKOFF_DISABLE) || (mode > SAR_BACKOFF_DISABLE_ALL)) {
+               ANDROID_ERROR(("%s: Request for Unsupported:%d\n", __FUNCTION__, bcm_atoi(string_num)));
+               err = BCME_RANGE;
+               goto error;
+       }
+
+       mode_bit = mode + 1;
+       enab = mode_bit % 2;
+       mode_bit = mode_bit / 2;
+
+       err = wldev_iovar_getint(dev, "sar_enable", &setval);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("%s: Failed to get sar_enable - error (%d)\n", __FUNCTION__, err));
+               goto error;
+       }
+
+       if (mode == SAR_BACKOFF_DISABLE_ALL) {
+               ANDROID_ERROR(("%s: SAR limit control all mode disable!\n", __FUNCTION__));
+               setval = 0;
+       } else {
+               ANDROID_ERROR(("%s: SAR limit control mode %d enab %d\n",
+                       __FUNCTION__, mode_bit, enab));
+               if (enab) {
+                       setval |= (1 << mode_bit);
+               } else {
+                       setval &= ~(1 << mode_bit);
+               }
+       }
+
+       err = wldev_iovar_setint(dev, "sar_enable", setval);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("%s: Failed to set sar_enable - error (%d)\n", __FUNCTION__, err));
+               goto error;
+       }
+       err = BCME_OK;
+error:
+       return err;
+}
+
+#ifdef SUPPORT_SET_TID
+static int
+wl_android_set_tid(struct net_device *dev, char* command)
+{
+       int err = BCME_ERROR;
+       char *pos = command;
+       char *token = NULL;
+       uint8 mode = 0;
+       uint32 uid = 0;
+       uint8 prio = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+
+       if (!dhdp) {
+               ANDROID_ERROR(("dhd is NULL\n"));
+               return err;
+       }
+
+       ANDROID_INFO(("%s: command[%s]\n", __FUNCTION__, command));
+
+       /* drop command */
+       token = bcmstrtok(&pos, " ", NULL);
+
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               ANDROID_ERROR(("Invalid arguments\n"));
+               return err;
+       }
+
+       mode = bcm_atoi(token);
+
+       if (mode < SET_TID_OFF || mode > SET_TID_BASED_ON_UID) {
+               ANDROID_ERROR(("Invalid arguments, mode %d\n", mode));
+                       return err;
+       }
+
+       if (mode) {
+               token = bcmstrtok(&pos, " ", NULL);
+               if (!token) {
+                       ANDROID_ERROR(("Invalid arguments for target uid\n"));
+                       return err;
+               }
+
+               uid = bcm_atoi(token);
+
+               token = bcmstrtok(&pos, " ", NULL);
+               if (!token) {
+                       ANDROID_ERROR(("Invalid arguments for target tid\n"));
+                       return err;
+               }
+
+               prio = bcm_atoi(token);
+               if (prio >= 0 && prio <= MAXPRIO) {
+                       dhdp->tid_mode = mode;
+                       dhdp->target_uid = uid;
+                       dhdp->target_tid = prio;
+               } else {
+                       ANDROID_ERROR(("Invalid arguments, prio %d\n", prio));
+                       return err;
+               }
+       } else {
+               dhdp->tid_mode = SET_TID_OFF;
+               dhdp->target_uid = 0;
+               dhdp->target_tid = 0;
+       }
+
+       ANDROID_INFO(("%s mode [%d], uid [%d], tid [%d]\n", __FUNCTION__,
+               dhdp->tid_mode, dhdp->target_uid, dhdp->target_tid));
+
+       err = BCME_OK;
+       return err;
+}
+
+static int
+wl_android_get_tid(struct net_device *dev, char* command, int total_len)
+{
+       int bytes_written = BCME_ERROR;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+
+       if (!dhdp) {
+               ANDROID_ERROR(("dhd is NULL\n"));
+               return bytes_written;
+       }
+
+       bytes_written = snprintf(command, total_len, "mode %d uid %d tid %d",
+               dhdp->tid_mode, dhdp->target_uid, dhdp->target_tid);
+
+       ANDROID_INFO(("%s: command results %s\n", __FUNCTION__, command));
+
+       return bytes_written;
+}
+#endif /* SUPPORT_SET_TID */
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+
+int wl_android_set_roam_mode(struct net_device *dev, char *command)
+{
+       int error = 0;
+       int mode = 0;
+
+       if (sscanf(command, "%*s %d", &mode) != 1) {
+               ANDROID_ERROR(("%s: Failed to get Parameter\n", __FUNCTION__));
+               return -1;
+       }
+
+       error = wldev_iovar_setint(dev, "roam_off", mode);
+       if (error) {
+               ANDROID_ERROR(("%s: Failed to set roaming Mode %d, error = %d\n",
+               __FUNCTION__, mode, error));
+               return -1;
+       }
+       else
+               ANDROID_ERROR(("%s: succeeded to set roaming Mode %d, error = %d\n",
+               __FUNCTION__, mode, error));
+       return 0;
+}
+
+#ifdef WL_CFG80211
+int wl_android_set_ibss_beacon_ouidata(struct net_device *dev, char *command, int total_len)
+{
+       char ie_buf[VNDR_IE_MAX_LEN];
+       char *ioctl_buf = NULL;
+       char hex[] = "XX";
+       char *pcmd = NULL;
+       int ielen = 0, datalen = 0, idx = 0, tot_len = 0;
+       vndr_ie_setbuf_t *vndr_ie = NULL;
+       s32 iecount;
+       uint32 pktflag;
+       s32 err = BCME_OK, bssidx;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       /* Check the VSIE (Vendor Specific IE) which was added.
+        *  If exist then send IOVAR to delete it
+        */
+       if (wl_cfg80211_ibss_vsie_delete(dev) != BCME_OK) {
+               return -EINVAL;
+       }
+
+       if (total_len < (strlen(CMD_SETIBSSBEACONOUIDATA) + 1)) {
+               ANDROID_ERROR(("error. total_len:%d\n", total_len));
+               return -EINVAL;
+       }
+
+       pcmd = command + strlen(CMD_SETIBSSBEACONOUIDATA) + 1;
+       for (idx = 0; idx < DOT11_OUI_LEN; idx++) {
+               if (*pcmd == '\0') {
+                       ANDROID_ERROR(("error while parsing OUI.\n"));
+                       return -EINVAL;
+               }
+               hex[0] = *pcmd++;
+               hex[1] = *pcmd++;
+               ie_buf[idx] =  (uint8)simple_strtoul(hex, NULL, 16);
+       }
+       pcmd++;
+       while ((*pcmd != '\0') && (idx < VNDR_IE_MAX_LEN)) {
+               hex[0] = *pcmd++;
+               hex[1] = *pcmd++;
+               ie_buf[idx++] =  (uint8)simple_strtoul(hex, NULL, 16);
+               datalen++;
+       }
+
+       if (datalen <= 0) {
+               ANDROID_ERROR(("error. vndr ie len:%d\n", datalen));
+               return -EINVAL;
+       }
+
+       tot_len = (int)(sizeof(vndr_ie_setbuf_t) + (datalen - 1));
+       vndr_ie = (vndr_ie_setbuf_t *)MALLOCZ(cfg->osh, tot_len);
+       if (!vndr_ie) {
+               ANDROID_ERROR(("IE memory alloc failed\n"));
+               return -ENOMEM;
+       }
+       /* Copy the vndr_ie SET command ("add"/"del") to the buffer */
+       strlcpy(vndr_ie->cmd, "add", sizeof(vndr_ie->cmd));
+
+       /* Set the IE count - the buffer contains only 1 IE */
+       iecount = htod32(1);
+       memcpy((void *)&vndr_ie->vndr_ie_buffer.iecount, &iecount, sizeof(s32));
+
+       /* Set packet flag to indicate that BEACON's will contain this IE */
+       pktflag = htod32(VNDR_IE_BEACON_FLAG | VNDR_IE_PRBRSP_FLAG);
+       memcpy((void *)&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].pktflag, &pktflag,
+               sizeof(u32));
+       /* Set the IE ID */
+       vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.id = (uchar) DOT11_MNG_PROPR_ID;
+
+       memcpy(&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui, &ie_buf,
+               DOT11_OUI_LEN);
+       memcpy(&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.data,
+               &ie_buf[DOT11_OUI_LEN], datalen);
+
+       ielen = DOT11_OUI_LEN + datalen;
+       vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.len = (uchar) ielen;
+
+       ioctl_buf = (char *)MALLOC(cfg->osh, WLC_IOCTL_MEDLEN);
+       if (!ioctl_buf) {
+               ANDROID_ERROR(("ioctl memory alloc failed\n"));
+               if (vndr_ie) {
+                       MFREE(cfg->osh, vndr_ie, tot_len);
+               }
+               return -ENOMEM;
+       }
+       bzero(ioctl_buf, WLC_IOCTL_MEDLEN);     /* init the buffer */
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               ANDROID_ERROR(("Find index failed\n"));
+               err = BCME_ERROR;
+               goto end;
+       }
+       err = wldev_iovar_setbuf_bsscfg(dev, "vndr_ie", vndr_ie, tot_len, ioctl_buf,
+                       WLC_IOCTL_MEDLEN, bssidx, &cfg->ioctl_buf_sync);
+end:
+       if (err != BCME_OK) {
+               err = -EINVAL;
+               if (vndr_ie) {
+                       MFREE(cfg->osh, vndr_ie, tot_len);
+               }
+       }
+       else {
+               /* do NOT free 'vndr_ie' for the next process */
+               wl_cfg80211_ibss_vsie_set_buffer(dev, vndr_ie, tot_len);
+       }
+
+       if (ioctl_buf) {
+               MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_MEDLEN);
+       }
+
+       return err;
+}
+#endif /* WL_CFG80211 */
+
+#if defined(BCMFW_ROAM_ENABLE)
+static int
+wl_android_set_roampref(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       char smbuf[WLC_IOCTL_SMLEN];
+       uint8 buf[MAX_BUF_SIZE];
+       uint8 *pref = buf;
+       char *pcmd;
+       int num_ucipher_suites = 0;
+       int num_akm_suites = 0;
+       wpa_suite_t ucipher_suites[MAX_NUM_SUITES];
+       wpa_suite_t akm_suites[MAX_NUM_SUITES];
+       int num_tuples = 0;
+       int total_bytes = 0;
+       int total_len_left;
+       int i, j;
+       char hex[] = "XX";
+
+       pcmd = command + strlen(CMD_SET_ROAMPREF) + 1;
+       total_len_left = total_len - strlen(CMD_SET_ROAMPREF) + 1;
+
+       num_akm_suites = simple_strtoul(pcmd, NULL, 16);
+       if (num_akm_suites > MAX_NUM_SUITES) {
+               ANDROID_ERROR(("too many AKM suites = %d\n", num_akm_suites));
+               return -1;
+       }
+
+       /* Increment for number of AKM suites field + space */
+       pcmd += 3;
+       total_len_left -= 3;
+
+       /* check to make sure pcmd does not overrun */
+       if (total_len_left < (num_akm_suites * WIDTH_AKM_SUITE))
+               return -1;
+
+       bzero(buf, sizeof(buf));
+       bzero(akm_suites, sizeof(akm_suites));
+       bzero(ucipher_suites, sizeof(ucipher_suites));
+
+       /* Save the AKM suites passed in the command */
+       for (i = 0; i < num_akm_suites; i++) {
+               /* Store the MSB first, as required by join_pref */
+               for (j = 0; j < 4; j++) {
+                       hex[0] = *pcmd++;
+                       hex[1] = *pcmd++;
+                       buf[j] = (uint8)simple_strtoul(hex, NULL, 16);
+               }
+               memcpy((uint8 *)&akm_suites[i], buf, sizeof(uint32));
+       }
+
+       total_len_left -= (num_akm_suites * WIDTH_AKM_SUITE);
+       num_ucipher_suites = simple_strtoul(pcmd, NULL, 16);
+       /* Increment for number of cipher suites field + space */
+       pcmd += 3;
+       total_len_left -= 3;
+
+       if (total_len_left < (num_ucipher_suites * WIDTH_AKM_SUITE))
+               return -1;
+
+       /* Save the cipher suites passed in the command */
+       for (i = 0; i < num_ucipher_suites; i++) {
+               /* Store the MSB first, as required by join_pref */
+               for (j = 0; j < 4; j++) {
+                       hex[0] = *pcmd++;
+                       hex[1] = *pcmd++;
+                       buf[j] = (uint8)simple_strtoul(hex, NULL, 16);
+               }
+               memcpy((uint8 *)&ucipher_suites[i], buf, sizeof(uint32));
+       }
+
+       /* Join preference for RSSI
+        * Type   : 1 byte (0x01)
+        * Length : 1 byte (0x02)
+        * Value  : 2 bytes     (reserved)
+        */
+       *pref++ = WL_JOIN_PREF_RSSI;
+       *pref++ = JOIN_PREF_RSSI_LEN;
+       *pref++ = 0;
+       *pref++ = 0;
+
+       /* Join preference for WPA
+        * Type   : 1 byte (0x02)
+        * Length : 1 byte (not used)
+        * Value  : (variable length)
+        *              reserved: 1 byte
+        *      count   : 1 byte (no of tuples)
+        *              Tuple1  : 12 bytes
+        *                      akm[4]
+        *                      ucipher[4]
+        *                      mcipher[4]
+        *              Tuple2  : 12 bytes
+        *              Tuplen  : 12 bytes
+        */
+       num_tuples = num_akm_suites * num_ucipher_suites;
+       if (num_tuples != 0) {
+               if (num_tuples <= JOIN_PREF_MAX_WPA_TUPLES) {
+                       *pref++ = WL_JOIN_PREF_WPA;
+                       *pref++ = 0;
+                       *pref++ = 0;
+                       *pref++ = (uint8)num_tuples;
+                       total_bytes = JOIN_PREF_RSSI_SIZE + JOIN_PREF_WPA_HDR_SIZE +
+                               (JOIN_PREF_WPA_TUPLE_SIZE * num_tuples);
+               } else {
+                       ANDROID_ERROR(("%s: Too many wpa configs for join_pref \n", __FUNCTION__));
+                       return -1;
+               }
+       } else {
+               /* No WPA config, configure only RSSI preference */
+               total_bytes = JOIN_PREF_RSSI_SIZE;
+       }
+
+       /* akm-ucipher-mcipher tuples in the format required for join_pref */
+       for (i = 0; i < num_ucipher_suites; i++) {
+               for (j = 0; j < num_akm_suites; j++) {
+                       memcpy(pref, (uint8 *)&akm_suites[j], WPA_SUITE_LEN);
+                       pref += WPA_SUITE_LEN;
+                       memcpy(pref, (uint8 *)&ucipher_suites[i], WPA_SUITE_LEN);
+                       pref += WPA_SUITE_LEN;
+                       /* Set to 0 to match any available multicast cipher */
+                       bzero(pref, WPA_SUITE_LEN);
+                       pref += WPA_SUITE_LEN;
+               }
+       }
+
+       prhex("join pref", (uint8 *)buf, total_bytes);
+       error = wldev_iovar_setbuf(dev, "join_pref", buf, total_bytes, smbuf, sizeof(smbuf), NULL);
+       if (error) {
+               ANDROID_ERROR(("Failed to set join_pref, error = %d\n", error));
+       }
+       return error;
+}
+#endif /* defined(BCMFW_ROAM_ENABLE */
+
+#ifdef WL_CFG80211
+static int
+wl_android_iolist_add(struct net_device *dev, struct list_head *head, struct io_cfg *config)
+{
+       struct io_cfg *resume_cfg;
+       s32 ret;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       resume_cfg = (struct io_cfg *)MALLOCZ(cfg->osh, sizeof(struct io_cfg));
+       if (!resume_cfg)
+               return -ENOMEM;
+
+       if (config->iovar) {
+               ret = wldev_iovar_getint(dev, config->iovar, &resume_cfg->param);
+               if (ret) {
+                       ANDROID_ERROR(("%s: Failed to get current %s value\n",
+                               __FUNCTION__, config->iovar));
+                       goto error;
+               }
+
+               ret = wldev_iovar_setint(dev, config->iovar, config->param);
+               if (ret) {
+                       ANDROID_ERROR(("%s: Failed to set %s to %d\n", __FUNCTION__,
+                               config->iovar, config->param));
+                       goto error;
+               }
+
+               resume_cfg->iovar = config->iovar;
+       } else {
+               resume_cfg->arg = MALLOCZ(cfg->osh, config->len);
+               if (!resume_cfg->arg) {
+                       ret = -ENOMEM;
+                       goto error;
+               }
+               ret = wldev_ioctl_get(dev, config->ioctl, resume_cfg->arg, config->len);
+               if (ret) {
+                       ANDROID_ERROR(("%s: Failed to get ioctl %d\n", __FUNCTION__,
+                               config->ioctl));
+                       goto error;
+               }
+               ret = wldev_ioctl_set(dev, config->ioctl + 1, config->arg, config->len);
+               if (ret) {
+                       ANDROID_ERROR(("%s: Failed to set %s to %d\n", __FUNCTION__,
+                               config->iovar, config->param));
+                       goto error;
+               }
+               if (config->ioctl + 1 == WLC_SET_PM)
+                       wl_cfg80211_update_power_mode(dev);
+               resume_cfg->ioctl = config->ioctl;
+               resume_cfg->len = config->len;
+       }
+
+       /* assuming only one active user and no list protection */
+       list_add(&resume_cfg->list, head);
+
+       return 0;
+error:
+       MFREE(cfg->osh, resume_cfg->arg, config->len);
+       MFREE(cfg->osh, resume_cfg, sizeof(struct io_cfg));
+       return ret;
+}
+
+static void
+wl_android_iolist_resume(struct net_device *dev, struct list_head *head)
+{
+       struct io_cfg *config;
+       struct list_head *cur, *q;
+       s32 ret = 0;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_safe(cur, q, head) {
+               config = list_entry(cur, struct io_cfg, list);
+               GCC_DIAGNOSTIC_POP();
+               if (config->iovar) {
+                       if (!ret)
+                               ret = wldev_iovar_setint(dev, config->iovar,
+                                       config->param);
+               } else {
+                       if (!ret)
+                               ret = wldev_ioctl_set(dev, config->ioctl + 1,
+                                       config->arg, config->len);
+                       if (config->ioctl + 1 == WLC_SET_PM)
+                               wl_cfg80211_update_power_mode(dev);
+                       MFREE(cfg->osh, config->arg, config->len);
+               }
+               list_del(cur);
+               MFREE(cfg->osh, config, sizeof(struct io_cfg));
+       }
+}
+
+static int
+wl_android_set_miracast(struct net_device *dev, char *command)
+{
+       int mode, val = 0;
+       int ret = 0;
+       struct io_cfg config;
+
+       if (sscanf(command, "%*s %d", &mode) != 1) {
+               ANDROID_ERROR(("%s: Failed to get Parameter\n", __FUNCTION__));
+               return -1;
+       }
+
+       ANDROID_INFO(("%s: enter miracast mode %d\n", __FUNCTION__, mode));
+
+       if (miracast_cur_mode == mode) {
+               return 0;
+       }
+
+       wl_android_iolist_resume(dev, &miracast_resume_list);
+       miracast_cur_mode = MIRACAST_MODE_OFF;
+
+       bzero((void *)&config, sizeof(config));
+       switch (mode) {
+       case MIRACAST_MODE_SOURCE:
+#ifdef MIRACAST_MCHAN_ALGO
+               /* setting mchan_algo to platform specific value */
+               config.iovar = "mchan_algo";
+
+               /* check for station's beacon interval(BI)
+                * If BI is over 100ms, don't use mchan_algo
+                */
+               ret = wldev_ioctl_get(dev, WLC_GET_BCNPRD, &val, sizeof(int));
+               if (!ret && val > 100) {
+                       config.param = 0;
+                       ANDROID_ERROR(("%s: Connected station's beacon interval: "
+                               "%d and set mchan_algo to %d \n",
+                               __FUNCTION__, val, config.param));
+               } else {
+                       config.param = MIRACAST_MCHAN_ALGO;
+               }
+               ret = wl_android_iolist_add(dev, &miracast_resume_list, &config);
+               if (ret) {
+                       goto resume;
+               }
+#endif /* MIRACAST_MCHAN_ALGO */
+
+#ifdef MIRACAST_MCHAN_BW
+               /* setting mchan_bw to platform specific value */
+               config.iovar = "mchan_bw";
+               config.param = MIRACAST_MCHAN_BW;
+               ret = wl_android_iolist_add(dev, &miracast_resume_list, &config);
+               if (ret) {
+                       goto resume;
+               }
+#endif /* MIRACAST_MCHAN_BW */
+
+#ifdef MIRACAST_AMPDU_SIZE
+               /* setting apmdu to platform specific value */
+               config.iovar = "ampdu_mpdu";
+               config.param = MIRACAST_AMPDU_SIZE;
+               ret = wl_android_iolist_add(dev, &miracast_resume_list, &config);
+               if (ret) {
+                       goto resume;
+               }
+#endif /* MIRACAST_AMPDU_SIZE */
+               /* FALLTROUGH */
+               /* Source mode shares most configurations with sink mode.
+                * Fall through here to avoid code duplication
+                */
+       case MIRACAST_MODE_SINK:
+               /* disable internal roaming */
+               config.iovar = "roam_off";
+               config.param = 1;
+               config.arg = NULL;
+               config.len = 0;
+               ret = wl_android_iolist_add(dev, &miracast_resume_list, &config);
+               if (ret) {
+                       goto resume;
+               }
+
+               /* tunr off pm */
+               ret = wldev_ioctl_get(dev, WLC_GET_PM, &val, sizeof(val));
+               if (ret) {
+                       goto resume;
+               }
+
+               if (val != PM_OFF) {
+                       val = PM_OFF;
+                       config.iovar = NULL;
+                       config.ioctl = WLC_GET_PM;
+                       config.arg = &val;
+                       config.len = sizeof(int);
+                       ret = wl_android_iolist_add(dev, &miracast_resume_list, &config);
+                       if (ret) {
+                               goto resume;
+                       }
+               }
+               break;
+       case MIRACAST_MODE_OFF:
+       default:
+               break;
+       }
+       miracast_cur_mode = mode;
+
+       return 0;
+
+resume:
+       ANDROID_ERROR(("%s: turnoff miracast mode because of err%d\n", __FUNCTION__, ret));
+       wl_android_iolist_resume(dev, &miracast_resume_list);
+       return ret;
+}
+#endif /* WL_CFG80211 */
+
+#ifdef WL_RELMCAST
+#define NETLINK_OXYGEN     30
+#define AIBSS_BEACON_TIMEOUT   10
+
+static struct sock *nl_sk = NULL;
+
+static void wl_netlink_recv(struct sk_buff *skb)
+{
+       ANDROID_ERROR(("netlink_recv called\n"));
+}
+
+static int wl_netlink_init(void)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+       struct netlink_kernel_cfg cfg = {
+               .input  = wl_netlink_recv,
+       };
+#endif
+
+       if (nl_sk != NULL) {
+               ANDROID_ERROR(("nl_sk already exist\n"));
+               return BCME_ERROR;
+       }
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
+       nl_sk = netlink_kernel_create(&init_net, NETLINK_OXYGEN,
+               0, wl_netlink_recv, NULL, THIS_MODULE);
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0))
+       nl_sk = netlink_kernel_create(&init_net, NETLINK_OXYGEN, THIS_MODULE, &cfg);
+#else
+       nl_sk = netlink_kernel_create(&init_net, NETLINK_OXYGEN, &cfg);
+#endif
+
+       if (nl_sk == NULL) {
+               ANDROID_ERROR(("nl_sk is not ready\n"));
+               return BCME_ERROR;
+       }
+
+       return BCME_OK;
+}
+
+static void wl_netlink_deinit(void)
+{
+       if (nl_sk) {
+               netlink_kernel_release(nl_sk);
+               nl_sk = NULL;
+       }
+}
+
+s32
+wl_netlink_send_msg(int pid, int type, int seq, const void *data, size_t size)
+{
+       struct sk_buff *skb = NULL;
+       struct nlmsghdr *nlh = NULL;
+       int ret = -1;
+
+       if (nl_sk == NULL) {
+               ANDROID_ERROR(("nl_sk was not initialized\n"));
+               goto nlmsg_failure;
+       }
+
+       skb = alloc_skb(NLMSG_SPACE(size), GFP_ATOMIC);
+       if (skb == NULL) {
+               ANDROID_ERROR(("failed to allocate memory\n"));
+               goto nlmsg_failure;
+       }
+
+       nlh = nlmsg_put(skb, 0, 0, 0, size, 0);
+       if (nlh == NULL) {
+               ANDROID_ERROR(("failed to build nlmsg, skb_tailroom:%d, nlmsg_total_size:%d\n",
+                       skb_tailroom(skb), nlmsg_total_size(size)));
+               dev_kfree_skb(skb);
+               goto nlmsg_failure;
+       }
+
+       memcpy(nlmsg_data(nlh), data, size);
+       nlh->nlmsg_seq = seq;
+       nlh->nlmsg_type = type;
+
+       /* netlink_unicast() takes ownership of the skb and frees it itself. */
+       ret = netlink_unicast(nl_sk, skb, pid, 0);
+       ANDROID_INFO(("netlink_unicast() pid=%d, ret=%d\n", pid, ret));
+
+nlmsg_failure:
+       return ret;
+}
+#endif /* WL_RELMCAST */
+
+#ifdef WLAIBSS
+static int wl_android_set_ibss_txfail_event(struct net_device *dev, char *command, int total_len)
+{
+       int err = 0;
+       int retry = 0;
+       int pid = 0;
+       aibss_txfail_config_t txfail_config = {0, 0, 0, 0, 0};
+       char smbuf[WLC_IOCTL_SMLEN];
+
+       if (sscanf(command, CMD_SETIBSSTXFAILEVENT " %d %d", &retry, &pid) <= 0) {
+               ANDROID_ERROR(("Failed to get Parameter from : %s\n", command));
+               return -1;
+       }
+
+       /* set pid, and if the event was happened, let's send a notification through netlink */
+       wl_cfg80211_set_txfail_pid(dev, pid);
+
+#ifdef WL_RELMCAST
+       /* using same pid for RMC, AIBSS shares same pid with RMC and it is set once */
+       wl_cfg80211_set_rmc_pid(dev, pid);
+#endif /* WL_RELMCAST */
+
+       /* If retry value is 0, it disables the functionality for TX Fail. */
+       if (retry > 0) {
+               txfail_config.max_tx_retry = retry;
+               txfail_config.bcn_timeout = 0;  /* 0 : disable tx fail from beacon */
+       }
+       txfail_config.version = AIBSS_TXFAIL_CONFIG_VER_0;
+       txfail_config.len = sizeof(txfail_config);
+
+       err = wldev_iovar_setbuf(dev, "aibss_txfail_config", (void *) &txfail_config,
+               sizeof(aibss_txfail_config_t), smbuf, WLC_IOCTL_SMLEN, NULL);
+       ANDROID_INFO(("retry=%d, pid=%d, err=%d\n", retry, pid, err));
+
+       return ((err == 0)?total_len:err);
+}
+
+static int wl_android_get_ibss_peer_info(struct net_device *dev, char *command,
+       int total_len, bool bAll)
+{
+       int error;
+       int bytes_written = 0;
+       void *buf = NULL;
+       bss_peer_list_info_t peer_list_info;
+       bss_peer_info_t *peer_info;
+       int i;
+       bool found = false;
+       struct ether_addr mac_ea;
+       char *str = command;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       ANDROID_INFO(("get ibss peer info(%s)\n", bAll?"true":"false"));
+
+       if (!bAll) {
+               if (bcmstrtok(&str, " ", NULL) == NULL) {
+                       ANDROID_ERROR(("invalid command\n"));
+                       return -1;
+               }
+
+               if (!str || !bcm_ether_atoe(str, &mac_ea)) {
+                       ANDROID_ERROR(("invalid MAC address\n"));
+                       return -1;
+               }
+       }
+
+       if ((buf = MALLOC(cfg->osh, WLC_IOCTL_MAXLEN)) == NULL) {
+               ANDROID_ERROR(("kmalloc failed\n"));
+               return -1;
+       }
+
+       error = wldev_iovar_getbuf(dev, "bss_peer_info", NULL, 0, buf, WLC_IOCTL_MAXLEN, NULL);
+       if (unlikely(error)) {
+               ANDROID_ERROR(("could not get ibss peer info (%d)\n", error));
+               MFREE(cfg->osh, buf, WLC_IOCTL_MAXLEN);
+               return -1;
+       }
+
+       memcpy(&peer_list_info, buf, sizeof(peer_list_info));
+       peer_list_info.version = htod16(peer_list_info.version);
+       peer_list_info.bss_peer_info_len = htod16(peer_list_info.bss_peer_info_len);
+       peer_list_info.count = htod32(peer_list_info.count);
+
+       ANDROID_INFO(("ver:%d, len:%d, count:%d\n", peer_list_info.version,
+               peer_list_info.bss_peer_info_len, peer_list_info.count));
+
+       if (peer_list_info.count > 0) {
+               if (bAll)
+                       bytes_written += snprintf(&command[bytes_written], total_len, "%u ",
+                               peer_list_info.count);
+
+               peer_info = (bss_peer_info_t *) ((char *)buf + BSS_PEER_LIST_INFO_FIXED_LEN);
+
+               for (i = 0; i < peer_list_info.count; i++) {
+
+                       ANDROID_INFO(("index:%d rssi:%d, tx:%u, rx:%u\n", i, peer_info->rssi,
+                               peer_info->tx_rate, peer_info->rx_rate));
+
+                       if (!bAll &&
+                               memcmp(&mac_ea, &peer_info->ea, sizeof(struct ether_addr)) == 0) {
+                               found = true;
+                       }
+
+                       if (bAll || found) {
+                               bytes_written += snprintf(&command[bytes_written],
+                                       total_len - bytes_written,
+                                       MACF" %u %d ", ETHER_TO_MACF(peer_info->ea),
+                                       peer_info->tx_rate/1000, peer_info->rssi);
+                               if (bytes_written >= total_len) {
+                                       ANDROID_ERROR(("wl_android_get_ibss_peer_info: Insufficient"
+                                               " memory, %d bytes\n",
+                                               total_len));
+                                       bytes_written = -1;
+                                       break;
+                               }
+                       }
+
+                       if (found)
+                               break;
+
+                       peer_info = (bss_peer_info_t *)((char *)peer_info+sizeof(bss_peer_info_t));
+               }
+       }
+       else {
+               ANDROID_ERROR(("could not get ibss peer info : no item\n"));
+       }
+       ANDROID_INFO(("command(%u):%s\n", total_len, command));
+       ANDROID_INFO(("bytes_written:%d\n", bytes_written));
+
+       MFREE(cfg->osh, buf, WLC_IOCTL_MAXLEN);
+       return bytes_written;
+}
+
+int wl_android_set_ibss_routetable(struct net_device *dev, char *command)
+{
+
+       char *pcmd = command;
+       char *str = NULL;
+       ibss_route_tbl_t *route_tbl = NULL;
+       char *ioctl_buf = NULL;
+       s32 err = BCME_OK;
+       uint32 route_tbl_len;
+       uint32 entries;
+       char *endptr;
+       uint32 i = 0;
+       struct ipv4_addr  dipaddr;
+       struct ether_addr ea;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       route_tbl_len = sizeof(ibss_route_tbl_t) +
+               (MAX_IBSS_ROUTE_TBL_ENTRY - 1) * sizeof(ibss_route_entry_t);
+       route_tbl = (ibss_route_tbl_t *)MALLOCZ(cfg->osh, route_tbl_len);
+       if (!route_tbl) {
+               ANDROID_ERROR(("Route TBL alloc failed\n"));
+               return -ENOMEM;
+       }
+       ioctl_buf = (char *)MALLOCZ(cfg->osh, WLC_IOCTL_MEDLEN);
+       if (!ioctl_buf) {
+               ANDROID_ERROR(("ioctl memory alloc failed\n"));
+               if (route_tbl) {
+                       MFREE(cfg->osh, route_tbl, route_tbl_len);
+               }
+               return -ENOMEM;
+       }
+       bzero(ioctl_buf, WLC_IOCTL_MEDLEN);
+
+       /* drop command */
+       str = bcmstrtok(&pcmd, " ", NULL);
+
+       /* get count */
+       str = bcmstrtok(&pcmd, " ",  NULL);
+       if (!str) {
+               ANDROID_ERROR(("Invalid number parameter %s\n", str));
+               err = -EINVAL;
+               goto exit;
+       }
+       entries = bcm_strtoul(str, &endptr, 0);
+       if (*endptr != '\0') {
+               ANDROID_ERROR(("Invalid number parameter %s\n", str));
+               err = -EINVAL;
+               goto exit;
+       }
+       if (entries > MAX_IBSS_ROUTE_TBL_ENTRY) {
+               ANDROID_ERROR(("Invalid entries number %u\n", entries));
+               err = -EINVAL;
+               goto exit;
+       }
+
+       ANDROID_INFO(("Routing table count:%u\n", entries));
+       route_tbl->num_entry = entries;
+
+       for (i = 0; i < entries; i++) {
+               str = bcmstrtok(&pcmd, " ", NULL);
+               if (!str || !bcm_atoipv4(str, &dipaddr)) {
+                       ANDROID_ERROR(("Invalid ip string %s\n", str));
+                       err = -EINVAL;
+                       goto exit;
+               }
+
+               str = bcmstrtok(&pcmd, " ", NULL);
+               if (!str || !bcm_ether_atoe(str, &ea)) {
+                       ANDROID_ERROR(("Invalid ethernet string %s\n", str));
+                       err = -EINVAL;
+                       goto exit;
+               }
+               bcopy(&dipaddr, &route_tbl->route_entry[i].ipv4_addr, IPV4_ADDR_LEN);
+               bcopy(&ea, &route_tbl->route_entry[i].nexthop, ETHER_ADDR_LEN);
+       }
+
+       route_tbl_len = sizeof(ibss_route_tbl_t) +
+               ((!entries?0:(entries - 1)) * sizeof(ibss_route_entry_t));
+       err = wldev_iovar_setbuf(dev, "ibss_route_tbl",
+               route_tbl, route_tbl_len, ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+       if (err != BCME_OK) {
+               ANDROID_ERROR(("Fail to set iovar %d\n", err));
+               err = -EINVAL;
+       }
+
+exit:
+       if (route_tbl) {
+               MFREE(cfg->osh, route_tbl, sizeof(ibss_route_tbl_t) +
+                       (MAX_IBSS_ROUTE_TBL_ENTRY - 1) * sizeof(ibss_route_entry_t));
+       }
+       if (ioctl_buf) {
+               MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_MEDLEN);
+       }
+       return err;
+
+}
+
+int
+wl_android_set_ibss_ampdu(struct net_device *dev, char *command, int total_len)
+{
+       char *pcmd = command;
+       char *str = NULL, *endptr = NULL;
+       struct ampdu_aggr aggr;
+       char smbuf[WLC_IOCTL_SMLEN];
+       int idx;
+       int err = 0;
+       int wme_AC2PRIO[AC_COUNT][2] = {
+               {PRIO_8021D_VO, PRIO_8021D_NC},         /* AC_VO - 3 */
+               {PRIO_8021D_CL, PRIO_8021D_VI},         /* AC_VI - 2 */
+               {PRIO_8021D_BK, PRIO_8021D_NONE},       /* AC_BK - 1 */
+               {PRIO_8021D_BE, PRIO_8021D_EE}};        /* AC_BE - 0 */
+
+       ANDROID_INFO(("set ibss ampdu:%s\n", command));
+
+       bzero(&aggr, sizeof(aggr));
+       /* Cofigure all priorities */
+       aggr.conf_TID_bmap = NBITMASK(NUMPRIO);
+
+       /* acquire parameters */
+       /* drop command */
+       str = bcmstrtok(&pcmd, " ", NULL);
+
+       for (idx = 0; idx < AC_COUNT; idx++) {
+               bool on;
+               str = bcmstrtok(&pcmd, " ", NULL);
+               if (!str) {
+                       ANDROID_ERROR(("Invalid parameter : %s\n", pcmd));
+                       return -EINVAL;
+               }
+               on = bcm_strtoul(str, &endptr, 0) ? TRUE : FALSE;
+               if (*endptr != '\0') {
+                       ANDROID_ERROR(("Invalid number format %s\n", str));
+                       return -EINVAL;
+               }
+               if (on) {
+                       setbit(&aggr.enab_TID_bmap, wme_AC2PRIO[idx][0]);
+                       setbit(&aggr.enab_TID_bmap, wme_AC2PRIO[idx][1]);
+               }
+       }
+
+       err = wldev_iovar_setbuf(dev, "ampdu_txaggr", (void *)&aggr,
+       sizeof(aggr), smbuf, WLC_IOCTL_SMLEN, NULL);
+
+       return ((err == 0) ? total_len : err);
+}
+
+int wl_android_set_ibss_antenna(struct net_device *dev, char *command, int total_len)
+{
+       char *pcmd = command;
+       char *str = NULL;
+       int txchain, rxchain;
+       int err = 0;
+
+       ANDROID_INFO(("set ibss antenna:%s\n", command));
+
+       /* acquire parameters */
+       /* drop command */
+       str = bcmstrtok(&pcmd, " ", NULL);
+
+       /* TX chain */
+       str = bcmstrtok(&pcmd, " ", NULL);
+       if (!str) {
+               ANDROID_ERROR(("Invalid parameter : %s\n", pcmd));
+               return -EINVAL;
+       }
+       txchain = bcm_atoi(str);
+
+       /* RX chain */
+       str = bcmstrtok(&pcmd, " ", NULL);
+       if (!str) {
+               ANDROID_ERROR(("Invalid parameter : %s\n", pcmd));
+               return -EINVAL;
+       }
+       rxchain = bcm_atoi(str);
+
+       err = wldev_iovar_setint(dev, "txchain", txchain);
+       if (err != 0)
+               return err;
+       err = wldev_iovar_setint(dev, "rxchain", rxchain);
+       return ((err == 0)?total_len:err);
+}
+#endif /* WLAIBSS */
+
+int wl_keep_alive_set(struct net_device *dev, char* extra)
+{
+       wl_mkeep_alive_pkt_t    mkeep_alive_pkt;
+       int ret;
+       uint period_msec = 0;
+       char *buf;
+       dhd_pub_t *dhd = dhd_get_pub(dev);
+
+       if (extra == NULL) {
+                ANDROID_ERROR(("%s: extra is NULL\n", __FUNCTION__));
+                return -1;
+       }
+       if (sscanf(extra, "%d", &period_msec) != 1) {
+                ANDROID_ERROR(("%s: sscanf error. check period_msec value\n", __FUNCTION__));
+                return -EINVAL;
+       }
+       ANDROID_ERROR(("%s: period_msec is %d\n", __FUNCTION__, period_msec));
+
+       bzero(&mkeep_alive_pkt, sizeof(wl_mkeep_alive_pkt_t));
+
+       mkeep_alive_pkt.period_msec = period_msec;
+       mkeep_alive_pkt.version = htod16(WL_MKEEP_ALIVE_VERSION);
+       mkeep_alive_pkt.length = htod16(WL_MKEEP_ALIVE_FIXED_LEN);
+
+       /* Setup keep alive zero for null packet generation */
+       mkeep_alive_pkt.keep_alive_id = 0;
+       mkeep_alive_pkt.len_bytes = 0;
+
+       buf = (char *)MALLOC(dhd->osh, WLC_IOCTL_SMLEN);
+       if (!buf) {
+               ANDROID_ERROR(("%s: buffer alloc failed\n", __FUNCTION__));
+               return BCME_NOMEM;
+       }
+       ret = wldev_iovar_setbuf(dev, "mkeep_alive", (char *)&mkeep_alive_pkt,
+                       WL_MKEEP_ALIVE_FIXED_LEN, buf, WLC_IOCTL_SMLEN, NULL);
+       if (ret < 0)
+               ANDROID_ERROR(("%s:keep_alive set failed:%d\n", __FUNCTION__, ret));
+       else
+               ANDROID_TRACE(("%s:keep_alive set ok\n", __FUNCTION__));
+       MFREE(dhd->osh, buf, WLC_IOCTL_SMLEN);
+       return ret;
+}
+
+#ifdef P2PRESP_WFDIE_SRC
+static int wl_android_get_wfdie_resp(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       int bytes_written = 0;
+       int only_resp_wfdsrc = 0;
+
+       error = wldev_iovar_getint(dev, "p2p_only_resp_wfdsrc", &only_resp_wfdsrc);
+       if (error) {
+               ANDROID_ERROR(("%s: Failed to get the mode for only_resp_wfdsrc, error = %d\n",
+                       __FUNCTION__, error));
+               return -1;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d",
+               CMD_P2P_GET_WFDIE_RESP, only_resp_wfdsrc);
+
+       return bytes_written;
+}
+
+static int wl_android_set_wfdie_resp(struct net_device *dev, int only_resp_wfdsrc)
+{
+       int error = 0;
+
+       error = wldev_iovar_setint(dev, "p2p_only_resp_wfdsrc", only_resp_wfdsrc);
+       if (error) {
+               ANDROID_ERROR(("%s: Failed to set only_resp_wfdsrc %d, error = %d\n",
+                       __FUNCTION__, only_resp_wfdsrc, error));
+               return -1;
+       }
+
+       return 0;
+}
+#endif /* P2PRESP_WFDIE_SRC */
+
+#ifdef BT_WIFI_HANDOVER
+static int
+wl_tbow_teardown(struct net_device *dev)
+{
+       int err = BCME_OK;
+       char buf[WLC_IOCTL_SMLEN];
+       tbow_setup_netinfo_t netinfo;
+       bzero(&netinfo, sizeof(netinfo));
+       netinfo.opmode = TBOW_HO_MODE_TEARDOWN;
+
+       err = wldev_iovar_setbuf_bsscfg(dev, "tbow_doho", &netinfo,
+                       sizeof(tbow_setup_netinfo_t), buf, WLC_IOCTL_SMLEN, 0, NULL);
+       if (err < 0) {
+               ANDROID_ERROR(("tbow_doho iovar error %d\n", err));
+               return err;
+       }
+       return err;
+}
+#endif /* BT_WIFI_HANOVER */
+
+static int wl_android_get_link_status(struct net_device *dev, char *command,
+       int total_len)
+{
+       int bytes_written, error, result = 0, single_stream, stf = -1, i, nss = 0, mcs_map;
+       uint32 rspec;
+       uint encode, txexp;
+       wl_bss_info_t *bi;
+       int datalen = sizeof(uint32) + sizeof(wl_bss_info_t);
+       char buf[WLC_IOCTL_SMLEN];
+
+       if (datalen > WLC_IOCTL_SMLEN) {
+               ANDROID_ERROR(("data too big\n"));
+               return -1;
+       }
+
+       bzero(buf, datalen);
+       /* get BSS information */
+       *(u32 *) buf = htod32(datalen);
+       error = wldev_ioctl_get(dev, WLC_GET_BSS_INFO, (void *)buf, datalen);
+       if (unlikely(error)) {
+               ANDROID_ERROR(("Could not get bss info %d\n", error));
+               return -1;
+       }
+
+       bi = (wl_bss_info_t*) (buf + sizeof(uint32));
+
+       for (i = 0; i < ETHER_ADDR_LEN; i++) {
+               if (bi->BSSID.octet[i] > 0) {
+                       break;
+               }
+       }
+
+       if (i == ETHER_ADDR_LEN) {
+               ANDROID_INFO(("No BSSID\n"));
+               return -1;
+       }
+
+       /* check VHT capability at beacon */
+       if (bi->vht_cap) {
+               if (CHSPEC_IS5G(bi->chanspec)) {
+                       result |= WL_ANDROID_LINK_AP_VHT_SUPPORT;
+               }
+       }
+
+       /* get a rspec (radio spectrum) rate */
+       error = wldev_iovar_getint(dev, "nrate", &rspec);
+       if (unlikely(error) || rspec == 0) {
+               ANDROID_ERROR(("get link status error (%d)\n", error));
+               return -1;
+       }
+
+       /* referred wl_nrate_print() for the calculation */
+       encode = (rspec & WL_RSPEC_ENCODING_MASK);
+       txexp = (rspec & WL_RSPEC_TXEXP_MASK) >> WL_RSPEC_TXEXP_SHIFT;
+
+       switch (encode) {
+       case WL_RSPEC_ENCODE_HT:
+               /* check Rx MCS Map for HT */
+               for (i = 0; i < MAX_STREAMS_SUPPORTED; i++) {
+                       int8 bitmap = 0xFF;
+                       if (i == MAX_STREAMS_SUPPORTED-1) {
+                               bitmap = 0x7F;
+                       }
+                       if (bi->basic_mcs[i] & bitmap) {
+                               nss++;
+                       }
+               }
+               break;
+       case WL_RSPEC_ENCODE_VHT:
+               /* check Rx MCS Map for VHT */
+               for (i = 1; i <= VHT_CAP_MCS_MAP_NSS_MAX; i++) {
+                       mcs_map = VHT_MCS_MAP_GET_MCS_PER_SS(i, dtoh16(bi->vht_rxmcsmap));
+                       if (mcs_map != VHT_CAP_MCS_MAP_NONE) {
+                               nss++;
+                       }
+               }
+               break;
+       }
+
+       /* check MIMO capability with nss in beacon */
+       if (nss > 1) {
+               result |= WL_ANDROID_LINK_AP_MIMO_SUPPORT;
+       }
+
+       /* Legacy rates WL_RSPEC_ENCODE_RATE are single stream, and
+        * HT rates for mcs 0-7 are single stream.
+        * In case of VHT NSS comes from rspec.
+        */
+       single_stream = (encode == WL_RSPEC_ENCODE_RATE) ||
+               ((encode == WL_RSPEC_ENCODE_HT) && (rspec & WL_RSPEC_HT_MCS_MASK) < 8) ||
+               ((encode == WL_RSPEC_ENCODE_VHT) &&
+               ((rspec & WL_RSPEC_VHT_NSS_MASK) >> WL_RSPEC_VHT_NSS_SHIFT) == 1);
+
+       if (txexp == 0) {
+               if ((rspec & WL_RSPEC_STBC) && single_stream) {
+                       stf = OLD_NRATE_STF_STBC;
+               } else {
+                       stf = (single_stream) ? OLD_NRATE_STF_SISO : OLD_NRATE_STF_SDM;
+               }
+       } else if (txexp == 1 && single_stream) {
+               stf = OLD_NRATE_STF_CDD;
+       }
+
+       /* check 11ac (VHT) */
+       if (encode == WL_RSPEC_ENCODE_VHT) {
+               if (CHSPEC_IS5G(bi->chanspec)) {
+                       result |= WL_ANDROID_LINK_VHT;
+               }
+       }
+
+       /* check MIMO */
+       if (result & WL_ANDROID_LINK_AP_MIMO_SUPPORT) {
+               switch (stf) {
+               case OLD_NRATE_STF_SISO:
+                       break;
+               case OLD_NRATE_STF_CDD:
+               case OLD_NRATE_STF_STBC:
+                       result |= WL_ANDROID_LINK_MIMO;
+                       break;
+               case OLD_NRATE_STF_SDM:
+                       if (!single_stream) {
+                               result |= WL_ANDROID_LINK_MIMO;
+                       }
+                       break;
+               }
+       }
+
+       ANDROID_INFO(("%s:result=%d, stf=%d, single_stream=%d, mcs map=%d\n",
+               __FUNCTION__, result, stf, single_stream, nss));
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_GET_LINK_STATUS, result);
+
+       return bytes_written;
+}
+
+#ifdef P2P_LISTEN_OFFLOADING
+
+s32
+wl_cfg80211_p2plo_deinit(struct bcm_cfg80211 *cfg)
+{
+       s32 bssidx;
+       int ret = 0;
+       int p2plo_pause = 0;
+       dhd_pub_t *dhd = NULL;
+       if (!cfg || !cfg->p2p) {
+               ANDROID_ERROR(("Wl %p or cfg->p2p %p is null\n",
+                       cfg, cfg ? cfg->p2p : 0));
+               return 0;
+       }
+
+       dhd =  (dhd_pub_t *)(cfg->pub);
+       if (!dhd->up) {
+               ANDROID_ERROR(("bus is already down\n"));
+               return ret;
+       }
+
+       bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+       ret = wldev_iovar_setbuf_bsscfg(bcmcfg_to_prmry_ndev(cfg),
+                       "p2po_stop", (void*)&p2plo_pause, sizeof(p2plo_pause),
+                       cfg->ioctl_buf, WLC_IOCTL_SMLEN, bssidx, &cfg->ioctl_buf_sync);
+       if (ret < 0) {
+               ANDROID_ERROR(("p2po_stop Failed :%d\n", ret));
+       }
+
+       return  ret;
+}
+s32
+wl_cfg80211_p2plo_listen_start(struct net_device *dev, u8 *buf, int len)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       s32 bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+       wl_p2plo_listen_t p2plo_listen;
+       int ret = -EAGAIN;
+       int channel = 0;
+       int period = 0;
+       int interval = 0;
+       int count = 0;
+       if (WL_DRV_STATUS_SENDING_AF_FRM_EXT(cfg)) {
+               ANDROID_ERROR(("Sending Action Frames. Try it again.\n"));
+               goto exit;
+       }
+
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               ANDROID_ERROR(("Scanning already\n"));
+               goto exit;
+       }
+
+       if (wl_get_drv_status(cfg, SCAN_ABORTING, dev)) {
+               ANDROID_ERROR(("Scanning being aborted\n"));
+               goto exit;
+       }
+
+       if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS)) {
+               ANDROID_ERROR(("p2p listen offloading already running\n"));
+               goto exit;
+       }
+
+       /* Just in case if it is not enabled */
+       if ((ret = wl_cfgp2p_enable_discovery(cfg, dev, NULL, 0)) < 0) {
+               ANDROID_ERROR(("cfgp2p_enable discovery failed"));
+               goto exit;
+       }
+
+       bzero(&p2plo_listen, sizeof(wl_p2plo_listen_t));
+
+       if (len) {
+               sscanf(buf, " %10d %10d %10d %10d", &channel, &period, &interval, &count);
+               if ((channel == 0) || (period == 0) ||
+                               (interval == 0) || (count == 0)) {
+                       ANDROID_ERROR(("Wrong argument %d/%d/%d/%d \n",
+                               channel, period, interval, count));
+                       ret = -EAGAIN;
+                       goto exit;
+               }
+               p2plo_listen.period = period;
+               p2plo_listen.interval = interval;
+               p2plo_listen.count = count;
+
+               ANDROID_ERROR(("channel:%d period:%d, interval:%d count:%d\n",
+                       channel, period, interval, count));
+       } else {
+               ANDROID_ERROR(("Argument len is wrong.\n"));
+               ret = -EAGAIN;
+               goto exit;
+       }
+
+       if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_listen_channel", (void*)&channel,
+                       sizeof(channel), cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+                       bssidx, &cfg->ioctl_buf_sync)) < 0) {
+               ANDROID_ERROR(("p2po_listen_channel Failed :%d\n", ret));
+               goto exit;
+       }
+
+       if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_listen", (void*)&p2plo_listen,
+                       sizeof(wl_p2plo_listen_t), cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+                       bssidx, &cfg->ioctl_buf_sync)) < 0) {
+               ANDROID_ERROR(("p2po_listen Failed :%d\n", ret));
+               goto exit;
+       }
+
+       wl_set_p2p_status(cfg, DISC_IN_PROGRESS);
+exit :
+       return ret;
+}
+s32
+wl_cfg80211_p2plo_listen_stop(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       s32 bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+       int ret = -EAGAIN;
+
+       if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_stop", NULL,
+                       0, cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+                       bssidx, &cfg->ioctl_buf_sync)) < 0) {
+               ANDROID_ERROR(("p2po_stop Failed :%d\n", ret));
+               goto exit;
+       }
+
+exit:
+       return ret;
+}
+
+s32
+wl_cfg80211_p2plo_offload(struct net_device *dev, char *cmd, char* buf, int len)
+{
+       int ret = 0;
+
+       ANDROID_ERROR(("Entry cmd:%s arg_len:%d \n", cmd, len));
+
+       if (strncmp(cmd, "P2P_LO_START", strlen("P2P_LO_START")) == 0) {
+               ret = wl_cfg80211_p2plo_listen_start(dev, buf, len);
+       } else if (strncmp(cmd, "P2P_LO_STOP", strlen("P2P_LO_STOP")) == 0) {
+               ret = wl_cfg80211_p2plo_listen_stop(dev);
+       } else {
+               ANDROID_ERROR(("Request for Unsupported CMD:%s \n", buf));
+               ret = -EINVAL;
+       }
+       return ret;
+}
+void
+wl_cfg80211_cancel_p2plo(struct bcm_cfg80211 *cfg)
+{
+       struct wireless_dev *wdev;
+       if (!cfg) {
+               return;
+       }
+
+       wdev = bcmcfg_to_p2p_wdev(cfg);
+
+       if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS)) {
+               ANDROID_INFO(("P2P_FIND: Discovery offload is already in progress."
+                                       "it aborted\n"));
+               wl_clr_p2p_status(cfg, DISC_IN_PROGRESS);
+               if (wdev != NULL) {
+#if defined(WL_CFG80211_P2P_DEV_IF)
+                       cfg80211_remain_on_channel_expired(wdev,
+                                       cfg->last_roc_id,
+                                       &cfg->remain_on_chan, GFP_KERNEL);
+#else
+                       cfg80211_remain_on_channel_expired(wdev,
+                                       cfg->last_roc_id,
+                                       &cfg->remain_on_chan,
+                                       cfg->remain_on_chan_type, GFP_KERNEL);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+               }
+               wl_cfg80211_p2plo_deinit(cfg);
+       }
+}
+#endif /* P2P_LISTEN_OFFLOADING */
+
+#ifdef WL_MURX
+int
+wl_android_murx_bfe_cap(struct net_device *dev, int val)
+{
+       int err = BCME_OK;
+       int iface_count = wl_cfg80211_iface_count(dev);
+       struct ether_addr bssid;
+       wl_reassoc_params_t params;
+
+       if (iface_count > 1) {
+               ANDROID_ERROR(("murx_bfe_cap change is not allowed when "
+                               "there are multiple interfaces\n"));
+               return -EINVAL;
+       }
+       /* Now there is only single interface */
+       err = wldev_iovar_setint(dev, "murx_bfe_cap", val);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("Failed to set murx_bfe_cap IOVAR to %d,"
+                               "error %d\n", val, err));
+               return err;
+       }
+
+       /* If successful intiate a reassoc */
+       bzero(&bssid, ETHER_ADDR_LEN);
+       if ((err = wldev_ioctl_get(dev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN)) < 0) {
+               ANDROID_ERROR(("Failed to get bssid, error=%d\n", err));
+               return err;
+       }
+
+       bzero(&params, sizeof(wl_reassoc_params_t));
+       memcpy(&params.bssid, &bssid, ETHER_ADDR_LEN);
+
+       if ((err = wldev_ioctl_set(dev, WLC_REASSOC, &params,
+               sizeof(wl_reassoc_params_t))) < 0) {
+               ANDROID_ERROR(("reassoc failed err:%d \n", err));
+       } else {
+               ANDROID_INFO(("reassoc issued successfully\n"));
+       }
+
+       return err;
+}
+#endif /* WL_MURX */
+
+#ifdef SUPPORT_RSSI_SUM_REPORT
+int
+wl_android_get_rssi_per_ant(struct net_device *dev, char *command, int total_len)
+{
+       wl_rssi_ant_mimo_t rssi_ant_mimo;
+       char *ifname = NULL;
+       char *peer_mac = NULL;
+       char *mimo_cmd = "mimo";
+       char *pos, *token;
+       int err = BCME_OK;
+       int bytes_written = 0;
+       bool mimo_rssi = FALSE;
+
+       bzero(&rssi_ant_mimo, sizeof(wl_rssi_ant_mimo_t));
+       /*
+        * STA I/F: DRIVER GET_RSSI_PER_ANT <ifname> <mimo>
+        * AP/GO I/F: DRIVER GET_RSSI_PER_ANT <ifname> <Peer MAC addr> <mimo>
+        */
+       pos = command;
+
+       /* drop command */
+       token = bcmstrtok(&pos, " ", NULL);
+
+       /* get the interface name */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               ANDROID_ERROR(("Invalid arguments\n"));
+               return -EINVAL;
+       }
+       ifname = token;
+
+       /* Optional: Check the MIMO RSSI mode or peer MAC address */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (token) {
+               /* Check the MIMO RSSI mode */
+               if (strncmp(token, mimo_cmd, strlen(mimo_cmd)) == 0) {
+                       mimo_rssi = TRUE;
+               } else {
+                       peer_mac = token;
+               }
+       }
+
+       /* Optional: Check the MIMO RSSI mode - RSSI sum across antennas */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (token && strncmp(token, mimo_cmd, strlen(mimo_cmd)) == 0) {
+               mimo_rssi = TRUE;
+       }
+
+       err = wl_get_rssi_per_ant(dev, ifname, peer_mac, &rssi_ant_mimo);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("Failed to get RSSI info, err=%d\n", err));
+               return err;
+       }
+
+       /* Parse the results */
+       ANDROID_INFO(("ifname %s, version %d, count %d, mimo rssi %d\n",
+               ifname, rssi_ant_mimo.version, rssi_ant_mimo.count, mimo_rssi));
+       if (mimo_rssi) {
+               ANDROID_INFO(("MIMO RSSI: %d\n", rssi_ant_mimo.rssi_sum));
+               bytes_written = snprintf(command, total_len, "%s MIMO %d",
+                       CMD_GET_RSSI_PER_ANT, rssi_ant_mimo.rssi_sum);
+       } else {
+               int cnt;
+               bytes_written = snprintf(command, total_len, "%s PER_ANT ", CMD_GET_RSSI_PER_ANT);
+               for (cnt = 0; cnt < rssi_ant_mimo.count; cnt++) {
+                       ANDROID_INFO(("RSSI[%d]: %d\n", cnt, rssi_ant_mimo.rssi_ant[cnt]));
+                       bytes_written = snprintf(command, total_len, "%d ",
+                               rssi_ant_mimo.rssi_ant[cnt]);
+               }
+       }
+
+       return bytes_written;
+}
+
+int
+wl_android_set_rssi_logging(struct net_device *dev, char *command, int total_len)
+{
+       rssilog_set_param_t set_param;
+       char *pos, *token;
+       int err = BCME_OK;
+
+       bzero(&set_param, sizeof(rssilog_set_param_t));
+       /*
+        * DRIVER SET_RSSI_LOGGING <enable/disable> <RSSI Threshold> <Time Threshold>
+        */
+       pos = command;
+
+       /* drop command */
+       token = bcmstrtok(&pos, " ", NULL);
+
+       /* enable/disable */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               ANDROID_ERROR(("Invalid arguments\n"));
+               return -EINVAL;
+       }
+       set_param.enable = bcm_atoi(token);
+
+       /* RSSI Threshold */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               ANDROID_ERROR(("Invalid arguments\n"));
+               return -EINVAL;
+       }
+       set_param.rssi_threshold = bcm_atoi(token);
+
+       /* Time Threshold */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               ANDROID_ERROR(("Invalid arguments\n"));
+               return -EINVAL;
+       }
+       set_param.time_threshold = bcm_atoi(token);
+
+       ANDROID_INFO(("enable %d, RSSI threshold %d, Time threshold %d\n", set_param.enable,
+               set_param.rssi_threshold, set_param.time_threshold));
+
+       err = wl_set_rssi_logging(dev, (void *)&set_param);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("Failed to configure RSSI logging: enable %d, RSSI Threshold %d,"
+                       " Time Threshold %d\n", set_param.enable, set_param.rssi_threshold,
+                       set_param.time_threshold));
+       }
+
+       return err;
+}
+
+int
+wl_android_get_rssi_logging(struct net_device *dev, char *command, int total_len)
+{
+       rssilog_get_param_t get_param;
+       int err = BCME_OK;
+       int bytes_written = 0;
+
+       err = wl_get_rssi_logging(dev, (void *)&get_param);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("Failed to get RSSI logging info\n"));
+               return BCME_ERROR;
+       }
+
+       ANDROID_INFO(("report_count %d, enable %d, rssi_threshold %d, time_threshold %d\n",
+               get_param.report_count, get_param.enable, get_param.rssi_threshold,
+               get_param.time_threshold));
+
+       /* Parse the parameter */
+       if (!get_param.enable) {
+               ANDROID_INFO(("RSSI LOGGING: Feature is disables\n"));
+               bytes_written = snprintf(command, total_len,
+                       "%s FEATURE DISABLED\n", CMD_GET_RSSI_LOGGING);
+       } else if (get_param.enable &
+               (RSSILOG_FLAG_FEATURE_SW | RSSILOG_FLAG_REPORT_READY)) {
+               if (!get_param.report_count) {
+                       ANDROID_INFO(("[PASS] RSSI difference across antennas is within"
+                               " threshold limits\n"));
+                       bytes_written = snprintf(command, total_len, "%s PASS\n",
+                               CMD_GET_RSSI_LOGGING);
+               } else {
+                       ANDROID_INFO(("[FAIL] RSSI difference across antennas found "
+                               "to be greater than %3d dB\n", get_param.rssi_threshold));
+                       ANDROID_INFO(("[FAIL] RSSI difference check have failed for "
+                               "%d out of %d times\n", get_param.report_count,
+                               get_param.time_threshold));
+                       ANDROID_INFO(("[FAIL] RSSI difference is being monitored once "
+                               "per second, for a %d secs window\n", get_param.time_threshold));
+                       bytes_written = snprintf(command, total_len, "%s FAIL - RSSI Threshold "
+                               "%d dBm for %d out of %d times\n", CMD_GET_RSSI_LOGGING,
+                               get_param.rssi_threshold, get_param.report_count,
+                               get_param.time_threshold);
+               }
+       } else {
+               ANDROID_INFO(("[BUSY] Reprot is not ready\n"));
+               bytes_written = snprintf(command, total_len, "%s BUSY - NOT READY\n",
+                       CMD_GET_RSSI_LOGGING);
+       }
+
+       return bytes_written;
+}
+#endif /* SUPPORT_RSSI_SUM_REPORT */
+
+#ifdef SET_PCIE_IRQ_CPU_CORE
+void
+wl_android_set_irq_cpucore(struct net_device *net, int affinity_cmd)
+{
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(net);
+       if (!dhdp) {
+               ANDROID_ERROR(("dhd is NULL\n"));
+               return;
+       }
+
+       if (affinity_cmd < PCIE_IRQ_AFFINITY_OFF || affinity_cmd > PCIE_IRQ_AFFINITY_LAST) {
+               ANDROID_ERROR(("Wrong Affinity cmds:%d, %s\n", affinity_cmd, __FUNCTION__));
+               return;
+       }
+
+       dhd_set_irq_cpucore(dhdp, affinity_cmd);
+}
+#endif /* SET_PCIE_IRQ_CPU_CORE */
+
+#ifdef SUPPORT_LQCM
+static int
+wl_android_lqcm_enable(struct net_device *net, int lqcm_enable)
+{
+       int err = 0;
+
+       err = wldev_iovar_setint(net, "lqcm", lqcm_enable);
+       if (err != BCME_OK) {
+               ANDROID_ERROR(("failed to set lqcm enable %d, error = %d\n", lqcm_enable, err));
+               return -EIO;
+       }
+       return err;
+}
+
+static int
+wl_android_get_lqcm_report(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written, err = 0;
+       uint32 lqcm_report = 0;
+       uint32 lqcm_enable, tx_lqcm_idx, rx_lqcm_idx;
+
+       err = wldev_iovar_getint(dev, "lqcm", &lqcm_report);
+       if (err != BCME_OK) {
+               ANDROID_ERROR(("failed to get lqcm report, error = %d\n", err));
+               return -EIO;
+       }
+       lqcm_enable = lqcm_report & LQCM_ENAB_MASK;
+       tx_lqcm_idx = (lqcm_report & LQCM_TX_INDEX_MASK) >> LQCM_TX_INDEX_SHIFT;
+       rx_lqcm_idx = (lqcm_report & LQCM_RX_INDEX_MASK) >> LQCM_RX_INDEX_SHIFT;
+
+       ANDROID_INFO(("lqcm report EN:%d, TX:%d, RX:%d\n", lqcm_enable, tx_lqcm_idx, rx_lqcm_idx));
+
+       bytes_written = snprintf(command, total_len, "%s %d",
+                       CMD_GET_LQCM_REPORT, lqcm_report);
+
+       return bytes_written;
+}
+#endif /* SUPPORT_LQCM */
+
+int
+wl_android_get_snr(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written, error = 0;
+       s32 snr = 0;
+
+       error = wldev_iovar_getint(dev, "snr", &snr);
+       if (error) {
+               ANDROID_ERROR(("%s: Failed to get SNR %d, error = %d\n",
+                       __FUNCTION__, snr, error));
+               return -EIO;
+       }
+
+       bytes_written = snprintf(command, total_len, "snr %d", snr);
+       ANDROID_INFO(("%s: command result is %s\n", __FUNCTION__, command));
+       return bytes_written;
+}
+
+#ifdef SUPPORT_AP_HIGHER_BEACONRATE
+int
+wl_android_set_ap_beaconrate(struct net_device *dev, char *command)
+{
+       int rate = 0;
+       char *pos, *token;
+       char *ifname = NULL;
+       int err = BCME_OK;
+
+       /*
+        * DRIVER SET_AP_BEACONRATE <rate> <ifname>
+        */
+       pos = command;
+
+       /* drop command */
+       token = bcmstrtok(&pos, " ", NULL);
+
+       /* Rate */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token)
+               return -EINVAL;
+       rate = bcm_atoi(token);
+
+       /* get the interface name */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token)
+               return -EINVAL;
+       ifname = token;
+
+       ANDROID_INFO(("rate %d, ifacename %s\n", rate, ifname));
+
+       err = wl_set_ap_beacon_rate(dev, rate, ifname);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("Failed to set ap beacon rate to %d, error = %d\n", rate, err));
+       }
+
+       return err;
+}
+
+int wl_android_get_ap_basicrate(struct net_device *dev, char *command, int total_len)
+{
+       char *pos, *token;
+       char *ifname = NULL;
+       int bytes_written = 0;
+       /*
+        * DRIVER GET_AP_BASICRATE <ifname>
+        */
+       pos = command;
+
+       /* drop command */
+       token = bcmstrtok(&pos, " ", NULL);
+
+       /* get the interface name */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token)
+               return -EINVAL;
+       ifname = token;
+
+       ANDROID_INFO(("ifacename %s\n", ifname));
+
+       bytes_written = wl_get_ap_basic_rate(dev, command, ifname, total_len);
+       if (bytes_written < 1) {
+               ANDROID_ERROR(("Failed to get ap basic rate, error = %d\n", bytes_written));
+               return -EPROTO;
+       }
+
+       return bytes_written;
+}
+#endif /* SUPPORT_AP_HIGHER_BEACONRATE */
+
+#ifdef SUPPORT_AP_RADIO_PWRSAVE
+int
+wl_android_get_ap_rps(struct net_device *dev, char *command, int total_len)
+{
+       char *pos, *token;
+       char *ifname = NULL;
+       int bytes_written = 0;
+       char name[IFNAMSIZ];
+       /*
+        * DRIVER GET_AP_RPS <ifname>
+        */
+       pos = command;
+
+       /* drop command */
+       token = bcmstrtok(&pos, " ", NULL);
+
+       /* get the interface name */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token)
+               return -EINVAL;
+       ifname = token;
+
+       strlcpy(name, ifname, sizeof(name));
+       ANDROID_INFO(("ifacename %s\n", name));
+
+       bytes_written = wl_get_ap_rps(dev, command, name, total_len);
+       if (bytes_written < 1) {
+               ANDROID_ERROR(("Failed to get rps, error = %d\n", bytes_written));
+               return -EPROTO;
+       }
+
+       return bytes_written;
+
+}
+
+int
+wl_android_set_ap_rps(struct net_device *dev, char *command, int total_len)
+{
+       int enable = 0;
+       char *pos, *token;
+       char *ifname = NULL;
+       int err = BCME_OK;
+       char name[IFNAMSIZ];
+
+       /*
+        * DRIVER SET_AP_RPS <0/1> <ifname>
+        */
+       pos = command;
+
+       /* drop command */
+       token = bcmstrtok(&pos, " ", NULL);
+
+       /* Enable */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token)
+               return -EINVAL;
+       enable = bcm_atoi(token);
+
+       /* get the interface name */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token)
+               return -EINVAL;
+       ifname = token;
+
+       strlcpy(name, ifname, sizeof(name));
+       ANDROID_INFO(("enable %d, ifacename %s\n", enable, name));
+
+       err = wl_set_ap_rps(dev, enable? TRUE: FALSE, name);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("Failed to set rps, enable %d, error = %d\n", enable, err));
+       }
+
+       return err;
+}
+
+int
+wl_android_set_ap_rps_params(struct net_device *dev, char *command, int total_len)
+{
+       ap_rps_info_t rps;
+       char *pos, *token;
+       char *ifname = NULL;
+       int err = BCME_OK;
+       char name[IFNAMSIZ];
+
+       bzero(&rps, sizeof(rps));
+       /*
+        * DRIVER SET_AP_RPS_PARAMS <pps> <level> <quiettime> <assoccheck> <ifname>
+        */
+       pos = command;
+
+       /* drop command */
+       token = bcmstrtok(&pos, " ", NULL);
+
+       /* pps */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token)
+               return -EINVAL;
+       rps.pps = bcm_atoi(token);
+
+       /* level */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token)
+               return -EINVAL;
+       rps.level = bcm_atoi(token);
+
+       /* quiettime */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token)
+               return -EINVAL;
+       rps.quiet_time = bcm_atoi(token);
+
+       /* sta assoc check */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token)
+               return -EINVAL;
+       rps.sta_assoc_check = bcm_atoi(token);
+
+       /* get the interface name */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token)
+               return -EINVAL;
+       ifname = token;
+       strlcpy(name, ifname, sizeof(name));
+
+       ANDROID_INFO(("pps %d, level %d, quiettime %d, sta_assoc_check %d, "
+               "ifacename %s\n", rps.pps, rps.level, rps.quiet_time,
+               rps.sta_assoc_check, name));
+
+       err = wl_update_ap_rps_params(dev, &rps, name);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("Failed to update rps, pps %d, level %d, quiettime %d, "
+                       "sta_assoc_check %d, err = %d\n", rps.pps, rps.level, rps.quiet_time,
+                       rps.sta_assoc_check, err));
+       }
+
+       return err;
+}
+#endif /* SUPPORT_AP_RADIO_PWRSAVE */
+
+#if defined(DHD_HANG_SEND_UP_TEST)
+void
+wl_android_make_hang_with_reason(struct net_device *dev, const char *string_num)
+{
+       dhd_make_hang_with_reason(dev, string_num);
+}
+#endif /* DHD_HANG_SEND_UP_TEST */
+
+#ifdef DHD_SEND_HANG_PRIVCMD_ERRORS
+static void
+wl_android_check_priv_cmd_errors(struct net_device *dev)
+{
+       dhd_pub_t *dhdp;
+       int memdump_mode;
+
+       if (!dev) {
+               ANDROID_ERROR(("dev is NULL\n"));
+               return;
+       }
+
+       dhdp = wl_cfg80211_get_dhdp(dev);
+       if (!dhdp) {
+               ANDROID_ERROR(("dhdp is NULL\n"));
+               return;
+       }
+
+#ifdef DHD_FW_COREDUMP
+       memdump_mode = dhdp->memdump_enabled;
+#else
+       /* Default enable if DHD doesn't support SOCRAM dump */
+       memdump_mode = 1;
+#endif /* DHD_FW_COREDUMP */
+
+       if (report_hang_privcmd_err) {
+               priv_cmd_errors++;
+       } else {
+               priv_cmd_errors = 0;
+       }
+
+       /* Trigger HANG event only if memdump mode is enabled
+        * due to customer's request
+        */
+       if (memdump_mode == DUMP_MEMFILE_BUGON &&
+               (priv_cmd_errors > NUMBER_SEQUENTIAL_PRIVCMD_ERRORS)) {
+               ANDROID_ERROR(("Send HANG event due to sequential private cmd errors\n"));
+               priv_cmd_errors = 0;
+#ifdef DHD_FW_COREDUMP
+               /* Take a SOCRAM dump */
+               dhdp->memdump_type = DUMP_TYPE_SEQUENTIAL_PRIVCMD_ERROR;
+               dhd_common_socram_dump(dhdp);
+#endif /* DHD_FW_COREDUMP */
+               /* Send the HANG event to upper layer */
+               dhdp->hang_reason = HANG_REASON_SEQUENTIAL_PRIVCMD_ERROR;
+               dhd_os_check_hang(dhdp, 0, -EREMOTEIO);
+       }
+}
+#endif /* DHD_SEND_HANG_PRIVCMD_ERRORS */
+
+#ifdef DHD_PKT_LOGGING
+static int
+wl_android_pktlog_filter_enable(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       dhd_pktlog_filter_t *filter;
+       int err = BCME_OK;
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       filter = dhdp->pktlog->pktlog_filter;
+
+       err = dhd_pktlog_filter_enable(filter, PKTLOG_TXPKT_CASE, TRUE);
+       err = dhd_pktlog_filter_enable(filter, PKTLOG_TXSTATUS_CASE, TRUE);
+       err = dhd_pktlog_filter_enable(filter, PKTLOG_RXPKT_CASE, TRUE);
+
+       if (err == BCME_OK) {
+               bytes_written = snprintf(command, total_len, "OK");
+               ANDROID_ERROR(("%s: pktlog filter enable success\n", __FUNCTION__));
+       } else {
+               ANDROID_ERROR(("%s: pktlog filter enable fail\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       return bytes_written;
+}
+
+static int
+wl_android_pktlog_filter_disable(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       dhd_pktlog_filter_t *filter;
+       int err = BCME_OK;
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       filter = dhdp->pktlog->pktlog_filter;
+
+       err = dhd_pktlog_filter_enable(filter, PKTLOG_TXPKT_CASE, FALSE);
+       err = dhd_pktlog_filter_enable(filter, PKTLOG_TXSTATUS_CASE, FALSE);
+       err = dhd_pktlog_filter_enable(filter, PKTLOG_RXPKT_CASE, FALSE);
+
+       if (err == BCME_OK) {
+               bytes_written = snprintf(command, total_len, "OK");
+               ANDROID_ERROR(("%s: pktlog filter disable success\n", __FUNCTION__));
+       } else {
+               ANDROID_ERROR(("%s: pktlog filter disable fail\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       return bytes_written;
+}
+
+static int
+wl_android_pktlog_filter_pattern_enable(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       dhd_pktlog_filter_t *filter;
+       int err = BCME_OK;
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       filter = dhdp->pktlog->pktlog_filter;
+
+       if (strlen(CMD_PKTLOG_FILTER_PATTERN_ENABLE) + 1 > total_len) {
+               return BCME_ERROR;
+       }
+
+       err = dhd_pktlog_filter_pattern_enable(filter,
+                       command + strlen(CMD_PKTLOG_FILTER_PATTERN_ENABLE) + 1, TRUE);
+
+       if (err == BCME_OK) {
+               bytes_written = snprintf(command, total_len, "OK");
+               ANDROID_ERROR(("%s: pktlog filter pattern enable success\n", __FUNCTION__));
+       } else {
+               ANDROID_ERROR(("%s: pktlog filter pattern enable fail\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       return bytes_written;
+}
+
+static int
+wl_android_pktlog_filter_pattern_disable(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       dhd_pktlog_filter_t *filter;
+       int err = BCME_OK;
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       filter = dhdp->pktlog->pktlog_filter;
+
+       if (strlen(CMD_PKTLOG_FILTER_PATTERN_DISABLE) + 1 > total_len) {
+               return BCME_ERROR;
+       }
+
+       err = dhd_pktlog_filter_pattern_enable(filter,
+                       command + strlen(CMD_PKTLOG_FILTER_PATTERN_DISABLE) + 1, FALSE);
+
+       if (err == BCME_OK) {
+               bytes_written = snprintf(command, total_len, "OK");
+               ANDROID_ERROR(("%s: pktlog filter pattern disable success\n", __FUNCTION__));
+       } else {
+               ANDROID_ERROR(("%s: pktlog filter pattern disable fail\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       return bytes_written;
+}
+
+static int
+wl_android_pktlog_filter_add(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       dhd_pktlog_filter_t *filter;
+       int err = BCME_OK;
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       filter = dhdp->pktlog->pktlog_filter;
+
+       if (strlen(CMD_PKTLOG_FILTER_ADD) + 1 > total_len) {
+               return BCME_ERROR;
+       }
+
+       err = dhd_pktlog_filter_add(filter, command + strlen(CMD_PKTLOG_FILTER_ADD) + 1);
+
+       if (err == BCME_OK) {
+               bytes_written = snprintf(command, total_len, "OK");
+               ANDROID_ERROR(("%s: pktlog filter add success\n", __FUNCTION__));
+       } else {
+               ANDROID_ERROR(("%s: pktlog filter add fail\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       return bytes_written;
+}
+
+static int
+wl_android_pktlog_filter_del(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       dhd_pktlog_filter_t *filter;
+       int err = BCME_OK;
+
+       if (!dhdp || !dhdp->pktlog) {
+               ANDROID_ERROR(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       filter = dhdp->pktlog->pktlog_filter;
+
+       if (strlen(CMD_PKTLOG_FILTER_DEL) + 1 > total_len) {
+               DHD_PKT_LOG(("%s(): wrong cmd length %d found\n",
+                       __FUNCTION__, (int)strlen(CMD_PKTLOG_FILTER_DEL)));
+               return BCME_ERROR;
+       }
+
+       err = dhd_pktlog_filter_del(filter, command + strlen(CMD_PKTLOG_FILTER_DEL) + 1);
+       if (err == BCME_OK) {
+               bytes_written = snprintf(command, total_len, "OK");
+               ANDROID_ERROR(("%s: pktlog filter del success\n", __FUNCTION__));
+       } else {
+               ANDROID_ERROR(("%s: pktlog filter del fail\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       return bytes_written;
+}
+
+static int
+wl_android_pktlog_filter_info(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       dhd_pktlog_filter_t *filter;
+       int err = BCME_OK;
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       filter = dhdp->pktlog->pktlog_filter;
+
+       err = dhd_pktlog_filter_info(filter);
+
+       if (err == BCME_OK) {
+               bytes_written = snprintf(command, total_len, "OK");
+               ANDROID_ERROR(("%s: pktlog filter info success\n", __FUNCTION__));
+       } else {
+               ANDROID_ERROR(("%s: pktlog filter info fail\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       return bytes_written;
+}
+
+static int
+wl_android_pktlog_start(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       if (!dhdp->pktlog->pktlog_ring) {
+               DHD_PKT_LOG(("%s(): pktlog_ring=%p\n",
+                       __FUNCTION__, dhdp->pktlog->pktlog_ring));
+               return -EINVAL;
+       }
+
+       atomic_set(&dhdp->pktlog->pktlog_ring->start, TRUE);
+
+       bytes_written = snprintf(command, total_len, "OK");
+
+       ANDROID_ERROR(("%s: pktlog start success\n", __FUNCTION__));
+
+       return bytes_written;
+}
+
+static int
+wl_android_pktlog_stop(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       if (!dhdp->pktlog->pktlog_ring) {
+               DHD_PKT_LOG(("%s(): _pktlog_ring=%p\n",
+                       __FUNCTION__, dhdp->pktlog->pktlog_ring));
+               return -EINVAL;
+       }
+
+       atomic_set(&dhdp->pktlog->pktlog_ring->start, FALSE);
+
+       bytes_written = snprintf(command, total_len, "OK");
+
+       ANDROID_ERROR(("%s: pktlog stop success\n", __FUNCTION__));
+
+       return bytes_written;
+}
+
+static int
+wl_android_pktlog_filter_exist(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       dhd_pktlog_filter_t *filter;
+       uint32 id;
+       bool exist = FALSE;
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       filter = dhdp->pktlog->pktlog_filter;
+
+       if (strlen(CMD_PKTLOG_FILTER_EXIST) + 1 > total_len) {
+               return BCME_ERROR;
+       }
+
+       exist = dhd_pktlog_filter_existed(filter, command + strlen(CMD_PKTLOG_FILTER_EXIST) + 1,
+                       &id);
+
+       if (exist) {
+               bytes_written = snprintf(command, total_len, "TRUE");
+               ANDROID_ERROR(("%s: pktlog filter pattern id: %d is existed\n", __FUNCTION__, id));
+       } else {
+               bytes_written = snprintf(command, total_len, "FALSE");
+               ANDROID_ERROR(("%s: pktlog filter pattern id: %d is not existed\n", __FUNCTION__, id));
+       }
+
+       return bytes_written;
+}
+
+static int
+wl_android_pktlog_minmize_enable(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       if (!dhdp->pktlog->pktlog_ring) {
+               DHD_PKT_LOG(("%s(): pktlog_ring=%p\n",
+                       __FUNCTION__, dhdp->pktlog->pktlog_ring));
+               return -EINVAL;
+       }
+
+       dhdp->pktlog->pktlog_ring->pktlog_minmize = TRUE;
+
+       bytes_written = snprintf(command, total_len, "OK");
+
+       ANDROID_ERROR(("%s: pktlog pktlog_minmize enable\n", __FUNCTION__));
+
+       return bytes_written;
+}
+
+static int
+wl_android_pktlog_minmize_disable(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       if (!dhdp->pktlog->pktlog_ring) {
+               DHD_PKT_LOG(("%s(): pktlog_ring=%p\n",
+                       __FUNCTION__, dhdp->pktlog->pktlog_ring));
+               return -EINVAL;
+       }
+
+       dhdp->pktlog->pktlog_ring->pktlog_minmize = FALSE;
+
+       bytes_written = snprintf(command, total_len, "OK");
+
+       ANDROID_ERROR(("%s: pktlog pktlog_minmize disable\n", __FUNCTION__));
+
+       return bytes_written;
+}
+
+static int
+wl_android_pktlog_change_size(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       int err = BCME_OK;
+       int size;
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       if (strlen(CMD_PKTLOG_CHANGE_SIZE) + 1 > total_len) {
+               return BCME_ERROR;
+       }
+
+       size = bcm_strtoul(command + strlen(CMD_PKTLOG_CHANGE_SIZE) + 1, NULL, 0);
+
+       dhdp->pktlog->pktlog_ring =
+               dhd_pktlog_ring_change_size(dhdp->pktlog->pktlog_ring, size);
+       if (!dhdp->pktlog->pktlog_ring) {
+               err = BCME_ERROR;
+       }
+
+       if (err == BCME_OK) {
+               bytes_written = snprintf(command, total_len, "OK");
+               ANDROID_ERROR(("%s: pktlog change size success\n", __FUNCTION__));
+       } else {
+               ANDROID_ERROR(("%s: pktlog change size fail\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       return bytes_written;
+}
+
+static int
+wl_android_pktlog_dbg_dump(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+       int err = BCME_OK;
+
+       if (!dhdp || !dhdp->pktlog) {
+               DHD_PKT_LOG(("%s(): dhdp=%p pktlog=%p\n",
+                       __FUNCTION__, dhdp, (dhdp ? dhdp->pktlog : NULL)));
+               return -EINVAL;
+       }
+
+       if (strlen(CMD_PKTLOG_DEBUG_DUMP) + 1 > total_len) {
+               return BCME_ERROR;
+       }
+
+       err = dhd_pktlog_debug_dump(dhdp);
+       if (err == BCME_OK) {
+               bytes_written = snprintf(command, total_len, "OK");
+               ANDROID_INFO(("%s: pktlog dbg dump success\n", __FUNCTION__));
+       } else {
+               ANDROID_ERROR(("%s: pktlog dbg dump fail\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       return bytes_written;
+}
+#endif /* DHD_PKT_LOGGING */
+
+#if defined(CONFIG_TIZEN)
+static int wl_android_set_powersave_mode(
+       struct net_device *dev, char* command, int total_len)
+{
+       int pm;
+
+       int err = BCME_OK;
+#ifdef DHD_PM_OVERRIDE
+       extern bool g_pm_override;
+#endif /* DHD_PM_OVERRIDE */
+       sscanf(command, "%*s %10d", &pm);
+       if (pm < PM_OFF || pm > PM_FAST) {
+               ANDROID_ERROR(("check pm=%d\n", pm));
+               return BCME_ERROR;
+       }
+
+#ifdef DHD_PM_OVERRIDE
+       if (pm > PM_OFF) {
+               g_pm_override = FALSE;
+       }
+#endif /* DHD_PM_OVERRIDE */
+
+       err =  wldev_ioctl_set(dev, WLC_SET_PM, &pm, sizeof(pm));
+
+#ifdef DHD_PM_OVERRIDE
+       if (pm == PM_OFF) {
+               g_pm_override = TRUE;
+       }
+
+       ANDROID_ERROR(("%s: PM:%d, pm_override=%d\n", __FUNCTION__, pm, g_pm_override));
+#endif /* DHD_PM_OVERRIDE */
+       return err;
+}
+
+static int wl_android_get_powersave_mode(
+       struct net_device *dev, char *command, int total_len)
+{
+       int err, bytes_written;
+       int pm;
+
+       err = wldev_ioctl_get(dev, WLC_GET_PM, &pm, sizeof(pm));
+       if (err != BCME_OK) {
+               ANDROID_ERROR(("failed to get pm (%d)", err));
+               return err;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d",
+               CMD_POWERSAVEMODE_GET, pm);
+
+       return bytes_written;
+}
+#endif /* CONFIG_TIZEN */
+
+#ifdef DHD_EVENT_LOG_FILTER
+uint32 dhd_event_log_filter_serialize(dhd_pub_t *dhdp, char *buf, uint32 tot_len, int type);
+
+#ifdef DHD_EWPR_VER2
+uint32 dhd_event_log_filter_serialize_bit(dhd_pub_t *dhdp, char *buf, uint32 tot_len,
+       int index1, int index2, int index3);
+#endif
+
+static int
+wl_android_ewp_filter(struct net_device *dev, char *command, uint32 tot_len)
+{
+       uint32 bytes_written = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+#ifdef DHD_EWPR_VER2
+       int index1 = 0, index2 = 0, index3 = 0;
+       unsigned char *index_str = (unsigned char *)(command +
+               strlen(CMD_EWP_FILTER) + 1);
+#else
+       int type = 0;
+#endif
+
+       if (!dhdp || !command) {
+               ANDROID_ERROR(("%s(): dhdp=%p \n", __FUNCTION__, dhdp));
+               return -EINVAL;
+       }
+
+#ifdef DHD_EWPR_VER2
+       if (strlen(command) > strlen(CMD_EWP_FILTER) + 1) {
+               sscanf(index_str, "%10d %10d %10d", &index1, &index2, &index3);
+               ANDROID_TRACE(("%s(): get index request: %d %d %d\n", __FUNCTION__,
+                       index1, index2, index3));
+       }
+       bytes_written += dhd_event_log_filter_serialize_bit(dhdp,
+               &command[bytes_written], tot_len - bytes_written, index1, index2, index3);
+#else
+       /* NEED TO GET TYPE if EXIST */
+       type = 0;
+
+       bytes_written += dhd_event_log_filter_serialize(dhdp,
+               &command[bytes_written], tot_len - bytes_written, type);
+#endif
+
+       return (int)bytes_written;
+}
+#endif /* DHD_EVENT_LOG_FILTER */
+
+#ifdef SUPPORT_AP_SUSPEND
+int
+wl_android_set_ap_suspend(struct net_device *dev, char *command, int total_len)
+{
+       int suspend = 0;
+       char *pos, *token;
+       char *ifname = NULL;
+       int err = BCME_OK;
+       char name[IFNAMSIZ];
+
+       /*
+        * DRIVER SET_AP_SUSPEND <0/1> <ifname>
+        */
+       pos = command;
+
+       /* drop command */
+       token = bcmstrtok(&pos, " ", NULL);
+
+       /* Enable */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               return -EINVAL;
+       }
+       suspend = bcm_atoi(token);
+
+       /* get the interface name */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               return -EINVAL;
+       }
+       ifname = token;
+
+       strlcpy(name, ifname, sizeof(name));
+       ANDROID_INFO(("suspend %d, ifacename %s\n", suspend, name));
+
+       err = wl_set_ap_suspend(dev, suspend? TRUE: FALSE, name);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("Failed to set suspend, suspend %d, error = %d\n", suspend, err));
+       }
+
+       return err;
+}
+#endif /* SUPPORT_AP_SUSPEND */
+
+#ifdef SUPPORT_AP_BWCTRL
+int
+wl_android_set_ap_bw(struct net_device *dev, char *command, int total_len)
+{
+       int bw = DOT11_OPER_MODE_20MHZ;
+       char *pos, *token;
+       char *ifname = NULL;
+       int err = BCME_OK;
+       char name[IFNAMSIZ];
+
+       /*
+        * DRIVER SET_AP_BW <0/1/2> <ifname>
+        * 0 : 20MHz, 1 : 40MHz, 2 : 80MHz 3: 80+80 or 160MHz
+        * This is from operating mode field
+        * in 8.4.1.50 of 802.11ac-2013
+        */
+       pos = command;
+
+       /* drop command */
+       token = bcmstrtok(&pos, " ", NULL);
+
+       /* BW */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               return -EINVAL;
+       }
+       bw = bcm_atoi(token);
+
+       /* get the interface name */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               return -EINVAL;
+       }
+       ifname = token;
+
+       strlcpy(name, ifname, sizeof(name));
+       ANDROID_INFO(("bw %d, ifacename %s\n", bw, name));
+
+       err = wl_set_ap_bw(dev, bw, name);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("Failed to set bw, bw %d, error = %d\n", bw, err));
+       }
+
+       return err;
+}
+
+int
+wl_android_get_ap_bw(struct net_device *dev, char *command, int total_len)
+{
+       char *pos, *token;
+       char *ifname = NULL;
+       int bytes_written = 0;
+       char name[IFNAMSIZ];
+
+       /*
+        * DRIVER GET_AP_BW <ifname>
+        * returns 0 : 20MHz, 1 : 40MHz, 2 : 80MHz 3: 80+80 or 160MHz
+        * This is from operating mode field
+        * in 8.4.1.50 of 802.11ac-2013
+        */
+       pos = command;
+
+       /* drop command */
+       token = bcmstrtok(&pos, " ", NULL);
+
+       /* get the interface name */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               return -EINVAL;
+       }
+       ifname = token;
+
+       strlcpy(name, ifname, sizeof(name));
+       ANDROID_INFO(("ifacename %s\n", name));
+
+       bytes_written = wl_get_ap_bw(dev, command, name, total_len);
+       if (bytes_written < 1) {
+               ANDROID_ERROR(("Failed to get bw, error = %d\n", bytes_written));
+               return -EPROTO;
+       }
+
+       return bytes_written;
+
+}
+#endif /* SUPPORT_AP_BWCTRL */
+
+static int
+wl_android_priv_cmd_log_enable_check(char* cmd)
+{
+       int cnt = 0;
+
+       while (strlen(loging_params[cnt].command) > 0) {
+               if (!strnicmp(cmd, loging_params[cnt].command,
+                       strlen(loging_params[cnt].command))) {
+                       return loging_params[cnt].enable;
+               }
+
+               cnt++;
+       }
+
+       return TRUE;
+}
+
+int wl_android_priv_cmd(struct net_device *net, struct ifreq *ifr)
+{
+#define PRIVATE_COMMAND_MAX_LEN        8192
+#define PRIVATE_COMMAND_DEF_LEN        4096
+       int ret = 0;
+       char *command = NULL;
+       int bytes_written = 0;
+       android_wifi_priv_cmd priv_cmd;
+       int buf_size = 0;
+       dhd_pub_t *dhd = dhd_get_pub(net);
+
+       net_os_wake_lock(net);
+
+       if (!capable(CAP_NET_ADMIN)) {
+               ret = -EPERM;
+               goto exit;
+       }
+
+       if (!ifr->ifr_data) {
+               ret = -EINVAL;
+               goto exit;
+       }
+
+#ifdef CONFIG_COMPAT
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 6, 0))
+       if (in_compat_syscall())
+#else
+       if (is_compat_task())
+#endif
+       {
+               compat_android_wifi_priv_cmd compat_priv_cmd;
+               if (copy_from_user(&compat_priv_cmd, ifr->ifr_data,
+                       sizeof(compat_android_wifi_priv_cmd))) {
+                       ret = -EFAULT;
+                       goto exit;
+
+               }
+               priv_cmd.buf = compat_ptr(compat_priv_cmd.buf);
+               priv_cmd.used_len = compat_priv_cmd.used_len;
+               priv_cmd.total_len = compat_priv_cmd.total_len;
+       } else
+#endif /* CONFIG_COMPAT */
+       {
+               if (copy_from_user(&priv_cmd, ifr->ifr_data, sizeof(android_wifi_priv_cmd))) {
+                       ret = -EFAULT;
+                       goto exit;
+               }
+       }
+       if ((priv_cmd.total_len > PRIVATE_COMMAND_MAX_LEN) || (priv_cmd.total_len < 0)) {
+               ANDROID_ERROR(("%s: buf length invalid:%d\n", __FUNCTION__,
+                       priv_cmd.total_len));
+               ret = -EINVAL;
+               goto exit;
+       }
+
+       buf_size = max(priv_cmd.total_len, PRIVATE_COMMAND_DEF_LEN);
+       command = (char *)MALLOC(dhd->osh, (buf_size + 1));
+       if (!command) {
+               ANDROID_ERROR(("%s: failed to allocate memory\n", __FUNCTION__));
+               ret = -ENOMEM;
+               goto exit;
+       }
+       if (copy_from_user(command, priv_cmd.buf, priv_cmd.total_len)) {
+               ret = -EFAULT;
+               goto exit;
+       }
+       command[priv_cmd.total_len] = '\0';
+
+       if (wl_android_priv_cmd_log_enable_check(command)) {
+               ANDROID_ERROR(("%s: Android private cmd \"%s\" on %s\n", __FUNCTION__,
+                       command, ifr->ifr_name));
+       }
+       else {
+               ANDROID_INFO(("%s: Android private cmd \"%s\" on %s\n", __FUNCTION__, command, ifr->ifr_name));
+
+       }
+
+       bytes_written = wl_handle_private_cmd(net, command, priv_cmd.total_len);
+       if (bytes_written >= 0) {
+               if ((bytes_written == 0) && (priv_cmd.total_len > 0)) {
+                       command[0] = '\0';
+               }
+               if (bytes_written >= priv_cmd.total_len) {
+                       ANDROID_ERROR(("%s: err. bytes_written:%d >= total_len:%d, buf_size:%d\n",
+                               __FUNCTION__, bytes_written, priv_cmd.total_len, buf_size));
+
+                       ret = BCME_BUFTOOSHORT;
+                       goto exit;
+               }
+               bytes_written++;
+               priv_cmd.used_len = bytes_written;
+               if (copy_to_user(priv_cmd.buf, command, bytes_written)) {
+                       ANDROID_ERROR(("%s: failed to copy data to user buffer\n", __FUNCTION__));
+                       ret = -EFAULT;
+               }
+       }
+       else {
+               /* Propagate the error */
+               ret = bytes_written;
+       }
+
+exit:
+#ifdef DHD_SEND_HANG_PRIVCMD_ERRORS
+       if (ret) {
+               /* Avoid incrementing priv_cmd_errors in case of unsupported feature */
+               if (ret != BCME_UNSUPPORTED) {
+                       wl_android_check_priv_cmd_errors(net);
+               }
+       } else {
+               priv_cmd_errors = 0;
+       }
+#endif /* DHD_SEND_HANG_PRIVCMD_ERRORS */
+       net_os_wake_unlock(net);
+       MFREE(dhd->osh, command, (buf_size + 1));
+       return ret;
+}
+
+#ifdef WLADPS_PRIVATE_CMD
+static int
+wl_android_set_adps_mode(struct net_device *dev, const char* string_num)
+{
+       int err = 0, adps_mode;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+#ifdef DHD_PM_CONTROL_FROM_FILE
+       if (g_pm_control) {
+               return -EPERM;
+       }
+#endif /* DHD_PM_CONTROL_FROM_FILE */
+
+       adps_mode = bcm_atoi(string_num);
+       ANDROID_ERROR(("%s: SET_ADPS %d\n", __FUNCTION__, adps_mode));
+
+       if ((adps_mode < 0) && (1 < adps_mode)) {
+               ANDROID_ERROR(("wl_android_set_adps_mode: Invalid value %d.\n", adps_mode));
+               return -EINVAL;
+       }
+
+       err = dhd_enable_adps(dhdp, adps_mode);
+       if (err != BCME_OK) {
+               ANDROID_ERROR(("failed to set adps mode %d, error = %d\n", adps_mode, err));
+               return -EIO;
+       }
+       return err;
+}
+static int
+wl_android_get_adps_mode(
+       struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written, err = 0;
+       uint len;
+       char buf[WLC_IOCTL_SMLEN];
+
+       bcm_iov_buf_t iov_buf;
+       bcm_iov_buf_t *ptr = NULL;
+       wl_adps_params_v1_t *data = NULL;
+
+       uint8 *pdata = NULL;
+       uint8 band, mode = 0;
+
+       bzero(&iov_buf, sizeof(iov_buf));
+
+       len = OFFSETOF(bcm_iov_buf_t, data) + sizeof(band);
+
+       iov_buf.version = WL_ADPS_IOV_VER;
+       iov_buf.len = sizeof(band);
+       iov_buf.id = WL_ADPS_IOV_MODE;
+
+       pdata = (uint8 *)&iov_buf.data;
+
+       for (band = 1; band <= MAX_BANDS; band++) {
+               pdata[0] = band;
+               err = wldev_iovar_getbuf(dev, "adps", &iov_buf, len,
+                       buf, WLC_IOCTL_SMLEN, NULL);
+               if (err != BCME_OK) {
+                       ANDROID_ERROR(("wl_android_get_adps_mode fail to get adps band %d(%d).\n",
+                                       band, err));
+                       return -EIO;
+               }
+               ptr = (bcm_iov_buf_t *) buf;
+               data = (wl_adps_params_v1_t *) ptr->data;
+               mode = data->mode;
+               if (mode != OFF) {
+                       break;
+               }
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d",
+               CMD_GET_ADPS, mode);
+       return bytes_written;
+}
+
+#ifdef WLADPS_ENERGY_GAIN
+static int
+wl_android_get_gain_adps(
+       struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written;
+
+       int energy_gain = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+
+       energy_gain = dhd_event_log_filter_adps_energy_gain(dhdp);
+       if (energy_gain < 0) {
+               energy_gain = 0;
+       }
+
+       ANDROID_ERROR(("%s ADPS Energy Gain: %d uAh\n", __FUNCTION__, energy_gain));
+
+       bytes_written = snprintf(command, total_len, "%s %d uAm",
+               CMD_GET_GAIN_ADPS, energy_gain);
+
+       return bytes_written;
+}
+
+static int
+wl_android_reset_gain_adps(
+       struct net_device *dev, char *command)
+{
+       int ret = BCME_OK;
+
+       bcm_iov_buf_t iov_buf;
+       char buf[WLC_IOCTL_SMLEN] = {0, };
+
+       iov_buf.version = WL_ADPS_IOV_VER;
+       iov_buf.id = WL_ADPS_IOV_RESET_GAIN;
+       iov_buf.len = 0;
+
+       if ((ret = wldev_iovar_setbuf(dev, "adps", &iov_buf, sizeof(iov_buf),
+               buf, sizeof(buf), NULL)) < 0) {
+               ANDROID_ERROR(("%s fail to reset adps gain (%d)\n", __FUNCTION__, ret));
+       }
+
+       return ret;
+}
+#endif /* WLADPS_ENERGY_GAIN */
+#endif /* WLADPS_PRIVATE_CMD */
+
+#ifdef WL_BCNRECV
+#define BCNRECV_ATTR_HDR_LEN 30
+int
+wl_android_bcnrecv_event(struct net_device *ndev, uint attr_type,
+               uint status, uint reason, uint8 *data, uint data_len)
+{
+       s32 err = BCME_OK;
+       struct sk_buff *skb;
+       gfp_t kflags;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       uint len;
+
+       len = BCNRECV_ATTR_HDR_LEN + data_len;
+
+       kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+       skb = CFG80211_VENDOR_EVENT_ALLOC(wiphy, ndev_to_wdev(ndev), len,
+               BRCM_VENDOR_EVENT_BEACON_RECV, kflags);
+       if (!skb) {
+               ANDROID_ERROR(("skb alloc failed"));
+               return -ENOMEM;
+       }
+       if ((attr_type == BCNRECV_ATTR_BCNINFO) && (data)) {
+               /* send bcn info to upper layer */
+               nla_put(skb, BCNRECV_ATTR_BCNINFO, data_len, data);
+       } else if (attr_type == BCNRECV_ATTR_STATUS) {
+               nla_put_u32(skb, BCNRECV_ATTR_STATUS, status);
+               if (reason) {
+                       nla_put_u32(skb, BCNRECV_ATTR_REASON, reason);
+               }
+       } else {
+               ANDROID_ERROR(("UNKNOWN ATTR_TYPE. attr_type:%d\n", attr_type));
+               kfree_skb(skb);
+               return -EINVAL;
+       }
+       cfg80211_vendor_event(skb, kflags);
+       return err;
+}
+
+static int
+_wl_android_bcnrecv_start(struct bcm_cfg80211 *cfg, struct net_device *ndev, bool user_trigger)
+{
+       s32 err = BCME_OK;
+
+       /* check any scan is in progress before beacon recv scan trigger IOVAR */
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               err = BCME_UNSUPPORTED;
+               ANDROID_ERROR(("Scan in progress, Aborting beacon recv start, "
+                       "error:%d\n", err));
+               goto exit;
+       }
+
+       if (wl_get_p2p_status(cfg, SCANNING)) {
+               err = BCME_UNSUPPORTED;
+               ANDROID_ERROR(("P2P Scan in progress, Aborting beacon recv start, "
+                       "error:%d\n", err));
+               goto exit;
+       }
+
+       if (wl_get_drv_status(cfg, REMAINING_ON_CHANNEL, ndev)) {
+               err = BCME_UNSUPPORTED;
+               ANDROID_ERROR(("P2P remain on channel, Aborting beacon recv start, "
+                       "error:%d\n", err));
+               goto exit;
+       }
+
+       /* check STA is in connected state, Beacon recv required connected state
+        * else exit from beacon recv scan
+        */
+       if (!wl_get_drv_status(cfg, CONNECTED, ndev)) {
+               err = BCME_UNSUPPORTED;
+               ANDROID_ERROR(("STA is in not associated state error:%d\n", err));
+               goto exit;
+       }
+
+#ifdef WL_NAN
+       /* Check NAN is enabled, if enabled exit else continue */
+       if (wl_cfgnan_is_enabled(cfg)) {
+               err = BCME_UNSUPPORTED;
+               ANDROID_ERROR(("Nan is enabled, NAN+STA+FAKEAP concurrency is not supported\n"));
+               goto exit;
+       }
+#endif /* WL_NAN */
+
+       /* Triggering an sendup_bcn iovar */
+       err = wldev_iovar_setint(ndev, "sendup_bcn", 1);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("sendup_bcn failed to set, error:%d\n", err));
+       } else {
+               cfg->bcnrecv_info.bcnrecv_state = BEACON_RECV_STARTED;
+               ANDROID_INFO(("bcnrecv started. user_trigger:%d\n", user_trigger));
+               if (user_trigger) {
+                       if ((err = wl_android_bcnrecv_event(ndev, BCNRECV_ATTR_STATUS,
+                                       WL_BCNRECV_STARTED, 0, NULL, 0)) != BCME_OK) {
+                               ANDROID_ERROR(("failed to send bcnrecv event, error:%d\n", err));
+                       }
+               }
+       }
+exit:
+       /*
+        * BCNRECV start request can be rejected from dongle
+        * in various conditions.
+        * Error code need to be overridden to BCME_UNSUPPORTED
+        * to avoid hang event from continous private
+        * command error
+        */
+       if (err) {
+               err = BCME_UNSUPPORTED;
+       }
+       return err;
+}
+
+int
+_wl_android_bcnrecv_stop(struct bcm_cfg80211 *cfg, struct net_device *ndev, uint reason)
+{
+       s32 err = BCME_OK;
+       u32 status;
+
+       /* Send sendup_bcn iovar for all cases except W_BCNRECV_ROAMABORT reason -
+        * fw generates roam abort event after aborting the bcnrecv.
+        */
+       if (reason != WL_BCNRECV_ROAMABORT) {
+               /* Triggering an sendup_bcn iovar */
+               err = wldev_iovar_setint(ndev, "sendup_bcn", 0);
+               if (unlikely(err)) {
+                       ANDROID_ERROR(("sendup_bcn failed to set error:%d\n", err));
+                       goto exit;
+               }
+       }
+
+       /* Send notification for all cases */
+       if (reason == WL_BCNRECV_SUSPEND) {
+               cfg->bcnrecv_info.bcnrecv_state = BEACON_RECV_SUSPENDED;
+               status = WL_BCNRECV_SUSPENDED;
+       } else {
+               cfg->bcnrecv_info.bcnrecv_state = BEACON_RECV_STOPPED;
+               ANDROID_INFO(("bcnrecv stopped\n"));
+               if (reason == WL_BCNRECV_USER_TRIGGER) {
+                       status = WL_BCNRECV_STOPPED;
+               } else {
+                       status = WL_BCNRECV_ABORTED;
+               }
+       }
+       if ((err = wl_android_bcnrecv_event(ndev, BCNRECV_ATTR_STATUS, status,
+                       reason, NULL, 0)) != BCME_OK) {
+               ANDROID_ERROR(("failed to send bcnrecv event, error:%d\n", err));
+       }
+exit:
+       return err;
+}
+
+static int
+wl_android_bcnrecv_start(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       s32 err = BCME_OK;
+
+       /* Adding scan_sync mutex to avoid race condition in b/w scan_req and bcn recv */
+       mutex_lock(&cfg->scan_sync);
+       mutex_lock(&cfg->bcn_sync);
+       err = _wl_android_bcnrecv_start(cfg, ndev, true);
+       mutex_unlock(&cfg->bcn_sync);
+       mutex_unlock(&cfg->scan_sync);
+       return err;
+}
+
+int
+wl_android_bcnrecv_stop(struct net_device *ndev, uint reason)
+{
+       s32 err = BCME_OK;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+
+       mutex_lock(&cfg->bcn_sync);
+       if ((cfg->bcnrecv_info.bcnrecv_state == BEACON_RECV_STARTED) ||
+          (cfg->bcnrecv_info.bcnrecv_state == BEACON_RECV_SUSPENDED)) {
+               err = _wl_android_bcnrecv_stop(cfg, ndev, reason);
+       }
+       mutex_unlock(&cfg->bcn_sync);
+       return err;
+}
+
+int
+wl_android_bcnrecv_suspend(struct net_device *ndev)
+{
+       s32 ret = BCME_OK;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+
+       mutex_lock(&cfg->bcn_sync);
+       if (cfg->bcnrecv_info.bcnrecv_state == BEACON_RECV_STARTED) {
+               ANDROID_INFO(("bcnrecv suspend\n"));
+               ret = _wl_android_bcnrecv_stop(cfg, ndev, WL_BCNRECV_SUSPEND);
+       }
+       mutex_unlock(&cfg->bcn_sync);
+       return ret;
+}
+
+int
+wl_android_bcnrecv_resume(struct net_device *ndev)
+{
+       s32 ret = BCME_OK;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+
+       /* Adding scan_sync mutex to avoid race condition in b/w scan_req and bcn recv */
+       mutex_lock(&cfg->scan_sync);
+       mutex_lock(&cfg->bcn_sync);
+       if (cfg->bcnrecv_info.bcnrecv_state == BEACON_RECV_SUSPENDED) {
+               ANDROID_INFO(("bcnrecv resume\n"));
+               ret = _wl_android_bcnrecv_start(cfg, ndev, false);
+       }
+       mutex_unlock(&cfg->bcn_sync);
+       mutex_unlock(&cfg->scan_sync);
+       return ret;
+}
+
+/* Beacon recv functionality code implementation */
+int
+wl_android_bcnrecv_config(struct net_device *ndev, char *cmd_argv, int total_len)
+{
+       struct bcm_cfg80211 *cfg = NULL;
+       uint err = BCME_OK;
+
+       if (!ndev) {
+               ANDROID_ERROR(("ndev is NULL\n"));
+               return -EINVAL;
+       }
+
+       cfg = wl_get_cfg(ndev);
+       if (!cfg) {
+               ANDROID_ERROR(("cfg is NULL\n"));
+               return -EINVAL;
+       }
+
+       /* sync commands from user space */
+       mutex_lock(&cfg->usr_sync);
+       if (strncmp(cmd_argv, "start", strlen("start")) == 0) {
+               ANDROID_INFO(("BCNRECV start\n"));
+               err = wl_android_bcnrecv_start(cfg, ndev);
+               if (err != BCME_OK) {
+                       ANDROID_ERROR(("Failed to process the start command, error:%d\n", err));
+                       goto exit;
+               }
+       } else if (strncmp(cmd_argv, "stop", strlen("stop")) == 0) {
+               ANDROID_INFO(("BCNRECV stop\n"));
+               err = wl_android_bcnrecv_stop(ndev, WL_BCNRECV_USER_TRIGGER);
+               if (err != BCME_OK) {
+                       ANDROID_ERROR(("Failed to stop the bcn recv, error:%d\n", err));
+                       goto exit;
+               }
+       } else {
+               err = BCME_ERROR;
+       }
+exit:
+       mutex_unlock(&cfg->usr_sync);
+       return err;
+}
+#endif /* WL_BCNRECV */
+
+#ifdef SUPPORT_LATENCY_CRITICAL_DATA
+#define DISABLE_LATENCY_CRT_DATA       0
+#define ENABLE_LATENCY_CRT_DATA                1
+static int
+wl_android_set_latency_crt_data(struct net_device *dev, int enable)
+{
+       int ret;
+
+       if (!(enable == DISABLE_LATENCY_CRT_DATA ||
+               enable == ENABLE_LATENCY_CRT_DATA)) {
+               return BCME_BADARG;
+       }
+
+       ret = wldev_iovar_setint(dev, "latency_critical_data", enable);
+       if (ret != BCME_OK) {
+               ANDROID_ERROR(("failed to set latency_critical_data enable %d, error = %d\n",
+                       enable, ret));
+               return ret;
+       }
+
+       return ret;
+}
+
+static int
+wl_android_get_latency_crt_data(struct net_device *dev, char *command, int total_len)
+{
+       int ret;
+       int enable = DISABLE_LATENCY_CRT_DATA;
+       int bytes_written;
+
+       ret = wldev_iovar_getint(dev, "latency_critical_data", &enable);
+       if (ret != BCME_OK) {
+               ANDROID_ERROR(("failed to get latency_critical_data error = %d\n", ret));
+               return ret;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d",
+               CMD_GET_LATENCY_CRITICAL_DATA, enable);
+
+       return bytes_written;
+}
+#endif /* SUPPORT_LATENCY_CRITICAL_DATA */
+
+#ifdef WL_CAC_TS
+/* CAC TSPEC functionality code implementation */
+static void
+wl_android_update_tsinfo(uint8 access_category, tspec_arg_t *tspec_arg)
+{
+       uint8 tspec_id;
+       /* Using direction as bidirectional by default */
+       uint8 direction = TSPEC_BI_DIRECTION;
+       /* Using U-APSD as the default power save mode */
+       uint8 user_psb = TSPEC_UAPSD_PSB;
+       uint8 ADDTS_AC2PRIO[4] = {PRIO_8021D_BE, PRIO_8021D_BK, PRIO_8021D_VI, PRIO_8021D_VO};
+
+       /* Map tspec_id from access category */
+       tspec_id = ADDTS_AC2PRIO[access_category];
+
+       /* Update the tsinfo */
+       tspec_arg->tsinfo.octets[0] = (uint8)(TSPEC_EDCA_ACCESS | direction |
+               (tspec_id << TSPEC_TSINFO_TID_SHIFT));
+       tspec_arg->tsinfo.octets[1] = (uint8)((tspec_id << TSPEC_TSINFO_PRIO_SHIFT) |
+               user_psb);
+       tspec_arg->tsinfo.octets[2] = 0x00;
+}
+
+static s32
+wl_android_handle_cac_action(struct bcm_cfg80211 * cfg, struct net_device * ndev, char * argv)
+{
+       tspec_arg_t tspec_arg;
+       s32 err = BCME_ERROR;
+       u8 ts_cmd[12] = "cac_addts";
+       uint8 access_category;
+       s32 bssidx;
+
+       /* Following handling is done only for the primary interface */
+       memset_s(&tspec_arg, sizeof(tspec_arg), 0, sizeof(tspec_arg));
+       if (strncmp(argv, "addts", strlen("addts")) == 0) {
+               tspec_arg.version = TSPEC_ARG_VERSION;
+               tspec_arg.length = sizeof(tspec_arg_t) - (2 * sizeof(uint16));
+               /* Read the params passed */
+               sscanf(argv, "%*s %hhu %hu %hu", &access_category,
+                       &tspec_arg.nom_msdu_size, &tspec_arg.surplus_bw);
+               if ((access_category > TSPEC_MAX_ACCESS_CATEGORY) ||
+                       ((tspec_arg.surplus_bw < TSPEC_MIN_SURPLUS_BW) ||
+                       (tspec_arg.surplus_bw > TSPEC_MAX_SURPLUS_BW)) ||
+                       (tspec_arg.nom_msdu_size > TSPEC_MAX_MSDU_SIZE)) {
+                       ANDROID_ERROR(("Invalid params access_category %hhu nom_msdu_size %hu"
+                               " surplus BW %hu\n", access_category, tspec_arg.nom_msdu_size,
+                               tspec_arg.surplus_bw));
+                       return BCME_USAGE_ERROR;
+               }
+
+               /* Update tsinfo */
+               wl_android_update_tsinfo(access_category, &tspec_arg);
+               /* Update other tspec parameters */
+               tspec_arg.dialog_token = TSPEC_DEF_DIALOG_TOKEN;
+               tspec_arg.mean_data_rate = TSPEC_DEF_MEAN_DATA_RATE;
+               tspec_arg.min_phy_rate = TSPEC_DEF_MIN_PHY_RATE;
+       } else if (strncmp(argv, "delts", strlen("delts")) == 0) {
+               snprintf(ts_cmd, sizeof(ts_cmd), "cac_delts");
+               tspec_arg.length = sizeof(tspec_arg_t) - (2 * sizeof(uint16));
+               tspec_arg.version = TSPEC_ARG_VERSION;
+               /* Read the params passed */
+               sscanf(argv, "%*s %hhu", &access_category);
+
+               if (access_category > TSPEC_MAX_ACCESS_CATEGORY) {
+                       ANDROID_INFO(("Invalide param, access_category %hhu\n", access_category));
+                       return BCME_USAGE_ERROR;
+               }
+               /* Update tsinfo */
+               wl_android_update_tsinfo(access_category, &tspec_arg);
+       }
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, ndev->ieee80211_ptr)) < 0) {
+               ANDROID_ERROR(("Find index failed\n"));
+               err = BCME_ERROR;
+               return err;
+       }
+       err = wldev_iovar_setbuf_bsscfg(ndev, ts_cmd, &tspec_arg, sizeof(tspec_arg),
+                       cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("%s error (%d)\n", ts_cmd, err));
+       }
+
+       return err;
+}
+
+static s32
+wl_android_cac_ts_config(struct net_device *ndev, char *cmd_argv, int total_len)
+{
+       struct bcm_cfg80211 *cfg = NULL;
+       s32 err = BCME_OK;
+
+       if (!ndev) {
+               ANDROID_ERROR(("ndev is NULL\n"));
+               return -EINVAL;
+       }
+
+       cfg = wl_get_cfg(ndev);
+       if (!cfg) {
+               ANDROID_ERROR(("cfg is NULL\n"));
+               return -EINVAL;
+       }
+
+       /* Request supported only for primary interface */
+       if (ndev != bcmcfg_to_prmry_ndev(cfg)) {
+               ANDROID_ERROR(("Request on non-primary interface\n"));
+               return -1;
+       }
+
+       /* sync commands from user space */
+       mutex_lock(&cfg->usr_sync);
+       err = wl_android_handle_cac_action(cfg, ndev, cmd_argv);
+       mutex_unlock(&cfg->usr_sync);
+
+       return err;
+}
+#endif /* WL_CAC_TS */
+
+#ifdef WL_GET_CU
+/* Implementation to get channel usage from framework */
+static s32
+wl_android_get_channel_util(struct net_device *ndev, char *command, int total_len)
+{
+       s32 bytes_written, err = 0;
+       wl_bssload_t bssload;
+       u8 smbuf[WLC_IOCTL_SMLEN];
+       u8 chan_use_percentage = 0;
+
+       if ((err = wldev_iovar_getbuf(ndev, "bssload_report", NULL,
+               0, smbuf, WLC_IOCTL_SMLEN, NULL))) {
+               ANDROID_ERROR(("Getting bssload report failed with err=%d \n", err));
+               return err;
+       }
+
+       (void)memcpy_s(&bssload, sizeof(wl_bssload_t), smbuf, sizeof(wl_bssload_t));
+       /* Convert channel usage to percentage value */
+       chan_use_percentage = (bssload.chan_util * 100) / 255;
+
+       bytes_written = snprintf(command, total_len, "CU %hhu",
+               chan_use_percentage);
+       ANDROID_INFO(("Channel Utilization %u %u\n", bssload.chan_util, chan_use_percentage));
+
+       return bytes_written;
+}
+#endif /* WL_GET_CU */
+
+#ifdef RTT_GEOFENCE_INTERVAL
+#if defined(RTT_SUPPORT) && defined(WL_NAN)
+static void
+wl_android_set_rtt_geofence_interval(struct net_device *ndev, char *command)
+{
+       int rtt_interval = 0;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(ndev);
+       char *rtt_intp = command + strlen(CMD_GEOFENCE_INTERVAL) + 1;
+
+       rtt_interval = bcm_atoi(rtt_intp);
+       dhd_rtt_set_geofence_rtt_interval(dhdp, rtt_interval);
+}
+#endif /* RTT_SUPPORT && WL_NAN */
+#endif /* RTT_GEOFENCE_INTERVAL */
+
+#ifdef SUPPORT_SOFTAP_ELNA_BYPASS
+int
+wl_android_set_softap_elna_bypass(struct net_device *dev, char *command, int total_len)
+{
+       char *ifname = NULL;
+       char *pos, *token;
+       int err = BCME_OK;
+       int enable = FALSE;
+
+       /*
+        * STA/AP/GO I/F: DRIVER SET_SOFTAP_ELNA_BYPASS <ifname> <enable/disable>
+        * the enable/disable format follows Samsung specific rules as following
+        * Enable : 0
+        * Disable :-1
+        */
+       pos = command;
+
+       /* drop command */
+       token = bcmstrtok(&pos, " ", NULL);
+
+       /* get the interface name */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               ANDROID_ERROR(("%s: Invalid arguments about interface name\n", __FUNCTION__));
+               return -EINVAL;
+       }
+       ifname = token;
+
+       /* get enable/disable flag */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               ANDROID_ERROR(("%s: Invalid arguments about Enable/Disable\n", __FUNCTION__));
+               return -EINVAL;
+       }
+       enable = bcm_atoi(token);
+
+       CUSTOMER_HW4_EN_CONVERT(enable);
+       err = wl_set_softap_elna_bypass(dev, ifname, enable);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("%s: Failed to set ELNA Bypass of SoftAP mode, err=%d\n",
+                       __FUNCTION__, err));
+               return err;
+       }
+
+       return err;
+}
+
+int
+wl_android_get_softap_elna_bypass(struct net_device *dev, char *command, int total_len)
+{
+       char *ifname = NULL;
+       char *pos, *token;
+       int err = BCME_OK;
+       int bytes_written = 0;
+       int softap_elnabypass = 0;
+
+       /*
+        * STA/AP/GO I/F: DRIVER GET_SOFTAP_ELNA_BYPASS <ifname>
+        */
+       pos = command;
+
+       /* drop command */
+       token = bcmstrtok(&pos, " ", NULL);
+
+       /* get the interface name */
+       token = bcmstrtok(&pos, " ", NULL);
+       if (!token) {
+               ANDROID_ERROR(("%s: Invalid arguments about interface name\n", __FUNCTION__));
+               return -EINVAL;
+       }
+       ifname = token;
+
+       err = wl_get_softap_elna_bypass(dev, ifname, &softap_elnabypass);
+       if (unlikely(err)) {
+               ANDROID_ERROR(("%s: Failed to get ELNA Bypass of SoftAP mode, err=%d\n",
+                       __FUNCTION__, err));
+               return err;
+       } else {
+               softap_elnabypass--; //Convert format to Customer HW4
+               ANDROID_INFO(("%s: eLNA Bypass feature enable status is %d\n",
+                       __FUNCTION__, softap_elnabypass));
+               bytes_written = snprintf(command, total_len, "%s %d",
+                       CMD_GET_SOFTAP_ELNA_BYPASS, softap_elnabypass);
+       }
+
+       return bytes_written;
+}
+#endif /* SUPPORT_SOFTAP_ELNA_BYPASS */
+
+#ifdef WL_NAN
+int
+wl_android_get_nan_status(struct net_device *dev, char *command, int total_len)
+{
+       int bytes_written = 0;
+       int error = BCME_OK;
+       wl_nan_conf_status_t nstatus;
+
+       error = wl_cfgnan_get_status(dev, &nstatus);
+       if (error) {
+               ANDROID_ERROR(("Failed to get nan status (%d)\n", error));
+               return error;
+       }
+
+       bytes_written = snprintf(command, total_len,
+                       "EN:%d Role:%d EM:%d CID:"MACF" NMI:"MACF" SC(2G):%d SC(5G):%d "
+                       "MR:"NMRSTR" AMR:"NMRSTR" IMR:"NMRSTR
+                       "HC:%d AMBTT:%04x TSF[%04x:%04x]\n",
+                       nstatus.enabled,
+                       nstatus.role,
+                       nstatus.election_mode,
+                       ETHERP_TO_MACF(&(nstatus.cid)),
+                       ETHERP_TO_MACF(&(nstatus.nmi)),
+                       nstatus.social_chans[0],
+                       nstatus.social_chans[1],
+                       NMR2STR(nstatus.mr),
+                       NMR2STR(nstatus.amr),
+                       NMR2STR(nstatus.imr),
+                       nstatus.hop_count,
+                       nstatus.ambtt,
+                       nstatus.cluster_tsf_h,
+                       nstatus.cluster_tsf_l);
+       return bytes_written;
+}
+#endif /* WL_NAN */
+
+#ifdef SUPPORT_NAN_RANGING_TEST_BW
+enum {
+       NAN_RANGING_5G_BW20 = 1,
+       NAN_RANGING_5G_BW40,
+       NAN_RANGING_5G_BW80
+};
+
+int
+wl_nan_ranging_bw(struct net_device *net, int bw, char *command)
+{
+       int bytes_written, err = BCME_OK;
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+       s32 val = 1;
+       struct {
+               u32 band;
+               u32 bw_cap;
+       } param = {0, 0};
+
+       if (bw < NAN_RANGING_5G_BW20 || bw > NAN_RANGING_5G_BW80) {
+               ANDROID_ERROR(("Wrong BW cmd:%d, %s\n", bw, __FUNCTION__));
+               bytes_written = scnprintf(command, sizeof("FAIL"), "FAIL");
+               return bytes_written;
+       }
+
+       switch (bw) {
+               case NAN_RANGING_5G_BW20:
+                       ANDROID_ERROR(("NAN_RANGING 5G/BW20\n"));
+                       param.band = WLC_BAND_5G;
+                       param.bw_cap = 0x1;
+                       break;
+               case NAN_RANGING_5G_BW40:
+                       ANDROID_ERROR(("NAN_RANGING 5G/BW40\n"));
+                       param.band = WLC_BAND_5G;
+                       param.bw_cap = 0x3;
+                       break;
+               case NAN_RANGING_5G_BW80:
+                       ANDROID_ERROR(("NAN_RANGING 5G/BW80\n"));
+                       param.band = WLC_BAND_5G;
+                       param.bw_cap = 0x7;
+                       break;
+       }
+
+       err = wldev_ioctl_set(net, WLC_DOWN, &val, sizeof(s32));
+       if (err) {
+               ANDROID_ERROR(("WLC_DOWN error %d\n", err));
+               bytes_written = scnprintf(command, sizeof("FAIL"), "FAIL");
+       } else {
+               err = wldev_iovar_setbuf(net, "bw_cap", &param, sizeof(param),
+                       ioctl_buf, sizeof(ioctl_buf), NULL);
+
+               if (err) {
+                       ANDROID_ERROR(("BW set failed\n"));
+                       bytes_written = scnprintf(command, sizeof("FAIL"), "FAIL");
+               } else {
+                       ANDROID_ERROR(("BW set done\n"));
+                       bytes_written = scnprintf(command, sizeof("OK"), "OK");
+               }
+
+               err = wldev_ioctl_set(net, WLC_UP, &val, sizeof(s32));
+               if (err < 0) {
+                       ANDROID_ERROR(("WLC_UP error %d\n", err));
+                       bytes_written = scnprintf(command, sizeof("FAIL"), "FAIL");
+               }
+       }
+       return bytes_written;
+}
+#endif /* SUPPORT_NAN_RANGING_TEST_BW */
+
+static int
+wl_android_set_softap_ax_mode(struct net_device *dev, const char* cmd_str)
+{
+       int enable = 0;
+       int err = 0;
+       s32 bssidx = 0;
+       struct bcm_cfg80211 *cfg = NULL;
+
+       if (!dev) {
+               err = -EINVAL;
+               goto exit;
+       }
+
+       cfg = wl_get_cfg(dev);
+       if (!cfg) {
+               err = -EINVAL;
+               goto exit;
+       }
+
+       if (cmd_str) {
+               enable = bcm_atoi(cmd_str);
+       } else {
+               ANDROID_ERROR(("failed due to wrong received parameter\n"));
+               err = -EINVAL;
+               goto exit;
+       }
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               ANDROID_ERROR(("find softap index from wdev failed\n"));
+               err = -EINVAL;
+               goto exit;
+       }
+
+       ANDROID_INFO(("HAPD_SET_AX_MODE = %d\n", enable));
+       err = wl_cfg80211_set_he_mode(dev, cfg, bssidx, WL_IF_TYPE_AP, (bool)enable);
+       if (err) {
+               ANDROID_ERROR(("failed to set softap ax mode(%d)\n", enable));
+
+       }
+exit :
+       return err;
+}
+
+int
+wl_handle_private_cmd(struct net_device *net, char *command, u32 cmd_len)
+{
+       int bytes_written = 0;
+       android_wifi_priv_cmd priv_cmd;
+
+       bzero(&priv_cmd, sizeof(android_wifi_priv_cmd));
+       priv_cmd.total_len = cmd_len;
+
+       if (strnicmp(command, CMD_START, strlen(CMD_START)) == 0) {
+               ANDROID_INFO(("%s, Received regular START command\n", __FUNCTION__));
+#ifdef SUPPORT_DEEP_SLEEP
+               trigger_deep_sleep = 1;
+#else
+#ifdef  BT_OVER_SDIO
+               bytes_written = dhd_net_bus_get(net);
+#else
+               bytes_written = wl_android_wifi_on(net);
+#endif /* BT_OVER_SDIO */
+#endif /* SUPPORT_DEEP_SLEEP */
+       }
+       else if (strnicmp(command, CMD_SETFWPATH, strlen(CMD_SETFWPATH)) == 0) {
+               bytes_written = wl_android_set_fwpath(net, command, priv_cmd.total_len);
+       }
+
+       if (!g_wifi_on) {
+               ANDROID_ERROR(("%s: Ignore private cmd \"%s\" - iface is down\n",
+                       __FUNCTION__, command));
+               return 0;
+       }
+
+       if (strnicmp(command, CMD_STOP, strlen(CMD_STOP)) == 0) {
+#ifdef SUPPORT_DEEP_SLEEP
+               trigger_deep_sleep = 1;
+#else
+#ifdef  BT_OVER_SDIO
+               bytes_written = dhd_net_bus_put(net);
+#else
+               bytes_written = wl_android_wifi_off(net, FALSE);
+#endif /* BT_OVER_SDIO */
+#endif /* SUPPORT_DEEP_SLEEP */
+       }
+#ifdef WL_CFG80211
+       else if (strnicmp(command, CMD_SCAN_ACTIVE, strlen(CMD_SCAN_ACTIVE)) == 0) {
+               wl_cfg80211_set_passive_scan(net, command);
+       }
+       else if (strnicmp(command, CMD_SCAN_PASSIVE, strlen(CMD_SCAN_PASSIVE)) == 0) {
+               wl_cfg80211_set_passive_scan(net, command);
+       }
+#endif /* WL_CFG80211 */
+       else if (strnicmp(command, CMD_RSSI, strlen(CMD_RSSI)) == 0) {
+               bytes_written = wl_android_get_rssi(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_LINKSPEED, strlen(CMD_LINKSPEED)) == 0) {
+               bytes_written = wl_android_get_link_speed(net, command, priv_cmd.total_len);
+       }
+#ifdef PKT_FILTER_SUPPORT
+       else if (strnicmp(command, CMD_RXFILTER_START, strlen(CMD_RXFILTER_START)) == 0) {
+               bytes_written = net_os_enable_packet_filter(net, 1);
+       }
+       else if (strnicmp(command, CMD_RXFILTER_STOP, strlen(CMD_RXFILTER_STOP)) == 0) {
+               bytes_written = net_os_enable_packet_filter(net, 0);
+       }
+       else if (strnicmp(command, CMD_RXFILTER_ADD, strlen(CMD_RXFILTER_ADD)) == 0) {
+               int filter_num = *(command + strlen(CMD_RXFILTER_ADD) + 1) - '0';
+               bytes_written = net_os_rxfilter_add_remove(net, TRUE, filter_num);
+       }
+       else if (strnicmp(command, CMD_RXFILTER_REMOVE, strlen(CMD_RXFILTER_REMOVE)) == 0) {
+               int filter_num = *(command + strlen(CMD_RXFILTER_REMOVE) + 1) - '0';
+               bytes_written = net_os_rxfilter_add_remove(net, FALSE, filter_num);
+       }
+#endif /* PKT_FILTER_SUPPORT */
+       else if (strnicmp(command, CMD_BTCOEXSCAN_START, strlen(CMD_BTCOEXSCAN_START)) == 0) {
+               /* TBD: BTCOEXSCAN-START */
+       }
+       else if (strnicmp(command, CMD_BTCOEXSCAN_STOP, strlen(CMD_BTCOEXSCAN_STOP)) == 0) {
+               /* TBD: BTCOEXSCAN-STOP */
+       }
+       else if (strnicmp(command, CMD_BTCOEXMODE, strlen(CMD_BTCOEXMODE)) == 0) {
+#ifdef WL_CFG80211
+               void *dhdp = wl_cfg80211_get_dhdp(net);
+               bytes_written = wl_cfg80211_set_btcoex_dhcp(net, dhdp, command);
+#else
+#ifdef PKT_FILTER_SUPPORT
+               uint mode = *(command + strlen(CMD_BTCOEXMODE) + 1) - '0';
+
+               if (mode == 1)
+                       net_os_enable_packet_filter(net, 0); /* DHCP starts */
+               else
+                       net_os_enable_packet_filter(net, 1); /* DHCP ends */
+#endif /* PKT_FILTER_SUPPORT */
+#endif /* WL_CFG80211 */
+       }
+       else if (strnicmp(command, CMD_SETSUSPENDOPT, strlen(CMD_SETSUSPENDOPT)) == 0) {
+               bytes_written = wl_android_set_suspendopt(net, command);
+       }
+       else if (strnicmp(command, CMD_SETSUSPENDMODE, strlen(CMD_SETSUSPENDMODE)) == 0) {
+               bytes_written = wl_android_set_suspendmode(net, command);
+       }
+       else if (strnicmp(command, CMD_SETDTIM_IN_SUSPEND, strlen(CMD_SETDTIM_IN_SUSPEND)) == 0) {
+               bytes_written = wl_android_set_bcn_li_dtim(net, command);
+       }
+       else if (strnicmp(command, CMD_MAXDTIM_IN_SUSPEND, strlen(CMD_MAXDTIM_IN_SUSPEND)) == 0) {
+               bytes_written = wl_android_set_max_dtim(net, command);
+       }
+#ifdef DISABLE_DTIM_IN_SUSPEND
+       else if (strnicmp(command, CMD_DISDTIM_IN_SUSPEND, strlen(CMD_DISDTIM_IN_SUSPEND)) == 0) {
+               bytes_written = wl_android_set_disable_dtim_in_suspend(net, command);
+       }
+#endif /* DISABLE_DTIM_IN_SUSPEND */
+#ifdef WL_CFG80211
+       else if (strnicmp(command, CMD_SETBAND, strlen(CMD_SETBAND)) == 0) {
+               bytes_written = wl_android_set_band(net, command);
+       }
+#endif /* WL_CFG80211 */
+       else if (strnicmp(command, CMD_GETBAND, strlen(CMD_GETBAND)) == 0) {
+               bytes_written = wl_android_get_band(net, command, priv_cmd.total_len);
+       }
+#ifdef WL_CFG80211
+       else if (strnicmp(command, CMD_SET_CSA, strlen(CMD_SET_CSA)) == 0) {
+               bytes_written = wl_android_set_csa(net, command);
+       } else if (strnicmp(command, CMD_80211_MODE, strlen(CMD_80211_MODE)) == 0) {
+               bytes_written = wl_android_get_80211_mode(net, command, priv_cmd.total_len);
+       } else if (strnicmp(command, CMD_CHANSPEC, strlen(CMD_CHANSPEC)) == 0) {
+               bytes_written = wl_android_get_chanspec(net, command, priv_cmd.total_len);
+       }
+#endif /* WL_CFG80211 */
+#ifndef CUSTOMER_SET_COUNTRY
+       /* CUSTOMER_SET_COUNTRY feature is define for only GGSM model */
+       else if (strnicmp(command, CMD_COUNTRY, strlen(CMD_COUNTRY)) == 0) {
+               /*
+                * Usage examples:
+                * DRIVER COUNTRY US
+                * DRIVER COUNTRY US/7
+                */
+               char *country_code = command + strlen(CMD_COUNTRY) + 1;
+               char *rev_info_delim = country_code + 2; /* 2 bytes of country code */
+               int revinfo = -1;
+#if defined(DHD_BLOB_EXISTENCE_CHECK)
+               dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(net);
+
+               if (dhdp->is_blob) {
+                       revinfo = 0;
+               } else
+#endif /* DHD_BLOB_EXISTENCE_CHECK */
+               if ((rev_info_delim) &&
+                       (strnicmp(rev_info_delim, CMD_COUNTRY_DELIMITER,
+                       strlen(CMD_COUNTRY_DELIMITER)) == 0) &&
+                       (rev_info_delim + 1)) {
+                       revinfo  = bcm_atoi(rev_info_delim + 1);
+               }
+#ifdef WL_CFG80211
+               bytes_written = wl_cfg80211_set_country_code(net, country_code,
+                               true, true, revinfo);
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+#ifdef FCC_PWR_LIMIT_2G
+               if (wldev_iovar_setint(net, "fccpwrlimit2g", FALSE)) {
+                       ANDROID_ERROR(("%s: fccpwrlimit2g deactivation is failed\n", __FUNCTION__));
+               } else {
+                       ANDROID_ERROR(("%s: fccpwrlimit2g is deactivated\n", __FUNCTION__));
+               }
+#endif /* FCC_PWR_LIMIT_2G */
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+#else
+               bytes_written = wldev_set_country(net, country_code, true, true, revinfo);
+#endif /* WL_CFG80211 */
+       }
+#endif /* CUSTOMER_SET_COUNTRY */
+       else if (strnicmp(command, CMD_DATARATE, strlen(CMD_DATARATE)) == 0) {
+               bytes_written = wl_android_get_datarate(net, command, priv_cmd.total_len);
+       } else if (strnicmp(command, CMD_ASSOC_CLIENTS, strlen(CMD_ASSOC_CLIENTS)) == 0) {
+               bytes_written = wl_android_get_assoclist(net, command, priv_cmd.total_len);
+       }
+
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+       else if (strnicmp(command, CMD_ROAM_VSIE_ENAB_SET, strlen(CMD_ROAM_VSIE_ENAB_SET)) == 0) {
+               bytes_written = wl_android_set_roam_vsie_enab(net, command, priv_cmd.total_len);
+       } else if (strnicmp(command, CMD_ROAM_VSIE_ENAB_GET, strlen(CMD_ROAM_VSIE_ENAB_GET)) == 0) {
+               bytes_written = wl_android_get_roam_vsie_enab(net, command, priv_cmd.total_len);
+       } else if (strnicmp(command, CMD_BR_VSIE_ENAB_SET, strlen(CMD_BR_VSIE_ENAB_SET)) == 0) {
+               bytes_written = wl_android_set_bcn_rpt_vsie_enab(net, command, priv_cmd.total_len);
+       } else if (strnicmp(command, CMD_BR_VSIE_ENAB_GET, strlen(CMD_BR_VSIE_ENAB_GET)) == 0) {
+               bytes_written = wl_android_get_bcn_rpt_vsie_enab(net, command, priv_cmd.total_len);
+       }
+#ifdef WES_SUPPORT
+       else if (strnicmp(command, CMD_GETNCHOMODE, strlen(CMD_GETNCHOMODE)) == 0) {
+               bytes_written = wl_android_get_ncho_mode(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_SETNCHOMODE, strlen(CMD_SETNCHOMODE)) == 0) {
+               int mode;
+               sscanf(command, "%*s %d", &mode);
+               bytes_written = wl_android_set_ncho_mode(net, mode);
+       }
+       else if (strnicmp(command, CMD_OKC_SET_PMK, strlen(CMD_OKC_SET_PMK)) == 0) {
+               bytes_written = wl_android_set_pmk(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_OKC_ENABLE, strlen(CMD_OKC_ENABLE)) == 0) {
+               bytes_written = wl_android_okc_enable(net, command);
+       }
+       else if (wl_android_legacy_check_command(net, command)) {
+               bytes_written = wl_android_legacy_private_command(net, command, priv_cmd.total_len);
+       }
+       else if (wl_android_ncho_check_command(net, command)) {
+               bytes_written = wl_android_ncho_private_command(net, command, priv_cmd.total_len);
+       }
+#endif /* WES_SUPPORT */
+#if defined(SUPPORT_RESTORE_SCAN_PARAMS) || defined(WES_SUPPORT)
+       else if (strnicmp(command, CMD_RESTORE_SCAN_PARAMS, strlen(CMD_RESTORE_SCAN_PARAMS)) == 0) {
+               bytes_written = wl_android_default_set_scan_params(net, command,
+                       priv_cmd.total_len);
+       }
+#endif /* SUPPORT_RESTORE_SCAN_PARAMS || WES_SUPPORT */
+#ifdef WLTDLS
+       else if (strnicmp(command, CMD_TDLS_RESET, strlen(CMD_TDLS_RESET)) == 0) {
+               bytes_written = wl_android_tdls_reset(net);
+       }
+#endif /* WLTDLS */
+#ifdef CONFIG_SILENT_ROAM
+       else if (strnicmp(command, CMD_SROAM_TURN_ON, strlen(CMD_SROAM_TURN_ON)) == 0) {
+               int mode = *(command + strlen(CMD_SROAM_TURN_ON) + 1) - '0';
+               bytes_written = wl_android_sroam_turn_on(net, mode);
+       }
+       else if (strnicmp(command, CMD_SROAM_SET_INFO, strlen(CMD_SROAM_SET_INFO)) == 0) {
+               char *data = (command + strlen(CMD_SROAM_SET_INFO) + 1);
+               bytes_written = wl_android_sroam_set_info(net, data, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_SROAM_GET_INFO, strlen(CMD_SROAM_GET_INFO)) == 0) {
+               bytes_written = wl_android_sroam_get_info(net, command, priv_cmd.total_len);
+       }
+#endif /* CONFIG_SILENT_ROAM */
+#ifdef CONFIG_ROAM_RSSI_LIMIT
+       else if (strnicmp(command, CMD_ROAM_RSSI_LMT, strlen(CMD_ROAM_RSSI_LMT)) == 0) {
+               bytes_written = wl_android_roam_rssi_limit(net, command, priv_cmd.total_len);
+       }
+#endif /* CONFIG_ROAM_RSSI_LIMIT */
+       else if (strnicmp(command, CMD_SET_DISCONNECT_IES, strlen(CMD_SET_DISCONNECT_IES)) == 0) {
+               bytes_written = wl_android_set_disconnect_ies(net, command);
+       }
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+
+#ifdef PNO_SUPPORT
+       else if (strnicmp(command, CMD_PNOSSIDCLR_SET, strlen(CMD_PNOSSIDCLR_SET)) == 0) {
+               bytes_written = dhd_dev_pno_stop_for_ssid(net);
+       }
+#ifndef WL_SCHED_SCAN
+       else if (strnicmp(command, CMD_PNOSETUP_SET, strlen(CMD_PNOSETUP_SET)) == 0) {
+               bytes_written = wl_android_set_pno_setup(net, command, priv_cmd.total_len);
+       }
+#endif /* !WL_SCHED_SCAN */
+       else if (strnicmp(command, CMD_PNOENABLE_SET, strlen(CMD_PNOENABLE_SET)) == 0) {
+               int enable = *(command + strlen(CMD_PNOENABLE_SET) + 1) - '0';
+               bytes_written = (enable)? 0 : dhd_dev_pno_stop_for_ssid(net);
+       }
+       else if (strnicmp(command, CMD_WLS_BATCHING, strlen(CMD_WLS_BATCHING)) == 0) {
+               bytes_written = wls_parse_batching_cmd(net, command, priv_cmd.total_len);
+       }
+#endif /* PNO_SUPPORT */
+       else if (strnicmp(command, CMD_P2P_DEV_ADDR, strlen(CMD_P2P_DEV_ADDR)) == 0) {
+               bytes_written = wl_android_get_p2p_dev_addr(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_P2P_SET_NOA, strlen(CMD_P2P_SET_NOA)) == 0) {
+               int skip = strlen(CMD_P2P_SET_NOA) + 1;
+               bytes_written = wl_cfg80211_set_p2p_noa(net, command + skip,
+                       priv_cmd.total_len - skip);
+       }
+#ifdef P2P_LISTEN_OFFLOADING
+       else if (strnicmp(command, CMD_P2P_LISTEN_OFFLOAD, strlen(CMD_P2P_LISTEN_OFFLOAD)) == 0) {
+               u8 *sub_command = strchr(command, ' ');
+               bytes_written = wl_cfg80211_p2plo_offload(net, command, sub_command,
+                               sub_command ? strlen(sub_command) : 0);
+       }
+#endif /* P2P_LISTEN_OFFLOADING */
+#if !defined WL_ENABLE_P2P_IF
+       else if (strnicmp(command, CMD_P2P_GET_NOA, strlen(CMD_P2P_GET_NOA)) == 0) {
+               bytes_written = wl_cfg80211_get_p2p_noa(net, command, priv_cmd.total_len);
+       }
+#endif /* WL_ENABLE_P2P_IF */
+       else if (strnicmp(command, CMD_P2P_SET_PS, strlen(CMD_P2P_SET_PS)) == 0) {
+               int skip = strlen(CMD_P2P_SET_PS) + 1;
+               bytes_written = wl_cfg80211_set_p2p_ps(net, command + skip,
+                       priv_cmd.total_len - skip);
+       }
+       else if (strnicmp(command, CMD_P2P_ECSA, strlen(CMD_P2P_ECSA)) == 0) {
+               int skip = strlen(CMD_P2P_ECSA) + 1;
+               bytes_written = wl_cfg80211_set_p2p_ecsa(net, command + skip,
+                       priv_cmd.total_len - skip);
+       }
+       /* This command is not for normal VSDB operation but for only specific P2P operation.
+        * Ex) P2P OTA backup operation
+        */
+       else if (strnicmp(command, CMD_P2P_INC_BW, strlen(CMD_P2P_INC_BW)) == 0) {
+               int skip = strlen(CMD_P2P_INC_BW) + 1;
+               bytes_written = wl_cfg80211_increase_p2p_bw(net,
+                               command + skip, priv_cmd.total_len - skip);
+       }
+#ifdef WL_CFG80211
+       else if (strnicmp(command, CMD_SET_AP_WPS_P2P_IE,
+               strlen(CMD_SET_AP_WPS_P2P_IE)) == 0) {
+               int skip = strlen(CMD_SET_AP_WPS_P2P_IE) + 3;
+               bytes_written = wl_cfg80211_set_wps_p2p_ie(net, command + skip,
+                       priv_cmd.total_len - skip, *(command + skip - 2) - '0');
+       }
+#ifdef WLFBT
+       else if (strnicmp(command, CMD_GET_FTKEY, strlen(CMD_GET_FTKEY)) == 0) {
+               bytes_written = wl_cfg80211_get_fbt_key(net, command, priv_cmd.total_len);
+       }
+#endif /* WLFBT */
+#endif /* WL_CFG80211 */
+#if defined(WL_SUPPORT_AUTO_CHANNEL)
+       else if (strnicmp(command, CMD_GET_BEST_CHANNELS,
+               strlen(CMD_GET_BEST_CHANNELS)) == 0) {
+               bytes_written = wl_cfg80211_get_best_channels(net, command,
+                       priv_cmd.total_len);
+       }
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+#if defined(WL_SUPPORT_AUTO_CHANNEL)
+       else if (strnicmp(command, CMD_SET_HAPD_AUTO_CHANNEL,
+               strlen(CMD_SET_HAPD_AUTO_CHANNEL)) == 0) {
+               int skip = strlen(CMD_SET_HAPD_AUTO_CHANNEL) + 1;
+               bytes_written = wl_android_set_auto_channel(net, (const char*)command+skip, command,
+                       priv_cmd.total_len);
+       }
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+#ifdef SUPPORT_AMPDU_MPDU_CMD
+       /* CMD_AMPDU_MPDU */
+       else if (strnicmp(command, CMD_AMPDU_MPDU, strlen(CMD_AMPDU_MPDU)) == 0) {
+               int skip = strlen(CMD_AMPDU_MPDU) + 1;
+               bytes_written = wl_android_set_ampdu_mpdu(net, (const char*)command+skip);
+       }
+#endif /* SUPPORT_AMPDU_MPDU_CMD */
+#if defined(SUPPORT_HIDDEN_AP)
+       else if (strnicmp(command, CMD_SET_HAPD_MAX_NUM_STA,
+               strlen(CMD_SET_HAPD_MAX_NUM_STA)) == 0) {
+               int skip = strlen(CMD_SET_HAPD_MAX_NUM_STA) + 3;
+               wl_android_set_max_num_sta(net, (const char*)command+skip);
+       }
+       else if (strnicmp(command, CMD_SET_HAPD_SSID,
+               strlen(CMD_SET_HAPD_SSID)) == 0) {
+               int skip = strlen(CMD_SET_HAPD_SSID) + 3;
+               wl_android_set_ssid(net, (const char*)command+skip);
+       }
+       else if (strnicmp(command, CMD_SET_HAPD_HIDE_SSID,
+               strlen(CMD_SET_HAPD_HIDE_SSID)) == 0) {
+               int skip = strlen(CMD_SET_HAPD_HIDE_SSID) + 3;
+               wl_android_set_hide_ssid(net, (const char*)command+skip);
+       }
+#endif /* SUPPORT_HIDDEN_AP */
+#ifdef SUPPORT_SOFTAP_SINGL_DISASSOC
+       else if (strnicmp(command, CMD_HAPD_STA_DISASSOC,
+               strlen(CMD_HAPD_STA_DISASSOC)) == 0) {
+               int skip = strlen(CMD_HAPD_STA_DISASSOC) + 1;
+               wl_android_sta_diassoc(net, (const char*)command+skip);
+       }
+#endif /* SUPPORT_SOFTAP_SINGL_DISASSOC */
+#ifdef SUPPORT_SET_LPC
+       else if (strnicmp(command, CMD_HAPD_LPC_ENABLED,
+               strlen(CMD_HAPD_LPC_ENABLED)) == 0) {
+               int skip = strlen(CMD_HAPD_LPC_ENABLED) + 3;
+               wl_android_set_lpc(net, (const char*)command+skip);
+       }
+#endif /* SUPPORT_SET_LPC */
+#ifdef SUPPORT_TRIGGER_HANG_EVENT
+       else if (strnicmp(command, CMD_TEST_FORCE_HANG,
+               strlen(CMD_TEST_FORCE_HANG)) == 0) {
+               int skip = strlen(CMD_TEST_FORCE_HANG) + 1;
+               net_os_send_hang_message_reason(net, (const char*)command+skip);
+       }
+#endif /* SUPPORT_TRIGGER_HANG_EVENT */
+       else if (strnicmp(command, CMD_CHANGE_RL, strlen(CMD_CHANGE_RL)) == 0)
+               bytes_written = wl_android_ch_res_rl(net, true);
+       else if (strnicmp(command, CMD_RESTORE_RL, strlen(CMD_RESTORE_RL)) == 0)
+               bytes_written = wl_android_ch_res_rl(net, false);
+#ifdef SUPPORT_LTECX
+       else if (strnicmp(command, CMD_LTECX_SET, strlen(CMD_LTECX_SET)) == 0) {
+               int skip = strlen(CMD_LTECX_SET) + 1;
+               bytes_written = wl_android_set_ltecx(net, (const char*)command+skip);
+       }
+#endif /* SUPPORT_LTECX */
+#ifdef WL_RELMCAST
+       else if (strnicmp(command, CMD_SET_RMC_ENABLE, strlen(CMD_SET_RMC_ENABLE)) == 0) {
+               int rmc_enable = *(command + strlen(CMD_SET_RMC_ENABLE) + 1) - '0';
+               bytes_written = wl_android_rmc_enable(net, rmc_enable);
+       }
+       else if (strnicmp(command, CMD_SET_RMC_TXRATE, strlen(CMD_SET_RMC_TXRATE)) == 0) {
+               int rmc_txrate;
+               sscanf(command, "%*s %10d", &rmc_txrate);
+               bytes_written = wldev_iovar_setint(net, "rmc_txrate", rmc_txrate * 2);
+       }
+       else if (strnicmp(command, CMD_SET_RMC_ACTPERIOD, strlen(CMD_SET_RMC_ACTPERIOD)) == 0) {
+               int actperiod;
+               sscanf(command, "%*s %10d", &actperiod);
+               bytes_written = wldev_iovar_setint(net, "rmc_actf_time", actperiod);
+       }
+       else if (strnicmp(command, CMD_SET_RMC_IDLEPERIOD, strlen(CMD_SET_RMC_IDLEPERIOD)) == 0) {
+               int acktimeout;
+               sscanf(command, "%*s %10d", &acktimeout);
+               acktimeout *= 1000;
+               bytes_written = wldev_iovar_setint(net, "rmc_acktmo", acktimeout);
+       }
+       else if (strnicmp(command, CMD_SET_RMC_LEADER, strlen(CMD_SET_RMC_LEADER)) == 0) {
+               int skip = strlen(CMD_SET_RMC_LEADER) + 1;
+               bytes_written = wl_android_rmc_set_leader(net, (const char*)command+skip);
+       }
+       else if (strnicmp(command, CMD_SET_RMC_EVENT,
+               strlen(CMD_SET_RMC_EVENT)) == 0) {
+               bytes_written = wl_android_set_rmc_event(net, command);
+       }
+#endif /* WL_RELMCAST */
+       else if (strnicmp(command, CMD_GET_SCSCAN, strlen(CMD_GET_SCSCAN)) == 0) {
+               bytes_written = wl_android_get_singlecore_scan(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_SET_SCSCAN, strlen(CMD_SET_SCSCAN)) == 0) {
+               bytes_written = wl_android_set_singlecore_scan(net, command);
+       }
+#ifdef TEST_TX_POWER_CONTROL
+       else if (strnicmp(command, CMD_TEST_SET_TX_POWER,
+               strlen(CMD_TEST_SET_TX_POWER)) == 0) {
+               int skip = strlen(CMD_TEST_SET_TX_POWER) + 1;
+               wl_android_set_tx_power(net, (const char*)command+skip);
+       }
+       else if (strnicmp(command, CMD_TEST_GET_TX_POWER,
+               strlen(CMD_TEST_GET_TX_POWER)) == 0) {
+               wl_android_get_tx_power(net, command, priv_cmd.total_len);
+       }
+#endif /* TEST_TX_POWER_CONTROL */
+       else if (strnicmp(command, CMD_SARLIMIT_TX_CONTROL,
+               strlen(CMD_SARLIMIT_TX_CONTROL)) == 0) {
+               int skip = strlen(CMD_SARLIMIT_TX_CONTROL) + 1;
+               bytes_written = wl_android_set_sarlimit_txctrl(net, (const char*)command+skip);
+       }
+#ifdef SUPPORT_SET_TID
+       else if (strnicmp(command, CMD_SET_TID, strlen(CMD_SET_TID)) == 0) {
+               bytes_written = wl_android_set_tid(net, command);
+       }
+       else if (strnicmp(command, CMD_GET_TID, strlen(CMD_GET_TID)) == 0) {
+               bytes_written = wl_android_get_tid(net, command, priv_cmd.total_len);
+       }
+#endif /* SUPPORT_SET_TID */
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+       else if (strnicmp(command, CMD_HAPD_MAC_FILTER, strlen(CMD_HAPD_MAC_FILTER)) == 0) {
+               int skip = strlen(CMD_HAPD_MAC_FILTER) + 1;
+               wl_android_set_mac_address_filter(net, command+skip);
+       }
+       else if (strnicmp(command, CMD_SETROAMMODE, strlen(CMD_SETROAMMODE)) == 0)
+               bytes_written = wl_android_set_roam_mode(net, command);
+#if defined(BCMFW_ROAM_ENABLE)
+       else if (strnicmp(command, CMD_SET_ROAMPREF, strlen(CMD_SET_ROAMPREF)) == 0) {
+               bytes_written = wl_android_set_roampref(net, command, priv_cmd.total_len);
+       }
+#endif /* BCMFW_ROAM_ENABLE */
+#ifdef WL_CFG80211
+       else if (strnicmp(command, CMD_MIRACAST, strlen(CMD_MIRACAST)) == 0)
+               bytes_written = wl_android_set_miracast(net, command);
+       else if (strnicmp(command, CMD_SETIBSSBEACONOUIDATA, strlen(CMD_SETIBSSBEACONOUIDATA)) == 0)
+               bytes_written = wl_android_set_ibss_beacon_ouidata(net,
+               command, priv_cmd.total_len);
+#endif /* WL_CFG80211 */
+#ifdef WLAIBSS
+       else if (strnicmp(command, CMD_SETIBSSTXFAILEVENT,
+               strlen(CMD_SETIBSSTXFAILEVENT)) == 0)
+               bytes_written = wl_android_set_ibss_txfail_event(net, command, priv_cmd.total_len);
+       else if (strnicmp(command, CMD_GET_IBSS_PEER_INFO_ALL,
+               strlen(CMD_GET_IBSS_PEER_INFO_ALL)) == 0)
+               bytes_written = wl_android_get_ibss_peer_info(net, command, priv_cmd.total_len,
+                       TRUE);
+       else if (strnicmp(command, CMD_GET_IBSS_PEER_INFO,
+               strlen(CMD_GET_IBSS_PEER_INFO)) == 0)
+               bytes_written = wl_android_get_ibss_peer_info(net, command, priv_cmd.total_len,
+                       FALSE);
+       else if (strnicmp(command, CMD_SETIBSSROUTETABLE,
+               strlen(CMD_SETIBSSROUTETABLE)) == 0)
+               bytes_written = wl_android_set_ibss_routetable(net, command);
+       else if (strnicmp(command, CMD_SETIBSSAMPDU, strlen(CMD_SETIBSSAMPDU)) == 0)
+               bytes_written = wl_android_set_ibss_ampdu(net, command, priv_cmd.total_len);
+       else if (strnicmp(command, CMD_SETIBSSANTENNAMODE, strlen(CMD_SETIBSSANTENNAMODE)) == 0)
+               bytes_written = wl_android_set_ibss_antenna(net, command, priv_cmd.total_len);
+#endif /* WLAIBSS */
+       else if (strnicmp(command, CMD_KEEP_ALIVE, strlen(CMD_KEEP_ALIVE)) == 0) {
+               int skip = strlen(CMD_KEEP_ALIVE) + 1;
+               bytes_written = wl_keep_alive_set(net, command + skip);
+       }
+#ifdef WL_CFG80211
+       else if (strnicmp(command, CMD_ROAM_OFFLOAD, strlen(CMD_ROAM_OFFLOAD)) == 0) {
+               int enable = *(command + strlen(CMD_ROAM_OFFLOAD) + 1) - '0';
+               bytes_written = wl_cfg80211_enable_roam_offload(net, enable);
+       }
+       else if (strnicmp(command, CMD_INTERFACE_CREATE, strlen(CMD_INTERFACE_CREATE)) == 0) {
+               char *name = (command + strlen(CMD_INTERFACE_CREATE) +1);
+               ANDROID_INFO(("Creating %s interface\n", name));
+               if (wl_cfg80211_add_if(wl_get_cfg(net), net, WL_IF_TYPE_STA,
+                               name, NULL) == NULL) {
+                       bytes_written = -ENODEV;
+               } else {
+                       /* Return success */
+                       bytes_written = 0;
+               }
+       }
+       else if (strnicmp(command, CMD_INTERFACE_DELETE, strlen(CMD_INTERFACE_DELETE)) == 0) {
+               char *name = (command + strlen(CMD_INTERFACE_DELETE) +1);
+               ANDROID_INFO(("Deleteing %s interface\n", name));
+               bytes_written = wl_cfg80211_del_if(wl_get_cfg(net), net, NULL, name);
+       }
+#endif /* WL_CFG80211 */
+       else if (strnicmp(command, CMD_GET_LINK_STATUS, strlen(CMD_GET_LINK_STATUS)) == 0) {
+               bytes_written = wl_android_get_link_status(net, command, priv_cmd.total_len);
+       }
+#ifdef P2PRESP_WFDIE_SRC
+       else if (strnicmp(command, CMD_P2P_SET_WFDIE_RESP,
+               strlen(CMD_P2P_SET_WFDIE_RESP)) == 0) {
+               int mode = *(command + strlen(CMD_P2P_SET_WFDIE_RESP) + 1) - '0';
+               bytes_written = wl_android_set_wfdie_resp(net, mode);
+       } else if (strnicmp(command, CMD_P2P_GET_WFDIE_RESP,
+               strlen(CMD_P2P_GET_WFDIE_RESP)) == 0) {
+               bytes_written = wl_android_get_wfdie_resp(net, command, priv_cmd.total_len);
+       }
+#endif /* P2PRESP_WFDIE_SRC */
+#ifdef WL_CFG80211
+       else if (strnicmp(command, CMD_DFS_AP_MOVE, strlen(CMD_DFS_AP_MOVE)) == 0) {
+               char *data = (command + strlen(CMD_DFS_AP_MOVE) +1);
+               bytes_written = wl_cfg80211_dfs_ap_move(net, data, command, priv_cmd.total_len);
+       }
+#endif /* WL_CFG80211 */
+#ifdef WBTEXT
+       else if (strnicmp(command, CMD_WBTEXT_ENABLE, strlen(CMD_WBTEXT_ENABLE)) == 0) {
+               bytes_written = wl_android_wbtext(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_WBTEXT_PROFILE_CONFIG,
+                       strlen(CMD_WBTEXT_PROFILE_CONFIG)) == 0) {
+               char *data = (command + strlen(CMD_WBTEXT_PROFILE_CONFIG) + 1);
+               bytes_written = wl_cfg80211_wbtext_config(net, data, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_WBTEXT_WEIGHT_CONFIG,
+                       strlen(CMD_WBTEXT_WEIGHT_CONFIG)) == 0) {
+               char *data = (command + strlen(CMD_WBTEXT_WEIGHT_CONFIG) + 1);
+               bytes_written = wl_cfg80211_wbtext_weight_config(net, data,
+                               command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_WBTEXT_TABLE_CONFIG,
+                       strlen(CMD_WBTEXT_TABLE_CONFIG)) == 0) {
+               char *data = (command + strlen(CMD_WBTEXT_TABLE_CONFIG) + 1);
+               bytes_written = wl_cfg80211_wbtext_table_config(net, data,
+                               command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_WBTEXT_DELTA_CONFIG,
+                       strlen(CMD_WBTEXT_DELTA_CONFIG)) == 0) {
+               char *data = (command + strlen(CMD_WBTEXT_DELTA_CONFIG) + 1);
+               bytes_written = wl_cfg80211_wbtext_delta_config(net, data,
+                               command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_WBTEXT_BTM_TIMER_THRESHOLD,
+                       strlen(CMD_WBTEXT_BTM_TIMER_THRESHOLD)) == 0) {
+               bytes_written = wl_cfg80211_wbtext_btm_timer_threshold(net, command,
+                       priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_WBTEXT_BTM_DELTA,
+                       strlen(CMD_WBTEXT_BTM_DELTA)) == 0) {
+               bytes_written = wl_cfg80211_wbtext_btm_delta(net, command,
+                       priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_WBTEXT_ESTM_ENABLE,
+                       strlen(CMD_WBTEXT_ESTM_ENABLE)) == 0) {
+               bytes_written = wl_cfg80211_wbtext_estm_enable(net, command,
+                       priv_cmd.total_len);
+       }
+#endif /* WBTEXT */
+#ifdef WLWFDS
+       else if (strnicmp(command, CMD_ADD_WFDS_HASH, strlen(CMD_ADD_WFDS_HASH)) == 0) {
+               bytes_written = wl_android_set_wfds_hash(net, command, 1);
+       }
+       else if (strnicmp(command, CMD_DEL_WFDS_HASH, strlen(CMD_DEL_WFDS_HASH)) == 0) {
+               bytes_written = wl_android_set_wfds_hash(net, command, 0);
+       }
+#endif /* WLWFDS */
+#ifdef BT_WIFI_HANDOVER
+       else if (strnicmp(command, CMD_TBOW_TEARDOWN, strlen(CMD_TBOW_TEARDOWN)) == 0) {
+           bytes_written = wl_tbow_teardown(net);
+       }
+#endif /* BT_WIFI_HANDOVER */
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+#ifdef FCC_PWR_LIMIT_2G
+       else if (strnicmp(command, CMD_GET_FCC_PWR_LIMIT_2G,
+               strlen(CMD_GET_FCC_PWR_LIMIT_2G)) == 0) {
+               bytes_written = wl_android_get_fcc_pwr_limit_2g(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_SET_FCC_PWR_LIMIT_2G,
+               strlen(CMD_SET_FCC_PWR_LIMIT_2G)) == 0) {
+               bytes_written = wl_android_set_fcc_pwr_limit_2g(net, command);
+       }
+#endif /* FCC_PWR_LIMIT_2G */
+       else if (strnicmp(command, CMD_GET_STA_INFO, strlen(CMD_GET_STA_INFO)) == 0) {
+               bytes_written = wl_cfg80211_get_sta_info(net, command, priv_cmd.total_len);
+       }
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+       else if (strnicmp(command, CMD_MURX_BFE_CAP,
+                       strlen(CMD_MURX_BFE_CAP)) == 0) {
+#if defined(WL_MURX) && defined(WL_CFG80211)
+               uint val = *(command + strlen(CMD_MURX_BFE_CAP) + 1) - '0';
+               bytes_written = wl_android_murx_bfe_cap(net, val);
+#else
+               return BCME_UNSUPPORTED;
+#endif /* WL_MURX */
+       }
+#ifdef SUPPORT_AP_HIGHER_BEACONRATE
+       else if (strnicmp(command, CMD_GET_AP_BASICRATE, strlen(CMD_GET_AP_BASICRATE)) == 0) {
+               bytes_written = wl_android_get_ap_basicrate(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_SET_AP_BEACONRATE, strlen(CMD_SET_AP_BEACONRATE)) == 0) {
+               bytes_written = wl_android_set_ap_beaconrate(net, command);
+       }
+#endif /* SUPPORT_AP_HIGHER_BEACONRATE */
+#ifdef SUPPORT_AP_RADIO_PWRSAVE
+       else if (strnicmp(command, CMD_SET_AP_RPS_PARAMS, strlen(CMD_SET_AP_RPS_PARAMS)) == 0) {
+               bytes_written = wl_android_set_ap_rps_params(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_SET_AP_RPS, strlen(CMD_SET_AP_RPS)) == 0) {
+               bytes_written = wl_android_set_ap_rps(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_GET_AP_RPS, strlen(CMD_GET_AP_RPS)) == 0) {
+               bytes_written = wl_android_get_ap_rps(net, command, priv_cmd.total_len);
+       }
+#endif /* SUPPORT_AP_RADIO_PWRSAVE */
+#ifdef SUPPORT_AP_SUSPEND
+       else if (strnicmp(command, CMD_SET_AP_SUSPEND, strlen(CMD_SET_AP_SUSPEND)) == 0) {
+               bytes_written = wl_android_set_ap_suspend(net, command, priv_cmd.total_len);
+       }
+#endif /* SUPPORT_AP_SUSPEND */
+#ifdef SUPPORT_AP_BWCTRL
+       else if (strnicmp(command, CMD_SET_AP_BW, strlen(CMD_SET_AP_BW)) == 0) {
+               bytes_written = wl_android_set_ap_bw(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_GET_AP_BW, strlen(CMD_GET_AP_BW)) == 0) {
+               bytes_written = wl_android_get_ap_bw(net, command, priv_cmd.total_len);
+       }
+#endif /* SUPPORT_AP_BWCTRL */
+#ifdef SUPPORT_RSSI_SUM_REPORT
+       else if (strnicmp(command, CMD_SET_RSSI_LOGGING, strlen(CMD_SET_RSSI_LOGGING)) == 0) {
+               bytes_written = wl_android_set_rssi_logging(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_GET_RSSI_LOGGING, strlen(CMD_GET_RSSI_LOGGING)) == 0) {
+               bytes_written = wl_android_get_rssi_logging(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_GET_RSSI_PER_ANT, strlen(CMD_GET_RSSI_PER_ANT)) == 0) {
+               bytes_written = wl_android_get_rssi_per_ant(net, command, priv_cmd.total_len);
+       }
+#endif /* SUPPORT_RSSI_SUM_REPORT */
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+       else if (strnicmp(command, CMD_GET_BSS_INFO, strlen(CMD_GET_BSS_INFO)) == 0) {
+               bytes_written = wl_cfg80211_get_bss_info(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_GET_ASSOC_REJECT_INFO, strlen(CMD_GET_ASSOC_REJECT_INFO))
+                       == 0) {
+               bytes_written = wl_cfg80211_get_connect_failed_status(net, command,
+                               priv_cmd.total_len);
+       }
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+#if defined(SUPPORT_RANDOM_MAC_SCAN)
+       else if (strnicmp(command, ENABLE_RANDOM_MAC, strlen(ENABLE_RANDOM_MAC)) == 0) {
+               bytes_written = wl_cfg80211_set_random_mac(net, TRUE);
+       } else if (strnicmp(command, DISABLE_RANDOM_MAC, strlen(DISABLE_RANDOM_MAC)) == 0) {
+               bytes_written = wl_cfg80211_set_random_mac(net, FALSE);
+       }
+#endif /* SUPPORT_RANDOM_MAC_SCAN */
+#ifdef WL_NATOE
+       else if (strnicmp(command, CMD_NATOE, strlen(CMD_NATOE)) == 0) {
+               bytes_written = wl_android_process_natoe_cmd(net, command,
+                               priv_cmd.total_len);
+       }
+#endif /* WL_NATOE */
+#ifdef CONNECTION_STATISTICS
+       else if (strnicmp(command, CMD_GET_CONNECTION_STATS,
+               strlen(CMD_GET_CONNECTION_STATS)) == 0) {
+               bytes_written = wl_android_get_connection_stats(net, command,
+                       priv_cmd.total_len);
+       }
+#endif
+#ifdef DHD_LOG_DUMP
+       else if (strnicmp(command, CMD_NEW_DEBUG_PRINT_DUMP,
+               strlen(CMD_NEW_DEBUG_PRINT_DUMP)) == 0) {
+               dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(net);
+               /* check whether it has more command */
+               if (strnicmp(command + strlen(CMD_NEW_DEBUG_PRINT_DUMP), " ", 1) == 0) {
+                       /* compare unwanted/disconnected command */
+                       if (strnicmp(command + strlen(CMD_NEW_DEBUG_PRINT_DUMP) + 1,
+                               SUBCMD_UNWANTED, strlen(SUBCMD_UNWANTED)) == 0) {
+                               dhd_log_dump_trigger(dhdp, CMD_UNWANTED);
+                       } else if (strnicmp(command + strlen(CMD_NEW_DEBUG_PRINT_DUMP) + 1,
+                               SUBCMD_DISCONNECTED, strlen(SUBCMD_DISCONNECTED)) == 0) {
+                               dhd_log_dump_trigger(dhdp, CMD_DISCONNECTED);
+                       } else {
+                               dhd_log_dump_trigger(dhdp, CMD_DEFAULT);
+                       }
+               } else {
+                       dhd_log_dump_trigger(dhdp, CMD_DEFAULT);
+               }
+       }
+#endif /* DHD_LOG_DUMP */
+#ifdef DHD_STATUS_LOGGING
+       else if (strnicmp(command, CMD_DUMP_STATUS_LOG, strlen(CMD_DUMP_STATUS_LOG)) == 0) {
+               dhd_statlog_dump_scr(wl_cfg80211_get_dhdp(net));
+       }
+       else if (strnicmp(command, CMD_QUERY_STATUS_LOG, strlen(CMD_QUERY_STATUS_LOG)) == 0) {
+               dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(net);
+               bytes_written = dhd_statlog_query(dhdp, command, priv_cmd.total_len);
+       }
+#endif /* DHD_STATUS_LOGGING */
+#if defined(CONFIG_TIZEN)
+       else if (strnicmp(command, CMD_POWERSAVEMODE_SET,
+                       strlen(CMD_POWERSAVEMODE_SET)) == 0) {
+               bytes_written = wl_android_set_powersave_mode(net, command,
+                       priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_POWERSAVEMODE_GET,
+                       strlen(CMD_POWERSAVEMODE_GET)) == 0) {
+               bytes_written = wl_android_get_powersave_mode(net, command,
+                       priv_cmd.total_len);
+       }
+#endif /* CONFIG_TIZEN */
+#ifdef SET_PCIE_IRQ_CPU_CORE
+       else if (strnicmp(command, CMD_PCIE_IRQ_CORE, strlen(CMD_PCIE_IRQ_CORE)) == 0) {
+               int affinity_cmd = *(command + strlen(CMD_PCIE_IRQ_CORE) + 1) - '0';
+               wl_android_set_irq_cpucore(net, affinity_cmd);
+       }
+#endif /* SET_PCIE_IRQ_CPU_CORE */
+#if defined(DHD_HANG_SEND_UP_TEST)
+       else if (strnicmp(command, CMD_MAKE_HANG, strlen(CMD_MAKE_HANG)) == 0) {
+               int skip = strlen(CMD_MAKE_HANG) + 1;
+               wl_android_make_hang_with_reason(net, (const char*)command+skip);
+       }
+#endif /* DHD_HANG_SEND_UP_TEST */
+#ifdef SUPPORT_LQCM
+       else if (strnicmp(command, CMD_SET_LQCM_ENABLE, strlen(CMD_SET_LQCM_ENABLE)) == 0) {
+               int lqcm_enable = *(command + strlen(CMD_SET_LQCM_ENABLE) + 1) - '0';
+               bytes_written = wl_android_lqcm_enable(net, lqcm_enable);
+       }
+       else if (strnicmp(command, CMD_GET_LQCM_REPORT,
+                       strlen(CMD_GET_LQCM_REPORT)) == 0) {
+               bytes_written = wl_android_get_lqcm_report(net, command,
+                       priv_cmd.total_len);
+       }
+#endif
+       else if (strnicmp(command, CMD_GET_SNR, strlen(CMD_GET_SNR)) == 0) {
+               bytes_written = wl_android_get_snr(net, command, priv_cmd.total_len);
+       }
+#ifdef WLADPS_PRIVATE_CMD
+       else if (strnicmp(command, CMD_SET_ADPS, strlen(CMD_SET_ADPS)) == 0) {
+               int skip = strlen(CMD_SET_ADPS) + 1;
+               bytes_written = wl_android_set_adps_mode(net, (const char*)command+skip);
+       }
+       else if (strnicmp(command, CMD_GET_ADPS, strlen(CMD_GET_ADPS)) == 0) {
+               bytes_written = wl_android_get_adps_mode(net, command, priv_cmd.total_len);
+       }
+#ifdef WLADPS_ENERGY_GAIN
+       else if (strnicmp(command, CMD_GET_GAIN_ADPS, strlen(CMD_GET_GAIN_ADPS)) == 0) {
+               bytes_written = wl_android_get_gain_adps(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_RESET_GAIN_ADPS, strlen(CMD_RESET_GAIN_ADPS)) == 0) {
+               bytes_written = wl_android_reset_gain_adps(net, command);
+       }
+#endif /* WLADPS_ENERGY_GAIN */
+#endif /* WLADPS_PRIVATE_CMD */
+#ifdef DHD_PKT_LOGGING
+       else if (strnicmp(command, CMD_PKTLOG_FILTER_ENABLE,
+               strlen(CMD_PKTLOG_FILTER_ENABLE)) == 0) {
+               bytes_written = wl_android_pktlog_filter_enable(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_PKTLOG_FILTER_DISABLE,
+               strlen(CMD_PKTLOG_FILTER_DISABLE)) == 0) {
+               bytes_written = wl_android_pktlog_filter_disable(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_PKTLOG_FILTER_PATTERN_ENABLE,
+               strlen(CMD_PKTLOG_FILTER_PATTERN_ENABLE)) == 0) {
+               bytes_written =
+                       wl_android_pktlog_filter_pattern_enable(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_PKTLOG_FILTER_PATTERN_DISABLE,
+               strlen(CMD_PKTLOG_FILTER_PATTERN_DISABLE)) == 0) {
+               bytes_written =
+                       wl_android_pktlog_filter_pattern_disable(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_PKTLOG_FILTER_ADD, strlen(CMD_PKTLOG_FILTER_ADD)) == 0) {
+               bytes_written = wl_android_pktlog_filter_add(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_PKTLOG_FILTER_DEL, strlen(CMD_PKTLOG_FILTER_DEL)) == 0) {
+               bytes_written = wl_android_pktlog_filter_del(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_PKTLOG_FILTER_INFO, strlen(CMD_PKTLOG_FILTER_INFO)) == 0) {
+               bytes_written = wl_android_pktlog_filter_info(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_PKTLOG_START, strlen(CMD_PKTLOG_START)) == 0) {
+               bytes_written = wl_android_pktlog_start(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_PKTLOG_STOP, strlen(CMD_PKTLOG_STOP)) == 0) {
+               bytes_written = wl_android_pktlog_stop(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_PKTLOG_FILTER_EXIST, strlen(CMD_PKTLOG_FILTER_EXIST)) == 0) {
+               bytes_written = wl_android_pktlog_filter_exist(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_PKTLOG_MINMIZE_ENABLE,
+               strlen(CMD_PKTLOG_MINMIZE_ENABLE)) == 0) {
+               bytes_written = wl_android_pktlog_minmize_enable(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_PKTLOG_MINMIZE_DISABLE,
+               strlen(CMD_PKTLOG_MINMIZE_DISABLE)) == 0) {
+               bytes_written = wl_android_pktlog_minmize_disable(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_PKTLOG_CHANGE_SIZE,
+               strlen(CMD_PKTLOG_CHANGE_SIZE)) == 0) {
+               bytes_written = wl_android_pktlog_change_size(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_PKTLOG_DEBUG_DUMP, strlen(CMD_PKTLOG_DEBUG_DUMP)) == 0) {
+               bytes_written = wl_android_pktlog_dbg_dump(net, command, priv_cmd.total_len);
+       }
+#endif /* DHD_PKT_LOGGING */
+#ifdef WL_CFG80211
+       else if (strnicmp(command, CMD_DEBUG_VERBOSE, strlen(CMD_DEBUG_VERBOSE)) == 0) {
+               int verbose_level = *(command + strlen(CMD_DEBUG_VERBOSE) + 1) - '0';
+               bytes_written = wl_cfg80211_set_dbg_verbose(net, verbose_level);
+       }
+#endif /* WL_CFG80211 */
+#ifdef DHD_EVENT_LOG_FILTER
+       else if (strnicmp(command, CMD_EWP_FILTER,
+               strlen(CMD_EWP_FILTER)) == 0) {
+               bytes_written = wl_android_ewp_filter(net, command, priv_cmd.total_len);
+       }
+#endif /* DHD_EVENT_LOG_FILTER */
+#ifdef WL_BCNRECV
+       else if (strnicmp(command, CMD_BEACON_RECV,
+               strlen(CMD_BEACON_RECV)) == 0) {
+               char *data = (command + strlen(CMD_BEACON_RECV) + 1);
+               bytes_written = wl_android_bcnrecv_config(net,
+                               data, priv_cmd.total_len);
+       }
+#endif /* WL_BCNRECV */
+#ifdef WL_MBO
+       else if (strnicmp(command, CMD_MBO, strlen(CMD_MBO)) == 0) {
+               bytes_written = wl_android_process_mbo_cmd(net, command,
+                       priv_cmd.total_len);
+       }
+#endif /* WL_MBO */
+#ifdef WL_CAC_TS
+       else if (strnicmp(command, CMD_CAC_TSPEC,
+               strlen(CMD_CAC_TSPEC)) == 0) {
+               char *data = (command + strlen(CMD_CAC_TSPEC) + 1);
+               bytes_written = wl_android_cac_ts_config(net,
+                               data, priv_cmd.total_len);
+       }
+#endif /* WL_CAC_TS */
+#ifdef WL_GET_CU
+       else if (strnicmp(command, CMD_GET_CHAN_UTIL,
+               strlen(CMD_GET_CHAN_UTIL)) == 0) {
+               bytes_written = wl_android_get_channel_util(net,
+                       command, priv_cmd.total_len);
+       }
+#endif /* WL_GET_CU */
+#ifdef RTT_GEOFENCE_INTERVAL
+#if defined(RTT_SUPPORT) && defined(WL_NAN)
+       else if (strnicmp(command, CMD_GEOFENCE_INTERVAL,
+                       strlen(CMD_GEOFENCE_INTERVAL)) == 0) {
+               (void)wl_android_set_rtt_geofence_interval(net, command);
+       }
+#endif /* RTT_SUPPORT && WL_NAN */
+#endif /* RTT_GEOFENCE_INTERVAL */
+#ifdef SUPPORT_SOFTAP_ELNA_BYPASS
+       else if (strnicmp(command, CMD_SET_SOFTAP_ELNA_BYPASS,
+                       strlen(CMD_SET_SOFTAP_ELNA_BYPASS)) == 0) {
+               bytes_written =
+                       wl_android_set_softap_elna_bypass(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_GET_SOFTAP_ELNA_BYPASS,
+                       strlen(CMD_GET_SOFTAP_ELNA_BYPASS)) == 0) {
+               bytes_written =
+                       wl_android_get_softap_elna_bypass(net, command, priv_cmd.total_len);
+       }
+#endif /* SUPPORT_SOFTAP_ELNA_BYPASS */
+#ifdef WL_NAN
+       else if (strnicmp(command, CMD_GET_NAN_STATUS,
+                       strlen(CMD_GET_NAN_STATUS)) == 0) {
+               bytes_written =
+                       wl_android_get_nan_status(net, command, priv_cmd.total_len);
+       }
+#endif /* WL_NAN */
+#if defined(SUPPORT_NAN_RANGING_TEST_BW)
+       else if (strnicmp(command, CMD_NAN_RANGING_SET_BW, strlen(CMD_NAN_RANGING_SET_BW)) == 0) {
+               int bw_cmd = *(command + strlen(CMD_NAN_RANGING_SET_BW) + 1) - '0';
+               bytes_written = wl_nan_ranging_bw(net, bw_cmd, command);
+       }
+#endif /* SUPPORT_NAN_RANGING_TEST_BW */
+       else if (strnicmp(command, CMD_GET_FACTORY_MAC, strlen(CMD_GET_FACTORY_MAC)) == 0) {
+               bytes_written = wl_android_get_factory_mac_addr(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_HAPD_SET_AX_MODE, strlen(CMD_HAPD_SET_AX_MODE)) == 0) {
+               int skip = strlen(CMD_HAPD_SET_AX_MODE) + 1;
+               bytes_written = wl_android_set_softap_ax_mode(net, command + skip);
+       }
+#ifdef SUPPORT_LATENCY_CRITICAL_DATA
+       else if (strnicmp(command, CMD_SET_LATENCY_CRITICAL_DATA,
+               strlen(CMD_SET_LATENCY_CRITICAL_DATA)) == 0) {
+               int enable = *(command + strlen(CMD_SET_LATENCY_CRITICAL_DATA) + 1) - '0';
+               bytes_written = wl_android_set_latency_crt_data(net, enable);
+       }
+       else if  (strnicmp(command, CMD_GET_LATENCY_CRITICAL_DATA,
+               strlen(CMD_GET_LATENCY_CRITICAL_DATA)) == 0) {
+               bytes_written = wl_android_get_latency_crt_data(net, command, priv_cmd.total_len);
+       }
+#endif /* SUPPORT_LATENCY_CRITICAL_DATA */
+       else if (wl_android_ext_priv_cmd(net, command, priv_cmd.total_len, &bytes_written) == 0) {
+       }
+       else {
+               ANDROID_ERROR(("Unknown PRIVATE command %s - ignored\n", command));
+               bytes_written = scnprintf(command, sizeof("FAIL"), "FAIL");
+       }
+
+       return bytes_written;
+}
+
+int wl_android_init(void)
+{
+       int ret = 0;
+
+#if defined(ENABLE_INSMOD_NO_FW_LOAD) || defined(BUS_POWER_RESTORE)
+       dhd_download_fw_on_driverload = FALSE;
+#endif /* ENABLE_INSMOD_NO_FW_LOAD */
+       if (!iface_name[0]) {
+               bzero(iface_name, IFNAMSIZ);
+               bcm_strncpy_s(iface_name, IFNAMSIZ, "wlan", IFNAMSIZ);
+       }
+
+#ifdef CUSTOMER_HW4_DEBUG
+       /* No Kernel Panic from ASSERT() on customer platform. */
+       g_assert_type = 1;
+#endif /* CUSTOMER_HW4_DEBUG */
+
+#ifdef WL_GENL
+       wl_genl_init();
+#endif
+#ifdef WL_RELMCAST
+       wl_netlink_init();
+#endif /* WL_RELMCAST */
+
+       return ret;
+}
+
+int wl_android_exit(void)
+{
+       int ret = 0;
+       struct io_cfg *cur, *q;
+
+#ifdef WL_GENL
+       wl_genl_deinit();
+#endif /* WL_GENL */
+#ifdef WL_RELMCAST
+       wl_netlink_deinit();
+#endif /* WL_RELMCAST */
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_entry_safe(cur, q, &miracast_resume_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               list_del(&cur->list);
+               kfree(cur);
+       }
+
+       return ret;
+}
+
+void wl_android_post_init(void)
+{
+
+#ifdef ENABLE_4335BT_WAR
+       bcm_bt_unlock(lock_cookie_wifi);
+       printk("%s: btlock released\n", __FUNCTION__);
+#endif /* ENABLE_4335BT_WAR */
+
+       if (!dhd_download_fw_on_driverload) {
+               g_wifi_on = FALSE;
+       }
+}
+
+#ifdef WL_GENL
+/* Generic Netlink Initializaiton */
+static int wl_genl_init(void)
+{
+       int ret;
+
+       ANDROID_INFO(("GEN Netlink Init\n\n"));
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 13, 0))
+       /* register new family */
+       ret = genl_register_family(&wl_genl_family);
+       if (ret != 0)
+               goto failure;
+
+       /* register functions (commands) of the new family */
+       ret = genl_register_ops(&wl_genl_family, &wl_genl_ops);
+       if (ret != 0) {
+               ANDROID_ERROR(("register ops failed: %i\n", ret));
+               genl_unregister_family(&wl_genl_family);
+               goto failure;
+       }
+
+       ret = genl_register_mc_group(&wl_genl_family, &wl_genl_mcast);
+#else
+       ret = genl_register_family_with_ops_groups(&wl_genl_family, wl_genl_ops, wl_genl_mcast);
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3, 13, 0) */
+       if (ret != 0) {
+               ANDROID_ERROR(("register mc_group failed: %i\n", ret));
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 13, 0))
+               genl_unregister_ops(&wl_genl_family, &wl_genl_ops);
+#endif
+               genl_unregister_family(&wl_genl_family);
+               goto failure;
+       }
+
+       return 0;
+
+failure:
+       ANDROID_ERROR(("Registering Netlink failed!!\n"));
+       return -1;
+}
+
+/* Generic netlink deinit */
+static int wl_genl_deinit(void)
+{
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 13, 0))
+       if (genl_unregister_ops(&wl_genl_family, &wl_genl_ops) < 0)
+               ANDROID_ERROR(("Unregister wl_genl_ops failed\n"));
+#endif
+       if (genl_unregister_family(&wl_genl_family) < 0)
+               ANDROID_ERROR(("Unregister wl_genl_ops failed\n"));
+
+       return 0;
+}
+
+s32 wl_event_to_bcm_event(u16 event_type)
+{
+       /* When you add any new event, please mention the
+        * version of BCM supplicant supporting it
+        */
+       u16 event = -1;
+
+       switch (event_type) {
+               case WLC_E_SERVICE_FOUND:
+                       event = BCM_E_SVC_FOUND;
+                       break;
+               case WLC_E_P2PO_ADD_DEVICE:
+                       event = BCM_E_DEV_FOUND;
+                       break;
+               case WLC_E_P2PO_DEL_DEVICE:
+                       event = BCM_E_DEV_LOST;
+                       break;
+       /* Above events are supported from BCM Supp ver 47 Onwards */
+#ifdef BT_WIFI_HANDOVER
+               case WLC_E_BT_WIFI_HANDOVER_REQ:
+                       event = BCM_E_DEV_BT_WIFI_HO_REQ;
+                       break;
+#endif /* BT_WIFI_HANDOVER */
+
+               default:
+                       ANDROID_ERROR(("Event not supported\n"));
+       }
+
+       return event;
+}
+
+s32
+wl_genl_send_msg(
+       struct net_device *ndev,
+       u32 event_type,
+       const u8 *buf,
+       u16 len,
+       u8 *subhdr,
+       u16 subhdr_len)
+{
+       int ret = 0;
+       struct sk_buff *skb;
+       void *msg;
+       u32 attr_type = 0;
+       bcm_event_hdr_t *hdr = NULL;
+       int mcast = 1; /* By default sent as mutlicast type */
+       int pid = 0;
+       u8 *ptr = NULL, *p = NULL;
+       u32 tot_len = sizeof(bcm_event_hdr_t) + subhdr_len + len;
+       u16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+
+       ANDROID_INFO(("Enter \n"));
+
+       /* Decide between STRING event and Data event */
+       if (event_type == 0)
+               attr_type = BCM_GENL_ATTR_STRING;
+       else
+               attr_type = BCM_GENL_ATTR_MSG;
+
+       skb = genlmsg_new(NLMSG_GOODSIZE, kflags);
+       if (skb == NULL) {
+               ret = -ENOMEM;
+               goto out;
+       }
+
+       msg = genlmsg_put(skb, 0, 0, &wl_genl_family, 0, BCM_GENL_CMD_MSG);
+       if (msg == NULL) {
+               ret = -ENOMEM;
+               goto out;
+       }
+
+       if (attr_type == BCM_GENL_ATTR_STRING) {
+               /* Add a BCM_GENL_MSG attribute. Since it is specified as a string.
+                * make sure it is null terminated
+                */
+               if (subhdr || subhdr_len) {
+                       ANDROID_ERROR(("No sub hdr support for the ATTR STRING type \n"));
+                       ret =  -EINVAL;
+                       goto out;
+               }
+
+               ret = nla_put_string(skb, BCM_GENL_ATTR_STRING, buf);
+               if (ret != 0) {
+                       ANDROID_ERROR(("nla_put_string failed\n"));
+                       goto out;
+               }
+       } else {
+               /* ATTR_MSG */
+
+               /* Create a single buffer for all */
+               p = ptr = (u8 *)MALLOCZ(cfg->osh, tot_len);
+               if (!ptr) {
+                       ret = -ENOMEM;
+                       ANDROID_ERROR(("ENOMEM!!\n"));
+                       goto out;
+               }
+
+               /* Include the bcm event header */
+               hdr = (bcm_event_hdr_t *)ptr;
+               hdr->event_type = wl_event_to_bcm_event(event_type);
+               hdr->len = len + subhdr_len;
+               ptr += sizeof(bcm_event_hdr_t);
+
+               /* Copy subhdr (if any) */
+               if (subhdr && subhdr_len) {
+                       memcpy(ptr, subhdr, subhdr_len);
+                       ptr += subhdr_len;
+               }
+
+               /* Copy the data */
+               if (buf && len) {
+                       memcpy(ptr, buf, len);
+               }
+
+               ret = nla_put(skb, BCM_GENL_ATTR_MSG, tot_len, p);
+               if (ret != 0) {
+                       ANDROID_ERROR(("nla_put_string failed\n"));
+                       goto out;
+               }
+       }
+
+       if (mcast) {
+               int err = 0;
+               /* finalize the message */
+               genlmsg_end(skb, msg);
+               /* NETLINK_CB(skb).dst_group = 1; */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 13, 0)
+               if ((err = genlmsg_multicast(skb, 0, wl_genl_mcast.id, GFP_ATOMIC)) < 0)
+#else
+               if ((err = genlmsg_multicast(&wl_genl_family, skb, 0, 0, GFP_ATOMIC)) < 0)
+#endif
+                       ANDROID_ERROR(("genlmsg_multicast for attr(%d) failed. Error:%d \n",
+                               attr_type, err));
+               else
+                       ANDROID_INFO(("Multicast msg sent successfully. attr_type:%d len:%d \n",
+                               attr_type, tot_len));
+       } else {
+               NETLINK_CB(skb).dst_group = 0; /* Not in multicast group */
+
+               /* finalize the message */
+               genlmsg_end(skb, msg);
+
+               /* send the message back */
+               if (genlmsg_unicast(&init_net, skb, pid) < 0)
+                       ANDROID_ERROR(("genlmsg_unicast failed\n"));
+       }
+
+out:
+       if (p) {
+               MFREE(cfg->osh, p, tot_len);
+       }
+       if (ret)
+               nlmsg_free(skb);
+
+       return ret;
+}
+
+static s32
+wl_genl_handle_msg(
+       struct sk_buff *skb,
+       struct genl_info *info)
+{
+       struct nlattr *na;
+       u8 *data = NULL;
+
+       ANDROID_INFO(("Enter \n"));
+
+       if (info == NULL) {
+               return -EINVAL;
+       }
+
+       na = info->attrs[BCM_GENL_ATTR_MSG];
+       if (!na) {
+               ANDROID_ERROR(("nlattribute NULL\n"));
+               return -EINVAL;
+       }
+
+       data = (char *)nla_data(na);
+       if (!data) {
+               ANDROID_ERROR(("Invalid data\n"));
+               return -EINVAL;
+       } else {
+               /* Handle the data */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0)) || defined(WL_COMPAT_WIRELESS)
+               ANDROID_INFO(("%s: Data received from pid (%d) \n", __func__,
+                       info->snd_pid));
+#else
+               ANDROID_INFO(("%s: Data received from pid (%d) \n", __func__,
+                       info->snd_portid));
+#endif /* (LINUX_VERSION < VERSION(3, 7, 0) || WL_COMPAT_WIRELESS */
+       }
+
+       return 0;
+}
+#endif /* WL_GENL */
+
+int wl_fatal_error(void * wl, int rc)
+{
+       return FALSE;
+}
+
+void
+wl_android_set_wifi_on_flag(bool enable)
+{
+       ANDROID_ERROR(("%s: %d\n", __FUNCTION__, enable));
+       g_wifi_on = enable;
+}
+
+#ifdef WL_STATIC_IF
+#include <dhd_linux_priv.h>
+struct net_device *
+wl_cfg80211_register_static_if(struct bcm_cfg80211 *cfg, u16 iftype, char *ifname)
+{
+       struct net_device *ndev;
+       struct wireless_dev *wdev = NULL;
+       int ifidx = WL_STATIC_IFIDX; /* Register ndev with a reserved ifidx */
+       u8 mac_addr[ETH_ALEN];
+       struct net_device *primary_ndev;
+#ifdef DHD_USE_RANDMAC
+       struct ether_addr ea_addr;
+#endif /* DHD_USE_RANDMAC */
+#ifdef CUSTOM_MULTI_MAC
+       char hw_ether[62];
+       dhd_pub_t *dhd = cfg->pub;
+#endif
+
+       ANDROID_INFO(("[STATIC_IF] Enter (%s) iftype:%d\n", ifname, iftype));
+
+       if (!cfg) {
+               ANDROID_ERROR(("cfg null\n"));
+               return NULL;
+       }
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+#ifdef DHD_USE_RANDMAC
+       wl_cfg80211_generate_mac_addr(&ea_addr);
+       (void)memcpy_s(mac_addr, ETH_ALEN, ea_addr.octet, ETH_ALEN);
+#else
+#if defined(CUSTOM_MULTI_MAC)
+       if (wifi_platform_get_mac_addr(dhd->info->adapter, hw_ether, "wlan1")) {
+#endif
+       /* Use primary mac with locally admin bit set */
+       (void)memcpy_s(mac_addr, ETH_ALEN, primary_ndev->dev_addr, ETH_ALEN);
+       mac_addr[0] |= 0x02;
+#if defined(CUSTOM_MULTI_MAC)
+       } else {
+               (void)memcpy_s(mac_addr, ETH_ALEN, hw_ether, ETH_ALEN);
+       }
+#endif
+#endif /* DHD_USE_RANDMAC */
+
+       ndev = wl_cfg80211_allocate_if(cfg, ifidx, ifname, mac_addr,
+               WL_BSSIDX_MAX, NULL);
+       if (unlikely(!ndev)) {
+               ANDROID_ERROR(("Failed to allocate static_if\n"));
+               goto fail;
+       }
+       wdev = (struct wireless_dev *)MALLOCZ(cfg->osh, sizeof(*wdev));
+       if (unlikely(!wdev)) {
+               ANDROID_ERROR(("Failed to allocate wdev for static_if\n"));
+               goto fail;
+       }
+
+       wdev->wiphy = cfg->wdev->wiphy;
+       wdev->iftype = iftype;
+
+       ndev->ieee80211_ptr = wdev;
+       SET_NETDEV_DEV(ndev, wiphy_dev(wdev->wiphy));
+       wdev->netdev = ndev;
+
+       if (wl_cfg80211_register_if(cfg, ifidx,
+               ndev, TRUE) != BCME_OK) {
+               ANDROID_ERROR(("ndev registration failed!\n"));
+               goto fail;
+       }
+
+       cfg->static_ndev = ndev;
+       cfg->static_ndev_state = NDEV_STATE_OS_IF_CREATED;
+       wl_cfg80211_update_iflist_info(cfg, ndev, ifidx, NULL, WL_BSSIDX_MAX,
+               ifname, NDEV_STATE_OS_IF_CREATED);
+       ANDROID_INFO(("Static I/F (%s) Registered\n", ndev->name));
+       return ndev;
+
+fail:
+       wl_cfg80211_remove_if(cfg, ifidx, ndev, false);
+       return NULL;
+}
+
+void
+wl_cfg80211_unregister_static_if(struct bcm_cfg80211 *cfg)
+{
+       ANDROID_INFO(("[STATIC_IF] Enter\n"));
+       if (!cfg || !cfg->static_ndev) {
+               ANDROID_ERROR(("invalid input\n"));
+               return;
+       }
+
+       /* wdev free will happen from notifier context */
+       /* free_netdev(cfg->static_ndev);
+       */
+       unregister_netdev(cfg->static_ndev);
+}
+
+s32
+wl_cfg80211_static_if_open(struct net_device *net)
+{
+       struct wireless_dev *wdev = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+       struct net_device *primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+       u16 iftype = net->ieee80211_ptr ? net->ieee80211_ptr->iftype : 0;
+       u16 wl_iftype, wl_mode;
+#ifdef CUSTOM_MULTI_MAC
+       char hw_ether[62];
+       dhd_pub_t *dhd = dhd_get_pub(net);
+#endif
+
+       ANDROID_INFO(("[STATIC_IF] dev_open ndev %p and wdev %p\n", net, net->ieee80211_ptr));
+       ASSERT(cfg->static_ndev == net);
+
+       if (cfg80211_to_wl_iftype(iftype, &wl_iftype, &wl_mode) <  0) {
+               return BCME_ERROR;
+       }
+       if (cfg->static_ndev_state != NDEV_STATE_FW_IF_CREATED) {
+#if defined(DHD_USE_RANDMAC) || defined(WL_SOFTAP_RAND)
+               wdev = wl_cfg80211_add_if(cfg, primary_ndev, wl_iftype, net->name, net->dev_addr);
+#else
+#if defined(CUSTOM_MULTI_MAC)
+               if (wifi_platform_get_mac_addr(dhd->info->adapter, hw_ether, net->name)) {
+#endif
+               wdev = wl_cfg80211_add_if(cfg, primary_ndev, wl_iftype, net->name, NULL);
+#if defined(CUSTOM_MULTI_MAC)
+               } else {
+                       wdev = wl_cfg80211_add_if(cfg, primary_ndev, wl_iftype, net->name, hw_ether);
+               }
+#endif
+#endif /* DHD_USE_RANDMAC || WL_SOFTAP_RAND */
+               if (!wdev) {
+                       ANDROID_ERROR(("[STATIC_IF] wdev is NULL, can't proceed"));
+                       return BCME_ERROR;
+               }
+       } else {
+               ANDROID_INFO(("Fw IF for static netdev already created\n"));
+       }
+
+       return BCME_OK;
+}
+
+s32
+wl_cfg80211_static_if_close(struct net_device *net)
+{
+       int ret = BCME_OK;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+       struct net_device *primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       if (cfg->static_ndev_state == NDEV_STATE_FW_IF_CREATED) {
+               if (mutex_is_locked(&cfg->if_sync) == TRUE) {
+                       ret = _wl_cfg80211_del_if(cfg, primary_ndev, net->ieee80211_ptr, net->name);
+               } else {
+                       ret = wl_cfg80211_del_if(cfg, primary_ndev, net->ieee80211_ptr, net->name);
+               }
+
+               if (unlikely(ret)) {
+                       ANDROID_ERROR(("Del iface failed for static_if %d\n", ret));
+               }
+       }
+
+       return ret;
+}
+struct net_device *
+wl_cfg80211_post_static_ifcreate(struct bcm_cfg80211 *cfg,
+       wl_if_event_info *event, u8 *addr, s32 iface_type)
+{
+       struct net_device *new_ndev = NULL;
+       struct wireless_dev *wdev = NULL;
+
+       ANDROID_INFO(("Updating static iface after Fw IF create \n"));
+       new_ndev = cfg->static_ndev;
+
+       if (new_ndev) {
+               wdev = new_ndev->ieee80211_ptr;
+               ASSERT(wdev);
+               wdev->iftype = iface_type;
+               (void)memcpy_s(new_ndev->dev_addr, ETH_ALEN, addr, ETH_ALEN);
+       }
+
+       cfg->static_ndev_state = NDEV_STATE_FW_IF_CREATED;
+       wl_cfg80211_update_iflist_info(cfg, new_ndev, event->ifidx, addr, event->bssidx,
+               event->name, NDEV_STATE_FW_IF_CREATED);
+       return new_ndev;
+}
+s32
+wl_cfg80211_post_static_ifdel(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       cfg->static_ndev_state = NDEV_STATE_FW_IF_DELETED;
+       wl_cfg80211_update_iflist_info(cfg, ndev, WL_STATIC_IFIDX, NULL,
+               WL_BSSIDX_MAX, NULL, NDEV_STATE_FW_IF_DELETED);
+       wl_cfg80211_clear_per_bss_ies(cfg, ndev->ieee80211_ptr);
+       wl_dealloc_netinfo_by_wdev(cfg, ndev->ieee80211_ptr);
+       return BCME_OK;
+}
+#endif /* WL_STATIC_IF */
+
+#ifdef WBTEXT
+static int
+wlc_wbtext_get_roam_prof(struct net_device *ndev, wl_roamprof_band_t *rp,
+       uint8 band, uint8 *roam_prof_ver, uint8 *roam_prof_size)
+{
+       int err = BCME_OK;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       u8 *ioctl_buf = NULL;
+
+       ioctl_buf = (u8 *)MALLOCZ(cfg->osh, WLC_IOCTL_MEDLEN);
+       if (unlikely(!ioctl_buf)) {
+               ANDROID_ERROR(("%s: failed to allocate memory\n", __func__));
+               err =  -ENOMEM;
+               goto exit;
+       }
+       rp->v1.band = band;
+       rp->v1.len = 0;
+       /* Getting roam profile from fw */
+       if ((err = wldev_iovar_getbuf(ndev, "roam_prof", rp, sizeof(*rp),
+               ioctl_buf, WLC_IOCTL_MEDLEN, NULL))) {
+               ANDROID_ERROR(("Getting roam_profile failed with err=%d \n", err));
+               goto exit;
+       }
+       memcpy_s(rp, sizeof(*rp), ioctl_buf, sizeof(*rp));
+       /* roam_prof version get */
+       if (rp->v1.ver > WL_ROAM_PROF_VER_3) {
+               ANDROID_ERROR(("bad version (=%d) in return data\n", rp->v1.ver));
+               err = BCME_VERSION;
+               goto exit;
+       }
+       switch (rp->v1.ver) {
+               case WL_ROAM_PROF_VER_0:
+               {
+                       *roam_prof_size = sizeof(wl_roam_prof_v1_t);
+                       *roam_prof_ver = WL_ROAM_PROF_VER_0;
+               }
+               break;
+               case WL_ROAM_PROF_VER_1:
+               {
+                       *roam_prof_size = sizeof(wl_roam_prof_v2_t);
+                       *roam_prof_ver = WL_ROAM_PROF_VER_1;
+               }
+               break;
+               case WL_ROAM_PROF_VER_2:
+               {
+                       *roam_prof_size = sizeof(wl_roam_prof_v3_t);
+                       *roam_prof_ver = WL_ROAM_PROF_VER_2;
+               }
+               break;
+               case WL_ROAM_PROF_VER_3:
+               {
+                       *roam_prof_size = sizeof(wl_roam_prof_v4_t);
+                       *roam_prof_ver = WL_ROAM_PROF_VER_3;
+               }
+               break;
+               default:
+                       ANDROID_ERROR(("bad version = %d \n", rp->v1.ver));
+                       err = BCME_VERSION;
+                       goto exit;
+       }
+       ANDROID_INFO(("roam prof ver %u size %u\n", *roam_prof_ver, *roam_prof_size));
+       if ((rp->v1.len % *roam_prof_size) != 0) {
+               ANDROID_ERROR(("bad length (=%d) in return data\n", rp->v1.len));
+               err = BCME_BADLEN;
+       }
+exit:
+       if (ioctl_buf) {
+               MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_MEDLEN);
+       }
+       return err;
+}
+
+s32
+wl_cfg80211_wbtext_set_default(struct net_device *ndev)
+{
+       char *commandp = NULL;
+       s32 ret = BCME_OK;
+       char *data;
+       u8 *ioctl_buf = NULL;
+       wl_roamprof_band_t rp;
+       uint8 bandidx = 0;
+       int wnmmask = 0;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+
+       ANDROID_INFO(("set wbtext to default\n"));
+
+       commandp = (char *)MALLOCZ(cfg->osh, WLC_IOCTL_SMLEN);
+       if (unlikely(!commandp)) {
+               ANDROID_ERROR(("%s: failed to allocate memory\n", __func__));
+               ret =  -ENOMEM;
+               goto exit;
+       }
+       ioctl_buf = (char *)MALLOCZ(cfg->osh, WLC_IOCTL_SMLEN);
+       if (unlikely(!ioctl_buf)) {
+               ANDROID_ERROR(("%s: failed to allocate memory\n", __func__));
+               ret =  -ENOMEM;
+               goto exit;
+       }
+
+       rp.v1.band = WLC_BAND_2G;
+       rp.v1.len = 0;
+       /* Getting roam profile from fw */
+       if ((ret = wldev_iovar_getbuf(ndev, "roam_prof", &rp, sizeof(rp),
+               ioctl_buf, WLC_IOCTL_SMLEN, NULL))) {
+               ANDROID_ERROR(("Getting roam_profile failed with err=%d \n", ret));
+               goto exit;
+       }
+       memcpy_s(&rp, sizeof(rp), ioctl_buf, sizeof(rp));
+       for (bandidx = 0; bandidx < MAXBANDS; bandidx++) {
+               switch (rp.v1.ver) {
+                       case WL_ROAM_PROF_VER_1:
+                       {
+                               memset_s(commandp, WLC_IOCTL_SMLEN, 0, WLC_IOCTL_SMLEN);
+                               if (bandidx == BAND_5G_INDEX) {
+                                       snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s",
+                                               CMD_WBTEXT_PROFILE_CONFIG,
+                                               DEFAULT_WBTEXT_PROFILE_A_V2);
+                                       data = (commandp + strlen(CMD_WBTEXT_PROFILE_CONFIG) + 1);
+                               } else {
+                                       snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s",
+                                               CMD_WBTEXT_PROFILE_CONFIG,
+                                               DEFAULT_WBTEXT_PROFILE_B_V2);
+                                       data = (commandp + strlen(CMD_WBTEXT_PROFILE_CONFIG) + 1);
+                               }
+                       }
+                       break;
+                       case WL_ROAM_PROF_VER_2:
+                       case WL_ROAM_PROF_VER_3:
+                       {
+                               memset_s(commandp, WLC_IOCTL_SMLEN, 0, WLC_IOCTL_SMLEN);
+                               if (bandidx == BAND_5G_INDEX) {
+                                       snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s",
+                                               CMD_WBTEXT_PROFILE_CONFIG,
+                                               DEFAULT_WBTEXT_PROFILE_A_V3);
+                                       data = (commandp + strlen(CMD_WBTEXT_PROFILE_CONFIG) + 1);
+                               } else {
+                                       snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s",
+                                               CMD_WBTEXT_PROFILE_CONFIG,
+                                               DEFAULT_WBTEXT_PROFILE_B_V3);
+                                       data = (commandp + strlen(CMD_WBTEXT_PROFILE_CONFIG) + 1);
+                               }
+                       }
+                       break;
+                       default:
+                               ANDROID_ERROR(("No Support for roam prof ver = %d \n", rp.v1.ver));
+                               ret = -EINVAL;
+                               goto exit;
+               }
+               /* set roam profile */
+               ret = wl_cfg80211_wbtext_config(ndev, data, commandp, WLC_IOCTL_SMLEN);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("%s: Failed to set roam_prof %s error = %d\n",
+                               __FUNCTION__, data, ret));
+                       goto exit;
+               }
+       }
+
+       /* wbtext code for backward compatibility. Newer firmwares set default value
+       * from fw init
+       */
+       /* set RSSI weight */
+       memset_s(commandp, WLC_IOCTL_SMLEN, 0, WLC_IOCTL_SMLEN);
+       snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s",
+               CMD_WBTEXT_WEIGHT_CONFIG, DEFAULT_WBTEXT_WEIGHT_RSSI_A);
+       data = (commandp + strlen(CMD_WBTEXT_WEIGHT_CONFIG) + 1);
+       ret = wl_cfg80211_wbtext_weight_config(ndev, data, commandp, WLC_IOCTL_SMLEN);
+       if (ret != BCME_OK) {
+               ANDROID_ERROR(("%s: Failed to set weight config %s error = %d\n",
+                       __FUNCTION__, data, ret));
+               goto exit;
+       }
+
+       memset_s(commandp, WLC_IOCTL_SMLEN, 0, WLC_IOCTL_SMLEN);
+       snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s",
+               CMD_WBTEXT_WEIGHT_CONFIG, DEFAULT_WBTEXT_WEIGHT_RSSI_B);
+       data = (commandp + strlen(CMD_WBTEXT_WEIGHT_CONFIG) + 1);
+       ret = wl_cfg80211_wbtext_weight_config(ndev, data, commandp, WLC_IOCTL_SMLEN);
+       if (ret != BCME_OK) {
+               ANDROID_ERROR(("%s: Failed to set weight config %s error = %d\n",
+                       __FUNCTION__, data, ret));
+               goto exit;
+       }
+
+       /* set CU weight */
+       memset_s(commandp, WLC_IOCTL_SMLEN, 0, WLC_IOCTL_SMLEN);
+       snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s",
+               CMD_WBTEXT_WEIGHT_CONFIG, DEFAULT_WBTEXT_WEIGHT_CU_A);
+       data = (commandp + strlen(CMD_WBTEXT_WEIGHT_CONFIG) + 1);
+       ret = wl_cfg80211_wbtext_weight_config(ndev, data, commandp, WLC_IOCTL_SMLEN);
+       if (ret != BCME_OK) {
+               ANDROID_ERROR(("%s: Failed to set weight config %s error = %d\n",
+                       __FUNCTION__, data, ret));
+               goto exit;
+       }
+
+       memset_s(commandp, WLC_IOCTL_SMLEN, 0, WLC_IOCTL_SMLEN);
+       snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s",
+               CMD_WBTEXT_WEIGHT_CONFIG, DEFAULT_WBTEXT_WEIGHT_CU_B);
+       data = (commandp + strlen(CMD_WBTEXT_WEIGHT_CONFIG) + 1);
+       ret = wl_cfg80211_wbtext_weight_config(ndev, data, commandp, WLC_IOCTL_SMLEN);
+       if (ret != BCME_OK) {
+               ANDROID_ERROR(("%s: Failed to set weight config %s error = %d\n",
+                       __FUNCTION__, data, ret));
+               goto exit;
+       }
+
+       ret = wldev_iovar_getint(ndev, "wnm", &wnmmask);
+       if (ret != BCME_OK) {
+               ANDROID_ERROR(("%s: Failed to get wnmmask error = %d\n", __func__, ret));
+               goto exit;
+       }
+       /* set ESTM DL weight. */
+       if (wnmmask & WL_WNM_ESTM) {
+               ANDROID_ERROR(("Setting ESTM wt\n"));
+               memset_s(commandp, WLC_IOCTL_SMLEN, 0, WLC_IOCTL_SMLEN);
+               snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s",
+                       CMD_WBTEXT_WEIGHT_CONFIG, DEFAULT_WBTEXT_WEIGHT_ESTM_DL_A);
+               data = (commandp + strlen(CMD_WBTEXT_WEIGHT_CONFIG) + 1);
+               ret = wl_cfg80211_wbtext_weight_config(ndev, data, commandp, WLC_IOCTL_SMLEN);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("%s: Failed to set weight config %s error = %d\n",
+                               __FUNCTION__, data, ret));
+                       goto exit;
+               }
+
+               memset_s(commandp, WLC_IOCTL_SMLEN, 0, WLC_IOCTL_SMLEN);
+               snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s",
+                       CMD_WBTEXT_WEIGHT_CONFIG, DEFAULT_WBTEXT_WEIGHT_ESTM_DL_B);
+               data = (commandp + strlen(CMD_WBTEXT_WEIGHT_CONFIG) + 1);
+               ret = wl_cfg80211_wbtext_weight_config(ndev, data, commandp, WLC_IOCTL_SMLEN);
+               if (ret != BCME_OK) {
+                       ANDROID_ERROR(("%s: Failed to set weight config %s error = %d\n",
+                               __FUNCTION__, data, ret));
+                       goto exit;
+               }
+       }
+
+       /* set RSSI table */
+       memset_s(commandp, WLC_IOCTL_SMLEN, 0, WLC_IOCTL_SMLEN);
+       snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s",
+               CMD_WBTEXT_TABLE_CONFIG, DEFAULT_WBTEXT_TABLE_RSSI_A);
+       data = (commandp + strlen(CMD_WBTEXT_TABLE_CONFIG) + 1);
+       ret = wl_cfg80211_wbtext_table_config(ndev, data, commandp, WLC_IOCTL_SMLEN);
+       if (ret != BCME_OK) {
+               ANDROID_ERROR(("%s: Failed to set RSSI table %s error = %d\n",
+                       __FUNCTION__, data, ret));
+               goto exit;
+       }
+
+       memset_s(commandp, WLC_IOCTL_SMLEN, 0, WLC_IOCTL_SMLEN);
+       snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s",
+               CMD_WBTEXT_TABLE_CONFIG, DEFAULT_WBTEXT_TABLE_RSSI_B);
+       data = (commandp + strlen(CMD_WBTEXT_TABLE_CONFIG) + 1);
+       ret = wl_cfg80211_wbtext_table_config(ndev, data, commandp, WLC_IOCTL_SMLEN);
+       if (ret != BCME_OK) {
+               ANDROID_ERROR(("%s: Failed to set RSSI table %s error = %d\n",
+                       __FUNCTION__, data, ret));
+               goto exit;
+       }
+
+       /* set CU table */
+       memset_s(commandp, WLC_IOCTL_SMLEN, 0, WLC_IOCTL_SMLEN);
+       snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s",
+               CMD_WBTEXT_TABLE_CONFIG, DEFAULT_WBTEXT_TABLE_CU_A);
+       data = (commandp + strlen(CMD_WBTEXT_TABLE_CONFIG) + 1);
+       ret = wl_cfg80211_wbtext_table_config(ndev, data, commandp, WLC_IOCTL_SMLEN);
+       if (ret != BCME_OK) {
+               ANDROID_ERROR(("%s: Failed to set CU table %s error = %d\n",
+                       __FUNCTION__, data, ret));
+               goto exit;
+       }
+
+       memset_s(commandp, WLC_IOCTL_SMLEN, 0, WLC_IOCTL_SMLEN);
+       snprintf(commandp, WLC_IOCTL_SMLEN, "%s %s",
+               CMD_WBTEXT_TABLE_CONFIG, DEFAULT_WBTEXT_TABLE_CU_B);
+       data = (commandp + strlen(CMD_WBTEXT_TABLE_CONFIG) + 1);
+       ret = wl_cfg80211_wbtext_table_config(ndev, data, commandp, WLC_IOCTL_SMLEN);
+       if (ret != BCME_OK) {
+               ANDROID_ERROR(("%s: Failed to set CU table %s error = %d\n",
+                       __FUNCTION__, data, ret));
+               goto exit;
+       }
+
+exit:
+       if (commandp) {
+               MFREE(cfg->osh, commandp, WLC_IOCTL_SMLEN);
+       }
+       if (ioctl_buf) {
+               MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_SMLEN);
+       }
+       return ret;
+}
+
+s32
+wl_cfg80211_wbtext_config(struct net_device *ndev, char *data, char *command, int total_len)
+{
+       uint i = 0;
+       long int rssi_lower, roam_trigger;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       wl_roamprof_band_t *rp = NULL;
+       int err = -EINVAL, bytes_written = 0;
+       size_t len = strlen(data);
+       int rp_len = 0;
+       u8 *ioctl_buf = NULL;
+       uint8 roam_prof_size = 0, roam_prof_ver = 0, fs_per = 0, prof_cnt = 0;
+
+       data[len] = '\0';
+       ioctl_buf = (u8 *)MALLOCZ(cfg->osh, WLC_IOCTL_MEDLEN);
+       if (unlikely(!ioctl_buf)) {
+               ANDROID_ERROR(("%s: failed to allocate memory\n", __func__));
+               err =  -ENOMEM;
+               goto exit;
+       }
+       rp = (wl_roamprof_band_t *)MALLOCZ(cfg->osh, sizeof(*rp));
+       if (unlikely(!rp)) {
+               ANDROID_ERROR(("%s: failed to allocate memory\n", __func__));
+               err =  -ENOMEM;
+               goto exit;
+       }
+       if (*data && (!strncmp(data, "b", 1))) {
+               rp->v1.band = WLC_BAND_2G;
+       } else if (*data && (!strncmp(data, "a", 1))) {
+               rp->v1.band = WLC_BAND_5G;
+       } else {
+               err = snprintf(command, total_len, "Missing band\n");
+               goto exit;
+       }
+       data++;
+       rp->v1.len = 0;
+       /* Getting roam profile from fw */
+       if ((err = wldev_iovar_getbuf(ndev, "roam_prof", rp, sizeof(*rp),
+               ioctl_buf, WLC_IOCTL_MEDLEN, NULL))) {
+               ANDROID_ERROR(("Getting roam_profile failed with err=%d \n", err));
+               goto exit;
+       }
+       memcpy_s(rp, sizeof(*rp), ioctl_buf, sizeof(*rp));
+       /* roam_prof version get */
+       if (rp->v1.ver > WL_ROAM_PROF_VER_3) {
+               ANDROID_ERROR(("bad version (=%d) in return data\n", rp->v1.ver));
+               err = -EINVAL;
+               goto exit;
+       }
+       switch (rp->v1.ver) {
+               case WL_ROAM_PROF_VER_0:
+               {
+                       roam_prof_size = sizeof(wl_roam_prof_v1_t);
+                       roam_prof_ver = WL_ROAM_PROF_VER_0;
+               }
+               break;
+               case WL_ROAM_PROF_VER_1:
+               {
+                       roam_prof_size = sizeof(wl_roam_prof_v2_t);
+                       roam_prof_ver = WL_ROAM_PROF_VER_1;
+               }
+               break;
+               case WL_ROAM_PROF_VER_2:
+               {
+                       roam_prof_size = sizeof(wl_roam_prof_v3_t);
+                       roam_prof_ver = WL_ROAM_PROF_VER_2;
+               }
+               break;
+               case WL_ROAM_PROF_VER_3:
+               {
+                       roam_prof_size = sizeof(wl_roam_prof_v4_t);
+                       roam_prof_ver = WL_ROAM_PROF_VER_3;
+               }
+               break;
+               default:
+                       ANDROID_ERROR(("bad version = %d \n", rp->v1.ver));
+                       goto exit;
+       }
+       ANDROID_INFO(("roam prof ver %u size %u\n", roam_prof_ver, roam_prof_size));
+       if ((rp->v1.len % roam_prof_size) != 0) {
+               ANDROID_ERROR(("bad length (=%d) in return data\n", rp->v1.len));
+               err = -EINVAL;
+               goto exit;
+       }
+       for (i = 0; i < WL_MAX_ROAM_PROF_BRACKETS; i++) {
+               /* printing contents of roam profile data from fw and exits
+                * if code hits any of one of the below condtion. If remaining
+                * length of buffer is less than roam profile size or
+                * if there is no valid entry.
+                */
+               if (((i * roam_prof_size) > rp->v1.len)) {
+                       break;
+               }
+               if (roam_prof_ver == WL_ROAM_PROF_VER_0) {
+                       fs_per = rp->v1.roam_prof[i].fullscan_period;
+               } else if (roam_prof_ver == WL_ROAM_PROF_VER_1) {
+                       fs_per = rp->v2.roam_prof[i].fullscan_period;
+               } else if (roam_prof_ver == WL_ROAM_PROF_VER_2) {
+                       fs_per = rp->v3.roam_prof[i].fullscan_period;
+               } else if (roam_prof_ver == WL_ROAM_PROF_VER_3) {
+                       fs_per = rp->v4.roam_prof[i].fullscan_period;
+               }
+               if (fs_per == 0) {
+                       break;
+               }
+               prof_cnt++;
+       }
+
+       if (!*data) {
+               for (i = 0; (i < prof_cnt) && (i < WL_MAX_ROAM_PROF_BRACKETS); i++) {
+                       if (roam_prof_ver == WL_ROAM_PROF_VER_1) {
+                               bytes_written += snprintf(command+bytes_written,
+                                       total_len - bytes_written,
+                                       "RSSI[%d,%d] CU(trigger:%d%%: duration:%ds)",
+                                       rp->v2.roam_prof[i].roam_trigger,
+                                       rp->v2.roam_prof[i].rssi_lower,
+                                       rp->v2.roam_prof[i].channel_usage,
+                                       rp->v2.roam_prof[i].cu_avg_calc_dur);
+                       } else if (roam_prof_ver == WL_ROAM_PROF_VER_2) {
+                               bytes_written += snprintf(command+bytes_written,
+                                       total_len - bytes_written,
+                                       "RSSI[%d,%d] CU(trigger:%d%%: duration:%ds)",
+                                       rp->v3.roam_prof[i].roam_trigger,
+                                       rp->v3.roam_prof[i].rssi_lower,
+                                       rp->v3.roam_prof[i].channel_usage,
+                                       rp->v3.roam_prof[i].cu_avg_calc_dur);
+                       } else if (roam_prof_ver == WL_ROAM_PROF_VER_3) {
+                               bytes_written += snprintf(command+bytes_written,
+                                       total_len - bytes_written,
+                                       "RSSI[%d,%d] CU(trigger:%d%%: duration:%ds)",
+                                       rp->v4.roam_prof[i].roam_trigger,
+                                       rp->v4.roam_prof[i].rssi_lower,
+                                       rp->v4.roam_prof[i].channel_usage,
+                                       rp->v4.roam_prof[i].cu_avg_calc_dur);
+                       }
+               }
+               bytes_written += snprintf(command+bytes_written, total_len - bytes_written, "\n");
+               err = bytes_written;
+               goto exit;
+       } else {
+               /* Do not set roam_prof from upper layer if fw doesn't have 2 rows */
+               if (prof_cnt != 2) {
+                       ANDROID_ERROR(("FW must have 2 rows to fill roam_prof\n"));
+                       err = -EINVAL;
+                       goto exit;
+               }
+               /* setting roam profile to fw */
+               data++;
+               for (i = 0; i < WL_MAX_ROAM_PROF_BRACKETS; i++) {
+                       roam_trigger = simple_strtol(data, &data, 10);
+                       if (roam_trigger >= 0) {
+                               ANDROID_ERROR(("roam trigger[%d] value must be negative\n", i));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       data++;
+                       rssi_lower = simple_strtol(data, &data, 10);
+                       if (rssi_lower >= 0) {
+                               ANDROID_ERROR(("rssi lower[%d] value must be negative\n", i));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       if (roam_prof_ver == WL_ROAM_PROF_VER_1) {
+                               rp->v2.roam_prof[i].roam_trigger = roam_trigger;
+                               rp->v2.roam_prof[i].rssi_lower = rssi_lower;
+                               data++;
+                               rp->v2.roam_prof[i].channel_usage = simple_strtol(data, &data, 10);
+                               data++;
+                               rp->v2.roam_prof[i].cu_avg_calc_dur =
+                                       simple_strtol(data, &data, 10);
+                       }
+                       if (roam_prof_ver == WL_ROAM_PROF_VER_2) {
+                               rp->v3.roam_prof[i].roam_trigger = roam_trigger;
+                               rp->v3.roam_prof[i].rssi_lower = rssi_lower;
+                               data++;
+                               rp->v3.roam_prof[i].channel_usage = simple_strtol(data, &data, 10);
+                               data++;
+                               rp->v3.roam_prof[i].cu_avg_calc_dur =
+                                       simple_strtol(data, &data, 10);
+                       }
+                       if (roam_prof_ver == WL_ROAM_PROF_VER_3) {
+                               rp->v4.roam_prof[i].roam_trigger = roam_trigger;
+                               rp->v4.roam_prof[i].rssi_lower = rssi_lower;
+                               data++;
+                               rp->v4.roam_prof[i].channel_usage = simple_strtol(data, &data, 10);
+                               data++;
+                               rp->v4.roam_prof[i].cu_avg_calc_dur =
+                                       simple_strtol(data, &data, 10);
+                       }
+
+                       rp_len += roam_prof_size;
+
+                       if (*data == '\0') {
+                               break;
+                       }
+                       data++;
+               }
+               if (i != 1) {
+                       ANDROID_ERROR(("Only two roam_prof rows supported.\n"));
+                       err = -EINVAL;
+                       goto exit;
+               }
+               rp->v1.len = rp_len;
+               if ((err = wldev_iovar_setbuf(ndev, "roam_prof", rp,
+                               sizeof(*rp), cfg->ioctl_buf, WLC_IOCTL_MEDLEN,
+                               &cfg->ioctl_buf_sync)) < 0) {
+                       ANDROID_ERROR(("seting roam_profile failed with err %d\n", err));
+               }
+       }
+exit:
+       if (rp) {
+               MFREE(cfg->osh, rp, sizeof(*rp));
+       }
+       if (ioctl_buf) {
+               MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_MEDLEN);
+       }
+       return err;
+}
+
+int wl_cfg80211_wbtext_weight_config(struct net_device *ndev, char *data,
+               char *command, int total_len)
+{
+       int bytes_written = 0, err = -EINVAL, argc = 0;
+       char rssi[BUFSZN], band[BUFSZN], weight[BUFSZN];
+       char *endptr = NULL;
+       wnm_bss_select_weight_cfg_t *bwcfg;
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+
+       bwcfg = (wnm_bss_select_weight_cfg_t *)MALLOCZ(cfg->osh, sizeof(*bwcfg));
+       if (unlikely(!bwcfg)) {
+               ANDROID_ERROR(("%s: failed to allocate memory\n", __func__));
+               err = -ENOMEM;
+               goto exit;
+       }
+       bwcfg->version =  WNM_BSSLOAD_MONITOR_VERSION;
+       bwcfg->type = 0;
+       bwcfg->weight = 0;
+
+       argc = sscanf(data, "%"S(BUFSZ)"s %"S(BUFSZ)"s %"S(BUFSZ)"s", rssi, band, weight);
+
+       if (!strcasecmp(rssi, "rssi"))
+               bwcfg->type = WNM_BSS_SELECT_TYPE_RSSI;
+       else if (!strcasecmp(rssi, "cu"))
+               bwcfg->type = WNM_BSS_SELECT_TYPE_CU;
+       else if (!strcasecmp(rssi, "estm_dl"))
+               bwcfg->type = WNM_BSS_SELECT_TYPE_ESTM_DL;
+       else {
+               /* Usage DRIVER WBTEXT_WEIGHT_CONFIG <rssi/cu/estm_dl> <band> <weight> */
+               ANDROID_ERROR(("%s: Command usage error\n", __func__));
+               goto exit;
+       }
+
+       if (BCME_BADBAND == wl_android_bandstr_to_fwband(band, &bwcfg->band)) {
+               ANDROID_ERROR(("%s: Command usage error\n", __func__));
+               goto exit;
+       }
+
+       if (argc == 2) {
+               /* If there is no data after band, getting wnm_bss_select_weight from fw */
+               if (bwcfg->band == WLC_BAND_ALL) {
+                       ANDROID_ERROR(("band option \"all\" is for set only, not get\n"));
+                       goto exit;
+               }
+               if ((err = wldev_iovar_getbuf(ndev, "wnm_bss_select_weight", bwcfg,
+                               sizeof(*bwcfg),
+                               ioctl_buf, sizeof(ioctl_buf), NULL))) {
+                       ANDROID_ERROR(("Getting wnm_bss_select_weight failed with err=%d \n", err));
+                       goto exit;
+               }
+               memcpy(bwcfg, ioctl_buf, sizeof(*bwcfg));
+               bytes_written = snprintf(command, total_len, "%s %s weight = %d\n",
+                       (bwcfg->type == WNM_BSS_SELECT_TYPE_RSSI) ? "RSSI" :
+                       (bwcfg->type == WNM_BSS_SELECT_TYPE_CU) ? "CU": "ESTM_DL",
+                       wl_android_get_band_str(bwcfg->band), bwcfg->weight);
+               err = bytes_written;
+               goto exit;
+       } else {
+               /* if weight is non integer returns command usage error */
+               bwcfg->weight = simple_strtol(weight, &endptr, 0);
+               if (*endptr != '\0') {
+                       ANDROID_ERROR(("%s: Command usage error", __func__));
+                       goto exit;
+               }
+               /* setting weight for iovar wnm_bss_select_weight to fw */
+               if ((err = wldev_iovar_setbuf(ndev, "wnm_bss_select_weight", bwcfg,
+                               sizeof(*bwcfg),
+                               ioctl_buf, sizeof(ioctl_buf), NULL))) {
+                       ANDROID_ERROR(("setting wnm_bss_select_weight failed with err=%d\n", err));
+               }
+       }
+exit:
+       if (bwcfg) {
+               MFREE(cfg->osh, bwcfg, sizeof(*bwcfg));
+       }
+       return err;
+}
+
+/* WBTEXT_TUPLE_MIN_LEN_CHECK :strlen(low)+" "+strlen(high)+" "+strlen(factor) */
+#define WBTEXT_TUPLE_MIN_LEN_CHECK 5
+
+int wl_cfg80211_wbtext_table_config(struct net_device *ndev, char *data,
+       char *command, int total_len)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       int bytes_written = 0, err = -EINVAL;
+       char rssi[BUFSZN], band[BUFSZN];
+       int btcfg_len = 0, i = 0, parsed_len = 0;
+       wnm_bss_select_factor_cfg_t *btcfg;
+       size_t slen = strlen(data);
+       char *start_addr = NULL;
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+
+       data[slen] = '\0';
+       btcfg = (wnm_bss_select_factor_cfg_t *)MALLOCZ(cfg->osh,
+               (sizeof(*btcfg) + sizeof(*btcfg) * WL_FACTOR_TABLE_MAX_LIMIT));
+       if (unlikely(!btcfg)) {
+               ANDROID_ERROR(("%s: failed to allocate memory\n", __func__));
+               err = -ENOMEM;
+               goto exit;
+       }
+
+       btcfg->version = WNM_BSS_SELECT_FACTOR_VERSION;
+       btcfg->band = WLC_BAND_AUTO;
+       btcfg->type = 0;
+       btcfg->count = 0;
+
+       sscanf(data, "%"S(BUFSZ)"s %"S(BUFSZ)"s", rssi, band);
+
+       if (!strcasecmp(rssi, "rssi")) {
+               btcfg->type = WNM_BSS_SELECT_TYPE_RSSI;
+       }
+       else if (!strcasecmp(rssi, "cu")) {
+               btcfg->type = WNM_BSS_SELECT_TYPE_CU;
+       }
+       else {
+               ANDROID_ERROR(("%s: Command usage error\n", __func__));
+               goto exit;
+       }
+
+       if (BCME_BADBAND == wl_android_bandstr_to_fwband(band, &btcfg->band)) {
+               ANDROID_ERROR(("%s: Command usage, Wrong band\n", __func__));
+               goto exit;
+       }
+
+       if ((slen - 1) == (strlen(rssi) + strlen(band))) {
+               /* Getting factor table using iovar 'wnm_bss_select_table' from fw */
+               if ((err = wldev_iovar_getbuf(ndev, "wnm_bss_select_table", btcfg,
+                               sizeof(*btcfg),
+                               ioctl_buf, sizeof(ioctl_buf), NULL))) {
+                       ANDROID_ERROR(("Getting wnm_bss_select_table failed with err=%d \n", err));
+                       goto exit;
+               }
+               memcpy(btcfg, ioctl_buf, sizeof(*btcfg));
+               memcpy(btcfg, ioctl_buf, (btcfg->count+1) * sizeof(*btcfg));
+
+               bytes_written += snprintf(command + bytes_written, total_len - bytes_written,
+                                       "No of entries in table: %d\n", btcfg->count);
+               bytes_written += snprintf(command + bytes_written, total_len - bytes_written,
+                               "%s factor table\n",
+                               (btcfg->type == WNM_BSS_SELECT_TYPE_RSSI) ? "RSSI" : "CU");
+               bytes_written += snprintf(command + bytes_written, total_len - bytes_written,
+                                       "low\thigh\tfactor\n");
+               for (i = 0; i <= btcfg->count-1; i++) {
+                       bytes_written += snprintf(command + bytes_written,
+                               total_len - bytes_written, "%d\t%d\t%d\n", btcfg->params[i].low,
+                               btcfg->params[i].high, btcfg->params[i].factor);
+               }
+               err = bytes_written;
+               goto exit;
+       } else {
+               uint16 len = (sizeof(wnm_bss_select_factor_params_t) * WL_FACTOR_TABLE_MAX_LIMIT);
+               memset_s(btcfg->params, len, 0, len);
+               data += (strlen(rssi) + strlen(band) + 2);
+               start_addr = data;
+               slen = slen - (strlen(rssi) + strlen(band) + 2);
+               for (i = 0; i < WL_FACTOR_TABLE_MAX_LIMIT; i++) {
+                       if (parsed_len + WBTEXT_TUPLE_MIN_LEN_CHECK <= slen) {
+                               btcfg->params[i].low = simple_strtol(data, &data, 10);
+                               data++;
+                               btcfg->params[i].high = simple_strtol(data, &data, 10);
+                               data++;
+                               btcfg->params[i].factor = simple_strtol(data, &data, 10);
+                               btcfg->count++;
+                               if (*data == '\0') {
+                                       break;
+                               }
+                               data++;
+                               parsed_len = data - start_addr;
+                       } else {
+                               ANDROID_ERROR(("%s:Command usage:less no of args\n", __func__));
+                               goto exit;
+                       }
+               }
+               btcfg_len = sizeof(*btcfg) + ((btcfg->count) * sizeof(*btcfg));
+               if ((err = wldev_iovar_setbuf(ndev, "wnm_bss_select_table", btcfg, btcfg_len,
+                               cfg->ioctl_buf, WLC_IOCTL_MEDLEN, &cfg->ioctl_buf_sync)) < 0) {
+                       ANDROID_ERROR(("seting wnm_bss_select_table failed with err %d\n", err));
+                       goto exit;
+               }
+       }
+exit:
+       if (btcfg) {
+               MFREE(cfg->osh, btcfg,
+                       (sizeof(*btcfg) + sizeof(*btcfg) * WL_FACTOR_TABLE_MAX_LIMIT));
+       }
+       return err;
+}
+
+s32
+wl_cfg80211_wbtext_delta_config(struct net_device *ndev, char *data, char *command, int total_len)
+{
+       uint i = 0;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       int err = -EINVAL, bytes_written = 0, argc = 0, val, len = 0;
+       char delta[BUFSZN], band[BUFSZN], *endptr = NULL;
+       wl_roamprof_band_t *rp = NULL;
+       uint8 band_val = 0, roam_prof_size = 0, roam_prof_ver = 0;
+
+       rp = (wl_roamprof_band_t *)MALLOCZ(cfg->osh, sizeof(*rp));
+       if (unlikely(!rp)) {
+               ANDROID_ERROR(("%s: failed to allocate memory\n", __func__));
+               err = -ENOMEM;
+               goto exit;
+       }
+
+       argc = sscanf(data, "%"S(BUFSZ)"s %"S(BUFSZ)"s", band, delta);
+       if (BCME_BADBAND == wl_android_bandstr_to_fwband(band, &band_val)) {
+               ANDROID_ERROR(("%s: Missing band\n", __func__));
+               goto exit;
+       }
+       if ((err = wlc_wbtext_get_roam_prof(ndev, rp, band_val, &roam_prof_ver,
+               &roam_prof_size))) {
+               ANDROID_ERROR(("Getting roam_profile failed with err=%d \n", err));
+               err = -EINVAL;
+               goto exit;
+       }
+       if (argc == 2) {
+               /* if delta is non integer returns command usage error */
+               val = simple_strtol(delta, &endptr, 0);
+               if (*endptr != '\0') {
+                       ANDROID_ERROR(("%s: Command usage error", __func__));
+                       goto exit;
+               }
+               for (i = 0; i < WL_MAX_ROAM_PROF_BRACKETS; i++) {
+               /*
+                * Checking contents of roam profile data from fw and exits
+                * if code hits below condtion. If remaining length of buffer is
+                * less than roam profile size or if there is no valid entry.
+                */
+                       if (len >= rp->v1.len) {
+                               break;
+                       }
+                       if (roam_prof_ver == WL_ROAM_PROF_VER_1) {
+                               if (rp->v2.roam_prof[i].fullscan_period == 0) {
+                                       break;
+                               }
+                               if (rp->v2.roam_prof[i].channel_usage != 0) {
+                                       rp->v2.roam_prof[i].roam_delta = val;
+                               }
+                       } else if (roam_prof_ver == WL_ROAM_PROF_VER_2) {
+                               if (rp->v3.roam_prof[i].fullscan_period == 0) {
+                                       break;
+                               }
+                               if (rp->v3.roam_prof[i].channel_usage != 0) {
+                                       rp->v3.roam_prof[i].roam_delta = val;
+                               }
+                       } else if (roam_prof_ver == WL_ROAM_PROF_VER_3) {
+                               if (rp->v4.roam_prof[i].fullscan_period == 0) {
+                                       break;
+                               }
+                               if (rp->v4.roam_prof[i].channel_usage != 0) {
+                                       rp->v4.roam_prof[i].roam_delta = val;
+                               }
+                       }
+                       len += roam_prof_size;
+               }
+       }
+       else {
+               if (rp->v2.roam_prof[0].channel_usage != 0) {
+                       bytes_written = snprintf(command, total_len,
+                               "%s Delta %d\n", wl_android_get_band_str(rp->v1.band),
+                               rp->v2.roam_prof[0].roam_delta);
+               }
+               err = bytes_written;
+               goto exit;
+       }
+       rp->v1.len = len;
+       if ((err = wldev_iovar_setbuf(ndev, "roam_prof", rp,
+                       sizeof(*rp), cfg->ioctl_buf, WLC_IOCTL_MEDLEN,
+                       &cfg->ioctl_buf_sync)) < 0) {
+               ANDROID_ERROR(("seting roam_profile failed with err %d\n", err));
+       }
+exit :
+       if (rp) {
+               MFREE(cfg->osh, rp, sizeof(*rp));
+       }
+       return err;
+}
+#endif /* WBTEXT */
diff --git a/bcmdhd.101.10.240.x/wl_android.h b/bcmdhd.101.10.240.x/wl_android.h
new file mode 100644 (file)
index 0000000..b9592df
--- /dev/null
@@ -0,0 +1,396 @@
+/*
+ * Linux cfg80211 driver - Android related functions
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _wl_android_
+#define _wl_android_
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <wldev_common.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+
+/* If any feature uses the Generic Netlink Interface, put it here to enable WL_GENL
+ * automatically
+ */
+#if defined(BT_WIFI_HANDOVER)
+#define WL_GENL
+#endif
+
+#ifdef WL_GENL
+#include <net/genetlink.h>
+#endif
+
+typedef struct _android_wifi_priv_cmd {
+    char *buf;
+    int used_len;
+    int total_len;
+} android_wifi_priv_cmd;
+
+#ifdef CONFIG_COMPAT
+typedef struct _compat_android_wifi_priv_cmd {
+    compat_caddr_t buf;
+    int used_len;
+    int total_len;
+} compat_android_wifi_priv_cmd;
+#endif /* CONFIG_COMPAT */
+
+/**
+ * Android platform dependent functions, feel free to add Android specific functions here
+ * (save the macros in dhd). Please do NOT declare functions that are NOT exposed to dhd
+ * or cfg, define them as static in wl_android.c
+ */
+
+/* message levels */
+#define ANDROID_ERROR_LEVEL    (1 << 0)
+#define ANDROID_TRACE_LEVEL    (1 << 1)
+#define ANDROID_INFO_LEVEL     (1 << 2)
+#define ANDROID_SCAN_LEVEL     (1 << 3)
+#define ANDROID_DBG_LEVEL      (1 << 4)
+#define ANDROID_MSG_LEVEL      (1 << 0)
+
+#define WL_MSG(name, arg1, args...) \
+       do { \
+               if (android_msg_level & ANDROID_MSG_LEVEL) { \
+                       printk(KERN_ERR "[dhd-%s] %s : " arg1, name, __func__, ## args); \
+               } \
+       } while (0)
+
+#define WL_MSG_PRINT_RATE_LIMIT_PERIOD 1000000000u /* 1s in units of ns */
+#define WL_MSG_RLMT(name, cmp, size, arg1, args...) \
+do {   \
+       if (android_msg_level & ANDROID_MSG_LEVEL) {    \
+               static uint64 __err_ts = 0; \
+               static uint32 __err_cnt = 0; \
+               uint64 __cur_ts = 0; \
+               static uint8 static_tmp[size]; \
+               __cur_ts = local_clock(); \
+               if (__err_ts == 0 || (__cur_ts > __err_ts && \
+               (__cur_ts - __err_ts > WL_MSG_PRINT_RATE_LIMIT_PERIOD)) || \
+               memcmp(&static_tmp, cmp, size)) { \
+                       __err_ts = __cur_ts; \
+                       memcpy(static_tmp, cmp, size); \
+                       printk(KERN_ERR "[dhd-%s] %s : [%u times] " arg1, \
+                               name, __func__, __err_cnt, ## args); \
+                       __err_cnt = 0; \
+               } else { \
+                       ++__err_cnt; \
+               } \
+       }       \
+} while (0)
+
+/**
+ * wl_android_init will be called from module init function (dhd_module_init now), similarly
+ * wl_android_exit will be called from module exit function (dhd_module_cleanup now)
+ */
+int wl_android_init(void);
+int wl_android_exit(void);
+void wl_android_post_init(void);
+void wl_android_set_wifi_on_flag(bool enable);
+#if defined(WLAN_ACCEL_BOOT)
+int wl_android_wifi_accel_on(struct net_device *dev, bool force_reg_on);
+int wl_android_wifi_accel_off(struct net_device *dev, bool force_reg_on);
+#endif /* WLAN_ACCEL_BOOT */
+int wl_android_wifi_on(struct net_device *dev);
+int wl_android_wifi_off(struct net_device *dev, bool on_failure);
+int wl_android_priv_cmd(struct net_device *net, struct ifreq *ifr);
+int wl_handle_private_cmd(struct net_device *net, char *command, u32 cmd_len);
+#ifdef WL_EXT_IAPSTA
+int wl_ext_iapsta_attach_netdev(struct net_device *net, int ifidx, uint8 bssidx);
+int wl_ext_iapsta_attach_name(struct net_device *net, int ifidx);
+int wl_ext_iapsta_dettach_netdev(struct net_device *net, int ifidx);
+int wl_ext_iapsta_update_net_device(struct net_device *net, int ifidx);
+void wl_ext_add_remove_pm_enable_work(struct net_device *dev, bool add);
+#ifdef PROPTX_MAXCOUNT
+void wl_ext_update_wlfc_maxcount(struct dhd_pub *dhd);
+int wl_ext_get_wlfc_maxcount(struct dhd_pub *dhd, int ifidx);
+#endif /* PROPTX_MAXCOUNT */
+int wl_ext_iapsta_alive_preinit(struct net_device *dev);
+int wl_ext_iapsta_alive_postinit(struct net_device *dev);
+int wl_ext_iapsta_attach(dhd_pub_t *pub);
+void wl_ext_iapsta_dettach(dhd_pub_t *pub);
+#ifdef WL_CFG80211
+u32 wl_ext_iapsta_update_channel(dhd_pub_t *dhd, struct net_device *dev, u32 channel);
+void wl_ext_iapsta_update_iftype(struct net_device *net, int ifidx, int wl_iftype);
+bool wl_ext_iapsta_iftype_enabled(struct net_device *net, int wl_iftype);
+void wl_ext_iapsta_ifadding(struct net_device *net, int ifidx);
+bool wl_ext_iapsta_mesh_creating(struct net_device *net);
+int wl_android_set_spect(struct net_device *dev, int spect);
+#endif
+extern int op_mode;
+#endif
+typedef struct bcol_gtk_para {
+       int enable;
+       int ptk_len;
+       char ptk[64];
+       char replay[8];
+} bcol_gtk_para_t;
+#define ACS_FW_BIT             (1<<0)
+#define ACS_DRV_BIT            (1<<1)
+#if defined(WL_EXT_IAPSTA) || defined(USE_IW)
+typedef enum WL_EVENT_PRIO {
+       PRIO_EVENT_IAPSTA,
+       PRIO_EVENT_ESCAN,
+       PRIO_EVENT_WEXT
+}wl_event_prio_t;
+s32 wl_ext_event_attach(struct net_device *dev, dhd_pub_t *dhdp);
+void wl_ext_event_dettach(dhd_pub_t *dhdp);
+int wl_ext_event_attach_netdev(struct net_device *net, int ifidx, uint8 bssidx);
+int wl_ext_event_dettach_netdev(struct net_device *net, int ifidx);
+int wl_ext_event_register(struct net_device *dev, dhd_pub_t *dhd,
+       uint32 event, void *cb_func, void *data, wl_event_prio_t prio);
+void wl_ext_event_deregister(struct net_device *dev, dhd_pub_t *dhd,
+       uint32 event, void *cb_func);
+void wl_ext_event_send(void *params, const wl_event_msg_t * e, void *data);
+#endif
+int wl_ext_autochannel(struct net_device *dev, uint acs, uint32 band);
+int wl_android_ext_priv_cmd(struct net_device *net, char *command, int total_len,
+       int *bytes_written);
+void wl_ext_get_sec(struct net_device *dev, int ifmode, char *sec, int total_len);
+bool wl_ext_check_scan(struct net_device *dev, dhd_pub_t *dhdp);
+#if defined(WL_CFG80211) || defined(WL_ESCAN)
+void wl_ext_user_sync(struct dhd_pub *dhd, int ifidx, bool lock);
+bool wl_ext_event_complete(struct dhd_pub *dhd, int ifidx);
+#endif
+#if defined(WL_CFG80211)
+void wl_ext_bss_iovar_war(struct net_device *dev, s32 *val);
+#endif
+enum wl_ext_status {
+       WL_EXT_STATUS_DISCONNECTING = 0,
+       WL_EXT_STATUS_DISCONNECTED,
+       WL_EXT_STATUS_SCAN,
+       WL_EXT_STATUS_CONNECTING,
+       WL_EXT_STATUS_CONNECTED,
+       WL_EXT_STATUS_ADD_KEY,
+       WL_EXT_STATUS_AP_ENABLED,
+       WL_EXT_STATUS_DELETE_STA,
+       WL_EXT_STATUS_STA_DISCONNECTED,
+       WL_EXT_STATUS_STA_CONNECTED,
+       WL_EXT_STATUS_AP_DISABLED
+};
+typedef struct wl_conn_info {
+       uint8 bssidx;
+       wlc_ssid_t ssid;
+       struct ether_addr bssid;
+       uint16 channel;
+} wl_conn_info_t;
+#if defined(WL_WIRELESS_EXT)
+s32 wl_ext_connect(struct net_device *dev, wl_conn_info_t *conn_info);
+#endif /* defined(WL_WIRELESS_EXT) */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0))
+#define strnicmp(str1, str2, len) strncasecmp((str1), (str2), (len))
+#endif
+
+#ifdef WL_GENL
+typedef struct bcm_event_hdr {
+       u16 event_type;
+       u16 len;
+} bcm_event_hdr_t;
+
+/* attributes (variables): the index in this enum is used as a reference for the type,
+ *             userspace application has to indicate the corresponding type
+ *             the policy is used for security considerations
+ */
+enum {
+       BCM_GENL_ATTR_UNSPEC,
+       BCM_GENL_ATTR_STRING,
+       BCM_GENL_ATTR_MSG,
+       __BCM_GENL_ATTR_MAX
+};
+#define BCM_GENL_ATTR_MAX (__BCM_GENL_ATTR_MAX - 1)
+
+/* commands: enumeration of all commands (functions),
+ * used by userspace application to identify command to be ececuted
+ */
+enum {
+       BCM_GENL_CMD_UNSPEC,
+       BCM_GENL_CMD_MSG,
+       __BCM_GENL_CMD_MAX
+};
+#define BCM_GENL_CMD_MAX (__BCM_GENL_CMD_MAX - 1)
+
+/* Enum values used by the BCM supplicant to identify the events */
+enum {
+       BCM_E_UNSPEC,
+       BCM_E_SVC_FOUND,
+       BCM_E_DEV_FOUND,
+       BCM_E_DEV_LOST,
+#ifdef BT_WIFI_HANDOVER
+       BCM_E_DEV_BT_WIFI_HO_REQ,
+#endif
+       BCM_E_MAX
+};
+
+s32 wl_genl_send_msg(struct net_device *ndev, u32 event_type,
+       const u8 *string, u16 len, u8 *hdr, u16 hdrlen);
+#endif /* WL_GENL */
+s32 wl_netlink_send_msg(int pid, int type, int seq, const void *data, size_t size);
+
+/* hostap mac mode */
+#define MACLIST_MODE_DISABLED   0
+#define MACLIST_MODE_DENY       1
+#define MACLIST_MODE_ALLOW      2
+
+/* max number of assoc list */
+#define MAX_NUM_OF_ASSOCLIST    64
+
+/* Bandwidth */
+#define WL_CH_BANDWIDTH_20MHZ 20
+#define WL_CH_BANDWIDTH_40MHZ 40
+#define WL_CH_BANDWIDTH_80MHZ 80
+#define WL_CH_BANDWIDTH_160MHZ 160
+
+/* max number of mac filter list
+ * restrict max number to 10 as maximum cmd string size is 255
+ */
+#define MAX_NUM_MAC_FILT        10
+#define        WL_GET_BAND(ch) (((uint)(ch) <= CH_MAX_2G_CHANNEL) ?    \
+       WLC_BAND_2G : WLC_BAND_5G)
+
+int wl_android_set_ap_mac_list(struct net_device *dev, int macmode, struct maclist *maclist);
+#ifdef WL_BCNRECV
+extern int wl_android_bcnrecv_config(struct net_device *ndev, char *data,
+               int total_len);
+extern int wl_android_bcnrecv_stop(struct net_device *ndev, uint reason);
+extern int wl_android_bcnrecv_resume(struct net_device *ndev);
+extern int wl_android_bcnrecv_suspend(struct net_device *ndev);
+extern int wl_android_bcnrecv_event(struct net_device *ndev,
+               uint attr_type, uint status, uint reason, uint8 *data, uint data_len);
+#endif /* WL_BCNRECV */
+#ifdef WL_CAC_TS
+#define TSPEC_UPLINK_DIRECTION (0 << 5)        /* uplink direction traffic stream */
+#define TSPEC_DOWNLINK_DIRECTION (1 << 5)      /* downlink direction traffic stream */
+#define TSPEC_BI_DIRECTION (3 << 5)    /* bi direction traffic stream */
+#define TSPEC_EDCA_ACCESS (1 << 7)     /* EDCA access policy */
+#define TSPEC_UAPSD_PSB (1 << 2)               /* U-APSD power saving behavior */
+#define TSPEC_TSINFO_TID_SHIFT 1               /* TID Shift */
+#define TSPEC_TSINFO_PRIO_SHIFT 3              /* PRIO Shift */
+#define TSPEC_MAX_ACCESS_CATEGORY 3
+#define TSPEC_MAX_USER_PRIO    7
+#define TSPEC_MAX_DIALOG_TOKEN 255
+#define TSPEC_MAX_SURPLUS_BW 12410
+#define TSPEC_MIN_SURPLUS_BW 11210
+#define TSPEC_MAX_MSDU_SIZE 1520
+#define TSPEC_DEF_MEAN_DATA_RATE 120000
+#define TSPEC_DEF_MIN_PHY_RATE 6000000
+#define TSPEC_DEF_DIALOG_TOKEN 7
+#endif /* WL_CAC_TS */
+
+#define WL_PRIV_CMD_LEN 64
+
+/* terence:
+ * BSSCACHE: Cache bss list
+ * RSSAVG: Average RSSI of BSS list
+ * RSSIOFFSET: RSSI offset
+ * SORT_BSS_BY_RSSI: Sort BSS by RSSI
+ */
+//#define BSSCACHE
+//#define RSSIAVG
+//#define RSSIOFFSET
+//#define RSSIOFFSET_NEW
+//#define SORT_BSS_BY_RSSI
+
+#define RSSI_MAXVAL -2
+#define RSSI_MINVAL -200
+
+#if defined(ESCAN_RESULT_PATCH)
+#define REPEATED_SCAN_RESULT_CNT       2
+#else
+#define REPEATED_SCAN_RESULT_CNT       1
+#endif
+
+#if defined(RSSIAVG) || defined(RSSIOFFSET)
+extern int g_wifi_on;
+#endif
+
+#if defined(RSSIAVG)
+#define RSSIAVG_LEN (4*REPEATED_SCAN_RESULT_CNT)
+#define RSSICACHE_TIMEOUT 15
+
+typedef struct wl_rssi_cache {
+       struct wl_rssi_cache *next;
+       int dirty;
+       struct timeval tv;
+       struct ether_addr BSSID;
+       int16 RSSI[RSSIAVG_LEN];
+} wl_rssi_cache_t;
+
+typedef struct wl_rssi_cache_ctrl {
+       wl_rssi_cache_t *m_cache_head;
+} wl_rssi_cache_ctrl_t;
+
+void wl_free_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl);
+void wl_delete_dirty_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl);
+void wl_delete_disconnected_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl, u8 *bssid);
+void wl_reset_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl);
+void wl_update_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl, wl_scan_results_t *ss_list);
+int wl_update_connected_rssi_cache(struct net_device *net, wl_rssi_cache_ctrl_t *rssi_cache_ctrl, int *rssi_avg);
+int16 wl_get_avg_rssi(wl_rssi_cache_ctrl_t *rssi_cache_ctrl, void *addr);
+#endif
+
+#if defined(RSSIOFFSET)
+#define RSSI_OFFSET    5
+#if defined(RSSIOFFSET_NEW)
+#define RSSI_OFFSET_MAXVAL -80
+#define RSSI_OFFSET_MINVAL -94
+#define RSSI_OFFSET_INTVAL ((RSSI_OFFSET_MAXVAL-RSSI_OFFSET_MINVAL)/RSSI_OFFSET)
+#endif
+#define BCM4330_CHIP_ID                0x4330
+#define BCM4330B2_CHIP_REV      4
+int wl_update_rssi_offset(struct net_device *net, int rssi);
+#endif
+
+#if defined(BSSCACHE)
+#define BSSCACHE_TIMEOUT       15
+
+typedef struct wl_bss_cache {
+       struct wl_bss_cache *next;
+       int dirty;
+       struct osl_timespec tv;
+       wl_scan_results_t results;
+} wl_bss_cache_t;
+
+typedef struct wl_bss_cache_ctrl {
+       wl_bss_cache_t *m_cache_head;
+} wl_bss_cache_ctrl_t;
+
+void wl_free_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl);
+void wl_delete_dirty_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl);
+void wl_delete_disconnected_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl, u8 *bssid);
+void wl_reset_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl);
+void wl_update_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl,
+#if defined(RSSIAVG)
+       wl_rssi_cache_ctrl_t *rssi_cache_ctrl,
+#endif
+       wl_scan_results_t *ss_list);
+void wl_release_bss_cache_ctrl(wl_bss_cache_ctrl_t *bss_cache_ctrl);
+#endif
+int wl_ext_get_best_channel(struct net_device *net,
+#if defined(BSSCACHE)
+       wl_bss_cache_ctrl_t *bss_cache_ctrl,
+#else
+       struct wl_scan_results *bss_list,
+#endif
+       int ioctl_ver, int *best_2g_ch, int *best_5g_ch
+);
+#endif /* _wl_android_ */
diff --git a/bcmdhd.101.10.240.x/wl_android_ext.c b/bcmdhd.101.10.240.x/wl_android_ext.c
new file mode 100644 (file)
index 0000000..cc7b2ff
--- /dev/null
@@ -0,0 +1,7345 @@
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <net/netlink.h>
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <ethernet.h>
+
+#include <wl_android.h>
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+#include <linux/wireless.h>
+#if defined(WL_WIRELESS_EXT)
+#include <wl_iw.h>
+#endif /* WL_WIRELESS_EXT */
+#include <wldev_common.h>
+#include <wlioctl.h>
+#include <bcmutils.h>
+#include <linux_osl.h>
+#include <dhd_dbg.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_config.h>
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#endif /* WL_CFG80211 */
+#ifdef WL_ESCAN
+#include <wl_escan.h>
+#endif /* WL_ESCAN */
+
+#define AEXT_ERROR(name, arg1, args...) \
+       do { \
+               if (android_msg_level & ANDROID_ERROR_LEVEL) { \
+                       printk(KERN_ERR "[dhd-%s] AEXT-ERROR) %s : " arg1, name, __func__, ## args); \
+               } \
+       } while (0)
+#define AEXT_TRACE(name, arg1, args...) \
+       do { \
+               if (android_msg_level & ANDROID_TRACE_LEVEL) { \
+                       printk(KERN_INFO "[dhd-%s] AEXT-TRACE) %s : " arg1, name, __func__, ## args); \
+               } \
+       } while (0)
+#define AEXT_INFO(name, arg1, args...) \
+       do { \
+               if (android_msg_level & ANDROID_INFO_LEVEL) { \
+                       printk(KERN_INFO "[dhd-%s] AEXT-INFO) %s : " arg1, name, __func__, ## args); \
+               } \
+       } while (0)
+#define AEXT_DBG(name, arg1, args...) \
+       do { \
+               if (android_msg_level & ANDROID_DBG_LEVEL) { \
+                       printk(KERN_INFO "[dhd-%s] AEXT-DBG) %s : " arg1, name, __func__, ## args); \
+               } \
+       } while (0)
+
+#ifndef WL_CFG80211
+#define htod32(i) i
+#define htod16(i) i
+#define dtoh32(i) i
+#define dtoh16(i) i
+#define htodchanspec(i) i
+#define dtohchanspec(i) i
+#define IEEE80211_BAND_2GHZ 0
+#define IEEE80211_BAND_5GHZ 1
+#define WL_SCAN_JOIN_PROBE_INTERVAL_MS                 20
+#define WL_SCAN_JOIN_ACTIVE_DWELL_TIME_MS      320
+#define WL_SCAN_JOIN_PASSIVE_DWELL_TIME_MS     400
+#endif /* WL_CFG80211 */
+#define strtoul(nptr, endptr, base) bcm_strtoul((nptr), (endptr), (base))
+
+#ifndef IW_CUSTOM_MAX
+#define IW_CUSTOM_MAX 256 /* size of extra buffer used for translation of events */
+#endif /* IW_CUSTOM_MAX */
+
+#define CMD_CHANNEL                            "CHANNEL"
+#define CMD_CHANNELS                   "CHANNELS"
+#define CMD_ROAM_TRIGGER               "ROAM_TRIGGER"
+#define CMD_PM                                 "PM"
+#define CMD_MONITOR                            "MONITOR"
+#define CMD_SET_SUSPEND_BCN_LI_DTIM            "SET_SUSPEND_BCN_LI_DTIM"
+#define CMD_WLMSGLEVEL                 "WLMSGLEVEL"
+
+#ifdef WL_EXT_IAPSTA
+#include <net/rtnetlink.h>
+#define CMD_IAPSTA_INIT                        "IAPSTA_INIT"
+#define CMD_IAPSTA_CONFIG              "IAPSTA_CONFIG"
+#define CMD_IAPSTA_ENABLE              "IAPSTA_ENABLE"
+#define CMD_IAPSTA_DISABLE             "IAPSTA_DISABLE"
+#define CMD_ISAM_INIT                  "ISAM_INIT"
+#define CMD_ISAM_CONFIG                        "ISAM_CONFIG"
+#define CMD_ISAM_ENABLE                        "ISAM_ENABLE"
+#define CMD_ISAM_DISABLE               "ISAM_DISABLE"
+#define CMD_ISAM_STATUS                        "ISAM_STATUS"
+#define CMD_ISAM_PEER_PATH             "ISAM_PEER_PATH"
+#define CMD_ISAM_PARAM                 "ISAM_PARAM"
+#ifdef PROP_TXSTATUS
+#ifdef PROP_TXSTATUS_VSDB
+#include <dhd_wlfc.h>
+extern int disable_proptx;
+#endif /* PROP_TXSTATUS_VSDB */
+#endif /* PROP_TXSTATUS */
+#endif /* WL_EXT_IAPSTA */
+#define CMD_AUTOCHANNEL                "AUTOCHANNEL"
+#define CMD_WL         "WL"
+
+#ifdef WL_EXT_IAPSTA
+typedef enum APSTAMODE {
+       IUNKNOWN_MODE = 0,
+       ISTAONLY_MODE = 1,
+       IAPONLY_MODE = 2,
+       ISTAAP_MODE = 3,
+       ISTAGO_MODE = 4,
+       ISTASTA_MODE = 5,
+       IDUALAP_MODE = 6,
+       ISTAAPAP_MODE = 7,
+       IMESHONLY_MODE = 8,
+       ISTAMESH_MODE = 9,
+       IMESHAP_MODE = 10,
+       ISTAAPMESH_MODE = 11,
+       IMESHAPAP_MODE = 12
+} apstamode_t;
+
+typedef enum IFMODE {
+       ISTA_MODE = 1,
+       IAP_MODE,
+       IGO_MODE,
+       IGC_MODE,
+       IMESH_MODE
+} ifmode_t;
+
+typedef enum BGNMODE {
+       IEEE80211B = 1,
+       IEEE80211G,
+       IEEE80211BG,
+       IEEE80211BGN,
+       IEEE80211BGNAC
+} bgnmode_t;
+
+typedef enum AUTHMODE {
+       AUTH_OPEN,
+       AUTH_SHARED,
+       AUTH_WPAPSK,
+       AUTH_WPA2PSK,
+       AUTH_WPAWPA2PSK,
+       AUTH_SAE
+} authmode_t;
+
+typedef enum ENCMODE {
+       ENC_NONE,
+       ENC_WEP,
+       ENC_TKIP,
+       ENC_AES,
+       ENC_TKIPAES
+} encmode_t;
+
+enum wl_if_list {
+       IF_PIF,
+       IF_VIF,
+       IF_VIF2,
+       MAX_IF_NUM
+};
+
+typedef enum WL_PRIO {
+       PRIO_AP,
+       PRIO_MESH,
+       PRIO_STA
+} wl_prio_t;
+
+typedef struct wl_if_info {
+       struct net_device *dev;
+       ifmode_t ifmode;
+       unsigned long status;
+       char prefix;
+       wl_prio_t prio;
+       int ifidx;
+       uint8 bssidx;
+       char ifname[IFNAMSIZ+1];
+       char ssid[DOT11_MAX_SSID_LEN];
+       struct ether_addr bssid;
+       bgnmode_t bgnmode;
+       int hidden;
+       int maxassoc;
+       uint16 channel;
+       authmode_t amode;
+       encmode_t emode;
+       char key[100];
+#if defined(WLMESH) && defined(WL_ESCAN)
+       struct wl_escan_info *escan;
+       timer_list_compat_t delay_scan;
+#endif /* WLMESH && WL_ESCAN */
+       struct delayed_work pm_enable_work;
+       struct mutex pm_sync;
+#ifdef PROPTX_MAXCOUNT
+       int transit_maxcount;
+#endif /* PROP_TXSTATUS_VSDB */
+} wl_if_info_t;
+
+#define CSA_FW_BIT             (1<<0)
+#define CSA_DRV_BIT            (1<<1)
+
+typedef struct wl_apsta_params {
+       struct wl_if_info if_info[MAX_IF_NUM];
+       struct dhd_pub *dhd;
+       int ioctl_ver;
+       bool init;
+       int rsdb;
+       bool vsdb;
+       uint csa;
+       uint acs;
+       bool radar;
+       apstamode_t apstamode;
+       wait_queue_head_t netif_change_event;
+       struct mutex usr_sync;
+#if defined(WLMESH) && defined(WL_ESCAN)
+       int macs;
+       struct wl_mesh_params mesh_info;
+#endif /* WLMESH && WL_ESCAN */
+} wl_apsta_params_t;
+
+#define MAX_AP_LINK_WAIT_TIME   3000
+#define MAX_STA_LINK_WAIT_TIME   15000
+enum wifi_isam_status {
+       ISAM_STATUS_IF_ADDING = 0,
+       ISAM_STATUS_IF_READY,
+       ISAM_STATUS_STA_CONNECTING,
+       ISAM_STATUS_STA_CONNECTED,
+       ISAM_STATUS_AP_CREATING,
+       ISAM_STATUS_AP_CREATED
+};
+
+#define wl_get_isam_status(cur_if, stat) \
+       (test_bit(ISAM_STATUS_ ## stat, &(cur_if)->status))
+#define wl_set_isam_status(cur_if, stat) \
+       (set_bit(ISAM_STATUS_ ## stat, &(cur_if)->status))
+#define wl_clr_isam_status(cur_if, stat) \
+       (clear_bit(ISAM_STATUS_ ## stat, &(cur_if)->status))
+#define wl_chg_isam_status(cur_if, stat) \
+       (change_bit(ISAM_STATUS_ ## stat, &(cur_if)->status))
+
+static int wl_ext_enable_iface(struct net_device *dev, char *ifname, int wait_up);
+static int wl_ext_disable_iface(struct net_device *dev, char *ifname);
+#if defined(WLMESH) && defined(WL_ESCAN)
+static int wl_mesh_escan_attach(dhd_pub_t *dhd, struct wl_if_info *cur_if);
+#endif /* WLMESH && WL_ESCAN */
+#endif /* WL_EXT_IAPSTA */
+
+#ifdef IDHCP
+typedef struct dhcpc_parameter {
+       uint32 ip_addr;
+       uint32 ip_serv;
+       uint32 lease_time;
+} dhcpc_para_t;
+#endif /* IDHCP */
+
+#ifdef WL_EXT_WOWL
+#define WL_WOWL_TCPFIN (1 << 26)
+typedef struct wl_wowl_pattern2 {
+       char cmd[4];
+       wl_wowl_pattern_t wowl_pattern;
+} wl_wowl_pattern2_t;
+#endif /* WL_EXT_WOWL */
+
+#ifdef WL_EXT_TCPKA
+typedef struct tcpka_conn {
+       uint32 sess_id;
+       struct ether_addr dst_mac;      /* Destinition Mac */
+       struct ipv4_addr  src_ip;       /* Sorce IP */
+       struct ipv4_addr  dst_ip;       /* Destinition IP */
+       uint16 ipid;    /* Ip Identification */
+       uint16 srcport; /* Source Port Address */
+       uint16 dstport; /* Destination Port Address */
+       uint32 seq;             /* TCP Sequence Number */
+       uint32 ack;             /* TCP Ack Number */
+       uint16 tcpwin;  /* TCP window */
+       uint32 tsval;   /* Timestamp Value */
+       uint32 tsecr;   /* Timestamp Echo Reply */
+       uint32 len;             /* last packet payload len */
+       uint32 ka_payload_len;  /* keep alive payload length */
+       uint8  ka_payload[1];   /* keep alive payload */
+} tcpka_conn_t;
+
+typedef struct tcpka_conn_sess {
+       uint32 sess_id; /* session id */
+       uint32 flag;    /* enable/disable flag */
+       wl_mtcpkeep_alive_timers_pkt_t  tcpka_timers;
+} tcpka_conn_sess_t;
+
+typedef struct tcpka_conn_info {
+       uint32 ipid;
+       uint32 seq;
+       uint32 ack;
+} tcpka_conn_sess_info_t;
+#endif /* WL_EXT_TCPKA */
+
+static int wl_ext_wl_iovar(struct net_device *dev, char *command, int total_len);
+
+static int
+wl_ext_ioctl(struct net_device *dev, u32 cmd, void *arg, u32 len, u32 set)
+{
+       int ret;
+
+       ret = wldev_ioctl(dev, cmd, arg, len, set);
+       if (ret)
+               AEXT_ERROR(dev->name, "cmd=%d, ret=%d\n", cmd, ret);
+       return ret;
+}
+
+static int
+wl_ext_iovar_getint(struct net_device *dev, s8 *iovar, s32 *val)
+{
+       int ret;
+
+       ret = wldev_iovar_getint(dev, iovar, val);
+       if (ret)
+               AEXT_ERROR(dev->name, "iovar=%s, ret=%d\n", iovar, ret);
+
+       return ret;
+}
+
+static int
+wl_ext_iovar_setint(struct net_device *dev, s8 *iovar, s32 val)
+{
+       int ret;
+
+       ret = wldev_iovar_setint(dev, iovar, val);
+       if (ret)
+               AEXT_ERROR(dev->name, "iovar=%s, ret=%d\n", iovar, ret);
+
+       return ret;
+}
+
+static int
+wl_ext_iovar_getbuf(struct net_device *dev, s8 *iovar_name,
+       void *param, s32 paramlen, void *buf, s32 buflen, struct mutex* buf_sync)
+{
+       int ret;
+
+       ret = wldev_iovar_getbuf(dev, iovar_name, param, paramlen, buf, buflen, buf_sync);
+       if (ret != 0)
+               AEXT_ERROR(dev->name, "iovar=%s, ret=%d\n", iovar_name, ret);
+
+       return ret;
+}
+
+static int
+wl_ext_iovar_setbuf(struct net_device *dev, s8 *iovar_name,
+       void *param, s32 paramlen, void *buf, s32 buflen, struct mutex* buf_sync)
+{
+       int ret;
+
+       ret = wldev_iovar_setbuf(dev, iovar_name, param, paramlen, buf, buflen, buf_sync);
+       if (ret != 0)
+               AEXT_ERROR(dev->name, "iovar=%s, ret=%d\n", iovar_name, ret);
+
+       return ret;
+}
+
+static int
+wl_ext_iovar_setbuf_bsscfg(struct net_device *dev, s8 *iovar_name,
+       void *param, s32 paramlen, void *buf, s32 buflen, s32 bsscfg_idx,
+       struct mutex* buf_sync)
+{
+       int ret;
+
+       ret = wldev_iovar_setbuf_bsscfg(dev, iovar_name, param, paramlen,
+               buf, buflen, bsscfg_idx, buf_sync);
+       if (ret < 0)
+               AEXT_ERROR(dev->name, "iovar=%s, ret=%d\n", iovar_name, ret);
+
+       return ret;
+}
+
+static chanspec_t
+wl_ext_chspec_to_legacy(chanspec_t chspec)
+{
+       chanspec_t lchspec;
+
+       if (wf_chspec_malformed(chspec)) {
+               AEXT_ERROR("wlan", "input chanspec (0x%04X) malformed\n", chspec);
+               return INVCHANSPEC;
+       }
+
+       /* get the channel number */
+       lchspec = CHSPEC_CHANNEL(chspec);
+
+       /* convert the band */
+       if (CHSPEC_IS2G(chspec)) {
+               lchspec |= WL_LCHANSPEC_BAND_2G;
+       } else {
+               lchspec |= WL_LCHANSPEC_BAND_5G;
+       }
+
+       /* convert the bw and sideband */
+       if (CHSPEC_IS20(chspec)) {
+               lchspec |= WL_LCHANSPEC_BW_20;
+               lchspec |= WL_LCHANSPEC_CTL_SB_NONE;
+       } else if (CHSPEC_IS40(chspec)) {
+               lchspec |= WL_LCHANSPEC_BW_40;
+               if (CHSPEC_CTL_SB(chspec) == WL_CHANSPEC_CTL_SB_L) {
+                       lchspec |= WL_LCHANSPEC_CTL_SB_LOWER;
+               } else {
+                       lchspec |= WL_LCHANSPEC_CTL_SB_UPPER;
+               }
+       } else {
+               /* cannot express the bandwidth */
+               char chanbuf[CHANSPEC_STR_LEN];
+               AEXT_ERROR("wlan", "unable to convert chanspec %s (0x%04X) "
+                       "to pre-11ac format\n",
+                       wf_chspec_ntoa(chspec, chanbuf), chspec);
+               return INVCHANSPEC;
+       }
+
+       return lchspec;
+}
+
+static chanspec_t
+wl_ext_chspec_host_to_driver(int ioctl_ver, chanspec_t chanspec)
+{
+       if (ioctl_ver == 1) {
+               chanspec = wl_ext_chspec_to_legacy(chanspec);
+               if (chanspec == INVCHANSPEC) {
+                       return chanspec;
+               }
+       }
+       chanspec = htodchanspec(chanspec);
+
+       return chanspec;
+}
+
+static void
+wl_ext_ch_to_chanspec(int ioctl_ver, int ch,
+       struct wl_join_params *join_params, size_t *join_params_size)
+{
+       chanspec_t chanspec = 0;
+
+       if (ch != 0) {
+               join_params->params.chanspec_num = 1;
+               join_params->params.chanspec_list[0] = ch;
+
+               if (join_params->params.chanspec_list[0] <= CH_MAX_2G_CHANNEL)
+                       chanspec |= WL_CHANSPEC_BAND_2G;
+               else
+                       chanspec |= WL_CHANSPEC_BAND_5G;
+
+               chanspec |= WL_CHANSPEC_BW_20;
+               chanspec |= WL_CHANSPEC_CTL_SB_NONE;
+
+               *join_params_size += WL_ASSOC_PARAMS_FIXED_SIZE +
+                       join_params->params.chanspec_num * sizeof(chanspec_t);
+
+               join_params->params.chanspec_list[0]  &= WL_CHANSPEC_CHAN_MASK;
+               join_params->params.chanspec_list[0] |= chanspec;
+               join_params->params.chanspec_list[0] =
+                       wl_ext_chspec_host_to_driver(ioctl_ver,
+                               join_params->params.chanspec_list[0]);
+
+               join_params->params.chanspec_num =
+                       htod32(join_params->params.chanspec_num);
+       }
+}
+
+#if defined(WL_EXT_IAPSTA) || defined(WL_CFG80211) || defined(WL_ESCAN)
+static chanspec_t
+wl_ext_chspec_from_legacy(chanspec_t legacy_chspec)
+{
+       chanspec_t chspec;
+
+       /* get the channel number */
+       chspec = LCHSPEC_CHANNEL(legacy_chspec);
+
+       /* convert the band */
+       if (LCHSPEC_IS2G(legacy_chspec)) {
+               chspec |= WL_CHANSPEC_BAND_2G;
+       } else {
+               chspec |= WL_CHANSPEC_BAND_5G;
+       }
+
+       /* convert the bw and sideband */
+       if (LCHSPEC_IS20(legacy_chspec)) {
+               chspec |= WL_CHANSPEC_BW_20;
+       } else {
+               chspec |= WL_CHANSPEC_BW_40;
+               if (LCHSPEC_CTL_SB(legacy_chspec) == WL_LCHANSPEC_CTL_SB_LOWER) {
+                       chspec |= WL_CHANSPEC_CTL_SB_L;
+               } else {
+                       chspec |= WL_CHANSPEC_CTL_SB_U;
+               }
+       }
+
+       if (wf_chspec_malformed(chspec)) {
+               AEXT_ERROR("wlan", "output chanspec (0x%04X) malformed\n", chspec);
+               return INVCHANSPEC;
+       }
+
+       return chspec;
+}
+
+static chanspec_t
+wl_ext_chspec_driver_to_host(int ioctl_ver, chanspec_t chanspec)
+{
+       chanspec = dtohchanspec(chanspec);
+       if (ioctl_ver == 1) {
+               chanspec = wl_ext_chspec_from_legacy(chanspec);
+       }
+
+       return chanspec;
+}
+#endif /* WL_EXT_IAPSTA || WL_CFG80211 || WL_ESCAN */
+
+bool
+wl_ext_check_scan(struct net_device *dev, dhd_pub_t *dhdp)
+{
+#ifdef WL_CFG80211
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+#endif /* WL_CFG80211 */
+#ifdef WL_ESCAN
+       struct wl_escan_info *escan = dhdp->escan;
+#endif /* WL_ESCAN */
+
+#ifdef WL_CFG80211
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               AEXT_ERROR(dev->name, "cfg80211 scanning...\n");
+               return TRUE;
+       }
+#endif /* WL_CFG80211 */
+
+#ifdef WL_ESCAN
+       if (escan->escan_state == ESCAN_STATE_SCANING) {
+               AEXT_ERROR(dev->name, "escan scanning...\n");
+               return TRUE;
+       }
+#endif /* WL_ESCAN */
+
+       return FALSE;
+}
+
+#if defined(WL_CFG80211) || defined(WL_ESCAN)
+void
+wl_ext_user_sync(struct dhd_pub *dhd, int ifidx, bool lock)
+{
+       struct net_device *dev = dhd_idx2net(dhd, ifidx);
+#ifdef WL_CFG80211
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+#endif /* WL_CFG80211 */
+#ifdef WL_ESCAN
+       struct wl_escan_info *escan = dhd->escan;
+#endif /* WL_ESCAN */
+
+       AEXT_INFO(dev->name, "lock=%d\n", lock);
+
+       if (lock) {
+#if defined(WL_CFG80211)
+               mutex_lock(&cfg->usr_sync);
+#endif
+#if defined(WL_ESCAN)
+               mutex_lock(&escan->usr_sync);
+#endif
+       } else {
+#if defined(WL_CFG80211)
+               mutex_unlock(&cfg->usr_sync);
+#endif
+#if defined(WL_ESCAN)
+               mutex_unlock(&escan->usr_sync);
+#endif
+       }
+}
+
+bool
+wl_ext_event_complete(struct dhd_pub *dhd, int ifidx)
+{
+       struct net_device *dev = dhd_idx2net(dhd, ifidx);
+#ifdef WL_CFG80211
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+#endif /* WL_CFG80211 */
+#ifdef WL_ESCAN
+       struct wl_escan_info *escan = dhd->escan;
+#endif /* WL_ESCAN */
+       bool complete = TRUE;
+
+#ifdef WL_CFG80211
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               AEXT_INFO(dev->name, "SCANNING\n");
+               complete = FALSE;
+       }
+       if (wl_get_drv_status_all(cfg, CONNECTING)) {
+               AEXT_INFO(dev->name, "CONNECTING\n");
+               complete = FALSE;
+       }
+       if (wl_get_drv_status_all(cfg, DISCONNECTING)) {
+               AEXT_INFO(dev->name, "DISCONNECTING\n");
+               complete = FALSE;
+       }
+#endif /* WL_CFG80211 */
+#ifdef WL_ESCAN
+       if (escan->escan_state == ESCAN_STATE_SCANING) {
+               AEXT_INFO(dev->name, "ESCAN_STATE_SCANING\n");
+               complete = FALSE;
+       }
+#endif /* WL_ESCAN */
+       if (dhd->conf->eapol_status >= EAPOL_STATUS_4WAY_START &&
+                       dhd->conf->eapol_status < EAPOL_STATUS_4WAY_DONE) {
+               AEXT_INFO(dev->name, "4-WAY handshaking\n");
+               complete = FALSE;
+       }
+
+       return complete;
+}
+#endif /* WL_CFG80211 && WL_ESCAN */
+
+static int
+wl_ext_get_ioctl_ver(struct net_device *dev, int *ioctl_ver)
+{
+       int ret = 0;
+       s32 val = 0;
+
+       val = 1;
+       ret = wl_ext_ioctl(dev, WLC_GET_VERSION, &val, sizeof(val), 0);
+       if (ret) {
+               return ret;
+       }
+       val = dtoh32(val);
+       if (val != WLC_IOCTL_VERSION && val != 1) {
+               AEXT_ERROR(dev->name, "Version mismatch, please upgrade. Got %d, expected %d or 1\n",
+                       val, WLC_IOCTL_VERSION);
+               return BCME_VERSION;
+       }
+       *ioctl_ver = val;
+
+       return ret;
+}
+
+void
+wl_ext_bss_iovar_war(struct net_device *ndev, s32 *val)
+{
+       dhd_pub_t *dhd = dhd_get_pub(ndev);
+       uint chip;
+       bool need_war = false;
+
+       chip = dhd_conf_get_chip(dhd);
+
+       if (chip == BCM43362_CHIP_ID || chip == BCM4330_CHIP_ID ||
+               chip == BCM43430_CHIP_ID || chip == BCM43012_CHIP_ID ||
+               chip == BCM4354_CHIP_ID || chip == BCM4356_CHIP_ID ||
+               chip == BCM4345_CHIP_ID || chip == BCM4359_CHIP_ID ||
+               chip == BCM43143_CHIP_ID || chip == BCM43242_CHIP_ID ||
+               chip == BCM43569_CHIP_ID) {
+               need_war = true;
+       }
+
+       if (need_war) {
+               /* Few firmware branches have issues in bss iovar handling and
+                * that can't be changed since they are in production.
+                */
+               if (*val == WLC_AP_IOV_OP_MANUAL_AP_BSSCFG_CREATE) {
+                       *val = WLC_AP_IOV_OP_MANUAL_STA_BSSCFG_CREATE;
+               } else if (*val == WLC_AP_IOV_OP_MANUAL_STA_BSSCFG_CREATE) {
+                       *val = WLC_AP_IOV_OP_MANUAL_AP_BSSCFG_CREATE;
+               } else {
+                       /* Ignore for other bss enums */
+                       return;
+               }
+               AEXT_TRACE(ndev->name, "wl bss %d\n", *val);
+       }
+}
+
+static int
+wl_ext_set_chanspec(struct net_device *dev, int ioctl_ver,
+       uint16 channel, chanspec_t *ret_chspec)
+{
+       s32 _chan = channel;
+       chanspec_t chspec = 0;
+       chanspec_t fw_chspec = 0;
+       u32 bw = WL_CHANSPEC_BW_20;
+       s32 err = BCME_OK;
+       s32 bw_cap = 0;
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       struct {
+               u32 band;
+               u32 bw_cap;
+       } param = {0, 0};
+       uint band;
+
+       if (_chan <= CH_MAX_2G_CHANNEL)
+               band = IEEE80211_BAND_2GHZ;
+       else
+               band = IEEE80211_BAND_5GHZ;
+
+       if (band == IEEE80211_BAND_5GHZ) {
+               param.band = WLC_BAND_5G;
+               err = wl_ext_iovar_getbuf(dev, "bw_cap", &param, sizeof(param),
+                       iovar_buf, WLC_IOCTL_SMLEN, NULL);
+               if (err) {
+                       if (err != BCME_UNSUPPORTED) {
+                               AEXT_ERROR(dev->name, "bw_cap failed, %d\n", err);
+                               return err;
+                       } else {
+                               err = wl_ext_iovar_getint(dev, "mimo_bw_cap", &bw_cap);
+                               if (bw_cap != WLC_N_BW_20ALL)
+                                       bw = WL_CHANSPEC_BW_40;
+                       }
+               } else {
+                       if (WL_BW_CAP_80MHZ(iovar_buf[0]))
+                               bw = WL_CHANSPEC_BW_80;
+                       else if (WL_BW_CAP_40MHZ(iovar_buf[0]))
+                               bw = WL_CHANSPEC_BW_40;
+                       else
+                               bw = WL_CHANSPEC_BW_20;
+
+               }
+       }
+       else if (band == IEEE80211_BAND_2GHZ)
+               bw = WL_CHANSPEC_BW_20;
+
+set_channel:
+       chspec = wf_channel2chspec(_chan, bw);
+       if (wf_chspec_valid(chspec)) {
+               fw_chspec = wl_ext_chspec_host_to_driver(ioctl_ver, chspec);
+               if (fw_chspec != INVCHANSPEC) {
+                       if ((err = wl_ext_iovar_setint(dev, "chanspec", fw_chspec)) == BCME_BADCHAN) {
+                               if (bw == WL_CHANSPEC_BW_80)
+                                       goto change_bw;
+                               err = wl_ext_ioctl(dev, WLC_SET_CHANNEL, &_chan, sizeof(_chan), 1);
+                               WL_MSG(dev->name, "channel %d\n", _chan);
+                       } else if (err) {
+                               AEXT_ERROR(dev->name, "failed to set chanspec error %d\n", err);
+                       } else
+                               WL_MSG(dev->name, "channel %d, 0x%x\n", channel, chspec);
+               } else {
+                       AEXT_ERROR(dev->name, "failed to convert host chanspec to fw chanspec\n");
+                       err = BCME_ERROR;
+               }
+       } else {
+change_bw:
+               if (bw == WL_CHANSPEC_BW_80)
+                       bw = WL_CHANSPEC_BW_40;
+               else if (bw == WL_CHANSPEC_BW_40)
+                       bw = WL_CHANSPEC_BW_20;
+               else
+                       bw = 0;
+               if (bw)
+                       goto set_channel;
+               AEXT_ERROR(dev->name, "Invalid chanspec 0x%x\n", chspec);
+               err = BCME_ERROR;
+       }
+       *ret_chspec = fw_chspec;
+
+       return err;
+}
+
+static int
+wl_ext_channel(struct net_device *dev, char* command, int total_len)
+{
+       int ret;
+       int channel=0;
+       channel_info_t ci;
+       int bytes_written = 0;
+       chanspec_t fw_chspec;
+       int ioctl_ver = 0;
+
+       AEXT_TRACE(dev->name, "cmd %s", command);
+
+       sscanf(command, "%*s %d", &channel);
+
+       if (channel > 0) {
+               wl_ext_get_ioctl_ver(dev, &ioctl_ver);
+               ret = wl_ext_set_chanspec(dev, ioctl_ver, channel, &fw_chspec);
+       } else {
+               if (!(ret = wl_ext_ioctl(dev, WLC_GET_CHANNEL, &ci,
+                               sizeof(channel_info_t), FALSE))) {
+                       AEXT_TRACE(dev->name, "hw_channel %d\n", ci.hw_channel);
+                       AEXT_TRACE(dev->name, "target_channel %d\n", ci.target_channel);
+                       AEXT_TRACE(dev->name, "scan_channel %d\n", ci.scan_channel);
+                       bytes_written = snprintf(command, sizeof(channel_info_t)+2,
+                               "channel %d", ci.hw_channel);
+                       AEXT_TRACE(dev->name, "command result is %s\n", command);
+                       ret = bytes_written;
+               }
+       }
+
+       return ret;
+}
+
+static int
+wl_ext_channels(struct net_device *dev, char* command, int total_len)
+{
+       int ret, i;
+       int bytes_written = -1;
+       u8 valid_chan_list[sizeof(u32)*(WL_NUMCHANNELS + 1)];
+       wl_uint32_list_t *list;
+
+       AEXT_TRACE(dev->name, "cmd %s", command);
+
+       memset(valid_chan_list, 0, sizeof(valid_chan_list));
+       list = (wl_uint32_list_t *)(void *) valid_chan_list;
+       list->count = htod32(WL_NUMCHANNELS);
+       ret = wl_ext_ioctl(dev, WLC_GET_VALID_CHANNELS, valid_chan_list,
+               sizeof(valid_chan_list), 0);
+       if (ret<0) {
+               AEXT_ERROR(dev->name, "get channels failed with %d\n", ret);
+       } else {
+               bytes_written = snprintf(command, total_len, "channels");
+               for (i = 0; i < dtoh32(list->count); i++) {
+                       bytes_written += snprintf(command+bytes_written, total_len, " %d",
+                               dtoh32(list->element[i]));
+               }
+               AEXT_TRACE(dev->name, "command result is %s\n", command);
+               ret = bytes_written;
+       }
+
+       return ret;
+}
+
+static int
+wl_ext_roam_trigger(struct net_device *dev, char* command, int total_len)
+{
+       int ret = 0;
+       int roam_trigger[2] = {0, 0};
+       int trigger[2]= {0, 0};
+       int bytes_written=-1;
+
+       sscanf(command, "%*s %10d", &roam_trigger[0]);
+
+       if (roam_trigger[0]) {
+               roam_trigger[1] = WLC_BAND_ALL;
+               ret = wl_ext_ioctl(dev, WLC_SET_ROAM_TRIGGER, roam_trigger,
+                       sizeof(roam_trigger), 1);
+       } else {
+               roam_trigger[1] = WLC_BAND_2G;
+               ret = wl_ext_ioctl(dev, WLC_GET_ROAM_TRIGGER, roam_trigger,
+                       sizeof(roam_trigger), 0);
+               if (!ret)
+                       trigger[0] = roam_trigger[0];
+
+               roam_trigger[1] = WLC_BAND_5G;
+               ret = wl_ext_ioctl(dev, WLC_GET_ROAM_TRIGGER, &roam_trigger,
+                       sizeof(roam_trigger), 0);
+               if (!ret)
+                       trigger[1] = roam_trigger[0];
+
+               AEXT_TRACE(dev->name, "roam_trigger %d %d\n", trigger[0], trigger[1]);
+               bytes_written = snprintf(command, total_len, "%d %d", trigger[0], trigger[1]);
+               ret = bytes_written;
+       }
+
+       return ret;
+}
+
+static int
+wl_ext_pm(struct net_device *dev, char *command, int total_len)
+{
+       int pm=-1, ret = -1;
+       char *pm_local;
+       int bytes_written=-1;
+
+       AEXT_TRACE(dev->name, "cmd %s", command);
+
+       sscanf(command, "%*s %d", &pm);
+
+       if (pm >= 0) {
+               ret = wl_ext_ioctl(dev, WLC_SET_PM, &pm, sizeof(pm), 1);
+       } else {
+               ret = wl_ext_ioctl(dev, WLC_GET_PM, &pm, sizeof(pm), 0);
+               if (!ret) {
+                       AEXT_TRACE(dev->name, "PM = %d", pm);
+                       if (pm == PM_OFF)
+                               pm_local = "PM_OFF";
+                       else if(pm == PM_MAX)
+                               pm_local = "PM_MAX";
+                       else if(pm == PM_FAST)
+                               pm_local = "PM_FAST";
+                       else {
+                               pm = 0;
+                               pm_local = "Invalid";
+                       }
+                       bytes_written = snprintf(command, total_len, "PM %s", pm_local);
+                       AEXT_TRACE(dev->name, "command result is %s\n", command);
+                       ret = bytes_written;
+               }
+       }
+
+       return ret;
+}
+
+static int
+wl_ext_monitor(struct net_device *dev, char *command, int total_len)
+{
+       int val = -1, ret = -1;
+       int bytes_written=-1;
+
+       sscanf(command, "%*s %d", &val);
+
+       if (val >=0) {
+               ret = wl_ext_ioctl(dev, WLC_SET_MONITOR, &val, sizeof(val), 1);
+       } else {
+               ret = wl_ext_ioctl(dev, WLC_GET_MONITOR, &val, sizeof(val), 0);
+               if (!ret) {
+                       AEXT_TRACE(dev->name, "monitor = %d\n", val);
+                       bytes_written = snprintf(command, total_len, "monitor %d", val);
+                       AEXT_TRACE(dev->name, "command result is %s\n", command);
+                       ret = bytes_written;
+               }
+       }
+
+       return ret;
+}
+
+s32
+wl_ext_connect(struct net_device *dev, struct wl_conn_info *conn_info)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       wl_extjoin_params_t *ext_join_params = NULL;
+       struct wl_join_params join_params;
+       size_t join_params_size;
+       s32 err = 0;
+       u32 chan_cnt = 0;
+       s8 *iovar_buf = NULL;
+       int ioctl_ver = 0;
+       char sec[32];
+
+       wl_ext_get_ioctl_ver(dev, &ioctl_ver);
+
+       if (dhd->conf->chip == BCM43362_CHIP_ID)
+               goto set_ssid;
+
+       if (conn_info->channel) {
+               chan_cnt = 1;
+       }
+
+       iovar_buf = kzalloc(WLC_IOCTL_MAXLEN, GFP_KERNEL);
+       if (iovar_buf == NULL) {
+               err = -ENOMEM;
+               goto exit;
+       }
+
+       /*
+        *      Join with specific BSSID and cached SSID
+        *      If SSID is zero join based on BSSID only
+        */
+       join_params_size = WL_EXTJOIN_PARAMS_FIXED_SIZE +
+               chan_cnt * sizeof(chanspec_t);
+       ext_join_params =  (wl_extjoin_params_t*)kzalloc(join_params_size, GFP_KERNEL);
+       if (ext_join_params == NULL) {
+               err = -ENOMEM;
+               goto exit;
+       }
+       ext_join_params->ssid.SSID_len = min((uint32)sizeof(ext_join_params->ssid.SSID),
+               conn_info->ssid.SSID_len);
+       memcpy(&ext_join_params->ssid.SSID, conn_info->ssid.SSID, ext_join_params->ssid.SSID_len);
+       ext_join_params->ssid.SSID_len = htod32(ext_join_params->ssid.SSID_len);
+       /* increate dwell time to receive probe response or detect Beacon
+       * from target AP at a noisy air only during connect command
+       */
+       ext_join_params->scan.active_time = chan_cnt ? WL_SCAN_JOIN_ACTIVE_DWELL_TIME_MS : -1;
+       ext_join_params->scan.passive_time = chan_cnt ? WL_SCAN_JOIN_PASSIVE_DWELL_TIME_MS : -1;
+       /* Set up join scan parameters */
+       ext_join_params->scan.scan_type = -1;
+       ext_join_params->scan.nprobes = chan_cnt ?
+               (ext_join_params->scan.active_time/WL_SCAN_JOIN_PROBE_INTERVAL_MS) : -1;
+       ext_join_params->scan.home_time = -1;
+
+       if (memcmp(&ether_null, &conn_info->bssid, ETHER_ADDR_LEN))
+               memcpy(&ext_join_params->assoc.bssid, &conn_info->bssid, ETH_ALEN);
+       else
+               memcpy(&ext_join_params->assoc.bssid, &ether_bcast, ETH_ALEN);
+       ext_join_params->assoc.chanspec_num = chan_cnt;
+       if (chan_cnt) {
+               u16 band, bw, ctl_sb;
+               chanspec_t chspec;
+               band = (conn_info->channel <= CH_MAX_2G_CHANNEL) ? WL_CHANSPEC_BAND_2G
+                       : WL_CHANSPEC_BAND_5G;
+               bw = WL_CHANSPEC_BW_20;
+               ctl_sb = WL_CHANSPEC_CTL_SB_NONE;
+               chspec = (conn_info->channel | band | bw | ctl_sb);
+               ext_join_params->assoc.chanspec_list[0]  &= WL_CHANSPEC_CHAN_MASK;
+               ext_join_params->assoc.chanspec_list[0] |= chspec;
+               ext_join_params->assoc.chanspec_list[0] =
+                       wl_ext_chspec_host_to_driver(ioctl_ver,
+                               ext_join_params->assoc.chanspec_list[0]);
+       }
+       ext_join_params->assoc.chanspec_num = htod32(ext_join_params->assoc.chanspec_num);
+
+       wl_ext_get_sec(dev, 0, sec, sizeof(sec));
+       WL_MSG(dev->name,
+               "Connecting with %pM channel (%d) ssid \"%s\", len (%d), sec=%s\n\n",
+               &ext_join_params->assoc.bssid, conn_info->channel,
+               ext_join_params->ssid.SSID, ext_join_params->ssid.SSID_len, sec);
+       err = wl_ext_iovar_setbuf_bsscfg(dev, "join", ext_join_params,
+               join_params_size, iovar_buf, WLC_IOCTL_MAXLEN, conn_info->bssidx, NULL);
+
+       if (err) {
+               if (err == BCME_UNSUPPORTED) {
+                       AEXT_TRACE(dev->name, "join iovar is not supported\n");
+                       goto set_ssid;
+               } else {
+                       AEXT_ERROR(dev->name, "error (%d)\n", err);
+                       goto exit;
+               }
+       } else
+               goto exit;
+
+set_ssid:
+       memset(&join_params, 0, sizeof(join_params));
+       join_params_size = sizeof(join_params.ssid);
+
+       join_params.ssid.SSID_len = min((uint32)sizeof(join_params.ssid.SSID),
+               conn_info->ssid.SSID_len);
+       memcpy(&join_params.ssid.SSID, conn_info->ssid.SSID, join_params.ssid.SSID_len);
+       join_params.ssid.SSID_len = htod32(join_params.ssid.SSID_len);
+       if (memcmp(&ether_null, &conn_info->bssid, ETHER_ADDR_LEN))
+               memcpy(&join_params.params.bssid, &conn_info->bssid, ETH_ALEN);
+       else
+               memcpy(&join_params.params.bssid, &ether_bcast, ETH_ALEN);
+
+       wl_ext_ch_to_chanspec(ioctl_ver, conn_info->channel, &join_params, &join_params_size);
+       AEXT_TRACE(dev->name, "join_param_size %zu\n", join_params_size);
+
+       if (join_params.ssid.SSID_len < IEEE80211_MAX_SSID_LEN) {
+               AEXT_INFO(dev->name, "ssid \"%s\", len (%d)\n", join_params.ssid.SSID,
+                       join_params.ssid.SSID_len);
+       }
+       wl_ext_get_sec(dev, 0, sec, sizeof(sec));
+       WL_MSG(dev->name,
+               "Connecting with %pM channel (%d) ssid \"%s\", len (%d), sec=%s\n\n",
+               &join_params.params.bssid, conn_info->channel,
+               join_params.ssid.SSID, join_params.ssid.SSID_len, sec);
+       err = wl_ext_ioctl(dev, WLC_SET_SSID, &join_params, join_params_size, 1);
+
+exit:
+#ifdef WL_EXT_IAPSTA
+       if (!err)
+               wl_ext_add_remove_pm_enable_work(dev, TRUE);
+#endif /* WL_EXT_IAPSTA */
+       if (iovar_buf)
+               kfree(iovar_buf);
+       if (ext_join_params)
+               kfree(ext_join_params);
+       return err;
+
+}
+
+void
+wl_ext_get_sec(struct net_device *dev, int ifmode, char *sec, int total_len)
+{
+       int auth=0, wpa_auth=0, wsec=0, mfp=0;
+       int bytes_written=0;
+
+       memset(sec, 0, total_len);
+       wl_ext_iovar_getint(dev, "auth", &auth);
+       wl_ext_iovar_getint(dev, "wpa_auth", &wpa_auth);
+       wl_ext_iovar_getint(dev, "wsec", &wsec);
+       wldev_iovar_getint(dev, "mfp", &mfp);
+
+#ifdef WL_EXT_IAPSTA
+       if (ifmode == IMESH_MODE) {
+               if (auth == WL_AUTH_OPEN_SYSTEM && wpa_auth == WPA_AUTH_DISABLED) {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "open");
+               } else if (auth == WL_AUTH_OPEN_SYSTEM && wpa_auth == WPA2_AUTH_PSK) {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "sae");
+               } else {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "%d/0x%x",
+                               auth, wpa_auth);
+               }
+       } else
+#endif /* WL_EXT_IAPSTA */
+       {
+               if (auth == WL_AUTH_OPEN_SYSTEM && wpa_auth == WPA_AUTH_DISABLED) {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "open");
+               } else if (auth == WL_AUTH_SHARED_KEY && wpa_auth == WPA_AUTH_DISABLED) {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "shared");
+               } else if (auth == WL_AUTH_OPEN_SYSTEM && wpa_auth == WPA_AUTH_PSK) {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "wpapsk");
+               } else if (auth == WL_AUTH_OPEN_SYSTEM && wpa_auth == WPA2_AUTH_PSK) {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "wpa2psk");
+               } else if ((auth == WL_AUTH_OPEN_SYSTEM || auth == WL_AUTH_SAE_KEY) &&
+                               wpa_auth == WPA3_AUTH_SAE_PSK) {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "wpa3");
+               } else if ((auth == WL_AUTH_OPEN_SYSTEM || auth == WL_AUTH_SAE_KEY) &&
+                               wpa_auth == 0x20) {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "wpa3");
+               } else {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "%d/0x%x",
+                               auth, wpa_auth);
+               }
+       }
+
+       if (mfp == WL_MFP_NONE) {
+               bytes_written += snprintf(sec+bytes_written, total_len, "/mfpn");
+       } else if (mfp == WL_MFP_CAPABLE) {
+               bytes_written += snprintf(sec+bytes_written, total_len, "/mfpc");
+       } else if (mfp == WL_MFP_REQUIRED) {
+               bytes_written += snprintf(sec+bytes_written, total_len, "/mfpr");
+       } else {
+               bytes_written += snprintf(sec+bytes_written, total_len, "/%d", mfp);
+       }
+
+#ifdef WL_EXT_IAPSTA
+       if (ifmode == IMESH_MODE) {
+               if (wsec == WSEC_NONE) {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "/none");
+               } else {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "/aes");
+               }
+       } else
+#endif /* WL_EXT_IAPSTA */
+       {
+               if (wsec == WSEC_NONE) {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "/none");
+               } else if (wsec == WEP_ENABLED) {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "/wep");
+               } else if (wsec == (TKIP_ENABLED|AES_ENABLED) ||
+                               wsec == (WSEC_SWFLAG|TKIP_ENABLED|AES_ENABLED)) {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "/tkipaes");
+               } else if (wsec == TKIP_ENABLED || wsec == (WSEC_SWFLAG|TKIP_ENABLED)) {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "/tkip");
+               } else if (wsec == AES_ENABLED || wsec == (WSEC_SWFLAG|AES_ENABLED)) {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "/aes");
+               } else {
+                       bytes_written += snprintf(sec+bytes_written, total_len, "/0x%x", wsec);
+               }
+       }
+
+}
+
+static bool
+wl_ext_dfs_chan(uint16 chan)
+{
+       if (chan >= 52 && chan <= 144)
+               return TRUE;
+       return FALSE;
+}
+
+static uint16
+wl_ext_get_default_chan(struct net_device *dev,
+       uint16 *chan_2g, uint16 *chan_5g, bool nodfs)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       uint16 chan_tmp = 0, chan = 0;
+       wl_uint32_list_t *list;
+       u8 valid_chan_list[sizeof(u32)*(WL_NUMCHANNELS + 1)];
+       s32 ret = BCME_OK;
+       int i;
+
+       *chan_2g = 0;
+       *chan_5g = 0;
+       memset(valid_chan_list, 0, sizeof(valid_chan_list));
+       list = (wl_uint32_list_t *)(void *) valid_chan_list;
+       list->count = htod32(WL_NUMCHANNELS);
+       ret = wl_ext_ioctl(dev, WLC_GET_VALID_CHANNELS, valid_chan_list,
+               sizeof(valid_chan_list), 0);
+       if (ret == 0) {
+               for (i=0; i<dtoh32(list->count); i++) {
+                       chan_tmp = dtoh32(list->element[i]);
+                       if (!dhd_conf_match_channel(dhd, chan_tmp))
+                               continue;
+                       if (chan_tmp <= 13) {
+                               *chan_2g = chan_tmp;
+                       } else {
+                               if (wl_ext_dfs_chan(chan_tmp) && nodfs)
+                                       continue;
+                               else if (chan_tmp >= 36 && chan_tmp <= 161)
+                                       *chan_5g = chan_tmp;
+                       }
+               }
+       }
+
+       return chan;
+}
+
+static int
+wl_ext_wlmsglevel(struct net_device *dev, char *command, int total_len)
+{
+       int val = -1, ret = 0;
+       int bytes_written = 0;
+
+       sscanf(command, "%*s %x", &val);
+
+       if (val >=0) {
+               if (val & DHD_ANDROID_VAL) {
+                       android_msg_level = (uint)(val & 0xFFFF);
+                       printf("android_msg_level=0x%x\n", android_msg_level);
+               }
+#if defined(WL_WIRELESS_EXT)
+               else if (val & DHD_IW_VAL) {
+                       iw_msg_level = (uint)(val & 0xFFFF);
+                       printf("iw_msg_level=0x%x\n", iw_msg_level);
+               }
+#endif
+#ifdef WL_CFG80211
+               else if (val & DHD_CFG_VAL) {
+                       wl_cfg80211_enable_trace((u32)(val & 0xFFFF));
+               }
+#endif
+               else if (val & DHD_CONFIG_VAL) {
+                       config_msg_level = (uint)(val & 0xFFFF);
+                       printf("config_msg_level=0x%x\n", config_msg_level);
+               }
+               else if (val & DHD_DUMP_VAL) {
+                       dump_msg_level = (uint)(val & 0xFFFF);
+                       printf("dump_msg_level=0x%x\n", dump_msg_level);
+               }
+       }
+       else {
+               bytes_written += snprintf(command+bytes_written, total_len,
+                       "android_msg_level=0x%x", android_msg_level);
+#if defined(WL_WIRELESS_EXT)
+               bytes_written += snprintf(command+bytes_written, total_len,
+                       "\niw_msg_level=0x%x", iw_msg_level);
+#endif
+#ifdef WL_CFG80211
+               bytes_written += snprintf(command+bytes_written, total_len,
+                       "\nwl_dbg_level=0x%x", wl_dbg_level);
+#endif
+               bytes_written += snprintf(command+bytes_written, total_len,
+                       "\nconfig_msg_level=0x%x", config_msg_level);
+               bytes_written += snprintf(command+bytes_written, total_len,
+                       "\ndump_msg_level=0x%x", dump_msg_level);
+               AEXT_INFO(dev->name, "%s\n", command);
+               ret = bytes_written;
+       }
+
+       return ret;
+}
+
+#if defined(SENDPROB) || (defined(WLMESH) && defined(WL_ESCAN))
+static int
+wl_ext_add_del_ie(struct net_device *dev, uint pktflag, char *ie_data, const char* add_del_cmd)
+{
+       vndr_ie_setbuf_t *vndr_ie = NULL;
+       char iovar_buf[WLC_IOCTL_SMLEN]="\0";
+       int ie_data_len = 0, tot_len = 0, iecount;
+       int err = -1;
+
+       if (!strlen(ie_data)) {
+               AEXT_ERROR(dev->name, "wrong ie %s\n", ie_data);
+               goto exit;
+       }
+
+       tot_len = (int)(sizeof(vndr_ie_setbuf_t) + ((strlen(ie_data)-2)/2));
+       vndr_ie = (vndr_ie_setbuf_t *) kzalloc(tot_len, GFP_KERNEL);
+       if (!vndr_ie) {
+               AEXT_ERROR(dev->name, "IE memory alloc failed\n");
+               err = -ENOMEM;
+               goto exit;
+       }
+
+       /* Copy the vndr_ie SET command ("add"/"del") to the buffer */
+       strncpy(vndr_ie->cmd, add_del_cmd, VNDR_IE_CMD_LEN - 1);
+       vndr_ie->cmd[VNDR_IE_CMD_LEN - 1] = '\0';
+
+       /* Set the IE count - the buffer contains only 1 IE */
+       iecount = htod32(1);
+       memcpy((void *)&vndr_ie->vndr_ie_buffer.iecount, &iecount, sizeof(s32));
+
+       /* Set packet flag to indicate that BEACON's will contain this IE */
+       pktflag = htod32(pktflag);
+       memcpy((void *)&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].pktflag, &pktflag,
+               sizeof(u32));
+
+       /* Set the IE ID */
+       vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.id = (uchar)DOT11_MNG_VS_ID;
+
+       /* Set the IE LEN */
+       vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.len = (strlen(ie_data)-2)/2;
+
+       /* Set the IE OUI and DATA */
+       ie_data_len = wl_pattern_atoh(ie_data,
+               (char *)vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui);
+       if (ie_data_len <= 0) {
+               AEXT_ERROR(dev->name, "wrong ie_data_len %d\n", (int)strlen(ie_data)-2);
+               goto exit;
+       }
+
+       err = wl_ext_iovar_setbuf(dev, "vndr_ie", vndr_ie, tot_len, iovar_buf,
+               sizeof(iovar_buf), NULL);
+
+exit:
+       if (vndr_ie) {
+               kfree(vndr_ie);
+       }
+       return err;
+}
+#endif /* SENDPROB || (WLMESH && WL_ESCAN) */
+
+#ifdef WL_EXT_IAPSTA
+#define WL_PM_ENABLE_TIMEOUT 10000
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+#define BCM_SET_CONTAINER_OF(entry, ptr, type, member) \
+_Pragma("GCC diagnostic push") \
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"") \
+entry = container_of((ptr), type, member); \
+_Pragma("GCC diagnostic pop")
+#else
+#define BCM_SET_CONTAINER_OF(entry, ptr, type, member) \
+entry = container_of((ptr), type, member);
+#endif /* STRICT_GCC_WARNINGS */
+
+static void
+wl_ext_pm_work_handler(struct work_struct *work)
+{
+       struct wl_if_info *cur_if;
+       s32 pm = PM_FAST;
+       dhd_pub_t *dhd;
+
+       BCM_SET_CONTAINER_OF(cur_if, work, struct wl_if_info, pm_enable_work.work);
+
+       WL_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (cur_if->dev == NULL)
+               return;
+
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic push")
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"")
+#endif
+
+       dhd = dhd_get_pub(cur_if->dev);
+
+       if (!dhd || !dhd->up) {
+               AEXT_TRACE(cur_if->ifname, "dhd is null or not up\n");
+               return;
+       }
+       if (dhd_conf_get_pm(dhd) >= 0)
+               pm = dhd_conf_get_pm(dhd);
+       wl_ext_ioctl(cur_if->dev, WLC_SET_PM, &pm, sizeof(pm), 1);
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic pop")
+#endif
+       DHD_PM_WAKE_UNLOCK(dhd);
+
+}
+
+void
+wl_ext_add_remove_pm_enable_work(struct net_device *dev, bool add)
+{
+       dhd_pub_t *dhd = dhd_get_pub(dev);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       struct wl_if_info *cur_if = NULL, *tmp_if = NULL;
+       u16 wq_duration = 0;
+       s32 pm = PM_OFF;
+       int i;
+
+       for (i=0; i<MAX_IF_NUM; i++) {
+               tmp_if = &apsta_params->if_info[i];
+               if (tmp_if->dev && tmp_if->dev == dev) {
+                       cur_if = tmp_if;
+                       break;
+               }
+       }
+
+       if (!cur_if)
+               return;
+
+       mutex_lock(&cur_if->pm_sync);
+       /*
+        * Make cancel and schedule work part mutually exclusive
+        * so that while cancelling, we are sure that there is no
+        * work getting scheduled.
+        */
+
+       if (delayed_work_pending(&cur_if->pm_enable_work)) {
+               cancel_delayed_work_sync(&cur_if->pm_enable_work);
+               DHD_PM_WAKE_UNLOCK(dhd);
+       }
+
+       if (add) {
+               wq_duration = (WL_PM_ENABLE_TIMEOUT);
+       }
+
+       /* It should schedule work item only if driver is up */
+       if (dhd->up) {
+               if (dhd_conf_get_pm(dhd) >= 0)
+                       pm = dhd_conf_get_pm(dhd);
+               wl_ext_ioctl(cur_if->dev, WLC_SET_PM, &pm, sizeof(pm), 1);
+               if (wq_duration) {
+                       if (schedule_delayed_work(&cur_if->pm_enable_work,
+                                       msecs_to_jiffies((const unsigned int)wq_duration))) {
+                               DHD_PM_WAKE_LOCK_TIMEOUT(dhd, wq_duration);
+                       } else {
+                               AEXT_ERROR(cur_if->ifname, "Can't schedule pm work handler\n");
+                       }
+               }
+       }
+       mutex_unlock(&cur_if->pm_sync);
+
+}
+
+static int
+wl_ext_parse_wep(char *key, struct wl_wsec_key *wsec_key)
+{
+       char hex[] = "XX";
+       unsigned char *data = wsec_key->data;
+       char *keystr = key;
+
+       switch (strlen(keystr)) {
+       case 5:
+       case 13:
+       case 16:
+               wsec_key->len = strlen(keystr);
+               memcpy(data, keystr, wsec_key->len + 1);
+               break;
+       case 12:
+       case 28:
+       case 34:
+       case 66:
+               /* strip leading 0x */
+               if (!strnicmp(keystr, "0x", 2))
+                       keystr += 2;
+               else
+                       return -1;
+               /* fall through */
+       case 10:
+       case 26:
+       case 32:
+       case 64:
+               wsec_key->len = strlen(keystr) / 2;
+               while (*keystr) {
+                       strncpy(hex, keystr, 2);
+                       *data++ = (char) strtoul(hex, NULL, 16);
+                       keystr += 2;
+               }
+               break;
+       default:
+               return -1;
+       }
+
+       switch (wsec_key->len) {
+       case 5:
+               wsec_key->algo = CRYPTO_ALGO_WEP1;
+               break;
+       case 13:
+               wsec_key->algo = CRYPTO_ALGO_WEP128;
+               break;
+       case 16:
+               /* default to AES-CCM */
+               wsec_key->algo = CRYPTO_ALGO_AES_CCM;
+               break;
+       case 32:
+               wsec_key->algo = CRYPTO_ALGO_TKIP;
+               break;
+       default:
+               return -1;
+       }
+
+       /* Set as primary wsec_key by default */
+       wsec_key->flags |= WL_PRIMARY_KEY;
+
+       return 0;
+}
+
+static int
+wl_ext_set_bgnmode(struct wl_if_info *cur_if)
+{
+       struct net_device *dev = cur_if->dev;
+       bgnmode_t bgnmode = cur_if->bgnmode;
+       int val;
+
+       if (bgnmode == 0)
+               return 0;
+
+       wl_ext_ioctl(dev, WLC_DOWN, NULL, 0, 1);
+       if (bgnmode == IEEE80211B) {
+               wl_ext_iovar_setint(dev, "nmode", 0);
+               val = 0;
+               wl_ext_ioctl(dev, WLC_SET_GMODE, &val, sizeof(val), 1);
+               AEXT_TRACE(dev->name, "Network mode: B only\n");
+       } else if (bgnmode == IEEE80211G) {
+               wl_ext_iovar_setint(dev, "nmode", 0);
+               val = 2;
+               wl_ext_ioctl(dev, WLC_SET_GMODE, &val, sizeof(val), 1);
+               AEXT_TRACE(dev->name, "Network mode: G only\n");
+       } else if (bgnmode == IEEE80211BG) {
+               wl_ext_iovar_setint(dev, "nmode", 0);
+               val = 1;
+               wl_ext_ioctl(dev, WLC_SET_GMODE, &val, sizeof(val), 1);
+               AEXT_TRACE(dev->name, "Network mode: B/G mixed\n");
+       } else if (bgnmode == IEEE80211BGN) {
+               wl_ext_iovar_setint(dev, "nmode", 0);
+               wl_ext_iovar_setint(dev, "nmode", 1);
+               wl_ext_iovar_setint(dev, "vhtmode", 0);
+               val = 1;
+               wl_ext_ioctl(dev, WLC_SET_GMODE, &val, sizeof(val), 1);
+               AEXT_TRACE(dev->name, "Network mode: B/G/N mixed\n");
+       } else if (bgnmode == IEEE80211BGNAC) {
+               wl_ext_iovar_setint(dev, "nmode", 0);
+               wl_ext_iovar_setint(dev, "nmode", 1);
+               wl_ext_iovar_setint(dev, "vhtmode", 1);
+               val = 1;
+               wl_ext_ioctl(dev, WLC_SET_GMODE, &val, sizeof(val), 1);
+               AEXT_TRACE(dev->name, "Network mode: B/G/N/AC mixed\n");
+       }
+       wl_ext_ioctl(dev, WLC_UP, NULL, 0, 1);
+
+       return 0;
+}
+
+static int
+wl_ext_set_amode(struct wl_if_info *cur_if)
+{
+       struct net_device *dev = cur_if->dev;
+       authmode_t amode = cur_if->amode;
+       int auth=0, wpa_auth=0;
+
+#ifdef WLMESH
+       if (cur_if->ifmode == IMESH_MODE) {
+               if (amode == AUTH_SAE) {
+                       auth = WL_AUTH_OPEN_SYSTEM;
+                       wpa_auth = WPA2_AUTH_PSK;
+                       AEXT_INFO(dev->name, "SAE\n");
+               } else {
+                       auth = WL_AUTH_OPEN_SYSTEM;
+                       wpa_auth = WPA_AUTH_DISABLED;
+                       AEXT_INFO(dev->name, "Open System\n");
+               }
+       } else
+#endif /* WLMESH */
+       if (amode == AUTH_OPEN) {
+               auth = WL_AUTH_OPEN_SYSTEM;
+               wpa_auth = WPA_AUTH_DISABLED;
+               AEXT_INFO(dev->name, "Open System\n");
+       } else if (amode == AUTH_SHARED) {
+               auth = WL_AUTH_SHARED_KEY;
+               wpa_auth = WPA_AUTH_DISABLED;
+               AEXT_INFO(dev->name, "Shared Key\n");
+       } else if (amode == AUTH_WPAPSK) {
+               auth = WL_AUTH_OPEN_SYSTEM;
+               wpa_auth = WPA_AUTH_PSK;
+               AEXT_INFO(dev->name, "WPA-PSK\n");
+       } else if (amode == AUTH_WPA2PSK) {
+               auth = WL_AUTH_OPEN_SYSTEM;
+               wpa_auth = WPA2_AUTH_PSK;
+               AEXT_INFO(dev->name, "WPA2-PSK\n");
+       } else if (amode == AUTH_WPAWPA2PSK) {
+               auth = WL_AUTH_OPEN_SYSTEM;
+               wpa_auth = WPA2_AUTH_PSK | WPA_AUTH_PSK;
+               AEXT_INFO(dev->name, "WPA/WPA2-PSK\n");
+       }
+#ifdef WLMESH
+       if (cur_if->ifmode == IMESH_MODE) {
+               s32 val = WL_BSSTYPE_MESH;
+               wl_ext_ioctl(dev, WLC_SET_INFRA, &val, sizeof(val), 1);
+       } else
+#endif /* WLMESH */
+       if (cur_if->ifmode == ISTA_MODE) {
+               s32 val = WL_BSSTYPE_INFRA;
+               wl_ext_ioctl(dev, WLC_SET_INFRA, &val, sizeof(val), 1);
+       }
+       wl_ext_iovar_setint(dev, "auth", auth);
+
+       wl_ext_iovar_setint(dev, "wpa_auth", wpa_auth);
+
+       return 0;
+}
+
+static int
+wl_ext_set_emode(struct wl_apsta_params *apsta_params,
+       struct wl_if_info *cur_if)
+{
+       struct net_device *dev = cur_if->dev;
+       int wsec=0;
+       struct wl_wsec_key wsec_key;
+       wsec_pmk_t psk;
+       authmode_t amode = cur_if->amode;
+       encmode_t emode = cur_if->emode;
+       char *key = cur_if->key;
+       struct dhd_pub *dhd = apsta_params->dhd;
+
+       memset(&wsec_key, 0, sizeof(wsec_key));
+       memset(&psk, 0, sizeof(psk));
+
+#ifdef WLMESH
+       if (cur_if->ifmode == IMESH_MODE) {
+               if (amode == AUTH_SAE) {
+                       wsec = AES_ENABLED;
+               } else {
+                       wsec = WSEC_NONE;
+               }
+       } else
+#endif /* WLMESH */
+       if (emode == ENC_NONE) {
+               wsec = WSEC_NONE;
+               AEXT_INFO(dev->name, "No securiy\n");
+       } else if (emode == ENC_WEP) {
+               wsec = WEP_ENABLED;
+               wl_ext_parse_wep(key, &wsec_key);
+               AEXT_INFO(dev->name, "WEP key \"%s\"\n", wsec_key.data);
+       } else if (emode == ENC_TKIP) {
+               wsec = TKIP_ENABLED;
+               psk.key_len = strlen(key);
+               psk.flags = WSEC_PASSPHRASE;
+               memcpy(psk.key, key, strlen(key));
+               AEXT_INFO(dev->name, "TKIP key \"%s\"\n", psk.key);
+       } else if (emode == ENC_AES || amode == AUTH_SAE) {
+               wsec = AES_ENABLED;
+               psk.key_len = strlen(key);
+               psk.flags = WSEC_PASSPHRASE;
+               memcpy(psk.key, key, strlen(key));
+               AEXT_INFO(dev->name, "AES key \"%s\"\n", psk.key);
+       } else if (emode == ENC_TKIPAES) {
+               wsec = TKIP_ENABLED | AES_ENABLED;
+               psk.key_len = strlen(key);
+               psk.flags = WSEC_PASSPHRASE;
+               memcpy(psk.key, key, strlen(key));
+               AEXT_INFO(dev->name, "TKIP/AES key \"%s\"\n", psk.key);
+       }
+       if (dhd->conf->chip == BCM43430_CHIP_ID && cur_if->ifidx > 0 && wsec >= 2 &&
+                       apsta_params->apstamode == ISTAAP_MODE) {
+               wsec |= WSEC_SWFLAG; // terence 20180628: fix me, this is a workaround
+       }
+
+       wl_ext_iovar_setint(dev, "wsec", wsec);
+
+#ifdef WLMESH
+       if (cur_if->ifmode == IMESH_MODE) {
+               if (amode == AUTH_SAE) {
+                       s8 iovar_buf[WLC_IOCTL_SMLEN];
+                       AEXT_INFO(dev->name, "AES key \"%s\"\n", key);
+                       wl_ext_iovar_setint(dev, "mesh_auth_proto", 1);
+                       wl_ext_iovar_setint(dev, "mfp", WL_MFP_REQUIRED);
+                       wl_ext_iovar_setbuf(dev, "sae_password", key, strlen(key),
+                               iovar_buf, WLC_IOCTL_SMLEN, NULL);
+               } else {
+                       AEXT_INFO(dev->name, "No securiy\n");
+                       wl_ext_iovar_setint(dev, "mesh_auth_proto", 0);
+                       wl_ext_iovar_setint(dev, "mfp", WL_MFP_NONE);
+               }
+       } else
+#endif /* WLMESH */
+       if (emode == ENC_WEP) {
+               wl_ext_ioctl(dev, WLC_SET_KEY, &wsec_key, sizeof(wsec_key), 1);
+       } else if (emode == ENC_TKIP || emode == ENC_AES || emode == ENC_TKIPAES) {
+               if (cur_if->ifmode == ISTA_MODE)
+                       wl_ext_iovar_setint(dev, "sup_wpa", 1);
+               wl_ext_ioctl(dev, WLC_SET_WSEC_PMK, &psk, sizeof(psk), 1);
+       }
+
+       return 0;
+}
+
+static u32
+wl_ext_get_chanspec(struct wl_apsta_params *apsta_params,
+       struct net_device *dev)
+{
+       int ret = 0;
+       struct ether_addr bssid;
+       u32 chanspec = 0;
+
+       ret = wldev_ioctl(dev, WLC_GET_BSSID, &bssid, sizeof(bssid), 0);
+       if (ret != BCME_NOTASSOCIATED && memcmp(&ether_null, &bssid, ETHER_ADDR_LEN)) {
+               if (wl_ext_iovar_getint(dev, "chanspec", (s32 *)&chanspec) == BCME_OK) {
+                       chanspec = wl_ext_chspec_driver_to_host(apsta_params->ioctl_ver, chanspec);
+                       return chanspec;
+               }
+       }
+
+       return 0;
+}
+
+static uint16
+wl_ext_get_chan(struct wl_apsta_params *apsta_params, struct net_device *dev)
+{
+       int ret = 0;
+       uint16 chan = 0, ctl_chan;
+       struct ether_addr bssid;
+       u32 chanspec = 0;
+
+       ret = wldev_ioctl(dev, WLC_GET_BSSID, &bssid, sizeof(bssid), 0);
+       if (ret != BCME_NOTASSOCIATED && memcmp(&ether_null, &bssid, ETHER_ADDR_LEN)) {
+               if (wl_ext_iovar_getint(dev, "chanspec", (s32 *)&chanspec) == BCME_OK) {
+                       chanspec = wl_ext_chspec_driver_to_host(apsta_params->ioctl_ver, chanspec);
+                       ctl_chan = wf_chspec_ctlchan(chanspec);
+                       chan = (u16)(ctl_chan & 0x00FF);
+                       return chan;
+               }
+       }
+
+       return 0;
+}
+
+static chanspec_t
+wl_ext_chan_to_chanspec(struct wl_apsta_params *apsta_params,
+       struct net_device *dev, uint16 channel)
+{
+       s32 _chan = channel;
+       chanspec_t chspec = 0;
+       chanspec_t fw_chspec = 0;
+       u32 bw = WL_CHANSPEC_BW_20;
+       s32 err = BCME_OK;
+       s32 bw_cap = 0;
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       struct {
+               u32 band;
+               u32 bw_cap;
+       } param = {0, 0};
+       uint band;
+
+       if (_chan <= CH_MAX_2G_CHANNEL)
+               band = IEEE80211_BAND_2GHZ;
+       else
+               band = IEEE80211_BAND_5GHZ;
+
+       if (band == IEEE80211_BAND_5GHZ) {
+               param.band = WLC_BAND_5G;
+               err = wl_ext_iovar_getbuf(dev, "bw_cap", &param, sizeof(param),
+                       iovar_buf, WLC_IOCTL_SMLEN, NULL);
+               if (err) {
+                       if (err != BCME_UNSUPPORTED) {
+                               AEXT_ERROR(dev->name, "bw_cap failed, %d\n", err);
+                               return err;
+                       } else {
+                               err = wl_ext_iovar_getint(dev, "mimo_bw_cap", &bw_cap);
+                               if (bw_cap != WLC_N_BW_20ALL)
+                                       bw = WL_CHANSPEC_BW_40;
+                       }
+               } else {
+                       if (WL_BW_CAP_80MHZ(iovar_buf[0]))
+                               bw = WL_CHANSPEC_BW_80;
+                       else if (WL_BW_CAP_40MHZ(iovar_buf[0]))
+                               bw = WL_CHANSPEC_BW_40;
+                       else
+                               bw = WL_CHANSPEC_BW_20;
+               }
+       }
+       else if (band == IEEE80211_BAND_2GHZ)
+               bw = WL_CHANSPEC_BW_20;
+
+set_channel:
+       chspec = wf_channel2chspec(_chan, bw);
+       if (wf_chspec_valid(chspec)) {
+               fw_chspec = wl_ext_chspec_host_to_driver(apsta_params->ioctl_ver, chspec);
+               if (fw_chspec == INVCHANSPEC) {
+                       AEXT_ERROR(dev->name, "failed to convert host chanspec to fw chanspec\n");
+                       fw_chspec = 0;
+               }
+       } else {
+               if (bw == WL_CHANSPEC_BW_80)
+                       bw = WL_CHANSPEC_BW_40;
+               else if (bw == WL_CHANSPEC_BW_40)
+                       bw = WL_CHANSPEC_BW_20;
+               else
+                       bw = 0;
+               if (bw)
+                       goto set_channel;
+               AEXT_ERROR(dev->name, "Invalid chanspec 0x%x\n", chspec);
+               err = BCME_ERROR;
+       }
+
+       return fw_chspec;
+}
+
+static bool
+wl_ext_radar_detect(struct net_device *dev)
+{
+       int ret = BCME_OK;
+       bool radar = FALSE;
+       s32 val = 0;
+
+       if ((ret = wldev_ioctl(dev, WLC_GET_RADAR, &val, sizeof(int), false) == 0)) {
+               radar = TRUE;
+       }
+
+       return radar;
+}
+
+static struct wl_if_info *
+wl_ext_if_enabled(struct wl_apsta_params *apsta_params, ifmode_t ifmode)
+{
+       struct wl_if_info *tmp_if, *target_if = NULL;
+       int i;
+
+       for (i=0; i<MAX_IF_NUM; i++) {
+               tmp_if = &apsta_params->if_info[i];
+               if (tmp_if && tmp_if->ifmode == ifmode &&
+                               wl_get_isam_status(tmp_if, IF_READY)) {
+                       if (wl_ext_get_chan(apsta_params, tmp_if->dev)) {
+                               target_if = tmp_if;
+                               break;
+                       }
+               }
+       }
+
+       return target_if;
+}
+
+#ifndef WL_STATIC_IF
+s32
+wl_ext_add_del_bss(struct net_device *ndev, s32 bsscfg_idx,
+       int iftype, s32 del, u8 *addr)
+{
+       s32 ret = BCME_OK;
+       s32 val = 0;
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+       struct {
+               s32 cfg;
+               s32 val;
+               struct ether_addr ea;
+       } bss_setbuf;
+
+       AEXT_TRACE(ndev->name, "wl_iftype:%d del:%d \n", iftype, del);
+
+       bzero(&bss_setbuf, sizeof(bss_setbuf));
+
+       /* AP=2, STA=3, up=1, down=0, val=-1 */
+       if (del) {
+               val = WLC_AP_IOV_OP_DELETE;
+       } else if (iftype == WL_INTERFACE_CREATE_AP) {
+               /* Add/role change to AP Interface */
+               AEXT_TRACE(ndev->name, "Adding AP Interface\n");
+               val = WLC_AP_IOV_OP_MANUAL_AP_BSSCFG_CREATE;
+       } else if (iftype == WL_INTERFACE_CREATE_STA) {
+               /* Add/role change to STA Interface */
+               AEXT_TRACE(ndev->name, "Adding STA Interface\n");
+               val = WLC_AP_IOV_OP_MANUAL_STA_BSSCFG_CREATE;
+       } else {
+               AEXT_ERROR(ndev->name, "add_del_bss NOT supported for IFACE type:0x%x", iftype);
+               return -EINVAL;
+       }
+
+       if (!del) {
+               wl_ext_bss_iovar_war(ndev, &val);
+       }
+
+       bss_setbuf.cfg = htod32(bsscfg_idx);
+       bss_setbuf.val = htod32(val);
+
+       if (addr) {
+               memcpy(&bss_setbuf.ea.octet, addr, ETH_ALEN);
+       }
+
+       AEXT_INFO(ndev->name, "wl bss %d bssidx:%d\n", val, bsscfg_idx);
+       ret = wl_ext_iovar_setbuf(ndev, "bss", &bss_setbuf, sizeof(bss_setbuf),
+               ioctl_buf, WLC_IOCTL_SMLEN, NULL);
+       if (ret != 0)
+               WL_ERR(("'bss %d' failed with %d\n", val, ret));
+
+       return ret;
+}
+
+static int
+wl_ext_interface_ops(struct net_device *dev,
+       struct wl_apsta_params *apsta_params, int iftype, u8 *addr)
+{
+       s32 ret;
+       struct wl_interface_create_v2 iface;
+       wl_interface_create_v3_t iface_v3;
+       struct wl_interface_info_v1 *info;
+       wl_interface_info_v2_t *info_v2;
+       uint32 ifflags = 0;
+       bool use_iface_info_v2 = false;
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+       wl_wlc_version_t wlc_ver;
+
+       /* Interface create */
+       bzero(&iface, sizeof(iface));
+
+       if (addr) {
+               ifflags |= WL_INTERFACE_MAC_USE;
+       }
+
+       ret = wldev_iovar_getbuf(dev, "wlc_ver", NULL, 0,
+               &wlc_ver, sizeof(wl_wlc_version_t), NULL);
+       if ((ret == BCME_OK) && (wlc_ver.wlc_ver_major >= 5)) {
+               ret = wldev_iovar_getbuf(dev, "interface_create",
+                       &iface, sizeof(struct wl_interface_create_v2),
+                       ioctl_buf, sizeof(ioctl_buf), NULL);
+               if ((ret == BCME_OK) && (*((uint32 *)ioctl_buf) == WL_INTERFACE_CREATE_VER_3)) {
+                       use_iface_info_v2 = true;
+                       bzero(&iface_v3, sizeof(wl_interface_create_v3_t));
+                       iface_v3.ver = WL_INTERFACE_CREATE_VER_3;
+                       iface_v3.iftype = iftype;
+                       iface_v3.flags = ifflags;
+                       if (addr) {
+                               memcpy(&iface_v3.mac_addr.octet, addr, ETH_ALEN);
+                       }
+                       ret = wl_ext_iovar_getbuf(dev, "interface_create",
+                               &iface_v3, sizeof(wl_interface_create_v3_t),
+                               ioctl_buf, sizeof(ioctl_buf), NULL);
+                       if (unlikely(ret)) {
+                               WL_ERR(("Interface v3 create failed!! ret %d\n", ret));
+                               return ret;
+                       }
+               }
+       }
+
+       /* success case */
+       if (use_iface_info_v2 == true) {
+               info_v2 = (wl_interface_info_v2_t *)ioctl_buf;
+               ret = info_v2->bsscfgidx;
+       } else {
+               /* Use v1 struct */
+               iface.ver = WL_INTERFACE_CREATE_VER_2;
+               iface.iftype = iftype;
+               iface.flags = ifflags;
+               if (addr) {
+                       memcpy(&iface.mac_addr.octet, addr, ETH_ALEN);
+               }
+               ret = wldev_iovar_getbuf(dev, "interface_create",
+                       &iface, sizeof(struct wl_interface_create_v2),
+                       ioctl_buf, sizeof(ioctl_buf), NULL);
+               if (ret == BCME_OK) {
+                       info = (struct wl_interface_info_v1 *)ioctl_buf;
+                       ret = info->bsscfgidx;
+               }
+       }
+
+       AEXT_INFO(dev->name, "wl interface create success!! bssidx:%d \n", ret);
+       return ret;
+}
+
+static void
+wl_ext_wait_netif_change(struct wl_apsta_params *apsta_params,
+       struct wl_if_info *cur_if)
+{
+       rtnl_unlock();
+       wait_event_interruptible_timeout(apsta_params->netif_change_event,
+               wl_get_isam_status(cur_if, IF_READY),
+               msecs_to_jiffies(MAX_AP_LINK_WAIT_TIME));
+       rtnl_lock();
+}
+
+static void
+wl_ext_interface_create(struct net_device *dev, struct wl_apsta_params *apsta_params,
+       struct wl_if_info *cur_if, int iftype, u8 *addr)
+{
+       s32 ret;
+
+       wl_set_isam_status(cur_if, IF_ADDING);
+       ret = wl_ext_interface_ops(dev, apsta_params, iftype, addr);
+       if (ret == BCME_UNSUPPORTED) {
+               wl_ext_add_del_bss(dev, 1, iftype, 0, addr);
+       }
+       wl_ext_wait_netif_change(apsta_params, cur_if);
+}
+
+static void
+wl_ext_iapsta_intf_add(struct net_device *dev, struct wl_apsta_params *apsta_params)
+{
+       struct dhd_pub *dhd;
+       apstamode_t apstamode = apsta_params->apstamode;
+       struct wl_if_info *cur_if;
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       wl_p2p_if_t ifreq;
+       struct ether_addr mac_addr;
+
+       dhd = dhd_get_pub(dev);
+       bzero(&mac_addr, sizeof(mac_addr));
+
+       if (apstamode == ISTAAP_MODE) {
+               cur_if = &apsta_params->if_info[IF_VIF];
+               wl_ext_interface_create(dev, apsta_params, cur_if, WL_INTERFACE_CREATE_AP, NULL);
+       }
+       else if (apstamode == ISTAGO_MODE) {
+               bzero(&ifreq, sizeof(wl_p2p_if_t));
+               ifreq.type = htod32(WL_P2P_IF_GO);
+               cur_if = &apsta_params->if_info[IF_VIF];
+               wl_set_isam_status(cur_if, IF_ADDING);
+               wl_ext_iovar_setbuf(dev, "p2p_ifadd", &ifreq, sizeof(ifreq),
+                       iovar_buf, WLC_IOCTL_SMLEN, NULL);
+               wl_ext_wait_netif_change(apsta_params, cur_if);
+       }
+       else if (apstamode == ISTASTA_MODE) {
+               cur_if = &apsta_params->if_info[IF_VIF];
+               memcpy(&mac_addr, dev->dev_addr, ETHER_ADDR_LEN);
+               mac_addr.octet[0] |= 0x02;
+               wl_ext_interface_create(dev, apsta_params, cur_if, WL_INTERFACE_CREATE_STA,
+                       (u8*)&mac_addr);
+       }
+       else if (apstamode == IDUALAP_MODE) {
+               cur_if = &apsta_params->if_info[IF_VIF];
+               wl_ext_interface_create(dev, apsta_params, cur_if, WL_INTERFACE_CREATE_AP, NULL);
+       }
+       else if (apstamode == ISTAAPAP_MODE) {
+               u8 rand_bytes[2] = {0, };
+               get_random_bytes(&rand_bytes, sizeof(rand_bytes));
+               cur_if = &apsta_params->if_info[IF_VIF];
+               memcpy(&mac_addr, dev->dev_addr, ETHER_ADDR_LEN);
+               mac_addr.octet[0] |= 0x02;
+               mac_addr.octet[5] += 0x01;
+               memcpy(&mac_addr.octet[3], rand_bytes, sizeof(rand_bytes));
+               wl_ext_interface_create(dev, apsta_params, cur_if, WL_INTERFACE_CREATE_AP,
+                       (u8*)&mac_addr);
+               cur_if = &apsta_params->if_info[IF_VIF2];
+               memcpy(&mac_addr, dev->dev_addr, ETHER_ADDR_LEN);
+               mac_addr.octet[0] |= 0x02;
+               mac_addr.octet[5] += 0x02;
+               memcpy(&mac_addr.octet[3], rand_bytes, sizeof(rand_bytes));
+               wl_ext_interface_create(dev, apsta_params, cur_if, WL_INTERFACE_CREATE_AP,
+                       (u8*)&mac_addr);
+       }
+#ifdef WLMESH
+       else if (apstamode == ISTAMESH_MODE) {
+               cur_if = &apsta_params->if_info[IF_VIF];
+               wl_ext_interface_create(dev, apsta_params, cur_if, WL_INTERFACE_CREATE_STA, NULL);
+       }
+       else if (apstamode == IMESHAP_MODE) {
+               cur_if = &apsta_params->if_info[IF_VIF];
+               wl_ext_interface_create(dev, apsta_params, cur_if, WL_INTERFACE_CREATE_AP, NULL);
+       }
+       else if (apstamode == ISTAAPMESH_MODE) {
+               cur_if = &apsta_params->if_info[IF_VIF];
+               wl_ext_interface_create(dev, apsta_params, cur_if, WL_INTERFACE_CREATE_AP, NULL);
+               cur_if = &apsta_params->if_info[IF_VIF2];
+               wl_ext_interface_create(dev, apsta_params, cur_if, WL_INTERFACE_CREATE_STA, NULL);
+       }
+       else if (apstamode == IMESHAPAP_MODE) {
+               cur_if = &apsta_params->if_info[IF_VIF];
+               wl_ext_interface_create(dev, apsta_params, cur_if, WL_INTERFACE_CREATE_AP, NULL);
+               cur_if = &apsta_params->if_info[IF_VIF2];
+               wl_ext_interface_create(dev, apsta_params, cur_if, WL_INTERFACE_CREATE_AP, NULL);
+       }
+#endif /* WLMESH */
+
+}
+#endif /* WL_STATIC_IF */
+
+static void
+wl_ext_iapsta_preinit(struct net_device *dev, struct wl_apsta_params *apsta_params)
+{
+       struct dhd_pub *dhd;
+       apstamode_t apstamode = apsta_params->apstamode;
+       struct wl_if_info *cur_if;
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       s32 val = 0;
+       int i;
+
+       dhd = dhd_get_pub(dev);
+
+       for (i=0; i<MAX_IF_NUM; i++) {
+               cur_if = &apsta_params->if_info[i];
+               if (i >= 1 && !strlen(cur_if->ifname))
+                       snprintf(cur_if->ifname, IFNAMSIZ, "wlan%d", i);
+               if (cur_if->ifmode == ISTA_MODE) {
+                       cur_if->channel = 0;
+                       cur_if->maxassoc = -1;
+                       cur_if->prio = PRIO_STA;
+                       cur_if->prefix = 'S';
+                       snprintf(cur_if->ssid, DOT11_MAX_SSID_LEN, "ttt_sta");
+               } else if (cur_if->ifmode == IAP_MODE) {
+                       cur_if->channel = 1;
+                       cur_if->maxassoc = -1;
+                       cur_if->prio = PRIO_AP;
+                       cur_if->prefix = 'A';
+                       snprintf(cur_if->ssid, DOT11_MAX_SSID_LEN, "ttt_ap");
+#ifdef WLMESH
+               } else if (cur_if->ifmode == IMESH_MODE) {
+                       cur_if->channel = 1;
+                       cur_if->maxassoc = -1;
+                       cur_if->prio = PRIO_MESH;
+                       cur_if->prefix = 'M';
+                       snprintf(cur_if->ssid, DOT11_MAX_SSID_LEN, "ttt_mesh");
+#ifdef WL_ESCAN
+                       if (i == 0 && apsta_params->macs)
+                               wl_mesh_escan_attach(dhd, cur_if);
+#endif /* WL_ESCAN */
+#endif /* WLMESH */
+               }
+       }
+
+       if (FW_SUPPORTED(dhd, rsdb)) {
+               if (apstamode == IDUALAP_MODE)
+                       apsta_params->rsdb = -1;
+               else if (apstamode == ISTAAPAP_MODE)
+                       apsta_params->rsdb = 0;
+               if (apstamode == ISTAAPAP_MODE || apstamode == IDUALAP_MODE ||
+                               apstamode == IMESHONLY_MODE || apstamode == ISTAMESH_MODE ||
+                               apstamode == IMESHAP_MODE || apstamode == ISTAAPMESH_MODE ||
+                               apstamode == IMESHAPAP_MODE) {
+                       wl_config_t rsdb_mode_cfg = {0, 0};
+                       rsdb_mode_cfg.config = apsta_params->rsdb;
+                       AEXT_INFO(dev->name, "set rsdb_mode %d\n", rsdb_mode_cfg.config);
+                       wl_ext_ioctl(dev, WLC_DOWN, NULL, 0, 1);
+                       wl_ext_iovar_setbuf(dev, "rsdb_mode", &rsdb_mode_cfg,
+                               sizeof(rsdb_mode_cfg), iovar_buf, sizeof(iovar_buf), NULL);
+                       wl_ext_ioctl(dev, WLC_UP, NULL, 0, 1);
+               }
+       } else {
+               apsta_params->rsdb = 0;
+       }
+
+       if (apstamode == ISTAONLY_MODE) {
+               wl_ext_ioctl(dev, WLC_DOWN, NULL, 0, 1);
+               wl_ext_iovar_setint(dev, "apsta", 1); // keep 1 as we set in dhd_preinit_ioctls
+               // don't set WLC_SET_AP to 0, some parameters will be reset, such as bcn_timeout and roam_off
+               wl_ext_ioctl(dev, WLC_UP, NULL, 0, 1);
+       } else if (apstamode == IAPONLY_MODE) {
+               wl_ext_ioctl(dev, WLC_DOWN, NULL, 0, 1);
+#ifdef ARP_OFFLOAD_SUPPORT
+               /* IF SoftAP is enabled, disable arpoe */
+               dhd_arp_offload_set(dhd, 0);
+               dhd_arp_offload_enable(dhd, FALSE);
+#endif /* ARP_OFFLOAD_SUPPORT */
+               wl_ext_iovar_setint(dev, "mpc", 0);
+               wl_ext_iovar_setint(dev, "apsta", 0);
+               val = 1;
+               wl_ext_ioctl(dev, WLC_SET_AP, &val, sizeof(val), 1);
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+               if (!(FW_SUPPORTED(dhd, rsdb)) && !disable_proptx) {
+                       bool enabled;
+                       dhd_wlfc_get_enable(dhd, &enabled);
+                       if (!enabled) {
+                               dhd_wlfc_init(dhd);
+                               wl_ext_ioctl(dev, WLC_UP, NULL, 0, 1);
+                       }
+               }
+#endif /* BCMSDIO */
+#endif /* PROP_TXSTATUS_VSDB */
+       }
+       else if (apstamode == ISTAAP_MODE) {
+               wl_ext_ioctl(dev, WLC_DOWN, NULL, 0, 1);
+               wl_ext_iovar_setint(dev, "mpc", 0);
+               wl_ext_iovar_setint(dev, "apsta", 1);
+               wl_ext_ioctl(dev, WLC_UP, NULL, 0, 1);
+       }
+       else if (apstamode == ISTAGO_MODE) {
+               wl_ext_ioctl(dev, WLC_DOWN, NULL, 0, 1);
+               wl_ext_iovar_setint(dev, "apsta", 1);
+               wl_ext_ioctl(dev, WLC_UP, NULL, 0, 1);
+       }
+       else if (apstamode == ISTASTA_MODE) {
+       }
+       else if (apstamode == IDUALAP_MODE) {
+               wl_ext_ioctl(dev, WLC_DOWN, NULL, 0, 1);
+               /* IF SoftAP is enabled, disable arpoe or wlan1 will ping fail */
+#ifdef ARP_OFFLOAD_SUPPORT
+               /* IF SoftAP is enabled, disable arpoe */
+               dhd_arp_offload_set(dhd, 0);
+               dhd_arp_offload_enable(dhd, FALSE);
+#endif /* ARP_OFFLOAD_SUPPORT */
+               wl_ext_iovar_setint(dev, "mpc", 0);
+               wl_ext_iovar_setint(dev, "mbcn", 1);
+               wl_ext_iovar_setint(dev, "apsta", 0);
+               wl_ext_ioctl(dev, WLC_UP, NULL, 0, 1);
+               val = 1;
+               wl_ext_ioctl(dev, WLC_SET_AP, &val, sizeof(val), 1);
+       }
+       else if (apstamode == ISTAAPAP_MODE) {
+               wl_ext_ioctl(dev, WLC_DOWN, NULL, 0, 1);
+               wl_ext_iovar_setint(dev, "mpc", 0);
+               wl_ext_iovar_setint(dev, "mbss", 1);
+               wl_ext_iovar_setint(dev, "apsta", 1); // keep 1 as we set in dhd_preinit_ioctls
+               wl_ext_ioctl(dev, WLC_UP, NULL, 0, 1);
+               // don't set WLC_SET_AP to 0, some parameters will be reset, such as bcn_timeout and roam_off
+       }
+#ifdef WLMESH
+       else if (apstamode == IMESHONLY_MODE || apstamode == ISTAMESH_MODE ||
+                       apstamode == IMESHAP_MODE || apstamode == ISTAAPMESH_MODE ||
+                       apstamode == IMESHAPAP_MODE) {
+               int pm = 0;
+               wl_ext_ioctl(dev, WLC_DOWN, NULL, 0, 1);
+               wl_ext_iovar_setint(dev, "mpc", 0);
+               if (apstamode == IMESHONLY_MODE)
+                       wl_ext_ioctl(dev, WLC_SET_PM, &pm, sizeof(pm), 1);
+               else
+                       wl_ext_iovar_setint(dev, "mbcn", 1);
+               wl_ext_iovar_setint(dev, "apsta", 1); // keep 1 as we set in dhd_preinit_ioctls
+               wl_ext_ioctl(dev, WLC_UP, NULL, 0, 1);
+               // don't set WLC_SET_AP to 0, some parameters will be reset, such as bcn_timeout and roam_off
+       }
+#endif /* WLMESH */
+
+       wl_ext_get_ioctl_ver(dev, &apsta_params->ioctl_ver);
+       apsta_params->init = TRUE;
+
+       WL_MSG(dev->name, "apstamode=%d\n", apstamode);
+}
+
+static int
+wl_ext_isam_param(struct net_device *dev, char *command, int total_len)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       int ret = -1;
+       char *pick_tmp, *data, *param;
+       int bytes_written=-1;
+
+       AEXT_TRACE(dev->name, "command=%s, len=%d\n", command, total_len);
+
+       pick_tmp = command;
+       param = bcmstrtok(&pick_tmp, " ", 0); // pick isam_param
+       param = bcmstrtok(&pick_tmp, " ", 0); // pick cmd
+       while (param != NULL) {
+               data = bcmstrtok(&pick_tmp, " ", 0); // pick data
+               if (!strcmp(param, "acs")) {
+                       if (data) {
+                               apsta_params->acs = simple_strtol(data, NULL, 0);
+                               ret = 0;
+                       } else {
+                               bytes_written = snprintf(command, total_len, "%d", apsta_params->acs);
+                               ret = bytes_written;
+                               goto exit;
+                       }
+               }
+               param = bcmstrtok(&pick_tmp, " ", 0); // pick cmd
+       }
+
+exit:
+       return ret;
+}
+
+static int
+wl_ext_isam_init(struct net_device *dev, char *command, int total_len)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       char *pch, *pick_tmp, *pick_tmp2, *param;
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       int i;
+
+       if (apsta_params->init) {
+               AEXT_ERROR(dev->name, "don't init twice\n");
+               return -1;
+       }
+       AEXT_TRACE(dev->name, "command=%s, len=%d\n", command, total_len);
+
+       pick_tmp = command;
+       param = bcmstrtok(&pick_tmp, " ", 0); // skip iapsta_init
+       param = bcmstrtok(&pick_tmp, " ", 0);
+       while (param != NULL) {
+               pick_tmp2 = bcmstrtok(&pick_tmp, " ", 0);
+               if (!pick_tmp2) {
+                       AEXT_ERROR(dev->name, "wrong param %s\n", param);
+                       return -1;
+               }
+               if (!strcmp(param, "mode")) {
+                       pch = NULL;
+                       if (!strcmp(pick_tmp2, "sta")) {
+                               apsta_params->apstamode = ISTAONLY_MODE;
+                       } else if (!strcmp(pick_tmp2, "ap")) {
+                               apsta_params->apstamode = IAPONLY_MODE;
+                       } else if (!strcmp(pick_tmp2, "sta-ap")) {
+                               apsta_params->apstamode = ISTAAP_MODE;
+                       } else if (!strcmp(pick_tmp2, "sta-sta")) {
+                               apsta_params->apstamode = ISTASTA_MODE;
+                               apsta_params->vsdb = TRUE;
+                       } else if (!strcmp(pick_tmp2, "ap-ap")) {
+                               apsta_params->apstamode = IDUALAP_MODE;
+                       } else if (!strcmp(pick_tmp2, "sta-ap-ap")) {
+                               apsta_params->apstamode = ISTAAPAP_MODE;
+                       } else if (!strcmp(pick_tmp2, "apsta")) {
+                               apsta_params->apstamode = ISTAAP_MODE;
+                               apsta_params->if_info[IF_PIF].ifmode = ISTA_MODE;
+                               apsta_params->if_info[IF_VIF].ifmode = IAP_MODE;
+                       } else if (!strcmp(pick_tmp2, "dualap")) {
+                               apsta_params->apstamode = IDUALAP_MODE;
+                               apsta_params->if_info[IF_PIF].ifmode = IAP_MODE;
+                               apsta_params->if_info[IF_VIF].ifmode = IAP_MODE;
+                       } else if (!strcmp(pick_tmp2, "sta-go") ||
+                                       !strcmp(pick_tmp2, "gosta")) {
+                               if (!FW_SUPPORTED(dhd, p2p)) {
+                                       return -1;
+                               }
+                               apsta_params->apstamode = ISTAGO_MODE;
+                               apsta_params->if_info[IF_PIF].ifmode = ISTA_MODE;
+                               apsta_params->if_info[IF_VIF].ifmode = IAP_MODE;
+#ifdef WLMESH
+                       } else if (!strcmp(pick_tmp2, "mesh")) {
+                               apsta_params->apstamode = IMESHONLY_MODE;
+                       } else if (!strcmp(pick_tmp2, "sta-mesh")) {
+                               apsta_params->apstamode = ISTAMESH_MODE;
+                       } else if (!strcmp(pick_tmp2, "sta-ap-mesh")) {
+                               apsta_params->apstamode = ISTAAPMESH_MODE;
+                       } else if (!strcmp(pick_tmp2, "mesh-ap")) {
+                               apsta_params->apstamode = IMESHAP_MODE;
+                       } else if (!strcmp(pick_tmp2, "mesh-ap-ap")) {
+                               apsta_params->apstamode = IMESHAPAP_MODE;
+#endif /* WLMESH */
+                       } else {
+                               AEXT_ERROR(dev->name, "mode [sta|ap|sta-ap|ap-ap]\n");
+                               return -1;
+                       }
+                       pch = bcmstrtok(&pick_tmp2, " -", 0);
+                       for (i=0; i<MAX_IF_NUM && pch; i++) {
+                               if (!strcmp(pch, "sta"))
+                                       apsta_params->if_info[i].ifmode = ISTA_MODE;
+                               else if (!strcmp(pch, "ap"))
+                                       apsta_params->if_info[i].ifmode = IAP_MODE;
+#ifdef WLMESH
+                               else if (!strcmp(pch, "mesh")) {
+                                       if (dhd->conf->fw_type != FW_TYPE_MESH) {
+                                               AEXT_ERROR(dev->name, "wrong fw type\n");
+                                               return -1;
+                                       }
+                                       apsta_params->if_info[i].ifmode = IMESH_MODE;
+                               }
+#endif /* WLMESH */
+                               pch = bcmstrtok(&pick_tmp2, " -", 0);
+                       }
+               }
+               else if (!strcmp(param, "rsdb")) {
+                       apsta_params->rsdb = (int)simple_strtol(pick_tmp2, NULL, 0);
+               } else if (!strcmp(param, "vsdb")) {
+                       if (!strcmp(pick_tmp2, "y")) {
+                               apsta_params->vsdb = TRUE;
+                       } else if (!strcmp(pick_tmp2, "n")) {
+                               apsta_params->vsdb = FALSE;
+                       } else {
+                               AEXT_ERROR(dev->name, "vsdb [y|n]\n");
+                               return -1;
+                       }
+               } else if (!strcmp(param, "csa")) {
+                       apsta_params->csa = (int)simple_strtol(pick_tmp2, NULL, 0);
+               } else if (!strcmp(param, "acs")) {
+                       apsta_params->acs = (int)simple_strtol(pick_tmp2, NULL, 0);
+#if defined(WLMESH) && defined(WL_ESCAN)
+               } else if (!strcmp(param, "macs")) {
+                       apsta_params->macs = (int)simple_strtol(pick_tmp2, NULL, 0);
+#endif /* WLMESH && WL_ESCAN */
+               } else if (!strcmp(param, "ifname")) {
+                       pch = NULL;
+                       pch = bcmstrtok(&pick_tmp2, " -", 0);
+                       for (i=0; i<MAX_IF_NUM && pch; i++) {
+                               strcpy(apsta_params->if_info[i].ifname, pch);
+                               pch = bcmstrtok(&pick_tmp2, " -", 0);
+                       }
+               } else if (!strcmp(param, "vifname")) {
+                       strcpy(apsta_params->if_info[IF_VIF].ifname, pick_tmp2);
+               }
+               param = bcmstrtok(&pick_tmp, " ", 0);
+       }
+
+       if (apsta_params->apstamode == 0) {
+               AEXT_ERROR(dev->name, "mode [sta|ap|sta-ap|ap-ap]\n");
+               return -1;
+       }
+
+       wl_ext_iapsta_preinit(dev, apsta_params);
+#ifndef WL_STATIC_IF
+       wl_ext_iapsta_intf_add(dev, apsta_params);
+#endif /* WL_STATIC_IF */
+
+       return 0;
+}
+
+static int
+wl_ext_parse_config(struct wl_if_info *cur_if, char *command, char **pick_next)
+{
+       char *pch, *pick_tmp;
+       char name[20], data[100];
+       int i, j, len;
+       char *ifname_head = NULL;
+
+       typedef struct config_map_t {
+               char name[20];
+               char *head;
+               char *tail;
+       } config_map_t;
+
+       config_map_t config_map [] = {
+               {" ifname ",    NULL, NULL},
+               {" ssid ",              NULL, NULL},
+               {" bssid ",     NULL, NULL},
+               {" bgnmode ",   NULL, NULL},
+               {" hidden ",    NULL, NULL},
+               {" maxassoc ",  NULL, NULL},
+               {" chan ",              NULL, NULL},
+               {" amode ",     NULL, NULL},
+               {" emode ",     NULL, NULL},
+               {" key ",               NULL, NULL},
+       };
+       config_map_t *row, *row_prev;
+
+       pick_tmp = command;
+
+       // reset head and tail
+       for (i = 0; i < sizeof(config_map)/sizeof(config_map[0]); i++) {
+               row = &config_map[i];
+               row->head = NULL;
+               row->tail = pick_tmp + strlen(pick_tmp);
+       }
+
+       // pick head
+       for (i = 0; i < sizeof(config_map)/sizeof(config_map[0]); i++) {
+               row = &config_map[i];
+               pch = strstr(pick_tmp, row->name);
+               if (pch) {
+                       row->head = pch;
+               }
+       }
+
+       // sort by head
+       for (i = 0; i < sizeof(config_map)/sizeof(config_map[0]) - 1; i++) {
+               row_prev = &config_map[i];
+               for (j = i+1; j < sizeof(config_map)/sizeof(config_map[0]); j++) {
+                       row = &config_map[j];
+                       if (row->head < row_prev->head) {
+                               strcpy(name, row_prev->name);
+                               strcpy(row_prev->name, row->name);
+                               strcpy(row->name, name);
+                               pch = row_prev->head;
+                               row_prev->head = row->head;
+                               row->head = pch;
+                       }
+               }
+       }
+
+       // pick tail
+       for (i = 0; i < sizeof(config_map)/sizeof(config_map[0]) - 1; i++) {
+               row_prev = &config_map[i];
+               row = &config_map[i+1];
+               if (row_prev->head) {
+                       row_prev->tail = row->head;
+               }
+       }
+
+       // remove name from head
+       for (i = 0; i < sizeof(config_map)/sizeof(config_map[0]); i++) {
+               row = &config_map[i];
+               if (row->head) {
+                       if (!strcmp(row->name, " ifname ")) {
+                               ifname_head = row->head + 1;
+                               break;
+                       }
+                       row->head += strlen(row->name);
+               }
+       }
+
+       for (i = 0; i < sizeof(config_map)/sizeof(config_map[0]); i++) {
+               row = &config_map[i];
+               if (row->head) {
+                       memset(data, 0, sizeof(data));
+                       if (row->tail && row->tail > row->head) {
+                               strncpy(data, row->head, row->tail-row->head);
+                       } else {
+                               strcpy(data, row->head);
+                       }
+                       pick_tmp = data;
+
+                       if (!strcmp(row->name, " ifname ")) {
+                               break;
+                       } else if (!strcmp(row->name, " ssid ")) {
+                               len = strlen(pick_tmp);
+                               memset(cur_if->ssid, 0, sizeof(cur_if->ssid));
+                               if (pick_tmp[0] == '"' && pick_tmp[len-1] == '"')
+                                       strncpy(cur_if->ssid, &pick_tmp[1], len-2);
+                               else
+                                       strcpy(cur_if->ssid, pick_tmp);
+                       } else if (!strcmp(row->name, " bssid ")) {
+                               pch = bcmstrtok(&pick_tmp, ": ", 0);
+                               for (j=0; j<6 && pch; j++) {
+                                       ((u8 *)&cur_if->bssid)[j] = (int)simple_strtol(pch, NULL, 16);
+                                       pch = bcmstrtok(&pick_tmp, ": ", 0);
+                               }
+                       } else if (!strcmp(row->name, " bgnmode ")) {
+                               if (!strcmp(pick_tmp, "b"))
+                                       cur_if->bgnmode = IEEE80211B;
+                               else if (!strcmp(pick_tmp, "g"))
+                                       cur_if->bgnmode = IEEE80211G;
+                               else if (!strcmp(pick_tmp, "bg"))
+                                       cur_if->bgnmode = IEEE80211BG;
+                               else if (!strcmp(pick_tmp, "bgn"))
+                                       cur_if->bgnmode = IEEE80211BGN;
+                               else if (!strcmp(pick_tmp, "bgnac"))
+                                       cur_if->bgnmode = IEEE80211BGNAC;
+                               else {
+                                       AEXT_ERROR(cur_if->dev->name, "bgnmode [b|g|bg|bgn|bgnac]\n");
+                                       return -1;
+                               }
+                       } else if (!strcmp(row->name, " hidden ")) {
+                               if (!strcmp(pick_tmp, "n"))
+                                       cur_if->hidden = 0;
+                               else if (!strcmp(pick_tmp, "y"))
+                                       cur_if->hidden = 1;
+                               else {
+                                       AEXT_ERROR(cur_if->dev->name, "hidden [y|n]\n");
+                                       return -1;
+                               }
+                       } else if (!strcmp(row->name, " maxassoc ")) {
+                               cur_if->maxassoc = (int)simple_strtol(pick_tmp, NULL, 10);
+                       } else if (!strcmp(row->name, " chan ")) {
+                               cur_if->channel = (int)simple_strtol(pick_tmp, NULL, 10);
+                       } else if (!strcmp(row->name, " amode ")) {
+                               if (!strcmp(pick_tmp, "open"))
+                                       cur_if->amode = AUTH_OPEN;
+                               else if (!strcmp(pick_tmp, "shared"))
+                                       cur_if->amode = AUTH_SHARED;
+                               else if (!strcmp(pick_tmp, "wpapsk"))
+                                       cur_if->amode = AUTH_WPAPSK;
+                               else if (!strcmp(pick_tmp, "wpa2psk"))
+                                       cur_if->amode = AUTH_WPA2PSK;
+                               else if (!strcmp(pick_tmp, "wpawpa2psk"))
+                                       cur_if->amode = AUTH_WPAWPA2PSK;
+                               else if (!strcmp(pick_tmp, "sae"))
+                                       cur_if->amode = AUTH_SAE;
+                               else {
+                                       AEXT_ERROR(cur_if->dev->name, "amode [open|shared|wpapsk|wpa2psk|wpawpa2psk]\n");
+                                       return -1;
+                               }
+                       } else if (!strcmp(row->name, " emode ")) {
+                               if (!strcmp(pick_tmp, "none"))
+                                       cur_if->emode = ENC_NONE;
+                               else if (!strcmp(pick_tmp, "wep"))
+                                       cur_if->emode = ENC_WEP;
+                               else if (!strcmp(pick_tmp, "tkip"))
+                                       cur_if->emode = ENC_TKIP;
+                               else if (!strcmp(pick_tmp, "aes"))
+                                       cur_if->emode = ENC_AES;
+                               else if (!strcmp(pick_tmp, "tkipaes"))
+                                       cur_if->emode = ENC_TKIPAES;
+                               else {
+                                       AEXT_ERROR(cur_if->dev->name, "emode [none|wep|tkip|aes|tkipaes]\n");
+                                       return -1;
+                               }
+                       } else if (!strcmp(row->name, " key ")) {
+                               len = strlen(pick_tmp);
+                               memset(cur_if->key, 0, sizeof(cur_if->key));
+                               if (pick_tmp[0] == '"' && pick_tmp[len-1] == '"')
+                                       strncpy(cur_if->key, &pick_tmp[1], len-2);
+                               else
+                                       strcpy(cur_if->key, pick_tmp);
+                       }
+               }
+       }
+
+       *pick_next = ifname_head;
+       return 0;
+}
+
+static int
+wl_ext_iapsta_config(struct net_device *dev, char *command, int total_len)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       int ret=0, i;
+       char *pch, *pch2, *pick_tmp, *pick_next=NULL, *param;
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       char ifname[IFNAMSIZ+1];
+       struct wl_if_info *cur_if = NULL, *tmp_if = NULL;
+
+       if (!apsta_params->init) {
+               AEXT_ERROR(dev->name, "please init first\n");
+               return -1;
+       }
+
+       AEXT_TRACE(dev->name, "command=%s, len=%d\n", command, total_len);
+
+       pick_tmp = command;
+       param = bcmstrtok(&pick_tmp, " ", 0); // skip iapsta_config
+
+       mutex_lock(&apsta_params->usr_sync);
+
+       while (pick_tmp != NULL) {
+               memset(ifname, 0, IFNAMSIZ+1);
+               if (!strncmp(pick_tmp, "ifname ", strlen("ifname "))) {
+                       pch = pick_tmp + strlen("ifname ");
+                       pch2 = strchr(pch, ' ');
+                       if (pch && pch2) {
+                               strncpy(ifname, pch, pch2-pch);
+                       } else {
+                               AEXT_ERROR(dev->name, "ifname [wlanX]\n");
+                               ret = -1;
+                               break;
+                       }
+                       for (i=0; i<MAX_IF_NUM; i++) {
+                               tmp_if = &apsta_params->if_info[i];
+                               if (tmp_if->dev && !strcmp(tmp_if->dev->name, ifname)) {
+                                       cur_if = tmp_if;
+                                       break;
+                               }
+                       }
+                       if (!cur_if) {
+                               AEXT_ERROR(dev->name, "wrong ifname=%s in apstamode=%d\n",
+                                       ifname, apsta_params->apstamode);
+                               ret = -1;
+                               break;
+                       }
+                       ret = wl_ext_parse_config(cur_if, pick_tmp, &pick_next);
+                       if (ret)
+                               break;
+                       pick_tmp = pick_next;
+               } else {
+                       AEXT_ERROR(dev->name, "first arg must be ifname\n");
+                       ret = -1;
+                       break;
+               }
+
+       }
+
+       mutex_unlock(&apsta_params->usr_sync);
+
+       return ret;
+}
+
+static int
+wl_ext_assoclist(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       int ret = 0, i, maxassoc = 0, bytes_written = 0;
+       char mac_buf[MAX_NUM_OF_ASSOCLIST *
+               sizeof(struct ether_addr) + sizeof(uint)] = {0};
+       struct maclist *assoc_maclist = (struct maclist *)mac_buf;
+
+       assoc_maclist->count = htod32(MAX_NUM_OF_ASSOCLIST);
+       ret = wl_ext_ioctl(dev, WLC_GET_ASSOCLIST, assoc_maclist, sizeof(mac_buf), 0);
+       if (ret)
+               return -1;
+       maxassoc = dtoh32(assoc_maclist->count);
+       bytes_written += snprintf(command+bytes_written, total_len,
+               "%2s: %12s",
+               "no", "------addr------");
+       for (i=0; i<maxassoc; i++) {
+               bytes_written += snprintf(command+bytes_written, total_len,
+                       "\n%2d: %pM", i, &assoc_maclist->ea[i]);
+       }
+
+       return bytes_written;
+}
+
+#ifdef WLMESH
+static int
+wl_mesh_print_peer_info(mesh_peer_info_ext_t *mpi_ext,
+       uint32 peer_results_count, char *command, int total_len)
+{
+       char *peering_map[] = MESH_PEERING_STATE_STRINGS;
+       uint32 count = 0;
+       int bytes_written = 0;
+
+       bytes_written += snprintf(command+bytes_written, total_len,
+               "%2s: %12s : %6s : %-6s : %6s :"
+               " %5s : %4s : %4s : %11s : %4s",
+               "no", "------addr------ ", "l.aid", "state", "p.aid",
+               "mppid", "llid", "plid", "entry_state", "rssi");
+       for (count=0; count < peer_results_count; count++) {
+               if (mpi_ext->entry_state != MESH_SELF_PEER_ENTRY_STATE_TIMEDOUT) {
+                       bytes_written += snprintf(command+bytes_written, total_len,
+                               "\n%2d: %pM : 0x%4x : %6s : 0x%4x :"
+                               " %5d : %4d : %4d : %11s : %4d",
+                               count, &mpi_ext->ea, mpi_ext->local_aid,
+                               peering_map[mpi_ext->peer_info.state],
+                               mpi_ext->peer_info.peer_aid,
+                               mpi_ext->peer_info.mesh_peer_prot_id,
+                               mpi_ext->peer_info.local_link_id,
+                               mpi_ext->peer_info.peer_link_id,
+                               (mpi_ext->entry_state == MESH_SELF_PEER_ENTRY_STATE_ACTIVE) ?
+                               "ACTIVE" :
+                               "EXTERNAL",
+                               mpi_ext->rssi);
+               } else {
+                       bytes_written += snprintf(command+bytes_written, total_len,
+                               "\n%2d: %pM : %6s : %5s : %6s :"
+                               " %5s : %4s : %4s : %11s : %4s",
+                               count, &mpi_ext->ea, "  NA  ", "  NA  ", "  NA  ",
+                               "  NA ", " NA ", " NA ", "  TIMEDOUT ", " NA ");
+               }
+               mpi_ext++;
+       }
+
+       return bytes_written;
+}
+
+static int
+wl_mesh_get_peer_results(struct net_device *dev, char *buf, int len)
+{
+       int indata, inlen;
+       mesh_peer_info_dump_t *peer_results;
+       int ret;
+
+       memset(buf, 0, len);
+       peer_results = (mesh_peer_info_dump_t *)buf;
+       indata = htod32(len);
+       inlen = 4;
+       ret = wl_ext_iovar_getbuf(dev, "mesh_peer_status", &indata, inlen, buf, len, NULL);
+       if (!ret) {
+               peer_results = (mesh_peer_info_dump_t *)buf;
+               ret = peer_results->count;
+       }
+
+       return ret;
+}
+
+static int
+wl_ext_mesh_peer_status(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       int i;
+       struct wl_if_info *cur_if;
+       mesh_peer_info_dump_t *peer_results;
+       mesh_peer_info_ext_t *mpi_ext;
+       char *peer_buf = NULL;
+       int peer_len = WLC_IOCTL_MAXLEN;
+       int dump_written = 0, ret;
+
+       if (!data) {
+               peer_buf = kmalloc(peer_len, GFP_KERNEL);
+               if (peer_buf == NULL) {
+                       AEXT_ERROR(dev->name, "Failed to allocate buffer of %d bytes\n",
+                               peer_len); 
+                       return -1;
+               }
+               for (i=0; i<MAX_IF_NUM; i++) {
+                       cur_if = &apsta_params->if_info[i];
+                       if (cur_if && dev == cur_if->dev && cur_if->ifmode == IMESH_MODE) {
+                               memset(peer_buf, 0, peer_len);
+                               ret = wl_mesh_get_peer_results(dev, peer_buf, peer_len);
+                               if (ret >= 0) {
+                                       peer_results = (mesh_peer_info_dump_t *)peer_buf;
+                                       mpi_ext = (mesh_peer_info_ext_t *)peer_results->mpi_ext;
+                                       dump_written += wl_mesh_print_peer_info(mpi_ext,
+                                               peer_results->count, command+dump_written,
+                                               total_len-dump_written);
+                               }
+                       } else if (cur_if && dev == cur_if->dev) {
+                               AEXT_ERROR(dev->name, "[%s][%c] is not mesh interface\n",
+                                       cur_if->ifname, cur_if->prefix);
+                       }
+               }
+       }
+
+       if (peer_buf)
+               kfree(peer_buf);
+       return dump_written;
+}
+
+#ifdef WL_ESCAN
+#define WL_MESH_DELAY_SCAN_MS  3000
+static void
+wl_mesh_timer(unsigned long data)
+{
+       wl_event_msg_t msg;
+       struct wl_if_info *mesh_if = (struct wl_if_info *)data;
+       struct dhd_pub *dhd;
+
+       if (!mesh_if) {
+               AEXT_ERROR("wlan", "mesh_if is not ready\n");
+               return;
+       }
+
+       if (!mesh_if->dev) {
+               AEXT_ERROR("wlan", "ifidx %d is not ready\n", mesh_if->ifidx);
+               return;
+       }
+       dhd = dhd_get_pub(mesh_if->dev);
+
+       bzero(&msg, sizeof(wl_event_msg_t));
+       AEXT_TRACE(mesh_if->dev->name, "timer expired\n");
+
+       msg.ifidx = mesh_if->ifidx;
+       msg.event_type = hton32(WLC_E_RESERVED);
+       msg.reason = 0xFFFFFFFF;
+       wl_ext_event_send(dhd->event_params, &msg, NULL);
+}
+
+static void
+wl_mesh_set_timer(struct wl_if_info *mesh_if, uint timeout)
+{
+       AEXT_TRACE(mesh_if->dev->name, "timeout=%d\n", timeout);
+
+       if (timer_pending(&mesh_if->delay_scan))
+               del_timer_sync(&mesh_if->delay_scan);
+
+       if (timeout) {
+               if (timer_pending(&mesh_if->delay_scan))
+                       del_timer_sync(&mesh_if->delay_scan);
+               mod_timer(&mesh_if->delay_scan, jiffies + msecs_to_jiffies(timeout));
+       }
+}
+
+static int
+wl_mesh_clear_vndr_ie(struct net_device *dev, uchar *oui)
+{
+       char *vndr_ie_buf = NULL;
+       vndr_ie_setbuf_t *vndr_ie = NULL;
+       ie_getbuf_t vndr_ie_tmp;
+       char *iovar_buf = NULL;
+       int err = -1, i;
+       vndr_ie_buf_t *vndr_ie_dump = NULL;
+       uchar *iebuf;
+       vndr_ie_info_t *ie_info;
+       vndr_ie_t *ie;
+
+       vndr_ie_buf = kzalloc(WLC_IOCTL_SMLEN, GFP_KERNEL);
+       if (!vndr_ie_buf) {
+               AEXT_ERROR(dev->name, "IE memory alloc failed\n");
+               err = -ENOMEM;
+               goto exit;
+       }
+
+       iovar_buf = kzalloc(WLC_IOCTL_MEDLEN, GFP_KERNEL);
+       if (!iovar_buf) {
+               AEXT_ERROR(dev->name, "iovar_buf alloc failed\n");
+               err = -ENOMEM;
+               goto exit;
+       }
+
+       memset(iovar_buf, 0, WLC_IOCTL_MEDLEN);
+       vndr_ie_tmp.pktflag = (uint32) -1;
+       vndr_ie_tmp.id = (uint8) DOT11_MNG_PROPR_ID;
+       err = wl_ext_iovar_getbuf(dev, "vndr_ie", &vndr_ie_tmp, sizeof(vndr_ie_tmp),
+               iovar_buf, WLC_IOCTL_MEDLEN, NULL);
+       if (err)
+               goto exit;
+
+       vndr_ie_dump = (vndr_ie_buf_t *)iovar_buf;
+       if (!vndr_ie_dump->iecount)
+               goto exit;
+
+       iebuf = (uchar *)&vndr_ie_dump->vndr_ie_list[0];
+       for (i=0; i<vndr_ie_dump->iecount; i++) {
+               ie_info = (vndr_ie_info_t *) iebuf;
+               ie = &ie_info->vndr_ie_data;
+               if (memcmp(ie->oui, oui, 3))
+                       memset(ie->oui, 0, 3);
+               iebuf += sizeof(uint32) + ie->len + VNDR_IE_HDR_LEN;
+       }
+
+       vndr_ie = (vndr_ie_setbuf_t *) vndr_ie_buf;
+       strncpy(vndr_ie->cmd, "del", VNDR_IE_CMD_LEN - 1);
+       vndr_ie->cmd[VNDR_IE_CMD_LEN - 1] = '\0';
+       memcpy(&vndr_ie->vndr_ie_buffer, vndr_ie_dump, WLC_IOCTL_SMLEN-VNDR_IE_CMD_LEN-1);
+
+       memset(iovar_buf, 0, WLC_IOCTL_MEDLEN);
+       err = wl_ext_iovar_setbuf(dev, "vndr_ie", vndr_ie, WLC_IOCTL_SMLEN, iovar_buf,
+               WLC_IOCTL_MEDLEN, NULL);
+
+exit:
+       if (vndr_ie) {
+               kfree(vndr_ie);
+       }
+       if (iovar_buf) {
+               kfree(iovar_buf);
+       }
+       return err;
+}
+
+static int
+wl_mesh_clear_mesh_info(struct wl_apsta_params *apsta_params,
+       struct wl_if_info *mesh_if, bool scan)
+{
+       struct wl_mesh_params *mesh_info = &apsta_params->mesh_info;
+       uchar mesh_oui[]={0x00, 0x22, 0xf4};
+       int ret;
+
+       AEXT_TRACE(mesh_if->dev->name, "Enter\n");
+
+       ret = wl_mesh_clear_vndr_ie(mesh_if->dev, mesh_oui);
+       memset(mesh_info, 0, sizeof(struct wl_mesh_params));
+       if (scan) {
+               mesh_info->scan_channel = wl_ext_get_chan(apsta_params, mesh_if->dev);
+               wl_mesh_set_timer(mesh_if, 100);
+       }
+
+       return ret;
+}
+
+static int
+wl_mesh_update_vndr_ie(struct wl_apsta_params *apsta_params,
+       struct wl_if_info *mesh_if)
+{
+       struct wl_mesh_params *mesh_info = &apsta_params->mesh_info;
+       char *vndr_ie;
+       uchar mesh_oui[]={0x00, 0x22, 0xf4};
+       int bytes_written = 0;
+       int ret = 0, i, vndr_ie_len;
+       uint8 *peer_bssid;
+
+       wl_mesh_clear_vndr_ie(mesh_if->dev, mesh_oui);
+
+       vndr_ie_len = WLC_IOCTL_MEDLEN;
+       vndr_ie = kmalloc(vndr_ie_len, GFP_KERNEL);
+       if (vndr_ie == NULL) {
+               AEXT_ERROR(mesh_if->dev->name, "Failed to allocate buffer of %d bytes\n",
+                       WLC_IOCTL_MEDLEN); 
+               ret = -1;
+               goto exit;
+       }
+
+       bytes_written += snprintf(vndr_ie+bytes_written, vndr_ie_len,
+               "0x%02x%02x%02x", mesh_oui[0], mesh_oui[1], mesh_oui[2]);
+
+       bytes_written += snprintf(vndr_ie+bytes_written, vndr_ie_len,
+               "%02x%02x%02x%02x%02x%02x%02x%02x", MESH_INFO_MASTER_BSSID, ETHER_ADDR_LEN,
+               ((u8 *)(&mesh_info->master_bssid))[0], ((u8 *)(&mesh_info->master_bssid))[1],
+               ((u8 *)(&mesh_info->master_bssid))[2], ((u8 *)(&mesh_info->master_bssid))[3],
+               ((u8 *)(&mesh_info->master_bssid))[4], ((u8 *)(&mesh_info->master_bssid))[5]);
+
+       bytes_written += snprintf(vndr_ie+bytes_written, vndr_ie_len,
+               "%02x%02x%02x", MESH_INFO_MASTER_CHANNEL, 1, mesh_info->master_channel);
+
+       bytes_written += snprintf(vndr_ie+bytes_written, vndr_ie_len,
+               "%02x%02x%02x", MESH_INFO_HOP_CNT, 1, mesh_info->hop_cnt);
+
+       bytes_written += snprintf(vndr_ie+bytes_written, vndr_ie_len,
+               "%02x%02x", MESH_INFO_PEER_BSSID, mesh_info->hop_cnt*ETHER_ADDR_LEN);
+       for (i=0; i<mesh_info->hop_cnt && i<MAX_HOP_LIST; i++) {
+               peer_bssid = (uint8 *)&mesh_info->peer_bssid[i];
+               bytes_written += snprintf(vndr_ie+bytes_written, vndr_ie_len,
+                       "%02x%02x%02x%02x%02x%02x",
+                       peer_bssid[0], peer_bssid[1], peer_bssid[2],
+                       peer_bssid[3], peer_bssid[4], peer_bssid[5]);
+       }
+
+       ret = wl_ext_add_del_ie(mesh_if->dev, VNDR_IE_BEACON_FLAG|VNDR_IE_PRBRSP_FLAG,
+               vndr_ie, "add");
+       if (!ret) {
+               AEXT_INFO(mesh_if->dev->name, "mbssid=%pM, mchannel=%d, hop=%d, pbssid=%pM\n",
+                       &mesh_info->master_bssid, mesh_info->master_channel, mesh_info->hop_cnt,
+                       mesh_info->peer_bssid); 
+       }
+
+exit:
+       if (vndr_ie)
+               kfree(vndr_ie);
+       return ret;
+}
+
+static bool
+wl_mesh_update_master_info(struct wl_apsta_params *apsta_params,
+       struct wl_if_info *mesh_if)
+{
+       struct wl_mesh_params *mesh_info = &apsta_params->mesh_info;
+       struct wl_if_info *sta_if = NULL;
+       bool updated = FALSE;
+
+       sta_if = wl_ext_if_enabled(apsta_params, ISTA_MODE);
+       if (sta_if) {
+               wldev_ioctl(mesh_if->dev, WLC_GET_BSSID, &mesh_info->master_bssid,
+                       ETHER_ADDR_LEN, 0);
+               mesh_info->master_channel = wl_ext_get_chan(apsta_params, mesh_if->dev);
+               mesh_info->hop_cnt = 0;
+               memset(mesh_info->peer_bssid, 0, MAX_HOP_LIST*ETHER_ADDR_LEN);
+               if (!wl_mesh_update_vndr_ie(apsta_params, mesh_if))
+                       updated = TRUE;
+       }
+
+       return updated;
+}
+
+static bool
+wl_mesh_update_mesh_info(struct wl_apsta_params *apsta_params,
+       struct wl_if_info *mesh_if)
+{
+       struct wl_mesh_params *mesh_info = &apsta_params->mesh_info, peer_mesh_info;
+       uint32 count = 0;
+       char *dump_buf = NULL;
+       mesh_peer_info_dump_t *peer_results;
+       mesh_peer_info_ext_t *mpi_ext;
+       struct ether_addr bssid;
+       bool updated = FALSE, bss_found = FALSE;
+       uint16 cur_chan;
+
+       dump_buf = kmalloc(WLC_IOCTL_MAXLEN, GFP_KERNEL);
+       if (dump_buf == NULL) {
+               AEXT_ERROR(mesh_if->dev->name, "Failed to allocate buffer of %d bytes\n",
+                       WLC_IOCTL_MAXLEN); 
+               return FALSE;
+       }
+       count = wl_mesh_get_peer_results(mesh_if->dev, dump_buf, WLC_IOCTL_MAXLEN);
+       if (count > 0) {
+               memset(&bssid, 0, ETHER_ADDR_LEN);
+               wldev_ioctl(mesh_if->dev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN, 0);
+               peer_results = (mesh_peer_info_dump_t *)dump_buf;
+               mpi_ext = (mesh_peer_info_ext_t *)peer_results->mpi_ext;
+               for (count = 0; count < peer_results->count; count++) {
+                       if (mpi_ext->entry_state != MESH_SELF_PEER_ENTRY_STATE_TIMEDOUT &&
+                                       mpi_ext->peer_info.state == MESH_PEERING_ESTAB) {
+                               memset(&peer_mesh_info, 0, sizeof(struct wl_mesh_params));
+                               bss_found = wl_escan_mesh_info(mesh_if->dev, mesh_if->escan,
+                                       &mpi_ext->ea, &peer_mesh_info);
+                               if (bss_found && (mesh_info->master_channel == 0 ||
+                                               peer_mesh_info.hop_cnt <= mesh_info->hop_cnt) &&
+                                               memcmp(&peer_mesh_info.peer_bssid, &bssid, ETHER_ADDR_LEN)) {
+                                       memcpy(&mesh_info->master_bssid, &peer_mesh_info.master_bssid,
+                                               ETHER_ADDR_LEN);
+                                       mesh_info->master_channel = peer_mesh_info.master_channel;
+                                       mesh_info->hop_cnt = peer_mesh_info.hop_cnt+1;
+                                       memset(mesh_info->peer_bssid, 0, MAX_HOP_LIST*ETHER_ADDR_LEN);
+                                       memcpy(&mesh_info->peer_bssid, &mpi_ext->ea, ETHER_ADDR_LEN);
+                                       memcpy(&mesh_info->peer_bssid[1], peer_mesh_info.peer_bssid,
+                                               (MAX_HOP_LIST-1)*ETHER_ADDR_LEN);
+                                       updated = TRUE;
+                               }
+                       }
+                       mpi_ext++;
+               }
+               if (updated) {
+                       if (wl_mesh_update_vndr_ie(apsta_params, mesh_if)) {
+                               AEXT_ERROR(mesh_if->dev->name, "update failed\n");
+                               mesh_info->master_channel = 0;
+                               updated = FALSE;
+                               goto exit;
+                       }
+               }
+       }
+
+       if (!mesh_info->master_channel) {
+               wlc_ssid_t cur_ssid;
+               char sec[32];
+               bool sae = FALSE;
+               memset(&peer_mesh_info, 0, sizeof(struct wl_mesh_params));
+               wl_ext_ioctl(mesh_if->dev, WLC_GET_SSID, &cur_ssid, sizeof(cur_ssid), 0);
+               wl_ext_get_sec(mesh_if->dev, mesh_if->ifmode, sec, sizeof(sec));
+               if (strnicmp(sec, "sae/sae", strlen("sae/sae")) == 0)
+                       sae = TRUE;
+               cur_chan = wl_ext_get_chan(apsta_params, mesh_if->dev);
+               bss_found = wl_escan_mesh_peer(mesh_if->dev, mesh_if->escan, &cur_ssid, cur_chan,
+                       sae, &peer_mesh_info);
+
+               if (bss_found && peer_mesh_info.master_channel&&
+                               (cur_chan != peer_mesh_info.master_channel)) {
+                       WL_MSG(mesh_if->ifname, "moving channel %d -> %d\n",
+                               cur_chan, peer_mesh_info.master_channel);
+                       wl_ext_disable_iface(mesh_if->dev, mesh_if->ifname);
+                       mesh_if->channel = peer_mesh_info.master_channel;
+                       wl_ext_enable_iface(mesh_if->dev, mesh_if->ifname, 500);
+               }
+       }
+
+exit:
+       if (dump_buf)
+               kfree(dump_buf);
+       return updated;
+}
+
+static void
+wl_mesh_event_handler( struct wl_apsta_params *apsta_params,
+       struct wl_if_info *mesh_if, const wl_event_msg_t *e, void *data)
+{
+       struct wl_mesh_params *mesh_info = &apsta_params->mesh_info;
+       uint32 event_type = ntoh32(e->event_type);
+       uint32 status = ntoh32(e->status);
+       uint32 reason = ntoh32(e->reason);
+       wlc_ssid_t ssid;
+       int ret;
+
+       if (wl_get_isam_status(mesh_if, AP_CREATED) &&
+                       ((event_type == WLC_E_SET_SSID && status == WLC_E_STATUS_SUCCESS) ||
+                       (event_type == WLC_E_LINK && status == WLC_E_STATUS_SUCCESS &&
+                       reason == WLC_E_REASON_INITIAL_ASSOC))) {
+               if (!wl_mesh_update_master_info(apsta_params, mesh_if)) {
+                       mesh_info->scan_channel = wl_ext_get_chan(apsta_params, mesh_if->dev);
+                       wl_mesh_set_timer(mesh_if, WL_MESH_DELAY_SCAN_MS);
+               }
+       }
+       else if ((event_type == WLC_E_LINK && reason == WLC_E_LINK_BSSCFG_DIS) ||
+                       (event_type == WLC_E_LINK && status == WLC_E_STATUS_SUCCESS &&
+                       reason == WLC_E_REASON_DEAUTH)) {
+               wl_mesh_clear_mesh_info(apsta_params, mesh_if, FALSE);
+       }
+       else if (wl_get_isam_status(mesh_if, AP_CREATED) &&
+                       (event_type == WLC_E_ASSOC_IND || event_type == WLC_E_REASSOC_IND) &&
+                       reason == DOT11_SC_SUCCESS) {
+               mesh_info->scan_channel = wl_ext_get_chan(apsta_params, mesh_if->dev);
+               wl_mesh_set_timer(mesh_if, 100);
+       }
+       else if (event_type == WLC_E_DISASSOC_IND || event_type == WLC_E_DEAUTH_IND ||
+                       (event_type == WLC_E_DEAUTH && reason != DOT11_RC_RESERVED)) {
+               if (!memcmp(&mesh_info->peer_bssid, &e->addr, ETHER_ADDR_LEN))
+                       wl_mesh_clear_mesh_info(apsta_params, mesh_if, TRUE);
+       }
+       else if (wl_get_isam_status(mesh_if, AP_CREATED) &&
+                       event_type == WLC_E_RESERVED && reason == 0xFFFFFFFF) {
+               if (!wl_mesh_update_master_info(apsta_params, mesh_if)) {
+                       wl_ext_ioctl(mesh_if->dev, WLC_GET_SSID, &ssid, sizeof(ssid), 0);
+                       ret = wl_escan_set_scan(mesh_if->dev, apsta_params->dhd, &ssid,
+                               mesh_info->scan_channel, FALSE);
+                       if (ret)
+                               wl_mesh_set_timer(mesh_if, WL_MESH_DELAY_SCAN_MS);
+               }
+       }
+       else if (wl_get_isam_status(mesh_if, AP_CREATED) &&
+                       ((event_type == WLC_E_ESCAN_RESULT && status == WLC_E_STATUS_SUCCESS) ||
+                       (event_type == WLC_E_ESCAN_RESULT &&
+                       (status == WLC_E_STATUS_ABORT || status == WLC_E_STATUS_NEWSCAN ||
+                       status == WLC_E_STATUS_11HQUIET || status == WLC_E_STATUS_CS_ABORT ||
+                       status == WLC_E_STATUS_NEWASSOC || status == WLC_E_STATUS_TIMEOUT)))) {
+               if (!wl_mesh_update_master_info(apsta_params, mesh_if)) {
+                       if (!wl_mesh_update_mesh_info(apsta_params, mesh_if)) {
+                               mesh_info->scan_channel = 0;
+                               wl_mesh_set_timer(mesh_if, WL_MESH_DELAY_SCAN_MS);
+                       }
+               }
+       }
+}
+
+static void
+wl_mesh_escan_detach(dhd_pub_t *dhd, struct wl_if_info *mesh_if)
+{
+       AEXT_TRACE(mesh_if->dev->name, "Enter\n");
+
+       del_timer_sync(&mesh_if->delay_scan);
+
+       if (mesh_if->escan) {
+               mesh_if->escan = NULL;
+       }
+}
+
+static int
+wl_mesh_escan_attach(dhd_pub_t *dhd, struct wl_if_info *mesh_if)
+{
+       AEXT_TRACE(mesh_if->dev->name, "Enter\n");
+
+       mesh_if->escan = dhd->escan;
+       init_timer_compat(&mesh_if->delay_scan, wl_mesh_timer, mesh_if);
+
+       return 0;
+}
+
+static uint
+wl_mesh_update_peer_path(struct wl_if_info *mesh_if, char *command,
+       int total_len)
+{
+       struct wl_mesh_params peer_mesh_info;
+       uint32 count = 0;
+       char *dump_buf = NULL;
+       mesh_peer_info_dump_t *peer_results;
+       mesh_peer_info_ext_t *mpi_ext;
+       int bytes_written = 0, j, k;
+       bool bss_found = FALSE;
+
+       dump_buf = kmalloc(WLC_IOCTL_MAXLEN, GFP_KERNEL);
+       if (dump_buf == NULL) {
+               AEXT_ERROR(mesh_if->dev->name, "Failed to allocate buffer of %d bytes\n",
+                       WLC_IOCTL_MAXLEN); 
+               return FALSE;
+       }
+       count = wl_mesh_get_peer_results(mesh_if->dev, dump_buf, WLC_IOCTL_MAXLEN);
+       if (count > 0) {
+               peer_results = (mesh_peer_info_dump_t *)dump_buf;
+               mpi_ext = (mesh_peer_info_ext_t *)peer_results->mpi_ext;
+               for (count = 0; count < peer_results->count; count++) {
+                       if (mpi_ext->entry_state != MESH_SELF_PEER_ENTRY_STATE_TIMEDOUT &&
+                                       mpi_ext->peer_info.state == MESH_PEERING_ESTAB) {
+                               memset(&peer_mesh_info, 0, sizeof(struct wl_mesh_params));
+                               bss_found = wl_escan_mesh_info(mesh_if->dev, mesh_if->escan,
+                                       &mpi_ext->ea, &peer_mesh_info);
+                               if (bss_found) {
+                                       bytes_written += snprintf(command+bytes_written, total_len,
+                                               "\npeer=%pM, hop=%d",
+                                               &mpi_ext->ea, peer_mesh_info.hop_cnt);
+                                       for (j=1; j<peer_mesh_info.hop_cnt; j++) {
+                                               bytes_written += snprintf(command+bytes_written,
+                                                       total_len, "\n");
+                                               for (k=0; k<j; k++) {
+                                                       bytes_written += snprintf(command+bytes_written,
+                                                               total_len, " ");
+                                               }
+                                               bytes_written += snprintf(command+bytes_written, total_len,
+                                                       "%pM", &peer_mesh_info.peer_bssid[j]);
+                                       }
+                               }
+                       }
+                       mpi_ext++;
+               }
+       }
+
+       if (dump_buf)
+               kfree(dump_buf);
+       return bytes_written;
+}
+
+static int
+wl_ext_isam_peer_path(struct net_device *dev, char *command, int total_len)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       struct wl_mesh_params *mesh_info = &apsta_params->mesh_info;
+       struct wl_if_info *tmp_if;
+       uint16 chan = 0;
+       char *dump_buf = NULL;
+       int dump_len = WLC_IOCTL_MEDLEN;
+       int dump_written = 0;
+       int i;
+
+       if (command || android_msg_level & ANDROID_INFO_LEVEL) {
+               if (command) {
+                       dump_buf = command;
+                       dump_len = total_len;
+               } else {
+                       dump_buf = kmalloc(dump_len, GFP_KERNEL);
+                       if (dump_buf == NULL) {
+                               AEXT_ERROR(dev->name, "Failed to allocate buffer of %d bytes\n",
+                                       dump_len); 
+                               return -1;
+                       }
+               }
+               for (i=0; i<MAX_IF_NUM; i++) {
+                       tmp_if = &apsta_params->if_info[i];
+                       if (tmp_if->dev && tmp_if->ifmode == IMESH_MODE && apsta_params->macs) {
+                               chan = wl_ext_get_chan(apsta_params, tmp_if->dev);
+                               if (chan) {
+                                       dump_written += snprintf(dump_buf+dump_written, dump_len,
+                                               "[dhd-%s-%c] mbssid=%pM, mchan=%d, hop=%d, pbssid=%pM",
+                                               tmp_if->ifname, tmp_if->prefix, &mesh_info->master_bssid,
+                                               mesh_info->master_channel, mesh_info->hop_cnt,
+                                               &mesh_info->peer_bssid);
+                                       dump_written += wl_mesh_update_peer_path(tmp_if,
+                                               dump_buf+dump_written, dump_len-dump_written);
+                               }
+                       }
+               }
+               AEXT_INFO(dev->name, "%s\n", dump_buf);
+       }
+
+       if (!command && dump_buf)
+               kfree(dump_buf);
+       return dump_written;
+}
+#endif /* WL_ESCAN */
+#endif /* WLMESH */
+
+static int
+wl_ext_isam_status(struct net_device *dev, char *command, int total_len)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       int i;
+       struct wl_if_info *tmp_if;
+       uint16 chan = 0;
+       wlc_ssid_t ssid = { 0, {0} };
+       struct ether_addr bssid;
+       scb_val_t scb_val;
+       char sec[32];
+       u32 chanspec = 0;
+       char *dump_buf = NULL;
+       int dump_len = WLC_IOCTL_MEDLEN;
+       int dump_written = 0;
+
+       if (command || android_msg_level & ANDROID_INFO_LEVEL) {
+               if (command) {
+                       dump_buf = command;
+                       dump_len = total_len;
+               } else {
+                       dump_buf = kmalloc(dump_len, GFP_KERNEL);
+                       if (dump_buf == NULL) {
+                               AEXT_ERROR(dev->name, "Failed to allocate buffer of %d bytes\n",
+                                       dump_len); 
+                               return -1;
+                       }
+               }
+               dump_written += snprintf(dump_buf+dump_written, dump_len,
+                       "apstamode=%d", apsta_params->apstamode);
+               for (i=0; i<MAX_IF_NUM; i++) {
+                       memset(&ssid, 0, sizeof(ssid));
+                       memset(&bssid, 0, sizeof(bssid));
+                       memset(&scb_val, 0, sizeof(scb_val));
+                       tmp_if = &apsta_params->if_info[i];
+                       if (tmp_if->dev) {
+                               chan = wl_ext_get_chan(apsta_params, tmp_if->dev);
+                               if (chan) {
+                                       wl_ext_ioctl(tmp_if->dev, WLC_GET_SSID, &ssid, sizeof(ssid), 0);
+                                       wldev_ioctl(tmp_if->dev, WLC_GET_BSSID, &bssid, sizeof(bssid), 0);
+                                       wldev_ioctl(tmp_if->dev, WLC_GET_RSSI, &scb_val,
+                                               sizeof(scb_val_t), 0);
+                                       chanspec = wl_ext_get_chanspec(apsta_params, tmp_if->dev);
+                                       wl_ext_get_sec(tmp_if->dev, tmp_if->ifmode, sec, sizeof(sec));
+                                       dump_written += snprintf(dump_buf+dump_written, dump_len,
+                                               "\n[dhd-%s-%c]: bssid=%pM, chan=%3d(0x%x %sMHz), "
+                                               "rssi=%3d, sec=%-15s, SSID=\"%s\"",
+                                               tmp_if->ifname, tmp_if->prefix, &bssid, chan, chanspec,
+                                               CHSPEC_IS20(chanspec)?"20":
+                                               CHSPEC_IS40(chanspec)?"40":
+                                               CHSPEC_IS80(chanspec)?"80":"160",
+                                               dtoh32(scb_val.val), sec, ssid.SSID);
+                                       if (tmp_if->ifmode == IAP_MODE) {
+                                               dump_written += snprintf(dump_buf+dump_written, dump_len, "\n");
+                                               dump_written += wl_ext_assoclist(tmp_if->dev, NULL,
+                                                       dump_buf+dump_written, dump_len-dump_written);
+                                       }
+#ifdef WLMESH
+                                       else if (tmp_if->ifmode == IMESH_MODE) {
+                                               dump_written += snprintf(dump_buf+dump_written, dump_len, "\n");
+                                               dump_written += wl_ext_mesh_peer_status(tmp_if->dev, NULL,
+                                                       dump_buf+dump_written, dump_len-dump_written);
+                                       }
+#endif /* WLMESH */
+                               } else {
+                                       dump_written += snprintf(dump_buf+dump_written, dump_len,
+                                               "\n[dhd-%s-%c]:", tmp_if->ifname, tmp_if->prefix);
+                               }
+                       }
+               }
+               AEXT_INFO(dev->name, "%s\n", dump_buf);
+       }
+
+       if (!command && dump_buf)
+               kfree(dump_buf);
+       return dump_written;
+}
+
+static bool
+wl_ext_master_if(struct wl_if_info *cur_if)
+{
+       if (cur_if->ifmode == IAP_MODE || cur_if->ifmode == IMESH_MODE)
+               return TRUE;
+       else
+               return FALSE;
+}
+
+static int
+wl_ext_if_down(struct wl_apsta_params *apsta_params, struct wl_if_info *cur_if)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       scb_val_t scbval;
+       struct {
+               s32 cfg;
+               s32 val;
+       } bss_setbuf;
+       apstamode_t apstamode = apsta_params->apstamode;
+
+       WL_MSG(cur_if->ifname, "[%c] Turning off...\n", cur_if->prefix);
+
+       if (cur_if->ifmode == ISTA_MODE) {
+               wl_ext_ioctl(cur_if->dev, WLC_DISASSOC, NULL, 0, 1);
+       } else if (cur_if->ifmode == IAP_MODE || cur_if->ifmode == IMESH_MODE) {
+               // deauthenticate all STA first
+               memcpy(scbval.ea.octet, &ether_bcast, ETHER_ADDR_LEN);
+               wl_ext_ioctl(cur_if->dev, WLC_SCB_DEAUTHENTICATE, &scbval.ea, ETHER_ADDR_LEN, 1);
+       }
+
+       if (apstamode == IAPONLY_MODE || apstamode == IMESHONLY_MODE) {
+               wl_ext_ioctl(cur_if->dev, WLC_DOWN, NULL, 0, 1);
+       } else {
+               bss_setbuf.cfg = 0xffffffff;
+               bss_setbuf.val = htod32(0);
+               wl_ext_iovar_setbuf(cur_if->dev, "bss", &bss_setbuf, sizeof(bss_setbuf),
+                       iovar_buf, WLC_IOCTL_SMLEN, NULL);
+       }
+       wl_clr_isam_status(cur_if, AP_CREATED);
+
+       return 0;
+}
+
+static int
+wl_ext_if_up(struct wl_apsta_params *apsta_params, struct wl_if_info *cur_if)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       struct {
+               s32 cfg;
+               s32 val;
+       } bss_setbuf;
+       apstamode_t apstamode = apsta_params->apstamode;
+       chanspec_t fw_chspec;
+       u32 timeout;
+       wlc_ssid_t ssid = { 0, {0} };
+       uint16 chan = 0;
+
+       if (cur_if->ifmode != IAP_MODE) {
+               AEXT_ERROR(cur_if->ifname, "Wrong ifmode\n");
+               return 0;
+       }
+
+       if (wl_ext_dfs_chan(cur_if->channel) && !apsta_params->radar) {
+               WL_MSG(cur_if->ifname, "[%c] skip DFS channel %d\n",
+                       cur_if->prefix, cur_if->channel);
+               return 0;
+       } else if (!cur_if->channel) {
+               WL_MSG(cur_if->ifname, "[%c] no valid channel\n", cur_if->prefix);
+               return 0;
+       }
+
+       WL_MSG(cur_if->ifname, "[%c] Turning on...\n", cur_if->prefix);
+
+       wl_ext_set_chanspec(cur_if->dev, apsta_params->ioctl_ver, cur_if->channel,
+               &fw_chspec);
+
+       wl_clr_isam_status(cur_if, AP_CREATED);
+       wl_set_isam_status(cur_if, AP_CREATING);
+       if (apstamode == IAPONLY_MODE) {
+               wl_ext_ioctl(cur_if->dev, WLC_UP, NULL, 0, 1);
+       } else {
+               bss_setbuf.cfg = 0xffffffff;    
+               bss_setbuf.val = htod32(1);
+               wl_ext_iovar_setbuf(cur_if->dev, "bss", &bss_setbuf,
+                       sizeof(bss_setbuf), iovar_buf, WLC_IOCTL_SMLEN, NULL);
+       }
+
+       timeout = wait_event_interruptible_timeout(apsta_params->netif_change_event,
+               wl_get_isam_status(cur_if, AP_CREATED),
+               msecs_to_jiffies(MAX_AP_LINK_WAIT_TIME));
+       if (timeout <= 0 || !wl_get_isam_status(cur_if, AP_CREATED)) {
+               wl_ext_if_down(apsta_params, cur_if);
+               WL_MSG(cur_if->ifname, "[%c] failed to up with SSID: \"%s\"\n",
+                       cur_if->prefix, cur_if->ssid);
+       } else {
+               wl_ext_ioctl(cur_if->dev, WLC_GET_SSID, &ssid, sizeof(ssid), 0);
+               chan = wl_ext_get_chan(apsta_params, cur_if->dev);
+               WL_MSG(cur_if->ifname, "[%c] enabled with SSID: \"%s\" on channel %d\n",
+                       cur_if->prefix, ssid.SSID, chan);
+       }
+       wl_clr_isam_status(cur_if, AP_CREATING);
+
+       wl_ext_isam_status(cur_if->dev, NULL, 0);
+
+       return 0;
+}
+
+static int
+wl_ext_disable_iface(struct net_device *dev, char *ifname)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       int i;
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       wlc_ssid_t ssid = { 0, {0} };
+       scb_val_t scbval;
+       struct {
+               s32 cfg;
+               s32 val;
+       } bss_setbuf;
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       apstamode_t apstamode = apsta_params->apstamode;
+       struct wl_if_info *cur_if = NULL, *tmp_if = NULL;
+
+       for (i=0; i<MAX_IF_NUM; i++) {
+               tmp_if = &apsta_params->if_info[i];
+               if (tmp_if->dev && !strcmp(tmp_if->dev->name, ifname)) {
+                       cur_if = tmp_if;
+                       break;
+               }
+       }
+       if (!cur_if) {
+               AEXT_ERROR(dev->name, "wrong ifname=%s or dev not ready\n", ifname);
+               return -1;
+       }
+
+       mutex_lock(&apsta_params->usr_sync);
+       WL_MSG(ifname, "[%c] Disabling...\n", cur_if->prefix);
+
+       if (cur_if->ifmode == ISTA_MODE) {
+               wl_ext_ioctl(cur_if->dev, WLC_DISASSOC, NULL, 0, 1);
+               wl_ext_add_remove_pm_enable_work(dev, FALSE);
+       } else if (cur_if->ifmode == IAP_MODE || cur_if->ifmode == IMESH_MODE) {
+               // deauthenticate all STA first
+               memcpy(scbval.ea.octet, &ether_bcast, ETHER_ADDR_LEN);
+               wl_ext_ioctl(cur_if->dev, WLC_SCB_DEAUTHENTICATE, &scbval.ea, ETHER_ADDR_LEN, 1);
+       }
+
+       if (apstamode == IAPONLY_MODE || apstamode == IMESHONLY_MODE) {
+               wl_ext_ioctl(dev, WLC_DOWN, NULL, 0, 1);
+               wl_ext_ioctl(dev, WLC_SET_SSID, &ssid, sizeof(ssid), 1); // reset ssid
+               wl_ext_iovar_setint(dev, "mpc", 1);
+       } else if ((apstamode==ISTAAP_MODE || apstamode==ISTAGO_MODE) &&
+                       cur_if->ifmode == IAP_MODE) {
+               bss_setbuf.cfg = 0xffffffff;
+               bss_setbuf.val = htod32(0);
+               wl_ext_iovar_setbuf(cur_if->dev, "bss", &bss_setbuf, sizeof(bss_setbuf),
+                       iovar_buf, WLC_IOCTL_SMLEN, NULL);
+               wl_ext_iovar_setint(dev, "mpc", 1);
+#ifdef ARP_OFFLOAD_SUPPORT
+               /* IF SoftAP is disabled, enable arpoe back for STA mode. */
+               dhd_arp_offload_set(dhd, dhd_arp_mode);
+               dhd_arp_offload_enable(dhd, TRUE);
+#endif /* ARP_OFFLOAD_SUPPORT */
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+               if (dhd->conf->disable_proptx!=0) {
+                       bool enabled;
+                       dhd_wlfc_get_enable(dhd, &enabled);
+                       if (enabled) {
+                               dhd_wlfc_deinit(dhd);
+                       }
+               }
+#endif /* BCMSDIO */
+#endif /* PROP_TXSTATUS_VSDB */
+       }
+       else if (apstamode == IDUALAP_MODE || apstamode == ISTAAPAP_MODE) {
+               bss_setbuf.cfg = 0xffffffff;
+               bss_setbuf.val = htod32(0);
+               wl_ext_iovar_setbuf(cur_if->dev, "bss", &bss_setbuf, sizeof(bss_setbuf),
+                       iovar_buf, WLC_IOCTL_SMLEN, NULL);
+#ifdef WLMESH
+       } else if (apstamode == ISTAMESH_MODE || apstamode == IMESHAP_MODE ||
+                       apstamode == ISTAAPMESH_MODE || apstamode == IMESHAPAP_MODE) {
+               bss_setbuf.cfg = 0xffffffff;
+               bss_setbuf.val = htod32(0);
+               wl_ext_iovar_setbuf(cur_if->dev, "bss", &bss_setbuf, sizeof(bss_setbuf),
+                       iovar_buf, WLC_IOCTL_SMLEN, NULL);
+               if (cur_if->ifmode == IMESH_MODE) {
+                       int scan_assoc_time = DHD_SCAN_ASSOC_ACTIVE_TIME;
+                       for (i=0; i<MAX_IF_NUM; i++) {
+                               tmp_if = &apsta_params->if_info[i];
+                               if (tmp_if->dev && tmp_if->ifmode == ISTA_MODE) {
+                                       wl_ext_ioctl(tmp_if->dev, WLC_SET_SCAN_CHANNEL_TIME,
+                                               &scan_assoc_time, sizeof(scan_assoc_time), 1);
+                               }
+                       }
+               }
+#endif /* WLMESH */
+       }
+
+       wl_clr_isam_status(cur_if, AP_CREATED);
+
+       WL_MSG(ifname, "[%c] Exit\n", cur_if->prefix);
+       mutex_unlock(&apsta_params->usr_sync);
+       return 0;
+}
+
+static int
+wl_ext_iapsta_disable(struct net_device *dev, char *command, int total_len)
+{
+       int ret = 0;
+       char *pch, *pick_tmp, *param;
+       char ifname[IFNAMSIZ+1];
+
+       AEXT_TRACE(dev->name, "command=%s, len=%d\n", command, total_len);
+
+       pick_tmp = command;
+       param = bcmstrtok(&pick_tmp, " ", 0); // skip iapsta_disable
+       param = bcmstrtok(&pick_tmp, " ", 0);
+       while (param != NULL) {
+               if (!strcmp(param, "ifname")) {
+                       pch = bcmstrtok(&pick_tmp, " ", 0);
+                       if (pch) {
+                               strcpy(ifname, pch);
+                               ret = wl_ext_disable_iface(dev, ifname);
+                               if (ret)
+                                       return ret;
+                       }
+                       else {
+                               AEXT_ERROR(dev->name, "ifname [wlanX]\n");
+                               return -1;
+                       }
+               }
+               param = bcmstrtok(&pick_tmp, " ", 0);
+       }
+
+       return ret;
+}
+
+static bool
+wl_ext_diff_band(uint16 chan1, uint16 chan2)
+{
+       if ((chan1 <= CH_MAX_2G_CHANNEL && chan2 > CH_MAX_2G_CHANNEL) ||
+               (chan1 > CH_MAX_2G_CHANNEL && chan2 <= CH_MAX_2G_CHANNEL)) {
+               return TRUE;
+       }
+       return FALSE;
+}
+
+static uint16
+wl_ext_same_band(struct wl_apsta_params *apsta_params,
+       struct wl_if_info *cur_if, bool nodfs)
+{
+       struct wl_if_info *tmp_if;
+       uint16 tmp_chan, target_chan = 0;
+       wl_prio_t max_prio;
+       int i;
+
+       // find the max prio
+       max_prio = cur_if->prio;
+       for (i=0; i<MAX_IF_NUM; i++) {
+               tmp_if = &apsta_params->if_info[i];
+               if (cur_if != tmp_if && wl_get_isam_status(tmp_if, IF_READY) &&
+                               tmp_if->prio > max_prio) {
+                       tmp_chan = wl_ext_get_chan(apsta_params, tmp_if->dev);
+                       if (wl_ext_dfs_chan(tmp_chan) && nodfs)
+                               continue;
+                       if (tmp_chan && !wl_ext_diff_band(cur_if->channel, tmp_chan)) {
+                               target_chan = tmp_chan;
+                               max_prio = tmp_if->prio;
+                       }
+               }
+       }
+
+       return target_chan;
+}
+
+static uint16
+wl_ext_get_vsdb_chan(struct wl_apsta_params *apsta_params,
+       struct wl_if_info *cur_if, struct wl_if_info *target_if)
+{
+       uint16 target_chan = 0, cur_chan = cur_if->channel;
+
+       target_chan = wl_ext_get_chan(apsta_params, target_if->dev);
+       if (target_chan) {
+               AEXT_INFO(cur_if->ifname, "cur_chan=%d, target_chan=%d\n",
+                       cur_chan, target_chan);
+               if (wl_ext_diff_band(cur_chan, target_chan)) {
+                       if (!apsta_params->rsdb)
+                               return target_chan;
+               } else {
+                       if (cur_chan != target_chan)
+                               return target_chan;
+               }
+       }
+
+       return 0;
+}
+
+static int
+wl_ext_rsdb_core_conflict(struct wl_apsta_params *apsta_params,
+       struct wl_if_info *cur_if)
+{
+       struct wl_if_info *tmp_if;
+       uint16 cur_chan, tmp_chan;
+       int i;
+
+       if (apsta_params->rsdb) {
+               cur_chan = wl_ext_get_chan(apsta_params, cur_if->dev);
+               for (i=0; i<MAX_IF_NUM; i++) {
+                       tmp_if = &apsta_params->if_info[i];
+                       if (tmp_if != cur_if && wl_get_isam_status(tmp_if, IF_READY) &&
+                                       tmp_if->prio > cur_if->prio) {
+                               tmp_chan = wl_ext_get_chan(apsta_params, tmp_if->dev);
+                               if (!tmp_chan)
+                                       continue;
+                               if (wl_ext_diff_band(cur_chan, tmp_chan) &&
+                                               wl_ext_diff_band(cur_chan, cur_if->channel))
+                                       return TRUE;
+                               else if (!wl_ext_diff_band(cur_chan, tmp_chan) &&
+                                               wl_ext_diff_band(cur_chan, cur_if->channel))
+                                       return TRUE;
+                       }
+               }
+       }
+       return FALSE;
+}
+
+static int
+wl_ext_trigger_csa(struct wl_apsta_params *apsta_params, struct wl_if_info *cur_if)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       bool core_conflict = FALSE;
+
+       if (wl_ext_master_if(cur_if) && (apsta_params->csa & CSA_DRV_BIT)) {
+               if (!cur_if->channel) {
+                       WL_MSG(cur_if->ifname, "[%c] no valid channel\n", cur_if->prefix);
+               } else if (wl_ext_dfs_chan(cur_if->channel) && !apsta_params->radar) {
+                       WL_MSG(cur_if->ifname, "[%c] skip DFS channel %d\n",
+                               cur_if->prefix, cur_if->channel);
+                       wl_ext_if_down(apsta_params, cur_if);
+               } else {
+                       wl_chan_switch_t csa_arg;
+                       memset(&csa_arg, 0, sizeof(csa_arg));
+                       csa_arg.mode = 1;
+                       csa_arg.count = 3;
+                       csa_arg.chspec = wl_ext_chan_to_chanspec(apsta_params, cur_if->dev,
+                               cur_if->channel);
+                       core_conflict = wl_ext_rsdb_core_conflict(apsta_params, cur_if);
+                       if (core_conflict) {
+                               WL_MSG(cur_if->ifname, "[%c] Skip CSA due to rsdb core conflict\n",
+                                       cur_if->prefix);
+                       } else if (csa_arg.chspec) {
+                               WL_MSG(cur_if->ifname, "[%c] Trigger CSA to channel %d(0x%x)\n",
+                                       cur_if->prefix, cur_if->channel, csa_arg.chspec);
+                               wl_set_isam_status(cur_if, AP_CREATING);
+                               wl_ext_iovar_setbuf(cur_if->dev, "csa", &csa_arg, sizeof(csa_arg),
+                                       iovar_buf, sizeof(iovar_buf), NULL);
+                               OSL_SLEEP(500);
+                               wl_clr_isam_status(cur_if, AP_CREATING);
+                               wl_ext_isam_status(cur_if->dev, NULL, 0);
+                       } else {
+                               AEXT_ERROR(cur_if->ifname, "fail to get chanspec\n");
+                       }
+               }
+       }
+
+       return 0;
+}
+
+static void
+wl_ext_move_cur_dfs_channel(struct wl_apsta_params *apsta_params,
+       struct wl_if_info *cur_if)
+{
+       uint16 other_chan = 0, cur_chan = cur_if->channel;
+       uint16 chan_2g = 0, chan_5g = 0;
+       uint32 auto_band = WLC_BAND_2G;
+
+       if (wl_ext_master_if(cur_if) && wl_ext_dfs_chan(cur_if->channel) &&
+                       !apsta_params->radar) {
+
+               wl_ext_get_default_chan(cur_if->dev, &chan_2g, &chan_5g, TRUE);
+               if (!chan_2g && !chan_5g) {
+                       cur_if->channel = 0;
+                       WL_MSG(cur_if->ifname, "[%c] no valid channel\n", cur_if->prefix);
+                       return;
+               }
+
+               if (apsta_params->vsdb) {
+                       if (chan_5g) {
+                               cur_if->channel = chan_5g;
+                               auto_band = WLC_BAND_5G;
+                               other_chan = wl_ext_same_band(apsta_params, cur_if, TRUE);
+                       } else {
+                               cur_if->channel = chan_2g;
+                               auto_band = WLC_BAND_2G;
+                               other_chan = wl_ext_same_band(apsta_params, cur_if, TRUE);
+                       }
+                       if (!other_chan) {
+                               other_chan = wl_ext_autochannel(cur_if->dev, ACS_FW_BIT|ACS_DRV_BIT,
+                                       auto_band);
+                       }
+                       if (other_chan)
+                               cur_if->channel = other_chan;
+               } else if (apsta_params->rsdb) {
+                       if (chan_5g) {
+                               cur_if->channel = chan_5g;
+                               auto_band = WLC_BAND_5G;
+                               other_chan = wl_ext_same_band(apsta_params, cur_if, FALSE);
+                               if (wl_ext_dfs_chan(other_chan) && chan_2g) {
+                                       cur_if->channel = chan_2g;
+                                       auto_band = WLC_BAND_2G;
+                                       other_chan = wl_ext_same_band(apsta_params, cur_if, TRUE);
+                               }
+                       } else {
+                               cur_if->channel = chan_2g;
+                               auto_band = WLC_BAND_2G;
+                               other_chan = wl_ext_same_band(apsta_params, cur_if, TRUE);
+                       }
+                       if (!other_chan) {
+                               other_chan = wl_ext_autochannel(cur_if->dev, ACS_FW_BIT|ACS_DRV_BIT,
+                                       auto_band);
+                       }
+                       if (other_chan)
+                               cur_if->channel = other_chan;
+               } else {
+                       cur_if->channel = chan_5g;
+                       auto_band = WLC_BAND_5G;
+                       other_chan = wl_ext_same_band(apsta_params, cur_if, FALSE);
+                       if (wl_ext_dfs_chan(other_chan)) {
+                               cur_if->channel = 0;
+                       }
+                       else if (!other_chan) {
+                               other_chan = wl_ext_autochannel(cur_if->dev, ACS_FW_BIT|ACS_DRV_BIT,
+                                       auto_band);
+                       }
+                       if (other_chan)
+                               cur_if->channel = other_chan;
+               }
+               WL_MSG(cur_if->ifname, "[%c] move channel %d => %d\n",
+                       cur_if->prefix, cur_chan, cur_if->channel);
+       }
+}
+
+static void
+wl_ext_move_other_dfs_channel(struct wl_apsta_params *apsta_params,
+       struct wl_if_info *cur_if)
+{
+       uint16 other_chan = 0, cur_chan = cur_if->channel;
+       uint16 chan_2g = 0, chan_5g = 0;
+       uint32 auto_band = WLC_BAND_2G;
+
+       if (wl_ext_master_if(cur_if) && wl_ext_dfs_chan(cur_if->channel) &&
+                       !apsta_params->radar) {
+
+               wl_ext_get_default_chan(cur_if->dev, &chan_2g, &chan_5g, TRUE);
+               if (!chan_2g && !chan_5g) {
+                       cur_if->channel = 0;
+                       WL_MSG(cur_if->ifname, "[%c] no valid channel\n", cur_if->prefix);
+                       return;
+               }
+
+               if (apsta_params->vsdb) {
+                       if (chan_5g) {
+                               cur_if->channel = chan_5g;
+                               auto_band = WLC_BAND_5G;
+                               other_chan = wl_ext_same_band(apsta_params, cur_if, TRUE);
+                       } else {
+                               cur_if->channel = chan_2g;
+                               auto_band = WLC_BAND_2G;
+                               other_chan = wl_ext_same_band(apsta_params, cur_if, TRUE);
+                       }
+                       if (!other_chan) {
+                               other_chan = wl_ext_autochannel(cur_if->dev, ACS_FW_BIT|ACS_DRV_BIT,
+                                       auto_band);
+                       }
+                       if (other_chan)
+                               cur_if->channel = other_chan;
+               } else if (apsta_params->rsdb) {
+                       if (chan_2g) {
+                               cur_if->channel = chan_2g;
+                               auto_band = WLC_BAND_2G;
+                               other_chan = wl_ext_same_band(apsta_params, cur_if, TRUE);
+                               if (!other_chan) {
+                                       other_chan = wl_ext_autochannel(cur_if->dev, ACS_FW_BIT|ACS_DRV_BIT,
+                                               auto_band);
+                               }
+                       } else {
+                               cur_if->channel = 0;
+                       }
+                       if (other_chan)
+                               cur_if->channel = other_chan;
+               } else {
+                       cur_if->channel = 0;
+               }
+               WL_MSG(cur_if->ifname, "[%c] move channel %d => %d\n",
+                       cur_if->prefix, cur_chan, cur_if->channel);
+       }
+}
+
+static uint16
+wl_ext_move_cur_channel(struct wl_apsta_params *apsta_params,
+       struct wl_if_info *cur_if)
+{
+       struct wl_if_info *tmp_if, *target_if = NULL;
+       uint16 tmp_chan, target_chan = 0;
+       wl_prio_t max_prio;
+       int i;
+
+       if (apsta_params->vsdb) {
+               target_chan = cur_if->channel;
+               goto exit;
+       }
+
+       // find the max prio
+       max_prio = cur_if->prio;
+       for (i=0; i<MAX_IF_NUM; i++) {
+               tmp_if = &apsta_params->if_info[i];
+               if (cur_if != tmp_if && wl_get_isam_status(tmp_if, IF_READY) &&
+                               tmp_if->prio > max_prio) {
+                       tmp_chan = wl_ext_get_vsdb_chan(apsta_params, cur_if, tmp_if);
+                       if (tmp_chan) {
+                               target_if = tmp_if;
+                               target_chan = tmp_chan;
+                               max_prio = tmp_if->prio;
+                       }
+               }
+       }
+
+       if (target_chan) {
+               tmp_chan = wl_ext_get_chan(apsta_params, cur_if->dev);
+               if (apsta_params->rsdb && tmp_chan &&
+                               wl_ext_diff_band(tmp_chan, target_chan)) {
+                       WL_MSG(cur_if->ifname, "[%c] keep on current channel %d\n",
+                               cur_if->prefix, tmp_chan);
+                       cur_if->channel = 0;
+               } else {
+                       WL_MSG(cur_if->ifname, "[%c] channel=%d => %s[%c] channel=%d\n",
+                               cur_if->prefix, cur_if->channel,
+                               target_if->ifname, target_if->prefix, target_chan);
+                       cur_if->channel = target_chan;
+               }
+       }
+
+exit:
+       wl_ext_move_cur_dfs_channel(apsta_params, cur_if);
+
+       return cur_if->channel;
+}
+
+static void
+wl_ext_move_other_channel(struct wl_apsta_params *apsta_params,
+       struct wl_if_info *cur_if)
+{
+       struct wl_if_info *tmp_if, *target_if=NULL;
+       uint16 tmp_chan, target_chan = 0;
+       wl_prio_t max_prio = 0, cur_prio;
+       int i;
+
+       if (apsta_params->vsdb || !cur_if->channel) {
+               return;
+       }
+
+       // find the max prio, but lower than cur_if
+       cur_prio = cur_if->prio;
+       for (i=0; i<MAX_IF_NUM; i++) {
+               tmp_if = &apsta_params->if_info[i];
+               if (cur_if != tmp_if && wl_get_isam_status(tmp_if, IF_READY) &&
+                               tmp_if->prio >= max_prio && tmp_if->prio <= cur_prio) {
+                       tmp_chan = wl_ext_get_vsdb_chan(apsta_params, cur_if, tmp_if);
+                       if (tmp_chan) {
+                               target_if = tmp_if;
+                               target_chan = tmp_chan;
+                               max_prio = tmp_if->prio;
+                       }
+               }
+       }
+
+       if (target_if) {
+               WL_MSG(target_if->ifname, "channel=%d => %s channel=%d\n",
+                       target_chan, cur_if->ifname, cur_if->channel);
+               target_if->channel = cur_if->channel;
+               wl_ext_move_other_dfs_channel(apsta_params, target_if);
+               if (apsta_params->csa == 0) {
+                       wl_ext_if_down(apsta_params, target_if);
+                       wl_ext_move_other_channel(apsta_params, cur_if);
+                       if (target_if->ifmode == ISTA_MODE || target_if->ifmode == IMESH_MODE) {
+                               wl_ext_enable_iface(target_if->dev, target_if->ifname, 0);
+                       } else if (target_if->ifmode == IAP_MODE) {
+                               wl_ext_if_up(apsta_params, target_if);
+                       }
+               } else {
+                       wl_ext_trigger_csa(apsta_params, target_if);
+               }
+       }
+
+}
+
+static bool
+wl_ext_wait_other_enabling(struct wl_apsta_params *apsta_params,
+       struct wl_if_info *cur_if)
+{
+       struct wl_if_info *tmp_if;
+       bool enabling = FALSE;
+       u32 timeout = 1;
+       int i;
+
+       for (i=0; i<MAX_IF_NUM; i++) {
+               tmp_if = &apsta_params->if_info[i];
+               if (tmp_if->dev && tmp_if->dev != cur_if->dev) {
+                       if (tmp_if->ifmode == ISTA_MODE)
+                               enabling = wl_get_isam_status(tmp_if, STA_CONNECTING);
+                       else if (tmp_if->ifmode == IAP_MODE || tmp_if->ifmode == IMESH_MODE)
+                               enabling = wl_get_isam_status(tmp_if, AP_CREATING);
+                       if (enabling)
+                               WL_MSG(cur_if->ifname, "waiting for %s[%c] enabling...\n",
+                                       tmp_if->ifname, tmp_if->prefix);
+                       if (enabling && tmp_if->ifmode == ISTA_MODE) {
+                               timeout = wait_event_interruptible_timeout(
+                                       apsta_params->netif_change_event,
+                                       !wl_get_isam_status(tmp_if, STA_CONNECTING),
+                                       msecs_to_jiffies(MAX_STA_LINK_WAIT_TIME));
+                       } else if (enabling &&
+                                       (tmp_if->ifmode == IAP_MODE || tmp_if->ifmode == IMESH_MODE)) {
+                               timeout = wait_event_interruptible_timeout(
+                                       apsta_params->netif_change_event,
+                                       !wl_get_isam_status(tmp_if, AP_CREATING),
+                                       msecs_to_jiffies(MAX_STA_LINK_WAIT_TIME));
+                       }
+                       if (tmp_if->ifmode == ISTA_MODE)
+                               enabling = wl_get_isam_status(tmp_if, STA_CONNECTING);
+                       else if (tmp_if->ifmode == IAP_MODE || tmp_if->ifmode == IMESH_MODE)
+                               enabling = wl_get_isam_status(tmp_if, AP_CREATING);
+                       if (timeout <= 0 || enabling) {
+                               WL_MSG(cur_if->ifname, "%s[%c] is still enabling...\n",
+                                       tmp_if->ifname, tmp_if->prefix);
+                       }
+               }
+       }
+
+       return enabling;
+}
+
+static int
+wl_ext_enable_iface(struct net_device *dev, char *ifname, int wait_up)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       int i, ret = 0;
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       wlc_ssid_t ssid = { 0, {0} };
+       chanspec_t fw_chspec;
+       struct {
+               s32 cfg;
+               s32 val;
+       } bss_setbuf;
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       apstamode_t apstamode = apsta_params->apstamode;
+       struct wl_if_info *cur_if = NULL, *tmp_if = NULL;
+       uint16 cur_chan;
+       struct wl_conn_info conn_info;
+       u32 timeout;
+
+       for (i=0; i<MAX_IF_NUM; i++) {
+               tmp_if = &apsta_params->if_info[i];
+               if (tmp_if->dev && !strcmp(tmp_if->dev->name, ifname)) {
+                       cur_if = tmp_if;
+                       break;
+               }
+       }
+       if (!cur_if) {
+               AEXT_ERROR(dev->name, "wrong ifname=%s or dev not ready\n", ifname);
+               return -1;
+       }
+
+       mutex_lock(&apsta_params->usr_sync);
+
+       if (cur_if->ifmode == ISTA_MODE) {
+               wl_set_isam_status(cur_if, STA_CONNECTING);
+       } else if (cur_if->ifmode == IAP_MODE || cur_if->ifmode == IMESH_MODE) {
+               wl_set_isam_status(cur_if, AP_CREATING);
+       }
+
+       wl_ext_isam_status(cur_if->dev, NULL, 0);
+       WL_MSG(ifname, "[%c] Enabling...\n", cur_if->prefix);
+
+       wl_ext_wait_other_enabling(apsta_params, cur_if);
+
+       if (wl_ext_master_if(cur_if) && apsta_params->acs) {
+               uint16 chan_2g, chan_5g;
+               uint auto_band;
+               auto_band = WL_GET_BAND(cur_if->channel);
+               wl_ext_get_default_chan(cur_if->dev, &chan_2g, &chan_5g, TRUE);
+               if ((chan_2g && auto_band == WLC_BAND_2G) ||
+                               (chan_5g && auto_band == WLC_BAND_5G)) {
+                       cur_if->channel = wl_ext_autochannel(cur_if->dev, apsta_params->acs,
+                               auto_band);
+               } else {
+                       AEXT_ERROR(ifname, "invalid channel\n");
+                       ret = -1;
+                       goto exit;
+               }
+       }
+
+       wl_ext_move_cur_channel(apsta_params, cur_if);
+
+       if (wl_ext_master_if(cur_if) && !cur_if->channel) {
+               AEXT_ERROR(ifname, "skip channel 0\n");
+               ret = -1;
+               goto exit;
+       }
+
+       cur_chan = wl_ext_get_chan(apsta_params, cur_if->dev);
+       if (cur_chan) {
+               AEXT_INFO(cur_if->ifname, "Associated\n");
+               if (cur_chan != cur_if->channel) {
+                       wl_ext_trigger_csa(apsta_params, cur_if);
+               }
+               goto exit;
+       }
+       if (cur_if->ifmode == ISTA_MODE) {
+               wl_clr_isam_status(cur_if, STA_CONNECTED);
+       } else if (cur_if->ifmode == IAP_MODE || cur_if->ifmode == IMESH_MODE) {
+               wl_clr_isam_status(cur_if, AP_CREATED);
+       }
+
+       wl_ext_move_other_channel(apsta_params, cur_if);
+
+       if (cur_if->ifidx > 0) {
+               wl_ext_iovar_setbuf(cur_if->dev, "cur_etheraddr", (u8 *)cur_if->dev->dev_addr,
+                       ETHER_ADDR_LEN, iovar_buf, WLC_IOCTL_SMLEN, NULL);
+       }
+
+       // set ssid for AP
+       ssid.SSID_len = strlen(cur_if->ssid);
+       memcpy(ssid.SSID, cur_if->ssid, ssid.SSID_len);
+       if (cur_if->ifmode == IAP_MODE || cur_if->ifmode == IMESH_MODE) {
+               wl_ext_iovar_setint(dev, "mpc", 0);
+               if (apstamode == IAPONLY_MODE || apstamode == IMESHONLY_MODE) {
+                       wl_ext_ioctl(dev, WLC_UP, NULL, 0, 1);
+               } else if (apstamode==ISTAAP_MODE || apstamode==ISTAGO_MODE) {
+                       wl_ext_iovar_setbuf_bsscfg(cur_if->dev, "ssid", &ssid, sizeof(ssid),
+                               iovar_buf, WLC_IOCTL_SMLEN, cur_if->bssidx, NULL);
+               }
+       }
+
+       if (wl_ext_master_if(cur_if)) {
+               wl_ext_set_bgnmode(cur_if);
+               if (!cur_if->channel) {
+                       cur_if->channel = 1;
+               }
+               ret = wl_ext_set_chanspec(cur_if->dev, apsta_params->ioctl_ver,
+                       cur_if->channel, &fw_chspec);
+               if (ret)
+                       goto exit;
+       }
+
+       wl_ext_set_amode(cur_if);
+       wl_ext_set_emode(apsta_params, cur_if);
+
+       if (cur_if->ifmode == ISTA_MODE) {
+               conn_info.bssidx = cur_if->bssidx;
+               conn_info.channel = cur_if->channel;
+               memcpy(conn_info.ssid.SSID, cur_if->ssid, strlen(cur_if->ssid));
+               conn_info.ssid.SSID_len = strlen(cur_if->ssid);
+               memcpy(&conn_info.bssid, &cur_if->bssid, ETHER_ADDR_LEN);
+       }
+       if (cur_if->ifmode == IAP_MODE) {
+               if (cur_if->maxassoc >= 0)
+                       wl_ext_iovar_setint(dev, "maxassoc", cur_if->maxassoc);
+               // terence: fix me, hidden does not work in dualAP mode
+               if (cur_if->hidden > 0) {
+                       wl_ext_ioctl(cur_if->dev, WLC_SET_CLOSED, &cur_if->hidden,
+                               sizeof(cur_if->hidden), 1);
+                       WL_MSG(ifname, "[%c] Broadcast SSID: %s\n",
+                               cur_if->prefix, cur_if->hidden ? "OFF":"ON");
+               }
+       }
+
+       if (apstamode == ISTAONLY_MODE) {
+               wl_ext_connect(cur_if->dev, &conn_info);
+       } else if (apstamode == IAPONLY_MODE) {
+               wl_ext_ioctl(cur_if->dev, WLC_SET_SSID, &ssid, sizeof(ssid), 1);
+               wl_ext_ioctl(dev, WLC_UP, NULL, 0, 1);
+       } else if (apstamode == ISTAAP_MODE || apstamode == ISTAGO_MODE) {
+               if (cur_if->ifmode == ISTA_MODE) {
+                       wl_ext_connect(cur_if->dev, &conn_info);
+               } else {
+                       if (FW_SUPPORTED(dhd, rsdb)) {
+                               wl_ext_ioctl(cur_if->dev, WLC_SET_SSID, &ssid, sizeof(ssid), 1);
+                       } else {
+                               bss_setbuf.cfg = htod32(cur_if->bssidx);
+                               bss_setbuf.val = htod32(1);
+                               wl_ext_iovar_setbuf(cur_if->dev, "bss", &bss_setbuf,
+                                       sizeof(bss_setbuf), iovar_buf, WLC_IOCTL_SMLEN, NULL);
+                       }
+#ifdef ARP_OFFLOAD_SUPPORT
+                       /* IF SoftAP is enabled, disable arpoe */
+                       dhd_arp_offload_set(dhd, 0);
+                       dhd_arp_offload_enable(dhd, FALSE);
+#endif /* ARP_OFFLOAD_SUPPORT */
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+                       if (!(FW_SUPPORTED(dhd, rsdb)) && !disable_proptx) {
+                               bool enabled;
+                               dhd_wlfc_get_enable(dhd, &enabled);
+                               if (!enabled) {
+                                       dhd_wlfc_init(dhd);
+                                       wl_ext_ioctl(dev, WLC_UP, NULL, 0, 1);
+                               }
+                       }
+#endif /* BCMSDIO */
+#endif /* PROP_TXSTATUS_VSDB */
+               }
+       }
+       else if (apstamode == IDUALAP_MODE) {
+               wl_ext_ioctl(cur_if->dev, WLC_SET_SSID, &ssid, sizeof(ssid), 1);
+       } else if (apstamode == ISTAAPAP_MODE) {
+               if (cur_if->ifmode == ISTA_MODE) {
+                       wl_ext_connect(cur_if->dev, &conn_info);
+               } else if (cur_if->ifmode == IAP_MODE) {
+                       wl_ext_ioctl(cur_if->dev, WLC_SET_SSID, &ssid, sizeof(ssid), 1);
+               } else {
+                       AEXT_ERROR(cur_if->ifname, "wrong ifmode %d\n", cur_if->ifmode);
+               }
+#ifdef WLMESH
+       } else if (apstamode == IMESHONLY_MODE ||
+                       apstamode == ISTAMESH_MODE || apstamode == IMESHAP_MODE ||
+                       apstamode == ISTAAPMESH_MODE || apstamode == IMESHAPAP_MODE) {
+               if (cur_if->ifmode == ISTA_MODE) {
+                       wl_ext_connect(cur_if->dev, &conn_info);
+               } else if (cur_if->ifmode == IAP_MODE) {
+                       wl_ext_ioctl(cur_if->dev, WLC_SET_SSID, &ssid, sizeof(ssid), 1);
+               } else if (cur_if->ifmode == IMESH_MODE) {
+                       struct wl_join_params join_params;
+                       // need to up before setting ssid
+                       memset(&join_params, 0, sizeof(join_params));
+                       join_params.ssid.SSID_len = strlen(cur_if->ssid);
+                       memcpy((void *)join_params.ssid.SSID, cur_if->ssid, strlen(cur_if->ssid));
+                       join_params.params.chanspec_list[0] = fw_chspec;
+                       join_params.params.chanspec_num = 1;
+                       wl_ext_ioctl(cur_if->dev, WLC_SET_SSID, &join_params, sizeof(join_params), 1);
+               } else {
+                       AEXT_ERROR(cur_if->ifname, "wrong ifmode %d\n", cur_if->ifmode);
+               }
+#endif /* WLMESH */
+       }
+
+       if (wait_up) {
+               OSL_SLEEP(wait_up);
+       } else if (cur_if->ifmode == IAP_MODE || cur_if->ifmode == IMESH_MODE) {
+               timeout = wait_event_interruptible_timeout(apsta_params->netif_change_event,
+                       wl_get_isam_status(cur_if, AP_CREATED),
+                       msecs_to_jiffies(MAX_AP_LINK_WAIT_TIME));
+               if (timeout <= 0 || !wl_get_isam_status(cur_if, AP_CREATED)) {
+                       mutex_unlock(&apsta_params->usr_sync);
+                       wl_ext_disable_iface(dev, cur_if->ifname);
+                       WL_MSG(ifname, "[%c] failed to enable with SSID: \"%s\"\n",
+                               cur_if->prefix, cur_if->ssid);
+                       ret = -1;
+               }
+       }
+
+       if (wl_get_isam_status(cur_if, AP_CREATED) &&
+                       (cur_if->ifmode == IMESH_MODE || cur_if->ifmode == IAP_MODE) &&
+                       (apstamode == ISTAAP_MODE || apstamode == ISTAAPAP_MODE ||
+                       apstamode == ISTAMESH_MODE || apstamode == IMESHAP_MODE ||
+                       apstamode == ISTAAPMESH_MODE || apstamode == IMESHAPAP_MODE)) {
+               int scan_assoc_time = 80;
+               for (i=0; i<MAX_IF_NUM; i++) {
+                       tmp_if = &apsta_params->if_info[i];
+                       if (tmp_if->dev && tmp_if->ifmode == ISTA_MODE) {
+                               wl_ext_ioctl(tmp_if->dev, WLC_SET_SCAN_CHANNEL_TIME,
+                                       &scan_assoc_time, sizeof(scan_assoc_time), 1);
+                       }
+               }
+       }
+
+       wl_ext_isam_status(cur_if->dev, NULL, 0);
+
+exit:
+       if (cur_if->ifmode == IAP_MODE || cur_if->ifmode == IMESH_MODE) {
+               wl_clr_isam_status(cur_if, AP_CREATING);
+       }
+       WL_MSG(ifname, "[%c] Exit ret=%d\n", cur_if->prefix, ret);
+       mutex_unlock(&apsta_params->usr_sync);
+       return ret;
+}
+
+static int
+wl_ext_iapsta_enable(struct net_device *dev, char *command, int total_len)
+{
+       int ret = 0;
+       char *pch, *pick_tmp, *param;
+       char ifname[IFNAMSIZ+1];
+
+       AEXT_TRACE(dev->name, "command=%s, len=%d\n", command, total_len);
+
+       pick_tmp = command;
+       param = bcmstrtok(&pick_tmp, " ", 0); // skip iapsta_enable
+       param = bcmstrtok(&pick_tmp, " ", 0);
+       while (param != NULL) {
+               if (!strcmp(param, "ifname")) {
+                       pch = bcmstrtok(&pick_tmp, " ", 0);
+                       if (pch) {
+                               strcpy(ifname, pch);
+                               ret = wl_ext_enable_iface(dev, ifname, 0);
+                               if (ret)
+                                       return ret;
+                       } else {
+                               AEXT_ERROR(dev->name, "ifname [wlanX]\n");
+                               return -1;
+                       }
+               }
+               param = bcmstrtok(&pick_tmp, " ", 0);
+       }
+
+       return ret;
+}
+
+#ifdef PROPTX_MAXCOUNT
+int
+wl_ext_get_wlfc_maxcount(struct dhd_pub *dhd, int ifidx)
+{
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       struct wl_if_info *tmp_if, *cur_if = NULL;
+       int i, maxcount = WL_TXSTATUS_FREERUNCTR_MASK;
+
+       if (!apsta_params->rsdb)
+               return maxcount;
+
+       for (i=0; i<MAX_IF_NUM; i++) {
+               tmp_if = &apsta_params->if_info[i];
+               if (tmp_if->dev && tmp_if->ifidx == ifidx) {
+                       cur_if = tmp_if;
+                       maxcount = cur_if->transit_maxcount;
+               }
+       }
+
+       if (cur_if)
+               AEXT_INFO(cur_if->ifname, "update maxcount %d\n", maxcount);
+       else
+               AEXT_INFO("wlan", "update maxcount %d for ifidx %d\n", maxcount, ifidx);
+       return maxcount;
+}
+
+void
+wl_ext_update_wlfc_maxcount(struct dhd_pub *dhd)
+{
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       struct wl_if_info *tmp_if;
+       bool band_5g = FALSE;
+       uint16 chan = 0;
+       int i, ret;
+
+       if (!apsta_params->rsdb)
+               return;
+
+       for (i=0; i<MAX_IF_NUM; i++) {
+               tmp_if = &apsta_params->if_info[i];
+               if (tmp_if->dev) {
+                       chan = wl_ext_get_chan(apsta_params, tmp_if->dev);
+                       if (chan > CH_MAX_2G_CHANNEL) {
+                               tmp_if->transit_maxcount = dhd->conf->proptx_maxcnt_5g;
+                               ret = dhd_wlfc_update_maxcount(dhd, tmp_if->ifidx,
+                                       tmp_if->transit_maxcount);
+                               if (ret == 0)
+                                       AEXT_INFO(tmp_if->ifname, "updated maxcount %d\n",
+                                               tmp_if->transit_maxcount);
+                               band_5g = TRUE;
+                       }
+               }
+       }
+
+       for (i=0; i<MAX_IF_NUM; i++) {
+               tmp_if = &apsta_params->if_info[i];
+               if (tmp_if->dev) {
+                       chan = wl_ext_get_chan(apsta_params, tmp_if->dev);
+                       if ((chan == 0) || (chan <= CH_MAX_2G_CHANNEL && chan >= CH_MIN_2G_CHANNEL)) {
+                               if (chan == 0) {
+                                       tmp_if->transit_maxcount = WL_TXSTATUS_FREERUNCTR_MASK;
+                               } else if (band_5g) {
+                                       tmp_if->transit_maxcount = dhd->conf->proptx_maxcnt_2g;
+                               } else {
+                                       tmp_if->transit_maxcount = dhd->conf->proptx_maxcnt_5g;
+                               }
+                               ret = dhd_wlfc_update_maxcount(dhd, tmp_if->ifidx,
+                                       tmp_if->transit_maxcount);
+                               if (ret == 0)
+                                       AEXT_INFO(tmp_if->ifname, "updated maxcount %d\n",
+                                               tmp_if->transit_maxcount);
+                       }
+               }
+       }
+}
+#endif /* PROPTX_MAXCOUNT */
+
+static int
+wl_ext_iapsta_event(struct net_device *dev,
+       struct wl_apsta_params *apsta_params, wl_event_msg_t *e, void* data)
+{
+       struct wl_if_info *cur_if = NULL, *tmp_if = NULL;
+#if defined(WLMESH) && defined(WL_ESCAN)
+       struct wl_if_info *mesh_if = NULL;
+#endif /* WLMESH && WL_ESCAN */
+       int i;
+       uint32 event_type = ntoh32(e->event_type);
+       uint32 status =  ntoh32(e->status);
+       uint32 reason =  ntoh32(e->reason);
+       uint16 flags =  ntoh16(e->flags);
+
+       for (i=0; i<MAX_IF_NUM; i++) {
+               tmp_if = &apsta_params->if_info[i];
+               if (tmp_if->dev == dev) {
+                       cur_if = tmp_if;
+                       break;
+               }
+       }
+#if defined(WLMESH) && defined(WL_ESCAN)
+       for (i=0; i<MAX_IF_NUM; i++) {
+               tmp_if = &apsta_params->if_info[i];
+               if (tmp_if->dev && tmp_if->ifmode == IMESH_MODE) {
+                       mesh_if = tmp_if;
+                       break;
+               }
+       }
+#endif /* WLMESH && WL_ESCAN */
+       if (!cur_if || !cur_if->dev) {
+               AEXT_DBG(dev->name, "ifidx %d is not ready\n", e->ifidx);
+               return -1;
+       }
+
+       if (cur_if->ifmode == ISTA_MODE || cur_if->ifmode == IGC_MODE) {
+               if (event_type == WLC_E_LINK) {
+                       if (!(flags & WLC_EVENT_MSG_LINK)) {
+                               WL_MSG(cur_if->ifname,
+                                       "[%c] Link down with %pM, %s(%d), reason %d\n",
+                                       cur_if->prefix, &e->addr, bcmevent_get_name(event_type),
+                                       event_type, reason);
+                               wl_clr_isam_status(cur_if, STA_CONNECTED);
+#if defined(WLMESH) && defined(WL_ESCAN)
+                               if (mesh_if && apsta_params->macs)
+                                       wl_mesh_clear_mesh_info(apsta_params, mesh_if, TRUE);
+#endif /* WLMESH && WL_ESCAN */
+                       } else {
+                               WL_MSG(cur_if->ifname, "[%c] Link UP with %pM\n",
+                                       cur_if->prefix, &e->addr);
+                               wl_set_isam_status(cur_if, STA_CONNECTED);
+#if defined(WLMESH) && defined(WL_ESCAN)
+                               if (mesh_if && apsta_params->macs)
+                                       wl_mesh_update_master_info(apsta_params, mesh_if);
+#endif /* WLMESH && WL_ESCAN */
+                       }
+                       wl_clr_isam_status(cur_if, STA_CONNECTING);
+                       wake_up_interruptible(&apsta_params->netif_change_event);
+#ifdef PROPTX_MAXCOUNT
+                       wl_ext_update_wlfc_maxcount(apsta_params->dhd);
+#endif /* PROPTX_MAXCOUNT */
+               } else if (event_type == WLC_E_SET_SSID && status != WLC_E_STATUS_SUCCESS) {
+                       WL_MSG(cur_if->ifname,
+                               "connect failed event=%d, reason=%d, status=%d\n",
+                               event_type, reason, status);
+                       wl_clr_isam_status(cur_if, STA_CONNECTING);
+                       wake_up_interruptible(&apsta_params->netif_change_event);
+#if defined(WLMESH) && defined(WL_ESCAN)
+                       if (mesh_if && apsta_params->macs)
+                               wl_mesh_clear_mesh_info(apsta_params, mesh_if, TRUE);
+#endif /* WLMESH && WL_ESCAN */
+#ifdef PROPTX_MAXCOUNT
+                       wl_ext_update_wlfc_maxcount(apsta_params->dhd);
+#endif /* PROPTX_MAXCOUNT */
+               } else if (event_type == WLC_E_DEAUTH || event_type == WLC_E_DEAUTH_IND ||
+                               event_type == WLC_E_DISASSOC || event_type == WLC_E_DISASSOC_IND) {
+                       WL_MSG(cur_if->ifname, "[%c] Link down with %pM, %s(%d), reason %d\n",
+                               cur_if->prefix, &e->addr, bcmevent_get_name(event_type),
+                               event_type, reason);
+#if defined(WLMESH) && defined(WL_ESCAN)
+                       if (mesh_if && apsta_params->macs)
+                               wl_mesh_clear_mesh_info(apsta_params, mesh_if, TRUE);
+#endif /* WLMESH && WL_ESCAN */
+               }
+       }
+       else if (cur_if->ifmode == IAP_MODE || cur_if->ifmode == IMESH_MODE) {
+               if ((event_type == WLC_E_SET_SSID && status == WLC_E_STATUS_SUCCESS) ||
+                               (event_type == WLC_E_LINK && status == WLC_E_STATUS_SUCCESS &&
+                               reason == WLC_E_REASON_INITIAL_ASSOC)) {
+                       if (wl_get_isam_status(cur_if, AP_CREATING)) {
+                               WL_MSG(cur_if->ifname, "[%c] Link up (etype=%d)\n",
+                                       cur_if->prefix, event_type);
+                               wl_set_isam_status(cur_if, AP_CREATED);
+                               wake_up_interruptible(&apsta_params->netif_change_event);
+                       } else {
+                               wl_set_isam_status(cur_if, AP_CREATED);
+                               WL_MSG(cur_if->ifname, "[%c] Link up w/o creating? (etype=%d)\n",
+                                       cur_if->prefix, event_type);
+                       }
+#ifdef PROPTX_MAXCOUNT
+                       wl_ext_update_wlfc_maxcount(apsta_params->dhd);
+#endif /* PROPTX_MAXCOUNT */
+               }
+               else if ((event_type == WLC_E_LINK && reason == WLC_E_LINK_BSSCFG_DIS) ||
+                               (event_type == WLC_E_LINK && status == WLC_E_STATUS_SUCCESS &&
+                               reason == WLC_E_REASON_DEAUTH)) {
+                       wl_clr_isam_status(cur_if, AP_CREATED);
+                       WL_MSG(cur_if->ifname, "[%c] Link down, reason=%d\n",
+                               cur_if->prefix, reason);
+#ifdef PROPTX_MAXCOUNT
+                       wl_ext_update_wlfc_maxcount(apsta_params->dhd);
+#endif /* PROPTX_MAXCOUNT */
+               }
+               else if ((event_type == WLC_E_ASSOC_IND || event_type == WLC_E_REASSOC_IND) &&
+                               reason == DOT11_SC_SUCCESS) {
+                       WL_MSG(cur_if->ifname, "[%c] connected device %pM\n",
+                               cur_if->prefix, &e->addr);
+                       wl_ext_isam_status(cur_if->dev, NULL, 0);
+               }
+               else if (event_type == WLC_E_DISASSOC_IND ||
+                               event_type == WLC_E_DEAUTH_IND ||
+                               (event_type == WLC_E_DEAUTH && reason != DOT11_RC_RESERVED)) {
+                       WL_MSG_RLMT(cur_if->ifname, &e->addr, ETHER_ADDR_LEN,
+                               "[%c] disconnected device %pM, %s(%d), reason=%d\n",
+                               cur_if->prefix, &e->addr, bcmevent_get_name(event_type),
+                               event_type, reason);
+                       wl_ext_isam_status(cur_if->dev, NULL, 0);
+               }
+#if defined(WLMESH) && defined(WL_ESCAN)
+               if (cur_if->ifmode == IMESH_MODE && apsta_params->macs)
+                       wl_mesh_event_handler(apsta_params, cur_if, e, data);
+#endif /* WLMESH && WL_ESCAN */
+       }
+
+       return 0;
+}
+
+#ifdef WL_CFG80211
+u32
+wl_ext_iapsta_update_channel(dhd_pub_t *dhd, struct net_device *dev,
+       u32 channel)
+{
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       struct wl_if_info *cur_if = NULL, *tmp_if = NULL;
+       int i;
+
+       for (i=0; i<MAX_IF_NUM; i++) {
+               tmp_if = &apsta_params->if_info[i];
+               if (tmp_if->dev && tmp_if->dev == dev) {
+                       cur_if = tmp_if;
+                       break;
+               }
+       }
+
+       if (cur_if) {
+               wl_ext_isam_status(cur_if->dev, NULL, 0);
+               cur_if->channel = channel;
+               if (wl_ext_master_if(cur_if) && apsta_params->acs) {
+                       uint auto_band = WL_GET_BAND(channel);
+                       cur_if->channel = wl_ext_autochannel(cur_if->dev, apsta_params->acs,
+                               auto_band);
+               }
+               channel = wl_ext_move_cur_channel(apsta_params, cur_if);
+               if (channel)
+                       wl_ext_move_other_channel(apsta_params, cur_if);
+               if (cur_if->ifmode == ISTA_MODE)
+                       wl_set_isam_status(cur_if, STA_CONNECTING);
+       }
+
+       return channel;
+}
+
+static int
+wl_ext_iftype_to_ifmode(struct net_device *net, int wl_iftype, ifmode_t *ifmode)
+{      
+       switch (wl_iftype) {
+               case WL_IF_TYPE_STA:
+                       *ifmode = ISTA_MODE;
+                       break;
+               case WL_IF_TYPE_AP:
+                       *ifmode = IAP_MODE;
+                       break;
+               case WL_IF_TYPE_P2P_GO:
+                       *ifmode = IGO_MODE;
+                       break;
+               case WL_IF_TYPE_P2P_GC:
+                       *ifmode = IGC_MODE;
+                       break;
+               default:
+                       AEXT_ERROR(net->name, "Unknown interface wl_iftype:0x%x\n", wl_iftype);
+                       return BCME_ERROR;
+       }
+       return BCME_OK;
+}
+
+void
+wl_ext_iapsta_update_iftype(struct net_device *net, int ifidx, int wl_iftype)
+{
+       struct dhd_pub *dhd = dhd_get_pub(net);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       struct wl_if_info *cur_if = NULL;
+
+       AEXT_TRACE(net->name, "ifidx=%d, wl_iftype=%d\n", ifidx, wl_iftype);
+
+       if (ifidx < MAX_IF_NUM) {
+               cur_if = &apsta_params->if_info[ifidx];
+       }
+
+       if (cur_if) {
+               if (wl_iftype == WL_IF_TYPE_STA) {
+                       cur_if->ifmode = ISTA_MODE;
+                       cur_if->prio = PRIO_STA;
+                       cur_if->prefix = 'S';
+               } else if (wl_iftype == WL_IF_TYPE_AP && cur_if->ifmode != IMESH_MODE) {
+                       cur_if->ifmode = IAP_MODE;
+                       cur_if->prio = PRIO_AP;
+                       cur_if->prefix = 'A';
+               } else if (wl_iftype == WL_IF_TYPE_P2P_GO) {
+                       cur_if->ifmode = IGO_MODE;
+                       cur_if->prio = PRIO_AP;
+                       cur_if->prefix = 'P';
+                       apsta_params->vsdb = TRUE;
+               } else if (wl_iftype == WL_IF_TYPE_P2P_GC) {
+                       cur_if->ifmode = IGC_MODE;
+                       cur_if->prio = PRIO_STA;
+                       cur_if->prefix = 'P';
+                       apsta_params->vsdb = TRUE;
+                       wl_ext_iovar_setint(cur_if->dev, "assoc_retry_max", 3);
+               }
+       }
+}
+
+void
+wl_ext_iapsta_ifadding(struct net_device *net, int ifidx)
+{
+       struct dhd_pub *dhd = dhd_get_pub(net);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       struct wl_if_info *cur_if = NULL;
+
+       AEXT_TRACE(net->name, "ifidx=%d\n", ifidx);
+       if (ifidx < MAX_IF_NUM) {
+               cur_if = &apsta_params->if_info[ifidx];
+               wl_set_isam_status(cur_if, IF_ADDING);
+       }
+}
+
+bool
+wl_ext_iapsta_iftype_enabled(struct net_device *net, int wl_iftype)
+{
+       struct dhd_pub *dhd = dhd_get_pub(net);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       struct wl_if_info *cur_if = NULL;
+       ifmode_t ifmode = 0;
+
+       wl_ext_iftype_to_ifmode(net, wl_iftype, &ifmode);
+       cur_if = wl_ext_if_enabled(apsta_params, ifmode);
+       if (cur_if)
+               return TRUE;
+
+       return FALSE;
+}
+
+bool
+wl_ext_iapsta_mesh_creating(struct net_device *net)
+{
+       struct dhd_pub *dhd = dhd_get_pub(net);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       struct wl_if_info *cur_if;
+       int i;
+
+       if (apsta_params) {
+               for (i=0; i<MAX_IF_NUM; i++) {
+                       cur_if = &apsta_params->if_info[i];
+                       if (cur_if->ifmode==IMESH_MODE && wl_get_isam_status(cur_if, IF_ADDING))
+                               return TRUE;
+               }
+       }
+       return FALSE;
+}
+#endif /* WL_CFG80211 */
+
+int
+wl_ext_iapsta_alive_preinit(struct net_device *dev)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+
+       if (apsta_params->init == TRUE) {
+               AEXT_ERROR(dev->name, "don't init twice\n");
+               return -1;
+       }
+
+       AEXT_TRACE(dev->name, "Enter\n");
+
+       apsta_params->init = TRUE;
+
+       return 0;
+}
+
+int
+wl_ext_iapsta_alive_postinit(struct net_device *dev)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       s32 apsta = 0, ap = 0;
+       struct wl_if_info *cur_if;
+       int i;
+
+       wl_ext_iovar_getint(dev, "apsta", &apsta);
+       wl_ext_ioctl(dev, WLC_GET_AP, &ap, sizeof(ap), 0);
+       if (apsta == 1 || ap == 0) {
+               apsta_params->apstamode = ISTAONLY_MODE;
+               apsta_params->if_info[IF_PIF].ifmode = ISTA_MODE;
+               op_mode = DHD_FLAG_STA_MODE;
+       } else {
+               apsta_params->apstamode = IAPONLY_MODE;
+               apsta_params->if_info[IF_PIF].ifmode = IAP_MODE;
+               op_mode = DHD_FLAG_HOSTAP_MODE;
+       }
+       // fix me: how to check it's ISTAAP_MODE or IDUALAP_MODE?
+
+       wl_ext_get_ioctl_ver(dev, &apsta_params->ioctl_ver);
+       WL_MSG(dev->name, "apstamode=%d\n", apsta_params->apstamode);
+
+       for (i=0; i<MAX_IF_NUM; i++) {
+               cur_if = &apsta_params->if_info[i];
+               if (i == 1 && !strlen(cur_if->ifname))
+                       strcpy(cur_if->ifname, "wlan1");
+               if (i == 2 && !strlen(cur_if->ifname))
+                       strcpy(cur_if->ifname, "wlan2");
+               if (cur_if->ifmode == ISTA_MODE) {
+                       cur_if->channel = 0;
+                       cur_if->maxassoc = -1;
+                       wl_set_isam_status(cur_if, IF_READY);
+                       cur_if->prio = PRIO_STA;
+                       cur_if->prefix = 'S';
+                       snprintf(cur_if->ssid, DOT11_MAX_SSID_LEN, "ttt_sta");
+               } else if (cur_if->ifmode == IAP_MODE) {
+                       cur_if->channel = 1;
+                       cur_if->maxassoc = -1;
+                       wl_set_isam_status(cur_if, IF_READY);
+                       cur_if->prio = PRIO_AP;
+                       cur_if->prefix = 'A';
+                       snprintf(cur_if->ssid, DOT11_MAX_SSID_LEN, "ttt_ap");
+#ifdef WLMESH
+               } else if (cur_if->ifmode == IMESH_MODE) {
+                       cur_if->channel = 1;
+                       cur_if->maxassoc = -1;
+                       wl_set_isam_status(cur_if, IF_READY);
+                       cur_if->prio = PRIO_MESH;
+                       cur_if->prefix = 'M';
+                       snprintf(cur_if->ssid, DOT11_MAX_SSID_LEN, "ttt_mesh");
+#endif /* WLMESH */
+               }
+       }
+
+       return op_mode;
+}
+
+static int
+wl_ext_iapsta_get_rsdb(struct net_device *net, struct dhd_pub *dhd)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       wl_config_t *rsdb_p;
+       int ret = 0, rsdb = 0;
+
+       if (dhd->conf->chip == BCM4359_CHIP_ID) {
+               ret = wldev_iovar_getbuf(net, "rsdb_mode", NULL, 0,
+                       iovar_buf, WLC_IOCTL_SMLEN, NULL);
+               if (!ret) {
+                       if (dhd->conf->fw_type == FW_TYPE_MESH) {
+                               rsdb = 1;
+                       } else {
+                               rsdb_p = (wl_config_t *) iovar_buf;
+                               rsdb = rsdb_p->config;
+                       }
+               }
+       }
+
+       AEXT_INFO(net->name, "rsdb_mode=%d\n", rsdb);
+
+       return rsdb;
+}
+
+static void
+wl_ext_iapsta_postinit(struct net_device *net, struct wl_if_info *cur_if)
+{
+       struct dhd_pub *dhd = dhd_get_pub(net);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       int pm;
+
+       AEXT_TRACE(cur_if->ifname, "ifidx=%d\n", cur_if->ifidx);
+       if (cur_if->ifidx == 0) {
+               apsta_params->rsdb = wl_ext_iapsta_get_rsdb(net, dhd);
+               apsta_params->vsdb = FALSE;
+               apsta_params->csa = 0;
+               apsta_params->acs = 0;
+               apsta_params->radar = wl_ext_radar_detect(net);
+               if (dhd->conf->fw_type == FW_TYPE_MESH) {
+                       apsta_params->csa |= (CSA_FW_BIT | CSA_DRV_BIT);
+               }
+       } else {
+               if (cur_if->ifmode == ISTA_MODE) {
+                       wl_ext_iovar_setint(cur_if->dev, "roam_off", dhd->conf->roam_off);
+                       wl_ext_iovar_setint(cur_if->dev, "bcn_timeout", dhd->conf->bcn_timeout);
+                       if (dhd->conf->pm >= 0)
+                               pm = dhd->conf->pm;
+                       else
+                               pm = PM_FAST;
+                       wl_ext_ioctl(cur_if->dev, WLC_SET_PM, &pm, sizeof(pm), 1);
+                       wl_ext_iovar_setint(cur_if->dev, "assoc_retry_max", 20);
+               }
+#ifdef WLMESH
+               else if (cur_if->ifmode == IMESH_MODE) {
+                       pm = 0;
+                       wl_ext_ioctl(cur_if->dev, WLC_SET_PM, &pm, sizeof(pm), 1);
+               }
+#endif /* WLMESH */
+       }
+#ifdef PROPTX_MAXCOUNT
+       wl_ext_update_wlfc_maxcount(dhd);
+#endif /* PROPTX_MAXCOUNT */
+
+}
+
+int
+wl_ext_iapsta_attach_name(struct net_device *net, int ifidx)
+{
+       struct dhd_pub *dhd = dhd_get_pub(net);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       struct wl_if_info *cur_if = NULL;
+
+       AEXT_TRACE(net->name, "ifidx=%d\n", ifidx);
+       if (ifidx < MAX_IF_NUM) {
+               cur_if = &apsta_params->if_info[ifidx];
+       }
+       if (ifidx == 0) {
+               strcpy(cur_if->ifname, net->name);
+               wl_ext_iapsta_postinit(net, cur_if);
+               wl_set_isam_status(cur_if, IF_READY);
+       } else if (cur_if && wl_get_isam_status(cur_if, IF_ADDING)) {
+               strcpy(cur_if->ifname, net->name);
+               wl_ext_iapsta_postinit(net, cur_if);
+               wl_clr_isam_status(cur_if, IF_ADDING);
+               wl_set_isam_status(cur_if, IF_READY);
+#ifndef WL_STATIC_IF
+               wake_up_interruptible(&apsta_params->netif_change_event);
+#endif /* WL_STATIC_IF */
+       }
+
+       return 0;
+}
+
+int
+wl_ext_iapsta_update_net_device(struct net_device *net, int ifidx)
+{
+       struct dhd_pub *dhd = dhd_get_pub(net);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       struct wl_if_info *cur_if = NULL, *primary_if;
+
+       AEXT_TRACE(net->name, "ifidx=%d\n", ifidx);
+       if (ifidx < MAX_IF_NUM) {
+               cur_if = &apsta_params->if_info[ifidx];
+       }
+       if (cur_if && wl_get_isam_status(cur_if, IF_ADDING)) {
+               primary_if = &apsta_params->if_info[IF_PIF];
+               if (strlen(cur_if->ifname)) {
+                       memset(net->name, 0, sizeof(IFNAMSIZ));
+                       strcpy(net->name, cur_if->ifname);
+                       net->name[IFNAMSIZ-1] = '\0';
+               }
+#ifndef WL_STATIC_IF
+               if (apsta_params->apstamode != IUNKNOWN_MODE &&
+                               apsta_params->apstamode != ISTAAPAP_MODE &&
+                               apsta_params->apstamode != ISTASTA_MODE) {
+                       memcpy(net->dev_addr, primary_if->dev->dev_addr, ETHER_ADDR_LEN);
+                       net->dev_addr[0] |= 0x02;
+                       if (ifidx >= 2) {
+                               net->dev_addr[4] ^= 0x80;
+                               net->dev_addr[4] += ifidx;
+                               net->dev_addr[5] += (ifidx-1);
+                       }
+               }
+#endif /* WL_STATIC_IF */
+       }
+
+       return 0;
+}
+
+int
+wl_ext_iapsta_attach_netdev(struct net_device *net, int ifidx, uint8 bssidx)
+{
+       struct dhd_pub *dhd = dhd_get_pub(net);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       struct wl_if_info *cur_if = NULL, *primary_if;
+
+       AEXT_TRACE(net->name, "ifidx=%d, bssidx=%d\n", ifidx, bssidx);
+       if (ifidx < MAX_IF_NUM) {
+               cur_if = &apsta_params->if_info[ifidx];
+       }
+       if (ifidx == 0) {
+               memset(apsta_params, 0, sizeof(struct wl_apsta_params));
+               apsta_params->dhd = dhd;
+               cur_if->dev = net;
+               cur_if->ifidx = ifidx;
+               cur_if->bssidx = bssidx;
+               cur_if->ifmode = ISTA_MODE;
+               cur_if->prio = PRIO_STA;
+               cur_if->prefix = 'S';
+               wl_ext_event_register(net, dhd, WLC_E_LAST, wl_ext_iapsta_event,
+                       apsta_params, PRIO_EVENT_IAPSTA);
+               strcpy(cur_if->ifname, net->name);
+               init_waitqueue_head(&apsta_params->netif_change_event);
+               mutex_init(&apsta_params->usr_sync);
+               mutex_init(&cur_if->pm_sync);
+               INIT_DELAYED_WORK(&cur_if->pm_enable_work, wl_ext_pm_work_handler);
+       } else if (cur_if && wl_get_isam_status(cur_if, IF_ADDING)) {
+               primary_if = &apsta_params->if_info[IF_PIF];
+               cur_if->dev = net;
+               cur_if->ifidx = ifidx;
+               cur_if->bssidx = bssidx;
+               wl_ext_event_register(net, dhd, WLC_E_LAST, wl_ext_iapsta_event,
+                       apsta_params, PRIO_EVENT_IAPSTA);
+#if defined(WLMESH) && defined(WL_ESCAN)
+               if (cur_if->ifmode == IMESH_MODE && apsta_params->macs) {
+                       wl_mesh_escan_attach(dhd, cur_if);
+               }
+#endif /* WLMESH && WL_ESCAN */
+               mutex_init(&cur_if->pm_sync);
+               INIT_DELAYED_WORK(&cur_if->pm_enable_work, wl_ext_pm_work_handler);
+       }
+
+       return 0;
+}
+
+int
+wl_ext_iapsta_dettach_netdev(struct net_device *net, int ifidx)
+{
+       struct dhd_pub *dhd = dhd_get_pub(net);
+       struct wl_apsta_params *apsta_params = dhd->iapsta_params;
+       struct wl_if_info *cur_if = NULL;
+
+       if (!apsta_params)
+               return 0;
+
+       AEXT_TRACE(net->name, "ifidx=%d\n", ifidx);
+       if (ifidx < MAX_IF_NUM) {
+               cur_if = &apsta_params->if_info[ifidx];
+       }
+
+       if (ifidx == 0) {
+               wl_ext_add_remove_pm_enable_work(net, FALSE);
+               wl_ext_event_deregister(net, dhd, WLC_E_LAST, wl_ext_iapsta_event);
+#if defined(WLMESH) && defined(WL_ESCAN)
+               if (cur_if->ifmode == IMESH_MODE && apsta_params->macs) {
+                       wl_mesh_escan_detach(dhd, cur_if);
+               }
+#endif /* WLMESH && WL_ESCAN */
+               memset(apsta_params, 0, sizeof(struct wl_apsta_params));
+       } else if (cur_if && (wl_get_isam_status(cur_if, IF_READY) ||
+                       wl_get_isam_status(cur_if, IF_ADDING))) {
+               wl_ext_add_remove_pm_enable_work(net, FALSE);
+               wl_ext_event_deregister(net, dhd, WLC_E_LAST, wl_ext_iapsta_event);
+#if defined(WLMESH) && defined(WL_ESCAN)
+               if (cur_if->ifmode == IMESH_MODE && apsta_params->macs) {
+                       wl_mesh_escan_detach(dhd, cur_if);
+               }
+#endif /* WLMESH && WL_ESCAN */
+               memset(cur_if, 0, sizeof(struct wl_if_info));
+       }
+
+       return 0;
+}
+
+int
+wl_ext_iapsta_attach(dhd_pub_t *pub)
+{
+       struct wl_apsta_params *iapsta_params;
+
+       iapsta_params = kzalloc(sizeof(struct wl_apsta_params), GFP_KERNEL);
+       if (unlikely(!iapsta_params)) {
+               AEXT_ERROR("wlan", "Could not allocate apsta_params\n");
+               return -ENOMEM;
+       }
+       pub->iapsta_params = (void *)iapsta_params;
+
+       return 0;
+}
+
+void
+wl_ext_iapsta_dettach(dhd_pub_t *pub)
+{
+       if (pub->iapsta_params) {
+               kfree(pub->iapsta_params);
+               pub->iapsta_params = NULL;
+       }
+}
+#endif /* WL_EXT_IAPSTA */
+
+#ifdef IDHCP
+/*
+terence 20190409:
+dhd_priv wl dhcpc_dump
+dhd_priv wl dhcpc_param <client ip> <server ip> <lease time>
+*/
+static int
+wl_ext_dhcpc_dump(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       int ret = 0;
+       int bytes_written = 0;
+       uint32 ip_addr;
+       char buf[20]="";
+
+       if (!data) {
+               ret = wl_ext_iovar_getint(dev, "dhcpc_ip_addr", &ip_addr);
+               if (!ret) {
+                       bcm_ip_ntoa((struct ipv4_addr *)&ip_addr, buf);
+                       bytes_written += snprintf(command+bytes_written, total_len,
+                               "ipaddr %s ", buf);
+               }
+
+               ret = wl_ext_iovar_getint(dev, "dhcpc_ip_mask", &ip_addr);
+               if (!ret) {
+                       bcm_ip_ntoa((struct ipv4_addr *)&ip_addr, buf);
+                       bytes_written += snprintf(command+bytes_written, total_len,
+                               "mask %s ", buf);
+               }
+
+               ret = wl_ext_iovar_getint(dev, "dhcpc_ip_gateway", &ip_addr);
+               if (!ret) {
+                       bcm_ip_ntoa((struct ipv4_addr *)&ip_addr, buf);
+                       bytes_written += snprintf(command+bytes_written, total_len,
+                               "gw %s ", buf);
+               }
+
+               ret = wl_ext_iovar_getint(dev, "dhcpc_ip_dnsserv", &ip_addr);
+               if (!ret) {
+                       bcm_ip_ntoa((struct ipv4_addr *)&ip_addr, buf);
+                       bytes_written += snprintf(command+bytes_written, total_len,
+                               "dnsserv %s ", buf);
+               }
+
+               if (!bytes_written)
+                       bytes_written = -1;
+
+               AEXT_TRACE(dev->name, "command result is %s\n", command);
+       }
+
+       return bytes_written;
+}
+
+int
+wl_ext_dhcpc_param(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       int ret = -1, bytes_written = 0;
+       char ip_addr_str[20]="", ip_serv_str[20]="";
+       struct dhcpc_parameter dhcpc_param;
+       uint32 ip_addr, ip_serv, lease_time;
+       char iovar_buf[WLC_IOCTL_SMLEN]="\0";
+
+       if (data) {
+               AEXT_TRACE(dev->name, "cmd %s", command);
+               sscanf(data, "%s %s %d", ip_addr_str, ip_serv_str, &lease_time);
+               AEXT_TRACE(dev->name, "ip_addr = %s, ip_serv = %s, lease_time = %d",
+                       ip_addr_str, ip_serv_str, lease_time);
+
+               memset(&dhcpc_param, 0, sizeof(struct dhcpc_parameter));
+               if (!bcm_atoipv4(ip_addr_str, (struct ipv4_addr *)&ip_addr)) {
+                       AEXT_ERROR(dev->name, "wrong ip_addr_str %s\n", ip_addr_str);
+                       ret = -1;
+                       goto exit;
+               }
+               dhcpc_param.ip_addr = ip_addr;
+
+               if (!bcm_atoipv4(ip_addr_str, (struct ipv4_addr *)&ip_serv)) {
+                       AEXT_ERROR(dev->name, "wrong ip_addr_str %s\n", ip_addr_str);
+                       ret = -1;
+                       goto exit;
+               }
+               dhcpc_param.ip_serv = ip_serv;
+               dhcpc_param.lease_time = lease_time;
+               ret = wl_ext_iovar_setbuf(dev, "dhcpc_param", &dhcpc_param,
+                       sizeof(struct dhcpc_parameter), iovar_buf, sizeof(iovar_buf), NULL);
+       } else {
+               ret = wl_ext_iovar_getbuf(dev, "dhcpc_param", &dhcpc_param,
+                       sizeof(struct dhcpc_parameter), iovar_buf, WLC_IOCTL_SMLEN, NULL);
+               if (!ret) {
+                       bcm_ip_ntoa((struct ipv4_addr *)&dhcpc_param.ip_addr, ip_addr_str);
+                       bytes_written += snprintf(command + bytes_written, total_len,
+                               "ip_addr %s\n", ip_addr_str);
+                       bcm_ip_ntoa((struct ipv4_addr *)&dhcpc_param.ip_serv, ip_serv_str);
+                       bytes_written += snprintf(command + bytes_written, total_len,
+                               "ip_serv %s\n", ip_serv_str);
+                       bytes_written += snprintf(command + bytes_written, total_len,
+                               "lease_time %d\n", dhcpc_param.lease_time);
+                       AEXT_TRACE(dev->name, "command result is %s\n", command);
+                       ret = bytes_written;
+               }
+       }
+
+       exit:
+               return ret;
+}
+#endif /* IDHCP */
+
+int
+wl_ext_mkeep_alive(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       wl_mkeep_alive_pkt_t *mkeep_alive_pktp;
+       int ret = -1, i, ifidx, id, period=-1;
+       char *packet = NULL, *buf = NULL;
+       int bytes_written = 0;
+
+       if (data) {
+               buf = kmalloc(total_len, GFP_KERNEL);
+               if (buf == NULL) {
+                       AEXT_ERROR(dev->name, "Failed to allocate buffer of %d bytes\n", WLC_IOCTL_SMLEN);
+                       goto exit;
+               }
+               packet = kmalloc(WLC_IOCTL_SMLEN, GFP_KERNEL);
+               if (packet == NULL) {
+                       AEXT_ERROR(dev->name, "Failed to allocate buffer of %d bytes\n", WLC_IOCTL_SMLEN);
+                       goto exit;
+               }
+               AEXT_TRACE(dev->name, "cmd %s", command);
+               sscanf(data, "%d %d %s", &id, &period, packet);
+               AEXT_TRACE(dev->name, "id=%d, period=%d, packet=%s", id, period, packet);
+               if (period >= 0) {
+                       ifidx = dhd_net2idx(dhd->info, dev);
+                       ret = dhd_conf_mkeep_alive(dhd, ifidx, id, period, packet, FALSE);
+               } else {
+                       if (id < 0)
+                               id = 0;
+                       ret = wl_ext_iovar_getbuf(dev, "mkeep_alive", &id, sizeof(id), buf,
+                               total_len, NULL);
+                       if (!ret) {
+                               mkeep_alive_pktp = (wl_mkeep_alive_pkt_t *) buf;
+                               bytes_written += snprintf(command+bytes_written, total_len,
+                                       "Id            :%d\n"
+                                       "Period (msec) :%d\n"
+                                       "Length        :%d\n"
+                                       "Packet        :0x",
+                                       mkeep_alive_pktp->keep_alive_id,
+                                       dtoh32(mkeep_alive_pktp->period_msec),
+                                       dtoh16(mkeep_alive_pktp->len_bytes));
+                               for (i=0; i<mkeep_alive_pktp->len_bytes; i++) {
+                                       bytes_written += snprintf(command+bytes_written, total_len,
+                                               "%02x", mkeep_alive_pktp->data[i]);
+                               }
+                               AEXT_TRACE(dev->name, "command result is %s\n", command);
+                               ret = bytes_written;
+                       }
+               }
+       }
+
+exit:
+       if (buf)
+               kfree(buf);
+       if (packet)
+               kfree(packet);
+       return ret;
+}
+
+#ifdef WL_EXT_TCPKA
+static int
+wl_ext_tcpka_conn_add(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       int ret = 0;
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       tcpka_conn_t *tcpka = NULL;
+       uint32 sess_id = 0, ipid = 0, srcport = 0, dstport = 0, seq = 0, ack = 0,
+               tcpwin = 0, tsval = 0, tsecr = 0, len = 0, ka_payload_len = 0;
+       char dst_mac[ETHER_ADDR_STR_LEN], src_ip[IPV4_ADDR_STR_LEN],
+               dst_ip[IPV4_ADDR_STR_LEN], ka_payload[32];
+
+       if (data) {
+               memset(dst_mac, 0, sizeof(dst_mac));
+               memset(src_ip, 0, sizeof(src_ip));
+               memset(dst_ip, 0, sizeof(dst_ip));
+               memset(ka_payload, 0, sizeof(ka_payload));
+               sscanf(data, "%d %s %s %s %d %d %d %u %u %d %u %u %u %32s",
+                       &sess_id, dst_mac, src_ip, dst_ip, &ipid, &srcport, &dstport, &seq,
+                       &ack, &tcpwin, &tsval, &tsecr, &len, ka_payload);
+
+               ka_payload_len = strlen(ka_payload) / 2;
+               tcpka = kmalloc(sizeof(struct tcpka_conn) + ka_payload_len, GFP_KERNEL);
+               if (tcpka == NULL) {
+                       AEXT_ERROR(dev->name, "Failed to allocate buffer of %d bytes\n",
+                               sizeof(struct tcpka_conn) + ka_payload_len);
+                       goto exit;
+               }
+               memset(tcpka, 0, sizeof(struct tcpka_conn) + ka_payload_len);
+
+               tcpka->sess_id = sess_id;
+               if (!(ret = bcm_ether_atoe(dst_mac, &tcpka->dst_mac))) {
+                       AEXT_ERROR(dev->name, "mac parsing err addr=%s\n", dst_mac);
+                       goto exit;
+               }
+               if (!bcm_atoipv4(src_ip, &tcpka->src_ip)) {
+                       AEXT_ERROR(dev->name, "src_ip parsing err ip=%s\n", src_ip);
+                       goto exit;
+               }
+               if (!bcm_atoipv4(dst_ip, &tcpka->dst_ip)) {
+                       AEXT_ERROR(dev->name, "dst_ip parsing err ip=%s\n", dst_ip);
+                       goto exit;
+               }
+               tcpka->ipid = ipid;
+               tcpka->srcport = srcport;
+               tcpka->dstport = dstport;
+               tcpka->seq = seq;
+               tcpka->ack = ack;
+               tcpka->tcpwin = tcpwin;
+               tcpka->tsval = tsval;
+               tcpka->tsecr = tsecr;
+               tcpka->len = len;
+               ka_payload_len = wl_pattern_atoh(ka_payload, (char *)tcpka->ka_payload);
+               if (ka_payload_len == -1) {
+                       AEXT_ERROR(dev->name,"rejecting ka_payload=%s\n", ka_payload);
+                       goto exit;
+               }
+               tcpka->ka_payload_len = ka_payload_len;
+
+               AEXT_INFO(dev->name,
+                       "tcpka_conn_add %d %pM %pM %pM %d %d %d %u %u %d %u %u %u %u \"%s\"\n",
+                       tcpka->sess_id, &tcpka->dst_mac, &tcpka->src_ip, &tcpka->dst_ip,
+                       tcpka->ipid, tcpka->srcport, tcpka->dstport, tcpka->seq,
+                       tcpka->ack, tcpka->tcpwin, tcpka->tsval, tcpka->tsecr,
+                       tcpka->len, tcpka->ka_payload_len, tcpka->ka_payload);
+
+               ret = wl_ext_iovar_setbuf(dev, "tcpka_conn_add", (char *)tcpka,
+                       (sizeof(tcpka_conn_t) + tcpka->ka_payload_len - 1),
+                       iovar_buf, sizeof(iovar_buf), NULL);
+       }
+
+exit:
+       if (tcpka)
+               kfree(tcpka);
+       return ret;
+}
+
+static int
+wl_ext_tcpka_conn_enable(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       tcpka_conn_sess_t tcpka_conn;
+       int ret = 0;
+       uint32 sess_id = 0, flag, interval = 0, retry_interval = 0, retry_count = 0;
+
+       if (data) {
+               sscanf(data, "%d %d %d %d %d",
+                       &sess_id, &flag, &interval, &retry_interval, &retry_count);
+               tcpka_conn.sess_id = sess_id;
+               tcpka_conn.flag = flag;
+               if (tcpka_conn.flag) {
+                       tcpka_conn.tcpka_timers.interval = interval;
+                       tcpka_conn.tcpka_timers.retry_interval = retry_interval;
+                       tcpka_conn.tcpka_timers.retry_count = retry_count;
+               } else {
+                       tcpka_conn.tcpka_timers.interval = 0;
+                       tcpka_conn.tcpka_timers.retry_interval = 0;
+                       tcpka_conn.tcpka_timers.retry_count = 0;
+               }
+
+               AEXT_INFO(dev->name, "tcpka_conn_enable %d %d %d %d %d\n",
+                       tcpka_conn.sess_id, tcpka_conn.flag,
+                       tcpka_conn.tcpka_timers.interval,
+                       tcpka_conn.tcpka_timers.retry_interval,
+                       tcpka_conn.tcpka_timers.retry_count);
+
+               ret = wl_ext_iovar_setbuf(dev, "tcpka_conn_enable", (char *)&tcpka_conn,
+                       sizeof(tcpka_conn_sess_t), iovar_buf, sizeof(iovar_buf), NULL);
+       }
+
+       return ret;
+}
+
+static int
+wl_ext_tcpka_conn_info(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       tcpka_conn_sess_info_t *info = NULL;
+       uint32 sess_id = 0;
+       int ret = 0, bytes_written = 0;
+
+       if (data) {
+               sscanf(data, "%d", &sess_id);
+               AEXT_INFO(dev->name, "tcpka_conn_sess_info %d\n", sess_id);
+               ret = wl_ext_iovar_getbuf(dev, "tcpka_conn_sess_info", (char *)&sess_id,
+                       sizeof(uint32), iovar_buf, sizeof(iovar_buf), NULL);
+               if (!ret) {
+                       info = (tcpka_conn_sess_info_t *) iovar_buf;
+                       bytes_written += snprintf(command+bytes_written, total_len,
+                               "id   :%d\n"
+                               "ipid :%d\n"
+                               "seq  :%u\n"
+                               "ack  :%u",
+                               sess_id, info->ipid, info->seq, info->ack);
+                       AEXT_INFO(dev->name, "%s\n", command);
+                       ret = bytes_written;
+               }
+       }
+
+       return ret;
+}
+#endif /* WL_EXT_TCPKA */
+
+static int
+wl_ext_rsdb_mode(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       wl_config_t rsdb_mode_cfg = {1, 0}, *rsdb_p;
+       int ret = 0;
+
+       if (data) {
+               rsdb_mode_cfg.config = (int)simple_strtol(data, NULL, 0);
+               ret = wl_ext_iovar_setbuf(dev, "rsdb_mode", (char *)&rsdb_mode_cfg,
+                       sizeof(rsdb_mode_cfg), iovar_buf, WLC_IOCTL_SMLEN, NULL);
+               AEXT_INFO(dev->name, "rsdb_mode %d\n", rsdb_mode_cfg.config);
+       } else {
+               ret = wl_ext_iovar_getbuf(dev, "rsdb_mode", NULL, 0,
+                       iovar_buf, WLC_IOCTL_SMLEN, NULL);
+               if (!ret) {
+                       rsdb_p = (wl_config_t *) iovar_buf;
+                       ret = snprintf(command, total_len, "%d", rsdb_p->config);
+                       AEXT_TRACE(dev->name, "command result is %s\n", command);
+               }
+       }
+
+       return ret;
+}
+
+static int
+wl_ext_recal(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       int ret = 0, i, nchan, nssid = 0;
+       int params_size = WL_SCAN_PARAMS_FIXED_SIZE + WL_NUMCHANNELS * sizeof(uint16);
+       wl_scan_params_t *params = NULL;
+       int ioctl_ver;
+       char *p;
+
+       AEXT_TRACE(dev->name, "Enter\n");
+
+       if (data) {
+               params_size += WL_SCAN_PARAMS_SSID_MAX * sizeof(wlc_ssid_t);
+               params = (wl_scan_params_t *) kzalloc(params_size, GFP_KERNEL);
+               if (params == NULL) {
+                       ret = -ENOMEM;
+                       goto exit;
+               }
+               memset(params, 0, params_size);
+
+               wl_ext_get_ioctl_ver(dev, &ioctl_ver);
+
+               memcpy(&params->bssid, &ether_bcast, ETHER_ADDR_LEN);
+               params->bss_type = DOT11_BSSTYPE_ANY;
+               params->scan_type = 0;
+               params->nprobes = -1;
+               params->active_time = -1;
+               params->passive_time = -1;
+               params->home_time = -1;
+               params->channel_num = 0;
+
+               params->scan_type |= WL_SCANFLAGS_PASSIVE;
+               nchan = 2;
+               params->channel_list[0] = wf_channel2chspec(1, WL_CHANSPEC_BW_20);
+               params->channel_list[1] = wf_channel2chspec(2, WL_CHANSPEC_BW_20);
+
+               params->nprobes = htod32(params->nprobes);
+               params->active_time = htod32(params->active_time);
+               params->passive_time = htod32(params->passive_time);
+               params->home_time = htod32(params->home_time);
+
+               for (i = 0; i < nchan; i++) {
+                       wl_ext_chspec_host_to_driver(ioctl_ver, params->channel_list[i]);
+               }
+
+               p = (char*)params->channel_list + nchan * sizeof(uint16);
+
+               params->channel_num = htod32((nssid << WL_SCAN_PARAMS_NSSID_SHIFT) |
+                                            (nchan & WL_SCAN_PARAMS_COUNT_MASK));
+               params_size = p - (char*)params + nssid * sizeof(wlc_ssid_t);
+
+               AEXT_INFO(dev->name, "recal\n");
+               ret = wl_ext_ioctl(dev, WLC_SCAN, params, params_size, 1);
+       }
+
+exit:
+       if (params)
+               kfree(params);
+       return ret;
+}
+
+static s32
+wl_ext_add_remove_eventmsg(struct net_device *ndev, u16 event, bool add)
+{
+       s8 iovbuf[WL_EVENTING_MASK_LEN + 12];
+       s8 eventmask[WL_EVENTING_MASK_LEN];
+       s32 err = 0;
+
+       if (!ndev)
+               return -ENODEV;
+
+       /* Setup event_msgs */
+       err = wldev_iovar_getbuf(ndev, "event_msgs", NULL, 0, iovbuf, sizeof(iovbuf), NULL);
+       if (unlikely(err)) {
+               AEXT_ERROR(ndev->name, "Get event_msgs error (%d)\n", err);
+               goto eventmsg_out;
+       }
+       memcpy(eventmask, iovbuf, WL_EVENTING_MASK_LEN);
+       if (add) {
+               setbit(eventmask, event);
+       } else {
+               clrbit(eventmask, event);
+       }
+       err = wldev_iovar_setbuf(ndev, "event_msgs", eventmask, WL_EVENTING_MASK_LEN, iovbuf,
+                       sizeof(iovbuf), NULL);
+       if (unlikely(err)) {
+               AEXT_ERROR(ndev->name, "Set event_msgs error (%d)\n", err);
+               goto eventmsg_out;
+       }
+
+eventmsg_out:
+       return err;
+}
+
+static int
+wl_ext_event_msg(struct net_device *dev, char *data,
+       char *command, int total_len)
+{
+       s8 iovbuf[WL_EVENTING_MASK_LEN + 12];
+       s8 eventmask[WL_EVENTING_MASK_LEN];
+       int i, bytes_written = 0, add = -1;
+       uint event;
+       char *vbuf;
+       bool skipzeros;
+
+       /* dhd_priv wl event_msg [offset] [1/0, 1 for add, 0 for remove] */
+       /* dhd_priv wl event_msg 40 1 */
+       if (data) {
+               AEXT_TRACE(dev->name, "data = %s\n", data);
+               sscanf(data, "%d %d", &event, &add);
+               /* Setup event_msgs */
+               bytes_written = wldev_iovar_getbuf(dev, "event_msgs", NULL, 0, iovbuf,
+                       sizeof(iovbuf), NULL);
+               if (unlikely(bytes_written)) {
+                       AEXT_ERROR(dev->name, "Get event_msgs error (%d)\n", bytes_written);
+                       goto eventmsg_out;
+               }
+               memcpy(eventmask, iovbuf, WL_EVENTING_MASK_LEN);
+               if (add == -1) {
+                       if (isset(eventmask, event))
+                               bytes_written += snprintf(command+bytes_written, total_len, "1");
+                       else
+                               bytes_written += snprintf(command+bytes_written, total_len, "0");
+                       AEXT_INFO(dev->name, "%s\n", command);
+                       goto eventmsg_out;
+               }
+               bytes_written = wl_ext_add_remove_eventmsg(dev, event, add);
+       }
+       else {
+               /* Setup event_msgs */
+               bytes_written = wldev_iovar_getbuf(dev, "event_msgs", NULL, 0, iovbuf,
+                       sizeof(iovbuf), NULL);
+               if (bytes_written) {
+                       AEXT_ERROR(dev->name, "Get event_msgs error (%d)\n", bytes_written);
+                       goto eventmsg_out;
+               }
+               vbuf = (char *)iovbuf;
+               bytes_written += snprintf(command+bytes_written, total_len, "0x");
+               for (i = (sizeof(eventmask) - 1); i >= 0; i--) {
+                       if (vbuf[i] || (i == 0))
+                               skipzeros = FALSE;
+                       if (skipzeros)
+                               continue;
+                       bytes_written += snprintf(command+bytes_written, total_len,
+                               "%02x", vbuf[i] & 0xff);
+               }
+               AEXT_INFO(dev->name, "%s\n", command);
+       }
+
+eventmsg_out:
+       return bytes_written;
+}
+
+#ifdef PKT_FILTER_SUPPORT
+extern void dhd_pktfilter_offload_set(dhd_pub_t * dhd, char *arg);
+extern void dhd_pktfilter_offload_delete(dhd_pub_t *dhd, int id);
+extern void dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode);
+static int
+wl_ext_pkt_filter_add(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       int i, filter_id, new_id = 0, cnt;
+       conf_pkt_filter_add_t *filter_add = &dhd->conf->pkt_filter_add;
+       char **pktfilter = dhd->pktfilter;
+       int err = 0;
+
+       if (data) {
+               AEXT_TRACE(dev->name, "data = %s\n", data);
+
+               new_id = simple_strtol(data, NULL, 10);
+               if (new_id <= 0) {
+                       AEXT_ERROR(dev->name, "wrong id %d\n", new_id);
+                       return -1;
+               }
+
+               cnt = dhd->pktfilter_count;
+               for (i=0; i<cnt; i++) {
+                       if (!pktfilter[i])
+                               continue;
+                       filter_id = simple_strtol(pktfilter[i], NULL, 10);
+                       if (new_id == filter_id) {
+                               AEXT_ERROR(dev->name, "filter id %d already in list\n", filter_id);
+                               return -1;
+                       }
+               }
+
+               cnt = filter_add->count;
+               if (cnt >= DHD_CONF_FILTER_MAX) {
+                       AEXT_ERROR(dev->name, "not enough filter\n");
+                       return -1;
+               }
+               for (i=0; i<cnt; i++) {
+                       filter_id = simple_strtol(filter_add->filter[i], NULL, 10);
+                       if (new_id == filter_id) {
+                               AEXT_ERROR(dev->name, "filter id %d already in list\n", filter_id);
+                               return -1;
+                       }
+               }
+
+               strcpy(&filter_add->filter[cnt][0], data);
+               dhd->pktfilter[dhd->pktfilter_count] = filter_add->filter[cnt];
+               filter_add->count++;
+               dhd->pktfilter_count++;
+
+               dhd_pktfilter_offload_set(dhd, data);
+               AEXT_INFO(dev->name, "filter id %d added\n", new_id);
+       }
+
+       return err;
+}
+
+static int
+wl_ext_pkt_filter_delete(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       int i, j, filter_id, cnt;
+       char **pktfilter = dhd->pktfilter;
+       conf_pkt_filter_add_t *filter_add = &dhd->conf->pkt_filter_add;
+       bool in_filter = FALSE;
+       int id, err = 0;
+
+       if (data) {
+               AEXT_TRACE(dev->name, "data = %s\n", data);
+               id = (int)simple_strtol(data, NULL, 0);
+
+               cnt = filter_add->count;
+               for (i=0; i<cnt; i++) {
+                       filter_id = simple_strtol(filter_add->filter[i], NULL, 10);
+                       if (id == filter_id) {
+                               in_filter = TRUE;
+                               memset(filter_add->filter[i], 0, PKT_FILTER_LEN);
+                               for (j=i; j<(cnt-1); j++) {
+                                       strcpy(filter_add->filter[j], filter_add->filter[j+1]);
+                                       memset(filter_add->filter[j+1], 0, PKT_FILTER_LEN);
+                               }
+                               cnt--;
+                               filter_add->count--;
+                               dhd->pktfilter_count--;
+                       }
+               }
+
+               cnt = dhd->pktfilter_count;
+               for (i=0; i<cnt; i++) {
+                       if (!pktfilter[i])
+                               continue;
+                       filter_id = simple_strtol(pktfilter[i], NULL, 10);
+                       if (id == filter_id) {
+                               in_filter = TRUE;
+                               memset(pktfilter[i], 0, strlen(pktfilter[i]));
+                       }
+               }
+
+               if (in_filter) {
+                       dhd_pktfilter_offload_delete(dhd, id);
+                       AEXT_INFO(dev->name, "filter id %d deleted\n", id);
+               } else {
+                       AEXT_ERROR(dev->name, "filter id %d not in list\n", id);
+                       err = -1;
+               }
+       }
+
+       return err;
+}
+
+static int
+wl_ext_pkt_filter_enable(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       int err = 0, id, enable;
+       int i, filter_id, cnt;
+       char **pktfilter = dhd->pktfilter;
+       bool in_filter = FALSE;
+
+       /* dhd_priv wl pkt_filter_enable [id] [1/0] */
+       /* dhd_priv wl pkt_filter_enable 141 1 */
+       if (data) {
+               sscanf(data, "%d %d", &id, &enable);
+
+               cnt = dhd->pktfilter_count;
+               for (i=0; i<cnt; i++) {
+                       if (!pktfilter[i])
+                               continue;
+                       filter_id = simple_strtol(pktfilter[i], NULL, 10);
+                       if (id == filter_id) {
+                               in_filter = TRUE;
+                               break;
+                       }
+               }
+
+               if (in_filter) {
+                       dhd_pktfilter_offload_enable(dhd, dhd->pktfilter[i],
+                               enable, dhd_master_mode);
+                       AEXT_INFO(dev->name, "filter id %d %s\n", id, enable?"enabled":"disabled");
+               } else {
+                       AEXT_ERROR(dev->name, "filter id %d not in list\n", id);
+                       err = -1;
+               }
+       }
+
+       return err;
+}
+#endif /* PKT_FILTER_SUPPORT */
+
+#ifdef SENDPROB
+static int
+wl_ext_send_probreq(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       int err = 0;
+       char addr_str[16], addr[6];
+       char iovar_buf[WLC_IOCTL_SMLEN]="\0";
+       char ie_data[WLC_IOCTL_SMLEN] = "\0";
+       wl_probe_params_t params;
+
+       /* dhd_priv wl send_probreq [dest. addr] [OUI+VAL] */
+       /* dhd_priv wl send_probreq 0x00904c010203 0x00904c01020304050607 */
+       if (data) {
+               AEXT_TRACE(dev->name, "data = %s\n", data);
+               sscanf(data, "%s %s", addr_str, ie_data);
+               AEXT_TRACE(dev->name, "addr=%s, ie=%s\n", addr_str, ie_data);
+
+               if (strlen(addr_str) != 14) {
+                       AEXT_ERROR(dev->name, "wrong addr %s\n", addr_str);
+                       goto exit;
+               }
+               wl_pattern_atoh(addr_str, (char *) addr);
+               memset(&params, 0, sizeof(params));
+               memcpy(&params.bssid, addr, ETHER_ADDR_LEN);
+               memcpy(&params.mac, addr, ETHER_ADDR_LEN);
+
+               err = wl_ext_add_del_ie(dev, VNDR_IE_PRBREQ_FLAG, ie_data, "add");
+               if (err)
+                       goto exit;
+               err = wl_ext_iovar_setbuf(dev, "sendprb", (char *)&params, sizeof(params),
+                       iovar_buf, sizeof(iovar_buf), NULL);
+               OSL_SLEEP(100);
+               wl_ext_add_del_ie(dev, VNDR_IE_PRBREQ_FLAG, ie_data, "del");
+       }
+
+exit:
+    return err;
+}
+
+static int
+wl_ext_send_probresp(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       int err = 0;
+       char addr_str[16], addr[6];
+       char iovar_buf[WLC_IOCTL_SMLEN]="\0";
+       char ie_data[WLC_IOCTL_SMLEN] = "\0";
+
+       /* dhd_priv wl send_probresp [dest. addr] [OUI+VAL] */
+       /* dhd_priv wl send_probresp 0x00904c010203 0x00904c01020304050607 */
+       if (data) {
+               AEXT_TRACE(dev->name, "data = %s\n", data);
+               sscanf(data, "%s %s", addr_str, ie_data);
+               AEXT_TRACE(dev->name, "addr=%s, ie=%s\n", addr_str, ie_data);
+
+               if (strlen(addr_str) != 14) {
+                       AEXT_ERROR(dev->name, "wrong addr %s\n", addr_str);
+                       goto exit;
+               }
+               wl_pattern_atoh(addr_str, (char *) addr);
+
+               err = wl_ext_add_del_ie(dev, VNDR_IE_PRBRSP_FLAG, ie_data, "add");
+               if (err)
+                       goto exit;
+               err = wl_ext_iovar_setbuf(dev, "send_probresp", addr, sizeof(addr),
+                       iovar_buf, sizeof(iovar_buf), NULL);
+               OSL_SLEEP(100);
+               wl_ext_add_del_ie(dev, VNDR_IE_PRBRSP_FLAG, ie_data, "del");
+       }
+
+exit:
+    return err;
+}
+
+static int
+wl_ext_recv_probreq(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       int err = 0, enable = 0;
+       char cmd[32];
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+
+       /* enable:
+           1. dhd_priv wl 86 0
+           2. dhd_priv wl event_msg 44 1
+           disable:
+           1. dhd_priv wl 86 2;
+           2. dhd_priv wl event_msg 44 0
+       */
+       if (data) {
+               AEXT_TRACE(dev->name, "data = %s\n", data);
+               sscanf(data, "%d", &enable);
+               if (enable) {
+                       strcpy(cmd, "wl 86 0");
+                       err = wl_ext_wl_iovar(dev, cmd, total_len);
+                       if (err)
+                               goto exit;
+                       strcpy(cmd, "wl event_msg 44 1");
+                       err = wl_ext_wl_iovar(dev, cmd, total_len);
+                       if (err)
+                               goto exit;
+                       dhd->recv_probereq = TRUE;
+               } else {
+                       if (dhd->conf->pm)
+                               strcpy(cmd, "wl 86 2"); {
+                               wl_ext_wl_iovar(dev, cmd, total_len);
+                       }
+                       strcpy(cmd, "wl event_msg 44 0");
+                       wl_ext_wl_iovar(dev, cmd, total_len);
+                       dhd->recv_probereq = FALSE;
+               }
+       }
+
+exit:
+    return err;
+}
+
+static int
+wl_ext_recv_probresp(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       int err = 0, enable = 0;
+       char cmd[32];
+
+       /* enable:
+           1. dhd_priv wl pkt_filter_add 150 0 0 0 0xFF 0x50
+           2. dhd_priv wl pkt_filter_enable 150 1 
+           3. dhd_priv wl mpc 0
+           4. dhd_priv wl 108 1
+           disable:
+           1. dhd_priv wl 108 0
+           2. dhd_priv wl mpc 1
+           3. dhd_priv wl pkt_filter_disable 150 0
+           4. dhd_priv pkt_filter_delete 150
+       */
+       if (data) {
+               AEXT_TRACE(dev->name, "data = %s\n", data);
+               sscanf(data, "%d", &enable);
+               if (enable) {
+                       strcpy(cmd, "wl pkt_filter_add 150 0 0 0 0xFF 0x50");
+                       err = wl_ext_wl_iovar(dev, cmd, total_len);
+                       if (err)
+                               goto exit;
+                       strcpy(cmd, "wl pkt_filter_enable 150 1");
+                       err = wl_ext_wl_iovar(dev, cmd, total_len);
+                       if (err)
+                               goto exit;
+                       strcpy(cmd, "wl mpc 0");
+                       err = wl_ext_wl_iovar(dev, cmd, total_len);
+                       if (err)
+                               goto exit;
+                       strcpy(cmd, "wl 108 1");
+                       err= wl_ext_wl_iovar(dev, cmd, total_len);
+               } else {
+                       strcpy(cmd, "wl 108 0");
+                       wl_ext_wl_iovar(dev, cmd, total_len);
+                       strcpy(cmd, "wl mpc 1");
+                       wl_ext_wl_iovar(dev, cmd, total_len);
+                       strcpy(cmd, "wl pkt_filter_enable 150 0");
+                       wl_ext_wl_iovar(dev, cmd, total_len);
+                       strcpy(cmd, "wl pkt_filter_delete 150");
+                       wl_ext_wl_iovar(dev, cmd, total_len);
+               }
+       }
+
+exit:
+    return err;
+}
+#endif /* SENDPROB */
+
+static int
+wl_ext_gtk_key_info(struct net_device *dev, char *data, char *command, int total_len)
+{
+       int err = 0;
+       char iovar_buf[WLC_IOCTL_SMLEN]="\0";
+       gtk_keyinfo_t keyinfo;
+       bcol_gtk_para_t bcol_keyinfo;
+
+       /* wl gtk_key_info [kck kek replay_ctr] */
+       /* wl gtk_key_info 001122..FF001122..FF00000000000001 */
+       if (data) {
+               memset(&keyinfo, 0, sizeof(keyinfo));
+               memcpy(&keyinfo, data, RSN_KCK_LENGTH+RSN_KEK_LENGTH+RSN_REPLAY_LEN);
+               if (android_msg_level & ANDROID_INFO_LEVEL) {
+                       prhex("kck", (uchar *)keyinfo.KCK, RSN_KCK_LENGTH);
+                       prhex("kek", (uchar *)keyinfo.KEK, RSN_KEK_LENGTH);
+                       prhex("replay_ctr", (uchar *)keyinfo.ReplayCounter, RSN_REPLAY_LEN);
+               }
+
+               memset(&bcol_keyinfo, 0, sizeof(bcol_keyinfo));
+               bcol_keyinfo.enable = 1;
+               bcol_keyinfo.ptk_len = 64;
+               memcpy(&bcol_keyinfo.ptk, data, RSN_KCK_LENGTH+RSN_KEK_LENGTH);
+               err = wl_ext_iovar_setbuf(dev, "bcol_gtk_rekey_ptk", &bcol_keyinfo,
+                       sizeof(bcol_keyinfo), iovar_buf, sizeof(iovar_buf), NULL);
+               if (!err) {
+                       goto exit;
+               }
+
+               err = wl_ext_iovar_setbuf(dev, "gtk_key_info", &keyinfo, sizeof(keyinfo),
+                       iovar_buf, sizeof(iovar_buf), NULL);
+               if (err) {
+                       AEXT_ERROR(dev->name, "failed to set gtk_key_info\n");
+                       goto exit;
+               }
+       }
+
+exit:
+    return err;
+}
+
+#ifdef WL_EXT_WOWL
+static int
+wl_ext_wowl_pattern(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       uint buf_len = 0;
+       int     offset;
+       char mask[128]="\0", pattern[128]="\0", add[4]="\0",
+               mask_tmp[128], *pmask_tmp;
+       uint32 masksize, patternsize, pad_len = 0;
+       wl_wowl_pattern2_t *wowl_pattern2 = NULL;
+       wl_wowl_pattern_t *wowl_pattern = NULL;
+       char *mask_and_pattern;
+       wl_wowl_pattern_list_t *list;
+       uint8 *ptr;
+       int ret = 0, i, j, v;
+
+       if (data) {
+               sscanf(data, "%s %d %s %s", add, &offset, mask_tmp, pattern);
+               if (strcmp(add, "add") != 0 && strcmp(add, "clr") != 0) {
+                       AEXT_ERROR(dev->name, "first arg should be add or clr\n");
+                       goto exit;
+               }
+               if (!strcmp(add, "clr")) {
+                       AEXT_INFO(dev->name, "wowl_pattern clr\n");
+                       ret = wl_ext_iovar_setbuf(dev, "wowl_pattern", add,
+                               sizeof(add), iovar_buf, sizeof(iovar_buf), NULL);
+                       goto exit;
+               }
+               masksize = strlen(mask_tmp) -2;
+               AEXT_TRACE(dev->name, "0 mask_tmp=%s, masksize=%d\n", mask_tmp, masksize);
+
+               // add pading
+               if (masksize % 16)
+                       pad_len = (16 - masksize % 16);
+               for (i=0; i<pad_len; i++)
+                       strcat(mask_tmp, "0");
+               masksize += pad_len;
+               AEXT_TRACE(dev->name, "1 mask_tmp=%s, masksize=%d\n", mask_tmp, masksize);
+
+               // translate 0x00 to 0, others to 1
+               j = 0;
+               pmask_tmp = &mask_tmp[2];
+               for (i=0; i<masksize/2; i++) {
+                       if(strncmp(&pmask_tmp[i*2], "00", 2))
+                               pmask_tmp[j] = '1';
+                       else
+                               pmask_tmp[j] = '0';
+                       j++;
+               }
+               pmask_tmp[j] = '\0';
+               masksize = masksize / 2;
+               AEXT_TRACE(dev->name, "2 mask_tmp=%s, masksize=%d\n", mask_tmp, masksize);
+
+               // reorder per 8bits
+               pmask_tmp = &mask_tmp[2];
+               for (i=0; i<masksize/8; i++) {
+                       char c;
+                       for (j=0; j<4; j++) {
+                               c = pmask_tmp[i*8+j];
+                               pmask_tmp[i*8+j] = pmask_tmp[(i+1)*8-j-1];
+                               pmask_tmp[(i+1)*8-j-1] = c;
+                       }
+               }
+               AEXT_TRACE(dev->name, "3 mask_tmp=%s, masksize=%d\n", mask_tmp, masksize);
+
+               // translate 8bits to 1byte
+               j = 0; v = 0;
+               pmask_tmp = &mask_tmp[2];
+               strcpy(mask, "0x");
+               for (i=0; i<masksize; i++) {
+                       v = (v<<1) | (pmask_tmp[i]=='1');
+                       if (((i+1)%4) == 0) {
+                               if (v < 10)
+                                       mask[j+2] = v + '0';
+                               else
+                                       mask[j+2] = (v-10) + 'a';
+                               j++;
+                               v = 0;
+                       }
+               }
+               mask[j+2] = '\0';
+               masksize = j/2;
+               AEXT_TRACE(dev->name, "4 mask=%s, masksize=%d\n", mask, masksize);
+
+               patternsize = (strlen(pattern)-2)/2;
+               buf_len = sizeof(wl_wowl_pattern2_t) + patternsize + masksize;
+               wowl_pattern2 = kmalloc(buf_len, GFP_KERNEL);
+               if (wowl_pattern2 == NULL) {
+                       AEXT_ERROR(dev->name, "Failed to allocate buffer of %d bytes\n", buf_len);
+                       goto exit;
+               }
+               memset(wowl_pattern2, 0, sizeof(wl_wowl_pattern2_t));
+
+               strncpy(wowl_pattern2->cmd, add, sizeof(add));
+               wowl_pattern2->wowl_pattern.type = 0;
+               wowl_pattern2->wowl_pattern.offset = offset;
+               mask_and_pattern = (char*)wowl_pattern2 + sizeof(wl_wowl_pattern2_t);
+
+               wowl_pattern2->wowl_pattern.masksize = masksize;
+               ret = wl_pattern_atoh(mask, mask_and_pattern);
+               if (ret == -1) {
+                       AEXT_ERROR(dev->name, "rejecting mask=%s\n", mask);
+                       goto exit;
+               }
+
+               mask_and_pattern += wowl_pattern2->wowl_pattern.masksize;
+               wowl_pattern2->wowl_pattern.patternoffset = sizeof(wl_wowl_pattern_t) +
+                       wowl_pattern2->wowl_pattern.masksize;
+
+               wowl_pattern2->wowl_pattern.patternsize = patternsize;
+               ret = wl_pattern_atoh(pattern, mask_and_pattern);
+               if (ret == -1) {
+                       AEXT_ERROR(dev->name, "rejecting pattern=%s\n", pattern);
+                       goto exit;
+               }
+
+               AEXT_INFO(dev->name, "%s %d %s %s\n", add, offset, mask, pattern);
+
+               ret = wl_ext_iovar_setbuf(dev, "wowl_pattern", (char *)wowl_pattern2,
+                       buf_len, iovar_buf, sizeof(iovar_buf), NULL);
+       }
+       else {
+               ret = wl_ext_iovar_getbuf(dev, "wowl_pattern", NULL, 0,
+                       iovar_buf, sizeof(iovar_buf), NULL);
+               if (!ret) {
+                       list = (wl_wowl_pattern_list_t *)iovar_buf;
+                       ret = snprintf(command, total_len, "#of patterns :%d\n", list->count);
+                       ptr = (uint8 *)list->pattern;
+                       for (i=0; i<list->count; i++) {
+                               uint8 *pattern;
+                               wowl_pattern = (wl_wowl_pattern_t *)ptr;
+                               ret += snprintf(command+ret, total_len,
+                                       "Pattern %d:\n"
+                                       "ID         :0x%x\n"
+                                       "Offset     :%d\n"
+                                       "Masksize   :%d\n"
+                                       "Mask       :0x",
+                                       i+1, (uint32)wowl_pattern->id, wowl_pattern->offset,
+                                       wowl_pattern->masksize);
+                               pattern = ((uint8 *)wowl_pattern + sizeof(wl_wowl_pattern_t));
+                               for (j = 0; j < wowl_pattern->masksize; j++) {
+                                       ret += snprintf(command+ret, total_len, "%02x", pattern[j]);
+                               }
+                               ret += snprintf(command+ret, total_len, "\n");
+                               ret += snprintf(command+ret, total_len,
+                                       "PatternSize:%d\n"
+                                       "Pattern    :0x",
+                                       wowl_pattern->patternsize);
+
+                               pattern = ((uint8*)wowl_pattern + wowl_pattern->patternoffset);
+                               for (j=0; j<wowl_pattern->patternsize; j++)
+                                       ret += snprintf(command+ret, total_len, "%02x", pattern[j]);
+                               ret += snprintf(command+ret, total_len, "\n");
+                               ptr += (wowl_pattern->masksize + wowl_pattern->patternsize +
+                                       sizeof(wl_wowl_pattern_t));
+                       }
+
+                       AEXT_INFO(dev->name, "%s\n", command);
+               }
+       }
+
+exit:
+       if (wowl_pattern2)
+               kfree(wowl_pattern2);
+       return ret;
+}
+
+static int
+wl_ext_wowl_wakeind(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       wl_wowl_wakeind_t *wake = NULL;
+       int ret = -1;
+       char clr[6]="\0";
+
+       if (data) {
+               sscanf(data, "%s", clr);
+               if (!strcmp(clr, "clear")) {
+                       AEXT_INFO(dev->name, "wowl_wakeind clear\n");
+                       ret = wl_ext_iovar_setbuf(dev, "wowl_wakeind", clr, sizeof(clr),
+                               iovar_buf, sizeof(iovar_buf), NULL);
+               } else {
+                       AEXT_ERROR(dev->name, "first arg should be clear\n");
+               }
+       } else {
+               ret = wl_ext_iovar_getbuf(dev, "wowl_wakeind", NULL, 0,
+                       iovar_buf, sizeof(iovar_buf), NULL);
+               if (!ret) {
+                       wake = (wl_wowl_wakeind_t *) iovar_buf;
+                       ret = snprintf(command, total_len, "wakeind=0x%x", wake->ucode_wakeind);
+                       if (wake->ucode_wakeind & WL_WOWL_MAGIC)
+                               ret += snprintf(command+ret, total_len, " (MAGIC packet)");
+                       if (wake->ucode_wakeind & WL_WOWL_NET)
+                               ret += snprintf(command+ret, total_len, " (Netpattern)");
+                       if (wake->ucode_wakeind & WL_WOWL_DIS)
+                               ret += snprintf(command+ret, total_len, " (Disassoc/Deauth)");
+                       if (wake->ucode_wakeind & WL_WOWL_BCN)
+                               ret += snprintf(command+ret, total_len, " (Loss of beacon)");
+                       if (wake->ucode_wakeind & WL_WOWL_TCPKEEP_TIME)
+                               ret += snprintf(command+ret, total_len, " (TCPKA timeout)");
+                       if (wake->ucode_wakeind & WL_WOWL_TCPKEEP_DATA)
+                               ret += snprintf(command+ret, total_len, " (TCPKA data)");
+                       if (wake->ucode_wakeind & WL_WOWL_TCPFIN)
+                               ret += snprintf(command+ret, total_len, " (TCP FIN)");
+                       AEXT_INFO(dev->name, "%s\n", command);
+               }
+       }
+
+       return ret;
+}
+#endif /* WL_EXT_WOWL */
+
+#ifdef WL_GPIO_NOTIFY
+typedef struct notify_payload {
+       int index;
+       int len;
+       char payload[128];
+} notify_payload_t;
+
+static int
+wl_ext_gpio_notify(struct net_device *dev, char *data, char *command,
+       int total_len)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       notify_payload_t notify, *pnotify = NULL;
+       int i, ret = 0, bytes_written = 0;
+       char frame_str[WLC_IOCTL_SMLEN+3];
+
+       if (data) {
+               memset(&notify, 0, sizeof(notify));
+               memset(frame_str, 0, sizeof(frame_str));
+               sscanf(data, "%d %s", &notify.index, frame_str);
+
+               if (notify.index < 0)
+                       notify.index = 0;
+
+               if (strlen(frame_str)) {
+                       notify.len = wl_pattern_atoh(frame_str, notify.payload);
+                       if (notify.len == -1) {
+                               AEXT_ERROR(dev->name, "rejecting pattern=%s\n", frame_str);
+                               goto exit;
+                       }
+                       AEXT_INFO(dev->name, "index=%d, len=%d\n", notify.index, notify.len);
+                       if (android_msg_level & ANDROID_INFO_LEVEL)
+                               prhex("payload", (uchar *)notify.payload, notify.len);
+                       ret = wl_ext_iovar_setbuf(dev, "bcol_gpio_noti", (char *)&notify,
+                               sizeof(notify), iovar_buf, WLC_IOCTL_SMLEN, NULL);
+               } else {
+                       AEXT_INFO(dev->name, "index=%d\n", notify.index);
+                       ret = wl_ext_iovar_getbuf(dev, "bcol_gpio_noti", &notify.index,
+                               sizeof(notify.index), iovar_buf, sizeof(iovar_buf), NULL);
+                       if (!ret) {
+                               pnotify = (notify_payload_t *)iovar_buf;
+                               bytes_written += snprintf(command+bytes_written, total_len,
+                                       "Id            :%d\n"
+                                       "Packet        :0x",
+                                       pnotify->index);
+                               for (i=0; i<pnotify->len; i++) {
+                                       bytes_written += snprintf(command+bytes_written, total_len,
+                                               "%02x", pnotify->payload[i]);
+                               }
+                               AEXT_TRACE(dev->name, "command result is\n%s\n", command);
+                               ret = bytes_written;
+                       }
+               }
+       }
+
+exit:
+       return ret;
+}
+#endif /* WL_GPIO_NOTIFY */
+
+#ifdef CSI_SUPPORT
+typedef struct csi_config {
+       /* Peer device mac address. */
+       struct ether_addr addr;
+       /* BW to be used in the measurements. This needs to be supported both by the */
+       /* device itself and the peer. */
+       uint32 bw;
+       /* Time interval between measurements (units: 1 ms). */
+       uint32 period;
+       /* CSI method */
+       uint32 method;
+} csi_config_t;
+
+typedef struct csi_list {
+       uint32 cnt;
+       csi_config_t configs[1];
+} csi_list_t;
+
+static int
+wl_ether_atoe(const char *a, struct ether_addr *n)
+{
+       char *c = NULL;
+       int i = 0;
+
+       memset(n, 0, ETHER_ADDR_LEN);
+       for (;;) {
+               n->octet[i++] = (uint8)strtoul(a, &c, 16);
+               if (!*c++ || i == ETHER_ADDR_LEN)
+                       break;
+               a = c;
+       }
+       return (i == ETHER_ADDR_LEN);
+}
+
+static int
+wl_ext_csi(struct net_device *dev, char *data, char *command, int total_len)
+{
+       csi_config_t csi, *csip;
+       csi_list_t *csi_list;
+       int ret = -1, period=-1, i;
+       char mac[32], *buf = NULL;
+       struct ether_addr ea;
+       int bytes_written = 0;
+
+       buf = kmalloc(WLC_IOCTL_SMLEN, GFP_KERNEL);
+       if (buf == NULL) {
+               AEXT_ERROR(dev->name, "Failed to allocate buffer of %d bytes\n", WLC_IOCTL_SMLEN);
+               goto exit;
+       }
+       memset(buf, 0, WLC_IOCTL_SMLEN);
+
+       if (data) {
+               sscanf(data, "%s %d", mac, &period);
+               ret = wl_ether_atoe(mac, &ea);
+               if (!ret) {
+                       AEXT_ERROR(dev->name, "rejecting mac=%s, ret=%d\n", mac, ret);
+                       goto exit;
+               }
+               AEXT_TRACE(dev->name, "mac=%pM, period=%d", &ea, period);
+               if (period > 0) {
+                       memset(&csi, 0, sizeof(csi_config_t));
+                       bcopy(&ea, &csi.addr, ETHER_ADDR_LEN);
+                       csi.period = period;
+                       ret = wl_ext_iovar_setbuf(dev, "csi", (char *)&csi, sizeof(csi),
+                               buf, WLC_IOCTL_SMLEN, NULL);
+               } else if (period == 0) {
+                       memset(&csi, 0, sizeof(csi_config_t));
+                       bcopy(&ea, &csi.addr, ETHER_ADDR_LEN);
+                       ret = wl_ext_iovar_setbuf(dev, "csi_del", (char *)&csi, sizeof(csi),
+                               buf, WLC_IOCTL_SMLEN, NULL);
+               } else {
+                       ret = wl_ext_iovar_getbuf(dev, "csi", &ea, ETHER_ADDR_LEN, buf,
+                               WLC_IOCTL_SMLEN, NULL);
+                       if (!ret) {
+                               csip = (csi_config_t *) buf;
+                                       /* Dump all lists */
+                               bytes_written += snprintf(command+bytes_written, total_len,
+                                       "Mac    :%pM\n"
+                                       "Period :%d\n"
+                                       "BW     :%d\n"
+                                       "Method :%d\n",
+                                       &csip->addr, csip->period, csip->bw, csip->method);
+                               AEXT_TRACE(dev->name, "command result is %s\n", command);
+                               ret = bytes_written;
+                       }
+               }
+       }
+       else {
+               ret = wl_ext_iovar_getbuf(dev, "csi_list", NULL, 0, buf, WLC_IOCTL_SMLEN, NULL);
+               if (!ret) {
+                       csi_list = (csi_list_t *)buf;
+                       bytes_written += snprintf(command+bytes_written, total_len,
+                               "Total number :%d\n", csi_list->cnt);
+                       for (i=0; i<csi_list->cnt; i++) {
+                               csip = &csi_list->configs[i];
+                               bytes_written += snprintf(command+bytes_written, total_len,
+                                       "Idx    :%d\n"
+                                       "Mac    :%pM\n"
+                                       "Period :%d\n"
+                                       "BW     :%d\n"
+                                       "Method :%d\n\n",
+                                       i+1, &csip->addr, csip->period, csip->bw, csip->method);
+                       }
+                       AEXT_TRACE(dev->name, "command result is %s\n", command);
+                       ret = bytes_written;
+               }
+       }
+
+exit:
+       if (buf)
+               kfree(buf);
+       return ret;
+}
+#endif /* CSI_SUPPORT */
+
+typedef int (wl_ext_tpl_parse_t)(struct net_device *dev, char *data, char *command,
+       int total_len);
+
+typedef struct wl_ext_iovar_tpl_t {
+       int get;
+       int set;
+       char *name;
+       wl_ext_tpl_parse_t *parse;
+} wl_ext_iovar_tpl_t;
+
+const wl_ext_iovar_tpl_t wl_ext_iovar_tpl_list[] = {
+       {WLC_GET_VAR,   WLC_SET_VAR,    "event_msg",    wl_ext_event_msg},
+       {WLC_GET_VAR,   WLC_SET_VAR,    "gtk_key_info", wl_ext_gtk_key_info},
+       {WLC_GET_VAR,   WLC_SET_VAR,    "recal",                wl_ext_recal},
+       {WLC_GET_VAR,   WLC_SET_VAR,    "rsdb_mode",    wl_ext_rsdb_mode},
+       {WLC_GET_VAR,   WLC_SET_VAR,    "mkeep_alive",  wl_ext_mkeep_alive},
+#ifdef PKT_FILTER_SUPPORT
+       {WLC_GET_VAR,   WLC_SET_VAR,    "pkt_filter_add",               wl_ext_pkt_filter_add},
+       {WLC_GET_VAR,   WLC_SET_VAR,    "pkt_filter_delete",    wl_ext_pkt_filter_delete},
+       {WLC_GET_VAR,   WLC_SET_VAR,    "pkt_filter_enable",    wl_ext_pkt_filter_enable},
+#endif /* PKT_FILTER_SUPPORT */
+#if defined(WL_EXT_IAPSTA) && defined(WLMESH)
+       {WLC_GET_VAR,   WLC_SET_VAR,    "mesh_peer_status",     wl_ext_mesh_peer_status},
+#endif /* WL_EXT_IAPSTA && WLMESH */
+#ifdef SENDPROB
+       {WLC_GET_VAR,   WLC_SET_VAR,    "send_probreq",         wl_ext_send_probreq},
+       {WLC_GET_VAR,   WLC_SET_VAR,    "send_probresp",        wl_ext_send_probresp},
+       {WLC_GET_VAR,   WLC_SET_VAR,    "recv_probreq",         wl_ext_recv_probreq},
+       {WLC_GET_VAR,   WLC_SET_VAR,    "recv_probresp",        wl_ext_recv_probresp},
+#endif /* SENDPROB */
+#ifdef WL_EXT_TCPKA
+       {WLC_GET_VAR,   WLC_SET_VAR,    "tcpka_conn_add",               wl_ext_tcpka_conn_add},
+       {WLC_GET_VAR,   WLC_SET_VAR,    "tcpka_conn_enable",    wl_ext_tcpka_conn_enable},
+       {WLC_GET_VAR,   WLC_SET_VAR,    "tcpka_conn_sess_info", wl_ext_tcpka_conn_info},
+#endif /* WL_EXT_TCPKA */
+#ifdef WL_EXT_WOWL
+       {WLC_GET_VAR,   WLC_SET_VAR,    "wowl_pattern",         wl_ext_wowl_pattern},
+       {WLC_GET_VAR,   WLC_SET_VAR,    "wowl_wakeind",         wl_ext_wowl_wakeind},
+#endif /* WL_EXT_WOWL */
+#ifdef IDHCP
+       {WLC_GET_VAR,   WLC_SET_VAR,    "dhcpc_dump",           wl_ext_dhcpc_dump},
+       {WLC_GET_VAR,   WLC_SET_VAR,    "dhcpc_param",          wl_ext_dhcpc_param},
+#endif /* IDHCP */
+#ifdef WL_GPIO_NOTIFY
+       {WLC_GET_VAR,   WLC_SET_VAR,    "bcol_gpio_noti",       wl_ext_gpio_notify},
+#endif /* WL_GPIO_NOTIFY */
+#ifdef CSI_SUPPORT
+       {WLC_GET_VAR,   WLC_SET_VAR,    "csi",                          wl_ext_csi},
+#endif /* CSI_SUPPORT */
+};
+
+/*
+Ex: dhd_priv wl [cmd] [val]
+  dhd_priv wl 85
+  dhd_priv wl 86 1
+  dhd_priv wl mpc
+  dhd_priv wl mpc 1
+*/
+static int
+wl_ext_wl_iovar(struct net_device *dev, char *command, int total_len)
+{
+       int cmd, val, ret = -1, i;
+       char name[32], *pch, *pick_tmp, *data;
+       int bytes_written=-1;
+       const wl_ext_iovar_tpl_t *tpl = wl_ext_iovar_tpl_list;
+       int tpl_count = ARRAY_SIZE(wl_ext_iovar_tpl_list);
+
+       AEXT_TRACE(dev->name, "cmd %s\n", command);
+       pick_tmp = command;
+
+       pch = bcmstrtok(&pick_tmp, " ", 0); // pick wl
+       if (!pch || strncmp(pch, "wl", 2))
+               goto exit;
+
+       pch = bcmstrtok(&pick_tmp, " ", 0); // pick cmd
+       if (!pch)
+               goto exit;
+
+       memset(name, 0 , sizeof (name));
+       cmd = (int)simple_strtol(pch, NULL, 0);
+       if (cmd == 0) {
+               strcpy(name, pch);
+       }
+       data = bcmstrtok(&pick_tmp, "", 0); // pick data
+       if (data && cmd == 0) {
+               cmd = WLC_SET_VAR;
+       } else if (cmd == 0) {
+               cmd = WLC_GET_VAR;
+       }
+
+       /* look for a matching code in the table */
+       for (i = 0; i < tpl_count; i++, tpl++) {
+               if ((tpl->get == cmd || tpl->set == cmd) && !strcmp(tpl->name, name))
+                       break;
+       }
+       if (i < tpl_count && tpl->parse) {
+               ret = tpl->parse(dev, data, command, total_len);
+       } else {
+               if (cmd == WLC_SET_VAR) {
+                       val = (int)simple_strtol(data, NULL, 0);
+                       AEXT_INFO(dev->name, "set %s %d\n", name, val);
+                       ret = wl_ext_iovar_setint(dev, name, val);
+               } else if (cmd == WLC_GET_VAR) {
+                       AEXT_INFO(dev->name, "get %s\n", name);
+                       ret = wl_ext_iovar_getint(dev, name, &val);
+                       if (!ret) {
+                               bytes_written = snprintf(command, total_len, "%d", val);
+                               AEXT_INFO(dev->name, "command result is %s\n", command);
+                               ret = bytes_written;
+                       }
+               } else if (data) {
+                       val = (int)simple_strtol(data, NULL, 0);
+                       AEXT_INFO(dev->name, "set %d %d\n", cmd, val);
+                       ret = wl_ext_ioctl(dev, cmd, &val, sizeof(val), TRUE);
+               } else {
+                       AEXT_INFO(dev->name, "get %d\n", cmd);
+                       ret = wl_ext_ioctl(dev, cmd, &val, sizeof(val), FALSE);
+                       if (!ret) {
+                               bytes_written = snprintf(command, total_len, "%d", val);
+                               AEXT_INFO(dev->name, "command result is %s\n", command);
+                               ret = bytes_written;
+                       }
+               }
+       }
+
+exit:
+       return ret;
+}
+
+int
+wl_android_ext_priv_cmd(struct net_device *net, char *command,
+       int total_len, int *bytes_written)
+{
+       int ret = 0;
+
+       if (strnicmp(command, CMD_CHANNELS, strlen(CMD_CHANNELS)) == 0) {
+               *bytes_written = wl_ext_channels(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_CHANNEL, strlen(CMD_CHANNEL)) == 0) {
+               *bytes_written = wl_ext_channel(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_ROAM_TRIGGER, strlen(CMD_ROAM_TRIGGER)) == 0) {
+               *bytes_written = wl_ext_roam_trigger(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_PM, strlen(CMD_PM)) == 0) {
+               *bytes_written = wl_ext_pm(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_MONITOR, strlen(CMD_MONITOR)) == 0) {
+               *bytes_written = wl_ext_monitor(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_SET_SUSPEND_BCN_LI_DTIM, strlen(CMD_SET_SUSPEND_BCN_LI_DTIM)) == 0) {
+               int bcn_li_dtim;
+               bcn_li_dtim = (int)simple_strtol((command + strlen(CMD_SET_SUSPEND_BCN_LI_DTIM) + 1), NULL, 10);
+               *bytes_written = net_os_set_suspend_bcn_li_dtim(net, bcn_li_dtim);
+       }
+#ifdef WL_EXT_IAPSTA
+       else if (strnicmp(command, CMD_IAPSTA_INIT, strlen(CMD_IAPSTA_INIT)) == 0 ||
+                       strnicmp(command, CMD_ISAM_INIT, strlen(CMD_ISAM_INIT)) == 0) {
+               *bytes_written = wl_ext_isam_init(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_IAPSTA_CONFIG, strlen(CMD_IAPSTA_CONFIG)) == 0 ||
+                       strnicmp(command, CMD_ISAM_CONFIG, strlen(CMD_ISAM_CONFIG)) == 0) {
+               *bytes_written = wl_ext_iapsta_config(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_IAPSTA_ENABLE, strlen(CMD_IAPSTA_ENABLE)) == 0 ||
+                       strnicmp(command, CMD_ISAM_ENABLE, strlen(CMD_ISAM_ENABLE)) == 0) {
+               *bytes_written = wl_ext_iapsta_enable(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_IAPSTA_DISABLE, strlen(CMD_IAPSTA_DISABLE)) == 0 ||
+                       strnicmp(command, CMD_ISAM_DISABLE, strlen(CMD_ISAM_DISABLE)) == 0) {
+               *bytes_written = wl_ext_iapsta_disable(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_ISAM_STATUS, strlen(CMD_ISAM_STATUS)) == 0) {
+               *bytes_written = wl_ext_isam_status(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_ISAM_PARAM, strlen(CMD_ISAM_PARAM)) == 0) {
+               *bytes_written = wl_ext_isam_param(net, command, total_len);
+       }
+#if defined(WLMESH) && defined(WL_ESCAN)
+       else if (strnicmp(command, CMD_ISAM_PEER_PATH, strlen(CMD_ISAM_PEER_PATH)) == 0) {
+               *bytes_written = wl_ext_isam_peer_path(net, command, total_len);
+       }
+#endif /* WLMESH && WL_ESCAN */
+#endif /* WL_EXT_IAPSTA */
+#ifdef WL_CFG80211
+       else if (strnicmp(command, CMD_AUTOCHANNEL, strlen(CMD_AUTOCHANNEL)) == 0) {
+               *bytes_written = wl_cfg80211_autochannel(net, command, total_len);
+       }
+#endif /* WL_CFG80211 */
+#if defined(WL_WIRELESS_EXT) && defined(WL_ESCAN)
+       else if (strnicmp(command, CMD_AUTOCHANNEL, strlen(CMD_AUTOCHANNEL)) == 0) {
+               *bytes_written = wl_iw_autochannel(net, command, total_len);
+       }
+#endif /* WL_WIRELESS_EXT && WL_ESCAN */
+       else if (strnicmp(command, CMD_WLMSGLEVEL, strlen(CMD_WLMSGLEVEL)) == 0) {
+               *bytes_written = wl_ext_wlmsglevel(net, command, total_len);
+       }
+       else if (strnicmp(command, CMD_WL, strlen(CMD_WL)) == 0) {
+               *bytes_written = wl_ext_wl_iovar(net, command, total_len);
+       }
+       else
+               ret = -1;
+
+       return ret;
+}
+
+#if defined(WL_CFG80211) || defined(WL_ESCAN)
+int
+wl_ext_get_distance(struct net_device *net, u32 band)
+{
+       u32 bw = WL_CHANSPEC_BW_20;
+       s32 bw_cap = 0, distance = 0;
+       struct {
+               u32 band;
+               u32 bw_cap;
+       } param = {0, 0};
+       char buf[WLC_IOCTL_SMLEN]="\0";
+       s32 err = BCME_OK;
+
+       param.band = band;
+       err = wl_ext_iovar_getbuf(net, "bw_cap", &param, sizeof(param), buf,
+               sizeof(buf), NULL);
+       if (err) {
+               if (err != BCME_UNSUPPORTED) {
+                       AEXT_ERROR(net->name, "bw_cap failed, %d\n", err);
+                       return err;
+               } else {
+                       err = wl_ext_iovar_getint(net, "mimo_bw_cap", &bw_cap);
+                       if (bw_cap != WLC_N_BW_20ALL)
+                               bw = WL_CHANSPEC_BW_40;
+               }
+       } else {
+               if (WL_BW_CAP_80MHZ(buf[0]))
+                       bw = WL_CHANSPEC_BW_80;
+               else if (WL_BW_CAP_40MHZ(buf[0]))
+                       bw = WL_CHANSPEC_BW_40;
+               else
+                       bw = WL_CHANSPEC_BW_20;
+       }
+
+       if (bw == WL_CHANSPEC_BW_20)
+               distance = 2;
+       else if (bw == WL_CHANSPEC_BW_40)
+               distance = 4;
+       else if (bw == WL_CHANSPEC_BW_80)
+               distance = 8;
+       else
+               distance = 16;
+       AEXT_INFO(net->name, "bw=0x%x, distance=%d\n", bw, distance);
+
+       return distance;
+}
+
+int
+wl_ext_get_best_channel(struct net_device *net,
+#if defined(BSSCACHE)
+       wl_bss_cache_ctrl_t *bss_cache_ctrl,
+#else
+       struct wl_scan_results *bss_list,
+#endif /* BSSCACHE */
+       int ioctl_ver, int *best_2g_ch, int *best_5g_ch
+)
+{
+       struct wl_bss_info *bi = NULL;  /* must be initialized */
+       s32 i, j;
+#if defined(BSSCACHE)
+       wl_bss_cache_t *node;
+#endif /* BSSCACHE */
+       int b_band[CH_MAX_2G_CHANNEL]={0}, a_band1[4]={0}, a_band4[5]={0};
+       s32 cen_ch, distance, distance_2g, distance_5g, ch, min_ap=999;
+       u8 valid_chan_list[sizeof(u32)*(WL_NUMCHANNELS + 1)];
+       wl_uint32_list_t *list;
+       int ret;
+       chanspec_t chanspec;
+       struct dhd_pub *dhd = dhd_get_pub(net);
+
+       memset(b_band, -1, sizeof(b_band));
+       memset(a_band1, -1, sizeof(a_band1));
+       memset(a_band4, -1, sizeof(a_band4));
+
+       memset(valid_chan_list, 0, sizeof(valid_chan_list));
+       list = (wl_uint32_list_t *)(void *) valid_chan_list;
+       list->count = htod32(WL_NUMCHANNELS);
+       ret = wl_ext_ioctl(net, WLC_GET_VALID_CHANNELS, &valid_chan_list,
+               sizeof(valid_chan_list), 0);
+       if (ret<0) {
+               AEXT_ERROR(net->name, "get channels failed with %d\n", ret);
+               return 0;
+       } else {
+               for (i = 0; i < dtoh32(list->count); i++) {
+                       ch = dtoh32(list->element[i]);
+                       if (!dhd_conf_match_channel(dhd, ch))
+                               continue;
+                       if (ch < CH_MAX_2G_CHANNEL)
+                               b_band[ch-1] = 0;
+                       else if (ch <= 48)
+                               a_band1[(ch-36)/4] = 0;
+                       else if (ch >= 149 && ch <= 161)
+                               a_band4[(ch-149)/4] = 0;
+               }
+       }
+
+       distance_2g = wl_ext_get_distance(net, WLC_BAND_2G);
+       distance_5g = wl_ext_get_distance(net, WLC_BAND_5G);
+
+#if defined(BSSCACHE)
+       node = bss_cache_ctrl->m_cache_head;
+       for (i=0; node && i<256; i++)
+#else
+       for (i=0; i < bss_list->count; i++)
+#endif /* BSSCACHE */
+       {
+#if defined(BSSCACHE)
+               bi = node->results.bss_info;
+#else
+               bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : bss_list->bss_info;
+#endif /* BSSCACHE */
+               chanspec = wl_ext_chspec_driver_to_host(ioctl_ver, bi->chanspec);
+               cen_ch = CHSPEC_CHANNEL(bi->chanspec);
+               distance = 0;
+               if (CHSPEC_IS20(chanspec))
+                       distance += 2;
+               else if (CHSPEC_IS40(chanspec))
+                       distance += 4;
+               else if (CHSPEC_IS80(chanspec))
+                       distance += 8;
+               else
+                       distance += 16;
+
+               if (CHSPEC_IS2G(chanspec)) {
+                       distance += distance_2g;
+                       for (j=0; j<ARRAYSIZE(b_band); j++) {
+                               if (b_band[j] >= 0 && abs(cen_ch-(1+j)) <= distance)
+                                       b_band[j] += 1;
+                       }
+               } else {
+                       distance += distance_5g;
+                       if (cen_ch <= 48) {
+                               for (j=0; j<ARRAYSIZE(a_band1); j++) {
+                                       if (a_band1[j] >= 0 && abs(cen_ch-(36+j*4)) <= distance)
+                                               a_band1[j] += 1;
+                               }
+                       } else if (cen_ch >= 149) {
+                               for (j=0; j<ARRAYSIZE(a_band4); j++) {
+                                       if (a_band4[j] >= 0 && abs(cen_ch-(149+j*4)) <= distance)
+                                               a_band4[j] += 1;
+                               }
+                       }
+               }
+#if defined(BSSCACHE)
+               node = node->next;
+#endif /* BSSCACHE */
+       }
+
+       *best_2g_ch = 0;
+       min_ap = 999;
+       for (i=0; i<CH_MAX_2G_CHANNEL; i++) {
+               if(b_band[i] < min_ap && b_band[i] >= 0) {
+                       min_ap = b_band[i];
+                       *best_2g_ch = i+1;
+               }
+       }
+       *best_5g_ch = 0;
+       min_ap = 999;
+       for (i=0; i<ARRAYSIZE(a_band1); i++) {
+               if(a_band1[i] < min_ap && a_band1[i] >= 0) {
+                       min_ap = a_band1[i];
+                       *best_5g_ch = i*4 + 36;
+               }
+       }
+       for (i=0; i<ARRAYSIZE(a_band4); i++) {
+               if(a_band4[i] < min_ap && a_band4[i] >= 0) {
+                       min_ap = a_band4[i];
+                       *best_5g_ch = i*4 + 149;
+               }
+       }
+
+       if (android_msg_level & ANDROID_INFO_LEVEL) {
+               struct bcmstrbuf strbuf;
+               char *tmp_buf = NULL;
+               tmp_buf = kmalloc(WLC_IOCTL_SMLEN, GFP_KERNEL);
+               if (tmp_buf == NULL) {
+                       AEXT_ERROR(net->name, "Failed to allocate buffer of %d bytes\n", WLC_IOCTL_SMLEN);
+                       goto exit;
+               }
+               bcm_binit(&strbuf, tmp_buf, WLC_IOCTL_SMLEN);
+               for (j=0; j<ARRAYSIZE(b_band); j++)
+                       bcm_bprintf(&strbuf, "%d/%d, ", b_band[j], 1+j);
+               bcm_bprintf(&strbuf, "\n");
+               for (j=0; j<ARRAYSIZE(a_band1); j++)
+                       bcm_bprintf(&strbuf, "%d/%d, ", a_band1[j], 36+j*4);
+               bcm_bprintf(&strbuf, "\n");
+               for (j=0; j<ARRAYSIZE(a_band4); j++)
+                       bcm_bprintf(&strbuf, "%d/%d, ", a_band4[j], 149+j*4);
+               bcm_bprintf(&strbuf, "\n");
+               bcm_bprintf(&strbuf, "best_2g_ch=%d, best_5g_ch=%d\n",
+                       *best_2g_ch, *best_5g_ch);
+               AEXT_INFO(net->name, "\n%s", strbuf.origbuf);
+               if (tmp_buf) {
+                       kfree(tmp_buf);
+               }
+       }
+
+exit:
+       return 0;
+}
+#endif /* WL_CFG80211 || WL_ESCAN */
+
+#ifdef WL_CFG80211
+#define APCS_MAX_RETRY         10
+static int
+wl_ext_fw_apcs(struct net_device *dev, uint32 band)
+{
+       int channel = 0, chosen = 0, retry = 0, ret = 0, spect = 0;
+       u8 *reqbuf = NULL;
+       uint32 buf_size;
+
+       ret = wldev_ioctl_get(dev, WLC_GET_SPECT_MANAGMENT, &spect, sizeof(spect));
+       if (ret) {
+               AEXT_ERROR(dev->name, "ACS: error getting the spect, ret=%d\n", ret);
+               goto done;
+       }
+
+       if (spect > 0) {
+               ret = wl_android_set_spect(dev, 0);
+               if (ret < 0) {
+                       AEXT_ERROR(dev->name, "ACS: error while setting spect, ret=%d\n", ret);
+                       goto done;
+               }
+       }
+
+       reqbuf = kmalloc(CHANSPEC_BUF_SIZE, GFP_KERNEL);
+       if (reqbuf == NULL) {
+               AEXT_ERROR(dev->name, "failed to allocate chanspec buffer\n");
+               goto done;
+       }
+       memset(reqbuf, 0, CHANSPEC_BUF_SIZE);
+
+       if (band == WLC_BAND_AUTO) {
+               AEXT_INFO(dev->name, "ACS full channel scan \n");
+               reqbuf[0] = htod32(0);
+       } else if (band == WLC_BAND_5G) {
+               AEXT_INFO(dev->name, "ACS 5G band scan \n");
+               if ((ret = wl_cfg80211_get_chanspecs_5g(dev, reqbuf, CHANSPEC_BUF_SIZE)) < 0) {
+                       AEXT_ERROR(dev->name, "ACS 5g chanspec retreival failed! \n");
+                       goto done;
+               }
+       } else if (band == WLC_BAND_2G) {
+               /*
+                * If channel argument is not provided/ argument 20 is provided,
+                * Restrict channel to 2GHz, 20MHz BW, No SB
+                */
+               AEXT_INFO(dev->name, "ACS 2G band scan \n");
+               if ((ret = wl_cfg80211_get_chanspecs_2g(dev, reqbuf, CHANSPEC_BUF_SIZE)) < 0) {
+                       AEXT_ERROR(dev->name, "ACS 2g chanspec retreival failed! \n");
+                       goto done;
+               }
+       } else {
+               AEXT_ERROR(dev->name, "ACS: No band chosen\n");
+               goto done;
+       }
+
+       buf_size = (band == WLC_BAND_AUTO) ? sizeof(int) : CHANSPEC_BUF_SIZE;
+       ret = wldev_ioctl_set(dev, WLC_START_CHANNEL_SEL, (void *)reqbuf,
+               buf_size);
+       if (ret < 0) {
+               AEXT_ERROR(dev->name, "can't start auto channel scan, err = %d\n", ret);
+               channel = 0;
+               goto done;
+       }
+
+       /* Wait for auto channel selection, max 3000 ms */
+       if ((band == WLC_BAND_2G) || (band == WLC_BAND_5G)) {
+               OSL_SLEEP(500);
+       } else {
+               /*
+                * Full channel scan at the minimum takes 1.2secs
+                * even with parallel scan. max wait time: 3500ms
+                */
+               OSL_SLEEP(1000);
+       }
+
+       retry = APCS_MAX_RETRY;
+       while (retry--) {
+               ret = wldev_ioctl_get(dev, WLC_GET_CHANNEL_SEL, &chosen,
+                       sizeof(chosen));
+               if (ret < 0) {
+                       chosen = 0;
+               } else {
+                       chosen = dtoh32(chosen);
+               }
+
+               if (chosen) {
+                       int chosen_band;
+                       int apcs_band;
+#ifdef D11AC_IOTYPES
+                       if (wl_cfg80211_get_ioctl_version() == 1) {
+                               channel = LCHSPEC_CHANNEL((chanspec_t)chosen);
+                       } else {
+                               channel = CHSPEC_CHANNEL((chanspec_t)chosen);
+                       }
+#else
+                       channel = CHSPEC_CHANNEL((chanspec_t)chosen);
+#endif /* D11AC_IOTYPES */
+                       apcs_band = (band == WLC_BAND_AUTO) ? WLC_BAND_2G : band;
+                       chosen_band = (channel <= CH_MAX_2G_CHANNEL) ? WLC_BAND_2G : WLC_BAND_5G;
+                       if (apcs_band == chosen_band) {
+                               WL_MSG(dev->name, "selected channel = %d\n", channel);
+                               break;
+                       }
+               }
+               AEXT_INFO(dev->name, "%d tried, ret = %d, chosen = 0x%x\n",
+                       (APCS_MAX_RETRY - retry), ret, chosen);
+               OSL_SLEEP(250);
+       }
+
+done:
+       if (spect > 0) {
+               if ((ret = wl_android_set_spect(dev, spect) < 0)) {
+                       AEXT_ERROR(dev->name, "ACS: error while setting spect\n");
+               }
+       }
+
+       if (reqbuf) {
+               kfree(reqbuf);
+       }
+
+       return channel;
+}
+#endif /* WL_CFG80211 */
+
+#ifdef WL_ESCAN
+int
+wl_ext_drv_apcs(struct net_device *dev, uint32 band)
+{
+       int ret = 0, channel = 0;
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       struct wl_escan_info *escan = NULL;
+       int retry = 0, retry_max, retry_interval = 250, up = 1;
+#ifdef WL_CFG80211
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+#endif /* WL_CFG80211 */
+
+       escan = dhd->escan;
+       if (dhd) {
+               retry_max = WL_ESCAN_TIMER_INTERVAL_MS/retry_interval;
+               ret = wldev_ioctl_get(dev, WLC_GET_UP, &up, sizeof(s32));
+               if (ret < 0 || up == 0) {
+                       ret = wldev_ioctl_set(dev, WLC_UP, &up, sizeof(s32));
+               }
+               retry = retry_max;
+               while (retry--) {
+                       if (escan->escan_state == ESCAN_STATE_SCANING
+#ifdef WL_CFG80211
+                               || wl_get_drv_status_all(cfg, SCANNING)
+#endif
+                       )
+                       {
+                               AEXT_INFO(dev->name, "Scanning %d tried, ret = %d\n",
+                                       (retry_max - retry), ret);
+                       } else {
+                               escan->autochannel = 1;
+                               ret = wl_escan_set_scan(dev, dhd, NULL, 0, TRUE);
+                               if (!ret)
+                                       break;
+                       }
+                       OSL_SLEEP(retry_interval);
+               }
+               if ((retry == 0) || (ret < 0))
+                       goto done;
+               retry = retry_max;
+               while (retry--) {
+                       if (escan->escan_state == ESCAN_STATE_IDLE) {
+                               if (band == WLC_BAND_5G)
+                                       channel = escan->best_5g_ch;
+                               else
+                                       channel = escan->best_2g_ch;
+                               WL_MSG(dev->name, "selected channel = %d\n", channel);
+                               goto done;
+                       }
+                       AEXT_INFO(dev->name, "escan_state=%d, %d tried, ret = %d\n",
+                               escan->escan_state, (retry_max - retry), ret);
+                       OSL_SLEEP(retry_interval);
+               }
+               if ((retry == 0) || (ret < 0))
+                       goto done;
+       }
+
+done:
+       if (escan)
+               escan->autochannel = 0;
+
+       return channel;
+}
+#endif /* WL_ESCAN */
+
+int
+wl_ext_autochannel(struct net_device *dev, uint acs, uint32 band)
+{
+       int channel = 0;
+       uint16 chan_2g, chan_5g;
+
+       AEXT_INFO(dev->name, "acs=0x%x, band=%d \n", acs, band);
+
+#ifdef WL_CFG80211
+       if (acs & ACS_FW_BIT) {
+               int ret = 0;
+               ret = wldev_ioctl_get(dev, WLC_GET_CHANNEL_SEL, &channel, sizeof(channel));
+               channel = 0;
+               if (ret != BCME_UNSUPPORTED)
+                       channel = wl_ext_fw_apcs(dev, band);
+               if (channel)
+                       return channel;
+       }
+#endif
+
+#ifdef WL_ESCAN
+       if (acs & ACS_DRV_BIT)
+               channel = wl_ext_drv_apcs(dev, band);
+#endif /* WL_ESCAN */
+
+       if (channel == 0) {
+               wl_ext_get_default_chan(dev, &chan_2g, &chan_5g, TRUE);
+               if (band == WLC_BAND_5G) {
+                       channel = chan_5g;
+               } else {
+                       channel = chan_2g;
+               }
+               AEXT_ERROR(dev->name, "ACS failed. Fall back to default channel (%d) \n", channel);
+       }
+
+       return channel;
+}
+
+#if defined(RSSIAVG)
+void
+wl_free_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl)
+{
+       wl_rssi_cache_t *node, *cur, **rssi_head;
+       int i=0;
+
+       rssi_head = &rssi_cache_ctrl->m_cache_head;
+       node = *rssi_head;
+
+       for (;node;) {
+               AEXT_INFO("wlan", "Free %d with BSSID %pM\n", i, &node->BSSID);
+               cur = node;
+               node = cur->next;
+               kfree(cur);
+               i++;
+       }
+       *rssi_head = NULL;
+}
+
+void
+wl_delete_dirty_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl)
+{
+       wl_rssi_cache_t *node, *prev, **rssi_head;
+       int i = -1, tmp = 0;
+       struct osl_timespec now;
+
+       osl_do_gettimeofday(&now);
+
+       rssi_head = &rssi_cache_ctrl->m_cache_head;
+       node = *rssi_head;
+       prev = node;
+       for (;node;) {
+               i++;
+               if (now.tv_sec > node->tv.tv_sec) {
+                       if (node == *rssi_head) {
+                               tmp = 1;
+                               *rssi_head = node->next;
+                       } else {
+                               tmp = 0;
+                               prev->next = node->next;
+                       }
+                       AEXT_INFO("wlan", "Del %d with BSSID %pM\n", i, &node->BSSID);
+                       kfree(node);
+                       if (tmp == 1) {
+                               node = *rssi_head;
+                               prev = node;
+                       } else {
+                               node = prev->next;
+                       }
+                       continue;
+               }
+               prev = node;
+               node = node->next;
+       }
+}
+
+void
+wl_delete_disconnected_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl,
+       u8 *bssid)
+{
+       wl_rssi_cache_t *node, *prev, **rssi_head;
+       int i = -1, tmp = 0;
+
+       rssi_head = &rssi_cache_ctrl->m_cache_head;
+       node = *rssi_head;
+       prev = node;
+       for (;node;) {
+               i++;
+               if (!memcmp(&node->BSSID, bssid, ETHER_ADDR_LEN)) {
+                       if (node == *rssi_head) {
+                               tmp = 1;
+                               *rssi_head = node->next;
+                       } else {
+                               tmp = 0;
+                               prev->next = node->next;
+                       }
+                       AEXT_INFO("wlan", "Del %d with BSSID %pM\n", i, &node->BSSID);
+                       kfree(node);
+                       if (tmp == 1) {
+                               node = *rssi_head;
+                               prev = node;
+                       } else {
+                               node = prev->next;
+                       }
+                       continue;
+               }
+               prev = node;
+               node = node->next;
+       }
+}
+
+void
+wl_reset_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl)
+{
+       wl_rssi_cache_t *node, **rssi_head;
+
+       rssi_head = &rssi_cache_ctrl->m_cache_head;
+
+       /* reset dirty */
+       node = *rssi_head;
+       for (;node;) {
+               node->dirty += 1;
+               node = node->next;
+       }
+}
+
+int
+wl_update_connected_rssi_cache(struct net_device *net,
+       wl_rssi_cache_ctrl_t *rssi_cache_ctrl, int *rssi_avg)
+{
+       wl_rssi_cache_t *node, *prev, *leaf, **rssi_head;
+       int j, k=0;
+       int rssi, error=0;
+       struct ether_addr bssid;
+       struct osl_timespec now, timeout;
+       scb_val_t scbval;
+
+       if (!g_wifi_on)
+               return 0;
+
+       error = wldev_ioctl(net, WLC_GET_BSSID, &bssid, sizeof(bssid), 0);
+       if (error == BCME_NOTASSOCIATED) {
+               AEXT_INFO("wlan", "Not Associated! res:%d\n", error);
+               return 0;
+       }
+       if (error) {
+               AEXT_ERROR(net->name, "Could not get bssid (%d)\n", error);
+       }
+       error = wldev_get_rssi(net, &scbval);
+       if (error) {
+               AEXT_ERROR(net->name, "Could not get rssi (%d)\n", error);
+               return error;
+       }
+       rssi = scbval.val;
+
+       osl_do_gettimeofday(&now);
+       timeout.tv_sec = now.tv_sec + RSSICACHE_TIMEOUT;
+       if (timeout.tv_sec < now.tv_sec) {
+               /*
+                * Integer overflow - assume long enough timeout to be assumed
+                * to be infinite, i.e., the timeout would never happen.
+                */
+               AEXT_TRACE(net->name,
+                       "Too long timeout (secs=%d) to ever happen - now=%lu, timeout=%lu\n",
+                       RSSICACHE_TIMEOUT, now.tv_sec, timeout.tv_sec);
+       }
+
+       /* update RSSI */
+       rssi_head = &rssi_cache_ctrl->m_cache_head;
+       node = *rssi_head;
+       prev = NULL;
+       for (;node;) {
+               if (!memcmp(&node->BSSID, &bssid, ETHER_ADDR_LEN)) {
+                       AEXT_INFO("wlan", "Update %d with BSSID %pM, RSSI=%d\n", k, &bssid, rssi);
+                       for (j=0; j<RSSIAVG_LEN-1; j++)
+                               node->RSSI[j] = node->RSSI[j+1];
+                       node->RSSI[j] = rssi;
+                       node->dirty = 0;
+                       node->tv = timeout;
+                       goto exit;
+               }
+               prev = node;
+               node = node->next;
+               k++;
+       }
+
+       leaf = kmalloc(sizeof(wl_rssi_cache_t), GFP_KERNEL);
+       if (!leaf) {
+               AEXT_ERROR(net->name, "Memory alloc failure %d\n", (int)sizeof(wl_rssi_cache_t));
+               return 0;
+       }
+       AEXT_INFO(net->name, "Add %d with cached BSSID %pM, RSSI=%3d in the leaf\n",
+               k, &bssid, rssi);
+
+       leaf->next = NULL;
+       leaf->dirty = 0;
+       leaf->tv = timeout;
+       memcpy(&leaf->BSSID, &bssid, ETHER_ADDR_LEN);
+       for (j=0; j<RSSIAVG_LEN; j++)
+               leaf->RSSI[j] = rssi;
+
+       if (!prev)
+               *rssi_head = leaf;
+       else
+               prev->next = leaf;
+
+exit:
+       *rssi_avg = (int)wl_get_avg_rssi(rssi_cache_ctrl, &bssid);
+
+       return error;
+}
+
+void
+wl_update_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl,
+       wl_scan_results_t *ss_list)
+{
+       wl_rssi_cache_t *node, *prev, *leaf, **rssi_head;
+       wl_bss_info_t *bi = NULL;
+       int i, j, k;
+       struct osl_timespec now, timeout;
+
+       if (!ss_list->count)
+               return;
+
+       osl_do_gettimeofday(&now);
+       timeout.tv_sec = now.tv_sec + RSSICACHE_TIMEOUT;
+       if (timeout.tv_sec < now.tv_sec) {
+               /*
+                * Integer overflow - assume long enough timeout to be assumed
+                * to be infinite, i.e., the timeout would never happen.
+                */
+               AEXT_TRACE("wlan",
+                       "Too long timeout (secs=%d) to ever happen - now=%lu, timeout=%lu\n",
+                       RSSICACHE_TIMEOUT, now.tv_sec, timeout.tv_sec);
+       }
+
+       rssi_head = &rssi_cache_ctrl->m_cache_head;
+
+       /* update RSSI */
+       for (i = 0; i < ss_list->count; i++) {
+               node = *rssi_head;
+               prev = NULL;
+               k = 0;
+               bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : ss_list->bss_info;
+               for (;node;) {
+                       if (!memcmp(&node->BSSID, &bi->BSSID, ETHER_ADDR_LEN)) {
+                               AEXT_INFO("wlan", "Update %d with BSSID %pM, RSSI=%3d, SSID \"%s\"\n",
+                                       k, &bi->BSSID, dtoh16(bi->RSSI), bi->SSID);
+                               for (j=0; j<RSSIAVG_LEN-1; j++)
+                                       node->RSSI[j] = node->RSSI[j+1];
+                               node->RSSI[j] = dtoh16(bi->RSSI);
+                               node->dirty = 0;
+                               node->tv = timeout;
+                               break;
+                       }
+                       prev = node;
+                       node = node->next;
+                       k++;
+               }
+
+               if (node)
+                       continue;
+
+               leaf = kmalloc(sizeof(wl_rssi_cache_t), GFP_KERNEL);
+               if (!leaf) {
+                       AEXT_ERROR("wlan", "Memory alloc failure %d\n",
+                               (int)sizeof(wl_rssi_cache_t));
+                       return;
+               }
+               AEXT_INFO("wlan", "Add %d with cached BSSID %pM, RSSI=%3d, SSID \"%s\" in the leaf\n",
+                       k, &bi->BSSID, dtoh16(bi->RSSI), bi->SSID);
+
+               leaf->next = NULL;
+               leaf->dirty = 0;
+               leaf->tv = timeout;
+               memcpy(&leaf->BSSID, &bi->BSSID, ETHER_ADDR_LEN);
+               for (j=0; j<RSSIAVG_LEN; j++)
+                       leaf->RSSI[j] = dtoh16(bi->RSSI);
+
+               if (!prev)
+                       *rssi_head = leaf;
+               else
+                       prev->next = leaf;
+       }
+}
+
+int16
+wl_get_avg_rssi(wl_rssi_cache_ctrl_t *rssi_cache_ctrl, void *addr)
+{
+       wl_rssi_cache_t *node, **rssi_head;
+       int j, rssi_sum, rssi=RSSI_MINVAL;
+
+       rssi_head = &rssi_cache_ctrl->m_cache_head;
+
+       node = *rssi_head;
+       for (;node;) {
+               if (!memcmp(&node->BSSID, addr, ETHER_ADDR_LEN)) {
+                       rssi_sum = 0;
+                       rssi = 0;
+                       for (j=0; j<RSSIAVG_LEN; j++)
+                               rssi_sum += node->RSSI[RSSIAVG_LEN-j-1];
+                       rssi = rssi_sum / j;
+                       break;
+               }
+               node = node->next;
+       }
+       rssi = MIN(rssi, RSSI_MAXVAL);
+       if (rssi == RSSI_MINVAL) {
+               AEXT_ERROR("wlan", "BSSID %pM does not in RSSI cache\n", addr);
+       }
+       return (int16)rssi;
+}
+#endif /* RSSIAVG */
+
+#if defined(RSSIOFFSET)
+int
+wl_update_rssi_offset(struct net_device *net, int rssi)
+{
+#if defined(RSSIOFFSET_NEW)
+       int j;
+#endif /* RSSIOFFSET_NEW */
+
+       if (!g_wifi_on)
+               return rssi;
+
+#if defined(RSSIOFFSET_NEW)
+       for (j=0; j<RSSI_OFFSET; j++) {
+               if (rssi - (RSSI_OFFSET_MINVAL+RSSI_OFFSET_INTVAL*(j+1)) < 0)
+                       break;
+       }
+       rssi += j;
+#else
+       rssi += RSSI_OFFSET;
+#endif /* RSSIOFFSET_NEW */
+       return MIN(rssi, RSSI_MAXVAL);
+}
+#endif /* RSSIOFFSET */
+
+#if defined(BSSCACHE)
+void
+wl_free_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl)
+{
+       wl_bss_cache_t *node, *cur, **bss_head;
+       int i=0;
+
+       AEXT_TRACE("wlan", "called\n");
+
+       bss_head = &bss_cache_ctrl->m_cache_head;
+       node = *bss_head;
+
+       for (;node;) {
+               AEXT_TRACE("wlan", "Free %d with BSSID %pM\n",
+                       i, &node->results.bss_info->BSSID);
+               cur = node;
+               node = cur->next;
+               kfree(cur);
+               i++;
+       }
+       *bss_head = NULL;
+}
+
+void
+wl_delete_dirty_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl)
+{
+       wl_bss_cache_t *node, *prev, **bss_head;
+       int i = -1, tmp = 0;
+       struct osl_timespec now;
+
+       osl_do_gettimeofday(&now);
+
+       bss_head = &bss_cache_ctrl->m_cache_head;
+       node = *bss_head;
+       prev = node;
+       for (;node;) {
+               i++;
+               if (now.tv_sec > node->tv.tv_sec) {
+                       if (node == *bss_head) {
+                               tmp = 1;
+                               *bss_head = node->next;
+                       } else {
+                               tmp = 0;
+                               prev->next = node->next;
+                       }
+                       AEXT_TRACE("wlan", "Del %d with BSSID %pM, RSSI=%3d, SSID \"%s\"\n",
+                               i, &node->results.bss_info->BSSID,
+                               dtoh16(node->results.bss_info->RSSI), node->results.bss_info->SSID);
+                       kfree(node);
+                       if (tmp == 1) {
+                               node = *bss_head;
+                               prev = node;
+                       } else {
+                               node = prev->next;
+                       }
+                       continue;
+               }
+               prev = node;
+               node = node->next;
+       }
+}
+
+void
+wl_delete_disconnected_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl,
+       u8 *bssid)
+{
+       wl_bss_cache_t *node, *prev, **bss_head;
+       int i = -1, tmp = 0;
+
+       bss_head = &bss_cache_ctrl->m_cache_head;
+       node = *bss_head;
+       prev = node;
+       for (;node;) {
+               i++;
+               if (!memcmp(&node->results.bss_info->BSSID, bssid, ETHER_ADDR_LEN)) {
+                       if (node == *bss_head) {
+                               tmp = 1;
+                               *bss_head = node->next;
+                       } else {
+                               tmp = 0;
+                               prev->next = node->next;
+                       }
+                       AEXT_TRACE("wlan", "Del %d with BSSID %pM, RSSI=%3d, SSID \"%s\"\n",
+                               i, &node->results.bss_info->BSSID,
+                               dtoh16(node->results.bss_info->RSSI), node->results.bss_info->SSID);
+                       kfree(node);
+                       if (tmp == 1) {
+                               node = *bss_head;
+                               prev = node;
+                       } else {
+                               node = prev->next;
+                       }
+                       continue;
+               }
+               prev = node;
+               node = node->next;
+       }
+}
+
+void
+wl_reset_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl)
+{
+       wl_bss_cache_t *node, **bss_head;
+
+       bss_head = &bss_cache_ctrl->m_cache_head;
+
+       /* reset dirty */
+       node = *bss_head;
+       for (;node;) {
+               node->dirty += 1;
+               node = node->next;
+       }
+}
+
+void dump_bss_cache(
+#if defined(RSSIAVG)
+       wl_rssi_cache_ctrl_t *rssi_cache_ctrl,
+#endif /* RSSIAVG */
+       wl_bss_cache_t *node)
+{
+       int k = 0;
+       int16 rssi;
+
+       for (;node;) {
+#if defined(RSSIAVG)
+               rssi = wl_get_avg_rssi(rssi_cache_ctrl, &node->results.bss_info->BSSID);
+#else
+               rssi = dtoh16(node->results.bss_info->RSSI);
+#endif /* RSSIAVG */
+               AEXT_TRACE("wlan", "dump %d with cached BSSID %pM, RSSI=%3d, SSID \"%s\"\n",
+                       k, &node->results.bss_info->BSSID, rssi, node->results.bss_info->SSID);
+               k++;
+               node = node->next;
+       }
+}
+
+void
+wl_update_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl,
+#if defined(RSSIAVG)
+       wl_rssi_cache_ctrl_t *rssi_cache_ctrl,
+#endif /* RSSIAVG */
+       wl_scan_results_t *ss_list)
+{
+       wl_bss_cache_t *node, *prev, *leaf, **bss_head;
+       wl_bss_info_t *bi = NULL;
+       int i, k=0;
+#if defined(SORT_BSS_BY_RSSI)
+       int16 rssi, rssi_node;
+#endif /* SORT_BSS_BY_RSSI */
+       struct osl_timespec now, timeout;
+
+       if (!ss_list->count)
+               return;
+
+       osl_do_gettimeofday(&now);
+       timeout.tv_sec = now.tv_sec + BSSCACHE_TIMEOUT;
+       if (timeout.tv_sec < now.tv_sec) {
+               /*
+                * Integer overflow - assume long enough timeout to be assumed
+                * to be infinite, i.e., the timeout would never happen.
+                */
+               AEXT_TRACE("wlan",
+                       "Too long timeout (secs=%d) to ever happen - now=%lu, timeout=%lu\n",
+                       BSSCACHE_TIMEOUT, now.tv_sec, timeout.tv_sec);
+       }
+
+       bss_head = &bss_cache_ctrl->m_cache_head;
+
+       for (i=0; i < ss_list->count; i++) {
+               node = *bss_head;
+               prev = NULL;
+               bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : ss_list->bss_info;
+
+               for (;node;) {
+                       if (!memcmp(&node->results.bss_info->BSSID, &bi->BSSID, ETHER_ADDR_LEN)) {
+                               if (node == *bss_head)
+                                       *bss_head = node->next;
+                               else {
+                                       prev->next = node->next;
+                               }
+                               break;
+                       }
+                       prev = node;
+                       node = node->next;
+               }
+
+               leaf = kmalloc(dtoh32(bi->length) + sizeof(wl_bss_cache_t), GFP_KERNEL);
+               if (!leaf) {
+                       AEXT_ERROR("wlan", "Memory alloc failure %d\n",
+                               dtoh32(bi->length) + (int)sizeof(wl_bss_cache_t));
+                       return;
+               }
+               if (node) {
+                       kfree(node);
+                       node = NULL;
+                       AEXT_TRACE("wlan",
+                               "Update %d with cached BSSID %pM, RSSI=%3d, SSID \"%s\"\n",
+                               k, &bi->BSSID, dtoh16(bi->RSSI), bi->SSID);
+               } else
+                       AEXT_TRACE("wlan",
+                               "Add %d with cached BSSID %pM, RSSI=%3d, SSID \"%s\"\n",
+                               k, &bi->BSSID, dtoh16(bi->RSSI), bi->SSID);
+
+               memcpy(leaf->results.bss_info, bi, dtoh32(bi->length));
+               leaf->next = NULL;
+               leaf->dirty = 0;
+               leaf->tv = timeout;
+               leaf->results.count = 1;
+               leaf->results.version = ss_list->version;
+               k++;
+
+               if (*bss_head == NULL)
+                       *bss_head = leaf;
+               else {
+#if defined(SORT_BSS_BY_RSSI)
+                       node = *bss_head;
+#if defined(RSSIAVG)
+                       rssi = wl_get_avg_rssi(rssi_cache_ctrl, &leaf->results.bss_info->BSSID);
+#else
+                       rssi = dtoh16(leaf->results.bss_info->RSSI);
+#endif /* RSSIAVG */
+                       for (;node;) {
+#if defined(RSSIAVG)
+                               rssi_node = wl_get_avg_rssi(rssi_cache_ctrl,
+                                       &node->results.bss_info->BSSID);
+#else
+                               rssi_node = dtoh16(node->results.bss_info->RSSI);
+#endif /* RSSIAVG */
+                               if (rssi > rssi_node) {
+                                       leaf->next = node;
+                                       if (node == *bss_head)
+                                               *bss_head = leaf;
+                                       else
+                                               prev->next = leaf;
+                                       break;
+                               }
+                               prev = node;
+                               node = node->next;
+                       }
+                       if (node == NULL)
+                               prev->next = leaf;
+#else
+                       leaf->next = *bss_head;
+                       *bss_head = leaf;
+#endif /* SORT_BSS_BY_RSSI */
+               }
+       }
+       dump_bss_cache(
+#if defined(RSSIAVG)
+               rssi_cache_ctrl,
+#endif /* RSSIAVG */
+               *bss_head);
+}
+
+void
+wl_release_bss_cache_ctrl(wl_bss_cache_ctrl_t *bss_cache_ctrl)
+{
+       AEXT_TRACE("wlan", "Enter\n");
+       wl_free_bss_cache(bss_cache_ctrl);
+}
+#endif /* BSSCACHE */
+
+
diff --git a/bcmdhd.101.10.240.x/wl_bam.c b/bcmdhd.101.10.240.x/wl_bam.c
new file mode 100644 (file)
index 0000000..e380c67
--- /dev/null
@@ -0,0 +1,643 @@
+/*
+ * Bad AP Manager for ADPS
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+#include <bcmiov.h>
+#include <linux/time.h>
+#include <linux/list_sort.h>
+#include <wl_cfg80211.h>
+#include <wlioctl.h>
+#include <wldev_common.h>
+#include <wl_bam.h>
+
+static int
+wl_bad_ap_mngr_add_entry(wl_bad_ap_mngr_t *bad_ap_mngr, wl_bad_ap_info_t *bad_ap_info)
+{
+       unsigned long flags;
+       wl_bad_ap_info_entry_t *entry;
+
+       entry = MALLOCZ(bad_ap_mngr->osh, sizeof(*entry));
+       if (entry == NULL) {
+               WL_ERR(("%s: allocation for list failed\n", __FUNCTION__));
+               return BCME_NOMEM;
+       }
+
+       memcpy(&entry->bad_ap, bad_ap_info, sizeof(entry->bad_ap));
+       INIT_LIST_HEAD(&entry->list);
+       spin_lock_irqsave(&bad_ap_mngr->lock, flags);
+       list_add_tail(&entry->list, &bad_ap_mngr->list);
+       spin_unlock_irqrestore(&bad_ap_mngr->lock, flags);
+
+       bad_ap_mngr->num++;
+
+       return BCME_OK;
+}
+
+#if !defined(DHD_ADPS_BAM_EXPORT)
+#define WL_BAD_AP_INFO_FILE_PATH       PLATFORM_PATH".bad_ap_list.info"
+#define WL_BAD_AP_MAX_BUF_SIZE         1024u
+
+/* Bad AP information data format
+ *
+ * Status and Reason: come from event
+ * Connection count: Increase connecting Bad AP
+ *
+ * BSSID,year-month-day hour:min:sec,Status,Reason,Connection count
+ * ex) XX:XX:XX:XX:XX:XX,1970-01-01 00:00:00,1,2,1
+ *
+ */
+#define WL_BAD_AP_INFO_FMT \
+       "%02x:%02x:%02x:%02x:%02x:%02x,%04ld-%02d-%02d %02d:%02d:%02d,%u,%u,%u\n"
+#define WL_BAD_AP_INFO_FMT_ITEM_CNT    15u
+
+static inline void
+wl_bad_ap_mngr_tm2ts(struct timespec *ts, const struct tm tm)
+{
+       ts->tv_sec = mktime(tm.tm_year, tm.tm_mon, tm.tm_mday, tm.tm_hour, tm.tm_min, tm.tm_sec);
+       ts->tv_nsec = 0;
+}
+
+/* Ignore compiler warnings due to -Werror=cast-qual */
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wcast-qual"
+#endif
+static int
+wl_bad_ap_mngr_timecmp(void *priv, struct list_head *a, struct list_head *b)
+{
+       int ret;
+
+       struct timespec ts1;
+       struct timespec ts2;
+
+       wl_bad_ap_info_entry_t *e1 = CONTAINEROF(a, wl_bad_ap_info_entry_t, list);
+       wl_bad_ap_info_entry_t *e2 = CONTAINEROF(b, wl_bad_ap_info_entry_t, list);
+
+       wl_bad_ap_mngr_tm2ts(&ts1, e1->bad_ap.tm);
+       wl_bad_ap_mngr_tm2ts(&ts2, e2->bad_ap.tm);
+
+       ret = timespec_compare((const struct timespec *)&ts1, (const struct timespec *)&ts2);
+
+       return ret;
+}
+
+static void
+wl_bad_ap_mngr_update(struct bcm_cfg80211 *cfg, wl_bad_ap_info_t *bad_ap_info)
+{
+       wl_bad_ap_info_entry_t *entry;
+       unsigned long flags;
+
+       if (list_empty(&cfg->bad_ap_mngr.list)) {
+               return;
+       }
+
+       WL_CFG_BAM_LOCK(&cfg->bad_ap_mngr.lock, flags);
+       /* sort by timestamp */
+       list_sort(NULL, &cfg->bad_ap_mngr.list, wl_bad_ap_mngr_timecmp);
+
+       /* update entry with the latest bad ap information */
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wcast-qual"
+#endif
+       entry = list_first_entry(&cfg->bad_ap_mngr.list, wl_bad_ap_info_entry_t, list);
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+       if (entry != NULL) {
+               memcpy(&entry->bad_ap, bad_ap_info, sizeof(entry->bad_ap));
+       }
+       WL_CFG_BAM_UNLOCK(&cfg->bad_ap_mngr.lock, flags);
+}
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+
+static inline int
+wl_bad_ap_mngr_fread_bad_ap_info(char *buf, int buf_len, wl_bad_ap_info_t *bad_ap)
+{
+       return snprintf(buf, buf_len, WL_BAD_AP_INFO_FMT,
+                       bad_ap->bssid.octet[0], bad_ap->bssid.octet[1],
+                       bad_ap->bssid.octet[2], bad_ap->bssid.octet[3],
+                       bad_ap->bssid.octet[4], bad_ap->bssid.octet[5],
+                       bad_ap->tm.tm_year + 1900, bad_ap->tm.tm_mon + 1, bad_ap->tm.tm_mday,
+                       bad_ap->tm.tm_hour, bad_ap->tm.tm_min, bad_ap->tm.tm_sec,
+                       bad_ap->status, bad_ap->reason, bad_ap->connect_count);
+}
+
+static int
+wl_bad_ap_mngr_fparse(struct bcm_cfg80211 *cfg, struct file *fp)
+{
+       int len;
+       int pos = 0;
+       char tmp[128];
+       int ret = BCME_ERROR;
+
+       wl_bad_ap_info_t bad_ap;
+       char *buf = NULL;
+
+       buf = MALLOCZ(cfg->osh, WL_BAD_AP_MAX_BUF_SIZE);
+       if (buf == NULL) {
+               WL_ERR(("%s: allocation for buf failed\n", __FUNCTION__));
+               return BCME_NOMEM;
+       }
+
+       ret = vfs_read(fp, buf, WL_BAD_AP_MAX_BUF_SIZE, &fp->f_pos);
+       if (ret  < 0) {
+               WL_ERR(("%s: file read failed (%d)\n", __FUNCTION__, ret));
+               goto fail;
+       }
+
+       len = ret;
+       do {
+               ret = sscanf(&buf[pos], WL_BAD_AP_INFO_FMT,
+                               (uint32 *)&bad_ap.bssid.octet[0], (uint32 *)&bad_ap.bssid.octet[1],
+                               (uint32 *)&bad_ap.bssid.octet[2], (uint32 *)&bad_ap.bssid.octet[3],
+                               (uint32 *)&bad_ap.bssid.octet[4], (uint32 *)&bad_ap.bssid.octet[5],
+                               (long int *)&bad_ap.tm.tm_year, (uint32 *)&bad_ap.tm.tm_mon,
+                               (uint32 *)&bad_ap.tm.tm_mday, (uint32 *)&bad_ap.tm.tm_hour,
+                               (uint32 *)&bad_ap.tm.tm_min, (uint32 *)&bad_ap.tm.tm_sec,
+                               (uint32 *)&bad_ap.status, (uint32 *)&bad_ap.reason,
+                               (uint32 *)&bad_ap.connect_count);
+               if (ret != WL_BAD_AP_INFO_FMT_ITEM_CNT) {
+                       WL_ERR(("%s: file parse failed(expected: %d actual: %d)\n",
+                               __FUNCTION__, WL_BAD_AP_INFO_FMT_ITEM_CNT, ret));
+                       ret = BCME_ERROR;
+                       goto fail;
+               }
+
+               /* convert struct tm format */
+               bad_ap.tm.tm_year -= 1900;
+               bad_ap.tm.tm_mon -= 1;
+
+               ret = wl_bad_ap_mngr_add(&cfg->bad_ap_mngr, &bad_ap);
+               if (ret < 0) {
+                       WL_ERR(("%s: bad ap add failed\n", __FUNCTION__));
+                       goto fail;
+               }
+
+               ret = wl_bad_ap_mngr_fread_bad_ap_info(tmp, sizeof(tmp), &bad_ap);
+               if (ret < 0) {
+                       WL_ERR(("%s: wl_bad_ap_mngr_fread_bad_ap_info failed (%d)\n",
+                               __FUNCTION__, ret));
+                       goto fail;
+               }
+
+               if (cfg->bad_ap_mngr.num >= WL_BAD_AP_MAX_ENTRY_NUM) {
+                       break;
+               }
+
+               len -= ret;
+               pos += ret;
+       } while (len > 0);
+
+       ret = BCME_OK;
+
+fail:
+       if (buf) {
+               MFREE(cfg->osh, buf, WL_BAD_AP_MAX_BUF_SIZE);
+       }
+
+       return ret;
+}
+
+static int
+wl_bad_ap_mngr_fread(struct bcm_cfg80211 *cfg, const char *fname)
+{
+       int ret = BCME_ERROR;
+
+       mm_segment_t fs;
+       struct file *fp = NULL;
+
+       if (fname == NULL) {
+               WL_ERR(("%s: fname is NULL\n", __FUNCTION__));
+               return ret;
+       }
+       mutex_lock(&cfg->bad_ap_mngr.fs_lock);
+
+       fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       fp = filp_open(fname, O_RDONLY, 0);
+       if (IS_ERR(fp)) {
+               fp = NULL;
+               WL_ERR(("%s: file open failed(%d)\n", __FUNCTION__, ret));
+               goto fail;
+       }
+
+       if ((ret = wl_bad_ap_mngr_fparse(cfg, fp)) < 0) {
+               goto fail;
+       }
+fail:
+       if (fp) {
+               filp_close(fp, NULL);
+       }
+       set_fs(fs);
+
+       mutex_unlock(&cfg->bad_ap_mngr.fs_lock);
+
+       return ret;
+}
+
+static int
+wl_bad_ap_mngr_fwrite(struct bcm_cfg80211 *cfg, const char *fname)
+{
+       int ret = BCME_ERROR;
+
+       mm_segment_t fs;
+       struct file *fp = NULL;
+
+       int len = 0;
+       char tmp[WL_BAD_AP_MAX_BUF_SIZE];
+       wl_bad_ap_info_t *bad_ap;
+       wl_bad_ap_info_entry_t *entry;
+
+       if (list_empty(&cfg->bad_ap_mngr.list)) {
+               return BCME_ERROR;
+       }
+
+       if (fname == NULL) {
+               return BCME_NOTFOUND;
+       }
+
+       mutex_lock(&cfg->bad_ap_mngr.fs_lock);
+
+       fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       fp = filp_open(fname, O_CREAT | O_RDWR | O_TRUNC,  0666);
+       if (IS_ERR(fp)) {
+               ret = PTR_ERR(fp);
+               WL_ERR(("%s: file open failed(%d)\n", __FUNCTION__, ret));
+               fp = NULL;
+               goto fail;
+       }
+
+       memset(tmp, 0, sizeof(tmp));
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wcast-qual"
+#endif
+       list_for_each_entry(entry, &cfg->bad_ap_mngr.list, list) {
+               bad_ap = &entry->bad_ap;
+               ret = wl_bad_ap_mngr_fread_bad_ap_info(&tmp[len], sizeof(tmp) - len, bad_ap);
+               if (ret < 0) {
+                       WL_ERR(("%s: snprintf failed(%d)\n", __FUNCTION__, ret));
+                       goto fail;
+               }
+
+               len += ret;
+       }
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+
+       ret = vfs_write(fp, tmp, len, &fp->f_pos);
+       if (ret < 0) {
+               WL_ERR(("%s: file write failed(%d)\n", __FUNCTION__, ret));
+               goto fail;
+       }
+       /* Sync file from filesystem to physical media */
+       ret = vfs_fsync(fp, 0);
+       if (ret < 0) {
+               WL_ERR(("%s: sync file failed(%d)\n", __FUNCTION__, ret));
+               goto fail;
+       }
+       ret = BCME_OK;
+fail:
+       if (fp) {
+               filp_close(fp, NULL);
+       }
+       set_fs(fs);
+       mutex_unlock(&cfg->bad_ap_mngr.fs_lock);
+
+       return ret;
+}
+#else
+extern wl_bad_ap_mngr_t *g_bad_ap_mngr;
+#endif /* DHD_ADPS_BAM_EXPORT */
+
+wl_bad_ap_info_entry_t*
+wl_bad_ap_mngr_find(wl_bad_ap_mngr_t *bad_ap_mngr, const struct ether_addr *bssid)
+{
+       wl_bad_ap_info_entry_t *entry;
+       unsigned long flags;
+
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wcast-qual"
+#endif
+       spin_lock_irqsave(&bad_ap_mngr->lock, flags);
+       list_for_each_entry(entry, &bad_ap_mngr->list, list) {
+               if (!memcmp(&entry->bad_ap.bssid.octet, bssid->octet, ETHER_ADDR_LEN)) {
+                       spin_unlock_irqrestore(&bad_ap_mngr->lock, flags);
+                       return entry;
+               }
+       }
+       spin_unlock_irqrestore(&bad_ap_mngr->lock, flags);
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+       return NULL;
+}
+
+int
+wl_bad_ap_mngr_add(wl_bad_ap_mngr_t *bad_ap_mngr, wl_bad_ap_info_t *bad_ap_info)
+{
+       int ret;
+       wl_bad_ap_info_entry_t *entry;
+       unsigned long flags;
+
+       BCM_REFERENCE(entry);
+       BCM_REFERENCE(flags);
+
+#if !defined(DHD_ADPS_BAM_EXPORT)
+       ret = wl_bad_ap_mngr_add_entry(bad_ap_mngr, bad_ap_info);
+#else
+       if (bad_ap_mngr->num == WL_BAD_AP_MAX_ENTRY_NUM) {
+               /* Remove the oldest entry if entry list is full */
+               spin_lock_irqsave(&bad_ap_mngr->lock, flags);
+               list_del(bad_ap_mngr->list.next);
+               bad_ap_mngr->num--;
+               spin_unlock_irqrestore(&bad_ap_mngr->lock, flags);
+       }
+
+       /* delete duplicated entry to update it at tail to keep the odrer */
+       entry = wl_bad_ap_mngr_find(bad_ap_mngr, &bad_ap_info->bssid);
+       if (entry != NULL) {
+               spin_lock_irqsave(&bad_ap_mngr->lock, flags);
+               list_del(&entry->list);
+               bad_ap_mngr->num--;
+               spin_unlock_irqrestore(&bad_ap_mngr->lock, flags);
+       }
+
+       ret = wl_bad_ap_mngr_add_entry(bad_ap_mngr, bad_ap_info);
+       if (ret < 0) {
+               WL_ERR(("%s - fail to add bad ap data(%d)\n", __FUNCTION__, ret));
+               return ret;
+       }
+#endif /* DHD_ADPS_BAM_EXPORT */
+       return ret;
+}
+
+void
+wl_bad_ap_mngr_deinit(struct bcm_cfg80211 *cfg)
+{
+       wl_bad_ap_info_entry_t *entry;
+       unsigned long flags;
+
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wcast-qual"
+#endif
+       WL_CFG_BAM_LOCK(&cfg->bad_ap_mngr.lock, flags);
+       while (!list_empty(&cfg->bad_ap_mngr.list)) {
+               entry = list_entry(cfg->bad_ap_mngr.list.next, wl_bad_ap_info_entry_t, list);
+               if (entry) {
+                       list_del(&cfg->bad_ap_mngr.list);
+                       MFREE(cfg->osh, entry, sizeof(*entry));
+               }
+       }
+       WL_CFG_BAM_UNLOCK(&cfg->bad_ap_mngr.lock, flags);
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+#if !defined(DHD_ADPS_BAM_EXPORT)
+       mutex_destroy(&cfg->bad_ap_mngr.fs_lock);
+#endif /* !DHD_ADPS_BAM_EXPORT */
+}
+
+void
+wl_bad_ap_mngr_init(struct bcm_cfg80211 *cfg)
+{
+       cfg->bad_ap_mngr.osh = cfg->osh;
+       cfg->bad_ap_mngr.num = 0;
+
+       spin_lock_init(&cfg->bad_ap_mngr.lock);
+       INIT_LIST_HEAD(&cfg->bad_ap_mngr.list);
+
+#if !defined(DHD_ADPS_BAM_EXPORT)
+       mutex_init(&cfg->bad_ap_mngr.fs_lock);
+#else
+       g_bad_ap_mngr = &cfg->bad_ap_mngr;
+#endif /* !DHD_ADPS_BAM_EXPORT */
+}
+
+static int
+wl_event_adps_bad_ap_mngr(struct bcm_cfg80211 *cfg, void *data)
+{
+       int ret = BCME_OK;
+
+       wl_event_adps_t *event_data = (wl_event_adps_t *)data;
+       wl_event_adps_bad_ap_t *bad_ap_data;
+
+       wl_bad_ap_info_entry_t *entry;
+       wl_bad_ap_info_t temp;
+#if !defined(DHD_ADPS_BAM_EXPORT)
+       struct timespec ts;
+#endif /* !DHD_ADPS_BAM_EXPORT */
+
+       if (event_data->version != WL_EVENT_ADPS_VER_1) {
+               return BCME_VERSION;
+       }
+
+       if (event_data->length != (OFFSETOF(wl_event_adps_t, data) + sizeof(*bad_ap_data))) {
+               return BCME_ERROR;
+       }
+
+       BCM_REFERENCE(ret);
+       BCM_REFERENCE(entry);
+       bad_ap_data = (wl_event_adps_bad_ap_t *)event_data->data;
+
+#if !defined(DHD_ADPS_BAM_EXPORT)
+       /* Update Bad AP list */
+       if (list_empty(&cfg->bad_ap_mngr.list)) {
+               wl_bad_ap_mngr_fread(cfg, WL_BAD_AP_INFO_FILE_PATH);
+       }
+
+       getnstimeofday(&ts);
+       entry = wl_bad_ap_mngr_find(&cfg->bad_ap_mngr, &bad_ap_data->ea);
+       if (entry != NULL) {
+               time_to_tm((ts.tv_sec - (sys_tz.tz_minuteswest * 60)), 0, &entry->bad_ap.tm);
+               entry->bad_ap.status = bad_ap_data->status;
+               entry->bad_ap.reason = bad_ap_data->reason;
+               entry->bad_ap.connect_count++;
+       }
+       else {
+               time_to_tm((ts.tv_sec - (sys_tz.tz_minuteswest * 60)), 0, &temp.tm);
+               temp.status = bad_ap_data->status;
+               temp.reason = bad_ap_data->reason;
+               temp.connect_count = 1;
+               memcpy(temp.bssid.octet, &bad_ap_data->ea.octet, ETHER_ADDR_LEN);
+
+               if (cfg->bad_ap_mngr.num < WL_BAD_AP_MAX_ENTRY_NUM) {
+                       wl_bad_ap_mngr_add(&cfg->bad_ap_mngr, &temp);
+               }
+               else {
+                       wl_bad_ap_mngr_update(cfg, &temp);
+               }
+       }
+
+       wl_bad_ap_mngr_fwrite(cfg, WL_BAD_AP_INFO_FILE_PATH);
+#else
+       memcpy(temp.bssid.octet, &bad_ap_data->ea.octet, ETHER_ADDR_LEN);
+       ret = wl_bad_ap_mngr_add(&cfg->bad_ap_mngr, &temp);
+#endif /* !DHD_ADPS_BAM_EXPORT */
+
+       return ret;
+}
+
+static int
+wl_adps_get_mode(struct net_device *ndev, uint8 band)
+{
+       int len;
+       int ret;
+
+       uint8 *pdata;
+       char buf[WLC_IOCTL_SMLEN];
+
+       bcm_iov_buf_t iov_buf;
+       bcm_iov_buf_t *resp;
+       wl_adps_params_v1_t *data = NULL;
+
+       memset(&iov_buf, 0, sizeof(iov_buf));
+       len = OFFSETOF(bcm_iov_buf_t, data) + sizeof(band);
+
+       iov_buf.version = WL_ADPS_IOV_VER;
+       iov_buf.len = sizeof(band);
+       iov_buf.id = WL_ADPS_IOV_MODE;
+       pdata = (uint8 *)iov_buf.data;
+       *pdata = band;
+
+       ret = wldev_iovar_getbuf(ndev, "adps", &iov_buf, len, buf, WLC_IOCTL_SMLEN, NULL);
+       if (ret < 0) {
+               return ret;
+       }
+       resp = (bcm_iov_buf_t *)buf;
+       data = (wl_adps_params_v1_t *)resp->data;
+
+       return data->mode;
+}
+
+/*
+ * Return value:
+ *  Disabled: 0
+ *  Enabled: bitmap of WLC_BAND_2G or WLC_BAND_5G when ADPS is enabled at each BAND
+ *
+ */
+int
+wl_adps_enabled(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       uint8 i;
+       int mode;
+       int ret = 0;
+
+       for (i = 1; i <= MAX_BANDS; i++) {
+               mode = wl_adps_get_mode(ndev, i);
+               if (mode > 0) {
+                       ret |= (1 << i);
+               }
+       }
+
+       return ret;
+}
+
+int
+wl_adps_set_suspend(struct bcm_cfg80211 *cfg, struct net_device *ndev, uint8 suspend)
+{
+       int ret = BCME_OK;
+
+       int buf_len;
+       bcm_iov_buf_t *iov_buf = NULL;
+       wl_adps_suspend_v1_t *data = NULL;
+
+       buf_len = OFFSETOF(bcm_iov_buf_t, data) + sizeof(*data);
+       iov_buf = MALLOCZ(cfg->osh, buf_len);
+       if (iov_buf == NULL) {
+               WL_ERR(("%s - failed to alloc %d bytes for iov_buf\n",
+                       __FUNCTION__, buf_len));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+
+       iov_buf->version = WL_ADPS_IOV_VER;
+       iov_buf->len = sizeof(*data);
+       iov_buf->id = WL_ADPS_IOV_SUSPEND;
+
+       data = (wl_adps_suspend_v1_t *)iov_buf->data;
+       data->version = ADPS_SUB_IOV_VERSION_1;
+       data->length = sizeof(*data);
+       data->suspend = suspend;
+
+       ret = wldev_iovar_setbuf(ndev, "adps", (char *)iov_buf, buf_len,
+               cfg->ioctl_buf, WLC_IOCTL_SMLEN, NULL);
+       if (ret < 0) {
+               if (ret == BCME_UNSUPPORTED) {
+                       WL_ERR(("%s - adps suspend is not supported\n", __FUNCTION__));
+                       ret = BCME_OK;
+               }
+               else {
+                       WL_ERR(("%s - fail to set adps suspend %d (%d)\n",
+                               __FUNCTION__, suspend, ret));
+               }
+               goto exit;
+       }
+       WL_INFORM_MEM(("[%s] Detect BAD AP and Suspend ADPS\n", ndev->name));
+exit:
+       if (iov_buf) {
+               MFREE(cfg->osh, iov_buf, buf_len);
+       }
+       return ret;
+}
+
+bool
+wl_adps_bad_ap_check(struct bcm_cfg80211 *cfg, const struct ether_addr *bssid)
+{
+#if !defined(DHD_ADPS_BAM_EXPORT)
+       /* Update Bad AP list */
+       if (list_empty(&cfg->bad_ap_mngr.list)) {
+               wl_bad_ap_mngr_fread(cfg, WL_BAD_AP_INFO_FILE_PATH);
+       }
+#endif /* DHD_ADPS_BAM_EXPORT */
+
+       if (wl_bad_ap_mngr_find(&cfg->bad_ap_mngr, bssid) != NULL)
+               return TRUE;
+
+       return FALSE;
+}
+
+s32
+wl_adps_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       int ret = BCME_OK;
+       wl_event_adps_t *event_data = (wl_event_adps_t *)data;
+
+       switch (event_data->type) {
+       case WL_E_TYPE_ADPS_BAD_AP:
+               ret = wl_event_adps_bad_ap_mngr(cfg, data);
+               break;
+       default:
+               break;
+       }
+
+       return ret;
+}
diff --git a/bcmdhd.101.10.240.x/wl_bigdata.c b/bcmdhd.101.10.240.x/wl_bigdata.c
new file mode 100644 (file)
index 0000000..fc77983
--- /dev/null
@@ -0,0 +1,575 @@
+/*
+ * Bigdata logging and report. None EWP and Hang event.
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+#include <typedefs.h>
+#include <osl.h>
+#include <dngl_stats.h>
+#include <bcmutils.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <wl_cfg80211.h>
+#include <wldev_common.h>
+#include <bcmendian.h>
+#include <wlioctl.h>
+#include <dhd_linux_wq.h>
+#include <wl_bigdata.h>
+
+#define WL_AP_BIGDATA_LOG(args) WL_DBG(args)
+
+#define WLC_E_IS_ASSOC(e, r) \
+       (((e == WLC_E_ASSOC_IND) || (e == WLC_E_REASSOC_IND)) && r == DOT11_SC_SUCCESS)
+#define WLC_E_IS_DEAUTH(e) \
+       (e == WLC_E_DISASSOC_IND || e == WLC_E_DEAUTH_IND || e == WLC_E_DEAUTH)
+
+static void dump_ap_stadata(wl_ap_sta_data_t *ap_sta_data);
+static inline void copy_ap_stadata(wl_ap_sta_data_t *dest, wl_ap_sta_data_t *src);
+static void wg_rate_dot11mode(uint32 *rate, uint8 *channel, uint32 *mode_80211);
+static void wg_ht_mimo_ant(uint32 *nss, wl_rateset_args_t *rateset);
+static void wg_vht_mimo_ant(uint32 *nss, wl_rateset_args_t *rateset);
+#if defined(WL11AX)
+static void wg_he_mimo_ant(uint32 *nss, uint16 *mcsset);
+#endif /* WL11AX */
+static int wg_parse_ap_stadata(struct net_device *dev, struct ether_addr *sta_mac,
+               wl_ap_sta_data_t *ap_sta_data);
+
+static void
+dump_ap_stadata(wl_ap_sta_data_t *ap_sta_data)
+{
+       int i;
+
+       if (!ap_sta_data) {
+               WL_AP_BIGDATA_LOG(("ap_sta_data is NULL\n"));
+               return;
+       }
+
+       for (i = 0; i < MAX_STA_INFO_AP_CNT; i++) {
+               if (!ap_sta_data[i].is_empty) {
+                       WL_AP_BIGDATA_LOG(("idx %d "MACDBG" dis %d empty %d\n",
+                               i, MAC2STRDBG((char *)&ap_sta_data[i].mac),
+                               ap_sta_data[i].disconnected, ap_sta_data[i].is_empty));
+                       WL_AP_BIGDATA_LOG(("mode %d nss %d chanspec %d rssi %d "
+                                               "rate %d reason_code %d\n\n",
+                                               ap_sta_data[i].mode_80211,
+                                               ap_sta_data[i].nss, ap_sta_data[i].chanspec,
+                                               ap_sta_data[i].rssi, ap_sta_data[i].rate,
+                                               ap_sta_data[i].reason_code));
+               }
+       }
+}
+
+static inline void
+copy_ap_stadata(wl_ap_sta_data_t *dest, wl_ap_sta_data_t *src)
+{
+       memcpy(dest, src, sizeof(wl_ap_sta_data_t));
+       dest->is_empty = FALSE;
+       dest->disconnected = FALSE;
+       dest->reason_code = 0;
+}
+
+static void
+get_copy_ptr_stadata(struct ether_addr *sta_mac, wl_ap_sta_data_t *sta_data,
+               uint32 *sta_list_cnt, void **data)
+{
+       int i;
+       int discon_idx = -1;
+       int empty_idx = -1;
+
+       if  (!sta_mac || !sta_data || !sta_list_cnt ||!data) {
+               WL_ERR(("sta_mac=%p sta_data=%p sta_lit_cnt=%p data=%p\n",
+                       sta_mac, sta_data, sta_list_cnt, data));
+               return;
+       }
+
+       /* Find already existed sta */
+       for (i = 0; i < MAX_STA_INFO_AP_CNT; i++) {
+               if (!memcmp((char*)sta_mac, (char*)&sta_data[i].mac, ETHER_ADDR_LEN)) {
+                       WL_AP_BIGDATA_LOG(("found existed "
+                                               "STA idx %d "MACDBG"\n",
+                                               i, MAC2STRDBG((char *)sta_mac)));
+                       *data = (wl_ap_sta_data_t *)&sta_data[i];
+                       return;
+               }
+
+               if (sta_data[i].disconnected && (discon_idx == -1)) {
+                       discon_idx = i;
+               }
+
+               if (sta_data[i].is_empty && (empty_idx == -1)) {
+                       empty_idx = i;
+               }
+       }
+
+       /* Buf is max */
+       if (*sta_list_cnt >= MAX_STA_INFO_AP_CNT) {
+               if (discon_idx != -1) {
+                       WL_AP_BIGDATA_LOG(("delete disconnected "
+                                               "idx %d "MACDBG"\n",
+                                               discon_idx, MAC2STRDBG((char *)sta_mac)));
+                       *data = (wl_ap_sta_data_t *)&sta_data[discon_idx];
+                       return;
+               }
+       }
+
+       /* Buf is not max */
+       if (empty_idx != -1) {
+               (*sta_list_cnt)++;
+               WL_AP_BIGDATA_LOG(("empty idx %d \n", empty_idx));
+               *data = (wl_ap_sta_data_t *)&sta_data[empty_idx];
+               return;
+       }
+}
+
+static void
+wg_rate_dot11mode(uint32 *rate, uint8 *channel, uint32 *mode_80211)
+{
+       if (*rate <= DOT11_11B_MAX_RATE) {
+               /* 11b maximum rate is 11Mbps. 11b mode */
+               *mode_80211 = BIGDATA_DOT11_11B_MODE;
+       } else {
+               /* It's not HT Capable case. */
+               if (*channel > DOT11_2GHZ_MAX_CH_NUM) {
+                       *mode_80211 = BIGDATA_DOT11_11A_MODE; /* 11a mode */
+               } else {
+                       *mode_80211 = BIGDATA_DOT11_11G_MODE; /* 11g mode */
+               }
+       }
+}
+
+static void
+wg_ht_mimo_ant(uint32 *nss, wl_rateset_args_t *rateset)
+{
+       int i;
+
+       *nss = 0;
+       for (i = 0; i < MAX_STREAMS_SUPPORTED; i++) {
+               int8 bitmap = DOT11_HT_MCS_RATE_MASK;
+               if (i == MAX_STREAMS_SUPPORTED-1) {
+                       bitmap = DOT11_RATE_MASK;
+               }
+               if (rateset->mcs[i] & bitmap) {
+                       (*nss)++;
+               }
+       }
+}
+
+static void
+wg_vht_mimo_ant(uint32 *nss, wl_rateset_args_t *rateset)
+{
+       int i;
+       uint32 mcs_code;
+
+       *nss = 0;
+
+       for (i = 1; i <= VHT_CAP_MCS_MAP_NSS_MAX; i++) {
+               mcs_code = VHT_MCS_MAP_TO_MCS_CODE(rateset->vht_mcs[i - 1]);
+               if (mcs_code != VHT_CAP_MCS_MAP_NONE) {
+                       (*nss)++;
+               }
+       }
+}
+
+#if defined(WL11AX)
+static void
+wg_he_mimo_ant(uint32 *nss, uint16 *mcsset)
+{
+       int i;
+
+       *nss = 0;
+
+       for (i = 0; i <= HE_MCS_MAP_NSS_MAX; i++) {
+               if (mcsset[i]) {
+                       (*nss)++;
+               }
+       }
+}
+#endif /* WL11AX */
+
+static int
+wg_parse_ap_stadata(struct net_device *dev, struct ether_addr *sta_mac,
+               wl_ap_sta_data_t *ap_sta_data)
+{
+       sta_info_v4_t *sta_v4 = NULL;
+       sta_info_v5_t *sta_v5 = NULL;
+       wl_rateset_args_t *rateset_adv;
+       int ret = BCME_OK;
+       char* ioctl_buf = NULL;
+#if defined(WL11AX)
+       struct wl_rateset_args_v2 *rateset_adv_v2;
+#endif
+
+       ioctl_buf = (char*)kmalloc(WLC_IOCTL_MEDLEN, GFP_KERNEL);
+       if (ioctl_buf == NULL) {
+               WL_ERR(("failed to allocated ioctl_buf \n"));
+               return BCME_ERROR;
+       }
+
+       ret = wldev_iovar_getbuf(dev, "sta_info", (struct ether_addr *)sta_mac,
+                       ETHER_ADDR_LEN, ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+
+       if (ret < 0) {
+               WL_ERR(("sta_info err value :%d\n", ret));
+               ret = BCME_ERROR;
+               goto done;
+       }
+
+       sta_v4 = (sta_info_v4_t *)ioctl_buf;
+       ap_sta_data->mac = *sta_mac;
+       ap_sta_data->rssi = 0;
+       ap_sta_data->mimo = 0;
+
+       rateset_adv = &sta_v4->rateset_adv;
+       ap_sta_data->chanspec = sta_v4->chanspec;
+
+       WL_AP_BIGDATA_LOG(("sta_info ver %d\n", sta_v4->ver));
+
+       if (sta_v4->ver == WL_STA_VER_5) {
+               sta_v5 = (sta_info_v5_t *)ioctl_buf;
+               ap_sta_data->chanspec = sta_v5->chanspec;
+               rateset_adv = &sta_v5->rateset_adv;
+       }
+
+       ap_sta_data->channel = wf_chspec_ctlchan(ap_sta_data->chanspec);
+       ap_sta_data->rate =
+               (sta_v4->rateset.rates[sta_v4->rateset.count - 1] & DOT11_RATE_MASK) / 2;
+
+       if (sta_v4->vht_flags) {
+               ap_sta_data->mode_80211 = BIGDATA_DOT11_11AC_MODE;
+               wg_vht_mimo_ant(&ap_sta_data->nss, rateset_adv);
+       } else if (sta_v4->ht_capabilities) {
+               ap_sta_data->mode_80211 = BIGDATA_DOT11_11N_MODE;
+               wg_ht_mimo_ant(&ap_sta_data->nss, rateset_adv);
+       } else {
+               wg_rate_dot11mode(&ap_sta_data->rate, &ap_sta_data->channel,
+                               &ap_sta_data->mode_80211);
+       }
+
+#if defined(WL11AX)
+       ret = wldev_iovar_getbuf(dev, "rateset", NULL, 0, ioctl_buf,
+                       sizeof(wl_rateset_args_v2_t), NULL);
+       if (ret < 0) {
+               WL_ERR(("get rateset failed = %d\n", ret));
+       } else {
+               rateset_adv_v2 = (wl_rateset_args_v2_t *)ioctl_buf;
+               WL_AP_BIGDATA_LOG(("rateset ver %d\n", rateset_adv_v2->version));
+
+               if (rateset_adv_v2->version == RATESET_ARGS_V2) {
+                       rateset_adv_v2 = (wl_rateset_args_v2_t *)&sta_v4->rateset_adv;
+                       if (sta_v4->ver == WL_STA_VER_5) {
+                               rateset_adv_v2 = (wl_rateset_args_v2_t *)&sta_v5->rateset_adv;
+                       }
+
+                       if (rateset_adv_v2->he_mcs[0]) {
+                               WL_AP_BIGDATA_LOG(("there is he mcs rate\n"));
+                               ap_sta_data->mode_80211 = BIGDATA_DOT11_11AX_MODE;
+                               wg_he_mimo_ant(&ap_sta_data->nss, &rateset_adv_v2->he_mcs[0]);
+                       }
+               }
+       }
+#endif /* WL11AX */
+
+       if (ap_sta_data->nss) {
+               ap_sta_data->nss = ap_sta_data->nss - 1;
+       }
+
+done:
+       if (ioctl_buf) {
+               kfree(ioctl_buf);
+       }
+
+       return ret;
+}
+
+void
+wl_gather_ap_stadata(void *handle, void *event_info, u8 event)
+{
+       u32 event_type = 0;
+       u32 reason = 0;
+       u32 status = 0;
+       struct ether_addr sta_mac;
+       dhd_pub_t *dhdp;
+
+       struct net_device *dev = NULL;
+       struct bcm_cfg80211 *cfg = NULL;
+       wl_event_msg_t *e;
+
+       wl_ap_sta_data_t *sta_data;
+       wl_ap_sta_data_t temp_sta_data;
+       void *data = NULL;
+       int i;
+       int ret;
+
+       ap_sta_wq_data_t *wq_event_data = event_info;
+       if (!wq_event_data) {
+               WL_ERR(("wq_event_data is NULL\n"));
+               return;
+       }
+
+       cfg = (struct bcm_cfg80211 *)wq_event_data->bcm_cfg;
+       if (!cfg || !cfg->ap_sta_info) {
+               WL_ERR(("cfg=%p ap_sta_info=%p\n", cfg, (cfg ? cfg->ap_sta_info : NULL)));
+               if (wq_event_data) {
+                       kfree(wq_event_data);
+               }
+               return;
+       }
+
+       mutex_lock(&cfg->ap_sta_info->wq_data_sync);
+
+       dhdp = (dhd_pub_t *)cfg->pub;
+       e = &wq_event_data->e;
+       dev = (struct net_device *)wq_event_data->ndev;
+
+       if (!e || !dev) {
+               WL_ERR(("e=%p dev=%p\n", e, dev));
+               goto done;
+       }
+
+       if (!wl_get_drv_status(cfg, AP_CREATED, dev)) {
+               WL_ERR(("skip to gather data becasue interface is not available\n"));
+               goto done;
+       }
+
+       sta_data = cfg->ap_sta_info->ap_sta_data;
+
+       event_type = ntoh32(e->event_type);
+       reason = ntoh32(e->reason);
+       status = ntoh32(e->status);
+       sta_mac = e->addr;
+
+       if (!sta_data) {
+               WL_ERR(("sta_data is NULL\n"));
+               goto done;
+       }
+
+       WL_AP_BIGDATA_LOG((""MACDBG" event %d status %d reason %d\n",
+               MAC2STRDBG((char*)&sta_mac), event_type, status, reason));
+
+       if (WLC_E_IS_ASSOC(event_type, reason)) {
+               ret = wg_parse_ap_stadata(dev, &sta_mac, &temp_sta_data);
+               if (ret < 0) {
+                       WL_AP_BIGDATA_LOG(("sta_info err value :%d\n", ret));
+                       goto done;
+               }
+
+               if (cfg->ap_sta_info->sta_list_cnt == 0) {
+                       copy_ap_stadata(&sta_data[0], &temp_sta_data);
+                       cfg->ap_sta_info->sta_list_cnt++;
+                       dump_ap_stadata(sta_data);
+               } else {
+                       get_copy_ptr_stadata(&sta_mac, sta_data,
+                                       &cfg->ap_sta_info->sta_list_cnt, &data);
+                       if (data != NULL) {
+                               copy_ap_stadata((wl_ap_sta_data_t *)data, &temp_sta_data);
+                               dump_ap_stadata(sta_data);
+                       }
+               }
+       }
+
+       if (WLC_E_IS_DEAUTH(event_type)) {
+               /* Find already existed sta */
+               for (i = 0; i < MAX_STA_INFO_AP_CNT; i++) {
+                       if (!sta_data[i].is_empty &&
+                               !memcmp((char*)&sta_mac, (char*)&sta_data[i].mac, ETHER_ADDR_LEN)) {
+                               WL_AP_BIGDATA_LOG(("found disconnected "
+                                                       "STA idx %d "MACDBG"\n",
+                                                       i, MAC2STRDBG((char *)&sta_mac)));
+                               sta_data[i].is_empty = FALSE;
+                               sta_data[i].disconnected = TRUE;
+                               sta_data[i].reason_code = reason;
+                               dump_ap_stadata(sta_data);
+                               goto done;
+                       }
+               }
+       }
+
+done:
+       if (wq_event_data) {
+               ASSERT(dhdp->osh);
+               MFREE(dhdp->osh, wq_event_data, sizeof(ap_sta_wq_data_t));
+       }
+       mutex_unlock(&cfg->ap_sta_info->wq_data_sync);
+}
+
+int
+wl_attach_ap_stainfo(void *bcm_cfg)
+{
+       gfp_t kflags;
+       uint32 alloc_len;
+       wl_ap_sta_info_t *sta_info;
+       wl_ap_sta_data_t *sta_data = NULL;
+       int i;
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)bcm_cfg;
+
+       if (!cfg) {
+               WL_ERR(("cfg is NULL\n"));
+               return -EINVAL;
+       }
+
+       kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+
+       alloc_len = sizeof(wl_ap_sta_info_t);
+       sta_info = (wl_ap_sta_info_t *)kzalloc(alloc_len, kflags);
+
+       if (unlikely(!sta_info)) {
+               WL_ERR(("could not allocate memory for - "
+                                       "wl_ap_sta_info_t\n"));
+               goto fail;
+       }
+       cfg->ap_sta_info = sta_info;
+
+       alloc_len = sizeof(wl_ap_sta_data_t) * MAX_STA_INFO_AP_CNT;
+       sta_data = (wl_ap_sta_data_t *)kzalloc(alloc_len, kflags);
+
+       if (unlikely(!sta_data)) {
+               WL_ERR(("could not allocate memory for - "
+                                       "wl_ap_sta_data_t\n"));
+               goto fail;
+       }
+
+       cfg->ap_sta_info->sta_list_cnt = 0;
+
+       for (i = 0; i < MAX_STA_INFO_AP_CNT; i++) {
+               sta_data[i].is_empty = TRUE;
+               memset(&sta_data[i].mac, 0, ETHER_ADDR_LEN);
+       }
+
+       cfg->ap_sta_info->ap_sta_data = sta_data;
+
+       mutex_init(&cfg->ap_sta_info->wq_data_sync);
+
+       WL_ERR(("attach success\n"));
+
+       return BCME_OK;
+
+fail:
+       if (sta_data) {
+               kfree(sta_data);
+               cfg->ap_sta_info->ap_sta_data = NULL;
+       }
+
+       if (sta_info) {
+               kfree(sta_info);
+               cfg->ap_sta_info = NULL;
+       }
+
+       return BCME_ERROR;
+}
+
+int
+wl_detach_ap_stainfo(void *bcm_cfg)
+{
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)bcm_cfg;
+
+       if (!cfg || !cfg->ap_sta_info) {
+               WL_ERR(("cfg=%p ap_sta_info=%p\n",
+                       cfg, (cfg ? cfg->ap_sta_info : NULL)));
+               return -EINVAL;
+       }
+
+       if (cfg->ap_sta_info->ap_sta_data) {
+               kfree(cfg->ap_sta_info->ap_sta_data);
+               cfg->ap_sta_info->ap_sta_data = NULL;
+       }
+
+       mutex_destroy(&cfg->ap_sta_info->wq_data_sync);
+
+       kfree(cfg->ap_sta_info);
+       cfg->ap_sta_info = NULL;
+
+       WL_ERR(("detach success\n"));
+
+       return BCME_OK;
+}
+
+int
+wl_ap_stainfo_init(void *bcm_cfg)
+{
+       int i;
+       wl_ap_sta_data_t *sta_data;
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)bcm_cfg;
+
+       if (!cfg || !cfg->ap_sta_info) {
+               WL_ERR(("cfg=%p ap_sta_info=%p\n",
+                       cfg, (cfg ? cfg->ap_sta_info : NULL)));
+               return -EINVAL;
+       }
+
+       sta_data = cfg->ap_sta_info->ap_sta_data;
+       cfg->ap_sta_info->sta_list_cnt = 0;
+
+       if (!sta_data) {
+               WL_ERR(("ap_sta_data is NULL\n"));
+               return -EINVAL;
+       }
+
+       for (i = 0; i < MAX_STA_INFO_AP_CNT; i++) {
+               sta_data[i].is_empty = TRUE;
+               memset(&sta_data[i].mac, 0, ETHER_ADDR_LEN);
+       }
+
+       return BCME_OK;
+}
+
+int
+wl_get_ap_stadata(void *bcm_cfg, struct ether_addr *sta_mac, void **data)
+{
+       int i;
+       wl_ap_sta_data_t *sta_data;
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)bcm_cfg;
+
+       if (!cfg || !cfg->ap_sta_info) {
+               WL_ERR(("cfg=%p ap_sta_info=%p\n",
+                       cfg, (cfg ? cfg->ap_sta_info : NULL)));
+               return -EINVAL;
+       }
+
+       if  (!sta_mac || !data) {
+               WL_ERR(("sta_mac=%p data=%p\n", sta_mac, data));
+               return -EINVAL;
+       }
+
+       sta_data = cfg->ap_sta_info->ap_sta_data;
+
+       if (!sta_data) {
+               WL_ERR(("ap_sta_data is NULL\n"));
+               return -EINVAL;
+       }
+
+       /* Find already existed sta */
+       for (i = 0; i < MAX_STA_INFO_AP_CNT; i++) {
+               if (!sta_data[i].is_empty) {
+                       WL_AP_BIGDATA_LOG(("%d " MACDBG " " MACDBG "\n", i,
+                               MAC2STRDBG((char *)sta_mac),
+                               MAC2STRDBG((char*)&sta_data[i].mac)));
+
+                       if (!memcmp(sta_mac, (char*)&sta_data[i].mac, ETHER_ADDR_LEN)) {
+                               WL_AP_BIGDATA_LOG(("Found STA idx %d " MACDBG "\n",
+                                       i, MAC2STRDBG((char *)&sta_mac)));
+
+                               *data = (wl_ap_sta_data_t*)&sta_data[i];
+                               return BCME_OK;
+                       }
+               }
+       }
+
+       return BCME_ERROR;
+}
diff --git a/bcmdhd.101.10.240.x/wl_cfg80211.c b/bcmdhd.101.10.240.x/wl_cfg80211.c
new file mode 100644 (file)
index 0000000..23a811b
--- /dev/null
@@ -0,0 +1,27270 @@
+/*
+ * Linux cfg80211 driver
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+/* */
+#include <typedefs.h>
+#include <linuxver.h>
+#include <linux/kernel.h>
+
+#include <bcmutils.h>
+#include <bcmstdlib_s.h>
+#include <bcmwifi_channels.h>
+#include <bcmendian.h>
+#include <ethernet.h>
+#ifdef WL_WPS_SYNC
+#include <eapol.h>
+#endif /* WL_WPS_SYNC */
+#include <802.11.h>
+#include <bcmiov.h>
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+
+#include <ethernet.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+#include <linux/ieee80211.h>
+#include <linux/wait.h>
+#if defined(CONFIG_TIZEN)
+#include <linux/net_stat_tizen.h>
+#endif /* CONFIG_TIZEN */
+#include <net/cfg80211.h>
+#include <net/rtnetlink.h>
+
+#include <wlioctl.h>
+#include <bcmevent.h>
+#include <wldev_common.h>
+#include <wl_cfg80211.h>
+#include <wl_cfgp2p.h>
+#include <wl_cfgscan.h>
+#include <bcmdevs.h>
+#include <bcmdevs_legacy.h>
+#ifdef WL_FILS
+#include <fils.h>
+#include <frag.h>
+#endif /* WL_FILS */
+
+#include <wl_android.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_linux.h>
+#include <dhd_linux_pktdump.h>
+#include <dhd_debug.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+#include <dhd_cfg80211.h>
+#include <dhd_bus.h>
+#ifdef PNO_SUPPORT
+#include <dhd_pno.h>
+#endif /* PNO_SUPPORT */
+#include <wl_cfgvendor.h>
+
+#ifdef CONFIG_SLEEP_MONITOR
+#include <linux/power/sleep_monitor.h>
+#endif
+
+#if !defined(WL_VENDOR_EXT_SUPPORT)
+#undef GSCAN_SUPPORT
+#endif
+#include <dhd_config.h>
+
+#ifdef WL_NAN
+#include <wl_cfgnan.h>
+#endif /* WL_NAN */
+
+#ifdef PROP_TXSTATUS
+#include <dhd_wlfc.h>
+#endif
+
+#ifdef BCMPCIE
+#include <dhd_flowring.h>
+#endif
+#ifdef RTT_SUPPORT
+#include <dhd_rtt.h>
+#endif /* RTT_SUPPORT */
+
+#if defined(BIGDATA_SOFTAP) || defined(DHD_ENABLE_BIGDATA_LOGGING)
+#include <wl_bigdata.h>
+#endif /* BIGDATA_SOFTAP || DHD_ENABLE_BIGDATA_LOGGING */
+
+#ifdef DHD_EVENT_LOG_FILTER
+#include <dhd_event_log_filter.h>
+#endif /* DHD_EVENT_LOG_FILTER */
+#define BRCM_SAE_VENDOR_EVENT_BUF_LEN 500
+
+#ifdef DNGL_AXI_ERROR_LOGGING
+#include <bcmtlv.h>
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+#if defined(CONFIG_WLAN_BEYONDX) || defined(CONFIG_SEC_5GMODEL)
+#include <linux/dev_ril_bridge.h>
+#include <linux/notifier.h>
+#endif /* CONFIG_WLAN_BEYONDX || defined(CONFIG_SEC_5GMODEL) */
+
+#if (defined(WL_FW_OCE_AP_SELECT) || defined(BCMFW_ROAM_ENABLE)) && \
+       ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS))
+uint fw_ap_select = true;
+#else
+uint fw_ap_select = false;
+#endif /* WL_FW_OCE_AP_SELECT && (ROAM_ENABLE || BCMFW_ROAM_ENABLE) */
+module_param(fw_ap_select, uint, 0660);
+
+#if defined(WL_REASSOC)
+uint wl_reassoc_support = true;
+#else
+uint wl_reassoc_support = false;
+#endif /* WL_REASSOC */
+module_param(wl_reassoc_support, uint, 0660);
+
+static struct device *cfg80211_parent_dev = NULL;
+static struct bcm_cfg80211 *g_bcmcfg = NULL;
+u32 wl_dbg_level = WL_DBG_ERR;
+
+#define        MAX_VIF_OFFSET  15
+#define MAX_WAIT_TIME 1500
+#ifdef WLAIBSS_MCHAN
+#define IBSS_IF_NAME "ibss%d"
+#endif /* WLAIBSS_MCHAN */
+
+#ifdef VSDB
+/* sleep time to keep STA's connecting or connection for continuous af tx or finding a peer */
+#define DEFAULT_SLEEP_TIME_VSDB                120
+#define OFF_CHAN_TIME_THRESHOLD_MS     200
+#define AF_RETRY_DELAY_TIME                    40
+
+/* if sta is connected or connecting, sleep for a while before retry af tx or finding a peer */
+#define WL_AF_TX_KEEP_PRI_CONNECTION_VSDB(cfg) \
+       do {    \
+               if (wl_get_drv_status(cfg, CONNECTED, bcmcfg_to_prmry_ndev(cfg)) ||     \
+                       wl_get_drv_status(cfg, CONNECTING, bcmcfg_to_prmry_ndev(cfg))) {        \
+                       OSL_SLEEP(DEFAULT_SLEEP_TIME_VSDB);                     \
+               }       \
+       } while (0)
+#else /* VSDB */
+/* if not VSDB, do nothing */
+#define WL_AF_TX_KEEP_PRI_CONNECTION_VSDB(cfg)
+#endif /* VSDB */
+
+#define DNGL_FUNC(func, parameters) func parameters
+#define COEX_DHCP
+
+#define WLAN_EID_SSID  0
+#define CH_MIN_5G_CHANNEL 34
+#ifdef WLAIBSS
+enum abiss_event_type {
+       AIBSS_EVENT_TXFAIL
+};
+#endif
+
+#ifdef WL_RELMCAST
+enum rmc_event_type {
+       RMC_EVENT_NONE,
+       RMC_EVENT_LEADER_CHECK_FAIL
+};
+#endif /* WL_RELMCAST */
+
+/* This is to override regulatory domains defined in cfg80211 module (reg.c)
+ * By default world regulatory domain defined in reg.c puts the flags NL80211_RRF_PASSIVE_SCAN
+ * and NL80211_RRF_NO_IBSS for 5GHz channels (for 36..48 and 149..165).
+ * With respect to these flags, wpa_supplicant doesn't start p2p operations on 5GHz channels.
+ * All the chnages in world regulatory domain are to be done here.
+ *
+ * this definition reuires disabling missing-field-initializer warning
+ * as the ieee80211_regdomain definition differs in plain linux and in Android
+ */
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic push")
+_Pragma("GCC diagnostic ignored \"-Wmissing-field-initializers\"")
+#endif
+static const struct ieee80211_regdomain brcm_regdom = {
+#ifdef WL_6G_BAND
+       .n_reg_rules = 8,
+#else
+       .n_reg_rules = 4,
+#endif
+       .alpha2 =  "99",
+       .reg_rules = {
+               /* IEEE 802.11b/g, channels 1..11 */
+               REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
+               /* If any */
+               /* IEEE 802.11 channel 14 - Only JP enables
+                * this and for 802.11b only
+                */
+               REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
+               /* IEEE 802.11a, channel 36..64 */
+               REG_RULE(5150-10, 5350+10, 40, 6, 20, 0),
+               /* IEEE 802.11a, channel 100..165 */
+               REG_RULE(5470-10, 5850+10, 40, 6, 20, 0),
+#ifdef WL_6G_BAND
+               REG_RULE(6015-80, 6975+80, 160, 6, 20, 0),
+               REG_RULE(5945-10, 7105+10, 20, 6, 20, 0),
+               REG_RULE(5955-20, 7075+20, 40, 6, 20, 0),
+               REG_RULE(5975-40, 7015+40, 80, 6, 20, 0),
+#endif /* WL_6G_BAND */
+               }
+};
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic pop")
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) && \
+       (defined(WL_IFACE_COMB_NUM_CHANNELS) || defined(WL_CFG80211_P2P_DEV_IF))
+static const struct ieee80211_iface_limit common_if_limits[] = {
+       {
+       /*
+        * Driver can support up to 2 AP's
+        */
+       .max = 2,
+       .types = BIT(NL80211_IFTYPE_AP),
+       },
+       {
+       /*
+        * During P2P-GO removal, P2P-GO is first changed to STA and later only
+        * removed. So setting maximum possible number of STA interfaces according
+        * to kernel version.
+        *
+        * less than linux-3.8 - max:3 (wlan0 + p2p0 + group removal of p2p-p2p0-x)
+        * linux-3.8 and above - max:4
+        * sta + NAN NMI + NAN DPI open + NAN DPI sec (since there is no iface type
+        * for NAN defined, registering it as STA type)
+        */
+#ifdef WL_ENABLE_P2P_IF
+       .max = 5,
+#else
+       .max = 4,
+#endif /* WL_ENABLE_P2P_IF */
+       .types = BIT(NL80211_IFTYPE_STATION),
+       },
+       {
+       .max = 2,
+       .types = BIT(NL80211_IFTYPE_P2P_GO) | BIT(NL80211_IFTYPE_P2P_CLIENT),
+       },
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       {
+       .max = 1,
+       .types = BIT(NL80211_IFTYPE_P2P_DEVICE),
+       },
+#endif /* WL_CFG80211_P2P_DEV_IF */
+       {
+       .max = 1,
+       .types = BIT(NL80211_IFTYPE_ADHOC),
+       },
+};
+
+#define NUM_DIFF_CHANNELS 2
+
+static const struct ieee80211_iface_combination
+common_iface_combinations[] = {
+       {
+       .num_different_channels = NUM_DIFF_CHANNELS,
+       /*
+        * At Max 5 network interfaces can be registered concurrently
+        */
+       .max_interfaces = IFACE_MAX_CNT,
+       .limits = common_if_limits,
+       .n_limits = ARRAY_SIZE(common_if_limits),
+       },
+};
+#endif /* LINUX_VER >= 3.0 && (WL_IFACE_COMB_NUM_CHANNELS || WL_CFG80211_P2P_DEV_IF) */
+
+static const char *wl_if_state_strs[WL_IF_STATE_MAX + 1] = {
+       "WL_IF_CREATE_REQ",
+       "WL_IF_CREATE_DONE",
+       "WL_IF_DELETE_REQ",
+       "WL_IF_DELETE_DONE",
+       "WL_IF_CHANGE_REQ",
+       "WL_IF_CHANGE_DONE",
+       "WL_IF_STATE_MAX"
+};
+
+#ifdef BCMWAPI_WPI
+#if defined(ANDROID_PLATFORM_VERSION) && (ANDROID_PLATFORM_VERSION >= 8)
+/* WAPI define in ieee80211.h is used */
+#else
+#undef WLAN_AKM_SUITE_WAPI_PSK
+#define WLAN_AKM_SUITE_WAPI_PSK         0x000FAC04
+
+#undef WLAN_AKM_SUITE_WAPI_CERT
+#define WLAN_AKM_SUITE_WAPI_CERT        0x000FAC12
+
+#undef NL80211_WAPI_VERSION_1
+#define NL80211_WAPI_VERSION_1                 1 << 2
+#endif /* ANDROID_PLATFORM_VERSION && ANDROID_PLATFORM_VERSION >= 8 */
+#endif /* BCMWAPI_WPI */
+
+/* Data Element Definitions */
+#define WPS_ID_CONFIG_METHODS     0x1008
+#define WPS_ID_REQ_TYPE           0x103A
+#define WPS_ID_DEVICE_NAME        0x1011
+#define WPS_ID_VERSION            0x104A
+#define WPS_ID_DEVICE_PWD_ID      0x1012
+#define WPS_ID_REQ_DEV_TYPE       0x106A
+#define WPS_ID_SELECTED_REGISTRAR_CONFIG_METHODS 0x1053
+#define WPS_ID_PRIM_DEV_TYPE      0x1054
+
+/* Device Password ID */
+#define DEV_PW_DEFAULT 0x0000
+#define DEV_PW_USER_SPECIFIED 0x0001,
+#define DEV_PW_MACHINE_SPECIFIED 0x0002
+#define DEV_PW_REKEY 0x0003
+#define DEV_PW_PUSHBUTTON 0x0004
+#define DEV_PW_REGISTRAR_SPECIFIED 0x0005
+
+/* Config Methods */
+#define WPS_CONFIG_USBA 0x0001
+#define WPS_CONFIG_ETHERNET 0x0002
+#define WPS_CONFIG_LABEL 0x0004
+#define WPS_CONFIG_DISPLAY 0x0008
+#define WPS_CONFIG_EXT_NFC_TOKEN 0x0010
+#define WPS_CONFIG_INT_NFC_TOKEN 0x0020
+#define WPS_CONFIG_NFC_INTERFACE 0x0040
+#define WPS_CONFIG_PUSHBUTTON 0x0080
+#define WPS_CONFIG_KEYPAD 0x0100
+#define WPS_CONFIG_VIRT_PUSHBUTTON 0x0280
+#define WPS_CONFIG_PHY_PUSHBUTTON 0x0480
+#define WPS_CONFIG_VIRT_DISPLAY 0x2008
+#define WPS_CONFIG_PHY_DISPLAY 0x4008
+
+#define PM_BLOCK 1
+#define PM_ENABLE 0
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0))
+#define IS_REGDOM_SELF_MANAGED(wiphy)  \
+       (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED)
+#else
+#define IS_REGDOM_SELF_MANAGED(wiphy)  (false)
+#endif /* KERNEL >= 4.0 */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)) && defined(WL_SELF_MANAGED_REGDOM)
+#define WL_UPDATE_CUSTOM_REGULATORY(wiphy) \
+       wiphy->regulatory_flags |= REGULATORY_WIPHY_SELF_MANAGED;
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+#define WL_UPDATE_CUSTOM_REGULATORY(wiphy) \
+       wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
+#else /* kernel > 4.0 && WL_SELF_MANAGED_REGDOM */
+/* Kernels < 3.14 */
+#define WL_UPDATE_CUSTOM_REGULATORY(wiphy) \
+       wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)) */
+
+/* GCMP crypto supported above kernel v4.0 */
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(4, 0, 0))
+#define WL_GCMP
+#endif /* (LINUX_VERSION_CODE > KERNEL_VERSION(4, 0, 0) */
+
+#ifndef IBSS_COALESCE_ALLOWED
+#define IBSS_COALESCE_ALLOWED IBSS_COALESCE_DEFAULT
+#endif
+
+#ifndef IBSS_INITIAL_SCAN_ALLOWED
+#define IBSS_INITIAL_SCAN_ALLOWED IBSS_INITIAL_SCAN_ALLOWED_DEFAULT
+#endif
+
+#define CUSTOM_RETRY_MASK 0xff000000 /* Mask for retry counter of custom dwell time */
+
+#ifdef WBTEXT
+typedef struct wl_wbtext_bssid {
+       struct ether_addr ea;
+       struct list_head list;
+} wl_wbtext_bssid_t;
+
+static void wl_cfg80211_wbtext_update_rcc(struct bcm_cfg80211 *cfg, struct net_device *dev);
+static bool wl_cfg80211_wbtext_check_bssid_list(struct bcm_cfg80211 *cfg, struct ether_addr *ea);
+static bool wl_cfg80211_wbtext_add_bssid_list(struct bcm_cfg80211 *cfg, struct ether_addr *ea);
+static void wl_cfg80211_wbtext_clear_bssid_list(struct bcm_cfg80211 *cfg);
+static bool wl_cfg80211_wbtext_send_nbr_req(struct bcm_cfg80211 *cfg, struct net_device *dev,
+       struct wl_profile *profile);
+static bool wl_cfg80211_wbtext_send_btm_query(struct bcm_cfg80211 *cfg, struct net_device *dev,
+       struct wl_profile *profile);
+static void wl_cfg80211_wbtext_set_wnm_maxidle(struct bcm_cfg80211 *cfg, struct net_device *dev);
+static int wl_cfg80211_recv_nbr_resp(struct net_device *dev, uint8 *body, uint body_len);
+#endif /* WBTEXT */
+
+#ifdef RTT_SUPPORT
+static s32 wl_cfg80211_rtt_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+               const wl_event_msg_t *e, void *data);
+#endif /* RTT_SUPPORT */
+#ifdef WL_CHAN_UTIL
+static s32 wl_cfg80211_bssload_report_event_handler(struct bcm_cfg80211 *cfg,
+       bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *e, void *data);
+static s32 wl_cfg80211_start_bssload_report(struct net_device *ndev);
+#endif /* WL_CHAN_UTIL */
+
+#ifdef SUPPORT_AP_RADIO_PWRSAVE
+#define RADIO_PWRSAVE_PPS                                      10
+#define RADIO_PWRSAVE_QUIET_TIME                       10
+#define RADIO_PWRSAVE_LEVEL                            3
+#define RADIO_PWRSAVE_STAS_ASSOC_CHECK 0
+
+#define RADIO_PWRSAVE_LEVEL_MIN                                1
+#define RADIO_PWRSAVE_LEVEL_MAX                                9
+#define RADIO_PWRSAVE_PPS_MIN                                  1
+#define RADIO_PWRSAVE_QUIETTIME_MIN                    1
+#define RADIO_PWRSAVE_ASSOCCHECK_MIN           0
+#define RADIO_PWRSAVE_ASSOCCHECK_MAX           1
+
+#define RADIO_PWRSAVE_MAJOR_VER 1
+#define RADIO_PWRSAVE_MINOR_VER 1
+#define RADIO_PWRSAVE_MAJOR_VER_SHIFT 8
+#define RADIO_PWRSAVE_VERSION \
+       ((RADIO_PWRSAVE_MAJOR_VER << RADIO_PWRSAVE_MAJOR_VER_SHIFT)| RADIO_PWRSAVE_MINOR_VER)
+#endif /* SUPPORT_AP_RADIO_PWRSAVE */
+
+/* SoftAP related parameters */
+#define DEFAULT_2G_SOFTAP_CHANNEL      1
+#define DEFAULT_2G_SOFTAP_CHANSPEC     0x1006
+#define DEFAULT_5G_SOFTAP_CHANNEL      149
+#define WL_MAX_NUM_CSA_COUNTERS                255
+
+#define MAX_VNDR_OUI_STR_LEN   256u
+#define VNDR_OUI_STR_LEN       10u
+#define DOT11_DISCONNECT_RC     2u
+static const uchar *exclude_vndr_oui_list[] = {
+       "\x00\x50\xf2",                 /* Microsoft */
+       "\x00\x00\xf0",                 /* Samsung Elec */
+       WFA_OUI,                        /* WFA */
+       NULL
+};
+
+typedef struct wl_vndr_oui_entry {
+       uchar oui[DOT11_OUI_LEN];
+       struct list_head list;
+} wl_vndr_oui_entry_t;
+
+#ifdef WL_ANALYTICS
+static const uchar disco_bcnloss_vsie[] = {
+       0xdd, /* Vendor specific */
+       0x09, /* Length */
+       0x00, 0x00, 0xF0, /* OUI */
+       0x22, /* VENDOR_ENTERPRISE_STA_OUI_TYPE */
+       0x03, /* Sub type for additional rc */
+       0x01, /* Version */
+       0x02, /* Length */
+       0x07, 0x00 /* Reason code for BCN loss */
+};
+#endif /* WL_ANALYTICS */
+
+#define WL_HE_FEATURES_HE_AP           0x8
+#define WL_HE_FEATURES_HE_P2P          0x20
+
+static int wl_vndr_ies_get_vendor_oui(struct bcm_cfg80211 *cfg,
+               struct net_device *ndev, char *vndr_oui, u32 vndr_oui_len);
+static void wl_vndr_ies_clear_vendor_oui_list(struct bcm_cfg80211 *cfg);
+#ifdef WL_ANALYTICS
+static bool wl_vndr_ies_find_vendor_oui(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev, const char *vndr_oui);
+#endif
+static s32 wl_cfg80211_parse_vndr_ies(const u8 *parse, u32 len,
+               struct parsed_vndr_ies *vndr_ies);
+static bool wl_cfg80211_filter_vndr_ext_id(const vndr_ie_t *vndrie);
+#if defined(WL_FW_OCE_AP_SELECT)
+static bool
+wl_cfgoce_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len, const u8 *oui, u32 oui_len, u8 type);
+
+/* Check whether the given IE looks like WFA OCE IE. */
+#define wl_cfgoce_is_oce_ie(ie, tlvs, len)      wl_cfgoce_has_ie(ie, tlvs, len, \
+       (const uint8 *)WFA_OUI, WFA_OUI_LEN, WFA_OUI_TYPE_MBO_OCE)
+
+/* Is any of the tlvs the expected entry? If
+ * not update the tlvs buffer pointer/length.
+ */
+static bool
+wl_cfgoce_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len, const u8 *oui, u32 oui_len, u8 type)
+{
+       /* If the contents match the OUI and the type */
+       if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
+                       !bcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
+                       type == ie[TLV_BODY_OFF + oui_len]) {
+               return TRUE;
+       }
+
+       return FALSE;
+}
+#endif /* WL_FW_OCE_AP_SELECT */
+
+/*
+ * cfg80211_ops api/callback list
+ */
+static s32 wl_frame_get_mgmt(struct bcm_cfg80211 *cfg, u16 fc,
+       const struct ether_addr *da, const struct ether_addr *sa,
+       const struct ether_addr *bssid, u8 **pheader, u32 *body_len, u8 *pbody);
+static s32 wl_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed);
+#ifdef WLAIBSS_MCHAN
+static bcm_struct_cfgdev* bcm_cfg80211_add_ibss_if(struct wiphy *wiphy, char *name);
+static s32 bcm_cfg80211_del_ibss_if(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev);
+#endif /* WLAIBSS_MCHAN */
+static s32 wl_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_ibss_params *params);
+static s32 wl_cfg80211_leave_ibss(struct wiphy *wiphy,
+       struct net_device *dev);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+static s32 wl_cfg80211_get_station(struct wiphy *wiphy,
+       struct net_device *dev, const u8 *mac,
+       struct station_info *sinfo);
+#else
+static s32 wl_cfg80211_get_station(struct wiphy *wiphy,
+       struct net_device *dev, u8 *mac,
+       struct station_info *sinfo);
+#endif
+static s32 wl_cfg80211_set_power_mgmt(struct wiphy *wiphy,
+       struct net_device *dev, bool enabled,
+       s32 timeout);
+static int wl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_connect_params *sme);
+#if defined(WL_FILS)
+static int wl_cfg80211_update_connect_params(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_connect_params *sme, u32 changed);
+#endif /* WL_FILS */
+static s32 wl_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
+       u16 reason_code);
+#if defined(WL_CFG80211_P2P_DEV_IF)
+static s32
+wl_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
+       enum nl80211_tx_power_setting type, s32 mbm);
+#else
+static s32
+wl_cfg80211_set_tx_power(struct wiphy *wiphy,
+       enum nl80211_tx_power_setting type, s32 dbm);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+#if defined(WL_CFG80211_P2P_DEV_IF)
+static s32 wl_cfg80211_get_tx_power(struct wiphy *wiphy,
+       struct wireless_dev *wdev, s32 *dbm);
+#else
+static s32 wl_cfg80211_get_tx_power(struct wiphy *wiphy, s32 *dbm);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+static s32 wl_cfg80211_config_default_key(struct wiphy *wiphy,
+       struct net_device *dev,
+       u8 key_idx, bool unicast, bool multicast);
+static s32 wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, bool pairwise, const u8 *mac_addr,
+       struct key_params *params);
+static s32 wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, bool pairwise, const u8 *mac_addr);
+static s32 wl_cfg80211_get_key(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, bool pairwise, const u8 *mac_addr,
+       void *cookie, void (*callback) (void *cookie,
+       struct key_params *params));
+static s32 wl_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
+       struct net_device *dev, u8 key_idx);
+#if defined(WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, \
+       2, 0))
+static s32 wl_cfg80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
+       bcm_struct_cfgdev *cfgdev, u64 cookie);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0))
+static s32 wl_cfg80211_del_station(
+               struct wiphy *wiphy, struct net_device *ndev,
+               struct station_del_parameters *params);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+static s32 wl_cfg80211_del_station(struct wiphy *wiphy,
+       struct net_device *ndev, const u8* mac_addr);
+#else
+static s32 wl_cfg80211_del_station(struct wiphy *wiphy,
+       struct net_device *ndev, u8* mac_addr);
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+static s32 wl_cfg80211_change_station(struct wiphy *wiphy,
+       struct net_device *dev, const u8 *mac, struct station_parameters *params);
+#else
+static s32 wl_cfg80211_change_station(struct wiphy *wiphy,
+       struct net_device *dev, u8 *mac, struct station_parameters *params);
+#endif
+#endif /* WL_SUPPORT_BACKPORTED_KPATCHES || KERNEL_VER >= KERNEL_VERSION(3, 2, 0)) */
+static s32 wl_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_pmksa *pmksa);
+static s32 wl_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_pmksa *pmksa);
+static s32 wl_cfg80211_flush_pmksa(struct wiphy *wiphy,
+       struct net_device *dev);
+#ifdef WL_CLIENT_SAE
+static bool wl_is_pmkid_available(struct net_device *dev, const u8 *bssid);
+#endif /* WL_CLIENT_SAE */
+static s32 wl_cfg80211_update_pmksa(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_pmksa *pmksa, bool set);
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)
+#if (defined(CONFIG_ARCH_MSM) && defined(TDLS_MGMT_VERSION2)) || (LINUX_VERSION_CODE < \
+       KERNEL_VERSION(3, 16, 0) && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0))
+static s32 wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+       u32 peer_capability, const u8 *buf, size_t len);
+#elif ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0)) && \
+               (LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0)))
+static s32 wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       const u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+       u32 peer_capability, const u8 *buf, size_t len);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+static s32 wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       const u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+       u32 peer_capability, bool initiator, const u8 *buf, size_t len);
+#else /* CONFIG_ARCH_MSM && TDLS_MGMT_VERSION2 */
+static s32 wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+       const u8 *buf, size_t len);
+#endif /* CONFIG_ARCH_MSM && TDLS_MGMT_VERSION2 */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+static s32 wl_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+       const u8 *peer, enum nl80211_tdls_operation oper);
+#else
+static s32 wl_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+       u8 *peer, enum nl80211_tdls_operation oper);
+#endif
+#endif /* LINUX_VERSION > KERNEL_VERSION(3,2,0) || WL_COMPAT_WIRELESS */
+static s32 wl_cfg80211_set_ap_role(struct bcm_cfg80211 *cfg, struct net_device *dev);
+
+struct wireless_dev *
+wl_cfg80211_create_iface(struct wiphy *wiphy, wl_iftype_t
+       iface_type, u8 *mac_addr, const char *name);
+s32
+wl_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev);
+
+s32 wl_cfg80211_interface_ops(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev, s32 bsscfg_idx,
+       wl_iftype_t iftype, s32 del, u8 *addr);
+s32 wl_cfg80211_add_del_bss(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev, s32 bsscfg_idx,
+       wl_iftype_t brcm_iftype, s32 del, u8 *addr);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || defined(WL_COMPAT_WIRELESS)
+static s32 wl_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *dev);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0) */
+#ifdef GTK_OFFLOAD_SUPPORT
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0))
+static s32 wl_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_gtk_rekey_data *data);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0) */
+#endif /* GTK_OFFLOAD_SUPPORT */
+chanspec_t wl_chspec_driver_to_host(chanspec_t chanspec);
+chanspec_t wl_chspec_host_to_driver(chanspec_t chanspec);
+static void wl_cfg80211_wait_for_disconnection(struct bcm_cfg80211 *cfg, struct net_device *dev);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0))
+int wl_cfg80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+        struct cfg80211_csa_settings *params);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0))
+static int wl_cfg80211_set_pmk(struct wiphy *wiphy, struct net_device *dev,
+        const struct cfg80211_pmk_conf *conf);
+static int wl_cfg80211_del_pmk(struct wiphy *wiphy, struct net_device *dev,
+        const u8 *aa);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0) */
+
+/*
+ * event & event Q handlers for cfg80211 interfaces
+ */
+static s32 wl_create_event_handler(struct bcm_cfg80211 *cfg);
+static void wl_destroy_event_handler(struct bcm_cfg80211 *cfg);
+static void wl_event_handler(struct work_struct *work_data);
+static void wl_init_eq(struct bcm_cfg80211 *cfg);
+static void wl_flush_eq(struct bcm_cfg80211 *cfg);
+static unsigned long wl_lock_eq(struct bcm_cfg80211 *cfg);
+static void wl_unlock_eq(struct bcm_cfg80211 *cfg, unsigned long flags);
+static void wl_init_eq_lock(struct bcm_cfg80211 *cfg);
+static void wl_init_event_handler(struct bcm_cfg80211 *cfg);
+static struct wl_event_q *wl_deq_event(struct bcm_cfg80211 *cfg);
+static s32 wl_enq_event(struct bcm_cfg80211 *cfg, struct net_device *ndev, u32 type,
+       const wl_event_msg_t *msg, void *data);
+static void wl_put_event(struct bcm_cfg80211 *cfg, struct wl_event_q *e);
+static s32 wl_notify_connect_status_ap(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data);
+static s32 wl_notify_connect_status(struct bcm_cfg80211 *cfg,
+       bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *e, void *data);
+static s32 wl_notify_roaming_status(struct bcm_cfg80211 *cfg,
+       bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *e, void *data);
+static s32 wl_bss_connect_done(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data, bool completed);
+static s32 wl_bss_roaming_done(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data);
+static s32 wl_notify_mic_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#ifdef BT_WIFI_HANDOVER
+static s32 wl_notify_bt_wifi_handover_req(struct bcm_cfg80211 *cfg,
+       bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *e, void *data);
+#endif /* BT_WIFI_HANDOVER */
+#ifdef GSCAN_SUPPORT
+static s32 wl_handle_roam_exp_event(struct bcm_cfg80211 *wl, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#endif /* GSCAN_SUPPORT */
+#ifdef RSSI_MONITOR_SUPPORT
+static s32 wl_handle_rssi_monitor_event(struct bcm_cfg80211 *wl, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#endif /* RSSI_MONITOR_SUPPORT */
+static s32 wl_notifier_change_state(struct bcm_cfg80211 *cfg, struct net_info *_net_info,
+       enum wl_status state, bool set);
+#ifdef CUSTOM_EVENT_PM_WAKE
+static s32 wl_check_pmstatus(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#endif /* CUSTOM_EVENT_PM_WAKE */
+#if defined(DHD_LOSSLESS_ROAMING) || defined(DBG_PKT_MON)
+static s32 wl_notify_roam_prep_status(struct bcm_cfg80211 *cfg,
+       bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *e, void *data);
+#endif /* DHD_LOSSLESS_ROAMING || DBG_PKT_MON */
+#ifdef DHD_LOSSLESS_ROAMING
+static void wl_del_roam_timeout(struct bcm_cfg80211 *cfg);
+#endif /* DHD_LOSSLESS_ROAMING */
+
+#ifdef WL_MBO
+static s32
+wl_mbo_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#endif /* WL_MBO */
+
+#ifdef WL_CLIENT_SAE
+static s32 wl_notify_connect_status_bss(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data);
+static s32 wl_notify_start_auth(struct bcm_cfg80211 *cfg,
+       bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *e, void *data);
+static s32 wl_cfg80211_external_auth(struct wiphy *wiphy,
+       struct net_device *dev, struct cfg80211_external_auth_params *ext_auth);
+#endif /* WL_CLIENT_SAE */
+
+/*
+ * register/deregister parent device
+ */
+static void wl_cfg80211_clear_parent_dev(void);
+/*
+ * ioctl utilites
+ */
+
+/*
+ * cfg80211 set_wiphy_params utilities
+ */
+static s32 wl_set_frag(struct net_device *dev, u32 frag_threshold);
+static s32 wl_set_rts(struct net_device *dev, u32 frag_threshold);
+static s32 wl_set_retry(struct net_device *dev, u32 retry, bool l);
+
+/*
+ * cfg profile utilities
+ */
+static s32 wl_update_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, const void *data, s32 item);
+static void wl_init_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+
+/*
+ * cfg80211 connect utilites
+ */
+static s32 wl_set_wpa_version(struct net_device *dev,
+       struct cfg80211_connect_params *sme);
+static s32 wl_set_auth_type(struct net_device *dev,
+       struct cfg80211_connect_params *sme);
+static s32 wl_set_set_cipher(struct net_device *dev,
+       struct cfg80211_connect_params *sme);
+static s32 wl_set_key_mgmt(struct net_device *dev,
+       struct cfg80211_connect_params *sme);
+static s32 wl_set_set_sharedkey(struct net_device *dev,
+       struct cfg80211_connect_params *sme);
+#ifdef WL_FILS
+static s32 wl_set_fils_params(struct net_device *dev,
+       struct cfg80211_connect_params *sme);
+#endif
+
+#ifdef BCMWAPI_WPI
+static s32 wl_set_set_wapi_ie(struct net_device *dev,
+       struct cfg80211_connect_params *sme);
+#endif
+
+#ifdef WL_GCMP
+static s32 wl_set_wsec_info_algos(struct net_device *dev, uint32 algos, uint32 mask);
+#endif /* WL_GCMP */
+static s32 wl_get_assoc_ies(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+void wl_cfg80211_clear_security(struct bcm_cfg80211 *cfg);
+
+/*
+ * information element utilities
+ */
+static __used s32 wl_add_ie(struct bcm_cfg80211 *cfg, u8 t, u8 l, u8 *v);
+
+#ifdef MFP
+static int wl_cfg80211_get_rsn_capa(const bcm_tlv_t *wpa2ie, const u8** rsn_cap);
+#endif
+
+static s32 wl_setup_wiphy(struct wireless_dev *wdev, struct device *dev, dhd_pub_t *data);
+static void wl_free_wdev(struct bcm_cfg80211 *cfg);
+#ifdef CONFIG_CFG80211_INTERNAL_REGDB
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 11))
+static int
+#else
+static void
+#endif /* kernel version < 3.10.11 */
+wl_cfg80211_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request);
+#endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+
+static s32 wl_update_bss_info(struct bcm_cfg80211 *cfg, struct net_device *ndev, bool update_ssid);
+static chanspec_t wl_cfg80211_get_shared_freq(struct wiphy *wiphy);
+static void wl_cfg80211_work_handler(struct work_struct *work);
+static s32 wl_add_keyext(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, const u8 *mac_addr,
+       struct key_params *params);
+/*
+ * key indianess swap utilities
+ */
+static void swap_key_from_BE(struct wl_wsec_key *key);
+static void swap_key_to_BE(struct wl_wsec_key *key);
+
+/*
+ * bcm_cfg80211 memory init/deinit utilities
+ */
+static s32 wl_init_priv_mem(struct bcm_cfg80211 *cfg);
+static void wl_deinit_priv_mem(struct bcm_cfg80211 *cfg);
+
+static void wl_delay(u32 ms);
+
+/*
+ * ibss mode utilities
+ */
+static bool wl_is_ibssmode(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+static __used bool wl_is_ibssstarter(struct bcm_cfg80211 *cfg);
+
+/*
+ * link up/down , default configuration utilities
+ */
+static s32 __wl_cfg80211_up(struct bcm_cfg80211 *cfg);
+static s32 __wl_cfg80211_down(struct bcm_cfg80211 *cfg);
+static bool wl_is_linkdown(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e);
+
+static bool wl_is_linkup(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e,
+       struct net_device *ndev);
+static bool wl_is_nonetwork(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e);
+static void wl_link_up(struct bcm_cfg80211 *cfg);
+static void wl_link_down(struct bcm_cfg80211 *cfg);
+static s32 wl_config_infra(struct bcm_cfg80211 *cfg, struct net_device *ndev, u16 iftype);
+static void wl_init_conf(struct wl_conf *conf);
+int wl_cfg80211_get_ioctl_version(void);
+
+/*
+ * find most significant bit set
+ */
+static __used u32 wl_find_msb(u16 bit16);
+
+/*
+ * rfkill support
+ */
+static int wl_setup_rfkill(struct bcm_cfg80211 *cfg, bool setup);
+static int wl_rfkill_set(void *data, bool blocked);
+#ifdef DEBUGFS_CFG80211
+static s32 wl_setup_debugfs(struct bcm_cfg80211 *cfg);
+static s32 wl_free_debugfs(struct bcm_cfg80211 *cfg);
+#endif
+static bool check_dev_role_integrity(struct bcm_cfg80211 *cfg, u32 dev_role);
+
+#ifdef WL_CFG80211_ACL
+/* ACL */
+static int wl_cfg80211_set_mac_acl(struct wiphy *wiphy, struct net_device *cfgdev,
+       const struct cfg80211_acl_data *acl);
+#endif /* WL_CFG80211_ACL */
+
+/*
+ * Some external functions, TODO: move them to dhd_linux.h
+ */
+int dhd_add_monitor(const char *name, struct net_device **new_ndev);
+int dhd_del_monitor(struct net_device *ndev);
+int dhd_monitor_init(void *dhd_pub);
+int dhd_monitor_uninit(void);
+int dhd_start_xmit(struct sk_buff *skb, struct net_device *net);
+
+#ifdef ROAM_CHANNEL_CACHE
+int init_roam_cache(struct bcm_cfg80211 *cfg, int ioctl_ver);
+#endif /* ROAM_CHANNEL_CACHE */
+
+#ifdef P2P_LISTEN_OFFLOADING
+s32 wl_cfg80211_p2plo_deinit(struct bcm_cfg80211 *cfg);
+#endif /* P2P_LISTEN_OFFLOADING */
+
+#ifdef CUSTOMER_HW4_DEBUG
+extern bool wl_scan_timeout_dbg_enabled;
+#endif /* CUSTOMER_HW4_DEBUG */
+#ifdef PKT_FILTER_SUPPORT
+extern uint dhd_pkt_filter_enable;
+extern void dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode);
+#endif /* PKT_FILTER_SUPPORT */
+
+#ifdef SUPPORT_SET_CAC
+static void wl_cfg80211_set_cac(struct bcm_cfg80211 *cfg, int enable);
+#endif /* SUPPORT_SET_CAC */
+
+static int wl_cfg80211_delayed_roam(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const struct ether_addr *bssid);
+static s32 __wl_update_wiphybands(struct bcm_cfg80211 *cfg, bool notify);
+
+#ifdef WL_WPS_SYNC
+static void wl_init_wps_reauth_sm(struct bcm_cfg80211 *cfg);
+static void wl_deinit_wps_reauth_sm(struct bcm_cfg80211 *cfg);
+static void wl_wps_reauth_timeout(unsigned long data);
+static s32 wl_get_free_wps_inst(struct bcm_cfg80211 *cfg);
+static s32 wl_get_wps_inst_match(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+static s32 wl_wps_session_add(struct net_device *ndev, u16 mode, u8 *peer_mac);
+static void wl_wps_session_del(struct net_device *ndev);
+static s32 wl_wps_session_update(struct net_device *ndev, u16 state, const u8 *peer_mac);
+static void wl_wps_handle_ifdel(struct net_device *ndev);
+#endif /* WL_WPS_SYNC */
+
+#if defined(WL_FW_OCE_AP_SELECT)
+bool static wl_cfg80211_is_oce_ap(struct wiphy *wiphy, const u8 *bssid_hint);
+#endif /* WL_FW_OCE_AP_SELECT */
+
+#ifdef WL_BCNRECV
+static s32 wl_bcnrecv_aborted_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+               const wl_event_msg_t *e, void *data);
+#endif /* WL_BCNRECV */
+
+#ifdef WL_CAC_TS
+static s32 wl_cfg80211_cac_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+               const wl_event_msg_t *e, void *data);
+#endif /* WL_CAC_TS */
+
+#if defined(WL_MBO) || defined(WL_OCE)
+static s32 wl_bssid_prune_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+               const wl_event_msg_t *e, void *data);
+#endif /* WL_MBO || WL_OCE */
+
+static int bw2cap[] = { 0, 0, WLC_BW_CAP_20MHZ, WLC_BW_CAP_40MHZ, WLC_BW_CAP_80MHZ,
+       WLC_BW_CAP_160MHZ, WLC_BW_CAP_160MHZ };
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)) || (defined(CONFIG_ARCH_MSM) && \
+       defined(CFG80211_DISCONNECTED_V2))
+#define CFG80211_GET_BSS(wiphy, channel, bssid, ssid, ssid_len) \
+       cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, \
+                       IEEE80211_BSS_TYPE_ANY, IEEE80211_PRIVACY_ANY);
+#else
+#define CFG80211_GET_BSS(wiphy, channel, bssid, ssid, ssid_len) \
+       cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, \
+                       WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)) || \
+       defined(CFG80211_CONNECT_TIMEOUT_REASON_CODE) || defined(WL_FILS) || \
+       defined(CONFIG_CFG80211_FILS_BKPORT)
+#define CFG80211_CONNECT_RESULT(dev, bssid, bss, req_ie, req_ie_len, resp_ie, \
+               resp_ie_len, status, gfp) \
+       cfg80211_connect_bss(dev, bssid, bss, req_ie, req_ie_len, resp_ie, \
+               resp_ie_len, status, gfp, NL80211_TIMEOUT_UNSPECIFIED);
+#else
+#define CFG80211_CONNECT_RESULT(dev, bssid, bss, req_ie, req_ie_len, resp_ie, \
+               resp_ie_len, status, gfp) \
+       cfg80211_connect_bss(dev, bssid, bss, req_ie, req_ie_len, resp_ie, \
+               resp_ie_len, status, gfp);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0) || \
+       * (CFG80211_CONNECT_TIMEOUT_REASON_CODE) ||
+       * WL_FILS || CONFIG_CFG80211_FILS_BKPORT
+       */
+#elif defined(CFG80211_CONNECT_TIMEOUT_REASON_CODE)
+/* There are customer kernels with backported changes for
+ *  connect timeout. CFG80211_CONNECT_TIMEOUT_REASON_CODE define
+ * is available for kernels < 4.7 in such cases.
+ */
+#define CFG80211_CONNECT_RESULT(dev, bssid, bss, req_ie, req_ie_len, resp_ie, \
+               resp_ie_len, status, gfp) \
+       cfg80211_connect_bss(dev, bssid, bss, req_ie, req_ie_len, resp_ie, \
+               resp_ie_len, status, gfp, NL80211_TIMEOUT_UNSPECIFIED);
+#else
+/* Kernels < 4.7 doesn't support cfg80211_connect_bss */
+#define CFG80211_CONNECT_RESULT(dev, bssid, bss, req_ie, req_ie_len, resp_ie, \
+               resp_ie_len, status, gfp) \
+       cfg80211_connect_result(dev, bssid, req_ie, req_ie_len, resp_ie, \
+               resp_ie_len, status, gfp);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0) */
+
+#define IS_WPA_AKM(akm) ((akm) == RSN_AKM_NONE ||                      \
+                                (akm) == RSN_AKM_UNSPECIFIED ||        \
+                                (akm) == RSN_AKM_PSK)
+
+extern int dhd_wait_pend8021x(struct net_device *dev);
+#ifdef PROP_TXSTATUS_VSDB
+extern int disable_proptx;
+#endif /* PROP_TXSTATUS_VSDB */
+
+/* WAR: disable pm_bcnrx , scan_ps for BCM4354 WISOL module.
+* WISOL module have ANT_1 Rx sensitivity issue.
+*/
+#if defined(FORCE_DISABLE_SINGLECORE_SCAN)
+extern void dhd_force_disable_singlcore_scan(dhd_pub_t *dhd);
+#endif /* FORCE_DISABLE_SINGLECORE_SCAN */
+
+static s32
+wl_ap_start_ind(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+static s32
+wl_csa_complete_ind(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+static int
+wl_get_bandwidth_cap(struct net_device *ndev, uint32 band, uint32 *bandwidth);
+#ifdef SUPPORT_AP_BWCTRL
+static void
+wl_update_apchan_bwcap(struct bcm_cfg80211 *cfg, struct net_device *ndev, chanspec_t chanspec);
+static void
+wl_restore_ap_bw(struct bcm_cfg80211 *cfg);
+#endif /* SUPPORT_AP_BWCTRL */
+
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION (3, 5, 0)) && (LINUX_VERSION_CODE <= (3, 7, \
+       0)))
+struct chan_info {
+       int freq;
+       int chan_type;
+};
+#endif
+
+#define CH_TO_CHSPC(band, _channel) \
+       ((_channel | band) | WL_CHANSPEC_BW_20 | WL_CHANSPEC_CTL_SB_NONE)
+#define CHAN2G(_channel, _freq, _flags) {                      \
+       .band                   = IEEE80211_BAND_2GHZ,          \
+       .center_freq            = (_freq),                      \
+       .hw_value               = CH_TO_CHSPC(WL_CHANSPEC_BAND_2G, _channel),                   \
+       .flags                  = (_flags),                     \
+       .max_antenna_gain       = 0,                            \
+       .max_power              = 30,                           \
+}
+
+#define CHAN5G(_channel, _flags) {                             \
+       .band                   = IEEE80211_BAND_5GHZ,          \
+       .center_freq            = 5000 + (5 * (_channel)),      \
+       .hw_value               = CH_TO_CHSPC(WL_CHANSPEC_BAND_5G, _channel),                   \
+       .flags                  = (_flags),                     \
+       .max_antenna_gain       = 0,                            \
+       .max_power              = 30,                           \
+}
+
+#ifdef WL_6G_BAND
+#define CHAN6G(_channel, _flags) {                             \
+       .band                   = IEEE80211_BAND_5GHZ,          \
+       .center_freq            = 5940 + (5 * (_channel)),      \
+       .hw_value               = CH_TO_CHSPC(WL_CHANSPEC_BAND_6G, _channel),                   \
+       .flags                  = (_flags),                     \
+       .max_antenna_gain       = 0,                            \
+       .max_power              = 30,                           \
+}
+#endif /* WL_6G_BAND */
+
+#define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
+#define RATETAB_ENT(_rateid, _flags) \
+       {                                                               \
+               .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
+               .hw_value       = (_rateid),                        \
+               .flags    = (_flags),                        \
+       }
+
+static struct ieee80211_rate __wl_rates[] = {
+       RATETAB_ENT(DOT11_RATE_1M, 0),
+       RATETAB_ENT(DOT11_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
+       RATETAB_ENT(DOT11_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
+       RATETAB_ENT(DOT11_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
+       RATETAB_ENT(DOT11_RATE_6M, 0),
+       RATETAB_ENT(DOT11_RATE_9M, 0),
+       RATETAB_ENT(DOT11_RATE_12M, 0),
+       RATETAB_ENT(DOT11_RATE_18M, 0),
+       RATETAB_ENT(DOT11_RATE_24M, 0),
+       RATETAB_ENT(DOT11_RATE_36M, 0),
+       RATETAB_ENT(DOT11_RATE_48M, 0),
+       RATETAB_ENT(DOT11_RATE_54M, 0)
+};
+
+#define wl_a_rates             (__wl_rates + 4)
+#define wl_a_rates_size        8
+#define wl_g_rates             (__wl_rates + 0)
+#define wl_g_rates_size        12
+
+static struct ieee80211_channel __wl_2ghz_channels[] = {
+       CHAN2G(1, 2412, 0),
+       CHAN2G(2, 2417, 0),
+       CHAN2G(3, 2422, 0),
+       CHAN2G(4, 2427, 0),
+       CHAN2G(5, 2432, 0),
+       CHAN2G(6, 2437, 0),
+       CHAN2G(7, 2442, 0),
+       CHAN2G(8, 2447, 0),
+       CHAN2G(9, 2452, 0),
+       CHAN2G(10, 2457, 0),
+       CHAN2G(11, 2462, 0),
+       CHAN2G(12, 2467, 0),
+       CHAN2G(13, 2472, 0),
+       CHAN2G(14, 2484, 0)
+};
+
+static struct ieee80211_channel __wl_5ghz_a_channels[] = {
+       CHAN5G(34, 0), CHAN5G(36, 0),
+       CHAN5G(38, 0), CHAN5G(40, 0),
+       CHAN5G(42, 0), CHAN5G(44, 0),
+       CHAN5G(46, 0), CHAN5G(48, 0),
+       CHAN5G(52, 0), CHAN5G(56, 0),
+       CHAN5G(60, 0), CHAN5G(64, 0),
+       CHAN5G(100, 0), CHAN5G(104, 0),
+       CHAN5G(108, 0), CHAN5G(112, 0),
+       CHAN5G(116, 0), CHAN5G(120, 0),
+       CHAN5G(124, 0), CHAN5G(128, 0),
+       CHAN5G(132, 0), CHAN5G(136, 0),
+       CHAN5G(140, 0), CHAN5G(144, 0),
+       CHAN5G(149, 0), CHAN5G(153, 0),
+       CHAN5G(157, 0), CHAN5G(161, 0),
+       CHAN5G(165, 0),
+#ifdef WL_6G_BAND
+       /* 6GHz frequency starting 5945 */
+       CHAN6G(1, 0), CHAN6G(5, 0), CHAN6G(9, 0),
+       CHAN6G(13, 0), CHAN6G(17, 0),
+       CHAN6G(21, 0), CHAN6G(25, 0),
+       CHAN6G(29, 0), CHAN6G(33, 0),
+       CHAN6G(37, 0), CHAN6G(41, 0),
+       CHAN6G(45, 0), CHAN6G(49, 0),
+       CHAN6G(53, 0), CHAN6G(57, 0),
+       CHAN6G(61, 0), CHAN6G(65, 0),
+       CHAN6G(69, 0), CHAN6G(73, 0),
+       CHAN6G(77, 0), CHAN6G(81, 0),
+       CHAN6G(85, 0), CHAN6G(89, 0),
+       CHAN6G(93, 0), CHAN6G(97, 0),
+       CHAN6G(101, 0), CHAN6G(105, 0),
+       CHAN6G(109, 0), CHAN6G(113, 0),
+       CHAN6G(117, 0), CHAN6G(121, 0),
+       CHAN6G(125, 0), CHAN6G(129, 0),
+       CHAN6G(133, 0), CHAN6G(137, 0),
+       CHAN6G(141, 0), CHAN6G(145, 0),
+       CHAN6G(149, 0), CHAN6G(153, 0),
+       CHAN6G(157, 0), CHAN6G(161, 0),
+       CHAN6G(165, 0), CHAN6G(169, 0),
+       CHAN6G(173, 0), CHAN6G(177, 0),
+       CHAN6G(181, 0), CHAN6G(185, 0),
+       CHAN6G(189, 0), CHAN6G(193, 0),
+       CHAN6G(197, 0), CHAN6G(201, 0),
+       CHAN6G(205, 0), CHAN6G(209, 0),
+       CHAN6G(213, 0), CHAN6G(217, 0),
+       CHAN6G(221, 0), CHAN6G(225, 0),
+       CHAN6G(229, 0), CHAN6G(233, 0),
+
+       CHAN6G(3, 0), CHAN6G(11, 0),
+       CHAN6G(19, 0), CHAN6G(27, 0),
+       CHAN6G(35, 0), CHAN6G(43, 0),
+       CHAN6G(51, 0), CHAN6G(59, 0),
+       CHAN6G(67, 0), CHAN6G(75, 0),
+       CHAN6G(83, 0), CHAN6G(91, 0),
+       CHAN6G(99, 0), CHAN6G(107, 0),
+       CHAN6G(115, 0), CHAN6G(123, 0),
+       CHAN6G(131, 0), CHAN6G(139, 0),
+       CHAN6G(147, 0), CHAN6G(155, 0),
+       CHAN6G(163, 0), CHAN6G(171, 0),
+       CHAN6G(179, 0), CHAN6G(187, 0),
+       CHAN6G(195, 0), CHAN6G(203, 0),
+       CHAN6G(211, 0), CHAN6G(219, 0), CHAN6G(227, 0),
+
+       CHAN6G(7, 0), CHAN6G(23, 0),
+       CHAN6G(39, 0), CHAN6G(55, 0),
+       CHAN6G(71, 0), CHAN6G(87, 0),
+       CHAN6G(103, 0), CHAN6G(119, 0),
+       CHAN6G(135, 0), CHAN6G(151, 0),
+       CHAN6G(167, 0), CHAN6G(183, 0),
+       CHAN6G(199, 0), CHAN6G(215, 0),
+
+       CHAN6G(15, 0), CHAN6G(47, 0),
+       CHAN6G(79, 0), CHAN6G(111, 0),
+       CHAN6G(143, 0), CHAN6G(175, 0), CHAN6G(207, 0),
+#endif /* WL_6G_BAND */
+};
+
+static struct ieee80211_supported_band __wl_band_2ghz = {
+       .band = IEEE80211_BAND_2GHZ,
+       .channels = __wl_2ghz_channels,
+       .n_channels = ARRAY_SIZE(__wl_2ghz_channels),
+       .bitrates = wl_g_rates,
+       .n_bitrates = wl_g_rates_size
+};
+
+static struct ieee80211_supported_band __wl_band_5ghz_a = {
+       .band = IEEE80211_BAND_5GHZ,
+       .channels = __wl_5ghz_a_channels,
+       .n_channels = ARRAY_SIZE(__wl_5ghz_a_channels),
+       .bitrates = wl_a_rates,
+       .n_bitrates = wl_a_rates_size
+};
+
+static const u32 __wl_cipher_suites[] = {
+       WLAN_CIPHER_SUITE_WEP40,
+       WLAN_CIPHER_SUITE_WEP104,
+       WLAN_CIPHER_SUITE_TKIP,
+       WLAN_CIPHER_SUITE_CCMP,
+#ifdef MFP
+       /*
+        * Advertising AES_CMAC cipher suite to userspace would imply that we
+        * are supporting MFP. So advertise only when MFP support is enabled.
+        */
+       WLAN_CIPHER_SUITE_AES_CMAC,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0))
+       WLAN_CIPHER_SUITE_BIP_GMAC_256,
+       WLAN_CIPHER_SUITE_BIP_GMAC_128,
+       WLAN_CIPHER_SUITE_BIP_CMAC_256,
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0) */
+#endif /* MFP */
+
+#ifdef BCMWAPI_WPI
+       WLAN_CIPHER_SUITE_SMS4,
+#endif
+
+#if defined(WLAN_CIPHER_SUITE_PMK)
+       WLAN_CIPHER_SUITE_PMK,
+#endif /* WLAN_CIPHER_SUITE_PMK */
+#ifdef WL_GCMP
+       WLAN_CIPHER_SUITE_GCMP,
+       WLAN_CIPHER_SUITE_GCMP_256,
+       WLAN_CIPHER_SUITE_BIP_GMAC_128,
+       WLAN_CIPHER_SUITE_BIP_GMAC_256,
+#endif /* WL_GCMP */
+};
+
+#ifdef WL_SUPPORT_ACS
+/*
+ * The firmware code required for this feature to work is currently under
+ * BCMINTERNAL flag. In future if this is to enabled we need to bring the
+ * required firmware code out of the BCMINTERNAL flag.
+ */
+struct wl_dump_survey {
+       u32 obss;
+       u32 ibss;
+       u32 no_ctg;
+       u32 no_pckt;
+       u32 tx;
+       u32 idle;
+};
+#endif /* WL_SUPPORT_ACS */
+
+#ifdef WL_CFG80211_GON_COLLISION
+#define BLOCK_GON_REQ_MAX_NUM 5
+#endif /* WL_CFG80211_GON_COLLISION */
+
+#if defined(USE_DYNAMIC_MAXPKT_RXGLOM)
+static int maxrxpktglom = 0;
+#endif
+
+/* IOCtl version read from targeted driver */
+int ioctl_version;
+#ifdef DEBUGFS_CFG80211
+#define SUBLOGLEVEL 20
+#define SUBLOGLEVELZ ((SUBLOGLEVEL) + (1))
+static const struct {
+       u32 log_level;
+       char *sublogname;
+} sublogname_map[] = {
+       {WL_DBG_ERR, "ERR"},
+       {WL_DBG_INFO, "INFO"},
+       {WL_DBG_DBG, "DBG"},
+       {WL_DBG_SCAN, "SCAN"},
+       {WL_DBG_TRACE, "TRACE"},
+       {WL_DBG_P2P_ACTION, "P2PACTION"}
+};
+#endif
+
+typedef struct rsn_cipher_algo_entry {
+       u32 cipher_suite;
+       u32 wsec_algo;
+       u32 wsec_key_algo;
+} rsn_cipher_algo_entry_t;
+
+static const rsn_cipher_algo_entry_t rsn_cipher_algo_lookup_tbl[] = {
+       {WLAN_CIPHER_SUITE_WEP40, WEP_ENABLED, CRYPTO_ALGO_WEP1},
+       {WLAN_CIPHER_SUITE_WEP104, WEP_ENABLED, CRYPTO_ALGO_WEP128},
+       {WLAN_CIPHER_SUITE_TKIP, TKIP_ENABLED, CRYPTO_ALGO_TKIP},
+       {WLAN_CIPHER_SUITE_CCMP, AES_ENABLED, CRYPTO_ALGO_AES_CCM},
+       {WLAN_CIPHER_SUITE_AES_CMAC, AES_ENABLED, CRYPTO_ALGO_BIP},
+
+#ifdef BCMWAPI_WPI
+       {WLAN_CIPHER_SUITE_SMS4, SMS4_ENABLED, CRYPTO_ALGO_SMS4},
+#endif /* BCMWAPI_WPI */
+
+#ifdef WL_GCMP
+       {WLAN_CIPHER_SUITE_GCMP, AES_ENABLED, CRYPTO_ALGO_AES_GCM},
+       {WLAN_CIPHER_SUITE_GCMP_256, AES_ENABLED, CRYPTO_ALGO_AES_GCM256},
+       {WLAN_CIPHER_SUITE_BIP_GMAC_128, AES_ENABLED, CRYPTO_ALGO_BIP_GMAC},
+       {WLAN_CIPHER_SUITE_BIP_GMAC_256, AES_ENABLED, CRYPTO_ALGO_BIP_GMAC256},
+#endif /* WL_GCMP */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0))
+       {WLAN_CIPHER_SUITE_BIP_CMAC_256, AES_ENABLED, CRYPTO_ALGO_BIP_CMAC256},
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0) */
+};
+
+typedef struct rsn_akm_wpa_auth_entry {
+       u32 akm_suite;
+       u32 wpa_auth;
+} rsn_akm_wpa_auth_entry_t;
+
+static const rsn_akm_wpa_auth_entry_t rsn_akm_wpa_auth_lookup_tbl[] = {
+#ifdef WL_OWE
+       {WLAN_AKM_SUITE_OWE, WPA3_AUTH_OWE},
+#endif /* WL_OWE */
+       {WLAN_AKM_SUITE_8021X, WPA2_AUTH_UNSPECIFIED},
+       {WL_AKM_SUITE_SHA256_1X, WPA2_AUTH_1X_SHA256},
+       {WL_AKM_SUITE_SHA256_PSK, WPA2_AUTH_PSK_SHA256},
+       {WLAN_AKM_SUITE_PSK, WPA2_AUTH_PSK},
+       {WLAN_AKM_SUITE_FT_8021X, WPA2_AUTH_UNSPECIFIED | WPA2_AUTH_FT},
+       {WLAN_AKM_SUITE_FT_PSK, WPA2_AUTH_PSK | WPA2_AUTH_FT},
+       {WLAN_AKM_SUITE_FILS_SHA256, WPA2_AUTH_FILS_SHA256},
+       {WLAN_AKM_SUITE_FILS_SHA384, WPA2_AUTH_FILS_SHA384},
+       {WLAN_AKM_SUITE_8021X_SUITE_B, WPA3_AUTH_1X_SUITE_B_SHA256},
+       {WLAN_AKM_SUITE_8021X_SUITE_B_192, WPA3_AUTH_1X_SUITE_B_SHA384},
+
+#ifdef BCMWAPI_WPI
+       {WLAN_AKM_SUITE_WAPI_CERT, WAPI_AUTH_UNSPECIFIED},
+       {WLAN_AKM_SUITE_WAPI_PSK, WAPI_AUTH_PSK},
+#endif /* BCMWAPI_WPI */
+
+#if defined(WL_SAE) || defined(WL_CLIENT_SAE)
+       {WLAN_AKM_SUITE_SAE, WPA3_AUTH_SAE_PSK},
+#endif /* WL_SAE || WL_CLIENT_SAE */
+#ifdef WL_SAE_FT
+       {WLAN_AKM_SUITE_FT_OVER_SAE, WPA3_AUTH_SAE_PSK | WPA2_AUTH_FT},
+#endif /* WL_SAE_FT */
+       {WLAN_AKM_SUITE_DPP, WPA3_AUTH_DPP_AKM},
+       {WLAN_AKM_SUITE_FT_8021X_SHA384, WPA3_AUTH_1X_SUITE_B_SHA384 | WPA2_AUTH_FT}
+};
+
+#define BUFSZ 8
+#define BUFSZN BUFSZ + 1
+
+#define _S(x) #x
+#define S(x) _S(x)
+
+#define SOFT_AP_IF_NAME         "swlan0"
+
+/* watchdog timer for disconnecting when fw is not associated for FW_ASSOC_WATCHDOG_TIME ms */
+uint32 fw_assoc_watchdog_ms = 0;
+bool fw_assoc_watchdog_started = 0;
+#define FW_ASSOC_WATCHDOG_TIME 10 * 1000 /* msec */
+
+int wl_channel_to_frequency(u32 chan, chanspec_band_t band)
+{
+       if (chan == 0) {
+               return 0; /* not supported */
+       }
+       switch (band) {
+       case WL_CHANSPEC_BAND_2G:
+               if (chan == 14)
+                       return 2484;
+               else if (chan < 14)
+                       return 2407 + chan * 5;
+               break;
+       case WL_CHANSPEC_BAND_5G:
+               if (chan >= 182 && chan <= 196)
+                       return 4000 + chan * 5;
+               else
+                       return 5000 + chan * 5;
+               break;
+#ifdef WL_6G_BAND
+       case WL_CHANSPEC_BAND_6G:
+               return 5940 + chan * 5;
+               break;
+#endif /* WL_6G_BAND */
+       default:
+               WL_ERR(("Invalid Frequency Band\n"));
+       }
+       return 0; /* not supported */
+}
+
+static void wl_add_remove_pm_enable_work(struct bcm_cfg80211 *cfg,
+       enum wl_pm_workq_act_type type)
+{
+       u16 wq_duration = 0;
+
+       dhd_pub_t *dhd =  NULL;
+
+       if (cfg == NULL)
+               return;
+
+       dhd = (dhd_pub_t *)(cfg->pub);
+
+       mutex_lock(&cfg->pm_sync);
+       /*
+        * Make cancel and schedule work part mutually exclusive
+        * so that while cancelling, we are sure that there is no
+        * work getting scheduled.
+        */
+       if (delayed_work_pending(&cfg->pm_enable_work)) {
+               cancel_delayed_work(&cfg->pm_enable_work);
+
+               DHD_PM_WAKE_UNLOCK(cfg->pub);
+
+       }
+
+       if (type == WL_PM_WORKQ_SHORT) {
+               wq_duration = WL_PM_ENABLE_TIMEOUT;
+       } else if (type == WL_PM_WORKQ_LONG) {
+               wq_duration = (WL_PM_ENABLE_TIMEOUT*2);
+       }
+
+       /* It should schedule work item only if driver is up */
+
+       if (wq_duration && dhd->up) {
+
+               if (schedule_delayed_work(&cfg->pm_enable_work,
+                               msecs_to_jiffies((const unsigned int)wq_duration))) {
+
+                       DHD_PM_WAKE_LOCK_TIMEOUT(cfg->pub, wq_duration);
+
+               } else {
+                       WL_ERR(("Can't schedule pm work handler\n"));
+               }
+       }
+       mutex_unlock(&cfg->pm_sync);
+}
+
+/* Return a new chanspec given a legacy chanspec
+ * Returns INVCHANSPEC on error
+ */
+chanspec_t
+wl_chspec_from_legacy(chanspec_t legacy_chspec)
+{
+       chanspec_t chspec;
+
+       /* get the channel number */
+       chspec = LCHSPEC_CHANNEL(legacy_chspec);
+
+       /* convert the band */
+       if (LCHSPEC_IS2G(legacy_chspec)) {
+               chspec |= WL_CHANSPEC_BAND_2G;
+       } else {
+               chspec |= WL_CHANSPEC_BAND_5G;
+       }
+
+       /* convert the bw and sideband */
+       if (LCHSPEC_IS20(legacy_chspec)) {
+               chspec |= WL_CHANSPEC_BW_20;
+       } else {
+               chspec |= WL_CHANSPEC_BW_40;
+               if (LCHSPEC_CTL_SB(legacy_chspec) == WL_LCHANSPEC_CTL_SB_LOWER) {
+                       chspec |= WL_CHANSPEC_CTL_SB_L;
+               } else {
+                       chspec |= WL_CHANSPEC_CTL_SB_U;
+               }
+       }
+
+       if (wf_chspec_malformed(chspec)) {
+               WL_ERR(("wl_chspec_from_legacy: output chanspec (0x%04X) malformed\n",
+                       chspec));
+               return INVCHANSPEC;
+       }
+
+       return chspec;
+}
+
+/* Return a legacy chanspec given a new chanspec
+ * Returns INVCHANSPEC on error
+ */
+static chanspec_t
+wl_chspec_to_legacy(chanspec_t chspec)
+{
+       chanspec_t lchspec;
+
+       if (wf_chspec_malformed(chspec)) {
+               WL_ERR(("wl_chspec_to_legacy: input chanspec (0x%04X) malformed\n",
+                       chspec));
+               return INVCHANSPEC;
+       }
+
+       /* get the channel number */
+       lchspec = CHSPEC_CHANNEL(chspec);
+
+       /* convert the band */
+       if (CHSPEC_IS2G(chspec)) {
+               lchspec |= WL_LCHANSPEC_BAND_2G;
+       } else {
+               lchspec |= WL_LCHANSPEC_BAND_5G;
+       }
+
+       /* convert the bw and sideband */
+       if (CHSPEC_IS20(chspec)) {
+               lchspec |= WL_LCHANSPEC_BW_20;
+               lchspec |= WL_LCHANSPEC_CTL_SB_NONE;
+       } else if (CHSPEC_IS40(chspec)) {
+               lchspec |= WL_LCHANSPEC_BW_40;
+               if (CHSPEC_CTL_SB(chspec) == WL_CHANSPEC_CTL_SB_L) {
+                       lchspec |= WL_LCHANSPEC_CTL_SB_LOWER;
+               } else {
+                       lchspec |= WL_LCHANSPEC_CTL_SB_UPPER;
+               }
+       } else {
+               /* cannot express the bandwidth */
+               char chanbuf[CHANSPEC_STR_LEN];
+               WL_ERR((
+                       "wl_chspec_to_legacy: unable to convert chanspec %s (0x%04X) "
+                       "to pre-11ac format\n",
+                       wf_chspec_ntoa(chspec, chanbuf), chspec));
+               return INVCHANSPEC;
+       }
+
+       return lchspec;
+}
+
+bool wl_cfg80211_is_hal_started(struct bcm_cfg80211 *cfg)
+{
+       return cfg->hal_started;
+}
+
+/* given a chanspec value, do the endian and chanspec version conversion to
+ * a chanspec_t value
+ * Returns INVCHANSPEC on error
+ */
+chanspec_t
+wl_chspec_host_to_driver(chanspec_t chanspec)
+{
+       if (ioctl_version == 1) {
+               chanspec = wl_chspec_to_legacy(chanspec);
+               if (chanspec == INVCHANSPEC) {
+                       return chanspec;
+               }
+       }
+       chanspec = htodchanspec(chanspec);
+
+       return chanspec;
+}
+
+/* given a channel value, do the endian and chanspec version conversion to
+ * a chanspec_t value
+ * Returns INVCHANSPEC on error
+ */
+chanspec_t
+wl_ch_host_to_driver(u16 channel)
+{
+       chanspec_t chanspec;
+       chanspec_band_t band;
+
+       band = WL_CHANNEL_BAND(channel);
+
+       chanspec = wf_create_20MHz_chspec(channel, band);
+       if (chanspec == INVCHANSPEC) {
+               return chanspec;
+       }
+
+       return wl_chspec_host_to_driver(chanspec);
+}
+
+/* given a chanspec value from the driver, do the endian and chanspec version conversion to
+ * a chanspec_t value
+ * Returns INVCHANSPEC on error
+ */
+chanspec_t
+wl_chspec_driver_to_host(chanspec_t chanspec)
+{
+       chanspec = dtohchanspec(chanspec);
+       if (ioctl_version == 1) {
+               chanspec = wl_chspec_from_legacy(chanspec);
+       }
+
+       return chanspec;
+}
+
+/*
+ * convert ASCII string to MAC address (colon-delimited format)
+ * eg: 00:11:22:33:44:55
+ */
+int
+wl_cfg80211_ether_atoe(const char *a, struct ether_addr *n)
+{
+       char *c = NULL;
+       int count = 0;
+
+       bzero(n, ETHER_ADDR_LEN);
+       for (;;) {
+               n->octet[count++] = (uint8)simple_strtoul(a, &c, 16);
+               if (!*c++ || count == ETHER_ADDR_LEN)
+                       break;
+               a = c;
+       }
+       return (count == ETHER_ADDR_LEN);
+}
+
+/* There isn't a lot of sense in it, but you can transmit anything you like */
+static const struct ieee80211_txrx_stypes
+wl_cfg80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
+#ifdef WLMESH_CFG80211
+       [NL80211_IFTYPE_MESH_POINT] = {
+               .tx = 0xffff,
+               .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+               BIT(IEEE80211_STYPE_AUTH >> 4)
+       },
+#endif /* WLMESH_CFG80211 */
+       [NL80211_IFTYPE_ADHOC] = {
+               .tx = 0xffff,
+               .rx = BIT(IEEE80211_STYPE_ACTION >> 4)
+       },
+       [NL80211_IFTYPE_STATION] = {
+               .tx = 0xffff,
+               .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+               BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+#ifdef WL_CLIENT_SAE
+               | BIT(IEEE80211_STYPE_AUTH >> 4)
+#endif /* WL_CLIENT_SAE */
+       },
+       [NL80211_IFTYPE_AP] = {
+               .tx = 0xffff,
+               .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+               BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+               BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+               BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+               BIT(IEEE80211_STYPE_AUTH >> 4) |
+               BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+               BIT(IEEE80211_STYPE_ACTION >> 4)
+       },
+       [NL80211_IFTYPE_AP_VLAN] = {
+               /* copy AP */
+               .tx = 0xffff,
+               .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+               BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+               BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+               BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+               BIT(IEEE80211_STYPE_AUTH >> 4) |
+               BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+               BIT(IEEE80211_STYPE_ACTION >> 4)
+       },
+       [NL80211_IFTYPE_P2P_CLIENT] = {
+               .tx = 0xffff,
+               .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+               BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+       },
+       [NL80211_IFTYPE_P2P_GO] = {
+               .tx = 0xffff,
+               .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+               BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+               BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+               BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+               BIT(IEEE80211_STYPE_AUTH >> 4) |
+               BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+               BIT(IEEE80211_STYPE_ACTION >> 4)
+       },
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       [NL80211_IFTYPE_P2P_DEVICE] = {
+               .tx = 0xffff,
+               .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+               BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+       },
+#endif /* WL_CFG80211_P2P_DEV_IF */
+};
+
+static void swap_key_from_BE(struct wl_wsec_key *key)
+{
+       key->index = htod32(key->index);
+       key->len = htod32(key->len);
+       key->algo = htod32(key->algo);
+       key->flags = htod32(key->flags);
+       key->rxiv.hi = htod32(key->rxiv.hi);
+       key->rxiv.lo = htod16(key->rxiv.lo);
+       key->iv_initialized = htod32(key->iv_initialized);
+}
+
+static void swap_key_to_BE(struct wl_wsec_key *key)
+{
+       key->index = dtoh32(key->index);
+       key->len = dtoh32(key->len);
+       key->algo = dtoh32(key->algo);
+       key->flags = dtoh32(key->flags);
+       key->rxiv.hi = dtoh32(key->rxiv.hi);
+       key->rxiv.lo = dtoh16(key->rxiv.lo);
+       key->iv_initialized = dtoh32(key->iv_initialized);
+}
+
+#if defined(WL_FW_OCE_AP_SELECT)
+bool static wl_cfg80211_is_oce_ap(struct wiphy *wiphy, const u8 *bssid_hint)
+{
+       const u8 *parse = NULL;
+       bcm_tlv_t *ie;
+       const struct cfg80211_bss_ies *ies;
+       u32 len;
+       struct cfg80211_bss *bss;
+
+       bss = CFG80211_GET_BSS(wiphy, NULL, bssid_hint, 0, 0);
+       if (!bss) {
+               WL_ERR(("Unable to find AP in the cache"));
+               return false;
+       }
+
+       if (rcu_access_pointer(bss->ies)) {
+               ies = rcu_access_pointer(bss->ies);
+               parse = ies->data;
+               len = ies->len;
+       } else {
+               WL_ERR(("ies is NULL"));
+               return false;
+       }
+
+       while ((ie = bcm_parse_tlvs(parse, len, DOT11_MNG_VS_ID))) {
+               if (wl_cfgoce_is_oce_ie((const uint8*)ie, (u8 const **)&parse, &len) == TRUE) {
+                       return true;
+               } else {
+                       ie = bcm_next_tlv((const bcm_tlv_t*) ie, &len);
+                       if (!ie) {
+                               return false;
+                       }
+                       parse = (uint8 *)ie;
+                       WL_DBG(("NON OCE IE. next ie ptr:%p", parse));
+               }
+       }
+       WL_DBG(("OCE IE NOT found"));
+       return false;
+}
+#endif /* WL_FW_OCE_AP_SELECT */
+
+/* Dump the contents of the encoded wps ie buffer and get pbc value */
+static void
+wl_validate_wps_ie(const char *wps_ie, s32 wps_ie_len, bool *pbc)
+{
+       #define WPS_IE_FIXED_LEN 6
+       s16 len;
+       const u8 *subel = NULL;
+       u16 subelt_id;
+       u16 subelt_len;
+       u16 val;
+       u8 *valptr = (uint8*) &val;
+       if (wps_ie == NULL || wps_ie_len < WPS_IE_FIXED_LEN) {
+               WL_ERR(("invalid argument : NULL\n"));
+               return;
+       }
+       len = (s16)wps_ie[TLV_LEN_OFF];
+
+       if (len > wps_ie_len) {
+               WL_ERR(("invalid length len %d, wps ie len %d\n", len, wps_ie_len));
+               return;
+       }
+       WL_DBG(("wps_ie len=%d\n", len));
+       len -= 4;       /* for the WPS IE's OUI, oui_type fields */
+       subel = wps_ie + WPS_IE_FIXED_LEN;
+       while (len >= 4) {              /* must have attr id, attr len fields */
+               valptr[0] = *subel++;
+               valptr[1] = *subel++;
+               subelt_id = HTON16(val);
+
+               valptr[0] = *subel++;
+               valptr[1] = *subel++;
+               subelt_len = HTON16(val);
+
+               len -= 4;                       /* for the attr id, attr len fields */
+               len -= (s16)subelt_len; /* for the remaining fields in this attribute */
+               if (len < 0) {
+                       break;
+               }
+               WL_DBG((" subel=%p, subelt_id=0x%x subelt_len=%u\n",
+                       subel, subelt_id, subelt_len));
+
+               if (subelt_id == WPS_ID_VERSION) {
+                       WL_DBG(("  attr WPS_ID_VERSION: %u\n", *subel));
+               } else if (subelt_id == WPS_ID_REQ_TYPE) {
+                       WL_DBG(("  attr WPS_ID_REQ_TYPE: %u\n", *subel));
+               } else if (subelt_id == WPS_ID_CONFIG_METHODS) {
+                       valptr[0] = *subel;
+                       valptr[1] = *(subel + 1);
+                       WL_DBG(("  attr WPS_ID_CONFIG_METHODS: %x\n", HTON16(val)));
+               } else if (subelt_id == WPS_ID_DEVICE_NAME) {
+                       char devname[33];
+                       int namelen = MIN(subelt_len, (sizeof(devname) - 1));
+
+                       if (namelen) {
+                               memcpy(devname, subel, namelen);
+                               devname[namelen] = '\0';
+                               /* Printing len as rx'ed in the IE */
+                               WL_DBG(("  attr WPS_ID_DEVICE_NAME: %s (len %u)\n",
+                                       devname, subelt_len));
+                       }
+               } else if (subelt_id == WPS_ID_DEVICE_PWD_ID) {
+                       valptr[0] = *subel;
+                       valptr[1] = *(subel + 1);
+                       WL_DBG(("  attr WPS_ID_DEVICE_PWD_ID: %u\n", HTON16(val)));
+                       *pbc = (HTON16(val) == DEV_PW_PUSHBUTTON) ? true : false;
+               } else if (subelt_id == WPS_ID_PRIM_DEV_TYPE) {
+                       valptr[0] = *subel;
+                       valptr[1] = *(subel + 1);
+                       WL_DBG(("  attr WPS_ID_PRIM_DEV_TYPE: cat=%u \n", HTON16(val)));
+                       valptr[0] = *(subel + 6);
+                       valptr[1] = *(subel + 7);
+                       WL_DBG(("  attr WPS_ID_PRIM_DEV_TYPE: subcat=%u\n", HTON16(val)));
+               } else if (subelt_id == WPS_ID_REQ_DEV_TYPE) {
+                       valptr[0] = *subel;
+                       valptr[1] = *(subel + 1);
+                       WL_DBG(("  attr WPS_ID_REQ_DEV_TYPE: cat=%u\n", HTON16(val)));
+                       valptr[0] = *(subel + 6);
+                       valptr[1] = *(subel + 7);
+                       WL_DBG(("  attr WPS_ID_REQ_DEV_TYPE: subcat=%u\n", HTON16(val)));
+               } else if (subelt_id == WPS_ID_SELECTED_REGISTRAR_CONFIG_METHODS) {
+                       valptr[0] = *subel;
+                       valptr[1] = *(subel + 1);
+                       WL_DBG(("  attr WPS_ID_SELECTED_REGISTRAR_CONFIG_METHODS"
+                               ": cat=%u\n", HTON16(val)));
+               } else {
+                       WL_DBG(("  unknown attr 0x%x\n", subelt_id));
+               }
+
+               subel += subelt_len;
+       }
+}
+
+s32 wl_set_tx_power(struct net_device *dev,
+       enum nl80211_tx_power_setting type, s32 dbm)
+{
+       s32 err = 0;
+       s32 disable = 0;
+       s32 txpwrqdbm;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       /* Make sure radio is off or on as far as software is concerned */
+       disable = WL_RADIO_SW_DISABLE << 16;
+       disable = htod32(disable);
+       err = wldev_ioctl_set(dev, WLC_SET_RADIO, &disable, sizeof(disable));
+       if (unlikely(err)) {
+               WL_ERR(("WLC_SET_RADIO error (%d)\n", err));
+               return err;
+       }
+
+       if (dbm > 0xffff)
+               dbm = 0xffff;
+       txpwrqdbm = dbm * 4;
+#ifdef SUPPORT_WL_TXPOWER
+       if (type == NL80211_TX_POWER_AUTOMATIC)
+               txpwrqdbm = 127;
+       else
+               txpwrqdbm |= WL_TXPWR_OVERRIDE;
+#endif /* SUPPORT_WL_TXPOWER */
+       err = wldev_iovar_setbuf_bsscfg(dev, "qtxpower", (void *)&txpwrqdbm,
+               sizeof(txpwrqdbm), cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0,
+               &cfg->ioctl_buf_sync);
+       if (unlikely(err))
+               WL_ERR(("qtxpower error (%d)\n", err));
+       else
+               WL_ERR(("dBm=%d, txpwrqdbm=0x%x\n", dbm, txpwrqdbm));
+
+       return err;
+}
+
+s32 wl_get_tx_power(struct net_device *dev, s32 *dbm)
+{
+       s32 err = 0;
+       s32 txpwrdbm;
+       char ioctl_buf[WLC_IOCTL_SMLEN];
+
+       err = wldev_iovar_getbuf_bsscfg(dev, "qtxpower",
+               NULL, 0, ioctl_buf, WLC_IOCTL_SMLEN, 0, NULL);
+       if (unlikely(err)) {
+               WL_ERR(("error (%d)\n", err));
+               return err;
+       }
+
+       memcpy(&txpwrdbm, ioctl_buf, sizeof(txpwrdbm));
+       txpwrdbm = dtoh32(txpwrdbm);
+       *dbm = (txpwrdbm & ~WL_TXPWR_OVERRIDE) / 4;
+
+       WL_DBG(("dBm=%d, txpwrdbm=0x%x\n", *dbm, txpwrdbm));
+
+       return err;
+}
+
+static chanspec_t wl_cfg80211_get_shared_freq(struct wiphy *wiphy)
+{
+       chanspec_t chspec;
+       int cur_band, err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+       struct ether_addr bssid;
+       wl_bss_info_t *bss = NULL;
+       u16 channel = WL_P2P_TEMP_CHAN;
+       char *buf;
+
+       bzero(&bssid, sizeof(bssid));
+       if ((err = wldev_ioctl_get(dev, WLC_GET_BSSID, &bssid, sizeof(bssid)))) {
+               /* STA interface is not associated. So start the new interface on a temp
+                * channel . Later proper channel will be applied by the above framework
+                * via set_channel (cfg80211 API).
+                */
+               WL_DBG(("Not associated. Return a temp channel. \n"));
+               cur_band = 0;
+               err = wldev_ioctl_get(dev, WLC_GET_BAND, &cur_band, sizeof(int));
+               if (unlikely(err)) {
+                       WL_ERR(("Get band failed\n"));
+               } else if (cur_band == WLC_BAND_5G || cur_band == WLC_BAND_6G) {
+                       channel = WL_P2P_TEMP_CHAN_5G;
+               }
+               return wl_ch_host_to_driver(channel);
+       }
+
+       buf = (char *)MALLOCZ(cfg->osh, WL_EXTRA_BUF_MAX);
+       if (!buf) {
+               WL_ERR(("buf alloc failed. use temp channel\n"));
+               return wl_ch_host_to_driver(channel);
+       }
+
+       *(u32 *)buf = htod32(WL_EXTRA_BUF_MAX);
+       if ((err = wldev_ioctl_get(dev, WLC_GET_BSS_INFO, buf,
+               WL_EXTRA_BUF_MAX))) {
+                       WL_ERR(("Failed to get associated bss info, use temp channel \n"));
+                       chspec = wl_ch_host_to_driver(channel);
+       }
+       else {
+                       bss = (wl_bss_info_t *) (buf + 4);
+                       chspec =  bss->chanspec;
+#ifdef WL_6G_BAND
+                       /* Avoid p2p bring up in 6G based on bssinfo */
+                       if (CHSPEC_IS6G(chspec)) {
+                               channel = WL_P2P_TEMP_CHAN_5G;
+                               chspec = wl_ch_host_to_driver(channel);
+                       }
+#endif /* WL_6G_BAND */
+                       WL_DBG(("Valid BSS Found. chanspec:%d \n", chspec));
+       }
+
+       MFREE(cfg->osh, buf, WL_EXTRA_BUF_MAX);
+       return chspec;
+}
+
+static void
+wl_wlfc_enable(struct bcm_cfg80211 *cfg, bool enable)
+{
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO) || defined(BCMDBUS)
+       bool wlfc_enabled = FALSE;
+       s32 err, up =1;
+       dhd_pub_t *dhd;
+       struct net_device *primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       dhd = (dhd_pub_t *)(cfg->pub);
+       if (!dhd) {
+               return;
+       }
+
+       if (enable) {
+               if (!cfg->wlfc_on && !disable_proptx) {
+                       dhd_wlfc_get_enable(dhd, &wlfc_enabled);
+                       if (!wlfc_enabled && dhd->op_mode != DHD_FLAG_HOSTAP_MODE &&
+                               dhd->op_mode != DHD_FLAG_IBSS_MODE) {
+                               dhd_wlfc_init(dhd);
+                               err = wldev_ioctl_set(primary_ndev, WLC_UP, &up, sizeof(s32));
+                               if (err < 0)
+                                       WL_ERR(("WLC_UP return err:%d\n", err));
+                       }
+                       cfg->wlfc_on = true;
+                       WL_DBG(("wlfc_on:%d \n", cfg->wlfc_on));
+               }
+       } else if (dhd->conf->disable_proptx != 0){
+                       dhd_wlfc_deinit(dhd);
+                       cfg->wlfc_on = false;
+       }
+#endif /* BCMSDIO || BCMDBUS */
+#endif /* PROP_TXSTATUS_VSDB */
+}
+
+struct wireless_dev *
+wl_cfg80211_p2p_if_add(struct bcm_cfg80211 *cfg,
+       wl_iftype_t wl_iftype,
+       char const *name, u8 *mac_addr, s32 *ret_err)
+{
+       u16 chspec;
+       s16 cfg_type;
+       long timeout;
+       s32 err;
+       u16 p2p_iftype;
+       int dhd_mode;
+       struct net_device *new_ndev = NULL;
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       struct ether_addr *p2p_addr;
+
+       *ret_err = BCME_OK;
+       if (!cfg->p2p) {
+               WL_ERR(("p2p not initialized\n"));
+               return NULL;
+       }
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       if (wl_iftype == WL_IF_TYPE_P2P_DISC) {
+               /* Handle Dedicated P2P discovery Interface */
+               return wl_cfgp2p_add_p2p_disc_if(cfg);
+       }
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+       if (wl_iftype == WL_IF_TYPE_P2P_GO) {
+               p2p_iftype = WL_P2P_IF_GO;
+       } else {
+               p2p_iftype = WL_P2P_IF_CLIENT;
+       }
+
+       /* Dual p2p doesn't support multiple P2PGO interfaces,
+        * p2p_go_count is the counter for GO creation
+        * requests.
+        */
+       if ((cfg->p2p->p2p_go_count > 0) && (wl_iftype == WL_IF_TYPE_P2P_GO)) {
+               WL_ERR(("FW does not support multiple GO\n"));
+               *ret_err = -ENOTSUPP;
+               return NULL;
+       }
+       if (!cfg->p2p->on) {
+               p2p_on(cfg) = true;
+               wl_cfgp2p_set_firm_p2p(cfg);
+               wl_cfgp2p_init_discovery(cfg);
+       }
+
+       strlcpy(cfg->p2p->vir_ifname, name, sizeof(cfg->p2p->vir_ifname));
+       /* In concurrency case, STA may be already associated in a particular channel.
+        * so retrieve the current channel of primary interface and then start the virtual
+        * interface on that.
+        */
+        chspec = wl_cfg80211_get_shared_freq(wiphy);
+
+       /* For P2P mode, use P2P-specific driver features to create the
+        * bss: "cfg p2p_ifadd"
+        */
+       wl_set_p2p_status(cfg, IF_ADDING);
+       bzero(&cfg->if_event_info, sizeof(cfg->if_event_info));
+       cfg_type = wl_cfgp2p_get_conn_idx(cfg);
+       if (cfg_type == BCME_ERROR) {
+               wl_clr_p2p_status(cfg, IF_ADDING);
+               WL_ERR(("Failed to get connection idx for p2p interface\n"));
+               return NULL;
+       }
+
+       p2p_addr = wl_to_p2p_bss_macaddr(cfg, cfg_type);
+       memcpy(p2p_addr->octet, mac_addr, ETH_ALEN);
+
+       err = wl_cfgp2p_ifadd(cfg, p2p_addr,
+               htod32(p2p_iftype), chspec);
+       if (unlikely(err)) {
+               wl_clr_p2p_status(cfg, IF_ADDING);
+               WL_ERR((" virtual iface add failed (%d) \n", err));
+               return NULL;
+       }
+
+       /* Wait for WLC_E_IF event with IF_ADD opcode */
+       timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+               ((wl_get_p2p_status(cfg, IF_ADDING) == false) &&
+               (cfg->if_event_info.valid)),
+               msecs_to_jiffies(MAX_WAIT_TIME));
+       if (timeout > 0 && !wl_get_p2p_status(cfg, IF_ADDING) && cfg->if_event_info.valid) {
+               wl_if_event_info *event = &cfg->if_event_info;
+               new_ndev = wl_cfg80211_post_ifcreate(bcmcfg_to_prmry_ndev(cfg), event,
+                       event->mac, cfg->p2p->vir_ifname, false);
+               if (unlikely(!new_ndev)) {
+                       goto fail;
+               }
+
+               if (wl_iftype == WL_IF_TYPE_P2P_GO) {
+                       cfg->p2p->p2p_go_count++;
+               }
+               /* Fill p2p specific data */
+               wl_to_p2p_bss_ndev(cfg, cfg_type) = new_ndev;
+               wl_to_p2p_bss_bssidx(cfg, cfg_type) = event->bssidx;
+
+               WL_ERR((" virtual interface(%s) is "
+                       "created net attach done\n", cfg->p2p->vir_ifname));
+               dhd_mode = (wl_iftype == WL_IF_TYPE_P2P_GC) ?
+                       DHD_FLAG_P2P_GC_MODE : DHD_FLAG_P2P_GO_MODE;
+               DNGL_FUNC(dhd_cfg80211_set_p2p_info, (cfg, dhd_mode));
+                       /* reinitialize completion to clear previous count */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 13, 0))
+                       INIT_COMPLETION(cfg->iface_disable);
+#else
+                       init_completion(&cfg->iface_disable);
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3, 13, 0) */
+
+                       return new_ndev->ieee80211_ptr;
+       }
+
+fail:
+       return NULL;
+}
+
+bool
+wl_cfg80211_check_vif_in_use(struct net_device *ndev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       bool nan_enabled = FALSE;
+
+#ifdef WL_NAN
+       nan_enabled = wl_cfgnan_is_enabled(cfg);
+#endif /* WL_NAN */
+
+       if (nan_enabled || (wl_cfgp2p_vif_created(cfg)) ||
+               (dhd->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+               WL_MEM(("%s: Virtual interfaces in use. NAN %d P2P %d softAP %d\n",
+                       __FUNCTION__, nan_enabled, wl_cfgp2p_vif_created(cfg),
+                       (dhd->op_mode & DHD_FLAG_HOSTAP_MODE)));
+               return TRUE;
+       }
+
+       return FALSE;
+}
+
+void
+wl_cfg80211_iface_state_ops(struct wireless_dev *wdev,
+       wl_interface_state_t state,
+       wl_iftype_t wl_iftype, u16 wl_mode)
+{
+       struct net_device *ndev;
+       struct bcm_cfg80211 *cfg;
+       dhd_pub_t *dhd;
+       s32 bssidx;
+
+       WL_DBG(("state:%s wl_iftype:%d mode:%d\n",
+               wl_if_state_strs[state], wl_iftype, wl_mode));
+       if (!wdev) {
+               WL_ERR(("wdev null\n"));
+               return;
+       }
+
+       if ((wl_iftype == WL_IF_TYPE_P2P_DISC) || (wl_iftype == WL_IF_TYPE_NAN_NMI)) {
+               /* P2P discovery is a netless device and uses a
+                * hidden bsscfg interface in fw. Don't apply the
+                * iface ops state changes for p2p discovery I/F.
+                * NAN NMI is netless device and uses a hidden bsscfg interface in fw.
+                * Don't apply iface ops state changes for NMI I/F.
+                */
+               return;
+       }
+
+       cfg = wiphy_priv(wdev->wiphy);
+       ndev = wdev->netdev;
+       dhd = (dhd_pub_t *)(cfg->pub);
+
+       bssidx = wl_get_bssidx_by_wdev(cfg, wdev);
+       if (!ndev || (bssidx < 0)) {
+               WL_ERR(("ndev null. skip iface state ops\n"));
+               return;
+       }
+
+       switch (state) {
+               case WL_IF_CREATE_REQ:
+#ifdef WL_BCNRECV
+                       /* check fakeapscan in progress then abort */
+                       wl_android_bcnrecv_stop(ndev, WL_BCNRECV_CONCURRENCY);
+#endif /* WL_BCNRECV */
+                       wl_cfg80211_scan_abort(cfg);
+                       wl_wlfc_enable(cfg, true);
+#ifdef WLTDLS
+                       /* disable TDLS if number of connected interfaces is >= 1 */
+                       wl_cfg80211_tdls_config(cfg, TDLS_STATE_IF_CREATE, false);
+#endif /* WLTDLS */
+                       break;
+               case WL_IF_DELETE_REQ:
+#ifdef WL_WPS_SYNC
+                       wl_wps_handle_ifdel(ndev);
+#endif /* WPS_SYNC */
+                       if (wl_get_drv_status(cfg, SCANNING, ndev)) {
+                               /* Send completion for any pending scans */
+                               wl_cfg80211_cancel_scan(cfg);
+                       }
+
+#ifdef CUSTOM_SET_CPUCORE
+                       dhd->chan_isvht80 &= ~DHD_FLAG_P2P_MODE;
+                       if (!(dhd->chan_isvht80)) {
+                               dhd_set_cpucore(dhd, FALSE);
+                       }
+#endif /* CUSTOM_SET_CPUCORE */
+                        wl_add_remove_pm_enable_work(cfg, WL_PM_WORKQ_DEL);
+                       break;
+               case WL_IF_CREATE_DONE:
+                       if (wl_mode == WL_MODE_BSS) {
+                               /* Common code for sta type interfaces - STA, GC */
+                               /* Enable firmware key buffering before sent 4-way M4 */
+                               wldev_iovar_setint(ndev, "buf_key_b4_m4", 1);
+                       }
+                       if (wl_iftype == WL_IF_TYPE_P2P_GC) {
+                               /* Disable firmware roaming for P2P interface  */
+                               wldev_iovar_setint(ndev, "roam_off", 1);
+                               wldev_iovar_setint(ndev, "bcn_timeout", dhd->conf->bcn_timeout);
+                               {
+                                       int assoc_retry = 3;
+#if defined(CUSTOM_ASSOC_RETRY_MAX)
+                                       assoc_retry = CUSTOM_ASSOC_RETRY_MAX;
+#endif /* CUSTOM_ASSOC_RETRY_MAX */
+                                       /* set retry_max to CUSTOM_ASSOC_RETRY_MAX(3) */
+                                       wldev_iovar_setint(ndev, "assoc_retry_max", assoc_retry);
+                               }
+                       }
+                       if (wl_mode == WL_MODE_AP) {
+                               /* Common code for AP/GO */
+                       }
+                       break;
+               case WL_IF_DELETE_DONE:
+#ifdef WLTDLS
+                       /* Enable back TDLS if connected interface is <= 1 */
+                       wl_cfg80211_tdls_config(cfg, TDLS_STATE_IF_DELETE, false);
+#endif /* WLTDLS */
+                       wl_wlfc_enable(cfg, false);
+                       break;
+               case WL_IF_CHANGE_REQ:
+                       /* Flush existing IEs from firmware on role change */
+                       wl_cfg80211_clear_per_bss_ies(cfg, wdev);
+                       break;
+               case WL_IF_CHANGE_DONE:
+                       if (wl_mode == WL_MODE_BSS) {
+                               /* Enable buffering of PTK key till EAPOL 4/4 is sent out */
+                               wldev_iovar_setint(ndev, "buf_key_b4_m4", 1);
+                       }
+                       break;
+
+               default:
+                       WL_ERR(("Unsupported state: %d\n", state));
+                       return;
+       }
+}
+
+static s32
+wl_cfg80211_p2p_if_del(struct wiphy *wiphy, struct wireless_dev *wdev)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s16 bssidx;
+       s16 err;
+       s32 cfg_type;
+       struct net_device *ndev;
+       long timeout;
+       struct ether_addr p2p_dev_addr = {{0}};
+
+       if (unlikely(!wl_get_drv_status(cfg, READY, bcmcfg_to_prmry_ndev(cfg)))) {
+               WL_INFORM_MEM(("device is not ready\n"));
+               return BCME_NOTFOUND;
+       }
+
+#ifdef WL_CFG80211_P2P_DEV_IF
+       if (wdev->iftype == NL80211_IFTYPE_P2P_DEVICE) {
+               /* Handle dedicated P2P discovery interface. */
+               return wl_cfgp2p_del_p2p_disc_if(wdev, cfg);
+       }
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+       /* Handle P2P Group Interface */
+       bssidx = wl_get_bssidx_by_wdev(cfg, wdev);
+       if (bssidx <= 0) {
+               WL_ERR(("bssidx not found\n"));
+               return BCME_NOTFOUND;
+       }
+       if (wl_cfgp2p_find_type(cfg, bssidx, &cfg_type) != BCME_OK) {
+               /* Couldn't find matching iftype */
+               WL_MEM(("non P2P interface\n"));
+               return BCME_NOTFOUND;
+       }
+
+       ndev = wdev->netdev;
+       (void)memcpy_s(p2p_dev_addr.octet, ETHER_ADDR_LEN,
+               ndev->dev_addr, ETHER_ADDR_LEN);
+
+       wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+       wl_clr_p2p_status(cfg, IF_ADDING);
+
+       /* for GO */
+       if (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_AP) {
+               wl_add_remove_eventmsg(ndev, WLC_E_PROBREQ_MSG, false);
+               cfg->p2p->p2p_go_count--;
+               /* disable interface before bsscfg free */
+               err = wl_cfgp2p_ifdisable(cfg, &p2p_dev_addr);
+               /* if fw doesn't support "ifdis",
+                  do not wait for link down of ap mode
+                */
+               if (err == 0) {
+                       WL_ERR(("Wait for Link Down event for GO !!!\n"));
+                       wait_for_completion_timeout(&cfg->iface_disable,
+                               msecs_to_jiffies(500));
+               } else if (err != BCME_UNSUPPORTED) {
+                       msleep(300);
+               }
+       } else {
+               /* GC case */
+               if (wl_get_drv_status(cfg, DISCONNECTING, ndev)) {
+                       WL_ERR(("Wait for Link Down event for GC !\n"));
+                       wait_for_completion_timeout
+                                       (&cfg->iface_disable, msecs_to_jiffies(500));
+               }
+
+               /* Force P2P disconnect in iface down context */
+               if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+                       WL_INFORM_MEM(("force send disconnect event\n"));
+                       CFG80211_DISCONNECTED(ndev, 0, NULL, 0, false, GFP_KERNEL);
+                       wl_clr_drv_status(cfg, AUTHORIZED, ndev);
+               }
+       }
+
+       bzero(&cfg->if_event_info, sizeof(cfg->if_event_info));
+       wl_set_p2p_status(cfg, IF_DELETING);
+       DNGL_FUNC(dhd_cfg80211_clean_p2p_info, (cfg));
+
+       err = wl_cfgp2p_ifdel(cfg, &p2p_dev_addr);
+       if (unlikely(err)) {
+               WL_ERR(("P2P IFDEL operation failed, error code = %d\n", err));
+               err = BCME_ERROR;
+               goto fail;
+       } else {
+               /* Wait for WLC_E_IF event */
+               timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+                       ((wl_get_p2p_status(cfg, IF_DELETING) == false) &&
+                       (cfg->if_event_info.valid)),
+                       msecs_to_jiffies(MAX_WAIT_TIME));
+               if (timeout > 0 && !wl_get_p2p_status(cfg, IF_DELETING) &&
+                       cfg->if_event_info.valid) {
+                       WL_ERR(("P2P IFDEL operation done\n"));
+                       err = BCME_OK;
+               } else {
+                       WL_ERR(("IFDEL didn't complete properly\n"));
+                       err = -EINVAL;
+               }
+       }
+
+fail:
+       /* Even in failure case, attempt to remove the host data structure.
+        * Firmware would be cleaned up via WiFi reset done by the
+        * user space from hang event context (for android only).
+        */
+       bzero(cfg->p2p->vir_ifname, IFNAMSIZ);
+       wl_to_p2p_bss_bssidx(cfg, cfg_type) = -1;
+       wl_to_p2p_bss_ndev(cfg, cfg_type) = NULL;
+       wl_clr_drv_status(cfg, CONNECTED, wl_to_p2p_bss_ndev(cfg, cfg_type));
+       dhd_net_if_lock(ndev);
+       if (cfg->if_event_info.ifidx) {
+               /* Remove interface except for primary ifidx */
+               wl_cfg80211_remove_if(cfg, cfg->if_event_info.ifidx, ndev, FALSE);
+       }
+       dhd_net_if_unlock(ndev);
+       return err;
+}
+
+#ifdef WL_IFACE_MGMT
+/* Get active secondary data iface type */
+wl_iftype_t
+wl_cfg80211_get_sec_iface(struct bcm_cfg80211 *cfg)
+{
+#ifndef WL_STATIC_IF
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+#endif /* !WL_STATIC_IF */
+       struct net_device *p2p_ndev = NULL;
+
+       p2p_ndev = wl_to_p2p_bss_ndev(cfg,
+               P2PAPI_BSSCFG_CONNECTION1);
+
+#ifdef WL_STATIC_IF
+       if (IS_CFG80211_STATIC_IF_ACTIVE(cfg)) {
+               if (IS_AP_IFACE(cfg->static_ndev->ieee80211_ptr)) {
+                       return WL_IF_TYPE_AP;
+               }
+       }
+#else
+       if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+               return WL_IF_TYPE_AP;
+       }
+#endif /* WL_STATIC_IF */
+
+       if (p2p_ndev && p2p_ndev->ieee80211_ptr) {
+               if (p2p_ndev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) {
+                       return WL_IF_TYPE_P2P_GO;
+               }
+
+               /* Set role to GC when cfg80211 layer downgrades P2P
+                * role to station type while bringing down the interface
+                */
+               if (p2p_ndev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION) {
+                       WL_DBG_MEM(("%s, Change to GC base role\n", __FUNCTION__));
+                       return WL_IF_TYPE_P2P_GC;
+               }
+
+               if (p2p_ndev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_CLIENT) {
+                       return WL_IF_TYPE_P2P_GC;
+               }
+       }
+
+#ifdef WL_NAN
+       if (wl_cfgnan_is_dp_active(bcmcfg_to_prmry_ndev(cfg))) {
+               return WL_IF_TYPE_NAN;
+       }
+#endif /* WL_NAN */
+       return WL_IFACE_NOT_PRESENT;
+}
+
+/*
+* Handle incoming data interface request based on policy.
+* If there is any conflicting interface, that will be
+* deleted.
+*/
+s32
+wl_cfg80211_data_if_mgmt(struct bcm_cfg80211 *cfg,
+       wl_iftype_t new_wl_iftype)
+{
+       s32 ret = BCME_OK;
+       bool del_iface = false;
+       wl_iftype_t sec_wl_if_type = wl_cfg80211_get_sec_iface(cfg);
+
+       if (sec_wl_if_type == WL_IF_TYPE_NAN &&
+               new_wl_iftype == WL_IF_TYPE_NAN) {
+               /* Multi NDP is allowed irrespective of Policy */
+               return BCME_OK;
+       }
+
+       if (sec_wl_if_type == WL_IFACE_NOT_PRESENT) {
+               /*
+               * If there is no active secondary I/F, there
+               * is no interface conflict. Do nothing.
+               */
+               return BCME_OK;
+       }
+
+       /* Handle secondary data link case */
+       switch (cfg->iface_data.policy) {
+               case WL_IF_POLICY_CUSTOM:
+               case WL_IF_POLICY_DEFAULT: {
+                       WL_INFORM_MEM(("%s, Delete any existing iface\n", __FUNCTION__));
+                       del_iface = true;
+                       break;
+               }
+               case WL_IF_POLICY_FCFS: {
+                       WL_INFORM_MEM(("Found active iface = %s, can't support new iface = %s\n",
+                               wl_iftype_to_str(sec_wl_if_type), wl_iftype_to_str(new_wl_iftype)));
+                       ret = BCME_ERROR;
+                       break;
+               }
+               case WL_IF_POLICY_LP: {
+                       WL_INFORM_MEM(("Remove active sec data interface, allow incoming iface\n"));
+                       /* Delete existing data iface and allow incoming sec iface */
+                       del_iface = true;
+                       break;
+               }
+               case WL_IF_POLICY_ROLE_PRIORITY: {
+                       WL_INFORM_MEM(("Existing iface = %s (%d) and new iface = %s (%d)\n",
+                               wl_iftype_to_str(sec_wl_if_type),
+                               cfg->iface_data.priority[sec_wl_if_type],
+                               wl_iftype_to_str(new_wl_iftype),
+                               cfg->iface_data.priority[new_wl_iftype]));
+                       if (cfg->iface_data.priority[new_wl_iftype] >
+                               cfg->iface_data.priority[sec_wl_if_type]) {
+                               del_iface = true;
+                       } else {
+                               WL_ERR(("Can't support new iface = %s\n",
+                                       wl_iftype_to_str(new_wl_iftype)));
+                                       ret = BCME_ERROR;
+                       }
+                       break;
+               }
+               default: {
+                       WL_ERR(("Unsupported interface policy = %d\n",
+                               cfg->iface_data.policy));
+                       return BCME_ERROR;
+               }
+       }
+       if (del_iface) {
+               ret = wl_cfg80211_delete_iface(cfg, sec_wl_if_type);
+       }
+       return ret;
+}
+
+/* Handle discovery ifaces based on policy */
+s32
+wl_cfg80211_disc_if_mgmt(struct bcm_cfg80211 *cfg,
+       wl_iftype_t new_wl_iftype, bool *disable_nan, bool *disable_p2p)
+{
+       s32 ret = BCME_OK;
+       wl_iftype_t sec_wl_if_type =
+               wl_cfg80211_get_sec_iface(cfg);
+       *disable_p2p = false;
+       *disable_nan = false;
+
+       if (sec_wl_if_type == WL_IF_TYPE_NAN &&
+                       new_wl_iftype == WL_IF_TYPE_NAN) {
+               /* Multi NDP is allowed irrespective of Policy */
+               return BCME_OK;
+       }
+
+       /*
+       * Check for any policy conflicts with active secondary
+       * interface for incoming discovery iface
+       */
+       if ((sec_wl_if_type != WL_IFACE_NOT_PRESENT) &&
+               (is_discovery_iface(new_wl_iftype))) {
+               switch (cfg->iface_data.policy) {
+                       case WL_IF_POLICY_CUSTOM: {
+                               if (sec_wl_if_type == WL_IF_TYPE_NAN &&
+                                       new_wl_iftype == WL_IF_TYPE_P2P_DISC) {
+                                       WL_INFORM_MEM(("Allow P2P Discovery with active NDP\n"));
+                                       /* No further checks are required. */
+                                       return BCME_OK;
+                               }
+                               /*
+                               * Intentional fall through to default policy
+                               * as for AP and associated ifaces, both are same
+                               */
+                       }
+                       case WL_IF_POLICY_DEFAULT: {
+                                if (sec_wl_if_type == WL_IF_TYPE_AP) {
+                                       WL_INFORM_MEM(("AP is active, cant support new iface\n"));
+                                       ret = BCME_ERROR;
+                               } else if (sec_wl_if_type == WL_IF_TYPE_P2P_GC ||
+                                       sec_wl_if_type == WL_IF_TYPE_P2P_GO) {
+                                       if (new_wl_iftype == WL_IF_TYPE_P2P_DISC) {
+                                               /*
+                                               * Associated discovery case,
+                                               * Fall through
+                                               */
+                                       } else {
+                                               /* Active iface is present, returning error */
+                                               WL_INFORM_MEM(("P2P group is active,"
+                                                       " cant support new iface\n"));
+                                               ret = BCME_ERROR;
+                                       }
+                               } else if (sec_wl_if_type == WL_IF_TYPE_NAN) {
+                                       ret = wl_cfg80211_delete_iface(cfg, sec_wl_if_type);
+                               }
+                               break;
+                       }
+                       case WL_IF_POLICY_FCFS: {
+                               WL_INFORM_MEM(("Can't support new iface = %s\n",
+                                               wl_iftype_to_str(new_wl_iftype)));
+                               ret = BCME_ERROR;
+                               break;
+                       }
+                       case WL_IF_POLICY_LP: {
+                               /* Delete existing data iface n allow incoming sec iface */
+                               WL_INFORM_MEM(("Remove active sec data interface = %s\n",
+                                       wl_iftype_to_str(sec_wl_if_type)));
+                               ret = wl_cfg80211_delete_iface(cfg,
+                                               sec_wl_if_type);
+                               break;
+                       }
+                       case WL_IF_POLICY_ROLE_PRIORITY: {
+                               WL_INFORM_MEM(("Existing iface = %s (%d) and new iface = %s (%d)\n",
+                                       wl_iftype_to_str(sec_wl_if_type),
+                                       cfg->iface_data.priority[sec_wl_if_type],
+                                       wl_iftype_to_str(new_wl_iftype),
+                                       cfg->iface_data.priority[new_wl_iftype]));
+                               if (cfg->iface_data.priority[new_wl_iftype] >
+                                       cfg->iface_data.priority[sec_wl_if_type]) {
+                                       WL_INFORM_MEM(("Remove active sec data iface\n"));
+                                       ret = wl_cfg80211_delete_iface(cfg,
+                                               sec_wl_if_type);
+                               } else {
+                                       WL_ERR(("Can't support new iface = %s"
+                                               " due to low priority\n",
+                                               wl_iftype_to_str(new_wl_iftype)));
+                                               ret = BCME_ERROR;
+                               }
+                               break;
+                       }
+                       default: {
+                               WL_ERR(("Unsupported policy\n"));
+                               return BCME_ERROR;
+                       }
+               }
+       } else {
+               /*
+               * Handle incoming new secondary iface request,
+               * irrespective of existing discovery ifaces
+               */
+               if ((cfg->iface_data.policy == WL_IF_POLICY_CUSTOM) &&
+                       (new_wl_iftype == WL_IF_TYPE_NAN)) {
+                       WL_INFORM_MEM(("Allow NAN Data Path\n"));
+                       /* No further checks are required. */
+                       return BCME_OK;
+               }
+       }
+
+       /* Check for any conflicting discovery iface */
+       switch (new_wl_iftype) {
+               case WL_IF_TYPE_P2P_DISC:
+               case WL_IF_TYPE_P2P_GO:
+               case WL_IF_TYPE_P2P_GC: {
+                       *disable_nan = true;
+                       break;
+               }
+               case WL_IF_TYPE_NAN_NMI:
+               case WL_IF_TYPE_NAN: {
+                       *disable_p2p = true;
+                       break;
+               }
+               case WL_IF_TYPE_STA:
+               case WL_IF_TYPE_AP: {
+                       *disable_nan = true;
+                       *disable_p2p = true;
+                       break;
+               }
+               default: {
+                       WL_ERR(("Unsupported\n"));
+                       return BCME_ERROR;
+               }
+       }
+       return ret;
+}
+
+bool
+wl_cfg80211_is_associated_discovery(struct bcm_cfg80211 *cfg,
+       wl_iftype_t new_wl_iftype)
+{
+       struct net_device *p2p_ndev = NULL;
+       p2p_ndev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION1);
+
+       if (new_wl_iftype == WL_IF_TYPE_P2P_DISC && p2p_ndev &&
+               p2p_ndev->ieee80211_ptr &&
+               is_p2p_group_iface(p2p_ndev->ieee80211_ptr)) {
+                       return true;
+       }
+#ifdef WL_NAN
+       else if ((new_wl_iftype == WL_IF_TYPE_NAN_NMI) &&
+               (wl_cfgnan_is_dp_active(bcmcfg_to_prmry_ndev(cfg)))) {
+                       return true;
+               }
+#endif /* WL_NAN */
+       return false;
+}
+
+/* Handle incoming discovery iface request */
+s32
+wl_cfg80211_handle_discovery_config(struct bcm_cfg80211 *cfg,
+       wl_iftype_t new_wl_iftype)
+{
+       s32 ret = BCME_OK;
+       bool disable_p2p = false;
+       bool disable_nan = false;
+
+       wl_iftype_t active_sec_iface =
+               wl_cfg80211_get_sec_iface(cfg);
+
+       if (is_discovery_iface(new_wl_iftype) &&
+               (active_sec_iface != WL_IFACE_NOT_PRESENT)) {
+               if (wl_cfg80211_is_associated_discovery(cfg,
+                       new_wl_iftype) == TRUE) {
+                       WL_DBG(("Associate iface request is allowed= %s\n",
+                               wl_iftype_to_str(new_wl_iftype)));
+                       return ret;
+               }
+       }
+
+       ret = wl_cfg80211_disc_if_mgmt(cfg, new_wl_iftype,
+                       &disable_nan, &disable_p2p);
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed at disc iface mgmt, ret = %d\n", ret));
+               return ret;
+       }
+
+       if (disable_nan) {
+#ifdef WL_NAN
+               /* Disable nan to avoid conflict with p2p */
+               ret = wl_cfgnan_check_nan_disable_pending(cfg, true, true);
+               if (ret != BCME_OK) {
+                       WL_ERR(("failed to disable nan, error[%d]\n", ret));
+                       return ret;
+               }
+#endif /* WL_NAN */
+       }
+
+       if (disable_p2p) {
+               /* Disable p2p discovery */
+               ret = wl_cfg80211_deinit_p2p_discovery(cfg);
+               if (ret != BCME_OK) {
+                       /* Should we fail nan enab here */
+                       WL_ERR(("Failed to disable p2p_disc for allowing nan\n"));
+                       return ret;
+               }
+       }
+       return ret;
+}
+
+/*
+* Check for any conflicting iface before adding iface.
+* Based on policy, either conflicting iface is removed
+* or new iface add request is blocked.
+*/
+s32
+wl_cfg80211_handle_if_role_conflict(struct bcm_cfg80211 *cfg,
+       wl_iftype_t new_wl_iftype)
+{
+       s32 ret = BCME_OK;
+
+       WL_INFORM_MEM(("Incoming iface = %s\n", wl_iftype_to_str(new_wl_iftype)));
+
+       if (!is_discovery_iface(new_wl_iftype)) {
+               /* Incoming data interface request */
+               if (wl_cfg80211_get_sec_iface(cfg) != WL_IFACE_NOT_PRESENT) {
+                       /* active interface present - Apply interface data policy */
+                       ret = wl_cfg80211_data_if_mgmt(cfg, new_wl_iftype);
+                       if (ret != BCME_OK) {
+                               WL_ERR(("if_mgmt fail:%d\n", ret));
+                               return ret;
+                       }
+               }
+       }
+       /* Apply discovery config */
+       ret = wl_cfg80211_handle_discovery_config(cfg, new_wl_iftype);
+       return ret;
+}
+#endif /* WL_IFACE_MGMT */
+
+static struct wireless_dev *
+wl_cfg80211_add_monitor_if(struct wiphy *wiphy, const char *name)
+{
+#if defined(WL_ENABLE_P2P_IF) || defined(WL_CFG80211_P2P_DEV_IF)
+       WL_ERR(("wl_cfg80211_add_monitor_if: No more support monitor interface\n"));
+       return ERR_PTR(-EOPNOTSUPP);
+#else
+       struct wireless_dev *wdev;
+       struct net_device* ndev = NULL;
+
+       dhd_add_monitor(name, &ndev);
+
+       wdev = kzalloc(sizeof(*wdev), GFP_KERNEL);
+       if (!wdev) {
+               WL_ERR(("wireless_dev alloc failed! \n"));
+               goto fail;
+       }
+
+       wdev->wiphy = wiphy;
+       wdev->iftype = NL80211_IFTYPE_MONITOR;
+       ndev->ieee80211_ptr = wdev;
+       SET_NETDEV_DEV(ndev, wiphy_dev(wiphy));
+
+       WL_DBG(("wl_cfg80211_add_monitor_if net device returned: 0x%p\n", ndev));
+       return ndev->ieee80211_ptr;
+fail:
+       return ERR_PTR(-EOPNOTSUPP);
+#endif // endif
+}
+
+static struct wireless_dev *
+wl_cfg80211_add_ibss(struct wiphy *wiphy, u16 wl_iftype, char const *name)
+{
+#ifdef WLAIBSS_MCHAN
+       /* AIBSS */
+       return bcm_cfg80211_add_ibss_if(wiphy, (char *)name);
+#else
+       /* Normal IBSS */
+       WL_ERR(("IBSS not supported on Virtual iface\n"));
+       return NULL;
+#endif
+}
+
+s32
+wl_release_vif_macaddr(struct bcm_cfg80211 *cfg, u8 *mac_addr, u16 wl_iftype)
+{
+       struct net_device *ndev =  bcmcfg_to_prmry_ndev(cfg);
+       u16 org_toggle_bytes;
+       u16 cur_toggle_bytes;
+       u16 toggled_bit;
+
+       if (!ndev || !mac_addr || ETHER_ISNULLADDR(mac_addr)) {
+               return -EINVAL;
+       }
+       WL_DBG(("%s:Mac addr" MACDBG "\n",
+                       __FUNCTION__, MAC2STRDBG(mac_addr)));
+
+       if ((wl_iftype == WL_IF_TYPE_P2P_DISC) || (wl_iftype == WL_IF_TYPE_AP) ||
+               (wl_iftype == WL_IF_TYPE_P2P_GO) || (wl_iftype == WL_IF_TYPE_P2P_GC)) {
+               /* Avoid invoking release mac addr code for interfaces using
+                * fixed mac addr.
+                */
+               return BCME_OK;
+       }
+
+       /* Fetch last two bytes of mac address */
+       org_toggle_bytes = ntoh16(*((u16 *)&ndev->dev_addr[4]));
+       cur_toggle_bytes = ntoh16(*((u16 *)&mac_addr[4]));
+
+       toggled_bit = (org_toggle_bytes ^ cur_toggle_bytes);
+       WL_DBG(("org_toggle_bytes:%04X cur_toggle_bytes:%04X\n",
+               org_toggle_bytes, cur_toggle_bytes));
+       if (toggled_bit & cfg->vif_macaddr_mask) {
+               /* This toggled_bit is marked in the used mac addr
+                * mask. Clear it.
+                */
+               cfg->vif_macaddr_mask &= ~toggled_bit;
+               WL_INFORM(("MAC address - " MACDBG " released. toggled_bit:%04X vif_mask:%04X\n",
+                       MAC2STRDBG(mac_addr), toggled_bit, cfg->vif_macaddr_mask));
+       } else {
+               WL_ERR(("MAC address - " MACDBG " not found in the used list."
+                       " toggled_bit:%04x vif_mask:%04x\n", MAC2STRDBG(mac_addr),
+                       toggled_bit, cfg->vif_macaddr_mask));
+               return -EINVAL;
+       }
+
+       return BCME_OK;
+}
+
+s32
+wl_get_vif_macaddr(struct bcm_cfg80211 *cfg, u16 wl_iftype, u8 *mac_addr)
+{
+       struct ether_addr *p2p_dev_addr = wl_to_p2p_bss_macaddr(cfg, P2PAPI_BSSCFG_DEVICE);
+       struct net_device *ndev =  bcmcfg_to_prmry_ndev(cfg);
+       u16 toggle_mask;
+       u16 toggle_bit;
+       u16 toggle_bytes;
+       u16 used;
+       u32 offset = 0;
+       /* Toggle mask starts from MSB of second last byte */
+       u16 mask = 0x8000;
+       if (!mac_addr) {
+               return -EINVAL;
+       }
+       if ((wl_iftype == WL_IF_TYPE_P2P_DISC) && p2p_dev_addr &&
+               ETHER_IS_LOCALADDR(p2p_dev_addr)) {
+               /* If mac address is already generated return the mac */
+               (void)memcpy_s(mac_addr, ETH_ALEN, p2p_dev_addr->octet, ETH_ALEN);
+               return 0;
+       }
+       (void)memcpy_s(mac_addr, ETH_ALEN, ndev->perm_addr, ETH_ALEN);
+/*
+ * VIF MAC address managment
+ * P2P Device addres: Primary MAC with locally admin. bit set
+ * P2P Group address/NAN NMI/Softap/NAN DPI: Primary MAC addr
+ *    with local admin bit set and one additional bit toggled.
+ * cfg->vif_macaddr_mask will hold the info regarding the mac address
+ * released. Ensure to call wl_release_vif_macaddress to free up
+ * the mac address.
+ */
+#if defined(SPECIFIC_MAC_GEN_SCHEME)
+       if (wl_iftype == WL_IF_TYPE_P2P_DISC || wl_iftype == WL_IF_TYPE_AP) {
+               mac_addr[0] |= 0x02;
+       } else if ((wl_iftype == WL_IF_TYPE_P2P_GO) || (wl_iftype == WL_IF_TYPE_P2P_GC)) {
+               mac_addr[0] |= 0x02;
+               mac_addr[4] ^= 0x80;
+       }
+#else
+       if (wl_iftype == WL_IF_TYPE_P2P_DISC) {
+               mac_addr[0] |= 0x02;
+       }
+#endif /* SEPCIFIC_MAC_GEN_SCHEME */
+       else {
+               /* For locally administered mac addresses, we keep the
+                * OUI part constant and just work on the last two bytes.
+                */
+               mac_addr[0] |= 0x02;
+               toggle_mask = cfg->vif_macaddr_mask;
+               toggle_bytes = ntoh16(*((u16 *)&mac_addr[4]));
+               do {
+                       used = toggle_mask & mask;
+                       if (!used) {
+                               /* Use this bit position */
+                               toggle_bit = mask >> offset;
+                               toggle_bytes ^= toggle_bit;
+                               cfg->vif_macaddr_mask |= toggle_bit;
+                               WL_DBG(("toggle_bit:%04X toggle_bytes:%04X toggle_mask:%04X\n",
+                                       toggle_bit, toggle_bytes, cfg->vif_macaddr_mask));
+                               /* Macaddress are stored in network order */
+                               mac_addr[5] = *((u8 *)&toggle_bytes);
+                               mac_addr[4] = *(((u8 *)&toggle_bytes + 1));
+                               break;
+                       }
+
+                       /* Shift by one */
+                       toggle_mask = toggle_mask << 0x1;
+                       offset++;
+                       if (offset > MAX_VIF_OFFSET) {
+                               /* We have used up all macaddresses. Something wrong! */
+                               WL_ERR(("Entire range of macaddress used up.\n"));
+                               ASSERT(0);
+                               break;
+                       }
+               } while (true);
+       }
+       WL_INFORM_MEM(("Get virtual I/F mac addr: "MACDBG"\n", MAC2STRDBG(mac_addr)));
+       return 0;
+}
+#ifdef DNGL_AXI_ERROR_LOGGING
+static s32
+_wl_cfg80211_check_axi_error(struct bcm_cfg80211 *cfg)
+{
+       s32 ret = BCME_OK;
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       hnd_ext_trap_hdr_t *hdr;
+       int axi_host_error_size;
+       uint8 *new_dst;
+       uint32 *ext_data = dhd->extended_trap_data;
+       struct file *fp = NULL;
+       char *filename = DHD_COMMON_DUMP_PATH
+                        DHD_DUMP_AXI_ERROR_FILENAME
+                        DHD_DUMP_HAL_FILENAME_SUFFIX;
+
+       WL_ERR(("%s: starts to read %s. Axi error \n", __FUNCTION__, filename));
+
+       fp = filp_open(filename, O_RDONLY, 0);
+
+       if (IS_ERR(fp) || (fp == NULL)) {
+               WL_ERR(("%s: Couldn't read the file, err %ld,File [%s]  No previous axi error \n",
+                       __FUNCTION__, PTR_ERR(fp), filename));
+               return ret;
+       }
+
+       kernel_read_compat(fp, fp->f_pos, (char *)dhd->axi_err_dump, sizeof(dhd_axi_error_dump_t));
+       filp_close(fp, NULL);
+
+       /* Delete axi error info file */
+       if (dhd_file_delete(filename) < 0) {
+               WL_ERR(("%s(): Failed to delete file: %s\n", __FUNCTION__, filename));
+               return ret;
+       }
+       WL_ERR(("%s(): Success to delete file: %s\n", __FUNCTION__, filename));
+
+       if (dhd->axi_err_dump->etd_axi_error_v1.signature != HND_EXT_TRAP_AXIERROR_SIGNATURE) {
+               WL_ERR(("%s: Invalid AXI signature: 0x%x\n",
+               __FUNCTION__, dhd->axi_err_dump->etd_axi_error_v1.signature));
+       }
+
+       /* First word is original trap_data */
+       ext_data++;
+
+       /* Followed by the extended trap data header */
+       hdr = (hnd_ext_trap_hdr_t *)ext_data;
+       new_dst = hdr->data;
+
+       axi_host_error_size =  sizeof(dhd->axi_err_dump->axid)
+               + sizeof(dhd->axi_err_dump->fault_address);
+
+       /* TAG_TRAP_AXI_HOST_INFO tlv : host's axid, fault address */
+       new_dst = bcm_write_tlv(TAG_TRAP_AXI_HOST_INFO,
+                       (const void *)dhd->axi_err_dump,
+                       axi_host_error_size, new_dst);
+
+       /* TAG_TRAP_AXI_ERROR tlv */
+       new_dst = bcm_write_tlv(TAG_TRAP_AXI_ERROR,
+                       (const void *)&dhd->axi_err_dump->etd_axi_error_v1,
+                       sizeof(dhd->axi_err_dump->etd_axi_error_v1), new_dst);
+       hdr->len = new_dst - hdr->data;
+
+       dhd->dongle_trap_occured = TRUE;
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+       copy_hang_info_trap(dhd);
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+       memset(dhd->axi_err_dump, 0, sizeof(dhd_axi_error_dump_t));
+
+       dhd->hang_reason = HANG_REASON_DONGLE_TRAP;
+       net_os_send_hang_message(bcmcfg_to_prmry_ndev(cfg));
+       ret = BCME_ERROR;
+       return ret;
+}
+#endif /* DNGL_AXI_ERROR_LOGGING */
+
+/* All Android/Linux private/Vendor Interface calls should make
+ *  use of below API for interface creation.
+ */
+struct wireless_dev *
+wl_cfg80211_add_if(struct bcm_cfg80211 *cfg,
+       struct net_device *primary_ndev,
+       wl_iftype_t wl_iftype, const char *name, u8 *mac)
+{
+       u8 mac_addr[ETH_ALEN];
+       s32 err = -ENODEV;
+       struct wireless_dev *wdev = NULL;
+       struct wiphy *wiphy;
+       s32 wl_mode;
+       dhd_pub_t *dhd;
+       wl_iftype_t macaddr_iftype = wl_iftype;
+
+       WL_INFORM_MEM(("if name: %s, wl_iftype:%d \n",
+               name ? name : "NULL", wl_iftype));
+       if (!cfg || !primary_ndev || !name) {
+               WL_ERR(("cfg/ndev/name ptr null\n"));
+               return NULL;
+       }
+       if (wl_cfg80211_get_wdev_from_ifname(cfg, name)) {
+               WL_ERR(("Interface name %s exists!\n", name));
+               return NULL;
+       }
+
+       wiphy = bcmcfg_to_wiphy(cfg);
+       dhd = (dhd_pub_t *)(cfg->pub);
+       if (!dhd) {
+               return NULL;
+       }
+
+       if ((wl_mode = wl_iftype_to_mode(wl_iftype)) < 0) {
+               return NULL;
+       }
+       mutex_lock(&cfg->if_sync);
+#ifdef WL_NAN
+       if (wl_iftype == WL_IF_TYPE_NAN) {
+       /*
+       * Bypass the role conflict check for NDI and handle it
+       * from dp req and dp resp context
+       * because in aware comms, ndi gets created soon after nan enable.
+       */
+       } else
+#endif /* WL_NAN */
+#ifdef WL_IFACE_MGMT
+       if ((err = wl_cfg80211_handle_if_role_conflict(cfg, wl_iftype)) < 0) {
+               mutex_unlock(&cfg->if_sync);
+               return NULL;
+       }
+#endif /* WL_IFACE_MGMT */
+#ifdef DNGL_AXI_ERROR_LOGGING
+       /* Check the previous smmu fault error */
+       if ((err = _wl_cfg80211_check_axi_error(cfg)) < 0) {
+               mutex_unlock(&cfg->if_sync);
+               return NULL;
+       }
+#endif /* DNGL_AXI_ERROR_LOGGING */
+       /* Protect the interace op context */
+       /* Do pre-create ops */
+       wl_cfg80211_iface_state_ops(primary_ndev->ieee80211_ptr, WL_IF_CREATE_REQ,
+               wl_iftype, wl_mode);
+
+       if (strnicmp(name, SOFT_AP_IF_NAME, strlen(SOFT_AP_IF_NAME)) == 0) {
+               macaddr_iftype = WL_IF_TYPE_AP;
+       }
+
+       if (mac) {
+               /* If mac address is provided, use that */
+               memcpy(mac_addr, mac, ETH_ALEN);
+       } else if ((wl_get_vif_macaddr(cfg, macaddr_iftype, mac_addr) != BCME_OK)) {
+               /* Fetch the mac address to be used for virtual interface */
+               err = -EINVAL;
+               goto fail;
+       }
+
+       switch (wl_iftype) {
+               case WL_IF_TYPE_IBSS:
+                       wdev = wl_cfg80211_add_ibss(wiphy, wl_iftype, name);
+                       break;
+               case WL_IF_TYPE_MONITOR:
+                       wdev = wl_cfg80211_add_monitor_if(wiphy, name);
+                       break;
+               case WL_IF_TYPE_STA:
+               case WL_IF_TYPE_AP:
+               case WL_IF_TYPE_NAN:
+                       if (cfg->iface_cnt >= (IFACE_MAX_CNT - 1)) {
+                               WL_ERR(("iface_cnt exceeds max cnt. created iface_cnt: %d\n",
+                                       cfg->iface_cnt));
+                               err = -ENOTSUPP;
+                               goto fail;
+                       }
+                       wdev = wl_cfg80211_create_iface(cfg->wdev->wiphy,
+                               wl_iftype, mac_addr, name);
+                       break;
+               case WL_IF_TYPE_P2P_DISC:
+               case WL_IF_TYPE_P2P_GO:
+                       /* Intentional fall through */
+               case WL_IF_TYPE_P2P_GC:
+                       if (cfg->p2p_supported) {
+                               wdev = wl_cfg80211_p2p_if_add(cfg, wl_iftype,
+                                       name, mac_addr, &err);
+                               break;
+                       }
+                       /* Intentionally fall through for unsupported interface
+                        * handling when firmware doesn't support p2p
+                        */
+               default:
+                       WL_ERR(("Unsupported interface type\n"));
+                       err = -ENOTSUPP;
+                       goto fail;
+       }
+
+       if (!wdev) {
+               WL_ERR(("vif create failed. err:%d\n", err));
+               if (err != -ENOTSUPP) {
+                       err = -ENODEV;
+               }
+               goto fail;
+       }
+
+       /* Ensure decrementing in case of failure */
+       cfg->vif_count++;
+
+       wl_cfg80211_iface_state_ops(wdev,
+               WL_IF_CREATE_DONE, wl_iftype, wl_mode);
+
+       WL_INFORM_MEM(("Vif created. dev->ifindex:%d"
+               " cfg_iftype:%d, vif_count:%d\n",
+               (wdev->netdev ? wdev->netdev->ifindex : 0xff),
+               wdev->iftype, cfg->vif_count));
+       mutex_unlock(&cfg->if_sync);
+       return wdev;
+
+fail:
+       wl_cfg80211_iface_state_ops(primary_ndev->ieee80211_ptr,
+               WL_IF_DELETE_REQ, wl_iftype, wl_mode);
+
+       if (err != -ENOTSUPP) {
+               /* For non-supported interfaces, just return error and
+                * skip below recovery steps.
+                */
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+               wl_copy_hang_info_if_falure(primary_ndev, HANG_REASON_IFACE_DEL_FAILURE, err);
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+               SUPP_LOG(("IF_ADD fail. err:%d\n", err));
+               wl_flush_fw_log_buffer(primary_ndev, FW_LOGSET_MASK_ALL);
+               if (dhd_query_bus_erros(dhd)) {
+                       goto exit;
+               }
+               dhd->iface_op_failed = TRUE;
+#if defined(DHD_DEBUG) && defined(BCMPCIE) && defined(DHD_FW_COREDUMP)
+               if (dhd->memdump_enabled) {
+                       dhd->memdump_type = DUMP_TYPE_IFACE_OP_FAILURE;
+                       dhd_bus_mem_dump(dhd);
+               }
+#endif /* DHD_DEBUG && BCMPCIE && DHD_FW_COREDUMP */
+
+               /* If reached here, something wrong with DHD or firmware.
+                * There could be a chance that firmware is in bad state.
+                * Request the upper layer to do a Wi-Fi reset.
+                */
+               dhd->hang_reason = HANG_REASON_IFACE_ADD_FAILURE;
+               net_os_send_hang_message(bcmcfg_to_prmry_ndev(cfg));
+
+       }
+exit:
+       mutex_unlock(&cfg->if_sync);
+       return NULL;
+}
+
+static bcm_struct_cfgdev *
+wl_cfg80211_add_virtual_iface(struct wiphy *wiphy,
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       const char *name,
+#else
+       char *name,
+#endif /* WL_CFG80211_P2P_DEV_IF */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0))
+       unsigned char name_assign_type,
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)) */
+       enum nl80211_iftype type,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 12, 0))
+       u32 *flags,
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(4, 12, 0) */
+       struct vif_params *params)
+{
+       u16 wl_iftype;
+       u16 wl_mode;
+       struct net_device *primary_ndev;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct wireless_dev *wdev;
+
+       WL_DBG(("Enter iftype: %d\n", type));
+       if (!cfg) {
+               return ERR_PTR(-EINVAL);
+       }
+
+       /* Use primary I/F for sending cmds down to firmware */
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+       if (unlikely(!wl_get_drv_status(cfg, READY, primary_ndev))) {
+               WL_ERR(("device is not ready\n"));
+               return ERR_PTR(-ENODEV);
+       }
+
+       if (!name) {
+               WL_ERR(("Interface name not provided \n"));
+               return ERR_PTR(-EINVAL);
+       }
+
+       if (cfg80211_to_wl_iftype(type, &wl_iftype, &wl_mode) < 0) {
+               return ERR_PTR(-EINVAL);
+       }
+
+       wdev = wl_cfg80211_add_if(cfg, primary_ndev, wl_iftype, name, NULL);
+       if (unlikely(!wdev)) {
+               return ERR_PTR(-ENODEV);
+       }
+       return wdev_to_cfgdev(wdev);
+}
+
+static s32
+wl_cfg80211_del_ibss(struct wiphy *wiphy, struct wireless_dev *wdev)
+{
+       WL_INFORM_MEM(("del ibss wdev_ptr:%p\n", wdev));
+#ifdef WLAIBSS_MCHAN
+       /* AIBSS */
+       return bcm_cfg80211_del_ibss_if(wiphy, wdev);
+#else
+       /* Normal IBSS */
+       return wl_cfg80211_del_iface(wiphy, wdev);
+#endif
+}
+
+s32
+wl_cfg80211_del_if(struct bcm_cfg80211 *cfg, struct net_device *primary_ndev,
+       struct wireless_dev *wdev, char *ifname)
+{
+       int ret = BCME_OK;
+       mutex_lock(&cfg->if_sync);
+       ret = _wl_cfg80211_del_if(cfg, primary_ndev, wdev, ifname);
+       mutex_unlock(&cfg->if_sync);
+       return ret;
+}
+
+s32
+_wl_cfg80211_del_if(struct bcm_cfg80211 *cfg, struct net_device *primary_ndev,
+       struct wireless_dev *wdev, char *ifname)
+{
+       int ret = BCME_OK;
+       s32 bssidx;
+       struct wiphy *wiphy;
+       u16 wl_mode;
+       u16 wl_iftype;
+       struct net_info *netinfo;
+       dhd_pub_t *dhd;
+       BCM_REFERENCE(dhd);
+
+       if (!cfg) {
+               return -EINVAL;
+       }
+
+       dhd = (dhd_pub_t *)(cfg->pub);
+
+       if (!wdev && ifname) {
+               /* If only ifname is provided, fetch corresponding wdev ptr from our
+                * internal data structure
+                */
+               wdev = wl_cfg80211_get_wdev_from_ifname(cfg, ifname);
+       }
+
+       /* Check whether we have a valid wdev ptr */
+       if (unlikely(!wdev)) {
+               WL_ERR(("wdev not found. '%s' does not exists\n", ifname));
+               return -ENODEV;
+       }
+
+       WL_INFORM_MEM(("del vif. wdev cfg_iftype:%d\n", wdev->iftype));
+
+       wiphy = wdev->wiphy;
+#ifdef WL_CFG80211_P2P_DEV_IF
+       if (wdev->iftype == NL80211_IFTYPE_P2P_DEVICE) {
+               /* p2p discovery would be de-initialized in stop p2p
+                * device context/from other virtual i/f creation context
+                * so netinfo list may not have any node corresponding to
+                * discovery I/F. Handle it before bssidx check.
+                */
+               ret = wl_cfg80211_p2p_if_del(wiphy, wdev);
+               if (unlikely(ret)) {
+                       goto exit;
+               } else {
+                       /* success case. return from here */
+                       if (cfg->vif_count) {
+                               cfg->vif_count--;
+                       }
+                       return BCME_OK;
+               }
+       }
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+       if ((netinfo = wl_get_netinfo_by_wdev(cfg, wdev)) == NULL) {
+               WL_ERR(("Find netinfo from wdev %p failed\n", wdev));
+               ret = -ENODEV;
+               goto exit;
+       }
+
+       if (!wdev->netdev) {
+               WL_ERR(("ndev null! \n"));
+       } else {
+               /* Disable tx before del */
+               netif_tx_disable(wdev->netdev);
+       }
+
+       wl_iftype = netinfo->iftype;
+       wl_mode = wl_iftype_to_mode(wl_iftype);
+       bssidx = netinfo->bssidx;
+       WL_DBG_MEM(("[IFDEL] cfg_iftype:%d wl_iftype:%d mode:%d bssidx:%d\n",
+               wdev->iftype, wl_iftype, wl_mode, bssidx));
+
+       /* Do pre-interface del ops */
+       wl_cfg80211_iface_state_ops(wdev, WL_IF_DELETE_REQ, wl_iftype, wl_mode);
+
+#ifdef PCIE_FULL_DONGLE
+       /* clean up sta info & clean up flowrings correspondign to the iface */
+       dhd_net_del_flowrings_sta(dhd, wdev->netdev);
+#endif /* PCIE_FULL_DONGLE */
+
+       switch (wl_iftype) {
+               case WL_IF_TYPE_P2P_GO:
+               case WL_IF_TYPE_P2P_GC:
+               case WL_IF_TYPE_AP:
+               case WL_IF_TYPE_STA:
+               case WL_IF_TYPE_NAN:
+                       ret = wl_cfg80211_del_iface(wiphy, wdev);
+                       break;
+               case WL_IF_TYPE_IBSS:
+                       ret = wl_cfg80211_del_ibss(wiphy, wdev);
+                       break;
+
+               default:
+                       WL_ERR(("Unsupported interface type\n"));
+                       ret = BCME_ERROR;
+       }
+
+exit:
+       if (ret == BCME_OK) {
+               /* Successful case */
+               if (cfg->vif_count) {
+                       cfg->vif_count--;
+               }
+               wl_cfg80211_iface_state_ops(primary_ndev->ieee80211_ptr,
+                               WL_IF_DELETE_DONE, wl_iftype, wl_mode);
+#ifdef WL_NAN
+               if (!((cfg->nancfg->mac_rand) && (wl_iftype == WL_IF_TYPE_NAN)))
+#endif /* WL_NAN */
+               {
+                       wl_release_vif_macaddr(cfg, wdev->netdev->dev_addr, wl_iftype);
+               }
+               WL_INFORM_MEM(("vif deleted. vif_count:%d\n", cfg->vif_count));
+       } else {
+               if (!wdev->netdev) {
+                       WL_ERR(("ndev null! \n"));
+               } else {
+                       /* IF del failed. revert back tx queue status */
+                       netif_tx_start_all_queues(wdev->netdev);
+               }
+
+               /* Skip generating log files and sending HANG event
+                * if driver state is not READY
+                */
+               if (wl_get_drv_status(cfg, READY, bcmcfg_to_prmry_ndev(cfg))) {
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+                       wl_copy_hang_info_if_falure(primary_ndev,
+                               HANG_REASON_IFACE_DEL_FAILURE, ret);
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+                       SUPP_LOG(("IF_DEL fail. err:%d\n", ret));
+                       wl_flush_fw_log_buffer(primary_ndev, FW_LOGSET_MASK_ALL);
+                       /* IF dongle is down due to previous hang or other conditions, sending
+                       * one more hang notification is not needed.
+                       */
+                       if (dhd_query_bus_erros(dhd) || (ret == BCME_DONGLE_DOWN)) {
+                               goto end;
+                       }
+                       dhd->iface_op_failed = TRUE;
+#if defined(DHD_FW_COREDUMP)
+                       if (dhd->memdump_enabled && (ret != -EBADTYPE)) {
+                               dhd->memdump_type = DUMP_TYPE_IFACE_OP_FAILURE;
+                               dhd_bus_mem_dump(dhd);
+                       }
+#endif /* DHD_FW_COREDUMP */
+
+                       WL_ERR(("Notify hang event to upper layer \n"));
+                       dhd->hang_reason = HANG_REASON_IFACE_DEL_FAILURE;
+                       net_os_send_hang_message(bcmcfg_to_prmry_ndev(cfg));
+
+               }
+       }
+end:
+       return ret;
+}
+
+static s32
+wl_cfg80211_del_virtual_iface(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct wireless_dev *wdev = cfgdev_to_wdev(cfgdev);
+       int ret = BCME_OK;
+       u16 wl_iftype;
+       u16 wl_mode;
+       struct net_device *primary_ndev;
+
+       if (!cfg) {
+               return -EINVAL;
+       }
+
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+       wdev = cfgdev_to_wdev(cfgdev);
+       if (!wdev) {
+               WL_ERR(("wdev null"));
+               return -ENODEV;
+       }
+
+       WL_DBG(("Enter  wdev:%p iftype: %d\n", wdev, wdev->iftype));
+       if (cfg80211_to_wl_iftype(wdev->iftype, &wl_iftype, &wl_mode) < 0) {
+               WL_ERR(("Wrong iftype: %d\n", wdev->iftype));
+               return -ENODEV;
+       }
+
+       if ((ret = wl_cfg80211_del_if(cfg, primary_ndev,
+                       wdev, NULL)) < 0) {
+               WL_ERR(("IF del failed\n"));
+       }
+
+       return ret;
+}
+
+static s32
+wl_cfg80211_change_p2prole(struct wiphy *wiphy, struct net_device *ndev, enum nl80211_iftype type)
+{
+       s32 wlif_type;
+       s32 mode = 0;
+       s32 index;
+       s32 err;
+       s32 conn_idx = -1;
+       chanspec_t chspec;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct ether_addr p2p_dev_addr = {{0, 0, 0, 0, 0, 0}};
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+       WL_INFORM_MEM(("Enter. current_role:%d new_role:%d \n", ndev->ieee80211_ptr->iftype, type));
+
+       (void)memcpy_s(p2p_dev_addr.octet, ETHER_ADDR_LEN,
+               ndev->dev_addr, ETHER_ADDR_LEN);
+
+       if (!cfg->p2p || !wl_cfgp2p_vif_created(cfg)) {
+               WL_ERR(("P2P not initialized \n"));
+               return -EINVAL;
+       }
+
+       if (!is_p2p_group_iface(ndev->ieee80211_ptr)) {
+               WL_ERR(("Wrong if type \n"));
+               return -EINVAL;
+       }
+
+       /* Abort any on-going scans to avoid race condition issues */
+       wl_cfg80211_cancel_scan(cfg);
+
+       index = wl_get_bssidx_by_wdev(cfg, ndev->ieee80211_ptr);
+       if (index < 0) {
+               WL_ERR(("Find bsscfg index from ndev(%p) failed\n", ndev));
+               return BCME_ERROR;
+       }
+       if (wl_cfgp2p_find_type(cfg, index, &conn_idx) != BCME_OK) {
+               return BCME_ERROR;
+       }
+
+       /* In concurrency case, STA may be already associated in a particular
+        * channel. so retrieve the current channel of primary interface and
+        * then start the virtual interface on that.
+        */
+       chspec = wl_cfg80211_get_shared_freq(wiphy);
+       if (type == NL80211_IFTYPE_P2P_GO) {
+               /* Dual p2p doesn't support multiple P2PGO interfaces,
+                * p2p_go_count is the counter for GO creation
+                * requests.
+                */
+               if ((cfg->p2p->p2p_go_count > 0) && (type == NL80211_IFTYPE_P2P_GO)) {
+                       WL_ERR(("FW does not support multiple GO\n"));
+                       return BCME_ERROR;
+               }
+               mode = WL_MODE_AP;
+               wlif_type = WL_P2P_IF_GO;
+               dhd->op_mode &= ~DHD_FLAG_P2P_GC_MODE;
+               dhd->op_mode |= DHD_FLAG_P2P_GO_MODE;
+       } else {
+               wlif_type = WL_P2P_IF_CLIENT;
+               /* for GO */
+               if (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_AP) {
+                       WL_INFORM_MEM(("Downgrading P2P GO to cfg_iftype:%d \n", type));
+                       wl_add_remove_eventmsg(ndev, WLC_E_PROBREQ_MSG, false);
+                       cfg->p2p->p2p_go_count--;
+                       /* disable interface before bsscfg free */
+                       err = wl_cfgp2p_ifdisable(cfg, &p2p_dev_addr);
+                       /* if fw doesn't support "ifdis",
+                        * do not wait for link down of ap mode
+                        */
+                       if (err == 0) {
+                               WL_DBG(("Wait for Link Down event for GO !!!\n"));
+                               wait_for_completion_timeout(&cfg->iface_disable,
+                                       msecs_to_jiffies(500));
+                       } else if (err != BCME_UNSUPPORTED) {
+                               msleep(300);
+                       }
+               }
+       }
+
+       wl_set_p2p_status(cfg, IF_CHANGING);
+       wl_clr_p2p_status(cfg, IF_CHANGED);
+       wl_cfgp2p_ifchange(cfg, &p2p_dev_addr,
+               htod32(wlif_type), chspec, conn_idx);
+       wait_event_interruptible_timeout(cfg->netif_change_event,
+               (wl_get_p2p_status(cfg, IF_CHANGED) == true),
+               msecs_to_jiffies(MAX_WAIT_TIME));
+
+       wl_clr_p2p_status(cfg, IF_CHANGING);
+       wl_clr_p2p_status(cfg, IF_CHANGED);
+
+       if (mode == WL_MODE_AP) {
+               wl_set_drv_status(cfg, CONNECTED, ndev);
+       }
+
+       return BCME_OK;
+}
+
+static s32
+wl_cfg80211_change_virtual_iface(struct wiphy *wiphy, struct net_device *ndev,
+       enum nl80211_iftype type,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 12, 0))
+       u32 *flags,
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(4, 12, 0) */
+       struct vif_params *params)
+{
+       s32 infra = 1;
+       s32 err = BCME_OK;
+       u16 wl_iftype;
+       u16 wl_mode;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_info *netinfo = NULL;
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       struct net_device *primary_ndev;
+
+       if (!dhd)
+               return -EINVAL;
+
+       WL_INFORM_MEM(("[%s] Enter. current cfg_iftype:%d new cfg_iftype:%d \n",
+               ndev->name, ndev->ieee80211_ptr->iftype, type));
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       if (cfg80211_to_wl_iftype(type, &wl_iftype, &wl_mode) < 0) {
+               WL_ERR(("Unknown role \n"));
+               return -EINVAL;
+       }
+
+       mutex_lock(&cfg->if_sync);
+       netinfo = wl_get_netinfo_by_wdev(cfg, ndev->ieee80211_ptr);
+       if (unlikely(!netinfo)) {
+#ifdef WL_STATIC_IF
+               if (IS_CFG80211_STATIC_IF(cfg, ndev)) {
+                       /* Incase of static interfaces, the netinfo will be
+                        * allocated only when FW interface is initialized. So
+                        * store the value and use it during initialization.
+                        */
+                       WL_INFORM_MEM(("skip change vif for static if\n"));
+                       ndev->ieee80211_ptr->iftype = type;
+                       err = BCME_OK;
+               } else
+#endif /* WL_STATIC_IF */
+               {
+                       WL_ERR(("netinfo not found \n"));
+                       err = -ENODEV;
+               }
+               goto fail;
+       }
+
+       if ((primary_ndev == ndev) && !(ndev->flags & IFF_UP)) {
+               /*
+               * If interface is not initialized, store the role and
+               * return. The role will be initilized after interface
+               * up
+               */
+               WL_INFORM_MEM(("skip change role before dev up\n"));
+               ndev->ieee80211_ptr->iftype = type;
+               err = BCME_OK;
+               goto fail;
+       }
+
+       /* perform pre-if-change tasks */
+       wl_cfg80211_iface_state_ops(ndev->ieee80211_ptr,
+               WL_IF_CHANGE_REQ, wl_iftype, wl_mode);
+
+       switch (type) {
+       case NL80211_IFTYPE_ADHOC:
+               infra = 0;
+               break;
+       case NL80211_IFTYPE_STATION:
+               /* Supplicant sets iftype to STATION while removing p2p GO */
+               if (ndev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) {
+                       /* Downgrading P2P GO */
+                       err = wl_cfg80211_change_p2prole(wiphy, ndev, type);
+                       if (unlikely(err)) {
+                               WL_ERR(("P2P downgrade failed \n"));
+                       }
+               } else if (ndev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP) {
+                       /* Downgrade role from AP to STA */
+                       if ((err = wl_cfg80211_add_del_bss(cfg, ndev,
+                               netinfo->bssidx, wl_iftype, 0, NULL)) < 0) {
+                               WL_ERR(("AP-STA Downgrade failed \n"));
+                               goto fail;
+                       }
+               }
+               break;
+       case NL80211_IFTYPE_AP:
+               /* intentional fall through */
+       case NL80211_IFTYPE_AP_VLAN:
+               {
+                       if (!wl_get_drv_status(cfg, AP_CREATED, ndev) &&
+                                       wl_get_drv_status(cfg, READY, ndev)) {
+                               err = wl_cfg80211_set_ap_role(cfg, ndev);
+                               if (unlikely(err)) {
+                                       WL_ERR(("set ap role failed!\n"));
+                                       goto fail;
+                               }
+                       } else {
+                               WL_INFORM_MEM(("AP_CREATED bit set. Skip role change\n"));
+                       }
+                       break;
+               }
+       case NL80211_IFTYPE_P2P_GO:
+               /* Intentional fall through */
+       case NL80211_IFTYPE_P2P_CLIENT:
+               infra = 1;
+               err = wl_cfg80211_change_p2prole(wiphy, ndev, type);
+               break;
+       case NL80211_IFTYPE_MONITOR:
+       case NL80211_IFTYPE_WDS:
+       case NL80211_IFTYPE_MESH_POINT:
+               /* Intentional fall through */
+       default:
+               WL_ERR(("Unsupported type:%d \n", type));
+               err = -EINVAL;
+               goto fail;
+       }
+
+       if (wl_get_drv_status(cfg, READY, ndev)) {
+               err = wldev_ioctl_set(ndev, WLC_SET_INFRA, &infra, sizeof(s32));
+               if (err < 0) {
+                       WL_ERR(("SET INFRA/IBSS  error %d\n", err));
+                       goto fail;
+               }
+       }
+
+       wl_cfg80211_iface_state_ops(primary_ndev->ieee80211_ptr,
+               WL_IF_CHANGE_DONE, wl_iftype, wl_mode);
+
+       /* Update new iftype in relevant structures */
+       if (is_p2p_group_iface(ndev->ieee80211_ptr) && (type == NL80211_IFTYPE_STATION)) {
+               /* For role downgrade cases, we keep interface role as GC */
+               netinfo->iftype = WL_IF_TYPE_P2P_GC;
+               WL_DBG_MEM(("[%s] Set  base role to GC, current role"
+                       "ndev->ieee80211_ptr->iftype = %d\n",
+                       __FUNCTION__, ndev->ieee80211_ptr->iftype));
+       } else {
+               netinfo->iftype = wl_iftype;
+       }
+
+       ndev->ieee80211_ptr->iftype = type;
+
+       WL_INFORM_MEM(("[%s] cfg_iftype changed to %d\n", ndev->name, type));
+#ifdef WL_EXT_IAPSTA
+       wl_ext_iapsta_update_iftype(ndev, netinfo->ifidx, wl_iftype);
+#endif
+
+fail:
+       if (err) {
+               wl_flush_fw_log_buffer(ndev, FW_LOGSET_MASK_ALL);
+       }
+       mutex_unlock(&cfg->if_sync);
+       return err;
+}
+
+s32
+wl_cfg80211_notify_ifadd(struct net_device *dev,
+       int ifidx, char *name, uint8 *mac, uint8 bssidx, uint8 role)
+{
+       bool ifadd_expected = FALSE;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       bool bss_pending_op = TRUE;
+
+       /* P2P may send WLC_E_IF_ADD and/or WLC_E_IF_CHANGE during IF updating ("p2p_ifupd")
+        * redirect the IF_ADD event to ifchange as it is not a real "new" interface
+        */
+       if (wl_get_p2p_status(cfg, IF_CHANGING))
+               return wl_cfg80211_notify_ifchange(dev, ifidx, name, mac, bssidx);
+
+       /* Okay, we are expecting IF_ADD (as IF_ADDING is true) */
+       if (wl_get_p2p_status(cfg, IF_ADDING)) {
+               ifadd_expected = TRUE;
+               wl_clr_p2p_status(cfg, IF_ADDING);
+       } else if (cfg->bss_pending_op) {
+               ifadd_expected = TRUE;
+               bss_pending_op = FALSE;
+       }
+
+       if (ifadd_expected) {
+               wl_if_event_info *if_event_info = &cfg->if_event_info;
+
+               if_event_info->valid = TRUE;
+               if_event_info->ifidx = ifidx;
+               if_event_info->bssidx = bssidx;
+               if_event_info->role = role;
+               strlcpy(if_event_info->name, name, sizeof(if_event_info->name));
+               if_event_info->name[IFNAMSIZ - 1] = '\0';
+               if (mac)
+                       memcpy(if_event_info->mac, mac, ETHER_ADDR_LEN);
+
+               /* Update bss pendig operation status */
+               if (!bss_pending_op) {
+                       cfg->bss_pending_op = FALSE;
+               }
+               WL_INFORM_MEM(("IF_ADD ifidx:%d bssidx:%d role:%d\n",
+                       ifidx, bssidx, role));
+               OSL_SMP_WMB();
+               wake_up_interruptible(&cfg->netif_change_event);
+               return BCME_OK;
+       }
+
+       return BCME_ERROR;
+}
+
+s32
+wl_cfg80211_notify_ifdel(struct net_device *dev, int ifidx, char *name, uint8 *mac, uint8 bssidx)
+{
+       bool ifdel_expected = FALSE;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       wl_if_event_info *if_event_info = &cfg->if_event_info;
+       bool bss_pending_op = TRUE;
+
+       if (wl_get_p2p_status(cfg, IF_DELETING)) {
+               ifdel_expected = TRUE;
+               wl_clr_p2p_status(cfg, IF_DELETING);
+       } else if (cfg->bss_pending_op) {
+               ifdel_expected = TRUE;
+               bss_pending_op = FALSE;
+       }
+
+       if (ifdel_expected) {
+               if_event_info->valid = TRUE;
+               if_event_info->ifidx = ifidx;
+               if_event_info->bssidx = bssidx;
+               /* Update bss pendig operation status */
+               if (!bss_pending_op) {
+                       cfg->bss_pending_op = FALSE;
+               }
+               WL_INFORM_MEM(("IF_DEL ifidx:%d bssidx:%d\n", ifidx, bssidx));
+               OSL_SMP_WMB();
+               wake_up_interruptible(&cfg->netif_change_event);
+               return BCME_OK;
+       }
+
+       return BCME_ERROR;
+}
+
+s32
+wl_cfg80211_notify_ifchange(struct net_device * dev, int ifidx, char *name, uint8 *mac,
+       uint8 bssidx)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       if (wl_get_p2p_status(cfg, IF_CHANGING)) {
+               wl_set_p2p_status(cfg, IF_CHANGED);
+               OSL_SMP_WMB();
+               wake_up_interruptible(&cfg->netif_change_event);
+               return BCME_OK;
+       }
+
+       return BCME_ERROR;
+}
+
+static s32 wl_set_rts(struct net_device *dev, u32 rts_threshold)
+{
+       s32 err = 0;
+
+       err = wldev_iovar_setint(dev, "rtsthresh", rts_threshold);
+       if (unlikely(err)) {
+               WL_ERR(("Error (%d)\n", err));
+               return err;
+       }
+       return err;
+}
+
+static s32 wl_set_frag(struct net_device *dev, u32 frag_threshold)
+{
+       s32 err = 0;
+
+       err = wldev_iovar_setint_bsscfg(dev, "fragthresh", frag_threshold, 0);
+       if (unlikely(err)) {
+               WL_ERR(("Error (%d)\n", err));
+               return err;
+       }
+       return err;
+}
+
+static s32 wl_set_retry(struct net_device *dev, u32 retry, bool l)
+{
+       s32 err = 0;
+       u32 cmd = (l ? WLC_SET_LRL : WLC_SET_SRL);
+
+#ifdef CUSTOM_LONG_RETRY_LIMIT
+       if ((cmd == WLC_SET_LRL) &&
+               (retry != CUSTOM_LONG_RETRY_LIMIT)) {
+               WL_DBG(("CUSTOM_LONG_RETRY_LIMIT is used.Ignore configuration"));
+               return err;
+       }
+#endif /* CUSTOM_LONG_RETRY_LIMIT */
+
+       retry = htod32(retry);
+       err = wldev_ioctl_set(dev, cmd, &retry, sizeof(retry));
+       if (unlikely(err)) {
+               WL_ERR(("cmd (%d) , error (%d)\n", cmd, err));
+               return err;
+       }
+       return err;
+}
+
+static s32 wl_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
+{
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)wiphy_priv(wiphy);
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       s32 err = 0;
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+       WL_DBG(("Enter\n"));
+       if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
+               (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
+               cfg->conf->rts_threshold = wiphy->rts_threshold;
+               err = wl_set_rts(ndev, cfg->conf->rts_threshold);
+               if (err != BCME_OK)
+                       return err;
+       }
+       if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
+               (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
+               cfg->conf->frag_threshold = wiphy->frag_threshold;
+               err = wl_set_frag(ndev, cfg->conf->frag_threshold);
+               if (err != BCME_OK)
+                       return err;
+       }
+       if (changed & WIPHY_PARAM_RETRY_LONG &&
+               (cfg->conf->retry_long != wiphy->retry_long)) {
+               cfg->conf->retry_long = wiphy->retry_long;
+               err = wl_set_retry(ndev, cfg->conf->retry_long, true);
+               if (err != BCME_OK)
+                       return err;
+       }
+       if (changed & WIPHY_PARAM_RETRY_SHORT &&
+               (cfg->conf->retry_short != wiphy->retry_short)) {
+               cfg->conf->retry_short = wiphy->retry_short;
+               err = wl_set_retry(ndev, cfg->conf->retry_short, false);
+               if (err != BCME_OK) {
+                       return err;
+               }
+       }
+
+       return err;
+}
+
+chanspec_t
+wl_channel_to_chanspec(struct wiphy *wiphy, struct net_device *dev, u32 channel, u32 bw_cap)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       u8 *buf = NULL;
+       wl_uint32_list_t *list;
+       int err = BCME_OK;
+       chanspec_t c = 0, ret_c = 0;
+       int bw = 0, tmp_bw = 0;
+       int i;
+       u32 tmp_c;
+
+#define LOCAL_BUF_SIZE 1024
+       buf = (u8 *)MALLOC(cfg->osh, LOCAL_BUF_SIZE);
+       if (!buf) {
+               WL_ERR(("buf memory alloc failed\n"));
+               goto exit;
+       }
+
+       err = wldev_iovar_getbuf_bsscfg(dev, "chanspecs", NULL,
+               0, buf, LOCAL_BUF_SIZE, 0, &cfg->ioctl_buf_sync);
+       if (err != BCME_OK) {
+               WL_ERR(("get chanspecs failed with %d\n", err));
+               goto exit;
+       }
+
+       list = (wl_uint32_list_t *)(void *)buf;
+       for (i = 0; i < dtoh32(list->count); i++) {
+               c = dtoh32(list->element[i]);
+               if (channel <= CH_MAX_2G_CHANNEL) {
+                       if (!CHSPEC_IS20(c))
+                               continue;
+                       if (channel == CHSPEC_CHANNEL(c)) {
+                               ret_c = c;
+                               bw = 20;
+                               goto exit;
+                       }
+               }
+               tmp_c = wf_chspec_ctlchan(c);
+               tmp_bw = bw2cap[CHSPEC_BW(c) >> WL_CHANSPEC_BW_SHIFT];
+               if (tmp_c != channel)
+                       continue;
+
+               if ((tmp_bw > bw) && (tmp_bw <= bw_cap)) {
+                       bw = tmp_bw;
+                       ret_c = c;
+                       if (bw == bw_cap)
+                               goto exit;
+               }
+       }
+exit:
+       if (buf) {
+                MFREE(cfg->osh, buf, LOCAL_BUF_SIZE);
+       }
+#undef LOCAL_BUF_SIZE
+       WL_DBG(("return chanspec %x %d\n", ret_c, bw));
+       return ret_c;
+}
+
+void
+wl_cfg80211_ibss_vsie_set_buffer(struct net_device *dev, vndr_ie_setbuf_t *ibss_vsie,
+       int ibss_vsie_len)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       if (cfg != NULL && ibss_vsie != NULL) {
+               if (cfg->ibss_vsie != NULL) {
+                       MFREE(cfg->osh, cfg->ibss_vsie, cfg->ibss_vsie_len);
+               }
+               cfg->ibss_vsie = ibss_vsie;
+               cfg->ibss_vsie_len = ibss_vsie_len;
+       }
+}
+
+static void
+wl_cfg80211_ibss_vsie_free(struct bcm_cfg80211 *cfg)
+{
+       /* free & initiralize VSIE (Vendor Specific IE) */
+       if (cfg->ibss_vsie != NULL) {
+               MFREE(cfg->osh, cfg->ibss_vsie, cfg->ibss_vsie_len);
+               cfg->ibss_vsie_len = 0;
+       }
+}
+
+s32
+wl_cfg80211_ibss_vsie_delete(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       char *ioctl_buf = NULL;
+       s32 ret = BCME_OK, bssidx;
+
+       if (cfg != NULL && cfg->ibss_vsie != NULL) {
+               ioctl_buf = (char *)MALLOC(cfg->osh, WLC_IOCTL_MEDLEN);
+               if (!ioctl_buf) {
+                       WL_ERR(("ioctl memory alloc failed\n"));
+                       return -ENOMEM;
+               }
+               if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+                       WL_ERR(("Find index failed\n"));
+                       ret = BCME_ERROR;
+                       goto end;
+               }
+               /* change the command from "add" to "del" */
+               strlcpy(cfg->ibss_vsie->cmd, "del", sizeof(cfg->ibss_vsie->cmd));
+
+               ret = wldev_iovar_setbuf_bsscfg(dev, "vndr_ie",
+                               cfg->ibss_vsie, cfg->ibss_vsie_len,
+                               ioctl_buf, WLC_IOCTL_MEDLEN, bssidx, NULL);
+               WL_ERR(("ret=%d\n", ret));
+
+               if (ret == BCME_OK) {
+                       /* Free & initialize VSIE */
+                       MFREE(cfg->osh, cfg->ibss_vsie, cfg->ibss_vsie_len);
+                       cfg->ibss_vsie_len = 0;
+               }
+end:
+               if (ioctl_buf) {
+                       MFREE(cfg->osh, ioctl_buf, WLC_IOCTL_MEDLEN);
+               }
+       }
+
+       return ret;
+}
+
+#ifdef WLAIBSS_MCHAN
+static bcm_struct_cfgdev*
+bcm_cfg80211_add_ibss_if(struct wiphy *wiphy, char *name)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct wireless_dev* wdev = NULL;
+       struct net_device *new_ndev = NULL;
+       struct net_device *primary_ndev = NULL;
+       long timeout;
+       wl_aibss_if_t aibss_if;
+       wl_if_event_info *event = NULL;
+
+       if (cfg->ibss_cfgdev != NULL) {
+               WL_ERR(("IBSS interface %s already exists\n", name));
+               return NULL;
+       }
+
+       WL_ERR(("Try to create IBSS interface %s\n", name));
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+       /* generate a new MAC address for the IBSS interface */
+       get_primary_mac(cfg, &cfg->ibss_if_addr);
+       cfg->ibss_if_addr.octet[4] ^= 0x40;
+       bzero(&aibss_if, sizeof(aibss_if));
+       memcpy(&aibss_if.addr, &cfg->ibss_if_addr, sizeof(aibss_if.addr));
+       aibss_if.chspec = 0;
+       aibss_if.len = sizeof(aibss_if);
+
+       cfg->bss_pending_op = TRUE;
+       bzero(&cfg->if_event_info, sizeof(cfg->if_event_info));
+       err = wldev_iovar_setbuf(primary_ndev, "aibss_ifadd", &aibss_if,
+               sizeof(aibss_if), cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       if (err) {
+               WL_ERR(("IOVAR aibss_ifadd failed with error %d\n", err));
+               goto fail;
+       }
+       timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+               !cfg->bss_pending_op, msecs_to_jiffies(MAX_WAIT_TIME));
+       if (timeout <= 0 || cfg->bss_pending_op)
+               goto fail;
+
+       event = &cfg->if_event_info;
+       /* By calling wl_cfg80211_allocate_if (dhd_allocate_if eventually) we give the control
+        * over this net_device interface to dhd_linux, hence the interface is managed by dhd_liux
+        * and will be freed by dhd_detach unless it gets unregistered before that. The
+        * wireless_dev instance new_ndev->ieee80211_ptr associated with this net_device will
+        * be freed by wl_dealloc_netinfo
+        */
+       new_ndev = wl_cfg80211_allocate_if(cfg, event->ifidx, event->name,
+               event->mac, event->bssidx, event->name);
+       if (new_ndev == NULL)
+               goto fail;
+       wdev = (struct wireless_dev *)MALLOCZ(cfg->osh, sizeof(*wdev));
+       if (wdev == NULL)
+               goto fail;
+       wdev->wiphy = wiphy;
+       wdev->iftype = NL80211_IFTYPE_ADHOC;
+       wdev->netdev = new_ndev;
+       new_ndev->ieee80211_ptr = wdev;
+       SET_NETDEV_DEV(new_ndev, wiphy_dev(wdev->wiphy));
+
+       /* rtnl lock must have been acquired, if this is not the case, wl_cfg80211_register_if
+       * needs to be modified to take one parameter (bool need_rtnl_lock)
+        */
+       ASSERT_RTNL();
+       if (wl_cfg80211_register_if(cfg, event->ifidx, new_ndev, FALSE) != BCME_OK)
+               goto fail;
+
+       wl_alloc_netinfo(cfg, new_ndev, wdev, WL_IF_TYPE_IBSS,
+               PM_ENABLE, event->bssidx, event->ifidx);
+       cfg->ibss_cfgdev = ndev_to_cfgdev(new_ndev);
+       WL_ERR(("IBSS interface %s created\n", new_ndev->name));
+       return cfg->ibss_cfgdev;
+
+fail:
+       WL_ERR(("failed to create IBSS interface %s \n", name));
+       cfg->bss_pending_op = FALSE;
+       if (new_ndev)
+               wl_cfg80211_remove_if(cfg, event->ifidx, new_ndev, FALSE);
+       if (wdev) {
+               MFREE(cfg->osh, wdev, sizeof(*wdev));
+       }
+       return NULL;
+}
+
+static s32
+bcm_cfg80211_del_ibss_if(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *ndev = NULL;
+       struct net_device *primary_ndev = NULL;
+       long timeout;
+
+       if (!cfgdev || cfg->ibss_cfgdev != cfgdev || ETHER_ISNULLADDR(&cfg->ibss_if_addr.octet))
+               return -EINVAL;
+       ndev = (struct net_device *)cfgdev_to_ndev(cfg->ibss_cfgdev);
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       cfg->bss_pending_op = TRUE;
+       bzero(&cfg->if_event_info, sizeof(cfg->if_event_info));
+       err = wldev_iovar_setbuf(primary_ndev, "aibss_ifdel", &cfg->ibss_if_addr,
+               sizeof(cfg->ibss_if_addr), cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       if (err) {
+               WL_ERR(("IOVAR aibss_ifdel failed with error %d\n", err));
+               goto fail;
+       }
+       timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+               !cfg->bss_pending_op, msecs_to_jiffies(MAX_WAIT_TIME));
+       if (timeout <= 0 || cfg->bss_pending_op) {
+               WL_ERR(("timeout in waiting IF_DEL event\n"));
+               goto fail;
+       }
+
+       wl_cfg80211_remove_if(cfg, cfg->if_event_info.ifidx, ndev, FALSE);
+       cfg->ibss_cfgdev = NULL;
+       return 0;
+
+fail:
+       cfg->bss_pending_op = FALSE;
+       return -1;
+}
+#endif /* WLAIBSS_MCHAN */
+
+s32
+wl_cfg80211_to_fw_iftype(wl_iftype_t iftype)
+{
+       s32 ret = BCME_ERROR;
+
+       switch (iftype) {
+               case WL_IF_TYPE_AP:
+                       ret = WL_INTERFACE_TYPE_AP;
+                       break;
+               case WL_IF_TYPE_STA:
+                       ret = WL_INTERFACE_TYPE_STA;
+                       break;
+               case WL_IF_TYPE_NAN_NMI:
+               case WL_IF_TYPE_NAN:
+                       ret = WL_INTERFACE_TYPE_NAN;
+                       break;
+               case WL_IF_TYPE_P2P_DISC:
+                       ret = WL_INTERFACE_TYPE_P2P_DISC;
+                       break;
+               case WL_IF_TYPE_P2P_GO:
+                       ret = WL_INTERFACE_TYPE_P2P_GO;
+                       break;
+               case WL_IF_TYPE_P2P_GC:
+                       ret = WL_INTERFACE_TYPE_P2P_GC;
+                       break;
+
+               default:
+                       WL_ERR(("Unsupported type:%d \n", iftype));
+                       ret = -EINVAL;
+                       break;
+       }
+       return ret;
+}
+
+bool
+wl_legacy_chip_check(struct bcm_cfg80211 *cfg)
+{
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       uint chip;
+
+       chip = dhd_conf_get_chip(dhd);
+
+       if (chip == BCM43362_CHIP_ID || chip == BCM4330_CHIP_ID ||
+               chip == BCM43430_CHIP_ID || chip == BCM43012_CHIP_ID ||
+               chip == BCM4334_CHIP_ID || chip == BCM43340_CHIP_ID ||
+               chip == BCM43341_CHIP_ID || chip == BCM4324_CHIP_ID ||
+               chip == BCM4335_CHIP_ID || chip == BCM4339_CHIP_ID ||
+               chip == BCM4345_CHIP_ID || chip == BCM43454_CHIP_ID ||
+               chip == BCM4354_CHIP_ID || chip == BCM4356_CHIP_ID ||
+               chip == BCM4371_CHIP_ID || chip == BCM4359_CHIP_ID ||
+               chip == BCM43143_CHIP_ID || chip == BCM43242_CHIP_ID ||
+               chip == BCM43569_CHIP_ID) {
+               return true;
+       }
+
+       return false;
+}
+
+s32
+wl_cfg80211_interface_ops(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev, s32 bsscfg_idx,
+       wl_iftype_t cfg_iftype, s32 del, u8 *addr)
+{
+       s32 ret;
+       struct wl_interface_create_v2 iface;
+       wl_interface_create_v3_t iface_v3;
+       wl_interface_create_t iface_v0;
+       struct wl_interface_info_v1 *info;
+       wl_interface_info_v2_t *info_v2;
+       wl_interface_info_t *info_v0;
+       uint32 ifflags = 0;
+       bool use_iface_info_v2 = false;
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+       s32 iftype;
+
+       if (del) {
+               ret = wldev_iovar_setbuf(ndev, "interface_remove",
+                       NULL, 0, ioctl_buf, sizeof(ioctl_buf), NULL);
+               if (unlikely(ret))
+                       WL_ERR(("Interface remove failed!! ret %d\n", ret));
+               return ret;
+       }
+
+       /* Interface create */
+       bzero(&iface, sizeof(iface));
+       /*
+        * flags field is still used along with iftype inorder to support the old version of the
+        * FW work with the latest app changes.
+        */
+
+       iftype = wl_cfg80211_to_fw_iftype(cfg_iftype);
+       if (iftype < 0) {
+               return -ENOTSUPP;
+       }
+
+       if (addr) {
+               ifflags |= WL_INTERFACE_MAC_USE;
+       }
+
+       /* Pass ver = 0 for fetching the interface_create iovar version */
+       if (wl_legacy_chip_check(cfg)) {
+               bzero(&iface_v0, sizeof(iface_v0));
+               iface_v0.ver = WL_INTERFACE_CREATE_VER;
+               iface_v0.flags = iftype | ifflags;
+               if (addr) {
+                       memcpy(&iface_v0.mac_addr.octet, addr, ETH_ALEN);
+               }
+               ret = wldev_iovar_getbuf(ndev, "interface_create",
+                       &iface_v0, sizeof(struct wl_interface_create),
+                       ioctl_buf, sizeof(ioctl_buf), NULL);
+               if (ret == 0) {
+                       info_v0 = (wl_interface_info_t *)ioctl_buf;
+                       ret = info_v0->bsscfgidx;
+                       goto exit;
+        }
+       } else {
+               ret = wldev_iovar_getbuf(ndev, "interface_create",
+                       &iface, sizeof(struct wl_interface_create_v2),
+                       ioctl_buf, sizeof(ioctl_buf), NULL);
+       }
+       if (ret == BCME_UNSUPPORTED) {
+               WL_ERR(("interface_create iovar not supported\n"));
+               return ret;
+       } else if ((ret == 0) && *((uint32 *)ioctl_buf) == WL_INTERFACE_CREATE_VER_3) {
+               WL_DBG(("interface_create version 3. flags:0x%x \n", ifflags));
+               use_iface_info_v2 = true;
+               bzero(&iface_v3, sizeof(wl_interface_create_v3_t));
+               iface_v3.ver = WL_INTERFACE_CREATE_VER_3;
+               iface_v3.iftype = iftype;
+               iface_v3.flags = ifflags;
+               if (addr) {
+                       memcpy(&iface_v3.mac_addr.octet, addr, ETH_ALEN);
+               }
+               ret = wldev_iovar_getbuf(ndev, "interface_create",
+                       &iface_v3, sizeof(wl_interface_create_v3_t),
+                       ioctl_buf, sizeof(ioctl_buf), NULL);
+       } else {
+               /* On any other error, attempt with iovar version 2 */
+               WL_DBG(("interface_create version 2. get_ver:%d ifflags:0x%x\n", ret, ifflags));
+               iface.ver = WL_INTERFACE_CREATE_VER_2;
+               iface.iftype = iftype;
+               iface.flags = ifflags;
+               if (addr) {
+                       memcpy(&iface.mac_addr.octet, addr, ETH_ALEN);
+               }
+               ret = wldev_iovar_getbuf(ndev, "interface_create",
+                       &iface, sizeof(struct wl_interface_create_v2),
+                       ioctl_buf, sizeof(ioctl_buf), NULL);
+       }
+
+       if (unlikely(ret)) {
+               WL_ERR(("Interface create failed!! ret %d\n", ret));
+               return ret;
+       }
+
+       /* success case */
+       if (use_iface_info_v2 == true) {
+               info_v2 = (wl_interface_info_v2_t *)ioctl_buf;
+               ret = info_v2->bsscfgidx;
+       } else {
+               /* Use v1 struct */
+               info = (struct wl_interface_info_v1 *)ioctl_buf;
+               ret = info->bsscfgidx;
+       }
+
+exit:
+       WL_DBG(("wl interface create success!! bssidx:%d \n", ret));
+       return ret;
+}
+
+s32
+wl_cfg80211_add_del_bss(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev, s32 bsscfg_idx,
+       wl_iftype_t brcm_iftype, s32 del, u8 *addr)
+{
+       s32 ret = BCME_OK;
+       s32 val = 0;
+
+       struct {
+               s32 cfg;
+               s32 val;
+               struct ether_addr ea;
+       } bss_setbuf;
+
+       WL_DBG(("wl_iftype:%d del:%d \n", brcm_iftype, del));
+
+       bzero(&bss_setbuf, sizeof(bss_setbuf));
+
+       /* AP=2, STA=3, up=1, down=0, val=-1 */
+       if (del) {
+               val = WLC_AP_IOV_OP_DELETE;
+       } else if (brcm_iftype == WL_IF_TYPE_AP) {
+               /* Add/role change to AP Interface */
+               WL_DBG(("Adding AP Interface \n"));
+               val = WLC_AP_IOV_OP_MANUAL_AP_BSSCFG_CREATE;
+       } else if (brcm_iftype == WL_IF_TYPE_STA) {
+               /* Add/role change to STA Interface */
+               WL_DBG(("Adding STA Interface \n"));
+               val = WLC_AP_IOV_OP_MANUAL_STA_BSSCFG_CREATE;
+       } else {
+               WL_ERR((" add_del_bss NOT supported for IFACE type:0x%x", brcm_iftype));
+               return -EINVAL;
+       }
+
+       if (!del) {
+               wl_ext_bss_iovar_war(ndev, &val);
+       }
+
+       bss_setbuf.cfg = htod32(bsscfg_idx);
+       bss_setbuf.val = htod32(val);
+
+       if (addr) {
+               memcpy(&bss_setbuf.ea.octet, addr, ETH_ALEN);
+       }
+
+       WL_MSG(ndev->name, "wl bss %d bssidx:%d\n", val, bsscfg_idx);
+       ret = wldev_iovar_setbuf(ndev, "bss", &bss_setbuf, sizeof(bss_setbuf),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       if (ret != 0)
+               WL_ERR(("'bss %d' failed with %d\n", val, ret));
+
+       return ret;
+}
+
+s32
+wl_cfg80211_bss_up(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 bsscfg_idx, s32 bss_up)
+{
+       s32 ret = BCME_OK;
+       s32 val = bss_up ? 1 : 0;
+
+       struct {
+               s32 cfg;
+               s32 val;
+       } bss_setbuf;
+
+       bss_setbuf.cfg = htod32(bsscfg_idx);
+       bss_setbuf.val = htod32(val);
+
+       WL_INFORM_MEM(("wl bss -C %d %s\n", bsscfg_idx, bss_up ? "up" : "down"));
+       ret = wldev_iovar_setbuf(ndev, "bss", &bss_setbuf, sizeof(bss_setbuf),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+
+       if (ret != 0) {
+               WL_ERR(("'bss %d' failed with %d\n", bss_up, ret));
+       }
+
+       return ret;
+}
+
+bool
+wl_cfg80211_bss_isup(struct net_device *ndev, int bsscfg_idx)
+{
+       s32 result, val;
+       bool isup = false;
+       s8 getbuf[64];
+
+       /* Check if the BSS is up */
+       *(int*)getbuf = -1;
+       result = wldev_iovar_getbuf_bsscfg(ndev, "bss", &bsscfg_idx,
+               sizeof(bsscfg_idx), getbuf, sizeof(getbuf), 0, NULL);
+       if (result != 0) {
+               WL_ERR(("'cfg bss -C %d' failed: %d\n", bsscfg_idx, result));
+               WL_ERR(("NOTE: this ioctl error is normal "
+                       "when the BSS has not been created yet.\n"));
+       } else {
+               val = *(int*)getbuf;
+               val = dtoh32(val);
+               WL_DBG(("wl bss -C %d = %d\n", bsscfg_idx, val));
+               isup = (val ? TRUE : FALSE);
+       }
+       return isup;
+}
+
+s32
+wl_iftype_to_mode(wl_iftype_t iftype)
+{
+       s32 mode = BCME_ERROR;
+
+       switch (iftype) {
+               case WL_IF_TYPE_STA:
+               case WL_IF_TYPE_P2P_GC:
+               case WL_IF_TYPE_P2P_DISC:
+                       mode = WL_MODE_BSS;
+                       break;
+               case WL_IF_TYPE_AP:
+               case WL_IF_TYPE_P2P_GO:
+                       mode = WL_MODE_AP;
+                       break;
+               case WL_IF_TYPE_NAN:
+                       mode = WL_MODE_NAN;
+                       break;
+
+               case WL_IF_TYPE_AIBSS:
+                       /* Intentional fall through */
+               case WL_IF_TYPE_IBSS:
+                       mode = WL_MODE_IBSS;
+                       break;
+#ifdef WLMESH_CFG80211
+               case WL_IF_TYPE_MESH:
+                       mode = WL_MODE_MESH;
+                       break;
+#endif /* WLMESH_CFG80211 */
+               default:
+                       WL_ERR(("Unsupported type:%d\n", iftype));
+                       break;
+       }
+       return mode;
+}
+
+s32
+cfg80211_to_wl_iftype(uint16 type, uint16 *role, uint16 *mode)
+{
+       switch (type) {
+               case NL80211_IFTYPE_STATION:
+                       *role = WL_IF_TYPE_STA;
+                       *mode = WL_MODE_BSS;
+                       break;
+               case NL80211_IFTYPE_AP:
+                       *role = WL_IF_TYPE_AP;
+                       *mode = WL_MODE_AP;
+                       break;
+#ifdef WL_CFG80211_P2P_DEV_IF
+               case NL80211_IFTYPE_P2P_DEVICE:
+                       *role = WL_IF_TYPE_P2P_DISC;
+                       *mode = WL_MODE_BSS;
+                       break;
+#endif /* WL_CFG80211_P2P_DEV_IF */
+               case NL80211_IFTYPE_P2P_GO:
+                       *role = WL_IF_TYPE_P2P_GO;
+                       *mode = WL_MODE_AP;
+                       break;
+               case NL80211_IFTYPE_P2P_CLIENT:
+                       *role = WL_IF_TYPE_P2P_GC;
+                       *mode = WL_MODE_BSS;
+                       break;
+               case NL80211_IFTYPE_MONITOR:
+                       WL_ERR(("Unsupported mode \n"));
+                       return BCME_UNSUPPORTED;
+               case NL80211_IFTYPE_ADHOC:
+                       *role = WL_IF_TYPE_IBSS;
+                       *mode = WL_MODE_IBSS;
+                       break;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0))
+               case NL80211_IFTYPE_NAN:
+                       *role = WL_IF_TYPE_NAN;
+                       *mode = WL_MODE_NAN;
+                       break;
+#endif
+#ifdef WLMESH_CFG80211
+               case NL80211_IFTYPE_MESH_POINT:
+                       *role = WLC_E_IF_ROLE_AP;
+                       *mode = WL_MODE_MESH;
+                       break;
+#endif /* WLMESH_CFG80211 */
+               default:
+                       WL_ERR(("Unknown interface type:0x%x\n", type));
+                       return BCME_ERROR;
+       }
+       return BCME_OK;
+}
+
+static s32
+wl_role_to_cfg80211_type(uint16 role, uint16 *wl_iftype, uint16 *mode)
+{
+       switch (role) {
+
+       case WLC_E_IF_ROLE_STA:
+               *wl_iftype = WL_IF_TYPE_STA;
+               *mode = WL_MODE_BSS;
+               return NL80211_IFTYPE_STATION;
+       case WLC_E_IF_ROLE_AP:
+               *wl_iftype = WL_IF_TYPE_AP;
+               *mode = WL_MODE_AP;
+               return NL80211_IFTYPE_AP;
+       case WLC_E_IF_ROLE_P2P_GO:
+               *wl_iftype = WL_IF_TYPE_P2P_GO;
+               *mode = WL_MODE_AP;
+               return NL80211_IFTYPE_P2P_GO;
+       case WLC_E_IF_ROLE_P2P_CLIENT:
+               *wl_iftype = WL_IF_TYPE_P2P_GC;
+               *mode = WL_MODE_BSS;
+               return NL80211_IFTYPE_P2P_CLIENT;
+       case WLC_E_IF_ROLE_IBSS:
+               *wl_iftype = WL_IF_TYPE_IBSS;
+               *mode = WL_MODE_IBSS;
+               return NL80211_IFTYPE_ADHOC;
+       case WLC_E_IF_ROLE_NAN:
+               *wl_iftype = WL_IF_TYPE_NAN;
+               *mode = WL_MODE_NAN;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0)) && defined(WL_CFG80211_NAN)
+               /* NL80211_IFTYPE_NAN should only be used with CFG80211 NAN MGMT
+                * For Vendor HAL based NAN implementation, continue advertising
+                * as a STA interface
+                */
+               return NL80211_IFTYPE_NAN;
+#else
+               return NL80211_IFTYPE_STATION;
+#endif /* ((LINUX_VER >= KERNEL_VERSION(4, 9, 0))) && WL_CFG80211_NAN */
+#ifdef WLDWDS
+       case WLC_E_IF_ROLE_WDS:
+               *wl_iftype = WL_IF_TYPE_AP;
+               *mode = WL_MODE_AP;
+               return NL80211_IFTYPE_AP;
+#endif
+#ifdef WLMESH_CFG80211
+       case WLC_E_IF_ROLE_MESH:
+               *wl_iftype = WL_IF_TYPE_MESH;
+               *mode = WL_MODE_MESH;
+               return NL80211_IFTYPE_MESH_POINT;
+#endif /* WLMESH_CFG80211 */
+
+       default:
+               WL_ERR(("Unknown interface role:0x%x. Forcing type station\n", role));
+               return BCME_ERROR;
+       }
+}
+
+struct net_device *
+wl_cfg80211_post_ifcreate(struct net_device *ndev,
+       wl_if_event_info *event, u8 *addr,
+       const char *name, bool rtnl_lock_reqd)
+{
+       struct bcm_cfg80211 *cfg;
+       struct net_device *primary_ndev;
+       struct net_device *new_ndev = NULL;
+       struct wireless_dev *wdev = NULL;
+       s32 iface_type;
+       s32 ret = BCME_OK;
+       u16 mode;
+       u8 mac_addr[ETH_ALEN];
+       u16 wl_iftype;
+
+       if (!ndev || !event) {
+               WL_ERR(("Wrong arg\n"));
+               return NULL;
+       }
+
+       cfg = wl_get_cfg(ndev);
+       if (!cfg) {
+               WL_ERR(("cfg null\n"));
+               return NULL;
+       }
+
+       WL_DBG(("Enter. role:%d ifidx:%d bssidx:%d\n",
+               event->role, event->ifidx, event->bssidx));
+       if (!event->ifidx || !event->bssidx) {
+               /* Fw returned primary idx (0) for virtual interface */
+               WL_ERR(("Wrong index. ifidx:%d bssidx:%d \n",
+                       event->ifidx, event->bssidx));
+               return NULL;
+       }
+
+#if defined(WLMESH_CFG80211) && defined(WL_EXT_IAPSTA)
+       if (wl_ext_iapsta_mesh_creating(ndev)) {
+               event->role = WLC_E_IF_ROLE_MESH;
+               WL_MSG(ndev->name, "change role to WLC_E_IF_ROLE_MESH\n");
+       }
+#endif /* WLMESH_CFG80211 && WL_EXT_IAPSTA */
+
+       iface_type = wl_role_to_cfg80211_type(event->role, &wl_iftype, &mode);
+       if (iface_type < 0) {
+               /* Unknown iface type */
+               WL_ERR(("Wrong iface type \n"));
+               return NULL;
+       }
+
+       WL_DBG(("mac_ptr:%p name:%s role:%d nl80211_iftype:%d " MACDBG "\n",
+               addr, name, event->role, iface_type, MAC2STRDBG(event->mac)));
+       if (!name) {
+               /* If iface name is not provided, use dongle ifname */
+               name = event->name;
+       }
+
+       if (!addr) {
+               /* If mac address is not set, use primary mac with locally administered
+                * bit set.
+                */
+               primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+               memcpy(mac_addr, primary_ndev->dev_addr, ETH_ALEN);
+               /* For customer6 builds, use primary mac address for virtual interface */
+               mac_addr[0] |= 0x02;
+               addr = mac_addr;
+       }
+
+       if (iface_type == NL80211_IFTYPE_P2P_CLIENT) {
+               s16 cfg_type = wl_cfgp2p_get_conn_idx(cfg);
+               struct ether_addr *p2p_addr = wl_to_p2p_bss_macaddr(cfg, cfg_type);
+
+               /* check if pre-registered mac matches the mac from dongle via WLC_E_LINK */
+               if (memcmp(p2p_addr->octet, addr, ETH_ALEN)) {
+                       WL_INFORM_MEM(("p2p pre-regsitered mac:" MACDBG
+                               " , mac from dongle:" MACDBG "\n",
+                               MAC2STRDBG(p2p_addr->octet), MAC2STRDBG(addr)));
+
+                       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+                       wl_cfg80211_handle_hang_event(primary_ndev,
+                               HANG_REASON_IFACE_ADD_FAILURE, DUMP_TYPE_IFACE_OP_FAILURE);
+                       goto fail;
+               }
+       }
+
+#ifdef WL_STATIC_IF
+       if (IS_CFG80211_STATIC_IF_NAME(cfg, name)) {
+               new_ndev = wl_cfg80211_post_static_ifcreate(cfg, event, addr, iface_type);
+               if (!new_ndev) {
+                       WL_ERR(("failed to get I/F pointer\n"));
+                       return NULL;
+               }
+               wdev = new_ndev->ieee80211_ptr;
+       } else
+#endif /* WL_STATIC_IF */
+       {
+               new_ndev = wl_cfg80211_allocate_if(cfg, event->ifidx,
+                       name, addr, event->bssidx, event->name);
+               if (!new_ndev) {
+                       WL_ERR(("I/F allocation failed! \n"));
+                       return NULL;
+               } else {
+                       WL_DBG(("I/F allocation succeeded! ifidx:0x%x bssidx:0x%x \n",
+                        event->ifidx, event->bssidx));
+               }
+
+               wdev = (struct wireless_dev *)MALLOCZ(cfg->osh, sizeof(*wdev));
+               if (!wdev) {
+                       WL_ERR(("wireless_dev alloc failed! \n"));
+                       wl_cfg80211_remove_if(cfg, event->ifidx, new_ndev, rtnl_lock_reqd);
+                       return NULL;
+               }
+
+               wdev->wiphy = bcmcfg_to_wiphy(cfg);
+               wdev->iftype = iface_type;
+
+               new_ndev->ieee80211_ptr = wdev;
+#ifdef WLDWDS
+               /* set wds0.x to 4addr interface here */
+               if (event->role == WLC_E_IF_ROLE_WDS) {
+                       printf("\n\n\n event->role == WLC_E_IF_ROLE_WDS, set vwdev 4addr to %s\n", event->name);
+                       wdev->use_4addr = true;
+               }
+#endif /* WLDWDS */
+               SET_NETDEV_DEV(new_ndev, wiphy_dev(wdev->wiphy));
+
+               memcpy(new_ndev->dev_addr, addr, ETH_ALEN);
+#ifdef WL_EXT_IAPSTA
+               wl_ext_iapsta_ifadding(new_ndev, event->ifidx);
+#endif /* WL_EXT_IAPSTA */
+               if (wl_cfg80211_register_if(cfg, event->ifidx, new_ndev, rtnl_lock_reqd)
+                       != BCME_OK) {
+                       WL_ERR(("IFACE register failed \n"));
+                       /* Post interface registration, wdev would be freed from the netdev
+                        * destructor path. For other cases, handle it here.
+                        */
+                       MFREE(cfg->osh, wdev, sizeof(*wdev));
+                       wl_cfg80211_remove_if(cfg, event->ifidx, new_ndev, rtnl_lock_reqd);
+                       return NULL;
+               }
+       }
+
+       /* Initialize with the station mode params */
+       ret = wl_alloc_netinfo(cfg, new_ndev, wdev, wl_iftype,
+               PM_ENABLE, event->bssidx, event->ifidx);
+       if (unlikely(ret)) {
+               WL_ERR(("wl_alloc_netinfo Error (%d)\n", ret));
+               goto fail;
+       }
+
+       /* Apply the mode & infra setting based on iftype */
+       if ((ret = wl_config_infra(cfg, new_ndev, wl_iftype)) < 0) {
+               WL_ERR(("config ifmode failure (%d)\n", ret));
+               goto fail;
+       }
+
+       if (mode == WL_MODE_AP) {
+               wl_set_drv_status(cfg, AP_CREATING, new_ndev);
+       }
+#ifdef WL_EXT_IAPSTA
+       wl_ext_iapsta_update_iftype(new_ndev, event->ifidx, wl_iftype);
+#endif
+
+       WL_INFORM_MEM(("Network Interface (%s) registered with host."
+               " cfg_iftype:%d wl_role:%d " MACDBG "\n",
+               new_ndev->name, iface_type, event->role, MAC2STRDBG(new_ndev->dev_addr)));
+
+#ifdef SUPPORT_SET_CAC
+       wl_cfg80211_set_cac(cfg, 0);
+#endif /* SUPPORT_SET_CAC */
+
+       return new_ndev;
+
+fail:
+#ifdef WL_STATIC_IF
+       /* remove static if from iflist */
+       if (IS_CFG80211_STATIC_IF_NAME(cfg, name)) {
+               cfg->static_ndev_state = NDEV_STATE_FW_IF_FAILED;
+               wl_cfg80211_update_iflist_info(cfg, new_ndev, WL_STATIC_IFIDX, addr,
+                       event->bssidx, event->name, NDEV_STATE_FW_IF_FAILED);
+       }
+#endif /* WL_STATIC_IF */
+       if (new_ndev) {
+               /* wdev would be freed from netdev destructor call back */
+               wl_cfg80211_remove_if(cfg, event->ifidx, new_ndev, rtnl_lock_reqd);
+       }
+
+       return NULL;
+}
+
+s32
+wl_cfg80211_delete_iface(struct bcm_cfg80211 *cfg,
+       wl_iftype_t sec_data_if_type)
+{
+       struct net_info *iter, *next;
+       struct net_device *primary_ndev;
+       s32 ret = BCME_OK;
+       uint8 i = 0;
+
+       BCM_REFERENCE(i);
+       BCM_REFERENCE(ret);
+
+       /* Note: This function will clean up only the network interface and host
+        * data structures. The firmware interface clean up will happen in the
+        * during chip reset (ifconfig wlan0 down for built-in drivers/rmmod
+        * context for the module case).
+        */
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+       WL_DBG(("Enter, deleting iftype  %s\n",
+               wl_iftype_to_str(sec_data_if_type)));
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       for_each_ndev(cfg, iter, next) {
+               GCC_DIAGNOSTIC_POP();
+               if (iter->ndev && (iter->ndev != primary_ndev)) {
+                       if (iter->iftype != sec_data_if_type) {
+                               continue;
+                       }
+                       switch (sec_data_if_type) {
+                               case WL_IF_TYPE_P2P_GO:
+                               case WL_IF_TYPE_P2P_GC: {
+                                       ret = _wl_cfg80211_del_if(cfg,
+                                               iter->ndev, NULL, iter->ndev->name);
+                                       break;
+                               }
+#ifdef WL_NAN
+                               case WL_IF_TYPE_NAN: {
+                                       if (wl_cfgnan_is_enabled(cfg) == false) {
+                                               WL_INFORM_MEM(("Nan is not active,"
+                                                       " ignore NDI delete\n"));
+                                       } else {
+                                               ret = wl_cfgnan_delete_ndp(cfg, iter->ndev);
+                                       }
+                                       break;
+                               }
+#endif /* WL_NAN */
+                               case WL_IF_TYPE_AP: {
+                                       /* Cleanup AP */
+#ifdef WL_STATIC_IF
+                                               /* handle static ap */
+                                       if (IS_CFG80211_STATIC_IF(cfg, iter->ndev)) {
+                                               dev_close(iter->ndev);
+                                       } else
+#endif /* WL_STATIC_IF */
+                                       {
+                                               /* handle virtual created AP */
+                                               ret = _wl_cfg80211_del_if(cfg, iter->ndev,
+                                                       NULL, iter->ndev->name);
+                                       }
+                                       break;
+                               }
+                               default: {
+                                       WL_ERR(("Unsupported interface type\n"));
+                                       ret = -ENOTSUPP;
+                                       goto fail;
+                               }
+                       }
+               }
+       }
+fail:
+       return ret;
+}
+
+void
+wl_cfg80211_cleanup_virtual_ifaces(struct bcm_cfg80211 *cfg, bool rtnl_lock_reqd)
+{
+       struct net_info *iter, *next;
+       struct net_device *primary_ndev;
+
+       /* Note: This function will clean up only the network interface and host
+        * data structures. The firmware interface clean up will happen in the
+        * during chip reset (ifconfig wlan0 down for built-in drivers/rmmod
+        * context for the module case).
+        */
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+       WL_DBG(("Enter\n"));
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       for_each_ndev(cfg, iter, next) {
+               GCC_DIAGNOSTIC_POP();
+               if (iter->ndev && (iter->ndev != primary_ndev)) {
+                       /* Ensure interfaces are down before deleting */
+#ifdef WL_STATIC_IF
+                       /* Avoiding cleaning static ifaces */
+                       if (!IS_CFG80211_STATIC_IF(cfg, iter->ndev))
+#endif /* WL_STATIC_IF */
+                       {
+                               dev_close(iter->ndev);
+                               WL_DBG(("Cleaning up iface:%s \n", iter->ndev->name));
+                               wl_cfg80211_post_ifdel(iter->ndev, rtnl_lock_reqd, 0);
+                       }
+               }
+       }
+}
+
+s32
+wl_cfg80211_post_ifdel(struct net_device *ndev, bool rtnl_lock_reqd, s32 ifidx)
+{
+       s32 ret = BCME_OK;
+       struct bcm_cfg80211 *cfg;
+       struct net_info *netinfo = NULL;
+
+       if (!ndev || !ndev->ieee80211_ptr) {
+               /* No wireless dev done for this interface */
+               ret = -EINVAL;
+               goto exit;
+       }
+
+       cfg = wl_get_cfg(ndev);
+       if (!cfg) {
+               WL_ERR(("cfg null\n"));
+               ret = BCME_ERROR;
+               goto exit;
+       }
+
+       if (ifidx <= 0) {
+               WL_ERR(("Invalid IF idx for iface:%s\n", ndev->name));
+               ifidx = dhd_net2idx(((struct dhd_pub *)(cfg->pub))->info, ndev);
+               BCM_REFERENCE(ifidx);
+               if (ifidx <= 0) {
+                       ASSERT(0);
+                       ret = BCME_ERROR;
+                       goto exit;
+               }
+       }
+
+       if ((netinfo = wl_get_netinfo_by_wdev(cfg, ndev_to_wdev(ndev))) == NULL) {
+               WL_ERR(("Find netinfo from wdev %p failed\n", ndev_to_wdev(ndev)));
+               ret = -ENODEV;
+               goto exit;
+       }
+
+#ifdef WL_STATIC_IF
+       if (IS_CFG80211_STATIC_IF(cfg, ndev)) {
+               ret = wl_cfg80211_post_static_ifdel(cfg, ndev);
+       } else
+#endif /* WL_STATIC_IF */
+       {
+               WL_INFORM_MEM(("[%s] cfg80211_remove_if ifidx:%d, vif_count:%d\n",
+                       ndev->name, ifidx, cfg->vif_count));
+               wl_cfg80211_remove_if(cfg, ifidx, ndev, rtnl_lock_reqd);
+               cfg->bss_pending_op = FALSE;
+       }
+
+#ifdef SUPPORT_SET_CAC
+       wl_cfg80211_set_cac(cfg, 1);
+#endif /* SUPPORT_SET_CAC */
+exit:
+       return ret;
+}
+
+int
+wl_cfg80211_deinit_p2p_discovery(struct bcm_cfg80211 *cfg)
+{
+       s32 ret = BCME_OK;
+       bcm_struct_cfgdev *cfgdev;
+
+       if (cfg->p2p) {
+               /* De-initialize the p2p discovery interface, if operational */
+               WL_ERR(("Disabling P2P Discovery Interface \n"));
+#ifdef WL_CFG80211_P2P_DEV_IF
+               cfgdev = bcmcfg_to_p2p_wdev(cfg);
+#else
+               cfgdev = cfg->p2p_net;
+#endif
+               if (cfgdev) {
+                       ret = wl_cfg80211_scan_stop(cfg, cfgdev);
+                       if (unlikely(ret < 0)) {
+                               CFGP2P_ERR(("P2P scan stop failed, ret=%d\n", ret));
+                       }
+               }
+
+               wl_cfgp2p_disable_discovery(cfg);
+               wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) = 0;
+               p2p_on(cfg) = false;
+       }
+       return ret;
+}
+
+/* Create a Generic Network Interface and initialize it depending up on
+ * the interface type
+ */
+struct wireless_dev *
+wl_cfg80211_create_iface(struct wiphy *wiphy,
+       wl_iftype_t wl_iftype,
+       u8 *mac_addr, const char *name)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *new_ndev = NULL;
+       struct net_device *primary_ndev = NULL;
+       s32 ret = BCME_OK;
+       s32 bsscfg_idx = 0;
+       long timeout;
+       wl_if_event_info *event = NULL;
+       u8 addr[ETH_ALEN];
+       struct net_info *iter, *next;
+
+       WL_DBG(("Enter\n"));
+       if (!name) {
+               WL_ERR(("Interface name not provided\n"));
+               return NULL;
+       }
+       else {
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               for_each_ndev(cfg, iter, next) {
+                       GCC_DIAGNOSTIC_POP();
+                       if (iter->ndev) {
+                               if (strncmp(iter->ndev->name, name, strlen(name)) == 0) {
+                                       WL_ERR(("Interface name,%s exists!\n", iter->ndev->name));
+                                       return NULL;
+                               }
+                       }
+               }
+       }
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+       if (likely(!mac_addr)) {
+               /* Use primary MAC with the locally administered bit for the
+                *  Secondary STA I/F
+                */
+               memcpy(addr, primary_ndev->dev_addr, ETH_ALEN);
+               addr[0] |= 0x02;
+       } else {
+               /* Use the application provided mac address (if any) */
+               memcpy(addr, mac_addr, ETH_ALEN);
+       }
+
+       cfg->bss_pending_op = TRUE;
+       bzero(&cfg->if_event_info, sizeof(cfg->if_event_info));
+
+       /*
+        * Intialize the firmware I/F.
+        */
+
+       {
+               ret = wl_cfg80211_interface_ops(cfg, primary_ndev, bsscfg_idx,
+                       wl_iftype, 0, addr);
+       }
+       if (ret == BCME_UNSUPPORTED) {
+               /* Use bssidx 1 by default */
+               bsscfg_idx = 1;
+               if ((ret = wl_cfg80211_add_del_bss(cfg, primary_ndev,
+                       bsscfg_idx, wl_iftype, 0, addr)) < 0) {
+                       goto exit;
+               }
+       } else if (ret < 0) {
+               WL_ERR(("Interface create failed!! ret:%d \n", ret));
+               goto exit;
+       } else {
+               /* Success */
+               bsscfg_idx = ret;
+       }
+
+       WL_DBG(("Interface created!! bssidx:%d \n", bsscfg_idx));
+       /*
+        * Wait till the firmware send a confirmation event back.
+        */
+       WL_DBG(("Wait for the FW I/F Event\n"));
+       timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+               !cfg->bss_pending_op, msecs_to_jiffies(MAX_WAIT_TIME));
+       if (timeout <= 0 || cfg->bss_pending_op) {
+               WL_ERR(("ADD_IF event, didn't come. Return. timeout:%lu bss_pending_op:%d\n",
+                       timeout, cfg->bss_pending_op));
+               if (timeout == -ERESTARTSYS) {
+                       WL_ERR(("waitqueue was interrupted by a signal, returns -ERESTARTSYS\n"));
+               }
+               goto exit;
+       }
+
+       event = &cfg->if_event_info;
+       /*
+        * Since FW operation is successful,we can go ahead with the
+        * the host interface creation.
+        */
+       new_ndev = wl_cfg80211_post_ifcreate(primary_ndev,
+               event, addr, name, false);
+
+       if (new_ndev) {
+               /* Iface post ops successful. Return ndev/wdev ptr */
+               return new_ndev->ieee80211_ptr;
+       }
+
+exit:
+       cfg->bss_pending_op = FALSE;
+       return NULL;
+}
+
+s32
+wl_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *ndev = NULL;
+       s32 ret = BCME_OK;
+       s32 bsscfg_idx = 1;
+       long timeout;
+       u16 wl_iftype;
+       u16 wl_mode;
+
+       WL_DBG(("Enter\n"));
+
+       /* If any scan is going on, abort it */
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               WL_DBG(("Scan in progress. Aborting the scan!\n"));
+               wl_cfg80211_cancel_scan(cfg);
+       }
+
+       bsscfg_idx = wl_get_bssidx_by_wdev(cfg, wdev);
+       if (bsscfg_idx <= 0) {
+               /* validate bsscfgidx */
+               WL_ERR(("Wrong bssidx! \n"));
+               return -EINVAL;
+       }
+
+       /* Handle p2p iface */
+       if ((ret = wl_cfg80211_p2p_if_del(wiphy, wdev)) != BCME_NOTFOUND) {
+               WL_DBG(("P2P iface del handled \n"));
+#ifdef SUPPORT_SET_CAC
+               wl_cfg80211_set_cac(cfg, 1);
+#endif /* SUPPORT_SET_CAC */
+               return ret;
+       }
+
+       ndev = wdev->netdev;
+       if (unlikely(!ndev)) {
+               WL_ERR(("ndev null! \n"));
+               return -EINVAL;
+       }
+
+       memset(&cfg->if_event_info, 0, sizeof(cfg->if_event_info));
+
+       if (cfg80211_to_wl_iftype(ndev->ieee80211_ptr->iftype,
+               &wl_iftype, &wl_mode) < 0) {
+               return -EINVAL;
+       }
+
+       WL_DBG(("del interface. bssidx:%d cfg_iftype:%d wl_iftype:%d",
+               bsscfg_idx, ndev->ieee80211_ptr->iftype, wl_iftype));
+       /* Delete the firmware interface. "interface_remove" command
+        * should go on the interface to be deleted
+        */
+       if (wl_cfg80211_get_bus_state(cfg)) {
+               WL_ERR(("Bus state is down: %d\n", __LINE__));
+               ret = BCME_DONGLE_DOWN;
+               goto exit;
+       }
+
+       cfg->bss_pending_op = true;
+       ret = wl_cfg80211_interface_ops(cfg, ndev, bsscfg_idx,
+               wl_iftype, 1, NULL);
+       if (ret == BCME_UNSUPPORTED) {
+               if ((ret = wl_cfg80211_add_del_bss(cfg, ndev,
+                       bsscfg_idx, wl_iftype, true, NULL)) < 0) {
+                       WL_ERR(("DEL bss failed ret:%d \n", ret));
+                       goto exit;
+               }
+       } else if ((ret == BCME_NOTAP) || (ret == BCME_NOTSTA)) {
+               /* De-init sequence involving role downgrade not happened.
+                * Do nothing and return error. The del command should be
+                * retried.
+                */
+               WL_ERR(("ifdel role mismatch:%d\n", ret));
+               ret = -EBADTYPE;
+               goto exit;
+       } else if (ret < 0) {
+               WL_ERR(("Interface DEL failed ret:%d \n", ret));
+               goto exit;
+       }
+
+       timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+               !cfg->bss_pending_op, msecs_to_jiffies(MAX_WAIT_TIME));
+       if (timeout <= 0 || cfg->bss_pending_op) {
+               WL_ERR(("timeout in waiting IF_DEL event\n"));
+               /* The interface unregister will happen from wifi reset context */
+               ret = -ETIMEDOUT;
+               /* fall through */
+       }
+
+exit:
+       if (ret < 0) {
+               WL_ERR(("iface del failed:%d\n", ret));
+#ifdef WL_STATIC_IF
+               if (IS_CFG80211_STATIC_IF(cfg, ndev)) {
+                       /*
+                        * For static interface, clean up the host data,
+                        * irrespective of fw status. For dynamic
+                        * interfaces it gets cleaned from dhd_stop context
+                        */
+                       wl_cfg80211_post_static_ifdel(cfg, ndev);
+               }
+#endif /* WL_STATIC_IF */
+       } else {
+               ret = wl_cfg80211_post_ifdel(ndev, false, cfg->if_event_info.ifidx);
+               if (unlikely(ret)) {
+                       WL_ERR(("post_ifdel failed\n"));
+               }
+       }
+
+       cfg->bss_pending_op = false;
+       return ret;
+}
+
+static s32
+wl_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_ibss_params *params)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct cfg80211_bss *bss;
+       struct ieee80211_channel *chan;
+       struct wl_join_params join_params;
+       int scan_suppress;
+       struct cfg80211_ssid ssid;
+       s32 scan_retry = 0;
+       s32 err = 0;
+       size_t join_params_size;
+       chanspec_t chanspec = 0;
+
+       WL_TRACE(("In\n"));
+       RETURN_EIO_IF_NOT_UP(cfg);
+       WL_INFORM_MEM(("IBSS JOIN BSSID:" MACDBG "\n", MAC2STRDBG(params->bssid)));
+       if (!params->ssid || params->ssid_len <= 0 ||
+               params->ssid_len > DOT11_MAX_SSID_LEN) {
+               WL_ERR(("Invalid parameter\n"));
+               return -EINVAL;
+       }
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       chan = params->chandef.chan;
+#else
+       chan = params->channel;
+#endif /* WL_CFG80211_P2P_DEV_IF */
+       if (chan) {
+               cfg->channel = wl_freq_to_chanspec(chan->center_freq);
+       }
+       if (wl_get_drv_status(cfg, CONNECTED, dev)) {
+               struct wlc_ssid *lssid = (struct wlc_ssid *)wl_read_prof(cfg, dev, WL_PROF_SSID);
+               u8 *bssid = (u8 *)wl_read_prof(cfg, dev, WL_PROF_BSSID);
+               u32 *channel = (u32 *)wl_read_prof(cfg, dev, WL_PROF_CHAN);
+               if (!params->bssid || ((memcmp(params->bssid, bssid, ETHER_ADDR_LEN) == 0) &&
+                       (memcmp(params->ssid, lssid->SSID, lssid->SSID_len) == 0) &&
+                       (*channel == cfg->channel))) {
+                       WL_ERR(("Connection already existed to " MACDBG "\n",
+                               MAC2STRDBG((u8 *)wl_read_prof(cfg, dev, WL_PROF_BSSID))));
+                       return -EISCONN;
+               }
+               WL_ERR(("Ignore Previous connecton to %s (" MACDBG ")\n",
+                       lssid->SSID, MAC2STRDBG(bssid)));
+       }
+
+       /* remove the VSIE */
+       wl_cfg80211_ibss_vsie_delete(dev);
+
+       bss = cfg80211_get_ibss(wiphy, NULL, params->ssid, params->ssid_len);
+       if (!bss) {
+               if (IBSS_INITIAL_SCAN_ALLOWED == TRUE) {
+                       memcpy(ssid.ssid, params->ssid, params->ssid_len);
+                       ssid.ssid_len = params->ssid_len;
+                       do {
+                               if (unlikely
+                                       (__wl_cfg80211_scan(wiphy, dev, NULL, &ssid) ==
+                                        -EBUSY)) {
+                                       wl_delay(150);
+                               } else {
+                                       break;
+                               }
+                       } while (++scan_retry < WL_SCAN_RETRY_MAX);
+
+                       /* rtnl lock code is removed here. don't see why rtnl lock
+                        * needs to be released.
+                        */
+
+                       /* wait 4 secons till scan done.... */
+                       schedule_timeout_interruptible(msecs_to_jiffies(4000));
+
+                       bss = cfg80211_get_ibss(wiphy, NULL,
+                               params->ssid, params->ssid_len);
+               }
+       }
+       if (bss && ((IBSS_COALESCE_ALLOWED == TRUE) ||
+               ((IBSS_COALESCE_ALLOWED == FALSE) && params->bssid &&
+               !memcmp(bss->bssid, params->bssid, ETHER_ADDR_LEN)))) {
+               cfg->ibss_starter = false;
+               WL_DBG(("Found IBSS\n"));
+       } else {
+               cfg->ibss_starter = true;
+       }
+
+       if (bss) {
+               CFG80211_PUT_BSS(wiphy, bss);
+       }
+
+       if (chan) {
+               u32 bw_cap = 0;
+               err = wl_get_bandwidth_cap(dev, CHSPEC_BAND(cfg->channel), &bw_cap);
+               if (unlikely(err)) {
+                       WL_ERR(("Failed to get bandwidth capability (%d)\n", err));
+                       return err;
+               }
+               chanspec = wf_create_chspec_from_primary(wf_chspec_primary20_chan(cfg->channel),
+                       bw_cap, CHSPEC_BAND(cfg->channel));
+       }
+
+       /*
+        * Join with specific BSSID and cached SSID
+        * If SSID is zero join based on BSSID only
+        */
+       bzero(&join_params, sizeof(join_params));
+       memcpy((void *)join_params.ssid.SSID, (const void *)params->ssid,
+               params->ssid_len);
+       join_params.ssid.SSID_len = htod32(params->ssid_len);
+       if (params->bssid) {
+               memcpy(&join_params.params.bssid, params->bssid, ETHER_ADDR_LEN);
+               err = wldev_ioctl_set(dev, WLC_SET_DESIRED_BSSID, &join_params.params.bssid,
+                       ETHER_ADDR_LEN);
+               if (unlikely(err)) {
+                       WL_ERR(("Error (%d)\n", err));
+                       return err;
+               }
+       } else
+               bzero(&join_params.params.bssid, ETHER_ADDR_LEN);
+
+       if (IBSS_INITIAL_SCAN_ALLOWED == FALSE) {
+               scan_suppress = TRUE;
+               /* Set the SCAN SUPPRESS Flag in the firmware to skip join scan */
+               err = wldev_ioctl_set(dev, WLC_SET_SCANSUPPRESS,
+                       &scan_suppress, sizeof(int));
+               if (unlikely(err)) {
+                       WL_ERR(("Scan Suppress Setting Failed (%d)\n", err));
+                       return err;
+               }
+       }
+
+       join_params.params.chanspec_list[0] = chanspec;
+       join_params.params.chanspec_num = 1;
+       wldev_iovar_setint(dev, "chanspec", chanspec);
+       join_params_size = sizeof(join_params);
+
+       /* Disable Authentication, IBSS will add key if it required */
+       wldev_iovar_setint(dev, "wpa_auth", WPA_AUTH_DISABLED);
+       wldev_iovar_setint(dev, "wsec", 0);
+
+       err = wldev_ioctl_set(dev, WLC_SET_SSID, &join_params,
+               join_params_size);
+       if (unlikely(err)) {
+               WL_ERR(("IBSS set_ssid Error (%d)\n", err));
+               return err;
+       }
+
+       if (IBSS_INITIAL_SCAN_ALLOWED == FALSE) {
+               scan_suppress = FALSE;
+               /* Reset the SCAN SUPPRESS Flag */
+               err = wldev_ioctl_set(dev, WLC_SET_SCANSUPPRESS,
+                       &scan_suppress, sizeof(int));
+               if (unlikely(err)) {
+                       WL_ERR(("Reset Scan Suppress Flag Failed (%d)\n", err));
+                       return err;
+               }
+       }
+       wl_update_prof(cfg, dev, NULL, &join_params.ssid, WL_PROF_SSID);
+       wl_update_prof(cfg, dev, NULL, &cfg->channel, WL_PROF_CHAN);
+#ifdef WLAIBSS
+       cfg->aibss_txfail_seq = 0;      /* initialize the sequence */
+#endif /* WLAIBSS */
+#ifdef WL_RELMCAST
+       cfg->rmc_event_seq = 0; /* initialize rmcfail sequence */
+#endif /* WL_RELMCAST */
+       return err;
+}
+
+static s32 wl_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 err = 0;
+       scb_val_t scbval;
+       u8 *curbssid;
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+       wl_link_down(cfg);
+
+       WL_INFORM_MEM(("Leave IBSS\n"));
+       curbssid = wl_read_prof(cfg, dev, WL_PROF_BSSID);
+       wl_set_drv_status(cfg, DISCONNECTING, dev);
+       scbval.val = 0;
+       memcpy(&scbval.ea, curbssid, ETHER_ADDR_LEN);
+       err = wldev_ioctl_set(dev, WLC_DISASSOC, &scbval,
+               sizeof(scb_val_t));
+       if (unlikely(err)) {
+               wl_clr_drv_status(cfg, DISCONNECTING, dev);
+               WL_ERR(("error(%d)\n", err));
+               return err;
+       }
+
+       /* remove the VSIE */
+       wl_cfg80211_ibss_vsie_delete(dev);
+
+       return err;
+}
+
+#ifdef MFP
+static
+int wl_cfg80211_get_rsn_capa(const bcm_tlv_t *wpa2ie,
+       const u8** rsn_cap)
+{
+       u16 suite_count;
+       const wpa_suite_mcast_t *mcast;
+       const wpa_suite_ucast_t *ucast;
+       int len;
+       const wpa_suite_auth_key_mgmt_t *mgmt;
+
+       if (!wpa2ie)
+               return BCME_BADARG;
+
+       len = wpa2ie->len;
+
+       /* check for Multicast cipher suite */
+       if ((len -= (WPA_SUITE_LEN + WPA2_VERSION_LEN)) <= 0) {
+               return BCME_NOTFOUND;
+       }
+
+       mcast = (const wpa_suite_mcast_t *)&wpa2ie->data[WPA2_VERSION_LEN];
+
+       /* Check for the unicast suite(s) */
+       if (len < WPA_IE_SUITE_COUNT_LEN) {
+               return BCME_NOTFOUND;
+       }
+
+       ucast = (const wpa_suite_ucast_t *)&mcast[1];
+       suite_count = ltoh16_ua(&ucast->count);
+       if ((suite_count > NL80211_MAX_NR_CIPHER_SUITES) ||
+               (len -= (WPA_IE_SUITE_COUNT_LEN +
+               (WPA_SUITE_LEN * suite_count))) <= 0)
+               return BCME_BADLEN;
+
+       /* Check for AUTH key management suite(s) */
+       if (len < WPA_IE_SUITE_COUNT_LEN) {
+               return BCME_NOTFOUND;
+       }
+
+       mgmt = (const wpa_suite_auth_key_mgmt_t *)&ucast->list[suite_count];
+       suite_count = ltoh16_ua(&mgmt->count);
+
+       if ((suite_count <= NL80211_MAX_NR_CIPHER_SUITES) &&
+                       (len -= (WPA_IE_SUITE_COUNT_LEN +
+                       (WPA_SUITE_LEN * suite_count))) >= RSN_CAP_LEN) {
+               rsn_cap[0] = (const u8 *)&mgmt->list[suite_count];
+       } else {
+               return BCME_BADLEN;
+       }
+
+       return BCME_OK;
+}
+#endif /* MFP */
+
+static s32
+wl_set_wpa_version(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       struct wl_security *sec;
+       s32 val = 0;
+       s32 err = 0;
+       s32 bssidx;
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
+               val = WPA_AUTH_PSK |
+                       WPA_AUTH_UNSPECIFIED;
+       else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
+               val = WPA2_AUTH_PSK|
+                       WPA2_AUTH_UNSPECIFIED;
+       else
+               val = WPA_AUTH_DISABLED;
+
+       if (is_wps_conn(sme))
+               val = WPA_AUTH_DISABLED;
+
+#ifdef BCMWAPI_WPI
+       if (sme->crypto.wpa_versions & NL80211_WAPI_VERSION_1) {
+               WL_DBG((" * wl_set_wpa_version, set wpa_auth"
+                       " to WPA_AUTH_WAPI 0x400"));
+               val = WAPI_AUTH_PSK | WAPI_AUTH_UNSPECIFIED;
+       }
+#endif
+
+       WL_DBG_MEM(("[%s] wl wpa_auth 0x%0x\n", dev->name, val));
+       err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", val, bssidx);
+       if (unlikely(err)) {
+               WL_ERR(("set wpa_auth failed (%d)\n", err));
+               return err;
+       }
+       sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+       sec->wpa_versions = sme->crypto.wpa_versions;
+       return err;
+}
+
+#ifdef BCMWAPI_WPI
+static s32
+wl_set_set_wapi_ie(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       s32 err = 0;
+       s32 bssidx;
+
+       WL_DBG((" wl_set_set_wapi_ie\n"));
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       err = wldev_iovar_setbuf_bsscfg(dev, "wapiie", (const void *)sme->ie, sme->ie_len,
+                       cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("set_wapi_ie Error (%d)\n", err));
+               return err;
+       }
+       WL_DBG_MEM(("wapi_ie successfully (%s)\n", dev->name));
+       return err;
+}
+#endif /* BCMWAPI_WPI */
+
+static s32
+wl_set_auth_type(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       struct wl_security *sec;
+       s32 val = 0;
+       s32 err = 0;
+       s32 bssidx;
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       switch (sme->auth_type) {
+       case NL80211_AUTHTYPE_OPEN_SYSTEM:
+               val = WL_AUTH_OPEN_SYSTEM;
+               WL_DBG(("open system\n"));
+               break;
+       case NL80211_AUTHTYPE_SHARED_KEY:
+               val = WL_AUTH_SHARED_KEY;
+               WL_DBG(("shared key\n"));
+               break;
+       case NL80211_AUTHTYPE_AUTOMATIC:
+               val = WL_AUTH_OPEN_SHARED;
+               WL_DBG(("automatic\n"));
+               break;
+#ifdef WL_FILS
+       case NL80211_AUTHTYPE_FILS_SK:
+               WL_DBG(("fils shared key\n"));
+               val = WL_AUTH_FILS_SHARED;
+               break;
+       case NL80211_AUTHTYPE_FILS_SK_PFS:
+               val = WL_AUTH_FILS_SHARED_PFS;
+               WL_DBG(("fils shared key with pfs\n"));
+               break;
+       case NL80211_AUTHTYPE_FILS_PK:
+               WL_DBG(("fils public key\n"));
+               val = WL_AUTH_FILS_PUBLIC;
+               break;
+#endif /* WL_FILS */
+#if defined(WL_SAE) || defined(WL_CLIENT_SAE)
+       case NL80211_AUTHTYPE_SAE:
+               if (!wl_is_pmkid_available(dev, sme->bssid)) {
+                       val = WL_AUTH_SAE_KEY;
+               } else {
+                       /* Fw will choose right auth type
+                       * dynamically based on PMKID availability
+                       */
+                       val = WL_AUTH_OPEN_SHARED;
+               }
+               WL_DBG(("sae auth type %d\n", val));
+               break;
+#endif /* WL_SAE || WL_CLIENT_SAE */
+       default:
+               val = 2;
+               WL_ERR(("invalid auth type (%d)\n", sme->auth_type));
+               break;
+       }
+
+       WL_DBG_MEM(("[%s] wl auth 0x%0x \n", dev->name, val));
+       err = wldev_iovar_setint_bsscfg(dev, "auth", val, bssidx);
+       if (unlikely(err)) {
+               WL_ERR(("set auth failed (%d)\n", err));
+               return err;
+       }
+       sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+       sec->auth_type = sme->auth_type;
+       sec->fw_auth = val;
+       return err;
+}
+
+#ifdef WL_CLIENT_SAE
+static bool
+wl_is_pmkid_available(struct net_device *dev, const u8 *bssid)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       int i;
+       int npmkids = (cfg->pmk_list->pmkids.length - sizeof(uint16)*2) / sizeof(pmkid_v2_t);
+
+       /* check the bssid is null or not */
+       if (!bssid) return FALSE;
+
+       for (i = 0; i < npmkids; i++) {
+               if (!memcmp(bssid, &cfg->pmk_list->pmkids.pmkid[i].bssid, ETHER_ADDR_LEN)) {
+                       WL_DBG(("FOUND PMKID\n"));
+                       return TRUE;
+               }
+       }
+       WL_ERR(("PMKID NOT FOUND\n"));
+       return FALSE;
+}
+#endif /* WL_CLIENT_SAE */
+
+static u32
+wl_rsn_cipher_wsec_algo_lookup(uint32 cipher)
+{
+       uint i;
+
+       for (i = 0; i < ARRAYSIZE(rsn_cipher_algo_lookup_tbl); i++) {
+               if (cipher == rsn_cipher_algo_lookup_tbl[i].cipher_suite) {
+                       return rsn_cipher_algo_lookup_tbl[i].wsec_algo;
+               }
+       }
+       return WSEC_NONE;
+}
+
+static u32
+wl_rsn_cipher_wsec_key_algo_lookup(uint32 cipher)
+{
+       uint i;
+
+       for (i = 0; i < ARRAYSIZE(rsn_cipher_algo_lookup_tbl); i++) {
+               if (cipher == rsn_cipher_algo_lookup_tbl[i].cipher_suite) {
+                       return rsn_cipher_algo_lookup_tbl[i].wsec_key_algo;
+               }
+       }
+       return CRYPTO_ALGO_OFF;
+}
+
+static u32
+wl_rsn_akm_wpa_auth_lookup(uint32 akm)
+{
+       uint i;
+
+       for (i = 0; i < ARRAYSIZE(rsn_akm_wpa_auth_lookup_tbl); i++) {
+               if (akm == rsn_akm_wpa_auth_lookup_tbl[i].akm_suite) {
+                       return rsn_akm_wpa_auth_lookup_tbl[i].wpa_auth;
+               }
+       }
+       return WPA_AUTH_DISABLED;
+}
+
+static s32
+wl_set_set_cipher(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       struct wl_security *sec;
+       s32 pval = 0;
+       s32 gval = 0;
+       s32 err = 0;
+       s32 wsec_val = 0;
+
+#ifdef BCMWAPI_WPI
+       s32 wapi_val = 0;
+       s32 val = 0;
+#endif
+
+       s32 bssidx;
+#ifdef WL_GCMP
+       uint32 algos = 0, mask = 0;
+#endif /* WL_GCMP */
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if (sme->crypto.n_ciphers_pairwise) {
+               pval = wl_rsn_cipher_wsec_algo_lookup(sme->crypto.ciphers_pairwise[0]);
+               if (pval == WSEC_NONE) {
+                       WL_ERR(("Invalid cipher (0x%x)\n",
+                               sme->crypto.ciphers_pairwise[0]));
+                       return BCME_BADARG;
+               }
+               switch (sme->crypto.ciphers_pairwise[0]) {
+
+#ifdef BCMWAPI_WPI
+               case WLAN_CIPHER_SUITE_SMS4:
+                       val = pval;
+                       err = wl_set_set_wapi_ie(dev, sme);
+                       if (unlikely(err)) {
+                               WL_DBG(("Set wapi ie failed  \n"));
+                               return err;
+                       } else {
+                               WL_DBG(("Set wapi ie succeded\n"));
+                       }
+                       wapi_val = WAPI_AUTH_PSK | WAPI_AUTH_UNSPECIFIED;
+                       WL_DBG_MEM(("[WAPI] wl wpa_auth to 0x%0x (%s)\n", val, dev->name));
+                       err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", wapi_val, bssidx);
+                       if (unlikely(err)) {
+                               WL_ERR(("set wpa_auth failed (%d)\n", err));
+                               return err;
+                       }
+                       break;
+#endif /* BCMWAPI_WPI */
+
+#ifdef WL_GCMP
+               case WLAN_CIPHER_SUITE_GCMP:
+               case WLAN_CIPHER_SUITE_GCMP_256:
+                       algos = KEY_ALGO_MASK(wl_rsn_cipher_wsec_key_algo_lookup(
+                                       sme->crypto.ciphers_pairwise[0]));
+                       mask = algos | KEY_ALGO_MASK(CRYPTO_ALGO_AES_CCM);
+                       break;
+#endif /* WL_GCMP */
+               default: /* No post processing required */
+                       break;
+               }
+       }
+#if defined(BCMSUP_4WAY_HANDSHAKE)
+       /* Ensure in-dongle supplicant is turned on when FBT wants to do the 4-way
+        * handshake.
+        * Note that the FW feature flag only exists on kernels that support the
+        * FT-EAP AKM suite.
+        */
+       if (cfg->wdev->wiphy->features & NL80211_FEATURE_FW_4WAY_HANDSHAKE) {
+               err = wldev_iovar_setint_bsscfg(dev, "sup_wpa", 1, bssidx);
+               if (err) {
+                       WL_ERR(("FBT: Error setting sup_wpa (%d)\n", err));
+                       return err;
+               } else {
+                       WL_INFORM_MEM(("idsup enabled.\n"));
+               }
+       }
+#endif /* BCMSUP_4WAY_HANDSHAKE */
+       if (sme->crypto.cipher_group) {
+               gval = wl_rsn_cipher_wsec_algo_lookup(sme->crypto.cipher_group);
+               if (gval == WSEC_NONE) {
+                       WL_ERR(("invalid cipher group (0x%x)\n", sme->crypto.cipher_group));
+                       return BCME_BADARG;
+               }
+               switch (sme->crypto.cipher_group) {
+
+#ifdef BCMWAPI_WPI
+               case WLAN_CIPHER_SUITE_SMS4:
+                       val = gval;
+                       break;
+#endif
+
+#ifdef WL_GCMP
+               case WLAN_CIPHER_SUITE_GCMP:
+               case WLAN_CIPHER_SUITE_GCMP_256:
+                       algos = KEY_ALGO_MASK(
+                               wl_rsn_cipher_wsec_key_algo_lookup(sme->crypto.cipher_group));
+                       mask = algos | KEY_ALGO_MASK(CRYPTO_ALGO_AES_CCM);
+                       break;
+#endif /* WL_GCMP */
+               default: /* No post processing required */
+                       break;
+               }
+       }
+
+       WL_DBG(("pval (%d) gval (%d)\n", pval, gval));
+#ifdef WL_GCMP
+       WL_DBG(("algos:%x, mask:%x", algos, mask));
+#endif /* WL_GCMP */
+
+       if (is_wps_conn(sme)) {
+               if (sme->privacy) {
+                       wsec_val = 4;
+               } else {
+                       /* WPS-2.0 allows no security */
+                       wsec_val = 0;
+               }
+       } else {
+
+#ifdef BCMWAPI_WPI
+               if (sme->crypto.cipher_group == WLAN_CIPHER_SUITE_SMS4) {
+                       WL_DBG((" NO, is_wps_conn, WAPI set to SMS4_ENABLED"));
+                       wsec_val = val;
+               } else
+#endif
+
+               {
+                       WL_DBG((" NO, is_wps_conn, Set pval | gval to WSEC"));
+                       wsec_val = pval | gval;
+               }
+       }
+
+       WL_DBG_MEM(("[%s] wl wsec 0x%x\n", dev->name, wsec_val));
+       err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec_val, bssidx);
+       if (unlikely(err)) {
+               WL_ERR(("error (%d)\n", err));
+               return err;
+       }
+#ifdef WL_GCMP
+       if (wl_set_wsec_info_algos(dev, algos, mask)) {
+               WL_ERR(("set wsec_info error (%d)\n", err));
+       }
+#endif /* WL_GCMP */
+       sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+       sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
+       sec->cipher_group = sme->crypto.cipher_group;
+       sec->fw_wsec = wsec_val;
+       return err;
+}
+#ifdef WL_GCMP
+static s32
+wl_set_wsec_info_algos(struct net_device *dev, uint32 algos, uint32 mask)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       s32 bssidx;
+       s32 err = 0;
+       wl_wsec_info_t *wsec_info;
+       bcm_xtlv_t *wsec_info_tlv;
+       uint16 tlv_data_len;
+       uint32 tlv_data[2];
+       uint32 param_len;
+       uint8 * buf;
+
+       WL_DBG(("enter.\n"));
+       if (!cfg) {
+               return BCME_ERROR;
+       }
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       buf = MALLOCZ(cfg->osh, sizeof(wl_wsec_info_t) + sizeof(tlv_data));
+       if (!buf) {
+               WL_ERR(("No memory"));
+               return BCME_NOMEM;
+       }
+       wsec_info = (wl_wsec_info_t *)buf;
+       wsec_info->version = WL_WSEC_INFO_VERSION;
+       wsec_info_tlv = (bcm_xtlv_t *)(buf + OFFSETOF(wl_wsec_info_t, tlvs));
+
+       wsec_info->num_tlvs++;
+       tlv_data_len = sizeof(tlv_data);
+       tlv_data[0] = algos;
+       tlv_data[1] = mask;
+
+       bcm_xtlv_pack_xtlv(wsec_info_tlv, WL_WSEC_INFO_BSS_ALGOS, tlv_data_len,
+               (const uint8 *)tlv_data, 0);
+       param_len = OFFSETOF(wl_wsec_info_t, tlvs) + WL_WSEC_INFO_TLV_HDR_LEN + tlv_data_len;
+
+       err = wldev_iovar_setbuf_bsscfg(dev, "wsec_info", wsec_info, param_len,
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+
+       MFREE(cfg->osh, buf, sizeof(wl_wsec_info_t) + sizeof(tlv_data));
+       return err;
+}
+#endif /* WL_GCMP */
+
+#ifdef WL_SAE
+s32
+wl_cfg80211_set_wsec_info(struct net_device *dev, uint32 *data,
+       uint16 data_len, int tag)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       s32 bssidx;
+       s32 err = 0;
+       wl_wsec_info_t *wsec_info;
+       bcm_xtlv_t *bcm_info_tlv;
+       uint32 param_len;
+       uint8 *buf = NULL;
+
+       if (!cfg) {
+               return BCME_ERROR;
+       }
+
+       if (data_len > WLC_IOCTL_SMLEN) {
+               err = BCME_BADLEN;
+               goto exit;
+       }
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               err = BCME_ERROR;
+               goto exit;
+       }
+
+       buf = MALLOCZ(cfg->osh, sizeof(wl_wsec_info_t) + data_len);
+       if (!buf) {
+               WL_ERR(("No memory"));
+               err = BCME_NOMEM;
+               goto exit;
+       }
+
+       wsec_info = (wl_wsec_info_t *)buf;
+       bzero(wsec_info, sizeof(wl_wsec_info_t) + data_len);
+       wsec_info->version = WL_WSEC_INFO_VERSION;
+       bcm_info_tlv = (bcm_xtlv_t *)(buf + OFFSETOF(wl_wsec_info_t, tlvs));
+
+       wsec_info->num_tlvs++;
+
+       bcm_xtlv_pack_xtlv(bcm_info_tlv, tag, data_len, (const u8*)data, 0);
+       param_len = OFFSETOF(wl_wsec_info_t, tlvs) + WL_WSEC_INFO_TLV_HDR_LEN + data_len;
+
+       err = wldev_iovar_setbuf_bsscfg(dev, "wsec_info", wsec_info, param_len,
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("set wsec_info error (%d)\n", err));
+       }
+
+exit:
+       if (buf)
+               MFREE(cfg->osh, buf, sizeof(wl_wsec_info_t) + data_len);
+       return err;
+}
+#endif /* SAE */
+
+#ifdef MFP
+static s32
+wl_cfg80211_set_mfp(struct bcm_cfg80211 *cfg,
+       struct net_device *dev,
+       struct cfg80211_connect_params *sme)
+{
+       s32 mfp = WL_MFP_NONE;
+       s32 current_mfp = WL_MFP_NONE;
+       const bcm_tlv_t *wpa2_ie;
+       const u8* rsn_cap = NULL;
+       bool fw_support = false;
+       int err, count = 0;
+       const u8 *eptr = NULL, *ptr = NULL;
+       const u8* group_mgmt_cs = NULL;
+       const wpa_pmkid_list_t* pmkid = NULL;
+       struct wl_security *sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+
+       if (!sme) {
+               /* No connection params from userspace, Do nothing. */
+               return 0;
+       }
+
+       /* Check fw support and retreive current mfp val */
+       err = wldev_iovar_getint(dev, "mfp", &current_mfp);
+       if (!err) {
+               fw_support = true;
+       }
+
+       /* Parse the wpa2ie to decode the MFP capablity */
+       if (((wpa2_ie = bcm_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
+                       DOT11_MNG_RSN_ID)) != NULL) &&
+                       (wl_cfg80211_get_rsn_capa(wpa2_ie, &rsn_cap) == 0) && rsn_cap) {
+               WL_DBG(("rsn_cap 0x%x%x\n", rsn_cap[0], rsn_cap[1]));
+               /* Check for MFP cap in the RSN capability field */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
+               if (sme->mfp)
+#endif
+               {
+                       if (rsn_cap[0] & RSN_CAP_MFPR) {
+                               mfp = WL_MFP_REQUIRED;
+                       } else if (rsn_cap[0] & RSN_CAP_MFPC) {
+                               mfp = WL_MFP_CAPABLE;
+                       }
+               }
+               /*
+                * eptr --> end/last byte addr of wpa2_ie
+                * ptr --> to keep track of current/required byte addr
+                */
+               eptr = (const u8*)wpa2_ie + (wpa2_ie->len + TLV_HDR_LEN);
+               /* pointing ptr to the next byte after rns_cap */
+               ptr = (const u8*)rsn_cap + RSN_CAP_LEN;
+               if (mfp && (eptr - ptr) >= WPA2_PMKID_COUNT_LEN) {
+                       /* pmkid now to point to 1st byte addr of pmkid in wpa2_ie */
+                       pmkid = (const wpa_pmkid_list_t*)ptr;
+                       count = pmkid->count.low | (pmkid->count.high << 8);
+                       /* ptr now to point to last byte addr of pmkid */
+                       ptr = (const u8*)pmkid + (count * WPA2_PMKID_LEN
+                                       + WPA2_PMKID_COUNT_LEN);
+                       if ((eptr - ptr) >= WPA_SUITE_LEN) {
+                               /* group_mgmt_cs now to point to first byte addr of bip */
+                               group_mgmt_cs = ptr;
+                       }
+               }
+       }
+
+       WL_DBG(("mfp:%d wpa2_ie ptr:%p mfp fw_support:%d\n",
+               mfp, wpa2_ie, fw_support));
+
+       if (fw_support == false) {
+               if (mfp == WL_MFP_REQUIRED) {
+                       /* if mfp > 0, mfp capability set in wpa ie, but
+                        * FW indicated error for mfp. Propagate the error up.
+                        */
+                       WL_ERR(("mfp capability found in wpaie. But fw doesn't "
+                               "seem to support MFP\n"));
+                       err = -EINVAL;
+                       goto exit;
+               } else {
+                       /* Firmware doesn't support mfp. But since connection request
+                        * is for non-mfp case, don't bother.
+                        */
+                       err = BCME_OK;
+                       goto exit;
+               }
+       } else if (mfp != current_mfp) {
+               /* Some FW brances report error (-5) during MFP set if the BSS
+                * is up (roam case). Typically in roaming cases, the MFP
+                * configuration doesn't change. So in roam/reassoc cases, there is
+                * no need to update the fw state. If we still hit corner cases
+                * throwing (-5) error, we need to pull in RB:59117.
+                */
+               err = wldev_iovar_setint(dev, "mfp", mfp);
+               if (unlikely(err)) {
+                       WL_ERR(("mfp (%d) set failed ret:%d \n", mfp, err));
+                       goto exit;
+               }
+               WL_DBG_MEM(("[%s] wl mfp 0x%x\n", dev->name, mfp));
+       }
+
+       if (sec) {
+               sec->fw_mfp = mfp;
+       }
+
+       if (group_mgmt_cs && bcmp((const uint8 *)WPA2_OUI,
+                       group_mgmt_cs, (WPA_SUITE_LEN - 1)) == 0) {
+               WL_DBG(("BIP is found\n"));
+               err = wldev_iovar_setbuf(dev, "bip",
+                       group_mgmt_cs, WPA_SUITE_LEN, cfg->ioctl_buf,
+                       WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync);
+               /*
+                * Dont return failure for unsupported cases
+                * of bip iovar for backward compatibility
+                */
+               if (err != BCME_UNSUPPORTED && err < 0) {
+                       WL_ERR(("bip set error (%d)\n", err));
+
+                               {
+                                       goto exit;
+                               }
+               } else {
+                       WL_INFORM_MEM(("[%s] wl bip %02X:%02X:%02X\n",
+                               dev->name, group_mgmt_cs[0], group_mgmt_cs[1],
+                               group_mgmt_cs[2]));
+               }
+       }
+exit:
+       if (err) {
+               wl_flush_fw_log_buffer(bcmcfg_to_prmry_ndev(cfg),
+                       FW_LOGSET_MASK_ALL);
+       }
+
+       return 0;
+}
+#endif /* MFP */
+
+#ifdef WL_FILS
+bool
+wl_is_fils_supported(struct net_device *ndev)
+{
+       s32 err;
+       u8 ioctl_buf[WLC_IOCTL_SMLEN] = {0};
+       bcm_iov_buf_t *iov_buf = (bcm_iov_buf_t *)ioctl_buf;
+
+       iov_buf->version = WL_FILS_IOV_VERSION;
+       err = wldev_iovar_getbuf(ndev, "fils", (uint8*)iov_buf, sizeof(bcm_iov_buf_t),
+               iov_buf, WLC_IOCTL_SMLEN, NULL);
+       if (err == BCME_UNSUPPORTED) {
+               WL_DBG(("FILS NOT supported\n"));
+               return false;
+       }
+
+       WL_INFORM(("FILS supported\n"));
+       return true;
+}
+
+#define WL_NUM_OF_TLV_IN_SET_FILS_PARAMS       4u
+static s32
+wl_set_fils_params(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       bcm_iov_buf_t *iov_buf = NULL;
+       bcm_xtlvbuf_t tbuf;
+       s32 err = BCME_OK;
+       uint32 buf_size;
+
+       if ((sme->auth_type != NL80211_AUTHTYPE_FILS_SK) &&
+               (sme->auth_type != NL80211_AUTHTYPE_FILS_SK_PFS) &&
+               (sme->auth_type != NL80211_AUTHTYPE_FILS_PK)) {
+               return BCME_OK;
+       }
+       if (sme->fils_erp_rrk_len > WL_MAX_FILS_KEY_LEN) {
+               WL_ERR(("%s: FILS rRK exceed allowed size\n", __FUNCTION__));
+               err = BCME_BADARG;
+               goto exit;
+       }
+       /* Check incoming buffer length */
+       buf_size = sme->fils_erp_username_len + sme->fils_erp_realm_len + sme->fils_erp_rrk_len +
+               sizeof(sme->fils_erp_next_seq_num) +
+               WL_NUM_OF_TLV_IN_SET_FILS_PARAMS * BCM_XTLV_HDR_SIZE_EX(BCM_XTLV_OPTION_ALIGN32) +
+               sizeof(bcm_iov_buf_t) - 1u;
+
+       if (buf_size > WLC_IOCTL_SMLEN) {
+               WL_ERR(("%s: FILS connect params arguments exceed allowed size\n", __FUNCTION__));
+               err = BCME_BADARG;
+               goto exit;
+       }
+       iov_buf = MALLOCZ(cfg->osh, WLC_IOCTL_SMLEN);
+       if (!iov_buf) {
+               WL_ERR(("%s: iov_buf alloc failed! %d bytes\n", __FUNCTION__, WLC_IOCTL_SMLEN));
+               err = BCME_NOMEM;
+               goto exit;
+       }
+       iov_buf->version = WL_FILS_IOV_VERSION;
+       iov_buf->id = WL_FILS_CMD_ADD_CONNECT_PARAMS;
+       /* check if this should be len w/o headers */
+       err = bcm_xtlv_buf_init(&tbuf, (uint8*)&iov_buf->data[0],
+               WLC_IOCTL_SMLEN - sizeof(bcm_iov_buf_t) + sizeof(uint16),
+               BCM_XTLV_OPTION_ALIGN32);
+       if (err != BCME_OK) {
+               WL_ERR(("%s: xtlv_context initialization failed\n", __FUNCTION__));
+               goto exit;
+       }
+       if (sme->fils_erp_username_len && sme->fils_erp_username != NULL) {
+               err = bcm_xtlv_put_data(&tbuf, WL_FILS_XTLV_ERP_USERNAME,
+                       sme->fils_erp_username, sme->fils_erp_username_len);
+               if (err != BCME_OK) {
+                       WL_ERR(("%s: write xtlv failed\n", __FUNCTION__));
+                       goto exit;
+               }
+       }
+       if (sme->fils_erp_realm_len && sme->fils_erp_realm != NULL) {
+               err = bcm_xtlv_put_data(&tbuf, WL_FILS_XTLV_ERP_REALM,
+                       sme->fils_erp_realm, sme->fils_erp_realm_len);
+               if (err != BCME_OK) {
+                       WL_ERR(("%s: write xtlv failed\n", __FUNCTION__));
+                       goto exit;
+               }
+       }
+       if (sme->fils_erp_rrk_len && sme->fils_erp_rrk != NULL) {
+               err = bcm_xtlv_put_data(&tbuf, WL_FILS_XTLV_ERP_RRK,
+                       sme->fils_erp_rrk, sme->fils_erp_rrk_len);
+               if (err != BCME_OK) {
+                       WL_ERR(("%s: write xtlv failed\n", __FUNCTION__));
+                       goto exit;
+               }
+       }
+       err = bcm_xtlv_put_data(&tbuf, WL_FILS_XTLV_ERP_NEXT_SEQ_NUM,
+                       (u8 *)&sme->fils_erp_next_seq_num, sizeof(sme->fils_erp_next_seq_num));
+       if (err != BCME_OK) {
+               WL_ERR(("%s: write xtlv failed\n", __FUNCTION__));
+               goto exit;
+       }
+       iov_buf->len = bcm_xtlv_buf_len(&tbuf);
+       err = wldev_iovar_setbuf(dev, "fils", iov_buf, iov_buf->len + sizeof(bcm_iov_buf_t) -
+               sizeof(uint16), cfg->ioctl_buf, WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+                WL_ERR(("set fils params ioctl error (%d)\n", err));
+                goto exit;
+       }
+
+exit:
+       if (err != BCME_OK) {
+               WL_ERR(("set FILS params error %d\n", err));
+       }
+       else {
+               WL_DBG_MEM(("FILS parameters succesfully applied\n"));
+       }
+       if (iov_buf) {
+               MFREE(cfg->osh, iov_buf, WLC_IOCTL_SMLEN);
+       }
+       return err;
+}
+
+#if !defined(WL_FILS_ROAM_OFFLD) && defined(WL_FILS)
+static s32
+wl_get_bcn_timeout(struct net_device *dev, u32 *bcn_timeout)
+{
+       s32 err = 0;
+
+       err = wldev_iovar_getint(dev, "bcn_timeout", bcn_timeout);
+       if (unlikely(err)) {
+               WL_ERR(("could not get bcn_timeout (%d)\n", err));
+       }
+       return err;
+}
+
+#define WL_ROAM_ENABLE 0
+#define WL_ROAM_DISABLE 1
+/* Beacon Timeout beacon loss in case FILS roaming offload is not supported by fw */
+#define WL_BCN_TIMEOUT 3
+
+static s32
+wl_fils_toggle_roaming(struct net_device *dev, u32 auth_type)
+{
+       s32 err = 0;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       if (WPA2_AUTH_IS_FILS(auth_type) && !cfg->fils_info.fils_roam_disabled) {
+               err = wl_get_bcn_timeout(dev, &cfg->fils_info.fils_bcn_timeout_cache);
+               if (unlikely(err)) {
+                       return err;
+               }
+               wl_dongle_roam(dev, WL_ROAM_DISABLE, WL_BCN_TIMEOUT);
+               cfg->fils_info.fils_roam_disabled = true;
+               WL_DBG_MEM(("fw roam disabled for FILS akm\n"));
+       } else if (cfg->fils_info.fils_roam_disabled) {
+               /* Enable roaming back for other auth types */
+               wl_dongle_roam(dev, WL_ROAM_ENABLE, cfg->fils_info.fils_bcn_timeout_cache);
+               cfg->fils_info.fils_roam_disabled = false;
+               WL_DBG_MEM(("fw roam enabled\n"));
+       }
+       return err;
+}
+#endif /* !WL_FILS_ROAM_OFFLD && WL_FILS */
+#endif /* WL_FILS */
+
+static s32
+wl_set_key_mgmt(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       struct wl_security *sec;
+       s32 val = 0;
+       s32 err = 0;
+       s32 bssidx;
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if (sme->crypto.n_akm_suites) {
+               err = wldev_iovar_getint(dev, "wpa_auth", &val);
+               if (unlikely(err)) {
+                       WL_ERR(("could not get wpa_auth (%d)\n", err));
+                       return err;
+               }
+               if (val & (WPA_AUTH_PSK |
+                       WPA_AUTH_UNSPECIFIED)) {
+                       switch (sme->crypto.akm_suites[0]) {
+                       case WLAN_AKM_SUITE_8021X:
+                               val = WPA_AUTH_UNSPECIFIED;
+                               break;
+                       case WLAN_AKM_SUITE_PSK:
+                               val = WPA_AUTH_PSK;
+                               break;
+                       default:
+                               WL_ERR(("invalid akm suite (0x%x)\n",
+                                       sme->crypto.akm_suites[0]));
+                               return -EINVAL;
+                       }
+               } else if (val & (WPA2_AUTH_PSK |
+                       WPA2_AUTH_UNSPECIFIED)) {
+                       switch (sme->crypto.akm_suites[0]) {
+#ifdef MFP
+
+                       case WL_AKM_SUITE_SHA256_1X:
+                               val = WPA2_AUTH_1X_SHA256;
+                               break;
+                       case WL_AKM_SUITE_SHA256_PSK:
+                               val = WPA2_AUTH_PSK_SHA256;
+                               break;
+#endif /* MFP */
+                       case WLAN_AKM_SUITE_8021X:
+                       case WLAN_AKM_SUITE_PSK:
+#if defined(WLFBT) && defined(WLAN_AKM_SUITE_FT_8021X)
+                       case WLAN_AKM_SUITE_FT_8021X:
+#endif
+#if defined(WLFBT) && defined(WLAN_AKM_SUITE_FT_PSK)
+                       case WLAN_AKM_SUITE_FT_PSK:
+#endif
+                       case WLAN_AKM_SUITE_FILS_SHA256:
+                       case WLAN_AKM_SUITE_FILS_SHA384:
+                       case WLAN_AKM_SUITE_8021X_SUITE_B:
+                       case WLAN_AKM_SUITE_8021X_SUITE_B_192:
+#ifdef WL_OWE
+                       case WLAN_AKM_SUITE_OWE:
+#endif /* WL_OWE */
+#ifdef WL_SAE_FT
+                       case WLAN_AKM_SUITE_FT_OVER_SAE:
+#endif /* WL_SAE_FT */
+                       case WLAN_AKM_SUITE_DPP:
+                       case WLAN_AKM_SUITE_FT_8021X_SHA384:
+                               val = wl_rsn_akm_wpa_auth_lookup(sme->crypto.akm_suites[0]);
+                               break;
+                       case WLAN_AKM_SUITE_FT_FILS_SHA256:
+                               val = WPA2_AUTH_FILS_SHA256 | WPA2_AUTH_FT;
+                               break;
+                       case WLAN_AKM_SUITE_FT_FILS_SHA384:
+                               val = WPA2_AUTH_FILS_SHA384 | WPA2_AUTH_FT;
+                               break;
+#if defined(WL_SAE) || defined(WL_CLIENT_SAE)
+                       case WLAN_AKM_SUITE_SAE:
+                               val = WPA3_AUTH_SAE_PSK;
+                               break;
+#endif /* WL_SAE || WL_CLIENT_SAE */
+                       default:
+                               WL_ERR(("invalid akm suite (0x%x)\n",
+                                       sme->crypto.akm_suites[0]));
+                               return -EINVAL;
+                       }
+               }
+
+#ifdef BCMWAPI_WPI
+               else if (val & (WAPI_AUTH_PSK | WAPI_AUTH_UNSPECIFIED)) {
+                       switch (sme->crypto.akm_suites[0]) {
+                       case WLAN_AKM_SUITE_WAPI_CERT:
+                               val = WAPI_AUTH_UNSPECIFIED;
+                               break;
+                       case WLAN_AKM_SUITE_WAPI_PSK:
+                               val = WAPI_AUTH_PSK;
+                               break;
+                       default:
+                               WL_ERR(("invalid akm suite (0x%x)\n",
+                                       sme->crypto.akm_suites[0]));
+                               return -EINVAL;
+                       }
+               }
+#endif
+
+#ifdef WL_FILS
+#if !defined(WL_FILS_ROAM_OFFLD)
+       err = wl_fils_toggle_roaming(dev, val);
+       if (unlikely(err)) {
+               return err;
+       }
+#endif /* !WL_FILS_ROAM_OFFLD */
+#endif /* !WL_FILS */
+
+#ifdef MFP
+               if ((err = wl_cfg80211_set_mfp(cfg, dev, sme)) < 0) {
+                       WL_ERR(("MFP set failed err:%d\n", err));
+                       return -EINVAL;
+               }
+#endif /* MFP */
+
+               WL_DBG_MEM(("[%s] wl wpa_auth to 0x%x\n", dev->name, val));
+               err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", val, bssidx);
+               if (unlikely(err)) {
+                       WL_ERR(("could not set wpa_auth (0x%x)\n", err));
+                       return err;
+               }
+       }
+       sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+       sec->wpa_auth = sme->crypto.akm_suites[0];
+       sec->fw_wpa_auth = val;
+
+       return err;
+}
+
+static s32
+wl_set_set_sharedkey(struct net_device *dev,
+       struct cfg80211_connect_params *sme)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       struct wl_security *sec;
+       struct wl_wsec_key key;
+       s32 val;
+       s32 err = 0;
+       s32 bssidx;
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       WL_DBG(("key len (%d)\n", sme->key_len));
+       if (sme->key_len) {
+               sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+               WL_DBG(("wpa_versions 0x%x cipher_pairwise 0x%x\n",
+                       sec->wpa_versions, sec->cipher_pairwise));
+               if (!(sec->wpa_versions & (NL80211_WPA_VERSION_1 |
+                       NL80211_WPA_VERSION_2)) &&
+
+#ifdef BCMWAPI_WPI
+                       !is_wapi(sec->cipher_pairwise) &&
+#endif
+
+                       (sec->cipher_pairwise & (WLAN_CIPHER_SUITE_WEP40 |
+                       WLAN_CIPHER_SUITE_WEP104)))
+               {
+                       bzero(&key, sizeof(key));
+                       key.len = (u32) sme->key_len;
+                       key.index = (u32) sme->key_idx;
+                       if (unlikely(key.len > sizeof(key.data))) {
+                               WL_ERR(("Too long key length (%u)\n", key.len));
+                               return -EINVAL;
+                       }
+                       memcpy(key.data, sme->key, key.len);
+                       key.flags = WL_PRIMARY_KEY;
+                       if ((sec->cipher_pairwise == WLAN_CIPHER_SUITE_WEP40) ||
+                           (sec->cipher_pairwise == WLAN_CIPHER_SUITE_WEP104)) {
+                               key.algo = wl_rsn_cipher_wsec_key_algo_lookup(sec->cipher_pairwise);
+                       } else {
+                               WL_ERR(("Invalid algorithm (%d)\n",
+                                       sme->crypto.ciphers_pairwise[0]));
+                               return -EINVAL;
+                       }
+                       /* Set the new key/index */
+                       WL_DBG(("key length (%d) key index (%d) algo (%d)\n",
+                               key.len, key.index, key.algo));
+                       WL_DBG(("key \"%s\"\n", key.data));
+                       swap_key_from_BE(&key);
+                       err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key),
+                               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+                       if (unlikely(err)) {
+                               WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+                               return err;
+                       }
+                       WL_INFORM_MEM(("key applied to fw\n"));
+                       if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
+                               WL_DBG(("set auth_type to shared key\n"));
+                               val = WL_AUTH_SHARED_KEY;       /* shared key */
+                               err = wldev_iovar_setint_bsscfg(dev, "auth", val, bssidx);
+                               if (unlikely(err)) {
+                                       WL_ERR(("set auth failed (%d)\n", err));
+                                       return err;
+                               }
+                       }
+               }
+       }
+       return err;
+}
+
+#if defined(CUSTOM_SET_CPUCORE) || defined(CONFIG_TCPACK_FASTTX)
+static bool wl_get_chan_isvht80(struct net_device *net, dhd_pub_t *dhd)
+{
+       u32 chanspec = 0;
+       bool isvht80 = 0;
+
+       if (wldev_iovar_getint(net, "chanspec", (s32 *)&chanspec) == BCME_OK)
+               chanspec = wl_chspec_driver_to_host(chanspec);
+
+       isvht80 = chanspec & WL_CHANSPEC_BW_80;
+       WL_DBG(("wl_get_chan_isvht80: chanspec(%x:%d)\n", chanspec, isvht80));
+
+       return isvht80;
+}
+#endif /* CUSTOM_SET_CPUCORE || CONFIG_TCPACK_FASTTX */
+
+int wl_cfg80211_cleanup_mismatch_status(struct net_device *dev, struct bcm_cfg80211 *cfg,
+       bool disassociate)
+{
+       scb_val_t scbval;
+       int err = TRUE;
+       int wait_cnt;
+
+       if (disassociate) {
+               dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+               BCM_REFERENCE(dhdp);
+               DHD_STATLOG_CTRL(dhdp, ST(DISASSOC_INT_START),
+                       dhd_net2idx(dhdp->info, dev), DOT11_RC_DISASSOC_LEAVING);
+               WL_ERR(("Disassociate previous connection!\n"));
+               wl_set_drv_status(cfg, DISCONNECTING, dev);
+               scbval.val = DOT11_RC_DISASSOC_LEAVING;
+               scbval.val = htod32(scbval.val);
+
+               err = wldev_ioctl_set(dev, WLC_DISASSOC, &scbval,
+                               sizeof(scb_val_t));
+               if (unlikely(err)) {
+                       wl_clr_drv_status(cfg, DISCONNECTING, dev);
+                       WL_ERR(("error (%d)\n", err));
+                       return err;
+               }
+               wait_cnt = 500/10;
+       } else {
+               wait_cnt = 200/10;
+               WL_ERR(("Waiting for previous DISCONNECTING status!\n"));
+               if (wl_get_drv_status(cfg, DISCONNECTING, dev)) {
+                       wl_clr_drv_status(cfg, DISCONNECTING, dev);
+               }
+       }
+
+       while (wl_get_drv_status(cfg, DISCONNECTING, dev) && wait_cnt) {
+               WL_DBG(("Waiting for disconnection terminated, wait_cnt: %d\n",
+                       wait_cnt));
+               wait_cnt--;
+               OSL_SLEEP(10);
+       }
+
+       if (wait_cnt == 0) {
+               WL_ERR(("DISCONNECING clean up failed!\n"));
+               /* Clear DISCONNECTING driver status as we have made sufficient attempts
+               * for driver clean up.
+               */
+               wl_clr_drv_status(cfg, DISCONNECTING, dev);
+               wl_clr_drv_status(cfg, CONNECTED, dev);
+               return BCME_NOTREADY;
+       }
+       return BCME_OK;
+}
+
+#ifdef WL_FILS
+static int
+wl_fils_add_hlp_container(struct bcm_cfg80211 *cfg, struct net_device *dev,
+       const uint8* ie_buf, uint16 ie_len)
+{
+       const bcm_tlv_ext_t *hlp_ie;
+
+       if ((hlp_ie = (const bcm_tlv_ext_t*)bcm_parse_tlvs_dot11((const uint8 *)ie_buf, ie_len,
+               FILS_HLP_CONTAINER_EXT_ID, TRUE))) {
+               u16 hlp_len = hlp_ie->len;
+               u16 left_len = (ie_len - ((const uint8*)hlp_ie - ie_buf));
+               bcm_iov_buf_t *iov_buf = 0;
+               uint8* pxtlv;
+               int err;
+               size_t iov_buf_len;
+               bcm_tlv_dot11_frag_tot_len(ie_buf, ie_len, FILS_HLP_CONTAINER_EXT_ID,
+                       TRUE, (uint*)&hlp_len);
+
+               hlp_len += BCM_TLV_EXT_HDR_SIZE;
+
+               if ((hlp_len > DOT11_MAX_MPDU_BODY_LEN) || (hlp_len > left_len)) {
+                       WL_ERR(("bad HLP length %d\n", hlp_len));
+                       return EFAULT;
+               }
+               iov_buf_len = sizeof(bcm_iov_buf_t) + sizeof(bcm_xtlv_t) - 1 + hlp_len;
+               iov_buf = MALLOCZ(cfg->osh, iov_buf_len);
+               if (iov_buf == NULL) {
+                       WL_ERR(("failed to allocated iov_buf\n"));
+                       return ENOMEM;
+               }
+
+               prhex("HLP, HLP", (const uchar *)hlp_ie, hlp_len);
+
+               pxtlv = (uint8 *)&iov_buf->data[0];
+               ((bcm_xtlv_t*)pxtlv)->id = WL_FILS_XTLV_HLP_IE;
+               ((bcm_xtlv_t*)pxtlv)->len = hlp_len;
+
+               memcpy(((bcm_xtlv_t*)pxtlv)->data, hlp_ie, ((bcm_xtlv_t*)pxtlv)->len);
+
+               iov_buf->version = WL_FILS_IOV_VERSION;
+               iov_buf->id = WL_FILS_CMD_ADD_HLP_IE;
+               iov_buf->len = ((sizeof(bcm_xtlv_t)-1) + ((bcm_xtlv_t*)pxtlv)->len);
+
+               err = wldev_iovar_setbuf(dev, "fils", iov_buf,
+                               sizeof(bcm_iov_buf_t) + iov_buf->len,
+                               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+               if (unlikely(err)) {
+                       WL_ERR(("fils wldev_iovar_setbuf error (%d)\n", err));
+               }
+               else {
+                       WL_DBG_MEM(("FILS HLP Packet succesfully updated\n"));
+               }
+               MFREE(cfg->osh, iov_buf, iov_buf_len);
+       }
+       return BCME_OK;
+}
+#endif /* WL_FILS */
+
+#if defined(WL_FILS)
+#ifndef UPDATE_FILS_ERP_INFO
+#define UPDATE_FILS_ERP_INFO   BIT(1)
+#define UPDATE_AUTH_TYPE       BIT(2)
+#endif
+
+static int
+wl_cfg80211_update_connect_params(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_connect_params *sme, u32 changed)
+{
+       s32 err = BCME_OK;
+       if (changed & UPDATE_FILS_ERP_INFO) {
+               err = wl_set_fils_params(dev, sme);
+
+               if (unlikely(err)) {
+                       WL_ERR(("Invalid FILS params\n"));
+                       goto exit;
+               }
+       }
+       if (changed & UPDATE_AUTH_TYPE) {
+               err = wl_set_auth_type(dev, sme);
+               if (unlikely(err)) {
+                       WL_ERR(("Invalid auth type\n"));
+                       goto exit;
+               }
+       }
+       if ((changed & UPDATE_FILS_ERP_INFO) && !(changed & UPDATE_AUTH_TYPE)) {
+               WL_DBG(("Warning: FILS ERP params are set, but authentication type - not\n"));
+       }
+exit:
+       return err;
+
+}
+#endif /* WL_FILS */
+
+#if defined(ROAM_ENABLE) && defined(ROAM_AP_ENV_DETECTION)
+static s32
+wl_config_roam_env_detection(struct bcm_cfg80211 *cfg, struct net_device *dev)
+{
+       dhd_pub_t *dhdp =  (dhd_pub_t *)(cfg->pub);
+       s32 roam_trigger[2] = {0, 0};
+       s32 err = BCME_OK;
+
+       if (dhdp->roam_env_detection && (dev == bcmcfg_to_prmry_ndev(cfg))) {
+               bool is_roamtrig_reset = TRUE;
+               bool is_roam_env_ok = (wldev_iovar_setint(dev, "roam_env_detection",
+                               AP_ENV_DETECT_NOT_USED) == BCME_OK);
+#ifdef SKIP_ROAM_TRIGGER_RESET
+               roam_trigger[1] = WLC_BAND_2G;
+               is_roamtrig_reset =
+                       (wldev_ioctl_get(dev, WLC_GET_ROAM_TRIGGER, roam_trigger,
+                               sizeof(roam_trigger)) == BCME_OK) &&
+                       (roam_trigger[0] == WL_AUTO_ROAM_TRIGGER-10);
+#endif /* SKIP_ROAM_TRIGGER_RESET */
+               if (is_roamtrig_reset && is_roam_env_ok) {
+                       roam_trigger[0] = WL_AUTO_ROAM_TRIGGER;
+                       roam_trigger[1] = WLC_BAND_ALL;
+                       err = wldev_ioctl_set(dev, WLC_SET_ROAM_TRIGGER, roam_trigger,
+                               sizeof(roam_trigger));
+                       if (unlikely(err)) {
+                               WL_ERR((" failed to restore roam_trigger for auto env"
+                                               " detection. err:%d\n", err));
+                       }
+               }
+       }
+       return err;
+}
+#endif /* ROAM_ENABLE && ROAMENV_DETECTION */
+
+s32
+wl_do_preassoc_ops(struct bcm_cfg80211 *cfg,
+               struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+       dhd_pub_t *dhdp =  (dhd_pub_t *)(cfg->pub);
+
+       BCM_REFERENCE(dhdp);
+       DHD_STATLOG_CTRL(dhdp, ST(ASSOC_START), dhd_net2idx(dhdp->info, dev), 0);
+
+#ifdef DHDTCPSYNC_FLOOD_BLK
+       dhd_reset_tcpsync_info_by_dev(dev);
+#endif /* DHDTCPSYNC_FLOOD_BLK */
+
+       if (wl_get_drv_status(cfg, SCANNING, dev)) {
+               wl_cfg80211_cancel_scan(cfg);
+       }
+
+#ifdef WL_SCHED_SCAN
+       /* Locks are taken in wl_cfg80211_sched_scan_stop()
+        * A start scan occuring during connect is unlikely
+        */
+       if (cfg->sched_scan_req) {
+               struct wireless_dev *wdev = dev->ieee80211_ptr;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0))
+               wl_cfg80211_sched_scan_stop(wdev->wiphy, bcmcfg_to_prmry_ndev(cfg),
+                               cfg->sched_scan_req->reqid);
+#else
+               wl_cfg80211_sched_scan_stop(wdev->wiphy, bcmcfg_to_prmry_ndev(cfg));
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)) */
+       }
+#endif /* WL_SCHED_SCAN */
+#ifdef WL_CFG80211_GON_COLLISION
+       /* init block gon req count  */
+       cfg->block_gon_req_tx_count = 0;
+       cfg->block_gon_req_rx_count = 0;
+#endif /* WL_CFG80211_GON_COLLISION */
+
+#if defined(USE_DYNAMIC_MAXPKT_RXGLOM)
+       maxrxpktglom = 0;
+#endif
+
+#if defined(ROAM_ENABLE) && defined(ROAM_AP_ENV_DETECTION)
+       if (wl_config_roam_env_detection(cfg, dev) != BCME_OK) {
+               return BCME_ERROR;
+       }
+#endif /* ROAM_ENABLE && ROAM_AP_ENV_DETECTION */
+
+#ifdef WLTDLS
+       /* disable TDLS if number of connected interfaces is >= 1 */
+       wl_cfg80211_tdls_config(cfg, TDLS_STATE_CONNECT, false);
+#endif /* WLTDLS */
+
+#ifdef SUPPORT_AP_BWCTRL
+       if (dhdp->op_mode & DHD_FLAG_HOSTAP_MODE) {
+               wl_restore_ap_bw(cfg);
+       }
+#endif /* SUPPORT_AP_BWCTRL */
+#if defined(ROAMEXP_SUPPORT)
+       /* Clear Blacklist bssid and Whitelist ssid list before join issue
+        * This is temporary fix since currently firmware roaming is not
+        * disabled by android framework before SSID join from framework
+       */
+       /* Flush blacklist bssid content */
+       dhd_dev_set_blacklist_bssid(dev, NULL, 0, true);
+       /* Flush whitelist ssid content */
+       dhd_dev_set_whitelist_ssid(dev, NULL, 0, true);
+#endif /* ROAMEXP_SUPPORT */
+
+       WL_DBG(("SME IE : len=%zu\n", sme->ie_len));
+       if (sme->ie != NULL && sme->ie_len > 0 && (wl_dbg_level & WL_DBG_DBG)) {
+               prhex(NULL, sme->ie, sme->ie_len);
+       }
+       /* Connection attempted via linux-wireless */
+       wl_set_drv_status(cfg, CFG80211_CONNECT, dev);
+       return BCME_OK;
+}
+
+static s32
+wl_config_assoc_security(struct bcm_cfg80211 *cfg,
+       struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+       s32 err = BCME_OK;
+
+       err = wl_set_wpa_version(dev, sme);
+       if (unlikely(err)) {
+               WL_ERR(("Invalid wpa_version\n"));
+               goto exit;
+       }
+
+#ifdef BCMWAPI_WPI
+       if (sme->crypto.wpa_versions & NL80211_WAPI_VERSION_1) {
+               WL_DBG(("skip auth type for wapi\n"));
+       } else
+#endif
+
+       {
+               err = wl_set_auth_type(dev, sme);
+               if (unlikely(err)) {
+                       WL_ERR(("Invalid auth type\n"));
+                       goto exit;
+               }
+       }
+
+#ifdef WL_FILS
+       if (sme->ie && sme->ie_len) {
+               err = wl_fils_add_hlp_container(cfg, dev, sme->ie, sme->ie_len);
+               if (unlikely(err)) {
+                       WL_ERR(("FILS sending HLP failed\n"));
+                       goto exit;
+               }
+       }
+#endif /* WL_FILS */
+
+       err = wl_set_set_cipher(dev, sme);
+       if (unlikely(err)) {
+               WL_ERR(("Invalid ciper\n"));
+               goto exit;
+       }
+
+       err = wl_set_key_mgmt(dev, sme);
+       if (unlikely(err)) {
+               WL_ERR(("Invalid key mgmt\n"));
+               goto exit;
+       }
+
+       err = wl_set_set_sharedkey(dev, sme);
+       if (unlikely(err)) {
+               WL_ERR(("Invalid shared key\n"));
+               goto exit;
+       }
+
+#ifdef WL_FILS
+       err = wl_set_fils_params(dev, sme);
+       if (unlikely(err)) {
+               WL_ERR(("Invalid FILS params\n"));
+               goto exit;
+       }
+#endif /* WL_FILS */
+
+exit:
+       return err;
+}
+
+static s32
+wl_config_assoc_ies(struct bcm_cfg80211 *cfg, struct net_device *dev,
+       struct cfg80211_connect_params *sme, wlcfg_assoc_info_t *info)
+{
+       const wpa_ie_fixed_t *wpa_ie;
+       const bcm_tlv_t *wpa2_ie;
+       const u8* wpaie = 0;
+       u32 wpaie_len;
+       s32 err;
+       s32 bssidx = info->bssidx;
+
+       /* configure all vendor and extended vendor IEs */
+       wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(dev), bssidx,
+               VNDR_IE_ASSOCREQ_FLAG, sme->ie, sme->ie_len);
+
+       /* Find the RSNXE_IE and plumb */
+       if ((err = wl_cfg80211_config_rsnxe_ie(cfg, dev,
+                       (const u8*)sme->ie, sme->ie_len)) < 0) {
+               WL_ERR(("Failed to configure rsnxe ie: %d\n", err));
+               return err;
+       }
+
+       /* find the RSN_IE */
+       if ((wpa2_ie = bcm_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
+               DOT11_MNG_RSN_ID)) != NULL) {
+               WL_DBG((" RSN IE is found\n"));
+       }
+
+       /* find the WPA_IE */
+       if ((wpa_ie = wl_cfgp2p_find_wpaie(sme->ie,
+               sme->ie_len)) != NULL) {
+               WL_DBG((" WPA IE is found\n"));
+       }
+
+       if (wpa_ie != NULL || wpa2_ie != NULL) {
+               wpaie = (wpa_ie != NULL) ? (const u8 *)wpa_ie : (const u8 *)wpa2_ie;
+               wpaie_len = (wpa_ie != NULL) ? wpa_ie->length : wpa2_ie->len;
+               wpaie_len += WPA_RSN_IE_TAG_FIXED_LEN;
+       } else {
+               wpaie = NULL;
+               wpaie_len = 0;
+       }
+
+       err = wldev_iovar_setbuf(dev, "wpaie", wpaie, wpaie_len,
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("wpaie set error (%d)\n", err));
+       }
+
+       return err;
+}
+
+s32
+wl_cfg80211_config_rsnxe_ie(struct bcm_cfg80211 *cfg, struct net_device *dev,
+               const u8 *parse, u32 len)
+{
+       bcm_tlv_t *ie = NULL;
+       s32 err = 0;
+       u8 ie_len = 0;
+       char smbuf[WLC_IOCTL_SMLEN];
+
+       while ((ie = bcm_parse_tlvs(parse, len, DOT11_MNG_RSNXE_ID))) {
+               WL_DBG(("Found RSNXE ie\n"));
+               break;
+       }
+
+       ie_len = (ie != NULL) ? (ie->len + BCM_TLV_HDR_SIZE): 0;
+
+       err = wldev_iovar_setbuf(dev, "rsnxe", ie, ie_len,
+               smbuf, sizeof(smbuf), NULL);
+       if (!err) {
+               WL_DBG(("Configured RSNXE IE\n"));
+       } else if (err == BCME_UNSUPPORTED) {
+               WL_DBG(("FW does not support rsnxe iovar\n"));
+               err = BCME_OK;
+       } else {
+               WL_ERR(("rsnxe set error (%d)\n", err));
+       }
+       return err;
+}
+
+static s32
+wl_config_assoc_params(struct bcm_cfg80211 *cfg, struct net_device *dev,
+       wl_extjoin_params_t *ext_join_params,
+       u32 buf_len, wlcfg_assoc_info_t *info)
+{
+
+       chanspec_t *chanspecs = info->chanspecs;
+       u32 chan_cnt = info->chan_cnt;
+       u32 join_scan_active_time = 0;
+
+       if (buf_len < (sizeof(ext_join_params->ssid.SSID) +
+               (sizeof(chanspec_t) * chan_cnt))) {
+               WL_ERR(("buf too short\n"));
+               return -EINVAL;
+       }
+
+       /* ssid length check is already done above */
+       if (memcpy_s(ext_join_params->ssid.SSID, sizeof(ext_join_params->ssid.SSID),
+                       info->ssid, info->ssid_len) != BCME_OK) {
+               WL_ERR(("ssid cpy failed info_len:%d\n", info->ssid_len));
+               return -EINVAL;
+       }
+
+       ext_join_params->ssid.SSID_len = info->ssid_len;
+       wl_update_prof(cfg, dev, NULL, &ext_join_params->ssid, WL_PROF_SSID);
+       if (ext_join_params->ssid.SSID_len < IEEE80211_MAX_SSID_LEN) {
+               WL_DBG(("ssid \"%s\", len (%d)\n", ext_join_params->ssid.SSID,
+                       ext_join_params->ssid.SSID_len));
+       }
+       ext_join_params->ssid.SSID_len = htod32(info->ssid_len);
+
+       /* Use increased dwell for targeted join case to take care of noisy env */
+       join_scan_active_time = info->targeted_join ? WL_SCAN_JOIN_ACTIVE_DWELL_TIME_MS :
+               WL_BCAST_SCAN_JOIN_ACTIVE_DWELL_TIME_MS;
+       ext_join_params->scan.active_time = chan_cnt ? join_scan_active_time : -1;
+       ext_join_params->scan.passive_time = chan_cnt ? WL_SCAN_JOIN_PASSIVE_DWELL_TIME_MS : -1;
+       /* Set up join scan parameters */
+       ext_join_params->scan.scan_type = -1;
+       /* WAR to sync with presence period of VSDB GO.
+        * send probe request more frequently
+        * probe request will be stopped when it gets probe response from target AP/GO.
+        */
+       ext_join_params->scan.nprobes = chan_cnt ?
+               (ext_join_params->scan.active_time/WL_SCAN_JOIN_PROBE_INTERVAL_MS) : -1;
+       ext_join_params->scan.home_time = -1;
+
+       (void)memcpy_s(&ext_join_params->assoc.bssid, ETH_ALEN, info->bssid, ETH_ALEN);
+
+       ext_join_params->assoc.chanspec_num = chan_cnt;
+       /* source and target lens are same */
+       (void)memcpy_s(ext_join_params->assoc.chanspec_list, (sizeof(chanspec_t) * chan_cnt),
+               chanspecs, sizeof(chanspec_t) * chan_cnt);
+
+       ext_join_params->assoc.chanspec_num = htod32(chan_cnt);
+       return BCME_OK;
+}
+
+static s32
+wl_handle_assoc_hints(struct bcm_cfg80211 *cfg, struct net_device *dev,
+       struct cfg80211_connect_params *sme, wlcfg_assoc_info_t *info)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0))
+       bool skip_hints = false;
+#endif /* KERNEL >= 3.15 */
+       chanspec_t chspec;
+
+       if (!sme || !info) {
+               WL_ERR(("wrong args\n"));
+               return -EINVAL;
+       }
+
+       if (unlikely(!sme->ssid) || (sme->ssid_len > DOT11_MAX_SSID_LEN)) {
+               WL_ERR(("Invalid ssid %p. len:%zu\n", sme->ssid, sme->ssid_len));
+               return -EINVAL;
+       }
+
+       /* Copy SSID detail */
+       info->ssid_len = sme->ssid_len;
+       if (memcpy_s(info->ssid, sizeof(info->ssid),
+                       sme->ssid, info->ssid_len) != BCME_OK) {
+               WL_ERR(("ssid cpy failed\n"));
+               return -EINVAL;
+       }
+
+       /* Handle incoming BSSID and Channel info */
+       if (sme->bssid && !ETHER_ISBCAST(sme->bssid)) {
+               /* Use user space requested BSSID and channel */
+               info->targeted_join = true;
+               (void)memcpy_s(info->bssid, ETH_ALEN, sme->bssid, ETH_ALEN);
+               if (sme->channel && ((chspec =
+                       wl_freq_to_chanspec(sme->channel->center_freq)) != INVCHANSPEC)) {
+                       info->chan_cnt = 1;
+                       info->chanspecs[0] = chspec;
+#ifndef WL_P2P_6G
+                       /* Skip p2p connection on 6G */
+                       if (IS_P2P_GC(dev->ieee80211_ptr) && (CHSPEC_IS6G(chspec))) {
+                               WL_ERR(("P2P connection not allowed on 6G\n"));
+                               return -ENOTSUPP;
+                       }
+#endif /* WL_P2P_6G */
+               }
+       }
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0))
+       else {
+#ifdef WL_SKIP_CONNECT_HINTS
+               skip_hints = true;
+               WL_DBG(("force skip connect hints\n"));
+#else /* WL_SKIP_CONNECT_HINTS */
+               /* override bssid_hint if overridden via module param */
+               skip_hints = fw_ap_select;
+#if defined(WL_FW_OCE_AP_SELECT)
+               /* If fw select needs to be specifically done for OCE */
+               skip_hints = fw_ap_select &&
+                       wl_cfg80211_is_oce_ap(wiphy, sme->bssid_hint);
+#endif /* WL_FW_OCE_AP_SELECT */
+               WL_DBG(("fw_ap_select:%d skip_hints:%d\n", fw_ap_select, skip_hints));
+#endif /* WL_SKIP_CONNECT_HINTS */
+
+               /* Use bssid_hint if hints are allowed and if its unicast addr */
+               if (!skip_hints && sme->bssid_hint && !ETHER_ISBCAST(sme->bssid_hint)) {
+                       WL_INFORM_MEM(("bssid_hint "MACDBG" \n", MAC2STRDBG(sme->bssid_hint)));
+                       info->targeted_join = true;
+                       (void)memcpy_s(info->bssid, ETH_ALEN, sme->bssid_hint, ETH_ALEN);
+                       /* Use channel hint only for target bssid join case. In other
+                        * cases, use RCC or full scan to find better APs.
+                        */
+                       if (sme->channel_hint && ((chspec = wl_freq_to_chanspec(
+                               sme->channel_hint->center_freq)) != INVCHANSPEC)) {
+                               info->chan_cnt = 1;
+                               info->chanspecs[0] = chspec;
+                               WL_INFORM_MEM(("channel_hint: chspec(%x)\n", chspec));
+                       }
+               }
+       }
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0) */
+
+       if (info->targeted_join != true) {
+               /* For non targeted join, use bcast address */
+               (void)memcpy_s(&info->bssid, ETH_ALEN, &ether_bcast, ETH_ALEN);
+       }
+       WL_DBG(("targeted_join:%d chan_cnt:%d\n",
+                       info->targeted_join, info->chan_cnt));
+       return 0;
+}
+
+static s32
+wl_sync_fw_assoc_states(struct bcm_cfg80211 *cfg,
+               struct net_device *dev, wlcfg_assoc_info_t *info)
+{
+       s32 err = BCME_OK;
+       u8 bssid[ETH_ALEN];
+
+       if (wl_get_drv_status(cfg, CONNECTED, dev) && wl_reassoc_support) {
+               /* ROAM case */
+               info->reassoc = true;
+       } else {
+               /* store the bssid for the connect req */
+               wl_update_prof(cfg, dev, NULL, info->bssid, WL_PROF_LATEST_BSSID);
+
+               /* following scenarios are possible
+               * In case of wrong request/abnormal status,
+               * trigger DISASSOC to clean up status.
+               * 1. DHD prev status is CONNECTING
+               *      => 1.1 Wrong request
+               * 2. DHD previous status is CONNECTED
+               *      -  FW connected
+               *              => Wrong request
+               *      - FW not connected
+               *              => Abnormal status
+               * 3. DHD previous status is DISCONNECTING
+               *      => Waiting for disconnecting
+               * 4. DHD previous status is not connected
+               *      - FW not connected
+               *              => Normal status
+               *      - FW connected
+               *              => Abnormal status
+               */
+               if (wl_get_drv_status(cfg, CONNECTING, dev) ||
+                       wl_get_drv_status(cfg, CONNECTED, dev)) {
+                       /* set nested connect bit to identify the context */
+                       wl_set_drv_status(cfg, NESTED_CONNECT, dev);
+                       /* DHD prev status is CONNECTING/CONNECTED */
+                       wl_cfg80211_cleanup_mismatch_status(dev, cfg, TRUE);
+               } else if (wl_get_drv_status(cfg, DISCONNECTING, dev)) {
+                       /* DHD prev status is DISCONNECTING */
+                       wl_cfg80211_cleanup_mismatch_status(dev, cfg, false);
+               } else if (!wl_get_drv_status(cfg, CONNECTED, dev)) {
+                       /* DHD previous status is not connected and FW connected */
+                       if (wldev_ioctl_get(dev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN) == 0) {
+                               /* set nested connect bit to identify the context */
+                               wl_set_drv_status(cfg, NESTED_CONNECT, dev);
+                               wl_cfg80211_cleanup_mismatch_status(dev, cfg, true);
+                       }
+               }
+               wl_cfg80211_check_in4way(cfg, dev, WAIT_DISCONNECTED,
+                       WL_EXT_STATUS_CONNECTING, NULL);
+       }
+
+       /* Clear BSSID if disconnecting state is not in progress */
+       bzero(&bssid, sizeof(bssid));
+       if (!wl_get_drv_status(cfg, DISCONNECTING, dev)) {
+               wl_update_prof(cfg, dev, NULL, (void *)&bssid, WL_PROF_BSSID);
+       }
+
+       LOG_TS(cfg, conn_start);
+       CLR_TS(cfg, authorize_start);
+       /* clear nested connect bit on proceeding for connection */
+       wl_clr_drv_status(cfg, NESTED_CONNECT, dev);
+
+       if (!info->reassoc) {
+               /* 'connect' request received */
+               wl_set_drv_status(cfg, CONNECTING, dev);
+       }
+
+       return err;
+}
+
+#if defined(DBG_PKT_MON)
+void
+wl_pkt_mon_start(struct bcm_cfg80211 *cfg, struct net_device *dev)
+{
+       if ((dev == bcmcfg_to_prmry_ndev(cfg))) {
+               dhd_pub_t *dhdp =  (dhd_pub_t *)(cfg->pub);
+               DHD_DBG_PKT_MON_START(dhdp);
+       }
+}
+#endif /* DBG_PKT_MON && BCMDONGLEHOST */
+
+void
+wl_conn_debug_info(struct bcm_cfg80211 *cfg, struct net_device *dev, wlcfg_assoc_info_t *info)
+{
+       struct wl_security *sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+       char sec_info[32];
+
+       if (!sec) {
+               return;
+       }
+
+       wl_ext_get_sec(dev, 0, sec_info, sizeof(sec_info));
+       WL_MSG(dev->name, "Connecting with " MACDBG " ssid \"%s\", len (%d), "
+               "channel=%d, sec=%s\n", MAC2STRDBG((u8*)(&info->bssid)),
+               info->ssid, info->ssid_len, info->chan_cnt, sec_info);
+       if (wl_dbg_level & WL_DBG_DBG) {
+               WL_MSG(dev->name, "akm:0x%x auth:0x%x wpaver:0x%x pwise:0x%x gwise:0x%x\n",
+                               sec->wpa_auth, sec->auth_type, sec->wpa_versions,
+                               sec->cipher_pairwise, sec->cipher_group);
+               WL_MSG(dev->name, "wpa_auth:0x%x auth:0x%x wsec:0x%x mfp:0x%x\n",
+                               sec->fw_wpa_auth, sec->fw_auth, sec->fw_wsec, sec->fw_mfp);
+               /* print channels for assoc */
+               prhex("chanspecs", (const u8 *)info->chanspecs,
+                               (info->chan_cnt * sizeof(chanspec_t)));
+       }
+       SUPP_LOG(("[%s] Connecting with " MACDBG " ssid \"%s\",chan_cnt:%d\n",
+               dev->name, MAC2STRDBG((u8*)(&info->bssid)),
+               info->ssid, info->chan_cnt));
+}
+
+static s32
+wl_handle_join(struct bcm_cfg80211 *cfg,
+       struct net_device *dev, wlcfg_assoc_info_t *assoc_info)
+{
+       s32 err = 0;
+       wl_extjoin_params_t *ext_join_params;
+       size_t join_params_size;
+
+       join_params_size = WL_EXTJOIN_PARAMS_FIXED_SIZE +
+               assoc_info->chan_cnt * sizeof(chanspec_t);
+       ext_join_params = (wl_extjoin_params_t *)MALLOCZ(cfg->osh, join_params_size);
+       if (ext_join_params == NULL) {
+               err = -ENOMEM;
+               WL_ERR(("Mem alloc for join_params failed\n"));
+               goto fail;
+       }
+
+       err = wl_config_assoc_params(cfg, dev, ext_join_params, join_params_size,
+                       assoc_info);
+       if (unlikely(err)) {
+               WL_ERR(("config assoc ies failed\n"));
+               goto fail;
+       }
+
+       err = wldev_iovar_setbuf_bsscfg(dev, "join", ext_join_params, join_params_size,
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, assoc_info->bssidx, &cfg->ioctl_buf_sync);
+
+fail:
+       MFREE(cfg->osh, ext_join_params, join_params_size);
+       return err;
+}
+
+static s32
+wl_handle_reassoc(struct bcm_cfg80211 *cfg, struct net_device *dev,
+               wlcfg_assoc_info_t *info)
+{
+       wl_reassoc_params_t reassoc_params;
+       s32 err;
+       char sec_info[32];
+
+       bzero(&reassoc_params, WL_REASSOC_PARAMS_FIXED_SIZE);
+       (void)memcpy_s(&reassoc_params.bssid.octet, ETH_ALEN, info->bssid, ETH_ALEN);
+       wl_ext_get_sec(dev, 0, sec_info, sizeof(sec_info));
+       WL_MSG(dev->name, "Reconnecting with " MACDBG " sec=%s\n",
+               MAC2STRDBG((u8*)(&reassoc_params.bssid)), sec_info);
+       err = wldev_ioctl_set(dev, WLC_REASSOC, &reassoc_params, sizeof(wl_reassoc_params_t));
+       if (unlikely(err)) {
+               WL_ERR(("reassoc failed, error=%d\n", err));
+               return err;
+       } else {
+               WL_INFORM_MEM(("wl reassoc "MACDBG"\n", MAC2STRDBG(info->bssid)));
+       }
+
+       return BCME_OK;
+}
+
+static s32
+wl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_connect_params *sme)
+{
+       s32 err = BCME_OK;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       wlcfg_assoc_info_t assoc_info;
+       dhd_pub_t *dhdp =  (dhd_pub_t *)(cfg->pub);
+
+       WL_DBG(("Enter len=%zu\n", sme->ie_len));
+       RETURN_EIO_IF_NOT_UP(cfg);
+
+       /* syncronize the connect states */
+       mutex_lock(&cfg->connect_sync);
+
+       bzero(&assoc_info, sizeof(wlcfg_assoc_info_t));
+       if ((assoc_info.bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find wlan index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               goto fail;
+       }
+
+       err = wl_do_preassoc_ops(cfg, dev, sme);
+       if (unlikely(err)) {
+               WL_ERR(("config assoc channel failed\n"));
+               goto fail;
+       }
+
+       err = wl_handle_assoc_hints(cfg, dev, sme, &assoc_info);
+       if (unlikely(err)) {
+               WL_ERR(("assoc hint processing failed\n"));
+               goto fail;
+       }
+
+       if (wl_sync_fw_assoc_states(cfg, dev, &assoc_info) != BCME_OK) {
+               /* attempt best effort */
+               WL_ERR(("fw assoc sync failed\n"));
+       }
+
+       if (assoc_info.reassoc) {
+               // terence 20200530, should call wl_ext_iapsta_update_channel() to move AP channel?
+               /* Handle roam to same ESS */
+               err = wl_handle_reassoc(cfg, dev, &assoc_info);
+       } else {
+               err = wl_config_assoc_security(cfg, dev, sme);
+               if (unlikely(err)) {
+                       WL_ERR(("config assoc security failed\n"));
+                       goto fail;
+               }
+
+               err = wl_get_assoc_channels(cfg, dev, &assoc_info);
+               if (unlikely(err)) {
+                       WL_ERR(("get assoc channels failed\n"));
+                       goto fail;
+               }
+
+               err = wl_config_assoc_ies(cfg, dev, sme, &assoc_info);
+               if (unlikely(err)) {
+                       WL_ERR(("config assoc ies failed\n"));
+                       goto fail;
+               }
+
+               /* print relevant info for debug purpose */
+#ifdef WL_EXT_IAPSTA
+               wl_ext_iapsta_update_channel(dhdp, dev, assoc_info.chan_cnt);
+#endif
+               wl_conn_debug_info(cfg, dev, &assoc_info);
+               err = wl_handle_join(cfg, dev, &assoc_info);
+       }
+
+fail:
+       if (unlikely(err)) {
+               WL_ERR(("connect error (%d)\n", err));
+               wl_clr_drv_status(cfg, CONNECTING, dev);
+               CLR_TS(cfg, conn_start);
+               /* Flush fw logs */
+               wl_flush_fw_log_buffer(dev, FW_LOGSET_MASK_ALL);
+#ifdef WLTDLS
+               /* If connect fails, check whether we can enable back TDLS */
+               wl_cfg80211_tdls_config(cfg, TDLS_STATE_DISCONNECT, false);
+#endif /* WLTDLS */
+       } else {
+#ifdef DBG_PKT_MON
+               /* start packet log in adv to ensure that EAPOL msgs aren't missed */
+               wl_pkt_mon_start(cfg, dev);
+#endif /* DBG_PKT_MON */
+       }
+       if (!err)
+               wl_cfg80211_check_in4way(cfg, dev, NO_SCAN_IN4WAY|NO_BTC_IN4WAY,
+                       WL_EXT_STATUS_CONNECTING, NULL);
+
+       mutex_unlock(&cfg->connect_sync);
+       return err;
+}
+
+static void wl_cfg80211_wait_for_disconnection(struct bcm_cfg80211 *cfg, struct net_device *dev)
+{
+       uint8 wait_cnt;
+       u32 status = 0;
+
+       wait_cnt = WAIT_FOR_DISCONNECT_MAX;
+       while ((status = wl_get_drv_status(cfg, DISCONNECTING, dev)) && wait_cnt) {
+               WL_DBG(("Waiting for disconnection, wait_cnt: %d\n", wait_cnt));
+               wait_cnt--;
+               OSL_SLEEP(50);
+       }
+
+       WL_INFORM_MEM(("Wait for disconnection done. status:%d wait_cnt:%d\n", status, wait_cnt));
+       if (!wait_cnt && wl_get_drv_status(cfg, DISCONNECTING, dev)) {
+               /* No response from firmware. Indicate connect result
+                * to clear cfg80211 state machine
+                */
+               if (wl_get_drv_status(cfg, CONNECTING, dev)) {
+                       WL_INFORM_MEM(("force send connect result\n"));
+                       CFG80211_CONNECT_RESULT(dev, NULL, NULL, NULL, 0, NULL, 0,
+                               WLAN_STATUS_UNSPECIFIED_FAILURE,
+                               GFP_KERNEL);
+               } else {
+                       WL_INFORM_MEM(("force send disconnect event\n"));
+                       CFG80211_DISCONNECTED(dev, WLAN_REASON_DEAUTH_LEAVING,
+                               NULL, 0, false, GFP_KERNEL);
+               }
+               CLR_TS(cfg, conn_start);
+               CLR_TS(cfg, authorize_start);
+               wl_clr_drv_status(cfg, DISCONNECTING, dev);
+       }
+       return;
+}
+
+static s32
+wl_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
+       u16 reason_code)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       scb_val_t scbval;
+       bool act = false;
+       s32 err = 0;
+       u8 *curbssid = NULL;
+       u8 null_bssid[ETHER_ADDR_LEN];
+       s32 bssidx = 0;
+       bool connected;
+       bool conn_in_progress;
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+       WL_MSG(dev->name, "Reason %d, act %d\n", reason_code, act);
+
+       BCM_REFERENCE(dhdp);
+       DHD_STATLOG_CTRL(dhdp, ST(DISASSOC_START),
+               dhd_net2idx(dhdp->info, dev), reason_code);
+#ifdef DHD_4WAYM4_FAIL_DISCONNECT
+       dhd_cleanup_m4_state_work(dhdp, dhd_net2idx(dhdp->info, dev));
+#endif /* DHD_4WAYM4_FAIL_DISCONNECT */
+
+       connected = wl_get_drv_status(cfg, CONNECTED, dev);
+       conn_in_progress = wl_get_drv_status(cfg, CONNECTING, dev);
+       curbssid = wl_read_prof(cfg, dev, WL_PROF_BSSID);
+       act = *(bool *) wl_read_prof(cfg, dev, WL_PROF_ACT);
+       WL_INFORM_MEM(("disconnect in connect state [%d:%d:%d]. reason:%d\n",
+               connected, conn_in_progress, act, reason_code));
+       if (connected || conn_in_progress) {
+               if (curbssid) {
+                       WL_DBG_MEM(("curbssid:" MACDBG "\n", MAC2STRDBG(curbssid)));
+               }
+               act = true;
+       }
+
+       if (!curbssid) {
+               WL_ERR(("Disconnecting while CONNECTING status %d\n", (int)sizeof(null_bssid)));
+               bzero(null_bssid, sizeof(null_bssid));
+               curbssid = null_bssid;
+       }
+
+       if (act) {
+#ifdef DBG_PKT_MON
+               /* Stop packet monitor */
+               if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+                       DHD_DBG_PKT_MON_STOP(dhdp);
+               }
+#endif /* DBG_PKT_MON */
+               /*
+               * Cancel ongoing scan to sync up with sme state machine of cfg80211.
+               */
+               /* Let scan aborted by F/W */
+               if (cfg->scan_request) {
+                       WL_TRACE_HW4(("Aborting the scan! \n"));
+                       wl_cfg80211_cancel_scan(cfg);
+               }
+               if (conn_in_progress || connected) {
+                               scbval.val = reason_code;
+                               memcpy(&scbval.ea, curbssid, ETHER_ADDR_LEN);
+                               scbval.val = htod32(scbval.val);
+                               WL_INFORM_MEM(("[%s] wl disassoc\n", dev->name));
+                               /* Set DISCONNECTING state. We are clearing this state
+                                in all exit paths
+                                */
+                               wl_set_drv_status(cfg, DISCONNECTING, dev);
+                               err = wldev_ioctl_set(dev, WLC_DISASSOC, &scbval,
+                                               sizeof(scb_val_t));
+                               if (unlikely(err)) {
+                                       wl_clr_drv_status(cfg, DISCONNECTING, dev);
+                                       WL_ERR(("error (%d)\n", err));
+                                       goto exit;
+                               }
+                               wl_cfg80211_check_in4way(cfg, dev, NO_SCAN_IN4WAY|NO_BTC_IN4WAY|WAIT_DISCONNECTED,
+                                       WL_EXT_STATUS_DISCONNECTING, NULL);
+               }
+#ifdef WL_WPS_SYNC
+               /* If are in WPS reauth state, then we would be
+                * dropping the link down events. Ensure that
+                * Event is sent up for the disconnect Req
+                */
+               if (wl_wps_session_update(dev,
+                       WPS_STATE_DISCONNECT, curbssid) == BCME_OK) {
+                       WL_INFORM_MEM(("[WPS] Disconnect done.\n"));
+                       wl_clr_drv_status(cfg, DISCONNECTING, dev);
+                       goto exit;
+               }
+#endif /* WPS_SYNC */
+               wl_cfg80211_wait_for_disconnection(cfg, dev);
+       } else {
+               /* Not in connected or connection in progres states. Still receiving
+                * disassoc indicates state mismatch with upper layer. Check for state
+                * and issue disconnect indication if required.
+                */
+
+               if (dev->ieee80211_ptr->current_bss) {
+                       WL_INFORM_MEM(("report disconnect event\n"));
+                       CFG80211_DISCONNECTED(dev, 0, NULL, 0, false, GFP_KERNEL);
+               }
+       }
+
+#ifdef CUSTOM_SET_CPUCORE
+       /* set default cpucore */
+       if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+               dhdp->chan_isvht80 &= ~DHD_FLAG_STA_MODE;
+               if (!(dhdp->chan_isvht80))
+                       dhd_set_cpucore(dhdp, FALSE);
+       }
+#endif /* CUSTOM_SET_CPUCORE */
+
+       cfg->rssi = 0;  /* reset backup of rssi */
+
+exit:
+       CLR_TS(cfg, conn_start);
+       CLR_TS(cfg, authorize_start);
+
+       /* Clear IEs for disaasoc */
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find index failed\n"));
+               err = -EINVAL;
+               return err;
+       }
+       WL_ERR(("Clearing disconnect IEs \n"));
+       err = wl_cfg80211_set_mgmt_vndr_ies(cfg,
+               ndev_to_cfgdev(dev), bssidx, VNDR_IE_DISASSOC_FLAG, NULL, 0);
+
+       return err;
+}
+
+static s32
+#if defined(WL_CFG80211_P2P_DEV_IF)
+wl_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
+       enum nl80211_tx_power_setting type, s32 mbm)
+#else
+wl_cfg80211_set_tx_power(struct wiphy *wiphy,
+       enum nl80211_tx_power_setting type, s32 dbm)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+{
+
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       s32 err = 0;
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       s32 dbm = MBM_TO_DBM(mbm);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0)) || \
+       defined(WL_COMPAT_WIRELESS) || defined(WL_SUPPORT_BACKPORTED_KPATCHES)
+       dbm = MBM_TO_DBM(dbm);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+       switch (type) {
+       case NL80211_TX_POWER_AUTOMATIC:
+               break;
+       case NL80211_TX_POWER_LIMITED:
+               if (dbm < 0) {
+                       WL_ERR(("TX_POWER_LIMITTED - dbm is negative\n"));
+                       return -EINVAL;
+               }
+               break;
+       case NL80211_TX_POWER_FIXED:
+               if (dbm < 0) {
+                       WL_ERR(("TX_POWER_FIXED - dbm is negative..\n"));
+                       return -EINVAL;
+               }
+               break;
+       }
+
+       err = wl_set_tx_power(ndev, type, dbm);
+       if (unlikely(err)) {
+               WL_ERR(("error (%d)\n", err));
+               return err;
+       }
+
+       cfg->conf->tx_power = dbm;
+
+       return err;
+}
+
+static s32
+#if defined(WL_CFG80211_P2P_DEV_IF)
+wl_cfg80211_get_tx_power(struct wiphy *wiphy,
+       struct wireless_dev *wdev, s32 *dbm)
+#else
+wl_cfg80211_get_tx_power(struct wiphy *wiphy, s32 *dbm)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       s32 err = 0;
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+       err = wl_get_tx_power(ndev, dbm);
+       if (unlikely(err))
+               WL_ERR(("error (%d)\n", err));
+
+       return err;
+}
+
+static s32
+wl_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, bool unicast, bool multicast)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       u32 index;
+       s32 wsec;
+       s32 err = 0;
+       s32 bssidx;
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from dev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       WL_DBG(("key index (%d)\n", key_idx));
+       RETURN_EIO_IF_NOT_UP(cfg);
+       err = wldev_iovar_getint_bsscfg(dev, "wsec", &wsec, bssidx);
+       if (unlikely(err)) {
+               WL_ERR(("WLC_GET_WSEC error (%d)\n", err));
+               return err;
+       }
+       /* Fix IOT issue with Apple Airport */
+       if (wsec == WEP_ENABLED) {
+               /* Just select a new current key */
+               index = (u32) key_idx;
+               index = htod32(index);
+               err = wldev_ioctl_set(dev, WLC_SET_KEY_PRIMARY, &index,
+                       sizeof(index));
+               if (unlikely(err)) {
+                       WL_ERR(("error (%d)\n", err));
+               }
+       }
+       return err;
+}
+
+static s32
+wl_add_keyext(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, const u8 *mac_addr, struct key_params *params)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct wl_wsec_key key;
+       s32 err = 0;
+       s32 bssidx;
+       s32 mode = wl_get_mode_by_netdev(cfg, dev);
+
+       WL_MSG(dev->name, "key index (%d)\n", key_idx);
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+       bzero(&key, sizeof(key));
+       key.index = (u32) key_idx;
+
+       if (!ETHER_ISMULTI(mac_addr))
+               memcpy((char *)&key.ea, (const void *)mac_addr, ETHER_ADDR_LEN);
+       key.len = (u32) params->key_len;
+
+       /* check for key index change */
+       if (key.len == 0) {
+               /* key delete */
+               swap_key_from_BE(&key);
+               err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key),
+                       cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+               if (unlikely(err)) {
+                       WL_ERR(("key delete error (%d)\n", err));
+                       return err;
+               }
+       } else {
+               if (key.len > sizeof(key.data)) {
+                       WL_ERR(("Invalid key length (%d)\n", key.len));
+                       return -EINVAL;
+               }
+               WL_DBG(("Setting the key index %d\n", key.index));
+               memcpy(key.data, params->key, key.len);
+
+               if ((mode == WL_MODE_BSS) &&
+                       (params->cipher == WLAN_CIPHER_SUITE_TKIP)) {
+                       u8 keybuf[8];
+                       memcpy(keybuf, &key.data[24], sizeof(keybuf));
+                       memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
+                       memcpy(&key.data[16], keybuf, sizeof(keybuf));
+               }
+
+               /* if IW_ENCODE_EXT_RX_SEQ_VALID set */
+               if (params->seq && params->seq_len == 6) {
+                       /* rx iv */
+                       const u8 *ivptr;
+                       ivptr = (const u8 *) params->seq;
+                       key.rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
+                               (ivptr[3] << 8) | ivptr[2];
+                       key.rxiv.lo = (ivptr[1] << 8) | ivptr[0];
+                       key.iv_initialized = true;
+               }
+               key.algo = wl_rsn_cipher_wsec_key_algo_lookup(params->cipher);
+               if (key.algo == CRYPTO_ALGO_OFF) { //not found.
+                       WL_ERR(("Invalid cipher (0x%x)\n", params->cipher));
+                       return -EINVAL;
+               }
+               swap_key_from_BE(&key);
+#if !defined(CUSTOMER_HW4)
+               /* need to guarantee EAPOL 4/4 send out before set key */
+               dhd_wait_pend8021x(dev);
+#endif /* BCMDONGLEHOST && !CUSTOMER_HW4 */
+               err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key),
+                       cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+               if (unlikely(err)) {
+                       WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+                       return err;
+               }
+               WL_INFORM_MEM(("[%s] wsec key set\n", dev->name));
+       }
+       return err;
+}
+
+int
+wl_cfg80211_enable_roam_offload(struct net_device *dev, int enable)
+{
+       int err;
+       wl_eventmsg_buf_t ev_buf;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       if (dev != bcmcfg_to_prmry_ndev(cfg)) {
+               /* roam offload is only for the primary device */
+               return -1;
+       }
+
+       WL_INFORM_MEM(("[%s] wl roam_offload %d\n", dev->name, enable));
+       err = wldev_iovar_setint(dev, "roam_offload", enable);
+       if (err)
+               return err;
+
+       bzero(&ev_buf, sizeof(wl_eventmsg_buf_t));
+       wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_PSK_SUP, !enable);
+       wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_ASSOC_REQ_IE, !enable);
+       wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_ASSOC_RESP_IE, !enable);
+       wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_REASSOC, !enable);
+       wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_JOIN, !enable);
+       wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_ROAM, !enable);
+       err = wl_cfg80211_apply_eventbuffer(dev, cfg, &ev_buf);
+       if (!err) {
+               cfg->roam_offload = enable;
+       }
+       return err;
+}
+
+struct wireless_dev *
+wl_cfg80211_get_wdev_from_ifname(struct bcm_cfg80211 *cfg, const char *name)
+{
+       struct net_info *iter, *next;
+
+       if (name == NULL) {
+               WL_ERR(("Iface name is not provided\n"));
+               return NULL;
+       }
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       for_each_ndev(cfg, iter, next) {
+               GCC_DIAGNOSTIC_POP();
+               if (iter->ndev) {
+                       if (strcmp(iter->ndev->name, name) == 0) {
+                               return iter->ndev->ieee80211_ptr;
+                       }
+               }
+       }
+
+       WL_DBG(("Iface %s not found\n", name));
+       return NULL;
+}
+
+#if defined(PKT_FILTER_SUPPORT) && defined(APSTA_BLOCK_ARP_DURING_DHCP)
+void
+wl_cfg80211_block_arp(struct net_device *dev, int enable)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       WL_INFORM_MEM(("[%s] Enter. enable:%d\n", dev->name, enable));
+       if (!dhd_pkt_filter_enable) {
+               WL_DBG(("Packet filter isn't enabled\n"));
+               return;
+       }
+
+       /* Block/Unblock ARP frames only if STA is connected to
+        * the upstream AP in case of STA+SoftAP Concurrenct mode
+        */
+       if (!wl_get_drv_status(cfg, CONNECTED, dev)) {
+               WL_DBG(("STA not connected to upstream AP\n"));
+               return;
+       }
+
+       if (enable) {
+               WL_DBG(("Enable ARP Filter\n"));
+               /* Add ARP filter */
+               dhd_packet_filter_add_remove(dhdp, TRUE, DHD_BROADCAST_ARP_FILTER_NUM);
+
+               /* Enable ARP packet filter - blacklist */
+               dhd_pktfilter_offload_enable(dhdp, dhdp->pktfilter[DHD_BROADCAST_ARP_FILTER_NUM],
+                       TRUE, FALSE);
+       } else {
+               WL_DBG(("Disable ARP Filter\n"));
+               /* Disable ARP packet filter */
+               dhd_pktfilter_offload_enable(dhdp, dhdp->pktfilter[DHD_BROADCAST_ARP_FILTER_NUM],
+                       FALSE, TRUE);
+
+               /* Delete ARP filter */
+               dhd_packet_filter_add_remove(dhdp, FALSE, DHD_BROADCAST_ARP_FILTER_NUM);
+       }
+}
+#endif /* PKT_FILTER_SUPPORT && APSTA_BLOCK_ARP_DURING_DHCP */
+
+static s32
+wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, bool pairwise, const u8 *mac_addr,
+       struct key_params *params)
+{
+       struct wl_wsec_key key;
+       s32 val = 0;
+       s32 wsec = 0;
+       s32 err = 0;
+       u8 keybuf[8];
+       s32 bssidx = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 mode = wl_get_mode_by_netdev(cfg, dev);
+#ifdef WL_GCMP
+       uint32 algos = 0, mask = 0;
+#endif /* WL_GCMP */
+#if defined(WLAN_CIPHER_SUITE_PMK)
+       wsec_pmk_t pmk;
+       struct wl_security *sec;
+#endif /* defined(WLAN_CIPHER_SUITE_PMK) */
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       if (dhd_query_bus_erros(dhdp)) {
+               /* If we are hit with bus error, return success so that
+                * don't repeatedly call del station till we recover.
+                */
+               return 0;
+       }
+
+       WL_INFORM_MEM(("key index (%d) (0x%x)\n", key_idx, params->cipher));
+       RETURN_EIO_IF_NOT_UP(cfg);
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from dev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if (mac_addr &&
+               ((params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
+               (params->cipher != WLAN_CIPHER_SUITE_WEP104))) {
+                       wl_add_keyext(wiphy, dev, key_idx, mac_addr, params);
+                       goto exit;
+       }
+
+       BCM_REFERENCE(dhdp);
+       DHD_STATLOG_CTRL(dhdp, ST(INSTALL_KEY), dhd_net2idx(dhdp->info, dev), 0);
+
+       bzero(&key, sizeof(key));
+       /* Clear any buffered wep key */
+       bzero(&cfg->wep_key, sizeof(struct wl_wsec_key));
+
+       key.len = (u32) params->key_len;
+       key.index = (u32) key_idx;
+
+       if (unlikely(key.len > sizeof(key.data))) {
+               WL_ERR(("Too long key length (%u)\n", key.len));
+               return -EINVAL;
+       }
+       memcpy(key.data, params->key, key.len);
+
+       key.flags = WL_PRIMARY_KEY;
+
+       key.algo = wl_rsn_cipher_wsec_key_algo_lookup(params->cipher);
+       val = wl_rsn_cipher_wsec_algo_lookup(params->cipher);
+       if (val == WSEC_NONE) {
+               WL_ERR(("Invalid cipher (0x%x), key.len = %d\n", params->cipher, key.len));
+#if defined(WLAN_CIPHER_SUITE_PMK)
+       /* WLAN_CIPHER_SUITE_PMK is not NL80211 standard ,but BRCM proprietary cipher suite.
+        * so it doesn't have right algo type. Just for now, bypass this check for
+        * backward compatibility.
+        * TODO: deprecate this proprietary way and replace to nl80211 set_pmk API.
+        */
+               if (params->cipher != WLAN_CIPHER_SUITE_PMK)
+#endif /* defined(WLAN_CIPHER_SUITE_PMK) */
+               return -EINVAL;
+       }
+       switch (params->cipher) {
+       case WLAN_CIPHER_SUITE_TKIP:
+               if (params->key_len != TKIP_KEY_SIZE) {
+                       WL_ERR(("wrong TKIP Key length:%d", params->key_len));
+                       return -EINVAL;
+               }
+               /* wpa_supplicant switches the third and fourth quarters of the TKIP key */
+               if (mode == WL_MODE_BSS) {
+                       bcopy(&key.data[24], keybuf, sizeof(keybuf));
+                       bcopy(&key.data[16], &key.data[24], sizeof(keybuf));
+                       bcopy(keybuf, &key.data[16], sizeof(keybuf));
+               }
+               WL_DBG(("WLAN_CIPHER_SUITE_TKIP\n"));
+               break;
+#if defined(WLAN_CIPHER_SUITE_PMK)
+       case WLAN_CIPHER_SUITE_PMK:
+               sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+
+               WL_MEM(("set_pmk: wpa_auth:%x akm:%x\n", sec->wpa_auth, params->cipher));
+               /* Avoid pmk set for SAE and OWE for external supplicant case. */
+               if (IS_AKM_SAE(sec->wpa_auth) || IS_AKM_OWE(sec->wpa_auth)) {
+                       WL_INFORM_MEM(("skip pmk set for akm:%x\n", sec->wpa_auth));
+                       break;
+               }
+
+               if (params->key_len > sizeof(pmk.key)) {
+                       WL_ERR(("Worng PMK key length:%d", params->key_len));
+                       return -EINVAL;
+               }
+               bzero(&pmk, sizeof(pmk));
+               bcopy(params->key, &pmk.key, params->key_len);
+               pmk.key_len = params->key_len;
+               pmk.flags = 0; /* 0:PMK, WSEC_PASSPHRASE:PSK, WSEC_SAE_PASSPHRASE:SAE_PSK */
+
+               if ((sec->wpa_auth == WLAN_AKM_SUITE_8021X) ||
+                       (sec->wpa_auth == WL_AKM_SUITE_SHA256_1X)) {
+                       err = wldev_iovar_setbuf_bsscfg(dev, "okc_info_pmk", pmk.key, pmk.key_len,
+                               cfg->ioctl_buf, WLC_IOCTL_SMLEN, bssidx, &cfg->ioctl_buf_sync);
+                       if (err) {
+                               /* could fail in case that 'okc' is not supported */
+                               WL_INFORM_MEM(("okc_info_pmk failed, err=%d (ignore)\n", err));
+                       }
+               }
+
+               err = wldev_ioctl_set(dev, WLC_SET_WSEC_PMK, &pmk, sizeof(pmk));
+               if (err) {
+                       WL_ERR(("pmk failed, err=%d (ignore)\n", err));
+                       return err;
+               } else {
+                       WL_DBG(("pmk set. flags:0x%x\n", pmk.flags));
+               }
+               /* Clear key length to delete key */
+               key.len = 0;
+               break;
+#endif /* WLAN_CIPHER_SUITE_PMK */
+#ifdef WL_GCMP
+       case WLAN_CIPHER_SUITE_GCMP:
+       case WLAN_CIPHER_SUITE_GCMP_256:
+       case WLAN_CIPHER_SUITE_BIP_GMAC_128:
+       case WLAN_CIPHER_SUITE_BIP_GMAC_256:
+               algos = KEY_ALGO_MASK(key.algo);
+               mask = algos | KEY_ALGO_MASK(CRYPTO_ALGO_AES_CCM);
+               break;
+#endif /* WL_GCMP */
+       default: /* No post processing required */
+               WL_DBG(("no post processing required (0x%x)\n", params->cipher));
+               break;
+       }
+
+       /* Set the new key/index */
+       if ((mode == WL_MODE_IBSS) && (val & (TKIP_ENABLED | AES_ENABLED))) {
+               WL_ERR(("IBSS KEY setted\n"));
+               wldev_iovar_setint(dev, "wpa_auth", WPA_AUTH_NONE);
+       }
+       swap_key_from_BE(&key);
+       if ((params->cipher == WLAN_CIPHER_SUITE_WEP40) ||
+               (params->cipher == WLAN_CIPHER_SUITE_WEP104)) {
+               /*
+                * For AP role, since we are doing a wl down before bringing up AP,
+                * the plumbed keys will be lost. So for AP once we bring up AP, we
+                * need to plumb keys again. So buffer the keys for future use. This
+                * is more like a WAR. If firmware later has the capability to do
+                * interface upgrade without doing a "wl down" and "wl apsta 0", then
+                * this will not be required.
+                */
+               WL_DBG(("Buffering WEP Keys \n"));
+               memcpy(&cfg->wep_key, &key, sizeof(struct wl_wsec_key));
+       }
+       err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key), cfg->ioctl_buf,
+               WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+               return err;
+       }
+
+exit:
+       err = wldev_iovar_getint_bsscfg(dev, "wsec", &wsec, bssidx);
+       if (unlikely(err)) {
+               WL_ERR(("get wsec error (%d)\n", err));
+               return err;
+       }
+
+       wsec |= val;
+       err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+       if (unlikely(err)) {
+               WL_ERR(("set wsec error (%d)\n", err));
+               return err;
+       }
+#ifdef WL_GCMP
+       wl_set_wsec_info_algos(dev, algos, mask);
+#endif /* WL_GCMP */
+       wl_cfg80211_check_in4way(cfg, dev, NO_SCAN_IN4WAY|NO_BTC_IN4WAY,
+               WL_EXT_STATUS_ADD_KEY, NULL);
+       return err;
+}
+
+static s32
+wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, bool pairwise, const u8 *mac_addr)
+{
+       struct wl_wsec_key key;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 err = 0;
+       s32 bssidx;
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       if (dhd_query_bus_erros(dhdp)) {
+               /* If we are hit with bus error, return success so that
+                * don't repeatedly call del station till we recover.
+                */
+               return 0;
+       }
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+       WL_DBG(("Enter\n"));
+
+#ifndef MFP
+       if ((key_idx >= DOT11_MAX_DEFAULT_KEYS) && (key_idx < DOT11_MAX_DEFAULT_KEYS+2))
+               return -EINVAL;
+#endif
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+       BCM_REFERENCE(dhdp);
+       DHD_STATLOG_CTRL(dhdp, ST(DELETE_KEY), dhd_net2idx(dhdp->info, dev), 0);
+       bzero(&key, sizeof(key));
+
+       key.flags = WL_PRIMARY_KEY;
+       key.algo = CRYPTO_ALGO_OFF;
+       key.index = (u32) key_idx;
+
+       WL_DBG(("key index (%d)\n", key_idx));
+       /* Set the new key/index */
+       swap_key_from_BE(&key);
+       err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key), cfg->ioctl_buf,
+               WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               if (err == -EINVAL) {
+                       if (key.index >= DOT11_MAX_DEFAULT_KEYS) {
+                               /* we ignore this key index in this case */
+                               WL_DBG(("invalid key index (%d)\n", key_idx));
+                       }
+               } else {
+                       WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+               }
+               return err;
+       }
+       return err;
+}
+
+/* NOTE : this function cannot work as is and is never called */
+static s32
+wl_cfg80211_get_key(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, bool pairwise, const u8 *mac_addr, void *cookie,
+       void (*callback) (void *cookie, struct key_params * params))
+{
+       struct key_params params;
+       struct wl_wsec_key key;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct wl_security *sec;
+       s32 wsec;
+       s32 err = 0;
+       s32 bssidx;
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+       WL_DBG(("key index (%d)\n", key_idx));
+       RETURN_EIO_IF_NOT_UP(cfg);
+       bzero(&key, sizeof(key));
+       key.index = key_idx;
+       swap_key_to_BE(&key);
+       bzero(&params, sizeof(params));
+       params.key_len = (u8) min_t(u8, DOT11_MAX_KEY_SIZE, key.len);
+       params.key = key.data;
+
+       err = wldev_iovar_getint_bsscfg(dev, "wsec", &wsec, bssidx);
+       if (unlikely(err)) {
+               WL_ERR(("WLC_GET_WSEC error (%d)\n", err));
+               return err;
+       }
+       switch (WSEC_ENABLED(wsec)) {
+               case WEP_ENABLED:
+                       sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+                       if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
+                               params.cipher = WLAN_CIPHER_SUITE_WEP40;
+                               WL_DBG(("WLAN_CIPHER_SUITE_WEP40\n"));
+                       } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
+                               params.cipher = WLAN_CIPHER_SUITE_WEP104;
+                               WL_DBG(("WLAN_CIPHER_SUITE_WEP104\n"));
+                       }
+                       break;
+               case TKIP_ENABLED:
+                       params.cipher = WLAN_CIPHER_SUITE_TKIP;
+                       WL_DBG(("WLAN_CIPHER_SUITE_TKIP\n"));
+                       break;
+               case AES_ENABLED:
+                       params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
+                       WL_DBG(("WLAN_CIPHER_SUITE_AES_CMAC\n"));
+                       break;
+
+#ifdef BCMWAPI_WPI
+               case SMS4_ENABLED:
+                       params.cipher = WLAN_CIPHER_SUITE_SMS4;
+                       WL_DBG(("WLAN_CIPHER_SUITE_SMS4\n"));
+                       break;
+#endif
+
+#if defined(SUPPORT_SOFTAP_WPAWPA2_MIXED)
+               /* to connect to mixed mode AP */
+               case (AES_ENABLED | TKIP_ENABLED): /* TKIP CCMP */
+                       params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
+                       WL_DBG(("WLAN_CIPHER_SUITE_TKIP\n"));
+                       break;
+#endif
+               default:
+                       WL_ERR(("Invalid algo (0x%x)\n", wsec));
+                       return -EINVAL;
+       }
+
+       callback(cookie, &params);
+       return err;
+}
+
+static s32
+wl_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
+       struct net_device *dev, u8 key_idx)
+{
+#ifdef MFP
+       /* Firmware seems to use hard coded index for Group Mgmt Key.
+        * TODO/Need to check whether something else needs to be
+        * taken here
+        */
+       return 0;
+#else
+       WL_INFORM_MEM(("Not supported\n"));
+       return -EOPNOTSUPP;
+#endif /* MFP */
+}
+
+static bool
+wl_check_assoc_state(struct bcm_cfg80211 *cfg, struct net_device *dev)
+{
+       wl_assoc_info_t asinfo;
+       uint32 state = 0;
+       int err;
+
+       err = wldev_iovar_getbuf_bsscfg(dev, "assoc_info",
+               NULL, 0, cfg->ioctl_buf, WLC_IOCTL_MEDLEN, 0, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("failed to get assoc_info : err=%d\n", err));
+               return FALSE;
+       } else {
+               memcpy(&asinfo, cfg->ioctl_buf, sizeof(wl_assoc_info_t));
+               state = dtoh32(asinfo.state);
+               WL_DBG(("assoc state=%d\n", state));
+       }
+
+       return (state > 0)? TRUE:FALSE;
+}
+
+static s32
+wl_cfg80211_get_rssi(struct net_device *dev, struct bcm_cfg80211 *cfg, s32 *rssi)
+{
+       s32 err = BCME_OK;
+       scb_val_t scb_val;
+#ifdef SUPPORT_RSSI_SUM_REPORT
+       wl_rssi_ant_mimo_t rssi_ant_mimo;
+#endif /* SUPPORT_RSSI_SUM_REPORT */
+
+       if (dev == NULL || cfg == NULL) {
+               return BCME_ERROR;
+       }
+
+       /* initialize rssi */
+       *rssi = 0;
+
+#ifdef SUPPORT_RSSI_SUM_REPORT
+       /* Query RSSI sum across antennas */
+       bzero(&rssi_ant_mimo, sizeof(rssi_ant_mimo));
+       err = wl_get_rssi_per_ant(dev, dev->name, NULL, &rssi_ant_mimo);
+       if (err) {
+               WL_ERR(("Could not get rssi sum (%d)\n", err));
+               /* set rssi to zero and do not return error,
+               * because iovar phy_rssi_ant could return BCME_UNSUPPORTED
+               * when bssid was null during roaming
+               */
+               err = BCME_OK;
+       } else {
+               cfg->rssi_sum_report = TRUE;
+               if ((*rssi = rssi_ant_mimo.rssi_sum) >= 0) {
+                       *rssi = 0;
+               }
+       }
+#endif /* SUPPORT_RSSI_SUM_REPORT */
+
+       /* if SUPPORT_RSSI_SUM_REPORT works once, do not use legacy method anymore */
+       if (cfg->rssi_sum_report == FALSE) {
+               bzero(&scb_val, sizeof(scb_val));
+               scb_val.val = 0;
+               err = wldev_ioctl_get(dev, WLC_GET_RSSI, &scb_val,
+                       sizeof(scb_val_t));
+               if (err) {
+                       WL_ERR(("Could not get rssi (%d)\n", err));
+                       return err;
+               }
+#if defined(RSSIOFFSET)
+               *rssi = wl_update_rssi_offset(dev, dtoh32(scb_val.val));
+#else
+               *rssi = dtoh32(scb_val.val);
+#endif
+       }
+
+       if (*rssi >= 0) {
+               /* check assoc status including roaming */
+               DHD_OS_WAKE_LOCK((dhd_pub_t *)(cfg->pub));
+               if (wl_get_drv_status(cfg, CONNECTED, dev) && wl_check_assoc_state(cfg, dev)) {
+                       *rssi = cfg->rssi;         /* use previous RSSI */
+                       WL_DBG(("use previous RSSI %d dBm\n", cfg->rssi));
+               } else {
+                       *rssi = 0;
+               }
+               DHD_OS_WAKE_UNLOCK((dhd_pub_t *)(cfg->pub));
+       } else {
+               /* backup the current rssi */
+               cfg->rssi = *rssi;
+       }
+
+       return err;
+}
+
+static int
+wl_cfg80211_ifstats_counters_cb(void *ctx, const uint8 *data, uint16 type, uint16 len)
+{
+       switch (type) {
+       case WL_IFSTATS_XTLV_IF_INDEX:
+               WL_DBG(("Stats received on interface index: %d\n", *data));
+               break;
+       case WL_IFSTATS_XTLV_GENERIC: {
+               if (len > sizeof(wl_if_stats_t)) {
+                       WL_INFORM(("type 0x%x: cntbuf length too long! %d > %d\n",
+                               type, len, (int)sizeof(wl_if_stats_t)));
+               }
+               memcpy(ctx, data, sizeof(wl_if_stats_t));
+               break;
+       }
+       default:
+               WL_DBG(("Unsupported counter type 0x%x\n", type));
+               break;
+       }
+
+       return BCME_OK;
+}
+
+/* Parameters to if_counters iovar need to be converted to XTLV format
+ * before sending to FW. The length of the top level XTLV container
+ * containing parameters should not exceed 228 bytes
+ */
+#define IF_COUNTERS_PARAM_CONTAINER_LEN_MAX    228
+
+int
+wl_cfg80211_ifstats_counters(struct net_device *dev, wl_if_stats_t *if_stats)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       uint8 *pbuf = NULL;
+       bcm_xtlvbuf_t xtlvbuf, local_xtlvbuf;
+       bcm_xtlv_t *xtlv;
+       uint16 expected_resp_len;
+       wl_stats_report_t *request = NULL, *response = NULL;
+       int bsscfg_idx;
+       int ret = BCME_OK;
+
+       pbuf = (uint8 *)MALLOCZ(dhdp->osh, WLC_IOCTL_MEDLEN);
+       if (!pbuf) {
+               WL_ERR(("Failed to allocate local pbuf\n"));
+               return BCME_NOMEM;
+       }
+
+       /* top level container length cannot exceed 228 bytes.
+        * This is because the output buffer is 1535 bytes long.
+        * Allow 1300 bytes for reporting stats coming in XTLV format
+        */
+       request = (wl_stats_report_t *)
+               MALLOCZ(dhdp->osh, IF_COUNTERS_PARAM_CONTAINER_LEN_MAX);
+       if (!request) {
+               WL_ERR(("Failed to allocate wl_stats_report_t with length (%d)\n",
+                       IF_COUNTERS_PARAM_CONTAINER_LEN_MAX));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       request->version = WL_STATS_REPORT_REQUEST_VERSION_V2;
+
+       /* Top level container... we will create it ourselves */
+       /* Leave space for report version, length, and top level XTLV
+        * WL_IFSTATS_XTLV_IF.
+        */
+       ret = bcm_xtlv_buf_init(&local_xtlvbuf,
+               (uint8*)(request->data) + BCM_XTLV_HDR_SIZE,
+               IF_COUNTERS_PARAM_CONTAINER_LEN_MAX -
+               offsetof(wl_stats_report_t, data) - BCM_XTLV_HDR_SIZE,
+               BCM_XTLV_OPTION_ALIGN32);
+
+       if (ret) {
+               goto fail;
+       }
+
+       /* Populate requests using this the local_xtlvbuf context. The xtlvbuf
+        * is used to fill the container containing the XTLVs populated using
+        * local_xtlvbuf.
+        */
+       ret = bcm_xtlv_buf_init(&xtlvbuf,
+               (uint8*)(request->data),
+               IF_COUNTERS_PARAM_CONTAINER_LEN_MAX -
+               offsetof(wl_stats_report_t, data),
+               BCM_XTLV_OPTION_ALIGN32);
+
+       if (ret) {
+               goto fail;
+       }
+
+       /* Request generic stats */
+       ret = bcm_xtlv_put_data(&local_xtlvbuf,
+               WL_IFSTATS_XTLV_GENERIC, NULL, 0);
+       if (ret) {
+               goto fail;
+       }
+
+       /* Complete the outer container with type and length
+        * only.
+        */
+       ret = bcm_xtlv_put_data(&xtlvbuf,
+               WL_IFSTATS_XTLV_IF,
+               NULL, bcm_xtlv_buf_len(&local_xtlvbuf));
+
+       if (ret) {
+               goto fail;
+       }
+
+       request->length = bcm_xtlv_buf_len(&xtlvbuf) +
+               offsetof(wl_stats_report_t, data);
+       bsscfg_idx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr);
+
+       /* send the command over to the device and get teh output */
+       ret = wldev_iovar_getbuf_bsscfg(dev, "if_counters", (void *)request,
+               request->length, pbuf, WLC_IOCTL_MEDLEN, bsscfg_idx,
+               &cfg->ioctl_buf_sync);
+       if (ret < 0) {
+               WL_ERR(("if_counters not supported ret=%d\n", ret));
+               goto fail;
+       }
+
+       /* Reuse request to process response */
+       response = (wl_stats_report_t *)pbuf;
+
+       /* version check */
+       if (response->version != WL_STATS_REPORT_REQUEST_VERSION_V2) {
+               ret = BCME_VERSION;
+               goto fail;
+       }
+
+       xtlv = (bcm_xtlv_t *)(response->data);
+
+       expected_resp_len =
+               (BCM_XTLV_LEN(xtlv) + OFFSETOF(wl_stats_report_t, data));
+
+       /* Check if the received length is as expected */
+       if ((response->length > WLC_IOCTL_MEDLEN) ||
+               (response->length < expected_resp_len)) {
+               ret = BCME_ERROR;
+               WL_ERR(("Illegal response length received. Got: %d"
+                       " Expected: %d. Expected len must be <= %u\n",
+                       response->length, expected_resp_len, WLC_IOCTL_MEDLEN));
+               goto fail;
+       }
+
+       /* check the type. The return data will be in
+        * WL_IFSTATS_XTLV_IF container. So check if that container is
+        * present
+        */
+       if (BCM_XTLV_ID(xtlv) != WL_IFSTATS_XTLV_IF) {
+               ret = BCME_ERROR;
+               WL_ERR(("unexpected type received: %d Expected: %d\n",
+                       BCM_XTLV_ID(xtlv), WL_IFSTATS_XTLV_IF));
+               goto fail;
+       }
+
+       /* Process XTLVs within WL_IFSTATS_XTLV_IF container */
+       ret = bcm_unpack_xtlv_buf(if_stats,
+               (uint8*)response->data + BCM_XTLV_HDR_SIZE,
+               BCM_XTLV_LEN(xtlv), /* total length of all TLVs in container */
+               BCM_XTLV_OPTION_ALIGN32, wl_cfg80211_ifstats_counters_cb);
+       if (ret) {
+               WL_ERR(("Error unpacking XTLVs in wl_ifstats_counters: %d\n", ret));
+       }
+
+fail:
+       if (pbuf) {
+               MFREE(dhdp->osh, pbuf, WLC_IOCTL_MEDLEN);
+       }
+
+       if (request) {
+               MFREE(dhdp->osh, request, IF_COUNTERS_PARAM_CONTAINER_LEN_MAX);
+       }
+       return ret;
+}
+#undef IF_COUNTERS_PARAM_CONTAINER_LEN_MAX
+
+static s32
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+wl_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev,
+        const u8 *mac, struct station_info *sinfo)
+#else
+wl_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev,
+        u8 *mac, struct station_info *sinfo)
+#endif
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 rssi = 0;
+#if defined(SUPPORT_RSSI_SUM_REPORT) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, \
+       0))
+       wl_rssi_ant_mimo_t rssi_ant_mimo;
+       int cnt, chains;
+#endif /* SUPPORT_RSSI_SUM_REPORT && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)) */
+       s32 rate = 0;
+       s32 err = 0;
+       u16 wl_iftype = 0;
+       u16 wl_mode = 0;
+       get_pktcnt_t pktcnt;
+       wl_if_stats_t *if_stats = NULL;
+       sta_info_v4_t *sta = NULL;
+       u8 *curmacp = NULL;
+       s8 eabuf[ETHER_ADDR_STR_LEN];
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       bool fw_assoc_state = FALSE;
+       u32 dhd_assoc_state = 0;
+       void *buf;
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+
+       if (cfg80211_to_wl_iftype(dev->ieee80211_ptr->iftype, &wl_iftype, &wl_mode) < 0) {
+               return -EINVAL;
+       }
+
+       buf = MALLOC(cfg->osh, MAX(sizeof(wl_if_stats_t), WLC_IOCTL_SMLEN));
+       if (buf == NULL) {
+               WL_ERR(("wl_cfg80211_get_station: MALLOC failed\n"));
+               goto error;
+       }
+
+       switch (wl_iftype) {
+               case WL_IF_TYPE_STA:
+               case WL_IF_TYPE_IBSS:
+                       if (cfg->roam_offload) {
+                               struct ether_addr bssid;
+                               bzero(&bssid, sizeof(bssid));
+                               err = wldev_ioctl_get(dev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN);
+                               if (err) {
+                                       WL_ERR(("Failed to get current BSSID\n"));
+                               } else {
+                                       if (memcmp(mac, &bssid.octet, ETHER_ADDR_LEN) != 0) {
+                                               /* roaming is detected */
+                                               err = wl_cfg80211_delayed_roam(cfg, dev, &bssid);
+                                               if (err)
+                                                       WL_ERR(("Failed to handle the delayed"
+                                                               " roam, err=%d", err));
+                                               mac = (u8 *)bssid.octet;
+                                       }
+                               }
+                       }
+                       dhd_assoc_state = wl_get_drv_status(cfg, CONNECTED, dev);
+                       DHD_OS_WAKE_LOCK(dhd);
+                       fw_assoc_state = dhd_is_associated(dhd, 0, &err);
+                       if (dhd_assoc_state && !fw_assoc_state) {
+                               /* check roam (join) status */
+                               if (wl_check_assoc_state(cfg, dev)) {
+                                       fw_assoc_state = TRUE;
+                                       WL_DBG(("roam status\n"));
+                               }
+                       }
+                       DHD_OS_WAKE_UNLOCK(dhd);
+                       if (!dhd_assoc_state || !fw_assoc_state) {
+                               WL_ERR(("NOT assoc\n"));
+                               if (err == -ENODATA)
+                                       goto error;
+                               if (!dhd_assoc_state) {
+                                       WL_TRACE_HW4(("drv state is not connected \n"));
+                               }
+                               if (!fw_assoc_state) {
+                                       WL_TRACE_HW4(("fw state is not associated \n"));
+                               }
+                               /* Disconnect due to fw is not associated for
+                                * FW_ASSOC_WATCHDOG_TIME ms.
+                                * 'err == 0' of dhd_is_associated() and '!fw_assoc_state'
+                                * means that BSSID is null.
+                                */
+                               if (dhd_assoc_state && !fw_assoc_state && !err) {
+                                       if (!fw_assoc_watchdog_started) {
+                                               fw_assoc_watchdog_ms = OSL_SYSUPTIME();
+                                               fw_assoc_watchdog_started = TRUE;
+                                               WL_TRACE_HW4(("fw_assoc_watchdog_started \n"));
+                                       } else if (OSL_SYSUPTIME() - fw_assoc_watchdog_ms >
+                                                       FW_ASSOC_WATCHDOG_TIME) {
+                                               fw_assoc_watchdog_started = FALSE;
+                                               err = -ENODEV;
+                                               WL_TRACE_HW4(("fw is not associated for %d ms \n",
+                                                       (OSL_SYSUPTIME() - fw_assoc_watchdog_ms)));
+                                               goto get_station_err;
+                                       }
+                               }
+                               err = -ENODEV;
+                               goto error;
+                       }
+                       if (dhd_is_associated(dhd, 0, NULL)) {
+                               fw_assoc_watchdog_started = FALSE;
+                       }
+                       curmacp = wl_read_prof(cfg, dev, WL_PROF_BSSID);
+                       if (memcmp(mac, curmacp, ETHER_ADDR_LEN)) {
+                               WL_ERR(("Wrong Mac address: "MACDBG" != "MACDBG"\n",
+                                       MAC2STRDBG(mac), MAC2STRDBG(curmacp)));
+                       }
+                       /* go through to get another information */
+               case WL_IF_TYPE_P2P_GC:
+               case WL_IF_TYPE_P2P_DISC:
+                       if ((err = wl_cfg80211_get_rssi(dev, cfg, &rssi)) != BCME_OK) {
+                               goto get_station_err;
+                       }
+#if defined(RSSIAVG)
+                       err = wl_update_connected_rssi_cache(dev, &cfg->g_connected_rssi_cache_ctrl, &rssi);
+                       if (err) {
+                               WL_ERR(("Could not get rssi (%d)\n", err));
+                               goto get_station_err;
+                       }
+                       wl_delete_dirty_rssi_cache(&cfg->g_connected_rssi_cache_ctrl);
+                       wl_reset_rssi_cache(&cfg->g_connected_rssi_cache_ctrl);
+#endif
+#if defined(RSSIOFFSET)
+                       rssi = wl_update_rssi_offset(dev, rssi);
+#endif
+#if !defined(RSSIAVG) && !defined(RSSIOFFSET)
+                       // terence 20150419: limit the max. rssi to -2 or the bss will be filtered out in android OS
+                       rssi = MIN(rssi, RSSI_MAXVAL);
+#endif
+                       sinfo->filled |= STA_INFO_BIT(INFO_SIGNAL);
+                       sinfo->signal = rssi;
+                       WL_DBG(("RSSI %d dBm\n", rssi));
+#if defined(SUPPORT_RSSI_SUM_REPORT) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, \
+       0))
+                       /* Query RSSI sum across antennas */
+                       memset(&rssi_ant_mimo, 0, sizeof(rssi_ant_mimo));
+                       err = wl_get_rssi_per_ant(dev, dev->name, NULL, &rssi_ant_mimo);
+                       if (err) {
+                               WL_ERR(("Could not get rssi sum (%d)\n", err));
+                       } else {
+                               chains = 0;
+                               for (cnt = 0; cnt < rssi_ant_mimo.count; cnt++) {
+                                       sinfo->chain_signal[cnt] = rssi_ant_mimo.rssi_ant[cnt];
+                                       chains |= (1 << cnt);
+                                       WL_DBG(("RSSI[%d]: %d dBm\n",
+                                               cnt, rssi_ant_mimo.rssi_ant[cnt]));
+                               }
+                               sinfo->chains = chains;
+                               sinfo->filled |= STA_INFO_BIT(INFO_CHAIN_SIGNAL);
+                       }
+#endif /* SUPPORT_RSSI_SUM_REPORT && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)) */
+                       /* go through to get another information */
+               case WL_IF_TYPE_P2P_GO:
+                       /* Report the current tx rate */
+                       rate = 0;
+                       err = wldev_ioctl_get(dev, WLC_GET_RATE, &rate, sizeof(rate));
+                       if (err) {
+                               WL_ERR(("Could not get rate (%d)\n", err));
+                       } else {
+#if defined(USE_DYNAMIC_MAXPKT_RXGLOM)
+                               int rxpktglom;
+#endif
+                               rate = dtoh32(rate);
+                               sinfo->filled |= STA_INFO_BIT(INFO_TX_BITRATE);
+                               sinfo->txrate.legacy = rate * 5;
+                               WL_DBG(("Rate %d Mbps\n", (rate / 2)));
+#if defined(USE_DYNAMIC_MAXPKT_RXGLOM)
+                               rxpktglom = ((rate/2) > 150) ? 20 : 10;
+
+                               if (maxrxpktglom != rxpktglom) {
+                                       maxrxpktglom = rxpktglom;
+                                       WL_DBG(("Rate %d Mbps, update bus:"
+                                               "maxtxpktglom=%d\n", (rate/2), maxrxpktglom));
+                                       err = wldev_iovar_setbuf(dev, "bus:maxtxpktglom",
+                                                       (char*)&maxrxpktglom, 4, cfg->ioctl_buf,
+                                                       WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+                                       if (err < 0) {
+                                               WL_ERR(("set bus:maxtxpktglom failed, %d\n", err));
+                                       }
+                               }
+#endif
+                       }
+                       if_stats = (wl_if_stats_t *)buf;
+                       bzero(if_stats, sizeof(*if_stats));
+                       if (FW_SUPPORTED(dhd, ifst)) {
+                               err = wl_cfg80211_ifstats_counters(dev, if_stats);
+                       } else
+                       {
+                               err = wldev_iovar_getbuf(dev, "if_counters", NULL, 0,
+                                               (char *)if_stats, sizeof(*if_stats), NULL);
+                       }
+
+                       if (err) {
+//                             WL_ERR(("if_counters not supported ret=%d\n", err));
+                               bzero(&pktcnt, sizeof(pktcnt));
+                               err = wldev_ioctl_get(dev, WLC_GET_PKTCNTS, &pktcnt,
+                                               sizeof(pktcnt));
+                               if (!err) {
+                                       sinfo->rx_packets = pktcnt.rx_good_pkt;
+                                       sinfo->rx_dropped_misc = pktcnt.rx_bad_pkt;
+                                       sinfo->tx_packets = pktcnt.tx_good_pkt;
+                                       sinfo->tx_failed  = pktcnt.tx_bad_pkt;
+                               }
+                       } else {
+                               sinfo->rx_packets = (uint32)dtoh64(if_stats->rxframe);
+                               /* In this case, if_stats->rxerror is invalid.
+                                * So, force to assign '0'.
+                                */
+                               sinfo->rx_dropped_misc = 0;
+                               sinfo->tx_packets = (uint32)dtoh64(if_stats->txfrmsnt);
+                               sinfo->tx_failed = (uint32)dtoh64(if_stats->txnobuf) +
+                                       (uint32)dtoh64(if_stats->txrunt) +
+                                       (uint32)dtoh64(if_stats->txfail);
+                               sinfo->rx_bytes = dtoh64(if_stats->rxbyte);
+                               sinfo->tx_bytes = dtoh64(if_stats->txbyte);
+                               sinfo->tx_retries = (uint32)dtoh64(if_stats->txretry);
+                               sinfo->filled |= (STA_INFO_BIT(INFO_RX_BYTES) |
+                                       STA_INFO_BIT(INFO_TX_BYTES) |
+                                       STA_INFO_BIT(INFO_TX_RETRIES));
+                       }
+
+                       sinfo->filled |= (STA_INFO_BIT(INFO_RX_PACKETS) |
+                                       STA_INFO_BIT(INFO_RX_DROP_MISC) |
+                                       STA_INFO_BIT(INFO_TX_PACKETS) |
+                                       STA_INFO_BIT(INFO_TX_FAILED));
+get_station_err:
+                       if (err && (err != -ENODATA)) {
+                               /* Disconnect due to zero BSSID or error to get RSSI */
+                               scb_val_t scbval;
+                               DHD_STATLOG_CTRL(dhd, ST(DISASSOC_INT_START),
+                                       dhd_net2idx(dhd->info, dev), DOT11_RC_DISASSOC_LEAVING);
+                               scbval.val = htod32(DOT11_RC_DISASSOC_LEAVING);
+                               err = wldev_ioctl_set(dev, WLC_DISASSOC, &scbval,
+                                               sizeof(scb_val_t));
+                               if (unlikely(err)) {
+                                       WL_ERR(("disassoc error (%d)\n", err));
+                               }
+
+                               WL_ERR(("force cfg80211_disconnected: %d\n", err));
+                               wl_clr_drv_status(cfg, CONNECTED, dev);
+                               DHD_STATLOG_CTRL(dhd, ST(DISASSOC_DONE),
+                                       dhd_net2idx(dhd->info, dev), DOT11_RC_DISASSOC_LEAVING);
+                               CFG80211_DISCONNECTED(dev, 0, NULL, 0, false, GFP_KERNEL);
+                               wl_link_down(cfg);
+                       }
+                       break;
+               case WL_IF_TYPE_AP:
+                       err = wldev_iovar_getbuf(dev, "sta_info", (const   void*)mac,
+                                       ETHER_ADDR_LEN, buf, WLC_IOCTL_SMLEN, NULL);
+                       if (err < 0) {
+                               WL_ERR(("GET STA INFO failed, %d\n", err));
+                               goto error;
+                       }
+                       sinfo->filled = STA_INFO_BIT(INFO_INACTIVE_TIME);
+                       sta = (sta_info_v4_t *)buf;
+                       if (sta->ver != WL_STA_VER_4 && sta->ver != WL_STA_VER_5) {
+                               WL_ERR(("GET STA INFO version mismatch, %d\n", err));
+                               return BCME_VERSION;
+                       }
+                       sta->len = dtoh16(sta->len);
+                       sta->cap = dtoh16(sta->cap);
+                       sta->flags = dtoh32(sta->flags);
+                       sta->idle = dtoh32(sta->idle);
+                       sta->in = dtoh32(sta->in);
+                       sinfo->inactive_time = sta->idle * 1000;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) || defined(WL_COMPAT_WIRELESS)
+                       if (sta->flags & WL_STA_ASSOC) {
+                               sinfo->filled |= STA_INFO_BIT(INFO_CONNECTED_TIME);
+                               sinfo->connected_time = sta->in;
+                       }
+#endif
+                       WL_INFORM_MEM(("STA %s, flags 0x%x, idle time %ds, connected time %ds\n",
+                               bcm_ether_ntoa((const struct ether_addr *)mac, eabuf),
+                               sta->flags, sta->idle, sta->in));
+                       break;
+               default :
+                       WL_ERR(("Invalid device mode %d\n", wl_get_mode_by_netdev(cfg, dev)));
+       }
+error:
+       if (buf) {
+               MFREE(cfg->osh, buf, MAX(sizeof(wl_if_stats_t), WLC_IOCTL_SMLEN));
+       }
+
+       return err;
+}
+
+static int
+wl_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
+       int idx, u8 *mac, struct station_info *sinfo)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct maclist *assoc_maclist = (struct maclist *)&(cfg->assoclist);
+       int err;
+
+       WL_ERR(("%s: enter, idx=%d\n", __FUNCTION__, idx));
+
+       if (idx == 0) {
+               assoc_maclist->count = MAX_NUM_OF_ASSOCIATED_DEV;
+               err = wldev_ioctl_get(ndev, WLC_GET_ASSOCLIST,
+                       assoc_maclist, sizeof(cfg->assoclist));
+               if (err < 0) {
+                       WL_ERR(("WLC_GET_ASSOCLIST error %d\n", err));
+                       cfg->assoclist.count = 0;
+                       return -EOPNOTSUPP;
+               }
+       }
+
+       if (idx < le32_to_cpu(cfg->assoclist.count)) {
+               memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
+               return wl_cfg80211_get_station(wiphy, ndev, mac, sinfo);
+       }
+
+       return -ENOENT;
+}
+
+static s32
+wl_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       bool enabled, s32 timeout)
+{
+       s32 pm;
+       s32 err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_info *_net_info = wl_get_netinfo_by_netdev(cfg, dev);
+       s32 mode;
+#ifdef RTT_SUPPORT
+       rtt_status_info_t *rtt_status;
+#endif /* RTT_SUPPORT */
+       dhd_pub_t *dhd = cfg->pub;
+       RETURN_EIO_IF_NOT_UP(cfg);
+
+       WL_DBG(("Enter\n"));
+       mode = wl_get_mode_by_netdev(cfg, dev);
+       if (cfg->p2p_net == dev || _net_info == NULL ||
+                       !wl_get_drv_status(cfg, CONNECTED, dev) ||
+                       ((mode != WL_MODE_BSS) &&
+                       (mode != WL_MODE_IBSS))) {
+               return err;
+       }
+
+       /* Enlarge pm_enable_work */
+       wl_add_remove_pm_enable_work(cfg, WL_PM_WORKQ_LONG);
+
+       pm = enabled ? PM_FAST : PM_OFF;
+       if (_net_info->pm_block) {
+               WL_ERR(("%s:Do not enable the power save for pm_block %d\n",
+                       dev->name, _net_info->pm_block));
+               pm = PM_OFF;
+       }
+       if (enabled && dhd_conf_get_pm(dhd) >= 0)
+               pm = dhd_conf_get_pm(dhd);
+       pm = htod32(pm);
+       WL_DBG(("%s:power save %s\n", dev->name, (pm ? "enabled" : "disabled")));
+#ifdef RTT_SUPPORT
+       rtt_status = GET_RTTSTATE(dhd);
+       if (rtt_status->status != RTT_ENABLED) {
+#endif /* RTT_SUPPORT */
+               err = wldev_ioctl_set(dev, WLC_SET_PM, &pm, sizeof(pm));
+               if (unlikely(err)) {
+                       if (err == -ENODEV)
+                               WL_DBG(("net_device is not ready yet\n"));
+                       else
+                               WL_ERR(("error (%d)\n", err));
+                       return err;
+               }
+#ifdef RTT_SUPPORT
+       }
+#endif /* RTT_SUPPORT */
+       wl_cfg80211_update_power_mode(dev);
+       return err;
+}
+
+/* force update cfg80211 to keep power save mode in sync. BUT this is NOT
+ * a good solution since there is no protection while changing wdev->os. Best
+ * way of changing power saving mode is doing it through
+ * NL80211_CMD_SET_POWER_SAVE
+ */
+void wl_cfg80211_update_power_mode(struct net_device *dev)
+{
+       int err, pm = -1;
+
+       err = wldev_ioctl_get(dev, WLC_GET_PM, &pm, sizeof(pm));
+       if (err)
+               WL_ERR(("error (%d)\n", err));
+       else if (pm != -1 && dev->ieee80211_ptr)
+               dev->ieee80211_ptr->ps = (pm == PM_OFF) ? false : true;
+}
+
+static __used u32 wl_find_msb(u16 bit16)
+{
+       u32 ret = 0;
+
+       if (bit16 & 0xff00) {
+               ret += 8;
+               bit16 >>= 8;
+       }
+
+       if (bit16 & 0xf0) {
+               ret += 4;
+               bit16 >>= 4;
+       }
+
+       if (bit16 & 0xc) {
+               ret += 2;
+               bit16 >>= 2;
+       }
+
+       if (bit16 & 2)
+               ret += bit16 & 2;
+       else if (bit16)
+               ret += bit16;
+
+       return ret;
+}
+
+static s32
+wl_update_pmklist(struct net_device *dev, struct wl_pmk_list *pmk_list,
+       s32 err)
+{
+       int i, j;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       struct net_device *primary_dev = bcmcfg_to_prmry_ndev(cfg);
+       int npmkids = cfg->pmk_list->pmkids.count;
+
+       ASSERT(cfg->pmk_list->pmkids.length >= (sizeof(u16)*2));
+       if (!pmk_list) {
+               WL_ERR(("pmk_list is NULL\n"));
+               return -EINVAL;
+       }
+       /* pmk list is supported only for STA interface i.e. primary interface
+        * Refer code wlc_bsscfg.c->wlc_bsscfg_sta_init
+        */
+       if (primary_dev != dev) {
+               WL_INFORM_MEM(("Not supporting Flushing pmklist on virtual"
+                       " interfaces than primary interface\n"));
+               return err;
+       }
+
+       WL_DBG(("No of elements %d\n", npmkids));
+       for (i = 0; i < npmkids; i++) {
+               WL_DBG(("PMKID[%d]: %pM =\n", i,
+                       &pmk_list->pmkids.pmkid[i].bssid));
+               for (j = 0; j < WPA2_PMKID_LEN; j++) {
+                       WL_DBG(("%02x\n", pmk_list->pmkids.pmkid[i].pmkid[j]));
+               }
+       }
+       if (cfg->wlc_ver.wlc_ver_major >= MIN_PMKID_LIST_V3_FW_MAJOR) {
+                       pmk_list->pmkids.version = PMKID_LIST_VER_3;
+                       err = wldev_iovar_setbuf(dev, "pmkid_info", (char *)pmk_list,
+                               sizeof(*pmk_list), cfg->ioctl_buf,
+                               WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       }
+       else if (cfg->wlc_ver.wlc_ver_major == MIN_PMKID_LIST_V2_FW_MAJOR) {
+               u32 v2_list_size = (u32)(sizeof(pmkid_list_v2_t) + npmkids*sizeof(pmkid_v2_t));
+               pmkid_list_v2_t *pmkid_v2_list = (pmkid_list_v2_t *)MALLOCZ(cfg->osh, v2_list_size);
+               pmkid_list_v3_t *spmk_list = &cfg->spmk_info_list->pmkids;
+
+               if (pmkid_v2_list == NULL) {
+                       WL_ERR(("failed to allocate pmkid list\n"));
+                       return BCME_NOMEM;
+               }
+
+               pmkid_v2_list->version = PMKID_LIST_VER_2;
+               /* Account for version, length and pmkid_v2_t fields */
+               pmkid_v2_list->length = (npmkids * sizeof(pmkid_v2_t)) + (2 * sizeof(u16));
+
+               for (i = 0; i < npmkids; i++) {
+                       /* memcpy_s return checks not needed as buffers are of same size */
+                       (void)memcpy_s(&pmkid_v2_list->pmkid[i].BSSID,
+                                       ETHER_ADDR_LEN, &pmk_list->pmkids.pmkid[i].bssid,
+                                       ETHER_ADDR_LEN);
+
+                       /* copy pmkid if available */
+                       if (pmk_list->pmkids.pmkid[i].pmkid_len) {
+                               (void)memcpy_s(pmkid_v2_list->pmkid[i].PMKID,
+                                               WPA2_PMKID_LEN,
+                                               pmk_list->pmkids.pmkid[i].pmkid,
+                                               pmk_list->pmkids.pmkid[i].pmkid_len);
+                       }
+
+                       if (pmk_list->pmkids.pmkid[i].pmk_len) {
+                               (void)memcpy_s(pmkid_v2_list->pmkid[i].pmk,
+                                               pmk_list->pmkids.pmkid[i].pmk_len,
+                                               pmk_list->pmkids.pmkid[i].pmk,
+                                               pmk_list->pmkids.pmkid[i].pmk_len);
+                               pmkid_v2_list->pmkid[i].pmk_len = pmk_list->pmkids.pmkid[i].pmk_len;
+                       }
+
+                       if (pmk_list->pmkids.pmkid[i].ssid_len) {
+                               (void)memcpy_s(pmkid_v2_list->pmkid[i].ssid.ssid,
+                                               pmk_list->pmkids.pmkid[i].ssid_len,
+                                               pmk_list->pmkids.pmkid[i].ssid,
+                                               pmk_list->pmkids.pmkid[i].ssid_len);
+                               pmkid_v2_list->pmkid[i].ssid.ssid_len
+                                       = pmk_list->pmkids.pmkid[i].ssid_len;
+                       }
+
+                       (void)memcpy_s(pmkid_v2_list->pmkid[i].fils_cache_id,
+                                       FILS_CACHE_ID_LEN, &pmk_list->pmkids.pmkid[i].fils_cache_id,
+                                       FILS_CACHE_ID_LEN);
+                       for (j = 0; j < spmk_list->count; j++) {
+                               if (memcmp(&pmkid_v2_list->pmkid[i].BSSID,
+                                       &spmk_list->pmkid[j].bssid, ETHER_ADDR_LEN)) {
+                                       continue; /* different MAC */
+                               }
+                               WL_DBG(("SPMK replace idx:%d bssid: "MACF " to SSID: %d\n", i,
+                                       ETHER_TO_MACF(pmkid_v2_list->pmkid[i].BSSID),
+                                       spmk_list->pmkid[j].ssid_len));
+                               bzero(&pmkid_v2_list->pmkid[i].BSSID, ETHER_ADDR_LEN);
+                               pmkid_v2_list->pmkid[i].ssid.ssid_len =
+                                       spmk_list->pmkid[j].ssid_len;
+                               (void)memcpy_s(pmkid_v2_list->pmkid[i].ssid.ssid,
+                                       spmk_list->pmkid[j].ssid_len,
+                                       spmk_list->pmkid[j].ssid,
+                                       spmk_list->pmkid[j].ssid_len);
+                       }
+                       pmkid_v2_list->pmkid[i].length = PMKID_ELEM_V2_LENGTH;
+               }
+
+               err = wldev_iovar_setbuf(dev, "pmkid_info", (char *)pmkid_v2_list,
+                               v2_list_size, cfg->ioctl_buf,
+                               WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+               if (unlikely(err)) {
+                       WL_ERR(("pmkid_info failed (%d)\n", err));
+               }
+
+               MFREE(cfg->osh, pmkid_v2_list, v2_list_size);
+       }
+       else {
+               u32 v1_list_size = (u32)(sizeof(pmkid_list_v1_t) + npmkids*sizeof(pmkid_v1_t));
+               pmkid_list_v1_t *pmkid_v1_list = (pmkid_list_v1_t *)MALLOCZ(cfg->osh, v1_list_size);
+               if (pmkid_v1_list == NULL) {
+                       WL_ERR(("failed to allocate pmkid list\n"));
+                       return BCME_NOMEM;
+               }
+               for (i = 0; i < npmkids; i++) {
+                       /* memcpy_s return checks not needed as buffers are of same size */
+                       (void)memcpy_s(&pmkid_v1_list->pmkid[i].BSSID,
+                                       ETHER_ADDR_LEN, &pmk_list->pmkids.pmkid[i].bssid,
+                                       ETHER_ADDR_LEN);
+                       (void)memcpy_s(pmkid_v1_list->pmkid[i].PMKID,
+                                       WPA2_PMKID_LEN, pmk_list->pmkids.pmkid[i].pmkid,
+                                       WPA2_PMKID_LEN);
+                       pmkid_v1_list->npmkid++;
+               }
+               err = wldev_iovar_setbuf(dev, "pmkid_info", (char *)pmkid_v1_list,
+                               v1_list_size, cfg->ioctl_buf,
+                               WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+               if (unlikely(err)) {
+                       WL_ERR(("pmkid_info failed (%d)\n", err));
+               }
+
+               MFREE(cfg->osh, pmkid_v1_list, v1_list_size);
+       }
+       return err;
+}
+
+/* TODO: remove temporal cfg->pmk_list list, and call wl_cfg80211_update_pmksa for single
+ * entry operation.
+ */
+static s32
+wl_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_pmksa *pmksa)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 err = 0;
+       int i;
+       int npmkids = cfg->pmk_list->pmkids.count;
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       if (cfg->wlc_ver.wlc_ver_major >= PMKDB_WLC_VER) {
+               err = wl_cfg80211_update_pmksa(wiphy, dev, pmksa, TRUE);
+               if (err != BCME_OK) {
+                       WL_ERR(("wl_cfg80211_set_pmksa err:%d\n", err));
+               }
+               return err;
+       }
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+       BCM_REFERENCE(dhdp);
+       DHD_STATLOG_CTRL(dhdp, ST(INSTALL_PMKSA), dhd_net2idx(dhdp->info, dev), 0);
+
+       for (i = 0; i < npmkids; i++) {
+               if (pmksa->bssid != NULL) {
+                       if (!memcmp(pmksa->bssid, &cfg->pmk_list->pmkids.pmkid[i].bssid,
+                               ETHER_ADDR_LEN))
+                               break;
+               }
+#ifdef WL_FILS
+               else if (pmksa->ssid != NULL) {
+                       if (!memcmp(pmksa->ssid, &cfg->pmk_list->pmkids.pmkid[i].ssid,
+                               pmksa->ssid_len))
+                               break;
+               }
+#endif /* WL_FILS */
+       }
+       if (i < WL_NUM_PMKIDS_MAX) {
+               if (pmksa->bssid != NULL) {
+                       memcpy(&cfg->pmk_list->pmkids.pmkid[i].bssid, pmksa->bssid,
+                               ETHER_ADDR_LEN);
+               }
+#ifdef WL_FILS
+               else if (pmksa->ssid != NULL) {
+                       cfg->pmk_list->pmkids.pmkid[i].ssid_len = pmksa->ssid_len;
+                       memcpy(&cfg->pmk_list->pmkids.pmkid[i].ssid, pmksa->ssid,
+                               pmksa->ssid_len);
+                       memcpy(&cfg->pmk_list->pmkids.pmkid[i].fils_cache_id, pmksa->cache_id,
+                               FILS_CACHE_ID_LEN);
+               }
+#endif /* WL_FILS */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) || defined(WL_FILS))
+               if (pmksa->pmk_len) {
+                       if (memcpy_s(&cfg->pmk_list->pmkids.pmkid[i].pmk, PMK_LEN_MAX, pmksa->pmk,
+                               pmksa->pmk_len)) {
+                               WL_ERR(("invalid pmk len = %zu", pmksa->pmk_len));
+                       } else {
+                               cfg->pmk_list->pmkids.pmkid[i].pmk_len = pmksa->pmk_len;
+                       }
+               }
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) || defined(WL_FILS) */
+               /* return check not required as buffer lengths are same */
+               (void)memcpy_s(cfg->pmk_list->pmkids.pmkid[i].pmkid, WPA2_PMKID_LEN, pmksa->pmkid,
+                       WPA2_PMKID_LEN);
+               cfg->pmk_list->pmkids.pmkid[i].pmkid_len = WPA2_PMKID_LEN;
+
+               /* set lifetime not to expire in firmware by default.
+                * Currently, wpa_supplicant control PMKID lifetime on his end. e.g) set 12 hours
+                * when it expired, wpa_supplicant should call set_pmksa/del_pmksa to update
+                * corresponding entry.
+                */
+               cfg->pmk_list->pmkids.pmkid[i].time_left = KEY_PERM_PMK;
+               if (i == npmkids) {
+                       cfg->pmk_list->pmkids.length += sizeof(pmkid_v3_t);
+                       cfg->pmk_list->pmkids.count++;
+               }
+       } else {
+               err = -EINVAL;
+       }
+
+#if (WL_DBG_LEVEL > 0)
+       if (pmksa->bssid != NULL) {
+               WL_DBG(("set_pmksa,IW_PMKSA_ADD - PMKID: %pM =\n",
+                       &cfg->pmk_list->pmkids.pmkid[npmkids - 1].bssid));
+       }
+       for (i = 0; i < WPA2_PMKID_LEN; i++) {
+               WL_DBG(("%02x\n",
+                       cfg->pmk_list->pmkids.pmkid[npmkids - 1].
+                       pmkid[i]));
+       }
+#endif /* (WL_DBG_LEVEL > 0) */
+
+       err = wl_update_pmklist(dev, cfg->pmk_list, err);
+
+       return err;
+}
+
+/* sending pmkid_info IOVAR to manipulate PMKID(PMKSA) list in firmware.
+ * input @pmksa: host given single pmksa info.
+ * if it's NULL, assume whole list manipulated. e.g) flush all PMKIDs in firmware.
+ * input @set: TRUE means adding PMKSA operation. FALSE means deleting.
+ * return: log internal BCME_XXX error, and convert it to -EINVAL to linux generic error code.
+ */
+static s32 wl_cfg80211_update_pmksa(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_pmksa *pmksa, bool set) {
+
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 err = 0;
+       pmkid_list_v3_t *pmk_list;
+       uint32 alloc_len;
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+
+       if (cfg->wlc_ver.wlc_ver_major < MIN_PMKID_LIST_V3_FW_MAJOR) {
+               WL_DBG(("wlc_ver_major not supported:%d\n", cfg->wlc_ver.wlc_ver_major));
+               return BCME_VERSION;
+       }
+
+       alloc_len = (uint32)(OFFSETOF(pmkid_list_v3_t, pmkid) + ((pmksa) ? sizeof(pmkid_v3_t) : 0));
+       pmk_list = (pmkid_list_v3_t *)MALLOCZ(cfg->osh, alloc_len);
+
+       if (pmk_list == NULL) {
+               return BCME_NOMEM;
+       }
+
+       pmk_list->version = PMKID_LIST_VER_3;
+       pmk_list->length = alloc_len;
+       pmk_list->count = (pmksa) ? 1 : 0; // 1 means single entry operation, 0 means whole list.
+       pmk_list->flag = (set) ? PMKDB_SET_IOVAR : PMKDB_CLEAR_IOVAR;
+
+       if (pmksa) {
+               /* controll set/del action by lifetime parameter accordingly.
+                * if set == TRUE, it's set PMKID action with lifetime permanent.
+                * if set == FALSE, it's del PMKID action with lifetime zero.
+                */
+               pmk_list->pmkid->time_left = (set) ? KEY_PERM_PMK : 0;
+               if (pmksa->bssid) {
+                       eacopy(pmksa->bssid, &pmk_list->pmkid->bssid);
+               }
+               if (pmksa->pmkid) {
+                       err = memcpy_s(&pmk_list->pmkid->pmkid, sizeof(pmk_list->pmkid->pmkid),
+                               pmksa->pmkid, WPA2_PMKID_LEN);
+                       if (err) {
+                               goto exit;
+                       }
+                       pmk_list->pmkid->pmkid_len = WPA2_PMKID_LEN;
+               }
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0))
+               if (pmksa->pmk) {
+                       err = memcpy_s(&pmk_list->pmkid->pmk, sizeof(pmk_list->pmkid->pmk),
+                               pmksa->pmk, pmksa->pmk_len);
+                       if (err) {
+                               goto exit;
+                       }
+                       pmk_list->pmkid->pmk_len = pmksa->pmk_len;
+               }
+               if (pmksa->ssid) {
+                       err = memcpy_s(&pmk_list->pmkid->ssid, sizeof(pmk_list->pmkid->ssid),
+                               pmksa->ssid, pmksa->ssid_len);
+                       if (err) {
+                               goto exit;
+                       }
+                       pmk_list->pmkid->ssid_len = pmksa->ssid_len;
+               }
+               if (pmksa->cache_id) {
+                       pmk_list->pmkid->fils_cache_id = *(const uint16 *)pmksa->cache_id;
+               }
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
+       }
+
+       if (wl_dbg_level & WL_DBG_DBG) {
+               prhex("pmklist_data", (char *)pmk_list, alloc_len);
+       }
+
+       err = wldev_iovar_setbuf(dev, "pmkdb", (char *)pmk_list,
+               alloc_len, cfg->ioctl_buf,
+               WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("pmkdb set failed. err:%d\n", err));
+       }
+exit:
+       if (pmk_list) {
+               MFREE(cfg->osh, pmk_list, alloc_len);
+       }
+       return err;
+}
+
+/* TODO: remove temporal cfg->pmk_list list, and call wl_cfg80211_update_pmksa for single
+ * entry operation.
+ */
+static s32
+wl_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_pmksa *pmksa)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 err = 0;
+       int i;
+       int npmkids = cfg->pmk_list->pmkids.count;
+       RETURN_EIO_IF_NOT_UP(cfg);
+
+       if (!pmksa) {
+               WL_ERR(("pmksa is not initialized\n"));
+               return BCME_ERROR;
+       }
+       if (cfg->wlc_ver.wlc_ver_major >= PMKDB_WLC_VER) {
+               err = wl_cfg80211_update_pmksa(wiphy, dev, pmksa, FALSE);
+               if (err != BCME_OK) {
+                       WL_ERR(("wl_cfg80211_del_pmksa err:%d\n", err));
+               }
+               return err;
+       }
+
+       if (!npmkids) {
+               /* nmpkids = 0, nothing to delete */
+               WL_DBG(("npmkids=0. Skip del\n"));
+               return BCME_OK;
+       }
+
+#if (WL_DBG_LEVEL > 0)
+       if (pmksa->bssid) {
+               WL_DBG(("del_pmksa,IW_PMKSA_REMOVE - PMKID: %pM =\n",
+                       pmksa->bssid));
+       }
+#ifdef WL_FILS
+       else if (pmksa->ssid) {
+               WL_DBG(("FILS: del_pmksa for ssid: "));
+               for (i = 0; i < pmksa->ssid_len; i++) {
+                       WL_DBG(("%c", pmksa->ssid[i]));
+               }
+               WL_DBG(("\n"));
+       }
+#endif /* WL_FILS */
+       if (pmksa->pmkid) {
+               for (i = 0; i < WPA2_PMKID_LEN; i++) {
+                       WL_DBG(("%02x\n", pmksa->pmkid[i]));
+               }
+       }
+#endif /* (WL_DBG_LEVEL > 0) */
+
+       for (i = 0; i < npmkids; i++) {
+               if (pmksa->bssid) {
+                       if (!memcmp
+                           (pmksa->bssid, &cfg->pmk_list->pmkids.pmkid[i].bssid,
+                            ETHER_ADDR_LEN)) {
+                                       break;
+                       }
+               }
+#ifdef WL_FILS
+               else if (pmksa->ssid) {
+                       if (!memcmp
+                           (pmksa->ssid, &cfg->pmk_list->pmkids.pmkid[i].ssid,
+                            pmksa->ssid_len)) {
+                                       break;
+                       }
+               }
+#endif /* WL_FILS */
+       }
+       if ((npmkids > 0) && (i < npmkids)) {
+               bzero(&cfg->pmk_list->pmkids.pmkid[i], sizeof(pmkid_v3_t));
+               for (; i < (npmkids - 1); i++) {
+                       (void)memcpy_s(&cfg->pmk_list->pmkids.pmkid[i],
+                               sizeof(pmkid_v3_t),
+                               &cfg->pmk_list->pmkids.pmkid[i + 1],
+                               sizeof(pmkid_v3_t));
+               }
+               npmkids--;
+               cfg->pmk_list->pmkids.length -= sizeof(pmkid_v3_t);
+               cfg->pmk_list->pmkids.count--;
+
+       } else {
+               err = -EINVAL;
+       }
+
+       /* current wl_update_pmklist() doesn't delete corresponding PMKID entry.
+        * inside firmware. So we need to issue delete action explicitely through
+        * this function.
+        */
+       err = wl_cfg80211_update_pmksa(wiphy, dev, pmksa, FALSE);
+       /* intentional fall through even on error.
+        * it should work above MIN_PMKID_LIST_V3_FW_MAJOR, otherwise let ignore it.
+        */
+
+       err = wl_update_pmklist(dev, cfg->pmk_list, err);
+
+       return err;
+
+}
+
+/* TODO: remove temporal cfg->pmk_list list, and call wl_cfg80211_update_pmksa for single
+ * entry operation.
+ */
+static s32
+wl_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 err = 0;
+       RETURN_EIO_IF_NOT_UP(cfg);
+       if (cfg->wlc_ver.wlc_ver_major >= PMKDB_WLC_VER) {
+               /* NULL pmksa means delete whole PMKSA list */
+               err = wl_cfg80211_update_pmksa(wiphy, dev, NULL, FALSE);
+               if (err != BCME_OK) {
+                       WL_ERR(("wl_cfg80211_flush_pmksa err:%d\n", err));
+               }
+               return err;
+       }
+       bzero(cfg->pmk_list, sizeof(*cfg->pmk_list));
+       cfg->pmk_list->pmkids.length = OFFSETOF(pmkid_list_v3_t, pmkid);
+       cfg->pmk_list->pmkids.count = 0;
+       cfg->pmk_list->pmkids.version = PMKID_LIST_VER_3;
+       err = wl_update_pmklist(dev, cfg->pmk_list, err);
+       return err;
+}
+
+static void
+wl_cfg80211_afx_handler(struct work_struct *work)
+{
+       struct afx_hdl *afx_instance;
+       struct bcm_cfg80211 *cfg;
+       s32 ret = BCME_OK;
+
+       BCM_SET_CONTAINER_OF(afx_instance, work, struct afx_hdl, work);
+       if (afx_instance) {
+               cfg = wl_get_cfg(afx_instance->dev);
+               if (cfg != NULL && cfg->afx_hdl->is_active) {
+                       if (cfg->afx_hdl->is_listen && cfg->afx_hdl->my_listen_chan) {
+                               ret = wl_cfgp2p_discover_listen(cfg, cfg->afx_hdl->my_listen_chan,
+                                       (100 * (1 + (RANDOM32() % 3)))); /* 100ms ~ 300ms */
+                       } else {
+                               ret = wl_cfgp2p_act_frm_search(cfg, cfg->afx_hdl->dev,
+                                       cfg->afx_hdl->bssidx, cfg->afx_hdl->peer_listen_chan,
+                                       NULL);
+                       }
+                       if (unlikely(ret != BCME_OK)) {
+                               WL_ERR(("ERROR occurred! returned value is (%d)\n", ret));
+                               if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL))
+                                       complete(&cfg->act_frm_scan);
+                       }
+               }
+       }
+}
+
+static s32
+wl_cfg80211_af_searching_channel(struct bcm_cfg80211 *cfg, struct net_device *dev)
+{
+       u32 max_retry = WL_CHANNEL_SYNC_RETRY;
+       bool is_p2p_gas = false;
+
+       if (dev == NULL)
+               return -1;
+
+       WL_DBG((" enter ) \n"));
+
+       wl_set_drv_status(cfg, FINDING_COMMON_CHANNEL, dev);
+       cfg->afx_hdl->is_active = TRUE;
+
+       if (cfg->afx_hdl->pending_tx_act_frm) {
+               wl_action_frame_t *action_frame;
+               action_frame = &(cfg->afx_hdl->pending_tx_act_frm->action_frame);
+               if (wl_cfgp2p_is_p2p_gas_action(action_frame->data, action_frame->len))
+                       is_p2p_gas = true;
+       }
+
+       /* Loop to wait until we find a peer's channel or the
+        * pending action frame tx is cancelled.
+        */
+       while ((cfg->afx_hdl->retry < max_retry) &&
+               (cfg->afx_hdl->peer_chan == WL_INVALID)) {
+               cfg->afx_hdl->is_listen = FALSE;
+               wl_set_drv_status(cfg, SCANNING, dev);
+               WL_DBG(("Scheduling the action frame for sending.. retry %d\n",
+                       cfg->afx_hdl->retry));
+               /* search peer on peer's listen channel */
+               schedule_work(&cfg->afx_hdl->work);
+               wait_for_completion_timeout(&cfg->act_frm_scan,
+                       msecs_to_jiffies(WL_AF_SEARCH_TIME_MAX));
+
+               if ((cfg->afx_hdl->peer_chan != WL_INVALID) ||
+                       !(wl_get_drv_status(cfg, FINDING_COMMON_CHANNEL, dev)))
+                       break;
+
+               if (is_p2p_gas)
+                       break;
+
+               if (cfg->afx_hdl->my_listen_chan) {
+                       WL_DBG(("Scheduling Listen peer in my listen channel = %d\n",
+                               cfg->afx_hdl->my_listen_chan));
+                       /* listen on my listen channel */
+                       cfg->afx_hdl->is_listen = TRUE;
+                       schedule_work(&cfg->afx_hdl->work);
+                       wait_for_completion_timeout(&cfg->act_frm_scan,
+                               msecs_to_jiffies(WL_AF_SEARCH_TIME_MAX));
+               }
+               if ((cfg->afx_hdl->peer_chan != WL_INVALID) ||
+                       !(wl_get_drv_status(cfg, FINDING_COMMON_CHANNEL, dev)))
+                       break;
+
+               cfg->afx_hdl->retry++;
+
+               WL_AF_TX_KEEP_PRI_CONNECTION_VSDB(cfg);
+       }
+
+       cfg->afx_hdl->is_active = FALSE;
+
+       wl_clr_drv_status(cfg, SCANNING, dev);
+       wl_clr_drv_status(cfg, FINDING_COMMON_CHANNEL, dev);
+
+       return (cfg->afx_hdl->peer_chan);
+}
+
+struct p2p_config_af_params {
+       s32 max_tx_retry;       /* max tx retry count if tx no ack */
+#ifdef WL_CFG80211_GON_COLLISION
+       /* drop tx go nego request if go nego collision occurs */
+       bool drop_tx_req;
+#endif
+#ifdef WL_CFG80211_SYNC_GON
+       /* WAR: dongle does not keep the dwell time of 'actframe' sometime.
+        * if extra_listen is set, keep the dwell time to get af response frame
+        */
+       bool extra_listen;
+#endif
+       bool search_channel;    /* 1: search peer's channel to send af */
+};
+
+static s32
+wl_cfg80211_config_p2p_pub_af_tx(struct wiphy *wiphy,
+       wl_action_frame_t *action_frame, wl_af_params_t *af_params,
+       struct p2p_config_af_params *config_af_params)
+{
+       s32 err = BCME_OK;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       wifi_p2p_pub_act_frame_t *act_frm =
+               (wifi_p2p_pub_act_frame_t *) (action_frame->data);
+
+       /* initialize default value */
+#ifdef WL_CFG80211_GON_COLLISION
+       config_af_params->drop_tx_req = false;
+#endif
+#ifdef WL_CFG80211_SYNC_GON
+       config_af_params->extra_listen = true;
+#endif
+       config_af_params->search_channel = false;
+       config_af_params->max_tx_retry = WL_AF_TX_MAX_RETRY;
+       cfg->next_af_subtype = WL_PUB_AF_STYPE_INVALID;
+
+       switch (act_frm->subtype) {
+       case P2P_PAF_GON_REQ: {
+               /* Disable he if peer does not support before starting GONEG */
+               WL_DBG(("P2P: GO_NEG_PHASE status set \n"));
+               wl_set_p2p_status(cfg, GO_NEG_PHASE);
+
+               config_af_params->search_channel = true;
+               cfg->next_af_subtype = act_frm->subtype + 1;
+
+               /* increase dwell time to wait for RESP frame */
+               af_params->dwell_time = WL_MED_DWELL_TIME;
+
+#ifdef WL_CFG80211_GON_COLLISION
+               config_af_params->drop_tx_req = true;
+#endif /* WL_CFG80211_GON_COLLISION */
+               break;
+       }
+       case P2P_PAF_GON_RSP: {
+               cfg->next_af_subtype = act_frm->subtype + 1;
+               /* increase dwell time to wait for CONF frame */
+               /* WAR : 100ms is added because kernel spent more time in some case.
+                *              Kernel should be fixed.
+                */
+               af_params->dwell_time = WL_MED_DWELL_TIME + 100;
+               break;
+       }
+       case P2P_PAF_GON_CONF: {
+               /* If we reached till GO Neg confirmation reset the filter */
+               WL_DBG(("P2P: GO_NEG_PHASE status cleared \n"));
+               wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+
+               /* minimize dwell time */
+               af_params->dwell_time = WL_MIN_DWELL_TIME;
+
+#ifdef WL_CFG80211_GON_COLLISION
+               /* if go nego formation done, clear it */
+               cfg->block_gon_req_tx_count = 0;
+               cfg->block_gon_req_rx_count = 0;
+#endif /* WL_CFG80211_GON_COLLISION */
+#ifdef WL_CFG80211_SYNC_GON
+               config_af_params->extra_listen = false;
+#endif /* WL_CFG80211_SYNC_GON */
+               break;
+       }
+       case P2P_PAF_INVITE_REQ: {
+               config_af_params->search_channel = true;
+               cfg->next_af_subtype = act_frm->subtype + 1;
+
+               /* increase dwell time */
+               af_params->dwell_time = WL_MED_DWELL_TIME;
+               break;
+       }
+       case P2P_PAF_INVITE_RSP:
+               /* minimize dwell time */
+               af_params->dwell_time = WL_MIN_DWELL_TIME;
+#ifdef WL_CFG80211_SYNC_GON
+               config_af_params->extra_listen = false;
+#endif /* WL_CFG80211_SYNC_GON */
+               break;
+       case P2P_PAF_DEVDIS_REQ: {
+               if (IS_ACTPUB_WITHOUT_GROUP_ID(&act_frm->elts[0],
+                       action_frame->len)) {
+                       config_af_params->search_channel = true;
+               }
+
+               cfg->next_af_subtype = act_frm->subtype + 1;
+               /* maximize dwell time to wait for RESP frame */
+               af_params->dwell_time = WL_LONG_DWELL_TIME;
+               break;
+       }
+       case P2P_PAF_DEVDIS_RSP:
+               /* minimize dwell time */
+               af_params->dwell_time = WL_MIN_DWELL_TIME;
+#ifdef WL_CFG80211_SYNC_GON
+               config_af_params->extra_listen = false;
+#endif /* WL_CFG80211_SYNC_GON */
+               break;
+       case P2P_PAF_PROVDIS_REQ: {
+               if (IS_ACTPUB_WITHOUT_GROUP_ID(&act_frm->elts[0],
+                       action_frame->len)) {
+                       config_af_params->search_channel = true;
+               }
+
+               cfg->next_af_subtype = act_frm->subtype + 1;
+               /* increase dwell time to wait for RESP frame */
+               af_params->dwell_time = WL_MED_DWELL_TIME;
+               break;
+       }
+       case P2P_PAF_PROVDIS_RSP: {
+               /* wpa_supplicant send go nego req right after prov disc */
+               cfg->next_af_subtype = P2P_PAF_GON_REQ;
+               af_params->dwell_time = WL_MED_DWELL_TIME;
+#ifdef WL_CFG80211_SYNC_GON
+               config_af_params->extra_listen = false;
+#endif /* WL_CFG80211_SYNC_GON */
+               break;
+       }
+       default:
+               WL_DBG(("Unknown p2p pub act frame subtype: %d\n",
+                       act_frm->subtype));
+               err = BCME_BADARG;
+       }
+       return err;
+}
+
+#if defined(WL11U) && defined(WL_HOST_AF_DFS_CHECK)
+static bool
+wl_cfg80211_check_DFS_channel(struct bcm_cfg80211 *cfg, wl_af_params_t *af_params,
+       void *frame, u16 frame_len)
+{
+       struct wl_scan_results *bss_list;
+       wl_bss_info_t *bi = NULL;
+       bool result = false;
+       s32 i;
+       chanspec_t chanspec;
+
+       /* If DFS channel is 52~148, check to block it or not */
+       if (af_params &&
+               (af_params->channel >= 52 && af_params->channel <= 148)) {
+               if (!wl_cfgp2p_is_p2p_action(frame, frame_len)) {
+                       bss_list = cfg->bss_list;
+                       bi = next_bss(bss_list, bi);
+                       for_each_bss(bss_list, bi, i) {
+                               chanspec = wl_chspec_driver_to_host(bi->chanspec);
+                               if (CHSPEC_IS5G(chanspec) &&
+                                       ((bi->ctl_ch ? bi->ctl_ch : CHSPEC_CHANNEL(chanspec))
+                                       == af_params->channel)) {
+                                       result = true;  /* do not block the action frame */
+                                       break;
+                               }
+                       }
+               }
+       }
+       else {
+               result = true;
+       }
+
+       WL_DBG(("result=%s", result?"true":"false"));
+       return result;
+}
+#endif /* WL11U && WL_HOST_AF_DFS_CHECK */
+static bool
+wl_cfg80211_check_dwell_overflow(int32 requested_dwell, ulong dwell_jiffies)
+{
+       if ((requested_dwell & CUSTOM_RETRY_MASK) &&
+                       (jiffies_to_msecs(jiffies - dwell_jiffies) >
+                        (requested_dwell & ~CUSTOM_RETRY_MASK))) {
+               WL_ERR(("Action frame TX retry time over dwell time!\n"));
+               return true;
+       }
+       return false;
+}
+
+static bool
+wl_cfg80211_send_action_frame(struct wiphy *wiphy, struct net_device *dev,
+       bcm_struct_cfgdev *cfgdev, wl_af_params_t *af_params,
+       wl_action_frame_t *action_frame, u16 action_frame_len, s32 bssidx)
+{
+#ifdef WL11U
+       struct net_device *ndev = NULL;
+#endif /* WL11U */
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       bool ack = false;
+       u8 category, action;
+       s32 tx_retry;
+       struct p2p_config_af_params config_af_params;
+       struct net_info *netinfo;
+#ifdef VSDB
+       ulong off_chan_started_jiffies = 0;
+#endif
+       ulong dwell_jiffies = 0;
+       bool dwell_overflow = false;
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+       int32 requested_dwell = af_params->dwell_time;
+
+       /* Add the default dwell time
+        * Dwell time to stay off-channel to wait for a response action frame
+        * after transmitting an GO Negotiation action frame
+        */
+       af_params->dwell_time = WL_DEFAULT_DWELL_TIME;
+
+#ifdef WL11U
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       ndev = dev;
+#else
+       ndev = ndev_to_cfgdev(cfgdev);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+#endif /* WL11U */
+
+       category = action_frame->data[DOT11_ACTION_CAT_OFF];
+       action = action_frame->data[DOT11_ACTION_ACT_OFF];
+
+       /* initialize variables */
+       tx_retry = 0;
+       cfg->next_af_subtype = WL_PUB_AF_STYPE_INVALID;
+       config_af_params.max_tx_retry = WL_AF_TX_MAX_RETRY;
+       config_af_params.search_channel = false;
+#ifdef WL_CFG80211_GON_COLLISION
+       config_af_params.drop_tx_req = false;
+#endif
+#ifdef WL_CFG80211_SYNC_GON
+       config_af_params.extra_listen = false;
+#endif
+
+       /* config parameters */
+       /* Public Action Frame Process - DOT11_ACTION_CAT_PUBLIC */
+       if (category == DOT11_ACTION_CAT_PUBLIC) {
+               if (wl_cfg80211_is_dpp_frame((void *)action_frame->data, action_frame->len)) {
+                       wl_dpp_pa_frame_t *pa = (wl_dpp_pa_frame_t *)action_frame->data;
+                       config_af_params.max_tx_retry = WL_AF_TX_MAX_RETRY;
+                       af_params->dwell_time = WL_MED_DWELL_TIME;
+                       cfg->need_wait_afrx = true;
+                       /* once matching frame is found in rx, abort dwell (upper layer
+                        * doesn't do that).
+                        */
+                       if (pa->ftype == DPP_AUTH_REQ) {
+                               cfg->next_af_subtype = DPP_AUTH_RESP;
+                       } else if (pa->ftype == DPP_AUTH_RESP) {
+                               cfg->next_af_subtype = DPP_AUTH_CONF;
+                       } else {
+                               cfg->next_af_subtype = WL_PUB_AF_STYPE_INVALID;
+                               cfg->need_wait_afrx = false;
+                       }
+               } else if (wl_cfg80211_is_dpp_gas_action(
+                               (void *)action_frame->data, action_frame->len)) {
+                       config_af_params.max_tx_retry = WL_AF_TX_MAX_RETRY;
+                       af_params->dwell_time = WL_MED_DWELL_TIME;
+                       cfg->need_wait_afrx = true;
+                       config_af_params.search_channel = false;
+
+                       if (requested_dwell == 0) {
+                               /* Use minimal dwell to take care of Ack */
+                               af_params->dwell_time = WL_MIN_DWELL_TIME;
+                       }
+               } else if ((action == P2P_PUB_AF_ACTION) &&
+                       (action_frame_len >= sizeof(wifi_p2p_pub_act_frame_t))) {
+                       /* p2p public action frame process */
+                       if (BCME_OK != wl_cfg80211_config_p2p_pub_af_tx(wiphy,
+                               action_frame, af_params, &config_af_params)) {
+                               /* just send unknown subtype frame with default parameters. */
+                               WL_DBG(("Unknown subtype.\n"));
+                       }
+
+#ifdef WL_CFG80211_GON_COLLISION
+                       if (config_af_params.drop_tx_req) {
+                               if (cfg->block_gon_req_tx_count) {
+                                       /* drop gon req tx action frame */
+                                       WL_DBG(("Drop gon req tx action frame: count %d\n",
+                                               cfg->block_gon_req_tx_count));
+                                       goto exit;
+                               }
+                       }
+#endif /* WL_CFG80211_GON_COLLISION */
+               } else if (action_frame_len >= sizeof(wifi_p2psd_gas_pub_act_frame_t)) {
+                       /* service discovery process */
+                       if (action == P2PSD_ACTION_ID_GAS_IREQ ||
+                               action == P2PSD_ACTION_ID_GAS_CREQ) {
+                               /* configure service discovery query frame */
+                               config_af_params.search_channel = true;
+
+                               /* save next af suptype to cancel remained dwell time */
+                               cfg->next_af_subtype = action + 1;
+
+                               af_params->dwell_time = WL_MED_DWELL_TIME;
+                               if (requested_dwell & CUSTOM_RETRY_MASK) {
+                                       config_af_params.max_tx_retry =
+                                               (requested_dwell & CUSTOM_RETRY_MASK) >> 24;
+                                       af_params->dwell_time =
+                                               (requested_dwell & ~CUSTOM_RETRY_MASK);
+                                       WL_DBG(("Custom retry(%d) and dwell time(%d) is set.\n",
+                                               config_af_params.max_tx_retry,
+                                               af_params->dwell_time));
+                               }
+                       } else if (action == P2PSD_ACTION_ID_GAS_IRESP ||
+                               action == P2PSD_ACTION_ID_GAS_CRESP) {
+                               /* configure service discovery response frame */
+                               af_params->dwell_time = WL_MIN_DWELL_TIME;
+                       } else {
+                               WL_DBG(("Unknown action type: %d\n", action));
+                       }
+               } else {
+                       WL_DBG(("Unknown Frame: category 0x%x, action 0x%x, length %d\n",
+                               category, action, action_frame_len));
+               }
+       } else if (category == P2P_AF_CATEGORY) {
+               /* do not configure anything. it will be sent with a default configuration */
+       } else {
+               WL_DBG(("Unknown Frame: category 0x%x, action 0x%x\n",
+                       category, action));
+               if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+                       wl_clr_drv_status(cfg, SENDING_ACT_FRM, dev);
+                       return false;
+               }
+       }
+
+       netinfo = wl_get_netinfo_by_wdev(cfg, cfgdev_to_wdev(cfgdev));
+       /* validate channel and p2p ies */
+       if (config_af_params.search_channel &&
+               IS_P2P_SOCIAL(CHSPEC_CHANNEL(af_params->channel)) &&
+               netinfo && netinfo->bss.ies.probe_req_ie_len) {
+               config_af_params.search_channel = true;
+       } else {
+               config_af_params.search_channel = false;
+       }
+#ifdef WL11U
+       if (ndev == bcmcfg_to_prmry_ndev(cfg))
+               config_af_params.search_channel = false;
+#endif /* WL11U */
+
+#ifdef VSDB
+       /* if connecting on primary iface, sleep for a while before sending af tx for VSDB */
+       if (wl_get_drv_status(cfg, CONNECTING, bcmcfg_to_prmry_ndev(cfg))) {
+               OSL_SLEEP(50);
+       }
+#endif
+
+       /* if scan is ongoing, abort current scan. */
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               wl_cfg80211_cancel_scan(cfg);
+       }
+
+       /* Abort P2P listen */
+       if (discover_cfgdev(cfgdev, cfg)) {
+               if (cfg->p2p_supported && cfg->p2p) {
+                       wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+                               wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+               }
+       }
+
+#if defined(WL11U) && defined(WL_HOST_AF_DFS_CHECK)
+       /* handling DFS channel exceptions */
+       if (!wl_cfg80211_check_DFS_channel(cfg, af_params, action_frame->data, action_frame->len)) {
+               return false;   /* the action frame was blocked */
+       }
+#endif /* WL11U && WL_HOST_AF_DFS_CHECK */
+
+       /* set status and destination address before sending af */
+       if (cfg->next_af_subtype != WL_PUB_AF_STYPE_INVALID) {
+               /* set this status to cancel the remained dwell time in rx process */
+               wl_set_drv_status(cfg, WAITING_NEXT_ACT_FRM, dev);
+       }
+       wl_set_drv_status(cfg, SENDING_ACT_FRM, dev);
+       memcpy(cfg->afx_hdl->tx_dst_addr.octet,
+               af_params->action_frame.da.octet,
+               sizeof(cfg->afx_hdl->tx_dst_addr.octet));
+
+       /* save af_params for rx process */
+       cfg->afx_hdl->pending_tx_act_frm = af_params;
+
+       if (wl_cfgp2p_is_p2p_gas_action(action_frame->data, action_frame->len)) {
+               WL_DBG(("Set GAS action frame config.\n"));
+               config_af_params.search_channel = false;
+               config_af_params.max_tx_retry = 1;
+       }
+
+       /* search peer's channel */
+       if (config_af_params.search_channel) {
+               /* initialize afx_hdl */
+               if ((cfg->afx_hdl->bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+                       WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+                       goto exit;
+               }
+               cfg->afx_hdl->dev = dev;
+               cfg->afx_hdl->retry = 0;
+               cfg->afx_hdl->peer_chan = WL_INVALID;
+
+               if (wl_cfg80211_af_searching_channel(cfg, dev) == WL_INVALID) {
+                       WL_ERR(("couldn't find peer's channel.\n"));
+                       wl_cfgp2p_print_actframe(true, action_frame->data, action_frame->len,
+                               af_params->channel);
+                       /* Even if we couldn't find peer channel, try to send the frame
+                        * out. P2P cert 5.1.14 testbed device (realtek) doesn't seem to
+                        * respond to probe request (Ideally it has to be in listen and
+                        * responsd to probe request). However if we send Go neg req, the
+                        * peer is sending GO-neg resp. So instead of giving up here, just
+                        * proceed and attempt sending out the action frame.
+                        */
+               }
+
+               wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+               /*
+                * Abort scan even for VSDB scenarios. Scan gets aborted in firmware
+                * but after the check of piggyback algorithm.
+                * To take care of current piggback algo, lets abort the scan here itself.
+                */
+               wl_cfg80211_cancel_scan(cfg);
+               /* Suspend P2P discovery's search-listen to prevent it from
+                * starting a scan or changing the channel.
+                */
+               if ((wl_cfgp2p_discover_enable_search(cfg, false)) < 0) {
+                       WL_ERR(("Can not disable discovery mode\n"));
+                       goto exit;
+               }
+
+               /* update channel */
+               if (cfg->afx_hdl->peer_chan != WL_INVALID) {
+                       af_params->channel = cfg->afx_hdl->peer_chan;
+                       WL_ERR(("Attempt tx on peer listen channel:%d ",
+                               cfg->afx_hdl->peer_chan));
+               } else {
+                       WL_ERR(("Attempt tx with the channel provided by userspace."
+                       "Channel: %d\n", af_params->channel));
+               }
+       }
+
+#ifdef VSDB
+       off_chan_started_jiffies = jiffies;
+#endif /* VSDB */
+
+       wl_cfgp2p_print_actframe(true, action_frame->data, action_frame->len, af_params->channel);
+
+       wl_cfgp2p_need_wait_actfrmae(cfg, action_frame->data, action_frame->len, true);
+
+       dwell_jiffies = jiffies;
+       /* Now send a tx action frame */
+       ack = wl_cfgp2p_tx_action_frame(cfg, dev, af_params, bssidx) ? false : true;
+       dwell_overflow = wl_cfg80211_check_dwell_overflow(requested_dwell, dwell_jiffies);
+
+       /* if failed, retry it. tx_retry_max value is configure by .... */
+       while ((ack == false) && (tx_retry++ < config_af_params.max_tx_retry) &&
+                       !dwell_overflow) {
+#ifdef VSDB
+               if (af_params->channel) {
+                       if (jiffies_to_msecs(jiffies - off_chan_started_jiffies) >
+                               OFF_CHAN_TIME_THRESHOLD_MS) {
+                               WL_AF_TX_KEEP_PRI_CONNECTION_VSDB(cfg);
+                               off_chan_started_jiffies = jiffies;
+                       } else
+                               OSL_SLEEP(AF_RETRY_DELAY_TIME);
+               }
+#endif /* VSDB */
+               ack = wl_cfgp2p_tx_action_frame(cfg, dev, af_params, bssidx) ?
+                       false : true;
+               dwell_overflow = wl_cfg80211_check_dwell_overflow(requested_dwell, dwell_jiffies);
+       }
+
+       if (ack == false) {
+               WL_ERR(("Failed to send Action Frame(retry %d)\n", tx_retry));
+       }
+       WL_DBG(("Complete to send action frame\n"));
+exit:
+       /* Clear SENDING_ACT_FRM after all sending af is done */
+       wl_clr_drv_status(cfg, SENDING_ACT_FRM, dev);
+
+#ifdef WL_CFG80211_SYNC_GON
+       /* WAR: sometimes dongle does not keep the dwell time of 'actframe'.
+        * if we coundn't get the next action response frame and dongle does not keep
+        * the dwell time, go to listen state again to get next action response frame.
+        */
+       if (ack && config_af_params.extra_listen &&
+#ifdef WL_CFG80211_GON_COLLISION
+               !cfg->block_gon_req_tx_count &&
+#endif /* WL_CFG80211_GON_COLLISION */
+               wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM) &&
+               cfg->af_sent_channel == cfg->afx_hdl->my_listen_chan) {
+               s32 extar_listen_time;
+
+               extar_listen_time = af_params->dwell_time -
+                       jiffies_to_msecs(jiffies - cfg->af_tx_sent_jiffies);
+
+               if (extar_listen_time > 50) {
+                       wl_set_drv_status(cfg, WAITING_NEXT_ACT_FRM_LISTEN, dev);
+                       WL_DBG(("Wait more time! actual af time:%d,"
+                               "calculated extar listen:%d\n",
+                               af_params->dwell_time, extar_listen_time));
+                       if (wl_cfgp2p_discover_listen(cfg, cfg->af_sent_channel,
+                               extar_listen_time + 100) == BCME_OK) {
+                               wait_for_completion_timeout(&cfg->wait_next_af,
+                                       msecs_to_jiffies(extar_listen_time + 100 + 300));
+                       }
+                       wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM_LISTEN, dev);
+               }
+       }
+#endif /* WL_CFG80211_SYNC_GON */
+       wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, dev);
+
+       cfg->afx_hdl->pending_tx_act_frm = NULL;
+
+       if (ack) {
+               WL_DBG(("-- Action Frame Tx succeeded, listen chan: %d\n",
+                       cfg->afx_hdl->my_listen_chan));
+       } else {
+               WL_ERR(("-- Action Frame Tx failed, listen chan: %d\n",
+                       cfg->afx_hdl->my_listen_chan));
+       }
+
+#ifdef WL_CFG80211_GON_COLLISION
+       if (cfg->block_gon_req_tx_count) {
+               cfg->block_gon_req_tx_count--;
+               /* if ack is ture, supplicant will wait more time(100ms).
+                * so we will return it as a success to get more time .
+                */
+               ack = true;
+       }
+#endif /* WL_CFG80211_GON_COLLISION */
+       return ack;
+}
+
+#define MAX_NUM_OF_ASSOCIATED_DEV       64
+static s32
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+wl_cfg80211_mgmt_tx(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+       struct cfg80211_mgmt_tx_params *params, u64 *cookie)
+#else
+wl_cfg80211_mgmt_tx(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+       struct ieee80211_channel *channel, bool offchan,
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3, 7, 0))
+       enum nl80211_channel_type channel_type,
+       bool channel_type_valid,
+#endif /* LINUX_VERSION_CODE <= KERNEL_VERSION(3, 7, 0) */
+       unsigned int wait, const u8* buf, size_t len,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)
+       bool no_cck,
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0)) || defined(WL_COMPAT_WIRELESS)
+       bool dont_wait_for_ack,
+#endif
+       u64 *cookie)
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
+{
+       wl_action_frame_t *action_frame;
+       wl_af_params_t *af_params;
+       scb_val_t scb_val;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+       struct ieee80211_channel *channel = params->chan;
+       const u8 *buf = params->buf;
+       size_t len = params->len;
+#endif
+       const struct ieee80211_mgmt *mgmt;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *dev = NULL;
+       s32 err = BCME_OK;
+       s32 bssidx = 0;
+       u32 id;
+       bool ack = false;
+       s8 eabuf[ETHER_ADDR_STR_LEN];
+
+       WL_DBG(("Enter \n"));
+
+       if (len > ACTION_FRAME_SIZE) {
+               WL_ERR(("bad length:%zu\n", len));
+               return BCME_BADLEN;
+       }
+#ifdef DHD_IFDEBUG
+       PRINT_WDEV_INFO(cfgdev);
+#endif /* DHD_IFDEBUG */
+
+       dev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       if (!dev) {
+               WL_ERR(("dev is NULL\n"));
+               return -EINVAL;
+       }
+
+       /* set bsscfg idx for iovar (wlan0: P2PAPI_BSSCFG_PRIMARY, p2p: P2PAPI_BSSCFG_DEVICE)   */
+       if (discover_cfgdev(cfgdev, cfg)) {
+               if (!cfg->p2p_supported || !cfg->p2p) {
+                       WL_ERR(("P2P doesn't setup completed yet\n"));
+                       return -EINVAL;
+               }
+               bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+       }
+       else {
+               if ((bssidx = wl_get_bssidx_by_wdev(cfg, cfgdev_to_wdev(cfgdev))) < 0) {
+                       WL_ERR(("Find p2p index failed\n"));
+                       return BCME_ERROR;
+               }
+       }
+
+       WL_DBG(("TX target bssidx=%d\n", bssidx));
+
+       if (p2p_is_on(cfg)) {
+               /* Suspend P2P discovery search-listen to prevent it from changing the
+                * channel.
+                */
+               if ((err = wl_cfgp2p_discover_enable_search(cfg, false)) < 0) {
+                       WL_ERR(("Can not disable discovery mode\n"));
+                       return -EFAULT;
+               }
+       }
+       *cookie = 0;
+       id = cfg->send_action_id++;
+       if (id == 0)
+               id = cfg->send_action_id++;
+       *cookie = id;
+       mgmt = (const struct ieee80211_mgmt *)buf;
+       if (ieee80211_is_mgmt(mgmt->frame_control)) {
+               if (ieee80211_is_probe_resp(mgmt->frame_control)) {
+                       s32 ie_offset =  DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
+                       s32 ie_len = len - ie_offset;
+                       if ((dev == bcmcfg_to_prmry_ndev(cfg)) && cfg->p2p) {
+                               bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+                       }
+                       wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(dev), bssidx,
+                               VNDR_IE_PRBRSP_FLAG, (const u8 *)(buf + ie_offset), ie_len);
+                       cfg80211_mgmt_tx_status(cfgdev, *cookie, buf, len, true, GFP_KERNEL);
+#if defined(P2P_IE_MISSING_FIX)
+                       if (!cfg->p2p_prb_noti) {
+                               cfg->p2p_prb_noti = true;
+                               WL_DBG(("wl_cfg80211_mgmt_tx: TX 802_1X Probe"
+                                       " Response first time.\n"));
+                       }
+#endif
+                       goto exit;
+               } else if (ieee80211_is_disassoc(mgmt->frame_control) ||
+                       ieee80211_is_deauth(mgmt->frame_control)) {
+                       char mac_buf[MAX_NUM_OF_ASSOCIATED_DEV *
+                               sizeof(struct ether_addr) + sizeof(uint)] = {0};
+                       int num_associated = 0;
+                       struct maclist *assoc_maclist = (struct maclist *)mac_buf;
+                       if (!bcmp((const uint8 *)BSSID_BROADCAST,
+                               (const struct ether_addr *)mgmt->da, ETHER_ADDR_LEN)) {
+                               assoc_maclist->count = MAX_NUM_OF_ASSOCIATED_DEV;
+                               err = wldev_ioctl_get(dev, WLC_GET_ASSOCLIST,
+                                       assoc_maclist, sizeof(mac_buf));
+                               if (err < 0)
+                                       WL_ERR(("WLC_GET_ASSOCLIST error %d\n", err));
+                               else
+                                       num_associated = assoc_maclist->count;
+                       }
+                       memcpy(scb_val.ea.octet, mgmt->da, ETH_ALEN);
+                       scb_val.val = mgmt->u.disassoc.reason_code;
+                       err = wldev_ioctl_set(dev, WLC_SCB_DEAUTHENTICATE_FOR_REASON, &scb_val,
+                               sizeof(scb_val_t));
+                       if (err < 0)
+                               WL_ERR(("WLC_SCB_DEAUTHENTICATE_FOR_REASON error %d\n", err));
+                       WL_ERR(("Disconnect STA : " MACDBG " scb_val.val %d\n",
+                               MAC2STRDBG(bcm_ether_ntoa((const struct ether_addr *)mgmt->da,
+                               eabuf)), scb_val.val));
+
+                       /* WAR Wait for the deauth event to come,
+                        * supplicant will do the delete iface immediately
+                        * and we will have problem in sending
+                        * deauth frame if we delete the bss in firmware.
+                        * But we do not need additional delays for this WAR
+                        * during P2P connection.
+                        *
+                        * Supplicant call this function with BCAST after
+                        * delete all GC stations with each addr.
+                        * So, 400 ms delay can be called only once when GO disconnect all GC
+                       */
+                       if (num_associated > 0 && ETHER_ISBCAST(mgmt->da))
+                               wl_delay(400);
+
+                       cfg80211_mgmt_tx_status(cfgdev, *cookie, buf, len, true, GFP_KERNEL);
+                       goto exit;
+
+               } else if (ieee80211_is_action(mgmt->frame_control)) {
+                       /* Abort the dwell time of any previous off-channel
+                       * action frame that may be still in effect.  Sending
+                       * off-channel action frames relies on the driver's
+                       * scan engine.  If a previous off-channel action frame
+                       * tx is still in progress (including the dwell time),
+                       * then this new action frame will not be sent out.
+                       */
+/* Do not abort scan for VSDB. Scan will be aborted in firmware if necessary.
+ * And previous off-channel action frame must be ended before new af tx.
+ */
+#ifndef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+                       wl_cfg80211_cancel_scan(cfg);
+#endif /* not WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+               }
+#ifdef WL_CLIENT_SAE
+               else if (ieee80211_is_auth(mgmt->frame_control)) {
+                       int err = 0;
+                       wl_assoc_mgr_cmd_t *cmd;
+                       char *ambuf = NULL;
+                       int param_len;
+
+                       ack = true;
+                       if ((dev == bcmcfg_to_prmry_ndev(cfg)) && cfg->p2p) {
+                               bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+                       }
+                       param_len = sizeof(wl_assoc_mgr_cmd_t) + len;
+                       ambuf = MALLOCZ(cfg->osh, param_len);
+                       if (ambuf == NULL) {
+                               WL_ERR(("unable to allocate frame\n"));
+                               return -ENOMEM;
+                       }
+                       cmd = (wl_assoc_mgr_cmd_t*)ambuf;
+                       cmd->version = WL_ASSOC_MGR_CURRENT_VERSION;
+                       cmd->length = len;
+                       cmd->cmd = WL_ASSOC_MGR_CMD_SEND_AUTH;
+                       memcpy(&cmd->params, buf, len);
+                       err = wldev_iovar_setbuf(dev, "assoc_mgr_cmd", ambuf, param_len,
+                               cfg->ioctl_buf, WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync);
+                       if (unlikely(err)) {
+                               WL_ERR(("Failed to send auth(%d)\n", err));
+                               ack = false;
+                       }
+                       MFREE(cfg->osh, ambuf, param_len);
+                       cfg80211_mgmt_tx_status(cfgdev, *cookie, buf, len, ack, GFP_KERNEL);
+                       goto exit;
+               }
+#endif /* WL_CLIENT_SAE */
+       } else {
+               WL_ERR(("Driver only allows MGMT packet type\n"));
+               goto exit;
+       }
+
+       af_params = (wl_af_params_t *)MALLOCZ(cfg->osh, WL_WIFI_AF_PARAMS_SIZE);
+
+       if (af_params == NULL)
+       {
+               WL_ERR(("unable to allocate frame\n"));
+               return -ENOMEM;
+       }
+
+       action_frame = &af_params->action_frame;
+
+       /* Add the packet Id */
+       action_frame->packetId = *cookie;
+       WL_DBG(("action frame %d\n", action_frame->packetId));
+       /* Add BSSID */
+       memcpy(&action_frame->da, &mgmt->da[0], ETHER_ADDR_LEN);
+       memcpy(&af_params->BSSID, &mgmt->bssid[0], ETHER_ADDR_LEN);
+
+       /* Add the length exepted for 802.11 header  */
+       action_frame->len = len - DOT11_MGMT_HDR_LEN;
+       WL_DBG(("action_frame->len: %d\n", action_frame->len));
+
+       /* Add the channel */
+       af_params->channel =
+               wl_freq_to_chanspec(channel->center_freq);
+       /* Save listen_chan for searching common channel */
+       cfg->afx_hdl->peer_listen_chan = af_params->channel;
+       WL_DBG(("channel from upper layer %d\n", cfg->afx_hdl->peer_listen_chan));
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+       af_params->dwell_time = params->wait;
+#else
+       af_params->dwell_time = wait;
+#endif
+
+       memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN], action_frame->len);
+
+       ack = wl_cfg80211_send_action_frame(wiphy, dev, cfgdev, af_params,
+               action_frame, action_frame->len, bssidx);
+       cfg80211_mgmt_tx_status(cfgdev, *cookie, buf, len, ack, GFP_KERNEL);
+       WL_DBG(("txstatus notified for cookie:%llu. ack:%d\n", *cookie, ack));
+
+       MFREE(cfg->osh, af_params, WL_WIFI_AF_PARAMS_SIZE);
+exit:
+       return err;
+}
+
+static void
+wl_cfg80211_mgmt_frame_register(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+       u16 frame, bool reg)
+{
+
+       WL_DBG(("frame_type: %x, reg: %d\n", frame, reg));
+
+       if (frame != (IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_REQ))
+               return;
+
+       return;
+}
+
+static s32
+wl_cfg80211_change_bss(struct wiphy *wiphy,
+       struct net_device *dev,
+       struct bss_parameters *params)
+{
+       s32 err = 0;
+       s32 ap_isolate = 0;
+#ifdef PCIE_FULL_DONGLE
+       s32 ifidx = DHD_BAD_IF;
+#endif
+#if defined(PCIE_FULL_DONGLE)
+       dhd_pub_t *dhd;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd = (dhd_pub_t *)(cfg->pub);
+#if defined(WL_ENABLE_P2P_IF)
+       if (cfg->p2p_net == dev)
+               dev = bcmcfg_to_prmry_ndev(cfg);
+#endif
+#endif
+
+       if (params->use_cts_prot >= 0) {
+       }
+
+       if (params->use_short_preamble >= 0) {
+       }
+
+       if (params->use_short_slot_time >= 0) {
+       }
+
+       if (params->basic_rates) {
+       }
+
+       if (params->ap_isolate >= 0) {
+               ap_isolate = params->ap_isolate;
+#ifdef PCIE_FULL_DONGLE
+               ifidx = dhd_net2idx(dhd->info, dev);
+
+               if (ifidx != DHD_BAD_IF) {
+                       err = dhd_set_ap_isolate(dhd, ifidx, ap_isolate);
+               } else {
+                       WL_ERR(("Failed to set ap_isolate\n"));
+               }
+#else
+               err = wldev_iovar_setint(dev, "ap_isolate", ap_isolate);
+               if (unlikely(err))
+               {
+                       WL_ERR(("set ap_isolate Error (%d)\n", err));
+               }
+#endif /* PCIE_FULL_DONGLE */
+       }
+
+       if (params->ht_opmode >= 0) {
+       }
+
+       return err;
+}
+
+static int
+wl_get_bandwidth_cap(struct net_device *ndev, uint32 band, uint32 *bandwidth)
+{
+       u32 bw = WL_CHANSPEC_BW_20;
+       s32 err = BCME_OK;
+       s32 bw_cap = 0;
+       struct {
+               u32 band;
+               u32 bw_cap;
+       } param = {0, 0};
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+
+       if (band == WL_CHANSPEC_BAND_5G) {
+               param.band = WLC_BAND_5G;
+       }
+#ifdef WL_6G_BAND
+       else if (band == WL_CHANSPEC_BAND_6G) {
+               param.band = WLC_BAND_6G;
+       }
+#endif
+       if (param.band) {
+               /* bw_cap is newly defined iovar for checking bandwith
+                 * capability of the band in Aardvark_branch_tob
+                 */
+               err = wldev_iovar_getbuf(ndev, "bw_cap", &param, sizeof(param),
+                       ioctl_buf, sizeof(ioctl_buf), NULL);
+               if (err) {
+                       if (err != BCME_UNSUPPORTED) {
+                               WL_ERR(("bw_cap failed, %d\n", err));
+                               return err;
+                       } else {
+                               /* if firmware doesn't support bw_cap iovar,
+                                * we have to use mimo_bw_cap
+                                */
+                               err = wldev_iovar_getint(ndev, "mimo_bw_cap", &bw_cap);
+                               if (err) {
+                                       WL_ERR(("error get mimo_bw_cap (%d)\n", err));
+                               }
+                               if (bw_cap != WLC_N_BW_20ALL) {
+                                       bw = WL_CHANSPEC_BW_40;
+                               }
+                       }
+               } else {
+                       if (WL_BW_CAP_160MHZ(ioctl_buf[0])) {
+                               bw = WL_CHANSPEC_BW_160;
+                       } else if (WL_BW_CAP_80MHZ(ioctl_buf[0])) {
+                               bw = WL_CHANSPEC_BW_80;
+                       } else if (WL_BW_CAP_40MHZ(ioctl_buf[0])) {
+                               bw = WL_CHANSPEC_BW_40;
+                       } else {
+                               bw = WL_CHANSPEC_BW_20;
+                       }
+               }
+       } else if (band == WL_CHANSPEC_BAND_2G) {
+               bw = WL_CHANSPEC_BW_20;
+       }
+
+       *bandwidth = bw;
+
+       return err;
+}
+
+#ifdef APSTA_RESTRICTED_CHANNEL
+static s32
+wl_get_nl80211_band(u32 wl_band)
+{
+       s32 err = BCME_ERROR;
+
+       switch (wl_band) {
+               case WL_CHANSPEC_BAND_2G:
+                       return IEEE80211_BAND_2GHZ;
+               case WL_CHANSPEC_BAND_5G:
+                       return IEEE80211_BAND_5GHZ;
+#ifdef WL_BAND_6G
+               case WL_CHANSPEC_BAND_6G:
+                       /* current kernels doesn't support seperate
+                        * band for 6GHz. so till patch is available
+                        * map it under 5GHz
+                        */
+                       return IEEE80211_BAND_5GHZ;
+#endif /* WL_BAND_6G */
+               default:
+                       WL_ERR(("unsupported Band. %d\n", wl_band));
+       }
+
+       return err;
+}
+#endif /* APSTA_RESTRICTED_CHANNEL */
+
+static s32
+wl_cfg80211_set_channel(struct wiphy *wiphy, struct net_device *dev,
+       struct ieee80211_channel *chan,
+       enum nl80211_channel_type channel_type)
+{
+       chanspec_t chspec = INVCHANSPEC;
+       chanspec_t cur_chspec = INVCHANSPEC;
+       u32 bw = WL_CHANSPEC_BW_20;
+       s32 err = BCME_OK;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+#if defined(CUSTOM_SET_CPUCORE) || defined(APSTA_RESTRICTED_CHANNEL) || defined(WL_EXT_IAPSTA)
+       dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+       enum nl80211_band band;
+       s32 _chan;
+#endif /* CUSTOM_SET_CPUCORE || APSTA_RESTRICTED_CHANNEL */
+
+       dev = ndev_to_wlc_ndev(dev, cfg);
+#ifdef WL_EXT_IAPSTA
+       _chan = ieee80211_frequency_to_channel(chan->center_freq);
+       if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP) {
+               wl_ext_iapsta_update_iftype(dev, dhd_net2idx(dhd->info, dev), WL_IF_TYPE_AP);
+               _chan = wl_ext_iapsta_update_channel(dhd, dev, _chan);
+       }
+       if (CHANNEL_IS_5G(_chan))
+               band = NL80211_BAND_5GHZ;
+       else
+               band = NL80211_BAND_2GHZ;
+       chan->center_freq = ieee80211_channel_to_frequency(_chan, band);
+#endif
+       chspec = wl_freq_to_chanspec(chan->center_freq);
+
+       WL_MSG(dev->name, "netdev_ifidx(%d), chan_type(%d) target channel(%d) \n",
+               dev->ifindex, channel_type, CHSPEC_CHANNEL(chspec));
+
+#ifndef WL_P2P_6G
+       if (IS_P2P_GO(dev->ieee80211_ptr) && (CHSPEC_IS6G(chspec))) {
+               WL_ERR(("P2P GO not allowed on 6G\n"));
+               return -ENOTSUPP;
+       }
+#endif /* WL_P2P_6G */
+
+#ifdef NOT_YET
+       switch (channel_type) {
+               case NL80211_CHAN_HT40MINUS:
+                       /* secondary channel is below the control channel */
+                       chspec = CH40MHZ_CHSPEC(CHSPEC_CHANNEL(chspec), WL_CHANSPEC_CTL_SB_UPPER);
+                       break;
+               case NL80211_CHAN_HT40PLUS:
+                       /* secondary channel is above the control channel */
+                       chspec = CH40MHZ_CHSPEC(CHSPEC_CHANNEL(chspec), WL_CHANSPEC_CTL_SB_LOWER);
+                       break;
+               default:
+                       chspec = CH20MHZ_CHSPEC(CHSPEC_CHANNEL(chspec));
+
+       }
+#endif /* NOT_YET */
+
+#if defined(APSTA_RESTRICTED_CHANNEL)
+       /* Some customer platform used limited number of channels
+        * for SoftAP interface on STA/SoftAP concurrent mode.
+        * - 2.4GHz Channel: CH1 - CH13
+        * - 5GHz Channel: CH149 (it depends on the country code)
+        * If the Android framework sent invaild channel configuration
+        * to DHD, driver should change the channel which is sutible for
+        * STA/SoftAP concurrent mode.
+        * - Set operating channel to CH1 (default 2.4GHz channel for
+        *   restricted APSTA mode) if STA interface was associated to
+        *   5GHz APs except for CH149.
+        * - Otherwise, set the channel to the same channel as existing AP.
+        */
+       if (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP &&
+               DHD_OPMODE_STA_SOFTAP_CONCURR(dhd) &&
+               wl_get_drv_status(cfg, CONNECTED, bcmcfg_to_prmry_ndev(cfg))) {
+               u32 *sta_chanspec = (u32 *)wl_read_prof(cfg,
+                       bcmcfg_to_prmry_ndev(cfg), WL_PROF_CHAN);
+               if (chan->band == wl_get_nl80211_band(CHSPEC_BAND(*sta_chanspec))) {
+                       /* Do not try SCC in 5GHz if channel is not CH149 */
+                       chspec = (
+#ifdef WL_6G_BAND
+                               CHSPEC_IS6G(*sta_chanspec) ||
+#endif /* WL_6G_BAND */
+                               (CHSPEC_IS5G(*sta_chanspec) &&
+                               CHSPEC_CHANNEL(*sta_chanspec) != DEFAULT_5G_SOFTAP_CHANNEL)) ?
+                               DEFAULT_2G_SOFTAP_CHANSPEC: *sta_chanspec;
+                       WL_ERR(("target chanspec will be changed to %d\n", chspec));
+                       if (CHSPEC_IS2G(chspec)) {
+                               bw = WL_CHANSPEC_BW_20;
+                               goto set_channel;
+                       }
+               }
+       }
+#endif /* APSTA_RESTRICTED_CHANNEL */
+
+       err = wl_get_bandwidth_cap(dev, CHSPEC_BAND(chspec), &bw);
+       if (err < 0) {
+               WL_ERR(("Failed to get bandwidth information, err=%d\n", err));
+               return err;
+       }
+
+       /* In case of 5G downgrade BW to 80MHz as 160MHz channels falls in DFS */
+       if (CHSPEC_IS5G(chspec) && (bw == WL_CHANSPEC_BW_160)) {
+               bw = WL_CHANSPEC_BW_80;
+       }
+set_channel:
+       cur_chspec = wf_create_chspec_from_primary(wf_chspec_primary20_chan(chspec),
+               bw, CHSPEC_BAND(chspec));
+       if (wf_chspec_valid(cur_chspec)) {
+               /* convert 802.11 ac chanspec to current fw chanspec type */
+               cur_chspec = wl_chspec_host_to_driver(cur_chspec);
+               if (cur_chspec != INVCHANSPEC) {
+                       if ((err = wldev_iovar_setint(dev, "chanspec",
+                               cur_chspec)) == BCME_BADCHAN) {
+                               u32 local_channel = CHSPEC_CHANNEL(chspec);
+                               if ((bw == WL_CHANSPEC_BW_80) || (bw == WL_CHANSPEC_BW_160))
+                                       goto change_bw;
+                               err = wldev_ioctl_set(dev, WLC_SET_CHANNEL,
+                                       &local_channel, sizeof(local_channel));
+                               if (err < 0) {
+                                       WL_ERR(("WLC_SET_CHANNEL error %d"
+                                       "chip may not be supporting this channel\n", err));
+                               }
+                       } else if (err) {
+                               WL_ERR(("failed to set chanspec error %d\n", err));
+                       }
+#ifdef DISABLE_WL_FRAMEBURST_SOFTAP
+                       else {
+                               /* Disable Frameburst only for stand-alone 2GHz SoftAP */
+                               if (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP &&
+                                       DHD_OPMODE_SUPPORTED(cfg->pub, DHD_FLAG_HOSTAP_MODE) &&
+                                       (CHSPEC_IS2G(chspec)) &&
+                                       !wl_get_drv_status(cfg, CONNECTED,
+                                               bcmcfg_to_prmry_ndev(cfg))) {
+                                       WL_DBG(("Disabling frameburst on "
+                                               "stand-alone 2GHz SoftAP\n"));
+                                       wl_cfg80211_set_frameburst(cfg, FALSE);
+                               }
+                       }
+#endif /* DISABLE_WL_FRAMEBURST_SOFTAP */
+               } else {
+                       WL_ERR(("failed to convert host chanspec to fw chanspec\n"));
+                       err = BCME_ERROR;
+               }
+       } else {
+change_bw:
+               if (bw == WL_CHANSPEC_BW_160) {
+                       bw = WL_CHANSPEC_BW_80;
+               } else if (bw == WL_CHANSPEC_BW_80) {
+                       bw = WL_CHANSPEC_BW_40;
+               } else if (bw == WL_CHANSPEC_BW_40) {
+                       bw = WL_CHANSPEC_BW_20;
+               } else {
+                       bw = 0;
+               }
+               if (bw)
+                       goto set_channel;
+               WL_ERR(("Invalid chanspec 0x%x\n", chspec));
+               err = BCME_ERROR;
+       }
+#ifdef CUSTOM_SET_CPUCORE
+       if (dhd->op_mode == DHD_FLAG_HOSTAP_MODE) {
+               WL_DBG(("SoftAP mode do not need to set cpucore\n"));
+       } else if (chspec & WL_CHANSPEC_BW_80) {
+               /* SoftAp only mode do not need to set cpucore */
+               if ((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP) &&
+                       dev != bcmcfg_to_prmry_ndev(cfg)) {
+                       /* Soft AP on virtual Iface (AP+STA case) */
+                       dhd->chan_isvht80 |= DHD_FLAG_HOSTAP_MODE;
+                       dhd_set_cpucore(dhd, TRUE);
+               } else if (is_p2p_group_iface(dev->ieee80211_ptr)) {
+                       /* If P2P IF is vht80 */
+                       dhd->chan_isvht80 |= DHD_FLAG_P2P_MODE;
+                       dhd_set_cpucore(dhd, TRUE);
+               }
+       }
+#endif /* CUSTOM_SET_CPUCORE */
+       if (!err && (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP)) {
+               /* Update AP/GO operating chanspec */
+               cfg->ap_oper_channel = wl_freq_to_chanspec(chan->center_freq);
+       }
+       if (err) {
+               wl_flush_fw_log_buffer(bcmcfg_to_prmry_ndev(cfg),
+                       FW_LOGSET_MASK_ALL);
+       } else {
+               WL_DBG(("Setting chanspec %x for GO/AP \n", chspec));
+       }
+       return err;
+}
+
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+struct net_device *
+wl_cfg80211_get_remain_on_channel_ndev(struct bcm_cfg80211 *cfg)
+{
+       struct net_info *_net_info, *next;
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_entry_safe(_net_info, next, &cfg->net_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (_net_info->ndev &&
+                       test_bit(WL_STATUS_REMAINING_ON_CHANNEL, &_net_info->sme_state))
+                       return _net_info->ndev;
+       }
+
+       return NULL;
+}
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+static s32
+wl_validate_opensecurity(struct net_device *dev, s32 bssidx, bool privacy)
+{
+       s32 err = BCME_OK;
+       u32 wpa_val;
+       s32 wsec = 0;
+
+       /* set auth */
+       err = wldev_iovar_setint_bsscfg(dev, "auth", 0, bssidx);
+       if (err < 0) {
+               WL_ERR(("auth error %d\n", err));
+               return BCME_ERROR;
+       }
+
+       if (privacy) {
+               /* If privacy bit is set in open mode, then WEP would be enabled */
+               wsec = WEP_ENABLED;
+               WL_DBG(("Setting wsec to %d for WEP \n", wsec));
+       }
+
+       /* set wsec */
+       err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+       if (err < 0) {
+               WL_ERR(("wsec error %d\n", err));
+               return BCME_ERROR;
+       }
+
+       /* set upper-layer auth */
+       if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_ADHOC)
+               wpa_val = WPA_AUTH_NONE;
+       else
+               wpa_val = WPA_AUTH_DISABLED;
+       err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", wpa_val, bssidx);
+       if (err < 0) {
+               WL_ERR(("wpa_auth error %d\n", err));
+               return BCME_ERROR;
+       }
+
+       return 0;
+}
+
+#define MAX_FILS_IND_IE_LEN 1024u
+static s32
+wl_validate_fils_ind_ie(struct net_device *dev, const bcm_tlv_t *filsindie, s32 bssidx)
+{
+       s32 err = BCME_OK;
+       struct bcm_cfg80211 *cfg = NULL;
+       bcm_iov_buf_t *iov_buf = NULL;
+       bcm_xtlv_t* pxtlv;
+       int iov_buf_size = 0;
+
+       if (!dev || !filsindie) {
+               WL_ERR(("%s: dev/filsidie is null\n", __FUNCTION__));
+               goto exit;
+       }
+
+       cfg = wl_get_cfg(dev);
+       if (!cfg) {
+               WL_ERR(("%s: cfg is null\n", __FUNCTION__));
+               goto exit;
+       }
+
+       iov_buf_size = sizeof(bcm_iov_buf_t) + sizeof(bcm_xtlv_t) + filsindie->len - 1;
+       iov_buf = MALLOCZ(cfg->osh, iov_buf_size);
+       if (!iov_buf) {
+               WL_ERR(("%s: iov_buf alloc failed! %d bytes\n", __FUNCTION__, iov_buf_size));
+               err = BCME_NOMEM;
+               goto exit;
+       }
+       iov_buf->version = WL_FILS_IOV_VERSION;
+       iov_buf->id = WL_FILS_CMD_ADD_IND_IE;
+       iov_buf->len = sizeof(bcm_xtlv_t) + filsindie->len - 1;
+       pxtlv = (bcm_xtlv_t*)&iov_buf->data[0];
+       pxtlv->id = WL_FILS_XTLV_IND_IE;
+       pxtlv->len = filsindie->len;
+       /* memcpy_s return check not required as buffer is allocated based on ie
+        * len
+        */
+       (void)memcpy_s(pxtlv->data, filsindie->len, filsindie->data, filsindie->len);
+
+       err = wldev_iovar_setbuf(dev, "fils", iov_buf, iov_buf_size,
+               cfg->ioctl_buf, WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("fils indication ioctl error (%d)\n", err));
+                goto exit;
+       }
+
+exit:
+       if (err < 0) {
+               WL_ERR(("FILS Ind setting error %d\n", err));
+       }
+
+       if (iov_buf) {
+               MFREE(cfg->osh, iov_buf, iov_buf_size);
+       }
+       return err;
+}
+
+static s32
+wl_validate_wpa2ie(struct net_device *dev, const bcm_tlv_t *wpa2ie, s32 bssidx)
+{
+       s32 len = 0;
+       s32 err = BCME_OK;
+       u16 auth = 0; /* d11 open authentication */
+       u32 wsec;
+       u32 pval = 0;
+       u32 gval = 0;
+       u32 wpa_auth = 0;
+       const wpa_suite_mcast_t *mcast;
+       const wpa_suite_ucast_t *ucast;
+       const wpa_suite_auth_key_mgmt_t *mgmt;
+       const wpa_pmkid_list_t *pmkid;
+       int cnt = 0;
+#ifdef MFP
+       int mfp = 0;
+#endif /* MFP */
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       struct wl_security *sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+
+       u16 suite_count;
+       u8 rsn_cap[2];
+       u32 wme_bss_disable;
+
+       if (wpa2ie == NULL)
+               goto exit;
+
+       WL_DBG(("Enter \n"));
+       len =  wpa2ie->len - WPA2_VERSION_LEN;
+       /* check the mcast cipher */
+       mcast = (const wpa_suite_mcast_t *)&wpa2ie->data[WPA2_VERSION_LEN];
+       switch (mcast->type) {
+               case WPA_CIPHER_NONE:
+                       gval = 0;
+                       break;
+               case WPA_CIPHER_WEP_40:
+               case WPA_CIPHER_WEP_104:
+                       gval = WEP_ENABLED;
+                       break;
+               case WPA_CIPHER_TKIP:
+                       gval = TKIP_ENABLED;
+                       break;
+               case WPA_CIPHER_AES_CCM:
+                       gval = AES_ENABLED;
+                       break;
+
+#ifdef BCMWAPI_WPI
+               case WAPI_CIPHER_SMS4:
+                       gval = SMS4_ENABLED;
+                       break;
+#endif
+
+               default:
+                       WL_ERR(("No Security Info\n"));
+                       break;
+       }
+       if ((len -= WPA_SUITE_LEN) <= 0)
+               return BCME_BADLEN;
+
+       /* check the unicast cipher */
+       ucast = (const wpa_suite_ucast_t *)&mcast[1];
+       suite_count = ltoh16_ua(&ucast->count);
+       switch (ucast->list[0].type) {
+               case WPA_CIPHER_NONE:
+                       pval = 0;
+                       break;
+               case WPA_CIPHER_WEP_40:
+               case WPA_CIPHER_WEP_104:
+                       pval = WEP_ENABLED;
+                       break;
+               case WPA_CIPHER_TKIP:
+                       pval = TKIP_ENABLED;
+                       break;
+               case WPA_CIPHER_AES_CCM:
+                       pval = AES_ENABLED;
+                       break;
+
+#ifdef BCMWAPI_WPI
+               case WAPI_CIPHER_SMS4:
+                       pval = SMS4_ENABLED;
+                       break;
+#endif
+
+               default:
+                       WL_ERR(("No Security Info\n"));
+       }
+       if ((len -= (WPA_IE_SUITE_COUNT_LEN + (WPA_SUITE_LEN * suite_count))) <= 0)
+               return BCME_BADLEN;
+
+       /* FOR WPS , set SEC_OW_ENABLED */
+       wsec = (pval | gval | SES_OW_ENABLED);
+       /* check the AKM */
+       mgmt = (const wpa_suite_auth_key_mgmt_t *)&ucast->list[suite_count];
+       suite_count = cnt = ltoh16_ua(&mgmt->count);
+       while (cnt--) {
+               if (bcmp(mgmt->list[cnt].oui, WFA_OUI, WFA_OUI_LEN) == 0) {
+                       switch (mgmt->list[cnt].type) {
+                       case RSN_AKM_DPP:
+                               wpa_auth |= WPA3_AUTH_DPP_AKM;
+                               break;
+                       default:
+                               WL_ERR(("No Key Mgmt Info in WFA_OUI\n"));
+                       }
+               } else {
+                       switch (mgmt->list[cnt].type) {
+                       case RSN_AKM_NONE:
+                               wpa_auth |= WPA_AUTH_NONE;
+                               break;
+                       case RSN_AKM_UNSPECIFIED:
+                               wpa_auth |= WPA2_AUTH_UNSPECIFIED;
+                               break;
+                       case RSN_AKM_PSK:
+                               wpa_auth |= WPA2_AUTH_PSK;
+                               break;
+#ifdef MFP
+                       case RSN_AKM_MFP_PSK:
+                               wpa_auth |= WPA2_AUTH_PSK_SHA256;
+                               break;
+                       case RSN_AKM_MFP_1X:
+                               wpa_auth |= WPA2_AUTH_1X_SHA256;
+                               break;
+                       case RSN_AKM_FILS_SHA256:
+                               wpa_auth |= WPA2_AUTH_FILS_SHA256;
+                               break;
+                       case RSN_AKM_FILS_SHA384:
+                               wpa_auth |= WPA2_AUTH_FILS_SHA384;
+                               break;
+#if defined(WL_SAE) || defined(WL_CLIENT_SAE)
+                       case RSN_AKM_SAE_PSK:
+                               wpa_auth |= WPA3_AUTH_SAE_PSK;
+                               break;
+#endif /* WL_SAE || WL_CLIENT_SAE */
+#endif /* MFP */
+                       default:
+                               WL_ERR(("No Key Mgmt Info\n"));
+                       }
+               }
+       }
+       if ((len -= (WPA_IE_SUITE_COUNT_LEN + (WPA_SUITE_LEN * suite_count))) >= RSN_CAP_LEN) {
+               rsn_cap[0] = *(const u8 *)&mgmt->list[suite_count];
+               rsn_cap[1] = *((const u8 *)&mgmt->list[suite_count] + 1);
+
+               if (rsn_cap[0] & (RSN_CAP_16_REPLAY_CNTRS << RSN_CAP_PTK_REPLAY_CNTR_SHIFT)) {
+                       wme_bss_disable = 0;
+               } else {
+                       wme_bss_disable = 1;
+               }
+
+#ifdef MFP
+       if (rsn_cap[0] & RSN_CAP_MFPR) {
+               WL_DBG(("MFP Required \n"));
+               mfp = WL_MFP_REQUIRED;
+               /* Our firmware has requirement that WPA2_AUTH_PSK/WPA2_AUTH_UNSPECIFIED
+                * be set, if SHA256 OUI is to be included in the rsn ie.
+                */
+               if (wpa_auth & WPA2_AUTH_PSK_SHA256) {
+                       wpa_auth |= WPA2_AUTH_PSK;
+               } else if (wpa_auth & WPA2_AUTH_1X_SHA256) {
+                       wpa_auth |= WPA2_AUTH_UNSPECIFIED;
+               }
+       } else if (rsn_cap[0] & RSN_CAP_MFPC) {
+               WL_DBG(("MFP Capable \n"));
+               mfp = WL_MFP_CAPABLE;
+       }
+#endif /* MFP */
+
+               /* set wme_bss_disable to sync RSN Capabilities */
+               err = wldev_iovar_setint_bsscfg(dev, "wme_bss_disable", wme_bss_disable, bssidx);
+               if (err < 0) {
+                       WL_ERR(("wme_bss_disable error %d\n", err));
+                       return BCME_ERROR;
+               }
+       } else {
+               WL_DBG(("There is no RSN Capabilities. remained len %d\n", len));
+       }
+
+       len -= RSN_CAP_LEN;
+       if (len >= WPA2_PMKID_COUNT_LEN) {
+               pmkid = (const wpa_pmkid_list_t *)
+                       ((const u8 *)&mgmt->list[suite_count] + RSN_CAP_LEN);
+               cnt = ltoh16_ua(&pmkid->count);
+               if (cnt != 0) {
+                       WL_ERR(("AP has non-zero PMKID count. Wrong!\n"));
+                       return BCME_ERROR;
+               }
+               /* since PMKID cnt is known to be 0 for AP, */
+               /* so don't bother to send down this info to firmware */
+       }
+
+#ifdef MFP
+       len -= WPA2_PMKID_COUNT_LEN;
+       if (len >= WPA_SUITE_LEN) {
+               cfg->bip_pos =
+                       (const u8 *)&mgmt->list[suite_count] + RSN_CAP_LEN + WPA2_PMKID_COUNT_LEN;
+       } else {
+               cfg->bip_pos = NULL;
+       }
+#endif
+
+       /* set auth */
+       err = wldev_iovar_setint_bsscfg(dev, "auth", auth, bssidx);
+       if (err < 0) {
+               WL_ERR(("auth error %d\n", err));
+               return BCME_ERROR;
+       }
+
+       /* set wsec */
+       err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+       if (err < 0) {
+               WL_ERR(("wsec error %d\n", err));
+               return BCME_ERROR;
+       }
+
+#ifdef MFP
+       cfg->mfp_mode = mfp;
+#endif /* MFP */
+
+       /* set upper-layer auth */
+       err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", wpa_auth, bssidx);
+       if (err < 0) {
+               WL_ERR(("wpa_auth error %d\n", err));
+               return BCME_ERROR;
+       }
+
+       if (sec) {
+               /* store applied sec settings */
+               sec->fw_wpa_auth = wpa_auth;
+               sec->fw_wsec = wsec;
+               sec->fw_auth = auth;
+#ifdef MFP
+               sec->fw_mfp = mfp;
+#endif /* mfp */
+       }
+exit:
+       return 0;
+}
+
+static s32
+wl_validate_wpaie(struct net_device *dev, const wpa_ie_fixed_t *wpaie, s32 bssidx)
+{
+       const wpa_suite_mcast_t *mcast;
+       const wpa_suite_ucast_t *ucast;
+       const wpa_suite_auth_key_mgmt_t *mgmt;
+       u16 auth = 0; /* d11 open authentication */
+       u16 count;
+       s32 err = BCME_OK;
+       s32 len = 0;
+       u32 i;
+       u32 wsec;
+       u32 pval = 0;
+       u32 gval = 0;
+       u32 wpa_auth = 0;
+       u32 tmp = 0;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       struct wl_security *sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+
+       if (wpaie == NULL)
+               goto exit;
+       WL_DBG(("Enter \n"));
+       len = wpaie->length;    /* value length */
+       len -= WPA_IE_TAG_FIXED_LEN;
+       /* check for multicast cipher suite */
+       if (len < WPA_SUITE_LEN) {
+               WL_INFORM_MEM(("no multicast cipher suite\n"));
+               goto exit;
+       }
+
+       /* pick up multicast cipher */
+       mcast = (const wpa_suite_mcast_t *)&wpaie[1];
+       len -= WPA_SUITE_LEN;
+       if (!bcmp(mcast->oui, WPA_OUI, WPA_OUI_LEN)) {
+               if (IS_WPA_CIPHER(mcast->type)) {
+                       tmp = 0;
+                       switch (mcast->type) {
+                               case WPA_CIPHER_NONE:
+                                       tmp = 0;
+                                       break;
+                               case WPA_CIPHER_WEP_40:
+                               case WPA_CIPHER_WEP_104:
+                                       tmp = WEP_ENABLED;
+                                       break;
+                               case WPA_CIPHER_TKIP:
+                                       tmp = TKIP_ENABLED;
+                                       break;
+                               case WPA_CIPHER_AES_CCM:
+                                       tmp = AES_ENABLED;
+                                       break;
+                               default:
+                                       WL_ERR(("No Security Info\n"));
+                       }
+                       gval |= tmp;
+               }
+       }
+       /* Check for unicast suite(s) */
+       if (len < WPA_IE_SUITE_COUNT_LEN) {
+               WL_INFORM_MEM(("no unicast suite\n"));
+               goto exit;
+       }
+       /* walk thru unicast cipher list and pick up what we recognize */
+       ucast = (const wpa_suite_ucast_t *)&mcast[1];
+       count = ltoh16_ua(&ucast->count);
+       len -= WPA_IE_SUITE_COUNT_LEN;
+       for (i = 0; i < count && len >= WPA_SUITE_LEN;
+               i++, len -= WPA_SUITE_LEN) {
+               if (!bcmp(ucast->list[i].oui, WPA_OUI, WPA_OUI_LEN)) {
+                       if (IS_WPA_CIPHER(ucast->list[i].type)) {
+                               tmp = 0;
+                               switch (ucast->list[i].type) {
+                                       case WPA_CIPHER_NONE:
+                                               tmp = 0;
+                                               break;
+                                       case WPA_CIPHER_WEP_40:
+                                       case WPA_CIPHER_WEP_104:
+                                               tmp = WEP_ENABLED;
+                                               break;
+                                       case WPA_CIPHER_TKIP:
+                                               tmp = TKIP_ENABLED;
+                                               break;
+                                       case WPA_CIPHER_AES_CCM:
+                                               tmp = AES_ENABLED;
+                                               break;
+                                       default:
+                                               WL_ERR(("No Security Info\n"));
+                               }
+                               pval |= tmp;
+                       }
+               }
+       }
+       len -= (count - i) * WPA_SUITE_LEN;
+       /* Check for auth key management suite(s) */
+       if (len < WPA_IE_SUITE_COUNT_LEN) {
+               WL_INFORM_MEM((" no auth key mgmt suite\n"));
+               goto exit;
+       }
+       /* walk thru auth management suite list and pick up what we recognize */
+       mgmt = (const wpa_suite_auth_key_mgmt_t *)&ucast->list[count];
+       count = ltoh16_ua(&mgmt->count);
+       len -= WPA_IE_SUITE_COUNT_LEN;
+       for (i = 0; i < count && len >= WPA_SUITE_LEN;
+               i++, len -= WPA_SUITE_LEN) {
+               if (!bcmp(mgmt->list[i].oui, WPA_OUI, WPA_OUI_LEN)) {
+                       if (IS_WPA_AKM(mgmt->list[i].type)) {
+                               tmp = 0;
+                               switch (mgmt->list[i].type) {
+                                       case RSN_AKM_NONE:
+                                               tmp = WPA_AUTH_NONE;
+                                               break;
+                                       case RSN_AKM_UNSPECIFIED:
+                                               tmp = WPA_AUTH_UNSPECIFIED;
+                                               break;
+                                       case RSN_AKM_PSK:
+                                               tmp = WPA_AUTH_PSK;
+                                               break;
+                                       default:
+                                               WL_ERR(("No Key Mgmt Info\n"));
+                               }
+                               wpa_auth |= tmp;
+                       }
+               }
+
+       }
+       /* FOR WPS , set SEC_OW_ENABLED */
+       wsec = (pval | gval | SES_OW_ENABLED);
+       /* set auth */
+       err = wldev_iovar_setint_bsscfg(dev, "auth", auth, bssidx);
+       if (err < 0) {
+               WL_ERR(("auth error %d\n", err));
+               return BCME_ERROR;
+       }
+       /* set wsec */
+       err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+       if (err < 0) {
+               WL_ERR(("wsec error %d\n", err));
+               return BCME_ERROR;
+       }
+       /* set upper-layer auth */
+       err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", wpa_auth, bssidx);
+       if (err < 0) {
+               WL_ERR(("wpa_auth error %d\n", err));
+               return BCME_ERROR;
+       }
+
+       if (sec) {
+               /* store applied sec settings */
+               sec->fw_wpa_auth = wpa_auth;
+               sec->fw_wsec = wsec;
+               sec->fw_auth = auth;
+       }
+
+exit:
+       return 0;
+}
+
+#if defined(SUPPORT_SOFTAP_WPAWPA2_MIXED)
+static u32 wl_get_cipher_type(uint8 type)
+{
+       u32 ret = 0;
+       switch (type) {
+               case WPA_CIPHER_NONE:
+                       ret = 0;
+                       break;
+               case WPA_CIPHER_WEP_40:
+               case WPA_CIPHER_WEP_104:
+                       ret = WEP_ENABLED;
+                       break;
+               case WPA_CIPHER_TKIP:
+                       ret = TKIP_ENABLED;
+                       break;
+               case WPA_CIPHER_AES_CCM:
+                       ret = AES_ENABLED;
+                       break;
+
+#ifdef BCMWAPI_WPI
+               case WAPI_CIPHER_SMS4:
+                       ret = SMS4_ENABLED;
+                       break;
+#endif
+
+               default:
+                       WL_ERR(("No Security Info\n"));
+       }
+       return ret;
+}
+
+static u32 wl_get_suite_auth_key_mgmt_type(uint8 type, const wpa_suite_mcast_t *mcast)
+{
+       u32 ret = 0;
+       u32 is_wpa2 = 0;
+
+       if (!bcmp(mcast->oui, WPA2_OUI, WPA2_OUI_LEN)) {
+               is_wpa2 = 1;
+       }
+
+       WL_INFORM_MEM(("%s, type = %d\n", is_wpa2 ? "WPA2":"WPA", type));
+       if (bcmp(mcast->oui, WFA_OUI, WFA_OUI_LEN) == 0) {
+               switch (type) {
+                       case RSN_AKM_DPP:
+                               ret = WPA3_AUTH_DPP_AKM;
+                               break;
+                       default:
+                               WL_ERR(("No Key Mgmt Info in WFA_OUI\n"));
+               }
+       } else {
+               switch (type) {
+               case RSN_AKM_NONE:
+                       /* For WPA and WPA2, AUTH_NONE is common */
+                       ret = WPA_AUTH_NONE;
+                       break;
+               case RSN_AKM_UNSPECIFIED:
+                       if (is_wpa2) {
+                               ret = WPA2_AUTH_UNSPECIFIED;
+                       } else {
+                               ret = WPA_AUTH_UNSPECIFIED;
+                       }
+                       break;
+               case RSN_AKM_PSK:
+                       if (is_wpa2) {
+                               ret = WPA2_AUTH_PSK;
+                       } else {
+                               ret = WPA_AUTH_PSK;
+                       }
+                       break;
+#ifdef WL_SAE
+               case RSN_AKM_SAE_PSK:
+                       ret = WPA3_AUTH_SAE_PSK;
+                       break;
+#endif /* WL_SAE */
+               default:
+                       WL_ERR(("No Key Mgmt Info\n"));
+               }
+       }
+       return ret;
+}
+
+static s32
+wl_validate_wpaie_wpa2ie(struct net_device *dev, const wpa_ie_fixed_t *wpaie,
+       const bcm_tlv_t *wpa2ie, s32 bssidx)
+{
+       const wpa_suite_mcast_t *mcast;
+       const wpa_suite_ucast_t *ucast;
+       const wpa_suite_auth_key_mgmt_t *mgmt;
+       u16 auth = 0; /* d11 open authentication */
+       u16 count;
+       s32 err = BCME_OK;
+       u32 wme_bss_disable;
+       u16 suite_count;
+       u8 rsn_cap[2];
+       s32 len = 0;
+       u32 i;
+       u32 wsec1, wsec2, wsec;
+       u32 pval = 0;
+       u32 gval = 0;
+       u32 wpa_auth = 0;
+       u32 wpa_auth1 = 0;
+       u32 wpa_auth2 = 0;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       struct wl_security *sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+
+       if (wpaie == NULL || wpa2ie == NULL)
+               goto exit;
+
+       WL_DBG(("Enter \n"));
+       len = wpaie->length;    /* value length */
+       len -= WPA_IE_TAG_FIXED_LEN;
+       /* check for multicast cipher suite */
+       if (len < WPA_SUITE_LEN) {
+               WL_INFORM_MEM(("no multicast cipher suite\n"));
+               goto exit;
+       }
+
+       /* pick up multicast cipher */
+       mcast = (const wpa_suite_mcast_t *)&wpaie[1];
+       len -= WPA_SUITE_LEN;
+       if (!bcmp(mcast->oui, WPA_OUI, WPA_OUI_LEN)) {
+               if (IS_WPA_CIPHER(mcast->type)) {
+                       gval |= wl_get_cipher_type(mcast->type);
+               }
+       }
+       WL_DBG(("\nwpa ie validate\n"));
+       WL_DBG(("wpa ie mcast cipher = 0x%X\n", gval));
+
+       /* Check for unicast suite(s) */
+       if (len < WPA_IE_SUITE_COUNT_LEN) {
+               WL_INFORM_MEM(("no unicast suite\n"));
+               goto exit;
+       }
+
+       /* walk thru unicast cipher list and pick up what we recognize */
+       ucast = (const wpa_suite_ucast_t *)&mcast[1];
+       count = ltoh16_ua(&ucast->count);
+       len -= WPA_IE_SUITE_COUNT_LEN;
+       for (i = 0; i < count && len >= WPA_SUITE_LEN;
+               i++, len -= WPA_SUITE_LEN) {
+               if (!bcmp(ucast->list[i].oui, WPA_OUI, WPA_OUI_LEN)) {
+                       if (IS_WPA_CIPHER(ucast->list[i].type)) {
+                               pval |= wl_get_cipher_type(ucast->list[i].type);
+                       }
+               }
+       }
+       WL_ERR(("wpa ie ucast count =%d, cipher = 0x%X\n", count, pval));
+
+       /* FOR WPS , set SEC_OW_ENABLED */
+       wsec1 = (pval | gval | SES_OW_ENABLED);
+       WL_ERR(("wpa ie wsec = 0x%X\n", wsec1));
+
+       len -= (count - i) * WPA_SUITE_LEN;
+       /* Check for auth key management suite(s) */
+       if (len < WPA_IE_SUITE_COUNT_LEN) {
+               WL_INFORM_MEM((" no auth key mgmt suite\n"));
+               goto exit;
+       }
+       /* walk thru auth management suite list and pick up what we recognize */
+       mgmt = (const wpa_suite_auth_key_mgmt_t *)&ucast->list[count];
+       count = ltoh16_ua(&mgmt->count);
+       len -= WPA_IE_SUITE_COUNT_LEN;
+       for (i = 0; i < count && len >= WPA_SUITE_LEN;
+               i++, len -= WPA_SUITE_LEN) {
+               if (!bcmp(mgmt->list[i].oui, WPA_OUI, WPA_OUI_LEN)) {
+                       if (IS_WPA_AKM(mgmt->list[i].type)) {
+                               wpa_auth1 |=
+                                       wl_get_suite_auth_key_mgmt_type(mgmt->list[i].type, mcast);
+                       }
+               }
+
+       }
+       WL_ERR(("wpa ie wpa_suite_auth_key_mgmt count=%d, key_mgmt = 0x%X\n", count, wpa_auth1));
+       WL_ERR(("\nwpa2 ie validate\n"));
+
+       pval = 0;
+       gval = 0;
+       len =  wpa2ie->len;
+       /* check the mcast cipher */
+       mcast = (const wpa_suite_mcast_t *)&wpa2ie->data[WPA2_VERSION_LEN];
+       gval = wl_get_cipher_type(mcast->type);
+
+       WL_ERR(("wpa2 ie mcast cipher = 0x%X\n", gval));
+       if ((len -= WPA_SUITE_LEN) <= 0)
+       {
+               WL_ERR(("P:wpa2 ie len[%d]", len));
+               return BCME_BADLEN;
+       }
+
+       /* check the unicast cipher */
+       ucast = (const wpa_suite_ucast_t *)&mcast[1];
+       suite_count = ltoh16_ua(&ucast->count);
+       WL_ERR((" WPA2 ucast cipher count=%d\n", suite_count));
+       pval |= wl_get_cipher_type(ucast->list[0].type);
+
+       if ((len -= (WPA_IE_SUITE_COUNT_LEN + (WPA_SUITE_LEN * suite_count))) <= 0)
+               return BCME_BADLEN;
+
+       WL_ERR(("wpa2 ie ucast cipher = 0x%X\n", pval));
+
+       /* FOR WPS , set SEC_OW_ENABLED */
+       wsec2 = (pval | gval | SES_OW_ENABLED);
+       WL_ERR(("wpa2 ie wsec = 0x%X\n", wsec2));
+
+       /* check the AKM */
+       mgmt = (const wpa_suite_auth_key_mgmt_t *)&ucast->list[suite_count];
+       suite_count = ltoh16_ua(&mgmt->count);
+       wpa_auth2 = wl_get_suite_auth_key_mgmt_type(mgmt->list[0].type, mcast);
+       WL_ERR(("wpa ie wpa_suite_auth_key_mgmt count=%d, key_mgmt = 0x%X\n", count, wpa_auth2));
+
+       if ((len -= (WPA_IE_SUITE_COUNT_LEN + (WPA_SUITE_LEN * suite_count))) >= RSN_CAP_LEN) {
+               rsn_cap[0] = *(const u8 *)&mgmt->list[suite_count];
+               rsn_cap[1] = *((const u8 *)&mgmt->list[suite_count] + 1);
+               if (rsn_cap[0] & (RSN_CAP_16_REPLAY_CNTRS << RSN_CAP_PTK_REPLAY_CNTR_SHIFT)) {
+                       wme_bss_disable = 0;
+               } else {
+                       wme_bss_disable = 1;
+               }
+               WL_DBG(("P:rsn_cap[0]=[0x%X]:wme_bss_disabled[%d]\n", rsn_cap[0], wme_bss_disable));
+
+               /* set wme_bss_disable to sync RSN Capabilities */
+               err = wldev_iovar_setint_bsscfg(dev, "wme_bss_disable", wme_bss_disable, bssidx);
+               if (err < 0) {
+                       WL_ERR(("wme_bss_disable error %d\n", err));
+                       return BCME_ERROR;
+               }
+       } else {
+               WL_DBG(("There is no RSN Capabilities. remained len %d\n", len));
+       }
+
+       wsec = (wsec1 | wsec2);
+       wpa_auth = (wpa_auth1 | wpa_auth2);
+       WL_ERR(("wpa_wpa2 wsec=0x%X wpa_auth=0x%X\n", wsec, wpa_auth));
+
+       /* set auth */
+       err = wldev_iovar_setint_bsscfg(dev, "auth", auth, bssidx);
+       if (err < 0) {
+               WL_ERR(("auth error %d\n", err));
+               return BCME_ERROR;
+       }
+       /* set wsec */
+       err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+       if (err < 0) {
+               WL_ERR(("wsec error %d\n", err));
+               return BCME_ERROR;
+       }
+       /* set upper-layer auth */
+       err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", wpa_auth, bssidx);
+       if (err < 0) {
+               WL_ERR(("wpa_auth error %d\n", err));
+               return BCME_ERROR;
+       }
+
+       if (sec) {
+               sec->fw_wpa_auth = wpa_auth;
+               sec->fw_auth = auth;
+               sec->fw_wsec = wsec;
+       }
+
+exit:
+       return 0;
+}
+#endif /* SUPPORT_SOFTAP_WPAWPA2_MIXED */
+
+static s32
+wl_cfg80211_bcn_validate_sec(
+       struct net_device *dev,
+       struct parsed_ies *ies,
+       u32 dev_role,
+       s32 bssidx,
+       bool privacy)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       wl_cfgbss_t *bss = wl_get_cfgbss_by_wdev(cfg, dev->ieee80211_ptr);
+       struct wl_security *sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+
+       if (!bss) {
+               WL_ERR(("cfgbss is NULL \n"));
+               return BCME_ERROR;
+       }
+
+       if (dev_role == NL80211_IFTYPE_P2P_GO && (ies->wpa2_ie)) {
+               /* For P2P GO, the sec type is WPA2-PSK */
+               WL_DBG(("P2P GO: validating wpa2_ie"));
+               if (wl_validate_wpa2ie(dev, ies->wpa2_ie, bssidx)  < 0)
+                       return BCME_ERROR;
+
+       } else if (dev_role == NL80211_IFTYPE_AP) {
+
+               WL_DBG(("SoftAP: validating security"));
+               /* If wpa2_ie or wpa_ie is present validate it */
+
+#if defined(SUPPORT_SOFTAP_WPAWPA2_MIXED)
+               if ((ies->wpa_ie != NULL && ies->wpa2_ie != NULL)) {
+                       if (wl_validate_wpaie_wpa2ie(dev, ies->wpa_ie, ies->wpa2_ie, bssidx)  < 0) {
+                               bss->security_mode = false;
+                               return BCME_ERROR;
+                       }
+               }
+               else {
+#endif /* SUPPORT_SOFTAP_WPAWPA2_MIXED */
+               if ((ies->wpa2_ie || ies->wpa_ie) &&
+                       ((wl_validate_wpa2ie(dev, ies->wpa2_ie, bssidx)  < 0 ||
+                       wl_validate_wpaie(dev, ies->wpa_ie, bssidx) < 0))) {
+                       bss->security_mode = false;
+                       return BCME_ERROR;
+               }
+
+               if (ies->fils_ind_ie &&
+                       (wl_validate_fils_ind_ie(dev, ies->fils_ind_ie, bssidx)  < 0)) {
+                       bss->security_mode = false;
+                       return BCME_ERROR;
+               }
+
+               bss->security_mode = true;
+               if (bss->rsn_ie) {
+                       MFREE(cfg->osh, bss->rsn_ie, bss->rsn_ie[1]
+                               + WPA_RSN_IE_TAG_FIXED_LEN);
+                       bss->rsn_ie = NULL;
+               }
+               if (bss->wpa_ie) {
+                       MFREE(cfg->osh, bss->wpa_ie, bss->wpa_ie[1]
+                               + WPA_RSN_IE_TAG_FIXED_LEN);
+                       bss->wpa_ie = NULL;
+               }
+               if (bss->wps_ie) {
+                       MFREE(cfg->osh, bss->wps_ie, bss->wps_ie[1] + 2);
+                       bss->wps_ie = NULL;
+               }
+               if (bss->fils_ind_ie) {
+                       MFREE(cfg->osh, bss->fils_ind_ie, bss->fils_ind_ie[1]
+                               + FILS_INDICATION_IE_TAG_FIXED_LEN);
+                       bss->fils_ind_ie = NULL;
+               }
+               if (ies->wpa_ie != NULL) {
+                       /* WPAIE */
+                       bss->rsn_ie = NULL;
+                       bss->wpa_ie = MALLOCZ(cfg->osh,
+                                       ies->wpa_ie->length
+                                       + WPA_RSN_IE_TAG_FIXED_LEN);
+                       if (bss->wpa_ie) {
+                               memcpy(bss->wpa_ie, ies->wpa_ie,
+                                       ies->wpa_ie->length
+                                       + WPA_RSN_IE_TAG_FIXED_LEN);
+                       }
+               } else if (ies->wpa2_ie != NULL) {
+                       /* RSNIE */
+                       bss->wpa_ie = NULL;
+                       bss->rsn_ie = MALLOCZ(cfg->osh,
+                                       ies->wpa2_ie->len
+                                       + WPA_RSN_IE_TAG_FIXED_LEN);
+                       if (bss->rsn_ie) {
+                               memcpy(bss->rsn_ie, ies->wpa2_ie,
+                                       ies->wpa2_ie->len
+                                       + WPA_RSN_IE_TAG_FIXED_LEN);
+                       }
+               }
+#ifdef WL_FILS
+               if (ies->fils_ind_ie) {
+                       bss->fils_ind_ie = MALLOCZ(cfg->osh,
+                                       ies->fils_ind_ie->len
+                                       + FILS_INDICATION_IE_TAG_FIXED_LEN);
+                       if (bss->fils_ind_ie) {
+                               memcpy(bss->fils_ind_ie, ies->fils_ind_ie,
+                                       ies->fils_ind_ie->len
+                                       + FILS_INDICATION_IE_TAG_FIXED_LEN);
+                       }
+               }
+#endif /* WL_FILS */
+#if defined(SUPPORT_SOFTAP_WPAWPA2_MIXED)
+               }
+#endif /* SUPPORT_SOFTAP_WPAWPA2_MIXED */
+               if (!ies->wpa2_ie && !ies->wpa_ie) {
+                       wl_validate_opensecurity(dev, bssidx, privacy);
+                       bss->security_mode = false;
+               }
+
+               if (ies->wps_ie) {
+                       bss->wps_ie = MALLOCZ(cfg->osh, ies->wps_ie_len);
+                       if (bss->wps_ie) {
+                               memcpy(bss->wps_ie, ies->wps_ie, ies->wps_ie_len);
+                       }
+               }
+       }
+
+       WL_INFORM_MEM(("[%s] wpa_auth:0x%x auth:0x%x wsec:0x%x mfp:0x%x\n",
+               dev->name, sec->fw_wpa_auth, sec->fw_auth, sec->fw_wsec, sec->fw_mfp));
+       return 0;
+
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || defined(WL_COMPAT_WIRELESS)
+static s32 wl_cfg80211_bcn_set_params(
+       struct cfg80211_ap_settings *info,
+       struct net_device *dev,
+       u32 dev_role, s32 bssidx)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       s32 err = BCME_OK;
+
+       WL_DBG(("interval (%d) \ndtim_period (%d) \n",
+               info->beacon_interval, info->dtim_period));
+
+       if (info->beacon_interval) {
+               if ((err = wldev_ioctl_set(dev, WLC_SET_BCNPRD,
+                       &info->beacon_interval, sizeof(s32))) < 0) {
+                       WL_ERR(("Beacon Interval Set Error, %d\n", err));
+                       return err;
+               }
+       }
+
+       if (info->dtim_period) {
+               if ((err = wldev_ioctl_set(dev, WLC_SET_DTIMPRD,
+                       &info->dtim_period, sizeof(s32))) < 0) {
+                       WL_ERR(("DTIM Interval Set Error, %d\n", err));
+                       return err;
+               }
+       }
+
+       if ((info->ssid) && (info->ssid_len > 0) &&
+               (info->ssid_len <= DOT11_MAX_SSID_LEN)) {
+               WL_DBG(("SSID (%s) len:%zd \n", info->ssid, info->ssid_len));
+               if (dev_role == NL80211_IFTYPE_AP) {
+                       /* Store the hostapd SSID */
+                       bzero(cfg->hostapd_ssid.SSID, DOT11_MAX_SSID_LEN);
+                       memcpy(cfg->hostapd_ssid.SSID, info->ssid, info->ssid_len);
+                       cfg->hostapd_ssid.SSID_len = (uint32)info->ssid_len;
+               } else {
+                               /* P2P GO */
+                       bzero(cfg->p2p->ssid.SSID, DOT11_MAX_SSID_LEN);
+                       memcpy(cfg->p2p->ssid.SSID, info->ssid, info->ssid_len);
+                       cfg->p2p->ssid.SSID_len = (uint32)info->ssid_len;
+               }
+       }
+
+       return err;
+}
+#endif /* LINUX_VERSION >= VERSION(3,4,0) || WL_COMPAT_WIRELESS */
+
+static s32
+wl_cfg80211_parse_ies(const u8 *ptr, u32 len, struct parsed_ies *ies)
+{
+       s32 err = BCME_OK;
+
+       bzero(ies, sizeof(struct parsed_ies));
+
+       /* find the WPSIE */
+       if ((ies->wps_ie = wl_cfgp2p_find_wpsie(ptr, len)) != NULL) {
+               WL_DBG(("WPSIE in beacon \n"));
+               ies->wps_ie_len = ies->wps_ie->length + WPA_RSN_IE_TAG_FIXED_LEN;
+       } else {
+               WL_ERR(("No WPSIE in beacon \n"));
+       }
+
+       /* find the RSN_IE */
+       if ((ies->wpa2_ie = bcm_parse_tlvs(ptr, len,
+               DOT11_MNG_RSN_ID)) != NULL) {
+               WL_DBG((" WPA2 IE found\n"));
+               ies->wpa2_ie_len = ies->wpa2_ie->len;
+       }
+
+       /* find the FILS_IND_IE */
+       if ((ies->fils_ind_ie = bcm_parse_tlvs(ptr, len,
+               DOT11_MNG_FILS_IND_ID)) != NULL) {
+               WL_DBG((" FILS IND IE found\n"));
+               ies->fils_ind_ie_len = ies->fils_ind_ie->len;
+       }
+
+       /* find the WPA_IE */
+       if ((ies->wpa_ie = wl_cfgp2p_find_wpaie(ptr, len)) != NULL) {
+               WL_DBG((" WPA found\n"));
+               ies->wpa_ie_len = ies->wpa_ie->length;
+       }
+
+       return err;
+
+}
+
+static s32
+wl_cfg80211_set_ap_role(
+       struct bcm_cfg80211 *cfg,
+       struct net_device *dev)
+{
+       s32 err = BCME_OK;
+       s32 infra = 1;
+       s32 ap = 0;
+       s32 pm;
+       s32 bssidx;
+       s32 apsta = 0;
+       bool legacy_chip;
+
+       legacy_chip = wl_legacy_chip_check(cfg);
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return -EINVAL;
+       }
+
+       WL_INFORM_MEM(("[%s] Bringup SoftAP on bssidx:%d \n", dev->name, bssidx));
+
+       if (bssidx != 0 || !legacy_chip) {
+               if ((err = wl_cfg80211_add_del_bss(cfg, dev, bssidx,
+                               WL_IF_TYPE_AP, 0, NULL)) < 0) {
+                       WL_ERR(("wl add_del_bss returned error:%d\n", err));
+                       return err;
+               }
+       }
+
+       /*
+        * For older chips, "bss" iovar does not support
+        * bsscfg role change/upgradation, and still
+        * return BCME_OK on attempt
+        * Hence, below traditional way to handle the same
+        */
+
+       if ((err = wldev_ioctl_get(dev,
+                       WLC_GET_AP, &ap, sizeof(s32))) < 0) {
+               WL_ERR(("Getting AP mode failed %d \n", err));
+               return err;
+       }
+
+       if (!ap) {
+               /* AP mode switch not supported. Try setting up AP explicitly */
+               err = wldev_iovar_getint(dev, "apsta", (s32 *)&apsta);
+               if (unlikely(err)) {
+                       WL_ERR(("Could not get apsta %d\n", err));
+                       return err;
+               }
+               if (apsta == 0) {
+                       /* If apsta is not set, set it */
+
+                       /* Check for any connected interfaces before wl down */
+                       if (wl_get_drv_status_all(cfg, CONNECTED) > 0) {
+                               WL_ERR(("Concurrent i/f operational. can't do wl down"));
+                               return BCME_ERROR;
+                       }
+                       err = wldev_ioctl_set(dev, WLC_DOWN, &ap, sizeof(s32));
+                       if (err < 0) {
+                               WL_ERR(("WLC_DOWN error %d\n", err));
+                               return err;
+                       }
+                       err = wldev_iovar_setint(dev, "apsta", 0);
+                       if (err < 0) {
+                               WL_ERR(("wl apsta 0 error %d\n", err));
+                               return err;
+                       }
+                       ap = 1;
+                       if ((err = wldev_ioctl_set(dev,
+                                       WLC_SET_AP, &ap, sizeof(s32))) < 0) {
+                               WL_ERR(("setting AP mode failed %d \n", err));
+                               return err;
+                       }
+               }
+       } else if (bssidx == 0 && legacy_chip) {
+               err = wldev_ioctl_set(dev, WLC_DOWN, &ap, sizeof(s32));
+               if (err < 0) {
+                       WL_ERR(("WLC_DOWN error %d\n", err));
+                       return err;
+               }
+               err = wldev_iovar_setint(dev, "apsta", 0);
+               if (err < 0) {
+                       WL_ERR(("wl apsta 0 error %d\n", err));
+                       return err;
+               }
+               ap = 1;
+               if ((err = wldev_ioctl_set(dev, WLC_SET_AP, &ap, sizeof(s32))) < 0) {
+                       WL_ERR(("setting AP mode failed %d \n", err));
+                       return err;
+               }
+       }
+
+       if (bssidx == 0) {
+               pm = 0;
+               if ((err = wldev_ioctl_set(dev, WLC_SET_PM, &pm, sizeof(pm))) != 0) {
+                       WL_ERR(("wl PM 0 returned error:%d\n", err));
+                       /* Ignore error, if any */
+                       err = BCME_OK;
+               }
+               err = wldev_ioctl_set(dev, WLC_SET_INFRA, &infra, sizeof(s32));
+               if (err < 0) {
+                       WL_ERR(("SET INFRA error %d\n", err));
+                       return err;
+               }
+       }
+
+       /* On success, mark AP creation in progress. */
+       wl_set_drv_status(cfg, AP_CREATING, dev);
+       return 0;
+}
+
+/* In RSDB downgrade cases, the link up event can get delayed upto 7-8 secs */
+#define MAX_AP_LINK_WAIT_TIME   10000
+static s32
+wl_cfg80211_bcn_bringup_ap(
+       struct net_device *dev,
+       struct parsed_ies *ies,
+       u32 dev_role, s32 bssidx)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       struct wl_join_params join_params;
+       bool is_bssup = false;
+       s32 infra = 1;
+       s32 join_params_size = 0;
+       s32 ap = 1;
+       s32 wsec;
+#ifdef DISABLE_11H_SOFTAP
+       s32 spect = 0;
+#endif /* DISABLE_11H_SOFTAP */
+#ifdef SOFTAP_UAPSD_OFF
+       uint32 wme_apsd = 0;
+#endif /* SOFTAP_UAPSD_OFF */
+       s32 err = BCME_OK;
+       s32 is_rsdb_supported = BCME_ERROR;
+       long timeout;
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       char sec[32];
+
+       is_rsdb_supported = DHD_OPMODE_SUPPORTED(cfg->pub, DHD_FLAG_RSDB_MODE);
+       if (is_rsdb_supported < 0)
+               return (-ENODEV);
+
+       WL_DBG(("Enter dev_role:%d bssidx:%d ifname:%s\n", dev_role, bssidx, dev->name));
+
+       /* Common code for SoftAP and P2P GO */
+       wl_clr_drv_status(cfg, AP_CREATED, dev);
+
+       /* Make sure INFRA is set for AP/GO */
+       err = wldev_ioctl_set(dev, WLC_SET_INFRA, &infra, sizeof(s32));
+       if (err < 0) {
+               WL_ERR(("SET INFRA error %d\n", err));
+               goto exit;
+       }
+
+       /* Do abort scan before creating GO */
+       wl_cfg80211_scan_abort(cfg);
+
+       if (dev_role == NL80211_IFTYPE_P2P_GO) {
+               wl_ext_get_sec(dev, 0, sec, sizeof(sec));
+               WL_MSG(dev->name, "Creating GO with sec=%s\n", sec);
+               is_bssup = wl_cfg80211_bss_isup(dev, bssidx);
+               if (!is_bssup && (ies->wpa2_ie != NULL)) {
+
+                       err = wldev_iovar_setbuf_bsscfg(dev, "ssid", &cfg->p2p->ssid,
+                               sizeof(cfg->p2p->ssid), cfg->ioctl_buf, WLC_IOCTL_MAXLEN,
+                               bssidx, &cfg->ioctl_buf_sync);
+                       if (err < 0) {
+                               WL_ERR(("GO SSID setting error %d\n", err));
+                               goto exit;
+                       }
+
+                       if ((err = wl_cfg80211_bss_up(cfg, dev, bssidx, 1)) < 0) {
+                               WL_ERR(("GO Bring up error %d\n", err));
+                               goto exit;
+                       }
+                       wl_clr_drv_status(cfg, AP_CREATING, dev);
+               } else
+                       WL_DBG(("Bss is already up\n"));
+       } else if (dev_role == NL80211_IFTYPE_AP) {
+
+//             if (!wl_get_drv_status(cfg, AP_CREATING, dev)) {
+                       /* Make sure fw is in proper state */
+                       err = wl_cfg80211_set_ap_role(cfg, dev);
+                       if (unlikely(err)) {
+                               WL_ERR(("set ap role failed!\n"));
+                               goto exit;
+                       }
+//             }
+
+               /* Device role SoftAP */
+               WL_DBG(("Creating AP bssidx:%d dev_role:%d\n", bssidx, dev_role));
+               /* Clear the status bit after use */
+               wl_clr_drv_status(cfg, AP_CREATING, dev);
+
+#ifdef DISABLE_11H_SOFTAP
+               /* Some old WLAN card (e.g. Intel PRO/Wireless 2200BG)
+                * does not try to connect SoftAP because they cannot detect
+                * 11h IEs. For this reason, we disable 11h feature in case
+                * of SoftAP mode. (Related CSP case number: 661635)
+                */
+               if (is_rsdb_supported == 0) {
+                       err = wldev_ioctl_set(dev, WLC_DOWN, &ap, sizeof(s32));
+                       if (err < 0) {
+                               WL_ERR(("WLC_DOWN error %d\n", err));
+                               goto exit;
+                       }
+               }
+               err = wldev_ioctl_set(dev, WLC_SET_SPECT_MANAGMENT,
+                       &spect, sizeof(s32));
+               if (err < 0) {
+                       WL_ERR(("SET SPECT_MANAGMENT error %d\n", err));
+                       goto exit;
+               }
+#endif /* DISABLE_11H_SOFTAP */
+
+#ifdef WL_DISABLE_HE_SOFTAP
+               err = wl_cfg80211_set_he_mode(dev, cfg, bssidx, WL_IF_TYPE_AP, FALSE);
+               if (err < 0) {
+                       WL_ERR(("failed to set he features, error=%d\n", err));
+               }
+#endif /* WL_DISABLE_HE_SOFTAP */
+
+#ifdef SOFTAP_UAPSD_OFF
+               err = wldev_iovar_setbuf_bsscfg(dev, "wme_apsd", &wme_apsd, sizeof(wme_apsd),
+                       cfg->ioctl_buf, WLC_IOCTL_SMLEN, bssidx, &cfg->ioctl_buf_sync);
+               if (err < 0) {
+                       WL_ERR(("failed to disable uapsd, error=%d\n", err));
+               }
+#endif /* SOFTAP_UAPSD_OFF */
+
+               err = wldev_ioctl_set(dev, WLC_UP, &ap, sizeof(s32));
+               if (unlikely(err)) {
+                       WL_ERR(("WLC_UP error (%d)\n", err));
+                       goto exit;
+               }
+
+#ifdef MFP
+               if (cfg->bip_pos) {
+                       err = wldev_iovar_setbuf_bsscfg(dev, "bip",
+                               (const void *)(cfg->bip_pos), WPA_SUITE_LEN, cfg->ioctl_buf,
+                               WLC_IOCTL_SMLEN, bssidx, &cfg->ioctl_buf_sync);
+                       if (err < 0) {
+                               WL_ERR(("bip set error %d\n", err));
+
+                               {
+                                       goto exit;
+                               }
+                       }
+               }
+#endif /* MFP */
+
+               err = wldev_iovar_getint(dev, "wsec", (s32 *)&wsec);
+               if (unlikely(err)) {
+                       WL_ERR(("Could not get wsec %d\n", err));
+                       goto exit;
+               }
+               if (dhdp->conf->chip == BCM43430_CHIP_ID && bssidx > 0 &&
+                               (wsec & (TKIP_ENABLED|AES_ENABLED))) {
+                       wsec |= WSEC_SWFLAG; // terence 20180628: fix me, this is a workaround
+                       err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+                       if (err < 0) {
+                               WL_ERR(("wsec error %d\n", err));
+                               goto exit;
+                       }
+               }
+               if ((wsec == WEP_ENABLED) && cfg->wep_key.len) {
+                       WL_DBG(("Applying buffered WEP KEY \n"));
+                       err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &cfg->wep_key,
+                               sizeof(struct wl_wsec_key), cfg->ioctl_buf,
+                               WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+                       /* clear the key after use */
+                       bzero(&cfg->wep_key, sizeof(struct wl_wsec_key));
+                       if (unlikely(err)) {
+                               WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+                               goto exit;
+                       }
+               }
+
+#ifdef MFP
+               if (cfg->mfp_mode) {
+                       /* This needs to go after wsec otherwise the wsec command will
+                        * overwrite the values set by MFP
+                        */
+                       err = wldev_iovar_setint_bsscfg(dev, "mfp", cfg->mfp_mode, bssidx);
+                       if (err < 0) {
+                               WL_ERR(("MFP Setting failed. ret = %d \n", err));
+                               /* If fw doesn't support mfp, Ignore the error */
+                               if (err != BCME_UNSUPPORTED) {
+                                       goto exit;
+                               }
+                       }
+               }
+#endif /* MFP */
+
+               bzero(&join_params, sizeof(join_params));
+               /* join parameters starts with ssid */
+               join_params_size = sizeof(join_params.ssid);
+               join_params.ssid.SSID_len = MIN(cfg->hostapd_ssid.SSID_len,
+                       (uint32)DOT11_MAX_SSID_LEN);
+               memcpy(join_params.ssid.SSID, cfg->hostapd_ssid.SSID,
+                       join_params.ssid.SSID_len);
+               join_params.ssid.SSID_len = htod32(join_params.ssid.SSID_len);
+
+               wl_ext_get_sec(dev, 0, sec, sizeof(sec));
+               WL_MSG(dev->name, "Creating AP with sec=%s\n", sec);
+               /* create softap */
+               if ((err = wldev_ioctl_set(dev, WLC_SET_SSID, &join_params,
+                       join_params_size)) != 0) {
+                       WL_ERR(("SoftAP/GO set ssid failed! \n"));
+                       goto exit;
+               } else {
+                       WL_DBG((" SoftAP SSID \"%s\" \n", join_params.ssid.SSID));
+               }
+
+               if (bssidx != 0) {
+                       /* AP on Virtual Interface */
+                       if ((err = wl_cfg80211_bss_up(cfg, dev, bssidx, 1)) < 0) {
+                               WL_ERR(("AP Bring up error %d\n", err));
+                               goto exit;
+                       }
+               }
+
+       } else {
+               WL_ERR(("Wrong interface type %d\n", dev_role));
+               goto exit;
+       }
+
+       /* Wait for Linkup event to mark successful AP/GO bring up */
+       timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+               wl_get_drv_status(cfg, AP_CREATED, dev), msecs_to_jiffies(MAX_AP_LINK_WAIT_TIME));
+       if (timeout <= 0 || !wl_get_drv_status(cfg, AP_CREATED, dev)) {
+               WL_ERR(("Link up didn't come for AP interface. AP/GO creation failed! \n"));
+               if (timeout == -ERESTARTSYS) {
+                       WL_ERR(("waitqueue was interrupted by a signal, returns -ERESTARTSYS\n"));
+                       err = -ERESTARTSYS;
+                       goto exit;
+               }
+               if (dhd_query_bus_erros(dhdp)) {
+                       err = -ENODEV;
+                       goto exit;
+               }
+#ifdef DHD_PCIE_RUNTIMEPM
+               dhdpcie_runtime_bus_wake(dhdp, CAN_SLEEP(), __builtin_return_address(0));
+#endif /* DHD_PCIE_RUNTIMEPM */
+               dhdp->iface_op_failed = TRUE;
+
+#if defined(DHD_DEBUG) && defined(DHD_FW_COREDUMP)
+               if (dhdp->memdump_enabled) {
+                       dhdp->memdump_type = DUMP_TYPE_AP_LINKUP_FAILURE;
+                       dhd_bus_mem_dump(dhdp);
+               }
+#endif /* DHD_DEBUG && DHD_FW_COREDUMP */
+
+               WL_ERR(("Notify hang event to upper layer \n"));
+               dhdp->hang_reason = HANG_REASON_IFACE_ADD_FAILURE;
+               net_os_send_hang_message(bcmcfg_to_prmry_ndev(cfg));
+
+               err = -ENODEV;
+               goto exit;
+       }
+       SUPP_LOG(("AP/GO Link up\n"));
+
+exit:
+       if (cfg->wep_key.len) {
+               bzero(&cfg->wep_key, sizeof(struct wl_wsec_key));
+       }
+
+#ifdef MFP
+       if (cfg->mfp_mode) {
+               cfg->mfp_mode = 0;
+       }
+
+       if (cfg->bip_pos) {
+               cfg->bip_pos = NULL;
+       }
+#endif /* MFP */
+
+       if (err) {
+               SUPP_LOG(("AP/GO bring up fail. err:%d\n", err));
+       }
+       return err;
+}
+
+bool
+wl_cfg80211_macaddr_sync_reqd(struct net_device *dev)
+{
+       struct wireless_dev *wdev = dev->ieee80211_ptr;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       WL_DBG(("enter \n"));
+       if (!wdev) {
+               WL_ERR(("no wdev present\n"));
+               return false;
+       }
+
+       BCM_REFERENCE(cfg);
+
+#if defined(WL_STATIC_IF)
+       /* In soft case too role upgrade happens
+        * from STA to AP in some cases.These
+        * cases will have iftype as STATION.
+        */
+       if (IS_CFG80211_STATIC_IF(cfg, dev)) {
+               WL_INFORM_MEM(("STATIC interface\n"));
+               return true;
+       }
+#endif /* WL_STATIC_IF && WL_SOFTAP_RAND */
+
+       switch (wdev->iftype) {
+#ifdef WL_P2P_RAND
+               case NL80211_IFTYPE_P2P_GO:
+               case NL80211_IFTYPE_P2P_CLIENT:
+                       WL_INFORM_MEM(("P2P GO/GC interface\n"));
+                       return true;
+#endif /* WL_P2P_RAND */
+#if defined(WL_STA_ASSOC_RAND)
+               case NL80211_IFTYPE_STATION:
+                       WL_INFORM_MEM(("STA interface\n"));
+                       return true;
+#endif /* WL_STA_ASSOC_RAND */
+#ifdef WL_SOFTAP_RAND
+               case NL80211_IFTYPE_AP:
+                       WL_INFORM_MEM(("SOFTAP interface\n"));
+                       return true;
+#endif /* WL_SOFTAP_RAND */
+               default:
+                       WL_ERR(("no macthing if type\n"));
+       }
+       return false;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || defined(WL_COMPAT_WIRELESS)
+s32
+wl_cfg80211_parse_ap_ies(
+       struct net_device *dev,
+       struct cfg80211_beacon_data *info,
+       struct parsed_ies *ies)
+{
+       struct parsed_ies prb_ies;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       const u8 *vndr = NULL;
+       u32 vndr_ie_len = 0;
+       s32 err = BCME_OK;
+
+       /* Parse Beacon IEs */
+       if (wl_cfg80211_parse_ies((const u8 *)info->tail,
+               info->tail_len, ies) < 0) {
+               WL_ERR(("Beacon get IEs failed \n"));
+               err = -EINVAL;
+               goto fail;
+       }
+
+       if ((err = wl_cfg80211_config_rsnxe_ie(cfg, dev,
+               (const u8 *)info->tail, info->tail_len)) < 0) {
+               WL_ERR(("Failed to configure rsnxe ie: %d\n", err));
+               err = -EINVAL;
+               goto fail;
+       }
+
+       vndr = (const u8 *)info->proberesp_ies;
+       vndr_ie_len = (uint32)info->proberesp_ies_len;
+
+       if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+               /* SoftAP mode */
+               const struct ieee80211_mgmt *mgmt;
+               mgmt = (const struct ieee80211_mgmt *)info->probe_resp;
+               if (mgmt != NULL) {
+                       vndr = (const u8 *)&mgmt->u.probe_resp.variable;
+                       vndr_ie_len = (uint32)(info->probe_resp_len -
+                               offsetof(const struct ieee80211_mgmt, u.probe_resp.variable));
+               }
+       }
+       /* Parse Probe Response IEs */
+       if (wl_cfg80211_parse_ies((const u8 *)vndr, vndr_ie_len, &prb_ies) < 0) {
+               WL_ERR(("PROBE RESP get IEs failed \n"));
+               err = -EINVAL;
+       }
+fail:
+
+       return err;
+}
+
+s32
+wl_cfg80211_set_ies(
+       struct net_device *dev,
+       struct cfg80211_beacon_data *info,
+       s32 bssidx)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       const u8 *vndr = NULL;
+       u32 vndr_ie_len = 0;
+       s32 err = BCME_OK;
+
+       /* Set Beacon IEs to FW */
+       if ((err = wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(dev), bssidx,
+               VNDR_IE_BEACON_FLAG, (const u8 *)info->tail,
+               info->tail_len)) < 0) {
+               WL_ERR(("Set Beacon IE Failed \n"));
+       } else {
+               WL_DBG(("Applied Vndr IEs for Beacon \n"));
+       }
+
+       vndr = (const u8 *)info->proberesp_ies;
+       vndr_ie_len = (uint32)info->proberesp_ies_len;
+
+       if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+               /* SoftAP mode */
+               const struct ieee80211_mgmt *mgmt;
+               mgmt = (const struct ieee80211_mgmt *)info->probe_resp;
+               if (mgmt != NULL) {
+                       vndr = (const u8 *)&mgmt->u.probe_resp.variable;
+                       vndr_ie_len = (uint32)(info->probe_resp_len -
+                               offsetof(struct ieee80211_mgmt, u.probe_resp.variable));
+               }
+       }
+
+       /* Set Probe Response IEs to FW */
+       if ((err = wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(dev), bssidx,
+               VNDR_IE_PRBRSP_FLAG, vndr, vndr_ie_len)) < 0) {
+               WL_ERR(("Set Probe Resp IE Failed \n"));
+       } else {
+               WL_DBG(("Applied Vndr IEs for Probe Resp \n"));
+       }
+
+       return err;
+}
+#endif /* LINUX_VERSION >= VERSION(3,4,0) || WL_COMPAT_WIRELESS */
+
+static s32 wl_cfg80211_hostapd_sec(
+       struct net_device *dev,
+       struct parsed_ies *ies,
+       s32 bssidx)
+{
+       bool update_bss = 0;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       wl_cfgbss_t *bss = wl_get_cfgbss_by_wdev(cfg, dev->ieee80211_ptr);
+
+       if (!bss) {
+               WL_ERR(("cfgbss is NULL \n"));
+               return -EINVAL;
+       }
+
+       if (ies->wps_ie) {
+               /* Remove after verification.
+                * Setting IE part moved to set_ies func
+                */
+               if (bss->wps_ie &&
+                       memcmp(bss->wps_ie, ies->wps_ie, ies->wps_ie_len)) {
+                       WL_DBG((" WPS IE is changed\n"));
+                       MFREE(cfg->osh, bss->wps_ie, bss->wps_ie[1] + 2);
+                       bss->wps_ie = MALLOCZ(cfg->osh, ies->wps_ie_len);
+                       if (bss->wps_ie) {
+                               memcpy(bss->wps_ie, ies->wps_ie, ies->wps_ie_len);
+                       }
+               } else if (bss->wps_ie == NULL) {
+                       WL_DBG((" WPS IE is added\n"));
+                       bss->wps_ie = MALLOCZ(cfg->osh, ies->wps_ie_len);
+                       if (bss->wps_ie) {
+                               memcpy(bss->wps_ie, ies->wps_ie, ies->wps_ie_len);
+                       }
+               }
+
+#if defined(SUPPORT_SOFTAP_WPAWPA2_MIXED)
+               if (ies->wpa_ie != NULL && ies->wpa2_ie != NULL) {
+                       WL_ERR(("update bss - wpa_ie and  wpa2_ie is not null\n"));
+                       if (!bss->security_mode) {
+                               /* change from open mode to security mode */
+                               update_bss = true;
+                               bss->wpa_ie = MALLOCZ(cfg->osh,
+                                       ies->wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN);
+                               if (bss->wpa_ie) {
+                                       memcpy(bss->wpa_ie, ies->wpa_ie,
+                                               ies->wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN);
+                               }
+                               bss->rsn_ie = MALLOCZ(cfg->osh,
+                                               ies->wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN);
+                               if (bss->rsn_ie) {
+                                       memcpy(bss->rsn_ie, ies->wpa2_ie,
+                                               ies->wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN);
+                               }
+                       } else {
+                               /* change from (WPA or WPA2 or WPA/WPA2) to WPA/WPA2 mixed mode */
+                               if (bss->wpa_ie) {
+                                       if (memcmp(bss->wpa_ie,
+                                       ies->wpa_ie, ies->wpa_ie->length +
+                                       WPA_RSN_IE_TAG_FIXED_LEN)) {
+                                               MFREE(cfg->osh, bss->wpa_ie,
+                                                       bss->wpa_ie[1] + WPA_RSN_IE_TAG_FIXED_LEN);
+                                               update_bss = true;
+                                               bss->wpa_ie = MALLOCZ(cfg->osh,
+                                                       ies->wpa_ie->length
+                                                       + WPA_RSN_IE_TAG_FIXED_LEN);
+                                               if (bss->wpa_ie) {
+                                                       memcpy(bss->wpa_ie, ies->wpa_ie,
+                                                               ies->wpa_ie->length
+                                                               + WPA_RSN_IE_TAG_FIXED_LEN);
+                                               }
+                                       }
+                               }
+                               else {
+                                       update_bss = true;
+                                       bss->wpa_ie = MALLOCZ(cfg->osh,
+                                               ies->wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN);
+                                       if (bss->wpa_ie) {
+                                               memcpy(bss->wpa_ie, ies->wpa_ie,
+                                                       ies->wpa_ie->length
+                                                       + WPA_RSN_IE_TAG_FIXED_LEN);
+                                       }
+                               }
+                               if (bss->rsn_ie) {
+                                       if (memcmp(bss->rsn_ie,
+                                       ies->wpa2_ie,
+                                       ies->wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN)) {
+                                               update_bss = true;
+                                               MFREE(cfg->osh, bss->rsn_ie,
+                                                       bss->rsn_ie[1] + WPA_RSN_IE_TAG_FIXED_LEN);
+                                               bss->rsn_ie = MALLOCZ(cfg->osh,
+                                                       ies->wpa2_ie->len
+                                                       + WPA_RSN_IE_TAG_FIXED_LEN);
+                                               if (bss->rsn_ie) {
+                                                       memcpy(bss->rsn_ie, ies->wpa2_ie,
+                                                               ies->wpa2_ie->len
+                                                               + WPA_RSN_IE_TAG_FIXED_LEN);
+                                               }
+                                       }
+                               }
+                               else {
+                                       update_bss = true;
+                                       bss->rsn_ie = MALLOCZ(cfg->osh,
+                                               ies->wpa2_ie->len
+                                               + WPA_RSN_IE_TAG_FIXED_LEN);
+                                       if (bss->rsn_ie) {
+                                               memcpy(bss->rsn_ie, ies->wpa2_ie,
+                                                       ies->wpa2_ie->len
+                                                       + WPA_RSN_IE_TAG_FIXED_LEN);
+                                       }
+                               }
+                       }
+                       WL_ERR(("update_bss=%d\n", update_bss));
+                       if (update_bss) {
+                               bss->security_mode = true;
+                               wl_cfg80211_bss_up(cfg, dev, bssidx, 0);
+                               if (wl_validate_wpaie_wpa2ie(dev, ies->wpa_ie,
+                                       ies->wpa2_ie, bssidx)  < 0) {
+                                       return BCME_ERROR;
+                               }
+                               wl_cfg80211_bss_up(cfg, dev, bssidx, 1);
+                       }
+
+               }
+               else
+#endif /* SUPPORT_SOFTAP_WPAWPA2_MIXED */
+               if ((ies->wpa_ie != NULL || ies->wpa2_ie != NULL)) {
+                       if (!bss->security_mode) {
+                               /* change from open mode to security mode */
+                               update_bss = true;
+                               if (ies->wpa_ie != NULL) {
+                                       bss->wpa_ie = MALLOCZ(cfg->osh,
+                                               ies->wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN);
+                                       if (bss->wpa_ie) {
+                                               memcpy(bss->wpa_ie,
+                                                       ies->wpa_ie,
+                                                       ies->wpa_ie->length
+                                                       + WPA_RSN_IE_TAG_FIXED_LEN);
+                                       }
+                               } else {
+                                       bss->rsn_ie = MALLOCZ(cfg->osh,
+                                               ies->wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN);
+                                       if (bss->rsn_ie) {
+                                               memcpy(bss->rsn_ie,
+                                                       ies->wpa2_ie,
+                                                       ies->wpa2_ie->len
+                                                       + WPA_RSN_IE_TAG_FIXED_LEN);
+                                       }
+                               }
+                       } else if (bss->wpa_ie) {
+                               /* change from WPA2 mode to WPA mode */
+                               if (ies->wpa_ie != NULL) {
+                                       update_bss = true;
+                                       MFREE(cfg->osh, bss->rsn_ie,
+                                               bss->rsn_ie[1] + WPA_RSN_IE_TAG_FIXED_LEN);
+                                       bss->rsn_ie = NULL;
+                                       bss->wpa_ie = MALLOCZ(cfg->osh,
+                                               ies->wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN);
+                                       if (bss->wpa_ie) {
+                                               memcpy(bss->wpa_ie,
+                                                       ies->wpa_ie,
+                                                       ies->wpa_ie->length
+                                                       + WPA_RSN_IE_TAG_FIXED_LEN);
+                                       }
+                               } else if (memcmp(bss->rsn_ie,
+                                       ies->wpa2_ie, ies->wpa2_ie->len
+                                       + WPA_RSN_IE_TAG_FIXED_LEN)) {
+                                       update_bss = true;
+                                       MFREE(cfg->osh, bss->rsn_ie,
+                                               bss->rsn_ie[1] + WPA_RSN_IE_TAG_FIXED_LEN);
+                                       bss->rsn_ie = MALLOCZ(cfg->osh,
+                                               ies->wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN);
+                                       if (bss->rsn_ie) {
+                                               memcpy(bss->rsn_ie,
+                                                       ies->wpa2_ie,
+                                                       ies->wpa2_ie->len
+                                                       + WPA_RSN_IE_TAG_FIXED_LEN);
+                                       }
+                                       bss->wpa_ie = NULL;
+                               }
+                       }
+                       if (update_bss) {
+                               bss->security_mode = true;
+                               wl_cfg80211_bss_up(cfg, dev, bssidx, 0);
+                               if (wl_validate_wpa2ie(dev, ies->wpa2_ie, bssidx)  < 0 ||
+                                       wl_validate_wpaie(dev, ies->wpa_ie, bssidx) < 0) {
+                                       return BCME_ERROR;
+                               }
+                               wl_cfg80211_bss_up(cfg, dev, bssidx, 1);
+                       }
+               }
+       } else {
+               WL_ERR(("No WPSIE in beacon \n"));
+       }
+       return 0;
+}
+
+#if defined(WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, \
+       2, 0))
+static s32
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0))
+wl_cfg80211_del_station(
+               struct wiphy *wiphy, struct net_device *ndev,
+               struct station_del_parameters *params)
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+wl_cfg80211_del_station(
+       struct wiphy *wiphy,
+       struct net_device *ndev,
+       const u8* mac_addr)
+#else
+wl_cfg80211_del_station(
+       struct wiphy *wiphy,
+       struct net_device *ndev,
+       u8* mac_addr)
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) */
+{
+       struct net_device *dev;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       scb_val_t scb_val;
+       s8 eabuf[ETHER_ADDR_STR_LEN];
+       int err;
+       char mac_buf[MAX_NUM_OF_ASSOCIATED_DEV *
+               sizeof(struct ether_addr) + sizeof(uint)] = {0};
+       struct maclist *assoc_maclist = (struct maclist *)mac_buf;
+       int num_associated = 0;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0))
+       const u8 *mac_addr = params->mac;
+#ifdef CUSTOM_BLOCK_DEAUTH_AT_EAP_FAILURE
+       u16 rc = params->reason_code;
+#endif /* CUSTOM_BLOCK_DEAUTH_AT_EAP_FAILURE */
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) */
+
+       WL_DBG(("Entry\n"));
+       if (mac_addr == NULL) {
+               WL_DBG(("mac_addr is NULL ignore it\n"));
+               return 0;
+       }
+
+       dev = ndev_to_wlc_ndev(ndev, cfg);
+
+       if (p2p_is_on(cfg)) {
+               /* Suspend P2P discovery search-listen to prevent it from changing the
+                * channel.
+                */
+               if ((wl_cfgp2p_discover_enable_search(cfg, false)) < 0) {
+                       WL_ERR(("Can not disable discovery mode\n"));
+                       return -EFAULT;
+               }
+       }
+       err = wl_cfg80211_check_in4way(cfg, ndev, DONT_DELETE_GC_AFTER_WPS,
+               WL_EXT_STATUS_DELETE_STA, (void *)mac_addr);
+       if (err) {
+               return 0;
+       }
+
+       assoc_maclist->count = MAX_NUM_OF_ASSOCIATED_DEV;
+       err = wldev_ioctl_get(ndev, WLC_GET_ASSOCLIST,
+               assoc_maclist, sizeof(mac_buf));
+       if (err < 0)
+               WL_ERR(("WLC_GET_ASSOCLIST error %d\n", err));
+       else
+               num_associated = assoc_maclist->count;
+
+       memcpy(scb_val.ea.octet, mac_addr, ETHER_ADDR_LEN);
+#ifdef CUSTOM_BLOCK_DEAUTH_AT_EAP_FAILURE
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0))
+       if (rc == DOT11_RC_8021X_AUTH_FAIL) {
+               WL_ERR(("deauth will be sent at F/W\n"));
+               scb_val.val = DOT11_RC_8021X_AUTH_FAIL;
+       } else {
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) */
+#endif /* CUSTOM_BLOCK_DEAUTH_AT_EAP_FAILURE */
+
+#ifdef WL_WPS_SYNC
+               if (wl_wps_session_update(ndev,
+                       WPS_STATE_DISCONNECT_CLIENT, mac_addr) == BCME_UNSUPPORTED) {
+                       /* Ignore disconnect command from upper layer */
+                       WL_INFORM_MEM(("[WPS] Ignore client disconnect.\n"));
+               } else
+#endif /* WL_WPS_SYNC */
+               {
+                       scb_val.val = DOT11_RC_DEAUTH_LEAVING;
+                       WL_MSG(dev->name, "Disconnect STA : " MACDBG " scb_val.val %d\n",
+                               MAC2STRDBG(bcm_ether_ntoa((const struct ether_addr *)mac_addr,
+                               eabuf)), scb_val.val);
+                       /* need to guarantee EAP-Failure send out before deauth */
+                       dhd_wait_pend8021x(dev);
+                       err = wldev_ioctl_set(dev, WLC_SCB_DEAUTHENTICATE_FOR_REASON, &scb_val,
+                               sizeof(scb_val_t));
+                       if (err < 0) {
+                               WL_ERR(("WLC_SCB_DEAUTHENTICATE_FOR_REASON err %d\n", err));
+                       }
+               }
+#ifdef CUSTOM_BLOCK_DEAUTH_AT_EAP_FAILURE
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0))
+       }
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) */
+#endif /* CUSTOM_BLOCK_DEAUTH_AT_EAP_FAILURE */
+
+       /* WAR Wait for the deauth event to come, supplicant will do the
+        * delete iface immediately and we will have problem in sending
+        * deauth frame if we delete the bss in firmware
+        * But we do not need additional delays for this WAR
+        * during P2P connection.
+        *
+        * Supplicant call this function with BCAST after doing
+        * wl_cfg80211_del_station() all GC stations with each addr.
+        * So, 400 ms delay can be called only once when GO disconnect all GC
+       */
+       if (num_associated > 0 && ETHER_ISBCAST(mac_addr))
+               wl_delay(400);
+
+       return 0;
+}
+
+/* Implementation for post SCB authorize */
+static void
+wl_cfg80211_post_scb_auth(struct bcm_cfg80211 *cfg, struct net_device *dev)
+{
+#ifdef WBTEXT
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+#endif /* WBTEXT */
+
+       LOG_TS(cfg, authorize_cmplt);
+       CLR_TS(cfg, authorize_start);
+       wl_set_drv_status(cfg, AUTHORIZED, dev);
+#ifdef DHD_LOSSLESS_ROAMING
+       wl_del_roam_timeout(cfg);
+#endif
+#ifdef WBTEXT
+       /* send nbr request or BTM query to update RCC
+        * after 4-way handshake is completed
+        */
+       if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION &&
+               dhdp->wbtext_support) {
+               wl_cfg80211_wbtext_update_rcc(cfg, dev);
+       }
+#endif /* WBTEXT */
+}
+
+/* Currently adding support only for authorize/de-authorize flag
+ * Need to be extended in future
+ */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+static s32
+wl_cfg80211_change_station(
+       struct wiphy *wiphy,
+       struct net_device *dev,
+       const u8 *mac,
+       struct station_parameters *params)
+#else
+static s32
+wl_cfg80211_change_station(
+       struct wiphy *wiphy,
+       struct net_device *dev,
+       u8 *mac,
+       struct station_parameters *params)
+#endif
+{
+       int err = BCME_OK;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+#ifdef BCMSUP_4WAY_HANDSHAKE
+       struct wl_security *sec;
+#endif /* BCMSUP_4WAY_HANDSHAKE */
+       struct net_device *ndev = ndev_to_wlc_ndev(dev, cfg);
+
+       WL_DBG(("SCB_AUTHORIZE mac_addr:"MACDBG" sta_flags_mask:0x%x "
+                               "sta_flags_set:0x%x iface:%s \n", MAC2STRDBG(mac),
+                               params->sta_flags_mask, params->sta_flags_set, ndev->name));
+
+       if ((wl_get_mode_by_netdev(cfg, dev) == WL_MODE_BSS) &&
+               !(wl_get_drv_status(cfg, CONNECTED, dev))) {
+               /* Return error indicating not in connected state */
+               WL_ERR(("Ignore SCB_AUTHORIZE/DEAUTHORIZE in non connected state\n"));
+               return -ENOTSUPP;
+       }
+
+       /* Processing only authorize/de-authorize flag for now */
+       if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED))) {
+               WL_ERR(("WLC_SCB_AUTHORIZE sta_flags_mask not set \n"));
+               return -ENOTSUPP;
+       }
+
+       if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))) {
+               err = wldev_ioctl_set(ndev, WLC_SCB_DEAUTHORIZE, mac, ETH_ALEN);
+               if (unlikely(err)) {
+                       WL_ERR(("WLC_SCB_DEAUTHORIZE error (%d)\n", err));
+               } else {
+                       WL_INFORM_MEM(("[%s] WLC_SCB_DEAUTHORIZE " MACDBG "\n",
+                               ndev->name, MAC2STRDBG(mac)));
+               }
+               wl_clr_drv_status(cfg, AUTHORIZED, dev);
+               CLR_TS(cfg, authorize_start);
+               CLR_TS(cfg, conn_start);
+               return err;
+       }
+       /* In case of 4way HS offloaded to FW and key_mgmt being 8021x, even the SCB
+       * authorization is also offloaded to FW. So on reception of SCB authorize in the above
+       * cases we avoid explicit call to ioctl WLC_SCB_AUTHORIZE. The post SCB authorize
+       * actions are done from context of WLC_E_PSK_SUP event handler
+       */
+#ifdef BCMSUP_4WAY_HANDSHAKE
+       sec = wl_read_prof(cfg, ndev, WL_PROF_SEC);
+       if (
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0))
+               (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) &&
+#else
+               (cfg->wdev->wiphy->features & NL80211_FEATURE_FW_4WAY_HANDSHAKE) &&
+#endif
+               ((sec->wpa_auth == WLAN_AKM_SUITE_8021X) ||
+               (sec->wpa_auth == WL_AKM_SUITE_SHA256_1X))) {
+               return BCME_OK;
+       }
+#endif /* BCMSUP_4WAY_HANDSHAKE */
+       err = wldev_ioctl_set(ndev, WLC_SCB_AUTHORIZE, mac, ETH_ALEN);
+       if (unlikely(err)) {
+               WL_ERR(("WLC_SCB_AUTHORIZE error (%d)\n", err));
+       } else {
+               WL_INFORM_MEM(("[%s] WLC_SCB_AUTHORIZE " MACDBG "\n",
+                       ndev->name, MAC2STRDBG(mac)));
+#ifdef WL_WPS_SYNC
+               wl_wps_session_update(ndev, WPS_STATE_AUTHORIZE, mac);
+#endif /* WL_WPS_SYNC */
+       }
+
+       /* Post SCB authorize actions */
+       wl_cfg80211_post_scb_auth(cfg, ndev);
+
+       return err;
+}
+#endif /* WL_SUPPORT_BACKPORTED_KPATCHES || KERNEL_VER >= KERNEL_VERSION(3, 2, 0)) */
+
+static s32
+wl_cfg80211_set_scb_timings(
+       struct bcm_cfg80211 *cfg,
+       struct net_device *dev)
+{
+       int err;
+       u32 ps_pretend;
+       wl_scb_probe_t scb_probe;
+       u32 ps_pretend_retries;
+
+       bzero(&scb_probe, sizeof(wl_scb_probe_t));
+       scb_probe.scb_timeout = WL_SCB_TIMEOUT;
+       scb_probe.scb_activity_time = WL_SCB_ACTIVITY_TIME;
+       scb_probe.scb_max_probe = WL_SCB_MAX_PROBE;
+       err = wldev_iovar_setbuf(dev, "scb_probe", (void *)&scb_probe,
+               sizeof(wl_scb_probe_t), cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+               &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("set 'scb_probe' failed, error = %d\n", err));
+               return err;
+       }
+
+       ps_pretend_retries = WL_PSPRETEND_RETRY_LIMIT;
+       err = wldev_iovar_setint(dev, "pspretend_retry_limit", ps_pretend_retries);
+       if (unlikely(err)) {
+               if (err == BCME_UNSUPPORTED) {
+                       /* Ignore error if fw doesn't support the iovar */
+                       WL_DBG(("set 'pspretend_retry_limit %d' failed, error = %d\n",
+                               ps_pretend_retries, err));
+               } else {
+                       WL_ERR(("set 'pspretend_retry_limit %d' failed, error = %d\n",
+                               ps_pretend_retries, err));
+                       return err;
+               }
+       }
+
+       ps_pretend = MAX(WL_SCB_MAX_PROBE / 2, WL_MIN_PSPRETEND_THRESHOLD);
+       err = wldev_iovar_setint(dev, "pspretend_threshold", ps_pretend);
+       if (unlikely(err)) {
+               if (err == BCME_UNSUPPORTED) {
+                       /* Ignore error if fw doesn't support the iovar */
+                       WL_DBG(("wl pspretend_threshold %d set error %d\n",
+                               ps_pretend, err));
+               } else {
+                       WL_ERR(("wl pspretend_threshold %d set error %d\n",
+                               ps_pretend, err));
+                       return err;
+               }
+       }
+
+       return 0;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || defined(WL_COMPAT_WIRELESS)
+static s32
+wl_cfg80211_start_ap(
+       struct wiphy *wiphy,
+       struct net_device *dev,
+       struct cfg80211_ap_settings *info)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 err = BCME_OK;
+       struct parsed_ies ies;
+       s32 bssidx = 0;
+       u32 dev_role = 0;
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+       WL_DBG(("Enter \n"));
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if (p2p_is_on(cfg) && (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO)) {
+               dev_role = NL80211_IFTYPE_P2P_GO;
+       } else if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP) {
+
+               if (!wl_get_drv_status(cfg, AP_CREATING, dev)) {
+                       /* Make sure fw is in proper state */
+                       err = wl_cfg80211_set_ap_role(cfg, dev);
+                       if (unlikely(err)) {
+                               WL_ERR(("set ap role failed!\n"));
+                               return BCME_ERROR;
+                       }
+               }
+               dev_role = NL80211_IFTYPE_AP;
+               dhd->op_mode |= DHD_FLAG_HOSTAP_MODE;
+               err = dhd_ndo_enable(dhd, FALSE);
+               WL_DBG(("Disabling NDO on Hostapd mode %d\n", err));
+               if (err) {
+                       WL_ERR(("Disabling NDO Failed %d\n", err));
+               }
+#ifdef WL_EXT_IAPSTA
+               wl_ext_iapsta_update_iftype(dev, dhd_net2idx(dhd->info, dev), WL_IF_TYPE_AP);
+#endif /* WL_EXT_IAPSTA */
+#ifdef PKT_FILTER_SUPPORT
+               /* Disable packet filter */
+               if (dhd->early_suspended) {
+                       WL_ERR(("Disable pkt_filter\n"));
+                       dhd_enable_packet_filter(0, dhd);
+#ifdef APF
+                       dhd_dev_apf_disable_filter(dhd_linux_get_primary_netdev(dhd));
+#endif /* APF */
+               }
+#endif /* PKT_FILTER_SUPPORT */
+       } else {
+               /* only AP or GO role need to be handled here. */
+               err = -EINVAL;
+               goto fail;
+       }
+
+       /* disable TDLS */
+#ifdef WLTDLS
+       if (bssidx == 0) {
+               /* Disable TDLS for primary Iface. For virtual interface,
+                * tdls disable will happen from interface create context
+                */
+               wl_cfg80211_tdls_config(cfg, TDLS_STATE_AP_CREATE, false);
+       }
+#endif /*  WLTDLS */
+
+       if (!check_dev_role_integrity(cfg, dev_role)) {
+               err = -EINVAL;
+               goto fail;
+       }
+
+/*
+ * TODO:
+ * Check whether 802.11ac-160MHz bandwidth channel setting has to use the
+ *      center frequencies present in 'preset_chandef' instead of using the
+ *      hardcoded values in 'wl_cfg80211_set_channel()'.
+ */
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)) && !defined(WL_COMPAT_WIRELESS))
+       if ((err = wl_cfg80211_set_channel(wiphy, dev,
+               dev->ieee80211_ptr->preset_chandef.chan,
+               NL80211_CHAN_HT20) < 0)) {
+               WL_ERR(("Set channel failed \n"));
+               goto fail;
+       }
+#endif /* ((LINUX_VERSION >= VERSION(3, 6, 0) && !WL_COMPAT_WIRELESS) */
+
+       if ((err = wl_cfg80211_bcn_set_params(info, dev,
+               dev_role, bssidx)) < 0) {
+               WL_ERR(("Beacon params set failed \n"));
+               goto fail;
+       }
+
+       /* Parse IEs */
+       if ((err = wl_cfg80211_parse_ap_ies(dev, &info->beacon, &ies)) < 0) {
+               WL_ERR(("Set IEs failed \n"));
+               goto fail;
+       }
+
+       if ((err = wl_cfg80211_bcn_validate_sec(dev, &ies,
+               dev_role, bssidx, info->privacy)) < 0)
+       {
+               WL_ERR(("Beacon set security failed \n"));
+               goto fail;
+       }
+
+       if ((err = wl_cfg80211_bcn_bringup_ap(dev, &ies,
+               dev_role, bssidx)) < 0) {
+               WL_ERR(("Beacon bring up AP/GO failed \n"));
+               goto fail;
+       }
+
+       /* Set GC/STA SCB expiry timings. */
+       if ((err = wl_cfg80211_set_scb_timings(cfg, dev))) {
+               WL_ERR(("scb setting failed \n"));
+//             goto fail;
+       }
+
+       wl_set_drv_status(cfg, CONNECTED, dev);
+       WL_DBG(("** AP/GO Created **\n"));
+
+#ifdef WL_CFG80211_ACL
+       /* Enfoce Admission Control. */
+       if ((err = wl_cfg80211_set_mac_acl(wiphy, dev, info->acl)) < 0) {
+               WL_ERR(("Set ACL failed\n"));
+       }
+#endif /* WL_CFG80211_ACL */
+
+       /* Set IEs to FW */
+       if ((err = wl_cfg80211_set_ies(dev, &info->beacon, bssidx)) < 0)
+               WL_ERR(("Set IEs failed \n"));
+       
+#ifdef WLDWDS
+       if (dev->ieee80211_ptr->use_4addr) {
+               if ((err = wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(dev), bssidx,
+                               VNDR_IE_ASSOCRSP_FLAG, (const u8 *)info->beacon.assocresp_ies,
+                               info->beacon.assocresp_ies_len)) < 0) {
+                       WL_ERR(("Set ASSOC RESP IE Failed\n"));
+               }
+       }
+#endif /* WLDWDS */
+
+       /* Enable Probe Req filter, WPS-AP certification 4.2.13 */
+       if ((dev_role == NL80211_IFTYPE_AP) && (ies.wps_ie != NULL)) {
+               bool pbc = 0;
+               wl_validate_wps_ie((const char *) ies.wps_ie, ies.wps_ie_len, &pbc);
+               if (pbc) {
+                       WL_DBG(("set WLC_E_PROBREQ_MSG\n"));
+                       wl_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, true);
+               }
+       }
+
+       /* Configure hidden SSID */
+       if (info->hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE) {
+               if ((err = wldev_iovar_setint(dev, "closednet", 1)) < 0)
+                       WL_ERR(("failed to set hidden : %d\n", err));
+               WL_DBG(("hidden_ssid_enum_val: %d \n", info->hidden_ssid));
+       }
+
+#ifdef SUPPORT_AP_RADIO_PWRSAVE
+       if (dev_role == NL80211_IFTYPE_AP) {
+               if (!wl_set_ap_rps(dev, FALSE, dev->name)) {
+                       wl_cfg80211_init_ap_rps(cfg);
+               } else {
+                       WL_ERR(("Set rpsnoa failed \n"));
+               }
+       }
+#endif /* SUPPORT_AP_RADIO_PWRSAVE */
+fail:
+       if (err) {
+               WL_ERR(("ADD/SET beacon failed\n"));
+               wl_flush_fw_log_buffer(dev, FW_LOGSET_MASK_ALL);
+               wl_cfg80211_stop_ap(wiphy, dev);
+               if (dev_role == NL80211_IFTYPE_AP) {
+#ifdef WL_EXT_IAPSTA
+               if (!wl_ext_iapsta_iftype_enabled(dev, WL_IF_TYPE_AP)) {
+#endif /* WL_EXT_IAPSTA */
+                       dhd->op_mode &= ~DHD_FLAG_HOSTAP_MODE;
+#ifdef PKT_FILTER_SUPPORT
+                       /* Enable packet filter */
+                       if (dhd->early_suspended) {
+                               WL_ERR(("Enable pkt_filter\n"));
+                               dhd_enable_packet_filter(1, dhd);
+#ifdef APF
+                               dhd_dev_apf_enable_filter(dhd_linux_get_primary_netdev(dhd));
+#endif /* APF */
+                       }
+#endif /* PKT_FILTER_SUPPORT */
+#ifdef DISABLE_WL_FRAMEBURST_SOFTAP
+                       wl_cfg80211_set_frameburst(cfg, TRUE);
+#endif /* DISABLE_WL_FRAMEBURST_SOFTAP */
+#ifdef WL_EXT_IAPSTA
+               }
+#endif /* WL_EXT_IAPSTA */
+               }
+#ifdef WLTDLS
+               if (bssidx == 0) {
+                       /* Since AP creation failed, re-enable TDLS */
+                       wl_cfg80211_tdls_config(cfg, TDLS_STATE_AP_DELETE, false);
+               }
+#endif /*  WLTDLS */
+
+       }
+
+       return err;
+}
+
+static s32
+wl_cfg80211_stop_ap(
+       struct wiphy *wiphy,
+       struct net_device *dev)
+{
+       int err = 0;
+       u32 dev_role = 0;
+       int ap = 0;
+       s32 bssidx = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 is_rsdb_supported = BCME_ERROR;
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+       WL_DBG(("Enter \n"));
+
+       if (wl_cfg80211_get_bus_state(cfg)) {
+               /* since bus is down, iovar will fail. recovery path will bringup the bus. */
+               WL_ERR(("bus is not ready\n"));
+               return BCME_OK;
+       }
+       is_rsdb_supported = DHD_OPMODE_SUPPORTED(cfg->pub, DHD_FLAG_RSDB_MODE);
+       if (is_rsdb_supported < 0)
+               return (-ENODEV);
+
+       wl_clr_drv_status(cfg, AP_CREATING, dev);
+       wl_clr_drv_status(cfg, AP_CREATED, dev);
+       cfg->ap_oper_channel = INVCHANSPEC;
+
+       if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP) {
+               dev_role = NL80211_IFTYPE_AP;
+               WL_DBG(("stopping AP operation\n"));
+       } else if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) {
+               dev_role = NL80211_IFTYPE_P2P_GO;
+               WL_DBG(("stopping P2P GO operation\n"));
+       } else {
+               WL_ERR(("no AP/P2P GO interface is operational.\n"));
+               return -EINVAL;
+       }
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if (!check_dev_role_integrity(cfg, dev_role)) {
+               WL_ERR(("role integrity check failed \n"));
+               err = -EINVAL;
+               goto exit;
+       }
+
+       /* Free up resources */
+       wl_cfg80211_cleanup_if(dev);
+
+       /* Clear AP/GO connected status */
+       wl_clr_drv_status(cfg, CONNECTED, dev);
+       if ((err = wl_cfg80211_bss_up(cfg, dev, bssidx, 0)) < 0) {
+               WL_ERR(("bss down error %d\n", err));
+       }
+
+       if (dev_role == NL80211_IFTYPE_AP) {
+#ifdef DISABLE_WL_FRAMEBURST_SOFTAP
+               wl_cfg80211_set_frameburst(cfg, TRUE);
+#endif /* DISABLE_WL_FRAMEBURST_SOFTAP */
+#ifdef PKT_FILTER_SUPPORT
+               /* Enable packet filter */
+               if (dhd->early_suspended) {
+                       WL_ERR(("Enable pkt_filter\n"));
+                       dhd_enable_packet_filter(1, dhd);
+#ifdef APF
+                       dhd_dev_apf_enable_filter(dhd_linux_get_primary_netdev(dhd));
+#endif /* APF */
+               }
+#endif /* PKT_FILTER_SUPPORT */
+
+               if (is_rsdb_supported == 0) {
+                       /* For non-rsdb chips, we use stand alone AP. Do wl down on stop AP */
+                       err = wldev_ioctl_set(dev, WLC_UP, &ap, sizeof(s32));
+                       if (unlikely(err)) {
+                               WL_ERR(("WLC_UP error (%d)\n", err));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+               }
+
+#ifdef WL_DISABLE_HE_SOFTAP
+               if (wl_cfg80211_set_he_mode(dev, cfg, bssidx, WL_IF_TYPE_AP, TRUE) != BCME_OK) {
+                       WL_ERR(("failed to set he features\n"));
+               }
+#endif /* WL_DISABLE_HE_SOFTAP */
+
+               wl_cfg80211_clear_per_bss_ies(cfg, dev->ieee80211_ptr);
+#ifdef SUPPORT_AP_RADIO_PWRSAVE
+               if (!wl_set_ap_rps(dev, FALSE, dev->name)) {
+                       wl_cfg80211_init_ap_rps(cfg);
+               } else {
+                       WL_ERR(("Set rpsnoa failed \n"));
+               }
+#endif /* SUPPORT_AP_RADIO_PWRSAVE */
+       } else {
+               /* Do we need to do something here */
+               WL_DBG(("Stopping P2P GO \n"));
+
+               DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE((dhd_pub_t *)(cfg->pub),
+                       DHD_EVENT_TIMEOUT_MS*3);
+               DHD_OS_WAKE_LOCK_TIMEOUT((dhd_pub_t *)(cfg->pub));
+
+       }
+
+       SUPP_LOG(("AP/GO Link down\n"));
+exit:
+       if (err) {
+               /* In case of failure, flush fw logs */
+               wl_flush_fw_log_buffer(dev, FW_LOGSET_MASK_ALL);
+               SUPP_LOG(("AP/GO Link down fail. err:%d\n", err));
+       }
+#ifdef WLTDLS
+       if (bssidx == 0) {
+               /* re-enable TDLS if the number of connected interfaces is less than 2 */
+               wl_cfg80211_tdls_config(cfg, TDLS_STATE_AP_DELETE, false);
+       }
+#endif /* WLTDLS */
+
+       if (dev_role == NL80211_IFTYPE_AP) {
+#ifdef WL_EXT_IAPSTA
+               if (!wl_ext_iapsta_iftype_enabled(dev, WL_IF_TYPE_AP)) {
+#endif /* WL_EXT_IAPSTA */
+               /* clear the AP mode */
+               dhd->op_mode &= ~DHD_FLAG_HOSTAP_MODE;
+#ifdef WL_EXT_IAPSTA
+               }
+#endif /* WL_EXT_IAPSTA */
+       }
+       return err;
+}
+
+static s32
+wl_cfg80211_change_beacon(
+       struct wiphy *wiphy,
+       struct net_device *dev,
+       struct cfg80211_beacon_data *info)
+{
+       s32 err = BCME_OK;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct parsed_ies ies;
+       u32 dev_role = 0;
+       s32 bssidx = 0;
+       bool pbc = 0;
+
+       WL_DBG(("Enter \n"));
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) {
+               dev_role = NL80211_IFTYPE_P2P_GO;
+       } else if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP) {
+               dev_role = NL80211_IFTYPE_AP;
+       } else {
+               err = -EINVAL;
+               goto fail;
+       }
+
+       if (!check_dev_role_integrity(cfg, dev_role)) {
+               err = -EINVAL;
+               goto fail;
+       }
+
+       if ((dev_role == NL80211_IFTYPE_P2P_GO) && (cfg->p2p_wdev == NULL)) {
+               WL_ERR(("P2P already down status!\n"));
+               err = BCME_ERROR;
+               goto fail;
+       }
+
+       /* Parse IEs */
+       if ((err = wl_cfg80211_parse_ap_ies(dev, info, &ies)) < 0) {
+               WL_ERR(("Parse IEs failed \n"));
+               goto fail;
+       }
+
+       /* Set IEs to FW */
+       if ((err = wl_cfg80211_set_ies(dev, info, bssidx)) < 0) {
+               WL_ERR(("Set IEs failed \n"));
+               goto fail;
+       }
+
+       if (dev_role == NL80211_IFTYPE_AP) {
+               if (wl_cfg80211_hostapd_sec(dev, &ies, bssidx) < 0) {
+                       WL_ERR(("Hostapd update sec failed \n"));
+                       err = -EINVAL;
+                       goto fail;
+               }
+               /* Enable Probe Req filter, WPS-AP certification 4.2.13 */
+               if ((dev_role == NL80211_IFTYPE_AP) && (ies.wps_ie != NULL)) {
+                       wl_validate_wps_ie((const char *) ies.wps_ie, ies.wps_ie_len, &pbc);
+                       WL_DBG((" WPS AP, wps_ie is exists pbc=%d\n", pbc));
+                       if (pbc)
+                               wl_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, true);
+                       else
+                               wl_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, false);
+               }
+       }
+
+fail:
+       if (err) {
+               wl_flush_fw_log_buffer(dev, FW_LOGSET_MASK_ALL);
+       }
+       return err;
+}
+#else
+static s32
+wl_cfg80211_add_set_beacon(struct wiphy *wiphy, struct net_device *dev,
+       struct beacon_parameters *info)
+{
+       s32 err = BCME_OK;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 ie_offset = 0;
+       s32 bssidx = 0;
+       u32 dev_role = NL80211_IFTYPE_AP;
+       struct parsed_ies ies;
+       bcm_tlv_t *ssid_ie;
+       bool pbc = 0;
+       bool privacy;
+       bool is_bss_up = 0;
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+       WL_DBG(("interval (%d) dtim_period (%d) head_len (%d) tail_len (%d)\n",
+               info->interval, info->dtim_period, info->head_len, info->tail_len));
+
+       if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+               dev_role = NL80211_IFTYPE_AP;
+       }
+#if defined(WL_ENABLE_P2P_IF)
+       else if (dev == cfg->p2p_net) {
+               /* Group Add request on p2p0 */
+               dev = bcmcfg_to_prmry_ndev(cfg);
+               dev_role = NL80211_IFTYPE_P2P_GO;
+       }
+#endif /* WL_ENABLE_P2P_IF */
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) {
+               dev_role = NL80211_IFTYPE_P2P_GO;
+       } else if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP) {
+               dhd->op_mode |= DHD_FLAG_HOSTAP_MODE;
+       }
+
+       if (!check_dev_role_integrity(cfg, dev_role)) {
+               err = -ENODEV;
+               goto fail;
+       }
+
+       if ((dev_role == NL80211_IFTYPE_P2P_GO) && (cfg->p2p_wdev == NULL)) {
+               WL_ERR(("P2P already down status!\n"));
+               err = BCME_ERROR;
+               goto fail;
+       }
+
+       ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
+       /* find the SSID */
+       if ((ssid_ie = bcm_parse_tlvs((u8 *)&info->head[ie_offset],
+               info->head_len - ie_offset,
+               DOT11_MNG_SSID_ID)) != NULL) {
+               if (dev_role == NL80211_IFTYPE_AP) {
+                       /* Store the hostapd SSID */
+                       bzero(&cfg->hostapd_ssid.SSID[0], DOT11_MAX_SSID_LEN);
+                       cfg->hostapd_ssid.SSID_len = MIN(ssid_ie->len, DOT11_MAX_SSID_LEN);
+                       memcpy(&cfg->hostapd_ssid.SSID[0], ssid_ie->data,
+                               cfg->hostapd_ssid.SSID_len);
+               } else {
+                       /* P2P GO */
+                       bzero(&cfg->p2p->ssid.SSID[0], DOT11_MAX_SSID_LEN);
+                       cfg->p2p->ssid.SSID_len = MIN(ssid_ie->len, DOT11_MAX_SSID_LEN);
+                       memcpy(cfg->p2p->ssid.SSID, ssid_ie->data,
+                               cfg->p2p->ssid.SSID_len);
+               }
+       }
+
+       if (wl_cfg80211_parse_ies((u8 *)info->tail,
+               info->tail_len, &ies) < 0) {
+               WL_ERR(("Beacon get IEs failed \n"));
+               err = -EINVAL;
+               goto fail;
+       }
+
+       if ((err = wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(dev), bssidx,
+               VNDR_IE_BEACON_FLAG, (u8 *)info->tail,
+               info->tail_len)) < 0) {
+               WL_ERR(("Beacon set IEs failed \n"));
+               goto fail;
+       } else {
+               WL_DBG(("Applied Vndr IEs for Beacon \n"));
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
+       if ((err = wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(dev), bssidx,
+               VNDR_IE_PRBRSP_FLAG, (u8 *)info->proberesp_ies,
+               info->proberesp_ies_len)) < 0) {
+               WL_ERR(("ProbeRsp set IEs failed \n"));
+               goto fail;
+       } else {
+               WL_DBG(("Applied Vndr IEs for ProbeRsp \n"));
+       }
+#endif
+
+       is_bss_up = wl_cfg80211_bss_isup(dev, bssidx);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
+       privacy = info->privacy;
+#else
+       privacy = 0;
+#endif
+       if (!is_bss_up &&
+               (wl_cfg80211_bcn_validate_sec(dev, &ies, dev_role, bssidx, privacy) < 0))
+       {
+               WL_ERR(("Beacon set security failed \n"));
+               err = -EINVAL;
+               goto fail;
+       }
+
+       /* Set BI and DTIM period */
+       if (info->interval) {
+               if ((err = wldev_ioctl_set(dev, WLC_SET_BCNPRD,
+                       &info->interval, sizeof(s32))) < 0) {
+                       WL_ERR(("Beacon Interval Set Error, %d\n", err));
+                       return err;
+               }
+       }
+       if (info->dtim_period) {
+               if ((err = wldev_ioctl_set(dev, WLC_SET_DTIMPRD,
+                       &info->dtim_period, sizeof(s32))) < 0) {
+                       WL_ERR(("DTIM Interval Set Error, %d\n", err));
+                       return err;
+               }
+       }
+
+       /* If bss is already up, skip bring up */
+       if (!is_bss_up &&
+               (err = wl_cfg80211_bcn_bringup_ap(dev, &ies, dev_role, bssidx)) < 0)
+       {
+               WL_ERR(("Beacon bring up AP/GO failed \n"));
+               goto fail;
+       }
+
+       /* Set GC/STA SCB expiry timings. */
+       if ((err = wl_cfg80211_set_scb_timings(cfg, dev))) {
+               WL_ERR(("scb setting failed \n"));
+               if (err == BCME_UNSUPPORTED)
+                       err = 0;
+//             goto fail;
+       }
+
+       if (wl_get_drv_status(cfg, AP_CREATED, dev)) {
+               /* Soft AP already running. Update changed params */
+               if (wl_cfg80211_hostapd_sec(dev, &ies, bssidx) < 0) {
+                       WL_ERR(("Hostapd update sec failed \n"));
+                       err = -EINVAL;
+                       goto fail;
+               }
+       }
+
+       /* Enable Probe Req filter */
+       if (((dev_role == NL80211_IFTYPE_P2P_GO) ||
+               (dev_role == NL80211_IFTYPE_AP)) && (ies.wps_ie != NULL)) {
+               wl_validate_wps_ie((char *) ies.wps_ie, ies.wps_ie_len, &pbc);
+               if (pbc)
+                       wl_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, true);
+       }
+
+       WL_DBG(("** ADD/SET beacon done **\n"));
+       wl_set_drv_status(cfg, CONNECTED, dev);
+
+fail:
+       if (err) {
+               WL_ERR(("ADD/SET beacon failed\n"));
+               if (dev_role == NL80211_IFTYPE_AP) {
+#ifdef WL_EXT_IAPSTA
+               if (!wl_ext_iapsta_iftype_enabled(dev, WL_IF_TYPE_AP)) {
+#endif /* WL_EXT_IAPSTA */
+                       /* clear the AP mode */
+                       dhd->op_mode &= ~DHD_FLAG_HOSTAP_MODE;
+#ifdef WL_EXT_IAPSTA
+               }
+#endif /* WL_EXT_IAPSTA */
+               }
+       }
+       return err;
+
+}
+
+static s32
+wl_cfg80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
+{
+       int err = 0;
+       s32 bssidx = 0;
+       int infra = 0;
+       struct wireless_dev *wdev = dev->ieee80211_ptr;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+       WL_DBG(("Enter. \n"));
+
+       if (!wdev) {
+               WL_ERR(("wdev null \n"));
+               return -EINVAL;
+       }
+
+       if ((wdev->iftype != NL80211_IFTYPE_P2P_GO) && (wdev->iftype != NL80211_IFTYPE_AP)) {
+               WL_ERR(("Unspported iface type iftype:%d \n", wdev->iftype));
+       }
+
+       wl_clr_drv_status(cfg, AP_CREATING, dev);
+       wl_clr_drv_status(cfg, AP_CREATED, dev);
+
+       /* Clear AP/GO connected status */
+       wl_clr_drv_status(cfg, CONNECTED, dev);
+
+       cfg->ap_oper_channel = INVCHANSPEC;
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       /* Do bss down */
+       if ((err = wl_cfg80211_bss_up(cfg, dev, bssidx, 0)) < 0) {
+               WL_ERR(("bss down error %d\n", err));
+       }
+
+       /* fall through is intentional */
+       err = wldev_ioctl_set(dev, WLC_SET_INFRA, &infra, sizeof(s32));
+       if (err < 0) {
+               WL_ERR(("SET INFRA error %d\n", err));
+       }
+        wl_cfg80211_clear_per_bss_ies(cfg, dev->ieee80211_ptr);
+
+       if (wdev->iftype == NL80211_IFTYPE_AP) {
+#ifdef WL_EXT_IAPSTA
+               if (!wl_ext_iapsta_iftype_enabled(dev, WL_IF_TYPE_AP)) {
+#endif /* WL_EXT_IAPSTA */
+               /* clear the AP mode */
+               dhd->op_mode &= ~DHD_FLAG_HOSTAP_MODE;
+#ifdef WL_EXT_IAPSTA
+               }
+#endif /* WL_EXT_IAPSTA */
+       }
+
+       return 0;
+}
+#endif /* LINUX_VERSION < VERSION(3,4,0) || WL_COMPAT_WIRELESS */
+
+#ifdef WL_SUPPORT_ACS
+/*
+ * Currently the dump_obss IOVAR is returning string as output so we need to
+ * parse the output buffer in an unoptimized way. Going forward if we get the
+ * IOVAR output in binary format this method can be optimized
+ */
+static int wl_parse_dump_obss(char *buf, struct wl_dump_survey *survey)
+{
+       int i;
+       char *token;
+       char delim[] = " \n";
+
+       token = strsep(&buf, delim);
+       while (token != NULL) {
+               if (!strcmp(token, "OBSS")) {
+                       for (i = 0; i < OBSS_TOKEN_IDX; i++)
+                               token = strsep(&buf, delim);
+                       survey->obss = simple_strtoul(token, NULL, 10);
+               }
+
+               if (!strcmp(token, "IBSS")) {
+                       for (i = 0; i < IBSS_TOKEN_IDX; i++)
+                               token = strsep(&buf, delim);
+                       survey->ibss = simple_strtoul(token, NULL, 10);
+               }
+
+               if (!strcmp(token, "TXDur")) {
+                       for (i = 0; i < TX_TOKEN_IDX; i++)
+                               token = strsep(&buf, delim);
+                       survey->tx = simple_strtoul(token, NULL, 10);
+               }
+
+               if (!strcmp(token, "Category")) {
+                       for (i = 0; i < CTG_TOKEN_IDX; i++)
+                               token = strsep(&buf, delim);
+                       survey->no_ctg = simple_strtoul(token, NULL, 10);
+               }
+
+               if (!strcmp(token, "Packet")) {
+                       for (i = 0; i < PKT_TOKEN_IDX; i++)
+                               token = strsep(&buf, delim);
+                       survey->no_pckt = simple_strtoul(token, NULL, 10);
+               }
+
+               if (!strcmp(token, "Opp(time):")) {
+                       for (i = 0; i < IDLE_TOKEN_IDX; i++)
+                               token = strsep(&buf, delim);
+                       survey->idle = simple_strtoul(token, NULL, 10);
+               }
+
+               token = strsep(&buf, delim);
+       }
+
+       return 0;
+}
+
+static int wl_dump_obss(struct net_device *ndev, cca_msrmnt_query req,
+       struct wl_dump_survey *survey)
+{
+       cca_stats_n_flags *results;
+       char *buf;
+       int retry, err;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+
+       buf = (char *)MALLOCZ(cfg->osh, sizeof(char) * WLC_IOCTL_MAXLEN);
+       if (unlikely(!buf)) {
+               WL_ERR(("%s: buf alloc failed\n", __func__));
+               return -ENOMEM;
+       }
+
+       retry = IOCTL_RETRY_COUNT;
+       while (retry--) {
+               err = wldev_iovar_getbuf(ndev, "dump_obss", &req, sizeof(req),
+                       buf, WLC_IOCTL_MAXLEN, NULL);
+               if (err >=  0) {
+                       break;
+               }
+               WL_DBG(("attempt = %d, err = %d, \n",
+                       (IOCTL_RETRY_COUNT - retry), err));
+       }
+
+       if (retry <= 0) {
+               WL_ERR(("failure, dump_obss IOVAR failed\n"));
+               err = -EINVAL;
+               goto exit;
+       }
+
+       results = (cca_stats_n_flags *)(buf);
+       wl_parse_dump_obss(results->buf, survey);
+       MFREE(cfg->osh, buf, sizeof(char) * WLC_IOCTL_MAXLEN);
+
+       return 0;
+exit:
+       MFREE(cfg->osh, buf, sizeof(char) * WLC_IOCTL_MAXLEN);
+       return err;
+}
+
+static int wl_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
+       int idx, struct survey_info *info)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct wl_dump_survey *survey;
+       struct ieee80211_supported_band *band;
+       struct ieee80211_channel*chan;
+       cca_msrmnt_query req;
+       int val, err, noise, retry;
+
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       if (!(dhd->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+               return -ENOENT;
+       }
+       band = wiphy->bands[IEEE80211_BAND_2GHZ];
+       if (band && idx >= band->n_channels) {
+               idx -= band->n_channels;
+               band = NULL;
+       }
+
+       if (!band || idx >= band->n_channels) {
+               /* Move to 5G band */
+               band = wiphy->bands[IEEE80211_BAND_5GHZ];
+               if (idx >= band->n_channels) {
+                       return -ENOENT;
+               }
+       }
+
+       chan = &band->channels[idx];
+       /* Setting current channel to the requested channel */
+       if ((err = wl_cfg80211_set_channel(wiphy, ndev, chan,
+               NL80211_CHAN_HT20) < 0)) {
+               /*
+                * FIXME:
+                *
+                *      Mostly set channel should not fail. because we are
+                *      traversing through Valid channel list. In case it fails,
+                *      right now we are passing the stats for previous channel.
+                */
+               WL_ERR(("Set channel failed \n"));
+       }
+
+       if (!idx) {
+               /* Set interface up, explicitly. */
+               val = 1;
+               err = wldev_ioctl_set(ndev, WLC_UP, (void *)&val, sizeof(val));
+               if (err < 0) {
+                       WL_ERR(("set interface up failed, error = %d\n", err));
+               }
+       }
+
+       /* Get noise value */
+       retry = IOCTL_RETRY_COUNT;
+       while (retry--) {
+               noise = 0;
+               err = wldev_ioctl_get(ndev, WLC_GET_PHY_NOISE, &noise,
+                       sizeof(noise));
+               if (err >=  0) {
+                       break;
+               }
+               WL_DBG(("attempt = %d, err = %d, \n",
+                       (IOCTL_RETRY_COUNT - retry), err));
+       }
+
+       if (retry <= 0) {
+               WL_ERR(("Get Phy Noise failed, error = %d\n", err));
+               noise = CHAN_NOISE_DUMMY;
+       }
+
+       survey = (struct wl_dump_survey *)MALLOCZ(cfg->osh,
+               sizeof(struct wl_dump_survey));
+       if (unlikely(!survey)) {
+               WL_ERR(("%s: alloc failed\n", __func__));
+               return -ENOMEM;
+       }
+
+       /* Start Measurement for obss stats on current channel */
+       req.msrmnt_query = 0;
+       req.time_req = ACS_MSRMNT_DELAY;
+       if ((err = wl_dump_obss(ndev, req, survey)) < 0) {
+               goto exit;
+       }
+
+       /*
+        * Wait for the meaurement to complete, adding a buffer value of 10 to take
+        * into consideration any delay in IOVAR completion
+        */
+       msleep(ACS_MSRMNT_DELAY + 10);
+
+       /* Issue IOVAR to collect measurement results */
+       req.msrmnt_query = 1;
+       if ((err = wl_dump_obss(ndev, req, survey)) < 0) {
+               goto exit;
+       }
+
+       info->channel = chan;
+       info->noise = noise;
+       info->channel_time = ACS_MSRMNT_DELAY;
+       info->channel_time_busy = ACS_MSRMNT_DELAY - survey->idle;
+       info->channel_time_rx = survey->obss + survey->ibss + survey->no_ctg +
+               survey->no_pckt;
+       info->channel_time_tx = survey->tx;
+       info->filled = SURVEY_INFO_NOISE_DBM |SURVEY_INFO_CHANNEL_TIME |
+               SURVEY_INFO_CHANNEL_TIME_BUSY | SURVEY_INFO_CHANNEL_TIME_RX |
+               SURVEY_INFO_CHANNEL_TIME_TX;
+       MFREE(cfg->osh, survey, sizeof(struct wl_dump_survey));
+
+       return 0;
+exit:
+       MFREE(cfg->osh, survey, sizeof(struct wl_dump_survey));
+       return err;
+}
+#endif /* WL_SUPPORT_ACS */
+
+static struct cfg80211_ops wl_cfg80211_ops = {
+       .add_virtual_intf = wl_cfg80211_add_virtual_iface,
+       .del_virtual_intf = wl_cfg80211_del_virtual_iface,
+       .change_virtual_intf = wl_cfg80211_change_virtual_iface,
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       .start_p2p_device = wl_cfgp2p_start_p2p_device,
+       .stop_p2p_device = wl_cfgp2p_stop_p2p_device,
+#endif /* WL_CFG80211_P2P_DEV_IF */
+       .scan = wl_cfg80211_scan,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0))
+       .abort_scan = wl_cfg80211_abort_scan,
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)) */
+       .set_wiphy_params = wl_cfg80211_set_wiphy_params,
+       .join_ibss = wl_cfg80211_join_ibss,
+       .leave_ibss = wl_cfg80211_leave_ibss,
+       .get_station = wl_cfg80211_get_station,
+       .dump_station = wl_cfg80211_dump_station,
+       .set_tx_power = wl_cfg80211_set_tx_power,
+       .get_tx_power = wl_cfg80211_get_tx_power,
+       .add_key = wl_cfg80211_add_key,
+       .del_key = wl_cfg80211_del_key,
+       .get_key = wl_cfg80211_get_key,
+       .set_default_key = wl_cfg80211_config_default_key,
+       .set_default_mgmt_key = wl_cfg80211_config_default_mgmt_key,
+       .set_power_mgmt = wl_cfg80211_set_power_mgmt,
+       .connect = wl_cfg80211_connect,
+       .disconnect = wl_cfg80211_disconnect,
+       .set_pmksa = wl_cfg80211_set_pmksa,
+       .del_pmksa = wl_cfg80211_del_pmksa,
+       .flush_pmksa = wl_cfg80211_flush_pmksa,
+       .remain_on_channel = wl_cfgscan_remain_on_channel,
+       .cancel_remain_on_channel = wl_cfgscan_cancel_remain_on_channel,
+       .mgmt_tx = wl_cfg80211_mgmt_tx,
+       .mgmt_frame_register = wl_cfg80211_mgmt_frame_register,
+       .change_bss = wl_cfg80211_change_bss,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0)) || defined(WL_COMPAT_WIRELESS)
+       .set_channel = wl_cfg80211_set_channel,
+#endif /* ((LINUX_VERSION < VERSION(3, 6, 0)) || WL_COMPAT_WIRELESS */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0)) && !defined(WL_COMPAT_WIRELESS)
+       .set_beacon = wl_cfg80211_add_set_beacon,
+       .add_beacon = wl_cfg80211_add_set_beacon,
+       .del_beacon = wl_cfg80211_del_beacon,
+#else
+       .change_beacon = wl_cfg80211_change_beacon,
+       .start_ap = wl_cfg80211_start_ap,
+       .stop_ap = wl_cfg80211_stop_ap,
+#endif /* LINUX_VERSION < KERNEL_VERSION(3,4,0) && !WL_COMPAT_WIRELESS */
+#ifdef WL_SCHED_SCAN
+       .sched_scan_start = wl_cfg80211_sched_scan_start,
+       .sched_scan_stop = wl_cfg80211_sched_scan_stop,
+#endif /* WL_SCHED_SCAN */
+#if defined(WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, \
+       2, 0))
+       .del_station = wl_cfg80211_del_station,
+       .change_station = wl_cfg80211_change_station,
+       .mgmt_tx_cancel_wait = wl_cfg80211_mgmt_tx_cancel_wait,
+#endif /* WL_SUPPORT_BACKPORTED_KPATCHES || KERNEL_VERSION >= (3,2,0) */
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)
+       .tdls_mgmt = wl_cfg80211_tdls_mgmt,
+       .tdls_oper = wl_cfg80211_tdls_oper,
+#endif /* LINUX_VERSION > VERSION(3, 2, 0) || WL_COMPAT_WIRELESS */
+#ifdef WL_SUPPORT_ACS
+       .dump_survey = wl_cfg80211_dump_survey,
+#endif /* WL_SUPPORT_ACS */
+#ifdef WL_CFG80211_ACL
+       .set_mac_acl = wl_cfg80211_set_mac_acl,
+#endif /* WL_CFG80211_ACL */
+#ifdef GTK_OFFLOAD_SUPPORT
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0))
+       .set_rekey_data = wl_cfg80211_set_rekey_data,
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0) */
+#endif /* GTK_OFFLOAD_SUPPORT */
+#if defined(WL_FILS)
+       /* This should be enabled from kernel version which supports this */
+       .update_connect_params = wl_cfg80211_update_connect_params,
+#endif /* WL_FILS */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0))
+       .set_pmk = wl_cfg80211_set_pmk,
+       .del_pmk = wl_cfg80211_del_pmk,
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0) */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0))
+       .channel_switch = wl_cfg80211_channel_switch,
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0) */
+#ifdef WL_CLIENT_SAE
+       .external_auth = wl_cfg80211_external_auth,
+#endif /* WL_CLIENT_SAE */
+};
+
+s32 wl_mode_to_nl80211_iftype(s32 mode)
+{
+       s32 err = 0;
+
+       switch (mode) {
+       case WL_MODE_BSS:
+               return NL80211_IFTYPE_STATION;
+       case WL_MODE_IBSS:
+               return NL80211_IFTYPE_ADHOC;
+       case WL_MODE_AP:
+               return NL80211_IFTYPE_AP;
+#ifdef WLMESH_CFG80211
+       case WL_MODE_MESH:
+               return NL80211_IFTYPE_MESH_POINT;
+#endif /* WLMESH_CFG80211 */
+       default:
+               return NL80211_IFTYPE_UNSPECIFIED;
+       }
+
+       return err;
+}
+
+static bool
+wl_is_ccode_change_required(struct net_device *net,
+       char *country_code, int revinfo)
+{
+       s32 ret = BCME_OK;
+       wl_country_t cspec = {{0}, 0, {0}};
+       wl_country_t cur_cspec = {{0}, 0, {0}};
+
+       ret = wldev_iovar_getbuf(net, "country", NULL, 0, &cur_cspec,
+               sizeof(cur_cspec), NULL);
+       if (ret < 0) {
+               WL_ERR(("get country code failed = %d\n", ret));
+               return true;
+       }
+       /* If translation table is available, update cspec */
+       cspec.rev = revinfo;
+       strlcpy(cspec.country_abbrev, country_code, WLC_CNTRY_BUF_SZ);
+       strlcpy(cspec.ccode, country_code, WLC_CNTRY_BUF_SZ);
+       dhd_get_customized_country_code(net, country_code, &cspec);
+       if ((cur_cspec.rev == cspec.rev) &&
+               (strncmp(cur_cspec.ccode, cspec.ccode, WLC_CNTRY_BUF_SZ) == 0) &&
+               (strncmp(cur_cspec.country_abbrev, cspec.country_abbrev, WLC_CNTRY_BUF_SZ) == 0)) {
+                       WL_INFORM_MEM(("country code = %s/%d is already configured\n",
+                               country_code, revinfo));
+                       return false;
+       }
+       return true;
+}
+
+s32
+wl_cfg80211_set_country_code(struct net_device *net, char *country_code,
+       bool notify, bool user_enforced, int revinfo)
+{
+       s32 ret = BCME_OK;
+       struct wireless_dev *wdev = ndev_to_wdev(net);
+       struct wiphy *wiphy = wdev->wiphy;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       BCM_REFERENCE(cfg);
+
+       if (wl_is_ccode_change_required(net, country_code, revinfo) == false) {
+               goto exit;
+       }
+#ifdef WL_NAN
+       if (wl_cfgnan_is_enabled(cfg)) {
+               mutex_lock(&cfg->if_sync);
+               ret = wl_cfgnan_check_nan_disable_pending(cfg, true, true);
+               mutex_unlock(&cfg->if_sync);
+               if (ret != BCME_OK) {
+                       WL_ERR(("failed to disable nan, error[%d]\n", ret));
+                       goto exit;
+               }
+       }
+#endif /* WL_NAN */
+       ret = wldev_set_country(net, country_code,
+               notify, user_enforced, revinfo);
+       if (ret < 0) {
+               WL_ERR(("set country Failed :%d\n", ret));
+               goto exit;
+       }
+
+       /* send up the hint so that upper layer apps
+        * can refresh the channel
+        * list
+        */
+       if (!IS_REGDOM_SELF_MANAGED(wiphy)) {
+               regulatory_hint(wiphy, country_code);
+       }
+
+exit:
+       return ret;
+}
+
+#ifdef CONFIG_CFG80211_INTERNAL_REGDB
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0))
+#define WL_CFG80211_REG_NOTIFIER() static int wl_cfg80211_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request)
+#else
+#define WL_CFG80211_REG_NOTIFIER() static void wl_cfg80211_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request)
+#endif /* kernel version < 3.9.0 */
+#endif
+
+#ifdef CONFIG_CFG80211_INTERNAL_REGDB
+WL_CFG80211_REG_NOTIFIER()
+{
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)wiphy_priv(wiphy);
+       int ret = 0;
+       int revinfo = -1;
+
+       if (!request || !cfg) {
+               WL_ERR(("Invalid arg\n"));
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 11))
+               return -EINVAL;
+#else
+               return;
+#endif /* kernel version < 3.10.11 */
+       }
+
+       WL_DBG(("ccode: %c%c Initiator: %d\n",
+               request->alpha2[0], request->alpha2[1], request->initiator));
+
+       /* We support only REGDOM_SET_BY_USER as of now */
+       if ((request->initiator != NL80211_REGDOM_SET_BY_USER) &&
+               (request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE)) {
+               WL_ERR(("reg_notifier for intiator:%d not supported : set default\n",
+                       request->initiator));
+               /* in case of no supported country by regdb
+                    lets driver setup platform default Locale
+               */
+       }
+
+       WL_ERR(("Set country code %c%c from %s\n",
+               request->alpha2[0], request->alpha2[1],
+               ((request->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) ? " 11d AP" : "User")));
+
+       if ((ret = wldev_set_country(bcmcfg_to_prmry_ndev(cfg), request->alpha2,
+               false, (request->initiator == NL80211_REGDOM_SET_BY_USER ? true : false),
+               revinfo)) < 0) {
+               WL_ERR(("set country Failed :%d\n", ret));
+       }
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 11))
+       return ret;
+#else
+       return;
+#endif /* kernel version < 3.10.11 */
+}
+#endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+
+#ifdef CONFIG_PM
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+static const struct wiphy_wowlan_support brcm_wowlan_support = {
+       .flags = WIPHY_WOWLAN_ANY,
+       .n_patterns = WL_WOWLAN_MAX_PATTERNS,
+       .pattern_min_len = WL_WOWLAN_MIN_PATTERN_LEN,
+       .pattern_max_len = WL_WOWLAN_MAX_PATTERN_LEN,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
+       .max_pkt_offset = WL_WOWLAN_MAX_PATTERN_LEN,
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0) */
+};
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0) */
+#endif /* CONFIG_PM */
+
+int wl_features_set(u8 *array, uint8 len, u32 ftidx)
+{
+       u8* ft_byte;
+
+       if ((ftidx / 8u) >= len)
+               return BCME_BADARG;
+
+       ft_byte = &array[ftidx / 8u];
+       *ft_byte |= BIT(ftidx % 8u);
+       return BCME_OK;
+}
+
+static
+void wl_config_custom_regulatory(struct wiphy *wiphy)
+{
+
+#if defined(WL_SELF_MANAGED_REGDOM) && (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0))
+       /* Use self managed regulatory domain */
+       wiphy->regulatory_flags |= REGULATORY_WIPHY_SELF_MANAGED |
+                       REGULATORY_IGNORE_STALE_KICKOFF;
+       wiphy->regd = &brcm_regdom;
+       WL_DBG(("Self managed regdom\n"));
+       return;
+#else /* WL_SELF_MANAGED_REGDOM && KERNEL >= 4.0 */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+       wiphy->regulatory_flags |=
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0))
+               REGULATORY_IGNORE_STALE_KICKOFF |
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0) */
+               REGULATORY_CUSTOM_REG;
+#else /* KERNEL VER >= 3.14 */
+       wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
+       wiphy_apply_custom_regulatory(wiphy, &brcm_regdom);
+       WL_DBG(("apply custom regulatory\n"));
+#endif /* WL_SELF_MANAGED_REGDOM && KERNEL >= 4.0 */
+}
+
+static s32 wl_setup_wiphy(struct wireless_dev *wdev, struct device *sdiofunc_dev, dhd_pub_t *context)
+{
+       s32 err = 0;
+#ifdef CONFIG_PM
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
+       struct cfg80211_wowlan *brcm_wowlan_config = NULL;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0) */
+#endif /* CONFIG_PM */
+
+//#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0) || defined(WL_COMPAT_WIRELESS))
+       dhd_pub_t *dhd = (dhd_pub_t *)context;
+       BCM_REFERENCE(dhd);
+
+       if (!dhd) {
+               WL_ERR(("DHD is NULL!!"));
+               err = -ENODEV;
+               return err;
+       }
+//#endif // endif
+
+       wdev->wiphy =
+           wiphy_new(&wl_cfg80211_ops, sizeof(struct bcm_cfg80211));
+       if (unlikely(!wdev->wiphy)) {
+               WL_ERR(("Couldn not allocate wiphy device\n"));
+               err = -ENOMEM;
+               return err;
+       }
+       set_wiphy_dev(wdev->wiphy, sdiofunc_dev);
+       wdev->wiphy->max_scan_ie_len = WL_SCAN_IE_LEN_MAX;
+       /* Report  how many SSIDs Driver can support per Scan request */
+       wdev->wiphy->max_scan_ssids = WL_SCAN_PARAMS_SSID_MAX;
+       wdev->wiphy->max_num_pmkids = WL_NUM_PMKIDS_MAX;
+#ifdef WL_SCHED_SCAN
+       wdev->wiphy->max_sched_scan_ssids = MAX_PFN_LIST_COUNT;
+       wdev->wiphy->max_match_sets = MAX_PFN_LIST_COUNT;
+       wdev->wiphy->max_sched_scan_ie_len = WL_SCAN_IE_LEN_MAX;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 12, 0))
+       wdev->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
+#else
+       wdev->wiphy->max_sched_scan_reqs = 1;
+#endif /* LINUX_VER < 4.12 */
+#endif /* WL_SCHED_SCAN */
+#ifdef WLMESH_CFG80211
+       wdev->wiphy->flags |= WIPHY_FLAG_MESH_AUTH;
+#endif /* WLMESH_CFG80211 */
+       wdev->wiphy->interface_modes =
+               BIT(NL80211_IFTYPE_STATION)
+               | BIT(NL80211_IFTYPE_ADHOC)
+#if !defined(WL_ENABLE_P2P_IF) && !defined(WL_CFG80211_P2P_DEV_IF)
+       /*
+        * This monitor mode support creates an issue in registering
+        * Action frame for P2P-GO, this was leading an error in receiving
+        * action frames to GO interface.Keeping the code here because
+        * monitor mode code has kept as it is in other modules,
+        * though we are not supporting this mode.
+        */
+               | BIT(NL80211_IFTYPE_MONITOR)
+#endif /* !WL_ENABLE_P2P_IF && !WL_CFG80211_P2P_DEV_IF */
+#if defined(WL_IFACE_COMB_NUM_CHANNELS) || defined(WL_CFG80211_P2P_DEV_IF)
+               | BIT(NL80211_IFTYPE_P2P_CLIENT)
+               | BIT(NL80211_IFTYPE_P2P_GO)
+#endif /* WL_IFACE_COMB_NUM_CHANNELS || WL_CFG80211_P2P_DEV_IF */
+#if defined(WL_CFG80211_P2P_DEV_IF)
+               | BIT(NL80211_IFTYPE_P2P_DEVICE)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+#ifdef WLMESH_CFG80211
+               | BIT(NL80211_IFTYPE_MESH_POINT)
+#endif /* WLMESH_CFG80211 */
+               | BIT(NL80211_IFTYPE_AP);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) && \
+       (defined(WL_IFACE_COMB_NUM_CHANNELS) || defined(WL_CFG80211_P2P_DEV_IF))
+       WL_DBG(("Setting interface combinations for common mode\n"));
+       wdev->wiphy->iface_combinations = common_iface_combinations;
+       wdev->wiphy->n_iface_combinations =
+               ARRAY_SIZE(common_iface_combinations);
+#endif /* LINUX_VER >= 3.0 && (WL_IFACE_COMB_NUM_CHANNELS || WL_CFG80211_P2P_DEV_IF) */
+
+       wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &__wl_band_2ghz;
+
+       wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+       wdev->wiphy->cipher_suites = __wl_cipher_suites;
+       wdev->wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
+       wdev->wiphy->max_remain_on_channel_duration = 5000;
+       wdev->wiphy->mgmt_stypes = wl_cfg80211_default_mgmt_stypes;
+#ifndef WL_POWERSAVE_DISABLED
+       wdev->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
+#else
+       wdev->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+#endif                         /* !WL_POWERSAVE_DISABLED */
+       wdev->wiphy->flags |= WIPHY_FLAG_NETNS_OK |
+               WIPHY_FLAG_4ADDR_AP |
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)) && !defined(WL_COMPAT_WIRELESS)
+               WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS |
+#endif
+               WIPHY_FLAG_4ADDR_STATION;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0))
+       /*
+        * If FW ROAM flag is advertised, upper layer doesn't provide the
+        * bssid & freq in the connect command. However, kernel ver >= 3.15,
+        * provides bssid_hint & freq_hint which can be used by the firmware.
+        * fw_ap_select variable determines whether FW selects the AP or the
+        * user space selects the target AP within the given ESS.
+        */
+       wdev->wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0) */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0)) || defined(WL_COMPAT_WIRELESS)
+       /* this flag should be added to support wpa_supplicant 1.0+ */
+       wdev->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
+               WIPHY_FLAG_OFFCHAN_TX;
+#endif
+#if defined(WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, \
+       4, 0))
+       /* From 3.4 kernel ownards AP_SME flag can be advertised
+        * to remove the patch from supplicant
+        */
+       wdev->wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME;
+
+#ifdef WL_CFG80211_ACL
+       /* Configure ACL capabilities. */
+       wdev->wiphy->max_acl_mac_addrs = MAX_NUM_MAC_FILT;
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0) || defined(WL_COMPAT_WIRELESS))
+       /* Supplicant distinguish between the SoftAP mode and other
+        * modes (e.g. P2P, WPS, HS2.0) when it builds the probe
+        * response frame from Supplicant MR1 and Kernel 3.4.0 or
+        * later version. To add Vendor specific IE into the
+        * probe response frame in case of SoftAP mode,
+        * AP_PROBE_RESP_OFFLOAD flag is set to wiphy->flags variable.
+        */
+       if (dhd_get_fw_mode(dhd->info) == DHD_FLAG_HOSTAP_MODE) {
+               wdev->wiphy->flags |= WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
+               wdev->wiphy->probe_resp_offload = 0;
+       }
+#endif
+#endif /* WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) */
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)
+       wdev->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
+#endif
+
+#if defined(CONFIG_PM) && defined(WL_CFG80211_P2P_DEV_IF)
+       /*
+        * From linux-3.10 kernel, wowlan packet filter is mandated to avoid the
+        * disconnection of connected network before suspend. So a dummy wowlan
+        * filter is configured for kernels linux-3.8 and above.
+        */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
+       wdev->wiphy->wowlan = &brcm_wowlan_support;
+       /* If this is not provided cfg stack will get disconnect
+       * during suspend.
+       * Note: wiphy->wowlan_config is freed by cfg80211 layer.
+       * so use malloc instead of MALLOC(osh) to avoid false alarm.
+       */
+       brcm_wowlan_config = kmalloc(sizeof(struct cfg80211_wowlan), GFP_KERNEL);
+       if (brcm_wowlan_config) {
+               brcm_wowlan_config->disconnect = true;
+               brcm_wowlan_config->gtk_rekey_failure = true;
+               brcm_wowlan_config->eap_identity_req = true;
+               brcm_wowlan_config->four_way_handshake = true;
+               brcm_wowlan_config->patterns = NULL;
+               brcm_wowlan_config->n_patterns = 0;
+               brcm_wowlan_config->tcp = NULL;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0))
+               brcm_wowlan_config->nd_config = NULL;
+#endif
+       } else {
+               WL_ERR(("Can not allocate memory for brcm_wowlan_config,"
+                       " So wiphy->wowlan_config is set to NULL\n"));
+       }
+       wdev->wiphy->wowlan_config = brcm_wowlan_config;
+#else
+       wdev->wiphy->wowlan.flags = WIPHY_WOWLAN_ANY;
+       wdev->wiphy->wowlan.n_patterns = WL_WOWLAN_MAX_PATTERNS;
+       wdev->wiphy->wowlan.pattern_min_len = WL_WOWLAN_MIN_PATTERN_LEN;
+       wdev->wiphy->wowlan.pattern_max_len = WL_WOWLAN_MAX_PATTERN_LEN;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
+       wdev->wiphy->wowlan.max_pkt_offset = WL_WOWLAN_MAX_PATTERN_LEN;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0) */
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0) */
+#endif /* CONFIG_PM && WL_CFG80211_P2P_DEV_IF */
+
+       WL_DBG(("Registering custom regulatory)\n"));
+       wl_config_custom_regulatory(wdev->wiphy);
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 14, 0)) || defined(WL_VENDOR_EXT_SUPPORT)
+       WL_INFORM_MEM(("Registering Vendor80211\n"));
+       err = wl_cfgvendor_attach(wdev->wiphy, dhd);
+       if (unlikely(err < 0)) {
+               WL_ERR(("Couldn not attach vendor commands (%d)\n", err));
+       }
+#endif /* (LINUX_VERSION_CODE > KERNEL_VERSION(3, 14, 0)) || defined(WL_VENDOR_EXT_SUPPORT) */
+#ifdef WL_FILS
+       wiphy_ext_feature_set(wdev->wiphy, NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
+#endif /* WL_FILS */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 17, 0))
+       wdev->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
+       wdev->wiphy->max_num_csa_counters = WL_MAX_NUM_CSA_COUNTERS;
+#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(3, 12, 0) */
+
+       /* Now we can register wiphy with cfg80211 module */
+       err = wiphy_register(wdev->wiphy);
+       if (unlikely(err < 0)) {
+               WL_ERR(("Couldn not register wiphy device (%d)\n", err));
+               wiphy_free(wdev->wiphy);
+       }
+
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) && (LINUX_VERSION_CODE <= \
+       KERNEL_VERSION(3, 3, 0))) && defined(WL_IFACE_COMB_NUM_CHANNELS)
+       /* Workaround for a cfg80211 bug */
+       wdev->wiphy->flags &= ~WIPHY_FLAG_ENFORCE_COMBINATIONS;
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) && \
+       defined(SUPPORT_RANDOM_MAC_SCAN)
+               wdev->wiphy->features |= (NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
+                       NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR);
+               wdev->wiphy->max_sched_scan_plans = 1; /* multiple plans not supported */
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) && defined(SUPPORT_RANDOM_MAC_SCAN) */
+
+#if defined(WL_SAE) || defined(WL_CLIENT_SAE)
+       wdev->wiphy->features |= NL80211_FEATURE_SAE;
+#endif /* WL_SAE || WL_CLIENT_SAE */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)) && defined(BCMSUP_4WAY_HANDSHAKE)
+       if (FW_SUPPORTED(dhd, idsup)) {
+               wiphy_ext_feature_set(wdev->wiphy, NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK);
+               wiphy_ext_feature_set(wdev->wiphy, NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X);
+       }
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0) && defined(BCMSUP_4WAY_HANDSHAKE) */
+#ifdef WL_SCAN_TYPE
+       /* These scan types will be mapped to default scan on non-supported chipset */
+       /* Advertise scan type capability. */
+       wiphy_ext_feature_set(wdev->wiphy, NL80211_EXT_FEATURE_LOW_SPAN_SCAN);
+       wiphy_ext_feature_set(wdev->wiphy, NL80211_EXT_FEATURE_LOW_POWER_SCAN);
+       wiphy_ext_feature_set(wdev->wiphy, NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN);
+       wdev->wiphy->features |= NL80211_FEATURE_LOW_PRIORITY_SCAN;
+#endif /* WL_SCAN_TYPE */
+
+       return err;
+}
+
+static void wl_free_wdev(struct bcm_cfg80211 *cfg)
+{
+       struct wireless_dev *wdev = cfg->wdev;
+       struct wiphy *wiphy = NULL;
+       if (!wdev) {
+               WL_ERR(("wdev is invalid\n"));
+               return;
+       }
+       if (wdev->wiphy) {
+               wiphy = wdev->wiphy;
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 14, 0)) || defined(WL_VENDOR_EXT_SUPPORT)
+               wl_cfgvendor_detach(wdev->wiphy);
+#endif /* (LINUX_VERSION_CODE > KERNEL_VERSION(3, 14, 0)) || defined(WL_VENDOR_EXT_SUPPORT) */
+#if defined(CONFIG_PM) && defined(WL_CFG80211_P2P_DEV_IF)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
+               /* Reset wowlan & wowlan_config before Unregister to avoid Kernel Panic */
+               WL_DBG(("clear wowlan\n"));
+               wdev->wiphy->wowlan = NULL;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0) */
+#endif /* CONFIG_PM && WL_CFG80211_P2P_DEV_IF */
+#if defined(WL_SELF_MANAGED_REGDOM) && (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0))
+               /* Making regd ptr NULL, to avoid reference/freeing by regulatory unregister */
+               wiphy->regd = NULL;
+#endif /* WL_SELF_MANAGED_REGDOM && KERNEL >= 4.0 */
+               wiphy_unregister(wdev->wiphy);
+               wdev->wiphy->dev.parent = NULL;
+               wdev->wiphy = NULL;
+       }
+
+       wl_delete_all_netinfo(cfg);
+       if (wiphy) {
+               if (wdev->netdev)
+                       wdev->netdev->ieee80211_ptr = NULL;
+               wdev->netdev = NULL;
+               MFREE(cfg->osh, wdev, sizeof(*wdev));
+               cfg->wdev = NULL;
+               wiphy_free(wiphy);
+       }
+
+       /* PLEASE do NOT call any function after wiphy_free, the driver's private structure "cfg",
+        * which is the private part of wiphy, has been freed in wiphy_free !!!!!!!!!!!
+        */
+}
+
+static bool wl_is_linkup(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e, struct net_device *ndev)
+{
+       u32 event = ntoh32(e->event_type);
+       u32 status =  ntoh32(e->status);
+       u16 flags = ntoh16(e->flags);
+#if defined(CUSTOM_SET_OCLOFF) || defined(CUSTOM_SET_ANTNPM)
+       dhd_pub_t *dhd;
+       dhd = (dhd_pub_t *)(cfg->pub);
+#endif /* CUSTOM_SET_OCLOFF || CUSTOM_SET_ANTNPM */
+
+       WL_DBG(("event %d, status %d flags %x\n", event, status, flags));
+       if (event == WLC_E_SET_SSID) {
+               if (status == WLC_E_STATUS_SUCCESS) {
+#ifdef CUSTOM_SET_OCLOFF
+                       if (dhd->ocl_off) {
+                               int err = 0;
+                               int ocl_enable = 0;
+                               err = wldev_iovar_setint(ndev, "ocl_enable", ocl_enable);
+                               if (err != 0) {
+                                       WL_ERR(("[WIFI_SEC] wl_is_linkup: Set ocl_enable %d"
+                                               " failed %d\n",
+                                               ocl_enable, err));
+                               } else {
+                                       WL_ERR(("[WIFI_SEC] wl_is_linkup: Set ocl_enable %d"
+                                               " succeeded %d\n",
+                                               ocl_enable, err));
+                               }
+                       }
+#endif /* CUSTOM_SET_OCLOFF */
+#ifdef CUSTOM_SET_ANTNPM
+                       if (dhd->mimo_ant_set) {
+                               int err = 0;
+
+                               WL_ERR(("[WIFI_SEC] mimo_ant_set = %d\n", dhd->mimo_ant_set));
+                               err = wldev_iovar_setint(ndev, "txchain", dhd->mimo_ant_set);
+                               if (err != 0) {
+                                       WL_ERR(("[WIFI_SEC] Fail set txchain\n"));
+                               }
+                               err = wldev_iovar_setint(ndev, "rxchain", dhd->mimo_ant_set);
+                               if (err != 0) {
+                                       WL_ERR(("[WIFI_SEC] Fail set rxchain\n"));
+                               }
+                       }
+#endif /* CUSTOM_SET_ANTNPM */
+                       if (!wl_is_ibssmode(cfg, ndev))
+                               return true;
+               }
+       } else if (event == WLC_E_LINK) {
+               if (flags & WLC_EVENT_MSG_LINK)
+                       return true;
+       }
+
+       WL_DBG(("wl_is_linkup false\n"));
+       return false;
+}
+
+static bool wl_is_linkdown(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e)
+{
+       u32 event = ntoh32(e->event_type);
+       u16 flags = ntoh16(e->flags);
+
+       if (event == WLC_E_DEAUTH_IND ||
+       event == WLC_E_DISASSOC_IND ||
+       event == WLC_E_DISASSOC ||
+       event == WLC_E_DEAUTH) {
+               WL_ERR(("Link down Reason : %s\n", bcmevent_get_name(event)));
+               return true;
+       } else if (event == WLC_E_LINK) {
+               if (!(flags & WLC_EVENT_MSG_LINK)) {
+                       WL_ERR(("Link down Reason : %s\n", bcmevent_get_name(event)));
+                       return true;
+               }
+       }
+
+       return false;
+}
+
+static bool wl_is_nonetwork(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e)
+{
+       u32 event = ntoh32(e->event_type);
+       u32 status = ntoh32(e->status);
+
+       if (event == WLC_E_LINK && status == WLC_E_STATUS_NO_NETWORKS)
+               return true;
+       if (event == WLC_E_SET_SSID && status != WLC_E_STATUS_SUCCESS)
+               return true;
+       if (event == WLC_E_ASSOC_RESP_IE && status != WLC_E_STATUS_SUCCESS)
+               return true;
+
+       return false;
+}
+
+#ifdef WL_SAE
+static s32
+wl_cfg80211_event_sae_key(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       wl_sae_key_info_t *sae_key)
+{
+       struct sk_buff *skb;
+       gfp_t kflags;
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       int err = BCME_OK;
+       struct cfg80211_pmksa pmksa;
+
+       kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+#if (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || \
+       LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+       skb = cfg80211_vendor_event_alloc(wiphy, ndev_to_wdev(ndev), BRCM_SAE_VENDOR_EVENT_BUF_LEN,
+               BRCM_VENDOR_EVENT_SAE_KEY, kflags);
+#else
+       skb = cfg80211_vendor_event_alloc(wiphy, BRCM_SAE_VENDOR_EVENT_BUF_LEN,
+               BRCM_VENDOR_EVENT_SAE_KEY, kflags);
+#endif /* (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || */
+               /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0) */
+       if (!skb) {
+               WL_ERR(("skb alloc failed"));
+               err = BCME_NOMEM;
+               goto done;
+       }
+
+       WL_INFORM_MEM(("Received Sae Key event for "MACDBG" key length %x %x",
+               MAC2STRDBG(sae_key->peer_mac), sae_key->pmk_len, sae_key->pmkid_len));
+       nla_put(skb, BRCM_SAE_KEY_ATTR_PEER_MAC, ETHER_ADDR_LEN, sae_key->peer_mac);
+       nla_put(skb, BRCM_SAE_KEY_ATTR_PMK, sae_key->pmk_len, sae_key->pmk);
+       nla_put(skb, BRCM_SAE_KEY_ATTR_PMKID, sae_key->pmkid_len, sae_key->pmkid);
+       cfg80211_vendor_event(skb, kflags);
+       /* wpa_supplicant will manage the PMK and PMKID from here on..
+        * Delete the PMK cache in firmware, if wlc_ver equals to MIN_PMKID_LIST_V3_FW_MAJOR
+        * else ignore.
+        * MIN_PMKID_LIST_V3_FW_MAJOR has two IOVAR's(pmklist_info and PMKDB).
+        */
+       if (cfg->wlc_ver.wlc_ver_major == MIN_PMKID_LIST_V3_FW_MAJOR) {
+               WL_INFORM_MEM(("Deleting the SAE PMK cache Info from firmware \n"));
+               memset_s(&pmksa, sizeof(pmksa), 0, sizeof(pmksa));
+               pmksa.bssid = sae_key->peer_mac;
+               pmksa.pmkid = sae_key->pmkid;
+               err = wl_cfg80211_update_pmksa(wiphy, ndev, &pmksa, FALSE);
+               if (err != BCME_OK) {
+                       WL_ERR(("Failed to delete the SAE PMK cache Info from firmware %d\n", err));
+               }
+       }
+done:
+       return err;
+}
+
+static s32
+wl_bss_handle_sae_auth_v1(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *event, void *data)
+{
+       int err = BCME_OK;
+       wl_auth_event_t *auth_data;
+       wl_sae_key_info_t sae_key;
+       uint16 tlv_buf_len;
+       auth_data = (wl_auth_event_t *)data;
+
+       tlv_buf_len = auth_data->length - WL_AUTH_EVENT_FIXED_LEN_V1;
+
+       /* check if PMK info present */
+       sae_key.pmk = bcm_get_data_from_xtlv_buf(auth_data->xtlvs, tlv_buf_len,
+               WL_AUTH_PMK_TLV_ID, &(sae_key.pmk_len), BCM_XTLV_OPTION_ALIGN32);
+       if (!sae_key.pmk || !sae_key.pmk_len) {
+               WL_ERR(("Mandatory PMK info not present"));
+               err = BCME_NOTFOUND;
+               goto done;
+       }
+       /* check if PMKID info present */
+       sae_key.pmkid = bcm_get_data_from_xtlv_buf(auth_data->xtlvs, tlv_buf_len,
+               WL_AUTH_PMKID_TLV_ID, &(sae_key.pmkid_len), BCM_XTLV_OPTION_ALIGN32);
+       if (!sae_key.pmkid || !sae_key.pmkid_len) {
+               WL_ERR(("Mandatory PMKID info not present\n"));
+               err = BCME_NOTFOUND;
+               goto done;
+       }
+       memcpy_s(sae_key.peer_mac, ETHER_ADDR_LEN, event->addr.octet, ETHER_ADDR_LEN);
+       err = wl_cfg80211_event_sae_key(cfg, ndev, &sae_key);
+       if (err) {
+               WL_ERR(("Failed to event sae key info\n"));
+       }
+done:
+       return err;
+}
+
+static s32
+wl_bss_handle_sae_auth_v2(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *event, void *data)
+{
+       int err = BCME_OK;
+       wl_auth_event_t *auth_data;
+       wl_sae_key_info_t sae_key;
+       uint16 tlv_buf_len;
+       uint8 ssid[DOT11_MAX_SSID_LEN];
+       const uint8 *tmp_buf;
+       uint16 ssid_len;
+       uint16 type_len;
+       uint32 type;
+       pmkid_v3_t *t_pmkid = NULL;
+
+       auth_data = (wl_auth_event_t *)data;
+
+       tlv_buf_len = auth_data->length - WL_AUTH_EVENT_FIXED_LEN_V2;
+
+       /* check if PMK info present */
+       sae_key.pmk = bcm_get_data_from_xtlv_buf(auth_data->xtlvs, tlv_buf_len,
+               WL_AUTH_PMK_TLV_ID, &(sae_key.pmk_len), BCM_XTLV_OPTION_ALIGN32);
+       if (!sae_key.pmk || !sae_key.pmk_len) {
+               WL_ERR(("Mandatory PMK info not present"));
+               err = BCME_NOTFOUND;
+               goto done;
+       }
+       /* check if PMKID info present */
+       sae_key.pmkid = bcm_get_data_from_xtlv_buf(auth_data->xtlvs, tlv_buf_len,
+               WL_AUTH_PMKID_TLV_ID, &(sae_key.pmkid_len), BCM_XTLV_OPTION_ALIGN32);
+       if (!sae_key.pmkid || !sae_key.pmkid_len) {
+               WL_ERR(("Mandatory PMKID info not present\n"));
+               err = BCME_NOTFOUND;
+               goto done;
+       }
+       memcpy_s(sae_key.peer_mac, ETHER_ADDR_LEN, event->addr.octet, ETHER_ADDR_LEN);
+
+       tmp_buf = bcm_get_data_from_xtlv_buf(auth_data->xtlvs, tlv_buf_len,
+               WL_AUTH_PMKID_TYPE_TLV_ID, &type_len, BCM_XTLV_OPTION_ALIGN32);
+
+       memcpy(&type, tmp_buf, MIN(type_len, sizeof(type)));
+       if (type == WL_AUTH_PMKID_TYPE_SSID) {
+               int idx;
+               int idx2;
+               pmkid_list_v3_t *spmk_list = &cfg->spmk_info_list->pmkids;
+
+               tmp_buf = bcm_get_data_from_xtlv_buf(auth_data->xtlvs, tlv_buf_len,
+                       WL_AUTH_SSID_TLV_ID, &ssid_len, BCM_XTLV_OPTION_ALIGN32);
+               if (tmp_buf == NULL) {
+                       return BCME_ERROR;
+               }
+               bzero(ssid, sizeof(ssid));
+               (void)memcpy_s(ssid, sizeof(ssid), tmp_buf, MIN(sizeof(ssid), ssid_len));
+               for (idx = 0; idx < spmk_list->count; idx++) {
+                       t_pmkid = &spmk_list->pmkid[idx];
+                       if (ssid_len == t_pmkid->ssid_len &&
+                               !memcmp(ssid, t_pmkid->ssid, MIN(sizeof(ssid), ssid_len))) {
+                               break;
+                       }
+               }
+               if (idx >= spmk_list->count) {
+                       if (spmk_list->count == MAXPMKID) {
+                               /* remove oldest PMK info */
+                               for (idx2 = 0; idx2 < spmk_list->count - 1; idx2++) {
+                                       (void)memcpy_s(&spmk_list->pmkid[idx2], sizeof(pmkid_v3_t),
+                                               &spmk_list->pmkid[idx2 + 1], sizeof(pmkid_v3_t));
+                               }
+                               t_pmkid = &spmk_list->pmkid[spmk_list->count - 1];
+                       } else {
+                               t_pmkid = &spmk_list->pmkid[spmk_list->count++];
+                       }
+               }
+               if (!t_pmkid) {
+                       WL_ERR(("SPMK TPMKID is null\n"));
+                       return BCME_NOTFOUND;
+               }
+               bzero(t_pmkid, sizeof(pmkid_v3_t));
+               memcpy(&t_pmkid->bssid, event->addr.octet, 6);
+               t_pmkid->ssid_len = ssid_len;
+               err = memcpy_s(t_pmkid->ssid, sizeof(t_pmkid->ssid), ssid, ssid_len);
+               if (err != BCME_OK) {
+                       goto done;
+               }
+               /* COPY but not used */
+               t_pmkid->pmkid_len = sae_key.pmkid_len;
+               memcpy(t_pmkid->pmkid, sae_key.pmkid, sae_key.pmkid_len);
+               t_pmkid->pmk_len = sae_key.pmk_len;
+               memcpy(t_pmkid->pmk, sae_key.pmk, sae_key.pmk_len);
+       }
+
+       err = wl_cfg80211_event_sae_key(cfg, ndev, &sae_key);
+       if (err) {
+               WL_ERR(("Failed to event sae key info\n"));
+       }
+done:
+       return err;
+}
+
+static s32
+wl_bss_handle_sae_auth(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *event, void *data)
+{
+       int err = BCME_OK;
+       uint status = ntoh32(event->status);
+       wl_auth_event_t *auth_data;
+
+       if (status == WLC_E_STATUS_SUCCESS) {
+               auth_data = (wl_auth_event_t *)data;
+               if (auth_data->version == WL_AUTH_EVENT_DATA_V1) {
+                       err = wl_bss_handle_sae_auth_v1(cfg, ndev, event, data);
+               } else if (auth_data->version == WL_AUTH_EVENT_DATA_V2) {
+                       err = wl_bss_handle_sae_auth_v2(cfg, ndev, event, data);
+               } else {
+                       printf("unknown auth event data version %x\n",
+                               auth_data->version);
+                       err = BCME_VERSION;
+               }
+       } else {
+               printf("sae auth status failure:%d\n", status);
+       }
+       printf("SAE AUTH result: %d\n", err);
+       return err;
+}
+#endif /* WL_SAE */
+
+static s32
+wl_get_auth_assoc_status(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data)
+{
+       u32 reason = ntoh32(e->reason);
+       u32 event = ntoh32(e->event_type);
+#ifdef WL_SAE
+       uint auth_type = ntoh32(e->auth_type);
+#endif /* WL_SAE */
+       struct wl_security *sec = wl_read_prof(cfg, ndev, WL_PROF_SEC);
+       WL_DBG(("event type : %d, reason : %d\n", event, reason));
+
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+       (void)memcpy_s(&cfg->event_auth_assoc, sizeof(wl_event_msg_t),
+               e, sizeof(wl_event_msg_t));
+       WL_ERR(("event=%d status %d reason %d \n",
+               ntoh32(cfg->event_auth_assoc.event_type),
+               ntoh32(cfg->event_auth_assoc.status),
+               ntoh32(cfg->event_auth_assoc.reason)));
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+       if (sec) {
+               switch (event) {
+               case WLC_E_ASSOC:
+               case WLC_E_AUTH:
+               case WLC_E_AUTH_IND:
+                       sec->auth_assoc_res_status = reason;
+#ifdef WL_SAE
+                       if ((event == WLC_E_AUTH || event == WLC_E_AUTH_IND) &&
+                               auth_type == DOT11_SAE) {
+                               wl_bss_handle_sae_auth(cfg, ndev, e, data);
+                       }
+#endif /* WL_SAE */
+                       break;
+               default:
+                       break;
+               }
+       } else {
+               WL_ERR(("sec is NULL\n"));
+       }
+       return 0;
+}
+
+#ifdef WL_CLIENT_SAE
+static s32
+wl_notify_connect_status_ap_auth(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev, const wl_event_msg_t *e, void *data)
+{
+       bcm_struct_cfgdev *cfgdev = ndev_to_cfgdev(ndev);
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       u8 bsscfgidx = e->bsscfgidx;
+       u8 *mgmt_frame = NULL;
+       u8 *body = NULL;
+       u32 body_len = 0;
+       s32 chan;
+       u16 channel;
+       struct ieee80211_supported_band *band;
+       chanspec_t chanspec;
+       s32 freq;
+       struct ether_addr da;
+       struct ether_addr bssid;
+       u32 event = ntoh32(e->event_type);
+       u32 reason = ntoh32(e->reason);
+       u32 len = ntoh32(e->datalen);
+       s32 err = 0;
+
+       if (!len) {
+               WL_ERR(("event %s(%d) has no payload. status %d reason %d\n",
+                       bcmevent_get_name(event), event, ntoh32(e->status), reason));
+               return 0;
+       }
+
+       body = (u8 *)MALLOCZ(cfg->osh, len);
+       if (body == NULL) {
+               WL_ERR(("Failed to allocate body\n"));
+               return WL_INVALID;
+       }
+       (void)memcpy_s(body, len, data, len);
+
+       err = wldev_iovar_getbuf_bsscfg(ndev, "cur_etheraddr",
+               NULL, 0, cfg->ioctl_buf, WLC_IOCTL_SMLEN, bsscfgidx, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("Could not get cur_etheraddr %d\n", err));
+               goto exit;
+       }
+       (void)memcpy_s(da.octet, ETHER_ADDR_LEN, cfg->ioctl_buf, ETHER_ADDR_LEN);
+
+       bzero(&bssid, sizeof(bssid));
+       err = wldev_ioctl_get(ndev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN);
+       if (unlikely(err)) {
+               WL_ERR(("Could not get bssid %d\n", err));
+               goto exit;
+       }
+
+       err = wldev_iovar_getint(ndev, "chanspec", &chan);
+       if (unlikely(err)) {
+               WL_ERR(("Could not get chanspec %d\n", err));
+               goto exit;
+       }
+       chanspec = wl_chspec_driver_to_host(chan);
+       channel = wf_chspec_ctlchan(chanspec);
+
+       if (channel <= CH_MAX_2G_CHANNEL)
+               band = wiphy->bands[IEEE80211_BAND_2GHZ];
+       else
+               band = wiphy->bands[IEEE80211_BAND_5GHZ];
+       if (!band) {
+               WL_ERR(("No valid band\n"));
+               goto exit;
+       }
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 39) && !defined(WL_COMPAT_WIRELESS)
+       freq = ieee80211_channel_to_frequency(channel);
+#else
+       freq = ieee80211_channel_to_frequency(channel, band->band);
+#endif
+
+       body_len = len;
+       err = wl_frame_get_mgmt(cfg, FC_AUTH, &da, &e->addr, &bssid,
+               &mgmt_frame, &len, body);
+       if (!err) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+               cfg80211_rx_mgmt(cfgdev, freq, 0, mgmt_frame, len, 0);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
+               cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, GFP_ATOMIC);
+#else
+               cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+#endif
+               MFREE(cfg->osh, mgmt_frame, len);
+       }
+
+exit:
+       if (body) {
+               MFREE(cfg->osh, body, body_len);
+       }
+
+       return err;
+}
+#endif /* WL_CLIENT_SAE */
+
+
+/* The mainline kernel >= 3.2.0 has support for indicating new/del station
+ * to AP/P2P GO via events. If this change is backported to kernel for which
+ * this driver is being built, then define WL_CFG80211_STA_EVENT. You
+ * should use this new/del sta event mechanism for BRCM supplicant >= 22.
+ */
+static s32
+wl_notify_connect_status_ap(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = 0;
+       u32 event = ntoh32(e->event_type);
+       u32 reason = ntoh32(e->reason);
+       u32 len = ntoh32(e->datalen);
+       u32 status = ntoh32(e->status);
+
+#if !defined(WL_CFG80211_STA_EVENT) && !defined(WL_COMPAT_WIRELESS) && \
+       (LINUX_VERSION_CODE < KERNEL_VERSION(3, 2, 0))
+       bool isfree = false;
+       u8 *mgmt_frame;
+       u8 bsscfgidx = e->bsscfgidx;
+       s32 freq;
+       u8 *body = NULL;
+       u16 fc = 0;
+       u32 body_len = 0;
+       chanspec_t chanspec;
+       struct ieee80211_supported_band *band;
+       struct ether_addr da;
+       struct ether_addr bssid;
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+#else
+       struct station_info sinfo;
+#endif /* (LINUX_VERSION < VERSION(3,2,0)) && !WL_CFG80211_STA_EVENT && !WL_COMPAT_WIRELESS */
+
+#ifdef BIGDATA_SOFTAP
+       dhd_pub_t *dhdp;
+#endif /* BIGDATA_SOFTAP */
+
+       WL_INFORM_MEM(("[%s] Mode AP/GO. Event:%d status:%d reason:%d\n",
+               ndev->name, event, ntoh32(e->status), reason));
+
+       if (event == WLC_E_AUTH_IND) {
+               wl_get_auth_assoc_status(cfg, ndev, e, data);
+               return 0;
+       }
+       /* if link down, bsscfg is disabled. */
+       if (event == WLC_E_LINK && reason == WLC_E_LINK_BSSCFG_DIS &&
+               wl_get_p2p_status(cfg, IF_DELETING) && (ndev != bcmcfg_to_prmry_ndev(cfg))) {
+               wl_add_remove_eventmsg(ndev, WLC_E_PROBREQ_MSG, false);
+               WL_MSG(ndev->name, "AP mode link down !! \n");
+               complete(&cfg->iface_disable);
+               return 0;
+       }
+
+       if ((event == WLC_E_LINK) && (status == WLC_E_STATUS_SUCCESS) &&
+               (reason == WLC_E_REASON_INITIAL_ASSOC) &&
+               (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_AP)) {
+               if (!wl_get_drv_status(cfg, AP_CREATED, ndev)) {
+                       /* AP/GO brought up successfull in firmware */
+                       WL_MSG(ndev->name, "AP/GO Link up\n");
+                       wl_set_drv_status(cfg, AP_CREATED, ndev);
+                       OSL_SMP_WMB();
+                       wake_up_interruptible(&cfg->netif_change_event);
+
+#ifdef BIGDATA_SOFTAP
+                       wl_ap_stainfo_init(cfg);
+#endif /* BIGDATA_SOFTAP */
+
+#ifdef WL_BCNRECV
+                       /* check fakeapscan is in progress, if progress then abort */
+                       wl_android_bcnrecv_stop(ndev, WL_BCNRECV_CONCURRENCY);
+#endif /* WL_BCNRECV */
+                       wl_cfg80211_check_in4way(cfg, ndev, 0, WL_EXT_STATUS_AP_ENABLED, NULL);
+                       return 0;
+               }
+       }
+
+       if (event == WLC_E_DISASSOC_IND || event == WLC_E_DEAUTH_IND || event == WLC_E_DEAUTH) {
+               WL_MSG_RLMT(ndev->name, &e->addr, ETHER_ADDR_LEN,
+                       "event %s(%d) status %d reason %d\n",
+                       bcmevent_get_name(event), event, ntoh32(e->status), reason);
+       }
+
+#ifdef BIGDATA_SOFTAP
+       if (event == WLC_E_LINK && reason == WLC_E_LINK_BSSCFG_DIS) {
+               WL_ERR(("AP link down - skip get sta data\n"));
+       } else {
+               dhdp = (dhd_pub_t *)(cfg->pub);
+               if (dhdp && dhdp->op_mode & DHD_FLAG_HOSTAP_MODE) {
+                       dhd_schedule_gather_ap_stadata(cfg, ndev, e);
+               }
+       }
+#endif /* BIGDATA_SOFTAP */
+
+#if !defined(WL_CFG80211_STA_EVENT) && !defined(WL_COMPAT_WIRELESS) && \
+       (LINUX_VERSION_CODE < KERNEL_VERSION(3, 2, 0))
+       WL_DBG(("Enter \n"));
+       if (!len && (event == WLC_E_DEAUTH)) {
+               len = 2; /* reason code field */
+               data = &reason;
+       }
+       if (len) {
+               body = (u8 *)MALLOCZ(cfg->osh, len);
+               if (body == NULL) {
+                       WL_ERR(("Failed to allocate body\n"));
+                       return WL_INVALID;
+               }
+       }
+       bzero(&bssid, ETHER_ADDR_LEN);
+       WL_DBG(("Enter event %d ndev %p\n", event, ndev));
+       if (wl_get_mode_by_netdev(cfg, ndev) == WL_INVALID) {
+               MFREE(cfg->osh, body, len);
+               return WL_INVALID;
+       }
+       if (len)
+               memcpy(body, data, len);
+
+       wldev_iovar_getbuf_bsscfg(ndev, "cur_etheraddr",
+               NULL, 0, ioctl_buf, sizeof(ioctl_buf), bsscfgidx, NULL);
+       memcpy(da.octet, ioctl_buf, ETHER_ADDR_LEN);
+       bzero(&bssid, sizeof(bssid));
+       err = wldev_ioctl_get(ndev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN);
+       switch (event) {
+               case WLC_E_ASSOC_IND:
+                       fc = FC_ASSOC_REQ;
+                       break;
+               case WLC_E_REASSOC_IND:
+                       fc = FC_REASSOC_REQ;
+                       break;
+               case WLC_E_DISASSOC_IND:
+                       fc = FC_DISASSOC;
+                       break;
+               case WLC_E_DEAUTH_IND:
+                       fc = FC_DISASSOC;
+                       break;
+               case WLC_E_DEAUTH:
+                       fc = FC_DISASSOC;
+                       break;
+               default:
+                       fc = 0;
+                       goto exit;
+       }
+       err = wldev_iovar_getint(ndev, "chanspec", (s32 *)&chanspec);
+       if (unlikely(err)) {
+               MFREE(cfg->osh, body, len);
+               WL_ERR(("%s: Could not get chanspec %d\n", __FUNCTION__, err));
+               return err;
+       }
+       chanspec = wl_chspec_driver_to_host(chanspec);
+       freq = wl_channel_to_frequency(wf_chspec_ctlchan(chanspec), CHSPEC_BAND(chanspec));
+       body_len = len;
+       err = wl_frame_get_mgmt(cfg, fc, &da, &e->addr, &bssid,
+               &mgmt_frame, &len, body);
+       if (err < 0)
+               goto exit;
+       isfree = true;
+
+       if ((event == WLC_E_ASSOC_IND && reason == DOT11_SC_SUCCESS) ||
+                       (event == WLC_E_DISASSOC_IND) ||
+                       ((event == WLC_E_DEAUTH_IND) || (event == WLC_E_DEAUTH))) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+               cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, 0);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0))
+               cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, 0, GFP_ATOMIC);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || \
+               defined(WL_COMPAT_WIRELESS)
+               cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, GFP_ATOMIC);
+#else
+               cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+#endif /* LINUX_VERSION >= VERSION(3, 18,0) || WL_COMPAT_WIRELESS */
+       }
+
+exit:
+       if (isfree) {
+               MFREE(cfg->osh, mgmt_frame, len);
+       }
+       if (body) {
+               MFREE(cfg->osh, body, body_len);
+       }
+#else /* LINUX_VERSION < VERSION(3,2,0) && !WL_CFG80211_STA_EVENT && !WL_COMPAT_WIRELESS */
+       memset_s(&sinfo, sizeof(sinfo), 0, sizeof(sinfo));
+       if (((event == WLC_E_ASSOC_IND) || (event == WLC_E_REASSOC_IND)) &&
+               reason == DOT11_SC_SUCCESS) {
+               /* Linux ver >= 4.0 assoc_req_ies_len is used instead of
+                * STATION_INFO_ASSOC_REQ_IES flag
+                */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0))
+               sinfo.filled = STA_INFO_BIT(INFO_ASSOC_REQ_IES);
+#endif /*  (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)) */
+               if (!data) {
+                       WL_ERR(("No IEs present in ASSOC/REASSOC_IND"));
+                       return -EINVAL;
+               }
+               sinfo.assoc_req_ies = data;
+               sinfo.assoc_req_ies_len = len;
+               WL_MSG(ndev->name, "new sta event for "MACDBG "\n",
+                       MAC2STRDBG(e->addr.octet));
+               wl_cfg80211_check_in4way(cfg, ndev, DONT_DELETE_GC_AFTER_WPS,
+                       WL_EXT_STATUS_STA_CONNECTED, NULL);
+               cfg80211_new_sta(ndev, e->addr.octet, &sinfo, GFP_ATOMIC);
+#ifdef WL_WPS_SYNC
+               wl_wps_session_update(ndev, WPS_STATE_LINKUP, e->addr.octet);
+#endif /* WL_WPS_SYNC */
+       } else if ((event == WLC_E_DEAUTH_IND) ||
+               ((event == WLC_E_DEAUTH) && (reason != DOT11_RC_RESERVED)) ||
+               (event == WLC_E_DISASSOC_IND)) {
+               /*
+                * WAR: Dongle sends WLC_E_DEAUTH event with DOT11_RC_RESERVED
+                * to delete flowring in case of PCIE Full dongle.
+                * By deleting flowring on SoftAP interface we can avoid any issues
+                * due to stale/bad state of flowring.
+                * Therefore, we don't need to notify the client dissaociation to Hostapd
+                * in this case.
+                * Please refer to the RB:115182 to understand the case more clearly.
+                */
+               WL_MSG_RLMT(ndev->name, &e->addr, ETHER_ADDR_LEN,
+                       "del sta event for "MACDBG "\n", MAC2STRDBG(e->addr.octet));
+               wl_cfg80211_check_in4way(cfg, ndev, DONT_DELETE_GC_AFTER_WPS,
+                       WL_EXT_STATUS_STA_DISCONNECTED, NULL);
+               cfg80211_del_sta(ndev, e->addr.octet, GFP_ATOMIC);
+#ifdef WL_WPS_SYNC
+               wl_wps_session_update(ndev, WPS_STATE_LINKDOWN, e->addr.octet);
+#endif /* WL_WPS_SYNC */
+       }
+#ifdef WL_CLIENT_SAE
+       else if (event == WLC_E_AUTH) {
+               WL_MSG_RLMT(ndev->name, &e->addr, ETHER_ADDR_LEN,
+                       "add sta auth event for "MACDBG "\n", MAC2STRDBG(e->addr.octet));
+               if (wl_get_mode_by_netdev(cfg, ndev) == WL_INVALID) {
+                       WL_ERR(("invalid mode\n"));
+                       return WL_INVALID;
+               }
+               err = wl_notify_connect_status_ap_auth(cfg, ndev, e, data);
+       }
+#endif /* WL_CLIENT_SAE */
+#endif /* LINUX_VERSION < VERSION(3,2,0) && !WL_CFG80211_STA_EVENT && !WL_COMPAT_WIRELESS */
+       return err;
+}
+
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+enum {
+       BIGDATA_ASSOC_REJECT_NO_ACK = 1,
+       BIGDATA_ASSOC_REJECT_FAIL = 2,
+       BIGDATA_ASSOC_REJECT_UNSOLICITED = 3,
+       BIGDATA_ASSOC_REJECT_TIMEOUT = 4,
+       BIGDATA_ASSOC_REJECT_ABORT = 5,
+       BIGDATA_ASSOC_REJECT_NO_NETWWORKS = 6,
+       BIGDATA_ASSOC_REJECT_MAX = 50
+};
+
+int wl_get_connect_failed_status(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e)
+{
+       u32 status = ntoh32(e->status);
+
+       cfg->assoc_reject_status = 0;
+
+       if (status != WLC_E_STATUS_SUCCESS) {
+               WL_ERR(("auth assoc status event=%d e->status %d e->reason %d \n",
+                       ntoh32(cfg->event_auth_assoc.event_type),
+                       (int)ntoh32(cfg->event_auth_assoc.status),
+                       (int)ntoh32(cfg->event_auth_assoc.reason)));
+
+               switch ((int)ntoh32(cfg->event_auth_assoc.status)) {
+                       case WLC_E_STATUS_NO_ACK:
+                               cfg->assoc_reject_status = BIGDATA_ASSOC_REJECT_NO_ACK;
+                               break;
+                       case WLC_E_STATUS_FAIL:
+                               cfg->assoc_reject_status = BIGDATA_ASSOC_REJECT_FAIL;
+                               break;
+                       case WLC_E_STATUS_UNSOLICITED:
+                               cfg->assoc_reject_status = BIGDATA_ASSOC_REJECT_UNSOLICITED;
+                               break;
+                       case WLC_E_STATUS_TIMEOUT:
+                               cfg->assoc_reject_status = BIGDATA_ASSOC_REJECT_TIMEOUT;
+                               break;
+                       case WLC_E_STATUS_ABORT:
+                               cfg->assoc_reject_status = BIGDATA_ASSOC_REJECT_ABORT;
+                               break;
+                       case WLC_E_STATUS_SUCCESS:
+                               if (status == WLC_E_STATUS_NO_NETWORKS) {
+                                       cfg->assoc_reject_status =
+                                               BIGDATA_ASSOC_REJECT_NO_NETWWORKS;
+                                       break;
+                               }
+                       default:
+                               cfg->assoc_reject_status = BIGDATA_ASSOC_REJECT_MAX;
+                               break;
+               }
+               if (cfg->assoc_reject_status) {
+                       if (ntoh32(cfg->event_auth_assoc.event_type) == WLC_E_ASSOC) {
+                               cfg->assoc_reject_status += BIGDATA_ASSOC_REJECT_MAX;
+                       }
+               }
+       }
+
+       WL_ERR(("assoc_reject_status %d \n", cfg->assoc_reject_status));
+
+       return 0;
+}
+
+s32 wl_cfg80211_get_connect_failed_status(struct net_device *dev, char* cmd, int total_len)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       int bytes_written = 0;
+
+       if (cfg == NULL) {
+               return -1;
+       }
+       bytes_written = snprintf(cmd, total_len, "assoc_reject.status %d",
+                       cfg->assoc_reject_status);
+       WL_ERR(("cmd: %s \n", cmd));
+       return bytes_written;
+}
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+
+#ifdef WL_CLIENT_SAE
+static s32
+wl_notify_start_auth(struct bcm_cfg80211 *cfg,
+       bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *e, void *data)
+{
+       struct cfg80211_external_auth_params ext_auth_param;
+       struct net_device *ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+       u32 datalen = be32_to_cpu(e->datalen);
+       wl_ext_auth_evt_t *evt_data = (wl_ext_auth_evt_t *)data;
+       wl_assoc_mgr_cmd_t cmd;
+       int err;
+
+       WL_DBG(("Enter\n"));
+
+       if (!datalen || !data)
+               return BCME_ERROR;
+
+       ext_auth_param.ssid.ssid_len = MIN(evt_data->ssid.SSID_len, DOT11_MAX_SSID_LEN);
+       if (ext_auth_param.ssid.ssid_len)
+               memcpy(&ext_auth_param.ssid.ssid, evt_data->ssid.SSID,
+                       ext_auth_param.ssid.ssid_len);
+
+       memcpy(&ext_auth_param.bssid, &evt_data->bssid, ETHER_ADDR_LEN);
+       ext_auth_param.action = NL80211_EXTERNAL_AUTH_START;
+       ext_auth_param.key_mgmt_suite = ntoh32(WLAN_AKM_SUITE_SAE_SHA256);
+
+       WL_MSG(ndev->name, "BSSID: "MACDBG"\n", MAC2STRDBG(&evt_data->bssid));
+
+       err = cfg80211_external_auth_request(ndev, &ext_auth_param, GFP_KERNEL);
+       if (unlikely(err)) {
+               WL_ERR(("Failed to notify external auth req(%d)\n", err));
+       }
+
+       cmd.version = WL_ASSOC_MGR_CURRENT_VERSION;
+       cmd.length = sizeof(cmd);
+       cmd.cmd = WL_ASSOC_MGR_CMD_PAUSE_ON_EVT;
+       cmd.params = WL_ASSOC_MGR_PARAMS_PAUSE_EVENT_AUTH_RESP;
+       err = wldev_iovar_setbuf(ndev, "assoc_mgr_cmd", (void *)&cmd, sizeof(cmd),
+               cfg->ioctl_buf, WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("Failed to pause assoc(%d)\n", err));
+       }
+
+       return BCME_OK;
+}
+
+static s32
+wl_notify_connect_status_bss(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = 0;
+       u32 event = ntoh32(e->event_type);
+       u32 reason = ntoh32(e->reason);
+       u32 len = ntoh32(e->datalen);
+       u32 status = ntoh32(e->status);
+
+       bool isfree = false;
+       u8 *mgmt_frame;
+       u8 bsscfgidx = e->bsscfgidx;
+       s32 freq;
+       s32 channel;
+       u8 *body = NULL;
+       u16 fc = 0, rssi = 0;
+       bcm_struct_cfgdev *cfgdev = ndev_to_cfgdev(ndev);
+
+       struct ieee80211_supported_band *band;
+       struct ether_addr da;
+       struct ether_addr bssid;
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       channel_info_t ci;
+
+       WL_DBG(("event %d status %d reason %d\n", event, status, reason));
+
+       if (event == WLC_E_AUTH) {
+               struct wl_security *sec;
+               sec = wl_read_prof(cfg, ndev, WL_PROF_SEC);
+
+               if (!(sec->auth_type == NL80211_AUTHTYPE_SAE)) {
+                       WL_DBG(("Abort AUTH processing due to NOT SAE\n"));
+                       return 0;
+               } else {
+                       if (status != WLC_E_STATUS_SUCCESS && !len) {
+                               WL_ERR(("SAE AUTH FAIL EVENT\n"));
+                               wl_cfg80211_check_in4way(cfg, ndev, NO_SCAN_IN4WAY|NO_BTC_IN4WAY|WAIT_DISCONNECTED,
+                                       WL_EXT_STATUS_DISCONNECTED, NULL);
+                               return 0;
+                       }
+               }
+       }
+
+       if (!len && (event == WLC_E_DEAUTH)) {
+               len = 2; /* reason code field */
+               data = &reason;
+       }
+
+       if (len) {
+               body = kzalloc(len, GFP_KERNEL);
+               if (body == NULL) {
+                       WL_ERR(("wl_notify_connect_status: Failed to allocate body\n"));
+                       return WL_INVALID;
+               }
+       }
+
+       memset(&bssid, 0, ETHER_ADDR_LEN);
+       if (wl_get_mode_by_netdev(cfg, ndev) == WL_INVALID) {
+               kfree(body);
+               return WL_INVALID;
+       }
+       if (len)
+               memcpy(body, data, len);
+
+       wldev_iovar_getbuf_bsscfg(ndev, "cur_etheraddr",
+               NULL, 0, cfg->ioctl_buf, WLC_IOCTL_SMLEN, bsscfgidx, &cfg->ioctl_buf_sync);
+       memcpy(da.octet, cfg->ioctl_buf, ETHER_ADDR_LEN);
+       err = wldev_ioctl_get(ndev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN);
+       /* Use e->addr as bssid for Sta case , before association completed */
+       if (err == BCME_NOTASSOCIATED)
+               memcpy(&bssid, &e->addr, ETHER_ADDR_LEN);
+
+       switch (event) {
+               case WLC_E_ASSOC_IND:
+                       fc = FC_ASSOC_REQ;
+                       break;
+               case WLC_E_REASSOC_IND:
+                       fc = FC_REASSOC_REQ;
+                       break;
+               case WLC_E_DISASSOC_IND:
+                       fc = FC_DISASSOC;
+                       break;
+               case WLC_E_DEAUTH_IND:
+                       fc = FC_DISASSOC;
+                       break;
+               case WLC_E_DEAUTH:
+                       fc = FC_DISASSOC;
+                       break;
+               case WLC_E_AUTH:
+                       fc = FC_AUTH;
+                       break;
+               default:
+                       fc = 0;
+                       goto exit;
+       }
+       if ((err = wldev_ioctl_get(ndev, WLC_GET_CHANNEL, &ci, sizeof(ci)))) {
+               kfree(body);
+               return err;
+       }
+
+       channel = dtoh32(ci.hw_channel);
+       if (channel <= CH_MAX_2G_CHANNEL)
+               band = wiphy->bands[IEEE80211_BAND_2GHZ];
+       else
+               band = wiphy->bands[IEEE80211_BAND_5GHZ];
+       if (!band) {
+               WL_ERR(("No valid band\n"));
+               if (body)
+                       kfree(body);
+               return -EINVAL;
+       }
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 39)
+       freq = ieee80211_channel_to_frequency(channel);
+       (void)band->band;
+#else
+       freq = ieee80211_channel_to_frequency(channel, band->band);
+#endif
+
+       err = wl_frame_get_mgmt(cfg, fc, &da, &e->addr, &bssid,
+               &mgmt_frame, &len, body);
+       if (err < 0) {
+               goto exit;
+       }
+       isfree = true;
+
+       if (event == WLC_E_ASSOC_IND && reason == DOT11_SC_SUCCESS) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+               cfg80211_rx_mgmt(cfgdev, freq, rssi,  mgmt_frame, len, 0);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
+               cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, GFP_ATOMIC);
+#else
+               cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+#endif
+       } else if (event == WLC_E_DISASSOC_IND) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+               cfg80211_rx_mgmt(cfgdev, freq, rssi,  mgmt_frame, len, 0);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
+               cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, GFP_ATOMIC);
+#else
+               cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+#endif
+       } else if ((event == WLC_E_DEAUTH_IND) || (event == WLC_E_DEAUTH)) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+               cfg80211_rx_mgmt(cfgdev, freq, rssi,  mgmt_frame, len, 0);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
+               cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, GFP_ATOMIC);
+#else
+               cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+#endif
+       } else if (event == WLC_E_AUTH) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+               cfg80211_rx_mgmt(cfgdev, freq, rssi,  mgmt_frame, len, 0);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0))
+               cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, GFP_ATOMIC);
+#else
+               cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+#endif
+       }
+exit:
+       if (isfree)
+               kfree(mgmt_frame);
+       if (body)
+               kfree(body);
+       return err;
+}
+#endif /* WL_CLIENT_SAE */
+
+static s32
+wl_notify_connect_status_ibss(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = 0;
+       u32 event = ntoh32(e->event_type);
+       u16 flags = ntoh16(e->flags);
+       u32 status =  ntoh32(e->status);
+       bool active;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+       struct ieee80211_channel *channel = NULL;
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       chanspec_t chanspec;
+       u32 freq;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0) */
+
+       if (event == WLC_E_JOIN) {
+               WL_INFORM_MEM(("[%s] joined in IBSS network\n", ndev->name));
+       }
+       if (event == WLC_E_START) {
+               WL_INFORM_MEM(("[%s] started IBSS network\n", ndev->name));
+       }
+       if (event == WLC_E_JOIN || event == WLC_E_START ||
+               (event == WLC_E_LINK && (flags == WLC_EVENT_MSG_LINK))) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+               err = wldev_iovar_getint(ndev, "chanspec", (s32 *)&chanspec);
+               if (unlikely(err)) {
+                       WL_ERR(("Could not get chanspec %d\n", err));
+                       return err;
+               }
+               chanspec = wl_chspec_driver_to_host(chanspec);
+               freq = wl_channel_to_frequency(wf_chspec_ctlchan(chanspec), CHSPEC_BAND(chanspec));
+               channel = ieee80211_get_channel(wiphy, freq);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0) */
+               if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+                       /* ROAM or Redundant */
+                       u8 *cur_bssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+                       if (memcmp(cur_bssid, &e->addr, ETHER_ADDR_LEN) == 0) {
+                               WL_DBG(("IBSS connected event from same BSSID("
+                                       MACDBG "), ignore it\n", MAC2STRDBG(cur_bssid)));
+                               return err;
+                       }
+                       WL_INFORM_MEM(("[%s] IBSS BSSID is changed from " MACDBG " to " MACDBG "\n",
+                               ndev->name, MAC2STRDBG(cur_bssid),
+                               MAC2STRDBG((const u8 *)&e->addr)));
+                       wl_get_assoc_ies(cfg, ndev);
+                       wl_update_prof(cfg, ndev, NULL, (const void *)&e->addr, WL_PROF_BSSID);
+                       wl_update_bss_info(cfg, ndev, false);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+                       cfg80211_ibss_joined(ndev, (const s8 *)&e->addr, channel, GFP_KERNEL);
+#else
+                       cfg80211_ibss_joined(ndev, (const s8 *)&e->addr, GFP_KERNEL);
+#endif
+               }
+               else {
+                       /* New connection */
+                       WL_INFORM_MEM(("[%s] IBSS connected to " MACDBG "\n",
+                               ndev->name, MAC2STRDBG((const u8 *)&e->addr)));
+                       wl_link_up(cfg);
+                       wl_get_assoc_ies(cfg, ndev);
+                       wl_update_prof(cfg, ndev, NULL, (const void *)&e->addr, WL_PROF_BSSID);
+                       wl_update_bss_info(cfg, ndev, false);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+                       cfg80211_ibss_joined(ndev, (const s8 *)&e->addr, channel, GFP_KERNEL);
+#else
+                       cfg80211_ibss_joined(ndev, (const s8 *)&e->addr, GFP_KERNEL);
+#endif
+                       wl_set_drv_status(cfg, CONNECTED, ndev);
+                       active = true;
+                       wl_update_prof(cfg, ndev, NULL, (const void *)&active, WL_PROF_ACT);
+               }
+       } else if ((event == WLC_E_LINK && !(flags & WLC_EVENT_MSG_LINK)) ||
+               event == WLC_E_DEAUTH_IND || event == WLC_E_DISASSOC_IND) {
+               wl_clr_drv_status(cfg, CONNECTED, ndev);
+               wl_link_down(cfg);
+               wl_init_prof(cfg, ndev);
+       }
+       else if (event == WLC_E_SET_SSID && status == WLC_E_STATUS_NO_NETWORKS) {
+               WL_INFORM_MEM(("no action - join fail (IBSS mode)\n"));
+       }
+       else {
+               WL_DBG(("no action (IBSS mode)\n"));
+}
+       return err;
+}
+
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+#define WiFiALL_OUI         "\x50\x6F\x9A"  /* Wi-FiAll OUI */
+#define WiFiALL_OUI_LEN     3
+#define WiFiALL_OUI_TYPE    16
+
+/* 11kv feature flag for big data */
+#define WL_BIGDATA_11KV_QBSSLOAD               0x00000001
+#define WL_BIGDATA_11KV_PROXYARP               0x00000002
+#define WL_BIGDATA_11KV_TFS                    0x00000004
+#define WL_BIGDATA_11KV_SLEEP                  0x00000008
+#define WL_BIGDATA_11KV_TIMBC                  0x00000010
+#define WL_BIGDATA_11KV_BSSTRANS               0x00000020
+#define WL_BIGDATA_11KV_DMS                    0x00000040
+#define WL_BIGDATA_11KV_LINK_MEA               0x00000080
+#define WL_BIGDATA_11KV_NBRREP                 0x00000100
+#define WL_BIGDATA_11KV_BCNPASSIVE             0x00000200
+#define WL_BIGDATA_11KV_BCNACTIVE              0x00000400
+#define WL_BIGDATA_11KV_BCNTABLE               0x00000800
+#define WL_BIGDATA_11KV_BSSAAD                 0x00001000
+#define WL_BIGDATA_11KV_MAX                    0x00002000
+
+#define WL_BIGDATA_SUPPORT_11K         0x00000001
+#define WL_BIGDATA_SUPPORT_11V         0x00000002
+
+typedef struct {
+       uint8   bitmap;
+       uint8   octet_len;
+       uint32  flag;
+} bigdata_11kv_t;
+
+bigdata_11kv_t bigdata_11k_info[] = {
+       {DOT11_RRM_CAP_LINK, DOT11_RRM_CAP_LEN, WL_BIGDATA_11KV_LINK_MEA},
+       {DOT11_RRM_CAP_NEIGHBOR_REPORT, DOT11_RRM_CAP_LEN, WL_BIGDATA_11KV_NBRREP},
+       {DOT11_RRM_CAP_BCN_PASSIVE, DOT11_RRM_CAP_LEN, WL_BIGDATA_11KV_BCNPASSIVE},
+       {DOT11_RRM_CAP_BCN_ACTIVE, DOT11_RRM_CAP_LEN, WL_BIGDATA_11KV_BCNACTIVE},
+       {DOT11_RRM_CAP_BCN_TABLE, DOT11_RRM_CAP_LEN, WL_BIGDATA_11KV_BCNTABLE},
+       {DOT11_RRM_CAP_BSSAAD, DOT11_RRM_CAP_LEN, WL_BIGDATA_11KV_BSSAAD},
+};
+
+bigdata_11kv_t bigdata_11v_info[] = {
+       {DOT11_EXT_CAP_PROXY_ARP, DOT11_EXTCAP_LEN_PROXY_ARP, WL_BIGDATA_11KV_PROXYARP},
+       {DOT11_EXT_CAP_TFS, DOT11_EXTCAP_LEN_TFS, WL_BIGDATA_11KV_TFS},
+       {DOT11_EXT_CAP_WNM_SLEEP, DOT11_EXTCAP_LEN_WNM_SLEEP, WL_BIGDATA_11KV_SLEEP},
+       {DOT11_EXT_CAP_TIMBC, DOT11_EXTCAP_LEN_TIMBC, WL_BIGDATA_11KV_TIMBC},
+       {DOT11_EXT_CAP_BSSTRANS_MGMT, DOT11_EXTCAP_LEN_BSSTRANS, WL_BIGDATA_11KV_BSSTRANS},
+       {DOT11_EXT_CAP_DMS, DOT11_EXTCAP_LEN_DMS, WL_BIGDATA_11KV_DMS}
+};
+
+static void
+wl_get_11kv_info(u8 *ie, u32 ie_len, uint8 *support_11kv, uint32 *flag_11kv)
+{
+       bcm_tlv_t *ie_11kv = NULL;
+       uint32 flag_11k = 0, flag_11v = 0;
+       int i;
+
+       /* parsing QBSS load ie */
+       if ((bcm_parse_tlvs(ie, (u32)ie_len,
+                       DOT11_MNG_QBSS_LOAD_ID)) != NULL) {
+               flag_11k |= WL_BIGDATA_11KV_QBSSLOAD;
+       }
+
+       /* parsing RM IE for 11k */
+       if ((ie_11kv = bcm_parse_tlvs(ie, (u32)ie_len,
+                       DOT11_MNG_RRM_CAP_ID)) != NULL) {
+               for (i = 0; i < ARRAYSIZE(bigdata_11k_info); i++) {
+                       if ((ie_11kv->len >= bigdata_11k_info[i].octet_len) &&
+                                       isset(ie_11kv->data, bigdata_11k_info[i].bitmap)) {
+                               flag_11k |= bigdata_11k_info[i].flag;
+                       }
+               }
+       }
+
+       /* parsing extended cap. IE for 11v */
+       if ((ie_11kv = bcm_parse_tlvs(ie, (u32)ie_len,
+                       DOT11_MNG_EXT_CAP_ID)) != NULL) {
+               for (i = 0; i < ARRAYSIZE(bigdata_11v_info); i++) {
+                       if ((ie_11kv->len >= bigdata_11v_info[i].octet_len) &&
+                                       isset(ie_11kv->data, bigdata_11v_info[i].bitmap)) {
+                               flag_11v |= bigdata_11v_info[i].flag;
+                       }
+               }
+       }
+
+       if (flag_11k > 0) {
+               *support_11kv |= WL_BIGDATA_SUPPORT_11K;
+       }
+
+       if (flag_11v > 0) {
+               *support_11kv |= WL_BIGDATA_SUPPORT_11V;
+       }
+
+       *flag_11kv = flag_11k | flag_11v;
+}
+
+int wl_get_bss_info(struct bcm_cfg80211 *cfg, struct net_device *dev, struct ether_addr const *mac)
+{
+       s32 err = 0;
+       wl_bss_info_v109_1_t *bi;
+       uint8 eabuf[ETHER_ADDR_LEN];
+       u32 rate, channel, freq, supported_rate, nss = 0, mcs_map, mode_80211 = 0;
+       char rate_str[4];
+       u8 *ie = NULL;
+       u32 ie_len;
+       struct wiphy *wiphy;
+       struct cfg80211_bss *bss;
+       bcm_tlv_t *interworking_ie = NULL;
+       bcm_tlv_t *tlv_ie = NULL;
+       bcm_tlv_t *vht_ie = NULL;
+       vndr_ie_t *vndrie;
+       int16 ie_11u_rel_num = -1, ie_mu_mimo_cap = -1;
+       u32 i, remained_len, count = 0;
+       char roam_count_str[4], akm_str[4];
+       s32 val = 0;
+       uint8 support_11kv = 0;
+       uint32 flag_11kv = 0;   /* bit flags of 11kv big data */
+       int cfg_bss_info_len = 0;
+
+       /* get BSS information */
+
+       strlcpy(cfg->bss_info, "x x x x x x x x x x x x x x x x x", sizeof(cfg->bss_info));
+
+       *(u32 *) cfg->extra_buf = htod32(WL_EXTRA_BUF_MAX);
+
+       err = wldev_ioctl_get(dev, WLC_GET_BSS_INFO, cfg->extra_buf, WL_EXTRA_BUF_MAX);
+       if (unlikely(err)) {
+               WL_ERR(("Could not get bss info %d\n", err));
+               cfg->roam_count = 0;
+               return -1;
+       }
+
+       if (!mac) {
+               WL_ERR(("mac is null \n"));
+               cfg->roam_count = 0;
+               return -1;
+       }
+
+       memcpy(eabuf, mac, ETHER_ADDR_LEN);
+
+       bi = (wl_bss_info_v109_1_t *)(cfg->extra_buf + 4);
+       channel = wf_chspec_ctlchan(bi->chanspec);
+       freq = wl_channel_to_frequency(channel, CHSPEC_BAND(bi->chanspec));
+       rate = 0;
+       err = wldev_ioctl_get(dev, WLC_GET_RATE, &rate, sizeof(rate));
+       if (err) {
+               WL_ERR(("Could not get rate (%d)\n", err));
+               snprintf(rate_str, sizeof(rate_str), "x"); /* Unknown */
+
+       } else {
+               rate = dtoh32(rate);
+               snprintf(rate_str, sizeof(rate_str), "%d", (rate/2));
+       }
+
+       /* supported maximum rate */
+       supported_rate = (bi->rateset.rates[bi->rateset.count - 1] & 0x7f) / 2;
+
+       if (supported_rate < 12) {
+               mode_80211 = BIGDATA_DOT11_11B_MODE; /* 11b maximum rate is 11Mbps. 11b mode */
+       } else {
+               /* It's not HT Capable case. */
+               if (channel > 14) {
+                       mode_80211 = BIGDATA_DOT11_11A_MODE; /* 11a mode */
+               } else {
+                       mode_80211 = BIGDATA_DOT11_11G_MODE; /* 11g mode */
+               }
+       }
+
+       if (bi->n_cap) {
+               /* check Rx MCS Map for HT */
+               nss = 0;
+               mode_80211 = BIGDATA_DOT11_11N_MODE;
+               for (i = 0; i < MAX_STREAMS_SUPPORTED; i++) {
+                       int8 bitmap = DOT11_HT_MCS_RATE_MASK;
+                       if (i == MAX_STREAMS_SUPPORTED-1) {
+                               bitmap = DOT11_RATE_MASK;
+                       }
+                       if (bi->basic_mcs[i] & bitmap) {
+                               nss++;
+                       }
+               }
+       }
+
+       if (bi->vht_cap) {
+               nss = 0;
+               mode_80211 = BIGDATA_DOT11_11AC_MODE;
+               for (i = 1; i <= VHT_CAP_MCS_MAP_NSS_MAX; i++) {
+                       mcs_map = VHT_MCS_MAP_GET_MCS_PER_SS(i, dtoh16(bi->vht_rxmcsmap));
+                       if (mcs_map != VHT_CAP_MCS_MAP_NONE) {
+                               nss++;
+                       }
+               }
+       }
+
+#if defined(WL11AX)
+       if (bi->he_cap) {
+               nss = 0;
+               mode_80211 = BIGDATA_DOT11_11AX_MODE;
+               for (i = 1; i <= HE_MCS_MAP_NSS_MAX; i++) {
+                       mcs_map = HE_MCS_NSS_GET_MCS(i, dtoh32(bi->he_rxmcsmap));
+                       if (mcs_map != HE_MCS_CODE_NONE) {
+                               nss++;
+                       }
+               }
+       }
+#endif /* WL11AX */
+
+       if (nss) {
+               nss = nss - 1;
+       }
+
+       wiphy = bcmcfg_to_wiphy(cfg);
+       bss = CFG80211_GET_BSS(wiphy, NULL, eabuf, bi->SSID, bi->SSID_len);
+       if (!bss) {
+               WL_ERR(("Could not find the AP\n"));
+       } else {
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+#if defined(WL_CFG80211_P2P_DEV_IF)
+               ie = (u8 *)bss->ies->data;
+               ie_len = bss->ies->len;
+#else
+               ie = bss->information_elements;
+               ie_len = bss->len_information_elements;
+#endif /* WL_CFG80211_P2P_DEV_IF */
+               GCC_DIAGNOSTIC_POP();
+       }
+
+       if (ie) {
+               ie_mu_mimo_cap = 0;
+               ie_11u_rel_num = 0;
+
+               if (bi->vht_cap) {
+                       if ((vht_ie = bcm_parse_tlvs(ie, ie_len,
+                                       DOT11_MNG_VHT_CAP_ID)) != NULL) {
+                                       if (vht_ie->len >= VHT_CAP_IE_LEN) {
+                                               ie_mu_mimo_cap = (vht_ie->data[2] & 0x08) >> 3;
+                                       }
+                       }
+               }
+
+               if ((interworking_ie = bcm_parse_tlvs(ie, ie_len,
+                               DOT11_MNG_INTERWORKING_ID)) != NULL) {
+                       if ((tlv_ie = bcm_parse_tlvs(ie, ie_len, DOT11_MNG_VS_ID)) != NULL) {
+                               remained_len = ie_len;
+
+                               while (tlv_ie) {
+                                       if (count > MAX_VNDR_IE_NUMBER)
+                                               break;
+
+                                       if (tlv_ie->id == DOT11_MNG_VS_ID) {
+                                               vndrie = (vndr_ie_t *) tlv_ie;
+
+                                               if (vndrie->len < (VNDR_IE_MIN_LEN + 1)) {
+                                                       WL_ERR(("wl_get_bss_info: invalid vndr ie."
+                                                               "length is too small %d\n",
+                                                               vndrie->len));
+                                                       break;
+                                               }
+
+                                               if (!bcmp(vndrie->oui,
+                                                       (u8*)WiFiALL_OUI, WiFiALL_OUI_LEN) &&
+                                                       (vndrie->data[0] == WiFiALL_OUI_TYPE))
+                                               {
+                                                       WL_ERR(("Found Wi-FiAll OUI oui.\n"));
+                                                       ie_11u_rel_num = vndrie->data[1];
+                                                       ie_11u_rel_num = (ie_11u_rel_num & 0xf0)>>4;
+                                                       ie_11u_rel_num += 1;
+
+                                                       break;
+                                               }
+                                       }
+                                       count++;
+                                       tlv_ie = bcm_next_tlv(tlv_ie, &remained_len);
+                               }
+                       }
+               }
+
+               /* get 11kv information from ie of current bss */
+               wl_get_11kv_info(ie, ie_len, &support_11kv, &flag_11kv);
+       }
+
+       for (i = 0; i < bi->SSID_len; i++) {
+               if (bi->SSID[i] == ' ') {
+                       bi->SSID[i] = '_';
+               }
+       }
+
+       /* 0 : None, 1 : OKC, 2 : FT, 3 : CCKM */
+       err = wldev_iovar_getint(dev, "wpa_auth", &val);
+       if (unlikely(err)) {
+               WL_ERR(("could not get wpa_auth (%d)\n", err));
+               snprintf(akm_str, sizeof(akm_str), "x"); /* Unknown */
+       } else {
+               WL_ERR(("wpa_auth val %d \n", val));
+                       if (val & WPA2_AUTH_FT) {
+                               snprintf(akm_str, sizeof(akm_str), "2");
+                       } else if (val & (WPA_AUTH_UNSPECIFIED | WPA2_AUTH_UNSPECIFIED)) {
+                               snprintf(akm_str, sizeof(akm_str), "1");
+                       } else {
+                               snprintf(akm_str, sizeof(akm_str), "0");
+                       }
+       }
+
+       if (cfg->roam_offload) {
+               snprintf(roam_count_str, sizeof(roam_count_str), "x"); /* Unknown */
+       } else {
+               snprintf(roam_count_str, sizeof(roam_count_str), "%d", cfg->roam_count);
+       }
+       cfg->roam_count = 0;
+
+       WL_ERR(("BSSID:" MACDBG " SSID %s \n", MAC2STRDBG(eabuf), "*****"));
+       WL_ERR(("freq:%d, BW:%s, RSSI:%d dBm, Rate:%d Mbps, 11mode:%d, stream:%d,"
+                               "MU-MIMO:%d, Passpoint:%d, SNR:%d, Noise:%d, \n"
+                               "akm:%s, roam:%s, 11kv:%d/%d \n",
+                               freq, wf_chspec_to_bw_str(bi->chanspec),
+                               dtoh32(bi->RSSI), (rate / 2), mode_80211, nss,
+                               ie_mu_mimo_cap, ie_11u_rel_num, bi->SNR, bi->phy_noise,
+                               akm_str, roam_count_str, support_11kv, flag_11kv));
+
+       if (ie) {
+               snprintf(cfg->bss_info, GET_BSS_INFO_LEN,
+                               MACOUI" %d %s %d %s %d %d %d %d %d %d %s %s %d %d",
+                               MACOUI2STR(eabuf), freq, wf_chspec_to_bw_str(bi->chanspec),
+                               dtoh32(bi->RSSI), rate_str, mode_80211, nss, ie_mu_mimo_cap,
+                               ie_11u_rel_num, bi->SNR, bi->phy_noise, akm_str, roam_count_str,
+                               support_11kv, flag_11kv);
+       } else {
+               /* ie_mu_mimo_cap and ie_11u_rel_num is unknow. */
+               snprintf(cfg->bss_info, GET_BSS_INFO_LEN,
+                               MACOUI" %d %s %d %s %d %d x x %d %d %s %s x x",
+                               MACOUI2STR(eabuf), freq, wf_chspec_to_bw_str(bi->chanspec),
+                               dtoh32(bi->RSSI), rate_str, mode_80211, nss, bi->SNR,
+                               bi->phy_noise, akm_str, roam_count_str);
+       }
+
+       cfg_bss_info_len = strlen(cfg->bss_info);
+       if (GET_BSS_INFO_LEN > cfg_bss_info_len) {
+               uint16 full_cnt = 0, partial_cnt = 0;
+               bool cnt_valid = FALSE;
+
+#if defined(DHD_PUB_ROAM_EVT)
+               wl_roam_stats_v1_t *roam_elem =
+                       (wl_roam_stats_v1_t *)dhd_get_roam_evt((dhd_pub_t *)cfg->pub);
+
+               if (roam_elem && roam_elem->version == WL_ROAM_STATS_VER_1) {
+                       wl_roam_stats_v1_t *roam_elem_v1;
+                       roam_elem_v1 = (wl_roam_stats_v1_t *)(uintptr_t)roam_elem;
+
+                       cnt_valid = TRUE;
+                       full_cnt = roam_elem_v1->full_roam_scan_cnt;
+                       partial_cnt = roam_elem_v1->partial_roam_scan_cnt;
+               }
+#endif /* DHD_PUB_ROAM_EVT */
+               if (cnt_valid) {
+                       WL_ERR(("GET_BSS: full roam scan count:%d partial roam scan count:%d\n",
+                               full_cnt, partial_cnt));
+                       snprintf(&cfg->bss_info[cfg_bss_info_len],
+                               GET_BSS_INFO_LEN - cfg_bss_info_len, " %d %d",
+                               full_cnt, partial_cnt);
+               } else {
+                       WL_ERR(("GET_BSS: roam scan count invalid\n"));
+                       snprintf(&cfg->bss_info[cfg_bss_info_len],
+                               GET_BSS_INFO_LEN - cfg_bss_info_len, " x x");
+               }
+       } else {
+               WL_ERR(("Buffer to short to save roam info\n"));
+       }
+
+       CFG80211_PUT_BSS(wiphy, bss);
+
+       return 0;
+}
+
+s32 wl_cfg80211_get_bss_info(struct net_device *dev, char* cmd, int total_len)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       if (cfg == NULL) {
+               return -1;
+       }
+
+       if (total_len < GET_BSS_INFO_LEN) {
+               WL_ERR(("wl_cfg80211_get_bss_info: Buffer insuffient %d\n", total_len));
+               return -1;
+       }
+
+       bzero(cmd, total_len);
+       memcpy(cmd, cfg->bss_info, GET_BSS_INFO_LEN);
+
+       WL_ERR_KERN(("cmd: %s \n", cmd));
+
+       return GET_BSS_INFO_LEN;
+}
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+
+void wl_cfg80211_disassoc(struct net_device *ndev, uint32 reason)
+{
+       scb_val_t scbval;
+       s32 err;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       BCM_REFERENCE(cfg);
+       BCM_REFERENCE(dhdp);
+       DHD_STATLOG_CTRL(dhdp, ST(DISASSOC_INT_START),
+               dhd_net2idx(dhdp->info, ndev), WLAN_REASON_DEAUTH_LEAVING);
+
+       memset_s(&scbval, sizeof(scb_val_t), 0x0, sizeof(scb_val_t));
+       scbval.val = htod32(reason);
+       err = wldev_ioctl_set(ndev, WLC_DISASSOC, &scbval, sizeof(scb_val_t));
+       if (err < 0) {
+               WL_ERR(("WLC_DISASSOC error %d\n", err));
+       } else {
+               WL_INFORM_MEM(("wl disassoc. reason:%d\n", reason));
+       }
+}
+void wl_cfg80211_del_all_sta(struct net_device *ndev, uint32 reason)
+{
+       struct net_device *dev;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       scb_val_t scb_val;
+       int err;
+       char mac_buf[MAX_NUM_OF_ASSOCIATED_DEV *
+               sizeof(struct ether_addr) + sizeof(uint)] = {0};
+       struct maclist *assoc_maclist = (struct maclist *)mac_buf;
+       int num_associated = 0;
+
+       dev = ndev_to_wlc_ndev(ndev, cfg);
+
+       if (p2p_is_on(cfg)) {
+               /* Suspend P2P discovery search-listen to prevent it from changing the
+                * channel.
+                */
+               if ((wl_cfgp2p_discover_enable_search(cfg, false)) < 0) {
+                       WL_ERR(("Can not disable discovery mode\n"));
+                       return;
+               }
+       }
+
+       assoc_maclist->count = MAX_NUM_OF_ASSOCIATED_DEV;
+       err = wldev_ioctl_get(ndev, WLC_GET_ASSOCLIST,
+               assoc_maclist, sizeof(mac_buf));
+       if (err < 0)
+               WL_ERR(("WLC_GET_ASSOCLIST error %d\n", err));
+       else
+               num_associated = assoc_maclist->count;
+
+       memset(scb_val.ea.octet, 0xff, ETHER_ADDR_LEN);
+       scb_val.val = DOT11_RC_DEAUTH_LEAVING;
+       scb_val.val = htod32(reason);
+       err = wldev_ioctl_set(dev, WLC_SCB_DEAUTHENTICATE_FOR_REASON, &scb_val,
+                       sizeof(scb_val_t));
+       if (err < 0) {
+               WL_ERR(("WLC_SCB_DEAUTHENTICATE_FOR_REASON err %d\n", err));
+       }
+
+       /* WAR Wait for the deauth event to come, supplicant will do the
+        * delete iface immediately and we will have problem in sending
+        * deauth frame if we delete the bss in firmware
+        * But we do not need additional delays for this WAR
+        * during P2P connection.
+        *
+        * Supplicant call this function with BCAST after doing
+        * wl_cfg80211_del_station() all GC stations with each addr.
+        * So, 400 ms delay can be called only once when GO disconnect all GC
+       */
+       if (num_associated > 0)
+               wl_delay(400);
+
+       return;
+}
+/* API to handle the Deauth from the AP.
+* For now we are deleting the PMKID cache in DHD/FW
+* in case of current connection is using SAE authnetication
+*/
+static s32
+wl_cfg80211_handle_deauth_ind(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data)
+{
+       int err = BCME_OK;
+#ifdef WL_SAE
+       uint8 bssid[ETHER_ADDR_LEN];
+       struct cfg80211_pmksa pmksa;
+       s32 val = 0;
+       struct wlc_ssid *curssid;
+       pmkid_list_v3_t *spmk_list = &cfg->spmk_info_list->pmkids;
+       pmkid_v3_t *t_pmkid = NULL;
+       int idx;
+       bool bFound = FALSE;
+
+       err = wldev_iovar_getint(ndev, "wpa_auth", &val);
+       if (unlikely(err)) {
+               WL_ERR(("could not get wpa_auth (%d)\n", err));
+               goto done;
+       }
+       if (val == WPA3_AUTH_SAE_PSK) {
+               (void)memcpy_s(bssid, ETHER_ADDR_LEN,
+               (const uint8*)&e->addr, ETHER_ADDR_LEN);
+               memset_s(&pmksa, sizeof(pmksa), 0, sizeof(pmksa));
+               pmksa.bssid = bssid;
+               WL_INFORM_MEM(("Deleting the PMKSA for SAE AP "MACDBG,
+                       MAC2STRDBG(e->addr.octet)));
+               wl_cfg80211_del_pmksa(cfg->wdev->wiphy, ndev, &pmksa);
+               curssid = wl_read_prof(cfg, ndev, WL_PROF_SSID);
+               for (idx = 0; idx < spmk_list->count; idx++) {
+                       t_pmkid = &spmk_list->pmkid[idx];
+                       if (curssid->SSID_len == t_pmkid->ssid_len &&
+                               !memcmp(curssid->SSID, t_pmkid->ssid, curssid->SSID_len)) {
+                               bFound = TRUE;
+                               break;
+                       }
+               }
+               if (!bFound) {
+                       goto done;
+               }
+               for (; idx < spmk_list->count - 1; idx++) {
+                       memcpy_s(&spmk_list->pmkid[idx], sizeof(pmkid_v3_t),
+                               &spmk_list->pmkid[idx + 1], sizeof(pmkid_v3_t));
+               }
+               spmk_list->count--;
+       }
+done:
+#endif /* WL_SAE */
+       return err;
+}
+
+static void
+wl_cache_assoc_resp_ies(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data)
+{
+       struct wl_connect_info *conn_info = wl_to_conn(cfg);
+       u32 datalen = ntoh32(e->datalen);
+       u32 event_type = ntoh32(e->event_type);
+
+       if (data && datalen <= sizeof(conn_info->resp_ie)) {
+               conn_info->resp_ie_len = datalen;
+               WL_DBG((" assoc resp IES len = %d\n", conn_info->resp_ie_len));
+               bzero(conn_info->resp_ie, sizeof(conn_info->resp_ie));
+               (void)memcpy_s(conn_info->resp_ie, sizeof(conn_info->resp_ie),
+                       data, datalen);
+
+               WL_INFORM_MEM(("[%s] copied assoc resp ies, sent to upper layer:"
+                       "event %d reason=%d ie_len=%d from " MACDBG "\n",
+                       ndev->name,     event_type, ntoh32(e->reason), datalen,
+                       MAC2STRDBG((const u8*)(&e->addr))));
+       }
+}
+
+#ifdef WLMESH_CFG80211
+static s32
+wl_notify_connect_status_mesh(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = 0;
+       u32 event = ntoh32(e->event_type);
+       u32 reason = ntoh32(e->reason);
+       u32 len = ntoh32(e->datalen);
+       u32 status = ntoh32(e->status);
+
+#if !defined(WL_CFG80211_STA_EVENT) && !defined(WL_COMPAT_WIRELESS) && \
+       (LINUX_VERSION_CODE < KERNEL_VERSION(3, 2, 0))
+       bool isfree = false;
+       u8 *mgmt_frame;
+       u8 bsscfgidx = e->bsscfgidx;
+       s32 freq;
+       s32 channel;
+       u8 *body = NULL;
+       u16 fc = 0;
+       u32 body_len = 0;
+
+       struct ieee80211_supported_band *band;
+       struct ether_addr da;
+       struct ether_addr bssid;
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       channel_info_t ci;
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+#else
+       struct station_info sinfo;
+#endif /* (LINUX_VERSION < VERSION(3,2,0)) && !WL_CFG80211_STA_EVENT && !WL_COMPAT_WIRELESS */
+
+       WL_INFORM_MEM(("[%s] Mode Mesh. Event:%d status:%d reason:%d\n",
+               ndev->name, event, ntoh32(e->status), reason));
+
+       /* if link down, bsscfg is disabled. */
+       if (event == WLC_E_LINK && reason == WLC_E_LINK_BSSCFG_DIS &&
+                       (ndev != bcmcfg_to_prmry_ndev(cfg))) {
+               WL_MSG(ndev->name, "Mesh mode link down !! \n");
+               return 0;
+       }
+
+       if ((event == WLC_E_LINK) && (status == WLC_E_STATUS_SUCCESS) &&
+                       (reason == WLC_E_REASON_INITIAL_ASSOC)) {
+               /* AP/GO brought up successfull in firmware */
+               WL_MSG(ndev->name, "Mesh Link up\n");
+               return 0;
+       }
+
+       if (event == WLC_E_DISASSOC_IND || event == WLC_E_DEAUTH_IND || event == WLC_E_DEAUTH) {
+               WL_MSG(ndev->name, "event %s(%d) status %d reason %d\n",
+               bcmevent_get_name(event), event, ntoh32(e->status), reason);
+       }
+
+#if !defined(WL_CFG80211_STA_EVENT) && !defined(WL_COMPAT_WIRELESS) && \
+       (LINUX_VERSION_CODE < KERNEL_VERSION(3, 2, 0))
+       WL_DBG(("Enter \n"));
+       if (!len && (event == WLC_E_DEAUTH)) {
+               len = 2; /* reason code field */
+               data = &reason;
+       }
+       if (len) {
+               body = (u8 *)MALLOCZ(cfg->osh, len);
+               if (body == NULL) {
+                       WL_ERR(("Failed to allocate body\n"));
+                       return WL_INVALID;
+               }
+       }
+       bzero(&bssid, ETHER_ADDR_LEN);
+       WL_DBG(("Enter event %d ndev %p\n", event, ndev));
+       if (wl_get_mode_by_netdev(cfg, ndev) == WL_INVALID) {
+               MFREE(cfg->osh, body, len);
+               return WL_INVALID;
+       }
+       if (len)
+               memcpy(body, data, len);
+
+       wldev_iovar_getbuf_bsscfg(ndev, "cur_etheraddr",
+               NULL, 0, ioctl_buf, sizeof(ioctl_buf), bsscfgidx, NULL);
+       memcpy(da.octet, ioctl_buf, ETHER_ADDR_LEN);
+       bzero(&bssid, sizeof(bssid));
+       err = wldev_ioctl_get(ndev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN);
+       switch (event) {
+               case WLC_E_ASSOC_IND:
+                       fc = FC_ASSOC_REQ;
+                       break;
+               case WLC_E_REASSOC_IND:
+                       fc = FC_REASSOC_REQ;
+                       break;
+               case WLC_E_DISASSOC_IND:
+                       fc = FC_DISASSOC;
+                       break;
+               case WLC_E_DEAUTH_IND:
+                       fc = FC_DISASSOC;
+                       break;
+               case WLC_E_DEAUTH:
+                       fc = FC_DISASSOC;
+                       break;
+               default:
+                       fc = 0;
+                       goto exit;
+       }
+       bzero(&ci, sizeof(ci));
+       if ((err = wldev_ioctl_get(ndev, WLC_GET_CHANNEL, &ci, sizeof(ci)))) {
+               MFREE(cfg->osh, body, len);
+               return err;
+       }
+
+       channel = dtoh32(ci.hw_channel);
+       if (channel <= CH_MAX_2G_CHANNEL)
+               band = wiphy->bands[IEEE80211_BAND_2GHZ];
+       else
+               band = wiphy->bands[IEEE80211_BAND_5GHZ];
+       if (!band) {
+               WL_ERR(("No valid band\n"));
+               if (body) {
+                       MFREE(cfg->osh, body, len);
+               }
+               return -EINVAL;
+       }
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 39) && !defined(WL_COMPAT_WIRELESS)
+       freq = ieee80211_channel_to_frequency(channel);
+       (void)band->band;
+#else
+       freq = ieee80211_channel_to_frequency(channel, band->band);
+#endif // endif
+       body_len = len;
+       err = wl_frame_get_mgmt(cfg, fc, &da, &e->addr, &bssid,
+               &mgmt_frame, &len, body);
+       if (err < 0)
+               goto exit;
+       isfree = true;
+
+       if ((event == WLC_E_ASSOC_IND && reason == DOT11_SC_SUCCESS) ||
+                       (event == WLC_E_DISASSOC_IND) ||
+                       ((event == WLC_E_DEAUTH_IND) || (event == WLC_E_DEAUTH))) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+               cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, 0);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0))
+               cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, 0, GFP_ATOMIC);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || \
+               defined(WL_COMPAT_WIRELESS)
+               cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, GFP_ATOMIC);
+#else
+               cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+#endif /* LINUX_VERSION >= VERSION(3, 18,0) || WL_COMPAT_WIRELESS */
+       }
+
+exit:
+       if (isfree) {
+               MFREE(cfg->osh, mgmt_frame, len);
+       }
+       if (body) {
+               MFREE(cfg->osh, body, body_len);
+       }
+#else /* LINUX_VERSION < VERSION(3,2,0) && !WL_CFG80211_STA_EVENT && !WL_COMPAT_WIRELESS */
+       memset(&sinfo, 0, sizeof(struct station_info));
+       sinfo.filled = 0;
+       if (((event == WLC_E_ASSOC_IND) || (event == WLC_E_REASSOC_IND)) &&
+               reason == DOT11_SC_SUCCESS) {
+               /* Linux ver >= 4.0 assoc_req_ies_len is used instead of
+                * STATION_INFO_ASSOC_REQ_IES flag
+                */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0))
+               sinfo.filled = STA_INFO_BIT(INFO_ASSOC_REQ_IES);
+#endif /*  (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)) */
+               if (!data) {
+                       WL_ERR(("No IEs present in ASSOC/REASSOC_IND"));
+                       return -EINVAL;
+               }
+               sinfo.assoc_req_ies = data;
+               sinfo.assoc_req_ies_len = len;
+               WL_MSG(ndev->name, "new sta event for "MACDBG "\n",
+                       MAC2STRDBG(e->addr.octet));
+               cfg80211_new_sta(ndev, e->addr.octet, &sinfo, GFP_ATOMIC);
+       } else if ((event == WLC_E_DEAUTH_IND) ||
+               ((event == WLC_E_DEAUTH) && (reason != DOT11_RC_RESERVED)) ||
+               (event == WLC_E_DISASSOC_IND)) {
+               WL_MSG(ndev->name, "del sta event for "MACDBG "\n",
+                       MAC2STRDBG(e->addr.octet));
+               cfg80211_del_sta(ndev, e->addr.octet, GFP_ATOMIC);
+       }
+#endif /* LINUX_VERSION < VERSION(3,2,0) && !WL_CFG80211_STA_EVENT && !WL_COMPAT_WIRELESS */
+       return err;
+}
+#endif /* WLMESH_CFG80211 */
+
+static s32
+wl_notify_connect_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       bool act;
+       struct net_device *ndev = NULL;
+       s32 err = 0;
+       u32 event = ntoh32(e->event_type);
+       u32 datalen = ntoh32(e->datalen);
+       struct wiphy *wiphy = NULL;
+       struct cfg80211_bss *bss = NULL;
+       struct wlc_ssid *ssid = NULL;
+       u8 *bssid = 0;
+       s32 bssidx = 0;
+       u8 *ie_ptr = NULL;
+       uint32 ie_len = 0;
+
+       dhd_pub_t *dhdp;
+       u32 mode;
+       int vndr_oui_num = 0;
+       char vndr_oui[MAX_VNDR_OUI_STR_LEN] = {0, };
+       bool loc_gen = false;
+#ifdef DHD_LOSSLESS_ROAMING
+       struct wl_security *sec;
+#endif /* DHD_LOSSLESS_ROAMING */
+#if defined(DHDTCPSYNC_FLOOD_BLK) && defined(CUSTOMER_TCPSYNC_FLOOD_DIS_RC)
+       dhd_if_t *ifp = NULL;
+#endif /* DHDTCPSYNC_FLOOD_BLK && CUSTOMER_TCPSYNC_FLOOD_DIS_RC */
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+#ifdef DHD_LOSSLESS_ROAMING
+       sec = wl_read_prof(cfg, ndev, WL_PROF_SEC);
+#endif /* DHD_LOSSLESS_ROAMING */
+       dhdp = (dhd_pub_t *)(cfg->pub);
+       BCM_REFERENCE(dhdp);
+
+       mode = wl_get_mode_by_netdev(cfg, ndev);
+       /* Push link events to upper layer log */
+       SUPP_LOG(("[%s] Mode:%d event:%d status:0x%x reason:%d\n",
+               ndev->name, mode, ntoh32(e->event_type),
+               ntoh32(e->status),  ntoh32(e->reason)));
+       if (mode == WL_MODE_AP) {
+               err = wl_notify_connect_status_ap(cfg, ndev, e, data);
+#ifdef WLMESH_CFG80211
+       } else if (mode == WL_MODE_MESH) {
+               err = wl_notify_connect_status_mesh(cfg, ndev, e, data);
+#endif /* WLMESH_CFG80211 */
+       } else if (mode == WL_MODE_IBSS) {
+               err = wl_notify_connect_status_ibss(cfg, ndev, e, data);
+       } else if (mode == WL_MODE_BSS) {
+               WL_INFORM_MEM(("[%s] Mode BSS. event:%d status:%d reason:%d\n",
+                       ndev->name, ntoh32(e->event_type),
+                       ntoh32(e->status),  ntoh32(e->reason)));
+
+               if (!wl_get_drv_status(cfg, CFG80211_CONNECT, ndev)) {
+                       /* Join attempt via non-cfg80211 interface.
+                        * Don't send resultant events to cfg80211
+                        * layer
+                        */
+                       WL_INFORM_MEM(("Event received in non-cfg80211"
+                               " connect state. Ignore\n"));
+                       return BCME_OK;
+               }
+#ifdef WL_CLIENT_SAE
+               if (event == WLC_E_AUTH)
+                       wl_notify_connect_status_bss(cfg, ndev, e, data);
+#endif /* WL_CLIENT_SAE */
+
+               if (event == WLC_E_ASSOC || event == WLC_E_AUTH) {
+                       wl_get_auth_assoc_status(cfg, ndev, e, data);
+                       return 0;
+               }
+               if (event == WLC_E_ASSOC_RESP_IE) {
+                       if (ntoh32(e->status) != WLC_E_STATUS_SUCCESS) {
+                               wl_cache_assoc_resp_ies(cfg, ndev, e, data);
+                       }
+                       return 0;
+               }
+
+               DHD_DISABLE_RUNTIME_PM((dhd_pub_t *)cfg->pub);
+
+               if (wl_is_linkup(cfg, e, ndev)) {
+                       wl_link_up(cfg);
+                       act = true;
+                       if (!wl_get_drv_status(cfg, DISCONNECTING, ndev)) {
+                               WL_INFORM_MEM(("[%s] link up for bssid " MACDBG "\n",
+                                       ndev->name, MAC2STRDBG((const u8*)(&e->addr))));
+                               if ((event == WLC_E_LINK) &&
+                                       (ntoh16(e->flags) & WLC_EVENT_MSG_LINK) &&
+                                       !wl_get_drv_status(cfg, CONNECTED, ndev) &&
+                                       !wl_get_drv_status(cfg, CONNECTING, ndev)) {
+                                       WL_INFORM_MEM(("link up in non-connected/"
+                                               "non-connecting state\n"));
+                                       wl_cfg80211_disassoc(ndev, WLAN_REASON_DEAUTH_LEAVING);
+                                       return BCME_OK;
+                               }
+
+#ifdef WL_WPS_SYNC
+                               /* Avoid invocation for Roam cases */
+                               if ((event == WLC_E_LINK) &&
+                                       !wl_get_drv_status(cfg, CONNECTED, ndev)) {
+                                       wl_wps_session_update(ndev,
+                                               WPS_STATE_LINKUP, e->addr.octet);
+                               }
+#endif /* WL_WPS_SYNC */
+
+#ifdef DHD_EVENT_LOG_FILTER
+                               if (event == WLC_E_LINK && ndev == bcmcfg_to_prmry_ndev(cfg)) {
+                                       int roam = FALSE;
+                                       uint8 eth_addr[ETHER_ADDR_LEN];
+                                       if (TRUE &&
+#ifdef DHD_LOSSLESS_ROAMING
+                                               !cfg->roam_offload &&
+#endif /* DHD_LOSSLESS_ROAMING */
+                                               wl_get_drv_status(cfg, CONNECTED, ndev)) {
+                                               roam = TRUE;
+                                       }
+                                       memcpy(eth_addr, &(e->addr), ETHER_ADDR_LEN);
+                                       dhd_event_log_filter_notify_connect_done(dhdp,
+                                               eth_addr, roam);
+                               }
+#endif /* DHD_EVENT_LOG_FILTER */
+                               if (event == WLC_E_LINK &&
+#ifdef DHD_LOSSLESS_ROAMING
+                                       !cfg->roam_offload &&
+                                       !IS_AKM_SUITE_FT(sec) &&
+#endif /* DHD_LOSSLESS_ROAMING */
+                                       wl_get_drv_status(cfg, CONNECTED, ndev)) {
+                                       wl_bss_roaming_done(cfg, ndev, e, data);
+                                       /* Arm pkt logging timer */
+                                       dhd_dump_mod_pkt_timer(dhdp, PKT_CNT_RSN_ROAM);
+                               } else {
+                                       /* Initial Association */
+                                       wl_update_prof(cfg, ndev, e, &act, WL_PROF_ACT);
+#ifdef ESCAN_CHANNEL_CACHE
+                                       /* Update RCC list in linkup, FW clears RCC in join path */
+                                       wl_update_rcc_list(ndev);
+#endif /* ESCAN_CHANNEL_CACHE */
+                                       wl_bss_connect_done(cfg, ndev, e, data, true);
+                                       if (ndev == bcmcfg_to_prmry_ndev(cfg)) {
+                                               vndr_oui_num = wl_vndr_ies_get_vendor_oui(cfg,
+                                                       ndev, vndr_oui, ARRAY_SIZE(vndr_oui));
+                                               if (vndr_oui_num > 0) {
+                                                       WL_INFORM_MEM(("[%s] vendor oui: %s\n",
+                                                               ndev->name, vndr_oui));
+                                               }
+                                       }
+                                       if (event == WLC_E_LINK) {
+                                               /* Arm pkt logging timer */
+                                               dhd_dump_mod_pkt_timer(dhdp, PKT_CNT_RSN_CONNECT);
+                                       }
+                                       WL_DBG(("joined in BSS network \"%s\"\n",
+                                               ((struct wlc_ssid *)wl_read_prof(cfg, ndev,
+                                                       WL_PROF_SSID))->SSID));
+                               }
+#ifdef WBTEXT
+                               if (ndev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION &&
+                                       dhdp->wbtext_support && event == WLC_E_SET_SSID) {
+                                       /* set wnm_keepalives_max_idle after association */
+                                       wl_cfg80211_wbtext_set_wnm_maxidle(cfg, ndev);
+                               }
+#endif /* WBTEXT */
+                       }
+                       wl_update_prof(cfg, ndev, e, &act, WL_PROF_ACT);
+                       wl_update_prof(cfg, ndev, NULL, (const void *)&e->addr, WL_PROF_BSSID);
+
+               } else if (wl_is_linkdown(cfg, e) ||
+                               ((event == WLC_E_SET_SSID) &&
+                               (ntoh32(e->status) != WLC_E_STATUS_SUCCESS) &&
+                               (wl_get_drv_status(cfg, CONNECTED, ndev)))) {
+                       if (wl_is_linkdown(cfg, e)) {
+                               /* Clear IEs for disaasoc */
+                               if ((bssidx = wl_get_bssidx_by_wdev(cfg,
+                                       ndev->ieee80211_ptr)) < 0) {
+                                       WL_ERR(("Find index failed\n"));
+                               } else {
+                                       WL_ERR(("link down--clearing disconnect IEs\n"));
+                                       if ((err =  wl_cfg80211_set_mgmt_vndr_ies(cfg,
+                                               ndev_to_cfgdev(ndev), bssidx, VNDR_IE_DISASSOC_FLAG,
+                                               NULL, 0)) != BCME_OK) {
+                                               WL_ERR(("Failed to clear ies err = %d\n", err));
+                                       }
+                               }
+#ifdef WL_GET_RCC
+                               wl_android_get_roam_scan_chanlist(cfg);
+#endif /* WL_GET_RCC */
+#ifdef WES_SUPPORT
+                               if (cfg->ncho_mode) {
+                                       wl_android_set_ncho_mode(ndev, OFF);
+                               }
+#endif /* WES_SUPPORT */
+                       }
+
+                       WL_INFORM_MEM(("link down. connection state bit status: [%u:%u:%u:%u]\n",
+                               wl_get_drv_status(cfg, CONNECTING, ndev),
+                               wl_get_drv_status(cfg, CONNECTED, ndev),
+                               wl_get_drv_status(cfg, DISCONNECTING, ndev),
+                               wl_get_drv_status(cfg, NESTED_CONNECT, ndev)));
+
+                               /* clear timestamps on disconnect */
+                               CLR_TS(cfg, conn_start);
+                               CLR_TS(cfg, conn_cmplt);
+                               CLR_TS(cfg, authorize_start);
+                               CLR_TS(cfg, authorize_cmplt);
+#ifdef WL_WPS_SYNC
+                       {
+                               u8 wps_state;
+                               if ((event == WLC_E_SET_SSID) &&
+                                       (ntoh32(e->status) != WLC_E_STATUS_SUCCESS)) {
+                                       /* connect fail */
+                                       wps_state = WPS_STATE_CONNECT_FAIL;
+                               } else {
+                                       wps_state = WPS_STATE_LINKDOWN;
+                               }
+                               if (wl_wps_session_update(ndev,
+                                       wps_state, e->addr.octet) == BCME_UNSUPPORTED) {
+                                       /* Unexpected event. Ignore it. */
+                                       return 0;
+                               }
+               }
+#endif /* WL_WPS_SYNC */
+
+                       if (wl_get_drv_status(cfg, DISCONNECTING, ndev) &&
+                               (wl_get_drv_status(cfg, NESTED_CONNECT, ndev) ||
+                               wl_get_drv_status(cfg, CONNECTING, ndev))) {
+                               /* wl_cfg80211_connect was called before 'DISCONNECTING' was
+                                * cleared. Deauth/Link down event is caused by WLC_DISASSOC
+                                * command issued from the wl_cfg80211_connect context. Ignore
+                                * the event to avoid pre-empting the current connection
+                                */
+                               WL_DBG(("Nested connection case. Drop event. \n"));
+                               wl_cfg80211_check_in4way(cfg, ndev, NO_SCAN_IN4WAY|NO_BTC_IN4WAY|WAIT_DISCONNECTED,
+                                       WL_EXT_STATUS_DISCONNECTED, NULL);
+                               wl_clr_drv_status(cfg, NESTED_CONNECT, ndev);
+                               wl_clr_drv_status(cfg, DISCONNECTING, ndev);
+                               /* Not in 'CONNECTED' state, clear it */
+                               wl_clr_drv_status(cfg, CONNECTED, ndev);
+                               return 0;
+                       }
+
+                       if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+                               wl_flush_fw_log_buffer(bcmcfg_to_prmry_ndev(cfg),
+                                       FW_LOGSET_MASK_ALL);
+                       }
+#ifdef DHD_LOSSLESS_ROAMING
+                       wl_del_roam_timeout(cfg);
+#endif
+#ifdef P2PLISTEN_AP_SAMECHN
+                       if (ndev == bcmcfg_to_prmry_ndev(cfg)) {
+                               wl_cfg80211_set_p2p_resp_ap_chn(ndev, 0);
+                               cfg->p2p_resp_apchn_status = false;
+                               WL_DBG(("p2p_resp_apchn_status Turn OFF \n"));
+                       }
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+                       if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+                               wl_get_bss_info(cfg, ndev, &e->addr);
+                       }
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+
+                       if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+                               u8 *curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+                               if (memcmp(curbssid, &e->addr, ETHER_ADDR_LEN) != 0) {
+                                       bool fw_assoc_state = TRUE;
+                                       dhd_pub_t *dhd = (dhd_pub_t *)cfg->pub;
+                                       fw_assoc_state = dhd_is_associated(dhd, e->ifidx, &err);
+                                       if (!fw_assoc_state) {
+                                               WL_ERR(("Event sends up even different BSSID"
+                                                       " cur: " MACDBG " event: " MACDBG"\n",
+                                                       MAC2STRDBG(curbssid),
+                                                       MAC2STRDBG((const u8*)(&e->addr))));
+                                       } else {
+                                               WL_ERR(("BSSID of event is not the connected BSSID"
+                                                       "(ignore it) cur: " MACDBG
+                                                       " event: " MACDBG"\n",
+                                                       MAC2STRDBG(curbssid),
+                                                       MAC2STRDBG((const u8*)(&e->addr))));
+                                               return 0;
+                                       }
+                               }
+                       }
+                       /* Explicitly calling unlink to remove BSS in CFG */
+                       wiphy = bcmcfg_to_wiphy(cfg);
+                       ssid = (struct wlc_ssid *)wl_read_prof(cfg, ndev, WL_PROF_SSID);
+                       bssid = (u8 *)wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+                       if (ssid && bssid) {
+                               bss = CFG80211_GET_BSS(wiphy, NULL, bssid,
+                                       ssid->SSID, ssid->SSID_len);
+                               if (bss) {
+                                       cfg80211_unlink_bss(wiphy, bss);
+                                       CFG80211_PUT_BSS(wiphy, bss);
+                               }
+                       }
+
+                       if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+                               scb_val_t scbval;
+                               u8 *curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+                               uint32 reason = 0;
+                               struct ether_addr bssid_dongle = {{0, 0, 0, 0, 0, 0}};
+                               struct ether_addr bssid_null = {{0, 0, 0, 0, 0, 0}};
+
+                               wl_cfg80211_cancel_scan(cfg);
+                               if (event == WLC_E_DEAUTH_IND || event == WLC_E_DISASSOC_IND) {
+                                       reason = ntoh32(e->reason);
+                                       /* Specific AP send deauth by invalid reason.
+                                        * If reason over 0x8XXX, framework trigger recovery.
+                                        * Framework check HANG_REASON_MASK(0x8000) with reason.
+                                        */
+                                       if (reason > WLC_E_DEAUTH_MAX_REASON) {
+                                               WL_ERR(("Event %d original reason is %d, "
+                                                       "changed 0xFF\n", event, reason));
+                                               reason = WLC_E_DEAUTH_MAX_REASON;
+                                       }
+                                       wl_cfg80211_handle_deauth_ind(cfg, ndev, e, data);
+                               }
+#ifdef SET_SSID_FAIL_CUSTOM_RC
+                               if ((event == WLC_E_SET_SSID) &&
+                                       (ntoh32(e->status) == WLC_E_STATUS_TIMEOUT)) {
+                                       reason = SET_SSID_FAIL_CUSTOM_RC;
+                               }
+#endif /* SET_SSID_FAIL_CUSTOM_RC */
+#if defined(CONFIG_TIZEN)
+                               net_stat_tizen_update_wifi(ndev, WIFISTAT_DISCONNECTION);
+#endif /* CONFIG_TIZEN */
+
+                               /* roam offload does not sync BSSID always, get it from dongle */
+                               if (cfg->roam_offload) {
+                                       bzero(&bssid_dongle, sizeof(bssid_dongle));
+                                       if (wldev_ioctl_get(ndev, WLC_GET_BSSID, &bssid_dongle,
+                                                       sizeof(bssid_dongle)) == BCME_OK) {
+                                               /* if not roam case, it would return null bssid */
+                                               if (memcmp(&bssid_dongle, &bssid_null,
+                                                               ETHER_ADDR_LEN) != 0) {
+                                                       curbssid = (u8 *)&bssid_dongle;
+                                               }
+                                       }
+                               }
+                               if (memcmp(curbssid, &e->addr, ETHER_ADDR_LEN) != 0) {
+                                       bool fw_assoc_state = TRUE;
+                                       dhd_pub_t *dhd = (dhd_pub_t *)cfg->pub;
+                                       fw_assoc_state = dhd_is_associated(dhd, e->ifidx, &err);
+                                       if (!fw_assoc_state) {
+                                               WL_ERR(("Event sends up even different BSSID"
+                                                       " cur: " MACDBG " event: " MACDBG"\n",
+                                                       MAC2STRDBG(curbssid),
+                                                       MAC2STRDBG((const u8*)(&e->addr))));
+                                       } else {
+                                               WL_ERR(("BSSID of event is not the connected BSSID"
+                                                       "(ignore it) cur: " MACDBG
+                                                       " event: " MACDBG"\n",
+                                                       MAC2STRDBG(curbssid),
+                                                       MAC2STRDBG((const u8*)(&e->addr))));
+                                               return 0;
+                                       }
+                               }
+#ifdef DBG_PKT_MON
+                               /* Stop packet monitor */
+                               if (ndev == bcmcfg_to_prmry_ndev(cfg)) {
+                                       DHD_DBG_PKT_MON_STOP(dhdp);
+                               }
+#endif /* DBG_PKT_MON */
+                               /* clear RSSI monitor, framework will set new cfg */
+#ifdef RSSI_MONITOR_SUPPORT
+                               dhd_dev_set_rssi_monitor_cfg(bcmcfg_to_prmry_ndev(cfg),
+                                   FALSE, 0, 0);
+#endif /* RSSI_MONITOR_SUPPORT */
+                               if (dhdp->conf->eapol_status == EAPOL_STATUS_4WAY_DONE &&
+                                               !memcmp(ndev->name, WL_P2P_INTERFACE_PREFIX, strlen(WL_P2P_INTERFACE_PREFIX))) {
+                                       // terence 20130703: Fix for wrong group_capab (timing issue)
+                                       cfg->p2p_disconnected = 1;
+                               }
+                               memcpy(&cfg->disconnected_bssid, curbssid, ETHER_ADDR_LEN);
+                               wl_clr_drv_status(cfg, CONNECTED, ndev);
+
+                               if (!wl_get_drv_status(cfg, DISCONNECTING, ndev)) {
+                                       DHD_STATLOG_CTRL(dhdp, ST(DISASSOC_INT_START),
+                                               dhd_net2idx(dhdp->info, ndev),
+                                               WLAN_REASON_DEAUTH_LEAVING);
+                                       /* To make sure disconnect, explictly send dissassoc
+                                       *  for BSSID 00:00:00:00:00:00 issue
+                                       */
+                                       scbval.val = WLAN_REASON_DEAUTH_LEAVING;
+                                       WL_INFORM_MEM(("clear fw state\n"));
+                                       memcpy(&scbval.ea, curbssid, ETHER_ADDR_LEN);
+                                       scbval.val = htod32(scbval.val);
+                                       err = wldev_ioctl_set(ndev, WLC_DISASSOC, &scbval,
+                                               sizeof(scb_val_t));
+                                       if (err < 0) {
+                                               WL_ERR(("WLC_DISASSOC error %d\n", err));
+                                               err = 0;
+                                       }
+                               }
+                               if (wl_get_drv_status(cfg, DISCONNECTING, ndev)) {
+                                       loc_gen = true;
+                               }
+                               WL_INFORM_MEM(("[%s] Indicate disconnect event to upper layer. "
+                                       "event: %d reason=%d from " MACDBG "\n",
+                                       ndev->name, event, ntoh32(e->reason),
+                                       MAC2STRDBG((const u8*)(&e->addr))));
+
+#ifdef WBTEXT
+                               /* when STA was disconnected, clear join pref and set wbtext */
+                               if (ndev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION &&
+                                               dhdp->wbtext_policy
+                                               == WL_BSSTRANS_POLICY_PRODUCT_WBTEXT) {
+                                       char smbuf[WLC_IOCTL_SMLEN];
+                                       if ((err = wldev_iovar_setbuf(ndev, "join_pref",
+                                                       NULL, 0, smbuf,
+                                                       sizeof(smbuf), NULL))
+                                                       == BCME_OK) {
+                                               if ((err = wldev_iovar_setint(ndev,
+                                                               "wnm_bsstrans_resp",
+                                                               dhdp->wbtext_policy))
+                                                               == BCME_OK) {
+                                                       wl_cfg80211_wbtext_set_default(ndev);
+                                               } else {
+                                                       WL_ERR(("wl_notify_connect_status:"
+                                                               " Failed to"
+                                                               " set wbtext = %d\n",
+                                                               err));
+                                               }
+                                       } else {
+                                               WL_ERR(("wl_notify_connect_status:"
+                                                       " Failed to clear join pref = %d\n",
+                                                       err));
+                                       }
+                                       wl_cfg80211_wbtext_clear_bssid_list(cfg);
+                               }
+#endif /* WBTEXT */
+                               DHD_STATLOG_CTRL(dhdp, ST(DISASSOC_DONE),
+                                       dhd_net2idx(dhdp->info, ndev), reason);
+                               /* Send up deauth and clear states */
+
+                               /*
+                               * FW sends body and body len as a part of deauth
+                               * and disassoc events (WLC_E_DISASSOC_IND, WLC_E_DEAUTH_IND)
+                               * The VIEs sits after reason code in the body. Reason code is
+                               * 2 bytes long.
+                               */
+                               WL_DBG(("recv disconnect ies ie_len = %d\n", ie_len));
+                               if (event == WLC_E_DISASSOC_IND || event == WLC_E_DEAUTH_IND) {
+                                       if ((datalen > DOT11_DISCONNECT_RC) &&
+                                               datalen < (VNDR_IE_MAX_LEN + DOT11_DISCONNECT_RC) &&
+                                               data) {
+                                               ie_ptr = (uchar*)data + DOT11_DISCONNECT_RC;
+                                               ie_len = datalen - DOT11_DISCONNECT_RC;
+                                       }
+                               } else if (event == WLC_E_LINK &&
+                                               ntoh32(e->reason) == WLC_E_LINK_BCN_LOSS) {
+#ifdef WL_ANALYTICS
+                                       if (ndev == bcmcfg_to_prmry_ndev(cfg)) {
+                                               if (wl_vndr_ies_find_vendor_oui(cfg, ndev,
+                                                       CISCO_AIRONET_OUI)) {
+                                                       WL_INFORM_MEM(("Analytics Beacon loss\n"));
+                                                       ie_ptr = (uchar*)disco_bcnloss_vsie;
+                                                       ie_len = sizeof(disco_bcnloss_vsie);
+                                               }
+                                       }
+#endif /* WL_ANALYTICS */
+                               }
+#if defined(DHDTCPSYNC_FLOOD_BLK) && defined(CUSTOMER_TCPSYNC_FLOOD_DIS_RC)
+                               ifp = dhd_get_ifp(dhdp, e->ifidx);
+                               if (ifp && ifp->disconnect_tsync_flood) {
+                                       reason = CUSTOMER_TCPSYNC_FLOOD_DIS_RC;
+                               }
+#endif /* DHDTCPSYNC_FLOOD_BLK && CUSTOMER_TCPSYNC_FLOOD_DIS_RC */
+                               CFG80211_DISCONNECTED(ndev, reason, ie_ptr, ie_len,
+                                       loc_gen, GFP_KERNEL);
+                               WL_INFORM_MEM(("[%s] Disconnect event sent to upper layer"
+                                       "event:%d e->reason=%d reason=%d ie_len=%d "
+                                       "from " MACDBG "\n",
+                                       ndev->name,     event, ntoh32(e->reason), reason, ie_len,
+                                       MAC2STRDBG((const u8*)(&e->addr))));
+
+                               /* Wait for status to be cleared to prevent race condition
+                                * issues with connect context
+                                */
+                               wl_link_down(cfg);
+                               wl_init_prof(cfg, ndev);
+                               wl_clr_drv_status(cfg, AUTHORIZED, ndev);
+                               CLR_TS(cfg, authorize_start);
+                               CLR_TS(cfg, authorize_cmplt);
+                               CLR_TS(cfg, conn_start);
+                               CLR_TS(cfg, conn_cmplt);
+                       }
+                       else if (wl_get_drv_status(cfg, CONNECTING, ndev)) {
+#ifdef ESCAN_RESULT_PATCH
+                               u8 *conn_req_bssid = wl_read_prof(cfg, ndev, WL_PROF_LATEST_BSSID);
+#endif /* ESCAN_RESULT_PATCH */
+                               DHD_STATLOG_CTRL(dhdp, ST(DISASSOC_INT_START),
+                                       dhd_net2idx(dhdp->info, ndev), 0);
+                               WL_INFORM_MEM(("link down, during connecting\n"));
+                               /* Issue WLC_DISASSOC to prevent FW roam attempts.
+                               * Do not issue WLC_DISASSOC again if the linkdown  is
+                               * generated due to local disassoc, to avoid connect-disconnect
+                               * loop.
+                               */
+                               if (!((event == WLC_E_LINK) &&
+                                       (ntoh32(e->reason) == WLC_E_LINK_DISASSOC) &&
+                                       (ntoh32(e->status) == WLC_E_STATUS_SUCCESS))) {
+                                       err = wldev_ioctl_set(ndev, WLC_DISASSOC, NULL, 0);
+                                       if (err < 0) {
+                                               WL_ERR(("CONNECTING state,"
+                                                       " WLC_DISASSOC error %d\n",
+                                                       err));
+                                               err = 0;
+                                       }
+#ifdef ESCAN_RESULT_PATCH
+                                       if (conn_req_bssid && (ETHER_ISNULLADDR(conn_req_bssid) ||
+                                               ETHER_ISNULLADDR(&e->addr) ||
+                                               (memcmp(&e->addr, conn_req_bssid,
+                                               ETHER_ADDR_LEN) == 0)))
+                                               /* In case this event comes while associating
+                                               * another AP
+                                               */
+#endif /* ESCAN_RESULT_PATCH */
+                                               wl_bss_connect_done(cfg, ndev, e, data, false);
+                               }
+                       }
+                       wl_clr_drv_status(cfg, DISCONNECTING, ndev);
+                       wl_cfg80211_check_in4way(cfg, ndev, NO_SCAN_IN4WAY|NO_BTC_IN4WAY|WAIT_DISCONNECTED,
+                               WL_EXT_STATUS_DISCONNECTED, NULL);
+
+                       /* if link down, bsscfg is diabled */
+                       if (ndev != bcmcfg_to_prmry_ndev(cfg))
+                               complete(&cfg->iface_disable);
+#ifdef WLTDLS
+                       /* re-enable TDLS if the number of connected interfaces
+                        * is less than 2.
+                        */
+                       wl_cfg80211_tdls_config(cfg, TDLS_STATE_DISCONNECT, false);
+#endif /* WLTDLS */
+               } else if (wl_is_nonetwork(cfg, e)) {
+                       WL_ERR(("connect failed event=%d e->status %d e->reason %d \n",
+                               event, (int)ntoh32(e->status), (int)ntoh32(e->reason)));
+#if defined(CONFIG_TIZEN)
+                       net_stat_tizen_update_wifi(ndev, WIFISTAT_CONNECTION_FAIL);
+#endif /* CONFIG_TIZEN */
+                       wl_cfg80211_check_in4way(cfg, ndev, NO_SCAN_IN4WAY|NO_BTC_IN4WAY|WAIT_DISCONNECTED,
+                               WL_EXT_STATUS_DISCONNECTED, NULL);
+#ifdef WL_WPS_SYNC
+                       if (wl_wps_session_update(ndev,
+                               WPS_STATE_CONNECT_FAIL, e->addr.octet) == BCME_UNSUPPORTED) {
+                               /* Unexpected event. Ignore it. */
+                               return 0;
+                       }
+#endif /* WL_WPS_SYNC */
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+                       if (event == WLC_E_SET_SSID) {
+                               wl_get_connect_failed_status(cfg, e);
+                       }
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+                       /* Dump FW preserve buffer content */
+                       wl_flush_fw_log_buffer(ndev, FW_LOGSET_MASK_ALL);
+
+                       /* Clean up any pending scan request */
+                       wl_cfg80211_cancel_scan(cfg);
+
+                       if (wl_get_drv_status(cfg, CONNECTING, ndev)) {
+                               if (!wl_get_drv_status(cfg, DISCONNECTING, ndev)) {
+                                       WL_INFORM_MEM(("wl dissassoc\n"));
+                                       err = wldev_ioctl_set(ndev, WLC_DISASSOC, NULL, 0);
+                                       if (err < 0) {
+                                               WL_ERR(("WLC_DISASSOC error %d\n", err));
+                                               err = 0;
+                                       }
+                               } else {
+                                       WL_DBG(("connect fail. clear disconnecting bit\n"));
+                                       wl_clr_drv_status(cfg, DISCONNECTING, ndev);
+                               }
+                               wl_bss_connect_done(cfg, ndev, e, data, false);
+                               wl_clr_drv_status(cfg, CONNECTING, ndev);
+                               WL_INFORM_MEM(("connect fail reported\n"));
+                       }
+               } else {
+                       WL_DBG(("%s nothing\n", __FUNCTION__));
+               }
+
+               DHD_ENABLE_RUNTIME_PM((dhd_pub_t *)cfg->pub);
+
+       } else {
+               WL_MSG(ndev->name, "Invalid mode %d event %d status %d\n",
+                       wl_get_mode_by_netdev(cfg, ndev), ntoh32(e->event_type),
+                       ntoh32(e->status));
+       }
+       return err;
+}
+
+#ifdef WL_RELMCAST
+void wl_cfg80211_set_rmc_pid(struct net_device *dev, int pid)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       if (pid > 0)
+               cfg->rmc_event_pid = pid;
+       WL_DBG(("set pid for rmc event : pid=%d\n", pid));
+}
+#endif /* WL_RELMCAST */
+
+#ifdef WLAIBSS
+void wl_cfg80211_set_txfail_pid(struct net_device *dev, int pid)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       if (pid > 0)
+               cfg->aibss_txfail_pid = pid;
+       WL_DBG(("set pid for aibss fail event : pid=%d\n", pid));
+}
+
+static s32
+wl_notify_aibss_txfail(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       u32 evt = ntoh32(e->event_type);
+       int ret = -1;
+#ifdef PCIE_FULL_DONGLE
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       u32 reason = ntoh32(e->reason);
+#endif
+       if (cfg->aibss_txfail_pid != 0) {
+#ifdef PCIE_FULL_DONGLE
+               if (reason == AIBSS_PEER_FREE) {
+                       uint8 ifindex;
+                       wl_event_msg_t event;
+
+                       bzero(&event, sizeof(wl_event_msg_t));
+                       memcpy(&event, e, sizeof(wl_event_msg_t));
+
+                       ifindex = (uint8)dhd_ifname2idx(dhd->info, event.ifname);
+                       WL_INFORM_MEM(("Peer freed. Flow rings delete for peer.\n"));
+                       dhd_flow_rings_delete_for_peer(dhd, ifindex,
+                               (void *)&event.addr.octet[0]);
+                       return 0;
+               }
+#endif
+               ret = wl_netlink_send_msg(cfg->aibss_txfail_pid, AIBSS_EVENT_TXFAIL,
+                       cfg->aibss_txfail_seq++, &e->addr, ETHER_ADDR_LEN);
+       }
+
+       WL_DBG(("txfail : evt=%d, pid=%d, ret=%d, mac=" MACF "\n",
+               evt, cfg->aibss_txfail_pid, ret, CONST_ETHERP_TO_MACF(&e->addr)));
+       return ret;
+}
+#endif /* WLAIBSS */
+#ifdef WL_RELMCAST
+static s32
+wl_notify_rmc_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       u32 evt = ntoh32(e->event_type);
+       u32 reason = ntoh32(e->reason);
+       int ret = -1;
+
+       switch (reason) {
+               case WLC_E_REASON_RMC_AR_LOST:
+               case WLC_E_REASON_RMC_AR_NO_ACK:
+                       if (cfg->rmc_event_pid != 0) {
+                               ret = wl_netlink_send_msg(cfg->rmc_event_pid,
+                                       RMC_EVENT_LEADER_CHECK_FAIL,
+                                       cfg->rmc_event_seq++, NULL, 0);
+                       }
+                       break;
+               default:
+                       break;
+       }
+       WL_DBG(("rmcevent : evt=%d, pid=%d, ret=%d\n", evt, cfg->rmc_event_pid, ret));
+       return ret;
+}
+#endif /* WL_RELMCAST */
+
+#ifdef GSCAN_SUPPORT
+static s32
+wl_handle_roam_exp_event(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       struct net_device *ndev = NULL;
+       u32 datalen = be32_to_cpu(e->datalen);
+
+       if (datalen) {
+               wl_roam_exp_event_t *evt_data = (wl_roam_exp_event_t *)data;
+               if (evt_data->version == ROAM_EXP_EVENT_VERSION) {
+                       wlc_ssid_t *ssid = &evt_data->cur_ssid;
+                       struct wireless_dev *wdev;
+                       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+                       if (ndev) {
+                               wdev = ndev->ieee80211_ptr;
+                               wdev->ssid_len = min(ssid->SSID_len, (uint32)DOT11_MAX_SSID_LEN);
+                               memcpy(wdev->ssid, ssid->SSID, wdev->ssid_len);
+                               WL_ERR(("SSID is %s\n", ssid->SSID));
+                               wl_update_prof(cfg, ndev, NULL, ssid, WL_PROF_SSID);
+                       } else {
+                               WL_ERR(("NULL ndev!\n"));
+                       }
+               } else {
+                       WL_ERR(("Version mismatch %d, expected %d", evt_data->version,
+                              ROAM_EXP_EVENT_VERSION));
+               }
+       }
+       return BCME_OK;
+}
+#endif /* GSCAN_SUPPORT */
+
+#ifdef RSSI_MONITOR_SUPPORT
+static s32 wl_handle_rssi_monitor_event(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+
+#if defined(WL_VENDOR_EXT_SUPPORT) || defined(CONFIG_BCMDHD_VENDOR_EXT)
+       u32 datalen = be32_to_cpu(e->datalen);
+       struct net_device *ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+
+       if (datalen) {
+               wl_rssi_monitor_evt_t *evt_data = (wl_rssi_monitor_evt_t *)data;
+               if (evt_data->version == RSSI_MONITOR_VERSION) {
+                       dhd_rssi_monitor_evt_t monitor_data;
+                       monitor_data.version = DHD_RSSI_MONITOR_EVT_VERSION;
+                       monitor_data.cur_rssi = evt_data->cur_rssi;
+                       memcpy(&monitor_data.BSSID, &e->addr, ETHER_ADDR_LEN);
+                       wl_cfgvendor_send_async_event(wiphy, ndev,
+                               GOOGLE_RSSI_MONITOR_EVENT,
+                               &monitor_data, sizeof(monitor_data));
+               } else {
+                       WL_ERR(("Version mismatch %d, expected %d", evt_data->version,
+                              RSSI_MONITOR_VERSION));
+               }
+       }
+#endif /* WL_VENDOR_EXT_SUPPORT || CONFIG_BCMDHD_VENDOR_EXT */
+       return BCME_OK;
+}
+#endif /* RSSI_MONITOR_SUPPORT */
+
+static s32
+wl_notify_roaming_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       bool act;
+       struct net_device *ndev = NULL;
+       s32 err = 0;
+       u32 event = be32_to_cpu(e->event_type);
+       u32 status = be32_to_cpu(e->status);
+#ifdef DHD_LOSSLESS_ROAMING
+       struct wl_security *sec;
+#endif
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       WL_DBG(("Enter \n"));
+
+       BCM_REFERENCE(dhdp);
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       if ((!cfg->disable_roam_event) && (event == WLC_E_BSSID)) {
+
+               wl_add_remove_eventmsg(ndev, WLC_E_ROAM, false);
+
+               cfg->disable_roam_event = TRUE;
+       }
+
+       if ((cfg->disable_roam_event) && (event == WLC_E_ROAM))
+               return err;
+
+       if ((event == WLC_E_ROAM || event == WLC_E_BSSID) && status == WLC_E_STATUS_SUCCESS) {
+               if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+#ifdef DHD_LOSSLESS_ROAMING
+                       sec = wl_read_prof(cfg, ndev, WL_PROF_SEC);
+                       /* In order to reduce roaming delay, wl_bss_roaming_done is
+                        * early called with WLC_E_LINK event. It is called from
+                        * here only if WLC_E_LINK event is blocked for specific
+                        * security type.
+                        */
+                       if (IS_AKM_SUITE_FT(sec)) {
+                               wl_bss_roaming_done(cfg, ndev, e, data);
+                               /* Arm pkt logging timer */
+                               dhd_dump_mod_pkt_timer(dhdp, PKT_CNT_RSN_ROAM);
+                       }
+                       /* Roam timer is deleted mostly from wl_cfg80211_change_station
+                        * after roaming is finished successfully. We need to delete
+                        * the timer from here only for some security types that aren't
+                        * using wl_cfg80211_change_station to authorize SCB
+                        */
+                       if (IS_AKM_SUITE_FT(sec) || IS_AKM_SUITE_CCKM(sec)) {
+                               wl_del_roam_timeout(cfg);
+                       }
+#else
+#if !defined(DHD_NONFT_ROAMING)
+                       wl_bss_roaming_done(cfg, ndev, e, data);
+#endif /* !DHD_NONFT_ROAMING */
+#endif /* DHD_LOSSLESS_ROAMING */
+#ifdef WBTEXT
+                       if (dhdp->wbtext_support) {
+                               /* set wnm_keepalives_max_idle after association */
+                               wl_cfg80211_wbtext_set_wnm_maxidle(cfg, ndev);
+
+                               /* Mostly nbr request of BTM query will be handled
+                                * from wl_cfg80211_change_station
+                                * after key negotiation is finished.
+                                * This part is only for some specific security
+                                * types (FT, CCKM) that don't call
+                                * wl_cfg80211_change_station after roaming
+                                */
+                               if (IS_AKM_SUITE_FT(sec) || IS_AKM_SUITE_CCKM(sec)) {
+                                       /* send nbr request or BTM query to update RCC
+                                        * after roaming completed
+                                        */
+                                       wl_cfg80211_wbtext_update_rcc(cfg, ndev);
+                               }
+                       }
+#endif /* WBTEXT */
+               } else {
+                       wl_bss_connect_done(cfg, ndev, e, data, true);
+               }
+               act = true;
+               wl_update_prof(cfg, ndev, e, &act, WL_PROF_ACT);
+               wl_update_prof(cfg, ndev, NULL, (const void *)&e->addr, WL_PROF_BSSID);
+
+               if (ndev == bcmcfg_to_prmry_ndev(cfg)) {
+                       wl_vndr_ies_get_vendor_oui(cfg, ndev, NULL, 0);
+               }
+       }
+#ifdef DHD_LOSSLESS_ROAMING
+       else if ((event == WLC_E_ROAM || event == WLC_E_BSSID) && status != WLC_E_STATUS_SUCCESS) {
+               wl_del_roam_timeout(cfg);
+       }
+#endif
+       return err;
+}
+
+#ifdef CUSTOM_EVENT_PM_WAKE
+uint32 last_dpm_upd_time = 0;  /* ms */
+#define DPM_UPD_LMT_TIME       ((CUSTOM_EVENT_PM_WAKE + (5)) * (1000) * (4))   /* ms */
+#define DPM_UPD_LMT_RSSI       -85     /* dbm */
+
+static s32
+wl_check_pmstatus(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = BCME_OK;
+       struct net_device *ndev = NULL;
+       u8 *pbuf = NULL;
+       uint32 cur_dpm_upd_time = 0;
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       s32 rssi;
+#ifdef SUPPORT_RSSI_SUM_REPORT
+       wl_rssi_ant_mimo_t rssi_ant_mimo;
+#endif /* SUPPORT_RSSI_SUM_REPORT */
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       pbuf = (u8 *)MALLOCZ(cfg->osh, WLC_IOCTL_MEDLEN);
+       if (pbuf == NULL) {
+               WL_ERR(("failed to allocate local pbuf\n"));
+               return -ENOMEM;
+       }
+
+       err = wldev_iovar_getbuf_bsscfg(ndev, "dump",
+               "pm", strlen("pm"), pbuf, WLC_IOCTL_MEDLEN,
+               0, &cfg->ioctl_buf_sync);
+
+       if (err) {
+               WL_ERR(("dump ioctl err = %d", err));
+       } else {
+               WL_ERR(("PM status : %s\n", pbuf));
+       }
+
+       if (pbuf) {
+               MFREE(cfg->osh, pbuf, WLC_IOCTL_MEDLEN);
+       }
+
+       if (dhd->early_suspended) {
+               /* LCD off */
+#ifdef SUPPORT_RSSI_SUM_REPORT
+               /* Query RSSI sum across antennas */
+               memset(&rssi_ant_mimo, 0, sizeof(rssi_ant_mimo));
+               err = wl_get_rssi_per_ant(ndev, ndev->name, NULL, &rssi_ant_mimo);
+               if (err) {
+                       WL_ERR(("Could not get rssi sum (%d)\n", err));
+               }
+               rssi = rssi_ant_mimo.rssi_sum;
+               if (rssi == 0)
+#endif /* SUPPORT_RSSI_SUM_REPORT */
+               {
+                       scb_val_t scb_val;
+                       memset(&scb_val, 0, sizeof(scb_val_t));
+                       scb_val.val = 0;
+                       err = wldev_ioctl_get(ndev, WLC_GET_RSSI, &scb_val, sizeof(scb_val_t));
+                       if (err) {
+                               WL_ERR(("Could not get rssi (%d)\n", err));
+                       }
+#if defined(RSSIOFFSET)
+                       rssi = wl_update_rssi_offset(ndev, dtoh32(scb_val.val));
+#else
+                       rssi = dtoh32(scb_val.val);
+#endif
+               }
+               WL_ERR(("RSSI %d dBm\n", rssi));
+               if (rssi > DPM_UPD_LMT_RSSI) {
+                       return err;
+               }
+       } else {
+               /* LCD on */
+               return err;
+       }
+
+       if (last_dpm_upd_time == 0) {
+               last_dpm_upd_time = OSL_SYSUPTIME();
+       } else {
+               cur_dpm_upd_time = OSL_SYSUPTIME();
+               if (cur_dpm_upd_time - last_dpm_upd_time < DPM_UPD_LMT_TIME) {
+                       scb_val_t scbval;
+                       DHD_STATLOG_CTRL(dhd, ST(DISASSOC_INT_START),
+                               dhd_net2idx(dhd->info, ndev), 0);
+                       bzero(&scbval, sizeof(scb_val_t));
+
+                       err = wldev_ioctl_set(ndev, WLC_DISASSOC,
+                               &scbval, sizeof(scb_val_t));
+                       if (err < 0) {
+                               WL_ERR(("Disassoc error %d\n", err));
+                               return err;
+                       }
+                       WL_ERR(("Force Disassoc due to updated DPM event.\n"));
+
+                       last_dpm_upd_time = 0;
+               } else {
+                       last_dpm_upd_time = cur_dpm_upd_time;
+               }
+       }
+
+       return err;
+}
+#endif /* CUSTOM_EVENT_PM_WAKE */
+
+#ifdef QOS_MAP_SET
+/* get user priority table */
+uint8 *
+wl_get_up_table(dhd_pub_t * dhdp, int idx)
+{
+       struct net_device *ndev;
+       struct bcm_cfg80211 *cfg;
+
+       ndev = dhd_idx2net(dhdp, idx);
+       if (ndev) {
+               cfg = wl_get_cfg(ndev);
+               if (cfg)
+                       return (uint8 *)(cfg->up_table);
+       }
+
+       return NULL;
+}
+#endif /* QOS_MAP_SET */
+
+#if defined(DHD_LOSSLESS_ROAMING) || defined(DBG_PKT_MON)
+/*
+ * start packet logging in advance to make sure that EAPOL
+ * messages are not missed during roaming
+ */
+static s32
+wl_notify_roam_prep_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       struct wl_security *sec;
+       struct net_device *ndev;
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       u32 status = ntoh32(e->status);
+       u32 reason = ntoh32(e->reason);
+
+       BCM_REFERENCE(sec);
+
+       if (status == WLC_E_STATUS_SUCCESS && reason != WLC_E_REASON_INITIAL_ASSOC) {
+               WL_ERR(("Attempting roam with reason code : %d\n", reason));
+       }
+
+#ifdef CONFIG_SILENT_ROAM
+       if (dhdp->in_suspend && reason == WLC_E_REASON_SILENT_ROAM) {
+               dhdp->sroamed = TRUE;
+       }
+#endif /* CONFIG_SILENT_ROAM */
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+#ifdef DBG_PKT_MON
+       if (ndev == bcmcfg_to_prmry_ndev(cfg)) {
+               DHD_DBG_PKT_MON_STOP(dhdp);
+               DHD_DBG_PKT_MON_START(dhdp);
+       }
+#endif /* DBG_PKT_MON */
+#ifdef DHD_LOSSLESS_ROAMING
+       sec = wl_read_prof(cfg, ndev, WL_PROF_SEC);
+       /* Disable Lossless Roaming for specific AKM suite
+        * Any other AKM suite can be added below if transition time
+        * is delayed because of Lossless Roaming
+        * and it causes any certication failure
+        */
+       if (IS_AKM_SUITE_FT(sec)) {
+               return BCME_OK;
+       }
+
+       dhdp->dequeue_prec_map = 1 << PRIO_8021D_NC;
+       /* Restore flow control  */
+       dhd_txflowcontrol(dhdp, ALL_INTERFACES, OFF);
+
+       mod_timer(&cfg->roam_timeout, jiffies + msecs_to_jiffies(WL_ROAM_TIMEOUT_MS));
+#endif /* DHD_LOSSLESS_ROAMING */
+
+       return BCME_OK;
+}
+#endif /* DHD_LOSSLESS_ROAMING || DBG_PKT_MON */
+
+static s32
+wl_notify_roam_start_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 13, 0)) || defined(WL_VENDOR_EXT_SUPPORT)
+       struct net_device *ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       int event_type;
+
+       event_type = WIFI_EVENT_ROAM_SCAN_STARTED;
+       wl_cfgvendor_send_async_event(wiphy, ndev, GOOGLE_ROAM_EVENT_START,
+               &event_type, sizeof(int));
+#endif /* (LINUX_VERSION_CODE > KERNEL_VERSION(3, 13, 0)) || (WL_VENDOR_EXT_SUPPORT) */
+
+       return BCME_OK;
+}
+
+static s32 wl_get_assoc_ies(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       wl_assoc_info_t assoc_info;
+       struct wl_connect_info *conn_info = wl_to_conn(cfg);
+       s32 err = 0;
+#ifdef QOS_MAP_SET
+       bcm_tlv_t * qos_map_ie = NULL;
+#endif /* QOS_MAP_SET */
+
+       WL_DBG(("Enter \n"));
+
+       bzero(&assoc_info, sizeof(wl_assoc_info_t));
+       err = wldev_iovar_getbuf(ndev, "assoc_info", NULL, 0, cfg->extra_buf,
+               WL_ASSOC_INFO_MAX, NULL);
+       if (unlikely(err)) {
+               WL_ERR(("could not get assoc info (%d)\n", err));
+               return err;
+       }
+       memcpy(&assoc_info, cfg->extra_buf, sizeof(wl_assoc_info_t));
+       assoc_info.req_len = htod32(assoc_info.req_len);
+       assoc_info.resp_len = htod32(assoc_info.resp_len);
+       assoc_info.flags = htod32(assoc_info.flags);
+       if (conn_info->req_ie_len) {
+               conn_info->req_ie_len = 0;
+               bzero(conn_info->req_ie, sizeof(conn_info->req_ie));
+       }
+       if (conn_info->resp_ie_len) {
+               conn_info->resp_ie_len = 0;
+               bzero(conn_info->resp_ie, sizeof(conn_info->resp_ie));
+       }
+
+       if (assoc_info.req_len) {
+               err = wldev_iovar_getbuf(ndev, "assoc_req_ies", NULL, 0, cfg->extra_buf,
+                       assoc_info.req_len, NULL);
+               if (unlikely(err)) {
+                       WL_ERR(("could not get assoc req (%d)\n", err));
+                       return err;
+               }
+               if (assoc_info.req_len < sizeof(struct dot11_assoc_req)) {
+                       WL_ERR(("req_len %d lessthan %d \n", assoc_info.req_len,
+                               (int)sizeof(struct dot11_assoc_req)));
+                       return BCME_BADLEN;
+               }
+               conn_info->req_ie_len = (uint32)(assoc_info.req_len
+                                               - sizeof(struct dot11_assoc_req));
+               if (assoc_info.flags & WLC_ASSOC_REQ_IS_REASSOC) {
+                       conn_info->req_ie_len -= ETHER_ADDR_LEN;
+               }
+               if (conn_info->req_ie_len <= MAX_REQ_LINE)
+                       memcpy(conn_info->req_ie, cfg->extra_buf, conn_info->req_ie_len);
+               else {
+                       WL_ERR(("IE size %d above max %d size \n",
+                               conn_info->req_ie_len, MAX_REQ_LINE));
+                       return err;
+               }
+       } else {
+               conn_info->req_ie_len = 0;
+       }
+
+       if (assoc_info.resp_len) {
+               err = wldev_iovar_getbuf(ndev, "assoc_resp_ies", NULL, 0, cfg->extra_buf,
+                       assoc_info.resp_len, NULL);
+               if (unlikely(err)) {
+                       WL_ERR(("could not get assoc resp (%d)\n", err));
+                       return err;
+               }
+               if (assoc_info.resp_len < sizeof(struct dot11_assoc_resp)) {
+                       WL_ERR(("resp_len %d is lessthan %d \n", assoc_info.resp_len,
+                               (int)sizeof(struct dot11_assoc_resp)));
+                       return BCME_BADLEN;
+               }
+               conn_info->resp_ie_len = assoc_info.resp_len -
+                               (uint32)sizeof(struct dot11_assoc_resp);
+               if (conn_info->resp_ie_len <= MAX_REQ_LINE) {
+                       memcpy(conn_info->resp_ie, cfg->extra_buf, conn_info->resp_ie_len);
+               } else {
+                       WL_ERR(("IE size %d above max %d size \n",
+                               conn_info->resp_ie_len, MAX_REQ_LINE));
+                       return err;
+               }
+
+#ifdef QOS_MAP_SET
+               /* find qos map set ie */
+               if ((qos_map_ie = bcm_parse_tlvs(conn_info->resp_ie, conn_info->resp_ie_len,
+                               DOT11_MNG_QOS_MAP_ID)) != NULL) {
+                       WL_DBG((" QoS map set IE found in assoc response\n"));
+                       if (!cfg->up_table) {
+                               cfg->up_table = (uint8 *)MALLOC(cfg->osh, UP_TABLE_MAX);
+                       }
+                       wl_set_up_table(cfg->up_table, qos_map_ie);
+               } else {
+                       MFREE(cfg->osh, cfg->up_table, UP_TABLE_MAX);
+               }
+#endif /* QOS_MAP_SET */
+       } else {
+               conn_info->resp_ie_len = 0;
+       }
+       WL_DBG(("req len (%d) resp len (%d)\n", conn_info->req_ie_len,
+               conn_info->resp_ie_len));
+
+       return err;
+}
+
+static s32 wl_update_bss_info(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       bool update_ssid)
+{
+       struct cfg80211_bss *bss;
+       wl_bss_info_t *bi;
+       struct wlc_ssid *ssid;
+       const struct bcm_tlv *tim;
+       s32 beacon_interval;
+       s32 dtim_period;
+       size_t ie_len;
+       const u8 *ie;
+       u8 *curbssid;
+       s32 err = 0;
+       struct wiphy *wiphy;
+       char *buf;
+       u32 freq;
+       chanspec_t chspec = INVCHANSPEC;
+
+       wiphy = bcmcfg_to_wiphy(cfg);
+
+       ssid = (struct wlc_ssid *)wl_read_prof(cfg, ndev, WL_PROF_SSID);
+       curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+       bss = CFG80211_GET_BSS(wiphy, NULL, curbssid,
+               ssid->SSID, ssid->SSID_len);
+       buf = (char *)MALLOCZ(cfg->osh, WL_EXTRA_BUF_MAX);
+       if (!buf) {
+               WL_ERR(("buffer alloc failed.\n"));
+               return BCME_NOMEM;
+       }
+       mutex_lock(&cfg->usr_sync);
+       *(u32 *)buf = htod32(WL_EXTRA_BUF_MAX);
+       err = wldev_ioctl_get(ndev, WLC_GET_BSS_INFO, buf, WL_EXTRA_BUF_MAX);
+       if (unlikely(err)) {
+               WL_ERR(("Could not get bss info %d\n", err));
+               goto update_bss_info_out;
+       }
+       bi = (wl_bss_info_t *)(buf + 4);
+       chspec = wl_chspec_driver_to_host(bi->chanspec);
+       wl_update_prof(cfg, ndev, NULL, &chspec, WL_PROF_CHAN);
+
+       if (!bss) {
+               WL_DBG(("Could not find the AP\n"));
+               if (memcmp(bi->BSSID.octet, curbssid, ETHER_ADDR_LEN)) {
+                       WL_ERR(("Bssid doesn't match\n"));
+                       err = -EIO;
+                       goto update_bss_info_out;
+               }
+               err = wl_inform_single_bss(cfg, bi, update_ssid);
+               if (unlikely(err))
+                       goto update_bss_info_out;
+
+               ie = ((u8 *)bi) + bi->ie_offset;
+               ie_len = bi->ie_length;
+               beacon_interval = cpu_to_le16(bi->beacon_period);
+       } else {
+               u16 channel;
+               WL_DBG(("Found the AP in the list - BSSID %pM\n", bss->bssid));
+               channel = wf_chspec_ctlchan(wl_chspec_driver_to_host(bi->chanspec));
+               freq = wl_channel_to_frequency(channel, CHSPEC_BAND(bi->chanspec));
+               bss->channel = ieee80211_get_channel(wiphy, freq);
+#if defined(WL_CFG80211_P2P_DEV_IF)
+               ie = (const u8 *)bss->ies->data;
+               ie_len = bss->ies->len;
+#else
+               ie = bss->information_elements;
+               ie_len = bss->len_information_elements;
+#endif /* WL_CFG80211_P2P_DEV_IF */
+               beacon_interval = bss->beacon_interval;
+
+               CFG80211_PUT_BSS(wiphy, bss);
+       }
+
+       tim = bcm_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
+       if (tim) {
+               dtim_period = tim->data[1];
+       } else {
+               /*
+               * active scan was done so we could not get dtim
+               * information out of probe response.
+               * so we speficially query dtim information.
+               */
+               dtim_period = 0;
+               err = wldev_ioctl_get(ndev, WLC_GET_DTIMPRD,
+                       &dtim_period, sizeof(dtim_period));
+               if (unlikely(err)) {
+                       WL_ERR(("WLC_GET_DTIMPRD error (%d)\n", err));
+                       goto update_bss_info_out;
+               }
+       }
+
+       wl_update_prof(cfg, ndev, NULL, &beacon_interval, WL_PROF_BEACONINT);
+       wl_update_prof(cfg, ndev, NULL, &dtim_period, WL_PROF_DTIMPERIOD);
+
+update_bss_info_out:
+       if (unlikely(err)) {
+               WL_ERR(("Failed with error %d\n", err));
+       }
+
+       MFREE(cfg->osh, buf, WL_EXTRA_BUF_MAX);
+       mutex_unlock(&cfg->usr_sync);
+       return err;
+}
+
+static s32
+wl_bss_roaming_done(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data)
+{
+       struct wl_connect_info *conn_info = wl_to_conn(cfg);
+       s32 err = 0;
+       u8 *curbssid;
+       chanspec_t *chanspec;
+       scb_val_t scbval;
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) || defined(WL_COMPAT_WIRELESS)
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       struct ieee80211_channel *notify_channel = NULL;
+       u32 freq;
+       struct channel_info ci;
+       u32 cur_channel;
+#endif /* LINUX_VERSION > 2.6.39 || WL_COMPAT_WIRELESS */
+#if (defined(CONFIG_ARCH_MSM) && defined(CFG80211_ROAMED_API_UNIFIED)) || \
+       (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)) || defined(WL_FILS_ROAM_OFFLD) || \
+       defined(CFG80211_ROAM_API_GE_4_12)
+       struct cfg80211_roam_info roam_info;
+#endif /* (CONFIG_ARCH_MSM && CFG80211_ROAMED_API_UNIFIED) || LINUX_VERSION >= 4.12.0 */
+#if defined(WL_FILS_ROAM_OFFLD)
+       struct wl_fils_info *fils_info = wl_to_fils_info(cfg);
+       struct wl_security *sec = wl_read_prof(cfg, ndev, WL_PROF_SEC);
+#endif
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+#ifdef DHD_POST_EAPOL_M1_AFTER_ROAM_EVT
+       dhd_if_t *ifp = NULL;
+#endif /* DHD_POST_EAPOL_M1_AFTER_ROAM_EVT */
+#ifdef WLFBT
+       uint32 data_len = 0;
+       if (data)
+               data_len = ntoh32(e->datalen);
+#endif /* WLFBT */
+
+       BCM_REFERENCE(dhdp);
+       curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+       chanspec = (chanspec_t *)wl_read_prof(cfg, ndev, WL_PROF_CHAN);
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) || defined(WL_COMPAT_WIRELESS)
+       /* Skip calling cfg80211_roamed If the channels are same and
+        * the current bssid & the new bssid are same
+        * Also clear timer roam_timeout.
+        * Only used on BCM4359 devices.
+        */
+       bzero(&ci, sizeof(ci));
+       if ((wldev_ioctl_get(ndev, WLC_GET_CHANNEL, &ci,
+                       sizeof(ci))) < 0) {
+               WL_ERR(("Failed to get current channel !"));
+               err = BCME_ERROR;
+               goto fail;
+       }
+       cur_channel = dtoh32(ci.hw_channel);
+       if ((CHSPEC_CHANNEL(*chanspec) == cur_channel) && ((memcmp(curbssid, &e->addr,
+                       ETHER_ADDR_LEN) == 0) || (memcmp(&cfg->last_roamed_addr,
+                       &e->addr, ETHER_ADDR_LEN) == 0))) {
+               WL_DBG(("BSS already present, Skipping roamed event to"
+               " upper layer\n"));
+               goto fail;
+       }
+#endif /* LINUX_VERSION > 2.6.39 || WL_COMPAT_WIRELESS */
+
+       if ((err = wl_get_assoc_ies(cfg, ndev)) != BCME_OK) {
+               DHD_STATLOG_CTRL(dhdp, ST(DISASSOC_INT_START),
+                       dhd_net2idx(dhdp->info, ndev), WLAN_REASON_DEAUTH_LEAVING);
+               WL_ERR(("Fetching Assoc IEs failed, Skipping roamed event to"
+                       " upper layer\n"));
+               /* To make sure disconnect, and fw sync, explictly send dissassoc
+                * for BSSID 00:00:00:00:00:00 issue
+                */
+               bzero(&scbval, sizeof(scb_val_t));
+               scbval.val = WLAN_REASON_DEAUTH_LEAVING;
+               memcpy(&scbval.ea, curbssid, ETHER_ADDR_LEN);
+               scbval.val = htod32(scbval.val);
+               if (wldev_ioctl_set(ndev, WLC_DISASSOC, &scbval,
+                               sizeof(scb_val_t)) < 0) {
+                       WL_ERR(("WLC_DISASSOC error\n"));
+               }
+               goto fail;
+       }
+
+       wl_update_prof(cfg, ndev, NULL, (const void *)(e->addr.octet), WL_PROF_BSSID);
+       curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+       if ((err = wl_update_bss_info(cfg, ndev, true)) != BCME_OK) {
+               WL_ERR(("failed to update bss info, err=%d\n", err));
+               goto fail;
+       }
+       if (cfg->wlc_ver.wlc_ver_major < PMKDB_WLC_VER) {
+               wl_update_pmklist(ndev, cfg->pmk_list, err);
+       }
+
+       chanspec = (chanspec_t *)wl_read_prof(cfg, ndev, WL_PROF_CHAN);
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) || defined(WL_COMPAT_WIRELESS)
+       /* channel info for cfg80211_roamed introduced in 2.6.39-rc1 */
+       freq = wl_channel_to_frequency(wf_chspec_ctlchan(*chanspec), CHSPEC_BAND(*chanspec));
+       notify_channel = ieee80211_get_channel(wiphy, freq);
+#endif /* LINUX_VERSION > 2.6.39  || WL_COMPAT_WIRELESS */
+#ifdef WLFBT
+       /* back up the given FBT key for the further supplicant request,
+        * currently not checking the FBT is enabled for current BSS in DHD,
+        * because the supplicant decides to take it or not.
+        */
+       if (data && (data_len == FBT_KEYLEN)) {
+               memcpy(cfg->fbt_key, data, FBT_KEYLEN);
+       }
+#endif /* WLFBT */
+#ifdef CUSTOM_LONG_RETRY_LIMIT
+       if (wl_set_retry(ndev, CUSTOM_LONG_RETRY_LIMIT, 1) < 0) {
+               WL_ERR(("CUSTOM_LONG_RETRY_LIMIT set fail!\n"));
+       }
+#endif /* CUSTOM_LONG_RETRY_LIMIT */
+       DHD_STATLOG_CTRL(dhdp, ST(REASSOC_INFORM),
+               dhd_net2idx(dhdp->info, ndev), 0);
+       WL_ERR(("Report roam event to upper layer. " MACDBG " (ch:%d)\n",
+               MAC2STRDBG((const u8*)(&e->addr)), CHSPEC_CHANNEL(*chanspec)));
+       wl_cfg80211_check_in4way(cfg, ndev, 0, WL_EXT_STATUS_CONNECTED, NULL);
+
+#if (defined(CONFIG_ARCH_MSM) && defined(CFG80211_ROAMED_API_UNIFIED)) || \
+       (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)) || defined(WL_FILS_ROAM_OFFLD) || \
+       defined(CFG80211_ROAM_API_GE_4_12)
+       memset(&roam_info, 0, sizeof(struct cfg80211_roam_info));
+       roam_info.channel = notify_channel;
+       roam_info.bssid = curbssid;
+       roam_info.req_ie = conn_info->req_ie;
+       roam_info.req_ie_len = conn_info->req_ie_len;
+       roam_info.resp_ie = conn_info->resp_ie;
+       roam_info.resp_ie_len = conn_info->resp_ie_len;
+#if defined(WL_FILS_ROAM_OFFLD)
+       if ((sec->auth_type == DOT11_FILS_SKEY_PFS)||(sec->auth_type == DOT11_FILS_SKEY)) {
+               roam_info.fils.kek = fils_info->fils_kek;
+               roam_info.fils.kek_len = fils_info->fils_kek_len;
+               roam_info.fils.update_erp_next_seq_num = true;
+               roam_info.fils.erp_next_seq_num = fils_info->fils_erp_next_seq_num;
+               roam_info.fils.pmk = fils_info->fils_pmk;
+               roam_info.fils.pmk_len = fils_info->fils_kek_len;
+               roam_info.fils.pmkid = fils_info->fils_pmkid;
+       }
+#endif
+       cfg80211_roamed(ndev, &roam_info, GFP_KERNEL);
+#else
+       cfg80211_roamed(ndev,
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) || defined(WL_COMPAT_WIRELESS)
+               notify_channel,
+#endif
+               curbssid,
+               conn_info->req_ie, conn_info->req_ie_len,
+               conn_info->resp_ie, conn_info->resp_ie_len, GFP_KERNEL);
+#endif /* (CONFIG_ARCH_MSM && CFG80211_ROAMED_API_UNIFIED) || LINUX_VERSION >= 4.12.0 */
+
+       memcpy(&cfg->last_roamed_addr, &e->addr, ETHER_ADDR_LEN);
+       wl_set_drv_status(cfg, CONNECTED, ndev);
+
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+       cfg->roam_count++;
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+#ifdef WL_BAM
+       if (wl_adps_bad_ap_check(cfg, &e->addr)) {
+               if (wl_adps_enabled(cfg, ndev)) {
+                       wl_adps_set_suspend(cfg, ndev, ADPS_SUSPEND);
+               }
+       }
+#endif /* WL_BAM */
+
+#ifdef DHD_POST_EAPOL_M1_AFTER_ROAM_EVT
+       ifp = dhd_get_ifp(dhdp, e->ifidx);
+       if (ifp) {
+               ifp->post_roam_evt = TRUE;
+       }
+#endif /* DHD_POST_EAPOL_M1_AFTER_ROAM_EVT */
+
+       return err;
+
+fail:
+#ifdef DHD_LOSSLESS_ROAMING
+       wl_del_roam_timeout(cfg);
+#endif  /* DHD_LOSSLESS_ROAMING */
+       return err;
+}
+
+static bool
+wl_cfg80211_verify_bss(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       struct cfg80211_bss **bss)
+{
+       struct wiphy *wiphy;
+       struct wlc_ssid *ssid;
+       uint8 *curbssid;
+       int count = 0;
+       int ret = false;
+       u8 cur_ssid[DOT11_MAX_SSID_LEN + 1];
+
+       wiphy = bcmcfg_to_wiphy(cfg);
+       ssid = (struct wlc_ssid *)wl_read_prof(cfg, ndev, WL_PROF_SSID);
+       curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+       if (!ssid) {
+               WL_ERR(("No SSID found in the saved profile \n"));
+               return false;
+       }
+
+       do {
+               *bss = CFG80211_GET_BSS(wiphy, NULL, curbssid,
+                       ssid->SSID, ssid->SSID_len);
+               if (*bss || (count > 5)) {
+                       break;
+               }
+
+               count++;
+               msleep(100);
+       } while (*bss == NULL);
+
+       WL_DBG(("cfg80211 bss_ptr:%p loop_cnt:%d\n", *bss, count));
+       if (*bss) {
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 7, 0))
+               /* Update the reference count after use. In case of kernel version >= 4.7
+               * the cfg802_put_bss is called in cfg80211_connect_bss context
+               */
+               CFG80211_PUT_BSS(wiphy, *bss);
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(4, 7, 0) */
+               ret = true;
+       } else {
+               memset(cur_ssid, 0, DOT11_MAX_SSID_LEN);
+               strncpy(cur_ssid, ssid->SSID,
+                       MIN(ssid->SSID_len, DOT11_MAX_SSID_LEN));
+               WL_ERR(("No bss entry for ssid:%s bssid:"MACDBG"\n",
+                       cur_ssid, MAC2STRDBG(curbssid)));
+       }
+
+       return ret;
+}
+
+#ifdef WL_FILS
+static s32
+wl_get_fils_connect_params(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       const bcm_xtlv_t* pxtlv_out;
+       struct wl_fils_info *fils_info = wl_to_fils_info(cfg);
+       int err = BCME_OK;
+       bcm_iov_buf_t *iov_buf_in = NULL;
+       bcm_iov_buf_t iov_buf_out = {0};
+       u16 len;
+       u16 type;
+       const u8 *data;
+       iov_buf_in = MALLOCZ(cfg->osh, WLC_IOCTL_SMLEN);
+       if (!iov_buf_in) {
+               WL_ERR(("buf memory alloc failed\n"));
+               err = BCME_NOMEM;
+               goto exit;
+       }
+       iov_buf_out.version = WL_FILS_IOV_VERSION;
+       iov_buf_out.id = WL_FILS_CMD_GET_CONNECT_PARAMS;
+       err = wldev_iovar_getbuf(ndev, "fils", (uint8*)&iov_buf_out, sizeof(bcm_iov_buf_t),
+               iov_buf_in, WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("Get FILS Params Error (%d)\n", err));
+               goto exit;
+       }
+       pxtlv_out = (bcm_xtlv_t*)((bcm_iov_buf_t*)iov_buf_in)->data;
+       len = iov_buf_in->len;
+       do {
+               if (!bcm_valid_xtlv(pxtlv_out, iov_buf_in->len, BCM_XTLV_OPTION_ALIGN32)) {
+                       WL_ERR(("%s: XTLV is not valid\n", __func__));
+                       err = BCME_BADARG;
+                       goto exit;
+               }
+               bcm_xtlv_unpack_xtlv(pxtlv_out, &type, &len, &data, BCM_XTLV_OPTION_ALIGN32);
+               switch (type) {
+                       case WL_FILS_XTLV_ERP_NEXT_SEQ_NUM:
+                               fils_info->fils_erp_next_seq_num = *(const u16 *)data;
+                               break;
+                       case WL_FILS_XTLV_KEK:
+                               if (memcpy_s(fils_info->fils_kek,
+                                               WL_MAX_FILS_KEY_LEN, data, len) < 0) {
+                                       err = BCME_BADARG;
+                                       goto exit;
+                               }
+                               fils_info->fils_kek_len = len;
+                               break;
+                       case WL_FILS_XTLV_PMK:
+                               if (memcpy_s(fils_info->fils_pmk,
+                                               WL_MAX_FILS_KEY_LEN, data, len) < 0) {
+                                       err = BCME_BADARG;
+                                       goto exit;
+                               }
+                               fils_info->fils_pmk_len = len;
+                               break;
+                       case WL_FILS_XTLV_PMKID:
+                               if (memcpy_s(fils_info->fils_pmkid,
+                                               WL_MAX_FILS_KEY_LEN, data, len) < 0) {
+                                       err = BCME_BADARG;
+                                       goto exit;
+                               }
+                               break;
+                       default:
+                               WL_ERR(("%s: wrong XTLV code\n", __func__));
+                               break;
+
+               }
+       } while ((pxtlv_out = bcm_next_xtlv(pxtlv_out, (int *)&iov_buf_in->len,
+               BCM_XTLV_OPTION_ALIGN32)) && iov_buf_in->len);
+exit:
+       if (iov_buf_in) {
+               MFREE(cfg->osh, iov_buf_in, WLC_IOCTL_SMLEN);
+       }
+       return err;
+}
+#endif /* WL_FILS */
+static s32
+wl_bss_connect_done(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data, bool completed)
+{
+       struct wl_connect_info *conn_info = wl_to_conn(cfg);
+       struct wl_security *sec = wl_read_prof(cfg, ndev, WL_PROF_SEC);
+       s32 err = 0;
+#ifdef WL_FILS
+       struct cfg80211_connect_resp_params resp_params = {0};
+       struct wl_fils_info *fils_info = NULL;
+       struct wlc_ssid *ssid = NULL;
+       struct wiphy *wiphy = NULL;
+
+#endif /* WL_FILS */
+#ifdef ESCAN_RESULT_PATCH
+       u8 *conn_req_bssid = wl_read_prof(cfg, ndev, WL_PROF_LATEST_BSSID);
+#endif /* ESCAN_RESULT_PATCH */
+       u8 *curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+       u32 event_type = ntoh32(e->event_type);
+       struct cfg80211_bss *bss = NULL;
+       dhd_pub_t *dhdp;
+       dhdp = (dhd_pub_t *)(cfg->pub);
+       BCM_REFERENCE(dhdp);
+
+       if (!sec) {
+               WL_ERR(("sec is NULL\n"));
+               return -ENODEV;
+       }
+       WL_DBG((" enter\n"));
+#ifdef ESCAN_RESULT_PATCH
+       if (!conn_req_bssid) {
+               WL_ERR(("conn_req bssid is null\n"));
+               return -EINVAL;
+       }
+       if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+               if (memcmp(curbssid, conn_req_bssid, ETHER_ADDR_LEN) == 0) {
+                       WL_INFORM_MEM((" Connected event of connected device "
+                               "e=%d s=%d, ignore it\n",
+                               ntoh32(e->event_type), ntoh32(e->status)));
+                       return err;
+               }
+       }
+       if (ETHER_ISNULLADDR(curbssid) &&
+               !ETHER_ISNULLADDR(conn_req_bssid)) {
+               WL_DBG(("copy bssid\n"));
+               memcpy(curbssid, conn_req_bssid, ETHER_ADDR_LEN);
+       }
+#else
+       if (cfg->scan_request) {
+               wl_cfg80211_cancel_scan(cfg);
+       }
+#endif /* ESCAN_RESULT_PATCH */
+       if (wl_get_drv_status(cfg, CONNECTING, ndev)) {
+               wl_cfg80211_scan_abort(cfg);
+               if (completed) {
+                       wl_get_assoc_ies(cfg, ndev);
+                       wl_update_prof(cfg, ndev, NULL, (const void *)(e->addr.octet),
+                               WL_PROF_BSSID);
+                       curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+                       /*
+                        * CFG layer relies on cached IEs (from probe/beacon) to fetch matching bss.
+                        * For cases, there is no match available,
+                        * need to update the cache based on bss info from fw.
+                        */
+                       wl_update_bss_info(cfg, ndev, true);
+                       if (cfg->wlc_ver.wlc_ver_major < PMKDB_WLC_VER) {
+                               wl_update_pmklist(ndev, cfg->pmk_list, err);
+                       }
+                       wl_set_drv_status(cfg, CONNECTED, ndev);
+#if defined(ROAM_ENABLE) && defined(ROAM_AP_ENV_DETECTION)
+                       if (dhdp->roam_env_detection)
+                               wldev_iovar_setint(ndev, "roam_env_detection",
+                                       AP_ENV_INDETERMINATE);
+#endif /* ROAM_AP_ENV_DETECTION */
+                       if (ndev != bcmcfg_to_prmry_ndev(cfg)) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0)
+                               init_completion(&cfg->iface_disable);
+#else
+                               /* reinitialize completion to clear previous count */
+                               INIT_COMPLETION(cfg->iface_disable);
+#endif
+                       }
+#ifdef CUSTOM_SET_CPUCORE
+                       if (wl_get_chan_isvht80(ndev, dhdp)) {
+                               if (ndev == bcmcfg_to_prmry_ndev(cfg))
+                                       dhdp->chan_isvht80 |= DHD_FLAG_STA_MODE; /* STA mode */
+                               else if (is_p2p_group_iface(ndev->ieee80211_ptr))
+                                       dhdp->chan_isvht80 |= DHD_FLAG_P2P_MODE; /* p2p mode */
+                               dhd_set_cpucore(dhdp, TRUE);
+                       }
+#endif /* CUSTOM_SET_CPUCORE */
+#ifdef CUSTOM_LONG_RETRY_LIMIT
+                       if (wl_set_retry(ndev, CUSTOM_LONG_RETRY_LIMIT, 1) < 0) {
+                               WL_ERR(("CUSTOM_LONG_RETRY_LIMIT set fail!\n"));
+                       }
+#endif /* CUSTOM_LONG_RETRY_LIMIT */
+                       bzero(&cfg->last_roamed_addr, ETHER_ADDR_LEN);
+               }
+               wl_clr_drv_status(cfg, CONNECTING, ndev);
+
+               if (completed) {
+                       if (wl_cfg80211_verify_bss(cfg, ndev, &bss) != true) {
+                               /* If bss entry is not available in the cfg80211 bss cache
+                                * the wireless stack will complain and won't populate
+                                * wdev->current_bss ptr
+                                */
+                               WL_ERR(("BSS entry not found. Indicate assoc event failure\n"));
+                               completed = false;
+                               sec->auth_assoc_res_status = WLAN_STATUS_UNSPECIFIED_FAILURE;
+                       } else if (!ndev->ieee80211_ptr->ssid_len) {
+                               /* In certain cases, the delayed cfg80211 work from
+                                * disconnect context will induce race conditions in
+                                * which the ssid_len will be cleared, but dhd is in
+                                * connecting state. Return connect failure to avoid
+                                * getting locked in connected state.
+                                */
+                               WL_ERR(("ssid_len=0. Indicate assoc event failure\n"));
+                               completed = false;
+                               sec->auth_assoc_res_status = WLAN_STATUS_UNSPECIFIED_FAILURE;
+                       }
+               }
+               if (completed) {
+                       WL_MSG(ndev->name, "Report connect result - connection succeeded\n");
+                       wl_cfg80211_check_in4way(cfg, ndev, 0, WL_EXT_STATUS_CONNECTED, NULL);
+               } else {
+                       WL_MSG(ndev->name, "Report connect result - connection failed\n");
+                       wl_cfg80211_check_in4way(cfg, ndev, NO_SCAN_IN4WAY|NO_BTC_IN4WAY|WAIT_DISCONNECTED,
+                               WL_EXT_STATUS_DISCONNECTED, NULL);
+               }
+#ifdef WL_FILS
+               if ((sec->auth_type == DOT11_FILS_SKEY_PFS)||(sec->auth_type == DOT11_FILS_SKEY)) {
+                       wl_get_fils_connect_params(cfg, ndev);
+                       fils_info = wl_to_fils_info(cfg);
+                       ssid = (struct wlc_ssid *)wl_read_prof(cfg, ndev, WL_PROF_SSID);
+                       wiphy = bcmcfg_to_wiphy(cfg);
+                       resp_params.status = completed ? WLAN_STATUS_SUCCESS :
+                               (sec->auth_assoc_res_status) ?
+                               sec->auth_assoc_res_status :
+                               WLAN_STATUS_UNSPECIFIED_FAILURE;
+                       resp_params.bssid = curbssid;
+                       resp_params.bss = CFG80211_GET_BSS(wiphy, NULL, curbssid,
+                               ssid->SSID, ssid->SSID_len);
+                       resp_params.req_ie = conn_info->req_ie;
+                       resp_params.req_ie_len = conn_info->req_ie_len;
+                       resp_params.resp_ie = conn_info->resp_ie;
+                       resp_params.resp_ie_len = conn_info->resp_ie_len;
+#if defined(WL_FILS_ROAM_OFFLD) || (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 18, 0))
+                       resp_params.fils.kek = fils_info->fils_kek;
+                       resp_params.fils.kek_len = fils_info->fils_kek_len;
+                       resp_params.fils.update_erp_next_seq_num = true;
+                       resp_params.fils.erp_next_seq_num = fils_info->fils_erp_next_seq_num;
+                       resp_params.fils.pmk = fils_info->fils_pmk;
+                       resp_params.fils.pmk_len = fils_info->fils_kek_len;
+                       resp_params.fils.pmkid = fils_info->fils_pmkid;
+#else
+                       resp_params.fils_kek = fils_info->fils_kek;
+                       resp_params.fils_kek_len = fils_info->fils_kek_len;
+                       resp_params.update_erp_next_seq_num = true;
+                       resp_params.fils_erp_next_seq_num = fils_info->fils_erp_next_seq_num;
+                       resp_params.pmk = fils_info->fils_pmk;
+                       resp_params.pmk_len = fils_info->fils_kek_len;
+                       resp_params.pmkid = fils_info->fils_pmkid;
+#endif /* WL_FILS_ROAM_OFFLD */
+                       cfg80211_connect_done(ndev, &resp_params, GFP_KERNEL);
+               }
+               else
+#endif /* WL_FILS */
+               {
+                       CFG80211_CONNECT_RESULT(ndev,
+                               curbssid,
+                               bss,
+                               conn_info->req_ie,
+                               conn_info->req_ie_len,
+                               conn_info->resp_ie,
+                               conn_info->resp_ie_len,
+                               completed ? WLAN_STATUS_SUCCESS :
+                               (sec->auth_assoc_res_status) ?
+                               sec->auth_assoc_res_status :
+                               WLAN_STATUS_UNSPECIFIED_FAILURE,
+                               GFP_KERNEL);
+               }
+               CLR_TS(cfg, conn_start);
+               if (completed) {
+                       LOG_TS(cfg, conn_cmplt);
+                       LOG_TS(cfg, authorize_start);
+#ifdef BCMWAPI_WPI
+                       if (sec->cipher_group == WLAN_CIPHER_SUITE_SMS4) {
+                               /* In WAPI case, there is no seperate authorized call
+                                * from upper layer. so set the state from connect done.
+                                */
+                               wl_set_drv_status(cfg, AUTHORIZED, ndev);
+                               CLR_TS(cfg, authorize_start);
+                               LOG_TS(cfg, authorize_cmplt);
+                       }
+#endif /* WAPI */
+
+#if defined(CONFIG_TIZEN)
+                       net_stat_tizen_update_wifi(ndev, WIFISTAT_CONNECTION);
+#endif /* CONFIG_TIZEN */
+#ifdef WL_BAM
+                       if (wl_adps_bad_ap_check(cfg, &e->addr)) {
+                               if (wl_adps_enabled(cfg, ndev)) {
+                                       wl_adps_set_suspend(cfg, ndev, ADPS_SUSPEND);
+                               }
+                       }
+#endif /* WL_BAM */
+               }
+       } else {
+               WL_INFORM_MEM(("[%s] Ignore event:%d. drv status"
+                       " connecting:%x. connected:%d\n",
+                       ndev->name, event_type, wl_get_drv_status(cfg, CONNECTING, ndev),
+                       wl_get_drv_status(cfg, CONNECTED, ndev)));
+       }
+#ifdef CONFIG_TCPACK_FASTTX
+       if (wl_get_chan_isvht80(ndev, dhdp))
+               wldev_iovar_setint(ndev, "tcpack_fast_tx", 0);
+       else
+               wldev_iovar_setint(ndev, "tcpack_fast_tx", 1);
+#endif /* CONFIG_TCPACK_FASTTX */
+
+       return err;
+}
+
+static s32
+wl_notify_mic_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       struct net_device *ndev = NULL;
+       u16 flags = ntoh16(e->flags);
+       enum nl80211_key_type key_type;
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       WL_INFORM_MEM(("[%s] mic fail event - " MACDBG " \n",
+               ndev->name, MAC2STRDBG(e->addr.octet)));
+       mutex_lock(&cfg->usr_sync);
+       if (flags & WLC_EVENT_MSG_GROUP)
+               key_type = NL80211_KEYTYPE_GROUP;
+       else
+               key_type = NL80211_KEYTYPE_PAIRWISE;
+
+       wl_flush_fw_log_buffer(ndev, FW_LOGSET_MASK_ALL);
+       cfg80211_michael_mic_failure(ndev, (const u8 *)&e->addr, key_type, -1,
+               NULL, GFP_KERNEL);
+       mutex_unlock(&cfg->usr_sync);
+
+       return 0;
+}
+
+#ifdef BT_WIFI_HANDOVER
+static s32
+wl_notify_bt_wifi_handover_req(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       struct net_device *ndev = NULL;
+       u32 event = ntoh32(e->event_type);
+       u32 datalen = ntoh32(e->datalen);
+       s32 err;
+
+       WL_ERR(("wl_notify_bt_wifi_handover_req: event_type : %d, datalen : %d\n", event, datalen));
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+       err = wl_genl_send_msg(ndev, event, data, (u16)datalen, 0, 0);
+
+       return err;
+}
+#endif /* BT_WIFI_HANDOVER */
+
+static s32
+wl_frame_get_mgmt(struct bcm_cfg80211 *cfg, u16 fc,
+       const struct ether_addr *da, const struct ether_addr *sa,
+       const struct ether_addr *bssid, u8 **pheader, u32 *body_len, u8 *pbody)
+{
+       struct dot11_management_header *hdr;
+       u32 totlen = 0;
+       s32 err = 0;
+       u8 *offset;
+       u32 prebody_len = *body_len;
+       switch (fc) {
+               case FC_ASSOC_REQ:
+                       /* capability , listen interval */
+                       totlen = DOT11_ASSOC_REQ_FIXED_LEN;
+                       *body_len += DOT11_ASSOC_REQ_FIXED_LEN;
+                       break;
+
+               case FC_REASSOC_REQ:
+                       /* capability, listen inteval, ap address */
+                       totlen = DOT11_REASSOC_REQ_FIXED_LEN;
+                       *body_len += DOT11_REASSOC_REQ_FIXED_LEN;
+                       break;
+       }
+       totlen += DOT11_MGMT_HDR_LEN + prebody_len;
+       *pheader = (u8 *)MALLOCZ(cfg->osh, totlen);
+       if (*pheader == NULL) {
+               WL_ERR(("memory alloc failed \n"));
+               return -ENOMEM;
+       }
+       hdr = (struct dot11_management_header *) (*pheader);
+       hdr->fc = htol16(fc);
+       hdr->durid = 0;
+       hdr->seq = 0;
+       offset = (u8*)(hdr + 1) + (totlen - DOT11_MGMT_HDR_LEN - prebody_len);
+       bcopy((const char*)da, (u8*)&hdr->da, ETHER_ADDR_LEN);
+       bcopy((const char*)sa, (u8*)&hdr->sa, ETHER_ADDR_LEN);
+       bcopy((const char*)bssid, (u8*)&hdr->bssid, ETHER_ADDR_LEN);
+       if ((pbody != NULL) && prebody_len)
+               bcopy((const char*)pbody, offset, prebody_len);
+       *body_len = totlen;
+       return err;
+}
+
+#ifdef WL_CFG80211_GON_COLLISION
+static void
+wl_gon_req_collision(struct bcm_cfg80211 *cfg, wl_action_frame_t *tx_act_frm,
+       wifi_p2p_pub_act_frame_t *rx_act_frm, struct net_device *ndev,
+       struct ether_addr sa, struct ether_addr da)
+{
+       if (cfg->afx_hdl->pending_tx_act_frm == NULL)
+               return;
+
+       if (tx_act_frm &&
+               wl_cfgp2p_is_pub_action(tx_act_frm->data, tx_act_frm->len)) {
+               wifi_p2p_pub_act_frame_t *pact_frm;
+
+               pact_frm = (wifi_p2p_pub_act_frame_t *)tx_act_frm->data;
+
+               if (!(pact_frm->subtype == P2P_PAF_GON_REQ &&
+                       rx_act_frm->subtype == P2P_PAF_GON_REQ)) {
+                       return;
+               }
+       }
+
+       WL_ERR((" GO NEGO Request COLLISION !!! \n"));
+
+       /* if sa(peer) addr is less than da(my) addr,
+        * my device will process peer's gon request and block to send my gon req.
+        *
+        * if not (sa addr > da addr),
+        * my device will process gon request and drop gon req of peer.
+        */
+       if (memcmp(sa.octet, da.octet, ETHER_ADDR_LEN) < 0) {
+               /* block to send tx gon request */
+               cfg->block_gon_req_tx_count = BLOCK_GON_REQ_MAX_NUM;
+               WL_ERR((" block to send gon req tx !!!\n"));
+
+               /* if we are finding a common channel for sending af,
+                * do not scan more to block to send current gon req
+                */
+               if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+                       wl_clr_drv_status(cfg, FINDING_COMMON_CHANNEL, ndev);
+                       complete(&cfg->act_frm_scan);
+               }
+       } else {
+               /* drop gon request of peer to process gon request by my device. */
+               WL_ERR((" drop to receive gon req rx !!! \n"));
+               cfg->block_gon_req_rx_count = BLOCK_GON_REQ_MAX_NUM;
+       }
+
+       return;
+}
+#endif /* WL_CFG80211_GON_COLLISION */
+
+void
+wl_stop_wait_next_action_frame(struct bcm_cfg80211 *cfg, struct net_device *ndev, u8 bsscfgidx)
+{
+       s32 err = 0;
+
+       if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+               if (timer_pending(&cfg->p2p->listen_timer)) {
+                       del_timer_sync(&cfg->p2p->listen_timer);
+               }
+               if (cfg->afx_hdl != NULL) {
+                       if (cfg->afx_hdl->dev != NULL) {
+                               wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+                               wl_clr_drv_status(cfg, FINDING_COMMON_CHANNEL, cfg->afx_hdl->dev);
+                       }
+                       cfg->afx_hdl->peer_chan = WL_INVALID;
+               }
+               complete(&cfg->act_frm_scan);
+               WL_DBG(("*** Wake UP ** Working afx searching is cleared\n"));
+       } else if (wl_get_drv_status_all(cfg, SENDING_ACT_FRM)) {
+               if (!(wl_get_p2p_status(cfg, ACTION_TX_COMPLETED) ||
+                       wl_get_p2p_status(cfg, ACTION_TX_NOACK)))
+                       wl_set_p2p_status(cfg, ACTION_TX_COMPLETED);
+
+               WL_DBG(("*** Wake UP ** abort actframe iovar on bsscfxidx %d\n", bsscfgidx));
+               /* Scan engine is not used for sending action frames in the latest driver
+                * branches. actframe_abort is used in the latest driver branches
+                * instead of scan abort.
+                *  If actframe_abort iovar succeeds, don't execute scan abort.
+                *  If actframe_abort fails with unsupported error,
+                *  execute scan abort (for backward copmatibility).
+                */
+               if (cfg->af_sent_channel) {
+                       err = wldev_iovar_setint_bsscfg(ndev, "actframe_abort", 1, bsscfgidx);
+                       if (err < 0) {
+                               if (err == BCME_UNSUPPORTED) {
+                                       wl_cfg80211_scan_abort(cfg);
+                               } else {
+                                       WL_ERR(("actframe_abort failed. ret:%d\n", err));
+                               }
+                       }
+               }
+       }
+#ifdef WL_CFG80211_SYNC_GON
+       else if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM_LISTEN)) {
+               WL_DBG(("*** Wake UP ** abort listen for next af frame\n"));
+               /* So abort scan to cancel listen */
+               wl_cfg80211_scan_abort(cfg);
+       }
+#endif /* WL_CFG80211_SYNC_GON */
+}
+
+#if defined(WLTDLS)
+bool wl_cfg80211_is_tdls_tunneled_frame(void *frame, u32 frame_len)
+{
+       unsigned char *data;
+
+       if (frame == NULL) {
+               WL_ERR(("Invalid frame \n"));
+               return false;
+       }
+
+       if (frame_len < 5) {
+               WL_ERR(("Invalid frame length [%d] \n", frame_len));
+               return false;
+       }
+
+       data = frame;
+
+       if (!memcmp(data, TDLS_TUNNELED_PRB_REQ, 5) ||
+               !memcmp(data, TDLS_TUNNELED_PRB_RESP, 5)) {
+               WL_DBG(("TDLS Vendor Specific Received type\n"));
+               return true;
+       }
+
+       return false;
+}
+#endif /* WLTDLS */
+
+#if defined(WES_SUPPORT)
+int wl_cfg80211_set_wes_mode(struct net_device *dev, int mode)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       cfg->wes_mode = mode;
+       return 0;
+}
+
+int wl_cfg80211_get_wes_mode(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       return cfg->wes_mode;
+}
+
+bool wl_cfg80211_is_wes(void *frame, u32 frame_len)
+{
+       unsigned char *data;
+
+       if (frame == NULL) {
+               WL_ERR(("Invalid frame \n"));
+               return false;
+       }
+
+       if (frame_len < 4) {
+               WL_ERR(("Invalid frame length [%d] \n", frame_len));
+               return false;
+       }
+
+       data = frame;
+
+       if (memcmp(data, "\x7f\x00\x00\xf0", 4) == 0) {
+               WL_DBG(("Receive WES VS Action Frame \n"));
+               return true;
+       }
+
+       return false;
+}
+
+int
+wl_cfg80211_set_ncho_mode(struct net_device *dev, int mode)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       cfg->ncho_mode = mode;
+       return BCME_OK;
+}
+
+int
+wl_cfg80211_get_ncho_mode(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       return cfg->ncho_mode;
+}
+#endif /* WES_SUPPORT */
+
+int wl_cfg80211_get_ioctl_version(void)
+{
+       return ioctl_version;
+}
+
+static s32
+wl_notify_rx_mgmt_frame(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       struct ether_addr da;
+       struct ether_addr bssid;
+       bool isfree = false;
+       s32 err = 0;
+       s32 freq;
+       struct net_device *ndev = NULL;
+       wifi_p2p_pub_act_frame_t *act_frm = NULL;
+       wifi_p2p_action_frame_t *p2p_act_frm = NULL;
+       wifi_p2psd_gas_pub_act_frame_t *sd_act_frm = NULL;
+       wl_event_rx_frame_data_t *rxframe;
+       u32 event;
+       u8 *mgmt_frame;
+       u8 bsscfgidx;
+       u32 mgmt_frame_len;
+       chanspec_t chspec;
+#if defined(TDLS_MSG_ONLY_WFD) && defined(WLTDLS)
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+#endif /* BCMDONGLEHOST && TDLS_MSG_ONLY_WFD && WLTDLS */
+       if (ntoh32(e->datalen) < sizeof(wl_event_rx_frame_data_t)) {
+               WL_ERR(("wrong datalen:%d\n", ntoh32(e->datalen)));
+               return -EINVAL;
+       }
+       mgmt_frame_len = ntoh32(e->datalen) - (uint32)sizeof(wl_event_rx_frame_data_t);
+       event = ntoh32(e->event_type);
+       bsscfgidx = e->bsscfgidx;
+       rxframe = (wl_event_rx_frame_data_t *)data;
+       if (!rxframe) {
+               WL_ERR(("rxframe: NULL\n"));
+               return -EINVAL;
+       }
+       chspec = ntoh16(rxframe->channel);
+       bzero(&bssid, ETHER_ADDR_LEN);
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+       if ((ndev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) &&
+               (event == WLC_E_PROBREQ_MSG)) {
+               /* Probe req event comes on wlan0 interface even though
+                * the frame have been received on correct interface(AP)
+                * in firmware. Find the right interface to pass it up.
+                * Required for WPS-AP certification 4.2.13.
+                *  TODO/Need a better fix. Current fix doesn't take
+                * care of dual AP/GO scenarios.
+                */
+               struct net_info *iter, *next;
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               for_each_ndev(cfg, iter, next) {
+                       GCC_DIAGNOSTIC_POP();
+                       if (iter->ndev && iter->wdev &&
+                                       iter->wdev->iftype == NL80211_IFTYPE_AP) {
+                                       ndev = iter->ndev;
+                                       cfgdev =  ndev_to_cfgdev(ndev);
+                                       break;
+                       }
+               }
+       }
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 39) && !defined(WL_COMPAT_WIRELESS)
+       freq = ieee80211_channel_to_frequency(CHSPEC_CHANNEL(chspec));
+#else
+       freq = wl_channel_to_frequency(wf_chspec_ctlchan(chspec), CHSPEC_BAND(chspec));
+#endif
+       if (event == WLC_E_ACTION_FRAME_RX) {
+               u8 ioctl_buf[WLC_IOCTL_SMLEN];
+               if ((err = wldev_iovar_getbuf_bsscfg(ndev, "cur_etheraddr",
+                               NULL, 0, ioctl_buf, sizeof(ioctl_buf), bsscfgidx,
+                               NULL)) != BCME_OK) {
+                       WL_ERR(("WLC_GET_CUR_ETHERADDR failed, error %d\n", err));
+                       goto exit;
+               }
+
+               err = wldev_ioctl_get(ndev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN);
+               if (err < 0)
+                        WL_ERR(("WLC_GET_BSSID error %d\n", err));
+               memcpy(da.octet, ioctl_buf, ETHER_ADDR_LEN);
+               err = wl_frame_get_mgmt(cfg, FC_ACTION, &da, &e->addr, &bssid,
+                       &mgmt_frame, &mgmt_frame_len,
+                       (u8 *)((wl_event_rx_frame_data_t *)rxframe + 1));
+               if (err < 0) {
+                       WL_ERR(("Error in receiving action frame len %d channel %d freq %d\n",
+                               mgmt_frame_len, CHSPEC_CHANNEL(chspec), freq));
+                       goto exit;
+               }
+               isfree = true;
+
+               wl_cfgp2p_print_actframe(false, &mgmt_frame[DOT11_MGMT_HDR_LEN],
+                       mgmt_frame_len - DOT11_MGMT_HDR_LEN, CHSPEC_CHANNEL(chspec));
+
+               if (wl_cfgp2p_is_pub_action(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+                       mgmt_frame_len - DOT11_MGMT_HDR_LEN)) {
+                       act_frm = (wifi_p2p_pub_act_frame_t *)
+                                       (&mgmt_frame[DOT11_MGMT_HDR_LEN]);
+               } else if (wl_cfgp2p_is_p2p_action(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+                       mgmt_frame_len - DOT11_MGMT_HDR_LEN)) {
+                       p2p_act_frm = (wifi_p2p_action_frame_t *)
+                                       (&mgmt_frame[DOT11_MGMT_HDR_LEN]);
+                       (void) p2p_act_frm;
+               } else if (wl_cfg80211_is_dpp_gas_action(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+                       mgmt_frame_len - DOT11_MGMT_HDR_LEN)) {
+                       wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, ndev);
+
+                       /* Stop waiting for next AF. */
+                       wl_stop_wait_next_action_frame(cfg, ndev, bsscfgidx);
+               } else if (wl_cfgp2p_is_gas_action(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+                       mgmt_frame_len - DOT11_MGMT_HDR_LEN)) {
+                       sd_act_frm = (wifi_p2psd_gas_pub_act_frame_t *)
+                                       (&mgmt_frame[DOT11_MGMT_HDR_LEN]);
+                       if (sd_act_frm && wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM)) {
+                               if (cfg->next_af_subtype == sd_act_frm->action) {
+                                       WL_DBG(("We got a right next frame of SD!(%d)\n",
+                                               sd_act_frm->action));
+                                       wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, ndev);
+
+                                       /* Stop waiting for next AF. */
+                                       wl_stop_wait_next_action_frame(cfg, ndev, bsscfgidx);
+                               }
+                       }
+                       (void) sd_act_frm;
+#ifdef WLTDLS
+               } else if ((mgmt_frame[DOT11_MGMT_HDR_LEN] == TDLS_AF_CATEGORY) ||
+                               (wl_cfg80211_is_tdls_tunneled_frame(
+                                   &mgmt_frame[DOT11_MGMT_HDR_LEN],
+                                   mgmt_frame_len - DOT11_MGMT_HDR_LEN))) {
+                       if (mgmt_frame[DOT11_MGMT_HDR_LEN] == TDLS_AF_CATEGORY) {
+                               WL_ERR((" TDLS Action Frame Received type = %d \n",
+                                       mgmt_frame[DOT11_MGMT_HDR_LEN + 1]));
+                       }
+#ifdef TDLS_MSG_ONLY_WFD
+                       if (!dhdp->tdls_mode) {
+                               WL_DBG((" TDLS Frame filtered \n"));
+                               goto exit;
+                       }
+#else
+                       if (mgmt_frame[DOT11_MGMT_HDR_LEN + 1] == TDLS_ACTION_SETUP_RESP) {
+                               cfg->tdls_mgmt_frame = mgmt_frame;
+                               cfg->tdls_mgmt_frame_len = mgmt_frame_len;
+                               cfg->tdls_mgmt_freq = freq;
+                               return 0;
+                       }
+#endif /* TDLS_MSG_ONLY_WFD */
+#endif /* WLTDLS */
+#ifdef QOS_MAP_SET
+               } else if (mgmt_frame[DOT11_MGMT_HDR_LEN] == DOT11_ACTION_CAT_QOS) {
+                       /* update QoS map set table */
+                       bcm_tlv_t * qos_map_ie = NULL;
+                       uint8 offset = DOT11_MGMT_HDR_LEN + DOT11_ACTION_FRMHDR_LEN;
+                       if ((qos_map_ie = bcm_parse_tlvs(&mgmt_frame[offset],
+                                       mgmt_frame_len - offset, DOT11_MNG_QOS_MAP_ID)) != NULL) {
+                               WL_DBG((" QoS map set IE found in QoS action frame\n"));
+                               if (!cfg->up_table) {
+                                       cfg->up_table = (uint8 *)MALLOC(cfg->osh, UP_TABLE_MAX);
+                               }
+                               wl_set_up_table(cfg->up_table, qos_map_ie);
+                       } else {
+                               MFREE(cfg->osh, cfg->up_table, UP_TABLE_MAX);
+                       }
+#endif /* QOS_MAP_SET */
+#ifdef WBTEXT
+               } else if (mgmt_frame[DOT11_MGMT_HDR_LEN] == DOT11_ACTION_CAT_RRM) {
+                       /* radio measurement category */
+                       switch (mgmt_frame[DOT11_MGMT_HDR_LEN+1]) {
+                               case DOT11_RM_ACTION_NR_REP:
+                                       if (wl_cfg80211_recv_nbr_resp(ndev,
+                                                       &mgmt_frame[DOT11_MGMT_HDR_LEN],
+                                                       mgmt_frame_len - DOT11_MGMT_HDR_LEN)
+                                                       == BCME_OK) {
+                                               WL_DBG(("RCC updated by nbr response\n"));
+                                       }
+                                       break;
+                               default:
+                                       break;
+                       }
+#endif /* WBTEXT */
+               } else {
+                       /* WAR : There is no way to identify DA of action frame as of now.
+                        *  We have to modify firmware code to include DA and SA of Act frame
+                        *  as event data
+                        */
+                       /*
+                        *  if we got normal action frame and ndev is p2p0,
+                        *  we have to change ndev from p2p0 to wlan0
+                        */
+#if defined(WES_SUPPORT)
+                       if (wl_cfg80211_is_wes(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+                       mgmt_frame_len - DOT11_MGMT_HDR_LEN) && cfg->wes_mode == 0) {
+                       /* Ignore WES VS Action frame */
+                       goto exit;
+                       }
+#endif /* WES_SUPPORT */
+
+                       /* We need to check proper action frame is received */
+                       if (cfg->next_af_subtype != WL_PUB_AF_STYPE_INVALID) {
+                               u8 action = 0;
+                               if (wl_get_public_action(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+                                       mgmt_frame_len - DOT11_MGMT_HDR_LEN, &action) != BCME_OK) {
+                                       WL_DBG(("Recived action is not public action frame\n"));
+                               } else if (cfg->next_af_subtype == action) {
+                                       WL_DBG(("Recived action is the waiting action(%d)\n",
+                                               action));
+                                       wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, ndev);
+
+                                       /* Stop waiting for next AF. */
+                                       wl_stop_wait_next_action_frame(cfg, ndev, bsscfgidx);
+                               }
+                       }
+               }
+
+               if (act_frm) {
+#ifdef WL_CFG80211_GON_COLLISION
+                       if (act_frm->subtype == P2P_PAF_GON_REQ) {
+                               wl_gon_req_collision(cfg,
+                                       &cfg->afx_hdl->pending_tx_act_frm->action_frame,
+                                       act_frm, ndev, e->addr, da);
+
+                               if (cfg->block_gon_req_rx_count) {
+                                       WL_ERR(("drop frame GON Req Rx : count (%d)\n",
+                                               cfg->block_gon_req_rx_count));
+                                       cfg->block_gon_req_rx_count--;
+                                       goto exit;
+                               }
+                       } else if (act_frm->subtype == P2P_PAF_GON_CONF) {
+                               /* if go formation done, clear it */
+                               cfg->block_gon_req_tx_count = 0;
+                               cfg->block_gon_req_rx_count = 0;
+                       }
+#endif /* WL_CFG80211_GON_COLLISION */
+
+                       if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM)) {
+                               if (cfg->next_af_subtype == act_frm->subtype) {
+                                       WL_DBG(("We got a right next frame!(%d)\n",
+                                               act_frm->subtype));
+                                       wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, ndev);
+
+                                       if (cfg->next_af_subtype == P2P_PAF_GON_CONF) {
+                                               OSL_SLEEP(20);
+                                       }
+
+                                       /* Stop waiting for next AF. */
+                                       wl_stop_wait_next_action_frame(cfg, ndev, bsscfgidx);
+                               } else if ((cfg->next_af_subtype == P2P_PAF_GON_RSP) &&
+                                               (act_frm->subtype == P2P_PAF_GON_REQ)) {
+                                       /* If current received frame is GO NEG REQ and next
+                                        * expected frame is GO NEG RESP, do not send it up.
+                                        */
+                                       WL_ERR(("GO Neg req received while waiting for RESP."
+                                               "Discard incoming frame\n"));
+                                       goto exit;
+                               }
+                       }
+               }
+
+               if (wl_cfg80211_is_dpp_frame(
+                       (void *)&mgmt_frame[DOT11_MGMT_HDR_LEN],
+                       mgmt_frame_len - DOT11_MGMT_HDR_LEN)) {
+                       wl_dpp_pa_frame_t *pa =
+                               (wl_dpp_pa_frame_t *)&mgmt_frame[DOT11_MGMT_HDR_LEN];
+                       if (cfg->next_af_subtype == pa->ftype) {
+                               WL_DBG(("matching dpp frm (%d) found. abort dwell\n", pa->ftype));
+                               wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, ndev);
+
+                               /* Stop waiting for next AF. */
+                               wl_stop_wait_next_action_frame(cfg, ndev, bsscfgidx);
+                       }
+               }
+               if (act_frm && (act_frm->subtype == P2P_PAF_GON_CONF)) {
+                       WL_DBG(("P2P: GO_NEG_PHASE status cleared \n"));
+                       wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+               }
+       } else if (event == WLC_E_PROBREQ_MSG) {
+
+               /* Handle probe reqs frame
+                * WPS-AP certification 4.2.13
+                */
+               struct parsed_ies prbreq_ies;
+               u32 prbreq_ie_len = 0;
+               bool pbc = 0;
+
+               WL_DBG((" Event WLC_E_PROBREQ_MSG received\n"));
+               mgmt_frame = (u8 *)(data);
+               mgmt_frame_len = ntoh32(e->datalen);
+               if (mgmt_frame_len < DOT11_MGMT_HDR_LEN) {
+                       WL_ERR(("wrong datalen:%d\n", mgmt_frame_len));
+                       return -EINVAL;
+               }
+               prbreq_ie_len = mgmt_frame_len - DOT11_MGMT_HDR_LEN;
+
+               /* Parse prob_req IEs */
+               if (wl_cfg80211_parse_ies(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+                       prbreq_ie_len, &prbreq_ies) < 0) {
+                       WL_ERR(("Prob req get IEs failed\n"));
+                       return 0;
+               }
+               if (prbreq_ies.wps_ie != NULL) {
+                       wl_validate_wps_ie(
+                               (const char *)prbreq_ies.wps_ie, prbreq_ies.wps_ie_len, &pbc);
+                       WL_DBG((" wps_ie exist pbc = %d\n", pbc));
+                       /* if pbc method, send prob_req mgmt frame to upper layer */
+                       if (!pbc)
+                               return 0;
+               } else
+                       return 0;
+       } else {
+               mgmt_frame = (u8 *)((wl_event_rx_frame_data_t *)rxframe + 1);
+
+               /* wpa supplicant use probe request event for restarting another GON Req.
+                * but it makes GON Req repetition.
+                * so if src addr of prb req is same as my target device,
+                * do not send probe request event during sending action frame.
+                */
+               if (event == WLC_E_P2P_PROBREQ_MSG) {
+                       WL_DBG((" Event %s\n", (event == WLC_E_P2P_PROBREQ_MSG) ?
+                               "WLC_E_P2P_PROBREQ_MSG":"WLC_E_PROBREQ_MSG"));
+
+#ifdef WL_CFG80211_USE_PRB_REQ_FOR_AF_TX
+                       if (WL_DRV_STATUS_SENDING_AF_FRM_EXT(cfg) &&
+                               !memcmp(cfg->afx_hdl->tx_dst_addr.octet, e->addr.octet,
+                               ETHER_ADDR_LEN)) {
+                               if (cfg->afx_hdl->pending_tx_act_frm &&
+                                       wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+                                       chanspec_t channel = hton16(rxframe->channel);
+                                       WL_DBG(("PROBE REQUEST : Peer found, channel : %d\n",
+                                               channel));
+                                       cfg->afx_hdl->peer_chan = channel;
+                                       complete(&cfg->act_frm_scan);
+                               }
+                       }
+#endif /* WL_CFG80211_USE_PRB_REQ_FOR_AF_TX */
+
+                       /* Filter any P2P probe reqs arriving during the
+                        * GO-NEG Phase
+                        */
+                       if (cfg->p2p &&
+#if defined(P2P_IE_MISSING_FIX)
+                               cfg->p2p_prb_noti &&
+#endif
+                               wl_get_p2p_status(cfg, GO_NEG_PHASE)) {
+                               WL_DBG(("Filtering P2P probe_req while "
+                                       "being in GO-Neg state\n"));
+                               return 0;
+                       }
+               }
+       }
+
+       if (discover_cfgdev(cfgdev, cfg))
+               WL_DBG(("Rx Managment frame For P2P Discovery Interface \n"));
+       else
+               WL_DBG(("Rx Managment frame For Iface (%s) \n", ndev->name));
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+        cfg80211_rx_mgmt(cfgdev, freq, 0,  mgmt_frame, mgmt_frame_len, 0);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0))
+       cfg80211_rx_mgmt(cfgdev, freq, 0,  mgmt_frame, mgmt_frame_len, 0, GFP_ATOMIC);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || \
+       defined(WL_COMPAT_WIRELESS)
+       cfg80211_rx_mgmt(cfgdev, freq, 0, mgmt_frame, mgmt_frame_len, GFP_ATOMIC);
+#else
+       cfg80211_rx_mgmt(cfgdev, freq, mgmt_frame, mgmt_frame_len, GFP_ATOMIC);
+#endif /* LINUX_VERSION >= VERSION(3, 18, 0) */
+
+       WL_DBG(("mgmt_frame_len (%d) , e->datalen (%d), channel (%d), freq (%d)\n",
+               mgmt_frame_len, ntoh32(e->datalen), CHSPEC_CHANNEL(chspec), freq));
+exit:
+       if (isfree) {
+               MFREE(cfg->osh, mgmt_frame, mgmt_frame_len);
+       }
+       return err;
+}
+
+static void wl_init_conf(struct wl_conf *conf)
+{
+       WL_DBG(("Enter \n"));
+       conf->frag_threshold = (u32)-1;
+       conf->rts_threshold = (u32)-1;
+       conf->retry_short = (u32)-1;
+       conf->retry_long = (u32)-1;
+       conf->tx_power = -1;
+}
+
+static void wl_init_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       unsigned long flags;
+       struct wl_profile *profile = wl_get_profile_by_netdev(cfg, ndev);
+
+       if (!profile) {
+               WL_ERR(("profile null\n"));
+               return;
+       }
+
+       WL_CFG_DRV_LOCK(&cfg->cfgdrv_lock, flags);
+       bzero(profile, sizeof(struct wl_profile));
+       WL_CFG_DRV_UNLOCK(&cfg->cfgdrv_lock, flags);
+}
+
+static void wl_init_event_handler(struct bcm_cfg80211 *cfg)
+{
+       bzero(cfg->evt_handler, sizeof(cfg->evt_handler));
+
+       cfg->evt_handler[WLC_E_SCAN_COMPLETE] = wl_notify_scan_status;
+       cfg->evt_handler[WLC_E_AUTH] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_ASSOC] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_LINK] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_DEAUTH_IND] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_DEAUTH] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_DISASSOC_IND] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_ASSOC_IND] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_REASSOC_IND] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_ROAM] = wl_notify_roaming_status;
+       cfg->evt_handler[WLC_E_MIC_ERROR] = wl_notify_mic_status;
+       cfg->evt_handler[WLC_E_SET_SSID] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_ACTION_FRAME_RX] = wl_notify_rx_mgmt_frame;
+       cfg->evt_handler[WLC_E_PROBREQ_MSG] = wl_notify_rx_mgmt_frame;
+       cfg->evt_handler[WLC_E_P2P_PROBREQ_MSG] = wl_notify_rx_mgmt_frame;
+       cfg->evt_handler[WLC_E_P2P_DISC_LISTEN_COMPLETE] = wl_cfgp2p_listen_complete;
+       cfg->evt_handler[WLC_E_ACTION_FRAME_COMPLETE] = wl_cfgp2p_action_tx_complete;
+       cfg->evt_handler[WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE] = wl_cfgp2p_action_tx_complete;
+       cfg->evt_handler[WLC_E_JOIN] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_START] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_AUTH_IND] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_ASSOC_RESP_IE] = wl_notify_connect_status;
+#ifdef PNO_SUPPORT
+       cfg->evt_handler[WLC_E_PFN_NET_FOUND] = wl_notify_pfn_status;
+#endif /* PNO_SUPPORT */
+#ifdef GSCAN_SUPPORT
+       cfg->evt_handler[WLC_E_PFN_BEST_BATCHING] = wl_notify_gscan_event;
+       cfg->evt_handler[WLC_E_PFN_SCAN_COMPLETE] = wl_notify_gscan_event;
+       cfg->evt_handler[WLC_E_PFN_GSCAN_FULL_RESULT] = wl_notify_gscan_event;
+       cfg->evt_handler[WLC_E_PFN_BSSID_NET_FOUND] = wl_notify_gscan_event;
+       cfg->evt_handler[WLC_E_PFN_BSSID_NET_LOST] = wl_notify_gscan_event;
+       cfg->evt_handler[WLC_E_PFN_SSID_EXT] = wl_notify_gscan_event;
+       cfg->evt_handler[WLC_E_GAS_FRAGMENT_RX] = wl_notify_gscan_event;
+       cfg->evt_handler[WLC_E_ROAM_EXP_EVENT] = wl_handle_roam_exp_event;
+#endif /* GSCAN_SUPPORT */
+#ifdef RSSI_MONITOR_SUPPORT
+       cfg->evt_handler[WLC_E_RSSI_LQM] = wl_handle_rssi_monitor_event;
+#endif /* RSSI_MONITOR_SUPPORT */
+#ifdef WLTDLS
+       cfg->evt_handler[WLC_E_TDLS_PEER_EVENT] = wl_tdls_event_handler;
+#endif /* WLTDLS */
+       cfg->evt_handler[WLC_E_BSSID] = wl_notify_roaming_status;
+#ifdef WLAIBSS
+       cfg->evt_handler[WLC_E_AIBSS_TXFAIL] = wl_notify_aibss_txfail;
+#endif /* WLAIBSS */
+#ifdef WL_RELMCAST
+       cfg->evt_handler[WLC_E_RMC_EVENT] = wl_notify_rmc_status;
+#endif /* WL_RELMCAST */
+#ifdef BT_WIFI_HANDOVER
+       cfg->evt_handler[WLC_E_BT_WIFI_HANDOVER_REQ] = wl_notify_bt_wifi_handover_req;
+#endif
+#ifdef WL_NAN
+       cfg->evt_handler[WLC_E_NAN_CRITICAL] = wl_cfgnan_notify_nan_status;
+       cfg->evt_handler[WLC_E_NAN_NON_CRITICAL] = wl_cfgnan_notify_nan_status;
+#endif /* WL_NAN */
+       cfg->evt_handler[WLC_E_CSA_COMPLETE_IND] = wl_csa_complete_ind;
+       cfg->evt_handler[WLC_E_AP_STARTED] = wl_ap_start_ind;
+#ifdef CUSTOM_EVENT_PM_WAKE
+       cfg->evt_handler[WLC_E_EXCESS_PM_WAKE_EVENT] = wl_check_pmstatus;
+#endif /* CUSTOM_EVENT_PM_WAKE */
+#if defined(DHD_LOSSLESS_ROAMING) || defined(DBG_PKT_MON)
+       cfg->evt_handler[WLC_E_ROAM_PREP] = wl_notify_roam_prep_status;
+#endif /* DHD_LOSSLESS_ROAMING || DBG_PKT_MON  */
+       cfg->evt_handler[WLC_E_ROAM_START] = wl_notify_roam_start_status;
+#ifdef WL_BAM
+       cfg->evt_handler[WLC_E_ADPS] = wl_adps_event_handler;
+#endif /* WL_BAM */
+       cfg->evt_handler[WLC_E_PSK_SUP] = wl_cfg80211_sup_event_handler;
+#ifdef WL_BCNRECV
+       cfg->evt_handler[WLC_E_BCNRECV_ABORTED] = wl_bcnrecv_aborted_event_handler;
+#endif /* WL_BCNRECV */
+#ifdef WL_MBO
+       cfg->evt_handler[WLC_E_MBO] = wl_mbo_event_handler;
+#endif  /* WL_MBO */
+#ifdef WL_CAC_TS
+       cfg->evt_handler[WLC_E_ADDTS_IND] = wl_cfg80211_cac_event_handler;
+       cfg->evt_handler[WLC_E_DELTS_IND] = wl_cfg80211_cac_event_handler;
+#endif /* WL_CAC_TS */
+#if defined(WL_MBO) || defined(WL_OCE)
+       cfg->evt_handler[WLC_E_PRUNE] = wl_bssid_prune_event_handler;
+#endif /* WL_MBO || WL_OCE */
+#ifdef RTT_SUPPORT
+       cfg->evt_handler[WLC_E_PROXD] = wl_cfg80211_rtt_event_handler;
+#endif
+#ifdef WL_CHAN_UTIL
+       cfg->evt_handler[WLC_E_BSS_LOAD] = wl_cfg80211_bssload_report_event_handler;
+#endif /* WL_CHAN_UTIL */
+#ifdef WL_CLIENT_SAE
+       cfg->evt_handler[WLC_E_JOIN_START] = wl_notify_start_auth;
+#endif /* WL_CLIENT_SAE */
+}
+
+#ifdef WL_CLIENT_SAE
+/** Called by the cfg80211 framework */
+static s32
+wl_cfg80211_external_auth(struct wiphy *wiphy,
+       struct net_device *ndev, struct cfg80211_external_auth_params *ext_auth_param)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       wl_assoc_mgr_cmd_t cmd;
+
+       WL_DBG(("Enter\n"));
+
+       if (!ext_auth_param ||
+               ETHER_ISNULLADDR(ext_auth_param->bssid)) {
+               WL_ERR(("Invalid wl_cfg80211_external_auth param\n"));
+               return -EINVAL;
+       }
+
+       cmd.version = WL_ASSOC_MGR_CURRENT_VERSION;
+       cmd.length = sizeof(cmd);
+       cmd.cmd = WL_ASSOC_MGR_CMD_PAUSE_ON_EVT;
+       cmd.params = WL_ASSOC_MGR_PARAMS_EVENT_NONE;
+       err = wldev_iovar_setbuf(ndev, "assoc_mgr_cmd", (void *)&cmd, sizeof(cmd), cfg->ioctl_buf,
+               WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("Failed to pause assoc(%d)\n", err));
+       }
+
+       return err;
+}
+#endif /* WL_CLIENT_SAE */
+
+#if defined(STATIC_WL_PRIV_STRUCT)
+static int
+wl_init_escan_result_buf(struct bcm_cfg80211 *cfg)
+{
+#ifdef DUAL_ESCAN_RESULT_BUFFER
+       cfg->escan_info.escan_buf[0] = DHD_OS_PREALLOC(cfg->pub,
+               DHD_PREALLOC_WIPHY_ESCAN0, ESCAN_BUF_SIZE);
+       if (cfg->escan_info.escan_buf[0] == NULL) {
+               WL_ERR(("Failed to alloc ESCAN_BUF0\n"));
+               return -ENOMEM;
+       }
+
+       cfg->escan_info.escan_buf[1] = DHD_OS_PREALLOC(cfg->pub,
+               DHD_PREALLOC_WIPHY_ESCAN1, ESCAN_BUF_SIZE);
+       if (cfg->escan_info.escan_buf[1] == NULL) {
+               WL_ERR(("Failed to alloc ESCAN_BUF1\n"));
+               return -ENOMEM;
+       }
+
+       bzero(cfg->escan_info.escan_buf[0], ESCAN_BUF_SIZE);
+       bzero(cfg->escan_info.escan_buf[1], ESCAN_BUF_SIZE);
+       cfg->escan_info.escan_type[0] = 0;
+       cfg->escan_info.escan_type[1] = 0;
+#else
+       cfg->escan_info.escan_buf = DHD_OS_PREALLOC(cfg->pub,
+               DHD_PREALLOC_WIPHY_ESCAN0, ESCAN_BUF_SIZE);
+       if (cfg->escan_info.escan_buf == NULL) {
+               WL_ERR(("Failed to alloc ESCAN_BUF\n"));
+               return -ENOMEM;
+       }
+       bzero(cfg->escan_info.escan_buf, ESCAN_BUF_SIZE);
+#endif /* DUAL_ESCAN_RESULT_BUFFER */
+
+       return 0;
+}
+
+static void
+wl_deinit_escan_result_buf(struct bcm_cfg80211 *cfg)
+{
+#ifdef DUAL_ESCAN_RESULT_BUFFER
+       if (cfg->escan_info.escan_buf[0] != NULL) {
+               cfg->escan_info.escan_buf[0] = NULL;
+               cfg->escan_info.escan_type[0] = 0;
+       }
+
+       if (cfg->escan_info.escan_buf[1] != NULL) {
+               cfg->escan_info.escan_buf[1] = NULL;
+               cfg->escan_info.escan_type[1] = 0;
+       }
+#else
+       if (cfg->escan_info.escan_buf != NULL) {
+               cfg->escan_info.escan_buf = NULL;
+       }
+#endif /* DUAL_ESCAN_RESULT_BUFFER */
+}
+#endif /* STATIC_WL_PRIV_STRUCT */
+
+static s32 wl_init_priv_mem(struct bcm_cfg80211 *cfg)
+{
+       WL_DBG(("Enter \n"));
+
+       cfg->scan_results = (struct wl_scan_results *)MALLOCZ(cfg->osh,
+               WL_SCAN_BUF_MAX);
+       if (unlikely(!cfg->scan_results)) {
+               WL_ERR(("Scan results alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       cfg->conf = (struct wl_conf *)MALLOCZ(cfg->osh, sizeof(*cfg->conf));
+       if (unlikely(!cfg->conf)) {
+               WL_ERR(("wl_conf alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       cfg->scan_req_int = (void *)MALLOCZ(cfg->osh,
+               sizeof(*cfg->scan_req_int));
+       if (unlikely(!cfg->scan_req_int)) {
+               WL_ERR(("Scan req alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       cfg->ioctl_buf = (u8 *)MALLOCZ(cfg->osh, WLC_IOCTL_MAXLEN);
+       if (unlikely(!cfg->ioctl_buf)) {
+               WL_ERR(("Ioctl buf alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       cfg->escan_ioctl_buf = (void *)MALLOCZ(cfg->osh, WLC_IOCTL_MAXLEN);
+       if (unlikely(!cfg->escan_ioctl_buf)) {
+               WL_ERR(("Ioctl buf alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       cfg->extra_buf = (void *)MALLOCZ(cfg->osh, WL_EXTRA_BUF_MAX);
+       if (unlikely(!cfg->extra_buf)) {
+               WL_ERR(("Extra buf alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       cfg->pmk_list = (void *)MALLOCZ(cfg->osh, sizeof(*cfg->pmk_list));
+       if (unlikely(!cfg->pmk_list)) {
+               WL_ERR(("pmk list alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+#if defined(STATIC_WL_PRIV_STRUCT)
+       cfg->conn_info = (void *)MALLOCZ(cfg->osh, sizeof(*cfg->conn_info));
+       if (unlikely(!cfg->conn_info)) {
+               WL_ERR(("cfg->conn_info alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       cfg->ie = (void *)MALLOC(cfg->osh, sizeof(*cfg->ie));
+       if (unlikely(!cfg->ie)) {
+               WL_ERR(("cfg->ie alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       if (unlikely(wl_init_escan_result_buf(cfg))) {
+               WL_ERR(("Failed to init escan resul buf\n"));
+               goto init_priv_mem_out;
+       }
+#endif /* STATIC_WL_PRIV_STRUCT */
+       cfg->afx_hdl = (void *)MALLOCZ(cfg->osh, sizeof(*cfg->afx_hdl));
+       if (unlikely(!cfg->afx_hdl)) {
+               WL_ERR(("afx hdl alloc failed\n"));
+               goto init_priv_mem_out;
+       } else {
+               init_completion(&cfg->act_frm_scan);
+               init_completion(&cfg->wait_next_af);
+
+               INIT_WORK(&cfg->afx_hdl->work, wl_cfg80211_afx_handler);
+       }
+#ifdef WLTDLS
+       if (cfg->tdls_mgmt_frame) {
+               MFREE(cfg->osh, cfg->tdls_mgmt_frame, cfg->tdls_mgmt_frame_len);
+               cfg->tdls_mgmt_frame = NULL;
+               cfg->tdls_mgmt_frame_len = 0;
+       }
+#endif /* WLTDLS */
+       cfg->spmk_info_list = (void *)MALLOCZ(cfg->osh, sizeof(*cfg->spmk_info_list));
+       if (unlikely(!cfg->spmk_info_list)) {
+               WL_ERR(("Single PMK info list allocation falure\n"));
+               goto init_priv_mem_out;
+       }
+
+       return 0;
+
+init_priv_mem_out:
+       wl_deinit_priv_mem(cfg);
+
+       return -ENOMEM;
+}
+
+static void wl_deinit_priv_mem(struct bcm_cfg80211 *cfg)
+{
+       MFREE(cfg->osh, cfg->scan_results, WL_SCAN_BUF_MAX);
+       MFREE(cfg->osh, cfg->conf, sizeof(*cfg->conf));
+       MFREE(cfg->osh, cfg->scan_req_int, sizeof(*cfg->scan_req_int));
+       MFREE(cfg->osh, cfg->ioctl_buf, WLC_IOCTL_MAXLEN);
+       MFREE(cfg->osh, cfg->escan_ioctl_buf, WLC_IOCTL_MAXLEN);
+       MFREE(cfg->osh, cfg->extra_buf, WL_EXTRA_BUF_MAX);
+       MFREE(cfg->osh, cfg->pmk_list, sizeof(*cfg->pmk_list));
+#if defined(STATIC_WL_PRIV_STRUCT)
+       MFREE(cfg->osh, cfg->conn_info, sizeof(*cfg->conn_info));
+       MFREE(cfg->osh, cfg->ie, sizeof(*cfg->ie));
+       wl_deinit_escan_result_buf(cfg);
+#endif /* STATIC_WL_PRIV_STRUCT */
+       if (cfg->afx_hdl) {
+               cancel_work_sync(&cfg->afx_hdl->work);
+               MFREE(cfg->osh, cfg->afx_hdl, sizeof(*cfg->afx_hdl));
+       }
+       MFREE(cfg->osh, cfg->spmk_info_list, sizeof(*cfg->spmk_info_list));
+
+}
+
+static s32 wl_create_event_handler(struct bcm_cfg80211 *cfg)
+{
+       int ret = 0;
+       WL_DBG(("Enter \n"));
+
+       /* making separate work queue needs GPL license,
+        * but some drivers are not in GPL license, so, making seperate queue Android only
+        */
+
+       /* Allocate workqueue for event */
+       if (!cfg->event_workq) {
+               cfg->event_workq = alloc_workqueue("dhd_eventd",
+                       WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_UNBOUND, 1);
+       }
+
+       if (!cfg->event_workq) {
+               WL_ERR(("event_workq alloc_workqueue failed\n"));
+               ret = -ENOMEM;
+       } else {
+               INIT_WORK(&cfg->event_work, wl_event_handler);
+       }
+
+       return ret;
+}
+
+static void wl_destroy_event_handler(struct bcm_cfg80211 *cfg)
+{
+
+       if (cfg && cfg->event_workq) {
+               cancel_work_sync(&cfg->event_work);
+               destroy_workqueue(cfg->event_workq);
+               cfg->event_workq = NULL;
+       }
+
+}
+
+void wl_terminate_event_handler(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       if (cfg) {
+               wl_destroy_event_handler(cfg);
+               wl_flush_eq(cfg);
+       }
+}
+
+#ifdef DHD_LOSSLESS_ROAMING
+static void wl_del_roam_timeout(struct bcm_cfg80211 *cfg)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       /* restore prec_map to ALLPRIO */
+       dhdp->dequeue_prec_map = ALLPRIO;
+       if (timer_pending(&cfg->roam_timeout)) {
+               del_timer_sync(&cfg->roam_timeout);
+       }
+
+}
+
+static void wl_roam_timeout(unsigned long data)
+{
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)data;
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       WL_ERR(("roam timer expired\n"));
+
+       /* restore prec_map to ALLPRIO */
+       dhdp->dequeue_prec_map = ALLPRIO;
+}
+
+#endif /* DHD_LOSSLESS_ROAMING */
+
+#if defined(CONFIG_WLAN_BEYONDX) || defined(CONFIG_SEC_5GMODEL)
+#define CP_CHAN_INFO_RAT_MODE_LTE      3
+#define CP_CHAN_INFO_RAT_MODE_NR5G     7
+int g_mhs_chan_for_cpcoex = 0;
+
+struct __packed cam_cp_noti_info {
+       u8 rat;
+       u32 band;
+       u32 channel;
+};
+
+int
+wl_cfg80211_send_msg_to_ril()
+{
+       int id, buf = 1;
+
+       id = IPC_SYSTEM_CP_CHANNEL_INFO;
+       dev_ril_bridge_send_msg(id, sizeof(int), &buf);
+       WL_ERR(("[BeyondX] send message to ril.\n"));
+
+       OSL_SLEEP(500);
+       return 0;
+}
+
+int
+wl_cfg80211_ril_bridge_notifier_call(struct notifier_block *nb,
+       unsigned long size, void *buf)
+{
+       struct dev_ril_bridge_msg *msg;
+       struct cam_cp_noti_info *cp_noti_info;
+       static int mhs_channel_for_4g, mhs_channel_for_5g;
+       static int recv_msg_4g, recv_msg_5g;
+
+       WL_ERR(("[BeyondX] receive message from ril.\n"));
+       msg = (struct dev_ril_bridge_msg *)buf;
+
+       if (msg->dev_id == IPC_SYSTEM_CP_CHANNEL_INFO &&
+               msg->data_len <= sizeof(struct cam_cp_noti_info)) {
+               u8 rat;
+               u32 band;
+               u32 channel;
+
+               cp_noti_info = (struct cam_cp_noti_info *)msg->data;
+               rat = cp_noti_info->rat;
+               band = cp_noti_info->band;
+               channel = cp_noti_info->channel;
+
+               /* LTE/5G Band/Freq information => Mobile Hotspot channel mapping.
+                * LTE/B40: 38650~39649 => Ch.11
+                * LTE/B41: 39650~41589 => Ch.1
+                * 5G/N41: 499200~537999 => Ch.1
+                */
+               if (rat == CP_CHAN_INFO_RAT_MODE_LTE) {
+                       recv_msg_4g = 1;
+                       if (channel >= 38650 && channel <= 39649) {
+                               mhs_channel_for_4g = 11;
+                       } else if (channel >= 39650 && channel <= 41589) {
+                               mhs_channel_for_4g = 1;
+                       }
+               }
+               if (rat == CP_CHAN_INFO_RAT_MODE_NR5G) {
+                       recv_msg_5g = 1;
+                       if (channel >= 499200 && channel <= 537999) {
+                               mhs_channel_for_5g = 1;
+                       }
+               }
+
+               WL_DBG(("[BeyondX] rat: %u, band: %u, channel: %u, mhs_channel_for_4g: %u, "
+                       "mhs_channel_for_5g: %u\n", rat, band, channel,
+                       mhs_channel_for_4g, mhs_channel_for_5g));
+
+               if (recv_msg_4g && recv_msg_5g) {
+                       if (mhs_channel_for_4g && mhs_channel_for_5g) {
+                               /* if 4G/B40 + 5G/N41, select channel 6 for MHS */
+                               if (mhs_channel_for_4g == 11 && mhs_channel_for_5g == 1) {
+                                       g_mhs_chan_for_cpcoex = 6;
+                               /* if 4G(except for B40) + 5G/N41, select channel 1 for MHS */
+                               } else {
+                                       g_mhs_chan_for_cpcoex = 1;
+                               }
+                       } else {
+                               g_mhs_chan_for_cpcoex = mhs_channel_for_4g ? mhs_channel_for_4g :
+                                       mhs_channel_for_5g ? mhs_channel_for_5g : 0;
+                       }
+                       mhs_channel_for_4g = mhs_channel_for_5g = 0;
+                       recv_msg_4g = recv_msg_5g = 0;
+               }
+       }
+
+       return 0;
+}
+
+static struct notifier_block wl_cfg80211_ril_bridge_notifier = {
+       .notifier_call = wl_cfg80211_ril_bridge_notifier_call,
+};
+
+static bool wl_cfg80211_ril_bridge_notifier_registered = FALSE;
+#endif /* CONFIG_WLAN_BEYONDX || defined(CONFIG_SEC_5GMODEL) */
+
+static s32
+wl_cfg80211_netdev_notifier_call(struct notifier_block * nb,
+       unsigned long state, void *ptr)
+{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 11, 0))
+       struct net_device *dev = ptr;
+#else
+       struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+#endif /* LINUX_VERSION < VERSION(3, 11, 0) */
+       struct wireless_dev *wdev = NULL;
+       struct bcm_cfg80211 *cfg = NULL;
+
+       WL_DBG(("Enter state:%lu  ndev%p \n", state, dev));
+       if (!dev) {
+               WL_ERR(("dev null\n"));
+               return NOTIFY_DONE;
+       }
+
+       wdev = ndev_to_wdev(dev);
+       if (!wdev) {
+               WL_ERR(("wdev null. Do nothing\n"));
+               return NOTIFY_DONE;
+       }
+
+       cfg = (struct bcm_cfg80211 *)wiphy_priv(wdev->wiphy);
+       if (!cfg || (cfg != wl_cfg80211_get_bcmcfg())) {
+               /* If cfg80211 priv is null or doesn't match return */
+               WL_ERR(("wrong cfg ptr (%p)\n", cfg));
+               return NOTIFY_DONE;
+       }
+
+       if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+               /* Nothing to be done for primary I/F */
+               return NOTIFY_DONE;
+       }
+
+       switch (state) {
+               case NETDEV_DOWN:
+               {
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 11, 0))
+                       int max_wait_timeout = 2;
+                       int max_wait_count = 100;
+                       int refcnt = 0;
+                       unsigned long limit = jiffies + max_wait_timeout * HZ;
+                       while (work_pending(&wdev->cleanup_work)) {
+                               if (refcnt%5 == 0) {
+                                       WL_ERR(("[NETDEV_DOWN] wait for "
+                                               "complete of cleanup_work"
+                                               " (%d th)\n", refcnt));
+                               }
+                               if (!time_before(jiffies, limit)) {
+                                       WL_ERR(("[NETDEV_DOWN] cleanup_work"
+                                               " of CFG80211 is not"
+                                               " completed in %d sec\n",
+                                               max_wait_timeout));
+                                       break;
+                               }
+                               if (refcnt >= max_wait_count) {
+                                       WL_ERR(("[NETDEV_DOWN] cleanup_work"
+                                               " of CFG80211 is not"
+                                               " completed in %d loop\n",
+                                               max_wait_count));
+                                       break;
+                               }
+                               set_current_state(TASK_INTERRUPTIBLE);
+                               (void)schedule_timeout(100);
+                               set_current_state(TASK_RUNNING);
+                               refcnt++;
+                       }
+#endif /* LINUX_VERSION < VERSION(3, 14, 0) */
+                       break;
+               }
+               case NETDEV_UNREGISTER:
+                       wl_cfg80211_clear_per_bss_ies(cfg, wdev);
+                       /* after calling list_del_rcu(&wdev->list) */
+                       wl_dealloc_netinfo_by_wdev(cfg, wdev);
+                       break;
+               case NETDEV_GOING_DOWN:
+                       /*
+                        * At NETDEV_DOWN state, wdev_cleanup_work work will be called.
+                        * In front of door, the function checks whether current scan
+                        * is working or not. If the scanning is still working,
+                        * wdev_cleanup_work call WARN_ON and make the scan done forcibly.
+                        */
+                       if (wl_get_drv_status(cfg, SCANNING, dev))
+                               wl_cfg80211_cancel_scan(cfg);
+                       break;
+       }
+       return NOTIFY_DONE;
+}
+
+static struct notifier_block wl_cfg80211_netdev_notifier = {
+       .notifier_call = wl_cfg80211_netdev_notifier_call,
+};
+
+/*
+ * to make sure we won't register the same notifier twice, otherwise a loop is likely to be
+ * created in kernel notifier link list (with 'next' pointing to itself)
+ */
+static bool wl_cfg80211_netdev_notifier_registered = FALSE;
+
+static void wl_cfg80211_concurrent_roam(struct bcm_cfg80211 *cfg, int enable)
+{
+       u32 connected_cnt  = wl_get_drv_status_all(cfg, CONNECTED);
+       bool p2p_connected  = wl_cfgp2p_vif_created(cfg);
+       struct net_info *iter, *next;
+
+       if (!(cfg->roam_flags & WL_ROAM_OFF_ON_CONCURRENT))
+               return;
+
+       WL_DBG(("roam off:%d p2p_connected:%d connected_cnt:%d \n",
+               enable, p2p_connected, connected_cnt));
+       /* Disable FW roam when we have a concurrent P2P connection */
+       if (enable && p2p_connected && connected_cnt > 1) {
+
+               /* Mark it as to be reverted */
+               cfg->roam_flags |= WL_ROAM_REVERT_STATUS;
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               for_each_ndev(cfg, iter, next) {
+                       GCC_DIAGNOSTIC_POP();
+                       if (iter->ndev && iter->wdev &&
+                                       iter->wdev->iftype == NL80211_IFTYPE_STATION) {
+                               if (wldev_iovar_setint(iter->ndev, "roam_off", TRUE)
+                                               == BCME_OK) {
+                                       iter->roam_off = TRUE;
+                               }
+                               else {
+                                       WL_ERR(("error to enable roam_off\n"));
+                               }
+                       }
+               }
+       }
+       else if (!enable && (cfg->roam_flags & WL_ROAM_REVERT_STATUS)) {
+               cfg->roam_flags &= ~WL_ROAM_REVERT_STATUS;
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               for_each_ndev(cfg, iter, next) {
+                       GCC_DIAGNOSTIC_POP();
+                       if (iter->ndev && iter->wdev &&
+                                       iter->wdev->iftype == NL80211_IFTYPE_STATION) {
+                               if (iter->roam_off != WL_INVALID) {
+                                       if (wldev_iovar_setint(iter->ndev, "roam_off", FALSE)
+                                                       == BCME_OK) {
+                                               iter->roam_off = FALSE;
+                                       }
+                                       else {
+                                               WL_ERR(("error to disable roam_off\n"));
+                                       }
+                               }
+                       }
+               }
+       }
+
+       return;
+}
+
+static void wl_cfg80211_determine_vsdb_mode(struct bcm_cfg80211 *cfg)
+{
+       struct net_info *iter, *next;
+       u32 ctl_chan = 0;
+       u32 chanspec = 0;
+       u32 pre_ctl_chan = 0;
+       u32 band = 0;
+       u32 pre_band = 0;
+       u32 connected_cnt  = wl_get_drv_status_all(cfg, CONNECTED);
+       cfg->vsdb_mode = false;
+
+       if (connected_cnt <= 1)  {
+               return;
+       }
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       for_each_ndev(cfg, iter, next) {
+               GCC_DIAGNOSTIC_POP();
+               /* p2p discovery iface ndev could be null */
+               if (iter->ndev) {
+                       chanspec = 0;
+                       ctl_chan = 0;
+                       if (wl_get_drv_status(cfg, CONNECTED, iter->ndev)) {
+                               if (wldev_iovar_getint(iter->ndev, "chanspec",
+                                       (s32 *)&chanspec) == BCME_OK) {
+                                       chanspec = wl_chspec_driver_to_host(chanspec);
+                                       ctl_chan = wf_chspec_ctlchan(chanspec);
+                                       band = CHSPEC_BAND(chanspec);
+                                       wl_update_prof(cfg, iter->ndev, NULL,
+                                               &chanspec, WL_PROF_CHAN);
+                               }
+                               if (!cfg->vsdb_mode) {
+                                       if (!pre_ctl_chan && ctl_chan) {
+                                               pre_ctl_chan = ctl_chan;
+                                               pre_band = band;
+                                       } else if (pre_ctl_chan && (pre_ctl_chan != ctl_chan) &&
+                                               (band == pre_band)) {
+                                               cfg->vsdb_mode = true;
+                                       }
+                               }
+                       }
+               }
+       }
+       WL_MSG("wlan", "%s concurrency is enabled\n", cfg->vsdb_mode ? "Multi Channel" : "Same Channel");
+       return;
+}
+
+int
+wl_cfg80211_determine_p2p_rsdb_mode(struct bcm_cfg80211 *cfg)
+{
+       struct net_info *iter, *next;
+       u32 chanspec = 0;
+       u32 band = 0;
+       u32 pre_band = 0;
+       bool is_rsdb_supported = FALSE;
+       bool rsdb_mode = FALSE;
+
+       is_rsdb_supported = DHD_OPMODE_SUPPORTED(cfg->pub, DHD_FLAG_RSDB_MODE);
+
+       if (!is_rsdb_supported) {
+               return 0;
+       }
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       for_each_ndev(cfg, iter, next) {
+               GCC_DIAGNOSTIC_POP();
+               /* p2p discovery iface ndev could be null */
+               if (iter->ndev) {
+                       chanspec = 0;
+                       band = 0;
+                       if (wl_get_drv_status(cfg, CONNECTED, iter->ndev)) {
+                               if (wldev_iovar_getint(iter->ndev, "chanspec",
+                                       (s32 *)&chanspec) == BCME_OK) {
+                                       chanspec = wl_chspec_driver_to_host(chanspec);
+                                       band = CHSPEC_BAND(chanspec);
+                               }
+
+                               if (!pre_band && band) {
+                                       pre_band = band;
+                               } else if (pre_band && (pre_band != band)) {
+                                       rsdb_mode = TRUE;
+                               }
+                       }
+               }
+       }
+       WL_DBG(("RSDB mode is %s\n", rsdb_mode ? "enabled" : "disabled"));
+
+       return rsdb_mode;
+}
+
+static s32 wl_notifier_change_state(struct bcm_cfg80211 *cfg, struct net_info *_net_info,
+       enum wl_status state, bool set)
+{
+       s32 pm = PM_FAST;
+       s32 err = BCME_OK;
+       u32 mode;
+       chanspec_t chspec = 0;
+       struct net_device *primary_dev = bcmcfg_to_prmry_ndev(cfg);
+       dhd_pub_t *dhd = cfg->pub;
+#ifdef RTT_SUPPORT
+       rtt_status_info_t *rtt_status;
+#endif /* RTT_SUPPORT */
+       if (dhd->busstate == DHD_BUS_DOWN) {
+               WL_ERR(("busstate is DHD_BUS_DOWN!\n"));
+               return 0;
+       }
+       WL_DBG(("Enter state %d set %d _net_info->pm_restore %d iface %s\n",
+               state, set, _net_info->pm_restore, _net_info->ndev->name));
+
+       if (state != WL_STATUS_CONNECTED)
+               return 0;
+       mode = wl_get_mode_by_netdev(cfg, _net_info->ndev);
+       if (set) {
+               wl_cfg80211_concurrent_roam(cfg, 1);
+               wl_cfg80211_determine_vsdb_mode(cfg);
+               if (mode == WL_MODE_AP) {
+                       if (wl_add_remove_eventmsg(primary_dev, WLC_E_P2P_PROBREQ_MSG, false))
+                               WL_ERR((" failed to unset WLC_E_P2P_PROPREQ_MSG\n"));
+               }
+               pm = PM_OFF;
+               if ((err = wldev_ioctl_set(_net_info->ndev, WLC_SET_PM, &pm,
+                               sizeof(pm))) != 0) {
+                       if (err == -ENODEV)
+                               WL_DBG(("%s:netdev not ready\n",
+                                       _net_info->ndev->name));
+                       else
+                               WL_ERR(("%s:error (%d)\n",
+                                       _net_info->ndev->name, err));
+
+                       wl_cfg80211_update_power_mode(_net_info->ndev);
+               }
+               wl_add_remove_pm_enable_work(cfg, WL_PM_WORKQ_SHORT);
+#if defined(WLTDLS)
+               if (wl_cfg80211_is_concurrent_mode(primary_dev)) {
+                       err = wldev_iovar_setint(primary_dev, "tdls_enable", 0);
+               }
+#endif /* defined(WLTDLS) */
+
+#ifdef DISABLE_FRAMEBURST_VSDB
+               if (!DHD_OPMODE_SUPPORTED(cfg->pub, DHD_FLAG_HOSTAP_MODE) &&
+                       wl_cfg80211_is_concurrent_mode(primary_dev) &&
+                       !wl_cfg80211_determine_p2p_rsdb_mode(cfg)) {
+                       wl_cfg80211_set_frameburst(cfg, FALSE);
+               }
+#endif /* DISABLE_FRAMEBURST_VSDB */
+#ifdef DISABLE_WL_FRAMEBURST_SOFTAP
+               if (DHD_OPMODE_STA_SOFTAP_CONCURR(dhd) &&
+                       wl_get_drv_status(cfg, CONNECTED, bcmcfg_to_prmry_ndev(cfg))) {
+                       /* Enable frameburst for
+                        * STA/SoftAP concurrent mode
+                        */
+                       wl_cfg80211_set_frameburst(cfg, TRUE);
+               }
+#endif /* DISABLE_WL_FRAMEBURST_SOFTAP */
+       } else { /* clear */
+               chspec = INVCHANSPEC;
+               /* clear chan information when the net device is disconnected */
+               wl_update_prof(cfg, _net_info->ndev, NULL, &chspec, WL_PROF_CHAN);
+               wl_cfg80211_determine_vsdb_mode(cfg);
+               if (primary_dev == _net_info->ndev) {
+                       pm = PM_FAST;
+#ifdef RTT_SUPPORT
+                       rtt_status = GET_RTTSTATE(dhd);
+                       if (rtt_status->status != RTT_ENABLED) {
+#endif /* RTT_SUPPORT */
+                               if (dhd_conf_get_pm(dhd) >= 0)
+                                       pm = dhd_conf_get_pm(dhd);
+                               if ((err = wldev_ioctl_set(_net_info->ndev, WLC_SET_PM, &pm,
+                                               sizeof(pm))) != 0) {
+                                       if (err == -ENODEV)
+                                               WL_DBG(("%s:netdev not ready\n",
+                                                       _net_info->ndev->name));
+                                       else
+                                               WL_ERR(("%s:error (%d)\n",
+                                                       _net_info->ndev->name, err));
+
+                                       wl_cfg80211_update_power_mode(_net_info->ndev);
+                               }
+#ifdef RTT_SUPPORT
+                       }
+#endif /* RTT_SUPPORT */
+               }
+               wl_cfg80211_concurrent_roam(cfg, 0);
+#if defined(WLTDLS)
+               if (!wl_cfg80211_is_concurrent_mode(primary_dev)) {
+                       err = wldev_iovar_setint(primary_dev, "tdls_enable", 1);
+               }
+#endif /* defined(WLTDLS) */
+
+#if defined(DISABLE_FRAMEBURST_VSDB)
+               if (!DHD_OPMODE_SUPPORTED(cfg->pub, DHD_FLAG_HOSTAP_MODE)) {
+                       wl_cfg80211_set_frameburst(cfg, TRUE);
+               }
+#endif /* DISABLE_FRAMEBURST_VSDB */
+#ifdef DISABLE_WL_FRAMEBURST_SOFTAP
+               if (DHD_OPMODE_STA_SOFTAP_CONCURR(dhd) &&
+                       CHSPEC_IS2G(cfg->ap_oper_channel)) {
+                       /* Disable frameburst for stand-alone 2GHz SoftAP */
+                       wl_cfg80211_set_frameburst(cfg, FALSE);
+               }
+#endif /* DISABLE_WL_FRAMEBURST_SOFTAP */
+       }
+       return err;
+}
+
+#ifdef DHD_LOSSLESS_ROAMING
+static s32 wl_init_roam_timeout(struct bcm_cfg80211 *cfg)
+{
+       int err = 0;
+
+       /* Init roam timer */
+       init_timer_compat(&cfg->roam_timeout, wl_roam_timeout, cfg);
+
+       return err;
+}
+#endif /* DHD_LOSSLESS_ROAMING */
+
+#ifdef CONFIG_SLEEP_MONITOR
+extern long long temp_raw;
+
+int wlan_get_sleep_monitor64_cb(void *priv, long long *raw_val,
+       int check_level, int caller_type)
+{
+       struct bcm_cfg80211 *cfg = priv;
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       int state = DEVICE_UNKNOWN;
+
+       if (!dhdp->up)
+               state = DEVICE_POWER_OFF;
+       else {
+               state = DEVICE_ON_ACTIVE1;
+               if (wl_get_drv_status_all(cfg, CONNECTED))
+                       state = DEVICE_ON_ACTIVE2;
+
+               if (caller_type == SLEEP_MONITOR_CALL_SUSPEND) {
+                       *raw_val = temp_raw;
+                       temp_raw = 0;
+               }
+       }
+
+       return state;
+}
+
+static struct sleep_monitor_ops wlan_sleep_monitor_ops = {
+       .read64_cb_func = wlan_get_sleep_monitor64_cb,
+};
+#endif /* CONFIG_SLEEP_MONITOR */
+
+static s32 wl_init_priv(struct bcm_cfg80211 *cfg)
+{
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       s32 err = 0;
+
+       cfg->scan_request = NULL;
+       cfg->pwr_save = !!(wiphy->flags & WIPHY_FLAG_PS_ON_BY_DEFAULT);
+#ifdef DISABLE_BUILTIN_ROAM
+       cfg->roam_on = false;
+#else
+       cfg->roam_on = true;
+#endif /* DISABLE_BUILTIN_ROAM */
+       cfg->active_scan = true;
+       cfg->rf_blocked = false;
+       cfg->vsdb_mode = false;
+#if defined(BCMSDIO) || defined(BCMDBUS)
+       cfg->wlfc_on = false;
+#endif /* BCMSDIO || BCMDBUS */
+       cfg->roam_flags |= WL_ROAM_OFF_ON_CONCURRENT;
+       cfg->disable_roam_event = false;
+       /* register interested state */
+       set_bit(WL_STATUS_CONNECTED, &cfg->interrested_state);
+       spin_lock_init(&cfg->cfgdrv_lock);
+       mutex_init(&cfg->ioctl_buf_sync);
+       init_waitqueue_head(&cfg->netif_change_event);
+       init_waitqueue_head(&cfg->wps_done_event);
+       init_completion(&cfg->send_af_done);
+       init_completion(&cfg->iface_disable);
+       mutex_init(&cfg->usr_sync);
+       mutex_init(&cfg->event_sync);
+       mutex_init(&cfg->if_sync);
+       mutex_init(&cfg->scan_sync);
+       mutex_init(&cfg->connect_sync);
+       mutex_init(&cfg->pm_sync);
+       mutex_init(&cfg->in4way_sync);
+#ifdef WLTDLS
+       mutex_init(&cfg->tdls_sync);
+#endif /* WLTDLS */
+#ifdef WL_BCNRECV
+       mutex_init(&cfg->bcn_sync);
+#endif /* WL_BCNRECV */
+#ifdef WL_WPS_SYNC
+       wl_init_wps_reauth_sm(cfg);
+#endif /* WL_WPS_SYNC */
+       wl_init_eq(cfg);
+       err = wl_init_priv_mem(cfg);
+       if (err)
+               return err;
+       if (wl_create_event_handler(cfg))
+               return -ENOMEM;
+       wl_init_event_handler(cfg);
+       err = wl_init_scan(cfg);
+       if (err)
+               return err;
+#ifdef DHD_LOSSLESS_ROAMING
+       err = wl_init_roam_timeout(cfg);
+       if (err) {
+               return err;
+       }
+#endif /* DHD_LOSSLESS_ROAMING */
+       wl_init_conf(cfg->conf);
+       wl_init_prof(cfg, ndev);
+       wl_link_down(cfg);
+       DNGL_FUNC(dhd_cfg80211_init, (cfg));
+       cfg->pmk_list->pmkids.length = OFFSETOF(pmkid_list_v3_t, pmkid);
+       cfg->pmk_list->pmkids.count = 0;
+       cfg->pmk_list->pmkids.version = PMKID_LIST_VER_3;
+
+#ifdef CONFIG_SLEEP_MONITOR
+       sleep_monitor_register_ops(cfg, &wlan_sleep_monitor_ops,
+               SLEEP_MONITOR_WIFI);
+#endif /* CONFIG_SLEEP_MONITOR */
+       return err;
+}
+
+static void wl_deinit_priv(struct bcm_cfg80211 *cfg)
+{
+       DNGL_FUNC(dhd_cfg80211_deinit, (cfg));
+       wl_destroy_event_handler(cfg);
+       wl_flush_eq(cfg);
+       wl_link_down(cfg);
+       del_timer_sync(&cfg->scan_timeout);
+#ifdef DHD_LOSSLESS_ROAMING
+       del_timer_sync(&cfg->roam_timeout);
+#endif
+       wl_deinit_priv_mem(cfg);
+       if (wl_cfg80211_netdev_notifier_registered) {
+               wl_cfg80211_netdev_notifier_registered = FALSE;
+               unregister_netdevice_notifier(&wl_cfg80211_netdev_notifier);
+       }
+
+#ifdef CONFIG_SLEEP_MONITOR
+       sleep_monitor_unregister_ops(SLEEP_MONITOR_WIFI);
+#endif /* CONFIG_SLEEP_MONITOR */
+}
+
+#if defined(WL_ENABLE_P2P_IF) || defined(WL_NEWCFG_PRIVCMD_SUPPORT)
+static s32 wl_cfg80211_attach_p2p(struct bcm_cfg80211 *cfg)
+{
+       WL_TRACE(("Enter \n"));
+
+       if (wl_cfgp2p_register_ndev(cfg) < 0) {
+               WL_ERR(("P2P attach failed. \n"));
+               return -ENODEV;
+       }
+
+       return 0;
+}
+
+static s32  wl_cfg80211_detach_p2p(struct bcm_cfg80211 *cfg)
+{
+#ifndef WL_NEWCFG_PRIVCMD_SUPPORT
+       struct wireless_dev *wdev;
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+
+       WL_DBG(("Enter \n"));
+       if (!cfg) {
+               WL_ERR(("Invalid Ptr\n"));
+               return -EINVAL;
+       }
+#ifndef WL_NEWCFG_PRIVCMD_SUPPORT
+       else {
+               wdev = cfg->p2p_wdev;
+               if (!wdev) {
+                       WL_ERR(("Invalid Ptr\n"));
+                       return -EINVAL;
+               }
+       }
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+
+       wl_cfgp2p_unregister_ndev(cfg);
+
+       cfg->p2p_wdev = NULL;
+       cfg->p2p_net = NULL;
+#ifndef WL_NEWCFG_PRIVCMD_SUPPORT
+       WL_DBG(("Freeing 0x%p \n", wdev));
+       MFREE(cfg->osh, wdev, sizeof(*wdev));
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+
+       return 0;
+}
+#endif /* WL_ENABLE_P2P_IF || WL_NEWCFG_PRIVCMD_SUPPORT */
+
+static s32 wl_cfg80211_attach_post(struct net_device *ndev)
+{
+       struct bcm_cfg80211 * cfg;
+       s32 err = 0;
+       s32 ret = 0;
+       WL_TRACE(("In\n"));
+       if (unlikely(!ndev)) {
+               WL_ERR(("ndev is invaild\n"));
+               return -ENODEV;
+       }
+       cfg = wl_get_cfg(ndev);
+       if (unlikely(!cfg)) {
+               WL_ERR(("cfg is invaild\n"));
+               return -EINVAL;
+       }
+       if (!wl_get_drv_status(cfg, READY, ndev)) {
+               if (cfg->wdev) {
+                       ret = wl_cfgp2p_supported(cfg, ndev);
+                       if (ret > 0) {
+#if !defined(WL_ENABLE_P2P_IF)
+                               cfg->wdev->wiphy->interface_modes |=
+                                       (BIT(NL80211_IFTYPE_P2P_CLIENT)|
+                                       BIT(NL80211_IFTYPE_P2P_GO));
+#endif /* !WL_ENABLE_P2P_IF */
+                               if ((err = wl_cfgp2p_init_priv(cfg)) != 0)
+                                       goto fail;
+
+#if defined(WL_ENABLE_P2P_IF)
+                               if (cfg->p2p_net) {
+                                       /* Update MAC addr for p2p0 interface here. */
+                                       memcpy(cfg->p2p_net->dev_addr, ndev->dev_addr, ETH_ALEN);
+                                       cfg->p2p_net->dev_addr[0] |= 0x02;
+                                       WL_MSG(cfg->p2p_net->name, "p2p_dev_addr="MACDBG "\n",
+                                               MAC2STRDBG(cfg->p2p_net->dev_addr));
+                               } else {
+                                       WL_ERR(("p2p_net not yet populated."
+                                       " Couldn't update the MAC Address for p2p0 \n"));
+                                       return -ENODEV;
+                               }
+#endif /* WL_ENABLE_P2P_IF */
+                               cfg->p2p_supported = true;
+                       } else if (ret == 0) {
+                               if ((err = wl_cfgp2p_init_priv(cfg)) != 0)
+                                       goto fail;
+                       } else {
+                               /* SDIO bus timeout */
+                               err = -ENODEV;
+                               goto fail;
+                       }
+               }
+       }
+       wl_set_drv_status(cfg, READY, ndev);
+fail:
+       return err;
+}
+
+struct bcm_cfg80211 *wl_get_cfg(struct net_device *ndev)
+{
+       struct wireless_dev *wdev = ndev->ieee80211_ptr;
+
+       if (!wdev || !wdev->wiphy)
+               return NULL;
+
+       return wiphy_priv(wdev->wiphy);
+}
+
+s32
+wl_cfg80211_net_attach(struct net_device *primary_ndev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(primary_ndev);
+
+       if (!cfg) {
+               WL_ERR(("cfg null\n"));
+               return BCME_ERROR;
+       }
+#ifdef WL_STATIC_IF
+       /* Register dummy n/w iface. FW init will happen only from dev_open */
+       if (wl_cfg80211_register_static_if(cfg, NL80211_IFTYPE_STATION,
+               WL_STATIC_IFNAME_PREFIX) == NULL) {
+               WL_ERR(("static i/f registration failed!\n"));
+               return BCME_ERROR;
+       }
+#endif /* WL_STATIC_IF */
+       return BCME_OK;
+}
+
+s32 wl_cfg80211_attach(struct net_device *ndev, void *context)
+{
+       struct wireless_dev *wdev;
+       struct bcm_cfg80211 *cfg;
+       s32 err = 0;
+       struct device *dev;
+       u16 bssidx = 0;
+       u16 ifidx = 0;
+       dhd_pub_t *dhd = (struct dhd_pub *)(context);
+
+       WL_TRACE(("In\n"));
+       if (!ndev) {
+               WL_ERR(("ndev is invaild\n"));
+               return -ENODEV;
+       }
+       WL_DBG(("func %p\n", wl_cfg80211_get_parent_dev()));
+       dev = wl_cfg80211_get_parent_dev();
+
+       wdev = (struct wireless_dev *)MALLOCZ(dhd->osh, sizeof(*wdev));
+       if (unlikely(!wdev)) {
+               WL_ERR(("Could not allocate wireless device\n"));
+               return -ENOMEM;
+       }
+       err = wl_setup_wiphy(wdev, dev, context);
+       if (unlikely(err)) {
+               MFREE(dhd->osh, wdev, sizeof(*wdev));
+               return -ENOMEM;
+       }
+#ifdef WLMESH_CFG80211
+       wdev->iftype = wl_mode_to_nl80211_iftype(WL_MODE_MESH);
+#else
+       wdev->iftype = wl_mode_to_nl80211_iftype(WL_MODE_BSS);
+#endif
+       cfg = wiphy_priv(wdev->wiphy);
+       cfg->wdev = wdev;
+       cfg->pub = context;
+       cfg->osh = dhd->osh;
+       INIT_LIST_HEAD(&cfg->net_list);
+#ifdef WBTEXT
+       INIT_LIST_HEAD(&cfg->wbtext_bssid_list);
+#endif /* WBTEXT */
+       INIT_LIST_HEAD(&cfg->vndr_oui_list);
+       spin_lock_init(&cfg->vndr_oui_sync);
+       spin_lock_init(&cfg->net_list_sync);
+       ndev->ieee80211_ptr = wdev;
+       SET_NETDEV_DEV(ndev, wiphy_dev(wdev->wiphy));
+       wdev->netdev = ndev;
+       cfg->state_notifier = wl_notifier_change_state;
+       err = wl_alloc_netinfo(cfg, ndev, wdev, WL_IF_TYPE_STA, PM_ENABLE, bssidx, ifidx);
+       if (err) {
+               WL_ERR(("Failed to alloc net_info (%d)\n", err));
+               goto cfg80211_attach_out;
+       }
+       err = wl_init_priv(cfg);
+       if (err) {
+               WL_ERR(("Failed to init iwm_priv (%d)\n", err));
+               goto cfg80211_attach_out;
+       }
+
+       err = wl_setup_rfkill(cfg, TRUE);
+       if (err) {
+               WL_ERR(("Failed to setup rfkill %d\n", err));
+               goto cfg80211_attach_out;
+       }
+#ifdef DEBUGFS_CFG80211
+       err = wl_setup_debugfs(cfg);
+       if (err) {
+               WL_ERR(("Failed to setup debugfs %d\n", err));
+               goto cfg80211_attach_out;
+       }
+#endif
+       if (!wl_cfg80211_netdev_notifier_registered) {
+               wl_cfg80211_netdev_notifier_registered = TRUE;
+               err = register_netdevice_notifier(&wl_cfg80211_netdev_notifier);
+               if (err) {
+                       wl_cfg80211_netdev_notifier_registered = FALSE;
+                       WL_ERR(("Failed to register notifierl %d\n", err));
+                       goto cfg80211_attach_out;
+               }
+       }
+
+#if defined(COEX_DHCP)
+       cfg->btcoex_info = wl_cfg80211_btcoex_init(cfg->wdev->netdev);
+       if (!cfg->btcoex_info)
+               goto cfg80211_attach_out;
+#endif
+
+#if defined(SUPPORT_RANDOM_MAC_SCAN)
+       cfg->random_mac_enabled = FALSE;
+#endif /* SUPPORT_RANDOM_MAC_SCAN */
+
+#ifdef CONFIG_CFG80211_INTERNAL_REGDB
+       wdev->wiphy->reg_notifier = wl_cfg80211_reg_notifier;
+#endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+
+#if defined(WL_ENABLE_P2P_IF) || defined(WL_NEWCFG_PRIVCMD_SUPPORT)
+       err = wl_cfg80211_attach_p2p(cfg);
+       if (err)
+               goto cfg80211_attach_out;
+#endif /* WL_ENABLE_P2P_IF || WL_NEWCFG_PRIVCMD_SUPPORT */
+
+       INIT_DELAYED_WORK(&cfg->pm_enable_work, wl_cfg80211_work_handler);
+       INIT_DELAYED_WORK(&cfg->loc.work, wl_cfgscan_listen_complete_work);
+       mutex_init(&cfg->pm_sync);
+#ifdef WL_NAN
+       err = wl_cfgnan_attach(cfg);
+       if (err) {
+               WL_ERR(("Failed to attach nan module %d\n", err));
+               goto cfg80211_attach_out;
+       }
+#endif /* WL_NAN */
+       cfg->rssi_sum_report = FALSE;
+#ifdef WL_BAM
+       wl_bad_ap_mngr_init(cfg);
+#endif /* WL_BAM */
+
+#ifdef BIGDATA_SOFTAP
+       wl_attach_ap_stainfo(cfg);
+#endif /* BIGDATA_SOFTAP */
+
+       return err;
+
+cfg80211_attach_out:
+       wl_cfg80211_detach(cfg);
+       return err;
+}
+
+void wl_cfg80211_detach(struct bcm_cfg80211 *cfg)
+{
+       WL_DBG(("Enter\n"));
+       if (!cfg) {
+               return;
+       }
+/* clean up pm_enable work item. Remove this once deinit is properly
+ * clean up and wl_cfg8021_down is called while removing the module
+ */
+       wl_add_remove_pm_enable_work(cfg, WL_PM_WORKQ_DEL);
+
+#if defined(COEX_DHCP)
+       wl_cfg80211_btcoex_deinit();
+       cfg->btcoex_info = NULL;
+#endif
+
+       wl_setup_rfkill(cfg, FALSE);
+#ifdef DEBUGFS_CFG80211
+       wl_free_debugfs(cfg);
+#endif
+       if (cfg->p2p_supported) {
+               if (timer_pending(&cfg->p2p->listen_timer))
+                       del_timer_sync(&cfg->p2p->listen_timer);
+               wl_cfgp2p_deinit_priv(cfg);
+       }
+
+#ifdef WL_WPS_SYNC
+       wl_deinit_wps_reauth_sm(cfg);
+#endif /* WL_WPS_SYNC */
+
+       if (timer_pending(&cfg->scan_timeout))
+               del_timer_sync(&cfg->scan_timeout);
+#ifdef DHD_LOSSLESS_ROAMING
+       if (timer_pending(&cfg->roam_timeout)) {
+               del_timer_sync(&cfg->roam_timeout);
+       }
+#endif /* DHD_LOSSLESS_ROAMING */
+
+#ifdef WL_STATIC_IF
+       wl_cfg80211_unregister_static_if(cfg);
+#endif /* WL_STATIC_IF */
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       if (cfg->p2p_wdev)
+               wl_cfgp2p_del_p2p_disc_if(cfg->p2p_wdev, cfg);
+#endif /* WL_CFG80211_P2P_DEV_IF  */
+#if defined(WL_ENABLE_P2P_IF) || defined(WL_NEWCFG_PRIVCMD_SUPPORT)
+       wl_cfg80211_detach_p2p(cfg);
+#endif /* WL_ENABLE_P2P_IF || WL_NEWCFG_PRIVCMD_SUPPORT */
+#ifdef WL_BAM
+       wl_bad_ap_mngr_deinit(cfg);
+#endif /* WL_BAM */
+
+#ifdef BIGDATA_SOFTAP
+       wl_detach_ap_stainfo(cfg);
+#endif /* BIGDATA_SOFTAP */
+
+#ifdef WL_NAN
+       wl_cfgnan_detach(cfg);
+#endif /* WL_NAN */
+       wl_cfg80211_ibss_vsie_free(cfg);
+       wl_dealloc_netinfo_by_wdev(cfg, cfg->wdev);
+       wl_cfg80211_set_bcmcfg(NULL);
+       wl_deinit_priv(cfg);
+       wl_cfg80211_clear_parent_dev();
+#if defined(RSSIAVG)
+       wl_free_rssi_cache(&cfg->g_rssi_cache_ctrl);
+       wl_free_rssi_cache(&cfg->g_connected_rssi_cache_ctrl);
+#endif
+#if defined(BSSCACHE)
+       wl_release_bss_cache_ctrl(&cfg->g_bss_cache_ctrl);
+#endif
+       wl_free_wdev(cfg);
+       /* PLEASE do NOT call any function after wl_free_wdev, the driver's private
+        * structure "cfg", which is the private part of wiphy, has been freed in
+        * wl_free_wdev !!!!!!!!!!!
+        */
+       WL_DBG(("Exit\n"));
+}
+
+#if defined(CONFIG_WLAN_BEYONDX) || defined(CONFIG_SEC_5GMODEL)
+void wl_cfg80211_register_dev_ril_bridge_event_notifier()
+{
+       WL_DBG(("Enter\n"));
+       if (!wl_cfg80211_ril_bridge_notifier_registered) {
+               s32 err = 0;
+               wl_cfg80211_ril_bridge_notifier_registered = TRUE;
+               err = register_dev_ril_bridge_event_notifier(&wl_cfg80211_ril_bridge_notifier);
+               if (err) {
+                       wl_cfg80211_ril_bridge_notifier_registered = FALSE;
+                       WL_ERR(("Failed to register ril_notifier! %d\n", err));
+               }
+       }
+}
+
+void wl_cfg80211_unregister_dev_ril_bridge_event_notifier()
+{
+       WL_DBG(("Enter\n"));
+       if (wl_cfg80211_ril_bridge_notifier_registered) {
+               wl_cfg80211_ril_bridge_notifier_registered = FALSE;
+               unregister_dev_ril_bridge_event_notifier(&wl_cfg80211_ril_bridge_notifier);
+       }
+}
+#endif /* CONFIG_WLAN_BEYONDX || defined(CONFIG_SEC_5GMODEL) */
+
+static void wl_print_event_data(struct bcm_cfg80211 *cfg,
+       uint32 event_type, const wl_event_msg_t *e)
+{
+       s32 status = ntoh32(e->status);
+       s32 reason = ntoh32(e->reason);
+       s32 ifidx = ntoh32(e->ifidx);
+       s32 bssidx = ntoh32(e->bsscfgidx);
+
+       switch (event_type) {
+               case WLC_E_ESCAN_RESULT:
+                       if ((status == WLC_E_STATUS_SUCCESS) ||
+                               (status == WLC_E_STATUS_ABORT)) {
+                               WL_INFORM_MEM(("event_type (%d), ifidx: %d"
+                                       " bssidx: %d scan_type:%d\n",
+                                       event_type, ifidx, bssidx, status));
+                       }
+                       break;
+               case WLC_E_LINK:
+               case WLC_E_DISASSOC:
+               case WLC_E_DISASSOC_IND:
+               case WLC_E_DEAUTH:
+               case WLC_E_DEAUTH_IND:
+                       WL_INFORM_MEM(("event_type (%d), ifidx: %d bssidx: %d"
+                               " status:%d reason:%d\n",
+                               event_type, ifidx, bssidx, status, reason));
+                               break;
+
+               default:
+                       /* Print only when DBG verbose is enabled */
+                       WL_DBG(("event_type (%d), ifidx: %d bssidx: %d status:%d reason: %d\n",
+                               event_type, ifidx, bssidx, status, reason));
+       }
+}
+
+static void wl_event_handler(struct work_struct *work_data)
+{
+       struct bcm_cfg80211 *cfg = NULL;
+       struct wl_event_q *e;
+       struct wireless_dev *wdev = NULL;
+
+       WL_DBG(("Enter \n"));
+       BCM_SET_CONTAINER_OF(cfg, work_data, struct bcm_cfg80211, event_work);
+       LOG_TS(cfg, wl_evt_hdlr_entry);
+       DHD_EVENT_WAKE_LOCK(cfg->pub);
+       while ((e = wl_deq_event(cfg))) {
+               s32 status = ntoh32(e->emsg.status);
+               u32 event_type = ntoh32(e->emsg.event_type);
+               bool scan_cmplt_evt = (event_type == WLC_E_ESCAN_RESULT) &&
+                       ((status == WLC_E_STATUS_SUCCESS) || (status == WLC_E_STATUS_ABORT));
+
+               LOG_TS(cfg, wl_evt_deq);
+               if (scan_cmplt_evt) {
+                       LOG_TS(cfg, scan_deq);
+               }
+               /* Print only critical events to avoid too many prints */
+               wl_print_event_data(cfg, e->etype, &e->emsg);
+
+               if (e->emsg.ifidx > WL_MAX_IFS) {
+                       WL_ERR((" Event ifidx not in range. val:%d \n", e->emsg.ifidx));
+                       goto fail;
+               }
+
+               /* Make sure iface operations, don't creat race conditions */
+               mutex_lock(&cfg->if_sync);
+               if (!(wdev = wl_get_wdev_by_fw_idx(cfg,
+                       e->emsg.bsscfgidx, e->emsg.ifidx))) {
+                       /* For WLC_E_IF would be handled by wl_host_event */
+                       if (e->etype != WLC_E_IF)
+                               WL_ERR(("No wdev corresponding to bssidx: 0x%x found!"
+                                       " Ignoring event.\n", e->emsg.bsscfgidx));
+               } else if (e->etype < WLC_E_LAST && cfg->evt_handler[e->etype]) {
+                       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+                       if (dhd->busstate == DHD_BUS_DOWN) {
+                               WL_ERR((": BUS is DOWN.\n"));
+                       } else
+                       {
+                               WL_DBG(("event_type %d event_sub %d\n",
+                                       ntoh32(e->emsg.event_type),
+                                       ntoh32(e->emsg.reason)));
+                               cfg->evt_handler[e->etype](cfg, wdev_to_cfgdev(wdev),
+                                       &e->emsg, e->edata);
+                               if (scan_cmplt_evt) {
+                                       LOG_TS(cfg, scan_hdlr_cmplt);
+                               }
+                       }
+               } else {
+                       WL_DBG(("Unknown Event (%d): ignoring\n", e->etype));
+               }
+               mutex_unlock(&cfg->if_sync);
+fail:
+               wl_put_event(cfg, e);
+               if (scan_cmplt_evt) {
+                       LOG_TS(cfg, scan_cmplt);
+               }
+               LOG_TS(cfg, wl_evt_hdlr_exit);
+       }
+       DHD_EVENT_WAKE_UNLOCK(cfg->pub);
+}
+
+/*
+* Generic API to handle critical events which doesnt need
+* cfg enquening and sleepable API calls.
+*/
+s32
+wl_cfg80211_handle_critical_events(struct bcm_cfg80211 *cfg,
+       const wl_event_msg_t * e)
+{
+       s32 ret = BCME_ERROR;
+       u32 event_type = ntoh32(e->event_type);
+
+       if (event_type >= WLC_E_LAST) {
+               return BCME_ERROR;
+       }
+
+       switch (event_type) {
+               case WLC_E_NAN_CRITICAL: {
+#ifdef WL_NAN
+               if (ntoh32(e->reason) == WL_NAN_EVENT_STOP) {
+                       WL_DBG(("Received WL_NAN_EVENT_STOP\n"));
+               }
+#endif /* WL_NAN */
+                       break;
+               }
+               default:
+                       ret = BCME_ERROR;
+       }
+       return ret;
+}
+
+void
+wl_cfg80211_event(struct net_device *ndev, const wl_event_msg_t * e, void *data)
+{
+       s32 status = ntoh32(e->status);
+       u32 event_type = ntoh32(e->event_type);
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       struct net_info *netinfo;
+
+       WL_DBG(("event_type (%d): reason (%d): %s\n", event_type, ntoh32(e->reason),
+               bcmevent_get_name(event_type)));
+       if ((cfg == NULL) || (cfg->p2p_supported && cfg->p2p == NULL)) {
+               WL_ERR(("Stale event ignored\n"));
+               return;
+       }
+
+       if (cfg->event_workq == NULL) {
+               WL_ERR(("Event handler is not created\n"));
+               return;
+       }
+
+       if (event_type == WLC_E_IF) {
+               /* Don't process WLC_E_IF events in wl_cfg80211 layer */
+               return;
+       }
+
+       netinfo = wl_get_netinfo_by_fw_idx(cfg, e->bsscfgidx, e->ifidx);
+       if (!netinfo) {
+               /* Since the netinfo entry is not there, the netdev entry is not
+                * created via cfg80211 interface. so the event is not of interest
+                * to the cfg80211 layer.
+                */
+               WL_TRACE(("ignore event %d, not interested\n", event_type));
+               return;
+       }
+
+       /* Handle wl_cfg80211_critical_events */
+       if (wl_cfg80211_handle_critical_events(cfg, e) == BCME_OK) {
+               return;
+       }
+
+       if (event_type == WLC_E_PFN_NET_FOUND) {
+               WL_DBG((" PNOEVENT: PNO_NET_FOUND\n"));
+       }
+       else if (event_type == WLC_E_PFN_NET_LOST) {
+               WL_DBG((" PNOEVENT: PNO_NET_LOST\n"));
+       }
+
+       if (likely(!wl_enq_event(cfg, ndev, event_type, e, data))) {
+
+               queue_work(cfg->event_workq, &cfg->event_work);
+
+       }
+       /* Mark timeout value for thread sched */
+       if ((event_type == WLC_E_ESCAN_RESULT) &&
+               ((status == WLC_E_STATUS_SUCCESS) ||
+               (status == WLC_E_STATUS_ABORT)))  {
+               LOG_TS(cfg, scan_enq);
+               WL_INFORM_MEM(("Enqueing escan completion (%d). WQ state:0x%x \n",
+                       status, work_busy(&cfg->event_work)));
+       }
+}
+
+static void wl_init_eq(struct bcm_cfg80211 *cfg)
+{
+       wl_init_eq_lock(cfg);
+       INIT_LIST_HEAD(&cfg->eq_list);
+}
+
+static void wl_flush_eq(struct bcm_cfg80211 *cfg)
+{
+       struct wl_event_q *e;
+       unsigned long flags;
+
+       flags = wl_lock_eq(cfg);
+       while (!list_empty_careful(&cfg->eq_list)) {
+               BCM_SET_LIST_FIRST_ENTRY(e, &cfg->eq_list, struct wl_event_q, eq_list);
+               list_del(&e->eq_list);
+               MFREE(cfg->osh, e, e->datalen + sizeof(struct wl_event_q));
+       }
+       wl_unlock_eq(cfg, flags);
+}
+
+/*
+* retrieve first queued event from head
+*/
+
+static struct wl_event_q *wl_deq_event(struct bcm_cfg80211 *cfg)
+{
+       struct wl_event_q *e = NULL;
+       unsigned long flags;
+
+       flags = wl_lock_eq(cfg);
+       if (likely(!list_empty(&cfg->eq_list))) {
+               BCM_SET_LIST_FIRST_ENTRY(e, &cfg->eq_list, struct wl_event_q, eq_list);
+               list_del(&e->eq_list);
+       }
+       wl_unlock_eq(cfg, flags);
+
+       return e;
+}
+
+/*
+ * push event to tail of the queue
+ */
+
+static s32
+wl_enq_event(struct bcm_cfg80211 *cfg, struct net_device *ndev, u32 event,
+       const wl_event_msg_t *msg, void *data)
+{
+       struct wl_event_q *e;
+       s32 err = 0;
+       uint32 evtq_size;
+       uint32 data_len;
+       unsigned long flags;
+
+       data_len = 0;
+       if (data)
+               data_len = ntoh32(msg->datalen);
+       evtq_size = (uint32)(sizeof(struct wl_event_q) + data_len);
+       e = (struct wl_event_q *)MALLOCZ(cfg->osh, evtq_size);
+       if (unlikely(!e)) {
+               WL_ERR(("event alloc failed\n"));
+               return -ENOMEM;
+       }
+       e->etype = event;
+       memcpy(&e->emsg, msg, sizeof(wl_event_msg_t));
+       if (data)
+               memcpy(e->edata, data, data_len);
+       e->datalen = data_len;
+       flags = wl_lock_eq(cfg);
+       list_add_tail(&e->eq_list, &cfg->eq_list);
+       wl_unlock_eq(cfg, flags);
+
+       return err;
+}
+
+static void wl_put_event(struct bcm_cfg80211 *cfg, struct wl_event_q *e)
+{
+       MFREE(cfg->osh, e, e->datalen + sizeof(struct wl_event_q));
+}
+
+static s32 wl_config_infra(struct bcm_cfg80211 *cfg, struct net_device *ndev, u16 iftype)
+{
+       s32 infra = 0;
+       s32 err = 0;
+       bool skip_infra = false;
+
+       switch (iftype) {
+               case WL_IF_TYPE_IBSS:
+               case WL_IF_TYPE_AIBSS:
+                       infra = 0;
+                       break;
+               case WL_IF_TYPE_AP:
+               case WL_IF_TYPE_STA:
+               case WL_IF_TYPE_P2P_GO:
+               case WL_IF_TYPE_P2P_GC:
+                       /* Intentional fall through */
+                       infra = 1;
+                       break;
+#ifdef WLMESH_CFG80211
+       case NL80211_IFTYPE_MESH_POINT:
+               infra = WL_BSSTYPE_MESH;
+               break;
+#endif /* WLMESH_CFG80211 */
+               case WL_IF_TYPE_MONITOR:
+
+               case WL_IF_TYPE_NAN:
+                       /* Intentionall fall through */
+               default:
+                       skip_infra = true;
+                       WL_ERR(("Skipping infra setting for type:%d\n", iftype));
+                       break;
+       }
+
+       /* /TODO Infra iovar is stored in default bss first and
+        * then applied to the next upcoming bss. so if there is
+        * some other concurrent bss coming up in parallel, it
+        * can cause problem. Ideally this iovar should get directly
+        * applied on the target bsscfg.
+        */
+       if (!skip_infra) {
+               infra = htod32(infra);
+               err = wldev_ioctl_set(ndev, WLC_SET_INFRA, &infra, sizeof(infra));
+               if (unlikely(err)) {
+                       WL_ERR(("WLC_SET_INFRA error (%d)\n", err));
+                       return err;
+               }
+       }
+       return 0;
+}
+
+void wl_cfg80211_add_to_eventbuffer(struct wl_eventmsg_buf *ev, u16 event, bool set)
+{
+       if (!ev || (event > WLC_E_LAST))
+               return;
+
+       if (ev->num < MAX_EVENT_BUF_NUM) {
+               ev->event[ev->num].type = event;
+               ev->event[ev->num].set = set;
+               ev->num++;
+       } else {
+               WL_ERR(("evenbuffer doesn't support > %u events. Update"
+                       " the define MAX_EVENT_BUF_NUM \n", MAX_EVENT_BUF_NUM));
+               ASSERT(0);
+       }
+}
+
+s32 wl_cfg80211_apply_eventbuffer(
+       struct net_device *ndev,
+       struct bcm_cfg80211 *cfg,
+       wl_eventmsg_buf_t *ev)
+{
+       int i, ret = BCME_OK;
+       s8 event_buf[WL_EVENTING_MASK_EXT_LEN + EVENTMSGS_EXT_STRUCT_SIZE] = {0};
+       /*  Room for "event_msgs_ext" + '\0' + bitvec  */
+       char iovbuf[WL_EVENTING_MASK_EXT_LEN + EVENTMSGS_EXT_STRUCT_SIZE + 16];
+       eventmsgs_ext_t *eventmask_msg;
+       s32 msglen = WL_EVENTING_MASK_EXT_LEN + EVENTMSGS_EXT_STRUCT_SIZE;
+
+       if (!ev || (!ev->num)) {
+               return -EINVAL;
+       }
+
+       mutex_lock(&cfg->event_sync);
+
+       eventmask_msg = (eventmsgs_ext_t *)event_buf;
+       eventmask_msg->ver = EVENTMSGS_VER;
+       eventmask_msg->command = EVENTMSGS_NONE;
+       eventmask_msg->len = WL_EVENTING_MASK_EXT_LEN;
+       eventmask_msg->maxgetsize = WL_EVENTING_MASK_EXT_LEN;
+
+       /* Read event_msgs mask */
+       ret = wldev_iovar_getbuf(ndev, "event_msgs_ext",
+               eventmask_msg, EVENTMSGS_EXT_STRUCT_SIZE,
+               iovbuf,
+               sizeof(iovbuf),
+               NULL);
+
+       if (unlikely(ret)) {
+               WL_ERR(("Get event_msgs error (%d)\n", ret));
+               goto exit;
+       }
+
+       bcopy(iovbuf, eventmask_msg, msglen);
+
+       /* apply the set bits */
+       for (i = 0; i < ev->num; i++) {
+               if (ev->event[i].set)
+                       setbit(eventmask_msg->mask, ev->event[i].type);
+               else
+                       clrbit(eventmask_msg->mask, ev->event[i].type);
+       }
+
+       /* Write updated Event mask */
+       eventmask_msg->ver = EVENTMSGS_VER;
+       eventmask_msg->command = EVENTMSGS_SET_MASK;
+       eventmask_msg->len = WL_EVENTING_MASK_EXT_LEN;
+
+       /* Write updated Event mask */
+       ret = wldev_iovar_setbuf(ndev, "event_msgs_ext", eventmask_msg,
+               WL_EVENTING_MASK_EXT_LEN + EVENTMSGS_EXT_STRUCT_SIZE,
+               iovbuf, sizeof(iovbuf), NULL);
+
+       if (unlikely(ret)) {
+               WL_ERR(("Set event_msgs error (%d)\n", ret));
+       }
+
+exit:
+       mutex_unlock(&cfg->event_sync);
+       return ret;
+}
+
+s32 wl_add_remove_eventmsg(struct net_device *ndev, u16 event, bool add)
+{
+       s32 err = 0;
+       s8 event_buf[WL_EVENTING_MASK_EXT_LEN + EVENTMSGS_EXT_STRUCT_SIZE] = {0};
+       eventmsgs_ext_t *eventmask_msg = NULL;
+       struct bcm_cfg80211 *cfg;
+       /*  Room for "event_msgs_ext" + '\0' + bitvec  */
+       char iovbuf[WL_EVENTING_MASK_EXT_LEN + EVENTMSGS_EXT_STRUCT_SIZE + 16];
+       s32 msglen = WL_EVENTING_MASK_EXT_LEN + EVENTMSGS_EXT_STRUCT_SIZE;
+
+       if (!ndev)
+               return -ENODEV;
+
+       cfg = wl_get_cfg(ndev);
+       if (!cfg)
+               return -ENODEV;
+
+       mutex_lock(&cfg->event_sync);
+
+       eventmask_msg = (eventmsgs_ext_t *)event_buf;
+       eventmask_msg->ver = EVENTMSGS_VER;
+       eventmask_msg->command = EVENTMSGS_NONE;
+       eventmask_msg->len = WL_EVENTING_MASK_EXT_LEN;
+       eventmask_msg->maxgetsize = WL_EVENTING_MASK_EXT_LEN;
+
+       /* Read event_msgs mask */
+       err = wldev_iovar_getbuf(ndev, "event_msgs_ext",
+               eventmask_msg, EVENTMSGS_EXT_STRUCT_SIZE,
+               iovbuf,
+               sizeof(iovbuf),
+               NULL);
+
+       if (unlikely(err)) {
+               WL_ERR(("Get event_msgs error (%d)\n", err));
+               goto eventmsg_out;
+       }
+
+       bcopy(iovbuf, eventmask_msg, msglen);
+
+       if (add) {
+               setbit(eventmask_msg->mask, event);
+       } else {
+               clrbit(eventmask_msg->mask, event);
+       }
+
+       /* Write updated Event mask */
+       eventmask_msg->ver = EVENTMSGS_VER;
+       eventmask_msg->command = EVENTMSGS_SET_MASK;
+       eventmask_msg->len = WL_EVENTING_MASK_EXT_LEN;
+
+       err = wldev_iovar_setbuf(ndev, "event_msgs_ext", eventmask_msg,
+               WL_EVENTING_MASK_EXT_LEN + EVENTMSGS_EXT_STRUCT_SIZE,
+               iovbuf, sizeof(iovbuf), NULL);
+
+       if (unlikely(err)) {
+               WL_ERR(("Set event_msgs error (%d)\n", err));
+               goto eventmsg_out;
+       }
+
+eventmsg_out:
+       mutex_unlock(&cfg->event_sync);
+       return err;
+}
+
+void
+wl_cfg80211_generate_mac_addr(struct ether_addr *ea_addr)
+{
+       RANDOM_BYTES(ea_addr->octet, ETHER_ADDR_LEN);
+       /* restore mcast and local admin bits to 0 and 1 */
+       ETHER_SET_UNICAST(ea_addr->octet);
+       ETHER_SET_LOCALADDR(ea_addr->octet);
+       WL_ERR(("%s:generated new MAC="MACDBG" \n",
+               __FUNCTION__, MAC2STRDBG(ea_addr->octet)));
+       return;
+}
+
+static s32 wl_update_chan_param(struct net_device *dev, u32 cur_chan,
+       struct ieee80211_channel *band_chan, bool *dfs_radar_disabled, bool legacy_chan_info)
+{
+       s32 err = BCME_OK;
+       u32 channel = cur_chan;
+
+       if (!(*dfs_radar_disabled)) {
+               if (legacy_chan_info) {
+                       channel |= WL_CHANSPEC_BW_20;
+                       channel = wl_chspec_host_to_driver(channel);
+                       err = wldev_iovar_getint(dev, "per_chan_info", &channel);
+               }
+               if (!err) {
+                       if (channel & WL_CHAN_RADAR) {
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+                               band_chan->flags |= (IEEE80211_CHAN_RADAR |
+                                       IEEE80211_CHAN_NO_IBSS);
+#else
+                               band_chan->flags |= IEEE80211_CHAN_RADAR;
+#endif
+                       }
+                       if (channel & WL_CHAN_PASSIVE) {
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+                               band_chan->flags |= IEEE80211_CHAN_PASSIVE_SCAN;
+#else
+                               band_chan->flags |= IEEE80211_CHAN_NO_IR;
+#endif
+                       }
+               } else if (err == BCME_UNSUPPORTED) {
+                       *dfs_radar_disabled = TRUE;
+                       WL_ERR(("does not support per_chan_info\n"));
+               }
+       }
+
+       return err;
+}
+
+static int wl_construct_reginfo(struct bcm_cfg80211 *cfg, s32 bw_cap)
+{
+       struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+       struct ieee80211_channel *band_chan_arr = NULL;
+       void *list;
+       u32 i, j, index, channel, array_size = 0;
+       chanspec_t chspec = 0;
+       s32 err = BCME_OK;
+       bool ht40_allowed;
+       bool dfs_radar_disabled = FALSE;
+       bool legacy_chan_info = FALSE;
+       u16 list_count;
+
+#define LOCAL_BUF_LEN 4096
+       list = MALLOCZ(cfg->osh, LOCAL_BUF_LEN);
+       if (list == NULL) {
+               WL_ERR(("failed to allocate local buf\n"));
+               return -ENOMEM;
+       }
+
+       err = wldev_iovar_getbuf_bsscfg(dev, "chan_info_list", NULL,
+               0, list, LOCAL_BUF_LEN, 0, &cfg->ioctl_buf_sync);
+       if (err == BCME_UNSUPPORTED) {
+               WL_INFORM(("get chan_info_list, UNSUPPORTED\n"));
+               err = wldev_iovar_getbuf_bsscfg(dev, "chanspecs", NULL,
+                       0, list, LOCAL_BUF_LEN, 0, &cfg->ioctl_buf_sync);
+               if (err != BCME_OK) {
+                       WL_ERR(("get chanspecs err(%d)\n", err));
+                       MFREE(cfg->osh, list, LOCAL_BUF_LEN);
+                       return err;
+               }
+               /* Update indicating legacy chan info usage */
+               legacy_chan_info = TRUE;
+       } else if (err != BCME_OK) {
+               WL_ERR(("get chan_info_list err(%d)\n", err));
+               MFREE(cfg->osh, list, LOCAL_BUF_LEN);
+               return err;
+       }
+
+       WL_CHANNEL_ARRAY_INIT(__wl_2ghz_channels);
+       WL_CHANNEL_ARRAY_INIT(__wl_5ghz_a_channels);
+
+       list_count = legacy_chan_info ? ((wl_uint32_list_t *)list)->count :
+               ((wl_chanspec_list_v1_t *)list)->count;
+       for (i = 0; i < dtoh32(list_count); i++) {
+               index = 0;
+               ht40_allowed = false;
+               if (legacy_chan_info) {
+                       chspec = (chanspec_t)dtoh32(((wl_uint32_list_t *)list)->element[i]);
+               } else {
+                       chspec = (chanspec_t)dtoh32
+                       (((wl_chanspec_list_v1_t *)list)->chspecs[i].chanspec);
+               }
+               chspec = wl_chspec_driver_to_host(chspec);
+               channel = wf_chspec_ctlchan(chspec);
+
+               if (!CHSPEC_IS40(chspec) &&
+                       !CHSPEC_IS20(chspec)) {
+                       WL_DBG(("HT80/160/80p80 center channel : %d\n", channel));
+                       continue;
+               }
+               if (CHSPEC_IS2G(chspec) && (channel >= CH_MIN_2G_CHANNEL) &&
+                       (channel <= CH_MAX_2G_CHANNEL)) {
+                       band_chan_arr = __wl_2ghz_channels;
+                       array_size = ARRAYSIZE(__wl_2ghz_channels);
+                       ht40_allowed = (bw_cap  == WLC_N_BW_40ALL)? true : false;
+               } else if (
+#ifdef WL_6G_BAND
+                       /* Currently due to lack of kernel support both 6GHz and 5GHz
+                       * channels are published under 5GHz band
+                       */
+                       (CHSPEC_IS6G(chspec) && (channel >= CH_MIN_6G_CHANNEL) &&
+                       (channel <= CH_MAX_6G_CHANNEL)) ||
+#endif /* WL_6G_BAND */
+                       (CHSPEC_IS5G(chspec) && channel >= CH_MIN_5G_CHANNEL)) {
+                       band_chan_arr = __wl_5ghz_a_channels;
+                       array_size = ARRAYSIZE(__wl_5ghz_a_channels);
+                       ht40_allowed = (bw_cap  == WLC_N_BW_20ALL)? false : true;
+               } else {
+                       WL_ERR(("Invalid channel Sepc. 0x%x.\n", chspec));
+                       continue;
+               }
+               if (!ht40_allowed && CHSPEC_IS40(chspec))
+                       continue;
+               for (j = 0; j < array_size; j++) {
+                       if (band_chan_arr[j].hw_value == chspec) {
+                               break;
+                       }
+               }
+               index = j;
+               if (!dhd_conf_match_channel(cfg->pub, channel))
+                       continue;
+               if (index <  array_size) {
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 39) && !defined(WL_COMPAT_WIRELESS)
+                       band_chan_arr[index].center_freq =
+                               ieee80211_channel_to_frequency(channel);
+#else
+                       band_chan_arr[index].center_freq =
+                               wl_channel_to_frequency(channel, CHSPEC_BAND(chspec));
+#endif
+                       band_chan_arr[index].hw_value = chspec;
+                       band_chan_arr[index].beacon_found = false;
+                       band_chan_arr[index].flags &= ~IEEE80211_CHAN_DISABLED;
+
+                       if (CHSPEC_IS40(chspec) && ht40_allowed) {
+                               /* assuming the order is HT20, HT40 Upper,
+                                *  HT40 lower from chanspecs
+                                */
+                               u32 ht40_flag = band_chan_arr[index].flags & IEEE80211_CHAN_NO_HT40;
+                               if (CHSPEC_SB_UPPER(chspec)) {
+                                       if (ht40_flag == IEEE80211_CHAN_NO_HT40)
+                                               band_chan_arr[index].flags &=
+                                                       ~IEEE80211_CHAN_NO_HT40;
+                                       band_chan_arr[index].flags |= IEEE80211_CHAN_NO_HT40PLUS;
+                               } else {
+                                       /* It should be one of
+                                        * IEEE80211_CHAN_NO_HT40 or IEEE80211_CHAN_NO_HT40PLUS
+                                        */
+                                       band_chan_arr[index].flags &= ~IEEE80211_CHAN_NO_HT40;
+                                       if (ht40_flag == IEEE80211_CHAN_NO_HT40)
+                                               band_chan_arr[index].flags |=
+                                                       IEEE80211_CHAN_NO_HT40MINUS;
+                               }
+                       } else {
+                               band_chan_arr[index].flags = IEEE80211_CHAN_NO_HT40;
+                               if (!legacy_chan_info) {
+                                       channel = dtoh32
+                                       (((wl_chanspec_list_v1_t *)list)->chspecs[i].chaninfo);
+                               } else {
+                                       channel |= CHSPEC_BAND(chspec);
+                               }
+                               /* Update channel for radar/passive support */
+                               err = wl_update_chan_param(dev, channel,
+                               &band_chan_arr[index], &dfs_radar_disabled, legacy_chan_info);
+                       }
+               }
+
+       }
+
+       __wl_band_2ghz.n_channels = ARRAYSIZE(__wl_2ghz_channels);
+       __wl_band_5ghz_a.n_channels = ARRAYSIZE(__wl_5ghz_a_channels);
+
+       MFREE(cfg->osh, list, LOCAL_BUF_LEN);
+#undef LOCAL_BUF_LEN
+       return err;
+}
+
+#ifdef WL_6G_BAND
+static void wl_is_6g_supported(struct bcm_cfg80211 *cfg, u32 *bandlist, u8 nbands)
+{
+       u32 i = 0;
+
+       if (nbands > WL_MAX_BAND_SUPPORT) {
+               return;
+       }
+       /* Check for 6GHz band support */
+       for (i = 1; i <= nbands; i++) {
+               if (bandlist[i] == WLC_BAND_6G) {
+                       cfg->band_6g_supported = true;
+               }
+       }
+}
+#endif /* WL_6G_BAND */
+
+static s32 __wl_update_wiphybands(struct bcm_cfg80211 *cfg, bool notify)
+{
+       struct wiphy *wiphy;
+       struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+       u32 bandlist[WL_MAX_BAND_SUPPORT+1];
+       u32 nband = 0;
+       u32 i = 0;
+       s32 err = 0;
+       s32 index = 0;
+       s32 nmode = 0;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+       u32 j = 0;
+       s32 vhtmode = 0;
+       s32 txstreams = 0;
+       s32 rxstreams = 0;
+       s32 ldpc_cap = 0;
+       s32 stbc_rx = 0;
+       s32 stbc_tx = 0;
+       s32 txbf_bfe_cap = 0;
+       s32 txbf_bfr_cap = 0;
+#endif
+       s32 bw_cap = 0;
+       s32 cur_band = -1;
+       struct ieee80211_supported_band *bands[IEEE80211_NUM_BANDS] = {NULL, };
+
+       bzero(bandlist, sizeof(bandlist));
+       err = wldev_ioctl_get(dev, WLC_GET_BANDLIST, bandlist,
+               sizeof(bandlist));
+       if (unlikely(err)) {
+               WL_ERR(("error read bandlist (%d)\n", err));
+               return err;
+       }
+       err = wldev_ioctl_get(dev, WLC_GET_BAND, &cur_band,
+               sizeof(s32));
+       if (unlikely(err)) {
+               WL_ERR(("error (%d)\n", err));
+               return err;
+       }
+
+       err = wldev_iovar_getint(dev, "nmode", &nmode);
+       if (unlikely(err)) {
+               WL_ERR(("error reading nmode (%d)\n", err));
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+       err = wldev_iovar_getint(dev, "vhtmode", &vhtmode);
+       if (unlikely(err)) {
+               WL_ERR(("error reading vhtmode (%d)\n", err));
+       }
+
+       if (vhtmode) {
+               err = wldev_iovar_getint(dev, "txstreams", &txstreams);
+               if (unlikely(err)) {
+                       WL_ERR(("error reading txstreams (%d)\n", err));
+               }
+
+               err = wldev_iovar_getint(dev, "rxstreams", &rxstreams);
+               if (unlikely(err)) {
+                       WL_ERR(("error reading rxstreams (%d)\n", err));
+               }
+
+               err = wldev_iovar_getint(dev, "ldpc_cap", &ldpc_cap);
+               if (unlikely(err)) {
+                       WL_ERR(("error reading ldpc_cap (%d)\n", err));
+               }
+
+               err = wldev_iovar_getint(dev, "stbc_rx", &stbc_rx);
+               if (unlikely(err)) {
+                       WL_ERR(("error reading stbc_rx (%d)\n", err));
+               }
+
+               err = wldev_iovar_getint(dev, "stbc_tx", &stbc_tx);
+               if (unlikely(err)) {
+                       WL_ERR(("error reading stbc_tx (%d)\n", err));
+               }
+
+               err = wldev_iovar_getint(dev, "txbf_bfe_cap", &txbf_bfe_cap);
+               if (unlikely(err)) {
+                       WL_ERR(("error reading txbf_bfe_cap (%d)\n", err));
+               }
+
+               err = wldev_iovar_getint(dev, "txbf_bfr_cap", &txbf_bfr_cap);
+               if (unlikely(err)) {
+                       WL_ERR(("error reading txbf_bfr_cap (%d)\n", err));
+               }
+       }
+#endif
+
+       /* For nmode and vhtmode   check bw cap */
+       if (nmode ||
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+               vhtmode ||
+#endif
+               0) {
+               err = wldev_iovar_getint(dev, "mimo_bw_cap", &bw_cap);
+               if (unlikely(err)) {
+                       WL_ERR(("error get mimo_bw_cap (%d)\n", err));
+               }
+       }
+
+#ifdef WL_6G_BAND
+       wl_is_6g_supported(cfg, bandlist, bandlist[0]);
+#endif /* WL_6G_BAND */
+
+       err = wl_construct_reginfo(cfg, bw_cap);
+       if (err) {
+               WL_ERR(("wl_construct_reginfo() fails err=%d\n", err));
+               if (err != BCME_UNSUPPORTED)
+                       return err;
+       }
+
+       wiphy = bcmcfg_to_wiphy(cfg);
+       nband = bandlist[0];
+
+       for (i = 1; i <= nband && i < ARRAYSIZE(bandlist); i++) {
+               index = -1;
+
+               if (((bandlist[i] == WLC_BAND_5G) || (bandlist[i] == WLC_BAND_6G)) &&
+                       (__wl_band_5ghz_a.n_channels > 0)) {
+                       bands[IEEE80211_BAND_5GHZ] =
+                               &__wl_band_5ghz_a;
+                       index = IEEE80211_BAND_5GHZ;
+                       if (nmode && (bw_cap == WLC_N_BW_40ALL || bw_cap == WLC_N_BW_20IN2G_40IN5G))
+                               bands[index]->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+                       /* VHT capabilities. */
+                       if (vhtmode) {
+                               /* Supported */
+                               bands[index]->vht_cap.vht_supported = TRUE;
+
+                               for (j = 1; j <= VHT_CAP_MCS_MAP_NSS_MAX; j++) {
+                                       /* TX stream rates. */
+                                       if (j <= txstreams) {
+                                               VHT_MCS_MAP_SET_MCS_PER_SS(j, VHT_CAP_MCS_MAP_0_9,
+                                                       bands[index]->vht_cap.vht_mcs.tx_mcs_map);
+                                       } else {
+                                               VHT_MCS_MAP_SET_MCS_PER_SS(j, VHT_CAP_MCS_MAP_NONE,
+                                                       bands[index]->vht_cap.vht_mcs.tx_mcs_map);
+                                       }
+
+                                       /* RX stream rates. */
+                                       if (j <= rxstreams) {
+                                               VHT_MCS_MAP_SET_MCS_PER_SS(j, VHT_CAP_MCS_MAP_0_9,
+                                                       bands[index]->vht_cap.vht_mcs.rx_mcs_map);
+                                       } else {
+                                               VHT_MCS_MAP_SET_MCS_PER_SS(j, VHT_CAP_MCS_MAP_NONE,
+                                                       bands[index]->vht_cap.vht_mcs.rx_mcs_map);
+                                       }
+                               }
+
+                               /* Capabilities */
+                               /* 80 MHz is mandatory */
+                               bands[index]->vht_cap.cap |=
+                                       IEEE80211_VHT_CAP_SHORT_GI_80;
+
+                               if (WL_BW_CAP_160MHZ(bw_cap)) {
+                                       bands[index]->vht_cap.cap |=
+                                               IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
+                                       bands[index]->vht_cap.cap |=
+                                               IEEE80211_VHT_CAP_SHORT_GI_160;
+                               }
+
+                               bands[index]->vht_cap.cap |=
+                                       IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
+
+                               if (ldpc_cap)
+                                       bands[index]->vht_cap.cap |=
+                                               IEEE80211_VHT_CAP_RXLDPC;
+
+                               if (stbc_tx)
+                                       bands[index]->vht_cap.cap |=
+                                               IEEE80211_VHT_CAP_TXSTBC;
+
+                               if (stbc_rx)
+                                       bands[index]->vht_cap.cap |=
+                                               (stbc_rx << VHT_CAP_INFO_RX_STBC_SHIFT);
+
+                               if (txbf_bfe_cap)
+                                       bands[index]->vht_cap.cap |=
+                                               IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
+
+                               if (txbf_bfr_cap) {
+                                       bands[index]->vht_cap.cap |=
+                                               IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
+                               }
+
+                               if (txbf_bfe_cap || txbf_bfr_cap) {
+                                       bands[index]->vht_cap.cap |=
+                                               (2 << VHT_CAP_INFO_NUM_BMFMR_ANT_SHIFT);
+                                       bands[index]->vht_cap.cap |=
+                                               ((txstreams - 1) <<
+                                                       VHT_CAP_INFO_NUM_SOUNDING_DIM_SHIFT);
+                                       bands[index]->vht_cap.cap |=
+                                               IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
+                               }
+
+                               /* AMPDU length limit, support max 1MB (2 ^ (13 + 7)) */
+                               bands[index]->vht_cap.cap |=
+                                       (7 << VHT_CAP_INFO_AMPDU_MAXLEN_EXP_SHIFT);
+                               WL_DBG(("__wl_update_wiphybands band[%d] vht_enab=%d vht_cap=%08x "
+                                       "vht_rx_mcs_map=%04x vht_tx_mcs_map=%04x\n",
+                                       index,
+                                       bands[index]->vht_cap.vht_supported,
+                                       bands[index]->vht_cap.cap,
+                                       bands[index]->vht_cap.vht_mcs.rx_mcs_map,
+                                       bands[index]->vht_cap.vht_mcs.tx_mcs_map));
+                       }
+#endif
+               }
+               else if (bandlist[i] == WLC_BAND_2G && __wl_band_2ghz.n_channels > 0) {
+                       bands[IEEE80211_BAND_2GHZ] =
+                               &__wl_band_2ghz;
+                       index = IEEE80211_BAND_2GHZ;
+                       if (bw_cap == WLC_N_BW_40ALL)
+                               bands[index]->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
+               }
+
+               if ((index >= 0) && nmode) {
+                       bands[index]->ht_cap.cap |=
+                               (IEEE80211_HT_CAP_SGI_20 | IEEE80211_HT_CAP_DSSSCCK40);
+                       bands[index]->ht_cap.ht_supported = TRUE;
+                       bands[index]->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+                       bands[index]->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
+                       /* An HT shall support all EQM rates for one spatial stream */
+                       bands[index]->ht_cap.mcs.rx_mask[0] = 0xff;
+               }
+
+       }
+
+       wiphy->bands[IEEE80211_BAND_2GHZ] = bands[IEEE80211_BAND_2GHZ];
+       wiphy->bands[IEEE80211_BAND_5GHZ] = bands[IEEE80211_BAND_5GHZ];
+
+       /* check if any bands populated otherwise makes 2Ghz as default */
+       if (wiphy->bands[IEEE80211_BAND_2GHZ] == NULL &&
+               wiphy->bands[IEEE80211_BAND_5GHZ] == NULL) {
+               /* Setup 2Ghz band as default */
+               wiphy->bands[IEEE80211_BAND_2GHZ] = &__wl_band_2ghz;
+       }
+
+       if (notify) {
+               if (!IS_REGDOM_SELF_MANAGED(wiphy)) {
+                       WL_UPDATE_CUSTOM_REGULATORY(wiphy);
+                       wiphy_apply_custom_regulatory(wiphy, &brcm_regdom);
+               }
+       }
+
+       return 0;
+}
+
+s32 wl_update_wiphybands(struct bcm_cfg80211 *cfg, bool notify)
+{
+       s32 err;
+
+       mutex_lock(&cfg->usr_sync);
+       err = __wl_update_wiphybands(cfg, notify);
+       mutex_unlock(&cfg->usr_sync);
+
+       return err;
+}
+
+static s32 __wl_cfg80211_up(struct bcm_cfg80211 *cfg)
+{
+       s32 err = 0;
+       s32 ret = 0;
+
+       struct net_info *netinfo = NULL;
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       struct wireless_dev *wdev = ndev->ieee80211_ptr;
+       dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+#ifdef WLTDLS
+       u32 tdls;
+#endif /* WLTDLS */
+       u16 wl_iftype = 0;
+       u16 wl_mode = 0;
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+
+       WL_DBG(("In\n"));
+
+#if defined(__linux__)
+       if (!dhd_download_fw_on_driverload) {
+#endif
+               err = wl_create_event_handler(cfg);
+               if (err) {
+                       WL_ERR(("wl_create_event_handler failed\n"));
+                       return err;
+               }
+               wl_init_event_handler(cfg);
+#if defined(__linux__)
+       }
+#endif
+       /* Reserve 0x8000 toggle bit for P2P GO/GC */
+       cfg->vif_macaddr_mask = 0x8000;
+
+       err = dhd_config_dongle(cfg);
+       if (unlikely(err))
+               return err;
+
+       (void)memcpy_s(wdev->wiphy->perm_addr, ETHER_ADDR_LEN,
+               bcmcfg_to_prmry_ndev(cfg)->perm_addr, ETHER_ADDR_LEN);
+       /* Always bring up interface in STA mode.
+       * Did observe , if previous SofAP Bringup/cleanup
+       * is not done properly, iftype is stuck with AP mode.
+       * So during next wlan0 up, forcing the type to STA
+       */
+       netinfo = wl_get_netinfo_by_wdev(cfg, wdev);
+       if (!netinfo) {
+               WL_ERR(("there is no netinfo\n"));
+               return -ENODEV;
+       }
+
+       if (ndev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP) {
+               /* AP on primary interface case: Supplicant will
+                * set mode first and then do dev_open. so in this
+                * case, the type will already be set.
+                */
+               netinfo->iftype = WL_IF_TYPE_AP;
+       } else {
+               ndev->ieee80211_ptr->iftype = NL80211_IFTYPE_STATION;
+               netinfo->iftype = WL_IF_TYPE_STA;
+       }
+
+       if (cfg80211_to_wl_iftype(wdev->iftype, &wl_iftype, &wl_mode) < 0) {
+               return -EINVAL;
+       }
+       if (!dhd->fw_preinit) {
+               err = wl_config_infra(cfg, ndev, wl_iftype);
+               if (unlikely(err && err != -EINPROGRESS)) {
+                       WL_ERR(("wl_config_infra failed\n"));
+                       if (err == -1) {
+                               WL_ERR(("return error %d\n", err));
+                               return err;
+                       }
+               }
+       }
+
+       err = wl_init_scan(cfg);
+       if (err) {
+               WL_ERR(("wl_init_scan failed\n"));
+               return err;
+       }
+       err = __wl_update_wiphybands(cfg, true);
+       if (unlikely(err)) {
+               WL_ERR(("wl_update_wiphybands failed\n"));
+               if (err == -1) {
+                       WL_ERR(("return error %d\n", err));
+                       return err;
+               }
+       }
+
+       /* Update wlc version in cfg struct already queried as part of DHD  initialization */
+       cfg->wlc_ver.wlc_ver_major = dhd->wlc_ver_major;
+       cfg->wlc_ver.wlc_ver_minor = dhd->wlc_ver_minor;
+
+       if ((ret = wldev_iovar_getbuf(ndev, "scan_ver", NULL, 0,
+               ioctl_buf, sizeof(ioctl_buf), NULL) == BCME_OK)) {
+               WL_INFORM_MEM(("scan_params v2\n"));
+               /* use scan_params ver2 */
+               cfg->scan_params_v2 = true;
+       } else {
+               if (ret == BCME_UNSUPPORTED) {
+                       WL_INFORM(("scan_ver, UNSUPPORTED\n"));
+               } else {
+                       WL_ERR(("get scan_ver err(%d)\n", ret));
+               }
+       }
+#ifdef DHD_LOSSLESS_ROAMING
+       if (timer_pending(&cfg->roam_timeout)) {
+               del_timer_sync(&cfg->roam_timeout);
+       }
+#endif /* DHD_LOSSLESS_ROAMING */
+
+       err = dhd_monitor_init(cfg->pub);
+
+#ifdef WL_HOST_BAND_MGMT
+       /* By default the curr_band is initialized to BAND_AUTO */
+       if ((ret = wl_cfg80211_set_band(ndev, WLC_BAND_AUTO)) < 0) {
+               if (ret == BCME_UNSUPPORTED) {
+                       /* Don't fail the initialization, lets just
+                        * fall back to the original method
+                        */
+                       WL_ERR(("WL_HOST_BAND_MGMT defined, "
+                               "but roam_band iovar not supported \n"));
+               } else {
+                       WL_ERR(("roam_band failed. ret=%d", ret));
+                       err = -1;
+               }
+       }
+#endif /* WL_HOST_BAND_MGMT */
+       /* Reset WES mode to 0 */
+       cfg->wes_mode = OFF;
+       cfg->ncho_mode = OFF;
+       cfg->ncho_band = WLC_BAND_AUTO;
+#ifdef WBTEXT
+       /* when wifi up, set roam_prof to default value */
+       if (dhd->wbtext_support) {
+               if (dhd->op_mode & DHD_FLAG_STA_MODE) {
+                       if (!dhd->fw_preinit) {
+                               wl_cfg80211_wbtext_set_default(ndev);
+                       }
+                       wl_cfg80211_wbtext_clear_bssid_list(cfg);
+               }
+       }
+#endif /* WBTEXT */
+#ifdef WLTDLS
+       if (wldev_iovar_getint(ndev, "tdls_enable", &tdls) == 0) {
+               WL_DBG(("TDLS supported in fw\n"));
+               cfg->tdls_supported = true;
+       }
+#endif /* WLTDLS */
+#ifdef WL_IFACE_MGMT
+#ifdef CUSTOM_IF_MGMT_POLICY
+       cfg->iface_data.policy = CUSTOM_IF_MGMT_POLICY;
+#else
+       cfg->iface_data.policy = WL_IF_POLICY_DEFAULT;
+#endif /*  CUSTOM_IF_MGMT_POLICY */
+#endif /* WL_IFACE_MGMT */
+#ifdef WL_NAN
+#endif /* WL_NAN  */
+
+#ifdef WL_SAR_TX_POWER
+       cfg->wifi_tx_power_mode = WIFI_POWER_SCENARIO_INVALID;
+#endif /* WL_SAR_TX_POWER */
+
+       INIT_DELAYED_WORK(&cfg->pm_enable_work, wl_cfg80211_work_handler);
+       wl_set_drv_status(cfg, READY, ndev);
+       return err;
+}
+
+static s32 __wl_cfg80211_down(struct bcm_cfg80211 *cfg)
+{
+       s32 err = 0;
+       struct net_info *iter, *next;
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+#if defined(WL_CFG80211) && (defined(WL_ENABLE_P2P_IF) || \
+       defined(WL_NEWCFG_PRIVCMD_SUPPORT)) && !defined(PLATFORM_SLP)
+       struct net_device *p2p_net = cfg->p2p_net;
+#endif /* WL_CFG80211 && (WL_ENABLE_P2P_IF || WL_NEWCFG_PRIVCMD_SUPPORT) && !PLATFORM_SLP */
+       dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+       WL_INFORM_MEM(("cfg80211 down\n"));
+
+       /* Check if cfg80211 interface is already down */
+       if (!wl_get_drv_status(cfg, READY, ndev)) {
+               WL_DBG(("cfg80211 interface is already down\n"));
+               return err;     /* it is even not ready */
+       }
+
+#ifdef SHOW_LOGTRACE
+       /* Stop the event logging */
+       wl_add_remove_eventmsg(ndev, WLC_E_TRACE, FALSE);
+#endif /* SHOW_LOGTRACE */
+
+       /* clear vendor OUI list */
+       wl_vndr_ies_clear_vendor_oui_list(cfg);
+
+       /* clear timestamps */
+       CLR_TS(cfg, scan_start);
+       CLR_TS(cfg, scan_cmplt);
+       CLR_TS(cfg, conn_start);
+       CLR_TS(cfg, conn_cmplt);
+       CLR_TS(cfg, authorize_start);
+       CLR_TS(cfg, authorize_cmplt);
+
+       /* Delete pm_enable_work */
+       wl_add_remove_pm_enable_work(cfg, WL_PM_WORKQ_DEL);
+
+       if (cfg->loc.in_progress) {
+               /* Listen in progress */
+               if (delayed_work_pending(&cfg->loc.work)) {
+                       cancel_delayed_work_sync(&cfg->loc.work);
+               }
+               wl_cfgscan_notify_listen_complete(cfg);
+       }
+
+       if (cfg->p2p_supported) {
+               wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO) || defined(BCMDBUS)
+               if (wl_cfgp2p_vif_created(cfg)) {
+                       bool enabled = false;
+                       dhd_wlfc_get_enable(dhd, &enabled);
+                       /* WLFC should be turned off
+                       *       while unloading dhd driver in IBSS or SoftAP mode
+                       */
+                       if (enabled && cfg->wlfc_on && dhd->op_mode != DHD_FLAG_HOSTAP_MODE &&
+                               dhd->op_mode != DHD_FLAG_IBSS_MODE) {
+                               dhd_wlfc_deinit(dhd);
+                               cfg->wlfc_on = false;
+                       }
+               }
+#endif /* BCMSDIO || BCMDBUS */
+#endif /* PROP_TXSTATUS_VSDB */
+       }
+
+#ifdef WL_NAN
+       mutex_lock(&cfg->if_sync);
+       wl_cfgnan_check_nan_disable_pending(cfg, true, false);
+       mutex_unlock(&cfg->if_sync);
+#endif /* WL_NAN */
+
+#ifdef WL_SAR_TX_POWER
+       cfg->wifi_tx_power_mode = WIFI_POWER_SCENARIO_INVALID;
+#endif /* WL_SAR_TX_POWER */
+       if (!dhd_download_fw_on_driverload) {
+               /* For built-in drivers/other drivers that do reset on
+                * "ifconfig <primary_iface> down", cleanup any left
+                * over interfaces
+                */
+               wl_cfg80211_cleanup_virtual_ifaces(cfg, false);
+       }
+       /* Clear used mac addr mask */
+       cfg->vif_macaddr_mask = 0;
+
+       if (dhd->up)
+       {
+               /* If primary BSS is operational (for e.g SoftAP), bring it down */
+               if (wl_cfg80211_bss_isup(ndev, 0)) {
+                       if (wl_cfg80211_bss_up(cfg, ndev, 0, 0) < 0)
+                               WL_ERR(("BSS down failed \n"));
+               }
+
+               /* clear all the security setting on primary Interface */
+               wl_cfg80211_clear_security(cfg);
+       }
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       for_each_ndev(cfg, iter, next) {
+               GCC_DIAGNOSTIC_POP();
+               if (iter->ndev) /* p2p discovery iface is null */
+                       wl_set_drv_status(cfg, SCAN_ABORTING, iter->ndev);
+       }
+
+#ifdef P2P_LISTEN_OFFLOADING
+       wl_cfg80211_p2plo_deinit(cfg);
+#endif /* P2P_LISTEN_OFFLOADING */
+
+       /* cancel and notify scan complete, if scan request is pending */
+       wl_cfg80211_cancel_scan(cfg);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       for_each_ndev(cfg, iter, next) {
+               GCC_DIAGNOSTIC_POP();
+               /* p2p discovery iface ndev ptr could be null */
+               if (iter->ndev == NULL)
+                       continue;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+               WL_INFORM_MEM(("wl_cfg80211_down. connection state bit status: [%u:%u:%u:%u]\n",
+                       wl_get_drv_status(cfg, CONNECTING, ndev),
+                       wl_get_drv_status(cfg, CONNECTED, ndev),
+                       wl_get_drv_status(cfg, DISCONNECTING, ndev),
+                       wl_get_drv_status(cfg, NESTED_CONNECT, ndev)));
+
+               if (wl_get_drv_status(cfg, CONNECTED, iter->ndev)) {
+                       CFG80211_DISCONNECTED(iter->ndev, 0, NULL, 0, false, GFP_KERNEL);
+                       wl_clr_drv_status(cfg, AUTHORIZED, iter->ndev);
+               }
+
+               if ((iter->ndev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION) &&
+                       wl_get_drv_status(cfg, CONNECTING, iter->ndev)) {
+
+                       u8 *latest_bssid = wl_read_prof(cfg, ndev, WL_PROF_LATEST_BSSID);
+                       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+                       struct wireless_dev *wdev = ndev->ieee80211_ptr;
+                       struct cfg80211_bss *bss = CFG80211_GET_BSS(wiphy, NULL, latest_bssid,
+                               wdev->ssid, wdev->ssid_len);
+
+                       BCM_REFERENCE(bss);
+
+                       CFG80211_CONNECT_RESULT(ndev,
+                               latest_bssid, bss, NULL, 0, NULL, 0,
+                               WLAN_STATUS_UNSPECIFIED_FAILURE,
+                               GFP_KERNEL);
+               }
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)) */
+               wl_clr_drv_status(cfg, READY, iter->ndev);
+               wl_clr_drv_status(cfg, SCANNING, iter->ndev);
+               wl_clr_drv_status(cfg, SCAN_ABORTING, iter->ndev);
+               wl_clr_drv_status(cfg, CONNECTING, iter->ndev);
+               wl_clr_drv_status(cfg, CONNECTED, iter->ndev);
+               wl_clr_drv_status(cfg, DISCONNECTING, iter->ndev);
+               wl_clr_drv_status(cfg, AP_CREATED, iter->ndev);
+               wl_clr_drv_status(cfg, AP_CREATING, iter->ndev);
+               wl_clr_drv_status(cfg, NESTED_CONNECT, iter->ndev);
+               wl_clr_drv_status(cfg, CFG80211_CONNECT, iter->ndev);
+       }
+       bcmcfg_to_prmry_ndev(cfg)->ieee80211_ptr->iftype =
+               NL80211_IFTYPE_STATION;
+#if defined(WL_CFG80211) && (defined(WL_ENABLE_P2P_IF) || \
+       defined(WL_NEWCFG_PRIVCMD_SUPPORT)) && !defined(PLATFORM_SLP)
+#ifdef SUPPORT_DEEP_SLEEP
+       if (!trigger_deep_sleep)
+#endif /* SUPPORT_DEEP_SLEEP */
+               if (p2p_net)
+                       dev_close(p2p_net);
+#endif /* WL_CFG80211 && (WL_ENABLE_P2P_IF || WL_NEWCFG_PRIVCMD_SUPPORT)&& !PLATFORM_SLP */
+
+       /* Avoid deadlock from wl_cfg80211_down */
+#if defined(__linux__)
+       if (!dhd_download_fw_on_driverload) {
+#endif
+               mutex_unlock(&cfg->usr_sync);
+               wl_destroy_event_handler(cfg);
+               mutex_lock(&cfg->usr_sync);
+#if defined(__linux__)
+       }
+#endif
+
+       wl_flush_eq(cfg);
+       wl_link_down(cfg);
+       if (cfg->p2p_supported) {
+               if (timer_pending(&cfg->p2p->listen_timer))
+                       del_timer_sync(&cfg->p2p->listen_timer);
+               wl_cfgp2p_down(cfg);
+       }
+
+       if (timer_pending(&cfg->scan_timeout)) {
+               del_timer_sync(&cfg->scan_timeout);
+       }
+
+       wl_cfg80211_clear_mgmt_vndr_ies(cfg);
+
+       DHD_OS_SCAN_WAKE_UNLOCK((dhd_pub_t *)(cfg->pub));
+
+       dhd_monitor_uninit();
+#ifdef WLAIBSS_MCHAN
+       bcm_cfg80211_del_ibss_if(cfg->wdev->wiphy, cfg->ibss_cfgdev);
+#endif /* WLAIBSS_MCHAN */
+
+#ifdef WL11U
+       /* Clear interworking element. */
+       if (cfg->wl11u) {
+               cfg->wl11u = FALSE;
+       }
+#endif /* WL11U */
+
+#ifdef CUSTOMER_HW4_DEBUG
+       if (wl_scan_timeout_dbg_enabled) {
+               wl_scan_timeout_dbg_clear();
+       }
+#endif /* CUSTOMER_HW4_DEBUG */
+
+       cfg->disable_roam_event = false;
+
+       DNGL_FUNC(dhd_cfg80211_down, (cfg));
+
+#ifdef DHD_IFDEBUG
+       /* Printout all netinfo entries */
+       wl_probe_wdev_all(cfg);
+#endif /* DHD_IFDEBUG */
+
+       return err;
+}
+
+s32 wl_cfg80211_up(struct net_device *net)
+{
+       struct bcm_cfg80211 *cfg;
+       s32 err = 0;
+       int val = 1;
+       dhd_pub_t *dhd;
+#ifdef DISABLE_PM_BCNRX
+       s32 interr = 0;
+       uint param = 0;
+       s8 iovbuf[WLC_IOCTL_SMLEN];
+#endif /* DISABLE_PM_BCNRX */
+#ifdef WL_USE_RANDOMIZED_SCAN
+       uint8 random_addr[ETHER_ADDR_LEN] = {0x02, 0x00, 0x00, 0x00, 0x00, 0x00};
+#endif /* WL_USE_RANDOMIZED_SCAN */
+       WL_DBG(("In\n"));
+       cfg = wl_get_cfg(net);
+
+       if ((err = wldev_ioctl_get(bcmcfg_to_prmry_ndev(cfg), WLC_GET_VERSION, &val,
+               sizeof(int)) < 0)) {
+               WL_ERR(("WLC_GET_VERSION failed, err=%d\n", err));
+               return err;
+       }
+       val = dtoh32(val);
+       if (val != WLC_IOCTL_VERSION && val != 1) {
+               WL_ERR(("Version mismatch, please upgrade. Got %d, expected %d or 1\n",
+                       val, WLC_IOCTL_VERSION));
+               return BCME_VERSION;
+       }
+       ioctl_version = val;
+       WL_TRACE(("WLC_GET_VERSION=%d\n", ioctl_version));
+       wl_cfg80211_check_in4way(cfg, net, NO_SCAN_IN4WAY|NO_BTC_IN4WAY|WAIT_DISCONNECTED,
+               WL_EXT_STATUS_DISCONNECTED, NULL);
+
+       mutex_lock(&cfg->usr_sync);
+       dhd = (dhd_pub_t *)(cfg->pub);
+       if (!(dhd->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+               err = wl_cfg80211_attach_post(bcmcfg_to_prmry_ndev(cfg));
+               if (unlikely(err)) {
+                       mutex_unlock(&cfg->usr_sync);
+                       return err;
+               }
+       }
+#ifdef WLMESH_CFG80211
+       cfg->wdev->wiphy->features |= NL80211_FEATURE_USERSPACE_MPM;
+#endif /* WLMESH_CFG80211 */
+#if defined(BCMSUP_4WAY_HANDSHAKE)
+       if (dhd->fw_4way_handshake) {
+               /* This is a hacky method to indicate fw 4WHS support and
+                * is used only for kernels (kernels < 3.14). For newer
+                * kernels, we would be using vendor extn. path to advertise
+                * FW based 4-way handshake feature support.
+                */
+               cfg->wdev->wiphy->features |= NL80211_FEATURE_FW_4WAY_HANDSHAKE;
+       }
+#endif /* BCMSUP_4WAY_HANDSHAKE */
+       err = __wl_cfg80211_up(cfg);
+       if (unlikely(err))
+               WL_ERR(("__wl_cfg80211_up failed\n"));
+
+#ifdef ROAM_CHANNEL_CACHE
+       if (init_roam_cache(cfg, ioctl_version) == 0) {
+               /* Enable support for Roam cache */
+               cfg->rcc_enabled = true;
+               WL_ERR(("Roam channel cache enabled\n"));
+       } else {
+               WL_ERR(("Failed to enable RCC.\n"));
+       }
+#endif /* ROAM_CHANNEL_CACHE */
+#ifdef WL_USE_RANDOMIZED_SCAN
+       /* Call scanmac only for valid configuration */
+       if (wl_cfg80211_scan_mac_enable(net)) {
+               WL_ERR(("%s : randmac enable failed\n", __FUNCTION__));
+       } else {
+               /* scanmac enabled. apply configuration */
+               if (wl_cfg80211_scan_mac_config(net, random_addr, NULL)) {
+                       WL_ERR(("%s : failed to set randmac config for scan\n", __FUNCTION__));
+                       /* if config fails, disable scan mac */
+                       wl_cfg80211_scan_mac_disable(net);
+               }
+       }
+#endif /* WL_USE_RANDOMIZED_SCAN */
+#if defined(FORCE_DISABLE_SINGLECORE_SCAN)
+       dhd_force_disable_singlcore_scan(dhd);
+#endif /* FORCE_DISABLE_SINGLECORE_SCAN */
+
+       /* IOVAR configurations with 'up' condition */
+#ifdef DISABLE_PM_BCNRX
+       interr = wldev_iovar_setbuf(net, "pm_bcnrx", (char *)&param, sizeof(param), iovbuf,
+                       sizeof(iovbuf), &cfg->ioctl_buf_sync);
+
+       if (unlikely(interr)) {
+               WL_ERR(("Set pm_bcnrx returned (%d)\n", interr));
+       }
+#endif /* DISABLE_PM_BCNRX */
+#ifdef WL_CHAN_UTIL
+       interr = wl_cfg80211_start_bssload_report(net);
+       if (unlikely(interr)) {
+               WL_ERR(("%s: Failed to start bssload_report eventing, err=%d\n",
+                       __FUNCTION__, interr));
+       }
+#endif /* WL_CHAN_UTIL */
+
+       mutex_unlock(&cfg->usr_sync);
+
+#ifdef WLAIBSS_MCHAN
+       bcm_cfg80211_add_ibss_if(cfg->wdev->wiphy, IBSS_IF_NAME);
+#endif /* WLAIBSS_MCHAN */
+       cfg->spmk_info_list->pmkids.count = 0;
+       return err;
+}
+
+/* Private Event to Supplicant with indication that chip hangs */
+int wl_cfg80211_hang(struct net_device *dev, u16 reason)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhd;
+#if defined(SOFTAP_SEND_HANGEVT)
+       /* specifc mac address used for hang event */
+       uint8 hang_mac[ETHER_ADDR_LEN] = {0x11, 0x11, 0x11, 0x11, 0x11, 0x11};
+#endif /* SOFTAP_SEND_HANGEVT */
+       if (!cfg) {
+               return BCME_ERROR;
+       }
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+
+       dhd = (dhd_pub_t *)(cfg->pub);
+#if defined(DHD_HANG_SEND_UP_TEST)
+       if (dhd->req_hang_type) {
+               WL_ERR(("wl_cfg80211_hang, Clear HANG test request 0x%x\n",
+                       dhd->req_hang_type));
+               dhd->req_hang_type = 0;
+       }
+#endif /* DHD_HANG_SEND_UP_TEST */
+       if ((dhd->hang_reason <= HANG_REASON_MASK) || (dhd->hang_reason >= HANG_REASON_MAX)) {
+               WL_ERR(("wl_cfg80211_hang, Invalid hang reason 0x%x\n",
+                       dhd->hang_reason));
+               dhd->hang_reason = HANG_REASON_UNKNOWN;
+       }
+#ifdef DHD_USE_EXTENDED_HANG_REASON
+       /* The proper dhd->hang_reason handling codes should be implemented
+        * in the WPA Supplicant/Hostapd or Android framework.
+        * If not, HANG event may not be sent to Android framework and
+        * driver cannot be reloaded.
+        * Please do not enable DHD_USE_EXTENDED_HANG_REASON if your Android platform
+        * cannot handle the dhd->hang_reason value.
+        */
+       if (dhd->hang_reason != 0) {
+               reason = dhd->hang_reason;
+       }
+#endif /* DHD_USE_EXTENDED_HANG_REASON */
+       WL_ERR(("In : chip crash eventing, reason=0x%x\n", (uint32)(dhd->hang_reason)));
+
+       wl_add_remove_pm_enable_work(cfg, WL_PM_WORKQ_DEL);
+#ifdef SOFTAP_SEND_HANGEVT
+       if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+               cfg80211_del_sta(dev, hang_mac, GFP_ATOMIC);
+       } else
+#endif /* SOFTAP_SEND_HANGEVT */
+       {
+               if (dhd->up == TRUE) {
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+                       wl_cfgvendor_send_hang_event(dev, reason,
+                                       dhd->hang_info, dhd->hang_info_cnt);
+#else
+                       CFG80211_DISCONNECTED(dev, reason, NULL, 0, false, GFP_KERNEL);
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+               }
+       }
+#if defined(RSSIAVG)
+       wl_free_rssi_cache(&cfg->g_rssi_cache_ctrl);
+#endif
+#if defined(BSSCACHE)
+       wl_free_bss_cache(&cfg->g_bss_cache_ctrl);
+#endif
+       if (cfg != NULL) {
+               /* Do we need to call wl_cfg80211_down here ? */
+               wl_link_down(cfg);
+       }
+       return 0;
+}
+
+s32 wl_cfg80211_down(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       s32 err = BCME_ERROR;
+
+       WL_DBG(("In\n"));
+
+       if (cfg && (cfg == wl_cfg80211_get_bcmcfg())) {
+               mutex_lock(&cfg->usr_sync);
+#if defined(RSSIAVG)
+               wl_free_rssi_cache(&cfg->g_rssi_cache_ctrl);
+#endif
+#if defined(BSSCACHE)
+               wl_free_bss_cache(&cfg->g_bss_cache_ctrl);
+#endif
+               err = __wl_cfg80211_down(cfg);
+               mutex_unlock(&cfg->usr_sync);
+       }
+
+       return err;
+}
+
+void
+wl_cfg80211_sta_ifdown(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       WL_DBG(("In\n"));
+
+       if (cfg) {
+               /* cancel scan if anything pending */
+               wl_cfg80211_cancel_scan(cfg);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+               if ((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION) &&
+                       wl_get_drv_status(cfg, CONNECTED, dev)) {
+                       CFG80211_DISCONNECTED(dev, 0, NULL, 0, false, GFP_KERNEL);
+               }
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)) */
+       }
+}
+
+void *wl_read_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 item)
+{
+       unsigned long flags;
+       void *rptr = NULL;
+       struct wl_profile *profile = wl_get_profile_by_netdev(cfg, ndev);
+
+       if (!profile)
+               return NULL;
+       WL_CFG_DRV_LOCK(&cfg->cfgdrv_lock, flags);
+       switch (item) {
+       case WL_PROF_SEC:
+               rptr = &profile->sec;
+               break;
+       case WL_PROF_ACT:
+               rptr = &profile->active;
+               break;
+       case WL_PROF_BSSID:
+               rptr = profile->bssid;
+               break;
+       case WL_PROF_SSID:
+               rptr = &profile->ssid;
+               break;
+       case WL_PROF_CHAN:
+               rptr = &profile->channel;
+               break;
+       case WL_PROF_LATEST_BSSID:
+               rptr = profile->latest_bssid;
+               break;
+       }
+       WL_CFG_DRV_UNLOCK(&cfg->cfgdrv_lock, flags);
+       if (!rptr)
+               WL_ERR(("invalid item (%d)\n", item));
+       return rptr;
+}
+
+static s32
+wl_update_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, const void *data, s32 item)
+{
+       s32 err = 0;
+       const struct wlc_ssid *ssid;
+       unsigned long flags;
+       struct wl_profile *profile = wl_get_profile_by_netdev(cfg, ndev);
+
+       if (!profile)
+               return WL_INVALID;
+       WL_CFG_DRV_LOCK(&cfg->cfgdrv_lock, flags);
+       switch (item) {
+       case WL_PROF_SSID:
+               ssid = (const wlc_ssid_t *) data;
+               bzero(profile->ssid.SSID,
+                       sizeof(profile->ssid.SSID));
+               profile->ssid.SSID_len = MIN(ssid->SSID_len, DOT11_MAX_SSID_LEN);
+               memcpy(profile->ssid.SSID, ssid->SSID, profile->ssid.SSID_len);
+               break;
+       case WL_PROF_BSSID:
+               if (data)
+                       memcpy(profile->bssid, data, ETHER_ADDR_LEN);
+               else
+                       bzero(profile->bssid, ETHER_ADDR_LEN);
+               break;
+       case WL_PROF_SEC:
+               memcpy(&profile->sec, data, sizeof(profile->sec));
+               break;
+       case WL_PROF_ACT:
+               profile->active = *(const bool *)data;
+               break;
+       case WL_PROF_BEACONINT:
+               profile->beacon_interval = *(const u16 *)data;
+               break;
+       case WL_PROF_DTIMPERIOD:
+               profile->dtim_period = *(const u8 *)data;
+               break;
+       case WL_PROF_CHAN:
+               profile->channel = *(const chanspec_t *)data;
+               break;
+       case WL_PROF_LATEST_BSSID:
+               if (data) {
+                       memcpy_s(profile->latest_bssid, sizeof(profile->latest_bssid),
+                                       data, ETHER_ADDR_LEN);
+               } else {
+                       memset_s(profile->latest_bssid, sizeof(profile->latest_bssid),
+                                       0, ETHER_ADDR_LEN);
+               }
+               break;
+       default:
+               err = -EOPNOTSUPP;
+               break;
+       }
+       WL_CFG_DRV_UNLOCK(&cfg->cfgdrv_lock, flags);
+
+       if (err == -EOPNOTSUPP)
+               WL_ERR(("unsupported item (%d)\n", item));
+
+       return err;
+}
+
+void wl_cfg80211_dbg_level(u32 level)
+{
+       /*
+       * prohibit to change debug level
+       * by insmod parameter.
+       * eventually debug level will be configured
+       * in compile time by using CONFIG_XXX
+       */
+       /* wl_dbg_level = level; */
+}
+
+static bool wl_is_ibssmode(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       return wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_IBSS;
+}
+
+static __used bool wl_is_ibssstarter(struct bcm_cfg80211 *cfg)
+{
+       return cfg->ibss_starter;
+}
+
+static __used s32 wl_add_ie(struct bcm_cfg80211 *cfg, u8 t, u8 l, u8 *v)
+{
+       struct wl_ie *ie = wl_to_ie(cfg);
+       s32 err = 0;
+
+       if (unlikely(ie->offset + l + 2 > WL_TLV_INFO_MAX)) {
+               WL_ERR(("ei crosses buffer boundary\n"));
+               return -ENOSPC;
+       }
+       ie->buf[ie->offset] = t;
+       ie->buf[ie->offset + 1] = l;
+       memcpy(&ie->buf[ie->offset + 2], v, l);
+       ie->offset += l + 2;
+
+       return err;
+}
+
+static void wl_link_up(struct bcm_cfg80211 *cfg)
+{
+       cfg->link_up = true;
+}
+
+static void wl_link_down(struct bcm_cfg80211 *cfg)
+{
+       struct wl_connect_info *conn_info = wl_to_conn(cfg);
+
+       WL_DBG(("In\n"));
+       cfg->link_up = false;
+       if (conn_info) {
+               conn_info->req_ie_len = 0;
+               conn_info->resp_ie_len = 0;
+       }
+}
+
+static unsigned long wl_lock_eq(struct bcm_cfg80211 *cfg)
+{
+       unsigned long flags;
+
+       WL_CFG_EQ_LOCK(&cfg->eq_lock, flags);
+       return flags;
+}
+
+static void wl_unlock_eq(struct bcm_cfg80211 *cfg, unsigned long flags)
+{
+       WL_CFG_EQ_UNLOCK(&cfg->eq_lock, flags);
+}
+
+static void wl_init_eq_lock(struct bcm_cfg80211 *cfg)
+{
+       spin_lock_init(&cfg->eq_lock);
+}
+
+static void wl_delay(u32 ms)
+{
+       if (in_atomic() || (ms < jiffies_to_msecs(1))) {
+               OSL_DELAY(ms*1000);
+       } else {
+               OSL_SLEEP(ms);
+       }
+}
+
+s32 wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+       struct ether_addr primary_mac;
+       if (!cfg->p2p)
+               return -1;
+       if (!p2p_is_on(cfg)) {
+               get_primary_mac(cfg, &primary_mac);
+               memcpy((void *)&p2pdev_addr, (void *)&primary_mac, ETHER_ADDR_LEN);
+       } else {
+               memcpy(p2pdev_addr->octet, wl_to_p2p_bss_macaddr(cfg, P2PAPI_BSSCFG_DEVICE).octet,
+                       ETHER_ADDR_LEN);
+       }
+
+       return 0;
+}
+s32 wl_cfg80211_set_p2p_noa(struct net_device *net, char* buf, int len)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+
+       return wl_cfgp2p_set_p2p_noa(cfg, net, buf, len);
+}
+
+s32 wl_cfg80211_get_p2p_noa(struct net_device *net, char* buf, int len)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+
+       return wl_cfgp2p_get_p2p_noa(cfg, net, buf, len);
+}
+
+s32 wl_cfg80211_set_p2p_ps(struct net_device *net, char* buf, int len)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+
+       return wl_cfgp2p_set_p2p_ps(cfg, net, buf, len);
+}
+
+s32 wl_cfg80211_set_p2p_ecsa(struct net_device *net, char* buf, int len)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+
+       return wl_cfgp2p_set_p2p_ecsa(cfg, net, buf, len);
+}
+
+s32 wl_cfg80211_increase_p2p_bw(struct net_device *net, char* buf, int len)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+
+       return wl_cfgp2p_increase_p2p_bw(cfg, net, buf, len);
+}
+
+#ifdef P2PLISTEN_AP_SAMECHN
+s32 wl_cfg80211_set_p2p_resp_ap_chn(struct net_device *net, s32 enable)
+{
+       s32 ret = wldev_iovar_setint(net, "p2p_resp_ap_chn", enable);
+
+       if ((ret == 0) && enable) {
+               /* disable PM for p2p responding on infra AP channel */
+               s32 pm = PM_OFF;
+
+               ret = wldev_ioctl_set(net, WLC_SET_PM, &pm, sizeof(pm));
+       }
+
+       return ret;
+}
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+#ifdef WLTDLS
+s32
+wl_tdls_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data) {
+
+       struct net_device *ndev = NULL;
+       u32 reason = ntoh32(e->reason);
+       s8 *msg = NULL;
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       switch (reason) {
+       case WLC_E_TDLS_PEER_DISCOVERED :
+               msg = " TDLS PEER DISCOVERD ";
+               break;
+       case WLC_E_TDLS_PEER_CONNECTED :
+               if (cfg->tdls_mgmt_frame) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+                       cfg80211_rx_mgmt(cfgdev, cfg->tdls_mgmt_freq, 0,
+                                       cfg->tdls_mgmt_frame, cfg->tdls_mgmt_frame_len, 0);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0))
+                       cfg80211_rx_mgmt(cfgdev, cfg->tdls_mgmt_freq, 0,
+                                       cfg->tdls_mgmt_frame, cfg->tdls_mgmt_frame_len, 0,
+                                       GFP_ATOMIC);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || \
+                       defined(WL_COMPAT_WIRELESS)
+                       cfg80211_rx_mgmt(cfgdev, cfg->tdls_mgmt_freq, 0,
+                                       cfg->tdls_mgmt_frame, cfg->tdls_mgmt_frame_len,
+                                       GFP_ATOMIC);
+#else
+                       cfg80211_rx_mgmt(cfgdev, cfg->tdls_mgmt_freq,
+                                       cfg->tdls_mgmt_frame, cfg->tdls_mgmt_frame_len, GFP_ATOMIC);
+
+#endif /* LINUX_VERSION >= VERSION(3, 18,0) || WL_COMPAT_WIRELESS */
+               }
+               msg = " TDLS PEER CONNECTED ";
+#ifdef SUPPORT_SET_CAC
+               /* TDLS connect reset CAC */
+               wl_cfg80211_set_cac(cfg, 0);
+#endif /* SUPPORT_SET_CAC */
+               break;
+       case WLC_E_TDLS_PEER_DISCONNECTED :
+               if (cfg->tdls_mgmt_frame) {
+                       MFREE(cfg->osh, cfg->tdls_mgmt_frame, cfg->tdls_mgmt_frame_len);
+                       cfg->tdls_mgmt_frame_len = 0;
+                       cfg->tdls_mgmt_freq = 0;
+               }
+               msg = "TDLS PEER DISCONNECTED ";
+#ifdef SUPPORT_SET_CAC
+               /* TDLS disconnec, set CAC */
+               wl_cfg80211_set_cac(cfg, 1);
+#endif /* SUPPORT_SET_CAC */
+               break;
+       }
+       if (msg) {
+               WL_ERR(("%s: " MACDBG " on %s ndev\n", msg, MAC2STRDBG((const u8*)(&e->addr)),
+                       (bcmcfg_to_prmry_ndev(cfg) == ndev) ? "primary" : "secondary"));
+       }
+       return 0;
+
+}
+
+#endif  /* WLTDLS */
+
+static s32
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)
+#if (defined(CONFIG_ARCH_MSM) && defined(TDLS_MGMT_VERSION2)) || (LINUX_VERSION_CODE < \
+       KERNEL_VERSION(3, 16, 0) && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0))
+wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+       u32 peer_capability, const u8 *buf, size_t len)
+#elif ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0)) && \
+               (LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0)))
+wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       const u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+       u32 peer_capability, const u8 *buf, size_t len)
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       const u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+       u32 peer_capability, bool initiator, const u8 *buf, size_t len)
+#else /* CONFIG_ARCH_MSM && TDLS_MGMT_VERSION2 */
+wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+       const u8 *buf, size_t len)
+#endif /* CONFIG_ARCH_MSM && TDLS_MGMT_VERSION2 */
+{
+       s32 ret = 0;
+#if defined(TDLS_MSG_ONLY_WFD) && defined(WLTDLS)
+       struct bcm_cfg80211 *cfg;
+       tdls_wfd_ie_iovar_t info;
+       bzero(&info, sizeof(info));
+       cfg = wl_get_cfg(dev);
+
+#if defined(CONFIG_ARCH_MSM) && defined(TDLS_MGMT_VERSION2)
+       /* Some customer platform back ported this feature from kernel 3.15 to kernel 3.10
+        * and that cuases build error
+        */
+       BCM_REFERENCE(peer_capability);
+#endif  /* CONFIG_ARCH_MSM && TDLS_MGMT_VERSION2 */
+
+       switch (action_code) {
+               /* We need to set TDLS Wifi Display IE to firmware
+                * using tdls_wfd_ie iovar
+                */
+               case WLAN_TDLS_SET_PROBE_WFD_IE:
+                       WL_ERR(("wl_cfg80211_tdls_mgmt: WLAN_TDLS_SET_PROBE_WFD_IE\n"));
+                       info.mode = TDLS_WFD_PROBE_IE_TX;
+
+                       if (len > sizeof(info.data)) {
+                               return -EINVAL;
+                       }
+                       memcpy(&info.data, buf, len);
+                       info.length = len;
+                       break;
+               case WLAN_TDLS_SET_SETUP_WFD_IE:
+                       WL_ERR(("wl_cfg80211_tdls_mgmt: WLAN_TDLS_SET_SETUP_WFD_IE\n"));
+                       info.mode = TDLS_WFD_IE_TX;
+
+                       if (len > sizeof(info.data)) {
+                               return -EINVAL;
+                       }
+                       memcpy(&info.data, buf, len);
+                       info.length = len;
+                       break;
+               case WLAN_TDLS_SET_WFD_ENABLED:
+                       WL_ERR(("wl_cfg80211_tdls_mgmt: WLAN_TDLS_SET_MODE_WFD_ENABLED\n"));
+                       dhd_tdls_set_mode((dhd_pub_t *)(cfg->pub), true);
+                       goto out;
+               case WLAN_TDLS_SET_WFD_DISABLED:
+                       WL_ERR(("wl_cfg80211_tdls_mgmt: WLAN_TDLS_SET_MODE_WFD_DISABLED\n"));
+                       dhd_tdls_set_mode((dhd_pub_t *)(cfg->pub), false);
+                       goto out;
+               default:
+                       WL_ERR(("Unsupported action code : %d\n", action_code));
+                       goto out;
+       }
+       ret = wldev_iovar_setbuf(dev, "tdls_wfd_ie", &info, sizeof(info),
+                       cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+
+       if (ret) {
+               WL_ERR(("tdls_wfd_ie error %d\n", ret));
+       }
+
+out:
+#endif /* TDLS_MSG_ONLY_WFD && WLTDLS */
+       return ret;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+static s32
+wl_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+       const u8 *peer, enum nl80211_tdls_operation oper)
+#else
+static s32
+wl_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+       u8 *peer, enum nl80211_tdls_operation oper)
+#endif
+{
+       s32 ret = 0;
+#ifdef WLTDLS
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       tdls_iovar_t info;
+       dhd_pub_t *dhdp;
+       bool tdls_auto_mode = false;
+       dhdp = (dhd_pub_t *)(cfg->pub);
+       bzero(&info, sizeof(tdls_iovar_t));
+       if (peer) {
+               memcpy(&info.ea, peer, ETHER_ADDR_LEN);
+       } else {
+               return -1;
+       }
+       switch (oper) {
+       case NL80211_TDLS_DISCOVERY_REQ:
+               /* If the discovery request is broadcast then we need to set
+                * info.mode to Tunneled Probe Request
+                */
+               if (memcmp(peer, (const uint8 *)BSSID_BROADCAST, ETHER_ADDR_LEN) == 0) {
+                       info.mode = TDLS_MANUAL_EP_WFD_TPQ;
+                       WL_ERR(("wl_cfg80211_tdls_oper: TDLS TUNNELED PRBOBE REQUEST\n"));
+               } else {
+                       info.mode = TDLS_MANUAL_EP_DISCOVERY;
+               }
+               break;
+       case NL80211_TDLS_SETUP:
+               if (dhdp->tdls_mode == true) {
+                       info.mode = TDLS_MANUAL_EP_CREATE;
+                       tdls_auto_mode = false;
+                       /* Do tear down and create a fresh one */
+                       ret = wl_cfg80211_tdls_config(cfg, TDLS_STATE_TEARDOWN, tdls_auto_mode);
+                       if (ret < 0) {
+                               return ret;
+                       }
+               } else {
+                       tdls_auto_mode = true;
+               }
+               break;
+       case NL80211_TDLS_TEARDOWN:
+               info.mode = TDLS_MANUAL_EP_DELETE;
+               break;
+       default:
+               WL_ERR(("Unsupported operation : %d\n", oper));
+               goto out;
+       }
+       /* turn on TDLS */
+       ret = wl_cfg80211_tdls_config(cfg, TDLS_STATE_SETUP, tdls_auto_mode);
+       if (ret < 0) {
+               return ret;
+       }
+       if (info.mode) {
+               ret = wldev_iovar_setbuf(dev, "tdls_endpoint", &info, sizeof(info),
+                       cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+               if (ret) {
+                       WL_ERR(("tdls_endpoint error %d\n", ret));
+               }
+       }
+out:
+       /* use linux generic error code instead of firmware error code */
+       if (ret) {
+               wl_flush_fw_log_buffer(dev, FW_LOGSET_MASK_ALL);
+               return -ENOTSUPP;
+       }
+#endif /* WLTDLS */
+       return ret;
+}
+#endif /* LINUX_VERSION > VERSION(3,2,0) || WL_COMPAT_WIRELESS */
+
+s32 wl_cfg80211_set_wps_p2p_ie(struct net_device *ndev, char *buf, int len,
+       enum wl_management_type type)
+{
+       struct bcm_cfg80211 *cfg;
+       s32 ret = 0;
+       s32 bssidx = 0;
+       s32 pktflag = 0;
+       cfg = wl_get_cfg(ndev);
+
+       if (wl_get_drv_status(cfg, AP_CREATING, ndev)) {
+               /* Vendor IEs should be set to FW
+                * after SoftAP interface is brought up
+                */
+               WL_DBG(("Skipping set IE since AP is not up \n"));
+               goto exit;
+       } else  if (ndev == bcmcfg_to_prmry_ndev(cfg)) {
+               /* Either stand alone AP case or P2P discovery */
+               if (wl_get_drv_status(cfg, AP_CREATED, ndev)) {
+                       /* Stand alone AP case on primary interface */
+                       WL_DBG(("Apply IEs for Primary AP Interface \n"));
+                       bssidx = 0;
+               } else {
+                       if (!cfg->p2p) {
+                               /* If p2p not initialized, return failure */
+                               WL_ERR(("P2P not initialized \n"));
+                               goto exit;
+                       }
+                       /* P2P Discovery case (p2p listen) */
+                       if (!cfg->p2p->on) {
+                               /* Turn on Discovery interface */
+                               p2p_on(cfg) = true;
+                               ret = wl_cfgp2p_enable_discovery(cfg, ndev, NULL, 0);
+                               if (unlikely(ret)) {
+                                       WL_ERR(("Enable discovery failed \n"));
+                                       goto exit;
+                               }
+                       }
+                       WL_DBG(("Apply IEs for P2P Discovery Iface \n"));
+                       ndev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY);
+                       bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+               }
+       } else {
+               /* Virtual AP/ P2P Group Interface */
+               WL_DBG(("Apply IEs for iface:%s\n", ndev->name));
+               bssidx = wl_get_bssidx_by_wdev(cfg, ndev->ieee80211_ptr);
+       }
+
+       if (ndev != NULL) {
+               switch (type) {
+                       case WL_BEACON:
+                               pktflag = VNDR_IE_BEACON_FLAG;
+                               break;
+                       case WL_PROBE_RESP:
+                               pktflag = VNDR_IE_PRBRSP_FLAG;
+                               break;
+                       case WL_ASSOC_RESP:
+                               pktflag = VNDR_IE_ASSOCRSP_FLAG;
+                               break;
+               }
+               if (pktflag) {
+                       ret = wl_cfg80211_set_mgmt_vndr_ies(cfg,
+                               ndev_to_cfgdev(ndev), bssidx, pktflag, buf, len);
+               }
+       }
+exit:
+       return ret;
+}
+
+#ifdef WL_SUPPORT_AUTO_CHANNEL
+static s32
+wl_cfg80211_set_auto_channel_scan_state(struct net_device *ndev)
+{
+       u32 val = 0;
+       s32 ret = BCME_ERROR;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       /* Set interface up, explicitly. */
+       val = 1;
+
+       ret = wldev_ioctl_set(ndev, WLC_UP, (void *)&val, sizeof(val));
+       if (ret < 0) {
+               WL_ERR(("set interface up failed, error = %d\n", ret));
+               goto done;
+       }
+
+       /* Stop all scan explicitly, till auto channel selection complete. */
+       wl_set_drv_status(cfg, SCANNING, ndev);
+       if (cfg->escan_info.ndev == NULL) {
+               ret = BCME_OK;
+               goto done;
+       }
+
+       wl_cfg80211_cancel_scan(cfg);
+
+done:
+       return ret;
+}
+
+static bool
+wl_cfg80211_valid_channel_p2p(int channel)
+{
+       bool valid = false;
+
+       /* channel 1 to 14 */
+       if ((channel >= 1) && (channel <= 14)) {
+               valid = true;
+       }
+       /* channel 36 to 48 */
+       else if ((channel >= 36) && (channel <= 48)) {
+               valid = true;
+       }
+       /* channel 149 to 161 */
+       else if ((channel >= 149) && (channel <= 161)) {
+               valid = true;
+       }
+       else {
+               valid = false;
+               WL_INFORM(("invalid P2P chanspec, channel = %d\n", channel));
+       }
+
+       return valid;
+}
+
+s32
+wl_cfg80211_get_chanspecs_2g(struct net_device *ndev, void *buf, s32 buflen)
+{
+       s32 ret = BCME_ERROR;
+       struct bcm_cfg80211 *cfg = NULL;
+       chanspec_t chanspec = 0;
+
+       cfg = wl_get_cfg(ndev);
+
+       /* Restrict channels to 2.4GHz, 20MHz BW, no SB. */
+       chanspec |= (WL_CHANSPEC_BAND_2G | WL_CHANSPEC_BW_20 |
+               WL_CHANSPEC_CTL_SB_NONE);
+       chanspec = wl_chspec_host_to_driver(chanspec);
+
+       ret = wldev_iovar_getbuf_bsscfg(ndev, "chanspecs", (void *)&chanspec,
+               sizeof(chanspec), buf, buflen, 0, &cfg->ioctl_buf_sync);
+       if (ret < 0) {
+               WL_ERR(("get 'chanspecs' failed, error = %d\n", ret));
+       }
+
+       return ret;
+}
+
+s32
+wl_cfg80211_get_chanspecs_5g(struct net_device *ndev, void *buf, s32 buflen)
+{
+       u32 channel = 0;
+       s32 ret = BCME_ERROR;
+       s32 i = 0;
+       s32 j = 0;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       wl_uint32_list_t *list = NULL;
+       chanspec_t chanspec = 0;
+
+       /* Restrict channels to 5GHz, 20MHz BW, no SB. */
+       chanspec |= (WL_CHANSPEC_BAND_5G | WL_CHANSPEC_BW_20 |
+               WL_CHANSPEC_CTL_SB_NONE);
+       chanspec = wl_chspec_host_to_driver(chanspec);
+
+       ret = wldev_iovar_getbuf_bsscfg(ndev, "chanspecs", (void *)&chanspec,
+               sizeof(chanspec), buf, buflen, 0, &cfg->ioctl_buf_sync);
+       if (ret < 0) {
+               WL_ERR(("get 'chanspecs' failed, error = %d\n", ret));
+               goto done;
+       }
+
+       list = (wl_uint32_list_t *)buf;
+       /* Skip DFS and inavlid P2P channel. */
+       for (i = 0, j = 0; i < dtoh32(list->count); i++) {
+               chanspec = (chanspec_t) dtoh32(list->element[i]);
+               channel = CHSPEC_CHANNEL(chanspec);
+
+               ret = wldev_iovar_getint(ndev, "per_chan_info", &channel);
+               if (ret < 0) {
+                       WL_ERR(("get 'per_chan_info' failed, error = %d\n", ret));
+                       goto done;
+               }
+
+               if (CHANNEL_IS_RADAR(channel) ||
+                       !(wl_cfg80211_valid_channel_p2p(CHSPEC_CHANNEL(chanspec)))) {
+                       continue;
+               } else {
+                       list->element[j] = list->element[i];
+               }
+
+               j++;
+       }
+
+       list->count = j;
+
+done:
+       return ret;
+}
+
+static s32
+wl_cfg80211_get_best_channel(struct net_device *ndev, void *buf, int buflen,
+       int *channel)
+{
+       s32 ret = BCME_ERROR;
+       int chosen = 0;
+       int retry = 0;
+       uint chip;
+
+       /* Start auto channel selection scan. */
+       ret = wldev_ioctl_set(ndev, WLC_START_CHANNEL_SEL, buf, buflen);
+       if (ret < 0) {
+               WL_ERR(("can't start auto channel scan, error = %d\n", ret));
+               *channel = 0;
+               goto done;
+       }
+
+       /* Wait for auto channel selection, worst case possible delay is 5250ms. */
+       retry = CHAN_SEL_RETRY_COUNT;
+
+       while (retry--) {
+               OSL_SLEEP(CHAN_SEL_IOCTL_DELAY);
+               chosen = 0;
+               ret = wldev_ioctl_get(ndev, WLC_GET_CHANNEL_SEL, &chosen, sizeof(chosen));
+               if ((ret == 0) && (dtoh32(chosen) != 0)) {
+                       chip = dhd_conf_get_chip(dhd_get_pub(ndev));
+                       if (chip != BCM43362_CHIP_ID && chip != BCM4330_CHIP_ID &&
+                                       chip != BCM43143_CHIP_ID) {
+                               u32 chanspec = 0;
+                               int ctl_chan;
+                               chanspec = wl_chspec_driver_to_host(chosen);
+                               WL_INFORM(("selected chanspec = 0x%x\n", chanspec));
+                               ctl_chan = wf_chspec_ctlchan(chanspec);
+                               WL_INFORM(("selected ctl_chan = %d\n", ctl_chan));
+                               *channel = (u16)(ctl_chan & 0x00FF);
+                       } else
+                               *channel = (u16)(chosen & 0x00FF);
+                       WL_INFORM(("selected channel = %d\n", *channel));
+                       break;
+               }
+               WL_INFORM(("attempt = %d, ret = %d, chosen = %d\n",
+                       (CHAN_SEL_RETRY_COUNT - retry), ret, dtoh32(chosen)));
+       }
+
+       if (retry <= 0) {
+               WL_ERR(("failure, auto channel selection timed out\n"));
+               *channel = 0;
+               ret = BCME_ERROR;
+       }
+       WL_INFORM(("selected channel = %d\n", *channel));
+
+done:
+       return ret;
+}
+
+static s32
+wl_cfg80211_restore_auto_channel_scan_state(struct net_device *ndev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       /* Clear scan stop driver status. */
+       wl_clr_drv_status(cfg, SCANNING, ndev);
+
+       return BCME_OK;
+}
+
+s32
+wl_cfg80211_get_best_channels(struct net_device *dev, char* cmd, int total_len)
+{
+       int channel = 0, band, band_cur;
+       s32 ret = BCME_ERROR;
+       u8 *buf = NULL;
+       char *pos = cmd;
+       struct bcm_cfg80211 *cfg = NULL;
+       struct net_device *ndev = NULL;
+
+       bzero(cmd, total_len);
+       cfg = wl_get_cfg(dev);
+
+       buf = (u8 *)MALLOC(cfg->osh, CHANSPEC_BUF_SIZE);
+       if (buf == NULL) {
+               WL_ERR(("failed to allocate chanspec buffer\n"));
+               return -ENOMEM;
+       }
+
+       /*
+        * Always use primary interface, irrespective of interface on which
+        * command came.
+        */
+       ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       /*
+        * Make sure that FW and driver are in right state to do auto channel
+        * selection scan.
+        */
+       ret = wl_cfg80211_set_auto_channel_scan_state(ndev);
+       if (ret < 0) {
+               WL_ERR(("can't set auto channel scan state, error = %d\n", ret));
+               goto done;
+       }
+
+       ret = wldev_ioctl(dev, WLC_GET_BAND, &band_cur, sizeof(band_cur), false);
+       if (band_cur != WLC_BAND_5G) {
+               /* Best channel selection in 2.4GHz band. */
+               ret = wl_cfg80211_get_chanspecs_2g(ndev, (void *)buf, CHANSPEC_BUF_SIZE);
+               if (ret < 0) {
+                       WL_ERR(("can't get chanspecs in 2.4GHz, error = %d\n", ret));
+                       goto done;
+               }
+
+               ret = wl_cfg80211_get_best_channel(ndev, (void *)buf, CHANSPEC_BUF_SIZE,
+                       &channel);
+               if (ret < 0) {
+                       WL_ERR(("can't select best channel scan in 2.4GHz, error = %d\n", ret));
+                       goto done;
+               }
+
+               if (CHANNEL_IS_2G(channel)) {
+//                     channel = ieee80211_channel_to_frequency(channel, IEEE80211_BAND_2GHZ);
+               } else {
+                       WL_ERR(("invalid 2.4GHz channel, channel = %d\n", channel));
+                       channel = 0;
+               }
+               pos += snprintf(pos, total_len, "2g=%d ", channel);
+       }
+
+       if (band_cur != WLC_BAND_2G) {
+               // terence 20140120: fix for some chipsets only return 2.4GHz channel (4330b2/43341b0/4339a0)
+               band = band_cur==WLC_BAND_2G ? band_cur : WLC_BAND_5G;
+               ret = wldev_ioctl(dev, WLC_SET_BAND, &band, sizeof(band), true);
+               if (ret < 0) {
+                       WL_ERR(("WLC_SET_BAND error %d\n", ret));
+                       goto done;
+               }
+
+               /* Best channel selection in 5GHz band. */
+               ret = wl_cfg80211_get_chanspecs_5g(ndev, (void *)buf, CHANSPEC_BUF_SIZE);
+               if (ret < 0) {
+                       WL_ERR(("can't get chanspecs in 5GHz, error = %d\n", ret));
+                       goto done;
+               }
+
+               ret = wl_cfg80211_get_best_channel(ndev, (void *)buf, CHANSPEC_BUF_SIZE,
+                       &channel);
+               if (ret < 0) {
+                       WL_ERR(("can't select best channel scan in 5GHz, error = %d\n", ret));
+                       goto done;
+               }
+
+               if (CHANNEL_IS_5G(channel)) {
+//                     channel = ieee80211_channel_to_frequency(channel, IEEE80211_BAND_5GHZ);
+               } else {
+                       WL_ERR(("invalid 5GHz channel, channel = %d\n", channel));
+                       channel = 0;
+               }
+
+               ret = wldev_ioctl(dev, WLC_SET_BAND, &band_cur, sizeof(band_cur), true);
+               if (ret < 0)
+                       WL_ERR(("WLC_SET_BAND error %d\n", ret));
+               pos += snprintf(pos, total_len, "5g=%d ", channel);
+       }
+
+done:
+       if (NULL != buf) {
+               MFREE(cfg->osh, buf, CHANSPEC_BUF_SIZE);
+       }
+
+       /* Restore FW and driver back to normal state. */
+       ret = wl_cfg80211_restore_auto_channel_scan_state(ndev);
+       if (ret < 0) {
+               WL_ERR(("can't restore auto channel scan state, error = %d\n", ret));
+       }
+
+       WL_MSG(ndev->name, "%s\n", cmd);
+
+       return (pos - cmd);
+}
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+
+static const struct rfkill_ops wl_rfkill_ops = {
+       .set_block = wl_rfkill_set
+};
+
+static int wl_rfkill_set(void *data, bool blocked)
+{
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)data;
+
+       WL_DBG(("Enter \n"));
+       WL_DBG(("RF %s\n", blocked ? "blocked" : "unblocked"));
+
+       if (!cfg)
+               return -EINVAL;
+
+       cfg->rf_blocked = blocked;
+
+       return 0;
+}
+
+static int wl_setup_rfkill(struct bcm_cfg80211 *cfg, bool setup)
+{
+       s32 err = 0;
+
+       WL_DBG(("Enter \n"));
+       if (!cfg)
+               return -EINVAL;
+       if (setup) {
+               cfg->rfkill = rfkill_alloc("brcmfmac-wifi",
+                       wl_cfg80211_get_parent_dev(),
+                       RFKILL_TYPE_WLAN, &wl_rfkill_ops, (void *)cfg);
+
+               if (!cfg->rfkill) {
+                       err = -ENOMEM;
+                       goto err_out;
+               }
+
+               err = rfkill_register(cfg->rfkill);
+
+               if (err)
+                       rfkill_destroy(cfg->rfkill);
+       } else {
+               if (!cfg->rfkill) {
+                       err = -ENOMEM;
+                       goto err_out;
+               }
+
+               rfkill_unregister(cfg->rfkill);
+               rfkill_destroy(cfg->rfkill);
+       }
+
+err_out:
+       return err;
+}
+
+#ifdef DEBUGFS_CFG80211
+/**
+* Format : echo "SCAN:1 DBG:1" > /sys/kernel/debug/dhd/debug_level
+* to turn on SCAN and DBG log.
+* To turn off SCAN partially, echo "SCAN:0" > /sys/kernel/debug/dhd/debug_level
+* To see current setting of debug level,
+* cat /sys/kernel/debug/dhd/debug_level
+*/
+static ssize_t
+wl_debuglevel_write(struct file *file, const char __user *userbuf,
+       size_t count, loff_t *ppos)
+{
+       char tbuf[SUBLOGLEVELZ * ARRAYSIZE(sublogname_map)], sublog[SUBLOGLEVELZ];
+       char *params, *token, *colon;
+       uint i, tokens, log_on = 0;
+       size_t minsize = min_t(size_t, (sizeof(tbuf) - 1), count);
+
+       bzero(tbuf, sizeof(tbuf));
+       bzero(sublog, sizeof(sublog));
+       if (copy_from_user(&tbuf, userbuf, minsize)) {
+               return -EFAULT;
+       }
+
+       tbuf[minsize] = '\0';
+       params = &tbuf[0];
+       colon = strchr(params, '\n');
+       if (colon != NULL)
+               *colon = '\0';
+       while ((token = strsep(&params, " ")) != NULL) {
+               bzero(sublog, sizeof(sublog));
+               if (token == NULL || !*token)
+                       break;
+               if (*token == '\0')
+                       continue;
+               colon = strchr(token, ':');
+               if (colon != NULL) {
+                       *colon = ' ';
+               }
+               tokens = sscanf(token, "%"S(SUBLOGLEVEL)"s %u", sublog, &log_on);
+               if (colon != NULL)
+                       *colon = ':';
+
+               if (tokens == 2) {
+                               for (i = 0; i < ARRAYSIZE(sublogname_map); i++) {
+                                       if (!strncmp(sublog, sublogname_map[i].sublogname,
+                                               strlen(sublogname_map[i].sublogname))) {
+                                               if (log_on)
+                                                       wl_dbg_level |=
+                                                       (sublogname_map[i].log_level);
+                                               else
+                                                       wl_dbg_level &=
+                                                       ~(sublogname_map[i].log_level);
+                                       }
+                               }
+               } else
+                       WL_ERR(("%s: can't parse '%s' as a "
+                              "SUBMODULE:LEVEL (%d tokens)\n",
+                              tbuf, token, tokens));
+
+       }
+       return count;
+}
+
+static ssize_t
+wl_debuglevel_read(struct file *file, char __user *user_buf,
+       size_t count, loff_t *ppos)
+{
+       char *param;
+       char tbuf[SUBLOGLEVELZ * ARRAYSIZE(sublogname_map)];
+       uint i;
+       bzero(tbuf, sizeof(tbuf));
+       param = &tbuf[0];
+       for (i = 0; i < ARRAYSIZE(sublogname_map); i++) {
+               param += snprintf(param, sizeof(tbuf) - 1, "%s:%d ",
+                       sublogname_map[i].sublogname,
+                       (wl_dbg_level & sublogname_map[i].log_level) ? 1 : 0);
+       }
+       *param = '\n';
+       return simple_read_from_buffer(user_buf, count, ppos, tbuf, strlen(&tbuf[0]));
+
+}
+static const struct file_operations fops_debuglevel = {
+       .open = NULL,
+       .write = wl_debuglevel_write,
+       .read = wl_debuglevel_read,
+       .owner = THIS_MODULE,
+       .llseek = NULL,
+};
+
+static s32 wl_setup_debugfs(struct bcm_cfg80211 *cfg)
+{
+       s32 err = 0;
+       struct dentry *_dentry;
+       if (!cfg)
+               return -EINVAL;
+       cfg->debugfs = debugfs_create_dir(KBUILD_MODNAME, NULL);
+       if (!cfg->debugfs || IS_ERR(cfg->debugfs)) {
+               if (cfg->debugfs == ERR_PTR(-ENODEV))
+                       WL_ERR(("Debugfs is not enabled on this kernel\n"));
+               else
+                       WL_ERR(("Can not create debugfs directory\n"));
+               cfg->debugfs = NULL;
+               goto exit;
+
+       }
+       _dentry = debugfs_create_file("debug_level", S_IRUSR | S_IWUSR,
+               cfg->debugfs, cfg, &fops_debuglevel);
+       if (!_dentry || IS_ERR(_dentry)) {
+               WL_ERR(("failed to create debug_level debug file\n"));
+               wl_free_debugfs(cfg);
+       }
+exit:
+       return err;
+}
+static s32 wl_free_debugfs(struct bcm_cfg80211 *cfg)
+{
+       if (!cfg)
+               return -EINVAL;
+       if (cfg->debugfs)
+               debugfs_remove_recursive(cfg->debugfs);
+       cfg->debugfs = NULL;
+       return 0;
+}
+#endif /* DEBUGFS_CFG80211 */
+
+struct bcm_cfg80211 *wl_cfg80211_get_bcmcfg(void)
+{
+       return g_bcmcfg;
+}
+
+void wl_cfg80211_set_bcmcfg(struct bcm_cfg80211 *cfg)
+{
+       g_bcmcfg = cfg;
+}
+
+struct device *wl_cfg80211_get_parent_dev(void)
+{
+       return cfg80211_parent_dev;
+}
+
+void wl_cfg80211_set_parent_dev(void *dev)
+{
+       cfg80211_parent_dev = dev;
+}
+
+static void wl_cfg80211_clear_parent_dev(void)
+{
+       cfg80211_parent_dev = NULL;
+}
+
+void get_primary_mac(struct bcm_cfg80211 *cfg, struct ether_addr *mac)
+{
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+
+       if (wldev_iovar_getbuf_bsscfg(bcmcfg_to_prmry_ndev(cfg),
+                       "cur_etheraddr", NULL, 0, ioctl_buf, sizeof(ioctl_buf),
+                       0, NULL) == BCME_OK) {
+               memcpy(mac->octet, ioctl_buf, ETHER_ADDR_LEN);
+       } else {
+               bzero(mac->octet, ETHER_ADDR_LEN);
+       }
+}
+static bool check_dev_role_integrity(struct bcm_cfg80211 *cfg, u32 dev_role)
+{
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       if (((dev_role == NL80211_IFTYPE_AP) &&
+               !(dhd->op_mode & DHD_FLAG_HOSTAP_MODE)) ||
+               ((dev_role == NL80211_IFTYPE_P2P_GO) &&
+               !(dhd->op_mode & DHD_FLAG_P2P_GO_MODE)))
+       {
+               WL_ERR(("device role select failed role:%d op_mode:%d \n", dev_role, dhd->op_mode));
+               return false;
+       }
+       return true;
+}
+
+int wl_cfg80211_do_driver_init(struct net_device *net)
+{
+       struct bcm_cfg80211 *cfg = *(struct bcm_cfg80211 **)netdev_priv(net);
+
+       if (!cfg || !cfg->wdev)
+               return -EINVAL;
+
+       if (dhd_do_driver_init(cfg->wdev->netdev) < 0)
+               return -1;
+
+       return 0;
+}
+
+void wl_cfg80211_enable_trace(u32 level)
+{
+       wl_dbg_level = level;
+       WL_MSG("wlan", "wl_dbg_level = 0x%x\n", wl_dbg_level);
+}
+
+#if defined(WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, \
+       2, 0))
+static s32
+wl_cfg80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
+       bcm_struct_cfgdev *cfgdev, u64 cookie)
+{
+       /* CFG80211 checks for tx_cancel_wait callback when ATTR_DURATION
+        * is passed with CMD_FRAME. This callback is supposed to cancel
+        * the OFFCHANNEL Wait. Since we are already taking care of that
+        *  with the tx_mgmt logic, do nothing here.
+        */
+
+       return 0;
+}
+#endif /* WL_SUPPORT_BACKPORTED_PATCHES || KERNEL >= 3.2.0 */
+
+#ifdef WL_HOST_BAND_MGMT
+s32
+wl_cfg80211_set_band(struct net_device *ndev, int band)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       int ret = 0;
+       char ioctl_buf[50];
+
+       if ((band < WLC_BAND_AUTO) || (band > WLC_BAND_2G)) {
+               WL_ERR(("Invalid band\n"));
+               return -EINVAL;
+       }
+
+       if ((ret = wldev_iovar_setbuf(ndev, "roam_band", &band,
+               sizeof(int), ioctl_buf, sizeof(ioctl_buf), NULL)) < 0) {
+               WL_ERR(("seting roam_band failed code=%d\n", ret));
+               return ret;
+       }
+
+       WL_DBG(("Setting band to %d\n", band));
+       cfg->curr_band = band;
+
+       return 0;
+}
+#endif /* WL_HOST_BAND_MGMT */
+
+s32
+wl_cfg80211_set_if_band(struct net_device *ndev, int band)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       int ret = BCME_OK, wait_cnt;
+       char ioctl_buf[32];
+
+       if ((band < WLC_BAND_AUTO) || (band > WLC_BAND_2G)) {
+               WL_ERR(("Invalid band\n"));
+               return -EINVAL;
+       }
+
+       if (cfg->ncho_band == band) {
+               WL_ERR(("Same to Current band %d\n", cfg->ncho_band));
+               return ret;
+       }
+
+       if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+               dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+               BCM_REFERENCE(dhdp);
+               DHD_STATLOG_CTRL(dhdp, ST(DISASSOC_INT_START),
+                       dhd_net2idx(dhdp->info, ndev), 0);
+               ret = wldev_ioctl_set(ndev, WLC_DISASSOC, NULL, 0);
+               if (ret < 0) {
+                       WL_ERR(("WLC_DISASSOC error %d\n", ret));
+                       /* continue to set 'if_band' */
+               }
+               else {
+                       /* This is to ensure that 'if_band' iovar is issued only after
+                       * disconnection is completed
+                       */
+                       wait_cnt = WAIT_FOR_DISCONNECT_MAX;
+                       while (wl_get_drv_status(cfg, CONNECTED, ndev) && wait_cnt) {
+                               WL_DBG(("Wait until disconnected. wait_cnt: %d\n", wait_cnt));
+                               wait_cnt--;
+                               OSL_SLEEP(50);
+                       }
+               }
+       }
+       if ((ret = wldev_iovar_setbuf(ndev, "if_band", &band,
+                       sizeof(int), ioctl_buf, sizeof(ioctl_buf), NULL)) < 0) {
+               WL_ERR(("seting if_band failed ret=%d\n", ret));
+               /* issue 'WLC_SET_BAND' if if_band is not supported */
+               if (ret == BCME_UNSUPPORTED) {
+                       ret = wldev_set_band(ndev, band);
+                       if (ret < 0) {
+                               WL_ERR(("seting band failed ret=%d\n", ret));
+                       }
+               }
+       }
+
+       if (ret == BCME_OK) {
+               cfg->ncho_band = band;
+       }
+       return ret;
+}
+
+s32
+wl_cfg80211_dfs_ap_move(struct net_device *ndev, char *data, char *command, int total_len)
+{
+       char ioctl_buf[WLC_IOCTL_SMLEN];
+       int err = 0;
+       uint32 val = 0;
+       chanspec_t chanspec = 0;
+       int abort;
+       int bytes_written = 0;
+       struct wl_dfs_ap_move_status_v2 *status;
+       char chanbuf[CHANSPEC_STR_LEN];
+       const char *dfs_state_str[DFS_SCAN_S_MAX] = {
+               "Radar Free On Channel",
+               "Radar Found On Channel",
+               "Radar Scan In Progress",
+               "Radar Scan Aborted",
+               "RSDB Mode switch in Progress For Scan"
+       };
+       if (ndev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
+               bytes_written = snprintf(command, total_len, "AP is not up\n");
+               return bytes_written;
+       }
+       if (!*data) {
+               if ((err = wldev_iovar_getbuf(ndev, "dfs_ap_move", NULL, 0,
+                               ioctl_buf, sizeof(ioctl_buf), NULL))) {
+                       WL_ERR(("setting dfs_ap_move failed with err=%d \n", err));
+                       return err;
+               }
+               status = (struct wl_dfs_ap_move_status_v2 *)ioctl_buf;
+
+               if (status->version != WL_DFS_AP_MOVE_VERSION) {
+                       err = BCME_UNSUPPORTED;
+                       WL_ERR(("err=%d version=%d\n", err, status->version));
+                       return err;
+               }
+
+               if (status->move_status != (int8) DFS_SCAN_S_IDLE) {
+                       chanspec = wl_chspec_driver_to_host(status->chanspec);
+                       if (chanspec != 0 && chanspec != INVCHANSPEC) {
+                               wf_chspec_ntoa(chanspec, chanbuf);
+                               bytes_written = snprintf(command, total_len,
+                                       "AP Target Chanspec %s (0x%x)\n", chanbuf, chanspec);
+                       }
+                       bytes_written += snprintf(command + bytes_written,
+                                       total_len - bytes_written,
+                                       "%s\n", dfs_state_str[status->move_status]);
+                       return bytes_written;
+               } else {
+                       bytes_written = snprintf(command, total_len, "dfs AP move in IDLE state\n");
+                       return bytes_written;
+               }
+       }
+
+       abort = bcm_atoi(data);
+       if (abort == -1) {
+               if ((err = wldev_iovar_setbuf(ndev, "dfs_ap_move", &abort,
+                               sizeof(int), ioctl_buf, sizeof(ioctl_buf), NULL)) < 0) {
+                       WL_ERR(("seting dfs_ap_move failed with err %d\n", err));
+                       return err;
+               }
+       } else {
+               chanspec = wf_chspec_aton(data);
+               if (chanspec != 0) {
+                       val = wl_chspec_host_to_driver(chanspec);
+                       if (val != INVCHANSPEC) {
+                               if ((err = wldev_iovar_setbuf(ndev, "dfs_ap_move", &val,
+                                       sizeof(int), ioctl_buf, sizeof(ioctl_buf), NULL)) < 0) {
+                                       WL_ERR(("seting dfs_ap_move failed with err %d\n", err));
+                                       return err;
+                               }
+                               WL_DBG((" set dfs_ap_move successfull"));
+                       } else {
+                               err = BCME_USAGE_ERROR;
+                       }
+               }
+       }
+       return err;
+}
+
+bool wl_cfg80211_is_concurrent_mode(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       if ((cfg) && (wl_get_drv_status_all(cfg, CONNECTED) > 1)) {
+               return true;
+       } else {
+               return false;
+       }
+}
+
+/*
+ * This is to support existing btcoex implementation
+ * btcoex clean up may help removing this function
+ */
+void* wl_cfg80211_get_dhdp(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       return cfg->pub;
+}
+
+bool wl_cfg80211_is_p2p_active(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       return (cfg && cfg->p2p);
+}
+
+bool wl_cfg80211_is_roam_offload(struct net_device * dev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       return (cfg && cfg->roam_offload);
+}
+
+bool wl_cfg80211_is_event_from_connected_bssid(struct net_device * dev, const wl_event_msg_t *e,
+               int ifidx)
+{
+       u8 *curbssid = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       if (!cfg) {
+               /* When interface is created using wl
+                * ndev->ieee80211_ptr will be NULL.
+                */
+               return NULL;
+       }
+       curbssid = wl_read_prof(cfg, dev, WL_PROF_BSSID);
+
+       if (memcmp(curbssid, &e->addr, ETHER_ADDR_LEN) == 0) {
+               return true;
+       }
+       return false;
+}
+
+static void wl_cfg80211_work_handler(struct work_struct * work)
+{
+       struct bcm_cfg80211 *cfg = NULL;
+       struct net_info *iter, *next;
+       s32 err = BCME_OK;
+       s32 pm = PM_FAST;
+       dhd_pub_t *dhd;
+       BCM_SET_CONTAINER_OF(cfg, work, struct bcm_cfg80211, pm_enable_work.work);
+       WL_DBG(("Enter \n"));
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       for_each_ndev(cfg, iter, next) {
+               GCC_DIAGNOSTIC_POP();
+               /* p2p discovery iface ndev could be null */
+               if (iter->ndev) {
+                       if (!wl_get_drv_status(cfg, CONNECTED, iter->ndev) ||
+                               (wl_get_mode_by_netdev(cfg, iter->ndev) != WL_MODE_BSS &&
+                               wl_get_mode_by_netdev(cfg, iter->ndev) != WL_MODE_IBSS))
+                               continue;
+                       if (iter->ndev) {
+                               dhd = (dhd_pub_t *)(cfg->pub);
+                               if (dhd_conf_get_pm(dhd) >= 0)
+                                       pm = dhd_conf_get_pm(dhd);
+                               if ((err = wldev_ioctl_set(iter->ndev, WLC_SET_PM,
+                                               &pm, sizeof(pm))) != 0) {
+                                       if (err == -ENODEV)
+                                               WL_DBG(("%s:netdev not ready\n",
+                                                       iter->ndev->name));
+                                       else
+                                               WL_ERR(("%s:error (%d)\n",
+                                                       iter->ndev->name, err));
+                               } else
+                                       wl_cfg80211_update_power_mode(iter->ndev);
+                       }
+               }
+       }
+
+       DHD_PM_WAKE_UNLOCK(cfg->pub);
+
+}
+
+u8
+wl_get_action_category(void *frame, u32 frame_len)
+{
+       u8 category;
+       u8 *ptr = (u8 *)frame;
+       if (frame == NULL)
+               return DOT11_ACTION_CAT_ERR_MASK;
+       if (frame_len < DOT11_ACTION_HDR_LEN)
+               return DOT11_ACTION_CAT_ERR_MASK;
+       category = ptr[DOT11_ACTION_CAT_OFF];
+       WL_DBG(("Action Category: %d\n", category));
+       return category;
+}
+
+int
+wl_get_public_action(void *frame, u32 frame_len, u8 *ret_action)
+{
+       u8 *ptr = (u8 *)frame;
+       if (frame == NULL || ret_action == NULL)
+               return BCME_ERROR;
+       if (frame_len < DOT11_ACTION_HDR_LEN)
+               return BCME_ERROR;
+       if (DOT11_ACTION_CAT_PUBLIC != wl_get_action_category(frame, frame_len))
+               return BCME_ERROR;
+       *ret_action = ptr[DOT11_ACTION_ACT_OFF];
+       WL_DBG(("Public Action : %d\n", *ret_action));
+       return BCME_OK;
+}
+
+#ifdef WLFBT
+int
+wl_cfg80211_get_fbt_key(struct net_device *dev, uint8 *key, int total_len)
+{
+       struct bcm_cfg80211 * cfg = wl_get_cfg(dev);
+       int bytes_written = -1;
+
+       if (total_len < FBT_KEYLEN) {
+               WL_ERR(("wl_cfg80211_get_fbt_key: Insufficient buffer \n"));
+               goto end;
+       }
+       if (cfg) {
+               memcpy(key, cfg->fbt_key, FBT_KEYLEN);
+               bytes_written = FBT_KEYLEN;
+       } else {
+               bzero(key, FBT_KEYLEN);
+               WL_ERR(("wl_cfg80211_get_fbt_key: Failed to copy KCK and KEK \n"));
+       }
+       prhex("KCK, KEK", (uchar *)key, FBT_KEYLEN);
+end:
+       return bytes_written;
+}
+#endif /* WLFBT */
+
+static int
+wl_cfg80211_delayed_roam(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const struct ether_addr *bssid)
+{
+       s32 err;
+       wl_event_msg_t e;
+
+       bzero(&e, sizeof(e));
+       e.event_type = cpu_to_be32(WLC_E_ROAM);
+       memcpy(&e.addr, bssid, ETHER_ADDR_LEN);
+       /* trigger the roam event handler */
+       err = wl_notify_roaming_status(cfg, ndev_to_cfgdev(ndev), &e, NULL);
+
+       return err;
+}
+
+static bool
+wl_cfg80211_filter_vndr_ext_id(const vndr_ie_t *vndrie)
+{
+       if (vndrie->oui[0] == FILS_EXTID_MNG_HLP_CONTAINER_ID) {
+               /* Skip adding fils HLP IE, its already done using
+                * "WL_FILS_CMD_ADD_HLP_IE" subcmd.
+                */
+               WL_DBG(("%s:SKIP ADDING FILS HLP EXTN ID\n", __func__));
+               return true;
+       }
+       return false;
+}
+
+static s32
+wl_cfg80211_parse_vndr_ies(const u8 *parse, u32 len,
+    struct parsed_vndr_ies *vndr_ies)
+{
+       s32 err = BCME_OK;
+       const vndr_ie_t *vndrie;
+       const bcm_tlv_t *ie;
+       struct parsed_vndr_ie_info *parsed_info;
+       u32 count = 0;
+       u32 remained_len;
+
+       remained_len = len;
+       bzero(vndr_ies, sizeof(*vndr_ies));
+
+       WL_DBG(("---> len %d\n", len));
+       ie = (const bcm_tlv_t *) parse;
+       if (!bcm_valid_tlv(ie, remained_len))
+               ie = NULL;
+       while (ie) {
+               if (count >= MAX_VNDR_IE_NUMBER)
+                       break;
+               if (ie->id == DOT11_MNG_VS_ID || (ie->id == DOT11_MNG_ID_EXT_ID)) {
+                       vndrie = (const vndr_ie_t *) ie;
+                       if (ie->id == DOT11_MNG_ID_EXT_ID) {
+                               /* len should be bigger than sizeof ID extn field at least */
+                               if (vndrie->len < MIN_VENDOR_EXTN_IE_LEN) {
+                                       WL_ERR(("%s: invalid vndr extn ie."
+                                               " length %d\n",
+                                               __FUNCTION__, vndrie->len));
+                                       goto end;
+                               }
+                               if (wl_cfg80211_filter_vndr_ext_id(vndrie)) {
+                                       goto end;
+                               }
+                       } else {
+                               /* len should be bigger than OUI length +
+                                * one data length at least
+                                */
+                               if (vndrie->len < (VNDR_IE_MIN_LEN + 1)) {
+                                       WL_ERR(("wl_cfg80211_parse_vndr_ies:"
+                                               " invalid vndr ie. length is too small %d\n",
+                                               vndrie->len));
+                                       goto end;
+                               }
+
+                               /* if wpa or wme ie, do not add ie */
+                               if (!bcmp(vndrie->oui, (u8*)WPA_OUI, WPA_OUI_LEN) &&
+                                               ((vndrie->data[0] == WPA_OUI_TYPE) ||
+                                               (vndrie->data[0] == WME_OUI_TYPE))) {
+                                       CFGP2P_DBG(("Found WPA/WME oui. Do not add it\n"));
+                                       goto end;
+                               }
+                       }
+
+                       parsed_info = &vndr_ies->ie_info[count++];
+
+                       /* save vndr ie information */
+                       parsed_info->ie_ptr = (const char *)vndrie;
+                       parsed_info->ie_len = (vndrie->len + TLV_HDR_LEN);
+                       memcpy(&parsed_info->vndrie, vndrie, sizeof(vndr_ie_t));
+                       vndr_ies->count = count;
+                       if (ie->id == DOT11_MNG_ID_EXT_ID) {
+                               WL_DBG(("\t ** Vendor Extension ie id: 0x%02x, len:%d\n",
+                                       ie->id, parsed_info->ie_len));
+                       } else {
+                               WL_DBG(("\t ** OUI "MACOUIDBG", type 0x%02x len:%d\n",
+                                       MACOUI2STRDBG(parsed_info->vndrie.oui),
+                                       parsed_info->vndrie.data[0], parsed_info->ie_len));
+                       }
+               }
+end:
+               ie = bcm_next_tlv(ie, &remained_len);
+       }
+       return err;
+}
+
+static bool
+wl_vndr_ies_exclude_vndr_oui(struct parsed_vndr_ie_info *vndr_info)
+{
+       int i = 0;
+
+       while (exclude_vndr_oui_list[i]) {
+               if (!memcmp(vndr_info->vndrie.oui,
+                       exclude_vndr_oui_list[i],
+                       DOT11_OUI_LEN)) {
+                       return TRUE;
+               }
+               i++;
+       }
+
+       return FALSE;
+}
+
+static bool
+wl_vndr_ies_check_duplicate_vndr_oui(struct bcm_cfg80211 *cfg,
+               struct parsed_vndr_ie_info *vndr_info)
+{
+       wl_vndr_oui_entry_t *oui_entry = NULL;
+       unsigned long flags;
+
+       WL_CFG_VNDR_OUI_SYNC_LOCK(&cfg->vndr_oui_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_entry(oui_entry, &cfg->vndr_oui_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (!memcmp(oui_entry->oui, vndr_info->vndrie.oui, DOT11_OUI_LEN)) {
+                       WL_CFG_VNDR_OUI_SYNC_UNLOCK(&cfg->vndr_oui_sync, flags);
+                       return TRUE;
+               }
+       }
+       WL_CFG_VNDR_OUI_SYNC_UNLOCK(&cfg->vndr_oui_sync, flags);
+       return FALSE;
+}
+
+static bool
+wl_vndr_ies_add_vendor_oui_list(struct bcm_cfg80211 *cfg,
+       struct parsed_vndr_ie_info *vndr_info)
+{
+       wl_vndr_oui_entry_t *oui_entry = NULL;
+       unsigned long flags;
+
+       oui_entry = kmalloc(sizeof(*oui_entry), GFP_KERNEL);
+       if (oui_entry == NULL) {
+               WL_ERR(("alloc failed\n"));
+               return FALSE;
+       }
+
+       memcpy(oui_entry->oui, vndr_info->vndrie.oui, DOT11_OUI_LEN);
+
+       INIT_LIST_HEAD(&oui_entry->list);
+       WL_CFG_VNDR_OUI_SYNC_LOCK(&cfg->vndr_oui_sync, flags);
+       list_add_tail(&oui_entry->list, &cfg->vndr_oui_list);
+       WL_CFG_VNDR_OUI_SYNC_UNLOCK(&cfg->vndr_oui_sync, flags);
+
+       return TRUE;
+}
+
+static void
+wl_vndr_ies_clear_vendor_oui_list(struct bcm_cfg80211 *cfg)
+{
+       wl_vndr_oui_entry_t *oui_entry = NULL;
+       unsigned long flags;
+
+       WL_CFG_VNDR_OUI_SYNC_LOCK(&cfg->vndr_oui_sync, flags);
+       while (!list_empty(&cfg->vndr_oui_list)) {
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               oui_entry = list_entry(cfg->vndr_oui_list.next, wl_vndr_oui_entry_t, list);
+               GCC_DIAGNOSTIC_POP();
+               if (oui_entry) {
+                       list_del(&oui_entry->list);
+                       kfree(oui_entry);
+               }
+       }
+       WL_CFG_VNDR_OUI_SYNC_UNLOCK(&cfg->vndr_oui_sync, flags);
+}
+
+static int
+wl_vndr_ies_get_vendor_oui(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       char *vndr_oui, u32 vndr_oui_len)
+{
+       int i;
+       int vndr_oui_num = 0;
+
+       struct wl_connect_info *conn_info = wl_to_conn(cfg);
+       wl_vndr_oui_entry_t *oui_entry = NULL;
+       struct parsed_vndr_ie_info *vndr_info;
+       struct parsed_vndr_ies vndr_ies;
+
+       char *pos = vndr_oui;
+       u32 remained_buf_len = vndr_oui_len;
+       unsigned long flags;
+
+       if (!conn_info->resp_ie_len) {
+               return BCME_ERROR;
+       }
+
+       wl_vndr_ies_clear_vendor_oui_list(cfg);
+
+       if ((wl_cfg80211_parse_vndr_ies((u8 *)conn_info->resp_ie,
+               conn_info->resp_ie_len, &vndr_ies)) == BCME_OK) {
+               for (i = 0; i < vndr_ies.count; i++) {
+                       vndr_info = &vndr_ies.ie_info[i];
+                       if (wl_vndr_ies_exclude_vndr_oui(vndr_info)) {
+                               continue;
+                       }
+
+                       if (wl_vndr_ies_check_duplicate_vndr_oui(cfg, vndr_info)) {
+                               continue;
+                       }
+
+                       wl_vndr_ies_add_vendor_oui_list(cfg, vndr_info);
+                       vndr_oui_num++;
+               }
+       }
+
+       if (vndr_oui) {
+               WL_CFG_VNDR_OUI_SYNC_LOCK(&cfg->vndr_oui_sync, flags);
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               list_for_each_entry(oui_entry, &cfg->vndr_oui_list, list) {
+                       GCC_DIAGNOSTIC_POP();
+                       if (remained_buf_len < VNDR_OUI_STR_LEN) {
+                               WL_CFG_VNDR_OUI_SYNC_UNLOCK(&cfg->vndr_oui_sync, flags);
+                               return BCME_ERROR;
+                       }
+                       pos += snprintf(pos, VNDR_OUI_STR_LEN, "%02X-%02X-%02X ",
+                               oui_entry->oui[0], oui_entry->oui[1], oui_entry->oui[2]);
+                       remained_buf_len -= VNDR_OUI_STR_LEN;
+               }
+               WL_CFG_VNDR_OUI_SYNC_UNLOCK(&cfg->vndr_oui_sync, flags);
+       }
+
+       return vndr_oui_num;
+}
+
+#ifdef WL_ANALYTICS
+static bool
+wl_vndr_ies_find_vendor_oui(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const char *vndr_oui)
+{
+       int i;
+       int vndr_oui_num = 0;
+
+       struct wl_connect_info *conn_info = wl_to_conn(cfg);
+       wl_vndr_oui_entry_t *oui_entry = NULL;
+       struct parsed_vndr_ie_info *vndr_info;
+       struct parsed_vndr_ies vndr_ies;
+
+       unsigned long flags;
+       bool found = FALSE;
+
+       if (!conn_info->resp_ie_len) {
+               return FALSE;
+       }
+
+       wl_vndr_ies_clear_vendor_oui_list(cfg);
+
+       if ((wl_cfg80211_parse_vndr_ies((u8 *)conn_info->resp_ie,
+               conn_info->resp_ie_len, &vndr_ies)) == BCME_OK) {
+               for (i = 0; i < vndr_ies.count; i++) {
+                       vndr_info = &vndr_ies.ie_info[i];
+                       if (wl_vndr_ies_exclude_vndr_oui(vndr_info)) {
+                               continue;
+                       }
+
+                       if (wl_vndr_ies_check_duplicate_vndr_oui(cfg, vndr_info)) {
+                               continue;
+                       }
+
+                       wl_vndr_ies_add_vendor_oui_list(cfg, vndr_info);
+                       vndr_oui_num++;
+               }
+       }
+
+       if (vndr_oui && vndr_oui_num) {
+               WL_CFG_VNDR_OUI_SYNC_LOCK(&cfg->vndr_oui_sync, flags);
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               list_for_each_entry(oui_entry, &cfg->vndr_oui_list, list) {
+                       GCC_DIAGNOSTIC_POP();
+                       if (!memcmp(vndr_oui, oui_entry->oui, DOT11_OUI_LEN)) {
+                               found = TRUE;
+                               break;
+                       }
+               }
+               WL_CFG_VNDR_OUI_SYNC_UNLOCK(&cfg->vndr_oui_sync, flags);
+       }
+
+       return found;
+}
+#endif /* WL_ANALYTICS */
+
+void
+wl_cfg80211_clear_p2p_disc_ies(struct bcm_cfg80211 *cfg)
+{
+       /* Legacy P2P used to store it in primary dev cache */
+       s32 index;
+       struct net_device *ndev;
+       s32 bssidx;
+       s32 ret;
+       s32 vndrie_flag[] = {VNDR_IE_BEACON_FLAG, VNDR_IE_PRBRSP_FLAG,
+               VNDR_IE_ASSOCRSP_FLAG, VNDR_IE_PRBREQ_FLAG, VNDR_IE_ASSOCREQ_FLAG};
+
+       WL_DBG(("Clear IEs for P2P Discovery Iface \n"));
+       /* certain vendors uses p2p0 interface in addition to
+        * the dedicated p2p interface supported by the linux
+        * kernel.
+        */
+       ndev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY);
+       bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+       if (bssidx == WL_INVALID) {
+               WL_DBG(("No discovery I/F available. Do nothing.\n"));
+               return;
+       }
+
+       for (index = 0; index < ARRAYSIZE(vndrie_flag); index++) {
+               if ((ret = wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(ndev),
+                       bssidx, vndrie_flag[index], NULL, 0)) < 0) {
+                       if (ret != BCME_NOTFOUND) {
+                               WL_ERR(("vndr_ies clear failed (%d). Ignoring.. \n", ret));
+                       }
+               }
+       }
+
+       if (cfg->p2p_wdev && (ndev->ieee80211_ptr != cfg->p2p_wdev)) {
+               /* clear IEs for dedicated p2p interface */
+               wl_cfg80211_clear_per_bss_ies(cfg, cfg->p2p_wdev);
+       }
+}
+
+s32
+wl_cfg80211_clear_per_bss_ies(struct bcm_cfg80211 *cfg, struct wireless_dev *wdev)
+{
+       s32 index;
+       s32 ret;
+       struct net_info *netinfo;
+       s32 vndrie_flag[] = {VNDR_IE_BEACON_FLAG, VNDR_IE_PRBRSP_FLAG,
+               VNDR_IE_ASSOCRSP_FLAG, VNDR_IE_PRBREQ_FLAG, VNDR_IE_ASSOCREQ_FLAG};
+
+       netinfo = wl_get_netinfo_by_wdev(cfg, wdev);
+       if (!netinfo || !netinfo->wdev) {
+               WL_ERR(("netinfo or netinfo->wdev is NULL\n"));
+               return -1;
+       }
+
+       WL_DBG(("clear management vendor IEs for bssidx:%d \n", netinfo->bssidx));
+       /* Clear the IEs set in the firmware so that host is in sync with firmware */
+       for (index = 0; index < ARRAYSIZE(vndrie_flag); index++) {
+               if ((ret = wl_cfg80211_set_mgmt_vndr_ies(cfg, wdev_to_cfgdev(netinfo->wdev),
+                       netinfo->bssidx, vndrie_flag[index], NULL, 0)) < 0)
+                       if (ret != BCME_NOTFOUND) {
+                               WL_ERR(("vndr_ies clear failed. Ignoring.. \n"));
+                       }
+       }
+
+       return 0;
+}
+
+s32
+wl_cfg80211_clear_mgmt_vndr_ies(struct bcm_cfg80211 *cfg)
+{
+       struct net_info *iter, *next;
+
+       WL_DBG(("clear management vendor IEs \n"));
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       for_each_ndev(cfg, iter, next) {
+               GCC_DIAGNOSTIC_POP();
+               wl_cfg80211_clear_per_bss_ies(cfg, iter->wdev);
+       }
+       return 0;
+}
+
+#define WL_VNDR_IE_MAXLEN 2048
+static s8 g_mgmt_ie_buf[WL_VNDR_IE_MAXLEN];
+int
+wl_cfg80211_set_mgmt_vndr_ies(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       s32 bssidx, s32 pktflag, const u8 *vndr_ie, u32 vndr_ie_len)
+{
+       struct net_device *ndev = NULL;
+       s32 ret = BCME_OK;
+       u8  *curr_ie_buf = NULL;
+       u8  *mgmt_ie_buf = NULL;
+       u32 mgmt_ie_buf_len = 0;
+       u32 *mgmt_ie_len = 0;
+       u32 del_add_ie_buf_len = 0;
+       u32 total_ie_buf_len = 0;
+       u32 parsed_ie_buf_len = 0;
+       struct parsed_vndr_ies old_vndr_ies;
+       struct parsed_vndr_ies new_vndr_ies;
+       s32 i;
+       u8 *ptr;
+       s32 remained_buf_len;
+       wl_bss_vndr_ies_t *ies = NULL;
+       struct net_info *netinfo;
+       struct wireless_dev *wdev;
+
+       if (!cfgdev) {
+               WL_ERR(("cfgdev is NULL\n"));
+               return -EINVAL;
+       }
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+       wdev = cfgdev_to_wdev(cfgdev);
+
+       if (bssidx > WL_MAX_IFS) {
+               WL_ERR(("bssidx > supported concurrent Ifaces \n"));
+               return -EINVAL;
+       }
+
+       netinfo = wl_get_netinfo_by_wdev(cfg, wdev);
+       if (!netinfo) {
+               WL_ERR(("net_info ptr is NULL \n"));
+               return -EINVAL;
+       }
+
+       /* Clear the global buffer */
+       bzero(g_mgmt_ie_buf, sizeof(g_mgmt_ie_buf));
+       curr_ie_buf = g_mgmt_ie_buf;
+       ies = &netinfo->bss.ies;
+
+       WL_DBG(("Enter. pktflag:0x%x bssidx:%x vnd_ie_len:%d wdev:%p\n",
+               pktflag, bssidx, vndr_ie_len, wdev));
+
+       switch (pktflag) {
+               case VNDR_IE_PRBRSP_FLAG :
+                       mgmt_ie_buf = ies->probe_res_ie;
+                       mgmt_ie_len = &ies->probe_res_ie_len;
+                       mgmt_ie_buf_len = sizeof(ies->probe_res_ie);
+                       break;
+               case VNDR_IE_ASSOCRSP_FLAG :
+                       mgmt_ie_buf = ies->assoc_res_ie;
+                       mgmt_ie_len = &ies->assoc_res_ie_len;
+                       mgmt_ie_buf_len = sizeof(ies->assoc_res_ie);
+                       break;
+               case VNDR_IE_BEACON_FLAG :
+                       mgmt_ie_buf = ies->beacon_ie;
+                       mgmt_ie_len = &ies->beacon_ie_len;
+                       mgmt_ie_buf_len = sizeof(ies->beacon_ie);
+                       break;
+               case VNDR_IE_PRBREQ_FLAG :
+                       mgmt_ie_buf = ies->probe_req_ie;
+                       mgmt_ie_len = &ies->probe_req_ie_len;
+                       mgmt_ie_buf_len = sizeof(ies->probe_req_ie);
+                       break;
+               case VNDR_IE_ASSOCREQ_FLAG :
+                       mgmt_ie_buf = ies->assoc_req_ie;
+                       mgmt_ie_len = &ies->assoc_req_ie_len;
+                       mgmt_ie_buf_len = sizeof(ies->assoc_req_ie);
+                       break;
+               case VNDR_IE_DISASSOC_FLAG :
+                       mgmt_ie_buf = ies->disassoc_ie;
+                       mgmt_ie_len = &ies->disassoc_ie_len;
+                       mgmt_ie_buf_len = sizeof(ies->disassoc_ie);
+                       break;
+               default:
+                       mgmt_ie_buf = NULL;
+                       mgmt_ie_len = NULL;
+                       WL_ERR(("not suitable packet type (%d)\n", pktflag));
+                       return BCME_ERROR;
+       }
+
+       if (vndr_ie_len > mgmt_ie_buf_len) {
+               WL_ERR(("extra IE size too big\n"));
+               ret = -ENOMEM;
+       } else {
+               /* parse and save new vndr_ie in curr_ie_buff before comparing it */
+               if (vndr_ie && vndr_ie_len && curr_ie_buf) {
+                       ptr = curr_ie_buf;
+
+                       if ((ret = wl_cfg80211_parse_vndr_ies((const u8 *)vndr_ie,
+                                                             vndr_ie_len, &new_vndr_ies)) < 0) {
+                               WL_ERR(("parse vndr ie failed \n"));
+                               goto exit;
+                       }
+
+                       for (i = 0; i < new_vndr_ies.count; i++) {
+                               struct parsed_vndr_ie_info *vndrie_info =
+                                       &new_vndr_ies.ie_info[i];
+
+                               if ((parsed_ie_buf_len + vndrie_info->ie_len) > WL_VNDR_IE_MAXLEN) {
+                                       WL_ERR(("IE size is too big (%d > %d)\n",
+                                               parsed_ie_buf_len, WL_VNDR_IE_MAXLEN));
+                                       ret = -EINVAL;
+                                       goto exit;
+                               }
+
+                               memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
+                                       vndrie_info->ie_len);
+                               parsed_ie_buf_len += vndrie_info->ie_len;
+                       }
+               }
+
+               if (mgmt_ie_buf != NULL) {
+                       if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
+                               (memcmp(mgmt_ie_buf, curr_ie_buf, parsed_ie_buf_len) == 0)) {
+                               WL_DBG(("Previous mgmt IE is equals to current IE"));
+                               goto exit;
+                       }
+
+                       /* parse old vndr_ie */
+                       if ((ret = wl_cfg80211_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len,
+                               &old_vndr_ies)) < 0) {
+                               WL_ERR(("parse vndr ie failed \n"));
+                               goto exit;
+                       }
+                       /* make a command to delete old ie */
+                       for (i = 0; i < old_vndr_ies.count; i++) {
+                               struct parsed_vndr_ie_info *vndrie_info =
+                               &old_vndr_ies.ie_info[i];
+#if defined(WL_MBO) || defined(WL_OCE)
+                       {
+                               if ((vndrie_info->vndrie.id == 0xDD) &&
+                                       (!memcmp(vndrie_info->vndrie.oui, WFA_OUI, WFA_OUI_LEN)) &&
+                                       (vndrie_info->vndrie.data[0] == WFA_OUI_TYPE_MBO_OCE)) {
+                                       WL_DBG(("skipping ID : %d, Len: %d, OUI:"MACOUIDBG
+                                               ", type: %0x\n",
+                                               vndrie_info->vndrie.id,
+                                               vndrie_info->vndrie.len,
+                                               MACOUI2STRDBG(vndrie_info->vndrie.oui),
+                                               vndrie_info->vndrie.data[0]));
+                                       continue;
+                               }
+                       }
+#endif /* WL_MBO || WL_OCE */
+
+                               if (vndrie_info->vndrie.id == DOT11_MNG_ID_EXT_ID) {
+                                       WL_DBG(("DELETED VENDOR EXTN ID : %d, TYPE: %d Len: %d\n",
+                                               vndrie_info->vndrie.id, vndrie_info->vndrie.oui[0],
+                                               vndrie_info->vndrie.len));
+                               } else {
+                                       WL_DBG(("DELETED ID : %d, Len: %d , OUI:"MACOUIDBG"\n",
+                                               vndrie_info->vndrie.id, vndrie_info->vndrie.len,
+                                               MACOUI2STRDBG(vndrie_info->vndrie.oui)));
+                               }
+
+                               del_add_ie_buf_len = wl_cfgp2p_vndr_ie(cfg, curr_ie_buf,
+                                       pktflag, vndrie_info->vndrie.oui,
+                                       vndrie_info->vndrie.id,
+                                       vndrie_info->ie_ptr + VNDR_IE_FIXED_LEN,
+                                       vndrie_info->ie_len - VNDR_IE_FIXED_LEN,
+                                       "del");
+
+                               curr_ie_buf += del_add_ie_buf_len;
+                               total_ie_buf_len += del_add_ie_buf_len;
+                       }
+               }
+
+               *mgmt_ie_len = 0;
+               /* Add if there is any extra IE */
+               if (mgmt_ie_buf && parsed_ie_buf_len) {
+                       ptr = mgmt_ie_buf;
+
+                       remained_buf_len = mgmt_ie_buf_len;
+
+                       /* make a command to add new ie */
+                       for (i = 0; i < new_vndr_ies.count; i++) {
+                               struct parsed_vndr_ie_info *vndrie_info =
+                                       &new_vndr_ies.ie_info[i];
+#if defined(WL_MBO) || defined(WL_OCE)
+                       {
+                               if ((vndrie_info->vndrie.id == 0xDD) &&
+                                       (!memcmp(vndrie_info->vndrie.oui, WFA_OUI, WFA_OUI_LEN)) &&
+                                       (vndrie_info->vndrie.data[0] == WFA_OUI_TYPE_MBO_OCE)) {
+                                       WL_DBG(("skipping ID : %d, Len: %d, OUI:"MACOUIDBG
+                                               ",type :%0x\n",
+                                               vndrie_info->vndrie.id,
+                                               vndrie_info->vndrie.len,
+                                               MACOUI2STRDBG(vndrie_info->vndrie.oui),
+                                               vndrie_info->vndrie.data[0]));
+                                       continue;
+                               }
+                       }
+#endif /* WL_MBO || WL_OCE */
+                               if (vndrie_info->vndrie.id == DOT11_MNG_ID_EXT_ID) {
+                                       WL_DBG(("ADDED VENDOR EXTN ID : %d, TYPE = %d, Len: %d\n",
+                                               vndrie_info->vndrie.id, vndrie_info->vndrie.oui[0],
+                                               vndrie_info->vndrie.len));
+                               } else {
+                                       WL_DBG(("ADDED ID : %d, Len: %d(%d), OUI:"MACOUIDBG"\n",
+                                               vndrie_info->vndrie.id, vndrie_info->vndrie.len,
+                                               vndrie_info->ie_len - 2,
+                                               MACOUI2STRDBG(vndrie_info->vndrie.oui)));
+                               }
+
+                               del_add_ie_buf_len = wl_cfgp2p_vndr_ie(cfg, curr_ie_buf,
+                                       pktflag, vndrie_info->vndrie.oui,
+                                       vndrie_info->vndrie.id,
+                                       vndrie_info->ie_ptr + VNDR_IE_FIXED_LEN,
+                                       vndrie_info->ie_len - VNDR_IE_FIXED_LEN,
+                                       "add");
+
+                               /* verify remained buf size before copy data */
+                               if (remained_buf_len >= vndrie_info->ie_len) {
+                                       remained_buf_len -= vndrie_info->ie_len;
+                               } else {
+                                       WL_ERR(("no space in mgmt_ie_buf: pktflag = %d, "
+                                       "found vndr ies # = %d(cur %d), remained len %d, "
+                                       "cur mgmt_ie_len %d, new ie len = %d\n",
+                                       pktflag, new_vndr_ies.count, i, remained_buf_len,
+                                       *mgmt_ie_len, vndrie_info->ie_len));
+                                       break;
+                               }
+
+                               /* save the parsed IE in cfg struct */
+                               memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
+                                       vndrie_info->ie_len);
+                               *mgmt_ie_len += vndrie_info->ie_len;
+                               curr_ie_buf += del_add_ie_buf_len;
+                               total_ie_buf_len += del_add_ie_buf_len;
+                       }
+               }
+
+               if (total_ie_buf_len && cfg->ioctl_buf != NULL) {
+                       ret  = wldev_iovar_setbuf_bsscfg(ndev, "vndr_ie", g_mgmt_ie_buf,
+                               total_ie_buf_len, cfg->ioctl_buf, WLC_IOCTL_MAXLEN,
+                               bssidx, &cfg->ioctl_buf_sync);
+                       if (ret)
+                               WL_ERR(("vndr ie set error : %d\n", ret));
+               }
+       }
+exit:
+
+return ret;
+}
+
+#ifdef WL_CFG80211_ACL
+static int
+wl_cfg80211_set_mac_acl(struct wiphy *wiphy, struct net_device *cfgdev,
+       const struct cfg80211_acl_data *acl)
+{
+       int i;
+       int ret = 0;
+       int macnum = 0;
+       int macmode = MACLIST_MODE_DISABLED;
+       struct maclist *list;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(cfgdev);
+
+       /* get the MAC filter mode */
+       if (acl && acl->acl_policy == NL80211_ACL_POLICY_DENY_UNLESS_LISTED) {
+               macmode = MACLIST_MODE_ALLOW;
+       } else if (acl && acl->acl_policy == NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
+       acl->n_acl_entries) {
+               macmode = MACLIST_MODE_DENY;
+       }
+
+       /* if acl == NULL, macmode is still disabled.. */
+       if (macmode == MACLIST_MODE_DISABLED) {
+               if ((ret = wl_android_set_ap_mac_list(cfgdev, macmode, NULL)) != 0)
+                       WL_ERR(("wl_cfg80211_set_mac_acl: Setting MAC list"
+                               " failed error=%d\n", ret));
+
+               return ret;
+       }
+
+       macnum = acl->n_acl_entries;
+       if (macnum < 0 || macnum > MAX_NUM_MAC_FILT) {
+               WL_ERR(("wl_cfg80211_set_mac_acl: invalid number of MAC address entries %d\n",
+                       macnum));
+               return -1;
+       }
+
+       /* allocate memory for the MAC list */
+       list = (struct maclist *)MALLOC(cfg->osh, sizeof(int) +
+               sizeof(struct ether_addr) * macnum);
+       if (!list) {
+               WL_ERR(("wl_cfg80211_set_mac_acl: failed to allocate memory\n"));
+               return -1;
+       }
+
+       /* prepare the MAC list */
+       list->count = htod32(macnum);
+       for (i = 0; i < macnum; i++) {
+               memcpy(&list->ea[i], &acl->mac_addrs[i], ETHER_ADDR_LEN);
+       }
+       /* set the list */
+       if ((ret = wl_android_set_ap_mac_list(cfgdev, macmode, list)) != 0)
+               WL_ERR(("wl_cfg80211_set_mac_acl: Setting MAC list failed error=%d\n", ret));
+
+       MFREE(cfg->osh, list, sizeof(int) +
+               sizeof(struct ether_addr) * macnum);
+
+       return ret;
+}
+#endif /* WL_CFG80211_ACL */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 5, 0))
+int wl_chspec_chandef(chanspec_t chanspec,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+       struct cfg80211_chan_def *chandef,
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 5, 0) && (LINUX_VERSION_CODE <= (3, 7, 0)))
+       struct chan_info *chaninfo,
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 5, 0)) */
+       struct wiphy *wiphy)
+{
+       uint16 freq = 0;
+       int chan_type = 0;
+       int channel = 0;
+       struct ieee80211_channel *chan;
+
+       if (!chandef) {
+               return -1;
+       }
+       channel = CHSPEC_CHANNEL(chanspec);
+
+       switch (CHSPEC_BW(chanspec)) {
+               case WL_CHANSPEC_BW_20:
+                       chan_type = NL80211_CHAN_HT20;
+                       break;
+               case WL_CHANSPEC_BW_40:
+               {
+                       if (CHSPEC_SB_UPPER(chanspec)) {
+                               channel += CH_10MHZ_APART;
+                       } else {
+                               channel -= CH_10MHZ_APART;
+                       }
+               }
+                       chan_type = NL80211_CHAN_HT40PLUS;
+                       break;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0))
+               case WL_CHANSPEC_BW_80:
+               case WL_CHANSPEC_BW_8080:
+               {
+                       uint16 sb = CHSPEC_CTL_SB(chanspec);
+
+                       if (sb == WL_CHANSPEC_CTL_SB_LL) {
+                               channel -= (CH_10MHZ_APART + CH_20MHZ_APART);
+                       } else if (sb == WL_CHANSPEC_CTL_SB_LU) {
+                               channel -= CH_10MHZ_APART;
+                       } else if (sb == WL_CHANSPEC_CTL_SB_UL) {
+                               channel += CH_10MHZ_APART;
+                       } else {
+                               /* WL_CHANSPEC_CTL_SB_UU */
+                               channel += (CH_10MHZ_APART + CH_20MHZ_APART);
+                       }
+
+                       if (sb == WL_CHANSPEC_CTL_SB_LL || sb == WL_CHANSPEC_CTL_SB_LU)
+                               chan_type = NL80211_CHAN_HT40MINUS;
+                       else if (sb == WL_CHANSPEC_CTL_SB_UL || sb == WL_CHANSPEC_CTL_SB_UU)
+                               chan_type = NL80211_CHAN_HT40PLUS;
+               }
+                       break;
+               case WL_CHANSPEC_BW_160:
+                       channel = wf_chspec_primary20_chan(chanspec);
+                       /* Using base chan_type as kernel does not define chan_type for 160 MHz */
+                       chan_type = NL80211_CHAN_HT20;
+                       break;
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0)) */
+               default:
+                       chan_type = NL80211_CHAN_HT20;
+                       break;
+
+       }
+       freq = wl_channel_to_frequency(channel, CHSPEC_BAND(chanspec));
+       chan = ieee80211_get_channel(wiphy, freq);
+       WL_DBG(("channel:%d freq:%d chan_type: %d chan_ptr:%p \n",
+               channel, freq, chan_type, chan));
+       if (unlikely(!chan)) {
+               /* fw and cfg80211 channel lists are not in sync */
+               WL_ERR(("Couldn't find matching channel in wiphy channel list \n"));
+               ASSERT(0);
+               return -EINVAL;
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0))
+       cfg80211_chandef_create(chandef, chan, chan_type);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 5, 0) && (LINUX_VERSION_CODE <= (3, 7, \
+       0)))
+       chaninfo->freq = freq;
+       chaninfo->chan_type = chan_type;
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0)) */
+       return 0;
+}
+
+void
+wl_cfg80211_ch_switch_notify(struct net_device *dev, uint16 chanspec, struct wiphy *wiphy)
+{
+       u32 freq;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0))
+       struct cfg80211_chan_def chandef;
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 5, 0) && (LINUX_VERSION_CODE <= (3, 7, 0)))
+       struct chan_info chaninfo;
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0)) */
+
+       if (!wiphy) {
+               WL_ERR(("wiphy is null\n"));
+               return;
+       }
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION (3, 18, 0))
+       /* Channel switch support is only for AP/GO/ADHOC/MESH */
+       if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION ||
+               dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_CLIENT) {
+               WL_ERR(("No channel switch notify support for STA/GC\n"));
+               return;
+       }
+#endif /* (LINUX_VERSION_CODE <= KERNEL_VERSION (3, 18, 0)) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0))
+       if (wl_chspec_chandef(chanspec, &chandef, wiphy))
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 5, 0) && (LINUX_VERSION_CODE <= (3, 7, 0)))
+       if (wl_chspec_chandef(chanspec, &chaninfo, wiphy))
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0)) */
+       {
+               WL_ERR(("chspec_chandef failed\n"));
+               return;
+       }
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0))
+       freq = chandef.chan ? chandef.chan->center_freq : chandef.center_freq1;
+       cfg80211_ch_switch_notify(dev, &chandef);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 5, 0) && (LINUX_VERSION_CODE <= (3, 7, 0)))
+       freq = chan_info.freq;
+       cfg80211_ch_switch_notify(dev, freq, chan_info.chan_type);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0)) */
+
+       WL_MSG(dev->name, "Channel switch notification for freq: %d chanspec: 0x%x\n",
+               freq, chanspec);
+       return;
+}
+#endif /* LINUX_VERSION_CODE >= (3, 5, 0) */
+
+static void
+wl_ap_channel_ind(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev,
+       chanspec_t chanspec)
+{
+       u32 channel = LCHSPEC_CHANNEL(chanspec);
+
+       WL_INFORM_MEM(("(%s) AP channel:%d chspec:0x%x \n",
+               ndev->name, channel, chanspec));
+
+#ifdef SUPPORT_AP_BWCTRL
+       wl_update_apchan_bwcap(cfg, ndev, chanspec);
+#endif /* SUPPORT_AP_BWCTRL */
+
+       if (!(cfg->ap_oper_channel == INVCHANSPEC) && (cfg->ap_oper_channel != chanspec)) {
+               /*
+                * If cached channel is different from the channel indicated
+                * by the event, notify user space about the channel switch.
+                */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 5, 0))
+               wl_cfg80211_ch_switch_notify(ndev, chanspec, bcmcfg_to_wiphy(cfg));
+#endif /* LINUX_VERSION_CODE >= (3, 5, 0) */
+               cfg->ap_oper_channel = chanspec;
+       }
+}
+
+static s32
+wl_ap_start_ind(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+const wl_event_msg_t *e, void *data)
+{
+       struct net_device *ndev = NULL;
+       chanspec_t chanspec;
+
+       WL_DBG(("Enter\n"));
+       if (unlikely(e->status)) {
+               WL_ERR(("status:0x%x \n", e->status));
+               return -1;
+       }
+
+       if (!data) {
+               return -EINVAL;
+       }
+
+       if (likely(cfgdev)) {
+               ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+               chanspec = *((chanspec_t *)data);
+
+               if (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_AP) {
+                       /* For AP/GO role */
+                       wl_ap_channel_ind(cfg, ndev, chanspec);
+               }
+       }
+
+       return 0;
+}
+
+static s32
+wl_csa_complete_ind(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+const wl_event_msg_t *e, void *data)
+{
+       int error = 0;
+       u32 chanspec = 0;
+       struct net_device *ndev = NULL;
+       struct ether_addr bssid;
+
+       WL_DBG(("Enter\n"));
+       if (unlikely(e->status)) {
+               WL_ERR(("status:0x%x \n", e->status));
+               return -1;
+       }
+
+       if (likely(cfgdev)) {
+               ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+               /* Get association state if not AP and then query chanspec */
+               if (!((wl_get_mode_by_netdev(cfg, ndev)) == WL_MODE_AP)) {
+                       error = wldev_ioctl_get(ndev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN);
+                       if (error) {
+                               WL_ERR(("CSA on %s. Not associated. error=%d\n",
+                                       ndev->name, error));
+                               return BCME_ERROR;
+                       }
+               }
+
+               error = wldev_iovar_getint(ndev, "chanspec", &chanspec);
+               if (unlikely(error)) {
+                       WL_ERR(("Get chanspec error: %d \n", error));
+                       return -1;
+               }
+
+               WL_INFORM_MEM(("[%s] CSA ind. ch:0x%x\n", ndev->name, chanspec));
+               if (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_AP) {
+                       /* For AP/GO role */
+                       wl_ap_channel_ind(cfg, ndev, chanspec);
+               } else {
+                       /* STA/GC roles */
+                       if (!wl_get_drv_status(cfg, CONNECTED, ndev)) {
+                               WL_ERR(("CSA on %s. Not associated.\n", ndev->name));
+                               return BCME_ERROR;
+                       }
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 5, 0))
+                       wl_cfg80211_ch_switch_notify(ndev, chanspec, bcmcfg_to_wiphy(cfg));
+#endif /* LINUX_VERSION_CODE >= (3, 5, 0) */
+               }
+
+       }
+
+       return 0;
+}
+
+void wl_cfg80211_clear_security(struct bcm_cfg80211 *cfg)
+{
+       struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+       int err;
+
+       /* Clear the security settings on the primary Interface */
+       err = wldev_iovar_setint(dev, "wsec", 0);
+       if (unlikely(err)) {
+               WL_ERR(("wsec clear failed \n"));
+       }
+       err = wldev_iovar_setint(dev, "auth", 0);
+       if (unlikely(err)) {
+               WL_ERR(("auth clear failed \n"));
+       }
+       err = wldev_iovar_setint(dev, "wpa_auth", WPA_AUTH_DISABLED);
+       if (unlikely(err)) {
+               WL_ERR(("wpa_auth clear failed \n"));
+       }
+}
+
+#ifdef WL_CFG80211_P2P_DEV_IF
+void wl_cfg80211_del_p2p_wdev(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       struct wireless_dev *wdev = NULL;
+
+       WL_DBG(("Enter \n"));
+       if (!cfg) {
+               WL_ERR(("Invalid Ptr\n"));
+               return;
+       } else {
+               wdev = cfg->p2p_wdev;
+       }
+
+       if (wdev) {
+               wl_cfgp2p_del_p2p_disc_if(wdev, cfg);
+       }
+}
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#ifdef GTK_OFFLOAD_SUPPORT
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0))
+static s32
+wl_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *dev,
+               struct cfg80211_gtk_rekey_data *data)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 err = 0;
+       gtk_keyinfo_t keyinfo;
+       bcol_gtk_para_t bcol_keyinfo;
+
+       WL_DBG(("Enter\n"));
+       if (data == NULL || cfg->p2p_net == dev) {
+               WL_ERR(("data is NULL or wrong net device\n"));
+               return -EINVAL;
+       }
+
+       prhex("kck", (const u8 *) (data->kck), RSN_KCK_LENGTH);
+       prhex("kek", (const u8 *) (data->kek), RSN_KEK_LENGTH);
+       prhex("replay_ctr", (const u8 *) (data->replay_ctr), RSN_REPLAY_LEN);
+       bcopy(data->kck, keyinfo.KCK, RSN_KCK_LENGTH);
+       bcopy(data->kek, keyinfo.KEK, RSN_KEK_LENGTH);
+       bcopy(data->replay_ctr, keyinfo.ReplayCounter, RSN_REPLAY_LEN);
+
+       memset(&bcol_keyinfo, 0, sizeof(bcol_keyinfo));
+       bcol_keyinfo.enable = 1;
+       bcol_keyinfo.ptk_len = 64;
+       memcpy(&bcol_keyinfo.ptk[0], data->kck, RSN_KCK_LENGTH);
+       memcpy(&bcol_keyinfo.ptk[RSN_KCK_LENGTH], data->kek, RSN_KEK_LENGTH);
+       err = wldev_iovar_setbuf(dev, "bcol_gtk_rekey_ptk", &bcol_keyinfo,
+               sizeof(bcol_keyinfo), cfg->ioctl_buf, WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync);
+       if (!err) {
+               return err;
+       }
+
+       if ((err = wldev_iovar_setbuf(dev, "gtk_key_info", &keyinfo, sizeof(keyinfo),
+               cfg->ioctl_buf, WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync)) < 0) {
+               WL_ERR(("seting gtk_key_info failed code=%d\n", err));
+               return err;
+       }
+
+       WL_DBG(("Exit\n"));
+       return err;
+}
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0) */
+#endif /* GTK_OFFLOAD_SUPPORT */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0))
+static int wl_cfg80211_set_pmk(struct wiphy *wiphy, struct net_device *dev,
+       const struct cfg80211_pmk_conf *conf)
+{
+       int ret = 0;
+       wsec_pmk_t pmk;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct wl_security *sec;
+       s32 bssidx;
+
+       pmk.key_len = conf->pmk_len;
+       if (pmk.key_len > sizeof(pmk.key)) {
+               ret = -EINVAL;
+               return ret;
+       }
+       pmk.flags = 0;
+       ret = memcpy_s(&pmk.key, sizeof(pmk.key), conf->pmk, conf->pmk_len);
+       if (ret) {
+               ret = -EINVAL;
+               return ret;
+       }
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find index failed\n"));
+               ret = -EINVAL;
+               return ret;
+       }
+
+       sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+       if ((sec->wpa_auth == WLAN_AKM_SUITE_8021X) ||
+               (sec->wpa_auth == WL_AKM_SUITE_SHA256_1X)) {
+               ret = wldev_iovar_setbuf_bsscfg(dev, "okc_info_pmk", pmk.key, pmk.key_len,
+                       cfg->ioctl_buf, WLC_IOCTL_SMLEN, bssidx, &cfg->ioctl_buf_sync);
+               if (ret) {
+                       /* could fail in case that 'okc' is not supported */
+                       WL_INFORM_MEM(("okc_info_pmk failed, err=%d (ignore)\n", ret));
+               }
+       }
+
+       ret = wldev_ioctl_set(dev, WLC_SET_WSEC_PMK, &pmk, sizeof(pmk));
+       if (ret) {
+               WL_ERR(("wl_cfg80211_set_pmk error:%d", ret));
+               ret = -EINVAL;
+               return ret;
+       } else {
+               WL_DBG(("pmk added for mac:"MACDBG"\n", MAC2STRDBG(conf->aa)));
+       }
+       return 0;
+}
+
+static int wl_cfg80211_del_pmk(struct wiphy *wiphy, struct net_device *dev,
+       const u8 *aa)
+{
+       int err = BCME_OK;
+       struct cfg80211_pmksa pmksa;
+
+       /* build up cfg80211_pmksa structure to use existing wl_cfg80211_update_pmksa API */
+       bzero(&pmksa, sizeof(pmksa));
+       pmksa.bssid = aa;
+
+       err = wl_cfg80211_update_pmksa(wiphy, dev, &pmksa, FALSE);
+       if (unlikely(err)) {
+               WL_ERR(("wl_cfg80211_update_pmksa err:%d\n", err));
+               err = -EINVAL;
+       } else {
+               WL_DBG(("pmk deleted for bssid:"MACDBG"\n", MAC2STRDBG(aa)));
+       }
+
+       return err;
+}
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0) */
+
+int
+wl_cfg80211_get_sta_channel(struct bcm_cfg80211 *cfg)
+{
+       chanspec_t *sta_chanspec = NULL;
+       u32 channel = 0;
+
+       if (wl_get_drv_status(cfg, CONNECTED, bcmcfg_to_prmry_ndev(cfg))) {
+               if ((sta_chanspec = (chanspec_t *)wl_read_prof(cfg,
+                       bcmcfg_to_prmry_ndev(cfg), WL_PROF_CHAN))) {
+                       channel = CHSPEC_CHANNEL(*sta_chanspec);
+               }
+       }
+       return channel;
+}
+
+u64
+wl_cfg80211_get_new_roc_id(struct bcm_cfg80211 *cfg)
+{
+       u64 id = 0;
+       id = ++cfg->last_roc_id;
+#ifdef  P2P_LISTEN_OFFLOADING
+       if (id == P2PO_COOKIE) {
+               id = ++cfg->last_roc_id;
+       }
+#endif /* P2P_LISTEN_OFFLOADING */
+       if (id == 0)
+               id = ++cfg->last_roc_id;
+       return id;
+}
+
+#ifdef WLTDLS
+s32
+wl_cfg80211_tdls_config(struct bcm_cfg80211 *cfg, enum wl_tdls_config state, bool auto_mode)
+{
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       int err = 0;
+       struct net_info *iter, *next;
+       int update_reqd = 0;
+       int enable = 0;
+       dhd_pub_t *dhdp;
+       dhdp = (dhd_pub_t *)(cfg->pub);
+
+       /*
+        * TDLS need to be enabled only if we have a single STA/GC
+        * connection.
+        */
+
+       WL_DBG(("Enter state:%d\n", state));
+       if (!cfg->tdls_supported) {
+               /* FW doesn't support tdls. Do nothing */
+               return -ENODEV;
+       }
+
+       /* Protect tdls config session */
+       mutex_lock(&cfg->tdls_sync);
+
+       if (state == TDLS_STATE_TEARDOWN) {
+               /* Host initiated TDLS tear down */
+               err = dhd_tdls_enable(ndev, false, auto_mode, NULL);
+               goto exit;
+       } else if ((state == TDLS_STATE_AP_CREATE) ||
+               (state == TDLS_STATE_NMI_CREATE)) {
+               /* We don't support tdls while AP/GO/NAN is operational */
+               update_reqd = true;
+               enable = false;
+       } else if ((state == TDLS_STATE_CONNECT) || (state == TDLS_STATE_IF_CREATE)) {
+               if (wl_get_drv_status_all(cfg,
+                       CONNECTED) >= TDLS_MAX_IFACE_FOR_ENABLE) {
+                       /* For STA/GC connect command request, disable
+                        * tdls if we have any concurrent interfaces
+                        * operational.
+                        */
+                       WL_DBG(("Interface limit restriction. disable tdls.\n"));
+                       update_reqd = true;
+                       enable = false;
+               }
+       } else if ((state == TDLS_STATE_DISCONNECT) ||
+               (state == TDLS_STATE_AP_DELETE) ||
+               (state == TDLS_STATE_SETUP) ||
+               (state == TDLS_STATE_IF_DELETE)) {
+               /* Enable back the tdls connection only if we have less than
+                * or equal to a single STA/GC connection.
+                */
+               if (wl_get_drv_status_all(cfg,
+                       CONNECTED) == 0) {
+                       /* If there are no interfaces connected, enable tdls */
+                       update_reqd = true;
+                       enable = true;
+               } else if (wl_get_drv_status_all(cfg,
+                       CONNECTED) == TDLS_MAX_IFACE_FOR_ENABLE) {
+                       /* We have one interface in CONNECTED state.
+                        * Verify whether its a STA interface before
+                        * we enable back tdls.
+                        */
+                       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                       for_each_ndev(cfg, iter, next) {
+                               GCC_DIAGNOSTIC_POP();
+                               if ((iter->ndev) && (wl_get_drv_status(cfg, CONNECTED, ndev)) &&
+                                       (ndev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION)) {
+                                       WL_DBG(("Non STA iface operational. cfg_iftype:%d"
+                                               " Can't enable tdls.\n",
+                                               ndev->ieee80211_ptr->iftype));
+                                       err = -ENOTSUPP;
+                                       goto exit;
+                               }
+                       }
+                       /* No AP/GO found. Enable back tdls */
+                       update_reqd = true;
+                       enable = true;
+               } else {
+                       WL_DBG(("Concurrent connection mode. Can't enable tdls. \n"));
+                       err = -ENOTSUPP;
+                       goto exit;
+               }
+       } else {
+               WL_ERR(("Unknown tdls state:%d \n", state));
+               err = -EINVAL;
+               goto exit;
+       }
+
+       if (update_reqd == true) {
+               if (dhdp->tdls_enable == enable) {
+                       WL_DBG(("No change in tdls state. Do nothing."
+                               " tdls_enable:%d\n", enable));
+                       goto exit;
+               }
+               err = wldev_iovar_setint(ndev, "tdls_enable", enable);
+               if (unlikely(err)) {
+                       WL_ERR(("tdls_enable setting failed. err:%d\n", err));
+                       goto exit;
+               } else {
+                       WL_INFORM_MEM(("tdls_enable %d state:%d\n", enable, state));
+                       /* Update the dhd state variable to be in sync */
+                       dhdp->tdls_enable = enable;
+                       if (state == TDLS_STATE_SETUP) {
+                               /* For host initiated setup, apply TDLS params
+                                * Don't propagate errors up for param config
+                                * failures
+                                */
+                               dhd_tdls_enable(ndev, true, auto_mode, NULL);
+
+                       }
+               }
+       } else {
+               WL_DBG(("Skip tdls config. state:%d update_reqd:%d "
+                       "current_status:%d \n",
+                       state, update_reqd, dhdp->tdls_enable));
+       }
+
+exit:
+       if (err) {
+               wl_flush_fw_log_buffer(ndev, FW_LOGSET_MASK_ALL);
+       }
+       mutex_unlock(&cfg->tdls_sync);
+       return err;
+}
+#endif /* WLTDLS */
+
+struct net_device* wl_get_ap_netdev(struct bcm_cfg80211 *cfg, char *ifname)
+{
+       struct net_info *iter, *next;
+       struct net_device *ndev = NULL;
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       for_each_ndev(cfg, iter, next) {
+               GCC_DIAGNOSTIC_POP();
+               if (iter->ndev) {
+                       if (strncmp(iter->ndev->name, ifname, IFNAMSIZ) == 0) {
+                               if (iter->ndev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP) {
+                                       ndev = iter->ndev;
+                                       break;
+                               }
+                       }
+               }
+       }
+
+       return ndev;
+}
+
+struct net_device*
+wl_get_netdev_by_name(struct bcm_cfg80211 *cfg, char *ifname)
+{
+       struct net_info *iter, *next;
+       struct net_device *ndev = NULL;
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       for_each_ndev(cfg, iter, next) {
+               GCC_DIAGNOSTIC_POP();
+               if (iter->ndev) {
+                       if (strncmp(iter->ndev->name, ifname, IFNAMSIZ) == 0) {
+                               ndev = iter->ndev;
+                               break;
+                       }
+               }
+       }
+
+       return ndev;
+}
+
+#ifdef SUPPORT_AP_HIGHER_BEACONRATE
+#define WLC_RATE_FLAG  0x80
+#define RATE_MASK              0x7f
+
+int wl_set_ap_beacon_rate(struct net_device *dev, int val, char *ifname)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhdp;
+       wl_rateset_args_t rs;
+       int error = BCME_ERROR, i;
+       struct net_device *ndev = NULL;
+
+       dhdp = (dhd_pub_t *)(cfg->pub);
+
+       if (dhdp && !(dhdp->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+               WL_ERR(("Not Hostapd mode\n"));
+               return BCME_NOTAP;
+       }
+
+       ndev = wl_get_ap_netdev(cfg, ifname);
+
+       if (ndev == NULL) {
+               WL_ERR(("No softAP interface named %s\n", ifname));
+               return BCME_NOTAP;
+       }
+
+       bzero(&rs, sizeof(wl_rateset_args_t));
+       error = wldev_iovar_getbuf(ndev, "rateset", NULL, 0,
+               &rs, sizeof(wl_rateset_args_t), NULL);
+       if (error < 0) {
+               WL_ERR(("get rateset failed = %d\n", error));
+               return error;
+       }
+
+       if (rs.count < 1) {
+               WL_ERR(("Failed to get rate count\n"));
+               return BCME_ERROR;
+       }
+
+       /* Host delivers target rate in the unit of 500kbps */
+       /* To make it to 1mbps unit, atof should be implemented for 5.5mbps basic rate */
+       for (i = 0; i < rs.count && i < WL_NUMRATES; i++)
+               if (rs.rates[i] & WLC_RATE_FLAG)
+                       if ((rs.rates[i] & RATE_MASK) == val)
+                               break;
+
+       /* Valid rate has been delivered as an argument */
+       if (i < rs.count && i < WL_NUMRATES) {
+               error = wldev_iovar_setint(ndev, "force_bcn_rspec", val);
+               if (error < 0) {
+                       WL_ERR(("set beacon rate failed = %d\n", error));
+                       return BCME_ERROR;
+               }
+       } else {
+               WL_ERR(("Rate is invalid"));
+               return BCME_BADARG;
+       }
+
+       return BCME_OK;
+}
+
+int
+wl_get_ap_basic_rate(struct net_device *dev, char* command, char *ifname, int total_len)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhdp;
+       wl_rateset_args_t rs;
+       int error = BCME_ERROR;
+       int i, bytes_written = 0;
+       struct net_device *ndev = NULL;
+
+       dhdp = (dhd_pub_t *)(cfg->pub);
+
+       if (!(dhdp->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+               WL_ERR(("Not Hostapd mode\n"));
+               return BCME_NOTAP;
+       }
+
+       ndev = wl_get_ap_netdev(cfg, ifname);
+
+       if (ndev == NULL) {
+               WL_ERR(("No softAP interface named %s\n", ifname));
+               return BCME_NOTAP;
+       }
+
+       bzero(&rs, sizeof(wl_rateset_args_t));
+       error = wldev_iovar_getbuf(ndev, "rateset", NULL, 0,
+               &rs, sizeof(wl_rateset_args_t), NULL);
+       if (error < 0) {
+               WL_ERR(("get rateset failed = %d\n", error));
+               return error;
+       }
+
+       if (rs.count < 1) {
+               WL_ERR(("Failed to get rate count\n"));
+               return BCME_ERROR;
+       }
+
+       /* Delivers basic rate in the unit of 500kbps to host */
+       for (i = 0; i < rs.count && i < WL_NUMRATES; i++)
+               if (rs.rates[i] & WLC_RATE_FLAG)
+                       bytes_written += snprintf(command + bytes_written, total_len,
+                                                       "%d ", rs.rates[i] & RATE_MASK);
+
+       /* Remove last space in the command buffer */
+       if (bytes_written && (bytes_written < total_len)) {
+               command[bytes_written - 1] = '\0';
+               bytes_written--;
+       }
+
+       return bytes_written;
+
+}
+#endif /* SUPPORT_AP_HIGHER_BEACONRATE */
+
+#ifdef SUPPORT_AP_RADIO_PWRSAVE
+#define MSEC_PER_MIN   (60000L)
+
+static int
+_wl_update_ap_rps_params(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = NULL;
+       rpsnoa_iovar_params_t iovar;
+       u8 smbuf[WLC_IOCTL_SMLEN];
+
+       if (!dev)
+               return BCME_BADARG;
+
+       cfg = wl_get_cfg(dev);
+
+       bzero(&iovar, sizeof(iovar));
+       bzero(smbuf, sizeof(smbuf));
+
+       iovar.hdr.ver = RADIO_PWRSAVE_VERSION;
+       iovar.hdr.subcmd = WL_RPSNOA_CMD_PARAMS;
+       iovar.hdr.len = sizeof(iovar);
+       iovar.param->band = WLC_BAND_ALL;
+       iovar.param->level = cfg->ap_rps_info.level;
+       iovar.param->stas_assoc_check = cfg->ap_rps_info.sta_assoc_check;
+       iovar.param->pps = cfg->ap_rps_info.pps;
+       iovar.param->quiet_time = cfg->ap_rps_info.quiet_time;
+
+       if (wldev_iovar_setbuf(dev, "rpsnoa", &iovar, sizeof(iovar),
+               smbuf, sizeof(smbuf), NULL)) {
+               WL_ERR(("Failed to set rpsnoa params"));
+               return BCME_ERROR;
+       }
+
+       return BCME_OK;
+}
+
+int
+wl_get_ap_rps(struct net_device *dev, char* command, char *ifname, int total_len)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhdp;
+       int error = BCME_ERROR;
+       int bytes_written = 0;
+       struct net_device *ndev = NULL;
+       rpsnoa_iovar_status_t iovar;
+       u8 smbuf[WLC_IOCTL_SMLEN];
+       u32 chanspec = 0;
+       u8 idx = 0;
+       u16 state;
+       u32 sleep;
+       u32 time_since_enable;
+
+       dhdp = (dhd_pub_t *)(cfg->pub);
+
+       if (!dhdp) {
+               error = BCME_NOTUP;
+               goto fail;
+       }
+
+       if (!(dhdp->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+               WL_ERR(("Not Hostapd mode\n"));
+               error = BCME_NOTAP;
+               goto fail;
+       }
+
+       ndev = wl_get_ap_netdev(cfg, ifname);
+
+       if (ndev == NULL) {
+               WL_ERR(("No softAP interface named %s\n", ifname));
+               error = BCME_NOTAP;
+               goto fail;
+       }
+
+       bzero(&iovar, sizeof(iovar));
+       bzero(smbuf, sizeof(smbuf));
+
+       iovar.hdr.ver = RADIO_PWRSAVE_VERSION;
+       iovar.hdr.subcmd = WL_RPSNOA_CMD_STATUS;
+       iovar.hdr.len = sizeof(iovar);
+       iovar.stats->band = WLC_BAND_ALL;
+
+       error = wldev_iovar_getbuf(ndev, "rpsnoa", &iovar, sizeof(iovar),
+               smbuf, sizeof(smbuf), NULL);
+       if (error < 0) {
+               WL_ERR(("get ap radio pwrsave failed = %d\n", error));
+               goto fail;
+       }
+
+       /* RSDB event doesn't seem to be handled correctly.
+        * So check chanspec of AP directly from the firmware
+        */
+       error = wldev_iovar_getint(ndev, "chanspec", (s32 *)&chanspec);
+       if (error < 0) {
+               WL_ERR(("get chanspec from AP failed = %d\n", error));
+               goto fail;
+       }
+
+       chanspec = wl_chspec_driver_to_host(chanspec);
+       if (CHSPEC_IS2G(chanspec))
+               idx = 0;
+       else if (
+#ifdef WL_6G_BAND
+               CHSPEC_IS6G(chanspec) ||
+#endif /* WL_6G_BAND */
+               CHSPEC_IS5G(chanspec))
+               idx = 1;
+       else {
+               error = BCME_BADCHAN;
+               goto fail;
+       }
+
+       state = ((rpsnoa_iovar_status_t *)smbuf)->stats[idx].state;
+       sleep = ((rpsnoa_iovar_status_t *)smbuf)->stats[idx].sleep_dur;
+       time_since_enable = ((rpsnoa_iovar_status_t *)smbuf)->stats[idx].sleep_avail_dur;
+
+       /* Conver ms to minute, round down only */
+       sleep = DIV_U64_BY_U32(sleep, MSEC_PER_MIN);
+       time_since_enable = DIV_U64_BY_U32(time_since_enable, MSEC_PER_MIN);
+
+       bytes_written += snprintf(command + bytes_written, total_len,
+               "state=%d sleep=%d time_since_enable=%d", state, sleep, time_since_enable);
+       error = bytes_written;
+
+fail:
+       return error;
+}
+
+int
+wl_set_ap_rps(struct net_device *dev, bool enable, char *ifname)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhdp;
+       struct net_device *ndev = NULL;
+       rpsnoa_iovar_t iovar;
+       u8 smbuf[WLC_IOCTL_SMLEN];
+       int ret = BCME_OK;
+
+       dhdp = (dhd_pub_t *)(cfg->pub);
+
+       if (!dhdp) {
+               ret = BCME_NOTUP;
+               goto exit;
+       }
+
+       if (!(dhdp->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+               WL_ERR(("Not Hostapd mode\n"));
+               ret = BCME_NOTAP;
+               goto exit;
+       }
+
+       ndev = wl_get_ap_netdev(cfg, ifname);
+
+       if (ndev == NULL) {
+               WL_ERR(("No softAP interface named %s\n", ifname));
+               ret = BCME_NOTAP;
+               goto exit;
+       }
+
+       if (cfg->ap_rps_info.enable != enable) {
+               cfg->ap_rps_info.enable = enable;
+               if (enable) {
+                       ret = _wl_update_ap_rps_params(ndev);
+                       if (ret) {
+                               WL_ERR(("Filed to update rpsnoa params\n"));
+                               goto exit;
+                       }
+               }
+               bzero(&iovar, sizeof(iovar));
+               bzero(smbuf, sizeof(smbuf));
+
+               iovar.hdr.ver = RADIO_PWRSAVE_VERSION;
+               iovar.hdr.subcmd = WL_RPSNOA_CMD_ENABLE;
+               iovar.hdr.len = sizeof(iovar);
+               iovar.data->band = WLC_BAND_ALL;
+               iovar.data->value = (int16)enable;
+
+               ret = wldev_iovar_setbuf(ndev, "rpsnoa", &iovar, sizeof(iovar),
+                       smbuf, sizeof(smbuf), NULL);
+               if (ret) {
+                       WL_ERR(("Failed to enable AP radio power save"));
+                       goto exit;
+               }
+               cfg->ap_rps_info.enable = enable;
+       }
+exit:
+       return ret;
+}
+
+int
+wl_update_ap_rps_params(struct net_device *dev, ap_rps_info_t* rps, char *ifname)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhdp;
+       struct net_device *ndev = NULL;
+
+       dhdp = (dhd_pub_t *)(cfg->pub);
+
+       if (!dhdp)
+               return BCME_NOTUP;
+
+       if (!(dhdp->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+               WL_ERR(("Not Hostapd mode\n"));
+               return BCME_NOTAP;
+       }
+
+       ndev = wl_get_ap_netdev(cfg, ifname);
+
+       if (ndev == NULL) {
+               WL_ERR(("No softAP interface named %s\n", ifname));
+               return BCME_NOTAP;
+       }
+
+       if (!rps)
+               return BCME_BADARG;
+
+       if (rps->pps < RADIO_PWRSAVE_PPS_MIN)
+               return BCME_BADARG;
+
+       if (rps->level < RADIO_PWRSAVE_LEVEL_MIN ||
+               rps->level > RADIO_PWRSAVE_LEVEL_MAX)
+               return BCME_BADARG;
+
+       if (rps->quiet_time < RADIO_PWRSAVE_QUIETTIME_MIN)
+               return BCME_BADARG;
+
+       if (rps->sta_assoc_check > RADIO_PWRSAVE_ASSOCCHECK_MAX ||
+               rps->sta_assoc_check < RADIO_PWRSAVE_ASSOCCHECK_MIN)
+               return BCME_BADARG;
+
+       cfg->ap_rps_info.pps = rps->pps;
+       cfg->ap_rps_info.level = rps->level;
+       cfg->ap_rps_info.quiet_time = rps->quiet_time;
+       cfg->ap_rps_info.sta_assoc_check = rps->sta_assoc_check;
+
+       if (cfg->ap_rps_info.enable) {
+               if (_wl_update_ap_rps_params(ndev)) {
+                       WL_ERR(("Failed to update rpsnoa params"));
+                       return BCME_ERROR;
+               }
+       }
+
+       return BCME_OK;
+}
+
+void
+wl_cfg80211_init_ap_rps(struct bcm_cfg80211 *cfg)
+{
+       cfg->ap_rps_info.enable = FALSE;
+       cfg->ap_rps_info.sta_assoc_check = RADIO_PWRSAVE_STAS_ASSOC_CHECK;
+       cfg->ap_rps_info.pps = RADIO_PWRSAVE_PPS;
+       cfg->ap_rps_info.quiet_time = RADIO_PWRSAVE_QUIET_TIME;
+       cfg->ap_rps_info.level = RADIO_PWRSAVE_LEVEL;
+}
+#endif /* SUPPORT_AP_RADIO_PWRSAVE */
+
+int
+wl_cfg80211_iface_count(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       struct net_info *iter, *next;
+       int iface_count = 0;
+
+       /* Return the count of network interfaces (skip netless p2p discovery
+        * interface)
+        */
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       for_each_ndev(cfg, iter, next) {
+               GCC_DIAGNOSTIC_POP();
+               if (iter->ndev) {
+                       iface_count++;
+               }
+       }
+       return iface_count;
+}
+
+#ifdef WBTEXT
+static bool wl_cfg80211_wbtext_check_bssid_list(struct bcm_cfg80211 *cfg, struct ether_addr *ea)
+{
+       wl_wbtext_bssid_t *bssid = NULL;
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       /* check duplicate */
+       list_for_each_entry(bssid, &cfg->wbtext_bssid_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (!memcmp(bssid->ea.octet, ea, ETHER_ADDR_LEN)) {
+                       return FALSE;
+               }
+       }
+
+       return TRUE;
+}
+
+static bool wl_cfg80211_wbtext_add_bssid_list(struct bcm_cfg80211 *cfg, struct ether_addr *ea)
+{
+       wl_wbtext_bssid_t *bssid = NULL;
+       char eabuf[ETHER_ADDR_STR_LEN];
+
+       bssid = (wl_wbtext_bssid_t *)MALLOC(cfg->osh, sizeof(wl_wbtext_bssid_t));
+       if (bssid == NULL) {
+               WL_ERR(("alloc failed\n"));
+               return FALSE;
+       }
+
+       memcpy(bssid->ea.octet, ea, ETHER_ADDR_LEN);
+
+       INIT_LIST_HEAD(&bssid->list);
+       list_add_tail(&bssid->list, &cfg->wbtext_bssid_list);
+
+       WL_DBG(("add wbtext bssid : %s\n", bcm_ether_ntoa(ea, eabuf)));
+
+       return TRUE;
+}
+
+static void wl_cfg80211_wbtext_clear_bssid_list(struct bcm_cfg80211 *cfg)
+{
+       wl_wbtext_bssid_t *bssid = NULL;
+       char eabuf[ETHER_ADDR_STR_LEN];
+
+       while (!list_empty(&cfg->wbtext_bssid_list)) {
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               bssid = list_entry(cfg->wbtext_bssid_list.next, wl_wbtext_bssid_t, list);
+               GCC_DIAGNOSTIC_POP();
+               if (bssid) {
+                       WL_DBG(("clear wbtext bssid : %s\n", bcm_ether_ntoa(&bssid->ea, eabuf)));
+                       list_del(&bssid->list);
+                       MFREE(cfg->osh, bssid, sizeof(wl_wbtext_bssid_t));
+               }
+       }
+}
+
+static void wl_cfg80211_wbtext_update_rcc(struct bcm_cfg80211 *cfg, struct net_device *dev)
+{
+       struct wl_connect_info *conn_info = wl_to_conn(cfg);
+       bcm_tlv_t * cap_ie = NULL;
+       bool req_sent = FALSE;
+       struct wl_profile *profile;
+
+       WL_DBG(("Enter\n"));
+
+       profile = wl_get_profile_by_netdev(cfg, dev);
+       if (!profile) {
+               WL_ERR(("no profile exists\n"));
+               return;
+       }
+
+       if (wl_cfg80211_wbtext_check_bssid_list(cfg,
+                       (struct ether_addr *)&profile->bssid) == FALSE) {
+               WL_DBG(("already updated\n"));
+               return;
+       }
+
+       /* first, check NBR bit in RRM IE */
+       if ((cap_ie = bcm_parse_tlvs(conn_info->resp_ie, conn_info->resp_ie_len,
+                       DOT11_MNG_RRM_CAP_ID)) != NULL) {
+               if (isset(cap_ie->data, DOT11_RRM_CAP_NEIGHBOR_REPORT)) {
+                       WL_DBG(("sending neighbor report\n"));
+                       req_sent = wl_cfg80211_wbtext_send_nbr_req(cfg, dev, profile);
+               }
+       }
+
+       /* if RRM nbr was not supported, check BTM bit in extend cap. IE */
+       if (!req_sent) {
+               if ((cap_ie = bcm_parse_tlvs(conn_info->resp_ie, conn_info->resp_ie_len,
+                               DOT11_MNG_EXT_CAP_ID)) != NULL) {
+                       if (cap_ie->len >= DOT11_EXTCAP_LEN_BSSTRANS &&
+                                       isset(cap_ie->data, DOT11_EXT_CAP_BSSTRANS_MGMT)) {
+                               WL_DBG(("sending btm query\n"));
+                               wl_cfg80211_wbtext_send_btm_query(cfg, dev, profile);
+                       }
+               }
+       }
+}
+
+static bool wl_cfg80211_wbtext_send_nbr_req(struct bcm_cfg80211 *cfg, struct net_device *dev,
+       struct wl_profile *profile)
+{
+       int error = -1;
+       char *smbuf = NULL;
+       struct wl_connect_info *conn_info = wl_to_conn(cfg);
+       bcm_tlv_t * rrm_cap_ie = NULL;
+       wlc_ssid_t *ssid = NULL;
+       bool ret = FALSE;
+
+       WL_DBG(("Enter\n"));
+
+       /* check RRM nbr bit in extend cap. IE of assoc response */
+       if ((rrm_cap_ie = bcm_parse_tlvs(conn_info->resp_ie, conn_info->resp_ie_len,
+                       DOT11_MNG_RRM_CAP_ID)) != NULL) {
+               if (!isset(rrm_cap_ie->data, DOT11_RRM_CAP_NEIGHBOR_REPORT)) {
+                       WL_DBG(("AP doesn't support neighbor report\n"));
+                       return FALSE;
+               }
+       }
+
+       smbuf = (char *)MALLOCZ(cfg->osh, WLC_IOCTL_MAXLEN);
+       if (smbuf == NULL) {
+               WL_ERR(("failed to allocated memory\n"));
+               goto nbr_req_out;
+       }
+
+       ssid = (wlc_ssid_t *)MALLOCZ(cfg->osh, sizeof(wlc_ssid_t));
+       if (ssid == NULL) {
+               WL_ERR(("failed to allocated memory\n"));
+               goto nbr_req_out;
+       }
+
+       ssid->SSID_len = MIN(profile->ssid.SSID_len, DOT11_MAX_SSID_LEN);
+       memcpy(ssid->SSID, profile->ssid.SSID, ssid->SSID_len);
+
+       error = wldev_iovar_setbuf(dev, "rrm_nbr_req", ssid,
+               sizeof(wlc_ssid_t), smbuf, WLC_IOCTL_MAXLEN, NULL);
+       if (error == BCME_OK) {
+               ret = wl_cfg80211_wbtext_add_bssid_list(cfg,
+                       (struct ether_addr *)&profile->bssid);
+       } else {
+               WL_ERR(("failed to send neighbor report request, error=%d\n", error));
+       }
+
+nbr_req_out:
+       if (ssid) {
+               MFREE(cfg->osh, ssid, sizeof(wlc_ssid_t));
+       }
+
+       if (smbuf) {
+               MFREE(cfg->osh, smbuf, WLC_IOCTL_MAXLEN);
+       }
+       return ret;
+}
+
+static bool wl_cfg80211_wbtext_send_btm_query(struct bcm_cfg80211 *cfg, struct net_device *dev,
+       struct wl_profile *profile)
+
+{
+       int error = -1;
+       bool ret = FALSE;
+       wl_bsstrans_query_t btq;
+
+       WL_DBG(("Enter\n"));
+
+       bzero(&btq, sizeof(wl_bsstrans_query_t));
+
+       btq.version = WL_BSSTRANS_QUERY_VERSION_1;
+       error = wldev_iovar_setbuf(dev, "wnm_bsstrans_query", &btq,
+               sizeof(btq), cfg->ioctl_buf, WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync);
+       if (error == BCME_OK) {
+               ret = wl_cfg80211_wbtext_add_bssid_list(cfg,
+                       (struct ether_addr *)&profile->bssid);
+       } else {
+               WL_ERR(("wl_cfg80211_wbtext_send_btm_query: failed to set BTM query,"
+                       " error=%d\n", error));
+       }
+       return ret;
+}
+
+static void wl_cfg80211_wbtext_set_wnm_maxidle(struct bcm_cfg80211 *cfg, struct net_device *dev)
+{
+       keepalives_max_idle_t keepalive = {0, 0, 0, 0};
+       s32 bssidx, error;
+       int wnm_maxidle = 0;
+       struct wl_connect_info *conn_info = wl_to_conn(cfg);
+
+       /* AP supports wnm max idle ? */
+       if (bcm_parse_tlvs(conn_info->resp_ie, conn_info->resp_ie_len,
+                       DOT11_MNG_BSS_MAX_IDLE_PERIOD_ID) != NULL) {
+               error = wldev_iovar_getint(dev, "wnm_maxidle", &wnm_maxidle);
+               if (error < 0) {
+                       WL_ERR(("failed to get wnm max idle period : %d\n", error));
+               }
+       }
+
+       WL_DBG(("wnm max idle period : %d\n", wnm_maxidle));
+
+       /* if wnm maxidle has valid period, set it as keep alive */
+       if (wnm_maxidle > 0) {
+               keepalive.keepalive_count = 1;
+       }
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) >= 0) {
+               error = wldev_iovar_setbuf_bsscfg(dev, "wnm_keepalives_max_idle", &keepalive,
+                       sizeof(keepalives_max_idle_t), cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+                       bssidx, &cfg->ioctl_buf_sync);
+               if (error < 0) {
+                       if (error == BCME_BADARG) {
+                               WL_ERR(("set wnm_keepalive with invalid arguments\n"));
+                       } else {
+                               WL_ERR(("set wnm_keepalives_max_idle failed : %d\n", error));
+                       }
+               }
+       }
+}
+
+static int
+wl_cfg80211_recv_nbr_resp(struct net_device *dev, uint8 *body, uint body_len)
+{
+       dot11_rm_action_t *rm_rep;
+       bcm_tlv_t *tlvs;
+       uint tlv_len;
+       int i, error;
+       dot11_neighbor_rep_ie_t *nbr_rep_ie;
+       chanspec_t ch;
+       wl_roam_channel_list_t channel_list;
+       char iobuf[WLC_IOCTL_SMLEN];
+
+       if (body_len < DOT11_RM_ACTION_LEN) {
+               WL_ERR(("Received Neighbor Report frame with incorrect length %d\n",
+                       body_len));
+               return BCME_ERROR;
+       }
+
+       rm_rep = (dot11_rm_action_t *)body;
+       WL_DBG(("received neighbor report (token = %d)\n", rm_rep->token));
+
+       tlvs = (bcm_tlv_t *)&rm_rep->data[0];
+
+       tlv_len = body_len - DOT11_RM_ACTION_LEN;
+
+       while (tlvs && tlvs->id == DOT11_MNG_NEIGHBOR_REP_ID) {
+               nbr_rep_ie = (dot11_neighbor_rep_ie_t *)tlvs;
+
+               if (nbr_rep_ie->len < DOT11_NEIGHBOR_REP_IE_FIXED_LEN) {
+                       WL_ERR(("malformed Neighbor Report element with length %d\n",
+                               nbr_rep_ie->len));
+                       tlvs = bcm_next_tlv(tlvs, &tlv_len);
+                       continue;
+               }
+
+               ch = CH20MHZ_CHSPEC(nbr_rep_ie->channel);
+               WL_DBG(("ch:%d, bssid:"MACDBG"\n",
+                       ch, MAC2STRDBG(nbr_rep_ie->bssid.octet)));
+
+               /* get RCC list */
+               error = wldev_iovar_getbuf(dev, "roamscan_channels", 0, 0,
+                       (void *)&channel_list, sizeof(channel_list), NULL);
+               if (error) {
+                       WL_ERR(("Failed to get roamscan channels, error = %d\n", error));
+                       return BCME_ERROR;
+               }
+
+               /* update RCC */
+               if (channel_list.n < MAX_ROAM_CHANNEL) {
+                       for (i = 0; i < channel_list.n; i++) {
+                               if (channel_list.channels[i] == ch) {
+                                       break;
+                               }
+                       }
+                       if (i == channel_list.n) {
+                               channel_list.channels[channel_list.n] = ch;
+                               channel_list.n++;
+                       }
+               }
+
+               /* set RCC list */
+               error = wldev_iovar_setbuf(dev, "roamscan_channels", &channel_list,
+                       sizeof(channel_list), iobuf, sizeof(iobuf), NULL);
+               if (error) {
+                       WL_DBG(("Failed to set roamscan channels, error = %d\n", error));
+               }
+
+               tlvs = bcm_next_tlv(tlvs, &tlv_len);
+       }
+
+       return BCME_OK;
+}
+#endif /* WBTEXT */
+#ifdef SUPPORT_SET_CAC
+static void
+wl_cfg80211_set_cac(struct bcm_cfg80211 *cfg, int enable)
+{
+       int ret = 0;
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+       WL_DBG(("cac enable %d\n", enable));
+       if (!dhd) {
+               WL_ERR(("dhd is NULL\n"));
+               return;
+       }
+       if ((ret = dhd_wl_ioctl_set_intiovar(dhd, "cac", enable,
+                       WLC_SET_VAR, TRUE, 0)) < 0) {
+               WL_ERR(("Failed set CAC, ret=%d\n", ret));
+       } else {
+               WL_DBG(("CAC set successfully\n"));
+       }
+       return;
+}
+#endif /* SUPPORT_SET_CAC */
+
+#ifdef SUPPORT_RSSI_SUM_REPORT
+int
+wl_get_rssi_per_ant(struct net_device *dev, char *ifname, char *peer_mac, void *param)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       wl_rssi_ant_mimo_t *get_param = (wl_rssi_ant_mimo_t *)param;
+       rssi_ant_param_t *set_param = NULL;
+       struct net_device *ifdev = NULL;
+       char iobuf[WLC_IOCTL_SMLEN];
+       int err = BCME_OK;
+       int iftype = 0;
+
+       bzero(iobuf, WLC_IOCTL_SMLEN);
+
+       /* Check the interface type */
+       ifdev = wl_get_netdev_by_name(cfg, ifname);
+       if (ifdev == NULL) {
+               WL_ERR(("Could not find net_device for ifname:%s\n", ifname));
+               err = BCME_BADARG;
+               goto fail;
+       }
+
+       iftype = ifdev->ieee80211_ptr->iftype;
+       if (iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO) {
+               if (peer_mac) {
+                       set_param = (rssi_ant_param_t *)MALLOCZ(cfg->osh, sizeof(rssi_ant_param_t));
+                       err = wl_cfg80211_ether_atoe(peer_mac, &set_param->ea);
+                       if (!err) {
+                               WL_ERR(("Invalid Peer MAC format\n"));
+                               err = BCME_BADARG;
+                               goto fail;
+                       }
+               } else {
+                       WL_ERR(("Peer MAC is not provided for iftype %d\n", iftype));
+                       err = BCME_BADARG;
+                       goto fail;
+               }
+       }
+
+       err = wldev_iovar_getbuf(ifdev, "phy_rssi_ant", peer_mac ?
+               (void *)&(set_param->ea) : NULL, peer_mac ? ETHER_ADDR_LEN : 0,
+               (void *)iobuf, sizeof(iobuf), NULL);
+       if (unlikely(err)) {
+               WL_ERR(("Failed to get rssi info, err=%d\n", err));
+       } else {
+               memcpy(get_param, iobuf, sizeof(wl_rssi_ant_mimo_t));
+               if (get_param->count == 0) {
+                       WL_ERR(("Not supported on this chip\n"));
+                       err = BCME_UNSUPPORTED;
+               }
+       }
+
+fail:
+       if (set_param) {
+               MFREE(cfg->osh, set_param, sizeof(rssi_ant_param_t));
+       }
+
+       return err;
+}
+
+int
+wl_get_rssi_logging(struct net_device *dev, void *param)
+{
+       rssilog_get_param_t *get_param = (rssilog_get_param_t *)param;
+       char iobuf[WLC_IOCTL_SMLEN];
+       int err = BCME_OK;
+
+       bzero(iobuf, WLC_IOCTL_SMLEN);
+       bzero(get_param, sizeof(*get_param));
+       err = wldev_iovar_getbuf(dev, "rssilog", NULL, 0, (void *)iobuf,
+               sizeof(iobuf), NULL);
+       if (err) {
+               WL_ERR(("Failed to get rssi logging info, err=%d\n", err));
+       } else {
+               memcpy(get_param, iobuf, sizeof(*get_param));
+       }
+
+       return err;
+}
+
+int
+wl_set_rssi_logging(struct net_device *dev, void *param)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       rssilog_set_param_t *set_param = (rssilog_set_param_t *)param;
+       int err;
+
+       err = wldev_iovar_setbuf(dev, "rssilog", set_param,
+               sizeof(*set_param), cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+               &cfg->ioctl_buf_sync);
+       if (err) {
+               WL_ERR(("Failed to set rssi logging param, err=%d\n", err));
+       }
+
+       return err;
+}
+#endif /* SUPPORT_RSSI_SUM_REPORT */
+/* Function to flush the FW preserve buffer content
+* The buffer content is sent to host in form of events.
+*/
+void
+wl_flush_fw_log_buffer(struct net_device *dev, uint32 logset_mask)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       int i;
+       int err = 0;
+       u8 buf[WLC_IOCTL_SMLEN] = {0};
+       wl_el_set_params_t set_param;
+
+       /* Set the size of data to retrieve */
+       memset(&set_param, 0, sizeof(set_param));
+       set_param.size = WLC_IOCTL_SMLEN;
+
+       for (i = 0; i < dhd->event_log_max_sets; i++)
+       {
+               if ((0x01u << i) & logset_mask) {
+                       set_param.set = i;
+                       err = wldev_iovar_setbuf(dev, "event_log_get", &set_param,
+                               sizeof(struct wl_el_set_params_s), buf, WLC_IOCTL_SMLEN,
+                               NULL);
+                       if (err) {
+                               WL_DBG(("Failed to get fw preserve logs, err=%d\n", err));
+                       }
+               }
+       }
+}
+#ifdef USE_WFA_CERT_CONF
+extern int g_frameburst;
+#endif /* USE_WFA_CERT_CONF */
+
+int
+wl_cfg80211_set_frameburst(struct bcm_cfg80211 *cfg, bool enable)
+{
+       int ret = BCME_OK;
+       int val = enable ? 1 : 0;
+
+#ifdef USE_WFA_CERT_CONF
+       if (!g_frameburst) {
+               WL_DBG(("Skip setting frameburst\n"));
+               return 0;
+       }
+#endif /* USE_WFA_CERT_CONF */
+
+       WL_DBG(("Set frameburst %d\n", val));
+       ret = wldev_ioctl_set(bcmcfg_to_prmry_ndev(cfg), WLC_SET_FAKEFRAG, &val, sizeof(val));
+       if (ret < 0) {
+               WL_ERR(("Failed set frameburst, ret=%d\n", ret));
+       } else {
+               WL_INFORM_MEM(("frameburst is %s\n", enable ? "enabled" : "disabled"));
+       }
+
+       return ret;
+}
+
+s32
+wl_cfg80211_set_dbg_verbose(struct net_device *ndev, u32 level)
+{
+       /* configure verbose level for debugging */
+       if (level) {
+               /* Enable increased verbose */
+               wl_dbg_level |= WL_DBG_DBG;
+       } else {
+               /* Disable */
+               wl_dbg_level &= ~WL_DBG_DBG;
+       }
+       WL_INFORM(("debug verbose set to %d\n", level));
+
+       return BCME_OK;
+}
+
+const u8 *
+wl_find_attribute(const u8 *buf, u16 len, u16 element_id)
+{
+       const u8 *attrib;
+       u16 attrib_id;
+       u16 attrib_len;
+
+       if (!buf) {
+               WL_ERR(("buf null\n"));
+               return NULL;
+       }
+
+       attrib = buf;
+       while (len >= 4) {
+               /* attribute id */
+               attrib_id = *attrib++ << 8;
+               attrib_id |= *attrib++;
+               len -= 2;
+
+               /* 2-byte little endian */
+               attrib_len = *attrib++ << 8;
+               attrib_len |= *attrib++;
+
+               len -= 2;
+               if (attrib_id == element_id) {
+                       /* This will point to start of subelement attrib after
+                        * attribute id & len
+                        */
+                       return attrib;
+               }
+               if (len > attrib_len) {
+                       len -= attrib_len;      /* for the remaining subelt fields */
+                       WL_DBG(("Attribue:%4x attrib_len:%d rem_len:%d\n",
+                               attrib_id, attrib_len, len));
+
+                       /* Go to next subelement */
+                       attrib += attrib_len;
+               } else {
+                       WL_ERR(("Incorrect Attribue:%4x attrib_len:%d\n",
+                               attrib_id, attrib_len));
+                       return NULL;
+               }
+       }
+       return NULL;
+}
+
+uint8 wl_cfg80211_get_bus_state(struct bcm_cfg80211 *cfg)
+{
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       WL_INFORM(("dhd->hang_was_sent = %d and busstate = %d\n",
+                       dhd->hang_was_sent, dhd->busstate));
+       return ((dhd->busstate == DHD_BUS_DOWN) || dhd->hang_was_sent);
+}
+
+#ifdef WL_WPS_SYNC
+static void wl_wps_reauth_timeout(unsigned long data)
+{
+       struct net_device *ndev = (struct net_device *)data;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       s32 inst;
+       unsigned long flags;
+
+       WL_CFG_WPS_SYNC_LOCK(&cfg->wps_sync, flags);
+       inst = wl_get_wps_inst_match(cfg, ndev);
+       if (inst >= 0) {
+               WL_ERR(("[%s][WPS] Reauth Timeout Inst:%d! state:%d\n",
+                               ndev->name, inst, cfg->wps_session[inst].state));
+               if (cfg->wps_session[inst].state == WPS_STATE_REAUTH_WAIT) {
+                       /* Session should get deleted from success (linkup) or
+                        * deauth case. Just in case, link reassoc failed, clear
+                        * state here.
+                        */
+                       WL_ERR(("[%s][WPS] Reauth Timeout Inst:%d!\n",
+                               ndev->name, inst));
+                       cfg->wps_session[inst].state = WPS_STATE_IDLE;
+                       cfg->wps_session[inst].in_use = false;
+               }
+       }
+       WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+}
+
+static void wl_init_wps_reauth_sm(struct bcm_cfg80211 *cfg)
+{
+       /* Only two instances are supported as of now. one for
+        * infra STA and other for infra STA/GC.
+        */
+       int i = 0;
+       struct net_device *pdev = bcmcfg_to_prmry_ndev(cfg);
+
+       spin_lock_init(&cfg->wps_sync);
+       for (i = 0; i < WPS_MAX_SESSIONS; i++) {
+               /* Init scan_timeout timer */
+               init_timer_compat(&cfg->wps_session[i].timer, wl_wps_reauth_timeout, pdev);
+               cfg->wps_session[i].in_use = false;
+               cfg->wps_session[i].state = WPS_STATE_IDLE;
+       }
+}
+
+static void wl_deinit_wps_reauth_sm(struct bcm_cfg80211 *cfg)
+{
+       int i = 0;
+
+       for (i = 0; i < WPS_MAX_SESSIONS; i++) {
+               cfg->wps_session[i].in_use = false;
+               cfg->wps_session[i].state = WPS_STATE_IDLE;
+               if (timer_pending(&cfg->wps_session[i].timer)) {
+                       del_timer_sync(&cfg->wps_session[i].timer);
+               }
+       }
+
+}
+
+static s32
+wl_get_free_wps_inst(struct bcm_cfg80211 *cfg)
+{
+       int i;
+
+       for (i = 0; i < WPS_MAX_SESSIONS; i++) {
+               if (!cfg->wps_session[i].in_use) {
+                       return i;
+               }
+       }
+       return BCME_ERROR;
+}
+
+static s32
+wl_get_wps_inst_match(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       int i;
+
+       for (i = 0; i < WPS_MAX_SESSIONS; i++) {
+               if ((cfg->wps_session[i].in_use) &&
+                       (ndev == cfg->wps_session[i].ndev)) {
+                       return i;
+               }
+       }
+
+       return BCME_ERROR;
+}
+
+static s32
+wl_wps_session_add(struct net_device *ndev, u16 mode, u8 *mac_addr)
+{
+       s32 inst;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       unsigned long flags;
+
+       WL_CFG_WPS_SYNC_LOCK(&cfg->wps_sync, flags);
+       /* Fetch and initialize a wps instance */
+       inst = wl_get_free_wps_inst(cfg);
+       if (inst == BCME_ERROR) {
+               WL_ERR(("[WPS] No free insance\n"));
+               WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+               return BCME_ERROR;
+       }
+       cfg->wps_session[inst].in_use = true;
+       cfg->wps_session[inst].state = WPS_STATE_STARTED;
+       cfg->wps_session[inst].ndev = ndev;
+       cfg->wps_session[inst].mode = mode;
+       /* return check not required since both buffer lens are same */
+       (void)memcpy_s(cfg->wps_session[inst].peer_mac, ETH_ALEN, mac_addr, ETH_ALEN);
+       WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+
+       WL_INFORM_MEM(("[%s][WPS] session created.  Peer: " MACDBG "\n",
+               ndev->name, MAC2STRDBG(mac_addr)));
+       return BCME_OK;
+}
+
+static void
+wl_wps_session_del(struct net_device *ndev)
+{
+       s32 inst;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       unsigned long flags;
+       u16 cur_state;
+
+       WL_CFG_WPS_SYNC_LOCK(&cfg->wps_sync, flags);
+
+       /* Get current instance for the given ndev */
+       inst = wl_get_wps_inst_match(cfg, ndev);
+       if (inst == BCME_ERROR) {
+               WL_DBG(("[WPS] instance match NOT found\n"));
+               WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+               return;
+       }
+
+       cur_state = cfg->wps_session[inst].state;
+       if (cur_state != WPS_STATE_DONE) {
+               WL_DBG(("[WPS] wrong state:%d\n", cur_state));
+               WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+               return;
+       }
+
+       /* Mark this as unused */
+       cfg->wps_session[inst].in_use = false;
+       cfg->wps_session[inst].state = WPS_STATE_IDLE;
+       WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+
+       /* Ensure this API is called from sleepable context. */
+       if (timer_pending(&cfg->wps_session[inst].timer)) {
+               del_timer_sync(&cfg->wps_session[inst].timer);
+       }
+
+       WL_INFORM_MEM(("[%s][WPS] session deleted\n", ndev->name));
+}
+
+static void
+wl_wps_handle_ifdel(struct net_device *ndev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       unsigned long flags;
+       u16 cur_state;
+       s32 inst;
+
+       WL_CFG_WPS_SYNC_LOCK(&cfg->wps_sync, flags);
+       inst = wl_get_wps_inst_match(cfg, ndev);
+       if (inst == BCME_ERROR) {
+               WL_DBG(("[WPS] instance match NOT found\n"));
+               WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+               return;
+       }
+       cur_state = cfg->wps_session[inst].state;
+       cfg->wps_session[inst].state = WPS_STATE_DONE;
+       WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+
+       WL_INFORM_MEM(("[%s][WPS] state:%x\n", ndev->name, cur_state));
+       if (cur_state > WPS_STATE_IDLE) {
+               wl_wps_session_del(ndev);
+       }
+}
+
+static s32
+wl_wps_handle_sta_linkdown(struct net_device *ndev, u16 inst)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       unsigned long flags;
+       u16 cur_state;
+       bool wps_done = false;
+
+       WL_CFG_WPS_SYNC_LOCK(&cfg->wps_sync, flags);
+       cur_state = cfg->wps_session[inst].state;
+       if (cur_state == WPS_STATE_REAUTH_WAIT) {
+               WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+               wl_clr_drv_status(cfg, CONNECTED, ndev);
+               wl_clr_drv_status(cfg, DISCONNECTING, ndev);
+               WL_INFORM_MEM(("[%s][WPS] REAUTH link down\n", ndev->name));
+               /* Drop the link down event while we are waiting for reauth */
+               return BCME_UNSUPPORTED;
+       } else if (cur_state == WPS_STATE_STARTED) {
+               /* Link down before reaching EAP-FAIL. End WPS session */
+               cfg->wps_session[inst].state = WPS_STATE_DONE;
+               wps_done = true;
+               WL_INFORM_MEM(("[%s][WPS] link down after wps start\n", ndev->name));
+       } else {
+               WL_DBG(("[%s][WPS] link down in state:%d\n",
+                       ndev->name, cur_state));
+       }
+
+       WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+
+       if (wps_done) {
+               wl_wps_session_del(ndev);
+       }
+       return BCME_OK;
+}
+
+static s32
+wl_wps_handle_peersta_linkdown(struct net_device *ndev, u16 inst, const u8 *peer_mac)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       unsigned long flags;
+       u16 cur_state;
+       s32 ret = BCME_OK;
+       bool wps_done = false;
+
+       WL_CFG_WPS_SYNC_LOCK(&cfg->wps_sync, flags);
+       cur_state = cfg->wps_session[inst].state;
+
+       if (!peer_mac) {
+               WL_ERR(("Invalid arg\n"));
+               ret = BCME_ERROR;
+               goto exit;
+       }
+
+       /* AP/GO can have multiple clients. so validate peer_mac addr
+        * and ensure states are updated only for right peer.
+        */
+       if (memcmp(cfg->wps_session[inst].peer_mac, peer_mac, ETH_ALEN)) {
+               /* Mac addr not matching. Ignore. */
+               WL_DBG(("[%s][WPS] No active WPS session"
+                       "for the peer:" MACDBG "\n", ndev->name, MAC2STRDBG(peer_mac)));
+               ret = BCME_OK;
+               goto exit;
+       }
+       if (cur_state == WPS_STATE_REAUTH_WAIT) {
+               WL_INFORM_MEM(("[%s][WPS] REAUTH link down."
+                       " Peer: " MACDBG "\n",
+                       ndev->name, MAC2STRDBG(peer_mac)));
+#ifdef NOT_YET
+               /* Link down during REAUTH state is expected. However,
+                * if this is send up, hostapd statemachine issues a
+                * deauth down and that may pre-empt WPS reauth state
+                * at GC.
+                */
+               WL_INFORM_MEM(("[%s][WPS] REAUTH link down. Ignore."
+                       " for client:" MACDBG "\n",
+                       ndev->name, MAC2STRDBG(peer_mac)));
+               ret = BCME_UNSUPPORTED;
+#endif
+       } else if (cur_state == WPS_STATE_STARTED) {
+               /* Link down before reaching REAUTH_WAIT state. WPS
+                * session ended.
+                */
+               cfg->wps_session[inst].state = WPS_STATE_DONE;
+               WL_INFORM_MEM(("[%s][WPS] link down after wps start"
+                       " client:" MACDBG "\n",
+                       ndev->name, MAC2STRDBG(peer_mac)));
+               wps_done = true;
+               /* since we have freed lock above, return from here */
+               ret = BCME_OK;
+       } else {
+               WL_ERR(("[%s][WPS] Unsupported state:%d",
+                       ndev->name, cur_state));
+               ret = BCME_ERROR;
+       }
+exit:
+       WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+       if (wps_done) {
+               wl_wps_session_del(ndev);
+       }
+       return ret;
+}
+
+static s32
+wl_wps_handle_sta_linkup(struct net_device *ndev, u16 inst)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       unsigned long flags;
+       u16 cur_state;
+       s32 ret = BCME_OK;
+       bool wps_done = false;
+
+       WL_CFG_WPS_SYNC_LOCK(&cfg->wps_sync, flags);
+       cur_state = cfg->wps_session[inst].state;
+       if (cur_state == WPS_STATE_REAUTH_WAIT) {
+               /* WPS session succeeded. del session. */
+               cfg->wps_session[inst].state = WPS_STATE_DONE;
+               wps_done = true;
+               WL_INFORM_MEM(("[%s][WPS] WPS_REAUTH link up (WPS DONE)\n", ndev->name));
+               ret = BCME_OK;
+       } else {
+               WL_ERR(("[%s][WPS] unexpected link up in state:%d \n",
+                       ndev->name, cur_state));
+               ret = BCME_ERROR;
+       }
+       WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+       if (wps_done) {
+               wl_wps_session_del(ndev);
+       }
+       return ret;
+}
+
+static s32
+wl_wps_handle_peersta_linkup(struct net_device *ndev, u16 inst, const u8 *peer_mac)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       unsigned long flags;
+       u16 cur_state;
+       s32 ret = BCME_OK;
+
+       WL_CFG_WPS_SYNC_LOCK(&cfg->wps_sync, flags);
+       cur_state = cfg->wps_session[inst].state;
+
+       /* For AP case, check whether call came for right peer */
+       if (!peer_mac ||
+               memcmp(cfg->wps_session[inst].peer_mac, peer_mac, ETH_ALEN)) {
+               WL_ERR(("[WPS] macaddr mismatch\n"));
+               WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+               /* Mac addr not matching. Ignore. */
+               return BCME_ERROR;
+       }
+
+       if (cur_state == WPS_STATE_REAUTH_WAIT) {
+               WL_INFORM_MEM(("[%s][WPS] REAUTH link up\n", ndev->name));
+               ret = BCME_OK;
+       } else {
+               WL_INFORM_MEM(("[%s][WPS] unexpected link up in state:%d \n",
+                       ndev->name, cur_state));
+               ret = BCME_ERROR;
+       }
+
+       WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+
+       return ret;
+}
+
+static s32
+wl_wps_handle_authorize(struct net_device *ndev, u16 inst, const u8 *peer_mac)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       unsigned long flags;
+       u16 cur_state;
+       bool wps_done = false;
+       s32 ret = BCME_OK;
+
+       WL_CFG_WPS_SYNC_LOCK(&cfg->wps_sync, flags);
+       cur_state = cfg->wps_session[inst].state;
+
+       /* For AP case, check whether call came for right peer */
+       if (!peer_mac ||
+               memcmp(cfg->wps_session[inst].peer_mac, peer_mac, ETH_ALEN)) {
+               WL_ERR(("[WPS] macaddr mismatch\n"));
+               WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+               /* Mac addr not matching. Ignore. */
+               return BCME_ERROR;
+       }
+
+       if (cur_state == WPS_STATE_REAUTH_WAIT) {
+               /* WPS session succeeded. del session. */
+               cfg->wps_session[inst].state = WPS_STATE_DONE;
+               wps_done = true;
+               WL_INFORM_MEM(("[%s][WPS] Authorize done (WPS DONE)\n", ndev->name));
+               ret = BCME_OK;
+       } else {
+               WL_INFORM_MEM(("[%s][WPS] unexpected Authorize in state:%d \n",
+                       ndev->name, cur_state));
+               ret = BCME_ERROR;
+       }
+
+       WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+       if (wps_done) {
+               wl_wps_session_del(ndev);
+       }
+       return ret;
+}
+
+static s32
+wl_wps_handle_reauth(struct net_device *ndev, u16 inst, const u8 *peer_mac)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       unsigned long flags;
+       u16 cur_state;
+       u16 mode;
+       s32 ret = BCME_OK;
+
+       WL_CFG_WPS_SYNC_LOCK(&cfg->wps_sync, flags);
+       cur_state = cfg->wps_session[inst].state;
+       mode = cfg->wps_session[inst].mode;
+
+       if (((mode == WL_MODE_BSS) && (cur_state == WPS_STATE_STARTED)) ||
+               ((mode == WL_MODE_AP) && (cur_state == WPS_STATE_M8_SENT))) {
+               /* Move to reauth wait */
+               cfg->wps_session[inst].state = WPS_STATE_REAUTH_WAIT;
+               /* Use ndev to find the wps instance which fired the timer */
+               timer_set_private(&cfg->wps_session[inst].timer, ndev);
+               WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+               mod_timer(&cfg->wps_session[inst].timer,
+                       jiffies + msecs_to_jiffies(WL_WPS_REAUTH_TIMEOUT));
+               WL_INFORM_MEM(("[%s][WPS] STATE_REAUTH_WAIT mode:%d Peer: " MACDBG "\n",
+                       ndev->name, mode, MAC2STRDBG(peer_mac)));
+               return BCME_OK;
+       } else {
+               /* 802.1x cases */
+               WL_DBG(("[%s][WPS] EAP-FAIL\n", ndev->name));
+       }
+       WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+       return ret;
+}
+
+static s32
+wl_wps_handle_disconnect(struct net_device *ndev, u16 inst, const u8 *peer_mac)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       unsigned long flags;
+       u16 cur_state;
+       s32 ret = BCME_OK;
+
+       WL_CFG_WPS_SYNC_LOCK(&cfg->wps_sync, flags);
+       cur_state = cfg->wps_session[inst].state;
+       /* If Disconnect command comes from  user space for STA/GC,
+        * respond with event without waiting for event from fw as
+        * it would be dropped by the WPS_SYNC code.
+        */
+       if (cur_state == WPS_STATE_REAUTH_WAIT) {
+               if (ETHER_ISBCAST(peer_mac)) {
+                       WL_DBG(("[WPS] Bcast peer. Do nothing.\n"));
+               } else {
+                       /* Notify link down */
+                       CFG80211_DISCONNECTED(ndev,
+                               WLAN_REASON_DEAUTH_LEAVING, NULL, 0,
+                               true, GFP_ATOMIC);
+               }
+       } else {
+               WL_DBG(("[%s][WPS] Not valid state to report disconnected:%d",
+                       ndev->name, cur_state));
+               ret = BCME_UNSUPPORTED;
+       }
+       WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+       return ret;
+}
+
+static s32
+wl_wps_handle_disconnect_client(struct net_device *ndev, u16 inst, const u8 *peer_mac)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       unsigned long flags;
+       u16 cur_state;
+       s32 ret = BCME_OK;
+       bool wps_done = false;
+
+       WL_CFG_WPS_SYNC_LOCK(&cfg->wps_sync, flags);
+       cur_state = cfg->wps_session[inst].state;
+       /* For GO/AP, ignore disconnect client during reauth state */
+       if (cur_state == WPS_STATE_REAUTH_WAIT) {
+               if (ETHER_ISBCAST(peer_mac)) {
+                       /* If there is broadcast deauth, then mark wps session as ended */
+                       cfg->wps_session[inst].state = WPS_STATE_DONE;
+                       wps_done = true;
+                       WL_INFORM_MEM(("[%s][WPS] BCAST deauth. WPS stopped.\n", ndev->name));
+                       ret = BCME_OK;
+                       goto exit;
+               } else if (!(memcmp(cfg->wps_session[inst].peer_mac,
+                       peer_mac, ETH_ALEN))) {
+                       WL_ERR(("[%s][WPS] Drop disconnect client\n", ndev->name));
+                       ret = BCME_UNSUPPORTED;
+               }
+       }
+
+exit:
+       WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+       if (wps_done) {
+               wl_wps_session_del(ndev);
+       }
+       return ret;
+}
+
+static s32
+wl_wps_handle_connect_fail(struct net_device *ndev, u16 inst)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       unsigned long flags;
+       u16 cur_state;
+       bool wps_done = false;
+
+       WL_CFG_WPS_SYNC_LOCK(&cfg->wps_sync, flags);
+       cur_state = cfg->wps_session[inst].state;
+       if (cur_state == WPS_STATE_REAUTH_WAIT) {
+               cfg->wps_session[inst].state = WPS_STATE_DONE;
+               wps_done = true;
+               WL_INFORM_MEM(("[%s][WPS] Connect fail. WPS stopped.\n",
+                       ndev->name));
+       } else {
+               WL_ERR(("[%s][WPS] Connect fail. state:%d\n",
+                       ndev->name, cur_state));
+       }
+       WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+       if (wps_done) {
+               wl_wps_session_del(ndev);
+       }
+       return BCME_OK;
+}
+
+static s32
+wl_wps_handle_m8_sent(struct net_device *ndev, u16 inst, const u8 *peer_mac)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       unsigned long flags;
+       u16 cur_state;
+       s32 ret = BCME_OK;
+
+       WL_CFG_WPS_SYNC_LOCK(&cfg->wps_sync, flags);
+       cur_state = cfg->wps_session[inst].state;
+
+       if (cur_state == WPS_STATE_STARTED) {
+               /* Move to M8 sent state */
+               cfg->wps_session[inst].state = WPS_STATE_M8_SENT;
+               WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+               return BCME_OK;
+       } else {
+               /* 802.1x cases */
+               WL_DBG(("[%s][WPS] Not valid state to send M8\n", ndev->name));
+       }
+       WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+       return ret;
+}
+
+static s32
+wl_wps_session_update(struct net_device *ndev, u16 state, const u8 *peer_mac)
+{
+       s32 inst;
+       u16 mode;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       s32 ret = BCME_ERROR;
+       unsigned long flags;
+
+       WL_CFG_WPS_SYNC_LOCK(&cfg->wps_sync, flags);
+       /* Get current instance for the given ndev */
+       inst = wl_get_wps_inst_match(cfg, ndev);
+       if (inst == BCME_ERROR) {
+               /* No active WPS session. Do Nothing. */
+               WL_DBG(("[%s][WPS] No matching instance.\n", ndev->name));
+               WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+               return BCME_NOTFOUND;
+       }
+       mode = cfg->wps_session[inst].mode;
+       WL_CFG_WPS_SYNC_UNLOCK(&cfg->wps_sync, flags);
+
+       WL_DBG(("[%s][WPS] state:%d mode:%d Peer: " MACDBG "\n",
+               ndev->name, state, mode, MAC2STRDBG(peer_mac)));
+
+       switch (state) {
+               case WPS_STATE_M8_RECVD:
+               {
+                       /* Occasionally, due to race condition between ctrl
+                        * and data path, deauth ind is recvd before EAP-FAIL.
+                        * Ignore deauth ind before EAP-FAIL
+                        * So move to REAUTH WAIT on receiving M8 on GC and
+                        * ignore deauth ind before EAP-FAIL till 'x' timeout.
+                        * Kickoff a timer to monitor reauth status.
+                        */
+                       if (mode == WL_MODE_BSS) {
+                               ret = wl_wps_handle_reauth(ndev, inst, peer_mac);
+                       } else {
+                               /* Nothing to be done for AP/GO mode */
+                               ret = BCME_OK;
+                       }
+                       break;
+               }
+               case WPS_STATE_M8_SENT:
+               {
+                       /* Mantain the M8 sent state to verify
+                        * EAP-FAIL sent is valid
+                        */
+                       if (mode == WL_MODE_AP) {
+                               ret = wl_wps_handle_m8_sent(ndev, inst, peer_mac);
+                       } else {
+                               /* Nothing to be done for STA/GC mode */
+                               ret = BCME_OK;
+                       }
+                       break;
+               }
+               case WPS_STATE_EAP_FAIL:
+               {
+                       /* Move to REAUTH WAIT following EAP-FAIL TX on GO/AP.
+                        * Kickoff a timer to monitor reauth status
+                        */
+                       if (mode == WL_MODE_AP) {
+                               ret = wl_wps_handle_reauth(ndev, inst, peer_mac);
+                       } else {
+                               /* Nothing to be done for STA/GC mode */
+                               ret = BCME_OK;
+                       }
+                       break;
+               }
+               case WPS_STATE_LINKDOWN:
+               {
+                       if (mode == WL_MODE_BSS) {
+                               ret = wl_wps_handle_sta_linkdown(ndev, inst);
+                       } else if (mode == WL_MODE_AP) {
+                               /* Take action only for matching peer mac */
+                               if (!memcmp(cfg->wps_session[inst].peer_mac, peer_mac, ETH_ALEN)) {
+                                       ret = wl_wps_handle_peersta_linkdown(ndev, inst, peer_mac);
+                               }
+                       }
+                       break;
+               }
+               case WPS_STATE_LINKUP:
+               {
+                       if (mode == WL_MODE_BSS) {
+                               wl_wps_handle_sta_linkup(ndev, inst);
+                       } else if (mode == WL_MODE_AP) {
+                               /* Take action only for matching peer mac */
+                               if (!memcmp(cfg->wps_session[inst].peer_mac, peer_mac, ETH_ALEN)) {
+                                       wl_wps_handle_peersta_linkup(ndev, inst, peer_mac);
+                               }
+                       }
+                       break;
+               }
+               case WPS_STATE_DISCONNECT_CLIENT:
+               {
+                       /* Disconnect STA/GC command from user space */
+                       if (mode == WL_MODE_AP) {
+                               ret = wl_wps_handle_disconnect_client(ndev, inst, peer_mac);
+                       } else {
+                               WL_ERR(("[WPS] Unsupported mode %d\n", mode));
+                       }
+                       break;
+               }
+               case WPS_STATE_DISCONNECT:
+               {
+                       /* Disconnect command on STA/GC interface */
+                       if (mode == WL_MODE_BSS) {
+                               ret = wl_wps_handle_disconnect(ndev, inst, peer_mac);
+                       }
+                       break;
+               }
+               case WPS_STATE_CONNECT_FAIL:
+               {
+                       if (mode == WL_MODE_BSS) {
+                               ret = wl_wps_handle_connect_fail(ndev, inst);
+                       } else {
+                               WL_ERR(("[WPS] Unsupported mode %d\n", mode));
+                       }
+                       break;
+               }
+               case WPS_STATE_AUTHORIZE:
+               {
+                       if (mode == WL_MODE_AP) {
+                               /* Take action only for matching peer mac */
+                               if (!memcmp(cfg->wps_session[inst].peer_mac, peer_mac, ETH_ALEN)) {
+                                       wl_wps_handle_authorize(ndev, inst, peer_mac);
+                               } else {
+                                       WL_INFORM_MEM(("[WPS] Authorize Request for wrong peer\n"));
+                               }
+                       }
+                       break;
+               }
+
+       default:
+               WL_ERR(("[WPS] Unsupported state:%d mode:%d\n", state, mode));
+               ret = BCME_ERROR;
+       }
+
+       return ret;
+}
+
+#define EAP_EXP_ATTRIB_DATA_OFFSET 14
+void
+wl_handle_wps_states(struct net_device *ndev, u8 *pkt, u16 len, bool direction)
+{
+       eapol_header_t *eapol_hdr;
+       bool tx_packet = direction;
+       u16 eapol_type;
+       u16 mode;
+       u8 *peer_mac;
+
+       if (!ndev || !pkt) {
+               WL_ERR(("[WPS] Invalid arg\n"));
+               return;
+       }
+
+       if (len < (ETHER_HDR_LEN + EAPOL_HDR_LEN)) {
+               WL_ERR(("[WPS] Invalid len\n"));
+               return;
+       }
+
+       eapol_hdr = (eapol_header_t *)pkt;
+       eapol_type = eapol_hdr->type;
+
+       peer_mac = tx_packet ? eapol_hdr->eth.ether_dhost :
+                       eapol_hdr->eth.ether_shost;
+       /*
+        * The implementation assumes only one WPS session would be active
+        * per interface at a time. Even for hostap, the wps_pin session
+        * is limited to one enrollee/client at a time. A session is marked
+        * started on WSC_START and gets cleared from below contexts
+        * a) Deauth/link down before reaching EAP-FAIL state. (Fail case)
+        * b) Link up following EAP-FAIL. (success case)
+        * c) Link up timeout after EAP-FAIL. (Fail case)
+        */
+
+       if (eapol_type == EAP_PACKET) {
+               wl_eap_header_t *eap;
+
+               if (len > sizeof(*eap)) {
+                       eap = (wl_eap_header_t *)(pkt + ETHER_HDR_LEN + EAPOL_HDR_LEN);
+                       if (eap->type == EAP_EXPANDED_TYPE) {
+                               wl_eap_exp_t *exp = (wl_eap_exp_t *)eap->data;
+                               if (eap->length > EAP_EXP_HDR_MIN_LENGTH) {
+                                       /* opcode is at fixed offset */
+                                       u8 opcode = exp->opcode;
+                                       u16 eap_len = ntoh16(eap->length);
+
+                                       WL_DBG(("[%s][WPS] EAP EXPANDED packet. opcode:%x len:%d\n",
+                                               ndev->name, opcode, eap_len));
+                                       if (opcode == EAP_WSC_MSG) {
+                                               const u8 *msg;
+                                               const u8* parse_buf = exp->data;
+                                               /* Check if recvd pkt is fragmented */
+                                               if ((!tx_packet) &&
+                                                       (exp->flags &
+                                                       EAP_EXP_FLAGS_FRAGMENTED_DATA)) {
+                                                       if ((eap_len - EAP_EXP_ATTRIB_DATA_OFFSET)
+                                                       > 2) {
+                                                               parse_buf +=
+                                                               EAP_EXP_FRAGMENT_LEN_OFFSET;
+                                                               eap_len -=
+                                                               EAP_EXP_FRAGMENT_LEN_OFFSET;
+                                                               WL_DBG(("Rcvd EAP"
+                                                               " fragmented pkt\n"));
+                                                       } else {
+                                                               /* If recvd pkt is fragmented
+                                                               * and does not have
+                                                               * length field drop the packet.
+                                                               */
+                                                               return;
+                                                       }
+                                               }
+
+                                               msg = wl_find_attribute(parse_buf,
+                                                       (eap_len - EAP_EXP_ATTRIB_DATA_OFFSET),
+                                                       EAP_ATTRIB_MSGTYPE);
+                                               if (unlikely(!msg)) {
+                                                       WL_ERR(("[WPS] ATTRIB MSG not found!\n"));
+                                               } else if ((*msg == EAP_WSC_MSG_M8) &&
+                                                               !tx_packet) {
+                                                       /* In certain cases M2 can also carry
+                                                        * credential. So add check for
+                                                        * cred in M8/M2 and start reauth timer.
+                                                        */
+                                                       WL_INFORM_MEM(("[%s][WPS] M8\n",
+                                                               ndev->name));
+                                                       wl_wps_session_update(ndev,
+                                                               WPS_STATE_M8_RECVD, peer_mac);
+                                               } else if ((*msg == EAP_WSC_MSG_M8) &&
+                                                               tx_packet) {
+                                                       WL_INFORM_MEM(("[%s][WPS] M8 Sent\n",
+                                                               ndev->name));
+                                                       wl_wps_session_update(ndev,
+                                                               WPS_STATE_M8_SENT, peer_mac);
+                                               } else {
+                                                       WL_DBG(("[%s][WPS] EAP WSC MSG: 0x%X\n",
+                                                               ndev->name, *msg));
+                                               }
+                                       } else if (opcode == EAP_WSC_START) {
+                                               /* WSC session started. WSC_START - Tx from GO/AP.
+                                                * Session will be deleted on successful link up or
+                                                * on failure (deauth context)
+                                                */
+                                               mode = tx_packet ? WL_MODE_AP : WL_MODE_BSS;
+                                               wl_wps_session_add(ndev, mode, peer_mac);
+                                               WL_INFORM_MEM(("[%s][WPS] WSC_START Mode:%d\n",
+                                                       ndev->name, mode));
+                                       } else if (opcode == EAP_WSC_DONE) {
+                                               /* WSC session done. TX on STA/GC. RX on GO/AP
+                                                * On devices where config file save fails, it may
+                                                * return WPS_NAK with config_error:0. But the
+                                                * connection would still proceed. Hence don't let
+                                                * state machine depend on WSC DONE.
+                                                */
+                                               WL_INFORM_MEM(("[%s][WPS] WSC_DONE\n", ndev->name));
+                                       }
+                               }
+                       }
+
+                       if (eap->code == EAP_CODE_FAILURE) {
+                               /* EAP_FAIL */
+                               WL_INFORM_MEM(("[%s][WPS] EAP_FAIL\n", ndev->name));
+                               wl_wps_session_update(ndev,
+                                       WPS_STATE_EAP_FAIL, peer_mac);
+                       }
+               }
+       }
+}
+#endif /* WL_WPS_SYNC */
+
+s32
+wl_cfg80211_sup_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *event, void *data)
+{
+       int err = BCME_OK;
+       u32 status = ntoh32(event->status);
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       u32 reason = ntoh32(event->reason);
+
+       if (!wl_get_drv_status(cfg, CFG80211_CONNECT, ndev)) {
+               /* Join attempt via non-cfg80211 interface.
+                * Don't send resultant events to cfg80211
+                * layer
+                */
+               WL_INFORM_MEM(("Event received in non-cfg80211"
+                       " connect state. Ignore\n"));
+               return BCME_OK;
+       }
+
+       if ((status == WLC_SUP_KEYED || status == WLC_SUP_KEYXCHANGE_WAIT_G1) &&
+           reason == WLC_E_SUP_OTHER) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0))
+               /* NL80211_CMD_PORT_AUTHORIZED supported above >= 4.15 */
+               cfg80211_port_authorized(ndev, (u8 *)wl_read_prof(cfg, ndev, WL_PROF_BSSID),
+                       GFP_KERNEL);
+               WL_INFORM_MEM(("4way HS finished. port authorized event sent\n"));
+#elif ((LINUX_VERSION_CODE > KERNEL_VERSION(3, 14, 0)) || \
+       defined(WL_VENDOR_EXT_SUPPORT))
+               err = wl_cfgvendor_send_async_event(bcmcfg_to_wiphy(cfg), ndev,
+                       BRCM_VENDOR_EVENT_PORT_AUTHORIZED, NULL, 0);
+               WL_INFORM_MEM(("4way HS finished. port authorized event sent\n"));
+#else
+               /* not supported in kernel <= 3,14,0 */
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0) */
+               /* Post SCB authorize actions */
+               wl_cfg80211_post_scb_auth(cfg, ndev);
+       } else if (status < WLC_SUP_KEYXCHANGE_WAIT_G1 && (reason != WLC_E_SUP_OTHER &&
+               reason != WLC_E_SUP_PTK_UPDATE)) {
+               /* if any failure seen while 4way HS, should send NL80211_CMD_DISCONNECT */
+               WL_ERR(("4way HS error. status:%d, reason:%d\n", status, reason));
+               CFG80211_DISCONNECTED(ndev, 0, NULL, 0, false, GFP_KERNEL);
+       }
+
+       return err;
+}
+
+#ifdef WL_BCNRECV
+static s32
+wl_bcnrecv_aborted_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+               const wl_event_msg_t *e, void *data)
+{
+       s32 status = ntoh32(e->status);
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       /* Abort fakeapscan, when Roam is in progress */
+       if (status == WLC_E_STATUS_RXBCN_ABORT) {
+               wl_android_bcnrecv_stop(ndev, WL_BCNRECV_ROAMABORT);
+       } else {
+               WL_ERR(("UNKNOWN STATUS. status:%d\n", status));
+       }
+       return BCME_OK;
+}
+#endif /* WL_BCNRECV */
+
+#ifdef WL_MBO
+static s32
+wl_mbo_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = 0;
+       wl_event_mbo_t *mbo_evt = (wl_event_mbo_t *)data;
+       wl_event_mbo_cell_nw_switch_t *cell_sw_evt = NULL;
+       wl_btm_event_type_data_t *evt_data = NULL;
+
+       WL_INFORM(("MBO: Evt %u\n", mbo_evt->type));
+
+       if (mbo_evt->type == WL_MBO_E_CELLULAR_NW_SWITCH) {
+               cell_sw_evt = (wl_event_mbo_cell_nw_switch_t *)mbo_evt->data;
+               BCM_REFERENCE(cell_sw_evt);
+               SUPP_EVENT(("CTRL-EVENT-CELLULAR-SWITCH", "reason %d cur_assoc_time_left %u "
+                       "reassoc_delay %u\n", cell_sw_evt->reason,
+                       cell_sw_evt->assoc_time_remain, cell_sw_evt->reassoc_delay));
+       } else if (mbo_evt->type == WL_MBO_E_BTM_RCVD) {
+               evt_data = (wl_btm_event_type_data_t *)mbo_evt->data;
+               if (evt_data->version != WL_BTM_EVENT_DATA_VER_1) {
+                       WL_ERR(("version mismatch. rcvd %u expected %u\n",
+                               evt_data->version, WL_BTM_EVENT_DATA_VER_1));
+                               return -1;
+               }
+               SUPP_EVENT(("CTRL-EVENT-BRCM-BTM-REQ-RCVD", "reason=%u\n",
+                       evt_data->transition_reason));
+       } else {
+               WL_INFORM(("UNKNOWN EVENT. type:%u\n", mbo_evt->type));
+       }
+       return err;
+}
+#endif /* WL_MBO */
+
+#ifdef WL_CAC_TS
+static s32
+wl_cfg80211_cac_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+               const wl_event_msg_t *e, void *data)
+{
+       u32 event = ntoh32(e->event_type);
+       s32 status = ntoh32(e->status);
+       s32 reason = ntoh32(e->reason);
+
+       BCM_REFERENCE(reason);
+
+       if (event == WLC_E_ADDTS_IND) {
+               /* The supp log format of adding ts_delay in success case needs to be maintained */
+               if (status == WLC_E_STATUS_SUCCESS) {
+                       uint *ts_delay = (uint *)data;
+                       BCM_REFERENCE(ts_delay);
+                       SUPP_EVENT(("CTRL-EVENT-CAC-ADDTS", "status=%d reason=%d ts_delay=%u\n",
+                               status, reason, *ts_delay));
+               } else {
+                       SUPP_EVENT(("CTRL-EVENT-CAC-ADDTS", "status=%d reason=%d\n",
+                               status, reason));
+               }
+       } else if (event == WLC_E_DELTS_IND) {
+               SUPP_EVENT(("CTRL-EVENT-CAC-DELTS", "status=%d reason=%d\n", status, reason));
+       }
+
+       return BCME_OK;
+}
+#endif /* WL_CAC_TS */
+
+#if defined(WL_MBO) || defined(WL_OCE)
+static s32
+wl_bssid_prune_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = 0;
+       uint reason = 0;
+       wl_bssid_pruned_evt_info_t *evt_info = (wl_bssid_pruned_evt_info_t *)data;
+
+       if (evt_info->version == WL_BSSID_PRUNE_EVT_VER_1) {
+               if (evt_info->reason == WLC_E_PRUNE_ASSOC_RETRY_DELAY) {
+                       /* MBO assoc retry delay */
+                       reason = WIFI_PRUNE_ASSOC_RETRY_DELAY;
+                       SUPP_EVENT(("CTRL-EVENT-BRCM-BSSID-PRUNED", "ssid=%s bssid=" MACF
+                               " reason=%u timeout_val=%u(ms)\n", evt_info->SSID,
+                               ETHER_TO_MACF(evt_info->BSSID), reason, evt_info->time_remaining));
+               } else if (evt_info->reason == WLC_E_PRUNE_RSSI_ASSOC_REJ) {
+                       /* OCE RSSI-based assoc rejection */
+                       reason = WIFI_PRUNE_RSSI_ASSOC_REJ;
+                       SUPP_EVENT(("CTRL-EVENT-BRCM-BSSID-PRUNED", "ssid=%s bssid=" MACF
+                               " reason=%u timeout_val=%u(ms) rssi_threshold=%d(dBm)\n",
+                               evt_info->SSID, ETHER_TO_MACF(evt_info->BSSID),
+                               reason, evt_info->time_remaining, evt_info->rssi_threshold));
+               } else {
+                       /* Invalid other than the assoc retry delay/RSSI assoc rejection
+                        * in the current handler
+                        */
+                       BCM_REFERENCE(reason);
+                       WL_INFORM(("INVALID. reason:%u\n", evt_info->reason));
+               }
+       } else {
+               WL_INFORM(("version mismatch. rcvd %u expected %u\n", evt_info->version,
+                       WL_BSSID_PRUNE_EVT_VER_1));
+       }
+       return err;
+}
+#endif /* WL_MBO || WL_OCE */
+#ifdef RTT_SUPPORT
+static s32
+wl_cfg80211_rtt_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+               const wl_event_msg_t *e, void *data)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       wl_event_msg_t event;
+
+       (void)memcpy_s(&event, sizeof(wl_event_msg_t),
+               e, sizeof(wl_event_msg_t));
+       return dhd_rtt_event_handler(dhdp, &event, data);
+}
+#endif /* RTT_SUPPORT */
+
+void
+wl_print_verinfo(struct bcm_cfg80211 *cfg)
+{
+       char *ver_ptr;
+       uint32 alloc_len = MOD_PARAM_INFOLEN;
+
+       if (!cfg) {
+               WL_ERR(("cfg is NULL\n"));
+               return;
+       }
+
+       ver_ptr = (char *)MALLOCZ(cfg->osh, alloc_len);
+       if (!ver_ptr) {
+               WL_ERR(("Failed to alloc ver_ptr\n"));
+               return;
+       }
+
+       if (!dhd_os_get_version(bcmcfg_to_prmry_ndev(cfg),
+               TRUE, &ver_ptr, alloc_len)) {
+               WL_ERR(("DHD Version: %s\n", ver_ptr));
+       }
+
+       if (!dhd_os_get_version(bcmcfg_to_prmry_ndev(cfg),
+               FALSE, &ver_ptr, alloc_len)) {
+               WL_ERR(("F/W Version: %s\n", ver_ptr));
+       }
+
+       MFREE(cfg->osh, ver_ptr, alloc_len);
+}
+
+typedef struct {
+       uint16 id;
+       uint16 len;
+       uint32 val;
+} he_xtlv_v32;
+
+       static bool
+wl_he_get_uint_cb(void *ctx, uint16 *id, uint16 *len)
+{
+       he_xtlv_v32 *v32 = ctx;
+
+       *id = v32->id;
+       *len = v32->len;
+
+       return FALSE;
+}
+
+       static void
+wl_he_pack_uint_cb(void *ctx, uint16 id, uint16 len, uint8 *buf)
+{
+       he_xtlv_v32 *v32 = ctx;
+
+       BCM_REFERENCE(id);
+       BCM_REFERENCE(len);
+
+       v32->val = htod32(v32->val);
+
+       switch (v32->len) {
+               case sizeof(uint8):
+                       *buf = (uint8)v32->val;
+                       break;
+               case sizeof(uint16):
+                       store16_ua(buf, (uint16)v32->val);
+                       break;
+               case sizeof(uint32):
+                       store32_ua(buf, v32->val);
+                       break;
+               default:
+                       /* ASSERT(0); */
+                       break;
+       }
+}
+
+int wl_cfg80211_set_he_mode(struct net_device *dev, struct bcm_cfg80211 *cfg,
+               s32 bssidx, u32 interface_type, bool set)
+{
+       bcm_xtlv_t read_he_xtlv;
+       uint8 se_he_xtlv[32];
+       int se_he_xtlv_len = sizeof(se_he_xtlv);
+       he_xtlv_v32 v32;
+       u32 he_feature = 0;
+       s32 err = 0;
+       u32 he_interface = 0;
+
+       read_he_xtlv.id = WL_HE_CMD_FEATURES;
+       read_he_xtlv.len = 0;
+       err = wldev_iovar_getbuf_bsscfg(dev, "he", &read_he_xtlv, sizeof(read_he_xtlv),
+                       cfg->ioctl_buf, WLC_IOCTL_SMLEN, bssidx, NULL);
+       if (err < 0) {
+               if (err == BCME_UNSUPPORTED) {
+                       /* HE not supported. Do nothing. */
+                       return BCME_OK;
+               }
+               WL_ERR(("HE get failed. error=%d\n", err));
+       } else {
+               he_feature =  *(int*)cfg->ioctl_buf;
+               he_feature = dtoh32(he_feature);
+       }
+
+       v32.id = WL_HE_CMD_FEATURES;
+       v32.len = sizeof(s32);
+       if (interface_type == WL_IF_TYPE_P2P_DISC) {
+               he_interface = WL_HE_FEATURES_HE_P2P;
+       } else if (interface_type == WL_IF_TYPE_AP) {
+               he_interface = WL_HE_FEATURES_HE_AP;
+       } else {
+               WL_ERR(("HE request for Invalid interface type"));
+               err = BCME_BADARG;
+               return err;
+       }
+
+       if (set) {
+               v32.val = (he_feature | he_interface);
+       } else {
+               v32.val = (he_feature & ~he_interface);
+       }
+
+       err = bcm_pack_xtlv_buf((void *)&v32, se_he_xtlv, sizeof(se_he_xtlv),
+                       BCM_XTLV_OPTION_ALIGN32, wl_he_get_uint_cb, wl_he_pack_uint_cb,
+                       &se_he_xtlv_len);
+       if (err != BCME_OK) {
+               WL_ERR(("failed to pack he settvl=%d\n", err));
+       }
+
+       err = wldev_iovar_setbuf_bsscfg(dev, "he", &se_he_xtlv, sizeof(se_he_xtlv),
+                       cfg->ioctl_buf, WLC_IOCTL_SMLEN, bssidx, &cfg->ioctl_buf_sync);
+       if (err < 0) {
+               WL_ERR(("failed to set he features, error=%d\n", err));
+       }
+       WL_INFORM(("Set HE[%d] done\n", set));
+
+       return err;
+}
+
+/* Get the concurrency mode */
+int wl_cfg80211_get_concurrency_mode(struct bcm_cfg80211 *cfg)
+{
+       struct net_info *iter, *next;
+       uint cmode = CONCURRENCY_MODE_NONE;
+       u32 connected_cnt = 0;
+       u32 pre_channel = 0, channel = 0;
+       u32 pre_band = 0;
+       u32 chanspec = 0;
+       u32 band = 0;
+
+       connected_cnt = wl_get_drv_status_all(cfg, CONNECTED);
+       if (connected_cnt <= 1) {
+               return cmode;
+       }
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       for_each_ndev(cfg, iter, next) {
+               if (iter->ndev) {
+                       if (wl_get_drv_status(cfg, CONNECTED, iter->ndev)) {
+                               if (wldev_iovar_getint(iter->ndev, "chanspec",
+                                       (s32 *)&chanspec) == BCME_OK) {
+                                       channel = wf_chspec_ctlchan(
+                                               wl_chspec_driver_to_host(chanspec));
+                                       band = (channel <= CH_MAX_2G_CHANNEL) ?
+                                               IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
+                               }
+                               if ((!pre_channel && channel)) {
+                                       pre_band = band;
+                                       pre_channel = channel;
+                               } else if (pre_channel) {
+                                       if ((pre_band == band) && (pre_channel == channel)) {
+                                               cmode = CONCURRENCY_SCC_MODE;
+                                               goto exit;
+                                       } else if ((pre_band == band) && (pre_channel != channel)) {
+                                               cmode = CONCURRENCY_VSDB_MODE;
+                                               goto exit;
+                                       } else if (pre_band != band) {
+                                               cmode = CONCURRENCY_RSDB_MODE;
+                                               goto exit;
+                                       }
+                               }
+                       }
+               }
+       }
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic pop")
+#endif
+exit:
+       return cmode;
+}
+#ifdef WL_CHAN_UTIL
+static s32
+wl_cfg80211_bssload_report_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+               const wl_event_msg_t *e, void *data)
+{
+       s32 err = BCME_OK;
+       struct sk_buff *skb = NULL;
+       s32 status = ntoh32(e->status);
+       u8 chan_use_percentage = 0;
+#if (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || \
+       LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+#endif /* (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || */
+                       /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0) */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       uint len;
+       gfp_t kflags;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+       len = CU_ATTR_HDR_LEN + sizeof(u8);
+       kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
+
+#if (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || \
+       LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+       skb = cfg80211_vendor_event_alloc(wiphy, ndev_to_wdev(ndev), len,
+               BRCM_VENDOR_EVENT_CU, kflags);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+       skb = cfg80211_vendor_event_alloc(wiphy, len, BRCM_VENDOR_EVENT_CU, kflags);
+#else
+       /* No support exist */
+#endif /* (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || */
+               /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0) */
+       if (!skb) {
+               WL_ERR(("skb alloc failed"));
+               return -ENOMEM;
+       }
+
+       if ((status == WLC_E_STATUS_SUCCESS) && data) {
+               wl_bssload_t *bssload_report = (wl_bssload_t *)data;
+               chan_use_percentage = (bssload_report->chan_util * 100) / 255;
+               WL_DBG(("ChannelUtilization=%hhu\n", chan_use_percentage));
+               err = nla_put_u8(skb, CU_ATTR_PERCENTAGE, chan_use_percentage);
+               if (err < 0) {
+                       WL_ERR(("Failed to put CU_ATTR_PERCENTAGE, err:%d\n", err));
+               }
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+       cfg80211_vendor_event(skb, kflags);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
+
+       return err;
+}
+
+#define WL_CHAN_UTIL_DEFAULT_INTERVAL  3000
+#define WL_CHAN_UTIL_THRESH_MIN                15
+#define WL_CHAN_UTIL_THRESH_INTERVAL   10
+#ifndef CUSTOM_CU_INTERVAL
+#define CUSTOM_CU_INTERVAL WL_CHAN_UTIL_DEFAULT_INTERVAL
+#endif /* CUSTOM_CU_INTERVAL */
+
+static s32
+wl_cfg80211_start_bssload_report(struct net_device *ndev)
+{
+       s32 err = BCME_OK;
+       wl_bssload_cfg_t blcfg;
+       u8 i;
+       struct bcm_cfg80211 *cfg;
+
+       if (!ndev) {
+               return -ENODEV;
+       }
+
+       cfg = wl_get_cfg(ndev);
+       if (!cfg) {
+               return -ENODEV;
+       }
+
+       /* Typecasting to void as the buffer size is same as the memset size */
+       (void)memset_s(&blcfg, sizeof(wl_bssload_cfg_t), 0, sizeof(wl_bssload_cfg_t));
+       /* Set default report interval 3 sec and 8 threshhold levels between 15 to 85% */
+       blcfg.rate_limit_msec = CUSTOM_CU_INTERVAL;
+       blcfg.num_util_levels = MAX_BSSLOAD_LEVELS;
+       for (i = 0; i < MAX_BSSLOAD_LEVELS; i++) {
+               blcfg.util_levels[i] = (((WL_CHAN_UTIL_THRESH_MIN +
+                       (i * WL_CHAN_UTIL_THRESH_INTERVAL)) * 255) / 100);
+       }
+
+       err = wldev_iovar_setbuf(ndev, "bssload_report_event", &blcfg,
+               sizeof(wl_bssload_cfg_t), cfg->ioctl_buf, WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("Set event_msgs error (%d)\n", err));
+       }
+
+       return err;
+}
+#endif /* WL_CHAN_UTIL */
+
+s32
+wl_cfg80211_config_suspend_events(struct net_device *ndev, bool enable)
+{
+       s32 err = 0;
+       struct bcm_cfg80211 *cfg;
+       s8 event_buf[WL_EVENTING_MASK_EXT_LEN + EVENTMSGS_EXT_STRUCT_SIZE] = {0};
+       eventmsgs_ext_t *eventmask_msg = NULL;
+       /*  Room for "event_msgs_ext" + '\0' + bitvec  */
+       char iovbuf[WL_EVENTING_MASK_EXT_LEN + EVENTMSGS_EXT_STRUCT_SIZE + 16];
+       s32 msglen = WL_EVENTING_MASK_EXT_LEN + EVENTMSGS_EXT_STRUCT_SIZE;
+
+       if (!ndev) {
+               return -ENODEV;
+       }
+
+       cfg = wl_get_cfg(ndev);
+       if (!cfg) {
+               return -ENODEV;
+       }
+
+       mutex_lock(&cfg->event_sync);
+
+       eventmask_msg = (eventmsgs_ext_t *)event_buf;
+       eventmask_msg->ver = EVENTMSGS_VER;
+       eventmask_msg->command = EVENTMSGS_NONE;
+       eventmask_msg->len = WL_EVENTING_MASK_EXT_LEN;
+       eventmask_msg->maxgetsize = WL_EVENTING_MASK_EXT_LEN;
+
+       /* Read event_msgs mask */
+       err = wldev_iovar_getbuf(ndev, "event_msgs_ext",
+               eventmask_msg, EVENTMSGS_EXT_STRUCT_SIZE,
+               iovbuf,
+               sizeof(iovbuf),
+               NULL);
+
+       if (unlikely(err)) {
+               WL_ERR(("Get event_msgs error (%d)\n", err));
+               goto eventmsg_out;
+       }
+
+       bcopy(iovbuf, eventmask_msg, msglen);
+
+       /* Add set/clear of event mask under feature specific flags */
+       if (enable) {
+               WL_DBG(("%s: Enabling events on resume\n", __FUNCTION__));
+#ifdef WL_CHAN_UTIL
+               setbit(eventmask_msg->mask, WLC_E_BSS_LOAD);
+#endif /* WL_CHAN_UTIL */
+       } else {
+               WL_DBG(("%s: Disabling events before suspend\n", __FUNCTION__));
+#ifdef WL_CHAN_UTIL
+               clrbit(eventmask_msg->mask, WLC_E_BSS_LOAD);
+#endif /* WL_CHAN_UTIL */
+       }
+
+       /* Write updated Event mask */
+       eventmask_msg->ver = EVENTMSGS_VER;
+       eventmask_msg->command = EVENTMSGS_SET_MASK;
+       eventmask_msg->len = WL_EVENTING_MASK_EXT_LEN;
+
+       err = wldev_iovar_setbuf(ndev, "event_msgs_ext", eventmask_msg,
+               WL_EVENTING_MASK_EXT_LEN + EVENTMSGS_EXT_STRUCT_SIZE,
+               iovbuf, sizeof(iovbuf), NULL);
+
+       if (unlikely(err)) {
+               WL_ERR(("Set event_msgs error (%d)\n", err));
+               goto eventmsg_out;
+       }
+
+eventmsg_out:
+       mutex_unlock(&cfg->event_sync);
+       return err;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0))
+int
+wl_cfg80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_csa_settings *params)
+{
+       s32 err = BCME_OK;
+       u32 bw = WL_CHANSPEC_BW_20;
+       chanspec_t chspec = 0;
+       wl_chan_switch_t csa_arg;
+       struct cfg80211_chan_def *chandef = &params->chandef;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *primary_dev = bcmcfg_to_prmry_ndev(cfg);
+
+       dev = ndev_to_wlc_ndev(dev, cfg);
+       chspec = wl_freq_to_chanspec(chandef->chan->center_freq);
+
+       WL_ERR(("netdev_ifidx(%d), target channel(%d) target bandwidth(%d),"
+               " mode(%d), count(%d)\n", dev->ifindex, CHSPEC_CHANNEL(chspec), chandef->width,
+               params->block_tx, params->count));
+
+       if (wl_get_mode_by_netdev(cfg, dev) != WL_MODE_AP) {
+               WL_ERR(("Channel Switch doesn't support on "
+                       "the non-SoftAP mode\n"));
+               return -EINVAL;
+       }
+
+       /* Check if STA is trying to associate with an AP */
+       if (wl_get_drv_status(cfg, CONNECTING, primary_dev)) {
+               WL_ERR(("Connecting is in progress\n"));
+               return BCME_BUSY;
+       }
+
+       if (chspec == cfg->ap_oper_channel) {
+               WL_ERR(("Channel %d is same as current operating channel,"
+                       " so skip\n", CHSPEC_CHANNEL(chspec)));
+               return BCME_OK;
+       }
+
+       if (
+#ifdef WL_6G_BAND
+               CHSPEC_IS6G(chspec) ||
+#endif
+               CHSPEC_IS5G(chspec)) {
+#ifdef APSTA_RESTRICTED_CHANNEL
+               if (CHSPEC_CHANNEL(chspec) != DEFAULT_5G_SOFTAP_CHANNEL) {
+                       WL_ERR(("Invalid 5G Channel, chan=%d\n", CHSPEC_CHANNEL(chspec)));
+                       return -EINVAL;
+               }
+#endif /* APSTA_RESTRICTED_CHANNEL */
+               err = wl_get_bandwidth_cap(primary_dev, CHSPEC_BAND(chspec), &bw);
+               if (err < 0) {
+                       WL_ERR(("Failed to get bandwidth information,"
+                               " err=%d\n", err));
+                       return err;
+               }
+       } else if (CHSPEC_IS2G(chspec)) {
+#ifdef APSTA_RESTRICTED_CHANNEL
+               dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+               chanspec_t *sta_chanspec = (chanspec_t *)wl_read_prof(cfg,
+                       primary_dev, WL_PROF_CHAN);
+
+               /* In 2GHz STA/SoftAP concurrent mode, the operating channel
+                * of STA and SoftAP should be confgiured to the same 2GHz
+                * channel. Otherwise, it is an invalid configuration.
+                */
+               if (DHD_OPMODE_STA_SOFTAP_CONCURR(dhdp) &&
+                       wl_get_drv_status(cfg, CONNECTED, primary_dev) &&
+                       sta_chanspec && (CHSPEC_CHANNEL(*sta_chanspec) != CHSPEC_CHANNEL(chspec))) {
+                       WL_ERR(("Invalid 2G Channel in case of STA/SoftAP"
+                               " concurrent mode, sta_chan=%d, chan=%d\n",
+                               CHSPEC_CHANNEL(*sta_chanspec), CHSPEC_CHANNEL(chspec)));
+                       return -EINVAL;
+               }
+#endif /* APSTA_RESTRICTED_CHANNEL */
+               bw = WL_CHANSPEC_BW_20;
+       } else {
+               WL_ERR(("invalid band (%d)\n", CHSPEC_BAND(chspec)));
+               return -EINVAL;
+       }
+
+#ifdef WL_6G_BAND
+       /* Avoid in case of 6G as for each center frequency bw is unique and is
+       * detected based on centre frequency.
+       */
+       if (!CHSPEC_IS6G(chspec))
+#endif /* WL_6G_BAND */
+       {
+               chspec = wf_channel2chspec(CHSPEC_CHANNEL(chspec), bw);
+       }
+       if (!wf_chspec_valid(chspec)) {
+               WL_ERR(("Invalid chanspec 0x%x\n", chspec));
+               return -EINVAL;
+       }
+
+       /* Send CSA to associated STAs */
+       memset(&csa_arg, 0, sizeof(wl_chan_switch_t));
+       csa_arg.mode = params->block_tx;
+       csa_arg.count = params->count;
+       csa_arg.chspec = chspec;
+       csa_arg.frame_type = CSA_BROADCAST_ACTION_FRAME;
+       csa_arg.reg = 0;
+
+       err = wldev_iovar_setbuf(dev, "csa", &csa_arg, sizeof(wl_chan_switch_t),
+               cfg->ioctl_buf, WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync);
+       if (err < 0) {
+               WL_ERR(("Failed to switch channel, err=%d\n", err));
+       }
+
+       return err;
+}
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0) */
+
+#ifdef WL_WIPSEVT
+int
+wl_cfg80211_wips_event_ext(wl_wips_event_info_t *wips_event)
+{
+       s32 err = BCME_OK;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+       struct sk_buff *skb;
+       gfp_t kflags;
+       struct bcm_cfg80211 *cfg;
+       struct net_device *ndev;
+       struct wiphy *wiphy;
+
+       cfg = wl_cfg80211_get_bcmcfg();
+       if (!cfg || !cfg->wdev) {
+               WL_ERR(("WIPS evt invalid arg\n"));
+               return err;
+       }
+
+       ndev = bcmcfg_to_prmry_ndev(cfg);
+       wiphy = bcmcfg_to_wiphy(cfg);
+
+       kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+       skb = CFG80211_VENDOR_EVENT_ALLOC(wiphy, ndev_to_wdev(ndev),
+               BRCM_VENDOR_WIPS_EVENT_BUF_LEN, BRCM_VENDOR_EVENT_WIPS, kflags);
+
+       if (!skb) {
+               WL_ERR(("skb alloc failed"));
+               return BCME_NOMEM;
+       }
+
+       err = nla_put_u16(skb, WIPS_ATTR_DEAUTH_CNT, wips_event->misdeauth);
+       if (unlikely(err)) {
+               WL_ERR(("nla_put_u16 WIPS_ATTR_DEAUTH_CNT failed\n"));
+               goto fail;
+       }
+       err = nla_put(skb, WIPS_ATTR_DEAUTH_BSSID, ETHER_ADDR_LEN, &wips_event->bssid);
+       if (unlikely(err)) {
+               WL_ERR(("nla_put WIPS_ATTR_DEAUTH_BSSID failed\n"));
+               goto fail;
+       }
+       err = nla_put_s16(skb, WIPS_ATTR_CURRENT_RSSI, wips_event->current_RSSI);
+       if (unlikely(err)) {
+               WL_ERR(("nla_put_u16 WIPS_ATTR_CURRENT_RSSI failed\n"));
+               goto fail;
+       }
+       err = nla_put_s16(skb, WIPS_ATTR_DEAUTH_RSSI, wips_event->deauth_RSSI);
+       if (unlikely(err)) {
+               WL_ERR(("nla_put_u16 WIPS_ATTR_DEAUTH_RSSI failed\n"));
+               goto fail;
+       }
+       cfg80211_vendor_event(skb, kflags);
+
+       return err;
+
+fail:
+       if (skb) {
+               nlmsg_free(skb);
+       }
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
+       return err;
+}
+
+int
+wl_cfg80211_wips_event(uint16 misdeauth, char* bssid)
+{
+       s32 err = BCME_OK;
+       wl_wips_event_info_t wips_event;
+
+       wips_event.misdeauth = misdeauth;
+       memcpy(&wips_event.bssid, bssid, ETHER_ADDR_LEN);
+       wips_event.current_RSSI = 0;
+       wips_event.deauth_RSSI = 0;
+
+       err = wl_cfg80211_wips_event_ext(&wips_event);
+       return err;
+}
+#endif /* WL_WIPSEVT */
+
+#ifdef PCIE_INB_DW
+#define WL_DS(x)
+/*
+ * This API checks whether its okay to enter DS.
+ * If some transaction is in progress, return true
+ * to skip DS.
+ */
+bool wl_cfg80211_check_in_progress(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg;
+       struct net_device *pri_dev;
+       u8 reason = WL_STATE_IDLE;
+       u64 timeout;
+       u64 start_time = 0;
+
+       cfg = wl_get_cfg(dev);
+       pri_dev = bcmcfg_to_prmry_ndev(cfg);
+
+       /* check states like scan in progress, four way handshake, etc
+        * before entering Deep Sleep.
+        */
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               WL_DS(("scan in progress\n"));
+               reason = WL_STATE_SCANNING;
+               start_time = GET_TS(cfg, scan_start);
+       } else if (wl_get_drv_status_all(cfg, CONNECTING)) {
+               WL_DS(("connect in progress\n"));
+               reason = WL_STATE_CONNECTING;
+               start_time = GET_TS(cfg, conn_start);
+       } else if ((IS_STA_IFACE(ndev_to_wdev(dev))) &&
+               wl_get_drv_status(cfg, CONNECTED, pri_dev) &&
+               !wl_get_drv_status(cfg, AUTHORIZED, pri_dev)) {
+               WL_DS(("connect-authorization in progress\n"));
+               reason = WL_STATE_AUTHORIZING;
+               start_time = GET_TS(cfg, authorize_start);
+       }
+
+       if (reason) {
+               u64 curtime = OSL_LOCALTIME_NS();
+               if (unlikely(!start_time)) {
+                       WL_ERR(("state got cleared for reason:%d\n", reason));
+                       return false;
+               }
+               /* check whether we are stuck in a state
+                * for too long.
+                */
+               timeout = (start_time + (WL_DS_SKIP_THRESHOLD_USECS * 1000L));
+               if (time_after64(curtime, timeout)) {
+                       /* state hasn't changed for WL_DS_SKIP_THRESHOLD_USECS */
+                       WL_ERR(("DS skip threshold hit. reason:%d start_time:"
+                                       SEC_USEC_FMT" cur_time:"SEC_USEC_FMT"\n",
+                                       reason, GET_SEC_USEC(start_time), GET_SEC_USEC(curtime)));
+                       ASSERT((0));
+               }
+               /* return true to skip suspend */
+               return true;
+       }
+
+       return false;
+}
+#endif
+
+#ifdef SUPPORT_AP_SUSPEND
+void
+wl_set_ap_suspend_error_handler(struct net_device *ndev, bool suspend)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       if (wl_get_drv_status(cfg, READY, ndev)) {
+               /* IF dongle is down due to previous hang or other conditions, sending
+               * one more hang notification is not needed.
+               */
+               if (dhd_query_bus_erros(dhdp)) {
+                       return;
+               }
+               dhdp->iface_op_failed = TRUE;
+#if defined(DHD_FW_COREDUMP)
+               if (dhdp->memdump_enabled) {
+                       dhdp->memdump_type = DUMP_TYPE_IFACE_OP_FAILURE;
+                       dhd_bus_mem_dump(dhdp);
+               }
+#endif /* DHD_FW_COREDUMP */
+
+               WL_ERR(("Notify hang event to upper layer \n"));
+               dhdp->hang_reason = suspend ?
+                       HANG_REASON_BSS_DOWN_FAILURE : HANG_REASON_BSS_UP_FAILURE;
+               net_os_send_hang_message(ndev);
+
+       }
+}
+
+#define MAX_AP_RESUME_TIME   5000
+int
+wl_set_ap_suspend(struct net_device *dev, bool suspend, char *ifname)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhdp;
+       struct net_device *ndev = NULL;
+       int ret = BCME_OK;
+       bool is_bssup = FALSE;
+       int bssidx;
+       unsigned long start_j;
+       int time_to_sleep = MAX_AP_RESUME_TIME;
+
+       dhdp = (dhd_pub_t *)(cfg->pub);
+
+       if (!dhdp) {
+               return BCME_NOTUP;
+       }
+
+       if (!(dhdp->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+               WL_ERR(("Not Hostapd mode\n"));
+               return BCME_NOTAP;
+       }
+
+       ndev = wl_get_ap_netdev(cfg, ifname);
+
+       if (ndev == NULL) {
+               WL_ERR(("No softAP interface named %s\n", ifname));
+               return BCME_NOTAP;
+       }
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, ndev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", ndev->ieee80211_ptr));
+               return BCME_NOTFOUND;
+       }
+
+       is_bssup = wl_cfg80211_bss_isup(ndev, bssidx);
+       if (is_bssup && suspend) {
+               wl_clr_drv_status(cfg, AP_CREATED, ndev);
+               wl_clr_drv_status(cfg, CONNECTED, ndev);
+
+               if ((ret = wl_cfg80211_bss_up(cfg, ndev, bssidx, 0)) < 0) {
+                       WL_ERR(("AP suspend error %d, suspend %d\n", ret, suspend));
+                       ret = BCME_NOTDOWN;
+                       goto exit;
+               }
+       } else if (!is_bssup && !suspend) {
+               /* Abort scan before starting AP again */
+               wl_cfg80211_scan_abort(cfg);
+
+               if ((ret = wl_cfg80211_bss_up(cfg, ndev, bssidx, 1)) < 0) {
+                       WL_ERR(("AP resume error %d, suspend %d\n", ret, suspend));
+                       ret = BCME_NOTUP;
+                       goto exit;
+               }
+
+               while (TRUE) {
+                       start_j = get_jiffies_64();
+                       /* Wait for Linkup event to mark successful AP bring up */
+                       ret = wait_event_interruptible_timeout(cfg->netif_change_event,
+                               wl_get_drv_status(cfg, AP_CREATED, ndev),
+                               msecs_to_jiffies(time_to_sleep));
+                       if (ret == -ERESTARTSYS) {
+                               WL_ERR(("waitqueue was interrupted by a signal\n"));
+                               time_to_sleep -= jiffies_to_msecs(get_jiffies_64() - start_j);
+                               if (time_to_sleep <= 0) {
+                                       WL_ERR(("time to sleep hits 0\n"));
+                                       ret = BCME_NOTUP;
+                                       goto exit;
+                               }
+                       } else if (ret == 0 || !wl_get_drv_status(cfg, AP_CREATED, ndev)) {
+                               WL_ERR(("AP resume failed!\n"));
+                               ret = BCME_NOTUP;
+                               goto exit;
+                       } else {
+                               wl_set_drv_status(cfg, CONNECTED, ndev);
+                               wl_clr_drv_status(cfg, AP_CREATING, ndev);
+                               ret = BCME_OK;
+                               break;
+                       }
+               }
+       } else {
+               /* bssup + resume or bssdown + suspend,
+                * So, returns OK
+                */
+               ret = BCME_OK;
+       }
+exit:
+       if (ret != BCME_OK)
+               wl_set_ap_suspend_error_handler(bcmcfg_to_prmry_ndev(cfg), suspend);
+
+       return ret;
+}
+#endif /* SUPPORT_AP_SUSPEND */
+
+#ifdef SUPPORT_SOFTAP_ELNA_BYPASS
+int wl_set_softap_elna_bypass(struct net_device *dev, char *ifname, int enable)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       struct net_device *ifdev = NULL;
+       char iobuf[WLC_IOCTL_SMLEN];
+       int err = BCME_OK;
+       int iftype = 0;
+
+       memset(iobuf, 0, WLC_IOCTL_SMLEN);
+
+       /* Check the interface type */
+       ifdev = wl_get_netdev_by_name(cfg, ifname);
+       if (ifdev == NULL) {
+               WL_ERR(("%s: Could not find net_device for ifname:%s\n", __FUNCTION__, ifname));
+               err = BCME_BADARG;
+               goto fail;
+       }
+
+       iftype = ifdev->ieee80211_ptr->iftype;
+       if (iftype == NL80211_IFTYPE_AP) {
+               err = wldev_iovar_setint(ifdev, "softap_elnabypass", enable);
+               if (unlikely(err)) {
+                       WL_ERR(("%s: Failed to set softap_elnabypass, err=%d\n",
+                               __FUNCTION__, err));
+               }
+       } else {
+               WL_ERR(("%s: softap_elnabypass should control in SoftAP mode only\n",
+                       __FUNCTION__));
+               err = BCME_BADARG;
+       }
+fail:
+       return err;
+}
+int wl_get_softap_elna_bypass(struct net_device *dev, char *ifname, void *param)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       int *enable = (int*)param;
+       struct net_device *ifdev = NULL;
+       char iobuf[WLC_IOCTL_SMLEN];
+       int err = BCME_OK;
+       int iftype = 0;
+
+       memset(iobuf, 0, WLC_IOCTL_SMLEN);
+
+       /* Check the interface type */
+       ifdev = wl_get_netdev_by_name(cfg, ifname);
+       if (ifdev == NULL) {
+               WL_ERR(("%s: Could not find net_device for ifname:%s\n", __FUNCTION__, ifname));
+               err = BCME_BADARG;
+               goto fail;
+       }
+
+       iftype = ifdev->ieee80211_ptr->iftype;
+       if (iftype == NL80211_IFTYPE_AP) {
+               err = wldev_iovar_getint(ifdev, "softap_elnabypass", enable);
+               if (unlikely(err)) {
+                       WL_ERR(("%s: Failed to get softap_elnabypass, err=%d\n",
+                               __FUNCTION__, err));
+               }
+       } else {
+               WL_ERR(("%s: softap_elnabypass should control in SoftAP mode only\n",
+                       __FUNCTION__));
+               err = BCME_BADARG;
+       }
+fail:
+       return err;
+
+}
+#endif /* SUPPORT_SOFTAP_ELNA_BYPASS */
+
+#ifdef SUPPORT_AP_BWCTRL
+#define OPER_MODE_ENABLE       (1 << 8)
+static int op2bw[] = {20, 40, 80, 160};
+
+static int
+wl_get_ap_he_mode(struct net_device *ndev, struct bcm_cfg80211 *cfg, bool *he)
+{
+       bcm_xtlv_t read_he_xtlv;
+       int ret = 0;
+       u8  he_enab = 0;
+       u32 he_feature = 0;
+       *he = FALSE;
+
+       /* Check he enab first */
+       read_he_xtlv.id = WL_HE_CMD_ENAB;
+       read_he_xtlv.len = 0;
+
+       ret = wldev_iovar_getbuf(ndev, "he", &read_he_xtlv, sizeof(read_he_xtlv),
+                       cfg->ioctl_buf, WLC_IOCTL_SMLEN, NULL);
+       if (ret < 0) {
+               if (ret == BCME_UNSUPPORTED) {
+                       /* HE not supported */
+                       ret = BCME_OK;
+               } else {
+                       WL_ERR(("HE ENAB get failed. ret=%d\n", ret));
+               }
+               goto exit;
+       } else {
+               he_enab =  *(u8*)cfg->ioctl_buf;
+       }
+
+       if (!he_enab) {
+               goto exit;
+       }
+
+       /* Then check BIT3 of he features */
+       read_he_xtlv.id = WL_HE_CMD_FEATURES;
+       read_he_xtlv.len = 0;
+
+       ret = wldev_iovar_getbuf(ndev, "he", &read_he_xtlv, sizeof(read_he_xtlv),
+                       cfg->ioctl_buf, WLC_IOCTL_SMLEN, NULL);
+       if (ret < 0) {
+               WL_ERR(("HE FEATURE get failed. error=%d\n", ret));
+               goto exit;
+       } else {
+               he_feature =  *(int*)cfg->ioctl_buf;
+               he_feature = dtoh32(he_feature);
+       }
+
+       if (he_feature & WL_HE_FEATURES_HE_AP) {
+               WL_DBG(("HE is enabled in AP\n"));
+               *he = TRUE;
+       }
+exit:
+       return ret;
+}
+
+static void
+wl_update_apchan_bwcap(struct bcm_cfg80211 *cfg, struct net_device *ndev, chanspec_t chanspec)
+{
+       struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+       struct wireless_dev *wdev = ndev_to_wdev(dev);
+       struct wiphy *wiphy = wdev->wiphy;
+       int ret = BCME_OK;
+       u32 bw_cap;
+       u32 ctl_chan;
+       chanspec_t chanbw = WL_CHANSPEC_BW_20;
+
+       /* Update channel in profile */
+       ctl_chan = wf_chspec_ctlchan(chanspec);
+       wl_update_prof(cfg, ndev, NULL, &chanspec, WL_PROF_CHAN);
+
+       /* BW cap is only updated in 5GHz */
+       if (ctl_chan <= CH_MAX_2G_CHANNEL)
+               return;
+
+       /* Get WL BW CAP */
+       ret = wl_get_bandwidth_cap(bcmcfg_to_prmry_ndev(cfg),
+               CHSPEC_BAND(chanspec), &bw_cap);
+       if (ret < 0) {
+               WL_ERR(("get bw_cap failed = %d\n", ret));
+               goto exit;
+       }
+
+       chanbw = CHSPEC_BW(wl_channel_to_chanspec(wiphy,
+               ndev, wf_chspec_ctlchan(chanspec), bw_cap));
+
+exit:
+       cfg->bw_cap_5g = bw2cap[chanbw >> WL_CHANSPEC_BW_SHIFT];
+       WL_INFORM_MEM(("supported bw cap is:0x%x\n", cfg->bw_cap_5g));
+
+}
+
+int
+wl_rxchain_to_opmode_nss(int rxchain)
+{
+       /*
+        * Nss 1 -> 0, Nss 2 -> 1
+        * This is from operating mode field
+        * in 8.4.1.50 of 802.11ac-2013
+        */
+       /* TODO : Nss 3 ? */
+       if (rxchain == 3)
+               return (1 << 4);
+       else
+               return 0;
+}
+
+int
+wl_update_opmode(struct net_device *ndev, u32 bw)
+{
+       int ret = BCME_OK;
+       int oper_mode;
+       int rxchain;
+
+       ret = wldev_iovar_getint(ndev, "rxchain", (s32 *)&rxchain);
+       if (ret < 0) {
+               WL_ERR(("get rxchain failed = %d\n", ret));
+               goto exit;
+       }
+
+       oper_mode = bw;
+       oper_mode |= wl_rxchain_to_opmode_nss(rxchain);
+       /* Enable flag */
+       oper_mode |= OPER_MODE_ENABLE;
+
+       ret = wldev_iovar_setint(ndev, "oper_mode", oper_mode);
+       if (ret < 0) {
+               WL_ERR(("set oper_mode failed = %d\n", ret));
+               goto exit;
+       }
+
+exit:
+       return ret;
+}
+
+int
+wl_set_ap_bw(struct net_device *dev, u32 bw, char *ifname)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhdp;
+       struct net_device *ndev = NULL;
+       int ret = BCME_OK;
+       chanspec_t *chanspec;
+       bool he;
+
+       dhdp = (dhd_pub_t *)(cfg->pub);
+
+       if (!dhdp) {
+               return BCME_NOTUP;
+       }
+
+       if (!(dhdp->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+               WL_ERR(("Not Hostapd mode\n"));
+               return BCME_NOTAP;
+       }
+
+       ndev = wl_get_ap_netdev(cfg, ifname);
+
+       if (ndev == NULL) {
+               WL_ERR(("No softAP interface named %s\n", ifname));
+               return BCME_NOTAP;
+       }
+
+       if (bw > DOT11_OPER_MODE_160MHZ) {
+               WL_ERR(("BW is too big %d\n", bw));
+               return BCME_BADARG;
+       }
+
+       chanspec = (chanspec_t *)wl_read_prof(cfg, ndev, WL_PROF_CHAN);
+       if (CHSPEC_IS2G(*chanspec)) {
+               WL_ERR(("current chanspec is %d, not supported\n", *chanspec));
+               ret = BCME_BADCHAN;
+               goto exit;
+       }
+
+       if ((DHD_OPMODE_STA_SOFTAP_CONCURR(dhdp) &&
+               wl_get_drv_status(cfg, CONNECTED, bcmcfg_to_prmry_ndev(cfg))) ||
+               wl_cfgnan_is_enabled(cfg)) {
+               WL_ERR(("BW control in concurrent mode is not supported\n"));
+               return BCME_BUSY;
+       }
+
+       /* When SCAN is on going either in STA or in AP, return BUSY */
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               WL_ERR(("STA is SCANNING, not support BW control\n"));
+               return BCME_BUSY;
+       }
+
+       /* When SCANABORT is on going either in STA or in AP, return BUSY */
+       if (wl_get_drv_status_all(cfg, SCAN_ABORTING)) {
+               WL_ERR(("STA is SCAN_ABORTING, not support BW control\n"));
+               return BCME_BUSY;
+       }
+
+       /* When CONNECTION is on going in STA, return BUSY */
+       if (wl_get_drv_status(cfg, CONNECTING, bcmcfg_to_prmry_ndev(cfg))) {
+               WL_ERR(("STA is CONNECTING, not support BW control\n"));
+               return BCME_BUSY;
+       }
+
+       /* BW control in AX mode needs more verification */
+       ret = wl_get_ap_he_mode(ndev, cfg, &he);
+       if (ret == BCME_OK && he) {
+               WL_ERR(("BW control in HE mode is not supported\n"));
+               return BCME_UNSUPPORTED;
+       }
+       if (ret < 0) {
+               WL_ERR(("Check AX mode is failed\n"));
+               goto exit;
+       }
+
+       if ((!WL_BW_CAP_160MHZ(cfg->bw_cap_5g) && (bw == DOT11_OPER_MODE_160MHZ)) ||
+               (!WL_BW_CAP_80MHZ(cfg->bw_cap_5g) && (bw >= DOT11_OPER_MODE_80MHZ)) ||
+               (!WL_BW_CAP_40MHZ(cfg->bw_cap_5g) && (bw >= DOT11_OPER_MODE_40MHZ)) ||
+               (!WL_BW_CAP_20MHZ(cfg->bw_cap_5g))) {
+               WL_ERR(("bw_cap %x does not support bw = %d\n", cfg->bw_cap_5g, bw));
+               ret = BCME_BADARG;
+               goto exit;
+       }
+
+       WL_DBG(("Updating AP BW to %d\n", op2bw[bw]));
+
+       ret = wl_update_opmode(ndev, bw);
+       if (ret < 0) {
+               WL_ERR(("opmode set failed = %d\n", ret));
+               goto exit;
+       }
+
+exit:
+       return ret;
+}
+
+int
+wl_get_ap_bw(struct net_device *dev, char* command, char *ifname, int total_len)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhdp;
+       struct net_device *ndev = NULL;
+       int ret = BCME_OK;
+       u32 chanspec = 0;
+       u32 bw = DOT11_OPER_MODE_20MHZ;
+       int bytes_written = 0;
+
+       dhdp = (dhd_pub_t *)(cfg->pub);
+
+       if (!dhdp) {
+               return BCME_NOTUP;
+       }
+
+       if (!(dhdp->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+               WL_ERR(("Not Hostapd mode\n"));
+               return BCME_NOTAP;
+       }
+
+       ndev = wl_get_ap_netdev(cfg, ifname);
+
+       if (ndev == NULL) {
+               WL_ERR(("No softAP interface named %s\n", ifname));
+               return BCME_NOTAP;
+       }
+
+       ret = wldev_iovar_getint(ndev, "chanspec", (s32 *)&chanspec);
+       if (ret < 0) {
+               WL_ERR(("get chanspec from AP failed = %d\n", ret));
+               goto exit;
+       }
+
+       chanspec = wl_chspec_driver_to_host(chanspec);
+
+       if (CHSPEC_IS20(chanspec)) {
+               bw = DOT11_OPER_MODE_20MHZ;
+       } else if (CHSPEC_IS40(chanspec)) {
+               bw = DOT11_OPER_MODE_40MHZ;
+       } else if (CHSPEC_IS80(chanspec)) {
+               bw = DOT11_OPER_MODE_80MHZ;
+       } else if (CHSPEC_IS_BW_160_WIDE(chanspec)) {
+               bw = DOT11_OPER_MODE_160MHZ;
+       } else {
+               WL_ERR(("chanspec error %x\n", chanspec));
+               ret = BCME_BADCHAN;
+               goto exit;
+       }
+
+       bytes_written += snprintf(command + bytes_written, total_len,
+               "bw=%d", bw);
+       ret = bytes_written;
+exit:
+       return ret;
+}
+
+static void
+wl_restore_ap_bw(struct bcm_cfg80211 *cfg)
+{
+       int ret = BCME_OK;
+       u32 bw;
+       bool he = FALSE;
+       struct net_info *iter, *next;
+       struct net_device *ndev = NULL;
+       chanspec_t *chanspec;
+
+       if (!cfg) {
+               return;
+       }
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       for_each_ndev(cfg, iter, next) {
+               GCC_DIAGNOSTIC_POP();
+               if (iter->ndev) {
+                       if (iter->ndev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP) {
+                               chanspec = (chanspec_t *)wl_read_prof(cfg, iter->ndev,
+                                       WL_PROF_CHAN);
+                               if (CHSPEC_IS2G(*chanspec)) {
+                                       ndev = iter->ndev;
+                                       break;
+                               }
+                       }
+               }
+       }
+
+       if (!ndev) {
+               return;
+       }
+
+       /* BW control in AX mode not allowed */
+       ret = wl_get_ap_he_mode(bcmcfg_to_prmry_ndev(cfg), cfg, &he);
+       if (ret == BCME_OK && he) {
+               return;
+       }
+       if (ret < 0) {
+               WL_ERR(("Check AX mode is failed\n"));
+               return;
+       }
+
+       if (WL_BW_CAP_160MHZ(cfg->bw_cap_5g)) {
+               bw = DOT11_OPER_MODE_160MHZ;
+       } else if (WL_BW_CAP_80MHZ(cfg->bw_cap_5g)) {
+               bw = DOT11_OPER_MODE_80MHZ;
+       } else if (WL_BW_CAP_40MHZ(cfg->bw_cap_5g)) {
+               bw = DOT11_OPER_MODE_40MHZ;
+       } else {
+               return;
+       }
+
+       WL_DBG(("Restoring AP BW to %d\n", op2bw[bw]));
+
+       ret = wl_update_opmode(ndev, bw);
+       if (ret < 0) {
+               WL_ERR(("bw restore failed = %d\n", ret));
+               return;
+       }
+}
+#endif /* SUPPORT_AP_BWCTRL */
+
+bool wl_cfg80211_is_dpp_frame(void *frame, u32 frame_len)
+{
+               /* check for DPP public action frames */
+       wl_dpp_pa_frame_t *pact_frm;
+
+       if (frame == NULL) {
+               return false;
+       }
+       pact_frm = (wl_dpp_pa_frame_t *)frame;
+       if (frame_len < sizeof(wl_dpp_pa_frame_t) -1) {
+               return false;
+       }
+
+       if ((pact_frm->category == WL_PUB_AF_CATEGORY) &&
+               (pact_frm->action == WL_PUB_AF_ACTION) &&
+               (pact_frm->oui_type == WL_PUB_AF_WFA_STYPE_DPP) &&
+               (memcmp(pact_frm->oui, WFA_OUI, sizeof(pact_frm->oui)) == 0)) {
+               return true;
+       }
+
+       return false;
+}
+
+const char *
+get_dpp_pa_ftype(enum wl_dpp_ftype ftype)
+{
+       switch (ftype) {
+               case DPP_AUTH_REQ:
+                       return "DPP_AUTH_REQ";
+               case DPP_AUTH_RESP:
+                       return "DPP_AUTH_RESP";
+               case DPP_AUTH_CONF:
+                       return "DPP_AUTH_CONF";
+               default:
+                       return "Unkown DPP frame";
+       }
+}
+
+#define GAS_RESP_LEN        2
+#define DOUBLE_TLV_BODY_OFF 4
+bool wl_cfg80211_find_gas_subtype(u8 subtype, u16 adv_id, u8* data, u32 len)
+{
+       const bcm_tlv_t *ie = (bcm_tlv_t *)data;
+       const u8 *frame = NULL;
+       u16 id, flen;
+
+       /* Skipped first ANQP Element, if frame has anqp elemnt */
+       ie = bcm_parse_tlvs(ie, len, DOT11_MNG_ADVERTISEMENT_ID);
+
+       if (ie == NULL)
+               return false;
+
+       frame = (const uint8 *)ie + ie->len + TLV_HDR_LEN + GAS_RESP_LEN;
+       id = ((u16) (((frame)[1] << 8) | (frame)[0]));
+       flen = ((u16) (((frame)[3] << 8) | (frame)[2]));
+
+       /* If the contents match the OUI and the type */
+       if ((flen >= WFA_OUI_LEN + 1) &&
+               (id == adv_id) &&
+               !bcmp(&frame[DOUBLE_TLV_BODY_OFF], (const uint8*)WFA_OUI, WFA_OUI_LEN) &&
+               subtype == frame[DOUBLE_TLV_BODY_OFF+WFA_OUI_LEN]) {
+               return true;
+       }
+
+       return false;
+}
+
+bool wl_cfg80211_is_dpp_gas_action(void *frame, u32 frame_len)
+{
+       wl_dpp_gas_af_t *act_frm = (wl_dpp_gas_af_t *)frame;
+       u32 len;
+       const bcm_tlv_t *ie = NULL;
+
+       if ((frame_len < (sizeof(wl_dpp_gas_af_t) - 1)) ||
+                       act_frm->category != WL_PUB_AF_CATEGORY) {
+               return false;
+       }
+
+       len = frame_len - (u32)(sizeof(wl_dpp_gas_af_t) - 1);
+       if (act_frm->action == WL_PUB_AF_GAS_IREQ) {
+               ie = (bcm_tlv_t *)act_frm->query_data;
+               /* We are interested only in MNG ADV ID. Skip any other id. */
+               ie = bcm_parse_tlvs(ie, len, DOT11_MNG_ADVERTISEMENT_ID);
+       } else if (act_frm->action == WL_PUB_AF_GAS_IRESP) {
+               ie = (bcm_tlv_t *)&act_frm->query_data[WL_GAS_RESP_OFFSET];
+               /* We are interested only in MNG ADV ID. Skip any other id. */
+               ie = bcm_parse_tlvs(ie, len, DOT11_MNG_ADVERTISEMENT_ID);
+       } else {
+               return false;
+       }
+
+       if (ie && (ie->len >= WL_GAS_MIN_LEN) &&
+               (memcmp(&ie->data[WL_GAS_WFA_OFFSET], WFA_OUI, 3) == 0) &&
+               (ie->data[WL_GAS_STYPE_OFFSET] == WL_GAS_WFA_STYPE_DPP)) {
+               WL_DBG(("DPP GAS FRAME. type:%d\n", act_frm->action));
+               return true;
+       }
+
+       /* Non DPP GAS frame */
+       return false;
+}
+
+#ifdef KEEP_ALIVE
+#define KA_TEMP_BUF_SIZE 512
+#define KA_FRAME_SIZE 300
+int
+wl_cfg80211_start_mkeep_alive(struct bcm_cfg80211 *cfg, uint8 mkeep_alive_id,
+       uint16 ether_type, uint8 *ip_pkt, uint16 ip_pkt_len,
+       uint8* src_mac, uint8* dst_mac, uint32 period_msec)
+{
+       const int ETHERTYPE_LEN = 2;
+       char *pbuf = NULL;
+       const char *str;
+       wl_mkeep_alive_pkt_t mkeep_alive_pkt;
+       wl_mkeep_alive_pkt_t *mkeep_alive_pktp = NULL;
+       uint16 buf_len = 0;
+       u8 str_len = 0;
+       int res = BCME_ERROR;
+       uint16 len_bytes = 0;
+       int i = 0;
+       uint16 pmac_frame_len = KA_FRAME_SIZE;
+       uint16 pbuf_len = KA_TEMP_BUF_SIZE;
+
+       /* ether frame to have both max IP pkt (256 bytes) and ether header */
+       char *pmac_frame = NULL;
+       char *pmac_frame_begin = NULL;
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       struct net_device *primary_ndev = NULL;
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       /*
+        * The mkeep_alive packet is for STA interface only; if the bss is configured as AP,
+        * dongle shall reject a mkeep_alive request.
+        */
+       if (!(dhd->op_mode & DHD_FLAG_STA_MODE))
+               return res;
+
+       WL_TRACE(("%s execution\n", __FUNCTION__));
+
+       if ((pbuf = MALLOCZ(cfg->osh, KA_TEMP_BUF_SIZE)) == NULL) {
+               WL_ERR(("failed to allocate buf with size %d\n", KA_TEMP_BUF_SIZE));
+               res = BCME_NOMEM;
+               return res;
+       }
+
+       if ((pmac_frame = MALLOCZ(cfg->osh, pmac_frame_len)) == NULL) {
+               WL_ERR(("failed to allocate mac_frame with size %d\n", pmac_frame_len));
+               res = BCME_NOMEM;
+               goto exit;
+       }
+       pmac_frame_begin = pmac_frame;
+
+       /*
+        * Get current mkeep-alive status.
+        */
+       res = wldev_iovar_getbuf(primary_ndev, "mkeep_alive", &mkeep_alive_id,
+               sizeof(mkeep_alive_id), pbuf, KA_TEMP_BUF_SIZE, &cfg->ioctl_buf_sync);
+       if (res < 0) {
+               WL_ERR(("%s: Get mkeep_alive failed (error=%d)\n", __FUNCTION__, res));
+               goto exit;
+       } else {
+               /* Check available ID whether it is occupied */
+               mkeep_alive_pktp = (wl_mkeep_alive_pkt_t *) pbuf;
+               if (dtoh32(mkeep_alive_pktp->period_msec != 0)) {
+                       WL_ERR(("%s: Get mkeep_alive failed, ID %u is in use.\n",
+                               __FUNCTION__, mkeep_alive_id));
+
+                       /* Current occupied ID info */
+                       WL_ERR(("%s: mkeep_alive\n", __FUNCTION__));
+                       WL_ERR(("   Id    : %d\n"
+                               "   Period: %d msec\n"
+                               "   Length: %d\n"
+                               "   Packet: 0x",
+                               mkeep_alive_pktp->keep_alive_id,
+                               dtoh32(mkeep_alive_pktp->period_msec),
+                               dtoh16(mkeep_alive_pktp->len_bytes)));
+
+                       for (i = 0; i < mkeep_alive_pktp->len_bytes; i++) {
+                               WL_ERR(("%02x", mkeep_alive_pktp->data[i]));
+                       }
+                       WL_ERR(("\n"));
+
+                       res = BCME_NOTFOUND;
+                       goto exit;
+               }
+       }
+
+       /* Request the specified ID */
+       bzero(&mkeep_alive_pkt, sizeof(wl_mkeep_alive_pkt_t));
+       bzero(pbuf, KA_TEMP_BUF_SIZE);
+       str = "mkeep_alive";
+       str_len = strlen(str);
+       strlcpy(pbuf, str, KA_TEMP_BUF_SIZE);
+       buf_len = str_len + 1;
+       pbuf_len -= buf_len;
+
+       mkeep_alive_pktp = (wl_mkeep_alive_pkt_t *) (pbuf + buf_len);
+       mkeep_alive_pkt.period_msec = htod32(period_msec);
+       mkeep_alive_pkt.version = htod16(WL_MKEEP_ALIVE_VERSION);
+       mkeep_alive_pkt.length = htod16(WL_MKEEP_ALIVE_FIXED_LEN);
+       len_bytes = (ETHER_ADDR_LEN*2) + ETHERTYPE_LEN + ip_pkt_len;
+       mkeep_alive_pkt.len_bytes = htod16(len_bytes);
+
+       /* ID assigned */
+       mkeep_alive_pkt.keep_alive_id = mkeep_alive_id;
+
+       buf_len += WL_MKEEP_ALIVE_FIXED_LEN;
+
+       /*
+        * Build up Ethernet Frame
+        */
+
+       /* Mapping dest mac addr */
+       res = memcpy_s(pmac_frame, pmac_frame_len, dst_mac, ETHER_ADDR_LEN);
+       if (res) {
+               goto exit;
+       }
+       pmac_frame += ETHER_ADDR_LEN;
+       pmac_frame_len -= ETHER_ADDR_LEN;
+
+       /* Mapping src mac addr */
+       res = memcpy_s(pmac_frame, pmac_frame_len, src_mac, ETHER_ADDR_LEN);
+       if (res) {
+               goto exit;
+       }
+       pmac_frame += ETHER_ADDR_LEN;
+       pmac_frame_len -= ETHER_ADDR_LEN;
+
+       /* Mapping Ethernet type */
+       ether_type = hton16(ether_type);
+       res = memcpy_s(pmac_frame, pmac_frame_len, &ether_type, ETHERTYPE_LEN);
+       if (res) {
+               goto exit;
+       }
+       pmac_frame += ETHERTYPE_LEN;
+       pmac_frame_len -= ETHERTYPE_LEN;
+
+       /* Mapping IP pkt */
+       res = memcpy_s(pmac_frame, pmac_frame_len, ip_pkt, ip_pkt_len);
+       if (res) {
+               goto exit;
+       }
+       pmac_frame += ip_pkt_len;
+       pmac_frame_len -= ip_pkt_len;
+
+       /*
+        * Keep-alive attributes are set in local variable (mkeep_alive_pkt), and
+        * then memcpy'ed into buffer (mkeep_alive_pktp) since there is no
+        * guarantee that the buffer is properly aligned.
+        */
+       res = memcpy_s((char *)mkeep_alive_pktp, pbuf_len,
+               &mkeep_alive_pkt, WL_MKEEP_ALIVE_FIXED_LEN);
+       if (res) {
+               goto exit;
+       }
+       pbuf_len -= WL_MKEEP_ALIVE_FIXED_LEN;
+
+       /*
+        * Length of ether frame (assume to be all hexa bytes)
+        *     = src mac + dst mac + ether type + ip pkt len
+        */
+       res = memcpy_s(mkeep_alive_pktp->data, pbuf_len,
+               pmac_frame_begin, len_bytes);
+       if (res) {
+               goto exit;
+       }
+       buf_len += len_bytes;
+
+       res = wldev_ioctl_set(primary_ndev, WLC_SET_VAR, pbuf, buf_len);
+exit:
+       if (pmac_frame_begin) {
+               MFREE(cfg->osh, pmac_frame_begin, KA_FRAME_SIZE);
+       }
+       if (pbuf) {
+               MFREE(cfg->osh, pbuf, KA_TEMP_BUF_SIZE);
+       }
+       return res;
+}
+
+int
+wl_cfg80211_stop_mkeep_alive(struct bcm_cfg80211 *cfg, uint8 mkeep_alive_id)
+{
+       char *pbuf = NULL;
+       wl_mkeep_alive_pkt_t mkeep_alive_pkt;
+       wl_mkeep_alive_pkt_t *mkeep_alive_pktp = NULL;
+       int     res = BCME_ERROR;
+       int     i = 0;
+       struct net_device *primary_ndev = NULL;
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       /*
+        * The mkeep_alive packet is for STA interface only; if the bss is configured as AP,
+        * dongle shall reject a mkeep_alive request.
+        */
+       if (!(dhd->op_mode & DHD_FLAG_STA_MODE))
+               return res;
+
+       WL_TRACE(("%s execution\n", __FUNCTION__));
+
+       /*
+        * Get current mkeep-alive status. Skip ID 0 which is being used for NULL pkt.
+        */
+       if ((pbuf = MALLOCZ(cfg->osh, KA_TEMP_BUF_SIZE)) == NULL) {
+               WL_ERR(("failed to allocate buf with size %d\n", KA_TEMP_BUF_SIZE));
+               res = BCME_NOMEM;
+               return res;
+       }
+
+       res = wldev_iovar_getbuf(primary_ndev, "mkeep_alive", &mkeep_alive_id,
+                       sizeof(mkeep_alive_id), pbuf, KA_TEMP_BUF_SIZE, &cfg->ioctl_buf_sync);
+       if (res < 0) {
+               WL_ERR(("%s: Get mkeep_alive failed (error=%d)\n", __FUNCTION__, res));
+               goto exit;
+       } else {
+               /* Check occupied ID */
+               mkeep_alive_pktp = (wl_mkeep_alive_pkt_t *) pbuf;
+               WL_DBG(("%s: mkeep_alive\n", __FUNCTION__));
+               WL_DBG(("   Id    : %d\n"
+                       "   Period: %d msec\n"
+                       "   Length: %d\n"
+                       "   Packet: 0x",
+                       mkeep_alive_pktp->keep_alive_id,
+                       dtoh32(mkeep_alive_pktp->period_msec),
+                       dtoh16(mkeep_alive_pktp->len_bytes)));
+
+               for (i = 0; i < mkeep_alive_pktp->len_bytes; i++) {
+                       WL_DBG(("%02x", mkeep_alive_pktp->data[i]));
+               }
+               WL_DBG(("\n"));
+       }
+
+       /* Make it stop if available */
+       if (dtoh32(mkeep_alive_pktp->period_msec != 0)) {
+               WL_INFORM_MEM(("stop mkeep_alive on ID %d\n", mkeep_alive_id));
+               bzero(&mkeep_alive_pkt, sizeof(wl_mkeep_alive_pkt_t));
+
+               mkeep_alive_pkt.period_msec = 0;
+               mkeep_alive_pkt.version = htod16(WL_MKEEP_ALIVE_VERSION);
+               mkeep_alive_pkt.length = htod16(WL_MKEEP_ALIVE_FIXED_LEN);
+               mkeep_alive_pkt.keep_alive_id = mkeep_alive_id;
+
+               res = wldev_iovar_setbuf(primary_ndev, "mkeep_alive",
+                       (char *)&mkeep_alive_pkt, WL_MKEEP_ALIVE_FIXED_LEN,
+                       pbuf, KA_TEMP_BUF_SIZE, &cfg->ioctl_buf_sync);
+       } else {
+               WL_ERR(("%s: ID %u does not exist.\n", __FUNCTION__, mkeep_alive_id));
+               res = BCME_NOTFOUND;
+       }
+exit:
+       if (pbuf) {
+               MFREE(cfg->osh, pbuf, KA_TEMP_BUF_SIZE);
+       }
+       return res;
+}
+#endif /* KEEP_ALIVE */
+
+s32
+wl_cfg80211_handle_macaddr_change(struct net_device *dev, u8 *macaddr)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       uint8 wait_cnt = WAIT_FOR_DISCONNECT_MAX;
+       u32 status = TRUE;
+
+       if (IS_STA_IFACE(dev->ieee80211_ptr) &&
+               wl_get_drv_status(cfg, CONNECTED, dev)) {
+               /* Macaddress change in connected state. The curent
+                * connection will become invalid. Issue disconnect
+                * to current AP to let the AP know about link down
+                */
+               WL_INFORM_MEM(("macaddr change in connected state. Force disassoc.\n"));
+               wl_cfg80211_disassoc(dev, WLAN_REASON_DEAUTH_LEAVING);
+
+               while ((status = wl_get_drv_status(cfg, CONNECTED, dev)) && wait_cnt) {
+                       WL_DBG(("Waiting for disconnection, wait_cnt: %d\n", wait_cnt));
+                       wait_cnt--;
+                       OSL_SLEEP(50);
+               }
+       }
+       return BCME_OK;
+}
+
+int
+wl_cfg80211_handle_hang_event(struct net_device *ndev, uint16 hang_reason, uint32 memdump_type)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+       WL_INFORM_MEM(("hang reason = %d, memdump_type =%d\n",
+               hang_reason, memdump_type));
+
+       /* check if pre-registered mac matches the mac from dongle via WLC_E_LINK */
+       if (wl_get_drv_status(cfg, READY, ndev)) {
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+               wl_copy_hang_info_if_falure(ndev,
+                       hang_reason, BCME_NOTFOUND);
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+               SUPP_LOG(("Err. hang reason:%d, dump_type:%d\n", hang_reason, memdump_type));
+               wl_flush_fw_log_buffer(ndev, FW_LOGSET_MASK_ALL);
+               /* IF dongle is down due to previous hang or other conditions,
+                * sending 0ne more hang notification is not needed.
+                */
+
+               if (dhd_query_bus_erros(dhd)) {
+                       return BCME_ERROR;
+               }
+               dhd->iface_op_failed = TRUE;
+#if defined(DHD_FW_COREDUMP)
+               if (dhd->memdump_enabled) {
+                       dhd->memdump_type = memdump_type;
+                       dhd_bus_mem_dump(dhd);
+               }
+#endif /* DHD_FW_COREDUMP */
+               WL_ERR(("Notify hang event to upper layer \n"));
+               dhd->hang_reason = hang_reason;
+               net_os_send_hang_message(ndev);
+       }
+
+       return BCME_OK;
+}
+
+s32
+wl_cfg80211_autochannel(struct net_device *dev, char* command, int total_len)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       int ret = 0;
+       int bytes_written = -1;
+
+       sscanf(command, "%*s %d", &cfg->autochannel);
+
+       if (cfg->autochannel == 0) {
+               cfg->best_2g_ch = 0;
+               cfg->best_5g_ch = 0;
+       } else if (cfg->autochannel == 2) {
+               bytes_written = snprintf(command, total_len, "2g=%d 5g=%d",
+                       cfg->best_2g_ch, cfg->best_5g_ch);
+               WL_TRACE(("%s: command result is %s\n", __FUNCTION__, command));
+               ret = bytes_written;
+       }
+
+       return ret;
+}
+
+int
+wl_cfg80211_check_in4way(struct bcm_cfg80211 *cfg,
+       struct net_device *dev, uint action, enum wl_ext_status status, void *context)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       struct wl_security *sec;
+       s32 bssidx = -1;
+       int ret = 0, cur_eapol_status, ifidx;
+       int max_wait_time, max_wait_cnt;
+       int suppressed = 0;
+
+       mutex_lock(&cfg->in4way_sync);
+       action = action & dhdp->conf->in4way;
+       WL_DBG(("status=%d, action=0x%x, in4way=0x%x\n", status, action, dhdp->conf->in4way));
+
+       cur_eapol_status = dhdp->conf->eapol_status;
+       switch (status) {
+               case WL_EXT_STATUS_SCAN:
+                       wldev_ioctl(dev, WLC_GET_SCANSUPPRESS, &suppressed, sizeof(int), false);
+                       if (suppressed) {
+                               WL_ERR(("scan suppressed\n"));
+                               ret = -EBUSY;
+                               break;
+                       }
+                       if (action & NO_SCAN_IN4WAY) {
+                               if (cfg->handshaking > 0 && cfg->handshaking <= 3) {
+                                       WL_ERR(("return -EBUSY cnt %d\n", cfg->handshaking));
+                                       cfg->handshaking++;
+                                       ret = -EBUSY;
+                                       break;
+                               }
+                       }
+                       break;
+               case WL_EXT_STATUS_DISCONNECTING:
+                       if (cur_eapol_status >= EAPOL_STATUS_4WAY_START &&
+                                       cur_eapol_status < EAPOL_STATUS_4WAY_DONE) {
+                               WL_ERR(("WPA failed at %d\n", cur_eapol_status));
+                               dhdp->conf->eapol_status = EAPOL_STATUS_NONE;
+                       } else if (cur_eapol_status >= EAPOL_STATUS_WSC_START &&
+                                       cur_eapol_status < EAPOL_STATUS_WSC_DONE) {
+                               WL_ERR(("WPS failed at %d\n", cur_eapol_status));
+                               dhdp->conf->eapol_status = EAPOL_STATUS_NONE;
+                       }
+                       if (action & (NO_SCAN_IN4WAY|NO_BTC_IN4WAY)) {
+                               if (cfg->handshaking) {
+                                       if ((action & NO_BTC_IN4WAY) && cfg->btc_mode) {
+                                               WL_TRACE(("status=%d, restore btc_mode %d\n",
+                                                       status, cfg->btc_mode));
+                                               wldev_iovar_setint(dev, "btc_mode", cfg->btc_mode);
+                                       }
+                                       cfg->handshaking = 0;
+                               }
+                       }
+                       if (action & WAIT_DISCONNECTED) {
+                               max_wait_time = 200;
+                               max_wait_cnt = 20;
+                               cfg->disconnected_jiffies = jiffies;
+                               while (!time_after(jiffies,
+                                               cfg->disconnected_jiffies + msecs_to_jiffies(max_wait_time)) &&
+                                               max_wait_cnt) {
+                                       WL_TRACE(("status=%d, max_wait_cnt=%d waiting...\n",
+                                               status, max_wait_cnt));
+                                       mutex_unlock(&cfg->in4way_sync);
+                                       OSL_SLEEP(50);
+                                       mutex_lock(&cfg->in4way_sync);
+                                       max_wait_cnt--;
+                               }
+                               wake_up_interruptible(&dhdp->conf->event_complete);
+                       }
+                       break;
+               case WL_EXT_STATUS_CONNECTING:
+                       if (action & (NO_SCAN_IN4WAY|NO_BTC_IN4WAY)) {
+                               bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr);
+                               sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+                               if ((sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2)) &&
+                                               bssidx == 0) {
+                                       dhdp->conf->eapol_status = EAPOL_STATUS_4WAY_START;
+                                       cfg->handshaking = 1;
+                                       if (action & NO_BTC_IN4WAY) {
+                                               ret = wldev_iovar_getint(dev, "btc_mode", &cfg->btc_mode);
+                                               if (!ret && cfg->btc_mode) {
+                                                       WL_TRACE(("status=%d, disable current btc_mode %d\n",
+                                                               status, cfg->btc_mode));
+                                                       wldev_iovar_setint(dev, "btc_mode", 0);
+                                               }
+                                       }
+                               }
+                       }
+                       if (action & WAIT_DISCONNECTED) {
+                               max_wait_time = 200;
+                               max_wait_cnt = 10;
+                               while (!time_after(jiffies,
+                                               cfg->disconnected_jiffies + msecs_to_jiffies(max_wait_time)) &&
+                                               max_wait_cnt) {
+                                       WL_TRACE(("status=%d, max_wait_cnt=%d waiting...\n",
+                                               status, max_wait_cnt));
+                                       mutex_unlock(&cfg->in4way_sync);
+                                       OSL_SLEEP(50);
+                                       mutex_lock(&cfg->in4way_sync);
+                                       max_wait_cnt--;
+                               }
+                               wake_up_interruptible(&dhdp->conf->event_complete);
+                       }
+                       break;
+               case WL_EXT_STATUS_CONNECTED:
+                       ifidx = dhd_net2idx(dhdp->info, dev);
+                       if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION && ifidx >= 0) {
+                               dhd_conf_set_wme(cfg->pub, ifidx, 0);
+                               wake_up_interruptible(&dhdp->conf->event_complete);
+                       }
+                       else if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_CLIENT) {
+                               dhd_conf_set_mchan_bw(cfg->pub, WL_P2P_IF_CLIENT, -1);
+                       }
+                       break;
+               case WL_EXT_STATUS_DISCONNECTED:
+                       if (cur_eapol_status >= EAPOL_STATUS_4WAY_START &&
+                                       cur_eapol_status < EAPOL_STATUS_4WAY_DONE) {
+                               WL_ERR(("WPA failed at %d\n", cur_eapol_status));
+                               dhdp->conf->eapol_status = EAPOL_STATUS_NONE;
+                       } else if (cur_eapol_status >= EAPOL_STATUS_WSC_START &&
+                                       cur_eapol_status < EAPOL_STATUS_WSC_DONE) {
+                               WL_ERR(("WPS failed at %d\n", cur_eapol_status));
+                               dhdp->conf->eapol_status = EAPOL_STATUS_NONE;
+                       }
+                       if (action & (NO_SCAN_IN4WAY|NO_BTC_IN4WAY)) {
+                               if (cfg->handshaking) {
+                                       if ((action & NO_BTC_IN4WAY) && cfg->btc_mode) {
+                                               WL_TRACE(("status=%d, restore btc_mode %d\n",
+                                                       status, cfg->btc_mode));
+                                               wldev_iovar_setint(dev, "btc_mode", cfg->btc_mode);
+                                       }
+                                       cfg->handshaking = 0;
+                               }
+                       }
+                       if (action & WAIT_DISCONNECTED) {
+                               cfg->disconnected_jiffies = jiffies;
+                       }
+                       wake_up_interruptible(&dhdp->conf->event_complete);
+                       break;
+               case WL_EXT_STATUS_ADD_KEY:
+                       dhdp->conf->eapol_status = EAPOL_STATUS_4WAY_DONE;
+                       if (action & (NO_SCAN_IN4WAY|NO_BTC_IN4WAY)) {
+                               if (cfg->handshaking) {
+                                       if ((action & NO_BTC_IN4WAY) && cfg->btc_mode) {
+                                               WL_TRACE(("status=%d, restore btc_mode %d\n",
+                                                       status, cfg->btc_mode));
+                                               wldev_iovar_setint(dev, "btc_mode", cfg->btc_mode);
+                                       }
+                                       cfg->handshaking = 0;
+                               }
+                       }
+                       wake_up_interruptible(&dhdp->conf->event_complete);
+                       break;
+               case WL_EXT_STATUS_AP_ENABLED:
+                       ifidx = dhd_net2idx(dhdp->info, dev);
+                       if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP && ifidx >= 0) {
+                               dhd_conf_set_wme(cfg->pub, ifidx, 1);
+                       }
+                       else if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) {
+                               dhd_conf_set_mchan_bw(cfg->pub, WL_P2P_IF_GO, -1);
+                       }
+                       break;
+               case WL_EXT_STATUS_DELETE_STA:
+                       if ((action & DONT_DELETE_GC_AFTER_WPS) &&
+                                       (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO)) {
+                               u8* mac_addr = context;
+                               if (mac_addr && memcmp(&ether_bcast, mac_addr, ETHER_ADDR_LEN) &&
+                                               cur_eapol_status == EAPOL_STATUS_WSC_DONE) {
+                                       u32 timeout;
+                                       max_wait_time = 300;
+                                       WL_TRACE(("status=%d, wps_done=%d, waiting %dms ...\n",
+                                               status, cfg->wps_done, max_wait_time));
+                                       mutex_unlock(&cfg->in4way_sync);
+                                       timeout = wait_event_interruptible_timeout(cfg->wps_done_event,
+                                               cfg->wps_done, msecs_to_jiffies(max_wait_time));
+                                       mutex_lock(&cfg->in4way_sync);
+                                       WL_TRACE(("status=%d, wps_done=%d, timeout=%d\n",
+                                               status, cfg->wps_done, timeout));
+                                       if (timeout > 0) {
+                                               ret = -1;
+                                               break;
+                                       }
+                               } else {
+                                       WL_TRACE(("status=%d, wps_done=%d => 0\n", status, cfg->wps_done));
+                                       cfg->wps_done = FALSE;
+                                       dhdp->conf->eapol_status = EAPOL_STATUS_NONE;
+                               }
+                       }
+                       break;
+               case WL_EXT_STATUS_STA_DISCONNECTED:
+                       if ((action & DONT_DELETE_GC_AFTER_WPS) &&
+                                       (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
+                                       cur_eapol_status == EAPOL_STATUS_WSC_DONE) {
+                               WL_TRACE(("status=%d, wps_done=%d => 0\n", status, cfg->wps_done));
+                               cfg->wps_done = FALSE;
+                       }
+                       break;
+               case WL_EXT_STATUS_STA_CONNECTED:
+                       if ((action & DONT_DELETE_GC_AFTER_WPS) &&
+                                       (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
+                                       cur_eapol_status == EAPOL_STATUS_WSC_DONE) {
+                               WL_TRACE(("status=%d, wps_done=%d => 1\n", status, cfg->wps_done));
+                               cfg->wps_done = TRUE;
+                               wake_up_interruptible(&cfg->wps_done_event);
+                       }
+                       break;
+               default:
+                       WL_ERR(("Unknown action=0x%x, status=%d\n", action, status));
+       }
+
+       mutex_unlock(&cfg->in4way_sync);
+
+       return ret;
+}
diff --git a/bcmdhd.101.10.240.x/wl_cfg80211.h b/bcmdhd.101.10.240.x/wl_cfg80211.h
new file mode 100644 (file)
index 0000000..1401eab
--- /dev/null
@@ -0,0 +1,2702 @@
+/*
+ * Linux cfg80211 driver
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+/**
+ * Older Linux versions support the 'iw' interface, more recent ones the 'cfg80211' interface.
+ */
+
+#ifndef _wl_cfg80211_h_
+#define _wl_cfg80211_h_
+
+#include <linux/wireless.h>
+#include <typedefs.h>
+#include <ethernet.h>
+#include <wlioctl.h>
+#include <linux/wireless.h>
+#include <net/cfg80211.h>
+#include <linux/rfkill.h>
+#include <osl.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+
+#define WL_CFG_DRV_LOCK(lock, flags)   (flags) = osl_spin_lock(lock)
+#define WL_CFG_DRV_UNLOCK(lock, flags) osl_spin_unlock((lock), (flags))
+
+#define WL_CFG_WPS_SYNC_LOCK(lock, flags)      (flags) = osl_spin_lock(lock)
+#define WL_CFG_WPS_SYNC_UNLOCK(lock, flags)    osl_spin_unlock((lock), (flags))
+
+#define WL_CFG_NET_LIST_SYNC_LOCK(lock, flags)         (flags) = osl_spin_lock(lock)
+#define WL_CFG_NET_LIST_SYNC_UNLOCK(lock, flags)       osl_spin_unlock((lock), (flags))
+
+#define WL_CFG_EQ_LOCK(lock, flags)    (flags) = osl_spin_lock(lock)
+#define WL_CFG_EQ_UNLOCK(lock, flags)  osl_spin_unlock((lock), (flags))
+
+#define WL_CFG_BAM_LOCK(lock, flags)   (flags) = osl_spin_lock(lock)
+#define WL_CFG_BAM_UNLOCK(lock, flags) osl_spin_unlock((lock), (flags))
+
+#define WL_CFG_VNDR_OUI_SYNC_LOCK(lock, flags)         (flags) = osl_spin_lock(lock)
+#define WL_CFG_VNDR_OUI_SYNC_UNLOCK(lock, flags)       osl_spin_unlock((lock), (flags))
+
+#include <wl_cfgp2p.h>
+#include <wl_android.h>
+#ifdef WL_NAN
+#include <wl_cfgnan.h>
+#endif /* WL_NAN */
+#ifdef WL_BAM
+#include <wl_bam.h>
+#endif  /* WL_BAM */
+
+#ifdef BIGDATA_SOFTAP
+#include <wl_bigdata.h>
+#endif /* BIGDATA_SOFTAP */
+
+struct wl_conf;
+struct wl_iface;
+struct bcm_cfg80211;
+struct wl_security;
+struct wl_ibss;
+
+#if !defined(WL_CLIENT_SAE) && (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0))
+#define WL_CLIENT_SAE
+#endif
+#if defined(WL_SAE) && (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+#error "Can not support WL_SAE befor kernel 3.14"
+#endif
+#if defined(WL_CLIENT_SAE) && (LINUX_VERSION_CODE < KERNEL_VERSION(4, 9, 0))
+#error "Can not support WL_CLIENT_SAE before kernel 4.9"
+#endif
+#if defined(WL_CLIENT_SAE) && defined(WL_SAE)
+#error "WL_SAE is for dongle-offload and WL_CLIENT_SAE is for wpa_supplicant. Please choose one."
+#endif
+
+#if defined(WL_CLIENT_SAE)
+#ifndef WL_ASSOC_MGR_CMD_SEND_AUTH
+#define WL_ASSOC_MGR_CMD_SEND_AUTH 3
+#endif /* WL_ASSOC_MGR_CMD_SEND_AUTH */
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0) && !defined(WL_SCAN_TYPE))
+#define WL_SCAN_TYPE
+#endif /* WL_SCAN_TYPE */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)) && !defined(WL_FILS)
+#define WL_FILS
+#endif /* WL_FILS */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 18, 0)) && !defined(WL_FILS_ROAM_OFFLD)
+#define WL_FILS_ROAM_OFFLD
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0))
+/* Use driver managed regd */
+#define WL_SELF_MANAGED_REGDOM
+#endif /* KERNEL >= 4.0 */
+
+#ifdef WL_SAE
+#define IS_AKM_SAE(akm) (akm == WLAN_AKM_SUITE_SAE)
+#else
+#define IS_AKM_SAE(akm) FALSE
+#endif
+#ifdef WL_OWE
+#define IS_AKM_OWE(akm) (akm == WLAN_AKM_SUITE_OWE)
+#else
+#define IS_AKM_OWE(akm) FALSE
+#endif
+
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh64(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+
+#define WL_DBG_NONE    0
+#define WL_DBG_P2P_ACTION      (1 << 5)
+#define WL_DBG_TRACE   (1 << 4)
+#define WL_DBG_SCAN    (1 << 3)
+#define WL_DBG_DBG     (1 << 2)
+#define WL_DBG_INFO    (1 << 1)
+#define WL_DBG_ERR     (1 << 0)
+
+#ifndef WAIT_FOR_DISCONNECT_MAX
+#define WAIT_FOR_DISCONNECT_MAX 10
+#endif /* WAIT_FOR_DISCONNECT_MAX */
+#define WAIT_FOR_DISCONNECT_STATE_SYNC 10
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+/* Newer kernels use defines from nl80211.h */
+#define IEEE80211_BAND_2GHZ    NL80211_BAND_2GHZ
+#define IEEE80211_BAND_5GHZ    NL80211_BAND_5GHZ
+#define IEEE80211_BAND_60GHZ NL80211_BAND_60GHZ
+#define IEEE80211_NUM_BANDS    NUM_NL80211_BANDS
+#endif /* LINUX_VER >= 4.7 */
+
+/* Max BAND support */
+#define WL_MAX_BAND_SUPPORT 3
+
+#ifdef DHD_LOG_DUMP
+extern void dhd_log_dump_write(int type, char *binary_data,
+               int binary_len, const char *fmt, ...);
+extern char *dhd_log_dump_get_timestamp(void);
+#ifndef _DHD_LOG_DUMP_DEFINITIONS_
+#define DHD_LOG_DUMP_WRITE(fmt, ...) \
+       dhd_log_dump_write(DLD_BUF_TYPE_GENERAL, NULL, 0, fmt, ##__VA_ARGS__)
+#define DHD_LOG_DUMP_WRITE_EX(fmt, ...) \
+       dhd_log_dump_write(DLD_BUF_TYPE_SPECIAL, NULL, 0, fmt, ##__VA_ARGS__)
+#endif /* !_DHD_LOG_DUMP_DEFINITIONS_ */
+#endif /* DHD_LOG_DUMP */
+
+/* On some MSM platform, it uses different version
+ * of linux kernel and cfg code as not synced.
+ * MSM defined CFG80211_DISCONNECTED_V2 as the flag
+ * when they uses different kernel/cfg version.
+ */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)) || (defined(CONFIG_ARCH_MSM) && \
+       defined(CFG80211_DISCONNECTED_V2))
+#define CFG80211_DISCONNECTED(dev, reason, ie, len, loc_gen, gfp) \
+       cfg80211_disconnected(dev, reason, ie, len, loc_gen, gfp);
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(4, 2, 0))
+#define CFG80211_DISCONNECTED(dev, reason, ie, len, loc_gen, gfp) \
+       BCM_REFERENCE(loc_gen); \
+       cfg80211_disconnected(dev, reason, ie, len, gfp);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)) */
+
+/* 0 invalidates all debug messages.  default is 1 */
+#define WL_DBG_LEVEL 0xFF
+
+#define CFG80211_INFO_TEXT             "[dhd] CFG80211-INFO) "
+/* Samsung want to print INFO2 instead of ERROR
+ * because most of case, ERROR message is not a real ERROR.
+ * but it can be regarded as real error case for Tester
+ */
+#ifdef CUSTOMER_HW4_DEBUG
+#define CFG80211_ERROR_TEXT            "[dhd] CFG80211-INFO2) "
+#else
+#define CFG80211_ERROR_TEXT            "[dhd] CFG80211-ERROR) "
+#endif /* CUSTOMER_HW4_DEBUG */
+
+#if defined(DHD_DEBUG)
+#ifdef DHD_LOG_DUMP
+#define        WL_ERR_MSG(x, args...)  \
+do {   \
+       if (wl_dbg_level & WL_DBG_ERR) {        \
+               printk(KERN_INFO CFG80211_ERROR_TEXT "%s : " x, __func__, ## args);     \
+               DHD_LOG_DUMP_WRITE("[%s] %s: ", dhd_log_dump_get_timestamp(), __func__);        \
+               DHD_LOG_DUMP_WRITE(x, ## args); \
+       }       \
+} while (0)
+#define WL_ERR(x) WL_ERR_MSG x
+#define WL_ERR_KERN_MSG(x, args...)    \
+do {   \
+       if (wl_dbg_level & WL_DBG_ERR) {        \
+               printk(KERN_INFO CFG80211_ERROR_TEXT "%s : " x, __func__, ## args);     \
+       }       \
+} while (0)
+#define WL_ERR_KERN(x) WL_ERR_KERN_MSG x
+#define        WL_ERR_MEM_MSG(x, args...)      \
+do {   \
+       if (wl_dbg_level & WL_DBG_ERR) {        \
+               DHD_LOG_DUMP_WRITE("[%s] %s: ", dhd_log_dump_get_timestamp(), __func__);        \
+               DHD_LOG_DUMP_WRITE(x, ## args); \
+       }       \
+} while (0)
+/* Prints to debug ring by default. If dbg level is enabled, prints on to
+ * console as well
+ */
+#define        WL_DBG_MEM(args)        \
+do {   \
+       if (wl_dbg_level & WL_DBG_DBG) {        \
+               printk(KERN_INFO CFG80211_INFO_TEXT "%s : ", __func__); \
+               printk args;    \
+       }       \
+       DHD_LOG_DUMP_WRITE("[%s] %s: ", dhd_log_dump_get_timestamp(), __func__);        \
+       DHD_LOG_DUMP_WRITE args;        \
+} while (0)
+#define WL_ERR_MEM(x) WL_ERR_MEM_MSG x
+#define        WL_INFORM_MEM_MSG(x, args...)   \
+do {   \
+       if (wl_dbg_level & WL_DBG_INFO) {       \
+               printk(KERN_INFO CFG80211_INFO_TEXT "%s : " x, __func__, ## args);      \
+               DHD_LOG_DUMP_WRITE("[%s] %s: ", dhd_log_dump_get_timestamp(), __func__);        \
+               DHD_LOG_DUMP_WRITE(x, ## args); \
+       }       \
+} while (0)
+#define WL_INFORM_MEM(x) WL_INFORM_MEM_MSG x
+#define        WL_ERR_EX(args) \
+do {   \
+       if (wl_dbg_level & WL_DBG_ERR) {        \
+               printk(KERN_INFO CFG80211_ERROR_TEXT "%s : " x, __func__, ## args);     \
+               DHD_LOG_DUMP_WRITE_EX("[%s] %s: ", dhd_log_dump_get_timestamp(), __func__);     \
+               DHD_LOG_DUMP_WRITE_EX args;     \
+       }       \
+} while (0)
+#define        WL_MEM(args)    \
+do {   \
+       DHD_LOG_DUMP_WRITE("[%s] %s: ", dhd_log_dump_get_timestamp(), __func__);        \
+       DHD_LOG_DUMP_WRITE args;        \
+} while (0)
+#else
+#define        WL_ERR_MSG(x, args...)                                                                  \
+do {                                                                           \
+       if (wl_dbg_level & WL_DBG_ERR) {                                \
+               printk(KERN_INFO CFG80211_ERROR_TEXT "%s : " x, __func__, ## args);     \
+       }                                                               \
+} while (0)
+#define WL_ERR(x) WL_ERR_MSG x
+#define WL_ERR_KERN(args) WL_ERR(args)
+#define WL_ERR_MEM(args) WL_ERR(args)
+#define WL_INFORM_MEM(args) WL_INFORM(args)
+#define WL_DBG_MEM(args) WL_DBG(args)
+#define WL_ERR_EX(args) WL_ERR(args)
+#define WL_MEM(args) WL_DBG(args)
+#endif /* DHD_LOG_DUMP */
+#else /* defined(DHD_DEBUG) */
+#define        WL_ERR_MSG(x, args...)                                                                  \
+do {                                                                           \
+       if ((wl_dbg_level & WL_DBG_ERR) && net_ratelimit()) {                           \
+               printk(KERN_INFO CFG80211_ERROR_TEXT "%s : " x, __func__, ## args);     \
+       }                                                               \
+} while (0)
+#define WL_ERR(x) WL_ERR_MSG x
+#define WL_ERR_KERN(args) WL_ERR(args)
+#define WL_ERR_MEM(args) WL_ERR(args)
+#define WL_INFORM_MEM(args) WL_INFORM(args)
+#define WL_DBG_MEM(args) WL_DBG(args)
+#define WL_ERR_EX(args) WL_ERR(args)
+#define WL_MEM(args) WL_DBG(args)
+#endif /* defined(DHD_DEBUG) */
+
+#if defined(__linux__)
+#define WL_PRINT_RATE_LIMIT_PERIOD 4000000000u /* 4s in units of ns */
+#endif
+#if defined(__linux__)
+#define WL_ERR_RLMT(args) \
+do {   \
+       if (wl_dbg_level & WL_DBG_ERR) {        \
+               static uint64 __err_ts = 0; \
+               static uint32 __err_cnt = 0; \
+               uint64 __cur_ts = 0; \
+               __cur_ts = local_clock(); \
+               if (__err_ts == 0 || (__cur_ts > __err_ts && \
+               (__cur_ts - __err_ts > WL_PRINT_RATE_LIMIT_PERIOD))) { \
+                       __err_ts = __cur_ts; \
+                       WL_ERR(args);   \
+                       WL_ERR(("[Repeats %u times]\n", __err_cnt)); \
+                       __err_cnt = 0; \
+               } else { \
+                       ++__err_cnt; \
+               } \
+       }       \
+} while (0)
+#else /* defined(__linux__) && !defined(DHD_EFI) */
+#define WL_ERR_RLMT(args) WL_ERR(args)
+#endif
+
+#ifdef WL_INFORM
+#undef WL_INFORM
+#endif
+
+#define        WL_INFORM_MSG(x, args...)                                                                       \
+do {                                                                           \
+       if (wl_dbg_level & WL_DBG_INFO) {                               \
+               printk(KERN_INFO "[dhd] CFG80211-INFO) %s : " x, __func__, ## args);    \
+       }                                                               \
+} while (0)
+#define WL_INFORM(x) WL_INFORM_MSG x
+
+#ifdef WL_SCAN
+#undef WL_SCAN
+#endif
+#define        WL_SCAN_MSG(x, args...)                                                         \
+do {                                                                   \
+       if (wl_dbg_level & WL_DBG_SCAN) {                       \
+               printk(KERN_INFO "[dhd] CFG80211-SCAN) %s :" x, __func__, ## args);     \
+       }                                                                       \
+} while (0)
+#define WL_SCAN(x) WL_SCAN_MSG x
+#ifdef WL_TRACE
+#undef WL_TRACE
+#endif
+#define        WL_TRACE_MSG(x, args...)                                                                \
+do {                                                                   \
+       if (wl_dbg_level & WL_DBG_TRACE) {                      \
+               printk(KERN_INFO "[dhd] CFG80211-TRACE) %s :" x, __func__, ## args); \
+       }                                                                       \
+} while (0)
+#define WL_TRACE(x) WL_TRACE_MSG x
+#ifdef WL_TRACE_HW4
+#undef WL_TRACE_HW4
+#endif
+#ifdef CUSTOMER_HW4_DEBUG
+#define        WL_TRACE_HW4(args)                                      \
+do {                                                                           \
+       if (wl_dbg_level & WL_DBG_ERR) {                                \
+                       printk(KERN_INFO "CFG80211-TRACE) %s : ", __func__);    \
+                       printk args;                                            \
+               }                                                               \
+} while (0)
+#else
+#define        WL_TRACE_HW4                    WL_TRACE
+#endif /* CUSTOMER_HW4_DEBUG */
+#if (WL_DBG_LEVEL > 0)
+#define        WL_DBG_MSG(x, args...)                                                          \
+do {                                                                   \
+       if (wl_dbg_level & WL_DBG_DBG) {                        \
+               printk(KERN_INFO "[dhd] CFG80211-DEBUG) %s :" x, __func__, ## args); \
+       }                                                                       \
+} while (0)
+#define WL_DBG(x) WL_DBG_MSG x
+#else                          /* !(WL_DBG_LEVEL > 0) */
+#define        WL_DBG(args)
+#endif                         /* (WL_DBG_LEVEL > 0) */
+#define WL_PNO(x)
+#define WL_SD(x)
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+#define ieee80211_band nl80211_band
+#define IEEE80211_BAND_2GHZ NL80211_BAND_2GHZ
+#define IEEE80211_BAND_5GHZ NL80211_BAND_5GHZ
+#define IEEE80211_NUM_BANDS NUM_NL80211_BANDS
+#endif
+
+#define WL_SCAN_RETRY_MAX   3
+#define WL_NUM_PMKIDS_MAX   MAXPMKID
+#define WL_SCAN_BUF_MAX     (1024 * 8)
+#define WL_TLV_INFO_MAX     1500
+#define WL_SCAN_IE_LEN_MAX  2048
+#define WL_BSS_INFO_MAX     2048
+#define WL_ASSOC_INFO_MAX   512
+/* the length of pmkid_info iovar is 1416
+ * It exceed the original 1024 limitation
+ * so change WL_EXTRA_LEN_MAX to 2048
+ */
+#define WL_IOCTL_LEN_MAX        2048
+#define WL_EXTRA_BUF_MAX        2048
+#define WL_SCAN_ERSULTS_LAST    (WL_SCAN_RESULTS_NO_MEM+1)
+#define WL_AP_MAX                          256
+#define WL_FILE_NAME_MAX        256
+#define WL_DEFAULT_DWELL_TIME   200
+#define WL_MED_DWELL_TIME       400
+#define WL_MIN_DWELL_TIME       100
+#define WL_LONG_DWELL_TIME      1000
+#define IFACE_MAX_CNT           5
+#define WL_SCAN_CONNECT_DWELL_TIME_MS          200
+#define WL_SCAN_JOIN_PROBE_INTERVAL_MS         20
+#define WL_SCAN_JOIN_ACTIVE_DWELL_TIME_MS      320
+#define WL_BCAST_SCAN_JOIN_ACTIVE_DWELL_TIME_MS        80
+#define WL_SCAN_JOIN_PASSIVE_DWELL_TIME_MS     400
+#define WL_AF_TX_MAX_RETRY     5
+#define WL_AF_TX_MIN_RETRY     3
+
+#define WL_AF_SEARCH_TIME_MAX          450
+#define WL_AF_TX_EXTRA_TIME_MAX                200
+
+#define WL_SCAN_TIMER_INTERVAL_MS      10000 /* Scan timeout */
+#ifdef WL_NAN
+#define WL_SCAN_TIMER_INTERVAL_MS_NAN  15000 /* Scan timeout */
+#endif /* WL_NAN */
+#ifdef WL_6G_BAND
+/* additional scan timeout for 6GHz, 15*110msec, rounded to 3000msec */
+#define WL_SCAN_TIMER_INTERVAL_MS_6G   3000
+#endif /* WL_6G_BAND */
+#define WL_CHANNEL_SYNC_RETRY  5
+#define WL_INVALID             -1
+
+#ifdef DHD_LOSSLESS_ROAMING
+#define WL_ROAM_TIMEOUT_MS     1000 /* Roam timeout */
+#endif
+/* Bring down SCB Timeout to 20secs from 60secs default */
+#ifndef WL_SCB_TIMEOUT
+#define WL_SCB_TIMEOUT 20
+#endif
+
+#if defined(ROAM_ENABLE) || defined(ROAM_CHANNEL_CACHE)
+#define  ESCAN_CHANNEL_CACHE
+#endif
+
+#ifndef WL_SCB_ACTIVITY_TIME
+#define WL_SCB_ACTIVITY_TIME   5
+#endif
+
+#ifndef WL_SCB_MAX_PROBE
+#define WL_SCB_MAX_PROBE       3
+#endif
+
+#ifndef WL_PSPRETEND_RETRY_LIMIT
+#define WL_PSPRETEND_RETRY_LIMIT 1
+#endif
+
+#ifndef WL_MIN_PSPRETEND_THRESHOLD
+#define WL_MIN_PSPRETEND_THRESHOLD     2
+#endif
+
+/* Cipher suites */
+#ifndef WLAN_CIPHER_SUITE_PMK
+#define WLAN_CIPHER_SUITE_PMK                  0x00904C00
+#endif /* WLAN_CIPHER_SUITE_PMK */
+
+#ifndef WLAN_AKM_SUITE_FT_8021X
+#define WLAN_AKM_SUITE_FT_8021X                        0x000FAC03
+#endif /* WLAN_AKM_SUITE_FT_8021X */
+
+#ifndef WLAN_AKM_SUITE_FT_PSK
+#define WLAN_AKM_SUITE_FT_PSK                  0x000FAC04
+#endif /* WLAN_AKM_SUITE_FT_PSK */
+
+#define WLAN_AKM_SUITE_SAE_SHA256      0x000FAC08
+
+#ifndef WLAN_AKM_SUITE_8021X_SUITE_B
+#define WLAN_AKM_SUITE_8021X_SUITE_B           0x000FAC0B
+#define WLAN_AKM_SUITE_8021X_SUITE_B_192       0x000FAC0C
+#endif /* WLAN_AKM_SUITE_8021X_SUITE_B */
+
+/* TODO: even in upstream linux(v5.0), FT-1X-SHA384 isn't defined and supported yet.
+ * need to revisit here to sync correct name later.
+ */
+#define WLAN_AKM_SUITE_FT_8021X_SHA384         0x000FAC0D
+
+#define WL_AKM_SUITE_SHA256_1X  0x000FAC05
+#define WL_AKM_SUITE_SHA256_PSK 0x000FAC06
+
+#ifndef WLAN_AKM_SUITE_FILS_SHA256
+#define WLAN_AKM_SUITE_FILS_SHA256             0x000FAC0E
+#define WLAN_AKM_SUITE_FILS_SHA384             0x000FAC0F
+#define WLAN_AKM_SUITE_FT_FILS_SHA256          0x000FAC10
+#define WLAN_AKM_SUITE_FT_FILS_SHA384          0x000FAC11
+#endif /* WLAN_AKM_SUITE_FILS_SHA256 */
+
+#define MIN_VENDOR_EXTN_IE_LEN         2
+#ifdef WL_OWE
+#ifndef WLAN_AKM_SUITE_OWE
+#define WLAN_AKM_SUITE_OWE                0X000FAC12
+#endif /* WPA_KEY_MGMT_OWE */
+#endif /* WL_OWE */
+#define WLAN_AKM_SUITE_DPP                0X506F9A02
+
+/*
+ * BRCM local.
+ * Use a high number that's unlikely to clash with linux upstream for a while until we can
+ * submit these changes to the community.
+*/
+#define NL80211_FEATURE_FW_4WAY_HANDSHAKE (1<<31)
+
+/* SCAN_SUPPRESS timer values in ms */
+#define WL_SCAN_SUPPRESS_TIMEOUT 31000 /* default Framwork DHCP timeout is 30 sec */
+#define WL_SCAN_SUPPRESS_RETRY 3000
+
+#define WL_PM_ENABLE_TIMEOUT 10000
+
+/* cfg80211 wowlan definitions */
+#define WL_WOWLAN_MAX_PATTERNS                 8
+#define WL_WOWLAN_MIN_PATTERN_LEN              1
+#define WL_WOWLAN_MAX_PATTERN_LEN              255
+#define WL_WOWLAN_PKT_FILTER_ID_FIRST  201
+#define WL_WOWLAN_PKT_FILTER_ID_LAST   (WL_WOWLAN_PKT_FILTER_ID_FIRST + \
+                                                                       WL_WOWLAN_MAX_PATTERNS - 1)
+#ifdef WLAIBSS
+#define IBSS_COALESCE_DEFAULT 0
+#define IBSS_INITIAL_SCAN_ALLOWED_DEFAULT 0
+#else  /* WLAIBSS */
+#define IBSS_COALESCE_DEFAULT 1
+#define IBSS_INITIAL_SCAN_ALLOWED_DEFAULT 1
+#endif /* WLAIBSS */
+
+#ifdef WLTDLS
+#define TDLS_TUNNELED_PRB_REQ  "\x7f\x50\x6f\x9a\04"
+#define TDLS_TUNNELED_PRB_RESP "\x7f\x50\x6f\x9a\05"
+#define TDLS_MAX_IFACE_FOR_ENABLE 1
+#endif /* WLTDLS */
+
+#ifdef WLAIBSS
+/* Custom AIBSS beacon parameters */
+#define AIBSS_INITIAL_MIN_BCN_DUR      500
+#define AIBSS_MIN_BCN_DUR              5000
+#define AIBSS_BCN_FLOOD_DUR            5000
+#define AIBSS_PEER_FREE                        3
+#endif /* WLAIBSS */
+
+#ifndef FILS_INDICATION_IE_TAG_FIXED_LEN
+#define FILS_INDICATION_IE_TAG_FIXED_LEN               2
+#endif
+
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+#define BCM_SET_LIST_FIRST_ENTRY(entry, ptr, type, member) \
+GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST(); \
+(entry) = list_first_entry((ptr), type, member); \
+GCC_DIAGNOSTIC_POP(); \
+
+#define BCM_SET_CONTAINER_OF(entry, ptr, type, member) \
+GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST(); \
+entry = container_of((ptr), type, member); \
+GCC_DIAGNOSTIC_POP(); \
+
+#else
+#define BCM_SET_LIST_FIRST_ENTRY(entry, ptr, type, member) \
+(entry) = list_first_entry((ptr), type, member); \
+
+#define BCM_SET_CONTAINER_OF(entry, ptr, type, member) \
+entry = container_of((ptr), type, member); \
+
+#endif /* STRICT_GCC_WARNINGS */
+
+/* DPP Public Action Frame types */
+enum wl_dpp_ftype {
+    DPP_AUTH_REQ = 0,
+    DPP_AUTH_RESP = 1,
+    DPP_AUTH_CONF = 2,
+    DPP_PEER_DISC_REQ = 5,
+    DPP_PEER_DISC_RESP = 6,
+    DPP_PKEX_EX_REQ = 7,
+    DPP_PKEX_EX_RESP = 8,
+    DPP_PKEX_COMMIT_REVEAL_REQ = 9,
+    DPP_PKEX_COMMIT_REVEAL_RESP = 10,
+    DPP_CONFIGURATION_RESULT = 11
+};
+
+/* DPP Public Action Frame */
+struct wl_dpp_pub_act_frame {
+    uint8   category;        /* PUB_AF_CATEGORY */
+    uint8   action;          /* PUB_AF_ACTION */
+    uint8   oui[3];          /* OUI */
+    uint8   oui_type;        /* OUI type */
+    uint8   crypto_suite;    /* OUI subtype */
+    uint8   ftype;           /* nonzero, identifies req/rsp transaction */
+    uint8   elts[1];         /* Variable length information elements. */
+} __attribute__ ((packed));
+typedef struct wl_dpp_pub_act_frame wl_dpp_pa_frame_t;
+
+#define WL_PUB_AF_CATEGORY        0x04
+#define WL_PUB_AF_ACTION          0x09   /* Vendor specific */
+#define WL_PUB_AF_WFA_STYPE_DPP   0x1A   /* WFA Subtype DPP */
+#define WL_PUB_AF_STYPE_INVALID          255
+#define WL_GAS_MIN_LEN            8
+#define WL_GAS_WFA_OFFSET         3
+#define WL_GAS_RESP_OFFSET        4
+#define WL_GAS_STYPE_OFFSET       6
+#define WL_GAS_WFA_STYPE_DPP      0x1A
+#define WL_GAS_DPP_ADV_ID         0x7ddd
+
+/* Action value for GAS Initial Request AF */
+#define WL_PUB_AF_GAS_IREQ    0x0a
+/* Action value for GAS Initial Response AF */
+#define WL_PUB_AF_GAS_IRESP   0x0b
+/* Action value for GAS Comeback Request AF */
+#define WL_PUB_AF_GAS_CREQ    0x0c
+/* Action value for GAS Comeback Response AF */
+#define WL_PUB_AF_GAS_CRESP   0x0d
+/* Advertisement Protocol IE ID */
+#define WL_PUB_AF_GAS_AD_EID  0x6c
+
+typedef wifi_p2psd_gas_pub_act_frame_t wl_dpp_gas_af_t;
+
+/* driver status */
+enum wl_status {
+       WL_STATUS_READY = 0,
+       WL_STATUS_SCANNING,
+       WL_STATUS_SCAN_ABORTING,
+       WL_STATUS_CONNECTING,
+       WL_STATUS_CONNECTED,
+       WL_STATUS_DISCONNECTING,
+       WL_STATUS_AP_CREATING,
+       WL_STATUS_AP_CREATED,
+       /* whole sending action frame procedure:
+        * includes a) 'finding common channel' for public action request frame
+        * and b) 'sending af via 'actframe' iovar'
+        */
+       WL_STATUS_SENDING_ACT_FRM,
+       /* find a peer to go to a common channel before sending public action req frame */
+       WL_STATUS_FINDING_COMMON_CHANNEL,
+       /* waiting for next af to sync time of supplicant.
+        * it includes SENDING_ACT_FRM and WAITING_NEXT_ACT_FRM_LISTEN
+        */
+       WL_STATUS_WAITING_NEXT_ACT_FRM,
+#ifdef WL_CFG80211_SYNC_GON
+       /* go to listen state to wait for next af after SENDING_ACT_FRM */
+       WL_STATUS_WAITING_NEXT_ACT_FRM_LISTEN,
+#endif /* WL_CFG80211_SYNC_GON */
+       /* it will be set when upper layer requests listen and succeed in setting listen mode.
+        * if set, other scan request can abort current listen state
+        */
+       WL_STATUS_REMAINING_ON_CHANNEL,
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+       /* it's fake listen state to keep current scan state.
+        * it will be set when upper layer requests listen but scan is running. then just run
+        * a expire timer without actual listen state.
+        * if set, other scan request does not need to abort scan.
+        */
+       WL_STATUS_FAKE_REMAINING_ON_CHANNEL,
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+       WL_STATUS_NESTED_CONNECT,
+       WL_STATUS_CFG80211_CONNECT,
+       WL_STATUS_AUTHORIZED
+};
+
+typedef enum wl_iftype {
+       WL_IF_TYPE_STA = 0,
+       WL_IF_TYPE_AP = 1,
+#ifdef WLMESH_CFG80211
+       WL_IF_TYPE_MESH = 2,
+#endif /* WLMESH_CFG80211 */
+       WL_IF_TYPE_NAN_NMI = 3,
+       WL_IF_TYPE_NAN = 4,
+       WL_IF_TYPE_P2P_GO = 5,
+       WL_IF_TYPE_P2P_GC = 6,
+       WL_IF_TYPE_P2P_DISC = 7,
+       WL_IF_TYPE_IBSS = 8,
+       WL_IF_TYPE_MONITOR = 9,
+       WL_IF_TYPE_AIBSS = 10,
+       WL_IF_TYPE_MAX
+} wl_iftype_t;
+
+typedef enum wl_interface_state {
+       WL_IF_CREATE_REQ,
+       WL_IF_CREATE_DONE,
+       WL_IF_DELETE_REQ,
+       WL_IF_DELETE_DONE,
+       WL_IF_CHANGE_REQ,
+       WL_IF_CHANGE_DONE,
+       WL_IF_STATE_MAX,        /* Retain as last one */
+} wl_interface_state_t;
+
+/* wi-fi mode */
+enum wl_mode {
+       WL_MODE_BSS = 0,
+       WL_MODE_IBSS = 1,
+       WL_MODE_AP = 2,
+
+       WL_MODE_NAN = 4,
+#ifdef WLMESH_CFG80211
+       WL_MODE_MESH = 5,
+#endif /* WLMESH_CFG80211 */
+       WL_MODE_MAX
+};
+
+/* driver profile list */
+enum wl_prof_list {
+       WL_PROF_MODE,
+       WL_PROF_SSID,
+       WL_PROF_SEC,
+       WL_PROF_IBSS,
+       WL_PROF_BAND,
+       WL_PROF_CHAN,
+       WL_PROF_BSSID,
+       WL_PROF_ACT,
+       WL_PROF_BEACONINT,
+       WL_PROF_DTIMPERIOD,
+       WL_PROF_LATEST_BSSID
+};
+
+/* donlge escan state */
+enum wl_escan_state {
+       WL_ESCAN_STATE_IDLE,
+       WL_ESCAN_STATE_SCANING
+};
+/* fw downloading status */
+enum wl_fw_status {
+       WL_FW_LOADING_DONE,
+       WL_NVRAM_LOADING_DONE
+};
+
+enum wl_management_type {
+       WL_BEACON = 0x1,
+       WL_PROBE_RESP = 0x2,
+       WL_ASSOC_RESP = 0x4
+};
+
+enum wl_pm_workq_act_type {
+       WL_PM_WORKQ_SHORT,
+       WL_PM_WORKQ_LONG,
+       WL_PM_WORKQ_DEL
+};
+
+enum wl_tdls_config {
+    TDLS_STATE_AP_CREATE,
+    TDLS_STATE_AP_DELETE,
+    TDLS_STATE_CONNECT,
+    TDLS_STATE_DISCONNECT,
+    TDLS_STATE_SETUP,
+    TDLS_STATE_TEARDOWN,
+    TDLS_STATE_IF_CREATE,
+    TDLS_STATE_IF_DELETE,
+    TDLS_STATE_NMI_CREATE
+};
+
+/* beacon / probe_response */
+struct beacon_proberesp {
+       __le64 timestamp;
+       __le16 beacon_int;
+       __le16 capab_info;
+       u8 variable[0];
+} __attribute__ ((packed));
+
+/* driver configuration */
+struct wl_conf {
+       u32 frag_threshold;
+       u32 rts_threshold;
+       u32 retry_short;
+       u32 retry_long;
+       s32 tx_power;
+       struct ieee80211_channel channel;
+};
+
+typedef s32(*EVENT_HANDLER) (struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+                            const wl_event_msg_t *e, void *data);
+
+/* bss inform structure for cfg80211 interface */
+struct wl_cfg80211_bss_info {
+       u16 band;
+       u16 channel;
+       s16 rssi;
+       u16 frame_len;
+       u8 frame_buf[1];
+};
+
+/* basic structure of scan request */
+struct wl_scan_req {
+       struct wlc_ssid ssid;
+};
+
+/* basic structure of information element */
+struct wl_ie {
+       u16 offset;
+       u8 buf[WL_TLV_INFO_MAX];
+};
+
+/* event queue for cfg80211 main event */
+struct wl_event_q {
+       struct list_head eq_list;
+       u32 etype;
+       wl_event_msg_t emsg;
+       u32 datalen;
+       s8 edata[1];
+};
+
+/* security information with currently associated ap */
+struct wl_security {
+       u32 wpa_versions;
+       u32 auth_type;
+       u32 cipher_pairwise;
+       u32 cipher_group;
+       u32 wpa_auth;
+       u32 auth_assoc_res_status;
+       u32 fw_wpa_auth;
+       u32 fw_auth;
+       u32 fw_wsec;
+       u32 fw_mfp;
+};
+
+/* ibss information for currently joined ibss network */
+struct wl_ibss {
+       u8 beacon_interval;     /* in millisecond */
+       u8 atim;                /* in millisecond */
+       s8 join_only;
+       u8 band;
+       u8 channel;
+};
+
+typedef struct wl_bss_vndr_ies {
+       u8  probe_req_ie[VNDR_IES_BUF_LEN];
+       u8  probe_res_ie[VNDR_IES_MAX_BUF_LEN];
+       u8  assoc_req_ie[VNDR_IES_BUF_LEN];
+       u8  assoc_res_ie[VNDR_IES_BUF_LEN];
+       u8  beacon_ie[VNDR_IES_MAX_BUF_LEN];
+       u8  disassoc_ie[VNDR_IES_BUF_LEN];
+       u32 probe_req_ie_len;
+       u32 probe_res_ie_len;
+       u32 assoc_req_ie_len;
+       u32 assoc_res_ie_len;
+       u32 beacon_ie_len;
+       u32 disassoc_ie_len;
+} wl_bss_vndr_ies_t;
+
+typedef struct wl_cfgbss {
+       u8 *wpa_ie;
+       u8 *rsn_ie;
+       u8 *wps_ie;
+       u8 *fils_ind_ie;
+       bool security_mode;
+       struct wl_bss_vndr_ies ies;     /* Common for STA, P2P GC, GO, AP, P2P Disc Interface */
+} wl_cfgbss_t;
+
+/* cfg driver profile */
+struct wl_profile {
+       u32 mode;
+       s32 band;
+       u32 channel;
+       struct wlc_ssid ssid;
+       struct wl_security sec;
+       struct wl_ibss ibss;
+       u8 bssid[ETHER_ADDR_LEN];
+       u16 beacon_interval;
+       u8 dtim_period;
+       bool active;
+       u8 latest_bssid[ETHER_ADDR_LEN];
+};
+
+struct wl_wps_ie {
+       uint8   id;             /* IE ID: 0xDD */
+       uint8   len;            /* IE length */
+       uint8   OUI[3];         /* WiFi WPS specific OUI */
+       uint8   oui_type;       /*  Vendor specific OUI Type */
+       uint8   attrib[1];      /* variable length attributes */
+} __attribute__ ((packed));
+typedef struct wl_wps_ie wl_wps_ie_t;
+
+struct wl_eap_msg {
+       uint16 attrib;
+       uint16 len;
+       uint8 type;
+} __attribute__ ((packed));
+typedef struct wl_eap_msg wl_eap_msg_t;
+
+struct wl_eap_exp {
+       uint8 OUI[3];
+       uint32 oui_type;
+       uint8 opcode;
+       u8 flags;
+       u8 data[1];
+} __attribute__ ((packed));
+typedef struct wl_eap_exp wl_eap_exp_t;
+
+struct net_info {
+       struct net_device *ndev;
+       struct wireless_dev *wdev;
+       struct wl_profile profile;
+       wl_iftype_t iftype;
+       s32 roam_off;
+       unsigned long sme_state;
+       bool pm_restore;
+       bool pm_block;
+       s32 pm;
+       s32 bssidx;
+       wl_cfgbss_t bss;
+       u8 ifidx;
+       struct list_head list; /* list of all net_info structure */
+};
+
+#ifdef WL_BCNRECV
+/* PERIODIC Beacon receive for detecting FakeAPs */
+typedef struct wl_bcnrecv_result {
+       uint8      SSID[DOT11_MAX_SSID_LEN];    /**< SSID String */
+       struct ether_addr BSSID;                /**< Network BSSID */
+       uint8      channel;                     /**< Channel */
+       uint16     beacon_interval;
+       uint32     timestamp[2];                /**< Beacon Timestamp */
+       uint64     system_time;
+} wl_bcnrecv_result_t;
+
+typedef struct wl_bcnrecv_info {
+       uint bcnrecv_state;             /* TO know the fakeap state */
+} wl_bcnrecv_info_t;
+
+typedef enum wl_bcnrecv_state {
+       BEACON_RECV_IDLE = 0,
+       BEACON_RECV_STARTED,
+       BEACON_RECV_STOPPED,
+       BEACON_RECV_SUSPENDED
+} wl_bcnrecv_state_t;
+
+typedef enum wl_bcnrecv_reason {
+       WL_BCNRECV_INVALID = 0,
+       WL_BCNRECV_USER_TRIGGER,
+       WL_BCNRECV_SUSPEND,
+       WL_BCNRECV_SCANBUSY,
+       WL_BCNRECV_CONCURRENCY,
+       WL_BCNRECV_LISTENBUSY,
+       WL_BCNRECV_ROAMABORT,
+       WL_BCNRECV_HANG
+} wl_bcnrecv_reason_t;
+
+typedef enum wl_bcnrecv_status {
+       WL_BCNRECV_STARTED = 0,
+       WL_BCNRECV_STOPPED,
+       WL_BCNRECV_ABORTED,
+       WL_BCNRECV_SUSPENDED,
+       WL_BCNRECV_MAX
+} wl_bcnrecv_status_t;
+
+typedef enum wl_bcnrecv_attr_type {
+       BCNRECV_ATTR_STATUS = 1,
+       BCNRECV_ATTR_REASON,
+       BCNRECV_ATTR_BCNINFO
+} wl_bcnrecv_attr_type_t;
+#endif /* WL_BCNRECV */
+#ifdef WL_CHAN_UTIL
+#define CU_ATTR_PERCENTAGE 1
+#define CU_ATTR_HDR_LEN 30
+#endif /* WL_CHAN_UTIL */
+
+/* association inform */
+#define MAX_REQ_LINE 1024u
+struct wl_connect_info {
+       u8 req_ie[MAX_REQ_LINE];
+       u32 req_ie_len;
+       u8 resp_ie[MAX_REQ_LINE];
+       u32 resp_ie_len;
+};
+#define WL_MAX_FILS_KEY_LEN 64
+
+struct wl_fils_info {
+       u8 fils_kek[WL_MAX_FILS_KEY_LEN];
+       u32 fils_kek_len;
+       u8 fils_pmk[WL_MAX_FILS_KEY_LEN];
+       u32 fils_pmk_len;
+       u8 fils_pmkid[WL_MAX_FILS_KEY_LEN];
+       u16 fils_erp_next_seq_num;
+       bool fils_roam_disabled;
+       u32 fils_bcn_timeout_cache;
+};
+
+/* firmware /nvram downloading controller */
+struct wl_fw_ctrl {
+       const struct firmware *fw_entry;
+       unsigned long status;
+       u32 ptr;
+       s8 fw_name[WL_FILE_NAME_MAX];
+       s8 nvram_name[WL_FILE_NAME_MAX];
+};
+
+/* assoc ie length */
+struct wl_assoc_ielen {
+       u32 req_len;
+       u32 resp_len;
+};
+
+#define PMKDB_WLC_VER 14
+#define MIN_PMKID_LIST_V3_FW_MAJOR 13
+#define MIN_PMKID_LIST_V3_FW_MINOR 0
+
+#define MIN_PMKID_LIST_V2_FW_MAJOR 12
+#define MIN_PMKID_LIST_V2_FW_MINOR 0
+
+/* wpa2 pmk list */
+struct wl_pmk_list {
+       pmkid_list_v3_t pmkids;
+       pmkid_v3_t foo[MAXPMKID];
+};
+
+#define KEY_PERM_PMK 0xFFFFFFFF
+
+#ifdef DHD_MAX_IFS
+#define WL_MAX_IFS DHD_MAX_IFS
+#else
+#define WL_MAX_IFS 16
+#endif
+
+#define MAC_RAND_BYTES 3
+#define ESCAN_BUF_SIZE (64 * 1024)
+
+struct escan_info {
+       u32 escan_state;
+#ifdef STATIC_WL_PRIV_STRUCT
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+#error STATIC_WL_PRIV_STRUCT should be used with CONFIG_DHD_USE_STATIC_BUF
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+#ifdef DUAL_ESCAN_RESULT_BUFFER
+       u8 *escan_buf[2];
+#else
+       u8 *escan_buf;
+#endif /* DUAL_ESCAN_RESULT_BUFFER */
+#else
+#ifdef DUAL_ESCAN_RESULT_BUFFER
+       u8 escan_buf[2][ESCAN_BUF_SIZE];
+#else
+       u8 escan_buf[ESCAN_BUF_SIZE];
+#endif /* DUAL_ESCAN_RESULT_BUFFER */
+#endif /* STATIC_WL_PRIV_STRUCT */
+#ifdef DUAL_ESCAN_RESULT_BUFFER
+       u8 cur_sync_id;
+       u8 escan_type[2];
+#endif /* DUAL_ESCAN_RESULT_BUFFER */
+       struct wiphy *wiphy;
+       struct net_device *ndev;
+#ifdef DHD_SEND_HANG_ESCAN_SYNCID_MISMATCH
+       bool prev_escan_aborted;
+#endif /* DHD_SEND_HANG_ESCAN_SYNCID_MISMATCH */
+};
+
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+#define BUF_OVERFLOW_MGMT_COUNT 3
+typedef struct {
+       int RSSI;
+       int length;
+       struct ether_addr BSSID;
+} removal_element_t;
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+struct afx_hdl {
+       wl_af_params_t *pending_tx_act_frm;
+       struct ether_addr       tx_dst_addr;
+       struct net_device *dev;
+       struct work_struct work;
+       s32 bssidx;
+       u32 retry;
+       s32 peer_chan;
+       s32 peer_listen_chan; /* search channel: configured by upper layer */
+       s32 my_listen_chan;     /* listen chanel: extract it from prb req or gon req */
+       bool is_listen;
+       bool ack_recv;
+       bool is_active;
+};
+
+struct parsed_ies {
+       const wpa_ie_fixed_t *wps_ie;
+       u32 wps_ie_len;
+       const wpa_ie_fixed_t *wpa_ie;
+       u32 wpa_ie_len;
+       const bcm_tlv_t *wpa2_ie;
+       u32 wpa2_ie_len;
+       const bcm_tlv_t *fils_ind_ie;
+       u32 fils_ind_ie_len;
+};
+
+#ifdef P2P_LISTEN_OFFLOADING
+typedef struct {
+       uint16  period;                 /* listen offload period */
+       uint16  interval;               /* listen offload interval */
+       uint16  count;                  /* listen offload count */
+       uint16  pad;                    /* pad for 32bit align */
+} wl_p2plo_listen_t;
+#endif /* P2P_LISTEN_OFFLOADING */
+
+#ifdef WL11U
+/* Max length of Interworking element */
+#define IW_IES_MAX_BUF_LEN             8
+#endif
+#ifdef WLFBT
+#define FBT_KEYLEN             32
+#endif
+#define MAX_EVENT_BUF_NUM 16
+typedef struct wl_eventmsg_buf {
+       u16 num;
+       struct {
+               u16 type;
+               bool set;
+       } event [MAX_EVENT_BUF_NUM];
+} wl_eventmsg_buf_t;
+
+typedef struct wl_if_event_info {
+       bool valid;
+       int ifidx;
+       int bssidx;
+       uint8 mac[ETHER_ADDR_LEN];
+       char name[IFNAMSIZ+1];
+       uint8 role;
+} wl_if_event_info;
+
+#ifdef SUPPORT_AP_RADIO_PWRSAVE
+typedef struct ap_rps_info {
+       bool enable;
+       int sta_assoc_check;
+       int pps;
+       int quiet_time;
+       int level;
+} ap_rps_info_t;
+#endif /* SUPPORT_AP_RADIO_PWRSAVE */
+
+#ifdef SUPPORT_RSSI_SUM_REPORT
+#define RSSILOG_FLAG_FEATURE_SW                0x1
+#define RSSILOG_FLAG_REPORT_READY      0x2
+typedef struct rssilog_set_param {
+       uint8 enable;
+       uint8 rssi_threshold;
+       uint8 time_threshold;
+       uint8 pad;
+} rssilog_set_param_t;
+
+typedef struct rssilog_get_param {
+       uint8 report_count;
+       uint8 enable;
+       uint8 rssi_threshold;
+       uint8 time_threshold;
+} rssilog_get_param_t;
+
+typedef struct rssi_ant_param {
+       struct ether_addr ea;
+       chanspec_t chanspec;
+} rssi_ant_param_t;
+
+typedef struct wl_rssi_ant_mimo {
+       uint32 version;
+       uint32 count;
+       int8 rssi_ant[WL_RSSI_ANT_MAX];
+       int8 rssi_sum;
+       int8 PAD[3];
+} wl_rssi_ant_mimo_t;
+#endif /* SUPPORT_RSSI_SUM_REPORT */
+
+/* MBO-OCE prune event reason codes */
+#if defined(WL_MBO) || defined(WL_OCE)
+typedef enum wl_prune_evt_reason {
+       WIFI_PRUNE_UNSPECIFIED = 0,             /* Unspecified event reason code */
+       WIFI_PRUNE_ASSOC_RETRY_DELAY = 1,       /* MBO assoc retry delay */
+       WIFI_PRUNE_RSSI_ASSOC_REJ = 2           /* OCE RSSI-based assoc rejection */
+} wl_prune_evt_reason_t;
+#endif /* WL_MBO || WL_OCE */
+
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+#define GET_BSS_INFO_LEN 90
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+
+#ifdef WL_MBO
+typedef struct wl_event_mbo wl_event_mbo_t;
+typedef struct wl_event_mbo_cell_nw_switch wl_event_mbo_cell_nw_switch_t;
+typedef struct wl_btm_event_type_data wl_btm_event_type_data_t;
+#endif /* WL_MBO */
+
+#if defined(WL_MBO) || defined(WL_OCE)
+typedef struct wl_bssid_prune_evt_info wl_bssid_pruned_evt_info_t;
+#endif /* WL_MBO || WL_OCE */
+
+#ifdef WL_NAN
+#endif /* WL_NAN */
+
+#ifdef WL_IFACE_MGMT
+#define WL_IFACE_NOT_PRESENT -1
+
+typedef enum iface_conc_policy {
+       WL_IF_POLICY_DEFAULT            = 0,
+       WL_IF_POLICY_FCFS               = 1,
+       WL_IF_POLICY_LP                 = 2,
+       WL_IF_POLICY_ROLE_PRIORITY      = 3,
+       WL_IF_POLICY_CUSTOM             = 4,
+       WL_IF_POLICY_INVALID
+} iface_conc_policy_t;
+
+typedef struct iface_mgmt_data {
+       uint8 policy;
+       uint8 priority[WL_IF_TYPE_MAX];
+} iface_mgmt_data_t;
+#endif /* WL_IFACE_MGMT */
+
+#ifdef WL_WPS_SYNC
+#define EAP_PACKET              0
+#define EAP_EXPANDED_TYPE       254
+#define EAP_EXP_OPCODE_OFFSET   7
+#define EAP_EXP_FRAGMENT_LEN_OFFSET    2
+#define EAP_EXP_FLAGS_FRAGMENTED_DATA  2
+#define EAP_EXP_FLAGS_MORE_DATA        1
+#define EAPOL_EAP_HDR_LEN       5
+#define EAP_EXP_HDR_MIN_LENGTH (EAPOL_EAP_HDR_LEN + EAP_EXP_OPCODE_OFFSET)
+#define EAP_ATTRIB_MSGTYPE  0x1022
+#define EAP_WSC_UPNP        0
+#define EAP_WSC_START       1
+#define EAP_WSC_ACK         2
+#define EAP_WSC_NACK        3
+#define EAP_WSC_MSG         4
+#define EAP_WSC_DONE        5
+#define EAP_WSC_MSG_M8      12
+#define EAP_CODE_FAILURE    4
+#define WL_WPS_REAUTH_TIMEOUT  10000
+
+struct wl_eap_header {
+       unsigned char code; /* EAP code */
+       unsigned char id;   /* Current request ID */
+       unsigned short length;  /* Length including header */
+       unsigned char type; /* EAP type (optional) */
+       unsigned char data[1];  /* Type data (optional) */
+} __attribute__ ((packed));
+typedef struct wl_eap_header wl_eap_header_t;
+
+typedef enum wl_wps_state {
+       WPS_STATE_IDLE = 0,
+       WPS_STATE_STARTED,
+       WPS_STATE_M8_SENT,
+       WPS_STATE_M8_RECVD,
+       WPS_STATE_EAP_FAIL,
+       WPS_STATE_REAUTH_WAIT,
+       WPS_STATE_LINKUP,
+       WPS_STATE_LINKDOWN,
+       WPS_STATE_DISCONNECT,
+       WPS_STATE_DISCONNECT_CLIENT,
+       WPS_STATE_CONNECT_FAIL,
+       WPS_STATE_AUTHORIZE,
+       WPS_STATE_DONE,
+       WPS_STATE_INVALID
+} wl_wps_state_t;
+
+#define WPS_MAX_SESSIONS       2
+typedef struct wl_wps_session {
+       bool in_use;
+       timer_list_compat_t timer;
+       struct net_device *ndev;
+       wl_wps_state_t state;
+       u16 mode;
+       u8 peer_mac[ETHER_ADDR_LEN];
+} wl_wps_session_t;
+#endif /* WL_WPS_SYNC */
+
+#ifndef WL_STATIC_IFNAME_PREFIX
+#define WL_STATIC_IFNAME_PREFIX "wlan%d"
+#endif /* WL_STATIC_IFNAME */
+
+typedef struct buf_data {
+       u32 ver; /* version of struct */
+       u32 len; /* Total len */
+       /* size of each buffer in case of split buffers (0 - single buffer). */
+       u32 buf_threshold;
+       const void *data_buf[1]; /* array of user space buffer pointers. */
+} buf_data_t;
+
+typedef struct wl_loc_info {
+       bool in_progress;             /* for tracking listen in progress        */
+       struct delayed_work work;     /* for taking care of listen timeout      */
+       struct wireless_dev *wdev;    /* interface on which listen is requested */
+} wl_loc_info_t;
+
+typedef enum
+{
+       HEAD_SAR_BACKOFF_DISABLE = -1,
+       HEAD_SAR_BACKOFF_ENABLE = 0,
+       GRIP_SAR_BACKOFF_DISABLE,
+       GRIP_SAR_BACKOFF_ENABLE,
+       NR_mmWave_SAR_BACKOFF_DISABLE,
+       NR_mmWave_SAR_BACKOFF_ENABLE,
+       NR_Sub6_SAR_BACKOFF_DISABLE,
+       NR_Sub6_SAR_BACKOFF_ENABLE,
+       SAR_BACKOFF_DISABLE_ALL
+} sar_modes;
+
+/* Pre selected Power scenarios to be applied from BDF file */
+typedef enum
+{
+       WIFI_POWER_SCENARIO_INVALID = -2,
+       WIFI_POWER_SCENARIO_DEFAULT = -1,
+       WIFI_POWER_SCENARIO_VOICE_CALL = 0,
+       WIFI_POWER_SCENARIO_ON_HEAD_CELL_OFF = 1,
+       WIFI_POWER_SCENARIO_ON_HEAD_CELL_ON = 2,
+       WIFI_POWER_SCENARIO_ON_BODY_CELL_OFF = 3,
+       WIFI_POWER_SCENARIO_ON_BODY_CELL_ON = 4,
+       WIFI_POWER_SCENARIO_ON_BODY_BT = 5
+} wifi_power_scenario;
+
+/* Log timestamp */
+#define LOG_TS(cfg, ts)        cfg->tsinfo.ts = OSL_LOCALTIME_NS();
+#define CLR_TS(cfg, ts)        cfg->tsinfo.ts = 0;
+#define GET_TS(cfg, ts)        cfg->tsinfo.ts;
+typedef struct wl_ctx_tsinfo {
+       uint64 scan_start;
+       uint64 scan_enq;             /* scan event enqueue time       */
+       uint64 scan_deq;
+       uint64 scan_hdlr_cmplt;
+       uint64 scan_cmplt;           /* scan event handler completion */
+       uint64 conn_start;
+       uint64 conn_cmplt;
+       uint64 wl_evt_deq;
+       uint64 authorize_start;
+       uint64 authorize_cmplt;
+       uint64 wl_evt_hdlr_entry;
+       uint64 wl_evt_hdlr_exit;
+} wl_ctx_tsinfo_t;
+
+typedef struct wlcfg_assoc_info {
+       bool targeted_join;     /* Unicast bssid. Host selected bssid for join */
+       bool reassoc;
+       u8 bssid[ETH_ALEN];
+       u16 ssid_len;
+       u8 ssid[DOT11_MAX_SSID_LEN];
+       s32 bssidx;
+       u32 chan_cnt;
+       chanspec_t chanspecs[MAX_ROAM_CHANNEL];
+} wlcfg_assoc_info_t;
+
+#define MAX_NUM_OF_ASSOCIATED_DEV       64
+struct bcm_assoclist {
+       u32 count;
+       u8 mac[MAX_NUM_OF_ASSOCIATED_DEV][ETH_ALEN];
+};
+
+/* private data of cfg80211 interface */
+struct bcm_cfg80211 {
+       struct wireless_dev *wdev;      /* representing cfg cfg80211 device */
+
+       struct wireless_dev *p2p_wdev;  /* representing cfg cfg80211 device for P2P */
+       struct net_device *p2p_net;    /* reference to p2p0 interface */
+
+       struct wl_conf *conf;
+       struct cfg80211_scan_request *scan_request;     /* scan request object */
+       EVENT_HANDLER evt_handler[WLC_E_LAST];
+       struct list_head eq_list;       /* used for event queue */
+       struct list_head net_list;     /* used for struct net_info */
+       spinlock_t net_list_sync;       /* to protect scan status (and others if needed) */
+       spinlock_t eq_lock;     /* for event queue synchronization */
+       spinlock_t cfgdrv_lock; /* to protect scan status (and others if needed) */
+       struct completion act_frm_scan;
+       struct completion iface_disable;
+       struct completion wait_next_af;
+       struct mutex usr_sync;  /* maily for up/down synchronization */
+       struct mutex if_sync;   /* maily for iface op synchronization */
+       struct mutex scan_sync; /* scan sync from different scan contexts  */
+       struct wl_scan_results *bss_list;
+       struct wl_scan_results *scan_results;
+
+       /* scan request object for internal purpose */
+       struct wl_scan_req *scan_req_int;
+       /* information element object for internal purpose */
+#if defined(STATIC_WL_PRIV_STRUCT)
+       struct wl_ie *ie;
+#else
+       struct wl_ie ie;
+#endif
+
+       /* association information container */
+#if defined(STATIC_WL_PRIV_STRUCT)
+       struct wl_connect_info *conn_info;
+#else
+       struct wl_connect_info conn_info;
+#endif
+#ifdef DEBUGFS_CFG80211
+       struct dentry           *debugfs;
+#endif /* DEBUGFS_CFG80211 */
+       struct wl_pmk_list *pmk_list;   /* wpa2 pmk list */
+       tsk_ctl_t event_tsk;            /* task of main event handler thread */
+       dhd_pub_t *pub;
+       u32 iface_cnt;
+       u32 channel;            /* current channel */
+       u32 af_sent_channel;    /* channel action frame is sent */
+       /* next af subtype to cancel the remained dwell time in rx process */
+       u8 next_af_subtype;
+#ifdef WL_CFG80211_SYNC_GON
+       ulong af_tx_sent_jiffies;
+#endif /* WL_CFG80211_SYNC_GON */
+       struct escan_info escan_info;   /* escan information */
+       bool active_scan;       /* current scan mode */
+       bool ibss_starter;      /* indicates this sta is ibss starter */
+       bool link_up;           /* link/connection up flag */
+
+       /* indicate whether chip to support power save mode */
+       bool pwr_save;
+       bool roam_on;           /* on/off switch for self-roaming */
+       bool scan_tried;        /* indicates if first scan attempted */
+#if defined(BCMSDIO) || defined(BCMDBUS)
+       bool wlfc_on;
+#endif
+       bool vsdb_mode;
+#define WL_ROAM_OFF_ON_CONCURRENT      0x0001
+#define WL_ROAM_REVERT_STATUS          0x0002
+       u32 roam_flags;
+       u8 *ioctl_buf;          /* ioctl buffer */
+       struct mutex ioctl_buf_sync;
+       u8 *escan_ioctl_buf;
+       u8 *extra_buf;  /* maily to grab assoc information */
+       struct dentry *debugfsdir;
+       struct rfkill *rfkill;
+       bool rf_blocked;
+       struct ieee80211_channel remain_on_chan;
+       enum nl80211_channel_type remain_on_chan_type;
+       u64 send_action_id;
+       u64 last_roc_id;
+       wait_queue_head_t netif_change_event;
+       wl_if_event_info if_event_info;
+       struct completion send_af_done;
+       struct afx_hdl *afx_hdl;
+       struct p2p_info *p2p;
+       bool p2p_supported;
+       void *btcoex_info;
+       timer_list_compat_t scan_timeout;   /* Timer for catch scan event timeout */
+#ifdef WL_CFG80211_GON_COLLISION
+       u8 block_gon_req_tx_count;
+       u8 block_gon_req_rx_count;
+#endif /* WL_CFG80211_GON_COLLISION */
+#if defined(P2P_IE_MISSING_FIX)
+       bool p2p_prb_noti;
+#endif
+       s32(*state_notifier) (struct bcm_cfg80211 *cfg,
+               struct net_info *_net_info, enum wl_status state, bool set);
+       unsigned long interrested_state;
+       wlc_ssid_t hostapd_ssid;
+#ifdef WL11U
+       bool wl11u;
+#endif /* WL11U */
+       bool sched_scan_running;        /* scheduled scan req status */
+       struct cfg80211_sched_scan_request *sched_scan_req;     /* scheduled scan req */
+#ifdef WL_HOST_BAND_MGMT
+       u8 curr_band;
+#endif /* WL_HOST_BAND_MGMT */
+       bool scan_suppressed;
+
+       timer_list_compat_t scan_supp_timer;
+       struct work_struct wlan_work;
+
+       struct mutex event_sync;        /* maily for up/down synchronization */
+       bool disable_roam_event;
+       struct delayed_work pm_enable_work;
+
+       struct workqueue_struct *event_workq;   /* workqueue for event */
+
+       struct work_struct event_work;          /* work item for event */
+       struct mutex pm_sync;   /* mainly for pm work synchronization */
+
+       vndr_ie_setbuf_t *ibss_vsie;    /* keep the VSIE for IBSS */
+       int ibss_vsie_len;
+#ifdef WLAIBSS
+       u32 aibss_txfail_pid;
+       u32 aibss_txfail_seq;
+#endif /* WLAIBSS */
+#ifdef WL_RELMCAST
+       u32 rmc_event_pid;
+       u32 rmc_event_seq;
+#endif /* WL_RELMCAST */
+#ifdef WLAIBSS_MCHAN
+       struct ether_addr ibss_if_addr;
+       bcm_struct_cfgdev *ibss_cfgdev; /* For AIBSS */
+#endif /* WLAIBSS_MCHAN */
+       bool bss_pending_op;            /* indicate where there is a pending IF operation */
+#ifdef WLFBT
+       uint8 fbt_key[FBT_KEYLEN];
+#endif
+       int roam_offload;
+#ifdef WL_NAN
+       wl_nancfg_t *nancfg;
+#endif /* WL_NAN */
+#ifdef WL_IFACE_MGMT
+       iface_mgmt_data_t iface_data;
+#endif /* WL_IFACE_MGMT */
+#ifdef P2PLISTEN_AP_SAMECHN
+       bool p2p_resp_apchn_status;
+#endif /* P2PLISTEN_AP_SAMECHN */
+       struct wl_wsec_key wep_key;
+#ifdef WLTDLS
+       u8 *tdls_mgmt_frame;
+       u32 tdls_mgmt_frame_len;
+       s32 tdls_mgmt_freq;
+#endif /* WLTDLS */
+       bool need_wait_afrx;
+#ifdef QOS_MAP_SET
+       uint8    *up_table;     /* user priority table, size is UP_TABLE_MAX */
+#endif /* QOS_MAP_SET */
+       struct ether_addr last_roamed_addr;
+       bool rcc_enabled;       /* flag for Roam channel cache feature */
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+       char bss_info[GET_BSS_INFO_LEN];
+       wl_event_msg_t event_auth_assoc;
+       u32 assoc_reject_status;
+       u32 roam_count;
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+       u16 ap_oper_channel;
+#if defined(SUPPORT_RANDOM_MAC_SCAN)
+       bool random_mac_enabled;
+#endif /* SUPPORT_RANDOM_MAC_SCAN */
+#ifdef DHD_LOSSLESS_ROAMING
+       timer_list_compat_t roam_timeout;   /* Timer for catch roam timeout */
+#endif
+#ifndef DUAL_ESCAN_RESULT_BUFFER
+       uint16 escan_sync_id_cntr;
+#endif
+#ifdef WLTDLS
+       uint8 tdls_supported;
+       struct mutex tdls_sync; /* protect tdls config operations */
+#endif /* WLTDLS */
+#ifdef MFP
+       const uint8 *bip_pos;
+       int mfp_mode;
+#endif /* MFP */
+#ifdef WES_SUPPORT
+#ifdef CUSTOMER_SCAN_TIMEOUT_SETTING
+       int custom_scan_channel_time;
+       int custom_scan_unassoc_time;
+       int custom_scan_passive_time;
+       int custom_scan_home_time;
+       int custom_scan_home_away_time;
+#endif /* CUSTOMER_SCAN_TIMEOUT_SETTING */
+#endif /* WES_SUPPORT */
+       uint8 vif_count;        /* Virtual Interface count */
+#ifdef WBTEXT
+       struct list_head wbtext_bssid_list;
+#endif /* WBTEXT */
+#ifdef SUPPORT_AP_RADIO_PWRSAVE
+       ap_rps_info_t ap_rps_info;
+#endif /* SUPPORT_AP_RADIO_PWRSAVE */
+       u16 vif_macaddr_mask;
+       osl_t *osh;
+       struct list_head vndr_oui_list;
+       spinlock_t vndr_oui_sync;       /* to protect vndr_oui_list */
+       bool rssi_sum_report;
+       int rssi;       /* previous RSSI (backup) of get_station */
+#ifdef WL_WPS_SYNC
+       wl_wps_session_t wps_session[WPS_MAX_SESSIONS];
+       spinlock_t wps_sync;    /* to protect wps states (and others if needed) */
+#endif /* WL_WPS_SYNC */
+       struct wl_fils_info fils_info;
+#ifdef WL_BAM
+       wl_bad_ap_mngr_t bad_ap_mngr;
+#endif  /* WL_BAM */
+
+#ifdef BIGDATA_SOFTAP
+       struct wl_ap_sta_info *ap_sta_info;
+#endif /* BIGDATA_SOFTAP */
+
+       uint8 scanmac_enabled;
+       bool scanmac_config;
+#ifdef WL_BCNRECV
+       /* structure used for fake ap detection info */
+       struct mutex bcn_sync;  /* mainly for bcn resume/suspend synchronization */
+       wl_bcnrecv_info_t bcnrecv_info;
+#endif /* WL_BCNRECV */
+       struct net_device *static_ndev;
+       uint8 static_ndev_state;
+       bool hal_started;
+       wl_wlc_version_t wlc_ver;
+       bool scan_params_v2;
+#ifdef SUPPORT_AP_BWCTRL
+       u32 bw_cap_5g;
+#endif /* SUPPORT_AP_BWCTRL */
+#ifdef WL_6G_BAND
+       bool band_6g_supported;
+#endif /* WL_6G_BAND */
+       wl_loc_info_t loc;    /* listen on channel state info */
+       int roamscan_mode;
+       int wes_mode;
+       int ncho_mode;
+       int ncho_band;
+#ifdef WL_SAR_TX_POWER
+       wifi_power_scenario wifi_tx_power_mode;
+#endif /* WL_SAR_TX_POWER */
+       struct mutex connect_sync;  /* For assoc/resssoc state sync */
+       wl_ctx_tsinfo_t tsinfo;
+       struct wl_pmk_list *spmk_info_list;     /* single pmk info list */
+       struct bcm_assoclist assoclist;
+#if defined(RSSIAVG)
+       wl_rssi_cache_ctrl_t g_rssi_cache_ctrl;
+       wl_rssi_cache_ctrl_t g_connected_rssi_cache_ctrl;
+#endif
+#if defined(BSSCACHE)
+       wl_bss_cache_ctrl_t g_bss_cache_ctrl;
+#endif
+       int p2p_disconnected; // terence 20130703: Fix for wrong group_capab (timing issue)
+       struct ether_addr disconnected_bssid;
+       int autochannel;
+       int best_2g_ch;
+       int best_5g_ch;
+       uint handshaking;
+       int btc_mode;
+       bool wps_done;
+       wait_queue_head_t wps_done_event;
+       struct mutex in4way_sync;
+       ulong disconnected_jiffies;
+};
+
+/* Max auth timeout allowed in case of EAP is 70sec, additional 5 sec for
+* inter-layer overheads
+*/
+#define WL_DS_SKIP_THRESHOLD_USECS  (75000L * 1000L)
+
+enum wl_state_type {
+       WL_STATE_IDLE,
+       WL_STATE_SCANNING,
+       WL_STATE_CONNECTING,
+       WL_STATE_LISTEN,
+       WL_STATE_AUTHORIZING /* Assocated to authorized */
+};
+
+#define WL_STATIC_IFIDX        (DHD_MAX_IFS + DHD_MAX_STATIC_IFS - 1)
+enum static_ndev_states {
+       NDEV_STATE_NONE,
+       NDEV_STATE_OS_IF_CREATED,
+       NDEV_STATE_FW_IF_CREATED,
+       NDEV_STATE_FW_IF_FAILED,
+       NDEV_STATE_FW_IF_DELETED
+};
+#define IS_CFG80211_STATIC_IF(cfg, ndev) \
+       ((cfg && (cfg->static_ndev == ndev)) ? true : false)
+#define IS_CFG80211_STATIC_IF_ACTIVE(cfg) \
+       ((cfg && cfg->static_ndev && \
+       (cfg->static_ndev_state & NDEV_STATE_FW_IF_CREATED)) ? true : false)
+#define IS_CFG80211_STATIC_IF_NAME(cfg, name) \
+       (cfg && cfg->static_ndev && \
+         !strncmp(cfg->static_ndev->name, name, strlen(name)))
+
+#ifdef WL_SAE
+typedef struct wl_sae_key_info {
+       uint8 peer_mac[ETHER_ADDR_LEN];
+       uint16 pmk_len;
+       uint16 pmkid_len;
+       const uint8 *pmk;
+       const uint8 *pmkid;
+} wl_sae_key_info_t;
+#endif /* WL_SAE */
+
+typedef enum wl_concurrency_mode {
+       CONCURRENCY_MODE_NONE = 0,
+       CONCURRENCY_SCC_MODE,
+       CONCURRENCY_VSDB_MODE,
+       CONCURRENCY_RSDB_MODE
+} wl_concurrency_mode_t;
+
+typedef struct wl_wips_event_info {
+       uint32 timestamp;
+       struct ether_addr   bssid;
+       uint16 misdeauth;
+       int16 current_RSSI;
+       int16 deauth_RSSI;
+} wl_wips_event_info_t;
+
+s32 wl_iftype_to_mode(wl_iftype_t iftype);
+
+#define BCM_LIST_FOR_EACH_ENTRY_SAFE(pos, next, head, member) \
+       list_for_each_entry_safe((pos), (next), (head), member)
+extern int ioctl_version;
+
+static inline wl_bss_info_t *next_bss(struct wl_scan_results *list, wl_bss_info_t *bss)
+{
+       return bss = bss ?
+               (wl_bss_info_t *)((uintptr) bss + dtoh32(bss->length)) : list->bss_info;
+}
+
+static inline void
+wl_probe_wdev_all(struct bcm_cfg80211 *cfg)
+{
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+       int idx = 0;
+       WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next,
+               &cfg->net_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               WL_INFORM_MEM(("wl_probe_wdev_all: net_list[%d] bssidx: %d\n",
+                       idx++, _net_info->bssidx));
+       }
+       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+       return;
+}
+
+static inline struct net_info *
+wl_get_netinfo_by_fw_idx(struct bcm_cfg80211 *cfg, s32 bssidx, u8 ifidx)
+{
+       struct net_info *_net_info, *next, *info = NULL;
+       unsigned long int flags;
+
+       WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if ((bssidx >= 0) && (_net_info->bssidx == bssidx) &&
+                       (_net_info->ifidx == ifidx)) {
+                       info = _net_info;
+                       break;
+               }
+       }
+       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+       return info;
+}
+
+static inline void
+wl_dealloc_netinfo_by_wdev(struct bcm_cfg80211 *cfg, struct wireless_dev *wdev)
+{
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+
+#ifdef DHD_IFDEBUG
+       WL_INFORM_MEM(("dealloc_netinfo enter wdev=%p \n", OSL_OBFUSCATE_BUF(wdev)));
+#endif
+       WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (wdev && (_net_info->wdev == wdev)) {
+                       wl_cfgbss_t *bss = &_net_info->bss;
+
+                       if (bss->wpa_ie) {
+                               MFREE(cfg->osh, bss->wpa_ie, bss->wpa_ie[1]
+                                       + WPA_RSN_IE_TAG_FIXED_LEN);
+                               bss->wpa_ie = NULL;
+                       }
+
+                       if (bss->rsn_ie) {
+                               MFREE(cfg->osh, bss->rsn_ie,
+                                       bss->rsn_ie[1] + WPA_RSN_IE_TAG_FIXED_LEN);
+                               bss->rsn_ie = NULL;
+                       }
+
+                       if (bss->wps_ie) {
+                               MFREE(cfg->osh, bss->wps_ie, bss->wps_ie[1] + 2);
+                               bss->wps_ie = NULL;
+                       }
+                       list_del(&_net_info->list);
+                       cfg->iface_cnt--;
+                       MFREE(cfg->osh, _net_info, sizeof(struct net_info));
+               }
+       }
+       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+#ifdef DHD_IFDEBUG
+       WL_INFORM_MEM(("dealloc_netinfo exit iface_cnt=%d \n", cfg->iface_cnt));
+#endif
+}
+
+static inline s32
+wl_alloc_netinfo(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       struct wireless_dev * wdev, wl_iftype_t iftype, bool pm_block, u8 bssidx, u8 ifidx)
+{
+       struct net_info *_net_info;
+       s32 err = 0;
+       unsigned long int flags;
+#ifdef DHD_IFDEBUG
+       WL_INFORM_MEM(("alloc_netinfo enter bssidx=%d wdev=%p\n",
+               bssidx, OSL_OBFUSCATE_BUF(wdev)));
+#endif
+       /* Check whether there is any duplicate entry for the
+        *  same bssidx && ifidx.
+        */
+       if ((_net_info = wl_get_netinfo_by_fw_idx(cfg, bssidx, ifidx))) {
+               /* We have a duplicate entry for the same bssidx
+                * already present which shouldn't have been the case.
+                * Attempt recovery.
+                */
+               WL_ERR(("Duplicate entry for bssidx=%d ifidx=%d present."
+                       " Can't add new entry\n", bssidx, ifidx));
+               wl_probe_wdev_all(cfg);
+#ifdef DHD_DEBUG
+               ASSERT(0);
+#endif /* DHD_DEBUG */
+               return -EINVAL;
+       }
+       if (cfg->iface_cnt == IFACE_MAX_CNT)
+               return -ENOMEM;
+       _net_info = (struct net_info *)MALLOCZ(cfg->osh, sizeof(struct net_info));
+       if (!_net_info)
+               err = -ENOMEM;
+       else {
+               _net_info->iftype = iftype;
+               _net_info->ndev = ndev;
+               _net_info->wdev = wdev;
+               _net_info->pm_restore = 0;
+               _net_info->pm = 0;
+               _net_info->pm_block = pm_block;
+               _net_info->roam_off = WL_INVALID;
+               _net_info->bssidx = bssidx;
+               _net_info->ifidx = ifidx;
+               WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+               cfg->iface_cnt++;
+               list_add(&_net_info->list, &cfg->net_list);
+               WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+       }
+#ifdef DHD_IFDEBUG
+       WL_DBG(("alloc_netinfo exit iface_cnt=%d \n", cfg->iface_cnt));
+#endif
+       return err;
+}
+
+static inline void
+wl_delete_all_netinfo(struct bcm_cfg80211 *cfg)
+{
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+
+       WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               wl_cfgbss_t *bss = &_net_info->bss;
+               GCC_DIAGNOSTIC_POP();
+
+               if (bss->wpa_ie) {
+                       MFREE(cfg->osh, bss->wpa_ie, bss->wpa_ie[1]
+                               + WPA_RSN_IE_TAG_FIXED_LEN);
+                       bss->wpa_ie = NULL;
+               }
+
+               if (bss->rsn_ie) {
+                       MFREE(cfg->osh, bss->rsn_ie, bss->rsn_ie[1]
+                               + WPA_RSN_IE_TAG_FIXED_LEN);
+                       bss->rsn_ie = NULL;
+               }
+
+               if (bss->wps_ie) {
+                       MFREE(cfg->osh, bss->wps_ie, bss->wps_ie[1] + 2);
+                       bss->wps_ie = NULL;
+               }
+
+               if (bss->fils_ind_ie) {
+                       MFREE(cfg->osh, bss->fils_ind_ie, bss->fils_ind_ie[1]
+                               + FILS_INDICATION_IE_TAG_FIXED_LEN);
+                       bss->fils_ind_ie = NULL;
+               }
+               list_del(&_net_info->list);
+               if (_net_info->wdev) {
+                       MFREE(cfg->osh, _net_info->wdev, sizeof(struct wireless_dev));
+               }
+               MFREE(cfg->osh, _net_info, sizeof(struct net_info));
+       }
+       cfg->iface_cnt = 0;
+       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+}
+static inline u32
+wl_get_status_all(struct bcm_cfg80211 *cfg, s32 status)
+
+{
+       struct net_info *_net_info, *next;
+       u32 cnt = 0;
+       unsigned long int flags;
+
+       WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (_net_info->ndev &&
+                       test_bit(status, &_net_info->sme_state))
+                       cnt++;
+       }
+       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+       return cnt;
+}
+static inline void
+wl_set_status_all(struct bcm_cfg80211 *cfg, s32 status, u32 op)
+{
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+
+       WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               switch (op) {
+                       case 1:
+                               break; /* set all status is not allowed */
+                       case 2:
+                               /*
+                                * Release the spinlock before calling notifier. Else there
+                                * will be nested calls
+                                */
+                               WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+                               clear_bit(status, &_net_info->sme_state);
+                               if (cfg->state_notifier &&
+                                       test_bit(status, &(cfg->interrested_state)))
+                                       cfg->state_notifier(cfg, _net_info, status, false);
+                               return;
+                       case 4:
+                               break; /* change all status is not allowed */
+                       default:
+                               break; /* unknown operation */
+               }
+       }
+       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+}
+static inline void
+wl_set_status_by_netdev(struct bcm_cfg80211 *cfg, s32 status,
+       struct net_device *ndev, u32 op)
+{
+
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+
+       if (status >= BITS_PER_LONG) {
+               /* max value for shift operation is
+                * (BITS_PER_LONG -1) for unsigned long.
+                * if status crosses BIT_PER_LONG, the variable
+                * sme_state should be correspondingly updated.
+                */
+               ASSERT(0);
+               return;
+       }
+
+       WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (ndev && (_net_info->ndev == ndev)) {
+                       GCC_DIAGNOSTIC_POP();
+                       switch (op) {
+                               case 1:
+                                       /*
+                                        * Release the spinlock before calling notifier. Else there
+                                        * will be nested calls
+                                        */
+                                       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+                                       set_bit(status, &_net_info->sme_state);
+                                       if (cfg->state_notifier &&
+                                               test_bit(status, &(cfg->interrested_state)))
+                                               cfg->state_notifier(cfg, _net_info, status, true);
+                                       return;
+                               case 2:
+                                       /*
+                                        * Release the spinlock before calling notifier. Else there
+                                        * will be nested calls
+                                        */
+                                       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+                                       clear_bit(status, &_net_info->sme_state);
+                                       if (cfg->state_notifier &&
+                                               test_bit(status, &(cfg->interrested_state)))
+                                               cfg->state_notifier(cfg, _net_info, status, false);
+                                       return;
+                               case 4:
+                                       change_bit(status, &_net_info->sme_state);
+                                       break;
+                       }
+               }
+
+       }
+       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+
+}
+
+static inline wl_cfgbss_t *
+wl_get_cfgbss_by_wdev(struct bcm_cfg80211 *cfg,
+       struct wireless_dev *wdev)
+{
+       struct net_info *_net_info, *next;
+       wl_cfgbss_t *bss = NULL;
+       unsigned long int flags;
+
+       WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (wdev && (_net_info->wdev == wdev)) {
+                       bss = &_net_info->bss;
+                       break;
+               }
+       }
+
+       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+       return bss;
+}
+
+static inline u32
+wl_get_status_by_netdev(struct bcm_cfg80211 *cfg, s32 status,
+       struct net_device *ndev)
+{
+       struct net_info *_net_info, *next;
+       u32 stat = 0;
+       unsigned long int flags;
+
+       WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (ndev && (_net_info->ndev == ndev)) {
+                       stat = test_bit(status, &_net_info->sme_state);
+                       break;
+               }
+       }
+       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+       return stat;
+}
+
+static inline s32
+wl_get_mode_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       struct net_info *_net_info, *next;
+       s32 mode = -1;
+       unsigned long int flags;
+
+       WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (_net_info->ndev && (_net_info->ndev == ndev)) {
+                       mode = wl_iftype_to_mode(_net_info->iftype);
+                       break;
+               }
+       }
+       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+       return mode;
+}
+
+static inline s32
+wl_get_bssidx_by_wdev(struct bcm_cfg80211 *cfg, struct wireless_dev *wdev)
+{
+       struct net_info *_net_info, *next;
+       s32 bssidx = -1;
+       unsigned long int flags;
+
+       WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (_net_info->wdev && (_net_info->wdev == wdev)) {
+                       bssidx = _net_info->bssidx;
+                       break;
+               }
+       }
+       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+       return bssidx;
+}
+
+static inline struct wireless_dev *
+wl_get_wdev_by_fw_idx(struct bcm_cfg80211 *cfg, s32 bssidx, s32 ifidx)
+{
+       struct net_info *_net_info, *next;
+       struct wireless_dev *wdev = NULL;
+       unsigned long int flags;
+
+       if (bssidx < 0)
+               return NULL;
+       WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if ((_net_info->bssidx == bssidx) && (_net_info->ifidx == ifidx)) {
+                       wdev = _net_info->wdev;
+                       break;
+               }
+       }
+       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+       return wdev;
+}
+
+static inline struct wl_profile *
+wl_get_profile_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       struct net_info *_net_info, *next;
+       struct wl_profile *prof = NULL;
+       unsigned long int flags;
+
+       WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (ndev && (_net_info->ndev == ndev)) {
+                       prof = &_net_info->profile;
+                       break;
+               }
+       }
+       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+       return prof;
+}
+static inline struct net_info *
+wl_get_netinfo_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       struct net_info *_net_info, *next, *info = NULL;
+       unsigned long int flags;
+
+       WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (ndev && (_net_info->ndev == ndev)) {
+                       info = _net_info;
+                       break;
+               }
+       }
+       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+       return info;
+}
+
+static inline struct net_info *
+wl_get_netinfo_by_wdev(struct bcm_cfg80211 *cfg, struct wireless_dev *wdev)
+{
+       struct net_info *_net_info, *next, *info = NULL;
+       unsigned long int flags;
+
+       WL_CFG_NET_LIST_SYNC_LOCK(&cfg->net_list_sync, flags);
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               GCC_DIAGNOSTIC_POP();
+               if (wdev && (_net_info->wdev == wdev)) {
+                       info = _net_info;
+                       break;
+               }
+       }
+       WL_CFG_NET_LIST_SYNC_UNLOCK(&cfg->net_list_sync, flags);
+       return info;
+}
+
+static inline char *
+wl_iftype_to_str(int wl_iftype)
+{
+       switch (wl_iftype) {
+               case (WL_IF_TYPE_STA):
+                       return "WL_IF_TYPE_STA";
+               case (WL_IF_TYPE_AP):
+                       return "WL_IF_TYPE_AP";
+
+               case (WL_IF_TYPE_NAN_NMI):
+                       return "WL_IF_TYPE_NAN_NMI";
+               case (WL_IF_TYPE_NAN):
+                       return "WL_IF_TYPE_NAN";
+               case (WL_IF_TYPE_P2P_GO):
+                       return "WL_IF_TYPE_P2P_GO";
+               case (WL_IF_TYPE_P2P_GC):
+                       return "WL_IF_TYPE_P2P_GC";
+               case (WL_IF_TYPE_P2P_DISC):
+                       return "WL_IF_TYPE_P2P_DISC";
+               case (WL_IF_TYPE_IBSS):
+                       return "WL_IF_TYPE_IBSS";
+               case (WL_IF_TYPE_MONITOR):
+                       return "WL_IF_TYPE_MONITOR";
+               case (WL_IF_TYPE_AIBSS):
+                       return "WL_IF_TYPE_AIBSS";
+               default:
+                       return "WL_IF_TYPE_UNKNOWN";
+       }
+}
+
+#define is_discovery_iface(iface) (((iface == WL_IF_TYPE_P2P_DISC) || \
+       (iface == WL_IF_TYPE_NAN_NMI)) ? 1 : 0)
+#define IS_P2P_GC(wdev) \
+               ((wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) ? 1 : 0)
+#define IS_P2P_GO(wdev) \
+               ((wdev->iftype == NL80211_IFTYPE_P2P_GO) ? 1 : 0)
+#define is_p2p_group_iface(wdev) (((wdev->iftype == NL80211_IFTYPE_P2P_GO) || \
+               (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) ? 1 : 0)
+#define bcmcfg_to_wiphy(cfg) (cfg->wdev->wiphy)
+#define bcmcfg_to_prmry_ndev(cfg) (cfg->wdev->netdev)
+#define bcmcfg_to_prmry_wdev(cfg) (cfg->wdev)
+#define bcmcfg_to_p2p_wdev(cfg) (cfg->p2p_wdev)
+#define ndev_to_wl(n) (wdev_to_wl(n->ieee80211_ptr))
+#define ndev_to_wdev(ndev) (ndev->ieee80211_ptr)
+#define wdev_to_ndev(wdev) (wdev->netdev)
+
+#ifdef WL_BLOCK_P2P_SCAN_ON_STA
+#define IS_P2P_IFACE(wdev) (wdev && \
+               ((wdev->iftype == NL80211_IFTYPE_P2P_DEVICE) || \
+               (wdev->iftype == NL80211_IFTYPE_P2P_GO) || \
+               (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)))
+#endif /* WL_BLOCK_P2P_SCAN_ON_STA */
+
+#define IS_STA_IFACE(wdev) (wdev && \
+               (wdev->iftype == NL80211_IFTYPE_STATION))
+
+#define IS_AP_IFACE(wdev) (wdev && \
+       (wdev->iftype == NL80211_IFTYPE_AP))
+
+#if defined(WL_ENABLE_P2P_IF)
+#define ndev_to_wlc_ndev(ndev, cfg)    ((ndev == cfg->p2p_net) ? \
+       bcmcfg_to_prmry_ndev(cfg) : ndev)
+#else
+#define ndev_to_wlc_ndev(ndev, cfg)    (ndev)
+#endif /* WL_ENABLE_P2P_IF */
+
+#define wdev_to_wlc_ndev(wdev, cfg)    \
+       (wdev_to_ndev(wdev) ? \
+       wdev_to_ndev(wdev) : bcmcfg_to_prmry_ndev(cfg))
+#if defined(WL_CFG80211_P2P_DEV_IF)
+#define cfgdev_to_wlc_ndev(cfgdev, cfg)        wdev_to_wlc_ndev(cfgdev, cfg)
+#define bcmcfg_to_prmry_cfgdev(cfgdev, cfg) bcmcfg_to_prmry_wdev(cfg)
+#elif defined(WL_ENABLE_P2P_IF)
+#define cfgdev_to_wlc_ndev(cfgdev, cfg)        ndev_to_wlc_ndev(cfgdev, cfg)
+#define bcmcfg_to_prmry_cfgdev(cfgdev, cfg) bcmcfg_to_prmry_ndev(cfg)
+#else
+#define cfgdev_to_wlc_ndev(cfgdev, cfg)        (cfgdev)
+#define bcmcfg_to_prmry_cfgdev(cfgdev, cfg) (cfgdev)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+#define cfgdev_to_wdev(cfgdev) (cfgdev)
+#define ndev_to_cfgdev(ndev)   ndev_to_wdev(ndev)
+#define cfgdev_to_ndev(cfgdev) (cfgdev ? (cfgdev->netdev) : NULL)
+#define wdev_to_cfgdev(cfgdev) (cfgdev)
+#define discover_cfgdev(cfgdev, cfg) (cfgdev->iftype == NL80211_IFTYPE_P2P_DEVICE)
+#else
+#define cfgdev_to_wdev(cfgdev) (cfgdev->ieee80211_ptr)
+#define wdev_to_cfgdev(cfgdev) cfgdev ? (cfgdev->netdev) : NULL
+#define ndev_to_cfgdev(ndev)   (ndev)
+#define cfgdev_to_ndev(cfgdev) (cfgdev)
+#define discover_cfgdev(cfgdev, cfg) (cfgdev == cfg->p2p_net)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+#define scan_req_match(cfg)    (((cfg) && (cfg->scan_request) && \
+       (cfg->scan_request->wdev == cfg->p2p_wdev)) ? true : false)
+#elif defined(WL_ENABLE_P2P_IF)
+#define scan_req_match(cfg)    (((cfg) && (cfg->scan_request) && \
+       (cfg->scan_request->dev == cfg->p2p_net)) ? true : false)
+#else
+#define scan_req_match(cfg)    (((cfg) && p2p_is_on(cfg) && p2p_scan(cfg)) ? \
+       true : false)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#define        PRINT_WDEV_INFO(cfgdev) \
+       { \
+               struct wireless_dev *wdev = cfgdev_to_wdev(cfgdev); \
+               struct net_device *netdev = wdev ? wdev->netdev : NULL; \
+               WL_DBG(("wdev_ptr:%p ndev_ptr:%p ifname:%s iftype:%d\n", OSL_OBFUSCATE_BUF(wdev), \
+                       OSL_OBFUSCATE_BUF(netdev),      \
+                       netdev ? netdev->name : "NULL (non-ndev device)",       \
+                       wdev ? wdev->iftype : 0xff)); \
+       }
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
+#define scan_req_iftype(req) (req->dev->ieee80211_ptr->iftype)
+#else
+#define scan_req_iftype(req) (req->wdev->iftype)
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0) */
+
+#define wl_to_sr(w) (w->scan_req_int)
+#if defined(STATIC_WL_PRIV_STRUCT)
+#define wl_to_ie(w) (w->ie)
+#define wl_to_conn(w) (w->conn_info)
+#else
+#define wl_to_ie(w) (&w->ie)
+#define wl_to_conn(w) (&w->conn_info)
+#endif
+#define wl_to_fils_info(w) (&w->fils_info)
+#define wiphy_from_scan(w) (w->escan_info.wiphy)
+#define wl_get_drv_status_all(cfg, stat) \
+       (wl_get_status_all(cfg, WL_STATUS_ ## stat))
+#define wl_get_drv_status(cfg, stat, ndev)  \
+       (wl_get_status_by_netdev(cfg, WL_STATUS_ ## stat, ndev))
+#define wl_set_drv_status(cfg, stat, ndev)  \
+       (wl_set_status_by_netdev(cfg, WL_STATUS_ ## stat, ndev, 1))
+#define wl_clr_drv_status(cfg, stat, ndev)  \
+       (wl_set_status_by_netdev(cfg, WL_STATUS_ ## stat, ndev, 2))
+#define wl_clr_drv_status_all(cfg, stat)  \
+       (wl_set_status_all(cfg, WL_STATUS_ ## stat, 2))
+#define wl_chg_drv_status(cfg, stat, ndev)  \
+       (wl_set_status_by_netdev(cfg, WL_STATUS_ ## stat, ndev, 4))
+
+#define for_each_bss(list, bss, __i)   \
+       for (__i = 0; __i < list->count && __i < WL_AP_MAX; __i++, bss = next_bss(list, bss))
+
+#define for_each_ndev(cfg, iter, next) \
+       list_for_each_entry_safe(iter, next, &cfg->net_list, list)
+
+/* In case of WPS from wpa_supplicant, pairwise siute and group suite is 0.
+ * In addtion to that, wpa_version is WPA_VERSION_1
+ */
+#define is_wps_conn(_sme) \
+       ((wl_cfgp2p_find_wpsie(_sme->ie, _sme->ie_len) != NULL) && \
+        (!_sme->crypto.n_ciphers_pairwise) && \
+        (!_sme->crypto.cipher_group))
+
+#ifdef WLFBT
+#if defined(WLAN_AKM_SUITE_FT_8021X) && defined(WLAN_AKM_SUITE_FT_PSK)
+#define IS_AKM_SUITE_FT(sec) (sec->wpa_auth == WLAN_AKM_SUITE_FT_8021X || \
+               sec->wpa_auth == WLAN_AKM_SUITE_FT_PSK)
+#elif defined(WLAN_AKM_SUITE_FT_8021X)
+#define IS_AKM_SUITE_FT(sec) (sec->wpa_auth == WLAN_AKM_SUITE_FT_8021X)
+#elif defined(WLAN_AKM_SUITE_FT_PSK)
+#define IS_AKM_SUITE_FT(sec) (sec->wpa_auth == WLAN_AKM_SUITE_FT_PSK)
+#else
+#define IS_AKM_SUITE_FT(sec) ({BCM_REFERENCE(sec); FALSE;})
+#endif /* WLAN_AKM_SUITE_FT_8021X && WLAN_AKM_SUITE_FT_PSK */
+#else
+#define IS_AKM_SUITE_FT(sec) ({BCM_REFERENCE(sec); FALSE;})
+#endif /* WLFBT */
+
+#define IS_AKM_SUITE_CCKM(sec) ({BCM_REFERENCE(sec); FALSE;})
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0))
+#define STA_INFO_BIT(info) (1ul << NL80211_STA_ ## info)
+#ifdef strnicmp
+#undef strnicmp
+#endif /* strnicmp */
+#define strnicmp(str1, str2, len) strncasecmp((str1), (str2), (len))
+#else
+#define STA_INFO_BIT(info) (STATION_ ## info)
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)) */
+
+extern s32 wl_cfg80211_attach(struct net_device *ndev, void *context);
+extern void wl_cfg80211_detach(struct bcm_cfg80211 *cfg);
+
+extern void wl_cfg80211_event(struct net_device *ndev, const wl_event_msg_t *e,
+            void *data);
+extern s32 wl_cfg80211_handle_critical_events(struct bcm_cfg80211 *cfg,
+       const wl_event_msg_t * e);
+
+void wl_cfg80211_set_parent_dev(void *dev);
+struct device *wl_cfg80211_get_parent_dev(void);
+struct bcm_cfg80211 *wl_cfg80211_get_bcmcfg(void);
+void wl_cfg80211_set_bcmcfg(struct bcm_cfg80211 *cfg);
+
+/* clear IEs */
+extern s32 wl_cfg80211_clear_mgmt_vndr_ies(struct bcm_cfg80211 *cfg);
+extern s32 wl_cfg80211_clear_per_bss_ies(struct bcm_cfg80211 *cfg, struct wireless_dev *wdev);
+extern void wl_cfg80211_clear_p2p_disc_ies(struct bcm_cfg80211 *cfg);
+#ifdef WL_STATIC_IF
+extern int32 wl_cfg80211_update_iflist_info(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       int ifidx, uint8 *addr, int bssidx, char *name, int if_state);
+#endif /* WL_STATIC_IF */
+extern s32 wl_cfg80211_up(struct net_device *net);
+extern s32 wl_cfg80211_down(struct net_device *net);
+extern void wl_cfg80211_sta_ifdown(struct net_device *net);
+extern s32 wl_cfg80211_notify_ifadd(struct net_device * dev, int ifidx, char *name, uint8 *mac,
+       uint8 bssidx, uint8 role);
+extern s32 wl_cfg80211_notify_ifdel(struct net_device * dev, int ifidx, char *name, uint8 *mac,
+       uint8 bssidx);
+extern s32 wl_cfg80211_notify_ifchange(struct net_device * dev, int ifidx, char *name, uint8 *mac,
+       uint8 bssidx);
+extern struct net_device* wl_cfg80211_allocate_if(struct bcm_cfg80211 *cfg, int ifidx,
+       const char *name, uint8 *mac, uint8 bssidx, const char *dngl_name);
+extern int wl_cfg80211_register_if(struct bcm_cfg80211 *cfg,
+       int ifidx, struct net_device* ndev, bool rtnl_lock_reqd);
+extern int wl_cfg80211_remove_if(struct bcm_cfg80211 *cfg,
+       int ifidx, struct net_device* ndev, bool rtnl_lock_reqd);
+extern void wl_cfg80211_cleanup_if(struct net_device *dev);
+extern bool wl_cfg80211_is_concurrent_mode(struct net_device * dev);
+extern void wl_cfg80211_disassoc(struct net_device *ndev, uint32 reason);
+extern void wl_cfg80211_del_all_sta(struct net_device *ndev, uint32 reason);
+extern void* wl_cfg80211_get_dhdp(struct net_device * dev);
+extern bool wl_cfg80211_is_p2p_active(struct net_device * dev);
+extern bool wl_cfg80211_is_roam_offload(struct net_device * dev);
+extern bool wl_cfg80211_is_event_from_connected_bssid(struct net_device * dev,
+               const wl_event_msg_t *e, int ifidx);
+extern void wl_cfg80211_dbg_level(u32 level);
+extern s32 wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr);
+extern s32 wl_cfg80211_set_p2p_noa(struct net_device *net, char* buf, int len);
+extern s32 wl_cfg80211_get_p2p_noa(struct net_device *net, char* buf, int len);
+extern s32 wl_cfg80211_set_wps_p2p_ie(struct net_device *net, char *buf, int len,
+       enum wl_management_type type);
+extern s32 wl_cfg80211_set_p2p_ps(struct net_device *net, char* buf, int len);
+extern s32 wl_cfg80211_set_p2p_ecsa(struct net_device *net, char* buf, int len);
+extern s32 wl_cfg80211_increase_p2p_bw(struct net_device *net, char* buf, int len);
+extern bool wl_cfg80211_check_vif_in_use(struct net_device *ndev);
+#ifdef P2PLISTEN_AP_SAMECHN
+extern s32 wl_cfg80211_set_p2p_resp_ap_chn(struct net_device *net, s32 enable);
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+/* btcoex functions */
+void* wl_cfg80211_btcoex_init(struct net_device *ndev);
+void wl_cfg80211_btcoex_deinit(void);
+
+extern chanspec_t wl_chspec_from_legacy(chanspec_t legacy_chspec);
+extern chanspec_t wl_chspec_driver_to_host(chanspec_t chanspec);
+
+#ifdef WL_SUPPORT_AUTO_CHANNEL
+#define CHANSPEC_BUF_SIZE      1024
+#define CHAN_SEL_IOCTL_DELAY   300
+#define CHAN_SEL_RETRY_COUNT   15
+#define CHANNEL_IS_RADAR(channel)      (((channel & WL_CHAN_RADAR) || \
+       (channel & WL_CHAN_PASSIVE)) ? true : false)
+#define CHANNEL_IS_2G(channel) (((channel >= 1) && (channel <= 14)) ? \
+       true : false)
+#define CHANNEL_IS_5G(channel) (((channel >= 36) && (channel <= 165)) ? \
+       true : false)
+extern s32 wl_cfg80211_get_best_channels(struct net_device *dev, char* command,
+       int total_len);
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+extern int wl_cfg80211_ether_atoe(const char *a, struct ether_addr *n);
+extern int wl_cfg80211_hang(struct net_device *dev, u16 reason);
+extern bool wl_cfg80211_macaddr_sync_reqd(struct net_device *dev);
+void wl_cfg80211_generate_mac_addr(struct ether_addr *ea_addr);
+extern s32 wl_mode_to_nl80211_iftype(s32 mode);
+int wl_cfg80211_do_driver_init(struct net_device *net);
+void wl_cfg80211_enable_trace(u32 level);
+extern s32 wl_update_wiphybands(struct bcm_cfg80211 *cfg, bool notify);
+extern s32 wl_cfg80211_if_is_group_owner(void);
+extern chanspec_t wl_chspec_host_to_driver(chanspec_t chanspec);
+extern chanspec_t wl_ch_host_to_driver(u16 channel);
+extern s32 wl_set_tx_power(struct net_device *dev,
+       enum nl80211_tx_power_setting type, s32 dbm);
+extern s32 wl_get_tx_power(struct net_device *dev, s32 *dbm);
+extern s32 wl_add_remove_eventmsg(struct net_device *ndev, u16 event, bool add);
+extern void wl_stop_wait_next_action_frame(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       u8 bsscfgidx);
+#ifdef WL_HOST_BAND_MGMT
+extern s32 wl_cfg80211_set_band(struct net_device *ndev, int band);
+#endif /* WL_HOST_BAND_MGMT */
+
+extern void wl_cfg80211_add_to_eventbuffer(wl_eventmsg_buf_t *ev, u16 event, bool set);
+extern s32 wl_cfg80211_apply_eventbuffer(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, wl_eventmsg_buf_t *ev);
+extern void get_primary_mac(struct bcm_cfg80211 *cfg, struct ether_addr *mac);
+extern void wl_cfg80211_update_power_mode(struct net_device *dev);
+extern void wl_terminate_event_handler(struct net_device *dev);
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+extern s32 wl_cfg80211_get_bss_info(struct net_device *dev, char* cmd, int total_len);
+extern s32 wl_cfg80211_get_connect_failed_status(struct net_device *dev, char* cmd, int total_len);
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+extern struct bcm_cfg80211 *wl_get_cfg(struct net_device *ndev);
+extern s32 wl_cfg80211_set_if_band(struct net_device *ndev, int band);
+extern s32 wl_cfg80211_set_country_code(struct net_device *dev, char *country_code,
+        bool notify, bool user_enforced, int revinfo);
+extern bool wl_cfg80211_is_hal_started(struct bcm_cfg80211 *cfg);
+#ifdef WL_WIPSEVT
+extern int wl_cfg80211_wips_event(uint16 misdeauth, char* bssid);
+extern int wl_cfg80211_wips_event_ext(wl_wips_event_info_t *wips_event);
+#endif /* WL_WIPSEVT */
+
+#define SCAN_BUF_CNT   2
+#define SCAN_BUF_NEXT  1
+#define WL_SCANTYPE_LEGACY     0x1
+#define WL_SCANTYPE_P2P                0x2
+extern void wl_cfg80211_ibss_vsie_set_buffer(struct net_device *dev, vndr_ie_setbuf_t *ibss_vsie,
+       int ibss_vsie_len);
+extern s32 wl_cfg80211_ibss_vsie_delete(struct net_device *dev);
+#ifdef WLAIBSS
+extern void wl_cfg80211_set_txfail_pid(struct net_device *dev, int pid);
+#endif /* WLAIBSS */
+#ifdef WL_RELMCAST
+extern void wl_cfg80211_set_rmc_pid(struct net_device *dev, int pid);
+#endif /* WL_RELMCAST */
+extern int wl_cfg80211_set_mgmt_vndr_ies(struct bcm_cfg80211 *cfg,
+       bcm_struct_cfgdev *cfgdev, s32 bssidx, s32 pktflag,
+       const u8 *vndr_ie, u32 vndr_ie_len);
+
+#ifdef WLFBT
+extern int wl_cfg80211_get_fbt_key(struct net_device *dev, uint8 *key, int total_len);
+#endif
+
+/* Action frame specific functions */
+extern u8 wl_get_action_category(void *frame, u32 frame_len);
+extern int wl_get_public_action(void *frame, u32 frame_len, u8 *ret_action);
+
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+struct net_device *wl_cfg80211_get_remain_on_channel_ndev(struct bcm_cfg80211 *cfg);
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+#ifdef WL_SUPPORT_ACS
+#define ACS_MSRMNT_DELAY 1000 /* dump_obss delay in ms */
+#define IOCTL_RETRY_COUNT 5
+#define CHAN_NOISE_DUMMY -80
+#define OBSS_TOKEN_IDX 15
+#define IBSS_TOKEN_IDX 15
+#define TX_TOKEN_IDX 14
+#define CTG_TOKEN_IDX 13
+#define PKT_TOKEN_IDX 15
+#define IDLE_TOKEN_IDX 12
+#endif /* WL_SUPPORT_ACS */
+
+#ifdef BCMWAPI_WPI
+#define is_wapi(cipher) (cipher == WLAN_CIPHER_SUITE_SMS4) ? 1 : 0
+#endif /* BCMWAPI_WPI */
+
+extern int wl_cfg80211_get_ioctl_version(void);
+extern int wl_cfg80211_enable_roam_offload(struct net_device *dev, int enable);
+extern s32 wl_cfg80211_dfs_ap_move(struct net_device *ndev, char *data,
+               char *command, int total_len);
+#ifdef WBTEXT
+extern s32 wl_cfg80211_wbtext_set_default(struct net_device *ndev);
+extern s32 wl_cfg80211_wbtext_config(struct net_device *ndev, char *data,
+               char *command, int total_len);
+extern int wl_cfg80211_wbtext_weight_config(struct net_device *ndev, char *data,
+               char *command, int total_len);
+extern int wl_cfg80211_wbtext_table_config(struct net_device *ndev, char *data,
+               char *command, int total_len);
+extern s32 wl_cfg80211_wbtext_delta_config(struct net_device *ndev, char *data,
+               char *command, int total_len);
+#endif /* WBTEXT */
+extern s32 wl_cfg80211_get_chanspecs_2g(struct net_device *ndev,
+               void *buf, s32 buflen);
+extern s32 wl_cfg80211_get_chanspecs_5g(struct net_device *ndev,
+               void *buf, s32 buflen);
+
+extern s32 wl_cfg80211_bss_up(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev, s32 bsscfg_idx, s32 up);
+extern bool wl_cfg80211_bss_isup(struct net_device *ndev, int bsscfg_idx);
+
+struct net_device *wl_cfg80211_post_ifcreate(struct net_device *ndev,
+       wl_if_event_info *event, u8 *addr, const char *name, bool rtnl_lock_reqd);
+extern s32 wl_cfg80211_post_ifdel(struct net_device *ndev, bool rtnl_lock_reqd, s32 ifidx);
+#if defined(PKT_FILTER_SUPPORT) && defined(APSTA_BLOCK_ARP_DURING_DHCP)
+extern void wl_cfg80211_block_arp(struct net_device *dev, int enable);
+#endif /* PKT_FILTER_SUPPORT && APSTA_BLOCK_ARP_DURING_DHCP */
+
+#ifdef WLTDLS
+extern s32 wl_cfg80211_tdls_config(struct bcm_cfg80211 *cfg,
+       enum wl_tdls_config state, bool tdls_mode);
+extern s32 wl_tdls_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#endif /* WLTDLS */
+
+#ifdef WL_NAN
+extern int wl_cfgvendor_send_nan_event(struct wiphy * wiphy,
+       struct net_device *dev, int event_id,
+       nan_event_data_t *nan_event_data);
+#ifdef RTT_SUPPORT
+extern s32 wl_cfgvendor_send_as_rtt_legacy_event(struct wiphy *wiphy,
+       struct net_device *dev, wl_nan_ev_rng_rpt_ind_t *range_res,
+       uint32 status);
+#endif /* RTT_SUPPORT */
+#endif /* WL_NAN */
+
+#ifdef WL_CFG80211_P2P_DEV_IF
+extern void wl_cfg80211_del_p2p_wdev(struct net_device *dev);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+extern int wl_cfg80211_get_sta_channel(struct bcm_cfg80211 *cfg);
+#ifdef WL_CFG80211_SYNC_GON
+#define WL_DRV_STATUS_SENDING_AF_FRM_EXT(cfg) \
+       (wl_get_drv_status_all(cfg, SENDING_ACT_FRM) || \
+               wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM_LISTEN))
+#else
+#define WL_DRV_STATUS_SENDING_AF_FRM_EXT(cfg) wl_get_drv_status_all(cfg, SENDING_ACT_FRM)
+#endif /* WL_CFG80211_SYNC_GON */
+
+#ifdef P2P_LISTEN_OFFLOADING
+extern s32 wl_cfg80211_p2plo_deinit(struct bcm_cfg80211 *cfg);
+#endif /* P2P_LISTEN_OFFLOADING */
+
+/* Function to flush the FW log buffer content */
+extern void wl_flush_fw_log_buffer(struct net_device *dev, uint32 logset_mask);
+
+#define RETURN_EIO_IF_NOT_UP(wlpriv)                        \
+do {                                    \
+       struct net_device *checkSysUpNDev = bcmcfg_to_prmry_ndev(wlpriv);           \
+       if (unlikely(!wl_get_drv_status(wlpriv, READY, checkSysUpNDev))) {  \
+               WL_INFORM(("device is not ready\n"));           \
+               return -EIO;                        \
+       }                               \
+} while (0)
+
+#ifdef QOS_MAP_SET
+extern uint8 *wl_get_up_table(dhd_pub_t * dhdp, int idx);
+#endif /* QOS_MAP_SET */
+
+#define P2PO_COOKIE     65535
+u64 wl_cfg80211_get_new_roc_id(struct bcm_cfg80211 *cfg);
+
+#define ROAMSCAN_MODE_NORMAL   0
+#define ROAMSCAN_MODE_WES      1
+
+#ifdef SUPPORT_AP_HIGHER_BEACONRATE
+int wl_set_ap_beacon_rate(struct net_device *dev, int val, char *ifname);
+int wl_get_ap_basic_rate(struct net_device *dev, char* command, char *ifname, int total_len);
+#endif /* SUPPORT_AP_HIGHER_BEACONRATE */
+#ifdef SUPPORT_AP_RADIO_PWRSAVE
+int wl_get_ap_rps(struct net_device *dev, char* command, char *ifname, int total_len);
+int wl_set_ap_rps(struct net_device *dev, bool enable, char *ifname);
+int wl_update_ap_rps_params(struct net_device *dev, ap_rps_info_t* rps, char *ifname);
+void wl_cfg80211_init_ap_rps(struct bcm_cfg80211 *cfg);
+#endif /* SUPPORT_AP_RADIO_PWRSAVE */
+#ifdef SUPPORT_RSSI_SUM_REPORT
+int wl_get_rssi_logging(struct net_device *dev, void *param);
+int wl_set_rssi_logging(struct net_device *dev, void *param);
+int wl_get_rssi_per_ant(struct net_device *dev, char *ifname, char *peer_mac, void *param);
+#endif /* SUPPORT_RSSI_SUM_REPORT */
+int wl_cfg80211_iface_count(struct net_device *dev);
+struct net_device* wl_get_ap_netdev(struct bcm_cfg80211 *cfg, char *ifname);
+void wl_cfg80211_cleanup_virtual_ifaces(struct bcm_cfg80211 *cfg, bool rtnl_lock_reqd);
+#ifdef WL_IFACE_MGMT
+extern int wl_cfg80211_set_iface_policy(struct net_device *ndev, char *arg, int len);
+extern uint8 wl_cfg80211_get_iface_policy(struct net_device *ndev);
+extern s32 wl_cfg80211_handle_if_role_conflict(struct bcm_cfg80211 *cfg, wl_iftype_t new_wl_iftype);
+s32 wl_cfg80211_data_if_mgmt(struct bcm_cfg80211 *cfg, wl_iftype_t new_wl_iftype);
+s32 wl_cfg80211_disc_if_mgmt(struct bcm_cfg80211 *cfg, wl_iftype_t new_wl_iftype,
+       bool *disable_nan, bool *disable_p2p);
+s32 wl_cfg80211_handle_discovery_config(struct bcm_cfg80211 *cfg, wl_iftype_t new_wl_iftype);
+wl_iftype_t wl_cfg80211_get_sec_iface(struct bcm_cfg80211 *cfg);
+bool wl_cfg80211_is_associated_discovery(struct bcm_cfg80211 *cfg, wl_iftype_t new_wl_iftype);
+#endif /* WL_IFACE_MGMT */
+struct wireless_dev * wl_cfg80211_add_if(struct bcm_cfg80211 *cfg, struct net_device *primary_ndev,
+       wl_iftype_t wl_iftype, const char *name, u8 *mac);
+extern s32 wl_cfg80211_del_if(struct bcm_cfg80211 *cfg, struct net_device *primary_ndev,
+       struct wireless_dev *wdev, char *name);
+s32 _wl_cfg80211_del_if(struct bcm_cfg80211 *cfg, struct net_device *primary_ndev,
+       struct wireless_dev *wdev, char *ifname);
+s32 wl_cfg80211_delete_iface(struct bcm_cfg80211 *cfg, wl_iftype_t sec_data_if_type);
+
+#ifdef WL_STATIC_IF
+extern struct net_device *wl_cfg80211_register_static_if(struct bcm_cfg80211 *cfg,
+       u16 iftype, char *ifname);
+extern void wl_cfg80211_unregister_static_if(struct bcm_cfg80211 * cfg);
+extern s32 wl_cfg80211_static_if_open(struct net_device *net);
+extern s32 wl_cfg80211_static_if_close(struct net_device *net);
+extern struct net_device * wl_cfg80211_post_static_ifcreate(struct bcm_cfg80211 *cfg,
+       wl_if_event_info *event, u8 *addr, s32 iface_type);
+extern s32 wl_cfg80211_post_static_ifdel(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+#endif  /* WL_STATIC_IF */
+extern struct wireless_dev *wl_cfg80211_get_wdev_from_ifname(struct bcm_cfg80211 *cfg,
+       const char *name);
+struct net_device* wl_get_netdev_by_name(struct bcm_cfg80211 *cfg, char *ifname);
+extern s32 wl_get_vif_macaddr(struct bcm_cfg80211 *cfg, u16 wl_iftype, u8 *mac_addr);
+extern s32 wl_release_vif_macaddr(struct bcm_cfg80211 *cfg, u8 *mac_addr, u16 wl_iftype);
+extern int wl_cfg80211_ifstats_counters(struct net_device *dev, wl_if_stats_t *if_stats);
+extern s32 wl_cfg80211_set_dbg_verbose(struct net_device *ndev, u32 level);
+extern int wl_cfg80211_deinit_p2p_discovery(struct bcm_cfg80211 * cfg);
+extern int wl_cfg80211_set_frameburst(struct bcm_cfg80211 *cfg, bool enable);
+extern int wl_cfg80211_determine_p2p_rsdb_mode(struct bcm_cfg80211 *cfg);
+extern uint8 wl_cfg80211_get_bus_state(struct bcm_cfg80211 *cfg);
+#ifdef WL_WPS_SYNC
+void wl_handle_wps_states(struct net_device *ndev, u8 *dump_data, u16 len, bool direction);
+#endif /* WL_WPS_SYNC */
+extern int wl_features_set(u8 *array, uint8 len, u32 ftidx);
+extern void *wl_read_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 item);
+extern s32 wl_cfg80211_sup_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+        const wl_event_msg_t *event, void *data);
+extern void wl_cfg80211_cancel_scan(struct bcm_cfg80211 *cfg);
+extern s32 wl_notify_escan_complete(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev, bool aborted, bool fw_abort);
+#ifdef CUSTOMER_HW4_DEBUG
+extern void wl_scan_timeout_dbg_clear(void);
+#endif /* CUSTOMER_HW4_DEBUG */
+extern s32 cfg80211_to_wl_iftype(uint16 type, uint16 *role, uint16 *mode);
+extern s32 wl_cfg80211_net_attach(struct net_device *primary_ndev);
+extern void wl_print_verinfo(struct bcm_cfg80211 *cfg);
+extern const u8 *wl_find_attribute(const u8 *buf, u16 len, u16 element_id);
+extern int wl_cfg80211_get_concurrency_mode(struct bcm_cfg80211 *cfg);
+int wl_cfg80211_set_he_mode(struct net_device *dev, struct bcm_cfg80211 *cfg,
+               s32 bssidx, u32 interface_type, bool set);
+extern s32 wl_cfg80211_config_suspend_events(struct net_device *ndev, bool enable);
+#ifdef SUPPORT_AP_SUSPEND
+extern int wl_set_ap_suspend(struct net_device *dev, bool enable, char *ifname);
+#endif /* SUPPORT_AP_SUSPEND */
+#ifdef SUPPORT_SOFTAP_ELNA_BYPASS
+int wl_set_softap_elna_bypass(struct net_device *dev, char *ifname, int enable);
+int wl_get_softap_elna_bypass(struct net_device *dev, char *ifname, void *param);
+#endif /* SUPPORT_SOFTAP_ELNA_BYPASS */
+#ifdef SUPPORT_AP_BWCTRL
+extern int wl_set_ap_bw(struct net_device *dev, u32 bw, char *ifname);
+extern int wl_get_ap_bw(struct net_device *dev, char* command, char *ifname, int total_len);
+#endif /* SUPPORT_AP_BWCTRL */
+#ifdef PCIE_INB_DW
+bool wl_cfg80211_check_in_progress(struct net_device *dev);
+#endif
+#ifdef WES_SUPPORT
+extern int wl_android_set_ncho_mode(struct net_device *dev, int mode);
+#endif /* WES_SUPPORT */
+#ifdef KEEP_ALIVE
+extern int wl_cfg80211_start_mkeep_alive(struct bcm_cfg80211 *cfg, uint8 mkeep_alive_id,
+       uint16 ether_type, uint8 *ip_pkt, uint16 ip_pkt_len, uint8* src_mac_addr,
+       uint8* dst_mac_addr, uint32 period_msec);
+extern int wl_cfg80211_stop_mkeep_alive(struct bcm_cfg80211 *cfg, uint8 mkeep_alive_id);
+#endif /* KEEP_ALIVE */
+
+extern s32 wl_cfg80211_handle_macaddr_change(struct net_device *dev, u8 *macaddr);
+extern int wl_cfg80211_handle_hang_event(struct net_device *ndev,
+       uint16 hang_reason, uint32 memdump_type);
+bool wl_cfg80211_is_dpp_frame(void *frame, u32 frame_len);
+const char *get_dpp_pa_ftype(enum wl_dpp_ftype ftype);
+bool wl_cfg80211_is_dpp_gas_action(void *frame, u32 frame_len);
+extern bool wl_cfg80211_find_gas_subtype(u8 subtype, u16 adv_id, u8* data, u32 len);
+#ifdef ESCAN_CHANNEL_CACHE
+extern void wl_update_rcc_list(struct net_device *dev);
+#endif /* ESCAN_CHANNEL_CACHE */
+
+#ifdef WL_SAE
+extern s32 wl_cfg80211_set_wsec_info(struct net_device *dev, uint32 *data,
+       uint16 data_len, int tag);
+#endif /* WL_SAE */
+#define WL_CHANNEL_ARRAY_INIT(band_chan_arr)   \
+do {   \
+       u32 arr_size, k;        \
+       arr_size = ARRAYSIZE(band_chan_arr);    \
+       for (k = 0; k < arr_size; k++) {        \
+               band_chan_arr[k].flags = IEEE80211_CHAN_DISABLED;       \
+       }       \
+} while (0)
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
+#define CFG80211_PUT_BSS(wiphy, bss) cfg80211_put_bss(wiphy, bss);
+#else
+#define CFG80211_PUT_BSS(wiphy, bss) cfg80211_put_bss(bss);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0) */
+
+#ifdef RSSI_OFFSET
+static inline s32 wl_rssi_offset(s32 rssi)
+{
+       rssi += RSSI_OFFSET;
+       if (rssi > 0)
+               rssi = 0;
+       return rssi;
+}
+#else
+#define wl_rssi_offset(x)      x
+#endif
+extern int wl_channel_to_frequency(u32 chan, chanspec_band_t band);
+extern int wl_cfg80211_config_rsnxe_ie(struct bcm_cfg80211 *cfg, struct net_device *dev,
+               const u8 *parse, u32 len);
+s32 wl_cfg80211_autochannel(struct net_device *dev, char* command, int total_len);
+int wl_cfg80211_check_in4way(struct bcm_cfg80211 *cfg,
+       struct net_device *dev, uint action, enum wl_ext_status status, void *context);
+#endif /* _wl_cfg80211_h_ */
diff --git a/bcmdhd.101.10.240.x/wl_cfg_btcoex.c b/bcmdhd.101.10.240.x/wl_cfg_btcoex.c
new file mode 100644 (file)
index 0000000..e5ef7a8
--- /dev/null
@@ -0,0 +1,568 @@
+/*
+ * Linux cfg80211 driver - Dongle Host Driver (DHD) related
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <net/rtnetlink.h>
+
+#include <bcmutils.h>
+#include <wldev_common.h>
+#include <wl_cfg80211.h>
+#include <dhd_cfg80211.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+
+#ifdef PKT_FILTER_SUPPORT
+extern uint dhd_pkt_filter_enable;
+extern uint dhd_master_mode;
+extern void dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode);
+#endif
+
+struct btcoex_info {
+       timer_list_compat_t timer;
+       u32 timer_ms;
+       u32 timer_on;
+       u32 ts_dhcp_start;      /* ms ts ecord time stats */
+       u32 ts_dhcp_ok;         /* ms ts ecord time stats */
+       bool dhcp_done; /* flag, indicates that host done with
+                                        * dhcp before t1/t2 expiration
+                                        */
+       s32 bt_state;
+       struct work_struct work;
+       struct net_device *dev;
+};
+
+static struct btcoex_info *btcoex_info_loc = NULL;
+
+/* TODO: clean up the BT-Coex code, it still have some legacy ioctl/iovar functions */
+
+/* use New SCO/eSCO smart YG suppression */
+#define BT_DHCP_eSCO_FIX
+/* this flag boost wifi pkt priority to max, caution: -not fair to sco */
+#define BT_DHCP_USE_FLAGS
+/* T1 start SCO/ESCo priority suppression */
+#define BT_DHCP_OPPR_WIN_TIME  2500
+/* T2 turn off SCO/SCO supperesion is (timeout) */
+#define BT_DHCP_FLAG_FORCE_TIME 5500
+
+#define        BTCOEXMODE      "BTCOEXMODE"
+#define        POWERMODE       "POWERMODE"
+
+enum wl_cfg80211_btcoex_status {
+       BT_DHCP_IDLE,
+       BT_DHCP_START,
+       BT_DHCP_OPPR_WIN,
+       BT_DHCP_FLAG_FORCE_TIMEOUT
+};
+
+/*
+ * get named driver variable to uint register value and return error indication
+ * calling example: dev_wlc_intvar_get_reg(dev, "btc_params",66, &reg_value)
+ */
+static int
+dev_wlc_intvar_get_reg(struct net_device *dev, char *name,
+       uint reg, int *retval)
+{
+       union {
+               char buf[WLC_IOCTL_SMLEN];
+               int val;
+       } var;
+       int error;
+
+       bzero(&var, sizeof(var));
+       error = bcm_mkiovar(name, (char *)(&reg), sizeof(reg), (char *)(&var), sizeof(var.buf));
+       if (error == 0) {
+               return BCME_BUFTOOSHORT;
+       }
+       error = wldev_ioctl_get(dev, WLC_GET_VAR, (char *)(&var), sizeof(var.buf));
+
+       *retval = dtoh32(var.val);
+       return (error);
+}
+
+static int
+dev_wlc_bufvar_set(struct net_device *dev, char *name, char *buf, int len)
+{
+       char ioctlbuf_local[WLC_IOCTL_SMLEN];
+       int ret;
+
+       ret = bcm_mkiovar(name, buf, len, ioctlbuf_local, sizeof(ioctlbuf_local));
+       if (ret == 0)
+               return BCME_BUFTOOSHORT;
+       return (wldev_ioctl_set(dev, WLC_SET_VAR, ioctlbuf_local, ret));
+}
+
+/*
+get named driver variable to uint register value and return error indication
+calling example: dev_wlc_intvar_set_reg(dev, "btc_params",66, value)
+*/
+static int
+dev_wlc_intvar_set_reg(struct net_device *dev, char *name, char *addr, char * val)
+{
+       char reg_addr[8];
+
+       bzero(reg_addr, sizeof(reg_addr));
+       memcpy((char *)&reg_addr[0], (char *)addr, 4);
+       memcpy((char *)&reg_addr[4], (char *)val, 4);
+
+       return (dev_wlc_bufvar_set(dev, name, (char *)&reg_addr[0], sizeof(reg_addr)));
+}
+
+/* andrey: bt pkt period independant sco/esco session detection algo.  */
+static bool btcoex_is_sco_active(struct net_device *dev)
+{
+       int ioc_res = 0;
+       bool res = FALSE;
+       int sco_id_cnt = 0;
+       int param27;
+       int i;
+
+       for (i = 0; i < 12; i++) {
+
+               ioc_res = dev_wlc_intvar_get_reg(dev, "btc_params", 27, &param27);
+
+               WL_TRACE(("sample[%d], btc params: 27:%x\n", i, param27));
+
+               if (ioc_res < 0) {
+                       WL_ERR(("ioc read btc params error\n"));
+                       break;
+               }
+
+               if ((param27 & 0x6) == 2) { /* count both sco & esco  */
+                       sco_id_cnt++;
+               }
+
+               if (sco_id_cnt > 2) {
+                       WL_TRACE(("sco/esco detected, pkt id_cnt:%d  samples:%d\n",
+                               sco_id_cnt, i));
+                       res = TRUE;
+                       break;
+               }
+
+               OSL_SLEEP(5);
+       }
+
+       return res;
+}
+
+#if defined(BT_DHCP_eSCO_FIX)
+/* Enhanced BT COEX settings for eSCO compatibility during DHCP window */
+static int set_btc_esco_params(struct net_device *dev, bool trump_sco)
+{
+       static bool saved_status = FALSE;
+
+       char buf_reg50va_dhcp_on[8] =
+               { 50, 00, 00, 00, 0x22, 0x80, 0x00, 0x00 };
+       char buf_reg51va_dhcp_on[8] =
+               { 51, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+       char buf_reg64va_dhcp_on[8] =
+               { 64, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+       char buf_reg65va_dhcp_on[8] =
+               { 65, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+       char buf_reg71va_dhcp_on[8] =
+               { 71, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+       uint32 regaddr;
+       static uint32 saved_reg50;
+       static uint32 saved_reg51;
+       static uint32 saved_reg64;
+       static uint32 saved_reg65;
+       static uint32 saved_reg71;
+
+       if (trump_sco) {
+               /* this should reduce eSCO agressive retransmit
+                * w/o breaking it
+                */
+
+               /* 1st save current */
+               WL_TRACE(("Do new SCO/eSCO coex algo {save &"
+                         "override}\n"));
+               if ((!dev_wlc_intvar_get_reg(dev, "btc_params", 50, &saved_reg50)) &&
+                       (!dev_wlc_intvar_get_reg(dev, "btc_params", 51, &saved_reg51)) &&
+                       (!dev_wlc_intvar_get_reg(dev, "btc_params", 64, &saved_reg64)) &&
+                       (!dev_wlc_intvar_get_reg(dev, "btc_params", 65, &saved_reg65)) &&
+                       (!dev_wlc_intvar_get_reg(dev, "btc_params", 71, &saved_reg71))) {
+                       saved_status = TRUE;
+                       WL_TRACE(("saved bt_params[50,51,64,65,71]:"
+                                 "0x%x 0x%x 0x%x 0x%x 0x%x\n",
+                                 saved_reg50, saved_reg51,
+                                 saved_reg64, saved_reg65, saved_reg71));
+               } else {
+                       WL_ERR((":%s: save btc_params failed\n",
+                               __FUNCTION__));
+                       saved_status = FALSE;
+                       return -1;
+               }
+
+               /* pacify the eSco   */
+               WL_TRACE(("override with [50,51,64,65,71]:"
+                         "0x%x 0x%x 0x%x 0x%x 0x%x\n",
+                         *(u32 *)(buf_reg50va_dhcp_on+4),
+                         *(u32 *)(buf_reg51va_dhcp_on+4),
+                         *(u32 *)(buf_reg64va_dhcp_on+4),
+                         *(u32 *)(buf_reg65va_dhcp_on+4),
+                         *(u32 *)(buf_reg71va_dhcp_on+4)));
+
+               dev_wlc_bufvar_set(dev, "btc_params",
+                       (char *)&buf_reg50va_dhcp_on[0], 8);
+               dev_wlc_bufvar_set(dev, "btc_params",
+                       (char *)&buf_reg51va_dhcp_on[0], 8);
+               dev_wlc_bufvar_set(dev, "btc_params",
+                       (char *)&buf_reg64va_dhcp_on[0], 8);
+               dev_wlc_bufvar_set(dev, "btc_params",
+                       (char *)&buf_reg65va_dhcp_on[0], 8);
+               dev_wlc_bufvar_set(dev, "btc_params",
+                       (char *)&buf_reg71va_dhcp_on[0], 8);
+
+               saved_status = TRUE;
+       } else if (saved_status) {
+               /* restore previously saved bt params */
+               WL_TRACE(("Do new SCO/eSCO coex algo {save &"
+                         "override}\n"));
+
+               regaddr = 50;
+               dev_wlc_intvar_set_reg(dev, "btc_params",
+                       (char *)&regaddr, (char *)&saved_reg50);
+               regaddr = 51;
+               dev_wlc_intvar_set_reg(dev, "btc_params",
+                       (char *)&regaddr, (char *)&saved_reg51);
+               regaddr = 64;
+               dev_wlc_intvar_set_reg(dev, "btc_params",
+                       (char *)&regaddr, (char *)&saved_reg64);
+               regaddr = 65;
+               dev_wlc_intvar_set_reg(dev, "btc_params",
+                       (char *)&regaddr, (char *)&saved_reg65);
+               regaddr = 71;
+               dev_wlc_intvar_set_reg(dev, "btc_params",
+                       (char *)&regaddr, (char *)&saved_reg71);
+
+               WL_TRACE(("restore bt_params[50,51,64,65,71]:"
+                       "0x%x 0x%x 0x%x 0x%x 0x%x\n",
+                       saved_reg50, saved_reg51, saved_reg64,
+                       saved_reg65, saved_reg71));
+
+               saved_status = FALSE;
+       } else {
+               WL_ERR((":%s att to restore not saved BTCOEX params\n",
+                       __FUNCTION__));
+               return -1;
+       }
+       return 0;
+}
+#endif /* BT_DHCP_eSCO_FIX */
+
+static void
+wl_cfg80211_bt_setflag(struct net_device *dev, bool set)
+{
+#if defined(BT_DHCP_USE_FLAGS)
+       char buf_flag7_dhcp_on[8] = { 7, 00, 00, 00, 0x1, 0x0, 0x00, 0x00 };
+       char buf_flag7_default[8]   = { 7, 00, 00, 00, 0x0, 0x00, 0x00, 0x00};
+#endif
+
+#if defined(BT_DHCP_eSCO_FIX)
+       /*  ANREY: New Yury's eSco pacifier */
+       /* set = 1, save & turn on  0 - off & restore prev settings */
+       set_btc_esco_params(dev, set);
+#endif
+
+#if defined(BT_DHCP_USE_FLAGS)
+/*  ANdrey: old WI-FI priority boost via flags   */
+       WL_TRACE(("WI-FI priority boost via bt flags, set:%d\n", set));
+       if (set == TRUE)
+               /* Forcing bt_flag7  */
+               dev_wlc_bufvar_set(dev, "btc_flags",
+                       (char *)&buf_flag7_dhcp_on[0],
+                       sizeof(buf_flag7_dhcp_on));
+       else
+               /* Restoring default bt flag7 */
+               dev_wlc_bufvar_set(dev, "btc_flags",
+                       (char *)&buf_flag7_default[0],
+                       sizeof(buf_flag7_default));
+#endif
+}
+
+static void wl_cfg80211_bt_timerfunc(ulong data)
+{
+       struct btcoex_info *bt_local = (struct btcoex_info *)data;
+       WL_TRACE(("Enter\n"));
+       bt_local->timer_on = 0;
+       schedule_work(&bt_local->work);
+}
+
+static void wl_cfg80211_bt_handler(struct work_struct *work)
+{
+       struct btcoex_info *btcx_inf;
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       btcx_inf = container_of(work, struct btcoex_info, work);
+       GCC_DIAGNOSTIC_POP();
+
+       if (btcx_inf->timer_on) {
+               btcx_inf->timer_on = 0;
+               del_timer_sync(&btcx_inf->timer);
+       }
+
+       switch (btcx_inf->bt_state) {
+               case BT_DHCP_START:
+                       /* DHCP started
+                        * provide OPPORTUNITY window to get DHCP address
+                        */
+                       WL_TRACE(("bt_dhcp stm: started \n"));
+
+                       btcx_inf->bt_state = BT_DHCP_OPPR_WIN;
+                       mod_timer(&btcx_inf->timer,
+                               jiffies + msecs_to_jiffies(BT_DHCP_OPPR_WIN_TIME));
+                       btcx_inf->timer_on = 1;
+                       break;
+
+               case BT_DHCP_OPPR_WIN:
+                       if (btcx_inf->dhcp_done) {
+                               WL_TRACE(("DHCP Done before T1 expiration\n"));
+                               goto btc_coex_idle;
+                       }
+
+                       /* DHCP is not over yet, start lowering BT priority
+                        * enforce btc_params + flags if necessary
+                        */
+                       WL_TRACE(("DHCP T1:%d expired\n", BT_DHCP_OPPR_WIN_TIME));
+                       if (btcx_inf->dev)
+                               wl_cfg80211_bt_setflag(btcx_inf->dev, TRUE);
+                       btcx_inf->bt_state = BT_DHCP_FLAG_FORCE_TIMEOUT;
+                       mod_timer(&btcx_inf->timer,
+                               jiffies + msecs_to_jiffies(BT_DHCP_FLAG_FORCE_TIME));
+                       btcx_inf->timer_on = 1;
+                       break;
+
+               case BT_DHCP_FLAG_FORCE_TIMEOUT:
+                       if (btcx_inf->dhcp_done) {
+                               WL_TRACE(("DHCP Done before T2 expiration\n"));
+                       } else {
+                               /* Noo dhcp during T1+T2, restore BT priority */
+                               WL_TRACE(("DHCP wait interval T2:%d msec expired\n",
+                                       BT_DHCP_FLAG_FORCE_TIME));
+                       }
+
+                       /* Restoring default bt priority */
+                       if (btcx_inf->dev)
+                               wl_cfg80211_bt_setflag(btcx_inf->dev, FALSE);
+btc_coex_idle:
+                       btcx_inf->bt_state = BT_DHCP_IDLE;
+                       btcx_inf->timer_on = 0;
+                       break;
+
+               default:
+                       WL_ERR(("error g_status=%d !!!\n",      btcx_inf->bt_state));
+                       if (btcx_inf->dev)
+                               wl_cfg80211_bt_setflag(btcx_inf->dev, FALSE);
+                       btcx_inf->bt_state = BT_DHCP_IDLE;
+                       btcx_inf->timer_on = 0;
+                       break;
+       }
+
+       /* why we need this? */
+       net_os_wake_unlock(btcx_inf->dev);
+}
+
+void* wl_cfg80211_btcoex_init(struct net_device *ndev)
+{
+       struct btcoex_info *btco_inf = NULL;
+
+       btco_inf = kmalloc(sizeof(struct btcoex_info), GFP_KERNEL);
+       if (!btco_inf)
+               return NULL;
+
+       btco_inf->bt_state = BT_DHCP_IDLE;
+       btco_inf->ts_dhcp_start = 0;
+       btco_inf->ts_dhcp_ok = 0;
+       /* Set up timer for BT  */
+       btco_inf->timer_ms = 10;
+       init_timer_compat(&btco_inf->timer, wl_cfg80211_bt_timerfunc, btco_inf);
+
+       btco_inf->dev = ndev;
+
+       INIT_WORK(&btco_inf->work, wl_cfg80211_bt_handler);
+
+       btcoex_info_loc = btco_inf;
+       return btco_inf;
+}
+
+void wl_cfg80211_btcoex_deinit()
+{
+       if (!btcoex_info_loc)
+               return;
+
+       if (btcoex_info_loc->timer_on) {
+               btcoex_info_loc->timer_on = 0;
+               del_timer_sync(&btcoex_info_loc->timer);
+       }
+
+       cancel_work_sync(&btcoex_info_loc->work);
+
+       kfree(btcoex_info_loc);
+}
+
+int wl_cfg80211_set_btcoex_dhcp(struct net_device *dev, dhd_pub_t *dhd, char *command)
+{
+
+       struct btcoex_info *btco_inf = btcoex_info_loc;
+       char powermode_val = 0;
+       uint8 cmd_len = 0;
+       char buf_reg66va_dhcp_on[8] = { 66, 00, 00, 00, 0x10, 0x27, 0x00, 0x00 };
+       char buf_reg41va_dhcp_on[8] = { 41, 00, 00, 00, 0x33, 0x00, 0x00, 0x00 };
+       char buf_reg68va_dhcp_on[8] = { 68, 00, 00, 00, 0x90, 0x01, 0x00, 0x00 };
+
+       uint32 regaddr;
+       static uint32 saved_reg66;
+       static uint32 saved_reg41;
+       static uint32 saved_reg68;
+       static bool saved_status = FALSE;
+
+       char buf_flag7_default[8] =   { 7, 00, 00, 00, 0x0, 0x00, 0x00, 0x00};
+
+       /* Figure out powermode 1 or o command */
+       cmd_len = sizeof(BTCOEXMODE);
+       powermode_val = command[cmd_len];
+
+       WL_INFORM_MEM(("BTCOEX MODE: %c\n", powermode_val));
+       if (powermode_val == '1') {
+               WL_TRACE_HW4(("DHCP session starts\n"));
+
+#ifdef PKT_FILTER_SUPPORT
+               dhd->dhcp_in_progress = 1;
+
+#if defined(APSTA_BLOCK_ARP_DURING_DHCP)
+               if (DHD_OPMODE_STA_SOFTAP_CONCURR(dhd)) {
+                       /* Block ARP frames while DHCP of STA interface is in
+                        * progress in case of STA/SoftAP concurrent mode
+                        */
+                       wl_cfg80211_block_arp(dev, TRUE);
+               } else
+#endif /* APSTA_BLOCK_ARP_DURING_DHCP */
+               if (dhd->early_suspended) {
+                       WL_TRACE_HW4(("DHCP in progressing , disable packet filter!!!\n"));
+                       dhd_enable_packet_filter(0, dhd);
+               }
+#endif /* PKT_FILTER_SUPPORT */
+
+               /* Retrieve and saved orig regs value */
+               if ((saved_status == FALSE) &&
+                       (!dev_wlc_intvar_get_reg(dev, "btc_params", 66,  &saved_reg66)) &&
+                       (!dev_wlc_intvar_get_reg(dev, "btc_params", 41,  &saved_reg41)) &&
+                       (!dev_wlc_intvar_get_reg(dev, "btc_params", 68,  &saved_reg68)))   {
+                               saved_status = TRUE;
+                               WL_TRACE(("Saved 0x%x 0x%x 0x%x\n",
+                                       saved_reg66, saved_reg41, saved_reg68));
+
+                               /* Disable PM mode during dhpc session */
+
+                               /* Disable PM mode during dhpc session */
+                               /* Start  BT timer only for SCO connection */
+                               if (btcoex_is_sco_active(dev)) {
+                                       /* btc_params 66 */
+                                       dev_wlc_bufvar_set(dev, "btc_params",
+                                               (char *)&buf_reg66va_dhcp_on[0],
+                                               sizeof(buf_reg66va_dhcp_on));
+                                       /* btc_params 41 0x33 */
+                                       dev_wlc_bufvar_set(dev, "btc_params",
+                                               (char *)&buf_reg41va_dhcp_on[0],
+                                               sizeof(buf_reg41va_dhcp_on));
+                                       /* btc_params 68 0x190 */
+                                       dev_wlc_bufvar_set(dev, "btc_params",
+                                               (char *)&buf_reg68va_dhcp_on[0],
+                                               sizeof(buf_reg68va_dhcp_on));
+                                       saved_status = TRUE;
+
+                                       btco_inf->bt_state = BT_DHCP_START;
+                                       btco_inf->timer_on = 1;
+                                       mod_timer(&btco_inf->timer,
+                                               timer_expires(&btco_inf->timer));
+                                       WL_TRACE(("enable BT DHCP Timer\n"));
+                               }
+               }
+               else if (saved_status == TRUE) {
+                       WL_ERR(("was called w/o DHCP OFF. Continue\n"));
+               }
+       }
+       else if (powermode_val == '2') {
+
+#ifdef PKT_FILTER_SUPPORT
+               dhd->dhcp_in_progress = 0;
+               WL_TRACE_HW4(("DHCP is complete \n"));
+
+#if defined(APSTA_BLOCK_ARP_DURING_DHCP)
+               if (DHD_OPMODE_STA_SOFTAP_CONCURR(dhd)) {
+                       /* Unblock ARP frames */
+                       wl_cfg80211_block_arp(dev, FALSE);
+               } else
+#endif /* APSTA_BLOCK_ARP_DURING_DHCP */
+               if (dhd->early_suspended) {
+                       /* Enable packet filtering */
+                       WL_TRACE_HW4(("DHCP is complete , enable packet filter!!!\n"));
+                       dhd_enable_packet_filter(1, dhd);
+               }
+#endif /* PKT_FILTER_SUPPORT */
+
+               /* Restoring PM mode */
+
+               /* Stop any bt timer because DHCP session is done */
+               WL_TRACE(("disable BT DHCP Timer\n"));
+               if (btco_inf->timer_on) {
+                       btco_inf->timer_on = 0;
+                       del_timer_sync(&btco_inf->timer);
+
+                       if (btco_inf->bt_state != BT_DHCP_IDLE) {
+                       /* ANDREY: case when framework signals DHCP end before STM timeout */
+                       /* need to restore original btc flags & extra btc params */
+                               WL_TRACE(("bt->bt_state:%d\n", btco_inf->bt_state));
+                               /* wake up btcoex thread to restore btlags+params  */
+                               schedule_work(&btco_inf->work);
+                       }
+               }
+
+               /* Restoring btc_flag paramter anyway */
+               if (saved_status == TRUE)
+                       dev_wlc_bufvar_set(dev, "btc_flags",
+                               (char *)&buf_flag7_default[0], sizeof(buf_flag7_default));
+
+               /* Restore original values */
+               if (saved_status == TRUE) {
+                       regaddr = 66;
+                       dev_wlc_intvar_set_reg(dev, "btc_params",
+                               (char *)&regaddr, (char *)&saved_reg66);
+                       regaddr = 41;
+                       dev_wlc_intvar_set_reg(dev, "btc_params",
+                               (char *)&regaddr, (char *)&saved_reg41);
+                       regaddr = 68;
+                       dev_wlc_intvar_set_reg(dev, "btc_params",
+                               (char *)&regaddr, (char *)&saved_reg68);
+
+                       WL_TRACE(("restore regs {66,41,68} <- 0x%x 0x%x 0x%x\n",
+                               saved_reg66, saved_reg41, saved_reg68));
+               }
+               saved_status = FALSE;
+
+       }
+       else {
+               WL_ERR(("Unknown yet power setting, ignored\n"));
+       }
+       return 0;
+}
diff --git a/bcmdhd.101.10.240.x/wl_cfgnan.c b/bcmdhd.101.10.240.x/wl_cfgnan.c
new file mode 100644 (file)
index 0000000..11db4b5
--- /dev/null
@@ -0,0 +1,9087 @@
+/*
+ * Neighbor Awareness Networking
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifdef WL_NAN
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmwifi_channels.h>
+#include <nan.h>
+#include <bcmiov.h>
+#include <net/rtnetlink.h>
+
+#include <wl_cfg80211.h>
+#include <wl_cfgscan.h>
+#include <wl_android.h>
+#include <wl_cfgnan.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <wl_cfgvendor.h>
+#include <bcmbloom.h>
+#include <wl_cfgp2p.h>
+#ifdef RTT_SUPPORT
+#include <dhd_rtt.h>
+#endif /* RTT_SUPPORT */
+#include <bcmstdlib_s.h>
+
+#define NAN_RANGE_REQ_EVNT 1
+#define NAN_RAND_MAC_RETRIES 10
+#define NAN_SCAN_DWELL_TIME_DELTA_MS 10
+
+#ifdef WL_NAN_DISC_CACHE
+/* Disc Cache Parameters update Flags */
+#define NAN_DISC_CACHE_PARAM_SDE_CONTROL       0x0001
+static int wl_cfgnan_cache_disc_result(struct bcm_cfg80211 *cfg, void * data,
+       u16 *disc_cache_update_flags);
+static int wl_cfgnan_remove_disc_result(struct bcm_cfg80211 * cfg, uint8 local_subid);
+static nan_disc_result_cache * wl_cfgnan_get_disc_result(struct bcm_cfg80211 *cfg,
+       uint8 remote_pubid, struct ether_addr *peer);
+#endif /* WL_NAN_DISC_CACHE */
+
+static int wl_cfgnan_set_if_addr(struct bcm_cfg80211 *cfg);
+static int wl_cfgnan_get_capability(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_hal_capabilities_t *capabilities);
+static void wl_cfgnan_clear_nan_event_data(struct bcm_cfg80211 *cfg,
+       nan_event_data_t *nan_event_data);
+void wl_cfgnan_data_remove_peer(struct bcm_cfg80211 *cfg,
+        struct ether_addr *peer_addr);
+static void wl_cfgnan_send_stop_event(struct bcm_cfg80211 *cfg);
+static void wl_cfgnan_disable_cleanup(struct bcm_cfg80211 *cfg);
+static s32 wl_cfgnan_get_ndi_idx(struct bcm_cfg80211 *cfg);
+static int wl_cfgnan_init(struct bcm_cfg80211 *cfg);
+static int wl_cfgnan_deinit(struct bcm_cfg80211 *cfg, uint8 busstate);
+static void wl_cfgnan_update_dp_info(struct bcm_cfg80211 *cfg, bool add,
+       nan_data_path_id ndp_id);
+static void wl_cfgnan_data_set_peer_dp_state(struct bcm_cfg80211 *cfg,
+       struct ether_addr *peer_addr, nan_peer_dp_state_t state);
+static nan_ndp_peer_t* wl_cfgnan_data_get_peer(struct bcm_cfg80211 *cfg,
+       struct ether_addr *peer_addr);
+static int wl_cfgnan_disable(struct bcm_cfg80211 *cfg);
+static s32 wl_cfgnan_del_ndi_data(struct bcm_cfg80211 *cfg, char *name);
+static s32 wl_cfgnan_add_ndi_data(struct bcm_cfg80211 *cfg, s32 idx, char *name);
+
+#ifdef RTT_SUPPORT
+static int wl_cfgnan_clear_disc_cache(struct bcm_cfg80211 *cfg, wl_nan_instance_id_t sub_id);
+static int32 wl_cfgnan_notify_disc_with_ranging(struct bcm_cfg80211 *cfg,
+       nan_ranging_inst_t *rng_inst, nan_event_data_t *nan_event_data, uint32 distance);
+static void wl_cfgnan_disc_result_on_geofence_cancel(struct bcm_cfg80211 *cfg,
+       nan_ranging_inst_t *rng_inst);
+static void wl_cfgnan_terminate_ranging_session(struct bcm_cfg80211 *cfg,
+       nan_ranging_inst_t *ranging_inst);
+static s32 wl_cfgnan_clear_peer_ranging(struct bcm_cfg80211 * cfg,
+       nan_ranging_inst_t *rng_inst, int reason);
+static s32 wl_cfgnan_handle_dp_ranging_concurrency(struct bcm_cfg80211 *cfg,
+       struct ether_addr *peer, int reason);
+static void wl_cfgnan_terminate_all_obsolete_ranging_sessions(struct bcm_cfg80211 *cfg);
+static bool wl_ranging_geofence_session_with_peer(struct bcm_cfg80211 *cfg,
+       struct ether_addr *peer_addr);
+static bool wl_cfgnan_update_geofence_target_idx(struct bcm_cfg80211 *cfg);
+static void wl_cfgnan_reset_remove_ranging_instance(struct bcm_cfg80211 *cfg,
+       nan_ranging_inst_t *ranging_inst);
+static void wl_cfgnan_remove_ranging_instance(struct bcm_cfg80211 *cfg,
+       nan_ranging_inst_t *ranging_inst);
+#endif /* RTT_SUPPORT */
+
+static const char *
+nan_role_to_str(u8 role)
+{
+       const char *id2str;
+
+       switch (role) {
+               C2S(WL_NAN_ROLE_AUTO);
+                       break;
+               C2S(WL_NAN_ROLE_NON_MASTER_NON_SYNC);
+                       break;
+               C2S(WL_NAN_ROLE_NON_MASTER_SYNC);
+                       break;
+               C2S(WL_NAN_ROLE_MASTER);
+                       break;
+               C2S(WL_NAN_ROLE_ANCHOR_MASTER);
+                       break;
+               default:
+                       id2str = "WL_NAN_ROLE_UNKNOWN";
+       }
+
+       return id2str;
+}
+
+static const char *
+nan_event_to_str(u16 cmd)
+{
+       const char *id2str;
+
+       switch (cmd) {
+       C2S(WL_NAN_EVENT_START);
+               break;
+       C2S(WL_NAN_EVENT_DISCOVERY_RESULT);
+               break;
+       C2S(WL_NAN_EVENT_TERMINATED);
+               break;
+       C2S(WL_NAN_EVENT_RECEIVE);
+               break;
+       C2S(WL_NAN_EVENT_MERGE);
+               break;
+       C2S(WL_NAN_EVENT_STOP);
+               break;
+       C2S(WL_NAN_EVENT_PEER_DATAPATH_IND);
+               break;
+       C2S(WL_NAN_EVENT_DATAPATH_ESTB);
+               break;
+       C2S(WL_NAN_EVENT_SDF_RX);
+               break;
+       C2S(WL_NAN_EVENT_DATAPATH_END);
+               break;
+       C2S(WL_NAN_EVENT_PEER_DATAPATH_RESP);
+               break;
+       C2S(WL_NAN_EVENT_PEER_DATAPATH_CONF);
+               break;
+       C2S(WL_NAN_EVENT_PEER_DATAPATH_SEC_INST);
+               break;
+       C2S(WL_NAN_EVENT_RNG_REQ_IND);
+               break;
+       C2S(WL_NAN_EVENT_RNG_RPT_IND);
+               break;
+       C2S(WL_NAN_EVENT_RNG_TERM_IND);
+               break;
+       C2S(WL_NAN_EVENT_TXS);
+               break;
+       C2S(WL_NAN_EVENT_INVALID);
+               break;
+
+       default:
+               id2str = "WL_NAN_EVENT_UNKNOWN";
+       }
+
+       return id2str;
+}
+
+static const char *
+nan_frm_type_to_str(u16 frm_type)
+{
+       const char *id2str;
+
+       switch (frm_type) {
+       C2S(WL_NAN_FRM_TYPE_PUBLISH);
+               break;
+       C2S(WL_NAN_FRM_TYPE_SUBSCRIBE);
+               break;
+       C2S(WL_NAN_FRM_TYPE_FOLLOWUP);
+               break;
+
+       C2S(WL_NAN_FRM_TYPE_DP_REQ);
+               break;
+       C2S(WL_NAN_FRM_TYPE_DP_RESP);
+               break;
+       C2S(WL_NAN_FRM_TYPE_DP_CONF);
+               break;
+       C2S(WL_NAN_FRM_TYPE_DP_INSTALL);
+               break;
+       C2S(WL_NAN_FRM_TYPE_DP_END);
+               break;
+
+       C2S(WL_NAN_FRM_TYPE_SCHED_REQ);
+               break;
+       C2S(WL_NAN_FRM_TYPE_SCHED_RESP);
+               break;
+       C2S(WL_NAN_FRM_TYPE_SCHED_CONF);
+               break;
+       C2S(WL_NAN_FRM_TYPE_SCHED_UPD);
+               break;
+
+       C2S(WL_NAN_FRM_TYPE_RNG_REQ);
+               break;
+       C2S(WL_NAN_FRM_TYPE_RNG_RESP);
+               break;
+       C2S(WL_NAN_FRM_TYPE_RNG_TERM);
+               break;
+       C2S(WL_NAN_FRM_TYPE_RNG_REPORT);
+               break;
+
+       default:
+               id2str = "WL_NAN_FRM_TYPE_UNKNOWN";
+       }
+
+       return id2str;
+}
+
+static const char *
+nan_event_cause_to_str(u8 cause)
+{
+       const char *id2str;
+
+       switch (cause) {
+       C2S(WL_NAN_DP_TERM_WITH_INACTIVITY);
+               break;
+       C2S(WL_NAN_DP_TERM_WITH_FSM_DESTROY);
+               break;
+       C2S(WL_NAN_DP_TERM_WITH_PEER_DP_END);
+               break;
+       C2S(WL_NAN_DP_TERM_WITH_STALE_NDP);
+               break;
+       C2S(WL_NAN_DP_TERM_WITH_DISABLE);
+               break;
+       C2S(WL_NAN_DP_TERM_WITH_NDI_DEL);
+               break;
+       C2S(WL_NAN_DP_TERM_WITH_PEER_HB_FAIL);
+               break;
+       C2S(WL_NAN_DP_TERM_WITH_HOST_IOVAR);
+               break;
+       C2S(WL_NAN_DP_TERM_WITH_ESTB_FAIL);
+               break;
+       C2S(WL_NAN_DP_TERM_WITH_SCHED_REJECT);
+               break;
+
+       default:
+               id2str = "WL_NAN_EVENT_CAUSE_UNKNOWN";
+       }
+
+       return id2str;
+}
+
+static int wl_cfgnan_execute_ioctl(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, bcm_iov_batch_buf_t *nan_buf,
+       uint16 nan_buf_size, uint32 *status, uint8 *resp_buf,
+       uint16 resp_buf_len);
+int
+wl_cfgnan_generate_inst_id(struct bcm_cfg80211 *cfg, uint8 *p_inst_id)
+{
+       s32 ret = BCME_OK;
+       uint8 i = 0;
+       wl_nancfg_t *nancfg = cfg->nancfg;
+
+       if (p_inst_id == NULL) {
+               WL_ERR(("Invalid arguments\n"));
+               ret = -EINVAL;
+               goto exit;
+       }
+
+       if (nancfg->inst_id_start == NAN_ID_MAX) {
+               WL_ERR(("Consumed all IDs, resetting the counter\n"));
+               nancfg->inst_id_start = 0;
+       }
+
+       for (i = nancfg->inst_id_start; i < NAN_ID_MAX; i++) {
+               if (isclr(nancfg->svc_inst_id_mask, i)) {
+                       setbit(nancfg->svc_inst_id_mask, i);
+                       *p_inst_id = i + 1;
+                       nancfg->inst_id_start = *p_inst_id;
+                       WL_DBG(("Instance ID=%d\n", *p_inst_id));
+                       goto exit;
+               }
+       }
+       WL_ERR(("Allocated maximum IDs\n"));
+       ret = BCME_NORESOURCE;
+exit:
+       return ret;
+}
+
+int
+wl_cfgnan_remove_inst_id(struct bcm_cfg80211 *cfg, uint8 inst_id)
+{
+       s32 ret = BCME_OK;
+       WL_DBG(("%s: Removing svc instance id %d\n", __FUNCTION__, inst_id));
+       clrbit(cfg->nancfg->svc_inst_id_mask, inst_id-1);
+       return ret;
+}
+s32 wl_cfgnan_parse_sdea_data(osl_t *osh, const uint8 *p_attr,
+               uint16 len, nan_event_data_t *tlv_data)
+{
+       const wifi_nan_svc_desc_ext_attr_t *nan_svc_desc_ext_attr = NULL;
+       uint8 offset;
+       s32 ret = BCME_OK;
+
+       /* service descriptor ext attributes */
+       nan_svc_desc_ext_attr = (const wifi_nan_svc_desc_ext_attr_t *)p_attr;
+
+       /* attribute ID */
+       WL_TRACE(("> attr id: 0x%02x\n", nan_svc_desc_ext_attr->id));
+
+       /* attribute length */
+       WL_TRACE(("> attr len: 0x%x\n", nan_svc_desc_ext_attr->len));
+       if (nan_svc_desc_ext_attr->instance_id == tlv_data->pub_id) {
+               tlv_data->sde_control_flag = nan_svc_desc_ext_attr->control;
+       }
+       offset = sizeof(*nan_svc_desc_ext_attr);
+       if (offset > len) {
+               WL_ERR(("Invalid event buffer len\n"));
+               ret = BCME_BUFTOOSHORT;
+               goto fail;
+       }
+       p_attr += offset;
+       len -= offset;
+
+       if (tlv_data->sde_control_flag & NAN_SC_RANGE_LIMITED) {
+               WL_TRACE(("> svc_control: range limited present\n"));
+       }
+       if (tlv_data->sde_control_flag & NAN_SDE_CF_SVC_UPD_IND_PRESENT) {
+               WL_TRACE(("> svc_control: sdea svc specific info present\n"));
+               tlv_data->sde_svc_info.dlen = (p_attr[1] | (p_attr[2] << 8));
+               WL_TRACE(("> sdea svc info len: 0x%02x\n", tlv_data->sde_svc_info.dlen));
+               if (!tlv_data->sde_svc_info.dlen ||
+                               tlv_data->sde_svc_info.dlen > NAN_MAX_SERVICE_SPECIFIC_INFO_LEN) {
+                       /* must be able to handle null msg which is not error */
+                       tlv_data->sde_svc_info.dlen = 0;
+                       WL_ERR(("sde data length is invalid\n"));
+                       ret = BCME_BADLEN;
+                       goto fail;
+               }
+
+               if (tlv_data->sde_svc_info.dlen > 0) {
+                       tlv_data->sde_svc_info.data = MALLOCZ(osh, tlv_data->sde_svc_info.dlen);
+                       if (!tlv_data->sde_svc_info.data) {
+                               WL_ERR(("%s: memory allocation failed\n", __FUNCTION__));
+                               tlv_data->sde_svc_info.dlen = 0;
+                               ret = BCME_NOMEM;
+                               goto fail;
+                       }
+                       /* advance read pointer, consider sizeof of Service Update Indicator */
+                       offset = sizeof(tlv_data->sde_svc_info.dlen) - 1;
+                       if (offset > len) {
+                               WL_ERR(("Invalid event buffer len\n"));
+                               ret = BCME_BUFTOOSHORT;
+                               goto fail;
+                       }
+                       p_attr += offset;
+                       len -= offset;
+                       ret = memcpy_s(tlv_data->sde_svc_info.data, tlv_data->sde_svc_info.dlen,
+                               p_attr, tlv_data->sde_svc_info.dlen);
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy sde_svc_info\n"));
+                               goto fail;
+                       }
+               } else {
+                       /* must be able to handle null msg which is not error */
+                       tlv_data->sde_svc_info.dlen = 0;
+                       WL_DBG(("%s: sdea svc info length is zero, null info data\n",
+                               __FUNCTION__));
+               }
+       }
+       return ret;
+fail:
+       if (tlv_data->sde_svc_info.data) {
+               MFREE(osh, tlv_data->sde_svc_info.data,
+                               tlv_data->sde_svc_info.dlen);
+               tlv_data->sde_svc_info.data = NULL;
+       }
+
+       WL_DBG(("Parse SDEA event data, status = %d\n", ret));
+       return ret;
+}
+
+/*
+ * This attribute contains some mandatory fields and some optional fields
+ * depending on the content of the service discovery request.
+ */
+s32
+wl_cfgnan_parse_sda_data(osl_t *osh, const uint8 *p_attr,
+               uint16 len, nan_event_data_t *tlv_data)
+{
+       uint8 svc_control = 0, offset = 0;
+       s32 ret = BCME_OK;
+       const wifi_nan_svc_descriptor_attr_t *nan_svc_desc_attr = NULL;
+
+       /* service descriptor attributes */
+       nan_svc_desc_attr = (const wifi_nan_svc_descriptor_attr_t *)p_attr;
+       /* attribute ID */
+       WL_TRACE(("> attr id: 0x%02x\n", nan_svc_desc_attr->id));
+
+       /* attribute length */
+       WL_TRACE(("> attr len: 0x%x\n", nan_svc_desc_attr->len));
+
+       /* service ID */
+       ret = memcpy_s(tlv_data->svc_name, sizeof(tlv_data->svc_name),
+               nan_svc_desc_attr->svc_hash, NAN_SVC_HASH_LEN);
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to copy svc_hash_name:\n"));
+               return ret;
+       }
+       WL_TRACE(("> svc_hash_name: " MACDBG "\n", MAC2STRDBG(tlv_data->svc_name)));
+
+       /* local instance ID */
+       tlv_data->local_inst_id = nan_svc_desc_attr->instance_id;
+       WL_TRACE(("> local instance id: 0x%02x\n", tlv_data->local_inst_id));
+
+       /* requestor instance ID */
+       tlv_data->requestor_id = nan_svc_desc_attr->requestor_id;
+       WL_TRACE(("> requestor id: 0x%02x\n", tlv_data->requestor_id));
+
+       /* service control */
+       svc_control = nan_svc_desc_attr->svc_control;
+       if ((svc_control & NAN_SVC_CONTROL_TYPE_MASK) == NAN_SC_PUBLISH) {
+               WL_TRACE(("> Service control type: NAN_SC_PUBLISH\n"));
+       } else if ((svc_control & NAN_SVC_CONTROL_TYPE_MASK) == NAN_SC_SUBSCRIBE) {
+               WL_TRACE(("> Service control type: NAN_SC_SUBSCRIBE\n"));
+       } else if ((svc_control & NAN_SVC_CONTROL_TYPE_MASK) == NAN_SC_FOLLOWUP) {
+               WL_TRACE(("> Service control type: NAN_SC_FOLLOWUP\n"));
+       }
+       offset = sizeof(*nan_svc_desc_attr);
+       if (offset > len) {
+               WL_ERR(("Invalid event buffer len\n"));
+               ret = BCME_BUFTOOSHORT;
+               goto fail;
+       }
+       p_attr += offset;
+       len -= offset;
+
+       /*
+        * optional fields:
+        * must be in order following by service descriptor attribute format
+        */
+
+       /* binding bitmap */
+       if (svc_control & NAN_SC_BINDING_BITMAP_PRESENT) {
+               uint16 bitmap = 0;
+               WL_TRACE(("> svc_control: binding bitmap present\n"));
+
+               /* Copy binding bitmap */
+               ret = memcpy_s(&bitmap, sizeof(bitmap),
+                       p_attr, NAN_BINDING_BITMAP_LEN);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy bit map\n"));
+                       return ret;
+               }
+               WL_TRACE(("> sc binding bitmap: 0x%04x\n", bitmap));
+
+               if (NAN_BINDING_BITMAP_LEN > len) {
+                       WL_ERR(("Invalid event buffer len\n"));
+                       ret = BCME_BUFTOOSHORT;
+                       goto fail;
+               }
+               p_attr += NAN_BINDING_BITMAP_LEN;
+               len -= NAN_BINDING_BITMAP_LEN;
+       }
+
+       /* matching filter */
+       if (svc_control & NAN_SC_MATCHING_FILTER_PRESENT) {
+               WL_TRACE(("> svc_control: matching filter present\n"));
+
+               tlv_data->tx_match_filter.dlen = *p_attr++;
+               WL_TRACE(("> matching filter len: 0x%02x\n",
+                               tlv_data->tx_match_filter.dlen));
+
+               if (!tlv_data->tx_match_filter.dlen ||
+                               tlv_data->tx_match_filter.dlen > MAX_MATCH_FILTER_LEN) {
+                       tlv_data->tx_match_filter.dlen = 0;
+                       WL_ERR(("tx match filter length is invalid\n"));
+                       ret = -EINVAL;
+                       goto fail;
+               }
+               tlv_data->tx_match_filter.data =
+                       MALLOCZ(osh, tlv_data->tx_match_filter.dlen);
+               if (!tlv_data->tx_match_filter.data) {
+                       WL_ERR(("%s: memory allocation failed\n", __FUNCTION__));
+                       tlv_data->tx_match_filter.dlen = 0;
+                       ret = -ENOMEM;
+                       goto fail;
+               }
+               ret = memcpy_s(tlv_data->tx_match_filter.data, tlv_data->tx_match_filter.dlen,
+                               p_attr, tlv_data->tx_match_filter.dlen);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy tx match filter data\n"));
+                       goto fail;
+               }
+               /* advance read pointer */
+               offset = tlv_data->tx_match_filter.dlen;
+               if (offset > len) {
+                       WL_ERR(("Invalid event buffer\n"));
+                       ret = BCME_BUFTOOSHORT;
+                       goto fail;
+               }
+               p_attr += offset;
+               len -= offset;
+       }
+
+       /* service response filter */
+       if (svc_control & NAN_SC_SR_FILTER_PRESENT) {
+               WL_TRACE(("> svc_control: service response filter present\n"));
+
+               tlv_data->rx_match_filter.dlen = *p_attr++;
+               WL_TRACE(("> sr match filter len: 0x%02x\n",
+                               tlv_data->rx_match_filter.dlen));
+
+               if (!tlv_data->rx_match_filter.dlen ||
+                               tlv_data->rx_match_filter.dlen > MAX_MATCH_FILTER_LEN) {
+                       tlv_data->rx_match_filter.dlen = 0;
+                       WL_ERR(("%s: sr matching filter length is invalid\n",
+                                       __FUNCTION__));
+                       ret = BCME_BADLEN;
+                       goto fail;
+               }
+               tlv_data->rx_match_filter.data =
+                       MALLOCZ(osh, tlv_data->rx_match_filter.dlen);
+               if (!tlv_data->rx_match_filter.data) {
+                       WL_ERR(("%s: memory allocation failed\n", __FUNCTION__));
+                       tlv_data->rx_match_filter.dlen = 0;
+                       ret = BCME_NOMEM;
+                       goto fail;
+               }
+
+               ret = memcpy_s(tlv_data->rx_match_filter.data, tlv_data->rx_match_filter.dlen,
+                               p_attr, tlv_data->rx_match_filter.dlen);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy rx match filter data\n"));
+                       goto fail;
+               }
+
+               /* advance read pointer */
+               offset = tlv_data->rx_match_filter.dlen;
+               if (offset > len) {
+                       WL_ERR(("Invalid event buffer len\n"));
+                       ret = BCME_BUFTOOSHORT;
+                       goto fail;
+               }
+               p_attr += offset;
+               len -= offset;
+       }
+
+       /* service specific info */
+       if (svc_control & NAN_SC_SVC_INFO_PRESENT) {
+               WL_TRACE(("> svc_control: svc specific info present\n"));
+
+               tlv_data->svc_info.dlen = *p_attr++;
+               WL_TRACE(("> svc info len: 0x%02x\n", tlv_data->svc_info.dlen));
+
+               if (!tlv_data->svc_info.dlen ||
+                               tlv_data->svc_info.dlen > NAN_MAX_SERVICE_SPECIFIC_INFO_LEN) {
+                       /* must be able to handle null msg which is not error */
+                       tlv_data->svc_info.dlen = 0;
+                       WL_ERR(("sde data length is invalid\n"));
+                       ret = BCME_BADLEN;
+                       goto fail;
+               }
+
+               if (tlv_data->svc_info.dlen > 0) {
+                       tlv_data->svc_info.data =
+                               MALLOCZ(osh, tlv_data->svc_info.dlen);
+                       if (!tlv_data->svc_info.data) {
+                               WL_ERR(("%s: memory allocation failed\n", __FUNCTION__));
+                               tlv_data->svc_info.dlen = 0;
+                               ret = BCME_NOMEM;
+                               goto fail;
+                       }
+                       ret = memcpy_s(tlv_data->svc_info.data, tlv_data->svc_info.dlen,
+                                       p_attr, tlv_data->svc_info.dlen);
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy svc info\n"));
+                               goto fail;
+                       }
+
+                       /* advance read pointer */
+                       offset = tlv_data->svc_info.dlen;
+                       if (offset > len) {
+                               WL_ERR(("Invalid event buffer len\n"));
+                               ret = BCME_BUFTOOSHORT;
+                               goto fail;
+                       }
+                       p_attr += offset;
+                       len -= offset;
+               } else {
+                       /* must be able to handle null msg which is not error */
+                       tlv_data->svc_info.dlen = 0;
+                       WL_TRACE(("%s: svc info length is zero, null info data\n",
+                                       __FUNCTION__));
+               }
+       }
+
+       /*
+        * discovery range limited:
+        * If set to 1, the pub/sub msg is limited in range to close proximity.
+        * If set to 0, the pub/sub msg is not limited in range.
+        * Valid only when the message is either of a publish or a sub.
+        */
+       if (svc_control & NAN_SC_RANGE_LIMITED) {
+               if (((svc_control & NAN_SVC_CONTROL_TYPE_MASK) == NAN_SC_PUBLISH) ||
+                               ((svc_control & NAN_SVC_CONTROL_TYPE_MASK) == NAN_SC_SUBSCRIBE)) {
+                       WL_TRACE(("> svc_control: range limited present\n"));
+               } else {
+                       WL_TRACE(("range limited is only valid on pub or sub\n"));
+               }
+
+               /* TODO: send up */
+
+               /* advance read pointer */
+               p_attr++;
+       }
+       return ret;
+fail:
+       if (tlv_data->tx_match_filter.data) {
+               MFREE(osh, tlv_data->tx_match_filter.data,
+                               tlv_data->tx_match_filter.dlen);
+               tlv_data->tx_match_filter.data = NULL;
+       }
+       if (tlv_data->rx_match_filter.data) {
+               MFREE(osh, tlv_data->rx_match_filter.data,
+                               tlv_data->rx_match_filter.dlen);
+               tlv_data->rx_match_filter.data = NULL;
+       }
+       if (tlv_data->svc_info.data) {
+               MFREE(osh, tlv_data->svc_info.data,
+                               tlv_data->svc_info.dlen);
+               tlv_data->svc_info.data = NULL;
+       }
+
+       WL_DBG(("Parse SDA event data, status = %d\n", ret));
+       return ret;
+}
+
+static s32
+wl_cfgnan_parse_sd_attr_data(osl_t *osh, uint16 len, const uint8 *data,
+       nan_event_data_t *tlv_data, uint16 type) {
+       const uint8 *p_attr = data;
+       uint16 offset = 0;
+       s32 ret = BCME_OK;
+       const wl_nan_event_disc_result_t *ev_disc = NULL;
+       const wl_nan_event_replied_t *ev_replied = NULL;
+       const wl_nan_ev_receive_t *ev_fup = NULL;
+
+       /*
+        * Mapping wifi_nan_svc_descriptor_attr_t, and svc controls are optional.
+        */
+       if (type == WL_NAN_XTLV_SD_DISC_RESULTS) {
+               u8 iter;
+               ev_disc = (const wl_nan_event_disc_result_t *)p_attr;
+
+               WL_DBG((">> WL_NAN_XTLV_RESULTS: Discovery result\n"));
+
+               tlv_data->pub_id = (wl_nan_instance_id_t)ev_disc->pub_id;
+               tlv_data->sub_id = (wl_nan_instance_id_t)ev_disc->sub_id;
+               tlv_data->publish_rssi = ev_disc->publish_rssi;
+               ret = memcpy_s(&tlv_data->remote_nmi, ETHER_ADDR_LEN,
+                               &ev_disc->pub_mac, ETHER_ADDR_LEN);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy remote nmi\n"));
+                       goto fail;
+               }
+
+               WL_TRACE(("publish id: %d\n", ev_disc->pub_id));
+               WL_TRACE(("subscribe d: %d\n", ev_disc->sub_id));
+               WL_TRACE(("publish mac addr: " MACDBG "\n",
+                               MAC2STRDBG(ev_disc->pub_mac.octet)));
+               WL_TRACE(("publish rssi: %d\n", (int8)ev_disc->publish_rssi));
+               WL_TRACE(("attribute no: %d\n", ev_disc->attr_num));
+               WL_TRACE(("attribute len: %d\n", (uint16)ev_disc->attr_list_len));
+
+               /* advance to the service descricptor */
+               offset = OFFSETOF(wl_nan_event_disc_result_t, attr_list[0]);
+               if (offset > len) {
+                       WL_ERR(("Invalid event buffer len\n"));
+                       ret = BCME_BUFTOOSHORT;
+                       goto fail;
+               }
+               p_attr += offset;
+               len -= offset;
+
+               iter = ev_disc->attr_num;
+               while (iter) {
+                       if ((uint8)*p_attr == NAN_ATTR_SVC_DESCRIPTOR) {
+                               WL_TRACE(("> attr id: 0x%02x\n", (uint8)*p_attr));
+                               ret = wl_cfgnan_parse_sda_data(osh, p_attr, len, tlv_data);
+                               if (unlikely(ret)) {
+                                       WL_ERR(("wl_cfgnan_parse_sda_data failed,"
+                                                       "error = %d \n", ret));
+                                       goto fail;
+                               }
+                       }
+
+                       if ((uint8)*p_attr == NAN_ATTR_SVC_DESC_EXTENSION) {
+                               WL_TRACE(("> attr id: 0x%02x\n", (uint8)*p_attr));
+                               ret = wl_cfgnan_parse_sdea_data(osh, p_attr, len, tlv_data);
+                               if (unlikely(ret)) {
+                                       WL_ERR(("wl_cfgnan_parse_sdea_data failed,"
+                                                       "error = %d \n", ret));
+                                       goto fail;
+                               }
+                       }
+                       offset = (sizeof(*p_attr) +
+                                       sizeof(ev_disc->attr_list_len) +
+                                       (p_attr[1] | (p_attr[2] << 8)));
+                       if (offset > len) {
+                               WL_ERR(("Invalid event buffer len\n"));
+                               ret = BCME_BUFTOOSHORT;
+                               goto fail;
+                       }
+                       p_attr += offset;
+                       len -= offset;
+                       iter--;
+               }
+       } else if (type == WL_NAN_XTLV_SD_FUP_RECEIVED) {
+               uint8 iter;
+               ev_fup = (const wl_nan_ev_receive_t *)p_attr;
+
+               WL_TRACE((">> WL_NAN_XTLV_SD_FUP_RECEIVED: Transmit follow-up\n"));
+
+               tlv_data->local_inst_id = (wl_nan_instance_id_t)ev_fup->local_id;
+               tlv_data->requestor_id = (wl_nan_instance_id_t)ev_fup->remote_id;
+               tlv_data->fup_rssi = ev_fup->fup_rssi;
+               ret = memcpy_s(&tlv_data->remote_nmi, ETHER_ADDR_LEN,
+                               &ev_fup->remote_addr, ETHER_ADDR_LEN);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy remote nmi\n"));
+                       goto fail;
+               }
+
+               WL_TRACE(("local id: %d\n", ev_fup->local_id));
+               WL_TRACE(("remote id: %d\n", ev_fup->remote_id));
+               WL_TRACE(("peer mac addr: " MACDBG "\n",
+                               MAC2STRDBG(ev_fup->remote_addr.octet)));
+               WL_TRACE(("peer rssi: %d\n", (int8)ev_fup->fup_rssi));
+               WL_TRACE(("attribute no: %d\n", ev_fup->attr_num));
+               WL_TRACE(("attribute len: %d\n", ev_fup->attr_list_len));
+
+               /* advance to the service descriptor which is attr_list[0] */
+               offset = OFFSETOF(wl_nan_ev_receive_t, attr_list[0]);
+               if (offset > len) {
+                       WL_ERR(("Invalid event buffer len\n"));
+                       ret = BCME_BUFTOOSHORT;
+                       goto fail;
+               }
+               p_attr += offset;
+               len -= offset;
+
+               iter = ev_fup->attr_num;
+               while (iter) {
+                       if ((uint8)*p_attr == NAN_ATTR_SVC_DESCRIPTOR) {
+                               WL_TRACE(("> attr id: 0x%02x\n", (uint8)*p_attr));
+                               ret = wl_cfgnan_parse_sda_data(osh, p_attr, len, tlv_data);
+                               if (unlikely(ret)) {
+                                       WL_ERR(("wl_cfgnan_parse_sda_data failed,"
+                                                       "error = %d \n", ret));
+                                       goto fail;
+                               }
+                       }
+
+                       if ((uint8)*p_attr == NAN_ATTR_SVC_DESC_EXTENSION) {
+                               WL_TRACE(("> attr id: 0x%02x\n", (uint8)*p_attr));
+                               ret = wl_cfgnan_parse_sdea_data(osh, p_attr, len, tlv_data);
+                               if (unlikely(ret)) {
+                                       WL_ERR(("wl_cfgnan_parse_sdea_data failed,"
+                                                       "error = %d \n", ret));
+                                       goto fail;
+                               }
+                       }
+                       offset = (sizeof(*p_attr) +
+                                       sizeof(ev_fup->attr_list_len) +
+                                       (p_attr[1] | (p_attr[2] << 8)));
+                       if (offset > len) {
+                               WL_ERR(("Invalid event buffer len\n"));
+                               ret = BCME_BUFTOOSHORT;
+                               goto fail;
+                       }
+                       p_attr += offset;
+                       len -= offset;
+                       iter--;
+               }
+       } else if (type == WL_NAN_XTLV_SD_SDF_RX) {
+               /*
+                * SDF followed by nan2_pub_act_frame_t and wifi_nan_svc_descriptor_attr_t,
+                * and svc controls are optional.
+                */
+               const nan2_pub_act_frame_t *nan_pub_af =
+                       (const nan2_pub_act_frame_t *)p_attr;
+
+               WL_TRACE((">> WL_NAN_XTLV_SD_SDF_RX\n"));
+
+               /* nan2_pub_act_frame_t */
+               WL_TRACE(("pub category: 0x%02x\n", nan_pub_af->category_id));
+               WL_TRACE(("pub action: 0x%02x\n", nan_pub_af->action_field));
+               WL_TRACE(("nan oui: %2x-%2x-%2x\n",
+                               nan_pub_af->oui[0], nan_pub_af->oui[1], nan_pub_af->oui[2]));
+               WL_TRACE(("oui type: 0x%02x\n", nan_pub_af->oui_type));
+               WL_TRACE(("oui subtype: 0x%02x\n", nan_pub_af->oui_sub_type));
+
+               offset = sizeof(*nan_pub_af);
+               if (offset > len) {
+                       WL_ERR(("Invalid event buffer len\n"));
+                       ret = BCME_BUFTOOSHORT;
+                       goto fail;
+               }
+               p_attr += offset;
+               len -= offset;
+       } else if (type == WL_NAN_XTLV_SD_REPLIED) {
+               ev_replied = (const wl_nan_event_replied_t *)p_attr;
+
+               WL_TRACE((">> WL_NAN_XTLV_SD_REPLIED: Replied Event\n"));
+
+               tlv_data->pub_id = (wl_nan_instance_id_t)ev_replied->pub_id;
+               tlv_data->sub_id = (wl_nan_instance_id_t)ev_replied->sub_id;
+               tlv_data->sub_rssi = ev_replied->sub_rssi;
+               ret = memcpy_s(&tlv_data->remote_nmi, ETHER_ADDR_LEN,
+                               &ev_replied->sub_mac, ETHER_ADDR_LEN);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy remote nmi\n"));
+                       goto fail;
+               }
+
+               WL_TRACE(("publish id: %d\n", ev_replied->pub_id));
+               WL_TRACE(("subscribe d: %d\n", ev_replied->sub_id));
+               WL_TRACE(("Subscriber mac addr: " MACDBG "\n",
+                               MAC2STRDBG(ev_replied->sub_mac.octet)));
+               WL_TRACE(("subscribe rssi: %d\n", (int8)ev_replied->sub_rssi));
+               WL_TRACE(("attribute no: %d\n", ev_replied->attr_num));
+               WL_TRACE(("attribute len: %d\n", (uint16)ev_replied->attr_list_len));
+
+               /* advance to the service descriptor which is attr_list[0] */
+               offset = OFFSETOF(wl_nan_event_replied_t, attr_list[0]);
+               if (offset > len) {
+                       WL_ERR(("Invalid event buffer len\n"));
+                       ret = BCME_BUFTOOSHORT;
+                       goto fail;
+               }
+               p_attr += offset;
+               len -= offset;
+               ret = wl_cfgnan_parse_sda_data(osh, p_attr, len, tlv_data);
+               if (unlikely(ret)) {
+                       WL_ERR(("wl_cfgnan_parse_sdea_data failed,"
+                               "error = %d \n", ret));
+               }
+       }
+
+fail:
+       return ret;
+}
+
+/* Based on each case of tlv type id, fill into tlv data */
+static int
+wl_cfgnan_set_vars_cbfn(void *ctx, const uint8 *data, uint16 type, uint16 len)
+{
+       nan_parse_event_ctx_t *ctx_tlv_data = ((nan_parse_event_ctx_t *)(ctx));
+       nan_event_data_t *tlv_data = ((nan_event_data_t *)(ctx_tlv_data->nan_evt_data));
+       int ret = BCME_OK;
+
+       NAN_DBG_ENTER();
+       if (!data || !len) {
+               WL_ERR(("data length is invalid\n"));
+               ret = BCME_ERROR;
+               goto fail;
+       }
+
+       switch (type) {
+       /*
+        * Need to parse service descript attributes including service control,
+        * when Follow up or Discovery result come
+        */
+       case WL_NAN_XTLV_SD_FUP_RECEIVED:
+       case WL_NAN_XTLV_SD_DISC_RESULTS: {
+               ret = wl_cfgnan_parse_sd_attr_data(ctx_tlv_data->cfg->osh,
+                       len, data, tlv_data, type);
+               break;
+       }
+       case WL_NAN_XTLV_SD_NDPE_TLV_LIST:
+               /* Intentional fall through NDPE TLV list and SVC INFO is sent in same container
+                * to upper layers
+                */
+       case WL_NAN_XTLV_SD_SVC_INFO: {
+               tlv_data->svc_info.data =
+                       MALLOCZ(ctx_tlv_data->cfg->osh, len);
+               if (!tlv_data->svc_info.data) {
+                       WL_ERR(("%s: memory allocation failed\n", __FUNCTION__));
+                       tlv_data->svc_info.dlen = 0;
+                       ret = BCME_NOMEM;
+                       goto fail;
+               }
+               tlv_data->svc_info.dlen = len;
+               ret = memcpy_s(tlv_data->svc_info.data, tlv_data->svc_info.dlen,
+                               data, tlv_data->svc_info.dlen);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy svc info data\n"));
+                       goto fail;
+               }
+               break;
+       }
+       default:
+               WL_ERR(("Not available for tlv type = 0x%x\n", type));
+               ret = BCME_ERROR;
+               break;
+       }
+fail:
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+int
+wl_cfg_nan_check_cmd_len(uint16 nan_iov_len, uint16 data_size,
+               uint16 *subcmd_len)
+{
+       s32 ret = BCME_OK;
+
+       if (subcmd_len != NULL) {
+               *subcmd_len = OFFSETOF(bcm_iov_batch_subcmd_t, data) +
+                               ALIGN_SIZE(data_size, 4);
+               if (*subcmd_len > nan_iov_len) {
+                       WL_ERR(("%s: Buf short, requested:%d, available:%d\n",
+                                       __FUNCTION__, *subcmd_len, nan_iov_len));
+                       ret = BCME_NOMEM;
+               }
+       } else {
+               WL_ERR(("Invalid subcmd_len\n"));
+               ret = BCME_ERROR;
+       }
+       return ret;
+}
+
+int
+wl_cfgnan_config_eventmask(struct net_device *ndev, struct bcm_cfg80211 *cfg,
+       uint8 event_ind_flag, bool disable_events)
+{
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       uint16 subcmd_len;
+       uint32 status;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       bcm_iov_batch_subcmd_t *sub_cmd_resp = NULL;
+       uint8 event_mask[WL_NAN_EVMASK_EXTN_LEN];
+       wl_nan_evmask_extn_t *evmask;
+       uint16 evmask_cmd_len;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+
+       NAN_DBG_ENTER();
+
+       /* same src and dest len here */
+       bzero(event_mask, sizeof(event_mask));
+       evmask_cmd_len = OFFSETOF(wl_nan_evmask_extn_t, evmask) +
+               sizeof(event_mask);
+       ret = wl_add_remove_eventmsg(ndev, WLC_E_NAN, true);
+       if (unlikely(ret)) {
+               WL_ERR((" nan event enable failed, error = %d \n", ret));
+               goto fail;
+       }
+
+       nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_buf_size -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(uint8 *)(&nan_buf->cmds[0]);
+
+       ret = wl_cfg_nan_check_cmd_len(nan_buf_size,
+                       evmask_cmd_len, &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               goto fail;
+       }
+
+       sub_cmd->id = htod16(WL_NAN_CMD_CFG_EVENT_MASK);
+       sub_cmd->len = sizeof(sub_cmd->u.options) + evmask_cmd_len;
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       evmask = (wl_nan_evmask_extn_t *)sub_cmd->data;
+       evmask->ver = WL_NAN_EVMASK_EXTN_VER;
+       evmask->len = WL_NAN_EVMASK_EXTN_LEN;
+       nan_buf_size -= subcmd_len;
+       nan_buf->count = 1;
+
+       if (disable_events) {
+               WL_DBG(("Disabling all nan events..except stop event\n"));
+               setbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_STOP));
+       } else {
+               /*
+                * Android framework event mask configuration.
+                */
+               nan_buf->is_set = false;
+               memset(resp_buf, 0, sizeof(resp_buf));
+               ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size, &status,
+                               (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+               if (unlikely(ret) || unlikely(status)) {
+                       WL_ERR(("get nan event mask failed ret %d status %d \n",
+                               ret, status));
+                       goto fail;
+               }
+               sub_cmd_resp = &((bcm_iov_batch_buf_t *)(resp_buf))->cmds[0];
+               evmask = (wl_nan_evmask_extn_t *)sub_cmd_resp->data;
+
+               /* check the response buff */
+               /* same src and dest len here */
+               (void)memcpy_s(&event_mask, WL_NAN_EVMASK_EXTN_LEN,
+                               (uint8*)&evmask->evmask, WL_NAN_EVMASK_EXTN_LEN);
+
+               if (event_ind_flag) {
+                       /* FIXME:BIT0 - Disable disc mac addr change event indication */
+                       if (CHECK_BIT(event_ind_flag, WL_NAN_EVENT_DIC_MAC_ADDR_BIT)) {
+                               WL_DBG(("Need to add disc mac addr change event\n"));
+                       }
+                       /* BIT2 - Disable nan cluster join indication (OTA). */
+                       if (CHECK_BIT(event_ind_flag, WL_NAN_EVENT_JOIN_EVENT)) {
+                               clrbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_MERGE));
+                       }
+               }
+
+               setbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_DISCOVERY_RESULT));
+               setbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_RECEIVE));
+               setbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_TERMINATED));
+               setbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_STOP));
+               setbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_TXS));
+               setbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_PEER_DATAPATH_IND));
+               setbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_DATAPATH_ESTB));
+               setbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_DATAPATH_END));
+               setbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_RNG_REQ_IND));
+               setbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_RNG_TERM_IND));
+               setbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_DISC_CACHE_TIMEOUT));
+               /* Disable below events by default */
+               clrbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_PEER_SCHED_UPD_NOTIF));
+               clrbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_RNG_RPT_IND));
+               clrbit(event_mask, NAN_EVENT_MAP(WL_NAN_EVENT_DW_END));
+       }
+
+       nan_buf->is_set = true;
+       evmask = (wl_nan_evmask_extn_t *)sub_cmd->data;
+       /* same src and dest len here */
+       (void)memcpy_s((uint8*)&evmask->evmask, sizeof(event_mask),
+               &event_mask, sizeof(event_mask));
+
+       nan_buf_size = (NAN_IOCTL_BUF_SIZE - nan_buf_size);
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size, &status,
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(status)) {
+               WL_ERR(("set nan event mask failed ret %d status %d \n", ret, status));
+               goto fail;
+       }
+       WL_DBG(("set nan event mask successfull\n"));
+
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_set_nan_avail(struct net_device *ndev,
+               struct bcm_cfg80211 *cfg, nan_avail_cmd_data *cmd_data, uint8 avail_type)
+{
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       uint16 subcmd_len;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       wl_nan_iov_t *nan_iov_data = NULL;
+       wl_avail_t *avail = NULL;
+       wl_avail_entry_t *entry;        /* used for filling entry structure */
+       uint8 *p;       /* tracking pointer */
+       uint8 i;
+       u32 status;
+       int c;
+       char ndc_id[ETHER_ADDR_LEN] = { 0x50, 0x6f, 0x9a, 0x01, 0x0, 0x0 };
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(ndev);
+       char *a = WL_AVAIL_BIT_MAP;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+
+       NAN_DBG_ENTER();
+
+       /* Do not disturb avail if dam is supported */
+       if (FW_SUPPORTED(dhdp, autodam)) {
+               WL_DBG(("DAM is supported, avail modification not allowed\n"));
+               return ret;
+       }
+
+       if (avail_type < WL_AVAIL_LOCAL || avail_type > WL_AVAIL_TYPE_MAX) {
+               WL_ERR(("Invalid availability type\n"));
+               ret = BCME_USAGE_ERROR;
+               goto fail;
+       }
+
+       nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_iov_data = MALLOCZ(cfg->osh, sizeof(*nan_iov_data));
+       if (!nan_iov_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_iov_data->nan_iov_len = NAN_IOCTL_BUF_SIZE;
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_iov_data->nan_iov_buf = (uint8 *)(&nan_buf->cmds[0]);
+       nan_iov_data->nan_iov_len -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+                       sizeof(*avail), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               goto fail;
+       }
+       avail = (wl_avail_t *)sub_cmd->data;
+
+       /* populate wl_avail_type */
+       avail->flags = avail_type;
+       if (avail_type == WL_AVAIL_RANGING) {
+               ret = memcpy_s(&avail->addr, ETHER_ADDR_LEN,
+                       &cmd_data->peer_nmi, ETHER_ADDR_LEN);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy peer nmi\n"));
+                       goto fail;
+               }
+       }
+
+       sub_cmd->len = sizeof(sub_cmd->u.options) + subcmd_len;
+       sub_cmd->id = htod16(WL_NAN_CMD_CFG_AVAIL);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+
+       nan_buf->is_set = false;
+       nan_buf->count++;
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_buf_size = (NAN_IOCTL_BUF_SIZE - nan_iov_data->nan_iov_len);
+
+       WL_TRACE(("Read wl nan avail status\n"));
+
+       bzero(resp_buf, sizeof(resp_buf));
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size, &status,
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret)) {
+               WL_ERR(("\n Get nan avail failed ret %d, status %d \n", ret, status));
+               goto fail;
+       }
+
+       if (status == BCME_NOTFOUND) {
+               nan_buf->count = 0;
+               nan_iov_data->nan_iov_buf = (uint8 *)(&nan_buf->cmds[0]);
+               nan_iov_data->nan_iov_len -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+
+               sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+
+               avail = (wl_avail_t *)sub_cmd->data;
+               p = avail->entry;
+
+               /* populate wl_avail fields */
+               avail->length = OFFSETOF(wl_avail_t, entry);
+               avail->flags = avail_type;
+               avail->num_entries = 0;
+               avail->id = 0;
+               entry = (wl_avail_entry_t*)p;
+               entry->flags = WL_AVAIL_ENTRY_COM;
+
+               /* set default values for optional parameters */
+               entry->start_offset = 0;
+               entry->u.band = 0;
+
+               if (cmd_data->avail_period) {
+                       entry->period = cmd_data->avail_period;
+               } else {
+                       entry->period = WL_AVAIL_PERIOD_1024;
+               }
+
+               if (cmd_data->duration != NAN_BAND_INVALID) {
+                       entry->flags |= (3 << WL_AVAIL_ENTRY_USAGE_SHIFT) |
+                               (cmd_data->duration << WL_AVAIL_ENTRY_BIT_DUR_SHIFT);
+               } else {
+                       entry->flags |= (3 << WL_AVAIL_ENTRY_USAGE_SHIFT) |
+                               (WL_AVAIL_BIT_DUR_16 << WL_AVAIL_ENTRY_BIT_DUR_SHIFT);
+               }
+               entry->bitmap_len = 0;
+
+               if (avail_type == WL_AVAIL_LOCAL) {
+                       entry->flags |= 1 << WL_AVAIL_ENTRY_CHAN_SHIFT;
+                       /* Check for 5g support, based on that choose 5g channel */
+                       if (cfg->nancfg->support_5g) {
+                               entry->u.channel_info =
+                                       htod32(wf_channel2chspec(WL_AVAIL_CHANNEL_5G,
+                                               WL_AVAIL_BANDWIDTH_5G));
+                       } else {
+                               entry->u.channel_info =
+                                       htod32(wf_channel2chspec(WL_AVAIL_CHANNEL_2G,
+                                               WL_AVAIL_BANDWIDTH_2G));
+                       }
+                       entry->flags = htod16(entry->flags);
+               }
+
+               if (cfg->nancfg->support_5g) {
+                       a = WL_5G_AVAIL_BIT_MAP;
+               }
+
+               /* point to bitmap value for processing */
+               if (cmd_data->bmap) {
+                       for (c = (WL_NAN_EVENT_CLEAR_BIT-1); c >= 0; c--) {
+                               i = cmd_data->bmap >> c;
+                               if (i & 1) {
+                                       setbit(entry->bitmap, (WL_NAN_EVENT_CLEAR_BIT-c-1));
+                               }
+                       }
+               } else {
+                       for (i = 0; i < strlen(WL_AVAIL_BIT_MAP); i++) {
+                               if (*a == '1') {
+                                       setbit(entry->bitmap, i);
+                               }
+                               a++;
+                       }
+               }
+
+               /* account for partially filled most significant byte */
+               entry->bitmap_len = ((WL_NAN_EVENT_CLEAR_BIT) + NBBY - 1) / NBBY;
+               if (avail_type == WL_AVAIL_NDC) {
+                       ret = memcpy_s(&avail->addr, ETHER_ADDR_LEN,
+                                       ndc_id, ETHER_ADDR_LEN);
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy ndc id\n"));
+                               goto fail;
+                       }
+               } else if (avail_type == WL_AVAIL_RANGING) {
+                       ret = memcpy_s(&avail->addr, ETHER_ADDR_LEN,
+                                       &cmd_data->peer_nmi, ETHER_ADDR_LEN);
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy peer nmi\n"));
+                               goto fail;
+                       }
+               }
+               /* account for partially filled most significant byte */
+
+               /* update wl_avail and populate wl_avail_entry */
+               entry->length = OFFSETOF(wl_avail_entry_t, bitmap) + entry->bitmap_len;
+               avail->num_entries++;
+               avail->length += entry->length;
+               /* advance pointer for next entry */
+               p += entry->length;
+
+               /* convert to dongle endianness */
+               entry->length = htod16(entry->length);
+               entry->start_offset = htod16(entry->start_offset);
+               entry->u.channel_info = htod32(entry->u.channel_info);
+               entry->flags = htod16(entry->flags);
+               /* update avail_len only if
+                * there are avail entries
+                */
+               if (avail->num_entries) {
+                       nan_iov_data->nan_iov_len -= avail->length;
+                       avail->length = htod16(avail->length);
+                       avail->flags = htod16(avail->flags);
+               }
+               avail->length = htod16(avail->length);
+
+               sub_cmd->id = htod16(WL_NAN_CMD_CFG_AVAIL);
+               sub_cmd->len = sizeof(sub_cmd->u.options) + avail->length;
+               sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+
+               nan_buf->is_set = true;
+               nan_buf->count++;
+
+               /* Reduce the iov_len size by subcmd_len */
+               nan_iov_data->nan_iov_len -= subcmd_len;
+               nan_buf_size = (NAN_IOCTL_BUF_SIZE - nan_iov_data->nan_iov_len);
+
+               ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size, &status,
+                               (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+               if (unlikely(ret) || unlikely(status)) {
+                       WL_ERR(("\n set nan avail failed ret %d status %d \n", ret, status));
+                       ret = status;
+                       goto fail;
+               }
+       } else if (status == BCME_OK) {
+               WL_DBG(("Avail type [%d] found to be configured\n", avail_type));
+       } else {
+               WL_ERR(("set nan avail failed ret %d status %d \n", ret, status));
+       }
+
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+       if (nan_iov_data) {
+               MFREE(cfg->osh, nan_iov_data, sizeof(*nan_iov_data));
+       }
+
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+/* API to configure nan ctrl and nan ctrl2 commands */
+static int
+wl_cfgnan_config_control_flag(struct net_device *ndev, struct bcm_cfg80211 *cfg,
+       uint32 flag1, uint32 flag2, uint16 cmd_id, uint32 *status, bool set)
+{
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       s32 ret = BCME_OK;
+       uint16 nan_iov_start, nan_iov_end;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       uint16 subcmd_len;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       bcm_iov_batch_subcmd_t *sub_cmd_resp = NULL;
+       wl_nan_iov_t *nan_iov_data = NULL;
+       uint32 *cfg_ctrl;
+       uint16 cfg_ctrl_size;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+
+       NAN_DBG_ENTER();
+       nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_iov_data = MALLOCZ(cfg->osh, sizeof(*nan_iov_data));
+       if (!nan_iov_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       if (cmd_id == WL_NAN_CMD_CFG_NAN_CONFIG) {
+               cfg_ctrl_size = sizeof(wl_nan_cfg_ctrl_t);
+       } else if (cmd_id == WL_NAN_CMD_CFG_NAN_CONFIG2) {
+               cfg_ctrl_size = sizeof(wl_nan_cfg_ctrl2_t);
+       } else {
+               ret = BCME_BADARG;
+               goto fail;
+       }
+
+       nan_iov_data->nan_iov_len = nan_iov_start = NAN_IOCTL_BUF_SIZE;
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_iov_data->nan_iov_buf = (uint8 *)(&nan_buf->cmds[0]);
+       nan_iov_data->nan_iov_len -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+                       cfg_ctrl_size, &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               goto fail;
+       }
+
+       sub_cmd->id = htod16(cmd_id);
+       sub_cmd->len = sizeof(sub_cmd->u.options) + cfg_ctrl_size;
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+
+       nan_buf->is_set = false;
+       nan_buf->count++;
+
+       /* Reduce the iov_len size by subcmd_len */
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_end = nan_iov_data->nan_iov_len;
+       nan_buf_size = (nan_iov_start - nan_iov_end);
+
+       bzero(resp_buf, sizeof(resp_buf));
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size, status,
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(*status)) {
+               WL_ERR(("get nan cfg ctrl failed ret %d status %d \n", ret, *status));
+               goto fail;
+       }
+       sub_cmd_resp = &((bcm_iov_batch_buf_t *)(resp_buf))->cmds[0];
+
+       /* check the response buff */
+       if (cmd_id == WL_NAN_CMD_CFG_NAN_CONFIG) {
+               wl_nan_cfg_ctrl_t *cfg_ctrl1;
+               cfg_ctrl1 = ((uint32 *)&sub_cmd_resp->data[0]);
+               if (set) {
+                       *cfg_ctrl1 |= flag1;
+               } else {
+                       *cfg_ctrl1 &= ~flag1;
+               }
+               cfg_ctrl = cfg_ctrl1;
+               WL_INFORM_MEM(("%s: Modifying nan ctrl flag %x val %d", __FUNCTION__, flag1, set));
+       } else {
+               wl_nan_cfg_ctrl2_t *cfg_ctrl2;
+               cfg_ctrl2 = ((wl_nan_cfg_ctrl2_t *)&sub_cmd_resp->data[0]);
+               if (set) {
+                       cfg_ctrl2->flags1 |= flag1;
+                       cfg_ctrl2->flags2 |= flag2;
+               } else {
+                       cfg_ctrl2->flags1 &= ~flag1;
+                       cfg_ctrl2->flags2 &= ~flag2;
+               }
+               cfg_ctrl = (uint32 *)cfg_ctrl2;
+               WL_INFORM_MEM(("%s: Modifying nan ctrl2 flag1 %x flag2 %x val %d",
+                               __FUNCTION__, flag1, flag2, set));
+       }
+       ret = memcpy_s(sub_cmd->data, cfg_ctrl_size, cfg_ctrl, cfg_ctrl_size);
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to copy cfg ctrl\n"));
+               goto fail;
+       }
+
+       nan_buf->is_set = true;
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size, status,
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(*status)) {
+               WL_ERR(("set nan cfg ctrl failed ret %d status %d \n", ret, *status));
+               goto fail;
+       }
+       WL_DBG(("set nan cfg ctrl successfull\n"));
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+       if (nan_iov_data) {
+               MFREE(cfg->osh, nan_iov_data, sizeof(*nan_iov_data));
+       }
+
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_get_iovars_status(void *ctx, const uint8 *data, uint16 type, uint16 len)
+{
+       bcm_iov_batch_buf_t *b_resp = (bcm_iov_batch_buf_t *)ctx;
+       uint32 status;
+       /* if all tlvs are parsed, we should not be here */
+       if (b_resp->count == 0) {
+               return BCME_BADLEN;
+       }
+
+       /*  cbfn params may be used in f/w */
+       if (len < sizeof(status)) {
+               return BCME_BUFTOOSHORT;
+       }
+
+       /* first 4 bytes consists status */
+       if (memcpy_s(&status, sizeof(status),
+                       data, sizeof(uint32)) != BCME_OK) {
+               WL_ERR(("Failed to copy status\n"));
+               goto exit;
+       }
+
+       status = dtoh32(status);
+
+       /* If status is non zero */
+       if (status != BCME_OK) {
+               printf("cmd type %d failed, status: %04x\n", type, status);
+               goto exit;
+       }
+
+       if (b_resp->count > 0) {
+               b_resp->count--;
+       }
+
+       if (!b_resp->count) {
+               status = BCME_IOV_LAST_CMD;
+       }
+exit:
+       return status;
+}
+
+static int
+wl_cfgnan_execute_ioctl(struct net_device *ndev, struct bcm_cfg80211 *cfg,
+       bcm_iov_batch_buf_t *nan_buf, uint16 nan_buf_size, uint32 *status,
+       uint8 *resp_buf, uint16 resp_buf_size)
+{
+       int ret = BCME_OK;
+       uint16 tlvs_len;
+       int res = BCME_OK;
+       bcm_iov_batch_buf_t *p_resp = NULL;
+       char *iov = "nan";
+       int max_resp_len = WLC_IOCTL_MAXLEN;
+
+       WL_DBG(("Enter:\n"));
+       if (nan_buf->is_set) {
+               ret = wldev_iovar_setbuf(ndev, "nan", nan_buf, nan_buf_size,
+                       resp_buf, resp_buf_size, NULL);
+               p_resp = (bcm_iov_batch_buf_t *)(resp_buf + strlen(iov) + 1);
+       } else {
+               ret = wldev_iovar_getbuf(ndev, "nan", nan_buf, nan_buf_size,
+                       resp_buf, resp_buf_size, NULL);
+               p_resp = (bcm_iov_batch_buf_t *)(resp_buf);
+       }
+       if (unlikely(ret)) {
+               WL_ERR((" nan execute ioctl failed, error = %d \n", ret));
+               goto fail;
+       }
+
+       p_resp->is_set = nan_buf->is_set;
+       tlvs_len = max_resp_len - OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+
+       /* Extract the tlvs and print their resp in cb fn */
+       res = bcm_unpack_xtlv_buf((void *)p_resp, (const uint8 *)&p_resp->cmds[0],
+               tlvs_len, BCM_IOV_CMD_OPT_ALIGN32, wl_cfgnan_get_iovars_status);
+
+       if (res == BCME_IOV_LAST_CMD) {
+               res = BCME_OK;
+       }
+fail:
+       *status = res;
+       WL_DBG((" nan ioctl ret %d status %d \n", ret, *status));
+       return ret;
+
+}
+
+static int
+wl_cfgnan_if_addr_handler(void *p_buf, uint16 *nan_buf_size,
+               struct ether_addr *if_addr)
+{
+       /* nan enable */
+       s32 ret = BCME_OK;
+       uint16 subcmd_len;
+
+       NAN_DBG_ENTER();
+
+       if (p_buf != NULL) {
+               bcm_iov_batch_subcmd_t *sub_cmd = (bcm_iov_batch_subcmd_t*)(p_buf);
+
+               ret = wl_cfg_nan_check_cmd_len(*nan_buf_size,
+                               sizeof(*if_addr), &subcmd_len);
+               if (unlikely(ret)) {
+                       WL_ERR(("nan_sub_cmd check failed\n"));
+                       goto fail;
+               }
+
+               /* Fill the sub_command block */
+               sub_cmd->id = htod16(WL_NAN_CMD_CFG_IF_ADDR);
+               sub_cmd->len = sizeof(sub_cmd->u.options) + sizeof(*if_addr);
+               sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+               ret = memcpy_s(sub_cmd->data, sizeof(*if_addr),
+                               (uint8 *)if_addr, sizeof(*if_addr));
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy if addr\n"));
+                       goto fail;
+               }
+
+               *nan_buf_size -= subcmd_len;
+       } else {
+               WL_ERR(("nan_iov_buf is NULL\n"));
+               ret = BCME_ERROR;
+               goto fail;
+       }
+
+fail:
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_get_ver(struct net_device *ndev, struct bcm_cfg80211 *cfg)
+{
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       wl_nan_ver_t *nan_ver = NULL;
+       uint16 subcmd_len;
+       uint32 status;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       bcm_iov_batch_subcmd_t *sub_cmd_resp = NULL;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+
+       NAN_DBG_ENTER();
+       nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_buf_size -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(uint8 *)(&nan_buf->cmds[0]);
+
+       ret = wl_cfg_nan_check_cmd_len(nan_buf_size,
+                       sizeof(*nan_ver), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               goto fail;
+       }
+
+       nan_ver = (wl_nan_ver_t *)sub_cmd->data;
+       sub_cmd->id = htod16(WL_NAN_CMD_GLB_NAN_VER);
+       sub_cmd->len = sizeof(sub_cmd->u.options) + sizeof(*nan_ver);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       nan_buf_size -= subcmd_len;
+       nan_buf->count = 1;
+
+       nan_buf->is_set = false;
+       bzero(resp_buf, sizeof(resp_buf));
+       nan_buf_size = NAN_IOCTL_BUF_SIZE - nan_buf_size;
+
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size, &status,
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(status)) {
+               WL_ERR(("get nan ver failed ret %d status %d \n",
+                               ret, status));
+               goto fail;
+       }
+
+       sub_cmd_resp = &((bcm_iov_batch_buf_t *)(resp_buf))->cmds[0];
+       nan_ver = ((wl_nan_ver_t *)&sub_cmd_resp->data[0]);
+       if (!nan_ver) {
+               ret = BCME_NOTFOUND;
+               WL_ERR(("nan_ver not found: err = %d\n", ret));
+               goto fail;
+       }
+       cfg->nancfg->version = *nan_ver;
+       WL_INFORM_MEM(("Nan Version is %d\n", cfg->nancfg->version));
+
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+       NAN_DBG_EXIT();
+       return ret;
+
+}
+
+static int
+wl_cfgnan_set_if_addr(struct bcm_cfg80211 *cfg)
+{
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       uint32 status;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+       struct ether_addr if_addr;
+       uint8 buf[NAN_IOCTL_BUF_SIZE];
+       bcm_iov_batch_buf_t *nan_buf = (bcm_iov_batch_buf_t*)buf;
+       bool rand_mac = cfg->nancfg->mac_rand;
+
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_buf_size -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+       if (rand_mac) {
+               RANDOM_BYTES(if_addr.octet, 6);
+               /* restore mcast and local admin bits to 0 and 1 */
+               ETHER_SET_UNICAST(if_addr.octet);
+               ETHER_SET_LOCALADDR(if_addr.octet);
+       } else {
+               /* Use primary MAC with the locally administered bit for the
+                * NAN NMI I/F
+                */
+               if (wl_get_vif_macaddr(cfg, WL_IF_TYPE_NAN_NMI,
+                               if_addr.octet) != BCME_OK) {
+                       ret = -EINVAL;
+                       WL_ERR(("Failed to get mac addr for NMI\n"));
+                       goto fail;
+               }
+       }
+       WL_INFORM_MEM(("%s: NMI " MACDBG "\n",
+                       __FUNCTION__, MAC2STRDBG(if_addr.octet)));
+       ret = wl_cfgnan_if_addr_handler(&nan_buf->cmds[0],
+                       &nan_buf_size, &if_addr);
+       if (unlikely(ret)) {
+               WL_ERR(("Nan if addr handler sub_cmd set failed\n"));
+               goto fail;
+       }
+       nan_buf->count++;
+       nan_buf->is_set = true;
+       nan_buf_size = NAN_IOCTL_BUF_SIZE - nan_buf_size;
+       bzero(resp_buf, sizeof(resp_buf));
+       ret = wl_cfgnan_execute_ioctl(bcmcfg_to_prmry_ndev(cfg), cfg,
+                       nan_buf, nan_buf_size, &status,
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(status)) {
+               WL_ERR(("nan if addr handler failed ret %d status %d\n",
+                               ret, status));
+               goto fail;
+       }
+       ret = memcpy_s(cfg->nancfg->nan_nmi_mac, ETH_ALEN,
+                       if_addr.octet, ETH_ALEN);
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to copy nmi addr\n"));
+               goto fail;
+       }
+       return ret;
+fail:
+       if (!rand_mac) {
+               wl_release_vif_macaddr(cfg, if_addr.octet, WL_IF_TYPE_NAN_NMI);
+       }
+
+       return ret;
+}
+
+static int
+wl_cfgnan_init_handler(void *p_buf, uint16 *nan_buf_size, bool val)
+{
+       /* nan enable */
+       s32 ret = BCME_OK;
+       uint16 subcmd_len;
+
+       NAN_DBG_ENTER();
+
+       if (p_buf != NULL) {
+               bcm_iov_batch_subcmd_t *sub_cmd = (bcm_iov_batch_subcmd_t*)(p_buf);
+
+               ret = wl_cfg_nan_check_cmd_len(*nan_buf_size,
+                               sizeof(val), &subcmd_len);
+               if (unlikely(ret)) {
+                       WL_ERR(("nan_sub_cmd check failed\n"));
+                       goto fail;
+               }
+
+               /* Fill the sub_command block */
+               sub_cmd->id = htod16(WL_NAN_CMD_CFG_NAN_INIT);
+               sub_cmd->len = sizeof(sub_cmd->u.options) + sizeof(uint8);
+               sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+               ret = memcpy_s(sub_cmd->data, sizeof(uint8),
+                               (uint8*)&val, sizeof(uint8));
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy init value\n"));
+                       goto fail;
+               }
+
+               *nan_buf_size -= subcmd_len;
+       } else {
+               WL_ERR(("nan_iov_buf is NULL\n"));
+               ret = BCME_ERROR;
+               goto fail;
+       }
+
+fail:
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_enable_handler(wl_nan_iov_t *nan_iov_data, bool val)
+{
+       /* nan enable */
+       s32 ret = BCME_OK;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       uint16 subcmd_len;
+
+       NAN_DBG_ENTER();
+
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+                       sizeof(val), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               return ret;
+       }
+
+       /* Fill the sub_command block */
+       sub_cmd->id = htod16(WL_NAN_CMD_CFG_NAN_ENAB);
+       sub_cmd->len = sizeof(sub_cmd->u.options) + sizeof(uint8);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       ret = memcpy_s(sub_cmd->data, sizeof(uint8),
+                       (uint8*)&val, sizeof(uint8));
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to copy enab value\n"));
+               return ret;
+       }
+
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_data->nan_iov_buf += subcmd_len;
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_warmup_time_handler(nan_config_cmd_data_t *cmd_data,
+               wl_nan_iov_t *nan_iov_data)
+{
+       /* wl nan warm_up_time */
+       s32 ret = BCME_OK;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       wl_nan_warmup_time_ticks_t *wup_ticks = NULL;
+       uint16 subcmd_len;
+       NAN_DBG_ENTER();
+
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+       wup_ticks = (wl_nan_warmup_time_ticks_t *)sub_cmd->data;
+
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+                       sizeof(*wup_ticks), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               return ret;
+       }
+       /* Fill the sub_command block */
+       sub_cmd->id = htod16(WL_NAN_CMD_CFG_WARMUP_TIME);
+       sub_cmd->len = sizeof(sub_cmd->u.options) +
+               sizeof(*wup_ticks);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       *wup_ticks = cmd_data->warmup_time;
+
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_data->nan_iov_buf += subcmd_len;
+
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_set_election_metric(nan_config_cmd_data_t *cmd_data,
+               wl_nan_iov_t *nan_iov_data, uint32 nan_attr_mask)
+{
+       s32 ret = BCME_OK;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       wl_nan_election_metric_config_t *metrics = NULL;
+       uint16 subcmd_len;
+       NAN_DBG_ENTER();
+
+       sub_cmd =
+               (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+                       sizeof(*metrics), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               goto fail;
+       }
+
+       metrics = (wl_nan_election_metric_config_t *)sub_cmd->data;
+
+       if (nan_attr_mask & NAN_ATTR_RAND_FACTOR_CONFIG) {
+               metrics->random_factor = (uint8)cmd_data->metrics.random_factor;
+       }
+
+       if ((!cmd_data->metrics.master_pref) ||
+               (cmd_data->metrics.master_pref > NAN_MAXIMUM_MASTER_PREFERENCE)) {
+               WL_TRACE(("Master Pref is 0 or greater than 254, hence sending random value\n"));
+               /* Master pref for mobile devices can be from 1 - 127 as per Spec AppendixC */
+               metrics->master_pref = (RANDOM32()%(NAN_MAXIMUM_MASTER_PREFERENCE/2)) + 1;
+       } else {
+               metrics->master_pref = (uint8)cmd_data->metrics.master_pref;
+       }
+       sub_cmd->id = htod16(WL_NAN_CMD_ELECTION_METRICS_CONFIG);
+       sub_cmd->len = sizeof(sub_cmd->u.options) +
+               sizeof(*metrics);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_data->nan_iov_buf += subcmd_len;
+
+fail:
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_set_rssi_proximity(nan_config_cmd_data_t *cmd_data,
+               wl_nan_iov_t *nan_iov_data, uint32 nan_attr_mask)
+{
+       s32 ret = BCME_OK;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       wl_nan_rssi_notif_thld_t *rssi_notif_thld = NULL;
+       uint16 subcmd_len;
+
+       NAN_DBG_ENTER();
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+
+       rssi_notif_thld = (wl_nan_rssi_notif_thld_t *)sub_cmd->data;
+
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+                       sizeof(*rssi_notif_thld), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               return ret;
+       }
+       if (nan_attr_mask & NAN_ATTR_RSSI_PROXIMITY_2G_CONFIG) {
+               rssi_notif_thld->bcn_rssi_2g =
+                       cmd_data->rssi_attr.rssi_proximity_2dot4g_val;
+       } else {
+               /* Keeping RSSI threshold value to be -70dBm */
+               rssi_notif_thld->bcn_rssi_2g = NAN_DEF_RSSI_NOTIF_THRESH;
+       }
+
+       if (nan_attr_mask & NAN_ATTR_RSSI_PROXIMITY_5G_CONFIG) {
+               rssi_notif_thld->bcn_rssi_5g =
+                       cmd_data->rssi_attr.rssi_proximity_5g_val;
+       } else {
+               /* Keeping RSSI threshold value to be -70dBm */
+               rssi_notif_thld->bcn_rssi_5g = NAN_DEF_RSSI_NOTIF_THRESH;
+       }
+
+       sub_cmd->id = htod16(WL_NAN_CMD_SYNC_BCN_RSSI_NOTIF_THRESHOLD);
+       sub_cmd->len = htod16(sizeof(sub_cmd->u.options) + sizeof(*rssi_notif_thld));
+       sub_cmd->u.options = htod32(BCM_XTLV_OPTION_ALIGN32);
+
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_data->nan_iov_buf += subcmd_len;
+
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_set_rssi_mid_or_close(nan_config_cmd_data_t *cmd_data,
+               wl_nan_iov_t *nan_iov_data, uint32 nan_attr_mask)
+{
+       s32 ret = BCME_OK;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       wl_nan_rssi_thld_t *rssi_thld = NULL;
+       uint16 subcmd_len;
+
+       NAN_DBG_ENTER();
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+       rssi_thld = (wl_nan_rssi_thld_t *)sub_cmd->data;
+
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+                       sizeof(*rssi_thld), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               return ret;
+       }
+
+       /*
+        * Keeping RSSI mid value -75dBm for both 2G and 5G
+        * Keeping RSSI close value -60dBm for both 2G and 5G
+        */
+       if (nan_attr_mask & NAN_ATTR_RSSI_MIDDLE_2G_CONFIG) {
+               rssi_thld->rssi_mid_2g =
+                       cmd_data->rssi_attr.rssi_middle_2dot4g_val;
+       } else {
+               rssi_thld->rssi_mid_2g = NAN_DEF_RSSI_MID;
+       }
+
+       if (nan_attr_mask & NAN_ATTR_RSSI_MIDDLE_5G_CONFIG) {
+               rssi_thld->rssi_mid_5g =
+                       cmd_data->rssi_attr.rssi_middle_5g_val;
+       } else {
+               rssi_thld->rssi_mid_5g = NAN_DEF_RSSI_MID;
+       }
+
+       if (nan_attr_mask & NAN_ATTR_RSSI_CLOSE_CONFIG) {
+               rssi_thld->rssi_close_2g =
+                       cmd_data->rssi_attr.rssi_close_2dot4g_val;
+       } else {
+               rssi_thld->rssi_close_2g = NAN_DEF_RSSI_CLOSE;
+       }
+
+       if (nan_attr_mask & NAN_ATTR_RSSI_CLOSE_5G_CONFIG) {
+               rssi_thld->rssi_close_5g =
+                       cmd_data->rssi_attr.rssi_close_5g_val;
+       } else {
+               rssi_thld->rssi_close_5g = NAN_DEF_RSSI_CLOSE;
+       }
+
+       sub_cmd->id = htod16(WL_NAN_CMD_ELECTION_RSSI_THRESHOLD);
+       sub_cmd->len = htod16(sizeof(sub_cmd->u.options) + sizeof(*rssi_thld));
+       sub_cmd->u.options = htod32(BCM_XTLV_OPTION_ALIGN32);
+
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_data->nan_iov_buf += subcmd_len;
+
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+check_for_valid_5gchan(struct net_device *ndev, uint8 chan)
+{
+       s32 ret = BCME_OK;
+       uint bitmap;
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+       uint32 chanspec_arg;
+       NAN_DBG_ENTER();
+
+       chanspec_arg = CH20MHZ_CHSPEC(chan);
+       chanspec_arg = wl_chspec_host_to_driver(chanspec_arg);
+       bzero(ioctl_buf, WLC_IOCTL_SMLEN);
+       ret = wldev_iovar_getbuf(ndev, "per_chan_info",
+                       (void *)&chanspec_arg, sizeof(chanspec_arg),
+                       ioctl_buf, WLC_IOCTL_SMLEN, NULL);
+       if (ret != BCME_OK) {
+               WL_ERR(("Chaninfo for channel = %d, error %d\n", chan, ret));
+               goto exit;
+       }
+
+       bitmap = dtoh32(*(uint *)ioctl_buf);
+       if (!(bitmap & WL_CHAN_VALID_HW)) {
+               WL_ERR(("Invalid channel\n"));
+               ret = BCME_BADCHAN;
+               goto exit;
+       }
+
+       if (!(bitmap & WL_CHAN_VALID_SW)) {
+               WL_ERR(("Not supported in current locale\n"));
+               ret = BCME_BADCHAN;
+               goto exit;
+       }
+exit:
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_set_nan_soc_chans(struct net_device *ndev, nan_config_cmd_data_t *cmd_data,
+       wl_nan_iov_t *nan_iov_data, uint32 nan_attr_mask)
+{
+       s32 ret = BCME_OK;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       wl_nan_social_channels_t *soc_chans = NULL;
+       uint16 subcmd_len;
+
+       NAN_DBG_ENTER();
+
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+       soc_chans =
+               (wl_nan_social_channels_t *)sub_cmd->data;
+
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+                       sizeof(*soc_chans), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               return ret;
+       }
+
+       sub_cmd->id = htod16(WL_NAN_CMD_SYNC_SOCIAL_CHAN);
+       sub_cmd->len = sizeof(sub_cmd->u.options) +
+               sizeof(*soc_chans);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       if (nan_attr_mask & NAN_ATTR_2G_CHAN_CONFIG) {
+               soc_chans->soc_chan_2g = cmd_data->chanspec[1];
+       } else {
+               soc_chans->soc_chan_2g = NAN_DEF_SOCIAL_CHAN_2G;
+       }
+
+       if (cmd_data->support_5g) {
+               if (nan_attr_mask & NAN_ATTR_5G_CHAN_CONFIG) {
+                       soc_chans->soc_chan_5g = cmd_data->chanspec[2];
+               } else {
+                       soc_chans->soc_chan_5g = NAN_DEF_SOCIAL_CHAN_5G;
+               }
+               ret = check_for_valid_5gchan(ndev, soc_chans->soc_chan_5g);
+               if (ret != BCME_OK) {
+                       ret = check_for_valid_5gchan(ndev, NAN_DEF_SEC_SOCIAL_CHAN_5G);
+                       if (ret == BCME_OK) {
+                               soc_chans->soc_chan_5g = NAN_DEF_SEC_SOCIAL_CHAN_5G;
+                       } else {
+                               soc_chans->soc_chan_5g = 0;
+                               ret = BCME_OK;
+                               WL_ERR(("Current locale doesn't support 5G op"
+                                       "continuing with 2G only operation\n"));
+                       }
+               }
+       } else {
+               WL_DBG(("5G support is disabled\n"));
+       }
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_data->nan_iov_buf += subcmd_len;
+
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_set_nan_scan_params(struct net_device *ndev, struct bcm_cfg80211 *cfg,
+       nan_config_cmd_data_t *cmd_data, uint8 band_index, uint32 nan_attr_mask)
+{
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       s32 ret = BCME_OK;
+       uint16 nan_iov_start, nan_iov_end;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       uint16 subcmd_len;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       wl_nan_iov_t *nan_iov_data = NULL;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+       wl_nan_scan_params_t *scan_params = NULL;
+       uint32 status;
+
+       NAN_DBG_ENTER();
+
+       nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_iov_data = MALLOCZ(cfg->osh, sizeof(*nan_iov_data));
+       if (!nan_iov_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_iov_data->nan_iov_len = nan_iov_start = NAN_IOCTL_BUF_SIZE;
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_iov_data->nan_iov_buf = (uint8 *)(&nan_buf->cmds[0]);
+       nan_iov_data->nan_iov_len -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+                       sizeof(*scan_params), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               goto fail;
+       }
+       scan_params = (wl_nan_scan_params_t *)sub_cmd->data;
+
+       sub_cmd->id = htod16(WL_NAN_CMD_CFG_SCAN_PARAMS);
+       sub_cmd->len = sizeof(sub_cmd->u.options) + sizeof(*scan_params);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+
+       if (!band_index) {
+               /* Fw default: Dwell time for 2G is 210 */
+               if ((nan_attr_mask & NAN_ATTR_2G_DWELL_TIME_CONFIG) &&
+                       cmd_data->dwell_time[0]) {
+                       scan_params->dwell_time = cmd_data->dwell_time[0] +
+                               NAN_SCAN_DWELL_TIME_DELTA_MS;
+               }
+               /* Fw default: Scan period for 2G is 10 */
+               if (nan_attr_mask & NAN_ATTR_2G_SCAN_PERIOD_CONFIG) {
+                       scan_params->scan_period = cmd_data->scan_period[0];
+               }
+       } else {
+               if ((nan_attr_mask & NAN_ATTR_5G_DWELL_TIME_CONFIG) &&
+                       cmd_data->dwell_time[1]) {
+                       scan_params->dwell_time = cmd_data->dwell_time[1] +
+                               NAN_SCAN_DWELL_TIME_DELTA_MS;
+               }
+               if (nan_attr_mask & NAN_ATTR_5G_SCAN_PERIOD_CONFIG) {
+                       scan_params->scan_period = cmd_data->scan_period[1];
+               }
+       }
+       scan_params->band_index = band_index;
+       nan_buf->is_set = true;
+       nan_buf->count++;
+
+       /* Reduce the iov_len size by subcmd_len */
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_end = nan_iov_data->nan_iov_len;
+       nan_buf_size = (nan_iov_start - nan_iov_end);
+
+       bzero(resp_buf, sizeof(resp_buf));
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size, &status,
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(status)) {
+               WL_ERR(("set nan scan params failed ret %d status %d \n", ret, status));
+               goto fail;
+       }
+       WL_DBG(("set nan scan params successfull\n"));
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+       if (nan_iov_data) {
+               MFREE(cfg->osh, nan_iov_data, sizeof(*nan_iov_data));
+       }
+
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static uint16
+wl_cfgnan_gen_rand_cluster_id(uint16 low_val, uint16 high_val)
+{
+       uint16 random_id;
+       ulong random_seed;
+
+       /* In negative case also, assigning to cluster_high value */
+       if (low_val >= high_val)
+       {
+               random_id = high_val;
+       } else {
+               RANDOM_BYTES(&random_seed, sizeof(random_seed));
+               random_id = (uint16)((random_seed % ((high_val + 1) -
+                               low_val)) + low_val);
+       }
+       return random_id;
+}
+
+static int
+wl_cfgnan_set_cluster_id(nan_config_cmd_data_t *cmd_data,
+               wl_nan_iov_t *nan_iov_data)
+{
+       s32 ret = BCME_OK;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       uint16 subcmd_len;
+
+       NAN_DBG_ENTER();
+
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+                       (sizeof(cmd_data->clus_id) - sizeof(uint8)), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               return ret;
+       }
+
+       cmd_data->clus_id.octet[0] = 0x50;
+       cmd_data->clus_id.octet[1] = 0x6F;
+       cmd_data->clus_id.octet[2] = 0x9A;
+       cmd_data->clus_id.octet[3] = 0x01;
+       hton16_ua_store(wl_cfgnan_gen_rand_cluster_id(cmd_data->cluster_low,
+                       cmd_data->cluster_high), &cmd_data->clus_id.octet[4]);
+
+       WL_TRACE(("cluster_id = " MACDBG "\n", MAC2STRDBG(cmd_data->clus_id.octet)));
+
+       sub_cmd->id = htod16(WL_NAN_CMD_CFG_CID);
+       sub_cmd->len = sizeof(sub_cmd->u.options) + sizeof(cmd_data->clus_id);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       ret = memcpy_s(sub_cmd->data, sizeof(cmd_data->clus_id),
+                       (uint8 *)&cmd_data->clus_id,
+                       sizeof(cmd_data->clus_id));
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to copy clus id\n"));
+               return ret;
+       }
+
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_data->nan_iov_buf += subcmd_len;
+
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_set_hop_count_limit(nan_config_cmd_data_t *cmd_data,
+               wl_nan_iov_t *nan_iov_data)
+{
+       s32 ret = BCME_OK;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       wl_nan_hop_count_t *hop_limit = NULL;
+       uint16 subcmd_len;
+
+       NAN_DBG_ENTER();
+
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+       hop_limit = (wl_nan_hop_count_t *)sub_cmd->data;
+
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+                       sizeof(*hop_limit), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               return ret;
+       }
+
+       *hop_limit = cmd_data->hop_count_limit;
+       sub_cmd->id = htod16(WL_NAN_CMD_CFG_HOP_LIMIT);
+       sub_cmd->len = sizeof(sub_cmd->u.options) + sizeof(*hop_limit);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_data->nan_iov_buf += subcmd_len;
+
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_set_sid_beacon_val(nan_config_cmd_data_t *cmd_data,
+       wl_nan_iov_t *nan_iov_data, uint32 nan_attr_mask)
+{
+       s32 ret = BCME_OK;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       wl_nan_sid_beacon_control_t *sid_beacon = NULL;
+       uint16 subcmd_len;
+
+       NAN_DBG_ENTER();
+
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+                       sizeof(*sid_beacon), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               return ret;
+       }
+
+       sid_beacon = (wl_nan_sid_beacon_control_t *)sub_cmd->data;
+       sid_beacon->sid_enable = cmd_data->sid_beacon.sid_enable;
+       /* Need to have separate flag for sub beacons
+        * sid_beacon->sub_sid_enable = cmd_data->sid_beacon.sub_sid_enable;
+        */
+       if (nan_attr_mask & NAN_ATTR_SID_BEACON_CONFIG) {
+               /* Limit for number of publish SIDs to be included in Beacons */
+               sid_beacon->sid_count = cmd_data->sid_beacon.sid_count;
+       }
+       if (nan_attr_mask & NAN_ATTR_SUB_SID_BEACON_CONFIG) {
+               /* Limit for number of subscribe SIDs to be included in Beacons */
+               sid_beacon->sub_sid_count = cmd_data->sid_beacon.sub_sid_count;
+       }
+       sub_cmd->id = htod16(WL_NAN_CMD_CFG_SID_BEACON);
+       sub_cmd->len = sizeof(sub_cmd->u.options) +
+               sizeof(*sid_beacon);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_data->nan_iov_buf += subcmd_len;
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_set_nan_oui(nan_config_cmd_data_t *cmd_data,
+               wl_nan_iov_t *nan_iov_data)
+{
+       s32 ret = BCME_OK;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       uint16 subcmd_len;
+
+       NAN_DBG_ENTER();
+
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+                       sizeof(cmd_data->nan_oui), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               return ret;
+       }
+
+       sub_cmd->id = htod16(WL_NAN_CMD_CFG_OUI);
+       sub_cmd->len = sizeof(sub_cmd->u.options) + sizeof(cmd_data->nan_oui);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       ret = memcpy_s(sub_cmd->data, sizeof(cmd_data->nan_oui),
+                       (uint32 *)&cmd_data->nan_oui,
+                       sizeof(cmd_data->nan_oui));
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to copy nan oui\n"));
+               return ret;
+       }
+
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_data->nan_iov_buf += subcmd_len;
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_set_awake_dws(struct net_device *ndev, nan_config_cmd_data_t *cmd_data,
+               wl_nan_iov_t *nan_iov_data, struct bcm_cfg80211 *cfg, uint32 nan_attr_mask)
+{
+       s32 ret = BCME_OK;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       wl_nan_awake_dws_t *awake_dws = NULL;
+       uint16 subcmd_len;
+       NAN_DBG_ENTER();
+
+       sub_cmd =
+               (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+                       sizeof(*awake_dws), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               return ret;
+       }
+
+       awake_dws = (wl_nan_awake_dws_t *)sub_cmd->data;
+
+       if (nan_attr_mask & NAN_ATTR_2G_DW_CONFIG) {
+               awake_dws->dw_interval_2g = cmd_data->awake_dws.dw_interval_2g;
+               if (!awake_dws->dw_interval_2g) {
+                       /* Set 2G awake dw value to fw default value 1 */
+                       awake_dws->dw_interval_2g = NAN_SYNC_DEF_AWAKE_DW;
+               }
+       } else {
+               /* Set 2G awake dw value to fw default value 1 */
+               awake_dws->dw_interval_2g = NAN_SYNC_DEF_AWAKE_DW;
+       }
+
+       if (cfg->nancfg->support_5g) {
+               if (nan_attr_mask & NAN_ATTR_5G_DW_CONFIG) {
+                       awake_dws->dw_interval_5g = cmd_data->awake_dws.dw_interval_5g;
+                       /* config sync/discovery beacons on 5G band */
+                       ret = wl_cfgnan_config_control_flag(ndev, cfg,
+                                       WL_NAN_CTRL_DISC_BEACON_TX_5G |
+                                       WL_NAN_CTRL_SYNC_BEACON_TX_5G,
+                                       0, WL_NAN_CMD_CFG_NAN_CONFIG,
+                                       &(cmd_data->status),
+                                       awake_dws->dw_interval_5g);
+                       if (unlikely(ret) || unlikely(cmd_data->status)) {
+                               WL_ERR((" nan control set config handler, ret = %d"
+                                       " status = %d \n", ret, cmd_data->status));
+                               goto fail;
+                       }
+               } else {
+                       /* Set 5G awake dw value to fw default value 1 */
+                       awake_dws->dw_interval_5g = NAN_SYNC_DEF_AWAKE_DW;
+               }
+       }
+
+       sub_cmd->id = htod16(WL_NAN_CMD_SYNC_AWAKE_DWS);
+       sub_cmd->len = sizeof(sub_cmd->u.options) +
+               sizeof(*awake_dws);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_data->nan_iov_buf += subcmd_len;
+
+fail:
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+int
+wl_cfgnan_set_enable_merge(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, uint8 enable, uint32 *status)
+{
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       s32 ret = BCME_OK;
+       uint16 nan_iov_start, nan_iov_end;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       uint16 subcmd_len;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       wl_nan_iov_t *nan_iov_data = NULL;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+       wl_nan_merge_enable_t merge_enable;
+       uint8 size_of_iov;
+
+       NAN_DBG_ENTER();
+
+       nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_iov_data = MALLOCZ(cfg->osh, sizeof(*nan_iov_data));
+       if (!nan_iov_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       merge_enable = (wl_nan_merge_enable_t)enable;
+       size_of_iov = sizeof(wl_nan_merge_enable_t);
+
+       nan_iov_data->nan_iov_len = nan_iov_start = NAN_IOCTL_BUF_SIZE;
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_iov_data->nan_iov_buf = (uint8 *)(&nan_buf->cmds[0]);
+       nan_iov_data->nan_iov_len -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+               size_of_iov, &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               goto fail;
+       }
+
+       sub_cmd->id = htod16(WL_NAN_CMD_ELECTION_MERGE);
+       sub_cmd->len = sizeof(sub_cmd->u.options) + size_of_iov;
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+
+       /* Reduce the iov_len size by subcmd_len */
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_end = nan_iov_data->nan_iov_len;
+       nan_buf_size = (nan_iov_start - nan_iov_end);
+
+       (void)memcpy_s(sub_cmd->data, nan_iov_data->nan_iov_len,
+               &merge_enable, size_of_iov);
+
+       nan_buf->is_set = true;
+       nan_buf->count++;
+       bzero(resp_buf, sizeof(resp_buf));
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size, status,
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(*status)) {
+               WL_ERR(("Merge enable %d failed ret %d status %d \n", merge_enable, ret, *status));
+               goto fail;
+       }
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+       if (nan_iov_data) {
+               MFREE(cfg->osh, nan_iov_data, sizeof(*nan_iov_data));
+       }
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_set_disc_beacon_interval_handler(struct net_device *ndev, struct bcm_cfg80211 *cfg,
+       wl_nan_disc_bcn_interval_t disc_beacon_interval)
+{
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       wl_nan_iov_t *nan_iov_data = NULL;
+       uint32 status;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       uint16 subcmd_len;
+       uint8 size_of_iov;
+
+       NAN_DBG_ENTER();
+       NAN_MUTEX_LOCK();
+
+       nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_iov_data = MALLOCZ(cfg->osh, sizeof(*nan_iov_data));
+       if (!nan_iov_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       size_of_iov = sizeof(wl_nan_disc_bcn_interval_t);
+       nan_iov_data->nan_iov_len = NAN_IOCTL_BUF_SIZE;
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_iov_data->nan_iov_buf = (uint8 *)(&nan_buf->cmds[0]);
+       nan_iov_data->nan_iov_len -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+                       size_of_iov, &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               goto fail;
+       }
+
+       /* Choose default value discovery beacon interval  if value is zero */
+       if (!disc_beacon_interval) {
+               disc_beacon_interval = cfg->nancfg->support_5g ? NAN_DISC_BCN_INTERVAL_5G_DEF:
+                       NAN_DISC_BCN_INTERVAL_2G_DEF;
+       }
+
+       /* Fill the sub_command block */
+       sub_cmd->id = htod16(WL_NAN_CMD_CFG_BCN_INTERVAL);
+       sub_cmd->len = sizeof(sub_cmd->u.options) + size_of_iov;
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       ret = memcpy_s(sub_cmd->data, nan_iov_data->nan_iov_len,
+                       &disc_beacon_interval, size_of_iov);
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to copy disc_beacon_interval\n"));
+               goto fail;
+       }
+
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_data->nan_iov_buf += subcmd_len;
+
+       nan_buf->count++;
+       nan_buf->is_set = true;
+       nan_buf_size -= nan_iov_data->nan_iov_len;
+       bzero(resp_buf, sizeof(resp_buf));
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size, &status,
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(status)) {
+               WL_ERR(("Failed to set disc beacon interval, ret = %d status = %d\n",
+                       ret, status));
+               goto fail;
+       }
+
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+       if (nan_iov_data) {
+               MFREE(cfg->osh, nan_iov_data, sizeof(*nan_iov_data));
+       }
+
+       NAN_MUTEX_UNLOCK();
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+int
+wl_cfgnan_check_nan_disable_pending(struct bcm_cfg80211 *cfg,
+       bool force_disable, bool is_sync_reqd)
+{
+       int ret = BCME_OK;
+       struct net_device *ndev = NULL;
+
+       if (delayed_work_pending(&cfg->nancfg->nan_disable)) {
+               WL_DBG(("Cancel nan_disable work\n"));
+               /*
+                * Nan gets disabled from dhd_stop(dev_close) and other frameworks contexts.
+                * Can't use cancel_work_sync from dhd_stop context for
+                * wl_cfgnan_delayed_disable since both contexts uses
+                * rtnl_lock resulting in deadlock. If dhd_stop gets invoked,
+                * rely on dhd_stop context to do the nan clean up work and
+                * just do return from delayed WQ based on state check.
+                */
+
+               DHD_NAN_WAKE_UNLOCK(cfg->pub);
+
+               if (is_sync_reqd == true) {
+                       cancel_delayed_work_sync(&cfg->nancfg->nan_disable);
+               } else {
+                       cancel_delayed_work(&cfg->nancfg->nan_disable);
+               }
+               force_disable = true;
+       }
+       if ((force_disable == true) && (cfg->nancfg->nan_enable == true)) {
+               ret = wl_cfgnan_disable(cfg);
+               if (ret != BCME_OK) {
+                       WL_ERR(("failed to disable nan, error[%d]\n", ret));
+               }
+               /* Intentional fall through to cleanup framework */
+               if (cfg->nancfg->notify_user == true) {
+                       ndev = bcmcfg_to_prmry_ndev(cfg);
+                       wl_cfgvendor_nan_send_async_disable_resp(ndev->ieee80211_ptr);
+               }
+       }
+       return ret;
+}
+
+int
+wl_cfgnan_start_handler(struct net_device *ndev, struct bcm_cfg80211 *cfg,
+       nan_config_cmd_data_t *cmd_data, uint32 nan_attr_mask)
+{
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       wl_nan_iov_t *nan_iov_data = NULL;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(ndev);
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+       int i;
+       s32 timeout = 0;
+       nan_hal_capabilities_t capabilities;
+       uint32 cfg_ctrl1_flags = 0;
+       uint32 cfg_ctrl2_flags1 = 0;
+       wl_nancfg_t *nancfg = cfg->nancfg;
+
+       NAN_DBG_ENTER();
+
+       /* Protect discovery creation. Ensure proper mutex precedence.
+        * If if_sync & nan_mutex comes together in same context, nan_mutex
+        * should follow if_sync.
+        */
+       mutex_lock(&cfg->if_sync);
+       NAN_MUTEX_LOCK();
+
+       if (!dhdp->up) {
+               WL_ERR(("bus is already down, hence blocking nan start\n"));
+               ret = BCME_ERROR;
+               NAN_MUTEX_UNLOCK();
+               mutex_unlock(&cfg->if_sync);
+               goto fail;
+       }
+
+#ifdef WL_IFACE_MGMT
+       if ((ret = wl_cfg80211_handle_if_role_conflict(cfg, WL_IF_TYPE_NAN_NMI)) != BCME_OK) {
+               WL_ERR(("Conflicting iface is present, cant support nan\n"));
+               NAN_MUTEX_UNLOCK();
+               mutex_unlock(&cfg->if_sync);
+               goto fail;
+       }
+#endif /* WL_IFACE_MGMT */
+
+       WL_INFORM_MEM(("Initializing NAN\n"));
+       ret = wl_cfgnan_init(cfg);
+       if (ret != BCME_OK) {
+               WL_ERR(("failed to initialize NAN[%d]\n", ret));
+               NAN_MUTEX_UNLOCK();
+               mutex_unlock(&cfg->if_sync);
+               goto fail;
+       }
+
+       ret = wl_cfgnan_get_ver(ndev, cfg);
+       if (ret != BCME_OK) {
+               WL_ERR(("failed to Nan IOV version[%d]\n", ret));
+               NAN_MUTEX_UNLOCK();
+               mutex_unlock(&cfg->if_sync);
+               goto fail;
+       }
+
+       /* set nmi addr */
+       ret = wl_cfgnan_set_if_addr(cfg);
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to set nmi address \n"));
+               NAN_MUTEX_UNLOCK();
+               mutex_unlock(&cfg->if_sync);
+               goto fail;
+       }
+       nancfg->nan_event_recvd = false;
+       NAN_MUTEX_UNLOCK();
+       mutex_unlock(&cfg->if_sync);
+
+       nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_iov_data = MALLOCZ(cfg->osh, sizeof(*nan_iov_data));
+       if (!nan_iov_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_iov_data->nan_iov_len = NAN_IOCTL_BUF_SIZE;
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_iov_data->nan_iov_buf = (uint8 *)(&nan_buf->cmds[0]);
+       nan_iov_data->nan_iov_len -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+
+       if (nan_attr_mask & NAN_ATTR_SYNC_DISC_2G_BEACON_CONFIG) {
+               /* config sync/discovery beacons on 2G band */
+               /* 2g is mandatory */
+               if (!cmd_data->beacon_2g_val) {
+                       WL_ERR(("Invalid NAN config...2G is mandatory\n"));
+                       ret = BCME_BADARG;
+               }
+               cfg_ctrl1_flags |= (WL_NAN_CTRL_DISC_BEACON_TX_2G | WL_NAN_CTRL_SYNC_BEACON_TX_2G);
+       }
+       if (nan_attr_mask & NAN_ATTR_SYNC_DISC_5G_BEACON_CONFIG) {
+               /* config sync/discovery beacons on 5G band */
+               cfg_ctrl1_flags |= (WL_NAN_CTRL_DISC_BEACON_TX_5G | WL_NAN_CTRL_SYNC_BEACON_TX_5G);
+       }
+
+       if (cmd_data->warmup_time) {
+               ret = wl_cfgnan_warmup_time_handler(cmd_data, nan_iov_data);
+               if (unlikely(ret)) {
+                       WL_ERR(("warm up time handler sub_cmd set failed\n"));
+                       goto fail;
+               }
+               nan_buf->count++;
+       }
+       /* setting master preference and random factor */
+       ret = wl_cfgnan_set_election_metric(cmd_data, nan_iov_data, nan_attr_mask);
+       if (unlikely(ret)) {
+               WL_ERR(("election_metric sub_cmd set failed\n"));
+               goto fail;
+       } else {
+               nan_buf->count++;
+       }
+
+       /* setting nan social channels */
+       ret = wl_cfgnan_set_nan_soc_chans(ndev, cmd_data, nan_iov_data, nan_attr_mask);
+       if (unlikely(ret)) {
+               WL_ERR(("nan social channels set failed\n"));
+               goto fail;
+       } else {
+               /* Storing 5g capability which is reqd for avail chan config. */
+               nancfg->support_5g = cmd_data->support_5g;
+               nan_buf->count++;
+       }
+
+       if ((cmd_data->support_2g) && ((cmd_data->dwell_time[0]) ||
+                       (cmd_data->scan_period[0]))) {
+               /* setting scan params */
+               ret = wl_cfgnan_set_nan_scan_params(ndev, cfg, cmd_data, 0, nan_attr_mask);
+               if (unlikely(ret)) {
+                       WL_ERR(("scan params set failed for 2g\n"));
+                       goto fail;
+               }
+       }
+
+       if ((cmd_data->support_5g) && ((cmd_data->dwell_time[1]) ||
+                       (cmd_data->scan_period[1]))) {
+               /* setting scan params */
+               ret = wl_cfgnan_set_nan_scan_params(ndev, cfg, cmd_data,
+                       cmd_data->support_5g, nan_attr_mask);
+               if (unlikely(ret)) {
+                       WL_ERR(("scan params set failed for 5g\n"));
+                       goto fail;
+               }
+       }
+
+       /*
+        * A cluster_low value matching cluster_high indicates a request
+        * to join a cluster with that value.
+        * If the requested cluster is not found the
+        * device will start its own cluster
+        */
+       /* For Debug purpose, using clust id compulsion */
+       if (cmd_data->cluster_low == cmd_data->cluster_high) {
+               /* device will merge to configured CID only */
+               cfg_ctrl1_flags |= (WL_NAN_CTRL_MERGE_CONF_CID_ONLY);
+       }
+       /* setting cluster ID */
+       ret = wl_cfgnan_set_cluster_id(cmd_data, nan_iov_data);
+       if (unlikely(ret)) {
+               WL_ERR(("cluster_id sub_cmd set failed\n"));
+               goto fail;
+       }
+       nan_buf->count++;
+
+       /* setting rssi proximaty values for 2.4GHz and 5GHz */
+       ret = wl_cfgnan_set_rssi_proximity(cmd_data, nan_iov_data, nan_attr_mask);
+       if (unlikely(ret)) {
+               WL_ERR(("2.4GHz/5GHz rssi proximity threshold set failed\n"));
+               goto fail;
+       } else {
+               nan_buf->count++;
+       }
+
+       /* setting rssi middle/close values for 2.4GHz and 5GHz */
+       ret = wl_cfgnan_set_rssi_mid_or_close(cmd_data, nan_iov_data, nan_attr_mask);
+       if (unlikely(ret)) {
+               WL_ERR(("2.4GHz/5GHz rssi middle and close set failed\n"));
+               goto fail;
+       } else {
+               nan_buf->count++;
+       }
+
+       /* setting hop count limit or threshold */
+       if (nan_attr_mask & NAN_ATTR_HOP_COUNT_LIMIT_CONFIG) {
+               ret = wl_cfgnan_set_hop_count_limit(cmd_data, nan_iov_data);
+               if (unlikely(ret)) {
+                       WL_ERR(("hop_count_limit sub_cmd set failed\n"));
+                       goto fail;
+               }
+               nan_buf->count++;
+       }
+
+       /* setting sid beacon val */
+       if ((nan_attr_mask & NAN_ATTR_SID_BEACON_CONFIG) ||
+               (nan_attr_mask & NAN_ATTR_SUB_SID_BEACON_CONFIG)) {
+               ret = wl_cfgnan_set_sid_beacon_val(cmd_data, nan_iov_data, nan_attr_mask);
+               if (unlikely(ret)) {
+                       WL_ERR(("sid_beacon sub_cmd set failed\n"));
+                       goto fail;
+               }
+               nan_buf->count++;
+       }
+
+       /* setting nan oui */
+       if (nan_attr_mask & NAN_ATTR_OUI_CONFIG) {
+               ret = wl_cfgnan_set_nan_oui(cmd_data, nan_iov_data);
+               if (unlikely(ret)) {
+                       WL_ERR(("nan_oui sub_cmd set failed\n"));
+                       goto fail;
+               }
+               nan_buf->count++;
+       }
+
+       /* setting nan awake dws */
+       ret = wl_cfgnan_set_awake_dws(ndev, cmd_data,
+                       nan_iov_data, cfg, nan_attr_mask);
+       if (unlikely(ret)) {
+               WL_ERR(("nan awake dws set failed\n"));
+               goto fail;
+       } else {
+               nan_buf->count++;
+       }
+
+       /* enable events */
+       ret = wl_cfgnan_config_eventmask(ndev, cfg, cmd_data->disc_ind_cfg, false);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to config disc ind flag in event_mask, ret = %d\n", ret));
+               goto fail;
+       }
+
+       /* setting nan enable sub_cmd */
+       ret = wl_cfgnan_enable_handler(nan_iov_data, true);
+       if (unlikely(ret)) {
+               WL_ERR(("enable handler sub_cmd set failed\n"));
+               goto fail;
+       }
+       nan_buf->count++;
+       nan_buf->is_set = true;
+
+       nan_buf_size -= nan_iov_data->nan_iov_len;
+       memset(resp_buf, 0, sizeof(resp_buf));
+       /* Reset conditon variable */
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size,
+                       &(cmd_data->status), (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(cmd_data->status)) {
+               WL_ERR((" nan start handler, enable failed, ret = %d status = %d \n",
+                               ret, cmd_data->status));
+               goto fail;
+       }
+
+       timeout = wait_event_timeout(nancfg->nan_event_wait,
+               nancfg->nan_event_recvd, msecs_to_jiffies(NAN_START_STOP_TIMEOUT));
+       if (!timeout) {
+               WL_ERR(("Timed out while Waiting for WL_NAN_EVENT_START event !!!\n"));
+               ret = BCME_ERROR;
+               goto fail;
+       }
+
+       /* Default flags: set NAN proprietary rates and auto datapath confirm
+        * If auto datapath confirms is set, then DPCONF will be sent by FW
+        */
+       cfg_ctrl1_flags |= (WL_NAN_CTRL_AUTO_DPCONF | WL_NAN_CTRL_PROP_RATE);
+
+       /* set CFG CTRL flags */
+       ret = wl_cfgnan_config_control_flag(ndev, cfg, cfg_ctrl1_flags,
+                       0, WL_NAN_CMD_CFG_NAN_CONFIG,
+                       &(cmd_data->status), true);
+       if (unlikely(ret) || unlikely(cmd_data->status)) {
+               WL_ERR((" nan ctrl1 config flags setting failed, ret = %d status = %d \n",
+                               ret, cmd_data->status));
+               goto fail;
+       }
+
+       /* malloc for ndp peer list */
+       if ((ret = wl_cfgnan_get_capablities_handler(ndev, cfg, &capabilities))
+                       == BCME_OK) {
+               nancfg->max_ndp_count = capabilities.max_ndp_sessions;
+               nancfg->max_ndi_supported = capabilities.max_ndi_interfaces;
+               nancfg->nan_ndp_peer_info = MALLOCZ(cfg->osh,
+                               nancfg->max_ndp_count * sizeof(nan_ndp_peer_t));
+               if (!nancfg->nan_ndp_peer_info) {
+                       WL_ERR(("%s: memory allocation failed\n", __func__));
+                       ret = BCME_NOMEM;
+                       goto fail;
+               }
+
+               if (!nancfg->ndi) {
+                       nancfg->ndi = MALLOCZ(cfg->osh,
+                                       nancfg->max_ndi_supported * sizeof(*nancfg->ndi));
+                       if (!nancfg->ndi) {
+                               WL_ERR(("%s: memory allocation failed\n", __func__));
+                               ret = BCME_NOMEM;
+                               goto fail;
+                       }
+               }
+       } else {
+               WL_ERR(("wl_cfgnan_get_capablities_handler failed, ret = %d\n", ret));
+               goto fail;
+       }
+
+       BCM_REFERENCE(i);
+#ifdef NAN_IFACE_CREATE_ON_UP
+       for (i = 0; i < nancfg->max_ndi_supported; i++) {
+               /* Create NDI using the information provided by user space */
+               if (nancfg->ndi[i].in_use && !nancfg->ndi[i].created) {
+                       ret = wl_cfgnan_data_path_iface_create_delete_handler(ndev, cfg,
+                               nancfg->ndi[i].ifname,
+                               NAN_WIFI_SUBCMD_DATA_PATH_IFACE_CREATE, dhdp->up);
+                       if (ret) {
+                               WL_ERR(("failed to create ndp interface [%d]\n", ret));
+                               goto fail;
+                       }
+                       nancfg->ndi[i].created = true;
+               }
+       }
+#endif /* NAN_IFACE_CREATE_ON_UP */
+
+       /* Check if NDPE is capable and use_ndpe_attr is set by framework */
+       /* TODO: For now enabling NDPE by default as framework is not setting use_ndpe_attr
+        * When (cmd_data->use_ndpe_attr) is set by framework, Add additional check for
+        * (cmd_data->use_ndpe_attr) as below
+        * if (capabilities.ndpe_attr_supported && cmd_data->use_ndpe_attr)
+        */
+       if (capabilities.ndpe_attr_supported)
+       {
+               cfg_ctrl2_flags1 |= WL_NAN_CTRL2_FLAG1_NDPE_CAP;
+               nancfg->ndpe_enabled = true;
+       } else {
+               /* reset NDPE capability in FW */
+               ret = wl_cfgnan_config_control_flag(ndev, cfg, WL_NAN_CTRL2_FLAG1_NDPE_CAP,
+                               0, WL_NAN_CMD_CFG_NAN_CONFIG2,
+                               &(cmd_data->status), false);
+               if (unlikely(ret) || unlikely(cmd_data->status)) {
+                       WL_ERR((" nan ctrl2 config flags resetting failed, ret = %d status = %d \n",
+                                       ret, cmd_data->status));
+                       goto fail;
+               }
+               nancfg->ndpe_enabled = false;
+       }
+
+       /* set CFG CTRL2 flags1 and flags2 */
+       ret = wl_cfgnan_config_control_flag(ndev, cfg, cfg_ctrl2_flags1,
+                       0, WL_NAN_CMD_CFG_NAN_CONFIG2,
+                       &(cmd_data->status), true);
+       if (unlikely(ret) || unlikely(cmd_data->status)) {
+               WL_ERR((" nan ctrl2 config flags setting failed, ret = %d status = %d \n",
+                               ret, cmd_data->status));
+               goto fail;
+       }
+
+#ifdef RTT_SUPPORT
+       /* Initialize geofence cfg */
+       dhd_rtt_initialize_geofence_cfg(cfg->pub);
+#endif /* RTT_SUPPORT */
+
+       if (cmd_data->dw_early_termination > 0) {
+               WL_ERR(("dw early termination is not supported, ignoring for now\n"));
+       }
+
+       if (nan_attr_mask & NAN_ATTR_DISC_BEACON_INTERVAL) {
+               ret = wl_cfgnan_set_disc_beacon_interval_handler(ndev, cfg,
+                       cmd_data->disc_bcn_interval);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to set beacon interval\n"));
+                       goto fail;
+               }
+       }
+
+       nancfg->nan_enable = true;
+       WL_INFORM_MEM(("[NAN] Enable successfull \n"));
+       /* disable TDLS on NAN NMI IF create  */
+       wl_cfg80211_tdls_config(cfg, TDLS_STATE_NMI_CREATE, false);
+
+fail:
+       /* reset conditon variable */
+       nancfg->nan_event_recvd = false;
+       if (unlikely(ret) || unlikely(cmd_data->status)) {
+               nancfg->nan_enable = false;
+               mutex_lock(&cfg->if_sync);
+               ret = wl_cfg80211_delete_iface(cfg, WL_IF_TYPE_NAN);
+               if (ret != BCME_OK) {
+                       WL_ERR(("failed to delete NDI[%d]\n", ret));
+               }
+               mutex_unlock(&cfg->if_sync);
+               if (nancfg->nan_ndp_peer_info) {
+                       MFREE(cfg->osh, nancfg->nan_ndp_peer_info,
+                                       nancfg->max_ndp_count * sizeof(nan_ndp_peer_t));
+                       nancfg->nan_ndp_peer_info = NULL;
+               }
+               if (nancfg->ndi) {
+                       MFREE(cfg->osh, nancfg->ndi,
+                                       nancfg->max_ndi_supported * sizeof(*nancfg->ndi));
+                       nancfg->ndi = NULL;
+               }
+       }
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+       if (nan_iov_data) {
+               MFREE(cfg->osh, nan_iov_data, sizeof(*nan_iov_data));
+       }
+
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_disable(struct bcm_cfg80211 *cfg)
+{
+       s32 ret = BCME_OK;
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       NAN_DBG_ENTER();
+       if ((cfg->nancfg->nan_init_state == TRUE) &&
+                       (cfg->nancfg->nan_enable == TRUE)) {
+               struct net_device *ndev;
+               ndev = bcmcfg_to_prmry_ndev(cfg);
+
+               /* We have to remove NDIs so that P2P/Softap can work */
+               ret = wl_cfg80211_delete_iface(cfg, WL_IF_TYPE_NAN);
+               if (ret != BCME_OK) {
+                       WL_ERR(("failed to delete NDI[%d]\n", ret));
+               }
+
+               ret = wl_cfgnan_stop_handler(ndev, cfg);
+               if (ret == -ENODEV) {
+                       WL_ERR(("Bus is down, no need to proceed\n"));
+               } else if (ret != BCME_OK) {
+                       WL_ERR(("failed to stop nan, error[%d]\n", ret));
+               }
+               ret = wl_cfgnan_deinit(cfg, dhdp->up);
+               if (ret != BCME_OK) {
+                       WL_ERR(("failed to de-initialize NAN[%d]\n", ret));
+                       if (!dhd_query_bus_erros(dhdp)) {
+                               ASSERT(0);
+                       }
+               }
+               wl_cfgnan_disable_cleanup(cfg);
+       }
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static void
+wl_cfgnan_send_stop_event(struct bcm_cfg80211 *cfg)
+{
+       s32 ret = BCME_OK;
+       nan_event_data_t *nan_event_data = NULL;
+
+       NAN_DBG_ENTER();
+
+       nan_event_data = MALLOCZ(cfg->osh, sizeof(nan_event_data_t));
+       if (!nan_event_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+       bzero(nan_event_data, sizeof(nan_event_data_t));
+
+       nan_event_data->status = NAN_STATUS_SUCCESS;
+       ret = memcpy_s(nan_event_data->nan_reason, NAN_ERROR_STR_LEN,
+                       "NAN_STATUS_SUCCESS", strlen("NAN_STATUS_SUCCESS"));
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to copy nan reason string, ret = %d\n", ret));
+               goto exit;
+       }
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 13, 0)) || defined(WL_VENDOR_EXT_SUPPORT)
+       ret = wl_cfgvendor_send_nan_event(cfg->wdev->wiphy, bcmcfg_to_prmry_ndev(cfg),
+                       GOOGLE_NAN_EVENT_DISABLED, nan_event_data);
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to send event to nan hal, (%d)\n",
+                               GOOGLE_NAN_EVENT_DISABLED));
+       }
+#endif /* (LINUX_VERSION_CODE > KERNEL_VERSION(3, 13, 0)) || defined(WL_VENDOR_EXT_SUPPORT) */
+exit:
+       if (nan_event_data) {
+               MFREE(cfg->osh, nan_event_data, sizeof(nan_event_data_t));
+       }
+       NAN_DBG_EXIT();
+       return;
+}
+
+static void
+wl_cfgnan_disable_cleanup(struct bcm_cfg80211 *cfg)
+{
+       int i = 0;
+       wl_nancfg_t *nancfg = cfg->nancfg;
+#ifdef RTT_SUPPORT
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhdp);
+       rtt_target_info_t *target_info = NULL;
+
+       /* Delete the geofence rtt target list */
+       dhd_rtt_delete_geofence_target_list(dhdp);
+       /* Cancel pending retry timer if any */
+       if (delayed_work_pending(&rtt_status->rtt_retry_timer)) {
+               cancel_delayed_work_sync(&rtt_status->rtt_retry_timer);
+       }
+       /* Remove if any pending proxd timeout for nan-rtt */
+       target_info = &rtt_status->rtt_config.target_info[rtt_status->cur_idx];
+       if (target_info && target_info->peer == RTT_PEER_NAN) {
+               /* Cancel pending proxd timeout work if any */
+               if (delayed_work_pending(&rtt_status->proxd_timeout)) {
+                       cancel_delayed_work_sync(&rtt_status->proxd_timeout);
+               }
+       }
+       /* Delete if any directed nan rtt session */
+       dhd_rtt_delete_nan_session(dhdp);
+#endif /* RTT_SUPPORT */
+       /* Clear the NDP ID array and dp count */
+       for (i = 0; i < NAN_MAX_NDP_PEER; i++) {
+               nancfg->ndp_id[i] = 0;
+       }
+       nancfg->nan_dp_count = 0;
+       if (nancfg->nan_ndp_peer_info) {
+               MFREE(cfg->osh, nancfg->nan_ndp_peer_info,
+                       nancfg->max_ndp_count * sizeof(nan_ndp_peer_t));
+               nancfg->nan_ndp_peer_info = NULL;
+       }
+       if (nancfg->ndi) {
+               MFREE(cfg->osh, nancfg->ndi,
+                       nancfg->max_ndi_supported * sizeof(*nancfg->ndi));
+               nancfg->ndi = NULL;
+       }
+       return;
+}
+
+/*
+ * Deferred nan disable work,
+ * scheduled with NAN_DISABLE_CMD_DELAY
+ * delay in order to remove any active nan dps
+ */
+void
+wl_cfgnan_delayed_disable(struct work_struct *work)
+{
+       struct bcm_cfg80211 *cfg = NULL;
+       struct net_device *ndev = NULL;
+       wl_nancfg_t *nancfg = NULL;
+
+       BCM_SET_CONTAINER_OF(nancfg, work, wl_nancfg_t, nan_disable.work);
+
+       cfg = nancfg->cfg;
+
+       rtnl_lock();
+       if (nancfg->nan_enable == true) {
+               wl_cfgnan_disable(cfg);
+               ndev = bcmcfg_to_prmry_ndev(cfg);
+               wl_cfgvendor_nan_send_async_disable_resp(ndev->ieee80211_ptr);
+       } else {
+               WL_INFORM_MEM(("nan is in disabled state\n"));
+       }
+       rtnl_unlock();
+
+       DHD_NAN_WAKE_UNLOCK(cfg->pub);
+
+       return;
+}
+
+int
+wl_cfgnan_stop_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg)
+{
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       wl_nan_iov_t *nan_iov_data = NULL;
+       uint32 status;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       wl_nancfg_t *nancfg = cfg->nancfg;
+
+       NAN_DBG_ENTER();
+       NAN_MUTEX_LOCK();
+
+       if (!nancfg->nan_enable) {
+               WL_INFORM(("Nan is not enabled\n"));
+               ret = BCME_OK;
+               goto fail;
+       }
+
+       if (dhdp->up != DHD_BUS_DOWN) {
+               /*
+                * Framework doing cleanup(iface remove) on disable command,
+                * so avoiding event to prevent iface delete calls again
+                */
+               WL_INFORM_MEM(("[NAN] Disabling Nan events\n"));
+               wl_cfgnan_config_eventmask(ndev, cfg, 0, true);
+
+               nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+               if (!nan_buf) {
+                       WL_ERR(("%s: memory allocation failed\n", __func__));
+                       ret = BCME_NOMEM;
+                       goto fail;
+               }
+
+               nan_iov_data = MALLOCZ(cfg->osh, sizeof(*nan_iov_data));
+               if (!nan_iov_data) {
+                       WL_ERR(("%s: memory allocation failed\n", __func__));
+                       ret = BCME_NOMEM;
+                       goto fail;
+               }
+
+               nan_iov_data->nan_iov_len = NAN_IOCTL_BUF_SIZE;
+               nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+               nan_buf->count = 0;
+               nan_iov_data->nan_iov_buf = (uint8 *)(&nan_buf->cmds[0]);
+               nan_iov_data->nan_iov_len -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+
+               ret = wl_cfgnan_enable_handler(nan_iov_data, false);
+               if (unlikely(ret)) {
+                       WL_ERR(("nan disable handler failed\n"));
+                       goto fail;
+               }
+               nan_buf->count++;
+               nan_buf->is_set = true;
+               nan_buf_size -= nan_iov_data->nan_iov_len;
+               bzero(resp_buf, sizeof(resp_buf));
+               ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size, &status,
+                               (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+               if (unlikely(ret) || unlikely(status)) {
+                       WL_ERR(("nan disable failed ret = %d status = %d\n", ret, status));
+                       goto fail;
+               }
+               /* Enable back TDLS if connected interface is <= 1 */
+               wl_cfg80211_tdls_config(cfg, TDLS_STATE_IF_DELETE, false);
+       }
+
+       if (!nancfg->notify_user) {
+               wl_cfgnan_send_stop_event(cfg);
+       }
+fail:
+       /* Resetting instance ID mask */
+       nancfg->inst_id_start = 0;
+       memset(nancfg->svc_inst_id_mask, 0, sizeof(nancfg->svc_inst_id_mask));
+       memset(nancfg->svc_info, 0, NAN_MAX_SVC_INST * sizeof(nan_svc_info_t));
+       nancfg->nan_enable = false;
+       WL_INFORM_MEM(("[NAN] Disable done\n"));
+
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+       if (nan_iov_data) {
+               MFREE(cfg->osh, nan_iov_data, sizeof(*nan_iov_data));
+       }
+
+       NAN_MUTEX_UNLOCK();
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+int
+wl_cfgnan_config_handler(struct net_device *ndev, struct bcm_cfg80211 *cfg,
+       nan_config_cmd_data_t *cmd_data, uint32 nan_attr_mask)
+{
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       wl_nan_iov_t *nan_iov_data = NULL;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+
+       NAN_DBG_ENTER();
+
+       /* Nan need to be enabled before configuring/updating params */
+       if (!cfg->nancfg->nan_enable) {
+               WL_INFORM(("nan is not enabled\n"));
+               ret = BCME_NOTENABLED;
+               goto fail;
+       }
+
+       nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_iov_data = MALLOCZ(cfg->osh, sizeof(*nan_iov_data));
+       if (!nan_iov_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_iov_data->nan_iov_len = NAN_IOCTL_BUF_SIZE;
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_iov_data->nan_iov_buf = (uint8 *)(&nan_buf->cmds[0]);
+       nan_iov_data->nan_iov_len -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+
+       /* setting sid beacon val */
+       if ((nan_attr_mask & NAN_ATTR_SID_BEACON_CONFIG) ||
+               (nan_attr_mask & NAN_ATTR_SUB_SID_BEACON_CONFIG)) {
+               ret = wl_cfgnan_set_sid_beacon_val(cmd_data, nan_iov_data, nan_attr_mask);
+               if (unlikely(ret)) {
+                       WL_ERR(("sid_beacon sub_cmd set failed\n"));
+                       goto fail;
+               }
+               nan_buf->count++;
+       }
+
+       /* setting master preference and random factor */
+       if (cmd_data->metrics.random_factor ||
+               cmd_data->metrics.master_pref) {
+               ret = wl_cfgnan_set_election_metric(cmd_data, nan_iov_data,
+                               nan_attr_mask);
+               if (unlikely(ret)) {
+                       WL_ERR(("election_metric sub_cmd set failed\n"));
+                       goto fail;
+               } else {
+                       nan_buf->count++;
+               }
+       }
+
+       /* setting hop count limit or threshold */
+       if (nan_attr_mask & NAN_ATTR_HOP_COUNT_LIMIT_CONFIG) {
+               ret = wl_cfgnan_set_hop_count_limit(cmd_data, nan_iov_data);
+               if (unlikely(ret)) {
+                       WL_ERR(("hop_count_limit sub_cmd set failed\n"));
+                       goto fail;
+               }
+               nan_buf->count++;
+       }
+
+       /* setting rssi proximaty values for 2.4GHz and 5GHz */
+       ret = wl_cfgnan_set_rssi_proximity(cmd_data, nan_iov_data,
+                       nan_attr_mask);
+       if (unlikely(ret)) {
+               WL_ERR(("2.4GHz/5GHz rssi proximity threshold set failed\n"));
+               goto fail;
+       } else {
+               nan_buf->count++;
+       }
+
+       /* setting nan awake dws */
+       ret = wl_cfgnan_set_awake_dws(ndev, cmd_data, nan_iov_data,
+               cfg, nan_attr_mask);
+       if (unlikely(ret)) {
+               WL_ERR(("nan awake dws set failed\n"));
+               goto fail;
+       } else {
+               nan_buf->count++;
+       }
+
+       /* TODO: Add below code once use_ndpe_attr is being updated by framework
+        * If NDPE is enabled (cfg.nancfg.ndpe_enabled) and use_ndpe_attr is reset
+        * by framework, then disable NDPE using nan ctrl2 configuration setting.
+        * Else if NDPE is disabled and use_ndpe_attr is set by framework enable NDPE in FW
+        */
+
+       if (cmd_data->disc_ind_cfg) {
+               /* Disable events */
+               WL_TRACE(("Disable events based on flag\n"));
+               ret = wl_cfgnan_config_eventmask(ndev, cfg,
+                       cmd_data->disc_ind_cfg, false);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to config disc ind flag in event_mask, ret = %d\n",
+                               ret));
+                       goto fail;
+               }
+       }
+
+       if ((cfg->nancfg->support_5g) && ((cmd_data->dwell_time[1]) ||
+                       (cmd_data->scan_period[1]))) {
+               /* setting scan params */
+               ret = wl_cfgnan_set_nan_scan_params(ndev, cfg,
+                               cmd_data, cfg->nancfg->support_5g, nan_attr_mask);
+               if (unlikely(ret)) {
+                       WL_ERR(("scan params set failed for 5g\n"));
+                       goto fail;
+               }
+       }
+       if ((cmd_data->dwell_time[0]) ||
+                       (cmd_data->scan_period[0])) {
+               ret = wl_cfgnan_set_nan_scan_params(ndev, cfg, cmd_data, 0, nan_attr_mask);
+               if (unlikely(ret)) {
+                       WL_ERR(("scan params set failed for 2g\n"));
+                       goto fail;
+               }
+       }
+       nan_buf->is_set = true;
+       nan_buf_size -= nan_iov_data->nan_iov_len;
+
+       if (nan_buf->count) {
+               bzero(resp_buf, sizeof(resp_buf));
+               ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size,
+                               &(cmd_data->status),
+                               (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+               if (unlikely(ret) || unlikely(cmd_data->status)) {
+                       WL_ERR((" nan config handler failed ret = %d status = %d\n",
+                               ret, cmd_data->status));
+                       goto fail;
+               }
+       } else {
+               WL_DBG(("No commands to send\n"));
+       }
+
+       if ((!cmd_data->bmap) || (cmd_data->avail_params.duration == NAN_BAND_INVALID) ||
+                       (!cmd_data->chanspec[0])) {
+               WL_TRACE(("mandatory arguments are not present to set avail\n"));
+               ret = BCME_OK;
+       } else {
+               cmd_data->avail_params.chanspec[0] = cmd_data->chanspec[0];
+               cmd_data->avail_params.bmap = cmd_data->bmap;
+               /* 1=local, 2=peer, 3=ndc, 4=immutable, 5=response, 6=counter */
+               ret = wl_cfgnan_set_nan_avail(bcmcfg_to_prmry_ndev(cfg),
+                               cfg, &cmd_data->avail_params, WL_AVAIL_LOCAL);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to set avail value with type local\n"));
+                       goto fail;
+               }
+
+               ret = wl_cfgnan_set_nan_avail(bcmcfg_to_prmry_ndev(cfg),
+                               cfg, &cmd_data->avail_params, WL_AVAIL_NDC);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to set avail value with type ndc\n"));
+                       goto fail;
+               }
+       }
+
+       if (cmd_data->nmi_rand_intvl > 0) {
+#ifdef WL_NAN_ENABLE_MERGE
+               /* Cluster merge enable/disable are being set using nmi random interval config param
+                * If MSB(31st bit) is set that indicates cluster merge enable/disable config is set
+                * MSB 30th bit indicates cluser merge enable/disable value to set in firmware
+                */
+               if (cmd_data->nmi_rand_intvl & NAN_NMI_RAND_PVT_CMD_VENDOR) {
+                       uint8 merge_enable;
+                       uint8 lwt_mode_enable;
+                       int status = BCME_OK;
+
+                       merge_enable = !!(cmd_data->nmi_rand_intvl &
+                                       NAN_NMI_RAND_CLUSTER_MERGE_ENAB);
+                       ret = wl_cfgnan_set_enable_merge(bcmcfg_to_prmry_ndev(cfg), cfg,
+                                       merge_enable, &status);
+                       if (unlikely(ret) || unlikely(status)) {
+                               WL_ERR(("Enable merge: failed to set config request  [%d]\n", ret));
+                               /* As there is no cmd_reply, check if error is in status or ret */
+                               if (status) {
+                                       ret = status;
+                               }
+                               goto fail;
+                       }
+
+                       lwt_mode_enable = !!(cmd_data->nmi_rand_intvl &
+                                       NAN_NMI_RAND_AUTODAM_LWT_MODE_ENAB);
+
+                       /* set CFG CTRL2 flags1 and flags2 */
+                       ret = wl_cfgnan_config_control_flag(ndev, cfg,
+                                       WL_NAN_CTRL2_FLAG1_AUTODAM_LWT_MODE,
+                                       0, WL_NAN_CMD_CFG_NAN_CONFIG2,
+                                       &status, lwt_mode_enable);
+                       if (unlikely(ret) || unlikely(status)) {
+                               WL_ERR(("Enable dam lwt mode: "
+                                       "failed to set config request  [%d]\n", ret));
+                               /* As there is no cmd_reply, check if error is in status or ret */
+                               if (status) {
+                                       ret = status;
+                               }
+                               goto fail;
+                       }
+
+                       /* reset pvt merge enable bits */
+                       cmd_data->nmi_rand_intvl &= ~(NAN_NMI_RAND_PVT_CMD_VENDOR |
+                                       NAN_NMI_RAND_CLUSTER_MERGE_ENAB |
+                                       NAN_NMI_RAND_AUTODAM_LWT_MODE_ENAB);
+               }
+#endif /* WL_NAN_ENABLE_MERGE */
+
+               if (cmd_data->nmi_rand_intvl) {
+                       /* run time nmi rand not supported as of now.
+                        * Only during nan enable/iface-create rand mac is used
+                        */
+                       WL_ERR(("run time nmi rand not supported, ignoring for now\n"));
+               }
+       }
+
+       if (cmd_data->dw_early_termination > 0) {
+               WL_ERR(("dw early termination is not supported, ignoring for now\n"));
+       }
+
+       if (nan_attr_mask & NAN_ATTR_DISC_BEACON_INTERVAL) {
+               ret = wl_cfgnan_set_disc_beacon_interval_handler(ndev, cfg,
+                       cmd_data->disc_bcn_interval);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to set beacon interval\n"));
+                       goto fail;
+               }
+       }
+
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+       if (nan_iov_data) {
+               MFREE(cfg->osh, nan_iov_data, sizeof(*nan_iov_data));
+       }
+
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+int
+wl_cfgnan_support_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_config_cmd_data_t *cmd_data)
+{
+       /* TODO: */
+       return BCME_OK;
+}
+
+int
+wl_cfgnan_status_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_config_cmd_data_t *cmd_data)
+{
+       /* TODO: */
+       return BCME_OK;
+}
+
+#ifdef WL_NAN_DISC_CACHE
+static
+nan_svc_info_t *
+wl_cfgnan_get_svc_inst(struct bcm_cfg80211 *cfg,
+       wl_nan_instance_id svc_inst_id, uint8 ndp_id)
+{
+       uint8 i, j;
+       wl_nancfg_t *nancfg = cfg->nancfg;
+       if (ndp_id) {
+               for (i = 0; i < NAN_MAX_SVC_INST; i++) {
+                       for (j = 0; j < NAN_MAX_SVC_INST; j++) {
+                               if (nancfg->svc_info[i].ndp_id[j] == ndp_id) {
+                                       return &nancfg->svc_info[i];
+                               }
+                       }
+               }
+       } else if (svc_inst_id) {
+               for (i = 0; i < NAN_MAX_SVC_INST; i++) {
+                       if (nancfg->svc_info[i].svc_id == svc_inst_id) {
+                               return &nancfg->svc_info[i];
+                       }
+               }
+
+       }
+       return NULL;
+}
+
+static int
+wl_cfgnan_svc_inst_add_ndp(struct bcm_cfg80211 *cfg,
+       wl_nan_instance_id svc_inst_id, uint8 ndp_id)
+{
+       int ret = BCME_OK, i;
+       nan_svc_info_t *svc_info;
+
+       svc_info = wl_cfgnan_get_svc_inst(cfg, svc_inst_id, 0);
+       if (svc_info) {
+               for (i = 0; i < NAN_MAX_SVC_INST; i++) {
+                       if (!svc_info->ndp_id[i]) {
+                               WL_TRACE(("Found empty field\n"));
+                               break;
+                       }
+               }
+               if (i == NAN_MAX_SVC_INST) {
+                       WL_ERR(("%s:cannot accommadate ndp id\n", __FUNCTION__));
+                       ret = BCME_NORESOURCE;
+                       goto done;
+               }
+               svc_info->ndp_id[i] = ndp_id;
+       }
+
+done:
+       return ret;
+}
+
+static int
+wl_cfgnan_svc_inst_del_ndp(struct bcm_cfg80211 *cfg,
+       wl_nan_instance_id svc_inst_id, uint8 ndp_id)
+{
+       int ret = BCME_OK, i;
+       nan_svc_info_t *svc_info;
+
+       svc_info = wl_cfgnan_get_svc_inst(cfg, svc_inst_id, 0);
+
+       if (svc_info) {
+               for (i = 0; i < NAN_MAX_SVC_INST; i++) {
+                       if (svc_info->ndp_id[i] == ndp_id) {
+                               svc_info->ndp_id[i] = 0;
+                               break;
+                       }
+               }
+               if (i == NAN_MAX_SVC_INST) {
+                       WL_ERR(("couldn't find entry for ndp id = %d\n", ndp_id));
+                       ret = BCME_NOTFOUND;
+               }
+       }
+       return ret;
+}
+
+nan_ranging_inst_t *
+wl_cfgnan_check_for_ranging(struct bcm_cfg80211 *cfg, struct ether_addr *peer)
+{
+       uint8 i;
+       if (peer) {
+               for (i = 0; i < NAN_MAX_RANGING_INST; i++) {
+                       if (!memcmp(peer, &cfg->nancfg->nan_ranging_info[i].peer_addr,
+                               ETHER_ADDR_LEN)) {
+                               return &(cfg->nancfg->nan_ranging_info[i]);
+                       }
+               }
+       }
+       return NULL;
+}
+
+nan_ranging_inst_t *
+wl_cfgnan_get_rng_inst_by_id(struct bcm_cfg80211 *cfg, uint8 rng_id)
+{
+       uint8 i;
+       if (rng_id) {
+               for (i = 0; i < NAN_MAX_RANGING_INST; i++) {
+                       if (cfg->nancfg->nan_ranging_info[i].range_id == rng_id)
+                       {
+                               return &(cfg->nancfg->nan_ranging_info[i]);
+                       }
+               }
+       }
+       WL_ERR(("Couldn't find the ranging instance for rng_id %d\n", rng_id));
+       return NULL;
+}
+
+/*
+ * Find ranging inst for given peer,
+ * On not found, create one
+ * with given range role
+ */
+nan_ranging_inst_t *
+wl_cfgnan_get_ranging_inst(struct bcm_cfg80211 *cfg, struct ether_addr *peer,
+       nan_range_role_t range_role)
+{
+       nan_ranging_inst_t *ranging_inst = NULL;
+       uint8 i;
+
+       if (!peer) {
+               WL_ERR(("Peer address is NULL"));
+               goto done;
+       }
+
+       ranging_inst = wl_cfgnan_check_for_ranging(cfg, peer);
+       if (ranging_inst) {
+               goto done;
+       }
+       WL_TRACE(("Creating Ranging instance \n"));
+
+       for (i =  0; i < NAN_MAX_RANGING_INST; i++) {
+               if (cfg->nancfg->nan_ranging_info[i].in_use == FALSE) {
+                       break;
+               }
+       }
+
+       if (i == NAN_MAX_RANGING_INST) {
+               WL_ERR(("No buffer available for the ranging instance"));
+               goto done;
+       }
+       ranging_inst = &cfg->nancfg->nan_ranging_info[i];
+       memcpy(&ranging_inst->peer_addr, peer, ETHER_ADDR_LEN);
+       ranging_inst->range_status = NAN_RANGING_REQUIRED;
+       ranging_inst->prev_distance_mm = INVALID_DISTANCE;
+       ranging_inst->range_role = range_role;
+       ranging_inst->in_use = TRUE;
+
+done:
+       return ranging_inst;
+}
+#endif /* WL_NAN_DISC_CACHE */
+
+static int
+process_resp_buf(void *iov_resp,
+       uint8 *instance_id, uint16 sub_cmd_id)
+{
+       int res = BCME_OK;
+       NAN_DBG_ENTER();
+
+       if (sub_cmd_id == WL_NAN_CMD_DATA_DATAREQ) {
+               wl_nan_dp_req_ret_t *dpreq_ret = NULL;
+               dpreq_ret = (wl_nan_dp_req_ret_t *)(iov_resp);
+               *instance_id = dpreq_ret->ndp_id;
+               WL_TRACE(("%s: Initiator NDI: " MACDBG "\n",
+                       __FUNCTION__, MAC2STRDBG(dpreq_ret->indi.octet)));
+       } else if (sub_cmd_id == WL_NAN_CMD_RANGE_REQUEST) {
+               wl_nan_range_id *range_id = NULL;
+               range_id = (wl_nan_range_id *)(iov_resp);
+               *instance_id = *range_id;
+               WL_TRACE(("Range id: %d\n", *range_id));
+       }
+       WL_DBG(("instance_id: %d\n", *instance_id));
+       NAN_DBG_EXIT();
+       return res;
+}
+
+int
+wl_cfgnan_cancel_ranging(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, uint8 *range_id, uint8 flags, uint32 *status)
+{
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       s32 ret = BCME_OK;
+       uint16 nan_iov_start, nan_iov_end;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       uint16 subcmd_len;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       wl_nan_iov_t *nan_iov_data = NULL;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+       wl_nan_range_cancel_ext_t rng_cncl;
+       uint8 size_of_iov;
+
+       NAN_DBG_ENTER();
+
+       if (*range_id == 0) {
+               WL_ERR(("Invalid Range ID\n"));
+               ret = BCME_BADARG;
+               goto fail;
+       }
+
+       if (cfg->nancfg->version >= NAN_RANGE_EXT_CANCEL_SUPPORT_VER) {
+               size_of_iov = sizeof(rng_cncl);
+       } else {
+               size_of_iov = sizeof(*range_id);
+       }
+
+       bzero(&rng_cncl, sizeof(rng_cncl));
+       rng_cncl.range_id = *range_id;
+       rng_cncl.flags = flags;
+
+       nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_iov_data = MALLOCZ(cfg->osh, sizeof(*nan_iov_data));
+       if (!nan_iov_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_iov_data->nan_iov_len = nan_iov_start = NAN_IOCTL_BUF_SIZE;
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_iov_data->nan_iov_buf = (uint8 *)(&nan_buf->cmds[0]);
+       nan_iov_data->nan_iov_len -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(nan_iov_data->nan_iov_buf);
+
+       ret = wl_cfg_nan_check_cmd_len(nan_iov_data->nan_iov_len,
+               size_of_iov, &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               goto fail;
+       }
+
+       sub_cmd->id = htod16(WL_NAN_CMD_RANGE_CANCEL);
+       sub_cmd->len = sizeof(sub_cmd->u.options) + size_of_iov;
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+
+       /* Reduce the iov_len size by subcmd_len */
+       nan_iov_data->nan_iov_len -= subcmd_len;
+       nan_iov_end = nan_iov_data->nan_iov_len;
+       nan_buf_size = (nan_iov_start - nan_iov_end);
+
+       if (size_of_iov >= sizeof(rng_cncl)) {
+               (void)memcpy_s(sub_cmd->data, nan_iov_data->nan_iov_len,
+                       &rng_cncl, size_of_iov);
+       } else {
+               (void)memcpy_s(sub_cmd->data, nan_iov_data->nan_iov_len,
+                       range_id, size_of_iov);
+       }
+
+       nan_buf->is_set = true;
+       nan_buf->count++;
+       bzero(resp_buf, sizeof(resp_buf));
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size, status,
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(*status)) {
+               WL_ERR(("Range ID %d cancel failed ret %d status %d \n", *range_id, ret, *status));
+               goto fail;
+       }
+       WL_MEM(("Range cancel with Range ID [%d] successfull\n", *range_id));
+
+       /* Resetting range id */
+       *range_id = 0;
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+       if (nan_iov_data) {
+               MFREE(cfg->osh, nan_iov_data, sizeof(*nan_iov_data));
+       }
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+#ifdef WL_NAN_DISC_CACHE
+static void
+wl_cfgnan_clear_svc_cache(struct bcm_cfg80211 *cfg,
+       wl_nan_instance_id svc_id)
+{
+       nan_svc_info_t *svc;
+       svc = wl_cfgnan_get_svc_inst(cfg, svc_id, 0);
+       if (svc) {
+               WL_DBG(("clearing cached svc info for svc id %d\n", svc_id));
+               memset(svc, 0, sizeof(*svc));
+       }
+}
+
+static int
+wl_cfgnan_cache_svc_info(struct bcm_cfg80211 *cfg,
+       nan_discover_cmd_data_t *cmd_data, uint16 cmd_id, bool update)
+{
+       int ret = BCME_OK;
+       int i;
+       nan_svc_info_t *svc_info;
+       uint8 svc_id = (cmd_id == WL_NAN_CMD_SD_SUBSCRIBE) ? cmd_data->sub_id :
+               cmd_data->pub_id;
+       wl_nancfg_t *nancfg = cfg->nancfg;
+
+       for (i = 0; i < NAN_MAX_SVC_INST; i++) {
+               if (update) {
+                       if (nancfg->svc_info[i].svc_id == svc_id) {
+                               svc_info = &nancfg->svc_info[i];
+                               break;
+                       } else {
+                               continue;
+                       }
+               }
+               if (!nancfg->svc_info[i].svc_id) {
+                       svc_info = &nancfg->svc_info[i];
+                       break;
+               }
+       }
+       if (i == NAN_MAX_SVC_INST) {
+               WL_ERR(("%s:cannot accomodate ranging session\n", __FUNCTION__));
+               ret = BCME_NORESOURCE;
+               goto fail;
+       }
+       if (cmd_data->sde_control_flag & NAN_SDE_CF_RANGING_REQUIRED) {
+               WL_TRACE(("%s: updating ranging info, enabling", __FUNCTION__));
+               svc_info->status = 1;
+               svc_info->ranging_interval = cmd_data->ranging_intvl_msec;
+               svc_info->ranging_ind = cmd_data->ranging_indication;
+               svc_info->ingress_limit = cmd_data->ingress_limit;
+               svc_info->egress_limit = cmd_data->egress_limit;
+               svc_info->ranging_required = 1;
+       } else {
+               WL_TRACE(("%s: updating ranging info, disabling", __FUNCTION__));
+               svc_info->status = 0;
+               svc_info->ranging_interval = 0;
+               svc_info->ranging_ind = 0;
+               svc_info->ingress_limit = 0;
+               svc_info->egress_limit = 0;
+               svc_info->ranging_required = 0;
+       }
+
+       /* Reset Range status flags on svc creation/update */
+       svc_info->svc_range_status = 0;
+       svc_info->flags = cmd_data->flags;
+
+       if (cmd_id == WL_NAN_CMD_SD_SUBSCRIBE) {
+               svc_info->svc_id = cmd_data->sub_id;
+               if ((cmd_data->flags & WL_NAN_SUB_ACTIVE) &&
+                       (cmd_data->tx_match.dlen)) {
+                       ret = memcpy_s(svc_info->tx_match_filter, sizeof(svc_info->tx_match_filter),
+                               cmd_data->tx_match.data, cmd_data->tx_match.dlen);
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy tx match filter data\n"));
+                               goto fail;
+                       }
+                       svc_info->tx_match_filter_len = cmd_data->tx_match.dlen;
+               }
+       } else {
+               svc_info->svc_id = cmd_data->pub_id;
+       }
+       ret = memcpy_s(svc_info->svc_hash, sizeof(svc_info->svc_hash),
+                       cmd_data->svc_hash.data, WL_NAN_SVC_HASH_LEN);
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to copy svc hash\n"));
+       }
+fail:
+       return ret;
+
+}
+
+#ifdef RTT_SUPPORT
+/*
+ * Reset for Initiator
+ * Remove for Responder if no pending
+ * geofence target or else reset
+ */
+static void
+wl_cfgnan_reset_remove_ranging_instance(struct bcm_cfg80211 *cfg,
+        nan_ranging_inst_t *ranging_inst)
+{
+       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+       int8 index;
+       rtt_geofence_target_info_t* geofence_target;
+
+       ASSERT(ranging_inst);
+       if (!ranging_inst) {
+               return;
+       }
+
+       if (ranging_inst->range_role == NAN_RANGING_ROLE_RESPONDER) {
+               /* Remove ranging instance for responder */
+               geofence_target = dhd_rtt_get_geofence_target(dhd,
+                               &ranging_inst->peer_addr, &index);
+               if (!geofence_target) {
+                       /* Remove rng inst if no pend target */
+                       WL_INFORM_MEM(("Removing Ranging Instance "
+                               "peer: " MACDBG "\n",
+                               MAC2STRDBG(&ranging_inst->peer_addr)));
+                       bzero(ranging_inst, sizeof(*ranging_inst));
+               } else {
+                       ranging_inst->range_status =
+                               NAN_RANGING_REQUIRED;
+               }
+       } else {
+               ranging_inst->range_status = NAN_RANGING_REQUIRED;
+       }
+}
+
+/*
+ * Forcecully Remove Ranging instance
+ * Remove if any corresponding Geofence Target
+ */
+static void
+wl_cfgnan_remove_ranging_instance(struct bcm_cfg80211 *cfg,
+               nan_ranging_inst_t *ranging_inst)
+{
+       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+       int8 index;
+       rtt_geofence_target_info_t* geofence_target;
+
+       ASSERT(ranging_inst);
+       if (!ranging_inst) {
+               return;
+       }
+
+       geofence_target = dhd_rtt_get_geofence_target(dhd,
+                       &ranging_inst->peer_addr, &index);
+       if (geofence_target) {
+               dhd_rtt_remove_geofence_target(dhd,
+                       &geofence_target->peer_addr);
+       }
+       WL_INFORM_MEM(("Removing Ranging Instance " MACDBG "\n",
+               MAC2STRDBG(&(ranging_inst->peer_addr))));
+       bzero(ranging_inst, sizeof(nan_ranging_inst_t));
+
+       return;
+}
+
+static bool
+wl_cfgnan_clear_svc_from_ranging_inst(struct bcm_cfg80211 *cfg,
+       nan_ranging_inst_t *ranging_inst, nan_svc_info_t *svc)
+{
+       int i = 0;
+       bool cleared = FALSE;
+
+       if (svc && ranging_inst->in_use) {
+               for (i = 0; i < MAX_SUBSCRIBES; i++) {
+                       if (svc == ranging_inst->svc_idx[i]) {
+                               ranging_inst->num_svc_ctx--;
+                               ranging_inst->svc_idx[i] = NULL;
+                               cleared = TRUE;
+                               /*
+                                * This list is maintained dupes free,
+                                * hence can break
+                                */
+                               break;
+                       }
+               }
+       }
+       return cleared;
+}
+
+static int
+wl_cfgnan_clear_svc_from_all_ranging_inst(struct bcm_cfg80211 *cfg, uint8 svc_id)
+{
+       nan_ranging_inst_t *ranging_inst;
+       int i = 0;
+       int ret = BCME_OK;
+
+       nan_svc_info_t *svc = wl_cfgnan_get_svc_inst(cfg, svc_id, 0);
+       if (!svc) {
+               WL_ERR(("\n svc not found \n"));
+               ret = BCME_NOTFOUND;
+               goto done;
+       }
+       for (i = 0; i < NAN_MAX_RANGING_INST; i++) {
+               ranging_inst = &(cfg->nancfg->nan_ranging_info[i]);
+               wl_cfgnan_clear_svc_from_ranging_inst(cfg, ranging_inst, svc);
+       }
+
+done:
+       return ret;
+}
+
+static int
+wl_cfgnan_ranging_clear_publish(struct bcm_cfg80211 *cfg,
+       struct ether_addr *peer, uint8 svc_id)
+{
+       nan_ranging_inst_t *ranging_inst = NULL;
+       nan_svc_info_t *svc = NULL;
+       bool cleared = FALSE;
+       int ret = BCME_OK;
+
+       ranging_inst = wl_cfgnan_check_for_ranging(cfg, peer);
+       if (!ranging_inst || !ranging_inst->in_use) {
+               goto done;
+       }
+
+       WL_INFORM_MEM(("Check clear Ranging for pub update, sub id = %d,"
+               " range_id = %d, peer addr = " MACDBG " \n", svc_id,
+               ranging_inst->range_id, MAC2STRDBG(peer)));
+       svc = wl_cfgnan_get_svc_inst(cfg, svc_id, 0);
+       if (!svc) {
+               WL_ERR(("\n svc not found, svc_id = %d\n", svc_id));
+               ret = BCME_NOTFOUND;
+               goto done;
+       }
+
+       cleared = wl_cfgnan_clear_svc_from_ranging_inst(cfg, ranging_inst, svc);
+       if (!cleared) {
+               /* Only if this svc was cleared, any update needed */
+               ret = BCME_NOTFOUND;
+               goto done;
+       }
+
+       wl_cfgnan_terminate_ranging_session(cfg, ranging_inst);
+       wl_cfgnan_reset_geofence_ranging(cfg, NULL,
+               RTT_SCHED_RNG_TERM_PUB_RNG_CLEAR);
+
+done:
+       return ret;
+}
+
+/* API to terminate/clear all directed nan-rtt sessions.
+* Can be called from framework RTT stop context
+*/
+int
+wl_cfgnan_terminate_directed_rtt_sessions(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg)
+{
+       nan_ranging_inst_t *ranging_inst;
+       int i, ret = BCME_OK;
+       uint32 status;
+
+       for (i = 0; i < NAN_MAX_RANGING_INST; i++) {
+               ranging_inst = &cfg->nancfg->nan_ranging_info[i];
+               if (ranging_inst->range_id && ranging_inst->range_type == RTT_TYPE_NAN_DIRECTED) {
+                       if (NAN_RANGING_IS_IN_PROG(ranging_inst->range_status)) {
+                               ret =  wl_cfgnan_cancel_ranging(ndev, cfg, &ranging_inst->range_id,
+                                       NAN_RNG_TERM_FLAG_IMMEDIATE, &status);
+                               if (unlikely(ret) || unlikely(status)) {
+                                       WL_ERR(("nan range cancel failed ret = %d status = %d\n",
+                                               ret, status));
+                               }
+                       }
+                       wl_cfgnan_reset_geofence_ranging(cfg, ranging_inst,
+                               RTT_SHCED_HOST_DIRECTED_TERM);
+               }
+       }
+       return ret;
+}
+
+/*
+ * suspend ongoing geofence ranging session
+ * with a peer if on-going ranging is with given peer
+ * If peer NULL,
+ * Suspend all on-going ranging sessions blindly
+ * Do nothing on:
+ * If ranging is not in progress
+ * If ranging in progress but not with given peer
+ */
+int
+wl_cfgnan_suspend_geofence_rng_session(struct net_device *ndev,
+       struct ether_addr *peer, int suspend_reason, u8 cancel_flags)
+{
+       int ret = BCME_OK;
+       uint32 status;
+       nan_ranging_inst_t *ranging_inst = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       int suspend_req_dropped_at = 0;
+       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+
+       UNUSED_PARAMETER(suspend_req_dropped_at);
+
+       ASSERT(peer);
+       if (!peer) {
+               WL_DBG(("Incoming Peer is NULL, suspend req dropped\n"));
+               suspend_req_dropped_at = 1;
+               goto exit;
+       }
+
+       if (!wl_ranging_geofence_session_with_peer(cfg, peer)) {
+               WL_DBG(("Geofence Ranging not in progress with given peer,"
+                       " suspend req dropped\n"));
+               suspend_req_dropped_at = 2;
+               goto exit;
+       }
+
+       ranging_inst = wl_cfgnan_check_for_ranging(cfg, peer);
+       if (ranging_inst) {
+               cancel_flags |= NAN_RNG_TERM_FLAG_IMMEDIATE;
+               ret =  wl_cfgnan_cancel_ranging(ndev, cfg,
+                               &ranging_inst->range_id, cancel_flags, &status);
+               if (unlikely(ret) || unlikely(status)) {
+                       WL_ERR(("Geofence Range suspended failed, err = %d, status = %d,"
+                               "suspend_reason = %d, peer: " MACDBG " \n",
+                               ret, status, suspend_reason, MAC2STRDBG(peer)));
+               }
+               ranging_inst->range_status = NAN_RANGING_REQUIRED;
+               dhd_rtt_update_geofence_sessions_cnt(dhd, FALSE,
+                       &ranging_inst->peer_addr);
+               WL_INFORM_MEM(("Geofence Range suspended, "
+                       " suspend_reason = %d, peer: " MACDBG " \n",
+                       suspend_reason, MAC2STRDBG(peer)));
+       }
+
+exit:
+       /* Post pending discovery results */
+       if (ranging_inst &&
+               ((suspend_reason == RTT_GEO_SUSPN_HOST_NDP_TRIGGER) ||
+               (suspend_reason == RTT_GEO_SUSPN_PEER_NDP_TRIGGER))) {
+               wl_cfgnan_disc_result_on_geofence_cancel(cfg, ranging_inst);
+       }
+
+       if (suspend_req_dropped_at) {
+               if (ranging_inst) {
+                       WL_INFORM_MEM(("Ranging Suspend Req with peer: " MACDBG
+                               ", dropped at = %d\n", MAC2STRDBG(&ranging_inst->peer_addr),
+                               suspend_req_dropped_at));
+               } else {
+                       WL_INFORM_MEM(("Ranging Suspend Req dropped at = %d\n",
+                               suspend_req_dropped_at));
+               }
+       }
+       return ret;
+}
+
+/*
+ * suspends all geofence ranging sessions
+ * including initiators and responders
+ */
+void
+wl_cfgnan_suspend_all_geofence_rng_sessions(struct net_device *ndev,
+               int suspend_reason, u8 cancel_flags)
+{
+
+       uint8 i = 0;
+       int ret = BCME_OK;
+       uint32 status;
+       nan_ranging_inst_t *ranging_inst = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+
+       WL_INFORM_MEM(("Suspending all geofence sessions: "
+               "suspend_reason = %d\n", suspend_reason));
+
+       cancel_flags |= NAN_RNG_TERM_FLAG_IMMEDIATE;
+       for (i = 0; i < NAN_MAX_RANGING_INST; i++) {
+               ranging_inst = &cfg->nancfg->nan_ranging_info[i];
+               /* Cancel Ranging if in progress for rang_inst */
+               if (ranging_inst->in_use &&
+                               NAN_RANGING_IS_IN_PROG(ranging_inst->range_status)) {
+                       ret =  wl_cfgnan_cancel_ranging(bcmcfg_to_prmry_ndev(cfg),
+                                       cfg, &ranging_inst->range_id,
+                                       NAN_RNG_TERM_FLAG_IMMEDIATE, &status);
+                       if (unlikely(ret) || unlikely(status)) {
+                               WL_ERR(("wl_cfgnan_suspend_all_geofence_rng_sessions: "
+                                       "nan range cancel failed ret = %d status = %d\n",
+                                       ret, status));
+                       } else {
+                               dhd_rtt_update_geofence_sessions_cnt(dhd, FALSE,
+                                       &ranging_inst->peer_addr);
+                               wl_cfgnan_reset_remove_ranging_instance(cfg, ranging_inst);
+                       }
+               }
+       }
+
+       return;
+
+}
+
+/*
+ * Terminate given ranging instance
+ * if no pending ranging sub service
+ */
+static void
+wl_cfgnan_terminate_ranging_session(struct bcm_cfg80211 *cfg,
+       nan_ranging_inst_t *ranging_inst)
+{
+       int ret = BCME_OK;
+       uint32 status;
+       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+
+       if (ranging_inst->num_svc_ctx != 0) {
+               /*
+                * Make sure to remove all svc_insts for range_inst
+                * in order to cancel ranging and remove target in caller
+                */
+               return;
+       }
+
+       /* Cancel Ranging if in progress for rang_inst */
+       if (NAN_RANGING_IS_IN_PROG(ranging_inst->range_status)) {
+               ret =  wl_cfgnan_cancel_ranging(bcmcfg_to_prmry_ndev(cfg),
+                               cfg, &ranging_inst->range_id,
+                               NAN_RNG_TERM_FLAG_IMMEDIATE, &status);
+               if (unlikely(ret) || unlikely(status)) {
+                       WL_ERR(("%s:nan range cancel failed ret = %d status = %d\n",
+                               __FUNCTION__, ret, status));
+               } else {
+                       WL_DBG(("Range cancelled \n"));
+                       dhd_rtt_update_geofence_sessions_cnt(dhd, FALSE,
+                               &ranging_inst->peer_addr);
+               }
+       }
+
+       /* Remove ranging instance and clean any corresponding target */
+       wl_cfgnan_remove_ranging_instance(cfg, ranging_inst);
+}
+
+/*
+ * Terminate all ranging sessions
+ * with no pending ranging sub service
+ */
+static void
+wl_cfgnan_terminate_all_obsolete_ranging_sessions(
+       struct bcm_cfg80211 *cfg)
+{
+       /* cancel all related ranging instances */
+       uint8 i = 0;
+       nan_ranging_inst_t *ranging_inst = NULL;
+
+       for (i = 0; i < NAN_MAX_RANGING_INST; i++) {
+               ranging_inst = &cfg->nancfg->nan_ranging_info[i];
+               if (ranging_inst->in_use) {
+                       wl_cfgnan_terminate_ranging_session(cfg, ranging_inst);
+               }
+       }
+
+       return;
+}
+
+/*
+ * Store svc_ctx for processing during RNG_RPT
+ * Return BCME_OK only when svc is added
+ */
+static int
+wl_cfgnan_update_ranging_svc_inst(nan_ranging_inst_t *ranging_inst,
+       nan_svc_info_t *svc)
+{
+       int ret = BCME_OK;
+       int i = 0;
+
+       for (i = 0; i < MAX_SUBSCRIBES; i++) {
+               if (ranging_inst->svc_idx[i] == svc) {
+                       WL_DBG(("SVC Ctx for ranging already present, "
+                       " Duplication not supported: sub_id: %d\n", svc->svc_id));
+                       ret = BCME_UNSUPPORTED;
+                       goto done;
+               }
+       }
+       for (i = 0; i < MAX_SUBSCRIBES; i++) {
+               if (ranging_inst->svc_idx[i]) {
+                       continue;
+               } else {
+                       WL_DBG(("Adding SVC Ctx for ranging..svc_id %d\n", svc->svc_id));
+                       ranging_inst->svc_idx[i] = svc;
+                       ranging_inst->num_svc_ctx++;
+                       ret = BCME_OK;
+                       goto done;
+               }
+       }
+       if (i == MAX_SUBSCRIBES) {
+               WL_ERR(("wl_cfgnan_update_ranging_svc_inst: "
+                       "No resource to hold Ref SVC ctx..svc_id %d\n", svc->svc_id));
+               ret = BCME_NORESOURCE;
+               goto done;
+       }
+done:
+       return ret;
+}
+
+bool
+wl_ranging_geofence_session_with_peer(struct bcm_cfg80211 *cfg,
+               struct ether_addr *peer_addr)
+{
+       bool ret = FALSE;
+       nan_ranging_inst_t *rng_inst = NULL;
+
+       rng_inst = wl_cfgnan_check_for_ranging(cfg,
+               peer_addr);
+       if (rng_inst &&
+                       (NAN_RANGING_IS_IN_PROG(rng_inst->range_status))) {
+               ret = TRUE;
+       }
+
+       return ret;
+}
+
+int
+wl_cfgnan_trigger_geofencing_ranging(struct net_device *dev,
+               struct ether_addr *peer_addr)
+{
+       int ret = BCME_OK;
+       int err_at = 0;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+       nan_ranging_inst_t *ranging_inst;
+       ranging_inst = wl_cfgnan_check_for_ranging(cfg, peer_addr);
+
+       if (!ranging_inst) {
+               WL_INFORM_MEM(("Ranging Entry for peer:" MACDBG ", not found\n",
+                       MAC2STRDBG(peer_addr)));
+               ASSERT(0);
+               /* Ranging inst should have been added before adding target */
+               dhd_rtt_remove_geofence_target(dhd, peer_addr);
+               ret = BCME_ERROR;
+               err_at = 1;
+               goto exit;
+       }
+
+       ASSERT(!NAN_RANGING_IS_IN_PROG(ranging_inst->range_status));
+
+       if (!NAN_RANGING_IS_IN_PROG(ranging_inst->range_status)) {
+               WL_DBG(("Trigger range request with first svc in svc list of range inst\n"));
+               ret = wl_cfgnan_trigger_ranging(bcmcfg_to_prmry_ndev(cfg),
+                               cfg, ranging_inst, ranging_inst->svc_idx[0],
+                               NAN_RANGE_REQ_CMD, TRUE);
+               if (ret != BCME_OK) {
+                       /* Unsupported is for already ranging session for peer */
+                       if (ret == BCME_BUSY) {
+                               /* TODO: Attempt again over a timer */
+                               err_at = 2;
+                       } else {
+                               /* Remove target and clean ranging inst */
+                               wl_cfgnan_remove_ranging_instance(cfg, ranging_inst);
+                               err_at = 3;
+                               goto exit;
+                       }
+               }
+       } else {
+               /* already in progress..This should not happen */
+               ret = BCME_ERROR;
+               err_at = 4;
+               goto exit;
+       }
+
+exit:
+       if (ret) {
+               WL_ERR(("wl_cfgnan_trigger_geofencing_ranging: Failed to "
+                       "trigger ranging, peer: " MACDBG " ret"
+                       " = (%d), err_at = %d\n", MAC2STRDBG(peer_addr),
+                       ret, err_at));
+       }
+       return ret;
+}
+
+static int
+wl_cfgnan_check_disc_result_for_ranging(struct bcm_cfg80211 *cfg,
+               nan_event_data_t* nan_event_data)
+{
+       nan_svc_info_t *svc;
+       int ret = BCME_OK;
+       rtt_geofence_target_info_t geofence_target;
+       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+       uint8 index;
+       bool add_target;
+
+       svc = wl_cfgnan_get_svc_inst(cfg, nan_event_data->sub_id, 0);
+
+       if (svc && svc->ranging_required) {
+               nan_ranging_inst_t *ranging_inst;
+               ranging_inst = wl_cfgnan_get_ranging_inst(cfg,
+                               &nan_event_data->remote_nmi,
+                               NAN_RANGING_ROLE_INITIATOR);
+               if (!ranging_inst) {
+                       ret = BCME_NORESOURCE;
+                       goto exit;
+               }
+               ASSERT(ranging_inst->range_role != NAN_RANGING_ROLE_INVALID);
+
+               /* For responder role, range state should be in progress only */
+               ASSERT((ranging_inst->range_role == NAN_RANGING_ROLE_INITIATOR) ||
+                       NAN_RANGING_IS_IN_PROG(ranging_inst->range_status));
+
+               /*
+                * On rec disc result with ranging required, add target, if
+                * ranging role is responder (range state has to be in prog always)
+                * Or ranging role is initiator and ranging is not already in prog
+                */
+               add_target = ((ranging_inst->range_role ==  NAN_RANGING_ROLE_RESPONDER) ||
+                       ((ranging_inst->range_role ==  NAN_RANGING_ROLE_INITIATOR) &&
+                       (!NAN_RANGING_IS_IN_PROG(ranging_inst->range_status))));
+               if (add_target) {
+                       WL_DBG(("Add Range request to geofence target list\n"));
+                       memcpy(&geofence_target.peer_addr, &nan_event_data->remote_nmi,
+                                       ETHER_ADDR_LEN);
+                       /* check if target is already added */
+                       if (!dhd_rtt_get_geofence_target(dhd, &nan_event_data->remote_nmi, &index))
+                       {
+                               ret = dhd_rtt_add_geofence_target(dhd, &geofence_target);
+                               if (unlikely(ret)) {
+                                       WL_ERR(("Failed to add geofence Tgt, ret = (%d)\n", ret));
+                                       bzero(ranging_inst, sizeof(*ranging_inst));
+                                       goto exit;
+                               } else {
+                                       WL_INFORM_MEM(("Geofence Tgt Added:" MACDBG " sub_id:%d\n",
+                                               MAC2STRDBG(&geofence_target.peer_addr),
+                                               svc->svc_id));
+                               }
+                               ranging_inst->range_type = RTT_TYPE_NAN_GEOFENCE;
+                       }
+                       if (wl_cfgnan_update_ranging_svc_inst(ranging_inst, svc)
+                                       != BCME_OK) {
+                                       goto exit;
+                       }
+                       if (ranging_inst->range_role == NAN_RANGING_ROLE_RESPONDER) {
+                               /* Adding RTT target while responder, leads to role concurrency */
+                       } else {
+                               /* Trigger/Reset geofence RTT */
+                               wl_cfgnan_reset_geofence_ranging(cfg, ranging_inst,
+                                       RTT_SCHED_SUB_MATCH);
+                       }
+               } else {
+                       /* Target already added, check & add svc_inst ref to rang_inst */
+                       wl_cfgnan_update_ranging_svc_inst(ranging_inst, svc);
+               }
+               /* Disc event will be given on receving range_rpt event */
+               WL_TRACE(("Disc event will given when Range RPT event is recvd"));
+       } else {
+               ret = BCME_UNSUPPORTED;
+       }
+
+exit:
+       return ret;
+}
+
+bool
+wl_cfgnan_ranging_allowed(struct bcm_cfg80211 *cfg)
+{
+       int i = 0;
+       uint8 rng_progress_count = 0;
+       nan_ranging_inst_t *ranging_inst = NULL;
+
+       for (i =  0; i < NAN_MAX_RANGING_INST; i++) {
+               ranging_inst = &cfg->nancfg->nan_ranging_info[i];
+               if (NAN_RANGING_IS_IN_PROG(ranging_inst->range_status)) {
+                       rng_progress_count++;
+               }
+       }
+
+       if (rng_progress_count >= NAN_MAX_RANGING_SSN_ALLOWED) {
+               return FALSE;
+       }
+       return TRUE;
+}
+
+uint8
+wl_cfgnan_cancel_rng_responders(struct net_device *ndev)
+{
+       int i = 0;
+       uint8 num_resp_cancelled = 0;
+       int status, ret;
+       nan_ranging_inst_t *ranging_inst = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+
+       for (i =  0; i < NAN_MAX_RANGING_INST; i++) {
+               ranging_inst = &cfg->nancfg->nan_ranging_info[i];
+               if (NAN_RANGING_IS_IN_PROG(ranging_inst->range_status) &&
+                       (ranging_inst->range_role == NAN_RANGING_ROLE_RESPONDER)) {
+                       num_resp_cancelled++;
+                       ret = wl_cfgnan_cancel_ranging(bcmcfg_to_prmry_ndev(cfg), cfg,
+                               &ranging_inst->range_id, NAN_RNG_TERM_FLAG_IMMEDIATE, &status);
+                       if (unlikely(ret) || unlikely(status)) {
+                               WL_ERR(("wl_cfgnan_cancel_rng_responders: Failed to cancel"
+                                       " existing ranging, ret = (%d)\n", ret));
+                       }
+                       WL_INFORM_MEM(("Removing Ranging Instance " MACDBG "\n",
+                               MAC2STRDBG(&(ranging_inst->peer_addr))));
+                       bzero(ranging_inst, sizeof(*ranging_inst));
+               }
+       }
+       return num_resp_cancelled;
+}
+
+/* ranging reqeust event handler */
+static int
+wl_cfgnan_handle_ranging_ind(struct bcm_cfg80211 *cfg,
+               wl_nan_ev_rng_req_ind_t *rng_ind)
+{
+       int ret = BCME_OK;
+       nan_ranging_inst_t *ranging_inst = NULL;
+       uint32 status;
+       uint8 cancel_flags = 0;
+       bool accept = TRUE;
+       nan_ranging_inst_t tmp_rng_inst;
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       struct ether_addr * peer_addr = &(rng_ind->peer_m_addr);
+       uint8 rtt_invalid_state;
+       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+
+       WL_DBG(("Trigger range response\n"));
+
+       /* Check if ranging is allowed */
+       rtt_invalid_state = dhd_rtt_invalid_states(ndev, peer_addr);
+       if (rtt_invalid_state != RTT_STATE_VALID) {
+               WL_INFORM_MEM(("Cannot allow ranging due to reason %d \n", rtt_invalid_state));
+               ret = BCME_NORESOURCE;
+               goto done;
+       }
+
+       if (rtt_status && !RTT_IS_STOPPED(rtt_status)) {
+               WL_INFORM_MEM(("Direcetd RTT in progress..reject RNG_REQ\n"));
+               ret = BCME_NORESOURCE;
+               goto done;
+       }
+
+       /* check if we are already having any ranging session with peer.
+       * If so below are the policies
+       * If we are already a Geofence Initiator or responder w.r.t the peer
+       * then silently teardown the current session and accept the REQ.
+       * If we are in direct rtt initiator role then reject.
+       */
+       ranging_inst = wl_cfgnan_check_for_ranging(cfg, peer_addr);
+       if (ranging_inst) {
+               if (ranging_inst->range_type == RTT_TYPE_NAN_GEOFENCE ||
+                       ranging_inst->range_role == NAN_RANGING_ROLE_RESPONDER) {
+                       WL_INFORM_MEM(("Already responder/geofence for the Peer, cancel current"
+                               " ssn and accept new one, range_type = %d, role = %d\n",
+                               ranging_inst->range_type, ranging_inst->range_role));
+                       cancel_flags = NAN_RNG_TERM_FLAG_IMMEDIATE |
+                               NAN_RNG_TERM_FLAG_SILIENT_TEARDOWN;
+
+                       if (ranging_inst->range_type == RTT_TYPE_NAN_GEOFENCE &&
+                               ranging_inst->range_role == NAN_RANGING_ROLE_INITIATOR) {
+                               wl_cfgnan_suspend_geofence_rng_session(ndev,
+                                       &(rng_ind->peer_m_addr), RTT_GEO_SUSPN_PEER_RTT_TRIGGER,
+                                       cancel_flags);
+                       } else {
+                               ret = wl_cfgnan_cancel_ranging(ndev, cfg,
+                                       &ranging_inst->range_id, cancel_flags, &status);
+                               if (unlikely(ret)) {
+                                       WL_ERR(("wl_cfgnan_handle_ranging_ind: Failed to cancel"
+                                               " existing ranging, ret = (%d)\n", ret));
+                                       goto done;
+                               } else {
+                                       dhd_rtt_update_geofence_sessions_cnt(dhd, FALSE,
+                                               &ranging_inst->peer_addr);
+                               }
+                       }
+                       ranging_inst->range_status = NAN_RANGING_REQUIRED;
+                       ranging_inst->range_role = NAN_RANGING_ROLE_RESPONDER;
+                       ranging_inst->range_type = 0;
+               } else {
+                       WL_ERR(("Reject the RNG_REQ_IND in direct rtt initiator role\n"));
+                       ret = BCME_BUSY;
+                       goto done;
+               }
+       } else {
+               /* Check if ranging set up in progress */
+               if (dhd_rtt_is_geofence_setup_inprog(dhd)) {
+                       WL_INFORM_MEM(("Ranging set up in already progress\n"));
+                       ret = BCME_NOTREADY;
+                       goto done;
+               }
+
+               /* Check if new Ranging session is allowed */
+               if (dhd_rtt_geofence_sessions_maxed_out(dhd)) {
+                       WL_ERR(("Cannot allow more ranging sessions\n"));
+                       ret = BCME_NORESOURCE;
+                       goto done;
+               }
+
+               ranging_inst = wl_cfgnan_get_ranging_inst(cfg, &rng_ind->peer_m_addr,
+                               NAN_RANGING_ROLE_RESPONDER);
+               if (!ranging_inst) {
+                       WL_ERR(("Failed to create ranging instance \n"));
+                       ASSERT(0);
+                       ret = BCME_NORESOURCE;
+                       goto done;
+               }
+       }
+
+done:
+       if (ret != BCME_OK) {
+               /* reject the REQ using temp ranging instance */
+               bzero(&tmp_rng_inst, sizeof(tmp_rng_inst));
+               ranging_inst = &tmp_rng_inst;
+               (void)memcpy_s(&tmp_rng_inst.peer_addr, ETHER_ADDR_LEN,
+                       &rng_ind->peer_m_addr, ETHER_ADDR_LEN);
+               accept = FALSE;
+       }
+
+       ranging_inst->range_id = rng_ind->rng_id;
+
+       WL_DBG(("Trigger Ranging at Responder\n"));
+       ret = wl_cfgnan_trigger_ranging(ndev, cfg, ranging_inst,
+               NULL, NAN_RANGE_REQ_EVNT, accept);
+       if (unlikely(ret) || !accept) {
+               WL_ERR(("Failed to handle range request, ret = (%d) accept %d\n",
+                       ret, accept));
+               wl_cfgnan_reset_remove_ranging_instance(cfg, ranging_inst);
+       } else {
+               dhd_rtt_set_geofence_setup_status(dhd, TRUE,
+                       &ranging_inst->peer_addr);
+       }
+
+       return ret;
+}
+
+/* ranging quest and response iovar handler */
+int
+wl_cfgnan_trigger_ranging(struct net_device *ndev, struct bcm_cfg80211 *cfg,
+               void *ranging_ctxt, nan_svc_info_t *svc,
+               uint8 range_cmd, bool accept_req)
+{
+       s32 ret = BCME_OK;
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       wl_nan_range_req_t *range_req = NULL;
+       wl_nan_range_resp_t *range_resp = NULL;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       uint32 status;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE_MED];
+       nan_ranging_inst_t *ranging_inst = (nan_ranging_inst_t *)ranging_ctxt;
+       nan_avail_cmd_data cmd_data;
+
+       NAN_DBG_ENTER();
+
+       bzero(&cmd_data, sizeof(cmd_data));
+       ret = memcpy_s(&cmd_data.peer_nmi, ETHER_ADDR_LEN,
+                       &ranging_inst->peer_addr, ETHER_ADDR_LEN);
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to copy ranging peer addr\n"));
+               goto fail;
+       }
+
+       cmd_data.avail_period = NAN_RANGING_PERIOD;
+       ret = wl_cfgnan_set_nan_avail(bcmcfg_to_prmry_ndev(cfg),
+                       cfg, &cmd_data, WL_AVAIL_LOCAL);
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to set avail value with type [WL_AVAIL_LOCAL]\n"));
+               goto fail;
+       }
+
+       ret = wl_cfgnan_set_nan_avail(bcmcfg_to_prmry_ndev(cfg),
+                       cfg, &cmd_data, WL_AVAIL_RANGING);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to set avail value with type [WL_AVAIL_RANGING]\n"));
+               goto fail;
+       }
+
+       nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_buf_size -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(&nan_buf->cmds[0]);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       if (range_cmd == NAN_RANGE_REQ_CMD) {
+               sub_cmd->id = htod16(WL_NAN_CMD_RANGE_REQUEST);
+               sub_cmd->len = sizeof(sub_cmd->u.options) + sizeof(wl_nan_range_req_t);
+               range_req = (wl_nan_range_req_t *)(sub_cmd->data);
+               /* ranging config */
+               range_req->peer = ranging_inst->peer_addr;
+               if (svc) {
+                       range_req->interval = svc->ranging_interval;
+                       /* Limits are in cm from host */
+                       range_req->ingress = svc->ingress_limit;
+                       range_req->egress = svc->egress_limit;
+               }
+               range_req->indication = NAN_RANGING_INDICATE_CONTINUOUS_MASK;
+       } else {
+               /* range response config */
+               sub_cmd->id = htod16(WL_NAN_CMD_RANGE_RESPONSE);
+               sub_cmd->len = sizeof(sub_cmd->u.options) + sizeof(wl_nan_range_resp_t);
+               range_resp = (wl_nan_range_resp_t *)(sub_cmd->data);
+               range_resp->range_id = ranging_inst->range_id;
+               range_resp->indication = NAN_RANGING_INDICATE_CONTINUOUS_MASK;
+               if (accept_req) {
+                       range_resp->status = NAN_RNG_REQ_ACCEPTED_BY_HOST;
+               } else {
+                       range_resp->status = NAN_RNG_REQ_REJECTED_BY_HOST;
+               }
+               nan_buf->is_set = true;
+       }
+
+       nan_buf_size -= (sub_cmd->len +
+                       OFFSETOF(bcm_iov_batch_subcmd_t, u.options));
+       nan_buf->count++;
+
+       bzero(resp_buf, sizeof(resp_buf));
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size,
+                       &status,
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(status)) {
+               WL_ERR(("nan ranging failed ret = %d status = %d\n",
+                               ret, status));
+               ret = (ret == BCME_OK) ? status : ret;
+               goto fail;
+       }
+       WL_TRACE(("nan ranging trigger successful\n"));
+       if (range_cmd == NAN_RANGE_REQ_CMD) {
+               WL_INFORM_MEM(("Ranging Req Triggered"
+                       " peer: " MACDBG ", ind : %d, ingress : %d, egress : %d\n",
+                       MAC2STRDBG(&ranging_inst->peer_addr), range_req->indication,
+                       range_req->ingress, range_req->egress));
+       } else {
+               WL_INFORM_MEM(("Ranging Resp Triggered"
+                       " peer: " MACDBG ", ind : %d, ingress : %d, egress : %d\n",
+                       MAC2STRDBG(&ranging_inst->peer_addr), range_resp->indication,
+                       range_resp->ingress, range_resp->egress));
+       }
+
+       /* check the response buff for request */
+       if (range_cmd == NAN_RANGE_REQ_CMD) {
+               ret = process_resp_buf(resp_buf + WL_NAN_OBUF_DATA_OFFSET,
+                               &ranging_inst->range_id, WL_NAN_CMD_RANGE_REQUEST);
+               WL_INFORM_MEM(("ranging instance returned %d\n", ranging_inst->range_id));
+       }
+
+       /* Move Ranging instance to set up in progress state */
+       ranging_inst->range_status = NAN_RANGING_SETUP_IN_PROGRESS;
+
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+
+       NAN_DBG_EXIT();
+       return ret;
+}
+#endif /* RTT_SUPPORT */
+#endif /* WL_NAN_DISC_CACHE */
+
+static void *wl_nan_bloom_alloc(void *ctx, uint size)
+{
+       uint8 *buf;
+       BCM_REFERENCE(ctx);
+
+       buf = kmalloc(size, GFP_KERNEL);
+       if (!buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               buf = NULL;
+       }
+       return buf;
+}
+
+static void wl_nan_bloom_free(void *ctx, void *buf, uint size)
+{
+       BCM_REFERENCE(ctx);
+       BCM_REFERENCE(size);
+       if (buf) {
+               kfree(buf);
+       }
+}
+
+static uint wl_nan_hash(void *ctx, uint index, const uint8 *input, uint input_len)
+{
+       uint8* filter_idx = (uint8*)ctx;
+       uint8 i = (*filter_idx * WL_NAN_HASHES_PER_BLOOM) + (uint8)index;
+       uint b = 0;
+
+       /* Steps 1 and 2 as explained in Section 6.2 */
+       /* Concatenate index to input and run CRC32 by calling hndcrc32 twice */
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       b = hndcrc32(&i, sizeof(uint8), CRC32_INIT_VALUE);
+       b = hndcrc32((uint8*)input, input_len, b);
+       GCC_DIAGNOSTIC_POP();
+       /* Obtain the last 2 bytes of the CRC32 output */
+       b &= NAN_BLOOM_CRC32_MASK;
+
+       /* Step 3 is completed by bcmbloom functions */
+       return b;
+}
+
+static int wl_nan_bloom_create(bcm_bloom_filter_t **bp, uint *idx, uint size)
+{
+       uint i;
+       int err;
+
+       err = bcm_bloom_create(wl_nan_bloom_alloc, wl_nan_bloom_free,
+                       idx, WL_NAN_HASHES_PER_BLOOM, size, bp);
+       if (err != BCME_OK) {
+               goto exit;
+       }
+
+       /* Populate bloom filter with hash functions */
+       for (i = 0; i < WL_NAN_HASHES_PER_BLOOM; i++) {
+               err = bcm_bloom_add_hash(*bp, wl_nan_hash, &i);
+               if (err) {
+                       WL_ERR(("bcm_bloom_add_hash failed\n"));
+                       goto exit;
+               }
+       }
+exit:
+       return err;
+}
+
+static int
+wl_cfgnan_sd_params_handler(struct net_device *ndev,
+       nan_discover_cmd_data_t *cmd_data, uint16 cmd_id,
+       void *p_buf, uint16 *nan_buf_size)
+{
+       s32 ret = BCME_OK;
+       uint8 *pxtlv, *srf = NULL, *srf_mac = NULL, *srftmp = NULL;
+       uint16 buflen_avail;
+       bcm_iov_batch_subcmd_t *sub_cmd = (bcm_iov_batch_subcmd_t*)(p_buf);
+       wl_nan_sd_params_t *sd_params = (wl_nan_sd_params_t *)sub_cmd->data;
+       uint16 srf_size = 0;
+       uint bloom_size, a;
+       bcm_bloom_filter_t *bp = NULL;
+       /* Bloom filter index default, indicates it has not been set */
+       uint bloom_idx = 0xFFFFFFFF;
+       uint16 bloom_len = NAN_BLOOM_LENGTH_DEFAULT;
+       /* srf_ctrl_size = bloom_len + src_control field */
+       uint16 srf_ctrl_size = bloom_len + 1;
+
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(ndev);
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       BCM_REFERENCE(cfg);
+
+       NAN_DBG_ENTER();
+
+       if (cmd_data->period) {
+               sd_params->awake_dw = cmd_data->period;
+       }
+       sd_params->period = 1;
+
+       if (cmd_data->ttl) {
+               sd_params->ttl = cmd_data->ttl;
+       } else {
+               sd_params->ttl = WL_NAN_TTL_UNTIL_CANCEL;
+       }
+
+       sd_params->flags = 0;
+       sd_params->flags = cmd_data->flags;
+
+       /* Nan Service Based event suppression Flags */
+       if (cmd_data->recv_ind_flag) {
+               /* BIT0 - If set, host wont rec event "terminated" */
+               if (CHECK_BIT(cmd_data->recv_ind_flag, WL_NAN_EVENT_SUPPRESS_TERMINATE_BIT)) {
+                       sd_params->flags |= WL_NAN_SVC_CTRL_SUPPRESS_EVT_TERMINATED;
+               }
+
+               /* BIT1 - If set, host wont receive match expiry evt */
+               /* TODO: Exp not yet supported */
+               if (CHECK_BIT(cmd_data->recv_ind_flag, WL_NAN_EVENT_SUPPRESS_MATCH_EXP_BIT)) {
+                       WL_DBG(("Need to add match expiry event\n"));
+               }
+               /* BIT2 - If set, host wont rec event "receive"  */
+               if (CHECK_BIT(cmd_data->recv_ind_flag, WL_NAN_EVENT_SUPPRESS_RECEIVE_BIT)) {
+                       sd_params->flags |= WL_NAN_SVC_CTRL_SUPPRESS_EVT_RECEIVE;
+               }
+               /* BIT3 - If set, host wont rec event "replied" */
+               if (CHECK_BIT(cmd_data->recv_ind_flag, WL_NAN_EVENT_SUPPRESS_REPLIED_BIT)) {
+                       sd_params->flags |= WL_NAN_SVC_CTRL_SUPPRESS_EVT_REPLIED;
+               }
+       }
+       if (cmd_id == WL_NAN_CMD_SD_PUBLISH) {
+               sd_params->instance_id = cmd_data->pub_id;
+               if (cmd_data->service_responder_policy) {
+                       /* Do not disturb avail if dam is supported */
+                       if (FW_SUPPORTED(dhdp, autodam)) {
+                               /* Nan Accept policy: Per service basis policy
+                                * Based on this policy(ALL/NONE), responder side
+                                * will send ACCEPT/REJECT
+                                * If set, auto datapath responder will be sent by FW
+                                */
+                               sd_params->flags |= WL_NAN_SVC_CTRL_AUTO_DPRESP;
+                       } else  {
+                               WL_ERR(("svc specifiv auto dp resp is not"
+                                               " supported in non-auto dam fw\n"));
+                       }
+               }
+       } else if (cmd_id == WL_NAN_CMD_SD_SUBSCRIBE) {
+               sd_params->instance_id = cmd_data->sub_id;
+       } else {
+               ret = BCME_USAGE_ERROR;
+               WL_ERR(("wrong command id = %d \n", cmd_id));
+               goto fail;
+       }
+
+       if ((cmd_data->svc_hash.dlen == WL_NAN_SVC_HASH_LEN) &&
+                       (cmd_data->svc_hash.data)) {
+               ret = memcpy_s((uint8*)sd_params->svc_hash,
+                               sizeof(sd_params->svc_hash),
+                               cmd_data->svc_hash.data,
+                               cmd_data->svc_hash.dlen);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy svc hash\n"));
+                       goto fail;
+               }
+#ifdef WL_NAN_DEBUG
+               prhex("hashed svc name", cmd_data->svc_hash.data,
+                               cmd_data->svc_hash.dlen);
+#endif /* WL_NAN_DEBUG */
+       } else {
+               ret = BCME_ERROR;
+               WL_ERR(("invalid svc hash data or length = %d\n",
+                               cmd_data->svc_hash.dlen));
+               goto fail;
+       }
+
+       /* check if ranging support is present in firmware */
+       if ((cmd_data->sde_control_flag & NAN_SDE_CF_RANGING_REQUIRED) &&
+               !FW_SUPPORTED(dhdp, nanrange)) {
+               WL_ERR(("Service requires ranging but fw doesnt support it\n"));
+               ret = BCME_UNSUPPORTED;
+               goto fail;
+       }
+
+       /* Optional parameters: fill the sub_command block with service descriptor attr */
+       sub_cmd->id = htod16(cmd_id);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       sub_cmd->len = sizeof(sub_cmd->u.options) +
+               OFFSETOF(wl_nan_sd_params_t, optional[0]);
+       pxtlv = (uint8*)&sd_params->optional[0];
+
+       *nan_buf_size -= sub_cmd->len;
+       buflen_avail = *nan_buf_size;
+
+       if (cmd_data->svc_info.data && cmd_data->svc_info.dlen) {
+               WL_TRACE(("optional svc_info present, pack it\n"));
+               ret = bcm_pack_xtlv_entry(&pxtlv, nan_buf_size,
+                               WL_NAN_XTLV_SD_SVC_INFO,
+                               cmd_data->svc_info.dlen,
+                               cmd_data->svc_info.data, BCM_XTLV_OPTION_ALIGN32);
+               if (unlikely(ret)) {
+                       WL_ERR(("%s: fail to pack WL_NAN_XTLV_SD_SVC_INFO\n", __FUNCTION__));
+                       goto fail;
+               }
+       }
+
+       if (cmd_data->sde_svc_info.data && cmd_data->sde_svc_info.dlen) {
+               WL_TRACE(("optional sdea svc_info present, pack it, %d\n",
+                       cmd_data->sde_svc_info.dlen));
+               ret = bcm_pack_xtlv_entry(&pxtlv, nan_buf_size,
+                               WL_NAN_XTLV_SD_SDE_SVC_INFO,
+                               cmd_data->sde_svc_info.dlen,
+                               cmd_data->sde_svc_info.data, BCM_XTLV_OPTION_ALIGN32);
+               if (unlikely(ret)) {
+                       WL_ERR(("%s: fail to pack sdea svc info\n", __FUNCTION__));
+                       goto fail;
+               }
+       }
+
+       if (cmd_data->tx_match.dlen) {
+               WL_TRACE(("optional tx match filter presnet (len=%d)\n",
+                               cmd_data->tx_match.dlen));
+               ret = bcm_pack_xtlv_entry(&pxtlv, nan_buf_size,
+                               WL_NAN_XTLV_CFG_MATCH_TX, cmd_data->tx_match.dlen,
+                               cmd_data->tx_match.data, BCM_XTLV_OPTION_ALIGN32);
+               if (unlikely(ret)) {
+                       WL_ERR(("%s: failed on xtlv_pack for tx match filter\n", __FUNCTION__));
+                       goto fail;
+               }
+       }
+
+       if (cmd_data->life_count) {
+               WL_TRACE(("optional life count is present, pack it\n"));
+               ret = bcm_pack_xtlv_entry(&pxtlv, nan_buf_size, WL_NAN_XTLV_CFG_SVC_LIFE_COUNT,
+                               sizeof(cmd_data->life_count), &cmd_data->life_count,
+                               BCM_XTLV_OPTION_ALIGN32);
+               if (unlikely(ret)) {
+                       WL_ERR(("%s: failed to WL_NAN_XTLV_CFG_SVC_LIFE_COUNT\n", __FUNCTION__));
+                       goto fail;
+               }
+       }
+
+       if (cmd_data->use_srf) {
+               uint8 srf_control = 0;
+               /* set include bit */
+               if (cmd_data->srf_include == true) {
+                       srf_control |= 0x2;
+               }
+
+               if (!ETHER_ISNULLADDR(&cmd_data->mac_list.list) &&
+                               (cmd_data->mac_list.num_mac_addr
+                                < NAN_SRF_MAX_MAC)) {
+                       if (cmd_data->srf_type == SRF_TYPE_SEQ_MAC_ADDR) {
+                               /* mac list */
+                               srf_size = (cmd_data->mac_list.num_mac_addr
+                                               * ETHER_ADDR_LEN) + NAN_SRF_CTRL_FIELD_LEN;
+                               WL_TRACE(("srf size = %d\n", srf_size));
+
+                               srf_mac = MALLOCZ(cfg->osh, srf_size);
+                               if (srf_mac == NULL) {
+                                       WL_ERR(("%s: memory allocation failed\n", __FUNCTION__));
+                                       ret = -ENOMEM;
+                                       goto fail;
+                               }
+                               ret = memcpy_s(srf_mac, NAN_SRF_CTRL_FIELD_LEN,
+                                               &srf_control, NAN_SRF_CTRL_FIELD_LEN);
+                               if (ret != BCME_OK) {
+                                       WL_ERR(("Failed to copy srf control\n"));
+                                       goto fail;
+                               }
+                               ret = memcpy_s(srf_mac+1, (srf_size - NAN_SRF_CTRL_FIELD_LEN),
+                                               cmd_data->mac_list.list,
+                                               (srf_size - NAN_SRF_CTRL_FIELD_LEN));
+                               if (ret != BCME_OK) {
+                                       WL_ERR(("Failed to copy srf control mac list\n"));
+                                       goto fail;
+                               }
+                               ret = bcm_pack_xtlv_entry(&pxtlv, nan_buf_size,
+                                               WL_NAN_XTLV_CFG_SR_FILTER, srf_size, srf_mac,
+                                               BCM_XTLV_OPTION_ALIGN32);
+                               if (unlikely(ret)) {
+                                       WL_ERR(("%s: failed to WL_NAN_XTLV_CFG_SR_FILTER\n",
+                                                       __FUNCTION__));
+                                       goto fail;
+                               }
+                       } else if (cmd_data->srf_type == SRF_TYPE_BLOOM_FILTER) {
+                               /* Create bloom filter */
+                               srf = MALLOCZ(cfg->osh, srf_ctrl_size);
+                               if (srf == NULL) {
+                                       WL_ERR(("%s: memory allocation failed\n", __FUNCTION__));
+                                       ret = -ENOMEM;
+                                       goto fail;
+                               }
+                               /* Bloom filter */
+                               srf_control |= 0x1;
+                               /* Instance id must be from 1 to 255, 0 is Reserved */
+                               if (sd_params->instance_id == NAN_ID_RESERVED) {
+                                       WL_ERR(("Invalid instance id: %d\n",
+                                                       sd_params->instance_id));
+                                       ret = BCME_BADARG;
+                                       goto fail;
+                               }
+                               if (bloom_idx == 0xFFFFFFFF) {
+                                       bloom_idx = sd_params->instance_id % 4;
+                               } else {
+                                       WL_ERR(("Invalid bloom_idx\n"));
+                                       ret = BCME_BADARG;
+                                       goto fail;
+
+                               }
+                               srf_control |= bloom_idx << 2;
+
+                               ret = wl_nan_bloom_create(&bp, &bloom_idx, bloom_len);
+                               if (unlikely(ret)) {
+                                       WL_ERR(("%s: Bloom create failed\n", __FUNCTION__));
+                                       goto fail;
+                               }
+
+                               srftmp = cmd_data->mac_list.list;
+                               for (a = 0;
+                                       a < cmd_data->mac_list.num_mac_addr; a++) {
+                                       ret = bcm_bloom_add_member(bp, srftmp, ETHER_ADDR_LEN);
+                                       if (unlikely(ret)) {
+                                               WL_ERR(("%s: Cannot add to bloom filter\n",
+                                                               __FUNCTION__));
+                                               goto fail;
+                                       }
+                                       srftmp += ETHER_ADDR_LEN;
+                               }
+
+                               ret = memcpy_s(srf, NAN_SRF_CTRL_FIELD_LEN,
+                                               &srf_control, NAN_SRF_CTRL_FIELD_LEN);
+                               if (ret != BCME_OK) {
+                                       WL_ERR(("Failed to copy srf control\n"));
+                                       goto fail;
+                               }
+                               ret = bcm_bloom_get_filter_data(bp, bloom_len,
+                                               (srf + NAN_SRF_CTRL_FIELD_LEN),
+                                               &bloom_size);
+                               if (unlikely(ret)) {
+                                       WL_ERR(("%s: Cannot get filter data\n", __FUNCTION__));
+                                       goto fail;
+                               }
+                               ret = bcm_pack_xtlv_entry(&pxtlv, nan_buf_size,
+                                               WL_NAN_XTLV_CFG_SR_FILTER, srf_ctrl_size,
+                                               srf, BCM_XTLV_OPTION_ALIGN32);
+                               if (ret != BCME_OK) {
+                                       WL_ERR(("Failed to pack SR FILTER data, ret = %d\n", ret));
+                                       goto fail;
+                               }
+                       } else {
+                               WL_ERR(("Invalid SRF Type = %d !!!\n",
+                                               cmd_data->srf_type));
+                               goto fail;
+                       }
+               } else {
+                       WL_ERR(("Invalid MAC Addr/Too many mac addr = %d !!!\n",
+                                       cmd_data->mac_list.num_mac_addr));
+                       goto fail;
+               }
+       }
+
+       if (cmd_data->rx_match.dlen) {
+               WL_TRACE(("optional rx match filter is present, pack it\n"));
+               ret = bcm_pack_xtlv_entry(&pxtlv, nan_buf_size,
+                               WL_NAN_XTLV_CFG_MATCH_RX, cmd_data->rx_match.dlen,
+                               cmd_data->rx_match.data, BCM_XTLV_OPTION_ALIGN32);
+               if (unlikely(ret)) {
+                       WL_ERR(("%s: failed on xtlv_pack for rx match filter\n", __func__));
+                       goto fail;
+               }
+       }
+
+       /* Security elements */
+       if (cmd_data->csid) {
+               WL_TRACE(("Cipher suite type is present, pack it\n"));
+               ret = bcm_pack_xtlv_entry(&pxtlv, nan_buf_size,
+                               WL_NAN_XTLV_CFG_SEC_CSID, sizeof(nan_sec_csid_e),
+                               (uint8*)&cmd_data->csid, BCM_XTLV_OPTION_ALIGN32);
+               if (unlikely(ret)) {
+                       WL_ERR(("%s: fail to pack on csid\n", __FUNCTION__));
+                       goto fail;
+               }
+       }
+
+       if (cmd_data->ndp_cfg.security_cfg) {
+               if ((cmd_data->key_type == NAN_SECURITY_KEY_INPUT_PMK) ||
+                       (cmd_data->key_type == NAN_SECURITY_KEY_INPUT_PASSPHRASE)) {
+                       if (cmd_data->key.data && cmd_data->key.dlen) {
+                               WL_TRACE(("optional pmk present, pack it\n"));
+                               ret = bcm_pack_xtlv_entry(&pxtlv, nan_buf_size,
+                                       WL_NAN_XTLV_CFG_SEC_PMK, cmd_data->key.dlen,
+                                       cmd_data->key.data, BCM_XTLV_OPTION_ALIGN32);
+                               if (unlikely(ret)) {
+                                       WL_ERR(("%s: fail to pack WL_NAN_XTLV_CFG_SEC_PMK\n",
+                                               __FUNCTION__));
+                                       goto fail;
+                               }
+                       }
+               } else {
+                       WL_ERR(("Invalid security key type\n"));
+                       ret = BCME_BADARG;
+                       goto fail;
+               }
+       }
+
+       if (cmd_data->scid.data && cmd_data->scid.dlen) {
+               WL_TRACE(("optional scid present, pack it\n"));
+               ret = bcm_pack_xtlv_entry(&pxtlv, nan_buf_size, WL_NAN_XTLV_CFG_SEC_SCID,
+                       cmd_data->scid.dlen, cmd_data->scid.data, BCM_XTLV_OPTION_ALIGN32);
+               if (unlikely(ret)) {
+                       WL_ERR(("%s: fail to pack WL_NAN_XTLV_CFG_SEC_SCID\n", __FUNCTION__));
+                       goto fail;
+               }
+       }
+
+       if (cmd_data->sde_control_config) {
+               ret = bcm_pack_xtlv_entry(&pxtlv, nan_buf_size,
+                               WL_NAN_XTLV_SD_SDE_CONTROL,
+                               sizeof(uint16), (uint8*)&cmd_data->sde_control_flag,
+                               BCM_XTLV_OPTION_ALIGN32);
+               if (ret != BCME_OK) {
+                       WL_ERR(("%s: fail to pack WL_NAN_XTLV_SD_SDE_CONTROL\n", __FUNCTION__));
+                       goto fail;
+               }
+       }
+
+       sub_cmd->len += (buflen_avail - *nan_buf_size);
+
+fail:
+       if (srf) {
+               MFREE(cfg->osh, srf, srf_ctrl_size);
+       }
+
+       if (srf_mac) {
+               MFREE(cfg->osh, srf_mac, srf_size);
+       }
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_aligned_data_size_of_opt_disc_params(uint16 *data_size, nan_discover_cmd_data_t *cmd_data)
+{
+       s32 ret = BCME_OK;
+       if (cmd_data->svc_info.dlen)
+               *data_size += ALIGN_SIZE(cmd_data->svc_info.dlen + NAN_XTLV_ID_LEN_SIZE, 4);
+       if (cmd_data->sde_svc_info.dlen)
+               *data_size += ALIGN_SIZE(cmd_data->sde_svc_info.dlen + NAN_XTLV_ID_LEN_SIZE, 4);
+       if (cmd_data->tx_match.dlen)
+               *data_size += ALIGN_SIZE(cmd_data->tx_match.dlen + NAN_XTLV_ID_LEN_SIZE, 4);
+       if (cmd_data->rx_match.dlen)
+               *data_size += ALIGN_SIZE(cmd_data->rx_match.dlen + NAN_XTLV_ID_LEN_SIZE, 4);
+       if (cmd_data->use_srf) {
+               if (cmd_data->srf_type == SRF_TYPE_SEQ_MAC_ADDR) {
+                       *data_size += (cmd_data->mac_list.num_mac_addr * ETHER_ADDR_LEN)
+                                       + NAN_SRF_CTRL_FIELD_LEN;
+               } else { /* Bloom filter type */
+                       *data_size += NAN_BLOOM_LENGTH_DEFAULT + 1;
+               }
+               *data_size += ALIGN_SIZE(*data_size + NAN_XTLV_ID_LEN_SIZE, 4);
+       }
+       if (cmd_data->csid)
+               *data_size +=  ALIGN_SIZE(sizeof(nan_sec_csid_e) + NAN_XTLV_ID_LEN_SIZE, 4);
+       if (cmd_data->key.dlen)
+               *data_size += ALIGN_SIZE(cmd_data->key.dlen + NAN_XTLV_ID_LEN_SIZE, 4);
+       if (cmd_data->scid.dlen)
+               *data_size += ALIGN_SIZE(cmd_data->scid.dlen + NAN_XTLV_ID_LEN_SIZE, 4);
+       if (cmd_data->sde_control_config)
+               *data_size += ALIGN_SIZE(sizeof(uint16) + NAN_XTLV_ID_LEN_SIZE, 4);
+       if (cmd_data->life_count)
+               *data_size += ALIGN_SIZE(sizeof(cmd_data->life_count) + NAN_XTLV_ID_LEN_SIZE, 4);
+       return ret;
+}
+
+static int
+wl_cfgnan_aligned_data_size_of_opt_dp_params(struct bcm_cfg80211 *cfg, uint16 *data_size,
+       nan_datapath_cmd_data_t *cmd_data)
+{
+       s32 ret = BCME_OK;
+       if (cmd_data->svc_info.dlen) {
+               *data_size += ALIGN_SIZE(cmd_data->svc_info.dlen + NAN_XTLV_ID_LEN_SIZE, 4);
+               /* When NDPE is enabled, adding this extra data_size to provide backward
+                * compatability for non-ndpe devices. Duplicating NDP specific info and sending it
+                * to FW in SD SVCINFO and NDPE TLV list as host doesn't know peer's NDPE capability
+                */
+               if (cfg->nancfg->ndpe_enabled) {
+                       *data_size += ALIGN_SIZE(cmd_data->svc_info.dlen + NAN_XTLV_ID_LEN_SIZE, 4);
+               }
+       }
+       if (cmd_data->key.dlen)
+               *data_size += ALIGN_SIZE(cmd_data->key.dlen + NAN_XTLV_ID_LEN_SIZE, 4);
+       if (cmd_data->csid)
+               *data_size += ALIGN_SIZE(sizeof(nan_sec_csid_e) + NAN_XTLV_ID_LEN_SIZE, 4);
+
+       *data_size += ALIGN_SIZE(WL_NAN_SVC_HASH_LEN + NAN_XTLV_ID_LEN_SIZE, 4);
+       return ret;
+}
+int
+wl_cfgnan_svc_get_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, uint16 cmd_id, nan_discover_cmd_data_t *cmd_data)
+{
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       uint32 instance_id;
+       s32 ret = BCME_OK;
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+
+       uint8 *resp_buf = NULL;
+       uint16 data_size = WL_NAN_OBUF_DATA_OFFSET + sizeof(instance_id);
+
+       NAN_DBG_ENTER();
+
+       nan_buf = MALLOCZ(cfg->osh, data_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       resp_buf = MALLOCZ(cfg->osh, NAN_IOCTL_BUF_SIZE_LARGE);
+       if (!resp_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 1;
+       /* check if service is present */
+       nan_buf->is_set = false;
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(&nan_buf->cmds[0]);
+       if (cmd_id == WL_NAN_CMD_SD_PUBLISH) {
+               instance_id = cmd_data->pub_id;
+       } else if (cmd_id == WL_NAN_CMD_SD_SUBSCRIBE) {
+               instance_id = cmd_data->sub_id;
+       }  else {
+               ret = BCME_USAGE_ERROR;
+               WL_ERR(("wrong command id = %u\n", cmd_id));
+               goto fail;
+       }
+       /* Fill the sub_command block */
+       sub_cmd->id = htod16(cmd_id);
+       sub_cmd->len = sizeof(sub_cmd->u.options) + sizeof(instance_id);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+
+       ret = memcpy_s(sub_cmd->data, (data_size - WL_NAN_OBUF_DATA_OFFSET),
+                       &instance_id, sizeof(instance_id));
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to copy instance id, ret = %d\n", ret));
+               goto fail;
+       }
+
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, data_size,
+                       &(cmd_data->status), resp_buf, NAN_IOCTL_BUF_SIZE_LARGE);
+
+       if (unlikely(ret) || unlikely(cmd_data->status)) {
+               WL_ERR(("nan svc check failed ret = %d status = %d\n", ret, cmd_data->status));
+               goto fail;
+       } else {
+               WL_DBG(("nan svc check successful..proceed to update\n"));
+       }
+
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, data_size);
+       }
+
+       if (resp_buf) {
+               MFREE(cfg->osh, resp_buf, NAN_IOCTL_BUF_SIZE_LARGE);
+       }
+       NAN_DBG_EXIT();
+       return ret;
+
+}
+
+int
+wl_cfgnan_svc_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, uint16 cmd_id, nan_discover_cmd_data_t *cmd_data)
+{
+       s32 ret = BCME_OK;
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       uint16 nan_buf_size;
+       uint8 *resp_buf = NULL;
+       /* Considering fixed params */
+       uint16 data_size = WL_NAN_OBUF_DATA_OFFSET +
+               OFFSETOF(wl_nan_sd_params_t, optional[0]);
+
+       if (cmd_data->svc_update) {
+               ret = wl_cfgnan_svc_get_handler(ndev, cfg, cmd_id, cmd_data);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to update svc handler, ret = %d\n", ret));
+                       goto fail;
+               } else {
+                       /* Ignoring any other svc get error */
+                       if (cmd_data->status == WL_NAN_E_BAD_INSTANCE) {
+                               WL_ERR(("Bad instance status, failed to update svc handler\n"));
+                               goto fail;
+                       }
+               }
+       }
+
+       ret = wl_cfgnan_aligned_data_size_of_opt_disc_params(&data_size, cmd_data);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to get alligned size of optional params\n"));
+               goto fail;
+       }
+       nan_buf_size = data_size;
+       NAN_DBG_ENTER();
+
+       nan_buf = MALLOCZ(cfg->osh, data_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       resp_buf = MALLOCZ(cfg->osh, data_size + NAN_IOVAR_NAME_SIZE);
+       if (!resp_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_buf->is_set = true;
+
+       ret = wl_cfgnan_sd_params_handler(ndev, cmd_data, cmd_id,
+                       &nan_buf->cmds[0], &nan_buf_size);
+       if (unlikely(ret)) {
+               WL_ERR((" Service discovery params handler failed, ret = %d\n", ret));
+               goto fail;
+       }
+
+       nan_buf->count++;
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, data_size,
+                       &(cmd_data->status), resp_buf, data_size + NAN_IOVAR_NAME_SIZE);
+       if (cmd_data->svc_update && (cmd_data->status == BCME_DATA_NOTFOUND)) {
+               /* return OK if update tlv data is not present
+               * which means nothing to update
+               */
+               cmd_data->status = BCME_OK;
+       }
+       if (unlikely(ret) || unlikely(cmd_data->status)) {
+               WL_ERR(("nan svc failed ret = %d status = %d\n", ret, cmd_data->status));
+               goto fail;
+       } else {
+               WL_DBG(("nan svc successful\n"));
+#ifdef WL_NAN_DISC_CACHE
+               ret = wl_cfgnan_cache_svc_info(cfg, cmd_data, cmd_id, cmd_data->svc_update);
+               if (ret < 0) {
+                       WL_ERR(("%s: fail to cache svc info, ret=%d\n",
+                               __FUNCTION__, ret));
+                       goto fail;
+               }
+#endif /* WL_NAN_DISC_CACHE */
+       }
+
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, data_size);
+       }
+
+       if (resp_buf) {
+               MFREE(cfg->osh, resp_buf, data_size + NAN_IOVAR_NAME_SIZE);
+       }
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+int
+wl_cfgnan_publish_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_discover_cmd_data_t *cmd_data)
+{
+       int ret = BCME_OK;
+
+       NAN_DBG_ENTER();
+       NAN_MUTEX_LOCK();
+       /*
+        * proceed only if mandatory arguments are present - subscriber id,
+        * service hash
+        */
+       if ((!cmd_data->pub_id) || (!cmd_data->svc_hash.data) ||
+               (!cmd_data->svc_hash.dlen)) {
+               WL_ERR(("mandatory arguments are not present\n"));
+               ret = BCME_BADARG;
+               goto fail;
+       }
+
+       ret = wl_cfgnan_svc_handler(ndev, cfg, WL_NAN_CMD_SD_PUBLISH, cmd_data);
+       if (ret < 0) {
+               WL_ERR(("%s: fail to handle pub, ret=%d\n", __FUNCTION__, ret));
+               goto fail;
+       }
+       WL_INFORM_MEM(("[NAN] Service published for instance id:%d is_update %d\n",
+               cmd_data->pub_id, cmd_data->svc_update));
+
+fail:
+       NAN_MUTEX_UNLOCK();
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+int
+wl_cfgnan_subscribe_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_discover_cmd_data_t *cmd_data)
+{
+       int ret = BCME_OK;
+#ifdef WL_NAN_DISC_CACHE
+       nan_svc_info_t *svc_info;
+#ifdef RTT_SUPPORT
+       uint8 upd_ranging_required;
+#endif /* RTT_SUPPORT */
+#endif /* WL_NAN_DISC_CACHE */
+
+#ifdef RTT_SUPPORT
+#ifdef RTT_GEOFENCE_CONT
+       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+#endif /* RTT_GEOFENCE_CONT */
+#endif /* RTT_SUPPORT */
+
+       NAN_DBG_ENTER();
+       NAN_MUTEX_LOCK();
+
+       /*
+        * proceed only if mandatory arguments are present - subscriber id,
+        * service hash
+        */
+       if ((!cmd_data->sub_id) || (!cmd_data->svc_hash.data) ||
+               (!cmd_data->svc_hash.dlen)) {
+               WL_ERR(("mandatory arguments are not present\n"));
+               ret = BCME_BADARG;
+               goto fail;
+       }
+
+       /* Check for ranging sessions if any */
+       if (cmd_data->svc_update) {
+#ifdef WL_NAN_DISC_CACHE
+               svc_info = wl_cfgnan_get_svc_inst(cfg, cmd_data->sub_id, 0);
+               if (svc_info) {
+#ifdef RTT_SUPPORT
+                       wl_cfgnan_clear_svc_from_all_ranging_inst(cfg, cmd_data->sub_id);
+                       /* terminate ranging sessions for this svc, avoid clearing svc cache */
+                       wl_cfgnan_terminate_all_obsolete_ranging_sessions(cfg);
+                       /* Attempt RTT for current geofence target */
+                       wl_cfgnan_reset_geofence_ranging(cfg, NULL,
+                               RTT_SCHED_RNG_TERM_SUB_SVC_UPD);
+                       WL_DBG(("Ranging sessions handled for svc update\n"));
+                       upd_ranging_required = !!(cmd_data->sde_control_flag &
+                                       NAN_SDE_CF_RANGING_REQUIRED);
+                       if ((svc_info->ranging_required ^ upd_ranging_required) ||
+                                       (svc_info->ingress_limit != cmd_data->ingress_limit) ||
+                                       (svc_info->egress_limit != cmd_data->egress_limit)) {
+                               /* Clear cache info in Firmware */
+                               ret = wl_cfgnan_clear_disc_cache(cfg, cmd_data->sub_id);
+                               if (ret != BCME_OK) {
+                                       WL_ERR(("couldn't send clear cache to FW \n"));
+                                       goto fail;
+                               }
+                               /* Invalidate local cache info */
+                               wl_cfgnan_remove_disc_result(cfg, cmd_data->sub_id);
+                       }
+#endif /* RTT_SUPPORT */
+               }
+#endif /* WL_NAN_DISC_CACHE */
+       }
+
+#ifdef RTT_SUPPORT
+#ifdef RTT_GEOFENCE_CONT
+       /* Override ranging Indication */
+       if (rtt_status->geofence_cfg.geofence_cont) {
+               if (cmd_data->ranging_indication !=
+                               NAN_RANGE_INDICATION_NONE) {
+                       cmd_data->ranging_indication = NAN_RANGE_INDICATION_CONT;
+               }
+       }
+#endif /* RTT_GEOFENCE_CONT */
+#endif /* RTT_SUPPORT */
+       ret = wl_cfgnan_svc_handler(ndev, cfg, WL_NAN_CMD_SD_SUBSCRIBE, cmd_data);
+       if (ret < 0) {
+               WL_ERR(("%s: fail to handle svc, ret=%d\n", __FUNCTION__, ret));
+               goto fail;
+       }
+       WL_INFORM_MEM(("[NAN] Service subscribed for instance id:%d is_update %d\n",
+               cmd_data->sub_id, cmd_data->svc_update));
+
+fail:
+       NAN_MUTEX_UNLOCK();
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_cancel_handler(nan_discover_cmd_data_t *cmd_data,
+       uint16 cmd_id, void *p_buf, uint16 *nan_buf_size)
+{
+       s32 ret = BCME_OK;
+
+       NAN_DBG_ENTER();
+
+       if (p_buf != NULL) {
+               bcm_iov_batch_subcmd_t *sub_cmd = (bcm_iov_batch_subcmd_t*)(p_buf);
+               wl_nan_instance_id_t instance_id;
+
+               if (cmd_id == WL_NAN_CMD_SD_CANCEL_PUBLISH) {
+                       instance_id = cmd_data->pub_id;
+               } else if (cmd_id == WL_NAN_CMD_SD_CANCEL_SUBSCRIBE) {
+                       instance_id = cmd_data->sub_id;
+               }  else {
+                       ret = BCME_USAGE_ERROR;
+                       WL_ERR(("wrong command id = %u\n", cmd_id));
+                       goto fail;
+               }
+
+               /* Fill the sub_command block */
+               sub_cmd->id = htod16(cmd_id);
+               sub_cmd->len = sizeof(sub_cmd->u.options) + sizeof(instance_id);
+               sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+               ret = memcpy_s(sub_cmd->data, *nan_buf_size,
+                               &instance_id, sizeof(instance_id));
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy instance id, ret = %d\n", ret));
+                       goto fail;
+               }
+               /* adjust iov data len to the end of last data record */
+               *nan_buf_size -= (sub_cmd->len +
+                               OFFSETOF(bcm_iov_batch_subcmd_t, u.options));
+               WL_INFORM_MEM(("[NAN] Service with instance id:%d cancelled\n", instance_id));
+       } else {
+               WL_ERR(("nan_iov_buf is NULL\n"));
+               ret = BCME_ERROR;
+               goto fail;
+       }
+
+fail:
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+int
+wl_cfgnan_cancel_pub_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_discover_cmd_data_t *cmd_data)
+{
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+
+       NAN_DBG_ENTER();
+       NAN_MUTEX_LOCK();
+
+       nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_buf_size -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+
+       /* proceed only if mandatory argument is present - publisher id */
+       if (!cmd_data->pub_id) {
+               WL_ERR(("mandatory argument is not present\n"));
+               ret = BCME_BADARG;
+               goto fail;
+       }
+
+#ifdef WL_NAN_DISC_CACHE
+       wl_cfgnan_clear_svc_cache(cfg, cmd_data->pub_id);
+#endif /* WL_NAN_DISC_CACHE */
+       ret = wl_cfgnan_cancel_handler(cmd_data, WL_NAN_CMD_SD_CANCEL_PUBLISH,
+                       &nan_buf->cmds[0], &nan_buf_size);
+       if (unlikely(ret)) {
+               WL_ERR(("cancel publish failed\n"));
+               goto fail;
+       }
+       nan_buf->is_set = true;
+       nan_buf->count++;
+
+       bzero(resp_buf, sizeof(resp_buf));
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size,
+                       &(cmd_data->status),
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(cmd_data->status)) {
+               WL_ERR(("nan cancel publish failed ret = %d status = %d\n",
+                       ret, cmd_data->status));
+               goto fail;
+       }
+       WL_DBG(("nan cancel publish successfull\n"));
+       wl_cfgnan_remove_inst_id(cfg, cmd_data->pub_id);
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+
+       NAN_MUTEX_UNLOCK();
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+int
+wl_cfgnan_cancel_sub_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_discover_cmd_data_t *cmd_data)
+{
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+
+       NAN_DBG_ENTER();
+       NAN_MUTEX_LOCK();
+
+       nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_buf_size -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+
+       /* proceed only if mandatory argument is present - subscriber id */
+       if (!cmd_data->sub_id) {
+               WL_ERR(("mandatory argument is not present\n"));
+               ret = BCME_BADARG;
+               goto fail;
+       }
+
+#ifdef WL_NAN_DISC_CACHE
+#ifdef RTT_SUPPORT
+       /* terminate ranging sessions for this svc */
+       wl_cfgnan_clear_svc_from_all_ranging_inst(cfg, cmd_data->sub_id);
+       wl_cfgnan_terminate_all_obsolete_ranging_sessions(cfg);
+       wl_cfgnan_reset_geofence_ranging(cfg, NULL, RTT_SCHED_RNG_TERM_SUB_SVC_CANCEL);
+#endif /* RTT_SUPPORT */
+       /* clear svc cache for the service */
+       wl_cfgnan_clear_svc_cache(cfg, cmd_data->sub_id);
+       wl_cfgnan_remove_disc_result(cfg, cmd_data->sub_id);
+#endif /* WL_NAN_DISC_CACHE */
+
+       ret = wl_cfgnan_cancel_handler(cmd_data, WL_NAN_CMD_SD_CANCEL_SUBSCRIBE,
+                       &nan_buf->cmds[0], &nan_buf_size);
+       if (unlikely(ret)) {
+               WL_ERR(("cancel subscribe failed\n"));
+               goto fail;
+       }
+       nan_buf->is_set = true;
+       nan_buf->count++;
+
+       bzero(resp_buf, sizeof(resp_buf));
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size,
+                       &(cmd_data->status),
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(cmd_data->status)) {
+               WL_ERR(("nan cancel subscribe failed ret = %d status = %d\n",
+                       ret, cmd_data->status));
+               goto fail;
+       }
+       WL_DBG(("subscribe cancel successfull\n"));
+       wl_cfgnan_remove_inst_id(cfg, cmd_data->sub_id);
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+
+       NAN_MUTEX_UNLOCK();
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+int
+wl_cfgnan_transmit_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_discover_cmd_data_t *cmd_data)
+{
+       s32 ret = BCME_OK;
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       wl_nan_sd_transmit_t *sd_xmit = NULL;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       bool is_lcl_id = FALSE;
+       bool is_dest_id = FALSE;
+       bool is_dest_mac = FALSE;
+       uint16 buflen_avail;
+       uint8 *pxtlv;
+       uint16 nan_buf_size;
+       uint8 *resp_buf = NULL;
+       /* Considering fixed params */
+       uint16 data_size = WL_NAN_OBUF_DATA_OFFSET +
+               OFFSETOF(wl_nan_sd_transmit_t, opt_tlv);
+       data_size = ALIGN_SIZE(data_size, 4);
+       ret = wl_cfgnan_aligned_data_size_of_opt_disc_params(&data_size, cmd_data);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to get alligned size of optional params\n"));
+               goto fail;
+       }
+       NAN_DBG_ENTER();
+       NAN_MUTEX_LOCK();
+       nan_buf_size = data_size;
+       nan_buf = MALLOCZ(cfg->osh, data_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       resp_buf = MALLOCZ(cfg->osh, data_size + NAN_IOVAR_NAME_SIZE);
+       if (!resp_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       /* nan transmit */
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_buf_size -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+       /*
+        * proceed only if mandatory arguments are present - subscriber id,
+        * publisher id, mac address
+        */
+       if ((!cmd_data->local_id) || (!cmd_data->remote_id) ||
+                       ETHER_ISNULLADDR(&cmd_data->mac_addr.octet)) {
+               WL_ERR(("mandatory arguments are not present\n"));
+               ret = -EINVAL;
+               goto fail;
+       }
+
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(&nan_buf->cmds[0]);
+       sd_xmit = (wl_nan_sd_transmit_t *)(sub_cmd->data);
+
+       /* local instance id must be from 1 to 255, 0 is reserved */
+       if (cmd_data->local_id == NAN_ID_RESERVED) {
+               WL_ERR(("Invalid local instance id: %d\n", cmd_data->local_id));
+               ret = BCME_BADARG;
+               goto fail;
+       }
+       sd_xmit->local_service_id = cmd_data->local_id;
+       is_lcl_id = TRUE;
+
+       /* remote instance id must be from 1 to 255, 0 is reserved */
+       if (cmd_data->remote_id == NAN_ID_RESERVED) {
+               WL_ERR(("Invalid remote instance id: %d\n", cmd_data->remote_id));
+               ret = BCME_BADARG;
+               goto fail;
+       }
+
+       sd_xmit->requestor_service_id = cmd_data->remote_id;
+       is_dest_id = TRUE;
+
+       if (!ETHER_ISNULLADDR(&cmd_data->mac_addr.octet)) {
+               ret = memcpy_s(&sd_xmit->destination_addr, ETHER_ADDR_LEN,
+                               &cmd_data->mac_addr, ETHER_ADDR_LEN);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy dest mac address\n"));
+                       goto fail;
+               }
+       } else {
+               WL_ERR(("Invalid ether addr provided\n"));
+               ret = BCME_BADARG;
+               goto fail;
+       }
+       is_dest_mac = TRUE;
+
+       if (cmd_data->priority) {
+               sd_xmit->priority = cmd_data->priority;
+       }
+       sd_xmit->token = cmd_data->token;
+
+       if (cmd_data->recv_ind_flag) {
+               /* BIT0 - If set, host wont rec event "txs"  */
+               if (CHECK_BIT(cmd_data->recv_ind_flag,
+                               WL_NAN_EVENT_SUPPRESS_FOLLOWUP_RECEIVE_BIT)) {
+                       sd_xmit->flags = WL_NAN_FUP_SUPR_EVT_TXS;
+               }
+       }
+       /* Optional parameters: fill the sub_command block with service descriptor attr */
+       sub_cmd->id = htod16(WL_NAN_CMD_SD_TRANSMIT);
+       sub_cmd->len = sizeof(sub_cmd->u.options) +
+               OFFSETOF(wl_nan_sd_transmit_t, opt_tlv);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       pxtlv = (uint8 *)&sd_xmit->opt_tlv;
+
+       nan_buf_size -= (sub_cmd->len +
+                       OFFSETOF(bcm_iov_batch_subcmd_t, u.options));
+
+       buflen_avail = nan_buf_size;
+
+       if (cmd_data->svc_info.data && cmd_data->svc_info.dlen) {
+               bcm_xtlv_t *pxtlv_svc_info = (bcm_xtlv_t *)pxtlv;
+               ret = bcm_pack_xtlv_entry(&pxtlv, &nan_buf_size,
+                               WL_NAN_XTLV_SD_SVC_INFO, cmd_data->svc_info.dlen,
+                               cmd_data->svc_info.data, BCM_XTLV_OPTION_ALIGN32);
+               if (unlikely(ret)) {
+                       WL_ERR(("%s: fail to pack on bcm_pack_xtlv_entry, ret=%d\n",
+                               __FUNCTION__, ret));
+                       goto fail;
+               }
+
+               /* 0xFF is max length for svc_info */
+               if (pxtlv_svc_info->len > 0xFF) {
+                       WL_ERR(("Invalid service info length %d\n",
+                               (pxtlv_svc_info->len)));
+                       ret = BCME_USAGE_ERROR;
+                       goto fail;
+               }
+               sd_xmit->opt_len = (uint8)(pxtlv_svc_info->len);
+       }
+       if (cmd_data->sde_svc_info.data && cmd_data->sde_svc_info.dlen) {
+               WL_TRACE(("optional sdea svc_info present, pack it\n"));
+               ret = bcm_pack_xtlv_entry(&pxtlv, &nan_buf_size,
+                               WL_NAN_XTLV_SD_SDE_SVC_INFO, cmd_data->sde_svc_info.dlen,
+                               cmd_data->sde_svc_info.data, BCM_XTLV_OPTION_ALIGN32);
+               if (unlikely(ret)) {
+                       WL_ERR(("%s: fail to pack sdea svc info\n", __FUNCTION__));
+                       goto fail;
+               }
+       }
+
+       /* Check if all mandatory params are provided */
+       if (is_lcl_id && is_dest_id && is_dest_mac) {
+               nan_buf->count++;
+               sub_cmd->len += (buflen_avail - nan_buf_size);
+       } else {
+               WL_ERR(("Missing parameters\n"));
+               ret = BCME_USAGE_ERROR;
+       }
+       nan_buf->is_set = TRUE;
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, data_size,
+                       &(cmd_data->status), resp_buf, data_size + NAN_IOVAR_NAME_SIZE);
+       if (unlikely(ret) || unlikely(cmd_data->status)) {
+               WL_ERR(("nan transmit failed for token %d ret = %d status = %d\n",
+                       sd_xmit->token, ret, cmd_data->status));
+               goto fail;
+       }
+       WL_INFORM_MEM(("nan transmit successful for token %d\n", sd_xmit->token));
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, data_size);
+       }
+       if (resp_buf) {
+               MFREE(cfg->osh, resp_buf, data_size + NAN_IOVAR_NAME_SIZE);
+       }
+       NAN_MUTEX_UNLOCK();
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_get_capability(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_hal_capabilities_t *capabilities)
+{
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       wl_nan_fw_cap_t *fw_cap = NULL;
+       uint16 subcmd_len;
+       uint32 status;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       bcm_iov_batch_subcmd_t *sub_cmd_resp = NULL;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+       const bcm_xtlv_t *xtlv;
+       uint16 type = 0;
+       int len = 0;
+
+       NAN_DBG_ENTER();
+       nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_buf_size -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(uint8 *)(&nan_buf->cmds[0]);
+
+       ret = wl_cfg_nan_check_cmd_len(nan_buf_size,
+                       sizeof(*fw_cap), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               goto fail;
+       }
+
+       fw_cap = (wl_nan_fw_cap_t *)sub_cmd->data;
+       sub_cmd->id = htod16(WL_NAN_CMD_GEN_FW_CAP);
+       sub_cmd->len = sizeof(sub_cmd->u.options) + sizeof(*fw_cap);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       nan_buf_size -= subcmd_len;
+       nan_buf->count = 1;
+
+       nan_buf->is_set = false;
+       memset(resp_buf, 0, sizeof(resp_buf));
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size, &status,
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(status)) {
+               WL_ERR(("get nan fw cap failed ret %d status %d \n",
+                               ret, status));
+               goto fail;
+       }
+
+       sub_cmd_resp = &((bcm_iov_batch_buf_t *)(resp_buf))->cmds[0];
+
+       /* check the response buff */
+       xtlv = ((const bcm_xtlv_t *)&sub_cmd_resp->data[0]);
+       if (!xtlv) {
+               ret = BCME_NOTFOUND;
+               WL_ERR(("xtlv not found: err = %d\n", ret));
+               goto fail;
+       }
+       bcm_xtlv_unpack_xtlv(xtlv, &type, (uint16*)&len, NULL, BCM_XTLV_OPTION_ALIGN32);
+       do
+       {
+               switch (type) {
+                       case WL_NAN_XTLV_GEN_FW_CAP:
+                               if (len > sizeof(wl_nan_fw_cap_t)) {
+                                       ret = BCME_BADARG;
+                                       goto fail;
+                               }
+                               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+                               fw_cap = (wl_nan_fw_cap_t*)xtlv->data;
+                               GCC_DIAGNOSTIC_POP();
+                               break;
+                       default:
+                               WL_ERR(("Unknown xtlv: id %u\n", type));
+                               ret = BCME_ERROR;
+                               break;
+               }
+               if (ret != BCME_OK) {
+                       goto fail;
+               }
+       } while ((xtlv = bcm_next_xtlv(xtlv, &len, BCM_XTLV_OPTION_ALIGN32)));
+
+       memset(capabilities, 0, sizeof(nan_hal_capabilities_t));
+       capabilities->max_publishes = fw_cap->max_svc_publishes;
+       capabilities->max_subscribes = fw_cap->max_svc_subscribes;
+       capabilities->max_ndi_interfaces = fw_cap->max_lcl_ndi_interfaces;
+       capabilities->max_ndp_sessions = fw_cap->max_ndp_sessions;
+       capabilities->max_concurrent_nan_clusters = fw_cap->max_concurrent_nan_clusters;
+       capabilities->max_service_name_len = fw_cap->max_service_name_len;
+       capabilities->max_match_filter_len = fw_cap->max_match_filter_len;
+       capabilities->max_total_match_filter_len = fw_cap->max_total_match_filter_len;
+       capabilities->max_service_specific_info_len = fw_cap->max_service_specific_info_len;
+       capabilities->max_app_info_len = fw_cap->max_app_info_len;
+       capabilities->max_sdea_service_specific_info_len = fw_cap->max_sdea_svc_specific_info_len;
+       capabilities->max_queued_transmit_followup_msgs = fw_cap->max_queued_tx_followup_msgs;
+       capabilities->max_subscribe_address = fw_cap->max_subscribe_address;
+       capabilities->is_ndp_security_supported = fw_cap->is_ndp_security_supported;
+       capabilities->ndp_supported_bands = fw_cap->ndp_supported_bands;
+       capabilities->cipher_suites_supported = fw_cap->cipher_suites_supported_mask;
+       if (fw_cap->flags1 & WL_NAN_FW_CAP_FLAG1_NDPE) {
+               capabilities->ndpe_attr_supported = true;
+       }
+
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+int
+wl_cfgnan_get_capablities_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_hal_capabilities_t *capabilities)
+{
+       s32 ret = BCME_OK;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(ndev);
+
+       NAN_DBG_ENTER();
+
+       /* Do not query fw about nan if feature is not supported */
+       if (!FW_SUPPORTED(dhdp, nan)) {
+               WL_DBG(("NAN is not supported\n"));
+               return ret;
+       }
+
+       if (cfg->nancfg->nan_init_state) {
+               ret = wl_cfgnan_get_capability(ndev, cfg, capabilities);
+               if (ret != BCME_OK) {
+                       WL_ERR(("NAN init state: %d, failed to get capability from FW[%d]\n",
+                                       cfg->nancfg->nan_init_state, ret));
+                       goto exit;
+               }
+       } else {
+               /* Initialize NAN before sending iovar */
+               WL_ERR(("Initializing NAN\n"));
+               ret = wl_cfgnan_init(cfg);
+               if (ret != BCME_OK) {
+                       WL_ERR(("failed to initialize NAN[%d]\n", ret));
+                       goto fail;
+               }
+
+               ret = wl_cfgnan_get_capability(ndev, cfg, capabilities);
+               if (ret != BCME_OK) {
+                       WL_ERR(("NAN init state: %d, failed to get capability from FW[%d]\n",
+                                       cfg->nancfg->nan_init_state, ret));
+                       goto exit;
+               }
+               WL_ERR(("De-Initializing NAN\n"));
+               ret = wl_cfgnan_deinit(cfg, dhdp->up);
+               if (ret != BCME_OK) {
+                       WL_ERR(("failed to de-initialize NAN[%d]\n", ret));
+                       goto fail;
+               }
+       }
+fail:
+       NAN_DBG_EXIT();
+       return ret;
+exit:
+       /* Keeping backward campatibility */
+       capabilities->max_concurrent_nan_clusters = MAX_CONCURRENT_NAN_CLUSTERS;
+       capabilities->max_publishes = MAX_PUBLISHES;
+       capabilities->max_subscribes = MAX_SUBSCRIBES;
+       capabilities->max_service_name_len = MAX_SVC_NAME_LEN;
+       capabilities->max_match_filter_len = MAX_MATCH_FILTER_LEN;
+       capabilities->max_total_match_filter_len = MAX_TOTAL_MATCH_FILTER_LEN;
+       capabilities->max_service_specific_info_len = NAN_MAX_SERVICE_SPECIFIC_INFO_LEN;
+       capabilities->max_ndi_interfaces = NAN_MAX_NDI;
+       capabilities->max_ndp_sessions = MAX_NDP_SESSIONS;
+       capabilities->max_app_info_len = MAX_APP_INFO_LEN;
+       capabilities->max_queued_transmit_followup_msgs = MAX_QUEUED_TX_FOLLOUP_MSGS;
+       capabilities->max_sdea_service_specific_info_len = MAX_SDEA_SVC_INFO_LEN;
+       capabilities->max_subscribe_address = MAX_SUBSCRIBE_ADDRESS;
+       capabilities->cipher_suites_supported = WL_NAN_CIPHER_SUITE_SHARED_KEY_128_MASK;
+       capabilities->max_scid_len = MAX_SCID_LEN;
+       capabilities->is_ndp_security_supported = true;
+       capabilities->ndp_supported_bands = NDP_SUPPORTED_BANDS;
+       capabilities->ndpe_attr_supported = false;
+       ret = BCME_OK;
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+bool wl_cfgnan_is_enabled(struct bcm_cfg80211 *cfg)
+{
+       wl_nancfg_t *nancfg = cfg->nancfg;
+       if (nancfg) {
+               if (nancfg->nan_init_state && nancfg->nan_enable) {
+                       return TRUE;
+               }
+       }
+
+       return FALSE;
+}
+
+static int
+wl_cfgnan_init(struct bcm_cfg80211 *cfg)
+{
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       uint32 status;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+       uint8 buf[NAN_IOCTL_BUF_SIZE];
+       bcm_iov_batch_buf_t *nan_buf = (bcm_iov_batch_buf_t*)buf;
+
+       NAN_DBG_ENTER();
+       if (cfg->nancfg->nan_init_state) {
+               WL_ERR(("nan initialized/nmi exists\n"));
+               return BCME_OK;
+       }
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_buf_size -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+       ret = wl_cfgnan_init_handler(&nan_buf->cmds[0], &nan_buf_size, true);
+       if (unlikely(ret)) {
+               WL_ERR(("init handler sub_cmd set failed\n"));
+               goto fail;
+       }
+       nan_buf->count++;
+       nan_buf->is_set = true;
+
+       bzero(resp_buf, sizeof(resp_buf));
+       ret = wl_cfgnan_execute_ioctl(bcmcfg_to_prmry_ndev(cfg), cfg,
+                       nan_buf, nan_buf_size, &status,
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(status)) {
+               WL_ERR(("nan init handler failed ret %d status %d\n",
+                               ret, status));
+               goto fail;
+       }
+
+#ifdef WL_NAN_DISC_CACHE
+       /* malloc for disc result */
+       cfg->nancfg->nan_disc_cache = MALLOCZ(cfg->osh,
+                       NAN_MAX_CACHE_DISC_RESULT * sizeof(nan_disc_result_cache));
+       if (!cfg->nancfg->nan_disc_cache) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+#endif /* WL_NAN_DISC_CACHE */
+       cfg->nancfg->nan_init_state = true;
+       return ret;
+fail:
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static void
+wl_cfgnan_deinit_cleanup(struct bcm_cfg80211 *cfg)
+{
+       uint8 i = 0;
+       wl_nancfg_t *nancfg = cfg->nancfg;
+
+       nancfg->nan_dp_count = 0;
+       nancfg->nan_init_state = false;
+#ifdef WL_NAN_DISC_CACHE
+       if (nancfg->nan_disc_cache) {
+               for (i = 0; i < NAN_MAX_CACHE_DISC_RESULT; i++) {
+                       if (nancfg->nan_disc_cache[i].tx_match_filter.data) {
+                               MFREE(cfg->osh, nancfg->nan_disc_cache[i].tx_match_filter.data,
+                                       nancfg->nan_disc_cache[i].tx_match_filter.dlen);
+                       }
+                       if (nancfg->nan_disc_cache[i].svc_info.data) {
+                               MFREE(cfg->osh, nancfg->nan_disc_cache[i].svc_info.data,
+                                       nancfg->nan_disc_cache[i].svc_info.dlen);
+                       }
+               }
+               MFREE(cfg->osh, nancfg->nan_disc_cache,
+                       NAN_MAX_CACHE_DISC_RESULT * sizeof(nan_disc_result_cache));
+               nancfg->nan_disc_cache = NULL;
+       }
+       nancfg->nan_disc_count = 0;
+       bzero(nancfg->svc_info, NAN_MAX_SVC_INST * sizeof(nan_svc_info_t));
+       bzero(nancfg->nan_ranging_info, NAN_MAX_RANGING_INST * sizeof(nan_ranging_inst_t));
+#endif /* WL_NAN_DISC_CACHE */
+       return;
+}
+
+static int
+wl_cfgnan_deinit(struct bcm_cfg80211 *cfg, uint8 busstate)
+{
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       uint32 status;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+       uint8 buf[NAN_IOCTL_BUF_SIZE];
+       bcm_iov_batch_buf_t *nan_buf = (bcm_iov_batch_buf_t*)buf;
+       wl_nancfg_t *nancfg = cfg->nancfg;
+
+       NAN_DBG_ENTER();
+       NAN_MUTEX_LOCK();
+
+       if (!nancfg->nan_init_state) {
+               WL_ERR(("nan is not initialized/nmi doesnt exists\n"));
+               ret = BCME_OK;
+               goto fail;
+       }
+
+       if (busstate != DHD_BUS_DOWN) {
+               nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+               nan_buf->count = 0;
+               nan_buf_size -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+
+               WL_DBG(("nan deinit\n"));
+               ret = wl_cfgnan_init_handler(&nan_buf->cmds[0], &nan_buf_size, false);
+               if (unlikely(ret)) {
+                       WL_ERR(("deinit handler sub_cmd set failed\n"));
+               } else {
+                       nan_buf->count++;
+                       nan_buf->is_set = true;
+                       bzero(resp_buf, sizeof(resp_buf));
+                       ret = wl_cfgnan_execute_ioctl(cfg->wdev->netdev, cfg,
+                               nan_buf, nan_buf_size, &status,
+                               (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+                       if (unlikely(ret) || unlikely(status)) {
+                               WL_ERR(("nan init handler failed ret %d status %d\n",
+                                       ret, status));
+                       }
+               }
+       }
+       wl_cfgnan_deinit_cleanup(cfg);
+
+fail:
+       if (!nancfg->mac_rand && !ETHER_ISNULLADDR(nancfg->nan_nmi_mac)) {
+               wl_release_vif_macaddr(cfg, nancfg->nan_nmi_mac, WL_IF_TYPE_NAN_NMI);
+       }
+       NAN_MUTEX_UNLOCK();
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgnan_get_ndi_macaddr(struct bcm_cfg80211 *cfg, u8* mac_addr)
+{
+       int i = 0;
+       int ret = BCME_OK;
+       bool rand_mac = cfg->nancfg->mac_rand;
+       BCM_REFERENCE(i);
+
+       if (rand_mac) {
+               /* ensure nmi != ndi */
+               do {
+                       RANDOM_BYTES(mac_addr, ETHER_ADDR_LEN);
+                       /* restore mcast and local admin bits to 0 and 1 */
+                       ETHER_SET_UNICAST(mac_addr);
+                       ETHER_SET_LOCALADDR(mac_addr);
+                       i++;
+                       if (i == NAN_RAND_MAC_RETRIES) {
+                               break;
+                       }
+               } while (eacmp(cfg->nancfg->nan_nmi_mac, mac_addr) == 0);
+
+               if (i == NAN_RAND_MAC_RETRIES) {
+                       if (eacmp(cfg->nancfg->nan_nmi_mac, mac_addr) == 0) {
+                               WL_ERR(("\nCouldn't generate rand NDI which != NMI\n"));
+                               ret = BCME_NORESOURCE;
+                               goto fail;
+                       }
+               }
+       } else {
+               if (wl_get_vif_macaddr(cfg, WL_IF_TYPE_NAN,
+                       mac_addr) != BCME_OK) {
+                       ret = -EINVAL;
+                       WL_ERR(("Failed to get mac addr for NDI\n"));
+                       goto fail;
+               }
+       }
+
+fail:
+       return ret;
+}
+
+int
+wl_cfgnan_data_path_iface_create_delete_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, char *ifname, uint16 type, uint8 busstate)
+{
+       u8 mac_addr[ETH_ALEN];
+       s32 ret = BCME_OK;
+       s32 idx;
+       struct wireless_dev *wdev;
+       NAN_DBG_ENTER();
+
+       if (busstate != DHD_BUS_DOWN) {
+               ASSERT(cfg->nancfg->ndi);
+               if (type == NAN_WIFI_SUBCMD_DATA_PATH_IFACE_CREATE) {
+                       if ((idx = wl_cfgnan_get_ndi_idx(cfg)) < 0) {
+                               WL_ERR(("No free idx for NAN NDI\n"));
+                               ret = BCME_NORESOURCE;
+                               goto fail;
+                       }
+
+                       ret = wl_cfgnan_get_ndi_macaddr(cfg, mac_addr);
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Couldn't get mac addr for NDI ret %d\n", ret));
+                               goto fail;
+                       }
+                       wdev = wl_cfg80211_add_if(cfg, ndev, WL_IF_TYPE_NAN,
+                               ifname, mac_addr);
+                       if (!wdev) {
+                               ret = -ENODEV;
+                               WL_ERR(("Failed to create NDI iface = %s, wdev is NULL\n", ifname));
+                               goto fail;
+                       }
+                       /* Store the iface name to pub data so that it can be used
+                        * during NAN enable
+                        */
+                       wl_cfgnan_add_ndi_data(cfg, idx, ifname);
+                       cfg->nancfg->ndi[idx].created = true;
+                       /* Store nan ndev */
+                       cfg->nancfg->ndi[idx].nan_ndev = wdev_to_ndev(wdev);
+
+               } else if (type == NAN_WIFI_SUBCMD_DATA_PATH_IFACE_DELETE) {
+                       ret = wl_cfg80211_del_if(cfg, ndev, NULL, ifname);
+                       if (ret == BCME_OK) {
+                               if (wl_cfgnan_del_ndi_data(cfg, ifname) < 0) {
+                                       WL_ERR(("Failed to find matching data for ndi:%s\n",
+                                       ifname));
+                               }
+                       } else if (ret == -ENODEV) {
+                               WL_INFORM(("Already deleted: %s\n", ifname));
+                               ret = BCME_OK;
+                       } else if (ret != BCME_OK) {
+                               WL_ERR(("failed to delete NDI[%d]\n", ret));
+                       }
+               }
+       } else {
+               ret = -ENODEV;
+               WL_ERR(("Bus is already down, no dev found to remove, ret = %d\n", ret));
+       }
+fail:
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+/*
+ * Return data peer from peer list
+ * for peer_addr
+ * NULL if not found
+ */
+static nan_ndp_peer_t *
+wl_cfgnan_data_get_peer(struct bcm_cfg80211 *cfg,
+       struct ether_addr *peer_addr)
+{
+       uint8 i;
+       nan_ndp_peer_t* peer = cfg->nancfg->nan_ndp_peer_info;
+
+       if (!peer) {
+               WL_ERR(("wl_cfgnan_data_get_peer: nan_ndp_peer_info is NULL\n"));
+               goto exit;
+       }
+       for (i = 0; i < cfg->nancfg->max_ndp_count; i++) {
+               if (peer[i].peer_dp_state != NAN_PEER_DP_NOT_CONNECTED &&
+                       (!memcmp(peer_addr, &peer[i].peer_addr, ETHER_ADDR_LEN))) {
+                       return &peer[i];
+               }
+       }
+
+exit:
+       return NULL;
+}
+
+/*
+ * Returns True if
+ * datapath exists for nan cfg
+ * for given peer
+ */
+bool
+wl_cfgnan_data_dp_exists_with_peer(struct bcm_cfg80211 *cfg,
+               struct ether_addr *peer_addr)
+{
+       bool ret = FALSE;
+       nan_ndp_peer_t* peer = NULL;
+
+       if ((cfg->nancfg->nan_init_state == FALSE) ||
+               (cfg->nancfg->nan_enable == FALSE)) {
+               goto exit;
+       }
+
+       /* check for peer exist */
+       peer = wl_cfgnan_data_get_peer(cfg, peer_addr);
+       if (peer) {
+               ret = TRUE;
+       }
+
+exit:
+       return ret;
+}
+
+/*
+ * As of now API only available
+ * for setting state to CONNECTED
+ * if applicable
+ */
+static void
+wl_cfgnan_data_set_peer_dp_state(struct bcm_cfg80211 *cfg,
+               struct ether_addr *peer_addr, nan_peer_dp_state_t state)
+{
+       nan_ndp_peer_t* peer = NULL;
+       /* check for peer exist */
+       peer = wl_cfgnan_data_get_peer(cfg, peer_addr);
+       if (!peer) {
+               goto end;
+       }
+       peer->peer_dp_state = state;
+end:
+       return;
+}
+
+/* Adds peer to nan data peer list */
+void
+wl_cfgnan_data_add_peer(struct bcm_cfg80211 *cfg,
+               struct ether_addr *peer_addr)
+{
+       uint8 i;
+       nan_ndp_peer_t* peer = NULL;
+       /* check for peer exist */
+       peer = wl_cfgnan_data_get_peer(cfg, peer_addr);
+       if (peer) {
+               peer->dp_count++;
+               goto end;
+       }
+       peer = cfg->nancfg->nan_ndp_peer_info;
+       for (i = 0; i < cfg->nancfg->max_ndp_count; i++) {
+               if (peer[i].peer_dp_state == NAN_PEER_DP_NOT_CONNECTED) {
+                       break;
+               }
+       }
+       if (i == NAN_MAX_NDP_PEER) {
+               WL_DBG(("DP Peer list full, Droopping add peer req\n"));
+               goto end;
+       }
+       /* Add peer to list */
+       memcpy(&peer[i].peer_addr, peer_addr, ETHER_ADDR_LEN);
+       peer[i].dp_count = 1;
+       peer[i].peer_dp_state = NAN_PEER_DP_CONNECTING;
+
+end:
+       return;
+}
+
+/* Removes nan data peer from peer list */
+void
+wl_cfgnan_data_remove_peer(struct bcm_cfg80211 *cfg,
+               struct ether_addr *peer_addr)
+{
+       nan_ndp_peer_t* peer = NULL;
+       /* check for peer exist */
+       peer = wl_cfgnan_data_get_peer(cfg, peer_addr);
+       if (!peer) {
+               WL_DBG(("DP Peer not present in list, "
+                       "Droopping remove peer req\n"));
+               goto end;
+       }
+       peer->dp_count--;
+       if (peer->dp_count == 0) {
+               /* No more NDPs, delete entry */
+               memset(peer, 0, sizeof(nan_ndp_peer_t));
+       } else {
+               /* Set peer dp state to connected if any ndp still exits */
+               peer->peer_dp_state = NAN_PEER_DP_CONNECTED;
+       }
+end:
+       return;
+}
+
+int
+wl_cfgnan_data_path_request_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_datapath_cmd_data_t *cmd_data,
+       uint8 *ndp_instance_id)
+{
+       s32 ret = BCME_OK;
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       wl_nan_dp_req_t *datareq = NULL;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       uint16 buflen_avail;
+       uint8 *pxtlv;
+       struct wireless_dev *wdev;
+       uint16 nan_buf_size;
+       uint8 *resp_buf = NULL;
+       /* Considering fixed params */
+       uint16 data_size = WL_NAN_OBUF_DATA_OFFSET +
+               OFFSETOF(wl_nan_dp_req_t, tlv_params);
+       data_size = ALIGN_SIZE(data_size, 4);
+
+       ret = wl_cfgnan_aligned_data_size_of_opt_dp_params(cfg, &data_size, cmd_data);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to get alligned size of optional params\n"));
+               goto fail;
+       }
+
+       nan_buf_size = data_size;
+       NAN_DBG_ENTER();
+
+       mutex_lock(&cfg->if_sync);
+       NAN_MUTEX_LOCK();
+#ifdef WL_IFACE_MGMT
+       if ((ret = wl_cfg80211_handle_if_role_conflict(cfg, WL_IF_TYPE_NAN)) < 0) {
+               WL_ERR(("Conflicting iface found to be active\n"));
+               ret = BCME_UNSUPPORTED;
+               goto fail;
+       }
+#endif /* WL_IFACE_MGMT */
+
+#ifdef RTT_SUPPORT
+       /* cancel any ongoing RTT session with peer
+       * as we donot support DP and RNG to same peer
+       */
+       wl_cfgnan_handle_dp_ranging_concurrency(cfg, &cmd_data->mac_addr,
+               RTT_GEO_SUSPN_HOST_NDP_TRIGGER);
+#endif /* RTT_SUPPORT */
+
+       nan_buf = MALLOCZ(cfg->osh, data_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       resp_buf = MALLOCZ(cfg->osh, data_size + NAN_IOVAR_NAME_SIZE);
+       if (!resp_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       ret = wl_cfgnan_set_nan_avail(bcmcfg_to_prmry_ndev(cfg),
+                       cfg, &cmd_data->avail_params, WL_AVAIL_LOCAL);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to set avail value with type local\n"));
+               goto fail;
+       }
+
+       ret = wl_cfgnan_set_nan_avail(bcmcfg_to_prmry_ndev(cfg),
+                       cfg, &cmd_data->avail_params, WL_AVAIL_NDC);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to set avail value with type ndc\n"));
+               goto fail;
+       }
+
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_buf_size -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(&nan_buf->cmds[0]);
+       datareq = (wl_nan_dp_req_t *)(sub_cmd->data);
+
+       /* setting default data path type to unicast */
+       datareq->type = WL_NAN_DP_TYPE_UNICAST;
+
+       if (cmd_data->pub_id) {
+               datareq->pub_id = cmd_data->pub_id;
+       }
+
+       if (!ETHER_ISNULLADDR(&cmd_data->mac_addr.octet)) {
+               ret = memcpy_s(&datareq->peer_mac, ETHER_ADDR_LEN,
+                               &cmd_data->mac_addr, ETHER_ADDR_LEN);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy ether addr provided\n"));
+                       goto fail;
+               }
+       } else {
+               WL_ERR(("Invalid ether addr provided\n"));
+               ret = BCME_BADARG;
+               goto fail;
+       }
+
+       /* Retrieve mac from given iface name */
+       wdev = wl_cfg80211_get_wdev_from_ifname(cfg,
+               (char *)cmd_data->ndp_iface);
+       if (!wdev || ETHER_ISNULLADDR(wdev->netdev->dev_addr)) {
+               ret = -EINVAL;
+               WL_ERR(("Failed to retrieve wdev/dev addr for ndp_iface = %s\n",
+                       (char *)cmd_data->ndp_iface));
+               goto fail;
+       }
+
+       if (!ETHER_ISNULLADDR(wdev->netdev->dev_addr)) {
+               ret = memcpy_s(&datareq->ndi, ETHER_ADDR_LEN,
+                               wdev->netdev->dev_addr, ETHER_ADDR_LEN);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy ether addr provided\n"));
+                       goto fail;
+               }
+               WL_TRACE(("%s: Retrieved ndi mac " MACDBG "\n",
+                       __FUNCTION__, MAC2STRDBG(datareq->ndi.octet)));
+       } else {
+               WL_ERR(("Invalid NDI addr retrieved\n"));
+               ret = BCME_BADARG;
+               goto fail;
+       }
+
+       datareq->ndl_qos.min_slots = NAN_NDL_QOS_MIN_SLOT_NO_PREF;
+       datareq->ndl_qos.max_latency = NAN_NDL_QOS_MAX_LAT_NO_PREF;
+
+       /* Fill the sub_command block */
+       sub_cmd->id = htod16(WL_NAN_CMD_DATA_DATAREQ);
+       sub_cmd->len = sizeof(sub_cmd->u.options) +
+               OFFSETOF(wl_nan_dp_req_t, tlv_params);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       pxtlv = (uint8 *)&datareq->tlv_params;
+
+       nan_buf_size -= (sub_cmd->len +
+                       OFFSETOF(bcm_iov_batch_subcmd_t, u.options));
+       buflen_avail = nan_buf_size;
+
+       if (cmd_data->svc_info.data && cmd_data->svc_info.dlen) {
+               ret = bcm_pack_xtlv_entry(&pxtlv, &nan_buf_size,
+                               WL_NAN_XTLV_SD_SVC_INFO, cmd_data->svc_info.dlen,
+                               cmd_data->svc_info.data,
+                               BCM_XTLV_OPTION_ALIGN32);
+               if (ret != BCME_OK) {
+                       WL_ERR(("unable to process svc_spec_info: %d\n", ret));
+                       goto fail;
+               }
+               /* If NDPE is enabled, duplicating svc_info and sending it as part of NDPE TLV list
+                * too along with SD SVC INFO, as FW is considering both of them as different
+                * entities where as framework is sending both of them in same variable
+                * (cmd_data->svc_info). FW will decide which one to use based on
+                * peer's capability (NDPE capable or not)
+                */
+               if (cfg->nancfg->ndpe_enabled) {
+                       ret = bcm_pack_xtlv_entry(&pxtlv, &nan_buf_size,
+                                       WL_NAN_XTLV_SD_NDPE_TLV_LIST, cmd_data->svc_info.dlen,
+                                       cmd_data->svc_info.data,
+                                       BCM_XTLV_OPTION_ALIGN32);
+                       if (ret != BCME_OK) {
+                               WL_ERR(("unable to process NDPE TLV list: %d\n", ret));
+                               goto fail;
+                       }
+               }
+               datareq->flags |= WL_NAN_DP_FLAG_SVC_INFO;
+       }
+
+       /* Security elements */
+
+       if (cmd_data->csid) {
+               WL_TRACE(("Cipher suite type is present, pack it\n"));
+               ret = bcm_pack_xtlv_entry(&pxtlv, &nan_buf_size,
+                               WL_NAN_XTLV_CFG_SEC_CSID, sizeof(nan_sec_csid_e),
+                               (uint8*)&cmd_data->csid, BCM_XTLV_OPTION_ALIGN32);
+               if (unlikely(ret)) {
+                       WL_ERR(("%s: fail to pack on csid\n", __FUNCTION__));
+                       goto fail;
+               }
+       }
+
+       if (cmd_data->ndp_cfg.security_cfg) {
+               if ((cmd_data->key_type == NAN_SECURITY_KEY_INPUT_PMK) ||
+                       (cmd_data->key_type == NAN_SECURITY_KEY_INPUT_PASSPHRASE)) {
+                       if (cmd_data->key.data && cmd_data->key.dlen) {
+                               WL_TRACE(("optional pmk present, pack it\n"));
+                               ret = bcm_pack_xtlv_entry(&pxtlv, &nan_buf_size,
+                                       WL_NAN_XTLV_CFG_SEC_PMK, cmd_data->key.dlen,
+                                       cmd_data->key.data, BCM_XTLV_OPTION_ALIGN32);
+                               if (unlikely(ret)) {
+                                       WL_ERR(("%s: fail to pack on WL_NAN_XTLV_CFG_SEC_PMK\n",
+                                               __FUNCTION__));
+                                       goto fail;
+                               }
+                       }
+               } else {
+                       WL_ERR(("Invalid security key type\n"));
+                       ret = BCME_BADARG;
+                       goto fail;
+               }
+
+               if ((cmd_data->svc_hash.dlen == WL_NAN_SVC_HASH_LEN) &&
+                               (cmd_data->svc_hash.data)) {
+                       WL_TRACE(("svc hash present, pack it\n"));
+                       ret = bcm_pack_xtlv_entry(&pxtlv, &nan_buf_size,
+                                       WL_NAN_XTLV_CFG_SVC_HASH, WL_NAN_SVC_HASH_LEN,
+                                       cmd_data->svc_hash.data, BCM_XTLV_OPTION_ALIGN32);
+                       if (ret != BCME_OK) {
+                               WL_ERR(("%s: fail to pack WL_NAN_XTLV_CFG_SVC_HASH\n",
+                                               __FUNCTION__));
+                               goto fail;
+                       }
+               } else {
+#ifdef WL_NAN_DISC_CACHE
+                       /* check in cache */
+                       nan_disc_result_cache *cache;
+                       cache = wl_cfgnan_get_disc_result(cfg,
+                               datareq->pub_id, &datareq->peer_mac);
+                       if (!cache) {
+                               ret = BCME_ERROR;
+                               WL_ERR(("invalid svc hash data or length = %d\n",
+                                       cmd_data->svc_hash.dlen));
+                               goto fail;
+                       }
+                       WL_TRACE(("svc hash present, pack it\n"));
+                       ret = bcm_pack_xtlv_entry(&pxtlv, &nan_buf_size,
+                                       WL_NAN_XTLV_CFG_SVC_HASH, WL_NAN_SVC_HASH_LEN,
+                                       cache->svc_hash, BCM_XTLV_OPTION_ALIGN32);
+                       if (ret != BCME_OK) {
+                               WL_ERR(("%s: fail to pack WL_NAN_XTLV_CFG_SVC_HASH\n",
+                                               __FUNCTION__));
+                               goto fail;
+                       }
+#else
+                       ret = BCME_ERROR;
+                       WL_ERR(("invalid svc hash data or length = %d\n",
+                                       cmd_data->svc_hash.dlen));
+                       goto fail;
+#endif /* WL_NAN_DISC_CACHE */
+               }
+               /* If the Data req is for secure data connection */
+               datareq->flags |= WL_NAN_DP_FLAG_SECURITY;
+       }
+
+       sub_cmd->len += (buflen_avail - nan_buf_size);
+       nan_buf->is_set = false;
+       nan_buf->count++;
+
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, data_size,
+                       &(cmd_data->status), resp_buf, data_size + NAN_IOVAR_NAME_SIZE);
+       if (unlikely(ret) || unlikely(cmd_data->status)) {
+               WL_ERR(("nan data path request handler failed, ret = %d,"
+                       " status %d, peer: " MACDBG "\n",
+                       ret, cmd_data->status, MAC2STRDBG(&(cmd_data->mac_addr))));
+               goto fail;
+       }
+
+       /* check the response buff */
+       if (ret == BCME_OK) {
+               ret = process_resp_buf(resp_buf + WL_NAN_OBUF_DATA_OFFSET,
+                               ndp_instance_id, WL_NAN_CMD_DATA_DATAREQ);
+               cmd_data->ndp_instance_id = *ndp_instance_id;
+       }
+       WL_INFORM_MEM(("[NAN] DP request successfull (ndp_id:%d), peer: " MACDBG " \n",
+               cmd_data->ndp_instance_id, MAC2STRDBG(&cmd_data->mac_addr)));
+       /* Add peer to data ndp peer list */
+       wl_cfgnan_data_add_peer(cfg, &datareq->peer_mac);
+
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, data_size);
+       }
+
+       if (resp_buf) {
+               MFREE(cfg->osh, resp_buf, data_size + NAN_IOVAR_NAME_SIZE);
+       }
+       NAN_MUTEX_UNLOCK();
+       mutex_unlock(&cfg->if_sync);
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+int
+wl_cfgnan_data_path_response_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_datapath_cmd_data_t *cmd_data)
+{
+       s32 ret = BCME_OK;
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       wl_nan_dp_resp_t *dataresp = NULL;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       uint16 buflen_avail;
+       uint8 *pxtlv;
+       struct wireless_dev *wdev;
+       uint16 nan_buf_size;
+       uint8 *resp_buf = NULL;
+
+       /* Considering fixed params */
+       uint16 data_size = WL_NAN_OBUF_DATA_OFFSET +
+               OFFSETOF(wl_nan_dp_resp_t, tlv_params);
+       data_size = ALIGN_SIZE(data_size, 4);
+       ret = wl_cfgnan_aligned_data_size_of_opt_dp_params(cfg, &data_size, cmd_data);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to get alligned size of optional params\n"));
+               goto fail;
+       }
+       nan_buf_size = data_size;
+
+       NAN_DBG_ENTER();
+
+       mutex_lock(&cfg->if_sync);
+       NAN_MUTEX_LOCK();
+#ifdef WL_IFACE_MGMT
+       if ((ret = wl_cfg80211_handle_if_role_conflict(cfg, WL_IF_TYPE_NAN)) < 0) {
+               WL_ERR(("Conflicting iface found to be active\n"));
+               ret = BCME_UNSUPPORTED;
+               goto fail;
+       }
+#endif /* WL_IFACE_MGMT */
+
+       nan_buf = MALLOCZ(cfg->osh, data_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       resp_buf = MALLOCZ(cfg->osh, data_size + NAN_IOVAR_NAME_SIZE);
+       if (!resp_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       ret = wl_cfgnan_set_nan_avail(bcmcfg_to_prmry_ndev(cfg),
+                       cfg, &cmd_data->avail_params, WL_AVAIL_LOCAL);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to set avail value with type local\n"));
+               goto fail;
+       }
+
+       ret = wl_cfgnan_set_nan_avail(bcmcfg_to_prmry_ndev(cfg),
+                       cfg, &cmd_data->avail_params, WL_AVAIL_NDC);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to set avail value with type ndc\n"));
+               goto fail;
+       }
+
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_buf_size -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(&nan_buf->cmds[0]);
+       dataresp = (wl_nan_dp_resp_t *)(sub_cmd->data);
+
+       /* Setting default data path type to unicast */
+       dataresp->type = WL_NAN_DP_TYPE_UNICAST;
+       /* Changing status value as per fw convention */
+       dataresp->status = cmd_data->rsp_code ^= 1;
+       dataresp->reason_code = 0;
+
+       /* ndp instance id must be from 1 to 255, 0 is reserved */
+       if (cmd_data->ndp_instance_id < NAN_ID_MIN ||
+                       cmd_data->ndp_instance_id > NAN_ID_MAX) {
+               WL_ERR(("Invalid ndp instance id: %d\n", cmd_data->ndp_instance_id));
+               ret = BCME_BADARG;
+               goto fail;
+       }
+       dataresp->ndp_id = cmd_data->ndp_instance_id;
+
+       /* Retrieved initiator ndi from NanDataPathRequestInd */
+       if (!ETHER_ISNULLADDR(&cfg->nancfg->initiator_ndi.octet)) {
+               ret = memcpy_s(&dataresp->mac_addr, ETHER_ADDR_LEN,
+                               &cfg->nancfg->initiator_ndi, ETHER_ADDR_LEN);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy initiator ndi\n"));
+                       goto fail;
+               }
+       } else {
+               WL_ERR(("Invalid ether addr retrieved\n"));
+               ret = BCME_BADARG;
+               goto fail;
+       }
+
+       /* Interface is not mandatory, when it is a reject from framework */
+       if (dataresp->status != WL_NAN_DP_STATUS_REJECTED) {
+#ifdef RTT_SUPPORT
+               /* cancel any ongoing RTT session with peer
+               * as we donot support DP and RNG to same peer
+               */
+               wl_cfgnan_handle_dp_ranging_concurrency(cfg, &cmd_data->mac_addr,
+                       RTT_GEO_SUSPN_HOST_NDP_TRIGGER);
+#endif /* RTT_SUPPORT */
+               /* Retrieve mac from given iface name */
+               wdev = wl_cfg80211_get_wdev_from_ifname(cfg,
+                               (char *)cmd_data->ndp_iface);
+               if (!wdev || ETHER_ISNULLADDR(wdev->netdev->dev_addr)) {
+                       ret = -EINVAL;
+                       WL_ERR(("Failed to retrieve wdev/dev addr for ndp_iface = %s\n",
+                               (char *)cmd_data->ndp_iface));
+                       goto fail;
+               }
+
+               if (!ETHER_ISNULLADDR(wdev->netdev->dev_addr)) {
+                       ret = memcpy_s(&dataresp->ndi, ETHER_ADDR_LEN,
+                                       wdev->netdev->dev_addr, ETHER_ADDR_LEN);
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy responder ndi\n"));
+                               goto fail;
+                       }
+                       WL_TRACE(("%s: Retrieved ndi mac " MACDBG "\n",
+                                       __FUNCTION__, MAC2STRDBG(dataresp->ndi.octet)));
+               } else {
+                       WL_ERR(("Invalid NDI addr retrieved\n"));
+                       ret = BCME_BADARG;
+                       goto fail;
+               }
+       }
+
+       dataresp->ndl_qos.min_slots = NAN_NDL_QOS_MIN_SLOT_NO_PREF;
+       dataresp->ndl_qos.max_latency = NAN_NDL_QOS_MAX_LAT_NO_PREF;
+
+       /* Fill the sub_command block */
+       sub_cmd->id = htod16(WL_NAN_CMD_DATA_DATARESP);
+       sub_cmd->len = sizeof(sub_cmd->u.options) +
+               OFFSETOF(wl_nan_dp_resp_t, tlv_params);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       pxtlv = (uint8 *)&dataresp->tlv_params;
+
+       nan_buf_size -= (sub_cmd->len +
+                       OFFSETOF(bcm_iov_batch_subcmd_t, u.options));
+       buflen_avail = nan_buf_size;
+
+       if (cmd_data->svc_info.data && cmd_data->svc_info.dlen) {
+               ret = bcm_pack_xtlv_entry(&pxtlv, &nan_buf_size,
+                               WL_NAN_XTLV_SD_SVC_INFO, cmd_data->svc_info.dlen,
+                               cmd_data->svc_info.data,
+                               BCM_XTLV_OPTION_ALIGN32);
+               if (ret != BCME_OK) {
+                       WL_ERR(("unable to process svc_spec_info: %d\n", ret));
+                       goto fail;
+               }
+               /* If NDPE is enabled, duplicating svc_info and sending it as part of NDPE TLV list
+                * too along with SD SVC INFO, as FW is considering both of them as different
+                * entities where as framework is sending both of them in same variable
+                * (cmd_data->svc_info). FW will decide which one to use based on
+                * peer's capability (NDPE capable or not)
+                */
+               if (cfg->nancfg->ndpe_enabled) {
+                       ret = bcm_pack_xtlv_entry(&pxtlv, &nan_buf_size,
+                                       WL_NAN_XTLV_SD_NDPE_TLV_LIST, cmd_data->svc_info.dlen,
+                                       cmd_data->svc_info.data,
+                                       BCM_XTLV_OPTION_ALIGN32);
+                       if (ret != BCME_OK) {
+                               WL_ERR(("unable to process NDPE TLV list: %d\n", ret));
+                               goto fail;
+                       }
+               }
+               dataresp->flags |= WL_NAN_DP_FLAG_SVC_INFO;
+       }
+
+       /* Security elements */
+       if (cmd_data->csid) {
+               WL_TRACE(("Cipher suite type is present, pack it\n"));
+               ret = bcm_pack_xtlv_entry(&pxtlv, &nan_buf_size,
+                               WL_NAN_XTLV_CFG_SEC_CSID, sizeof(nan_sec_csid_e),
+                               (uint8*)&cmd_data->csid, BCM_XTLV_OPTION_ALIGN32);
+               if (unlikely(ret)) {
+                       WL_ERR(("%s: fail to pack csid\n", __FUNCTION__));
+                       goto fail;
+               }
+       }
+
+       if (cmd_data->ndp_cfg.security_cfg) {
+               if ((cmd_data->key_type == NAN_SECURITY_KEY_INPUT_PMK) ||
+                       (cmd_data->key_type == NAN_SECURITY_KEY_INPUT_PASSPHRASE)) {
+                       if (cmd_data->key.data && cmd_data->key.dlen) {
+                               WL_TRACE(("optional pmk present, pack it\n"));
+                               ret = bcm_pack_xtlv_entry(&pxtlv, &nan_buf_size,
+                                       WL_NAN_XTLV_CFG_SEC_PMK, cmd_data->key.dlen,
+                                       cmd_data->key.data, BCM_XTLV_OPTION_ALIGN32);
+                               if (unlikely(ret)) {
+                                       WL_ERR(("%s: fail to pack WL_NAN_XTLV_CFG_SEC_PMK\n",
+                                               __FUNCTION__));
+                                       goto fail;
+                               }
+                       }
+               } else {
+                       WL_ERR(("Invalid security key type\n"));
+                       ret = BCME_BADARG;
+                       goto fail;
+               }
+
+               if ((cmd_data->svc_hash.dlen == WL_NAN_SVC_HASH_LEN) &&
+                               (cmd_data->svc_hash.data)) {
+                       WL_TRACE(("svc hash present, pack it\n"));
+                       ret = bcm_pack_xtlv_entry(&pxtlv, &nan_buf_size,
+                                       WL_NAN_XTLV_CFG_SVC_HASH, WL_NAN_SVC_HASH_LEN,
+                                       cmd_data->svc_hash.data,
+                                       BCM_XTLV_OPTION_ALIGN32);
+                       if (ret != BCME_OK) {
+                               WL_ERR(("%s: fail to pack WL_NAN_XTLV_CFG_SVC_HASH\n",
+                                               __FUNCTION__));
+                               goto fail;
+                       }
+               }
+               /* If the Data resp is for secure data connection */
+               dataresp->flags |= WL_NAN_DP_FLAG_SECURITY;
+       }
+
+       sub_cmd->len += (buflen_avail - nan_buf_size);
+
+       nan_buf->is_set = false;
+       nan_buf->count++;
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, data_size,
+                       &(cmd_data->status), resp_buf, data_size + NAN_IOVAR_NAME_SIZE);
+       if (unlikely(ret) || unlikely(cmd_data->status)) {
+               WL_ERR(("nan data path response handler failed, error = %d, status %d\n",
+                               ret, cmd_data->status));
+               goto fail;
+       }
+
+       WL_INFORM_MEM(("[NAN] DP response successfull (ndp_id:%d)\n", dataresp->ndp_id));
+
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, data_size);
+       }
+
+       if (resp_buf) {
+               MFREE(cfg->osh, resp_buf, data_size + NAN_IOVAR_NAME_SIZE);
+       }
+       NAN_MUTEX_UNLOCK();
+       mutex_unlock(&cfg->if_sync);
+
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+int wl_cfgnan_data_path_end_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_data_path_id ndp_instance_id,
+       int *status)
+{
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       wl_nan_dp_end_t *dataend = NULL;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(ndev);
+
+       NAN_DBG_ENTER();
+       NAN_MUTEX_LOCK();
+
+       if (!dhdp->up) {
+               WL_ERR(("bus is already down, hence blocking nan dp end\n"));
+               ret = BCME_OK;
+               goto fail;
+       }
+
+       if (!cfg->nancfg->nan_enable) {
+               WL_ERR(("nan is not enabled, nan dp end blocked\n"));
+               ret = BCME_OK;
+               goto fail;
+       }
+
+       /* ndp instance id must be from 1 to 255, 0 is reserved */
+       if (ndp_instance_id < NAN_ID_MIN ||
+               ndp_instance_id > NAN_ID_MAX) {
+               WL_ERR(("Invalid ndp instance id: %d\n", ndp_instance_id));
+               ret = BCME_BADARG;
+               goto fail;
+       }
+
+       nan_buf = MALLOCZ(cfg->osh, nan_buf_size);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_buf_size -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(&nan_buf->cmds[0]);
+       dataend = (wl_nan_dp_end_t *)(sub_cmd->data);
+
+       /* Fill sub_cmd block */
+       sub_cmd->id = htod16(WL_NAN_CMD_DATA_DATAEND);
+       sub_cmd->len = sizeof(sub_cmd->u.options) +
+               sizeof(*dataend);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+
+       dataend->lndp_id = ndp_instance_id;
+
+       /*
+        * Currently fw requires ndp_id and reason to end the data path
+        * But wifi_nan.h takes ndp_instances_count and ndp_id.
+        * Will keep reason = accept always.
+        */
+
+       dataend->status = 1;
+
+       nan_buf->is_set = true;
+       nan_buf->count++;
+
+       nan_buf_size -= (sub_cmd->len +
+               OFFSETOF(bcm_iov_batch_subcmd_t, u.options));
+       bzero(resp_buf, sizeof(resp_buf));
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size,
+                       status, (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(*status)) {
+               WL_ERR(("nan data path end handler failed, error = %d status %d\n",
+                       ret, *status));
+               goto fail;
+       }
+       WL_INFORM_MEM(("[NAN] DP end successfull (ndp_id:%d)\n",
+               dataend->lndp_id));
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+
+       NAN_MUTEX_UNLOCK();
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+#ifdef WL_NAN_DISC_CACHE
+int wl_cfgnan_sec_info_handler(struct bcm_cfg80211 *cfg,
+               nan_datapath_sec_info_cmd_data_t *cmd_data, nan_hal_resp_t *nan_req_resp)
+{
+       s32 ret = BCME_NOTFOUND;
+       /* check in cache */
+       nan_disc_result_cache *disc_cache = NULL;
+       nan_svc_info_t *svc_info = NULL;
+
+       NAN_DBG_ENTER();
+       NAN_MUTEX_LOCK();
+
+       if (!cfg->nancfg->nan_init_state) {
+               WL_ERR(("nan is not initialized/nmi doesnt exists\n"));
+               ret = BCME_NOTENABLED;
+               goto fail;
+       }
+
+       /* datapath request context */
+       if (cmd_data->pub_id && !ETHER_ISNULLADDR(&cmd_data->mac_addr)) {
+               disc_cache = wl_cfgnan_get_disc_result(cfg,
+                       cmd_data->pub_id, &cmd_data->mac_addr);
+               WL_DBG(("datapath request: PUB ID: = %d\n",
+                       cmd_data->pub_id));
+               if (disc_cache) {
+                       (void)memcpy_s(nan_req_resp->svc_hash, WL_NAN_SVC_HASH_LEN,
+                                       disc_cache->svc_hash, WL_NAN_SVC_HASH_LEN);
+                       ret = BCME_OK;
+               } else {
+                       WL_ERR(("disc_cache is NULL\n"));
+                       goto fail;
+               }
+       }
+
+       /* datapath response context */
+       if (cmd_data->ndp_instance_id) {
+               WL_DBG(("datapath response: NDP ID: = %d\n",
+                       cmd_data->ndp_instance_id));
+               svc_info = wl_cfgnan_get_svc_inst(cfg, 0, cmd_data->ndp_instance_id);
+               /* Note: svc_info will not be present in OOB cases
+               * In such case send NMI alone and let HAL handle if
+               * svc_hash is mandatory
+               */
+               if (svc_info) {
+                       WL_DBG(("svc hash present, pack it\n"));
+                       (void)memcpy_s(nan_req_resp->svc_hash, WL_NAN_SVC_HASH_LEN,
+                                       svc_info->svc_hash, WL_NAN_SVC_HASH_LEN);
+               } else {
+                       WL_INFORM_MEM(("svc_info not present..assuming OOB DP\n"));
+               }
+               /* Always send NMI */
+               (void)memcpy_s(nan_req_resp->pub_nmi, ETHER_ADDR_LEN,
+                               cfg->nancfg->nan_nmi_mac, ETHER_ADDR_LEN);
+               ret = BCME_OK;
+       }
+fail:
+       NAN_MUTEX_UNLOCK();
+       NAN_DBG_EXIT();
+       return ret;
+}
+#endif /* WL_NAN_DISC_CACHE */
+
+#ifdef RTT_SUPPORT
+static s32 wl_nan_cache_to_event_data(nan_disc_result_cache *cache,
+       nan_event_data_t *nan_event_data, osl_t *osh)
+{
+       s32 ret = BCME_OK;
+       NAN_DBG_ENTER();
+
+       nan_event_data->pub_id = cache->pub_id;
+       nan_event_data->sub_id = cache->sub_id;
+       nan_event_data->publish_rssi = cache->publish_rssi;
+       nan_event_data->peer_cipher_suite = cache->peer_cipher_suite;
+       ret = memcpy_s(&nan_event_data->remote_nmi, ETHER_ADDR_LEN,
+                       &cache->peer, ETHER_ADDR_LEN);
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to copy cached peer nan nmi\n"));
+               goto fail;
+       }
+
+       if (cache->svc_info.dlen && cache->svc_info.data) {
+               nan_event_data->svc_info.dlen = cache->svc_info.dlen;
+               nan_event_data->svc_info.data =
+                       MALLOCZ(osh, nan_event_data->svc_info.dlen);
+               if (!nan_event_data->svc_info.data) {
+                       WL_ERR(("%s: memory allocation failed\n", __FUNCTION__));
+                       nan_event_data->svc_info.dlen = 0;
+                       ret = -ENOMEM;
+                       goto fail;
+               }
+               ret = memcpy_s(nan_event_data->svc_info.data, nan_event_data->svc_info.dlen,
+                       cache->svc_info.data, cache->svc_info.dlen);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy cached svc info data\n"));
+                       goto fail;
+               }
+       }
+       if (cache->tx_match_filter.dlen && cache->tx_match_filter.data) {
+               nan_event_data->tx_match_filter.dlen = cache->tx_match_filter.dlen;
+               nan_event_data->tx_match_filter.data =
+                       MALLOCZ(osh, nan_event_data->tx_match_filter.dlen);
+               if (!nan_event_data->tx_match_filter.data) {
+                       WL_ERR(("%s: memory allocation failed\n", __FUNCTION__));
+                       nan_event_data->tx_match_filter.dlen = 0;
+                       ret = -ENOMEM;
+                       goto fail;
+               }
+               ret = memcpy_s(nan_event_data->tx_match_filter.data,
+                               nan_event_data->tx_match_filter.dlen,
+                               cache->tx_match_filter.data, cache->tx_match_filter.dlen);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy cached tx match filter data\n"));
+                       goto fail;
+               }
+       }
+fail:
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+/*
+ * API to cancel the ranging for given instance
+ * For geofence initiator, suspend ranging.
+ * for directed RTT initiator , report fail result, cancel ranging
+ * and clear ranging instance
+ * For responder, cancel ranging and clear ranging instance
+ */
+static s32
+wl_cfgnan_clear_peer_ranging(struct bcm_cfg80211 *cfg,
+               nan_ranging_inst_t *rng_inst, int reason)
+{
+       uint32 status = 0;
+       int err = BCME_OK;
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       if (rng_inst->range_type == RTT_TYPE_NAN_GEOFENCE &&
+               rng_inst->range_role == NAN_RANGING_ROLE_INITIATOR) {
+               err = wl_cfgnan_suspend_geofence_rng_session(ndev,
+                               &rng_inst->peer_addr, reason, 0);
+       } else {
+               if (rng_inst->range_type == RTT_TYPE_NAN_DIRECTED) {
+                       dhd_rtt_handle_nan_rtt_session_end(dhdp,
+                               &rng_inst->peer_addr);
+               }
+               /* responder */
+               err = wl_cfgnan_cancel_ranging(ndev, cfg,
+                       &rng_inst->range_id,
+                       NAN_RNG_TERM_FLAG_IMMEDIATE, &status);
+               wl_cfgnan_reset_remove_ranging_instance(cfg, rng_inst);
+       }
+
+       if (err) {
+               WL_ERR(("Failed to stop ranging with peer, err : %d\n", err));
+       }
+
+       return err;
+}
+
+/*
+ * Handle NDP-Ranging Concurrency,
+ * for incoming DP Reuest
+ * Cancel Ranging with same peer
+ * Cancel Ranging for set up in prog
+ * for all other peers
+ */
+static s32
+wl_cfgnan_handle_dp_ranging_concurrency(struct bcm_cfg80211 *cfg,
+               struct ether_addr *peer, int reason)
+{
+       uint8 i = 0;
+       nan_ranging_inst_t *cur_rng_inst = NULL;
+       nan_ranging_inst_t *rng_inst = NULL;
+       int err = BCME_OK;
+
+       /*
+        * FixMe:
+        * DP Ranging Concurrency will need more
+        * than what has been addressed till now
+        * Poll max rng sessions and update it
+        * take relevant actions accordingly
+        */
+
+       cur_rng_inst = wl_cfgnan_check_for_ranging(cfg, peer);
+
+       for (i = 0; i < NAN_MAX_RANGING_INST; i++) {
+               rng_inst = &cfg->nancfg->nan_ranging_info[i];
+               if (rng_inst->in_use) {
+                       if ((cur_rng_inst && cur_rng_inst == rng_inst) ||
+                               NAN_RANGING_SETUP_IS_IN_PROG(rng_inst->range_status)) {
+                               err = wl_cfgnan_clear_peer_ranging(cfg, rng_inst,
+                                               RTT_GEO_SUSPN_HOST_NDP_TRIGGER);
+                       }
+               }
+       }
+
+       if (err) {
+               WL_ERR(("Failed to handle dp ranging concurrency, err : %d\n", err));
+       }
+
+       return err;
+}
+#endif /* RTT_SUPPORT */
+
+static s32
+wl_nan_dp_cmn_event_data(struct bcm_cfg80211 *cfg, void *event_data,
+               uint16 data_len, uint16 *tlvs_offset,
+               uint16 *nan_opts_len, uint32 event_num,
+               int *hal_event_id, nan_event_data_t *nan_event_data)
+{
+       s32 ret = BCME_OK;
+       uint8 i;
+       wl_nan_ev_datapath_cmn_t *ev_dp;
+       nan_svc_info_t *svc_info;
+       bcm_xtlv_t *xtlv = (bcm_xtlv_t *)event_data;
+#ifdef RTT_SUPPORT
+       nan_ranging_inst_t *rng_inst = NULL;
+#endif /* RTT_SUPPORT */
+
+       if (xtlv->id == WL_NAN_XTLV_DATA_DP_INFO) {
+               ev_dp = (wl_nan_ev_datapath_cmn_t *)xtlv->data;
+               NAN_DBG_ENTER();
+
+               BCM_REFERENCE(svc_info);
+               BCM_REFERENCE(i);
+               /* Mapping to common struct between DHD and HAL */
+               WL_TRACE(("Event type: %d\n", ev_dp->type));
+               nan_event_data->type = ev_dp->type;
+               WL_TRACE(("pub_id: %d\n", ev_dp->pub_id));
+               nan_event_data->pub_id = ev_dp->pub_id;
+               WL_TRACE(("security: %d\n", ev_dp->security));
+               nan_event_data->security = ev_dp->security;
+
+               /* Store initiator_ndi, required for data_path_response_request */
+               ret = memcpy_s(&cfg->nancfg->initiator_ndi, ETHER_ADDR_LEN,
+                               &ev_dp->initiator_ndi, ETHER_ADDR_LEN);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy event's initiator addr\n"));
+                       goto fail;
+               }
+               if (ev_dp->type == NAN_DP_SESSION_UNICAST) {
+                       WL_INFORM_MEM(("NDP ID: %d\n", ev_dp->ndp_id));
+                       nan_event_data->ndp_id = ev_dp->ndp_id;
+                       WL_TRACE(("INITIATOR_NDI: " MACDBG "\n",
+                                       MAC2STRDBG(ev_dp->initiator_ndi.octet)));
+                       WL_TRACE(("RESPONDOR_NDI: " MACDBG "\n",
+                                       MAC2STRDBG(ev_dp->responder_ndi.octet)));
+                       WL_TRACE(("PEER NMI: " MACDBG "\n",
+                                       MAC2STRDBG(ev_dp->peer_nmi.octet)));
+                       ret = memcpy_s(&nan_event_data->remote_nmi, ETHER_ADDR_LEN,
+                                       &ev_dp->peer_nmi, ETHER_ADDR_LEN);
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy event's peer nmi\n"));
+                               goto fail;
+                       }
+               } else {
+                       /* type is multicast */
+                       WL_INFORM_MEM(("NDP ID: %d\n", ev_dp->mc_id));
+                       nan_event_data->ndp_id = ev_dp->mc_id;
+                       WL_TRACE(("PEER NMI: " MACDBG "\n",
+                                       MAC2STRDBG(ev_dp->peer_nmi.octet)));
+                       ret = memcpy_s(&nan_event_data->remote_nmi, ETHER_ADDR_LEN,
+                                       &ev_dp->peer_nmi,
+                                       ETHER_ADDR_LEN);
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy event's peer nmi\n"));
+                               goto fail;
+                       }
+               }
+               *tlvs_offset = OFFSETOF(wl_nan_ev_datapath_cmn_t, opt_tlvs) +
+                       OFFSETOF(bcm_xtlv_t, data);
+               *nan_opts_len = data_len - *tlvs_offset;
+               if (event_num == WL_NAN_EVENT_PEER_DATAPATH_IND) {
+                       *hal_event_id = GOOGLE_NAN_EVENT_DATA_REQUEST;
+#ifdef WL_NAN_DISC_CACHE
+                       ret = wl_cfgnan_svc_inst_add_ndp(cfg, nan_event_data->pub_id,
+                                       nan_event_data->ndp_id);
+                       if (ret != BCME_OK) {
+                               goto fail;
+                       }
+#endif /* WL_NAN_DISC_CACHE */
+                       /* Add peer to data ndp peer list */
+                       wl_cfgnan_data_add_peer(cfg, &ev_dp->peer_nmi);
+#ifdef RTT_SUPPORT
+                       /* cancel any ongoing RTT session with peer
+                        * as we donot support DP and RNG to same peer
+                        */
+                       wl_cfgnan_handle_dp_ranging_concurrency(cfg, &ev_dp->peer_nmi,
+                                       RTT_GEO_SUSPN_PEER_NDP_TRIGGER);
+#endif /* RTT_SUPPORT */
+               } else if (event_num == WL_NAN_EVENT_DATAPATH_ESTB) {
+                       *hal_event_id = GOOGLE_NAN_EVENT_DATA_CONFIRMATION;
+                       if (ev_dp->role == NAN_DP_ROLE_INITIATOR) {
+                               ret = memcpy_s(&nan_event_data->responder_ndi, ETHER_ADDR_LEN,
+                                               &ev_dp->responder_ndi,
+                                               ETHER_ADDR_LEN);
+                               if (ret != BCME_OK) {
+                                       WL_ERR(("Failed to copy event's responder ndi\n"));
+                                       goto fail;
+                               }
+                               WL_TRACE(("REMOTE_NDI: " MACDBG "\n",
+                                               MAC2STRDBG(ev_dp->responder_ndi.octet)));
+                               WL_TRACE(("Initiator status %d\n", nan_event_data->status));
+                       } else {
+                               ret = memcpy_s(&nan_event_data->responder_ndi, ETHER_ADDR_LEN,
+                                               &ev_dp->initiator_ndi,
+                                               ETHER_ADDR_LEN);
+                               if (ret != BCME_OK) {
+                                       WL_ERR(("Failed to copy event's responder ndi\n"));
+                                       goto fail;
+                               }
+                               WL_TRACE(("REMOTE_NDI: " MACDBG "\n",
+                                               MAC2STRDBG(ev_dp->initiator_ndi.octet)));
+                       }
+                       if (ev_dp->status == NAN_NDP_STATUS_ACCEPT) {
+                               nan_event_data->status = NAN_DP_REQUEST_ACCEPT;
+                               wl_cfgnan_data_set_peer_dp_state(cfg, &ev_dp->peer_nmi,
+                                       NAN_PEER_DP_CONNECTED);
+                               wl_cfgnan_update_dp_info(cfg, true, nan_event_data->ndp_id);
+                       } else if (ev_dp->status == NAN_NDP_STATUS_REJECT) {
+                               nan_event_data->status = NAN_DP_REQUEST_REJECT;
+#ifdef WL_NAN_DISC_CACHE
+                               if (ev_dp->role != NAN_DP_ROLE_INITIATOR) {
+                                       /* Only at Responder side,
+                                        * If dp is ended,
+                                        * clear the resp ndp id from the svc info cache
+                                        */
+                                       ret = wl_cfgnan_svc_inst_del_ndp(cfg,
+                                                       nan_event_data->pub_id,
+                                                       nan_event_data->ndp_id);
+                                       if (ret != BCME_OK) {
+                                               goto fail;
+                                       }
+                               }
+#endif /* WL_NAN_DISC_CACHE */
+                               /* Remove peer from data ndp peer list */
+                               wl_cfgnan_data_remove_peer(cfg, &ev_dp->peer_nmi);
+#ifdef RTT_SUPPORT
+                               rng_inst = wl_cfgnan_check_for_ranging(cfg, &ev_dp->peer_nmi);
+                               if (rng_inst) {
+                                       /* Trigger/Reset geofence RTT */
+                                       wl_cfgnan_reset_geofence_ranging(cfg,
+                                               rng_inst, RTT_SCHED_DP_REJECTED);
+                               }
+#endif /* RTT_SUPPORT */
+                       } else {
+                               WL_ERR(("%s:Status code = %x not expected\n",
+                                               __FUNCTION__, ev_dp->status));
+                               ret = BCME_ERROR;
+                               goto fail;
+                       }
+                       WL_TRACE(("Responder status %d\n", nan_event_data->status));
+               } else if (event_num == WL_NAN_EVENT_DATAPATH_END) {
+                       /* Mapping to common struct between DHD and HAL */
+                       *hal_event_id = GOOGLE_NAN_EVENT_DATA_END;
+#ifdef WL_NAN_DISC_CACHE
+                       if (ev_dp->role != NAN_DP_ROLE_INITIATOR) {
+                               /* Only at Responder side,
+                                * If dp is ended,
+                                * clear the resp ndp id from the svc info cache
+                                */
+                               ret = wl_cfgnan_svc_inst_del_ndp(cfg,
+                                               nan_event_data->pub_id,
+                                               nan_event_data->ndp_id);
+                               if (ret != BCME_OK) {
+                                       goto fail;
+                               }
+                       }
+#endif /* WL_NAN_DISC_CACHE */
+                       /* Remove peer from data ndp peer list */
+                       wl_cfgnan_data_remove_peer(cfg, &ev_dp->peer_nmi);
+                       wl_cfgnan_update_dp_info(cfg, false, nan_event_data->ndp_id);
+                       WL_INFORM_MEM(("DP_END for REMOTE_NMI: " MACDBG " with %s\n",
+                               MAC2STRDBG(&ev_dp->peer_nmi),
+                               nan_event_cause_to_str(ev_dp->event_cause)));
+#ifdef RTT_SUPPORT
+                       rng_inst = wl_cfgnan_check_for_ranging(cfg, &ev_dp->peer_nmi);
+                       if (rng_inst) {
+                               /* Trigger/Reset geofence RTT */
+                               WL_INFORM_MEM(("sched geofence rtt from DP_END ctx: " MACDBG "\n",
+                                               MAC2STRDBG(&rng_inst->peer_addr)));
+                               wl_cfgnan_reset_geofence_ranging(cfg, rng_inst,
+                                       RTT_SCHED_DP_END);
+                       }
+#endif /* RTT_SUPPORT */
+               }
+       } else {
+               /* Follow though, not handling other IDs as of now */
+               WL_DBG(("%s:ID = 0x%02x not supported\n", __FUNCTION__, xtlv->id));
+       }
+fail:
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+#ifdef RTT_SUPPORT
+static int
+wl_cfgnan_event_disc_result(struct bcm_cfg80211 *cfg,
+               nan_event_data_t *nan_event_data)
+{
+       int ret = BCME_OK;
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 13, 0)) || defined(WL_VENDOR_EXT_SUPPORT)
+       ret = wl_cfgvendor_send_nan_event(cfg->wdev->wiphy, bcmcfg_to_prmry_ndev(cfg),
+               GOOGLE_NAN_EVENT_SUBSCRIBE_MATCH, nan_event_data);
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to send event to nan hal\n"));
+       }
+#endif /* (LINUX_VERSION_CODE > KERNEL_VERSION(3, 13, 0)) || defined(WL_VENDOR_EXT_SUPPORT) */
+       return ret;
+}
+
+#define IN_GEOFENCE(ingress, egress, distance) (((distance) <= (ingress)) && \
+       ((distance) >= (egress)))
+#define IS_INGRESS_VAL(ingress, distance) ((distance) < (ingress))
+#define IS_EGRESS_VAL(egress, distance) ((distance) > (egress))
+
+static bool
+wl_cfgnan_check_ranging_cond(nan_svc_info_t *svc_info, uint32 distance,
+       uint8 *ranging_ind, uint32 prev_distance)
+{
+       uint8 svc_ind = svc_info->ranging_ind;
+       bool notify = FALSE;
+       bool range_rep_ev_once =
+               !!(svc_info->svc_range_status & SVC_RANGE_REP_EVENT_ONCE);
+       uint32 ingress_limit = svc_info->ingress_limit;
+       uint32 egress_limit = svc_info->egress_limit;
+
+       if (svc_ind & NAN_RANGE_INDICATION_CONT) {
+               *ranging_ind = NAN_RANGE_INDICATION_CONT;
+               notify = TRUE;
+               WL_ERR(("\n%s :Svc has continous Ind %d\n",
+                               __FUNCTION__, __LINE__));
+               goto done;
+       }
+
+       if (svc_ind == (NAN_RANGE_INDICATION_INGRESS |
+               NAN_RANGE_INDICATION_EGRESS)) {
+               if (IN_GEOFENCE(ingress_limit, egress_limit, distance)) {
+                       /* if not already in geofence */
+                       if ((range_rep_ev_once == FALSE) ||
+                               (!IN_GEOFENCE(ingress_limit, egress_limit,
+                               prev_distance))) {
+                               notify = TRUE;
+                               if (distance > prev_distance) {
+                                       *ranging_ind = NAN_RANGE_INDICATION_EGRESS;
+                               } else {
+                                       *ranging_ind = NAN_RANGE_INDICATION_INGRESS;
+                               }
+                               WL_ERR(("\n%s :Svc has geofence Ind %d res_ind %d\n",
+                                       __FUNCTION__, __LINE__, *ranging_ind));
+                       }
+               }
+               goto done;
+       }
+
+       if (svc_ind == NAN_RANGE_INDICATION_INGRESS) {
+               if (IS_INGRESS_VAL(ingress_limit, distance)) {
+                       if ((range_rep_ev_once == FALSE) ||
+                               (prev_distance == INVALID_DISTANCE) ||
+                               !IS_INGRESS_VAL(ingress_limit, prev_distance)) {
+                               notify = TRUE;
+                               *ranging_ind = NAN_RANGE_INDICATION_INGRESS;
+                               WL_ERR(("\n%s :Svc has ingress Ind %d\n",
+                                       __FUNCTION__, __LINE__));
+                       }
+               }
+               goto done;
+       }
+
+       if (svc_ind == NAN_RANGE_INDICATION_EGRESS) {
+               if (IS_EGRESS_VAL(egress_limit, distance)) {
+                       if ((range_rep_ev_once == FALSE) ||
+                               (prev_distance == INVALID_DISTANCE) ||
+                               !IS_EGRESS_VAL(egress_limit, prev_distance)) {
+                               notify = TRUE;
+                               *ranging_ind = NAN_RANGE_INDICATION_EGRESS;
+                               WL_ERR(("\n%s :Svc has egress Ind %d\n",
+                                       __FUNCTION__, __LINE__));
+                       }
+               }
+               goto done;
+       }
+done:
+       WL_INFORM_MEM(("SVC ranging Ind %d distance %d prev_distance %d, "
+               "range_rep_ev_once %d ingress_limit %d egress_limit %d notify %d\n",
+               svc_ind, distance, prev_distance, range_rep_ev_once,
+               ingress_limit, egress_limit, notify));
+       svc_info->svc_range_status |= SVC_RANGE_REP_EVENT_ONCE;
+       return notify;
+}
+
+static int32
+wl_cfgnan_notify_disc_with_ranging(struct bcm_cfg80211 *cfg,
+       nan_ranging_inst_t *rng_inst, nan_event_data_t *nan_event_data, uint32 distance)
+{
+       nan_svc_info_t *svc_info;
+       bool notify_svc = TRUE;
+       nan_disc_result_cache *disc_res = cfg->nancfg->nan_disc_cache;
+       uint8 ranging_ind = 0;
+       int ret = BCME_OK;
+       int i = 0, j = 0;
+       uint8 result_present = nan_event_data->ranging_result_present;
+
+       for (i = 0; i < MAX_SUBSCRIBES; i++) {
+               svc_info = rng_inst->svc_idx[i];
+               if (svc_info && svc_info->ranging_required) {
+                       /* if ranging_result is present notify disc result if
+                       * result satisfies the conditions.
+                       * if ranging_result is not present, then notify disc
+                       * result with out ranging info.
+                       */
+                       if (result_present) {
+                               notify_svc = wl_cfgnan_check_ranging_cond(svc_info, distance,
+                                       &ranging_ind, rng_inst->prev_distance_mm);
+                               nan_event_data->ranging_ind = ranging_ind;
+                       }
+                       WL_DBG(("Ranging notify for svc_id %d, notify %d and ind %d"
+                               " distance_mm %d result_present %d\n", svc_info->svc_id, notify_svc,
+                               ranging_ind, distance, result_present));
+               } else {
+                       continue;
+               }
+               if (notify_svc) {
+                       for (j = 0; j < NAN_MAX_CACHE_DISC_RESULT; j++) {
+                               if (!memcmp(&disc_res[j].peer,
+                                       &(rng_inst->peer_addr), ETHER_ADDR_LEN) &&
+                                       (svc_info->svc_id == disc_res[j].sub_id)) {
+                                       ret = wl_nan_cache_to_event_data(&disc_res[j],
+                                               nan_event_data, cfg->osh);
+                                       ret = wl_cfgnan_event_disc_result(cfg, nan_event_data);
+                                       /* If its not match once, clear it as the FW indicates
+                                        * again.
+                                        */
+                                       if (!(svc_info->flags & WL_NAN_MATCH_ONCE)) {
+                                               wl_cfgnan_remove_disc_result(cfg, svc_info->svc_id);
+                                       }
+                               }
+                       }
+               }
+       }
+       WL_DBG(("notify_disc_with_ranging done ret %d\n", ret));
+       return ret;
+}
+
+static int32
+wl_cfgnan_handle_directed_rtt_report(struct bcm_cfg80211 *cfg,
+       nan_ranging_inst_t *rng_inst)
+{
+       int ret = BCME_OK;
+       uint32 status;
+       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+
+       ret = wl_cfgnan_cancel_ranging(bcmcfg_to_prmry_ndev(cfg), cfg,
+                       &rng_inst->range_id, NAN_RNG_TERM_FLAG_IMMEDIATE, &status);
+       if (unlikely(ret) || unlikely(status)) {
+               WL_ERR(("nan range cancel failed ret = %d status = %d\n", ret, status));
+       }
+       dhd_rtt_handle_nan_rtt_session_end(dhd, &rng_inst->peer_addr);
+
+       wl_cfgnan_reset_geofence_ranging(cfg, rng_inst, RTT_SCHED_RNG_RPT_DIRECTED);
+
+       WL_DBG(("Ongoing ranging session is cancelled \n"));
+       return ret;
+}
+
+static void
+wl_cfgnan_disc_result_on_geofence_cancel(struct bcm_cfg80211 *cfg,
+               nan_ranging_inst_t *rng_inst)
+{
+       nan_event_data_t *nan_event_data = NULL;
+
+       nan_event_data = MALLOCZ(cfg->osh, sizeof(*nan_event_data));
+       if (!nan_event_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               goto exit;
+       }
+
+       wl_cfgnan_notify_disc_with_ranging(cfg, rng_inst, nan_event_data, 0);
+
+exit:
+       wl_cfgnan_clear_nan_event_data(cfg, nan_event_data);
+
+       return;
+}
+
+void
+wl_cfgnan_process_range_report(struct bcm_cfg80211 *cfg,
+               wl_nan_ev_rng_rpt_ind_t *range_res, int status)
+{
+       nan_ranging_inst_t *rng_inst = NULL;
+       nan_event_data_t nan_event_data;
+       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+
+       UNUSED_PARAMETER(nan_event_data);
+       rng_inst = wl_cfgnan_check_for_ranging(cfg, &range_res->peer_m_addr);
+       if (!rng_inst) {
+               WL_ERR(("No ranging instance but received RNG RPT event..check \n"));
+               goto exit;
+       }
+
+       if (rng_inst->range_status != NAN_RANGING_SESSION_IN_PROGRESS) {
+               WL_ERR(("SSN not in prog but received RNG RPT event..ignore \n"));
+               goto exit;
+       }
+
+#ifdef NAN_RTT_DBG
+       DUMP_NAN_RTT_INST(rng_inst);
+       DUMP_NAN_RTT_RPT(range_res);
+#endif
+       range_res->rng_id = rng_inst->range_id;
+       bzero(&nan_event_data, sizeof(nan_event_data));
+
+       if (status == BCME_OK) {
+               nan_event_data.ranging_result_present = 1;
+               nan_event_data.range_measurement_cm = range_res->dist_mm;
+               nan_event_data.ranging_ind = range_res->indication;
+       }
+
+       (void)memcpy_s(&nan_event_data.remote_nmi, ETHER_ADDR_LEN,
+                       &range_res->peer_m_addr, ETHER_ADDR_LEN);
+
+       if (rng_inst->range_type == RTT_TYPE_NAN_GEOFENCE) {
+               /* check in cache and event match to host */
+               wl_cfgnan_notify_disc_with_ranging(cfg, rng_inst, &nan_event_data,
+                               range_res->dist_mm);
+               rng_inst->prev_distance_mm = range_res->dist_mm;
+               /* Reset geof retry count on valid measurement */
+               rng_inst->geof_retry_count = 0;
+               /*
+                * Suspend and trigger other targets,
+                * if running sessions maxed out and more
+                * pending targets waiting for trigger
+                */
+               if (dhd_rtt_geofence_sessions_maxed_out(dhd) &&
+                       (dhd_rtt_get_geofence_target_cnt(dhd) >=
+                               dhd_rtt_get_geofence_max_sessions(dhd))) {
+                       /*
+                        * Update the target idx first, before suspending current target
+                        * or else current target will become eligible again
+                        * and will get scheduled again on reset ranging
+                        */
+                       wl_cfgnan_update_geofence_target_idx(cfg);
+                       wl_cfgnan_suspend_geofence_rng_session(bcmcfg_to_prmry_ndev(cfg),
+                               &rng_inst->peer_addr, RTT_GEO_SUSPN_RANGE_RES_REPORTED, 0);
+               }
+               wl_cfgnan_reset_geofence_ranging(cfg,
+                       rng_inst, RTT_SCHED_RNG_RPT_GEOFENCE);
+
+       } else if (rng_inst->range_type == RTT_TYPE_NAN_DIRECTED) {
+               wl_cfgnan_handle_directed_rtt_report(cfg, rng_inst);
+       }
+       rng_inst->ftm_ssn_retry_count = 0;
+
+exit:
+       return;
+}
+#endif /* RTT_SUPPORT */
+
+static void
+wl_nan_print_status(wl_nan_conf_status_t *nstatus)
+{
+       WL_INFORM_MEM(("> NMI: " MACDBG " Cluster_ID: " MACDBG "\n",
+               MAC2STRDBG(nstatus->nmi.octet),
+               MAC2STRDBG(nstatus->cid.octet)));
+
+       WL_INFORM_MEM(("> NAN Device Role %s\n", nan_role_to_str(nstatus->role)));
+       WL_INFORM_MEM(("> Social channels: %d, %d\n",
+               nstatus->social_chans[0], nstatus->social_chans[1]));
+
+       WL_INFORM_MEM(("> Master_rank: " NMRSTR " AMR : " NMRSTR " Hop Count : %d, AMBTT : %d\n",
+               NMR2STR(nstatus->mr),
+               NMR2STR(nstatus->amr),
+               nstatus->hop_count,
+               nstatus->ambtt));
+
+       WL_INFORM_MEM(("> Cluster TSF_H: %x , Cluster TSF_L: %x\n",
+               nstatus->cluster_tsf_h, nstatus->cluster_tsf_l));
+}
+
+static void
+wl_cfgnan_clear_nan_event_data(struct bcm_cfg80211 *cfg,
+       nan_event_data_t *nan_event_data)
+{
+       if (nan_event_data) {
+               if (nan_event_data->tx_match_filter.data) {
+                       MFREE(cfg->osh, nan_event_data->tx_match_filter.data,
+                                       nan_event_data->tx_match_filter.dlen);
+                       nan_event_data->tx_match_filter.data = NULL;
+               }
+               if (nan_event_data->rx_match_filter.data) {
+                       MFREE(cfg->osh, nan_event_data->rx_match_filter.data,
+                                       nan_event_data->rx_match_filter.dlen);
+                       nan_event_data->rx_match_filter.data = NULL;
+               }
+               if (nan_event_data->svc_info.data) {
+                       MFREE(cfg->osh, nan_event_data->svc_info.data,
+                                       nan_event_data->svc_info.dlen);
+                       nan_event_data->svc_info.data = NULL;
+               }
+               if (nan_event_data->sde_svc_info.data) {
+                       MFREE(cfg->osh, nan_event_data->sde_svc_info.data,
+                                       nan_event_data->sde_svc_info.dlen);
+                       nan_event_data->sde_svc_info.data = NULL;
+               }
+               MFREE(cfg->osh, nan_event_data, sizeof(*nan_event_data));
+       }
+
+}
+
+#ifdef RTT_SUPPORT
+bool
+wl_cfgnan_update_geofence_target_idx(struct bcm_cfg80211 *cfg)
+{
+       int8 i = 0, target_cnt = 0;
+       int8 cur_idx = DHD_RTT_INVALID_TARGET_INDEX;
+       rtt_geofence_target_info_t  *geofence_target_info = NULL;
+       bool found = false;
+       nan_ranging_inst_t *rng_inst = NULL;
+       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+
+       cur_idx = dhd_rtt_get_geofence_cur_target_idx(dhd);
+       ASSERT(cur_idx != DHD_RTT_INVALID_TARGET_INDEX);
+
+       target_cnt = dhd_rtt_get_geofence_target_cnt(dhd);
+       ASSERT(target_cnt);
+       if (target_cnt == 0) {
+               WL_DBG(("No geofence targets to schedule\n"));
+               goto exit;
+       }
+       geofence_target_info = rtt_status->geofence_cfg.geofence_target_info;
+
+       /* Loop through to find eligible target idx */
+       i = cur_idx;
+       do {
+               if (geofence_target_info[i].valid == TRUE) {
+                       rng_inst = wl_cfgnan_check_for_ranging(cfg,
+                                       &geofence_target_info[i].peer_addr);
+                       if (rng_inst &&
+                                       (!NAN_RANGING_IS_IN_PROG(rng_inst->range_status))) {
+                               found = TRUE;
+                               break;
+                       }
+               }
+               if (++i == target_cnt) {
+                       i = 0;
+               }
+       } while (i != cur_idx);
+
+       if (found) {
+               dhd_rtt_set_geofence_cur_target_idx(dhd, i);
+       }
+
+exit:
+       return found;
+}
+
+/*
+ * Triggers rtt work thread
+ * if set up not in prog already
+ * and max sessions not maxed out,
+ * after setting next eligible target index
+ */
+void
+wl_cfgnan_reset_geofence_ranging(struct bcm_cfg80211 *cfg,
+               nan_ranging_inst_t * rng_inst, int sched_reason)
+{
+       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+       u8 rtt_invalid_reason = RTT_STATE_VALID;
+       rtt_status_info_t *rtt_status = GET_RTTSTATE(dhd);
+       int8 cur_idx = DHD_RTT_INVALID_TARGET_INDEX;
+       int reset_req_drop = 0;
+
+       WL_INFORM_MEM(("wl_cfgnan_reset_geofence_ranging: "
+               "sched_reason = %d, cur_idx = %d, geofence_interval = %d\n",
+               sched_reason, rtt_status->geofence_cfg.cur_target_idx,
+               rtt_status->geofence_cfg.geofence_rtt_interval));
+
+       if (rtt_status->rtt_sched == TRUE) {
+               reset_req_drop = 1;
+               goto exit;
+       }
+
+       cur_idx = dhd_rtt_get_geofence_cur_target_idx(dhd);
+       if (cur_idx == DHD_RTT_INVALID_TARGET_INDEX) {
+               /*
+                * FIXME:
+                * No Geofence target
+                * Remove all valid ranging inst
+                */
+               if (rng_inst) {
+                       WL_INFORM_MEM(("Removing Ranging Instance " MACDBG "\n",
+                               MAC2STRDBG(&(rng_inst->peer_addr))));
+                       bzero(rng_inst, sizeof(*rng_inst));
+               }
+               /* Cancel pending retry timer if any */
+               if (delayed_work_pending(&rtt_status->rtt_retry_timer)) {
+                       cancel_delayed_work(&rtt_status->rtt_retry_timer);
+               }
+               reset_req_drop = 2;
+               goto exit;
+       }
+
+       if (dhd_rtt_is_geofence_setup_inprog(dhd)) {
+               /* Will be called again for schedule once lock is removed */
+               reset_req_drop = 3;
+               goto exit;
+       }
+
+       /* Avoid schedule if
+        * already geofence running
+        * or Directed RTT in progress
+        * or Invalid RTT state like
+        * NDP with Peer
+        */
+       if ((!RTT_IS_STOPPED(rtt_status)) ||
+               (rtt_invalid_reason != RTT_STATE_VALID)) {
+               /* Not in valid RTT state, avoid schedule */
+               reset_req_drop = 4;
+               goto exit;
+       }
+
+       if (dhd_rtt_geofence_sessions_maxed_out(dhd)) {
+               reset_req_drop = 5;
+               goto exit;
+       }
+
+       if (!wl_cfgnan_update_geofence_target_idx(cfg)) {
+               reset_req_drop = 6;
+               goto exit;
+       }
+
+       /*
+        * FixMe: Retry geofence target over a timer Logic
+        * to be brought back later again
+        * in accordance to new multipeer implementation
+        */
+
+       /* schedule RTT */
+       dhd_rtt_schedule_rtt_work_thread(dhd, sched_reason);
+
+exit:
+       if (reset_req_drop) {
+               WL_INFORM_MEM(("reset geofence req dropped, reason = %d\n",
+                       reset_req_drop));
+       }
+
+       return;
+}
+
+void
+wl_cfgnan_reset_geofence_ranging_for_cur_target(dhd_pub_t *dhd, int sched_reason)
+{
+       struct net_device *dev = dhd_linux_get_primary_netdev(dhd);
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       rtt_geofence_target_info_t  *geofence_target = NULL;
+       nan_ranging_inst_t *ranging_inst = NULL;
+
+       geofence_target = dhd_rtt_get_geofence_current_target(dhd);
+       if (!geofence_target) {
+               WL_DBG(("reset ranging request dropped: geofence target null\n"));
+               goto exit;
+       }
+
+       ranging_inst = wl_cfgnan_check_for_ranging(cfg,
+                       &geofence_target->peer_addr);
+       if (!ranging_inst) {
+               WL_DBG(("reset ranging request dropped: ranging instance null\n"));
+               goto exit;
+       }
+
+       if (NAN_RANGING_IS_IN_PROG(ranging_inst->range_status) &&
+               (ranging_inst->range_type == RTT_TYPE_NAN_GEOFENCE)) {
+               WL_DBG(("Ranging is already in progress for Current target "
+                       MACDBG " \n", MAC2STRDBG(&ranging_inst->peer_addr)));
+               goto exit;
+       }
+
+       wl_cfgnan_reset_geofence_ranging(cfg, ranging_inst, sched_reason);
+
+exit:
+       return;
+}
+
+static bool
+wl_cfgnan_geofence_retry_check(nan_ranging_inst_t *rng_inst, uint8 reason_code)
+{
+       bool geof_retry = FALSE;
+
+       switch (reason_code) {
+               case NAN_RNG_TERM_IDLE_TIMEOUT:
+               /* Fallthrough: Keep adding more reason code if needed */
+               case NAN_RNG_TERM_RNG_RESP_TIMEOUT:
+               case NAN_RNG_TERM_RNG_RESP_REJ:
+               case NAN_RNG_TERM_RNG_TXS_FAIL:
+                       if (rng_inst->geof_retry_count <
+                                       NAN_RNG_GEOFENCE_MAX_RETRY_CNT) {
+                               rng_inst->geof_retry_count++;
+                               geof_retry = TRUE;
+                       }
+                       break;
+               default:
+                       /* FALSE for any other case */
+                       break;
+       }
+
+       return geof_retry;
+}
+#endif /* RTT_SUPPORT */
+
+s32
+wl_cfgnan_notify_nan_status(struct bcm_cfg80211 *cfg,
+       bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *event, void *event_data)
+{
+       uint16 data_len;
+       uint32 event_num;
+       s32 event_type;
+       int hal_event_id = 0;
+       nan_event_data_t *nan_event_data = NULL;
+       nan_parse_event_ctx_t nan_event_ctx;
+       uint16 tlvs_offset = 0;
+       uint16 nan_opts_len = 0;
+       uint8 *tlv_buf;
+       s32 ret = BCME_OK;
+       bcm_xtlv_opts_t xtlv_opt = BCM_IOV_CMD_OPT_ALIGN32;
+       uint32 status;
+       nan_svc_info_t *svc;
+#ifdef RTT_SUPPORT
+       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+       UNUSED_PARAMETER(dhd);
+#endif /* RTT_SUPPORT */
+
+       UNUSED_PARAMETER(wl_nan_print_status);
+       UNUSED_PARAMETER(status);
+       NAN_DBG_ENTER();
+       NAN_MUTEX_LOCK();
+
+       if (!event || !event_data) {
+               WL_ERR(("event data is NULL\n"));
+               ret = -EINVAL;
+               goto exit;
+       }
+
+       event_type = ntoh32(event->event_type);
+       event_num = ntoh32(event->reason);
+       data_len = ntoh32(event->datalen);
+
+       if (NAN_INVALID_EVENT(event_num)) {
+               WL_ERR(("unsupported event, num: %d, event type: %d\n", event_num, event_type));
+               ret = -EINVAL;
+               goto exit;
+       }
+
+       WL_INFORM_MEM((">> Nan Event Received: %s (num=%d, len=%d)\n",
+                       nan_event_to_str(event_num), event_num, data_len));
+
+#ifdef WL_NAN_DEBUG
+       prhex("nan_event_data:", event_data, data_len);
+#endif /* WL_NAN_DEBUG */
+
+       if (!cfg->nancfg->nan_init_state) {
+               WL_ERR(("nan is not in initialized state, dropping nan related events\n"));
+               ret = BCME_OK;
+               goto exit;
+       }
+
+       nan_event_data = MALLOCZ(cfg->osh, sizeof(*nan_event_data));
+       if (!nan_event_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               goto exit;
+       }
+
+       nan_event_ctx.cfg = cfg;
+       nan_event_ctx.nan_evt_data = nan_event_data;
+       /*
+        * send as preformatted hex string
+        * EVENT_NAN <event_type> <tlv_hex_string>
+        */
+       switch (event_num) {
+       case WL_NAN_EVENT_START:
+       case WL_NAN_EVENT_MERGE:
+       case WL_NAN_EVENT_ROLE: {
+               /* get nan status info as-is */
+               bcm_xtlv_t *xtlv = (bcm_xtlv_t *)event_data;
+               wl_nan_conf_status_t *nstatus = (wl_nan_conf_status_t *)xtlv->data;
+               WL_INFORM_MEM((">> Nan Mac Event Received: %s (num=%d, len=%d)\n",
+                       nan_event_to_str(event_num), event_num, data_len));
+               WL_INFORM_MEM(("Nan Device Role %s\n", nan_role_to_str(nstatus->role)));
+               /* Mapping to common struct between DHD and HAL */
+               nan_event_data->enabled = nstatus->enabled;
+               ret = memcpy_s(&nan_event_data->local_nmi, ETHER_ADDR_LEN,
+                       &nstatus->nmi, ETHER_ADDR_LEN);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy nmi\n"));
+                       goto exit;
+               }
+               ret = memcpy_s(&nan_event_data->clus_id, ETHER_ADDR_LEN,
+                       &nstatus->cid, ETHER_ADDR_LEN);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy cluster id\n"));
+                       goto exit;
+               }
+               nan_event_data->nan_de_evt_type = event_num;
+               if (event_num == WL_NAN_EVENT_ROLE) {
+                       wl_nan_print_status(nstatus);
+               }
+
+               if (event_num == WL_NAN_EVENT_START) {
+                       OSL_SMP_WMB();
+                       cfg->nancfg->nan_event_recvd = true;
+                       OSL_SMP_WMB();
+                       wake_up(&cfg->nancfg->nan_event_wait);
+               }
+               hal_event_id = GOOGLE_NAN_EVENT_DE_EVENT;
+               break;
+       }
+       case WL_NAN_EVENT_TERMINATED: {
+               bcm_xtlv_t *xtlv = (bcm_xtlv_t *)event_data;
+               wl_nan_ev_terminated_t *pev = (wl_nan_ev_terminated_t *)xtlv->data;
+
+               /* Mapping to common struct between DHD and HAL */
+               WL_TRACE(("Instance ID: %d\n", pev->instance_id));
+               nan_event_data->local_inst_id = pev->instance_id;
+               WL_TRACE(("Service Type: %d\n", pev->svctype));
+
+#ifdef WL_NAN_DISC_CACHE
+               wl_cfgnan_clear_svc_cache(cfg, pev->instance_id);
+               /* if we have to store disc_res even after sub_cancel
+               * donot call below api..but need to device on the criteria to expire
+               */
+               if (pev->svctype == NAN_SC_SUBSCRIBE) {
+                       wl_cfgnan_remove_disc_result(cfg, pev->instance_id);
+               }
+#endif /* WL_NAN_DISC_CACHE */
+               /* Mapping reason code of FW to status code of framework */
+               if (pev->reason == NAN_TERM_REASON_TIMEOUT ||
+                               pev->reason == NAN_TERM_REASON_USER_REQ ||
+                               pev->reason == NAN_TERM_REASON_COUNT_REACHED) {
+                       nan_event_data->status = NAN_STATUS_SUCCESS;
+                       ret = memcpy_s(nan_event_data->nan_reason,
+                               sizeof(nan_event_data->nan_reason),
+                               "NAN_STATUS_SUCCESS",
+                               strlen("NAN_STATUS_SUCCESS"));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy nan_reason\n"));
+                               goto exit;
+                       }
+               } else {
+                       nan_event_data->status = NAN_STATUS_INTERNAL_FAILURE;
+                       ret = memcpy_s(nan_event_data->nan_reason,
+                               sizeof(nan_event_data->nan_reason),
+                               "NAN_STATUS_INTERNAL_FAILURE",
+                               strlen("NAN_STATUS_INTERNAL_FAILURE"));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy nan_reason\n"));
+                               goto exit;
+                       }
+               }
+
+               if (pev->svctype == NAN_SC_SUBSCRIBE) {
+                       hal_event_id = GOOGLE_NAN_EVENT_SUBSCRIBE_TERMINATED;
+               } else {
+                       hal_event_id = GOOGLE_NAN_EVENT_PUBLISH_TERMINATED;
+               }
+#ifdef WL_NAN_DISC_CACHE
+#ifdef RTT_SUPPORT
+               if (pev->reason != NAN_TERM_REASON_USER_REQ) {
+                       wl_cfgnan_clear_svc_from_all_ranging_inst(cfg, pev->instance_id);
+                       /* terminate ranging sessions */
+                       wl_cfgnan_terminate_all_obsolete_ranging_sessions(cfg);
+               }
+#endif /* RTT_SUPPORT */
+#endif /* WL_NAN_DISC_CACHE */
+               break;
+       }
+
+       case WL_NAN_EVENT_RECEIVE: {
+               nan_opts_len = data_len;
+               hal_event_id = GOOGLE_NAN_EVENT_FOLLOWUP;
+               xtlv_opt = BCM_IOV_CMD_OPT_ALIGN_NONE;
+               break;
+       }
+
+       case WL_NAN_EVENT_TXS: {
+               bcm_xtlv_t *xtlv = (bcm_xtlv_t *)event_data;
+               wl_nan_event_txs_t *txs = (wl_nan_event_txs_t *)xtlv->data;
+               wl_nan_event_sd_txs_t *txs_sd = NULL;
+               if (txs->status == WL_NAN_TXS_SUCCESS) {
+                       WL_INFORM_MEM(("TXS success for type %s(%d) token %d\n",
+                               nan_frm_type_to_str(txs->type), txs->type, txs->host_seq));
+                       nan_event_data->status = NAN_STATUS_SUCCESS;
+                       ret = memcpy_s(nan_event_data->nan_reason,
+                               sizeof(nan_event_data->nan_reason),
+                               "NAN_STATUS_SUCCESS",
+                               strlen("NAN_STATUS_SUCCESS"));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy nan_reason\n"));
+                               goto exit;
+                       }
+               } else {
+                       /* TODO : populate status based on reason codes
+                       For now adding it as no ACK, so that app/framework can retry
+                       */
+                       WL_INFORM_MEM(("TXS failed for type %s(%d) status %d token %d\n",
+                               nan_frm_type_to_str(txs->type), txs->type, txs->status,
+                               txs->host_seq));
+                       nan_event_data->status = NAN_STATUS_NO_OTA_ACK;
+                       ret = memcpy_s(nan_event_data->nan_reason,
+                               sizeof(nan_event_data->nan_reason),
+                               "NAN_STATUS_NO_OTA_ACK",
+                               strlen("NAN_STATUS_NO_OTA_ACK"));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy nan_reason\n"));
+                               goto exit;
+                       }
+               }
+               nan_event_data->reason = txs->reason_code;
+               nan_event_data->token = txs->host_seq;
+               if (txs->type == WL_NAN_FRM_TYPE_FOLLOWUP) {
+                       hal_event_id = GOOGLE_NAN_EVENT_TRANSMIT_FOLLOWUP_IND;
+                       xtlv = (bcm_xtlv_t *)(txs->opt_tlvs);
+                       if (txs->opt_tlvs_len && xtlv->id == WL_NAN_XTLV_SD_TXS) {
+                               txs_sd = (wl_nan_event_sd_txs_t*)xtlv->data;
+                               nan_event_data->local_inst_id = txs_sd->inst_id;
+                       } else {
+                               WL_ERR(("Invalid params in TX status for trasnmit followup"));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+#ifdef RTT_SUPPORT
+               } else if (txs->type == WL_NAN_FRM_TYPE_RNG_RESP) {
+                       xtlv = (bcm_xtlv_t *)(txs->opt_tlvs);
+                       if (txs->opt_tlvs_len && xtlv->id == WL_NAN_XTLV_RNG_TXS) {
+                               wl_nan_range_txs_t* txs_rng_resp = (wl_nan_range_txs_t*)xtlv->data;
+                               nan_ranging_inst_t *rng_inst =
+                                       wl_cfgnan_get_rng_inst_by_id(cfg, txs_rng_resp->range_id);
+                               if (rng_inst &&
+                                       NAN_RANGING_SETUP_IS_IN_PROG(rng_inst->range_status)) {
+                                       /* Unset ranging set up in progress */
+                                       dhd_rtt_update_geofence_sessions_cnt(dhd, FALSE,
+                                               &rng_inst->peer_addr);
+                                       if (txs->status == WL_NAN_TXS_SUCCESS) {
+                                               /* range set up is over, move range in progress */
+                                               rng_inst->range_status =
+                                                       NAN_RANGING_SESSION_IN_PROGRESS;
+                                                /* Increment geofence session count */
+                                               dhd_rtt_update_geofence_sessions_cnt(dhd,
+                                                       TRUE, NULL);
+                                               WL_DBG(("Txs for range resp, rng_id = %d\n",
+                                                       rng_inst->range_id));
+                                       } else {
+                                               wl_cfgnan_reset_remove_ranging_instance(cfg,
+                                                       rng_inst);
+                                       }
+                               }
+                       } else {
+                               WL_ERR(("Invalid params in TX status for range response"));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+#endif /* RTT_SUPPORT */
+               } else { /* TODO: add for other frame types if required */
+                       ret = -EINVAL;
+                       goto exit;
+               }
+               break;
+       }
+
+       case WL_NAN_EVENT_DISCOVERY_RESULT: {
+               nan_opts_len = data_len;
+               hal_event_id = GOOGLE_NAN_EVENT_SUBSCRIBE_MATCH;
+               xtlv_opt = BCM_IOV_CMD_OPT_ALIGN_NONE;
+               break;
+       }
+#ifdef WL_NAN_DISC_CACHE
+       case WL_NAN_EVENT_DISC_CACHE_TIMEOUT: {
+               bcm_xtlv_t *xtlv = (bcm_xtlv_t *)event_data;
+               wl_nan_ev_disc_cache_timeout_t *cache_data =
+                               (wl_nan_ev_disc_cache_timeout_t *)xtlv->data;
+               wl_nan_disc_expired_cache_entry_t *cache_entry = NULL;
+               uint16 xtlv_len = xtlv->len;
+               uint8 entry_idx = 0;
+
+               if (xtlv->id == WL_NAN_XTLV_SD_DISC_CACHE_TIMEOUT) {
+                       xtlv_len = xtlv_len -
+                                       OFFSETOF(wl_nan_ev_disc_cache_timeout_t, cache_exp_list);
+                       while ((entry_idx < cache_data->count) &&
+                                       (xtlv_len >= sizeof(*cache_entry))) {
+                               cache_entry = &cache_data->cache_exp_list[entry_idx];
+                               /* Handle ranging cases for cache timeout */
+                               WL_INFORM_MEM(("WL_NAN_EVENT_DISC_CACHE_TIMEOUT peer: " MACDBG
+                                       " l_id:%d r_id:%d\n", MAC2STRDBG(&cache_entry->r_nmi_addr),
+                                       cache_entry->l_sub_id, cache_entry->r_pub_id));
+#ifdef RTT_SUPPORT
+                               wl_cfgnan_ranging_clear_publish(cfg, &cache_entry->r_nmi_addr,
+                                       cache_entry->l_sub_id);
+#endif /* RTT_SUPPORT */
+                               /* Invalidate local cache info */
+                               wl_cfgnan_remove_disc_result(cfg, cache_entry->l_sub_id);
+                               xtlv_len = xtlv_len - sizeof(*cache_entry);
+                               entry_idx++;
+                       }
+               }
+               break;
+       }
+#ifdef RTT_SUPPORT
+       case WL_NAN_EVENT_RNG_REQ_IND: {
+               wl_nan_ev_rng_req_ind_t *rng_ind;
+               bcm_xtlv_t *xtlv = (bcm_xtlv_t *)event_data;
+
+               nan_opts_len = data_len;
+               rng_ind = (wl_nan_ev_rng_req_ind_t *)xtlv->data;
+               xtlv_opt = BCM_IOV_CMD_OPT_ALIGN_NONE;
+               WL_INFORM_MEM(("Received WL_NAN_EVENT_RNG_REQ_IND range_id %d"
+                       " peer:" MACDBG "\n", rng_ind->rng_id,
+                       MAC2STRDBG(&rng_ind->peer_m_addr)));
+               ret = wl_cfgnan_handle_ranging_ind(cfg, rng_ind);
+               /* no need to event to HAL */
+               goto exit;
+       }
+
+       case WL_NAN_EVENT_RNG_TERM_IND: {
+               bcm_xtlv_t *xtlv = (bcm_xtlv_t *)event_data;
+               nan_ranging_inst_t *rng_inst;
+               wl_nan_ev_rng_term_ind_t *range_term = (wl_nan_ev_rng_term_ind_t *)xtlv->data;
+               int rng_sched_reason = 0;
+               int8 index = -1;
+               rtt_geofence_target_info_t* geofence_target;
+               BCM_REFERENCE(dhd);
+               WL_INFORM_MEM(("Received WL_NAN_EVENT_RNG_TERM_IND peer: " MACDBG ", "
+                       " Range ID:%d Reason Code:%d\n", MAC2STRDBG(&range_term->peer_m_addr),
+                       range_term->rng_id, range_term->reason_code));
+               rng_inst = wl_cfgnan_get_rng_inst_by_id(cfg, range_term->rng_id);
+               if (rng_inst) {
+                       if (!NAN_RANGING_IS_IN_PROG(rng_inst->range_status)) {
+                               WL_DBG(("Late or unsynchronized nan term indicator event\n"));
+                               break;
+                       }
+                       rng_sched_reason = RTT_SCHED_RNG_TERM;
+                       if (rng_inst->range_role == NAN_RANGING_ROLE_RESPONDER) {
+                               dhd_rtt_update_geofence_sessions_cnt(dhd, FALSE,
+                                       &rng_inst->peer_addr);
+                               wl_cfgnan_reset_remove_ranging_instance(cfg, rng_inst);
+                       } else {
+                               if (rng_inst->range_type == RTT_TYPE_NAN_DIRECTED) {
+                                       dhd_rtt_handle_nan_rtt_session_end(dhd,
+                                               &rng_inst->peer_addr);
+                               } else if (rng_inst->range_type == RTT_TYPE_NAN_GEOFENCE) {
+                                       rng_inst->range_status = NAN_RANGING_REQUIRED;
+                                       dhd_rtt_update_geofence_sessions_cnt(dhd, FALSE,
+                                               &rng_inst->peer_addr);
+                                       if (!wl_cfgnan_geofence_retry_check(rng_inst,
+                                                       range_term->reason_code)) {
+                                               /* Report on ranging failure */
+                                               wl_cfgnan_disc_result_on_geofence_cancel(cfg,
+                                                       rng_inst);
+                                               WL_TRACE(("Reset the state on terminate\n"));
+                                               geofence_target = dhd_rtt_get_geofence_target(dhd,
+                                                       &rng_inst->peer_addr, &index);
+                                               if (geofence_target) {
+                                                       dhd_rtt_remove_geofence_target(dhd,
+                                                               &geofence_target->peer_addr);
+                                               }
+                                       }
+                               }
+                       }
+                       /* Reset Ranging Instance and trigger ranging if applicable */
+                       wl_cfgnan_reset_geofence_ranging(cfg, rng_inst, rng_sched_reason);
+               } else {
+                       /*
+                        * This can happen in some scenarios
+                        * like receiving term after a fail txs for range resp
+                        * where ranging instance is already cleared
+                        */
+                       WL_DBG(("Term Indication recieved for a peer without rng inst\n"));
+               }
+               break;
+       }
+
+       case WL_NAN_EVENT_RNG_RESP_IND: {
+               bcm_xtlv_t *xtlv = (bcm_xtlv_t *)event_data;
+               nan_ranging_inst_t *rng_inst;
+               wl_nan_ev_rng_resp_t *range_resp = (wl_nan_ev_rng_resp_t *)xtlv->data;
+
+               WL_INFORM_MEM(("Received WL_NAN_EVENT_RNG_RESP_IND peer: " MACDBG ", "
+                       " Range ID:%d Ranging Status:%d\n", MAC2STRDBG(&range_resp->peer_m_addr),
+                       range_resp->rng_id, range_resp->status));
+               rng_inst = wl_cfgnan_get_rng_inst_by_id(cfg, range_resp->rng_id);
+               if (!rng_inst) {
+                       WL_DBG(("Late or unsynchronized resp indicator event\n"));
+                       break;
+               }
+               //ASSERT(NAN_RANGING_SETUP_IS_IN_PROG(rng_inst->range_status));
+               if (!NAN_RANGING_SETUP_IS_IN_PROG(rng_inst->range_status)) {
+                       WL_INFORM_MEM(("Resp Indicator received for not in prog range inst\n"));
+                       break;
+               }
+               /* range set up is over now, move to range in progress */
+               rng_inst->range_status = NAN_RANGING_SESSION_IN_PROGRESS;
+               if (rng_inst->range_type == RTT_TYPE_NAN_DIRECTED) {
+                       /* FixMe: Ideally, all below like update session cnt
+                        * should be appilicabe to nan rtt and not specific to
+                        * geofence. To be fixed in next RB
+                        */
+                       break;
+               }
+               /*
+               ASSERT(dhd_rtt_is_geofence_setup_inprog_with_peer(dhd,
+                       &rng_inst->peer_addr));
+               */
+               if (!dhd_rtt_is_geofence_setup_inprog_with_peer(dhd,
+                       &rng_inst->peer_addr)) {
+                       WL_INFORM_MEM(("Resp Indicator received for not in prog range peer\n"));
+                       break;
+               }
+               /* Unset geof ranging setup status */
+               dhd_rtt_update_geofence_sessions_cnt(dhd, FALSE, &rng_inst->peer_addr);
+               /* Increase geofence session count */
+               dhd_rtt_update_geofence_sessions_cnt(dhd, TRUE, NULL);
+               wl_cfgnan_reset_geofence_ranging(cfg,
+                       rng_inst, RTT_SCHED_RNG_RESP_IND);
+               break;
+       }
+#endif /* RTT_SUPPORT */
+#endif /* WL_NAN_DISC_CACHE */
+       /*
+        * Data path events data are received in common event struct,
+        * Handling all the events as part of one case, hence fall through is intentional
+        */
+       case WL_NAN_EVENT_PEER_DATAPATH_IND:
+       case WL_NAN_EVENT_DATAPATH_ESTB:
+       case WL_NAN_EVENT_DATAPATH_END: {
+               ret = wl_nan_dp_cmn_event_data(cfg, event_data, data_len,
+                               &tlvs_offset, &nan_opts_len,
+                               event_num, &hal_event_id, nan_event_data);
+               /* Avoiding optional param parsing for DP END Event */
+               if (event_num == WL_NAN_EVENT_DATAPATH_END) {
+                       nan_opts_len = 0;
+                       xtlv_opt = BCM_IOV_CMD_OPT_ALIGN_NONE;
+               }
+               if (unlikely(ret)) {
+                       WL_ERR(("nan dp common event data parse failed\n"));
+                       goto exit;
+               }
+               break;
+       }
+       default:
+               WL_ERR_RLMT(("WARNING: unimplemented NAN APP EVENT = %d\n", event_num));
+               ret = BCME_ERROR;
+               goto exit;
+       }
+
+       if (nan_opts_len) {
+               tlv_buf = (uint8 *)event_data + tlvs_offset;
+               /* Extract event data tlvs and pass their resp to cb fn */
+               ret = bcm_unpack_xtlv_buf((void *)&nan_event_ctx, (const uint8*)tlv_buf,
+                       nan_opts_len, xtlv_opt, wl_cfgnan_set_vars_cbfn);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to unpack tlv data, ret=%d\n", ret));
+               }
+       }
+
+#ifdef WL_NAN_DISC_CACHE
+       if (hal_event_id == GOOGLE_NAN_EVENT_SUBSCRIBE_MATCH) {
+#ifdef RTT_SUPPORT
+               u8 rtt_invalid_reason = RTT_STATE_VALID;
+#endif /* RTT_SUPPORT */
+               u16 update_flags = 0;
+               WL_TRACE(("Cache disc res\n"));
+               ret = wl_cfgnan_cache_disc_result(cfg, nan_event_data, &update_flags);
+               if (ret) {
+                       WL_ERR(("Failed to cache disc result ret %d\n", ret));
+               }
+
+#ifdef RTT_SUPPORT
+               if (nan_event_data->sde_control_flag & NAN_SDE_CF_RANGING_REQUIRED) {
+                       ret = wl_cfgnan_check_disc_result_for_ranging(cfg, nan_event_data);
+                       if (ret == BCME_OK) {
+                               rtt_invalid_reason = dhd_rtt_invalid_states
+                                       (bcmcfg_to_prmry_ndev(cfg),  &nan_event_data->remote_nmi);
+                               /*
+                                * If instant RTT not possible,
+                                * send discovery result instantly like
+                                * incase of invalid rtt state as
+                                * NDP connected/connecting or role_concurrency
+                                * on, otherwise, disc result will be posted
+                                * on ranging report event
+                                */
+                               if (rtt_invalid_reason == RTT_STATE_VALID) {
+                                       /* Avoid sending disc result instantly */
+                                       goto exit;
+                               }
+                       } else {
+                               /* TODO: should we terminate service if ranging fails ? */
+                               WL_INFORM_MEM(("Ranging failed or not required, " MACDBG
+                                       " sub_id:%d , pub_id:%d\n",
+                                       MAC2STRDBG(&nan_event_data->remote_nmi),
+                                       nan_event_data->sub_id, nan_event_data->pub_id));
+                       }
+               } else {
+                       nan_svc_info_t *svc_info = wl_cfgnan_get_svc_inst(cfg,
+                               nan_event_data->sub_id, 0);
+                       if (svc_info && svc_info->ranging_required &&
+                               (update_flags & NAN_DISC_CACHE_PARAM_SDE_CONTROL)) {
+                               wl_cfgnan_ranging_clear_publish(cfg,
+                                       &nan_event_data->remote_nmi, nan_event_data->sub_id);
+                       }
+               }
+#endif /* RTT_SUPPORT */
+
+               /*
+               * If tx match filter is present as part of active subscribe, keep same filter
+               * values in discovery results also.
+               */
+               if (nan_event_data->sub_id == nan_event_data->requestor_id) {
+                       svc = wl_cfgnan_get_svc_inst(cfg, nan_event_data->sub_id, 0);
+                       if (svc && svc->tx_match_filter_len) {
+                               nan_event_data->tx_match_filter.dlen = svc->tx_match_filter_len;
+                               nan_event_data->tx_match_filter.data =
+                                       MALLOCZ(cfg->osh, svc->tx_match_filter_len);
+                               if (!nan_event_data->tx_match_filter.data) {
+                                       WL_ERR(("%s: tx_match_filter_data alloc failed\n",
+                                                       __FUNCTION__));
+                                       nan_event_data->tx_match_filter.dlen = 0;
+                                       ret = -ENOMEM;
+                                       goto exit;
+                               }
+                               ret = memcpy_s(nan_event_data->tx_match_filter.data,
+                                               nan_event_data->tx_match_filter.dlen,
+                                               svc->tx_match_filter, svc->tx_match_filter_len);
+                               if (ret != BCME_OK) {
+                                       WL_ERR(("Failed to copy tx match filter data\n"));
+                                       goto exit;
+                               }
+                       }
+               }
+       }
+#endif /* WL_NAN_DISC_CACHE */
+
+       WL_TRACE(("Send up %s (%d) data to HAL, hal_event_id=%d\n",
+                       nan_event_to_str(event_num), event_num, hal_event_id));
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 13, 0)) || defined(WL_VENDOR_EXT_SUPPORT)
+       ret = wl_cfgvendor_send_nan_event(cfg->wdev->wiphy, bcmcfg_to_prmry_ndev(cfg),
+                       hal_event_id, nan_event_data);
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to send event to nan hal, %s (%d)\n",
+                               nan_event_to_str(event_num), event_num));
+       }
+#endif /* (LINUX_VERSION_CODE > KERNEL_VERSION(3, 13, 0)) || defined(WL_VENDOR_EXT_SUPPORT) */
+
+exit:
+       wl_cfgnan_clear_nan_event_data(cfg, nan_event_data);
+
+       NAN_MUTEX_UNLOCK();
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+#ifdef WL_NAN_DISC_CACHE
+static int
+wl_cfgnan_cache_disc_result(struct bcm_cfg80211 *cfg, void * data,
+       u16 *disc_cache_update_flags)
+{
+       nan_event_data_t* disc = (nan_event_data_t*)data;
+       int i, add_index = 0;
+       int ret = BCME_OK;
+       wl_nancfg_t *nancfg = cfg->nancfg;
+       nan_disc_result_cache *disc_res = nancfg->nan_disc_cache;
+       *disc_cache_update_flags = 0;
+
+       if (!nancfg->nan_enable) {
+               WL_DBG(("nan not enabled"));
+               return BCME_NOTENABLED;
+       }
+       if (nancfg->nan_disc_count == NAN_MAX_CACHE_DISC_RESULT) {
+               WL_DBG(("cache full"));
+               ret = BCME_NORESOURCE;
+               goto done;
+       }
+
+       for (i = 0; i < NAN_MAX_CACHE_DISC_RESULT; i++) {
+               if (!disc_res[i].valid) {
+                       add_index = i;
+                       continue;
+               }
+               if (!memcmp(&disc_res[i].peer, &disc->remote_nmi, ETHER_ADDR_LEN) &&
+                       !memcmp(disc_res[i].svc_hash, disc->svc_name, WL_NAN_SVC_HASH_LEN)) {
+                       WL_DBG(("cache entry already present, i = %d", i));
+                       /* Update needed parameters here */
+                       if (disc_res[i].sde_control_flag != disc->sde_control_flag) {
+                               disc_res[i].sde_control_flag = disc->sde_control_flag;
+                               *disc_cache_update_flags |= NAN_DISC_CACHE_PARAM_SDE_CONTROL;
+                       }
+                       ret = BCME_OK; /* entry already present */
+                       goto done;
+               }
+       }
+       WL_DBG(("adding cache entry: add_index = %d\n", add_index));
+       disc_res[add_index].valid = 1;
+       disc_res[add_index].pub_id = disc->pub_id;
+       disc_res[add_index].sub_id = disc->sub_id;
+       disc_res[add_index].publish_rssi = disc->publish_rssi;
+       disc_res[add_index].peer_cipher_suite = disc->peer_cipher_suite;
+       disc_res[add_index].sde_control_flag = disc->sde_control_flag;
+       ret = memcpy_s(&disc_res[add_index].peer, ETHER_ADDR_LEN,
+                       &disc->remote_nmi, ETHER_ADDR_LEN);
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to copy remote nmi\n"));
+               goto done;
+       }
+       ret = memcpy_s(disc_res[add_index].svc_hash, WL_NAN_SVC_HASH_LEN,
+                       disc->svc_name, WL_NAN_SVC_HASH_LEN);
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to copy svc hash\n"));
+               goto done;
+       }
+
+       if (disc->svc_info.dlen && disc->svc_info.data) {
+               disc_res[add_index].svc_info.dlen = disc->svc_info.dlen;
+               disc_res[add_index].svc_info.data =
+                       MALLOCZ(cfg->osh, disc_res[add_index].svc_info.dlen);
+               if (!disc_res[add_index].svc_info.data) {
+                       WL_ERR(("%s: memory allocation failed\n", __FUNCTION__));
+                       disc_res[add_index].svc_info.dlen = 0;
+                       ret = BCME_NOMEM;
+                       goto done;
+               }
+               ret = memcpy_s(disc_res[add_index].svc_info.data, disc_res[add_index].svc_info.dlen,
+                               disc->svc_info.data, disc->svc_info.dlen);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy svc info\n"));
+                       goto done;
+               }
+       }
+       if (disc->tx_match_filter.dlen && disc->tx_match_filter.data) {
+               disc_res[add_index].tx_match_filter.dlen = disc->tx_match_filter.dlen;
+               disc_res[add_index].tx_match_filter.data =
+                       MALLOCZ(cfg->osh, disc_res[add_index].tx_match_filter.dlen);
+               if (!disc_res[add_index].tx_match_filter.data) {
+                       WL_ERR(("%s: memory allocation failed\n", __FUNCTION__));
+                       disc_res[add_index].tx_match_filter.dlen = 0;
+                       ret = BCME_NOMEM;
+                       goto done;
+               }
+               ret = memcpy_s(disc_res[add_index].tx_match_filter.data,
+                       disc_res[add_index].tx_match_filter.dlen,
+                       disc->tx_match_filter.data, disc->tx_match_filter.dlen);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy tx match filter\n"));
+                       goto done;
+               }
+       }
+       nancfg->nan_disc_count++;
+       WL_DBG(("cfg->nan_disc_count = %d\n", nancfg->nan_disc_count));
+
+done:
+       return ret;
+}
+
+#ifdef RTT_SUPPORT
+/* Sending command to FW for clearing discovery cache info in FW */
+static int
+wl_cfgnan_clear_disc_cache(struct bcm_cfg80211 *cfg, wl_nan_instance_id_t sub_id)
+{
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       uint32 status;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+       uint8 buf[NAN_IOCTL_BUF_SIZE];
+       bcm_iov_batch_buf_t *nan_buf;
+       bcm_iov_batch_subcmd_t *sub_cmd;
+       uint16 subcmd_len;
+
+       bzero(buf, sizeof(buf));
+       nan_buf = (bcm_iov_batch_buf_t*)buf;
+
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_buf_size -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+
+       sub_cmd = (bcm_iov_batch_subcmd_t *)(&nan_buf->cmds[0]);
+       ret = wl_cfg_nan_check_cmd_len(nan_buf_size,
+                       sizeof(sub_id), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               goto fail;
+       }
+
+       /* Fill the sub_command block */
+       sub_cmd->id = htod16(WL_NAN_CMD_SD_DISC_CACHE_CLEAR);
+       sub_cmd->len = sizeof(sub_cmd->u.options) + sizeof(sub_id);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       /* Data size len vs buffer len check is already done above.
+        * So, short buffer error is impossible.
+        */
+       (void)memcpy_s(sub_cmd->data, (nan_buf_size - OFFSETOF(bcm_iov_batch_subcmd_t, data)),
+                       &sub_id, sizeof(sub_id));
+       /* adjust iov data len to the end of last data record */
+       nan_buf_size -= (subcmd_len);
+
+       nan_buf->count++;
+       nan_buf->is_set = true;
+       nan_buf_size = NAN_IOCTL_BUF_SIZE - nan_buf_size;
+       /* Same src and dest len here */
+       bzero(resp_buf, sizeof(resp_buf));
+       ret = wl_cfgnan_execute_ioctl(bcmcfg_to_prmry_ndev(cfg), cfg,
+                       nan_buf, nan_buf_size, &status,
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(status)) {
+               WL_ERR(("Disc cache clear handler failed ret %d status %d\n",
+                               ret, status));
+               goto fail;
+       }
+
+fail:
+       return ret;
+}
+#endif /* RTT_SUPPORT */
+
+static int wl_cfgnan_remove_disc_result(struct bcm_cfg80211 *cfg,
+               uint8 local_subid)
+{
+       int i;
+       int ret = BCME_NOTFOUND;
+       nan_disc_result_cache *disc_res = cfg->nancfg->nan_disc_cache;
+       if (!cfg->nancfg->nan_enable) {
+               WL_DBG(("nan not enabled\n"));
+               ret = BCME_NOTENABLED;
+               goto done;
+       }
+       for (i = 0; i < NAN_MAX_CACHE_DISC_RESULT; i++) {
+               if ((disc_res[i].valid) && (disc_res[i].sub_id == local_subid)) {
+                       WL_TRACE(("make cache entry invalid\n"));
+                       if (disc_res[i].tx_match_filter.data) {
+                               MFREE(cfg->osh, disc_res[i].tx_match_filter.data,
+                                       disc_res[i].tx_match_filter.dlen);
+                       }
+                       if (disc_res[i].svc_info.data) {
+                               MFREE(cfg->osh, disc_res[i].svc_info.data,
+                                       disc_res[i].svc_info.dlen);
+                       }
+                       bzero(&disc_res[i], sizeof(disc_res[i]));
+                       cfg->nancfg->nan_disc_count--;
+                       ret = BCME_OK;
+               }
+       }
+       WL_DBG(("couldn't find entry\n"));
+done:
+       return ret;
+}
+
+static nan_disc_result_cache *
+wl_cfgnan_get_disc_result(struct bcm_cfg80211 *cfg, uint8 remote_pubid,
+       struct ether_addr *peer)
+{
+       int i;
+       nan_disc_result_cache *disc_res = cfg->nancfg->nan_disc_cache;
+       if (remote_pubid) {
+               for (i = 0; i < NAN_MAX_CACHE_DISC_RESULT; i++) {
+                       if ((disc_res[i].pub_id == remote_pubid) &&
+                                       !memcmp(&disc_res[i].peer, peer, ETHER_ADDR_LEN)) {
+                               WL_DBG(("Found entry: i = %d\n", i));
+                               return &disc_res[i];
+                       }
+               }
+       } else {
+               for (i = 0; i < NAN_MAX_CACHE_DISC_RESULT; i++) {
+                       if (!memcmp(&disc_res[i].peer, peer, ETHER_ADDR_LEN)) {
+                               WL_DBG(("Found entry: %d\n", i));
+                               return &disc_res[i];
+                       }
+               }
+       }
+       return NULL;
+}
+#endif /* WL_NAN_DISC_CACHE */
+
+static void
+wl_cfgnan_update_dp_info(struct bcm_cfg80211 *cfg, bool add,
+       nan_data_path_id ndp_id)
+{
+       uint8 i;
+       bool match_found = false;
+       wl_nancfg_t *nancfg = cfg->nancfg;
+       /* As of now, we don't see a need to know which ndp is active.
+        * so just keep tracking of ndp via count. If we need to know
+        * the status of each ndp based on ndp id, we need to change
+        * this implementation to use a bit mask.
+        */
+
+       if (add) {
+               /* On first NAN DP establishment, disable ARP. */
+               for (i = 0; i < NAN_MAX_NDP_PEER; i++) {
+                       if (!nancfg->ndp_id[i]) {
+                               WL_TRACE(("Found empty field\n"));
+                               break;
+                       }
+               }
+
+               if (i == NAN_MAX_NDP_PEER) {
+                       WL_ERR(("%s:cannot accommodate ndp id\n", __FUNCTION__));
+                       return;
+               }
+               if (ndp_id) {
+                       nancfg->nan_dp_count++;
+                       nancfg->ndp_id[i] = ndp_id;
+                       WL_DBG(("%s:Added ndp id = [%d] at i = %d\n",
+                                       __FUNCTION__, nancfg->ndp_id[i], i));
+               }
+       } else {
+               ASSERT(nancfg->nan_dp_count);
+               if (ndp_id) {
+                       for (i = 0; i < NAN_MAX_NDP_PEER; i++) {
+                               if (nancfg->ndp_id[i] == ndp_id) {
+                                       nancfg->ndp_id[i] = 0;
+                                       WL_DBG(("%s:Removed ndp id = [%d] from i = %d\n",
+                                               __FUNCTION__, ndp_id, i));
+                                       match_found = true;
+                                       if (nancfg->nan_dp_count) {
+                                               nancfg->nan_dp_count--;
+                                       }
+                                       break;
+                               } else {
+                                       WL_DBG(("couldn't find entry for ndp id = %d\n",
+                                               ndp_id));
+                               }
+                       }
+                       if (match_found == false) {
+                               WL_ERR(("Received unsaved NDP Id = %d !!\n", ndp_id));
+                       }
+               }
+
+       }
+       WL_INFORM_MEM(("NAN_DP_COUNT: %d\n", nancfg->nan_dp_count));
+}
+
+bool
+wl_cfgnan_is_dp_active(struct net_device *ndev)
+{
+       struct bcm_cfg80211 *cfg;
+       bool nan_dp;
+
+       if (!ndev || !ndev->ieee80211_ptr) {
+               WL_ERR(("ndev/wdev null\n"));
+               return false;
+       }
+
+       cfg =  wiphy_priv(ndev->ieee80211_ptr->wiphy);
+       nan_dp = cfg->nancfg->nan_dp_count ? true : false;
+
+       WL_DBG(("NAN DP status:%d\n", nan_dp));
+       return nan_dp;
+}
+
+static s32
+wl_cfgnan_get_ndi_idx(struct bcm_cfg80211 *cfg)
+{
+       int i;
+       for (i = 0; i < cfg->nancfg->max_ndi_supported; i++) {
+               if (!cfg->nancfg->ndi[i].in_use) {
+                       /* Free interface, use it */
+                       return i;
+               }
+       }
+       /* Don't have a free interface */
+       return WL_INVALID;
+}
+
+static s32
+wl_cfgnan_add_ndi_data(struct bcm_cfg80211 *cfg, s32 idx, char *name)
+{
+       u16 len;
+       wl_nancfg_t *nancfg = cfg->nancfg;
+       if (!name || (idx < 0) || (idx >= cfg->nancfg->max_ndi_supported)) {
+               return -EINVAL;
+       }
+
+       /* Ensure ifname string size <= IFNAMSIZ including null termination */
+       len = MIN(strlen(name), (IFNAMSIZ - 1));
+       strncpy(nancfg->ndi[idx].ifname, name, len);
+       nancfg->ndi[idx].ifname[len] = '\0';
+       nancfg->ndi[idx].in_use = true;
+       nancfg->ndi[idx].created = false;
+
+       /* Don't have a free interface */
+       return WL_INVALID;
+}
+
+static s32
+wl_cfgnan_del_ndi_data(struct bcm_cfg80211 *cfg, char *name)
+{
+       u16 len;
+       int i;
+       wl_nancfg_t *nancfg = cfg->nancfg;
+
+       if (!name) {
+               return -EINVAL;
+       }
+
+       len = MIN(strlen(name), IFNAMSIZ);
+       for (i = 0; i < cfg->nancfg->max_ndi_supported; i++) {
+               if (strncmp(nancfg->ndi[i].ifname, name, len) == 0) {
+                       bzero(&nancfg->ndi[i].ifname, IFNAMSIZ);
+                       nancfg->ndi[i].in_use = false;
+                       nancfg->ndi[i].created = false;
+                       nancfg->ndi[i].nan_ndev = NULL;
+                       return i;
+               }
+       }
+       return -EINVAL;
+}
+
+s32
+wl_cfgnan_delete_ndp(struct bcm_cfg80211 *cfg,
+       struct net_device *nan_ndev)
+{
+       s32 ret = BCME_OK;
+       uint8 i = 0;
+       wl_nancfg_t *nancfg = cfg->nancfg;
+
+       for (i = 0; i < cfg->nancfg->max_ndi_supported; i++) {
+               if (nancfg->ndi[i].in_use && nancfg->ndi[i].created &&
+                       (nancfg->ndi[i].nan_ndev == nan_ndev)) {
+                       WL_INFORM_MEM(("iface name: %s, cfg->nancfg->ndi[i].nan_ndev = %p"
+                                       "  and nan_ndev = %p\n",
+                                               (char*)nancfg->ndi[i].ifname,
+                                               nancfg->ndi[i].nan_ndev, nan_ndev));
+                       ret = _wl_cfg80211_del_if(cfg, nan_ndev, NULL,
+                                       (char*)nancfg->ndi[i].ifname);
+                       if (ret) {
+                               WL_ERR(("failed to del ndi [%d]\n", ret));
+                       }
+                       /*
+                        * Intentional fall through to clear the host data structs
+                        * Unconditionally delete the ndi data and states
+                        */
+                       if (wl_cfgnan_del_ndi_data(cfg,
+                               (char*)nancfg->ndi[i].ifname) < 0) {
+                               WL_ERR(("Failed to find matching data for ndi:%s\n",
+                                       (char*)nancfg->ndi[i].ifname));
+                       }
+               }
+       }
+       return ret;
+}
+
+int
+wl_cfgnan_get_status(struct net_device *ndev, wl_nan_conf_status_t *nan_status)
+{
+       bcm_iov_batch_buf_t *nan_buf = NULL;
+       uint16 subcmd_len;
+       bcm_iov_batch_subcmd_t *sub_cmd = NULL;
+       bcm_iov_batch_subcmd_t *sub_cmd_resp = NULL;
+       uint8 resp_buf[NAN_IOCTL_BUF_SIZE];
+       wl_nan_conf_status_t *nstatus = NULL;
+       uint32 status;
+       s32 ret = BCME_OK;
+       uint16 nan_buf_size = NAN_IOCTL_BUF_SIZE;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(ndev);
+       NAN_DBG_ENTER();
+
+       nan_buf = MALLOCZ(cfg->osh, NAN_IOCTL_BUF_SIZE);
+       if (!nan_buf) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto fail;
+       }
+
+       nan_buf->version = htol16(WL_NAN_IOV_BATCH_VERSION);
+       nan_buf->count = 0;
+       nan_buf_size -= OFFSETOF(bcm_iov_batch_buf_t, cmds[0]);
+       sub_cmd = (bcm_iov_batch_subcmd_t*)(uint8 *)(&nan_buf->cmds[0]);
+
+       ret = wl_cfg_nan_check_cmd_len(nan_buf_size,
+                       sizeof(*nstatus), &subcmd_len);
+       if (unlikely(ret)) {
+               WL_ERR(("nan_sub_cmd check failed\n"));
+               goto fail;
+       }
+
+       nstatus = (wl_nan_conf_status_t *)sub_cmd->data;
+       sub_cmd->id = htod16(WL_NAN_CMD_CFG_STATUS);
+       sub_cmd->len = sizeof(sub_cmd->u.options) + sizeof(*nstatus);
+       sub_cmd->u.options = htol32(BCM_XTLV_OPTION_ALIGN32);
+       nan_buf_size -= subcmd_len;
+       nan_buf->count = 1;
+       nan_buf->is_set = false;
+
+       bzero(resp_buf, sizeof(resp_buf));
+       ret = wl_cfgnan_execute_ioctl(ndev, cfg, nan_buf, nan_buf_size, &status,
+                       (void*)resp_buf, NAN_IOCTL_BUF_SIZE);
+       if (unlikely(ret) || unlikely(status)) {
+               WL_ERR(("get nan status failed ret %d status %d \n",
+                       ret, status));
+               goto fail;
+       }
+       sub_cmd_resp = &((bcm_iov_batch_buf_t *)(resp_buf))->cmds[0];
+       /* WL_NAN_CMD_CFG_STATUS return value doesn't use xtlv package */
+       nstatus = ((wl_nan_conf_status_t *)&sub_cmd_resp->data[0]);
+       ret = memcpy_s(nan_status, sizeof(wl_nan_conf_status_t),
+                       nstatus, sizeof(wl_nan_conf_status_t));
+       if (ret != BCME_OK) {
+               WL_ERR(("Failed to copy tx match filter\n"));
+               goto fail;
+       }
+
+fail:
+       if (nan_buf) {
+               MFREE(cfg->osh, nan_buf, NAN_IOCTL_BUF_SIZE);
+       }
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+int
+wl_cfgnan_attach(struct bcm_cfg80211 *cfg)
+{
+       int err = BCME_OK;
+       wl_nancfg_t *nancfg = NULL;
+
+       if (cfg) {
+               cfg->nancfg = (wl_nancfg_t *)MALLOCZ(cfg->osh, sizeof(wl_nancfg_t));
+               if (cfg->nancfg == NULL) {
+                       err = BCME_NOMEM;
+                       goto done;
+               }
+               cfg->nancfg->cfg = cfg;
+       } else {
+               err = BCME_BADARG;
+               goto done;
+       }
+
+       nancfg = cfg->nancfg;
+       mutex_init(&nancfg->nan_sync);
+       init_waitqueue_head(&nancfg->nan_event_wait);
+       INIT_DELAYED_WORK(&nancfg->nan_disable, wl_cfgnan_delayed_disable);
+       nancfg->nan_dp_state = NAN_DP_STATE_DISABLED;
+       init_waitqueue_head(&nancfg->ndp_if_change_event);
+
+done:
+       return err;
+
+}
+
+void
+wl_cfgnan_detach(struct bcm_cfg80211 *cfg)
+{
+       if (cfg && cfg->nancfg) {
+               if (delayed_work_pending(&cfg->nancfg->nan_disable)) {
+                       WL_DBG(("Cancel nan_disable work\n"));
+                       DHD_NAN_WAKE_UNLOCK(cfg->pub);
+                       cancel_delayed_work_sync(&cfg->nancfg->nan_disable);
+               }
+               MFREE(cfg->osh, cfg->nancfg, sizeof(wl_nancfg_t));
+               cfg->nancfg = NULL;
+       }
+
+}
+#endif /* WL_NAN */
diff --git a/bcmdhd.101.10.240.x/wl_cfgnan.h b/bcmdhd.101.10.240.x/wl_cfgnan.h
new file mode 100644 (file)
index 0000000..45db615
--- /dev/null
@@ -0,0 +1,952 @@
+/*
+ * Neighbor Awareness Networking
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _wl_cfgnan_h_
+#define _wl_cfgnan_h_
+
+/* NAN structs versioning b/w DHD and HAL
+* define new version if any change in any of the shared structs
+*/
+#define NAN_HAL_VERSION_1      0x2
+
+#define NAN_EVENT_BUFFER_SIZE_LARGE    1024u
+
+#define NAN_RANGE_EXT_CANCEL_SUPPORT_VER 2
+#define WL_NAN_IOV_BATCH_VERSION       0x8000
+#define WL_NAN_AVAIL_REPEAT_INTVL      0x0200
+#define WL_NAN_AVAIL_START_INTVL       160
+#define WL_NAN_AVAIL_DURATION_INTVL    336
+#define NAN_IOCTL_BUF_SIZE             256u
+#define NAN_IOCTL_BUF_SIZE_MED         512u
+#define NAN_IOCTL_BUF_SIZE_LARGE       1024u
+#define NAN_EVENT_NAME_MAX_LEN         40u
+#define NAN_RTT_IOVAR_BUF_SIZE         1024u
+#define WL_NAN_EVENT_CLEAR_BIT         32
+#define NAN_EVENT_MASK_ALL                     0x7fffffff
+#define NAN_MAX_AWAKE_DW_INTERVAL      5
+#define NAN_MAXIMUM_ID_NUMBER 255
+#define NAN_MAXIMUM_MASTER_PREFERENCE 254
+#define NAN_ID_RESERVED        0
+#define NAN_ID_MIN     1
+#define NAN_ID_MAX     255
+#define NAN_DEF_SOCIAL_CHAN_2G 6
+#define NAN_DEF_SOCIAL_CHAN_5G 149
+#define NAN_DEF_SEC_SOCIAL_CHAN_5G     44
+#define NAN_MAX_SOCIAL_CHANNELS        3
+/* Keeping RSSI threshold value to be -70dBm */
+#define NAN_DEF_RSSI_NOTIF_THRESH -70
+/* Keeping default RSSI mid value to be -70dBm */
+#define NAN_DEF_RSSI_MID -75
+/* Keeping default RSSI close value to be -60dBm */
+#define NAN_DEF_RSSI_CLOSE -60
+#define WL_AVAIL_BIT_MAP       "1111111111111111111111111111111100000000000000000000000000000000"
+#define WL_5G_AVAIL_BIT_MAP    "0000000011111111111111111111111111111111000000000000000000000000"
+#define WL_AVAIL_CHANNEL_2G    6
+#define WL_AVAIL_BANDWIDTH_2G  WL_CHANSPEC_BW_20
+#define WL_AVAIL_CHANNEL_5G    149
+#define WL_AVAIL_BANDWIDTH_5G  WL_CHANSPEC_BW_80
+#define NAN_RANGING_PERIOD WL_AVAIL_PERIOD_1024
+#define NAN_SYNC_DEF_AWAKE_DW  1
+#define NAN_RNG_TERM_FLAG_NONE 0
+
+#define NAN_BLOOM_LENGTH_DEFAULT        240u
+#define NAN_SRF_MAX_MAC (NAN_BLOOM_LENGTH_DEFAULT / ETHER_ADDR_LEN)
+#define NAN_SRF_CTRL_FIELD_LEN 1u
+
+#define MAX_IF_ADD_WAIT_TIME   1000
+#define NAN_DP_ROLE_INITIATOR  0x0001
+#define NAN_DP_ROLE_RESPONDER  0x0002
+
+#define WL_NAN_OBUF_DATA_OFFSET  (OFFSETOF(bcm_iov_batch_buf_t, cmds[0]) + \
+               OFFSETOF(bcm_iov_batch_subcmd_t, data[0]))
+#define NAN_INVALID_ROLE(role) (role > WL_NAN_ROLE_ANCHOR_MASTER)
+#define NAN_INVALID_CHANSPEC(chanspec) ((chanspec == INVCHANSPEC) || \
+       (chanspec == 0))
+#define NAN_INVALID_EVENT(num) ((num < WL_NAN_EVENT_START) || \
+       (num >= WL_NAN_EVENT_INVALID))
+#define NAN_INVALID_PROXD_EVENT(num)   (num != WLC_E_PROXD_NAN_EVENT)
+#define NAN_EVENT_BIT(event) (1U << (event - WL_NAN_EVENT_START))
+#define NAN_EVENT_MAP(event) ((event) - WL_NAN_EVENT_START)
+#define NAME_TO_STR(name) #name
+#define NAN_ID_CTRL_SIZE ((NAN_MAXIMUM_ID_NUMBER/8) + 1)
+
+#define tolower(c) bcm_tolower(c)
+
+#define NMR2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5], (a)[6], (a)[7]
+#define NMRSTR "%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x"
+
+#define NAN_DBG_ENTER() {WL_DBG(("Enter: %s\n", __FUNCTION__));}
+#define NAN_DBG_EXIT() {WL_DBG(("Exit: %s\n", __FUNCTION__));}
+
+/* Service Control Type length */
+#define NAN_SVC_CONTROL_TYPE_MASK      ((1 << NAN_SVC_CONTROL_TYPE_LEN) - 1)
+
+#ifndef strtoul
+#define strtoul(nptr, endptr, base) bcm_strtoul((nptr), (endptr), (base))
+#endif
+
+#define NAN_MAC_ADDR_LEN 6u
+#define NAN_DP_MAX_APP_INFO_LEN        512u
+
+#define NAN_SDE_CF_DP_REQUIRED      (1 << 2)
+#define NAN_SDE_CF_DP_TYPE      (1 << 3)
+#define NAN_SDE_CF_MULTICAST_TYPE   (1 << 4)
+#define NAN_SDE_CF_SECURITY_REQUIRED    (1 << 6)
+#define NAN_SDE_CF_RANGING_REQUIRED (1 << 7)
+#define NAN_SDE_CF_RANGE_PRESENT    (1 << 8)
+
+#define CHECK_BIT(m, n) ((m >> n) & 1)? 1 : 0
+#define WL_NAN_EVENT_DIC_MAC_ADDR_BIT  0
+#define WL_NAN_EVENT_START_EVENT       1
+#define WL_NAN_EVENT_JOIN_EVENT                2
+
+/* Disabling svc specific(as per part of sub & pub calls) events based on below bits */
+#define WL_NAN_EVENT_SUPPRESS_TERMINATE_BIT    0
+#define WL_NAN_EVENT_SUPPRESS_MATCH_EXP_BIT    1
+#define WL_NAN_EVENT_SUPPRESS_RECEIVE_BIT      2
+#define WL_NAN_EVENT_SUPPRESS_REPLIED_BIT      3
+
+/* Disabling tranmsit followup events based on below bit */
+#define WL_NAN_EVENT_SUPPRESS_FOLLOWUP_RECEIVE_BIT     0
+
+#define C2S(x)  case x: id2str = #x
+#define NAN_BLOOM_LENGTH_DEFAULT       240u
+#define NAN_SRF_MAX_MAC                        (NAN_BLOOM_LENGTH_DEFAULT / ETHER_ADDR_LEN)
+#define NAN_MAX_PMK_LEN                        32u
+#define NAN_ERROR_STR_LEN              255u
+
+/* NAN related Capabilities */
+#define MAX_CONCURRENT_NAN_CLUSTERS            1u
+#define MAX_PUBLISHES                          8u
+#define MAX_SUBSCRIBES                         8u
+#define MAX_SVC_NAME_LEN                       255u
+#define MAX_MATCH_FILTER_LEN                   255u
+#define MAX_TOTAL_MATCH_FILTER_LEN             510u
+#define        NAN_MAX_SERVICE_SPECIFIC_INFO_LEN       255u
+#define NAN_MAX_NDI                            3u
+#define MAX_NDP_SESSIONS                       5u
+#define MAX_APP_INFO_LEN                       255u
+#define        MAX_QUEUED_TX_FOLLOUP_MSGS              10u
+#define        MAX_SDEA_SVC_INFO_LEN                   255u
+#define        MAX_SUBSCRIBE_ADDRESS                   10u
+#define        CIPHER_SUITE_SUPPORTED                  1u
+#define        MAX_SCID_LEN                            0u
+#define        IS_NDP_SECURITY_SUPPORTED               true
+#define        NDP_SUPPORTED_BANDS                     2u
+#define NAN_MAX_RANGING_INST                   8u
+#define NAN_MAX_RANGING_SSN_ALLOWED            1u
+#define NAN_MAX_SVC_INST                       (MAX_PUBLISHES + MAX_SUBSCRIBES)
+#define NAN_SVC_INST_SIZE                      32u
+#define NAN_START_STOP_TIMEOUT                 5000u
+#define NAN_MAX_NDP_PEER                       8u
+#define NAN_DISABLE_CMD_DELAY                  530u
+#define NAN_WAKELOCK_TIMEOUT                   (NAN_DISABLE_CMD_DELAY + 100u)
+
+#define NAN_NMI_RAND_PVT_CMD_VENDOR            (1 << 31)
+#define NAN_NMI_RAND_CLUSTER_MERGE_ENAB                (1 << 30)
+#define NAN_NMI_RAND_AUTODAM_LWT_MODE_ENAB     (1 << 29)
+
+#ifdef WL_NAN_DEBUG
+#define NAN_MUTEX_LOCK() {WL_DBG(("Mutex Lock: Enter: %s\n", __FUNCTION__)); \
+       mutex_lock(&cfg->nancfg->nan_sync);}
+#define NAN_MUTEX_UNLOCK() {mutex_unlock(&cfg->nancfg->nan_sync); \
+       WL_DBG(("Mutex Unlock: Exit: %s\n", __FUNCTION__));}
+#else
+#define NAN_MUTEX_LOCK() {mutex_lock(&cfg->nancfg->nan_sync);}
+#define NAN_MUTEX_UNLOCK() {mutex_unlock(&cfg->nancfg->nan_sync);}
+#endif /* WL_NAN_DEBUG */
+#define        NAN_ATTR_SUPPORT_2G_CONFIG              (1<<0)
+#define        NAN_ATTR_SYNC_DISC_2G_BEACON_CONFIG     (1<<1)
+#define        NAN_ATTR_SDF_2G_SUPPORT_CONFIG          (1<<2)
+#define        NAN_ATTR_SUPPORT_5G_CONFIG              (1<<3)
+#define        NAN_ATTR_SYNC_DISC_5G_BEACON_CONFIG     (1<<4)
+#define        NAN_ATTR_SDF_5G_SUPPORT_CONFIG          (1<<5)
+#define        NAN_ATTR_2G_DW_CONFIG                   (1<<6)
+#define        NAN_ATTR_5G_DW_CONFIG                   (1<<7)
+#define        NAN_ATTR_2G_CHAN_CONFIG                 (1<<8)
+#define        NAN_ATTR_5G_CHAN_CONFIG                 (1<<9)
+#define        NAN_ATTR_2G_DWELL_TIME_CONFIG           (1<<10)
+#define        NAN_ATTR_5G_DWELL_TIME_CONFIG           (1<<11)
+#define        NAN_ATTR_2G_SCAN_PERIOD_CONFIG          (1<<12)
+#define        NAN_ATTR_5G_SCAN_PERIOD_CONFIG          (1<<13)
+#define        NAN_ATTR_RSSI_CLOSE_CONFIG              (1<<14)
+#define        NAN_ATTR_RSSI_MIDDLE_2G_CONFIG          (1<<15)
+#define        NAN_ATTR_RSSI_PROXIMITY_2G_CONFIG       (1<<16)
+#define        NAN_ATTR_RSSI_CLOSE_5G_CONFIG           (1<<17)
+#define        NAN_ATTR_RSSI_MIDDLE_5G_CONFIG          (1<<18)
+#define        NAN_ATTR_RSSI_PROXIMITY_5G_CONFIG       (1<<19)
+#define        NAN_ATTR_RSSI_WINDOW_SIZE_CONFIG        (1<<20)
+#define        NAN_ATTR_HOP_COUNT_LIMIT_CONFIG         (1<<21)
+#define        NAN_ATTR_SID_BEACON_CONFIG              (1<<22)
+#define        NAN_ATTR_HOP_COUNT_FORCE_CONFIG         (1<<23)
+#define        NAN_ATTR_RAND_FACTOR_CONFIG             (1<<24)
+#define        NAN_ATTR_CLUSTER_VAL_CONFIG             (1<<25)
+#define        NAN_ATTR_IF_ADDR_CONFIG                 (1<<26)
+#define        NAN_ATTR_OUI_CONFIG                     (1<<27)
+#define        NAN_ATTR_SUB_SID_BEACON_CONFIG          (1<<28)
+#define NAN_ATTR_DISC_BEACON_INTERVAL          (1<<29)
+#define NAN_IOVAR_NAME_SIZE    4u
+#define NAN_XTLV_ID_LEN_SIZE OFFSETOF(bcm_xtlv_t, data)
+#define NAN_RANGING_INDICATE_CONTINUOUS_MASK   0x01
+#define NAN_RANGE_REQ_CMD 0
+#define NAN_RNG_REQ_ACCEPTED_BY_HOST    1
+#define NAN_RNG_REQ_REJECTED_BY_HOST    0
+
+#define NAN_RNG_REQ_ACCEPTED_BY_PEER   0
+#define NAN_RNG_REQ_REJECTED_BY_PEER   1
+
+#define NAN_RNG_GEOFENCE_MAX_RETRY_CNT 3u
+
+/*
+* Discovery Beacon Interval config,
+* Default value is 128 msec in 2G DW and 176 msec in 2G/5G DW.
+*/
+#define NAN_DISC_BCN_INTERVAL_2G_DEF 128u
+#define NAN_DISC_BCN_INTERVAL_5G_DEF 176u
+
+typedef uint32 nan_data_path_id;
+
+typedef enum nan_range_status {
+       NAN_RANGING_INVALID = 0,
+       NAN_RANGING_REQUIRED = 1,
+       NAN_RANGING_SETUP_IN_PROGRESS = 2,
+       NAN_RANGING_SESSION_IN_PROGRESS = 3
+} nan_range_status_t;
+
+typedef enum nan_range_role {
+       NAN_RANGING_ROLE_INVALID = 0,
+       NAN_RANGING_ROLE_INITIATOR = 1,
+       NAN_RANGING_ROLE_RESPONDER = 2
+} nan_range_role_t;
+
+typedef struct nan_svc_inst {
+       uint8  inst_id;      /* publisher/subscriber id */
+       uint8  inst_type;    /* publisher/subscriber */
+} nan_svc_inst_t;
+
+/* Range Status Flag bits for svc info */
+#define SVC_RANGE_REP_EVENT_ONCE 0x01
+
+/* Range Status Flag bits for svc info */
+#define SVC_RANGE_REP_EVENT_ONCE 0x01
+
+#define NAN_RANGING_SETUP_IS_IN_PROG(status) \
+       ((status) == NAN_RANGING_SETUP_IN_PROGRESS)
+
+#define NAN_RANGING_IS_IN_PROG(status) \
+       (((status) == NAN_RANGING_SETUP_IN_PROGRESS) || \
+       ((status) == NAN_RANGING_SESSION_IN_PROGRESS))
+
+typedef struct nan_svc_info {
+       bool valid;
+       nan_data_path_id ndp_id[NAN_MAX_SVC_INST];
+       uint8 svc_hash[WL_NAN_SVC_HASH_LEN];        /* service hash */
+       uint8 svc_id;
+       uint8 ranging_required;
+       uint8 ranging_ind;
+       uint8 status;
+       uint32 ranging_interval;
+       uint32 ingress_limit;
+       uint32 egress_limit;
+       uint32 flags;
+       uint8 tx_match_filter[MAX_MATCH_FILTER_LEN];        /* TX match filter */
+       uint8 tx_match_filter_len;
+       uint8 svc_range_status; /* For managing any svc range status flags */
+} nan_svc_info_t;
+
+/* NAN Peer DP state */
+typedef enum {
+       NAN_PEER_DP_NOT_CONNECTED = 0,
+       NAN_PEER_DP_CONNECTING = 1,
+       NAN_PEER_DP_CONNECTED = 2
+} nan_peer_dp_state_t;
+
+typedef struct nan_ndp_peer {
+       uint8 peer_dp_state;
+       uint8 dp_count;
+       struct ether_addr peer_addr;
+} nan_ndp_peer_t;
+
+#define INVALID_DISTANCE               0xFFFFFFFF
+#define NAN_RTT_FTM_SSN_RETRIES                2
+
+typedef struct nan_ranging_inst {
+       uint8 range_id;
+       nan_range_status_t range_status;
+       struct ether_addr peer_addr;
+       int range_type;
+       uint8 num_svc_ctx;
+       nan_svc_info_t *svc_idx[MAX_SUBSCRIBES];
+       uint32 prev_distance_mm;
+       nan_range_role_t range_role;
+       bool in_use;
+       uint8 geof_retry_count;
+       uint8 ftm_ssn_retry_count;
+} nan_ranging_inst_t;
+
+#define DUMP_NAN_RTT_INST(inst) { printf("svc instance ID %d", (inst)->svc_inst_id); \
+       printf("Range ID %d", (inst)->range_id); \
+       printf("range_status %d", (inst)->range_status); \
+       printf("Range Type %d", (inst)->range_type); \
+       printf("Peer MAC "MACDBG"\n", MAC2STRDBG((inst)->peer_addr.octet)); \
+       }
+
+#define DUMP_NAN_RTT_RPT(rpt) { printf("Range ID %d", (rpt)->rng_id); \
+       printf("Distance in MM %d", (rpt)->dist_mm); \
+       printf("range_indication %d", (rpt)->indication); \
+       printf("Peer MAC "MACDBG"\n", MAC2STRDBG((rpt)->peer_m_addr.octet)); \
+       }
+/*
+ * Data request Initiator/Responder
+ * app/service related info
+ */
+typedef struct nan_data_path_app_info {
+       uint16 ndp_app_info_len;
+       uint8 ndp_app_info[NAN_DP_MAX_APP_INFO_LEN];
+} nan_data_path_app_info_t;
+
+/* QoS configuration */
+typedef enum {
+       NAN_DP_CONFIG_NO_QOS = 0,
+       NAN_DP_CONFIG_QOS
+} nan_data_path_qos_cfg_t;
+
+/* Data request Responder's response */
+typedef enum {
+       NAN_DP_REQUEST_ACCEPT = 0,
+       NAN_DP_REQUEST_REJECT
+} nan_data_path_response_code_t;
+
+/* NAN DP security Configuration */
+typedef enum {
+       NAN_DP_CONFIG_NO_SECURITY = 0,
+       NAN_DP_CONFIG_SECURITY
+} nan_data_path_security_cfg_status_t;
+
+/* NAN Security Key Input Type */
+typedef enum {
+       NAN_SECURITY_KEY_INPUT_PMK = 1,
+       NAN_SECURITY_KEY_INPUT_PASSPHRASE
+} nan_security_key_input_type;
+
+/* Configuration params of Data request Initiator/Responder */
+typedef struct nan_data_path_cfg {
+       /* Status Indicating Security/No Security */
+       nan_data_path_security_cfg_status_t security_cfg;
+       nan_data_path_qos_cfg_t qos_cfg;
+} nan_data_path_cfg_t;
+
+enum nan_dp_states {
+       NAN_DP_STATE_DISABLED = 0,
+       NAN_DP_STATE_ENABLED = 1
+};
+
+enum {
+       SRF_TYPE_BLOOM_FILTER = 0,
+       SRF_TYPE_SEQ_MAC_ADDR = 1
+};
+
+/* NAN Match indication type */
+typedef enum {
+    NAN_MATCH_ALG_MATCH_ONCE           = 0,
+    NAN_MATCH_ALG_MATCH_CONTINUOUS     = 1,
+    NAN_MATCH_ALG_MATCH_NEVER          = 2
+} nan_match_alg;
+
+typedef struct nan_str_data {
+       uint32 dlen;
+       uint8 *data;
+} nan_str_data_t;
+
+typedef struct nan_mac_list {
+       uint32 num_mac_addr;
+       uint8 *list;
+} nan_mac_list_t;
+
+typedef struct wl_nan_sid_beacon_tune {
+       uint8 sid_enable;       /* flag for sending service id in beacon */
+       uint8 sid_count;        /* Limit for number of SIDs to be included in Beacons */
+       uint8 sub_sid_enable;   /* flag for sending subscribe service id in beacon */
+       uint8 sub_sid_count;    /* Limit for number of SUb SIDs to be included in Beacons */
+} wl_nan_sid_beacon_ctrl_t;
+
+typedef struct nan_avail_cmd_data {
+       chanspec_t chanspec[NAN_MAX_SOCIAL_CHANNELS];    /* channel */
+       uint32 bmap;            /* bitmap */
+       uint8 duration;
+       uint8 avail_period;
+       /* peer mac address reqd for ranging avail type */
+       struct ether_addr peer_nmi;
+       bool no_config_avail;
+} nan_avail_cmd_data;
+
+typedef struct nan_discover_cmd_data {
+       nan_str_data_t svc_info;        /* service information */
+       nan_str_data_t sde_svc_info;    /* extended service information */
+       nan_str_data_t svc_hash;        /* service hash */
+       nan_str_data_t rx_match;        /* matching filter rx */
+       nan_str_data_t tx_match;        /* matching filter tx */
+       nan_str_data_t key;        /* Security key information */
+       nan_str_data_t scid;        /* security context information */
+       nan_data_path_cfg_t ndp_cfg;
+       struct ether_addr mac_addr;     /* mac address */
+       nan_mac_list_t mac_list;   /* mac list */
+       wl_nan_instance_id_t pub_id;    /* publisher id */
+       wl_nan_instance_id_t sub_id;    /* subscriber id */
+       wl_nan_instance_id_t local_id;  /* Local id */
+       wl_nan_instance_id_t remote_id; /* Remote id */
+       uint32 status;
+       uint32 ttl;             /* time to live */
+       uint32 period;          /* publish period */
+       uint32 flags;           /* Flag bits */
+       bool sde_control_config; /* whether sde_control present */
+       uint16 sde_control_flag;
+       uint16 token; /* transmit fup token id */
+       uint8 csid;     /* cipher suite type */
+       nan_security_key_input_type key_type;   /* cipher suite type */
+       uint8 priority;         /* Priority of Transmit */
+       uint8 life_count;       /* life count of the instance */
+       uint8 srf_type;         /* SRF type */
+       uint8 srf_include;      /* SRF include */
+       uint8 use_srf;          /* use SRF */
+       uint8 recv_ind_flag;    /* Receive Indication Flag */
+       uint8 disc_ind_cfg;     /* Discovery Ind cfg */
+       uint8 ranging_indication;
+       uint32 ranging_intvl_msec; /* ranging interval in msec */
+       uint32 ingress_limit;
+       uint32 egress_limit;
+       bool response;
+       uint8 service_responder_policy;
+       bool svc_update;
+} nan_discover_cmd_data_t;
+
+typedef struct nan_datapath_cmd_data {
+       nan_avail_cmd_data avail_params;        /* Avail config params */
+       nan_str_data_t svc_hash;        /* service hash */
+       nan_str_data_t svc_info;        /* service information */
+       nan_str_data_t key;        /* security key information */
+       nan_data_path_response_code_t rsp_code;
+       nan_data_path_id ndp_instance_id;
+       nan_data_path_cfg_t ndp_cfg;
+       wl_nan_instance_id_t pub_id;    /* publisher id */
+       nan_security_key_input_type key_type;   /* cipher suite type */
+       struct ether_addr if_addr;      /* if addr */
+       struct ether_addr mac_addr;     /* mac address */
+       chanspec_t chanspec[NAN_MAX_SOCIAL_CHANNELS];    /* channel */
+       uint32 status;
+       uint32 bmap;            /* bitmap */
+       uint16 service_instance_id;
+       uint16 sde_control_flag;
+       uint8 csid;     /* cipher suite type */
+       uint8 peer_disc_mac_addr[ETHER_ADDR_LEN];
+       uint8 peer_ndi_mac_addr[ETHER_ADDR_LEN];
+       uint8 num_ndp_instances;
+       uint8 duration;
+       char ndp_iface[IFNAMSIZ+1];
+} nan_datapath_cmd_data_t;
+
+typedef struct nan_rssi_cmd_data {
+       int8 rssi_middle_2dot4g_val;
+       int8 rssi_close_2dot4g_val;
+       int8 rssi_proximity_2dot4g_val;
+       int8 rssi_proximity_5g_val;
+       int8 rssi_middle_5g_val;
+       int8 rssi_close_5g_val;
+       uint16 rssi_window_size; /* Window size over which rssi calculated */
+} nan_rssi_cmd_data_t;
+
+typedef struct election_metrics {
+       uint8 random_factor;    /* Configured random factor */
+       uint8 master_pref;     /* configured master preference */
+} election_metrics_t;
+
+typedef struct nan_awake_dws {
+       uint8 dw_interval_2g;   /* 2G DW interval */
+       uint8 dw_interval_5g;   /* 5G DW interval */
+} nan_awake_dws_t;
+
+typedef struct nan_config_cmd_data {
+       nan_rssi_cmd_data_t rssi_attr;  /* RSSI related data */
+       election_metrics_t metrics;
+       nan_awake_dws_t awake_dws;      /* Awake DWs */
+       nan_avail_cmd_data avail_params;        /* Avail config params */
+       nan_str_data_t p2p_info;        /* p2p information */
+       nan_str_data_t scid;        /* security context information */
+       struct ether_addr clus_id;      /* cluster id */
+       struct ether_addr mac_addr;     /* mac address */
+       wl_nan_sid_beacon_ctrl_t sid_beacon;    /* sending service id in beacon */
+       chanspec_t chanspec[NAN_MAX_SOCIAL_CHANNELS];    /* channel */
+       uint32 status;
+       uint32 bmap;            /* bitmap */
+       uint32 nan_oui;         /* configured nan oui */
+       uint32 warmup_time;     /* Warm up time */
+       uint8 duration;
+       uint8 hop_count_limit;  /* hop count limit */
+       uint8 support_5g;       /* To decide dual band support */
+       uint8 support_2g;       /* To decide dual band support */
+       uint8 beacon_2g_val;
+       uint8 beacon_5g_val;
+       uint8 sdf_2g_val;
+       uint8 sdf_5g_val;
+       uint8 dwell_time[NAN_MAX_SOCIAL_CHANNELS];
+       uint8 scan_period[NAN_MAX_SOCIAL_CHANNELS];
+       uint8 config_cluster_val;
+       uint8 disc_ind_cfg;     /* Discovery Ind cfg */
+       uint8 csid;     /* cipher suite type */
+       uint32 nmi_rand_intvl; /* nmi randomization interval */
+       uint32 use_ndpe_attr;
+       uint8 enable_merge;
+       uint16 cluster_low;
+       uint16 cluster_high;
+       wl_nan_disc_bcn_interval_t disc_bcn_interval;
+       uint32 dw_early_termination;
+} nan_config_cmd_data_t;
+
+typedef struct nan_event_hdr {
+       uint32 flags;                                                   /* future use */
+       uint16 event_subtype;
+} nan_event_hdr_t;
+
+typedef struct nan_event_data {
+       uint8 svc_name[WL_NAN_SVC_HASH_LEN];    /* service name */
+       uint8 enabled;        /* NAN Enabled */
+       uint8 nan_de_evt_type;  /* DE event type */
+       uint8 status;           /* status */
+       uint8 ndp_id;           /* data path instance id */
+       uint8 security;         /* data path security */
+       uint8 type;
+       uint8 attr_num;
+       uint8 reason;          /* reason */
+       wl_nan_instance_id_t pub_id;          /* publisher id */
+       wl_nan_instance_id_t sub_id;          /* subscriber id */
+       wl_nan_instance_id_t local_inst_id;   /* local instance id */
+       wl_nan_instance_id_t requestor_id;    /* Requestor instance id */
+       int publish_rssi;       /* discovery rssi value */
+       int sub_rssi;   /* Sub rssi value */
+       int fup_rssi;           /* followup rssi */
+       uint16 attr_list_len;  /* sizeof attributes attached to payload */
+       nan_str_data_t svc_info;        /* service info */
+       nan_str_data_t vend_info;       /* vendor info */
+       nan_str_data_t sde_svc_info;    /* extended service information */
+       nan_str_data_t tx_match_filter; /* tx match filter */
+       nan_str_data_t rx_match_filter; /* rx match filter */
+       struct ether_addr local_nmi;      /* local nmi */
+       struct ether_addr clus_id;        /* cluster id */
+       struct ether_addr remote_nmi;     /* remote nmi */
+       struct ether_addr initiator_ndi;        /* initiator_ndi */
+       struct ether_addr responder_ndi;        /* responder_ndi */
+       uint16 token; /* transmit fup token id */
+       uint8 peer_cipher_suite; /* peer cipher suite type */
+       nan_str_data_t scid;        /* security context information */
+       char nan_reason[NAN_ERROR_STR_LEN]; /* Describe the NAN reason type */
+       uint16 sde_control_flag;
+       uint8 ranging_result_present;
+       uint32 range_measurement_cm;
+       uint32 ranging_ind;
+       uint8 rng_id;
+} nan_event_data_t;
+
+/*
+ *   Various NAN Protocol Response code
+*/
+typedef enum {
+       /* NAN Protocol Response Codes */
+       NAN_STATUS_SUCCESS = 0,
+       /*  NAN Discovery Engine/Host driver failures */
+       NAN_STATUS_INTERNAL_FAILURE = 1,
+       /*  NAN OTA failures */
+       NAN_STATUS_PROTOCOL_FAILURE = 2,
+       /* if the publish/subscribe id is invalid */
+       NAN_STATUS_INVALID_PUBLISH_SUBSCRIBE_ID = 3,
+       /* If we run out of resources allocated */
+       NAN_STATUS_NO_RESOURCE_AVAILABLE = 4,
+       /* if invalid params are passed */
+       NAN_STATUS_INVALID_PARAM = 5,
+       /*  if the requestor instance id is invalid */
+       NAN_STATUS_INVALID_REQUESTOR_INSTANCE_ID = 6,
+       /*  if the ndp id is invalid */
+       NAN_STATUS_INVALID_NDP_ID = 7,
+       /* if NAN is enabled when wifi is turned off */
+       NAN_STATUS_NAN_NOT_ALLOWED = 8,
+       /* if over the air ack is not received */
+       NAN_STATUS_NO_OTA_ACK = 9,
+       /* If NAN is already enabled and we are try to re-enable the same */
+       NAN_STATUS_ALREADY_ENABLED = 10,
+       /* If followup message internal queue is full */
+       NAN_STATUS_FOLLOWUP_QUEUE_FULL = 11,
+       /* Unsupported concurrency session enabled, NAN disabled notified */
+       NAN_STATUS_UNSUPPORTED_CONCURRENCY_NAN_DISABLED = 12
+} nan_status_type_t;
+
+typedef struct {
+       nan_status_type_t status;
+       char nan_reason[NAN_ERROR_STR_LEN]; /* Describe the NAN reason type */
+} nan_hal_status_t;
+
+typedef struct nan_parse_event_ctx {
+       struct bcm_cfg80211 *cfg;
+       nan_event_data_t *nan_evt_data;
+} nan_parse_event_ctx_t;
+
+/* Capabilities info supported by FW */
+typedef struct nan_hal_capabilities {
+       uint32 max_concurrent_nan_clusters;
+       uint32 max_publishes;
+       uint32 max_subscribes;
+       uint32 max_service_name_len;
+       uint32 max_match_filter_len;
+       uint32 max_total_match_filter_len;
+       uint32 max_service_specific_info_len;
+       uint32 max_vsa_data_len;
+       uint32 max_mesh_data_len;
+       uint32 max_ndi_interfaces;
+       uint32 max_ndp_sessions;
+       uint32 max_app_info_len;
+       uint32 max_queued_transmit_followup_msgs;
+       uint32 ndp_supported_bands;
+       uint32 cipher_suites_supported;
+       uint32 max_scid_len;
+       bool is_ndp_security_supported;
+       uint32 max_sdea_service_specific_info_len;
+       uint32 max_subscribe_address;
+       uint32 ndpe_attr_supported;
+} nan_hal_capabilities_t;
+
+typedef struct _nan_hal_resp {
+       uint16 instance_id;
+       uint16 subcmd;
+       int32 status;
+       int32 value;
+       /* Identifier for the instance of the NDP */
+       uint16 ndp_instance_id;
+       /* Publisher NMI */
+       uint8 pub_nmi[NAN_MAC_ADDR_LEN];
+       /* SVC_HASH */
+       uint8 svc_hash[WL_NAN_SVC_HASH_LEN];
+       char nan_reason[NAN_ERROR_STR_LEN]; /* Describe the NAN reason type */
+       char pad[3];
+       nan_hal_capabilities_t capabilities;
+} nan_hal_resp_t;
+
+typedef struct wl_nan_iov {
+       uint16 nan_iov_len;
+       uint8 *nan_iov_buf;
+} wl_nan_iov_t;
+
+#ifdef WL_NAN_DISC_CACHE
+
+#define NAN_MAX_CACHE_DISC_RESULT 16
+typedef struct {
+       bool valid;
+       wl_nan_instance_id_t pub_id;
+       wl_nan_instance_id_t sub_id;
+       uint8 svc_hash[WL_NAN_SVC_HASH_LEN];
+       struct ether_addr peer;
+       int8 publish_rssi;
+       uint8 peer_cipher_suite;
+       uint8 security;
+       nan_str_data_t svc_info;        /* service info */
+       nan_str_data_t vend_info;       /* vendor info */
+       nan_str_data_t sde_svc_info;    /* extended service information */
+       nan_str_data_t tx_match_filter; /* tx match filter */
+       uint16 sde_control_flag;
+} nan_disc_result_cache;
+
+typedef struct nan_datapath_sec_info {
+       nan_data_path_id ndp_instance_id;
+       wl_nan_instance_id_t pub_id;    /* publisher id */
+       struct ether_addr mac_addr;     /* mac address */
+} nan_datapath_sec_info_cmd_data_t;
+#endif /* WL_NAN_DISC_CACHE */
+
+typedef enum {
+       NAN_RANGING_AUTO_RESPONSE_ENABLE = 0,
+       NAN_RANGING_AUTO_RESPONSE_DISABLE
+} NanRangingAutoResponseCfg;
+
+typedef struct wl_ndi_data
+{
+       u8 ifname[IFNAMSIZ];
+       u8 in_use;
+       u8 created;
+       struct net_device *nan_ndev;
+} wl_ndi_data_t;
+
+typedef struct wl_nancfg
+{
+       struct bcm_cfg80211 *cfg;
+       bool nan_enable;
+       nan_svc_inst_t nan_inst_ctrl[NAN_ID_CTRL_SIZE];
+       struct ether_addr initiator_ndi;
+       uint8 nan_dp_state;
+       bool nan_init_state; /* nan initialization state */
+       wait_queue_head_t ndp_if_change_event;
+       uint8 support_5g;
+       u8 nan_nmi_mac[ETH_ALEN];
+       u8 nan_dp_count;
+       struct delayed_work     nan_disable;
+       int nan_disc_count;
+       nan_disc_result_cache *nan_disc_cache;
+       nan_svc_info_t svc_info[NAN_MAX_SVC_INST];
+       nan_ranging_inst_t nan_ranging_info[NAN_MAX_RANGING_INST];
+       wl_nan_ver_t version;
+       struct mutex nan_sync;
+       uint8 svc_inst_id_mask[NAN_SVC_INST_SIZE];
+       uint8 inst_id_start;
+       /* wait queue and condition variable for nan event */
+       bool nan_event_recvd;
+       wait_queue_head_t nan_event_wait;
+       bool notify_user;
+       bool mac_rand;
+       uint8 max_ndp_count;       /* Max no. of NDPs */
+       nan_ndp_peer_t *nan_ndp_peer_info;
+       nan_data_path_id ndp_id[NAN_MAX_NDP_PEER];
+       uint8 ndpe_enabled;
+       uint8 max_ndi_supported;
+       wl_ndi_data_t *ndi;
+       bool ranging_enable;
+} wl_nancfg_t;
+
+bool wl_cfgnan_is_enabled(struct bcm_cfg80211 *cfg);
+int wl_cfgnan_check_nan_disable_pending(struct bcm_cfg80211 *cfg,
+bool force_disable, bool is_sync_reqd);
+int wl_cfgnan_start_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_config_cmd_data_t *cmd_data, uint32 nan_attr_mask);
+int wl_cfgnan_stop_handler(struct net_device *ndev, struct bcm_cfg80211 *cfg);
+void wl_cfgnan_delayed_disable(struct work_struct *work);
+int wl_cfgnan_config_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_config_cmd_data_t *cmd_data, uint32 nan_attr_mask);
+int wl_cfgnan_support_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_config_cmd_data_t *cmd_data);
+int wl_cfgnan_status_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_config_cmd_data_t *cmd_data);
+int wl_cfgnan_publish_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_discover_cmd_data_t *cmd_data);
+int wl_cfgnan_subscribe_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_discover_cmd_data_t *cmd_data);
+int wl_cfgnan_cancel_pub_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_discover_cmd_data_t *cmd_data);
+int wl_cfgnan_cancel_sub_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_discover_cmd_data_t *cmd_data);
+int wl_cfgnan_transmit_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_discover_cmd_data_t *cmd_data);
+s32 wl_cfgnan_notify_nan_status(struct bcm_cfg80211 *cfg,
+       bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *e, void *data);
+int wl_cfgnan_generate_inst_id(struct bcm_cfg80211 *cfg, uint8 *p_inst_id);
+int wl_cfgnan_remove_inst_id(struct bcm_cfg80211 *cfg, uint8 inst_id);
+int wl_cfgnan_get_capablities_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_hal_capabilities_t *capabilities);
+int wl_cfgnan_data_path_iface_create_delete_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, char *ifname, uint16 type, uint8 busstate);
+int wl_cfgnan_data_path_request_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_datapath_cmd_data_t *cmd_data,
+       uint8 *ndp_instance_id);
+int wl_cfgnan_data_path_response_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_datapath_cmd_data_t *cmd_data);
+int wl_cfgnan_data_path_end_handler(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, nan_data_path_id ndp_instance_id,
+       int *status);
+
+#ifdef WL_NAN_DISC_CACHE
+int wl_cfgnan_sec_info_handler(struct bcm_cfg80211 *cfg,
+       nan_datapath_sec_info_cmd_data_t *cmd_data, nan_hal_resp_t *nan_req_resp);
+/* ranging quest and response iovar handler */
+#endif /* WL_NAN_DISC_CACHE */
+bool wl_cfgnan_is_dp_active(struct net_device *ndev);
+bool wl_cfgnan_data_dp_exists_with_peer(struct bcm_cfg80211 *cfg,
+       struct ether_addr *peer_addr);
+s32 wl_cfgnan_delete_ndp(struct bcm_cfg80211 *cfg, struct net_device *nan_ndev);
+int wl_cfgnan_set_enable_merge(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, uint8 enable, uint32 *status);
+int wl_cfgnan_attach(struct bcm_cfg80211 *cfg);
+void wl_cfgnan_detach(struct bcm_cfg80211 *cfg);
+int wl_cfgnan_get_status(struct net_device *ndev, wl_nan_conf_status_t *nan_status);
+
+#ifdef RTT_SUPPORT
+int wl_cfgnan_trigger_ranging(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, void *event_data, nan_svc_info_t *svc,
+       uint8 range_req, bool accept_req);
+nan_ranging_inst_t *wl_cfgnan_get_ranging_inst(struct bcm_cfg80211 *cfg,
+       struct ether_addr *peer, nan_range_role_t range_role);
+nan_ranging_inst_t* wl_cfgnan_check_for_ranging(struct bcm_cfg80211 *cfg,
+       struct ether_addr *peer);
+int wl_cfgnan_trigger_geofencing_ranging(struct net_device *dev,
+       struct ether_addr *peer_addr);
+int wl_cfgnan_suspend_geofence_rng_session(struct net_device *ndev,
+       struct ether_addr *peer, int suspend_reason, u8 cancel_flags);
+void wl_cfgnan_suspend_all_geofence_rng_sessions(struct net_device *ndev,
+       int suspend_reason, u8 cancel_flags);
+int wl_cfgnan_terminate_directed_rtt_sessions(struct net_device *ndev, struct bcm_cfg80211 *cfg);
+void wl_cfgnan_reset_geofence_ranging(struct bcm_cfg80211 *cfg,
+       nan_ranging_inst_t * rng_inst, int sched_reason);
+void wl_cfgnan_reset_geofence_ranging_for_cur_target(dhd_pub_t *dhd, int sched_reason);
+void wl_cfgnan_process_range_report(struct bcm_cfg80211 *cfg,
+       wl_nan_ev_rng_rpt_ind_t *range_res, int rtt_status);
+int wl_cfgnan_cancel_ranging(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, uint8 *range_id, uint8 flags, uint32 *status);
+bool wl_cfgnan_ranging_allowed(struct bcm_cfg80211 *cfg);
+uint8 wl_cfgnan_cancel_rng_responders(struct net_device *ndev);
+#endif /* RTT_SUPPORT */
+
+typedef enum {
+       NAN_ATTRIBUTE_HEADER                            = 100,
+       NAN_ATTRIBUTE_HANDLE                            = 101,
+       NAN_ATTRIBUTE_TRANSAC_ID                        = 102,
+
+       /* NAN Enable request attributes */
+       NAN_ATTRIBUTE_2G_SUPPORT                        = 103,
+       NAN_ATTRIBUTE_5G_SUPPORT                        = 104,
+       NAN_ATTRIBUTE_CLUSTER_LOW                       = 105,
+       NAN_ATTRIBUTE_CLUSTER_HIGH                      = 106,
+       NAN_ATTRIBUTE_SID_BEACON                        = 107,
+       NAN_ATTRIBUTE_SYNC_DISC_2G_BEACON               = 108,
+       NAN_ATTRIBUTE_SYNC_DISC_5G_BEACON               = 109,
+       NAN_ATTRIBUTE_SDF_2G_SUPPORT                    = 110,
+       NAN_ATTRIBUTE_SDF_5G_SUPPORT                    = 111,
+       NAN_ATTRIBUTE_RSSI_CLOSE                        = 112,
+       NAN_ATTRIBUTE_RSSI_MIDDLE                       = 113,
+       NAN_ATTRIBUTE_RSSI_PROXIMITY                    = 114,
+       NAN_ATTRIBUTE_HOP_COUNT_LIMIT                   = 115,
+       NAN_ATTRIBUTE_RANDOM_TIME                       = 116,
+       NAN_ATTRIBUTE_MASTER_PREF                       = 117,
+       NAN_ATTRIBUTE_PERIODIC_SCAN_INTERVAL            = 118,
+
+       /* Nan Publish/Subscribe request attributes */
+       NAN_ATTRIBUTE_PUBLISH_ID                        = 119,
+       NAN_ATTRIBUTE_TTL                               = 120,
+       NAN_ATTRIBUTE_PERIOD                            = 121,
+       NAN_ATTRIBUTE_REPLIED_EVENT_FLAG                = 122,
+       NAN_ATTRIBUTE_PUBLISH_TYPE                      = 123,
+       NAN_ATTRIBUTE_TX_TYPE                           = 124,
+       NAN_ATTRIBUTE_PUBLISH_COUNT                     = 125,
+       NAN_ATTRIBUTE_SERVICE_NAME_LEN                  = 126,
+       NAN_ATTRIBUTE_SERVICE_NAME                      = 127,
+       NAN_ATTRIBUTE_SERVICE_SPECIFIC_INFO_LEN         = 128,
+       NAN_ATTRIBUTE_SERVICE_SPECIFIC_INFO             = 129,
+       NAN_ATTRIBUTE_RX_MATCH_FILTER_LEN               = 130,
+       NAN_ATTRIBUTE_RX_MATCH_FILTER                   = 131,
+       NAN_ATTRIBUTE_TX_MATCH_FILTER_LEN               = 132,
+       NAN_ATTRIBUTE_TX_MATCH_FILTER                   = 133,
+       NAN_ATTRIBUTE_SUBSCRIBE_ID                      = 134,
+       NAN_ATTRIBUTE_SUBSCRIBE_TYPE                    = 135,
+       NAN_ATTRIBUTE_SERVICERESPONSEFILTER             = 136,
+       NAN_ATTRIBUTE_SERVICERESPONSEINCLUDE            = 137,
+       NAN_ATTRIBUTE_USESERVICERESPONSEFILTER          = 138,
+       NAN_ATTRIBUTE_SSIREQUIREDFORMATCHINDICATION     = 139,
+       NAN_ATTRIBUTE_SUBSCRIBE_MATCH                   = 140,
+       NAN_ATTRIBUTE_SUBSCRIBE_COUNT                   = 141,
+       NAN_ATTRIBUTE_MAC_ADDR                          = 142,
+       NAN_ATTRIBUTE_MAC_ADDR_LIST                     = 143,
+       NAN_ATTRIBUTE_MAC_ADDR_LIST_NUM_ENTRIES         = 144,
+       NAN_ATTRIBUTE_PUBLISH_MATCH                     = 145,
+
+       /* Nan Event attributes */
+       NAN_ATTRIBUTE_ENABLE_STATUS                     = 146,
+       NAN_ATTRIBUTE_JOIN_STATUS                       = 147,
+       NAN_ATTRIBUTE_ROLE                              = 148,
+       NAN_ATTRIBUTE_MASTER_RANK                       = 149,
+       NAN_ATTRIBUTE_ANCHOR_MASTER_RANK                = 150,
+       NAN_ATTRIBUTE_CNT_PEND_TXFRM                    = 151,
+       NAN_ATTRIBUTE_CNT_BCN_TX                        = 152,
+       NAN_ATTRIBUTE_CNT_BCN_RX                        = 153,
+       NAN_ATTRIBUTE_CNT_SVC_DISC_TX                   = 154,
+       NAN_ATTRIBUTE_CNT_SVC_DISC_RX                   = 155,
+       NAN_ATTRIBUTE_AMBTT                             = 156,
+       NAN_ATTRIBUTE_CLUSTER_ID                        = 157,
+       NAN_ATTRIBUTE_INST_ID                           = 158,
+       NAN_ATTRIBUTE_OUI                               = 159,
+       NAN_ATTRIBUTE_STATUS                            = 160,
+       NAN_ATTRIBUTE_DE_EVENT_TYPE                     = 161,
+       NAN_ATTRIBUTE_MERGE                             = 162,
+       NAN_ATTRIBUTE_IFACE                             = 163,
+       NAN_ATTRIBUTE_CHANNEL                           = 164,
+       NAN_ATTRIBUTE_PEER_ID                           = 165,
+       NAN_ATTRIBUTE_NDP_ID                            = 167,
+       NAN_ATTRIBUTE_SECURITY                          = 168,
+       NAN_ATTRIBUTE_QOS                               = 169,
+       NAN_ATTRIBUTE_RSP_CODE                          = 170,
+       NAN_ATTRIBUTE_INST_COUNT                        = 171,
+       NAN_ATTRIBUTE_PEER_DISC_MAC_ADDR                = 172,
+       NAN_ATTRIBUTE_PEER_NDI_MAC_ADDR                 = 173,
+       NAN_ATTRIBUTE_IF_ADDR                           = 174,
+       NAN_ATTRIBUTE_WARMUP_TIME                       = 175,
+       NAN_ATTRIBUTE_RECV_IND_CFG                      = 176,
+       NAN_ATTRIBUTE_RSSI_CLOSE_5G                     = 177,
+       NAN_ATTRIBUTE_RSSI_MIDDLE_5G                    = 178,
+       NAN_ATTRIBUTE_RSSI_PROXIMITY_5G                 = 179,
+       NAN_ATTRIBUTE_CONNMAP                           = 180,
+       NAN_ATTRIBUTE_24G_CHANNEL                       = 181,
+       NAN_ATTRIBUTE_5G_CHANNEL                        = 182,
+       NAN_ATTRIBUTE_DWELL_TIME                        = 183,
+       NAN_ATTRIBUTE_SCAN_PERIOD                       = 184,
+       NAN_ATTRIBUTE_RSSI_WINDOW_SIZE                  = 185,
+       NAN_ATTRIBUTE_CONF_CLUSTER_VAL                  = 186,
+       NAN_ATTRIBUTE_AVAIL_BIT_MAP                     = 187,
+       NAN_ATTRIBUTE_ENTRY_CONTROL                     = 188,
+       NAN_ATTRIBUTE_CIPHER_SUITE_TYPE                 = 189,
+       NAN_ATTRIBUTE_KEY_TYPE                          = 190,
+       NAN_ATTRIBUTE_KEY_LEN                           = 191,
+       NAN_ATTRIBUTE_SCID                              = 192,
+       NAN_ATTRIBUTE_SCID_LEN                          = 193,
+       NAN_ATTRIBUTE_SDE_CONTROL_CONFIG_DP             = 194,
+       NAN_ATTRIBUTE_SDE_CONTROL_SECURITY              = 195,
+       NAN_ATTRIBUTE_SDE_CONTROL_DP_TYPE               = 196,
+       NAN_ATTRIBUTE_SDE_CONTROL_RANGE_SUPPORT         = 197,
+       NAN_ATTRIBUTE_NO_CONFIG_AVAIL                   = 198,
+       NAN_ATTRIBUTE_2G_AWAKE_DW                       = 199,
+       NAN_ATTRIBUTE_5G_AWAKE_DW                       = 200,
+       NAN_ATTRIBUTE_RANGING_INTERVAL                  = 201,
+       NAN_ATTRIBUTE_RANGING_INDICATION                = 202,
+       NAN_ATTRIBUTE_RANGING_INGRESS_LIMIT             = 203,
+       NAN_ATTRIBUTE_RANGING_EGRESS_LIMIT              = 204,
+       NAN_ATTRIBUTE_RANGING_AUTO_ACCEPT               = 205,
+       NAN_ATTRIBUTE_RANGING_RESULT                    = 206,
+       NAN_ATTRIBUTE_DISC_IND_CFG                      = 207,
+       NAN_ATTRIBUTE_RSSI_THRESHOLD_FLAG               = 208,
+       NAN_ATTRIBUTE_KEY_DATA                          = 209,
+       NAN_ATTRIBUTE_SDEA_SERVICE_SPECIFIC_INFO_LEN    = 210,
+       NAN_ATTRIBUTE_SDEA_SERVICE_SPECIFIC_INFO        = 211,
+       NAN_ATTRIBUTE_REASON                            = 212,
+       NAN_ATTRIBUTE_DWELL_TIME_5G                     = 215,
+       NAN_ATTRIBUTE_SCAN_PERIOD_5G                    = 216,
+       NAN_ATTRIBUTE_SVC_RESPONDER_POLICY              = 217,
+       NAN_ATTRIBUTE_EVENT_MASK                        = 218,
+       NAN_ATTRIBUTE_SUB_SID_BEACON                    = 219,
+       NAN_ATTRIBUTE_RANDOMIZATION_INTERVAL            = 220,
+       NAN_ATTRIBUTE_CMD_RESP_DATA                     = 221,
+       NAN_ATTRIBUTE_CMD_USE_NDPE                      = 222,
+       NAN_ATTRIBUTE_ENABLE_MERGE                      = 223,
+       NAN_ATTRIBUTE_DISCOVERY_BEACON_INTERVAL         = 224,
+       NAN_ATTRIBUTE_NSS                               = 225,
+       NAN_ATTRIBUTE_ENABLE_RANGING                    = 226,
+       NAN_ATTRIBUTE_DW_EARLY_TERM                     = 227
+} NAN_ATTRIBUTE;
+
+enum geofence_suspend_reason {
+       RTT_GEO_SUSPN_HOST_DIR_RTT_TRIG = 0,
+       RTT_GEO_SUSPN_PEER_RTT_TRIGGER = 1,
+       RTT_GEO_SUSPN_HOST_NDP_TRIGGER = 2,
+       RTT_GEO_SUSPN_PEER_NDP_TRIGGER = 3,
+       RTT_GEO_SUSPN_RANGE_RES_REPORTED = 4
+};
+#endif /* _wl_cfgnan_h_ */
diff --git a/bcmdhd.101.10.240.x/wl_cfgp2p.c b/bcmdhd.101.10.240.x/wl_cfgp2p.c
new file mode 100644 (file)
index 0000000..6d9662e
--- /dev/null
@@ -0,0 +1,2777 @@
+/*
+ * Linux cfgp2p driver
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ *
+ */
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/types.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+
+#include <bcmutils.h>
+#include <bcmstdlib_s.h>
+#include <bcmendian.h>
+#include <ethernet.h>
+#include <802.11.h>
+#include <net/rtnetlink.h>
+
+#include <wl_cfg80211.h>
+#include <wl_cfgp2p.h>
+#include <wl_cfgscan.h>
+#include <wldev_common.h>
+
+#include <wl_android.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_linux.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+#include <dhd_cfg80211.h>
+#include <dhd_bus.h>
+#include <dhd_config.h>
+
+static s8 scanparambuf[WLC_IOCTL_MEDLEN];
+static bool wl_cfgp2p_has_ie(const bcm_tlv_t *ie, const u8 **tlvs, u32 *tlvs_len,
+                             const u8 *oui, u32 oui_len, u8 type);
+
+static s32 wl_cfgp2p_cancel_listen(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       struct wireless_dev *wdev, bool notify);
+
+#if defined(WL_ENABLE_P2P_IF)
+static int wl_cfgp2p_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+static int wl_cfgp2p_do_ioctl(struct net_device *net, struct ifreq *ifr, int cmd);
+static int wl_cfgp2p_if_open(struct net_device *net);
+static int wl_cfgp2p_if_stop(struct net_device *net);
+
+static const struct net_device_ops wl_cfgp2p_if_ops = {
+       .ndo_open       = wl_cfgp2p_if_open,
+       .ndo_stop       = wl_cfgp2p_if_stop,
+       .ndo_do_ioctl   = wl_cfgp2p_do_ioctl,
+       .ndo_start_xmit = wl_cfgp2p_start_xmit,
+};
+#endif /* WL_ENABLE_P2P_IF */
+
+#if defined(WL_NEWCFG_PRIVCMD_SUPPORT)
+static int wl_cfgp2p_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+static int wl_cfgp2p_do_ioctl(struct net_device *net, struct ifreq *ifr, int cmd);
+
+static int wl_cfgp2p_if_dummy(struct net_device *net)
+{
+       return 0;
+}
+
+static const struct net_device_ops wl_cfgp2p_if_ops = {
+       .ndo_open       = wl_cfgp2p_if_dummy,
+       .ndo_stop       = wl_cfgp2p_if_dummy,
+       .ndo_do_ioctl   = wl_cfgp2p_do_ioctl,
+       .ndo_start_xmit = wl_cfgp2p_start_xmit,
+};
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+
+bool wl_cfgp2p_is_pub_action(void *frame, u32 frame_len)
+{
+       wifi_p2p_pub_act_frame_t *pact_frm;
+
+       if (frame == NULL)
+               return false;
+       pact_frm = (wifi_p2p_pub_act_frame_t *)frame;
+       if (frame_len < sizeof(wifi_p2p_pub_act_frame_t) -1)
+               return false;
+
+       if (pact_frm->category == P2P_PUB_AF_CATEGORY &&
+               pact_frm->action == P2P_PUB_AF_ACTION &&
+               pact_frm->oui_type == P2P_VER &&
+               memcmp(pact_frm->oui, P2P_OUI, sizeof(pact_frm->oui)) == 0) {
+               return true;
+       }
+
+       return false;
+}
+
+bool wl_cfgp2p_is_p2p_action(void *frame, u32 frame_len)
+{
+       wifi_p2p_action_frame_t *act_frm;
+
+       if (frame == NULL)
+               return false;
+       act_frm = (wifi_p2p_action_frame_t *)frame;
+       if (frame_len < sizeof(wifi_p2p_action_frame_t) -1)
+               return false;
+
+       if (act_frm->category == P2P_AF_CATEGORY &&
+               act_frm->type  == P2P_VER &&
+               memcmp(act_frm->OUI, P2P_OUI, DOT11_OUI_LEN) == 0) {
+               return true;
+       }
+
+       return false;
+}
+
+/*
+* Currently Action frame just pass to P2P interface regardless real dst.
+* but GAS Action can be used for Hotspot2.0 as well
+* Need to distingush that it's for P2P or HS20
+*/
+#define GAS_RESP_OFFSET                4
+#define GAS_CRESP_OFFSET       5
+bool wl_cfgp2p_is_gas_action(void *frame, u32 frame_len)
+{
+       wifi_p2psd_gas_pub_act_frame_t *sd_act_frm;
+
+       if (frame == NULL)
+               return false;
+
+       sd_act_frm = (wifi_p2psd_gas_pub_act_frame_t *)frame;
+       if (frame_len < (sizeof(wifi_p2psd_gas_pub_act_frame_t) - 1))
+               return false;
+       if (sd_act_frm->category != P2PSD_ACTION_CATEGORY)
+               return false;
+
+       if (wl_cfg80211_is_dpp_gas_action(frame, frame_len)) {
+               return true;
+       }
+
+#ifdef WL11U
+       /* Hotspot2.0 STA mode can receive only response
+       *  SoftAP mode cannot run Hotspot2.0 compliant Ap because
+       *  Hotspot2.0 support only Enterprise mode
+       */
+       if (sd_act_frm->action == P2PSD_ACTION_ID_GAS_IRESP) {
+               return wl_cfg80211_find_gas_subtype(P2PSD_GAS_OUI_SUBTYPE, P2PSD_GAS_NQP_INFOID,
+                       (u8 *)sd_act_frm->query_data + GAS_RESP_OFFSET,
+                       frame_len);
+
+       } else if (sd_act_frm->action == P2PSD_ACTION_ID_GAS_CRESP) {
+               return wl_cfg80211_find_gas_subtype(P2PSD_GAS_OUI_SUBTYPE, P2PSD_GAS_NQP_INFOID,
+                       (u8 *)sd_act_frm->query_data + GAS_CRESP_OFFSET,
+                       frame_len);
+       } else if (sd_act_frm->action == P2PSD_ACTION_ID_GAS_IREQ ||
+               sd_act_frm->action == P2PSD_ACTION_ID_GAS_CREQ) {
+               return true;
+       } else {
+               return false;
+       }
+#else
+       if (sd_act_frm->action == P2PSD_ACTION_ID_GAS_IREQ ||
+               sd_act_frm->action == P2PSD_ACTION_ID_GAS_IRESP ||
+               sd_act_frm->action == P2PSD_ACTION_ID_GAS_CREQ ||
+               sd_act_frm->action == P2PSD_ACTION_ID_GAS_CRESP)
+               return true;
+       else
+               return false;
+#endif /* WL11U */
+}
+
+bool wl_cfgp2p_is_p2p_gas_action(void *frame, u32 frame_len)
+{
+
+       wifi_p2psd_gas_pub_act_frame_t *sd_act_frm;
+
+       if (frame == NULL)
+               return false;
+
+       sd_act_frm = (wifi_p2psd_gas_pub_act_frame_t *)frame;
+       if (frame_len < (sizeof(wifi_p2psd_gas_pub_act_frame_t) - 1))
+               return false;
+       if (sd_act_frm->category != P2PSD_ACTION_CATEGORY)
+               return false;
+
+       if (sd_act_frm->action == P2PSD_ACTION_ID_GAS_IREQ)
+               return wl_cfg80211_find_gas_subtype(P2PSD_GAS_OUI_SUBTYPE, P2PSD_GAS_NQP_INFOID,
+                       (u8 *)sd_act_frm->query_data,
+                       frame_len);
+       else
+               return false;
+}
+
+void wl_cfgp2p_print_actframe(bool tx, void *frame, u32 frame_len, u32 channel)
+{
+       wifi_p2p_pub_act_frame_t *pact_frm;
+       wifi_p2p_action_frame_t *act_frm;
+       wifi_p2psd_gas_pub_act_frame_t *sd_act_frm;
+       if (!frame || frame_len <= 2)
+               return;
+
+       if (wl_cfgp2p_is_pub_action(frame, frame_len)) {
+               pact_frm = (wifi_p2p_pub_act_frame_t *)frame;
+               switch (pact_frm->subtype) {
+                       case P2P_PAF_GON_REQ:
+                               CFGP2P_ACTION(("%s P2P Group Owner Negotiation Req Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_GON_RSP:
+                               CFGP2P_ACTION(("%s P2P Group Owner Negotiation Rsp Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_GON_CONF:
+                               CFGP2P_ACTION(("%s P2P Group Owner Negotiation Confirm Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_INVITE_REQ:
+                               CFGP2P_ACTION(("%s P2P Invitation Request  Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_INVITE_RSP:
+                               CFGP2P_ACTION(("%s P2P Invitation Response Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_DEVDIS_REQ:
+                               CFGP2P_ACTION(("%s P2P Device Discoverability Request Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_DEVDIS_RSP:
+                               CFGP2P_ACTION(("%s P2P Device Discoverability Response Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_PROVDIS_REQ:
+                               CFGP2P_ACTION(("%s P2P Provision Discovery Request Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_PROVDIS_RSP:
+                               CFGP2P_ACTION(("%s P2P Provision Discovery Response Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       default:
+                               CFGP2P_ACTION(("%s Unknown Public Action Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+
+               }
+       } else if (wl_cfgp2p_is_p2p_action(frame, frame_len)) {
+               act_frm = (wifi_p2p_action_frame_t *)frame;
+               switch (act_frm->subtype) {
+                       case P2P_AF_NOTICE_OF_ABSENCE:
+                               CFGP2P_ACTION(("%s P2P Notice of Absence Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_AF_PRESENCE_REQ:
+                               CFGP2P_ACTION(("%s P2P Presence Request Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_AF_PRESENCE_RSP:
+                               CFGP2P_ACTION(("%s P2P Presence Response Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_AF_GO_DISC_REQ:
+                               CFGP2P_ACTION(("%s P2P Discoverability Request Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       default:
+                               CFGP2P_ACTION(("%s Unknown P2P Action Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+               }
+
+       } else if (wl_cfg80211_is_dpp_frame(frame, frame_len)) {
+               wl_dpp_pa_frame_t *pa = (wl_dpp_pa_frame_t *)frame;
+               CFGP2P_ACTION(("%s %s, channel=%d\n",
+                               (tx) ? "TX" : "RX", get_dpp_pa_ftype(pa->ftype), channel));
+       } else if (wl_cfgp2p_is_gas_action(frame, frame_len)) {
+               sd_act_frm = (wifi_p2psd_gas_pub_act_frame_t *)frame;
+               switch (sd_act_frm->action) {
+                       case P2PSD_ACTION_ID_GAS_IREQ:
+                               CFGP2P_ACTION(("%s GAS Initial Request,"
+                                       " channel=%d\n", (tx)? "TX" : "RX", channel));
+                               break;
+                       case P2PSD_ACTION_ID_GAS_IRESP:
+                               CFGP2P_ACTION(("%s GAS Initial Response,"
+                                       " channel=%d\n", (tx)? "TX" : "RX", channel));
+                               break;
+                       case P2PSD_ACTION_ID_GAS_CREQ:
+                               CFGP2P_ACTION(("%s GAS Comback Request,"
+                                       " channel=%d\n", (tx)? "TX" : "RX", channel));
+                               break;
+                       case P2PSD_ACTION_ID_GAS_CRESP:
+                               CFGP2P_ACTION(("%s GAS Comback Response,"
+                                       " channel=%d\n", (tx)? "TX" : "RX", channel));
+                               break;
+                       default:
+                               CFGP2P_ACTION(("%s Unknown GAS Frame,"
+                                       " channel=%d\n", (tx)? "TX" : "RX", channel));
+               }
+       }
+}
+
+/*
+ *  Initialize variables related to P2P
+ *
+ */
+s32
+wl_cfgp2p_init_priv(struct bcm_cfg80211 *cfg)
+{
+       struct ether_addr primary_mac;
+       cfg->p2p = MALLOCZ(cfg->osh, sizeof(struct p2p_info));
+       if (cfg->p2p == NULL) {
+               CFGP2P_ERR(("struct p2p_info allocation failed\n"));
+               return -ENOMEM;
+       }
+
+       get_primary_mac(cfg, &primary_mac);
+       wl_cfgp2p_generate_bss_mac(cfg, &primary_mac);
+
+       wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY) = bcmcfg_to_prmry_ndev(cfg);
+       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_PRIMARY) = 0;
+       wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE) = NULL;
+       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) = 0;
+       wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION1) = NULL;
+       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION1) = -1;
+       wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION2) = NULL;
+       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION2) = -1;
+       return BCME_OK;
+
+}
+/*
+ *  Deinitialize variables related to P2P
+ *
+ */
+void
+wl_cfgp2p_deinit_priv(struct bcm_cfg80211 *cfg)
+{
+       CFGP2P_INFO(("In\n"));
+       if (cfg->p2p) {
+               MFREE(cfg->osh, cfg->p2p, sizeof(struct p2p_info));
+               cfg->p2p = NULL;
+       }
+       cfg->p2p_supported = 0;
+}
+/*
+ * Set P2P functions into firmware
+ */
+s32
+wl_cfgp2p_set_firm_p2p(struct bcm_cfg80211 *cfg)
+{
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       s32 ret = BCME_OK;
+       s32 val = 0;
+       struct ether_addr *p2p_dev_addr = wl_to_p2p_bss_macaddr(cfg, P2PAPI_BSSCFG_DEVICE);
+
+       if (ETHER_ISNULLADDR(p2p_dev_addr)) {
+               CFGP2P_ERR(("NULL p2p_dev_addr\n"));
+               return BCME_BADADDR;
+       }
+
+       /* Do we have to check whether APSTA is enabled or not ? */
+       ret = wldev_iovar_getint(ndev, "apsta", &val);
+       if (ret < 0) {
+               CFGP2P_ERR(("get apsta error %d\n", ret));
+               return ret;
+       }
+       if (val == 0) {
+               val = 1;
+               ret = wldev_ioctl_set(ndev, WLC_DOWN, &val, sizeof(s32));
+               if (ret < 0) {
+                       CFGP2P_ERR(("WLC_DOWN error %d\n", ret));
+                       return ret;
+               }
+
+               ret = wldev_iovar_setint(ndev, "apsta", val);
+               if (ret < 0) {
+                       /* return error and fail the initialization */
+                       CFGP2P_ERR(("wl apsta %d set error. ret: %d\n", val, ret));
+                       return ret;
+               }
+
+               ret = wldev_ioctl_set(ndev, WLC_UP, &val, sizeof(s32));
+               if (ret < 0) {
+                       CFGP2P_ERR(("WLC_UP error %d\n", ret));
+                       return ret;
+               }
+       }
+
+       /* In case of COB type, firmware has default mac address
+        * After Initializing firmware, we have to set current mac address to
+        * firmware for P2P device address
+        */
+       ret = wldev_iovar_setbuf_bsscfg(ndev, "p2p_da_override", p2p_dev_addr,
+               sizeof(*p2p_dev_addr), cfg->ioctl_buf, WLC_IOCTL_MAXLEN, 0, &cfg->ioctl_buf_sync);
+       if (ret && ret != BCME_UNSUPPORTED) {
+               CFGP2P_ERR(("failed to update device address ret %d\n", ret));
+       }
+       return ret;
+}
+
+int wl_cfg_multip2p_operational(struct bcm_cfg80211 *cfg)
+{
+       if (!cfg->p2p) {
+               CFGP2P_DBG(("p2p not enabled! \n"));
+               return false;
+       }
+
+       if ((wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION1) != -1) &&
+           (wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION2) != -1))
+               return true;
+       else
+               return false;
+}
+
+/* Create a new P2P BSS.
+ * Parameters:
+ * @mac      : MAC address of the BSS to create
+ * @if_type  : interface type: WL_P2P_IF_GO or WL_P2P_IF_CLIENT
+ * @chspec   : chspec to use if creating a GO BSS.
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifadd(struct bcm_cfg80211 *cfg, struct ether_addr *mac, u8 if_type,
+            chanspec_t chspec)
+{
+       wl_p2p_if_t ifreq;
+       s32 err;
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       ifreq.type = if_type;
+       ifreq.chspec = chspec;
+       memcpy(ifreq.addr.octet, mac->octet, sizeof(ifreq.addr.octet));
+
+       CFGP2P_ERR(("---cfg p2p_ifadd "MACDBG" %s %u\n",
+               MAC2STRDBG(ifreq.addr.octet),
+               (if_type == WL_P2P_IF_GO) ? "go" : "client",
+               (chspec & WL_CHANSPEC_CHAN_MASK) >> WL_CHANSPEC_CHAN_SHIFT));
+
+       err = wldev_iovar_setbuf(ndev, "p2p_ifadd", &ifreq, sizeof(ifreq),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(err < 0)) {
+               CFGP2P_ERR(("'cfg p2p_ifadd' error %d\n", err));
+               return err;
+       }
+
+       return err;
+}
+
+/* Disable a P2P BSS.
+ * Parameters:
+ * @mac      : MAC address of the BSS to disable
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifdisable(struct bcm_cfg80211 *cfg, struct ether_addr *mac)
+{
+       s32 ret;
+       struct net_device *netdev = bcmcfg_to_prmry_ndev(cfg);
+
+       CFGP2P_INFO(("------ cfg p2p_ifdis "MACDBG" dev->ifindex:%d \n",
+               MAC2STRDBG(mac->octet), netdev->ifindex));
+       ret = wldev_iovar_setbuf(netdev, "p2p_ifdis", mac, sizeof(*mac),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR(("'cfg p2p_ifdis' error %d\n", ret));
+       }
+       return ret;
+}
+
+/* Delete a P2P BSS.
+ * Parameters:
+ * @mac      : MAC address of the BSS to delete
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifdel(struct bcm_cfg80211 *cfg, struct ether_addr *mac)
+{
+       s32 ret;
+       struct net_device *netdev = bcmcfg_to_prmry_ndev(cfg);
+
+       CFGP2P_ERR(("------ cfg p2p_ifdel "MACDBG" dev->ifindex:%d\n",
+           MAC2STRDBG(mac->octet), netdev->ifindex));
+       ret = wldev_iovar_setbuf(netdev, "p2p_ifdel", mac, sizeof(*mac),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR(("'cfg p2p_ifdel' error %d\n", ret));
+       }
+
+       return ret;
+}
+
+/* Change a P2P Role.
+ * Parameters:
+ * @mac      : MAC address of the BSS to change a role
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifchange(struct bcm_cfg80211 *cfg, struct ether_addr *mac, u8 if_type,
+            chanspec_t chspec, s32 conn_idx)
+{
+       wl_p2p_if_t ifreq;
+       s32 err;
+
+       struct net_device *netdev =  wl_to_p2p_bss_ndev(cfg, conn_idx);
+
+       ifreq.type = if_type;
+       ifreq.chspec = chspec;
+       memcpy(ifreq.addr.octet, mac->octet, sizeof(ifreq.addr.octet));
+
+       CFGP2P_INFO(("---cfg p2p_ifchange "MACDBG" %s %u"
+               " chanspec 0x%04x\n", MAC2STRDBG(ifreq.addr.octet),
+               (if_type == WL_P2P_IF_GO) ? "go" : "client",
+               (chspec & WL_CHANSPEC_CHAN_MASK) >> WL_CHANSPEC_CHAN_SHIFT,
+               ifreq.chspec));
+
+       err = wldev_iovar_setbuf(netdev, "p2p_ifupd", &ifreq, sizeof(ifreq),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(err < 0)) {
+               CFGP2P_ERR(("'cfg p2p_ifupd' error %d\n", err));
+       } else if (if_type == WL_P2P_IF_GO) {
+               cfg->p2p->p2p_go_count++;
+       }
+       return err;
+}
+
+/* Get the index of a created P2P BSS.
+ * Parameters:
+ * @mac      : MAC address of the created BSS
+ * @index    : output: index of created BSS
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifidx(struct bcm_cfg80211 *cfg, struct ether_addr *mac, s32 *index)
+{
+       s32 ret;
+       u8 getbuf[64];
+       struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+
+       CFGP2P_INFO(("---cfg p2p_if "MACDBG"\n", MAC2STRDBG(mac->octet)));
+
+       ret = wldev_iovar_getbuf_bsscfg(dev, "p2p_if", mac, sizeof(*mac), getbuf,
+               sizeof(getbuf), wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_PRIMARY), NULL);
+
+       if (ret == 0) {
+               memcpy(index, getbuf, sizeof(s32));
+               CFGP2P_DBG(("---cfg p2p_if   ==> %d\n", *index));
+       }
+
+       return ret;
+}
+
+static s32
+wl_cfgp2p_set_discovery(struct bcm_cfg80211 *cfg, s32 on)
+{
+       s32 ret = BCME_OK;
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       CFGP2P_DBG(("enter\n"));
+
+       ret = wldev_iovar_setint(ndev, "p2p_disc", on);
+
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR(("p2p_disc %d error %d\n", on, ret));
+       }
+
+       return ret;
+}
+
+/* Set the WL driver's P2P mode.
+ * Parameters :
+ * @mode      : is one of WL_P2P_DISC_ST_{SCAN,LISTEN,SEARCH}.
+ * @channel   : the channel to listen
+ * @listen_ms : the time (milli seconds) to wait
+ * @bssidx    : bss index for BSSCFG
+ * Returns 0 if success
+ */
+
+s32
+wl_cfgp2p_set_p2p_mode(struct bcm_cfg80211 *cfg, u8 mode, u32 channel, u16 listen_ms, int bssidx)
+{
+       wl_p2p_disc_st_t discovery_mode;
+       s32 ret;
+       struct net_device *dev;
+       CFGP2P_DBG(("enter\n"));
+
+       if (unlikely(bssidx == WL_INVALID)) {
+               CFGP2P_ERR((" %d index out of range\n", bssidx));
+               return -1;
+       }
+
+       dev = wl_cfgp2p_find_ndev(cfg, bssidx);
+       if (unlikely(dev == NULL)) {
+               CFGP2P_ERR(("bssidx %d is not assigned\n", bssidx));
+               return BCME_NOTFOUND;
+       }
+
+#ifdef P2PLISTEN_AP_SAMECHN
+       CFGP2P_DBG(("p2p0 listen channel %d  AP connection chan %d \n",
+               channel, cfg->channel));
+       if ((mode == WL_P2P_DISC_ST_LISTEN) && (cfg->channel == channel)) {
+               struct net_device *primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+               if (cfg->p2p_resp_apchn_status) {
+                       CFGP2P_DBG(("p2p_resp_apchn_status already ON \n"));
+                       return BCME_OK;
+               }
+
+               if (wl_get_drv_status(cfg, CONNECTED, primary_ndev)) {
+                       ret = wl_cfg80211_set_p2p_resp_ap_chn(primary_ndev, 1);
+                       cfg->p2p_resp_apchn_status = true;
+                       CFGP2P_DBG(("p2p_resp_apchn_status ON \n"));
+                       return ret;
+               }
+       }
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+       /* Put the WL driver into P2P Listen Mode to respond to P2P probe reqs */
+       discovery_mode.state = mode;
+       discovery_mode.chspec = wl_ch_host_to_driver(channel);
+       discovery_mode.dwell = listen_ms;
+       ret = wldev_iovar_setbuf_bsscfg(dev, "p2p_state", &discovery_mode,
+               sizeof(discovery_mode), cfg->ioctl_buf, WLC_IOCTL_MAXLEN,
+               bssidx, &cfg->ioctl_buf_sync);
+
+       return ret;
+}
+
+/* Get the index of the P2P Discovery BSS */
+static s32
+wl_cfgp2p_get_disc_idx(struct bcm_cfg80211 *cfg, s32 *index)
+{
+       s32 ret;
+       struct net_device *dev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY);
+
+       ret = wldev_iovar_getint(dev, "p2p_dev", index);
+       CFGP2P_INFO(("p2p_dev bsscfg_idx=%d ret=%d\n", *index, ret));
+
+       if (unlikely(ret <  0)) {
+           CFGP2P_ERR(("'p2p_dev' error %d\n", ret));
+               return ret;
+       }
+       return ret;
+}
+
+int wl_cfgp2p_get_conn_idx(struct bcm_cfg80211 *cfg)
+{
+       int i;
+       s32 connected_cnt;
+       dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+       if (!dhd)
+               return (-ENODEV);
+       for (i = P2PAPI_BSSCFG_CONNECTION1; i < P2PAPI_BSSCFG_MAX; i++) {
+               if (wl_to_p2p_bss_bssidx(cfg, i) == -1) {
+                       if (i == P2PAPI_BSSCFG_CONNECTION2) {
+                               if (!(dhd->op_mode & DHD_FLAG_MP2P_MODE)) {
+                                       CFGP2P_ERR(("Multi p2p not supported"));
+                                       return BCME_ERROR;
+                               }
+                               if ((connected_cnt = wl_get_drv_status_all(cfg, CONNECTED)) > 1) {
+                                       CFGP2P_ERR(("Failed to create second p2p interface"
+                                               "Already one connection exists"));
+                                       return BCME_ERROR;
+                               }
+                       }
+               return i;
+               }
+       }
+       return BCME_ERROR;
+}
+
+s32
+wl_cfgp2p_init_discovery(struct bcm_cfg80211 *cfg)
+{
+
+       s32 bssidx = 0;
+       s32 ret = BCME_OK;
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       BCM_REFERENCE(ndev);
+       CFGP2P_DBG(("enter\n"));
+
+       if (wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) > 0) {
+               CFGP2P_ERR(("do nothing, already initialized\n"));
+               goto exit;
+       }
+
+       ret = wl_cfgp2p_set_discovery(cfg, 1);
+       if (ret < 0) {
+               CFGP2P_ERR(("set discover error\n"));
+               goto exit;
+       }
+       /* Enable P2P Discovery in the WL Driver */
+       ret = wl_cfgp2p_get_disc_idx(cfg, &bssidx);
+       if (ret < 0) {
+               goto exit;
+       }
+
+       /* In case of CFG80211 case, check if p2p_discovery interface has allocated p2p_wdev */
+       if (!cfg->p2p_wdev) {
+               CFGP2P_ERR(("p2p_wdev is NULL.\n"));
+               ret = -ENODEV;
+               goto exit;
+       }
+
+       /* Once p2p also starts using interface_create iovar, the ifidx may change.
+        * so that time, the ifidx returned in WLC_E_IF should be used for populating
+        * the netinfo
+        */
+       ret = wl_alloc_netinfo(cfg, NULL, cfg->p2p_wdev, WL_IF_TYPE_STA, 0, bssidx, 0);
+       if (unlikely(ret)) {
+               goto exit;
+       }
+       wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE) =
+           wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY);
+       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) = bssidx;
+
+       /* Set the initial discovery state to SCAN */
+       ret = wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+               wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+
+       if (unlikely(ret != 0)) {
+               CFGP2P_ERR(("unable to set WL_P2P_DISC_ST_SCAN\n"));
+               wl_cfgp2p_set_discovery(cfg, 0);
+               wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) = 0;
+               wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE) = NULL;
+               ret = 0;
+               goto exit;
+       }
+
+       /* Clear our saved WPS and P2P IEs for the discovery BSS */
+       wl_cfg80211_clear_p2p_disc_ies(cfg);
+exit:
+       if (ret) {
+               wl_flush_fw_log_buffer(ndev, FW_LOGSET_MASK_ALL);
+       }
+       return ret;
+}
+
+/* Deinitialize P2P Discovery
+ * Parameters :
+ * @cfg        : wl_private data
+ * Returns 0 if succes
+ */
+static s32
+wl_cfgp2p_deinit_discovery(struct bcm_cfg80211 *cfg)
+{
+       s32 ret = BCME_OK;
+       s32 bssidx;
+
+       CFGP2P_DBG(("enter\n"));
+       bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+       if (bssidx <= 0) {
+               CFGP2P_ERR(("do nothing, not initialized\n"));
+               return -1;
+       }
+
+       /* Clear our saved WPS and P2P IEs for the discovery BSS */
+       wl_cfg80211_clear_p2p_disc_ies(cfg);
+
+       /* Set the discovery state to SCAN */
+       wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+                   bssidx);
+       /* Disable P2P discovery in the WL driver (deletes the discovery BSSCFG) */
+       ret = wl_cfgp2p_set_discovery(cfg, 0);
+
+       /* Remove the p2p disc entry in the netinfo */
+       wl_dealloc_netinfo_by_wdev(cfg, cfg->p2p_wdev);
+
+       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) = WL_INVALID;
+       wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE) = NULL;
+
+       return ret;
+
+}
+/* Enable P2P Discovery
+ * Parameters:
+ * @cfg        : wl_private data
+ * @ie  : probe request ie (WPS IE + P2P IE)
+ * @ie_len   : probe request ie length
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_enable_discovery(struct bcm_cfg80211 *cfg, struct net_device *dev,
+       const u8 *ie, u32 ie_len)
+{
+       s32 ret = BCME_OK;
+       s32 bssidx;
+       bcm_struct_cfgdev *cfgdev;
+
+       CFGP2P_DBG(("enter\n"));
+       mutex_lock(&cfg->if_sync);
+#ifdef WL_IFACE_MGMT
+       if ((ret = wl_cfg80211_handle_if_role_conflict(cfg, WL_IF_TYPE_P2P_DISC)) != BCME_OK) {
+               WL_ERR(("secondary iface is active, p2p enable discovery is not supported\n"));
+               goto exit;
+       }
+#endif /* WL_IFACE_MGMT */
+
+       if (wl_get_p2p_status(cfg, DISCOVERY_ON)) {
+               CFGP2P_DBG((" DISCOVERY is already initialized, we have nothing to do\n"));
+               goto set_ie;
+       }
+
+       ret = wl_cfgp2p_init_discovery(cfg);
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR((" init discovery error %d\n", ret));
+               goto exit;
+       }
+
+       wl_set_p2p_status(cfg, DISCOVERY_ON);
+       /* Set wsec to any non-zero value in the discovery bsscfg to ensure our
+        * P2P probe responses have the privacy bit set in the 802.11 WPA IE.
+        * Some peer devices may not initiate WPS with us if this bit is not set.
+        */
+       ret = wldev_iovar_setint_bsscfg(wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE),
+                       "wsec", AES_ENABLED, wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR((" wsec error %d\n", ret));
+               goto exit;
+       }
+set_ie:
+
+       if (ie_len) {
+               if (bcmcfg_to_prmry_ndev(cfg) == dev) {
+                       bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+               } else if ((bssidx = wl_get_bssidx_by_wdev(cfg, cfg->p2p_wdev)) < 0) {
+                       WL_ERR(("Find p2p index from wdev(%p) failed\n", cfg->p2p_wdev));
+                       ret = BCME_ERROR;
+                       goto exit;
+               }
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+               /* For 3.8+ kernels, pass p2p discovery wdev */
+               cfgdev = cfg->p2p_wdev;
+#else
+               /* Prior to 3.8 kernel, there is no netless p2p, so pass p2p0 ndev */
+               cfgdev = ndev_to_cfgdev(dev);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+               ret = wl_cfg80211_set_mgmt_vndr_ies(cfg, cfgdev,
+                               bssidx, VNDR_IE_PRBREQ_FLAG, ie, ie_len);
+               if (unlikely(ret < 0)) {
+                       CFGP2P_ERR(("set probreq ie occurs error %d\n", ret));
+                       goto exit;
+               }
+       }
+exit:
+       if (ret) {
+               /* Disable discovery I/f on any failure */
+               if (wl_cfgp2p_disable_discovery(cfg) != BCME_OK) {
+                       /* Discard error (if any) to avoid override
+                        * of p2p enable error.
+                        */
+                       CFGP2P_ERR(("p2p disable disc failed\n"));
+               }
+               wl_flush_fw_log_buffer(dev, FW_LOGSET_MASK_ALL);
+       }
+       mutex_unlock(&cfg->if_sync);
+       return ret;
+}
+
+/* Disable P2P Discovery
+ * Parameters:
+ * @cfg       : wl_private_data
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_disable_discovery(struct bcm_cfg80211 *cfg)
+{
+       s32 ret = BCME_OK;
+       s32 bssidx;
+
+       CFGP2P_DBG((" enter\n"));
+       wl_clr_p2p_status(cfg, DISCOVERY_ON);
+
+       if (!cfg->p2p) { // terence 20130113: Fix for p2p NULL pointer
+               ret = BCME_ERROR;
+               CFGP2P_ERR(("wl->p2p is NULL\n"));
+               goto exit;
+       }
+
+#ifdef DHD_IFDEBUG
+       WL_ERR(("%s: bssidx: %d\n",
+               __FUNCTION__, (cfg)->p2p->bss[P2PAPI_BSSCFG_DEVICE].bssidx));
+#endif
+       bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+       if (bssidx <= 0) {
+               CFGP2P_ERR((" do nothing, not initialized\n"));
+               return 0;
+       }
+
+       ret = wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0, bssidx);
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR(("unable to set WL_P2P_DISC_ST_SCAN\n"));
+       }
+       /* Do a scan abort to stop the driver's scan engine in case it is still
+        * waiting out an action frame tx dwell time.
+        */
+#ifdef NOT_YET
+       if (wl_get_p2p_status(cfg, SCANNING)) {
+               p2pwlu_scan_abort(hdl, FALSE);
+       }
+#endif
+       wl_clr_p2p_status(cfg, DISCOVERY_ON);
+       ret = wl_cfgp2p_deinit_discovery(cfg);
+
+exit:
+       return ret;
+}
+
+/* Scan parameters */
+#define P2PAPI_SCAN_NPROBES 1
+#define P2PAPI_SCAN_DWELL_TIME_MS 80
+#define P2PAPI_SCAN_SOCIAL_DWELL_TIME_MS 40
+#define P2PAPI_SCAN_HOME_TIME_MS 60
+#define P2PAPI_SCAN_NPROBS_TIME_MS 30
+#define P2PAPI_SCAN_AF_SEARCH_DWELL_TIME_MS 100
+s32
+wl_cfgp2p_escan(struct bcm_cfg80211 *cfg, struct net_device *dev, u16 active_scan,
+       u32 num_chans, u16 *channels,
+       s32 search_state, u16 action, u32 bssidx, struct ether_addr *tx_dst_addr,
+       p2p_scan_purpose_t p2p_scan_purpose)
+{
+       s32 ret = BCME_OK;
+       s32 memsize;
+       s32 eparams_size;
+       u32 i;
+       s8 *memblk;
+       wl_p2p_scan_t *p2p_params;
+       wl_escan_params_t *eparams;
+       wl_escan_params_v2_t *eparams_v2;
+       wlc_ssid_t ssid;
+       u32 sync_id = 0;
+       s32 nprobes = 0;
+       s32 active_time = 0;
+       const struct ether_addr *mac_addr = NULL;
+       u32 scan_type = 0;
+       struct net_device *pri_dev = NULL;
+
+       pri_dev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY);
+       /* Allocate scan params which need space for 3 channels and 0 ssids */
+       if (cfg->scan_params_v2) {
+               eparams_size = (WL_SCAN_PARAMS_V2_FIXED_SIZE +
+                       OFFSETOF(wl_escan_params_v2_t, params)) +
+                       num_chans * sizeof(eparams->params.channel_list[0]);
+       } else {
+               eparams_size = (WL_SCAN_PARAMS_FIXED_SIZE +
+                       OFFSETOF(wl_escan_params_t, params)) +
+                       num_chans * sizeof(eparams->params.channel_list[0]);
+       }
+
+       memsize = sizeof(wl_p2p_scan_t) + eparams_size;
+       memblk = scanparambuf;
+       if (memsize > sizeof(scanparambuf)) {
+               CFGP2P_ERR((" scanpar buf too small (%u > %zu)\n",
+                   memsize, sizeof(scanparambuf)));
+               return -1;
+       }
+       bzero(memblk, memsize);
+       bzero(cfg->ioctl_buf, WLC_IOCTL_MAXLEN);
+       if (search_state == WL_P2P_DISC_ST_SEARCH) {
+               /*
+                * If we in SEARCH STATE, we don't need to set SSID explictly
+                * because dongle use P2P WILDCARD internally by default
+                */
+               wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SEARCH, 0, 0, bssidx);
+               /* use null ssid */
+               ssid.SSID_len = 0;
+               bzero(&ssid.SSID, sizeof(ssid.SSID));
+       } else if (search_state == WL_P2P_DISC_ST_SCAN) {
+               /* SCAN STATE 802.11 SCAN
+                * WFD Supplicant has p2p_find command with (type=progressive, type= full)
+                * So if P2P_find command with type=progressive,
+                * we have to set ssid to P2P WILDCARD because
+                * we just do broadcast scan unless setting SSID
+                */
+               wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0, bssidx);
+               /* use wild card ssid */
+               ssid.SSID_len = WL_P2P_WILDCARD_SSID_LEN;
+               bzero(&ssid.SSID, sizeof(ssid.SSID));
+               memcpy(&ssid.SSID, WL_P2P_WILDCARD_SSID, WL_P2P_WILDCARD_SSID_LEN);
+       } else {
+               CFGP2P_ERR((" invalid search state %d\n", search_state));
+               return -1;
+       }
+
+       /* Fill in the P2P scan structure at the start of the iovar param block */
+       p2p_params = (wl_p2p_scan_t*) memblk;
+       p2p_params->type = 'E';
+
+       if (!active_scan) {
+               scan_type = WL_SCANFLAGS_PASSIVE;
+       }
+
+       if (tx_dst_addr == NULL) {
+               mac_addr = &ether_bcast;
+       } else {
+               mac_addr = tx_dst_addr;
+       }
+
+       switch (p2p_scan_purpose) {
+               case P2P_SCAN_SOCIAL_CHANNEL:
+                       active_time = P2PAPI_SCAN_SOCIAL_DWELL_TIME_MS;
+                       break;
+               case P2P_SCAN_AFX_PEER_NORMAL:
+               case P2P_SCAN_AFX_PEER_REDUCED:
+                       active_time = P2PAPI_SCAN_AF_SEARCH_DWELL_TIME_MS;
+                       break;
+               case P2P_SCAN_CONNECT_TRY:
+                       active_time = WL_SCAN_CONNECT_DWELL_TIME_MS;
+                       break;
+               default:
+                       active_time = wl_get_drv_status_all(cfg, CONNECTED) ?
+                               -1 : P2PAPI_SCAN_DWELL_TIME_MS;
+                       break;
+       }
+
+       if (p2p_scan_purpose == P2P_SCAN_CONNECT_TRY) {
+               nprobes = active_time /
+                       WL_SCAN_JOIN_PROBE_INTERVAL_MS;
+       } else {
+               nprobes = active_time /
+                       P2PAPI_SCAN_NPROBS_TIME_MS;
+       }
+
+       if (nprobes <= 0) {
+               nprobes = 1;
+       }
+
+       wl_escan_set_sync_id(sync_id, cfg);
+       /* Fill in the Scan structure that follows the P2P scan structure */
+       if (cfg->scan_params_v2) {
+               eparams_v2 = (wl_escan_params_v2_t*) (p2p_params + 1);
+               eparams_v2->version = htod16(ESCAN_REQ_VERSION_V2);
+               eparams_v2->action =  htod16(action);
+               eparams_v2->params.version = htod16(WL_SCAN_PARAMS_VERSION_V2);
+               eparams_v2->params.length = htod16(sizeof(wl_scan_params_v2_t));
+               eparams_v2->params.bss_type = DOT11_BSSTYPE_ANY;
+               eparams_v2->params.scan_type = htod32(scan_type);
+               (void)memcpy_s(&eparams_v2->params.bssid, ETHER_ADDR_LEN, mac_addr, ETHER_ADDR_LEN);
+               eparams_v2->params.home_time = htod32(P2PAPI_SCAN_HOME_TIME_MS);
+               eparams_v2->params.active_time = htod32(active_time);
+               eparams_v2->params.nprobes = htod32(nprobes);
+               eparams_v2->params.passive_time = htod32(-1);
+               eparams_v2->sync_id = sync_id;
+               for (i = 0; i < num_chans; i++) {
+                       eparams_v2->params.channel_list[i] =
+                               wl_chspec_host_to_driver(channels[i]);
+               }
+               eparams_v2->params.channel_num = htod32((0 << WL_SCAN_PARAMS_NSSID_SHIFT) |
+                       (num_chans & WL_SCAN_PARAMS_COUNT_MASK));
+               if (ssid.SSID_len)
+                       (void)memcpy_s(&eparams_v2->params.ssid,
+                                       sizeof(wlc_ssid_t), &ssid, sizeof(wlc_ssid_t));
+               sync_id = eparams_v2->sync_id;
+       } else {
+               eparams = (wl_escan_params_t*) (p2p_params + 1);
+               eparams->version = htod32(ESCAN_REQ_VERSION);
+               eparams->action =  htod16(action);
+               eparams->params.bss_type = DOT11_BSSTYPE_ANY;
+               eparams->params.scan_type = htod32(scan_type);
+               (void)memcpy_s(&eparams->params.bssid, ETHER_ADDR_LEN, mac_addr, ETHER_ADDR_LEN);
+               eparams->params.home_time = htod32(P2PAPI_SCAN_HOME_TIME_MS);
+               eparams->params.active_time = htod32(active_time);
+               eparams->params.nprobes = htod32(nprobes);
+               eparams->params.passive_time = htod32(-1);
+               eparams->sync_id = sync_id;
+               for (i = 0; i < num_chans; i++) {
+                       eparams->params.channel_list[i] =
+                               wl_chspec_host_to_driver(channels[i]);
+               }
+               eparams->params.channel_num = htod32((0 << WL_SCAN_PARAMS_NSSID_SHIFT) |
+                       (num_chans & WL_SCAN_PARAMS_COUNT_MASK));
+               if (ssid.SSID_len)
+                       (void)memcpy_s(&eparams->params.ssid,
+                                       sizeof(wlc_ssid_t), &ssid, sizeof(wlc_ssid_t));
+               sync_id = eparams->sync_id;
+       }
+
+       wl_escan_set_type(cfg, WL_SCANTYPE_P2P);
+
+       CFGP2P_DBG(("nprobes:%d active_time:%d\n", nprobes, active_time));
+       CFGP2P_DBG(("SCAN CHANNELS : "));
+       CFGP2P_DBG(("%d", channels[0]));
+       for (i = 1; i < num_chans; i++) {
+               CFGP2P_DBG((",%d", channels[i]));
+       }
+       CFGP2P_DBG(("\n"));
+
+       ret = wldev_iovar_setbuf_bsscfg(pri_dev, "p2p_scan",
+               memblk, memsize, cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+       WL_MSG(dev->name, "P2P_SEARCH sync ID: %d, bssidx: %d\n", sync_id, bssidx);
+       if (ret == BCME_OK) {
+               wl_set_p2p_status(cfg, SCANNING);
+       }
+       return ret;
+}
+
+/* search function to reach at common channel to send action frame
+ * Parameters:
+ * @cfg       : wl_private data
+ * @ndev     : net device for bssidx
+ * @bssidx   : bssidx for BSS
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_act_frm_search(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       s32 bssidx, s32 channel, struct ether_addr *tx_dst_addr)
+{
+       s32 ret = 0;
+       u32 chan_cnt = 0;
+       u16 *default_chan_list = NULL;
+       p2p_scan_purpose_t p2p_scan_purpose = P2P_SCAN_AFX_PEER_NORMAL;
+       if (!p2p_is_on(cfg) || ndev == NULL || bssidx == WL_INVALID)
+               return -EINVAL;
+       WL_TRACE_HW4((" Enter\n"));
+       if (bssidx == wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_PRIMARY))
+               bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+       if (channel)
+               chan_cnt = AF_PEER_SEARCH_CNT;
+       else
+               chan_cnt = SOCIAL_CHAN_CNT;
+
+       if (cfg->afx_hdl->pending_tx_act_frm && cfg->afx_hdl->is_active) {
+               wl_action_frame_t *action_frame;
+               action_frame = &(cfg->afx_hdl->pending_tx_act_frm->action_frame);
+               if (wl_cfgp2p_is_p2p_gas_action(action_frame->data, action_frame->len)) {
+                       chan_cnt = 1;
+                       p2p_scan_purpose = P2P_SCAN_AFX_PEER_REDUCED;
+               }
+       }
+
+       default_chan_list = (u16 *)MALLOCZ(cfg->osh, chan_cnt * sizeof(*default_chan_list));
+       if (default_chan_list == NULL) {
+               CFGP2P_ERR(("channel list allocation failed \n"));
+               ret = -ENOMEM;
+               goto exit;
+       }
+       if (channel) {
+               u32 i;
+               /* insert same channel to the chan_list */
+               for (i = 0; i < chan_cnt; i++) {
+                       default_chan_list[i] = channel;
+               }
+       } else {
+               default_chan_list[0] = wf_create_chspec_from_primary(SOCIAL_CHAN_1,
+                       WL_CHANSPEC_BW_20, WL_CHANSPEC_BAND_2G);
+               default_chan_list[1] = wf_create_chspec_from_primary(SOCIAL_CHAN_2,
+                       WL_CHANSPEC_BW_20, WL_CHANSPEC_BAND_2G);
+               default_chan_list[2] = wf_create_chspec_from_primary(SOCIAL_CHAN_3,
+                       WL_CHANSPEC_BW_20, WL_CHANSPEC_BAND_2G);
+       }
+       ret = wl_cfgp2p_escan(cfg, ndev, true, chan_cnt,
+               default_chan_list, WL_P2P_DISC_ST_SEARCH,
+               WL_SCAN_ACTION_START, bssidx, NULL, p2p_scan_purpose);
+       MFREE(cfg->osh, default_chan_list, chan_cnt * sizeof(*default_chan_list));
+exit:
+       return ret;
+}
+
+/* Check whether pointed-to IE looks like WPA. */
+#define wl_cfgp2p_is_wpa_ie(ie, tlvs, len)     wl_cfgp2p_has_ie(ie, tlvs, len, \
+               (const uint8 *)WPS_OUI, WPS_OUI_LEN, WPA_OUI_TYPE)
+/* Check whether pointed-to IE looks like WPS. */
+#define wl_cfgp2p_is_wps_ie(ie, tlvs, len)     wl_cfgp2p_has_ie(ie, tlvs, len, \
+               (const uint8 *)WPS_OUI, WPS_OUI_LEN, WPS_OUI_TYPE)
+/* Check whether the given IE looks like WFA P2P IE. */
+#define wl_cfgp2p_is_p2p_ie(ie, tlvs, len)     wl_cfgp2p_has_ie(ie, tlvs, len, \
+               (const uint8 *)WFA_OUI, WFA_OUI_LEN, WFA_OUI_TYPE_P2P)
+/* Check whether the given IE looks like WFA WFDisplay IE. */
+#ifndef WFA_OUI_TYPE_WFD
+#define WFA_OUI_TYPE_WFD       0x0a                    /* WiFi Display OUI TYPE */
+#endif
+#define wl_cfgp2p_is_wfd_ie(ie, tlvs, len)     wl_cfgp2p_has_ie(ie, tlvs, len, \
+               (const uint8 *)WFA_OUI, WFA_OUI_LEN, WFA_OUI_TYPE_WFD)
+
+/* Is any of the tlvs the expected entry? If
+ * not update the tlvs buffer pointer/length.
+ */
+static bool
+wl_cfgp2p_has_ie(const bcm_tlv_t *ie, const u8 **tlvs, u32 *tlvs_len,
+                 const u8 *oui, u32 oui_len, u8 type)
+{
+       /* If the contents match the OUI and the type */
+       if (ie->len >= oui_len + 1 &&
+           !bcmp(ie->data, oui, oui_len) &&
+           type == ie->data[oui_len]) {
+               return TRUE;
+       }
+
+       /* point to the next ie */
+       if (tlvs != NULL) {
+               bcm_tlv_buffer_advance_past(ie, tlvs, tlvs_len);
+       }
+
+       return FALSE;
+}
+
+const wpa_ie_fixed_t *
+wl_cfgp2p_find_wpaie(const u8 *parse, u32 len)
+{
+       const bcm_tlv_t *ie;
+
+       while ((ie = bcm_parse_tlvs(parse, len, DOT11_MNG_VS_ID))) {
+               if (wl_cfgp2p_is_wpa_ie(ie, &parse, &len)) {
+                       return (const wpa_ie_fixed_t *)ie;
+               }
+       }
+       return NULL;
+}
+
+const wpa_ie_fixed_t *
+wl_cfgp2p_find_wpsie(const u8 *parse, u32 len)
+{
+       const bcm_tlv_t *ie;
+
+       while ((ie = bcm_parse_tlvs(parse, len, DOT11_MNG_VS_ID))) {
+               if (wl_cfgp2p_is_wps_ie(ie, &parse, &len)) {
+                       return (const wpa_ie_fixed_t *)ie;
+               }
+       }
+       return NULL;
+}
+
+wifi_p2p_ie_t *
+wl_cfgp2p_find_p2pie(const u8 *parse, u32 len)
+{
+       bcm_tlv_t *ie;
+
+       while ((ie = bcm_parse_tlvs(parse, len, DOT11_MNG_VS_ID))) {
+               if (wl_cfgp2p_is_p2p_ie(ie, &parse, &len)) {
+                       return (wifi_p2p_ie_t *)ie;
+               }
+       }
+       return NULL;
+}
+
+const wifi_wfd_ie_t *
+wl_cfgp2p_find_wfdie(const u8 *parse, u32 len)
+{
+       const bcm_tlv_t *ie;
+
+       while ((ie = bcm_parse_tlvs(parse, len, DOT11_MNG_VS_ID))) {
+               if (wl_cfgp2p_is_wfd_ie(ie, &parse, &len)) {
+                       return (const wifi_wfd_ie_t *)ie;
+               }
+       }
+       return NULL;
+}
+
+u32
+wl_cfgp2p_vndr_ie(struct bcm_cfg80211 *cfg, u8 *iebuf, s32 pktflag,
+            s8 *oui, s32 ie_id, const s8 *data, s32 datalen, const s8* add_del_cmd)
+{
+       vndr_ie_setbuf_t hdr;   /* aligned temporary vndr_ie buffer header */
+       s32 iecount;
+       u32 data_offset;
+
+       /* Validate the pktflag parameter */
+       if ((pktflag & ~(VNDR_IE_BEACON_FLAG | VNDR_IE_PRBRSP_FLAG |
+                   VNDR_IE_ASSOCRSP_FLAG | VNDR_IE_AUTHRSP_FLAG |
+                   VNDR_IE_PRBREQ_FLAG | VNDR_IE_ASSOCREQ_FLAG |
+                   VNDR_IE_DISASSOC_FLAG))) {
+               CFGP2P_ERR(("p2pwl_vndr_ie: Invalid packet flag 0x%x\n", pktflag));
+               return -1;
+       }
+
+       /* Copy the vndr_ie SET command ("add"/"del") to the buffer */
+       strlcpy(hdr.cmd, add_del_cmd, sizeof(hdr.cmd));
+
+       /* Set the IE count - the buffer contains only 1 IE */
+       iecount = htod32(1);
+       memcpy((void *)&hdr.vndr_ie_buffer.iecount, &iecount, sizeof(s32));
+
+       /* For vendor ID DOT11_MNG_ID_EXT_ID, need to set pkt flag to VNDR_IE_CUSTOM_FLAG */
+       if (ie_id == DOT11_MNG_ID_EXT_ID) {
+               pktflag = pktflag | VNDR_IE_CUSTOM_FLAG;
+       }
+
+       /* Copy packet flags that indicate which packets will contain this IE */
+       pktflag = htod32(pktflag);
+       memcpy((void *)&hdr.vndr_ie_buffer.vndr_ie_list[0].pktflag, &pktflag,
+               sizeof(u32));
+
+       /* Add the IE ID to the buffer */
+       hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.id = ie_id;
+
+       /* Add the IE length to the buffer */
+       hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.len =
+               (uint8) VNDR_IE_MIN_LEN + datalen;
+
+       /* Add the IE OUI to the buffer */
+       hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui[0] = oui[0];
+       hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui[1] = oui[1];
+       hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui[2] = oui[2];
+
+       /* Copy the aligned temporary vndr_ie buffer header to the IE buffer */
+       memcpy(iebuf, &hdr, sizeof(hdr) - 1);
+
+       /* Copy the IE data to the IE buffer */
+       data_offset =
+               (u8*)&hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.data[0] -
+               (u8*)&hdr;
+       memcpy(iebuf + data_offset, data, datalen);
+       return data_offset + datalen;
+
+}
+
+struct net_device *
+wl_cfgp2p_find_ndev(struct bcm_cfg80211 *cfg, s32 bssidx)
+{
+       u32 i;
+       struct net_device *ndev = NULL;
+       if (bssidx < 0) {
+               CFGP2P_ERR((" bsscfg idx is invalid\n"));
+               goto exit;
+       }
+
+       for (i = 0; i < P2PAPI_BSSCFG_MAX; i++) {
+               if (bssidx == wl_to_p2p_bss_bssidx(cfg, i)) {
+                       ndev = wl_to_p2p_bss_ndev(cfg, i);
+                       break;
+               }
+       }
+
+exit:
+       return ndev;
+}
+/*
+ * Search the driver array idx based on bssidx argument
+ * Parameters: Note that this idx is applicable only
+ * for primary and P2P interfaces. The virtual AP/STA is not
+ * covered here.
+ * @cfg     : wl_private data
+ * @bssidx : bssidx which indicate bsscfg->idx of firmware.
+ * @type   : output arg to store array idx of p2p->bss.
+ * Returns error
+ */
+
+s32
+wl_cfgp2p_find_type(struct bcm_cfg80211 *cfg, s32 bssidx, s32 *type)
+{
+       u32 i;
+       if (bssidx < 0 || type == NULL) {
+               CFGP2P_ERR((" argument is invalid\n"));
+               goto exit;
+       }
+       if (!cfg->p2p) {
+               CFGP2P_ERR(("p2p if does not exist\n"));
+               goto exit;
+       }
+       for (i = 0; i < P2PAPI_BSSCFG_MAX; i++) {
+               if (bssidx == wl_to_p2p_bss_bssidx(cfg, i)) {
+                       *type = i;
+                       return BCME_OK;
+               }
+       }
+
+exit:
+       return BCME_BADARG;
+}
+
+/*
+ * Callback function for WLC_E_P2P_DISC_LISTEN_COMPLETE
+ */
+s32
+wl_cfgp2p_listen_complete(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 ret = BCME_OK;
+       struct net_device *ndev = NULL;
+
+       if (!cfg || !cfg->p2p || !cfgdev)
+               return BCME_ERROR;
+
+       CFGP2P_DBG((" Enter\n"));
+#ifdef DHD_IFDEBUG
+       PRINT_WDEV_INFO(cfgdev);
+#endif /* DHD_IFDEBUG */
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+#ifdef P2P_LISTEN_OFFLOADING
+       if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS)) {
+               wl_clr_p2p_status(cfg, DISC_IN_PROGRESS);
+               CFGP2P_ERR(("DISC_IN_PROGRESS cleared\n"));
+               if (ndev && (ndev->ieee80211_ptr != NULL)) {
+#if defined(WL_CFG80211_P2P_DEV_IF)
+                       if (cfgdev && ((struct wireless_dev *)cfgdev)->wiphy) {
+                               cfg80211_remain_on_channel_expired(cfgdev, cfg->last_roc_id,
+                                               &cfg->remain_on_chan, GFP_KERNEL);
+                       } else {
+                               CFGP2P_ERR(("Invalid cfgdev. Dropping the"
+                                               "remain_on_channel_expired event.\n"));
+                       }
+#else
+                       cfg80211_remain_on_channel_expired(cfgdev, cfg->last_roc_id,
+                                       &cfg->remain_on_chan, cfg->remain_on_chan_type, GFP_KERNEL);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+               }
+       }
+#endif /* P2P_LISTEN_OFFLOADING */
+
+       if (wl_get_p2p_status(cfg, LISTEN_EXPIRED) == 0) {
+               wl_set_p2p_status(cfg, LISTEN_EXPIRED);
+               if (timer_pending(&cfg->p2p->listen_timer)) {
+                       del_timer_sync(&cfg->p2p->listen_timer);
+               }
+
+               if (cfg->afx_hdl->is_listen == TRUE &&
+                       wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+                       WL_DBG(("Listen DONE for action frame\n"));
+                       complete(&cfg->act_frm_scan);
+               }
+#ifdef WL_CFG80211_SYNC_GON
+               else if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM_LISTEN)) {
+                       wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM_LISTEN, ndev);
+                       WL_DBG(("Listen DONE and wake up wait_next_af !!(%d)\n",
+                               jiffies_to_msecs(jiffies - cfg->af_tx_sent_jiffies)));
+
+                       if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM))
+                               wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, ndev);
+
+                       complete(&cfg->wait_next_af);
+               }
+#endif /* WL_CFG80211_SYNC_GON */
+
+#ifndef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+               if (wl_get_drv_status_all(cfg, REMAINING_ON_CHANNEL))
+#else
+               if (wl_get_drv_status_all(cfg, REMAINING_ON_CHANNEL) ||
+                       wl_get_drv_status_all(cfg, FAKE_REMAINING_ON_CHANNEL))
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+               {
+                       WL_DBG(("Listen DONE for remain on channel expired\n"));
+                       wl_clr_drv_status(cfg, REMAINING_ON_CHANNEL, ndev);
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+                       wl_clr_drv_status(cfg, FAKE_REMAINING_ON_CHANNEL, ndev);
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+                       if (ndev && (ndev->ieee80211_ptr != NULL)) {
+#if defined(WL_CFG80211_P2P_DEV_IF)
+                               if (cfgdev && ((struct wireless_dev *)cfgdev)->wiphy &&
+                                   bcmcfg_to_p2p_wdev(cfg)) {
+                                       /* JIRA:SWWLAN-81873. It may be invalid cfgdev. */
+                                       /*
+                                        * To prevent kernel panic,
+                                        * if cfgdev->wiphy may be invalid, adding explicit check
+                                        */
+                                       cfg80211_remain_on_channel_expired(bcmcfg_to_p2p_wdev(cfg),
+                                               cfg->last_roc_id, &cfg->remain_on_chan, GFP_KERNEL);
+                               } else
+                                       CFGP2P_ERR(("Invalid cfgdev. Dropping the"
+                                               "remain_on_channel_expired event.\n"));
+#else
+                               if (cfgdev && ((struct wireless_dev *)cfgdev)->wiphy)
+                                       cfg80211_remain_on_channel_expired(cfgdev,
+                                               cfg->last_roc_id, &cfg->remain_on_chan,
+                                               cfg->remain_on_chan_type, GFP_KERNEL);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+                       }
+               }
+               if (wl_add_remove_eventmsg(bcmcfg_to_prmry_ndev(cfg),
+                       WLC_E_P2P_PROBREQ_MSG, false) != BCME_OK) {
+                       CFGP2P_ERR((" failed to unset WLC_E_P2P_PROPREQ_MSG\n"));
+               }
+       } else
+               wl_clr_p2p_status(cfg, LISTEN_EXPIRED);
+
+       return ret;
+
+}
+
+/*
+ *  Timer expire callback function for LISTEN
+ *  We can't report cfg80211_remain_on_channel_expired from Timer ISR context,
+ *  so lets do it from thread context.
+ */
+void
+wl_cfgp2p_listen_expired(unsigned long data)
+{
+       wl_event_msg_t msg;
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *) data;
+       struct net_device *ndev;
+       CFGP2P_DBG((" Enter\n"));
+
+       if (!cfg) {
+               CFGP2P_ERR((" No cfg\n"));
+               return;
+       }
+       bzero(&msg, sizeof(wl_event_msg_t));
+       msg.event_type =  hton32(WLC_E_P2P_DISC_LISTEN_COMPLETE);
+       msg.bsscfgidx  =  wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+#if defined(WL_ENABLE_P2P_IF)
+       ndev = cfg->p2p_net ? cfg->p2p_net :
+               wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE);
+#else
+       ndev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE);
+#endif /* WL_ENABLE_P2P_IF */
+       if (!ndev) {
+               CFGP2P_ERR((" No ndev\n"));
+               return;
+       }
+       wl_cfg80211_event(ndev, &msg, NULL);
+}
+/*
+ *  Routine for cancelling the P2P LISTEN
+ */
+static s32
+wl_cfgp2p_cancel_listen(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+                         struct wireless_dev *wdev, bool notify)
+{
+       WL_DBG(("Enter \n"));
+       /* Irrespective of whether timer is running or not, reset
+        * the LISTEN state.
+        */
+#ifdef NOT_YET
+/* WAR : it is temporal workaround before resolving the root cause of kernel panic */
+       wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+               wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+#endif /* NOT_YET */
+       if (timer_pending(&cfg->p2p->listen_timer)) {
+               del_timer_sync(&cfg->p2p->listen_timer);
+               if (notify) {
+#if defined(WL_CFG80211_P2P_DEV_IF)
+                       if (bcmcfg_to_p2p_wdev(cfg))
+                               cfg80211_remain_on_channel_expired(wdev, cfg->last_roc_id,
+                                       &cfg->remain_on_chan, GFP_KERNEL);
+#else
+                       if (ndev && ndev->ieee80211_ptr)
+                               cfg80211_remain_on_channel_expired(ndev, cfg->last_roc_id,
+                                       &cfg->remain_on_chan, cfg->remain_on_chan_type, GFP_KERNEL);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+               }
+       }
+       return 0;
+}
+/*
+ * Do a P2P Listen on the given channel for the given duration.
+ * A listen consists of sitting idle and responding to P2P probe requests
+ * with a P2P probe response.
+ *
+ * This fn assumes dongle p2p device discovery is already enabled.
+ * Parameters   :
+ * @cfg          : wl_private data
+ * @channel     : channel to listen
+ * @duration_ms : the time (milli seconds) to wait
+ */
+s32
+wl_cfgp2p_discover_listen(struct bcm_cfg80211 *cfg, s32 channel, u32 duration_ms)
+{
+#define EXTRA_DELAY_TIME       100
+       s32 ret = BCME_OK;
+       timer_list_compat_t *_timer;
+       s32 extra_delay;
+       struct net_device *netdev = bcmcfg_to_prmry_ndev(cfg);
+
+       CFGP2P_DBG((" Enter Listen Channel : %d, Duration : %d\n", channel, duration_ms));
+       if (unlikely(wl_get_p2p_status(cfg, DISCOVERY_ON) == 0)) {
+               CFGP2P_ERR((" Discovery is not set, so we have noting to do\n"));
+               ret = BCME_NOTREADY;
+               goto exit;
+       }
+       if (timer_pending(&cfg->p2p->listen_timer)) {
+               CFGP2P_DBG(("previous LISTEN is not completed yet\n"));
+               goto exit;
+
+       }
+#ifndef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+       else
+               wl_clr_p2p_status(cfg, LISTEN_EXPIRED);
+#endif /* not WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+       if (wl_add_remove_eventmsg(netdev, WLC_E_P2P_PROBREQ_MSG, true) != BCME_OK) {
+                       CFGP2P_ERR((" failed to set WLC_E_P2P_PROPREQ_MSG\n"));
+       }
+
+       ret = wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_LISTEN, channel, (u16) duration_ms,
+                   wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+       _timer = &cfg->p2p->listen_timer;
+
+       /*  We will wait to receive WLC_E_P2P_DISC_LISTEN_COMPLETE from dongle ,
+        *  otherwise we will wait up to duration_ms + 100ms + duration / 10
+        */
+       if (ret == BCME_OK) {
+               extra_delay = EXTRA_DELAY_TIME + (duration_ms / 10);
+       } else {
+               /* if failed to set listen, it doesn't need to wait whole duration. */
+               duration_ms = 100 + duration_ms / 20;
+               extra_delay = 0;
+       }
+
+       INIT_TIMER(_timer, wl_cfgp2p_listen_expired, duration_ms, extra_delay);
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+       wl_clr_p2p_status(cfg, LISTEN_EXPIRED);
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+#undef EXTRA_DELAY_TIME
+exit:
+       return ret;
+}
+
+s32
+wl_cfgp2p_discover_enable_search(struct bcm_cfg80211 *cfg, u8 enable)
+{
+       s32 ret = BCME_OK;
+       CFGP2P_DBG((" Enter\n"));
+       if (!wl_get_p2p_status(cfg, DISCOVERY_ON)) {
+
+               CFGP2P_DBG((" do nothing, discovery is off\n"));
+               return ret;
+       }
+       if (wl_get_p2p_status(cfg, SEARCH_ENABLED) == enable) {
+               CFGP2P_DBG(("already : %d\n", enable));
+               return ret;
+       }
+
+       wl_chg_p2p_status(cfg, SEARCH_ENABLED);
+       /* When disabling Search, reset the WL driver's p2p discovery state to
+        * WL_P2P_DISC_ST_SCAN.
+        */
+       if (!enable) {
+               wl_clr_p2p_status(cfg, SCANNING);
+               ret = wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+                           wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+       }
+
+       return ret;
+}
+
+/*
+ * Callback function for WLC_E_ACTION_FRAME_COMPLETE, WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE
+ */
+s32
+wl_cfgp2p_action_tx_complete(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+            const wl_event_msg_t *e, void *data)
+{
+       s32 ret = BCME_OK;
+       u32 event_type = ntoh32(e->event_type);
+       u32 status = ntoh32(e->status);
+       struct net_device *ndev = NULL;
+       u8 bsscfgidx = e->bsscfgidx;
+
+       CFGP2P_DBG((" Enter\n"));
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+       if (wl_get_drv_status_all(cfg, SENDING_ACT_FRM)) {
+               if (event_type == WLC_E_ACTION_FRAME_COMPLETE) {
+
+                       CFGP2P_DBG((" WLC_E_ACTION_FRAME_COMPLETE is received : %d\n", status));
+                       if (status == WLC_E_STATUS_SUCCESS) {
+                               wl_set_p2p_status(cfg, ACTION_TX_COMPLETED);
+                               CFGP2P_ACTION(("TX AF: ACK. wait_rx:%d\n", cfg->need_wait_afrx));
+                               if (!cfg->need_wait_afrx && cfg->af_sent_channel) {
+                                       CFGP2P_DBG(("no need to wait next AF.\n"));
+                                       wl_stop_wait_next_action_frame(cfg, ndev, bsscfgidx);
+                               }
+                       }
+                       else if (!wl_get_p2p_status(cfg, ACTION_TX_COMPLETED)) {
+                               wl_set_p2p_status(cfg, ACTION_TX_NOACK);
+                               if (status == WLC_E_STATUS_SUPPRESS) {
+                                       CFGP2P_ACTION(("TX actfrm : SUPPRES\n"));
+                               } else {
+                                       CFGP2P_ACTION(("TX actfrm : NO ACK\n"));
+                               }
+                               /* if there is no ack, we don't need to wait for
+                                * WLC_E_ACTION_FRAME_OFFCHAN_COMPLETE event for ucast
+                                */
+                               if (cfg->afx_hdl && !ETHER_ISBCAST(&cfg->afx_hdl->tx_dst_addr)) {
+                                       wl_stop_wait_next_action_frame(cfg, ndev, bsscfgidx);
+                               }
+                       }
+               } else {
+                       CFGP2P_ACTION((" WLC_E_ACTION_FRAME_OFFCHAN_COMPLETE is received,"
+                                               "status : %d\n", status));
+
+                       if (wl_get_drv_status_all(cfg, SENDING_ACT_FRM))
+                               complete(&cfg->send_af_done);
+               }
+       }
+       return ret;
+}
+/* Send an action frame immediately without doing channel synchronization.
+ *
+ * This function does not wait for a completion event before returning.
+ * The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action
+ * frame is transmitted.
+ * The WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE event will be received when an
+ * 802.11 ack has been received for the sent action frame.
+ */
+s32
+wl_cfgp2p_tx_action_frame(struct bcm_cfg80211 *cfg, struct net_device *dev,
+       wl_af_params_t *af_params, s32 bssidx)
+{
+       s32 ret = BCME_OK;
+       s32 evt_ret = BCME_OK;
+       s32 timeout = 0;
+       wl_eventmsg_buf_t buf;
+
+       CFGP2P_DBG(("\n"));
+       CFGP2P_ACTION(("channel : %u , dwell time : %u wait_afrx:%d\n",
+           af_params->channel, af_params->dwell_time, cfg->need_wait_afrx));
+
+       wl_clr_p2p_status(cfg, ACTION_TX_COMPLETED);
+       wl_clr_p2p_status(cfg, ACTION_TX_NOACK);
+
+       bzero(&buf, sizeof(wl_eventmsg_buf_t));
+       wl_cfg80211_add_to_eventbuffer(&buf, WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE, true);
+       wl_cfg80211_add_to_eventbuffer(&buf, WLC_E_ACTION_FRAME_COMPLETE, true);
+       if ((evt_ret = wl_cfg80211_apply_eventbuffer(bcmcfg_to_prmry_ndev(cfg), cfg, &buf)) < 0)
+               return evt_ret;
+
+       cfg->af_sent_channel  = af_params->channel;
+       /* For older FW versions actframe does not support chanspec format */
+       if (cfg->wlc_ver.wlc_ver_major < FW_MAJOR_VER_ACTFRAME_CHSPEC) {
+               af_params->channel = CHSPEC_CHANNEL(af_params->channel);
+       }
+#ifdef WL_CFG80211_SYNC_GON
+       cfg->af_tx_sent_jiffies = jiffies;
+#endif /* WL_CFG80211_SYNC_GON */
+
+       ret = wldev_iovar_setbuf_bsscfg(dev, "actframe", af_params, sizeof(*af_params),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+
+       if (ret < 0) {
+               CFGP2P_ACTION(("TX actfrm : ERROR\n"));
+               goto exit;
+       }
+
+       timeout = wait_for_completion_timeout(&cfg->send_af_done,
+               msecs_to_jiffies(af_params->dwell_time + WL_AF_TX_EXTRA_TIME_MAX));
+
+       if (timeout >= 0 && wl_get_p2p_status(cfg, ACTION_TX_COMPLETED)) {
+               CFGP2P_DBG(("tx action frame operation is completed\n"));
+               ret = BCME_OK;
+       } else if (ETHER_ISBCAST(&cfg->afx_hdl->tx_dst_addr)) {
+               CFGP2P_DBG(("bcast tx action frame operation is completed\n"));
+               ret = BCME_OK;
+       } else {
+               ret = BCME_ERROR;
+               CFGP2P_DBG(("tx action frame operation is failed\n"));
+       }
+       /* clear status bit for action tx */
+       wl_clr_p2p_status(cfg, ACTION_TX_COMPLETED);
+       wl_clr_p2p_status(cfg, ACTION_TX_NOACK);
+
+exit:
+       CFGP2P_DBG((" via act frame iovar : status = %d\n", ret));
+
+       bzero(&buf, sizeof(wl_eventmsg_buf_t));
+       wl_cfg80211_add_to_eventbuffer(&buf, WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE, false);
+       wl_cfg80211_add_to_eventbuffer(&buf, WLC_E_ACTION_FRAME_COMPLETE, false);
+       if ((evt_ret = wl_cfg80211_apply_eventbuffer(bcmcfg_to_prmry_ndev(cfg), cfg, &buf)) < 0) {
+               WL_ERR(("TX frame events revert back failed \n"));
+               return evt_ret;
+       }
+
+       return ret;
+}
+
+/* Generate our P2P Device Address and P2P Interface Address from our primary
+ * MAC address.
+ */
+void
+wl_cfgp2p_generate_bss_mac(struct bcm_cfg80211 *cfg, struct ether_addr *primary_addr)
+{
+       struct ether_addr *mac_addr = wl_to_p2p_bss_macaddr(cfg, P2PAPI_BSSCFG_DEVICE);
+       struct ether_addr *int_addr;
+
+       if (ETHER_IS_LOCALADDR(primary_addr)) {
+               /* STA is using locally administered MAC. Use randomized mac
+                * for p2p  disc to avoid collision with sta mac add.
+                */
+               wl_cfg80211_generate_mac_addr(mac_addr);
+       } else {
+               memcpy(mac_addr, primary_addr, sizeof(struct ether_addr));
+               mac_addr->octet[0] |= 0x02;
+               WL_DBG(("P2P Discovery address:"MACDBG "\n", MAC2STRDBG(mac_addr->octet)));
+       }
+
+       int_addr = wl_to_p2p_bss_macaddr(cfg, P2PAPI_BSSCFG_CONNECTION1);
+       memcpy(int_addr, mac_addr, sizeof(struct ether_addr));
+       int_addr->octet[4] ^= 0x80;
+       WL_DBG(("Primary P2P Interface address:"MACDBG "\n", MAC2STRDBG(int_addr->octet)));
+
+       int_addr = wl_to_p2p_bss_macaddr(cfg, P2PAPI_BSSCFG_CONNECTION2);
+       memcpy(int_addr, mac_addr, sizeof(struct ether_addr));
+       int_addr->octet[4] ^= 0x90;
+}
+
+/* P2P IF Address change to Virtual Interface MAC Address */
+void
+wl_cfg80211_change_ifaddr(u8* buf, struct ether_addr *p2p_int_addr, u8 element_id)
+{
+       wifi_p2p_ie_t *ie = (wifi_p2p_ie_t*) buf;
+       u16 len = ie->len;
+       u8 *subel;
+       u8 subelt_id;
+       u16 subelt_len;
+       CFGP2P_DBG((" Enter\n"));
+
+       /* Point subel to the P2P IE's subelt field.
+        * Subtract the preceding fields (id, len, OUI, oui_type) from the length.
+        */
+       subel = ie->subelts;
+       len -= 4;       /* exclude OUI + OUI_TYPE */
+
+       while (len >= 3) {
+       /* attribute id */
+               subelt_id = *subel;
+               subel += 1;
+               len -= 1;
+
+               /* 2-byte little endian */
+               subelt_len = *subel++;
+               subelt_len |= *subel++ << 8;
+
+               len -= 2;
+               len -= subelt_len;      /* for the remaining subelt fields */
+
+               if (subelt_id == element_id) {
+                       if (subelt_id == P2P_SEID_INTINTADDR) {
+                               memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+                               CFGP2P_INFO(("Intended P2P Interface Address ATTR FOUND\n"));
+                       } else if (subelt_id == P2P_SEID_DEV_ID) {
+                               memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+                               CFGP2P_INFO(("Device ID ATTR FOUND\n"));
+                       } else if (subelt_id == P2P_SEID_DEV_INFO) {
+                               memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+                               CFGP2P_INFO(("Device INFO ATTR FOUND\n"));
+                       } else if (subelt_id == P2P_SEID_GROUP_ID) {
+                               memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+                               CFGP2P_INFO(("GROUP ID ATTR FOUND\n"));
+                       }                       return;
+               } else {
+                       CFGP2P_DBG(("OTHER id : %d\n", subelt_id));
+               }
+               subel += subelt_len;
+       }
+}
+
+s32
+wl_cfgp2p_supported(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       s32 ret = BCME_OK;
+       s32 p2p_supported = 0;
+       ret = wldev_iovar_getint(ndev, "p2p",
+                      &p2p_supported);
+       if (ret < 0) {
+               if (ret == BCME_UNSUPPORTED) {
+                       CFGP2P_INFO(("p2p is unsupported\n"));
+                       return 0;
+               } else {
+                       CFGP2P_ERR(("cfg p2p error %d\n", ret));
+                       return ret;
+               }
+       }
+       if (cfg->pub->conf->fw_type == FW_TYPE_MESH)
+               p2p_supported = 0;
+       if (p2p_supported == 1) {
+               CFGP2P_INFO(("p2p is supported\n"));
+       } else {
+               CFGP2P_INFO(("p2p is unsupported\n"));
+               p2p_supported = 0;
+       }
+       return p2p_supported;
+}
+
+/* Cleanup P2P resources */
+s32
+wl_cfgp2p_down(struct bcm_cfg80211 *cfg)
+{
+       struct net_device *ndev = NULL;
+       struct wireless_dev *wdev = NULL;
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       ndev = bcmcfg_to_prmry_ndev(cfg);
+       wdev = bcmcfg_to_p2p_wdev(cfg);
+#elif defined(WL_ENABLE_P2P_IF)
+       ndev = cfg->p2p_net ? cfg->p2p_net : bcmcfg_to_prmry_ndev(cfg);
+       wdev = ndev_to_wdev(ndev);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+       wl_cfgp2p_cancel_listen(cfg, ndev, wdev, TRUE);
+       wl_cfgp2p_disable_discovery(cfg);
+
+#if defined(WL_CFG80211_P2P_DEV_IF) && !defined(KEEP_WIFION_OPTION)
+/*
+ * In CUSTOMER_HW4 implementation "ifconfig wlan0 down" can get
+ * called during phone suspend and customer requires the p2p
+ * discovery interface to be left untouched so that the user
+ * space can resume without any problem.
+ */
+       if (cfg->p2p_wdev) {
+               /* If p2p wdev is left out, clean it up */
+               WL_ERR(("Clean up the p2p discovery IF\n"));
+               wl_cfgp2p_del_p2p_disc_if(cfg->p2p_wdev, cfg);
+       }
+#endif /* WL_CFG80211_P2P_DEV_IF !defined(KEEP_WIFION_OPTION) */
+
+       wl_cfgp2p_deinit_priv(cfg);
+       return 0;
+}
+
+int wl_cfgp2p_vif_created(struct bcm_cfg80211 *cfg)
+{
+       if (cfg->p2p && ((wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION1) != -1) ||
+               (wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION2) != -1)))
+               return true;
+       else
+               return false;
+
+}
+
+s32
+wl_cfgp2p_set_p2p_noa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len)
+{
+       s32 ret = -1;
+       int count, start, duration;
+       wl_p2p_sched_t dongle_noa;
+       s32 bssidx, type;
+       int iovar_len = sizeof(dongle_noa);
+       CFGP2P_DBG((" Enter\n"));
+
+       bzero(&dongle_noa, sizeof(dongle_noa));
+
+       if (wl_cfgp2p_vif_created(cfg)) {
+               cfg->p2p->noa.desc[0].start = 0;
+
+               sscanf(buf, "%10d %10d %10d", &count, &start, &duration);
+               CFGP2P_DBG(("set_p2p_noa count %d start %d duration %d\n",
+                       count, start, duration));
+               if (count != -1)
+                       cfg->p2p->noa.desc[0].count = count;
+
+               /* supplicant gives interval as start */
+               if (start != -1)
+                       cfg->p2p->noa.desc[0].interval = start;
+
+               if (duration != -1)
+                       cfg->p2p->noa.desc[0].duration = duration;
+
+               if (cfg->p2p->noa.desc[0].count != 255 && cfg->p2p->noa.desc[0].count != 0) {
+                       cfg->p2p->noa.desc[0].start = 200;
+                       dongle_noa.type = WL_P2P_SCHED_TYPE_REQ_ABS;
+                       dongle_noa.action = WL_P2P_SCHED_ACTION_GOOFF;
+                       dongle_noa.option = WL_P2P_SCHED_OPTION_TSFOFS;
+               }
+               else if (cfg->p2p->noa.desc[0].count == 0) {
+                       cfg->p2p->noa.desc[0].start = 0;
+                       dongle_noa.type = WL_P2P_SCHED_TYPE_ABS;
+                       dongle_noa.option = WL_P2P_SCHED_OPTION_NORMAL;
+                       dongle_noa.action = WL_P2P_SCHED_ACTION_RESET;
+               }
+               else {
+                       /* Continuous NoA interval. */
+                       dongle_noa.action = WL_P2P_SCHED_ACTION_DOZE;
+                       dongle_noa.type = WL_P2P_SCHED_TYPE_ABS;
+                       /* If the NoA interval is equal to the beacon interval, use
+                        * the percentage based NoA API to work-around driver issues
+                        * (PR #88043). Otherwise, use the absolute duration/interval API.
+                        */
+                       if ((cfg->p2p->noa.desc[0].interval == 102) ||
+                               (cfg->p2p->noa.desc[0].interval == 100)) {
+                               cfg->p2p->noa.desc[0].start = 100 -
+                                       cfg->p2p->noa.desc[0].duration;
+                               dongle_noa.option = WL_P2P_SCHED_OPTION_BCNPCT;
+                       }
+                       else {
+                               dongle_noa.option = WL_P2P_SCHED_OPTION_NORMAL;
+                       }
+               }
+               /* Put the noa descriptor in dongle format for dongle */
+               dongle_noa.desc[0].count = htod32(cfg->p2p->noa.desc[0].count);
+               if (dongle_noa.option == WL_P2P_SCHED_OPTION_BCNPCT) {
+                       dongle_noa.desc[0].start = htod32(cfg->p2p->noa.desc[0].start);
+                       dongle_noa.desc[0].duration = htod32(cfg->p2p->noa.desc[0].duration);
+               }
+               else {
+                       dongle_noa.desc[0].start = htod32(cfg->p2p->noa.desc[0].start*1000);
+                       dongle_noa.desc[0].duration = htod32(cfg->p2p->noa.desc[0].duration*1000);
+               }
+               dongle_noa.desc[0].interval = htod32(cfg->p2p->noa.desc[0].interval*1000);
+               bssidx = wl_get_bssidx_by_wdev(cfg, ndev->ieee80211_ptr);
+               if (wl_cfgp2p_find_type(cfg, bssidx, &type) != BCME_OK)
+                       return BCME_ERROR;
+
+               if (dongle_noa.action == WL_P2P_SCHED_ACTION_RESET) {
+                       iovar_len -= sizeof(wl_p2p_sched_desc_t);
+               }
+
+               ret = wldev_iovar_setbuf(wl_to_p2p_bss_ndev(cfg, type),
+                       "p2p_noa", &dongle_noa, iovar_len, cfg->ioctl_buf,
+                       WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+
+               if (ret < 0) {
+                       CFGP2P_ERR(("fw set p2p_noa failed %d\n", ret));
+               }
+       }
+       else {
+               CFGP2P_ERR(("ERROR: set_noa in non-p2p mode\n"));
+       }
+       return ret;
+}
+s32
+wl_cfgp2p_get_p2p_noa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int buf_len)
+{
+
+       wifi_p2p_noa_desc_t *noa_desc;
+       int len = 0, i;
+       char _buf[200];
+
+       CFGP2P_DBG((" Enter\n"));
+       buf[0] = '\0';
+       if (wl_cfgp2p_vif_created(cfg)) {
+               if (cfg->p2p->noa.desc[0].count || cfg->p2p->ops.ops) {
+                       _buf[0] = 1; /* noa index */
+                       _buf[1] = (cfg->p2p->ops.ops ? 0x80: 0) |
+                               (cfg->p2p->ops.ctw & 0x7f); /* ops + ctw */
+                       len += 2;
+                       if (cfg->p2p->noa.desc[0].count) {
+                               noa_desc = (wifi_p2p_noa_desc_t*)&_buf[len];
+                               noa_desc->cnt_type = cfg->p2p->noa.desc[0].count;
+                               noa_desc->duration = cfg->p2p->noa.desc[0].duration;
+                               noa_desc->interval = cfg->p2p->noa.desc[0].interval;
+                               noa_desc->start = cfg->p2p->noa.desc[0].start;
+                               len += sizeof(wifi_p2p_noa_desc_t);
+                       }
+                       if (buf_len <= len * 2) {
+                               CFGP2P_ERR(("ERROR: buf_len %d in not enough for"
+                                       "returning noa in string format\n", buf_len));
+                               return -1;
+                       }
+                       /* We have to convert the buffer data into ASCII strings */
+                       for (i = 0; i < len; i++) {
+                               snprintf(buf, 3, "%02x", _buf[i]);
+                               buf += 2;
+                       }
+                       buf[i*2] = '\0';
+               }
+       }
+       else {
+               CFGP2P_ERR(("ERROR: get_noa in non-p2p mode\n"));
+               return -1;
+       }
+       return len * 2;
+}
+s32
+wl_cfgp2p_set_p2p_ps(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len)
+{
+       int ps, ctw;
+       int ret = -1;
+       s32 legacy_ps;
+       s32 conn_idx;
+       s32 bssidx;
+       struct net_device *dev;
+
+       CFGP2P_DBG((" Enter\n"));
+       if (wl_cfgp2p_vif_created(cfg)) {
+               sscanf(buf, "%10d %10d %10d", &legacy_ps, &ps, &ctw);
+               CFGP2P_DBG((" Enter legacy_ps %d ps %d ctw %d\n", legacy_ps, ps, ctw));
+
+               bssidx = wl_get_bssidx_by_wdev(cfg, ndev->ieee80211_ptr);
+               if (wl_cfgp2p_find_type(cfg, bssidx, &conn_idx) != BCME_OK)
+                       return BCME_ERROR;
+               dev = wl_to_p2p_bss_ndev(cfg, conn_idx);
+               if (ctw != -1) {
+                       cfg->p2p->ops.ctw = ctw;
+                       ret = 0;
+               }
+               if (ps != -1) {
+                       cfg->p2p->ops.ops = ps;
+                       ret = wldev_iovar_setbuf(dev,
+                               "p2p_ops", &cfg->p2p->ops, sizeof(cfg->p2p->ops),
+                               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+                       if (ret < 0) {
+                               CFGP2P_ERR(("fw set p2p_ops failed %d\n", ret));
+                       }
+               }
+
+               if ((legacy_ps != -1) && ((legacy_ps == PM_MAX) || (legacy_ps == PM_OFF))) {
+                       ret = wldev_ioctl_set(dev,
+                               WLC_SET_PM, &legacy_ps, sizeof(legacy_ps));
+                       if (unlikely(ret))
+                               CFGP2P_ERR(("error (%d)\n", ret));
+                       wl_cfg80211_update_power_mode(dev);
+               }
+               else
+                       CFGP2P_ERR(("ilegal setting\n"));
+       }
+       else {
+               CFGP2P_ERR(("ERROR: set_p2p_ps in non-p2p mode\n"));
+               ret = -1;
+       }
+       return ret;
+}
+
+s32
+wl_cfgp2p_set_p2p_ecsa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len)
+{
+       int ch, bw;
+       s32 conn_idx;
+       s32 bssidx;
+       struct net_device *dev;
+       char smbuf[WLC_IOCTL_SMLEN];
+       wl_chan_switch_t csa_arg;
+       u32 chnsp = 0;
+       int err = 0;
+
+       CFGP2P_DBG((" Enter\n"));
+       if (wl_cfgp2p_vif_created(cfg)) {
+               sscanf(buf, "%10d %10d", &ch, &bw);
+               CFGP2P_DBG(("Enter ch %d bw %d\n", ch, bw));
+
+               bssidx = wl_get_bssidx_by_wdev(cfg, ndev->ieee80211_ptr);
+               if (wl_cfgp2p_find_type(cfg, bssidx, &conn_idx) != BCME_OK) {
+                       return BCME_ERROR;
+               }
+               dev = wl_to_p2p_bss_ndev(cfg, conn_idx);
+               if (ch <= 0 || bw <= 0) {
+                       CFGP2P_ERR(("Negative value not permitted!\n"));
+                       return BCME_ERROR;
+               }
+
+               memset_s(&csa_arg, sizeof(csa_arg), 0, sizeof(csa_arg));
+               csa_arg.mode = DOT11_CSA_MODE_ADVISORY;
+               csa_arg.count = P2P_ECSA_CNT;
+               csa_arg.reg = 0;
+
+               snprintf(buf, len, "%d/%d", ch, bw);
+               chnsp = wf_chspec_aton(buf);
+               if (chnsp == 0) {
+                       CFGP2P_ERR(("%s:chsp is not correct\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+               chnsp = wl_chspec_host_to_driver(chnsp);
+               csa_arg.chspec = chnsp;
+
+               err = wldev_iovar_setbuf(dev, "csa", &csa_arg, sizeof(csa_arg),
+                       smbuf, sizeof(smbuf), NULL);
+               if (err) {
+                       CFGP2P_ERR(("%s:set p2p_ecsa failed:%d\n", __FUNCTION__, err));
+                       return BCME_ERROR;
+               }
+       } else {
+               CFGP2P_ERR(("ERROR: set_p2p_ecsa in non-p2p mode\n"));
+               return BCME_ERROR;
+       }
+       return BCME_OK;
+}
+
+s32
+wl_cfgp2p_increase_p2p_bw(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len)
+{
+       int algo;
+       int bw;
+       int ret = BCME_OK;
+
+       sscanf(buf, "%3d", &bw);
+       if (bw == 0) {
+               algo = 0;
+               ret = wldev_iovar_setbuf(ndev, "mchan_algo", &algo, sizeof(algo), cfg->ioctl_buf,
+                               WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+               if (ret < 0) {
+                       CFGP2P_ERR(("fw set mchan_algo failed %d\n", ret));
+                       return BCME_ERROR;
+               }
+       } else {
+               algo = 1;
+               ret = wldev_iovar_setbuf(ndev, "mchan_algo", &algo, sizeof(algo), cfg->ioctl_buf,
+                               WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+               if (ret < 0) {
+                       CFGP2P_ERR(("fw set mchan_algo failed %d\n", ret));
+                       return BCME_ERROR;
+               }
+               ret = wldev_iovar_setbuf(ndev, "mchan_bw", &bw, sizeof(algo), cfg->ioctl_buf,
+                               WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+               if (ret < 0) {
+                       CFGP2P_ERR(("fw set mchan_bw failed %d\n", ret));
+                       return BCME_ERROR;
+               }
+       }
+       return BCME_OK;
+}
+
+const u8 *
+wl_cfgp2p_retreive_p2pattrib(const void *buf, u8 element_id)
+{
+       const wifi_p2p_ie_t *ie = NULL;
+       u16 len = 0;
+       const u8 *subel;
+       u8 subelt_id;
+       u16 subelt_len;
+
+       if (!buf) {
+               WL_ERR(("P2P IE not present"));
+               return 0;
+       }
+
+       ie = (const wifi_p2p_ie_t*) buf;
+       len = ie->len;
+
+       /* Point subel to the P2P IE's subelt field.
+        * Subtract the preceding fields (id, len, OUI, oui_type) from the length.
+        */
+       subel = ie->subelts;
+       len -= 4;       /* exclude OUI + OUI_TYPE */
+
+       while (len >= 3) {
+               /* attribute id */
+               subelt_id = *subel;
+               subel += 1;
+               len -= 1;
+
+               /* 2-byte little endian */
+               subelt_len = *subel++;
+               subelt_len |= *subel++ << 8;
+
+               len -= 2;
+               len -= subelt_len;      /* for the remaining subelt fields */
+
+               if (subelt_id == element_id) {
+                       /* This will point to start of subelement attrib after
+                        * attribute id & len
+                        */
+                       return subel;
+               }
+
+               /* Go to next subelement */
+               subel += subelt_len;
+       }
+
+       /* Not Found */
+       return NULL;
+}
+
+#define P2P_GROUP_CAPAB_GO_BIT 0x01
+
+const u8*
+wl_cfgp2p_find_attrib_in_all_p2p_Ies(const u8 *parse, u32 len, u32 attrib)
+{
+       bcm_tlv_t *ie;
+       const u8* pAttrib;
+       uint ie_len;
+
+       CFGP2P_DBG(("Starting parsing parse %p attrib %d remaining len %d ", parse, attrib, len));
+       ie_len = len;
+       while ((ie = bcm_parse_tlvs(parse, ie_len, DOT11_MNG_VS_ID))) {
+               if (wl_cfgp2p_is_p2p_ie(ie, &parse, &ie_len) == TRUE) {
+                       /* Have the P2p ie. Now check for attribute */
+                       if ((pAttrib = wl_cfgp2p_retreive_p2pattrib(ie, attrib)) != NULL) {
+                               CFGP2P_DBG(("P2P attribute %d was found at parse %p",
+                                       attrib, parse));
+                               return pAttrib;
+                       }
+                       else {
+                               /* move to next IE */
+                               bcm_tlv_buffer_advance_past(ie, &parse, &ie_len);
+
+                               CFGP2P_INFO(("P2P Attribute %d not found Moving parse"
+                                       " to %p len to %d", attrib, parse, ie_len));
+                       }
+               }
+               else {
+                       /* It was not p2p IE. parse will get updated automatically to next TLV */
+                       CFGP2P_INFO(("IT was NOT P2P IE parse %p len %d", parse, ie_len));
+               }
+       }
+       CFGP2P_ERR(("P2P attribute %d was NOT found", attrib));
+       return NULL;
+}
+
+const u8 *
+wl_cfgp2p_retreive_p2p_dev_addr(wl_bss_info_t *bi, u32 bi_length)
+{
+       const u8 *capability = NULL;
+       bool p2p_go     = 0;
+       const u8 *ptr = NULL;
+
+       if (bi->length != bi->ie_offset + bi->ie_length) {
+               return NULL;
+       }
+
+       if ((capability = wl_cfgp2p_find_attrib_in_all_p2p_Ies(((u8 *) bi) + bi->ie_offset,
+       bi->ie_length, P2P_SEID_P2P_INFO)) == NULL) {
+               WL_ERR(("P2P Capability attribute not found"));
+               return NULL;
+       }
+
+       /* Check Group capability for Group Owner bit */
+       p2p_go = capability[1] & P2P_GROUP_CAPAB_GO_BIT;
+       if (!p2p_go) {
+               return bi->BSSID.octet;
+       }
+
+       /* In probe responses, DEVICE INFO attribute will be present */
+       if (!(ptr = wl_cfgp2p_find_attrib_in_all_p2p_Ies(((u8 *) bi) + bi->ie_offset,
+       bi->ie_length,  P2P_SEID_DEV_INFO))) {
+               /* If DEVICE_INFO is not found, this might be a beacon frame.
+                * check for DEVICE_ID in the beacon frame.
+                */
+               ptr = wl_cfgp2p_find_attrib_in_all_p2p_Ies(((u8 *) bi) + bi->ie_offset,
+               bi->ie_length,  P2P_SEID_DEV_ID);
+       }
+
+       if (!ptr)
+               WL_ERR((" Both DEVICE_ID & DEVICE_INFO attribute not present in P2P IE "));
+
+       return ptr;
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+static void
+wl_cfgp2p_ethtool_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *info)
+{
+       /* to prevent kernel panic, add dummy value.
+        * some kernel calls drvinfo even if ethtool is not registered.
+        */
+       snprintf(info->driver, sizeof(info->driver), "p2p");
+       snprintf(info->version, sizeof(info->version), "%lu", (unsigned long)(0));
+}
+
+struct ethtool_ops cfgp2p_ethtool_ops = {
+       .get_drvinfo = wl_cfgp2p_ethtool_get_drvinfo
+};
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24) */
+
+#if defined(WL_ENABLE_P2P_IF) || defined(WL_NEWCFG_PRIVCMD_SUPPORT)
+s32
+wl_cfgp2p_register_ndev(struct bcm_cfg80211 *cfg)
+{
+       int ret = 0;
+       struct net_device* net = NULL;
+#ifndef        WL_NEWCFG_PRIVCMD_SUPPORT
+       struct wireless_dev *wdev = NULL;
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+       uint8 temp_addr[ETHER_ADDR_LEN] = { 0x00, 0x90, 0x4c, 0x33, 0x22, 0x11 };
+
+       if (cfg->p2p_net) {
+               CFGP2P_ERR(("p2p_net defined already.\n"));
+               return -EINVAL;
+       }
+
+       /* Allocate etherdev, including space for private structure */
+       if (!(net = alloc_etherdev(sizeof(struct bcm_cfg80211 *)))) {
+               CFGP2P_ERR(("%s: OOM - alloc_etherdev\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+#ifndef        WL_NEWCFG_PRIVCMD_SUPPORT
+       wdev = (struct wireless_dev *)MALLOCZ(cfg->osh, sizeof(*wdev));
+       if (unlikely(!wdev)) {
+               WL_ERR(("Could not allocate wireless device\n"));
+               free_netdev(net);
+               return -ENOMEM;
+       }
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+
+       strlcpy(net->name, "p2p%d", sizeof(net->name));
+
+       /* Copy the reference to bcm_cfg80211 */
+       memcpy((void *)netdev_priv(net), &cfg, sizeof(struct bcm_cfg80211 *));
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31))
+       ASSERT(!net->open);
+       net->do_ioctl = wl_cfgp2p_do_ioctl;
+       net->hard_start_xmit = wl_cfgp2p_start_xmit;
+       net->open = wl_cfgp2p_if_open;
+       net->stop = wl_cfgp2p_if_stop;
+#else
+       ASSERT(!net->netdev_ops);
+       net->netdev_ops = &wl_cfgp2p_if_ops;
+#endif
+
+       /* Register with a dummy MAC addr */
+       memcpy(net->dev_addr, temp_addr, ETHER_ADDR_LEN);
+
+#ifndef        WL_NEWCFG_PRIVCMD_SUPPORT
+       wdev->wiphy = cfg->wdev->wiphy;
+
+       wdev->iftype = wl_mode_to_nl80211_iftype(WL_MODE_BSS);
+
+       net->ieee80211_ptr = wdev;
+#else
+       net->ieee80211_ptr = NULL;
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+       net->ethtool_ops = &cfgp2p_ethtool_ops;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24) */
+
+#ifndef        WL_NEWCFG_PRIVCMD_SUPPORT
+       SET_NETDEV_DEV(net, wiphy_dev(wdev->wiphy));
+
+       /* Associate p2p0 network interface with new wdev */
+       wdev->netdev = net;
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+
+       ret = register_netdev(net);
+       if (ret) {
+               CFGP2P_ERR((" register_netdevice failed (%d)\n", ret));
+               free_netdev(net);
+#ifndef        WL_NEWCFG_PRIVCMD_SUPPORT
+               MFREE(cfg->osh, wdev, sizeof(*wdev));
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+               return -ENODEV;
+       }
+
+       /* store p2p net ptr for further reference. Note that iflist won't have this
+        * entry as there corresponding firmware interface is a "Hidden" interface.
+        */
+#ifndef        WL_NEWCFG_PRIVCMD_SUPPORT
+       cfg->p2p_wdev = wdev;
+#else
+       cfg->p2p_wdev = NULL;
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+       cfg->p2p_net = net;
+
+       WL_MSG(net->name, "P2P Interface Registered\n");
+
+       return ret;
+}
+
+s32
+wl_cfgp2p_unregister_ndev(struct bcm_cfg80211 *cfg)
+{
+
+       if (!cfg || !cfg->p2p_net) {
+               CFGP2P_ERR(("Invalid Ptr\n"));
+               return -EINVAL;
+       }
+
+       unregister_netdev(cfg->p2p_net);
+       free_netdev(cfg->p2p_net);
+
+       return 0;
+}
+static int wl_cfgp2p_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+{
+
+       if (skb)
+       {
+               CFGP2P_DBG(("(%s) is not used for data operations.Droping the packet.\n",
+                       ndev->name));
+               dev_kfree_skb_any(skb);
+       }
+
+       return 0;
+}
+
+static int wl_cfgp2p_do_ioctl(struct net_device *net, struct ifreq *ifr, int cmd)
+{
+       int ret = 0;
+       struct bcm_cfg80211 *cfg = *(struct bcm_cfg80211 **)netdev_priv(net);
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       /* There is no ifidx corresponding to p2p0 in our firmware. So we should
+        * not Handle any IOCTL cmds on p2p0 other than ANDROID PRIVATE CMDs.
+        * For Android PRIV CMD handling map it to primary I/F
+        */
+       if (cmd == SIOCDEVPRIVATE+1) {
+
+               ret = wl_android_priv_cmd(ndev, ifr);
+
+       } else {
+               CFGP2P_ERR(("%s: IOCTL req 0x%x on p2p0 I/F. Ignoring. \n",
+               __FUNCTION__, cmd));
+               return -1;
+       }
+
+       return ret;
+}
+#endif /* WL_ENABLE_P2P_IF || WL_NEWCFG_PRIVCMD_SUPPORT  */
+
+#if defined(WL_ENABLE_P2P_IF)
+static int wl_cfgp2p_if_open(struct net_device *net)
+{
+       struct wireless_dev *wdev = net->ieee80211_ptr;
+
+       if (!wdev || !wl_cfg80211_is_p2p_active(net))
+               return -EINVAL;
+       WL_TRACE(("Enter\n"));
+#if !defined(WL_IFACE_COMB_NUM_CHANNELS)
+       /* If suppose F/W download (ifconfig wlan0 up) hasn't been done by now,
+        * do it here. This will make sure that in concurrent mode, supplicant
+        * is not dependent on a particular order of interface initialization.
+        * i.e you may give wpa_supp -iwlan0 -N -ip2p0 or wpa_supp -ip2p0 -N
+        * -iwlan0.
+        */
+       wdev->wiphy->interface_modes |= (BIT(NL80211_IFTYPE_P2P_CLIENT)
+               | BIT(NL80211_IFTYPE_P2P_GO));
+#endif /* !WL_IFACE_COMB_NUM_CHANNELS */
+       wl_cfg80211_do_driver_init(net);
+
+       return 0;
+}
+
+static int wl_cfgp2p_if_stop(struct net_device *net)
+{
+       struct wireless_dev *wdev = net->ieee80211_ptr;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+
+       if (!wdev)
+               return -EINVAL;
+
+       wl_cfg80211_scan_stop(cfg, net);
+
+#if !defined(WL_IFACE_COMB_NUM_CHANNELS)
+       wdev->wiphy->interface_modes = (wdev->wiphy->interface_modes)
+                                       & (~(BIT(NL80211_IFTYPE_P2P_CLIENT)|
+                                       BIT(NL80211_IFTYPE_P2P_GO)));
+#endif /* !WL_IFACE_COMB_NUM_CHANNELS */
+       return 0;
+}
+
+bool wl_cfgp2p_is_ifops(const struct net_device_ops *if_ops)
+{
+       return (if_ops == &wl_cfgp2p_if_ops);
+}
+#endif /* WL_ENABLE_P2P_IF */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+struct wireless_dev *
+wl_cfgp2p_add_p2p_disc_if(struct bcm_cfg80211 *cfg)
+{
+       struct wireless_dev *wdev = NULL;
+
+       if (!cfg || !cfg->p2p_supported)
+               return ERR_PTR(-EINVAL);
+
+       WL_TRACE(("Enter\n"));
+
+       if (cfg->p2p_wdev) {
+#ifndef EXPLICIT_DISCIF_CLEANUP
+               dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+#endif /* EXPLICIT_DISCIF_CLEANUP */
+               /*
+                * This is not expected. This can happen due to
+                * supplicant crash/unclean de-initialization which
+                * didn't free the p2p discovery interface. Indicate
+                * driver hang to user space so that the framework
+                * can rei-init the Wi-Fi.
+                */
+               CFGP2P_ERR(("p2p_wdev defined already.\n"));
+               wl_probe_wdev_all(cfg);
+#ifdef EXPLICIT_DISCIF_CLEANUP
+               /*
+                * CUSTOMER_HW4 design doesn't delete the p2p discovery
+                * interface on ifconfig wlan0 down context which comes
+                * without a preceeding NL80211_CMD_DEL_INTERFACE for p2p
+                * discovery. But during supplicant crash the DEL_IFACE
+                * command will not happen and will cause a left over iface
+                * even after ifconfig wlan0 down. So delete the iface
+                * first and then indicate the HANG event
+                */
+               wl_cfgp2p_del_p2p_disc_if(cfg->p2p_wdev, cfg);
+#else
+               dhd->hang_reason = HANG_REASON_IFACE_DEL_FAILURE;
+
+#if defined(BCMPCIE) && defined(DHD_FW_COREDUMP)
+               if (dhd->memdump_enabled) {
+                       /* Load the dongle side dump to host
+                        * memory and then BUG_ON()
+                        */
+                       dhd->memdump_type = DUMP_TYPE_IFACE_OP_FAILURE;
+                       dhd_bus_mem_dump(dhd);
+               }
+#endif /* BCMPCIE && DHD_FW_COREDUMP */
+               net_os_send_hang_message(bcmcfg_to_prmry_ndev(cfg));
+
+               return ERR_PTR(-ENODEV);
+#endif /* EXPLICIT_DISCIF_CLEANUP */
+       }
+
+       wdev = (struct wireless_dev *)MALLOCZ(cfg->osh, sizeof(*wdev));
+       if (unlikely(!wdev)) {
+               WL_ERR(("Could not allocate wireless device\n"));
+               return ERR_PTR(-ENOMEM);
+       }
+
+       wdev->wiphy = cfg->wdev->wiphy;
+       wdev->iftype = NL80211_IFTYPE_P2P_DEVICE;
+       memcpy(wdev->address, wl_to_p2p_bss_macaddr(cfg, P2PAPI_BSSCFG_DEVICE), ETHER_ADDR_LEN);
+
+#if defined(WL_NEWCFG_PRIVCMD_SUPPORT)
+       if (cfg->p2p_net)
+               memcpy(cfg->p2p_net->dev_addr, wl_to_p2p_bss_macaddr(cfg, P2PAPI_BSSCFG_DEVICE),
+                       ETHER_ADDR_LEN);
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+
+       /* store p2p wdev ptr for further reference. */
+       cfg->p2p_wdev = wdev;
+
+       printf("P2P interface registered\n");
+       printf("%s: wdev: %p, wdev->net: %p\n", __FUNCTION__, wdev, wdev->netdev);
+       return wdev;
+}
+
+int
+wl_cfgp2p_start_p2p_device(struct wiphy *wiphy, struct wireless_dev *wdev)
+{
+       int ret = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+       if (!cfg)
+               return -EINVAL;
+
+       WL_TRACE(("Enter\n"));
+
+       ret = wl_cfgp2p_set_firm_p2p(cfg);
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR(("Set P2P in firmware failed, ret=%d\n", ret));
+               goto exit;
+       }
+
+       ret = wl_cfgp2p_enable_discovery(cfg, bcmcfg_to_prmry_ndev(cfg), NULL, 0);
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR(("P2P enable discovery failed, ret=%d\n", ret));
+               goto exit;
+       }
+
+       p2p_on(cfg) = true;
+#if defined(P2P_IE_MISSING_FIX)
+       cfg->p2p_prb_noti = false;
+#endif
+
+       CFGP2P_DBG(("P2P interface started\n"));
+
+exit:
+       return ret;
+}
+
+void
+wl_cfgp2p_stop_p2p_device(struct wiphy *wiphy, struct wireless_dev *wdev)
+{
+       int ret = 0;
+       struct net_device *ndev = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+       if (!cfg)
+               return;
+
+       CFGP2P_DBG(("Enter\n"));
+
+       /* Check if cfg80211 interface is already down */
+       ndev = bcmcfg_to_prmry_ndev(cfg);
+       if (!wl_get_drv_status(cfg, READY, ndev)) {
+               WL_DBG(("cfg80211 interface is already down\n"));
+               return; /* it is even not ready */
+       }
+
+       ret = wl_cfg80211_scan_stop(cfg, wdev);
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR(("P2P scan stop failed, ret=%d\n", ret));
+       }
+
+       if (!p2p_is_on(cfg)) {
+               return;
+       }
+
+#ifdef P2P_LISTEN_OFFLOADING
+       wl_cfg80211_p2plo_deinit(cfg);
+#endif /* P2P_LISTEN_OFFLOADING */
+
+       /* Cancel any on-going listen */
+       wl_cfgp2p_cancel_listen(cfg, bcmcfg_to_prmry_ndev(cfg), wdev, TRUE);
+
+       ret = wl_cfgp2p_disable_discovery(cfg);
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR(("P2P disable discovery failed, ret=%d\n", ret));
+       }
+
+       p2p_on(cfg) = false;
+
+       CFGP2P_DBG(("Exit. P2P interface stopped\n"));
+
+       return;
+}
+
+int
+wl_cfgp2p_del_p2p_disc_if(struct wireless_dev *wdev, struct bcm_cfg80211 *cfg)
+{
+       bool rollback_lock = false;
+
+       if (!wdev || !cfg) {
+               WL_ERR(("wdev or cfg is NULL\n"));
+               return -EINVAL;
+       }
+
+       WL_INFORM(("Enter\n"));
+
+       if (!cfg->p2p_wdev) {
+               WL_ERR(("Already deleted p2p_wdev\n"));
+               return -EINVAL;
+       }
+
+       /* Ensure discovery i/f is deinitialized */
+       if (wl_cfgp2p_disable_discovery(cfg) != BCME_OK) {
+               /* discard error in the deinit part. Fw state
+                * recovery would happen from wl down/reset
+                * context.
+                */
+               CFGP2P_ERR(("p2p disable disc failed\n"));
+       }
+
+       if (!rtnl_is_locked()) {
+               rtnl_lock();
+               rollback_lock = true;
+       }
+
+       cfg80211_unregister_wdev(wdev);
+
+       if (rollback_lock)
+               rtnl_unlock();
+
+       synchronize_rcu();
+
+       MFREE(cfg->osh, wdev, sizeof(*wdev));
+
+       cfg->p2p_wdev = NULL;
+
+       CFGP2P_ERR(("P2P interface unregistered\n"));
+
+       return 0;
+}
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+void
+wl_cfgp2p_need_wait_actfrmae(struct bcm_cfg80211 *cfg, void *frame, u32 frame_len, bool tx)
+{
+       wifi_p2p_pub_act_frame_t *pact_frm;
+       int status = 0;
+
+       if (!frame || (frame_len < (sizeof(*pact_frm) + WL_P2P_AF_STATUS_OFFSET - 1))) {
+               return;
+       }
+
+       if (wl_cfgp2p_is_pub_action(frame, frame_len)) {
+               pact_frm = (wifi_p2p_pub_act_frame_t *)frame;
+               if (pact_frm->subtype == P2P_PAF_GON_RSP && tx) {
+                       CFGP2P_ACTION(("Check TX P2P Group Owner Negotiation Rsp Frame status\n"));
+                       status = pact_frm->elts[WL_P2P_AF_STATUS_OFFSET];
+                       if (status) {
+                               cfg->need_wait_afrx = false;
+                               return;
+                       }
+               }
+       }
+
+       cfg->need_wait_afrx = true;
+       return;
+}
+
+int
+wl_cfgp2p_is_p2p_specific_scan(struct cfg80211_scan_request *request)
+{
+       if (request && (request->n_ssids == 1) &&
+               (request->n_channels == 1) &&
+               IS_P2P_SSID(request->ssids[0].ssid, WL_P2P_WILDCARD_SSID_LEN) &&
+               (request->ssids[0].ssid_len > WL_P2P_WILDCARD_SSID_LEN)) {
+               return true;
+       }
+       return false;
+}
diff --git a/bcmdhd.101.10.240.x/wl_cfgp2p.h b/bcmdhd.101.10.240.x/wl_cfgp2p.h
new file mode 100644 (file)
index 0000000..cdaf437
--- /dev/null
@@ -0,0 +1,471 @@
+/*
+ * Linux cfgp2p driver
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+#ifndef _wl_cfgp2p_h_
+#define _wl_cfgp2p_h_
+#include <802.11.h>
+#include <p2p.h>
+
+struct bcm_cfg80211;
+extern u32 wl_dbg_level;
+
+typedef struct wifi_p2p_ie wifi_wfd_ie_t;
+/* Enumeration of the usages of the BSSCFGs used by the P2P Library.  Do not
+ * confuse this with a bsscfg index.  This value is an index into the
+ * saved_ie[] array of structures which in turn contains a bsscfg index field.
+ */
+typedef enum {
+       P2PAPI_BSSCFG_PRIMARY, /**< maps to driver's primary bsscfg */
+       P2PAPI_BSSCFG_DEVICE, /**< maps to driver's P2P device discovery bsscfg */
+       P2PAPI_BSSCFG_CONNECTION1, /**< maps to driver's P2P connection bsscfg */
+       P2PAPI_BSSCFG_CONNECTION2,
+       P2PAPI_BSSCFG_MAX
+} p2p_bsscfg_type_t;
+
+typedef enum {
+       P2P_SCAN_PURPOSE_MIN,
+       P2P_SCAN_SOCIAL_CHANNEL, /**< scan for social channel */
+       P2P_SCAN_AFX_PEER_NORMAL, /**< scan for action frame search */
+       P2P_SCAN_AFX_PEER_REDUCED, /**< scan for action frame search with short time */
+       P2P_SCAN_DURING_CONNECTED, /**< scan during connected status */
+       P2P_SCAN_CONNECT_TRY, /**< scan for connecting */
+       P2P_SCAN_NORMAL, /**< scan during not-connected status */
+       P2P_SCAN_PURPOSE_MAX
+} p2p_scan_purpose_t;
+
+/** vendor ies max buffer length for probe response or beacon */
+#define VNDR_IES_MAX_BUF_LEN   1400
+/** normal vendor ies buffer length */
+#define VNDR_IES_BUF_LEN               512
+
+struct p2p_bss {
+       s32 bssidx;
+       struct net_device *dev;
+       void *private_data;
+       struct ether_addr mac_addr;
+};
+
+struct p2p_info {
+       bool on;    /**< p2p on/off switch */
+       bool scan;
+       int16 search_state;
+       s8 vir_ifname[IFNAMSIZ];
+       unsigned long status;
+       struct p2p_bss bss[P2PAPI_BSSCFG_MAX];
+       timer_list_compat_t listen_timer;
+       wl_p2p_sched_t noa;
+       wl_p2p_ops_t ops;
+       wlc_ssid_t ssid;
+       s8 p2p_go_count;
+};
+
+#define MAX_VNDR_IE_NUMBER     10
+
+struct parsed_vndr_ie_info {
+       const char *ie_ptr;
+       u32 ie_len;     /**< total length including id & length field */
+       vndr_ie_t vndrie;
+};
+
+struct parsed_vndr_ies {
+       u32 count;
+       struct parsed_vndr_ie_info ie_info[MAX_VNDR_IE_NUMBER];
+};
+
+/* dongle status */
+enum wl_cfgp2p_status {
+       WLP2P_STATUS_DISCOVERY_ON = 0,
+       WLP2P_STATUS_SEARCH_ENABLED,
+       WLP2P_STATUS_IF_ADDING,
+       WLP2P_STATUS_IF_DELETING,
+       WLP2P_STATUS_IF_CHANGING,
+       WLP2P_STATUS_IF_CHANGED,
+       WLP2P_STATUS_LISTEN_EXPIRED,
+       WLP2P_STATUS_ACTION_TX_COMPLETED,
+       WLP2P_STATUS_ACTION_TX_NOACK,
+       WLP2P_STATUS_SCANNING,
+       WLP2P_STATUS_GO_NEG_PHASE,
+       WLP2P_STATUS_DISC_IN_PROGRESS
+};
+
+#define wl_to_p2p_bss_ndev(cfg, type)          ((cfg)->p2p->bss[type].dev)
+#define wl_to_p2p_bss_bssidx(cfg, type)                ((cfg)->p2p->bss[type].bssidx)
+#define wl_to_p2p_bss_macaddr(cfg, type)     &((cfg)->p2p->bss[type].mac_addr)
+#define wl_to_p2p_bss_saved_ie(cfg, type)      ((cfg)->p2p->bss[type].saved_ie)
+#define wl_to_p2p_bss_private(cfg, type)               ((cfg)->p2p->bss[type].private_data)
+#define wl_to_p2p_bss(cfg, type)                       ((cfg)->p2p->bss[type])
+#define wl_get_p2p_status(cfg, stat) ((!(cfg)->p2p_supported) ? 0 : \
+               test_bit(WLP2P_STATUS_ ## stat, &(cfg)->p2p->status))
+#define wl_set_p2p_status(cfg, stat) ((!(cfg)->p2p_supported) ? 0 : \
+               set_bit(WLP2P_STATUS_ ## stat, &(cfg)->p2p->status))
+#define wl_clr_p2p_status(cfg, stat) ((!(cfg)->p2p_supported) ? 0 : \
+               clear_bit(WLP2P_STATUS_ ## stat, &(cfg)->p2p->status))
+#define wl_chg_p2p_status(cfg, stat) ((!(cfg)->p2p_supported) ? 0 : \
+       change_bit(WLP2P_STATUS_ ## stat, &(cfg)->p2p->status))
+#define p2p_on(cfg) ((cfg)->p2p->on)
+#define p2p_scan(cfg) ((cfg)->p2p->scan)
+#define p2p_is_on(cfg) ((cfg)->p2p && (cfg)->p2p->on)
+
+/* dword align allocation */
+#define WLC_IOCTL_MAXLEN 8192
+
+#ifdef CUSTOMER_HW4_DEBUG
+#define CFGP2P_ERROR_TEXT              "[dhd] CFGP2P-INFO2) "
+#else
+#define CFGP2P_ERROR_TEXT              "[dhd] CFGP2P-ERROR) "
+#endif /* CUSTOMER_HW4_DEBUG */
+
+#ifdef DHD_LOG_DUMP
+#define        CFGP2P_ERR_MSG(x, args...)      \
+       do {    \
+               if (wl_dbg_level & WL_DBG_ERR) {        \
+                       printk(KERN_INFO CFGP2P_ERROR_TEXT "%s : " x, __func__, ## args);       \
+                       DHD_LOG_DUMP_WRITE("[%s] %s: ", dhd_log_dump_get_timestamp(), __func__);        \
+                       DHD_LOG_DUMP_WRITE(x, ## args); \
+               }       \
+       } while (0)
+#define CFGP2P_ERR(x) CFGP2P_ERR_MSG x
+#define        CFGP2P_INFO_MSG(x, args...)                                                                     \
+       do {                                                                            \
+               if (wl_dbg_level & WL_DBG_INFO) {                               \
+                       printk(KERN_INFO "[dhd] CFGP2P-INFO) %s : " x, __func__, ## args);      \
+                       DHD_LOG_DUMP_WRITE("[%s] %s: ", dhd_log_dump_get_timestamp(), __func__);        \
+                       DHD_LOG_DUMP_WRITE(x, ## args); \
+               }                                                                       \
+       } while (0)
+#define CFGP2P_INFO(x) CFGP2P_INFO_MSG x
+#define        CFGP2P_ACTION_MSG(x, args...)                                                           \
+       do {                                                                    \
+               if (wl_dbg_level & WL_DBG_P2P_ACTION) {                 \
+                       printk(KERN_INFO "[dhd] CFGP2P-ACTION) %s :" x, __func__, ## args);     \
+                       DHD_LOG_DUMP_WRITE("[%s] %s: ", dhd_log_dump_get_timestamp(), __func__);        \
+                       DHD_LOG_DUMP_WRITE(x, ## args); \
+               }                                                                       \
+       } while (0)
+#define CFGP2P_ACTION(x) CFGP2P_ACTION_MSG x
+#else
+#define CFGP2P_ERR_MSG(x, args...)                                                                     \
+       do {                                                                            \
+               if (wl_dbg_level & WL_DBG_ERR) {                                \
+                       printk(KERN_INFO CFGP2P_ERROR_TEXT "%s : " x, __func__, ## args);       \
+               }                                                                       \
+       } while (0)
+#define CFGP2P_ERR(x) CFGP2P_ERR_MSG x
+#define        CFGP2P_INFO_MSG(x, args...)                                                                     \
+       do {                                                                            \
+               if (wl_dbg_level & WL_DBG_INFO) {                               \
+                       printk(KERN_INFO "[dhd] CFGP2P-INFO) %s : " x, __func__, ## args);      \
+               }                                                                       \
+       } while (0)
+#define CFGP2P_INFO(x) CFGP2P_INFO_MSG x
+#define        CFGP2P_ACTION_MSG(x, args...)                                                           \
+       do {                                                                    \
+               if (wl_dbg_level & WL_DBG_P2P_ACTION) {                 \
+                       printk(KERN_INFO "[dhd] CFGP2P-ACTION) %s :" x, __func__, ## args);     \
+               }                                                                       \
+       } while (0)
+#define CFGP2P_ACTION(x) CFGP2P_ACTION_MSG x
+#endif /* DHD_LOG_DUMP */
+
+#define        CFGP2P_DBG_MSG(x, args...)                                                              \
+       do {                                                                    \
+               if (wl_dbg_level & WL_DBG_DBG) {                        \
+                       printk(KERN_INFO "[dhd] CFGP2P-DEBUG) %s :" x, __func__, ## args);      \
+               }                                                                       \
+       } while (0)
+#define CFGP2P_DBG(x) CFGP2P_DBG_MSG x
+
+#define INIT_TIMER(timer, func, duration, extra_delay) \
+       do {                               \
+               init_timer_compat(timer, func, cfg); \
+               timer_expires(timer) = jiffies + msecs_to_jiffies(duration + extra_delay); \
+               add_timer(timer); \
+       } while (0);
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3, 0, 8))
+#ifdef WL_SUPPORT_BACKPORTED_KPATCHES
+#undef WL_SUPPORT_BACKPORTED_KPATCHES
+#endif
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 2, 0))
+#ifdef WL_CFG80211_STA_EVENT
+#undef WL_CFG80211_STA_EVENT
+#endif
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)) && !defined(WL_CFG80211_P2P_DEV_IF)
+#define WL_CFG80211_P2P_DEV_IF
+
+#ifdef WL_ENABLE_P2P_IF
+#undef WL_ENABLE_P2P_IF
+#endif
+
+#ifdef WL_SUPPORT_BACKPORTED_KPATCHES
+#undef WL_SUPPORT_BACKPORTED_KPATCHES
+#endif
+#else
+#ifdef WLP2P
+#ifndef WL_ENABLE_P2P_IF
+/* Enable P2P network Interface if P2P support is enabled */
+#define WL_ENABLE_P2P_IF
+#endif /* WL_ENABLE_P2P_IF */
+#endif /* WLP2P */
+#endif /* (LINUX_VERSION >= VERSION(3, 8, 0)) */
+
+#ifndef WL_CFG80211_P2P_DEV_IF
+#ifdef WL_NEWCFG_PRIVCMD_SUPPORT
+#undef WL_NEWCFG_PRIVCMD_SUPPORT
+#endif
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#if defined(WL_ENABLE_P2P_IF) && (defined(WL_CFG80211_P2P_DEV_IF) || \
+       (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)))
+#error Disable 'WL_ENABLE_P2P_IF', if 'WL_CFG80211_P2P_DEV_IF' is enabled \
+       or kernel version is 3.8.0 or above
+#endif /* WL_ENABLE_P2P_IF && (WL_CFG80211_P2P_DEV_IF || (LINUX_VERSION >= VERSION(3, 8, 0))) */
+
+#if !defined(WLP2P) && (defined(WL_ENABLE_P2P_IF) || defined(WL_CFG80211_P2P_DEV_IF))
+#error WLP2P not defined
+#endif /* !WLP2P && (WL_ENABLE_P2P_IF || WL_CFG80211_P2P_DEV_IF) */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+#define bcm_struct_cfgdev      struct wireless_dev
+#else
+#define bcm_struct_cfgdev      struct net_device
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+/* If we take 10 or 30 as count value, operation
+ * may failed due to full scan and noisy environments.
+ * So, we choose 50 as the optimum value for P2P ECSA.
+ */
+#define P2P_ECSA_CNT 50
+
+extern void
+wl_cfgp2p_listen_expired(unsigned long data);
+extern bool
+wl_cfgp2p_is_pub_action(void *frame, u32 frame_len);
+extern bool
+wl_cfgp2p_is_p2p_action(void *frame, u32 frame_len);
+extern bool
+wl_cfgp2p_is_gas_action(void *frame, u32 frame_len);
+extern bool
+wl_cfgp2p_is_p2p_gas_action(void *frame, u32 frame_len);
+extern void
+wl_cfgp2p_print_actframe(bool tx, void *frame, u32 frame_len, u32 channel);
+extern s32
+wl_cfgp2p_init_priv(struct bcm_cfg80211 *cfg);
+extern void
+wl_cfgp2p_deinit_priv(struct bcm_cfg80211 *cfg);
+extern s32
+wl_cfgp2p_set_firm_p2p(struct bcm_cfg80211 *cfg);
+extern s32
+wl_cfgp2p_set_p2p_mode(struct bcm_cfg80211 *cfg, u8 mode,
+            u32 channel, u16 listen_ms, int bssidx);
+extern s32
+wl_cfgp2p_ifadd(struct bcm_cfg80211 *cfg, struct ether_addr *mac, u8 if_type,
+            chanspec_t chspec);
+extern s32
+wl_cfgp2p_ifdisable(struct bcm_cfg80211 *cfg, struct ether_addr *mac);
+extern s32
+wl_cfgp2p_ifdel(struct bcm_cfg80211 *cfg, struct ether_addr *mac);
+extern s32
+wl_cfgp2p_ifchange(struct bcm_cfg80211 *cfg, struct ether_addr *mac, u8 if_type,
+       chanspec_t chspec, s32 conn_idx);
+
+extern s32
+wl_cfgp2p_ifidx(struct bcm_cfg80211 *cfg, struct ether_addr *mac, s32 *index);
+
+extern s32
+wl_cfgp2p_init_discovery(struct bcm_cfg80211 *cfg);
+extern s32
+wl_cfgp2p_enable_discovery(struct bcm_cfg80211 *cfg, struct net_device *dev, const u8 *ie,
+       u32 ie_len);
+extern s32
+wl_cfgp2p_disable_discovery(struct bcm_cfg80211 *cfg);
+extern s32
+wl_cfgp2p_escan(struct bcm_cfg80211 *cfg, struct net_device *dev, u16 active, u32 num_chans,
+       u16 *channels,
+       s32 search_state, u16 action, u32 bssidx, struct ether_addr *tx_dst_addr,
+       p2p_scan_purpose_t p2p_scan_purpose);
+
+extern s32
+wl_cfgp2p_act_frm_search(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       s32 bssidx, s32 channel, struct ether_addr *tx_dst_addr);
+
+extern const wpa_ie_fixed_t *
+wl_cfgp2p_find_wpaie(const u8 *parse, u32 len);
+
+extern const wpa_ie_fixed_t *
+wl_cfgp2p_find_wpsie(const u8 *parse, u32 len);
+
+extern wifi_p2p_ie_t *
+wl_cfgp2p_find_p2pie(const u8 *parse, u32 len);
+
+extern const wifi_wfd_ie_t *
+wl_cfgp2p_find_wfdie(const u8 *parse, u32 len);
+extern s32
+wl_cfgp2p_set_management_ie(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 bssidx,
+            s32 pktflag, const u8 *vndr_ie, u32 vndr_ie_len);
+extern s32
+wl_cfgp2p_clear_management_ie(struct bcm_cfg80211 *cfg, s32 bssidx);
+
+extern struct net_device *
+wl_cfgp2p_find_ndev(struct bcm_cfg80211 *cfg, s32 bssidx);
+extern s32
+wl_cfgp2p_find_type(struct bcm_cfg80211 *cfg, s32 bssidx, s32 *type);
+
+extern s32
+wl_cfgp2p_listen_complete(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+extern s32
+wl_cfgp2p_discover_listen(struct bcm_cfg80211 *cfg, s32 channel, u32 duration_ms);
+
+extern s32
+wl_cfgp2p_discover_enable_search(struct bcm_cfg80211 *cfg, u8 enable);
+
+extern s32
+wl_cfgp2p_action_tx_complete(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+
+extern s32
+wl_cfgp2p_tx_action_frame(struct bcm_cfg80211 *cfg, struct net_device *dev,
+       wl_af_params_t *af_params, s32 bssidx);
+
+extern void
+wl_cfgp2p_generate_bss_mac(struct bcm_cfg80211 *cfg, struct ether_addr *primary_addr);
+
+extern void
+wl_cfg80211_change_ifaddr(u8* buf, struct ether_addr *p2p_int_addr, u8 element_id);
+
+extern s32
+wl_cfgp2p_supported(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+
+extern s32
+wl_cfgp2p_down(struct bcm_cfg80211 *cfg);
+
+extern s32
+wl_cfgp2p_set_p2p_noa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len);
+
+extern s32
+wl_cfgp2p_get_p2p_noa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len);
+
+extern s32
+wl_cfgp2p_set_p2p_ps(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len);
+
+extern s32
+wl_cfgp2p_set_p2p_ecsa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len);
+
+extern s32
+wl_cfgp2p_increase_p2p_bw(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len);
+
+extern const u8 *
+wl_cfgp2p_retreive_p2pattrib(const void *buf, u8 element_id);
+
+extern const u8*
+wl_cfgp2p_find_attrib_in_all_p2p_Ies(const u8 *parse, u32 len, u32 attrib);
+
+extern const u8 *
+wl_cfgp2p_retreive_p2p_dev_addr(wl_bss_info_t *bi, u32 bi_length);
+
+extern s32
+wl_cfgp2p_register_ndev(struct bcm_cfg80211 *cfg);
+
+extern s32
+wl_cfgp2p_unregister_ndev(struct bcm_cfg80211 *cfg);
+
+extern bool
+wl_cfgp2p_is_ifops(const struct net_device_ops *if_ops);
+
+extern u32
+wl_cfgp2p_vndr_ie(struct bcm_cfg80211 *cfg, u8 *iebuf, s32 pktflag,
+                  s8 *oui, s32 ie_id, const s8 *data, s32 datalen, const s8* add_del_cmd);
+
+extern int wl_cfgp2p_get_conn_idx(struct bcm_cfg80211 *cfg);
+
+extern
+int wl_cfg_multip2p_operational(struct bcm_cfg80211 *cfg);
+
+extern
+int wl_cfgp2p_vif_created(struct bcm_cfg80211 *cfg);
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+extern struct wireless_dev *
+wl_cfgp2p_add_p2p_disc_if(struct bcm_cfg80211 *cfg);
+
+extern int
+wl_cfgp2p_start_p2p_device(struct wiphy *wiphy, struct wireless_dev *wdev);
+
+extern void
+wl_cfgp2p_stop_p2p_device(struct wiphy *wiphy, struct wireless_dev *wdev);
+
+extern int
+wl_cfgp2p_del_p2p_disc_if(struct wireless_dev *wdev, struct bcm_cfg80211 *cfg);
+
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+extern void
+wl_cfgp2p_need_wait_actfrmae(struct bcm_cfg80211 *cfg, void *frame, u32 frame_len, bool tx);
+
+extern int
+wl_cfgp2p_is_p2p_specific_scan(struct cfg80211_scan_request *request);
+
+/* WiFi Direct */
+#define SOCIAL_CHAN_1 1
+#define SOCIAL_CHAN_2 6
+#define SOCIAL_CHAN_3 11
+#define IS_P2P_SOCIAL_CHANNEL(channel) ((channel == SOCIAL_CHAN_1) || \
+                                       (channel == SOCIAL_CHAN_2) || \
+                                       (channel == SOCIAL_CHAN_3))
+#define SOCIAL_CHAN_CNT 3
+#define AF_PEER_SEARCH_CNT 2
+#define WL_P2P_WILDCARD_SSID "DIRECT-"
+#define WL_P2P_WILDCARD_SSID_LEN 7
+#define WL_P2P_INTERFACE_PREFIX "p2p"
+#define WL_P2P_TEMP_CHAN 11
+#define WL_P2P_TEMP_CHAN_5G 36
+#define WL_P2P_AF_STATUS_OFFSET 9
+
+/* If the provision discovery is for JOIN operations,
+ * or the device discoverablity frame is destined to GO
+ * then we need not do an internal scan to find GO.
+ */
+#define IS_ACTPUB_WITHOUT_GROUP_ID(p2p_ie, len) \
+       (wl_cfgp2p_retreive_p2pattrib(p2p_ie, P2P_SEID_GROUP_ID) == NULL)
+
+#define IS_GAS_REQ(frame, len) (wl_cfgp2p_is_gas_action(frame, len) && \
+                                       ((frame->action == P2PSD_ACTION_ID_GAS_IREQ) || \
+                                       (frame->action == P2PSD_ACTION_ID_GAS_CREQ)))
+
+#define IS_P2P_PUB_ACT_RSP_SUBTYPE(subtype) ((subtype == P2P_PAF_GON_RSP) || \
+                                                       ((subtype == P2P_PAF_GON_CONF) || \
+                                                       (subtype == P2P_PAF_INVITE_RSP) || \
+                                                       (subtype == P2P_PAF_PROVDIS_RSP)))
+#define IS_P2P_SOCIAL(ch) ((ch == SOCIAL_CHAN_1) || (ch == SOCIAL_CHAN_2) || (ch == SOCIAL_CHAN_3))
+#define IS_P2P_SSID(ssid, len) (!memcmp(ssid, WL_P2P_WILDCARD_SSID, WL_P2P_WILDCARD_SSID_LEN) && \
+                                       (len >= WL_P2P_WILDCARD_SSID_LEN))
+
+/* Min FW ver required to support chanspec
+ * instead of channel in actframe iovar.
+ */
+#define FW_MAJOR_VER_ACTFRAME_CHSPEC    14
+#endif                         /* _wl_cfgp2p_h_ */
diff --git a/bcmdhd.101.10.240.x/wl_cfgscan.c b/bcmdhd.101.10.240.x/wl_cfgscan.c
new file mode 100644 (file)
index 0000000..d8c319e
--- /dev/null
@@ -0,0 +1,5118 @@
+/*
+ * Linux cfg80211 driver scan related code
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+/* */
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#include <linux/kernel.h>
+
+#include <bcmutils.h>
+#include <bcmstdlib_s.h>
+#include <bcmwifi_channels.h>
+#include <bcmendian.h>
+#include <ethernet.h>
+#include <802.11.h>
+#include <bcmiov.h>
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+
+#include <ethernet.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+#include <linux/ieee80211.h>
+#include <linux/wait.h>
+#if defined(CONFIG_TIZEN)
+#include <linux/net_stat_tizen.h>
+#endif /* CONFIG_TIZEN */
+#include <net/cfg80211.h>
+#include <net/rtnetlink.h>
+
+#include <wlioctl.h>
+#include <bcmevent.h>
+#include <wldev_common.h>
+#include <wl_cfg80211.h>
+#include <wl_cfgscan.h>
+#include <wl_cfgp2p.h>
+#include <bcmdevs.h>
+
+#include <wl_android.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_linux.h>
+#include <dhd_debug.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+#include <dhd_cfg80211.h>
+#include <dhd_bus.h>
+#include <wl_cfgvendor.h>
+#ifdef BCMPCIE
+#include <dhd_flowring.h>
+#endif
+#ifdef PNO_SUPPORT
+#include <dhd_pno.h>
+#endif /* PNO_SUPPORT */
+#ifdef RTT_SUPPORT
+#include "dhd_rtt.h"
+#endif /* RTT_SUPPORT */
+#include <dhd_config.h>
+
+#define ACTIVE_SCAN 1
+#define PASSIVE_SCAN 0
+
+#define MIN_P2P_IE_LEN 8       /* p2p_ie->OUI(3) + p2p_ie->oui_type(1) +
+                                * Attribute ID(1) + Length(2) + 1(Mininum length:1)
+                                */
+#define MAX_P2P_IE_LEN 251     /* Up To 251 */
+
+#define WPS_ATTR_REQ_TYPE 0x103a
+#define WPS_REQ_TYPE_ENROLLEE 0x01
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+#define CFG80211_READY_ON_CHANNEL(cfgdev, cookie, channel, channel_type, duration, flags) \
+       cfg80211_ready_on_channel(cfgdev, cookie, channel, duration, GFP_KERNEL);
+#else
+#define CFG80211_READY_ON_CHANNEL(cfgdev, cookie, channel, channel_type, duration, flags) \
+       cfg80211_ready_on_channel(cfgdev, cookie, channel, channel_type, duration, GFP_KERNEL);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0))
+#define CFG80211_SCHED_SCAN_STOPPED(wiphy, schedscan_req) \
+       cfg80211_sched_scan_stopped(wiphy, schedscan_req->reqid);
+#else
+#define CFG80211_SCHED_SCAN_STOPPED(wiphy, schedscan_req) \
+       cfg80211_sched_scan_stopped(wiphy);
+#endif /* KERNEL > 4.11.0 */
+
+#if defined(USE_INITIAL_2G_SCAN) || defined(USE_INITIAL_SHORT_DWELL_TIME)
+#define FIRST_SCAN_ACTIVE_DWELL_TIME_MS 40
+bool g_first_broadcast_scan = TRUE;
+#endif /* USE_INITIAL_2G_SCAN || USE_INITIAL_SHORT_DWELL_TIME */
+#ifdef CUSTOMER_HW4_DEBUG
+bool wl_scan_timeout_dbg_enabled = 0;
+#endif /* CUSTOMER_HW4_DEBUG */
+#ifdef P2P_LISTEN_OFFLOADING
+void wl_cfg80211_cancel_p2plo(struct bcm_cfg80211 *cfg);
+#endif /* P2P_LISTEN_OFFLOADING */
+static void _wl_notify_scan_done(struct bcm_cfg80211 *cfg, bool aborted);
+
+#ifdef ESCAN_CHANNEL_CACHE
+void reset_roam_cache(struct bcm_cfg80211 *cfg);
+void add_roam_cache(struct bcm_cfg80211 *cfg, wl_bss_info_t *bi);
+int get_roam_channel_list(struct bcm_cfg80211 *cfg, chanspec_t target_chan, chanspec_t *channels,
+       int n_channels, const wlc_ssid_t *ssid, int ioctl_ver);
+void set_roam_band(int band);
+#endif /* ESCAN_CHANNEL_CACHE */
+
+#ifdef ROAM_CHANNEL_CACHE
+void print_roam_cache(struct bcm_cfg80211 *cfg);
+void update_roam_cache(struct bcm_cfg80211 *cfg, int ioctl_ver);
+#endif /* ROAM_CHANNEL_CACHE */
+
+extern int passive_channel_skip;
+
+#ifdef DUAL_ESCAN_RESULT_BUFFER
+static wl_scan_results_t *
+wl_escan_get_buf(struct bcm_cfg80211 *cfg, bool aborted)
+{
+       u8 index;
+       if (aborted) {
+               if (cfg->escan_info.escan_type[0] == cfg->escan_info.escan_type[1]) {
+                       index = (cfg->escan_info.cur_sync_id + 1)%SCAN_BUF_CNT;
+               } else {
+                       index = (cfg->escan_info.cur_sync_id)%SCAN_BUF_CNT;
+               }
+       } else {
+               index = (cfg->escan_info.cur_sync_id)%SCAN_BUF_CNT;
+       }
+
+       return (wl_scan_results_t *)cfg->escan_info.escan_buf[index];
+}
+static int
+wl_escan_check_sync_id(struct bcm_cfg80211 *cfg, s32 status, u16 result_id, u16 wl_id)
+{
+       if (result_id != wl_id) {
+               WL_ERR(("ESCAN sync id mismatch :status :%d "
+                       "cur_sync_id:%d coming sync_id:%d\n",
+                       status, wl_id, result_id));
+#ifdef DHD_SEND_HANG_ESCAN_SYNCID_MISMATCH
+               if (cfg->escan_info.prev_escan_aborted == FALSE) {
+                       wl_cfg80211_handle_hang_event(bcmcfg_to_prmry_ndev(cfg),
+                               HANG_REASON_ESCAN_SYNCID_MISMATCH, DUMP_TYPE_ESCAN_SYNCID_MISMATCH);
+               }
+#endif /* DHD_SEND_HANG_ESCAN_SYNCID_MISMATCH */
+               return -1;
+       } else {
+               return 0;
+       }
+}
+#define wl_escan_increment_sync_id(a, b) ((a)->escan_info.cur_sync_id += b)
+#define wl_escan_init_sync_id(a) ((a)->escan_info.cur_sync_id = 0)
+#else
+#define wl_escan_get_buf(a, b) ((wl_scan_results_t *) (a)->escan_info.escan_buf)
+#define wl_escan_check_sync_id(a, b, c, d) 0
+#define wl_escan_increment_sync_id(a, b)
+#define wl_escan_init_sync_id(a)
+#endif /* DUAL_ESCAN_RESULT_BUFFER */
+
+/*
+ * information element utilities
+ */
+static void wl_rst_ie(struct bcm_cfg80211 *cfg)
+{
+       struct wl_ie *ie = wl_to_ie(cfg);
+
+       ie->offset = 0;
+       bzero(ie->buf, sizeof(ie->buf));
+}
+
+static void wl_update_hidden_ap_ie(wl_bss_info_t *bi, const u8 *ie_stream, u32 *ie_size,
+       bool update_ssid)
+{
+       u8 *ssidie;
+       int32 ssid_len = MIN(bi->SSID_len, DOT11_MAX_SSID_LEN);
+       int32 remaining_ie_buf_len, available_buffer_len, unused_buf_len;
+       /* cfg80211_find_ie defined in kernel returning const u8 */
+
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       ssidie = (u8 *)cfg80211_find_ie(WLAN_EID_SSID, ie_stream, *ie_size);
+       GCC_DIAGNOSTIC_POP();
+
+       /* ERROR out if
+        * 1. No ssid IE is FOUND or
+        * 2. New ssid length is > what was allocated for existing ssid (as
+        * we do not want to overwrite the rest of the IEs) or
+        * 3. If in case of erroneous buffer input where ssid length doesnt match the space
+        * allocated to it.
+        */
+       if (!ssidie) {
+               return;
+       }
+       available_buffer_len = ((int)(*ie_size)) - (ssidie + 2 - ie_stream);
+       remaining_ie_buf_len = available_buffer_len - (int)ssidie[1];
+       unused_buf_len = WL_EXTRA_BUF_MAX - (4 + bi->length + *ie_size);
+       if (ssidie[1] > available_buffer_len) {
+               WL_ERR_MEM(("wl_update_hidden_ap_ie: skip wl_update_hidden_ap_ie : overflow\n"));
+               return;
+       }
+
+       /* ssidie[1] can be different with bi->SSID_len only if roaming status
+        * On scanning the values will be same each other.
+        */
+
+       if (ssidie[1] != ssid_len) {
+               if (ssidie[1]) {
+                       WL_ERR_RLMT(("wl_update_hidden_ap_ie: Wrong SSID len: %d != %d\n",
+                               ssidie[1], bi->SSID_len));
+               }
+               /* ssidie[1] is 1 in beacon on CISCO hidden networks. */
+               /*
+                * The bss info in firmware gets updated from beacon and probe resp.
+                * In case of hidden network, the bss_info that got updated by beacon,
+                * will not carry SSID and this can result in cfg80211_get_bss not finding a match.
+                * so include the SSID element.
+                */
+               if ((update_ssid && (ssid_len > ssidie[1])) && (unused_buf_len > ssid_len)) {
+                       WL_INFORM_MEM(("Changing the SSID Info.\n"));
+                       memmove(ssidie + ssid_len + 2,
+                               (ssidie + 2) + ssidie[1],
+                               remaining_ie_buf_len);
+                       memcpy(ssidie + 2, bi->SSID, ssid_len);
+                       *ie_size = *ie_size + ssid_len - ssidie[1];
+                       ssidie[1] = ssid_len;
+               } else if (ssid_len < ssidie[1]) {
+                       WL_ERR_MEM(("wl_update_hidden_ap_ie: Invalid SSID len: %d < %d\n",
+                               bi->SSID_len, ssidie[1]));
+               }
+               return;
+       }
+       if (*(ssidie + 2) == '\0')
+                memcpy(ssidie + 2, bi->SSID, ssid_len);
+       return;
+}
+
+static s32 wl_mrg_ie(struct bcm_cfg80211 *cfg, u8 *ie_stream, u16 ie_size)
+{
+       struct wl_ie *ie = wl_to_ie(cfg);
+       s32 err = 0;
+
+       if (unlikely(ie->offset + ie_size > WL_TLV_INFO_MAX)) {
+               WL_ERR(("ei_stream crosses buffer boundary\n"));
+               return -ENOSPC;
+       }
+       memcpy(&ie->buf[ie->offset], ie_stream, ie_size);
+       ie->offset += ie_size;
+
+       return err;
+}
+
+static s32 wl_cp_ie(struct bcm_cfg80211 *cfg, u8 *dst, u16 dst_size)
+{
+       struct wl_ie *ie = wl_to_ie(cfg);
+       s32 err = 0;
+
+       if (unlikely(ie->offset > dst_size)) {
+               WL_ERR(("dst_size is not enough\n"));
+               return -ENOSPC;
+       }
+       memcpy(dst, &ie->buf[0], ie->offset);
+
+       return err;
+}
+
+static u32 wl_get_ielen(struct bcm_cfg80211 *cfg)
+{
+       struct wl_ie *ie = wl_to_ie(cfg);
+
+       return ie->offset;
+}
+
+s32 wl_inform_single_bss(struct bcm_cfg80211 *cfg, wl_bss_info_t *bi, bool update_ssid)
+{
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       struct ieee80211_mgmt *mgmt;
+       struct ieee80211_channel *channel;
+       struct wl_cfg80211_bss_info *notif_bss_info;
+       struct wl_scan_req *sr = wl_to_sr(cfg);
+       struct beacon_proberesp *beacon_proberesp;
+       struct cfg80211_bss *cbss = NULL;
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       log_conn_event_t *event_data = NULL;
+       tlv_log *tlv_data = NULL;
+       u32 alloc_len, tlv_len;
+       u32 payload_len;
+       s32 mgmt_type;
+       s32 signal;
+       u32 freq;
+       s32 err = 0;
+       gfp_t aflags;
+       u8 tmp_buf[IEEE80211_MAX_SSID_LEN + 1];
+       chanspec_t chanspec;
+
+       if (unlikely(dtoh32(bi->length) > WL_BSS_INFO_MAX)) {
+               WL_DBG(("Beacon is larger than buffer. Discarding\n"));
+               return err;
+       }
+
+       if (bi->SSID_len > IEEE80211_MAX_SSID_LEN) {
+               WL_ERR(("wrong SSID len:%d\n", bi->SSID_len));
+               return -EINVAL;
+       }
+
+       aflags = (in_atomic()) ? GFP_ATOMIC : GFP_KERNEL;
+       notif_bss_info = (struct wl_cfg80211_bss_info *)MALLOCZ(cfg->osh,
+               sizeof(*notif_bss_info) + sizeof(*mgmt) - sizeof(u8) + WL_BSS_INFO_MAX);
+       if (unlikely(!notif_bss_info)) {
+               WL_ERR(("notif_bss_info alloc failed\n"));
+               return -ENOMEM;
+       }
+       /* Check for all currently supported bands */
+       if (!(
+#ifdef WL_6G_BAND
+               CHSPEC_IS6G(bi->chanspec) ||
+#endif /* WL_6G_BAND */
+               CHSPEC_IS5G(bi->chanspec) || CHSPEC_IS2G(bi->chanspec))) {
+               WL_ERR(("No valid band"));
+               MFREE(cfg->osh, notif_bss_info, sizeof(*notif_bss_info)
+                       + sizeof(*mgmt) - sizeof(u8) + WL_BSS_INFO_MAX);
+               return -EINVAL;
+       }
+
+       mgmt = (struct ieee80211_mgmt *)notif_bss_info->frame_buf;
+       chanspec = wl_chspec_driver_to_host(bi->chanspec);
+       notif_bss_info->channel = wf_chspec_ctlchan(chanspec);
+       notif_bss_info->band = CHSPEC_BAND(bi->chanspec);
+       notif_bss_info->rssi = dtoh16(bi->RSSI);
+#if defined(RSSIAVG)
+       notif_bss_info->rssi = wl_get_avg_rssi(&cfg->g_rssi_cache_ctrl, &bi->BSSID);
+       if (notif_bss_info->rssi == RSSI_MINVAL)
+               notif_bss_info->rssi = MIN(dtoh16(bi->RSSI), RSSI_MAXVAL);
+#endif
+#if defined(RSSIOFFSET)
+       notif_bss_info->rssi = wl_update_rssi_offset(bcmcfg_to_prmry_ndev(cfg), notif_bss_info->rssi);
+#endif
+#if !defined(RSSIAVG) && !defined(RSSIOFFSET)
+       // terence 20150419: limit the max. rssi to -2 or the bss will be filtered out in android OS
+       notif_bss_info->rssi = MIN(notif_bss_info->rssi, RSSI_MAXVAL);
+#endif
+       memcpy(mgmt->bssid, &bi->BSSID, ETHER_ADDR_LEN);
+       mgmt_type = cfg->active_scan ?
+               IEEE80211_STYPE_PROBE_RESP : IEEE80211_STYPE_BEACON;
+       if (!memcmp(bi->SSID, sr->ssid.SSID, bi->SSID_len)) {
+           mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | mgmt_type);
+       }
+       beacon_proberesp = cfg->active_scan ?
+               (struct beacon_proberesp *)&mgmt->u.probe_resp :
+               (struct beacon_proberesp *)&mgmt->u.beacon;
+       beacon_proberesp->timestamp = 0;
+       beacon_proberesp->beacon_int = cpu_to_le16(bi->beacon_period);
+       beacon_proberesp->capab_info = cpu_to_le16(bi->capability);
+       wl_rst_ie(cfg);
+       wl_update_hidden_ap_ie(bi, ((u8 *) bi) + bi->ie_offset, &bi->ie_length, update_ssid);
+       wl_mrg_ie(cfg, ((u8 *) bi) + bi->ie_offset, bi->ie_length);
+       wl_cp_ie(cfg, beacon_proberesp->variable, WL_BSS_INFO_MAX -
+               offsetof(struct wl_cfg80211_bss_info, frame_buf));
+       notif_bss_info->frame_len = offsetof(struct ieee80211_mgmt,
+               u.beacon.variable) + wl_get_ielen(cfg);
+       freq = wl_channel_to_frequency(notif_bss_info->channel, notif_bss_info->band);
+       if (freq == 0) {
+               WL_ERR(("Invalid channel, failed to change channel to freq\n"));
+               MFREE(cfg->osh, notif_bss_info, sizeof(*notif_bss_info)
+                       + sizeof(*mgmt) - sizeof(u8) + WL_BSS_INFO_MAX);
+               return -EINVAL;
+       }
+       channel = ieee80211_get_channel(wiphy, freq);
+       memcpy(tmp_buf, bi->SSID, bi->SSID_len);
+       tmp_buf[bi->SSID_len] = '\0';
+       WL_SCAN(("BSSID %pM, channel %3d(%3d %sMHz), rssi %3d, capa 0x04%x, mgmt_type %d, "
+               "frame_len %d, SSID \"%s\"\n",
+               &bi->BSSID, notif_bss_info->channel, CHSPEC_CHANNEL(chanspec),
+               CHSPEC_IS20(chanspec)?"20":
+               CHSPEC_IS40(chanspec)?"40":
+               CHSPEC_IS80(chanspec)?"80":"160",
+               notif_bss_info->rssi, mgmt->u.beacon.capab_info, mgmt_type,
+               notif_bss_info->frame_len, tmp_buf));
+       if (unlikely(!channel)) {
+               WL_ERR(("ieee80211_get_channel error\n"));
+               MFREE(cfg->osh, notif_bss_info, sizeof(*notif_bss_info)
+                       + sizeof(*mgmt) - sizeof(u8) + WL_BSS_INFO_MAX);
+               return -EINVAL;
+       }
+
+       signal = notif_bss_info->rssi * 100;
+       if (!mgmt->u.probe_resp.timestamp) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
+               struct osl_timespec ts;
+               osl_get_monotonic_boottime(&ts);
+               mgmt->u.probe_resp.timestamp = ((u64)ts.tv_sec*1000000)
+                               + ts.tv_nsec / 1000;
+#else
+               struct osl_timespec tv;
+               osl_do_gettimeofday(&tv);
+               mgmt->u.probe_resp.timestamp = ((u64)tv.tv_sec*1000000)
+                               + tv.tv_usec;
+#endif
+       }
+
+       cbss = cfg80211_inform_bss_frame(wiphy, channel, mgmt,
+               le16_to_cpu(notif_bss_info->frame_len), signal, aflags);
+       if (unlikely(!cbss)) {
+               WL_ERR(("cfg80211_inform_bss_frame error bssid " MACDBG " channel %d \n",
+                       MAC2STRDBG((u8*)(&bi->BSSID)), notif_bss_info->channel));
+               err = -EINVAL;
+               goto out_err;
+       }
+
+       CFG80211_PUT_BSS(wiphy, cbss);
+
+       if (DBG_RING_ACTIVE(dhdp, DHD_EVENT_RING_ID) &&
+                       (cfg->sched_scan_req && !cfg->scan_request)) {
+               alloc_len = sizeof(log_conn_event_t) + IEEE80211_MAX_SSID_LEN + sizeof(uint16) +
+                       sizeof(int16);
+               event_data = (log_conn_event_t *)MALLOCZ(dhdp->osh, alloc_len);
+               if (!event_data) {
+                       WL_ERR(("%s: failed to allocate the log_conn_event_t with "
+                               "length(%d)\n", __func__, alloc_len));
+                       goto out_err;
+               }
+               tlv_len = 3 * sizeof(tlv_log);
+               event_data->tlvs = (tlv_log *)MALLOCZ(cfg->osh, tlv_len);
+               if (!event_data->tlvs) {
+                       WL_ERR(("%s: failed to allocate the log_conn_event_t with "
+                               "length(%d)\n", __func__, tlv_len));
+                       goto free_evt_data;
+               }
+
+               payload_len = sizeof(log_conn_event_t);
+               event_data->event = WIFI_EVENT_DRIVER_PNO_SCAN_RESULT_FOUND;
+               tlv_data = event_data->tlvs;
+
+               /* ssid */
+               tlv_data->tag = WIFI_TAG_SSID;
+               tlv_data->len = bi->SSID_len;
+               memcpy(tlv_data->value, bi->SSID, bi->SSID_len);
+               payload_len += TLV_LOG_SIZE(tlv_data);
+               tlv_data = TLV_LOG_NEXT(tlv_data);
+
+               /* channel */
+               tlv_data->tag = WIFI_TAG_CHANNEL;
+               tlv_data->len = sizeof(uint16);
+               memcpy(tlv_data->value, &notif_bss_info->channel, sizeof(uint16));
+               payload_len += TLV_LOG_SIZE(tlv_data);
+               tlv_data = TLV_LOG_NEXT(tlv_data);
+
+               /* rssi */
+               tlv_data->tag = WIFI_TAG_RSSI;
+               tlv_data->len = sizeof(int16);
+               memcpy(tlv_data->value, &notif_bss_info->rssi, sizeof(int16));
+               payload_len += TLV_LOG_SIZE(tlv_data);
+               tlv_data = TLV_LOG_NEXT(tlv_data);
+
+               dhd_os_push_push_ring_data(dhdp, DHD_EVENT_RING_ID,
+                       event_data, payload_len);
+               MFREE(dhdp->osh, event_data->tlvs, tlv_len);
+free_evt_data:
+               MFREE(dhdp->osh, event_data, alloc_len);
+       }
+
+out_err:
+       MFREE(cfg->osh, notif_bss_info, sizeof(*notif_bss_info)
+                       + sizeof(*mgmt) - sizeof(u8) + WL_BSS_INFO_MAX);
+       return err;
+}
+
+#if defined(BSSCACHE) || defined(RSSIAVG)
+void wl_cfg80211_update_bss_cache(struct bcm_cfg80211 *cfg)
+{
+#if defined(RSSIAVG)
+       int rssi;
+#endif
+       struct wl_scan_results *bss_list = cfg->bss_list;
+
+       /* Free cache in p2p scanning*/
+       if (p2p_is_on(cfg) && p2p_scan(cfg)) {
+#if defined(RSSIAVG)
+               wl_free_rssi_cache(&cfg->g_rssi_cache_ctrl);
+#endif
+#if defined(BSSCACHE)
+               wl_free_bss_cache(&cfg->g_bss_cache_ctrl);
+#endif
+       }
+
+       /* Delete disconnected cache */
+#if defined(BSSCACHE)
+       wl_delete_disconnected_bss_cache(&cfg->g_bss_cache_ctrl,
+               (u8*)&cfg->disconnected_bssid);
+#if defined(RSSIAVG)
+       wl_delete_disconnected_rssi_cache(&cfg->g_rssi_cache_ctrl,
+               (u8*)&cfg->disconnected_bssid);
+#endif
+       if (cfg->p2p_disconnected == 0)
+               memset(&cfg->disconnected_bssid, 0, ETHER_ADDR_LEN);
+#endif
+
+       /* Update cache */
+#if defined(RSSIAVG)
+       wl_update_rssi_cache(&cfg->g_rssi_cache_ctrl, bss_list);
+       if (!in_atomic())
+               wl_update_connected_rssi_cache(ndev, &cfg->g_rssi_cache_ctrl, &rssi);
+#endif
+#if defined(BSSCACHE)
+       wl_update_bss_cache(&cfg->g_bss_cache_ctrl,
+#if defined(RSSIAVG)
+               &cfg->g_rssi_cache_ctrl,
+#endif
+               bss_list);
+#endif
+
+       /* delete dirty cache */
+#if defined(RSSIAVG)
+       wl_delete_dirty_rssi_cache(&cfg->g_rssi_cache_ctrl);
+       wl_reset_rssi_cache(&cfg->g_rssi_cache_ctrl);
+#endif
+#if defined(BSSCACHE)
+       wl_delete_dirty_bss_cache(&cfg->g_bss_cache_ctrl);
+       wl_reset_bss_cache(&cfg->g_bss_cache_ctrl);
+#endif
+
+}
+#endif
+
+#if defined(BSSCACHE)
+s32 wl_inform_bss_cache(struct bcm_cfg80211 *cfg)
+{
+       struct wl_scan_results *bss_list = cfg->bss_list;
+       wl_bss_info_t *bi = NULL;       /* must be initialized */
+       s32 err = 0;
+       s32 i;
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+#if defined(BSSCACHE)
+       wl_bss_cache_t *node;
+#endif
+
+       if (cfg->p2p_disconnected > 0) {
+               // terence 20130703: Fix for wrong group_capab (timing issue)
+               wl_delete_disconnected_bss_cache(&cfg->g_bss_cache_ctrl, (u8*)&cfg->disconnected_bssid);
+#if defined(RSSIAVG)
+               wl_delete_disconnected_rssi_cache(&cfg->g_rssi_cache_ctrl, (u8*)&cfg->disconnected_bssid);
+#endif
+       }
+       WL_SCAN(("scanned AP count (%d)\n", bss_list->count));
+       node = cfg->g_bss_cache_ctrl.m_cache_head;
+       for (i=0; node && i<WL_AP_MAX; i++) {
+               bi = node->results.bss_info;
+               err = wl_inform_single_bss(cfg, bi, false);
+               node = node->next;
+       }
+       if (cfg->autochannel)
+               wl_ext_get_best_channel(ndev, &cfg->g_bss_cache_ctrl, ioctl_version,
+                       &cfg->best_2g_ch, &cfg->best_5g_ch);
+
+       return err;
+}
+#endif
+
+static s32
+wl_inform_bss(struct bcm_cfg80211 *cfg)
+{
+#if !defined(BSSCACHE)
+       struct wl_scan_results *bss_list;
+       wl_bss_info_t *bi = NULL;       /* must be initialized */
+       s32 i;
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+#endif
+       s32 err = 0;
+
+#if defined(BSSCACHE) || defined(RSSIAVG)
+               wl_cfg80211_update_bss_cache(cfg);
+#endif
+
+#if defined(BSSCACHE)
+       err = wl_inform_bss_cache(cfg);
+#else
+       bss_list = cfg->bss_list;
+       WL_SCAN(("scanned AP count (%d)\n", bss_list->count));
+#ifdef ESCAN_CHANNEL_CACHE
+       reset_roam_cache(cfg);
+#endif /* ESCAN_CHANNEL_CACHE */
+       preempt_disable();
+       bi = next_bss(bss_list, bi);
+       for_each_bss(bss_list, bi, i) {
+               if (cfg->p2p_disconnected > 0 &&
+                               !memcmp(&bi->BSSID, &cfg->disconnected_bssid, ETHER_ADDR_LEN)) {
+                       WL_SCAN(("Skip %pM\n", &bi->BSSID));
+                       continue;
+               }
+#ifdef ESCAN_CHANNEL_CACHE
+               add_roam_cache(cfg, bi);
+#endif /* ESCAN_CHANNEL_CACHE */
+               err = wl_inform_single_bss(cfg, bi, false);
+               if (unlikely(err)) {
+                       WL_ERR(("bss inform failed\n"));
+               }
+       }
+       preempt_enable();
+       if (cfg->autochannel)
+               wl_ext_get_best_channel(ndev, bss_list, ioctl_version,
+                       &cfg->best_2g_ch, &cfg->best_5g_ch);
+#endif
+
+       if (cfg->p2p_disconnected > 0) {
+               // terence 20130703: Fix for wrong group_capab (timing issue)
+               cfg->p2p_disconnected++;
+               if (cfg->p2p_disconnected >= 2) {
+                       cfg->p2p_disconnected = 0;
+                       memset(&cfg->disconnected_bssid, 0, ETHER_ADDR_LEN);
+               }
+       }
+       WL_MEM(("cfg80211 scan cache updated\n"));
+#ifdef ROAM_CHANNEL_CACHE
+       /* print_roam_cache(); */
+       update_roam_cache(cfg, ioctl_version);
+#endif /* ROAM_CHANNEL_CACHE */
+       return err;
+}
+
+#ifdef WL11U
+static bcm_tlv_t *
+wl_cfg80211_find_interworking_ie(const u8 *parse, u32 len)
+{
+       bcm_tlv_t *ie;
+
+/* unfortunately it's too much work to dispose the const cast - bcm_parse_tlvs
+ * is used everywhere and changing its prototype to take const qualifier needs
+ * a massive change to all its callers...
+ */
+
+       if ((ie = bcm_parse_tlvs(parse, len, DOT11_MNG_INTERWORKING_ID))) {
+               return ie;
+       }
+       return NULL;
+}
+
+static s32
+wl_cfg80211_clear_iw_ie(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 bssidx)
+{
+       ie_setbuf_t ie_setbuf;
+
+       WL_DBG(("clear interworking IE\n"));
+
+       bzero(&ie_setbuf, sizeof(ie_setbuf_t));
+
+       ie_setbuf.ie_buffer.iecount = htod32(1);
+       ie_setbuf.ie_buffer.ie_list[0].ie_data.id = DOT11_MNG_INTERWORKING_ID;
+       ie_setbuf.ie_buffer.ie_list[0].ie_data.len = 0;
+
+       return wldev_iovar_setbuf_bsscfg(ndev, "ie", &ie_setbuf, sizeof(ie_setbuf),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+}
+
+static s32
+wl_cfg80211_add_iw_ie(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 bssidx, s32 pktflag,
+                      uint8 ie_id, uint8 *data, uint8 data_len)
+{
+       s32 err = BCME_OK;
+       s32 buf_len;
+       ie_setbuf_t *ie_setbuf;
+       ie_getbuf_t ie_getbufp;
+       char getbuf[WLC_IOCTL_SMLEN];
+
+       if (ie_id != DOT11_MNG_INTERWORKING_ID) {
+               WL_ERR(("unsupported (id=%d)\n", ie_id));
+               return BCME_UNSUPPORTED;
+       }
+
+       /* access network options (1 octet)  is the mandatory field */
+       if (!data || data_len == 0 || data_len > IW_IES_MAX_BUF_LEN) {
+               WL_ERR(("wrong interworking IE (len=%d)\n", data_len));
+               return BCME_BADARG;
+       }
+
+       /* Validate the pktflag parameter */
+       if ((pktflag & ~(VNDR_IE_BEACON_FLAG | VNDR_IE_PRBRSP_FLAG |
+                       VNDR_IE_ASSOCRSP_FLAG | VNDR_IE_AUTHRSP_FLAG |
+                       VNDR_IE_PRBREQ_FLAG | VNDR_IE_ASSOCREQ_FLAG|
+                       VNDR_IE_CUSTOM_FLAG))) {
+               WL_ERR(("invalid packet flag 0x%x\n", pktflag));
+               return BCME_BADARG;
+       }
+
+       buf_len = sizeof(ie_setbuf_t) + data_len - 1;
+
+       ie_getbufp.id = DOT11_MNG_INTERWORKING_ID;
+       if (wldev_iovar_getbuf_bsscfg(ndev, "ie", (void *)&ie_getbufp,
+                       sizeof(ie_getbufp), getbuf, WLC_IOCTL_SMLEN, bssidx, &cfg->ioctl_buf_sync)
+                       == BCME_OK) {
+               if (!memcmp(&getbuf[TLV_HDR_LEN], data, data_len)) {
+                       WL_DBG(("skip to set interworking IE\n"));
+                       return BCME_OK;
+               }
+       }
+
+       /* if already set with previous values, delete it first */
+       if (cfg->wl11u) {
+               if ((err = wl_cfg80211_clear_iw_ie(cfg, ndev, bssidx)) != BCME_OK) {
+                       return err;
+               }
+       }
+
+       ie_setbuf = (ie_setbuf_t *)MALLOCZ(cfg->osh, buf_len);
+       if (!ie_setbuf) {
+               WL_ERR(("Error allocating buffer for IE\n"));
+               return -ENOMEM;
+       }
+       strlcpy(ie_setbuf->cmd, "add", sizeof(ie_setbuf->cmd));
+
+       /* Buffer contains only 1 IE */
+       ie_setbuf->ie_buffer.iecount = htod32(1);
+       /* use VNDR_IE_CUSTOM_FLAG flags for none vendor IE . currently fixed value */
+       ie_setbuf->ie_buffer.ie_list[0].pktflag = htod32(pktflag);
+
+       /* Now, add the IE to the buffer */
+       ie_setbuf->ie_buffer.ie_list[0].ie_data.id = DOT11_MNG_INTERWORKING_ID;
+       ie_setbuf->ie_buffer.ie_list[0].ie_data.len = data_len;
+       /* Returning void here as max data_len can be 8 */
+       (void)memcpy_s((uchar *)&ie_setbuf->ie_buffer.ie_list[0].ie_data.data[0], sizeof(uint8),
+               data, data_len);
+
+       if ((err = wldev_iovar_setbuf_bsscfg(ndev, "ie", ie_setbuf, buf_len,
+                       cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync))
+                       == BCME_OK) {
+               WL_DBG(("set interworking IE\n"));
+               cfg->wl11u = TRUE;
+               err = wldev_iovar_setint_bsscfg(ndev, "grat_arp", 1, bssidx);
+       }
+
+       MFREE(cfg->osh, ie_setbuf, buf_len);
+       return err;
+}
+#endif /* WL11U */
+
+#ifdef WL_BCNRECV
+/* Beacon recv results handler sending to upper layer */
+static s32
+wl_bcnrecv_result_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+               wl_bss_info_v109_2_t *bi, uint32 scan_status)
+{
+       s32 err = BCME_OK;
+       struct wiphy *wiphy = NULL;
+       wl_bcnrecv_result_t *bcn_recv = NULL;
+       struct osl_timespec ts;
+       if (!bi) {
+               WL_ERR(("%s: bi is NULL\n", __func__));
+               err = BCME_NORESOURCE;
+               goto exit;
+       }
+       if ((bi->length - bi->ie_length) < sizeof(wl_bss_info_v109_2_t)) {
+               WL_ERR(("bi info version doesn't support bcn_recv attributes\n"));
+               goto exit;
+       }
+
+       if (scan_status == WLC_E_STATUS_RXBCN) {
+               wiphy = cfg->wdev->wiphy;
+               if (!wiphy) {
+                        WL_ERR(("wiphy is NULL\n"));
+                        err = BCME_NORESOURCE;
+                        goto exit;
+               }
+               bcn_recv = (wl_bcnrecv_result_t *)MALLOCZ(cfg->osh, sizeof(*bcn_recv));
+               if (unlikely(!bcn_recv)) {
+                       WL_ERR(("Failed to allocate memory\n"));
+                       return -ENOMEM;
+               }
+               /* Returning void here as copy size does not exceed dest size of SSID */
+               (void)memcpy_s((char *)bcn_recv->SSID, DOT11_MAX_SSID_LEN,
+                       (char *)bi->SSID, DOT11_MAX_SSID_LEN);
+               /* Returning void here as copy size does not exceed dest size of ETH_LEN */
+               (void)memcpy_s(&bcn_recv->BSSID, ETHER_ADDR_LEN, &bi->BSSID, ETH_ALEN);
+               bcn_recv->channel = wf_chspec_ctlchan(
+                       wl_chspec_driver_to_host(bi->chanspec));
+               bcn_recv->beacon_interval = bi->beacon_period;
+
+               /* kernal timestamp */
+               osl_get_monotonic_boottime(&ts);
+               bcn_recv->system_time = ((u64)ts.tv_sec*1000000)
+                               + ts.tv_nsec / 1000;
+               bcn_recv->timestamp[0] = bi->timestamp[0];
+               bcn_recv->timestamp[1] = bi->timestamp[1];
+               if ((err = wl_android_bcnrecv_event(cfgdev_to_wlc_ndev(cfgdev, cfg),
+                               BCNRECV_ATTR_BCNINFO, 0, 0,
+                               (uint8 *)bcn_recv, sizeof(*bcn_recv)))
+                               != BCME_OK) {
+                       WL_ERR(("failed to send bcnrecv event, error:%d\n", err));
+               }
+       } else {
+               WL_DBG(("Ignoring Escan Event:%d \n", scan_status));
+       }
+exit:
+       if (bcn_recv) {
+               MFREE(cfg->osh, bcn_recv, sizeof(*bcn_recv));
+       }
+       return err;
+}
+#endif /* WL_BCNRECV */
+
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+#ifndef WL_DRV_AVOID_SCANCACHE
+static void
+wl_cfg80211_find_removal_candidate(wl_bss_info_t *bss, removal_element_t *candidate)
+{
+       int idx;
+       for (idx = 0; idx < BUF_OVERFLOW_MGMT_COUNT; idx++) {
+               int len = BUF_OVERFLOW_MGMT_COUNT - idx - 1;
+               if (bss->RSSI < candidate[idx].RSSI) {
+                       if (len) {
+                               /* In the below memcpy operation the candidate array always has the
+                               * buffer space available to max 'len' calculated in the for loop.
+                               */
+                               (void)memcpy_s(&candidate[idx + 1],
+                                       (sizeof(removal_element_t) * len),
+                                       &candidate[idx], sizeof(removal_element_t) * len);
+                       }
+                       candidate[idx].RSSI = bss->RSSI;
+                       candidate[idx].length = bss->length;
+                       (void)memcpy_s(&candidate[idx].BSSID, ETHER_ADDR_LEN,
+                               &bss->BSSID, ETHER_ADDR_LEN);
+                       return;
+               }
+       }
+}
+
+static void
+wl_cfg80211_remove_lowRSSI_info(wl_scan_results_t *list, removal_element_t *candidate,
+       wl_bss_info_t *bi)
+{
+       int idx1, idx2;
+       int total_delete_len = 0;
+       for (idx1 = 0; idx1 < BUF_OVERFLOW_MGMT_COUNT; idx1++) {
+               int cur_len = WL_SCAN_RESULTS_FIXED_SIZE;
+               wl_bss_info_t *bss = NULL;
+               if (candidate[idx1].RSSI >= bi->RSSI)
+                       continue;
+               for (idx2 = 0; idx2 < list->count; idx2++) {
+                       bss = bss ? (wl_bss_info_t *)((uintptr)bss + dtoh32(bss->length)) :
+                               list->bss_info;
+                       if (!bcmp(&candidate[idx1].BSSID, &bss->BSSID, ETHER_ADDR_LEN) &&
+                               candidate[idx1].RSSI == bss->RSSI &&
+                               candidate[idx1].length == dtoh32(bss->length)) {
+                               u32 delete_len = dtoh32(bss->length);
+                               WL_DBG(("delete scan info of " MACDBG " to add new AP\n",
+                                       MAC2STRDBG(bss->BSSID.octet)));
+                               if (idx2 < list->count -1) {
+                                       memmove((u8 *)bss, (u8 *)bss + delete_len,
+                                               list->buflen - cur_len - delete_len);
+                               }
+                               list->buflen -= delete_len;
+                               list->count--;
+                               total_delete_len += delete_len;
+                               /* if delete_len is greater than or equal to result length */
+                               if (total_delete_len >= bi->length) {
+                                       return;
+                               }
+                               break;
+                       }
+                       cur_len += dtoh32(bss->length);
+               }
+       }
+}
+#endif /* WL_DRV_AVOID_SCANCACHE */
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+s32
+wl_escan_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = BCME_OK;
+       s32 status = ntoh32(e->status);
+       wl_escan_result_t *escan_result;
+       struct net_device *ndev = NULL;
+#ifndef WL_DRV_AVOID_SCANCACHE
+       wl_bss_info_t *bi;
+       u32 bi_length;
+       const wifi_p2p_ie_t * p2p_ie;
+       const u8 *p2p_dev_addr = NULL;
+       wl_scan_results_t *list;
+       wl_bss_info_t *bss = NULL;
+       u32 i;
+#endif /* WL_DRV_AVOID_SCANCACHE */
+       u16 channel;
+       struct ieee80211_supported_band *band;
+
+       WL_DBG((" enter event type : %d, status : %d \n",
+               ntoh32(e->event_type), ntoh32(e->status)));
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       mutex_lock(&cfg->scan_sync);
+
+       if (cfg->loc.in_progress) {
+               /* Listen in progress */
+               if ((status == WLC_E_STATUS_SUCCESS) || (status == WLC_E_STATUS_ABORT)) {
+                       if (delayed_work_pending(&cfg->loc.work)) {
+                               cancel_delayed_work_sync(&cfg->loc.work);
+                       }
+                       err = wl_cfgscan_notify_listen_complete(cfg);
+                       goto exit;
+               } else {
+                       WL_DBG(("Listen in progress. Unknown status. %d\n", status));
+               }
+       }
+
+       /* P2P SCAN is coming from primary interface */
+       if (wl_get_p2p_status(cfg, SCANNING)) {
+               if (wl_get_drv_status_all(cfg, SENDING_ACT_FRM))
+                       ndev = cfg->afx_hdl->dev;
+               else
+                       ndev = cfg->escan_info.ndev;
+       }
+       escan_result = (wl_escan_result_t *)data;
+       if (!escan_result) {
+               WL_ERR(("Invalid escan result (NULL data)\n"));
+               goto exit;
+       }
+#ifdef WL_BCNRECV
+       if (cfg->bcnrecv_info.bcnrecv_state == BEACON_RECV_STARTED &&
+               status == WLC_E_STATUS_RXBCN) {
+               /* handle beacon recv scan results */
+               wl_bss_info_v109_2_t *bi_info;
+               bi_info = (wl_bss_info_v109_2_t *)escan_result->bss_info;
+               err = wl_bcnrecv_result_handler(cfg, cfgdev, bi_info, status);
+               goto exit;
+       }
+#endif /* WL_BCNRECV */
+       if (!ndev || (!wl_get_drv_status(cfg, SCANNING, ndev) && !cfg->sched_scan_running)) {
+               WL_ERR_RLMT(("escan is not ready. drv_scan_status 0x%x"
+                       " e_type %d e_states %d\n",
+                       wl_get_drv_status(cfg, SCANNING, ndev),
+                       ntoh32(e->event_type), ntoh32(e->status)));
+               goto exit;
+       }
+
+#ifndef WL_DRV_AVOID_SCANCACHE
+       if (wl_escan_check_sync_id(cfg, status, escan_result->sync_id,
+                       cfg->escan_info.cur_sync_id) < 0) {
+                       goto exit;
+       }
+
+       if (status == WLC_E_STATUS_PARTIAL) {
+               WL_DBG(("WLC_E_STATUS_PARTIAL \n"));
+               DBG_EVENT_LOG((dhd_pub_t *)cfg->pub, WIFI_EVENT_DRIVER_SCAN_RESULT_FOUND);
+               if ((dtoh32(escan_result->buflen) > (int)ESCAN_BUF_SIZE) ||
+                   (dtoh32(escan_result->buflen) < sizeof(wl_escan_result_t))) {
+                       WL_ERR(("Invalid escan buffer len:%d\n", dtoh32(escan_result->buflen)));
+                       goto exit;
+               }
+               if (dtoh16(escan_result->bss_count) != 1) {
+                       WL_ERR(("Invalid bss_count %d: ignoring\n", escan_result->bss_count));
+                       goto exit;
+               }
+               bi = escan_result->bss_info;
+               if (!bi) {
+                       WL_ERR(("Invalid escan bss info (NULL pointer)\n"));
+                       goto exit;
+               }
+               bi_length = dtoh32(bi->length);
+               if (bi_length != (dtoh32(escan_result->buflen) - WL_ESCAN_RESULTS_FIXED_SIZE)) {
+                       WL_ERR(("Invalid bss_info length %d: ignoring\n", bi_length));
+                       goto exit;
+               }
+
+               /* +++++ terence 20130524: skip invalid bss */
+               channel =
+                       bi->ctl_ch ? bi->ctl_ch : CHSPEC_CHANNEL(wl_chspec_driver_to_host(bi->chanspec));
+               if (channel <= CH_MAX_2G_CHANNEL)
+                       band = bcmcfg_to_wiphy(cfg)->bands[IEEE80211_BAND_2GHZ];
+               else
+                       band = bcmcfg_to_wiphy(cfg)->bands[IEEE80211_BAND_5GHZ];
+               if (!band) {
+                       WL_ERR(("No valid band\n"));
+                       goto exit;
+               }
+               if (!dhd_conf_match_channel(cfg->pub, channel))
+                       goto exit;
+               /* ----- terence 20130524: skip invalid bss */
+
+               if (!(bcmcfg_to_wiphy(cfg)->interface_modes & BIT(NL80211_IFTYPE_ADHOC))) {
+                       if (dtoh16(bi->capability) & DOT11_CAP_IBSS) {
+                               WL_DBG(("Ignoring IBSS result\n"));
+                               goto exit;
+                       }
+               }
+
+               if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+                       p2p_dev_addr = wl_cfgp2p_retreive_p2p_dev_addr(bi, bi_length);
+                       if (p2p_dev_addr && !memcmp(p2p_dev_addr,
+                               cfg->afx_hdl->tx_dst_addr.octet, ETHER_ADDR_LEN)) {
+                               s32 channel = wf_chspec_ctlchan(
+                                       wl_chspec_driver_to_host(bi->chanspec));
+
+                               if ((channel > MAXCHANNEL) || (channel <= 0))
+                                       channel = WL_INVALID;
+                               else
+                                       WL_ERR(("ACTION FRAME SCAN : Peer " MACDBG " found,"
+                                               " channel : %d\n",
+                                               MAC2STRDBG(cfg->afx_hdl->tx_dst_addr.octet),
+                                               channel));
+
+                               wl_clr_p2p_status(cfg, SCANNING);
+                               cfg->afx_hdl->peer_chan = channel;
+                               complete(&cfg->act_frm_scan);
+                               goto exit;
+                       }
+
+               } else {
+                       int cur_len = WL_SCAN_RESULTS_FIXED_SIZE;
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+                       removal_element_t candidate[BUF_OVERFLOW_MGMT_COUNT];
+                       int remove_lower_rssi = FALSE;
+
+                       bzero(candidate, sizeof(removal_element_t)*BUF_OVERFLOW_MGMT_COUNT);
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+                       list = wl_escan_get_buf(cfg, FALSE);
+                       if (scan_req_match(cfg)) {
+#ifdef WL_HOST_BAND_MGMT
+                               s32 channel_band = 0;
+                               chanspec_t chspec;
+#endif /* WL_HOST_BAND_MGMT */
+                               /* p2p scan && allow only probe response */
+                               if ((cfg->p2p->search_state != WL_P2P_DISC_ST_SCAN) &&
+                                       (bi->flags & WL_BSS_FLAGS_FROM_BEACON))
+                                       goto exit;
+                               if ((p2p_ie = wl_cfgp2p_find_p2pie(((u8 *) bi) + bi->ie_offset,
+                                       bi->ie_length)) == NULL) {
+                                               WL_ERR(("Couldn't find P2PIE in probe"
+                                                       " response/beacon\n"));
+                                               goto exit;
+                               }
+#ifdef WL_HOST_BAND_MGMT
+                               chspec = wl_chspec_driver_to_host(bi->chanspec);
+                               channel_band = CHSPEC2WLC_BAND(chspec);
+
+                               if ((
+#ifdef WL_6G_BAND
+                                       (cfg->curr_band == WLC_BAND_6G) ||
+#endif /* WL_6G_BAND */
+                                       (cfg->curr_band == WLC_BAND_5G)) &&
+                                       (channel_band == WLC_BAND_2G)) {
+                                       /* Avoid sending the GO results in band conflict */
+                                       if (wl_cfgp2p_retreive_p2pattrib(p2p_ie,
+                                               P2P_SEID_GROUP_ID) != NULL)
+                                               goto exit;
+                               }
+#endif /* WL_HOST_BAND_MGMT */
+                       }
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+                       if (bi_length > ESCAN_BUF_SIZE - list->buflen)
+                               remove_lower_rssi = TRUE;
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+                       for (i = 0; i < list->count; i++) {
+                               bss = bss ? (wl_bss_info_t *)((uintptr)bss + dtoh32(bss->length))
+                                       : list->bss_info;
+                               if (!bss) {
+                                       WL_ERR(("bss is NULL\n"));
+                                       goto exit;
+                               }
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+                               WL_DBG(("%s("MACDBG"), i=%d bss: RSSI %d list->count %d\n",
+                                       bss->SSID, MAC2STRDBG(bss->BSSID.octet),
+                                       i, bss->RSSI, list->count));
+
+                               if (remove_lower_rssi)
+                                       wl_cfg80211_find_removal_candidate(bss, candidate);
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+                               if (!bcmp(&bi->BSSID, &bss->BSSID, ETHER_ADDR_LEN) &&
+                                       (CHSPEC_BAND(wl_chspec_driver_to_host(bi->chanspec))
+                                       == CHSPEC_BAND(wl_chspec_driver_to_host(bss->chanspec))) &&
+                                       bi->SSID_len == bss->SSID_len &&
+                                       !bcmp(bi->SSID, bss->SSID, bi->SSID_len)) {
+
+                                       /* do not allow beacon data to update
+                                       *the data recd from a probe response
+                                       */
+                                       if (!(bss->flags & WL_BSS_FLAGS_FROM_BEACON) &&
+                                               (bi->flags & WL_BSS_FLAGS_FROM_BEACON))
+                                               goto exit;
+
+                                       WL_DBG(("%s("MACDBG"), i=%d prev: RSSI %d"
+                                               " flags 0x%x, new: RSSI %d flags 0x%x\n",
+                                               bss->SSID, MAC2STRDBG(bi->BSSID.octet), i,
+                                               bss->RSSI, bss->flags, bi->RSSI, bi->flags));
+
+                                       if ((bss->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL) ==
+                                               (bi->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL)) {
+                                               /* preserve max RSSI if the measurements are
+                                               * both on-channel or both off-channel
+                                               */
+                                               WL_DBG(("%s("MACDBG"), same onchan"
+                                               ", RSSI: prev %d new %d\n",
+                                               bss->SSID, MAC2STRDBG(bi->BSSID.octet),
+                                               bss->RSSI, bi->RSSI));
+                                               bi->RSSI = MAX(bss->RSSI, bi->RSSI);
+                                       } else if ((bss->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL) &&
+                                               (bi->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL) == 0) {
+                                               /* preserve the on-channel rssi measurement
+                                               * if the new measurement is off channel
+                                               */
+                                               WL_DBG(("%s("MACDBG"), prev onchan"
+                                               ", RSSI: prev %d new %d\n",
+                                               bss->SSID, MAC2STRDBG(bi->BSSID.octet),
+                                               bss->RSSI, bi->RSSI));
+                                               bi->RSSI = bss->RSSI;
+                                               bi->flags |= WL_BSS_FLAGS_RSSI_ONCHANNEL;
+                                       }
+                                       if (dtoh32(bss->length) != bi_length) {
+                                               u32 prev_len = dtoh32(bss->length);
+
+                                               WL_DBG(("bss info replacement"
+                                                       " is occured(bcast:%d->probresp%d)\n",
+                                                       bss->ie_length, bi->ie_length));
+                                               WL_DBG(("%s("MACDBG"), replacement!(%d -> %d)\n",
+                                               bss->SSID, MAC2STRDBG(bi->BSSID.octet),
+                                               prev_len, bi_length));
+
+                                               if ((list->buflen - prev_len) + bi_length
+                                                       > ESCAN_BUF_SIZE) {
+                                                       WL_ERR(("Buffer is too small: keep the"
+                                                               " previous result of this AP\n"));
+                                                       /* Only update RSSI */
+                                                       bss->RSSI = bi->RSSI;
+                                                       bss->flags |= (bi->flags
+                                                               & WL_BSS_FLAGS_RSSI_ONCHANNEL);
+                                                       goto exit;
+                                               }
+
+                                               if (i < list->count - 1) {
+                                                       /* memory copy required by this case only */
+                                                       memmove((u8 *)bss + bi_length,
+                                                               (u8 *)bss + prev_len,
+                                                               list->buflen - cur_len - prev_len);
+                                               }
+                                               list->buflen -= prev_len;
+                                               list->buflen += bi_length;
+                                       }
+                                       list->version = dtoh32(bi->version);
+                                       /* In the above code under check
+                                       *  '(dtoh32(bss->length) != bi_length)'
+                                       * buffer overflow is avoided. bi_length
+                                       * is already accounted in list->buflen
+                                       */
+                                       if ((err = memcpy_s((u8 *)bss,
+                                               (ESCAN_BUF_SIZE - (list->buflen - bi_length)),
+                                               (u8 *)bi, bi_length)) != BCME_OK) {
+                                               WL_ERR(("Failed to copy the recent bss_info."
+                                                       "err:%d recv_len:%d bi_len:%d\n", err,
+                                                       ESCAN_BUF_SIZE - (list->buflen - bi_length),
+                                                       bi_length));
+                                               /* This scenario should never happen. If it happens,
+                                                * set list->count to zero for recovery
+                                                */
+                                               list->count = 0;
+                                               list->buflen = 0;
+                                               ASSERT(0);
+                                       }
+                                       goto exit;
+                               }
+                               cur_len += dtoh32(bss->length);
+                       }
+                       if (bi_length > ESCAN_BUF_SIZE - list->buflen) {
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+                               wl_cfg80211_remove_lowRSSI_info(list, candidate, bi);
+                               if (bi_length > ESCAN_BUF_SIZE - list->buflen) {
+                                       WL_DBG(("RSSI(" MACDBG ") is too low(%d) to add Buffer\n",
+                                               MAC2STRDBG(bi->BSSID.octet), bi->RSSI));
+                                       goto exit;
+                               }
+#else
+                               WL_ERR(("Buffer is too small: ignoring\n"));
+                               goto exit;
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+                       }
+                       /* In the previous step check is added to ensure the bi_legth does not
+                       * exceed the ESCAN_BUF_SIZE
+                       */
+                       (void)memcpy_s(&(((char *)list)[list->buflen]),
+                               (ESCAN_BUF_SIZE - list->buflen), bi, bi_length);
+                       list->version = dtoh32(bi->version);
+                       list->buflen += bi_length;
+                       list->count++;
+
+                       /*
+                        * !Broadcast && number of ssid = 1 && number of channels =1
+                        * means specific scan to association
+                        */
+                       if (wl_cfgp2p_is_p2p_specific_scan(cfg->scan_request)) {
+                               WL_ERR(("P2P assoc scan fast aborted.\n"));
+                               wl_notify_escan_complete(cfg, cfg->escan_info.ndev, false, true);
+                               goto exit;
+                       }
+               }
+       }
+       else if (status == WLC_E_STATUS_SUCCESS) {
+               cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+#ifdef DHD_SEND_HANG_ESCAN_SYNCID_MISMATCH
+               cfg->escan_info.prev_escan_aborted = FALSE;
+#endif /* DHD_SEND_HANG_ESCAN_SYNCID_MISMATCH */
+               if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+                       WL_DBG(("ACTION FRAME SCAN DONE\n"));
+                       wl_clr_p2p_status(cfg, SCANNING);
+                       wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+                       if (cfg->afx_hdl->peer_chan == WL_INVALID)
+                               complete(&cfg->act_frm_scan);
+               } else if ((likely(cfg->scan_request)) || (cfg->sched_scan_running)) {
+                       WL_INFORM_MEM(("ESCAN COMPLETED\n"));
+                       DBG_EVENT_LOG((dhd_pub_t *)cfg->pub, WIFI_EVENT_DRIVER_SCAN_COMPLETE);
+                       cfg->bss_list = wl_escan_get_buf(cfg, FALSE);
+                       if (!scan_req_match(cfg)) {
+                               WL_DBG(("SCAN COMPLETED: scanned AP count=%d\n",
+                                       cfg->bss_list->count));
+                       }
+                       wl_inform_bss(cfg);
+                       wl_notify_escan_complete(cfg, ndev, false, false);
+               }
+               wl_escan_increment_sync_id(cfg, SCAN_BUF_NEXT);
+#ifdef CUSTOMER_HW4_DEBUG
+               if (wl_scan_timeout_dbg_enabled)
+                       wl_scan_timeout_dbg_clear();
+#endif /* CUSTOMER_HW4_DEBUG */
+       } else if ((status == WLC_E_STATUS_ABORT) || (status == WLC_E_STATUS_NEWSCAN) ||
+               (status == WLC_E_STATUS_11HQUIET) || (status == WLC_E_STATUS_CS_ABORT) ||
+               (status == WLC_E_STATUS_NEWASSOC)) {
+               /* Dump FW preserve buffer content */
+               if (status == WLC_E_STATUS_ABORT) {
+                       wl_flush_fw_log_buffer(ndev, FW_LOGSET_MASK_ALL);
+               }
+               /* Handle all cases of scan abort */
+               cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+               WL_DBG(("ESCAN ABORT reason: %d\n", status));
+               if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+                       WL_DBG(("ACTION FRAME SCAN DONE\n"));
+                       wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+                       wl_clr_p2p_status(cfg, SCANNING);
+                       if (cfg->afx_hdl->peer_chan == WL_INVALID)
+                               complete(&cfg->act_frm_scan);
+               } else if ((likely(cfg->scan_request)) || (cfg->sched_scan_running)) {
+                       WL_INFORM_MEM(("ESCAN ABORTED\n"));
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+                       if (p2p_scan(cfg) && cfg->scan_request &&
+                               (cfg->scan_request->flags & NL80211_SCAN_FLAG_FLUSH)) {
+                               WL_ERR(("scan list is changed"));
+                               cfg->bss_list = wl_escan_get_buf(cfg, FALSE);
+                       } else
+#endif
+                               cfg->bss_list = wl_escan_get_buf(cfg, TRUE);
+
+                       if (!scan_req_match(cfg)) {
+                               WL_TRACE_HW4(("SCAN ABORTED: scanned AP count=%d\n",
+                                       cfg->bss_list->count));
+                       }
+#ifdef DUAL_ESCAN_RESULT_BUFFER
+                       if (escan_result->sync_id != cfg->escan_info.cur_sync_id) {
+                               /* If sync_id is not matching, then the abort might have
+                                * come for the old scan req or for the in-driver initiated
+                                * scan. So do abort for scan_req for which sync_id is
+                                * matching.
+                                */
+                               WL_INFORM_MEM(("sync_id mismatch (%d != %d). "
+                                       "Ignore the scan abort event.\n",
+                                       escan_result->sync_id, cfg->escan_info.cur_sync_id));
+                               goto exit;
+                       } else {
+                               /* sync id is matching, abort the scan */
+                               WL_INFORM_MEM(("scan aborted for sync_id: %d \n",
+                                       cfg->escan_info.cur_sync_id));
+                               wl_inform_bss(cfg);
+                               wl_notify_escan_complete(cfg, ndev, true, false);
+                       }
+#else
+                       wl_inform_bss(cfg);
+                       wl_notify_escan_complete(cfg, ndev, true, false);
+#endif /* DUAL_ESCAN_RESULT_BUFFER */
+               } else {
+                       /* If there is no pending host initiated scan, do nothing */
+                       WL_DBG(("ESCAN ABORT: No pending scans. Ignoring event.\n"));
+               }
+               /* scan aborted, need to set previous success result */
+               wl_escan_increment_sync_id(cfg, SCAN_BUF_CNT);
+       } else if (status == WLC_E_STATUS_TIMEOUT) {
+               WL_ERR(("WLC_E_STATUS_TIMEOUT : scan_request[%p]\n", cfg->scan_request));
+               WL_ERR(("reason[0x%x]\n", e->reason));
+               if (e->reason == 0xFFFFFFFF) {
+                       wl_notify_escan_complete(cfg, cfg->escan_info.ndev, true, true);
+               }
+       } else {
+               WL_ERR(("unexpected Escan Event %d : abort\n", status));
+               cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+               if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+                       WL_DBG(("ACTION FRAME SCAN DONE\n"));
+                       wl_clr_p2p_status(cfg, SCANNING);
+                       wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+                       if (cfg->afx_hdl->peer_chan == WL_INVALID)
+                               complete(&cfg->act_frm_scan);
+               } else if ((likely(cfg->scan_request)) || (cfg->sched_scan_running)) {
+                       cfg->bss_list = wl_escan_get_buf(cfg, TRUE);
+                       if (!scan_req_match(cfg)) {
+                               WL_TRACE_HW4(("SCAN ABORTED(UNEXPECTED): "
+                                       "scanned AP count=%d\n",
+                                       cfg->bss_list->count));
+                       }
+                       wl_inform_bss(cfg);
+                       wl_notify_escan_complete(cfg, ndev, true, false);
+               }
+               /* scan aborted, need to set previous success result */
+               wl_escan_increment_sync_id(cfg, 2);
+       }
+#else /* WL_DRV_AVOID_SCANCACHE */
+       err = wl_escan_without_scan_cache(cfg, escan_result, ndev, e, status);
+#endif /* WL_DRV_AVOID_SCANCACHE */
+exit:
+       mutex_unlock(&cfg->scan_sync);
+       return err;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) && \
+       defined(SUPPORT_RANDOM_MAC_SCAN)
+static const u8 *
+wl_retrieve_wps_attribute(const u8 *buf, u16 element_id)
+{
+       const wl_wps_ie_t *ie = NULL;
+       u16 len = 0;
+       const u8 *attrib;
+
+       if (!buf) {
+               WL_ERR(("WPS IE not present"));
+               return 0;
+       }
+
+       ie = (const wl_wps_ie_t*) buf;
+       len = ie->len;
+
+       /* Point subel to the P2P IE's subelt field.
+        * Subtract the preceding fields (id, len, OUI, oui_type) from the length.
+        */
+       attrib = ie->attrib;
+       len -= 4;       /* exclude OUI + OUI_TYPE */
+
+       /* Search for attrib */
+       return wl_find_attribute(attrib, len, element_id);
+}
+
+bool
+wl_is_wps_enrollee_active(struct net_device *ndev, const u8 *ie_ptr, u16 len)
+{
+       const u8 *ie;
+       const u8 *attrib;
+
+       if ((ie = (const u8 *)wl_cfgp2p_find_wpsie(ie_ptr, len)) == NULL) {
+               WL_DBG(("WPS IE not present. Do nothing.\n"));
+               return false;
+       }
+
+       if ((attrib = wl_retrieve_wps_attribute(ie, WPS_ATTR_REQ_TYPE)) == NULL) {
+               WL_DBG(("WPS_ATTR_REQ_TYPE not found!\n"));
+               return false;
+       }
+
+       if (*attrib == WPS_REQ_TYPE_ENROLLEE) {
+               WL_INFORM_MEM(("WPS Enrolle Active\n"));
+               return true;
+       } else {
+               WL_DBG(("WPS_REQ_TYPE:%d\n", *attrib));
+       }
+
+       return false;
+}
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3, 19, 0) && defined(SUPPORT_RANDOM_MAC_SCAN) */
+
+/* Find listen channel */
+static s32 wl_find_listen_channel(struct bcm_cfg80211 *cfg,
+       const u8 *ie, u32 ie_len)
+{
+       const wifi_p2p_ie_t *p2p_ie;
+       const u8 *end, *pos;
+       s32 listen_channel;
+
+       pos = (const u8 *)ie;
+
+       p2p_ie = wl_cfgp2p_find_p2pie(pos, ie_len);
+
+       if (p2p_ie == NULL) {
+               return 0;
+       }
+
+       if (p2p_ie->len < MIN_P2P_IE_LEN || p2p_ie->len > MAX_P2P_IE_LEN) {
+               CFGP2P_ERR(("p2p_ie->len out of range - %d\n", p2p_ie->len));
+               return 0;
+       }
+       pos = p2p_ie->subelts;
+       end = p2p_ie->subelts + (p2p_ie->len - 4);
+
+       CFGP2P_DBG((" found p2p ie ! lenth %d \n",
+               p2p_ie->len));
+
+       while (pos < end) {
+               uint16 attr_len;
+               if (pos + 2 >= end) {
+                       CFGP2P_DBG((" -- Invalid P2P attribute"));
+                       return 0;
+               }
+               attr_len = ((uint16) (((pos + 1)[1] << 8) | (pos + 1)[0]));
+
+               if (pos + 3 + attr_len > end) {
+                       CFGP2P_DBG(("P2P: Attribute underflow "
+                                  "(len=%u left=%d)",
+                                  attr_len, (int) (end - pos - 3)));
+                       return 0;
+               }
+
+               /* if Listen Channel att id is 6 and the vailue is valid,
+                * return the listen channel
+                */
+               if (pos[0] == 6) {
+                       /* listen channel subel length format
+                        * 1(id) + 2(len) + 3(country) + 1(op. class) + 1(chan num)
+                        */
+                       listen_channel = pos[1 + 2 + 3 + 1];
+
+                       if (listen_channel == SOCIAL_CHAN_1 ||
+                               listen_channel == SOCIAL_CHAN_2 ||
+                               listen_channel == SOCIAL_CHAN_3) {
+                               CFGP2P_DBG((" Found my Listen Channel %d \n", listen_channel));
+                               return listen_channel;
+                       }
+               }
+               pos += 3 + attr_len;
+       }
+       return 0;
+}
+
+#ifdef WL_SCAN_TYPE
+static u32
+wl_cfgscan_map_nl80211_scan_type(struct bcm_cfg80211 *cfg, struct cfg80211_scan_request *request)
+{
+       u32 scan_flags = 0;
+
+       if (!request) {
+               return scan_flags;
+       }
+
+       if (request->flags & NL80211_SCAN_FLAG_LOW_SPAN) {
+               scan_flags |= WL_SCANFLAGS_LOW_SPAN;
+       }
+       if (request->flags & NL80211_SCAN_FLAG_HIGH_ACCURACY) {
+               scan_flags |= WL_SCANFLAGS_HIGH_ACCURACY;
+       }
+       if (request->flags & NL80211_SCAN_FLAG_LOW_POWER) {
+               scan_flags |= WL_SCANFLAGS_LOW_POWER_SCAN;
+       }
+       if (request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) {
+               scan_flags |= WL_SCANFLAGS_LOW_PRIO;
+       }
+
+       WL_INFORM(("scan flags. wl:%x cfg80211:%x\n", scan_flags, request->flags));
+       return scan_flags;
+}
+#endif /* WL_SCAN_TYPE */
+
+chanspec_t wl_freq_to_chanspec(int freq)
+{
+       chanspec_t chanspec = 0;
+       u16 bw;
+
+       /* see 802.11 17.3.8.3.2 and Annex J */
+       if (freq == 2484) {
+               chanspec = 14;
+               chanspec |= WL_CHANSPEC_BAND_2G;
+               bw = WL_CHANSPEC_BW_20;
+       } else if (freq < 2484) {
+               chanspec = (freq - 2407) / 5;
+               chanspec |= WL_CHANSPEC_BAND_2G;
+               bw = WL_CHANSPEC_BW_20;
+       } else if (freq >= 4910 && freq <= 4980) {
+               chanspec = (freq - 4000) / 5;
+               chanspec |= WL_CHANSPEC_BAND_5G;
+               bw = WL_CHANSPEC_BW_20;
+       } else if (freq < 5940) {
+               chanspec = (freq - 5000) / 5;
+               chanspec |= WL_CHANSPEC_BAND_5G;
+               bw = WL_CHANSPEC_BW_20;
+#ifdef WL_6G_BAND
+       } else if (freq <= 45000) { /* DMG band lower limit */
+               /* see 802.11ax D4.1 27.3.22.2 */
+               chanspec = (freq - 5940) / 5;
+               bw = WL_CHANSPEC_BW_20;
+               if ((chanspec % 8) == 3) {
+                       bw = WL_CHANSPEC_BW_40;
+               } else if ((chanspec % 16) == 7) {
+                       bw = WL_CHANSPEC_BW_80;
+               } else if ((chanspec % 32) == 15) {
+                       bw = WL_CHANSPEC_BW_160;
+               }
+               chanspec |= WL_CHANSPEC_BAND_6G;
+       } else if (freq >= 58320 && freq <= 70200) {
+               chanspec = (freq - 56160) / 2160;
+               chanspec |= WL_CHANSPEC_BAND_6G;
+               bw = WL_CHANSPEC_BW_20;
+#endif /* WL_6G_BAND */
+       } else {
+               WL_ERR(("Invalid frequency \n"));
+               return INVCHANSPEC;
+       }
+
+       /* Get the min_bw set for the interface */
+       chanspec |= bw;
+       chanspec |= WL_CHANSPEC_CTL_SB_NONE;
+
+       return chanspec;
+}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+#define IS_RADAR_CHAN(flags) (flags & (IEEE80211_CHAN_RADAR | IEEE80211_CHAN_PASSIVE_SCAN))
+#else
+#define IS_RADAR_CHAN(flags) (flags & (IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IR))
+#endif
+static void
+wl_cfgscan_populate_scan_channels(struct bcm_cfg80211 *cfg,
+       struct ieee80211_channel **channels, u32 n_channels,
+       u16 *channel_list, u32 *num_channels, bool use_chanspecs, bool skip_dfs)
+{
+       u32 i = 0, j = 0;
+       u32 chanspec = 0;
+       struct wireless_dev *wdev;
+       bool is_p2p_scan = false;
+#ifdef P2P_SKIP_DFS
+       int is_printed = false;
+#endif /* P2P_SKIP_DFS */
+       u32 channel;
+
+       if (!channels || !n_channels) {
+               /* Do full channel scan */
+               return;
+       }
+
+        wdev = GET_SCAN_WDEV(cfg->scan_request);
+       if (!skip_dfs && wdev && wdev->netdev &&
+                       (wdev->netdev != bcmcfg_to_prmry_ndev(cfg))) {
+               /* SKIP DFS channels for Secondary interface */
+               skip_dfs = true;
+       }
+
+       /* Check if request is for p2p scans */
+       is_p2p_scan = p2p_is_on(cfg) && p2p_scan(cfg);
+
+       for (i = 0; i < n_channels; i++) {
+               channel = ieee80211_frequency_to_channel(channels[i]->center_freq);
+               if (skip_dfs && (IS_RADAR_CHAN(channels[i]->flags))) {
+                       WL_DBG(("Skipping radar channel. freq:%d\n",
+                               (channels[i]->center_freq)));
+                       continue;
+               }
+               if (!dhd_conf_match_channel(cfg->pub, channel))
+                       continue;
+
+               chanspec = wl_freq_to_chanspec(channels[i]->center_freq);
+               if (chanspec == INVCHANSPEC) {
+                       WL_ERR(("Invalid chanspec! Skipping channel\n"));
+                       continue;
+               }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+               if (channels[i]->band == IEEE80211_BAND_60GHZ) {
+                       /* Not supported */
+                       continue;
+               }
+#endif /* LINUX_VER >= 3.6 */
+#ifdef WL_HOST_BAND_MGMT
+               if (channels[i]->band == IEEE80211_BAND_2GHZ) {
+                       if ((cfg->curr_band == WLC_BAND_5G) ||
+                               (cfg->curr_band == WLC_BAND_6G)) {
+                               if !(is_p2p_scan &&
+                                       IS_P2P_SOCIAL_CHANNEL(CHSPEC_CHANNEL(chanspec))) {
+                                       WL_DBG(("In 5G only mode, omit 2G channel:%d\n", channel));
+                                       continue;
+                               }
+                       }
+               } else {
+                       if (cfg->curr_band == WLC_BAND_2G) {
+                               WL_DBG(("In 2G only mode, omit 5G channel:%d\n", channel));
+                               continue;
+                       }
+               }
+#endif /* WL_HOST_BAND_MGMT */
+
+               if (is_p2p_scan) {
+#ifndef WL_P2P_6G
+                       if (CHSPEC_IS6G(chanspec)) {
+                               continue;
+                       }
+#endif /* WL_P2P_6G */
+#ifdef P2P_SKIP_DFS
+                       if (CHSPEC_IS5G(chanspec) &&
+                               (CHSPEC_CHANNEL(chanspec) >= 52 &&
+                               CHSPEC_CHANNEL(chanspec) <= 144)) {
+                               if (is_printed == false) {
+                                       WL_ERR(("SKIP DFS CHANs(52~144)\n"));
+                                       is_printed = true;
+                               }
+                               continue;
+                       }
+#endif /* P2P_SKIP_DFS */
+               }
+
+               if (use_chanspecs) {
+                       channel_list[j] = chanspec;
+               } else {
+                       channel_list[j] = CHSPEC_CHANNEL(chanspec);
+               }
+               WL_SCAN(("Channel/Chanspec: %x \n", channel_list[j]));
+               j++;
+               if (j == WL_NUMCHANSPECS) {
+                       /* max limit */
+                       break;
+               }
+       }
+       *num_channels = j;
+}
+
+static void
+wl_cfgscan_populate_scan_ssids(struct bcm_cfg80211 *cfg, u8 *buf_ptr, u32 buf_len,
+       struct cfg80211_scan_request *request, u32 *ssid_num)
+{
+       u32 n_ssids;
+       wlc_ssid_t ssid;
+       int i, j = 0;
+
+       if (!request || !buf_ptr) {
+               /* Do full channel scan */
+               return;
+       }
+
+       n_ssids = request->n_ssids;
+       if (n_ssids > 0) {
+
+               if (buf_len < (n_ssids * sizeof(wlc_ssid_t))) {
+                       WL_ERR(("buf len not sufficient for scan ssids\n"));
+                       return;
+               }
+
+               for (i = 0; i < n_ssids; i++) {
+                       bzero(&ssid, sizeof(wlc_ssid_t));
+                       ssid.SSID_len = MIN(request->ssids[i].ssid_len, DOT11_MAX_SSID_LEN);
+                       /* Returning void here, as per previous line copy length does not exceed
+                       * DOT11_MAX_SSID_LEN
+                       */
+                       (void)memcpy_s(ssid.SSID, DOT11_MAX_SSID_LEN, request->ssids[i].ssid,
+                               ssid.SSID_len);
+                       if (!ssid.SSID_len) {
+                               WL_SCAN(("%d: Broadcast scan\n", i));
+                       } else {
+                               WL_SCAN(("%d: scan  for  %s size =%d\n", i,
+                               ssid.SSID, ssid.SSID_len));
+                       }
+                       /* For multiple ssid case copy the each SSID info the ptr below corresponds
+                       * to that so dest is of type wlc_ssid_t
+                       */
+                       (void)memcpy_s(buf_ptr, sizeof(wlc_ssid_t), &ssid, sizeof(wlc_ssid_t));
+                       buf_ptr += sizeof(wlc_ssid_t);
+                       j++;
+               }
+       } else {
+               WL_SCAN(("Broadcast scan\n"));
+       }
+       *ssid_num = j;
+}
+
+static s32
+wl_scan_prep(struct bcm_cfg80211 *cfg, void *scan_params, u32 len,
+       struct cfg80211_scan_request *request)
+{
+       wl_scan_params_t *params = NULL;
+       wl_scan_params_v2_t *params_v2 = NULL;
+       u32 scan_type = 0;
+       u32 scan_param_size = 0;
+       u32 n_channels = 0;
+       u32 n_ssids = 0;
+       uint16 *chan_list = NULL;
+       u32 channel_offset = 0;
+       u32 cur_offset;
+
+       if (!scan_params) {
+               return BCME_ERROR;
+       }
+
+       if (cfg->active_scan == PASSIVE_SCAN) {
+               WL_INFORM_MEM(("Enforcing passive scan\n"));
+               scan_type = WL_SCANFLAGS_PASSIVE;
+       }
+
+       WL_DBG(("Preparing Scan request\n"));
+       if (cfg->scan_params_v2) {
+               params_v2 = (wl_scan_params_v2_t *)scan_params;
+               scan_param_size = sizeof(wl_scan_params_v2_t);
+               channel_offset = offsetof(wl_scan_params_v2_t, channel_list);
+       } else {
+               params = (wl_scan_params_t *)scan_params;
+               scan_param_size = sizeof(wl_scan_params_t);
+               channel_offset = offsetof(wl_scan_params_t, channel_list);
+       }
+
+       if (params_v2) {
+               /* scan params ver2 */
+#if defined(WL_SCAN_TYPE)
+               scan_type  += wl_cfgscan_map_nl80211_scan_type(cfg, request);
+#endif /* WL_SCAN_TYPE */
+
+               (void)memcpy_s(&params_v2->bssid, ETHER_ADDR_LEN, &ether_bcast, ETHER_ADDR_LEN);
+               params_v2->version = htod16(WL_SCAN_PARAMS_VERSION_V2);
+               params_v2->length = htod16(sizeof(wl_scan_params_v2_t));
+               params_v2->bss_type = DOT11_BSSTYPE_ANY;
+               params_v2->scan_type = htod32(scan_type);
+               params_v2->nprobes = htod32(-1);
+               params_v2->active_time = htod32(-1);
+               params_v2->passive_time = htod32(-1);
+               params_v2->home_time = htod32(-1);
+               params_v2->channel_num = 0;
+               bzero(&params_v2->ssid, sizeof(wlc_ssid_t));
+               chan_list = params_v2->channel_list;
+       } else {
+               /* scan params ver 1 */
+               if (!params) {
+                       ASSERT(0);
+                       return BCME_ERROR;
+               }
+               (void)memcpy_s(&params->bssid, ETHER_ADDR_LEN, &ether_bcast, ETHER_ADDR_LEN);
+               params->bss_type = DOT11_BSSTYPE_ANY;
+               params->scan_type = 0;
+               params->nprobes = htod32(-1);
+               params->active_time = htod32(-1);
+               params->passive_time = htod32(-1);
+               params->home_time = htod32(-1);
+               params->channel_num = 0;
+               bzero(&params->ssid, sizeof(wlc_ssid_t));
+               chan_list = params->channel_list;
+       }
+
+       if (!request) {
+               /* scan_request null, do scan based on base config */
+               WL_DBG(("scan_request is null\n"));
+               return BCME_OK;
+       }
+
+       WL_INFORM(("n_channels:%d n_ssids:%d\n", request->n_channels, request->n_ssids));
+
+       cur_offset = channel_offset;
+       /* Copy channel array if applicable */
+       if ((request->n_channels > 0) && chan_list) {
+               if (len >= (scan_param_size + (request->n_channels * sizeof(u16)))) {
+                       wl_cfgscan_populate_scan_channels(cfg,
+                                       request->channels, request->n_channels,
+                                       chan_list, &n_channels, true, false);
+                       cur_offset += (uint32)(n_channels * (sizeof(u16)));
+               }
+       }
+
+       /* Copy ssid array if applicable */
+       if (request->n_ssids > 0) {
+               cur_offset = (u32) roundup(cur_offset, sizeof(u32));
+               if (len > (cur_offset + (request->n_ssids * sizeof(wlc_ssid_t)))) {
+                       u32 rem_len = len - cur_offset;
+                       wl_cfgscan_populate_scan_ssids(cfg,
+                               ((u8 *)scan_params + cur_offset), rem_len, request, &n_ssids);
+               }
+       }
+
+       if (n_ssids || n_channels) {
+               u32 channel_num =
+                               htod32((n_ssids << WL_SCAN_PARAMS_NSSID_SHIFT) |
+                               (n_channels & WL_SCAN_PARAMS_COUNT_MASK));
+               if (params_v2) {
+                       params_v2->channel_num = channel_num;
+                       if (n_channels == 1) {
+                               params_v2->active_time = htod32(WL_SCAN_CONNECT_DWELL_TIME_MS);
+                               params_v2->nprobes = htod32(
+                                       params_v2->active_time / WL_SCAN_JOIN_PROBE_INTERVAL_MS);
+                       }
+               } else {
+                       params->channel_num = channel_num;
+                       if (n_channels == 1) {
+                               params->active_time = htod32(WL_SCAN_CONNECT_DWELL_TIME_MS);
+                               params->nprobes = htod32(
+                                       params->active_time / WL_SCAN_JOIN_PROBE_INTERVAL_MS);
+                       }
+               }
+       }
+
+       WL_DBG_MEM(("scan_prep done. n_channels:%d n_ssids:%d\n", n_channels, n_ssids));
+       return BCME_OK;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) && \
+       defined(SUPPORT_RANDOM_MAC_SCAN)
+static s32
+wl_config_scan_macaddr(struct bcm_cfg80211 *cfg,
+               struct net_device *ndev, bool randmac_enable, u8 *mac_addr, u8 *mac_addr_mask)
+{
+       s32 err = BCME_OK;
+
+       if (randmac_enable) {
+               if (!cfg->scanmac_enabled) {
+                       err = wl_cfg80211_scan_mac_enable(ndev);
+                       if (unlikely(err)) {
+                               goto exit;
+                       }
+                       WL_DBG(("randmac enabled\n"));
+               }
+
+#ifdef WL_HOST_RANDMAC_CONFIG
+               /* If mask provided, apply user space configuration */
+               if (!mac_addr_mask && !mac_addr && !ETHER_ISNULLADDR(mac_addr_mask)) {
+                       err = wl_cfg80211_scan_mac_config(ndev,
+                               mac_addr, mac_addr_mask);
+                       if (unlikely(err)) {
+                               WL_ERR(("scan mac config failed\n"));
+                               goto exit;
+                       }
+               }
+#endif /* WL_HOST_RANDMAC_CONFIG */
+               if (cfg->scanmac_config) {
+                       /* Use default scanmac configuration */
+                       WL_DBG(("Use host provided scanmac config\n"));
+               } else {
+                       WL_DBG(("Use fw default scanmac config\n"));
+               }
+       } else if (!randmac_enable && cfg->scanmac_enabled) {
+               WL_DBG(("randmac disabled\n"));
+               err = wl_cfg80211_scan_mac_disable(ndev);
+       } else {
+               WL_DBG(("no change in randmac configuration\n"));
+       }
+
+exit:
+       if (err < 0) {
+               if (err == BCME_UNSUPPORTED) {
+                       /* Ignore if chip doesnt support the feature */
+                       err = BCME_OK;
+               } else {
+                       /* For errors other than unsupported fail the scan */
+                       WL_ERR(("%s : failed to configure random mac for host scan, %d\n",
+                               __FUNCTION__, err));
+                       err = -EAGAIN;
+               }
+       }
+
+       return err;
+}
+#endif /* LINUX VER > 3.19 && SUPPORT_RANDOM_MAC_SCAN */
+
+static s32
+wl_run_escan(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       struct cfg80211_scan_request *request, uint16 action)
+{
+       s32 err = BCME_OK;
+       u32 num_chans = 0;
+       u32 n_channels = 0;
+       u32 n_ssids;
+       s32 params_size;
+       wl_escan_params_t *eparams = NULL;
+       wl_escan_params_v2_t *eparams_v2 = NULL;
+       u8 *scan_params = NULL;
+       u8 *params = NULL;
+       s32 search_state = WL_P2P_DISC_ST_SCAN;
+       u16 *default_chan_list = NULL;
+       s32 bssidx = -1;
+       struct net_device *dev = NULL;
+#if defined(USE_INITIAL_2G_SCAN) || defined(USE_INITIAL_SHORT_DWELL_TIME)
+       bool is_first_init_2g_scan = false;
+#endif /* USE_INITIAL_2G_SCAN || USE_INITIAL_SHORT_DWELL_TIME */
+       p2p_scan_purpose_t      p2p_scan_purpose = P2P_SCAN_PURPOSE_MIN;
+       u32 chan_mem = 0;
+       u32 sync_id = 0;
+
+       WL_DBG(("Enter \n"));
+
+       if (!cfg || !request) {
+               err = -EINVAL;
+               goto exit;
+       }
+
+       if (cfg->scan_params_v2) {
+               params_size = (WL_SCAN_PARAMS_V2_FIXED_SIZE +
+                               OFFSETOF(wl_escan_params_v2_t, params));
+       } else {
+               params_size = (WL_SCAN_PARAMS_FIXED_SIZE + OFFSETOF(wl_escan_params_t, params));
+       }
+
+       if (!cfg->p2p_supported || !p2p_scan(cfg)) {
+               /* LEGACY SCAN TRIGGER */
+               WL_SCAN((" LEGACY E-SCAN START\n"));
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) && \
+       defined(SUPPORT_RANDOM_MAC_SCAN)
+       if (request) {
+               bool randmac_enable = (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR);
+               if (wl_is_wps_enrollee_active(ndev, request->ie, request->ie_len)) {
+                       randmac_enable = false;
+               }
+               if ((err = wl_config_scan_macaddr(cfg, ndev, randmac_enable,
+                       request->mac_addr, request->mac_addr_mask)) != BCME_OK) {
+                               WL_ERR(("scanmac addr config failed\n"));
+                       goto exit;
+               }
+       }
+#endif /* KERNEL_VER >= 3.19 && SUPPORT_RANDOM_MAC_SCAN */
+
+#if defined(USE_INITIAL_2G_SCAN) || defined(USE_INITIAL_SHORT_DWELL_TIME)
+               if (ndev == bcmcfg_to_prmry_ndev(cfg) && g_first_broadcast_scan == true) {
+#ifdef USE_INITIAL_2G_SCAN
+                       struct ieee80211_channel tmp_channel_list[CH_MAX_2G_CHANNEL];
+                       /* allow one 5G channel to add previous connected channel in 5G */
+                       bool allow_one_5g_channel = TRUE;
+                       int i, j;
+                       j = 0;
+                       for (i = 0; i < request->n_channels; i++) {
+                               int tmp_chan = ieee80211_frequency_to_channel
+                                       (request->channels[i]->center_freq);
+                               if (tmp_chan > CH_MAX_2G_CHANNEL) {
+                                       if (allow_one_5g_channel)
+                                               allow_one_5g_channel = FALSE;
+                                       else
+                                               continue;
+                               }
+                               if (j > CH_MAX_2G_CHANNEL) {
+                                       WL_ERR(("Index %d exceeds max 2.4GHz channels %d"
+                                               " and previous 5G connected channel\n",
+                                               j, CH_MAX_2G_CHANNEL));
+                                       break;
+                               }
+                               bcopy(request->channels[i], &tmp_channel_list[j],
+                                       sizeof(struct ieee80211_channel));
+                               WL_SCAN(("channel of request->channels[%d]=%d\n", i, tmp_chan));
+                               j++;
+                       }
+                       if ((j > 0) && (j <= CH_MAX_2G_CHANNEL)) {
+                               for (i = 0; i < j; i++)
+                                       bcopy(&tmp_channel_list[i], request->channels[i],
+                                               sizeof(struct ieee80211_channel));
+
+                               request->n_channels = j;
+                               is_first_init_2g_scan = true;
+                       }
+                       else
+                               WL_ERR(("Invalid number of 2.4GHz channels %d\n", j));
+
+                       WL_SCAN(("request->n_channels=%d\n", request->n_channels));
+#else /* USE_INITIAL_SHORT_DWELL_TIME */
+                       is_first_init_2g_scan = true;
+#endif /* USE_INITIAL_2G_SCAN */
+                       g_first_broadcast_scan = false;
+               }
+#endif /* USE_INITIAL_2G_SCAN || USE_INITIAL_SHORT_DWELL_TIME */
+
+               n_channels = request->n_channels;
+               n_ssids = request->n_ssids;
+               if (n_channels % 2)
+                       /* If n_channels is odd, add a padd of u16 */
+                       params_size += sizeof(u16) * (n_channels + 1);
+               else
+                       params_size += sizeof(u16) * n_channels;
+
+               /* Allocate space for populating ssids in wl_escan_params_t struct */
+               params_size += sizeof(struct wlc_ssid) * n_ssids;
+               params = MALLOCZ(cfg->osh, params_size);
+               if (params == NULL) {
+                       err = -ENOMEM;
+                       goto exit;
+               }
+
+               wl_escan_set_sync_id(sync_id, cfg);
+               if (cfg->scan_params_v2) {
+                       eparams_v2 = (wl_escan_params_v2_t *)params;
+                       scan_params = (u8 *)&eparams_v2->params;
+                       eparams_v2->version = htod32(ESCAN_REQ_VERSION_V2);
+                       eparams_v2->action =  htod16(action);
+                       eparams_v2->sync_id = sync_id;
+               } else {
+                       eparams = (wl_escan_params_t *)params;
+                       scan_params = (u8 *)&eparams->params;
+                       eparams->version = htod32(ESCAN_REQ_VERSION);
+                       eparams->action =  htod16(action);
+                       eparams->sync_id = sync_id;
+               }
+
+               if (wl_scan_prep(cfg, scan_params, params_size, request) < 0) {
+                       WL_ERR(("scan_prep failed\n"));
+                       err = -EINVAL;
+                       goto exit;
+               }
+
+#if defined(USE_INITIAL_2G_SCAN) || defined(USE_INITIAL_SHORT_DWELL_TIME)
+               /* Override active_time to reduce scan time if it's first bradcast scan. */
+               if (is_first_init_2g_scan) {
+                       if (eparams_v2) {
+                               eparams_v2->params.active_time = FIRST_SCAN_ACTIVE_DWELL_TIME_MS;
+                       } else {
+                               eparams->params.active_time = FIRST_SCAN_ACTIVE_DWELL_TIME_MS;
+                       }
+               }
+#endif /* USE_INITIAL_2G_SCAN || USE_INITIAL_SHORT_DWELL_TIME */
+
+               wl_escan_set_type(cfg, WL_SCANTYPE_LEGACY);
+               if (params_size + sizeof("escan") >= WLC_IOCTL_MEDLEN) {
+                       WL_ERR(("ioctl buffer length not sufficient\n"));
+                       MFREE(cfg->osh, params, params_size);
+                       err = -ENOMEM;
+                       goto exit;
+               }
+
+               bssidx = wl_get_bssidx_by_wdev(cfg, ndev->ieee80211_ptr);
+               WL_MSG(ndev->name, "LEGACY_SCAN sync ID: %d, bssidx: %d\n", sync_id, bssidx);
+               err = wldev_iovar_setbuf(ndev, "escan", params, params_size,
+                       cfg->escan_ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+               if (unlikely(err)) {
+                       if (err == BCME_EPERM)
+                               /* Scan Not permitted at this point of time */
+                               WL_DBG((" Escan not permitted at this time (%d)\n", err));
+                       else
+                               WL_ERR((" Escan set error (%d)\n", err));
+               } else {
+                       DBG_EVENT_LOG((dhd_pub_t *)cfg->pub, WIFI_EVENT_DRIVER_SCAN_REQUESTED);
+               }
+               MFREE(cfg->osh, params, params_size);
+       }
+       else if (p2p_is_on(cfg) && p2p_scan(cfg)) {
+               /* P2P SCAN TRIGGER */
+               if (request->n_channels) {
+                       num_chans = request->n_channels;
+                       WL_SCAN((" chan number : %d\n", num_chans));
+                       chan_mem = (u32)(num_chans * sizeof(*default_chan_list));
+                       default_chan_list = MALLOCZ(cfg->osh, chan_mem);
+                       if (default_chan_list == NULL) {
+                               WL_ERR(("channel list allocation failed \n"));
+                               err = -ENOMEM;
+                               goto exit;
+                       }
+                       /* Populate channels for p2p scanning */
+                       wl_cfgscan_populate_scan_channels(cfg,
+                               request->channels, request->n_channels,
+                               default_chan_list, &num_chans, true, true);
+
+                       if (num_chans == SOCIAL_CHAN_CNT && (
+                                               (CHSPEC_CHANNEL(default_chan_list[0]) ==
+                                               SOCIAL_CHAN_1) &&
+                                               (CHSPEC_CHANNEL(default_chan_list[1]) ==
+                                               SOCIAL_CHAN_2) &&
+                                               (CHSPEC_CHANNEL(default_chan_list[2]) ==
+                                               SOCIAL_CHAN_3))) {
+                               /* SOCIAL CHANNELS 1, 6, 11 */
+                               search_state = WL_P2P_DISC_ST_SEARCH;
+                               p2p_scan_purpose = P2P_SCAN_SOCIAL_CHANNEL;
+                               WL_DBG(("P2P SEARCH PHASE START \n"));
+                       } else if (((dev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION1)) &&
+                               (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP)) ||
+                               ((dev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION2)) &&
+                               (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP))) {
+                               /* If you are already a GO, then do SEARCH only */
+                               WL_DBG(("Already a GO. Do SEARCH Only"));
+                               search_state = WL_P2P_DISC_ST_SEARCH;
+                               p2p_scan_purpose = P2P_SCAN_NORMAL;
+
+                       } else if (num_chans == 1) {
+                               p2p_scan_purpose = P2P_SCAN_CONNECT_TRY;
+                       } else if (num_chans == SOCIAL_CHAN_CNT + 1) {
+                       /* SOCIAL_CHAN_CNT + 1 takes care of the Progressive scan supported by
+                        * the supplicant
+                        */
+                               p2p_scan_purpose = P2P_SCAN_SOCIAL_CHANNEL;
+                       } else {
+                               WL_DBG(("P2P SCAN STATE START \n"));
+                               p2p_scan_purpose = P2P_SCAN_NORMAL;
+                       }
+               } else {
+                       err = -EINVAL;
+                       goto exit;
+               }
+               WL_INFORM_MEM(("p2p_scan  num_channels:%d\n", num_chans));
+               err = wl_cfgp2p_escan(cfg, ndev, ACTIVE_SCAN, num_chans, default_chan_list,
+                       search_state, action,
+                       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE), NULL,
+                       p2p_scan_purpose);
+
+               if (!err)
+                       cfg->p2p->search_state = search_state;
+
+               MFREE(cfg->osh, default_chan_list, chan_mem);
+       }
+exit:
+       if (unlikely(err)) {
+               /* Don't print Error incase of Scan suppress */
+               if ((err == BCME_EPERM) && cfg->scan_suppressed)
+                       WL_DBG(("Escan failed: Scan Suppressed \n"));
+               else
+                       WL_ERR(("scan error (%d)\n", err));
+       }
+       return err;
+}
+
+s32
+wl_do_escan(struct bcm_cfg80211 *cfg, struct wiphy *wiphy, struct net_device *ndev,
+       struct cfg80211_scan_request *request)
+{
+       s32 err = BCME_OK;
+       s32 passive_scan;
+       s32 passive_scan_time;
+       s32 passive_scan_time_org;
+       wl_scan_results_t *results;
+       WL_SCAN(("Enter \n"));
+
+       results = wl_escan_get_buf(cfg, FALSE);
+       results->version = 0;
+       results->count = 0;
+       results->buflen = WL_SCAN_RESULTS_FIXED_SIZE;
+
+       cfg->escan_info.ndev = ndev;
+       cfg->escan_info.wiphy = wiphy;
+       cfg->escan_info.escan_state = WL_ESCAN_STATE_SCANING;
+       passive_scan = cfg->active_scan ? 0 : 1;
+       err = wldev_ioctl_set(ndev, WLC_SET_PASSIVE_SCAN,
+                             &passive_scan, sizeof(passive_scan));
+       if (unlikely(err)) {
+               WL_ERR(("error (%d)\n", err));
+               goto exit;
+       }
+
+       if (passive_channel_skip) {
+
+               err = wldev_ioctl_get(ndev, WLC_GET_SCAN_PASSIVE_TIME,
+                       &passive_scan_time_org, sizeof(passive_scan_time_org));
+               if (unlikely(err)) {
+                       WL_ERR(("== error (%d)\n", err));
+                       goto exit;
+               }
+
+               WL_SCAN(("PASSIVE SCAN time : %d \n", passive_scan_time_org));
+
+               passive_scan_time = 0;
+               err = wldev_ioctl_set(ndev, WLC_SET_SCAN_PASSIVE_TIME,
+                       &passive_scan_time, sizeof(passive_scan_time));
+               if (unlikely(err)) {
+                       WL_ERR(("== error (%d)\n", err));
+                       goto exit;
+               }
+
+               WL_SCAN(("PASSIVE SCAN SKIPED!! (passive_channel_skip:%d) \n",
+                       passive_channel_skip));
+       }
+
+       err = wl_run_escan(cfg, ndev, request, WL_SCAN_ACTION_START);
+
+       if (passive_channel_skip) {
+               err = wldev_ioctl_set(ndev, WLC_SET_SCAN_PASSIVE_TIME,
+                       &passive_scan_time_org, sizeof(passive_scan_time_org));
+               if (unlikely(err)) {
+                       WL_ERR(("== error (%d)\n", err));
+                       goto exit;
+               }
+
+               WL_SCAN(("PASSIVE SCAN RECOVERED!! (passive_scan_time_org:%d) \n",
+                       passive_scan_time_org));
+       }
+
+exit:
+       return err;
+}
+
+static s32
+wl_get_scan_timeout_val(struct bcm_cfg80211 *cfg)
+{
+       u32 scan_timer_interval_ms = WL_SCAN_TIMER_INTERVAL_MS;
+
+#ifdef WES_SUPPORT
+#ifdef CUSTOMER_SCAN_TIMEOUT_SETTING
+       if ((cfg->custom_scan_channel_time > DHD_SCAN_ASSOC_ACTIVE_TIME) |
+               (cfg->custom_scan_unassoc_time > DHD_SCAN_UNASSOC_ACTIVE_TIME) |
+               (cfg->custom_scan_passive_time > DHD_SCAN_PASSIVE_TIME) |
+               (cfg->custom_scan_home_time > DHD_SCAN_HOME_TIME) |
+               (cfg->custom_scan_home_away_time > DHD_SCAN_HOME_AWAY_TIME)) {
+               scan_timer_interval_ms = CUSTOMER_WL_SCAN_TIMER_INTERVAL_MS;
+       }
+#endif /* CUSTOMER_SCAN_TIMEOUT_SETTING */
+#endif /* WES_SUPPORT */
+
+       /* If NAN is enabled adding +10 sec to the existing timeout value */
+#ifdef WL_NAN
+       if (wl_cfgnan_is_enabled(cfg)) {
+               scan_timer_interval_ms += WL_SCAN_TIMER_INTERVAL_MS_NAN;
+       }
+#endif /* WL_NAN */
+       /* Additional time to scan 6GHz band channels */
+#ifdef WL_6G_BAND
+       if (cfg->band_6g_supported) {
+               scan_timer_interval_ms += WL_SCAN_TIMER_INTERVAL_MS_6G;
+       }
+#endif /* WL_6G_BAND */
+       WL_MEM(("scan_timer_interval_ms %d\n", scan_timer_interval_ms));
+       return scan_timer_interval_ms;
+}
+
+#define SCAN_EBUSY_RETRY_LIMIT 20
+static s32
+wl_cfgscan_handle_scanbusy(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 err)
+{
+       s32     scanbusy_err = 0;
+       static u32 busy_count = 0;
+
+       if (!err) {
+               busy_count = 0;
+               return scanbusy_err;
+       }
+       if (err == BCME_BUSY || err == BCME_NOTREADY) {
+               WL_ERR(("Scan err = (%d), busy?%d", err, -EBUSY));
+               scanbusy_err = -EBUSY;
+       } else if ((err == BCME_EPERM) && cfg->scan_suppressed) {
+               WL_ERR(("Scan not permitted due to scan suppress\n"));
+               scanbusy_err = -EPERM;
+       } else {
+               /* For all other fw errors, use a generic error code as return
+                * value to cfg80211 stack
+                */
+               scanbusy_err = -EAGAIN;
+       }
+
+       /* if continuous busy state, clear assoc type in FW by disassoc cmd */
+       if (scanbusy_err == -EBUSY) {
+               /* Flush FW preserve buffer logs for checking failure */
+               if (busy_count++ > (SCAN_EBUSY_RETRY_LIMIT/5)) {
+                       wl_flush_fw_log_buffer(ndev, FW_LOGSET_MASK_ALL);
+               }
+               if (busy_count > SCAN_EBUSY_RETRY_LIMIT) {
+                       struct ether_addr bssid;
+                       s32 ret = 0;
+                       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+                       if (dhd_query_bus_erros(dhdp)) {
+                               return BCME_NOTREADY;
+                       }
+                       dhdp->scan_busy_occurred = TRUE;
+                       busy_count = 0;
+                       WL_ERR(("Unusual continuous EBUSY error, %d %d %d %d %d %d %d %d %d\n",
+                               wl_get_drv_status(cfg, SCANNING, ndev),
+                               wl_get_drv_status(cfg, SCAN_ABORTING, ndev),
+                               wl_get_drv_status(cfg, CONNECTING, ndev),
+                               wl_get_drv_status(cfg, CONNECTED, ndev),
+                               wl_get_drv_status(cfg, DISCONNECTING, ndev),
+                               wl_get_drv_status(cfg, AP_CREATING, ndev),
+                               wl_get_drv_status(cfg, AP_CREATED, ndev),
+                               wl_get_drv_status(cfg, SENDING_ACT_FRM, ndev),
+                               wl_get_drv_status(cfg, SENDING_ACT_FRM, ndev)));
+
+#if defined(DHD_DEBUG) && defined(DHD_FW_COREDUMP)
+                       if (dhdp->memdump_enabled) {
+                               dhdp->memdump_type = DUMP_TYPE_SCAN_BUSY;
+                               dhd_bus_mem_dump(dhdp);
+                       }
+#endif /* DHD_DEBUG && DHD_FW_COREDUMP */
+                       dhdp->hang_reason = HANG_REASON_SCAN_BUSY;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+                       dhd_os_send_hang_message(dhdp);
+#endif
+
+#if !(LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+                       WL_ERR(("%s: HANG event is unsupported\n", __FUNCTION__));
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) && OEM_ANDROID */
+
+                       bzero(&bssid, sizeof(bssid));
+                       if ((ret = wldev_ioctl_get(ndev, WLC_GET_BSSID,
+                               &bssid, ETHER_ADDR_LEN)) == 0) {
+                               WL_ERR(("FW is connected with " MACDBG "/n",
+                                       MAC2STRDBG(bssid.octet)));
+                       } else {
+                               WL_ERR(("GET BSSID failed with %d\n", ret));
+                       }
+
+                       /* To support GO, wl_cfg80211_scan_abort()
+                        * is needed instead of wl_cfg80211_disconnect()
+                        */
+                       wl_cfg80211_scan_abort(cfg);
+
+               } else {
+                       /* Hold the context for 400msec, so that 10 subsequent scans
+                       * can give a buffer of 4sec which is enough to
+                       * cover any on-going scan in the firmware
+                       */
+                       WL_DBG(("Enforcing delay for EBUSY case \n"));
+                       msleep(400);
+               }
+       } else {
+               busy_count = 0;
+       }
+
+       return scanbusy_err;
+}
+
+s32
+__wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+       struct cfg80211_scan_request *request,
+       struct cfg80211_ssid *this_ssid)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct cfg80211_ssid *ssids;
+       bool p2p_ssid;
+#ifdef WL11U
+       bcm_tlv_t *interworking_ie;
+#endif
+       s32 err = 0;
+       s32 bssidx = -1;
+       s32 i;
+       bool escan_req_failed = false;
+       s32 scanbusy_err = 0;
+
+       unsigned long flags;
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+       struct net_device *remain_on_channel_ndev = NULL;
+#endif
+       /*
+        * Hostapd triggers scan before starting automatic channel selection
+        * to collect channel characteristics. However firmware scan engine
+        * doesn't support any channel characteristics collection along with
+        * scan. Hence return scan success.
+        */
+       if (request && (scan_req_iftype(request) == NL80211_IFTYPE_AP)) {
+               WL_DBG(("Scan Command on SoftAP Interface. Ignoring...\n"));
+// terence 20161023: let it scan in SoftAP mode
+//             return 0;
+       }
+
+       ndev = ndev_to_wlc_ndev(ndev, cfg);
+
+       if (WL_DRV_STATUS_SENDING_AF_FRM_EXT(cfg)) {
+               WL_ERR(("Sending Action Frames. Try it again.\n"));
+               return -EAGAIN;
+       }
+
+       WL_DBG(("Enter wiphy (%p)\n", wiphy));
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               if (cfg->scan_request == NULL) {
+                       wl_clr_drv_status_all(cfg, SCANNING);
+                       WL_DBG(("<<<<<<<<<<<Force Clear Scanning Status>>>>>>>>>>>\n"));
+               } else {
+                       WL_ERR(("Scanning already\n"));
+                       return -EAGAIN;
+               }
+       }
+       if (wl_get_drv_status(cfg, SCAN_ABORTING, ndev)) {
+               WL_ERR(("Scanning being aborted\n"));
+               return -EAGAIN;
+       }
+       if (request && request->n_ssids > WL_SCAN_PARAMS_SSID_MAX) {
+               WL_ERR(("request null or n_ssids > WL_SCAN_PARAMS_SSID_MAX\n"));
+               return -EOPNOTSUPP;
+       }
+#ifdef WL_BCNRECV
+       /* check fakeapscan in progress then abort */
+       wl_android_bcnrecv_stop(ndev, WL_BCNRECV_SCANBUSY);
+#endif /* WL_BCNRECV */
+
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+       mutex_lock(&cfg->scan_sync);
+       remain_on_channel_ndev = wl_cfg80211_get_remain_on_channel_ndev(cfg);
+       if (remain_on_channel_ndev) {
+               WL_DBG(("Remain_on_channel bit is set, somehow it didn't get cleared\n"));
+               wl_notify_escan_complete(cfg, remain_on_channel_ndev, true, true);
+       }
+       mutex_unlock(&cfg->scan_sync);
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+#ifdef P2P_LISTEN_OFFLOADING
+       wl_cfg80211_cancel_p2plo(cfg);
+#endif /* P2P_LISTEN_OFFLOADING */
+
+       if (request) {          /* scan bss */
+               ssids = request->ssids;
+               p2p_ssid = false;
+               for (i = 0; i < request->n_ssids; i++) {
+                       if (ssids[i].ssid_len &&
+                               IS_P2P_SSID(ssids[i].ssid, ssids[i].ssid_len)) {
+                               /* P2P Scan */
+#ifdef WL_BLOCK_P2P_SCAN_ON_STA
+                               if (!(IS_P2P_IFACE(request->wdev))) {
+                                       /* P2P scan on non-p2p iface. Fail scan */
+                                       WL_ERR(("p2p_search on non p2p iface\n"));
+                                       goto scan_out;
+                               }
+#endif /* WL_BLOCK_P2P_SCAN_ON_STA */
+                               p2p_ssid = true;
+                               break;
+                       }
+               }
+               if (p2p_ssid) {
+                       if (cfg->p2p_supported) {
+                               /* p2p scan trigger */
+                               if (p2p_on(cfg) == false) {
+                                       /* p2p on at the first time */
+                                       p2p_on(cfg) = true;
+                                       wl_cfgp2p_set_firm_p2p(cfg);
+#if defined(P2P_IE_MISSING_FIX)
+                                       cfg->p2p_prb_noti = false;
+#endif
+                               }
+                               wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+                               WL_DBG(("P2P: GO_NEG_PHASE status cleared \n"));
+                               p2p_scan(cfg) = true;
+                       }
+               } else {
+                       /* legacy scan trigger
+                        * So, we have to disable p2p discovery if p2p discovery is on
+                        */
+                       if (cfg->p2p_supported) {
+                               p2p_scan(cfg) = false;
+                               /* If Netdevice is not equals to primary and p2p is on
+                               *  , we will do p2p scan using P2PAPI_BSSCFG_DEVICE.
+                               */
+
+                               if (p2p_scan(cfg) == false) {
+                                       if (wl_get_p2p_status(cfg, DISCOVERY_ON)) {
+                                               err = wl_cfgp2p_discover_enable_search(cfg,
+                                               false);
+                                               if (unlikely(err)) {
+                                                       goto scan_out;
+                                               }
+
+                                       }
+                               }
+                       }
+                       if (!cfg->p2p_supported || !p2p_scan(cfg)) {
+                               if ((bssidx = wl_get_bssidx_by_wdev(cfg,
+                                       ndev->ieee80211_ptr)) < 0) {
+                                       WL_ERR(("Find p2p index from ndev(%p) failed\n",
+                                               ndev));
+                                       err = BCME_ERROR;
+                                       goto scan_out;
+                               }
+#ifdef WL11U
+                               if (request && (interworking_ie = wl_cfg80211_find_interworking_ie(
+                                               request->ie, request->ie_len)) != NULL) {
+                                       if ((err = wl_cfg80211_add_iw_ie(cfg, ndev, bssidx,
+                                                       VNDR_IE_CUSTOM_FLAG, interworking_ie->id,
+                                                       interworking_ie->data,
+                                                       interworking_ie->len)) != BCME_OK) {
+                                               WL_ERR(("Failed to add interworking IE"));
+                                       }
+                               } else if (cfg->wl11u) {
+                                       /* we have to clear IW IE and disable gratuitous APR */
+                                       wl_cfg80211_clear_iw_ie(cfg, ndev, bssidx);
+                                       err = wldev_iovar_setint_bsscfg(ndev, "grat_arp",
+                                                                       0, bssidx);
+                                       /* we don't care about error here
+                                        * because the only failure case is unsupported,
+                                        * which is fine
+                                        */
+                                       if (unlikely(err)) {
+                                               WL_ERR(("Set grat_arp failed:(%d) Ignore!\n", err));
+                                       }
+                                       cfg->wl11u = FALSE;
+                               }
+#endif /* WL11U */
+                               if (request) {
+                                       err = wl_cfg80211_set_mgmt_vndr_ies(cfg,
+                                               ndev_to_cfgdev(ndev), bssidx, VNDR_IE_PRBREQ_FLAG,
+                                               request->ie, request->ie_len);
+                               }
+
+                               if (unlikely(err)) {
+// terence 20161023: let it scan in SoftAP mode
+//                                     goto scan_out;
+                               }
+
+                       }
+               }
+       } else {                /* scan in ibss */
+               ssids = this_ssid;
+       }
+
+       if (request && cfg->p2p_supported) {
+               WL_TRACE_HW4(("START SCAN\n"));
+
+               DHD_OS_SCAN_WAKE_LOCK_TIMEOUT((dhd_pub_t *)(cfg->pub),
+                       SCAN_WAKE_LOCK_TIMEOUT);
+               DHD_DISABLE_RUNTIME_PM((dhd_pub_t *)(cfg->pub));
+
+       }
+
+       if (cfg->p2p_supported) {
+               if (request && p2p_on(cfg) && p2p_scan(cfg)) {
+
+                       /* find my listen channel */
+                       cfg->afx_hdl->my_listen_chan =
+                               wl_find_listen_channel(cfg, request->ie,
+                               request->ie_len);
+                       err = wl_cfgp2p_enable_discovery(cfg, ndev,
+                       request->ie, request->ie_len);
+
+                       if (unlikely(err)) {
+                               goto scan_out;
+                       }
+               }
+       }
+
+       mutex_lock(&cfg->scan_sync);
+       err = wl_do_escan(cfg, wiphy, ndev, request);
+       if (likely(!err)) {
+               goto scan_success;
+       } else {
+               escan_req_failed = true;
+               goto scan_out;
+       }
+
+scan_success:
+       wl_cfgscan_handle_scanbusy(cfg, ndev, BCME_OK);
+       cfg->scan_request = request;
+       LOG_TS(cfg, scan_start);
+       wl_set_drv_status(cfg, SCANNING, ndev);
+       /* Arm the timer */
+       mod_timer(&cfg->scan_timeout,
+               jiffies + msecs_to_jiffies(wl_get_scan_timeout_val(cfg)));
+       mutex_unlock(&cfg->scan_sync);
+       return 0;
+
+scan_out:
+       if (escan_req_failed) {
+               WL_CFG_DRV_LOCK(&cfg->cfgdrv_lock, flags);
+               cfg->scan_request = NULL;
+               WL_CFG_DRV_UNLOCK(&cfg->cfgdrv_lock, flags);
+               mutex_unlock(&cfg->scan_sync);
+               /* Handling for scan busy errors */
+               scanbusy_err = wl_cfgscan_handle_scanbusy(cfg, ndev, err);
+               if (scanbusy_err == BCME_NOTREADY) {
+                       /* In case of bus failures avoid ioctl calls */
+
+                       DHD_OS_SCAN_WAKE_UNLOCK((dhd_pub_t *)(cfg->pub));
+
+                       return -ENODEV;
+               }
+               err = scanbusy_err;
+       }
+
+       DHD_OS_SCAN_WAKE_UNLOCK((dhd_pub_t *)(cfg->pub));
+
+       return err;
+}
+
+s32
+#if defined(WL_CFG80211_P2P_DEV_IF)
+wl_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
+#else
+wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+       struct cfg80211_scan_request *request)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+{
+       s32 err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       struct net_device *ndev = wdev_to_wlc_ndev(request->wdev, cfg);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+       WL_DBG(("Enter\n"));
+       RETURN_EIO_IF_NOT_UP(cfg);
+
+#ifdef DHD_IFDEBUG
+#ifdef WL_CFG80211_P2P_DEV_IF
+       PRINT_WDEV_INFO(request->wdev);
+#else
+       PRINT_WDEV_INFO(ndev);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+#endif /* DHD_IFDEBUG */
+
+       if (ndev == bcmcfg_to_prmry_ndev(cfg)) {
+               if (wl_cfg_multip2p_operational(cfg)) {
+                       WL_ERR(("wlan0 scan failed, p2p devices are operational"));
+                        return -ENODEV;
+               }
+       }
+       err = wl_cfg80211_check_in4way(cfg, ndev_to_wlc_ndev(ndev, cfg), NO_SCAN_IN4WAY,
+               WL_EXT_STATUS_SCAN, NULL);
+       if (err)
+               return err;
+
+       err = __wl_cfg80211_scan(wiphy, ndev, request, NULL);
+       if (unlikely(err)) {
+               WL_ERR(("scan error (%d)\n", err));
+       }
+#ifdef WL_DRV_AVOID_SCANCACHE
+       /* Reset roam cache after successful scan request */
+#ifdef ROAM_CHANNEL_CACHE
+       if (!err) {
+               reset_roam_cache(cfg);
+       }
+#endif /* ROAM_CHANNEL_CACHE */
+#endif /* WL_DRV_AVOID_SCANCACHE */
+       return err;
+}
+
+/* Note: This API should be invoked with scan_sync mutex
+ * held so that scan_request data structures doesn't
+ * get modified in between.
+ */
+struct wireless_dev *
+wl_get_scan_wdev(struct bcm_cfg80211 *cfg)
+{
+       struct wireless_dev *wdev = NULL;
+
+       if (!cfg) {
+               WL_ERR(("cfg ptr null\n"));
+               return NULL;
+       }
+
+       if (!cfg->scan_request && !cfg->sched_scan_req) {
+               /* No scans in progress */
+               WL_MEM(("no scan in progress \n"));
+               return NULL;
+       }
+
+       if (cfg->scan_request) {
+               wdev = GET_SCAN_WDEV(cfg->scan_request);
+#ifdef WL_SCHED_SCAN
+       } else if (cfg->sched_scan_req) {
+               wdev = GET_SCHED_SCAN_WDEV(cfg->sched_scan_req);
+#endif /* WL_SCHED_SCAN */
+       } else {
+               WL_MEM(("no scan in progress \n"));
+       }
+
+       return wdev;
+}
+
+void wl_cfg80211_cancel_scan(struct bcm_cfg80211 *cfg)
+{
+       struct wireless_dev *wdev = NULL;
+       struct net_device *ndev = NULL;
+
+       mutex_lock(&cfg->scan_sync);
+       if (!cfg->scan_request && !cfg->sched_scan_req) {
+               /* No scans in progress */
+               WL_INFORM_MEM(("No scan in progress\n"));
+               goto exit;
+       }
+
+       wdev = wl_get_scan_wdev(cfg);
+       if (!wdev) {
+               WL_ERR(("No wdev present\n"));
+               goto exit;
+       }
+
+       ndev = wdev_to_wlc_ndev(wdev, cfg);
+       wl_notify_escan_complete(cfg, ndev, true, true);
+       WL_INFORM_MEM(("Scan aborted! \n"));
+exit:
+       mutex_unlock(&cfg->scan_sync);
+}
+
+void wl_cfg80211_scan_abort(struct bcm_cfg80211 *cfg)
+{
+       void *params = NULL;
+       s32 params_size = 0;
+       s32 err = BCME_OK;
+       struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+       u32 channel, channel_num;
+
+       if (!in_atomic()) {
+               /* Abort scan params only need space for 1 channel and 0 ssids */
+               if (cfg->scan_params_v2) {
+                       params_size = WL_SCAN_PARAMS_V2_FIXED_SIZE + (1 * sizeof(uint16));
+               } else {
+                       params_size = WL_SCAN_PARAMS_FIXED_SIZE + (1 * sizeof(uint16));
+               }
+
+               params = MALLOCZ(cfg->osh, params_size);
+               if (params == NULL) {
+                       WL_ERR(("mem alloc failed (%d bytes)\n", params_size));
+                       return;
+               }
+
+               /* Use magic value of channel=-1 to abort scan */
+               channel = htodchanspec(-1);
+               channel_num = htod32((0 << WL_SCAN_PARAMS_NSSID_SHIFT) |
+                               (1 & WL_SCAN_PARAMS_COUNT_MASK));
+               if (cfg->scan_params_v2) {
+                       wl_scan_params_v2_t *params_v2 = (wl_scan_params_v2_t *)params;
+                       params_v2->channel_list[0] = channel;
+                       params_v2->channel_num = channel_num;
+                       params_v2->length = htod16(sizeof(wl_scan_params_v2_t));
+               } else {
+                       wl_scan_params_t *params_v1 = (wl_scan_params_t *)params;
+                       params_v1->channel_list[0] = channel;
+                       params_v1->channel_num = channel_num;
+               }
+#ifdef DHD_SEND_HANG_ESCAN_SYNCID_MISMATCH
+               cfg->escan_info.prev_escan_aborted = TRUE;
+#endif /* DHD_SEND_HANG_ESCAN_SYNCID_MISMATCH */
+               /* Do a scan abort to stop the driver's scan engine */
+               err = wldev_ioctl_set(dev, WLC_SCAN, params, params_size);
+               if (err < 0) {
+                       /* scan abort can fail if there is no outstanding scan */
+                       WL_ERR(("scan engine not aborted ret(%d)\n", err));
+               }
+               MFREE(cfg->osh, params, params_size);
+       }
+#ifdef WLTDLS
+       if (cfg->tdls_mgmt_frame) {
+               MFREE(cfg->osh, cfg->tdls_mgmt_frame, cfg->tdls_mgmt_frame_len);
+               cfg->tdls_mgmt_frame = NULL;
+               cfg->tdls_mgmt_frame_len = 0;
+       }
+#endif /* WLTDLS */
+}
+
+s32 wl_notify_escan_complete(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev,
+       bool aborted, bool fw_abort)
+{
+       s32 err = BCME_OK;
+       unsigned long flags;
+       struct net_device *dev;
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       WL_DBG(("Enter \n"));
+       BCM_REFERENCE(dhdp);
+
+       if (!ndev) {
+               WL_ERR(("ndev is null\n"));
+               err = BCME_ERROR;
+               goto out;
+       }
+
+       if (cfg->escan_info.ndev != ndev) {
+               WL_ERR(("Outstanding scan req ndev not matching (%p:%p)\n",
+                       cfg->escan_info.ndev, ndev));
+               err = BCME_ERROR;
+               goto out;
+       }
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) && \
+       defined(SUPPORT_RANDOM_MAC_SCAN) && !defined(WL_USE_RANDOMIZED_SCAN)
+       /* Disable scanmac if enabled */
+       if (cfg->scanmac_enabled) {
+               wl_cfg80211_scan_mac_disable(ndev);
+       }
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3, 19, 0) && defined(SUPPORT_RANDOM_MAC_SCAN) */
+       if (cfg->scan_request) {
+               dev = bcmcfg_to_prmry_ndev(cfg);
+#if defined(WL_ENABLE_P2P_IF)
+               if (cfg->scan_request->dev != cfg->p2p_net)
+                       dev = cfg->scan_request->dev;
+#elif defined(WL_CFG80211_P2P_DEV_IF)
+               if (cfg->scan_request->wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
+                       dev = cfg->scan_request->wdev->netdev;
+#endif /* WL_ENABLE_P2P_IF */
+       }
+       else {
+               WL_DBG(("cfg->scan_request is NULL. Internal scan scenario."
+                       "doing scan_abort for ndev %p primary %p",
+                       ndev, bcmcfg_to_prmry_ndev(cfg)));
+               dev = ndev;
+       }
+       if (fw_abort && !in_atomic())
+               wl_cfg80211_scan_abort(cfg);
+       if (timer_pending(&cfg->scan_timeout))
+               del_timer_sync(&cfg->scan_timeout);
+       /* clear scan enq time on complete */
+       CLR_TS(cfg, scan_enq);
+       CLR_TS(cfg, scan_start);
+#if defined(ESCAN_RESULT_PATCH)
+       if (likely(cfg->scan_request)) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+               if (aborted && cfg->p2p && p2p_scan(cfg) &&
+                       (cfg->scan_request->flags & NL80211_SCAN_FLAG_FLUSH)) {
+                       WL_ERR(("scan list is changed"));
+                       cfg->bss_list = wl_escan_get_buf(cfg, !aborted);
+               } else
+#endif
+                       cfg->bss_list = wl_escan_get_buf(cfg, aborted);
+
+               wl_inform_bss(cfg);
+       }
+#endif /* ESCAN_RESULT_PATCH */
+
+       WL_CFG_DRV_LOCK(&cfg->cfgdrv_lock, flags);
+       if (likely(cfg->scan_request)) {
+               WL_INFORM_MEM(("[%s] Report scan done.\n", dev->name));
+               /* scan_sync mutex is already held */
+               _wl_notify_scan_done(cfg, aborted);
+               cfg->scan_request = NULL;
+       }
+       if (p2p_is_on(cfg))
+               wl_clr_p2p_status(cfg, SCANNING);
+       wl_clr_drv_status(cfg, SCANNING, dev);
+       CLR_TS(cfg, scan_start);
+       WL_CFG_DRV_UNLOCK(&cfg->cfgdrv_lock, flags);
+
+#ifdef WL_SCHED_SCAN
+       if (cfg->sched_scan_running && cfg->sched_scan_req) {
+               struct wiphy *wiphy = cfg->sched_scan_req->wiphy;
+               if (!aborted) {
+                       WL_INFORM_MEM(("[%s] Report sched scan done.\n", dev->name));
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0))
+                       cfg80211_sched_scan_results(wiphy,
+                                       cfg->sched_scan_req->reqid);
+#else
+                       cfg80211_sched_scan_results(wiphy);
+#endif /* LINUX_VER > 4.11 */
+               }
+
+               DBG_EVENT_LOG(dhdp, WIFI_EVENT_DRIVER_PNO_SCAN_COMPLETE);
+               /* Mark target scan as done */
+               cfg->sched_scan_running = FALSE;
+
+               if (cfg->bss_list && (cfg->bss_list->count == 0)) {
+                       WL_INFORM_MEM(("bss list empty. report sched_scan_stop\n"));
+                       /* Indicated sched scan stopped so that user space
+                        * can do a full scan incase found match is empty.
+                        */
+                       CFG80211_SCHED_SCAN_STOPPED(wiphy, cfg->sched_scan_req);
+                       cfg->sched_scan_req = NULL;
+               }
+       }
+#endif /* WL_SCHED_SCAN */
+       wake_up_interruptible(&dhdp->conf->event_complete);
+
+       DHD_OS_SCAN_WAKE_UNLOCK((dhd_pub_t *)(cfg->pub));
+       DHD_ENABLE_RUNTIME_PM((dhd_pub_t *)(cfg->pub));
+
+out:
+       return err;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0))
+void
+wl_cfg80211_abort_scan(struct wiphy *wiphy, struct wireless_dev *wdev)
+{
+       struct bcm_cfg80211 *cfg;
+
+       WL_DBG(("Enter wl_cfg80211_abort_scan\n"));
+       cfg = wiphy_priv(wdev->wiphy);
+
+       /* Check if any scan in progress only then abort */
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               wl_cfg80211_scan_abort(cfg);
+               /* Only scan abort is issued here. As per the expectation of abort_scan
+               * the status of abort is needed to be communicated using cfg80211_scan_done call.
+               * Here we just issue abort request and let the scan complete path to indicate
+               * abort to cfg80211 layer.
+               */
+               WL_DBG(("wl_cfg80211_abort_scan: Scan abort issued to FW\n"));
+       }
+}
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)) */
+
+int wl_cfg80211_scan_stop(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev)
+{
+       int ret = 0;
+
+       WL_TRACE(("Enter\n"));
+
+       if (!cfg || !cfgdev) {
+               return -EINVAL;
+       }
+
+       /* cancel scan and notify scan status */
+       wl_cfg80211_cancel_scan(cfg);
+
+       return ret;
+}
+
+/* This API is just meant as a wrapper for cfg80211_scan_done
+ * API. This doesn't do state mgmt. For cancelling scan,
+ * please use wl_cfg80211_cancel_scan API.
+ */
+static void
+_wl_notify_scan_done(struct bcm_cfg80211 *cfg, bool aborted)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0))
+       struct cfg80211_scan_info info;
+#endif
+
+       if (!cfg->scan_request) {
+               return;
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0))
+       memset_s(&info, sizeof(struct cfg80211_scan_info), 0, sizeof(struct cfg80211_scan_info));
+       info.aborted = aborted;
+       cfg80211_scan_done(cfg->scan_request, &info);
+#else
+       cfg80211_scan_done(cfg->scan_request, aborted);
+#endif
+       cfg->scan_request = NULL;
+}
+
+#ifdef WL_DRV_AVOID_SCANCACHE
+static u32 wl_p2p_find_peer_channel(struct bcm_cfg80211 *cfg, s32 status, wl_bss_info_t *bi,
+               u32 bi_length)
+{
+       u32 ret;
+       u8 *p2p_dev_addr = NULL;
+
+       ret = wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL);
+       if (!ret) {
+               return ret;
+       }
+       if (status == WLC_E_STATUS_PARTIAL) {
+               p2p_dev_addr = wl_cfgp2p_retreive_p2p_dev_addr(bi, bi_length);
+               if (p2p_dev_addr && !memcmp(p2p_dev_addr,
+                       cfg->afx_hdl->tx_dst_addr.octet, ETHER_ADDR_LEN)) {
+                       s32 channel = wf_chspec_ctlchan(
+                               wl_chspec_driver_to_host(bi->chanspec));
+
+                       if ((channel > MAXCHANNEL) || (channel <= 0)) {
+                               channel = WL_INVALID;
+                       } else {
+                               WL_ERR(("ACTION FRAME SCAN : Peer " MACDBG " found,"
+                                       " channel : %d\n",
+                                       MAC2STRDBG(cfg->afx_hdl->tx_dst_addr.octet),
+                                       channel));
+                       }
+                       wl_clr_p2p_status(cfg, SCANNING);
+                       cfg->afx_hdl->peer_chan = channel;
+                       complete(&cfg->act_frm_scan);
+               }
+       } else {
+               WL_INFORM_MEM(("ACTION FRAME SCAN DONE\n"));
+               wl_clr_p2p_status(cfg, SCANNING);
+               wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+               if (cfg->afx_hdl->peer_chan == WL_INVALID)
+                       complete(&cfg->act_frm_scan);
+       }
+
+       return ret;
+}
+
+static s32 wl_escan_without_scan_cache(struct bcm_cfg80211 *cfg, wl_escan_result_t *escan_result,
+       struct net_device *ndev, const wl_event_msg_t *e, s32 status)
+{
+       s32 err = BCME_OK;
+       wl_bss_info_t *bi;
+       u32 bi_length;
+       bool aborted = false;
+       bool fw_abort = false;
+       bool notify_escan_complete = false;
+
+       if (wl_escan_check_sync_id(cfg, status, escan_result->sync_id,
+               cfg->escan_info.cur_sync_id) < 0) {
+               goto exit;
+       }
+
+       if (!(status == WLC_E_STATUS_TIMEOUT) || !(status == WLC_E_STATUS_PARTIAL)) {
+               cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+       }
+
+       if ((likely(cfg->scan_request)) || (cfg->sched_scan_running)) {
+               notify_escan_complete = true;
+       }
+
+       if (status == WLC_E_STATUS_PARTIAL) {
+               WL_DBG(("WLC_E_STATUS_PARTIAL \n"));
+               DBG_EVENT_LOG((dhd_pub_t *)cfg->pub, WIFI_EVENT_DRIVER_SCAN_RESULT_FOUND);
+               if ((!escan_result) || (dtoh16(escan_result->bss_count) != 1)) {
+                       WL_ERR(("Invalid escan result (NULL pointer) or invalid bss_count\n"));
+                       goto exit;
+               }
+
+               bi = escan_result->bss_info;
+               bi_length = dtoh32(bi->length);
+               if ((!bi) ||
+               (bi_length != (dtoh32(escan_result->buflen) - WL_ESCAN_RESULTS_FIXED_SIZE))) {
+                       WL_ERR(("Invalid escan bss info (NULL pointer)"
+                               "or invalid bss_info length\n"));
+                       goto exit;
+               }
+
+               if (!(bcmcfg_to_wiphy(cfg)->interface_modes & BIT(NL80211_IFTYPE_ADHOC))) {
+                       if (dtoh16(bi->capability) & DOT11_CAP_IBSS) {
+                               WL_DBG(("Ignoring IBSS result\n"));
+                               goto exit;
+                       }
+               }
+
+               if (wl_p2p_find_peer_channel(cfg, status, bi, bi_length)) {
+                       goto exit;
+               } else {
+                       if (scan_req_match(cfg)) {
+                               /* p2p scan && allow only probe response */
+                               if ((cfg->p2p->search_state != WL_P2P_DISC_ST_SCAN) &&
+                                       (bi->flags & WL_BSS_FLAGS_FROM_BEACON))
+                                       goto exit;
+                       }
+#ifdef ROAM_CHANNEL_CACHE
+                       add_roam_cache(cfg, bi);
+#endif /* ROAM_CHANNEL_CACHE */
+                       err = wl_inform_single_bss(cfg, bi, false);
+#ifdef ROAM_CHANNEL_CACHE
+                       /* print_roam_cache(); */
+                       update_roam_cache(cfg, ioctl_version);
+#endif /* ROAM_CHANNEL_CACHE */
+
+                       /*
+                        * !Broadcast && number of ssid = 1 && number of channels =1
+                        * means specific scan to association
+                        */
+                       if (wl_cfgp2p_is_p2p_specific_scan(cfg->scan_request)) {
+                               WL_ERR(("P2P assoc scan fast aborted.\n"));
+                               aborted = false;
+                               fw_abort = true;
+                       }
+                       /* Directly exit from function here and
+                       * avoid sending notify completion to cfg80211
+                       */
+                       goto exit;
+               }
+       } else if (status == WLC_E_STATUS_SUCCESS) {
+               if (wl_p2p_find_peer_channel(cfg, status, NULL, 0)) {
+                       goto exit;
+               }
+               WL_INFORM_MEM(("ESCAN COMPLETED\n"));
+               DBG_EVENT_LOG((dhd_pub_t *)cfg->pub, WIFI_EVENT_DRIVER_SCAN_COMPLETE);
+
+               /* Update escan complete status */
+               aborted = false;
+               fw_abort = false;
+
+#ifdef CUSTOMER_HW4_DEBUG
+               if (wl_scan_timeout_dbg_enabled)
+                       wl_scan_timeout_dbg_clear();
+#endif /* CUSTOMER_HW4_DEBUG */
+       } else if ((status == WLC_E_STATUS_ABORT) || (status == WLC_E_STATUS_NEWSCAN) ||
+               (status == WLC_E_STATUS_11HQUIET) || (status == WLC_E_STATUS_CS_ABORT) ||
+               (status == WLC_E_STATUS_NEWASSOC)) {
+               /* Handle all cases of scan abort */
+
+               WL_DBG(("ESCAN ABORT reason: %d\n", status));
+               if (wl_p2p_find_peer_channel(cfg, status, NULL, 0)) {
+                       goto exit;
+               }
+               WL_INFORM_MEM(("ESCAN ABORTED\n"));
+
+               /* Update escan complete status */
+               aborted = true;
+               fw_abort = false;
+
+       } else if (status == WLC_E_STATUS_TIMEOUT) {
+               WL_ERR(("WLC_E_STATUS_TIMEOUT : scan_request[%p]\n", cfg->scan_request));
+               WL_ERR(("reason[0x%x]\n", e->reason));
+               if (e->reason == 0xFFFFFFFF) {
+                       /* Update escan complete status */
+                       aborted = true;
+                       fw_abort = true;
+               }
+       } else {
+               WL_ERR(("unexpected Escan Event %d : abort\n", status));
+
+               if (wl_p2p_find_peer_channel(cfg, status, NULL, 0)) {
+                       goto exit;
+               }
+               /* Update escan complete status */
+               aborted = true;
+               fw_abort = false;
+       }
+
+       /* Notify escan complete status */
+       if (notify_escan_complete) {
+               wl_notify_escan_complete(cfg, ndev, aborted, fw_abort);
+       }
+
+exit:
+       return err;
+
+}
+#endif /* WL_DRV_AVOID_SCANCACHE */
+
+s32
+wl_notify_scan_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       struct channel_info channel_inform;
+       struct wl_scan_results *bss_list;
+       struct net_device *ndev = NULL;
+       u32 len = WL_SCAN_BUF_MAX;
+       s32 err = 0;
+       unsigned long flags;
+
+       WL_DBG(("Enter \n"));
+       if (!wl_get_drv_status(cfg, SCANNING, ndev)) {
+               WL_DBG(("scan is not ready \n"));
+               return err;
+       }
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       mutex_lock(&cfg->scan_sync);
+       wl_clr_drv_status(cfg, SCANNING, ndev);
+       bzero(&channel_inform, sizeof(channel_inform));
+       err = wldev_ioctl_get(ndev, WLC_GET_CHANNEL, &channel_inform,
+               sizeof(channel_inform));
+       if (unlikely(err)) {
+               WL_ERR(("scan busy (%d)\n", err));
+               goto scan_done_out;
+       }
+       channel_inform.scan_channel = dtoh32(channel_inform.scan_channel);
+       if (unlikely(channel_inform.scan_channel)) {
+
+               WL_DBG(("channel_inform.scan_channel (%d)\n",
+                       channel_inform.scan_channel));
+       }
+       cfg->bss_list = cfg->scan_results;
+       bss_list = cfg->bss_list;
+       bzero(bss_list, len);
+       bss_list->buflen = htod32(len);
+       err = wldev_ioctl_get(ndev, WLC_SCAN_RESULTS, bss_list, len);
+       if (unlikely(err) && unlikely(!cfg->scan_suppressed)) {
+               WL_ERR(("%s Scan_results error (%d)\n", ndev->name, err));
+               err = -EINVAL;
+               goto scan_done_out;
+       }
+       bss_list->buflen = dtoh32(bss_list->buflen);
+       bss_list->version = dtoh32(bss_list->version);
+       bss_list->count = dtoh32(bss_list->count);
+
+       err = wl_inform_bss(cfg);
+
+scan_done_out:
+       del_timer_sync(&cfg->scan_timeout);
+       WL_CFG_DRV_LOCK(&cfg->cfgdrv_lock, flags);
+       if (cfg->scan_request) {
+               _wl_notify_scan_done(cfg, false);
+               cfg->scan_request = NULL;
+       }
+       WL_CFG_DRV_UNLOCK(&cfg->cfgdrv_lock, flags);
+       WL_DBG(("cfg80211_scan_done\n"));
+       mutex_unlock(&cfg->scan_sync);
+       return err;
+}
+
+void wl_notify_scan_done(struct bcm_cfg80211 *cfg, bool aborted)
+{
+#if defined(CONFIG_TIZEN)
+       struct net_device *ndev = NULL;
+#endif /* CONFIG_TIZEN */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0))
+       struct cfg80211_scan_info info;
+
+       bzero(&info, sizeof(struct cfg80211_scan_info));
+       info.aborted = aborted;
+       cfg80211_scan_done(cfg->scan_request, &info);
+#else
+       cfg80211_scan_done(cfg->scan_request, aborted);
+#endif
+
+#if defined(CONFIG_TIZEN)
+       ndev = bcmcfg_to_prmry_ndev(cfg);
+       if (aborted)
+               net_stat_tizen_update_wifi(ndev, WIFISTAT_SCAN_ABORT);
+       else
+               net_stat_tizen_update_wifi(ndev, WIFISTAT_SCAN_DONE);
+#endif /* CONFIG_TIZEN */
+}
+
+#if defined(SUPPORT_RANDOM_MAC_SCAN)
+int
+wl_cfg80211_set_random_mac(struct net_device *dev, bool enable)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       int ret;
+
+       if (cfg->random_mac_enabled == enable) {
+               WL_ERR(("Random MAC already %s\n", enable ? "Enabled" : "Disabled"));
+               return BCME_OK;
+       }
+
+       if (enable) {
+               ret = wl_cfg80211_random_mac_enable(dev);
+       } else {
+               ret = wl_cfg80211_random_mac_disable(dev);
+       }
+
+       if (!ret) {
+               cfg->random_mac_enabled = enable;
+       }
+
+       return ret;
+}
+
+int
+wl_cfg80211_random_mac_enable(struct net_device *dev)
+{
+       u8 random_mac[ETH_ALEN] = {0, };
+       u8 rand_bytes[3] = {0, };
+       s32 err = BCME_ERROR;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+#if !defined(LEGACY_RANDOM_MAC)
+       uint8 buffer[WLC_IOCTL_SMLEN] = {0, };
+       wl_scanmac_t *sm = NULL;
+       int len = 0;
+       wl_scanmac_enable_t *sm_enable = NULL;
+       wl_scanmac_config_t *sm_config = NULL;
+#endif /* !LEGACY_RANDOM_MAC */
+
+       if (wl_get_drv_status_all(cfg, CONNECTED) || wl_get_drv_status_all(cfg, CONNECTING) ||
+           wl_get_drv_status_all(cfg, AP_CREATED) || wl_get_drv_status_all(cfg, AP_CREATING)) {
+               WL_ERR(("fail to Set random mac, current state is wrong\n"));
+               return err;
+       }
+
+       (void)memcpy_s(random_mac, ETH_ALEN, bcmcfg_to_prmry_ndev(cfg)->dev_addr, ETH_ALEN);
+       get_random_bytes(&rand_bytes, sizeof(rand_bytes));
+
+       if (rand_bytes[2] == 0x0 || rand_bytes[2] == 0xff) {
+               rand_bytes[2] = 0xf0;
+       }
+
+#if defined(LEGACY_RANDOM_MAC)
+       /* of the six bytes of random_mac the bytes 3, 4, 5 are copied with contents of rand_bytes
+       * So while copying 3 bytes of content no overflow would be seen. Hence returning void.
+       */
+       (void)memcpy_s(&random_mac[3], (sizeof(u8) * 3), rand_bytes, sizeof(rand_bytes));
+
+       err = wldev_iovar_setbuf_bsscfg(bcmcfg_to_prmry_ndev(cfg), "cur_etheraddr",
+               random_mac, ETH_ALEN, cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+
+       if (err != BCME_OK) {
+               WL_ERR(("failed to set random generate MAC address\n"));
+       } else {
+               WL_ERR(("set mac " MACDBG " to " MACDBG "\n",
+                       MAC2STRDBG((const u8 *)bcmcfg_to_prmry_ndev(cfg)->dev_addr),
+                       MAC2STRDBG((const u8 *)&random_mac)));
+               WL_ERR(("random MAC enable done"));
+       }
+#else
+       /* Enable scan mac */
+       sm = (wl_scanmac_t *)buffer;
+       sm_enable = (wl_scanmac_enable_t *)sm->data;
+       sm->len = sizeof(*sm_enable);
+       sm_enable->enable = 1;
+       len = OFFSETOF(wl_scanmac_t, data) + sm->len;
+       sm->subcmd_id = WL_SCANMAC_SUBCMD_ENABLE;
+
+       err = wldev_iovar_setbuf_bsscfg(dev, "scanmac",
+               sm, len, cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+
+       /* For older chip which which does not have scanmac support can still use
+        * cur_etheraddr to set the randmac. rand_mask and rand_mac comes from upper
+        * cfg80211 layer. If rand_mask and rand_mac is not passed then fallback
+        * to default cur_etheraddr and default mask.
+        */
+       if (err == BCME_UNSUPPORTED) {
+               /* In case of host based legacy randomization, random address is
+                * generated by mixing 3 bytes of cur_etheraddr and 3 bytes of
+                * random bytes generated.In that case rand_mask is nothing but
+                * random bytes.
+                */
+               (void)memcpy_s(&random_mac[3], (sizeof(u8) * 3), rand_bytes, sizeof(rand_bytes));
+               err = wldev_iovar_setbuf_bsscfg(bcmcfg_to_prmry_ndev(cfg), "cur_etheraddr",
+                               random_mac, ETH_ALEN, cfg->ioctl_buf,
+                               WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+               if (err != BCME_OK) {
+                       WL_ERR(("failed to set random generate MAC address\n"));
+               } else {
+                       WL_ERR(("set mac " MACDBG " to " MACDBG "\n",
+                               MAC2STRDBG((const u8 *)bcmcfg_to_prmry_ndev(cfg)->dev_addr),
+                               MAC2STRDBG((const u8 *)&random_mac)));
+                       WL_ERR(("random MAC enable done using legacy randmac"));
+               }
+       } else if (err == BCME_OK) {
+               /* Configure scanmac */
+               (void)memset_s(buffer, sizeof(buffer), 0x0, sizeof(buffer));
+               sm_config = (wl_scanmac_config_t *)sm->data;
+               sm->len = sizeof(*sm_config);
+               sm->subcmd_id = WL_SCANMAC_SUBCMD_CONFIG;
+               sm_config->scan_bitmap = WL_SCANMAC_SCAN_UNASSOC;
+
+               /* Set randomize mac address recv from upper layer */
+               (void)memcpy_s(&sm_config->mac.octet, ETH_ALEN, random_mac, ETH_ALEN);
+
+               /* Set randomize mask recv from upper layer */
+
+               /* Currently in samsung case, upper layer does not provide
+                * variable randmask and its using fixed 3 byte randomization
+                */
+               (void)memset_s(&sm_config->random_mask.octet, ETH_ALEN, 0x0, ETH_ALEN);
+               /* Memsetting the remaining octets 3, 4, 5. So remaining dest length is 3 */
+               (void)memset_s(&sm_config->random_mask.octet[3], 3, 0xFF, 3);
+
+               WL_DBG(("recv random mac addr " MACDBG  " recv rand mask" MACDBG "\n",
+                       MAC2STRDBG((const u8 *)&sm_config->mac.octet),
+                       MAC2STRDBG((const u8 *)&sm_config->random_mask)));
+
+               len = OFFSETOF(wl_scanmac_t, data) + sm->len;
+               err = wldev_iovar_setbuf_bsscfg(dev, "scanmac",
+                       sm, len, cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+
+               if (err != BCME_OK) {
+                       WL_ERR(("failed scanmac configuration\n"));
+
+                       /* Disable scan mac for clean-up */
+                       wl_cfg80211_random_mac_disable(dev);
+                       return err;
+               }
+               WL_DBG(("random MAC enable done using scanmac"));
+       } else  {
+               WL_ERR(("failed to enable scanmac, err=%d\n", err));
+       }
+#endif /* LEGACY_RANDOM_MAC */
+
+       return err;
+}
+
+int
+wl_cfg80211_random_mac_disable(struct net_device *dev)
+{
+       s32 err = BCME_ERROR;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+#if !defined(LEGACY_RANDOM_MAC)
+       uint8 buffer[WLC_IOCTL_SMLEN] = {0, };
+       wl_scanmac_t *sm = NULL;
+       int len = 0;
+       wl_scanmac_enable_t *sm_enable = NULL;
+#endif /* !LEGACY_RANDOM_MAC */
+
+#if defined(LEGACY_RANDOM_MAC)
+       WL_ERR(("set original mac " MACDBG "\n",
+               MAC2STRDBG((const u8 *)bcmcfg_to_prmry_ndev(cfg)->dev_addr)));
+
+       err = wldev_iovar_setbuf_bsscfg(bcmcfg_to_prmry_ndev(cfg), "cur_etheraddr",
+               bcmcfg_to_prmry_ndev(cfg)->dev_addr, ETH_ALEN,
+               cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+
+       if (err != BCME_OK) {
+               WL_ERR(("failed to set original MAC address\n"));
+       } else {
+               WL_ERR(("legacy random MAC disable done \n"));
+       }
+#else
+       sm = (wl_scanmac_t *)buffer;
+       sm_enable = (wl_scanmac_enable_t *)sm->data;
+       sm->len = sizeof(*sm_enable);
+       /* Disable scanmac */
+       sm_enable->enable = 0;
+       len = OFFSETOF(wl_scanmac_t, data) + sm->len;
+
+       sm->subcmd_id = WL_SCANMAC_SUBCMD_ENABLE;
+
+       err = wldev_iovar_setbuf_bsscfg(dev, "scanmac",
+               sm, len, cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+
+       if (err != BCME_OK) {
+               WL_ERR(("failed to disable scanmac, err=%d\n", err));
+               return err;
+       }
+       /* Clear scanmac enabled status */
+       cfg->scanmac_enabled = 0;
+       WL_DBG(("random MAC disable done\n"));
+#endif /* LEGACY_RANDOM_MAC */
+
+       return err;
+}
+
+int wl_cfg80211_scan_mac_enable(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       s32 err = BCME_ERROR;
+       uint8 buffer[WLC_IOCTL_SMLEN] = {0};
+       wl_scanmac_t *sm = NULL;
+       int len = 0;
+       wl_scanmac_enable_t *sm_enable = NULL;
+
+       /* Enable scan mac */
+       sm = (wl_scanmac_t *)buffer;
+       sm_enable = (wl_scanmac_enable_t *)sm->data;
+       sm->len = sizeof(*sm_enable);
+       sm_enable->enable = 1;
+       len = OFFSETOF(wl_scanmac_t, data) + sm->len;
+       sm->subcmd_id = WL_SCANMAC_SUBCMD_ENABLE;
+
+       err = wldev_iovar_setbuf_bsscfg(dev, "scanmac",
+               sm, len, cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("scanmac enable failed\n"));
+       } else {
+               /* Mark scanmac configured */
+               cfg->scanmac_enabled = 1;
+       }
+
+       return err;
+}
+/*
+ * This is new interface for mac randomization. It takes randmac and randmask
+ * as arg and it uses scanmac iovar to offload the mac randomization to firmware.
+ */
+int wl_cfg80211_scan_mac_config(struct net_device *dev, uint8 *rand_mac, uint8 *rand_mask)
+{
+       int byte_index = 0;
+       s32 err = BCME_ERROR;
+       uint8 buffer[WLC_IOCTL_SMLEN] = {0};
+       wl_scanmac_t *sm = NULL;
+       int len = 0;
+       wl_scanmac_config_t *sm_config = NULL;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       uint8 random_mask_46_bits[ETHER_ADDR_LEN] = {0xFC, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
+
+       if (rand_mac == NULL) {
+               err = BCME_BADARG;
+               WL_ERR(("fail to Set random mac, bad argument\n"));
+               /* Disable the current scanmac config */
+               return err;
+       }
+
+       if (ETHER_ISNULLADDR(rand_mac)) {
+               WL_DBG(("fail to Set random mac, Invalid rand mac\n"));
+               /* Disable the current scanmac config */
+               return err;
+       }
+
+       /* Configure scanmac */
+       (void)memset_s(buffer, sizeof(buffer), 0x0, sizeof(buffer));
+       sm = (wl_scanmac_t *)buffer;
+       sm_config = (wl_scanmac_config_t *)sm->data;
+       sm->len = sizeof(*sm_config);
+       sm->subcmd_id = WL_SCANMAC_SUBCMD_CONFIG;
+       sm_config->scan_bitmap = WL_SCANMAC_SCAN_UNASSOC;
+#ifdef WL_USE_RANDOMIZED_SCAN
+       sm_config->scan_bitmap |= WL_SCANMAC_SCAN_ASSOC_HOST;
+#endif /* WL_USE_RANDOMIZED_SCAN */
+       /* Set randomize mac address recv from upper layer */
+       (void)memcpy_s(&sm_config->mac.octet, ETH_ALEN, rand_mac, ETH_ALEN);
+
+       /* Set randomize mask recv from upper layer */
+
+       /* There is a difference in how to interpret rand_mask between
+        * upperlayer and firmware. If the byte is set as FF then for
+        * upper layer it  means keep that byte and do not randomize whereas
+        * for firmware it means randomize those bytes and vice versa. Hence
+        * conversion is needed before setting the iovar
+        */
+       (void)memset_s(&sm_config->random_mask.octet, ETH_ALEN, 0x0, ETH_ALEN);
+       /* Only byte randomization is supported currently. If mask recv is 0x0F
+        * for a particular byte then it will be treated as no randomization
+        * for that byte.
+        */
+       if (!rand_mask) {
+               /* If rand_mask not provided, use 46_bits_mask */
+               (void)memcpy_s(&sm_config->random_mask.octet, ETH_ALEN,
+                       random_mask_46_bits, ETH_ALEN);
+       } else {
+               while (byte_index < ETH_ALEN) {
+                       if (rand_mask[byte_index] == 0xFF) {
+                               sm_config->random_mask.octet[byte_index] = 0x00;
+                       } else if (rand_mask[byte_index] == 0x00) {
+                               sm_config->random_mask.octet[byte_index] = 0xFF;
+                       }
+                       byte_index++;
+               }
+       }
+
+       WL_DBG(("recv random mac addr " MACDBG  "recv rand mask" MACDBG "\n",
+               MAC2STRDBG((const u8 *)&sm_config->mac.octet),
+               MAC2STRDBG((const u8 *)&sm_config->random_mask)));
+
+       len = OFFSETOF(wl_scanmac_t, data) + sm->len;
+       err = wldev_iovar_setbuf_bsscfg(dev, "scanmac",
+               sm, len, cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+
+       if (err != BCME_OK) {
+               WL_ERR(("failed scanmac configuration\n"));
+
+               /* Disable scan mac for clean-up */
+               return err;
+       }
+       WL_INFORM_MEM(("scanmac configured"));
+       cfg->scanmac_config = true;
+
+       return err;
+}
+
+int
+wl_cfg80211_scan_mac_disable(struct net_device *dev)
+{
+       s32 err = BCME_ERROR;
+
+       err = wl_cfg80211_random_mac_disable(dev);
+
+       return err;
+}
+#endif /* SUPPORT_RANDOM_MAC_SCAN */
+
+#ifdef WL_SCHED_SCAN
+#define PNO_TIME                    30
+#define PNO_REPEAT                  4
+#define PNO_FREQ_EXPO_MAX           2
+#define PNO_ADAPTIVE_SCAN_LIMIT     60
+static bool
+is_ssid_in_list(struct cfg80211_ssid *ssid, struct cfg80211_ssid *ssid_list, int count)
+{
+       int i;
+
+       if (!ssid || !ssid_list)
+               return FALSE;
+
+       for (i = 0; i < count; i++) {
+               if (ssid->ssid_len == ssid_list[i].ssid_len) {
+                       if (strncmp(ssid->ssid, ssid_list[i].ssid, ssid->ssid_len) == 0)
+                               return TRUE;
+               }
+       }
+       return FALSE;
+}
+
+int
+wl_cfg80211_sched_scan_start(struct wiphy *wiphy,
+                             struct net_device *dev,
+                             struct cfg80211_sched_scan_request *request)
+{
+       u16 chan_list[WL_NUMCHANNELS] = {0};
+       u32 num_channels = 0;
+       ushort pno_time;
+       int pno_repeat = PNO_REPEAT;
+       int pno_freq_expo_max = PNO_FREQ_EXPO_MAX;
+       wlc_ssid_ext_t ssids_local[MAX_PFN_LIST_COUNT];
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       struct cfg80211_ssid *ssid = NULL;
+       struct cfg80211_ssid *hidden_ssid_list = NULL;
+       log_conn_event_t *event_data = NULL;
+       tlv_log *tlv_data = NULL;
+       u32 alloc_len = 0, tlv_len = 0;
+       u32 payload_len;
+       int ssid_cnt = 0;
+       int i;
+       int ret = 0;
+       unsigned long flags;
+
+       if (!request) {
+               WL_ERR(("Sched scan request was NULL\n"));
+               return -EINVAL;
+       }
+
+       if ((request->n_scan_plans == 1) && request->scan_plans &&
+                       (request->scan_plans->interval > PNO_ADAPTIVE_SCAN_LIMIT)) {
+               /* If the host gives a high value for scan interval, then
+                * doing adaptive scan doesn't make sense. Better stick to the
+                * scan interval that host gives.
+                */
+               pno_time = request->scan_plans->interval;
+               pno_repeat = 0;
+               pno_freq_expo_max = 0;
+       } else {
+               /* Run adaptive PNO */
+               pno_time = PNO_TIME;
+       }
+
+       WL_DBG(("Enter. ssids:%d match_sets:%d pno_time:%d pno_repeat:%d channels:%d\n",
+               request->n_ssids, request->n_match_sets,
+               pno_time, pno_repeat, request->n_channels));
+
+       if (!request->n_ssids || !request->n_match_sets) {
+               WL_ERR(("Invalid sched scan req!! n_ssids:%d \n", request->n_ssids));
+               return -EINVAL;
+       }
+
+       bzero(&ssids_local, sizeof(ssids_local));
+
+       if (request->n_ssids > 0) {
+               hidden_ssid_list = request->ssids;
+       }
+
+       if (request->n_channels && request->n_channels < WL_NUMCHANNELS) {
+               /* get channel list. Note PNO uses channels and not chanspecs */
+               wl_cfgscan_populate_scan_channels(cfg,
+                               request->channels, request->n_channels,
+                               chan_list, &num_channels, false, false);
+       }
+
+       if (DBG_RING_ACTIVE(dhdp, DHD_EVENT_RING_ID)) {
+               alloc_len = sizeof(log_conn_event_t) + DOT11_MAX_SSID_LEN;
+               event_data = (log_conn_event_t *)MALLOC(cfg->osh, alloc_len);
+               if (!event_data) {
+                       WL_ERR(("%s: failed to allocate log_conn_event_t with "
+                                               "length(%d)\n", __func__, alloc_len));
+                       return -ENOMEM;
+               }
+               bzero(event_data, alloc_len);
+               event_data->tlvs = NULL;
+               tlv_len = sizeof(tlv_log);
+               event_data->tlvs = (tlv_log *)MALLOC(cfg->osh, tlv_len);
+               if (!event_data->tlvs) {
+                       WL_ERR(("%s: failed to allocate log_tlv with "
+                                       "length(%d)\n", __func__, tlv_len));
+                       MFREE(cfg->osh, event_data, alloc_len);
+                       return -ENOMEM;
+               }
+       }
+       for (i = 0; i < request->n_match_sets && ssid_cnt < MAX_PFN_LIST_COUNT; i++) {
+               ssid = &request->match_sets[i].ssid;
+               /* No need to include null ssid */
+               if (ssid->ssid_len) {
+                       ssids_local[ssid_cnt].SSID_len = MIN(ssid->ssid_len,
+                               (uint32)DOT11_MAX_SSID_LEN);
+                       /* In previous step max SSID_len is limited to DOT11_MAX_SSID_LEN,
+                       * returning void
+                       */
+                       (void)memcpy_s(ssids_local[ssid_cnt].SSID, DOT11_MAX_SSID_LEN, ssid->ssid,
+                               ssids_local[ssid_cnt].SSID_len);
+                       if (is_ssid_in_list(ssid, hidden_ssid_list, request->n_ssids)) {
+                               ssids_local[ssid_cnt].hidden = TRUE;
+                               WL_PNO((">>> PNO hidden SSID (%s) \n", ssid->ssid));
+                       } else {
+                               ssids_local[ssid_cnt].hidden = FALSE;
+                               WL_PNO((">>> PNO non-hidden SSID (%s) \n", ssid->ssid));
+                       }
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 15, 0))
+                       if (request->match_sets[i].rssi_thold != NL80211_SCAN_RSSI_THOLD_OFF) {
+                               ssids_local[ssid_cnt].rssi_thresh =
+                                     (int8)request->match_sets[i].rssi_thold;
+                       }
+#endif /* (LINUX_VERSION_CODE > KERNEL_VERSION(3, 15, 0)) */
+                       ssid_cnt++;
+               }
+       }
+
+       if (ssid_cnt) {
+               if ((ret = dhd_dev_pno_set_for_ssid(dev, ssids_local, ssid_cnt,
+                       pno_time, pno_repeat, pno_freq_expo_max,
+                       (num_channels ? chan_list : NULL), num_channels)) < 0) {
+                       WL_ERR(("PNO setup failed!! ret=%d \n", ret));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+
+               if (DBG_RING_ACTIVE(dhdp, DHD_EVENT_RING_ID)) {
+                       /*
+                        * purposefully logging here to make sure that
+                        * firmware configuration was successful
+                        */
+                       for (i = 0; i < ssid_cnt; i++) {
+                               payload_len = sizeof(log_conn_event_t);
+                               event_data->event = WIFI_EVENT_DRIVER_PNO_ADD;
+                               tlv_data = event_data->tlvs;
+                               /* ssid */
+                               tlv_data->tag = WIFI_TAG_SSID;
+                               tlv_data->len = ssids_local[i].SSID_len;
+                               (void)memcpy_s(tlv_data->value, DOT11_MAX_SSID_LEN,
+                                       ssids_local[i].SSID, ssids_local[i].SSID_len);
+                               payload_len += TLV_LOG_SIZE(tlv_data);
+
+                               dhd_os_push_push_ring_data(dhdp, DHD_EVENT_RING_ID,
+                                       event_data, payload_len);
+                       }
+               }
+
+               WL_CFG_DRV_LOCK(&cfg->cfgdrv_lock, flags);
+               cfg->sched_scan_req = request;
+               WL_CFG_DRV_UNLOCK(&cfg->cfgdrv_lock, flags);
+       } else {
+               ret = -EINVAL;
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) && \
+       defined(SUPPORT_RANDOM_MAC_SCAN)
+       if ((ret = wl_config_scan_macaddr(cfg, dev,
+               (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR),
+               request->mac_addr, request->mac_addr_mask)) != BCME_OK) {
+               WL_ERR(("scanmac addr config failed\n"));
+               /* Cleanup the states and stop the pno */
+               if (dhd_dev_pno_stop_for_ssid(dev) < 0) {
+                       WL_ERR(("PNO Stop for SSID failed"));
+               }
+               WL_CFG_DRV_LOCK(&cfg->cfgdrv_lock, flags);
+               cfg->sched_scan_req = NULL;
+               cfg->sched_scan_running = FALSE;
+               WL_CFG_DRV_UNLOCK(&cfg->cfgdrv_lock, flags);
+               goto exit;
+       }
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) && (defined(SUPPORT_RANDOM_MAC_SCAN)) */
+
+exit:
+       if (event_data) {
+               MFREE(cfg->osh, event_data->tlvs, tlv_len);
+               MFREE(cfg->osh, event_data, alloc_len);
+       }
+       return ret;
+}
+
+int
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(4, 11, 0))
+wl_cfg80211_sched_scan_stop(struct wiphy *wiphy, struct net_device *dev, u64 reqid)
+#else
+wl_cfg80211_sched_scan_stop(struct wiphy *wiphy, struct net_device *dev)
+#endif /* LINUX_VER > 4.11 */
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       unsigned long flags;
+
+       WL_DBG(("Enter \n"));
+       WL_PNO((">>> SCHED SCAN STOP\n"));
+
+       if (dhd_dev_pno_stop_for_ssid(dev) < 0) {
+               WL_ERR(("PNO Stop for SSID failed"));
+       } else {
+               /*
+                * purposefully logging here to make sure that
+                * firmware configuration was successful
+                */
+               DBG_EVENT_LOG(dhdp, WIFI_EVENT_DRIVER_PNO_REMOVE);
+       }
+
+       if (cfg->sched_scan_req) {
+               WL_PNO((">>> Sched scan running. Aborting it..\n"));
+               wl_cfg80211_cancel_scan(cfg);
+       }
+       WL_CFG_DRV_LOCK(&cfg->cfgdrv_lock, flags);
+       cfg->sched_scan_req = NULL;
+       cfg->sched_scan_running = FALSE;
+       WL_CFG_DRV_UNLOCK(&cfg->cfgdrv_lock, flags);
+
+       return 0;
+}
+#endif /* WL_SCHED_SCAN */
+
+#ifdef WES_SUPPORT
+#ifdef CUSTOMER_SCAN_TIMEOUT_SETTING
+s32 wl_cfg80211_custom_scan_time(struct net_device *dev,
+               enum wl_custom_scan_time_type type, int time)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       if (cfg == NULL) {
+               return FALSE;
+       }
+
+       switch (type) {
+               case WL_CUSTOM_SCAN_CHANNEL_TIME :
+                       WL_ERR(("Scan Channel Time %d\n", time));
+                       cfg->custom_scan_channel_time = time;
+                       break;
+               case WL_CUSTOM_SCAN_UNASSOC_TIME :
+                       WL_ERR(("Scan Unassoc Time %d\n", time));
+                       cfg->custom_scan_unassoc_time = time;
+                       break;
+               case WL_CUSTOM_SCAN_PASSIVE_TIME :
+                       WL_ERR(("Scan Passive Time %d\n", time));
+                       cfg->custom_scan_passive_time = time;
+                       break;
+               case WL_CUSTOM_SCAN_HOME_TIME :
+                       WL_ERR(("Scan Home Time %d\n", time));
+                       cfg->custom_scan_home_time = time;
+                       break;
+               case WL_CUSTOM_SCAN_HOME_AWAY_TIME :
+                       WL_ERR(("Scan Home Away Time %d\n", time));
+                       cfg->custom_scan_home_away_time = time;
+                       break;
+               default:
+                       return FALSE;
+       }
+       return TRUE;
+}
+#endif /* CUSTOMER_SCAN_TIMEOUT_SETTING */
+#endif /* WES_SUPPORT */
+
+#ifdef CUSTOMER_HW4_DEBUG
+uint prev_dhd_console_ms = 0;
+u32 prev_wl_dbg_level = 0;
+static void wl_scan_timeout_dbg_set(void);
+
+static void wl_scan_timeout_dbg_set(void)
+{
+       WL_ERR(("Enter \n"));
+       prev_dhd_console_ms = dhd_console_ms;
+       prev_wl_dbg_level = wl_dbg_level;
+
+       dhd_console_ms = 1;
+       wl_dbg_level |= (WL_DBG_ERR | WL_DBG_P2P_ACTION | WL_DBG_SCAN);
+
+       wl_scan_timeout_dbg_enabled = 1;
+}
+void wl_scan_timeout_dbg_clear(void)
+{
+       WL_ERR(("Enter \n"));
+       dhd_console_ms = prev_dhd_console_ms;
+       wl_dbg_level = prev_wl_dbg_level;
+
+       wl_scan_timeout_dbg_enabled = 0;
+}
+#endif /* CUSTOMER_HW4_DEBUG */
+
+static void wl_scan_timeout(unsigned long data)
+{
+       wl_event_msg_t msg;
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)data;
+       struct wireless_dev *wdev = NULL;
+       struct net_device *ndev = NULL;
+       struct wl_scan_results *bss_list;
+       wl_bss_info_t *bi = NULL;
+       s32 i;
+       u32 channel;
+       u64 cur_time = OSL_LOCALTIME_NS();
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       unsigned long flags;
+#ifdef RTT_SUPPORT
+       rtt_status_info_t *rtt_status = NULL;
+       UNUSED_PARAMETER(rtt_status);
+#endif /* RTT_SUPPORT */
+
+       UNUSED_PARAMETER(cur_time);
+       WL_CFG_DRV_LOCK(&cfg->cfgdrv_lock, flags);
+       if (!(cfg->scan_request)) {
+               WL_ERR(("timer expired but no scan request\n"));
+               WL_CFG_DRV_UNLOCK(&cfg->cfgdrv_lock, flags);
+               return;
+       }
+
+       wdev = GET_SCAN_WDEV(cfg->scan_request);
+       WL_CFG_DRV_UNLOCK(&cfg->cfgdrv_lock, flags);
+
+       if (!wdev) {
+               WL_ERR(("No wireless_dev present\n"));
+               return;
+       }
+
+       if (dhd_query_bus_erros(dhdp)) {
+               return;
+       }
+#if defined(DHD_KERNEL_SCHED_DEBUG) && defined(DHD_FW_COREDUMP)
+       /* DHD triggers Kernel panic if the SCAN timeout occurrs
+        * due to tasklet or workqueue scheduling problems in the Linux Kernel.
+        * Customer informs that it is hard to find any clue from the
+        * host memory dump since the important tasklet or workqueue information
+        * is already disappered due the latency while printing out the timestamp
+        * logs for debugging scan timeout issue.
+        * For this reason, customer requestes us to trigger Kernel Panic rather than
+        * taking a SOCRAM dump.
+        */
+       if (dhdp->memdump_enabled == DUMP_MEMFILE_BUGON &&
+               ((cfg->tsinfo.scan_deq < cfg->tsinfo.scan_enq) ||
+               dhd_bus_query_dpc_sched_errors(dhdp))) {
+               WL_ERR(("****SCAN event timeout due to scheduling problem\n"));
+               /* change g_assert_type to trigger Kernel panic */
+               g_assert_type = 2;
+#ifdef RTT_SUPPORT
+               rtt_status = GET_RTTSTATE(dhdp);
+#endif /* RTT_SUPPORT */
+               WL_ERR(("***SCAN event timeout. WQ state:0x%x scan_enq_time:"SEC_USEC_FMT
+                       " evt_hdlr_entry_time:"SEC_USEC_FMT" evt_deq_time:"SEC_USEC_FMT
+                       "\nscan_deq_time:"SEC_USEC_FMT" scan_hdlr_cmplt_time:"SEC_USEC_FMT
+                       " scan_cmplt_time:"SEC_USEC_FMT" evt_hdlr_exit_time:"SEC_USEC_FMT
+                       "\ncurrent_time:"SEC_USEC_FMT"\n", work_busy(&cfg->event_work),
+                       GET_SEC_USEC(cfg->tsinfo.scan_enq),
+                       GET_SEC_USEC(cfg->tsinfo.wl_evt_hdlr_entry),
+                       GET_SEC_USEC(cfg->tsinfo.wl_evt_deq),
+                       GET_SEC_USEC(cfg->tsinfo.scan_deq),
+                       GET_SEC_USEC(cfg->tsinfo.scan_hdlr_cmplt),
+                       GET_SEC_USEC(cfg->tsinfo.scan_cmplt),
+                       GET_SEC_USEC(cfg->tsinfo.wl_evt_hdlr_exit), GET_SEC_USEC(cur_time)));
+               if (cfg->tsinfo.scan_enq) {
+                       WL_ERR(("Elapsed time(ns): %llu\n", (cur_time - cfg->tsinfo.scan_enq)));
+               }
+               WL_ERR(("lock_states:[%d:%d:%d:%d:%d:%d]\n",
+                       mutex_is_locked(&cfg->if_sync),
+                       mutex_is_locked(&cfg->usr_sync),
+                       mutex_is_locked(&cfg->pm_sync),
+                       mutex_is_locked(&cfg->scan_sync),
+                       spin_is_locked(&cfg->cfgdrv_lock),
+                       spin_is_locked(&cfg->eq_lock)));
+#ifdef RTT_SUPPORT
+               WL_ERR(("RTT lock_state:[%d]\n",
+                       mutex_is_locked(&rtt_status->rtt_mutex)));
+#ifdef WL_NAN
+               WL_ERR(("RTT and Geofence lock_states:[%d:%d]\n",
+                       mutex_is_locked(&cfg->nancfg->nan_sync),
+                       mutex_is_locked(&(rtt_status)->geofence_mutex)));
+#endif /* WL_NAN */
+#endif /* RTT_SUPPORT */
+
+               /* use ASSERT() to trigger panic */
+               ASSERT(0);
+       }
+#endif /* DHD_KERNEL_SCHED_DEBUG && DHD_FW_COREDUMP */
+       dhd_bus_intr_count_dump(dhdp);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)) && !defined(CONFIG_MODULES)
+       /* Print WQ states. Enable only for in-built drivers as the symbol is not exported  */
+       show_workqueue_state();
+#endif /* LINUX_VER >= 4.1 && !CONFIG_MODULES */
+
+       bss_list = wl_escan_get_buf(cfg, FALSE);
+       if (!bss_list) {
+               WL_ERR(("bss_list is null. Didn't receive any partial scan results\n"));
+       } else {
+               WL_ERR(("Dump scan buffer:\n"
+                       "scanned AP count (%d)\n", bss_list->count));
+
+               bi = next_bss(bss_list, bi);
+               for_each_bss(bss_list, bi, i) {
+                       channel = wf_chspec_ctlchan(wl_chspec_driver_to_host(bi->chanspec));
+                       WL_ERR(("SSID :%s  Channel :%d\n", bi->SSID, channel));
+               }
+       }
+
+       ndev = wdev_to_wlc_ndev(wdev, cfg);
+       bzero(&msg, sizeof(wl_event_msg_t));
+       WL_ERR(("timer expired\n"));
+       dhdp->scan_timeout_occurred = TRUE;
+#ifdef BCMPCIE
+       (void)dhd_pcie_dump_int_regs(dhdp);
+       dhd_pcie_dump_rc_conf_space_cap(dhdp);
+#endif /* BCMPCIE */
+#if 0
+       if (dhdp->memdump_enabled) {
+               dhdp->memdump_type = DUMP_TYPE_SCAN_TIMEOUT;
+               dhd_bus_mem_dump(dhdp);
+       }
+#endif /* DHD_FW_COREDUMP */
+       /*
+        * For the memdump sanity, blocking bus transactions for a while
+        * Keeping it TRUE causes the sequential private cmd error
+        */
+       dhdp->scan_timeout_occurred = FALSE;
+       msg.event_type = hton32(WLC_E_ESCAN_RESULT);
+       msg.status = hton32(WLC_E_STATUS_TIMEOUT);
+       msg.reason = 0xFFFFFFFF;
+       wl_cfg80211_event(ndev, &msg, NULL);
+#ifdef CUSTOMER_HW4_DEBUG
+       if (!wl_scan_timeout_dbg_enabled)
+               wl_scan_timeout_dbg_set();
+#endif /* CUSTOMER_HW4_DEBUG */
+}
+
+s32 wl_init_scan(struct bcm_cfg80211 *cfg)
+{
+       int err = 0;
+
+       cfg->evt_handler[WLC_E_ESCAN_RESULT] = wl_escan_handler;
+       cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+       wl_escan_init_sync_id(cfg);
+
+       /* Init scan_timeout timer */
+       init_timer_compat(&cfg->scan_timeout, wl_scan_timeout, cfg);
+
+       wl_cfg80211_set_bcmcfg(cfg);
+
+       return err;
+}
+
+#ifdef WL_SCHED_SCAN
+/* If target scan is not reliable, set the below define to "1" to do a
+ * full escan
+ */
+static s32
+wl_notify_sched_scan_results(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data)
+{
+       wl_pfn_net_info_v1_t *netinfo, *pnetinfo;
+       wl_pfn_net_info_v2_t *netinfo_v2, *pnetinfo_v2;
+       struct wiphy *wiphy     = bcmcfg_to_wiphy(cfg);
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       int err = 0;
+       struct cfg80211_scan_request *request = NULL;
+       struct cfg80211_ssid ssid[MAX_PFN_LIST_COUNT];
+       struct ieee80211_channel *channel = NULL;
+       int channel_req = 0;
+       int band = 0;
+       wl_pfn_scanresults_v1_t *pfn_result_v1 = (wl_pfn_scanresults_v1_t *)data;
+       wl_pfn_scanresults_v2_t *pfn_result_v2 = (wl_pfn_scanresults_v2_t *)data;
+       int n_pfn_results = 0;
+       log_conn_event_t *event_data = NULL;
+       tlv_log *tlv_data = NULL;
+       u32 alloc_len = 0, tlv_len = 0;
+       u32 payload_len;
+       u8 tmp_buf[DOT11_MAX_SSID_LEN + 1];
+
+       WL_DBG(("Enter\n"));
+
+       /* These static asserts guarantee v1/v2 net_info and subnet_info are compatible
+        * in size and SSID offset, allowing v1 to be used below except for the results
+        * fields themselves (status, count, offset to netinfo).
+        */
+       STATIC_ASSERT(sizeof(wl_pfn_net_info_v1_t) == sizeof(wl_pfn_net_info_v2_t));
+       STATIC_ASSERT(sizeof(wl_pfn_lnet_info_v1_t) == sizeof(wl_pfn_lnet_info_v2_t));
+       STATIC_ASSERT(sizeof(wl_pfn_subnet_info_v1_t) == sizeof(wl_pfn_subnet_info_v2_t));
+       STATIC_ASSERT(OFFSETOF(wl_pfn_subnet_info_v1_t, SSID) ==
+                     OFFSETOF(wl_pfn_subnet_info_v2_t, u.SSID));
+
+       /* Extract the version-specific items */
+       if (pfn_result_v1->version == PFN_SCANRESULT_VERSION_V1) {
+               n_pfn_results = pfn_result_v1->count;
+               pnetinfo = pfn_result_v1->netinfo;
+               WL_INFORM_MEM(("PFN NET FOUND event. count:%d \n", n_pfn_results));
+
+               if (n_pfn_results > 0) {
+                       int i;
+
+                       if (n_pfn_results > MAX_PFN_LIST_COUNT)
+                               n_pfn_results = MAX_PFN_LIST_COUNT;
+
+                       bzero(&ssid, sizeof(ssid));
+
+                       request = (struct cfg80211_scan_request *)MALLOCZ(cfg->osh,
+                               sizeof(*request) + sizeof(*request->channels) * n_pfn_results);
+                       channel = (struct ieee80211_channel *)MALLOCZ(cfg->osh,
+                               (sizeof(struct ieee80211_channel) * n_pfn_results));
+                       if (!request || !channel) {
+                               WL_ERR(("No memory"));
+                               err = -ENOMEM;
+                               goto out_err;
+                       }
+
+                       request->wiphy = wiphy;
+
+                       if (DBG_RING_ACTIVE(dhdp, DHD_EVENT_RING_ID)) {
+                               alloc_len = sizeof(log_conn_event_t) + DOT11_MAX_SSID_LEN +
+                                       sizeof(uint16) + sizeof(int16);
+                               event_data = (log_conn_event_t *)MALLOC(cfg->osh, alloc_len);
+                               if (!event_data) {
+                                       WL_ERR(("%s: failed to allocate the log_conn_event_t with "
+                                               "length(%d)\n", __func__, alloc_len));
+                                       goto out_err;
+                               }
+                               tlv_len = 3 * sizeof(tlv_log);
+                               event_data->tlvs = (tlv_log *)MALLOC(cfg->osh, tlv_len);
+                               if (!event_data->tlvs) {
+                                       WL_ERR(("%s: failed to allocate the tlv_log with "
+                                               "length(%d)\n", __func__, tlv_len));
+                                       goto out_err;
+                               }
+                       }
+
+                       for (i = 0; i < n_pfn_results; i++) {
+                               netinfo = &pnetinfo[i];
+                               /* This looks useless, shouldn't Coverity complain? */
+                               if (!netinfo) {
+                                       WL_ERR(("Invalid netinfo ptr. index:%d", i));
+                                       err = -EINVAL;
+                                       goto out_err;
+                               }
+                               if (netinfo->pfnsubnet.SSID_len > DOT11_MAX_SSID_LEN) {
+                                       WL_ERR(("Wrong SSID length:%d\n",
+                                               netinfo->pfnsubnet.SSID_len));
+                                       err = -EINVAL;
+                                       goto out_err;
+                               }
+                               /* In previous step max SSID_len limited to DOT11_MAX_SSID_LEN
+                               * and tmp_buf size is DOT11_MAX_SSID_LEN+1
+                               */
+                               (void)memcpy_s(tmp_buf, DOT11_MAX_SSID_LEN,
+                                       netinfo->pfnsubnet.SSID, netinfo->pfnsubnet.SSID_len);
+                               tmp_buf[netinfo->pfnsubnet.SSID_len] = '\0';
+                               WL_PNO((">>> SSID:%s Channel:%d \n",
+                                       tmp_buf, netinfo->pfnsubnet.channel));
+                               /* PFN result doesn't have all the info which are required by
+                                * the supplicant. (For e.g IEs) Do a target Escan so that
+                                * sched scan results are reported via wl_inform_single_bss in
+                                * the required format. Escan does require the scan request in
+                                * the form of cfg80211_scan_request. For timebeing, create
+                                * cfg80211_scan_request one out of the received PNO event.
+                                */
+
+                               ssid[i].ssid_len = netinfo->pfnsubnet.SSID_len;
+                               /* Returning void as ssid[i].ssid_len is limited to max of
+                               * DOT11_MAX_SSID_LEN
+                               */
+                               (void)memcpy_s(ssid[i].ssid, IEEE80211_MAX_SSID_LEN,
+                                       netinfo->pfnsubnet.SSID, ssid[i].ssid_len);
+                               request->n_ssids++;
+
+                               channel_req = netinfo->pfnsubnet.channel;
+                               band = (channel_req <= CH_MAX_2G_CHANNEL) ? NL80211_BAND_2GHZ
+                                       : NL80211_BAND_5GHZ;
+                               channel[i].center_freq =
+                                       ieee80211_channel_to_frequency(channel_req, band);
+                               channel[i].band = band;
+                               channel[i].flags |= IEEE80211_CHAN_NO_HT40;
+                               request->channels[i] = &channel[i];
+                               request->n_channels++;
+
+                               if (DBG_RING_ACTIVE(dhdp, DHD_EVENT_RING_ID)) {
+                                       payload_len = sizeof(log_conn_event_t);
+                                       event_data->event = WIFI_EVENT_DRIVER_PNO_NETWORK_FOUND;
+                                       tlv_data = event_data->tlvs;
+
+                                       /* ssid */
+                                       tlv_data->tag = WIFI_TAG_SSID;
+                                       tlv_data->len = ssid[i].ssid_len;
+                                       (void)memcpy_s(tlv_data->value, DOT11_MAX_SSID_LEN,
+                                               ssid[i].ssid, ssid[i].ssid_len);
+                                       payload_len += TLV_LOG_SIZE(tlv_data);
+                                       tlv_data = TLV_LOG_NEXT(tlv_data);
+
+                                       /* channel */
+                                       tlv_data->tag = WIFI_TAG_CHANNEL;
+                                       tlv_data->len = sizeof(uint16);
+                                       (void)memcpy_s(tlv_data->value, sizeof(uint16),
+                                               &channel_req, sizeof(uint16));
+                                       payload_len += TLV_LOG_SIZE(tlv_data);
+                                       tlv_data = TLV_LOG_NEXT(tlv_data);
+
+                                       /* rssi */
+                                       tlv_data->tag = WIFI_TAG_RSSI;
+                                       tlv_data->len = sizeof(int16);
+                                       (void)memcpy_s(tlv_data->value, sizeof(int16),
+                                               &netinfo->RSSI, sizeof(int16));
+                                       payload_len += TLV_LOG_SIZE(tlv_data);
+                                       tlv_data = TLV_LOG_NEXT(tlv_data);
+
+                                       dhd_os_push_push_ring_data(dhdp, DHD_EVENT_RING_ID,
+                                               &event_data->event, payload_len);
+                               }
+                       }
+
+                       /* assign parsed ssid array */
+                       if (request->n_ssids)
+                               request->ssids = &ssid[0];
+
+                       if (wl_get_p2p_status(cfg, DISCOVERY_ON)) {
+                               WL_PNO((">>> P2P discovery was ON. Disabling it\n"));
+                               err = wl_cfgp2p_discover_enable_search(cfg, false);
+                               if (unlikely(err)) {
+                                       wl_clr_drv_status(cfg, SCANNING, ndev);
+                                       goto out_err;
+                               }
+                               p2p_scan(cfg) = false;
+                       }
+                       LOG_TS(cfg, scan_start);
+                       wl_set_drv_status(cfg, SCANNING, ndev);
+                       WL_PNO((">>> Doing targeted ESCAN on PNO event\n"));
+                       err = wl_do_escan(cfg, wiphy, ndev, request);
+                       if (err) {
+                               WL_ERR(("targeted escan failed. err:%d\n", err));
+                               goto out_err;
+                       }
+                       DBG_EVENT_LOG(dhdp, WIFI_EVENT_DRIVER_PNO_SCAN_REQUESTED);
+                       cfg->sched_scan_running = TRUE;
+               }
+               else {
+                       WL_ERR(("FALSE PNO Event. (pfn_count == 0) \n"));
+               }
+
+       } else if (pfn_result_v2->version == PFN_SCANRESULT_VERSION_V2) {
+               n_pfn_results = pfn_result_v2->count;
+               pnetinfo_v2 = (wl_pfn_net_info_v2_t *)pfn_result_v2->netinfo;
+
+               if (e->event_type == WLC_E_PFN_NET_LOST) {
+                       WL_PNO(("Do Nothing %d\n", e->event_type));
+                       return 0;
+               }
+
+               WL_INFORM_MEM(("PFN NET FOUND event. count:%d \n", n_pfn_results));
+
+               if (n_pfn_results > 0) {
+                       int i;
+
+                       if (n_pfn_results > MAX_PFN_LIST_COUNT)
+                               n_pfn_results = MAX_PFN_LIST_COUNT;
+
+                       bzero(&ssid, sizeof(ssid));
+
+                       request = (struct cfg80211_scan_request *)MALLOCZ(cfg->osh,
+                               sizeof(*request) + sizeof(*request->channels) * n_pfn_results);
+                       channel = (struct ieee80211_channel *)MALLOCZ(cfg->osh,
+                               (sizeof(struct ieee80211_channel) * n_pfn_results));
+                       if (!request || !channel) {
+                               WL_ERR(("No memory"));
+                               err = -ENOMEM;
+                               goto out_err;
+                       }
+
+                       request->wiphy = wiphy;
+
+                       if (DBG_RING_ACTIVE(dhdp, DHD_EVENT_RING_ID)) {
+                               alloc_len = sizeof(log_conn_event_t) + DOT11_MAX_SSID_LEN +
+                                       sizeof(uint16) + sizeof(int16);
+                               event_data = (log_conn_event_t *)MALLOC(cfg->osh, alloc_len);
+                               if (!event_data) {
+                                       WL_ERR(("%s: failed to allocate the log_conn_event_t with "
+                                               "length(%d)\n", __func__, alloc_len));
+                                       goto out_err;
+                               }
+                               tlv_len = 3 * sizeof(tlv_log);
+                               event_data->tlvs = (tlv_log *)MALLOC(cfg->osh, tlv_len);
+                               if (!event_data->tlvs) {
+                                       WL_ERR(("%s: failed to allocate the tlv_log with "
+                                               "length(%d)\n", __func__, tlv_len));
+                                       goto out_err;
+                               }
+                       }
+
+                       for (i = 0; i < n_pfn_results; i++) {
+                               netinfo_v2 = &pnetinfo_v2[i];
+                               /* This looks useless, shouldn't Coverity complain? */
+                               if (!netinfo_v2) {
+                                       WL_ERR(("Invalid netinfo ptr. index:%d", i));
+                                       err = -EINVAL;
+                                       goto out_err;
+                               }
+                               WL_PNO((">>> SSID:%s Channel:%d \n",
+                                       netinfo_v2->pfnsubnet.u.SSID,
+                                       netinfo_v2->pfnsubnet.channel));
+                               /* PFN result doesn't have all the info which are required by the
+                                * supplicant. (For e.g IEs) Do a target Escan so that sched scan
+                                * results are reported via wl_inform_single_bss in the required
+                                * format. Escan does require the scan request in the form of
+                                * cfg80211_scan_request. For timebeing, create
+                                * cfg80211_scan_request one out of the received PNO event.
+                                */
+                               ssid[i].ssid_len = MIN(DOT11_MAX_SSID_LEN,
+                                       netinfo_v2->pfnsubnet.SSID_len);
+                               /* max ssid_len as in previous step DOT11_MAX_SSID_LEN is same
+                               * as DOT11_MAX_SSID_LEN = 32
+                               */
+                               (void)memcpy_s(ssid[i].ssid, IEEE80211_MAX_SSID_LEN,
+                                       netinfo_v2->pfnsubnet.u.SSID, ssid[i].ssid_len);
+                               request->n_ssids++;
+
+                               channel_req = netinfo_v2->pfnsubnet.channel;
+                               band = (channel_req <= CH_MAX_2G_CHANNEL) ? NL80211_BAND_2GHZ
+                                       : NL80211_BAND_5GHZ;
+                               channel[i].center_freq =
+                                       ieee80211_channel_to_frequency(channel_req, band);
+                               channel[i].band = band;
+                               channel[i].flags |= IEEE80211_CHAN_NO_HT40;
+                               request->channels[i] = &channel[i];
+                               request->n_channels++;
+
+                               if (DBG_RING_ACTIVE(dhdp, DHD_EVENT_RING_ID)) {
+                                       payload_len = sizeof(log_conn_event_t);
+                                       event_data->event = WIFI_EVENT_DRIVER_PNO_NETWORK_FOUND;
+                                       tlv_data = event_data->tlvs;
+
+                                       /* ssid */
+                                       tlv_data->tag = WIFI_TAG_SSID;
+                                       tlv_data->len = netinfo_v2->pfnsubnet.SSID_len;
+                                       (void)memcpy_s(tlv_data->value, DOT11_MAX_SSID_LEN,
+                                               ssid[i].ssid, ssid[i].ssid_len);
+                                       payload_len += TLV_LOG_SIZE(tlv_data);
+                                       tlv_data = TLV_LOG_NEXT(tlv_data);
+
+                                       /* channel */
+                                       tlv_data->tag = WIFI_TAG_CHANNEL;
+                                       tlv_data->len = sizeof(uint16);
+                                       (void)memcpy_s(tlv_data->value, sizeof(uint16),
+                                               &channel_req, sizeof(uint16));
+                                       payload_len += TLV_LOG_SIZE(tlv_data);
+                                       tlv_data = TLV_LOG_NEXT(tlv_data);
+
+                                       /* rssi */
+                                       tlv_data->tag = WIFI_TAG_RSSI;
+                                       tlv_data->len = sizeof(int16);
+                                       (void)memcpy_s(tlv_data->value, sizeof(uint16),
+                                               &netinfo_v2->RSSI, sizeof(int16));
+                                       payload_len += TLV_LOG_SIZE(tlv_data);
+                                       tlv_data = TLV_LOG_NEXT(tlv_data);
+
+                                       dhd_os_push_push_ring_data(dhdp, DHD_EVENT_RING_ID,
+                                               &event_data->event, payload_len);
+                               }
+                       }
+
+                       /* assign parsed ssid array */
+                       if (request->n_ssids)
+                               request->ssids = &ssid[0];
+
+                       if (wl_get_p2p_status(cfg, DISCOVERY_ON)) {
+                               WL_PNO((">>> P2P discovery was ON. Disabling it\n"));
+                               err = wl_cfgp2p_discover_enable_search(cfg, false);
+                               if (unlikely(err)) {
+                                       wl_clr_drv_status(cfg, SCANNING, ndev);
+                                       goto out_err;
+                               }
+                               p2p_scan(cfg) = false;
+                       }
+
+                       LOG_TS(cfg, scan_start);
+                       wl_set_drv_status(cfg, SCANNING, ndev);
+                       WL_PNO((">>> Doing targeted ESCAN on PNO event\n"));
+                       err = wl_do_escan(cfg, wiphy, ndev, request);
+                       if (err) {
+                               WL_ERR(("targeted scan failure. err:%d\n", err));
+                               goto out_err;
+                       }
+                       DBG_EVENT_LOG(dhdp, WIFI_EVENT_DRIVER_PNO_SCAN_REQUESTED);
+                       cfg->sched_scan_running = TRUE;
+               }
+               else {
+                       WL_ERR(("FALSE PNO Event. (pfn_count == 0) \n"));
+               }
+       } else {
+               WL_ERR(("Unsupported version %d, expected %d or %d\n", pfn_result_v1->version,
+                       PFN_SCANRESULT_VERSION_V1, PFN_SCANRESULT_VERSION_V2));
+               err = -EINVAL;
+       }
+
+out_err:
+
+       if (err) {
+               /* Notify upper layer that sched scan has stopped so that
+                * upper layer can attempt fresh scan.
+                */
+               if (cfg->sched_scan_req) {
+                       WL_ERR(("sched_scan stopped\n"));
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0))
+                       cfg80211_sched_scan_stopped(wiphy, cfg->sched_scan_req->reqid);
+#else
+                       cfg80211_sched_scan_stopped(wiphy);
+#endif /* KERNEL > 4.11.0 */
+                       cfg->sched_scan_req = NULL;
+               } else {
+                       WL_ERR(("sched scan req null!\n"));
+               }
+               cfg->sched_scan_running = FALSE;
+               wl_clr_drv_status(cfg, SCANNING, ndev);
+               CLR_TS(cfg, scan_start);
+       }
+
+       if (request) {
+               MFREE(cfg->osh, request,
+                       sizeof(*request) + sizeof(*request->channels) * n_pfn_results);
+       }
+       if (channel) {
+               MFREE(cfg->osh, channel,
+                       (sizeof(struct ieee80211_channel) * n_pfn_results));
+       }
+
+       if (event_data) {
+               if (event_data->tlvs) {
+                       MFREE(cfg->osh, event_data->tlvs, tlv_len);
+               }
+               MFREE(cfg->osh, event_data, alloc_len);
+       }
+       return err;
+}
+#endif /* WL_SCHED_SCAN */
+
+#ifdef PNO_SUPPORT
+s32
+wl_notify_pfn_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       struct net_device *ndev = NULL;
+#ifdef GSCAN_SUPPORT
+       void *ptr;
+       int send_evt_bytes = 0;
+       u32 event = be32_to_cpu(e->event_type);
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+#endif /* GSCAN_SUPPORT */
+
+       WL_INFORM_MEM((">>> PNO Event\n"));
+
+       if (!data) {
+               WL_ERR(("Data received is NULL!\n"));
+               return 0;
+       }
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+#ifdef GSCAN_SUPPORT
+       ptr = dhd_dev_process_epno_result(ndev, data, event, &send_evt_bytes);
+       if (ptr) {
+               wl_cfgvendor_send_async_event(wiphy, ndev,
+                       GOOGLE_SCAN_EPNO_EVENT, ptr, send_evt_bytes);
+               MFREE(cfg->osh, ptr, send_evt_bytes);
+       }
+       if (!dhd_dev_is_legacy_pno_enabled(ndev))
+               return 0;
+#endif /* GSCAN_SUPPORT */
+
+#ifndef WL_SCHED_SCAN
+       /* CUSTOMER_HW4 has other PNO wakelock time by RB:5911 */
+       mutex_lock(&cfg->usr_sync);
+       /* TODO: Use cfg80211_sched_scan_results(wiphy); */
+       /* GregG : WAR as to supplicant busy and not allowed Kernel to suspend */
+       CFG80211_DISCONNECTED(ndev, 0, NULL, 0, false, GFP_KERNEL);
+       mutex_unlock(&cfg->usr_sync);
+#else
+       /* If cfg80211 scheduled scan is supported, report the pno results via sched
+        * scan results
+        */
+       wl_notify_sched_scan_results(cfg, ndev, e, data);
+#endif /* WL_SCHED_SCAN */
+       return 0;
+}
+#endif /* PNO_SUPPORT */
+
+#ifdef GSCAN_SUPPORT
+s32
+wl_notify_gscan_event(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = 0;
+       u32 event = be32_to_cpu(e->event_type);
+       void *ptr = NULL;
+       int send_evt_bytes = 0;
+       int event_type;
+       struct net_device *ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       u32 len = ntoh32(e->datalen);
+       u32 buf_len = 0;
+
+       switch (event) {
+               case WLC_E_PFN_BEST_BATCHING:
+                       err = dhd_dev_retrieve_batch_scan(ndev);
+                       if (err < 0) {
+                               WL_ERR(("Batch retrieval already in progress %d\n", err));
+                       } else {
+                               event_type = WIFI_SCAN_THRESHOLD_NUM_SCANS;
+                               if (data && len) {
+                                       event_type = *((int *)data);
+                               }
+                               wl_cfgvendor_send_async_event(wiphy, ndev,
+                                   GOOGLE_GSCAN_BATCH_SCAN_EVENT,
+                                    &event_type, sizeof(int));
+                       }
+                       break;
+               case WLC_E_PFN_SCAN_COMPLETE:
+                       event_type = WIFI_SCAN_COMPLETE;
+                       wl_cfgvendor_send_async_event(wiphy, ndev,
+                               GOOGLE_SCAN_COMPLETE_EVENT,
+                               &event_type, sizeof(int));
+                       break;
+               case WLC_E_PFN_BSSID_NET_FOUND:
+                       ptr = dhd_dev_hotlist_scan_event(ndev, data, &send_evt_bytes,
+                             HOTLIST_FOUND, &buf_len);
+                       if (ptr) {
+                               wl_cfgvendor_send_hotlist_event(wiphy, ndev,
+                                ptr, send_evt_bytes, GOOGLE_GSCAN_GEOFENCE_FOUND_EVENT);
+                               dhd_dev_gscan_hotlist_cache_cleanup(ndev, HOTLIST_FOUND);
+                       } else {
+                               err = -ENOMEM;
+                       }
+                       break;
+               case WLC_E_PFN_BSSID_NET_LOST:
+                       /* WLC_E_PFN_BSSID_NET_LOST is conflict shared with WLC_E_PFN_SCAN_ALLGONE
+                        * We currently do not use WLC_E_PFN_SCAN_ALLGONE, so if we get it, ignore
+                        */
+                       if (len) {
+                               ptr = dhd_dev_hotlist_scan_event(ndev, data, &send_evt_bytes,
+                                                                HOTLIST_LOST, &buf_len);
+                               if (ptr) {
+                                       wl_cfgvendor_send_hotlist_event(wiphy, ndev,
+                                        ptr, send_evt_bytes, GOOGLE_GSCAN_GEOFENCE_LOST_EVENT);
+                                       dhd_dev_gscan_hotlist_cache_cleanup(ndev, HOTLIST_LOST);
+                                       MFREE(cfg->osh, ptr, buf_len);
+                               } else {
+                                       err = -ENOMEM;
+                               }
+                       } else {
+                               err = -EINVAL;
+                       }
+                       break;
+               case WLC_E_PFN_GSCAN_FULL_RESULT:
+                       ptr = dhd_dev_process_full_gscan_result(ndev, data, len, &send_evt_bytes);
+                       if (ptr) {
+                               wl_cfgvendor_send_async_event(wiphy, ndev,
+                                   GOOGLE_SCAN_FULL_RESULTS_EVENT, ptr, send_evt_bytes);
+                               MFREE(cfg->osh, ptr, send_evt_bytes);
+                       } else {
+                               err = -ENOMEM;
+                       }
+                       break;
+               case WLC_E_PFN_SSID_EXT:
+                       ptr = dhd_dev_process_epno_result(ndev, data, event, &send_evt_bytes);
+                       if (ptr) {
+                               wl_cfgvendor_send_async_event(wiphy, ndev,
+                                   GOOGLE_SCAN_EPNO_EVENT, ptr, send_evt_bytes);
+                               MFREE(cfg->osh, ptr, send_evt_bytes);
+                       } else {
+                               err = -ENOMEM;
+                       }
+                       break;
+               default:
+                       WL_ERR(("Unknown event %d\n", event));
+                       break;
+       }
+       return err;
+}
+#endif /* GSCAN_SUPPORT */
+
+void wl_cfg80211_set_passive_scan(struct net_device *dev, char *command)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+
+       if (strcmp(command, "SCAN-ACTIVE") == 0) {
+               cfg->active_scan = 1;
+       } else if (strcmp(command, "SCAN-PASSIVE") == 0) {
+               cfg->active_scan = 0;
+       } else
+               WL_ERR(("Unknown command \n"));
+       return;
+}
+
+void
+wl_cfgscan_listen_complete_work(struct work_struct *work)
+{
+       struct bcm_cfg80211 *cfg = NULL;
+       BCM_SET_CONTAINER_OF(cfg, work, struct bcm_cfg80211, loc.work.work);
+
+       WL_ERR(("listen timeout\n"));
+       /* listen not completed. Do recovery */
+       if (!cfg->loc.in_progress) {
+               WL_ERR(("No listen in progress!\n"));
+               return;
+       }
+       wl_cfgscan_notify_listen_complete(cfg);
+}
+
+s32
+wl_cfgscan_notify_listen_complete(struct bcm_cfg80211 *cfg)
+{
+       WL_DBG(("listen on channel complete! cookie:%llu\n", cfg->last_roc_id));
+       if (cfg->loc.wdev && cfg->loc.in_progress) {
+#if defined(WL_CFG80211_P2P_DEV_IF)
+               cfg80211_remain_on_channel_expired(cfg->loc.wdev, cfg->last_roc_id,
+                       &cfg->remain_on_chan, GFP_KERNEL);
+#else
+               cfg80211_remain_on_channel_expired(cfg->loc.wdev->netdev, cfg->last_roc_id,
+                       &cfg->remain_on_chan, cfg->remain_on_chan_type, GFP_KERNEL);
+#endif
+               cfg->loc.in_progress = false;
+               cfg->loc.wdev = NULL;
+       }
+       return BCME_OK;
+}
+
+static void
+wl_init_scan_params(struct bcm_cfg80211 *cfg, u8 *params, u16 params_size,
+       u32 scan_type, u32 action, u32 passive_time)
+{
+       u32 sync_id = 0;
+       wl_escan_params_t *eparams = NULL;
+       wl_escan_params_v2_t *eparams_v2 = NULL;
+       wl_scan_params_t *scanparams = NULL;
+       wl_scan_params_v2_t *scanparams_v2 = NULL;
+
+       wl_escan_set_sync_id(sync_id, cfg);
+       if (cfg->scan_params_v2) {
+               eparams_v2 = (wl_escan_params_v2_t *)params;
+               eparams_v2->version = htod32(ESCAN_REQ_VERSION_V2);
+               eparams_v2->action =  htod16(action);
+               eparams_v2->sync_id = sync_id;
+               scanparams_v2 = (wl_scan_params_v2_t *)&eparams_v2->params;
+               (void)memcpy_s(&scanparams_v2->bssid, ETHER_ADDR_LEN, &ether_bcast, ETHER_ADDR_LEN);
+               scanparams_v2->version = htod16(WL_SCAN_PARAMS_VERSION_V2);
+               scanparams_v2->length = htod16(sizeof(wl_scan_params_v2_t));
+               scanparams_v2->bss_type = DOT11_BSSTYPE_ANY;
+               scanparams_v2->scan_type = htod32(scan_type);
+               scanparams_v2->nprobes = htod32(-1);
+               scanparams_v2->active_time = htod32(-1);
+               scanparams_v2->passive_time = htod32(passive_time);
+               scanparams_v2->home_time = htod32(-1);
+               bzero(&scanparams_v2->ssid, sizeof(wlc_ssid_t));
+       } else {
+               eparams = (wl_escan_params_t *)params;
+               eparams->version = htod32(ESCAN_REQ_VERSION);
+               eparams->action =  htod16(action);
+               eparams->sync_id = sync_id;
+               scanparams = (wl_scan_params_t *)&eparams->params;
+               (void)memcpy_s(&scanparams->bssid, ETHER_ADDR_LEN, &ether_bcast, ETHER_ADDR_LEN);
+               scanparams->bss_type = DOT11_BSSTYPE_ANY;
+               scanparams->scan_type = 0;
+               scanparams->nprobes = htod32(-1);
+               scanparams->active_time = htod32(-1);
+               scanparams->passive_time = htod32(passive_time);
+               scanparams->home_time = htod32(-1);
+               bzero(&scanparams->ssid, sizeof(wlc_ssid_t));
+       }
+}
+
+/* timeout for recoverying upper layer statemachine */
+#define WL_LISTEN_TIMEOUT    3000u
+
+s32
+wl_cfgscan_cancel_listen_on_channel(struct bcm_cfg80211 *cfg, bool notify_user)
+{
+       WL_DBG(("Enter\n"));
+
+       mutex_lock(&cfg->scan_sync);
+       if (!cfg->loc.in_progress) {
+               WL_ERR(("listen not in progress. do nothing\n"));
+               goto exit;
+       }
+
+       if (delayed_work_pending(&cfg->loc.work)) {
+               cancel_delayed_work_sync(&cfg->loc.work);
+       }
+
+       /* abort scan listen */
+       wl_cfg80211_scan_abort(cfg);
+
+       if (notify_user) {
+               wl_cfgscan_notify_listen_complete(cfg);
+       }
+       cfg->loc.in_progress = false;
+       cfg->loc.wdev = NULL;
+exit:
+       mutex_unlock(&cfg->scan_sync);
+       return 0;
+}
+
+s32
+wl_cfgscan_listen_on_channel(struct bcm_cfg80211 *cfg, struct wireless_dev *wdev,
+       struct ieee80211_channel *channel, unsigned long duration)
+{
+       u32 dwell = duration;
+       u32 chanspec, params_size;
+       u16 chanspec_num = 0;
+       s32 bssidx = -1;
+       s32 err = 0;
+       struct net_device *ndev = NULL;
+       u8 *params = NULL;
+       wl_escan_params_t *eparams = NULL;
+       wl_escan_params_v2_t *eparams_v2 = NULL;
+       wl_scan_params_t *scanparams = NULL;
+       wl_scan_params_v2_t *scanparams_v2 = NULL;
+       u16 *chanspec_list = NULL;
+       u32 channel_num = 0, scan_type = 0;
+
+       WL_DBG(("Enter \n"));
+       if (!wdev) {
+         WL_ERR(("wdev null!\n"));
+         return -EINVAL;
+       }
+
+       mutex_lock(&cfg->scan_sync);
+       if (cfg->loc.in_progress == true) {
+               WL_ERR(("Listen in progress\n"));
+               err = -EAGAIN;
+               goto exit;
+       }
+       bssidx = wl_get_bssidx_by_wdev(cfg, wdev);
+       if (bssidx < 0) {
+               WL_ERR(("invalid bssidx!\n"));
+               err = -EINVAL;
+               goto exit;
+       }
+
+       /* Use primary ndev for netless dev. BSSIDX will point to right I/F */
+       ndev = wdev->netdev ? wdev->netdev : bcmcfg_to_prmry_ndev(cfg);
+
+       if (cfg->scan_params_v2) {
+               params_size = (WL_SCAN_PARAMS_V2_FIXED_SIZE +
+                       OFFSETOF(wl_escan_params_v2_t, params));
+       } else {
+               params_size = (WL_SCAN_PARAMS_FIXED_SIZE + OFFSETOF(wl_escan_params_t, params));
+       }
+
+       /* Single channel for listen case. Add a padd of u16 for alignment */
+       chanspec_num = 1;
+       params_size += (chanspec_num + 1);
+
+       /* Allocate space for populating single ssid in wl_escan_params_t struct */
+       params_size += ((u32) sizeof(struct wlc_ssid));
+
+       params = MALLOCZ(cfg->osh, params_size);
+       if (params == NULL) {
+               err = -ENOMEM;
+               WL_ERR(("listen fail. no mem.\n"));
+               goto exit;
+       }
+
+       scan_type = WL_SCANFLAGS_PASSIVE | WL_SCANFLAGS_LISTEN;
+
+       wl_init_scan_params(cfg, params, params_size,
+               scan_type, WL_SCAN_ACTION_START, dwell);
+
+       channel_num = (chanspec_num & WL_SCAN_PARAMS_COUNT_MASK);
+       if (cfg->scan_params_v2) {
+               eparams_v2 = (wl_escan_params_v2_t *)params;
+               scanparams_v2 = (wl_scan_params_v2_t *)&eparams_v2->params;
+               chanspec_list = scanparams_v2->channel_list;
+               scanparams_v2->channel_num = channel_num;
+       } else {
+               eparams = (wl_escan_params_t *)params;
+               scanparams = (wl_scan_params_t *)&eparams->params;
+               chanspec_list = scanparams->channel_list;
+               scanparams->channel_num = channel_num;
+       }
+
+       /* Copy the single listen channel */
+       chanspec = wl_freq_to_chanspec(channel->center_freq);
+       chanspec_list[0] = chanspec;
+
+       err = wldev_iovar_setbuf_bsscfg(ndev, "escan", params, params_size,
+               cfg->escan_ioctl_buf, WLC_IOCTL_MEDLEN, bssidx, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               if (err == BCME_EPERM) {
+                       /* Scan Not permitted at this point of time */
+                       WL_DBG((" listen not permitted at this time (%d)\n", err));
+               } else {
+                       WL_ERR((" listen set error (%d)\n", err));
+               }
+               goto exit;
+       } else {
+               unsigned long listen_timeout = dwell + WL_LISTEN_TIMEOUT;
+               WL_DBG(("listen started. chanspec:%x\n", chanspec));
+               cfg->loc.in_progress = true;
+               cfg->loc.wdev = wdev;
+
+               if (schedule_delayed_work(&cfg->loc.work,
+                               msecs_to_jiffies(listen_timeout))) {
+
+                       DHD_PM_WAKE_LOCK_TIMEOUT(cfg->pub, listen_timeout);
+
+               } else {
+                       WL_ERR(("Can't schedule listen work handler\n"));
+               }
+       }
+
+exit:
+       if (params) {
+               MFREE(cfg->osh, params, params_size);
+       }
+       mutex_unlock(&cfg->scan_sync);
+       return err;
+}
+
+#define LONG_LISTEN_TIME 2000
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+static void
+wl_priortize_scan_over_listen(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev, unsigned int duration)
+{
+       WL_DBG(("scan is running. go to fake listen state\n"));
+       wl_set_drv_status(cfg, FAKE_REMAINING_ON_CHANNEL, ndev);
+
+       if (timer_pending(&cfg->p2p->listen_timer)) {
+               WL_DBG(("cancel current listen timer \n"));
+               del_timer_sync(&cfg->p2p->listen_timer);
+       }
+
+       wl_clr_p2p_status(cfg, LISTEN_EXPIRED);
+
+       INIT_TIMER(&cfg->p2p->listen_timer,
+               wl_cfgp2p_listen_expired, duration, 0);
+}
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+/* Few vendors use hard coded static ndev p2p0 for p2p disc */
+#define IS_P2P_DISC_NDEV(wdev) \
+       (wdev->netdev ? (strncmp(wdev->netdev->name, "p2p0", strlen("p2p0")) == 0) : false)
+
+s32
+#if defined(WL_CFG80211_P2P_DEV_IF)
+wl_cfgscan_remain_on_channel(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+       struct ieee80211_channel *channel, unsigned int duration, u64 *cookie)
+#else
+wl_cfgscan_remain_on_channel(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+       struct ieee80211_channel *channel,
+       enum nl80211_channel_type channel_type,
+       unsigned int duration, u64 *cookie)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+{
+       s32 target_channel;
+       u32 id;
+       s32 err = BCME_OK;
+       struct net_device *ndev = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct wireless_dev *wdev;
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+
+       mutex_lock(&cfg->usr_sync);
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       wdev = cfgdev;
+#else
+       wdev = ndev_to_wdev(ndev);
+#endif
+       if (!wdev) {
+               WL_ERR(("wdev null\n"));
+               err = -EINVAL;
+               goto exit;
+       }
+
+       target_channel = ieee80211_frequency_to_channel(channel->center_freq);
+
+       WL_DBG(("Enter, channel: %d, duration ms (%d) scan_state:%d\n",
+               target_channel, duration,
+               (wl_get_drv_status(cfg, SCANNING, ndev)) ? TRUE : FALSE));
+
+#ifdef WL_BCNRECV
+       /* check fakeapscan in progress then abort */
+       wl_android_bcnrecv_stop(ndev, WL_BCNRECV_LISTENBUSY);
+#endif /* WL_BCNRECV */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       if ((wdev->iftype == NL80211_IFTYPE_P2P_DEVICE) || IS_P2P_DISC_NDEV(wdev))
+#else
+       if (cfg->p2p)
+#endif
+       {
+               /* p2p discovery */
+               if (!cfg->p2p) {
+                       WL_ERR(("cfg->p2p is not initialized\n"));
+                       err = BCME_ERROR;
+                       goto exit;
+               }
+
+#ifdef P2P_LISTEN_OFFLOADING
+               if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS)) {
+                       WL_ERR(("P2P_FIND: Discovery offload is in progress\n"));
+                       err = -EAGAIN;
+                       goto exit;
+               }
+#endif /* P2P_LISTEN_OFFLOADING */
+
+               if (wl_get_drv_status_all(cfg, SCANNING)) {
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+                       if (duration > LONG_LISTEN_TIME) {
+                               wl_cfg80211_scan_abort(cfg);
+                       } else {
+                               wl_priortize_scan_over_listen(cfg, ndev, duration);
+                               err = BCME_OK;
+                               goto exit;
+                       }
+#else
+                       wl_cfg80211_cancel_scan(cfg);
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+               }
+
+#ifdef WL_CFG80211_SYNC_GON
+               if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM_LISTEN)) {
+                       /* Do not enter listen mode again if we are in listen mode already
+                       * for next af. Remain on channel completion will be returned by
+                       * af completion.
+                       */
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+                       wl_set_drv_status(cfg, FAKE_REMAINING_ON_CHANNEL, ndev);
+#else
+                       wl_set_drv_status(cfg, REMAINING_ON_CHANNEL, ndev);
+#endif
+                       goto exit;
+               }
+#endif /* WL_CFG80211_SYNC_GON */
+
+               if (!cfg->p2p->on) {
+               /* In case of p2p_listen command, supplicant may send
+               * remain_on_channel without turning on P2P
+               */
+                       p2p_on(cfg) = true;
+               }
+
+               err = wl_cfgp2p_enable_discovery(cfg, ndev, NULL, 0);
+               if (unlikely(err)) {
+                       goto exit;
+               }
+               err = wl_cfgp2p_discover_listen(cfg, target_channel, duration);
+               if (err == BCME_OK) {
+                       wl_set_drv_status(cfg, REMAINING_ON_CHANNEL, ndev);
+               } else {
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+                       if (err == BCME_BUSY) {
+                               /* if failed, firmware may be internal scanning state.
+                               * so other scan request shall not abort it
+                               */
+                               wl_set_drv_status(cfg, FAKE_REMAINING_ON_CHANNEL, ndev);
+                               /* WAR: set err = ok to prevent cookie mismatch in wpa_supplicant
+                               * and expire timer will send a completion to the upper layer
+                               */
+                               err = BCME_OK;
+                       }
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+               }
+       } else if (wdev->iftype == NL80211_IFTYPE_STATION ||
+               wdev->iftype == NL80211_IFTYPE_AP) {
+               WL_DBG(("LISTEN ON CHANNEL\n"));
+               err = wl_cfgscan_listen_on_channel(cfg, wdev, channel, duration);
+       }
+
+exit:
+       if (err == BCME_OK) {
+               WL_DBG(("Success\n"));
+               (void)memcpy_s(&cfg->remain_on_chan, sizeof(struct ieee80211_channel),
+                       channel, sizeof(struct ieee80211_channel));
+#if defined(WL_ENABLE_P2P_IF)
+               cfg->remain_on_chan_type = channel_type;
+#endif /* WL_ENABLE_P2P_IF */
+               id = ++cfg->last_roc_id;
+               if (id == 0) {
+                       id = ++cfg->last_roc_id;
+               }
+               *cookie = id;
+
+               /* Notify userspace that listen has started */
+               CFG80211_READY_ON_CHANNEL(cfgdev, *cookie, channel, channel_type, duration, flags);
+               WL_INFORM_MEM(("listen started on channel:%d duration (ms):%d cookie:%llu\n",
+                               target_channel, duration, *cookie));
+       } else {
+               WL_ERR(("Fail to Set (err=%d cookie:%llu)\n", err, *cookie));
+               wl_flush_fw_log_buffer(ndev, FW_LOGSET_MASK_ALL);
+       }
+       mutex_unlock(&cfg->usr_sync);
+       return err;
+}
+
+s32
+wl_cfgscan_cancel_remain_on_channel(struct wiphy *wiphy,
+       bcm_struct_cfgdev *cfgdev, u64 cookie)
+{
+       s32 err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+#ifdef P2PLISTEN_AP_SAMECHN
+       struct net_device *dev;
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+
+#ifdef DHD_IFDEBUG
+       PRINT_WDEV_INFO(cfgdev);
+#endif /* DHD_IFDEBUG */
+
+       mutex_lock(&cfg->usr_sync);
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       WL_DBG(("cancel listen for iftype:%d\n", cfgdev->iftype));
+       if ((cfgdev->iftype != NL80211_IFTYPE_P2P_DEVICE) &&
+               !IS_P2P_DISC_NDEV(cfgdev)) {
+               /* Handle non-p2p cases here */
+               err = wl_cfgscan_cancel_listen_on_channel(cfg, false);
+               goto exit;
+       }
+#else
+       WL_DBG(("cancel listen for netdev_ifidx: %d \n", cfgdev->ifindex));
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#ifdef P2PLISTEN_AP_SAMECHN
+       if (cfg && cfg->p2p_resp_apchn_status) {
+               dev = bcmcfg_to_prmry_ndev(cfg);
+               wl_cfg80211_set_p2p_resp_ap_chn(dev, 0);
+               cfg->p2p_resp_apchn_status = false;
+               WL_DBG(("p2p_resp_apchn_status Turn OFF \n"));
+       }
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+       if (cfg->last_roc_id == cookie) {
+               WL_DBG(("cancel p2p listen. cookie:%llu\n", cookie));
+               wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+                       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+       } else {
+               WL_ERR(("wl_cfg80211_cancel_remain_on_channel: ignore, request cookie(%llu)"
+                       " is not matched. (cur : %llu)\n",
+                       cookie, cfg->last_roc_id));
+       }
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+exit:
+#endif
+       mutex_unlock(&cfg->usr_sync);
+       return err;
+}
+
+#ifdef WL_GET_RCC
+int
+wl_android_get_roam_scan_chanlist(struct bcm_cfg80211 *cfg)
+{
+       s32 err = BCME_OK;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+       struct sk_buff *skb;
+       gfp_t kflags;
+       struct net_device *ndev;
+       struct wiphy *wiphy;
+       wlc_ssid_t *ssid = NULL;
+       wl_roam_channel_list_t channel_list;
+       uint16 channels[MAX_ROAM_CHANNEL] = {0};
+       int i = 0;
+
+       ndev = bcmcfg_to_prmry_ndev(cfg);
+       wiphy = bcmcfg_to_wiphy(cfg);
+
+       kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+       skb = CFG80211_VENDOR_EVENT_ALLOC(wiphy, ndev_to_wdev(ndev),
+               BRCM_VENDOR_GET_RCC_EVENT_BUF_LEN, BRCM_VENDOR_EVENT_RCC_INFO, kflags);
+
+       if (!skb) {
+               WL_ERR(("skb alloc failed"));
+               return BCME_NOMEM;
+       }
+
+       /* Get Current SSID */
+       ssid = (struct wlc_ssid *)wl_read_prof(cfg, ndev, WL_PROF_SSID);
+       if (!ssid) {
+               WL_ERR(("No SSID found in the saved profile\n"));
+               err = BCME_ERROR;
+               goto fail;
+       }
+
+       /* Get Current RCC List */
+       err = wldev_iovar_getbuf(ndev, "roamscan_channels", 0, 0,
+               (void *)&channel_list, sizeof(channel_list), NULL);
+       if (err) {
+               WL_ERR(("Failed to get roamscan channels, err = %d\n", err));
+               goto fail;
+       }
+       if (channel_list.n > MAX_ROAM_CHANNEL) {
+               WL_ERR(("Invalid roamscan channels count(%d)\n", channel_list.n));
+               goto fail;
+       }
+
+       WL_DBG(("SSID %s(%d), RCC(%d)\n", ssid->SSID, ssid->SSID_len, channel_list.n));
+       for (i = 0; i < channel_list.n; i++) {
+               channels[i] = CHSPEC_CHANNEL(channel_list.channels[i]);
+               WL_DBG(("Chanspec[%d] CH:%03d(0x%04x)\n",
+                       i, channels[i], channel_list.channels[i]));
+       }
+
+       err = nla_put_string(skb, RCC_ATTRIBUTE_SSID, ssid->SSID);
+       if (unlikely(err)) {
+               WL_ERR(("nla_put_string RCC_ATTRIBUTE_SSID failed\n"));
+               goto fail;
+       }
+
+       err = nla_put_u32(skb, RCC_ATTRIBUTE_SSID_LEN, ssid->SSID_len);
+       if (unlikely(err)) {
+               WL_ERR(("nla_put_u32 RCC_ATTRIBUTE_SSID_LEN failed\n"));
+               goto fail;
+       }
+
+       err = nla_put_u32(skb, RCC_ATTRIBUTE_NUM_CHANNELS, channel_list.n);
+       if (unlikely(err)) {
+               WL_ERR(("nla_put_u32 RCC_ATTRIBUTE_NUM_CHANNELS failed\n"));
+               goto fail;
+       }
+
+       err = nla_put(skb, RCC_ATTRIBUTE_CHANNEL_LIST,
+               sizeof(uint16) * MAX_ROAM_CHANNEL, channels);
+       if (unlikely(err)) {
+               WL_ERR(("nla_put RCC_ATTRIBUTE_CHANNEL_LIST failed\n"));
+               goto fail;
+       }
+
+       cfg80211_vendor_event(skb, kflags);
+
+       return err;
+
+fail:
+       if (skb) {
+               nlmsg_free(skb);
+       }
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
+       return err;
+}
+#endif /* WL_GET_RCC */
+
+/*
+ * This function prepares assoc channel/s
+ */
+s32
+wl_get_assoc_channels(struct bcm_cfg80211 *cfg,
+       struct net_device *dev, wlcfg_assoc_info_t *info)
+{
+#ifdef ESCAN_CHANNEL_CACHE
+       s32 err;
+       u32 max_channels = MAX_ROAM_CHANNEL;
+       u16 rcc_chan_cnt = 0;
+
+       /*
+        * If bcast join 'OR' no channel information is provided by user space,
+        * then use channels from ESCAN_CHANNEL_CACHE. For other cases where target
+        * channel is available, update RCC via iovar.
+        *
+        * For a given SSID there might multiple APs on different channels and FW
+        * would scan all those channels before deciding up on the AP.
+        */
+       if (cfg->rcc_enabled) {
+               wlc_ssid_t ssid;
+               int band;
+               chanspec_t chanspecs[MAX_ROAM_CHANNEL] = {0};
+               chanspec_t target_chspec;
+
+               err = wldev_get_band(dev, &band);
+               if (!err) {
+                       set_roam_band(band);
+               }
+
+               if (memcpy_s(ssid.SSID, sizeof(ssid.SSID), info->ssid, info->ssid_len) != BCME_OK) {
+                       WL_ERR(("ssid copy failed\n"));
+                       return -EINVAL;
+               }
+               ssid.SSID_len = (uint32)info->ssid_len;
+
+               if (info->targeted_join && info->chanspecs[0]) {
+                       target_chspec = info->chanspecs[0];
+               } else {
+                       target_chspec = INVCHANSPEC;
+               }
+               rcc_chan_cnt = get_roam_channel_list(cfg, target_chspec, chanspecs,
+                               max_channels, &ssid, ioctl_version);
+               if ((!info->targeted_join) || (info->chan_cnt == 0)) {
+                       /* Use RCC channels as part of join params */
+                       info->chan_cnt = rcc_chan_cnt;
+                       if (memcpy_s(info->chanspecs, sizeof(info->chanspecs), chanspecs,
+                                       (sizeof(chanspec_t) * rcc_chan_cnt)) != BCME_OK) {
+                               WL_ERR(("chanspec copy failed!\n"));
+                               return -EINVAL;
+                       }
+               }
+       }
+#endif /* ESCAN_CHANNEL_CACHE */
+
+       WL_DBG_MEM(("channel cnt:%d\n", info->chan_cnt));
+       return BCME_OK;
+}
diff --git a/bcmdhd.101.10.240.x/wl_cfgscan.h b/bcmdhd.101.10.240.x/wl_cfgscan.h
new file mode 100644 (file)
index 0000000..88fa599
--- /dev/null
@@ -0,0 +1,143 @@
+/*
+ * Header for Linux cfg80211 scan
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#ifndef _wl_cfgscan_h_
+#define _wl_cfgscan_h_
+
+#include <linux/wireless.h>
+#include <typedefs.h>
+#include <ethernet.h>
+#include <wlioctl.h>
+#include <linux/wireless.h>
+#include <net/cfg80211.h>
+#include <linux/rfkill.h>
+#include <osl.h>
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
+#define GET_SCAN_WDEV(scan_request) \
+       (scan_request && scan_request->dev) ? scan_request->dev->ieee80211_ptr : NULL;
+#else
+#define GET_SCAN_WDEV(scan_request) \
+       scan_request ? scan_request->wdev : NULL;
+#endif
+#ifdef WL_SCHED_SCAN
+#define GET_SCHED_SCAN_WDEV(scan_request) \
+       (scan_request && scan_request->dev) ? scan_request->dev->ieee80211_ptr : NULL;
+#endif /* WL_SCHED_SCAN */
+
+#ifdef DUAL_ESCAN_RESULT_BUFFER
+#define wl_escan_set_sync_id(a, b) ((a) = (b)->escan_info.cur_sync_id)
+#define wl_escan_set_type(a, b) ((a)->escan_info.escan_type\
+                               [((a)->escan_info.cur_sync_id)%SCAN_BUF_CNT] = (b))
+#else
+#define wl_escan_set_sync_id(a, b) ((a) = htod16((b)->escan_sync_id_cntr++))
+#define wl_escan_set_type(a, b)
+#endif /* DUAL_ESCAN_RESULT_BUFFER */
+extern s32 wl_escan_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+extern s32 wl_do_escan(struct bcm_cfg80211 *cfg, struct wiphy *wiphy,
+       struct net_device *ndev, struct cfg80211_scan_request *request);
+extern s32 __wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+       struct cfg80211_scan_request *request, struct cfg80211_ssid *this_ssid);
+#if defined(WL_CFG80211_P2P_DEV_IF)
+extern s32 wl_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request);
+#else
+extern s32 wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+       struct cfg80211_scan_request *request);
+extern int wl_cfg80211_scan_stop(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0))
+extern void wl_cfg80211_abort_scan(struct wiphy *wiphy, struct wireless_dev *wdev);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 5, 0)) */
+extern void wl_cfg80211_scan_abort(struct bcm_cfg80211 *cfg);
+extern s32 wl_init_scan(struct bcm_cfg80211 *cfg);
+extern int wl_cfg80211_scan_stop(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev);
+extern s32 wl_notify_scan_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+extern void wl_cfg80211_set_passive_scan(struct net_device *dev, char *command);
+#ifdef PNO_SUPPORT
+extern s32 wl_notify_pfn_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#endif /* PNO_SUPPORT */
+#ifdef GSCAN_SUPPORT
+extern s32 wl_notify_gscan_event(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#endif /* GSCAN_SUPPORT */
+
+#ifdef WES_SUPPORT
+#ifdef CUSTOMER_SCAN_TIMEOUT_SETTING
+#define CUSTOMER_WL_SCAN_TIMER_INTERVAL_MS     25000 /* Scan timeout */
+enum wl_custom_scan_time_type {
+       WL_CUSTOM_SCAN_CHANNEL_TIME = 0,
+       WL_CUSTOM_SCAN_UNASSOC_TIME,
+       WL_CUSTOM_SCAN_PASSIVE_TIME,
+       WL_CUSTOM_SCAN_HOME_TIME,
+       WL_CUSTOM_SCAN_HOME_AWAY_TIME
+};
+extern s32 wl_cfg80211_custom_scan_time(struct net_device *dev,
+               enum wl_custom_scan_time_type type, int time);
+#endif /* CUSTOMER_SCAN_TIMEOUT_SETTING */
+#endif /* WES_SUPPORT */
+
+#if defined(SUPPORT_RANDOM_MAC_SCAN)
+int wl_cfg80211_set_random_mac(struct net_device *dev, bool enable);
+int wl_cfg80211_random_mac_enable(struct net_device *dev);
+int wl_cfg80211_random_mac_disable(struct net_device *dev);
+int wl_cfg80211_scan_mac_enable(struct net_device *dev);
+int wl_cfg80211_scan_mac_disable(struct net_device *dev);
+int wl_cfg80211_scan_mac_config(struct net_device *dev, uint8 *rand_mac, uint8 *rand_mask);
+#endif /* SUPPORT_RANDOM_MAC_SCAN */
+
+#ifdef WL_SCHED_SCAN
+extern int wl_cfg80211_sched_scan_start(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_sched_scan_request *request);
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(4, 11, 0))
+extern int wl_cfg80211_sched_scan_stop(struct wiphy *wiphy, struct net_device *dev, u64 reqid);
+#else
+extern int wl_cfg80211_sched_scan_stop(struct wiphy *wiphy, struct net_device *dev);
+#endif /* LINUX_VER > 4.11 */
+#endif /* WL_SCHED_SCAN */
+extern s32 wl_cfgscan_listen_on_channel(struct bcm_cfg80211 *cfg, struct wireless_dev *wdev,
+               struct ieee80211_channel *channel, unsigned long duration);
+extern void wl_cfgscan_listen_complete_work(struct work_struct *work);
+extern s32 wl_cfgscan_notify_listen_complete(struct bcm_cfg80211 *cfg);
+extern s32 wl_cfgscan_cancel_listen_on_channel(struct bcm_cfg80211 *cfg, bool notify_user);
+#if defined(WL_CFG80211_P2P_DEV_IF)
+extern s32 wl_cfgscan_remain_on_channel(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+       struct ieee80211_channel *channel, unsigned int duration, u64 *cookie);
+#else
+extern s32 wl_cfgscan_remain_on_channel(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+       struct ieee80211_channel *channel, enum nl80211_channel_type channel_type,
+       unsigned int duration, u64 *cookie);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+extern s32 wl_cfgscan_cancel_remain_on_channel(struct wiphy *wiphy,
+       bcm_struct_cfgdev *cfgdev, u64 cookie);
+extern chanspec_t wl_freq_to_chanspec(int freq);
+extern s32 wl_inform_single_bss(struct bcm_cfg80211 *cfg, wl_bss_info_t *bi, bool update_ssid);
+#ifdef WL_GET_RCC
+extern int wl_android_get_roam_scan_chanlist(struct bcm_cfg80211 *cfg);
+#endif /* WL_GET_RCC */
+extern s32 wl_get_assoc_channels(struct bcm_cfg80211 *cfg,
+       struct net_device *dev, wlcfg_assoc_info_t *info);
+#endif /* _wl_cfgscan_h_ */
diff --git a/bcmdhd.101.10.240.x/wl_cfgvendor.c b/bcmdhd.101.10.240.x/wl_cfgvendor.c
new file mode 100644 (file)
index 0000000..2121230
--- /dev/null
@@ -0,0 +1,9649 @@
+/*
+ * Linux cfg80211 Vendor Extension Code
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+/*
+ * New vendor interface additon to nl80211/cfg80211 to allow vendors
+ * to implement proprietary features over the cfg80211 stack.
+*/
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#include <linux/kernel.h>
+#include <linux/vmalloc.h>
+
+#include <bcmutils.h>
+#include <bcmwifi_channels.h>
+#include <bcmendian.h>
+#include <ethernet.h>
+#include <802.11.h>
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+
+#include <dngl_stats.h>
+#include "wifi_stats.h"
+#include <dhd.h>
+#include <dhd_debug.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+#include <wlioctl_utils.h>
+#include <dhd_cfg80211.h>
+#ifdef DHD_PKT_LOGGING
+#include <dhd_pktlog.h>
+#endif /* DHD_PKT_LOGGING */
+#ifdef PNO_SUPPORT
+#include <dhd_pno.h>
+#endif /* PNO_SUPPORT */
+#ifdef RTT_SUPPORT
+#include <dhd_rtt.h>
+#endif /* RTT_SUPPORT */
+
+#include <ethernet.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+#include <linux/ieee80211.h>
+#include <linux/wait.h>
+#include <net/cfg80211.h>
+#include <net/rtnetlink.h>
+
+#include <wlioctl.h>
+#include <wldev_common.h>
+#include <wl_cfg80211.h>
+#include <wl_cfgp2p.h>
+#ifdef WL_NAN
+#include <wl_cfgnan.h>
+#endif /* WL_NAN */
+
+#include <wl_android.h>
+
+#include <wl_cfgvendor.h>
+#ifdef PROP_TXSTATUS
+#include <dhd_wlfc.h>
+#endif
+#include <brcm_nl80211.h>
+
+char*
+wl_get_kernel_timestamp(void)
+{
+       static char buf[32];
+       u64 ts_nsec;
+       unsigned long rem_nsec;
+
+       ts_nsec = local_clock();
+       rem_nsec = DIV_AND_MOD_U64_BY_U32(ts_nsec, NSEC_PER_SEC);
+       snprintf(buf, sizeof(buf), "%5lu.%06lu",
+               (unsigned long)ts_nsec, rem_nsec / NSEC_PER_USEC);
+
+       return buf;
+}
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 13, 0)) || defined(WL_VENDOR_EXT_SUPPORT)
+#if defined(WL_SUPP_EVENT)
+int
+wl_cfgvendor_send_supp_eventstring(const char *func_name, const char *fmt, ...)
+{
+       char buf[SUPP_LOG_LEN] = {0};
+       struct bcm_cfg80211 *cfg;
+       struct wiphy *wiphy;
+       va_list args;
+       int len;
+       int prefix_len;
+       int rem_len;
+
+       cfg = wl_cfg80211_get_bcmcfg();
+       if (!cfg || !cfg->wdev) {
+               WL_DBG(("supp evt invalid arg\n"));
+               return BCME_OK;
+       }
+
+       wiphy = cfg->wdev->wiphy;
+       prefix_len = snprintf(buf, SUPP_LOG_LEN, "[DHD]<%s> %s: ",
+               wl_get_kernel_timestamp(), __func__);
+       /* Remaining buffer len */
+       rem_len = SUPP_LOG_LEN - (prefix_len + 1);
+       /* Print the arg list on to the remaining part of the buffer */
+       va_start(args, fmt);
+       len = vsnprintf((buf + prefix_len), rem_len, fmt, args);
+       va_end(args);
+       if (len < 0) {
+               return -EINVAL;
+       }
+
+       if (len > rem_len) {
+               /* If return length is greater than buffer len,
+                * then its truncated buffer case.
+                */
+               len = rem_len;
+       }
+
+       /* Ensure the buffer is null terminated */
+       len += prefix_len;
+       buf[len] = '\0';
+       len++;
+
+       return wl_cfgvendor_send_async_event(wiphy,
+               bcmcfg_to_prmry_ndev(cfg), BRCM_VENDOR_EVENT_PRIV_STR, buf, len);
+}
+
+int
+wl_cfgvendor_notify_supp_event_str(const char *evt_name, const char *fmt, ...)
+{
+       char buf[SUPP_LOG_LEN] = {0};
+       struct bcm_cfg80211 *cfg;
+       struct wiphy *wiphy;
+       va_list args;
+       int len;
+       int prefix_len;
+       int rem_len;
+
+       cfg = wl_cfg80211_get_bcmcfg();
+       if (!cfg || !cfg->wdev) {
+               WL_DBG(("supp evt invalid arg\n"));
+               return BCME_OK;
+       }
+       wiphy = cfg->wdev->wiphy;
+       prefix_len = snprintf(buf, SUPP_LOG_LEN, "%s ", evt_name);
+       /* Remaining buffer len */
+       rem_len = SUPP_LOG_LEN - (prefix_len + 1);
+       /* Print the arg list on to the remaining part of the buffer */
+       va_start(args, fmt);
+       len = vsnprintf((buf + prefix_len), rem_len, fmt, args);
+       va_end(args);
+       if (len < 0) {
+               return -EINVAL;
+       }
+
+       if (len > rem_len) {
+               /* If return length is greater than buffer len,
+                * then its truncated buffer case.
+                */
+               len = rem_len;
+       }
+
+       /* Ensure the buffer is null terminated */
+       len += prefix_len;
+       buf[len] = '\0';
+       len++;
+
+       return wl_cfgvendor_send_async_event(wiphy,
+               bcmcfg_to_prmry_ndev(cfg), BRCM_VENDOR_EVENT_PRIV_STR, buf, len);
+}
+#endif /* WL_SUPP_EVENT */
+
+/*
+ * This API is to be used for asynchronous vendor events. This
+ * shouldn't be used in response to a vendor command from its
+ * do_it handler context (instead wl_cfgvendor_send_cmd_reply should
+ * be used).
+ */
+int wl_cfgvendor_send_async_event(struct wiphy *wiphy,
+       struct net_device *dev, int event_id, const void  *data, int len)
+{
+       gfp_t kflags;
+       struct sk_buff *skb;
+
+       kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+
+       /* Alloc the SKB for vendor_event */
+#if (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || \
+       LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+       skb = cfg80211_vendor_event_alloc(wiphy, ndev_to_wdev(dev), len, event_id, kflags);
+#else
+       skb = cfg80211_vendor_event_alloc(wiphy, len, event_id, kflags);
+#endif /* (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || */
+               /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0) */
+       if (!skb) {
+               WL_ERR(("skb alloc failed"));
+               return -ENOMEM;
+       }
+
+       /* Push the data to the skb */
+       nla_put_nohdr(skb, len, data);
+
+       cfg80211_vendor_event(skb, kflags);
+
+       return 0;
+}
+
+static int
+wl_cfgvendor_send_cmd_reply(struct wiphy *wiphy,
+       const void  *data, int len)
+{
+       struct sk_buff *skb;
+       int err;
+
+       /* Alloc the SKB for vendor_event */
+       skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, len);
+       if (unlikely(!skb)) {
+               WL_ERR(("skb alloc failed"));
+               err = -ENOMEM;
+               goto exit;
+       }
+
+       /* Push the data to the skb */
+       nla_put_nohdr(skb, len, data);
+       err = cfg80211_vendor_cmd_reply(skb);
+exit:
+       WL_DBG(("wl_cfgvendor_send_cmd_reply status %d", err));
+       return err;
+}
+
+static int
+wl_cfgvendor_get_feature_set(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int reply;
+
+       reply = dhd_dev_get_feature_set(bcmcfg_to_prmry_ndev(cfg));
+
+       err =  wl_cfgvendor_send_cmd_reply(wiphy, &reply, sizeof(int));
+       if (unlikely(err))
+               WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+
+       return err;
+}
+
+static int
+wl_cfgvendor_get_feature_set_matrix(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct sk_buff *skb;
+       int reply;
+       int mem_needed, i;
+
+       mem_needed = VENDOR_REPLY_OVERHEAD +
+               (ATTRIBUTE_U32_LEN * MAX_FEATURE_SET_CONCURRRENT_GROUPS) + ATTRIBUTE_U32_LEN;
+
+       /* Alloc the SKB for vendor_event */
+       skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, mem_needed);
+       if (unlikely(!skb)) {
+               WL_ERR(("skb alloc failed"));
+               err = -ENOMEM;
+               goto exit;
+       }
+
+       err = nla_put_u32(skb, ANDR_WIFI_ATTRIBUTE_NUM_FEATURE_SET,
+               MAX_FEATURE_SET_CONCURRRENT_GROUPS);
+       if (unlikely(err)) {
+               kfree_skb(skb);
+               goto exit;
+       }
+       for (i = 0; i < MAX_FEATURE_SET_CONCURRRENT_GROUPS; i++) {
+               reply = dhd_dev_get_feature_set_matrix(bcmcfg_to_prmry_ndev(cfg), i);
+               if (reply != WIFI_FEATURE_INVALID) {
+                       err = nla_put_u32(skb, ANDR_WIFI_ATTRIBUTE_FEATURE_SET,
+                               reply);
+                       if (unlikely(err)) {
+                               kfree_skb(skb);
+                               goto exit;
+                       }
+               }
+       }
+
+       err =  cfg80211_vendor_cmd_reply(skb);
+
+       if (unlikely(err)) {
+               WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+       }
+exit:
+       return err;
+}
+
+static int
+wl_cfgvendor_set_rand_mac_oui(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = -EINVAL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int type;
+
+       if (!data) {
+               WL_ERR(("data is not available\n"));
+               goto exit;
+       }
+
+       if (len <= 0) {
+               WL_ERR(("invalid len %d\n", len));
+               goto exit;
+       }
+
+       type = nla_type(data);
+
+       if (type == ANDR_WIFI_ATTRIBUTE_RANDOM_MAC_OUI) {
+               if (nla_len(data) != DOT11_OUI_LEN) {
+                       WL_ERR(("nla_len not matched.\n"));
+                       goto exit;
+               }
+               err = dhd_dev_cfg_rand_mac_oui(bcmcfg_to_prmry_ndev(cfg), nla_data(data));
+
+               if (unlikely(err))
+                       WL_ERR(("Bad OUI, could not set:%d \n", err));
+       }
+exit:
+       return err;
+}
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+static int
+wl_cfgvendor_set_nodfs_flag(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void *data, int len)
+{
+       int err = -EINVAL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int type;
+       u32 nodfs;
+
+       if (!data) {
+               WL_ERR(("data is not available\n"));
+               return -EINVAL;
+       }
+
+       if (len <= 0) {
+               WL_ERR(("invalid len %d\n", len));
+               return -EINVAL;
+       }
+
+       type = nla_type(data);
+       if (type == ANDR_WIFI_ATTRIBUTE_NODFS_SET) {
+               nodfs = nla_get_u32(data);
+               err = dhd_dev_set_nodfs(bcmcfg_to_prmry_ndev(cfg), nodfs);
+       }
+
+       return err;
+}
+#endif /* CUSTOM_FORCE_NODFS_FLAG */
+
+static int
+wl_cfgvendor_set_country(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void *data, int len)
+{
+       int err = BCME_ERROR, rem, type;
+       char country_code[WLC_CNTRY_BUF_SZ] = {0};
+       const struct nlattr *iter;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               switch (type) {
+                       case ANDR_WIFI_ATTRIBUTE_COUNTRY:
+                               err = memcpy_s(country_code, WLC_CNTRY_BUF_SZ,
+                                       nla_data(iter), nla_len(iter));
+                               if (err) {
+                                       WL_ERR(("Failed to copy country code: %d\n", err));
+                                       return err;
+                               }
+                               break;
+                       default:
+                               WL_ERR(("Unknown type: %d\n", type));
+                               return err;
+               }
+       }
+       /* country code is unique for dongle..hence using primary interface. */
+       err = wl_cfg80211_set_country_code(primary_ndev, country_code, true, true, -1);
+       if (err < 0) {
+               WL_ERR(("Set country failed ret:%d\n", err));
+       }
+
+       return err;
+}
+
+#ifdef GSCAN_SUPPORT
+int
+wl_cfgvendor_send_hotlist_event(struct wiphy *wiphy,
+       struct net_device *dev, void  *data, int len, wl_vendor_event_t event)
+{
+       gfp_t kflags;
+       const void *ptr;
+       struct sk_buff *skb;
+       int malloc_len, total, iter_cnt_to_send, cnt;
+       gscan_results_cache_t *cache = (gscan_results_cache_t *)data;
+
+       total = len/sizeof(wifi_gscan_result_t);
+       while (total > 0) {
+               malloc_len = (total * sizeof(wifi_gscan_result_t)) + VENDOR_DATA_OVERHEAD;
+               if (malloc_len > NLMSG_DEFAULT_SIZE) {
+                       malloc_len = NLMSG_DEFAULT_SIZE;
+               }
+               iter_cnt_to_send =
+                  (malloc_len - VENDOR_DATA_OVERHEAD)/sizeof(wifi_gscan_result_t);
+               total = total - iter_cnt_to_send;
+
+               kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+
+               /* Alloc the SKB for vendor_event */
+#if (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || \
+       LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+               skb = cfg80211_vendor_event_alloc(wiphy, ndev_to_wdev(dev),
+               malloc_len, event, kflags);
+#else
+               skb = cfg80211_vendor_event_alloc(wiphy, malloc_len, event, kflags);
+#endif /* (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || */
+               /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0) */
+               if (!skb) {
+                       WL_ERR(("skb alloc failed"));
+                       return -ENOMEM;
+               }
+
+               while (cache && iter_cnt_to_send) {
+                       ptr = (const void *) &cache->results[cache->tot_consumed];
+
+                       if (iter_cnt_to_send < (cache->tot_count - cache->tot_consumed)) {
+                               cnt = iter_cnt_to_send;
+                       } else {
+                               cnt = (cache->tot_count - cache->tot_consumed);
+                       }
+
+                       iter_cnt_to_send -= cnt;
+                       cache->tot_consumed += cnt;
+                       /* Push the data to the skb */
+                       nla_append(skb, cnt * sizeof(wifi_gscan_result_t), ptr);
+                       if (cache->tot_consumed == cache->tot_count) {
+                               cache = cache->next;
+                       }
+
+               }
+
+               cfg80211_vendor_event(skb, kflags);
+       }
+
+       return 0;
+}
+
+static int
+wl_cfgvendor_gscan_get_capabilities(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pno_gscan_capabilities_t *reply = NULL;
+       uint32 reply_len = 0;
+
+       reply = dhd_dev_pno_get_gscan(bcmcfg_to_prmry_ndev(cfg),
+          DHD_PNO_GET_CAPABILITIES, NULL, &reply_len);
+       if (!reply) {
+               WL_ERR(("Could not get capabilities\n"));
+               err = -EINVAL;
+               return err;
+       }
+
+       err =  wl_cfgvendor_send_cmd_reply(wiphy, reply, reply_len);
+       if (unlikely(err)) {
+               WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+       }
+
+       MFREE(cfg->osh, reply, reply_len);
+       return err;
+}
+
+static int
+wl_cfgvendor_gscan_get_batch_results(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       gscan_results_cache_t *results, *iter;
+       uint32 reply_len, is_done = 1;
+       int32 mem_needed, num_results_iter;
+       wifi_gscan_result_t *ptr;
+       uint16 num_scan_ids, num_results;
+       struct sk_buff *skb;
+       struct nlattr *scan_hdr, *complete_flag;
+
+       err = dhd_dev_wait_batch_results_complete(bcmcfg_to_prmry_ndev(cfg));
+       if (err != BCME_OK)
+               return -EBUSY;
+
+       err = dhd_dev_pno_lock_access_batch_results(bcmcfg_to_prmry_ndev(cfg));
+       if (err != BCME_OK) {
+               WL_ERR(("Can't obtain lock to access batch results %d\n", err));
+               return -EBUSY;
+       }
+       results = dhd_dev_pno_get_gscan(bcmcfg_to_prmry_ndev(cfg),
+                    DHD_PNO_GET_BATCH_RESULTS, NULL, &reply_len);
+
+       if (!results) {
+               WL_ERR(("No results to send %d\n", err));
+               err =  wl_cfgvendor_send_cmd_reply(wiphy, results, 0);
+
+               if (unlikely(err))
+                       WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+               dhd_dev_pno_unlock_access_batch_results(bcmcfg_to_prmry_ndev(cfg));
+               return err;
+       }
+       num_scan_ids = reply_len & 0xFFFF;
+       num_results = (reply_len & 0xFFFF0000) >> 16;
+       mem_needed = (num_results * sizeof(wifi_gscan_result_t)) +
+                    (num_scan_ids * GSCAN_BATCH_RESULT_HDR_LEN) +
+                    VENDOR_REPLY_OVERHEAD + SCAN_RESULTS_COMPLETE_FLAG_LEN;
+
+       if (mem_needed > (int32)NLMSG_DEFAULT_SIZE) {
+               mem_needed = (int32)NLMSG_DEFAULT_SIZE;
+       }
+
+       WL_TRACE(("is_done %d mem_needed %d max_mem %d\n", is_done, mem_needed,
+               (int)NLMSG_DEFAULT_SIZE));
+       /* Alloc the SKB for vendor_event */
+       skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, mem_needed);
+       if (unlikely(!skb)) {
+               WL_ERR(("skb alloc failed"));
+               dhd_dev_pno_unlock_access_batch_results(bcmcfg_to_prmry_ndev(cfg));
+               return -ENOMEM;
+       }
+       iter = results;
+       complete_flag = nla_reserve(skb, GSCAN_ATTRIBUTE_SCAN_RESULTS_COMPLETE,
+                           sizeof(is_done));
+
+       if (unlikely(!complete_flag)) {
+               WL_ERR(("complete_flag could not be reserved"));
+               kfree_skb(skb);
+               dhd_dev_pno_unlock_access_batch_results(bcmcfg_to_prmry_ndev(cfg));
+               return -ENOMEM;
+       }
+       mem_needed = mem_needed - (SCAN_RESULTS_COMPLETE_FLAG_LEN + VENDOR_REPLY_OVERHEAD);
+
+       while (iter) {
+               num_results_iter = (mem_needed - (int32)GSCAN_BATCH_RESULT_HDR_LEN);
+               num_results_iter /= (int32)sizeof(wifi_gscan_result_t);
+               if (num_results_iter <= 0 ||
+                   ((iter->tot_count - iter->tot_consumed) > num_results_iter)) {
+                       break;
+               }
+               scan_hdr = nla_nest_start(skb, GSCAN_ATTRIBUTE_SCAN_RESULTS);
+               /* no more room? we are done then (for now) */
+               if (scan_hdr == NULL) {
+                       is_done = 0;
+                       break;
+               }
+               err = nla_put_u32(skb, GSCAN_ATTRIBUTE_SCAN_ID, iter->scan_id);
+               if (unlikely(err)) {
+                       goto fail;
+               }
+               err = nla_put_u8(skb, GSCAN_ATTRIBUTE_SCAN_FLAGS, iter->flag);
+               if (unlikely(err)) {
+                       goto fail;
+               }
+               err = nla_put_u32(skb, GSCAN_ATTRIBUTE_CH_BUCKET_BITMASK, iter->scan_ch_bucket);
+               if (unlikely(err)) {
+                       goto fail;
+               }
+               num_results_iter = iter->tot_count - iter->tot_consumed;
+
+               err = nla_put_u32(skb, GSCAN_ATTRIBUTE_NUM_OF_RESULTS, num_results_iter);
+               if (unlikely(err)) {
+                       goto fail;
+               }
+               if (num_results_iter) {
+                       ptr = &iter->results[iter->tot_consumed];
+                       err = nla_put(skb, GSCAN_ATTRIBUTE_SCAN_RESULTS,
+                        num_results_iter * sizeof(wifi_gscan_result_t), ptr);
+                       if (unlikely(err)) {
+                               goto fail;
+                       }
+                       iter->tot_consumed += num_results_iter;
+               }
+               nla_nest_end(skb, scan_hdr);
+               mem_needed -= GSCAN_BATCH_RESULT_HDR_LEN +
+                   (num_results_iter * sizeof(wifi_gscan_result_t));
+               iter = iter->next;
+       }
+       /* Cleans up consumed results and returns TRUE if all results are consumed */
+       is_done = dhd_dev_gscan_batch_cache_cleanup(bcmcfg_to_prmry_ndev(cfg));
+       memcpy(nla_data(complete_flag), &is_done, sizeof(is_done));
+       dhd_dev_pno_unlock_access_batch_results(bcmcfg_to_prmry_ndev(cfg));
+       return cfg80211_vendor_cmd_reply(skb);
+fail:
+       /* Free up consumed results which will now not be sent */
+       (void)dhd_dev_gscan_batch_cache_cleanup(bcmcfg_to_prmry_ndev(cfg));
+       kfree_skb(skb);
+       dhd_dev_pno_unlock_access_batch_results(bcmcfg_to_prmry_ndev(cfg));
+       return err;
+}
+
+static int
+wl_cfgvendor_initiate_gscan(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int type, tmp = len;
+       int run = 0xFF;
+       int flush = 0;
+       const struct nlattr *iter;
+
+       nla_for_each_attr(iter, data, len, tmp) {
+               type = nla_type(iter);
+               if (type == GSCAN_ATTRIBUTE_ENABLE_FEATURE)
+                       run = nla_get_u32(iter);
+               else if (type == GSCAN_ATTRIBUTE_FLUSH_FEATURE)
+                       flush = nla_get_u32(iter);
+       }
+
+       if (run != 0xFF) {
+               err = dhd_dev_pno_run_gscan(bcmcfg_to_prmry_ndev(cfg), run, flush);
+
+               if (unlikely(err)) {
+                       WL_ERR(("Could not run gscan:%d \n", err));
+               }
+               return err;
+       } else {
+               return -EINVAL;
+       }
+
+}
+
+static int
+wl_cfgvendor_enable_full_scan_result(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int type;
+       bool real_time = FALSE;
+
+       if (!data) {
+               WL_ERR(("data is not available\n"));
+               return -EINVAL;
+       }
+
+       if (len <= 0) {
+               WL_ERR(("invalid len %d\n", len));
+               return -EINVAL;
+       }
+
+       type = nla_type(data);
+
+       if (type == GSCAN_ATTRIBUTE_ENABLE_FULL_SCAN_RESULTS) {
+               real_time = nla_get_u32(data);
+
+               err = dhd_dev_pno_enable_full_scan_result(bcmcfg_to_prmry_ndev(cfg), real_time);
+
+               if (unlikely(err)) {
+                       WL_ERR(("Could not run gscan:%d \n", err));
+               }
+
+       } else {
+               err = -EINVAL;
+       }
+
+       return err;
+}
+
+static int
+wl_cfgvendor_set_scan_cfg_bucket(const struct nlattr *prev,
+       gscan_scan_params_t *scan_param, int num)
+{
+       struct dhd_pno_gscan_channel_bucket  *ch_bucket;
+       int k = 0;
+       int type, err = 0, rem;
+       const struct nlattr *cur, *next;
+
+       nla_for_each_nested(cur, prev, rem) {
+               type = nla_type(cur);
+               ch_bucket = scan_param->channel_bucket;
+               switch (type) {
+               case GSCAN_ATTRIBUTE_BUCKET_ID:
+                       break;
+               case GSCAN_ATTRIBUTE_BUCKET_PERIOD:
+                       if (nla_len(cur) != sizeof(uint32)) {
+                               err = -EINVAL;
+                               goto exit;
+                       }
+
+                       ch_bucket[num].bucket_freq_multiple =
+                               nla_get_u32(cur) / MSEC_PER_SEC;
+                       break;
+               case GSCAN_ATTRIBUTE_BUCKET_NUM_CHANNELS:
+                       if (nla_len(cur) != sizeof(uint32)) {
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       ch_bucket[num].num_channels = nla_get_u32(cur);
+                       if (ch_bucket[num].num_channels >
+                               GSCAN_MAX_CHANNELS_IN_BUCKET) {
+                               WL_ERR(("channel range:%d,bucket:%d\n",
+                                       ch_bucket[num].num_channels,
+                                       num));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       break;
+               case GSCAN_ATTRIBUTE_BUCKET_CHANNELS:
+                       nla_for_each_nested(next, cur, rem) {
+                               if (k >= GSCAN_MAX_CHANNELS_IN_BUCKET)
+                                       break;
+                               if (nla_len(next) != sizeof(uint32)) {
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               ch_bucket[num].chan_list[k] = nla_get_u32(next);
+                               k++;
+                       }
+                       break;
+               case GSCAN_ATTRIBUTE_BUCKETS_BAND:
+                       if (nla_len(cur) != sizeof(uint32)) {
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       ch_bucket[num].band = (uint16)nla_get_u32(cur);
+                       break;
+               case GSCAN_ATTRIBUTE_REPORT_EVENTS:
+                       if (nla_len(cur) != sizeof(uint32)) {
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       ch_bucket[num].report_flag = (uint8)nla_get_u32(cur);
+                       break;
+               case GSCAN_ATTRIBUTE_BUCKET_STEP_COUNT:
+                       if (nla_len(cur) != sizeof(uint32)) {
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       ch_bucket[num].repeat = (uint16)nla_get_u32(cur);
+                       break;
+               case GSCAN_ATTRIBUTE_BUCKET_MAX_PERIOD:
+                       if (nla_len(cur) != sizeof(uint32)) {
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       ch_bucket[num].bucket_max_multiple =
+                               nla_get_u32(cur) / MSEC_PER_SEC;
+                       break;
+               default:
+                       WL_ERR(("unknown attr type:%d\n", type));
+                       err = -EINVAL;
+                       goto exit;
+               }
+       }
+
+exit:
+       return err;
+}
+
+static int
+wl_cfgvendor_set_scan_cfg(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       gscan_scan_params_t *scan_param;
+       int j = 0;
+       int type, tmp;
+       const struct nlattr *iter;
+
+       scan_param = (gscan_scan_params_t *)MALLOCZ(cfg->osh,
+               sizeof(gscan_scan_params_t));
+       if (!scan_param) {
+               WL_ERR(("Could not set GSCAN scan cfg, mem alloc failure\n"));
+               err = -EINVAL;
+               return err;
+
+       }
+
+       scan_param->scan_fr = PNO_SCAN_MIN_FW_SEC;
+       nla_for_each_attr(iter, data, len, tmp) {
+               type = nla_type(iter);
+
+               if (j >= GSCAN_MAX_CH_BUCKETS) {
+                       break;
+               }
+
+               switch (type) {
+                       case GSCAN_ATTRIBUTE_BASE_PERIOD:
+                               if (nla_len(iter) != sizeof(uint32)) {
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               scan_param->scan_fr = nla_get_u32(iter) / MSEC_PER_SEC;
+                               break;
+                       case GSCAN_ATTRIBUTE_NUM_BUCKETS:
+                               if (nla_len(iter) != sizeof(uint32)) {
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               scan_param->nchannel_buckets = nla_get_u32(iter);
+                               if (scan_param->nchannel_buckets >=
+                                   GSCAN_MAX_CH_BUCKETS) {
+                                       WL_ERR(("ncha_buck out of range %d\n",
+                                       scan_param->nchannel_buckets));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               break;
+                       case GSCAN_ATTRIBUTE_CH_BUCKET_1:
+                       case GSCAN_ATTRIBUTE_CH_BUCKET_2:
+                       case GSCAN_ATTRIBUTE_CH_BUCKET_3:
+                       case GSCAN_ATTRIBUTE_CH_BUCKET_4:
+                       case GSCAN_ATTRIBUTE_CH_BUCKET_5:
+                       case GSCAN_ATTRIBUTE_CH_BUCKET_6:
+                       case GSCAN_ATTRIBUTE_CH_BUCKET_7:
+                               err = wl_cfgvendor_set_scan_cfg_bucket(iter, scan_param, j);
+                               if (err < 0) {
+                                       WL_ERR(("set_scan_cfg_buck error:%d\n", err));
+                                       goto exit;
+                               }
+                               j++;
+                               break;
+                       default:
+                               WL_ERR(("Unknown type %d\n", type));
+                               err = -EINVAL;
+                               goto exit;
+               }
+       }
+
+       err = dhd_dev_pno_set_cfg_gscan(bcmcfg_to_prmry_ndev(cfg),
+            DHD_PNO_SCAN_CFG_ID, scan_param, FALSE);
+
+       if (err < 0) {
+               WL_ERR(("Could not set GSCAN scan cfg\n"));
+               err = -EINVAL;
+       }
+
+exit:
+       MFREE(cfg->osh, scan_param, sizeof(gscan_scan_params_t));
+       return err;
+
+}
+
+static int
+wl_cfgvendor_hotlist_cfg(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       gscan_hotlist_scan_params_t *hotlist_params;
+       int tmp, tmp1, tmp2, type, j = 0, dummy;
+       const struct nlattr *outer, *inner = NULL, *iter;
+       bool flush = FALSE;
+       struct bssid_t *pbssid;
+
+       BCM_REFERENCE(dummy);
+
+       if (len < sizeof(*hotlist_params) || len >= WLC_IOCTL_MAXLEN) {
+               WL_ERR(("buffer length :%d wrong - bail out.\n", len));
+               return -EINVAL;
+       }
+
+       hotlist_params = (gscan_hotlist_scan_params_t *)MALLOCZ(cfg->osh,
+               sizeof(*hotlist_params)
+               + (sizeof(struct bssid_t) * (PFN_SWC_MAX_NUM_APS - 1)));
+
+       if (!hotlist_params) {
+               WL_ERR(("Cannot Malloc memory.\n"));
+               return -ENOMEM;
+       }
+
+       hotlist_params->lost_ap_window = GSCAN_LOST_AP_WINDOW_DEFAULT;
+
+       nla_for_each_attr(iter, data, len, tmp2) {
+               type = nla_type(iter);
+               switch (type) {
+               case GSCAN_ATTRIBUTE_HOTLIST_BSSID_COUNT:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               WL_DBG(("type:%d length:%d not matching.\n",
+                                       type, nla_len(iter)));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       hotlist_params->nbssid = (uint16)nla_get_u32(iter);
+                       if ((hotlist_params->nbssid == 0) ||
+                           (hotlist_params->nbssid > PFN_SWC_MAX_NUM_APS)) {
+                               WL_ERR(("nbssid:%d exceed limit.\n",
+                                       hotlist_params->nbssid));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       break;
+               case GSCAN_ATTRIBUTE_HOTLIST_BSSIDS:
+                       if (hotlist_params->nbssid == 0) {
+                               WL_ERR(("nbssid not retrieved.\n"));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       pbssid = hotlist_params->bssid;
+                       nla_for_each_nested(outer, iter, tmp) {
+                               if (j >= hotlist_params->nbssid)
+                                       break;
+                               nla_for_each_nested(inner, outer, tmp1) {
+                                       type = nla_type(inner);
+
+                                       switch (type) {
+                                       case GSCAN_ATTRIBUTE_BSSID:
+                                               if (nla_len(inner) != sizeof(pbssid[j].macaddr)) {
+                                                       WL_ERR(("type:%d length:%d not matching.\n",
+                                                               type, nla_len(inner)));
+                                                       err = -EINVAL;
+                                                       goto exit;
+                                               }
+                                               memcpy(
+                                                       &(pbssid[j].macaddr),
+                                                       nla_data(inner),
+                                                       sizeof(pbssid[j].macaddr));
+                                               break;
+                                       case GSCAN_ATTRIBUTE_RSSI_LOW:
+                                               if (nla_len(inner) != sizeof(uint8)) {
+                                                       WL_ERR(("type:%d length:%d not matching.\n",
+                                                               type, nla_len(inner)));
+                                                       err = -EINVAL;
+                                                       goto exit;
+                                               }
+                                               pbssid[j].rssi_reporting_threshold =
+                                                       (int8)nla_get_u8(inner);
+                                               break;
+                                       case GSCAN_ATTRIBUTE_RSSI_HIGH:
+                                               if (nla_len(inner) != sizeof(uint8)) {
+                                                       WL_ERR(("type:%d length:%d not matching.\n",
+                                                               type, nla_len(inner)));
+                                                       err = -EINVAL;
+                                                       goto exit;
+                                               }
+                                               dummy = (int8)nla_get_u8(inner);
+                                               WL_DBG(("dummy %d\n", dummy));
+                                               break;
+                                       default:
+                                               WL_ERR(("ATTR unknown %d\n", type));
+                                               err = -EINVAL;
+                                               goto exit;
+                                       }
+                               }
+                               j++;
+                       }
+                       if (j != hotlist_params->nbssid) {
+                               WL_ERR(("bssid_cnt:%d != nbssid:%d.\n", j,
+                                       hotlist_params->nbssid));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       break;
+               case GSCAN_ATTRIBUTE_HOTLIST_FLUSH:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               WL_ERR(("type:%d length:%d not matching.\n",
+                                       type, nla_len(iter)));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       flush = nla_get_u8(iter);
+                       break;
+               case GSCAN_ATTRIBUTE_LOST_AP_SAMPLE_SIZE:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               WL_ERR(("type:%d length:%d not matching.\n",
+                                       type, nla_len(iter)));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       hotlist_params->lost_ap_window = (uint16)nla_get_u32(iter);
+                       break;
+               default:
+                       WL_ERR(("Unknown type %d\n", type));
+                       err = -EINVAL;
+                       goto exit;
+               }
+
+       }
+
+       if (dhd_dev_pno_set_cfg_gscan(bcmcfg_to_prmry_ndev(cfg),
+             DHD_PNO_GEOFENCE_SCAN_CFG_ID, hotlist_params, flush) < 0) {
+               WL_ERR(("Could not set GSCAN HOTLIST cfg error: %d\n", err));
+               err = -EINVAL;
+               goto exit;
+       }
+exit:
+       MFREE(cfg->osh, hotlist_params, sizeof(*hotlist_params)
+               + (sizeof(struct bssid_t) * (PFN_SWC_MAX_NUM_APS - 1)));
+       return err;
+}
+
+static int wl_cfgvendor_epno_cfg(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pno_ssid_t *ssid_elem = NULL;
+       int tmp, tmp1, tmp2, type = 0, num = 0;
+       const struct nlattr *outer, *inner, *iter;
+       uint8 flush = FALSE, i = 0;
+       wl_ssid_ext_params_t params;
+
+       nla_for_each_attr(iter, data, len, tmp2) {
+               type = nla_type(iter);
+               switch (type) {
+                       case GSCAN_ATTRIBUTE_EPNO_SSID_LIST:
+                               nla_for_each_nested(outer, iter, tmp) {
+                                       ssid_elem = (dhd_pno_ssid_t *)
+                                               dhd_dev_pno_get_gscan(bcmcfg_to_prmry_ndev(cfg),
+                                               DHD_PNO_GET_NEW_EPNO_SSID_ELEM,
+                                               NULL, &num);
+                                       if (!ssid_elem) {
+                                               WL_ERR(("Failed to get SSID LIST buffer\n"));
+                                               err = -ENOMEM;
+                                               goto exit;
+                                       }
+                                       i++;
+                                       nla_for_each_nested(inner, outer, tmp1) {
+                                               type = nla_type(inner);
+
+                                               switch (type) {
+                                                       case GSCAN_ATTRIBUTE_EPNO_SSID:
+                                                               memcpy(ssid_elem->SSID,
+                                                                 nla_data(inner),
+                                                                 DOT11_MAX_SSID_LEN);
+                                                               break;
+                                                       case GSCAN_ATTRIBUTE_EPNO_SSID_LEN:
+                                                               ssid_elem->SSID_len =
+                                                                       nla_get_u32(inner);
+                                                               if (ssid_elem->SSID_len >
+                                                                       DOT11_MAX_SSID_LEN) {
+                                                                       WL_ERR(("SSID too"
+                                                                       "long %d\n",
+                                                                       ssid_elem->SSID_len));
+                                                                       err = -EINVAL;
+                                                                       MFREE(cfg->osh, ssid_elem,
+                                                                               num);
+                                                                       goto exit;
+                                                               }
+                                                               break;
+                                                       case GSCAN_ATTRIBUTE_EPNO_FLAGS:
+                                                               ssid_elem->flags =
+                                                                       nla_get_u32(inner);
+                                                               ssid_elem->hidden =
+                                                                       ((ssid_elem->flags &
+                                                                       DHD_EPNO_HIDDEN_SSID) != 0);
+                                                               break;
+                                                       case GSCAN_ATTRIBUTE_EPNO_AUTH:
+                                                               ssid_elem->wpa_auth =
+                                                                       nla_get_u32(inner);
+                                                               break;
+                                               }
+                                       }
+                                       if (!ssid_elem->SSID_len) {
+                                               WL_ERR(("Broadcast SSID is illegal for ePNO\n"));
+                                               err = -EINVAL;
+                                               MFREE(cfg->osh, ssid_elem, num);
+                                               goto exit;
+                                       }
+                                       dhd_pno_translate_epno_fw_flags(&ssid_elem->flags);
+                                       dhd_pno_set_epno_auth_flag(&ssid_elem->wpa_auth);
+                                       MFREE(cfg->osh, ssid_elem, num);
+                               }
+                               break;
+                       case GSCAN_ATTRIBUTE_EPNO_SSID_NUM:
+                               num = nla_get_u8(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_EPNO_FLUSH:
+                               flush = (bool)nla_get_u32(iter);
+                               /* Flush attribute is expected before any ssid attribute */
+                               if (i && flush) {
+                                       WL_ERR(("Bad attributes\n"));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               /* Need to flush driver and FW cfg */
+                               dhd_dev_pno_set_cfg_gscan(bcmcfg_to_prmry_ndev(cfg),
+                               DHD_PNO_EPNO_CFG_ID, NULL, flush);
+                               dhd_dev_flush_fw_epno(bcmcfg_to_prmry_ndev(cfg));
+                               break;
+                       case GSCAN_ATTRIBUTE_EPNO_5G_RSSI_THR:
+                               params.min5G_rssi = nla_get_s8(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_EPNO_2G_RSSI_THR:
+                               params.min2G_rssi = nla_get_s8(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_EPNO_INIT_SCORE_MAX:
+                               params.init_score_max = nla_get_s16(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_EPNO_CUR_CONN_BONUS:
+                               params.cur_bssid_bonus = nla_get_s16(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_EPNO_SAME_NETWORK_BONUS:
+                               params.same_ssid_bonus = nla_get_s16(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_EPNO_SECURE_BONUS:
+                               params.secure_bonus = nla_get_s16(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_EPNO_5G_BONUS:
+                               params.band_5g_bonus = nla_get_s16(iter);
+                               break;
+                       default:
+                               WL_ERR(("%s: No such attribute %d\n", __FUNCTION__, type));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+       }
+       if (i != num) {
+               WL_ERR(("%s: num_ssid %d does not match ssids sent %d\n", __FUNCTION__,
+                    num, i));
+               err = -EINVAL;
+       }
+exit:
+       /* Flush all configs if error condition */
+       if (err < 0) {
+               dhd_dev_pno_set_cfg_gscan(bcmcfg_to_prmry_ndev(cfg),
+                  DHD_PNO_EPNO_CFG_ID, NULL, TRUE);
+               dhd_dev_flush_fw_epno(bcmcfg_to_prmry_ndev(cfg));
+       } else if (type != GSCAN_ATTRIBUTE_EPNO_FLUSH) {
+               /* If the last attribute was FLUSH, nothing else to do */
+               dhd_dev_pno_set_cfg_gscan(bcmcfg_to_prmry_ndev(cfg),
+               DHD_PNO_EPNO_PARAMS_ID, &params, FALSE);
+               err = dhd_dev_set_epno(bcmcfg_to_prmry_ndev(cfg));
+       }
+       return err;
+}
+
+static int
+wl_cfgvendor_set_batch_scan_cfg(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0, tmp, type;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       gscan_batch_params_t batch_param;
+       const struct nlattr *iter;
+
+       batch_param.mscan = batch_param.bestn = 0;
+       batch_param.buffer_threshold = GSCAN_BATCH_NO_THR_SET;
+
+       nla_for_each_attr(iter, data, len, tmp) {
+               type = nla_type(iter);
+
+               switch (type) {
+                       case GSCAN_ATTRIBUTE_NUM_AP_PER_SCAN:
+                               batch_param.bestn = nla_get_u32(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_NUM_SCANS_TO_CACHE:
+                               batch_param.mscan = nla_get_u32(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_REPORT_THRESHOLD:
+                               batch_param.buffer_threshold = nla_get_u32(iter);
+                               break;
+                       default:
+                               WL_ERR(("Unknown type %d\n", type));
+                               break;
+               }
+       }
+
+       if (dhd_dev_pno_set_cfg_gscan(bcmcfg_to_prmry_ndev(cfg),
+              DHD_PNO_BATCH_SCAN_CFG_ID, &batch_param, FALSE) < 0) {
+               WL_ERR(("Could not set batch cfg\n"));
+               err = -EINVAL;
+               return err;
+       }
+
+       return err;
+}
+
+#endif /* GSCAN_SUPPORT */
+#if defined(GSCAN_SUPPORT) || defined(DHD_GET_VALID_CHANNELS)
+static int
+wl_cfgvendor_gscan_get_channel_list(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0, type, band;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       uint16 *reply = NULL;
+       uint32 reply_len = 0, num_channels, mem_needed;
+       struct sk_buff *skb;
+       dhd_pub_t *dhdp;
+       struct net_device *ndev = wdev->netdev;
+
+       if (!ndev) {
+               WL_ERR(("ndev null\n"));
+               return -EINVAL;
+       }
+
+       dhdp = wl_cfg80211_get_dhdp(ndev);
+       if (!dhdp) {
+               WL_ERR(("dhdp null\n"));
+               return -EINVAL;
+       }
+
+       if (!data) {
+               WL_ERR(("data is not available\n"));
+               return -EINVAL;
+       }
+
+       if (len <= 0) {
+               WL_ERR(("invalid len %d\n", len));
+               return -EINVAL;
+       }
+
+       type = nla_type(data);
+       if (type == GSCAN_ATTRIBUTE_BAND) {
+               band = nla_get_u32(data);
+       } else {
+               return -EINVAL;
+       }
+
+       reply = dhd_pno_get_gscan(dhdp,
+          DHD_PNO_GET_CHANNEL_LIST, &band, &reply_len);
+       if (!reply) {
+               WL_ERR(("Could not get channel list\n"));
+               err = -EINVAL;
+               return err;
+       }
+       num_channels =  reply_len/ sizeof(uint32);
+       mem_needed = reply_len + VENDOR_REPLY_OVERHEAD + (ATTRIBUTE_U32_LEN * 2);
+
+       /* Alloc the SKB for vendor_event */
+       skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, mem_needed);
+       if (unlikely(!skb)) {
+               WL_ERR(("skb alloc failed"));
+               err = -ENOMEM;
+               goto exit;
+       }
+
+       nla_put_u32(skb, GSCAN_ATTRIBUTE_NUM_CHANNELS, num_channels);
+       nla_put(skb, GSCAN_ATTRIBUTE_CHANNEL_LIST, reply_len, reply);
+
+       err =  cfg80211_vendor_cmd_reply(skb);
+
+       if (unlikely(err)) {
+               WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+       }
+exit:
+       MFREE(cfg->osh, reply, reply_len);
+       return err;
+}
+#endif /* GSCAN_SUPPORT || DHD_GET_VALID_CHANNELS */
+
+#ifdef RSSI_MONITOR_SUPPORT
+static int wl_cfgvendor_set_rssi_monitor(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0, tmp, type, start = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int8 max_rssi = 0, min_rssi = 0;
+       const struct nlattr *iter;
+
+       if (!wl_get_drv_status(cfg, CONNECTED, wdev_to_ndev(wdev))) {
+               WL_ERR(("Sta is not connected to an AP, rssi monitoring is not allowed\n"));
+               return -EINVAL;
+       }
+
+       nla_for_each_attr(iter, data, len, tmp) {
+               type = nla_type(iter);
+               switch (type) {
+                       case RSSI_MONITOR_ATTRIBUTE_MAX_RSSI:
+                               max_rssi = (int8) nla_get_u32(iter);
+                               break;
+                       case RSSI_MONITOR_ATTRIBUTE_MIN_RSSI:
+                               min_rssi = (int8) nla_get_u32(iter);
+                               break;
+                       case RSSI_MONITOR_ATTRIBUTE_START:
+                               start = nla_get_u32(iter);
+               }
+       }
+
+       if (dhd_dev_set_rssi_monitor_cfg(bcmcfg_to_prmry_ndev(cfg),
+              start, max_rssi, min_rssi) < 0) {
+               WL_ERR(("Could not set rssi monitor cfg\n"));
+               err = -EINVAL;
+       }
+       return err;
+}
+#endif /* RSSI_MONITOR_SUPPORT */
+
+#ifdef DHD_WAKE_STATUS
+static int
+wl_cfgvendor_get_wake_reason_stats(struct wiphy *wiphy,
+        struct wireless_dev *wdev, const void *data, int len)
+{
+       struct net_device *ndev = wdev_to_ndev(wdev);
+       wake_counts_t *pwake_count_info;
+       int ret, mem_needed;
+#if defined(DHD_DEBUG) && defined(DHD_WAKE_EVENT_STATUS)
+       int flowid;
+#endif /* DHD_DEBUG && DHD_WAKE_EVENT_STATUS */
+       struct sk_buff *skb = NULL;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(ndev);
+
+       WL_DBG(("Recv get wake status info cmd.\n"));
+
+       pwake_count_info = dhd_get_wakecount(dhdp);
+       mem_needed =  VENDOR_REPLY_OVERHEAD + (ATTRIBUTE_U32_LEN * 20) +
+               (WLC_E_LAST * sizeof(uint));
+
+       skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, mem_needed);
+       if (unlikely(!skb)) {
+               WL_ERR(("%s: can't allocate %d bytes\n", __FUNCTION__, mem_needed));
+               ret = -ENOMEM;
+               goto exit;
+       }
+#ifdef DHD_WAKE_EVENT_STATUS
+       WL_ERR(("pwake_count_info->rcwake %d\n", pwake_count_info->rcwake));
+       ret = nla_put_u32(skb, WAKE_STAT_ATTRIBUTE_TOTAL_CMD_EVENT, pwake_count_info->rcwake);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Total count of CMD event, ret=%d\n", ret));
+               goto exit;
+       }
+       ret = nla_put_u32(skb, WAKE_STAT_ATTRIBUTE_CMD_EVENT_COUNT_USED, WLC_E_LAST);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Max count of event used, ret=%d\n", ret));
+               goto exit;
+       }
+       ret = nla_put(skb, WAKE_STAT_ATTRIBUTE_CMD_EVENT_WAKE, (WLC_E_LAST * sizeof(uint)),
+               pwake_count_info->rc_event);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Event wake data, ret=%d\n", ret));
+               goto exit;
+       }
+#ifdef DHD_DEBUG
+       for (flowid = 0; flowid < WLC_E_LAST; flowid++) {
+               if (pwake_count_info->rc_event[flowid] != 0) {
+                       WL_ERR((" %s = %u\n", bcmevent_get_name(flowid),
+                               pwake_count_info->rc_event[flowid]));
+               }
+       }
+#endif /* DHD_DEBUG */
+#endif /* DHD_WAKE_EVENT_STATUS */
+#ifdef DHD_WAKE_RX_STATUS
+       WL_ERR(("pwake_count_info->rxwake %d\n", pwake_count_info->rxwake));
+       ret = nla_put_u32(skb, WAKE_STAT_ATTRIBUTE_TOTAL_RX_DATA_WAKE, pwake_count_info->rxwake);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Total Wake due RX data, ret=%d\n", ret));
+               goto exit;
+       }
+       ret = nla_put_u32(skb, WAKE_STAT_ATTRIBUTE_RX_UNICAST_COUNT, pwake_count_info->rx_ucast);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Total wake due to RX unicast, ret=%d\n", ret));
+               goto exit;
+       }
+       ret = nla_put_u32(skb, WAKE_STAT_ATTRIBUTE_RX_MULTICAST_COUNT, pwake_count_info->rx_mcast);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Total wake due RX multicast, ret=%d\n", ret));
+               goto exit;
+       }
+       ret = nla_put_u32(skb, WAKE_STAT_ATTRIBUTE_RX_BROADCAST_COUNT, pwake_count_info->rx_bcast);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Total wake due to RX broadcast, ret=%d\n", ret));
+               goto exit;
+       }
+       ret = nla_put_u32(skb, WAKE_STAT_ATTRIBUTE_RX_ICMP_PKT, pwake_count_info->rx_arp);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Total wake due to ICMP pkt, ret=%d\n", ret));
+               goto exit;
+       }
+       ret = nla_put_u32(skb, WAKE_STAT_ATTRIBUTE_RX_ICMP6_PKT, pwake_count_info->rx_icmpv6);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Total wake due ICMPV6 pkt, ret=%d\n", ret));
+               goto exit;
+       }
+       ret = nla_put_u32(skb, WAKE_STAT_ATTRIBUTE_RX_ICMP6_RA, pwake_count_info->rx_icmpv6_ra);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Total wake due to ICMPV6_RA, ret=%d\n", ret));
+               goto exit;
+       }
+       ret = nla_put_u32(skb, WAKE_STAT_ATTRIBUTE_RX_ICMP6_NA, pwake_count_info->rx_icmpv6_na);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Total wake due to ICMPV6_NA, ret=%d\n", ret));
+               goto exit;
+       }
+       ret = nla_put_u32(skb, WAKE_STAT_ATTRIBUTE_RX_ICMP6_NS, pwake_count_info->rx_icmpv6_ns);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Total wake due to ICMPV6_NS, ret=%d\n", ret));
+               goto exit;
+       }
+       ret = nla_put_u32(skb, WAKE_STAT_ATTRIBUTE_IPV4_RX_MULTICAST_ADD_CNT,
+               pwake_count_info->rx_multi_ipv4);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Total wake due to RX IPV4 MULTICAST, ret=%d\n", ret));
+               goto exit;
+       }
+       ret = nla_put_u32(skb, WAKE_STAT_ATTRIBUTE_IPV6_RX_MULTICAST_ADD_CNT,
+               pwake_count_info->rx_multi_ipv6);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Total wake due to RX IPV6 MULTICAST, ret=%d\n", ret));
+               goto exit;
+       }
+       ret = nla_put_u32(skb, WAKE_STAT_ATTRIBUTE_OTHER_RX_MULTICAST_ADD_CNT,
+               pwake_count_info->rx_multi_other);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Total wake due to Other RX Multicast, ret=%d\n", ret));
+               goto exit;
+       }
+#endif /* #ifdef DHD_WAKE_RX_STATUS */
+       ret = cfg80211_vendor_cmd_reply(skb);
+       if (unlikely(ret)) {
+               WL_ERR(("Vendor cmd reply for -get wake status failed:%d \n", ret));
+       }
+       /* On cfg80211_vendor_cmd_reply() skb is consumed and freed in case of success or failure */
+       return ret;
+
+exit:
+       /* Free skb memory */
+       if (skb) {
+               kfree_skb(skb);
+       }
+       return ret;
+}
+#endif /* DHD_WAKE_STATUS */
+
+#ifdef DHDTCPACK_SUPPRESS
+static int
+wl_cfgvendor_set_tcpack_sup_mode(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void *data, int len)
+{
+       int err = BCME_OK, type;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *ndev = wdev_to_wlc_ndev(wdev, cfg);
+       uint8 enable = 0;
+
+       if (!data) {
+               WL_ERR(("data is not available\n"));
+               err = BCME_BADARG;
+               goto exit;
+       }
+
+       if (len <= 0) {
+               WL_ERR(("Length of the nlattr is not valid len : %d\n", len));
+               err = BCME_BADARG;
+               goto exit;
+       }
+
+       type = nla_type(data);
+       if (type == ANDR_WIFI_ATTRIBUTE_TCPACK_SUP_VALUE) {
+               enable = (uint8) nla_get_u32(data);
+               err = dhd_dev_set_tcpack_sup_mode_cfg(ndev, enable);
+               if (unlikely(err)) {
+                       WL_ERR(("Could not set TCP Ack Suppress mode cfg: %d\n", err));
+               }
+       } else {
+               err = BCME_BADARG;
+       }
+
+exit:
+       return err;
+}
+#endif /* DHDTCPACK_SUPPRESS */
+
+#if defined(WL_CFG80211) && defined(DHD_FILE_DUMP_EVENT)
+static int
+wl_cfgvendor_notify_dump_completion(struct wiphy *wiphy,
+        struct wireless_dev *wdev, const void *data, int len)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhd_pub = cfg->pub;
+       unsigned long flags = 0;
+
+       WL_INFORM(("%s, [DUMP] received file dump notification from HAL\n", __FUNCTION__));
+
+       DHD_GENERAL_LOCK(dhd_pub, flags);
+       /* call wmb() to synchronize with the previous memory operations */
+       OSL_SMP_WMB();
+       DHD_BUS_BUSY_CLEAR_IN_HALDUMP(dhd_pub);
+       /* Call another wmb() to make sure wait_for_dump_completion value
+        * gets updated before waking up waiting context.
+        */
+       OSL_SMP_WMB();
+       dhd_os_busbusy_wake(dhd_pub);
+       DHD_GENERAL_UNLOCK(dhd_pub, flags);
+
+       return BCME_OK;
+}
+#endif /* WL_CFG80211 && DHD_FILE_DUMP_EVENT */
+
+#if defined(WL_CFG80211)
+static int
+wl_cfgvendor_set_hal_started(struct wiphy *wiphy,
+               struct wireless_dev *wdev, const void  *data, int len)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+#ifdef WL_STA_ASSOC_RAND
+       struct ether_addr primary_mac;
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+#endif /* WL_STA_ASSOC_RAND */
+       int ret = BCME_OK;
+#if defined(WIFI_TURNON_USE_HALINIT)
+       struct net_device *ndev = wdev_to_wlc_ndev(wdev, cfg);
+       uint32 type;
+
+       if (!data) {
+               WL_DBG(("%s,data is not available\n", __FUNCTION__));
+       } else {
+               if (len > 0) {
+                       type = nla_type(data);
+                       WL_INFORM(("%s,type: %xh\n", __FUNCTION__, type));
+                       if (type == SET_HAL_START_ATTRIBUTE_PRE_INIT) {
+                               if (nla_len(data)) {
+                                       WL_INFORM(("%s, HAL version: %s\n", __FUNCTION__,
+                                                       (char*)nla_data(data)));
+                               }
+                               WL_INFORM(("%s, dhd_open start\n", __FUNCTION__));
+                               ret = dhd_open(ndev);
+                               if (ret != BCME_OK) {
+                                       WL_INFORM(("%s, dhd_open failed\n", __FUNCTION__));
+                                       return ret;
+                               } else {
+                                       WL_INFORM(("%s, dhd_open succeeded\n", __FUNCTION__));
+                               }
+                               return ret;
+                       }
+               } else {
+                       WL_ERR(("invalid len %d\n", len));
+               }
+       }
+#endif /* WIFI_TURNON_USE_HALINIT */
+       RETURN_EIO_IF_NOT_UP(cfg);
+       WL_INFORM(("%s,[DUMP] HAL STARTED\n", __FUNCTION__));
+
+       cfg->hal_started = true;
+#ifdef WL_STA_ASSOC_RAND
+       /* If mac randomization is enabled and primary macaddress is not
+        * randomized, randomize it from HAL init context
+        */
+       get_primary_mac(cfg, &primary_mac);
+       if ((!ETHER_IS_LOCALADDR(&primary_mac)) &&
+               (!wl_get_drv_status(cfg, CONNECTED, wdev_to_ndev(wdev)))) {
+               WL_DBG_MEM(("%s, Local admin bit not set, randomize"
+                       "STA MAC address \n", __FUNCTION__));
+               if ((ret = dhd_update_rand_mac_addr(dhd)) < 0) {
+                       WL_ERR(("%s: failed to set macaddress, ret = %d\n", __FUNCTION__, ret));
+                       return ret;
+               }
+       }
+#endif /* WL_STA_ASSOC_RAND */
+       return ret;
+}
+
+static int
+wl_cfgvendor_stop_hal(struct wiphy *wiphy,
+               struct wireless_dev *wdev, const void  *data, int len)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       WL_INFORM(("%s,[DUMP] HAL STOPPED\n", __FUNCTION__));
+
+       cfg->hal_started = false;
+       return BCME_OK;
+}
+#endif /* WL_CFG80211 */
+
+#ifdef RTT_SUPPORT
+void
+wl_cfgvendor_rtt_evt(void *ctx, void *rtt_data)
+{
+       struct wireless_dev *wdev = (struct wireless_dev *)ctx;
+       struct wiphy *wiphy;
+       struct sk_buff *skb = NULL;
+       uint32 evt_complete = 0;
+       gfp_t kflags;
+       rtt_result_t *rtt_result;
+       rtt_results_header_t *rtt_header;
+       struct list_head *rtt_cache_list;
+       struct nlattr *rtt_nl_hdr;
+       int ret = BCME_OK;
+       wiphy = wdev->wiphy;
+
+       WL_DBG(("In\n"));
+       /* Push the data to the skb */
+       if (!rtt_data) {
+               WL_ERR(("rtt_data is NULL\n"));
+               return;
+       }
+       rtt_cache_list = (struct list_head *)rtt_data;
+       kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+       if (list_empty(rtt_cache_list)) {
+#if (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || \
+       LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+               skb = cfg80211_vendor_event_alloc(wiphy, NULL, 100,
+                       GOOGLE_RTT_COMPLETE_EVENT, kflags);
+#else
+               skb = cfg80211_vendor_event_alloc(wiphy, 100, GOOGLE_RTT_COMPLETE_EVENT, kflags);
+#endif /* (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || */
+               /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0) */
+               if (!skb) {
+                       WL_ERR(("skb alloc failed"));
+                       return;
+               }
+               evt_complete = 1;
+               ret = nla_put_u32(skb, RTT_ATTRIBUTE_RESULTS_COMPLETE, evt_complete);
+               if (ret < 0) {
+                       WL_ERR(("Failed to put RTT_ATTRIBUTE_RESULTS_COMPLETE\n"));
+                       goto free_mem;
+               }
+               cfg80211_vendor_event(skb, kflags);
+               return;
+       }
+       GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+       list_for_each_entry(rtt_header, rtt_cache_list, list) {
+               /* Alloc the SKB for vendor_event */
+#if (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || \
+       LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+               skb = cfg80211_vendor_event_alloc(wiphy, NULL, rtt_header->result_tot_len + 100,
+                       GOOGLE_RTT_COMPLETE_EVENT, kflags);
+#else
+               skb = cfg80211_vendor_event_alloc(wiphy, rtt_header->result_tot_len + 100,
+                       GOOGLE_RTT_COMPLETE_EVENT, kflags);
+#endif /* (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || */
+               /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0) */
+               if (!skb) {
+                       WL_ERR(("skb alloc failed"));
+                       return;
+               }
+               if (list_is_last(&rtt_header->list, rtt_cache_list)) {
+                       evt_complete = 1;
+               }
+               ret = nla_put_u32(skb, RTT_ATTRIBUTE_RESULTS_COMPLETE, evt_complete);
+               if (ret < 0) {
+                       WL_ERR(("Failed to put RTT_ATTRIBUTE_RESULTS_COMPLETE\n"));
+                       goto free_mem;
+               }
+               rtt_nl_hdr = nla_nest_start(skb, RTT_ATTRIBUTE_RESULTS_PER_TARGET);
+               if (!rtt_nl_hdr) {
+                       WL_ERR(("rtt_nl_hdr is NULL\n"));
+                       dev_kfree_skb_any(skb);
+                       break;
+               }
+               ret = nla_put(skb, RTT_ATTRIBUTE_TARGET_MAC, ETHER_ADDR_LEN,
+                               &rtt_header->peer_mac);
+               if (ret < 0) {
+                       WL_ERR(("Failed to put RTT_ATTRIBUTE_TARGET_MAC, ret:%d\n", ret));
+                       goto free_mem;
+               }
+               ret = nla_put_u32(skb, RTT_ATTRIBUTE_RESULT_CNT, rtt_header->result_cnt);
+               if (ret < 0) {
+                       WL_ERR(("Failed to put RTT_ATTRIBUTE_RESULT_CNT, ret:%d\n", ret));
+                       goto free_mem;
+               }
+               list_for_each_entry(rtt_result, &rtt_header->result_list, list) {
+                       ret = nla_put(skb, RTT_ATTRIBUTE_RESULT,
+                               rtt_result->report_len, &rtt_result->report);
+                       if (ret < 0) {
+                               WL_ERR(("Failed to put RTT_ATTRIBUTE_RESULT, ret:%d\n", ret));
+                               goto free_mem;
+                       }
+                       ret = nla_put(skb, RTT_ATTRIBUTE_RESULT_DETAIL,
+                               rtt_result->detail_len, &rtt_result->rtt_detail);
+                       if (ret < 0) {
+                               WL_ERR(("Failed to put RTT_ATTRIBUTE_RESULT_DETAIL, ret:%d\n",
+                                       ret));
+                               goto free_mem;
+                       }
+               }
+               nla_nest_end(skb, rtt_nl_hdr);
+               cfg80211_vendor_event(skb, kflags);
+       }
+       GCC_DIAGNOSTIC_POP();
+
+       return;
+
+free_mem:
+       /* Free skb memory */
+       if (skb) {
+               kfree_skb(skb);
+       }
+}
+
+static int
+wl_cfgvendor_rtt_set_config(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void *data, int len) {
+       int err = 0, rem, rem1, rem2, type;
+       int target_cnt = 0;
+       rtt_config_params_t rtt_param;
+       rtt_target_info_t* rtt_target = NULL;
+       const struct nlattr *iter, *iter1, *iter2;
+       int8 eabuf[ETHER_ADDR_STR_LEN];
+       int8 chanbuf[CHANSPEC_STR_LEN];
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       rtt_capabilities_t capability;
+
+       bzero(&rtt_param, sizeof(rtt_param));
+
+       WL_DBG(("In\n"));
+       err = dhd_dev_rtt_register_noti_callback(wdev->netdev, wdev, wl_cfgvendor_rtt_evt);
+       if (err < 0) {
+               WL_ERR(("failed to register rtt_noti_callback\n"));
+               goto exit;
+       }
+       err = dhd_dev_rtt_capability(bcmcfg_to_prmry_ndev(cfg), &capability);
+       if (err < 0) {
+               WL_ERR(("failed to get the capability\n"));
+               goto exit;
+       }
+
+       if (len <= 0) {
+               WL_ERR(("Length of the nlattr is not valid len : %d\n", len));
+               err = BCME_ERROR;
+               goto exit;
+       }
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               switch (type) {
+               case RTT_ATTRIBUTE_TARGET_CNT:
+                       if (target_cnt != 0) {
+                               WL_ERR(("attempt to overwrite target_cnt"));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       target_cnt = nla_get_u8(iter);
+                       if ((target_cnt <= 0) || (target_cnt > RTT_MAX_TARGET_CNT)) {
+                               WL_ERR(("target_cnt is not valid : %d\n",
+                                       target_cnt));
+                               err = BCME_RANGE;
+                               goto exit;
+                       }
+                       rtt_param.rtt_target_cnt = target_cnt;
+
+                       rtt_param.target_info = (rtt_target_info_t *)MALLOCZ(cfg->osh,
+                               TARGET_INFO_SIZE(target_cnt));
+                       if (rtt_param.target_info == NULL) {
+                               WL_ERR(("failed to allocate target info for (%d)\n", target_cnt));
+                               err = BCME_NOMEM;
+                               goto exit;
+                       }
+                       break;
+               case RTT_ATTRIBUTE_TARGET_INFO:
+                       /* Added this variable for safe check to avoid crash
+                        * incase the caller did not respect the order
+                        */
+                       if (rtt_param.target_info == NULL) {
+                               WL_ERR(("rtt_target_info is NULL\n"));
+                               err = BCME_NOMEM;
+                               goto exit;
+                       }
+                       rtt_target = rtt_param.target_info;
+                       nla_for_each_nested(iter1, iter, rem1) {
+                               if ((uint8 *)rtt_target >= ((uint8 *)rtt_param.target_info +
+                                       TARGET_INFO_SIZE(target_cnt))) {
+                                       WL_ERR(("rtt_target increased over its max size"));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               nla_for_each_nested(iter2, iter1, rem2) {
+                                       type = nla_type(iter2);
+                                       switch (type) {
+                                       case RTT_ATTRIBUTE_TARGET_MAC:
+                                               if (nla_len(iter2) != ETHER_ADDR_LEN) {
+                                                       WL_ERR(("mac_addr length not match\n"));
+                                                       err = -EINVAL;
+                                                       goto exit;
+                                               }
+                                               memcpy(&rtt_target->addr, nla_data(iter2),
+                                                       ETHER_ADDR_LEN);
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_TYPE:
+                                               rtt_target->type = nla_get_u8(iter2);
+                                               if (rtt_target->type == RTT_INVALID ||
+                                                       (rtt_target->type == RTT_ONE_WAY &&
+                                                       !capability.rtt_one_sided_supported)) {
+                                                       WL_ERR(("doesn't support RTT type"
+                                                               " : %d\n",
+                                                               rtt_target->type));
+                                                       err = -EINVAL;
+                                                       goto exit;
+                                               }
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_PEER:
+                                               rtt_target->peer = nla_get_u8(iter2);
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_CHAN:
+                                               memcpy(&rtt_target->channel, nla_data(iter2),
+                                                       sizeof(rtt_target->channel));
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_PERIOD:
+                                               rtt_target->burst_period = nla_get_u32(iter2);
+                                               if (rtt_target->burst_period < 32) {
+                                                       /* 100ms unit */
+                                                       rtt_target->burst_period *= 100;
+                                               } else {
+                                                       WL_ERR(("%d value must in (0-31)\n",
+                                                               rtt_target->burst_period));
+                                                       err = EINVAL;
+                                                       goto exit;
+                                               }
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_NUM_BURST:
+                                               rtt_target->num_burst = nla_get_u32(iter2);
+                                               if (rtt_target->num_burst > 16) {
+                                                       WL_ERR(("%d value must in (0-15)\n",
+                                                               rtt_target->num_burst));
+                                                       err = -EINVAL;
+                                                       goto exit;
+                                               }
+                                               rtt_target->num_burst = BIT(rtt_target->num_burst);
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_NUM_FTM_BURST:
+                                               rtt_target->num_frames_per_burst =
+                                               nla_get_u32(iter2);
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_NUM_RETRY_FTM:
+                                               rtt_target->num_retries_per_ftm =
+                                               nla_get_u32(iter2);
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_NUM_RETRY_FTMR:
+                                               rtt_target->num_retries_per_ftmr =
+                                               nla_get_u32(iter2);
+                                               if (rtt_target->num_retries_per_ftmr > 3) {
+                                                       WL_ERR(("%d value must in (0-3)\n",
+                                                               rtt_target->num_retries_per_ftmr));
+                                                       err = -EINVAL;
+                                                       goto exit;
+                                               }
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_LCI:
+                                               rtt_target->LCI_request = nla_get_u8(iter2);
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_LCR:
+                                               rtt_target->LCI_request = nla_get_u8(iter2);
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_BURST_DURATION:
+                                               if ((nla_get_u32(iter2) > 1 &&
+                                                       nla_get_u32(iter2) < 12)) {
+                                                       rtt_target->burst_duration =
+                                                       dhd_rtt_idx_to_burst_duration(
+                                                               nla_get_u32(iter2));
+                                               } else if (nla_get_u32(iter2) == 15) {
+                                                       /* use default value */
+                                                       rtt_target->burst_duration = 0;
+                                               } else {
+                                                       WL_ERR(("%d value must in (2-11) or 15\n",
+                                                               nla_get_u32(iter2)));
+                                                       err = -EINVAL;
+                                                       goto exit;
+                                               }
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_BW:
+                                               rtt_target->bw = nla_get_u8(iter2);
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_PREAMBLE:
+                                               rtt_target->preamble = nla_get_u8(iter2);
+                                               break;
+                                       }
+                               }
+                               /* convert to chanspec value */
+                               rtt_target->chanspec =
+                                       dhd_rtt_convert_to_chspec(rtt_target->channel);
+                               if (rtt_target->chanspec == 0) {
+                                       WL_ERR(("Channel is not valid \n"));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               WL_INFORM_MEM(("Target addr %s, Channel : %s for RTT \n",
+                                       bcm_ether_ntoa((const struct ether_addr *)&rtt_target->addr,
+                                       eabuf),
+                                       wf_chspec_ntoa(rtt_target->chanspec, chanbuf)));
+                               rtt_target++;
+                       }
+                       break;
+               }
+       }
+       WL_DBG(("leave :target_cnt : %d\n", rtt_param.rtt_target_cnt));
+       if (dhd_dev_rtt_set_cfg(bcmcfg_to_prmry_ndev(cfg), &rtt_param) < 0) {
+               WL_ERR(("Could not set RTT configuration\n"));
+               err = -EINVAL;
+       }
+exit:
+       /* free the target info list */
+       if (rtt_param.target_info) {
+               MFREE(cfg->osh, rtt_param.target_info,
+                       TARGET_INFO_SIZE(target_cnt));
+       }
+       return err;
+}
+
+static int
+wl_cfgvendor_rtt_cancel_config(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void *data, int len)
+{
+       int err = 0, rem, type, target_cnt = 0;
+       int target_idx = 0;
+       const struct nlattr *iter;
+       struct ether_addr *mac_list = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+       if (len <= 0) {
+               WL_ERR(("Length of nlattr is not valid len : %d\n", len));
+               err = -EINVAL;
+               goto exit;
+       }
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               switch (type) {
+               case RTT_ATTRIBUTE_TARGET_CNT:
+                       if (mac_list != NULL) {
+                               WL_ERR(("mac_list is not NULL\n"));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       target_cnt = nla_get_u8(iter);
+                       if ((target_cnt > 0) && (target_cnt < RTT_MAX_TARGET_CNT)) {
+                               mac_list = (struct ether_addr *)MALLOCZ(cfg->osh,
+                                       target_cnt * ETHER_ADDR_LEN);
+                               if (mac_list == NULL) {
+                                       WL_ERR(("failed to allocate mem for mac list\n"));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                       } else {
+                               /* cancel the current whole RTT process */
+                               goto cancel;
+                       }
+                       break;
+               case RTT_ATTRIBUTE_TARGET_MAC:
+                       if (mac_list == NULL) {
+                               WL_ERR(("ATTRIBUTE_TARGET_CNT not found before "
+                                               " ATTRIBUTE_TARGET_MAC\n"));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+
+                       if (target_idx >= target_cnt) {
+                               WL_ERR(("More TARGET_MAC entries found, "
+                                               "expected TARGET_CNT:%d\n", target_cnt));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+
+                       if (nla_len(iter) != ETHER_ADDR_LEN) {
+                               WL_ERR(("Invalid TARGET_MAC ATTR len :%d\n", nla_len(iter)));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+
+                       memcpy(&mac_list[target_idx], nla_data(iter), ETHER_ADDR_LEN);
+                       target_idx++;
+
+                       break;
+               default:
+                       WL_ERR(("Uknown type : %d\n", type));
+                       err = -EINVAL;
+                       goto exit;
+               }
+       }
+cancel:
+       if (mac_list && dhd_dev_rtt_cancel_cfg(
+               bcmcfg_to_prmry_ndev(cfg), mac_list, target_cnt) < 0) {
+               WL_ERR(("Could not cancel RTT configuration\n"));
+               err = -EINVAL;
+       }
+
+exit:
+       if (mac_list) {
+               MFREE(cfg->osh, mac_list, target_cnt * ETHER_ADDR_LEN);
+       }
+       return err;
+}
+
+static int
+wl_cfgvendor_rtt_get_capability(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       rtt_capabilities_t capability;
+
+       err = dhd_dev_rtt_capability(bcmcfg_to_prmry_ndev(cfg), &capability);
+       if (unlikely(err)) {
+               WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+               goto exit;
+       }
+       err =  wl_cfgvendor_send_cmd_reply(wiphy, &capability, sizeof(capability));
+
+       if (unlikely(err)) {
+               WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+       }
+exit:
+       return err;
+}
+static int
+get_responder_info(struct bcm_cfg80211 *cfg,
+       struct wifi_rtt_responder *responder_info)
+{
+       int err = 0;
+       rtt_capabilities_t capability;
+       err = dhd_dev_rtt_capability(bcmcfg_to_prmry_ndev(cfg), &capability);
+       if (unlikely(err)) {
+               WL_ERR(("Could not get responder capability:%d \n", err));
+               return err;
+       }
+       if (capability.preamble_support & RTT_PREAMBLE_VHT) {
+               responder_info->preamble |= RTT_PREAMBLE_VHT;
+       }
+       if (capability.preamble_support & RTT_PREAMBLE_HT) {
+               responder_info->preamble |= RTT_PREAMBLE_HT;
+       }
+       err = dhd_dev_rtt_avail_channel(bcmcfg_to_prmry_ndev(cfg), &(responder_info->channel));
+       if (unlikely(err)) {
+               WL_ERR(("Could not get available channel:%d \n", err));
+               return err;
+       }
+       return err;
+}
+static int
+wl_cfgvendor_rtt_get_responder_info(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       wifi_rtt_responder_t responder_info;
+
+       WL_DBG(("Recv -get_avail_ch command \n"));
+
+       bzero(&responder_info, sizeof(responder_info));
+       err = get_responder_info(cfg, &responder_info);
+       if (unlikely(err)) {
+               WL_ERR(("Failed to get responder info:%d \n", err));
+               return err;
+       }
+       err =  wl_cfgvendor_send_cmd_reply(wiphy, &responder_info, sizeof(responder_info));
+       if (unlikely(err)) {
+               WL_ERR(("Vendor cmd reply for -get_avail_ch failed ret:%d \n", err));
+       }
+       return err;
+}
+
+static int
+wl_cfgvendor_rtt_set_responder(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *ndev = wdev_to_wlc_ndev(wdev, cfg);
+       wifi_rtt_responder_t responder_info;
+
+       WL_DBG(("Recv rtt -enable_resp cmd.\n"));
+
+       bzero(&responder_info, sizeof(responder_info));
+
+       /*
+       *Passing channel as NULL until implementation
+       *to get chan info from upper layers is donex
+       */
+       err = dhd_dev_rtt_enable_responder(ndev, NULL);
+       if (unlikely(err)) {
+               WL_ERR(("Could not enable responder ret:%d \n", err));
+               goto done;
+       }
+       err = get_responder_info(cfg, &responder_info);
+       if (unlikely(err)) {
+               WL_ERR(("Failed to get responder info:%d \n", err));
+               dhd_dev_rtt_cancel_responder(ndev);
+               goto done;
+       }
+done:
+       err =  wl_cfgvendor_send_cmd_reply(wiphy, &responder_info, sizeof(responder_info));
+       if (unlikely(err)) {
+               WL_ERR(("Vendor cmd reply for -enable_resp failed ret:%d \n", err));
+       }
+       return err;
+}
+
+static int
+wl_cfgvendor_rtt_cancel_responder(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+       WL_DBG(("Recv rtt -cancel_resp cmd \n"));
+
+       err = dhd_dev_rtt_cancel_responder(bcmcfg_to_prmry_ndev(cfg));
+       if (unlikely(err)) {
+               WL_ERR(("Vendor cmd -cancel_resp failed ret:%d \n", err));
+       }
+       return err;
+}
+#endif /* RTT_SUPPORT */
+
+#ifdef GSCAN_SUPPORT
+static int wl_cfgvendor_enable_lazy_roam(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = -EINVAL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int type;
+       uint32 lazy_roam_enable_flag;
+
+       if (!data) {
+               WL_ERR(("data is not available\n"));
+               return -EINVAL;
+       }
+
+       if (len <= 0) {
+               WL_ERR(("invaild len %d\n", len));
+               return -EINVAL;
+       }
+
+       type = nla_type(data);
+
+       if (type == GSCAN_ATTRIBUTE_LAZY_ROAM_ENABLE) {
+               lazy_roam_enable_flag = nla_get_u32(data);
+
+               err = dhd_dev_lazy_roam_enable(bcmcfg_to_prmry_ndev(cfg),
+                          lazy_roam_enable_flag);
+               if (unlikely(err))
+                       WL_ERR(("Could not enable lazy roam:%d \n", err));
+       }
+
+       return err;
+}
+
+static int wl_cfgvendor_set_lazy_roam_cfg(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0, tmp, type;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       wlc_roam_exp_params_t roam_param;
+       const struct nlattr *iter;
+
+       bzero(&roam_param, sizeof(roam_param));
+
+       nla_for_each_attr(iter, data, len, tmp) {
+               type = nla_type(iter);
+               switch (type) {
+                       case GSCAN_ATTRIBUTE_A_BAND_BOOST_THRESHOLD:
+                               roam_param.a_band_boost_threshold = nla_get_u32(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_A_BAND_PENALTY_THRESHOLD:
+                               roam_param.a_band_penalty_threshold = nla_get_u32(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_A_BAND_BOOST_FACTOR:
+                               roam_param.a_band_boost_factor = nla_get_u32(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_A_BAND_PENALTY_FACTOR:
+                               roam_param.a_band_penalty_factor = nla_get_u32(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_A_BAND_MAX_BOOST:
+                               roam_param.a_band_max_boost = nla_get_u32(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_LAZY_ROAM_HYSTERESIS:
+                               roam_param.cur_bssid_boost = nla_get_u32(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_ALERT_ROAM_RSSI_TRIGGER:
+                               roam_param.alert_roam_trigger_threshold = nla_get_u32(iter);
+                               break;
+               }
+       }
+
+       if (dhd_dev_set_lazy_roam_cfg(bcmcfg_to_prmry_ndev(cfg), &roam_param) < 0) {
+               WL_ERR(("Could not set batch cfg\n"));
+               err = -EINVAL;
+       }
+       return err;
+}
+
+/* small helper function */
+static wl_bssid_pref_cfg_t *
+create_bssid_pref_cfg(struct bcm_cfg80211 *cfg, uint32 num, uint32 *buf_len)
+{
+       wl_bssid_pref_cfg_t *bssid_pref;
+
+       *buf_len = sizeof(wl_bssid_pref_cfg_t);
+       if (num) {
+               *buf_len += (num - 1) * sizeof(wl_bssid_pref_list_t);
+       }
+       bssid_pref = (wl_bssid_pref_cfg_t *)MALLOC(cfg->osh, *buf_len);
+
+       return bssid_pref;
+}
+
+static int
+wl_cfgvendor_set_bssid_pref(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       wl_bssid_pref_cfg_t *bssid_pref = NULL;
+       wl_bssid_pref_list_t *bssids;
+       int tmp, tmp1, tmp2, type;
+       const struct nlattr *outer, *inner, *iter;
+       uint32 flush = 0, num = 0, buf_len = 0;
+       uint8 bssid_found = 0, rssi_found = 0;
+
+       /* Assumption: NUM attribute must come first */
+       nla_for_each_attr(iter, data, len, tmp2) {
+               type = nla_type(iter);
+               switch (type) {
+                       case GSCAN_ATTRIBUTE_NUM_BSSID:
+                               if (num) {
+                                       WL_ERR(("attempt overide bssid num.\n"));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               if (nla_len(iter) != sizeof(uint32)) {
+                                       WL_ERR(("nla_len not match\n"));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               num = nla_get_u32(iter);
+                               if (num == 0 || num > MAX_BSSID_PREF_LIST_NUM) {
+                                       WL_ERR(("wrong BSSID num:%d\n", num));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               if ((bssid_pref = create_bssid_pref_cfg(cfg, num, &buf_len))
+                                                       == NULL) {
+                                       WL_ERR(("Can't malloc memory\n"));
+                                       err = -ENOMEM;
+                                       goto exit;
+                               }
+                               break;
+                       case GSCAN_ATTRIBUTE_BSSID_PREF_FLUSH:
+                               if (nla_len(iter) != sizeof(uint32)) {
+                                       WL_ERR(("nla_len not match\n"));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               flush = nla_get_u32(iter);
+                               if (flush != 1) {
+                                       WL_ERR(("wrong flush value\n"));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               break;
+                       case GSCAN_ATTRIBUTE_BSSID_PREF_LIST:
+                               if (!num || !bssid_pref) {
+                                       WL_ERR(("bssid list count not set\n"));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               bssid_pref->count = 0;
+                               bssids = bssid_pref->bssids;
+                               nla_for_each_nested(outer, iter, tmp) {
+                                       if (bssid_pref->count >= num) {
+                                               WL_ERR(("too many bssid list\n"));
+                                               err = -EINVAL;
+                                               goto exit;
+                                       }
+                                       bssid_found = 0;
+                                       rssi_found = 0;
+                                       nla_for_each_nested(inner, outer, tmp1) {
+                                               type = nla_type(inner);
+                                               switch (type) {
+                                               case GSCAN_ATTRIBUTE_BSSID_PREF:
+                                                       if (nla_len(inner) != ETHER_ADDR_LEN) {
+                                                               WL_ERR(("nla_len not match.\n"));
+                                                               err = -EINVAL;
+                                                               goto exit;
+                                                       }
+                                                       memcpy(&(bssids[bssid_pref->count].bssid),
+                                                         nla_data(inner), ETHER_ADDR_LEN);
+                                                       /* not used for now */
+                                                       bssids[bssid_pref->count].flags = 0;
+                                                       bssid_found = 1;
+                                                       break;
+                                               case GSCAN_ATTRIBUTE_RSSI_MODIFIER:
+                                                       if (nla_len(inner) != sizeof(uint32)) {
+                                                               WL_ERR(("nla_len not match.\n"));
+                                                               err = -EINVAL;
+                                                               goto exit;
+                                                       }
+                                                       bssids[bssid_pref->count].rssi_factor =
+                                                              (int8) nla_get_u32(inner);
+                                                       rssi_found = 1;
+                                                       break;
+                                               default:
+                                                       WL_ERR(("wrong type:%d\n", type));
+                                                       err = -EINVAL;
+                                                       goto exit;
+                                               }
+                                               if (bssid_found && rssi_found) {
+                                                       break;
+                                               }
+                                       }
+                                       bssid_pref->count++;
+                               }
+                               break;
+                       default:
+                               WL_ERR(("%s: No such attribute %d\n", __FUNCTION__, type));
+                               break;
+                       }
+       }
+
+       if (!bssid_pref) {
+               /* What if only flush is desired? */
+               if (flush) {
+                       if ((bssid_pref = create_bssid_pref_cfg(cfg, 0, &buf_len)) == NULL) {
+                               WL_ERR(("%s: Can't malloc memory\n", __FUNCTION__));
+                               err = -ENOMEM;
+                               goto exit;
+                       }
+                       bssid_pref->count = 0;
+               } else {
+                       err = -EINVAL;
+                       goto exit;
+               }
+       }
+       err = dhd_dev_set_lazy_roam_bssid_pref(bcmcfg_to_prmry_ndev(cfg),
+                 bssid_pref, flush);
+exit:
+       if (bssid_pref) {
+               MFREE(cfg->osh, bssid_pref, buf_len);
+       }
+       return err;
+}
+#endif /* GSCAN_SUPPORT */
+#if defined(GSCAN_SUPPORT) || defined(ROAMEXP_SUPPORT)
+static int
+wl_cfgvendor_set_bssid_blacklist(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       maclist_t *blacklist = NULL;
+       int err = 0;
+       int type, tmp;
+       const struct nlattr *iter;
+       uint32 mem_needed = 0, flush = 0, num = 0;
+
+       /* Assumption: NUM attribute must come first */
+       nla_for_each_attr(iter, data, len, tmp) {
+               type = nla_type(iter);
+               switch (type) {
+                       case GSCAN_ATTRIBUTE_NUM_BSSID:
+                               if (num != 0) {
+                                       WL_ERR(("attempt to change BSSID num\n"));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               if (nla_len(iter) != sizeof(uint32)) {
+                                       WL_ERR(("not matching nla_len.\n"));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               num = nla_get_u32(iter);
+                               if (num == 0 || num > MAX_BSSID_BLACKLIST_NUM) {
+                                       WL_ERR(("wrong BSSID count:%d\n", num));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               if (!blacklist) {
+                                       mem_needed = (uint32) (OFFSETOF(maclist_t, ea) +
+                                               sizeof(struct ether_addr) * (num));
+                                       blacklist = (maclist_t *)
+                                               MALLOCZ(cfg->osh, mem_needed);
+                                       if (!blacklist) {
+                                               WL_ERR(("MALLOCZ failed.\n"));
+                                               err = -ENOMEM;
+                                               goto exit;
+                                       }
+                               }
+                               break;
+                       case GSCAN_ATTRIBUTE_BSSID_BLACKLIST_FLUSH:
+                               if (nla_len(iter) != sizeof(uint32)) {
+                                       WL_ERR(("not matching nla_len.\n"));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               flush = nla_get_u32(iter);
+                               if (flush != 1) {
+                                       WL_ERR(("flush arg is worng:%d\n", flush));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               break;
+                       case GSCAN_ATTRIBUTE_BLACKLIST_BSSID:
+                               if (num == 0 || !blacklist) {
+                                       WL_ERR(("number of BSSIDs not received.\n"));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               if (nla_len(iter) != ETHER_ADDR_LEN) {
+                                       WL_ERR(("not matching nla_len.\n"));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               if (blacklist->count >= num) {
+                                       WL_ERR(("too many BSSIDs than expected:%d\n",
+                                               blacklist->count));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               memcpy(&(blacklist->ea[blacklist->count]), nla_data(iter),
+                                               ETHER_ADDR_LEN);
+                               blacklist->count++;
+                               break;
+               default:
+                       WL_ERR(("No such attribute:%d\n", type));
+                       break;
+               }
+       }
+
+       if (blacklist && (blacklist->count != num)) {
+               WL_ERR(("not matching bssid count:%d to expected:%d\n",
+                               blacklist->count, num));
+               err = -EINVAL;
+               goto exit;
+       }
+
+       err = dhd_dev_set_blacklist_bssid(bcmcfg_to_prmry_ndev(cfg),
+                 blacklist, mem_needed, flush);
+exit:
+       MFREE(cfg->osh, blacklist, mem_needed);
+       return err;
+}
+
+static int
+wl_cfgvendor_set_ssid_whitelist(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       wl_ssid_whitelist_t *ssid_whitelist = NULL;
+       wlc_ssid_t *ssid_elem;
+       int tmp, tmp1, mem_needed = 0, type;
+       const struct nlattr *iter, *iter1;
+       uint32 flush = 0, num = 0;
+       int ssid_found = 0;
+
+       /* Assumption: NUM attribute must come first */
+       nla_for_each_attr(iter, data, len, tmp) {
+               type = nla_type(iter);
+               switch (type) {
+               case GSCAN_ATTRIBUTE_NUM_WL_SSID:
+                       if (num != 0) {
+                               WL_ERR(("try to change SSID num\n"));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               WL_ERR(("not matching nla_len.\n"));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       num = nla_get_u32(iter);
+                       if (num == 0 || num > MAX_SSID_WHITELIST_NUM) {
+                               WL_ERR(("wrong SSID count:%d\n", num));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       mem_needed = sizeof(wl_ssid_whitelist_t) +
+                               sizeof(wlc_ssid_t) * num;
+                       ssid_whitelist = (wl_ssid_whitelist_t *)
+                               MALLOCZ(cfg->osh, mem_needed);
+                       if (ssid_whitelist == NULL) {
+                               WL_ERR(("failed to alloc mem\n"));
+                               err = -ENOMEM;
+                               goto exit;
+                       }
+                       break;
+               case GSCAN_ATTRIBUTE_WL_SSID_FLUSH:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               WL_ERR(("not matching nla_len.\n"));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       flush = nla_get_u32(iter);
+                       if (flush != 1) {
+                               WL_ERR(("flush arg worng:%d\n", flush));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       break;
+               case GSCAN_ATTRIBUTE_WHITELIST_SSID_ELEM:
+                       if (!num || !ssid_whitelist) {
+                               WL_ERR(("num ssid is not set!\n"));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       if (ssid_whitelist->ssid_count >= num) {
+                               WL_ERR(("too many SSIDs:%d\n",
+                                       ssid_whitelist->ssid_count));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+
+                       ssid_elem = &ssid_whitelist->ssids[
+                                       ssid_whitelist->ssid_count];
+                       ssid_found = 0;
+                       nla_for_each_nested(iter1, iter, tmp1) {
+                               type = nla_type(iter1);
+                               switch (type) {
+                               case GSCAN_ATTRIBUTE_WL_SSID_LEN:
+                                       if (nla_len(iter1) != sizeof(uint32)) {
+                                               WL_ERR(("not match nla_len\n"));
+                                               err = -EINVAL;
+                                               goto exit;
+                                       }
+                                       ssid_elem->SSID_len = nla_get_u32(iter1);
+                                       if (ssid_elem->SSID_len >
+                                                       DOT11_MAX_SSID_LEN) {
+                                               WL_ERR(("wrong SSID len:%d\n",
+                                                       ssid_elem->SSID_len));
+                                               err = -EINVAL;
+                                               goto exit;
+                                       }
+                                       break;
+                               case GSCAN_ATTRIBUTE_WHITELIST_SSID:
+                                       if (ssid_elem->SSID_len == 0) {
+                                               WL_ERR(("SSID_len not received\n"));
+                                               err = -EINVAL;
+                                               goto exit;
+                                       }
+                                       if (nla_len(iter1) != ssid_elem->SSID_len) {
+                                               WL_ERR(("not match nla_len\n"));
+                                               err = -EINVAL;
+                                               goto exit;
+                                       }
+                                       memcpy(ssid_elem->SSID, nla_data(iter1),
+                                                       ssid_elem->SSID_len);
+                                       ssid_found = 1;
+                                       break;
+                               }
+                               if (ssid_found) {
+                                       ssid_whitelist->ssid_count++;
+                                       break;
+                               }
+                       }
+                       break;
+               default:
+                       WL_ERR(("No such attribute: %d\n", type));
+                       break;
+               }
+       }
+
+       if (ssid_whitelist && (ssid_whitelist->ssid_count != num)) {
+               WL_ERR(("not matching ssid count:%d to expected:%d\n",
+                               ssid_whitelist->ssid_count, num));
+               err = -EINVAL;
+               goto exit;
+       }
+       err = dhd_dev_set_whitelist_ssid(bcmcfg_to_prmry_ndev(cfg),
+                 ssid_whitelist, mem_needed, flush);
+       if (err == BCME_UNSUPPORTED) {
+               /* If firmware doesn't support feature, ignore the error
+                * Android framework doesn't populate/use whitelist ssids
+                * as of now, but invokes whitelist as part of roam config
+                * API. so this handler cannot be compiled out. but its
+                * safe to ignore.
+                */
+               WL_ERR(("whilelist ssid not supported. Ignore."));
+               err = BCME_OK;
+       }
+exit:
+       MFREE(cfg->osh, ssid_whitelist, mem_needed);
+       return err;
+}
+#endif /* GSCAN_SUPPORT || ROAMEXP_SUPPORT */
+
+#ifdef ROAMEXP_SUPPORT
+typedef enum {
+       FW_ROAMING_ENABLE = 1,
+       FW_ROAMING_DISABLE,
+       FW_ROAMING_PAUSE,
+       FW_ROAMING_RESUME
+} fw_roaming_state_t;
+
+static int
+wl_cfgvendor_set_fw_roaming_state(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       fw_roaming_state_t requested_roaming_state;
+       int type;
+       int err = 0;
+
+       if (!data) {
+               WL_ERR(("data is not available\n"));
+               return -EINVAL;
+       }
+
+       if (len <= 0) {
+               WL_ERR(("invalid len %d\n", len));
+               return -EINVAL;
+       }
+
+       /* Get the requested fw roaming state */
+       type = nla_type(data);
+       if (type != GSCAN_ATTRIBUTE_ROAM_STATE_SET) {
+               WL_ERR(("%s: Invalid attribute %d\n", __FUNCTION__, type));
+               return -EINVAL;
+       }
+
+       requested_roaming_state = nla_get_u32(data);
+       WL_INFORM(("setting FW roaming state to %d\n", requested_roaming_state));
+
+       if ((requested_roaming_state == FW_ROAMING_ENABLE) ||
+               (requested_roaming_state == FW_ROAMING_RESUME)) {
+               err = wldev_iovar_setint(wdev_to_ndev(wdev), "roam_off", FALSE);
+       } else if ((requested_roaming_state == FW_ROAMING_DISABLE) ||
+               (requested_roaming_state == FW_ROAMING_PAUSE)) {
+               err = wldev_iovar_setint(wdev_to_ndev(wdev), "roam_off", TRUE);
+       } else {
+               err = -EINVAL;
+       }
+
+       return err;
+}
+
+static int
+wl_cfgvendor_fw_roam_get_capability(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       wifi_roaming_capabilities_t roaming_capability;
+
+       /* Update max number of blacklist bssids supported */
+       roaming_capability.max_blacklist_size = MAX_BSSID_BLACKLIST_NUM;
+       roaming_capability.max_whitelist_size = MAX_SSID_WHITELIST_NUM;
+       err =  wl_cfgvendor_send_cmd_reply(wiphy, &roaming_capability,
+               sizeof(roaming_capability));
+       if (unlikely(err)) {
+               WL_ERR(("Vendor cmd reply for fw roam capability failed ret:%d \n", err));
+       }
+
+       return err;
+}
+#endif /* ROAMEXP_SUPPORT */
+
+static int
+wl_cfgvendor_priv_string_handler(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int ret = 0;
+       int ret_len = 0, payload = 0, msglen;
+       const struct bcm_nlmsg_hdr *nlioc = data;
+       void *buf = NULL, *cur;
+       int maxmsglen = PAGE_SIZE - 0x100;
+       struct sk_buff *reply;
+
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(wdev->netdev);
+
+       /* send to dongle only if we are not waiting for reload already */
+       if (dhdp && dhdp->hang_was_sent) {
+               WL_INFORM(("Bus down. HANG was sent up earlier\n"));
+               DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE(dhdp, DHD_EVENT_TIMEOUT_MS);
+               DHD_OS_WAKE_UNLOCK(dhdp);
+               return OSL_ERROR(BCME_DONGLE_DOWN);
+       }
+
+       if (!data) {
+               WL_ERR(("data is not available\n"));
+               return BCME_BADARG;
+       }
+
+       if (len <= sizeof(struct bcm_nlmsg_hdr)) {
+               WL_ERR(("invalid len %d\n", len));
+               return BCME_BADARG;
+       }
+
+       WL_DBG(("entry: cmd = %d\n", nlioc->cmd));
+
+       if (nlioc->offset != sizeof(struct bcm_nlmsg_hdr)) {
+               WL_ERR(("invalid offset %d\n", nlioc->offset));
+               return BCME_BADARG;
+       }
+       len -= sizeof(struct bcm_nlmsg_hdr);
+       ret_len = nlioc->len;
+       if (ret_len > 0 || len > 0) {
+               if (len >= DHD_IOCTL_MAXLEN) {
+                       WL_ERR(("oversize input buffer %d\n", len));
+                       len = DHD_IOCTL_MAXLEN - 1;
+               }
+               if (ret_len >= DHD_IOCTL_MAXLEN) {
+                       WL_ERR(("oversize return buffer %d\n", ret_len));
+                       ret_len = DHD_IOCTL_MAXLEN - 1;
+               }
+
+               payload = max(ret_len, len) + 1;
+               buf = vzalloc(payload);
+               if (!buf) {
+                       return -ENOMEM;
+               }
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               memcpy(buf, (void *)((char *)nlioc + nlioc->offset), len);
+               GCC_DIAGNOSTIC_POP();
+               *((char *)buf + len) = '\0';
+       }
+
+       ret = dhd_cfgvendor_priv_string_handler(cfg, wdev, nlioc, buf);
+       if (ret) {
+               WL_ERR(("dhd_cfgvendor returned error %d", ret));
+               vfree(buf);
+               return ret;
+       }
+       cur = buf;
+       while (ret_len > 0) {
+               msglen = ret_len > maxmsglen ? maxmsglen : ret_len;
+               ret_len -= msglen;
+               payload = msglen + sizeof(msglen);
+               reply = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, payload);
+               if (!reply) {
+                       WL_ERR(("Failed to allocate reply msg\n"));
+                       ret = -ENOMEM;
+                       break;
+               }
+
+               if (nla_put(reply, BCM_NLATTR_DATA, msglen, cur) ||
+                       nla_put_u16(reply, BCM_NLATTR_LEN, msglen)) {
+                       kfree_skb(reply);
+                       ret = -ENOBUFS;
+                       break;
+               }
+
+               ret = cfg80211_vendor_cmd_reply(reply);
+               if (ret) {
+                       WL_ERR(("testmode reply failed:%d\n", ret));
+                       break;
+               }
+               cur = (void *)((char *)cur + msglen);
+       }
+
+       return ret;
+}
+
+struct net_device *
+wl_cfgvendor_get_ndev(struct bcm_cfg80211 *cfg, struct wireless_dev *wdev,
+       const char *data, unsigned long int *out_addr)
+{
+       char *pos, *pos1;
+       char ifname[IFNAMSIZ + 1] = {0};
+       struct net_info *iter, *next;
+       struct net_device *ndev = NULL;
+       ulong ifname_len;
+       *out_addr = (unsigned long int) data; /* point to command str by default */
+
+       /* check whether ifname=<ifname> is provided in the command */
+       pos = strstr(data, "ifname=");
+       if (pos) {
+               pos += strlen("ifname=");
+               pos1 = strstr(pos, " ");
+               if (!pos1) {
+                       WL_ERR(("command format error \n"));
+                       return NULL;
+               }
+
+               ifname_len = pos1 - pos;
+               if (memcpy_s(ifname, (sizeof(ifname) - 1), pos, ifname_len) != BCME_OK) {
+                       WL_ERR(("Failed to copy data. len: %ld\n", ifname_len));
+                       return NULL;
+               }
+               GCC_DIAGNOSTIC_PUSH_SUPPRESS_CAST();
+               for_each_ndev(cfg, iter, next) {
+                       if (iter->ndev) {
+                               if (strncmp(iter->ndev->name, ifname,
+                                       strlen(iter->ndev->name)) == 0) {
+                                       /* matching ifname found */
+                                       WL_DBG(("matching interface (%s) found ndev:%p \n",
+                                               iter->ndev->name, iter->ndev));
+                                       *out_addr = (unsigned long int)(pos1 + 1);
+                                       /* Returns the command portion after ifname=<name> */
+                                       return iter->ndev;
+                               }
+                       }
+               }
+               GCC_DIAGNOSTIC_POP();
+               WL_ERR(("Couldn't find ifname:%s in the netinfo list \n",
+                       ifname));
+               return NULL;
+       }
+
+       /* If ifname=<name> arg is not provided, use default ndev */
+       ndev = wdev->netdev ? wdev->netdev : bcmcfg_to_prmry_ndev(cfg);
+       WL_DBG(("Using default ndev (%s) \n", ndev->name));
+       return ndev;
+}
+
+#ifdef WL_SAE
+static int wl_cfgvendor_map_supp_sae_pwe_to_fw(u32 sup_value, u32 *sae_pwe)
+{
+       s32 ret = BCME_OK;
+       switch (sup_value) {
+               case SUPP_SAE_PWE_LOOP:
+                       *sae_pwe = SAE_PWE_LOOP;
+                       break;
+               case SUPP_SAE_PWE_H2E:
+                       *sae_pwe = SAE_PWE_H2E;
+                       break;
+               case SUPP_SAE_PWE_TRANS:
+                       *sae_pwe = SAE_PWE_LOOP | SAE_PWE_H2E;
+                       break;
+               default:
+                       ret = BCME_BADARG;
+       }
+       return ret;
+}
+#endif /* WL_SAE */
+
+int
+wl_cfgvendor_connect_params_handler(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       struct net_device *net = wdev->netdev;
+       int ret = BCME_OK;
+       int attr_type;
+       int rem = len;
+       const struct nlattr *iter;
+
+       BCM_REFERENCE(net);
+
+       nla_for_each_attr(iter, data, len, rem) {
+               attr_type = nla_type(iter);
+               WL_DBG(("attr type: (%u)\n", attr_type));
+
+               switch (attr_type) {
+#ifdef WL_SAE
+               case BRCM_ATTR_SAE_PWE: {
+                       u32 sae_pwe = 0;
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               WL_ERR(("Invalid value of sae_pwe\n"));
+                               ret = -EINVAL;
+                               break;
+                       }
+                       ret = wl_cfgvendor_map_supp_sae_pwe_to_fw(nla_get_u32(iter), &sae_pwe);
+                       if (unlikely(ret)) {
+                               WL_ERR(("Invalid sae_pwe\n"));
+                               break;
+                       }
+                       ret = wl_cfg80211_set_wsec_info(net, &sae_pwe,
+                               sizeof(sae_pwe), WL_WSEC_INFO_BSS_SAE_PWE);
+                       if (unlikely(ret)) {
+                               WL_ERR(("set wsec_info_sae_pwe failed \n"));
+                       }
+                       break;
+               }
+#endif /* WL_SAE */
+               /* Add new attributes here */
+               default:
+                       WL_DBG(("%s: Unknown type, %d\n", __FUNCTION__, attr_type));
+               }
+       }
+
+       return ret;
+}
+
+int
+wl_cfgvendor_start_ap_params_handler(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       struct net_device *net = wdev->netdev;
+       int ret = BCME_OK;
+       int attr_type;
+       int rem = len;
+       const struct nlattr *iter;
+
+       BCM_REFERENCE(net);
+
+       nla_for_each_attr(iter, data, len, rem) {
+               attr_type = nla_type(iter);
+               WL_DBG(("attr type: (%u)\n", attr_type));
+
+               switch (attr_type) {
+#ifdef WL_SAE
+               case BRCM_ATTR_SAE_PWE: {
+                       u32 sae_pwe = 0;
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               WL_ERR(("Invalid value of sae_pwe\n"));
+                               ret = -EINVAL;
+                               break;
+                       }
+                       ret = wl_cfgvendor_map_supp_sae_pwe_to_fw(nla_get_u32(iter), &sae_pwe);
+                       if (unlikely(ret)) {
+                               WL_ERR(("Invalid sae_pwe\n"));
+                               break;
+                       }
+                       ret = wl_cfg80211_set_wsec_info(net, &sae_pwe,
+                               sizeof(sae_pwe), WL_WSEC_INFO_BSS_SAE_PWE);
+                       if (unlikely(ret)) {
+                               WL_ERR(("set wsec_info_sae_pwe failed \n"));
+                       }
+                       break;
+               }
+#endif /* WL_SAE */
+               /* Add new attributes here */
+               default:
+                       WL_DBG(("%s: Unknown type, %d\n", __FUNCTION__, attr_type));
+               }
+       }
+
+       return ret;
+}
+
+#ifdef WL_SAE
+static int
+wl_cfgvendor_set_sae_password(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = BCME_OK;
+       struct net_device *net = wdev->netdev;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(net);
+       wsec_pmk_t pmk;
+       s32 bssidx;
+
+       /* clear the content of pmk structure before usage */
+       (void)memset_s(&pmk, sizeof(wsec_pmk_t), 0x0, sizeof(wsec_pmk_t));
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, net->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", net->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if ((len < WSEC_MIN_PSK_LEN) || (len >= WSEC_MAX_PASSPHRASE_LEN)) {
+               WL_ERR(("Invalid passphrase length %d..should be >= 8 and < 256\n",
+                       len));
+               err = BCME_BADLEN;
+               goto done;
+       }
+       /* Set AUTH to SAE */
+       err = wldev_iovar_setint_bsscfg(net, "wpa_auth", WPA3_AUTH_SAE_PSK, bssidx);
+       if (unlikely(err)) {
+               WL_ERR(("could not set wpa_auth (0x%x)\n", err));
+               goto done;
+       }
+       pmk.key_len = htod16(len);
+       bcopy((const u8*)data, pmk.key, len);
+       pmk.flags = htod16(WSEC_PASSPHRASE);
+
+       err = wldev_ioctl_set(net, WLC_SET_WSEC_PMK, &pmk, sizeof(pmk));
+       if (err) {
+               WL_ERR(("\n failed to set pmk %d\n", err));
+               goto done;
+       } else {
+               WL_INFORM_MEM(("sae passphrase set successfully\n"));
+       }
+done:
+       return err;
+}
+#endif /* WL_SAE */
+
+#ifdef BCM_PRIV_CMD_SUPPORT
+/* strlen("ifname=") + IFNAMESIZE + strlen(" ") + '\0' */
+#define ANDROID_PRIV_CMD_IF_PREFIX_LEN (7 + IFNAMSIZ + 2)
+/* Max length for the reply buffer. For BRCM_ATTR_DRIVER_CMD, the reply
+ * would be a formatted string and reply buf would be the size of the
+ * string.
+ */
+#define WL_DRIVER_PRIV_CMD_LEN 512
+static int
+wl_cfgvendor_priv_bcm_handler(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       const struct nlattr *iter;
+       int err = 0;
+       int data_len = 0, cmd_len = 0, tmp = 0, type = 0;
+       struct net_device *ndev = wdev->netdev;
+       char *cmd = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int bytes_written;
+       struct net_device *net = NULL;
+       unsigned long int cmd_out = 0;
+
+#if defined(WL_ANDROID_PRIV_CMD_OVER_NL80211)
+       u32 cmd_buf_len = WL_DRIVER_PRIV_CMD_LEN;
+       char cmd_prefix[ANDROID_PRIV_CMD_IF_PREFIX_LEN + 1] = {0};
+       char *cmd_buf = NULL;
+       char *current_pos;
+       u32 cmd_offset;
+#endif /* WL_ANDROID_PRIV_CMD_OVER_NL80211 && OEM_ANDROID */
+
+       WL_DBG(("%s: Enter \n", __func__));
+
+       /* hold wake lock */
+       net_os_wake_lock(ndev);
+
+       nla_for_each_attr(iter, data, len, tmp) {
+               type = nla_type(iter);
+               cmd = nla_data(iter);
+               cmd_len = nla_len(iter);
+
+               WL_DBG(("%s: type: %d cmd_len:%d cmd_ptr:%p \n", __func__, type, cmd_len, cmd));
+               if (!cmd || !cmd_len) {
+                       WL_ERR(("Invalid cmd data \n"));
+                       err = -EINVAL;
+                       goto exit;
+               }
+
+#if defined(WL_ANDROID_PRIV_CMD_OVER_NL80211)
+               if (type == BRCM_ATTR_DRIVER_CMD) {
+                       if ((cmd_len >= WL_DRIVER_PRIV_CMD_LEN) ||
+                               (cmd_len < ANDROID_PRIV_CMD_IF_PREFIX_LEN)) {
+                               WL_ERR(("Unexpected command length (%u)."
+                                       "Ignore the command\n", cmd_len));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+
+                       /* check whether there is any ifname prefix provided */
+                       if (memcpy_s(cmd_prefix, (sizeof(cmd_prefix) - 1),
+                                       cmd, ANDROID_PRIV_CMD_IF_PREFIX_LEN) != BCME_OK) {
+                               WL_ERR(("memcpy failed for cmd buffer. len:%d\n", cmd_len));
+                               err = -ENOMEM;
+                               goto exit;
+                       }
+
+                       net = wl_cfgvendor_get_ndev(cfg, wdev, cmd_prefix, &cmd_out);
+                       if (!cmd_out || !net) {
+                               WL_ERR(("ndev not found\n"));
+                               err = -ENODEV;
+                               goto exit;
+                       }
+
+                       /* find offset of the command */
+                       current_pos = (char *)cmd_out;
+                       cmd_offset = current_pos - cmd_prefix;
+
+                       if (!current_pos || (cmd_offset) > ANDROID_PRIV_CMD_IF_PREFIX_LEN) {
+                               WL_ERR(("Invalid len cmd_offset: %u \n", cmd_offset));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+
+                       /* Private command data in expected to be in str format. To ensure that
+                        * the data is null terminated, copy to a local buffer before use
+                        */
+                       cmd_buf = (char *)MALLOCZ(cfg->osh, cmd_buf_len);
+                       if (!cmd_buf) {
+                               WL_ERR(("memory alloc failed for %u \n", cmd_buf_len));
+                               err = -ENOMEM;
+                               goto exit;
+                       }
+
+                       /* Point to the start of command */
+                       if (memcpy_s(cmd_buf, (WL_DRIVER_PRIV_CMD_LEN - 1),
+                               (const void *)(cmd + cmd_offset),
+                               (cmd_len - cmd_offset - 1)) != BCME_OK) {
+                               WL_ERR(("memcpy failed for cmd buffer. len:%d\n", cmd_len));
+                               err = -ENOMEM;
+                               goto exit;
+                       }
+                       cmd_buf[WL_DRIVER_PRIV_CMD_LEN - 1] = '\0';
+
+                       WL_DBG(("vendor_command: %s len: %u \n", cmd_buf, cmd_buf_len));
+                       bytes_written = wl_handle_private_cmd(net, cmd_buf, cmd_buf_len);
+                       WL_DBG(("bytes_written: %d \n", bytes_written));
+                       if (bytes_written == 0) {
+                               snprintf(cmd_buf, cmd_buf_len, "%s", "OK");
+                               data_len = sizeof("OK");
+                       } else if (bytes_written > 0) {
+                               if (bytes_written >= (cmd_buf_len - 1)) {
+                                       /* Not expected */
+                                       ASSERT(0);
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               data_len = bytes_written;
+                       } else {
+                               /* -ve return value. Propagate the error back */
+                               err = bytes_written;
+                               goto exit;
+                       }
+                       if ((data_len > 0) && (data_len < (cmd_buf_len - 1)) && cmd_buf) {
+                               err =  wl_cfgvendor_send_cmd_reply(wiphy, cmd_buf, data_len);
+                               if (unlikely(err)) {
+                                       WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+                               } else {
+                                       WL_DBG(("Vendor Command reply sent successfully!\n"));
+                               }
+                       } else {
+                               /* No data to be sent back as reply */
+                               WL_ERR(("Vendor_cmd: No reply expected. data_len:%u cmd_buf %p \n",
+                                       data_len, cmd_buf));
+                       }
+                       break;
+               }
+#endif /* WL_ANDROID_PRIV_CMD_OVER_NL80211 && OEM_ANDROID */
+
+       }
+
+exit:
+
+#if defined(WL_ANDROID_PRIV_CMD_OVER_NL80211)
+       if (cmd_buf) {
+               MFREE(cfg->osh, cmd_buf, cmd_buf_len);
+       }
+#endif /* WL_ANDROID_PRIV_CMD_OVER_NL80211 && OEM_ANDROID */
+
+       net_os_wake_unlock(ndev);
+       return err;
+}
+#endif /* BCM_PRIV_CMD_SUPPORT */
+
+#ifdef WL_NAN
+static const char *
+nan_attr_to_str(u16 cmd)
+{
+       const char *id2str;
+
+       switch (cmd) {
+       C2S(NAN_ATTRIBUTE_HEADER);
+               break;
+       C2S(NAN_ATTRIBUTE_HANDLE);
+               break;
+       C2S(NAN_ATTRIBUTE_TRANSAC_ID);
+               break;
+       C2S(NAN_ATTRIBUTE_2G_SUPPORT);
+               break;
+       C2S(NAN_ATTRIBUTE_SDF_2G_SUPPORT);
+               break;
+       C2S(NAN_ATTRIBUTE_SDF_5G_SUPPORT);
+               break;
+       C2S(NAN_ATTRIBUTE_5G_SUPPORT);
+               break;
+       C2S(NAN_ATTRIBUTE_SYNC_DISC_2G_BEACON);
+               break;
+       C2S(NAN_ATTRIBUTE_SYNC_DISC_5G_BEACON);
+               break;
+       C2S(NAN_ATTRIBUTE_CLUSTER_LOW);
+               break;
+       C2S(NAN_ATTRIBUTE_CLUSTER_HIGH);
+               break;
+       C2S(NAN_ATTRIBUTE_SID_BEACON);
+               break;
+       C2S(NAN_ATTRIBUTE_RSSI_CLOSE);
+               break;
+       C2S(NAN_ATTRIBUTE_RSSI_MIDDLE);
+               break;
+       C2S(NAN_ATTRIBUTE_RSSI_PROXIMITY);
+               break;
+       C2S(NAN_ATTRIBUTE_RSSI_CLOSE_5G);
+               break;
+       C2S(NAN_ATTRIBUTE_RSSI_MIDDLE_5G);
+               break;
+       C2S(NAN_ATTRIBUTE_RSSI_PROXIMITY_5G);
+               break;
+       C2S(NAN_ATTRIBUTE_HOP_COUNT_LIMIT);
+               break;
+       C2S(NAN_ATTRIBUTE_RANDOM_TIME);
+               break;
+       C2S(NAN_ATTRIBUTE_MASTER_PREF);
+               break;
+       C2S(NAN_ATTRIBUTE_PERIODIC_SCAN_INTERVAL);
+               break;
+       C2S(NAN_ATTRIBUTE_PUBLISH_ID);
+               break;
+       C2S(NAN_ATTRIBUTE_TTL);
+               break;
+       C2S(NAN_ATTRIBUTE_PERIOD);
+               break;
+       C2S(NAN_ATTRIBUTE_REPLIED_EVENT_FLAG);
+               break;
+       C2S(NAN_ATTRIBUTE_PUBLISH_TYPE);
+               break;
+       C2S(NAN_ATTRIBUTE_TX_TYPE);
+               break;
+       C2S(NAN_ATTRIBUTE_PUBLISH_COUNT);
+               break;
+       C2S(NAN_ATTRIBUTE_SERVICE_NAME_LEN);
+               break;
+       C2S(NAN_ATTRIBUTE_SERVICE_NAME);
+               break;
+       C2S(NAN_ATTRIBUTE_SERVICE_SPECIFIC_INFO_LEN);
+               break;
+       C2S(NAN_ATTRIBUTE_SERVICE_SPECIFIC_INFO);
+               break;
+       C2S(NAN_ATTRIBUTE_RX_MATCH_FILTER_LEN);
+               break;
+       C2S(NAN_ATTRIBUTE_RX_MATCH_FILTER);
+               break;
+       C2S(NAN_ATTRIBUTE_TX_MATCH_FILTER_LEN);
+               break;
+       C2S(NAN_ATTRIBUTE_TX_MATCH_FILTER);
+               break;
+       C2S(NAN_ATTRIBUTE_SUBSCRIBE_ID);
+               break;
+       C2S(NAN_ATTRIBUTE_SUBSCRIBE_TYPE);
+               break;
+       C2S(NAN_ATTRIBUTE_SERVICERESPONSEFILTER);
+               break;
+       C2S(NAN_ATTRIBUTE_SERVICERESPONSEINCLUDE);
+               break;
+       C2S(NAN_ATTRIBUTE_USESERVICERESPONSEFILTER);
+               break;
+       C2S(NAN_ATTRIBUTE_SSIREQUIREDFORMATCHINDICATION);
+               break;
+       C2S(NAN_ATTRIBUTE_SUBSCRIBE_MATCH);
+               break;
+       C2S(NAN_ATTRIBUTE_SUBSCRIBE_COUNT);
+               break;
+       C2S(NAN_ATTRIBUTE_MAC_ADDR);
+               break;
+       C2S(NAN_ATTRIBUTE_MAC_ADDR_LIST);
+               break;
+       C2S(NAN_ATTRIBUTE_MAC_ADDR_LIST_NUM_ENTRIES);
+               break;
+       C2S(NAN_ATTRIBUTE_PUBLISH_MATCH);
+               break;
+       C2S(NAN_ATTRIBUTE_ENABLE_STATUS);
+               break;
+       C2S(NAN_ATTRIBUTE_JOIN_STATUS);
+               break;
+       C2S(NAN_ATTRIBUTE_ROLE);
+               break;
+       C2S(NAN_ATTRIBUTE_MASTER_RANK);
+               break;
+       C2S(NAN_ATTRIBUTE_ANCHOR_MASTER_RANK);
+               break;
+       C2S(NAN_ATTRIBUTE_CNT_PEND_TXFRM);
+               break;
+       C2S(NAN_ATTRIBUTE_CNT_BCN_TX);
+               break;
+       C2S(NAN_ATTRIBUTE_CNT_BCN_RX);
+               break;
+       C2S(NAN_ATTRIBUTE_CNT_SVC_DISC_TX);
+               break;
+       C2S(NAN_ATTRIBUTE_CNT_SVC_DISC_RX);
+               break;
+       C2S(NAN_ATTRIBUTE_AMBTT);
+               break;
+       C2S(NAN_ATTRIBUTE_CLUSTER_ID);
+               break;
+       C2S(NAN_ATTRIBUTE_INST_ID);
+               break;
+       C2S(NAN_ATTRIBUTE_OUI);
+               break;
+       C2S(NAN_ATTRIBUTE_STATUS);
+               break;
+       C2S(NAN_ATTRIBUTE_DE_EVENT_TYPE);
+               break;
+       C2S(NAN_ATTRIBUTE_MERGE);
+               break;
+       C2S(NAN_ATTRIBUTE_IFACE);
+               break;
+       C2S(NAN_ATTRIBUTE_CHANNEL);
+               break;
+       C2S(NAN_ATTRIBUTE_24G_CHANNEL);
+               break;
+       C2S(NAN_ATTRIBUTE_5G_CHANNEL);
+               break;
+       C2S(NAN_ATTRIBUTE_PEER_ID);
+               break;
+       C2S(NAN_ATTRIBUTE_NDP_ID);
+               break;
+       C2S(NAN_ATTRIBUTE_SECURITY);
+               break;
+       C2S(NAN_ATTRIBUTE_QOS);
+               break;
+       C2S(NAN_ATTRIBUTE_RSP_CODE);
+               break;
+       C2S(NAN_ATTRIBUTE_INST_COUNT);
+               break;
+       C2S(NAN_ATTRIBUTE_PEER_DISC_MAC_ADDR);
+               break;
+       C2S(NAN_ATTRIBUTE_PEER_NDI_MAC_ADDR);
+               break;
+       C2S(NAN_ATTRIBUTE_IF_ADDR);
+               break;
+       C2S(NAN_ATTRIBUTE_WARMUP_TIME);
+               break;
+       C2S(NAN_ATTRIBUTE_RECV_IND_CFG);
+               break;
+       C2S(NAN_ATTRIBUTE_CONNMAP);
+               break;
+       C2S(NAN_ATTRIBUTE_DWELL_TIME);
+               break;
+       C2S(NAN_ATTRIBUTE_SCAN_PERIOD);
+               break;
+       C2S(NAN_ATTRIBUTE_RSSI_WINDOW_SIZE);
+               break;
+       C2S(NAN_ATTRIBUTE_CONF_CLUSTER_VAL);
+               break;
+       C2S(NAN_ATTRIBUTE_CIPHER_SUITE_TYPE);
+               break;
+       C2S(NAN_ATTRIBUTE_KEY_TYPE);
+               break;
+       C2S(NAN_ATTRIBUTE_KEY_LEN);
+               break;
+       C2S(NAN_ATTRIBUTE_SCID);
+               break;
+       C2S(NAN_ATTRIBUTE_SCID_LEN);
+               break;
+       C2S(NAN_ATTRIBUTE_SDE_CONTROL_CONFIG_DP);
+               break;
+       C2S(NAN_ATTRIBUTE_SDE_CONTROL_SECURITY);
+               break;
+       C2S(NAN_ATTRIBUTE_SDE_CONTROL_DP_TYPE);
+               break;
+       C2S(NAN_ATTRIBUTE_SDE_CONTROL_RANGE_SUPPORT);
+               break;
+       C2S(NAN_ATTRIBUTE_NO_CONFIG_AVAIL);
+               break;
+       C2S(NAN_ATTRIBUTE_2G_AWAKE_DW);
+               break;
+       C2S(NAN_ATTRIBUTE_5G_AWAKE_DW);
+               break;
+       C2S(NAN_ATTRIBUTE_RSSI_THRESHOLD_FLAG);
+               break;
+       C2S(NAN_ATTRIBUTE_KEY_DATA);
+               break;
+       C2S(NAN_ATTRIBUTE_SDEA_SERVICE_SPECIFIC_INFO_LEN);
+               break;
+       C2S(NAN_ATTRIBUTE_SDEA_SERVICE_SPECIFIC_INFO);
+               break;
+       C2S(NAN_ATTRIBUTE_REASON);
+               break;
+       C2S(NAN_ATTRIBUTE_DISC_IND_CFG);
+               break;
+       C2S(NAN_ATTRIBUTE_DWELL_TIME_5G);
+               break;
+       C2S(NAN_ATTRIBUTE_SCAN_PERIOD_5G);
+               break;
+       C2S(NAN_ATTRIBUTE_SVC_RESPONDER_POLICY);
+               break;
+       C2S(NAN_ATTRIBUTE_EVENT_MASK);
+               break;
+       C2S(NAN_ATTRIBUTE_SUB_SID_BEACON);
+               break;
+       C2S(NAN_ATTRIBUTE_RANDOMIZATION_INTERVAL);
+               break;
+       C2S(NAN_ATTRIBUTE_CMD_RESP_DATA);
+               break;
+       C2S(NAN_ATTRIBUTE_CMD_USE_NDPE);
+               break;
+       C2S(NAN_ATTRIBUTE_ENABLE_MERGE);
+               break;
+       C2S(NAN_ATTRIBUTE_DISCOVERY_BEACON_INTERVAL);
+               break;
+       C2S(NAN_ATTRIBUTE_NSS);
+               break;
+       C2S(NAN_ATTRIBUTE_ENABLE_RANGING);
+               break;
+       C2S(NAN_ATTRIBUTE_DW_EARLY_TERM);
+               break;
+       default:
+               id2str = "NAN_ATTRIBUTE_UNKNOWN";
+       }
+
+       return id2str;
+}
+
+nan_hal_status_t nan_status_reasonstr_map[] = {
+       {NAN_STATUS_SUCCESS, "NAN status success"},
+       {NAN_STATUS_INTERNAL_FAILURE, "NAN Discovery engine failure"},
+       {NAN_STATUS_PROTOCOL_FAILURE, "protocol failure"},
+       {NAN_STATUS_INVALID_PUBLISH_SUBSCRIBE_ID, "invalid pub_sub ID"},
+       {NAN_STATUS_NO_RESOURCE_AVAILABLE, "No space available"},
+       {NAN_STATUS_INVALID_PARAM, "invalid param"},
+       {NAN_STATUS_INVALID_REQUESTOR_INSTANCE_ID, "invalid req inst id"},
+       {NAN_STATUS_INVALID_NDP_ID, "invalid ndp id"},
+       {NAN_STATUS_NAN_NOT_ALLOWED, "Nan not allowed"},
+       {NAN_STATUS_NO_OTA_ACK, "No OTA ack"},
+       {NAN_STATUS_ALREADY_ENABLED, "NAN is Already enabled"},
+       {NAN_STATUS_FOLLOWUP_QUEUE_FULL, "Follow-up queue full"},
+       {NAN_STATUS_UNSUPPORTED_CONCURRENCY_NAN_DISABLED, "unsupported concurrency"},
+};
+
+void
+wl_cfgvendor_add_nan_reason_str(nan_status_type_t status, nan_hal_resp_t *nan_req_resp)
+{
+       int i = 0;
+       int num = (int)(sizeof(nan_status_reasonstr_map)/sizeof(nan_status_reasonstr_map[0]));
+       for (i = 0; i < num; i++) {
+               if (nan_status_reasonstr_map[i].status == status) {
+                       strlcpy(nan_req_resp->nan_reason, nan_status_reasonstr_map[i].nan_reason,
+                               sizeof(nan_status_reasonstr_map[i].nan_reason));
+                       break;
+               }
+       }
+}
+
+nan_status_type_t
+wl_cfgvendor_brcm_to_nanhal_status(int32 vendor_status)
+{
+       nan_status_type_t hal_status;
+       switch (vendor_status) {
+               case BCME_OK:
+                       hal_status = NAN_STATUS_SUCCESS;
+                       break;
+               case BCME_BUSY:
+               case BCME_NOTREADY:
+                       hal_status = NAN_STATUS_NAN_NOT_ALLOWED;
+                       break;
+               case BCME_BADLEN:
+               case BCME_BADBAND:
+               case BCME_UNSUPPORTED:
+               case BCME_USAGE_ERROR:
+               case BCME_BADARG:
+                       hal_status = NAN_STATUS_INVALID_PARAM;
+                       break;
+               case BCME_NOMEM:
+               case BCME_NORESOURCE:
+               case WL_NAN_E_SVC_SUB_LIST_FULL:
+                       hal_status = NAN_STATUS_NO_RESOURCE_AVAILABLE;
+                       break;
+               case WL_NAN_E_SD_TX_LIST_FULL:
+                       hal_status = NAN_STATUS_FOLLOWUP_QUEUE_FULL;
+                       break;
+               case WL_NAN_E_BAD_INSTANCE:
+                       hal_status = NAN_STATUS_INVALID_PUBLISH_SUBSCRIBE_ID;
+                       break;
+               default:
+                       WL_ERR(("%s Unknown vendor status, status = %d\n",
+                                       __func__, vendor_status));
+                       /* Generic error */
+                       hal_status = NAN_STATUS_INTERNAL_FAILURE;
+       }
+       return hal_status;
+}
+
+static int
+wl_cfgvendor_nan_cmd_reply(struct wiphy *wiphy, int nan_cmd,
+       nan_hal_resp_t *nan_req_resp, int ret, int nan_cmd_status)
+{
+       int err;
+       int nan_reply;
+       nan_req_resp->subcmd = nan_cmd;
+       if (ret == BCME_OK) {
+               nan_reply = nan_cmd_status;
+       } else {
+               nan_reply = ret;
+       }
+       nan_req_resp->status = wl_cfgvendor_brcm_to_nanhal_status(nan_reply);
+       nan_req_resp->value = ret;
+       err = wl_cfgvendor_send_cmd_reply(wiphy, nan_req_resp,
+               sizeof(*nan_req_resp));
+       /* giving more prio to ret than err */
+       return (ret == 0) ? err : ret;
+}
+
+static void
+wl_cfgvendor_free_disc_cmd_data(struct bcm_cfg80211 *cfg,
+       nan_discover_cmd_data_t *cmd_data)
+{
+       if (!cmd_data) {
+               WL_ERR(("Cmd_data is null\n"));
+               return;
+       }
+       if (cmd_data->svc_info.data) {
+               MFREE(cfg->osh, cmd_data->svc_info.data, cmd_data->svc_info.dlen);
+       }
+       if (cmd_data->svc_hash.data) {
+               MFREE(cfg->osh, cmd_data->svc_hash.data, cmd_data->svc_hash.dlen);
+       }
+       if (cmd_data->rx_match.data) {
+               MFREE(cfg->osh, cmd_data->rx_match.data, cmd_data->rx_match.dlen);
+       }
+       if (cmd_data->tx_match.data) {
+               MFREE(cfg->osh, cmd_data->tx_match.data, cmd_data->tx_match.dlen);
+       }
+       if (cmd_data->mac_list.list) {
+               MFREE(cfg->osh, cmd_data->mac_list.list,
+                       cmd_data->mac_list.num_mac_addr * ETHER_ADDR_LEN);
+       }
+       if (cmd_data->key.data) {
+               MFREE(cfg->osh, cmd_data->key.data, NAN_MAX_PMK_LEN);
+       }
+       if (cmd_data->sde_svc_info.data) {
+               MFREE(cfg->osh, cmd_data->sde_svc_info.data, cmd_data->sde_svc_info.dlen);
+       }
+       MFREE(cfg->osh, cmd_data, sizeof(*cmd_data));
+}
+
+static void
+wl_cfgvendor_free_dp_cmd_data(struct bcm_cfg80211 *cfg,
+       nan_datapath_cmd_data_t *cmd_data)
+{
+       if (!cmd_data) {
+               WL_ERR(("Cmd_data is null\n"));
+               return;
+       }
+       if (cmd_data->svc_hash.data) {
+               MFREE(cfg->osh, cmd_data->svc_hash.data, cmd_data->svc_hash.dlen);
+       }
+       if (cmd_data->svc_info.data) {
+               MFREE(cfg->osh, cmd_data->svc_info.data, cmd_data->svc_info.dlen);
+       }
+       if (cmd_data->key.data) {
+               MFREE(cfg->osh, cmd_data->key.data, NAN_MAX_PMK_LEN);
+       }
+       MFREE(cfg->osh, cmd_data, sizeof(*cmd_data));
+}
+
+#define WL_NAN_EVENT_MAX_BUF 256
+#ifdef WL_NAN_DISC_CACHE
+static int
+wl_cfgvendor_nan_parse_dp_sec_info_args(struct wiphy *wiphy,
+       const void *buf, int len, nan_datapath_sec_info_cmd_data_t *cmd_data)
+{
+       int ret = BCME_OK;
+       int attr_type;
+       int rem = len;
+       const struct nlattr *iter;
+
+       NAN_DBG_ENTER();
+
+       nla_for_each_attr(iter, buf, len, rem) {
+               attr_type = nla_type(iter);
+               WL_TRACE(("attr: %s (%u)\n", nan_attr_to_str(attr_type), attr_type));
+
+               switch (attr_type) {
+               case NAN_ATTRIBUTE_MAC_ADDR:
+                       ret = memcpy_s((char*)&cmd_data->mac_addr, ETHER_ADDR_LEN,
+                               (char*)nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy mac addr\n"));
+                               return ret;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_PUBLISH_ID:
+                       cmd_data->pub_id = nla_get_u16(iter);
+                       break;
+               case NAN_ATTRIBUTE_NDP_ID:
+                       cmd_data->ndp_instance_id = nla_get_u32(iter);
+                       break;
+               default:
+                       WL_ERR(("%s: Unknown type, %d\n", __FUNCTION__, attr_type));
+                       ret = BCME_BADARG;
+                       break;
+               }
+       }
+       /* We need to call set_config_handler b/f calling start enable TBD */
+       NAN_DBG_EXIT();
+       return ret;
+}
+#endif /* WL_NAN_DISC_CACHE */
+
+int8 chanbuf[CHANSPEC_STR_LEN];
+static int
+wl_cfgvendor_nan_parse_datapath_args(struct wiphy *wiphy,
+       const void *buf, int len, nan_datapath_cmd_data_t *cmd_data)
+{
+       int ret = BCME_OK;
+       int attr_type;
+       int rem = len;
+       const struct nlattr *iter;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int chan;
+
+       NAN_DBG_ENTER();
+
+       nla_for_each_attr(iter, buf, len, rem) {
+               attr_type = nla_type(iter);
+               WL_TRACE(("attr: %s (%u)\n", nan_attr_to_str(attr_type), attr_type));
+
+               switch (attr_type) {
+               case NAN_ATTRIBUTE_NDP_ID:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->ndp_instance_id = nla_get_u32(iter);
+                       break;
+               case NAN_ATTRIBUTE_IFACE:
+                       if (nla_len(iter) >= sizeof(cmd_data->ndp_iface)) {
+                               WL_ERR(("iface_name len wrong:%d\n", nla_len(iter)));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       strlcpy((char *)cmd_data->ndp_iface, (char *)nla_data(iter),
+                               nla_len(iter));
+                       break;
+               case NAN_ATTRIBUTE_SECURITY:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->ndp_cfg.security_cfg = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_QOS:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->ndp_cfg.qos_cfg = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_RSP_CODE:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->rsp_code = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_INST_COUNT:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->num_ndp_instances = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_PEER_DISC_MAC_ADDR:
+                       if (nla_len(iter) != ETHER_ADDR_LEN) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       ret = memcpy_s((char*)&cmd_data->peer_disc_mac_addr,
+                               ETHER_ADDR_LEN, (char*)nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy peer_disc_mac_addr\n"));
+                               goto exit;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_PEER_NDI_MAC_ADDR:
+                       if (nla_len(iter) != ETHER_ADDR_LEN) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       ret = memcpy_s((char*)&cmd_data->peer_ndi_mac_addr,
+                               ETHER_ADDR_LEN, (char*)nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy peer_ndi_mac_addr\n"));
+                               goto exit;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_MAC_ADDR:
+                       if (nla_len(iter) != ETHER_ADDR_LEN) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       ret = memcpy_s((char*)&cmd_data->mac_addr, ETHER_ADDR_LEN,
+                                       (char*)nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy mac_addr\n"));
+                               goto exit;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_IF_ADDR:
+                       if (nla_len(iter) != ETHER_ADDR_LEN) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       ret = memcpy_s((char*)&cmd_data->if_addr, ETHER_ADDR_LEN,
+                                       (char*)nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy if_addr\n"));
+                               goto exit;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_ENTRY_CONTROL:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->avail_params.duration = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_AVAIL_BIT_MAP:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->avail_params.bmap = nla_get_u32(iter);
+                       break;
+               case NAN_ATTRIBUTE_CHANNEL: {
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       /* take the default channel start_factor frequency */
+                       chan = wf_mhz2channel((uint)nla_get_u32(iter), 0);
+                       if (chan <= CH_MAX_2G_CHANNEL) {
+                               cmd_data->avail_params.chanspec[0] =
+                                       wf_channel2chspec(chan, WL_CHANSPEC_BW_20);
+                       } else {
+                               cmd_data->avail_params.chanspec[0] =
+                                       wf_channel2chspec(chan, WL_CHANSPEC_BW_80);
+                       }
+                       if (cmd_data->avail_params.chanspec[0] == 0) {
+                               WL_ERR(("Channel is not valid \n"));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       WL_TRACE(("valid chanspec, chanspec = 0x%04x \n",
+                               cmd_data->avail_params.chanspec[0]));
+                       break;
+               }
+               case NAN_ATTRIBUTE_NO_CONFIG_AVAIL:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->avail_params.no_config_avail = (bool)nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_SERVICE_NAME_LEN: {
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->svc_hash.dlen) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->svc_hash.dlen = nla_get_u16(iter);
+                       if (cmd_data->svc_hash.dlen != WL_NAN_SVC_HASH_LEN) {
+                               WL_ERR(("invalid svc_hash length = %u\n", cmd_data->svc_hash.dlen));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       break;
+               }
+               case NAN_ATTRIBUTE_SERVICE_NAME:
+                       if ((!cmd_data->svc_hash.dlen) ||
+                               (nla_len(iter) != cmd_data->svc_hash.dlen)) {
+                               WL_ERR(("invalid svc_hash length = %d,%d\n",
+                                       cmd_data->svc_hash.dlen, nla_len(iter)));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->svc_hash.data) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->svc_hash.data =
+                               MALLOCZ(cfg->osh, cmd_data->svc_hash.dlen);
+                       if (!cmd_data->svc_hash.data) {
+                               WL_ERR(("failed to allocate svc_hash data, len=%d\n",
+                                       cmd_data->svc_hash.dlen));
+                               ret = -ENOMEM;
+                               goto exit;
+                       }
+                       ret = memcpy_s(cmd_data->svc_hash.data, cmd_data->svc_hash.dlen,
+                                       nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy svc hash data\n"));
+                               goto exit;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_SERVICE_SPECIFIC_INFO_LEN:
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->svc_info.dlen) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->svc_info.dlen = nla_get_u16(iter);
+                       if (cmd_data->svc_info.dlen > MAX_APP_INFO_LEN) {
+                               WL_ERR_RLMT(("Not allowed beyond :%d\n", MAX_APP_INFO_LEN));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_SERVICE_SPECIFIC_INFO:
+                       if ((!cmd_data->svc_info.dlen) ||
+                               (nla_len(iter) != cmd_data->svc_info.dlen)) {
+                               WL_ERR(("failed to allocate svc info by invalid len=%d,%d\n",
+                                       cmd_data->svc_info.dlen, nla_len(iter)));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->svc_info.data) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->svc_info.data = MALLOCZ(cfg->osh, cmd_data->svc_info.dlen);
+                       if (cmd_data->svc_info.data == NULL) {
+                               WL_ERR(("failed to allocate svc info data, len=%d\n",
+                                       cmd_data->svc_info.dlen));
+                               ret = -ENOMEM;
+                               goto exit;
+                       }
+                       ret = memcpy_s(cmd_data->svc_info.data, cmd_data->svc_info.dlen,
+                                       nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy svc info\n"));
+                               goto exit;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_PUBLISH_ID:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->pub_id = nla_get_u32(iter);
+                       break;
+               case NAN_ATTRIBUTE_CIPHER_SUITE_TYPE:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->csid = nla_get_u8(iter);
+                       WL_TRACE(("CSID = %u\n", cmd_data->csid));
+                       break;
+               case NAN_ATTRIBUTE_KEY_TYPE:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->key_type = nla_get_u8(iter);
+                       WL_TRACE(("Key Type = %u\n", cmd_data->key_type));
+                       break;
+               case NAN_ATTRIBUTE_KEY_LEN:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->key.dlen) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->key.dlen = nla_get_u32(iter);
+                       if ((!cmd_data->key.dlen) || (cmd_data->key.dlen > WL_NAN_NCS_SK_PMK_LEN)) {
+                               WL_ERR(("invalid key length = %u\n", cmd_data->key.dlen));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       WL_TRACE(("valid key length = %u\n", cmd_data->key.dlen));
+                       break;
+               case NAN_ATTRIBUTE_KEY_DATA:
+                       if ((!cmd_data->key.dlen) ||
+                               (nla_len(iter) != cmd_data->key.dlen)) {
+                               WL_ERR(("failed to allocate key data by invalid len=%d,%d\n",
+                                       cmd_data->key.dlen, nla_len(iter)));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->key.data) {
+                               WL_ERR(("trying to overwrite key data.\n"));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+
+                       cmd_data->key.data = MALLOCZ(cfg->osh, NAN_MAX_PMK_LEN);
+                       if (cmd_data->key.data == NULL) {
+                               WL_ERR(("failed to allocate key data, len=%d\n",
+                                       cmd_data->key.dlen));
+                               ret = -ENOMEM;
+                               goto exit;
+                       }
+                       ret = memcpy_s(cmd_data->key.data, NAN_MAX_PMK_LEN,
+                                       nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to key data\n"));
+                               goto exit;
+                       }
+                       break;
+
+               default:
+                       WL_ERR(("Unknown type, %d\n", attr_type));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+       }
+exit:
+       /* We need to call set_config_handler b/f calling start enable TBD */
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_parse_discover_args(struct wiphy *wiphy,
+       const void *buf, int len, nan_discover_cmd_data_t *cmd_data)
+{
+       int ret = BCME_OK;
+       int attr_type;
+       int rem = len;
+       const struct nlattr *iter;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       u8 val_u8;
+       u32 bit_flag;
+       u8 flag_match;
+
+       NAN_DBG_ENTER();
+
+       nla_for_each_attr(iter, buf, len, rem) {
+               attr_type = nla_type(iter);
+               WL_TRACE(("attr: %s (%u)\n", nan_attr_to_str(attr_type), attr_type));
+
+               switch (attr_type) {
+               case NAN_ATTRIBUTE_TRANSAC_ID:
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->token = nla_get_u16(iter);
+                       break;
+               case NAN_ATTRIBUTE_PERIODIC_SCAN_INTERVAL:
+                       break;
+
+               /* Nan Publish/Subscribe request Attributes */
+               case NAN_ATTRIBUTE_PUBLISH_ID:
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->pub_id = nla_get_u16(iter);
+                       cmd_data->local_id = cmd_data->pub_id;
+                       break;
+               case NAN_ATTRIBUTE_MAC_ADDR:
+                       if (nla_len(iter) != ETHER_ADDR_LEN) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       ret = memcpy_s((char*)&cmd_data->mac_addr, ETHER_ADDR_LEN,
+                                       (char*)nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy mac addr\n"));
+                               return ret;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_SERVICE_SPECIFIC_INFO_LEN:
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->svc_info.dlen) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->svc_info.dlen = nla_get_u16(iter);
+                       if (cmd_data->svc_info.dlen > NAN_MAX_SERVICE_SPECIFIC_INFO_LEN) {
+                               WL_ERR_RLMT(("Not allowed beyond :%d\n",
+                                       NAN_MAX_SERVICE_SPECIFIC_INFO_LEN));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_SERVICE_SPECIFIC_INFO:
+                       if ((!cmd_data->svc_info.dlen) ||
+                               (nla_len(iter) != cmd_data->svc_info.dlen)) {
+                               WL_ERR(("failed to allocate svc info by invalid len=%d,%d\n",
+                                       cmd_data->svc_info.dlen, nla_len(iter)));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->svc_info.data) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+
+                       cmd_data->svc_info.data = MALLOCZ(cfg->osh, cmd_data->svc_info.dlen);
+                       if (cmd_data->svc_info.data == NULL) {
+                               WL_ERR(("failed to allocate svc info data, len=%d\n",
+                                       cmd_data->svc_info.dlen));
+                               ret = -ENOMEM;
+                               goto exit;
+                       }
+                       ret = memcpy_s(cmd_data->svc_info.data, cmd_data->svc_info.dlen,
+                                       nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy svc info\n"));
+                               return ret;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_SUBSCRIBE_ID:
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->sub_id = nla_get_u16(iter);
+                       cmd_data->local_id = cmd_data->sub_id;
+                       break;
+               case NAN_ATTRIBUTE_SUBSCRIBE_TYPE:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->flags |= nla_get_u8(iter) ? WL_NAN_SUB_ACTIVE : 0;
+                       break;
+               case NAN_ATTRIBUTE_PUBLISH_COUNT:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->life_count = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_PUBLISH_TYPE: {
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       val_u8 = nla_get_u8(iter);
+                       if (val_u8 == 0) {
+                               cmd_data->flags |= WL_NAN_PUB_UNSOLICIT;
+                       } else if (val_u8 == 1) {
+                               cmd_data->flags |= WL_NAN_PUB_SOLICIT;
+                       } else {
+                               cmd_data->flags |= WL_NAN_PUB_BOTH;
+                       }
+                       break;
+               }
+               case NAN_ATTRIBUTE_PERIOD: {
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (nla_get_u16(iter) > NAN_MAX_AWAKE_DW_INTERVAL) {
+                               WL_ERR(("Invalid/Out of bound value = %u\n", nla_get_u16(iter)));
+                               ret = BCME_BADARG;
+                               break;
+                       }
+                       if (nla_get_u16(iter)) {
+                               cmd_data->period = 1 << (nla_get_u16(iter)-1);
+                       }
+                       break;
+               }
+               case NAN_ATTRIBUTE_REPLIED_EVENT_FLAG:
+                       break;
+               case NAN_ATTRIBUTE_TTL:
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->ttl = nla_get_u16(iter);
+                       break;
+               case NAN_ATTRIBUTE_SERVICE_NAME_LEN: {
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->svc_hash.dlen) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+
+                       cmd_data->svc_hash.dlen = nla_get_u16(iter);
+                       if (cmd_data->svc_hash.dlen != WL_NAN_SVC_HASH_LEN) {
+                               WL_ERR(("invalid svc_hash length = %u\n", cmd_data->svc_hash.dlen));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       break;
+               }
+               case NAN_ATTRIBUTE_SERVICE_NAME:
+                       if ((!cmd_data->svc_hash.dlen) ||
+                               (nla_len(iter) != cmd_data->svc_hash.dlen)) {
+                               WL_ERR(("invalid svc_hash length = %d,%d\n",
+                                       cmd_data->svc_hash.dlen, nla_len(iter)));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->svc_hash.data) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+
+                       cmd_data->svc_hash.data =
+                               MALLOCZ(cfg->osh, cmd_data->svc_hash.dlen);
+                       if (!cmd_data->svc_hash.data) {
+                               WL_ERR(("failed to allocate svc_hash data, len=%d\n",
+                                       cmd_data->svc_hash.dlen));
+                               ret = -ENOMEM;
+                               goto exit;
+                       }
+                       ret = memcpy_s(cmd_data->svc_hash.data, cmd_data->svc_hash.dlen,
+                                       nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy svc hash data\n"));
+                               return ret;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_PEER_ID:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->remote_id = nla_get_u32(iter);
+                       break;
+               case NAN_ATTRIBUTE_INST_ID:
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->local_id = nla_get_u16(iter);
+                       break;
+               case NAN_ATTRIBUTE_SUBSCRIBE_COUNT:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->life_count = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_SSIREQUIREDFORMATCHINDICATION: {
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       bit_flag = (u32)nla_get_u8(iter);
+                       cmd_data->flags |=
+                               bit_flag ? WL_NAN_SUB_MATCH_IF_SVC_INFO : 0;
+                       break;
+               }
+               case NAN_ATTRIBUTE_SUBSCRIBE_MATCH:
+               case NAN_ATTRIBUTE_PUBLISH_MATCH: {
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       flag_match = nla_get_u8(iter);
+
+                       switch (flag_match) {
+                       case NAN_MATCH_ALG_MATCH_CONTINUOUS:
+                               /* Default fw behaviour, no need to set explicitly */
+                               break;
+                       case NAN_MATCH_ALG_MATCH_ONCE:
+                               cmd_data->flags |= WL_NAN_MATCH_ONCE;
+                               break;
+                       case NAN_MATCH_ALG_MATCH_NEVER:
+                               cmd_data->flags |= WL_NAN_MATCH_NEVER;
+                               break;
+                       default:
+                               WL_ERR(("invalid nan match alg = %u\n", flag_match));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       break;
+               }
+               case NAN_ATTRIBUTE_SERVICERESPONSEFILTER:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->srf_type = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_SERVICERESPONSEINCLUDE:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->srf_include = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_USESERVICERESPONSEFILTER:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->use_srf = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_RX_MATCH_FILTER_LEN:
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->rx_match.dlen) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->rx_match.dlen = nla_get_u16(iter);
+                       if (cmd_data->rx_match.dlen > MAX_MATCH_FILTER_LEN) {
+                               ret = -EINVAL;
+                               WL_ERR_RLMT(("Not allowed beyond %d\n", MAX_MATCH_FILTER_LEN));
+                               goto exit;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_RX_MATCH_FILTER:
+                       if ((!cmd_data->rx_match.dlen) ||
+                           (nla_len(iter) != cmd_data->rx_match.dlen)) {
+                               WL_ERR(("RX match filter len wrong:%d,%d\n",
+                                       cmd_data->rx_match.dlen, nla_len(iter)));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->rx_match.data) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->rx_match.data =
+                               MALLOCZ(cfg->osh, cmd_data->rx_match.dlen);
+                       if (cmd_data->rx_match.data == NULL) {
+                               WL_ERR(("failed to allocate LEN=[%u]\n",
+                                       cmd_data->rx_match.dlen));
+                               ret = -ENOMEM;
+                               goto exit;
+                       }
+                       ret = memcpy_s(cmd_data->rx_match.data, cmd_data->rx_match.dlen,
+                                       nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy rx match data\n"));
+                               return ret;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_TX_MATCH_FILTER_LEN:
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->tx_match.dlen) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->tx_match.dlen = nla_get_u16(iter);
+                       if (cmd_data->tx_match.dlen > MAX_MATCH_FILTER_LEN) {
+                               ret = -EINVAL;
+                               WL_ERR_RLMT(("Not allowed beyond %d\n", MAX_MATCH_FILTER_LEN));
+                               goto exit;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_TX_MATCH_FILTER:
+                       if ((!cmd_data->tx_match.dlen) ||
+                           (nla_len(iter) != cmd_data->tx_match.dlen)) {
+                               WL_ERR(("TX match filter len wrong:%d,%d\n",
+                                       cmd_data->tx_match.dlen, nla_len(iter)));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->tx_match.data) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->tx_match.data =
+                               MALLOCZ(cfg->osh, cmd_data->tx_match.dlen);
+                       if (cmd_data->tx_match.data == NULL) {
+                               WL_ERR(("failed to allocate LEN=[%u]\n",
+                                       cmd_data->tx_match.dlen));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       ret = memcpy_s(cmd_data->tx_match.data, cmd_data->tx_match.dlen,
+                                       nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy tx match data\n"));
+                               return ret;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_MAC_ADDR_LIST_NUM_ENTRIES:
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->mac_list.num_mac_addr) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->mac_list.num_mac_addr = nla_get_u16(iter);
+                       break;
+               case NAN_ATTRIBUTE_MAC_ADDR_LIST:
+                       if ((!cmd_data->mac_list.num_mac_addr) ||
+                           (nla_len(iter) != (cmd_data->mac_list.num_mac_addr * ETHER_ADDR_LEN))) {
+                               WL_ERR(("wrong mac list len:%d,%d\n",
+                                       cmd_data->mac_list.num_mac_addr, nla_len(iter)));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->mac_list.list) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->mac_list.list =
+                               MALLOCZ(cfg->osh, (cmd_data->mac_list.num_mac_addr
+                                               * ETHER_ADDR_LEN));
+                       if (cmd_data->mac_list.list == NULL) {
+                               WL_ERR(("failed to allocate LEN=[%u]\n",
+                               (cmd_data->mac_list.num_mac_addr * ETHER_ADDR_LEN)));
+                               ret = -ENOMEM;
+                               goto exit;
+                       }
+                       ret = memcpy_s(cmd_data->mac_list.list,
+                               (cmd_data->mac_list.num_mac_addr * ETHER_ADDR_LEN),
+                               nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy list of mac addresses\n"));
+                               return ret;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_TX_TYPE:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       val_u8 =  nla_get_u8(iter);
+                       if (val_u8 == 0) {
+                               cmd_data->flags |= WL_NAN_PUB_BCAST;
+                               WL_TRACE(("NAN_ATTRIBUTE_TX_TYPE: flags=NAN_PUB_BCAST\n"));
+                       }
+                       break;
+               case NAN_ATTRIBUTE_SDE_CONTROL_CONFIG_DP:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (nla_get_u8(iter) == 1) {
+                               cmd_data->sde_control_flag
+                                       |= NAN_SDE_CF_DP_REQUIRED;
+                               break;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_SDE_CONTROL_RANGE_SUPPORT:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->sde_control_config = TRUE;
+                       if (nla_get_u8(iter) == 1) {
+                               cmd_data->sde_control_flag
+                                       |= NAN_SDE_CF_RANGING_REQUIRED;
+                               break;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_SDE_CONTROL_DP_TYPE:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (nla_get_u8(iter) == 1) {
+                               cmd_data->sde_control_flag
+                                       |= NAN_SDE_CF_MULTICAST_TYPE;
+                               break;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_SDE_CONTROL_SECURITY:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (nla_get_u8(iter) == 1) {
+                               cmd_data->sde_control_flag
+                                       |= NAN_SDE_CF_SECURITY_REQUIRED;
+                               break;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_RECV_IND_CFG:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->recv_ind_flag = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_CIPHER_SUITE_TYPE:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->csid = nla_get_u8(iter);
+                       WL_TRACE(("CSID = %u\n", cmd_data->csid));
+                       break;
+               case NAN_ATTRIBUTE_KEY_TYPE:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->key_type = nla_get_u8(iter);
+                       WL_TRACE(("Key Type = %u\n", cmd_data->key_type));
+                       break;
+               case NAN_ATTRIBUTE_KEY_LEN:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->key.dlen) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->key.dlen = nla_get_u32(iter);
+                       if ((!cmd_data->key.dlen) || (cmd_data->key.dlen > WL_NAN_NCS_SK_PMK_LEN)) {
+                               WL_ERR(("invalid key length = %u\n",
+                                       cmd_data->key.dlen));
+                               break;
+                       }
+                       WL_TRACE(("valid key length = %u\n", cmd_data->key.dlen));
+                       break;
+               case NAN_ATTRIBUTE_KEY_DATA:
+                       if (!cmd_data->key.dlen ||
+                           (nla_len(iter) != cmd_data->key.dlen)) {
+                               WL_ERR(("failed to allocate key data by invalid len=%d,%d\n",
+                                       cmd_data->key.dlen, nla_len(iter)));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->key.data) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+
+                       cmd_data->key.data = MALLOCZ(cfg->osh, NAN_MAX_PMK_LEN);
+                       if (cmd_data->key.data == NULL) {
+                               WL_ERR(("failed to allocate key data, len=%d\n",
+                                       cmd_data->key.dlen));
+                               ret = -ENOMEM;
+                               goto exit;
+                       }
+                       ret = memcpy_s(cmd_data->key.data, NAN_MAX_PMK_LEN,
+                                       nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to key data\n"));
+                               return ret;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_RSSI_THRESHOLD_FLAG:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (nla_get_u8(iter) == 1) {
+                               cmd_data->flags |=
+                                       WL_NAN_RANGE_LIMITED;
+                               break;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_DISC_IND_CFG:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->disc_ind_cfg = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_SDEA_SERVICE_SPECIFIC_INFO_LEN:
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->sde_svc_info.dlen) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->sde_svc_info.dlen = nla_get_u16(iter);
+                       if (cmd_data->sde_svc_info.dlen > MAX_SDEA_SVC_INFO_LEN) {
+                               ret = -EINVAL;
+                               WL_ERR_RLMT(("Not allowed beyond %d\n", MAX_SDEA_SVC_INFO_LEN));
+                               goto exit;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_SDEA_SERVICE_SPECIFIC_INFO:
+                       if ((!cmd_data->sde_svc_info.dlen) ||
+                           (nla_len(iter) != cmd_data->sde_svc_info.dlen)) {
+                               WL_ERR(("wrong sdea info len:%d,%d\n",
+                                       cmd_data->sde_svc_info.dlen, nla_len(iter)));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->sde_svc_info.data) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->sde_svc_info.data = MALLOCZ(cfg->osh,
+                               cmd_data->sde_svc_info.dlen);
+                       if (cmd_data->sde_svc_info.data == NULL) {
+                               WL_ERR(("failed to allocate svc info data, len=%d\n",
+                                       cmd_data->sde_svc_info.dlen));
+                               ret = -ENOMEM;
+                               goto exit;
+                       }
+                       ret = memcpy_s(cmd_data->sde_svc_info.data,
+                                       cmd_data->sde_svc_info.dlen,
+                                       nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to sdea info data\n"));
+                               return ret;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_SECURITY:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->ndp_cfg.security_cfg = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_RANGING_INTERVAL:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->ranging_intvl_msec = nla_get_u32(iter);
+                       break;
+               case NAN_ATTRIBUTE_RANGING_INGRESS_LIMIT:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->ingress_limit = nla_get_u32(iter);
+                       break;
+               case NAN_ATTRIBUTE_RANGING_EGRESS_LIMIT:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->egress_limit = nla_get_u32(iter);
+                       break;
+               case NAN_ATTRIBUTE_RANGING_INDICATION:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->ranging_indication = nla_get_u32(iter);
+                       break;
+               /* Nan accept policy: Per service basis policy
+                * Based on this policy(ALL/NONE), responder side
+                * will send ACCEPT/REJECT
+                */
+               case NAN_ATTRIBUTE_SVC_RESPONDER_POLICY:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->service_responder_policy = nla_get_u8(iter);
+                       break;
+               default:
+                       WL_ERR(("Unknown type, %d\n", attr_type));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+       }
+exit:
+       /* We need to call set_config_handler b/f calling start enable TBD */
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_parse_args(struct wiphy *wiphy, const void *buf,
+       int len, nan_config_cmd_data_t *cmd_data, uint32 *nan_attr_mask)
+{
+       int ret = BCME_OK;
+       int attr_type;
+       int rem = len;
+       const struct nlattr *iter;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int chan;
+       u8 sid_beacon = 0, sub_sid_beacon = 0;
+
+       NAN_DBG_ENTER();
+
+       nla_for_each_attr(iter, buf, len, rem) {
+               attr_type = nla_type(iter);
+               WL_TRACE(("attr: %s (%u)\n", nan_attr_to_str(attr_type), attr_type));
+
+               switch (attr_type) {
+               /* NAN Enable request attributes */
+               case NAN_ATTRIBUTE_2G_SUPPORT:{
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->support_2g = nla_get_u8(iter);
+                       *nan_attr_mask |= NAN_ATTR_SUPPORT_2G_CONFIG;
+                       break;
+               }
+               case NAN_ATTRIBUTE_5G_SUPPORT:{
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->support_5g = nla_get_u8(iter);
+                       *nan_attr_mask |= NAN_ATTR_SUPPORT_5G_CONFIG;
+                       break;
+               }
+               case NAN_ATTRIBUTE_CLUSTER_LOW: {
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->cluster_low = nla_get_u16(iter);
+                       break;
+               }
+               case NAN_ATTRIBUTE_CLUSTER_HIGH: {
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->cluster_high = nla_get_u16(iter);
+                       break;
+               }
+               case NAN_ATTRIBUTE_SID_BEACON: {
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       sid_beacon = nla_get_u8(iter);
+                       cmd_data->sid_beacon.sid_enable = (sid_beacon & 0x01);
+                       if (cmd_data->sid_beacon.sid_enable) {
+                               cmd_data->sid_beacon.sid_count = (sid_beacon >> 1);
+                               *nan_attr_mask |= NAN_ATTR_SID_BEACON_CONFIG;
+                       }
+                       break;
+               }
+               case NAN_ATTRIBUTE_SUB_SID_BEACON: {
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       sub_sid_beacon = nla_get_u8(iter);
+                       cmd_data->sid_beacon.sub_sid_enable = (sub_sid_beacon & 0x01);
+                       if (cmd_data->sid_beacon.sub_sid_enable) {
+                               cmd_data->sid_beacon.sub_sid_count = (sub_sid_beacon >> 1);
+                               *nan_attr_mask |= NAN_ATTR_SUB_SID_BEACON_CONFIG;
+                       }
+                       break;
+               }
+               case NAN_ATTRIBUTE_SYNC_DISC_2G_BEACON:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->beacon_2g_val = nla_get_u8(iter);
+                       *nan_attr_mask |= NAN_ATTR_SYNC_DISC_2G_BEACON_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_SYNC_DISC_5G_BEACON:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->beacon_5g_val = nla_get_u8(iter);
+                       *nan_attr_mask |= NAN_ATTR_SYNC_DISC_5G_BEACON_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_SDF_2G_SUPPORT:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->sdf_2g_val = nla_get_u8(iter);
+                       *nan_attr_mask |= NAN_ATTR_SDF_2G_SUPPORT_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_SDF_5G_SUPPORT:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->sdf_5g_val = nla_get_u8(iter);
+                       *nan_attr_mask |= NAN_ATTR_SDF_5G_SUPPORT_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_HOP_COUNT_LIMIT:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->hop_count_limit = nla_get_u8(iter);
+                       *nan_attr_mask |= NAN_ATTR_HOP_COUNT_LIMIT_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_RANDOM_TIME:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->metrics.random_factor = nla_get_u8(iter);
+                       *nan_attr_mask |= NAN_ATTR_RAND_FACTOR_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_MASTER_PREF:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->metrics.master_pref = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_OUI:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->nan_oui = nla_get_u32(iter);
+                       *nan_attr_mask |= NAN_ATTR_OUI_CONFIG;
+                       WL_TRACE(("nan_oui=%d\n", cmd_data->nan_oui));
+                       break;
+               case NAN_ATTRIBUTE_WARMUP_TIME:
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->warmup_time = nla_get_u16(iter);
+                       break;
+               case NAN_ATTRIBUTE_AMBTT:
+               case NAN_ATTRIBUTE_MASTER_RANK:
+                       WL_DBG(("Unhandled attribute, %d\n", attr_type));
+                       break;
+               case NAN_ATTRIBUTE_CHANNEL: {
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       /* take the default channel start_factor frequency */
+                       chan = wf_mhz2channel((uint)nla_get_u32(iter), 0);
+                       if (chan <= CH_MAX_2G_CHANNEL) {
+                               cmd_data->chanspec[0] = wf_channel2chspec(chan, WL_CHANSPEC_BW_20);
+                       } else {
+                               cmd_data->chanspec[0] = wf_channel2chspec(chan, WL_CHANSPEC_BW_80);
+                       }
+                       if (cmd_data->chanspec[0] == 0) {
+                               WL_ERR(("Channel is not valid \n"));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       WL_TRACE(("valid chanspec, chanspec = 0x%04x \n",
+                               cmd_data->chanspec[0]));
+                       break;
+               }
+               case NAN_ATTRIBUTE_24G_CHANNEL: {
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       /* take the default channel start_factor frequency */
+                       chan = wf_mhz2channel((uint)nla_get_u32(iter), 0);
+                       /* 20MHz as BW */
+                       cmd_data->chanspec[1] = wf_channel2chspec(chan, WL_CHANSPEC_BW_20);
+                       if (cmd_data->chanspec[1] == 0) {
+                               WL_ERR((" 2.4GHz Channel is not valid \n"));
+                               ret = -EINVAL;
+                               break;
+                       }
+                       *nan_attr_mask |= NAN_ATTR_2G_CHAN_CONFIG;
+                       WL_TRACE(("valid 2.4GHz chanspec, chanspec = 0x%04x \n",
+                               cmd_data->chanspec[1]));
+                       break;
+               }
+               case NAN_ATTRIBUTE_5G_CHANNEL: {
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       /* take the default channel start_factor frequency */
+                       chan = wf_mhz2channel((uint)nla_get_u32(iter), 0);
+                       /* 20MHz as BW */
+                       cmd_data->chanspec[2] = wf_channel2chspec(chan, WL_CHANSPEC_BW_20);
+                       if (cmd_data->chanspec[2] == 0) {
+                               WL_ERR((" 5GHz Channel is not valid \n"));
+                               ret = -EINVAL;
+                               break;
+                       }
+                       *nan_attr_mask |= NAN_ATTR_5G_CHAN_CONFIG;
+                       WL_TRACE(("valid 5GHz chanspec, chanspec = 0x%04x \n",
+                               cmd_data->chanspec[2]));
+                       break;
+               }
+               case NAN_ATTRIBUTE_CONF_CLUSTER_VAL:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->config_cluster_val = nla_get_u8(iter);
+                       *nan_attr_mask |= NAN_ATTR_CLUSTER_VAL_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_DWELL_TIME:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->dwell_time[0] = nla_get_u8(iter);
+                       *nan_attr_mask |= NAN_ATTR_2G_DWELL_TIME_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_SCAN_PERIOD:
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->scan_period[0] = nla_get_u16(iter);
+                       *nan_attr_mask |= NAN_ATTR_2G_SCAN_PERIOD_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_DWELL_TIME_5G:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->dwell_time[1] = nla_get_u8(iter);
+                       *nan_attr_mask |= NAN_ATTR_5G_DWELL_TIME_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_SCAN_PERIOD_5G:
+                       if (nla_len(iter) != sizeof(uint16)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->scan_period[1] = nla_get_u16(iter);
+                       *nan_attr_mask |= NAN_ATTR_5G_SCAN_PERIOD_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_AVAIL_BIT_MAP:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->bmap = nla_get_u32(iter);
+                       break;
+               case NAN_ATTRIBUTE_ENTRY_CONTROL:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->avail_params.duration = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_RSSI_CLOSE:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->rssi_attr.rssi_close_2dot4g_val = nla_get_s8(iter);
+                       *nan_attr_mask |= NAN_ATTR_RSSI_CLOSE_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_RSSI_MIDDLE:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->rssi_attr.rssi_middle_2dot4g_val = nla_get_s8(iter);
+                       *nan_attr_mask |= NAN_ATTR_RSSI_MIDDLE_2G_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_RSSI_PROXIMITY:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->rssi_attr.rssi_proximity_2dot4g_val = nla_get_s8(iter);
+                       *nan_attr_mask |= NAN_ATTR_RSSI_PROXIMITY_2G_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_RSSI_CLOSE_5G:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->rssi_attr.rssi_close_5g_val = nla_get_s8(iter);
+                       *nan_attr_mask |= NAN_ATTR_RSSI_CLOSE_5G_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_RSSI_MIDDLE_5G:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->rssi_attr.rssi_middle_5g_val = nla_get_s8(iter);
+                       *nan_attr_mask |= NAN_ATTR_RSSI_MIDDLE_5G_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_RSSI_PROXIMITY_5G:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->rssi_attr.rssi_proximity_5g_val = nla_get_s8(iter);
+                       *nan_attr_mask |= NAN_ATTR_RSSI_PROXIMITY_5G_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_RSSI_WINDOW_SIZE:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->rssi_attr.rssi_window_size = nla_get_u8(iter);
+                       *nan_attr_mask |= NAN_ATTR_RSSI_WINDOW_SIZE_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_CIPHER_SUITE_TYPE:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->csid = nla_get_u8(iter);
+                       WL_TRACE(("CSID = %u\n", cmd_data->csid));
+                       break;
+               case NAN_ATTRIBUTE_SCID_LEN:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->scid.dlen) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->scid.dlen = nla_get_u32(iter);
+                       if (cmd_data->scid.dlen > MAX_SCID_LEN) {
+                               ret = -EINVAL;
+                               WL_ERR_RLMT(("Not allowed beyond %d\n", MAX_SCID_LEN));
+                               goto exit;
+                       }
+                       WL_TRACE(("valid scid length = %u\n", cmd_data->scid.dlen));
+                       break;
+               case NAN_ATTRIBUTE_SCID:
+                       if (!cmd_data->scid.dlen || (nla_len(iter) != cmd_data->scid.dlen)) {
+                               WL_ERR(("wrong scid len:%d,%d\n", cmd_data->scid.dlen,
+                                       nla_len(iter)));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (cmd_data->scid.data) {
+                               WL_ERR(("trying to overwrite:%d\n", attr_type));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+
+                       cmd_data->scid.data = MALLOCZ(cfg->osh, cmd_data->scid.dlen);
+                       if (cmd_data->scid.data == NULL) {
+                               WL_ERR(("failed to allocate scid, len=%d\n",
+                                       cmd_data->scid.dlen));
+                               ret = -ENOMEM;
+                               goto exit;
+                       }
+                       ret = memcpy_s(cmd_data->scid.data, cmd_data->scid.dlen,
+                                       nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to scid data\n"));
+                               return ret;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_2G_AWAKE_DW:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (nla_get_u32(iter) > NAN_MAX_AWAKE_DW_INTERVAL) {
+                               WL_ERR(("%s: Invalid/Out of bound value = %u\n",
+                                               __FUNCTION__, nla_get_u32(iter)));
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (nla_get_u32(iter)) {
+                               cmd_data->awake_dws.dw_interval_2g =
+                                       1 << (nla_get_u32(iter)-1);
+                       }
+                       *nan_attr_mask |= NAN_ATTR_2G_DW_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_5G_AWAKE_DW:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       if (nla_get_u32(iter) > NAN_MAX_AWAKE_DW_INTERVAL) {
+                               WL_ERR(("%s: Invalid/Out of bound value = %u\n",
+                                               __FUNCTION__, nla_get_u32(iter)));
+                               ret = BCME_BADARG;
+                               break;
+                       }
+                       if (nla_get_u32(iter)) {
+                               cmd_data->awake_dws.dw_interval_5g =
+                                       1 << (nla_get_u32(iter)-1);
+                       }
+                       *nan_attr_mask |= NAN_ATTR_5G_DW_CONFIG;
+                       break;
+               case NAN_ATTRIBUTE_DISC_IND_CFG:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->disc_ind_cfg = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_MAC_ADDR:
+                       if (nla_len(iter) != ETHER_ADDR_LEN) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       ret = memcpy_s((char*)&cmd_data->mac_addr, ETHER_ADDR_LEN,
+                                       (char*)nla_data(iter), nla_len(iter));
+                       if (ret != BCME_OK) {
+                               WL_ERR(("Failed to copy mac addr\n"));
+                               return ret;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_RANDOMIZATION_INTERVAL:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       /* run time nmi rand not supported as of now.
+                       * Only during nan enable/iface-create rand mac is used
+                       */
+                       cmd_data->nmi_rand_intvl = nla_get_u32(iter);
+                       if (cmd_data->nmi_rand_intvl > 0) {
+                               cfg->nancfg->mac_rand = true;
+                       } else {
+                               cfg->nancfg->mac_rand = false;
+                       }
+                       break;
+               case NAN_ATTRIBUTE_CMD_USE_NDPE:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->use_ndpe_attr = nla_get_u32(iter);
+                       break;
+               case NAN_ATTRIBUTE_ENABLE_MERGE:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->enable_merge = nla_get_u8(iter);
+                       break;
+               case NAN_ATTRIBUTE_DISCOVERY_BEACON_INTERVAL:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->disc_bcn_interval = nla_get_u32(iter);
+                       *nan_attr_mask |= NAN_ATTR_DISC_BEACON_INTERVAL;
+                       break;
+               case NAN_ATTRIBUTE_NSS:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       /* FW handles it internally,
+                       * nothing to do as per the value rxed from framework, ignore.
+                       */
+                       break;
+               case NAN_ATTRIBUTE_ENABLE_RANGING:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cfg->nancfg->ranging_enable = nla_get_u32(iter);
+                       break;
+               case NAN_ATTRIBUTE_DW_EARLY_TERM:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               ret = -EINVAL;
+                               goto exit;
+                       }
+                       cmd_data->dw_early_termination = nla_get_u32(iter);
+                       break;
+               default:
+                       WL_ERR(("%s: Unknown type, %d\n", __FUNCTION__, attr_type));
+                       ret = -EINVAL;
+                       goto exit;
+               }
+       }
+
+exit:
+       /* We need to call set_config_handler b/f calling start enable TBD */
+       NAN_DBG_EXIT();
+       if (ret) {
+               WL_ERR(("%s: Failed to parse attribute %d ret %d",
+                       __FUNCTION__, attr_type, ret));
+       }
+       return ret;
+
+}
+
+static int
+wl_cfgvendor_nan_dp_estb_event_data_filler(struct sk_buff *msg,
+       nan_event_data_t *event_data) {
+       int ret = BCME_OK;
+       ret = nla_put_u32(msg, NAN_ATTRIBUTE_NDP_ID, event_data->ndp_id);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put NDP ID, ret=%d\n", ret));
+               goto fail;
+       }
+       /*
+        * NDI mac address of the peer
+        * (required to derive target ipv6 address)
+        */
+       ret = nla_put(msg, NAN_ATTRIBUTE_PEER_NDI_MAC_ADDR, ETH_ALEN,
+                       event_data->responder_ndi.octet);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put resp ndi, ret=%d\n", ret));
+               goto fail;
+       }
+       ret = nla_put_u8(msg, NAN_ATTRIBUTE_RSP_CODE, event_data->status);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put response code, ret=%d\n", ret));
+               goto fail;
+       }
+       if (event_data->svc_info.dlen && event_data->svc_info.data) {
+               ret = nla_put_u16(msg, NAN_ATTRIBUTE_SERVICE_SPECIFIC_INFO_LEN,
+                               event_data->svc_info.dlen);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put svc info len, ret=%d\n", ret));
+                       goto fail;
+               }
+               ret = nla_put(msg, NAN_ATTRIBUTE_SERVICE_SPECIFIC_INFO,
+                               event_data->svc_info.dlen, event_data->svc_info.data);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put svc info, ret=%d\n", ret));
+                       goto fail;
+               }
+       }
+
+fail:
+       return ret;
+}
+static int
+wl_cfgvendor_nan_dp_ind_event_data_filler(struct sk_buff *msg,
+               nan_event_data_t *event_data) {
+       int ret = BCME_OK;
+
+       ret = nla_put_u16(msg, NAN_ATTRIBUTE_PUBLISH_ID,
+                       event_data->pub_id);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put pub ID, ret=%d\n", ret));
+               goto fail;
+       }
+       ret = nla_put_u32(msg, NAN_ATTRIBUTE_NDP_ID, event_data->ndp_id);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put NDP ID, ret=%d\n", ret));
+               goto fail;
+       }
+       /* Discovery MAC addr of the peer/initiator */
+       ret = nla_put(msg, NAN_ATTRIBUTE_MAC_ADDR, ETH_ALEN,
+                       event_data->remote_nmi.octet);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put remote NMI, ret=%d\n", ret));
+               goto fail;
+       }
+       ret = nla_put_u8(msg, NAN_ATTRIBUTE_SECURITY, event_data->security);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put security, ret=%d\n", ret));
+               goto fail;
+       }
+       if (event_data->svc_info.dlen && event_data->svc_info.data) {
+               ret = nla_put_u16(msg, NAN_ATTRIBUTE_SERVICE_SPECIFIC_INFO_LEN,
+                               event_data->svc_info.dlen);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put svc info len, ret=%d\n", ret));
+                       goto fail;
+               }
+               ret = nla_put(msg, NAN_ATTRIBUTE_SERVICE_SPECIFIC_INFO,
+                               event_data->svc_info.dlen, event_data->svc_info.data);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put svc info, ret=%d\n", ret));
+                       goto fail;
+               }
+       }
+
+fail:
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_tx_followup_ind_event_data_filler(struct sk_buff *msg,
+       nan_event_data_t *event_data) {
+       int ret = BCME_OK;
+       ret = nla_put_u16(msg, NAN_ATTRIBUTE_TRANSAC_ID, event_data->token);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put transaction id, ret=%d\n", ret));
+               goto fail;
+       }
+       ret = nla_put_u8(msg, NAN_ATTRIBUTE_HANDLE, event_data->local_inst_id);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put handle, ret=%d\n", ret));
+               goto fail;
+       }
+       ret = nla_put_u16(msg, NAN_ATTRIBUTE_STATUS, event_data->status);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put nan status, ret=%d\n", ret));
+               goto fail;
+       }
+       if (event_data->status == NAN_STATUS_SUCCESS) {
+               ret = nla_put(msg, NAN_ATTRIBUTE_REASON,
+                               strlen("NAN_STATUS_SUCCESS"), event_data->nan_reason);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put nan reason, ret=%d\n", ret));
+                       goto fail;
+               }
+       } else {
+               ret = nla_put(msg, NAN_ATTRIBUTE_REASON,
+                               strlen("NAN_STATUS_NO_OTA_ACK"), event_data->nan_reason);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put nan reason, ret=%d\n", ret));
+                       goto fail;
+               }
+       }
+fail:
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_svc_terminate_event_filler(struct sk_buff *msg,
+       struct bcm_cfg80211 *cfg, int event_id, nan_event_data_t *event_data) {
+       int ret = BCME_OK;
+       ret = nla_put_u8(msg, NAN_ATTRIBUTE_HANDLE, event_data->local_inst_id);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put handle, ret=%d\n", ret));
+               goto fail;
+       }
+
+       if (event_id == GOOGLE_NAN_EVENT_SUBSCRIBE_TERMINATED) {
+               ret = nla_put_u16(msg, NAN_ATTRIBUTE_SUBSCRIBE_ID,
+                               event_data->local_inst_id);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put local inst id, ret=%d\n", ret));
+                       goto fail;
+               }
+       } else {
+               ret = nla_put_u16(msg, NAN_ATTRIBUTE_PUBLISH_ID,
+                               event_data->local_inst_id);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put local inst id, ret=%d\n", ret));
+                       goto fail;
+               }
+       }
+       ret = nla_put_u16(msg, NAN_ATTRIBUTE_STATUS, event_data->status);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put status, ret=%d\n", ret));
+               goto fail;
+       }
+       if (event_data->status == NAN_STATUS_SUCCESS) {
+               ret = nla_put(msg, NAN_ATTRIBUTE_REASON,
+                               strlen("NAN_STATUS_SUCCESS"), event_data->nan_reason);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put nan reason, ret=%d\n", ret));
+                       goto fail;
+               }
+       } else {
+               ret = nla_put(msg, NAN_ATTRIBUTE_REASON,
+                               strlen("NAN_STATUS_INTERNAL_FAILURE"), event_data->nan_reason);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put nan reason, ret=%d\n", ret));
+                       goto fail;
+               }
+       }
+
+       ret = wl_cfgnan_remove_inst_id(cfg, event_data->local_inst_id);
+       if (ret) {
+               WL_ERR(("failed to free svc instance-id[%d], ret=%d, event_id = %d\n",
+                               event_data->local_inst_id, ret, event_id));
+               goto fail;
+       }
+fail:
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_opt_params_filler(struct sk_buff *msg,
+       nan_event_data_t *event_data) {
+       int ret = BCME_OK;
+       /* service specific info data */
+       if (event_data->svc_info.dlen && event_data->svc_info.data) {
+               ret = nla_put_u16(msg, NAN_ATTRIBUTE_SERVICE_SPECIFIC_INFO_LEN,
+                               event_data->svc_info.dlen);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put svc info len, ret=%d\n", ret));
+                       goto fail;
+               }
+               ret = nla_put(msg, NAN_ATTRIBUTE_SERVICE_SPECIFIC_INFO,
+                               event_data->svc_info.dlen, event_data->svc_info.data);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put svc info, ret=%d\n", ret));
+                       goto fail;
+               }
+               WL_TRACE(("svc info len = %d\n", event_data->svc_info.dlen));
+       }
+
+       /* sdea service specific info data */
+       if (event_data->sde_svc_info.dlen && event_data->sde_svc_info.data) {
+               ret = nla_put_u16(msg, NAN_ATTRIBUTE_SDEA_SERVICE_SPECIFIC_INFO_LEN,
+                               event_data->sde_svc_info.dlen);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put sdea svc info len, ret=%d\n", ret));
+                       goto fail;
+               }
+               ret = nla_put(msg, NAN_ATTRIBUTE_SDEA_SERVICE_SPECIFIC_INFO,
+                               event_data->sde_svc_info.dlen,
+                               event_data->sde_svc_info.data);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put sdea svc info, ret=%d\n", ret));
+                       goto fail;
+               }
+               WL_TRACE(("sdea svc info len = %d\n", event_data->sde_svc_info.dlen));
+       }
+       /* service control discovery range limit */
+       /* TODO: */
+
+       /* service control binding bitmap */
+       /* TODO: */
+fail:
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_tx_followup_event_filler(struct sk_buff *msg,
+               nan_event_data_t *event_data) {
+       int ret = BCME_OK;
+       /* In followup pkt, instance id and requestor instance id are configured
+        * from the transmitter perspective. As the event is processed with the
+        * role of receiver, the local handle should use requestor instance
+        * id (peer_inst_id)
+        */
+       WL_TRACE(("handle=%d\n", event_data->requestor_id));
+       WL_TRACE(("inst id (local id)=%d\n", event_data->local_inst_id));
+       WL_TRACE(("peer id (remote id)=%d\n", event_data->requestor_id));
+       WL_TRACE(("peer mac addr=" MACDBG "\n",
+                       MAC2STRDBG(event_data->remote_nmi.octet)));
+       WL_TRACE(("peer rssi: %d\n", event_data->fup_rssi));
+       WL_TRACE(("attribute no: %d\n", event_data->attr_num));
+       WL_TRACE(("attribute len: %d\n", event_data->attr_list_len));
+
+       ret = nla_put_u8(msg, NAN_ATTRIBUTE_HANDLE, event_data->requestor_id);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put handle, ret=%d\n", ret));
+               goto fail;
+       }
+       ret = nla_put_u32(msg, NAN_ATTRIBUTE_INST_ID, event_data->local_inst_id);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put local inst id, ret=%d\n", ret));
+               goto fail;
+       }
+       ret = nla_put_u16(msg, NAN_ATTRIBUTE_PEER_ID, event_data->requestor_id);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put requestor inst id, ret=%d\n", ret));
+               goto fail;
+       }
+       ret = nla_put(msg, NAN_ATTRIBUTE_MAC_ADDR, ETHER_ADDR_LEN,
+                       event_data->remote_nmi.octet);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put remote nmi, ret=%d\n", ret));
+               goto fail;
+       }
+       ret = nla_put_s8(msg, NAN_ATTRIBUTE_RSSI_PROXIMITY,
+                       event_data->fup_rssi);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put fup rssi, ret=%d\n", ret));
+               goto fail;
+       }
+fail:
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_sub_match_event_filler(struct sk_buff *msg,
+       nan_event_data_t *event_data) {
+       int ret = BCME_OK;
+       WL_TRACE(("handle (sub_id)=%d\n", event_data->sub_id));
+       WL_TRACE(("pub id=%d\n", event_data->pub_id));
+       WL_TRACE(("sub id=%d\n", event_data->sub_id));
+       WL_TRACE(("pub mac addr=" MACDBG "\n",
+                       MAC2STRDBG(event_data->remote_nmi.octet)));
+       WL_TRACE(("attr no: %d\n", event_data->attr_num));
+       WL_TRACE(("attr len: %d\n", event_data->attr_list_len));
+
+       ret = nla_put_u8(msg, NAN_ATTRIBUTE_HANDLE, event_data->sub_id);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put handle, ret=%d\n", ret));
+               goto fail;
+       }
+       ret = nla_put_u16(msg, NAN_ATTRIBUTE_PUBLISH_ID, event_data->pub_id);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put pub id, ret=%d\n", ret));
+               goto fail;
+       }
+       ret = nla_put_u16(msg, NAN_ATTRIBUTE_SUBSCRIBE_ID, event_data->sub_id);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put Sub Id, ret=%d\n", ret));
+               goto fail;
+       }
+       ret = nla_put(msg, NAN_ATTRIBUTE_MAC_ADDR, ETHER_ADDR_LEN,
+                       event_data->remote_nmi.octet);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put remote NMI, ret=%d\n", ret));
+               goto fail;
+       }
+       if (event_data->publish_rssi) {
+               event_data->publish_rssi = -event_data->publish_rssi;
+               ret = nla_put_u8(msg, NAN_ATTRIBUTE_RSSI_PROXIMITY,
+                               event_data->publish_rssi);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put publish rssi, ret=%d\n", ret));
+                       goto fail;
+               }
+       }
+       if (event_data->ranging_result_present) {
+               ret = nla_put_u32(msg, NAN_ATTRIBUTE_RANGING_INDICATION,
+                               event_data->ranging_ind);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put ranging ind, ret=%d\n", ret));
+                       goto fail;
+               }
+               ret = nla_put_u32(msg, NAN_ATTRIBUTE_RANGING_RESULT,
+                               event_data->range_measurement_cm);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put range measurement cm, ret=%d\n",
+                                       ret));
+                       goto fail;
+               }
+       }
+       /*
+        * handling optional service control, service response filter
+        */
+       if (event_data->tx_match_filter.dlen && event_data->tx_match_filter.data) {
+               ret = nla_put_u16(msg, NAN_ATTRIBUTE_TX_MATCH_FILTER_LEN,
+                               event_data->tx_match_filter.dlen);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put tx match filter len, ret=%d\n",
+                                       ret));
+                       goto fail;
+               }
+               ret = nla_put(msg, NAN_ATTRIBUTE_TX_MATCH_FILTER,
+                               event_data->tx_match_filter.dlen,
+                               event_data->tx_match_filter.data);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put tx match filter data, ret=%d\n",
+                                       ret));
+                       goto fail;
+               }
+               WL_TRACE(("tx matching filter (%d):\n",
+                               event_data->tx_match_filter.dlen));
+       }
+
+fail:
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_de_event_filler(struct sk_buff *msg, nan_event_data_t *event_data)
+{
+       int ret = BCME_OK;
+       ret = nla_put_u8(msg, NAN_ATTRIBUTE_ENABLE_STATUS, event_data->enabled);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put event_data->enabled, ret=%d\n", ret));
+               goto fail;
+       }
+       ret = nla_put_u8(msg, NAN_ATTRIBUTE_DE_EVENT_TYPE,
+                       event_data->nan_de_evt_type);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put nan_de_evt_type, ret=%d\n", ret));
+               goto fail;
+       }
+       ret = nla_put(msg, NAN_ATTRIBUTE_CLUSTER_ID, ETH_ALEN,
+                       event_data->clus_id.octet);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put clust id, ret=%d\n", ret));
+               goto fail;
+       }
+       /* OOB tests requires local nmi */
+       ret = nla_put(msg, NAN_ATTRIBUTE_MAC_ADDR, ETH_ALEN,
+                       event_data->local_nmi.octet);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put NMI, ret=%d\n", ret));
+               goto fail;
+       }
+fail:
+       return ret;
+}
+
+#ifdef RTT_SUPPORT
+s32
+wl_cfgvendor_send_as_rtt_legacy_event(struct wiphy *wiphy, struct net_device *dev,
+       wl_nan_ev_rng_rpt_ind_t *range_res, uint32 status)
+{
+       s32 ret = BCME_OK;
+       gfp_t kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+       rtt_report_t *report = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct sk_buff *msg = NULL;
+       struct nlattr *rtt_nl_hdr;
+
+       NAN_DBG_ENTER();
+
+       report = MALLOCZ(cfg->osh, sizeof(*report));
+       if (!report) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+       if (range_res) {
+               report->distance = range_res->dist_mm/10;
+               ret = memcpy_s(&report->addr, ETHER_ADDR_LEN,
+                               &range_res->peer_m_addr, ETHER_ADDR_LEN);
+               if (ret != BCME_OK) {
+                       WL_ERR(("Failed to copy peer_m_addr\n"));
+                       goto exit;
+               }
+       }
+       report->status = (rtt_reason_t)status;
+       report->type   = RTT_TWO_WAY;
+
+#if (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || \
+       LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+       msg = cfg80211_vendor_event_alloc(wiphy, NULL, 100,
+                       GOOGLE_RTT_COMPLETE_EVENT, kflags);
+#else
+       msg = cfg80211_vendor_event_alloc(wiphy, 100, GOOGLE_RTT_COMPLETE_EVENT, kflags);
+#endif /* (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || */
+       /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0) */
+       if (!msg) {
+               WL_ERR(("%s: fail to allocate skb for vendor event\n", __FUNCTION__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+
+       ret = nla_put_u32(msg, RTT_ATTRIBUTE_RESULTS_COMPLETE, 1);
+       if (ret < 0) {
+               WL_ERR(("Failed to put RTT_ATTRIBUTE_RESULTS_COMPLETE\n"));
+               goto exit;
+       }
+       rtt_nl_hdr = nla_nest_start(msg, RTT_ATTRIBUTE_RESULTS_PER_TARGET);
+       if (!rtt_nl_hdr) {
+               WL_ERR(("rtt_nl_hdr is NULL\n"));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+       ret = nla_put(msg, RTT_ATTRIBUTE_TARGET_MAC, ETHER_ADDR_LEN, &report->addr);
+       if (ret < 0) {
+               WL_ERR(("Failed to put RTT_ATTRIBUTE_TARGET_MAC\n"));
+               goto exit;
+       }
+       ret = nla_put_u32(msg, RTT_ATTRIBUTE_RESULT_CNT, 1);
+       if (ret < 0) {
+               WL_ERR(("Failed to put RTT_ATTRIBUTE_RESULT_CNT\n"));
+               goto exit;
+       }
+       ret = nla_put(msg, RTT_ATTRIBUTE_RESULT,
+                       sizeof(*report), report);
+       if (ret < 0) {
+               WL_ERR(("Failed to put RTT_ATTRIBUTE_RESULTS\n"));
+               goto exit;
+       }
+       nla_nest_end(msg, rtt_nl_hdr);
+       cfg80211_vendor_event(msg, kflags);
+       if (report) {
+               MFREE(cfg->osh, report, sizeof(*report));
+       }
+
+       return ret;
+exit:
+       if (msg)
+               dev_kfree_skb_any(msg);
+       WL_ERR(("Failed to send event GOOGLE_RTT_COMPLETE_EVENT,"
+                               " -- Free skb, ret = %d\n", ret));
+       if (report)
+               MFREE(cfg->osh, report, sizeof(*report));
+       NAN_DBG_EXIT();
+       return ret;
+}
+#endif /* RTT_SUPPORT */
+
+static int
+wl_cfgvendor_send_nan_async_resp(struct wiphy *wiphy, struct wireless_dev *wdev,
+       int event_id, u8* nan_req_resp, u16 len)
+{
+       int ret = BCME_OK;
+       int buf_len = NAN_EVENT_BUFFER_SIZE_LARGE;
+       gfp_t kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+
+       struct sk_buff *msg;
+
+       NAN_DBG_ENTER();
+
+       /* Allocate the skb for vendor event */
+       msg = CFG80211_VENDOR_EVENT_ALLOC(wiphy, wdev, buf_len,
+               event_id, kflags);
+       if (!msg) {
+               WL_ERR(("%s: fail to allocate skb for vendor event\n", __FUNCTION__));
+               return -ENOMEM;
+       }
+
+       ret = nla_put(msg, NAN_ATTRIBUTE_CMD_RESP_DATA,
+                       len, (u8*)nan_req_resp);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put resp data, ret=%d\n",
+                               ret));
+               goto fail;
+       }
+       WL_DBG(("Event sent up to hal, event_id = %d, ret = %d\n",
+               event_id, ret));
+       cfg80211_vendor_event(msg, kflags);
+       NAN_DBG_EXIT();
+       return ret;
+
+fail:
+       dev_kfree_skb_any(msg);
+       WL_ERR(("Event not implemented or unknown -- Free skb, event_id = %d, ret = %d\n",
+               event_id, ret));
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+int
+wl_cfgvendor_nan_send_async_disable_resp(struct wireless_dev *wdev)
+{
+       int ret = BCME_OK;
+       struct wiphy *wiphy = wdev->wiphy;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_hal_resp_t nan_req_resp;
+       bzero(&nan_req_resp, sizeof(nan_req_resp));
+       nan_req_resp.status = NAN_STATUS_SUCCESS;
+       nan_req_resp.value = BCME_OK;
+       nan_req_resp.subcmd = NAN_WIFI_SUBCMD_DISABLE;
+       WL_INFORM_MEM(("Send NAN_ASYNC_RESPONSE_DISABLED\n"));
+       ret = wl_cfgvendor_send_nan_async_resp(wiphy, wdev,
+               NAN_ASYNC_RESPONSE_DISABLED, (u8*)&nan_req_resp, sizeof(nan_req_resp));
+       cfg->nancfg->notify_user = false;
+       return ret;
+}
+
+int
+wl_cfgvendor_send_nan_event(struct wiphy *wiphy, struct net_device *dev,
+       int event_id, nan_event_data_t *event_data)
+{
+       int ret = BCME_OK;
+       int buf_len = NAN_EVENT_BUFFER_SIZE_LARGE;
+       gfp_t kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct sk_buff *msg;
+
+       NAN_DBG_ENTER();
+
+       /* Allocate the skb for vendor event */
+       msg = CFG80211_VENDOR_EVENT_ALLOC(wiphy, ndev_to_wdev(dev), buf_len,
+               event_id, kflags);
+       if (!msg) {
+               WL_ERR(("%s: fail to allocate skb for vendor event\n", __FUNCTION__));
+               return -ENOMEM;
+       }
+
+       switch (event_id) {
+       case GOOGLE_NAN_EVENT_DE_EVENT: {
+               WL_INFORM_MEM(("[NAN] GOOGLE_NAN_DE_EVENT cluster id=" MACDBG "nmi= " MACDBG "\n",
+                       MAC2STRDBG(event_data->clus_id.octet),
+                       MAC2STRDBG(event_data->local_nmi.octet)));
+               ret = wl_cfgvendor_nan_de_event_filler(msg, event_data);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to fill de event data, ret=%d\n", ret));
+                       goto fail;
+               }
+               break;
+       }
+       case GOOGLE_NAN_EVENT_SUBSCRIBE_MATCH:
+       case GOOGLE_NAN_EVENT_FOLLOWUP: {
+               if (event_id == GOOGLE_NAN_EVENT_SUBSCRIBE_MATCH) {
+                       WL_DBG(("GOOGLE_NAN_EVENT_SUBSCRIBE_MATCH\n"));
+                       ret = wl_cfgvendor_nan_sub_match_event_filler(msg, event_data);
+                       if (unlikely(ret)) {
+                               WL_ERR(("Failed to fill sub match event data, ret=%d\n", ret));
+                               goto fail;
+                       }
+               } else if (event_id == GOOGLE_NAN_EVENT_FOLLOWUP) {
+                       WL_DBG(("GOOGLE_NAN_EVENT_FOLLOWUP\n"));
+                       ret = wl_cfgvendor_nan_tx_followup_event_filler(msg, event_data);
+                       if (unlikely(ret)) {
+                               WL_ERR(("Failed to fill sub match event data, ret=%d\n", ret));
+                               goto fail;
+                       }
+               }
+               ret = wl_cfgvendor_nan_opt_params_filler(msg, event_data);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to fill sub match event data, ret=%d\n", ret));
+                       goto fail;
+               }
+               break;
+       }
+
+       case GOOGLE_NAN_EVENT_DISABLED: {
+               WL_INFORM_MEM(("[NAN] GOOGLE_NAN_EVENT_DISABLED\n"));
+               ret = nla_put_u8(msg, NAN_ATTRIBUTE_HANDLE, 0);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put handle, ret=%d\n", ret));
+                       goto fail;
+               }
+               ret = nla_put_u16(msg, NAN_ATTRIBUTE_STATUS, event_data->status);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put status, ret=%d\n", ret));
+                       goto fail;
+               }
+               ret = nla_put(msg, NAN_ATTRIBUTE_REASON,
+                       strlen("NAN_STATUS_SUCCESS"), event_data->nan_reason);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put reason code, ret=%d\n", ret));
+                       goto fail;
+               }
+               break;
+       }
+
+       case GOOGLE_NAN_EVENT_SUBSCRIBE_TERMINATED:
+       case GOOGLE_NAN_EVENT_PUBLISH_TERMINATED: {
+               WL_DBG(("GOOGLE_NAN_SVC_TERMINATED, %d\n", event_id));
+               ret = wl_cfgvendor_nan_svc_terminate_event_filler(msg, cfg, event_id, event_data);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to fill svc terminate event data, ret=%d\n", ret));
+                       goto fail;
+               }
+               break;
+       }
+
+       case GOOGLE_NAN_EVENT_TRANSMIT_FOLLOWUP_IND: {
+               WL_DBG(("GOOGLE_NAN_EVENT_TRANSMIT_FOLLOWUP_IND %d\n",
+                       GOOGLE_NAN_EVENT_TRANSMIT_FOLLOWUP_IND));
+               ret = wl_cfgvendor_nan_tx_followup_ind_event_data_filler(msg, event_data);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to fill tx follow up ind event data, ret=%d\n", ret));
+                       goto fail;
+               }
+
+               break;
+       }
+
+       case GOOGLE_NAN_EVENT_DATA_REQUEST: {
+               WL_INFORM_MEM(("[NAN] GOOGLE_NAN_EVENT_DATA_REQUEST\n"));
+               ret = wl_cfgvendor_nan_dp_ind_event_data_filler(msg, event_data);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to fill dp ind event data, ret=%d\n", ret));
+                       goto fail;
+               }
+               break;
+       }
+
+       case GOOGLE_NAN_EVENT_DATA_CONFIRMATION: {
+               WL_INFORM_MEM(("[NAN] GOOGLE_NAN_EVENT_DATA_CONFIRMATION\n"));
+
+               ret = wl_cfgvendor_nan_dp_estb_event_data_filler(msg, event_data);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to fill dp estb event data, ret=%d\n", ret));
+                       goto fail;
+               }
+               break;
+       }
+
+       case GOOGLE_NAN_EVENT_DATA_END: {
+               WL_INFORM_MEM(("[NAN] GOOGLE_NAN_EVENT_DATA_END\n"));
+               ret = nla_put_u8(msg, NAN_ATTRIBUTE_INST_COUNT, 1);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put inst count, ret=%d\n", ret));
+                       goto fail;
+               }
+               ret = nla_put_u32(msg, NAN_ATTRIBUTE_NDP_ID, event_data->ndp_id);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to put ndp id, ret=%d\n", ret));
+                       goto fail;
+               }
+               break;
+       }
+
+       default:
+               goto fail;
+       }
+
+       cfg80211_vendor_event(msg, kflags);
+       NAN_DBG_EXIT();
+       return ret;
+
+fail:
+       dev_kfree_skb_any(msg);
+       WL_ERR(("Event not implemented or unknown -- Free skb, event_id = %d, ret = %d\n",
+                       event_id, ret));
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_req_subscribe(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void * data, int len)
+{
+       int ret = 0;
+       nan_discover_cmd_data_t *cmd_data = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_hal_resp_t nan_req_resp;
+
+       NAN_DBG_ENTER();
+       /* Blocking Subscribe if NAN is not enable */
+       if (!cfg->nancfg->nan_enable) {
+               WL_ERR(("nan is not enabled, subscribe blocked\n"));
+               ret = BCME_ERROR;
+               goto exit;
+       }
+       cmd_data = (nan_discover_cmd_data_t *)MALLOCZ(cfg->osh, sizeof(*cmd_data));
+       if (!cmd_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+
+       bzero(&nan_req_resp, sizeof(nan_req_resp));
+       ret = wl_cfgvendor_nan_parse_discover_args(wiphy, data, len, cmd_data);
+       if (ret) {
+               WL_ERR(("failed to parse nan disc vendor args, ret = %d\n", ret));
+               goto exit;
+       }
+
+       if (cmd_data->sub_id == 0) {
+               ret = wl_cfgnan_generate_inst_id(cfg, &cmd_data->sub_id);
+               if (ret) {
+                       WL_ERR(("failed to generate instance-id for subscribe\n"));
+                       goto exit;
+               }
+       } else {
+               cmd_data->svc_update = true;
+       }
+
+       ret = wl_cfgnan_subscribe_handler(wdev->netdev, cfg, cmd_data);
+       if (unlikely(ret) || unlikely(cmd_data->status)) {
+               WL_ERR(("failed to subscribe error[%d], status = [%d]\n",
+                               ret, cmd_data->status));
+               wl_cfgnan_remove_inst_id(cfg, cmd_data->sub_id);
+               goto exit;
+       }
+
+       WL_DBG(("subscriber instance id=%d\n", cmd_data->sub_id));
+
+       if (cmd_data->status == WL_NAN_E_OK) {
+               nan_req_resp.instance_id = cmd_data->sub_id;
+       } else {
+               nan_req_resp.instance_id = 0;
+       }
+exit:
+       ret = wl_cfgvendor_nan_cmd_reply(wiphy, NAN_WIFI_SUBCMD_REQUEST_SUBSCRIBE,
+               &nan_req_resp, ret, cmd_data ? cmd_data->status : BCME_OK);
+       wl_cfgvendor_free_disc_cmd_data(cfg, cmd_data);
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_req_publish(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void * data, int len)
+{
+       int ret = 0;
+       nan_discover_cmd_data_t *cmd_data = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_hal_resp_t nan_req_resp;
+       NAN_DBG_ENTER();
+
+       /* Blocking Publish if NAN is not enable */
+       if (!cfg->nancfg->nan_enable) {
+               WL_ERR(("nan is not enabled publish blocked\n"));
+               ret = BCME_ERROR;
+               goto exit;
+       }
+       cmd_data = (nan_discover_cmd_data_t *)MALLOCZ(cfg->osh, sizeof(*cmd_data));
+       if (!cmd_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+
+       bzero(&nan_req_resp, sizeof(nan_req_resp));
+       ret = wl_cfgvendor_nan_parse_discover_args(wiphy, data, len, cmd_data);
+       if (ret) {
+               WL_ERR(("failed to parse nan disc vendor args, ret = %d\n", ret));
+               goto exit;
+       }
+
+       if (cmd_data->pub_id == 0) {
+               ret = wl_cfgnan_generate_inst_id(cfg, &cmd_data->pub_id);
+               if (ret) {
+                       WL_ERR(("failed to generate instance-id for publisher\n"));
+                       goto exit;
+               }
+       } else {
+               cmd_data->svc_update = true;
+       }
+
+       ret = wl_cfgnan_publish_handler(wdev->netdev, cfg, cmd_data);
+       if (unlikely(ret) || unlikely(cmd_data->status)) {
+               WL_ERR(("failed to publish error[%d], status[%d]\n",
+                               ret, cmd_data->status));
+               wl_cfgnan_remove_inst_id(cfg, cmd_data->pub_id);
+               goto exit;
+       }
+
+       WL_DBG(("publisher instance id=%d\n", cmd_data->pub_id));
+
+       if (cmd_data->status == WL_NAN_E_OK) {
+               nan_req_resp.instance_id = cmd_data->pub_id;
+       } else {
+               nan_req_resp.instance_id = 0;
+       }
+exit:
+       ret = wl_cfgvendor_nan_cmd_reply(wiphy, NAN_WIFI_SUBCMD_REQUEST_PUBLISH,
+               &nan_req_resp, ret, cmd_data ? cmd_data->status : BCME_OK);
+       wl_cfgvendor_free_disc_cmd_data(cfg, cmd_data);
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_start_handler(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int ret = 0;
+       nan_config_cmd_data_t *cmd_data;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_hal_resp_t nan_req_resp;
+       uint32 nan_attr_mask = 0;
+
+       cmd_data = (nan_config_cmd_data_t *)MALLOCZ(cfg->osh, sizeof(*cmd_data));
+       if (!cmd_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+       NAN_DBG_ENTER();
+
+       ret = wl_cfgnan_check_nan_disable_pending(cfg, false, true);
+       if (ret != BCME_OK) {
+               WL_ERR(("failed to disable nan, error[%d]\n", ret));
+               goto exit;
+       }
+
+       if (cfg->nancfg->nan_enable) {
+               WL_ERR(("nan is already enabled\n"));
+               ret = BCME_OK;
+               goto exit;
+       }
+       bzero(&nan_req_resp, sizeof(nan_req_resp));
+
+       cmd_data->sid_beacon.sid_enable = NAN_SID_ENABLE_FLAG_INVALID; /* Setting to some default */
+       cmd_data->sid_beacon.sid_count = NAN_SID_BEACON_COUNT_INVALID; /* Setting to some default */
+
+       ret = wl_cfgvendor_nan_parse_args(wiphy, data, len, cmd_data, &nan_attr_mask);
+       if (ret) {
+               WL_ERR(("failed to parse nan vendor args, ret %d\n", ret));
+               goto exit;
+       }
+
+       ret = wl_cfgnan_start_handler(wdev->netdev, cfg, cmd_data, nan_attr_mask);
+       if (ret) {
+               WL_ERR(("failed to start nan error[%d]\n", ret));
+               goto exit;
+       }
+       /* Initializing Instance Id List */
+       bzero(cfg->nancfg->nan_inst_ctrl, NAN_ID_CTRL_SIZE * sizeof(nan_svc_inst_t));
+exit:
+       ret = wl_cfgvendor_nan_cmd_reply(wiphy, NAN_WIFI_SUBCMD_ENABLE,
+               &nan_req_resp, ret, cmd_data ? cmd_data->status : BCME_OK);
+       if (cmd_data) {
+               if (cmd_data->scid.data) {
+                       MFREE(cfg->osh, cmd_data->scid.data, cmd_data->scid.dlen);
+                       cmd_data->scid.dlen = 0;
+               }
+               MFREE(cfg->osh, cmd_data, sizeof(*cmd_data));
+       }
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_terminate_dp_rng_sessions(struct bcm_cfg80211 *cfg,
+       struct wireless_dev *wdev, bool *ssn_exists)
+{
+       int ret = 0;
+       uint8 i = 0;
+       int status = BCME_ERROR;
+       wl_nancfg_t *nancfg = cfg->nancfg;
+       dhd_pub_t *dhdp;
+#ifdef RTT_SUPPORT
+       nan_ranging_inst_t *ranging_inst = NULL;
+#endif /* RTT_SUPPORT */
+
+       *ssn_exists = false;
+       dhdp = wl_cfg80211_get_dhdp(wdev->netdev);
+       /* Cleanup active Data Paths If any */
+       for (i = 0; i < NAN_MAX_NDP_PEER; i++) {
+               if (nancfg->ndp_id[i]) {
+                       WL_DBG(("Found entry of ndp id = [%d], end dp associated to it\n",
+                                       nancfg->ndp_id[i]));
+                       ret = wl_cfgnan_data_path_end_handler(wdev->netdev, cfg,
+                                       nancfg->ndp_id[i], &status);
+                       if ((ret == BCME_OK) && cfg->nancfg->nan_enable &&
+                               dhdp->up) {
+                               *ssn_exists = true;
+                       }
+               }
+       }
+
+#ifdef RTT_SUPPORT
+       /* Cancel ranging sessiosns */
+       for (i = 0; i < NAN_MAX_RANGING_INST; i++) {
+               ranging_inst = &nancfg->nan_ranging_info[i];
+               if (ranging_inst->in_use &&
+                               (NAN_RANGING_IS_IN_PROG(ranging_inst->range_status))) {
+                       ret = wl_cfgnan_cancel_ranging(bcmcfg_to_prmry_ndev(cfg), cfg,
+                                       &ranging_inst->range_id,
+                                       NAN_RNG_TERM_FLAG_NONE, &status);
+                       if (unlikely(ret) || unlikely(status)) {
+                               WL_ERR(("nan range cancel failed ret = %d status = %d\n",
+                                       ret, status));
+                       } else {
+                               *ssn_exists = true;
+                       }
+               }
+       }
+#endif /* RTT_SUPPORT */
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_stop_handler(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void * data, int len)
+{
+       int ret = BCME_OK;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       bool ssn_exists = false;
+       uint32 delay_ms = 0;
+       wl_nancfg_t *nancfg = cfg->nancfg;
+
+       NAN_DBG_ENTER();
+       mutex_lock(&cfg->if_sync);
+
+       if (nancfg->nan_init_state == false) {
+               WL_INFORM_MEM(("nan is not initialized/nmi doesnt exists\n"));
+               goto exit;
+       }
+       if (nancfg->nan_enable == false) {
+               WL_INFORM_MEM(("nan is in disabled state\n"));
+       } else {
+               nancfg->notify_user = true;
+               wl_cfgvendor_terminate_dp_rng_sessions(cfg, wdev, &ssn_exists);
+               if (ssn_exists == true) {
+                       /*
+                       * Schedule nan disable with NAN_DISABLE_CMD_DELAY
+                       * delay to make sure
+                       * fw cleans any active Data paths and
+                       * notifies the peer about the dp session terminations
+                       */
+                       WL_INFORM_MEM(("Schedule Nan Disable Req with NAN_DISABLE_CMD_DELAY\n"));
+                       delay_ms = NAN_DISABLE_CMD_DELAY;
+                       DHD_NAN_WAKE_LOCK_TIMEOUT(cfg->pub, NAN_WAKELOCK_TIMEOUT);
+               } else {
+                       delay_ms = 0;
+               }
+               schedule_delayed_work(&nancfg->nan_disable,
+                       msecs_to_jiffies(delay_ms));
+       }
+exit:
+       mutex_unlock(&cfg->if_sync);
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_config_handler(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int ret = 0;
+       nan_config_cmd_data_t *cmd_data;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_hal_resp_t nan_req_resp;
+       uint32 nan_attr_mask = 0;
+
+       cmd_data = MALLOCZ(cfg->osh, sizeof(*cmd_data));
+       if (!cmd_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+       NAN_DBG_ENTER();
+
+       bzero(&nan_req_resp, sizeof(nan_req_resp));
+
+       cmd_data->avail_params.duration = NAN_BAND_INVALID;  /* Setting to some default */
+       cmd_data->sid_beacon.sid_enable = NAN_SID_ENABLE_FLAG_INVALID; /* Setting to some default */
+       cmd_data->sid_beacon.sid_count = NAN_SID_BEACON_COUNT_INVALID; /* Setting to some default */
+
+       ret = wl_cfgvendor_nan_parse_args(wiphy, data, len, cmd_data, &nan_attr_mask);
+       if (ret) {
+               WL_ERR(("failed to parse nan vendor args, ret = %d\n", ret));
+               goto exit;
+       }
+
+       ret = wl_cfgnan_config_handler(wdev->netdev, cfg, cmd_data, nan_attr_mask);
+       if (ret) {
+               WL_ERR(("failed in config request, nan error[%d]\n", ret));
+               goto exit;
+       }
+exit:
+       ret = wl_cfgvendor_nan_cmd_reply(wiphy, NAN_WIFI_SUBCMD_CONFIG,
+               &nan_req_resp, ret, cmd_data ? cmd_data->status : BCME_OK);
+       if (cmd_data) {
+               if (cmd_data->scid.data) {
+                       MFREE(cfg->osh, cmd_data->scid.data, cmd_data->scid.dlen);
+                       cmd_data->scid.dlen = 0;
+               }
+               MFREE(cfg->osh, cmd_data, sizeof(*cmd_data));
+       }
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_cancel_publish(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void * data, int len)
+{
+       int ret = 0;
+       nan_discover_cmd_data_t *cmd_data = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_hal_resp_t nan_req_resp;
+
+       /* Blocking Cancel_Publish if NAN is not enable */
+       if (!cfg->nancfg->nan_enable) {
+               WL_ERR(("nan is not enabled, cancel publish blocked\n"));
+               ret = BCME_ERROR;
+               goto exit;
+       }
+       cmd_data = (nan_discover_cmd_data_t *)MALLOCZ(cfg->osh, sizeof(*cmd_data));
+       if (!cmd_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+       NAN_DBG_ENTER();
+
+       bzero(&nan_req_resp, sizeof(nan_req_resp));
+
+       ret = wl_cfgvendor_nan_parse_discover_args(wiphy, data, len, cmd_data);
+       if (ret) {
+               WL_ERR(("failed to parse nan disc vendor args, ret= %d\n", ret));
+               goto exit;
+       }
+       nan_req_resp.instance_id = cmd_data->pub_id;
+       WL_INFORM_MEM(("[NAN] cancel publish instance_id=%d\n", cmd_data->pub_id));
+
+       ret = wl_cfgnan_cancel_pub_handler(wdev->netdev, cfg, cmd_data);
+       if (ret) {
+               WL_ERR(("failed to cancel publish nan instance-id[%d] error[%d]\n",
+                       cmd_data->pub_id, ret));
+               goto exit;
+       }
+exit:
+       ret = wl_cfgvendor_nan_cmd_reply(wiphy, NAN_WIFI_SUBCMD_CANCEL_PUBLISH,
+               &nan_req_resp, ret, cmd_data ? cmd_data->status : BCME_OK);
+       wl_cfgvendor_free_disc_cmd_data(cfg, cmd_data);
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_cancel_subscribe(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void * data, int len)
+{
+       int ret = 0;
+       nan_discover_cmd_data_t *cmd_data = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_hal_resp_t nan_req_resp;
+
+       /* Blocking Cancel_Subscribe if NAN is not enableb */
+       if (!cfg->nancfg->nan_enable) {
+               WL_ERR(("nan is not enabled, cancel subscribe blocked\n"));
+               ret = BCME_ERROR;
+               goto exit;
+       }
+       cmd_data = MALLOCZ(cfg->osh, sizeof(*cmd_data));
+       if (!cmd_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+       NAN_DBG_ENTER();
+
+       bzero(&nan_req_resp, sizeof(nan_req_resp));
+
+       ret = wl_cfgvendor_nan_parse_discover_args(wiphy, data, len, cmd_data);
+       if (ret) {
+               WL_ERR(("failed to parse nan disc vendor args, ret= %d\n", ret));
+               goto exit;
+       }
+       nan_req_resp.instance_id = cmd_data->sub_id;
+       WL_INFORM_MEM(("[NAN] cancel subscribe instance_id=%d\n", cmd_data->sub_id));
+
+       ret = wl_cfgnan_cancel_sub_handler(wdev->netdev, cfg, cmd_data);
+       if (ret) {
+               WL_ERR(("failed to cancel subscribe nan instance-id[%d] error[%d]\n",
+                       cmd_data->sub_id, ret));
+               goto exit;
+       }
+exit:
+       ret = wl_cfgvendor_nan_cmd_reply(wiphy, NAN_WIFI_SUBCMD_CANCEL_SUBSCRIBE,
+               &nan_req_resp, ret, cmd_data ? cmd_data->status : BCME_OK);
+       wl_cfgvendor_free_disc_cmd_data(cfg, cmd_data);
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_transmit(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void * data, int len)
+{
+       int ret = 0;
+       nan_discover_cmd_data_t *cmd_data = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_hal_resp_t nan_req_resp;
+
+       /* Blocking Transmit if NAN is not enable */
+       if (!cfg->nancfg->nan_enable) {
+               WL_ERR(("nan is not enabled, transmit blocked\n"));
+               ret = BCME_ERROR;
+               goto exit;
+       }
+       cmd_data = (nan_discover_cmd_data_t *)MALLOCZ(cfg->osh, sizeof(*cmd_data));
+       if (!cmd_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+       NAN_DBG_ENTER();
+
+       bzero(&nan_req_resp, sizeof(nan_req_resp));
+
+       ret = wl_cfgvendor_nan_parse_discover_args(wiphy, data, len, cmd_data);
+       if (ret) {
+               WL_ERR(("failed to parse nan disc vendor args, ret= %d\n", ret));
+               goto exit;
+       }
+       nan_req_resp.instance_id = cmd_data->local_id;
+       ret = wl_cfgnan_transmit_handler(wdev->netdev, cfg, cmd_data);
+       if (ret) {
+               WL_ERR(("failed to transmit-followup nan error[%d]\n", ret));
+               goto exit;
+       }
+exit:
+       ret = wl_cfgvendor_nan_cmd_reply(wiphy, NAN_WIFI_SUBCMD_TRANSMIT,
+               &nan_req_resp, ret, cmd_data ? cmd_data->status : BCME_OK);
+       wl_cfgvendor_free_disc_cmd_data(cfg, cmd_data);
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_get_capablities(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void * data, int len)
+{
+       int ret = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_hal_resp_t nan_req_resp;
+
+       NAN_DBG_ENTER();
+
+       bzero(&nan_req_resp, sizeof(nan_req_resp));
+       ret = wl_cfgnan_get_capablities_handler(wdev->netdev, cfg, &nan_req_resp.capabilities);
+       if (ret) {
+               WL_ERR(("Could not get capabilities\n"));
+               ret = -EINVAL;
+               goto exit;
+       }
+exit:
+       ret = wl_cfgvendor_nan_cmd_reply(wiphy, NAN_WIFI_SUBCMD_GET_CAPABILITIES,
+               &nan_req_resp, ret, BCME_OK);
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_data_path_iface_create(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void * data, int len)
+{
+       int ret = 0;
+       nan_datapath_cmd_data_t *cmd_data = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_hal_resp_t nan_req_resp;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(wdev->netdev);
+
+       if (!cfg->nancfg->nan_init_state) {
+               WL_ERR(("%s: NAN is not inited or Device doesn't support NAN \n", __func__));
+               ret = -ENODEV;
+               goto exit;
+       }
+
+       cmd_data = (nan_datapath_cmd_data_t *)MALLOCZ(cfg->osh, sizeof(*cmd_data));
+       if (!cmd_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+       NAN_DBG_ENTER();
+
+       bzero(&nan_req_resp, sizeof(nan_req_resp));
+
+       ret = wl_cfgvendor_nan_parse_datapath_args(wiphy, data, len, cmd_data);
+       if (ret) {
+               WL_ERR(("failed to parse nan datapath vendor args, ret = %d\n", ret));
+               goto exit;
+       }
+
+       if (cfg->nancfg->nan_enable) { /* new framework Impl, iface create called after nan enab */
+               ret = wl_cfgnan_data_path_iface_create_delete_handler(wdev->netdev,
+                       cfg, cmd_data->ndp_iface,
+                       NAN_WIFI_SUBCMD_DATA_PATH_IFACE_CREATE, dhdp->up);
+               if (ret != BCME_OK) {
+                       WL_ERR(("failed to create iface, ret = %d\n", ret));
+                       goto exit;
+               }
+       }
+exit:
+       ret = wl_cfgvendor_nan_cmd_reply(wiphy, NAN_WIFI_SUBCMD_DATA_PATH_IFACE_CREATE,
+               &nan_req_resp, ret, cmd_data ? cmd_data->status : BCME_OK);
+       wl_cfgvendor_free_dp_cmd_data(cfg, cmd_data);
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_data_path_iface_delete(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void * data, int len)
+{
+       int ret = 0;
+       nan_datapath_cmd_data_t *cmd_data = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_hal_resp_t nan_req_resp;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(wdev->netdev);
+
+       if (cfg->nancfg->nan_init_state == false) {
+               WL_ERR(("%s: NAN is not inited or Device doesn't support NAN \n", __func__));
+               /* Deinit has taken care of cleaing the virtual iface */
+               ret = BCME_OK;
+               goto exit;
+       }
+
+       NAN_DBG_ENTER();
+       cmd_data = (nan_datapath_cmd_data_t *)MALLOCZ(cfg->osh, sizeof(*cmd_data));
+       if (!cmd_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+       bzero(&nan_req_resp, sizeof(nan_req_resp));
+       ret = wl_cfgvendor_nan_parse_datapath_args(wiphy, data, len, cmd_data);
+       if (ret) {
+               WL_ERR(("failed to parse nan datapath vendor args, ret = %d\n", ret));
+               goto exit;
+       }
+
+       ret = wl_cfgnan_data_path_iface_create_delete_handler(wdev->netdev, cfg,
+               (char*)cmd_data->ndp_iface,
+               NAN_WIFI_SUBCMD_DATA_PATH_IFACE_DELETE, dhdp->up);
+       if (ret) {
+               WL_ERR(("failed to delete ndp iface [%d]\n", ret));
+               goto exit;
+       }
+exit:
+       ret = wl_cfgvendor_nan_cmd_reply(wiphy, NAN_WIFI_SUBCMD_DATA_PATH_IFACE_DELETE,
+               &nan_req_resp, ret, cmd_data ? cmd_data->status : BCME_OK);
+       wl_cfgvendor_free_dp_cmd_data(cfg, cmd_data);
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_data_path_request(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void * data, int len)
+{
+       int ret = 0;
+       nan_datapath_cmd_data_t *cmd_data = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_hal_resp_t nan_req_resp;
+       uint8 ndp_instance_id = 0;
+
+       if (!cfg->nancfg->nan_enable) {
+               WL_ERR(("nan is not enabled, nan data path request blocked\n"));
+               ret = BCME_ERROR;
+               goto exit;
+       }
+
+       NAN_DBG_ENTER();
+       cmd_data = (nan_datapath_cmd_data_t *)MALLOCZ(cfg->osh, sizeof(*cmd_data));
+       if (!cmd_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+
+       bzero(&nan_req_resp, sizeof(nan_req_resp));
+       ret = wl_cfgvendor_nan_parse_datapath_args(wiphy, data, len, cmd_data);
+       if (ret) {
+               WL_ERR(("failed to parse nan datapath vendor args, ret = %d\n", ret));
+               goto exit;
+       }
+
+       ret = wl_cfgnan_data_path_request_handler(wdev->netdev, cfg,
+                       cmd_data, &ndp_instance_id);
+       if (ret) {
+               WL_ERR(("failed to request nan data path [%d]\n", ret));
+               goto exit;
+       }
+
+       if (cmd_data->status == BCME_OK) {
+               nan_req_resp.ndp_instance_id = cmd_data->ndp_instance_id;
+       } else {
+               nan_req_resp.ndp_instance_id = 0;
+       }
+exit:
+       ret = wl_cfgvendor_nan_cmd_reply(wiphy, NAN_WIFI_SUBCMD_DATA_PATH_REQUEST,
+               &nan_req_resp, ret, cmd_data ? cmd_data->status : BCME_OK);
+       wl_cfgvendor_free_dp_cmd_data(cfg, cmd_data);
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_data_path_response(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void * data, int len)
+{
+       int ret = 0;
+       nan_datapath_cmd_data_t *cmd_data = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_hal_resp_t nan_req_resp;
+
+       if (!cfg->nancfg->nan_enable) {
+               WL_ERR(("nan is not enabled, nan data path response blocked\n"));
+               ret = BCME_ERROR;
+               goto exit;
+       }
+       NAN_DBG_ENTER();
+       cmd_data = (nan_datapath_cmd_data_t *)MALLOCZ(cfg->osh, sizeof(*cmd_data));
+       if (!cmd_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+
+       bzero(&nan_req_resp, sizeof(nan_req_resp));
+       ret = wl_cfgvendor_nan_parse_datapath_args(wiphy, data, len, cmd_data);
+       if (ret) {
+               WL_ERR(("failed to parse nan datapath vendor args, ret = %d\n", ret));
+               goto exit;
+       }
+       ret = wl_cfgnan_data_path_response_handler(wdev->netdev, cfg, cmd_data);
+       if (ret) {
+               WL_ERR(("failed to response nan data path [%d]\n", ret));
+               goto exit;
+       }
+exit:
+       ret = wl_cfgvendor_nan_cmd_reply(wiphy, NAN_WIFI_SUBCMD_DATA_PATH_RESPONSE,
+               &nan_req_resp, ret, cmd_data ? cmd_data->status : BCME_OK);
+       wl_cfgvendor_free_dp_cmd_data(cfg, cmd_data);
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_data_path_end(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void * data, int len)
+{
+       int ret = 0;
+       nan_datapath_cmd_data_t *cmd_data = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_hal_resp_t nan_req_resp;
+       int status = BCME_ERROR;
+
+       NAN_DBG_ENTER();
+       if (!cfg->nancfg->nan_enable) {
+               WL_ERR(("nan is not enabled, nan data path end blocked\n"));
+               ret = BCME_OK;
+               goto exit;
+       }
+       cmd_data = (nan_datapath_cmd_data_t *)MALLOCZ(cfg->osh, sizeof(*cmd_data));
+       if (!cmd_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+
+       bzero(&nan_req_resp, sizeof(nan_req_resp));
+       ret = wl_cfgvendor_nan_parse_datapath_args(wiphy, data, len, cmd_data);
+       if (ret) {
+               WL_ERR(("failed to parse nan datapath vendor args, ret = %d\n", ret));
+               goto exit;
+       }
+       ret = wl_cfgnan_data_path_end_handler(wdev->netdev, cfg,
+                       cmd_data->ndp_instance_id, &status);
+       if (ret) {
+               WL_ERR(("failed to end nan data path [%d]\n", ret));
+               goto exit;
+       }
+exit:
+       ret = wl_cfgvendor_nan_cmd_reply(wiphy, NAN_WIFI_SUBCMD_DATA_PATH_END,
+               &nan_req_resp, ret, cmd_data ? status : BCME_OK);
+       wl_cfgvendor_free_dp_cmd_data(cfg, cmd_data);
+       NAN_DBG_EXIT();
+       return ret;
+}
+
+#ifdef WL_NAN_DISC_CACHE
+static int
+wl_cfgvendor_nan_data_path_sec_info(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void *data, int len)
+{
+       int ret = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       nan_hal_resp_t nan_req_resp;
+       nan_datapath_sec_info_cmd_data_t *cmd_data = NULL;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(wdev->netdev);
+
+       NAN_DBG_ENTER();
+       if (!cfg->nancfg->nan_enable) {
+               WL_ERR(("nan is not enabled\n"));
+               ret = BCME_UNSUPPORTED;
+               goto exit;
+       }
+       cmd_data = MALLOCZ(dhdp->osh, sizeof(*cmd_data));
+       if (!cmd_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+
+       ret = wl_cfgvendor_nan_parse_dp_sec_info_args(wiphy, data, len, cmd_data);
+       if (ret) {
+               WL_ERR(("failed to parse sec info args\n"));
+               goto exit;
+       }
+
+       bzero(&nan_req_resp, sizeof(nan_req_resp));
+       ret = wl_cfgnan_sec_info_handler(cfg, cmd_data, &nan_req_resp);
+       if (ret) {
+               WL_ERR(("failed to retrieve svc hash/pub nmi error[%d]\n", ret));
+               goto exit;
+       }
+exit:
+       ret = wl_cfgvendor_nan_cmd_reply(wiphy, NAN_WIFI_SUBCMD_DATA_PATH_SEC_INFO,
+               &nan_req_resp, ret, BCME_OK);
+       if (cmd_data) {
+               MFREE(dhdp->osh, cmd_data, sizeof(*cmd_data));
+       }
+       NAN_DBG_EXIT();
+       return ret;
+}
+#endif /* WL_NAN_DISC_CACHE */
+
+static int
+wl_cfgvendor_nan_version_info(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void *data, int len)
+{
+       int ret = BCME_OK;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       uint32 version = NAN_HAL_VERSION_1;
+
+       BCM_REFERENCE(cfg);
+       WL_DBG(("Enter %s version %d\n", __FUNCTION__, version));
+       ret = wl_cfgvendor_send_cmd_reply(wiphy, &version, sizeof(version));
+       return ret;
+}
+
+static int
+wl_cfgvendor_nan_enable_merge(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void * data, int len)
+{
+       int ret = 0;
+       nan_config_cmd_data_t *cmd_data = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int status = BCME_OK;
+       uint32 nan_attr_mask = 0;
+
+       BCM_REFERENCE(nan_attr_mask);
+       NAN_DBG_ENTER();
+       cmd_data = (nan_config_cmd_data_t *)MALLOCZ(cfg->osh, sizeof(*cmd_data));
+       if (!cmd_data) {
+               WL_ERR(("%s: memory allocation failed\n", __func__));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+
+       ret = wl_cfgvendor_nan_parse_args(wiphy, data, len, cmd_data, &nan_attr_mask);
+       if (ret) {
+               WL_ERR((" Enable merge: failed to parse nan config vendor args, ret = %d\n", ret));
+               goto exit;
+       }
+       ret = wl_cfgnan_set_enable_merge(wdev->netdev, cfg, cmd_data->enable_merge, &status);
+       if (unlikely(ret) || unlikely(status)) {
+               WL_ERR(("Enable merge: failed to set config request  [%d]\n", ret));
+               /* As there is no cmd_reply, return status if error is in status else return ret */
+               if (status) {
+                       ret = status;
+               }
+               goto exit;
+       }
+exit:
+       if (cmd_data) {
+               if (cmd_data->scid.data) {
+                       MFREE(cfg->osh, cmd_data->scid.data, cmd_data->scid.dlen);
+                       cmd_data->scid.dlen = 0;
+               }
+               MFREE(cfg->osh, cmd_data, sizeof(*cmd_data));
+       }
+       NAN_DBG_EXIT();
+       return ret;
+}
+#endif /* WL_NAN */
+
+#ifdef LINKSTAT_SUPPORT
+
+#define NUM_RATE 32
+#define NUM_PEER 1
+#define NUM_CHAN 11
+#define HEADER_SIZE sizeof(ver_len)
+
+static int wl_cfgvendor_lstats_get_bcn_mbss(char *buf, uint32 *rxbeaconmbss)
+{
+       wl_cnt_info_t *cbuf = (wl_cnt_info_t *)buf;
+       const void *cnt;
+
+       if ((cnt = (const void *)bcm_get_data_from_xtlv_buf(cbuf->data, cbuf->datalen,
+               WL_CNT_XTLV_CNTV_LE10_UCODE, NULL, BCM_XTLV_OPTION_ALIGN32)) != NULL) {
+               *rxbeaconmbss = ((const wl_cnt_v_le10_mcst_t *)cnt)->rxbeaconmbss;
+       } else if ((cnt = (const void *)bcm_get_data_from_xtlv_buf(cbuf->data, cbuf->datalen,
+               WL_CNT_XTLV_LT40_UCODE_V1, NULL, BCM_XTLV_OPTION_ALIGN32)) != NULL) {
+               *rxbeaconmbss = ((const wl_cnt_lt40mcst_v1_t *)cnt)->rxbeaconmbss;
+       } else if ((cnt = (const void *)bcm_get_data_from_xtlv_buf(cbuf->data, cbuf->datalen,
+               WL_CNT_XTLV_GE40_UCODE_V1, NULL, BCM_XTLV_OPTION_ALIGN32)) != NULL) {
+               *rxbeaconmbss = ((const wl_cnt_ge40mcst_v1_t *)cnt)->rxbeaconmbss;
+       } else if ((cnt = (const void *)bcm_get_data_from_xtlv_buf(cbuf->data, cbuf->datalen,
+               WL_CNT_XTLV_GE80_UCODE_V1, NULL, BCM_XTLV_OPTION_ALIGN32)) != NULL) {
+               *rxbeaconmbss = ((const wl_cnt_ge80mcst_v1_t *)cnt)->rxbeaconmbss;
+       } else {
+               *rxbeaconmbss = 0;
+               return BCME_NOTFOUND;
+       }
+
+       return BCME_OK;
+}
+
+static int wl_cfgvendor_lstats_get_info(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       static char iovar_buf[WLC_IOCTL_MAXLEN];
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int err = 0, i;
+       wifi_radio_stat *radio;
+       wifi_radio_stat_h radio_h;
+       const wl_cnt_wlc_t *wlc_cnt;
+       scb_val_t scbval;
+       char *output = NULL;
+       char *outdata = NULL;
+       wifi_rate_stat_v1 *p_wifi_rate_stat_v1 = NULL;
+       wifi_rate_stat *p_wifi_rate_stat = NULL;
+       uint total_len = 0;
+       uint32 rxbeaconmbss;
+       wlc_rev_info_t revinfo;
+       wl_if_stats_t *if_stats = NULL;
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       COMPAT_STRUCT_IFACE(wifi_iface_stat, iface);
+
+       WL_TRACE(("%s: Enter \n", __func__));
+       RETURN_EIO_IF_NOT_UP(cfg);
+
+       BCM_REFERENCE(if_stats);
+       BCM_REFERENCE(dhdp);
+       /* Get the device rev info */
+       bzero(&revinfo, sizeof(revinfo));
+       err = wldev_ioctl_get(bcmcfg_to_prmry_ndev(cfg), WLC_GET_REVINFO, &revinfo,
+                       sizeof(revinfo));
+       if (err != BCME_OK) {
+               goto exit;
+       }
+
+       outdata = (void *)MALLOCZ(cfg->osh, WLC_IOCTL_MAXLEN);
+       if (outdata == NULL) {
+               WL_ERR(("outdata alloc failed\n"));
+               return BCME_NOMEM;
+       }
+
+       bzero(&scbval, sizeof(scb_val_t));
+       bzero(outdata, WLC_IOCTL_MAXLEN);
+       output = outdata;
+
+       err = wldev_iovar_getbuf(bcmcfg_to_prmry_ndev(cfg), "radiostat", NULL, 0,
+               iovar_buf, WLC_IOCTL_MAXLEN, NULL);
+       if (err != BCME_OK && err != BCME_UNSUPPORTED) {
+               WL_ERR(("error (%d) - size = %zu\n", err, sizeof(wifi_radio_stat)));
+               goto exit;
+       }
+       radio = (wifi_radio_stat *)iovar_buf;
+
+       bzero(&radio_h, sizeof(wifi_radio_stat_h));
+       radio_h.on_time = radio->on_time;
+       radio_h.tx_time = radio->tx_time;
+       radio_h.rx_time = radio->rx_time;
+       radio_h.on_time_scan = radio->on_time_scan;
+       radio_h.on_time_nbd = radio->on_time_nbd;
+       radio_h.on_time_gscan = radio->on_time_gscan;
+       radio_h.on_time_roam_scan = radio->on_time_roam_scan;
+       radio_h.on_time_pno_scan = radio->on_time_pno_scan;
+       radio_h.on_time_hs20 = radio->on_time_hs20;
+       radio_h.num_channels = NUM_CHAN;
+
+       memcpy(output, &radio_h, sizeof(wifi_radio_stat_h));
+
+       output += sizeof(wifi_radio_stat_h);
+       output += (NUM_CHAN * sizeof(wifi_channel_stat));
+
+       COMPAT_BZERO_IFACE(wifi_iface_stat, iface);
+       COMPAT_ASSIGN_VALUE(iface, ac[WIFI_AC_VO].ac, WIFI_AC_VO);
+       COMPAT_ASSIGN_VALUE(iface, ac[WIFI_AC_VI].ac, WIFI_AC_VI);
+       COMPAT_ASSIGN_VALUE(iface, ac[WIFI_AC_BE].ac, WIFI_AC_BE);
+       COMPAT_ASSIGN_VALUE(iface, ac[WIFI_AC_BK].ac, WIFI_AC_BK);
+
+       err = wldev_iovar_getbuf(bcmcfg_to_prmry_ndev(cfg), "counters", NULL, 0,
+               iovar_buf, WLC_IOCTL_MAXLEN, NULL);
+       if (unlikely(err)) {
+               WL_ERR(("error (%d) - size = %zu\n", err, sizeof(wl_cnt_wlc_t)));
+               goto exit;
+       }
+
+       CHK_CNTBUF_DATALEN(iovar_buf, WLC_IOCTL_MAXLEN);
+       /* Translate traditional (ver <= 10) counters struct to new xtlv type struct */
+       /* traditional(ver<=10)counters will use WL_CNT_XTLV_CNTV_LE10_UCODE.
+        * Other cases will use its xtlv type accroding to corerev
+        */
+       err = wl_cntbuf_to_xtlv_format(NULL, iovar_buf, WLC_IOCTL_MAXLEN, revinfo.corerev);
+       if (err != BCME_OK) {
+               WL_ERR(("wl_cntbuf_to_xtlv_format ERR %d\n", err));
+               goto exit;
+       }
+
+       if (!(wlc_cnt = GET_WLCCNT_FROM_CNTBUF(iovar_buf))) {
+               WL_ERR(("wlc_cnt NULL!\n"));
+               err = BCME_ERROR;
+               goto exit;
+       }
+
+#ifndef DISABLE_IF_COUNTERS
+       if_stats = (wl_if_stats_t *)MALLOCZ(cfg->osh, sizeof(wl_if_stats_t));
+       if (!if_stats) {
+           WL_ERR(("MALLOCZ failed\n"));
+           err = BCME_NOMEM;
+           goto exit;
+       }
+
+       if (FW_SUPPORTED(dhdp, ifst)) {
+               err = wl_cfg80211_ifstats_counters(bcmcfg_to_prmry_ndev(cfg), if_stats);
+       } else {
+               err = wldev_iovar_getbuf(bcmcfg_to_prmry_ndev(cfg), "if_counters",
+                       NULL, 0, (char *)if_stats, sizeof(*if_stats), NULL);
+       }
+
+       if (!err) {
+               /* Populate from if_stats */
+               if (dtoh16(if_stats->version) > WL_IF_STATS_T_VERSION) {
+                       WL_ERR(("incorrect version of wl_if_stats_t,"
+                               " expected=%u got=%u\n", WL_IF_STATS_T_VERSION,
+                               if_stats->version));
+                       goto exit;
+               }
+               COMPAT_ASSIGN_VALUE(iface, ac[WIFI_AC_BE].tx_mpdu,
+                       (uint32)(if_stats->txfrmsnt - if_stats->txmulti));
+               COMPAT_ASSIGN_VALUE(iface, ac[WIFI_AC_BE].rx_mpdu, (uint32)if_stats->rxframe);
+               COMPAT_ASSIGN_VALUE(iface, ac[WIFI_AC_BE].mpdu_lost, (uint32)if_stats->txfail);
+               COMPAT_ASSIGN_VALUE(iface, ac[WIFI_AC_BE].retries, (uint32)if_stats->txretrans);
+       } else
+#endif /* !DISABLE_IF_COUNTERS */
+       {
+               COMPAT_ASSIGN_VALUE(iface, ac[WIFI_AC_BE].tx_mpdu,
+                       (wlc_cnt->txfrmsnt - wlc_cnt->txmulti));
+               COMPAT_ASSIGN_VALUE(iface, ac[WIFI_AC_BE].rx_mpdu, wlc_cnt->rxframe);
+               COMPAT_ASSIGN_VALUE(iface, ac[WIFI_AC_BE].mpdu_lost, wlc_cnt->txfail);
+               COMPAT_ASSIGN_VALUE(iface, ac[WIFI_AC_BE].retries, wlc_cnt->txretrans);
+       }
+
+       err = wl_cfgvendor_lstats_get_bcn_mbss(iovar_buf, &rxbeaconmbss);
+       if (unlikely(err)) {
+               WL_ERR(("get_bcn_mbss error (%d)\n", err));
+               goto exit;
+       }
+
+       err = wldev_get_rssi(bcmcfg_to_prmry_ndev(cfg), &scbval);
+       if (unlikely(err)) {
+               WL_ERR(("get_rssi error (%d)\n", err));
+               goto exit;
+       }
+
+       COMPAT_ASSIGN_VALUE(iface, beacon_rx, rxbeaconmbss);
+       COMPAT_ASSIGN_VALUE(iface, rssi_mgmt, scbval.val);
+       COMPAT_ASSIGN_VALUE(iface, num_peers, NUM_PEER);
+       COMPAT_ASSIGN_VALUE(iface, peer_info->num_rate, NUM_RATE);
+
+       COMPAT_MEMCOPY_IFACE(output, total_len, wifi_iface_stat, iface, wifi_rate_stat);
+
+       err = wldev_iovar_getbuf(bcmcfg_to_prmry_ndev(cfg), "ratestat", NULL, 0,
+               iovar_buf, WLC_IOCTL_MAXLEN, NULL);
+       if (err != BCME_OK && err != BCME_UNSUPPORTED) {
+               WL_ERR(("error (%d) - size = %zu\n", err, NUM_RATE*sizeof(wifi_rate_stat)));
+               goto exit;
+       }
+       for (i = 0; i < NUM_RATE; i++) {
+               p_wifi_rate_stat =
+                       (wifi_rate_stat *)(iovar_buf + i*sizeof(wifi_rate_stat));
+               p_wifi_rate_stat_v1 = (wifi_rate_stat_v1 *)output;
+               p_wifi_rate_stat_v1->rate.preamble = p_wifi_rate_stat->rate.preamble;
+               p_wifi_rate_stat_v1->rate.nss = p_wifi_rate_stat->rate.nss;
+               p_wifi_rate_stat_v1->rate.bw = p_wifi_rate_stat->rate.bw;
+               p_wifi_rate_stat_v1->rate.rateMcsIdx = p_wifi_rate_stat->rate.rateMcsIdx;
+               p_wifi_rate_stat_v1->rate.reserved = p_wifi_rate_stat->rate.reserved;
+               p_wifi_rate_stat_v1->rate.bitrate = p_wifi_rate_stat->rate.bitrate;
+               p_wifi_rate_stat_v1->tx_mpdu = p_wifi_rate_stat->tx_mpdu;
+               p_wifi_rate_stat_v1->rx_mpdu = p_wifi_rate_stat->rx_mpdu;
+               p_wifi_rate_stat_v1->mpdu_lost = p_wifi_rate_stat->mpdu_lost;
+               p_wifi_rate_stat_v1->retries = p_wifi_rate_stat->retries;
+               p_wifi_rate_stat_v1->retries_short = p_wifi_rate_stat->retries_short;
+               p_wifi_rate_stat_v1->retries_long = p_wifi_rate_stat->retries_long;
+               output = (char *) &(p_wifi_rate_stat_v1->retries_long);
+               output += sizeof(p_wifi_rate_stat_v1->retries_long);
+       }
+
+       total_len = sizeof(wifi_radio_stat_h) +
+               NUM_CHAN * sizeof(wifi_channel_stat);
+
+       total_len = total_len - sizeof(wifi_peer_info) +
+               NUM_PEER * (sizeof(wifi_peer_info) - sizeof(wifi_rate_stat_v1) +
+                       NUM_RATE * sizeof(wifi_rate_stat_v1));
+
+       if (total_len > WLC_IOCTL_MAXLEN) {
+               WL_ERR(("Error! total_len:%d is unexpected value\n", total_len));
+               err = BCME_BADLEN;
+               goto exit;
+       }
+       err =  wl_cfgvendor_send_cmd_reply(wiphy, outdata, total_len);
+
+       if (unlikely(err))
+               WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+
+exit:
+       if (outdata) {
+               MFREE(cfg->osh, outdata, WLC_IOCTL_MAXLEN);
+       }
+       if (if_stats) {
+               MFREE(cfg->osh, if_stats, sizeof(wl_if_stats_t));
+       }
+       return err;
+}
+#endif /* LINKSTAT_SUPPORT */
+
+#ifdef DHD_LOG_DUMP
+static int
+wl_cfgvendor_get_buf_data(const struct nlattr *iter, struct buf_data **buf)
+{
+       int ret = BCME_OK;
+
+       if (nla_len(iter) != sizeof(struct buf_data)) {
+               WL_ERR(("Invalid len : %d\n", nla_len(iter)));
+               ret = BCME_BADLEN;
+       }
+       (*buf) = (struct buf_data *)nla_data(iter);
+       if (!(*buf) || (((*buf)->len) <= 0) || !((*buf)->data_buf[0])) {
+               WL_ERR(("Invalid buffer\n"));
+               ret = BCME_ERROR;
+       }
+       return ret;
+}
+
+static int
+wl_cfgvendor_dbg_file_dump(struct wiphy *wiphy,
+               struct wireless_dev *wdev, const void *data, int len)
+{
+       int ret = BCME_OK, rem, type = 0;
+       const struct nlattr *iter;
+       char *mem_buf = NULL;
+       struct sk_buff *skb = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct buf_data *buf;
+       int pos = 0;
+
+       /* Alloc the SKB for vendor_event */
+       skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, CFG80211_VENDOR_CMD_REPLY_SKB_SZ);
+       if (!skb) {
+               WL_ERR(("skb allocation is failed\n"));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+       WL_ERR(("%s\n", __FUNCTION__));
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               ret = wl_cfgvendor_get_buf_data(iter, &buf);
+               if (ret)
+                       goto exit;
+               switch (type) {
+                       case DUMP_BUF_ATTR_MEMDUMP:
+                               ret = dhd_os_get_socram_dump(bcmcfg_to_prmry_ndev(cfg), &mem_buf,
+                                       (uint32 *)(&(buf->len)));
+                               if (ret) {
+                                       WL_ERR(("failed to get_socram_dump : %d\n", ret));
+                                       goto exit;
+                               }
+                               ret = dhd_export_debug_data(mem_buf, NULL, buf->data_buf[0],
+                                       (int)buf->len, &pos);
+                               break;
+
+                       case DUMP_BUF_ATTR_TIMESTAMP :
+                               ret = dhd_print_time_str(buf->data_buf[0], NULL,
+                                       (uint32)buf->len, &pos);
+                               break;
+#ifdef EWP_ECNTRS_LOGGING
+                       case DUMP_BUF_ATTR_ECNTRS :
+                               ret = dhd_print_ecntrs_data(bcmcfg_to_prmry_ndev(cfg), NULL,
+                                       buf->data_buf[0], NULL, (uint32)buf->len, &pos);
+                               break;
+#endif /* EWP_ECNTRS_LOGGING */
+#ifdef DHD_STATUS_LOGGING
+                       case DUMP_BUF_ATTR_STATUS_LOG :
+                               ret = dhd_print_status_log_data(bcmcfg_to_prmry_ndev(cfg), NULL,
+                                       buf->data_buf[0], NULL, (uint32)buf->len, &pos);
+                               break;
+#endif /* DHD_STATUS_LOGGING */
+#ifdef EWP_RTT_LOGGING
+                       case DUMP_BUF_ATTR_RTT_LOG :
+                               ret = dhd_print_rtt_data(bcmcfg_to_prmry_ndev(cfg), NULL,
+                                       buf->data_buf[0], NULL, (uint32)buf->len, &pos);
+                               break;
+#endif /* EWP_RTT_LOGGING */
+                       case DUMP_BUF_ATTR_DHD_DUMP :
+                               ret = dhd_print_dump_data(bcmcfg_to_prmry_ndev(cfg), NULL,
+                                       buf->data_buf[0], NULL, (uint32)buf->len, &pos);
+                               break;
+#if defined(BCMPCIE)
+                       case DUMP_BUF_ATTR_EXT_TRAP :
+                               ret = dhd_print_ext_trap_data(bcmcfg_to_prmry_ndev(cfg), NULL,
+                                       buf->data_buf[0], NULL, (uint32)buf->len, &pos);
+                               break;
+#endif /* BCMPCIE */
+#if defined(DHD_FW_COREDUMP) && defined(DNGL_EVENT_SUPPORT)
+                       case DUMP_BUF_ATTR_HEALTH_CHK :
+                               ret = dhd_print_health_chk_data(bcmcfg_to_prmry_ndev(cfg), NULL,
+                                       buf->data_buf[0], NULL, (uint32)buf->len, &pos);
+                               break;
+#endif
+                       case DUMP_BUF_ATTR_COOKIE :
+                               ret = dhd_print_cookie_data(bcmcfg_to_prmry_ndev(cfg), NULL,
+                                       buf->data_buf[0], NULL, (uint32)buf->len, &pos);
+                               break;
+#ifdef DHD_DUMP_PCIE_RINGS
+                       case DUMP_BUF_ATTR_FLOWRING_DUMP :
+                               ret = dhd_print_flowring_data(bcmcfg_to_prmry_ndev(cfg), NULL,
+                                       buf->data_buf[0], NULL, (uint32)buf->len, &pos);
+                               break;
+#endif
+                       case DUMP_BUF_ATTR_GENERAL_LOG :
+                               ret = dhd_get_dld_log_dump(bcmcfg_to_prmry_ndev(cfg), NULL,
+                                       buf->data_buf[0], NULL, (uint32)buf->len,
+                                       DLD_BUF_TYPE_GENERAL, &pos);
+                               break;
+
+                       case DUMP_BUF_ATTR_PRESERVE_LOG :
+                               ret = dhd_get_dld_log_dump(bcmcfg_to_prmry_ndev(cfg), NULL,
+                                       buf->data_buf[0], NULL, (uint32)buf->len,
+                                       DLD_BUF_TYPE_PRESERVE, &pos);
+                               break;
+
+                       case DUMP_BUF_ATTR_SPECIAL_LOG :
+                               ret = dhd_get_dld_log_dump(bcmcfg_to_prmry_ndev(cfg), NULL,
+                                       buf->data_buf[0], NULL, (uint32)buf->len,
+                                       DLD_BUF_TYPE_SPECIAL, &pos);
+                               break;
+#ifdef DHD_SSSR_DUMP
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+                       case DUMP_BUF_ATTR_SSSR_C0_D11_BEFORE :
+                               ret = dhd_sssr_dump_d11_buf_before(bcmcfg_to_prmry_ndev(cfg),
+                                       buf->data_buf[0], (uint32)buf->len, 0);
+                               break;
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+                       case DUMP_BUF_ATTR_SSSR_C0_D11_AFTER :
+                               ret = dhd_sssr_dump_d11_buf_after(bcmcfg_to_prmry_ndev(cfg),
+                                       buf->data_buf[0], (uint32)buf->len, 0);
+                               break;
+
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+                       case DUMP_BUF_ATTR_SSSR_C1_D11_BEFORE :
+                               ret = dhd_sssr_dump_d11_buf_before(bcmcfg_to_prmry_ndev(cfg),
+                                       buf->data_buf[0], (uint32)buf->len, 1);
+                               break;
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+                       case DUMP_BUF_ATTR_SSSR_C1_D11_AFTER :
+                               ret = dhd_sssr_dump_d11_buf_after(bcmcfg_to_prmry_ndev(cfg),
+                                       buf->data_buf[0], (uint32)buf->len, 1);
+                               break;
+
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+                       case DUMP_BUF_ATTR_SSSR_C2_D11_BEFORE :
+                               ret = dhd_sssr_dump_d11_buf_before(bcmcfg_to_prmry_ndev(cfg),
+                                       buf->data_buf[0], (uint32)buf->len, 2);
+                               break;
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+                       case DUMP_BUF_ATTR_SSSR_C2_D11_AFTER :
+                               ret = dhd_sssr_dump_d11_buf_after(bcmcfg_to_prmry_ndev(cfg),
+                                       buf->data_buf[0], (uint32)buf->len, 2);
+                               break;
+
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+                       case DUMP_BUF_ATTR_SSSR_DIG_BEFORE :
+                               ret = dhd_sssr_dump_dig_buf_before(bcmcfg_to_prmry_ndev(cfg),
+                                       buf->data_buf[0], (uint32)buf->len);
+                               break;
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+                       case DUMP_BUF_ATTR_SSSR_DIG_AFTER :
+                               ret = dhd_sssr_dump_dig_buf_after(bcmcfg_to_prmry_ndev(cfg),
+                                       buf->data_buf[0], (uint32)buf->len);
+                               break;
+#endif /* DHD_SSSR_DUMP */
+#ifdef DHD_PKT_LOGGING
+                       case DUMP_BUF_ATTR_PKTLOG:
+                               ret = dhd_os_get_pktlog_dump(bcmcfg_to_prmry_ndev(cfg),
+                                       buf->data_buf[0], (uint32)buf->len);
+                               break;
+
+                       case DUMP_BUF_ATTR_PKTLOG_DEBUG:
+                               ret = dhd_os_get_pktlog_dump(bcmcfg_to_prmry_ndev(cfg),
+                                       buf->data_buf[0], (uint32)buf->len);
+                               break;
+#endif /* DHD_PKT_LOGGING */
+#ifdef DNGL_AXI_ERROR_LOGGING
+                       case DUMP_BUF_ATTR_AXI_ERROR:
+                               ret = dhd_os_get_axi_error_dump(bcmcfg_to_prmry_ndev(cfg),
+                                       buf->data_buf[0], (uint32)buf->len);
+                               break;
+#endif /* DNGL_AXI_ERROR_LOGGING */
+                       default:
+                               WL_ERR(("Unknown type: %d\n", type));
+                               ret = BCME_ERROR;
+                               goto exit;
+               }
+       }
+
+       if (ret)
+               goto exit;
+
+       ret = nla_put_u32(skb, type, (uint32)(ret));
+       if (ret < 0) {
+               WL_ERR(("Failed to put type, ret:%d\n", ret));
+               goto exit;
+       }
+       ret = cfg80211_vendor_cmd_reply(skb);
+       if (ret) {
+               WL_ERR(("Vendor Command reply failed ret:%d \n", ret));
+       }
+       return ret;
+exit:
+       if (skb) {
+               /* Free skb memory */
+               kfree_skb(skb);
+       }
+       return ret;
+}
+#endif /* DHD_LOG_DUMP */
+
+#ifdef DEBUGABILITY
+static int
+wl_cfgvendor_dbg_trigger_mem_dump(struct wiphy *wiphy,
+               struct wireless_dev *wdev, const void  *data, int len)
+{
+       int ret = BCME_OK;
+       uint32 alloc_len;
+       struct sk_buff *skb = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       WL_ERR(("wl_cfgvendor_dbg_trigger_mem_dump %d\n", __LINE__));
+
+       dhdp->memdump_type = DUMP_TYPE_CFG_VENDOR_TRIGGERED;
+       ret = dhd_os_socram_dump(bcmcfg_to_prmry_ndev(cfg), &alloc_len);
+       if (ret) {
+               WL_ERR(("failed to call dhd_os_socram_dump : %d\n", ret));
+               goto exit;
+       }
+       /* Alloc the SKB for vendor_event */
+       skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, CFG80211_VENDOR_CMD_REPLY_SKB_SZ);
+       if (!skb) {
+               WL_ERR(("skb allocation is failed\n"));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+       ret = nla_put_u32(skb, DEBUG_ATTRIBUTE_FW_DUMP_LEN, alloc_len);
+
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to put fw dump length, ret=%d\n", ret));
+               goto exit;
+       }
+
+       ret = cfg80211_vendor_cmd_reply(skb);
+
+       if (ret) {
+               WL_ERR(("Vendor Command reply failed ret:%d \n", ret));
+               goto exit;
+       }
+       return ret;
+exit:
+       /* Free skb memory */
+       if (skb) {
+               kfree_skb(skb);
+       }
+       return ret;
+}
+
+static int
+wl_cfgvendor_dbg_get_mem_dump(struct wiphy *wiphy,
+               struct wireless_dev *wdev, const void *data, int len)
+{
+       int ret = BCME_OK, rem, type;
+       int buf_len = 0;
+       uintptr_t user_buf = (uintptr_t)NULL;
+       const struct nlattr *iter;
+       char *mem_buf = NULL;
+       struct sk_buff *skb = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               switch (type) {
+                       case DEBUG_ATTRIBUTE_FW_DUMP_LEN:
+                               /* Check if the iter is valid and
+                                * buffer length is not already initialized.
+                                */
+                               if ((nla_len(iter) == sizeof(uint32)) &&
+                                               !buf_len) {
+                                       buf_len = nla_get_u32(iter);
+                                       if (buf_len <= 0) {
+                                               ret = BCME_ERROR;
+                                               goto exit;
+                                       }
+                               } else {
+                                       ret = BCME_ERROR;
+                                       goto exit;
+                               }
+                               break;
+                       case DEBUG_ATTRIBUTE_FW_DUMP_DATA:
+                               if (nla_len(iter) != sizeof(uint64)) {
+                                       WL_ERR(("Invalid len\n"));
+                                       ret = BCME_ERROR;
+                                       goto exit;
+                               }
+                               user_buf = (uintptr_t)nla_get_u64(iter);
+                               if (!user_buf) {
+                                       ret = BCME_ERROR;
+                                       goto exit;
+                               }
+                               break;
+                       default:
+                               WL_ERR(("Unknown type: %d\n", type));
+                               ret = BCME_ERROR;
+                               goto exit;
+               }
+       }
+       if (buf_len > 0 && user_buf) {
+#if 0
+               mem_buf = vmalloc(buf_len);
+               if (!mem_buf) {
+                       WL_ERR(("failed to allocate mem_buf with size : %d\n", buf_len));
+                       ret = BCME_NOMEM;
+                       goto exit;
+               }
+#endif
+               ret = dhd_os_get_socram_dump(bcmcfg_to_prmry_ndev(cfg), &mem_buf, &buf_len);
+               if (ret) {
+                       WL_ERR(("failed to get_socram_dump : %d\n", ret));
+                       goto free_mem;
+               }
+#ifdef CONFIG_COMPAT
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 6, 0))
+               if (in_compat_syscall())
+#else
+               if (is_compat_task())
+#endif /* LINUX_VER >= 4.6 */
+               {
+                       void * usr_ptr =  compat_ptr((uintptr_t) user_buf);
+                       ret = copy_to_user(usr_ptr, mem_buf, buf_len);
+                       if (ret) {
+                               WL_ERR(("failed to copy memdump into user buffer : %d\n", ret));
+                               goto free_mem;
+                       }
+               }
+               else
+#endif /* CONFIG_COMPAT */
+               {
+                       ret = copy_to_user((void*)user_buf, mem_buf, buf_len);
+                       if (ret) {
+                               WL_ERR(("failed to copy memdump into user buffer : %d\n", ret));
+                               goto free_mem;
+                       }
+               }
+               /* Alloc the SKB for vendor_event */
+               skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, CFG80211_VENDOR_CMD_REPLY_SKB_SZ);
+               if (!skb) {
+                       WL_ERR(("skb allocation is failed\n"));
+                       ret = BCME_NOMEM;
+                       goto free_mem;
+               }
+               /* Indicate the memdump is succesfully copied */
+               ret = nla_put(skb, DEBUG_ATTRIBUTE_FW_DUMP_DATA, sizeof(ret), &ret);
+               if (ret < 0) {
+                       WL_ERR(("Failed to put DEBUG_ATTRIBUTE_FW_DUMP_DATA, ret:%d\n", ret));
+                       goto free_mem;
+               }
+
+               ret = cfg80211_vendor_cmd_reply(skb);
+
+               if (ret) {
+                       WL_ERR(("Vendor Command reply failed ret:%d \n", ret));
+               }
+               skb = NULL;
+       }
+
+free_mem:
+//     vfree(mem_buf);
+       /* Free skb memory */
+       if (skb) {
+               kfree_skb(skb);
+       }
+exit:
+       return ret;
+}
+
+static int wl_cfgvendor_dbg_start_logging(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int ret = BCME_OK, rem, type;
+       char ring_name[DBGRING_NAME_MAX] = {0};
+       int log_level = 0, flags = 0, time_intval = 0, threshold = 0;
+       const struct nlattr *iter;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhd_pub = cfg->pub;
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               switch (type) {
+                       case DEBUG_ATTRIBUTE_RING_NAME:
+                               strncpy(ring_name, nla_data(iter),
+                                       MIN(sizeof(ring_name) -1, nla_len(iter)));
+                               break;
+                       case DEBUG_ATTRIBUTE_LOG_LEVEL:
+                               log_level = nla_get_u32(iter);
+                               break;
+                       case DEBUG_ATTRIBUTE_RING_FLAGS:
+                               flags = nla_get_u32(iter);
+                               break;
+                       case DEBUG_ATTRIBUTE_LOG_TIME_INTVAL:
+                               time_intval = nla_get_u32(iter);
+                               break;
+                       case DEBUG_ATTRIBUTE_LOG_MIN_DATA_SIZE:
+                               threshold = nla_get_u32(iter);
+                               break;
+                       default:
+                               WL_ERR(("Unknown type: %d\n", type));
+                               ret = BCME_BADADDR;
+                               goto exit;
+               }
+       }
+
+       ret = dhd_os_start_logging(dhd_pub, ring_name, log_level, flags, time_intval, threshold);
+       if (ret < 0) {
+               WL_ERR(("start_logging is failed ret: %d\n", ret));
+       }
+exit:
+       return ret;
+}
+
+static int wl_cfgvendor_dbg_reset_logging(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int ret = BCME_OK;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhd_pub = cfg->pub;
+
+       ret = dhd_os_reset_logging(dhd_pub);
+       if (ret < 0) {
+               WL_ERR(("reset logging is failed ret: %d\n", ret));
+       }
+
+       return ret;
+}
+
+static int wl_cfgvendor_dbg_get_ring_status(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int ret = BCME_OK;
+       int ring_id, i;
+       int ring_cnt;
+       struct sk_buff *skb;
+       dhd_dbg_ring_status_t dbg_ring_status[DEBUG_RING_ID_MAX];
+       dhd_dbg_ring_status_t ring_status;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhd_pub = cfg->pub;
+       bzero(dbg_ring_status, DBG_RING_STATUS_SIZE * DEBUG_RING_ID_MAX);
+       ring_cnt = 0;
+       for (ring_id = DEBUG_RING_ID_INVALID + 1; ring_id < DEBUG_RING_ID_MAX; ring_id++) {
+               ret = dhd_os_get_ring_status(dhd_pub, ring_id, &ring_status);
+               if (ret == BCME_NOTFOUND) {
+                       WL_DBG(("The ring (%d) is not found \n", ring_id));
+               } else if (ret == BCME_OK) {
+                       dbg_ring_status[ring_cnt++] = ring_status;
+               }
+       }
+       /* Alloc the SKB for vendor_event */
+       skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy,
+               nla_total_size(DBG_RING_STATUS_SIZE) * ring_cnt + nla_total_size(sizeof(ring_cnt)));
+       if (!skb) {
+               WL_ERR(("skb allocation is failed\n"));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+
+       /* Ignore return of nla_put_u32 and nla_put since the skb allocated
+        * above has a requested size for all payload
+        */
+       (void)nla_put_u32(skb, DEBUG_ATTRIBUTE_RING_NUM, ring_cnt);
+       for (i = 0; i < ring_cnt; i++) {
+               (void)nla_put(skb, DEBUG_ATTRIBUTE_RING_STATUS, DBG_RING_STATUS_SIZE,
+                               &dbg_ring_status[i]);
+       }
+       ret = cfg80211_vendor_cmd_reply(skb);
+
+       if (ret) {
+               WL_ERR(("Vendor Command reply failed ret:%d \n", ret));
+       }
+exit:
+       return ret;
+}
+
+static int wl_cfgvendor_dbg_get_ring_data(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int ret = BCME_OK, rem, type;
+       char ring_name[DBGRING_NAME_MAX] = {0};
+       const struct nlattr *iter;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhd_pub = cfg->pub;
+
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               switch (type) {
+                       case DEBUG_ATTRIBUTE_RING_NAME:
+                               strlcpy(ring_name, nla_data(iter), sizeof(ring_name));
+                               break;
+                       default:
+                               WL_ERR(("Unknown type: %d\n", type));
+                               return ret;
+               }
+       }
+
+       ret = dhd_os_trigger_get_ring_data(dhd_pub, ring_name);
+       if (ret < 0) {
+               WL_ERR(("trigger_get_data failed ret:%d\n", ret));
+       }
+
+       return ret;
+}
+#endif /* DEBUGABILITY */
+
+static int wl_cfgvendor_dbg_get_feature(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int ret = BCME_OK;
+       u32 supported_features = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhd_pub = cfg->pub;
+
+       ret = dhd_os_dbg_get_feature(dhd_pub, &supported_features);
+       if (ret < 0) {
+               WL_ERR(("dbg_get_feature failed ret:%d\n", ret));
+               goto exit;
+       }
+       ret = wl_cfgvendor_send_cmd_reply(wiphy, &supported_features,
+               sizeof(supported_features));
+exit:
+       return ret;
+}
+
+#ifdef DEBUGABILITY
+static void wl_cfgvendor_dbg_ring_send_evt(void *ctx,
+       const int ring_id, const void *data, const uint32 len,
+       const dhd_dbg_ring_status_t ring_status)
+{
+       struct net_device *ndev = ctx;
+       struct wiphy *wiphy;
+       gfp_t kflags;
+       struct sk_buff *skb;
+       if (!ndev) {
+               WL_ERR(("ndev is NULL\n"));
+               return;
+       }
+       kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+       wiphy = ndev->ieee80211_ptr->wiphy;
+       /* Alloc the SKB for vendor_event */
+#if (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || \
+       LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+       skb = cfg80211_vendor_event_alloc(wiphy, NULL, len + 100,
+                       GOOGLE_DEBUG_RING_EVENT, kflags);
+#else
+       skb = cfg80211_vendor_event_alloc(wiphy, len + 100,
+                       GOOGLE_DEBUG_RING_EVENT, kflags);
+#endif /* (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || */
+               /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0) */
+       if (!skb) {
+               WL_ERR(("skb alloc failed"));
+               return;
+       }
+       nla_put(skb, DEBUG_ATTRIBUTE_RING_STATUS, sizeof(ring_status), &ring_status);
+       nla_put(skb, DEBUG_ATTRIBUTE_RING_DATA, len, data);
+       cfg80211_vendor_event(skb, kflags);
+}
+#endif /* DEBUGABILITY */
+
+#ifdef DHD_LOG_DUMP
+#ifdef DHD_SSSR_DUMP
+#define DUMP_SSSR_DUMP_MAX_COUNT       8
+static int wl_cfgvendor_nla_put_sssr_dump_data(struct sk_buff *skb,
+               struct net_device *ndev)
+{
+       int ret = BCME_OK;
+#ifdef DHD_SSSR_DUMP
+       uint32 arr_len[DUMP_SSSR_DUMP_MAX_COUNT];
+#endif /* DHD_SSSR_DUMP */
+       char memdump_path[MEMDUMP_PATH_LEN];
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(ndev);
+
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+       dhd_get_memdump_filename(ndev, memdump_path, MEMDUMP_PATH_LEN,
+               "sssr_dump_core_0_before_SR");
+       ret = nla_put_string(skb, DUMP_FILENAME_ATTR_SSSR_CORE_0_BEFORE_DUMP, memdump_path);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to nla put sssr core 0 before dump path, ret=%d\n", ret));
+               goto exit;
+       }
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+       dhd_get_memdump_filename(ndev, memdump_path, MEMDUMP_PATH_LEN,
+               "sssr_dump_core_0_after_SR");
+       ret = nla_put_string(skb, DUMP_FILENAME_ATTR_SSSR_CORE_0_AFTER_DUMP, memdump_path);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to nla put sssr core 1 after dump path, ret=%d\n", ret));
+               goto exit;
+       }
+
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+       dhd_get_memdump_filename(ndev, memdump_path, MEMDUMP_PATH_LEN,
+               "sssr_dump_core_1_before_SR");
+       ret = nla_put_string(skb, DUMP_FILENAME_ATTR_SSSR_CORE_1_BEFORE_DUMP, memdump_path);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to nla put sssr core 1 before dump path, ret=%d\n", ret));
+               goto exit;
+       }
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+       dhd_get_memdump_filename(ndev, memdump_path, MEMDUMP_PATH_LEN,
+               "sssr_dump_core_1_after_SR");
+       ret = nla_put_string(skb, DUMP_FILENAME_ATTR_SSSR_CORE_1_AFTER_DUMP, memdump_path);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to nla put sssr core 1 after dump path, ret=%d\n", ret));
+               goto exit;
+       }
+
+       if (dhdp->sssr_d11_outofreset[2]) {
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+               dhd_get_memdump_filename(ndev, memdump_path, MEMDUMP_PATH_LEN,
+                       "sssr_dump_core_2_before_SR");
+               ret = nla_put_string(skb, DUMP_FILENAME_ATTR_SSSR_CORE_2_BEFORE_DUMP,
+                       memdump_path);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to nla put sssr core 2 before dump path, ret=%d\n",
+                               ret));
+                       goto exit;
+               }
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+               dhd_get_memdump_filename(ndev, memdump_path, MEMDUMP_PATH_LEN,
+                       "sssr_dump_core_2_after_SR");
+               ret = nla_put_string(skb, DUMP_FILENAME_ATTR_SSSR_CORE_2_AFTER_DUMP,
+                       memdump_path);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to nla put sssr core 2 after dump path, ret=%d\n",
+                               ret));
+                       goto exit;
+               }
+       }
+
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+       dhd_get_memdump_filename(ndev, memdump_path, MEMDUMP_PATH_LEN,
+               "sssr_dump_dig_before_SR");
+       ret = nla_put_string(skb, DUMP_FILENAME_ATTR_SSSR_DIG_BEFORE_DUMP, memdump_path);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to nla put sssr dig before dump path, ret=%d\n", ret));
+               goto exit;
+       }
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+
+       dhd_get_memdump_filename(ndev, memdump_path, MEMDUMP_PATH_LEN,
+               "sssr_dump_dig_after_SR");
+       ret = nla_put_string(skb, DUMP_FILENAME_ATTR_SSSR_DIG_AFTER_DUMP, memdump_path);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to nla put sssr dig after dump path, ret=%d\n", ret));
+               goto exit;
+       }
+
+#ifdef DHD_SSSR_DUMP
+       memset(arr_len, 0, sizeof(arr_len));
+       dhd_nla_put_sssr_dump_len(ndev, arr_len);
+#ifdef DHD_SSSR_DUMP_BEFORE_SR
+       ret |= nla_put_u32(skb, DUMP_LEN_ATTR_SSSR_C0_D11_BEFORE, arr_len[0]);
+       ret |= nla_put_u32(skb, DUMP_LEN_ATTR_SSSR_C1_D11_BEFORE, arr_len[2]);
+       ret |= nla_put_u32(skb, DUMP_LEN_ATTR_SSSR_C2_D11_BEFORE, arr_len[4]);
+       ret |= nla_put_u32(skb, DUMP_LEN_ATTR_SSSR_DIG_BEFORE, arr_len[6]);
+#endif /* DHD_SSSR_DUMP_BEFORE_SR */
+       ret |= nla_put_u32(skb, DUMP_LEN_ATTR_SSSR_C0_D11_AFTER, arr_len[1]);
+       ret |= nla_put_u32(skb, DUMP_LEN_ATTR_SSSR_C1_D11_AFTER, arr_len[3]);
+       ret |= nla_put_u32(skb, DUMP_LEN_ATTR_SSSR_C2_D11_AFTER, arr_len[5]);
+       ret |= nla_put_u32(skb, DUMP_LEN_ATTR_SSSR_DIG_AFTER, arr_len[7]);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to nla put sssr dump len, ret=%d\n", ret));
+               goto exit;
+       }
+#endif /* DHD_SSSR_DUMP */
+
+exit:
+       return ret;
+}
+#else
+static int wl_cfgvendor_nla_put_sssr_dump_data(struct sk_buff *skb,
+               struct net_device *ndev)
+{
+       return BCME_OK;
+}
+#endif /* DHD_SSSR_DUMP */
+
+static int wl_cfgvendor_nla_put_debug_dump_data(struct sk_buff *skb,
+               struct net_device *ndev)
+{
+       int ret = BCME_OK;
+       uint32 len = 0;
+       char dump_path[128];
+
+       ret = dhd_get_debug_dump_file_name(ndev, NULL, dump_path, sizeof(dump_path));
+       if (ret < 0) {
+               WL_ERR(("%s: Failed to get debug dump filename\n", __FUNCTION__));
+               goto exit;
+       }
+       ret = nla_put_string(skb, DUMP_FILENAME_ATTR_DEBUG_DUMP, dump_path);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to nla put debug dump path, ret=%d\n", ret));
+               goto exit;
+       }
+       WL_ERR(("debug_dump path = %s%s\n", dump_path, FILE_NAME_HAL_TAG));
+       wl_print_verinfo(wl_get_cfg(ndev));
+
+       len = dhd_get_time_str_len();
+       if (len) {
+               ret = nla_put_u32(skb, DUMP_LEN_ATTR_TIMESTAMP, len);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to nla put time stamp length, ret=%d\n", ret));
+                       goto exit;
+               }
+       }
+
+       len = dhd_get_dld_len(DLD_BUF_TYPE_GENERAL);
+       if (len) {
+               ret = nla_put_u32(skb, DUMP_LEN_ATTR_GENERAL_LOG, len);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to nla put general log length, ret=%d\n", ret));
+                       goto exit;
+               }
+       }
+#ifdef EWP_ECNTRS_LOGGING
+       len = dhd_get_ecntrs_len(ndev, NULL);
+       if (len) {
+               ret = nla_put_u32(skb, DUMP_LEN_ATTR_ECNTRS, len);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to nla put ecntrs length, ret=%d\n", ret));
+                       goto exit;
+               }
+       }
+#endif /* EWP_ECNTRS_LOGGING */
+       len = dhd_get_dld_len(DLD_BUF_TYPE_SPECIAL);
+       if (len) {
+               ret = nla_put_u32(skb, DUMP_LEN_ATTR_SPECIAL_LOG, len);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to nla put special log length, ret=%d\n", ret));
+                       goto exit;
+               }
+       }
+       len = dhd_get_dhd_dump_len(ndev, NULL);
+       if (len) {
+               ret = nla_put_u32(skb, DUMP_LEN_ATTR_DHD_DUMP, len);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to nla put dhd dump length, ret=%d\n", ret));
+                       goto exit;
+               }
+       }
+
+#if defined(BCMPCIE)
+       len = dhd_get_ext_trap_len(ndev, NULL);
+       if (len) {
+               ret = nla_put_u32(skb, DUMP_LEN_ATTR_EXT_TRAP, len);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to nla put ext trap length, ret=%d\n", ret));
+                       goto exit;
+               }
+       }
+#endif /* BCMPCIE */
+
+#if defined(DHD_FW_COREDUMP) && defined(DNGL_EVENT_SUPPORT)
+       len = dhd_get_health_chk_len(ndev, NULL);
+       if (len) {
+               ret = nla_put_u32(skb, DUMP_LEN_ATTR_HEALTH_CHK, len);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to nla put health check length, ret=%d\n", ret));
+                       goto exit;
+               }
+       }
+#endif
+
+       len = dhd_get_dld_len(DLD_BUF_TYPE_PRESERVE);
+       if (len) {
+               ret = nla_put_u32(skb, DUMP_LEN_ATTR_PRESERVE_LOG, len);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to nla put preserve log length, ret=%d\n", ret));
+                       goto exit;
+               }
+       }
+
+       len = dhd_get_cookie_log_len(ndev, NULL);
+       if (len) {
+               ret = nla_put_u32(skb, DUMP_LEN_ATTR_COOKIE, len);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to nla put cookie length, ret=%d\n", ret));
+                       goto exit;
+               }
+       }
+#ifdef DHD_DUMP_PCIE_RINGS
+       len = dhd_get_flowring_len(ndev, NULL);
+       if (len) {
+               ret = nla_put_u32(skb, DUMP_LEN_ATTR_FLOWRING_DUMP, len);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to nla put flowring dump length, ret=%d\n", ret));
+                       goto exit;
+               }
+       }
+#endif
+#ifdef DHD_STATUS_LOGGING
+       len = dhd_get_status_log_len(ndev, NULL);
+       if (len) {
+               ret = nla_put_u32(skb, DUMP_LEN_ATTR_STATUS_LOG, len);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to nla put status log length, ret=%d\n", ret));
+                       goto exit;
+               }
+       }
+#endif /* DHD_STATUS_LOGGING */
+#ifdef EWP_RTT_LOGGING
+       len = dhd_get_rtt_len(ndev, NULL);
+       if (len) {
+               ret = nla_put_u32(skb, DUMP_LEN_ATTR_RTT_LOG, len);
+               if (unlikely(ret)) {
+                       WL_ERR(("Failed to nla put rtt log length, ret=%d\n", ret));
+                       goto exit;
+               }
+       }
+#endif /* EWP_RTT_LOGGING */
+exit:
+       return ret;
+}
+#ifdef DNGL_AXI_ERROR_LOGGING
+static void wl_cfgvendor_nla_put_axi_error_data(struct sk_buff *skb,
+               struct net_device *ndev)
+{
+       int ret = 0;
+       char axierrordump_path[MEMDUMP_PATH_LEN];
+       int dumpsize = dhd_os_get_axi_error_dump_size(ndev);
+       if (dumpsize <= 0) {
+               WL_ERR(("Failed to calcuate axi error dump len\n"));
+               return;
+       }
+       dhd_os_get_axi_error_filename(ndev, axierrordump_path, MEMDUMP_PATH_LEN);
+       ret = nla_put_string(skb, DUMP_FILENAME_ATTR_AXI_ERROR_DUMP, axierrordump_path);
+       if (ret) {
+               WL_ERR(("Failed to put filename\n"));
+               return;
+       }
+       ret = nla_put_u32(skb, DUMP_LEN_ATTR_AXI_ERROR, dumpsize);
+       if (ret) {
+               WL_ERR(("Failed to put filesize\n"));
+               return;
+       }
+}
+#endif /* DNGL_AXI_ERROR_LOGGING */
+#ifdef DHD_PKT_LOGGING
+static int wl_cfgvendor_nla_put_pktlogdump_data(struct sk_buff *skb,
+               struct net_device *ndev, bool pktlogdbg)
+{
+       int ret = BCME_OK;
+       char pktlogdump_path[MEMDUMP_PATH_LEN];
+       uint32 pktlog_dumpsize = dhd_os_get_pktlog_dump_size(ndev);
+       if (pktlog_dumpsize == 0) {
+               WL_ERR(("Failed to calcuate pktlog len\n"));
+               return BCME_ERROR;
+       }
+
+       dhd_os_get_pktlogdump_filename(ndev, pktlogdump_path, MEMDUMP_PATH_LEN);
+
+       if (pktlogdbg) {
+               ret = nla_put_string(skb, DUMP_FILENAME_ATTR_PKTLOG_DEBUG_DUMP, pktlogdump_path);
+               if (ret) {
+                       WL_ERR(("Failed to put filename\n"));
+                       return ret;
+               }
+               ret = nla_put_u32(skb, DUMP_LEN_ATTR_PKTLOG_DEBUG, pktlog_dumpsize);
+               if (ret) {
+                       WL_ERR(("Failed to put filesize\n"));
+                       return ret;
+               }
+       } else {
+               ret = nla_put_string(skb, DUMP_FILENAME_ATTR_PKTLOG_DUMP, pktlogdump_path);
+               if (ret) {
+                       WL_ERR(("Failed to put filename\n"));
+                       return ret;
+               }
+               ret = nla_put_u32(skb, DUMP_LEN_ATTR_PKTLOG, pktlog_dumpsize);
+               if (ret) {
+                       WL_ERR(("Failed to put filesize\n"));
+                       return ret;
+               }
+       }
+       return ret;
+}
+#endif /* DHD_PKT_LOGGING */
+
+static int wl_cfgvendor_nla_put_memdump_data(struct sk_buff *skb,
+               struct net_device *ndev, const uint32 fw_len)
+{
+       char memdump_path[MEMDUMP_PATH_LEN];
+       int ret = BCME_OK;
+
+       dhd_get_memdump_filename(ndev, memdump_path, MEMDUMP_PATH_LEN, "mem_dump");
+       ret = nla_put_string(skb, DUMP_FILENAME_ATTR_MEM_DUMP, memdump_path);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to nla put mem dump path, ret=%d\n", ret));
+               goto exit;
+       }
+       ret = nla_put_u32(skb, DUMP_LEN_ATTR_MEMDUMP, fw_len);
+       if (unlikely(ret)) {
+               WL_ERR(("Failed to nla put mem dump length, ret=%d\n", ret));
+               goto exit;
+       }
+
+exit:
+       return ret;
+}
+
+static void wl_cfgvendor_dbg_send_file_dump_evt(void *ctx, const void *data,
+       const uint32 len, const uint32 fw_len)
+{
+       struct net_device *ndev = ctx;
+       struct wiphy *wiphy;
+       gfp_t kflags;
+       struct sk_buff *skb = NULL;
+       struct bcm_cfg80211 *cfg;
+       dhd_pub_t *dhd_pub;
+       int ret = BCME_OK;
+
+       if (!ndev) {
+               WL_ERR(("ndev is NULL\n"));
+               return;
+       }
+
+       kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+       wiphy = ndev->ieee80211_ptr->wiphy;
+       /* Alloc the SKB for vendor_event */
+#if (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || \
+       LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+       skb = cfg80211_vendor_event_alloc(wiphy, NULL, len + CFG80211_VENDOR_EVT_SKB_SZ,
+                       GOOGLE_FILE_DUMP_EVENT, kflags);
+#else
+       skb = cfg80211_vendor_event_alloc(wiphy, len + CFG80211_VENDOR_EVT_SKB_SZ,
+                       GOOGLE_FILE_DUMP_EVENT, kflags);
+#endif /* (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || */
+               /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0) */
+       if (!skb) {
+               WL_ERR(("skb alloc failed"));
+               return;
+       }
+
+       cfg = wiphy_priv(wiphy);
+       dhd_pub = cfg->pub;
+
+#ifdef DHD_PKT_LOGGING
+       if (dhd_pub->pktlog_debug) {
+               if ((ret = wl_cfgvendor_nla_put_pktlogdump_data(skb, ndev, TRUE)) < 0) {
+                       WL_ERR(("nla put failed\n"));
+                       goto done;
+               }
+               dhd_pub->pktlog_debug = FALSE;
+       } else
+#endif /* DHD_PKT_LOGGING */
+       {
+#ifdef DNGL_AXI_ERROR_LOGGING
+               if (dhd_pub->smmu_fault_occurred) {
+                       wl_cfgvendor_nla_put_axi_error_data(skb, ndev);
+               }
+#endif /* DNGL_AXI_ERROR_LOGGING */
+#ifdef DHD_FW_COREDUMP
+               if (dhd_pub->memdump_enabled || (dhd_pub->memdump_type == DUMP_TYPE_BY_SYSDUMP))
+#else
+               if ((dhd_pub->memdump_type == DUMP_TYPE_BY_SYSDUMP))
+#endif
+               {
+                       if (((ret = wl_cfgvendor_nla_put_memdump_data(skb, ndev, fw_len)) < 0) ||
+                               ((ret = wl_cfgvendor_nla_put_debug_dump_data(skb, ndev)) < 0) ||
+                               ((ret = wl_cfgvendor_nla_put_sssr_dump_data(skb, ndev)) < 0)) {
+                               WL_ERR(("nla put failed\n"));
+                               goto done;
+                       }
+#ifdef DHD_PKT_LOGGING
+                       if ((ret = wl_cfgvendor_nla_put_pktlogdump_data(skb, ndev, FALSE)) < 0) {
+                               WL_ERR(("nla put failed\n"));
+                               goto done;
+                       }
+#endif /* DHD_PKT_LOGGING */
+
+               }
+       }
+       /* TODO : Similar to above function add for debug_dump, sssr_dump, and pktlog also. */
+       cfg80211_vendor_event(skb, kflags);
+       return;
+done:
+       if (skb) {
+               dev_kfree_skb_any(skb);
+       }
+}
+#endif /* DHD_LOG_DUMP */
+
+static int wl_cfgvendor_dbg_get_version(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void *data, int len)
+{
+       int ret = BCME_OK, rem, type;
+       int buf_len = 1024;
+       bool dhd_ver = FALSE;
+       char *buf_ptr;
+       const struct nlattr *iter;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+       buf_ptr = (char *)MALLOCZ(cfg->osh, buf_len);
+       if (!buf_ptr) {
+               WL_ERR(("failed to allocate the buffer for version n"));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               switch (type) {
+                       case DEBUG_ATTRIBUTE_GET_DRIVER:
+                               dhd_ver = TRUE;
+                               break;
+                       case DEBUG_ATTRIBUTE_GET_FW:
+                               dhd_ver = FALSE;
+                               break;
+                       default:
+                               WL_ERR(("Unknown type: %d\n", type));
+                               ret = BCME_ERROR;
+                               goto exit;
+               }
+       }
+       ret = dhd_os_get_version(bcmcfg_to_prmry_ndev(cfg), dhd_ver, &buf_ptr, buf_len);
+       if (ret < 0) {
+               WL_ERR(("failed to get the version %d\n", ret));
+               goto exit;
+       }
+       ret = wl_cfgvendor_send_cmd_reply(wiphy, buf_ptr, strlen(buf_ptr));
+exit:
+       MFREE(cfg->osh, buf_ptr, buf_len);
+       return ret;
+}
+
+#ifdef DBG_PKT_MON
+static int wl_cfgvendor_dbg_start_pkt_fate_monitoring(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void *data, int len)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhd_pub = cfg->pub;
+       int ret;
+
+       ret = dhd_os_dbg_attach_pkt_monitor(dhd_pub);
+       if (unlikely(ret)) {
+               WL_ERR(("failed to start pkt fate monitoring, ret=%d", ret));
+       }
+
+       return ret;
+}
+
+typedef int (*dbg_mon_get_pkts_t) (dhd_pub_t *dhdp, void __user *user_buf,
+       uint16 req_count, uint16 *resp_count);
+
+static int __wl_cfgvendor_dbg_get_pkt_fates(struct wiphy *wiphy,
+       const void *data, int len, dbg_mon_get_pkts_t dbg_mon_get_pkts)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhd_pub = cfg->pub;
+       struct sk_buff *skb = NULL;
+       const struct nlattr *iter;
+       void __user *user_buf = NULL;
+       uint16 req_count = 0, resp_count = 0;
+       int ret, tmp, type, mem_needed;
+
+       nla_for_each_attr(iter, data, len, tmp) {
+               type = nla_type(iter);
+               switch (type) {
+                       case DEBUG_ATTRIBUTE_PKT_FATE_NUM:
+                               req_count = nla_get_u32(iter);
+                               break;
+                       case DEBUG_ATTRIBUTE_PKT_FATE_DATA:
+                               user_buf = (void __user *)(unsigned long) nla_get_u64(iter);
+                               break;
+                       default:
+                               WL_ERR(("%s: no such attribute %d\n", __FUNCTION__, type));
+                               ret = -EINVAL;
+                               goto exit;
+               }
+       }
+
+       if (!req_count || !user_buf) {
+               WL_ERR(("%s: invalid request, user_buf=%p, req_count=%u\n",
+                       __FUNCTION__, user_buf, req_count));
+               ret = -EINVAL;
+               goto exit;
+       }
+
+       ret = dbg_mon_get_pkts(dhd_pub, user_buf, req_count, &resp_count);
+       if (unlikely(ret)) {
+               WL_ERR(("failed to get packets, ret:%d \n", ret));
+               goto exit;
+       }
+
+       mem_needed = VENDOR_REPLY_OVERHEAD + ATTRIBUTE_U32_LEN;
+       skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, mem_needed);
+       if (unlikely(!skb)) {
+               WL_ERR(("skb alloc failed"));
+               ret = -ENOMEM;
+               goto exit;
+       }
+
+       ret = nla_put_u32(skb, DEBUG_ATTRIBUTE_PKT_FATE_NUM, resp_count);
+       if (ret < 0) {
+               WL_ERR(("Failed to put DEBUG_ATTRIBUTE_PKT_FATE_NUM, ret:%d\n", ret));
+               goto exit;
+       }
+
+       ret = cfg80211_vendor_cmd_reply(skb);
+       if (unlikely(ret)) {
+               WL_ERR(("vendor Command reply failed ret:%d \n", ret));
+       }
+       return ret;
+
+exit:
+       /* Free skb memory */
+       if (skb) {
+               kfree_skb(skb);
+       }
+       return ret;
+}
+
+static int wl_cfgvendor_dbg_get_tx_pkt_fates(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int ret;
+
+       ret = __wl_cfgvendor_dbg_get_pkt_fates(wiphy, data, len,
+                       dhd_os_dbg_monitor_get_tx_pkts);
+       if (unlikely(ret)) {
+               WL_ERR(("failed to get tx packets, ret:%d \n", ret));
+       }
+
+       return ret;
+}
+
+static int wl_cfgvendor_dbg_get_rx_pkt_fates(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int ret;
+
+       ret = __wl_cfgvendor_dbg_get_pkt_fates(wiphy, data, len,
+                       dhd_os_dbg_monitor_get_rx_pkts);
+       if (unlikely(ret)) {
+               WL_ERR(("failed to get rx packets, ret:%d \n", ret));
+       }
+
+       return ret;
+}
+#endif /* DBG_PKT_MON */
+
+#ifdef KEEP_ALIVE
+static int wl_cfgvendor_start_mkeep_alive(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void *data, int len)
+{
+       /* max size of IP packet for keep alive */
+       const int MKEEP_ALIVE_IP_PKT_MAX = 256;
+
+       int ret = BCME_OK, rem, type;
+       uint8 mkeep_alive_id = 0;
+       uint8 *ip_pkt = NULL;
+       uint16 ip_pkt_len = 0;
+       uint16 ether_type = ETHERTYPE_IP;
+       uint8 src_mac[ETHER_ADDR_LEN];
+       uint8 dst_mac[ETHER_ADDR_LEN];
+       uint32 period_msec = 0;
+       const struct nlattr *iter;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               switch (type) {
+                       case MKEEP_ALIVE_ATTRIBUTE_ID:
+                               mkeep_alive_id = nla_get_u8(iter);
+                               break;
+                       case MKEEP_ALIVE_ATTRIBUTE_IP_PKT_LEN:
+                               ip_pkt_len = nla_get_u16(iter);
+                               if (ip_pkt_len > MKEEP_ALIVE_IP_PKT_MAX) {
+                                       ret = BCME_BADARG;
+                                       goto exit;
+                               }
+                               break;
+                       case MKEEP_ALIVE_ATTRIBUTE_IP_PKT:
+                               if (ip_pkt) {
+                                       ret = BCME_BADARG;
+                                       WL_ERR(("ip_pkt already allocated\n"));
+                                       goto exit;
+                               }
+                               if (!ip_pkt_len) {
+                                       ret = BCME_BADARG;
+                                       WL_ERR(("ip packet length is 0\n"));
+                                       goto exit;
+                               }
+                               ip_pkt = (u8 *)MALLOCZ(cfg->osh, ip_pkt_len);
+                               if (ip_pkt == NULL) {
+                                       ret = BCME_NOMEM;
+                                       WL_ERR(("Failed to allocate mem for ip packet\n"));
+                                       goto exit;
+                               }
+                               memcpy(ip_pkt, (u8*)nla_data(iter), ip_pkt_len);
+                               break;
+                       case MKEEP_ALIVE_ATTRIBUTE_SRC_MAC_ADDR:
+                               memcpy(src_mac, nla_data(iter), ETHER_ADDR_LEN);
+                               break;
+                       case MKEEP_ALIVE_ATTRIBUTE_DST_MAC_ADDR:
+                               memcpy(dst_mac, nla_data(iter), ETHER_ADDR_LEN);
+                               break;
+                       case MKEEP_ALIVE_ATTRIBUTE_PERIOD_MSEC:
+                               period_msec = nla_get_u32(iter);
+                               break;
+                       case MKEEP_ALIVE_ATTRIBUTE_ETHER_TYPE:
+                               ether_type = nla_get_u16(iter);
+                               if (!((ether_type == ETHERTYPE_IP) ||
+                                               (ether_type == ETHERTYPE_IPV6))) {
+                                       WL_ERR(("Invalid ether type, %2x\n", ether_type));
+                                       ret = BCME_BADARG;
+                                       goto exit;
+                               }
+                               break;
+                       default:
+                               WL_ERR(("Unknown type: %d\n", type));
+                               ret = BCME_BADARG;
+                               goto exit;
+               }
+       }
+
+       if (ip_pkt == NULL) {
+               ret = BCME_BADARG;
+               WL_ERR(("ip packet is NULL\n"));
+               goto exit;
+       }
+
+       ret = wl_cfg80211_start_mkeep_alive(cfg, mkeep_alive_id,
+               ether_type, ip_pkt, ip_pkt_len, src_mac, dst_mac, period_msec);
+       if (ret < 0) {
+               WL_ERR(("start_mkeep_alive is failed ret: %d\n", ret));
+       }
+
+exit:
+       if (ip_pkt) {
+               MFREE(cfg->osh, ip_pkt, ip_pkt_len);
+       }
+
+       return ret;
+}
+
+static int wl_cfgvendor_stop_mkeep_alive(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void *data, int len)
+{
+       int ret = BCME_OK, rem, type;
+       uint8 mkeep_alive_id = 0;
+       const struct nlattr *iter;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               switch (type) {
+                       case MKEEP_ALIVE_ATTRIBUTE_ID:
+                               mkeep_alive_id = nla_get_u8(iter);
+                               break;
+                       default:
+                               WL_ERR(("Unknown type: %d\n", type));
+                               ret = BCME_BADARG;
+                               break;
+               }
+       }
+
+       ret = wl_cfg80211_stop_mkeep_alive(cfg, mkeep_alive_id);
+       if (ret < 0) {
+               WL_ERR(("stop_mkeep_alive is failed ret: %d\n", ret));
+       }
+
+       return ret;
+}
+#endif /* KEEP_ALIVE */
+
+#if defined(PKT_FILTER_SUPPORT) && defined(APF)
+static int
+wl_cfgvendor_apf_get_capabilities(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void *data, int len)
+{
+       struct net_device *ndev = wdev_to_ndev(wdev);
+       struct sk_buff *skb = NULL;
+       int ret, ver, max_len, mem_needed;
+
+       /* APF version */
+       ver = 0;
+       ret = dhd_dev_apf_get_version(ndev, &ver);
+       if (unlikely(ret)) {
+               WL_ERR(("APF get version failed, ret=%d\n", ret));
+               return ret;
+       }
+
+       /* APF memory size limit */
+       max_len = 0;
+       ret = dhd_dev_apf_get_max_len(ndev, &max_len);
+       if (unlikely(ret)) {
+               WL_ERR(("APF get maximum length failed, ret=%d\n", ret));
+               return ret;
+       }
+
+       mem_needed = VENDOR_REPLY_OVERHEAD + (ATTRIBUTE_U32_LEN * 2);
+
+       skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, mem_needed);
+       if (unlikely(!skb)) {
+               WL_ERR(("%s: can't allocate %d bytes\n", __FUNCTION__, mem_needed));
+               return -ENOMEM;
+       }
+
+       ret = nla_put_u32(skb, APF_ATTRIBUTE_VERSION, ver);
+       if (ret < 0) {
+               WL_ERR(("Failed to put APF_ATTRIBUTE_VERSION, ret:%d\n", ret));
+               goto exit;
+       }
+       ret = nla_put_u32(skb, APF_ATTRIBUTE_MAX_LEN, max_len);
+       if (ret < 0) {
+               WL_ERR(("Failed to put APF_ATTRIBUTE_MAX_LEN, ret:%d\n", ret));
+               goto exit;
+       }
+
+       ret = cfg80211_vendor_cmd_reply(skb);
+       if (unlikely(ret)) {
+               WL_ERR(("vendor command reply failed, ret=%d\n", ret));
+       }
+       return ret;
+exit:
+       /* Free skb memory */
+       kfree_skb(skb);
+       return ret;
+}
+
+static int
+wl_cfgvendor_apf_set_filter(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       struct net_device *ndev = wdev_to_ndev(wdev);
+       const struct nlattr *iter;
+       u8 *program = NULL;
+       u32 program_len = 0;
+       int ret, tmp, type;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+       if (len <= 0) {
+               WL_ERR(("Invalid len: %d\n", len));
+               ret = -EINVAL;
+               goto exit;
+       }
+       nla_for_each_attr(iter, data, len, tmp) {
+               type = nla_type(iter);
+               switch (type) {
+                       case APF_ATTRIBUTE_PROGRAM_LEN:
+                               /* check if the iter value is valid and program_len
+                                * is not already initialized.
+                                */
+                               if (nla_len(iter) == sizeof(uint32) && !program_len) {
+                                       program_len = nla_get_u32(iter);
+                               } else {
+                                       ret = -EINVAL;
+                                       goto exit;
+                               }
+
+                               if (program_len > WL_APF_PROGRAM_MAX_SIZE) {
+                                       WL_ERR(("program len is more than expected len\n"));
+                                       ret = -EINVAL;
+                                       goto exit;
+                               }
+
+                               if (unlikely(!program_len)) {
+                                       WL_ERR(("zero program length\n"));
+                                       ret = -EINVAL;
+                                       goto exit;
+                               }
+                               break;
+                       case APF_ATTRIBUTE_PROGRAM:
+                               if (unlikely(program)) {
+                                       WL_ERR(("program already allocated\n"));
+                                       ret = -EINVAL;
+                                       goto exit;
+                               }
+                               if (unlikely(!program_len)) {
+                                       WL_ERR(("program len is not set\n"));
+                                       ret = -EINVAL;
+                                       goto exit;
+                               }
+                               if (nla_len(iter) != program_len) {
+                                       WL_ERR(("program_len is not same\n"));
+                                       ret = -EINVAL;
+                                       goto exit;
+                               }
+                               program = MALLOCZ(cfg->osh, program_len);
+                               if (unlikely(!program)) {
+                                       WL_ERR(("%s: can't allocate %d bytes\n",
+                                             __FUNCTION__, program_len));
+                                       ret = -ENOMEM;
+                                       goto exit;
+                               }
+                               memcpy(program, (u8*)nla_data(iter), program_len);
+                               break;
+                       default:
+                               WL_ERR(("%s: no such attribute %d\n", __FUNCTION__, type));
+                               ret = -EINVAL;
+                               goto exit;
+               }
+       }
+
+       ret = dhd_dev_apf_add_filter(ndev, program, program_len);
+
+exit:
+       if (program) {
+               MFREE(cfg->osh, program, program_len);
+       }
+       return ret;
+}
+#endif /* PKT_FILTER_SUPPORT && APF */
+
+#ifdef NDO_CONFIG_SUPPORT
+static int wl_cfgvendor_configure_nd_offload(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       const struct nlattr *iter;
+       int ret = BCME_OK, rem, type;
+       u8 enable = 0;
+
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               switch (type) {
+                       case ANDR_WIFI_ATTRIBUTE_ND_OFFLOAD_VALUE:
+                               enable = nla_get_u8(iter);
+                               break;
+                       default:
+                               WL_ERR(("Unknown type: %d\n", type));
+                               ret = BCME_BADARG;
+                               goto exit;
+               }
+       }
+
+       ret = dhd_dev_ndo_cfg(bcmcfg_to_prmry_ndev(cfg), enable);
+       if (ret < 0) {
+               WL_ERR(("dhd_dev_ndo_cfg() failed: %d\n", ret));
+       }
+
+exit:
+       return ret;
+}
+#endif /* NDO_CONFIG_SUPPORT */
+
+/* for kernel >= 4.13 NL80211 wl_cfg80211_set_pmk have to be used. */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 13, 0))
+static int wl_cfgvendor_set_pmk(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void *data, int len)
+{
+       int ret = 0;
+       wsec_pmk_t pmk;
+       const struct nlattr *iter;
+       int rem, type;
+       struct net_device *ndev = wdev_to_ndev(wdev);
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct wl_security *sec;
+
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               switch (type) {
+                       case BRCM_ATTR_DRIVER_KEY_PMK:
+                               if (nla_len(iter) > sizeof(pmk.key)) {
+                                       ret = -EINVAL;
+                                       goto exit;
+                               }
+                               pmk.flags = 0;
+                               pmk.key_len = htod16(nla_len(iter));
+                               bcopy((uint8 *)nla_data(iter), pmk.key, len);
+                               break;
+                       default:
+                               WL_ERR(("Unknown type: %d\n", type));
+                               ret = BCME_BADARG;
+                               goto exit;
+               }
+       }
+
+       sec = wl_read_prof(cfg, ndev, WL_PROF_SEC);
+       if ((sec->wpa_auth == WLAN_AKM_SUITE_8021X) ||
+               (sec->wpa_auth == WL_AKM_SUITE_SHA256_1X)) {
+               ret = wldev_iovar_setbuf(ndev, "okc_info_pmk", pmk.key, pmk.key_len, cfg->ioctl_buf,
+                       WLC_IOCTL_SMLEN,  &cfg->ioctl_buf_sync);
+               if (ret) {
+                       /* could fail in case that 'okc' is not supported */
+                       WL_INFORM_MEM(("okc_info_pmk failed, err=%d (ignore)\n", ret));
+               }
+       }
+
+       ret = wldev_ioctl_set(ndev, WLC_SET_WSEC_PMK, &pmk, sizeof(pmk));
+       WL_INFORM_MEM(("IOVAR set_pmk ret:%d", ret));
+exit:
+       return ret;
+}
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(4, 13, 0) */
+
+static int wl_cfgvendor_get_driver_feature(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int ret = BCME_OK;
+       u8 supported[(BRCM_WLAN_VENDOR_FEATURES_MAX / 8) + 1] = {0};
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhd_pub = cfg->pub;
+       struct sk_buff *skb;
+       int32 mem_needed;
+
+       mem_needed = VENDOR_REPLY_OVERHEAD + NLA_HDRLEN + sizeof(supported);
+
+       BCM_REFERENCE(dhd_pub);
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 13, 0))
+       if (FW_SUPPORTED(dhd_pub, idsup)) {
+               ret = wl_features_set(supported, sizeof(supported),
+                               BRCM_WLAN_VENDOR_FEATURE_KEY_MGMT_OFFLOAD);
+       }
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(4, 13, 0) */
+
+       /* Alloc the SKB for vendor_event */
+       skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, mem_needed);
+       if (unlikely(!skb)) {
+               WL_ERR(("skb alloc failed"));
+               ret = BCME_NOMEM;
+               goto exit;
+       }
+
+       ret = nla_put(skb, BRCM_ATTR_DRIVER_FEATURE_FLAGS, sizeof(supported), supported);
+       if (ret) {
+               kfree_skb(skb);
+               goto exit;
+       }
+       ret = cfg80211_vendor_cmd_reply(skb);
+exit:
+       return ret;
+}
+
+#ifdef WL_P2P_RAND
+static int
+wl_cfgvendor_set_p2p_rand_mac(struct wiphy *wiphy,
+               struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int type;
+       WL_DBG(("%s, wdev->iftype = %d\n", __FUNCTION__, wdev->iftype));
+       WL_INFORM_MEM(("randomized p2p_dev_addr - "MACDBG"\n", MAC2STRDBG(nla_data(data))));
+
+       BCM_REFERENCE(cfg);
+
+       type = nla_type(data);
+
+       if (type == BRCM_ATTR_DRIVER_RAND_MAC) {
+               if (nla_len(data) != ETHER_ADDR_LEN) {
+                       WL_ERR(("nla_len not matched.\n"));
+                       err = -EINVAL;
+                       goto exit;
+               }
+
+               if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) {
+                       WL_ERR(("wrong interface type , wdev->iftype=%d\n", wdev->iftype));
+                       err = -EINVAL;
+                       goto exit;
+               }
+               (void)memcpy_s(wl_to_p2p_bss_macaddr(cfg, P2PAPI_BSSCFG_DEVICE), ETHER_ADDR_LEN,
+                               nla_data(data), ETHER_ADDR_LEN);
+               (void)memcpy_s(wdev->address, ETHER_ADDR_LEN, nla_data(data), ETHER_ADDR_LEN);
+
+               err = wl_cfgp2p_disable_discovery(cfg);
+               if (unlikely(err < 0)) {
+                       WL_ERR(("P2P disable discovery failed, ret=%d\n", err));
+                       goto exit;
+               }
+
+               err = wl_cfgp2p_set_firm_p2p(cfg);
+               if (unlikely(err < 0)) {
+                       WL_ERR(("Set P2P address in firmware failed, ret=%d\n", err));
+                       goto exit;
+               }
+
+               err = wl_cfgp2p_enable_discovery(cfg, bcmcfg_to_prmry_ndev(cfg), NULL, 0);
+               if (unlikely(err < 0)) {
+                       WL_ERR(("P2P enable discovery failed, ret=%d\n", err));
+                       goto exit;
+               }
+       } else {
+               WL_ERR(("unexpected attrib type:%d\n", type));
+               err = -EINVAL;
+       }
+exit:
+       return err;
+}
+#endif /* WL_P2P_RAND */
+
+#ifdef WL_SAR_TX_POWER
+static int
+wl_cfgvendor_tx_power_scenario(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = BCME_ERROR, rem, type;
+       wifi_power_scenario wifi_tx_power_mode = WIFI_POWER_SCENARIO_INVALID;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(wdev_to_ndev(wdev));
+       const struct nlattr *iter;
+       s8 sar_tx_power_val = WIFI_POWER_SCENARIO_INVALID;
+
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               if (type == ANDR_WIFI_ATTRIBUTE_TX_POWER_SCENARIO) {
+                       sar_tx_power_val = nla_get_s8(iter);
+               } else {
+                       WL_ERR(("Unknown attr type: %d\n", type));
+                       err = -EINVAL;
+                       goto exit;
+               }
+       }
+       /* If sar tx power is already configured, no need to set it again */
+       if (cfg->wifi_tx_power_mode == sar_tx_power_val) {
+               WL_INFORM_MEM(("%s, tx_power_mode %d is already set\n",
+                       __FUNCTION__, sar_tx_power_val));
+               err = BCME_OK;
+               goto exit;
+       }
+
+       /* Map Android TX power modes to Brcm power mode */
+       switch (sar_tx_power_val) {
+               case WIFI_POWER_SCENARIO_VOICE_CALL:
+               case WIFI_POWER_SCENARIO_DEFAULT:
+                       wifi_tx_power_mode = HEAD_SAR_BACKOFF_ENABLE;
+                       break;
+               case WIFI_POWER_SCENARIO_ON_HEAD_CELL_OFF:
+                       wifi_tx_power_mode = GRIP_SAR_BACKOFF_DISABLE;
+                       break;
+               case WIFI_POWER_SCENARIO_ON_BODY_CELL_OFF:
+                       wifi_tx_power_mode = GRIP_SAR_BACKOFF_ENABLE;
+                       break;
+               case WIFI_POWER_SCENARIO_ON_BODY_BT:
+                       wifi_tx_power_mode = NR_mmWave_SAR_BACKOFF_ENABLE;
+                       break;
+               case WIFI_POWER_SCENARIO_ON_HEAD_CELL_ON:
+                       wifi_tx_power_mode = NR_Sub6_SAR_BACKOFF_DISABLE;
+                       break;
+               case WIFI_POWER_SCENARIO_ON_BODY_CELL_ON:
+                       wifi_tx_power_mode = NR_Sub6_SAR_BACKOFF_ENABLE;
+                       break;
+               default:
+                       WL_ERR(("invalid wifi tx power scenario = %d\n",
+                               sar_tx_power_val));
+                       err = -EINVAL;
+                       goto exit;
+       }
+
+       WL_DBG(("%s, tx_power_mode %d\n", __FUNCTION__, wifi_tx_power_mode));
+       err = wldev_iovar_setint(wdev_to_ndev(wdev), "sar_enable", wifi_tx_power_mode);
+       if (unlikely(err)) {
+               WL_ERR(("%s: Failed to set sar_enable - error (%d)\n", __FUNCTION__, err));
+               goto exit;
+       }
+       /* Cache the tx power mode sent by the hal */
+       cfg->wifi_tx_power_mode = sar_tx_power_val;
+exit:
+       return err;
+}
+#endif /* WL_SAR_TX_POWER */
+
+static const struct wiphy_vendor_command wl_vendor_cmds [] = {
+       {
+               {
+                       .vendor_id = OUI_BRCM,
+                       .subcmd = BRCM_VENDOR_SCMD_PRIV_STR
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_priv_string_handler
+       },
+#ifdef BCM_PRIV_CMD_SUPPORT
+       {
+               {
+                       .vendor_id = OUI_BRCM,
+                       .subcmd = BRCM_VENDOR_SCMD_BCM_STR
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_priv_bcm_handler
+       },
+#endif /* BCM_PRIV_CMD_SUPPORT */
+#ifdef WL_SAE
+       {
+               {
+                       .vendor_id = OUI_BRCM,
+                       .subcmd = BRCM_VENDOR_SCMD_BCM_PSK
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_sae_password
+       },
+#endif /* WL_SAE */
+       {
+               {
+                       .vendor_id = OUI_BRCM,
+                       .subcmd = BRCM_VENDOR_SCMD_SET_CONNECT_PARAMS
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_connect_params_handler
+       },
+       {
+               {
+                       .vendor_id = OUI_BRCM,
+                       .subcmd = BRCM_VENDOR_SCMD_SET_START_AP_PARAMS
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_start_ap_params_handler
+       },
+#ifdef GSCAN_SUPPORT
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_GET_CAPABILITIES
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_gscan_get_capabilities
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_SET_CONFIG
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_scan_cfg
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_SET_SCAN_CONFIG
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_batch_scan_cfg
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_ENABLE_GSCAN
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_initiate_gscan
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_ENABLE_FULL_SCAN_RESULTS
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_enable_full_scan_result
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_SET_HOTLIST
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_hotlist_cfg
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_GET_SCAN_RESULTS
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_gscan_get_batch_results
+       },
+#endif /* GSCAN_SUPPORT */
+#if defined(GSCAN_SUPPORT) || defined(DHD_GET_VALID_CHANNELS)
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_GET_CHANNEL_LIST
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_gscan_get_channel_list
+       },
+#endif /* GSCAN_SUPPORT || DHD_GET_VALID_CHANNELS */
+#ifdef RTT_SUPPORT
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = RTT_SUBCMD_SET_CONFIG
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_rtt_set_config
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = RTT_SUBCMD_CANCEL_CONFIG
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_rtt_cancel_config
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = RTT_SUBCMD_GETCAPABILITY
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_rtt_get_capability
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = RTT_SUBCMD_GETAVAILCHANNEL
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_rtt_get_responder_info
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = RTT_SUBCMD_SET_RESPONDER
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_rtt_set_responder
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = RTT_SUBCMD_CANCEL_RESPONDER
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_rtt_cancel_responder
+       },
+#endif /* RTT_SUPPORT */
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = ANDR_WIFI_SUBCMD_GET_FEATURE_SET
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_get_feature_set
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = ANDR_WIFI_SUBCMD_GET_FEATURE_SET_MATRIX
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_get_feature_set_matrix
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = ANDR_WIFI_RANDOM_MAC_OUI
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_rand_mac_oui
+       },
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = ANDR_WIFI_NODFS_CHANNELS
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_nodfs_flag
+       },
+#endif /* CUSTOM_FORCE_NODFS_FLAG */
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = ANDR_WIFI_SET_COUNTRY
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_country
+       },
+#ifdef LINKSTAT_SUPPORT
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = LSTATS_SUBCMD_GET_INFO
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_lstats_get_info
+       },
+#endif /* LINKSTAT_SUPPORT */
+
+#ifdef GSCAN_SUPPORT
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_SET_EPNO_SSID
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_epno_cfg
+
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = WIFI_SUBCMD_SET_LAZY_ROAM_PARAMS
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_lazy_roam_cfg
+
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = WIFI_SUBCMD_ENABLE_LAZY_ROAM
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_enable_lazy_roam
+
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = WIFI_SUBCMD_SET_BSSID_PREF
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_bssid_pref
+
+       },
+#endif /* GSCAN_SUPPORT */
+#if defined(GSCAN_SUPPORT) || defined(ROAMEXP_SUPPORT)
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = WIFI_SUBCMD_SET_SSID_WHITELIST
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_ssid_whitelist
+
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = WIFI_SUBCMD_SET_BSSID_BLACKLIST
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_bssid_blacklist
+       },
+#endif /* GSCAN_SUPPORT || ROAMEXP_SUPPORT */
+#ifdef ROAMEXP_SUPPORT
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = WIFI_SUBCMD_FW_ROAM_POLICY
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_fw_roaming_state
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = WIFI_SUBCMD_ROAM_CAPABILITY
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_fw_roam_get_capability
+       },
+#endif /* ROAMEXP_SUPPORT */
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_GET_VER
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_dbg_get_version
+       },
+#ifdef DHD_LOG_DUMP
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_GET_FILE_DUMP_BUF
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_dbg_file_dump
+       },
+#endif /* DHD_LOG_DUMP */
+
+#ifdef DEBUGABILITY
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_TRIGGER_MEM_DUMP
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_dbg_trigger_mem_dump
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_GET_MEM_DUMP
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_dbg_get_mem_dump
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_START_LOGGING
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_dbg_start_logging
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_RESET_LOGGING
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_dbg_reset_logging
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_GET_RING_STATUS
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_dbg_get_ring_status
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_GET_RING_DATA
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_dbg_get_ring_data
+       },
+#endif /* DEBUGABILITY */
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_GET_FEATURE
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_dbg_get_feature
+       },
+#ifdef DBG_PKT_MON
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_START_PKT_FATE_MONITORING
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_dbg_start_pkt_fate_monitoring
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_GET_TX_PKT_FATES
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_dbg_get_tx_pkt_fates
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_GET_RX_PKT_FATES
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_dbg_get_rx_pkt_fates
+       },
+#endif /* DBG_PKT_MON */
+#ifdef KEEP_ALIVE
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = WIFI_OFFLOAD_SUBCMD_START_MKEEP_ALIVE
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_start_mkeep_alive
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = WIFI_OFFLOAD_SUBCMD_STOP_MKEEP_ALIVE
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_stop_mkeep_alive
+       },
+#endif /* KEEP_ALIVE */
+#ifdef WL_NAN
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_ENABLE
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_start_handler
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_DISABLE
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_stop_handler
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_CONFIG
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_config_handler
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_REQUEST_PUBLISH
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_req_publish
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_REQUEST_SUBSCRIBE
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_req_subscribe
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_CANCEL_PUBLISH
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_cancel_publish
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_CANCEL_SUBSCRIBE
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_cancel_subscribe
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_TRANSMIT
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_transmit
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_GET_CAPABILITIES
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_get_capablities
+       },
+
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_DATA_PATH_IFACE_CREATE
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_data_path_iface_create
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_DATA_PATH_IFACE_DELETE
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_data_path_iface_delete
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_DATA_PATH_REQUEST
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_data_path_request
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_DATA_PATH_RESPONSE
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_data_path_response
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_DATA_PATH_END
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_data_path_end
+       },
+#ifdef WL_NAN_DISC_CACHE
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_DATA_PATH_SEC_INFO
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_data_path_sec_info
+       },
+#endif /* WL_NAN_DISC_CACHE */
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_VERSION_INFO
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_version_info
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = NAN_WIFI_SUBCMD_ENABLE_MERGE
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_nan_enable_merge
+       },
+#endif /* WL_NAN */
+#if defined(PKT_FILTER_SUPPORT) && defined(APF)
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = APF_SUBCMD_GET_CAPABILITIES
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_apf_get_capabilities
+       },
+
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = APF_SUBCMD_SET_FILTER
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_apf_set_filter
+       },
+#endif /* PKT_FILTER_SUPPORT && APF */
+#ifdef NDO_CONFIG_SUPPORT
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = WIFI_SUBCMD_CONFIG_ND_OFFLOAD
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_configure_nd_offload
+       },
+#endif /* NDO_CONFIG_SUPPORT */
+#ifdef RSSI_MONITOR_SUPPORT
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = WIFI_SUBCMD_SET_RSSI_MONITOR
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_rssi_monitor
+       },
+#endif /* RSSI_MONITOR_SUPPORT */
+#ifdef DHD_WAKE_STATUS
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_GET_WAKE_REASON_STATS
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_get_wake_reason_stats
+       },
+#endif /* DHD_WAKE_STATUS */
+#ifdef DHDTCPACK_SUPPRESS
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = WIFI_SUBCMD_CONFIG_TCPACK_SUP
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_tcpack_sup_mode
+       },
+#endif /* DHDTCPACK_SUPPRESS */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 13, 0))
+       {
+               {
+                       .vendor_id = OUI_BRCM,
+                       .subcmd = BRCM_VENDOR_SCMD_SET_PMK
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_pmk
+       },
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(4, 13, 0) */
+       {
+               {
+                       .vendor_id = OUI_BRCM,
+                       .subcmd = BRCM_VENDOR_SCMD_GET_FEATURES
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_get_driver_feature
+       },
+#if defined(WL_CFG80211) && defined(DHD_FILE_DUMP_EVENT)
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_FILE_DUMP_DONE_IND
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_notify_dump_completion
+       },
+#endif /* WL_CFG80211 && DHD_FILE_DUMP_EVENT */
+#if defined(WL_CFG80211)
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_SET_HAL_START
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_hal_started
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = DEBUG_SET_HAL_STOP
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_stop_hal
+       },
+#endif /* WL_CFG80211 */
+#ifdef WL_P2P_RAND
+       {
+               {
+                       .vendor_id = OUI_BRCM,
+                       .subcmd = BRCM_VENDOR_SCMD_SET_MAC
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_set_p2p_rand_mac
+       },
+#endif /* WL_P2P_RAND */
+#ifdef WL_SAR_TX_POWER
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = WIFI_SUBCMD_TX_POWER_SCENARIO
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0))
+               .policy = VENDOR_CMD_RAW_DATA,
+#endif
+               .doit = wl_cfgvendor_tx_power_scenario
+       }
+#endif /* WL_SAR_TX_POWER */
+
+};
+
+static const struct  nl80211_vendor_cmd_info wl_vendor_events [] = {
+               { OUI_BRCM, BRCM_VENDOR_EVENT_UNSPEC },
+               { OUI_BRCM, BRCM_VENDOR_EVENT_PRIV_STR },
+               { OUI_GOOGLE, GOOGLE_GSCAN_SIGNIFICANT_EVENT },
+               { OUI_GOOGLE, GOOGLE_GSCAN_GEOFENCE_FOUND_EVENT },
+               { OUI_GOOGLE, GOOGLE_GSCAN_BATCH_SCAN_EVENT },
+               { OUI_GOOGLE, GOOGLE_SCAN_FULL_RESULTS_EVENT },
+               { OUI_GOOGLE, GOOGLE_RTT_COMPLETE_EVENT },
+               { OUI_GOOGLE, GOOGLE_SCAN_COMPLETE_EVENT },
+               { OUI_GOOGLE, GOOGLE_GSCAN_GEOFENCE_LOST_EVENT },
+               { OUI_GOOGLE, GOOGLE_SCAN_EPNO_EVENT },
+               { OUI_GOOGLE, GOOGLE_DEBUG_RING_EVENT },
+               { OUI_GOOGLE, GOOGLE_FW_DUMP_EVENT },
+               { OUI_GOOGLE, GOOGLE_PNO_HOTSPOT_FOUND_EVENT },
+               { OUI_GOOGLE, GOOGLE_RSSI_MONITOR_EVENT },
+               { OUI_GOOGLE, GOOGLE_MKEEP_ALIVE_EVENT },
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_ENABLED},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_DISABLED},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_SUBSCRIBE_MATCH},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_REPLIED},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_PUBLISH_TERMINATED},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_SUBSCRIBE_TERMINATED},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_DE_EVENT},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_FOLLOWUP},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_TRANSMIT_FOLLOWUP_IND},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_DATA_REQUEST},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_DATA_CONFIRMATION},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_DATA_END},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_BEACON},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_SDF},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_TCA},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_SUBSCRIBE_UNMATCH},
+               { OUI_GOOGLE, GOOGLE_NAN_EVENT_UNKNOWN},
+               { OUI_GOOGLE, GOOGLE_ROAM_EVENT_START},
+               { OUI_BRCM, BRCM_VENDOR_EVENT_HANGED},
+               { OUI_BRCM, BRCM_VENDOR_EVENT_SAE_KEY},
+               { OUI_BRCM, BRCM_VENDOR_EVENT_BEACON_RECV},
+               { OUI_BRCM, BRCM_VENDOR_EVENT_PORT_AUTHORIZED},
+               { OUI_GOOGLE, GOOGLE_FILE_DUMP_EVENT },
+               { OUI_BRCM, BRCM_VENDOR_EVENT_CU},
+               { OUI_BRCM, BRCM_VENDOR_EVENT_WIPS},
+               { OUI_GOOGLE, NAN_ASYNC_RESPONSE_DISABLED},
+               { OUI_BRCM, BRCM_VENDOR_EVENT_RCC_INFO}
+};
+
+int wl_cfgvendor_attach(struct wiphy *wiphy, dhd_pub_t *dhd)
+{
+
+       WL_INFORM_MEM(("Vendor: Register BRCM cfg80211 vendor cmd(0x%x) interface \n",
+               NL80211_CMD_VENDOR));
+
+       wiphy->vendor_commands  = wl_vendor_cmds;
+       wiphy->n_vendor_commands = ARRAY_SIZE(wl_vendor_cmds);
+       wiphy->vendor_events    = wl_vendor_events;
+       wiphy->n_vendor_events  = ARRAY_SIZE(wl_vendor_events);
+
+#ifdef DEBUGABILITY
+       dhd_os_dbg_register_callback(FW_VERBOSE_RING_ID, wl_cfgvendor_dbg_ring_send_evt);
+       dhd_os_dbg_register_callback(DHD_EVENT_RING_ID, wl_cfgvendor_dbg_ring_send_evt);
+#endif /* DEBUGABILITY */
+#ifdef DHD_LOG_DUMP
+       dhd_os_dbg_register_urgent_notifier(dhd, wl_cfgvendor_dbg_send_file_dump_evt);
+#endif /* DHD_LOG_DUMP */
+
+       return 0;
+}
+
+int wl_cfgvendor_detach(struct wiphy *wiphy)
+{
+       WL_INFORM_MEM(("Vendor: Unregister BRCM cfg80211 vendor interface \n"));
+
+       wiphy->vendor_commands  = NULL;
+       wiphy->vendor_events    = NULL;
+       wiphy->n_vendor_commands = 0;
+       wiphy->n_vendor_events  = 0;
+
+       return 0;
+}
+#endif /* (LINUX_VERSION_CODE > KERNEL_VERSION(3, 13, 0)) || defined(WL_VENDOR_EXT_SUPPORT) */
+
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+void
+wl_cfgvendor_send_hang_event(struct net_device *dev, u16 reason, char *string, int hang_info_cnt)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       struct wiphy *wiphy;
+       char *hang_info;
+       int len = 0;
+       int bytes_written;
+       uint32 dummy_data = 0;
+       int reason_hang_info = 0;
+       int cnt = 0;
+       dhd_pub_t *dhd;
+       int hang_reason_mismatch = FALSE;
+
+       if (!cfg || !cfg->wdev) {
+               WL_ERR(("cfg=%p wdev=%p\n", cfg, (cfg ? cfg->wdev : NULL)));
+               return;
+       }
+
+       wiphy = cfg->wdev->wiphy;
+
+       if (!wiphy) {
+               WL_ERR(("wiphy is NULL\n"));
+               return;
+       }
+
+       hang_info = MALLOCZ(cfg->osh, VENDOR_SEND_HANG_EXT_INFO_LEN);
+       if (hang_info == NULL) {
+               WL_ERR(("alloc hang_info failed\n"));
+               return;
+       }
+
+       dhd = (dhd_pub_t *)(cfg->pub);
+
+#ifdef WL_BCNRECV
+       /* check fakeapscan in progress then stop scan */
+       if (cfg->bcnrecv_info.bcnrecv_state == BEACON_RECV_STARTED) {
+               wl_android_bcnrecv_stop(dev, WL_BCNRECV_HANG);
+       }
+#endif /* WL_BCNRECV */
+       sscanf(string, "%d", &reason_hang_info);
+       bytes_written = 0;
+       len = VENDOR_SEND_HANG_EXT_INFO_LEN - bytes_written;
+       if (strlen(string) == 0 || (reason_hang_info != reason)) {
+               WL_ERR(("hang reason mismatch: string len %d reason_hang_info %d\n",
+                       (int)strlen(string), reason_hang_info));
+               hang_reason_mismatch = TRUE;
+               if (dhd) {
+                       get_debug_dump_time(dhd->debug_dump_time_hang_str);
+                       copy_debug_dump_time(dhd->debug_dump_time_str,
+                                       dhd->debug_dump_time_hang_str);
+               }
+               /* Fill bigdata key with */
+               bytes_written += scnprintf(&hang_info[bytes_written], len,
+                               "%d %d %s %08x %08x %08x %08x %08x %08x %08x",
+                               reason, VENDOR_SEND_HANG_EXT_INFO_VER,
+                               dhd->debug_dump_time_hang_str,
+                               0, 0, 0, 0, 0, 0, 0);
+               if (dhd) {
+                       clear_debug_dump_time(dhd->debug_dump_time_hang_str);
+               }
+       } else {
+               bytes_written += scnprintf(&hang_info[bytes_written], len, "%s", string);
+       }
+
+       WL_ERR(("hang reason: %d info cnt: %d\n", reason, hang_info_cnt));
+
+       if (hang_reason_mismatch == FALSE) {
+               cnt = hang_info_cnt;
+       } else {
+               cnt = HANG_FIELD_MISMATCH_CNT;
+       }
+
+       while (cnt < HANG_FIELD_CNT_MAX) {
+               len = VENDOR_SEND_HANG_EXT_INFO_LEN - bytes_written;
+               if (len <= 0) {
+                       break;
+               }
+               bytes_written += scnprintf(&hang_info[bytes_written], len,
+                               "%c%08x", HANG_RAW_DEL, dummy_data);
+               cnt++;
+       }
+
+       WL_ERR(("hang info cnt: %d len: %d\n", cnt, (int)strlen(hang_info)));
+       WL_ERR(("hang info data: %s\n", hang_info));
+
+       wl_cfgvendor_send_async_event(wiphy,
+                       bcmcfg_to_prmry_ndev(cfg), BRCM_VENDOR_EVENT_HANGED,
+                       hang_info, (int)strlen(hang_info));
+
+       memset(string, 0, VENDOR_SEND_HANG_EXT_INFO_LEN);
+
+       if (hang_info) {
+               MFREE(cfg->osh, hang_info, VENDOR_SEND_HANG_EXT_INFO_LEN);
+       }
+
+#ifdef DHD_LOG_DUMP
+       dhd_logdump_cookie_save(dhd, dhd->debug_dump_time_hang_str, "HANG");
+#endif /*  DHD_LOG_DUMP */
+
+       if (dhd) {
+               clear_debug_dump_time(dhd->debug_dump_time_str);
+       }
+}
+
+void
+wl_copy_hang_info_if_falure(struct net_device *dev, u16 reason, s32 ret)
+{
+       struct bcm_cfg80211 *cfg = NULL;
+       dhd_pub_t *dhd;
+       s32 err = 0;
+       char ioctl_buf[WLC_IOCTL_SMLEN];
+       memuse_info_t mu;
+       int bytes_written = 0;
+       int remain_len = 0;
+
+       if (!dev) {
+               WL_ERR(("dev is null"));
+               return;
+
+       }
+
+       cfg = wl_get_cfg(dev);
+       if (!cfg) {
+               WL_ERR(("dev=%p cfg=%p\n", dev, cfg));
+               return;
+       }
+
+       dhd = (dhd_pub_t *)(cfg->pub);
+
+       if (!dhd || !dhd->hang_info) {
+               WL_ERR(("%s dhd=%p hang_info=%p\n", __FUNCTION__,
+                       dhd, (dhd ? dhd->hang_info : NULL)));
+               return;
+       }
+
+       err = wldev_iovar_getbuf_bsscfg(dev, "memuse",
+                       NULL, 0, ioctl_buf, WLC_IOCTL_SMLEN, 0, NULL);
+       if (unlikely(err)) {
+               WL_ERR(("error (%d)\n", err));
+               return;
+       }
+
+       memcpy(&mu, ioctl_buf, sizeof(memuse_info_t));
+
+       if (mu.len >= sizeof(memuse_info_t)) {
+               WL_ERR(("Heap Total: %d(%dK)\n", mu.arena_size, KB(mu.arena_size)));
+               WL_ERR(("Free: %d(%dK), LWM: %d(%dK)\n",
+                       mu.arena_free, KB(mu.arena_free),
+                       mu.free_lwm, KB(mu.free_lwm)));
+               WL_ERR(("In use: %d(%dK), HWM: %d(%dK)\n",
+                       mu.inuse_size, KB(mu.inuse_size),
+                       mu.inuse_hwm, KB(mu.inuse_hwm)));
+               WL_ERR(("Malloc failure count: %d\n", mu.mf_count));
+       }
+
+       memset(dhd->hang_info, 0, VENDOR_SEND_HANG_EXT_INFO_LEN);
+       remain_len = VENDOR_SEND_HANG_EXT_INFO_LEN - bytes_written;
+
+       get_debug_dump_time(dhd->debug_dump_time_hang_str);
+       copy_debug_dump_time(dhd->debug_dump_time_str, dhd->debug_dump_time_hang_str);
+
+       bytes_written += scnprintf(&dhd->hang_info[bytes_written], remain_len,
+                       "%d %d %s %d %d %d %d %d %08x %08x",
+                       reason, VENDOR_SEND_HANG_EXT_INFO_VER,
+                       dhd->debug_dump_time_hang_str,
+                       ret, mu.arena_size, mu.arena_free, mu.inuse_size, mu.mf_count, 0, 0);
+
+       dhd->hang_info_cnt = HANG_FIELD_IF_FAILURE_CNT;
+
+       clear_debug_dump_time(dhd->debug_dump_time_hang_str);
+
+       return;
+}
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
diff --git a/bcmdhd.101.10.240.x/wl_cfgvendor.h b/bcmdhd.101.10.240.x/wl_cfgvendor.h
new file mode 100644 (file)
index 0000000..9b9d589
--- /dev/null
@@ -0,0 +1,811 @@
+/*
+ * Linux cfg80211 Vendor Extension Code
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+/*
+ * New vendor interface additon to nl80211/cfg80211 to allow vendors
+ * to implement proprietary features over the cfg80211 stack.
+ */
+
+#ifndef _wl_cfgvendor_h_
+#define _wl_cfgvendor_h_
+
+#define OUI_BRCM    0x001018
+#define OUI_GOOGLE  0x001A11
+#define BRCM_VENDOR_SUBCMD_PRIV_STR    1
+#define ATTRIBUTE_U32_LEN                  (NLA_HDRLEN  + 4)
+#define VENDOR_ID_OVERHEAD                 ATTRIBUTE_U32_LEN
+#define VENDOR_SUBCMD_OVERHEAD             ATTRIBUTE_U32_LEN
+#define VENDOR_DATA_OVERHEAD               (NLA_HDRLEN)
+#define ETHERTYPE_IP            0x0800          /* IP */
+#define ETHERTYPE_IPV6          0x86dd          /* IP protocol version 6 */
+
+enum brcm_vendor_attr {
+       BRCM_ATTR_DRIVER_CMD            = 0,
+       BRCM_ATTR_DRIVER_KEY_PMK        = 1,
+       BRCM_ATTR_DRIVER_FEATURE_FLAGS  = 2,
+       BRCM_ATTR_DRIVER_RAND_MAC       = 3,
+       BRCM_ATTR_SAE_PWE               = 4,
+       BRCM_ATTR_DRIVER_MAX            = 5
+};
+
+enum brcm_wlan_vendor_features {
+       BRCM_WLAN_VENDOR_FEATURE_KEY_MGMT_OFFLOAD       = 0,
+       BRCM_WLAN_VENDOR_FEATURES_MAX                   = 1
+};
+
+#define SCAN_RESULTS_COMPLETE_FLAG_LEN       ATTRIBUTE_U32_LEN
+#define SCAN_INDEX_HDR_LEN                   (NLA_HDRLEN)
+#define SCAN_ID_HDR_LEN                      ATTRIBUTE_U32_LEN
+#define SCAN_FLAGS_HDR_LEN                   ATTRIBUTE_U32_LEN
+#define GSCAN_NUM_RESULTS_HDR_LEN            ATTRIBUTE_U32_LEN
+#define GSCAN_CH_BUCKET_MASK_HDR_LEN         ATTRIBUTE_U32_LEN
+#define GSCAN_RESULTS_HDR_LEN                (NLA_HDRLEN)
+#define GSCAN_BATCH_RESULT_HDR_LEN  (SCAN_INDEX_HDR_LEN + SCAN_ID_HDR_LEN + \
+                                                                       SCAN_FLAGS_HDR_LEN + \
+                                                               GSCAN_NUM_RESULTS_HDR_LEN + \
+                                                               GSCAN_CH_BUCKET_MASK_HDR_LEN + \
+                                                                       GSCAN_RESULTS_HDR_LEN)
+
+#define VENDOR_REPLY_OVERHEAD       (VENDOR_ID_OVERHEAD + \
+                                                                       VENDOR_SUBCMD_OVERHEAD + \
+                                                                       VENDOR_DATA_OVERHEAD)
+
+#define GSCAN_ATTR_SET1                                10
+#define GSCAN_ATTR_SET2                                20
+#define GSCAN_ATTR_SET3                                30
+#define GSCAN_ATTR_SET4                                40
+#define GSCAN_ATTR_SET5                                50
+#define GSCAN_ATTR_SET6                                60
+#define GSCAN_ATTR_SET7                                70
+#define GSCAN_ATTR_SET8                                80
+#define GSCAN_ATTR_SET9                                90
+#define GSCAN_ATTR_SET10                       100
+#define GSCAN_ATTR_SET11                       110
+#define GSCAN_ATTR_SET12                       120
+#define GSCAN_ATTR_SET13                       130
+#define GSCAN_ATTR_SET14                       140
+
+#define NAN_SVC_INFO_LEN                       255
+#define NAN_SID_ENABLE_FLAG_INVALID    0xff
+#define NAN_SID_BEACON_COUNT_INVALID   0xff
+#define WL_NAN_DW_INTERVAL 512
+
+#define CFG80211_VENDOR_CMD_REPLY_SKB_SZ       100
+#define CFG80211_VENDOR_EVT_SKB_SZ                     2048
+
+#define SUPP_SAE_PWE_LOOP      0x00
+#define SUPP_SAE_PWE_H2E       0x01
+#define SUPP_SAE_PWE_TRANS     0x02
+
+typedef enum {
+       /* don't use 0 as a valid subcommand */
+       VENDOR_NL80211_SUBCMD_UNSPECIFIED,
+
+       /* define all vendor startup commands between 0x0 and 0x0FFF */
+       VENDOR_NL80211_SUBCMD_RANGE_START = 0x0001,
+       VENDOR_NL80211_SUBCMD_RANGE_END   = 0x0FFF,
+
+       /* define all GScan related commands between 0x1000 and 0x10FF */
+       ANDROID_NL80211_SUBCMD_GSCAN_RANGE_START = 0x1000,
+       ANDROID_NL80211_SUBCMD_GSCAN_RANGE_END   = 0x10FF,
+
+       /* define all RTT related commands between 0x1100 and 0x11FF */
+       ANDROID_NL80211_SUBCMD_RTT_RANGE_START = 0x1100,
+       ANDROID_NL80211_SUBCMD_RTT_RANGE_END   = 0x11FF,
+
+       ANDROID_NL80211_SUBCMD_LSTATS_RANGE_START = 0x1200,
+       ANDROID_NL80211_SUBCMD_LSTATS_RANGE_END   = 0x12FF,
+
+       ANDROID_NL80211_SUBCMD_TDLS_RANGE_START = 0x1300,
+       ANDROID_NL80211_SUBCMD_TDLS_RANGE_END   = 0x13FF,
+
+       ANDROID_NL80211_SUBCMD_DEBUG_RANGE_START = 0x1400,
+       ANDROID_NL80211_SUBCMD_DEBUG_RANGE_END  = 0x14FF,
+
+       /* define all NearbyDiscovery related commands between 0x1500 and 0x15FF */
+       ANDROID_NL80211_SUBCMD_NBD_RANGE_START = 0x1500,
+       ANDROID_NL80211_SUBCMD_NBD_RANGE_END   = 0x15FF,
+
+       /* define all wifi calling related commands between 0x1600 and 0x16FF */
+       ANDROID_NL80211_SUBCMD_WIFI_OFFLOAD_RANGE_START = 0x1600,
+       ANDROID_NL80211_SUBCMD_WIFI_OFFLOAD_RANGE_END   = 0x16FF,
+
+       /* define all NAN related commands between 0x1700 and 0x17FF */
+       ANDROID_NL80211_SUBCMD_NAN_RANGE_START = 0x1700,
+       ANDROID_NL80211_SUBCMD_NAN_RANGE_END   = 0x17FF,
+
+       /* define all packet filter related commands between 0x1800 and 0x18FF */
+       ANDROID_NL80211_SUBCMD_PKT_FILTER_RANGE_START = 0x1800,
+       ANDROID_NL80211_SUBCMD_PKT_FILTER_RANGE_END   = 0x18FF,
+
+       /* define all tx power related commands between 0x1900 and 0x19FF */
+       ANDROID_NL80211_SUBCMD_TX_POWER_RANGE_START =   0x1900,
+       ANDROID_NL80211_SUBCMD_TX_POWER_RANGE_END =     0x19FF,
+
+       /* This is reserved for future usage */
+
+} ANDROID_VENDOR_SUB_COMMAND;
+
+enum andr_vendor_subcmd {
+       GSCAN_SUBCMD_GET_CAPABILITIES = ANDROID_NL80211_SUBCMD_GSCAN_RANGE_START,
+       GSCAN_SUBCMD_SET_CONFIG,
+       GSCAN_SUBCMD_SET_SCAN_CONFIG,
+       GSCAN_SUBCMD_ENABLE_GSCAN,
+       GSCAN_SUBCMD_GET_SCAN_RESULTS,
+       GSCAN_SUBCMD_SCAN_RESULTS,
+       GSCAN_SUBCMD_SET_HOTLIST,
+       GSCAN_SUBCMD_SET_SIGNIFICANT_CHANGE_CONFIG,
+       GSCAN_SUBCMD_ENABLE_FULL_SCAN_RESULTS,
+       GSCAN_SUBCMD_GET_CHANNEL_LIST,
+       /* ANDR_WIFI_XXX although not related to gscan are defined here */
+       ANDR_WIFI_SUBCMD_GET_FEATURE_SET,
+       ANDR_WIFI_SUBCMD_GET_FEATURE_SET_MATRIX,
+       ANDR_WIFI_RANDOM_MAC_OUI,
+       ANDR_WIFI_NODFS_CHANNELS,
+       ANDR_WIFI_SET_COUNTRY,
+       GSCAN_SUBCMD_SET_EPNO_SSID,
+       WIFI_SUBCMD_SET_SSID_WHITELIST,
+       WIFI_SUBCMD_SET_LAZY_ROAM_PARAMS,
+       WIFI_SUBCMD_ENABLE_LAZY_ROAM,
+       WIFI_SUBCMD_SET_BSSID_PREF,
+       WIFI_SUBCMD_SET_BSSID_BLACKLIST,
+       GSCAN_SUBCMD_ANQPO_CONFIG,
+       WIFI_SUBCMD_SET_RSSI_MONITOR,
+       WIFI_SUBCMD_CONFIG_ND_OFFLOAD,
+       WIFI_SUBCMD_CONFIG_TCPACK_SUP,
+       WIFI_SUBCMD_FW_ROAM_POLICY,
+       WIFI_SUBCMD_ROAM_CAPABILITY,
+       WIFI_SUBCMD_SET_LATENCY_MODE,
+       RTT_SUBCMD_SET_CONFIG = ANDROID_NL80211_SUBCMD_RTT_RANGE_START,
+       RTT_SUBCMD_CANCEL_CONFIG,
+       RTT_SUBCMD_GETCAPABILITY,
+       RTT_SUBCMD_GETAVAILCHANNEL,
+       RTT_SUBCMD_SET_RESPONDER,
+       RTT_SUBCMD_CANCEL_RESPONDER,
+       LSTATS_SUBCMD_GET_INFO = ANDROID_NL80211_SUBCMD_LSTATS_RANGE_START,
+
+       DEBUG_START_LOGGING = ANDROID_NL80211_SUBCMD_DEBUG_RANGE_START,
+       DEBUG_TRIGGER_MEM_DUMP,
+       DEBUG_GET_MEM_DUMP,
+       DEBUG_GET_VER,
+       DEBUG_GET_RING_STATUS,
+       DEBUG_GET_RING_DATA,
+       DEBUG_GET_FEATURE,
+       DEBUG_RESET_LOGGING,
+
+       DEBUG_TRIGGER_DRIVER_MEM_DUMP,
+       DEBUG_GET_DRIVER_MEM_DUMP,
+       DEBUG_START_PKT_FATE_MONITORING,
+       DEBUG_GET_TX_PKT_FATES,
+       DEBUG_GET_RX_PKT_FATES,
+       DEBUG_GET_WAKE_REASON_STATS,
+       DEBUG_GET_FILE_DUMP_BUF,
+       DEBUG_FILE_DUMP_DONE_IND,
+       DEBUG_SET_HAL_START,
+       DEBUG_SET_HAL_STOP,
+
+       WIFI_OFFLOAD_SUBCMD_START_MKEEP_ALIVE = ANDROID_NL80211_SUBCMD_WIFI_OFFLOAD_RANGE_START,
+       WIFI_OFFLOAD_SUBCMD_STOP_MKEEP_ALIVE,
+
+       NAN_WIFI_SUBCMD_ENABLE = ANDROID_NL80211_SUBCMD_NAN_RANGE_START,         /* 0x1700 */
+       NAN_WIFI_SUBCMD_DISABLE,                                                 /* 0x1701 */
+       NAN_WIFI_SUBCMD_REQUEST_PUBLISH,                                         /* 0x1702 */
+       NAN_WIFI_SUBCMD_REQUEST_SUBSCRIBE,                                       /* 0x1703 */
+       NAN_WIFI_SUBCMD_CANCEL_PUBLISH,                                          /* 0x1704 */
+       NAN_WIFI_SUBCMD_CANCEL_SUBSCRIBE,                                        /* 0x1705 */
+       NAN_WIFI_SUBCMD_TRANSMIT,                                                /* 0x1706 */
+       NAN_WIFI_SUBCMD_CONFIG,                                                  /* 0x1707 */
+       NAN_WIFI_SUBCMD_TCA,                                                     /* 0x1708 */
+       NAN_WIFI_SUBCMD_STATS,                                                   /* 0x1709 */
+       NAN_WIFI_SUBCMD_GET_CAPABILITIES,                                        /* 0x170A */
+       NAN_WIFI_SUBCMD_DATA_PATH_IFACE_CREATE,                                  /* 0x170B */
+       NAN_WIFI_SUBCMD_DATA_PATH_IFACE_DELETE,                                  /* 0x170C */
+       NAN_WIFI_SUBCMD_DATA_PATH_REQUEST,                                       /* 0x170D */
+       NAN_WIFI_SUBCMD_DATA_PATH_RESPONSE,                                      /* 0x170E */
+       NAN_WIFI_SUBCMD_DATA_PATH_END,                                           /* 0x170F */
+       NAN_WIFI_SUBCMD_DATA_PATH_SEC_INFO,                                      /* 0x1710 */
+       NAN_WIFI_SUBCMD_VERSION_INFO,                                            /* 0x1711 */
+       NAN_WIFI_SUBCMD_ENABLE_MERGE,                                            /* 0x1712 */
+       APF_SUBCMD_GET_CAPABILITIES = ANDROID_NL80211_SUBCMD_PKT_FILTER_RANGE_START,
+       APF_SUBCMD_SET_FILTER,
+       WIFI_SUBCMD_TX_POWER_SCENARIO = ANDROID_NL80211_SUBCMD_TX_POWER_RANGE_START,
+       /* Add more sub commands here */
+       VENDOR_SUBCMD_MAX
+};
+
+enum gscan_attributes {
+    GSCAN_ATTRIBUTE_NUM_BUCKETS = GSCAN_ATTR_SET1,
+    GSCAN_ATTRIBUTE_BASE_PERIOD,
+    GSCAN_ATTRIBUTE_BUCKETS_BAND,
+    GSCAN_ATTRIBUTE_BUCKET_ID,
+    GSCAN_ATTRIBUTE_BUCKET_PERIOD,
+    GSCAN_ATTRIBUTE_BUCKET_NUM_CHANNELS,
+    GSCAN_ATTRIBUTE_BUCKET_CHANNELS,
+    GSCAN_ATTRIBUTE_NUM_AP_PER_SCAN,
+    GSCAN_ATTRIBUTE_REPORT_THRESHOLD,
+    GSCAN_ATTRIBUTE_NUM_SCANS_TO_CACHE,
+    GSCAN_ATTRIBUTE_BAND = GSCAN_ATTRIBUTE_BUCKETS_BAND,
+
+    GSCAN_ATTRIBUTE_ENABLE_FEATURE = GSCAN_ATTR_SET2,
+    GSCAN_ATTRIBUTE_SCAN_RESULTS_COMPLETE,
+    GSCAN_ATTRIBUTE_FLUSH_FEATURE,
+    GSCAN_ATTRIBUTE_ENABLE_FULL_SCAN_RESULTS,
+    GSCAN_ATTRIBUTE_REPORT_EVENTS,
+    /* remaining reserved for additional attributes */
+    GSCAN_ATTRIBUTE_NUM_OF_RESULTS = GSCAN_ATTR_SET3,
+    GSCAN_ATTRIBUTE_FLUSH_RESULTS,
+    GSCAN_ATTRIBUTE_SCAN_RESULTS,                       /* flat array of wifi_scan_result */
+    GSCAN_ATTRIBUTE_SCAN_ID,                            /* indicates scan number */
+    GSCAN_ATTRIBUTE_SCAN_FLAGS,                         /* indicates if scan was aborted */
+    GSCAN_ATTRIBUTE_AP_FLAGS,                           /* flags on significant change event */
+    GSCAN_ATTRIBUTE_NUM_CHANNELS,
+    GSCAN_ATTRIBUTE_CHANNEL_LIST,
+    GSCAN_ATTRIBUTE_CH_BUCKET_BITMASK,
+
+       /* remaining reserved for additional attributes */
+
+    GSCAN_ATTRIBUTE_SSID = GSCAN_ATTR_SET4,
+    GSCAN_ATTRIBUTE_BSSID,
+    GSCAN_ATTRIBUTE_CHANNEL,
+    GSCAN_ATTRIBUTE_RSSI,
+    GSCAN_ATTRIBUTE_TIMESTAMP,
+    GSCAN_ATTRIBUTE_RTT,
+    GSCAN_ATTRIBUTE_RTTSD,
+
+    /* remaining reserved for additional attributes */
+
+    GSCAN_ATTRIBUTE_HOTLIST_BSSIDS = GSCAN_ATTR_SET5,
+    GSCAN_ATTRIBUTE_RSSI_LOW,
+    GSCAN_ATTRIBUTE_RSSI_HIGH,
+    GSCAN_ATTRIBUTE_HOSTLIST_BSSID_ELEM,
+    GSCAN_ATTRIBUTE_HOTLIST_FLUSH,
+    GSCAN_ATTRIBUTE_HOTLIST_BSSID_COUNT,
+
+    /* remaining reserved for additional attributes */
+    GSCAN_ATTRIBUTE_RSSI_SAMPLE_SIZE = GSCAN_ATTR_SET6,
+    GSCAN_ATTRIBUTE_LOST_AP_SAMPLE_SIZE,
+    GSCAN_ATTRIBUTE_MIN_BREACHING,
+    GSCAN_ATTRIBUTE_SIGNIFICANT_CHANGE_BSSIDS,
+    GSCAN_ATTRIBUTE_SIGNIFICANT_CHANGE_FLUSH,
+
+    /* EPNO */
+    GSCAN_ATTRIBUTE_EPNO_SSID_LIST = GSCAN_ATTR_SET7,
+    GSCAN_ATTRIBUTE_EPNO_SSID,
+    GSCAN_ATTRIBUTE_EPNO_SSID_LEN,
+    GSCAN_ATTRIBUTE_EPNO_RSSI,
+    GSCAN_ATTRIBUTE_EPNO_FLAGS,
+    GSCAN_ATTRIBUTE_EPNO_AUTH,
+    GSCAN_ATTRIBUTE_EPNO_SSID_NUM,
+    GSCAN_ATTRIBUTE_EPNO_FLUSH,
+
+    /* Roam SSID Whitelist and BSSID pref */
+    GSCAN_ATTRIBUTE_WHITELIST_SSID = GSCAN_ATTR_SET8,
+    GSCAN_ATTRIBUTE_NUM_WL_SSID,
+    GSCAN_ATTRIBUTE_WL_SSID_LEN,
+    GSCAN_ATTRIBUTE_WL_SSID_FLUSH,
+    GSCAN_ATTRIBUTE_WHITELIST_SSID_ELEM,
+    GSCAN_ATTRIBUTE_NUM_BSSID,
+    GSCAN_ATTRIBUTE_BSSID_PREF_LIST,
+    GSCAN_ATTRIBUTE_BSSID_PREF_FLUSH,
+    GSCAN_ATTRIBUTE_BSSID_PREF,
+    GSCAN_ATTRIBUTE_RSSI_MODIFIER,
+
+    /* Roam cfg */
+    GSCAN_ATTRIBUTE_A_BAND_BOOST_THRESHOLD = GSCAN_ATTR_SET9,
+    GSCAN_ATTRIBUTE_A_BAND_PENALTY_THRESHOLD,
+    GSCAN_ATTRIBUTE_A_BAND_BOOST_FACTOR,
+    GSCAN_ATTRIBUTE_A_BAND_PENALTY_FACTOR,
+    GSCAN_ATTRIBUTE_A_BAND_MAX_BOOST,
+    GSCAN_ATTRIBUTE_LAZY_ROAM_HYSTERESIS,
+    GSCAN_ATTRIBUTE_ALERT_ROAM_RSSI_TRIGGER,
+    GSCAN_ATTRIBUTE_LAZY_ROAM_ENABLE,
+
+    /* BSSID blacklist */
+    GSCAN_ATTRIBUTE_BSSID_BLACKLIST_FLUSH = GSCAN_ATTR_SET10,
+    GSCAN_ATTRIBUTE_BLACKLIST_BSSID,
+
+    GSCAN_ATTRIBUTE_ANQPO_HS_LIST = GSCAN_ATTR_SET11,
+    GSCAN_ATTRIBUTE_ANQPO_HS_LIST_SIZE,
+    GSCAN_ATTRIBUTE_ANQPO_HS_NETWORK_ID,
+    GSCAN_ATTRIBUTE_ANQPO_HS_NAI_REALM,
+    GSCAN_ATTRIBUTE_ANQPO_HS_ROAM_CONSORTIUM_ID,
+    GSCAN_ATTRIBUTE_ANQPO_HS_PLMN,
+
+    /* Adaptive scan attributes */
+    GSCAN_ATTRIBUTE_BUCKET_STEP_COUNT = GSCAN_ATTR_SET12,
+    GSCAN_ATTRIBUTE_BUCKET_MAX_PERIOD,
+
+    /* ePNO cfg */
+    GSCAN_ATTRIBUTE_EPNO_5G_RSSI_THR = GSCAN_ATTR_SET13,
+    GSCAN_ATTRIBUTE_EPNO_2G_RSSI_THR,
+    GSCAN_ATTRIBUTE_EPNO_INIT_SCORE_MAX,
+    GSCAN_ATTRIBUTE_EPNO_CUR_CONN_BONUS,
+    GSCAN_ATTRIBUTE_EPNO_SAME_NETWORK_BONUS,
+    GSCAN_ATTRIBUTE_EPNO_SECURE_BONUS,
+    GSCAN_ATTRIBUTE_EPNO_5G_BONUS,
+
+    /* Android O Roaming features */
+    GSCAN_ATTRIBUTE_ROAM_STATE_SET = GSCAN_ATTR_SET14,
+
+    GSCAN_ATTRIBUTE_MAX
+};
+
+enum gscan_bucket_attributes {
+       GSCAN_ATTRIBUTE_CH_BUCKET_1,
+       GSCAN_ATTRIBUTE_CH_BUCKET_2,
+       GSCAN_ATTRIBUTE_CH_BUCKET_3,
+       GSCAN_ATTRIBUTE_CH_BUCKET_4,
+       GSCAN_ATTRIBUTE_CH_BUCKET_5,
+       GSCAN_ATTRIBUTE_CH_BUCKET_6,
+       GSCAN_ATTRIBUTE_CH_BUCKET_7
+};
+
+enum gscan_ch_attributes {
+       GSCAN_ATTRIBUTE_CH_ID_1,
+       GSCAN_ATTRIBUTE_CH_ID_2,
+       GSCAN_ATTRIBUTE_CH_ID_3,
+       GSCAN_ATTRIBUTE_CH_ID_4,
+       GSCAN_ATTRIBUTE_CH_ID_5,
+       GSCAN_ATTRIBUTE_CH_ID_6,
+       GSCAN_ATTRIBUTE_CH_ID_7
+};
+
+enum rtt_attributes {
+       RTT_ATTRIBUTE_TARGET_CNT,
+       RTT_ATTRIBUTE_TARGET_INFO,
+       RTT_ATTRIBUTE_TARGET_MAC,
+       RTT_ATTRIBUTE_TARGET_TYPE,
+       RTT_ATTRIBUTE_TARGET_PEER,
+       RTT_ATTRIBUTE_TARGET_CHAN,
+       RTT_ATTRIBUTE_TARGET_PERIOD,
+       RTT_ATTRIBUTE_TARGET_NUM_BURST,
+       RTT_ATTRIBUTE_TARGET_NUM_FTM_BURST,
+       RTT_ATTRIBUTE_TARGET_NUM_RETRY_FTM,
+       RTT_ATTRIBUTE_TARGET_NUM_RETRY_FTMR,
+       RTT_ATTRIBUTE_TARGET_LCI,
+       RTT_ATTRIBUTE_TARGET_LCR,
+       RTT_ATTRIBUTE_TARGET_BURST_DURATION,
+       RTT_ATTRIBUTE_TARGET_PREAMBLE,
+       RTT_ATTRIBUTE_TARGET_BW,
+       RTT_ATTRIBUTE_RESULTS_COMPLETE = 30,
+       RTT_ATTRIBUTE_RESULTS_PER_TARGET,
+       RTT_ATTRIBUTE_RESULT_CNT,
+       RTT_ATTRIBUTE_RESULT,
+       RTT_ATTRIBUTE_RESULT_DETAIL
+};
+
+enum wifi_rssi_monitor_attr {
+       RSSI_MONITOR_ATTRIBUTE_MAX_RSSI,
+       RSSI_MONITOR_ATTRIBUTE_MIN_RSSI,
+       RSSI_MONITOR_ATTRIBUTE_START
+};
+
+enum wifi_sae_key_attr {
+       BRCM_SAE_KEY_ATTR_PEER_MAC,
+       BRCM_SAE_KEY_ATTR_PMK,
+       BRCM_SAE_KEY_ATTR_PMKID
+};
+
+enum debug_attributes {
+       DEBUG_ATTRIBUTE_GET_DRIVER,
+       DEBUG_ATTRIBUTE_GET_FW,
+       DEBUG_ATTRIBUTE_RING_ID,
+       DEBUG_ATTRIBUTE_RING_NAME,
+       DEBUG_ATTRIBUTE_RING_FLAGS,
+       DEBUG_ATTRIBUTE_LOG_LEVEL,
+       DEBUG_ATTRIBUTE_LOG_TIME_INTVAL,
+       DEBUG_ATTRIBUTE_LOG_MIN_DATA_SIZE,
+//     DEBUG_ATTRIBUTE_DUMP_FILENAME,
+       DEBUG_ATTRIBUTE_FW_DUMP_LEN,
+       DEBUG_ATTRIBUTE_FW_DUMP_DATA,
+       DEBUG_ATTRIBUTE_RING_DATA,
+       DEBUG_ATTRIBUTE_RING_STATUS,
+       DEBUG_ATTRIBUTE_RING_NUM,
+       DEBUG_ATTRIBUTE_DRIVER_DUMP_LEN,
+       DEBUG_ATTRIBUTE_DRIVER_DUMP_DATA,
+       DEBUG_ATTRIBUTE_PKT_FATE_NUM,
+       DEBUG_ATTRIBUTE_PKT_FATE_DATA
+};
+
+typedef enum {
+       DUMP_LEN_ATTR_INVALID = 0,
+       DUMP_LEN_ATTR_MEMDUMP = 1,
+       DUMP_LEN_ATTR_SSSR_C0_D11_BEFORE = 2,
+       DUMP_LEN_ATTR_SSSR_C0_D11_AFTER = 3,
+       DUMP_LEN_ATTR_SSSR_C1_D11_BEFORE = 4,
+       DUMP_LEN_ATTR_SSSR_C1_D11_AFTER = 5,
+       DUMP_LEN_ATTR_SSSR_C2_D11_BEFORE = 6,
+       DUMP_LEN_ATTR_SSSR_C2_D11_AFTER = 7,
+       DUMP_LEN_ATTR_SSSR_DIG_BEFORE = 8,
+       DUMP_LEN_ATTR_SSSR_DIG_AFTER = 9,
+       DUMP_LEN_ATTR_TIMESTAMP = 10,
+       DUMP_LEN_ATTR_GENERAL_LOG = 11,
+       DUMP_LEN_ATTR_ECNTRS = 12,
+       DUMP_LEN_ATTR_SPECIAL_LOG = 13,
+       DUMP_LEN_ATTR_DHD_DUMP = 14,
+       DUMP_LEN_ATTR_EXT_TRAP = 15,
+       DUMP_LEN_ATTR_HEALTH_CHK = 16,
+       DUMP_LEN_ATTR_PRESERVE_LOG = 17,
+       DUMP_LEN_ATTR_COOKIE = 18,
+       DUMP_LEN_ATTR_FLOWRING_DUMP = 19,
+       DUMP_LEN_ATTR_PKTLOG = 20,
+       DUMP_LEN_ATTR_PKTLOG_DEBUG = 21,
+       DUMP_FILENAME_ATTR_DEBUG_DUMP = 22,
+       DUMP_FILENAME_ATTR_MEM_DUMP = 23,
+       DUMP_FILENAME_ATTR_SSSR_CORE_0_BEFORE_DUMP = 24,
+       DUMP_FILENAME_ATTR_SSSR_CORE_0_AFTER_DUMP = 25,
+       DUMP_FILENAME_ATTR_SSSR_CORE_1_BEFORE_DUMP = 26,
+       DUMP_FILENAME_ATTR_SSSR_CORE_1_AFTER_DUMP = 27,
+       DUMP_FILENAME_ATTR_SSSR_CORE_2_BEFORE_DUMP = 28,
+       DUMP_FILENAME_ATTR_SSSR_CORE_2_AFTER_DUMP = 29,
+       DUMP_FILENAME_ATTR_SSSR_DIG_BEFORE_DUMP = 30,
+       DUMP_FILENAME_ATTR_SSSR_DIG_AFTER_DUMP = 31,
+       DUMP_FILENAME_ATTR_PKTLOG_DUMP = 32,
+       DUMP_FILENAME_ATTR_PKTLOG_DEBUG_DUMP = 33,
+       DUMP_LEN_ATTR_STATUS_LOG = 34,
+       DUMP_LEN_ATTR_AXI_ERROR = 35,
+       DUMP_FILENAME_ATTR_AXI_ERROR_DUMP = 36,
+       DUMP_LEN_ATTR_RTT_LOG = 37
+       /* Please add new attributes from here to sync up old HAL */
+} EWP_DUMP_EVENT_ATTRIBUTE;
+
+/* Attributes associated with DEBUG_GET_DUMP_BUF */
+typedef enum {
+       DUMP_BUF_ATTR_INVALID = 0,
+       DUMP_BUF_ATTR_MEMDUMP = 1,
+       DUMP_BUF_ATTR_SSSR_C0_D11_BEFORE = 2,
+       DUMP_BUF_ATTR_SSSR_C0_D11_AFTER = 3,
+       DUMP_BUF_ATTR_SSSR_C1_D11_BEFORE = 4,
+       DUMP_BUF_ATTR_SSSR_C1_D11_AFTER = 5,
+       DUMP_BUF_ATTR_SSSR_C2_D11_BEFORE = 6,
+       DUMP_BUF_ATTR_SSSR_C2_D11_AFTER = 7,
+       DUMP_BUF_ATTR_SSSR_DIG_BEFORE = 8,
+       DUMP_BUF_ATTR_SSSR_DIG_AFTER = 9,
+       DUMP_BUF_ATTR_TIMESTAMP = 10,
+       DUMP_BUF_ATTR_GENERAL_LOG = 11,
+       DUMP_BUF_ATTR_ECNTRS = 12,
+       DUMP_BUF_ATTR_SPECIAL_LOG = 13,
+       DUMP_BUF_ATTR_DHD_DUMP = 14,
+       DUMP_BUF_ATTR_EXT_TRAP = 15,
+       DUMP_BUF_ATTR_HEALTH_CHK = 16,
+       DUMP_BUF_ATTR_PRESERVE_LOG = 17,
+       DUMP_BUF_ATTR_COOKIE = 18,
+       DUMP_BUF_ATTR_FLOWRING_DUMP = 19,
+       DUMP_BUF_ATTR_PKTLOG = 20,
+       DUMP_BUF_ATTR_PKTLOG_DEBUG = 21,
+       DUMP_BUF_ATTR_STATUS_LOG = 22,
+       DUMP_BUF_ATTR_AXI_ERROR = 23,
+       DUMP_BUF_ATTR_RTT_LOG = 24
+       /* Please add new attributes from here to sync up old HAL */
+} EWP_DUMP_CMD_ATTRIBUTE;
+
+enum mkeep_alive_attributes {
+       MKEEP_ALIVE_ATTRIBUTE_ID,
+       MKEEP_ALIVE_ATTRIBUTE_IP_PKT,
+       MKEEP_ALIVE_ATTRIBUTE_IP_PKT_LEN,
+       MKEEP_ALIVE_ATTRIBUTE_SRC_MAC_ADDR,
+       MKEEP_ALIVE_ATTRIBUTE_DST_MAC_ADDR,
+       MKEEP_ALIVE_ATTRIBUTE_PERIOD_MSEC,
+       MKEEP_ALIVE_ATTRIBUTE_ETHER_TYPE
+};
+
+typedef enum wl_vendor_event {
+       BRCM_VENDOR_EVENT_UNSPEC                = 0,
+       BRCM_VENDOR_EVENT_PRIV_STR              = 1,
+       GOOGLE_GSCAN_SIGNIFICANT_EVENT          = 2,
+       GOOGLE_GSCAN_GEOFENCE_FOUND_EVENT       = 3,
+       GOOGLE_GSCAN_BATCH_SCAN_EVENT           = 4,
+       GOOGLE_SCAN_FULL_RESULTS_EVENT          = 5,
+       GOOGLE_RTT_COMPLETE_EVENT               = 6,
+       GOOGLE_SCAN_COMPLETE_EVENT              = 7,
+       GOOGLE_GSCAN_GEOFENCE_LOST_EVENT        = 8,
+       GOOGLE_SCAN_EPNO_EVENT                  = 9,
+       GOOGLE_DEBUG_RING_EVENT                 = 10,
+       GOOGLE_FW_DUMP_EVENT                    = 11,
+       GOOGLE_PNO_HOTSPOT_FOUND_EVENT          = 12,
+       GOOGLE_RSSI_MONITOR_EVENT               = 13,
+       GOOGLE_MKEEP_ALIVE_EVENT                = 14,
+
+       /*
+        * BRCM specific events should be placed after
+        * the Generic events so that enums don't mismatch
+        * between the DHD and HAL
+        */
+       GOOGLE_NAN_EVENT_ENABLED                = 15,
+       GOOGLE_NAN_EVENT_DISABLED               = 16,
+       GOOGLE_NAN_EVENT_SUBSCRIBE_MATCH        = 17,
+       GOOGLE_NAN_EVENT_REPLIED                = 18,
+       GOOGLE_NAN_EVENT_PUBLISH_TERMINATED     = 19,
+       GOOGLE_NAN_EVENT_SUBSCRIBE_TERMINATED   = 20,
+       GOOGLE_NAN_EVENT_DE_EVENT               = 21,
+       GOOGLE_NAN_EVENT_FOLLOWUP               = 22,
+       GOOGLE_NAN_EVENT_TRANSMIT_FOLLOWUP_IND  = 23,
+       GOOGLE_NAN_EVENT_DATA_REQUEST           = 24,
+       GOOGLE_NAN_EVENT_DATA_CONFIRMATION      = 25,
+       GOOGLE_NAN_EVENT_DATA_END               = 26,
+       GOOGLE_NAN_EVENT_BEACON                 = 27,
+       GOOGLE_NAN_EVENT_SDF                    = 28,
+       GOOGLE_NAN_EVENT_TCA                    = 29,
+       GOOGLE_NAN_EVENT_SUBSCRIBE_UNMATCH      = 30,
+       GOOGLE_NAN_EVENT_UNKNOWN                = 31,
+       GOOGLE_ROAM_EVENT_START                 = 32,
+       BRCM_VENDOR_EVENT_HANGED                = 33,
+       BRCM_VENDOR_EVENT_SAE_KEY               = 34,
+       BRCM_VENDOR_EVENT_BEACON_RECV           = 35,
+       BRCM_VENDOR_EVENT_PORT_AUTHORIZED       = 36,
+       GOOGLE_FILE_DUMP_EVENT                  = 37,
+       BRCM_VENDOR_EVENT_CU                    = 38,
+       BRCM_VENDOR_EVENT_WIPS                  = 39,
+       NAN_ASYNC_RESPONSE_DISABLED             = 40,
+       BRCM_VENDOR_EVENT_RCC_INFO              = 41
+} wl_vendor_event_t;
+
+enum andr_wifi_attr {
+       ANDR_WIFI_ATTRIBUTE_NUM_FEATURE_SET,
+       ANDR_WIFI_ATTRIBUTE_FEATURE_SET,
+       ANDR_WIFI_ATTRIBUTE_RANDOM_MAC_OUI,
+       ANDR_WIFI_ATTRIBUTE_NODFS_SET,
+       ANDR_WIFI_ATTRIBUTE_COUNTRY,
+       ANDR_WIFI_ATTRIBUTE_ND_OFFLOAD_VALUE,
+       ANDR_WIFI_ATTRIBUTE_TCPACK_SUP_VALUE,
+       ANDR_WIFI_ATTRIBUTE_LATENCY_MODE,
+       ANDR_WIFI_ATTRIBUTE_RANDOM_MAC,
+       ANDR_WIFI_ATTRIBUTE_TX_POWER_SCENARIO
+};
+enum apf_attributes {
+       APF_ATTRIBUTE_VERSION,
+       APF_ATTRIBUTE_MAX_LEN,
+       APF_ATTRIBUTE_PROGRAM,
+       APF_ATTRIBUTE_PROGRAM_LEN
+};
+
+typedef enum wl_vendor_gscan_attribute {
+       ATTR_START_GSCAN,
+       ATTR_STOP_GSCAN,
+       ATTR_SET_SCAN_BATCH_CFG_ID, /* set batch scan params */
+       ATTR_SET_SCAN_GEOFENCE_CFG_ID, /* set list of bssids to track */
+       ATTR_SET_SCAN_SIGNIFICANT_CFG_ID, /* set list of bssids, rssi threshold etc.. */
+       ATTR_SET_SCAN_CFG_ID, /* set common scan config params here */
+       ATTR_GET_GSCAN_CAPABILITIES_ID,
+    /* Add more sub commands here */
+       ATTR_GSCAN_MAX
+} wl_vendor_gscan_attribute_t;
+
+typedef enum gscan_batch_attribute {
+       ATTR_GSCAN_BATCH_BESTN,
+       ATTR_GSCAN_BATCH_MSCAN,
+       ATTR_GSCAN_BATCH_BUFFER_THRESHOLD
+} gscan_batch_attribute_t;
+
+typedef enum gscan_geofence_attribute {
+       ATTR_GSCAN_NUM_HOTLIST_BSSID,
+       ATTR_GSCAN_HOTLIST_BSSID
+} gscan_geofence_attribute_t;
+
+typedef enum gscan_complete_event {
+       WIFI_SCAN_COMPLETE,
+       WIFI_SCAN_THRESHOLD_NUM_SCANS,
+       WIFI_SCAN_BUFFER_THR_BREACHED
+} gscan_complete_event_t;
+
+#ifdef DHD_WAKE_STATUS
+enum wake_stat_attributes {
+       WAKE_STAT_ATTRIBUTE_TOTAL_CMD_EVENT,
+       WAKE_STAT_ATTRIBUTE_CMD_EVENT_WAKE,
+       WAKE_STAT_ATTRIBUTE_CMD_EVENT_COUNT,
+       WAKE_STAT_ATTRIBUTE_CMD_EVENT_COUNT_USED,
+       WAKE_STAT_ATTRIBUTE_TOTAL_DRIVER_FW,
+       WAKE_STAT_ATTRIBUTE_DRIVER_FW_WAKE,
+       WAKE_STAT_ATTRIBUTE_DRIVER_FW_COUNT,
+       WAKE_STAT_ATTRIBUTE_DRIVER_FW_COUNT_USED,
+       WAKE_STAT_ATTRIBUTE_TOTAL_RX_DATA_WAKE,
+       WAKE_STAT_ATTRIBUTE_RX_UNICAST_COUNT,
+       WAKE_STAT_ATTRIBUTE_RX_MULTICAST_COUNT,
+       WAKE_STAT_ATTRIBUTE_RX_BROADCAST_COUNT,
+       WAKE_STAT_ATTRIBUTE_RX_ICMP_PKT,
+       WAKE_STAT_ATTRIBUTE_RX_ICMP6_PKT,
+       WAKE_STAT_ATTRIBUTE_RX_ICMP6_RA,
+       WAKE_STAT_ATTRIBUTE_RX_ICMP6_NA,
+       WAKE_STAT_ATTRIBUTE_RX_ICMP6_NS,
+       WAKE_STAT_ATTRIBUTE_IPV4_RX_MULTICAST_ADD_CNT,
+       WAKE_STAT_ATTRIBUTE_IPV6_RX_MULTICAST_ADD_CNT,
+       WAKE_STAT_ATTRIBUTE_OTHER_RX_MULTICAST_ADD_CNT
+};
+
+typedef struct rx_data_cnt_details_t {
+       int rx_unicast_cnt;             /* Total rx unicast packet which woke up host */
+       int rx_multicast_cnt;   /* Total rx multicast packet which woke up host */
+       int rx_broadcast_cnt;   /* Total rx broadcast packet which woke up host */
+} RX_DATA_WAKE_CNT_DETAILS;
+
+typedef struct rx_wake_pkt_type_classification_t {
+       int icmp_pkt;   /* wake icmp packet count */
+       int icmp6_pkt;  /* wake icmp6 packet count */
+       int icmp6_ra;   /* wake icmp6 RA packet count */
+       int icmp6_na;   /* wake icmp6 NA packet count */
+       int icmp6_ns;   /* wake icmp6 NS packet count */
+} RX_WAKE_PKT_TYPE_CLASSFICATION;
+
+typedef struct rx_multicast_cnt_t {
+       int ipv4_rx_multicast_addr_cnt; /* Rx wake packet was ipv4 multicast */
+       int ipv6_rx_multicast_addr_cnt; /* Rx wake packet was ipv6 multicast */
+       int other_rx_multicast_addr_cnt; /* Rx wake packet was non-ipv4 and non-ipv6 */
+} RX_MULTICAST_WAKE_DATA_CNT;
+
+typedef struct wlan_driver_wake_reason_cnt_t {
+       int total_cmd_event_wake;    /* Total count of cmd event wakes */
+       int *cmd_event_wake_cnt;     /* Individual wake count array, each index a reason */
+       int cmd_event_wake_cnt_sz;   /* Max number of cmd event wake reasons */
+       int cmd_event_wake_cnt_used; /* Number of cmd event wake reasons specific to the driver */
+       int total_driver_fw_local_wake;    /* Total count of drive/fw wakes, for local reasons */
+       int *driver_fw_local_wake_cnt;     /* Individual wake count array, each index a reason */
+       int driver_fw_local_wake_cnt_sz;   /* Max number of local driver/fw wake reasons */
+       /* Number of local driver/fw wake reasons specific to the driver */
+       int driver_fw_local_wake_cnt_used;
+       int total_rx_data_wake;     /* total data rx packets, that woke up host */
+       RX_DATA_WAKE_CNT_DETAILS rx_wake_details;
+       RX_WAKE_PKT_TYPE_CLASSFICATION rx_wake_pkt_classification_info;
+       RX_MULTICAST_WAKE_DATA_CNT rx_multicast_wake_pkt_info;
+} WLAN_DRIVER_WAKE_REASON_CNT;
+#endif /* DHD_WAKE_STATUS */
+
+#define BRCM_VENDOR_WIPS_EVENT_BUF_LEN 128
+typedef enum wl_vendor_wips_attr_type {
+       WIPS_ATTR_DEAUTH_CNT = 1,
+       WIPS_ATTR_DEAUTH_BSSID,
+       WIPS_ATTR_CURRENT_RSSI,
+       WIPS_ATTR_DEAUTH_RSSI
+} wl_vendor_wips_attr_type_t;
+
+#define BRCM_VENDOR_GET_RCC_EVENT_BUF_LEN      \
+       sizeof(uint32) + DOT11_MAX_SSID_LEN +   \
+       sizeof(int32) + (sizeof(uint16) * MAX_ROAM_CHANNEL)
+typedef enum wl_vendor_get_rcc_attr_type {
+       RCC_ATTRIBUTE_SSID = 1,
+       RCC_ATTRIBUTE_SSID_LEN,
+       RCC_ATTRIBUTE_NUM_CHANNELS,
+       RCC_ATTRIBUTE_CHANNEL_LIST
+} wl_vendor_get_rcc_attr_type_t;
+
+/* Chipset roaming capabilities */
+typedef struct wifi_roaming_capabilities {
+       u32 max_blacklist_size;
+       u32 max_whitelist_size;
+} wifi_roaming_capabilities_t;
+
+typedef enum {
+       SET_HAL_START_ATTRIBUTE_DEINIT = 0x0001,
+       SET_HAL_START_ATTRIBUTE_PRE_INIT = 0x0002
+} SET_HAL_START_ATTRIBUTE;
+
+/* Capture the BRCM_VENDOR_SUBCMD_PRIV_STRINGS* here */
+#define BRCM_VENDOR_SCMD_CAPA  "cap"
+#define MEMDUMP_PATH_LEN       128
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 13, 0)) || defined(WL_VENDOR_EXT_SUPPORT)
+extern int wl_cfgvendor_attach(struct wiphy *wiphy, dhd_pub_t *dhd);
+extern int wl_cfgvendor_detach(struct wiphy *wiphy);
+extern int wl_cfgvendor_send_async_event(struct wiphy *wiphy,
+                  struct net_device *dev, int event_id, const void  *data, int len);
+extern int wl_cfgvendor_send_hotlist_event(struct wiphy *wiphy,
+                struct net_device *dev, void  *data, int len, wl_vendor_event_t event);
+#else
+static INLINE int wl_cfgvendor_attach(struct wiphy *wiphy,
+               dhd_pub_t *dhd) { UNUSED_PARAMETER(wiphy); UNUSED_PARAMETER(dhd); return 0; }
+static INLINE int wl_cfgvendor_detach(struct wiphy *wiphy) { UNUSED_PARAMETER(wiphy); return 0; }
+static INLINE int wl_cfgvendor_send_async_event(struct wiphy *wiphy,
+                  struct net_device *dev, int event_id, const void  *data, int len)
+{ return 0; }
+static INLINE int wl_cfgvendor_send_hotlist_event(struct wiphy *wiphy,
+       struct net_device *dev, void  *data, int len, wl_vendor_event_t event)
+{ return 0; }
+#endif /*  (LINUX_VERSION_CODE > KERNEL_VERSION(3, 13, 0)) || defined(WL_VENDOR_EXT_SUPPORT) */
+
+#if defined(WL_SUPP_EVENT) && ((LINUX_VERSION_CODE > KERNEL_VERSION(3, 13, 0)) || \
+       defined(WL_VENDOR_EXT_SUPPORT))
+extern int wl_cfgvendor_send_supp_eventstring(const char *func, const char *fmt, ...);
+int wl_cfgvendor_notify_supp_event_str(const char *evt_name, const char *fmt, ...);
+#define SUPP_LOG_LEN 256
+#define PRINT_SUPP_LOG(fmt, ...) \
+        wl_cfgvendor_send_supp_eventstring(__func__, fmt, ##__VA_ARGS__);
+#define SUPP_LOG(args)  PRINT_SUPP_LOG  args;
+#define SUPP_EVT_LOG(evt_name, fmt, ...) \
+    wl_cfgvendor_notify_supp_event_str(evt_name, fmt, ##__VA_ARGS__);
+#define SUPP_EVENT(args) SUPP_EVT_LOG args
+#else
+#define SUPP_LOG(x)
+#define SUPP_EVENT(x)
+#endif /* WL_SUPP_EVENT && (kernel > (3, 13, 0)) || WL_VENDOR_EXT_SUPPORT */
+
+#ifdef CONFIG_COMPAT
+#define COMPAT_STRUCT_IFACE(normal_structure, value)   \
+       compat_ ## normal_structure compat_ ## iface;   \
+       int compat_task_state = is_compat_task();                       \
+       normal_structure value;
+
+#define COMPAT_BZERO_IFACE(normal_structure, value)    \
+       do { \
+               if (compat_task_state) {        \
+                       bzero(&compat_ ## value, sizeof(compat_ ## normal_structure));  \
+               } else { \
+                       bzero(&value, sizeof(normal_structure));        \
+               } \
+       } while (0)
+
+#define COMPAT_ASSIGN_VALUE(normal_structure, member, value)   \
+       do { \
+               if (compat_task_state) {        \
+                       compat_ ## normal_structure.member = value; \
+               } else { \
+                       normal_structure.member = value; \
+               } \
+       } while (0)
+
+#define COMPAT_MEMCOPY_IFACE(output, total_len, normal_structure, value, wifi_rate_stat)       \
+       do { \
+               if (compat_task_state) {        \
+                       memcpy(output, &compat_ ## value, sizeof(compat_ ## normal_structure)); \
+                       output += (sizeof(compat_ ## value) - sizeof(wifi_rate_stat));  \
+                       total_len += sizeof(compat_ ## normal_structure);       \
+               } else { \
+                       memcpy(output, &value, sizeof(normal_structure));       \
+                       output += (sizeof(value) - sizeof(wifi_rate_stat));     \
+                       total_len += sizeof(normal_structure);  \
+               } \
+       } while (0)
+#else
+#define COMPAT_STRUCT_IFACE(normal_structure, value)   normal_structure value;
+#define COMPAT_BZERO_IFACE(normal_structure, value)    bzero(&value, sizeof(normal_structure));
+#define COMPAT_ASSIGN_VALUE(normal_structure, member, value)   normal_structure.member = value;
+#define COMPAT_MEMCOPY_IFACE(output, total_len, normal_structure, value, rate_stat)    \
+       do { \
+               memcpy(output, &value, sizeof(normal_structure));       \
+               output += (sizeof(value) - sizeof(wifi_rate_stat));     \
+               total_len += sizeof(normal_structure);  \
+       } while (0)
+#endif /* CONFIG_COMPAT */
+
+#if (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || \
+       LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+#define CFG80211_VENDOR_EVENT_ALLOC(wiphy, wdev, len, type, kflags) \
+       cfg80211_vendor_event_alloc(wiphy, wdev, len, type, kflags);
+#else
+#define CFG80211_VENDOR_EVENT_ALLOC(wiphy, wdev, len, type, kflags) \
+       cfg80211_vendor_event_alloc(wiphy, len, type, kflags);
+#endif /* (defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)) || */
+       /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0) */
+int wl_cfgvendor_nan_send_async_disable_resp(struct wireless_dev *wdev);
+
+#ifdef WL_CFGVENDOR_SEND_HANG_EVENT
+void wl_cfgvendor_send_hang_event(struct net_device *dev, u16 reason,
+       char *string, int hang_info_cnt);
+void wl_copy_hang_info_if_falure(struct net_device *dev, u16 reason, s32 ret);
+#endif /* WL_CFGVENDOR_SEND_HANG_EVENT */
+#ifdef DHD_PKT_LOGGING
+int wl_cfgvendor_dbg_send_pktlog_dbg_file_dump_evt(struct net_device *ndev);
+#endif /* DHD_PKT_LOGGING */
+int wl_cfgvendor_connect_params_handler(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void  *data, int len);
+int wl_cfgvendor_start_ap_params_handler(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void  *data, int len);
+#endif /* _wl_cfgvendor_h_ */
diff --git a/bcmdhd.101.10.240.x/wl_escan.c b/bcmdhd.101.10.240.x/wl_escan.c
new file mode 100644 (file)
index 0000000..2775379
--- /dev/null
@@ -0,0 +1,1593 @@
+
+#if defined(WL_ESCAN)
+#include <bcmendian.h>
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+#include <wl_android.h>
+#include <wl_escan.h>
+#include <dhd_config.h>
+
+#define ESCAN_ERROR(name, arg1, args...) \
+       do { \
+               if (android_msg_level & ANDROID_ERROR_LEVEL) { \
+                       printk(KERN_ERR "[dhd-%s] ESCAN-ERROR) %s : " arg1, name, __func__, ## args); \
+               } \
+       } while (0)
+#define ESCAN_TRACE(name, arg1, args...) \
+       do { \
+               if (android_msg_level & ANDROID_TRACE_LEVEL) { \
+                       printk(KERN_INFO "[dhd-%s] ESCAN-TRACE) %s : " arg1, name, __func__, ## args); \
+               } \
+       } while (0)
+#define ESCAN_SCAN(name, arg1, args...) \
+       do { \
+               if (android_msg_level & ANDROID_SCAN_LEVEL) { \
+                       printk(KERN_INFO "[dhd-%s] ESCAN-SCAN) %s : " arg1, name, __func__, ## args); \
+               } \
+       } while (0)
+#define ESCAN_DBG(name, arg1, args...) \
+       do { \
+               if (android_msg_level & ANDROID_DBG_LEVEL) { \
+                       printk(KERN_INFO "[dhd-%s] ESCAN-DBG) %s : " arg1, name, __func__, ## args); \
+               } \
+       } while (0)
+
+/* IOCTL swapping mode for Big Endian host with Little Endian dongle.  Default to off */
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+#define WL_EXTRA_BUF_MAX 2048
+
+#define wl_escan_get_buf(a) ((wl_scan_results_t *) (a)->escan_buf)
+
+#define for_each_bss(list, bss, __i)   \
+       for (__i = 0; __i < list->count && __i < IW_MAX_AP; __i++, bss = next_bss(list, bss))
+
+#define wl_escan_set_sync_id(a) ((a) = htod16(0x1234))
+
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+#define BUF_OVERFLOW_MGMT_COUNT 3
+typedef struct {
+       int RSSI;
+       int length;
+       struct ether_addr BSSID;
+} removal_element_t;
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+/* Return a new chanspec given a legacy chanspec
+ * Returns INVCHANSPEC on error
+ */
+static chanspec_t
+wl_chspec_from_legacy(chanspec_t legacy_chspec)
+{
+       chanspec_t chspec;
+
+       /* get the channel number */
+       chspec = LCHSPEC_CHANNEL(legacy_chspec);
+
+       /* convert the band */
+       if (LCHSPEC_IS2G(legacy_chspec)) {
+               chspec |= WL_CHANSPEC_BAND_2G;
+       } else {
+               chspec |= WL_CHANSPEC_BAND_5G;
+       }
+
+       /* convert the bw and sideband */
+       if (LCHSPEC_IS20(legacy_chspec)) {
+               chspec |= WL_CHANSPEC_BW_20;
+       } else {
+               chspec |= WL_CHANSPEC_BW_40;
+               if (LCHSPEC_CTL_SB(legacy_chspec) == WL_LCHANSPEC_CTL_SB_LOWER) {
+                       chspec |= WL_CHANSPEC_CTL_SB_L;
+               } else {
+                       chspec |= WL_CHANSPEC_CTL_SB_U;
+               }
+       }
+
+       if (wf_chspec_malformed(chspec)) {
+               ESCAN_ERROR("wlan", "wl_chspec_from_legacy: output chanspec (0x%04X) malformed\n",
+                       chspec);
+               return INVCHANSPEC;
+       }
+
+       return chspec;
+}
+
+/* Return a legacy chanspec given a new chanspec
+ * Returns INVCHANSPEC on error
+ */
+static chanspec_t
+wl_chspec_to_legacy(chanspec_t chspec)
+{
+       chanspec_t lchspec;
+
+       if (wf_chspec_malformed(chspec)) {
+               ESCAN_ERROR("wlan", "wl_chspec_to_legacy: input chanspec (0x%04X) malformed\n",
+                       chspec);
+               return INVCHANSPEC;
+       }
+
+       /* get the channel number */
+       lchspec = CHSPEC_CHANNEL(chspec);
+
+       /* convert the band */
+       if (CHSPEC_IS2G(chspec)) {
+               lchspec |= WL_LCHANSPEC_BAND_2G;
+       } else {
+               lchspec |= WL_LCHANSPEC_BAND_5G;
+       }
+
+       /* convert the bw and sideband */
+       if (CHSPEC_IS20(chspec)) {
+               lchspec |= WL_LCHANSPEC_BW_20;
+               lchspec |= WL_LCHANSPEC_CTL_SB_NONE;
+       } else if (CHSPEC_IS40(chspec)) {
+               lchspec |= WL_LCHANSPEC_BW_40;
+               if (CHSPEC_CTL_SB(chspec) == WL_CHANSPEC_CTL_SB_L) {
+                       lchspec |= WL_LCHANSPEC_CTL_SB_LOWER;
+               } else {
+                       lchspec |= WL_LCHANSPEC_CTL_SB_UPPER;
+               }
+       } else {
+               /* cannot express the bandwidth */
+               char chanbuf[CHANSPEC_STR_LEN];
+               ESCAN_ERROR("wlan", "wl_chspec_to_legacy: unable to convert chanspec %s "
+                       "(0x%04X) to pre-11ac format\n",
+                       wf_chspec_ntoa(chspec, chanbuf), chspec);
+               return INVCHANSPEC;
+       }
+
+       return lchspec;
+}
+
+/* given a chanspec value from the driver, do the endian and chanspec version conversion to
+ * a chanspec_t value
+ * Returns INVCHANSPEC on error
+ */
+static chanspec_t
+wl_chspec_driver_to_host(int ioctl_ver, chanspec_t chanspec)
+{
+       chanspec = dtohchanspec(chanspec);
+       if (ioctl_ver == 1) {
+               chanspec = wl_chspec_from_legacy(chanspec);
+       }
+
+       return chanspec;
+}
+
+/* given a chanspec value, do the endian and chanspec version conversion to
+ * a chanspec_t value
+ * Returns INVCHANSPEC on error
+ */
+static chanspec_t
+wl_chspec_host_to_driver(int ioctl_ver, chanspec_t chanspec)
+{
+       if (ioctl_ver == 1) {
+               chanspec = wl_chspec_to_legacy(chanspec);
+               if (chanspec == INVCHANSPEC) {
+                       return chanspec;
+               }
+       }
+       chanspec = htodchanspec(chanspec);
+
+       return chanspec;
+}
+
+/* given a channel value, do the endian and chanspec version conversion to
+ * a chanspec_t value
+ * Returns INVCHANSPEC on error
+ */
+static chanspec_t
+wl_ch_host_to_driver(int ioctl_ver, u16 channel)
+{
+       chanspec_t chanspec;
+
+       chanspec = channel & WL_CHANSPEC_CHAN_MASK;
+
+       if (channel <= CH_MAX_2G_CHANNEL)
+               chanspec |= WL_CHANSPEC_BAND_2G;
+       else
+               chanspec |= WL_CHANSPEC_BAND_5G;
+
+       chanspec |= WL_CHANSPEC_BW_20;
+
+       chanspec |= WL_CHANSPEC_CTL_SB_NONE;
+
+       return wl_chspec_host_to_driver(ioctl_ver, chanspec);
+}
+
+static inline struct wl_bss_info *next_bss(struct wl_scan_results *list,
+       struct wl_bss_info *bss)
+{
+       return bss = bss ?
+               (struct wl_bss_info *)((uintptr) bss + dtoh32(bss->length)) : list->bss_info;
+}
+
+#if defined(ESCAN_RESULT_PATCH)
+static s32
+wl_escan_inform_bss(struct net_device *dev, struct wl_escan_info *escan)
+{
+       struct wl_scan_results *bss_list;
+       s32 err = 0;
+#if defined(RSSIAVG)
+       int rssi;
+#endif
+
+       bss_list = escan->bss_list;
+
+       ESCAN_SCAN(dev->name, "scanned AP count (%d)\n", bss_list->count);
+
+       /* Delete disconnected cache */
+#if defined(BSSCACHE)
+       wl_delete_disconnected_bss_cache(&escan->g_bss_cache_ctrl,
+               (u8*)&escan->disconnected_bssid);
+#if defined(RSSIAVG)
+       wl_delete_disconnected_rssi_cache(&escan->g_rssi_cache_ctrl,
+               (u8*)&escan->disconnected_bssid);
+#endif
+#endif
+
+       /* Update cache */
+#if defined(RSSIAVG)
+       wl_update_rssi_cache(&escan->g_rssi_cache_ctrl, bss_list);
+       if (!in_atomic())
+               wl_update_connected_rssi_cache(dev, &escan->g_rssi_cache_ctrl, &rssi);
+#endif
+#if defined(BSSCACHE)
+       wl_update_bss_cache(&escan->g_bss_cache_ctrl,
+#if defined(RSSIAVG)
+               &escan->g_rssi_cache_ctrl,
+#endif
+               bss_list);
+#endif
+
+       /* delete dirty cache */
+#if defined(RSSIAVG)
+       wl_delete_dirty_rssi_cache(&escan->g_rssi_cache_ctrl);
+       wl_reset_rssi_cache(&escan->g_rssi_cache_ctrl);
+#endif
+#if defined(BSSCACHE)
+       wl_delete_dirty_bss_cache(&escan->g_bss_cache_ctrl);
+       wl_reset_bss_cache(&escan->g_bss_cache_ctrl);
+       if (escan->autochannel)
+               wl_ext_get_best_channel(dev, &escan->g_bss_cache_ctrl,
+                       escan->ioctl_ver, &escan->best_2g_ch, &escan->best_5g_ch);
+#else
+       if (escan->autochannel)
+               wl_ext_get_best_channel(dev, bss_list, escan->ioctl_ver,
+                       &escan->best_2g_ch, &escan->best_5g_ch);
+#endif
+
+       return err;
+}
+#endif /* ESCAN_RESULT_PATCH */
+
+static wl_scan_params_t *
+wl_escan_alloc_params(struct net_device *dev, struct wl_escan_info *escan,
+       int channel, int nprobes, int *out_params_size)
+{
+       wl_scan_params_t *params;
+       int params_size;
+       int num_chans;
+
+       *out_params_size = 0;
+
+       /* Our scan params only need space for 1 channel and 0 ssids */
+       params_size = WL_SCAN_PARAMS_FIXED_SIZE + 1 * sizeof(uint16);
+       params = (wl_scan_params_t*) kzalloc(params_size, GFP_KERNEL);
+       if (params == NULL) {
+               ESCAN_ERROR(dev->name, "mem alloc failed (%d bytes)\n", params_size);
+               return params;
+       }
+       memset(params, 0, params_size);
+       params->nprobes = nprobes;
+
+       num_chans = (channel == 0) ? 0 : 1;
+
+       memcpy(&params->bssid, &ether_bcast, ETHER_ADDR_LEN);
+       params->bss_type = DOT11_BSSTYPE_ANY;
+       params->scan_type = DOT11_SCANTYPE_ACTIVE;
+       params->nprobes = htod32(1);
+       params->active_time = htod32(-1);
+       params->passive_time = htod32(-1);
+       params->home_time = htod32(10);
+       if (channel == -1)
+               params->channel_list[0] = htodchanspec(channel);
+       else
+               params->channel_list[0] = wl_ch_host_to_driver(escan->ioctl_ver, channel);
+
+       /* Our scan params have 1 channel and 0 ssids */
+       params->channel_num = htod32((0 << WL_SCAN_PARAMS_NSSID_SHIFT) |
+               (num_chans & WL_SCAN_PARAMS_COUNT_MASK));
+
+       *out_params_size = params_size; /* rtn size to the caller */
+       return params;
+}
+
+static void
+wl_escan_abort(struct net_device *dev, struct wl_escan_info *escan)
+{
+       wl_scan_params_t *params = NULL;
+       s32 params_size = 0;
+       s32 err = BCME_OK;
+       if (!in_atomic()) {
+               /* Our scan params only need space for 1 channel and 0 ssids */
+               params = wl_escan_alloc_params(dev, escan, -1, 0, &params_size);
+               if (params == NULL) {
+                       ESCAN_ERROR(dev->name, "scan params allocation failed \n");
+                       err = -ENOMEM;
+               } else {
+                       /* Do a scan abort to stop the driver's scan engine */
+                       err = wldev_ioctl(dev, WLC_SCAN, params, params_size, true);
+                       if (err < 0) {
+                               ESCAN_ERROR(dev->name, "scan abort  failed \n");
+                       }
+                       kfree(params);
+               }
+       }
+}
+
+static s32
+wl_escan_notify_complete(struct net_device *dev,
+       struct wl_escan_info *escan, bool fw_abort)
+{
+       s32 err = BCME_OK;
+#if defined(WL_WIRELESS_EXT)
+       int cmd = 0;
+#if WIRELESS_EXT > 13
+       union iwreq_data wrqu;
+       char extra[IW_CUSTOM_MAX + 1];
+#endif
+#endif
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+
+       ESCAN_TRACE(dev->name, "Enter\n");
+
+       if (fw_abort && !in_atomic())
+               wl_escan_abort(dev, escan);
+
+       if (timer_pending(&escan->scan_timeout))
+               del_timer_sync(&escan->scan_timeout);
+
+#if defined(ESCAN_RESULT_PATCH)
+       escan->bss_list = wl_escan_get_buf(escan);
+       wl_escan_inform_bss(dev, escan);
+#endif /* ESCAN_RESULT_PATCH */
+
+       escan->escan_state = ESCAN_STATE_IDLE;
+       wake_up_interruptible(&dhd->conf->event_complete);
+
+#if defined(WL_WIRELESS_EXT)
+#if WIRELESS_EXT > 13
+#if WIRELESS_EXT > 14
+       cmd = SIOCGIWSCAN;
+#endif
+       // terence 20150224: fix "wlan0: (WE) : Wireless Event too big (65306)"
+       memset(&wrqu, 0, sizeof(wrqu));
+       memset(extra, 0, sizeof(extra));
+       if (cmd) {
+               if (cmd == SIOCGIWSCAN) {
+                       wireless_send_event(dev, cmd, &wrqu, NULL);
+               } else
+                       wireless_send_event(dev, cmd, &wrqu, extra);
+       }
+#endif
+#endif
+
+       return err;
+}
+
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+static void
+wl_escan_find_removal_candidate(struct wl_escan_info *escan,
+       wl_bss_info_t *bss, removal_element_t *candidate)
+{
+       int idx;
+       for (idx = 0; idx < BUF_OVERFLOW_MGMT_COUNT; idx++) {
+               int len = BUF_OVERFLOW_MGMT_COUNT - idx - 1;
+               if (bss->RSSI < candidate[idx].RSSI) {
+                       if (len)
+                               memcpy(&candidate[idx + 1], &candidate[idx],
+                                       sizeof(removal_element_t) * len);
+                       candidate[idx].RSSI = bss->RSSI;
+                       candidate[idx].length = bss->length;
+                       memcpy(&candidate[idx].BSSID, &bss->BSSID, ETHER_ADDR_LEN);
+                       return;
+               }
+       }
+}
+
+static void
+wl_escan_remove_lowRSSI_info(struct net_device *dev, struct wl_escan_info *escan,
+       wl_scan_results_t *list, removal_element_t *candidate, wl_bss_info_t *bi)
+{
+       int idx1, idx2;
+       int total_delete_len = 0;
+       for (idx1 = 0; idx1 < BUF_OVERFLOW_MGMT_COUNT; idx1++) {
+               int cur_len = WL_SCAN_RESULTS_FIXED_SIZE;
+               wl_bss_info_t *bss = NULL;
+               if (candidate[idx1].RSSI >= bi->RSSI)
+                       continue;
+               for (idx2 = 0; idx2 < list->count; idx2++) {
+                       bss = bss ? (wl_bss_info_t *)((uintptr)bss + dtoh32(bss->length)) :
+                               list->bss_info;
+                       if (!bcmp(&candidate[idx1].BSSID, &bss->BSSID, ETHER_ADDR_LEN) &&
+                               candidate[idx1].RSSI == bss->RSSI &&
+                               candidate[idx1].length == dtoh32(bss->length)) {
+                               u32 delete_len = dtoh32(bss->length);
+                               ESCAN_DBG(dev->name,
+                                       "delete scan info of %pM to add new AP\n", &bss->BSSID);
+                               if (idx2 < list->count -1) {
+                                       memmove((u8 *)bss, (u8 *)bss + delete_len,
+                                               list->buflen - cur_len - delete_len);
+                               }
+                               list->buflen -= delete_len;
+                               list->count--;
+                               total_delete_len += delete_len;
+                               /* if delete_len is greater than or equal to result length */
+                               if (total_delete_len >= bi->length) {
+                                       return;
+                               }
+                               break;
+                       }
+                       cur_len += dtoh32(bss->length);
+               }
+       }
+}
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+static s32
+wl_escan_handler(struct net_device *dev, struct wl_escan_info *escan,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = BCME_OK;
+       s32 status = ntoh32(e->status);
+       wl_bss_info_t *bi;
+       wl_escan_result_t *escan_result;
+       wl_bss_info_t *bss = NULL;
+       wl_scan_results_t *list;
+       u32 bi_length;
+       u32 i;
+       u16 channel;
+
+       mutex_lock(&escan->usr_sync);
+       escan_result = (wl_escan_result_t *)data;
+
+       if (escan->escan_state != ESCAN_STATE_SCANING) {
+               ESCAN_DBG(dev->name, "Not my scan\n");
+               goto exit;
+       }
+
+       ESCAN_DBG(dev->name, "enter event type : %d, status : %d \n",
+               ntoh32(e->event_type), ntoh32(e->status));
+
+       if (status == WLC_E_STATUS_PARTIAL) {
+               ESCAN_DBG(dev->name, "WLC_E_STATUS_PARTIAL \n");
+               if (!escan_result) {
+                       ESCAN_ERROR(dev->name, "Invalid escan result (NULL pointer)\n");
+                       goto exit;
+               }
+               if (dtoh16(escan_result->bss_count) != 1) {
+                       ESCAN_ERROR(dev->name, "Invalid bss_count %d: ignoring\n",
+                               escan_result->bss_count);
+                       goto exit;
+               }
+               bi = escan_result->bss_info;
+               if (!bi) {
+                       ESCAN_ERROR(dev->name, "Invalid escan bss info (NULL pointer)\n");
+                       goto exit;
+               }
+               bi_length = dtoh32(bi->length);
+               if (bi_length != (dtoh32(escan_result->buflen) - WL_ESCAN_RESULTS_FIXED_SIZE)) {
+                       ESCAN_ERROR(dev->name, "Invalid bss_info length %d: ignoring\n",
+                               bi_length);
+                       goto exit;
+               }
+
+               /* +++++ terence 20130524: skip invalid bss */
+               channel =
+                       bi->ctl_ch ? bi->ctl_ch :
+                       CHSPEC_CHANNEL(wl_chspec_driver_to_host(escan->ioctl_ver, bi->chanspec));
+               if (!dhd_conf_match_channel(escan->pub, channel))
+                       goto exit;
+               /* ----- terence 20130524: skip invalid bss */
+
+               {
+                       int cur_len = WL_SCAN_RESULTS_FIXED_SIZE;
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+                       removal_element_t candidate[BUF_OVERFLOW_MGMT_COUNT];
+                       int remove_lower_rssi = FALSE;
+
+                       bzero(candidate, sizeof(removal_element_t)*BUF_OVERFLOW_MGMT_COUNT);
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+                       list = wl_escan_get_buf(escan);
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+                       if (bi_length > ESCAN_BUF_SIZE - list->buflen)
+                               remove_lower_rssi = TRUE;
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+                       ESCAN_DBG(dev->name, "%s(%pM) RSSI %d flags 0x%x length %d\n",
+                               bi->SSID, &bi->BSSID, bi->RSSI, bi->flags, bi->length);
+                       for (i = 0; i < list->count; i++) {
+                               bss = bss ? (wl_bss_info_t *)((uintptr)bss + dtoh32(bss->length))
+                                       : list->bss_info;
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+                               ESCAN_DBG(dev->name,
+                                       "%s(%pM), i=%d bss: RSSI %d list->count %d\n",
+                                       bss->SSID, &bss->BSSID, i, bss->RSSI, list->count);
+
+                               if (remove_lower_rssi)
+                                       wl_escan_find_removal_candidate(escan, bss, candidate);
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+                               if (!bcmp(&bi->BSSID, &bss->BSSID, ETHER_ADDR_LEN) &&
+                                               (CHSPEC_BAND(wl_chspec_driver_to_host(escan->ioctl_ver, bi->chanspec))
+                                               == CHSPEC_BAND(wl_chspec_driver_to_host(escan->ioctl_ver, bss->chanspec))) &&
+                                               bi->SSID_len == bss->SSID_len &&
+                                               !bcmp(bi->SSID, bss->SSID, bi->SSID_len)) {
+
+                                       /* do not allow beacon data to update
+                                       *the data recd from a probe response
+                                       */
+                                       if (!(bss->flags & WL_BSS_FLAGS_FROM_BEACON) &&
+                                               (bi->flags & WL_BSS_FLAGS_FROM_BEACON))
+                                               goto exit;
+
+                                       ESCAN_DBG(dev->name,
+                                               "%s(%pM), i=%d prev: RSSI %d flags 0x%x, "
+                                               "new: RSSI %d flags 0x%x\n",
+                                               bss->SSID, &bi->BSSID, i, bss->RSSI, bss->flags,
+                                               bi->RSSI, bi->flags);
+
+                                       if ((bss->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL) ==
+                                               (bi->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL)) {
+                                               /* preserve max RSSI if the measurements are
+                                               * both on-channel or both off-channel
+                                               */
+                                               ESCAN_DBG(dev->name,
+                                                       "%s(%pM), same onchan, RSSI: prev %d new %d\n",
+                                                       bss->SSID, &bi->BSSID, bss->RSSI, bi->RSSI);
+                                               bi->RSSI = MAX(bss->RSSI, bi->RSSI);
+                                       } else if ((bss->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL) &&
+                                               (bi->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL) == 0) {
+                                               /* preserve the on-channel rssi measurement
+                                               * if the new measurement is off channel
+                                               */
+                                               ESCAN_DBG(dev->name,
+                                                       "%s(%pM), prev onchan, RSSI: prev %d new %d\n",
+                                                       bss->SSID, &bi->BSSID, bss->RSSI, bi->RSSI);
+                                               bi->RSSI = bss->RSSI;
+                                               bi->flags |= WL_BSS_FLAGS_RSSI_ONCHANNEL;
+                                       }
+                                       if (dtoh32(bss->length) != bi_length) {
+                                               u32 prev_len = dtoh32(bss->length);
+
+                                               ESCAN_DBG(dev->name,
+                                                       "bss info replacement occured(bcast:%d->probresp%d)\n",
+                                                       bss->ie_length, bi->ie_length);
+                                               ESCAN_DBG(dev->name,
+                                                       "%s(%pM), replacement!(%d -> %d)\n",
+                                                       bss->SSID, &bi->BSSID, prev_len, bi_length);
+
+                                               if (list->buflen - prev_len + bi_length > ESCAN_BUF_SIZE) {
+                                                       ESCAN_ERROR(dev->name,
+                                                               "Buffer is too small: keep the previous result "
+                                                               "of this AP\n");
+                                                       /* Only update RSSI */
+                                                       bss->RSSI = bi->RSSI;
+                                                       bss->flags |= (bi->flags
+                                                               & WL_BSS_FLAGS_RSSI_ONCHANNEL);
+                                                       goto exit;
+                                               }
+
+                                               if (i < list->count - 1) {
+                                                       /* memory copy required by this case only */
+                                                       memmove((u8 *)bss + bi_length,
+                                                               (u8 *)bss + prev_len,
+                                                               list->buflen - cur_len - prev_len);
+                                               }
+                                               list->buflen -= prev_len;
+                                               list->buflen += bi_length;
+                                       }
+                                       list->version = dtoh32(bi->version);
+                                       memcpy((u8 *)bss, (u8 *)bi, bi_length);
+                                       goto exit;
+                               }
+                               cur_len += dtoh32(bss->length);
+                       }
+                       if (bi_length > ESCAN_BUF_SIZE - list->buflen) {
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+                               wl_escan_remove_lowRSSI_info(dev, escan, list, candidate, bi);
+                               if (bi_length > ESCAN_BUF_SIZE - list->buflen) {
+                                       ESCAN_DBG(dev->name,
+                                               "RSSI(%pM) is too low(%d) to add Buffer\n",
+                                               &bi->BSSID, bi->RSSI);
+                                       goto exit;
+                               }
+#else
+                               ESCAN_ERROR(dev->name, "Buffer is too small: ignoring\n");
+                               goto exit;
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+                       }
+
+                       memcpy(&(((char *)list)[list->buflen]), bi, bi_length);
+                       list->version = dtoh32(bi->version);
+                       list->buflen += bi_length;
+                       list->count++;
+               }
+       }
+       else if (status == WLC_E_STATUS_SUCCESS) {
+               ESCAN_DBG(dev->name, "ESCAN COMPLETED\n");
+               escan->bss_list = wl_escan_get_buf(escan);
+               ESCAN_DBG(dev->name, "SCAN COMPLETED: scanned AP count=%d\n",
+                       escan->bss_list->count);
+               wl_escan_notify_complete(dev, escan, false);
+       } else if ((status == WLC_E_STATUS_ABORT) || (status == WLC_E_STATUS_NEWSCAN) ||
+               (status == WLC_E_STATUS_11HQUIET) || (status == WLC_E_STATUS_CS_ABORT) ||
+               (status == WLC_E_STATUS_NEWASSOC)) {
+               /* Handle all cases of scan abort */
+               ESCAN_DBG(dev->name, "ESCAN ABORT reason: %d\n", status);
+               escan->bss_list = wl_escan_get_buf(escan);
+               ESCAN_DBG(dev->name, "SCAN ABORT: scanned AP count=%d\n",
+                       escan->bss_list->count);
+               wl_escan_notify_complete(dev, escan, false);
+       } else if (status == WLC_E_STATUS_TIMEOUT) {
+               ESCAN_ERROR(dev->name, "WLC_E_STATUS_TIMEOUT\n");
+               ESCAN_ERROR(dev->name, "reason[0x%x]\n", e->reason);
+               if (e->reason == 0xFFFFFFFF) {
+                       wl_escan_notify_complete(dev, escan, true);
+               }
+       } else {
+               ESCAN_ERROR(dev->name, "unexpected Escan Event %d : abort\n", status);
+               escan->bss_list = wl_escan_get_buf(escan);
+               ESCAN_DBG(dev->name, "SCAN ABORTED(UNEXPECTED): scanned AP count=%d\n",
+                       escan->bss_list->count);
+               wl_escan_notify_complete(dev, escan, false);
+       }
+exit:
+       mutex_unlock(&escan->usr_sync);
+       return err;
+}
+
+static int
+wl_escan_prep(struct net_device *dev, struct wl_escan_info *escan,
+       wl_uint32_list_t *list, wl_scan_params_t *params, wlc_ssid_t *ssid, bool bcast)
+{
+       int err = 0;
+       wl_scan_results_t *results;
+       s32 offset;
+       char *ptr;
+       int i = 0, j = 0;
+       wlc_ssid_t ssid_tmp;
+       u32 n_channels = 0;
+       uint channel;
+       chanspec_t chanspec;
+       u32 n_ssids;
+
+       results = wl_escan_get_buf(escan);
+       results->version = 0;
+       results->count = 0;
+       results->buflen = WL_SCAN_RESULTS_FIXED_SIZE;
+       escan->escan_state = ESCAN_STATE_SCANING;
+
+       /* Arm scan timeout timer */
+       mod_timer(&escan->scan_timeout, jiffies + msecs_to_jiffies(WL_ESCAN_TIMER_INTERVAL_MS));
+
+       memcpy(&params->bssid, &ether_bcast, ETHER_ADDR_LEN);
+       params->bss_type = DOT11_BSSTYPE_ANY;
+       params->scan_type = 0;
+       params->nprobes = -1;
+       params->active_time = -1;
+       params->passive_time = -1;
+       params->home_time = -1;
+       params->channel_num = 0;
+
+       params->nprobes = htod32(params->nprobes);
+       params->active_time = htod32(params->active_time);
+       params->passive_time = htod32(params->passive_time);
+       params->home_time = htod32(params->home_time);
+
+       n_channels = dtoh32(list->count);
+       /* Copy channel array if applicable */
+       ESCAN_SCAN(dev->name, "### List of channelspecs to scan ###\n");
+       if (n_channels > 0) {
+               for (i = 0; i < n_channels; i++) {
+                       channel = dtoh32(list->element[i]);
+                       if (!dhd_conf_match_channel(escan->pub, channel))
+                               continue;
+                       chanspec = WL_CHANSPEC_BW_20;
+                       if (chanspec == INVCHANSPEC) {
+                               ESCAN_ERROR(dev->name, "Invalid chanspec! Skipping channel\n");
+                               continue;
+                       }
+                       if (channel <= CH_MAX_2G_CHANNEL) {
+                               chanspec |= WL_CHANSPEC_BAND_2G;
+                       } else {
+                               chanspec |= WL_CHANSPEC_BAND_5G;
+                       }
+                       params->channel_list[j] = channel;
+                       params->channel_list[j] &= WL_CHANSPEC_CHAN_MASK;
+                       params->channel_list[j] |= chanspec;
+                       ESCAN_SCAN(dev->name, "Chan : %d, Channel spec: %x\n",
+                               channel, params->channel_list[j]);
+                       params->channel_list[j] = wl_chspec_host_to_driver(escan->ioctl_ver,
+                               params->channel_list[j]);
+                       j++;
+               }
+       } else {
+               ESCAN_SCAN(dev->name, "Scanning all channels\n");
+       }
+
+       if (ssid && ssid->SSID_len) {
+               /* Copy ssid array if applicable */
+               ESCAN_SCAN(dev->name, "### List of SSIDs to scan ###\n");
+               offset = offsetof(wl_scan_params_t, channel_list) + n_channels * sizeof(u16);
+               offset = roundup(offset, sizeof(u32));
+               ptr = (char*)params + offset;
+
+               if (bcast) {
+                       n_ssids = 2;
+                       ESCAN_SCAN(dev->name, "0: Broadcast scan\n");
+                       memset(&ssid_tmp, 0, sizeof(wlc_ssid_t));
+                       ssid_tmp.SSID_len = 0;
+                       memcpy(ptr, &ssid_tmp, sizeof(wlc_ssid_t));
+                       ptr += sizeof(wlc_ssid_t);
+               } else {
+                       n_ssids = 1;
+               }
+
+               memset(&ssid_tmp, 0, sizeof(wlc_ssid_t));
+               ssid_tmp.SSID_len = ssid->SSID_len;
+               memcpy(ssid_tmp.SSID, ssid->SSID, ssid->SSID_len);
+               memcpy(ptr, &ssid_tmp, sizeof(wlc_ssid_t));
+               ptr += sizeof(wlc_ssid_t);
+               ESCAN_SCAN(dev->name, "1: scan for %s size=%d\n",
+                       ssid_tmp.SSID, ssid_tmp.SSID_len);
+               /* Adding mask to channel numbers */
+               params->channel_num =
+               htod32((n_ssids << WL_SCAN_PARAMS_NSSID_SHIFT) |
+                      (n_channels & WL_SCAN_PARAMS_COUNT_MASK));
+       }
+       else {
+               ESCAN_SCAN(dev->name, "Broadcast scan\n");
+       }
+
+       return err;
+}
+
+static int
+wl_escan_reset(struct wl_escan_info *escan)
+{
+       if (timer_pending(&escan->scan_timeout))
+               del_timer_sync(&escan->scan_timeout);
+       escan->escan_state = ESCAN_STATE_IDLE;
+
+       return 0;
+}
+
+static void
+wl_escan_timeout(unsigned long data)
+{
+       wl_event_msg_t msg;
+       struct wl_escan_info *escan = (struct wl_escan_info *)data;
+       struct wl_scan_results *bss_list;
+       struct wl_bss_info *bi = NULL;
+       s32 i;
+       u32 channel;
+
+       if (!escan->dev) {
+               ESCAN_ERROR("wlan", "No dev present\n");
+               return;
+       }
+
+       bss_list = wl_escan_get_buf(escan);
+       if (!bss_list) {
+               ESCAN_ERROR(escan->dev->name,
+                       "bss_list is null. Didn't receive any partial scan results\n");
+       } else {
+               ESCAN_ERROR(escan->dev->name, "scanned AP count (%d)\n", bss_list->count);
+               bi = next_bss(bss_list, bi);
+               for_each_bss(bss_list, bi, i) {
+                       channel = wf_chspec_ctlchan(wl_chspec_driver_to_host(escan->ioctl_ver,
+                               bi->chanspec));
+                       ESCAN_ERROR(escan->dev->name, "SSID :%s  Channel :%d\n", bi->SSID, channel);
+               }
+       }
+
+       bzero(&msg, sizeof(wl_event_msg_t));
+       ESCAN_ERROR(escan->dev->name, "timer expired\n");
+
+       msg.ifidx = dhd_net2idx(escan->pub->info, escan->dev);
+       msg.event_type = hton32(WLC_E_ESCAN_RESULT);
+       msg.status = hton32(WLC_E_STATUS_TIMEOUT);
+       msg.reason = 0xFFFFFFFF;
+       wl_ext_event_send(escan->pub->event_params, &msg, NULL);
+}
+
+int
+wl_escan_set_scan(struct net_device *dev, dhd_pub_t *dhdp,
+       wlc_ssid_t *ssid, uint16 channel, bool bcast)
+{
+       struct wl_escan_info *escan = dhdp->escan;
+       s32 err = BCME_OK;
+       s32 params_size = (WL_SCAN_PARAMS_FIXED_SIZE + OFFSETOF(wl_escan_params_t, params));
+       wl_escan_params_t *params = NULL;
+       scb_val_t scbval;
+       static int cnt = 0;
+       u32 n_channels = 0;
+       wl_uint32_list_t *list;
+       u8 valid_chan_list[sizeof(u32)*(WL_NUMCHANNELS + 1)];
+
+       mutex_lock(&escan->usr_sync);
+       if (escan->escan_state == ESCAN_STATE_DOWN) {
+               ESCAN_ERROR(dev->name, "STATE is down\n");
+               err = -EINVAL;
+               goto exit2;
+       }
+
+       if (wl_ext_check_scan(dev, dhdp)) {
+               err = -EBUSY;
+               goto exit;
+       }
+
+       ESCAN_TRACE(dev->name, "Enter \n");
+
+       /* if scan request is not empty parse scan request paramters */
+       memset(valid_chan_list, 0, sizeof(valid_chan_list));
+       list = (wl_uint32_list_t *)(void *) valid_chan_list;
+
+       if (channel) {
+               list->count = htod32(1);
+               list->element[0] = htod32(channel);
+       } else {
+               list->count = htod32(WL_NUMCHANNELS);
+               err = wldev_ioctl(dev, WLC_GET_VALID_CHANNELS, valid_chan_list,
+                       sizeof(valid_chan_list), false);
+               if (err != 0) {
+                       ESCAN_ERROR(dev->name, "get channels failed with %d\n", err);
+                       goto exit;
+               }
+       }
+
+       n_channels = dtoh32(list->count);
+       /* Allocate space for populating ssids in wl_escan_params_t struct */
+       if (dtoh32(list->count) % 2)
+               /* If n_channels is odd, add a padd of u16 */
+               params_size += sizeof(u16) * (n_channels + 1);
+       else
+               params_size += sizeof(u16) * n_channels;
+       if (ssid && ssid->SSID_len) {
+               params_size += sizeof(struct wlc_ssid) * 2;
+       }
+
+       params = (wl_escan_params_t *) kzalloc(params_size, GFP_KERNEL);
+       if (params == NULL) {
+               err = -ENOMEM;
+               goto exit;
+       }
+       wl_escan_prep(dev, escan, list, &params->params, ssid, bcast);
+
+       params->version = htod32(ESCAN_REQ_VERSION);
+       params->action =  htod16(WL_SCAN_ACTION_START);
+       wl_escan_set_sync_id(params->sync_id);
+       if (params_size + sizeof("escan") >= WLC_IOCTL_MEDLEN) {
+               ESCAN_ERROR(dev->name, "ioctl buffer length not sufficient\n");
+               kfree(params);
+               err = -ENOMEM;
+               goto exit;
+       }
+       params->params.scan_type = DOT11_SCANTYPE_ACTIVE;
+       ESCAN_SCAN(dev->name, "Passive scan_type %d\n", params->params.scan_type);
+
+       WL_MSG(dev->name, "LEGACY_SCAN\n");
+       err = wldev_iovar_setbuf(dev, "escan", params, params_size,
+               escan->escan_ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+       if (unlikely(err)) {
+               if (err == BCME_EPERM)
+                       /* Scan Not permitted at this point of time */
+                       ESCAN_TRACE(dev->name, "Escan not permitted at this time (%d)\n", err);
+               else
+                       ESCAN_ERROR(dev->name, "Escan set error (%d)\n", err);
+       }
+       kfree(params);
+
+       if (unlikely(err)) {
+               /* Don't print Error incase of Scan suppress */
+               if (err == BCME_EPERM)
+                       ESCAN_TRACE(dev->name, "Escan failed: Scan Suppressed\n");
+               else {
+                       cnt++;
+                       ESCAN_ERROR(dev->name, "error (%d), cnt=%d\n", err, cnt);
+                       // terence 20140111: send disassoc to firmware
+                       if (cnt >= 4) {
+                               memset(&scbval, 0, sizeof(scb_val_t));
+                               wldev_ioctl(dev, WLC_DISASSOC, &scbval, sizeof(scb_val_t), true);
+                               ESCAN_ERROR(dev->name, "Send disassoc to break the busy\n");
+                               cnt = 0;
+                       }
+               }
+       } else {
+               cnt = 0;
+               escan->dev = dev;
+       }
+exit:
+       if (unlikely(err)) {
+               wl_escan_reset(escan);
+       }
+exit2:
+       mutex_unlock(&escan->usr_sync);
+       return err;
+}
+
+#if defined(WL_WIRELESS_EXT)
+static int
+rssi_to_qual(int rssi)
+{
+       if (rssi <= WL_IW_RSSI_NO_SIGNAL)
+               return 0;
+       else if (rssi <= WL_IW_RSSI_VERY_LOW)
+               return 1;
+       else if (rssi <= WL_IW_RSSI_LOW)
+               return 2;
+       else if (rssi <= WL_IW_RSSI_GOOD)
+               return 3;
+       else if (rssi <= WL_IW_RSSI_VERY_GOOD)
+               return 4;
+       else
+               return 5;
+}
+
+static int
+wl_escan_merge_scan_results(struct net_device *dev, struct wl_escan_info *escan,
+       struct iw_request_info *info, char *extra, wl_bss_info_t *bi, int *len, int max_size)
+{
+       s32 err = BCME_OK;
+       struct iw_event iwe;
+       int j;
+       char *event = extra, *end = extra + max_size - WE_ADD_EVENT_FIX, *value;
+       int16 rssi;
+       int channel;
+       chanspec_t chanspec;
+
+       /* overflow check cover fields before wpa IEs */
+       if (event + ETHER_ADDR_LEN + bi->SSID_len + IW_EV_UINT_LEN + IW_EV_FREQ_LEN +
+               IW_EV_QUAL_LEN >= end) {
+               err = -E2BIG;
+               goto exit;
+       }
+
+#if defined(RSSIAVG)
+       rssi = wl_get_avg_rssi(&escan->g_rssi_cache_ctrl, &bi->BSSID);
+       if (rssi == RSSI_MINVAL)
+               rssi = MIN(dtoh16(bi->RSSI), RSSI_MAXVAL);
+#else
+       // terence 20150419: limit the max. rssi to -2 or the bss will be filtered out in android OS
+       rssi = MIN(dtoh16(bi->RSSI), RSSI_MAXVAL);
+#endif
+       chanspec = wl_chspec_driver_to_host(escan->ioctl_ver, bi->chanspec);
+       channel = wf_chspec_ctlchan(chanspec);
+       ESCAN_SCAN(dev->name, "BSSID %pM, channel %3d(%3d %sMHz), rssi %3d, SSID \"%s\"\n",
+               &bi->BSSID, channel, CHSPEC_CHANNEL(chanspec),
+               CHSPEC_IS20(chanspec)?"20":
+               CHSPEC_IS40(chanspec)?"40":
+               CHSPEC_IS80(chanspec)?"80":"160",
+               rssi, bi->SSID);
+
+       /* First entry must be the BSSID */
+       iwe.cmd = SIOCGIWAP;
+       iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+       memcpy(iwe.u.ap_addr.sa_data, &bi->BSSID, ETHER_ADDR_LEN);
+       event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_ADDR_LEN);
+
+       /* SSID */
+       iwe.u.data.length = dtoh32(bi->SSID_len);
+       iwe.cmd = SIOCGIWESSID;
+       iwe.u.data.flags = 1;
+       event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, bi->SSID);
+
+       /* Mode */
+       if (dtoh16(bi->capability) & (DOT11_CAP_ESS | DOT11_CAP_IBSS)) {
+               iwe.cmd = SIOCGIWMODE;
+               if (dtoh16(bi->capability) & DOT11_CAP_ESS)
+                       iwe.u.mode = IW_MODE_INFRA;
+               else
+                       iwe.u.mode = IW_MODE_ADHOC;
+               event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_UINT_LEN);
+       }
+
+       /* Channel */
+       iwe.cmd = SIOCGIWFREQ;
+#if 1
+       iwe.u.freq.m = wf_channel2mhz(channel, channel <= CH_MAX_2G_CHANNEL ?
+                       WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G);
+#else
+       iwe.u.freq.m = wf_channel2mhz(bi->n_cap ?
+                       bi->ctl_ch : CHSPEC_CHANNEL(bi->chanspec),
+                       CHSPEC_CHANNEL(bi->chanspec) <= CH_MAX_2G_CHANNEL ?
+                       WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G);
+#endif
+       iwe.u.freq.e = 6;
+       event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_FREQ_LEN);
+
+       /* Channel quality */
+       iwe.cmd = IWEVQUAL;
+       iwe.u.qual.qual = rssi_to_qual(rssi);
+       iwe.u.qual.level = 0x100 + rssi;
+       iwe.u.qual.noise = 0x100 + bi->phy_noise;
+       event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_QUAL_LEN);
+
+       wl_iw_handle_scanresults_ies(&event, end, info, bi);
+
+       /* Encryption */
+       iwe.cmd = SIOCGIWENCODE;
+       if (dtoh16(bi->capability) & DOT11_CAP_PRIVACY)
+               iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+       else
+               iwe.u.data.flags = IW_ENCODE_DISABLED;
+       iwe.u.data.length = 0;
+       event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)event);
+
+       /* Rates */
+       if (bi->rateset.count <= sizeof(bi->rateset.rates)) {
+               if (event + IW_MAX_BITRATES*IW_EV_PARAM_LEN >= end) {
+                       err = -E2BIG;
+                       goto exit;
+               }
+               value = event + IW_EV_LCP_LEN;
+               iwe.cmd = SIOCGIWRATE;
+               /* Those two flags are ignored... */
+               iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+               for (j = 0; j < bi->rateset.count && j < IW_MAX_BITRATES; j++) {
+                       iwe.u.bitrate.value = (bi->rateset.rates[j] & 0x7f) * 500000;
+                       value = IWE_STREAM_ADD_VALUE(info, event, value, end, &iwe,
+                               IW_EV_PARAM_LEN);
+               }
+               event = value;
+       }
+       *len = event - extra;
+       if (*len < 0)
+               ESCAN_ERROR(dev->name, "==> Wrong size\n");
+
+exit:
+       return err;
+}
+
+int
+wl_escan_get_scan(struct net_device *dev, dhd_pub_t *dhdp,
+       struct iw_request_info *info, struct iw_point *dwrq, char *extra)
+{
+       struct wl_escan_info *escan = dhdp->escan;
+       s32 err = BCME_OK;
+       int i = 0;
+       int len_prep = 0, len_ret = 0;
+       wl_bss_info_t *bi = NULL;
+       struct wl_scan_results *bss_list;
+       __u16 buflen_from_user = dwrq->length;
+#if defined(BSSCACHE)
+       wl_bss_cache_t *node;
+#endif
+       char *buf = NULL;
+       struct ether_addr cur_bssid;
+       u8 ioctl_buf[WLC_IOCTL_SMLEN];
+
+       if (!extra) {
+               ESCAN_TRACE(dev->name, "extra is null\n");
+               return -EINVAL;
+       }
+
+       mutex_lock(&escan->usr_sync);
+
+       /* Check for scan in progress */
+       if (escan->escan_state == ESCAN_STATE_SCANING) {
+               ESCAN_DBG(dev->name, "SIOCGIWSCAN GET still scanning\n");
+               err = -EAGAIN;
+               goto exit;
+       }
+       if (!escan->bss_list) {
+               ESCAN_ERROR(dev->name, "scan not ready\n");
+               err = -EAGAIN;
+               goto exit;
+       }
+       if (dev != escan->dev) {
+               ESCAN_ERROR(dev->name, "not my scan from %s\n", escan->dev->name);
+               err = -EINVAL;
+               goto exit;
+       }
+
+       ESCAN_SCAN(dev->name, "SIOCGIWSCAN, len=%d\n", dwrq->length);
+
+       wldev_iovar_getbuf(dev, "cur_etheraddr", NULL, 0, ioctl_buf, WLC_IOCTL_SMLEN, NULL);
+       err = wldev_ioctl(dev, WLC_GET_BSSID, &cur_bssid, sizeof(cur_bssid), false);
+       if (err != BCME_NOTASSOCIATED &&
+                       memcmp(&ether_null, &cur_bssid, ETHER_ADDR_LEN) &&
+                       memcmp(ioctl_buf, &cur_bssid, ETHER_ADDR_LEN)) {
+               // merge current connected bss
+               buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_ATOMIC);
+               if (!buf) {
+                       ESCAN_ERROR(dev->name, "buffer alloc failed.\n");
+                       err = BCME_NOMEM;
+                       goto exit;
+               }
+               *(u32 *)buf = htod32(WL_EXTRA_BUF_MAX);
+               err = wldev_ioctl(dev, WLC_GET_BSS_INFO, buf, WL_EXTRA_BUF_MAX, false);
+               if (unlikely(err)) {
+                       ESCAN_ERROR(dev->name, "Could not get bss info %d\n", err);
+                       goto exit;
+               }
+               bi = (struct wl_bss_info *)(buf + 4);
+               len_prep = 0;
+               err = wl_escan_merge_scan_results(dev, escan, info, extra+len_ret, bi,
+                       &len_prep, buflen_from_user-len_ret);
+               len_ret += len_prep;
+               if (err)
+                       goto exit;
+               bi = NULL;
+       }
+
+#if defined(BSSCACHE)
+       bss_list = &escan->g_bss_cache_ctrl.m_cache_head->results;
+       node = escan->g_bss_cache_ctrl.m_cache_head;
+       for (i=0; node && i<IW_MAX_AP; i++)
+#else
+       bss_list = escan->bss_list;
+       bi = next_bss(bss_list, bi);
+       for_each_bss(bss_list, bi, i)
+#endif
+       {
+#if defined(BSSCACHE)
+               bi = node->results.bss_info;
+#endif
+               if (!memcmp(&bi->BSSID, &cur_bssid, ETHER_ADDR_LEN)) {
+                       ESCAN_SCAN(dev->name, "skip connected AP %pM\n", &cur_bssid);
+#if defined(BSSCACHE)
+                       node = node->next;
+#endif
+                       continue;
+               }
+               len_prep = 0;
+               err = wl_escan_merge_scan_results(dev, escan, info, extra+len_ret, bi,
+                       &len_prep, buflen_from_user-len_ret);
+               len_ret += len_prep;
+               if (err)
+                       goto exit;
+#if defined(BSSCACHE)
+               node = node->next;
+#endif
+       }
+
+       if ((len_ret + WE_ADD_EVENT_FIX) < dwrq->length)
+               dwrq->length = len_ret;
+
+       dwrq->flags = 0;        /* todo */
+       ESCAN_SCAN(dev->name, "scanned AP count (%d)\n", i);
+exit:
+       kfree(buf);
+       dwrq->length = len_ret;
+       mutex_unlock(&escan->usr_sync);
+       return err;
+}
+#endif /* WL_WIRELESS_EXT */
+
+#ifdef WLMESH
+bool
+wl_escan_meshid_ie(u8 *parse, u32 len, wlc_ssid_t *mesh_id)
+{
+       bcm_tlv_t *ie;
+
+       if((ie = bcm_parse_tlvs(parse, (int)len, DOT11_MNG_MESH_ID)) != NULL) {
+               mesh_id->SSID_len = ie->len;
+               if (ie->len) {
+                       strncpy(mesh_id->SSID, ie->data, ie->len);
+               }
+               return TRUE;
+       }
+       return FALSE;
+}
+
+bool
+wl_escan_rsn_ie(u8 *parse, u32 len)
+{
+       if (bcm_parse_tlvs(parse, (u32)len, DOT11_MNG_RSN_ID)) {
+               return TRUE;
+       }
+       return FALSE;
+}
+
+bool
+wl_escan_mesh_info_ie(struct net_device *dev, u8 *parse, u32 len,
+       struct wl_mesh_params *mesh_info)
+{
+       bcm_tlv_t *ie;
+       uchar mesh_oui[]={0x00, 0x22, 0xf4};
+       int totl_len;
+       uint8 *pie;
+       uint max_len;
+       bool found = FALSE;
+
+       memset(mesh_info, 0, sizeof(struct wl_mesh_params));
+       if((ie = bcm_parse_tlvs(parse, (int)len, DOT11_MNG_VS_ID)) != NULL) {
+               totl_len = ie->len;
+               if (!memcmp(ie->data, &mesh_oui, sizeof(mesh_oui))) {
+                       pie = ie->data + sizeof(mesh_oui);
+                       ie = (bcm_tlv_t *)pie;
+                       totl_len -= sizeof(mesh_oui);
+                       while (totl_len > 2 && ie->len) {
+                               if (ie->id == MESH_INFO_MASTER_BSSID && ie->len == ETHER_ADDR_LEN) {
+                                       memcpy(&mesh_info->master_bssid, ie->data, ETHER_ADDR_LEN);
+                               } else if (ie->id == MESH_INFO_MASTER_CHANNEL) {
+                                       mesh_info->master_channel = ie->data[0];
+                                       found = TRUE;
+                               } else if (ie->id == MESH_INFO_HOP_CNT) {
+                                       mesh_info->hop_cnt = ie->data[0];
+                               } else if (ie->id == MESH_INFO_PEER_BSSID) {
+                                       max_len = min(MAX_HOP_LIST*ETHER_ADDR_LEN, (int)ie->len);
+                                       memcpy(mesh_info->peer_bssid, ie->data, max_len);
+                               }
+                               totl_len -= (ie->len + 2);
+                               pie = ie->data + ie->len;
+                               ie = (bcm_tlv_t *)pie;
+                       }
+               }
+       }
+
+       return found;
+}
+
+bool
+wl_escan_mesh_info(struct net_device *dev, struct wl_escan_info *escan, 
+       struct ether_addr *peer_bssid, struct wl_mesh_params *mesh_info)
+{
+       int i = 0;
+       wl_bss_info_t *bi = NULL;
+       struct wl_scan_results *bss_list;
+       int16 bi_rssi, bi_chan;
+       wlc_ssid_t bi_meshid;
+       bool is_mesh_peer = FALSE, found = FALSE;
+       struct wl_mesh_params peer_mesh_info;
+
+       mutex_lock(&escan->usr_sync);
+
+       /* Check for scan in progress */
+       if (escan->escan_state == ESCAN_STATE_SCANING) {
+               ESCAN_ERROR(dev->name, "SIOCGIWSCAN GET still scanning\n");
+               goto exit;
+       }
+       if (!escan->bss_list) {
+               ESCAN_ERROR(dev->name, "scan not ready\n");
+               goto exit;
+       }
+       if (dev != escan->dev) {
+               ESCAN_ERROR(dev->name, "not my scan from %s\n", escan->dev->name);
+               goto exit;
+       }
+
+       bss_list = escan->bss_list;
+       bi = next_bss(bss_list, bi);
+       ESCAN_SCAN(dev->name, "scanned AP/Mesh count (%d)\n", bss_list->count);
+       for_each_bss(bss_list, bi, i)
+       {
+               memset(&bi_meshid, 0, sizeof(bi_meshid));
+               is_mesh_peer = FALSE;
+               bi_chan = wf_chspec_ctlchan(
+                       wl_chspec_driver_to_host(escan->ioctl_ver, bi->chanspec));
+               bi_rssi = MIN(dtoh16(bi->RSSI), RSSI_MAXVAL);
+               is_mesh_peer = wl_escan_meshid_ie(((u8*)bi)+bi->ie_offset,
+                       bi->ie_length, &bi_meshid);
+               if (!(bi->capability & (DOT11_CAP_ESS|DOT11_CAP_IBSS)) && is_mesh_peer) {
+                       bool bi_sae = FALSE, bss_found = FALSE, prefer = FALSE;
+                       if (!memcmp(peer_bssid, &bi->BSSID, ETHER_ADDR_LEN)) {
+                               bi_sae = wl_escan_rsn_ie(((u8*)bi)+bi->ie_offset, bi->ie_length);
+                               bss_found = wl_escan_mesh_info_ie(dev, ((u8*)bi)+bi->ie_offset,
+                                       bi->ie_length, &peer_mesh_info);
+                               if (bss_found) {
+                                       memcpy(&mesh_info->master_bssid, &peer_mesh_info.master_bssid,
+                                               ETHER_ADDR_LEN);
+                                       mesh_info->master_channel = peer_mesh_info.master_channel;
+                                       mesh_info->hop_cnt = peer_mesh_info.hop_cnt;
+                                       memcpy(mesh_info->peer_bssid, peer_mesh_info.peer_bssid,
+                                               sizeof(peer_mesh_info.peer_bssid));
+                                       prefer = TRUE;
+                                       found = TRUE;
+                               }
+                       }
+                       ESCAN_SCAN(dev->name,
+                               "%s[Mesh] BSSID=%pM, channel=%d, RSSI=%d, sec=%s, "
+                               "mbssid=%pM, mchannel=%d, hop=%d, pbssid=%pM, MeshID=\"%s\"\n",
+                               prefer?"*":" ", &bi->BSSID, bi_chan, bi_rssi, bi_sae?"SAE":"OPEN",
+                               &peer_mesh_info.master_bssid, peer_mesh_info.master_channel,
+                               peer_mesh_info.hop_cnt, &peer_mesh_info.peer_bssid, bi_meshid.SSID);
+               }
+       }
+
+exit:
+       mutex_unlock(&escan->usr_sync);
+       return found;
+}
+
+bool
+wl_escan_mesh_peer(struct net_device *dev, struct wl_escan_info *escan, 
+       wlc_ssid_t *cur_ssid, uint16 cur_chan, bool sae,
+       struct wl_mesh_params *mesh_info)
+{
+       int i = 0;
+       wl_bss_info_t *bi = NULL;
+       struct wl_scan_results *bss_list;
+       int16 bi_rssi, bi_chan, max_rssi = -100;
+       uint min_hop_cnt = 255;
+       wlc_ssid_t bi_meshid;
+       bool is_mesh_peer = FALSE, chan_matched = FALSE, found = FALSE;
+       struct wl_mesh_params peer_mesh_info;
+
+       mutex_lock(&escan->usr_sync);
+
+       /* Check for scan in progress */
+       if (escan->escan_state == ESCAN_STATE_SCANING) {
+               ESCAN_ERROR(dev->name, "SIOCGIWSCAN GET still scanning\n");
+               goto exit;
+       }
+       if (!escan->bss_list) {
+               ESCAN_ERROR(dev->name, "scan not ready\n");
+               goto exit;
+       }
+       if (dev != escan->dev) {
+               ESCAN_ERROR(dev->name, "not my scan from %s\n", escan->dev->name);
+               goto exit;
+       }
+
+       bss_list = escan->bss_list;
+       bi = next_bss(bss_list, bi);
+       ESCAN_SCAN(dev->name, "scanned AP/Mesh count (%d)\n", bss_list->count);
+       for_each_bss(bss_list, bi, i)
+       {
+               memset(&bi_meshid, 0, sizeof(bi_meshid));
+               is_mesh_peer = FALSE;
+               bi_chan = wf_chspec_ctlchan(
+                       wl_chspec_driver_to_host(escan->ioctl_ver, bi->chanspec));
+               bi_rssi = MIN(dtoh16(bi->RSSI), RSSI_MAXVAL);
+               is_mesh_peer = wl_escan_meshid_ie(((u8*)bi)+bi->ie_offset,
+                       bi->ie_length, &bi_meshid);
+               if (!(bi->capability & (DOT11_CAP_ESS|DOT11_CAP_IBSS)) && is_mesh_peer) {
+                       bool meshid_matched = FALSE, sec_matched = FALSE, bi_sae = FALSE,
+                               bss_found = FALSE, prefer = FALSE;
+
+                       if (cur_ssid->SSID_len && cur_ssid->SSID_len == bi_meshid.SSID_len &&
+                                       !memcmp(cur_ssid->SSID, bi_meshid.SSID, bi_meshid.SSID_len))
+                               meshid_matched = TRUE;
+
+                       bi_sae = wl_escan_rsn_ie(((u8*)bi)+bi->ie_offset, bi->ie_length);
+                       if (bi_sae == sae)
+                               sec_matched = TRUE;
+
+                       bss_found = wl_escan_mesh_info_ie(dev, ((u8*)bi)+bi->ie_offset, bi->ie_length,
+                               &peer_mesh_info);
+                       if (meshid_matched && sec_matched && bss_found &&
+                                       (cur_chan == bi_chan)) {
+                               if (peer_mesh_info.hop_cnt < min_hop_cnt) {
+                                       memcpy(&mesh_info->master_bssid, &peer_mesh_info.master_bssid,
+                                               ETHER_ADDR_LEN);
+                                       mesh_info->master_channel = peer_mesh_info.master_channel;
+                                       mesh_info->hop_cnt = peer_mesh_info.hop_cnt;
+                                       memcpy(mesh_info->peer_bssid, peer_mesh_info.peer_bssid,
+                                               sizeof(peer_mesh_info.peer_bssid));
+                                       min_hop_cnt = peer_mesh_info.hop_cnt;
+                                       prefer = TRUE;
+                                       chan_matched = TRUE;
+                                       found = TRUE;
+                               }
+                       }
+                       else if (meshid_matched && sec_matched && bss_found &&
+                                       (cur_chan != bi_chan) && !chan_matched) {
+                               if (bi_rssi > max_rssi) {
+                                       memcpy(&mesh_info->master_bssid, &peer_mesh_info.master_bssid,
+                                               ETHER_ADDR_LEN);
+                                       mesh_info->master_channel = peer_mesh_info.master_channel;
+                                       mesh_info->hop_cnt = peer_mesh_info.hop_cnt;
+                                       memcpy(mesh_info->peer_bssid, peer_mesh_info.peer_bssid,
+                                               sizeof(peer_mesh_info.peer_bssid));
+                                       max_rssi = bi_rssi;
+                                       prefer = TRUE;
+                                       found = TRUE;
+                               }
+                       }
+
+                       ESCAN_SCAN(dev->name,
+                               "%s[Mesh] BSSID=%pM, channel=%d, RSSI=%d, sec=%s, "
+                               "mbssid=%pM, mchannel=%d, hop=%d, pbssid=%pM, MeshID=\"%s\"\n",
+                               prefer?"*":" ", &bi->BSSID, bi_chan, bi_rssi, bi_sae?"SAE":"OPEN",
+                               &peer_mesh_info.master_bssid, peer_mesh_info.master_channel,
+                               peer_mesh_info.hop_cnt, &peer_mesh_info.peer_bssid, bi_meshid.SSID);
+               } else {
+                       ESCAN_SCAN(dev->name,
+                               "[AP] BSSID=%pM, channel=%d, RSSI=%d, SSID=\"%s\"\n",
+                               &bi->BSSID, bi_chan, bi_rssi, bi->SSID);
+               }
+       }
+
+exit:
+       mutex_unlock(&escan->usr_sync);
+       return found;
+}
+#endif /* WLMESH */
+
+static void
+wl_escan_deinit(struct net_device *dev, struct wl_escan_info *escan)
+{
+       ESCAN_TRACE(dev->name, "Enter\n");
+
+       del_timer_sync(&escan->scan_timeout);
+       escan->escan_state = ESCAN_STATE_DOWN;
+
+#if defined(RSSIAVG)
+       wl_free_rssi_cache(&escan->g_rssi_cache_ctrl);
+#endif
+#if defined(BSSCACHE)
+       wl_free_bss_cache(&escan->g_bss_cache_ctrl);
+#endif
+}
+
+static s32
+wl_escan_init(struct net_device *dev, struct wl_escan_info *escan)
+{
+       ESCAN_TRACE(dev->name, "Enter\n");
+
+       /* Init scan_timeout timer */
+       init_timer_compat(&escan->scan_timeout, wl_escan_timeout, escan);
+       escan->escan_state = ESCAN_STATE_IDLE;
+
+       return 0;
+}
+
+void
+wl_escan_down(struct net_device *dev, dhd_pub_t *dhdp)
+{
+       struct wl_escan_info *escan = dhdp->escan;
+
+       ESCAN_TRACE(dev->name, "Enter\n");
+       if (!escan) {
+               ESCAN_ERROR(dev->name, "escan is NULL\n");
+               return;
+       }
+
+       wl_escan_deinit(dev, escan);
+}
+
+int
+wl_escan_up(struct net_device *dev, dhd_pub_t *dhdp)
+{
+       struct wl_escan_info *escan = dhdp->escan;
+       s32 val = 0;
+       int ret = -1;
+
+       ESCAN_TRACE(dev->name, "Enter\n");
+       if (!escan) {
+               ESCAN_ERROR(dev->name, "escan is NULL\n");
+               return ret;
+       }
+
+       ret = wl_escan_init(dev, escan);
+       if (ret) {
+               ESCAN_ERROR(dev->name, "wl_escan_init ret %d\n", ret);
+               return ret;
+       }
+
+       if (!escan->ioctl_ver) {
+               val = 1;
+               if ((ret = wldev_ioctl(dev, WLC_GET_VERSION, &val, sizeof(int), false) < 0)) {
+                       ESCAN_ERROR(dev->name, "WLC_GET_VERSION failed, ret=%d\n", ret);
+                       return ret;
+               }
+               val = dtoh32(val);
+               if (val != WLC_IOCTL_VERSION && val != 1) {
+                       ESCAN_ERROR(dev->name,
+                               "Version mismatch, please upgrade. Got %d, expected %d or 1\n",
+                               val, WLC_IOCTL_VERSION);
+                       return ret;
+               }
+               escan->ioctl_ver = val;
+       }
+
+       return 0;
+}
+
+int
+wl_escan_event_dettach(struct net_device *dev, dhd_pub_t *dhdp)
+{
+       struct wl_escan_info *escan = dhdp->escan;
+       int ret = -1;
+
+       if (!escan) {
+               ESCAN_ERROR(dev->name, "escan is NULL\n");
+               return ret;
+       }
+
+       wl_ext_event_deregister(dev, dhdp, WLC_E_ESCAN_RESULT, wl_escan_handler);
+
+       return 0;
+}
+
+int
+wl_escan_event_attach(struct net_device *dev, dhd_pub_t *dhdp)
+{
+       struct wl_escan_info *escan = dhdp->escan;
+       int ret = -1;
+
+       if (!escan) {
+               ESCAN_ERROR(dev->name, "escan is NULL\n");
+               return ret;
+       }
+
+       ret = wl_ext_event_register(dev, dhdp, WLC_E_ESCAN_RESULT, wl_escan_handler,
+               escan, PRIO_EVENT_ESCAN);
+       if (ret) {
+               ESCAN_ERROR(dev->name, "wl_ext_event_register err %d\n", ret);
+       }
+
+       return ret;
+}
+
+void
+wl_escan_detach(struct net_device *dev, dhd_pub_t *dhdp)
+{
+       struct wl_escan_info *escan = dhdp->escan;
+
+       ESCAN_TRACE(dev->name, "Enter\n");
+
+       if (!escan)
+               return;
+
+       wl_escan_deinit(dev, escan);
+       if (escan->escan_ioctl_buf) {
+               kfree(escan->escan_ioctl_buf);
+               escan->escan_ioctl_buf = NULL;
+       }
+       wl_ext_event_deregister(dev, dhdp, WLC_E_ESCAN_RESULT, wl_escan_handler);
+
+       DHD_OS_PREFREE(dhdp, escan, sizeof(struct wl_escan_info));
+       dhdp->escan = NULL;
+}
+
+int
+wl_escan_attach(struct net_device *dev, dhd_pub_t *dhdp)
+{
+       struct wl_escan_info *escan = NULL;
+       int ret = 0;
+
+       ESCAN_TRACE(dev->name, "Enter\n");
+
+       escan = (struct wl_escan_info *)DHD_OS_PREALLOC(dhdp,
+               DHD_PREALLOC_WL_ESCAN, sizeof(struct wl_escan_info));
+       if (!escan)
+               return -ENOMEM;
+       memset(escan, 0, sizeof(struct wl_escan_info));
+
+       dhdp->escan = escan;
+
+       /* we only care about main interface so save a global here */
+       escan->pub = dhdp;
+       escan->escan_state = ESCAN_STATE_DOWN;
+
+       escan->escan_ioctl_buf = (void *)kzalloc(WLC_IOCTL_MAXLEN, GFP_KERNEL);
+       if (unlikely(!escan->escan_ioctl_buf)) {
+               ESCAN_ERROR(dev->name, "Ioctl buf alloc failed\n");
+               ret = -ENOMEM;
+               goto exit;
+       }
+       ret = wl_escan_init(dev, escan);
+       if (ret) {
+               ESCAN_ERROR(dev->name, "wl_escan_init err %d\n", ret);
+               goto exit;
+       }
+       mutex_init(&escan->usr_sync);
+
+       return 0;
+
+exit:
+       wl_escan_detach(dev, dhdp);
+       return ret;
+}
+
+#endif /* WL_ESCAN */
+
diff --git a/bcmdhd.101.10.240.x/wl_escan.h b/bcmdhd.101.10.240.x/wl_escan.h
new file mode 100644 (file)
index 0000000..080f333
--- /dev/null
@@ -0,0 +1,77 @@
+\r
+#ifndef _wl_escan_\r
+#define _wl_escan_\r
+#include <linuxver.h>\r
+#include <wl_iw.h>\r
+\r
+#define ESCAN_BUF_SIZE (64 * 1024)\r
+\r
+#define WL_ESCAN_TIMER_INTERVAL_MS     10000 /* Scan timeout */\r
+\r
+/* donlge escan state */\r
+enum escan_state {\r
+       ESCAN_STATE_DOWN,\r
+       ESCAN_STATE_IDLE,\r
+       ESCAN_STATE_SCANING\r
+};\r
+\r
+typedef struct wl_escan_info {\r
+       struct net_device *dev;\r
+       dhd_pub_t *pub;\r
+       timer_list_compat_t scan_timeout; /* Timer for catch scan event timeout */\r
+       int escan_state;\r
+       int ioctl_ver;\r
+       u8 escan_buf[ESCAN_BUF_SIZE];\r
+       struct wl_scan_results *bss_list;\r
+       struct ether_addr disconnected_bssid;\r
+       u8 *escan_ioctl_buf;\r
+       struct mutex usr_sync; /* maily for up/down synchronization */\r
+       int autochannel;\r
+       int best_2g_ch;\r
+       int best_5g_ch;\r
+#if defined(RSSIAVG)\r
+       wl_rssi_cache_ctrl_t g_rssi_cache_ctrl;\r
+       wl_rssi_cache_ctrl_t g_connected_rssi_cache_ctrl;\r
+#endif\r
+#if defined(BSSCACHE)\r
+       wl_bss_cache_ctrl_t g_bss_cache_ctrl;\r
+#endif\r
+} wl_escan_info_t;\r
+\r
+#if defined(WLMESH)\r
+enum mesh_info_id {\r
+       MESH_INFO_MASTER_BSSID = 1,\r
+       MESH_INFO_MASTER_CHANNEL,\r
+       MESH_INFO_HOP_CNT,\r
+       MESH_INFO_PEER_BSSID\r
+};\r
+\r
+#define MAX_HOP_LIST 10\r
+typedef struct wl_mesh_params {\r
+       struct ether_addr master_bssid;\r
+       uint16 master_channel;\r
+       uint hop_cnt;\r
+       struct ether_addr peer_bssid[MAX_HOP_LIST];\r
+       uint16 scan_channel;\r
+} wl_mesh_params_t;\r
+bool wl_escan_mesh_info(struct net_device *dev,\r
+       struct wl_escan_info *escan, struct ether_addr *peer_bssid,\r
+       struct wl_mesh_params *mesh_info);\r
+bool wl_escan_mesh_peer(struct net_device *dev,\r
+       struct wl_escan_info *escan, wlc_ssid_t *cur_ssid, uint16 cur_chan, bool sae,\r
+       struct wl_mesh_params *mesh_info);\r
+#endif /* WLMESH */\r
+\r
+int wl_escan_set_scan(struct net_device *dev, dhd_pub_t *dhdp,\r
+       wlc_ssid_t *ssid, uint16 channel, bool bcast);\r
+int wl_escan_get_scan(struct net_device *dev, dhd_pub_t *dhdp,\r
+       struct iw_request_info *info, struct iw_point *dwrq, char *extra);\r
+int wl_escan_attach(struct net_device *dev, dhd_pub_t *dhdp);\r
+void wl_escan_detach(struct net_device *dev, dhd_pub_t *dhdp);\r
+int wl_escan_event_attach(struct net_device *dev, dhd_pub_t *dhdp);\r
+int wl_escan_event_dettach(struct net_device *dev, dhd_pub_t *dhdp);\r
+int wl_escan_up(struct net_device *dev, dhd_pub_t *dhdp);\r
+void wl_escan_down(struct net_device *dev, dhd_pub_t *dhdp);\r
+\r
+#endif /* _wl_escan_ */\r
+\r
diff --git a/bcmdhd.101.10.240.x/wl_event.c b/bcmdhd.101.10.240.x/wl_event.c
new file mode 100644 (file)
index 0000000..5f75d65
--- /dev/null
@@ -0,0 +1,508 @@
+
+#if defined(WL_EXT_IAPSTA) || defined(USE_IW)
+#include <bcmendian.h>
+#include <wl_android.h>
+#include <dhd_config.h>
+
+#define EVENT_ERROR(name, arg1, args...) \
+       do { \
+               if (android_msg_level & ANDROID_ERROR_LEVEL) { \
+                       printk(KERN_ERR "[dhd-%s] EVENT-ERROR) %s : " arg1, name, __func__, ## args); \
+               } \
+       } while (0)
+#define EVENT_TRACE(name, arg1, args...) \
+       do { \
+               if (android_msg_level & ANDROID_TRACE_LEVEL) { \
+                       printk(KERN_INFO "[dhd-%s] EVENT-TRACE) %s : " arg1, name, __func__, ## args); \
+               } \
+       } while (0)
+#define EVENT_DBG(name, arg1, args...) \
+       do { \
+               if (android_msg_level & ANDROID_DBG_LEVEL) { \
+                       printk(KERN_INFO "[dhd-%s] EVENT-DBG) %s : " arg1, name, __func__, ## args); \
+               } \
+       } while (0)
+
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+#define BCM_SET_LIST_FIRST_ENTRY(entry, ptr, type, member) \
+_Pragma("GCC diagnostic push") \
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"") \
+(entry) = list_first_entry((ptr), type, member); \
+_Pragma("GCC diagnostic pop") \
+
+#define BCM_SET_CONTAINER_OF(entry, ptr, type, member) \
+_Pragma("GCC diagnostic push") \
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"") \
+entry = container_of((ptr), type, member); \
+_Pragma("GCC diagnostic pop") \
+
+#else
+#define BCM_SET_LIST_FIRST_ENTRY(entry, ptr, type, member) \
+(entry) = list_first_entry((ptr), type, member); \
+
+#define BCM_SET_CONTAINER_OF(entry, ptr, type, member) \
+entry = container_of((ptr), type, member); \
+
+#endif /* STRICT_GCC_WARNINGS */
+
+#ifdef DHD_MAX_IFS
+#define WL_MAX_IFS DHD_MAX_IFS
+#else
+#define WL_MAX_IFS 16
+#endif
+
+/* event queue for cfg80211 main event */
+struct wl_event_q {
+       struct list_head eq_list;
+       u32 etype;
+       wl_event_msg_t emsg;
+       s8 edata[1];
+};
+
+typedef s32(*EXT_EVENT_HANDLER) (struct net_device *dev, void *cb_argu,
+       const wl_event_msg_t *e, void *data);
+
+typedef struct event_handler_list {
+       struct event_handler_list *next;
+       struct net_device *dev;
+       uint32 etype;
+       EXT_EVENT_HANDLER cb_func;
+       void *cb_argu;
+       wl_event_prio_t prio;
+} event_handler_list_t;
+
+typedef struct event_handler_head {
+       event_handler_list_t *evt_head;
+} event_handler_head_t;
+
+typedef struct wl_event_params {
+       dhd_pub_t *pub;
+       struct net_device *dev[WL_MAX_IFS];
+       struct event_handler_head evt_head;
+       struct list_head eq_list;       /* used for event queue */
+       spinlock_t eq_lock;     /* for event queue synchronization */
+       struct workqueue_struct *event_workq;   /* workqueue for event */
+       struct work_struct event_work;          /* work item for event */
+       struct mutex event_sync;
+} wl_event_params_t;
+
+static unsigned long
+wl_ext_event_lock_eq(struct wl_event_params *event_params)
+{
+       unsigned long flags;
+
+       spin_lock_irqsave(&event_params->eq_lock, flags);
+       return flags;
+}
+
+static void
+wl_ext_event_unlock_eq(struct wl_event_params *event_params, unsigned long flags)
+{
+       spin_unlock_irqrestore(&event_params->eq_lock, flags);
+}
+
+static void
+wl_ext_event_init_eq_lock(struct wl_event_params *event_params)
+{
+       spin_lock_init(&event_params->eq_lock);
+}
+
+static void
+wl_ext_event_init_eq(struct wl_event_params *event_params)
+{
+       wl_ext_event_init_eq_lock(event_params);
+       INIT_LIST_HEAD(&event_params->eq_list);
+}
+
+static void
+wl_ext_event_flush_eq(struct wl_event_params *event_params)
+{
+       struct wl_event_q *e;
+       unsigned long flags;
+
+       flags = wl_ext_event_lock_eq(event_params);
+       while (!list_empty_careful(&event_params->eq_list)) {
+               BCM_SET_LIST_FIRST_ENTRY(e, &event_params->eq_list, struct wl_event_q, eq_list);
+               list_del(&e->eq_list);
+               kfree(e);
+       }
+       wl_ext_event_unlock_eq(event_params, flags);
+}
+
+/*
+* retrieve first queued event from head
+*/
+
+static struct wl_event_q *
+wl_ext_event_deq_event(struct wl_event_params *event_params)
+{
+       struct wl_event_q *e = NULL;
+       unsigned long flags;
+
+       flags = wl_ext_event_lock_eq(event_params);
+       if (likely(!list_empty(&event_params->eq_list))) {
+               BCM_SET_LIST_FIRST_ENTRY(e, &event_params->eq_list, struct wl_event_q, eq_list);
+               list_del(&e->eq_list);
+       }
+       wl_ext_event_unlock_eq(event_params, flags);
+
+       return e;
+}
+
+/*
+ * push event to tail of the queue
+ */
+
+static s32
+wl_ext_event_enq_event(struct wl_event_params *event_params, u32 event,
+       const wl_event_msg_t *msg, void *data)
+{
+       struct wl_event_q *e;
+       s32 err = 0;
+       uint32 evtq_size;
+       uint32 data_len;
+       unsigned long flags;
+       gfp_t aflags;
+
+       data_len = 0;
+       if (data)
+               data_len = ntoh32(msg->datalen);
+       evtq_size = sizeof(struct wl_event_q) + data_len;
+       aflags = (in_atomic()) ? GFP_ATOMIC : GFP_KERNEL;
+       e = kzalloc(evtq_size, aflags);
+       if (unlikely(!e)) {
+               EVENT_ERROR("wlan", "event alloc failed\n");
+               return -ENOMEM;
+       }
+       e->etype = event;
+       memcpy(&e->emsg, msg, sizeof(wl_event_msg_t));
+       if (data)
+               memcpy(e->edata, data, data_len);
+       flags = wl_ext_event_lock_eq(event_params);
+       list_add_tail(&e->eq_list, &event_params->eq_list);
+       wl_ext_event_unlock_eq(event_params, flags);
+
+       return err;
+}
+
+static void
+wl_ext_event_put_event(struct wl_event_q *e)
+{
+       kfree(e);
+}
+
+static void
+wl_ext_event_handler(struct work_struct *work_data)
+{
+       struct wl_event_params *event_params = NULL;
+       struct wl_event_q *e;
+       struct net_device *dev = NULL;
+       struct event_handler_list *evt_node;
+       dhd_pub_t *dhd;
+       unsigned long flags = 0;
+
+       BCM_SET_CONTAINER_OF(event_params, work_data, struct wl_event_params, event_work);
+       DHD_EVENT_WAKE_LOCK(event_params->pub);
+       while ((e = wl_ext_event_deq_event(event_params))) {
+               if (e->emsg.ifidx >= DHD_MAX_IFS) {
+                       EVENT_ERROR("wlan", "ifidx=%d not in range\n", e->emsg.ifidx);
+                       goto fail;
+               }
+               dev = event_params->dev[e->emsg.ifidx];
+               if (!dev) {
+                       EVENT_DBG("wlan", "ifidx=%d dev not ready\n", e->emsg.ifidx);
+                       goto fail;
+               }
+               dhd = dhd_get_pub(dev);
+               if (e->etype > WLC_E_LAST) {
+                       EVENT_TRACE(dev->name, "Unknown Event (%d): ignoring\n", e->etype);
+                       goto fail;
+               }
+               DHD_GENERAL_LOCK(dhd, flags);
+               if (DHD_BUS_CHECK_DOWN_OR_DOWN_IN_PROGRESS(dhd)) {
+                       EVENT_ERROR(dev->name, "BUS is DOWN.\n");
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+                       goto fail;
+               }
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               EVENT_DBG(dev->name, "event type (%d)\n", e->etype);
+               mutex_lock(&event_params->event_sync);
+               evt_node = event_params->evt_head.evt_head;
+               for (;evt_node;) {
+                       if (evt_node->dev == dev &&
+                                       (evt_node->etype == e->etype || evt_node->etype == WLC_E_LAST))
+                               evt_node->cb_func(dev, evt_node->cb_argu, &e->emsg, e->edata);
+                       evt_node = evt_node->next;
+               }
+               mutex_unlock(&event_params->event_sync);
+fail:
+               wl_ext_event_put_event(e);
+       }
+       DHD_EVENT_WAKE_UNLOCK(event_params->pub);
+}
+
+void
+wl_ext_event_send(void *params, const wl_event_msg_t * e, void *data)
+{
+       struct wl_event_params *event_params = params;
+       u32 event_type = ntoh32(e->event_type);
+
+       if (event_params == NULL) {
+               EVENT_ERROR("wlan", "Stale event %d(%s) ignored\n",
+                       event_type, bcmevent_get_name(event_type));
+               return;
+       }
+
+       if (event_params->event_workq == NULL) {
+               EVENT_ERROR("wlan", "Event handler is not created %d(%s)\n",
+                       event_type, bcmevent_get_name(event_type));
+               return;
+       }
+
+       if (likely(!wl_ext_event_enq_event(event_params, event_type, e, data))) {
+               queue_work(event_params->event_workq, &event_params->event_work);
+       }
+}
+
+static s32
+wl_ext_event_create_handler(struct wl_event_params *event_params)
+{
+       int ret = 0;
+       EVENT_TRACE("wlan", "Enter\n");
+
+       /* Allocate workqueue for event */
+       if (!event_params->event_workq) {
+               event_params->event_workq = alloc_workqueue("ext_eventd", WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
+       }
+
+       if (!event_params->event_workq) {
+               EVENT_ERROR("wlan", "event_workq alloc_workqueue failed\n");
+               ret = -ENOMEM;
+       } else {
+               INIT_WORK(&event_params->event_work, wl_ext_event_handler);
+       }
+       return ret;
+}
+
+static void
+wl_ext_event_free(struct wl_event_params *event_params)
+{
+       struct event_handler_list *node, *cur, **evt_head;
+
+       evt_head = &event_params->evt_head.evt_head;
+       node = *evt_head;
+
+       for (;node;) {
+               EVENT_TRACE(node->dev->name, "Free etype=%d\n", node->etype);
+               cur = node;
+               node = cur->next;
+               kfree(cur);
+       }
+       *evt_head = NULL;
+}
+
+static void
+wl_ext_event_destroy_handler(struct wl_event_params *event_params)
+{
+       if (event_params && event_params->event_workq) {
+               cancel_work_sync(&event_params->event_work);
+               destroy_workqueue(event_params->event_workq);
+               event_params->event_workq = NULL;
+       }
+}
+
+int
+wl_ext_event_register(struct net_device *dev, dhd_pub_t *dhd, uint32 event,
+       void *cb_func, void *data, wl_event_prio_t prio)
+{
+       struct wl_event_params *event_params = dhd->event_params;
+       struct event_handler_list *node, *leaf, *node_prev, **evt_head;
+       int ret = 0;
+
+       if (event_params) {
+               mutex_lock(&event_params->event_sync);
+               evt_head = &event_params->evt_head.evt_head;
+               node = *evt_head;
+               for (;node;) {
+                       if (node->dev == dev && node->etype == event && node->cb_func == cb_func) {
+                               EVENT_TRACE(dev->name, "skip event %d\n", event);
+                               mutex_unlock(&event_params->event_sync);
+                               return 0;
+                       }
+                       node = node->next;
+               }
+               leaf = kmalloc(sizeof(event_handler_list_t), GFP_KERNEL);
+               if (!leaf) {
+                       EVENT_ERROR(dev->name, "Memory alloc failure %d for event %d\n",
+                               (int)sizeof(event_handler_list_t), event);
+                       mutex_unlock(&event_params->event_sync);
+                       return -ENOMEM;
+               }
+               leaf->next = NULL;
+               leaf->dev = dev;
+               leaf->etype = event;
+               leaf->cb_func = cb_func;
+               leaf->cb_argu = data;
+               leaf->prio = prio;
+               if (*evt_head == NULL) {
+                       *evt_head = leaf;
+               } else {
+                       node = *evt_head;
+                       node_prev = NULL;
+                       for (;node;) {
+                               if (node->prio <= prio) {
+                                       leaf->next = node;
+                                       if (node_prev)
+                                               node_prev->next = leaf;
+                                       else
+                                               *evt_head = leaf;
+                                       break;
+                               } else if (node->next == NULL) {
+                                       node->next = leaf;
+                                       break;
+                               }
+                               node_prev = node;
+                               node = node->next;
+                       }
+               }
+               EVENT_TRACE(dev->name, "event %d registered\n", event);
+               mutex_unlock(&event_params->event_sync);
+       } else {
+               EVENT_ERROR(dev->name, "event_params not ready %d\n", event);
+               ret = -ENODEV;
+       }
+
+       return ret;
+}
+
+void
+wl_ext_event_deregister(struct net_device *dev, dhd_pub_t *dhd,
+       uint32 event, void *cb_func)
+{
+       struct wl_event_params *event_params = dhd->event_params;
+       struct event_handler_list *node, *prev, **evt_head;
+       int tmp = 0;
+
+       if (event_params) {
+               mutex_lock(&event_params->event_sync);
+               evt_head = &event_params->evt_head.evt_head;
+               node = *evt_head;
+               prev = node;
+               for (;node;) {
+                       if (node->dev == dev && node->etype == event && node->cb_func == cb_func) {
+                               if (node == *evt_head) {
+                                       tmp = 1;
+                                       *evt_head = node->next;
+                               } else {
+                                       tmp = 0;
+                                       prev->next = node->next;
+                               }
+                               EVENT_TRACE(dev->name, "event %d deregistered\n", event);
+                               kfree(node);
+                               if (tmp == 1) {
+                                       node = *evt_head;
+                                       prev = node;
+                               } else {
+                                       node = prev->next;
+                               }
+                               continue;
+                       }
+                       prev = node;
+                       node = node->next;
+               }
+               mutex_unlock(&event_params->event_sync);
+       } else {
+               EVENT_ERROR(dev->name, "event_params not ready %d\n", event);
+       }
+}
+
+static s32
+wl_ext_event_init_priv(struct wl_event_params *event_params)
+{
+       s32 err = 0;
+
+       mutex_init(&event_params->event_sync);
+       wl_ext_event_init_eq(event_params);
+       if (wl_ext_event_create_handler(event_params))
+               return -ENOMEM;
+
+       return err;
+}
+
+static void
+wl_ext_event_deinit_priv(struct wl_event_params *event_params)
+{
+       wl_ext_event_destroy_handler(event_params);
+       wl_ext_event_flush_eq(event_params);
+       wl_ext_event_free(event_params);
+}
+
+int
+wl_ext_event_attach_netdev(struct net_device *net, int ifidx, uint8 bssidx)
+{
+       struct dhd_pub *dhd = dhd_get_pub(net);
+       struct wl_event_params *event_params = dhd->event_params;
+
+       EVENT_TRACE(net->name, "ifidx=%d, bssidx=%d\n", ifidx, bssidx);
+       if (event_params && ifidx < WL_MAX_IFS) {
+               event_params->dev[ifidx] = net;
+       }
+
+       return 0;
+}
+
+int
+wl_ext_event_dettach_netdev(struct net_device *net, int ifidx)
+{
+       struct dhd_pub *dhd = dhd_get_pub(net);
+       struct wl_event_params *event_params = dhd->event_params;
+
+       EVENT_TRACE(net->name, "ifidx=%d\n", ifidx);
+       if (event_params && ifidx < WL_MAX_IFS) {
+               event_params->dev[ifidx] = NULL;
+       }
+
+       return 0;
+}
+
+s32
+wl_ext_event_attach(struct net_device *dev, dhd_pub_t *dhdp)
+{
+       struct wl_event_params *event_params = NULL;
+       s32 err = 0;
+
+       event_params = kmalloc(sizeof(wl_event_params_t), GFP_KERNEL);
+       if (!event_params) {
+               EVENT_ERROR(dev->name, "Failed to allocate memory (%zu)\n",
+                       sizeof(wl_event_params_t));
+               return -ENOMEM;
+       }
+       dhdp->event_params = event_params;
+       memset(event_params, 0, sizeof(wl_event_params_t));
+       event_params->pub = dhdp;
+
+       err = wl_ext_event_init_priv(event_params);
+       if (err) {
+               EVENT_ERROR(dev->name, "Failed to wl_ext_event_init_priv (%d)\n", err);
+               goto ext_attach_out;
+       }
+
+       return err;
+ext_attach_out:
+       wl_ext_event_dettach(dhdp);
+       return err;
+}
+
+void
+wl_ext_event_dettach(dhd_pub_t *dhdp)
+{
+       struct wl_event_params *event_params = dhdp->event_params;
+
+       if (event_params) {
+               wl_ext_event_deinit_priv(event_params);
+               kfree(event_params);
+               dhdp->event_params = NULL;
+       }
+}
+#endif
diff --git a/bcmdhd.101.10.240.x/wl_iw.c b/bcmdhd.101.10.240.x/wl_iw.c
new file mode 100644 (file)
index 0000000..2cdac61
--- /dev/null
@@ -0,0 +1,4359 @@
+/*
+ * Linux Wireless Extensions support
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wl_iw.c 616333 2016-02-01 05:30:29Z $
+ */
+
+#if defined(USE_IW)
+#define LINUX_PORT
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <ethernet.h>
+
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+#include <wlioctl.h>
+#ifdef WL_NAN
+#include <wlioctl_utils.h>
+#endif
+#include <wl_iw.h>
+#include <wl_android.h>
+#ifdef WL_ESCAN
+#include <wl_escan.h>
+#endif
+#include <dhd_config.h>
+
+uint iw_msg_level = WL_ERROR_LEVEL;
+
+#define WL_ERROR_MSG(x, args...) \
+       do { \
+               if (iw_msg_level & WL_ERROR_LEVEL) { \
+                       printk(KERN_ERR "[dhd] WEXT-ERROR) %s : " x, __func__, ## args); \
+               } \
+       } while (0)
+#define WL_TRACE_MSG(x, args...) \
+       do { \
+               if (iw_msg_level & WL_TRACE_LEVEL) { \
+                       printk(KERN_INFO "[dhd] WEXT-TRACE) %s : " x, __func__, ## args); \
+               } \
+       } while (0)
+#define WL_SCAN_MSG(x, args...) \
+       do { \
+               if (iw_msg_level & WL_SCAN_LEVEL) { \
+                       printk(KERN_INFO "[dhd] WEXT-SCAN) %s : " x, __func__, ## args); \
+               } \
+       } while (0)
+#define WL_WSEC_MSG(x, args...) \
+       do { \
+               if (iw_msg_level & WL_WSEC_LEVEL) { \
+                       printk(KERN_INFO "[dhd] WEXT-WSEC) %s : " x, __func__, ## args); \
+               } \
+       } while (0)
+#define WL_ERROR(x) WL_ERROR_MSG x
+#define WL_TRACE(x) WL_TRACE_MSG x
+#define WL_SCAN(x) WL_SCAN_MSG x
+#define WL_WSEC(x) WL_WSEC_MSG x
+#ifdef BCMWAPI_WPI
+/* these items should evetually go into wireless.h of the linux system headfile dir */
+#ifndef IW_ENCODE_ALG_SM4
+#define IW_ENCODE_ALG_SM4 0x20
+#endif
+
+#ifndef IW_AUTH_WAPI_ENABLED
+#define IW_AUTH_WAPI_ENABLED 0x20
+#endif
+
+#ifndef IW_AUTH_WAPI_VERSION_1
+#define IW_AUTH_WAPI_VERSION_1 0x00000008
+#endif
+
+#ifndef IW_AUTH_CIPHER_SMS4
+#define IW_AUTH_CIPHER_SMS4    0x00000020
+#endif
+
+#ifndef IW_AUTH_KEY_MGMT_WAPI_PSK
+#define IW_AUTH_KEY_MGMT_WAPI_PSK 4
+#endif
+
+#ifndef IW_AUTH_KEY_MGMT_WAPI_CERT
+#define IW_AUTH_KEY_MGMT_WAPI_CERT 8
+#endif
+#endif /* BCMWAPI_WPI */
+
+/* Broadcom extensions to WEXT, linux upstream has obsoleted WEXT */
+#ifndef IW_AUTH_KEY_MGMT_FT_802_1X
+#define IW_AUTH_KEY_MGMT_FT_802_1X 0x04
+#endif
+
+#ifndef IW_AUTH_KEY_MGMT_FT_PSK
+#define IW_AUTH_KEY_MGMT_FT_PSK 0x08
+#endif
+
+#ifndef IW_ENC_CAPA_FW_ROAM_ENABLE
+#define IW_ENC_CAPA_FW_ROAM_ENABLE     0x00000020
+#endif
+
+
+/* FC9: wireless.h 2.6.25-14.fc9.i686 is missing these, even though WIRELESS_EXT is set to latest
+ * version 22.
+ */
+#ifndef IW_ENCODE_ALG_PMK
+#define IW_ENCODE_ALG_PMK 4
+#endif
+#ifndef IW_ENC_CAPA_4WAY_HANDSHAKE
+#define IW_ENC_CAPA_4WAY_HANDSHAKE 0x00000010
+#endif
+/* End FC9. */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+#include <linux/rtnetlink.h>
+#endif
+
+extern bool wl_iw_conn_status_str(uint32 event_type, uint32 status,
+       uint32 reason, char* stringBuf, uint buflen);
+
+uint wl_msg_level = WL_ERROR_VAL;
+
+#define MAX_WLIW_IOCTL_LEN WLC_IOCTL_MEDLEN
+
+/* IOCTL swapping mode for Big Endian host with Little Endian dongle.  Default to off */
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+
+extern struct iw_statistics *dhd_get_wireless_stats(struct net_device *dev);
+extern int dhd_wait_pend8021x(struct net_device *dev);
+
+#if WIRELESS_EXT < 19
+#define IW_IOCTL_IDX(cmd)      ((cmd) - SIOCIWFIRST)
+#define IW_EVENT_IDX(cmd)      ((cmd) - IWEVFIRST)
+#endif /* WIRELESS_EXT < 19 */
+
+
+#ifndef WL_ESCAN
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+#define DAEMONIZE(a)   do { \
+               allow_signal(SIGKILL);  \
+               allow_signal(SIGTERM);  \
+       } while (0)
+#elif ((LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)) && \
+       (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)))
+#define DAEMONIZE(a) daemonize(a); \
+       allow_signal(SIGKILL); \
+       allow_signal(SIGTERM);
+#else /* Linux 2.4 (w/o preemption patch) */
+#define RAISE_RX_SOFTIRQ() \
+       cpu_raise_softirq(smp_processor_id(), NET_RX_SOFTIRQ)
+#define DAEMONIZE(a) daemonize(); \
+       do { if (a) \
+               strncpy(current->comm, a, MIN(sizeof(current->comm), (strlen(a) + 1))); \
+       } while (0);
+#endif /* LINUX_VERSION_CODE  */
+
+#define ISCAN_STATE_IDLE   0
+#define ISCAN_STATE_SCANING 1
+
+/* the buf lengh can be WLC_IOCTL_MAXLEN (8K) to reduce iteration */
+#define WLC_IW_ISCAN_MAXLEN   2048
+typedef struct iscan_buf {
+       struct iscan_buf * next;
+       char   iscan_buf[WLC_IW_ISCAN_MAXLEN];
+} iscan_buf_t;
+
+typedef struct iscan_info {
+       struct net_device *dev;
+       timer_list_compat_t timer;
+       uint32 timer_ms;
+       uint32 timer_on;
+       int    iscan_state;
+       iscan_buf_t * list_hdr;
+       iscan_buf_t * list_cur;
+
+       /* Thread to work on iscan */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+       struct task_struct *kthread;
+#endif
+       long sysioc_pid;
+       struct semaphore sysioc_sem;
+       struct completion sysioc_exited;
+       char ioctlbuf[WLC_IOCTL_SMLEN];
+} iscan_info_t;
+static void wl_iw_timerfunc(ulong data);
+static void wl_iw_set_event_mask(struct net_device *dev);
+static int wl_iw_iscan(iscan_info_t *iscan, wlc_ssid_t *ssid, uint16 action);
+#endif /* !WL_ESCAN */
+
+struct pmk_list {
+       pmkid_list_t pmkids;
+       pmkid_t foo[MAXPMKID - 1];
+};
+
+typedef struct wl_wext_info {
+       struct net_device *dev;
+       dhd_pub_t *dhd;
+       struct delayed_work pm_enable_work;
+       struct mutex pm_sync;
+       struct wl_conn_info conn_info;
+       struct pmk_list pmk_list;
+#ifndef WL_ESCAN
+       struct iscan_info iscan;
+#endif
+} wl_wext_info_t;
+
+/* priv_link becomes netdev->priv and is the link between netdev and wlif struct */
+typedef struct priv_link {
+       wl_iw_t *wliw;
+} priv_link_t;
+
+/* dev to priv_link */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24))
+#define WL_DEV_LINK(dev)       (priv_link_t*)(dev->priv)
+#else
+#define WL_DEV_LINK(dev)       (priv_link_t*)netdev_priv(dev)
+#endif
+
+/* dev to wl_iw_t */
+#define IW_DEV_IF(dev)          ((wl_iw_t*)(WL_DEV_LINK(dev))->wliw)
+
+static void swap_key_from_BE(
+               wl_wsec_key_t *key
+)
+{
+       key->index = htod32(key->index);
+       key->len = htod32(key->len);
+       key->algo = htod32(key->algo);
+       key->flags = htod32(key->flags);
+       key->rxiv.hi = htod32(key->rxiv.hi);
+       key->rxiv.lo = htod16(key->rxiv.lo);
+       key->iv_initialized = htod32(key->iv_initialized);
+}
+
+static void swap_key_to_BE(
+               wl_wsec_key_t *key
+)
+{
+       key->index = dtoh32(key->index);
+       key->len = dtoh32(key->len);
+       key->algo = dtoh32(key->algo);
+       key->flags = dtoh32(key->flags);
+       key->rxiv.hi = dtoh32(key->rxiv.hi);
+       key->rxiv.lo = dtoh16(key->rxiv.lo);
+       key->iv_initialized = dtoh32(key->iv_initialized);
+}
+
+static int
+dev_wlc_ioctl(
+       struct net_device *dev,
+       int cmd,
+       void *arg,
+       int len
+)
+{
+       struct ifreq ifr;
+       wl_ioctl_t ioc;
+       mm_segment_t fs;
+       int ret;
+
+       memset(&ioc, 0, sizeof(ioc));
+#ifdef CONFIG_COMPAT
+       ioc.cmd = cmd | WLC_SPEC_FLAG;
+#else
+       ioc.cmd = cmd;
+#endif
+       ioc.buf = arg;
+       ioc.len = len;
+
+       strncpy(ifr.ifr_name, dev->name, sizeof(ifr.ifr_name));
+       ifr.ifr_name[sizeof(ifr.ifr_name) - 1] = '\0';
+       ifr.ifr_data = (caddr_t) &ioc;
+
+       fs = get_fs();
+       set_fs(get_ds());
+#if defined(WL_USE_NETDEV_OPS)
+       ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
+#else
+       ret = dev->do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
+#endif
+       set_fs(fs);
+
+       return ret;
+}
+
+/*
+set named driver variable to int value and return error indication
+calling example: dev_wlc_intvar_set(dev, "arate", rate)
+*/
+
+static int
+dev_wlc_intvar_set(
+       struct net_device *dev,
+       char *name,
+       int val)
+{
+       char buf[WLC_IOCTL_SMLEN];
+       uint len;
+
+       val = htod32(val);
+       len = bcm_mkiovar(name, (char *)(&val), sizeof(val), buf, sizeof(buf));
+       ASSERT(len);
+
+       return (dev_wlc_ioctl(dev, WLC_SET_VAR, buf, len));
+}
+
+#ifndef WL_ESCAN
+static int
+dev_iw_iovar_setbuf(
+       struct net_device *dev,
+       char *iovar,
+       void *param,
+       int paramlen,
+       void *bufptr,
+       int buflen)
+{
+       int iolen;
+
+       iolen = bcm_mkiovar(iovar, param, paramlen, bufptr, buflen);
+       ASSERT(iolen);
+       BCM_REFERENCE(iolen);
+
+       return (dev_wlc_ioctl(dev, WLC_SET_VAR, bufptr, iolen));
+}
+
+static int
+dev_iw_iovar_getbuf(
+       struct net_device *dev,
+       char *iovar,
+       void *param,
+       int paramlen,
+       void *bufptr,
+       int buflen)
+{
+       int iolen;
+
+       iolen = bcm_mkiovar(iovar, param, paramlen, bufptr, buflen);
+       ASSERT(iolen);
+       BCM_REFERENCE(iolen);
+
+       return (dev_wlc_ioctl(dev, WLC_GET_VAR, bufptr, buflen));
+}
+#endif
+
+#if WIRELESS_EXT > 17
+static int
+dev_wlc_bufvar_set(
+       struct net_device *dev,
+       char *name,
+       char *buf, int len)
+{
+       char *ioctlbuf;
+       uint buflen;
+       int error;
+
+       ioctlbuf = kmalloc(MAX_WLIW_IOCTL_LEN, GFP_KERNEL);
+       if (!ioctlbuf)
+               return -ENOMEM;
+
+       buflen = bcm_mkiovar(name, buf, len, ioctlbuf, MAX_WLIW_IOCTL_LEN);
+       ASSERT(buflen);
+       error = dev_wlc_ioctl(dev, WLC_SET_VAR, ioctlbuf, buflen);
+
+       kfree(ioctlbuf);
+       return error;
+}
+#endif /* WIRELESS_EXT > 17 */
+
+/*
+get named driver variable to int value and return error indication
+calling example: dev_wlc_bufvar_get(dev, "arate", &rate)
+*/
+
+static int
+dev_wlc_bufvar_get(
+       struct net_device *dev,
+       char *name,
+       char *buf, int buflen)
+{
+       char *ioctlbuf;
+       int error;
+
+       uint len;
+
+       ioctlbuf = kmalloc(MAX_WLIW_IOCTL_LEN, GFP_KERNEL);
+       if (!ioctlbuf)
+               return -ENOMEM;
+       len = bcm_mkiovar(name, NULL, 0, ioctlbuf, MAX_WLIW_IOCTL_LEN);
+       ASSERT(len);
+       BCM_REFERENCE(len);
+       error = dev_wlc_ioctl(dev, WLC_GET_VAR, (void *)ioctlbuf, MAX_WLIW_IOCTL_LEN);
+       if (!error)
+               bcopy(ioctlbuf, buf, buflen);
+
+       kfree(ioctlbuf);
+       return (error);
+}
+
+/*
+get named driver variable to int value and return error indication
+calling example: dev_wlc_intvar_get(dev, "arate", &rate)
+*/
+
+static int
+dev_wlc_intvar_get(
+       struct net_device *dev,
+       char *name,
+       int *retval)
+{
+       union {
+               char buf[WLC_IOCTL_SMLEN];
+               int val;
+       } var;
+       int error;
+
+       uint len;
+       uint data_null;
+
+       len = bcm_mkiovar(name, (char *)(&data_null), 0, (char *)(&var), sizeof(var.buf));
+       ASSERT(len);
+       error = dev_wlc_ioctl(dev, WLC_GET_VAR, (void *)&var, len);
+
+       *retval = dtoh32(var.val);
+
+       return (error);
+}
+
+/* Maintain backward compatibility */
+#if WIRELESS_EXT < 13
+struct iw_request_info
+{
+       __u16           cmd;            /* Wireless Extension command */
+       __u16           flags;          /* More to come ;-) */
+};
+
+typedef int (*iw_handler)(struct net_device *dev, struct iw_request_info *info,
+       void *wrqu, char *extra);
+#endif /* WIRELESS_EXT < 13 */
+
+#if WIRELESS_EXT > 12
+static int
+wl_iw_set_leddc(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       union iwreq_data *wrqu,
+       char *extra
+)
+{
+       int dc = *(int *)extra;
+       int error;
+
+       error = dev_wlc_intvar_set(dev, "leddc", dc);
+       return error;
+}
+
+static int
+wl_iw_set_vlanmode(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       union iwreq_data *wrqu,
+       char *extra
+)
+{
+       int mode = *(int *)extra;
+       int error;
+
+       mode = htod32(mode);
+       error = dev_wlc_intvar_set(dev, "vlan_mode", mode);
+       return error;
+}
+
+static int
+wl_iw_set_pm(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       union iwreq_data *wrqu,
+       char *extra
+)
+{
+       int pm = *(int *)extra;
+       int error;
+
+       pm = htod32(pm);
+       error = dev_wlc_ioctl(dev, WLC_SET_PM, &pm, sizeof(pm));
+       return error;
+}
+#endif /* WIRELESS_EXT > 12 */
+
+static void
+wl_iw_update_connect_status(struct net_device *dev, enum wl_ext_status status)
+{
+#ifndef WL_CFG80211
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       int cur_eapol_status = 0;
+       int wpa_auth = 0;
+       int error = -EINVAL;
+       wl_wext_info_t *wext_info = NULL;
+
+       if (!dhd || !dhd->conf)
+               return;
+       wext_info = dhd->wext_info;
+       cur_eapol_status = dhd->conf->eapol_status;
+
+       if (status == WL_EXT_STATUS_CONNECTING) {
+#ifdef WL_EXT_IAPSTA
+               wl_ext_add_remove_pm_enable_work(dev, TRUE);
+#endif /* WL_EXT_IAPSTA */
+               if ((error = dev_wlc_intvar_get(dev, "wpa_auth", &wpa_auth))) {
+                       WL_ERROR(("wpa_auth get error %d\n", error));
+                       return;
+               }
+               if (wpa_auth & (WPA_AUTH_PSK|WPA2_AUTH_PSK))
+                       dhd->conf->eapol_status = EAPOL_STATUS_4WAY_START;
+               else
+                       dhd->conf->eapol_status = EAPOL_STATUS_NONE;
+       } else if (status == WL_EXT_STATUS_ADD_KEY) {
+               dhd->conf->eapol_status = EAPOL_STATUS_4WAY_DONE;
+               wake_up_interruptible(&dhd->conf->event_complete);
+       } else if (status == WL_EXT_STATUS_DISCONNECTING) {
+#ifdef WL_EXT_IAPSTA
+               wl_ext_add_remove_pm_enable_work(dev, FALSE);
+#endif /* WL_EXT_IAPSTA */
+               if (cur_eapol_status >= EAPOL_STATUS_4WAY_START &&
+                               cur_eapol_status < EAPOL_STATUS_4WAY_DONE) {
+                       WL_ERROR(("WPA failed at %d\n", cur_eapol_status));
+                       dhd->conf->eapol_status = EAPOL_STATUS_NONE;
+               } else if (cur_eapol_status >= EAPOL_STATUS_WSC_START &&
+                               cur_eapol_status < EAPOL_STATUS_WSC_DONE) {
+                       WL_ERROR(("WPS failed at %d\n", cur_eapol_status));
+                       dhd->conf->eapol_status = EAPOL_STATUS_NONE;
+               }
+       } else if (status == WL_EXT_STATUS_DISCONNECTED) {
+               if (cur_eapol_status >= EAPOL_STATUS_4WAY_START &&
+                               cur_eapol_status < EAPOL_STATUS_4WAY_DONE) {
+                       WL_ERROR(("WPA failed at %d\n", cur_eapol_status));
+                       dhd->conf->eapol_status = EAPOL_STATUS_NONE;
+                       wake_up_interruptible(&dhd->conf->event_complete);
+               } else if (cur_eapol_status >= EAPOL_STATUS_WSC_START &&
+                               cur_eapol_status < EAPOL_STATUS_WSC_DONE) {
+                       WL_ERROR(("WPS failed at %d\n", cur_eapol_status));
+                       dhd->conf->eapol_status = EAPOL_STATUS_NONE;
+               }
+       }
+#endif
+       return;
+}
+
+int
+wl_iw_send_priv_event(
+       struct net_device *dev,
+       char *flag
+)
+{
+       union iwreq_data wrqu;
+       char extra[IW_CUSTOM_MAX + 1];
+       int cmd;
+
+       cmd = IWEVCUSTOM;
+       memset(&wrqu, 0, sizeof(wrqu));
+       if (strlen(flag) > sizeof(extra))
+               return -1;
+
+       strncpy(extra, flag, sizeof(extra));
+       extra[sizeof(extra) - 1] = '\0';
+       wrqu.data.length = strlen(extra);
+       wireless_send_event(dev, cmd, &wrqu, extra);
+       WL_TRACE(("Send IWEVCUSTOM Event as %s\n", extra));
+
+       return 0;
+}
+
+static int
+wl_iw_config_commit(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       void *zwrq,
+       char *extra
+)
+{
+       wlc_ssid_t ssid;
+       int error;
+       struct sockaddr bssid;
+
+       WL_TRACE(("%s: SIOCSIWCOMMIT\n", dev->name));
+
+       if ((error = dev_wlc_ioctl(dev, WLC_GET_SSID, &ssid, sizeof(ssid))))
+               return error;
+
+       ssid.SSID_len = dtoh32(ssid.SSID_len);
+
+       if (!ssid.SSID_len)
+               return 0;
+
+       bzero(&bssid, sizeof(struct sockaddr));
+       if ((error = dev_wlc_ioctl(dev, WLC_REASSOC, &bssid, ETHER_ADDR_LEN))) {
+               WL_ERROR(("WLC_REASSOC failed (%d)\n", error));
+               return error;
+       }
+
+       return 0;
+}
+
+static int
+wl_iw_get_name(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       union iwreq_data *cwrq,
+       char *extra
+)
+{
+       int phytype, err;
+       uint band[3];
+       char cap[5];
+
+       WL_TRACE(("%s: SIOCGIWNAME\n", dev->name));
+
+       cap[0] = 0;
+       if ((err = dev_wlc_ioctl(dev, WLC_GET_PHYTYPE, &phytype, sizeof(phytype))) < 0)
+               goto done;
+       if ((err = dev_wlc_ioctl(dev, WLC_GET_BANDLIST, band, sizeof(band))) < 0)
+               goto done;
+
+       band[0] = dtoh32(band[0]);
+       switch (phytype) {
+               case WLC_PHY_TYPE_A:
+                       strncpy(cap, "a", sizeof(cap));
+                       break;
+               case WLC_PHY_TYPE_B:
+                       strncpy(cap, "b", sizeof(cap));
+                       break;
+               case WLC_PHY_TYPE_G:
+                       if (band[0] >= 2)
+                               strncpy(cap, "abg", sizeof(cap));
+                       else
+                               strncpy(cap, "bg", sizeof(cap));
+                       break;
+               case WLC_PHY_TYPE_N:
+                       if (band[0] >= 2)
+                               strncpy(cap, "abgn", sizeof(cap));
+                       else
+                               strncpy(cap, "bgn", sizeof(cap));
+                       break;
+       }
+done:
+       (void)snprintf(cwrq->name, IFNAMSIZ, "IEEE 802.11%s", cap);
+
+       return 0;
+}
+
+#define DHD_CHECK(dhd, dev) \
+       if (!dhd) { \
+               WL_ERROR (("[dhd-%s] %s: dhd is NULL\n", dev->name, __FUNCTION__)); \
+               return -ENODEV; \
+       } \
+
+static int
+wl_iw_set_freq(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_freq *fwrq,
+       char *extra
+)
+{
+       int error, chan;
+       uint sf = 0;
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       wl_wext_info_t *wext_info = NULL;
+
+       WL_TRACE(("%s: SIOCSIWFREQ\n", dev->name));
+       DHD_CHECK(dhd, dev);
+       wext_info = dhd->wext_info;
+
+       /* Setting by channel number */
+       if (fwrq->e == 0 && fwrq->m < MAXCHANNEL) {
+               chan = fwrq->m;
+       }
+
+       /* Setting by frequency */
+       else {
+               /* Convert to MHz as best we can */
+               if (fwrq->e >= 6) {
+                       fwrq->e -= 6;
+                       while (fwrq->e--)
+                               fwrq->m *= 10;
+               } else if (fwrq->e < 6) {
+                       while (fwrq->e++ < 6)
+                               fwrq->m /= 10;
+               }
+       /* handle 4.9GHz frequencies as Japan 4 GHz based channelization */
+               if (fwrq->m > 4000 && fwrq->m < 5000) {
+                       sf = WF_CHAN_FACTOR_4_G; /* start factor for 4 GHz */
+               }
+               chan = wf_mhz2channel(fwrq->m, sf);
+       }
+       if (wext_info)
+               wext_info->conn_info.channel = chan;
+       WL_MSG(dev->name, "chan=%d\n", chan);
+       chan = htod32(chan);
+       if ((error = dev_wlc_ioctl(dev, WLC_SET_CHANNEL, &chan, sizeof(chan)))) {
+               WL_ERROR(("WLC_SET_CHANNEL failed (%d).\n", error));
+               return error;
+       }
+
+       /* -EINPROGRESS: Call commit handler */
+       return -EINPROGRESS;
+}
+
+static int
+wl_iw_get_freq(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_freq *fwrq,
+       char *extra
+)
+{
+       int error;
+       u32 chanspec = 0;
+       int ctl_chan;
+
+       WL_TRACE(("%s: SIOCGIWFREQ\n", dev->name));
+
+       if ((error = dev_wlc_intvar_get(dev, "chanspec", &chanspec)))
+               return error;
+       ctl_chan = wf_chspec_ctlchan(chanspec);
+
+       /* Return radio channel in channel form */
+       fwrq->m = ctl_chan;
+       fwrq->e = dtoh32(0);
+       return 0;
+}
+
+static int
+wl_iw_set_mode(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       __u32 *uwrq,
+       char *extra
+)
+{
+       int infra = 0, ap = 0, error = 0;
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       wl_wext_info_t *wext_info = NULL;
+
+       WL_TRACE(("%s: SIOCSIWMODE\n", dev->name));
+       DHD_CHECK(dhd, dev);
+       wext_info = dhd->wext_info;
+       if (wext_info) {
+               memset(&wext_info->conn_info.ssid, 0, sizeof(wlc_ssid_t));
+               memset(&wext_info->conn_info.bssid, 0, sizeof(struct ether_addr));
+               wext_info->conn_info.channel = 0;
+       }
+
+       switch (*uwrq) {
+       case IW_MODE_MASTER:
+               infra = ap = 1;
+               break;
+       case IW_MODE_ADHOC:
+       case IW_MODE_AUTO:
+               break;
+       case IW_MODE_INFRA:
+               infra = 1;
+               break;
+       default:
+               return -EINVAL;
+       }
+       infra = htod32(infra);
+       ap = htod32(ap);
+
+       if ((error = dev_wlc_ioctl(dev, WLC_SET_INFRA, &infra, sizeof(infra))) ||
+           (error = dev_wlc_ioctl(dev, WLC_SET_AP, &ap, sizeof(ap))))
+               return error;
+
+       /* -EINPROGRESS: Call commit handler */
+       return -EINPROGRESS;
+}
+
+static int
+wl_iw_get_mode(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       __u32 *uwrq,
+       char *extra
+)
+{
+       int error, infra = 0, ap = 0;
+
+       WL_TRACE(("%s: SIOCGIWMODE\n", dev->name));
+
+       if ((error = dev_wlc_ioctl(dev, WLC_GET_INFRA, &infra, sizeof(infra))) ||
+           (error = dev_wlc_ioctl(dev, WLC_GET_AP, &ap, sizeof(ap))))
+               return error;
+
+       infra = dtoh32(infra);
+       ap = dtoh32(ap);
+       *uwrq = infra ? ap ? IW_MODE_MASTER : IW_MODE_INFRA : IW_MODE_ADHOC;
+
+       return 0;
+}
+
+static int
+wl_iw_get_range(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *dwrq,
+       char *extra
+)
+{
+       struct iw_range *range = (struct iw_range *) extra;
+       static int channels[MAXCHANNEL+1];
+       wl_uint32_list_t *list = (wl_uint32_list_t *) channels;
+       wl_rateset_t rateset;
+       int error, i, k;
+       uint sf, ch;
+
+       int phytype;
+       int bw_cap = 0, sgi_tx = 0, nmode = 0;
+       channel_info_t ci;
+       uint8 nrate_list2copy = 0;
+       uint16 nrate_list[4][8] = { {13, 26, 39, 52, 78, 104, 117, 130},
+               {14, 29, 43, 58, 87, 116, 130, 144},
+               {27, 54, 81, 108, 162, 216, 243, 270},
+               {30, 60, 90, 120, 180, 240, 270, 300}};
+       int fbt_cap = 0;
+
+       WL_TRACE(("%s: SIOCGIWRANGE\n", dev->name));
+
+       if (!extra)
+               return -EINVAL;
+
+       dwrq->length = sizeof(struct iw_range);
+       memset(range, 0, sizeof(*range));
+
+       /* We don't use nwids */
+       range->min_nwid = range->max_nwid = 0;
+
+       /* Set available channels/frequencies */
+       list->count = htod32(MAXCHANNEL);
+       if ((error = dev_wlc_ioctl(dev, WLC_GET_VALID_CHANNELS, channels, sizeof(channels))))
+               return error;
+       for (i = 0; i < dtoh32(list->count) && i < IW_MAX_FREQUENCIES; i++) {
+               range->freq[i].i = dtoh32(list->element[i]);
+
+               ch = dtoh32(list->element[i]);
+               if (ch <= CH_MAX_2G_CHANNEL)
+                       sf = WF_CHAN_FACTOR_2_4_G;
+               else
+                       sf = WF_CHAN_FACTOR_5_G;
+
+               range->freq[i].m = wf_channel2mhz(ch, sf);
+               range->freq[i].e = 6;
+       }
+       range->num_frequency = range->num_channels = i;
+
+       /* Link quality (use NDIS cutoffs) */
+       range->max_qual.qual = 5;
+       /* Signal level (use RSSI) */
+       range->max_qual.level = 0x100 - 200;    /* -200 dBm */
+       /* Noise level (use noise) */
+       range->max_qual.noise = 0x100 - 200;    /* -200 dBm */
+       /* Signal level threshold range (?) */
+       range->sensitivity = 65535;
+
+#if WIRELESS_EXT > 11
+       /* Link quality (use NDIS cutoffs) */
+       range->avg_qual.qual = 3;
+       /* Signal level (use RSSI) */
+       range->avg_qual.level = 0x100 + WL_IW_RSSI_GOOD;
+       /* Noise level (use noise) */
+       range->avg_qual.noise = 0x100 - 75;     /* -75 dBm */
+#endif /* WIRELESS_EXT > 11 */
+
+       /* Set available bitrates */
+       if ((error = dev_wlc_ioctl(dev, WLC_GET_CURR_RATESET, &rateset, sizeof(rateset))))
+               return error;
+       rateset.count = dtoh32(rateset.count);
+       range->num_bitrates = rateset.count;
+       for (i = 0; i < rateset.count && i < IW_MAX_BITRATES; i++)
+               range->bitrate[i] = (rateset.rates[i] & 0x7f) * 500000; /* convert to bps */
+       if ((error = dev_wlc_intvar_get(dev, "nmode", &nmode)))
+               return error;
+       if ((error = dev_wlc_ioctl(dev, WLC_GET_PHYTYPE, &phytype, sizeof(phytype))))
+               return error;
+       if (nmode == 1 && (((phytype == WLC_PHY_TYPE_LCN) ||
+                           (phytype == WLC_PHY_TYPE_LCN40)))) {
+               if ((error = dev_wlc_intvar_get(dev, "mimo_bw_cap", &bw_cap)))
+                       return error;
+               if ((error = dev_wlc_intvar_get(dev, "sgi_tx", &sgi_tx)))
+                       return error;
+               if ((error = dev_wlc_ioctl(dev, WLC_GET_CHANNEL, &ci, sizeof(channel_info_t))))
+                       return error;
+               ci.hw_channel = dtoh32(ci.hw_channel);
+
+               if (bw_cap == 0 ||
+                       (bw_cap == 2 && ci.hw_channel <= 14)) {
+                       if (sgi_tx == 0)
+                               nrate_list2copy = 0;
+                       else
+                               nrate_list2copy = 1;
+               }
+               if (bw_cap == 1 ||
+                       (bw_cap == 2 && ci.hw_channel >= 36)) {
+                       if (sgi_tx == 0)
+                               nrate_list2copy = 2;
+                       else
+                               nrate_list2copy = 3;
+               }
+               range->num_bitrates += 8;
+               ASSERT(range->num_bitrates < IW_MAX_BITRATES);
+               for (k = 0; i < range->num_bitrates; k++, i++) {
+                       /* convert to bps */
+                       range->bitrate[i] = (nrate_list[nrate_list2copy][k]) * 500000;
+               }
+       }
+
+       /* Set an indication of the max TCP throughput
+        * in bit/s that we can expect using this interface.
+        * May be use for QoS stuff... Jean II
+        */
+       if ((error = dev_wlc_ioctl(dev, WLC_GET_PHYTYPE, &i, sizeof(i))))
+               return error;
+       i = dtoh32(i);
+       if (i == WLC_PHY_TYPE_A)
+               range->throughput = 24000000;   /* 24 Mbits/s */
+       else
+               range->throughput = 1500000;    /* 1.5 Mbits/s */
+
+       /* RTS and fragmentation thresholds */
+       range->min_rts = 0;
+       range->max_rts = 2347;
+       range->min_frag = 256;
+       range->max_frag = 2346;
+
+       range->max_encoding_tokens = DOT11_MAX_DEFAULT_KEYS;
+       range->num_encoding_sizes = 4;
+       range->encoding_size[0] = WEP1_KEY_SIZE;
+       range->encoding_size[1] = WEP128_KEY_SIZE;
+#if WIRELESS_EXT > 17
+       range->encoding_size[2] = TKIP_KEY_SIZE;
+#else
+       range->encoding_size[2] = 0;
+#endif
+       range->encoding_size[3] = AES_KEY_SIZE;
+
+       /* Do not support power micro-management */
+       range->min_pmp = 0;
+       range->max_pmp = 0;
+       range->min_pmt = 0;
+       range->max_pmt = 0;
+       range->pmp_flags = 0;
+       range->pm_capa = 0;
+
+       /* Transmit Power - values are in mW */
+       range->num_txpower = 2;
+       range->txpower[0] = 1;
+       range->txpower[1] = 255;
+       range->txpower_capa = IW_TXPOW_MWATT;
+
+#if WIRELESS_EXT > 10
+       range->we_version_compiled = WIRELESS_EXT;
+       range->we_version_source = 19;
+
+       /* Only support retry limits */
+       range->retry_capa = IW_RETRY_LIMIT;
+       range->retry_flags = IW_RETRY_LIMIT;
+       range->r_time_flags = 0;
+       /* SRL and LRL limits */
+       range->min_retry = 1;
+       range->max_retry = 255;
+       /* Retry lifetime limits unsupported */
+       range->min_r_time = 0;
+       range->max_r_time = 0;
+#endif /* WIRELESS_EXT > 10 */
+
+#if WIRELESS_EXT > 17
+       range->enc_capa = IW_ENC_CAPA_WPA;
+       range->enc_capa |= IW_ENC_CAPA_CIPHER_TKIP;
+       range->enc_capa |= IW_ENC_CAPA_CIPHER_CCMP;
+       range->enc_capa |= IW_ENC_CAPA_WPA2;
+
+       /* Determine driver FBT capability. */
+       if (dev_wlc_intvar_get(dev, "fbt_cap", &fbt_cap) == 0) {
+               if (fbt_cap == WLC_FBT_CAP_DRV_4WAY_AND_REASSOC) {
+                       /* Tell the host (e.g. wpa_supplicant) to let driver do the handshake */
+                       range->enc_capa |= IW_ENC_CAPA_4WAY_HANDSHAKE;
+               }
+       }
+
+#ifdef BCMFW_ROAM_ENABLE_WEXT
+       /* Advertise firmware roam capability to the external supplicant */
+       range->enc_capa |= IW_ENC_CAPA_FW_ROAM_ENABLE;
+#endif /* BCMFW_ROAM_ENABLE_WEXT */
+
+       /* Event capability (kernel) */
+       IW_EVENT_CAPA_SET_KERNEL(range->event_capa);
+       /* Event capability (driver) */
+       IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWAP);
+       IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWSCAN);
+       IW_EVENT_CAPA_SET(range->event_capa, IWEVTXDROP);
+       IW_EVENT_CAPA_SET(range->event_capa, IWEVMICHAELMICFAILURE);
+       IW_EVENT_CAPA_SET(range->event_capa, IWEVASSOCREQIE);
+       IW_EVENT_CAPA_SET(range->event_capa, IWEVASSOCRESPIE);
+       IW_EVENT_CAPA_SET(range->event_capa, IWEVPMKIDCAND);
+
+#if WIRELESS_EXT >= 22 && defined(IW_SCAN_CAPA_ESSID)
+       /* FC7 wireless.h defines EXT 22 but doesn't define scan_capa bits */
+       range->scan_capa = IW_SCAN_CAPA_ESSID;
+#endif
+#endif /* WIRELESS_EXT > 17 */
+
+       return 0;
+}
+
+#ifndef WL_ESCAN
+static int
+rssi_to_qual(int rssi)
+{
+       if (rssi <= WL_IW_RSSI_NO_SIGNAL)
+               return 0;
+       else if (rssi <= WL_IW_RSSI_VERY_LOW)
+               return 1;
+       else if (rssi <= WL_IW_RSSI_LOW)
+               return 2;
+       else if (rssi <= WL_IW_RSSI_GOOD)
+               return 3;
+       else if (rssi <= WL_IW_RSSI_VERY_GOOD)
+               return 4;
+       else
+               return 5;
+}
+#endif /* WL_ESCAN */
+
+static int
+wl_iw_set_spy(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *dwrq,
+       char *extra
+)
+{
+       wl_iw_t *iw = IW_DEV_IF(dev);
+       struct sockaddr *addr = (struct sockaddr *) extra;
+       int i;
+
+       WL_TRACE(("%s: SIOCSIWSPY\n", dev->name));
+
+       if (!extra)
+               return -EINVAL;
+
+       iw->spy_num = MIN(ARRAYSIZE(iw->spy_addr), dwrq->length);
+       for (i = 0; i < iw->spy_num; i++)
+               memcpy(&iw->spy_addr[i], addr[i].sa_data, ETHER_ADDR_LEN);
+       memset(iw->spy_qual, 0, sizeof(iw->spy_qual));
+
+       return 0;
+}
+
+static int
+wl_iw_get_spy(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *dwrq,
+       char *extra
+)
+{
+       wl_iw_t *iw = IW_DEV_IF(dev);
+       struct sockaddr *addr = (struct sockaddr *) extra;
+       struct iw_quality *qual = (struct iw_quality *) &addr[iw->spy_num];
+       int i;
+
+       WL_TRACE(("%s: SIOCGIWSPY\n", dev->name));
+
+       if (!extra)
+               return -EINVAL;
+
+       dwrq->length = iw->spy_num;
+       for (i = 0; i < iw->spy_num; i++) {
+               memcpy(addr[i].sa_data, &iw->spy_addr[i], ETHER_ADDR_LEN);
+               addr[i].sa_family = AF_UNIX;
+               memcpy(&qual[i], &iw->spy_qual[i], sizeof(struct iw_quality));
+               iw->spy_qual[i].updated = 0;
+       }
+
+       return 0;
+}
+
+static int
+wl_iw_set_wap(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct sockaddr *awrq,
+       char *extra
+)
+{
+       int error = -EINVAL;
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       wl_wext_info_t *wext_info = NULL;
+
+       WL_TRACE(("%s: SIOCSIWAP\n", dev->name));
+       DHD_CHECK(dhd, dev);
+       wext_info = dhd->wext_info;
+       if (awrq->sa_family != ARPHRD_ETHER) {
+               WL_ERROR(("Invalid Header...sa_family\n"));
+               return -EINVAL;
+       }
+
+       /* Ignore "auto" or "off" */
+       if (ETHER_ISBCAST(awrq->sa_data) || ETHER_ISNULLADDR(awrq->sa_data)) {
+               scb_val_t scbval;
+               bzero(&scbval, sizeof(scb_val_t));
+               WL_MSG(dev->name, "WLC_DISASSOC\n");
+               if ((error = dev_wlc_ioctl(dev, WLC_DISASSOC, &scbval, sizeof(scb_val_t)))) {
+                       WL_ERROR(("WLC_DISASSOC failed (%d).\n", error));
+               }
+               wl_iw_update_connect_status(dev, WL_EXT_STATUS_DISCONNECTING);
+               return 0;
+       }
+       /* WL_ASSOC(("Assoc to %s\n", bcm_ether_ntoa((struct ether_addr *)&(awrq->sa_data),
+        * eabuf)));
+        */
+       /* Reassociate to the specified AP */
+       if (wext_info)
+               memcpy(&wext_info->conn_info.bssid, awrq->sa_data, ETHER_ADDR_LEN);
+       if (wext_info && wext_info->conn_info.ssid.SSID_len) {
+               if ((error = wl_ext_connect(dev, &wext_info->conn_info)))
+                       return error;
+       } else {
+               if ((error = dev_wlc_ioctl(dev, WLC_REASSOC, awrq->sa_data, ETHER_ADDR_LEN))) {
+                       WL_ERROR(("WLC_REASSOC failed (%d).\n", error));
+                       return error;
+               }
+               WL_MSG(dev->name, "join BSSID="MACSTR"\n", MAC2STR((u8 *)awrq->sa_data));
+       }
+       wl_iw_update_connect_status(dev, WL_EXT_STATUS_CONNECTING);
+
+       return 0;
+}
+
+static int
+wl_iw_get_wap(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct sockaddr *awrq,
+       char *extra
+)
+{
+       WL_TRACE(("%s: SIOCGIWAP\n", dev->name));
+
+       awrq->sa_family = ARPHRD_ETHER;
+       memset(awrq->sa_data, 0, ETHER_ADDR_LEN);
+
+       /* Ignore error (may be down or disassociated) */
+       (void) dev_wlc_ioctl(dev, WLC_GET_BSSID, awrq->sa_data, ETHER_ADDR_LEN);
+
+       return 0;
+}
+
+#if WIRELESS_EXT > 17
+static int
+wl_iw_mlme(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct sockaddr *awrq,
+       char *extra
+)
+{
+       struct iw_mlme *mlme;
+       scb_val_t scbval;
+       int error  = -EINVAL;
+
+       WL_TRACE(("%s: SIOCSIWMLME\n", dev->name));
+
+       mlme = (struct iw_mlme *)extra;
+       if (mlme == NULL) {
+               WL_ERROR(("Invalid ioctl data.\n"));
+               return error;
+       }
+
+       scbval.val = mlme->reason_code;
+       bcopy(&mlme->addr.sa_data, &scbval.ea, ETHER_ADDR_LEN);
+
+       if (mlme->cmd == IW_MLME_DISASSOC) {
+               scbval.val = htod32(scbval.val);
+               WL_MSG(dev->name, "WLC_DISASSOC\n");
+               error = dev_wlc_ioctl(dev, WLC_DISASSOC, &scbval, sizeof(scb_val_t));
+       }
+       else if (mlme->cmd == IW_MLME_DEAUTH) {
+               scbval.val = htod32(scbval.val);
+               WL_MSG(dev->name, "WLC_SCB_DEAUTHENTICATE_FOR_REASON\n");
+               error = dev_wlc_ioctl(dev, WLC_SCB_DEAUTHENTICATE_FOR_REASON, &scbval,
+                       sizeof(scb_val_t));
+       }
+       else {
+               WL_ERROR(("Invalid ioctl data.\n"));
+               return error;
+       }
+       wl_iw_update_connect_status(dev, WL_EXT_STATUS_DISCONNECTING);
+
+       return error;
+}
+#endif /* WIRELESS_EXT > 17 */
+
+#ifndef WL_ESCAN
+static int
+wl_iw_get_aplist(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *dwrq,
+       char *extra
+)
+{
+       wl_scan_results_t *list;
+       struct sockaddr *addr = (struct sockaddr *) extra;
+       struct iw_quality qual[IW_MAX_AP];
+       wl_bss_info_t *bi = NULL;
+       int error, i;
+       uint buflen = dwrq->length;
+       int16 rssi;
+
+       WL_TRACE(("%s: SIOCGIWAPLIST\n", dev->name));
+
+       if (!extra)
+               return -EINVAL;
+
+       /* Get scan results (too large to put on the stack) */
+       list = kmalloc(buflen, GFP_KERNEL);
+       if (!list)
+               return -ENOMEM;
+       memset(list, 0, buflen);
+       list->buflen = htod32(buflen);
+       if ((error = dev_wlc_ioctl(dev, WLC_SCAN_RESULTS, list, buflen))) {
+               WL_ERROR(("%d: Scan results error %d\n", __LINE__, error));
+               kfree(list);
+               return error;
+       }
+       list->buflen = dtoh32(list->buflen);
+       list->version = dtoh32(list->version);
+       list->count = dtoh32(list->count);
+       ASSERT(list->version == WL_BSS_INFO_VERSION);
+
+       for (i = 0, dwrq->length = 0; i < list->count && dwrq->length < IW_MAX_AP; i++) {
+               bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : list->bss_info;
+               ASSERT(((uintptr)bi + dtoh32(bi->length)) <= ((uintptr)list +
+                       buflen));
+
+               /* Infrastructure only */
+               if (!(dtoh16(bi->capability) & DOT11_CAP_ESS))
+                       continue;
+
+               /* BSSID */
+               memcpy(addr[dwrq->length].sa_data, &bi->BSSID, ETHER_ADDR_LEN);
+               addr[dwrq->length].sa_family = ARPHRD_ETHER;
+               // terence 20150419: limit the max. rssi to -2 or the bss will be filtered out in android OS
+               rssi = MIN(dtoh16(bi->RSSI), RSSI_MAXVAL);
+               qual[dwrq->length].qual = rssi_to_qual(rssi);
+               qual[dwrq->length].level = 0x100 + rssi;
+               qual[dwrq->length].noise = 0x100 + bi->phy_noise;
+
+               /* Updated qual, level, and noise */
+#if WIRELESS_EXT > 18
+               qual[dwrq->length].updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
+#else
+               qual[dwrq->length].updated = 7;
+#endif /* WIRELESS_EXT > 18 */
+
+               dwrq->length++;
+       }
+
+       kfree(list);
+
+       if (dwrq->length) {
+               memcpy(&addr[dwrq->length], qual, sizeof(struct iw_quality) * dwrq->length);
+               /* Provided qual */
+               dwrq->flags = 1;
+       }
+
+       return 0;
+}
+
+static int
+wl_iw_iscan_get_aplist(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *dwrq,
+       char *extra
+)
+{
+       wl_scan_results_t *list;
+       iscan_buf_t * buf;
+       iscan_info_t *iscan;
+
+       struct sockaddr *addr = (struct sockaddr *) extra;
+       struct iw_quality qual[IW_MAX_AP];
+       wl_bss_info_t *bi = NULL;
+       int i;
+       int16 rssi;
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       wl_wext_info_t *wext_info = NULL;
+
+       WL_TRACE(("%s: SIOCGIWAPLIST\n", dev->name));
+       DHD_CHECK(dhd, dev);
+       wext_info = dhd->wext_info;
+       iscan = &wext_info->iscan;
+
+       if (!extra)
+               return -EINVAL;
+
+       if ((!iscan) || (iscan->sysioc_pid < 0)) {
+               return wl_iw_get_aplist(dev, info, dwrq, extra);
+       }
+
+       buf = iscan->list_hdr;
+       /* Get scan results (too large to put on the stack) */
+       while (buf) {
+           list = &((wl_iscan_results_t*)buf->iscan_buf)->results;
+           ASSERT(list->version == WL_BSS_INFO_VERSION);
+
+           bi = NULL;
+       for (i = 0, dwrq->length = 0; i < list->count && dwrq->length < IW_MAX_AP; i++) {
+               bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : list->bss_info;
+               ASSERT(((uintptr)bi + dtoh32(bi->length)) <= ((uintptr)list +
+                       WLC_IW_ISCAN_MAXLEN));
+
+               /* Infrastructure only */
+               if (!(dtoh16(bi->capability) & DOT11_CAP_ESS))
+                       continue;
+
+               /* BSSID */
+               memcpy(addr[dwrq->length].sa_data, &bi->BSSID, ETHER_ADDR_LEN);
+               addr[dwrq->length].sa_family = ARPHRD_ETHER;
+               // terence 20150419: limit the max. rssi to -2 or the bss will be filtered out in android OS
+               rssi = MIN(dtoh16(bi->RSSI), RSSI_MAXVAL);
+               qual[dwrq->length].qual = rssi_to_qual(rssi);
+               qual[dwrq->length].level = 0x100 + rssi;
+               qual[dwrq->length].noise = 0x100 + bi->phy_noise;
+
+               /* Updated qual, level, and noise */
+#if WIRELESS_EXT > 18
+               qual[dwrq->length].updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
+#else
+               qual[dwrq->length].updated = 7;
+#endif /* WIRELESS_EXT > 18 */
+
+               dwrq->length++;
+           }
+           buf = buf->next;
+       }
+       if (dwrq->length) {
+               memcpy(&addr[dwrq->length], qual, sizeof(struct iw_quality) * dwrq->length);
+               /* Provided qual */
+               dwrq->flags = 1;
+       }
+
+       return 0;
+}
+#endif
+
+#if WIRELESS_EXT > 13
+#ifndef WL_ESCAN
+static int
+wl_iw_set_scan(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       union iwreq_data *wrqu,
+       char *extra
+)
+{
+       wlc_ssid_t ssid;
+
+       WL_TRACE(("%s: SIOCSIWSCAN\n", dev->name));
+
+       /* default Broadcast scan */
+       memset(&ssid, 0, sizeof(ssid));
+
+#if WIRELESS_EXT > 17
+       /* check for given essid */
+       if (wrqu->data.length == sizeof(struct iw_scan_req)) {
+               if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
+                       struct iw_scan_req *req = (struct iw_scan_req *)extra;
+                       ssid.SSID_len = MIN(sizeof(ssid.SSID), req->essid_len);
+                       memcpy(ssid.SSID, req->essid, ssid.SSID_len);
+                       ssid.SSID_len = htod32(ssid.SSID_len);
+               }
+       }
+#endif
+       /* Ignore error (most likely scan in progress) */
+       (void) dev_wlc_ioctl(dev, WLC_SCAN, &ssid, sizeof(ssid));
+
+       return 0;
+}
+#endif
+
+static int
+wl_iw_iscan_set_scan(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       union iwreq_data *wrqu,
+       char *extra
+)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       wl_wext_info_t *wext_info = NULL;
+       wlc_ssid_t ssid;
+#ifndef WL_ESCAN
+       iscan_info_t *iscan;
+#endif
+
+       DHD_CHECK(dhd, dev);
+       wext_info = dhd->wext_info;
+#ifdef WL_ESCAN
+       /* default Broadcast scan */
+       memset(&ssid, 0, sizeof(ssid));
+#if WIRELESS_EXT > 17
+       /* check for given essid */
+       if (wrqu->data.length == sizeof(struct iw_scan_req)) {
+               if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
+                       struct iw_scan_req *req = (struct iw_scan_req *)extra;
+                       ssid.SSID_len = MIN(sizeof(ssid.SSID), req->essid_len);
+                       memcpy(ssid.SSID, req->essid, ssid.SSID_len);
+                       ssid.SSID_len = htod32(ssid.SSID_len);
+               }
+       }
+#endif
+       return wl_escan_set_scan(dev, dhd, &ssid, 0, TRUE);
+#else
+       iscan = &wext_info->iscan;
+       WL_TRACE(("%s: SIOCSIWSCAN iscan=%p\n", dev->name, iscan));
+
+       /* use backup if our thread is not successful */
+       if ((!iscan) || (iscan->sysioc_pid < 0)) {
+               return wl_iw_set_scan(dev, info, wrqu, extra);
+       }
+       if (iscan->iscan_state == ISCAN_STATE_SCANING) {
+               return 0;
+       }
+
+       /* default Broadcast scan */
+       memset(&ssid, 0, sizeof(ssid));
+
+#if WIRELESS_EXT > 17
+       /* check for given essid */
+       if (wrqu->data.length == sizeof(struct iw_scan_req)) {
+               if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
+                       struct iw_scan_req *req = (struct iw_scan_req *)extra;
+                       ssid.SSID_len = MIN(sizeof(ssid.SSID), req->essid_len);
+                       memcpy(ssid.SSID, req->essid, ssid.SSID_len);
+                       ssid.SSID_len = htod32(ssid.SSID_len);
+               }
+       }
+#endif
+
+       iscan->list_cur = iscan->list_hdr;
+       iscan->iscan_state = ISCAN_STATE_SCANING;
+
+
+       wl_iw_set_event_mask(dev);
+       wl_iw_iscan(iscan, &ssid, WL_SCAN_ACTION_START);
+
+       iscan->timer.expires = jiffies + msecs_to_jiffies(iscan->timer_ms);
+       add_timer(&iscan->timer);
+       iscan->timer_on = 1;
+
+       return 0;
+#endif
+}
+
+#if WIRELESS_EXT > 17
+static bool
+ie_is_wpa_ie(uint8 **wpaie, uint8 **tlvs, int *tlvs_len)
+{
+/* Is this body of this tlvs entry a WPA entry? If */
+/* not update the tlvs buffer pointer/length */
+       uint8 *ie = *wpaie;
+
+       /* If the contents match the WPA_OUI and type=1 */
+       if ((ie[1] >= 6) &&
+               !bcmp((const void *)&ie[2], (const void *)(WPA_OUI "\x01"), 4)) {
+               return TRUE;
+       }
+
+       /* point to the next ie */
+       ie += ie[1] + 2;
+       /* calculate the length of the rest of the buffer */
+       *tlvs_len -= (int)(ie - *tlvs);
+       /* update the pointer to the start of the buffer */
+       *tlvs = ie;
+       return FALSE;
+}
+
+static bool
+ie_is_wps_ie(uint8 **wpsie, uint8 **tlvs, int *tlvs_len)
+{
+/* Is this body of this tlvs entry a WPS entry? If */
+/* not update the tlvs buffer pointer/length */
+       uint8 *ie = *wpsie;
+
+       /* If the contents match the WPA_OUI and type=4 */
+       if ((ie[1] >= 4) &&
+               !bcmp((const void *)&ie[2], (const void *)(WPA_OUI "\x04"), 4)) {
+               return TRUE;
+       }
+
+       /* point to the next ie */
+       ie += ie[1] + 2;
+       /* calculate the length of the rest of the buffer */
+       *tlvs_len -= (int)(ie - *tlvs);
+       /* update the pointer to the start of the buffer */
+       *tlvs = ie;
+       return FALSE;
+}
+#endif /* WIRELESS_EXT > 17 */
+
+#ifdef BCMWAPI_WPI
+static inline int _wpa_snprintf_hex(char *buf, size_t buf_size, const u8 *data,
+       size_t len, int uppercase)
+{
+       size_t i;
+       char *pos = buf, *end = buf + buf_size;
+       int ret;
+       if (buf_size == 0)
+               return 0;
+       for (i = 0; i < len; i++) {
+               ret = snprintf(pos, end - pos, uppercase ? "%02X" : "%02x",
+                       data[i]);
+               if (ret < 0 || ret >= end - pos) {
+                       end[-1] = '\0';
+                       return pos - buf;
+               }
+               pos += ret;
+       }
+       end[-1] = '\0';
+       return pos - buf;
+}
+
+/**
+ * wpa_snprintf_hex - Print data as a hex string into a buffer
+ * @buf: Memory area to use as the output buffer
+ * @buf_size: Maximum buffer size in bytes (should be at least 2 * len + 1)
+ * @data: Data to be printed
+ * @len: Length of data in bytes
+ * Returns: Number of bytes written
+ */
+static int
+wpa_snprintf_hex(char *buf, size_t buf_size, const u8 *data, size_t len)
+{
+       return _wpa_snprintf_hex(buf, buf_size, data, len, 0);
+}
+#endif /* BCMWAPI_WPI */
+
+#ifndef WL_ESCAN
+static
+#endif
+int
+wl_iw_handle_scanresults_ies(char **event_p, char *end,
+       struct iw_request_info *info, wl_bss_info_t *bi)
+{
+#if WIRELESS_EXT > 17
+       struct iw_event iwe;
+       char *event;
+#ifdef BCMWAPI_WPI
+       char *buf;
+       int custom_event_len;
+#endif
+
+       event = *event_p;
+       if (bi->ie_length) {
+               /* look for wpa/rsn ies in the ie list... */
+               bcm_tlv_t *ie;
+               uint8 *ptr = ((uint8 *)bi) + bi->ie_offset;
+               int ptr_len = bi->ie_length;
+
+               /* OSEN IE */
+               if ((ie = bcm_parse_tlvs(ptr, ptr_len, DOT11_MNG_VS_ID)) &&
+                       ie->len > WFA_OUI_LEN + 1 &&
+                       !bcmp((const void *)&ie->data[0], (const void *)WFA_OUI, WFA_OUI_LEN) &&
+                       ie->data[WFA_OUI_LEN] == WFA_OUI_TYPE_OSEN) {
+                       iwe.cmd = IWEVGENIE;
+                       iwe.u.data.length = ie->len + 2;
+                       event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)ie);
+               }
+               ptr = ((uint8 *)bi) + bi->ie_offset;
+
+               if ((ie = bcm_parse_tlvs(ptr, ptr_len, DOT11_MNG_RSN_ID))) {
+                       iwe.cmd = IWEVGENIE;
+                       iwe.u.data.length = ie->len + 2;
+                       event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)ie);
+               }
+               ptr = ((uint8 *)bi) + bi->ie_offset;
+
+               if ((ie = bcm_parse_tlvs(ptr, ptr_len, DOT11_MNG_MDIE_ID))) {
+                       iwe.cmd = IWEVGENIE;
+                       iwe.u.data.length = ie->len + 2;
+                       event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)ie);
+               }
+               ptr = ((uint8 *)bi) + bi->ie_offset;
+
+               while ((ie = bcm_parse_tlvs(ptr, ptr_len, DOT11_MNG_WPA_ID))) {
+                       /* look for WPS IE */
+                       if (ie_is_wps_ie(((uint8 **)&ie), &ptr, &ptr_len)) {
+                               iwe.cmd = IWEVGENIE;
+                               iwe.u.data.length = ie->len + 2;
+                               event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)ie);
+                               break;
+                       }
+               }
+
+               ptr = ((uint8 *)bi) + bi->ie_offset;
+               ptr_len = bi->ie_length;
+               while ((ie = bcm_parse_tlvs(ptr, ptr_len, DOT11_MNG_WPA_ID))) {
+                       if (ie_is_wpa_ie(((uint8 **)&ie), &ptr, &ptr_len)) {
+                               iwe.cmd = IWEVGENIE;
+                               iwe.u.data.length = ie->len + 2;
+                               event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)ie);
+                               break;
+                       }
+               }
+               
+#ifdef BCMWAPI_WPI
+               ptr = ((uint8 *)bi) + sizeof(wl_bss_info_t);
+               ptr_len = bi->ie_length;
+
+               while ((ie = bcm_parse_tlvs(ptr, ptr_len, DOT11_MNG_WAPI_ID))) {
+                       WL_TRACE(("found a WAPI IE...\n"));
+#ifdef WAPI_IE_USE_GENIE
+                       iwe.cmd = IWEVGENIE;
+                       iwe.u.data.length = ie->len + 2;
+                       event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)ie);
+#else /* using CUSTOM event */
+                       iwe.cmd = IWEVCUSTOM;
+                       custom_event_len = strlen("wapi_ie=") + 2*(ie->len + 2);
+                       iwe.u.data.length = custom_event_len;
+
+                       buf = kmalloc(custom_event_len+1, GFP_KERNEL);
+                       if (buf == NULL)
+                       {
+                               WL_ERROR(("malloc(%d) returned NULL...\n", custom_event_len));
+                               break;
+                       }
+
+                       memcpy(buf, "wapi_ie=", 8);
+                       wpa_snprintf_hex(buf + 8, 2+1, &(ie->id), 1);
+                       wpa_snprintf_hex(buf + 10, 2+1, &(ie->len), 1);
+                       wpa_snprintf_hex(buf + 12, 2*ie->len+1, ie->data, ie->len);
+                       event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, buf);
+                       kfree(buf);
+#endif /* WAPI_IE_USE_GENIE */
+                       break;
+               }
+#endif /* BCMWAPI_WPI */
+               *event_p = event;
+       }
+
+#endif /* WIRELESS_EXT > 17 */
+       return 0;
+}
+
+#ifndef WL_ESCAN
+static int
+wl_iw_get_scan(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *dwrq,
+       char *extra
+)
+{
+       channel_info_t ci;
+       wl_scan_results_t *list;
+       struct iw_event iwe;
+       wl_bss_info_t *bi = NULL;
+       int error, i, j;
+       char *event = extra, *end = extra + dwrq->length, *value;
+       uint buflen = dwrq->length;
+       int16 rssi;
+       int channel;
+
+       WL_TRACE(("%s SIOCGIWSCAN\n", dev->name));
+
+       if (!extra)
+               return -EINVAL;
+
+       /* Check for scan in progress */
+       if ((error = dev_wlc_ioctl(dev, WLC_GET_CHANNEL, &ci, sizeof(ci))))
+               return error;
+       ci.scan_channel = dtoh32(ci.scan_channel);
+       if (ci.scan_channel)
+               return -EAGAIN;
+
+       /* Get scan results (too large to put on the stack) */
+       list = kmalloc(buflen, GFP_KERNEL);
+       if (!list)
+               return -ENOMEM;
+       memset(list, 0, buflen);
+       list->buflen = htod32(buflen);
+       if ((error = dev_wlc_ioctl(dev, WLC_SCAN_RESULTS, list, buflen))) {
+               kfree(list);
+               return error;
+       }
+       list->buflen = dtoh32(list->buflen);
+       list->version = dtoh32(list->version);
+       list->count = dtoh32(list->count);
+
+       ASSERT(list->version == WL_BSS_INFO_VERSION);
+
+       for (i = 0; i < list->count && i < IW_MAX_AP; i++) {
+               bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : list->bss_info;
+               ASSERT(((uintptr)bi + dtoh32(bi->length)) <= ((uintptr)list +
+                       buflen));
+
+               // terence 20150419: limit the max. rssi to -2 or the bss will be filtered out in android OS
+               rssi = MIN(dtoh16(bi->RSSI), RSSI_MAXVAL);
+               channel = (bi->ctl_ch == 0) ? CHSPEC_CHANNEL(bi->chanspec) : bi->ctl_ch;
+               WL_SCAN(("BSSID="MACSTR", channel=%d, RSSI=%d, SSID=\"%s\"\n",
+                       MAC2STR(bi->BSSID.octet), channel, rssi, bi->SSID));
+
+               /* First entry must be the BSSID */
+               iwe.cmd = SIOCGIWAP;
+               iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+               memcpy(iwe.u.ap_addr.sa_data, &bi->BSSID, ETHER_ADDR_LEN);
+               event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_ADDR_LEN);
+
+               /* SSID */
+               iwe.u.data.length = dtoh32(bi->SSID_len);
+               iwe.cmd = SIOCGIWESSID;
+               iwe.u.data.flags = 1;
+               event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, bi->SSID);
+
+               /* Mode */
+               if (dtoh16(bi->capability) & (DOT11_CAP_ESS | DOT11_CAP_IBSS)) {
+                       iwe.cmd = SIOCGIWMODE;
+                       if (dtoh16(bi->capability) & DOT11_CAP_ESS)
+                               iwe.u.mode = IW_MODE_INFRA;
+                       else
+                               iwe.u.mode = IW_MODE_ADHOC;
+                       event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_UINT_LEN);
+               }
+
+               /* Channel */
+               iwe.cmd = SIOCGIWFREQ;
+
+               iwe.u.freq.m = wf_channel2mhz(CHSPEC_CHANNEL(bi->chanspec),
+                       (CHSPEC_IS2G(bi->chanspec)) ?
+                       WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G);
+               iwe.u.freq.e = 6;
+               event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_FREQ_LEN);
+
+               /* Channel quality */
+               iwe.cmd = IWEVQUAL;
+               iwe.u.qual.qual = rssi_to_qual(rssi);
+               iwe.u.qual.level = 0x100 + rssi;
+               iwe.u.qual.noise = 0x100 + bi->phy_noise;
+               event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_QUAL_LEN);
+
+                wl_iw_handle_scanresults_ies(&event, end, info, bi);
+
+               /* Encryption */
+               iwe.cmd = SIOCGIWENCODE;
+               if (dtoh16(bi->capability) & DOT11_CAP_PRIVACY)
+                       iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+               else
+                       iwe.u.data.flags = IW_ENCODE_DISABLED;
+               iwe.u.data.length = 0;
+               event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)event);
+
+               /* Rates */
+               if (bi->rateset.count) {
+                       value = event + IW_EV_LCP_LEN;
+                       iwe.cmd = SIOCGIWRATE;
+                       /* Those two flags are ignored... */
+                       iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+                       for (j = 0; j < bi->rateset.count && j < IW_MAX_BITRATES; j++) {
+                               iwe.u.bitrate.value = (bi->rateset.rates[j] & 0x7f) * 500000;
+                               value = IWE_STREAM_ADD_VALUE(info, event, value, end, &iwe,
+                                       IW_EV_PARAM_LEN);
+                       }
+                       event = value;
+               }
+       }
+
+       kfree(list);
+
+       dwrq->length = event - extra;
+       dwrq->flags = 0;        /* todo */
+
+       return 0;
+}
+#endif /* WL_ESCAN */
+
+static int
+wl_iw_iscan_get_scan(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *dwrq,
+       char *extra
+)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       wl_wext_info_t *wext_info = NULL;
+#ifndef WL_ESCAN
+       wl_scan_results_t *list;
+       struct iw_event iwe;
+       wl_bss_info_t *bi = NULL;
+       int ii, j;
+       int apcnt;
+       char *event = extra, *end = extra + dwrq->length, *value;
+       iscan_buf_t * p_buf;
+       int16 rssi;
+       int channel;
+       iscan_info_t *iscan;
+#endif
+
+       DHD_CHECK(dhd, dev);
+       wext_info = dhd->wext_info;
+#ifdef WL_ESCAN
+       return wl_escan_get_scan(dev, dhd, info, dwrq, extra);
+#else
+       WL_TRACE(("%s SIOCGIWSCAN\n", dev->name));
+
+       if (!extra)
+               return -EINVAL;
+
+       /* use backup if our thread is not successful */
+       iscan = &wext_info->iscan;
+       if ((!iscan) || (iscan->sysioc_pid < 0)) {
+               return wl_iw_get_scan(dev, info, dwrq, extra);
+       }
+
+       /* Check for scan in progress */
+       if (iscan->iscan_state == ISCAN_STATE_SCANING) {
+               WL_TRACE(("%s: SIOCGIWSCAN GET still scanning\n", dev->name));
+               return -EAGAIN;
+       }
+
+       apcnt = 0;
+       p_buf = iscan->list_hdr;
+       /* Get scan results */
+       while (p_buf != iscan->list_cur) {
+               list = &((wl_iscan_results_t*)p_buf->iscan_buf)->results;
+
+               if (list->version != WL_BSS_INFO_VERSION) {
+                       WL_ERROR(("list->version %d != WL_BSS_INFO_VERSION\n", list->version));
+               }
+
+               bi = NULL;
+               for (ii = 0; ii < list->count && apcnt < IW_MAX_AP; apcnt++, ii++) {
+                       bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : list->bss_info;
+                       ASSERT(((uintptr)bi + dtoh32(bi->length)) <= ((uintptr)list +
+                               WLC_IW_ISCAN_MAXLEN));
+
+                       /* overflow check cover fields before wpa IEs */
+                       if (event + ETHER_ADDR_LEN + bi->SSID_len + IW_EV_UINT_LEN + IW_EV_FREQ_LEN +
+                               IW_EV_QUAL_LEN >= end)
+                               return -E2BIG;
+
+                       // terence 20150419: limit the max. rssi to -2 or the bss will be filtered out in android OS
+                       rssi = MIN(dtoh16(bi->RSSI), RSSI_MAXVAL);
+                       channel = (bi->ctl_ch == 0) ? CHSPEC_CHANNEL(bi->chanspec) : bi->ctl_ch;
+                       WL_SCAN(("BSSID="MACSTR", channel=%d, RSSI=%d, SSID=\"%s\"\n",
+                               MAC2STR(bi->BSSID.octet), channel, rssi, bi->SSID));
+
+                       /* First entry must be the BSSID */
+                       iwe.cmd = SIOCGIWAP;
+                       iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+                       memcpy(iwe.u.ap_addr.sa_data, &bi->BSSID, ETHER_ADDR_LEN);
+                       event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_ADDR_LEN);
+
+                       /* SSID */
+                       iwe.u.data.length = dtoh32(bi->SSID_len);
+                       iwe.cmd = SIOCGIWESSID;
+                       iwe.u.data.flags = 1;
+                       event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, bi->SSID);
+
+                       /* Mode */
+                       if (dtoh16(bi->capability) & (DOT11_CAP_ESS | DOT11_CAP_IBSS)) {
+                               iwe.cmd = SIOCGIWMODE;
+                               if (dtoh16(bi->capability) & DOT11_CAP_ESS)
+                                       iwe.u.mode = IW_MODE_INFRA;
+                               else
+                                       iwe.u.mode = IW_MODE_ADHOC;
+                               event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_UINT_LEN);
+                       }
+
+                       /* Channel */
+                       iwe.cmd = SIOCGIWFREQ;
+                       iwe.u.freq.m = wf_channel2mhz(CHSPEC_CHANNEL(bi->chanspec),
+                               (CHSPEC_IS2G(bi->chanspec)) ?
+                               WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G);
+                       iwe.u.freq.e = 6;
+                       event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_FREQ_LEN);
+
+                       /* Channel quality */
+                       iwe.cmd = IWEVQUAL;
+                       iwe.u.qual.qual = rssi_to_qual(rssi);
+                       iwe.u.qual.level = 0x100 + rssi;
+                       iwe.u.qual.noise = 0x100 + bi->phy_noise;
+                       event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_QUAL_LEN);
+
+                       wl_iw_handle_scanresults_ies(&event, end, info, bi);
+
+                       /* Encryption */
+                       iwe.cmd = SIOCGIWENCODE;
+                       if (dtoh16(bi->capability) & DOT11_CAP_PRIVACY)
+                               iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+                       else
+                               iwe.u.data.flags = IW_ENCODE_DISABLED;
+                       iwe.u.data.length = 0;
+                       event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)event);
+
+                       /* Rates */
+                       if (bi->rateset.count <= sizeof(bi->rateset.rates)) {
+                               if (event + IW_MAX_BITRATES*IW_EV_PARAM_LEN >= end)
+                                       return -E2BIG;
+
+                               value = event + IW_EV_LCP_LEN;
+                               iwe.cmd = SIOCGIWRATE;
+                               /* Those two flags are ignored... */
+                               iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+                               for (j = 0; j < bi->rateset.count && j < IW_MAX_BITRATES; j++) {
+                                       iwe.u.bitrate.value = (bi->rateset.rates[j] & 0x7f) * 500000;
+                                       value = IWE_STREAM_ADD_VALUE(info, event, value, end, &iwe,
+                                               IW_EV_PARAM_LEN);
+                               }
+                               event = value;
+                       }
+               }
+               p_buf = p_buf->next;
+       } /* while (p_buf) */
+
+       dwrq->length = event - extra;
+       dwrq->flags = 0;        /* todo */
+       WL_SCAN(("apcnt=%d\n", apcnt));
+
+       return 0;
+#endif
+}
+#endif /* WIRELESS_EXT > 13 */
+
+
+static int
+wl_iw_set_essid(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *dwrq,
+       char *extra
+)
+{
+       wlc_ssid_t ssid;
+       int error;
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       wl_wext_info_t *wext_info = NULL;
+
+       WL_TRACE(("%s: SIOCSIWESSID\n", dev->name));
+       DHD_CHECK(dhd, dev);
+       wext_info = dhd->wext_info;
+
+       /* default Broadcast SSID */
+       memset(&ssid, 0, sizeof(ssid));
+       if (dwrq->length && extra) {
+#if WIRELESS_EXT > 20
+               ssid.SSID_len = MIN(sizeof(ssid.SSID), dwrq->length);
+#else
+               ssid.SSID_len = MIN(sizeof(ssid.SSID), dwrq->length-1);
+#endif
+               memcpy(ssid.SSID, extra, ssid.SSID_len);
+               ssid.SSID_len = htod32(ssid.SSID_len);
+
+               if (wext_info) {
+                       memcpy(wext_info->conn_info.ssid.SSID, ssid.SSID, ssid.SSID_len);
+                       wext_info->conn_info.ssid.SSID_len = ssid.SSID_len;
+               }
+               if (wext_info && memcmp(&ether_null, &wext_info->conn_info.bssid, ETHER_ADDR_LEN)) {
+                       if ((error = wl_ext_connect(dev, &wext_info->conn_info)))
+                               return error;
+               } else {
+                       if ((error = dev_wlc_ioctl(dev, WLC_SET_SSID, &ssid, sizeof(ssid)))) {
+                               WL_ERROR(("WLC_SET_SSID failed (%d).\n", error));
+                               return error;
+                       }
+                       WL_MSG(dev->name, "join SSID=\"%s\"\n", ssid.SSID);
+               }
+               wl_iw_update_connect_status(dev, WL_EXT_STATUS_CONNECTING);
+       }
+       /* If essid null then it is "iwconfig <interface> essid off" command */
+       else {
+               scb_val_t scbval;
+               bzero(&scbval, sizeof(scb_val_t));
+               WL_MSG(dev->name, "WLC_DISASSOC\n");
+               if ((error = dev_wlc_ioctl(dev, WLC_DISASSOC, &scbval, sizeof(scb_val_t)))) {
+                       WL_ERROR(("WLC_DISASSOC failed (%d).\n", error));
+                       return error;
+               }
+               wl_iw_update_connect_status(dev, WL_EXT_STATUS_DISCONNECTING);
+       }
+       return 0;
+}
+
+static int
+wl_iw_get_essid(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *dwrq,
+       char *extra
+)
+{
+       wlc_ssid_t ssid;
+       int error;
+
+       WL_TRACE(("%s: SIOCGIWESSID\n", dev->name));
+
+       if (!extra)
+               return -EINVAL;
+
+       if ((error = dev_wlc_ioctl(dev, WLC_GET_SSID, &ssid, sizeof(ssid)))) {
+               WL_ERROR(("Error getting the SSID %d\n", error));
+               return error;
+       }
+
+       ssid.SSID_len = dtoh32(ssid.SSID_len);
+
+       /* Max SSID length check */
+       if (ssid.SSID_len > IW_ESSID_MAX_SIZE) {
+               ssid.SSID_len = IW_ESSID_MAX_SIZE;
+       }
+
+       /* Get the current SSID */
+       memcpy(extra, ssid.SSID, ssid.SSID_len);
+
+       /* NULL terminating as length of extra buffer is IW_ESSID_MAX_SIZE ie 32 */
+       extra[IW_ESSID_MAX_SIZE] = '\0';
+
+       dwrq->length = ssid.SSID_len;
+
+       dwrq->flags = 1; /* active */
+
+       return 0;
+}
+
+static int
+wl_iw_set_nick(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *dwrq,
+       char *extra
+)
+{
+       wl_iw_t *iw = IW_DEV_IF(dev);
+       WL_TRACE(("%s: SIOCSIWNICKN\n", dev->name));
+
+       if (!extra)
+               return -EINVAL;
+
+       /* Check the size of the string */
+       if (dwrq->length > sizeof(iw->nickname))
+               return -E2BIG;
+
+       memcpy(iw->nickname, extra, dwrq->length);
+       iw->nickname[dwrq->length - 1] = '\0';
+
+       return 0;
+}
+
+static int
+wl_iw_get_nick(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *dwrq,
+       char *extra
+)
+{
+       wl_iw_t *iw = IW_DEV_IF(dev);
+       WL_TRACE(("%s: SIOCGIWNICKN\n", dev->name));
+
+       if (!extra)
+               return -EINVAL;
+
+       strcpy(extra, iw->nickname);
+       dwrq->length = strlen(extra) + 1;
+
+       return 0;
+}
+
+static int wl_iw_set_rate(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       wl_rateset_t rateset;
+       int error, rate, i, error_bg, error_a;
+
+       WL_TRACE(("%s: SIOCSIWRATE\n", dev->name));
+
+       /* Get current rateset */
+       if ((error = dev_wlc_ioctl(dev, WLC_GET_CURR_RATESET, &rateset, sizeof(rateset))))
+               return error;
+
+       rateset.count = dtoh32(rateset.count);
+
+       if (vwrq->value < 0) {
+               /* Select maximum rate */
+               rate = rateset.rates[rateset.count - 1] & 0x7f;
+       } else if (vwrq->value < rateset.count) {
+               /* Select rate by rateset index */
+               rate = rateset.rates[vwrq->value] & 0x7f;
+       } else {
+               /* Specified rate in bps */
+               rate = vwrq->value / 500000;
+       }
+
+       if (vwrq->fixed) {
+               /*
+                       Set rate override,
+                       Since the is a/b/g-blind, both a/bg_rate are enforced.
+               */
+               error_bg = dev_wlc_intvar_set(dev, "bg_rate", rate);
+               error_a = dev_wlc_intvar_set(dev, "a_rate", rate);
+
+               if (error_bg && error_a)
+                       return (error_bg | error_a);
+       } else {
+               /*
+                       clear rate override
+                       Since the is a/b/g-blind, both a/bg_rate are enforced.
+               */
+               /* 0 is for clearing rate override */
+               error_bg = dev_wlc_intvar_set(dev, "bg_rate", 0);
+               /* 0 is for clearing rate override */
+               error_a = dev_wlc_intvar_set(dev, "a_rate", 0);
+
+               if (error_bg && error_a)
+                       return (error_bg | error_a);
+
+               /* Remove rates above selected rate */
+               for (i = 0; i < rateset.count; i++)
+                       if ((rateset.rates[i] & 0x7f) > rate)
+                               break;
+               rateset.count = htod32(i);
+
+               /* Set current rateset */
+               if ((error = dev_wlc_ioctl(dev, WLC_SET_RATESET, &rateset, sizeof(rateset))))
+                       return error;
+       }
+
+       return 0;
+}
+
+static int wl_iw_get_rate(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       int error, rate;
+
+       WL_TRACE(("%s: SIOCGIWRATE\n", dev->name));
+
+       /* Report the current tx rate */
+       if ((error = dev_wlc_ioctl(dev, WLC_GET_RATE, &rate, sizeof(rate))))
+               return error;
+       rate = dtoh32(rate);
+       vwrq->value = rate * 500000;
+
+       return 0;
+}
+
+static int
+wl_iw_set_rts(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       int error, rts;
+
+       WL_TRACE(("%s: SIOCSIWRTS\n", dev->name));
+
+       if (vwrq->disabled)
+               rts = DOT11_DEFAULT_RTS_LEN;
+       else if (vwrq->value < 0 || vwrq->value > DOT11_DEFAULT_RTS_LEN)
+               return -EINVAL;
+       else
+               rts = vwrq->value;
+
+       if ((error = dev_wlc_intvar_set(dev, "rtsthresh", rts)))
+               return error;
+
+       return 0;
+}
+
+static int
+wl_iw_get_rts(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       int error, rts;
+
+       WL_TRACE(("%s: SIOCGIWRTS\n", dev->name));
+
+       if ((error = dev_wlc_intvar_get(dev, "rtsthresh", &rts)))
+               return error;
+
+       vwrq->value = rts;
+       vwrq->disabled = (rts >= DOT11_DEFAULT_RTS_LEN);
+       vwrq->fixed = 1;
+
+       return 0;
+}
+
+static int
+wl_iw_set_frag(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       int error, frag;
+
+       WL_TRACE(("%s: SIOCSIWFRAG\n", dev->name));
+
+       if (vwrq->disabled)
+               frag = DOT11_DEFAULT_FRAG_LEN;
+       else if (vwrq->value < 0 || vwrq->value > DOT11_DEFAULT_FRAG_LEN)
+               return -EINVAL;
+       else
+               frag = vwrq->value;
+
+       if ((error = dev_wlc_intvar_set(dev, "fragthresh", frag)))
+               return error;
+
+       return 0;
+}
+
+static int
+wl_iw_get_frag(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       int error, fragthreshold;
+
+       WL_TRACE(("%s: SIOCGIWFRAG\n", dev->name));
+
+       if ((error = dev_wlc_intvar_get(dev, "fragthresh", &fragthreshold)))
+               return error;
+
+       vwrq->value = fragthreshold;
+       vwrq->disabled = (fragthreshold >= DOT11_DEFAULT_FRAG_LEN);
+       vwrq->fixed = 1;
+
+       return 0;
+}
+
+static int
+wl_iw_set_txpow(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       int error, disable;
+       uint16 txpwrmw;
+       WL_TRACE(("%s: SIOCSIWTXPOW\n", dev->name));
+
+       /* Make sure radio is off or on as far as software is concerned */
+       disable = vwrq->disabled ? WL_RADIO_SW_DISABLE : 0;
+       disable += WL_RADIO_SW_DISABLE << 16;
+
+       disable = htod32(disable);
+       if ((error = dev_wlc_ioctl(dev, WLC_SET_RADIO, &disable, sizeof(disable))))
+               return error;
+
+       /* If Radio is off, nothing more to do */
+       if (disable & WL_RADIO_SW_DISABLE)
+               return 0;
+
+       /* Only handle mW */
+       if (!(vwrq->flags & IW_TXPOW_MWATT))
+               return -EINVAL;
+
+       /* Value < 0 means just "on" or "off" */
+       if (vwrq->value < 0)
+               return 0;
+
+       if (vwrq->value > 0xffff) txpwrmw = 0xffff;
+       else txpwrmw = (uint16)vwrq->value;
+
+
+       error = dev_wlc_intvar_set(dev, "qtxpower", (int)(bcm_mw_to_qdbm(txpwrmw)));
+       return error;
+}
+
+static int
+wl_iw_get_txpow(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       int error, disable, txpwrdbm;
+       uint8 result;
+
+       WL_TRACE(("%s: SIOCGIWTXPOW\n", dev->name));
+
+       if ((error = dev_wlc_ioctl(dev, WLC_GET_RADIO, &disable, sizeof(disable))) ||
+           (error = dev_wlc_intvar_get(dev, "qtxpower", &txpwrdbm)))
+               return error;
+
+       disable = dtoh32(disable);
+       result = (uint8)(txpwrdbm & ~WL_TXPWR_OVERRIDE);
+       vwrq->value = (int32)bcm_qdbm_to_mw(result);
+       vwrq->fixed = 0;
+       vwrq->disabled = (disable & (WL_RADIO_SW_DISABLE | WL_RADIO_HW_DISABLE)) ? 1 : 0;
+       vwrq->flags = IW_TXPOW_MWATT;
+
+       return 0;
+}
+
+#if WIRELESS_EXT > 10
+static int
+wl_iw_set_retry(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       int error, lrl, srl;
+
+       WL_TRACE(("%s: SIOCSIWRETRY\n", dev->name));
+
+       /* Do not handle "off" or "lifetime" */
+       if (vwrq->disabled || (vwrq->flags & IW_RETRY_LIFETIME))
+               return -EINVAL;
+
+       /* Handle "[min|max] limit" */
+       if (vwrq->flags & IW_RETRY_LIMIT) {
+               /* "max limit" or just "limit" */
+#if WIRELESS_EXT > 20
+               if ((vwrq->flags & IW_RETRY_LONG) ||(vwrq->flags & IW_RETRY_MAX) ||
+                       !((vwrq->flags & IW_RETRY_SHORT) || (vwrq->flags & IW_RETRY_MIN)))
+#else
+               if ((vwrq->flags & IW_RETRY_MAX) || !(vwrq->flags & IW_RETRY_MIN))
+#endif /* WIRELESS_EXT > 20 */
+               {
+                       lrl = htod32(vwrq->value);
+                       if ((error = dev_wlc_ioctl(dev, WLC_SET_LRL, &lrl, sizeof(lrl))))
+                               return error;
+               }
+               /* "min limit" or just "limit" */
+#if WIRELESS_EXT > 20
+               if ((vwrq->flags & IW_RETRY_SHORT) ||(vwrq->flags & IW_RETRY_MIN) ||
+                       !((vwrq->flags & IW_RETRY_LONG) || (vwrq->flags & IW_RETRY_MAX)))
+#else
+               if ((vwrq->flags & IW_RETRY_MIN) || !(vwrq->flags & IW_RETRY_MAX))
+#endif /* WIRELESS_EXT > 20 */
+               {
+                       srl = htod32(vwrq->value);
+                       if ((error = dev_wlc_ioctl(dev, WLC_SET_SRL, &srl, sizeof(srl))))
+                               return error;
+               }
+       }
+
+       return 0;
+}
+
+static int
+wl_iw_get_retry(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       int error, lrl, srl;
+
+       WL_TRACE(("%s: SIOCGIWRETRY\n", dev->name));
+
+       vwrq->disabled = 0;      /* Can't be disabled */
+
+       /* Do not handle lifetime queries */
+       if ((vwrq->flags & IW_RETRY_TYPE) == IW_RETRY_LIFETIME)
+               return -EINVAL;
+
+       /* Get retry limits */
+       if ((error = dev_wlc_ioctl(dev, WLC_GET_LRL, &lrl, sizeof(lrl))) ||
+           (error = dev_wlc_ioctl(dev, WLC_GET_SRL, &srl, sizeof(srl))))
+               return error;
+
+       lrl = dtoh32(lrl);
+       srl = dtoh32(srl);
+
+       /* Note : by default, display the min retry number */
+       if (vwrq->flags & IW_RETRY_MAX) {
+               vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
+               vwrq->value = lrl;
+       } else {
+               vwrq->flags = IW_RETRY_LIMIT;
+               vwrq->value = srl;
+               if (srl != lrl)
+                       vwrq->flags |= IW_RETRY_MIN;
+       }
+
+       return 0;
+}
+#endif /* WIRELESS_EXT > 10 */
+
+static int
+wl_iw_set_encode(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *dwrq,
+       char *extra
+)
+{
+       wl_wsec_key_t key;
+       int error, val, wsec;
+
+       WL_TRACE(("%s: SIOCSIWENCODE\n", dev->name));
+
+       memset(&key, 0, sizeof(key));
+
+       if ((dwrq->flags & IW_ENCODE_INDEX) == 0) {
+               /* Find the current key */
+               for (key.index = 0; key.index < DOT11_MAX_DEFAULT_KEYS; key.index++) {
+                       val = htod32(key.index);
+                       if ((error = dev_wlc_ioctl(dev, WLC_GET_KEY_PRIMARY, &val, sizeof(val))))
+                               return error;
+                       val = dtoh32(val);
+                       if (val)
+                               break;
+               }
+               /* Default to 0 */
+               if (key.index == DOT11_MAX_DEFAULT_KEYS)
+                       key.index = 0;
+       } else {
+               key.index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+               if (key.index >= DOT11_MAX_DEFAULT_KEYS)
+                       return -EINVAL;
+       }
+
+       /* Interpret "off" to mean no encryption */
+       wsec = (dwrq->flags & IW_ENCODE_DISABLED) ? 0 : WEP_ENABLED;
+
+       if ((error = dev_wlc_intvar_set(dev, "wsec", wsec)))
+               return error;
+
+       /* Old API used to pass a NULL pointer instead of IW_ENCODE_NOKEY */
+       if (!extra || !dwrq->length || (dwrq->flags & IW_ENCODE_NOKEY)) {
+               /* Just select a new current key */
+               val = htod32(key.index);
+               if ((error = dev_wlc_ioctl(dev, WLC_SET_KEY_PRIMARY, &val, sizeof(val))))
+                       return error;
+       } else {
+               key.len = dwrq->length;
+
+               if (dwrq->length > sizeof(key.data))
+                       return -EINVAL;
+
+               memcpy(key.data, extra, dwrq->length);
+
+               key.flags = WL_PRIMARY_KEY;
+               switch (key.len) {
+               case WEP1_KEY_SIZE:
+                       key.algo = CRYPTO_ALGO_WEP1;
+                       break;
+               case WEP128_KEY_SIZE:
+                       key.algo = CRYPTO_ALGO_WEP128;
+                       break;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 14)
+               case TKIP_KEY_SIZE:
+                       key.algo = CRYPTO_ALGO_TKIP;
+                       break;
+#endif
+               case AES_KEY_SIZE:
+                       key.algo = CRYPTO_ALGO_AES_CCM;
+                       break;
+               default:
+                       return -EINVAL;
+               }
+
+               /* Set the new key/index */
+               swap_key_from_BE(&key);
+               if ((error = dev_wlc_ioctl(dev, WLC_SET_KEY, &key, sizeof(key))))
+                       return error;
+       }
+
+       /* Interpret "restricted" to mean shared key authentication */
+       val = (dwrq->flags & IW_ENCODE_RESTRICTED) ? 1 : 0;
+       val = htod32(val);
+       if ((error = dev_wlc_ioctl(dev, WLC_SET_AUTH, &val, sizeof(val))))
+               return error;
+
+       return 0;
+}
+
+static int
+wl_iw_get_encode(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *dwrq,
+       char *extra
+)
+{
+       wl_wsec_key_t key;
+       int error, val, wsec, auth;
+
+       WL_TRACE(("%s: SIOCGIWENCODE\n", dev->name));
+
+       /* assure default values of zero for things we don't touch */
+       bzero(&key, sizeof(wl_wsec_key_t));
+
+       if ((dwrq->flags & IW_ENCODE_INDEX) == 0) {
+               /* Find the current key */
+               for (key.index = 0; key.index < DOT11_MAX_DEFAULT_KEYS; key.index++) {
+                       val = key.index;
+                       if ((error = dev_wlc_ioctl(dev, WLC_GET_KEY_PRIMARY, &val, sizeof(val))))
+                               return error;
+                       val = dtoh32(val);
+                       if (val)
+                               break;
+               }
+       } else
+               key.index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+
+       if (key.index >= DOT11_MAX_DEFAULT_KEYS)
+               key.index = 0;
+
+       /* Get info */
+
+       if ((error = dev_wlc_ioctl(dev, WLC_GET_WSEC, &wsec, sizeof(wsec))) ||
+           (error = dev_wlc_ioctl(dev, WLC_GET_AUTH, &auth, sizeof(auth))))
+               return error;
+
+       swap_key_to_BE(&key);
+
+       wsec = dtoh32(wsec);
+       auth = dtoh32(auth);
+       /* Get key length */
+       dwrq->length = MIN(IW_ENCODING_TOKEN_MAX, key.len);
+
+       /* Get flags */
+       dwrq->flags = key.index + 1;
+       if (!(wsec & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED))) {
+               /* Interpret "off" to mean no encryption */
+               dwrq->flags |= IW_ENCODE_DISABLED;
+       }
+       if (auth) {
+               /* Interpret "restricted" to mean shared key authentication */
+               dwrq->flags |= IW_ENCODE_RESTRICTED;
+       }
+
+       /* Get key */
+       if (dwrq->length && extra)
+               memcpy(extra, key.data, dwrq->length);
+
+       return 0;
+}
+
+static int
+wl_iw_set_power(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       int error, pm;
+
+       WL_TRACE(("%s: SIOCSIWPOWER\n", dev->name));
+
+       pm = vwrq->disabled ? PM_OFF : PM_MAX;
+
+       pm = htod32(pm);
+       if ((error = dev_wlc_ioctl(dev, WLC_SET_PM, &pm, sizeof(pm))))
+               return error;
+
+       return 0;
+}
+
+static int
+wl_iw_get_power(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       int error, pm;
+
+       WL_TRACE(("%s: SIOCGIWPOWER\n", dev->name));
+
+       if ((error = dev_wlc_ioctl(dev, WLC_GET_PM, &pm, sizeof(pm))))
+               return error;
+
+       pm = dtoh32(pm);
+       vwrq->disabled = pm ? 0 : 1;
+       vwrq->flags = IW_POWER_ALL_R;
+
+       return 0;
+}
+
+#if WIRELESS_EXT > 17
+static int
+wl_iw_set_wpaie(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *iwp,
+       char *extra
+)
+{
+#if defined(BCMWAPI_WPI)
+       uchar buf[WLC_IOCTL_SMLEN] = {0};
+       uchar *p = buf;
+       int wapi_ie_size;
+
+       WL_TRACE(("%s: SIOCSIWGENIE\n", dev->name));
+
+       if (extra[0] == DOT11_MNG_WAPI_ID)
+       {
+               wapi_ie_size = iwp->length;
+               memcpy(p, extra, iwp->length);
+               dev_wlc_bufvar_set(dev, "wapiie", buf, wapi_ie_size);
+       }
+       else
+#endif
+               dev_wlc_bufvar_set(dev, "wpaie", extra, iwp->length);
+
+       return 0;
+}
+
+static int
+wl_iw_get_wpaie(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *iwp,
+       char *extra
+)
+{
+       WL_TRACE(("%s: SIOCGIWGENIE\n", dev->name));
+       iwp->length = 64;
+       dev_wlc_bufvar_get(dev, "wpaie", extra, iwp->length);
+       return 0;
+}
+
+static int
+wl_iw_set_encodeext(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_point *dwrq,
+       char *extra
+)
+{
+       wl_wsec_key_t key;
+       int error;
+       struct iw_encode_ext *iwe;
+
+       WL_TRACE(("%s: SIOCSIWENCODEEXT\n", dev->name));
+
+       memset(&key, 0, sizeof(key));
+       iwe = (struct iw_encode_ext *)extra;
+
+       /* disable encryption completely  */
+       if (dwrq->flags & IW_ENCODE_DISABLED) {
+
+       }
+
+       /* get the key index */
+       key.index = 0;
+       if (dwrq->flags & IW_ENCODE_INDEX)
+               key.index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+
+       key.len = iwe->key_len;
+
+       /* Instead of bcast for ea address for default wep keys, driver needs it to be Null */
+       if (!ETHER_ISMULTI(iwe->addr.sa_data))
+               bcopy((void *)&iwe->addr.sa_data, (char *)&key.ea, ETHER_ADDR_LEN);
+
+       /* check for key index change */
+       if (key.len == 0) {
+               if (iwe->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
+                       WL_WSEC(("Changing the the primary Key to %d\n", key.index));
+                       /* change the key index .... */
+                       key.index = htod32(key.index);
+                       error = dev_wlc_ioctl(dev, WLC_SET_KEY_PRIMARY,
+                               &key.index, sizeof(key.index));
+                       if (error)
+                               return error;
+               }
+               /* key delete */
+               else {
+                       swap_key_from_BE(&key);
+                       error = dev_wlc_ioctl(dev, WLC_SET_KEY, &key, sizeof(key));
+                       if (error)
+                               return error;
+               }
+       }
+       /* This case is used to allow an external 802.1x supplicant
+        * to pass the PMK to the in-driver supplicant for use in
+        * the 4-way handshake.
+        */
+       else if (iwe->alg == IW_ENCODE_ALG_PMK) {
+               int j;
+               wsec_pmk_t pmk;
+               char keystring[WSEC_MAX_PSK_LEN + 1];
+               char* charptr = keystring;
+               uint len;
+
+               /* copy the raw hex key to the appropriate format */
+               for (j = 0; j < (WSEC_MAX_PSK_LEN / 2); j++) {
+                       (void)snprintf(charptr, 3, "%02x", iwe->key[j]);
+                       charptr += 2;
+               }
+               len = strlen(keystring);
+               pmk.key_len = htod16(len);
+               bcopy(keystring, pmk.key, len);
+               pmk.flags = htod16(WSEC_PASSPHRASE);
+
+               WL_WSEC(("set key %s\n", keystring));
+               error = dev_wlc_ioctl(dev, WLC_SET_WSEC_PMK, &pmk, sizeof(pmk));
+               if (error) {
+                       WL_ERROR(("WLC_SET_WSEC_PMK error %d\n", error));
+                       return error;
+               }
+       }
+
+       else {
+               if (iwe->key_len > sizeof(key.data))
+                       return -EINVAL;
+
+               WL_WSEC(("Setting the key index %d\n", key.index));
+               if (iwe->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
+                       WL_WSEC(("key is a Primary Key\n"));
+                       key.flags = WL_PRIMARY_KEY;
+               }
+
+               bcopy((void *)iwe->key, key.data, iwe->key_len);
+
+               if (iwe->alg == IW_ENCODE_ALG_TKIP) {
+                       uint8 keybuf[8];
+                       bcopy(&key.data[24], keybuf, sizeof(keybuf));
+                       bcopy(&key.data[16], &key.data[24], sizeof(keybuf));
+                       bcopy(keybuf, &key.data[16], sizeof(keybuf));
+               }
+
+               /* rx iv */
+               if (iwe->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
+                       uchar *ivptr;
+                       ivptr = (uchar *)iwe->rx_seq;
+                       key.rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
+                               (ivptr[3] << 8) | ivptr[2];
+                       key.rxiv.lo = (ivptr[1] << 8) | ivptr[0];
+                       key.iv_initialized = TRUE;
+               }
+
+               switch (iwe->alg) {
+                       case IW_ENCODE_ALG_NONE:
+                               key.algo = CRYPTO_ALGO_OFF;
+                               break;
+                       case IW_ENCODE_ALG_WEP:
+                               if (iwe->key_len == WEP1_KEY_SIZE)
+                                       key.algo = CRYPTO_ALGO_WEP1;
+                               else
+                                       key.algo = CRYPTO_ALGO_WEP128;
+                               break;
+                       case IW_ENCODE_ALG_TKIP:
+                               key.algo = CRYPTO_ALGO_TKIP;
+                               break;
+                       case IW_ENCODE_ALG_CCMP:
+                               key.algo = CRYPTO_ALGO_AES_CCM;
+                               break;
+#ifdef BCMWAPI_WPI
+                       case IW_ENCODE_ALG_SM4:
+                               key.algo = CRYPTO_ALGO_SMS4;
+                               if (iwe->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
+                                       key.flags &= ~WL_PRIMARY_KEY;
+                               }
+                               break;
+#endif
+                       default:
+                               break;
+               }
+               swap_key_from_BE(&key);
+
+               dhd_wait_pend8021x(dev);
+
+               error = dev_wlc_ioctl(dev, WLC_SET_KEY, &key, sizeof(key));
+               if (error)
+                       return error;
+               wl_iw_update_connect_status(dev, WL_EXT_STATUS_ADD_KEY);
+       }
+       return 0;
+}
+
+/* wpa2 pmk list */
+static int
+wl_iw_set_pmksa(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       struct pmk_list *pmk_list = NULL;
+       struct iw_pmksa *iwpmksa;
+       uint i;
+       char eabuf[ETHER_ADDR_STR_LEN];
+       pmkid_t *pmkid_array = NULL;
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       wl_wext_info_t *wext_info = NULL;
+
+       WL_TRACE(("%s: SIOCSIWPMKSA\n", dev->name));
+       DHD_CHECK(dhd, dev);
+       wext_info = dhd->wext_info;
+       pmk_list = &wext_info->pmk_list;
+       if (pmk_list)
+               pmkid_array = pmk_list->pmkids.pmkid;
+       iwpmksa = (struct iw_pmksa *)extra;
+       bzero((char *)eabuf, ETHER_ADDR_STR_LEN);
+       if (iwpmksa->cmd == IW_PMKSA_FLUSH) {
+               WL_TRACE(("wl_iw_set_pmksa - IW_PMKSA_FLUSH\n"));
+               bzero((char *)pmk_list, sizeof(struct pmk_list));
+       }
+       if (iwpmksa->cmd == IW_PMKSA_REMOVE) {
+               pmkid_list_t pmkid, *pmkidptr;
+               pmkidptr = &pmkid;
+               bcopy(&iwpmksa->bssid.sa_data[0], &pmkidptr->pmkid[0].BSSID, ETHER_ADDR_LEN);
+               bcopy(&iwpmksa->pmkid[0], &pmkidptr->pmkid[0].PMKID, WPA2_PMKID_LEN);
+               {
+                       uint j;
+                       WL_TRACE(("wl_iw_set_pmksa,IW_PMKSA_REMOVE - PMKID: %s = ",
+                               bcm_ether_ntoa(&pmkidptr->pmkid[0].BSSID,
+                               eabuf)));
+                       for (j = 0; j < WPA2_PMKID_LEN; j++)
+                               WL_TRACE(("%02x ", pmkidptr->pmkid[0].PMKID[j]));
+                       WL_TRACE(("\n"));
+               }
+               for (i = 0; i < pmk_list->pmkids.npmkid; i++)
+                       if (!bcmp(&iwpmksa->bssid.sa_data[0], &pmkid_array[i].BSSID,
+                               ETHER_ADDR_LEN))
+                               break;
+               for (; i < pmk_list->pmkids.npmkid; i++) {
+                       bcopy(&pmkid_array[i+1].BSSID,
+                               &pmkid_array[i].BSSID,
+                               ETHER_ADDR_LEN);
+                       bcopy(&pmkid_array[i+1].PMKID,
+                               &pmkid_array[i].PMKID,
+                               WPA2_PMKID_LEN);
+               }
+               pmk_list->pmkids.npmkid--;
+       }
+       if (iwpmksa->cmd == IW_PMKSA_ADD) {
+               bcopy(&iwpmksa->bssid.sa_data[0],
+                       &pmkid_array[pmk_list->pmkids.npmkid].BSSID,
+                       ETHER_ADDR_LEN);
+               bcopy(&iwpmksa->pmkid[0], &pmkid_array[pmk_list->pmkids.npmkid].PMKID,
+                       WPA2_PMKID_LEN);
+               {
+                       uint j;
+                       uint k;
+                       k = pmk_list->pmkids.npmkid;
+                       BCM_REFERENCE(k);
+                       WL_TRACE(("wl_iw_set_pmksa,IW_PMKSA_ADD - PMKID: %s = ",
+                               bcm_ether_ntoa(&pmkid_array[k].BSSID,
+                               eabuf)));
+                       for (j = 0; j < WPA2_PMKID_LEN; j++)
+                               WL_TRACE(("%02x ", pmkid_array[k].PMKID[j]));
+                       WL_TRACE(("\n"));
+               }
+               pmk_list->pmkids.npmkid++;
+       }
+       WL_TRACE(("PRINTING pmkid LIST - No of elements %d\n", pmk_list->pmkids.npmkid));
+       for (i = 0; i < pmk_list->pmkids.npmkid; i++) {
+               uint j;
+               WL_TRACE(("PMKID[%d]: %s = ", i,
+                       bcm_ether_ntoa(&pmkid_array[i].BSSID,
+                       eabuf)));
+               for (j = 0; j < WPA2_PMKID_LEN; j++)
+                       WL_TRACE(("%02x ", pmkid_array[i].PMKID[j]));
+               printf("\n");
+       }
+       dev_wlc_bufvar_set(dev, "pmkid_info", (char *)pmk_list, sizeof(struct pmk_list));
+       return 0;
+}
+
+static int
+wl_iw_get_encodeext(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       WL_TRACE(("%s: SIOCGIWENCODEEXT\n", dev->name));
+       return 0;
+}
+
+static int
+wl_iw_set_wpaauth(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       int error = 0;
+       int paramid;
+       int paramval;
+       uint32 cipher_combined;
+       int val = 0;
+       wl_iw_t *iw = IW_DEV_IF(dev);
+
+       WL_TRACE(("%s: SIOCSIWAUTH\n", dev->name));
+
+       paramid = vwrq->flags & IW_AUTH_INDEX;
+       paramval = vwrq->value;
+
+       WL_TRACE(("%s: SIOCSIWAUTH, paramid = 0x%0x, paramval = 0x%0x\n",
+               dev->name, paramid, paramval));
+
+       switch (paramid) {
+
+       case IW_AUTH_WPA_VERSION:
+               /* supported wpa version disabled or wpa or wpa2 */
+               if (paramval & IW_AUTH_WPA_VERSION_DISABLED)
+                       val = WPA_AUTH_DISABLED;
+               else if (paramval & (IW_AUTH_WPA_VERSION_WPA))
+                       val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
+               else if (paramval & IW_AUTH_WPA_VERSION_WPA2)
+                       val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
+#ifdef BCMWAPI_WPI
+               else if (paramval & IW_AUTH_WAPI_VERSION_1)
+                       val = WAPI_AUTH_UNSPECIFIED;
+#endif
+               WL_TRACE(("%d: setting wpa_auth to 0x%0x\n", __LINE__, val));
+               if ((error = dev_wlc_intvar_set(dev, "wpa_auth", val)))
+                       return error;
+               break;
+
+       case IW_AUTH_CIPHER_PAIRWISE:
+       case IW_AUTH_CIPHER_GROUP: {
+               int fbt_cap = 0;
+
+               if (paramid == IW_AUTH_CIPHER_PAIRWISE) {
+                       iw->pwsec = paramval;
+               }
+               else {
+                       iw->gwsec = paramval;
+               }
+
+               if ((error = dev_wlc_intvar_get(dev, "wsec", &val))) {
+                       WL_ERROR(("wsec error %d\n", error));
+                       return error;
+               }
+               WL_WSEC(("get wsec=0x%x\n", val));
+
+               cipher_combined = iw->gwsec | iw->pwsec;
+               val &= ~(WEP_ENABLED | TKIP_ENABLED | AES_ENABLED);
+               if (cipher_combined & (IW_AUTH_CIPHER_WEP40 | IW_AUTH_CIPHER_WEP104))
+                       val |= WEP_ENABLED;
+               if (cipher_combined & IW_AUTH_CIPHER_TKIP)
+                       val |= TKIP_ENABLED;
+               if (cipher_combined & IW_AUTH_CIPHER_CCMP)
+                       val |= AES_ENABLED;
+#ifdef BCMWAPI_WPI
+               val &= ~SMS4_ENABLED;
+               if (cipher_combined & IW_AUTH_CIPHER_SMS4)
+                       val |= SMS4_ENABLED;
+#endif
+
+               if (iw->privacy_invoked && !val) {
+                       WL_WSEC(("%s: 'Privacy invoked' TRUE but clearing wsec, assuming "
+                                "we're a WPS enrollee\n", dev->name));
+                       if ((error = dev_wlc_intvar_set(dev, "is_WPS_enrollee", TRUE))) {
+                               WL_WSEC(("Failed to set iovar is_WPS_enrollee\n"));
+                               return error;
+                       }
+               } else if (val) {
+                       if ((error = dev_wlc_intvar_set(dev, "is_WPS_enrollee", FALSE))) {
+                               WL_WSEC(("Failed to clear iovar is_WPS_enrollee\n"));
+                               return error;
+                       }
+               }
+
+               WL_WSEC(("set wsec=0x%x\n", val));
+               if ((error = dev_wlc_intvar_set(dev, "wsec", val))) {
+                       WL_ERROR(("wsec error %d\n", error));
+                       return error;
+               }
+
+               /* Ensure in-dongle supplicant is turned on when FBT wants to do the 4-way
+                * handshake.
+                */
+               if (dev_wlc_intvar_get(dev, "fbt_cap", &fbt_cap) == 0) {
+                       WL_WSEC(("get fbt_cap=0x%x\n", fbt_cap));
+                       if (fbt_cap == WLC_FBT_CAP_DRV_4WAY_AND_REASSOC) {
+                               if ((paramid == IW_AUTH_CIPHER_PAIRWISE) && (val & AES_ENABLED)) {
+                                       if ((error = dev_wlc_intvar_set(dev, "sup_wpa", 1))) {
+                                               WL_ERROR(("sup_wpa 1 error %d\n", error));
+                                               return error;
+                                       }
+                               }
+                               else if (val == 0) {
+                                       if ((error = dev_wlc_intvar_set(dev, "sup_wpa", 0))) {
+                                               WL_ERROR(("sup_wpa 0 error %d\n", error));
+                                               return error;
+                                       }
+                               }
+                       }
+               }
+               break;
+       }
+
+       case IW_AUTH_KEY_MGMT:
+               if ((error = dev_wlc_intvar_get(dev, "wpa_auth", &val))) {
+                       WL_ERROR(("wpa_auth error %d\n", error));
+                       return error;
+               }
+               WL_WSEC(("get wpa_auth to %d\n", val));
+
+               if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
+                       if (paramval & (IW_AUTH_KEY_MGMT_FT_PSK | IW_AUTH_KEY_MGMT_PSK))
+                               val = WPA_AUTH_PSK;
+                       else
+                               val = WPA_AUTH_UNSPECIFIED;
+                       if (paramval & (IW_AUTH_KEY_MGMT_FT_802_1X | IW_AUTH_KEY_MGMT_FT_PSK))
+                               val |= WPA2_AUTH_FT;
+               }
+               else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
+                       if (paramval & (IW_AUTH_KEY_MGMT_FT_PSK | IW_AUTH_KEY_MGMT_PSK))
+                               val = WPA2_AUTH_PSK;
+                       else
+                               val = WPA2_AUTH_UNSPECIFIED;
+                       if (paramval & (IW_AUTH_KEY_MGMT_FT_802_1X | IW_AUTH_KEY_MGMT_FT_PSK))
+                               val |= WPA2_AUTH_FT;
+               }
+#ifdef BCMWAPI_WPI
+               if (paramval & (IW_AUTH_KEY_MGMT_WAPI_PSK | IW_AUTH_KEY_MGMT_WAPI_CERT))
+                       val = WAPI_AUTH_UNSPECIFIED;
+#endif
+               WL_TRACE(("%d: setting wpa_auth to %d\n", __LINE__, val));
+               if ((error = dev_wlc_intvar_set(dev, "wpa_auth", val)))
+                       return error;
+               break;
+
+       case IW_AUTH_TKIP_COUNTERMEASURES:
+               dev_wlc_bufvar_set(dev, "tkip_countermeasures", (char *)&paramval, 1);
+               break;
+
+       case IW_AUTH_80211_AUTH_ALG:
+               /* open shared */
+               WL_MSG(dev->name, "Setting the D11auth %d\n", paramval);
+               if (paramval & IW_AUTH_ALG_OPEN_SYSTEM)
+                       val = 0;
+               else if (paramval & IW_AUTH_ALG_SHARED_KEY)
+                       val = 1;
+               else
+                       error = 1;
+               if (!error && (error = dev_wlc_intvar_set(dev, "auth", val)))
+                       return error;
+               break;
+
+       case IW_AUTH_WPA_ENABLED:
+               if (paramval == 0) {
+                       val = 0;
+                       WL_TRACE(("%d: setting wpa_auth to %d\n", __LINE__, val));
+                       error = dev_wlc_intvar_set(dev, "wpa_auth", val);
+                       return error;
+               }
+               else {
+                       /* If WPA is enabled, wpa_auth is set elsewhere */
+               }
+               break;
+
+       case IW_AUTH_DROP_UNENCRYPTED:
+               dev_wlc_bufvar_set(dev, "wsec_restrict", (char *)&paramval, 1);
+               break;
+
+       case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+               dev_wlc_bufvar_set(dev, "rx_unencrypted_eapol", (char *)&paramval, 1);
+               break;
+
+#if WIRELESS_EXT > 17
+
+       case IW_AUTH_ROAMING_CONTROL:
+               WL_TRACE(("IW_AUTH_ROAMING_CONTROL\n"));
+               /* driver control or user space app control */
+               break;
+
+       case IW_AUTH_PRIVACY_INVOKED: {
+               int wsec;
+
+               if (paramval == 0) {
+                       iw->privacy_invoked = FALSE;
+                       if ((error = dev_wlc_intvar_set(dev, "is_WPS_enrollee", FALSE))) {
+                               WL_WSEC(("Failed to clear iovar is_WPS_enrollee\n"));
+                               return error;
+                       }
+               } else {
+                       iw->privacy_invoked = TRUE;
+                       if ((error = dev_wlc_intvar_get(dev, "wsec", &wsec)))
+                               return error;
+
+                       if (!WSEC_ENABLED(wsec)) {
+                               /* if privacy is true, but wsec is false, we are a WPS enrollee */
+                               if ((error = dev_wlc_intvar_set(dev, "is_WPS_enrollee", TRUE))) {
+                                       WL_WSEC(("Failed to set iovar is_WPS_enrollee\n"));
+                                       return error;
+                               }
+                       } else {
+                               if ((error = dev_wlc_intvar_set(dev, "is_WPS_enrollee", FALSE))) {
+                                       WL_WSEC(("Failed to clear iovar is_WPS_enrollee\n"));
+                                       return error;
+                               }
+                       }
+               }
+               break;
+       }
+
+
+#endif /* WIRELESS_EXT > 17 */
+
+#ifdef BCMWAPI_WPI
+
+       case IW_AUTH_WAPI_ENABLED:
+               if ((error = dev_wlc_intvar_get(dev, "wsec", &val)))
+                       return error;
+               if (paramval) {
+                       val |= SMS4_ENABLED;
+                       if ((error = dev_wlc_intvar_set(dev, "wsec", val))) {
+                               WL_ERROR(("setting wsec to 0x%0x returned error %d\n",
+                                       val, error));
+                               return error;
+                       }
+                       if ((error = dev_wlc_intvar_set(dev, "wpa_auth", WAPI_AUTH_UNSPECIFIED))) {
+                               WL_ERROR(("setting wpa_auth(%d) returned %d\n",
+                                       WAPI_AUTH_UNSPECIFIED,
+                                       error));
+                               return error;
+                       }
+               }
+
+               break;
+
+#endif /* BCMWAPI_WPI */
+
+       default:
+               break;
+       }
+       return 0;
+}
+#define VAL_PSK(_val) (((_val) & WPA_AUTH_PSK) || ((_val) & WPA2_AUTH_PSK))
+
+static int
+wl_iw_get_wpaauth(
+       struct net_device *dev,
+       struct iw_request_info *info,
+       struct iw_param *vwrq,
+       char *extra
+)
+{
+       int error;
+       int paramid;
+       int paramval = 0;
+       int val;
+       wl_iw_t *iw = IW_DEV_IF(dev);
+
+       WL_TRACE(("%s: SIOCGIWAUTH\n", dev->name));
+
+       paramid = vwrq->flags & IW_AUTH_INDEX;
+
+       switch (paramid) {
+       case IW_AUTH_WPA_VERSION:
+               /* supported wpa version disabled or wpa or wpa2 */
+               if ((error = dev_wlc_intvar_get(dev, "wpa_auth", &val)))
+                       return error;
+               if (val & (WPA_AUTH_NONE | WPA_AUTH_DISABLED))
+                       paramval = IW_AUTH_WPA_VERSION_DISABLED;
+               else if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED))
+                       paramval = IW_AUTH_WPA_VERSION_WPA;
+               else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED))
+                       paramval = IW_AUTH_WPA_VERSION_WPA2;
+               break;
+
+       case IW_AUTH_CIPHER_PAIRWISE:
+               paramval = iw->pwsec;
+               break;
+
+       case IW_AUTH_CIPHER_GROUP:
+               paramval = iw->gwsec;
+               break;
+
+       case IW_AUTH_KEY_MGMT:
+               /* psk, 1x */
+               if ((error = dev_wlc_intvar_get(dev, "wpa_auth", &val)))
+                       return error;
+               if (VAL_PSK(val))
+                       paramval = IW_AUTH_KEY_MGMT_PSK;
+               else
+                       paramval = IW_AUTH_KEY_MGMT_802_1X;
+
+               break;
+       case IW_AUTH_TKIP_COUNTERMEASURES:
+               dev_wlc_bufvar_get(dev, "tkip_countermeasures", (char *)&paramval, 1);
+               break;
+
+       case IW_AUTH_DROP_UNENCRYPTED:
+               dev_wlc_bufvar_get(dev, "wsec_restrict", (char *)&paramval, 1);
+               break;
+
+       case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+               dev_wlc_bufvar_get(dev, "rx_unencrypted_eapol", (char *)&paramval, 1);
+               break;
+
+       case IW_AUTH_80211_AUTH_ALG:
+               /* open, shared, leap */
+               if ((error = dev_wlc_intvar_get(dev, "auth", &val)))
+                       return error;
+               if (!val)
+                       paramval = IW_AUTH_ALG_OPEN_SYSTEM;
+               else
+                       paramval = IW_AUTH_ALG_SHARED_KEY;
+               break;
+       case IW_AUTH_WPA_ENABLED:
+               if ((error = dev_wlc_intvar_get(dev, "wpa_auth", &val)))
+                       return error;
+               if (val)
+                       paramval = TRUE;
+               else
+                       paramval = FALSE;
+               break;
+
+#if WIRELESS_EXT > 17
+
+       case IW_AUTH_ROAMING_CONTROL:
+               WL_ERROR(("IW_AUTH_ROAMING_CONTROL\n"));
+               /* driver control or user space app control */
+               break;
+
+       case IW_AUTH_PRIVACY_INVOKED:
+               paramval = iw->privacy_invoked;
+               break;
+
+#endif /* WIRELESS_EXT > 17 */
+       }
+       vwrq->value = paramval;
+       return 0;
+}
+#endif /* WIRELESS_EXT > 17 */
+
+static const iw_handler wl_iw_handler[] =
+{
+       (iw_handler) wl_iw_config_commit,       /* SIOCSIWCOMMIT */
+       (iw_handler) wl_iw_get_name,            /* SIOCGIWNAME */
+       (iw_handler) NULL,                      /* SIOCSIWNWID */
+       (iw_handler) NULL,                      /* SIOCGIWNWID */
+       (iw_handler) wl_iw_set_freq,            /* SIOCSIWFREQ */
+       (iw_handler) wl_iw_get_freq,            /* SIOCGIWFREQ */
+       (iw_handler) wl_iw_set_mode,            /* SIOCSIWMODE */
+       (iw_handler) wl_iw_get_mode,            /* SIOCGIWMODE */
+       (iw_handler) NULL,                      /* SIOCSIWSENS */
+       (iw_handler) NULL,                      /* SIOCGIWSENS */
+       (iw_handler) NULL,                      /* SIOCSIWRANGE */
+       (iw_handler) wl_iw_get_range,           /* SIOCGIWRANGE */
+       (iw_handler) NULL,                      /* SIOCSIWPRIV */
+       (iw_handler) NULL,                      /* SIOCGIWPRIV */
+       (iw_handler) NULL,                      /* SIOCSIWSTATS */
+       (iw_handler) NULL,                      /* SIOCGIWSTATS */
+       (iw_handler) wl_iw_set_spy,             /* SIOCSIWSPY */
+       (iw_handler) wl_iw_get_spy,             /* SIOCGIWSPY */
+       (iw_handler) NULL,                      /* -- hole -- */
+       (iw_handler) NULL,                      /* -- hole -- */
+       (iw_handler) wl_iw_set_wap,             /* SIOCSIWAP */
+       (iw_handler) wl_iw_get_wap,             /* SIOCGIWAP */
+#if WIRELESS_EXT > 17
+       (iw_handler) wl_iw_mlme,                /* SIOCSIWMLME */
+#else
+       (iw_handler) NULL,                      /* -- hole -- */
+#endif
+#ifdef WL_ESCAN
+       (iw_handler) NULL,                      /* SIOCGIWAPLIST */
+#else
+       (iw_handler) wl_iw_iscan_get_aplist,    /* SIOCGIWAPLIST */
+#endif
+#if WIRELESS_EXT > 13
+       (iw_handler) wl_iw_iscan_set_scan,      /* SIOCSIWSCAN */
+       (iw_handler) wl_iw_iscan_get_scan,      /* SIOCGIWSCAN */
+#else  /* WIRELESS_EXT > 13 */
+       (iw_handler) NULL,                      /* SIOCSIWSCAN */
+       (iw_handler) NULL,                      /* SIOCGIWSCAN */
+#endif /* WIRELESS_EXT > 13 */
+       (iw_handler) wl_iw_set_essid,           /* SIOCSIWESSID */
+       (iw_handler) wl_iw_get_essid,           /* SIOCGIWESSID */
+       (iw_handler) wl_iw_set_nick,            /* SIOCSIWNICKN */
+       (iw_handler) wl_iw_get_nick,            /* SIOCGIWNICKN */
+       (iw_handler) NULL,                      /* -- hole -- */
+       (iw_handler) NULL,                      /* -- hole -- */
+       (iw_handler) wl_iw_set_rate,            /* SIOCSIWRATE */
+       (iw_handler) wl_iw_get_rate,            /* SIOCGIWRATE */
+       (iw_handler) wl_iw_set_rts,             /* SIOCSIWRTS */
+       (iw_handler) wl_iw_get_rts,             /* SIOCGIWRTS */
+       (iw_handler) wl_iw_set_frag,            /* SIOCSIWFRAG */
+       (iw_handler) wl_iw_get_frag,            /* SIOCGIWFRAG */
+       (iw_handler) wl_iw_set_txpow,           /* SIOCSIWTXPOW */
+       (iw_handler) wl_iw_get_txpow,           /* SIOCGIWTXPOW */
+#if WIRELESS_EXT > 10
+       (iw_handler) wl_iw_set_retry,           /* SIOCSIWRETRY */
+       (iw_handler) wl_iw_get_retry,           /* SIOCGIWRETRY */
+#endif /* WIRELESS_EXT > 10 */
+       (iw_handler) wl_iw_set_encode,          /* SIOCSIWENCODE */
+       (iw_handler) wl_iw_get_encode,          /* SIOCGIWENCODE */
+       (iw_handler) wl_iw_set_power,           /* SIOCSIWPOWER */
+       (iw_handler) wl_iw_get_power,           /* SIOCGIWPOWER */
+#if WIRELESS_EXT > 17
+       (iw_handler) NULL,                      /* -- hole -- */
+       (iw_handler) NULL,                      /* -- hole -- */
+       (iw_handler) wl_iw_set_wpaie,           /* SIOCSIWGENIE */
+       (iw_handler) wl_iw_get_wpaie,           /* SIOCGIWGENIE */
+       (iw_handler) wl_iw_set_wpaauth,         /* SIOCSIWAUTH */
+       (iw_handler) wl_iw_get_wpaauth,         /* SIOCGIWAUTH */
+       (iw_handler) wl_iw_set_encodeext,       /* SIOCSIWENCODEEXT */
+       (iw_handler) wl_iw_get_encodeext,       /* SIOCGIWENCODEEXT */
+       (iw_handler) wl_iw_set_pmksa,           /* SIOCSIWPMKSA */
+#endif /* WIRELESS_EXT > 17 */
+};
+
+#if WIRELESS_EXT > 12
+enum {
+       WL_IW_SET_LEDDC = SIOCIWFIRSTPRIV,
+       WL_IW_SET_VLANMODE,
+       WL_IW_SET_PM,
+       WL_IW_SET_LAST
+};
+
+static iw_handler wl_iw_priv_handler[] = {
+       wl_iw_set_leddc,
+       wl_iw_set_vlanmode,
+       wl_iw_set_pm,
+       NULL
+};
+
+static struct iw_priv_args wl_iw_priv_args[] = {
+       {
+               WL_IW_SET_LEDDC,
+               IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+               0,
+               "set_leddc"
+       },
+       {
+               WL_IW_SET_VLANMODE,
+               IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+               0,
+               "set_vlanmode"
+       },
+       {
+               WL_IW_SET_PM,
+               IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+               0,
+               "set_pm"
+       },
+       { 0, 0, 0, { 0 } }
+};
+
+const struct iw_handler_def wl_iw_handler_def =
+{
+       .num_standard = ARRAYSIZE(wl_iw_handler),
+       .num_private = ARRAY_SIZE(wl_iw_priv_handler),
+       .num_private_args = ARRAY_SIZE(wl_iw_priv_args),
+       .standard = (const iw_handler *) wl_iw_handler,
+       .private = wl_iw_priv_handler,
+       .private_args = wl_iw_priv_args,
+#if WIRELESS_EXT >= 19
+       get_wireless_stats: dhd_get_wireless_stats,
+#endif /* WIRELESS_EXT >= 19 */
+       };
+#endif /* WIRELESS_EXT > 12 */
+
+int
+wl_iw_ioctl(
+       struct net_device *dev,
+       struct ifreq *rq,
+       int cmd
+)
+{
+       struct iwreq *wrq = (struct iwreq *) rq;
+       struct iw_request_info info;
+       iw_handler handler;
+       char *extra = NULL;
+       size_t token_size = 1;
+       int max_tokens = 0, ret = 0;
+#ifndef WL_ESCAN
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       wl_wext_info_t *wext_info = NULL;
+       iscan_info_t *iscan;
+
+       DHD_CHECK(dhd, dev);
+       wext_info = dhd->wext_info;
+       iscan = &wext_info->iscan;
+#endif
+
+       if (cmd < SIOCIWFIRST ||
+               IW_IOCTL_IDX(cmd) >= ARRAYSIZE(wl_iw_handler) ||
+               !(handler = wl_iw_handler[IW_IOCTL_IDX(cmd)]))
+               return -EOPNOTSUPP;
+
+       switch (cmd) {
+
+       case SIOCSIWESSID:
+       case SIOCGIWESSID:
+       case SIOCSIWNICKN:
+       case SIOCGIWNICKN:
+               max_tokens = IW_ESSID_MAX_SIZE + 1;
+               break;
+
+       case SIOCSIWENCODE:
+       case SIOCGIWENCODE:
+#if WIRELESS_EXT > 17
+       case SIOCSIWENCODEEXT:
+       case SIOCGIWENCODEEXT:
+#endif
+               max_tokens = IW_ENCODING_TOKEN_MAX;
+               break;
+
+       case SIOCGIWRANGE:
+               max_tokens = sizeof(struct iw_range);
+               break;
+
+       case SIOCGIWAPLIST:
+               token_size = sizeof(struct sockaddr) + sizeof(struct iw_quality);
+               max_tokens = IW_MAX_AP;
+               break;
+
+#if WIRELESS_EXT > 13
+       case SIOCGIWSCAN:
+#ifndef WL_ESCAN
+       if (iscan)
+               max_tokens = wrq->u.data.length;
+       else
+#endif
+               max_tokens = IW_SCAN_MAX_DATA;
+               break;
+#endif /* WIRELESS_EXT > 13 */
+
+       case SIOCSIWSPY:
+               token_size = sizeof(struct sockaddr);
+               max_tokens = IW_MAX_SPY;
+               break;
+
+       case SIOCGIWSPY:
+               token_size = sizeof(struct sockaddr) + sizeof(struct iw_quality);
+               max_tokens = IW_MAX_SPY;
+               break;
+       default:
+               break;
+       }
+
+       if (max_tokens && wrq->u.data.pointer) {
+               if (wrq->u.data.length > max_tokens)
+                       return -E2BIG;
+
+               if (!(extra = kmalloc(max_tokens * token_size, GFP_KERNEL)))
+                       return -ENOMEM;
+
+               if (copy_from_user(extra, wrq->u.data.pointer, wrq->u.data.length * token_size)) {
+                       kfree(extra);
+                       return -EFAULT;
+               }
+       }
+
+       info.cmd = cmd;
+       info.flags = 0;
+
+       ret = handler(dev, &info, &wrq->u, extra);
+
+       if (extra) {
+               if (copy_to_user(wrq->u.data.pointer, extra, wrq->u.data.length * token_size)) {
+                       kfree(extra);
+                       return -EFAULT;
+               }
+
+               kfree(extra);
+       }
+
+       return ret;
+}
+
+/* Convert a connection status event into a connection status string.
+ * Returns TRUE if a matching connection status string was found.
+ */
+bool
+wl_iw_conn_status_str(uint32 event_type, uint32 status, uint32 reason,
+       char* stringBuf, uint buflen)
+{
+       typedef struct conn_fail_event_map_t {
+               uint32 inEvent;                 /* input: event type to match */
+               uint32 inStatus;                /* input: event status code to match */
+               uint32 inReason;                /* input: event reason code to match */
+               const char* outName;    /* output: failure type */
+               const char* outCause;   /* output: failure cause */
+       } conn_fail_event_map_t;
+
+       /* Map of WLC_E events to connection failure strings */
+#      define WL_IW_DONT_CARE  9999
+       const conn_fail_event_map_t event_map [] = {
+               /* inEvent           inStatus                inReason         */
+               /* outName outCause                                           */
+               {WLC_E_SET_SSID,     WLC_E_STATUS_SUCCESS,   WL_IW_DONT_CARE,
+               "Conn", "Success"},
+               {WLC_E_SET_SSID,     WLC_E_STATUS_NO_NETWORKS, WL_IW_DONT_CARE,
+               "Conn", "NoNetworks"},
+               {WLC_E_SET_SSID,     WLC_E_STATUS_FAIL,      WL_IW_DONT_CARE,
+               "Conn", "ConfigMismatch"},
+               {WLC_E_PRUNE,        WL_IW_DONT_CARE,        WLC_E_PRUNE_ENCR_MISMATCH,
+               "Conn", "EncrypMismatch"},
+               {WLC_E_PRUNE,        WL_IW_DONT_CARE,        WLC_E_RSN_MISMATCH,
+               "Conn", "RsnMismatch"},
+               {WLC_E_AUTH,         WLC_E_STATUS_TIMEOUT,   WL_IW_DONT_CARE,
+               "Conn", "AuthTimeout"},
+               {WLC_E_AUTH,         WLC_E_STATUS_FAIL,      WL_IW_DONT_CARE,
+               "Conn", "AuthFail"},
+               {WLC_E_AUTH,         WLC_E_STATUS_NO_ACK,    WL_IW_DONT_CARE,
+               "Conn", "AuthNoAck"},
+               {WLC_E_REASSOC,      WLC_E_STATUS_FAIL,      WL_IW_DONT_CARE,
+               "Conn", "ReassocFail"},
+               {WLC_E_REASSOC,      WLC_E_STATUS_TIMEOUT,   WL_IW_DONT_CARE,
+               "Conn", "ReassocTimeout"},
+               {WLC_E_REASSOC,      WLC_E_STATUS_ABORT,     WL_IW_DONT_CARE,
+               "Conn", "ReassocAbort"},
+               {WLC_E_PSK_SUP,      WLC_SUP_KEYED,          WL_IW_DONT_CARE,
+               "Sup", "ConnSuccess"},
+               {WLC_E_PSK_SUP,      WL_IW_DONT_CARE,        WL_IW_DONT_CARE,
+               "Sup", "WpaHandshakeFail"},
+               {WLC_E_DEAUTH_IND,   WL_IW_DONT_CARE,        WL_IW_DONT_CARE,
+               "Conn", "Deauth"},
+               {WLC_E_DISASSOC_IND, WL_IW_DONT_CARE,        WL_IW_DONT_CARE,
+               "Conn", "DisassocInd"},
+               {WLC_E_DISASSOC,     WL_IW_DONT_CARE,        WL_IW_DONT_CARE,
+               "Conn", "Disassoc"}
+       };
+
+       const char* name = "";
+       const char* cause = NULL;
+       int i;
+
+       /* Search the event map table for a matching event */
+       for (i = 0;  i < sizeof(event_map)/sizeof(event_map[0]);  i++) {
+               const conn_fail_event_map_t* row = &event_map[i];
+               if (row->inEvent == event_type &&
+                   (row->inStatus == status || row->inStatus == WL_IW_DONT_CARE) &&
+                   (row->inReason == reason || row->inReason == WL_IW_DONT_CARE)) {
+                       name = row->outName;
+                       cause = row->outCause;
+                       break;
+               }
+       }
+
+       /* If found, generate a connection failure string and return TRUE */
+       if (cause) {
+               memset(stringBuf, 0, buflen);
+               (void)snprintf(stringBuf, buflen, "%s %s %02d %02d", name, cause, status, reason);
+               WL_TRACE(("Connection status: %s\n", stringBuf));
+               return TRUE;
+       } else {
+               return FALSE;
+       }
+}
+
+#if (WIRELESS_EXT > 14)
+/* Check if we have received an event that indicates connection failure
+ * If so, generate a connection failure report string.
+ * The caller supplies a buffer to hold the generated string.
+ */
+static bool
+wl_iw_check_conn_fail(wl_event_msg_t *e, char* stringBuf, uint buflen)
+{
+       uint32 event = ntoh32(e->event_type);
+       uint32 status =  ntoh32(e->status);
+       uint32 reason =  ntoh32(e->reason);
+
+       if (wl_iw_conn_status_str(event, status, reason, stringBuf, buflen)) {
+               return TRUE;
+       } else
+       {
+               return FALSE;
+       }
+}
+#endif /* WIRELESS_EXT > 14 */
+
+#ifndef IW_CUSTOM_MAX
+#define IW_CUSTOM_MAX 256 /* size of extra buffer used for translation of events */
+#endif /* IW_CUSTOM_MAX */
+
+void
+wl_iw_event(struct net_device *dev, struct wl_wext_info *wext_info,
+       wl_event_msg_t *e, void* data)
+{
+#if WIRELESS_EXT > 13
+       union iwreq_data wrqu;
+       char extra[IW_CUSTOM_MAX + 1];
+       int cmd = 0;
+       uint32 event_type = ntoh32(e->event_type);
+       uint16 flags =  ntoh16(e->flags);
+       uint32 datalen = ntoh32(e->datalen);
+       uint32 status =  ntoh32(e->status);
+       uint32 reason =  ntoh32(e->reason);
+#ifndef WL_ESCAN
+       iscan_info_t *iscan = &wext_info->iscan;
+#endif
+
+       memset(&wrqu, 0, sizeof(wrqu));
+       memset(extra, 0, sizeof(extra));
+
+       memcpy(wrqu.addr.sa_data, &e->addr, ETHER_ADDR_LEN);
+       wrqu.addr.sa_family = ARPHRD_ETHER;
+
+       switch (event_type) {
+       case WLC_E_TXFAIL:
+               cmd = IWEVTXDROP;
+               break;
+#if WIRELESS_EXT > 14
+       case WLC_E_JOIN:
+       case WLC_E_ASSOC_IND:
+       case WLC_E_REASSOC_IND:
+               cmd = IWEVREGISTERED;
+               break;
+       case WLC_E_DEAUTH:
+       case WLC_E_DISASSOC:
+               wl_iw_update_connect_status(dev, WL_EXT_STATUS_DISCONNECTED);
+               WL_MSG_RLMT(dev->name, &e->addr, ETHER_ADDR_LEN,
+                       "disconnected with "MACSTR", event %d, reason %d\n",
+                       MAC2STR((u8 *)wrqu.addr.sa_data), event_type, reason);
+               break;
+       case WLC_E_DEAUTH_IND:
+       case WLC_E_DISASSOC_IND:
+               cmd = SIOCGIWAP;
+               WL_MSG(dev->name, "disconnected with "MACSTR", event %d, reason %d\n",
+                       MAC2STR((u8 *)wrqu.addr.sa_data), event_type, reason);
+               bzero(wrqu.addr.sa_data, ETHER_ADDR_LEN);
+               bzero(&extra, ETHER_ADDR_LEN);
+               wl_iw_update_connect_status(dev, WL_EXT_STATUS_DISCONNECTED);
+               break;
+
+       case WLC_E_LINK:
+               cmd = SIOCGIWAP;
+               if (!(flags & WLC_EVENT_MSG_LINK)) {
+                       WL_MSG(dev->name, "Link Down with "MACSTR", reason=%d\n",
+                               MAC2STR((u8 *)wrqu.addr.sa_data), reason);
+                       bzero(wrqu.addr.sa_data, ETHER_ADDR_LEN);
+                       bzero(&extra, ETHER_ADDR_LEN);
+                       wl_iw_update_connect_status(dev, WL_EXT_STATUS_DISCONNECTED);
+               } else {
+                       WL_MSG(dev->name, "Link UP with "MACSTR"\n",
+                               MAC2STR((u8 *)wrqu.addr.sa_data));
+               }
+               break;
+       case WLC_E_ACTION_FRAME:
+               cmd = IWEVCUSTOM;
+               if (datalen + 1 <= sizeof(extra)) {
+                       wrqu.data.length = datalen + 1;
+                       extra[0] = WLC_E_ACTION_FRAME;
+                       memcpy(&extra[1], data, datalen);
+                       WL_TRACE(("WLC_E_ACTION_FRAME len %d \n", wrqu.data.length));
+               }
+               break;
+
+       case WLC_E_ACTION_FRAME_COMPLETE:
+               cmd = IWEVCUSTOM;
+               if (sizeof(status) + 1 <= sizeof(extra)) {
+                       wrqu.data.length = sizeof(status) + 1;
+                       extra[0] = WLC_E_ACTION_FRAME_COMPLETE;
+                       memcpy(&extra[1], &status, sizeof(status));
+                       WL_TRACE(("wl_iw_event status %d  \n", status));
+               }
+               break;
+#endif /* WIRELESS_EXT > 14 */
+#if WIRELESS_EXT > 17
+       case WLC_E_MIC_ERROR: {
+               struct  iw_michaelmicfailure  *micerrevt = (struct  iw_michaelmicfailure  *)&extra;
+               cmd = IWEVMICHAELMICFAILURE;
+               wrqu.data.length = sizeof(struct iw_michaelmicfailure);
+               if (flags & WLC_EVENT_MSG_GROUP)
+                       micerrevt->flags |= IW_MICFAILURE_GROUP;
+               else
+                       micerrevt->flags |= IW_MICFAILURE_PAIRWISE;
+               memcpy(micerrevt->src_addr.sa_data, &e->addr, ETHER_ADDR_LEN);
+               micerrevt->src_addr.sa_family = ARPHRD_ETHER;
+
+               break;
+       }
+
+       case WLC_E_ASSOC_REQ_IE:
+               cmd = IWEVASSOCREQIE;
+               wrqu.data.length = datalen;
+               if (datalen < sizeof(extra))
+                       memcpy(extra, data, datalen);
+               break;
+
+       case WLC_E_ASSOC_RESP_IE:
+               cmd = IWEVASSOCRESPIE;
+               wrqu.data.length = datalen;
+               if (datalen < sizeof(extra))
+                       memcpy(extra, data, datalen);
+               break;
+
+       case WLC_E_PMKID_CACHE: {
+               struct iw_pmkid_cand *iwpmkidcand = (struct iw_pmkid_cand *)&extra;
+               pmkid_cand_list_t *pmkcandlist;
+               pmkid_cand_t    *pmkidcand;
+               int count;
+
+               if (data == NULL)
+                       break;
+
+               cmd = IWEVPMKIDCAND;
+               pmkcandlist = data;
+               count = ntoh32_ua((uint8 *)&pmkcandlist->npmkid_cand);
+               wrqu.data.length = sizeof(struct iw_pmkid_cand);
+               pmkidcand = pmkcandlist->pmkid_cand;
+               while (count) {
+                       bzero(iwpmkidcand, sizeof(struct iw_pmkid_cand));
+                       if (pmkidcand->preauth)
+                               iwpmkidcand->flags |= IW_PMKID_CAND_PREAUTH;
+                       bcopy(&pmkidcand->BSSID, &iwpmkidcand->bssid.sa_data,
+                             ETHER_ADDR_LEN);
+                       wireless_send_event(dev, cmd, &wrqu, extra);
+                       pmkidcand++;
+                       count--;
+               }
+               break;
+       }
+#endif /* WIRELESS_EXT > 17 */
+
+#ifndef WL_ESCAN
+       case WLC_E_SCAN_COMPLETE:
+#if WIRELESS_EXT > 14
+               cmd = SIOCGIWSCAN;
+#endif
+               WL_TRACE(("event WLC_E_SCAN_COMPLETE\n"));
+               // terence 20150224: fix "wlan0: (WE) : Wireless Event too big (65306)"
+               memset(&wrqu, 0, sizeof(wrqu));
+               if ((iscan) && (iscan->sysioc_pid >= 0) &&
+                       (iscan->iscan_state != ISCAN_STATE_IDLE))
+                       up(&iscan->sysioc_sem);
+               break;
+#endif
+
+       default:
+               /* Cannot translate event */
+               break;
+       }
+
+       if (cmd) {
+#ifndef WL_ESCAN
+               if (cmd == SIOCGIWSCAN) {
+                       if ((!iscan) || (iscan->sysioc_pid < 0)) {
+                               wireless_send_event(dev, cmd, &wrqu, NULL);
+                       }
+               } else
+#endif
+                       wireless_send_event(dev, cmd, &wrqu, extra);
+       }
+
+#if WIRELESS_EXT > 14
+       /* Look for WLC events that indicate a connection failure.
+        * If found, generate an IWEVCUSTOM event.
+        */
+       memset(extra, 0, sizeof(extra));
+       if (wl_iw_check_conn_fail(e, extra, sizeof(extra))) {
+               cmd = IWEVCUSTOM;
+               wrqu.data.length = strlen(extra);
+               wireless_send_event(dev, cmd, &wrqu, extra);
+       }
+#endif /* WIRELESS_EXT > 14 */
+
+#endif /* WIRELESS_EXT > 13 */
+}
+
+#ifdef WL_NAN
+static int wl_iw_get_wireless_stats_cbfn(void *ctx, uint8 *data, uint16 type, uint16 len)
+{
+       struct iw_statistics *wstats = ctx;
+       int res = BCME_OK;
+
+       switch (type) {
+               case WL_CNT_XTLV_WLC: {
+                       wl_cnt_wlc_t *cnt = (wl_cnt_wlc_t *)data;
+                       if (len > sizeof(wl_cnt_wlc_t)) {
+                               printf("counter structure length invalid! %d > %d\n",
+                                       len, (int)sizeof(wl_cnt_wlc_t));
+                       }
+                       wstats->discard.nwid = 0;
+                       wstats->discard.code = dtoh32(cnt->rxundec);
+                       wstats->discard.fragment = dtoh32(cnt->rxfragerr);
+                       wstats->discard.retries = dtoh32(cnt->txfail);
+                       wstats->discard.misc = dtoh32(cnt->rxrunt) + dtoh32(cnt->rxgiant);
+                       wstats->miss.beacon = 0;
+                       WL_TRACE(("wl_iw_get_wireless_stats counters txframe=%d txbyte=%d\n",
+                               dtoh32(cnt->txframe), dtoh32(cnt->txbyte)));
+                       WL_TRACE(("wl_iw_get_wireless_stats counters rxundec=%d\n",
+                               dtoh32(cnt->rxundec)));
+                       WL_TRACE(("wl_iw_get_wireless_stats counters txfail=%d\n",
+                               dtoh32(cnt->txfail)));
+                       WL_TRACE(("wl_iw_get_wireless_stats counters rxfragerr=%d\n",
+                               dtoh32(cnt->rxfragerr)));
+                       WL_TRACE(("wl_iw_get_wireless_stats counters rxrunt=%d\n",
+                               dtoh32(cnt->rxrunt)));
+                       WL_TRACE(("wl_iw_get_wireless_stats counters rxgiant=%d\n",
+                               dtoh32(cnt->rxgiant)));
+                       break;
+               }
+               case WL_CNT_XTLV_CNTV_LE10_UCODE:
+               case WL_CNT_XTLV_LT40_UCODE_V1:
+               case WL_CNT_XTLV_GE40_UCODE_V1:
+               {
+                       /* Offsets of rxfrmtoolong and rxbadplcp are the same in
+                        * wl_cnt_v_le10_mcst_t, wl_cnt_lt40mcst_v1_t, and wl_cnt_ge40mcst_v1_t.
+                        * So we can just cast to wl_cnt_v_le10_mcst_t here.
+                        */
+                       wl_cnt_v_le10_mcst_t *cnt = (wl_cnt_v_le10_mcst_t *)data;
+                       if (len != WL_CNT_MCST_STRUCT_SZ) {
+                               printf("counter structure length mismatch! %d != %d\n",
+                                       len, WL_CNT_MCST_STRUCT_SZ);
+                       }
+                       WL_TRACE(("wl_iw_get_wireless_stats counters rxfrmtoolong=%d\n",
+                               dtoh32(cnt->rxfrmtoolong)));
+                       WL_TRACE(("wl_iw_get_wireless_stats counters rxbadplcp=%d\n",
+                               dtoh32(cnt->rxbadplcp)));
+                       BCM_REFERENCE(cnt);
+                       break;
+               }
+               default:
+                       WL_ERROR(("%d: Unsupported type %d\n", __LINE__, type));
+                       break;
+       }
+       return res;
+}
+#endif
+
+int wl_iw_get_wireless_stats(struct net_device *dev, struct iw_statistics *wstats)
+{
+       int res = 0;
+       int phy_noise;
+       int rssi;
+       scb_val_t scb_val;
+#if WIRELESS_EXT > 11
+       char *cntbuf = NULL;
+       wl_cnt_info_t *cntinfo;
+       uint16 ver;
+       uint32 corerev = 0;
+#endif /* WIRELESS_EXT > 11 */
+
+       phy_noise = 0;
+       if ((res = dev_wlc_ioctl(dev, WLC_GET_PHY_NOISE, &phy_noise, sizeof(phy_noise)))) {
+               WL_TRACE(("WLC_GET_PHY_NOISE error=%d\n", res));
+               goto done;
+       }
+
+       phy_noise = dtoh32(phy_noise);
+       WL_TRACE(("wl_iw_get_wireless_stats phy noise=%d\n *****", phy_noise));
+
+       memset(&scb_val, 0, sizeof(scb_val));
+       if ((res = dev_wlc_ioctl(dev, WLC_GET_RSSI, &scb_val, sizeof(scb_val_t)))) {
+               WL_TRACE(("WLC_GET_RSSI error=%d\n", res));
+               goto done;
+       }
+
+       rssi = dtoh32(scb_val.val);
+       rssi = MIN(rssi, RSSI_MAXVAL);
+       WL_TRACE(("wl_iw_get_wireless_stats rssi=%d ****** \n", rssi));
+       if (rssi <= WL_IW_RSSI_NO_SIGNAL)
+               wstats->qual.qual = 0;
+       else if (rssi <= WL_IW_RSSI_VERY_LOW)
+               wstats->qual.qual = 1;
+       else if (rssi <= WL_IW_RSSI_LOW)
+               wstats->qual.qual = 2;
+       else if (rssi <= WL_IW_RSSI_GOOD)
+               wstats->qual.qual = 3;
+       else if (rssi <= WL_IW_RSSI_VERY_GOOD)
+               wstats->qual.qual = 4;
+       else
+               wstats->qual.qual = 5;
+
+       /* Wraps to 0 if RSSI is 0 */
+       wstats->qual.level = 0x100 + rssi;
+       wstats->qual.noise = 0x100 + phy_noise;
+#if WIRELESS_EXT > 18
+       wstats->qual.updated |= (IW_QUAL_ALL_UPDATED | IW_QUAL_DBM);
+#else
+       wstats->qual.updated |= 7;
+#endif /* WIRELESS_EXT > 18 */
+
+#if WIRELESS_EXT > 11
+       WL_TRACE(("wl_iw_get_wireless_stats counters\n *****"));
+
+       cntbuf = kmalloc(MAX_WLIW_IOCTL_LEN, GFP_KERNEL);
+       if (!cntbuf) {
+               res = BCME_NOMEM;
+               goto done;
+       }
+
+       memset(cntbuf, 0, MAX_WLIW_IOCTL_LEN);
+       res = dev_wlc_bufvar_get(dev, "counters", cntbuf, MAX_WLIW_IOCTL_LEN);
+       if (res)
+       {
+               WL_ERROR(("wl_iw_get_wireless_stats counters failed error=%d ****** \n", res));
+               goto done;
+       }
+
+       cntinfo = (wl_cnt_info_t *)cntbuf;
+       cntinfo->version = dtoh16(cntinfo->version);
+       cntinfo->datalen = dtoh16(cntinfo->datalen);
+       ver = cntinfo->version;
+#ifdef WL_NAN
+       CHK_CNTBUF_DATALEN(cntbuf, MAX_WLIW_IOCTL_LEN);
+#endif
+       if (ver > WL_CNT_T_VERSION) {
+               WL_TRACE(("\tIncorrect version of counters struct: expected %d; got %d\n",
+                       WL_CNT_T_VERSION, ver));
+               res = BCME_VERSION;
+               goto done;
+       }
+
+       if (ver == WL_CNT_VERSION_11) {
+               wlc_rev_info_t revinfo;
+               memset(&revinfo, 0, sizeof(revinfo));
+               res = dev_wlc_ioctl(dev, WLC_GET_REVINFO, &revinfo, sizeof(revinfo));
+               if (res) {
+                       WL_ERROR(("WLC_GET_REVINFO failed %d\n", res));
+                       goto done;
+               }
+               corerev = dtoh32(revinfo.corerev);
+       }
+
+#ifdef WL_NAN
+       res = wl_cntbuf_to_xtlv_format(NULL, cntinfo, MAX_WLIW_IOCTL_LEN, corerev);
+       if (res) {
+               WL_ERROR(("wl_cntbuf_to_xtlv_format failed %d\n", res));
+               goto done;
+       }
+
+       if ((res = bcm_unpack_xtlv_buf(wstats, cntinfo->data, cntinfo->datalen,
+               BCM_XTLV_OPTION_ALIGN32, wl_iw_get_wireless_stats_cbfn))) {
+               goto done;
+       }
+#endif
+#endif /* WIRELESS_EXT > 11 */
+
+done:
+#if WIRELESS_EXT > 11
+       if (cntbuf) {
+               kfree(cntbuf);
+       }
+#endif /* WIRELESS_EXT > 11 */
+       return res;
+}
+
+#ifndef WL_ESCAN
+static void
+wl_iw_timerfunc(ulong data)
+{
+       iscan_info_t *iscan = (iscan_info_t *)data;
+       iscan->timer_on = 0;
+       if (iscan->iscan_state != ISCAN_STATE_IDLE) {
+               WL_TRACE(("timer trigger\n"));
+               up(&iscan->sysioc_sem);
+       }
+}
+
+static void
+wl_iw_set_event_mask(struct net_device *dev)
+{
+       char eventmask[WL_EVENTING_MASK_LEN];
+       char iovbuf[WL_EVENTING_MASK_LEN + 12]; /* Room for "event_msgs" + '\0' + bitvec */
+
+       dev_iw_iovar_getbuf(dev, "event_msgs", "", 0, iovbuf, sizeof(iovbuf));
+       bcopy(iovbuf, eventmask, WL_EVENTING_MASK_LEN);
+       setbit(eventmask, WLC_E_SCAN_COMPLETE);
+       dev_iw_iovar_setbuf(dev, "event_msgs", eventmask, WL_EVENTING_MASK_LEN,
+               iovbuf, sizeof(iovbuf));
+
+}
+
+static int
+wl_iw_iscan_prep(wl_scan_params_t *params, wlc_ssid_t *ssid)
+{
+       int err = 0;
+
+       memcpy(&params->bssid, &ether_bcast, ETHER_ADDR_LEN);
+       params->bss_type = DOT11_BSSTYPE_ANY;
+       params->scan_type = 0;
+       params->nprobes = -1;
+       params->active_time = -1;
+       params->passive_time = -1;
+       params->home_time = -1;
+       params->channel_num = 0;
+
+       params->nprobes = htod32(params->nprobes);
+       params->active_time = htod32(params->active_time);
+       params->passive_time = htod32(params->passive_time);
+       params->home_time = htod32(params->home_time);
+       if (ssid && ssid->SSID_len)
+               memcpy(&params->ssid, ssid, sizeof(wlc_ssid_t));
+
+       return err;
+}
+
+static int
+wl_iw_iscan(iscan_info_t *iscan, wlc_ssid_t *ssid, uint16 action)
+{
+       int params_size = (WL_SCAN_PARAMS_FIXED_SIZE + OFFSETOF(wl_iscan_params_t, params));
+       wl_iscan_params_t *params;
+       int err = 0;
+
+       if (ssid && ssid->SSID_len) {
+               params_size += sizeof(wlc_ssid_t);
+       }
+       params = (wl_iscan_params_t*)kmalloc(params_size, GFP_KERNEL);
+       if (params == NULL) {
+               return -ENOMEM;
+       }
+       memset(params, 0, params_size);
+       ASSERT(params_size < WLC_IOCTL_SMLEN);
+
+       err = wl_iw_iscan_prep(&params->params, ssid);
+
+       if (!err) {
+               params->version = htod32(ISCAN_REQ_VERSION);
+               params->action = htod16(action);
+               params->scan_duration = htod16(0);
+
+               /* params_size += OFFSETOF(wl_iscan_params_t, params); */
+               (void) dev_iw_iovar_setbuf(iscan->dev, "iscan", params, params_size,
+                       iscan->ioctlbuf, WLC_IOCTL_SMLEN);
+       }
+
+       kfree(params);
+       return err;
+}
+
+static uint32
+wl_iw_iscan_get(iscan_info_t *iscan)
+{
+       iscan_buf_t * buf;
+       iscan_buf_t * ptr;
+       wl_iscan_results_t * list_buf;
+       wl_iscan_results_t list;
+       wl_scan_results_t *results;
+       uint32 status;
+
+       /* buffers are allocated on demand */
+       if (iscan->list_cur) {
+               buf = iscan->list_cur;
+               iscan->list_cur = buf->next;
+       }
+       else {
+               buf = kmalloc(sizeof(iscan_buf_t), GFP_KERNEL);
+               if (!buf)
+                       return WL_SCAN_RESULTS_ABORTED;
+               buf->next = NULL;
+               if (!iscan->list_hdr)
+                       iscan->list_hdr = buf;
+               else {
+                       ptr = iscan->list_hdr;
+                       while (ptr->next) {
+                               ptr = ptr->next;
+                       }
+                       ptr->next = buf;
+               }
+       }
+       memset(buf->iscan_buf, 0, WLC_IW_ISCAN_MAXLEN);
+       list_buf = (wl_iscan_results_t*)buf->iscan_buf;
+       results = &list_buf->results;
+       results->buflen = WL_ISCAN_RESULTS_FIXED_SIZE;
+       results->version = 0;
+       results->count = 0;
+
+       memset(&list, 0, sizeof(list));
+       list.results.buflen = htod32(WLC_IW_ISCAN_MAXLEN);
+       (void) dev_iw_iovar_getbuf(
+               iscan->dev,
+               "iscanresults",
+               &list,
+               WL_ISCAN_RESULTS_FIXED_SIZE,
+               buf->iscan_buf,
+               WLC_IW_ISCAN_MAXLEN);
+       results->buflen = dtoh32(results->buflen);
+       results->version = dtoh32(results->version);
+       results->count = dtoh32(results->count);
+       WL_TRACE(("results->count = %d\n", results->count));
+
+       WL_TRACE(("results->buflen = %d\n", results->buflen));
+       status = dtoh32(list_buf->status);
+       return status;
+}
+
+static void wl_iw_send_scan_complete(iscan_info_t *iscan)
+{
+       union iwreq_data wrqu;
+
+       memset(&wrqu, 0, sizeof(wrqu));
+
+       /* wext expects to get no data for SIOCGIWSCAN Event  */
+       wireless_send_event(iscan->dev, SIOCGIWSCAN, &wrqu, NULL);
+}
+
+static int
+_iscan_sysioc_thread(void *data)
+{
+       uint32 status;
+       iscan_info_t *iscan = (iscan_info_t *)data;
+
+       WL_MSG("wlan", "thread Enter\n");
+       DAEMONIZE("iscan_sysioc");
+
+       status = WL_SCAN_RESULTS_PARTIAL;
+       while (down_interruptible(&iscan->sysioc_sem) == 0) {
+               if (iscan->timer_on) {
+                       del_timer(&iscan->timer);
+                       iscan->timer_on = 0;
+               }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+               rtnl_lock();
+#endif
+               status = wl_iw_iscan_get(iscan);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+               rtnl_unlock();
+#endif
+
+               switch (status) {
+                       case WL_SCAN_RESULTS_PARTIAL:
+                               WL_TRACE(("iscanresults incomplete\n"));
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+                               rtnl_lock();
+#endif
+                               /* make sure our buffer size is enough before going next round */
+                               wl_iw_iscan(iscan, NULL, WL_SCAN_ACTION_CONTINUE);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+                               rtnl_unlock();
+#endif
+                               /* Reschedule the timer */
+                               iscan->timer.expires = jiffies + msecs_to_jiffies(iscan->timer_ms);
+                               add_timer(&iscan->timer);
+                               iscan->timer_on = 1;
+                               break;
+                       case WL_SCAN_RESULTS_SUCCESS:
+                               WL_TRACE(("iscanresults complete\n"));
+                               iscan->iscan_state = ISCAN_STATE_IDLE;
+                               wl_iw_send_scan_complete(iscan);
+                               break;
+                       case WL_SCAN_RESULTS_PENDING:
+                               WL_TRACE(("iscanresults pending\n"));
+                               /* Reschedule the timer */
+                               iscan->timer.expires = jiffies + msecs_to_jiffies(iscan->timer_ms);
+                               add_timer(&iscan->timer);
+                               iscan->timer_on = 1;
+                               break;
+                       case WL_SCAN_RESULTS_ABORTED:
+                               WL_TRACE(("iscanresults aborted\n"));
+                               iscan->iscan_state = ISCAN_STATE_IDLE;
+                               wl_iw_send_scan_complete(iscan);
+                               break;
+                       default:
+                               WL_TRACE(("iscanresults returned unknown status %d\n", status));
+                               break;
+                }
+       }
+       WL_MSG("wlan", "was terminated\n");
+       complete_and_exit(&iscan->sysioc_exited, 0);
+}
+#endif /* !WL_ESCAN */
+
+void
+wl_iw_detach(struct net_device *dev, dhd_pub_t *dhdp)
+{
+       wl_wext_info_t *wext_info = dhdp->wext_info;
+#ifndef WL_ESCAN
+       iscan_buf_t  *buf;
+       iscan_info_t *iscan;
+#endif
+       if (!wext_info)
+               return;
+
+#ifndef WL_ESCAN
+       iscan = &wext_info->iscan;
+       if (iscan->sysioc_pid >= 0) {
+               KILL_PROC(iscan->sysioc_pid, SIGTERM);
+               wait_for_completion(&iscan->sysioc_exited);
+       }
+
+       while (iscan->list_hdr) {
+               buf = iscan->list_hdr->next;
+               kfree(iscan->list_hdr);
+               iscan->list_hdr = buf;
+       }
+#endif
+       wl_ext_event_deregister(dev, dhdp, WLC_E_LAST, wl_iw_event);
+       if (wext_info) {
+               kfree(wext_info);
+               dhdp->wext_info = NULL;
+       }
+}
+
+int
+wl_iw_attach(struct net_device *dev, dhd_pub_t *dhdp)
+{
+       wl_wext_info_t *wext_info = NULL;
+       int ret = 0;
+#ifndef WL_ESCAN
+       iscan_info_t *iscan = NULL;
+#endif
+
+       if (!dev)
+               return 0;
+       WL_TRACE(("Enter\n"));
+
+       wext_info = (void *)kzalloc(sizeof(struct wl_wext_info), GFP_KERNEL);
+       if (!wext_info)
+               return -ENOMEM;
+       memset(wext_info, 0, sizeof(wl_wext_info_t));
+       wext_info->dev = dev;
+       wext_info->dhd = dhdp;
+       wext_info->conn_info.bssidx = 0;
+       dhdp->wext_info = (void *)wext_info;
+
+#ifndef WL_ESCAN
+       iscan = &wext_info->iscan;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+       iscan->kthread = NULL;
+#endif
+       iscan->sysioc_pid = -1;
+       /* we only care about main interface so save a global here */
+       iscan->dev = dev;
+       iscan->iscan_state = ISCAN_STATE_IDLE;
+
+       /* Set up the timer */
+       iscan->timer_ms    = 2000;
+       init_timer_compat(&iscan->timer, wl_iw_timerfunc, iscan);
+
+       sema_init(&iscan->sysioc_sem, 0);
+       init_completion(&iscan->sysioc_exited);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+       iscan->kthread = kthread_run(_iscan_sysioc_thread, iscan, "iscan_sysioc");
+       iscan->sysioc_pid = iscan->kthread->pid;
+#else
+       iscan->sysioc_pid = kernel_thread(_iscan_sysioc_thread, iscan, 0);
+#endif
+       if (iscan->sysioc_pid < 0) {
+               ret = -ENOMEM;
+               goto exit;
+       }
+#endif
+       ret = wl_ext_event_register(dev, dhdp, WLC_E_LAST, wl_iw_event, dhdp->wext_info,
+               PRIO_EVENT_WEXT);
+       if (ret) {
+               WL_ERROR(("wl_ext_event_register err %d\n", ret));
+               goto exit;
+       }
+
+       return ret;
+exit:
+       wl_iw_detach(dev, dhdp);
+       return ret;
+}
+
+void
+wl_iw_down(struct net_device *dev, dhd_pub_t *dhdp)
+{
+       wl_wext_info_t *wext_info = NULL;
+
+       if (dhdp) {
+               wext_info = dhdp->wext_info;
+       } else {
+               WL_ERROR (("dhd is NULL\n"));
+               return;
+       }
+}
+
+int
+wl_iw_up(struct net_device *dev, dhd_pub_t *dhdp)
+{
+       wl_wext_info_t *wext_info = NULL;
+       int ret = 0;
+
+       if (dhdp) {
+               wext_info = dhdp->wext_info;
+       } else {
+               WL_ERROR (("dhd is NULL\n"));
+               return -ENODEV;
+       }
+
+       return ret;
+}
+
+s32
+wl_iw_autochannel(struct net_device *dev, char* command, int total_len)
+{
+       struct dhd_pub *dhd = dhd_get_pub(dev);
+       wl_wext_info_t *wext_info = NULL;
+       int ret = 0;
+#ifdef WL_ESCAN
+       int bytes_written = -1;
+#endif
+
+       DHD_CHECK(dhd, dev);
+       wext_info = dhd->wext_info;
+#ifdef WL_ESCAN
+       sscanf(command, "%*s %d", &dhd->escan->autochannel);
+       if (dhd->escan->autochannel == 0) {
+               dhd->escan->best_2g_ch = 0;
+               dhd->escan->best_5g_ch = 0;
+       } else if (dhd->escan->autochannel == 2) {
+               bytes_written = snprintf(command, total_len, "2g=%d 5g=%d",
+                       dhd->escan->best_2g_ch, dhd->escan->best_5g_ch);
+               WL_TRACE(("command result is %s\n", command));
+               ret = bytes_written;
+       }
+#endif
+
+       return ret;
+}
+
+#endif /* USE_IW */
diff --git a/bcmdhd.101.10.240.x/wl_iw.h b/bcmdhd.101.10.240.x/wl_iw.h
new file mode 100644 (file)
index 0000000..31d5811
--- /dev/null
@@ -0,0 +1,177 @@
+/*
+ * Linux Wireless Extensions support
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wl_iw.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef _wl_iw_h_
+#define _wl_iw_h_
+
+#include <linux/wireless.h>
+
+#include <typedefs.h>
+#include <ethernet.h>
+#include <wlioctl.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
+#define get_ds()    (KERNEL_DS)
+#endif
+
+#define WL_SCAN_PARAMS_SSID_MAX        10
+#define GET_SSID                       "SSID="
+#define GET_CHANNEL                    "CH="
+#define GET_NPROBE                     "NPROBE="
+#define GET_ACTIVE_ASSOC_DWELL         "ACTIVE="
+#define GET_PASSIVE_ASSOC_DWELL        "PASSIVE="
+#define GET_HOME_DWELL                 "HOME="
+#define GET_SCAN_TYPE                  "TYPE="
+
+#define BAND_GET_CMD                           "GETBAND"
+#define BAND_SET_CMD                           "SETBAND"
+#define DTIM_SKIP_GET_CMD                      "DTIMSKIPGET"
+#define DTIM_SKIP_SET_CMD                      "DTIMSKIPSET"
+#define SETSUSPEND_CMD                         "SETSUSPENDOPT"
+#define PNOSSIDCLR_SET_CMD                     "PNOSSIDCLR"
+/* Lin - Is the extra space needed? */
+#define PNOSETUP_SET_CMD                       "PNOSETUP " /* TLV command has extra end space */
+#define PNOENABLE_SET_CMD                      "PNOFORCE"
+#define PNODEBUG_SET_CMD                       "PNODEBUG"
+#define TXPOWER_SET_CMD                        "TXPOWER"
+
+#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
+#define MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
+
+/* Structure to keep global parameters */
+typedef struct wl_iw_extra_params {
+       int     target_channel; /* target channel */
+} wl_iw_extra_params_t;
+
+/* ============================================== */
+/* Defines from wlc_pub.h */
+#define        WL_IW_RSSI_MINVAL               -200    /* Low value, e.g. for forcing roam */
+#define        WL_IW_RSSI_NO_SIGNAL    -91     /* NDIS RSSI link quality cutoffs */
+#define        WL_IW_RSSI_VERY_LOW     -80     /* Very low quality cutoffs */
+#define        WL_IW_RSSI_LOW          -70     /* Low quality cutoffs */
+#define        WL_IW_RSSI_GOOD         -68     /* Good quality cutoffs */
+#define        WL_IW_RSSI_VERY_GOOD    -58     /* Very good quality cutoffs */
+#define        WL_IW_RSSI_EXCELLENT    -57     /* Excellent quality cutoffs */
+#define        WL_IW_RSSI_INVALID       0      /* invalid RSSI value */
+#define MAX_WX_STRING 80
+#define SSID_FMT_BUF_LEN       ((4 * 32) + 1)
+#define isprint(c) bcm_isprint(c)
+#define WL_IW_SET_ACTIVE_SCAN  (SIOCIWFIRSTPRIV+1)
+#define WL_IW_GET_RSSI                 (SIOCIWFIRSTPRIV+3)
+#define WL_IW_SET_PASSIVE_SCAN (SIOCIWFIRSTPRIV+5)
+#define WL_IW_GET_LINK_SPEED   (SIOCIWFIRSTPRIV+7)
+#define WL_IW_GET_CURR_MACADDR (SIOCIWFIRSTPRIV+9)
+#define WL_IW_SET_STOP                         (SIOCIWFIRSTPRIV+11)
+#define WL_IW_SET_START                        (SIOCIWFIRSTPRIV+13)
+
+#define                G_SCAN_RESULTS 8*1024
+#define                WE_ADD_EVENT_FIX        0x80
+#define          G_WLAN_SET_ON 0
+#define          G_WLAN_SET_OFF        1
+
+
+typedef struct wl_iw {
+       char nickname[IW_ESSID_MAX_SIZE];
+
+       struct iw_statistics wstats;
+
+       int spy_num;
+       uint32 pwsec;                   /* pairwise wsec setting */
+       uint32 gwsec;                   /* group wsec setting  */
+       bool privacy_invoked;           /* IW_AUTH_PRIVACY_INVOKED setting */
+       struct ether_addr spy_addr[IW_MAX_SPY];
+       struct iw_quality spy_qual[IW_MAX_SPY];
+       void  *wlinfo;
+} wl_iw_t;
+
+struct wl_ctrl {
+       timer_list_compat_t *timer;
+       struct net_device *dev;
+       long sysioc_pid;
+       struct semaphore sysioc_sem;
+       struct completion sysioc_exited;
+};
+
+
+#if WIRELESS_EXT > 12
+#include <net/iw_handler.h>
+extern const struct iw_handler_def wl_iw_handler_def;
+#endif /* WIRELESS_EXT > 12 */
+
+extern int wl_iw_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
+extern int wl_iw_get_wireless_stats(struct net_device *dev, struct iw_statistics *wstats);
+int wl_iw_send_priv_event(struct net_device *dev, char *flag);
+#ifdef WL_ESCAN
+int wl_iw_handle_scanresults_ies(char **event_p, char *end,
+       struct iw_request_info *info, wl_bss_info_t *bi);
+#endif
+int wl_iw_attach(struct net_device *dev, dhd_pub_t *dhdp);
+void wl_iw_detach(struct net_device *dev, dhd_pub_t *dhdp);
+int wl_iw_up(struct net_device *dev, dhd_pub_t *dhdp);
+void wl_iw_down(struct net_device *dev, dhd_pub_t *dhdp);
+s32 wl_iw_autochannel(struct net_device *dev, char* command, int total_len);
+
+/* message levels */
+#define WL_ERROR_LEVEL (1 << 0)
+#define WL_TRACE_LEVEL (1 << 1)
+#define WL_INFO_LEVEL  (1 << 2)
+#define WL_SCAN_LEVEL  (1 << 3)
+#define WL_WSEC_LEVEL  (1 << 4)
+
+#define CSCAN_COMMAND                          "CSCAN "
+#define CSCAN_TLV_PREFIX                       'S'
+#define CSCAN_TLV_VERSION                      1
+#define CSCAN_TLV_SUBVERSION                   0
+#define CSCAN_TLV_TYPE_SSID_IE          'S'
+#define CSCAN_TLV_TYPE_CHANNEL_IE   'C'
+#define CSCAN_TLV_TYPE_NPROBE_IE     'N'
+#define CSCAN_TLV_TYPE_ACTIVE_IE      'A'
+#define CSCAN_TLV_TYPE_PASSIVE_IE    'P'
+#define CSCAN_TLV_TYPE_HOME_IE         'H'
+#define CSCAN_TLV_TYPE_STYPE_IE        'T'
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+#define IWE_STREAM_ADD_EVENT(info, stream, ends, iwe, extra) \
+       iwe_stream_add_event(info, stream, ends, iwe, extra)
+#define IWE_STREAM_ADD_VALUE(info, event, value, ends, iwe, event_len) \
+       iwe_stream_add_value(info, event, value, ends, iwe, event_len)
+#define IWE_STREAM_ADD_POINT(info, stream, ends, iwe, extra) \
+       iwe_stream_add_point(info, stream, ends, iwe, extra)
+#else
+#define IWE_STREAM_ADD_EVENT(info, stream, ends, iwe, extra) \
+       iwe_stream_add_event(stream, ends, iwe, extra)
+#define IWE_STREAM_ADD_VALUE(info, event, value, ends, iwe, event_len) \
+       iwe_stream_add_value(event, value, ends, iwe, event_len)
+#define IWE_STREAM_ADD_POINT(info, stream, ends, iwe, extra) \
+       iwe_stream_add_point(stream, ends, iwe, extra)
+#endif
+
+#endif /* _wl_iw_h_ */
diff --git a/bcmdhd.101.10.240.x/wl_linux_mon.c b/bcmdhd.101.10.240.x/wl_linux_mon.c
new file mode 100644 (file)
index 0000000..f659c86
--- /dev/null
@@ -0,0 +1,406 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Linux monitor network interface
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <osl.h>
+#include <linux/string.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/if_arp.h>
+#include <linux/ieee80211.h>
+#include <linux/rtnetlink.h>
+#include <net/ieee80211_radiotap.h>
+
+#include <wlioctl.h>
+#include <bcmutils.h>
+#include <dhd_dbg.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#if defined(__linux__)
+#include <bcmstdlib_s.h>
+#endif /* defined(__linux__) */
+
+typedef enum monitor_states
+{
+       MONITOR_STATE_DEINIT = 0x0,
+       MONITOR_STATE_INIT = 0x1,
+       MONITOR_STATE_INTERFACE_ADDED = 0x2,
+       MONITOR_STATE_INTERFACE_DELETED = 0x4
+} monitor_states_t;
+/*
+ * Some external functions, TODO: move them to dhd_linux.h
+ */
+int dhd_add_monitor(const char *name, struct net_device **new_ndev);
+extern int dhd_start_xmit(struct sk_buff *skb, struct net_device *net);
+int dhd_del_monitor(struct net_device *ndev);
+int dhd_monitor_init(void *dhd_pub);
+int dhd_monitor_uninit(void);
+
+/**
+ * Local declarations and defintions (not exposed)
+ */
+#ifndef DHD_MAX_IFS
+#define DHD_MAX_IFS 16
+#endif
+#define MON_PRINT(format, ...) printk("DHD-MON: %s " format, __func__, ##__VA_ARGS__)
+#define MON_TRACE MON_PRINT
+
+typedef struct monitor_interface {
+       int radiotap_enabled;
+       struct net_device* real_ndev;   /* The real interface that the monitor is on */
+       struct net_device* mon_ndev;
+} monitor_interface;
+
+typedef struct dhd_linux_monitor {
+       void *dhd_pub;
+       monitor_states_t monitor_state;
+       monitor_interface mon_if[DHD_MAX_IFS];
+       struct mutex lock;              /* lock to protect mon_if */
+} dhd_linux_monitor_t;
+
+static dhd_linux_monitor_t g_monitor;
+
+static struct net_device* lookup_real_netdev(const char *name);
+static monitor_interface* ndev_to_monif(struct net_device *ndev);
+static int dhd_mon_if_open(struct net_device *ndev);
+static int dhd_mon_if_stop(struct net_device *ndev);
+static int dhd_mon_if_subif_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+static void dhd_mon_if_set_multicast_list(struct net_device *ndev);
+static int dhd_mon_if_change_mac(struct net_device *ndev, void *addr);
+
+static const struct net_device_ops dhd_mon_if_ops = {
+       .ndo_open               = dhd_mon_if_open,
+       .ndo_stop               = dhd_mon_if_stop,
+       .ndo_start_xmit         = dhd_mon_if_subif_start_xmit,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
+       .ndo_set_rx_mode = dhd_mon_if_set_multicast_list,
+#else
+       .ndo_set_multicast_list = dhd_mon_if_set_multicast_list,
+#endif
+       .ndo_set_mac_address    = dhd_mon_if_change_mac,
+};
+
+/**
+ * Local static function defintions
+ */
+
+/* Look up dhd's net device table to find a match (e.g. interface "eth0" is a match for "mon.eth0"
+ * "p2p-eth0-0" is a match for "mon.p2p-eth0-0")
+ */
+static struct net_device* lookup_real_netdev(const char *name)
+{
+       struct net_device *ndev_found = NULL;
+
+       int i;
+       int len = 0;
+       int last_name_len = 0;
+       struct net_device *ndev;
+
+       /* We need to find interface "p2p-p2p-0" corresponding to monitor interface "mon-p2p-0",
+        * Once mon iface name reaches IFNAMSIZ, it is reset to p2p0-0 and corresponding mon
+        * iface would be mon-p2p0-0.
+        */
+       for (i = 0; i < DHD_MAX_IFS; i++) {
+               ndev = dhd_idx2net(g_monitor.dhd_pub, i);
+
+               /* Skip "p2p" and look for "-p2p0-x" in monitor interface name. If it
+                * it matches, then this netdev is the corresponding real_netdev.
+                */
+               if (ndev && strstr(ndev->name, "p2p-p2p0")) {
+                       len = strlen("p2p");
+               } else {
+               /* if p2p- is not present, then the IFNAMSIZ have reached and name
+                * would have got reset. In this casse,look for p2p0-x in mon-p2p0-x
+                */
+                       len = 0;
+               }
+               if (ndev && strstr(name, (ndev->name + len))) {
+                       if (strlen(ndev->name) > last_name_len) {
+                               ndev_found = ndev;
+                               last_name_len = strlen(ndev->name);
+                       }
+               }
+       }
+
+       return ndev_found;
+}
+
+static monitor_interface* ndev_to_monif(struct net_device *ndev)
+{
+       int i;
+
+       for (i = 0; i < DHD_MAX_IFS; i++) {
+               if (g_monitor.mon_if[i].mon_ndev == ndev)
+                       return &g_monitor.mon_if[i];
+       }
+
+       return NULL;
+}
+
+static int dhd_mon_if_open(struct net_device *ndev)
+{
+       int ret = 0;
+
+       MON_PRINT("enter\n");
+       return ret;
+}
+
+static int dhd_mon_if_stop(struct net_device *ndev)
+{
+       int ret = 0;
+
+       MON_PRINT("enter\n");
+       return ret;
+}
+
+static int dhd_mon_if_subif_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+{
+       int ret = 0;
+       int rtap_len;
+       int qos_len = 0;
+       int dot11_hdr_len = 24;
+       int snap_len = 6;
+       unsigned char *pdata;
+       unsigned short frame_ctl;
+       unsigned char src_mac_addr[6];
+       unsigned char dst_mac_addr[6];
+       struct ieee80211_hdr *dot11_hdr;
+       struct ieee80211_radiotap_header *rtap_hdr;
+       monitor_interface* mon_if;
+
+       MON_PRINT("enter\n");
+
+       mon_if = ndev_to_monif(ndev);
+       if (mon_if == NULL || mon_if->real_ndev == NULL) {
+               MON_PRINT(" cannot find matched net dev, skip the packet\n");
+               goto fail;
+       }
+
+       if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
+               goto fail;
+
+       rtap_hdr = (struct ieee80211_radiotap_header *)skb->data;
+       if (unlikely(rtap_hdr->it_version))
+               goto fail;
+
+       rtap_len = ieee80211_get_radiotap_len(skb->data);
+       if (unlikely(skb->len < rtap_len))
+               goto fail;
+
+       MON_PRINT("radiotap len (should be 14): %d\n", rtap_len);
+
+       /* Skip the ratio tap header */
+       skb_pull(skb, rtap_len);
+
+       dot11_hdr = (struct ieee80211_hdr *)skb->data;
+       frame_ctl = le16_to_cpu(dot11_hdr->frame_control);
+       /* Check if the QoS bit is set */
+       if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) {
+               /* Check if this ia a Wireless Distribution System (WDS) frame
+                * which has 4 MAC addresses
+                */
+               if (dot11_hdr->frame_control & 0x0080)
+                       qos_len = 2;
+               if ((dot11_hdr->frame_control & 0x0300) == 0x0300)
+                       dot11_hdr_len += 6;
+
+               eacopy(dot11_hdr->addr1, dst_mac_addr);
+               eacopy(dot11_hdr->addr2, src_mac_addr);
+
+               /* Skip the 802.11 header, QoS (if any) and SNAP, but leave spaces for
+                * for two MAC addresses
+                */
+               skb_pull(skb, dot11_hdr_len + qos_len + snap_len - sizeof(src_mac_addr) * 2);
+               pdata = (unsigned char*)skb->data;
+               (void)memcpy_s(pdata, sizeof(dst_mac_addr), dst_mac_addr, sizeof(dst_mac_addr));
+               (void)memcpy_s(pdata + sizeof(dst_mac_addr), sizeof(src_mac_addr), src_mac_addr,
+                               sizeof(src_mac_addr));
+               PKTSETPRIO(skb, 0);
+
+               MON_PRINT("if name: %s, matched if name %s\n", ndev->name, mon_if->real_ndev->name);
+
+               /* Use the real net device to transmit the packet */
+               ret = dhd_start_xmit(skb, mon_if->real_ndev);
+
+               return ret;
+       }
+fail:
+       dev_kfree_skb(skb);
+       return 0;
+}
+
+static void dhd_mon_if_set_multicast_list(struct net_device *ndev)
+{
+       monitor_interface* mon_if;
+
+       mon_if = ndev_to_monif(ndev);
+       if (mon_if == NULL || mon_if->real_ndev == NULL) {
+               MON_PRINT(" cannot find matched net dev, skip the packet\n");
+       } else {
+               MON_PRINT("enter, if name: %s, matched if name %s\n",
+               ndev->name, mon_if->real_ndev->name);
+       }
+}
+
+static int dhd_mon_if_change_mac(struct net_device *ndev, void *addr)
+{
+       int ret = 0;
+       monitor_interface* mon_if;
+
+       mon_if = ndev_to_monif(ndev);
+       if (mon_if == NULL || mon_if->real_ndev == NULL) {
+               MON_PRINT(" cannot find matched net dev, skip the packet\n");
+       } else {
+               MON_PRINT("enter, if name: %s, matched if name %s\n",
+               ndev->name, mon_if->real_ndev->name);
+       }
+       return ret;
+}
+
+/**
+ * Global function definitions (declared in dhd_linux_mon.h)
+ */
+
+int dhd_add_monitor(const char *name, struct net_device **new_ndev)
+{
+       int i;
+       int idx = -1;
+       int ret = 0;
+       struct net_device* ndev = NULL;
+       dhd_linux_monitor_t **dhd_mon;
+
+       mutex_lock(&g_monitor.lock);
+
+       MON_TRACE("enter, if name: %s\n", name);
+       if (!name || !new_ndev) {
+               MON_PRINT("invalid parameters\n");
+               ret = -EINVAL;
+               goto out;
+       }
+
+       /*
+        * Find a vacancy
+        */
+       for (i = 0; i < DHD_MAX_IFS; i++)
+               if (g_monitor.mon_if[i].mon_ndev == NULL) {
+                       idx = i;
+                       break;
+               }
+       if (idx == -1) {
+               MON_PRINT("exceeds maximum interfaces\n");
+               ret = -EFAULT;
+               goto out;
+       }
+
+       ndev = alloc_etherdev(sizeof(dhd_linux_monitor_t*));
+       if (!ndev) {
+               MON_PRINT("failed to allocate memory\n");
+               ret = -ENOMEM;
+               goto out;
+       }
+
+       ndev->type = ARPHRD_IEEE80211_RADIOTAP;
+       strlcpy(ndev->name, name, sizeof(ndev->name));
+       ndev->netdev_ops = &dhd_mon_if_ops;
+
+       ret = register_netdevice(ndev);
+       if (ret) {
+               MON_PRINT(" register_netdevice failed (%d)\n", ret);
+               goto out;
+       }
+
+       *new_ndev = ndev;
+       g_monitor.mon_if[idx].radiotap_enabled = TRUE;
+       g_monitor.mon_if[idx].mon_ndev = ndev;
+       g_monitor.mon_if[idx].real_ndev = lookup_real_netdev(name);
+       dhd_mon = (dhd_linux_monitor_t **)netdev_priv(ndev);
+       *dhd_mon = &g_monitor;
+       g_monitor.monitor_state = MONITOR_STATE_INTERFACE_ADDED;
+       MON_PRINT("net device returned: 0x%p\n", ndev);
+       MON_PRINT("found a matched net device, name %s\n", g_monitor.mon_if[idx].real_ndev->name);
+
+out:
+       if (ret && ndev)
+               free_netdev(ndev);
+
+       mutex_unlock(&g_monitor.lock);
+       return ret;
+
+}
+
+int dhd_del_monitor(struct net_device *ndev)
+{
+       int i;
+       if (!ndev)
+               return -EINVAL;
+       mutex_lock(&g_monitor.lock);
+       for (i = 0; i < DHD_MAX_IFS; i++) {
+               if (g_monitor.mon_if[i].mon_ndev == ndev ||
+                       g_monitor.mon_if[i].real_ndev == ndev) {
+
+                       g_monitor.mon_if[i].real_ndev = NULL;
+                       unregister_netdevice(g_monitor.mon_if[i].mon_ndev);
+                       free_netdev(g_monitor.mon_if[i].mon_ndev);
+                       g_monitor.mon_if[i].mon_ndev = NULL;
+                       g_monitor.monitor_state = MONITOR_STATE_INTERFACE_DELETED;
+                       break;
+               }
+       }
+
+       if (g_monitor.monitor_state != MONITOR_STATE_INTERFACE_DELETED)
+               MON_PRINT("IF not found in monitor array, is this a monitor IF? 0x%p\n", ndev);
+       mutex_unlock(&g_monitor.lock);
+
+       return 0;
+}
+
+int dhd_monitor_init(void *dhd_pub)
+{
+       if (g_monitor.monitor_state == MONITOR_STATE_DEINIT) {
+               g_monitor.dhd_pub = dhd_pub;
+               mutex_init(&g_monitor.lock);
+               g_monitor.monitor_state = MONITOR_STATE_INIT;
+       }
+       return 0;
+}
+
+int dhd_monitor_uninit(void)
+{
+       int i;
+       struct net_device *ndev;
+       if (g_monitor.monitor_state != MONITOR_STATE_DEINIT) {
+               mutex_lock(&g_monitor.lock);
+               for (i = 0; i < DHD_MAX_IFS; i++) {
+                       ndev = g_monitor.mon_if[i].mon_ndev;
+                       if (ndev) {
+                               unregister_netdevice(ndev);
+                               free_netdev(ndev);
+                               g_monitor.mon_if[i].real_ndev = NULL;
+                               g_monitor.mon_if[i].mon_ndev = NULL;
+                       }
+               }
+               g_monitor.monitor_state = MONITOR_STATE_DEINIT;
+               mutex_unlock(&g_monitor.lock);
+       }
+       return 0;
+}
diff --git a/bcmdhd.101.10.240.x/wl_roam.c b/bcmdhd.101.10.240.x/wl_roam.c
new file mode 100644 (file)
index 0000000..ef06528
--- /dev/null
@@ -0,0 +1,655 @@
+/*
+ * Linux roam cache
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmwifi_channels.h>
+#include <wlioctl.h>
+#include <bcmutils.h>
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#endif
+#include <wldev_common.h>
+#if defined(__linux__)
+#include <bcmstdlib_s.h>
+#endif /* defined(__linux__) */
+
+#ifdef ESCAN_CHANNEL_CACHE
+#define MAX_ROAM_CACHE         200
+#define MAX_SSID_BUFSIZE       36
+
+typedef struct {
+       chanspec_t chanspec;
+       int ssid_len;
+       char ssid[MAX_SSID_BUFSIZE];
+} roam_channel_cache;
+
+static int n_roam_cache = 0;
+static int roam_band = WLC_BAND_AUTO;
+static roam_channel_cache roam_cache[MAX_ROAM_CACHE];
+static uint band_bw;
+
+#ifdef ROAM_CHANNEL_CACHE
+void update_roam_cache(struct bcm_cfg80211 *cfg, int ioctl_ver);
+static void add_roam_cache_list(uint8 *SSID, uint32 SSID_len, chanspec_t chanspec);
+
+int init_roam_cache(struct bcm_cfg80211 *cfg, int ioctl_ver)
+{
+       int err;
+       struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+       s32 mode;
+
+       /* Check support in firmware */
+       err = wldev_iovar_getint(dev, "roamscan_mode", &mode);
+       if (err && (err == BCME_UNSUPPORTED)) {
+               /* If firmware doesn't support, return error. Else proceed */
+               WL_ERR(("roamscan_mode iovar failed. %d\n", err));
+               return err;
+       }
+
+#ifdef D11AC_IOTYPES
+       band_bw = WL_CHANSPEC_BW_20;
+#else
+       band_bw = WL_CHANSPEC_BW_20 | WL_CHANSPEC_CTL_SB_NONE;
+#endif /* D11AC_IOTYPES */
+
+       n_roam_cache = 0;
+       roam_band = WLC_BAND_AUTO;
+       cfg->roamscan_mode = ROAMSCAN_MODE_NORMAL;
+
+       return 0;
+}
+#endif /* ROAM_CHANNEL_CACHE */
+#ifdef ESCAN_CHANNEL_CACHE
+static int
+set_roamscan_chspec_list(struct net_device *dev,
+               unsigned chan_cnt, chanspec_t *chspecs)
+{
+       s32 error;
+       wl_roam_channel_list_t channel_list;
+       char iobuf[WLC_IOCTL_SMLEN];
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       cfg->roamscan_mode = ROAMSCAN_MODE_NORMAL;
+
+       if (chan_cnt > MAX_ROAM_CHANNEL) {
+               chan_cnt = MAX_ROAM_CHANNEL;
+       }
+
+       channel_list.n = chan_cnt;
+       if (memcpy_s(channel_list.channels, sizeof(channel_list.channels),
+                       chspecs, (chan_cnt * sizeof(chanspec_t))) != BCME_OK) {
+               WL_ERR(("channel list copy failed\n"));
+               return -EINVAL;
+       }
+       /* need to set ROAMSCAN_MODE_NORMAL to update roamscan_channels,
+        * otherwise, it won't be updated
+        */
+       error = wldev_iovar_setint(dev, "roamscan_mode", ROAMSCAN_MODE_NORMAL);
+       if (error) {
+               WL_ERR(("Failed to set roamscan mode to %d, error = %d\n",
+                       ROAMSCAN_MODE_NORMAL, error));
+               return error;
+       }
+       error = wldev_iovar_setbuf(dev, "roamscan_channels", &channel_list,
+               sizeof(channel_list), iobuf, sizeof(iobuf), NULL);
+       if (error) {
+               WL_ERR(("Failed to set roamscan channels, error = %d\n", error));
+               return error;
+       }
+
+       return error;
+}
+#endif /* ESCAN_CHANNEL_CACHE */
+
+#ifdef WES_SUPPORT
+int get_roamscan_mode(struct net_device *dev, int *mode)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       *mode = cfg->roamscan_mode;
+
+       return 0;
+}
+
+int set_roamscan_mode(struct net_device *dev, int mode)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       int error = 0;
+       cfg->roamscan_mode = mode;
+       n_roam_cache = 0;
+
+       error = wldev_iovar_setint(dev, "roamscan_mode", mode);
+       if (error) {
+               WL_ERR(("Failed to set roamscan mode to %d, error = %d\n", mode, error));
+       }
+
+       return error;
+}
+
+int get_roamscan_channel_list(struct net_device *dev, unsigned char channels[],
+       int n_channels)
+{
+       int n = 0;
+       int error = BCME_OK;
+       wl_roam_channel_list_t channel_list;
+
+       /* Get Current RCC List */
+       error = wldev_iovar_getbuf(dev, "roamscan_channels", 0, 0,
+               (void *)&channel_list, sizeof(channel_list), NULL);
+       if (error) {
+               WL_ERR(("Failed to get roamscan channels, err = %d\n", error));
+               return error;
+       }
+       if (channel_list.n > MAX_ROAM_CHANNEL) {
+               WL_ERR(("Invalid roamscan channels count(%d)\n", channel_list.n));
+               return BCME_ERROR;
+       }
+
+       for (n = 0; n < channel_list.n; n++) {
+               channels[n] = CHSPEC_CHANNEL(channel_list.channels[n]);
+
+               WL_DBG(("channel[%d] - [%02d] \n", n, channels[n]));
+       }
+
+       return n;
+}
+
+int set_roamscan_channel_list(struct net_device *dev,
+       unsigned char n, unsigned char channels[], int ioctl_ver)
+{
+       int i;
+       int error;
+       wl_roam_channel_list_t channel_list;
+       char iobuf[WLC_IOCTL_SMLEN];
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       cfg->roamscan_mode = ROAMSCAN_MODE_WES;
+
+       if (n > MAX_ROAM_CHANNEL)
+               n = MAX_ROAM_CHANNEL;
+
+       for (i = 0; i < n; i++) {
+               chanspec_t chanspec;
+
+               if (channels[i] <= CH_MAX_2G_CHANNEL) {
+                       chanspec = WL_CHANSPEC_BAND_2G | band_bw | channels[i];
+               } else {
+                       chanspec = WL_CHANSPEC_BAND_5G | band_bw | channels[i];
+               }
+               roam_cache[i].chanspec = chanspec;
+               channel_list.channels[i] = chanspec;
+
+               WL_DBG(("channel[%d] - [%02d] \n", i, channels[i]));
+       }
+
+       n_roam_cache = n;
+       channel_list.n = n;
+
+       /* need to set ROAMSCAN_MODE_NORMAL to update roamscan_channels,
+        * otherwise, it won't be updated
+        */
+       error = wldev_iovar_setint(dev, "roamscan_mode", ROAMSCAN_MODE_NORMAL);
+       if (error) {
+               WL_ERR(("Failed to set roamscan mode to %d, error = %d\n",
+                       ROAMSCAN_MODE_NORMAL, error));
+               return error;
+       }
+       error = wldev_iovar_setbuf(dev, "roamscan_channels", &channel_list,
+               sizeof(channel_list), iobuf, sizeof(iobuf), NULL);
+       if (error) {
+               WL_ERR(("Failed to set roamscan channels, error = %d\n", error));
+               return error;
+       }
+       error = wldev_iovar_setint(dev, "roamscan_mode", ROAMSCAN_MODE_WES);
+       if (error) {
+               WL_ERR(("Failed to set roamscan mode to %d, error = %d\n",
+                       ROAMSCAN_MODE_WES, error));
+       }
+
+       return error;
+}
+
+int
+add_roamscan_channel_list(struct net_device *dev, char *pcmd, int ioctl_ver)
+{
+       uint32 nchan = 0;
+       int i, error = BCME_OK;
+       char *token;
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       wlc_ssid_t ssid;
+
+       if (!cfg->rcc_enabled) {
+               return BCME_ERROR;
+       }
+
+       if (cfg->roamscan_mode == ROAMSCAN_MODE_WES) {
+               WL_ERR(("Failed to add roamscan channels, WES mode %d\n",
+                       cfg->roamscan_mode));
+               return BCME_ERROR;
+       }
+
+       /* Parse roam channel count */
+       token = bcmstrtok(&pcmd, " ", NULL);
+       if (!token) {
+               return BCME_BADARG;
+       }
+       nchan = bcm_atoi(token);
+       if (nchan > MAX_ROAM_CHANNEL) {
+               WL_ERR(("Failed Over MAX channel list(%d)\n", nchan));
+               return BCME_BADARG;
+       }
+
+       error = wldev_get_ssid(dev, &ssid);
+       if (error) {
+               WL_ERR(("Failed to get SSID, err=%d\n", error));
+               return error;
+       }
+
+       WL_DBG(("Add Roam scan channel count %d\n", nchan));
+
+       for (i = 0; i < nchan; i++) {
+               chanspec_t chanspec;
+               char chanbuf[CHANSPEC_STR_LEN];
+               uint32 channel;
+
+               /* Parse roam channel list */
+               token = bcmstrtok(&pcmd, " ", NULL);
+               if (!token) {
+                       WL_ERR(("Bad argument!\n"));
+                       return BCME_BADARG;
+               }
+               channel = bcm_atoi(token);
+
+               if (channel <= CH_MAX_2G_CHANNEL) {
+                       chanspec = WL_CHANSPEC_BAND_2G | band_bw | channel;
+               } else {
+                       chanspec = WL_CHANSPEC_BAND_5G | band_bw | channel;
+               }
+               add_roam_cache_list(ssid.SSID, ssid.SSID_len, chanspec);
+
+               WL_DBG(("channel[%d] - [%02d:%s] SSID %s\n", i, channel,
+                       wf_chspec_ntoa_ex(chanspec, chanbuf), ssid.SSID));
+       }
+
+       update_roam_cache(cfg, ioctl_ver);
+
+       return error;
+}
+#endif /* WES_SUPPORT */
+
+#ifdef ESCAN_CHANNEL_CACHE
+void set_roam_band(int band)
+{
+       roam_band = band;
+}
+
+void reset_roam_cache(struct bcm_cfg80211 *cfg)
+{
+       if (!cfg->rcc_enabled) {
+               return;
+       }
+
+#ifdef WES_SUPPORT
+       if (cfg->roamscan_mode == ROAMSCAN_MODE_WES)
+               return;
+#endif /* WES_SUPPORT */
+
+       n_roam_cache = 0;
+}
+
+static void
+add_roam_cache_list(uint8 *SSID, uint32 SSID_len, chanspec_t chanspec)
+{
+       int i;
+       uint8 channel;
+       char chanbuf[CHANSPEC_STR_LEN];
+
+       if (n_roam_cache >= MAX_ROAM_CACHE) {
+               return;
+       }
+
+       for (i = 0; i < n_roam_cache; i++) {
+               if ((roam_cache[i].ssid_len == SSID_len) &&
+                       (roam_cache[i].chanspec == chanspec) &&
+                       (memcmp(roam_cache[i].ssid, SSID, SSID_len) == 0)) {
+                       /* identical one found, just return */
+                       return;
+               }
+       }
+
+       roam_cache[n_roam_cache].ssid_len = SSID_len;
+       channel = wf_chspec_ctlchan(chanspec);
+       WL_DBG(("CHSPEC  = %s, CTL %d SSID %s\n",
+               wf_chspec_ntoa_ex(chanspec, chanbuf), channel, SSID));
+       roam_cache[n_roam_cache].chanspec = CHSPEC_BAND(chanspec) | band_bw | channel;
+       (void)memcpy_s(roam_cache[n_roam_cache].ssid, SSID_len, SSID, SSID_len);
+
+       n_roam_cache++;
+}
+
+void
+add_roam_cache(struct bcm_cfg80211 *cfg, wl_bss_info_t *bi)
+{
+       if (!cfg->rcc_enabled) {
+               return;
+       }
+
+#ifdef WES_SUPPORT
+       if (cfg->roamscan_mode == ROAMSCAN_MODE_WES) {
+               return;
+       }
+#endif /* WES_SUPPORT */
+
+       add_roam_cache_list(bi->SSID, bi->SSID_len, bi->chanspec);
+}
+
+static bool is_duplicated_channel(const chanspec_t *channels, int n_channels, chanspec_t new)
+{
+       int i;
+
+       for (i = 0; i < n_channels; i++) {
+               if (channels[i] == new)
+                       return TRUE;
+       }
+
+       return FALSE;
+}
+
+int get_roam_channel_list(struct bcm_cfg80211 *cfg, chanspec_t target_chan,
+       chanspec_t *channels, int n_channels, const wlc_ssid_t *ssid, int ioctl_ver)
+{
+       int i, n = 0;
+       char chanbuf[CHANSPEC_STR_LEN];
+
+       /* first index is filled with the given target channel */
+       if ((target_chan != INVCHANSPEC) && (target_chan != 0)) {
+               channels[0] = target_chan;
+               n++;
+       }
+
+       WL_DBG((" %s: 0x%04X\n", __FUNCTION__, channels[0]));
+
+#ifdef WES_SUPPORT
+       if (cfg->roamscan_mode == ROAMSCAN_MODE_WES) {
+               for (i = 0; i < n_roam_cache; i++) {
+                       chanspec_t ch = roam_cache[i].chanspec;
+                       bool band_match = ((roam_band == WLC_BAND_AUTO) ||
+#ifdef WL_6G_BAND
+                               ((roam_band == WLC_BAND_6G) && (CHSPEC_IS6G(ch))) ||
+#endif /* WL_6G_BAND */
+                               ((roam_band == WLC_BAND_2G) && (CHSPEC_IS2G(ch))) ||
+                               ((roam_band == WLC_BAND_5G) && (CHSPEC_IS5G(ch))));
+
+                       ch = CHSPEC_CHANNEL(ch) | CHSPEC_BAND(ch) | band_bw;
+
+                       if (band_match && !is_duplicated_channel(channels, n, ch)) {
+                               WL_DBG(("%s: Chanspec = %s\n", __FUNCTION__,
+                                       wf_chspec_ntoa_ex(ch, chanbuf)));
+                               channels[n++] = ch;
+                               if (n >= n_channels) {
+                                       WL_ERR(("Too many roam scan channels\n"));
+                                       return n;
+                               }
+                       }
+               }
+
+               return n;
+       }
+#endif /* WES_SUPPORT */
+
+       for (i = 0; i < n_roam_cache; i++) {
+               chanspec_t ch = roam_cache[i].chanspec;
+               bool band_match = ((roam_band == WLC_BAND_AUTO) ||
+#ifdef WL_6G_BAND
+                       ((roam_band == WLC_BAND_6G) && (CHSPEC_IS6G(ch))) ||
+#endif /* WL_6G_BAND */
+                       ((roam_band == WLC_BAND_2G) && (CHSPEC_IS2G(ch))) ||
+                       ((roam_band == WLC_BAND_5G) && (CHSPEC_IS5G(ch))));
+
+               ch = CHSPEC_CHANNEL(ch) | CHSPEC_BAND(ch) | band_bw;
+               if ((roam_cache[i].ssid_len == ssid->SSID_len) &&
+                       band_match && !is_duplicated_channel(channels, n, ch) &&
+                       (memcmp(roam_cache[i].ssid, ssid->SSID, ssid->SSID_len) == 0)) {
+                       /* match found, add it */
+                       WL_DBG(("%s: Chanspec = %s\n", __FUNCTION__,
+                               wf_chspec_ntoa_ex(ch, chanbuf)));
+                       channels[n++] = ch;
+                       if (n >= n_channels) {
+                               WL_ERR(("Too many roam scan channels\n"));
+                               return n;
+                       }
+               }
+       }
+
+       return n;
+}
+
+void
+wl_update_rcc_list(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wl_get_cfg(dev);
+       chanspec_t chanspec_list[MAX_ROAM_CHANNEL];
+       wlc_ssid_t *ssid = NULL;
+       u16 rcc_cnt = 0;
+
+       if (cfg->rcc_enabled)
+       {
+               ssid = (wlc_ssid_t*)wl_read_prof(cfg, dev, WL_PROF_SSID);
+               if (ssid == NULL) {
+                       WL_ERR(("Failed to read SSID profile\n"));
+                       ASSERT(0);
+                       return;
+               }
+               rcc_cnt = get_roam_channel_list(cfg, INVCHANSPEC, chanspec_list, MAX_ROAM_CHANNEL,
+                       ssid, ioctl_version);
+               if (rcc_cnt != 0) {
+                       /* Update rcc list to the firmware for roam use case */
+                       if (set_roamscan_chspec_list(dev, rcc_cnt, chanspec_list) != BCME_OK) {
+                               WL_ERR(("Roam channel update failed\n"));
+                       } else {
+                               WL_DBG(("Roam channel updated chan_cnt:%d\n", rcc_cnt));
+                       }
+               }
+       }
+}
+#endif /* ESCAN_CHANNEL_CACHE */
+
+#ifdef ROAM_CHANNEL_CACHE
+void print_roam_cache(struct bcm_cfg80211 *cfg)
+{
+       int i;
+
+       if (!cfg->rcc_enabled) {
+               return;
+       }
+
+       WL_DBG((" %d cache\n", n_roam_cache));
+
+       for (i = 0; i < n_roam_cache; i++) {
+               roam_cache[i].ssid[roam_cache[i].ssid_len] = 0;
+               WL_DBG(("0x%02X %02d %s\n", roam_cache[i].chanspec,
+                       roam_cache[i].ssid_len, roam_cache[i].ssid));
+       }
+}
+
+static void add_roamcache_channel(wl_roam_channel_list_t *channels, chanspec_t ch)
+{
+       int i;
+
+       if (channels->n >= MAX_ROAM_CHANNEL) /* buffer full */
+               return;
+
+       for (i = 0; i < channels->n; i++) {
+               if (channels->channels[i] == ch) /* already in the list */
+                       return;
+       }
+
+       channels->channels[i] = ch;
+       channels->n++;
+
+       WL_DBG((" RCC: %02d 0x%04X\n",
+               ch & WL_CHANSPEC_CHAN_MASK, ch));
+}
+
+void update_roam_cache(struct bcm_cfg80211 *cfg, int ioctl_ver)
+{
+       int error, i, prev_channels;
+       wl_roam_channel_list_t channel_list;
+       char iobuf[WLC_IOCTL_SMLEN];
+       struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+       wlc_ssid_t ssid;
+
+       if (!cfg->rcc_enabled) {
+               return;
+       }
+
+#ifdef WES_SUPPORT
+       if (cfg->roamscan_mode == ROAMSCAN_MODE_WES) {
+               /* no update when ROAMSCAN_MODE_WES */
+               return;
+       }
+#endif /* WES_SUPPORT */
+
+       if (!wl_get_drv_status(cfg, CONNECTED, dev)) {
+               WL_DBG(("Not associated\n"));
+               return;
+       }
+
+       /* need to read out the current cache list
+          as the firmware may change dynamically
+       */
+       error = wldev_iovar_getbuf(dev, "roamscan_channels", 0, 0,
+               (void *)&channel_list, sizeof(channel_list), NULL);
+       if (error) {
+               WL_ERR(("Failed to get roamscan channels, error = %d\n", error));
+               return;
+       }
+
+       error = wldev_get_ssid(dev, &ssid);
+       if (error) {
+               WL_ERR(("Failed to get SSID, err=%d\n", error));
+               return;
+       }
+
+       prev_channels = channel_list.n;
+       for (i = 0; i < n_roam_cache; i++) {
+               chanspec_t ch = roam_cache[i].chanspec;
+               bool band_match = ((roam_band == WLC_BAND_AUTO) ||
+#ifdef WL_6G_BAND
+                       ((roam_band == WLC_BAND_6G) && (CHSPEC_IS6G(ch))) ||
+#endif /* WL_6G_BAND */
+                       ((roam_band == WLC_BAND_2G) && (CHSPEC_IS2G(ch))) ||
+                       ((roam_band == WLC_BAND_5G) && (CHSPEC_IS5G(ch))));
+
+               if ((roam_cache[i].ssid_len == ssid.SSID_len) &&
+                       band_match && (memcmp(roam_cache[i].ssid, ssid.SSID, ssid.SSID_len) == 0)) {
+                       /* match found, add it */
+                       ch = CHSPEC_CHANNEL(ch) | CHSPEC_BAND(ch) | band_bw;
+                       add_roamcache_channel(&channel_list, ch);
+               }
+       }
+       if (prev_channels != channel_list.n) {
+               /* channel list updated */
+               error = wldev_iovar_setbuf(dev, "roamscan_channels", &channel_list,
+                       sizeof(channel_list), iobuf, sizeof(iobuf), NULL);
+               if (error) {
+                       WL_ERR(("Failed to update roamscan channels, error = %d\n", error));
+               }
+       }
+
+       WL_DBG(("%d AP, %d cache item(s), err=%d\n", n_roam_cache, channel_list.n, error));
+}
+
+void wl_update_roamscan_cache_by_band(struct net_device *dev, int band)
+{
+       int i, error, roamscan_mode;
+       wl_roam_channel_list_t chanlist_before, chanlist_after;
+       char iobuf[WLC_IOCTL_SMLEN];
+
+       roam_band = band;
+
+       error = wldev_iovar_getint(dev, "roamscan_mode", &roamscan_mode);
+       if (error) {
+               WL_ERR(("Failed to get roamscan mode, error = %d\n", error));
+               return;
+       }
+
+       /* in case of WES mode, update channel list by band based on the cache in DHD */
+       if (roamscan_mode) {
+               int n = 0;
+               chanlist_before.n = n_roam_cache;
+
+               for (n = 0; n < n_roam_cache; n++) {
+                       chanspec_t ch = roam_cache[n].chanspec;
+                       chanlist_before.channels[n] = CHSPEC_CHANNEL(ch) |
+                               CHSPEC_BAND(ch) | band_bw;
+               }
+       } else {
+               if (band == WLC_BAND_AUTO) {
+                       return;
+               }
+               error = wldev_iovar_getbuf(dev, "roamscan_channels", 0, 0,
+                               (void *)&chanlist_before, sizeof(wl_roam_channel_list_t), NULL);
+               if (error) {
+                       WL_ERR(("Failed to get roamscan channels, error = %d\n", error));
+                       return;
+               }
+       }
+       chanlist_after.n = 0;
+       /* filtering by the given band */
+       for (i = 0; i < chanlist_before.n; i++) {
+               chanspec_t chspec = chanlist_before.channels[i];
+               bool band_match = ((band == WLC_BAND_AUTO) ||
+#ifdef WL_6G_BAND
+                               ((band == WLC_BAND_6G) && (CHSPEC_IS6G(chspec))) ||
+#endif /* WL_6G_BAND */
+                               ((band == WLC_BAND_2G) && (CHSPEC_IS2G(chspec))) ||
+                               ((band == WLC_BAND_5G) && (CHSPEC_IS5G(chspec))));
+               if (band_match) {
+                       chanlist_after.channels[chanlist_after.n++] = chspec;
+               }
+       }
+
+       if (roamscan_mode) {
+               /* need to set ROAMSCAN_MODE_NORMAL to update roamscan_channels,
+                * otherwise, it won't be updated
+                */
+               wldev_iovar_setint(dev, "roamscan_mode", ROAMSCAN_MODE_NORMAL);
+
+               error = wldev_iovar_setbuf(dev, "roamscan_channels", &chanlist_after,
+                               sizeof(wl_roam_channel_list_t), iobuf, sizeof(iobuf), NULL);
+               if (error) {
+                       WL_ERR(("Failed to update roamscan channels, error = %d\n", error));
+               }
+               wldev_iovar_setint(dev, "roamscan_mode", ROAMSCAN_MODE_WES);
+       } else {
+               if (chanlist_before.n == chanlist_after.n) {
+                       return;
+               }
+               error = wldev_iovar_setbuf(dev, "roamscan_channels", &chanlist_after,
+                               sizeof(wl_roam_channel_list_t), iobuf, sizeof(iobuf), NULL);
+               if (error) {
+                       WL_ERR(("Failed to update roamscan channels, error = %d\n", error));
+               }
+       }
+}
+#endif /* ROAM_CHANNEL_CACHE */
+#endif /* ESCAN_CHANNEL_CACHE */
diff --git a/bcmdhd.101.10.240.x/wlc_types.h b/bcmdhd.101.10.240.x/wlc_types.h
new file mode 100644 (file)
index 0000000..dd5a1a3
--- /dev/null
@@ -0,0 +1,696 @@
+/*
+ * Forward declarations for commonly used wl driver structs
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef _wlc_types_h_
+#define _wlc_types_h_
+#include <wlioctl.h>
+
+/* Version of WLC interface to be returned as a part of wl_wlc_version structure.
+ */
+
+#define WLC_API_VERSION_MAJOR      14
+#define WLC_API_VERSION_MINOR      0
+
+/* forward declarations */
+
+typedef struct wlc_info wlc_info_t;
+typedef struct join_pref join_pref_t;
+typedef struct wlcband wlcband_t;
+typedef struct wlc_cmn_info wlc_cmn_info_t;
+typedef struct wlc_assoc_info wlc_assoc_info_t;
+typedef struct wlc_pm_info wlc_pm_info_t;
+
+typedef struct wlc_bsscfg wlc_bsscfg_t;
+typedef struct wlc_mbss_info wlc_mbss_info_t;
+typedef struct wlc_spt wlc_spt_t;
+typedef struct scb scb_t;
+typedef struct scb_iter scb_iter_t;
+typedef struct vndr_ie_listel vndr_ie_listel_t;
+typedef struct wlc_if wlc_if_t;
+typedef struct wl_if wl_if_t;
+typedef struct led_info led_info_t;
+typedef struct bmac_led bmac_led_t;
+typedef struct bmac_led_info bmac_led_info_t;
+typedef struct seq_cmds_info wlc_seq_cmds_info_t;
+typedef struct ota_test_info ota_test_info_t;
+typedef struct apps_wlc_psinfo apps_wlc_psinfo_t;
+typedef struct scb_module scb_module_t;
+typedef struct hscb_module hscb_module_t;
+typedef struct wlc_scb_handle wlc_scbh_t;
+typedef struct ba_info ba_info_t;
+typedef struct wlc_frminfo wlc_frminfo_t;
+typedef struct amsdu_info amsdu_info_t;
+typedef struct txq_info txq_info_t;
+typedef struct wlc_mux_info wlc_mux_info_t;
+typedef struct wlc_scbq_info wlc_scbq_info_t;
+typedef struct txq txq_t;
+typedef struct flow_ctx_info wlc_flow_ctx_info_t;
+typedef struct cram_info cram_info_t;
+typedef struct wlc_txq_info wlc_txq_info_t;
+typedef struct wlc_hrt_info wlc_hrt_info_t;
+typedef struct wlc_hrt_to wlc_hrt_to_t;
+typedef struct wlc_cac wlc_cac_t;
+typedef struct ampdu_tx_info ampdu_tx_info_t;
+typedef struct ampdu_rx_info ampdu_rx_info_t;
+typedef struct scb_ampdu_tx scb_ampdu_tx_t;
+typedef struct scb_ampdu_tid_ini scb_ampdu_tid_ini_t;
+typedef struct wlc_ratesel_info wlc_ratesel_info_t;
+typedef struct ratesel_info ratesel_info_t;
+typedef struct wlc_ap_info wlc_ap_info_t;
+typedef struct cs_info cs_info_t;
+typedef struct wlc_scan_info wlc_scan_info_t;
+typedef struct wlc_scan_cmn_info wlc_scan_cmn_t;
+typedef struct wlc_slotted_bss_info wlc_slotted_bss_info_t;
+typedef struct wl_bcn_report_cfg wl_bcn_report_cfg_t;
+typedef struct tdls_info tdls_info_t;
+typedef struct dls_info dls_info_t;
+typedef struct l2_filter_info l2_filter_info_t;
+typedef struct wlc_auth_info wlc_auth_info_t;
+typedef struct wlc_sup_info wlc_sup_info_t;
+typedef struct wlc_fbt_info wlc_fbt_info_t;
+typedef struct wlc_assoc_mgr_info wlc_assoc_mgr_info_t;
+typedef struct wlc_psta_info wlc_psta_info_t;
+typedef struct wlc_mcnx_info wlc_mcnx_info_t;
+typedef struct wlc_p2p_info wlc_p2p_info_t;
+typedef struct wlc_cxnoa_info wlc_cxnoa_info_t;
+typedef struct mchan_info mchan_info_t;
+typedef struct wlc_mchan_context wlc_mchan_context_t;
+typedef struct bta_info bta_info_t;
+typedef struct wowlpf_info wowlpf_info_t;
+typedef struct wlc_plt_info wlc_plt_pub_t;
+typedef struct antsel_info antsel_info_t;
+typedef struct bmac_pmq bmac_pmq_t;
+typedef struct wmf_info wmf_info_t;
+typedef struct wlc_rrm_info wlc_rrm_info_t;
+typedef struct rm_info rm_info_t;
+
+typedef struct wlc_dpc_info wlc_dpc_info_t;
+
+typedef struct wlc_11h_info wlc_11h_info_t;
+typedef struct wlc_tpc_info wlc_tpc_info_t;
+typedef struct wlc_csa_info wlc_csa_info_t;
+typedef struct wlc_quiet_info wlc_quiet_info_t;
+typedef struct cca_info cca_info_t;
+typedef struct itfr_info itfr_info_t;
+typedef struct wlc_wbtext_info wlc_wbtext_info_t;
+typedef struct wlc_wnm_info wlc_wnm_info_t;
+typedef struct wlc_wnm_pdt_info wlc_wnm_pdt_info_t;
+typedef struct wlc_wnm_roamscan_complete_data wlc_wnm_roamscan_complete_data_t;
+typedef struct wlc_wnm_roamscan_complete_res wlc_wnm_roamscan_complete_res_t;
+typedef struct wlc_11d_info wlc_11d_info_t;
+typedef struct wlc_cntry_info wlc_cntry_info_t;
+
+typedef struct wlc_dfs_info wlc_dfs_info_t;
+
+typedef struct bsscfg_module bsscfg_module_t;
+
+typedef struct wlc_prot_info wlc_prot_info_t;
+typedef struct wlc_prot_g_info wlc_prot_g_info_t;
+typedef struct wlc_prot_n_info wlc_prot_n_info_t;
+typedef struct wlc_prot_obss_info wlc_prot_obss_info_t;
+typedef struct wlc_obss_dynbw wlc_obss_dynbw_t;
+typedef struct wlc_11u_info wlc_11u_info_t;
+typedef struct wlc_probresp_info wlc_probresp_info_t;
+typedef struct wlc_wapi_info wlc_wapi_info_t;
+
+typedef struct wlc_tbtt_info wlc_tbtt_info_t;
+typedef struct wlc_nic_info wlc_nic_info_t;
+
+typedef struct wlc_bssload_info wlc_bssload_info_t;
+
+typedef struct wlc_pcb_info wlc_pcb_info_t;
+typedef struct wlc_txc_info wlc_txc_info_t;
+
+typedef struct wlc_trf_mgmt_ctxt    wlc_trf_mgmt_ctxt_t;
+typedef struct wlc_trf_mgmt_info    wlc_trf_mgmt_info_t;
+
+typedef struct wlc_net_detect_ctxt  wlc_net_detect_ctxt_t;
+
+typedef struct wlc_powersel_info wlc_powersel_info_t;
+typedef struct powersel_info powersel_info_t;
+
+typedef struct wlc_lpc_info wlc_lpc_info_t;
+typedef struct lpc_info lpc_info_t;
+typedef struct rate_lcb_info rate_lcb_info_t;
+typedef struct wlc_txbf_info wlc_txbf_info_t;
+typedef struct wlc_mutx_info wlc_mutx_info_t;
+typedef struct wlc_murx_info wlc_murx_info_t;
+
+typedef struct wlc_olpc_eng_info_t wlc_olpc_eng_info_t;
+/* used by olpc to register for callbacks from stf */
+typedef void (*wlc_stf_txchain_evt_notify)(wlc_info_t *wlc);
+
+typedef struct wlc_rfc wlc_rfc_t;
+typedef struct wlc_pktc_info wlc_pktc_info_t;
+
+typedef struct wlc_mfp_info wlc_mfp_info_t;
+
+typedef struct wlc_mdns_info wlc_mdns_info_t;
+
+typedef struct wlc_macfltr_info wlc_macfltr_info_t;
+
+typedef struct wlc_bs_data_info wlc_bs_data_info_t;
+
+typedef struct wlc_keymgmt wlc_keymgmt_t;
+typedef struct wlc_key wlc_key_t;
+typedef struct wlc_key_info wlc_key_info_t;
+
+typedef struct wlc_hw wlc_hw_t;
+typedef struct wlc_hw_info wlc_hw_info_t;
+typedef struct wlc_hwband wlc_hwband_t;
+
+typedef struct wlc_rx_stall_info wlc_rx_stall_info_t;
+typedef struct wlc_txs_hist wlc_txs_hist_t;
+
+typedef struct wlc_tx_stall_info wlc_tx_stall_info_t;
+typedef struct wlc_tx_stall_counters wlc_tx_stall_counters_t;
+
+typedef struct wlc_rmc_info wlc_rmc_info_t;
+
+typedef struct wlc_iem_info wlc_iem_info_t;
+
+typedef struct wlc_ier_info wlc_ier_info_t;
+typedef struct wlc_ier_reg wlc_ier_reg_t;
+typedef struct wlc_ier_reg_data wlc_ier_reg_data_t;
+typedef struct wlc_ier_reg_cmn wlc_ier_reg_cmn_t;
+
+typedef struct wlc_filter_ie_info wlc_filter_ie_info_t;
+
+typedef struct wlc_ht_info wlc_ht_info_t;
+typedef struct wlc_obss_info wlc_obss_info_t;
+typedef struct wlc_vht_info wlc_vht_info_t;
+typedef struct wlc_akm_info wlc_akm_info_t;
+
+typedef struct wlc_bss_info wlc_bss_info_t;
+
+typedef struct wlc_hs20_info wlc_hs20_info_t;
+typedef struct wlc_hs20_cmn wlc_hs20_cmn_t;
+typedef struct wlc_pmkid_info  wlc_pmkid_info_t;
+typedef struct wlc_btc_info wlc_btc_info_t;
+typedef struct wlc_btc_hw_info wlc_btc_hw_info_t;
+
+typedef struct wlc_txh_info wlc_txh_info_t;
+
+typedef struct wlc_staprio_info wlc_staprio_info_t;
+typedef struct wlc_stamon_info wlc_stamon_info_t;
+typedef struct wlc_monitor_info wlc_monitor_info_t;
+typedef struct monitor_info monitor_info_t;
+
+typedef struct wlc_debug_crash_info wlc_debug_crash_info_t;
+
+typedef struct wlc_nan_info wlc_nan_info_t;
+typedef struct wlc_edv_info wlc_edv_info_t;
+typedef struct wlc_tsmap_info wlc_tsmap_info_t;
+
+typedef struct wlc_wds_info wlc_wds_info_t;
+typedef struct okc_info okc_info_t;
+typedef struct wlc_aibss_info wlc_aibss_info_t;
+typedef struct wlc_ipfo_info wlc_ipfo_info_t;
+typedef struct wlc_stats_info wlc_stats_info_t;
+
+typedef struct wlc_pps_info wlc_pps_info_t;
+
+typedef struct duration_info duration_info_t;
+
+typedef struct wlc_pdsvc_info wlc_pdsvc_info_t;
+
+typedef struct wlc_swdiv_info wlc_swdiv_info_t;
+typedef struct lqcm_stats lqcm_stats_t;
+
+/* For LTE Coex */
+typedef struct wlc_ltecx_info wlc_ltecx_info_t;
+
+typedef struct mws_scanreq_bms mws_scanreq_bms_t;
+
+typedef struct wlc_probresp_mac_filter_info wlc_probresp_mac_filter_info_t;
+
+typedef struct wlc_ltr_info wlc_ltr_info_t;
+
+typedef struct bwte_info bwte_info_t;
+
+typedef struct tbow_info tbow_info_t;
+
+typedef struct wlc_modesw_info wlc_modesw_info_t;
+
+typedef struct wlc_pm_mute_tx_info wlc_pm_mute_tx_t;
+
+typedef struct wlc_nr5gcx_info wlc_nr5gcx_info_t;
+
+typedef struct wlc_bcntrim_info wlc_bcntrim_info_t;
+typedef wl_bcntrim_cfg_v1_t    wl_bcntrim_cfg_t;
+typedef wl_bcntrim_status_query_v1_t    wl_bcntrim_status_query_t;
+typedef wl_bcntrim_status_v1_t    wl_bcntrim_status_t;
+#define WL_BCNTRIM_STATUS_VERSION WL_BCNTRIM_STATUS_VERSION_1
+#define WL_BCNTRIM_CFG_VERSION WL_BCNTRIM_CFG_VERSION_1
+
+typedef struct wlc_ops_info wlc_ops_info_t;
+typedef wl_ops_cfg_v1_t  wl_ops_cfg_t;
+typedef wl_ops_status_v1_t  wl_ops_status_t;
+#define WL_OPS_STATUS_VERSION WL_OPS_STATUS_VERSION_1
+#define WL_OPS_CFG_VERSION WL_OPS_CFG_VERSION_1
+
+typedef struct wlc_psbw_info wlc_psbw_info_t;
+typedef wl_psbw_cfg_v1_t  wl_psbw_cfg_t;
+typedef wl_psbw_status_v1_t  wl_psbw_status_t;
+#define WL_PSBW_STATUS_VERSION WL_PSBW_STATUS_VERSION_1
+#define WL_PSBW_CFG_VERSION WL_PSBW_CFG_VERSION_1
+
+typedef struct wlc_smfs_info wlc_smfs_info_t;
+typedef struct wlc_misc_info wlc_misc_info_t;
+
+typedef struct wlc_eventq wlc_eventq_t;
+typedef struct wlc_event wlc_event_t;
+
+typedef struct wlc_bsscfg_psq_info wlc_bsscfg_psq_info_t;
+typedef struct wlc_bsscfg_viel_info wlc_bsscfg_viel_info_t;
+
+typedef struct wlc_txmod_info wlc_txmod_info_t;
+typedef struct tx_path_node tx_path_node_t;
+
+typedef struct wlc_linkstats_info wlc_linkstats_info_t;
+
+typedef struct wl_shub_info wl_shub_info_t;
+
+typedef struct wlc_lq_info wlc_lq_info_t;
+typedef struct chanim_info chanim_info_t;
+
+typedef struct wlc_mesh_info wlc_mesh_info_t;
+typedef struct wlc_wlfc_info wlc_wlfc_info_t;
+
+typedef struct wlc_frag_info wlc_frag_info_t;
+typedef struct wlc_bss_list wlc_bss_list_t;
+
+typedef struct wlc_msch_info wlc_msch_info_t;
+typedef struct wlc_msch_req_handle wlc_msch_req_handle_t;
+
+typedef struct wlc_randmac_info wlc_randmac_info_t;
+
+typedef struct wlc_chanctxt wlc_chanctxt_t;
+typedef struct wlc_chanctxt_info wlc_chanctxt_info_t;
+typedef struct wlc_sta_info wlc_sta_info_t;
+
+typedef struct health_check_info health_check_info_t;
+typedef struct wlc_act_frame_info wlc_act_frame_info_t;
+typedef struct nan_sched_req_handle nan_sched_req_handle_t;
+
+typedef struct wlc_qos_info wlc_qos_info_t;
+
+typedef struct wlc_assoc wlc_assoc_t;
+typedef struct wlc_roam wlc_roam_t;
+typedef struct wlc_pm_st wlc_pm_st_t;
+typedef struct wlc_pm_timers wlc_pm_timers_t;
+typedef struct wlc_wme wlc_wme_t;
+
+typedef struct wlc_link_qual wlc_link_qual_t;
+
+typedef struct wlc_rsdb_info wlc_rsdb_info_t;
+
+typedef struct wlc_asdb wlc_asdb_t;
+
+typedef struct rsdb_common_info rsdb_cmn_info_t;
+typedef struct rsdb_chan_sw_info rsdb_chan_sw_info_t;
+
+typedef struct wlc_macdbg_info wlc_macdbg_info_t;
+typedef struct wlc_rspec_info wlc_rspec_info_t;
+typedef struct wlc_ndis_info wlc_ndis_info_t;
+
+typedef struct wlc_join_pref wlc_join_pref_t;
+
+typedef struct wlc_scan_utils wlc_scan_utils_t;
+#ifdef ACKSUPR_MAC_FILTER
+typedef struct wlc_addrmatch_info wlc_addrmatch_info_t;
+#endif /* ACKSUPR_MAC_FILTER */
+
+typedef struct cca_ucode_counts cca_ucode_counts_t;
+typedef struct cca_chan_qual cca_chan_qual_t;
+
+typedef struct wlc_perf_utils wlc_perf_utils_t;
+typedef struct wlc_test_info wlc_test_info_t;
+
+typedef struct chanswitch_times chanswitch_times_t;
+typedef struct wlc_dump_info wlc_dump_info_t;
+
+typedef struct wlc_stf wlc_stf_t;
+typedef struct wlc_rsdb_policymgr_info wlc_rsdb_policymgr_info_t;
+
+typedef struct wlc_he_info wlc_he_info_t;
+typedef struct wlc_twt_info wlc_twt_info_t;
+
+/* TWT_STATS */
+typedef wl_twt_peer_stats_v1_t wl_twt_peer_stats_t;
+typedef wl_twt_stats_v1_t wl_twt_stats_t;
+typedef wl_twt_stats_cmd_v1_t wl_twt_stats_cmd_t;
+
+typedef struct wlc_heb_info wlc_heb_info_t;
+
+typedef struct resv_info resv_info_t;
+
+typedef struct wl_scan_summary wl_scan_summary_t;
+
+typedef struct wlc_stf_arb wlc_stf_arb_t;
+
+typedef struct wlc_stf_nss_request_st wlc_stf_nss_request_t;
+
+typedef struct wlc_stf_nss_request_q_st wlc_stf_nss_request_q_t;
+
+typedef struct wl_mimo_siso_stats wl_mimo_siso_stats_t;
+
+typedef struct wlc_mimo_ps_cfg wlc_mimo_ps_cfg_t;
+
+typedef struct wlc_hw_config wlc_hw_config_t;
+
+typedef struct wlc_stf_arb_mps_info wlc_stf_arb_mps_info_t;
+
+typedef struct wlc_tsync wlc_tsync_t;
+
+typedef struct wlc_fragdur_info wlc_fragdur_info_t;
+
+typedef struct wlc_mbo_info wlc_mbo_info_t;
+
+typedef struct wlc_rx_hc wlc_rx_hc_t;
+
+typedef struct wlc_oce_info wlc_oce_info_t;
+
+typedef struct wlc_fils_info wlc_fils_info_t;
+
+typedef struct wlc_sfd_cache wlc_sfd_cache_t;
+
+typedef struct wlc_ifstats_info wlc_ifstats_info_t;
+
+typedef struct wlc_mbo_oce_info wlc_mbo_oce_info_t;
+
+typedef struct wlc_esp_info wlc_esp_info_t;
+
+/* sta_info_v6 uses rateset_v2 which supported only when RATESET_VERSION_ENABLED */
+#ifdef RATESET_VERSION_ENABLED
+typedef sta_info_v6_t sta_info_t;
+#else
+typedef sta_info_v5_t sta_info_t;
+#endif /* RATESET_VERSION_ENABLED */
+
+typedef struct wl_roam_prof_band_v3 wl_roam_prof_band_t;
+typedef struct wl_roam_prof_v3 wl_roam_prof_t;
+
+typedef struct wlc_swdiv_stats_v2 wlc_swdiv_stats_t;
+typedef struct wl_dfs_ap_move_status_v2 wl_dfs_ap_move_status_t;
+
+typedef struct wl_utrace_capture_args_v2 wl_utrace_capture_args_t;
+typedef struct wl_pmalert_ucode_dbg_v2 wl_pmalert_ucode_dbg_t;
+
+typedef struct wl_proxd_collect_data_v3 wl_proxd_collect_data_t;
+typedef struct wl_proxd_collect_event_data_v3 wl_proxd_collect_event_data_t;
+
+typedef struct wlc_leakyapstats_info_v1 wlc_leakyapstats_info_t;
+
+typedef struct wlc_chctx_info wlc_chctx_info_t;
+
+typedef struct wlc_rpsnoa_info wlc_rpsnoa_info_t;
+
+/* Inteface version mapping for versioned pfn structures */
+#undef PFN_SCANRESULT_VERSION
+#define PFN_SCANRESULT_VERSION PFN_SCANRESULT_VERSION_V2
+#define PFN_SCANRESULTS_VERSION PFN_SCANRESULTS_VERSION_V2
+#define PFN_LBEST_SCAN_RESULT_VERSION PFN_LBEST_SCAN_RESULT_VERSION_V2
+typedef wl_pfn_subnet_info_v2_t wl_pfn_subnet_info_t;
+typedef wl_pfn_net_info_v2_t wl_pfn_net_info_t;
+typedef wl_pfn_lnet_info_v2_t wl_pfn_lnet_info_t;
+typedef wl_pfn_lscanresults_v2_t wl_pfn_lscanresults_t;
+typedef wl_pfn_scanresults_v2_t wl_pfn_scanresults_t;
+typedef wl_pfn_scanresult_v2_1_t wl_pfn_scanresult_t;
+
+/* XXX: 13_10 uses interface_create_v3 */
+#define WL_INTERFACE_CREATE_VER                WL_INTERFACE_CREATE_VER_3
+typedef wl_interface_create_v3_t wl_interface_create_t;
+
+#define WL_INTERFACE_INFO_VER          WL_INTERFACE_INFO_VER_2
+typedef wl_interface_info_v2_t wl_interface_info_t;
+
+#define WL_PKTENG_RU_FILL_CURRENT_VER  WL_PKTENG_RU_FILL_VER_2
+
+typedef struct wlc_hwa_info wlc_hwa_info_t;
+#define UCM_PROFILE_VERSION UCM_PROFILE_VERSION_1
+typedef wlc_btcx_profile_v1_t wlc_btcx_profile_t;
+
+#ifndef WL_BTCXSTATS
+#define BTCX_STATS_VER BTCX_STATS_VER_3
+typedef wlc_btc_stats_v3_t wlc_btc_stats_t;
+#else
+#define BTCX_STATS_VER BTCX_STATS_VER_4
+typedef wlc_btc_stats_v4_t wlc_btc_stats_t;
+#endif
+
+#define WL_BTC_WIFI_PROT_VER WL_BTC_WIFI_PROT_VER_1
+typedef wl_btc_wifi_prot_v1_t wl_btc_wifi_prot_t;
+
+/* TXQ MUX Broadcast/Multicast module and cubby structure definition */
+typedef struct wlc_bcmcq_info wlc_bcmcq_info_t;
+typedef struct bcmc_cubby bcmc_cubby_t;
+
+typedef struct wlc_ratelinkmem_info wlc_ratelinkmem_info_t;
+
+typedef wl_proxd_params_tof_tune_v3_t wl_proxd_params_tof_tune_t;
+
+/* ranging context */
+typedef struct wlc_ftm_ranging_ctx wlc_ftm_ranging_ctx_t;
+
+#define ETD_DATA_VERSION ETD_DATA_VERSION_V1
+typedef etd_data_v1_t etd_data_t;
+typedef etd_tag_data_v1_t etd_tag_data_t;
+typedef join_classification_info_v1_t join_classification_info_t;
+typedef join_target_classification_info_v1_t join_target_classification_info_t;
+typedef join_assoc_state_v1_t join_assoc_state_t;
+typedef join_channel_v1_t join_channel_t;
+typedef join_total_attempts_num_v1_t join_total_attempts_num_t;
+
+typedef rmc_bss_info_v1_t rmc_bss_info_t;
+typedef rmc_candidate_info_v1_t rmc_candidate_info_t;
+
+typedef struct wlc_adps_info wlc_adps_info_t;
+typedef event_ecounters_config_request_v2_t ecounters_event_based_config_t;
+
+#define WL_BAM_CMD_ENABLE      WL_BAM_CMD_ENABLE_V1
+#define WL_BAM_CMD_DISABLE     WL_BAM_CMD_DISABLE_V1
+#define WL_BAM_CMD_CONFIG      WL_BAM_CMD_CONFIG_V1
+#define WL_BAM_CMD_DUMP                WL_BAM_CMD_DUMP_V1
+typedef struct wlc_bam_info wlc_bam_info_t;
+typedef struct wl_bam_iov_enable_v1 wl_bam_iov_enable_type;
+typedef struct wl_bam_iov_enable_v1 wl_bam_iov_disable_type;
+typedef struct wl_bam_iov_config_v1 wl_bam_iov_config_type;
+typedef struct wl_bam_iov_dump_v1 wl_bam_iov_dump_type;
+typedef struct wl_bam_iov_bcn_config_v1 wl_bam_iov_bcn_config_type;
+typedef struct wl_bam_iov_dump_bcn_elem_v1 wl_bam_iov_dump_bcn_elem_type;
+
+typedef struct chanswitch_hist_info wl_chsw_hist_info_t;
+typedef struct wlc_tdm_tx_info wlc_tdm_tx_info_t;
+#ifdef WL_TDMTX_TYPEDEF_HAS_ALIAS
+typedef tdmtx_cnt_v2_t tdmtx_cnt_t;
+typedef tdmtx_cnt_shm_v2_t tdmtx_cnt_shm_t;
+typedef wl_tdmtx_ecounters_v2_t wl_tdmtx_ecounters_t;
+#define WL_CNT_TDMTX_STRUCT_SZ (sizeof(tdmtx_cnt_t))
+#define WL_CNT_TDMTX_SHM_SZ (sizeof(tdmtx_cnt_shm_t))
+#endif
+typedef struct wlc_tvpm_info wlc_tvpm_info_t;
+
+#define WL_HEB_CURRENT_VER WL_HEB_VER_1
+
+typedef wl_heb_cnt_v1_t wl_heb_cnt_t;
+typedef wl_config_heb_fill_v1_t wl_config_heb_fill_t;
+typedef wl_heb_blk_params_v1_t wl_heb_blk_params_t;
+typedef wl_heb_reg_status_v1_t wl_heb_reg_status_t;
+typedef wl_heb_status_v1_t wl_heb_status_t;
+typedef wl_heb_int_cnt_v1_t wl_heb_int_cnt_t;
+
+typedef struct wl_proxd_rtt_sample_v2 wl_proxd_rtt_sample_t;
+typedef struct wl_proxd_rtt_result_v2 wl_proxd_rtt_result_t;
+
+#ifdef RATESET_VERSION_ENABLED
+/* all rateset_args structures and version updates will come here */
+#define RATESET_ARGS_VERSION   (RATESET_ARGS_V2)
+typedef wl_rateset_args_v2_t wl_rateset_args_t;
+#endif /* RATESET_VERSION_ENABLED */
+
+#ifdef WL_PKTENG_STATS_TYPEDEF_HAS_ALIAS
+typedef wl_pkteng_stats_v2_t wl_pkteng_stats_t;
+#endif /* WL_PKTENG_STATS_TYPEDEF_HAS_ALIAS */
+
+#ifdef WL_BSS_INFO_TYPEDEF_HAS_ALIAS
+typedef wl_bss_info_v109_2_t wl_bss_info_t;
+
+typedef wl_gscan_bss_info_v3_t wl_gscan_bss_info_t;
+#define WL_GSCAN_INFO_FIXED_FIELD_SIZE   (OFFSETOF(wl_gscan_bss_info_t, info))
+
+typedef wl_scan_results_v2_t wl_scan_results_t;
+/** size of wl_scan_results not including variable length array */
+#define WL_SCAN_RESULTS_FIXED_SIZE (OFFSETOF(wl_scan_results_t, bss_info))
+
+typedef wl_escan_result_v2_t wl_escan_result_t;
+#define WL_ESCAN_RESULTS_FIXED_SIZE (OFFSETOF(wl_escan_result_t, bss_info))
+
+typedef wl_iscan_results_v2_t wl_iscan_results_t;
+/** size of wl_iscan_results not including variable length array */
+#define WL_ISCAN_RESULTS_FIXED_SIZE \
+       (WL_SCAN_RESULTS_FIXED_SIZE + OFFSETOF(wl_iscan_results_t, results))
+
+typedef wl_gscan_result_v2_1_t wl_gscan_result_t;
+#define WL_GSCAN_RESULTS_FIXED_SIZE (OFFSETOF(wl_gscan_result_t, bss_info))
+#endif /* WL_BSS_INFO_TYPEDEF_HAS_ALIAS */
+
+#define WLC_ALLOCMEM_POSTREV80
+
+typedef uint8 wlc_mbsp_sel_t;
+typedef uint8 dot11_mbsp_sel_t;
+
+#ifdef WL_PKTENG_RU_VER
+typedef wl_pkteng_ru_v2_t wl_pkteng_ru_fill_t;
+#endif
+
+typedef wl_msglevel_v1_t wl_msglevel_t;
+#define WL_MSGLEVEL_STRUCT_VERSION WL_MSGLEVEL_STRUCT_VERSION_1
+
+typedef struct wlc_tpa_info wlc_tpa_info_t;
+
+typedef struct wl_event_mbo wl_event_mbo_t;
+typedef struct wl_event_mbo_cell_nw_switch wl_event_mbo_cell_nw_switch_t;
+typedef struct wbrq_process_data wbrq_process_data_t;
+typedef struct wbrq_process_res wbrq_process_res_t;
+typedef struct wlc_lphs_info wlc_lphs_info_t;
+
+typedef struct wlc_obj_registry wlc_obj_registry_t;
+
+#ifdef WL_EVENT_RX_FRAME_DATA_ALIAS
+#define BCM_RX_FRAME_DATA_VERSION BCM_RX_FRAME_DATA_VERSION_2
+typedef wl_event_rx_frame_data_v2_t wl_event_rx_frame_data_t;
+#endif
+
+#ifdef ECOUNTERS_COMPACT
+typedef wl_periodic_compact_cntrs_v3_t wl_periodic_compact_cntrs_t;
+typedef wl_periodic_txbf_cntrs_v1_t wl_periodic_txbf_cntrs_t;
+typedef wl_event_based_statistics_v3_t wl_event_based_statistics_t;
+#endif /* ECOUNTERS_COMPACT */
+
+typedef struct wlc_sae_cubby wlc_sae_cubby_t;
+typedef struct wlc_sae_info wlc_sae_info_t;
+
+typedef struct wlc_owe_info wlc_owe_info_t;
+
+#ifdef PMKID_VERSION_ENABLED
+#define PMKID_VERSION  (PMKID_LIST_VER_3)
+typedef pmkid_v3_t pmkid_t;
+typedef pmkid_list_v3_t pmkid_list_t;
+#endif /* PMKID_VERSION_ENABLED */
+
+typedef struct wlc_txdc_info wlc_txdc_info_t;
+/* PHY health check */
+typedef wl_hc_desense_stats_v1_t wl_hc_desense_stats_t;
+typedef wl_hc_temp_stats_v2_t wl_hc_temp_stats_t;
+typedef wl_hc_vcocal_stats_v1_t wl_hc_vcocal_stats_t;
+typedef wl_hc_txpwr_stats_v2_t wl_hc_txpwr_stats_t;
+
+typedef wl_scb_ecounters_v2_t wl_scb_ecounters_t;
+typedef wl_nan_slot_ecounters_v1_t wl_nan_slot_ecounters_t;
+typedef wlc_scb_stats_v1_t wlc_scb_stats_t;
+
+typedef struct wlc_hw_cmn_info wlc_hw_cmn_info_t;
+typedef struct wlc_hw_tunables wlc_hw_tunables_t;
+
+typedef struct wlc_rxsig_info wlc_rxsig_info_t;
+typedef struct wlc_rxsig_hw_info wlc_rxsig_hw_info_t;
+
+typedef struct wlc_hw_macint_regs wlc_hw_macint_regs_t;
+
+#ifdef WL_SAE
+typedef struct wlc_sae_info wlc_sae_info_t;
+#endif
+#if defined(BCM_EWP) || defined(BCM_SDC)
+typedef wl_hist_compact_toss_stats_v2_t wl_hist_compact_toss_stats_t;
+#endif /* BCM_EWP */
+typedef struct wlc_ewp_info wlc_ewp_info_t;
+typedef struct wlc_ewp_htr_db wlc_ewp_htr_db_t;
+
+typedef struct wl_sc_info wl_sc_info_t;
+
+typedef struct wlc_swdiv_hw_info wlc_swdiv_hw_info_t;
+typedef struct wlc_ltecx_hw_info wlc_ltecx_hw_info_t;
+typedef struct wlc_stf_hw_info wlc_stf_hw_info_t;
+
+typedef struct wlc_macdbg_hw_info wlc_macdbg_hw_info_t;
+typedef struct wlc_perf_stats wlc_perf_stats_t;
+
+typedef wl_cnt_ge80mcst_v1_t wl_cnt_ge80mcst_t;
+typedef wl_cnt_ge40mcst_v1_t wl_cnt_ge40mcst_t;
+
+#ifdef HE_COUNTERS_VERSION_ENABLED
+#define HE_COUNTERS_VERSION    (HE_COUNTERS_V2)
+typedef wl_he_cnt_wlc_v2_t wl_he_cnt_wlc_t;
+#endif /* HE_COUNTERS_VERSION_ENABLED */
+typedef wl_compact_he_cnt_wlc_v2_t wl_compact_he_cnt_wlc_t;
+
+typedef struct wlc_cm_info wlc_cm_info_t;
+typedef struct wlc_cm_data wlc_cm_data_t;
+
+typedef struct wlc_calload_info wlc_calload_info_t;
+typedef struct wlc_reinit_st wlc_reinit_st_t;
+typedef wl_prio_roam_prof_v1_t wl_prio_roam_prof_t;
+
+#ifdef WL_ANQPO_PEER_LIST_TYPEDEF_HAS_ALIAS
+#define WL_ANQPO_PEER_LIST_VERSION WL_ANQPO_PEER_LIST_VERSION_2
+typedef wl_anqpo_peer_list_v2_t wl_anqpo_peer_list_t;
+typedef wl_anqpo_peer_v2_t wl_anqpo_peer_t;
+#endif /* WL_ANQPO_PEER_LIST_VERSION */
+
+typedef roamstats_counter_info_v1_t roamstats_counter_info_t;
+typedef roamstats_prev_roam_events_v1_t roamstats_prev_roam_events_t;
+typedef roamstats_reason_info_v1_t roamstats_reason_info_t;
+#undef SSSR_REG_INFO_VER
+#define SSSR_REG_INFO_VER SSSR_REG_INFO_VER_2
+
+typedef struct tdls_bss_info tdls_bss_info_t;
+typedef wl_bsstrans_rssi_rate_map_v2_t wl_bsstrans_rssi_rate_map_ext_t;
+
+#ifdef ETD
+#define MAX_DMAFIFO_DESC_ENTRIES       MAX_DMAFIFO_DESC_ENTRIES_V1
+#define MAX_DMAFIFO_ENTRIES            MAX_DMAFIFO_ENTRIES_V1
+typedef struct hnd_ext_trap_desc_entry_v1 dma_dentry_t;
+typedef struct hnd_ext_trap_dma_fifo_v1 dma_fifo_t;
+typedef struct hnd_ext_trap_axi_error_v1 hnd_ext_trap_axi_error_t;
+#else
+typedef void hnd_ext_trap_axi_error_t;
+#endif /* ETD */
+
+typedef struct wl_btm_event_type_data wl_btm_event_type_data_t;
+typedef struct wl_bssid_prune_evt_info wl_bssid_pruned_evt_info_t;
+
+#ifdef ETD
+typedef struct hnd_ext_trap_phydbg_v3 hnd_etd_phydbg_t;
+typedef struct hnd_ext_trap_wlc_mem_err_v3 hnd_ext_trap_wlc_mem_err_info_t;
+#define HND_EXT_TRAP_WLC_MEM_ERR_VER HND_EXT_TRAP_WLC_MEM_ERR_VER_V3
+#endif
+typedef key_update_info_v1_t key_update_info_t;
+typedef wl_omi_req_v1_t wl_omi_req_t;
+typedef wl_omi_status_v1_t wl_omi_status_t;
+#define WL_OMI_STATUS_VERSION WL_OMI_STATUS_VERSION_1
+#define WL_OMI_CONFIG_VERSION WL_OMI_CONFIG_VERSION_1
+
+#endif /* _wlc_types_h_ */
diff --git a/bcmdhd.101.10.240.x/wldev_common.c b/bcmdhd.101.10.240.x/wldev_common.c
new file mode 100644 (file)
index 0000000..c0a5f2d
--- /dev/null
@@ -0,0 +1,528 @@
+/*
+ * Common function shared by Linux WEXT, cfg80211 and p2p drivers
+ *
+ * Copyright (C) 2020, Broadcom.
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Dual:>>
+ */
+
+#include <osl.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+
+#include <wldev_common.h>
+#include <bcmutils.h>
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#include <wl_cfgscan.h>
+#endif /* WL_CFG80211 */
+#include <dhd_config.h>
+
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+
+#define        WLDEV_ERROR_MSG(x, args...)                                             \
+       do {                                                                                            \
+               printk(KERN_INFO "[dhd] WLDEV-ERROR) " x, ## args);     \
+       } while (0)
+#define WLDEV_ERROR(x) WLDEV_ERROR_MSG x
+
+#define        WLDEV_INFO_MSG(x, args...)                                              \
+       do {                                                                                            \
+               printk(KERN_INFO "[dhd] WLDEV-INFO) " x, ## args);      \
+       } while (0)
+#define WLDEV_INFO(x) WLDEV_INFO_MSG x
+
+extern int dhd_ioctl_entry_local(struct net_device *net, wl_ioctl_t *ioc, int cmd);
+
+s32 wldev_ioctl(
+       struct net_device *dev, u32 cmd, void *arg, u32 len, u32 set)
+{
+       s32 ret = 0;
+       struct wl_ioctl  ioc;
+
+       bzero(&ioc, sizeof(ioc));
+       ioc.cmd = cmd;
+       ioc.buf = arg;
+       ioc.len = len;
+       ioc.set = set;
+       ret = dhd_ioctl_entry_local(dev, (wl_ioctl_t *)&ioc, cmd);
+
+       return ret;
+}
+
+/*
+SET commands :
+cast buffer to non-const  and call the GET function
+*/
+
+s32 wldev_ioctl_set(
+       struct net_device *dev, u32 cmd, const void *arg, u32 len)
+{
+
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wcast-qual"
+#endif
+       return wldev_ioctl(dev, cmd, (void *)arg, len, 1);
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
+
+}
+
+s32 wldev_ioctl_get(
+       struct net_device *dev, u32 cmd, void *arg, u32 len)
+{
+       return wldev_ioctl(dev, cmd, (void *)arg, len, 0);
+}
+
+/* Format a iovar buffer, not bsscfg indexed. The bsscfg index will be
+ * taken care of in dhd_ioctl_entry. Internal use only, not exposed to
+ * wl_iw, wl_cfg80211 and wl_cfgp2p
+ */
+static s32 wldev_mkiovar(
+       const s8 *iovar_name, const s8 *param, u32 paramlen,
+       s8 *iovar_buf, u32 buflen)
+{
+       s32 iolen = 0;
+
+       iolen = bcm_mkiovar(iovar_name, param, paramlen, iovar_buf, buflen);
+       return iolen;
+}
+
+s32 wldev_iovar_getbuf(
+       struct net_device *dev, s8 *iovar_name,
+       const void *param, u32 paramlen, void *buf, u32 buflen, struct mutex* buf_sync)
+{
+       s32 ret = 0;
+       if (buf_sync) {
+               mutex_lock(buf_sync);
+       }
+
+       if (buf && (buflen > 0)) {
+               /* initialize the response buffer */
+               bzero(buf, buflen);
+       } else {
+               ret = BCME_BADARG;
+               goto exit;
+       }
+
+       ret = wldev_mkiovar(iovar_name, param, paramlen, buf, buflen);
+
+       if (!ret) {
+               ret = BCME_BUFTOOSHORT;
+               goto exit;
+       }
+       ret = wldev_ioctl_get(dev, WLC_GET_VAR, buf, buflen);
+exit:
+       if (buf_sync)
+               mutex_unlock(buf_sync);
+       return ret;
+}
+
+s32 wldev_iovar_setbuf(
+       struct net_device *dev, s8 *iovar_name,
+       const void *param, s32 paramlen, void *buf, s32 buflen, struct mutex* buf_sync)
+{
+       s32 ret = 0;
+       s32 iovar_len;
+       if (buf_sync) {
+               mutex_lock(buf_sync);
+       }
+       iovar_len = wldev_mkiovar(iovar_name, param, paramlen, buf, buflen);
+       if (iovar_len > 0)
+               ret = wldev_ioctl_set(dev, WLC_SET_VAR, buf, iovar_len);
+       else
+               ret = BCME_BUFTOOSHORT;
+
+       if (buf_sync)
+               mutex_unlock(buf_sync);
+       return ret;
+}
+
+s32 wldev_iovar_setint(
+       struct net_device *dev, s8 *iovar, s32 val)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+
+       val = htod32(val);
+       bzero(iovar_buf, sizeof(iovar_buf));
+       return wldev_iovar_setbuf(dev, iovar, &val, sizeof(val), iovar_buf,
+               sizeof(iovar_buf), NULL);
+}
+
+s32 wldev_iovar_getint(
+       struct net_device *dev, s8 *iovar, s32 *pval)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       s32 err;
+
+       bzero(iovar_buf, sizeof(iovar_buf));
+       err = wldev_iovar_getbuf(dev, iovar, pval, sizeof(*pval), iovar_buf,
+               sizeof(iovar_buf), NULL);
+       if (err == 0)
+       {
+               memcpy(pval, iovar_buf, sizeof(*pval));
+               *pval = dtoh32(*pval);
+       }
+       return err;
+}
+
+/** Format a bsscfg indexed iovar buffer. The bsscfg index will be
+ *  taken care of in dhd_ioctl_entry. Internal use only, not exposed to
+ *  wl_iw, wl_cfg80211 and wl_cfgp2p
+ */
+s32 wldev_mkiovar_bsscfg(
+       const s8 *iovar_name, const s8 *param, s32 paramlen,
+       s8 *iovar_buf, s32 buflen, s32 bssidx)
+{
+       const s8 *prefix = "bsscfg:";
+       s8 *p;
+       u32 prefixlen;
+       u32 namelen;
+       u32 iolen;
+
+       /* initialize buffer */
+       if (!iovar_buf || buflen <= 0)
+               return BCME_BADARG;
+       bzero(iovar_buf, buflen);
+
+       if (bssidx == 0) {
+               return wldev_mkiovar(iovar_name, param, paramlen,
+                       iovar_buf, buflen);
+       }
+
+       prefixlen = (u32) strlen(prefix); /* lengh of bsscfg prefix */
+       namelen = (u32) strlen(iovar_name) + 1; /* lengh of iovar  name + null */
+       iolen = prefixlen + namelen + sizeof(u32) + paramlen;
+
+       if (iolen > (u32)buflen) {
+               WLDEV_ERROR(("wldev_mkiovar_bsscfg: buffer is too short\n"));
+               return BCME_BUFTOOSHORT;
+       }
+
+       p = (s8 *)iovar_buf;
+
+       /* copy prefix, no null */
+       memcpy(p, prefix, prefixlen);
+       p += prefixlen;
+
+       /* copy iovar name including null */
+       memcpy(p, iovar_name, namelen);
+       p += namelen;
+
+       /* bss config index as first param */
+       bssidx = htod32(bssidx);
+       memcpy(p, &bssidx, sizeof(u32));
+       p += sizeof(u32);
+
+       /* parameter buffer follows */
+       if (paramlen)
+               memcpy(p, param, paramlen);
+
+       return iolen;
+
+}
+
+s32 wldev_iovar_getbuf_bsscfg(
+       struct net_device *dev, s8 *iovar_name,
+       void *param, s32 paramlen, void *buf, s32 buflen, s32 bsscfg_idx, struct mutex* buf_sync)
+{
+       s32 ret = 0;
+       if (buf_sync) {
+               mutex_lock(buf_sync);
+       }
+
+       wldev_mkiovar_bsscfg(iovar_name, param, paramlen, buf, buflen, bsscfg_idx);
+       ret = wldev_ioctl_get(dev, WLC_GET_VAR, buf, buflen);
+       if (buf_sync) {
+               mutex_unlock(buf_sync);
+       }
+       return ret;
+
+}
+
+s32 wldev_iovar_setbuf_bsscfg(
+       struct net_device *dev, const s8 *iovar_name,
+       const void *param, s32 paramlen,
+       void *buf, s32 buflen, s32 bsscfg_idx, struct mutex* buf_sync)
+{
+       s32 ret = 0;
+       s32 iovar_len;
+       if (buf_sync) {
+               mutex_lock(buf_sync);
+       }
+       iovar_len = wldev_mkiovar_bsscfg(iovar_name, param, paramlen, buf, buflen, bsscfg_idx);
+       if (iovar_len > 0)
+               ret = wldev_ioctl_set(dev, WLC_SET_VAR, buf, iovar_len);
+       else {
+               ret = BCME_BUFTOOSHORT;
+       }
+
+       if (buf_sync) {
+               mutex_unlock(buf_sync);
+       }
+       return ret;
+}
+
+s32 wldev_iovar_setint_bsscfg(
+       struct net_device *dev, s8 *iovar, s32 val, s32 bssidx)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+
+       val = htod32(val);
+       bzero(iovar_buf, sizeof(iovar_buf));
+       return wldev_iovar_setbuf_bsscfg(dev, iovar, &val, sizeof(val), iovar_buf,
+               sizeof(iovar_buf), bssidx, NULL);
+}
+
+s32 wldev_iovar_getint_bsscfg(
+       struct net_device *dev, s8 *iovar, s32 *pval, s32 bssidx)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       s32 err;
+
+       bzero(iovar_buf, sizeof(iovar_buf));
+       err = wldev_iovar_getbuf_bsscfg(dev, iovar, pval, sizeof(*pval), iovar_buf,
+               sizeof(iovar_buf), bssidx, NULL);
+       if (err == 0)
+       {
+               memcpy(pval, iovar_buf, sizeof(*pval));
+               *pval = dtoh32(*pval);
+       }
+       return err;
+}
+
+int wldev_get_link_speed(
+       struct net_device *dev, int *plink_speed)
+{
+       int error;
+
+       if (!plink_speed)
+               return -ENOMEM;
+       *plink_speed = 0;
+       error = wldev_ioctl_get(dev, WLC_GET_RATE, plink_speed, sizeof(int));
+       if (unlikely(error))
+               return error;
+
+       /* Convert internal 500Kbps to Kbps */
+       *plink_speed *= 500;
+       return error;
+}
+
+int wldev_get_rssi(
+       struct net_device *dev, scb_val_t *scb_val)
+{
+       int error;
+
+       if (!scb_val)
+               return -ENOMEM;
+       bzero(scb_val, sizeof(scb_val_t));
+       error = wldev_ioctl_get(dev, WLC_GET_RSSI, scb_val, sizeof(scb_val_t));
+       if (unlikely(error))
+               return error;
+
+       return error;
+}
+
+int wldev_get_ssid(
+       struct net_device *dev, wlc_ssid_t *pssid)
+{
+       int error;
+
+       if (!pssid)
+               return -ENOMEM;
+       bzero(pssid, sizeof(wlc_ssid_t));
+       error = wldev_ioctl_get(dev, WLC_GET_SSID, pssid, sizeof(wlc_ssid_t));
+       if (unlikely(error))
+               return error;
+       pssid->SSID_len = dtoh32(pssid->SSID_len);
+       return error;
+}
+
+int wldev_get_band(
+       struct net_device *dev, uint *pband)
+{
+       int error;
+
+       *pband = 0;
+       error = wldev_ioctl_get(dev, WLC_GET_BAND, pband, sizeof(uint));
+       return error;
+}
+
+int wldev_set_band(
+       struct net_device *dev, uint band)
+{
+       int error = -1;
+
+       if ((band == WLC_BAND_AUTO) || (band == WLC_BAND_5G) || (band == WLC_BAND_2G)) {
+               error = wldev_ioctl_set(dev, WLC_SET_BAND, &band, sizeof(band));
+               if (!error)
+                       dhd_bus_band_set(dev, band);
+       }
+       return error;
+}
+int wldev_get_datarate(struct net_device *dev, int *datarate)
+{
+       int error = 0;
+
+       error = wldev_ioctl_get(dev, WLC_GET_RATE, datarate, sizeof(int));
+       if (error) {
+               return -1;
+       } else {
+               *datarate = dtoh32(*datarate);
+       }
+
+       return error;
+}
+
+#ifdef WL_CFG80211
+extern chanspec_t
+wl_chspec_driver_to_host(chanspec_t chanspec);
+#define WL_EXTRA_BUF_MAX 2048
+int wldev_get_mode(
+       struct net_device *dev, uint8 *cap, uint8 caplen)
+{
+       int error = 0;
+       int chanspec = 0;
+       uint16 band = 0;
+       uint16 bandwidth = 0;
+       wl_bss_info_t *bss = NULL;
+       char* buf = NULL;
+
+       buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
+       if (!buf) {
+               WLDEV_ERROR(("%s:ENOMEM\n", __FUNCTION__));
+               return -ENOMEM;
+       }
+
+       *(u32*) buf = htod32(WL_EXTRA_BUF_MAX);
+       error = wldev_ioctl_get(dev, WLC_GET_BSS_INFO, (void*)buf, WL_EXTRA_BUF_MAX);
+       if (error) {
+               WLDEV_ERROR(("%s:failed:%d\n", __FUNCTION__, error));
+               kfree(buf);
+               buf = NULL;
+               return error;
+       }
+       bss = (wl_bss_info_t*)(buf + 4);
+       chanspec = wl_chspec_driver_to_host(bss->chanspec);
+
+       band = chanspec & WL_CHANSPEC_BAND_MASK;
+       bandwidth = chanspec & WL_CHANSPEC_BW_MASK;
+
+       if (band == WL_CHANSPEC_BAND_2G) {
+               if (bss->n_cap)
+                       strlcpy(cap, "n", caplen);
+               else
+                       strlcpy(cap, "bg", caplen);
+       } else if (band == WL_CHANSPEC_BAND_5G) {
+               if (bandwidth == WL_CHANSPEC_BW_80)
+                       strlcpy(cap, "ac", caplen);
+               else if ((bandwidth == WL_CHANSPEC_BW_40) || (bandwidth == WL_CHANSPEC_BW_20)) {
+                       if ((bss->nbss_cap & 0xf00) && (bss->n_cap))
+                               strlcpy(cap, "n|ac", caplen);
+                       else if (bss->n_cap)
+                               strlcpy(cap, "n", caplen);
+                       else if (bss->vht_cap)
+                               strlcpy(cap, "ac", caplen);
+                       else
+                               strlcpy(cap, "a", caplen);
+               } else {
+                       WLDEV_ERROR(("wldev_get_mode: Mode get failed\n"));
+                       error = BCME_ERROR;
+               }
+
+       }
+       kfree(buf);
+       buf = NULL;
+       return error;
+}
+#endif
+
+int wldev_set_country(
+       struct net_device *dev, char *country_code, bool notify, bool user_enforced, int revinfo)
+{
+       int error = -1;
+       wl_country_t cspec = {{0}, 0, {0}};
+       scb_val_t scbval;
+#ifdef WL_CFG80211
+       struct wireless_dev *wdev = ndev_to_wdev(dev);
+       struct wiphy *wiphy = wdev->wiphy;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+#endif /* WL_CFG80211 */
+
+       if (!country_code)
+               return error;
+
+       bzero(&scbval, sizeof(scb_val_t));
+       error = wldev_iovar_getbuf(dev, "country", NULL, 0, &cspec, sizeof(cspec), NULL);
+       if (error < 0) {
+               WLDEV_ERROR(("%s: get country failed = %d\n", __FUNCTION__, error));
+               return error;
+       }
+
+       if ((error < 0) ||
+               dhd_force_country_change(dev) ||
+           (strncmp(country_code, cspec.ccode, WLC_CNTRY_BUF_SZ) != 0)) {
+
+#ifdef WL_CFG80211
+               if ((user_enforced) && (wl_get_drv_status(cfg, CONNECTED, dev)))
+#else
+               if (user_enforced)
+#endif /* WL_CFG80211 */
+               {
+                       bzero(&scbval, sizeof(scb_val_t));
+                       error = wldev_ioctl_set(dev, WLC_DISASSOC,
+                                               &scbval, sizeof(scb_val_t));
+                       if (error < 0) {
+                               WLDEV_ERROR(("%s: set country failed due to Disassoc error %d\n",
+                                       __FUNCTION__, error));
+                               return error;
+                       }
+               }
+
+#ifdef WL_CFG80211
+               wl_cfg80211_scan_abort(cfg);
+#endif
+
+               cspec.rev = revinfo;
+               strlcpy(cspec.country_abbrev, country_code, WLC_CNTRY_BUF_SZ);
+               strlcpy(cspec.ccode, country_code, WLC_CNTRY_BUF_SZ);
+               error = dhd_conf_map_country_list(dhd_get_pub(dev), &cspec);
+               if (error)
+                       dhd_get_customized_country_code(dev, (char *)&cspec.country_abbrev, &cspec);
+               error = dhd_conf_set_country(dhd_get_pub(dev), &cspec);
+               if (error < 0) {
+                       WLDEV_ERROR(("%s: set country for %s as %s rev %d failed\n",
+                               __FUNCTION__, country_code, cspec.ccode, cspec.rev));
+                       return error;
+               }
+               dhd_conf_fix_country(dhd_get_pub(dev));
+               dhd_conf_get_country(dhd_get_pub(dev), &cspec);
+               dhd_bus_country_set(dev, &cspec, notify);
+               printf("%s: set country for %s as %s rev %d\n",
+                       __FUNCTION__, country_code, cspec.ccode, cspec.rev);
+       }
+       return 0;
+}